xmrig | 6263bfaec3b8579db3d1b6b2081421e0e80f19fe22f637f5d22463b25df73898

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
06-07-2024 04:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44fd2dafcc91e4c5e3237c8c79ec73f0.exe
Size

973KB
MD5

44fd2dafcc91e4c5e3237c8c79ec73f0
SHA1

e6d95a07e70c1bae37e062ec912b3acb0d751fc1
SHA256

6263bfaec3b8579db3d1b6b2081421e0e80f19fe22f637f5d22463b25df73898
SHA512

8fb5300476880e8171fc5b16471d8bf7c1525ab62e0a0793e1aa55faf7c0f37e99ad10246eb61473476279a892404f9bf55431ff7c111470617edf68b747adfb
SSDEEP

24576:zv3/fTLF671TilQFG4P5PmK/lzapjlRPRWRQJIA:Lz071uv4BPm6l+XPRWdA

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 23 IoCs

miner

resource	yara_rule
behavioral1/memory/2204-13-0x000000013FC50000-0x0000000140042000-memory.dmp	xmrig
behavioral1/memory/2584-107-0x000000013F400000-0x000000013F7F2000-memory.dmp	xmrig
behavioral1/memory/1344-130-0x000000013F290000-0x000000013F682000-memory.dmp	xmrig
behavioral1/memory/2412-135-0x000000013F140000-0x000000013F532000-memory.dmp	xmrig
behavioral1/memory/2720-112-0x000000013F310000-0x000000013F702000-memory.dmp	xmrig
behavioral1/memory/1920-128-0x000000013FA30000-0x000000013FE22000-memory.dmp	xmrig
behavioral1/memory/2596-126-0x000000013F470000-0x000000013F862000-memory.dmp	xmrig
behavioral1/memory/2852-124-0x000000013F4A0000-0x000000013F892000-memory.dmp	xmrig
behavioral1/memory/2496-121-0x000000013F760000-0x000000013FB52000-memory.dmp	xmrig
behavioral1/memory/2708-116-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	xmrig
behavioral1/memory/2132-114-0x000000013FE60000-0x0000000140252000-memory.dmp	xmrig
behavioral1/memory/2596-4642-0x000000013F470000-0x000000013F862000-memory.dmp	xmrig
behavioral1/memory/2584-4658-0x000000013F400000-0x000000013F7F2000-memory.dmp	xmrig
behavioral1/memory/1920-4652-0x000000013FA30000-0x000000013FE22000-memory.dmp	xmrig
behavioral1/memory/1344-4648-0x000000013F290000-0x000000013F682000-memory.dmp	xmrig
behavioral1/memory/2204-4666-0x000000013FC50000-0x0000000140042000-memory.dmp	xmrig
behavioral1/memory/2132-4672-0x000000013FE60000-0x0000000140252000-memory.dmp	xmrig
behavioral1/memory/2496-4671-0x000000013F760000-0x000000013FB52000-memory.dmp	xmrig
behavioral1/memory/2412-4681-0x000000013F140000-0x000000013F532000-memory.dmp	xmrig
behavioral1/memory/2708-4717-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	xmrig
behavioral1/memory/2852-4721-0x000000013F4A0000-0x000000013F892000-memory.dmp	xmrig
behavioral1/memory/2720-4727-0x000000013F310000-0x000000013F702000-memory.dmp	xmrig
behavioral1/memory/2432-4736-0x000000013FE10000-0x0000000140202000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2744	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2204	lelJbwd.exe
2432	Euhesbh.exe
2584	DOTQShP.exe
2720	VQidJeu.exe
2132	kCLsiUd.exe
2708	szaKAYN.exe
2496	YUblngO.exe
2852	KdonYIn.exe
2596	DPCYhEN.exe
1920	epfTuJl.exe
1344	GdNHJUI.exe
2412	ehwJbCi.exe
2688	qnqNWdx.exe
2752	LZUrJqQ.exe
1872	oGstarh.exe
1864	moKDlXH.exe
2040	jnrJDYY.exe
2020	QPCkESc.exe
320	SwEtuak.exe
1480	mKTYbcg.exe
1868	QEAYkRs.exe
1836	JEDXJPa.exe
768	ihIcpMa.exe
580	kCjMeLM.exe
1428	eTwEKDV.exe
1144	UXpJWZD.exe
1648	gfikBNN.exe
1912	LUxaTtg.exe
2140	VevUmIx.exe
1208	qdRqAww.exe
1532	vXKmnnf.exe
1916	tXddiwM.exe
888	BMCfixy.exe
572	bHjadbs.exe
2080	dAlRxED.exe
1448	GFqaUiL.exe
1664	xcAeQMw.exe
1972	RGEdqIb.exe
884	nXtoKiD.exe
1700	HfYOfet.exe
2996	uYOqXQy.exe
2648	oVHezay.exe
2640	UAsmUqU.exe
2632	xZkQwmY.exe
2936	jPauaXO.exe
1200	oJhmXdl.exe
2680	WxLVcKF.exe
2944	ASmAHTp.exe
2560	NTOQtev.exe
2472	DmmQpwZ.exe
2400	EnGVmVG.exe
2028	sasHYWU.exe
1696	tTEadYI.exe
1604	jveOhEQ.exe
932	thSAtPW.exe
2976	iUcSqBu.exe
1360	KfdZuaD.exe
3044	OUGNlOk.exe
848	mBixUkJ.exe
2032	hVcWDUZ.exe
2660	iWhgiAF.exe
1624	fpNfZvM.exe
1060	TwwHWeZ.exe
2136	NxkzcWF.exe

Loads dropped DLL 64 IoCs

pid	Process
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe

UPX packed file 62 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3064-2-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	upx
behavioral1/files/0x000c000000013417-6.dat	upx
behavioral1/files/0x0036000000013a53-19.dat	upx
behavioral1/memory/2204-13-0x000000013FC50000-0x0000000140042000-memory.dmp	upx
behavioral1/files/0x0016000000005586-22.dat	upx
behavioral1/files/0x0007000000014251-29.dat	upx
behavioral1/files/0x000800000001432f-43.dat	upx
behavioral1/files/0x00070000000143fb-47.dat	upx
behavioral1/files/0x0006000000014a60-52.dat	upx
behavioral1/files/0x0006000000014b1c-57.dat	upx
behavioral1/files/0x0006000000014f57-69.dat	upx
behavioral1/files/0x0006000000015083-82.dat	upx
behavioral1/files/0x00060000000153ee-94.dat	upx
behavioral1/files/0x0036000000013a88-103.dat	upx
behavioral1/memory/2584-107-0x000000013F400000-0x000000013F7F2000-memory.dmp	upx
behavioral1/memory/2432-105-0x000000013FE10000-0x0000000140202000-memory.dmp	upx
behavioral1/files/0x00060000000158d9-123.dat	upx
behavioral1/memory/1344-130-0x000000013F290000-0x000000013F682000-memory.dmp	upx
behavioral1/files/0x0006000000015c9a-145.dat	upx
behavioral1/files/0x0006000000015cee-168.dat	upx
behavioral1/files/0x0006000000015d0a-173.dat	upx
behavioral1/files/0x0006000000015cd2-161.dat	upx
behavioral1/files/0x0006000000015cb1-154.dat	upx
behavioral1/files/0x0006000000015d59-184.dat	upx
behavioral1/files/0x0006000000015d21-177.dat	upx
behavioral1/files/0x0006000000015cf8-170.dat	upx
behavioral1/files/0x0006000000015ce3-163.dat	upx
behavioral1/files/0x0006000000015cc5-156.dat	upx
behavioral1/files/0x0006000000015ca8-149.dat	upx
behavioral1/memory/2412-135-0x000000013F140000-0x000000013F532000-memory.dmp	upx
behavioral1/memory/2720-112-0x000000013F310000-0x000000013F702000-memory.dmp	upx
behavioral1/files/0x0006000000015662-108.dat	upx
behavioral1/files/0x000600000001565a-97.dat	upx
behavioral1/files/0x0006000000015d61-189.dat	upx
behavioral1/files/0x0006000000015d39-182.dat	upx
behavioral1/files/0x0006000000015b50-140.dat	upx
behavioral1/memory/1920-128-0x000000013FA30000-0x000000013FE22000-memory.dmp	upx
behavioral1/memory/2596-126-0x000000013F470000-0x000000013F862000-memory.dmp	upx
behavioral1/memory/2852-124-0x000000013F4A0000-0x000000013F892000-memory.dmp	upx
behavioral1/memory/2496-121-0x000000013F760000-0x000000013FB52000-memory.dmp	upx
behavioral1/files/0x0006000000015b85-142.dat	upx
behavioral1/files/0x0006000000015ae3-132.dat	upx
behavioral1/memory/2708-116-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	upx
behavioral1/memory/2132-114-0x000000013FE60000-0x0000000140252000-memory.dmp	upx
behavioral1/files/0x00060000000150d9-89.dat	upx
behavioral1/files/0x000600000001507a-77.dat	upx
behavioral1/files/0x0006000000014c2d-67.dat	upx
behavioral1/files/0x0006000000014bd7-62.dat	upx
behavioral1/files/0x000b00000001431b-37.dat	upx
behavioral1/files/0x000800000001418c-27.dat	upx
behavioral1/memory/2596-4642-0x000000013F470000-0x000000013F862000-memory.dmp	upx
behavioral1/memory/2584-4658-0x000000013F400000-0x000000013F7F2000-memory.dmp	upx
behavioral1/memory/1920-4652-0x000000013FA30000-0x000000013FE22000-memory.dmp	upx
behavioral1/memory/1344-4648-0x000000013F290000-0x000000013F682000-memory.dmp	upx
behavioral1/memory/2204-4666-0x000000013FC50000-0x0000000140042000-memory.dmp	upx
behavioral1/memory/2132-4672-0x000000013FE60000-0x0000000140252000-memory.dmp	upx
behavioral1/memory/2496-4671-0x000000013F760000-0x000000013FB52000-memory.dmp	upx
behavioral1/memory/2412-4681-0x000000013F140000-0x000000013F532000-memory.dmp	upx
behavioral1/memory/2708-4717-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	upx
behavioral1/memory/2852-4721-0x000000013F4A0000-0x000000013F892000-memory.dmp	upx
behavioral1/memory/2720-4727-0x000000013F310000-0x000000013F702000-memory.dmp	upx
behavioral1/memory/2432-4736-0x000000013FE10000-0x0000000140202000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\wEBivNp.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\kVoMHbi.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\sjwCfFg.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\GhncWUM.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\qShiTLz.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\sKAYCAc.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\TrNJbpD.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\CWRaQsB.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\DkDLEkF.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\EpECGdV.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\IeYUuzg.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\pARsklI.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\AjjecDM.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\CauiQSi.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\MhUijMG.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\epnwauE.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\EDvopxl.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\mjjeTim.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\jYCZapo.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\hxWQTva.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\etvDiQf.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\gUAlJfL.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\iIXmTWn.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\WkzYzrf.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\zESWXQM.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\WxLVcKF.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\gzVPBST.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\avKtWqS.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\aybWxlT.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\njsWutz.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\lQNERBB.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\IVeKlsa.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\KBeGBkt.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\lvaRunB.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\jAOFeHw.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\EtavKSI.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\IvGzvSF.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\AmESMQB.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\ISBxoQn.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\mczYvEs.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\faOltDc.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\tHkrVNV.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\CzFCuNx.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\xofuyks.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\rBSvqlg.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\vxwtWqG.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\FGHCrRc.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\QowOEGT.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\HxomClY.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\BGlNCRx.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\dSziebH.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\UNZpDyc.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\FMPnkeT.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\nJQdOof.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\pfaMLlF.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\LDtIMzP.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\JuGntoR.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\YHkzZRq.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\QLjHMWA.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\OcEcsIi.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\BYBxYPA.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\JIGlDlU.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\TtCRdKm.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
File created	C:\Windows\System\xKraFtD.exe	44fd2dafcc91e4c5e3237c8c79ec73f0.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2744	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
Token: SeLockMemoryPrivilege	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe
Token: SeDebugPrivilege	2744	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2744	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	29
PID 3064 wrote to memory of 2744	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	29
PID 3064 wrote to memory of 2744	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	29
PID 3064 wrote to memory of 2204	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	30
PID 3064 wrote to memory of 2204	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	30
PID 3064 wrote to memory of 2204	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	30
PID 3064 wrote to memory of 2432	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	31
PID 3064 wrote to memory of 2432	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	31
PID 3064 wrote to memory of 2432	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	31
PID 3064 wrote to memory of 2584	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	32
PID 3064 wrote to memory of 2584	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	32
PID 3064 wrote to memory of 2584	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	32
PID 3064 wrote to memory of 2720	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	33
PID 3064 wrote to memory of 2720	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	33
PID 3064 wrote to memory of 2720	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	33
PID 3064 wrote to memory of 2132	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	34
PID 3064 wrote to memory of 2132	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	34
PID 3064 wrote to memory of 2132	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	34
PID 3064 wrote to memory of 2708	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	35
PID 3064 wrote to memory of 2708	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	35
PID 3064 wrote to memory of 2708	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	35
PID 3064 wrote to memory of 2496	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	36
PID 3064 wrote to memory of 2496	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	36
PID 3064 wrote to memory of 2496	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	36
PID 3064 wrote to memory of 2852	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	37
PID 3064 wrote to memory of 2852	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	37
PID 3064 wrote to memory of 2852	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	37
PID 3064 wrote to memory of 2596	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	38
PID 3064 wrote to memory of 2596	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	38
PID 3064 wrote to memory of 2596	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	38
PID 3064 wrote to memory of 1920	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	39
PID 3064 wrote to memory of 1920	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	39
PID 3064 wrote to memory of 1920	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	39
PID 3064 wrote to memory of 1344	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	40
PID 3064 wrote to memory of 1344	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	40
PID 3064 wrote to memory of 1344	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	40
PID 3064 wrote to memory of 2412	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	41
PID 3064 wrote to memory of 2412	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	41
PID 3064 wrote to memory of 2412	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	41
PID 3064 wrote to memory of 2688	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	42
PID 3064 wrote to memory of 2688	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	42
PID 3064 wrote to memory of 2688	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	42
PID 3064 wrote to memory of 2752	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	43
PID 3064 wrote to memory of 2752	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	43
PID 3064 wrote to memory of 2752	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	43
PID 3064 wrote to memory of 1872	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	44
PID 3064 wrote to memory of 1872	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	44
PID 3064 wrote to memory of 1872	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	44
PID 3064 wrote to memory of 1864	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	45
PID 3064 wrote to memory of 1864	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	45
PID 3064 wrote to memory of 1864	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	45
PID 3064 wrote to memory of 2040	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	46
PID 3064 wrote to memory of 2040	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	46
PID 3064 wrote to memory of 2040	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	46
PID 3064 wrote to memory of 1944	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	47
PID 3064 wrote to memory of 1944	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	47
PID 3064 wrote to memory of 1944	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	47
PID 3064 wrote to memory of 2020	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	48
PID 3064 wrote to memory of 2020	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	48
PID 3064 wrote to memory of 2020	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	48
PID 3064 wrote to memory of 2844	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	49
PID 3064 wrote to memory of 2844	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	49
PID 3064 wrote to memory of 2844	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	49
PID 3064 wrote to memory of 320	3064	44fd2dafcc91e4c5e3237c8c79ec73f0.exe	50

C:\Users\Admin\AppData\Local\Temp\44fd2dafcc91e4c5e3237c8c79ec73f0.exe
"C:\Users\Admin\AppData\Local\Temp\44fd2dafcc91e4c5e3237c8c79ec73f0.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2744
- C:\Windows\System\lelJbwd.exe
  C:\Windows\System\lelJbwd.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\Euhesbh.exe
  C:\Windows\System\Euhesbh.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\DOTQShP.exe
  C:\Windows\System\DOTQShP.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\VQidJeu.exe
  C:\Windows\System\VQidJeu.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\kCLsiUd.exe
  C:\Windows\System\kCLsiUd.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\szaKAYN.exe
  C:\Windows\System\szaKAYN.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\YUblngO.exe
  C:\Windows\System\YUblngO.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\KdonYIn.exe
  C:\Windows\System\KdonYIn.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\DPCYhEN.exe
  C:\Windows\System\DPCYhEN.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\epfTuJl.exe
  C:\Windows\System\epfTuJl.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\GdNHJUI.exe
  C:\Windows\System\GdNHJUI.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\ehwJbCi.exe
  C:\Windows\System\ehwJbCi.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\qnqNWdx.exe
  C:\Windows\System\qnqNWdx.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\LZUrJqQ.exe
  C:\Windows\System\LZUrJqQ.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\oGstarh.exe
  C:\Windows\System\oGstarh.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\moKDlXH.exe
  C:\Windows\System\moKDlXH.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\jnrJDYY.exe
  C:\Windows\System\jnrJDYY.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\BSZJGHB.exe
  C:\Windows\System\BSZJGHB.exe
  2⤵
  PID:1944
- C:\Windows\System\QPCkESc.exe
  C:\Windows\System\QPCkESc.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\SDHvoYl.exe
  C:\Windows\System\SDHvoYl.exe
  2⤵
  PID:2844
- C:\Windows\System\SwEtuak.exe
  C:\Windows\System\SwEtuak.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\lldEBto.exe
  C:\Windows\System\lldEBto.exe
  2⤵
  PID:2196
- C:\Windows\System\mKTYbcg.exe
  C:\Windows\System\mKTYbcg.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\fYNBZEu.exe
  C:\Windows\System\fYNBZEu.exe
  2⤵
  PID:108
- C:\Windows\System\QEAYkRs.exe
  C:\Windows\System\QEAYkRs.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\KXqZFpB.exe
  C:\Windows\System\KXqZFpB.exe
  2⤵
  PID:2800
- C:\Windows\System\JEDXJPa.exe
  C:\Windows\System\JEDXJPa.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\pumzoac.exe
  C:\Windows\System\pumzoac.exe
  2⤵
  PID:2792
- C:\Windows\System\ihIcpMa.exe
  C:\Windows\System\ihIcpMa.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\EzlLGky.exe
  C:\Windows\System\EzlLGky.exe
  2⤵
  PID:948
- C:\Windows\System\kCjMeLM.exe
  C:\Windows\System\kCjMeLM.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\RIeMsJX.exe
  C:\Windows\System\RIeMsJX.exe
  2⤵
  PID:1396
- C:\Windows\System\eTwEKDV.exe
  C:\Windows\System\eTwEKDV.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\CPlzxhd.exe
  C:\Windows\System\CPlzxhd.exe
  2⤵
  PID:1712
- C:\Windows\System\UXpJWZD.exe
  C:\Windows\System\UXpJWZD.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\hJSECNI.exe
  C:\Windows\System\hJSECNI.exe
  2⤵
  PID:2092
- C:\Windows\System\gfikBNN.exe
  C:\Windows\System\gfikBNN.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\xhaJBZH.exe
  C:\Windows\System\xhaJBZH.exe
  2⤵
  PID:1140
- C:\Windows\System\LUxaTtg.exe
  C:\Windows\System\LUxaTtg.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\eigdaHh.exe
  C:\Windows\System\eigdaHh.exe
  2⤵
  PID:2932
- C:\Windows\System\VevUmIx.exe
  C:\Windows\System\VevUmIx.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\WAXZhqF.exe
  C:\Windows\System\WAXZhqF.exe
  2⤵
  PID:1456
- C:\Windows\System\qdRqAww.exe
  C:\Windows\System\qdRqAww.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\zuEVyAe.exe
  C:\Windows\System\zuEVyAe.exe
  2⤵
  PID:1924
- C:\Windows\System\vXKmnnf.exe
  C:\Windows\System\vXKmnnf.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\dGcUjNZ.exe
  C:\Windows\System\dGcUjNZ.exe
  2⤵
  PID:1896
- C:\Windows\System\tXddiwM.exe
  C:\Windows\System\tXddiwM.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\GUuGGXx.exe
  C:\Windows\System\GUuGGXx.exe
  2⤵
  PID:1904
- C:\Windows\System\BMCfixy.exe
  C:\Windows\System\BMCfixy.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\EySJXFU.exe
  C:\Windows\System\EySJXFU.exe
  2⤵
  PID:2964
- C:\Windows\System\bHjadbs.exe
  C:\Windows\System\bHjadbs.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\oVceKKN.exe
  C:\Windows\System\oVceKKN.exe
  2⤵
  PID:2380
- C:\Windows\System\dAlRxED.exe
  C:\Windows\System\dAlRxED.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\kDktOsD.exe
  C:\Windows\System\kDktOsD.exe
  2⤵
  PID:2948
- C:\Windows\System\GFqaUiL.exe
  C:\Windows\System\GFqaUiL.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\ECjdbTq.exe
  C:\Windows\System\ECjdbTq.exe
  2⤵
  PID:1640
- C:\Windows\System\xcAeQMw.exe
  C:\Windows\System\xcAeQMw.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\ZFyaHPe.exe
  C:\Windows\System\ZFyaHPe.exe
  2⤵
  PID:2188
- C:\Windows\System\RGEdqIb.exe
  C:\Windows\System\RGEdqIb.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\eQReGmI.exe
  C:\Windows\System\eQReGmI.exe
  2⤵
  PID:1420
- C:\Windows\System\nXtoKiD.exe
  C:\Windows\System\nXtoKiD.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\AeGRWpk.exe
  C:\Windows\System\AeGRWpk.exe
  2⤵
  PID:1988
- C:\Windows\System\HfYOfet.exe
  C:\Windows\System\HfYOfet.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\lsncdbj.exe
  C:\Windows\System\lsncdbj.exe
  2⤵
  PID:1516
- C:\Windows\System\uYOqXQy.exe
  C:\Windows\System\uYOqXQy.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\CNJrnJg.exe
  C:\Windows\System\CNJrnJg.exe
  2⤵
  PID:2924
- C:\Windows\System\oVHezay.exe
  C:\Windows\System\oVHezay.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\tucCddG.exe
  C:\Windows\System\tucCddG.exe
  2⤵
  PID:2772
- C:\Windows\System\UAsmUqU.exe
  C:\Windows\System\UAsmUqU.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\LrXaIvk.exe
  C:\Windows\System\LrXaIvk.exe
  2⤵
  PID:2600
- C:\Windows\System\xZkQwmY.exe
  C:\Windows\System\xZkQwmY.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\ydXfHxn.exe
  C:\Windows\System\ydXfHxn.exe
  2⤵
  PID:2144
- C:\Windows\System\jPauaXO.exe
  C:\Windows\System\jPauaXO.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\ZNMnuWB.exe
  C:\Windows\System\ZNMnuWB.exe
  2⤵
  PID:1576
- C:\Windows\System\oJhmXdl.exe
  C:\Windows\System\oJhmXdl.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\zuVafKx.exe
  C:\Windows\System\zuVafKx.exe
  2⤵
  PID:2668
- C:\Windows\System\WxLVcKF.exe
  C:\Windows\System\WxLVcKF.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\TBOERPH.exe
  C:\Windows\System\TBOERPH.exe
  2⤵
  PID:2164
- C:\Windows\System\ASmAHTp.exe
  C:\Windows\System\ASmAHTp.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\xjjhydj.exe
  C:\Windows\System\xjjhydj.exe
  2⤵
  PID:2728
- C:\Windows\System\NTOQtev.exe
  C:\Windows\System\NTOQtev.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\fQGOjgE.exe
  C:\Windows\System\fQGOjgE.exe
  2⤵
  PID:2544
- C:\Windows\System\DmmQpwZ.exe
  C:\Windows\System\DmmQpwZ.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\AJldtfU.exe
  C:\Windows\System\AJldtfU.exe
  2⤵
  PID:2244
- C:\Windows\System\EnGVmVG.exe
  C:\Windows\System\EnGVmVG.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\VHwiYmN.exe
  C:\Windows\System\VHwiYmN.exe
  2⤵
  PID:2676
- C:\Windows\System\sasHYWU.exe
  C:\Windows\System\sasHYWU.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\fSpMOIy.exe
  C:\Windows\System\fSpMOIy.exe
  2⤵
  PID:1780
- C:\Windows\System\tTEadYI.exe
  C:\Windows\System\tTEadYI.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\uSRRUWK.exe
  C:\Windows\System\uSRRUWK.exe
  2⤵
  PID:2796
- C:\Windows\System\jveOhEQ.exe
  C:\Windows\System\jveOhEQ.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\cSbMUZx.exe
  C:\Windows\System\cSbMUZx.exe
  2⤵
  PID:1976
- C:\Windows\System\thSAtPW.exe
  C:\Windows\System\thSAtPW.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\quYIuJT.exe
  C:\Windows\System\quYIuJT.exe
  2⤵
  PID:2404
- C:\Windows\System\iUcSqBu.exe
  C:\Windows\System\iUcSqBu.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\XVExapi.exe
  C:\Windows\System\XVExapi.exe
  2⤵
  PID:1656
- C:\Windows\System\KfdZuaD.exe
  C:\Windows\System\KfdZuaD.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\BdalCXy.exe
  C:\Windows\System\BdalCXy.exe
  2⤵
  PID:2112
- C:\Windows\System\OUGNlOk.exe
  C:\Windows\System\OUGNlOk.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\RkMpaWc.exe
  C:\Windows\System\RkMpaWc.exe
  2⤵
  PID:2724
- C:\Windows\System\mBixUkJ.exe
  C:\Windows\System\mBixUkJ.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\oqqgFyb.exe
  C:\Windows\System\oqqgFyb.exe
  2⤵
  PID:1740
- C:\Windows\System\hVcWDUZ.exe
  C:\Windows\System\hVcWDUZ.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\XUgCurb.exe
  C:\Windows\System\XUgCurb.exe
  2⤵
  PID:2212
- C:\Windows\System\iWhgiAF.exe
  C:\Windows\System\iWhgiAF.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\vgqYlcG.exe
  C:\Windows\System\vgqYlcG.exe
  2⤵
  PID:1028
- C:\Windows\System\fpNfZvM.exe
  C:\Windows\System\fpNfZvM.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\uKqYBRQ.exe
  C:\Windows\System\uKqYBRQ.exe
  2⤵
  PID:1928
- C:\Windows\System\TwwHWeZ.exe
  C:\Windows\System\TwwHWeZ.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\HCUjBvn.exe
  C:\Windows\System\HCUjBvn.exe
  2⤵
  PID:2628
- C:\Windows\System\NxkzcWF.exe
  C:\Windows\System\NxkzcWF.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\cwSvvjh.exe
  C:\Windows\System\cwSvvjh.exe
  2⤵
  PID:1652
- C:\Windows\System\rNWWZKy.exe
  C:\Windows\System\rNWWZKy.exe
  2⤵
  PID:3084
- C:\Windows\System\CGJXySu.exe
  C:\Windows\System\CGJXySu.exe
  2⤵
  PID:3100
- C:\Windows\System\uFPyIFr.exe
  C:\Windows\System\uFPyIFr.exe
  2⤵
  PID:3116
- C:\Windows\System\CkvEcPp.exe
  C:\Windows\System\CkvEcPp.exe
  2⤵
  PID:3132
- C:\Windows\System\qUSEQVm.exe
  C:\Windows\System\qUSEQVm.exe
  2⤵
  PID:3148
- C:\Windows\System\HlwEKbV.exe
  C:\Windows\System\HlwEKbV.exe
  2⤵
  PID:3172
- C:\Windows\System\CwGiAgf.exe
  C:\Windows\System\CwGiAgf.exe
  2⤵
  PID:3196
- C:\Windows\System\svoCBqR.exe
  C:\Windows\System\svoCBqR.exe
  2⤵
  PID:3212
- C:\Windows\System\IyevEDL.exe
  C:\Windows\System\IyevEDL.exe
  2⤵
  PID:3232
- C:\Windows\System\jIMdKVp.exe
  C:\Windows\System\jIMdKVp.exe
  2⤵
  PID:3616
- C:\Windows\System\COlKaHU.exe
  C:\Windows\System\COlKaHU.exe
  2⤵
  PID:4028
- C:\Windows\System\rTrxueV.exe
  C:\Windows\System\rTrxueV.exe
  2⤵
  PID:4044
- C:\Windows\System\LfhtXEJ.exe
  C:\Windows\System\LfhtXEJ.exe
  2⤵
  PID:4060
- C:\Windows\System\kNfsAmJ.exe
  C:\Windows\System\kNfsAmJ.exe
  2⤵
  PID:4076
- C:\Windows\System\crincic.exe
  C:\Windows\System\crincic.exe
  2⤵
  PID:2580
- C:\Windows\System\hBMnuxi.exe
  C:\Windows\System\hBMnuxi.exe
  2⤵
  PID:1772
- C:\Windows\System\LqXpEMF.exe
  C:\Windows\System\LqXpEMF.exe
  2⤵
  PID:3204
- C:\Windows\System\dSziebH.exe
  C:\Windows\System\dSziebH.exe
  2⤵
  PID:3308
- C:\Windows\System\eFxuYXh.exe
  C:\Windows\System\eFxuYXh.exe
  2⤵
  PID:3344
- C:\Windows\System\kLhPSsD.exe
  C:\Windows\System\kLhPSsD.exe
  2⤵
  PID:3364
- C:\Windows\System\VjgtjCQ.exe
  C:\Windows\System\VjgtjCQ.exe
  2⤵
  PID:3384
- C:\Windows\System\VZEttmW.exe
  C:\Windows\System\VZEttmW.exe
  2⤵
  PID:3408
- C:\Windows\System\QIeSjZU.exe
  C:\Windows\System\QIeSjZU.exe
  2⤵
  PID:3432
- C:\Windows\System\kaMZdxc.exe
  C:\Windows\System\kaMZdxc.exe
  2⤵
  PID:3452
- C:\Windows\System\RSjBQwC.exe
  C:\Windows\System\RSjBQwC.exe
  2⤵
  PID:3480
- C:\Windows\System\JNvgihn.exe
  C:\Windows\System\JNvgihn.exe
  2⤵
  PID:3504
- C:\Windows\System\DmjCrBJ.exe
  C:\Windows\System\DmjCrBJ.exe
  2⤵
  PID:3512
- C:\Windows\System\QyVPVvS.exe
  C:\Windows\System\QyVPVvS.exe
  2⤵
  PID:3548
- C:\Windows\System\PNSQBkA.exe
  C:\Windows\System\PNSQBkA.exe
  2⤵
  PID:3608
- C:\Windows\System\PkRZeNU.exe
  C:\Windows\System\PkRZeNU.exe
  2⤵
  PID:1940
- C:\Windows\System\MChONAo.exe
  C:\Windows\System\MChONAo.exe
  2⤵
  PID:2732
- C:\Windows\System\CDOJGzn.exe
  C:\Windows\System\CDOJGzn.exe
  2⤵
  PID:1564
- C:\Windows\System\meybtMg.exe
  C:\Windows\System\meybtMg.exe
  2⤵
  PID:112
- C:\Windows\System\RbWQzQo.exe
  C:\Windows\System\RbWQzQo.exe
  2⤵
  PID:2764
- C:\Windows\System\WWMZaVe.exe
  C:\Windows\System\WWMZaVe.exe
  2⤵
  PID:2340
- C:\Windows\System\qZMbDPp.exe
  C:\Windows\System\qZMbDPp.exe
  2⤵
  PID:2656
- C:\Windows\System\bXjfhbN.exe
  C:\Windows\System\bXjfhbN.exe
  2⤵
  PID:2644
- C:\Windows\System\MXgtEDQ.exe
  C:\Windows\System\MXgtEDQ.exe
  2⤵
  PID:2508
- C:\Windows\System\FkWUrUP.exe
  C:\Windows\System\FkWUrUP.exe
  2⤵
  PID:2840
- C:\Windows\System\MtkGWaS.exe
  C:\Windows\System\MtkGWaS.exe
  2⤵
  PID:2484
- C:\Windows\System\upYQcva.exe
  C:\Windows\System\upYQcva.exe
  2⤵
  PID:4000
- C:\Windows\System\itOHuRB.exe
  C:\Windows\System\itOHuRB.exe
  2⤵
  PID:3144
- C:\Windows\System\zjualox.exe
  C:\Windows\System\zjualox.exe
  2⤵
  PID:3188
- C:\Windows\System\DZbJaJR.exe
  C:\Windows\System\DZbJaJR.exe
  2⤵
  PID:3228
- C:\Windows\System\pDKScwm.exe
  C:\Windows\System\pDKScwm.exe
  2⤵
  PID:1856
- C:\Windows\System\UDPRAPu.exe
  C:\Windows\System\UDPRAPu.exe
  2⤵
  PID:812
- C:\Windows\System\WZGvUwi.exe
  C:\Windows\System\WZGvUwi.exe
  2⤵
  PID:676
- C:\Windows\System\JCDDrAN.exe
  C:\Windows\System\JCDDrAN.exe
  2⤵
  PID:620
- C:\Windows\System\CRuQjor.exe
  C:\Windows\System\CRuQjor.exe
  2⤵
  PID:756
- C:\Windows\System\UUdVPQH.exe
  C:\Windows\System\UUdVPQH.exe
  2⤵
  PID:1720
- C:\Windows\System\BKxtgGO.exe
  C:\Windows\System\BKxtgGO.exe
  2⤵
  PID:796
- C:\Windows\System\PyJirom.exe
  C:\Windows\System\PyJirom.exe
  2⤵
  PID:1840
- C:\Windows\System\aplPJVM.exe
  C:\Windows\System\aplPJVM.exe
  2⤵
  PID:4084
- C:\Windows\System\uKPUGAN.exe
  C:\Windows\System\uKPUGAN.exe
  2⤵
  PID:3632
- C:\Windows\System\qcsOEjI.exe
  C:\Windows\System\qcsOEjI.exe
  2⤵
  PID:2480
- C:\Windows\System\ZnWwWqu.exe
  C:\Windows\System\ZnWwWqu.exe
  2⤵
  PID:564
- C:\Windows\System\mszUuZQ.exe
  C:\Windows\System\mszUuZQ.exe
  2⤵
  PID:1540
- C:\Windows\System\mkIsQJX.exe
  C:\Windows\System\mkIsQJX.exe
  2⤵
  PID:744
- C:\Windows\System\VXCSZEw.exe
  C:\Windows\System\VXCSZEw.exe
  2⤵
  PID:2004
- C:\Windows\System\QBlnFqU.exe
  C:\Windows\System\QBlnFqU.exe
  2⤵
  PID:1348
- C:\Windows\System\ZSEbtAf.exe
  C:\Windows\System\ZSEbtAf.exe
  2⤵
  PID:904
- C:\Windows\System\cMBCdKb.exe
  C:\Windows\System\cMBCdKb.exe
  2⤵
  PID:2968
- C:\Windows\System\xVPFKxJ.exe
  C:\Windows\System\xVPFKxJ.exe
  2⤵
  PID:2568
- C:\Windows\System\bIcmzpx.exe
  C:\Windows\System\bIcmzpx.exe
  2⤵
  PID:4024
- C:\Windows\System\ISKoeLQ.exe
  C:\Windows\System\ISKoeLQ.exe
  2⤵
  PID:1880
- C:\Windows\System\ATuCQGP.exe
  C:\Windows\System\ATuCQGP.exe
  2⤵
  PID:2336
- C:\Windows\System\XKSsyFO.exe
  C:\Windows\System\XKSsyFO.exe
  2⤵
  PID:4052
- C:\Windows\System\sahSiFb.exe
  C:\Windows\System\sahSiFb.exe
  2⤵
  PID:3156
- C:\Windows\System\MIhpfQQ.exe
  C:\Windows\System\MIhpfQQ.exe
  2⤵
  PID:3360
- C:\Windows\System\mvwOKjF.exe
  C:\Windows\System\mvwOKjF.exe
  2⤵
  PID:3328
- C:\Windows\System\tmlaeqw.exe
  C:\Windows\System\tmlaeqw.exe
  2⤵
  PID:3404
- C:\Windows\System\dkEUHEf.exe
  C:\Windows\System\dkEUHEf.exe
  2⤵
  PID:3396
- C:\Windows\System\WbMLhLY.exe
  C:\Windows\System\WbMLhLY.exe
  2⤵
  PID:3420
- C:\Windows\System\WvQqzhr.exe
  C:\Windows\System\WvQqzhr.exe
  2⤵
  PID:3484
- C:\Windows\System\IWRxNAe.exe
  C:\Windows\System\IWRxNAe.exe
  2⤵
  PID:1260
- C:\Windows\System\zECzeCf.exe
  C:\Windows\System\zECzeCf.exe
  2⤵
  PID:2208
- C:\Windows\System\seCDUFn.exe
  C:\Windows\System\seCDUFn.exe
  2⤵
  PID:2776
- C:\Windows\System\CCAbYXn.exe
  C:\Windows\System\CCAbYXn.exe
  2⤵
  PID:2788
- C:\Windows\System\wtAMqDN.exe
  C:\Windows\System\wtAMqDN.exe
  2⤵
  PID:1572
- C:\Windows\System\TvDwjJp.exe
  C:\Windows\System\TvDwjJp.exe
  2⤵
  PID:2352
- C:\Windows\System\alwhVti.exe
  C:\Windows\System\alwhVti.exe
  2⤵
  PID:2988
- C:\Windows\System\aXQWgfP.exe
  C:\Windows\System\aXQWgfP.exe
  2⤵
  PID:2200
- C:\Windows\System\aVifgmh.exe
  C:\Windows\System\aVifgmh.exe
  2⤵
  PID:3996
- C:\Windows\System\OaLjTMy.exe
  C:\Windows\System\OaLjTMy.exe
  2⤵
  PID:3140
- C:\Windows\System\MbCWAFr.exe
  C:\Windows\System\MbCWAFr.exe
  2⤵
  PID:3224
- C:\Windows\System\TyoUOWV.exe
  C:\Windows\System\TyoUOWV.exe
  2⤵
  PID:3048
- C:\Windows\System\DXzjOJP.exe
  C:\Windows\System\DXzjOJP.exe
  2⤵
  PID:2940
- C:\Windows\System\XgXYijh.exe
  C:\Windows\System\XgXYijh.exe
  2⤵
  PID:1088
- C:\Windows\System\TIHiAQY.exe
  C:\Windows\System\TIHiAQY.exe
  2⤵
  PID:1240
- C:\Windows\System\bCHDAQw.exe
  C:\Windows\System\bCHDAQw.exe
  2⤵
  PID:2784
- C:\Windows\System\wvgjTgZ.exe
  C:\Windows\System\wvgjTgZ.exe
  2⤵
  PID:2344
- C:\Windows\System\nwJzfoe.exe
  C:\Windows\System\nwJzfoe.exe
  2⤵
  PID:1668
- C:\Windows\System\dFOMWqM.exe
  C:\Windows\System\dFOMWqM.exe
  2⤵
  PID:1544
- C:\Windows\System\yhsNoor.exe
  C:\Windows\System\yhsNoor.exe
  2⤵
  PID:1560
- C:\Windows\System\zbAgolx.exe
  C:\Windows\System\zbAgolx.exe
  2⤵
  PID:816
- C:\Windows\System\XAQClDb.exe
  C:\Windows\System\XAQClDb.exe
  2⤵
  PID:2312
- C:\Windows\System\TwSFbEW.exe
  C:\Windows\System\TwSFbEW.exe
  2⤵
  PID:1520
- C:\Windows\System\IaAgHDb.exe
  C:\Windows\System\IaAgHDb.exe
  2⤵
  PID:1188
- C:\Windows\System\XKfgVlI.exe
  C:\Windows\System\XKfgVlI.exe
  2⤵
  PID:2528
- C:\Windows\System\HEWEePj.exe
  C:\Windows\System\HEWEePj.exe
  2⤵
  PID:2572
- C:\Windows\System\kEhzvYk.exe
  C:\Windows\System\kEhzvYk.exe
  2⤵
  PID:1680
- C:\Windows\System\yRwPtmd.exe
  C:\Windows\System\yRwPtmd.exe
  2⤵
  PID:3492
- C:\Windows\System\uxYyTGg.exe
  C:\Windows\System\uxYyTGg.exe
  2⤵
  PID:3500
- C:\Windows\System\idRNhTn.exe
  C:\Windows\System\idRNhTn.exe
  2⤵
  PID:3400
- C:\Windows\System\FRNGTLi.exe
  C:\Windows\System\FRNGTLi.exe
  2⤵
  PID:3532
- C:\Windows\System\gimKMCL.exe
  C:\Windows\System\gimKMCL.exe
  2⤵
  PID:2888
- C:\Windows\System\EMVofen.exe
  C:\Windows\System\EMVofen.exe
  2⤵
  PID:2424
- C:\Windows\System\caPhxSb.exe
  C:\Windows\System\caPhxSb.exe
  2⤵
  PID:3460
- C:\Windows\System\rZIpOdW.exe
  C:\Windows\System\rZIpOdW.exe
  2⤵
  PID:280
- C:\Windows\System\UzuROhE.exe
  C:\Windows\System\UzuROhE.exe
  2⤵
  PID:3112
- C:\Windows\System\uVQESPd.exe
  C:\Windows\System\uVQESPd.exe
  2⤵
  PID:988
- C:\Windows\System\ZMNjfaQ.exe
  C:\Windows\System\ZMNjfaQ.exe
  2⤵
  PID:2872
- C:\Windows\System\COTAecy.exe
  C:\Windows\System\COTAecy.exe
  2⤵
  PID:2044
- C:\Windows\System\hnziqDV.exe
  C:\Windows\System\hnziqDV.exe
  2⤵
  PID:2316
- C:\Windows\System\tofcxUr.exe
  C:\Windows\System\tofcxUr.exe
  2⤵
  PID:3080
- C:\Windows\System\JznzeSb.exe
  C:\Windows\System\JznzeSb.exe
  2⤵
  PID:3440
- C:\Windows\System\bFaTKVg.exe
  C:\Windows\System\bFaTKVg.exe
  2⤵
  PID:2672
- C:\Windows\System\PcUTBOK.exe
  C:\Windows\System\PcUTBOK.exe
  2⤵
  PID:1748
- C:\Windows\System\LZUFOTR.exe
  C:\Windows\System\LZUFOTR.exe
  2⤵
  PID:2812
- C:\Windows\System\AjfVQUE.exe
  C:\Windows\System\AjfVQUE.exe
  2⤵
  PID:4012
- C:\Windows\System\RVOUASV.exe
  C:\Windows\System\RVOUASV.exe
  2⤵
  PID:352
- C:\Windows\System\HxomClY.exe
  C:\Windows\System\HxomClY.exe
  2⤵
  PID:1212
- C:\Windows\System\sMJypQp.exe
  C:\Windows\System\sMJypQp.exe
  2⤵
  PID:2564
- C:\Windows\System\JPblrHX.exe
  C:\Windows\System\JPblrHX.exe
  2⤵
  PID:3584
- C:\Windows\System\YsyUnJJ.exe
  C:\Windows\System\YsyUnJJ.exe
  2⤵
  PID:3304
- C:\Windows\System\wNeAKZR.exe
  C:\Windows\System\wNeAKZR.exe
  2⤵
  PID:3464
- C:\Windows\System\rcWjShT.exe
  C:\Windows\System\rcWjShT.exe
  2⤵
  PID:1932
- C:\Windows\System\PFhOdCh.exe
  C:\Windows\System\PFhOdCh.exe
  2⤵
  PID:2304
- C:\Windows\System\jwGmbwE.exe
  C:\Windows\System\jwGmbwE.exe
  2⤵
  PID:3380
- C:\Windows\System\cNVjpIQ.exe
  C:\Windows\System\cNVjpIQ.exe
  2⤵
  PID:1204
- C:\Windows\System\gRXMfUm.exe
  C:\Windows\System\gRXMfUm.exe
  2⤵
  PID:2248
- C:\Windows\System\wGUPikP.exe
  C:\Windows\System\wGUPikP.exe
  2⤵
  PID:2008
- C:\Windows\System\HRiPYyv.exe
  C:\Windows\System\HRiPYyv.exe
  2⤵
  PID:240
- C:\Windows\System\Yuvwgjf.exe
  C:\Windows\System\Yuvwgjf.exe
  2⤵
  PID:3220
- C:\Windows\System\jadxwlI.exe
  C:\Windows\System\jadxwlI.exe
  2⤵
  PID:4104
- C:\Windows\System\gyuQjAa.exe
  C:\Windows\System\gyuQjAa.exe
  2⤵
  PID:4124
- C:\Windows\System\DiWOrYw.exe
  C:\Windows\System\DiWOrYw.exe
  2⤵
  PID:4140
- C:\Windows\System\rMTAEcZ.exe
  C:\Windows\System\rMTAEcZ.exe
  2⤵
  PID:4160
- C:\Windows\System\bTDuXHj.exe
  C:\Windows\System\bTDuXHj.exe
  2⤵
  PID:4176
- C:\Windows\System\WJkdQXg.exe
  C:\Windows\System\WJkdQXg.exe
  2⤵
  PID:4200
- C:\Windows\System\GfRzvkp.exe
  C:\Windows\System\GfRzvkp.exe
  2⤵
  PID:4252
- C:\Windows\System\sRlJtKw.exe
  C:\Windows\System\sRlJtKw.exe
  2⤵
  PID:4276
- C:\Windows\System\EqCBZlc.exe
  C:\Windows\System\EqCBZlc.exe
  2⤵
  PID:4292
- C:\Windows\System\NVoPmwE.exe
  C:\Windows\System\NVoPmwE.exe
  2⤵
  PID:4308
- C:\Windows\System\pkRYAjx.exe
  C:\Windows\System\pkRYAjx.exe
  2⤵
  PID:4324
- C:\Windows\System\TtCRdKm.exe
  C:\Windows\System\TtCRdKm.exe
  2⤵
  PID:4348
- C:\Windows\System\TlIDbIw.exe
  C:\Windows\System\TlIDbIw.exe
  2⤵
  PID:4364
- C:\Windows\System\PIhAuFs.exe
  C:\Windows\System\PIhAuFs.exe
  2⤵
  PID:4380
- C:\Windows\System\LjOBUbL.exe
  C:\Windows\System\LjOBUbL.exe
  2⤵
  PID:4400
- C:\Windows\System\jipPZrT.exe
  C:\Windows\System\jipPZrT.exe
  2⤵
  PID:4440
- C:\Windows\System\VMRsrBv.exe
  C:\Windows\System\VMRsrBv.exe
  2⤵
  PID:4456
- C:\Windows\System\uixNOEF.exe
  C:\Windows\System\uixNOEF.exe
  2⤵
  PID:4472
- C:\Windows\System\YAfoISA.exe
  C:\Windows\System\YAfoISA.exe
  2⤵
  PID:4488
- C:\Windows\System\eDCIKUx.exe
  C:\Windows\System\eDCIKUx.exe
  2⤵
  PID:4504
- C:\Windows\System\JNqKeBe.exe
  C:\Windows\System\JNqKeBe.exe
  2⤵
  PID:4520
- C:\Windows\System\yBevDCz.exe
  C:\Windows\System\yBevDCz.exe
  2⤵
  PID:4536
- C:\Windows\System\ABViROR.exe
  C:\Windows\System\ABViROR.exe
  2⤵
  PID:4552
- C:\Windows\System\rRklvIg.exe
  C:\Windows\System\rRklvIg.exe
  2⤵
  PID:4568
- C:\Windows\System\FsTxkDv.exe
  C:\Windows\System\FsTxkDv.exe
  2⤵
  PID:4588
- C:\Windows\System\SNnFTVz.exe
  C:\Windows\System\SNnFTVz.exe
  2⤵
  PID:4604
- C:\Windows\System\uoaDxQz.exe
  C:\Windows\System\uoaDxQz.exe
  2⤵
  PID:4648
- C:\Windows\System\NGwWqsr.exe
  C:\Windows\System\NGwWqsr.exe
  2⤵
  PID:4664
- C:\Windows\System\ZfpRkHR.exe
  C:\Windows\System\ZfpRkHR.exe
  2⤵
  PID:4732
- C:\Windows\System\jadqaUs.exe
  C:\Windows\System\jadqaUs.exe
  2⤵
  PID:4756
- C:\Windows\System\atlIEDf.exe
  C:\Windows\System\atlIEDf.exe
  2⤵
  PID:4772
- C:\Windows\System\cerdXIs.exe
  C:\Windows\System\cerdXIs.exe
  2⤵
  PID:4792
- C:\Windows\System\dZlbAue.exe
  C:\Windows\System\dZlbAue.exe
  2⤵
  PID:4820
- C:\Windows\System\phghLbQ.exe
  C:\Windows\System\phghLbQ.exe
  2⤵
  PID:4840
- C:\Windows\System\AvNLAch.exe
  C:\Windows\System\AvNLAch.exe
  2⤵
  PID:4856
- C:\Windows\System\DeTEkXd.exe
  C:\Windows\System\DeTEkXd.exe
  2⤵
  PID:4880
- C:\Windows\System\hpiQZfI.exe
  C:\Windows\System\hpiQZfI.exe
  2⤵
  PID:4896
- C:\Windows\System\ddsRFDH.exe
  C:\Windows\System\ddsRFDH.exe
  2⤵
  PID:4920
- C:\Windows\System\xoNCHva.exe
  C:\Windows\System\xoNCHva.exe
  2⤵
  PID:4936
- C:\Windows\System\wORpuDs.exe
  C:\Windows\System\wORpuDs.exe
  2⤵
  PID:4960
- C:\Windows\System\trmQpgJ.exe
  C:\Windows\System\trmQpgJ.exe
  2⤵
  PID:4984
- C:\Windows\System\mSJYaKX.exe
  C:\Windows\System\mSJYaKX.exe
  2⤵
  PID:5000
- C:\Windows\System\EqwHFcy.exe
  C:\Windows\System\EqwHFcy.exe
  2⤵
  PID:5016
- C:\Windows\System\vzOBtdj.exe
  C:\Windows\System\vzOBtdj.exe
  2⤵
  PID:5036
- C:\Windows\System\qLqMRxw.exe
  C:\Windows\System\qLqMRxw.exe
  2⤵
  PID:5060
- C:\Windows\System\eaxHFlV.exe
  C:\Windows\System\eaxHFlV.exe
  2⤵
  PID:5076
- C:\Windows\System\ptlwygw.exe
  C:\Windows\System\ptlwygw.exe
  2⤵
  PID:5100
- C:\Windows\System\PFhZctd.exe
  C:\Windows\System\PFhZctd.exe
  2⤵
  PID:4132
- C:\Windows\System\aOjUpzc.exe
  C:\Windows\System\aOjUpzc.exe
  2⤵
  PID:4208
- C:\Windows\System\VXBCCob.exe
  C:\Windows\System\VXBCCob.exe
  2⤵
  PID:4224
- C:\Windows\System\fkUDbAk.exe
  C:\Windows\System\fkUDbAk.exe
  2⤵
  PID:800
- C:\Windows\System\ATOFfPm.exe
  C:\Windows\System\ATOFfPm.exe
  2⤵
  PID:3296
- C:\Windows\System\gjPYczB.exe
  C:\Windows\System\gjPYczB.exe
  2⤵
  PID:1012
- C:\Windows\System\ObaLpiz.exe
  C:\Windows\System\ObaLpiz.exe
  2⤵
  PID:4116
- C:\Windows\System\XTmOAhn.exe
  C:\Windows\System\XTmOAhn.exe
  2⤵
  PID:4148
- C:\Windows\System\owoOIFF.exe
  C:\Windows\System\owoOIFF.exe
  2⤵
  PID:4196
- C:\Windows\System\Jylgjhy.exe
  C:\Windows\System\Jylgjhy.exe
  2⤵
  PID:4260
- C:\Windows\System\IPfkTmZ.exe
  C:\Windows\System\IPfkTmZ.exe
  2⤵
  PID:4316
- C:\Windows\System\GqDMSuW.exe
  C:\Windows\System\GqDMSuW.exe
  2⤵
  PID:4332
- C:\Windows\System\FfqxNMa.exe
  C:\Windows\System\FfqxNMa.exe
  2⤵
  PID:4376
- C:\Windows\System\esOxbSV.exe
  C:\Windows\System\esOxbSV.exe
  2⤵
  PID:4336
- C:\Windows\System\YJPUPzt.exe
  C:\Windows\System\YJPUPzt.exe
  2⤵
  PID:4424
- C:\Windows\System\DfqTJDu.exe
  C:\Windows\System\DfqTJDu.exe
  2⤵
  PID:4484
- C:\Windows\System\hxLiLUP.exe
  C:\Windows\System\hxLiLUP.exe
  2⤵
  PID:4500
- C:\Windows\System\gdNYUlO.exe
  C:\Windows\System\gdNYUlO.exe
  2⤵
  PID:4584
- C:\Windows\System\YJCRnHt.exe
  C:\Windows\System\YJCRnHt.exe
  2⤵
  PID:4624
- C:\Windows\System\bQNNCJl.exe
  C:\Windows\System\bQNNCJl.exe
  2⤵
  PID:4544
- C:\Windows\System\cpHsUyH.exe
  C:\Windows\System\cpHsUyH.exe
  2⤵
  PID:4676
- C:\Windows\System\LMjUZiZ.exe
  C:\Windows\System\LMjUZiZ.exe
  2⤵
  PID:4684
- C:\Windows\System\cELnSpr.exe
  C:\Windows\System\cELnSpr.exe
  2⤵
  PID:4708
- C:\Windows\System\VQXNOOP.exe
  C:\Windows\System\VQXNOOP.exe
  2⤵
  PID:4720
- C:\Windows\System\KniTYFT.exe
  C:\Windows\System\KniTYFT.exe
  2⤵
  PID:4764
- C:\Windows\System\SNIVxfu.exe
  C:\Windows\System\SNIVxfu.exe
  2⤵
  PID:4784
- C:\Windows\System\BkvbRZT.exe
  C:\Windows\System\BkvbRZT.exe
  2⤵
  PID:4828
- C:\Windows\System\fZKrslL.exe
  C:\Windows\System\fZKrslL.exe
  2⤵
  PID:4852
- C:\Windows\System\ZfDwZDK.exe
  C:\Windows\System\ZfDwZDK.exe
  2⤵
  PID:4868
- C:\Windows\System\EzNPhIX.exe
  C:\Windows\System\EzNPhIX.exe
  2⤵
  PID:4912
- C:\Windows\System\IAjTeGf.exe
  C:\Windows\System\IAjTeGf.exe
  2⤵
  PID:4932
- C:\Windows\System\cksdoLj.exe
  C:\Windows\System\cksdoLj.exe
  2⤵
  PID:4992
- C:\Windows\System\DwOSdED.exe
  C:\Windows\System\DwOSdED.exe
  2⤵
  PID:5024
- C:\Windows\System\eDjldmF.exe
  C:\Windows\System\eDjldmF.exe
  2⤵
  PID:5048
- C:\Windows\System\jYIUBIa.exe
  C:\Windows\System\jYIUBIa.exe
  2⤵
  PID:5096
- C:\Windows\System\YKcFVYO.exe
  C:\Windows\System\YKcFVYO.exe
  2⤵
  PID:5116
- C:\Windows\System\ZVnqrMb.exe
  C:\Windows\System\ZVnqrMb.exe
  2⤵
  PID:2884
- C:\Windows\System\cAXnNhj.exe
  C:\Windows\System\cAXnNhj.exe
  2⤵
  PID:3528
- C:\Windows\System\sNTXQhX.exe
  C:\Windows\System\sNTXQhX.exe
  2⤵
  PID:4216
- C:\Windows\System\JGihkFZ.exe
  C:\Windows\System\JGihkFZ.exe
  2⤵
  PID:4092
- C:\Windows\System\cYvZQsH.exe
  C:\Windows\System\cYvZQsH.exe
  2⤵
  PID:1552
- C:\Windows\System\CnGulek.exe
  C:\Windows\System\CnGulek.exe
  2⤵
  PID:4112
- C:\Windows\System\SjZiJCz.exe
  C:\Windows\System\SjZiJCz.exe
  2⤵
  PID:4192
- C:\Windows\System\FGDhYgj.exe
  C:\Windows\System\FGDhYgj.exe
  2⤵
  PID:4264
- C:\Windows\System\qnOBkEm.exe
  C:\Windows\System\qnOBkEm.exe
  2⤵
  PID:4344
- C:\Windows\System\gIRHaIS.exe
  C:\Windows\System\gIRHaIS.exe
  2⤵
  PID:4416
- C:\Windows\System\imMuYxw.exe
  C:\Windows\System\imMuYxw.exe
  2⤵
  PID:4496
- C:\Windows\System\wzsWQlO.exe
  C:\Windows\System\wzsWQlO.exe
  2⤵
  PID:4560
- C:\Windows\System\YmXyXMd.exe
  C:\Windows\System\YmXyXMd.exe
  2⤵
  PID:4512
- C:\Windows\System\YHLoHCz.exe
  C:\Windows\System\YHLoHCz.exe
  2⤵
  PID:3124
- C:\Windows\System\ZOhbUFd.exe
  C:\Windows\System\ZOhbUFd.exe
  2⤵
  PID:4660
- C:\Windows\System\upNgeRB.exe
  C:\Windows\System\upNgeRB.exe
  2⤵
  PID:4724
- C:\Windows\System\jXvucuY.exe
  C:\Windows\System\jXvucuY.exe
  2⤵
  PID:4768
- C:\Windows\System\YuhNuDO.exe
  C:\Windows\System\YuhNuDO.exe
  2⤵
  PID:4832
- C:\Windows\System\JAVsrtl.exe
  C:\Windows\System\JAVsrtl.exe
  2⤵
  PID:4892
- C:\Windows\System\xPfFAly.exe
  C:\Windows\System\xPfFAly.exe
  2⤵
  PID:4956
- C:\Windows\System\SwEJHCp.exe
  C:\Windows\System\SwEJHCp.exe
  2⤵
  PID:4948
- C:\Windows\System\HcUgWwz.exe
  C:\Windows\System\HcUgWwz.exe
  2⤵
  PID:5012
- C:\Windows\System\EZDzIdu.exe
  C:\Windows\System\EZDzIdu.exe
  2⤵
  PID:5068
- C:\Windows\System\pxVBOkp.exe
  C:\Windows\System\pxVBOkp.exe
  2⤵
  PID:5108
- C:\Windows\System\OEQqKKk.exe
  C:\Windows\System\OEQqKKk.exe
  2⤵
  PID:1892
- C:\Windows\System\dnsVFlW.exe
  C:\Windows\System\dnsVFlW.exe
  2⤵
  PID:2392
- C:\Windows\System\iYzuyle.exe
  C:\Windows\System\iYzuyle.exe
  2⤵
  PID:3028
- C:\Windows\System\gGKEpGQ.exe
  C:\Windows\System\gGKEpGQ.exe
  2⤵
  PID:4156
- C:\Windows\System\LIGsNox.exe
  C:\Windows\System\LIGsNox.exe
  2⤵
  PID:4284
- C:\Windows\System\pEvnGsO.exe
  C:\Windows\System\pEvnGsO.exe
  2⤵
  PID:4412
- C:\Windows\System\aoqyLLO.exe
  C:\Windows\System\aoqyLLO.exe
  2⤵
  PID:4356
- C:\Windows\System\FSTCPit.exe
  C:\Windows\System\FSTCPit.exe
  2⤵
  PID:4468
- C:\Windows\System\SSuCkDD.exe
  C:\Windows\System\SSuCkDD.exe
  2⤵
  PID:4612
- C:\Windows\System\FuenxoS.exe
  C:\Windows\System\FuenxoS.exe
  2⤵
  PID:4636
- C:\Windows\System\RuwQRpK.exe
  C:\Windows\System\RuwQRpK.exe
  2⤵
  PID:4716
- C:\Windows\System\lqMiYPm.exe
  C:\Windows\System\lqMiYPm.exe
  2⤵
  PID:4788
- C:\Windows\System\GSBTzdr.exe
  C:\Windows\System\GSBTzdr.exe
  2⤵
  PID:3068
- C:\Windows\System\JnsVQik.exe
  C:\Windows\System\JnsVQik.exe
  2⤵
  PID:4972
- C:\Windows\System\LJQHAdd.exe
  C:\Windows\System\LJQHAdd.exe
  2⤵
  PID:5092
- C:\Windows\System\JufyKhG.exe
  C:\Windows\System\JufyKhG.exe
  2⤵
  PID:2928
- C:\Windows\System\IpRlxrI.exe
  C:\Windows\System\IpRlxrI.exe
  2⤵
  PID:2000
- C:\Windows\System\uITxrKh.exe
  C:\Windows\System\uITxrKh.exe
  2⤵
  PID:5136
- C:\Windows\System\mmGRhbp.exe
  C:\Windows\System\mmGRhbp.exe
  2⤵
  PID:5152
- C:\Windows\System\ZtAZxaZ.exe
  C:\Windows\System\ZtAZxaZ.exe
  2⤵
  PID:5172
- C:\Windows\System\lKAfnKO.exe
  C:\Windows\System\lKAfnKO.exe
  2⤵
  PID:5188
- C:\Windows\System\lPpTdFy.exe
  C:\Windows\System\lPpTdFy.exe
  2⤵
  PID:5268
- C:\Windows\System\hQsgtFE.exe
  C:\Windows\System\hQsgtFE.exe
  2⤵
  PID:5292
- C:\Windows\System\HlzkyuN.exe
  C:\Windows\System\HlzkyuN.exe
  2⤵
  PID:5308
- C:\Windows\System\POuGvGK.exe
  C:\Windows\System\POuGvGK.exe
  2⤵
  PID:5324
- C:\Windows\System\tjNERXD.exe
  C:\Windows\System\tjNERXD.exe
  2⤵
  PID:5340
- C:\Windows\System\OxRIKjN.exe
  C:\Windows\System\OxRIKjN.exe
  2⤵
  PID:5356
- C:\Windows\System\JhWNEfq.exe
  C:\Windows\System\JhWNEfq.exe
  2⤵
  PID:5372
- C:\Windows\System\mczYvEs.exe
  C:\Windows\System\mczYvEs.exe
  2⤵
  PID:5388
- C:\Windows\System\XzyVCKd.exe
  C:\Windows\System\XzyVCKd.exe
  2⤵
  PID:5408
- C:\Windows\System\lPkhXRK.exe
  C:\Windows\System\lPkhXRK.exe
  2⤵
  PID:5428
- C:\Windows\System\YRzZSMf.exe
  C:\Windows\System\YRzZSMf.exe
  2⤵
  PID:5444
- C:\Windows\System\BqRWAjy.exe
  C:\Windows\System\BqRWAjy.exe
  2⤵
  PID:5460
- C:\Windows\System\zFHayDP.exe
  C:\Windows\System\zFHayDP.exe
  2⤵
  PID:5476
- C:\Windows\System\LMlbkYp.exe
  C:\Windows\System\LMlbkYp.exe
  2⤵
  PID:5492
- C:\Windows\System\NRIXOaX.exe
  C:\Windows\System\NRIXOaX.exe
  2⤵
  PID:5508
- C:\Windows\System\CBDQDOF.exe
  C:\Windows\System\CBDQDOF.exe
  2⤵
  PID:5524
- C:\Windows\System\WlBSQTG.exe
  C:\Windows\System\WlBSQTG.exe
  2⤵
  PID:5540
- C:\Windows\System\ZPyIAuf.exe
  C:\Windows\System\ZPyIAuf.exe
  2⤵
  PID:5556
- C:\Windows\System\LkYJEXW.exe
  C:\Windows\System\LkYJEXW.exe
  2⤵
  PID:5572
- C:\Windows\System\WUXGCiE.exe
  C:\Windows\System\WUXGCiE.exe
  2⤵
  PID:5588
- C:\Windows\System\vbRtiAw.exe
  C:\Windows\System\vbRtiAw.exe
  2⤵
  PID:5604
- C:\Windows\System\JXTaekV.exe
  C:\Windows\System\JXTaekV.exe
  2⤵
  PID:5620
- C:\Windows\System\qkqGxON.exe
  C:\Windows\System\qkqGxON.exe
  2⤵
  PID:5636
- C:\Windows\System\gaGslkR.exe
  C:\Windows\System\gaGslkR.exe
  2⤵
  PID:5652
- C:\Windows\System\WVdvQRr.exe
  C:\Windows\System\WVdvQRr.exe
  2⤵
  PID:5668
- C:\Windows\System\jqRIdiD.exe
  C:\Windows\System\jqRIdiD.exe
  2⤵
  PID:5684
- C:\Windows\System\OAvfxlg.exe
  C:\Windows\System\OAvfxlg.exe
  2⤵
  PID:5700
- C:\Windows\System\xEmaVWa.exe
  C:\Windows\System\xEmaVWa.exe
  2⤵
  PID:5716
- C:\Windows\System\sXMDDwA.exe
  C:\Windows\System\sXMDDwA.exe
  2⤵
  PID:5732
- C:\Windows\System\QpLjajZ.exe
  C:\Windows\System\QpLjajZ.exe
  2⤵
  PID:5752
- C:\Windows\System\wOFnjlt.exe
  C:\Windows\System\wOFnjlt.exe
  2⤵
  PID:5768
- C:\Windows\System\oNUrDUR.exe
  C:\Windows\System\oNUrDUR.exe
  2⤵
  PID:5784
- C:\Windows\System\mshomSO.exe
  C:\Windows\System\mshomSO.exe
  2⤵
  PID:5800
- C:\Windows\System\iHQHYSC.exe
  C:\Windows\System\iHQHYSC.exe
  2⤵
  PID:5816
- C:\Windows\System\mBqVkLM.exe
  C:\Windows\System\mBqVkLM.exe
  2⤵
  PID:5832
- C:\Windows\System\stpeqvC.exe
  C:\Windows\System\stpeqvC.exe
  2⤵
  PID:5856
- C:\Windows\System\kpjUudY.exe
  C:\Windows\System\kpjUudY.exe
  2⤵
  PID:5872
- C:\Windows\System\nUhbRft.exe
  C:\Windows\System\nUhbRft.exe
  2⤵
  PID:5888
- C:\Windows\System\aroNnpS.exe
  C:\Windows\System\aroNnpS.exe
  2⤵
  PID:5908
- C:\Windows\System\McAEFyR.exe
  C:\Windows\System\McAEFyR.exe
  2⤵
  PID:5924
- C:\Windows\System\QLjHMWA.exe
  C:\Windows\System\QLjHMWA.exe
  2⤵
  PID:5940
- C:\Windows\System\MhQcpWx.exe
  C:\Windows\System\MhQcpWx.exe
  2⤵
  PID:5956
- C:\Windows\System\iOvMQeh.exe
  C:\Windows\System\iOvMQeh.exe
  2⤵
  PID:5972
- C:\Windows\System\aBMUHpK.exe
  C:\Windows\System\aBMUHpK.exe
  2⤵
  PID:5988
- C:\Windows\System\QrEZgTn.exe
  C:\Windows\System\QrEZgTn.exe
  2⤵
  PID:6008
- C:\Windows\System\dMVlUpU.exe
  C:\Windows\System\dMVlUpU.exe
  2⤵
  PID:6024
- C:\Windows\System\sUJQTWg.exe
  C:\Windows\System\sUJQTWg.exe
  2⤵
  PID:6040
- C:\Windows\System\FGHCrRc.exe
  C:\Windows\System\FGHCrRc.exe
  2⤵
  PID:6056
- C:\Windows\System\aGvRAah.exe
  C:\Windows\System\aGvRAah.exe
  2⤵
  PID:6072
- C:\Windows\System\VelbHAV.exe
  C:\Windows\System\VelbHAV.exe
  2⤵
  PID:6088
- C:\Windows\System\qPxcUSw.exe
  C:\Windows\System\qPxcUSw.exe
  2⤵
  PID:6104
- C:\Windows\System\mltFfnF.exe
  C:\Windows\System\mltFfnF.exe
  2⤵
  PID:6120
- C:\Windows\System\nJQdOof.exe
  C:\Windows\System\nJQdOof.exe
  2⤵
  PID:6136
- C:\Windows\System\ATvhBgP.exe
  C:\Windows\System\ATvhBgP.exe
  2⤵
  PID:4804
- C:\Windows\System\LDYkYPI.exe
  C:\Windows\System\LDYkYPI.exe
  2⤵
  PID:4532
- C:\Windows\System\UjqcbuM.exe
  C:\Windows\System\UjqcbuM.exe
  2⤵
  PID:5160
- C:\Windows\System\Bivhvzh.exe
  C:\Windows\System\Bivhvzh.exe
  2⤵
  PID:4976
- C:\Windows\System\OEXkYmS.exe
  C:\Windows\System\OEXkYmS.exe
  2⤵
  PID:5196
- C:\Windows\System\akXXLQA.exe
  C:\Windows\System\akXXLQA.exe
  2⤵
  PID:5224
- C:\Windows\System\LVyXzdm.exe
  C:\Windows\System\LVyXzdm.exe
  2⤵
  PID:5248
- C:\Windows\System\fgvttJc.exe
  C:\Windows\System\fgvttJc.exe
  2⤵
  PID:5264
- C:\Windows\System\MSNBQHL.exe
  C:\Windows\System\MSNBQHL.exe
  2⤵
  PID:5244
- C:\Windows\System\fYPkkgp.exe
  C:\Windows\System\fYPkkgp.exe
  2⤵
  PID:4628
- C:\Windows\System\wOQEohy.exe
  C:\Windows\System\wOQEohy.exe
  2⤵
  PID:5332
- C:\Windows\System\kzFNShs.exe
  C:\Windows\System\kzFNShs.exe
  2⤵
  PID:5396
- C:\Windows\System\GvBgrRr.exe
  C:\Windows\System\GvBgrRr.exe
  2⤵
  PID:5440
- C:\Windows\System\lkmKkgL.exe
  C:\Windows\System\lkmKkgL.exe
  2⤵
  PID:5284
- C:\Windows\System\jNztJVp.exe
  C:\Windows\System\jNztJVp.exe
  2⤵
  PID:4184
- C:\Windows\System\XZiSBOF.exe
  C:\Windows\System\XZiSBOF.exe
  2⤵
  PID:4268
- C:\Windows\System\ytIZPRo.exe
  C:\Windows\System\ytIZPRo.exe
  2⤵
  PID:4696
- C:\Windows\System\jMMadqI.exe
  C:\Windows\System\jMMadqI.exe
  2⤵
  PID:1492
- C:\Windows\System\ZjNtTIz.exe
  C:\Windows\System\ZjNtTIz.exe
  2⤵
  PID:5600
- C:\Windows\System\MIhAoCr.exe
  C:\Windows\System\MIhAoCr.exe
  2⤵
  PID:5632
- C:\Windows\System\vPTxAkW.exe
  C:\Windows\System\vPTxAkW.exe
  2⤵
  PID:5452
- C:\Windows\System\MvpgAoB.exe
  C:\Windows\System\MvpgAoB.exe
  2⤵
  PID:5144
- C:\Windows\System\RRaVyhq.exe
  C:\Windows\System\RRaVyhq.exe
  2⤵
  PID:5416
- C:\Windows\System\njsWutz.exe
  C:\Windows\System\njsWutz.exe
  2⤵
  PID:5380
- C:\Windows\System\WNDSWfR.exe
  C:\Windows\System\WNDSWfR.exe
  2⤵
  PID:5424
- C:\Windows\System\MnmTcvg.exe
  C:\Windows\System\MnmTcvg.exe
  2⤵
  PID:5580
- C:\Windows\System\oINFFkt.exe
  C:\Windows\System\oINFFkt.exe
  2⤵
  PID:5644
- C:\Windows\System\NeDOEhs.exe
  C:\Windows\System\NeDOEhs.exe
  2⤵
  PID:5812
- C:\Windows\System\pDCKxuo.exe
  C:\Windows\System\pDCKxuo.exe
  2⤵
  PID:5844
- C:\Windows\System\VrdegSw.exe
  C:\Windows\System\VrdegSw.exe
  2⤵
  PID:5880
- C:\Windows\System\IgcUNay.exe
  C:\Windows\System\IgcUNay.exe
  2⤵
  PID:5864
- C:\Windows\System\gnelKRB.exe
  C:\Windows\System\gnelKRB.exe
  2⤵
  PID:5968
- C:\Windows\System\FEMVWMs.exe
  C:\Windows\System\FEMVWMs.exe
  2⤵
  PID:5896
- C:\Windows\System\BWnEuWW.exe
  C:\Windows\System\BWnEuWW.exe
  2⤵
  PID:6036
- C:\Windows\System\QyKXUSQ.exe
  C:\Windows\System\QyKXUSQ.exe
  2⤵
  PID:6096
- C:\Windows\System\aVlXTJw.exe
  C:\Windows\System\aVlXTJw.exe
  2⤵
  PID:5952
- C:\Windows\System\FdGsRkw.exe
  C:\Windows\System\FdGsRkw.exe
  2⤵
  PID:6020
- C:\Windows\System\DYEwavT.exe
  C:\Windows\System\DYEwavT.exe
  2⤵
  PID:4812
- C:\Windows\System\hRZcNYy.exe
  C:\Windows\System\hRZcNYy.exe
  2⤵
  PID:4564
- C:\Windows\System\lRoQrmO.exe
  C:\Windows\System\lRoQrmO.exe
  2⤵
  PID:5216
- C:\Windows\System\meyrGWU.exe
  C:\Windows\System\meyrGWU.exe
  2⤵
  PID:4916
- C:\Windows\System\uZUhSUU.exe
  C:\Windows\System\uZUhSUU.exe
  2⤵
  PID:4392
- C:\Windows\System\XigQBkG.exe
  C:\Windows\System\XigQBkG.exe
  2⤵
  PID:5240
- C:\Windows\System\XHoMyTr.exe
  C:\Windows\System\XHoMyTr.exe
  2⤵
  PID:5364
- C:\Windows\System\BRWATZH.exe
  C:\Windows\System\BRWATZH.exe
  2⤵
  PID:4928
- C:\Windows\System\uvTJkmB.exe
  C:\Windows\System\uvTJkmB.exe
  2⤵
  PID:5436
- C:\Windows\System\DApAkgJ.exe
  C:\Windows\System\DApAkgJ.exe
  2⤵
  PID:2716
- C:\Windows\System\KUakGCW.exe
  C:\Windows\System\KUakGCW.exe
  2⤵
  PID:4548
- C:\Windows\System\xsaCsOs.exe
  C:\Windows\System\xsaCsOs.exe
  2⤵
  PID:5596
- C:\Windows\System\cTvPOnL.exe
  C:\Windows\System\cTvPOnL.exe
  2⤵
  PID:5288
- C:\Windows\System\BqfbsHj.exe
  C:\Windows\System\BqfbsHj.exe
  2⤵
  PID:5184
- C:\Windows\System\gBRfbzz.exe
  C:\Windows\System\gBRfbzz.exe
  2⤵
  PID:5484
- C:\Windows\System\sZyeumV.exe
  C:\Windows\System\sZyeumV.exe
  2⤵
  PID:5548
- C:\Windows\System\FNwReIQ.exe
  C:\Windows\System\FNwReIQ.exe
  2⤵
  PID:5680
- C:\Windows\System\nbpwDXs.exe
  C:\Windows\System\nbpwDXs.exe
  2⤵
  PID:5740
- C:\Windows\System\VURBGkV.exe
  C:\Windows\System\VURBGkV.exe
  2⤵
  PID:5780
- C:\Windows\System\fbXQWWt.exe
  C:\Windows\System\fbXQWWt.exe
  2⤵
  PID:5796
- C:\Windows\System\qeCrcFB.exe
  C:\Windows\System\qeCrcFB.exe
  2⤵
  PID:6032
- C:\Windows\System\LzsrWJl.exe
  C:\Windows\System\LzsrWJl.exe
  2⤵
  PID:5948
- C:\Windows\System\rGMfywD.exe
  C:\Windows\System\rGMfywD.exe
  2⤵
  PID:5128
- C:\Windows\System\xYieGst.exe
  C:\Windows\System\xYieGst.exe
  2⤵
  PID:5056
- C:\Windows\System\xCAaCZG.exe
  C:\Windows\System\xCAaCZG.exe
  2⤵
  PID:4136
- C:\Windows\System\ukJuqQX.exe
  C:\Windows\System\ukJuqQX.exe
  2⤵
  PID:5316
- C:\Windows\System\ndQPabM.exe
  C:\Windows\System\ndQPabM.exe
  2⤵
  PID:5552
- C:\Windows\System\mgeJvMO.exe
  C:\Windows\System\mgeJvMO.exe
  2⤵
  PID:5232
- C:\Windows\System\mnGPiTH.exe
  C:\Windows\System\mnGPiTH.exe
  2⤵
  PID:5964
- C:\Windows\System\MikJMAK.exe
  C:\Windows\System\MikJMAK.exe
  2⤵
  PID:6080
- C:\Windows\System\sPbZUdL.exe
  C:\Windows\System\sPbZUdL.exe
  2⤵
  PID:6132
- C:\Windows\System\XMsXEdW.exe
  C:\Windows\System\XMsXEdW.exe
  2⤵
  PID:5280
- C:\Windows\System\KOwIxUl.exe
  C:\Windows\System\KOwIxUl.exe
  2⤵
  PID:5180
- C:\Windows\System\wRtalmQ.exe
  C:\Windows\System\wRtalmQ.exe
  2⤵
  PID:5824
- C:\Windows\System\sZQTrbE.exe
  C:\Windows\System\sZQTrbE.exe
  2⤵
  PID:5304
- C:\Windows\System\ptYEoAk.exe
  C:\Windows\System\ptYEoAk.exe
  2⤵
  PID:5420
- C:\Windows\System\PMZtiwk.exe
  C:\Windows\System\PMZtiwk.exe
  2⤵
  PID:5984
- C:\Windows\System\bIwMygx.exe
  C:\Windows\System\bIwMygx.exe
  2⤵
  PID:6004
- C:\Windows\System\TuxHJTU.exe
  C:\Windows\System\TuxHJTU.exe
  2⤵
  PID:6156
- C:\Windows\System\BYDHADa.exe
  C:\Windows\System\BYDHADa.exe
  2⤵
  PID:6172
- C:\Windows\System\WGRUerr.exe
  C:\Windows\System\WGRUerr.exe
  2⤵
  PID:6188
- C:\Windows\System\IDOBPLT.exe
  C:\Windows\System\IDOBPLT.exe
  2⤵
  PID:6204
- C:\Windows\System\TtUhYoX.exe
  C:\Windows\System\TtUhYoX.exe
  2⤵
  PID:6220
- C:\Windows\System\OwPxpJF.exe
  C:\Windows\System\OwPxpJF.exe
  2⤵
  PID:6236
- C:\Windows\System\tWQBtQv.exe
  C:\Windows\System\tWQBtQv.exe
  2⤵
  PID:6252
- C:\Windows\System\gVTiBFg.exe
  C:\Windows\System\gVTiBFg.exe
  2⤵
  PID:6268
- C:\Windows\System\IjTvweX.exe
  C:\Windows\System\IjTvweX.exe
  2⤵
  PID:6284
- C:\Windows\System\KkBScZd.exe
  C:\Windows\System\KkBScZd.exe
  2⤵
  PID:6300
- C:\Windows\System\rECdDYQ.exe
  C:\Windows\System\rECdDYQ.exe
  2⤵
  PID:6316
- C:\Windows\System\LeBdYGi.exe
  C:\Windows\System\LeBdYGi.exe
  2⤵
  PID:6332
- C:\Windows\System\oiLwutK.exe
  C:\Windows\System\oiLwutK.exe
  2⤵
  PID:6348
- C:\Windows\System\ACNBtOf.exe
  C:\Windows\System\ACNBtOf.exe
  2⤵
  PID:6364
- C:\Windows\System\caygNrE.exe
  C:\Windows\System\caygNrE.exe
  2⤵
  PID:6380
- C:\Windows\System\BGODkXn.exe
  C:\Windows\System\BGODkXn.exe
  2⤵
  PID:6396
- C:\Windows\System\cydeSPR.exe
  C:\Windows\System\cydeSPR.exe
  2⤵
  PID:6412
- C:\Windows\System\hoMWyya.exe
  C:\Windows\System\hoMWyya.exe
  2⤵
  PID:6428
- C:\Windows\System\GCmeJeh.exe
  C:\Windows\System\GCmeJeh.exe
  2⤵
  PID:6444
- C:\Windows\System\fUHbDRM.exe
  C:\Windows\System\fUHbDRM.exe
  2⤵
  PID:6460
- C:\Windows\System\SEpLqtu.exe
  C:\Windows\System\SEpLqtu.exe
  2⤵
  PID:6476
- C:\Windows\System\VDRjuly.exe
  C:\Windows\System\VDRjuly.exe
  2⤵
  PID:6492
- C:\Windows\System\VdGVitS.exe
  C:\Windows\System\VdGVitS.exe
  2⤵
  PID:6508
- C:\Windows\System\eARGcQy.exe
  C:\Windows\System\eARGcQy.exe
  2⤵
  PID:6524
- C:\Windows\System\gIYrsdI.exe
  C:\Windows\System\gIYrsdI.exe
  2⤵
  PID:6540
- C:\Windows\System\cpGqghE.exe
  C:\Windows\System\cpGqghE.exe
  2⤵
  PID:6556
- C:\Windows\System\nWYstpo.exe
  C:\Windows\System\nWYstpo.exe
  2⤵
  PID:6572
- C:\Windows\System\mohMoLO.exe
  C:\Windows\System\mohMoLO.exe
  2⤵
  PID:6588
- C:\Windows\System\YFeDyXk.exe
  C:\Windows\System\YFeDyXk.exe
  2⤵
  PID:6604
- C:\Windows\System\GLOeuxe.exe
  C:\Windows\System\GLOeuxe.exe
  2⤵
  PID:6620
- C:\Windows\System\UNZpDyc.exe
  C:\Windows\System\UNZpDyc.exe
  2⤵
  PID:6636
- C:\Windows\System\NxMUHaS.exe
  C:\Windows\System\NxMUHaS.exe
  2⤵
  PID:6652
- C:\Windows\System\ThCwIVf.exe
  C:\Windows\System\ThCwIVf.exe
  2⤵
  PID:6668
- C:\Windows\System\sIlHGTM.exe
  C:\Windows\System\sIlHGTM.exe
  2⤵
  PID:6684
- C:\Windows\System\BQQxeFY.exe
  C:\Windows\System\BQQxeFY.exe
  2⤵
  PID:6700
- C:\Windows\System\yXrElbY.exe
  C:\Windows\System\yXrElbY.exe
  2⤵
  PID:6716
- C:\Windows\System\soLyExY.exe
  C:\Windows\System\soLyExY.exe
  2⤵
  PID:6732
- C:\Windows\System\rujIhqw.exe
  C:\Windows\System\rujIhqw.exe
  2⤵
  PID:6748
- C:\Windows\System\XZUXApU.exe
  C:\Windows\System\XZUXApU.exe
  2⤵
  PID:6764
- C:\Windows\System\JELqEoX.exe
  C:\Windows\System\JELqEoX.exe
  2⤵
  PID:6780
- C:\Windows\System\fSMpvab.exe
  C:\Windows\System\fSMpvab.exe
  2⤵
  PID:6796
- C:\Windows\System\SGHKSNk.exe
  C:\Windows\System\SGHKSNk.exe
  2⤵
  PID:6812
- C:\Windows\System\YQOrSWt.exe
  C:\Windows\System\YQOrSWt.exe
  2⤵
  PID:6828
- C:\Windows\System\VVxRCby.exe
  C:\Windows\System\VVxRCby.exe
  2⤵
  PID:6844
- C:\Windows\System\iCFAnvf.exe
  C:\Windows\System\iCFAnvf.exe
  2⤵
  PID:6860
- C:\Windows\System\gZRPCjo.exe
  C:\Windows\System\gZRPCjo.exe
  2⤵
  PID:6876
- C:\Windows\System\UtKnluR.exe
  C:\Windows\System\UtKnluR.exe
  2⤵
  PID:6892
- C:\Windows\System\UiCUqjF.exe
  C:\Windows\System\UiCUqjF.exe
  2⤵
  PID:6912
- C:\Windows\System\bxQdeTP.exe
  C:\Windows\System\bxQdeTP.exe
  2⤵
  PID:6928
- C:\Windows\System\uHFyJjU.exe
  C:\Windows\System\uHFyJjU.exe
  2⤵
  PID:6944
- C:\Windows\System\wYrUied.exe
  C:\Windows\System\wYrUied.exe
  2⤵
  PID:6960
- C:\Windows\System\QdjDjJJ.exe
  C:\Windows\System\QdjDjJJ.exe
  2⤵
  PID:6976
- C:\Windows\System\HCukZol.exe
  C:\Windows\System\HCukZol.exe
  2⤵
  PID:6992
- C:\Windows\System\rytKOZD.exe
  C:\Windows\System\rytKOZD.exe
  2⤵
  PID:7008
- C:\Windows\System\ylnkLdl.exe
  C:\Windows\System\ylnkLdl.exe
  2⤵
  PID:7024
- C:\Windows\System\skeJnuD.exe
  C:\Windows\System\skeJnuD.exe
  2⤵
  PID:7040
- C:\Windows\System\eIaNxsP.exe
  C:\Windows\System\eIaNxsP.exe
  2⤵
  PID:7056
- C:\Windows\System\NknvCEH.exe
  C:\Windows\System\NknvCEH.exe
  2⤵
  PID:7072
- C:\Windows\System\ieVUVhv.exe
  C:\Windows\System\ieVUVhv.exe
  2⤵
  PID:7088
- C:\Windows\System\tGrDKhG.exe
  C:\Windows\System\tGrDKhG.exe
  2⤵
  PID:7104
- C:\Windows\System\LrbjMzQ.exe
  C:\Windows\System\LrbjMzQ.exe
  2⤵
  PID:7120
- C:\Windows\System\VXHchuK.exe
  C:\Windows\System\VXHchuK.exe
  2⤵
  PID:7136
- C:\Windows\System\oEJjPjz.exe
  C:\Windows\System\oEJjPjz.exe
  2⤵
  PID:7152
- C:\Windows\System\YZlwRjd.exe
  C:\Windows\System\YZlwRjd.exe
  2⤵
  PID:5504
- C:\Windows\System\MjJQuBP.exe
  C:\Windows\System\MjJQuBP.exe
  2⤵
  PID:5852
- C:\Windows\System\SVAasVK.exe
  C:\Windows\System\SVAasVK.exe
  2⤵
  PID:5744
- C:\Windows\System\PPUimHZ.exe
  C:\Windows\System\PPUimHZ.exe
  2⤵
  PID:6212
- C:\Windows\System\OrLUTfW.exe
  C:\Windows\System\OrLUTfW.exe
  2⤵
  PID:6164
- C:\Windows\System\EpECGdV.exe
  C:\Windows\System\EpECGdV.exe
  2⤵
  PID:5916
- C:\Windows\System\MyaZktt.exe
  C:\Windows\System\MyaZktt.exe
  2⤵
  PID:6016
- C:\Windows\System\lqGxNBO.exe
  C:\Windows\System\lqGxNBO.exe
  2⤵
  PID:4340
- C:\Windows\System\BWgCwXb.exe
  C:\Windows\System\BWgCwXb.exe
  2⤵
  PID:6196
- C:\Windows\System\yNGGMDl.exe
  C:\Windows\System\yNGGMDl.exe
  2⤵
  PID:6292
- C:\Windows\System\qRcwrtl.exe
  C:\Windows\System\qRcwrtl.exe
  2⤵
  PID:6344
- C:\Windows\System\pIUfopW.exe
  C:\Windows\System\pIUfopW.exe
  2⤵
  PID:6356
- C:\Windows\System\iiWMMWC.exe
  C:\Windows\System\iiWMMWC.exe
  2⤵
  PID:6392
- C:\Windows\System\SSknwoO.exe
  C:\Windows\System\SSknwoO.exe
  2⤵
  PID:6452
- C:\Windows\System\kFATqmv.exe
  C:\Windows\System\kFATqmv.exe
  2⤵
  PID:6472
- C:\Windows\System\VhxbBOQ.exe
  C:\Windows\System\VhxbBOQ.exe
  2⤵
  PID:6488
- C:\Windows\System\OHIoFDv.exe
  C:\Windows\System\OHIoFDv.exe
  2⤵
  PID:6500
- C:\Windows\System\JMARsvE.exe
  C:\Windows\System\JMARsvE.exe
  2⤵
  PID:6552
- C:\Windows\System\Sxwvugj.exe
  C:\Windows\System\Sxwvugj.exe
  2⤵
  PID:6612
- C:\Windows\System\DXXZezr.exe
  C:\Windows\System\DXXZezr.exe
  2⤵
  PID:6644
- C:\Windows\System\gAhkpjO.exe
  C:\Windows\System\gAhkpjO.exe
  2⤵
  PID:6628
- C:\Windows\System\BxaCFbP.exe
  C:\Windows\System\BxaCFbP.exe
  2⤵
  PID:6692
- C:\Windows\System\vpqNvCO.exe
  C:\Windows\System\vpqNvCO.exe
  2⤵
  PID:6760
- C:\Windows\System\CVcaleb.exe
  C:\Windows\System\CVcaleb.exe
  2⤵
  PID:6820
- C:\Windows\System\nlRIZeK.exe
  C:\Windows\System\nlRIZeK.exe
  2⤵
  PID:6884
- C:\Windows\System\qWoTOuJ.exe
  C:\Windows\System\qWoTOuJ.exe
  2⤵
  PID:6840
- C:\Windows\System\YBBtKlh.exe
  C:\Windows\System\YBBtKlh.exe
  2⤵
  PID:6900
- C:\Windows\System\aIpYdQw.exe
  C:\Windows\System\aIpYdQw.exe
  2⤵
  PID:6776
- C:\Windows\System\IPIOuyn.exe
  C:\Windows\System\IPIOuyn.exe
  2⤵
  PID:6908
- C:\Windows\System\DpnwsDu.exe
  C:\Windows\System\DpnwsDu.exe
  2⤵
  PID:6956
- C:\Windows\System\GlxdIld.exe
  C:\Windows\System\GlxdIld.exe
  2⤵
  PID:7020
- C:\Windows\System\zFsCcTP.exe
  C:\Windows\System\zFsCcTP.exe
  2⤵
  PID:7084
- C:\Windows\System\GURwnsw.exe
  C:\Windows\System\GURwnsw.exe
  2⤵
  PID:7148
- C:\Windows\System\KuADTbs.exe
  C:\Windows\System\KuADTbs.exe
  2⤵
  PID:7068
- C:\Windows\System\dnjIfsm.exe
  C:\Windows\System\dnjIfsm.exe
  2⤵
  PID:7036
- C:\Windows\System\IsxoQRt.exe
  C:\Windows\System\IsxoQRt.exe
  2⤵
  PID:7064
- C:\Windows\System\HLfZFMr.exe
  C:\Windows\System\HLfZFMr.exe
  2⤵
  PID:7132
- C:\Windows\System\zsLmJDm.exe
  C:\Windows\System\zsLmJDm.exe
  2⤵
  PID:6184
- C:\Windows\System\HDpSXyD.exe
  C:\Windows\System\HDpSXyD.exe
  2⤵
  PID:5764
- C:\Windows\System\TCfEYdo.exe
  C:\Windows\System\TCfEYdo.exe
  2⤵
  PID:6312
- C:\Windows\System\QrrohCK.exe
  C:\Windows\System\QrrohCK.exe
  2⤵
  PID:6404
- C:\Windows\System\OZuQgda.exe
  C:\Windows\System\OZuQgda.exe
  2⤵
  PID:6564
- C:\Windows\System\MAdoYqA.exe
  C:\Windows\System\MAdoYqA.exe
  2⤵
  PID:6664
- C:\Windows\System\CoAMAJg.exe
  C:\Windows\System\CoAMAJg.exe
  2⤵
  PID:6836
- C:\Windows\System\VFEpMPJ.exe
  C:\Windows\System\VFEpMPJ.exe
  2⤵
  PID:6296
- C:\Windows\System\REskTqd.exe
  C:\Windows\System\REskTqd.exe
  2⤵
  PID:7080
- C:\Windows\System\YdAVQyF.exe
  C:\Windows\System\YdAVQyF.exe
  2⤵
  PID:6248
- C:\Windows\System\ExckkqG.exe
  C:\Windows\System\ExckkqG.exe
  2⤵
  PID:5236
- C:\Windows\System\XsXRfRq.exe
  C:\Windows\System\XsXRfRq.exe
  2⤵
  PID:6200
- C:\Windows\System\iSQKjiR.exe
  C:\Windows\System\iSQKjiR.exe
  2⤵
  PID:6420
- C:\Windows\System\wqiQmEf.exe
  C:\Windows\System\wqiQmEf.exe
  2⤵
  PID:7144
- C:\Windows\System\OkGlqjL.exe
  C:\Windows\System\OkGlqjL.exe
  2⤵
  PID:6756
- C:\Windows\System\TiQHssz.exe
  C:\Windows\System\TiQHssz.exe
  2⤵
  PID:6744
- C:\Windows\System\BYamInW.exe
  C:\Windows\System\BYamInW.exe
  2⤵
  PID:7000
- C:\Windows\System\PcRNyTi.exe
  C:\Windows\System\PcRNyTi.exe
  2⤵
  PID:6180
- C:\Windows\System\kvmXURk.exe
  C:\Windows\System\kvmXURk.exe
  2⤵
  PID:6516
- C:\Windows\System\bkopORS.exe
  C:\Windows\System\bkopORS.exe
  2⤵
  PID:6548
- C:\Windows\System\rrOFXXy.exe
  C:\Windows\System\rrOFXXy.exe
  2⤵
  PID:6808
- C:\Windows\System\PZcxsZn.exe
  C:\Windows\System\PZcxsZn.exe
  2⤵
  PID:6600
- C:\Windows\System\EUBcFOo.exe
  C:\Windows\System\EUBcFOo.exe
  2⤵
  PID:6152
- C:\Windows\System\gbfSuXs.exe
  C:\Windows\System\gbfSuXs.exe
  2⤵
  PID:7164
- C:\Windows\System\vVhNQSo.exe
  C:\Windows\System\vVhNQSo.exe
  2⤵
  PID:6728
- C:\Windows\System\ojPPMcz.exe
  C:\Windows\System\ojPPMcz.exe
  2⤵
  PID:6968
- C:\Windows\System\uhHYjRH.exe
  C:\Windows\System\uhHYjRH.exe
  2⤵
  PID:6112
- C:\Windows\System\ppJAiXA.exe
  C:\Windows\System\ppJAiXA.exe
  2⤵
  PID:6872
- C:\Windows\System\tfSZPYP.exe
  C:\Windows\System\tfSZPYP.exe
  2⤵
  PID:7116
- C:\Windows\System\zGuAXZN.exe
  C:\Windows\System\zGuAXZN.exe
  2⤵
  PID:6388
- C:\Windows\System\rOvLvnF.exe
  C:\Windows\System\rOvLvnF.exe
  2⤵
  PID:6308
- C:\Windows\System\pvOMHSJ.exe
  C:\Windows\System\pvOMHSJ.exe
  2⤵
  PID:6468
- C:\Windows\System\upDlzNf.exe
  C:\Windows\System\upDlzNf.exe
  2⤵
  PID:6504
- C:\Windows\System\KqyxJdm.exe
  C:\Windows\System\KqyxJdm.exe
  2⤵
  PID:6328
- C:\Windows\System\CiWvLMo.exe
  C:\Windows\System\CiWvLMo.exe
  2⤵
  PID:7176
- C:\Windows\System\ahuyzZg.exe
  C:\Windows\System\ahuyzZg.exe
  2⤵
  PID:7192
- C:\Windows\System\oatsyZB.exe
  C:\Windows\System\oatsyZB.exe
  2⤵
  PID:7208
- C:\Windows\System\bXuFNcV.exe
  C:\Windows\System\bXuFNcV.exe
  2⤵
  PID:7224
- C:\Windows\System\CmysKan.exe
  C:\Windows\System\CmysKan.exe
  2⤵
  PID:7240
- C:\Windows\System\KcxoIla.exe
  C:\Windows\System\KcxoIla.exe
  2⤵
  PID:7256
- C:\Windows\System\aDLQeVy.exe
  C:\Windows\System\aDLQeVy.exe
  2⤵
  PID:7272
- C:\Windows\System\YqaRIap.exe
  C:\Windows\System\YqaRIap.exe
  2⤵
  PID:7292
- C:\Windows\System\vRmHMLV.exe
  C:\Windows\System\vRmHMLV.exe
  2⤵
  PID:7308
- C:\Windows\System\BapUvQR.exe
  C:\Windows\System\BapUvQR.exe
  2⤵
  PID:7324
- C:\Windows\System\WUugAWt.exe
  C:\Windows\System\WUugAWt.exe
  2⤵
  PID:7340
- C:\Windows\System\Bbiaxxx.exe
  C:\Windows\System\Bbiaxxx.exe
  2⤵
  PID:7356
- C:\Windows\System\GTIUCsE.exe
  C:\Windows\System\GTIUCsE.exe
  2⤵
  PID:7372
- C:\Windows\System\NZlapMg.exe
  C:\Windows\System\NZlapMg.exe
  2⤵
  PID:7388
- C:\Windows\System\OXWXWUQ.exe
  C:\Windows\System\OXWXWUQ.exe
  2⤵
  PID:7404
- C:\Windows\System\FaMfWYx.exe
  C:\Windows\System\FaMfWYx.exe
  2⤵
  PID:7420
- C:\Windows\System\wxQKoaA.exe
  C:\Windows\System\wxQKoaA.exe
  2⤵
  PID:7436
- C:\Windows\System\gxBGDuI.exe
  C:\Windows\System\gxBGDuI.exe
  2⤵
  PID:7452
- C:\Windows\System\vWguhwh.exe
  C:\Windows\System\vWguhwh.exe
  2⤵
  PID:7468
- C:\Windows\System\yatKnPG.exe
  C:\Windows\System\yatKnPG.exe
  2⤵
  PID:7484
- C:\Windows\System\YYigOIi.exe
  C:\Windows\System\YYigOIi.exe
  2⤵
  PID:7500
- C:\Windows\System\MyExEnX.exe
  C:\Windows\System\MyExEnX.exe
  2⤵
  PID:7516
- C:\Windows\System\cJiuGVY.exe
  C:\Windows\System\cJiuGVY.exe
  2⤵
  PID:7532
- C:\Windows\System\YzpYTyr.exe
  C:\Windows\System\YzpYTyr.exe
  2⤵
  PID:7548
- C:\Windows\System\seFJcVv.exe
  C:\Windows\System\seFJcVv.exe
  2⤵
  PID:7564
- C:\Windows\System\Oxmfgez.exe
  C:\Windows\System\Oxmfgez.exe
  2⤵
  PID:7580
- C:\Windows\System\pJneyCY.exe
  C:\Windows\System\pJneyCY.exe
  2⤵
  PID:7596
- C:\Windows\System\nDmiMzT.exe
  C:\Windows\System\nDmiMzT.exe
  2⤵
  PID:7612
- C:\Windows\System\pnKnvtQ.exe
  C:\Windows\System\pnKnvtQ.exe
  2⤵
  PID:7632
- C:\Windows\System\AXZsAsa.exe
  C:\Windows\System\AXZsAsa.exe
  2⤵
  PID:7648
- C:\Windows\System\YNJfucR.exe
  C:\Windows\System\YNJfucR.exe
  2⤵
  PID:7664
- C:\Windows\System\SyCPaHU.exe
  C:\Windows\System\SyCPaHU.exe
  2⤵
  PID:7680
- C:\Windows\System\BxMDIjh.exe
  C:\Windows\System\BxMDIjh.exe
  2⤵
  PID:7696
- C:\Windows\System\zGzVzkO.exe
  C:\Windows\System\zGzVzkO.exe
  2⤵
  PID:7712
- C:\Windows\System\nbNqKBP.exe
  C:\Windows\System\nbNqKBP.exe
  2⤵
  PID:7728
- C:\Windows\System\YaKrCaY.exe
  C:\Windows\System\YaKrCaY.exe
  2⤵
  PID:7744
- C:\Windows\System\bkuhORa.exe
  C:\Windows\System\bkuhORa.exe
  2⤵
  PID:7760
- C:\Windows\System\lEAlZoL.exe
  C:\Windows\System\lEAlZoL.exe
  2⤵
  PID:7776
- C:\Windows\System\lzgCCyP.exe
  C:\Windows\System\lzgCCyP.exe
  2⤵
  PID:7792
- C:\Windows\System\skiTqwh.exe
  C:\Windows\System\skiTqwh.exe
  2⤵
  PID:7808
- C:\Windows\System\oBHoPVC.exe
  C:\Windows\System\oBHoPVC.exe
  2⤵
  PID:7824
- C:\Windows\System\uZxyBIV.exe
  C:\Windows\System\uZxyBIV.exe
  2⤵
  PID:7840
- C:\Windows\System\gmRTtnB.exe
  C:\Windows\System\gmRTtnB.exe
  2⤵
  PID:7856
- C:\Windows\System\bypcCoH.exe
  C:\Windows\System\bypcCoH.exe
  2⤵
  PID:7872
- C:\Windows\System\nTBmoIf.exe
  C:\Windows\System\nTBmoIf.exe
  2⤵
  PID:7888
- C:\Windows\System\HnjAgml.exe
  C:\Windows\System\HnjAgml.exe
  2⤵
  PID:7904
- C:\Windows\System\ESwqpOg.exe
  C:\Windows\System\ESwqpOg.exe
  2⤵
  PID:7920
- C:\Windows\System\WQsdzZb.exe
  C:\Windows\System\WQsdzZb.exe
  2⤵
  PID:7936
- C:\Windows\System\OBejQMb.exe
  C:\Windows\System\OBejQMb.exe
  2⤵
  PID:7952
- C:\Windows\System\RwGhDAP.exe
  C:\Windows\System\RwGhDAP.exe
  2⤵
  PID:7968
- C:\Windows\System\QQeAvLy.exe
  C:\Windows\System\QQeAvLy.exe
  2⤵
  PID:7984
- C:\Windows\System\HOfBcUY.exe
  C:\Windows\System\HOfBcUY.exe
  2⤵
  PID:8000
- C:\Windows\System\OhmUXsi.exe
  C:\Windows\System\OhmUXsi.exe
  2⤵
  PID:8016
- C:\Windows\System\EZUKFrT.exe
  C:\Windows\System\EZUKFrT.exe
  2⤵
  PID:8032
- C:\Windows\System\NAZQbjY.exe
  C:\Windows\System\NAZQbjY.exe
  2⤵
  PID:8048
- C:\Windows\System\mRPGjju.exe
  C:\Windows\System\mRPGjju.exe
  2⤵
  PID:8064
- C:\Windows\System\FmkprdD.exe
  C:\Windows\System\FmkprdD.exe
  2⤵
  PID:8080
- C:\Windows\System\xbGHbQN.exe
  C:\Windows\System\xbGHbQN.exe
  2⤵
  PID:8096
- C:\Windows\System\VSDiJHu.exe
  C:\Windows\System\VSDiJHu.exe
  2⤵
  PID:8112
- C:\Windows\System\ZVPvGPZ.exe
  C:\Windows\System\ZVPvGPZ.exe
  2⤵
  PID:8128
- C:\Windows\System\mHKUJED.exe
  C:\Windows\System\mHKUJED.exe
  2⤵
  PID:8144
- C:\Windows\System\REbZpTB.exe
  C:\Windows\System\REbZpTB.exe
  2⤵
  PID:8160
- C:\Windows\System\BvcNHrG.exe
  C:\Windows\System\BvcNHrG.exe
  2⤵
  PID:8176
- C:\Windows\System\Dwdtmvu.exe
  C:\Windows\System\Dwdtmvu.exe
  2⤵
  PID:7128
- C:\Windows\System\gzVPBST.exe
  C:\Windows\System\gzVPBST.exe
  2⤵
  PID:6772
- C:\Windows\System\ufwCEvo.exe
  C:\Windows\System\ufwCEvo.exe
  2⤵
  PID:7232
- C:\Windows\System\GxHixLX.exe
  C:\Windows\System\GxHixLX.exe
  2⤵
  PID:7264
- C:\Windows\System\GKqrHNV.exe
  C:\Windows\System\GKqrHNV.exe
  2⤵
  PID:7332
- C:\Windows\System\bLkIMlt.exe
  C:\Windows\System\bLkIMlt.exe
  2⤵
  PID:7396
- C:\Windows\System\vCnRfiT.exe
  C:\Windows\System\vCnRfiT.exe
  2⤵
  PID:7460
- C:\Windows\System\GUtCXZv.exe
  C:\Windows\System\GUtCXZv.exe
  2⤵
  PID:7524
- C:\Windows\System\fThaafx.exe
  C:\Windows\System\fThaafx.exe
  2⤵
  PID:7588
- C:\Windows\System\HOMWuva.exe
  C:\Windows\System\HOMWuva.exe
  2⤵
  PID:7284
- C:\Windows\System\sYHFqBG.exe
  C:\Windows\System\sYHFqBG.exe
  2⤵
  PID:7412
- C:\Windows\System\xUZvIfs.exe
  C:\Windows\System\xUZvIfs.exe
  2⤵
  PID:7316
- C:\Windows\System\hZqSzce.exe
  C:\Windows\System\hZqSzce.exe
  2⤵
  PID:7444
- C:\Windows\System\ldtDSqT.exe
  C:\Windows\System\ldtDSqT.exe
  2⤵
  PID:7512
- C:\Windows\System\YjTqALW.exe
  C:\Windows\System\YjTqALW.exe
  2⤵
  PID:7576
- C:\Windows\System\fBjiDwy.exe
  C:\Windows\System\fBjiDwy.exe
  2⤵
  PID:7656
- C:\Windows\System\yZdUaaJ.exe
  C:\Windows\System\yZdUaaJ.exe
  2⤵
  PID:7692
- C:\Windows\System\HelrdEN.exe
  C:\Windows\System\HelrdEN.exe
  2⤵
  PID:7672
- C:\Windows\System\wwFHStA.exe
  C:\Windows\System\wwFHStA.exe
  2⤵
  PID:7724
- C:\Windows\System\yJENxWy.exe
  C:\Windows\System\yJENxWy.exe
  2⤵
  PID:7756
- C:\Windows\System\cMDMvMP.exe
  C:\Windows\System\cMDMvMP.exe
  2⤵
  PID:7820
- C:\Windows\System\iqXIMsW.exe
  C:\Windows\System\iqXIMsW.exe
  2⤵
  PID:7912
- C:\Windows\System\YmzysjX.exe
  C:\Windows\System\YmzysjX.exe
  2⤵
  PID:7768
- C:\Windows\System\yCzOuuS.exe
  C:\Windows\System\yCzOuuS.exe
  2⤵
  PID:7976
- C:\Windows\System\GOQrbTn.exe
  C:\Windows\System\GOQrbTn.exe
  2⤵
  PID:8012
- C:\Windows\System\JsspPzL.exe
  C:\Windows\System\JsspPzL.exe
  2⤵
  PID:7800
- C:\Windows\System\VUyXipF.exe
  C:\Windows\System\VUyXipF.exe
  2⤵
  PID:7996
- C:\Windows\System\endFbuJ.exe
  C:\Windows\System\endFbuJ.exe
  2⤵
  PID:8104
- C:\Windows\System\KjEuopN.exe
  C:\Windows\System\KjEuopN.exe
  2⤵
  PID:7964
- C:\Windows\System\ZEDmMKq.exe
  C:\Windows\System\ZEDmMKq.exe
  2⤵
  PID:8136
- C:\Windows\System\fAFUGPJ.exe
  C:\Windows\System\fAFUGPJ.exe
  2⤵
  PID:8168
- C:\Windows\System\RWlqCkf.exe
  C:\Windows\System\RWlqCkf.exe
  2⤵
  PID:6660
- C:\Windows\System\xovxWIj.exe
  C:\Windows\System\xovxWIj.exe
  2⤵
  PID:7364
- C:\Windows\System\LIUrHoS.exe
  C:\Windows\System\LIUrHoS.exe
  2⤵
  PID:8124
- C:\Windows\System\kHXfnfR.exe
  C:\Windows\System\kHXfnfR.exe
  2⤵
  PID:7300
- C:\Windows\System\AIYkRJS.exe
  C:\Windows\System\AIYkRJS.exe
  2⤵
  PID:7188
- C:\Windows\System\lJhcvNE.exe
  C:\Windows\System\lJhcvNE.exe
  2⤵
  PID:7432
- C:\Windows\System\DKsJFNZ.exe
  C:\Windows\System\DKsJFNZ.exe
  2⤵
  PID:7252
- C:\Windows\System\vZeIehh.exe
  C:\Windows\System\vZeIehh.exe
  2⤵
  PID:7288
- C:\Windows\System\GuqtEKh.exe
  C:\Windows\System\GuqtEKh.exe
  2⤵
  PID:7480
- C:\Windows\System\XGhwBwe.exe
  C:\Windows\System\XGhwBwe.exe
  2⤵
  PID:7640
- C:\Windows\System\SGxZRej.exe
  C:\Windows\System\SGxZRej.exe
  2⤵
  PID:7688
- C:\Windows\System\ownGEDz.exe
  C:\Windows\System\ownGEDz.exe
  2⤵
  PID:7704
- C:\Windows\System\elOvoPH.exe
  C:\Windows\System\elOvoPH.exe
  2⤵
  PID:7852
- C:\Windows\System\vXalWHP.exe
  C:\Windows\System\vXalWHP.exe
  2⤵
  PID:7916
- C:\Windows\System\oNofzuo.exe
  C:\Windows\System\oNofzuo.exe
  2⤵
  PID:7960
- C:\Windows\System\EyAHjCb.exe
  C:\Windows\System\EyAHjCb.exe
  2⤵
  PID:7836
- C:\Windows\System\IUtDNDN.exe
  C:\Windows\System\IUtDNDN.exe
  2⤵
  PID:8056
- C:\Windows\System\EPzYtXS.exe
  C:\Windows\System\EPzYtXS.exe
  2⤵
  PID:8024
- C:\Windows\System\CsNdviy.exe
  C:\Windows\System\CsNdviy.exe
  2⤵
  PID:7428
- C:\Windows\System\bZkYFUS.exe
  C:\Windows\System\bZkYFUS.exe
  2⤵
  PID:7384
- C:\Windows\System\rEWifwR.exe
  C:\Windows\System\rEWifwR.exe
  2⤵
  PID:7788
- C:\Windows\System\FAteAqN.exe
  C:\Windows\System\FAteAqN.exe
  2⤵
  PID:7236
- C:\Windows\System\PtbTpTf.exe
  C:\Windows\System\PtbTpTf.exe
  2⤵
  PID:8040
- C:\Windows\System\lvMkvyV.exe
  C:\Windows\System\lvMkvyV.exe
  2⤵
  PID:7304
- C:\Windows\System\DcvBdHV.exe
  C:\Windows\System\DcvBdHV.exe
  2⤵
  PID:6904
- C:\Windows\System\kGGsIjb.exe
  C:\Windows\System\kGGsIjb.exe
  2⤵
  PID:7628
- C:\Windows\System\NgGphom.exe
  C:\Windows\System\NgGphom.exe
  2⤵
  PID:7380
- C:\Windows\System\AobCSWk.exe
  C:\Windows\System\AobCSWk.exe
  2⤵
  PID:7740
- C:\Windows\System\ITXaJPn.exe
  C:\Windows\System\ITXaJPn.exe
  2⤵
  PID:8200
- C:\Windows\System\hjWcnZw.exe
  C:\Windows\System\hjWcnZw.exe
  2⤵
  PID:8216
- C:\Windows\System\UQpsIFs.exe
  C:\Windows\System\UQpsIFs.exe
  2⤵
  PID:8232
- C:\Windows\System\ONTBjXw.exe
  C:\Windows\System\ONTBjXw.exe
  2⤵
  PID:8248
- C:\Windows\System\dQvrKng.exe
  C:\Windows\System\dQvrKng.exe
  2⤵
  PID:8264
- C:\Windows\System\rytkMos.exe
  C:\Windows\System\rytkMos.exe
  2⤵
  PID:8280
- C:\Windows\System\rAJQteG.exe
  C:\Windows\System\rAJQteG.exe
  2⤵
  PID:8296
- C:\Windows\System\lvaRunB.exe
  C:\Windows\System\lvaRunB.exe
  2⤵
  PID:8312
- C:\Windows\System\ivuDAxP.exe
  C:\Windows\System\ivuDAxP.exe
  2⤵
  PID:8328
- C:\Windows\System\lVgPrhF.exe
  C:\Windows\System\lVgPrhF.exe
  2⤵
  PID:8344
- C:\Windows\System\PiqQsDJ.exe
  C:\Windows\System\PiqQsDJ.exe
  2⤵
  PID:8360
- C:\Windows\System\xFGIRVD.exe
  C:\Windows\System\xFGIRVD.exe
  2⤵
  PID:8376
- C:\Windows\System\QJQTrkn.exe
  C:\Windows\System\QJQTrkn.exe
  2⤵
  PID:8392
- C:\Windows\System\CKzgaRo.exe
  C:\Windows\System\CKzgaRo.exe
  2⤵
  PID:8412
- C:\Windows\System\TrNJbpD.exe
  C:\Windows\System\TrNJbpD.exe
  2⤵
  PID:8428
- C:\Windows\System\dtBAhaA.exe
  C:\Windows\System\dtBAhaA.exe
  2⤵
  PID:8444
- C:\Windows\System\wJENaUt.exe
  C:\Windows\System\wJENaUt.exe
  2⤵
  PID:8460
- C:\Windows\System\hcZpYWE.exe
  C:\Windows\System\hcZpYWE.exe
  2⤵
  PID:8476
- C:\Windows\System\fODpvho.exe
  C:\Windows\System\fODpvho.exe
  2⤵
  PID:8492
- C:\Windows\System\LmLEvdA.exe
  C:\Windows\System\LmLEvdA.exe
  2⤵
  PID:8508
- C:\Windows\System\NImOXKv.exe
  C:\Windows\System\NImOXKv.exe
  2⤵
  PID:8524
- C:\Windows\System\JvftWRz.exe
  C:\Windows\System\JvftWRz.exe
  2⤵
  PID:8540
- C:\Windows\System\MgpaJBm.exe
  C:\Windows\System\MgpaJBm.exe
  2⤵
  PID:8556
- C:\Windows\System\SBBozia.exe
  C:\Windows\System\SBBozia.exe
  2⤵
  PID:8572
- C:\Windows\System\hCMXGtm.exe
  C:\Windows\System\hCMXGtm.exe
  2⤵
  PID:8588
- C:\Windows\System\QucwvjM.exe
  C:\Windows\System\QucwvjM.exe
  2⤵
  PID:8604
- C:\Windows\System\eTojzdM.exe
  C:\Windows\System\eTojzdM.exe
  2⤵
  PID:8620
- C:\Windows\System\ODshQJY.exe
  C:\Windows\System\ODshQJY.exe
  2⤵
  PID:8636
- C:\Windows\System\gAKweRM.exe
  C:\Windows\System\gAKweRM.exe
  2⤵
  PID:8652
- C:\Windows\System\DFsNgxZ.exe
  C:\Windows\System\DFsNgxZ.exe
  2⤵
  PID:8668
- C:\Windows\System\AKyHdjW.exe
  C:\Windows\System\AKyHdjW.exe
  2⤵
  PID:8684
- C:\Windows\System\sWjZWtK.exe
  C:\Windows\System\sWjZWtK.exe
  2⤵
  PID:8700
- C:\Windows\System\vYYTKmp.exe
  C:\Windows\System\vYYTKmp.exe
  2⤵
  PID:8716
- C:\Windows\System\ChAMfOH.exe
  C:\Windows\System\ChAMfOH.exe
  2⤵
  PID:8732
- C:\Windows\System\pjhMpkx.exe
  C:\Windows\System\pjhMpkx.exe
  2⤵
  PID:8748
- C:\Windows\System\fmoWssB.exe
  C:\Windows\System\fmoWssB.exe
  2⤵
  PID:8764
- C:\Windows\System\MJHbthy.exe
  C:\Windows\System\MJHbthy.exe
  2⤵
  PID:8780
- C:\Windows\System\adhtjvg.exe
  C:\Windows\System\adhtjvg.exe
  2⤵
  PID:8796
- C:\Windows\System\vQFteck.exe
  C:\Windows\System\vQFteck.exe
  2⤵
  PID:8812
- C:\Windows\System\ZnLkPTR.exe
  C:\Windows\System\ZnLkPTR.exe
  2⤵
  PID:8828
- C:\Windows\System\wXLBKXk.exe
  C:\Windows\System\wXLBKXk.exe
  2⤵
  PID:8844
- C:\Windows\System\PJSSbuI.exe
  C:\Windows\System\PJSSbuI.exe
  2⤵
  PID:8860
- C:\Windows\System\avKtWqS.exe
  C:\Windows\System\avKtWqS.exe
  2⤵
  PID:8876
- C:\Windows\System\KiXMFoI.exe
  C:\Windows\System\KiXMFoI.exe
  2⤵
  PID:8892
- C:\Windows\System\gqHqSoc.exe
  C:\Windows\System\gqHqSoc.exe
  2⤵
  PID:8908
- C:\Windows\System\YSABmUu.exe
  C:\Windows\System\YSABmUu.exe
  2⤵
  PID:8924
- C:\Windows\System\dMdbNSE.exe
  C:\Windows\System\dMdbNSE.exe
  2⤵
  PID:8940
- C:\Windows\System\uqhxZLb.exe
  C:\Windows\System\uqhxZLb.exe
  2⤵
  PID:8956
- C:\Windows\System\aSPThpr.exe
  C:\Windows\System\aSPThpr.exe
  2⤵
  PID:8972
- C:\Windows\System\UgykNYa.exe
  C:\Windows\System\UgykNYa.exe
  2⤵
  PID:8988
- C:\Windows\System\vtcHLBs.exe
  C:\Windows\System\vtcHLBs.exe
  2⤵
  PID:9004
- C:\Windows\System\msPQxJB.exe
  C:\Windows\System\msPQxJB.exe
  2⤵
  PID:9020
- C:\Windows\System\BAjWheb.exe
  C:\Windows\System\BAjWheb.exe
  2⤵
  PID:9036
- C:\Windows\System\FEvnRTg.exe
  C:\Windows\System\FEvnRTg.exe
  2⤵
  PID:9052
- C:\Windows\System\TsGABvZ.exe
  C:\Windows\System\TsGABvZ.exe
  2⤵
  PID:9068
- C:\Windows\System\XyyvUtL.exe
  C:\Windows\System\XyyvUtL.exe
  2⤵
  PID:9084
- C:\Windows\System\OjCwhFG.exe
  C:\Windows\System\OjCwhFG.exe
  2⤵
  PID:9100
- C:\Windows\System\THclPzy.exe
  C:\Windows\System\THclPzy.exe
  2⤵
  PID:9116
- C:\Windows\System\vYZuVGy.exe
  C:\Windows\System\vYZuVGy.exe
  2⤵
  PID:9132
- C:\Windows\System\bGyTMco.exe
  C:\Windows\System\bGyTMco.exe
  2⤵
  PID:9148
- C:\Windows\System\OQDzaaR.exe
  C:\Windows\System\OQDzaaR.exe
  2⤵
  PID:9164
- C:\Windows\System\IWeCizu.exe
  C:\Windows\System\IWeCizu.exe
  2⤵
  PID:9180
- C:\Windows\System\invhPNy.exe
  C:\Windows\System\invhPNy.exe
  2⤵
  PID:9196
- C:\Windows\System\CAEFiAi.exe
  C:\Windows\System\CAEFiAi.exe
  2⤵
  PID:9212
- C:\Windows\System\LToeqTN.exe
  C:\Windows\System\LToeqTN.exe
  2⤵
  PID:8196
- C:\Windows\System\ibLaEpM.exe
  C:\Windows\System\ibLaEpM.exe
  2⤵
  PID:7896
- C:\Windows\System\RftlYzi.exe
  C:\Windows\System\RftlYzi.exe
  2⤵
  PID:8060
- C:\Windows\System\BLYlYCv.exe
  C:\Windows\System\BLYlYCv.exe
  2⤵
  PID:7560
- C:\Windows\System\ansuRCb.exe
  C:\Windows\System\ansuRCb.exe
  2⤵
  PID:7948
- C:\Windows\System\OOguMPg.exe
  C:\Windows\System\OOguMPg.exe
  2⤵
  PID:8276
- C:\Windows\System\XSwrlNy.exe
  C:\Windows\System\XSwrlNy.exe
  2⤵
  PID:8352
- C:\Windows\System\PqJzeLJ.exe
  C:\Windows\System\PqJzeLJ.exe
  2⤵
  PID:8424
- C:\Windows\System\BfWBhRN.exe
  C:\Windows\System\BfWBhRN.exe
  2⤵
  PID:8304
- C:\Windows\System\WZEMLLF.exe
  C:\Windows\System\WZEMLLF.exe
  2⤵
  PID:8484
- C:\Windows\System\yMEEhXA.exe
  C:\Windows\System\yMEEhXA.exe
  2⤵
  PID:8368
- C:\Windows\System\lwcNSUc.exe
  C:\Windows\System\lwcNSUc.exe
  2⤵
  PID:8408
- C:\Windows\System\fYWMOND.exe
  C:\Windows\System\fYWMOND.exe
  2⤵
  PID:8520
- C:\Windows\System\DDOAfPw.exe
  C:\Windows\System\DDOAfPw.exe
  2⤵
  PID:8500
- C:\Windows\System\BBcPAfU.exe
  C:\Windows\System\BBcPAfU.exe
  2⤵
  PID:8580
- C:\Windows\System\qgjAfIt.exe
  C:\Windows\System\qgjAfIt.exe
  2⤵
  PID:8612
- C:\Windows\System\qWizJmd.exe
  C:\Windows\System\qWizJmd.exe
  2⤵
  PID:8644
- C:\Windows\System\DolcEie.exe
  C:\Windows\System\DolcEie.exe
  2⤵
  PID:8676
- C:\Windows\System\cuUresX.exe
  C:\Windows\System\cuUresX.exe
  2⤵
  PID:8708
- C:\Windows\System\wBBzthX.exe
  C:\Windows\System\wBBzthX.exe
  2⤵
  PID:8740
- C:\Windows\System\tQcsPTp.exe
  C:\Windows\System\tQcsPTp.exe
  2⤵
  PID:8772
- C:\Windows\System\ocYRANI.exe
  C:\Windows\System\ocYRANI.exe
  2⤵
  PID:8836
- C:\Windows\System\xKraFtD.exe
  C:\Windows\System\xKraFtD.exe
  2⤵
  PID:8900
- C:\Windows\System\oBGVYLG.exe
  C:\Windows\System\oBGVYLG.exe
  2⤵
  PID:8964
- C:\Windows\System\QvwBEJA.exe
  C:\Windows\System\QvwBEJA.exe
  2⤵
  PID:7280
- C:\Windows\System\xdKKJOt.exe
  C:\Windows\System\xdKKJOt.exe
  2⤵
  PID:8916
- C:\Windows\System\GTlhfmM.exe
  C:\Windows\System\GTlhfmM.exe
  2⤵
  PID:8920
- C:\Windows\System\ElztvSZ.exe
  C:\Windows\System\ElztvSZ.exe
  2⤵
  PID:8888
- C:\Windows\System\UbXzNrj.exe
  C:\Windows\System\UbXzNrj.exe
  2⤵
  PID:8984
- C:\Windows\System\DSwfbjF.exe
  C:\Windows\System\DSwfbjF.exe
  2⤵
  PID:9044
- C:\Windows\System\EdtvOqi.exe
  C:\Windows\System\EdtvOqi.exe
  2⤵
  PID:9060
- C:\Windows\System\tjQgeeU.exe
  C:\Windows\System\tjQgeeU.exe
  2⤵
  PID:9096
- C:\Windows\System\HbbsNbz.exe
  C:\Windows\System\HbbsNbz.exe
  2⤵
  PID:9160
- C:\Windows\System\LOSjBZh.exe
  C:\Windows\System\LOSjBZh.exe
  2⤵
  PID:7184
- C:\Windows\System\wmWuIWX.exe
  C:\Windows\System\wmWuIWX.exe
  2⤵
  PID:7816
- C:\Windows\System\YQcKYYQ.exe
  C:\Windows\System\YQcKYYQ.exe
  2⤵
  PID:8320
- C:\Windows\System\AnbFOWU.exe
  C:\Windows\System\AnbFOWU.exe
  2⤵
  PID:8240
- C:\Windows\System\vsLqBxj.exe
  C:\Windows\System\vsLqBxj.exe
  2⤵
  PID:9172
- C:\Windows\System\UAZFTmd.exe
  C:\Windows\System\UAZFTmd.exe
  2⤵
  PID:9112
- C:\Windows\System\gtrUtjc.exe
  C:\Windows\System\gtrUtjc.exe
  2⤵
  PID:8488
- C:\Windows\System\uwGKbob.exe
  C:\Windows\System\uwGKbob.exe
  2⤵
  PID:8340
- C:\Windows\System\mZpvfxE.exe
  C:\Windows\System\mZpvfxE.exe
  2⤵
  PID:8536
- C:\Windows\System\NCkpbsy.exe
  C:\Windows\System\NCkpbsy.exe
  2⤵
  PID:8600
- C:\Windows\System\mbZhopf.exe
  C:\Windows\System\mbZhopf.exe
  2⤵
  PID:8664
- C:\Windows\System\zvtdSQm.exe
  C:\Windows\System\zvtdSQm.exe
  2⤵
  PID:8692
- C:\Windows\System\hVDaDEX.exe
  C:\Windows\System\hVDaDEX.exe
  2⤵
  PID:8868
- C:\Windows\System\xOnLhUh.exe
  C:\Windows\System\xOnLhUh.exe
  2⤵
  PID:8808
- C:\Windows\System\KKfZrLk.exe
  C:\Windows\System\KKfZrLk.exe
  2⤵
  PID:8852
- C:\Windows\System\BqvPyny.exe
  C:\Windows\System\BqvPyny.exe
  2⤵
  PID:8936
- C:\Windows\System\DOYZLwi.exe
  C:\Windows\System\DOYZLwi.exe
  2⤵
  PID:8824
- C:\Windows\System\NoLnoBf.exe
  C:\Windows\System\NoLnoBf.exe
  2⤵
  PID:8208
- C:\Windows\System\RMUamnQ.exe
  C:\Windows\System\RMUamnQ.exe
  2⤵
  PID:9016
- C:\Windows\System\jccfcZB.exe
  C:\Windows\System\jccfcZB.exe
  2⤵
  PID:7832
- C:\Windows\System\KgzdlLU.exe
  C:\Windows\System\KgzdlLU.exe
  2⤵
  PID:9108
- C:\Windows\System\NlFyOyN.exe
  C:\Windows\System\NlFyOyN.exe
  2⤵
  PID:9208
- C:\Windows\System\OJgWsnG.exe
  C:\Windows\System\OJgWsnG.exe
  2⤵
  PID:8596
- C:\Windows\System\TlSaEDF.exe
  C:\Windows\System\TlSaEDF.exe
  2⤵
  PID:8932
- C:\Windows\System\GKOyNrX.exe
  C:\Windows\System\GKOyNrX.exe
  2⤵
  PID:8980
- C:\Windows\System\mlqtSuH.exe
  C:\Windows\System\mlqtSuH.exe
  2⤵
  PID:9092
- C:\Windows\System\WCDAVwT.exe
  C:\Windows\System\WCDAVwT.exe
  2⤵
  PID:8472
- C:\Windows\System\jxBLGvJ.exe
  C:\Windows\System\jxBLGvJ.exe
  2⤵
  PID:8468
- C:\Windows\System\cdSHsnH.exe
  C:\Windows\System\cdSHsnH.exe
  2⤵
  PID:8632
- C:\Windows\System\lOlUwJX.exe
  C:\Windows\System\lOlUwJX.exe
  2⤵
  PID:9232
- C:\Windows\System\DGVbXuN.exe
  C:\Windows\System\DGVbXuN.exe
  2⤵
  PID:9268
- C:\Windows\System\ghNWPZe.exe
  C:\Windows\System\ghNWPZe.exe
  2⤵
  PID:9284
- C:\Windows\System\HrumznA.exe
  C:\Windows\System\HrumznA.exe
  2⤵
  PID:9304
- C:\Windows\System\pghkVSb.exe
  C:\Windows\System\pghkVSb.exe
  2⤵
  PID:9320
- C:\Windows\System\teAAcnv.exe
  C:\Windows\System\teAAcnv.exe
  2⤵
  PID:9340
- C:\Windows\System\dGjHmcO.exe
  C:\Windows\System\dGjHmcO.exe
  2⤵
  PID:9356
- C:\Windows\System\FEUsNWO.exe
  C:\Windows\System\FEUsNWO.exe
  2⤵
  PID:9372
- C:\Windows\System\cBYIoDp.exe
  C:\Windows\System\cBYIoDp.exe
  2⤵
  PID:9388
- C:\Windows\System\EwHiKHT.exe
  C:\Windows\System\EwHiKHT.exe
  2⤵
  PID:9404
- C:\Windows\System\cKNloRG.exe
  C:\Windows\System\cKNloRG.exe
  2⤵
  PID:9420
- C:\Windows\System\vlSfSEB.exe
  C:\Windows\System\vlSfSEB.exe
  2⤵
  PID:9440
- C:\Windows\System\zpDAEGF.exe
  C:\Windows\System\zpDAEGF.exe
  2⤵
  PID:9456
- C:\Windows\System\dYTMKMB.exe
  C:\Windows\System\dYTMKMB.exe
  2⤵
  PID:9472
- C:\Windows\System\iTZocdI.exe
  C:\Windows\System\iTZocdI.exe
  2⤵
  PID:9488
- C:\Windows\System\rLxtGuT.exe
  C:\Windows\System\rLxtGuT.exe
  2⤵
  PID:9508
- C:\Windows\System\DzWSLyp.exe
  C:\Windows\System\DzWSLyp.exe
  2⤵
  PID:9524
- C:\Windows\System\SeBDNPE.exe
  C:\Windows\System\SeBDNPE.exe
  2⤵
  PID:9540
- C:\Windows\System\DpJkpga.exe
  C:\Windows\System\DpJkpga.exe
  2⤵
  PID:9560
- C:\Windows\System\TYYCYtU.exe
  C:\Windows\System\TYYCYtU.exe
  2⤵
  PID:9576
- C:\Windows\System\YMCNdIQ.exe
  C:\Windows\System\YMCNdIQ.exe
  2⤵
  PID:9596
- C:\Windows\System\SVJcGMp.exe
  C:\Windows\System\SVJcGMp.exe
  2⤵
  PID:9612
- C:\Windows\System\WoQjxLT.exe
  C:\Windows\System\WoQjxLT.exe
  2⤵
  PID:9628
- C:\Windows\System\GXiibBb.exe
  C:\Windows\System\GXiibBb.exe
  2⤵
  PID:9644
- C:\Windows\System\slkIUwN.exe
  C:\Windows\System\slkIUwN.exe
  2⤵
  PID:9660
- C:\Windows\System\BXCljBI.exe
  C:\Windows\System\BXCljBI.exe
  2⤵
  PID:9676
- C:\Windows\System\pZkjEBE.exe
  C:\Windows\System\pZkjEBE.exe
  2⤵
  PID:9692
- C:\Windows\System\ndzBzeq.exe
  C:\Windows\System\ndzBzeq.exe
  2⤵
  PID:9708
- C:\Windows\System\xtXgBYq.exe
  C:\Windows\System\xtXgBYq.exe
  2⤵
  PID:9724
- C:\Windows\System\YHkzZRq.exe
  C:\Windows\System\YHkzZRq.exe
  2⤵
  PID:9740
- C:\Windows\System\iCysDwF.exe
  C:\Windows\System\iCysDwF.exe
  2⤵
  PID:9756
- C:\Windows\System\PGcUKbn.exe
  C:\Windows\System\PGcUKbn.exe
  2⤵
  PID:9772
- C:\Windows\System\VlXwnEP.exe
  C:\Windows\System\VlXwnEP.exe
  2⤵
  PID:9792
- C:\Windows\System\WrVeYPc.exe
  C:\Windows\System\WrVeYPc.exe
  2⤵
  PID:9808
- C:\Windows\System\SZCChor.exe
  C:\Windows\System\SZCChor.exe
  2⤵
  PID:9824
- C:\Windows\System\WNHbGvb.exe
  C:\Windows\System\WNHbGvb.exe
  2⤵
  PID:9840
- C:\Windows\System\GbwPkVC.exe
  C:\Windows\System\GbwPkVC.exe
  2⤵
  PID:9856
- C:\Windows\System\SXrrsPs.exe
  C:\Windows\System\SXrrsPs.exe
  2⤵
  PID:9872
- C:\Windows\System\tLFMItT.exe
  C:\Windows\System\tLFMItT.exe
  2⤵
  PID:9888
- C:\Windows\System\fCcGgNc.exe
  C:\Windows\System\fCcGgNc.exe
  2⤵
  PID:9904
- C:\Windows\System\xpOKczm.exe
  C:\Windows\System\xpOKczm.exe
  2⤵
  PID:9920
- C:\Windows\System\LSEwYAl.exe
  C:\Windows\System\LSEwYAl.exe
  2⤵
  PID:9936
- C:\Windows\System\xFxzOfx.exe
  C:\Windows\System\xFxzOfx.exe
  2⤵
  PID:9952
- C:\Windows\System\KZGkdEc.exe
  C:\Windows\System\KZGkdEc.exe
  2⤵
  PID:9968
- C:\Windows\System\ykLMKyg.exe
  C:\Windows\System\ykLMKyg.exe
  2⤵
  PID:9984
- C:\Windows\System\LKydqJm.exe
  C:\Windows\System\LKydqJm.exe
  2⤵
  PID:10000
- C:\Windows\System\MkSdOsR.exe
  C:\Windows\System\MkSdOsR.exe
  2⤵
  PID:10016
- C:\Windows\System\tmWOaWn.exe
  C:\Windows\System\tmWOaWn.exe
  2⤵
  PID:10032
- C:\Windows\System\zBkBxpW.exe
  C:\Windows\System\zBkBxpW.exe
  2⤵
  PID:10048
- C:\Windows\System\NeJLtpg.exe
  C:\Windows\System\NeJLtpg.exe
  2⤵
  PID:10064
- C:\Windows\System\UQxChZW.exe
  C:\Windows\System\UQxChZW.exe
  2⤵
  PID:10080
- C:\Windows\System\CNbLUvL.exe
  C:\Windows\System\CNbLUvL.exe
  2⤵
  PID:10096
- C:\Windows\System\HybmOpD.exe
  C:\Windows\System\HybmOpD.exe
  2⤵
  PID:10112
- C:\Windows\System\akfhnrn.exe
  C:\Windows\System\akfhnrn.exe
  2⤵
  PID:10128
- C:\Windows\System\GEnRitj.exe
  C:\Windows\System\GEnRitj.exe
  2⤵
  PID:10144
- C:\Windows\System\CGTXfbF.exe
  C:\Windows\System\CGTXfbF.exe
  2⤵
  PID:10160
- C:\Windows\System\gSrwSLc.exe
  C:\Windows\System\gSrwSLc.exe
  2⤵
  PID:10176
- C:\Windows\System\ZDDYFFc.exe
  C:\Windows\System\ZDDYFFc.exe
  2⤵
  PID:10192
- C:\Windows\System\ENioQSe.exe
  C:\Windows\System\ENioQSe.exe
  2⤵
  PID:10208
- C:\Windows\System\PWyAKZN.exe
  C:\Windows\System\PWyAKZN.exe
  2⤵
  PID:10224
- C:\Windows\System\FMPnkeT.exe
  C:\Windows\System\FMPnkeT.exe
  2⤵
  PID:9224
- C:\Windows\System\DjdHYzt.exe
  C:\Windows\System\DjdHYzt.exe
  2⤵
  PID:7928
- C:\Windows\System\FelRWji.exe
  C:\Windows\System\FelRWji.exe
  2⤵
  PID:9080
- C:\Windows\System\niSYgxy.exe
  C:\Windows\System\niSYgxy.exe
  2⤵
  PID:8228
- C:\Windows\System\cemIbof.exe
  C:\Windows\System\cemIbof.exe
  2⤵
  PID:8456
- C:\Windows\System\fqGtRKu.exe
  C:\Windows\System\fqGtRKu.exe
  2⤵
  PID:9244
- C:\Windows\System\wWmNymt.exe
  C:\Windows\System\wWmNymt.exe
  2⤵
  PID:9280
- C:\Windows\System\CMMDCgs.exe
  C:\Windows\System\CMMDCgs.exe
  2⤵
  PID:9352
- C:\Windows\System\llMcgNa.exe
  C:\Windows\System\llMcgNa.exe
  2⤵
  PID:9416
- C:\Windows\System\hxWQTva.exe
  C:\Windows\System\hxWQTva.exe
  2⤵
  PID:9484
- C:\Windows\System\hqkuLFZ.exe
  C:\Windows\System\hqkuLFZ.exe
  2⤵
  PID:9552
- C:\Windows\System\mWYSTur.exe
  C:\Windows\System\mWYSTur.exe
  2⤵
  PID:9592
- C:\Windows\System\PUjeaDF.exe
  C:\Windows\System\PUjeaDF.exe
  2⤵
  PID:9436
- C:\Windows\System\RABobgr.exe
  C:\Windows\System\RABobgr.exe
  2⤵
  PID:9688
- C:\Windows\System\NgYyPNg.exe
  C:\Windows\System\NgYyPNg.exe
  2⤵
  PID:9336
- C:\Windows\System\yOevMkp.exe
  C:\Windows\System\yOevMkp.exe
  2⤵
  PID:9468
- C:\Windows\System\IMlPnnn.exe
  C:\Windows\System\IMlPnnn.exe
  2⤵
  PID:9568
- C:\Windows\System\jYlEicC.exe
  C:\Windows\System\jYlEicC.exe
  2⤵
  PID:9496
- C:\Windows\System\HWPpxkJ.exe
  C:\Windows\System\HWPpxkJ.exe
  2⤵
  PID:9536
- C:\Windows\System\bCVZJKg.exe
  C:\Windows\System\bCVZJKg.exe
  2⤵
  PID:9608
- C:\Windows\System\PiZqCNy.exe
  C:\Windows\System\PiZqCNy.exe
  2⤵
  PID:9672
- C:\Windows\System\FKLmcjF.exe
  C:\Windows\System\FKLmcjF.exe
  2⤵
  PID:9752
- C:\Windows\System\UnddmjW.exe
  C:\Windows\System\UnddmjW.exe
  2⤵
  PID:9820
- C:\Windows\System\vRhhiLK.exe
  C:\Windows\System\vRhhiLK.exe
  2⤵
  PID:9804
- C:\Windows\System\rhUKWUn.exe
  C:\Windows\System\rhUKWUn.exe
  2⤵
  PID:9836
- C:\Windows\System\pNDGyNg.exe
  C:\Windows\System\pNDGyNg.exe
  2⤵
  PID:9864
- C:\Windows\System\Idlcmdl.exe
  C:\Windows\System\Idlcmdl.exe
  2⤵
  PID:9896
- C:\Windows\System\oJkJQuc.exe
  C:\Windows\System\oJkJQuc.exe
  2⤵
  PID:9944
- C:\Windows\System\bwunBJW.exe
  C:\Windows\System\bwunBJW.exe
  2⤵
  PID:10012
- C:\Windows\System\tYWpefV.exe
  C:\Windows\System\tYWpefV.exe
  2⤵
  PID:10076
- C:\Windows\System\Njhgwaq.exe
  C:\Windows\System\Njhgwaq.exe
  2⤵
  PID:10140
- C:\Windows\System\OlSGPak.exe
  C:\Windows\System\OlSGPak.exe
  2⤵
  PID:9992
- C:\Windows\System\WmAiHzG.exe
  C:\Windows\System\WmAiHzG.exe
  2⤵
  PID:10232
- C:\Windows\System\xaUnOoK.exe
  C:\Windows\System\xaUnOoK.exe
  2⤵
  PID:9964
- C:\Windows\System\kezakbI.exe
  C:\Windows\System\kezakbI.exe
  2⤵
  PID:10056
- C:\Windows\System\lMoVLSE.exe
  C:\Windows\System\lMoVLSE.exe
  2⤵
  PID:10124
- C:\Windows\System\XpjjuUD.exe
  C:\Windows\System\XpjjuUD.exe
  2⤵
  PID:9000
- C:\Windows\System\etvDiQf.exe
  C:\Windows\System\etvDiQf.exe
  2⤵
  PID:8568
- C:\Windows\System\cVJLXHF.exe
  C:\Windows\System\cVJLXHF.exe
  2⤵
  PID:8440
- C:\Windows\System\NcJWDLF.exe
  C:\Windows\System\NcJWDLF.exe
  2⤵
  PID:9652
- C:\Windows\System\XyylhxI.exe
  C:\Windows\System\XyylhxI.exe
  2⤵
  PID:9620
- C:\Windows\System\yTAGKgr.exe
  C:\Windows\System\yTAGKgr.exe
  2⤵
  PID:9384
- C:\Windows\System\PjdCsja.exe
  C:\Windows\System\PjdCsja.exe
  2⤵
  PID:9240
- C:\Windows\System\OPSWxtb.exe
  C:\Windows\System\OPSWxtb.exe
  2⤵
  PID:9348
- C:\Windows\System\YuWljHc.exe
  C:\Windows\System\YuWljHc.exe
  2⤵
  PID:9640
- C:\Windows\System\BSUkEVs.exe
  C:\Windows\System\BSUkEVs.exe
  2⤵
  PID:9584
- C:\Windows\System\CgFPqlo.exe
  C:\Windows\System\CgFPqlo.exe
  2⤵
  PID:8760
- C:\Windows\System\wjiIiVV.exe
  C:\Windows\System\wjiIiVV.exe
  2⤵
  PID:9736
- C:\Windows\System\LtZTmFs.exe
  C:\Windows\System\LtZTmFs.exe
  2⤵
  PID:9912
- C:\Windows\System\lMdBiUJ.exe
  C:\Windows\System\lMdBiUJ.exe
  2⤵
  PID:9604
- C:\Windows\System\lKhLViQ.exe
  C:\Windows\System\lKhLViQ.exe
  2⤵
  PID:9868
- C:\Windows\System\MyFOuvl.exe
  C:\Windows\System\MyFOuvl.exe
  2⤵
  PID:10108
- C:\Windows\System\JIGlDlU.exe
  C:\Windows\System\JIGlDlU.exe
  2⤵
  PID:10204
- C:\Windows\System\kjzmlSm.exe
  C:\Windows\System\kjzmlSm.exe
  2⤵
  PID:10184
- C:\Windows\System\alilxFl.exe
  C:\Windows\System\alilxFl.exe
  2⤵
  PID:9624
- C:\Windows\System\HEJrYsj.exe
  C:\Windows\System\HEJrYsj.exe
  2⤵
  PID:9480
- C:\Windows\System\QuTFtdd.exe
  C:\Windows\System\QuTFtdd.exe
  2⤵
  PID:9932
- C:\Windows\System\nVtHCCJ.exe
  C:\Windows\System\nVtHCCJ.exe
  2⤵
  PID:10172
- C:\Windows\System\ztURbFt.exe
  C:\Windows\System\ztURbFt.exe
  2⤵
  PID:10092
- C:\Windows\System\sQGZKol.exe
  C:\Windows\System\sQGZKol.exe
  2⤵
  PID:9252
- C:\Windows\System\ZLSpeIU.exe
  C:\Windows\System\ZLSpeIU.exe
  2⤵
  PID:9504
- C:\Windows\System\bXtBbDf.exe
  C:\Windows\System\bXtBbDf.exe
  2⤵
  PID:9400
- C:\Windows\System\YXTxZxp.exe
  C:\Windows\System\YXTxZxp.exe
  2⤵
  PID:9572
- C:\Windows\System\dHEAqJu.exe
  C:\Windows\System\dHEAqJu.exe
  2⤵
  PID:10008
- C:\Windows\System\ejZNDvI.exe
  C:\Windows\System\ejZNDvI.exe
  2⤵
  PID:9428
- C:\Windows\System\MgdvjgJ.exe
  C:\Windows\System\MgdvjgJ.exe
  2⤵
  PID:10024
- C:\Windows\System\fUcIRiH.exe
  C:\Windows\System\fUcIRiH.exe
  2⤵
  PID:9816
- C:\Windows\System\JyrdiDj.exe
  C:\Windows\System\JyrdiDj.exe
  2⤵
  PID:10220
- C:\Windows\System\VHpOXqz.exe
  C:\Windows\System\VHpOXqz.exe
  2⤵
  PID:9464
- C:\Windows\System\eSfmoeS.exe
  C:\Windows\System\eSfmoeS.exe
  2⤵
  PID:8552
- C:\Windows\System\IuDYGFL.exe
  C:\Windows\System\IuDYGFL.exe
  2⤵
  PID:9852
- C:\Windows\System\iNjDsAx.exe
  C:\Windows\System\iNjDsAx.exe
  2⤵
  PID:10256
- C:\Windows\System\PEYXvFW.exe
  C:\Windows\System\PEYXvFW.exe
  2⤵
  PID:10272
- C:\Windows\System\fZqKqqW.exe
  C:\Windows\System\fZqKqqW.exe
  2⤵
  PID:10288
- C:\Windows\System\BuASnUw.exe
  C:\Windows\System\BuASnUw.exe
  2⤵
  PID:10304
- C:\Windows\System\nVEAGOl.exe
  C:\Windows\System\nVEAGOl.exe
  2⤵
  PID:10320
- C:\Windows\System\CUESrmY.exe
  C:\Windows\System\CUESrmY.exe
  2⤵
  PID:10336
- C:\Windows\System\wLsRGSR.exe
  C:\Windows\System\wLsRGSR.exe
  2⤵
  PID:10352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DOTQShP.exe

Filesize
974KB

MD5
fa21ab83d5286f85bb76842ba67b1905

SHA1
2845ae3b3006be455e80671b53189767caa8d206

SHA256
e5a5fb252b2012f7b0e50a2fc9566e9037582b0c0a20eb6a4786e31ab93646db

SHA512
2346002261d518177065c82254804f3b16ec0461a4a2a09c5feaeab7e8701069487f01ff2a49d8ccf8d85bcd4b00e97f2447a3f918b71ff3d45bb08018f8f8f6

Download Submit
C:\Windows\system\DPCYhEN.exe

Filesize
975KB

MD5
9e8afd4705c2740493c0a45b77fb81c9

SHA1
cf5587d3ad43d3e0174314c20f43347fbd712f92

SHA256
c815a443606a521804283788963ed98e58a5b79d0286535aba816e4f45038e80

SHA512
8be69e6d6d9dc539512f605d095f5090212caa4569c20718a131072c672c4ccf77e845741374113a6ac4f22c55e2b207ebac43bccf5af0a4d3b04a960c717536

Download Submit
C:\Windows\system\Euhesbh.exe

Filesize
974KB

MD5
3afbdc5d1f7af16fa1b998bbe9a01097

SHA1
286d4fdc7c6813f98fa8ed16d09ddeba2b552d17

SHA256
f227115db6d78fe36b64013e2419581884535152f6d6c4d298b07e1409d871eb

SHA512
5c98d96a698e7bbb734d610a65f750f2f99255e22b22ae74a18fc804009a3c195c0933603f372e9fb580765cef7d5d604781e7388cc11e0a914c164a1269fe75

Download Submit
C:\Windows\system\GdNHJUI.exe

Filesize
976KB

MD5
8b64fb92750a9f394ceea5a19c885434

SHA1
fbcc04123f43671588a470d91b2678502e01ebc9

SHA256
6af74e40e9ac63fff35b1be25fc9c738d357adae1f10370f43ca13d7dca97751

SHA512
76f546a67e144420aec4877a363b1a62c65200cd292e1ea9939ec9270c0e1e4f82ccd89f5d884015d5ee1cb6dedb7d7cb78d9378c883fd8b0a7d9928f258e5a2

Download Submit
C:\Windows\system\JEDXJPa.exe

Filesize
980KB

MD5
8f52a408ff783c4cd998997df7767bf2

SHA1
d0019a963ab1afa42340034baba23fd5e57b96e2

SHA256
1249bd85ececa5f78de7ac2093f407121286b636febe04dfc19f64f3f493e4f5

SHA512
15330fb938b0265ea505ae324379559bd64098606260bbdaf7e5fd55bd772e37d25b18d2f096da077c5e92aef44e141d12c571f8061ad5e506516a935c4f68b6

Download Submit
C:\Windows\system\KdonYIn.exe

Filesize
975KB

MD5
e1b2e3185ec81540cfa82c9edd3cefc3

SHA1
cb30910f92da7082053ba402591bdca8d8757b2c

SHA256
a2a4da5944a89566bf183bb0ab9316a36bfe2e1b6514ad58e75cfe422698841b

SHA512
37f412f44ddc10f30f88c3d421c28163a3e6cfdfcfdcb9159f3c2117d66ae899477ea9cf7c2be543f06228592826843f4ad33562360320af5b65c60864f9bf88

Download Submit
C:\Windows\system\LZUrJqQ.exe

Filesize
976KB

MD5
8f2e755b92ee8e3696eeb558ab39c9ba

SHA1
30e5f2ea399a0abc492f03cf3618590982228f50

SHA256
58298db9bc4eb5cc715e17c257679a1e97a7a7f857e101770c8578aded163663

SHA512
72d8b07bb7093b74e0bb709c6c72f76ebc6a1d3822117d7e20f91d874682ff3d92c1fd212090649a8fe6369952858a643cd940f8e83bc8ca364ec43d82943ebb

Download Submit
C:\Windows\system\QPCkESc.exe

Filesize
978KB

MD5
5636ee482d27983d810af2b3ab8f71c0

SHA1
4eb1b33caa8595b1515a16707b18e5e8622f43b9

SHA256
79c847ceb4d65b32a6333aff32a5c458a8401406d0686c2f1ed6dd03af5f5da5

SHA512
1b98b00869b5a461c4c84b8169365349eafd8cfd60c2aab667d35a43f8b383e2f7e57b6f159e1ecb451eb6054b5e5aef54e945898cc3a85a3440a258b946a60d

Download Submit
C:\Windows\system\SwEtuak.exe

Filesize
978KB

MD5
878ddf118d2abec616f368f2a413f10c

SHA1
7efa442768e2b62843be6898d88d8597040eebdc

SHA256
efce762a0fd375b0e33f7c779a4d3e9ff5710539b748fefb9feb383062312be0

SHA512
b78ff87575a85421589411b38015c185999f611e81b359e5f2d0a9a8b5345f0ce985ad1b3884ea401cc2b352719d4aa804cdbc697d82b8e9440f7be8ed79504e

Download Submit
C:\Windows\system\UXpJWZD.exe

Filesize
982KB

MD5
dd320b2f3475d9f6bb69822ecb980fc3

SHA1
0945a1d5572ea6ecef602216597688626db8ca64

SHA256
65d54e15b6b7e6b44e3bb80071edd9a55176a4380a3156549aae0c61e5bb408b

SHA512
b6d32f68d5834af4b2fb3bf2f85c77f76d70b6d6d4ea4edf6b4b4b8fe4cd9a08d8e5bdbc05bd2d3f69d817af459ccdd26049419d8b310525b9ff36fb0affa4ec

Download Submit
C:\Windows\system\VQidJeu.exe

Filesize
974KB

MD5
f08aa5de70fa4de5f963cdd91a1c6b23

SHA1
b312c6800a7e05462604bb8fe0c5d2d2985d3fb5

SHA256
0cafe27a3931e5ac8fac49853ac9e4ab4f9f1d4187a27cfaaa6c955e070ebf55

SHA512
356713036474acea49064f78827f8e77140ddb895d06fa0113d360ee7aa9cc8bd269c9b8e5047a44441413eda0653d894582abc69bbcadd836b2ecf429731c3c

Download Submit
C:\Windows\system\YUblngO.exe

Filesize
975KB

MD5
ccf2f5f3496c99376267f745d8f5a660

SHA1
a022134afd942890e72b247817f1b792548140e7

SHA256
38f924660d4f0940c18ea068c3c189e2ed8bc070057357da8cd9ff3cf8bb81fb

SHA512
1f8bcf9e35ba8024165b3b85ef2cf8683ab4b46fc1b42fc028c282bd7328adbdc1388a5a9c7288a124242ef3a9dcfb0b0493314abc2f4ee5b9afbaf6a0efb6f1

Download Submit
C:\Windows\system\ehwJbCi.exe

Filesize
976KB

MD5
e195b4017b55046a7ee44a48b7d287d0

SHA1
88b4dd770a72c010c4d6c1a58dd8c7a8706f4ebc

SHA256
323a3c8fd222dcb86ecf56d9eff675ee7e5b0826e19a39ef0a76d11d56586899

SHA512
cae900cb89d3a861cfa60a1a0db0d7f7a84b7fd046370f8e1c20ea8bfedc9596e729a2a19c72cbea1889f2bcfca667e56d9c1fa16e35c7eb9ce744ce89f10099

Download Submit
C:\Windows\system\epfTuJl.exe

Filesize
975KB

MD5
23a482577ff113bacd006c17b449e8db

SHA1
49acf57ca011be5492a55c313ab20abf511ffcde

SHA256
fc63d05ac58268a67a59cbd5777d1a29ec6643f43193b05569c84486a382ad5e

SHA512
886ecc2506aed74d50ba7ebe571012bf6e7f6e71d56b7640cdf977115822b9a0b78cf3bc782f778835aa4ea12b9e4fa4e4e08c661f45e8b52752fb29d92145fd

Download Submit
C:\Windows\system\gfikBNN.exe

Filesize
982KB

MD5
8952858b409e904eab013692ee3ae222

SHA1
e6c7e2bee528cf3ca94bb0458e102fa1e8c1ee99

SHA256
11d0339a1979860858dd2c56d93c124a86ccb9aff57ee9f64b004745eef601a1

SHA512
3d416dcb73a7c9ca88f3429fc6eb4f216ca3141fa112316eba86d685c8674c3d743308e72b1a2eee1dfaaf6a40a5b95b9975ba3da0f05e791fec76c98ecb98fa

Download Submit
C:\Windows\system\ihIcpMa.exe

Filesize
980KB

MD5
5df8a5ab32270e495f672b0e3db1230f

SHA1
44226994b43dcfce80b0c130f036f2ea7e19285a

SHA256
52cd119457e2edfa447030564eecb54aeedf82e9659c9ce2f8f0cd0f920ebd29

SHA512
33ffc2cccda824db1a842701caa149500a042838b8b22a24f4102d1cfcfe79064e4e2854051fdec6f5081642b5d9c63786812bbd6a3e8862af7500c57930f5b1

Download Submit
C:\Windows\system\jnrJDYY.exe

Filesize
977KB

MD5
5f1f895d2aff6eb4bbe87ddd7c4189c3

SHA1
8c4746bce5797cd864f65433831f7a4916a0fc7f

SHA256
8210a86e3fdbe76e6265339e05340a1ea8af8ef60e259c6a738a417b68b25597

SHA512
44ad67345c524a831b7e0213e7a28bfdc41edbcfdf1c03975ec1ee41ac6c6ee1490fbf429fd0ee9675a54dd7484c8c915d9f1dd92867407e01c1d19214f002ff

Download Submit
C:\Windows\system\kCjMeLM.exe

Filesize
981KB

MD5
cb2de0111e32b87cb6c26a846b963cf4

SHA1
577f592197ee25dee9dd80ebb64634ac13e22358

SHA256
b7b2e5b3ed148dc715fa52ab3122e0f3c7cd22070722aef4bee6efdd64b6eabf

SHA512
d673e8519fcf1baa45e4a606b418bf923b13b41eeab2f3c2455798b0eeab2a1f67028cf9319e8fd45e7011d31135f0628784b88591240daeb06ff9aa7ac83fda

Download Submit
C:\Windows\system\lelJbwd.exe

Filesize
973KB

MD5
7b5400333439112a212cfc6fb5c46ab7

SHA1
86050ee72c1df232e2da2fffeb20ecb1489f79cb

SHA256
d44506125cd2a50a1c029720f293646f3c501a4a798029f3ed06ab45b2d871dc

SHA512
a5105ae96558656134502980597de81732b9707ce849bdd1064a9846122c5f2d6873d95c70a0bf6c7d84ae664eadff45d69a7a1ab24f6c054c62177d38f53170

Download Submit
C:\Windows\system\mKTYbcg.exe

Filesize
979KB

MD5
5ecd4635fb333ffd25ef4b680baaa6c6

SHA1
d0c398abad224e4a69b0a83cb5aa95c830ca201b

SHA256
f39b60a52270039bbaf7e903b6dbadb5f49a985709570e31d645e047cc56d087

SHA512
c24da93c7371214f8df340a0bfc4e3801f99b9d78e2aa1b139f05caf7f0621a56c5f6a0390cedb8c97bfe2b2069f8a7dcd6844b6ce0152f5d62f84b6b9aee710

Download Submit
C:\Windows\system\moKDlXH.exe

Filesize
977KB

MD5
827b0bb0baae313d4df6e5e3691e4679

SHA1
7cfe4c22fe9e52703ab2590e007c01840ceffac4

SHA256
46fb20a75cf1c6cff9a31fd9d0e4182c0c50baf76bc86b7ec36ba219651e672f

SHA512
594c1501861274ca452e0e4679bd8f6372846cae4cc60c5786b1d11e4abc675610cc471d6eb253b28e16578178afba5e588b008e2b0cc6ed39c2c2fac11195a7

Download Submit
C:\Windows\system\oGstarh.exe

Filesize
977KB

MD5
58b9cb1fe879649964a9f0875ca8df85

SHA1
55bc1e50033b95e7c17b0778b44be8be15aca801

SHA256
89d9eb426564f376d3735f3c954d881b3a58d88bf2b1f096a768e83d833904a7

SHA512
daebdce8e898611491f588b20125566c120932510988e9a5444431d319d0adbc9f05da1648d3aa1c70bf169ed9ee1240ffa5cb762081265c27830e047525cb17

Download Submit
C:\Windows\system\szaKAYN.exe

Filesize
975KB

MD5
8eba614b19779a95a2af0bc662ad8c00

SHA1
b0ebc3afd483eb4a95fa7d3fd66c80afb51e60e5

SHA256
a41341a8642889bce643ec9eb03c0f7214ac58199e9e0a059b1454b06db0f505

SHA512
c182655555d023515b9b34fd38fae0d1abc0a50d2d5865789a9b8ff07f4bae09913f0324d5eed43ff8eb9e736eb5291c4503e5435cb067d029306606ea5e717d

Download Submit
\Windows\system\BSZJGHB.exe

Filesize
977KB

MD5
8babc3151c704898e1214c32d13ab7f1

SHA1
c299192db37ae1ccd4a34da0c369f2f38ac010db

SHA256
012c9db834b9d28bd03c7deb5d717669fba02dcb86e393663ed022d1c2ddb4d1

SHA512
237089f78ad309517cb1321d83393b307bf215738b812b2a5507526dcffee95a5a7e74635d00f0fbeca3a789e2702964b4bee7b6bb035468c196b7296c6065af

Download Submit
\Windows\system\CPlzxhd.exe

Filesize
981KB

MD5
857f0915a9ed6930fb0c8d2f25de35c6

SHA1
a9e01a703ab875232c5032358e14b40294503742

SHA256
986cfcd528e9eb12e58966c9bcc3c85492e7cf93eedfd41bd8bcac31bbe0af75

SHA512
4ad283f886671de3a956b974fcad22c124d8c3258377653fc31cf492a3871cfb6cac31e40ab35579b452f69faf7fb3e3ac47dcd4a920c6846938c895b848a5e1

Download Submit
\Windows\system\EzlLGky.exe

Filesize
980KB

MD5
48f6d7d56b7967b95af3f3480e1528ff

SHA1
a9c79d1d7ce162c0935bdaa99426043949cf5bcb

SHA256
f030739ecf687c79ccd0aa1fc2c4db2644e1742d7902d5604f8e912372537264

SHA512
ec59fb76961004b8960936c0c34a7f06d43af5e6a526a8ffecbff284c4285624dbfbb08d9b63dc3f08a6cf4b1762f91b641573a06ddf3b24ed846ce7ea4e1041

Download Submit
\Windows\system\KXqZFpB.exe

Filesize
979KB

MD5
2ff596ebd5802afe7aec20f45167666e

SHA1
cdc4d4a77cda460117a16e90b28d9af389e5b227

SHA256
83043424f2911a9a13c60952529bff157604faa0cf5a3d076cc2fcbfc946c72d

SHA512
61ab29a85f83c885c933b7d026474686ea0b8e8cbe79c080b44a0cb1703023ce5702482286e84ea6b4e8f647d099d9691c8773312fce95fc58a827d87b318154

Download Submit
\Windows\system\QEAYkRs.exe

Filesize
979KB

MD5
720701e78fdb821ed25437f433b201f0

SHA1
4595ee60ebf0a5a6efc54f266dc1addb16481adf

SHA256
f6ccf66001b87996dd0c6d9c86281b547a5619588959ea6ead4385ebf5558e66

SHA512
9dacb6d1230b0ef6792f4f4d878a0f96d832fca7cd5ba6b068766e15be00ccdf5b767845023accc6ada10ee970fbaf8cffba035d98190999d8137e1b393faa9d

Download Submit
\Windows\system\RIeMsJX.exe

Filesize
981KB

MD5
1eceed77e6398ddf03a73bc5922dd943

SHA1
e0bd10f1ed32126ffeaebf36f7bef7c8a3960cb4

SHA256
252d722d3d70d0e5ba19589745f478ded1dbe01c03f6283de32e05fa464b3f2a

SHA512
91e4dda6c0cb358479edc31fdeffacd0bef76aa75553da1ae567d11d3be55843b51e72939bd5e7570ada019a21258374cf7bbe6efc2ea18d9e2665db0c3b5864

Download Submit
\Windows\system\SDHvoYl.exe

Filesize
978KB

MD5
dc8cfcc52d23eb97d055814be426784b

SHA1
092073e917628afe37f7a3f36a0b070a97f23532

SHA256
7e9f8fbfd0dc6ce60f59f838ccef0ca8e3172f8d0d59cab9b68e6677559240e7

SHA512
a357d9da2d16224b644a18d5a57e0adbdf1b9e204803df75a9b8bb2b5a606ae7a98e713fb88cf31ac017e58db8328c701776e9c11d1b3c2c7701fdd640edcf50

Download Submit
\Windows\system\eTwEKDV.exe

Filesize
981KB

MD5
5f8d8e978a149244ea5627006428a3e9

SHA1
ee635ec51a3dceb4be2e366bcb57e8243859dc68

SHA256
85feeea3df30a54cd7a8d0b0743b8e7f7bae3f36f7add61a411bf3cff69a130e

SHA512
3e515497febb021f6f674dd2e4afa7cba1bb22c5d598c36feece13c69d1992f94eb1292059018875a4fa4b6bb15fd77e9735e8b2697868e40824eda4a2062c0e

Download Submit
\Windows\system\fYNBZEu.exe

Filesize
979KB

MD5
c88d614c41d0197274e3278e87a677f9

SHA1
53727a9d8e2f2a3913ae0be64678179bd82f7211

SHA256
474a788ffeb56398d6b8a6d8b84d4b2948109fbe666b40fea0332096d541154f

SHA512
66c8830717461a0f690c19794802712da7668e97b729b2a4386d2b65e4475615ae4fc72bba2510a16de656e37db84fc63c50b76303e14612a58609dfe7aa3133

Download Submit
\Windows\system\hJSECNI.exe

Filesize
982KB

MD5
d915ef5d3892b2eff489cf00c446fb08

SHA1
3ffe73e37d6ada2944de8aa02886e75a8d3a2b0d

SHA256
fec164719edfeff21de97d0bd633882e72512120ea111574e3b3cd9741398edd

SHA512
424df287450d176e8ace0016c5befdb71d4d30147cdbdaed09b19cc22d743fa86b24d1ced0e61f570f0667a06dba179367c80b602c697655e47a5a6a314a7ef2

Download Submit
\Windows\system\kCLsiUd.exe

Filesize
974KB

MD5
4b12198470177d7dcfb205d6f4fb0614

SHA1
ca852c32ba233e6c18181ba5a6a4302ab30d59f7

SHA256
53893631b5aaf55865912122a00659e9269b303807d3df74f45888b1d290c2e6

SHA512
b70f35ae30adb53a9ff87a977003add91d49ddf843154a5329f000fa1568736984ed978fd055f3beea47739cd6608135c0bdd48b637d470816303ab17f6c63b6

Download Submit
\Windows\system\lldEBto.exe

Filesize
978KB

MD5
c8703ec9aa5882aea65c7acad96d6ae6

SHA1
cd9fbff86e0aa8ae1305042c33265a453c71303b

SHA256
86ba476c4d78d73e5e137f20d48cdd02d8a7f60485299f432d3cbdd5ba23a101

SHA512
fa44b3a072ebb772827b8baf06861ca5e8f528c173230950364ff0bc21cc313ef1ca061f5e7272c2a1d2338976aa6963c9be9b10e78d5bbed5630a1313912a34

Download Submit
\Windows\system\pumzoac.exe

Filesize
980KB

MD5
b9c57141fa011b0ee678c6b0dd33455e

SHA1
0894c7a887929e7132ae30fd022f8ea208fb45f5

SHA256
e5a4e9cd0586926d2ff0c5069836ab38d454d4b87f2523069a92761cfbbd4320

SHA512
d0e8f6cfac4750856f3354dc88d95d2269305c879fdfb203ff7eb51ca326d61c7241f7f6348cb1715b379b81a58624327e772b34d5c43c281e16f32cb317ac17

Download Submit
\Windows\system\qnqNWdx.exe

Filesize
976KB

MD5
c05b46f9a25a711038cadb0381ba3b78

SHA1
041dbbfb40860ebc0722919bf49ba26b0e7ad45e

SHA256
55b7baa7b8df73e7fc48b60b2afd9a3290450575c14ba94edf0726a8994f981d

SHA512
3fbfa4a019e9cd098e5de370789605ac3b5258f340c330ce5823b7e1882be641b24f92343376adf7e5035fd87490028fcf390365f5676b811c91670bb5631e40

Download Submit
memory/1344-4648-0x000000013F290000-0x000000013F682000-memory.dmp

Filesize
3.9MB

Download
memory/1344-130-0x000000013F290000-0x000000013F682000-memory.dmp

Filesize
3.9MB

Download
memory/1920-128-0x000000013FA30000-0x000000013FE22000-memory.dmp

Filesize
3.9MB

Download
memory/1920-4652-0x000000013FA30000-0x000000013FE22000-memory.dmp

Filesize
3.9MB

Download
memory/2132-4672-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/2132-114-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/2204-4666-0x000000013FC50000-0x0000000140042000-memory.dmp

Filesize
3.9MB

Download
memory/2204-13-0x000000013FC50000-0x0000000140042000-memory.dmp

Filesize
3.9MB

Download
memory/2412-135-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/2412-4681-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/2432-105-0x000000013FE10000-0x0000000140202000-memory.dmp

Filesize
3.9MB

Download
memory/2432-4736-0x000000013FE10000-0x0000000140202000-memory.dmp

Filesize
3.9MB

Download
memory/2496-121-0x000000013F760000-0x000000013FB52000-memory.dmp

Filesize
3.9MB

Download
memory/2496-4671-0x000000013F760000-0x000000013FB52000-memory.dmp

Filesize
3.9MB

Download
memory/2584-4658-0x000000013F400000-0x000000013F7F2000-memory.dmp

Filesize
3.9MB

Download
memory/2584-107-0x000000013F400000-0x000000013F7F2000-memory.dmp

Filesize
3.9MB

Download
memory/2596-126-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2596-4642-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2708-4717-0x000000013F6F0000-0x000000013FAE2000-memory.dmp

Filesize
3.9MB

Download
memory/2708-116-0x000000013F6F0000-0x000000013FAE2000-memory.dmp

Filesize
3.9MB

Download
memory/2720-112-0x000000013F310000-0x000000013F702000-memory.dmp

Filesize
3.9MB

Download
memory/2720-4727-0x000000013F310000-0x000000013F702000-memory.dmp

Filesize
3.9MB

Download
memory/2744-486-0x000007FEF5F20000-0x000007FEF68BD000-memory.dmp

Filesize
9.6MB

Download
memory/2744-104-0x000007FEF5F20000-0x000007FEF68BD000-memory.dmp

Filesize
9.6MB

Download
memory/2744-90-0x00000000023A0000-0x00000000023A8000-memory.dmp

Filesize
32KB

Download
memory/2744-85-0x000000001B660000-0x000000001B942000-memory.dmp

Filesize
2.9MB

Download
memory/2744-15-0x000007FEF61DE000-0x000007FEF61DF000-memory.dmp

Filesize
4KB

Download
memory/2744-136-0x000007FEF5F20000-0x000007FEF68BD000-memory.dmp

Filesize
9.6MB

Download
memory/2744-14-0x0000000002A40000-0x0000000002AC0000-memory.dmp

Filesize
512KB

Download
memory/2852-124-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/2852-4721-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/3064-115-0x0000000003000000-0x00000000033F2000-memory.dmp

Filesize
3.9MB

Download
memory/3064-12-0x000000013FC50000-0x0000000140042000-memory.dmp

Filesize
3.9MB

Download
memory/3064-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/3064-117-0x00000000034A0000-0x0000000003892000-memory.dmp

Filesize
3.9MB

Download
memory/3064-106-0x0000000003000000-0x00000000033F2000-memory.dmp

Filesize
3.9MB

Download
memory/3064-127-0x000000013FA30000-0x000000013FE22000-memory.dmp

Filesize
3.9MB

Download
memory/3064-113-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/3064-131-0x00000000034A0000-0x0000000003892000-memory.dmp

Filesize
3.9MB

Download
memory/3064-129-0x00000000034A0000-0x0000000003892000-memory.dmp

Filesize
3.9MB

Download
memory/3064-2-0x000000013F4F0000-0x000000013F8E2000-memory.dmp

Filesize
3.9MB

Download
memory/3064-137-0x000000013FE10000-0x0000000140202000-memory.dmp

Filesize
3.9MB

Download
memory/3064-125-0x00000000034A0000-0x0000000003892000-memory.dmp

Filesize
3.9MB

Download
memory/3064-122-0x00000000034A0000-0x0000000003892000-memory.dmp

Filesize
3.9MB

Download
memory/3064-111-0x0000000003000000-0x00000000033F2000-memory.dmp

Filesize
3.9MB

Download