xmrig | c48f62a70c13de6cfa7cfc1c5e8f1f8fa4dd89168d1c8cc4c836c411538adf0f

Analysis

max time kernel
149s
max time network
146s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
07/07/2024, 03:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c4862b2316fa6ee8a635e0102c82440N.exe
Size

3.1MB
MD5

3c4862b2316fa6ee8a635e0102c82440
SHA1

9749ed67fdccd480318d541a206cbafbba101021
SHA256

c48f62a70c13de6cfa7cfc1c5e8f1f8fa4dd89168d1c8cc4c836c411538adf0f
SHA512

ea4a8592ddcf8b3baed793cadec0fd37b81897ba6f38b6593696a63c00cd94131983e6a345538eba5d5fd198bcc3de3e6c165dd2b8a7842f59a9318af89ccc7e
SSDEEP

98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWm:7bBeSFka

Score

10^/10

xmrig execution miner persistence privilege_escalation upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 55 IoCs

miner

resource	yara_rule
behavioral1/memory/2104-1-0x000000013F710000-0x000000013FB06000-memory.dmp	xmrig
behavioral1/files/0x0009000000012116-6.dat	xmrig
behavioral1/files/0x000b000000018671-7.dat	xmrig
behavioral1/memory/2344-17-0x000000013F8C0000-0x000000013FCB6000-memory.dmp	xmrig
behavioral1/files/0x000700000001867d-22.dat	xmrig
behavioral1/files/0x0007000000004e74-25.dat	xmrig
behavioral1/files/0x00070000000186e9-29.dat	xmrig
behavioral1/files/0x0005000000019449-62.dat	xmrig
behavioral1/files/0x00050000000194a1-69.dat	xmrig
behavioral1/memory/2672-127-0x000000013F7B0000-0x000000013FBA6000-memory.dmp	xmrig
behavioral1/files/0x000500000001961a-134.dat	xmrig
behavioral1/files/0x000500000001961d-148.dat	xmrig
behavioral1/files/0x0005000000019621-157.dat	xmrig
behavioral1/files/0x00050000000194b1-172.dat	xmrig
behavioral1/memory/2108-161-0x000000013FD90000-0x0000000140186000-memory.dmp	xmrig
behavioral1/files/0x0005000000019623-160.dat	xmrig
behavioral1/files/0x000500000001961f-152.dat	xmrig
behavioral1/memory/2876-141-0x000000013F9A0000-0x000000013FD96000-memory.dmp	xmrig
behavioral1/files/0x000500000001961b-137.dat	xmrig
behavioral1/files/0x0005000000019617-130.dat	xmrig
behavioral1/files/0x0005000000019619-128.dat	xmrig
behavioral1/files/0x00050000000195a1-122.dat	xmrig
behavioral1/files/0x00050000000195e6-118.dat	xmrig
behavioral1/files/0x0005000000019571-111.dat	xmrig
behavioral1/files/0x000500000001957d-109.dat	xmrig
behavioral1/files/0x0005000000019504-102.dat	xmrig
behavioral1/memory/2676-100-0x000000013FB30000-0x000000013FF26000-memory.dmp	xmrig
behavioral1/files/0x0005000000019506-99.dat	xmrig
behavioral1/files/0x00050000000194f0-92.dat	xmrig
behavioral1/files/0x00050000000194fa-91.dat	xmrig
behavioral1/files/0x00050000000194e5-83.dat	xmrig
behavioral1/memory/380-78-0x000000013F930000-0x000000013FD26000-memory.dmp	xmrig
behavioral1/files/0x0005000000019625-175.dat	xmrig
behavioral1/files/0x000500000001948a-65.dat	xmrig
behavioral1/memory/3052-150-0x000000013FDF0000-0x00000001401E6000-memory.dmp	xmrig
behavioral1/memory/2600-144-0x000000013F220000-0x000000013F616000-memory.dmp	xmrig
behavioral1/memory/2956-117-0x000000013F750000-0x000000013FB46000-memory.dmp	xmrig
behavioral1/memory/2768-107-0x000000013FD40000-0x0000000140136000-memory.dmp	xmrig
behavioral1/memory/2660-90-0x000000013F3F0000-0x000000013F7E6000-memory.dmp	xmrig
behavioral1/files/0x00050000000194c1-82.dat	xmrig
behavioral1/files/0x000500000001943b-57.dat	xmrig
behavioral1/files/0x000700000001877f-52.dat	xmrig
behavioral1/files/0x0008000000018736-48.dat	xmrig
behavioral1/files/0x0006000000018722-43.dat	xmrig
behavioral1/files/0x00060000000186f7-37.dat	xmrig
behavioral1/memory/2660-6275-0x000000013F3F0000-0x000000013F7E6000-memory.dmp	xmrig
behavioral1/memory/380-6273-0x000000013F930000-0x000000013FD26000-memory.dmp	xmrig
behavioral1/memory/2672-6282-0x000000013F7B0000-0x000000013FBA6000-memory.dmp	xmrig
behavioral1/memory/2768-6281-0x000000013FD40000-0x0000000140136000-memory.dmp	xmrig
behavioral1/memory/2956-6285-0x000000013F750000-0x000000013FB46000-memory.dmp	xmrig
behavioral1/memory/2600-6297-0x000000013F220000-0x000000013F616000-memory.dmp	xmrig
behavioral1/memory/2676-6293-0x000000013FB30000-0x000000013FF26000-memory.dmp	xmrig
behavioral1/memory/2876-6292-0x000000013F9A0000-0x000000013FD96000-memory.dmp	xmrig
behavioral1/memory/3052-6349-0x000000013FDF0000-0x00000001401E6000-memory.dmp	xmrig
behavioral1/memory/2104-6352-0x000000013F710000-0x000000013FB06000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3060	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2344	pVhrZdS.exe
2108	qdfjrqO.exe
380	MLUiant.exe
2660	FYHdlCG.exe
2676	BnaKgro.exe
2768	ucHhhSg.exe
2956	ctkdVLR.exe
2672	BfJIStL.exe
2876	VJnhpas.exe
2600	EXBaOJX.exe
3052	adIiDNy.exe
2564	GpWfoNb.exe
2736	QCevkSW.exe
1664	wdJEcpD.exe
664	lgvgitT.exe
2636	zhaSLpd.exe
2036	cVRpiJC.exe
984	IeZUZsD.exe
1780	YHzMapK.exe
2844	IzQsmzG.exe
2668	FOjmilQ.exe
2008	PeXUniM.exe
2608	GFKRaGk.exe
1376	EsDqNVO.exe
876	AvjDwFo.exe
2000	LwMGVvB.exe
1708	QslTrYE.exe
2464	rgfYWxe.exe
1184	eHWQMnS.exe
1324	QVKggGy.exe
2848	wYevmBe.exe
2916	ovXsnwG.exe
3004	crOVQcG.exe
2280	JAxewQO.exe
1132	WlRewnW.exe
1692	lvRZGsG.exe
2248	ykYgjmE.exe
1924	DtUaffk.exe
2988	PRualFT.exe
1908	SeXnTBq.exe
2112	lpKJglI.exe
1552	YtdzPOf.exe
896	WdFCbCe.exe
1076	kdQDpUm.exe
1704	ScGsBNv.exe
2936	PoTzpAx.exe
2696	SyXWbEa.exe
2796	TnZmGTd.exe
2216	IKijSei.exe
2704	lNopJNd.exe
308	kHKYslD.exe
108	MZVVLUh.exe
2664	FKJOEHO.exe
2644	SSfReUF.exe
1688	NeFbfaL.exe
2416	bOXJGCf.exe
2284	GabktSz.exe
1804	QhSJAVh.exe
1448	PVdvMew.exe
2228	fTHvZKV.exe
2384	ndzHtLF.exe
1104	micyyoq.exe
2164	iTiqxXx.exe
1972	uaXqdfC.exe

Loads dropped DLL 64 IoCs

pid	Process
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe
2104	3c4862b2316fa6ee8a635e0102c82440N.exe

UPX packed file 55 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2104-1-0x000000013F710000-0x000000013FB06000-memory.dmp	upx
behavioral1/files/0x0009000000012116-6.dat	upx
behavioral1/files/0x000b000000018671-7.dat	upx
behavioral1/memory/2344-17-0x000000013F8C0000-0x000000013FCB6000-memory.dmp	upx
behavioral1/files/0x000700000001867d-22.dat	upx
behavioral1/files/0x0007000000004e74-25.dat	upx
behavioral1/files/0x00070000000186e9-29.dat	upx
behavioral1/files/0x0005000000019449-62.dat	upx
behavioral1/files/0x00050000000194a1-69.dat	upx
behavioral1/memory/2672-127-0x000000013F7B0000-0x000000013FBA6000-memory.dmp	upx
behavioral1/files/0x000500000001961a-134.dat	upx
behavioral1/files/0x000500000001961d-148.dat	upx
behavioral1/files/0x0005000000019621-157.dat	upx
behavioral1/files/0x00050000000194b1-172.dat	upx
behavioral1/memory/2108-161-0x000000013FD90000-0x0000000140186000-memory.dmp	upx
behavioral1/files/0x0005000000019623-160.dat	upx
behavioral1/files/0x000500000001961f-152.dat	upx
behavioral1/memory/2876-141-0x000000013F9A0000-0x000000013FD96000-memory.dmp	upx
behavioral1/files/0x000500000001961b-137.dat	upx
behavioral1/files/0x0005000000019617-130.dat	upx
behavioral1/files/0x0005000000019619-128.dat	upx
behavioral1/files/0x00050000000195a1-122.dat	upx
behavioral1/files/0x00050000000195e6-118.dat	upx
behavioral1/files/0x0005000000019571-111.dat	upx
behavioral1/files/0x000500000001957d-109.dat	upx
behavioral1/files/0x0005000000019504-102.dat	upx
behavioral1/memory/2676-100-0x000000013FB30000-0x000000013FF26000-memory.dmp	upx
behavioral1/files/0x0005000000019506-99.dat	upx
behavioral1/files/0x00050000000194f0-92.dat	upx
behavioral1/files/0x00050000000194fa-91.dat	upx
behavioral1/files/0x00050000000194e5-83.dat	upx
behavioral1/memory/380-78-0x000000013F930000-0x000000013FD26000-memory.dmp	upx
behavioral1/files/0x0005000000019625-175.dat	upx
behavioral1/files/0x000500000001948a-65.dat	upx
behavioral1/memory/3052-150-0x000000013FDF0000-0x00000001401E6000-memory.dmp	upx
behavioral1/memory/2600-144-0x000000013F220000-0x000000013F616000-memory.dmp	upx
behavioral1/memory/2956-117-0x000000013F750000-0x000000013FB46000-memory.dmp	upx
behavioral1/memory/2768-107-0x000000013FD40000-0x0000000140136000-memory.dmp	upx
behavioral1/memory/2660-90-0x000000013F3F0000-0x000000013F7E6000-memory.dmp	upx
behavioral1/files/0x00050000000194c1-82.dat	upx
behavioral1/files/0x000500000001943b-57.dat	upx
behavioral1/files/0x000700000001877f-52.dat	upx
behavioral1/files/0x0008000000018736-48.dat	upx
behavioral1/files/0x0006000000018722-43.dat	upx
behavioral1/files/0x00060000000186f7-37.dat	upx
behavioral1/memory/2660-6275-0x000000013F3F0000-0x000000013F7E6000-memory.dmp	upx
behavioral1/memory/380-6273-0x000000013F930000-0x000000013FD26000-memory.dmp	upx
behavioral1/memory/2672-6282-0x000000013F7B0000-0x000000013FBA6000-memory.dmp	upx
behavioral1/memory/2768-6281-0x000000013FD40000-0x0000000140136000-memory.dmp	upx
behavioral1/memory/2956-6285-0x000000013F750000-0x000000013FB46000-memory.dmp	upx
behavioral1/memory/2600-6297-0x000000013F220000-0x000000013F616000-memory.dmp	upx
behavioral1/memory/2676-6293-0x000000013FB30000-0x000000013FF26000-memory.dmp	upx
behavioral1/memory/2876-6292-0x000000013F9A0000-0x000000013FD96000-memory.dmp	upx
behavioral1/memory/3052-6349-0x000000013FDF0000-0x00000001401E6000-memory.dmp	upx
behavioral1/memory/2104-6352-0x000000013F710000-0x000000013FB06000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\cyXKLio.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\FTgSkCM.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\ddWPDXq.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\dwRUypF.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\MGAammi.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\uImrFoQ.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\bVowcNB.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\fJhrCHV.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\AQyPEoY.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\wOfHpkW.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\BEuMdNp.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\NHTHLhX.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\WXbiLgV.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\ZRnAwtF.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\uluMuZV.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\RoQokMF.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\dpniwJq.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\hCUbxly.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\njIQYdi.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\PWYjGmc.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\GZSFMuq.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\bbeLAin.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\bNYXDIL.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\MFzrDmv.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\FysuhPb.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\fVEFOOG.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\MeuDphs.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\ZknHZny.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\QkKcZZW.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\skacnQN.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\zLnNpVb.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\TJHSEly.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\TLmEjOG.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\cdALbWa.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\NvwIYKK.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\qcXCjFB.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\wYIolXt.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\AMWLPWe.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\DUaiWSq.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\cnsXxyI.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\fIFemeg.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\tePQIWe.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\qVDjQKw.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\agsptjT.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\ozTKzkX.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\QthFfJM.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\ciAfGYA.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\jqjbHVo.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\PnaCqLl.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\yDcYoMD.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\RsPIUEf.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\AzPlpFL.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\dgnOIic.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\XYtLcgD.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\PQgSafa.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\puGAsmZ.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\WyQmpoL.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\xUmooSK.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\paISMKO.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\tnUtUaL.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\GvNvsxp.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\UQxbZNZ.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\BywAJAR.exe	3c4862b2316fa6ee8a635e0102c82440N.exe
File created	C:\Windows\System\OpNIawy.exe	3c4862b2316fa6ee8a635e0102c82440N.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3060	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2104	3c4862b2316fa6ee8a635e0102c82440N.exe
Token: SeLockMemoryPrivilege	2104	3c4862b2316fa6ee8a635e0102c82440N.exe
Token: SeDebugPrivilege	3060	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 3060	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	31
PID 2104 wrote to memory of 3060	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	31
PID 2104 wrote to memory of 3060	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	31
PID 2104 wrote to memory of 2344	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	32
PID 2104 wrote to memory of 2344	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	32
PID 2104 wrote to memory of 2344	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	32
PID 2104 wrote to memory of 2108	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	33
PID 2104 wrote to memory of 2108	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	33
PID 2104 wrote to memory of 2108	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	33
PID 2104 wrote to memory of 380	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	34
PID 2104 wrote to memory of 380	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	34
PID 2104 wrote to memory of 380	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	34
PID 2104 wrote to memory of 2660	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	35
PID 2104 wrote to memory of 2660	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	35
PID 2104 wrote to memory of 2660	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	35
PID 2104 wrote to memory of 2676	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	36
PID 2104 wrote to memory of 2676	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	36
PID 2104 wrote to memory of 2676	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	36
PID 2104 wrote to memory of 2768	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	37
PID 2104 wrote to memory of 2768	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	37
PID 2104 wrote to memory of 2768	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	37
PID 2104 wrote to memory of 2956	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	38
PID 2104 wrote to memory of 2956	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	38
PID 2104 wrote to memory of 2956	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	38
PID 2104 wrote to memory of 2672	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	39
PID 2104 wrote to memory of 2672	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	39
PID 2104 wrote to memory of 2672	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	39
PID 2104 wrote to memory of 2876	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	40
PID 2104 wrote to memory of 2876	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	40
PID 2104 wrote to memory of 2876	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	40
PID 2104 wrote to memory of 2600	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	41
PID 2104 wrote to memory of 2600	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	41
PID 2104 wrote to memory of 2600	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	41
PID 2104 wrote to memory of 3052	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	42
PID 2104 wrote to memory of 3052	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	42
PID 2104 wrote to memory of 3052	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	42
PID 2104 wrote to memory of 2736	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	43
PID 2104 wrote to memory of 2736	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	43
PID 2104 wrote to memory of 2736	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	43
PID 2104 wrote to memory of 2564	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	44
PID 2104 wrote to memory of 2564	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	44
PID 2104 wrote to memory of 2564	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	44
PID 2104 wrote to memory of 2608	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	45
PID 2104 wrote to memory of 2608	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	45
PID 2104 wrote to memory of 2608	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	45
PID 2104 wrote to memory of 1664	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	46
PID 2104 wrote to memory of 1664	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	46
PID 2104 wrote to memory of 1664	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	46
PID 2104 wrote to memory of 876	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	47
PID 2104 wrote to memory of 876	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	47
PID 2104 wrote to memory of 876	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	47
PID 2104 wrote to memory of 664	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	48
PID 2104 wrote to memory of 664	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	48
PID 2104 wrote to memory of 664	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	48
PID 2104 wrote to memory of 2000	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	49
PID 2104 wrote to memory of 2000	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	49
PID 2104 wrote to memory of 2000	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	49
PID 2104 wrote to memory of 2636	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	50
PID 2104 wrote to memory of 2636	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	50
PID 2104 wrote to memory of 2636	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	50
PID 2104 wrote to memory of 1708	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	51
PID 2104 wrote to memory of 1708	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	51
PID 2104 wrote to memory of 1708	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	51
PID 2104 wrote to memory of 2036	2104	3c4862b2316fa6ee8a635e0102c82440N.exe	52

C:\Users\Admin\AppData\Local\Temp\3c4862b2316fa6ee8a635e0102c82440N.exe
"C:\Users\Admin\AppData\Local\Temp\3c4862b2316fa6ee8a635e0102c82440N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3060
- C:\Windows\System\pVhrZdS.exe
  C:\Windows\System\pVhrZdS.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\qdfjrqO.exe
  C:\Windows\System\qdfjrqO.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\MLUiant.exe
  C:\Windows\System\MLUiant.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\FYHdlCG.exe
  C:\Windows\System\FYHdlCG.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\BnaKgro.exe
  C:\Windows\System\BnaKgro.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\ucHhhSg.exe
  C:\Windows\System\ucHhhSg.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\ctkdVLR.exe
  C:\Windows\System\ctkdVLR.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\BfJIStL.exe
  C:\Windows\System\BfJIStL.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\VJnhpas.exe
  C:\Windows\System\VJnhpas.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\EXBaOJX.exe
  C:\Windows\System\EXBaOJX.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\adIiDNy.exe
  C:\Windows\System\adIiDNy.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\QCevkSW.exe
  C:\Windows\System\QCevkSW.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\GpWfoNb.exe
  C:\Windows\System\GpWfoNb.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\GFKRaGk.exe
  C:\Windows\System\GFKRaGk.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\wdJEcpD.exe
  C:\Windows\System\wdJEcpD.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\AvjDwFo.exe
  C:\Windows\System\AvjDwFo.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\lgvgitT.exe
  C:\Windows\System\lgvgitT.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\LwMGVvB.exe
  C:\Windows\System\LwMGVvB.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\zhaSLpd.exe
  C:\Windows\System\zhaSLpd.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\QslTrYE.exe
  C:\Windows\System\QslTrYE.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\cVRpiJC.exe
  C:\Windows\System\cVRpiJC.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\rgfYWxe.exe
  C:\Windows\System\rgfYWxe.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\IeZUZsD.exe
  C:\Windows\System\IeZUZsD.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\eHWQMnS.exe
  C:\Windows\System\eHWQMnS.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\YHzMapK.exe
  C:\Windows\System\YHzMapK.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\QVKggGy.exe
  C:\Windows\System\QVKggGy.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\IzQsmzG.exe
  C:\Windows\System\IzQsmzG.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\wYevmBe.exe
  C:\Windows\System\wYevmBe.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\FOjmilQ.exe
  C:\Windows\System\FOjmilQ.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\ovXsnwG.exe
  C:\Windows\System\ovXsnwG.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\PeXUniM.exe
  C:\Windows\System\PeXUniM.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\crOVQcG.exe
  C:\Windows\System\crOVQcG.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\EsDqNVO.exe
  C:\Windows\System\EsDqNVO.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\JAxewQO.exe
  C:\Windows\System\JAxewQO.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\WlRewnW.exe
  C:\Windows\System\WlRewnW.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\lvRZGsG.exe
  C:\Windows\System\lvRZGsG.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\ykYgjmE.exe
  C:\Windows\System\ykYgjmE.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\DtUaffk.exe
  C:\Windows\System\DtUaffk.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\PRualFT.exe
  C:\Windows\System\PRualFT.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\lpKJglI.exe
  C:\Windows\System\lpKJglI.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\SeXnTBq.exe
  C:\Windows\System\SeXnTBq.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\YtdzPOf.exe
  C:\Windows\System\YtdzPOf.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\ScGsBNv.exe
  C:\Windows\System\ScGsBNv.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\WdFCbCe.exe
  C:\Windows\System\WdFCbCe.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\PoTzpAx.exe
  C:\Windows\System\PoTzpAx.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\kdQDpUm.exe
  C:\Windows\System\kdQDpUm.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\SyXWbEa.exe
  C:\Windows\System\SyXWbEa.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\TnZmGTd.exe
  C:\Windows\System\TnZmGTd.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\IKijSei.exe
  C:\Windows\System\IKijSei.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\lNopJNd.exe
  C:\Windows\System\lNopJNd.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\GabktSz.exe
  C:\Windows\System\GabktSz.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\kHKYslD.exe
  C:\Windows\System\kHKYslD.exe
  2⤵
  - Executes dropped EXE
  PID:308
- C:\Windows\System\QhSJAVh.exe
  C:\Windows\System\QhSJAVh.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\MZVVLUh.exe
  C:\Windows\System\MZVVLUh.exe
  2⤵
  - Executes dropped EXE
  PID:108
- C:\Windows\System\PVdvMew.exe
  C:\Windows\System\PVdvMew.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\FKJOEHO.exe
  C:\Windows\System\FKJOEHO.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\fTHvZKV.exe
  C:\Windows\System\fTHvZKV.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\SSfReUF.exe
  C:\Windows\System\SSfReUF.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\ndzHtLF.exe
  C:\Windows\System\ndzHtLF.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\NeFbfaL.exe
  C:\Windows\System\NeFbfaL.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\micyyoq.exe
  C:\Windows\System\micyyoq.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\bOXJGCf.exe
  C:\Windows\System\bOXJGCf.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\iTiqxXx.exe
  C:\Windows\System\iTiqxXx.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\uaXqdfC.exe
  C:\Windows\System\uaXqdfC.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\oaMShNz.exe
  C:\Windows\System\oaMShNz.exe
  2⤵
  PID:1636
- C:\Windows\System\rgZLsAS.exe
  C:\Windows\System\rgZLsAS.exe
  2⤵
  PID:2548
- C:\Windows\System\EBUEYUU.exe
  C:\Windows\System\EBUEYUU.exe
  2⤵
  PID:1516
- C:\Windows\System\phjWCjz.exe
  C:\Windows\System\phjWCjz.exe
  2⤵
  PID:1004
- C:\Windows\System\JZgLTwr.exe
  C:\Windows\System\JZgLTwr.exe
  2⤵
  PID:2132
- C:\Windows\System\xiVdMZm.exe
  C:\Windows\System\xiVdMZm.exe
  2⤵
  PID:2580
- C:\Windows\System\exzDgXz.exe
  C:\Windows\System\exzDgXz.exe
  2⤵
  PID:2940
- C:\Windows\System\KtyuhBf.exe
  C:\Windows\System\KtyuhBf.exe
  2⤵
  PID:2152
- C:\Windows\System\NorgJhv.exe
  C:\Windows\System\NorgJhv.exe
  2⤵
  PID:1604
- C:\Windows\System\VCFWrFa.exe
  C:\Windows\System\VCFWrFa.exe
  2⤵
  PID:2612
- C:\Windows\System\WvlyUZg.exe
  C:\Windows\System\WvlyUZg.exe
  2⤵
  PID:1996
- C:\Windows\System\tKWFxRv.exe
  C:\Windows\System\tKWFxRv.exe
  2⤵
  PID:1696
- C:\Windows\System\pvPYNLv.exe
  C:\Windows\System\pvPYNLv.exe
  2⤵
  PID:1684
- C:\Windows\System\pTPQZob.exe
  C:\Windows\System\pTPQZob.exe
  2⤵
  PID:1568
- C:\Windows\System\QtWYgaM.exe
  C:\Windows\System\QtWYgaM.exe
  2⤵
  PID:2488
- C:\Windows\System\yFnwwDP.exe
  C:\Windows\System\yFnwwDP.exe
  2⤵
  PID:1672
- C:\Windows\System\anHazqs.exe
  C:\Windows\System\anHazqs.exe
  2⤵
  PID:880
- C:\Windows\System\QJxpdbb.exe
  C:\Windows\System\QJxpdbb.exe
  2⤵
  PID:2148
- C:\Windows\System\aenRSeI.exe
  C:\Windows\System\aenRSeI.exe
  2⤵
  PID:112
- C:\Windows\System\IoAUTlm.exe
  C:\Windows\System\IoAUTlm.exe
  2⤵
  PID:2792
- C:\Windows\System\sklrMLe.exe
  C:\Windows\System\sklrMLe.exe
  2⤵
  PID:2868
- C:\Windows\System\gbRCaeb.exe
  C:\Windows\System\gbRCaeb.exe
  2⤵
  PID:2168
- C:\Windows\System\hVppBqo.exe
  C:\Windows\System\hVppBqo.exe
  2⤵
  PID:2716
- C:\Windows\System\PuiFOFL.exe
  C:\Windows\System\PuiFOFL.exe
  2⤵
  PID:572
- C:\Windows\System\TYFqrax.exe
  C:\Windows\System\TYFqrax.exe
  2⤵
  PID:3040
- C:\Windows\System\PLanBKj.exe
  C:\Windows\System\PLanBKj.exe
  2⤵
  PID:1468
- C:\Windows\System\egVYnCW.exe
  C:\Windows\System\egVYnCW.exe
  2⤵
  PID:1784
- C:\Windows\System\AaQJxGn.exe
  C:\Windows\System\AaQJxGn.exe
  2⤵
  PID:3048
- C:\Windows\System\taIOmGi.exe
  C:\Windows\System\taIOmGi.exe
  2⤵
  PID:1284
- C:\Windows\System\WkmSkcY.exe
  C:\Windows\System\WkmSkcY.exe
  2⤵
  PID:2124
- C:\Windows\System\inQesNY.exe
  C:\Windows\System\inQesNY.exe
  2⤵
  PID:2692
- C:\Windows\System\qBQUWmV.exe
  C:\Windows\System\qBQUWmV.exe
  2⤵
  PID:884
- C:\Windows\System\RpWUUVD.exe
  C:\Windows\System\RpWUUVD.exe
  2⤵
  PID:2572
- C:\Windows\System\dcbxSNo.exe
  C:\Windows\System\dcbxSNo.exe
  2⤵
  PID:2780
- C:\Windows\System\WEhIHKD.exe
  C:\Windows\System\WEhIHKD.exe
  2⤵
  PID:1304
- C:\Windows\System\vMZkXzi.exe
  C:\Windows\System\vMZkXzi.exe
  2⤵
  PID:804
- C:\Windows\System\vaViFWW.exe
  C:\Windows\System\vaViFWW.exe
  2⤵
  PID:1616
- C:\Windows\System\IrpxybS.exe
  C:\Windows\System\IrpxybS.exe
  2⤵
  PID:1236
- C:\Windows\System\lgmVtEP.exe
  C:\Windows\System\lgmVtEP.exe
  2⤵
  PID:1944
- C:\Windows\System\CYDyXwQ.exe
  C:\Windows\System\CYDyXwQ.exe
  2⤵
  PID:1352
- C:\Windows\System\uoArUzX.exe
  C:\Windows\System\uoArUzX.exe
  2⤵
  PID:2824
- C:\Windows\System\Xjzsqva.exe
  C:\Windows\System\Xjzsqva.exe
  2⤵
  PID:2360
- C:\Windows\System\ECBaQhc.exe
  C:\Windows\System\ECBaQhc.exe
  2⤵
  PID:288
- C:\Windows\System\rjGZGnV.exe
  C:\Windows\System\rjGZGnV.exe
  2⤵
  PID:2444
- C:\Windows\System\yLFvLRm.exe
  C:\Windows\System\yLFvLRm.exe
  2⤵
  PID:1668
- C:\Windows\System\DGWHlpC.exe
  C:\Windows\System\DGWHlpC.exe
  2⤵
  PID:2732
- C:\Windows\System\SSfRfOf.exe
  C:\Windows\System\SSfRfOf.exe
  2⤵
  PID:2524
- C:\Windows\System\DwEpNtr.exe
  C:\Windows\System\DwEpNtr.exe
  2⤵
  PID:1796
- C:\Windows\System\DNlwytG.exe
  C:\Windows\System\DNlwytG.exe
  2⤵
  PID:2888
- C:\Windows\System\mAtAmEo.exe
  C:\Windows\System\mAtAmEo.exe
  2⤵
  PID:2452
- C:\Windows\System\gVgjAxP.exe
  C:\Windows\System\gVgjAxP.exe
  2⤵
  PID:1320
- C:\Windows\System\HfMPILx.exe
  C:\Windows\System\HfMPILx.exe
  2⤵
  PID:2820
- C:\Windows\System\RDwpcjw.exe
  C:\Windows\System\RDwpcjw.exe
  2⤵
  PID:1528
- C:\Windows\System\AQbqnGy.exe
  C:\Windows\System\AQbqnGy.exe
  2⤵
  PID:1716
- C:\Windows\System\VemxOcI.exe
  C:\Windows\System\VemxOcI.exe
  2⤵
  PID:584
- C:\Windows\System\GDyuHgw.exe
  C:\Windows\System\GDyuHgw.exe
  2⤵
  PID:3084
- C:\Windows\System\rDpOcPa.exe
  C:\Windows\System\rDpOcPa.exe
  2⤵
  PID:3160
- C:\Windows\System\yvxXGrq.exe
  C:\Windows\System\yvxXGrq.exe
  2⤵
  PID:3176
- C:\Windows\System\eFywtWI.exe
  C:\Windows\System\eFywtWI.exe
  2⤵
  PID:3192
- C:\Windows\System\ZjTxbKi.exe
  C:\Windows\System\ZjTxbKi.exe
  2⤵
  PID:3208
- C:\Windows\System\lUhyfTt.exe
  C:\Windows\System\lUhyfTt.exe
  2⤵
  PID:3224
- C:\Windows\System\ZRnskKL.exe
  C:\Windows\System\ZRnskKL.exe
  2⤵
  PID:3244
- C:\Windows\System\wUanOfx.exe
  C:\Windows\System\wUanOfx.exe
  2⤵
  PID:3324
- C:\Windows\System\GoXblGd.exe
  C:\Windows\System\GoXblGd.exe
  2⤵
  PID:3360
- C:\Windows\System\wdyzAfh.exe
  C:\Windows\System\wdyzAfh.exe
  2⤵
  PID:3376
- C:\Windows\System\TtfmiXJ.exe
  C:\Windows\System\TtfmiXJ.exe
  2⤵
  PID:3392
- C:\Windows\System\kBoSvVm.exe
  C:\Windows\System\kBoSvVm.exe
  2⤵
  PID:3408
- C:\Windows\System\znBMXvU.exe
  C:\Windows\System\znBMXvU.exe
  2⤵
  PID:3428
- C:\Windows\System\cCinEpl.exe
  C:\Windows\System\cCinEpl.exe
  2⤵
  PID:3444
- C:\Windows\System\tsZvDHt.exe
  C:\Windows\System\tsZvDHt.exe
  2⤵
  PID:3460
- C:\Windows\System\dykrZlk.exe
  C:\Windows\System\dykrZlk.exe
  2⤵
  PID:3476
- C:\Windows\System\fKkDuac.exe
  C:\Windows\System\fKkDuac.exe
  2⤵
  PID:3496
- C:\Windows\System\iApBkzm.exe
  C:\Windows\System\iApBkzm.exe
  2⤵
  PID:3512
- C:\Windows\System\hTUJEuX.exe
  C:\Windows\System\hTUJEuX.exe
  2⤵
  PID:3528
- C:\Windows\System\tEuKydL.exe
  C:\Windows\System\tEuKydL.exe
  2⤵
  PID:3544
- C:\Windows\System\WvcBxpd.exe
  C:\Windows\System\WvcBxpd.exe
  2⤵
  PID:3560
- C:\Windows\System\vclZsHu.exe
  C:\Windows\System\vclZsHu.exe
  2⤵
  PID:3576
- C:\Windows\System\QaepGQN.exe
  C:\Windows\System\QaepGQN.exe
  2⤵
  PID:3592
- C:\Windows\System\KthFIWB.exe
  C:\Windows\System\KthFIWB.exe
  2⤵
  PID:3608
- C:\Windows\System\EojdFhU.exe
  C:\Windows\System\EojdFhU.exe
  2⤵
  PID:3624
- C:\Windows\System\omdNyCt.exe
  C:\Windows\System\omdNyCt.exe
  2⤵
  PID:3640
- C:\Windows\System\lNmffIs.exe
  C:\Windows\System\lNmffIs.exe
  2⤵
  PID:3656
- C:\Windows\System\MyJIfHt.exe
  C:\Windows\System\MyJIfHt.exe
  2⤵
  PID:3672
- C:\Windows\System\aRtffIv.exe
  C:\Windows\System\aRtffIv.exe
  2⤵
  PID:3688
- C:\Windows\System\TpOpzts.exe
  C:\Windows\System\TpOpzts.exe
  2⤵
  PID:3704
- C:\Windows\System\mrCOhpp.exe
  C:\Windows\System\mrCOhpp.exe
  2⤵
  PID:3720
- C:\Windows\System\XQwIEfu.exe
  C:\Windows\System\XQwIEfu.exe
  2⤵
  PID:3736
- C:\Windows\System\hRLxOEq.exe
  C:\Windows\System\hRLxOEq.exe
  2⤵
  PID:3752
- C:\Windows\System\zpsCgLU.exe
  C:\Windows\System\zpsCgLU.exe
  2⤵
  PID:3820
- C:\Windows\System\QPdzzxn.exe
  C:\Windows\System\QPdzzxn.exe
  2⤵
  PID:3836
- C:\Windows\System\vwuEiJg.exe
  C:\Windows\System\vwuEiJg.exe
  2⤵
  PID:3852
- C:\Windows\System\hNHYzVY.exe
  C:\Windows\System\hNHYzVY.exe
  2⤵
  PID:3868
- C:\Windows\System\IAdJEQm.exe
  C:\Windows\System\IAdJEQm.exe
  2⤵
  PID:3888
- C:\Windows\System\UhCunDX.exe
  C:\Windows\System\UhCunDX.exe
  2⤵
  PID:3908
- C:\Windows\System\fdkikSR.exe
  C:\Windows\System\fdkikSR.exe
  2⤵
  PID:3924
- C:\Windows\System\AKuzaZz.exe
  C:\Windows\System\AKuzaZz.exe
  2⤵
  PID:3940
- C:\Windows\System\scbvbJd.exe
  C:\Windows\System\scbvbJd.exe
  2⤵
  PID:3956
- C:\Windows\System\xHJIYyI.exe
  C:\Windows\System\xHJIYyI.exe
  2⤵
  PID:3972
- C:\Windows\System\FOVqahh.exe
  C:\Windows\System\FOVqahh.exe
  2⤵
  PID:3988
- C:\Windows\System\HCiFTUH.exe
  C:\Windows\System\HCiFTUH.exe
  2⤵
  PID:4004
- C:\Windows\System\Mulgcoj.exe
  C:\Windows\System\Mulgcoj.exe
  2⤵
  PID:4024
- C:\Windows\System\Gqshoeh.exe
  C:\Windows\System\Gqshoeh.exe
  2⤵
  PID:4040
- C:\Windows\System\BAohUSb.exe
  C:\Windows\System\BAohUSb.exe
  2⤵
  PID:4056
- C:\Windows\System\peUrgrz.exe
  C:\Windows\System\peUrgrz.exe
  2⤵
  PID:4072
- C:\Windows\System\EVHYQBA.exe
  C:\Windows\System\EVHYQBA.exe
  2⤵
  PID:2688
- C:\Windows\System\UwUpuEW.exe
  C:\Windows\System\UwUpuEW.exe
  2⤵
  PID:1276
- C:\Windows\System\hCUbxly.exe
  C:\Windows\System\hCUbxly.exe
  2⤵
  PID:1392
- C:\Windows\System\NKwBoXZ.exe
  C:\Windows\System\NKwBoXZ.exe
  2⤵
  PID:2928
- C:\Windows\System\jFbgqWu.exe
  C:\Windows\System\jFbgqWu.exe
  2⤵
  PID:2852
- C:\Windows\System\EnakEVz.exe
  C:\Windows\System\EnakEVz.exe
  2⤵
  PID:2880
- C:\Windows\System\azthysw.exe
  C:\Windows\System\azthysw.exe
  2⤵
  PID:3144
- C:\Windows\System\mnWUJrH.exe
  C:\Windows\System\mnWUJrH.exe
  2⤵
  PID:3092
- C:\Windows\System\sNPBxmf.exe
  C:\Windows\System\sNPBxmf.exe
  2⤵
  PID:3116
- C:\Windows\System\iwXlEnS.exe
  C:\Windows\System\iwXlEnS.exe
  2⤵
  PID:3132
- C:\Windows\System\CSNlxUl.exe
  C:\Windows\System\CSNlxUl.exe
  2⤵
  PID:3152
- C:\Windows\System\fIwpHTC.exe
  C:\Windows\System\fIwpHTC.exe
  2⤵
  PID:3216
- C:\Windows\System\WImIhpN.exe
  C:\Windows\System\WImIhpN.exe
  2⤵
  PID:3260
- C:\Windows\System\oMWFeXn.exe
  C:\Windows\System\oMWFeXn.exe
  2⤵
  PID:3268
- C:\Windows\System\AECdXMU.exe
  C:\Windows\System\AECdXMU.exe
  2⤵
  PID:3280
- C:\Windows\System\XfiiXVc.exe
  C:\Windows\System\XfiiXVc.exe
  2⤵
  PID:3292
- C:\Windows\System\orejaPP.exe
  C:\Windows\System\orejaPP.exe
  2⤵
  PID:3308
- C:\Windows\System\xyOEOYZ.exe
  C:\Windows\System\xyOEOYZ.exe
  2⤵
  PID:2932
- C:\Windows\System\RlNKmmV.exe
  C:\Windows\System\RlNKmmV.exe
  2⤵
  PID:1312
- C:\Windows\System\DMURzRe.exe
  C:\Windows\System\DMURzRe.exe
  2⤵
  PID:2816
- C:\Windows\System\IwCNZje.exe
  C:\Windows\System\IwCNZje.exe
  2⤵
  PID:1724
- C:\Windows\System\QskNxEM.exe
  C:\Windows\System\QskNxEM.exe
  2⤵
  PID:3076
- C:\Windows\System\fateWqK.exe
  C:\Windows\System\fateWqK.exe
  2⤵
  PID:3204
- C:\Windows\System\ZLLDTNS.exe
  C:\Windows\System\ZLLDTNS.exe
  2⤵
  PID:3332
- C:\Windows\System\lDfZZQv.exe
  C:\Windows\System\lDfZZQv.exe
  2⤵
  PID:3348
- C:\Windows\System\GWCRlGW.exe
  C:\Windows\System\GWCRlGW.exe
  2⤵
  PID:3356
- C:\Windows\System\bzkHkiV.exe
  C:\Windows\System\bzkHkiV.exe
  2⤵
  PID:3440
- C:\Windows\System\tJKErxR.exe
  C:\Windows\System\tJKErxR.exe
  2⤵
  PID:3536
- C:\Windows\System\LpACJad.exe
  C:\Windows\System\LpACJad.exe
  2⤵
  PID:3600
- C:\Windows\System\prjmNnT.exe
  C:\Windows\System\prjmNnT.exe
  2⤵
  PID:3696
- C:\Windows\System\BQLwqWa.exe
  C:\Windows\System\BQLwqWa.exe
  2⤵
  PID:3352
- C:\Windows\System\ChZrHDk.exe
  C:\Windows\System\ChZrHDk.exe
  2⤵
  PID:3424
- C:\Windows\System\YwxXOgl.exe
  C:\Windows\System\YwxXOgl.exe
  2⤵
  PID:3488
- C:\Windows\System\QTPgjff.exe
  C:\Windows\System\QTPgjff.exe
  2⤵
  PID:3792
- C:\Windows\System\nkfBxaF.exe
  C:\Windows\System\nkfBxaF.exe
  2⤵
  PID:3764
- C:\Windows\System\JIoqBtS.exe
  C:\Windows\System\JIoqBtS.exe
  2⤵
  PID:3616
- C:\Windows\System\AvzBTDa.exe
  C:\Windows\System\AvzBTDa.exe
  2⤵
  PID:3680
- C:\Windows\System\dVPnrbE.exe
  C:\Windows\System\dVPnrbE.exe
  2⤵
  PID:3744
- C:\Windows\System\KXOxOAD.exe
  C:\Windows\System\KXOxOAD.exe
  2⤵
  PID:3784
- C:\Windows\System\dDctEPM.exe
  C:\Windows\System\dDctEPM.exe
  2⤵
  PID:3796
- C:\Windows\System\MimdJhR.exe
  C:\Windows\System\MimdJhR.exe
  2⤵
  PID:3816
- C:\Windows\System\hDrQdSS.exe
  C:\Windows\System\hDrQdSS.exe
  2⤵
  PID:3916
- C:\Windows\System\yQqOQpk.exe
  C:\Windows\System\yQqOQpk.exe
  2⤵
  PID:3980
- C:\Windows\System\QqEXNaR.exe
  C:\Windows\System\QqEXNaR.exe
  2⤵
  PID:4020
- C:\Windows\System\JZiDnoM.exe
  C:\Windows\System\JZiDnoM.exe
  2⤵
  PID:4084
- C:\Windows\System\hbUwgvK.exe
  C:\Windows\System\hbUwgvK.exe
  2⤵
  PID:1992
- C:\Windows\System\TgclCfM.exe
  C:\Windows\System\TgclCfM.exe
  2⤵
  PID:1180
- C:\Windows\System\NqHsqPr.exe
  C:\Windows\System\NqHsqPr.exe
  2⤵
  PID:3156
- C:\Windows\System\ofKMEuL.exe
  C:\Windows\System\ofKMEuL.exe
  2⤵
  PID:3860
- C:\Windows\System\htFNaSJ.exe
  C:\Windows\System\htFNaSJ.exe
  2⤵
  PID:3904
- C:\Windows\System\DrvHhNQ.exe
  C:\Windows\System\DrvHhNQ.exe
  2⤵
  PID:3968
- C:\Windows\System\vwtNYfS.exe
  C:\Windows\System\vwtNYfS.exe
  2⤵
  PID:4032
- C:\Windows\System\tpmVPid.exe
  C:\Windows\System\tpmVPid.exe
  2⤵
  PID:3252
- C:\Windows\System\QWhEGVm.exe
  C:\Windows\System\QWhEGVm.exe
  2⤵
  PID:3300
- C:\Windows\System\gXpsQyJ.exe
  C:\Windows\System\gXpsQyJ.exe
  2⤵
  PID:1912
- C:\Windows\System\ZhFNmBj.exe
  C:\Windows\System\ZhFNmBj.exe
  2⤵
  PID:2752
- C:\Windows\System\wXCQIfr.exe
  C:\Windows\System\wXCQIfr.exe
  2⤵
  PID:2200
- C:\Windows\System\bhwvsYW.exe
  C:\Windows\System\bhwvsYW.exe
  2⤵
  PID:3128
- C:\Windows\System\YyKbTJu.exe
  C:\Windows\System\YyKbTJu.exe
  2⤵
  PID:2116
- C:\Windows\System\gheQCjI.exe
  C:\Windows\System\gheQCjI.exe
  2⤵
  PID:2628
- C:\Windows\System\UEtxgua.exe
  C:\Windows\System\UEtxgua.exe
  2⤵
  PID:1956
- C:\Windows\System\OJVglIT.exe
  C:\Windows\System\OJVglIT.exe
  2⤵
  PID:2964
- C:\Windows\System\yIAziin.exe
  C:\Windows\System\yIAziin.exe
  2⤵
  PID:3320
- C:\Windows\System\QTKwOer.exe
  C:\Windows\System\QTKwOer.exe
  2⤵
  PID:2040
- C:\Windows\System\asYnMEl.exe
  C:\Windows\System\asYnMEl.exe
  2⤵
  PID:2056
- C:\Windows\System\xLKmbZp.exe
  C:\Windows\System\xLKmbZp.exe
  2⤵
  PID:2948
- C:\Windows\System\smnQmHn.exe
  C:\Windows\System\smnQmHn.exe
  2⤵
  PID:3404
- C:\Windows\System\hJKDZih.exe
  C:\Windows\System\hJKDZih.exe
  2⤵
  PID:3372
- C:\Windows\System\YOpoiUT.exe
  C:\Windows\System\YOpoiUT.exe
  2⤵
  PID:3632
- C:\Windows\System\RtknfjU.exe
  C:\Windows\System\RtknfjU.exe
  2⤵
  PID:3668
- C:\Windows\System\wUVjkrt.exe
  C:\Windows\System\wUVjkrt.exe
  2⤵
  PID:3524
- C:\Windows\System\lsUamqq.exe
  C:\Windows\System\lsUamqq.exe
  2⤵
  PID:3648
- C:\Windows\System\CNXxfKg.exe
  C:\Windows\System\CNXxfKg.exe
  2⤵
  PID:3484
- C:\Windows\System\VoYLLjp.exe
  C:\Windows\System\VoYLLjp.exe
  2⤵
  PID:3776
- C:\Windows\System\bpnXIkO.exe
  C:\Windows\System\bpnXIkO.exe
  2⤵
  PID:3808
- C:\Windows\System\wWGwpzk.exe
  C:\Windows\System\wWGwpzk.exe
  2⤵
  PID:4080
- C:\Windows\System\lsFEgUk.exe
  C:\Windows\System\lsFEgUk.exe
  2⤵
  PID:3584
- C:\Windows\System\axkOEeF.exe
  C:\Windows\System\axkOEeF.exe
  2⤵
  PID:3716
- C:\Windows\System\oKgHmXs.exe
  C:\Windows\System\oKgHmXs.exe
  2⤵
  PID:4092
- C:\Windows\System\uFjdAXm.exe
  C:\Windows\System\uFjdAXm.exe
  2⤵
  PID:3896
- C:\Windows\System\qDBJoRA.exe
  C:\Windows\System\qDBJoRA.exe
  2⤵
  PID:3832
- C:\Windows\System\goEEgQS.exe
  C:\Windows\System\goEEgQS.exe
  2⤵
  PID:3276
- C:\Windows\System\aGJekLl.exe
  C:\Windows\System\aGJekLl.exe
  2⤵
  PID:548
- C:\Windows\System\qdKDumx.exe
  C:\Windows\System\qdKDumx.exe
  2⤵
  PID:2068
- C:\Windows\System\daXEpPd.exe
  C:\Windows\System\daXEpPd.exe
  2⤵
  PID:3140
- C:\Windows\System\tskHRJJ.exe
  C:\Windows\System\tskHRJJ.exe
  2⤵
  PID:1472
- C:\Windows\System\DFNPhji.exe
  C:\Windows\System\DFNPhji.exe
  2⤵
  PID:3172
- C:\Windows\System\nmgfnlN.exe
  C:\Windows\System\nmgfnlN.exe
  2⤵
  PID:1756
- C:\Windows\System\AXtZejR.exe
  C:\Windows\System\AXtZejR.exe
  2⤵
  PID:3240
- C:\Windows\System\ABAzSKF.exe
  C:\Windows\System\ABAzSKF.exe
  2⤵
  PID:3504
- C:\Windows\System\UNhpNVz.exe
  C:\Windows\System\UNhpNVz.exe
  2⤵
  PID:2184
- C:\Windows\System\lklVqSu.exe
  C:\Windows\System\lklVqSu.exe
  2⤵
  PID:3200
- C:\Windows\System\krTqYBe.exe
  C:\Windows\System\krTqYBe.exe
  2⤵
  PID:4052
- C:\Windows\System\DTrPeaK.exe
  C:\Windows\System\DTrPeaK.exe
  2⤵
  PID:1800
- C:\Windows\System\HPwHFdU.exe
  C:\Windows\System\HPwHFdU.exe
  2⤵
  PID:2448
- C:\Windows\System\JvnsVVZ.exe
  C:\Windows\System\JvnsVVZ.exe
  2⤵
  PID:3520
- C:\Windows\System\vFkfTrQ.exe
  C:\Windows\System\vFkfTrQ.exe
  2⤵
  PID:3884
- C:\Windows\System\jqjbHVo.exe
  C:\Windows\System\jqjbHVo.exe
  2⤵
  PID:3828
- C:\Windows\System\sXAkdrB.exe
  C:\Windows\System\sXAkdrB.exe
  2⤵
  PID:2412
- C:\Windows\System\xeepPKk.exe
  C:\Windows\System\xeepPKk.exe
  2⤵
  PID:2256
- C:\Windows\System\chxxQPd.exe
  C:\Windows\System\chxxQPd.exe
  2⤵
  PID:2520
- C:\Windows\System\ThCDDgb.exe
  C:\Windows\System\ThCDDgb.exe
  2⤵
  PID:4016
- C:\Windows\System\iQtaIxQ.exe
  C:\Windows\System\iQtaIxQ.exe
  2⤵
  PID:3020
- C:\Windows\System\FUUNPvO.exe
  C:\Windows\System\FUUNPvO.exe
  2⤵
  PID:3876
- C:\Windows\System\UnxEHqu.exe
  C:\Windows\System\UnxEHqu.exe
  2⤵
  PID:3952
- C:\Windows\System\UjRhdof.exe
  C:\Windows\System\UjRhdof.exe
  2⤵
  PID:3056
- C:\Windows\System\yJjgzDF.exe
  C:\Windows\System\yJjgzDF.exe
  2⤵
  PID:3748
- C:\Windows\System\QItxzWf.exe
  C:\Windows\System\QItxzWf.exe
  2⤵
  PID:3304
- C:\Windows\System\HMGgYPi.exe
  C:\Windows\System\HMGgYPi.exe
  2⤵
  PID:4104
- C:\Windows\System\dsRTBgo.exe
  C:\Windows\System\dsRTBgo.exe
  2⤵
  PID:4124
- C:\Windows\System\XNfrMNe.exe
  C:\Windows\System\XNfrMNe.exe
  2⤵
  PID:4140
- C:\Windows\System\QVAAsEq.exe
  C:\Windows\System\QVAAsEq.exe
  2⤵
  PID:4156
- C:\Windows\System\TSenOsC.exe
  C:\Windows\System\TSenOsC.exe
  2⤵
  PID:4172
- C:\Windows\System\RKkkabO.exe
  C:\Windows\System\RKkkabO.exe
  2⤵
  PID:4188
- C:\Windows\System\qghdaGy.exe
  C:\Windows\System\qghdaGy.exe
  2⤵
  PID:4204
- C:\Windows\System\WwkLAro.exe
  C:\Windows\System\WwkLAro.exe
  2⤵
  PID:4220
- C:\Windows\System\aVwXTgp.exe
  C:\Windows\System\aVwXTgp.exe
  2⤵
  PID:4236
- C:\Windows\System\VlyTkxF.exe
  C:\Windows\System\VlyTkxF.exe
  2⤵
  PID:4252
- C:\Windows\System\HKtTqZx.exe
  C:\Windows\System\HKtTqZx.exe
  2⤵
  PID:4268
- C:\Windows\System\NCbXkNS.exe
  C:\Windows\System\NCbXkNS.exe
  2⤵
  PID:4284
- C:\Windows\System\lLXnJUl.exe
  C:\Windows\System\lLXnJUl.exe
  2⤵
  PID:4300
- C:\Windows\System\xtSRNmu.exe
  C:\Windows\System\xtSRNmu.exe
  2⤵
  PID:4316
- C:\Windows\System\BMiENZh.exe
  C:\Windows\System\BMiENZh.exe
  2⤵
  PID:4336
- C:\Windows\System\uQrYthx.exe
  C:\Windows\System\uQrYthx.exe
  2⤵
  PID:4352
- C:\Windows\System\PeSftIW.exe
  C:\Windows\System\PeSftIW.exe
  2⤵
  PID:4368
- C:\Windows\System\KNAziUW.exe
  C:\Windows\System\KNAziUW.exe
  2⤵
  PID:4384
- C:\Windows\System\oBWbvdj.exe
  C:\Windows\System\oBWbvdj.exe
  2⤵
  PID:4416
- C:\Windows\System\qmsYFDG.exe
  C:\Windows\System\qmsYFDG.exe
  2⤵
  PID:4432
- C:\Windows\System\ibAIfLO.exe
  C:\Windows\System\ibAIfLO.exe
  2⤵
  PID:4448
- C:\Windows\System\ZRUGWkq.exe
  C:\Windows\System\ZRUGWkq.exe
  2⤵
  PID:4464
- C:\Windows\System\HTGQpou.exe
  C:\Windows\System\HTGQpou.exe
  2⤵
  PID:4480
- C:\Windows\System\VRpDdvY.exe
  C:\Windows\System\VRpDdvY.exe
  2⤵
  PID:4496
- C:\Windows\System\LWoMovD.exe
  C:\Windows\System\LWoMovD.exe
  2⤵
  PID:4512
- C:\Windows\System\LfNIsMZ.exe
  C:\Windows\System\LfNIsMZ.exe
  2⤵
  PID:4528
- C:\Windows\System\refnuqD.exe
  C:\Windows\System\refnuqD.exe
  2⤵
  PID:4544
- C:\Windows\System\TdroENP.exe
  C:\Windows\System\TdroENP.exe
  2⤵
  PID:4560
- C:\Windows\System\SSsOckx.exe
  C:\Windows\System\SSsOckx.exe
  2⤵
  PID:4576
- C:\Windows\System\AalYrUz.exe
  C:\Windows\System\AalYrUz.exe
  2⤵
  PID:4592
- C:\Windows\System\DUANjls.exe
  C:\Windows\System\DUANjls.exe
  2⤵
  PID:4608
- C:\Windows\System\jpuFrwy.exe
  C:\Windows\System\jpuFrwy.exe
  2⤵
  PID:4624
- C:\Windows\System\oinXjMK.exe
  C:\Windows\System\oinXjMK.exe
  2⤵
  PID:4640
- C:\Windows\System\MmoYdMP.exe
  C:\Windows\System\MmoYdMP.exe
  2⤵
  PID:4656
- C:\Windows\System\BZzCusI.exe
  C:\Windows\System\BZzCusI.exe
  2⤵
  PID:4676
- C:\Windows\System\dGEwWFa.exe
  C:\Windows\System\dGEwWFa.exe
  2⤵
  PID:4692
- C:\Windows\System\hZmFUSh.exe
  C:\Windows\System\hZmFUSh.exe
  2⤵
  PID:4708
- C:\Windows\System\qNagmWx.exe
  C:\Windows\System\qNagmWx.exe
  2⤵
  PID:4724
- C:\Windows\System\TrIXLQC.exe
  C:\Windows\System\TrIXLQC.exe
  2⤵
  PID:4740
- C:\Windows\System\lXrWcKd.exe
  C:\Windows\System\lXrWcKd.exe
  2⤵
  PID:4756
- C:\Windows\System\tHMztBv.exe
  C:\Windows\System\tHMztBv.exe
  2⤵
  PID:4772
- C:\Windows\System\mVWjFla.exe
  C:\Windows\System\mVWjFla.exe
  2⤵
  PID:4788
- C:\Windows\System\AoQJPfC.exe
  C:\Windows\System\AoQJPfC.exe
  2⤵
  PID:4804
- C:\Windows\System\ZzgfzKq.exe
  C:\Windows\System\ZzgfzKq.exe
  2⤵
  PID:4820
- C:\Windows\System\vjFqnSD.exe
  C:\Windows\System\vjFqnSD.exe
  2⤵
  PID:4836
- C:\Windows\System\RfKZnTj.exe
  C:\Windows\System\RfKZnTj.exe
  2⤵
  PID:4852
- C:\Windows\System\lNRZMjn.exe
  C:\Windows\System\lNRZMjn.exe
  2⤵
  PID:4872
- C:\Windows\System\lYVwIVv.exe
  C:\Windows\System\lYVwIVv.exe
  2⤵
  PID:4892
- C:\Windows\System\pIpAEYS.exe
  C:\Windows\System\pIpAEYS.exe
  2⤵
  PID:4912
- C:\Windows\System\ePdRWsI.exe
  C:\Windows\System\ePdRWsI.exe
  2⤵
  PID:4928
- C:\Windows\System\tGzUoDX.exe
  C:\Windows\System\tGzUoDX.exe
  2⤵
  PID:4944
- C:\Windows\System\icZQpnx.exe
  C:\Windows\System\icZQpnx.exe
  2⤵
  PID:4964
- C:\Windows\System\baYcnhn.exe
  C:\Windows\System\baYcnhn.exe
  2⤵
  PID:4980
- C:\Windows\System\IXjVsMg.exe
  C:\Windows\System\IXjVsMg.exe
  2⤵
  PID:4996
- C:\Windows\System\RYpmnWK.exe
  C:\Windows\System\RYpmnWK.exe
  2⤵
  PID:5012
- C:\Windows\System\OoiKprm.exe
  C:\Windows\System\OoiKprm.exe
  2⤵
  PID:5028
- C:\Windows\System\nuoVCVG.exe
  C:\Windows\System\nuoVCVG.exe
  2⤵
  PID:5044
- C:\Windows\System\ayAsONa.exe
  C:\Windows\System\ayAsONa.exe
  2⤵
  PID:5060
- C:\Windows\System\jTSsFFB.exe
  C:\Windows\System\jTSsFFB.exe
  2⤵
  PID:5076
- C:\Windows\System\hXlVbqh.exe
  C:\Windows\System\hXlVbqh.exe
  2⤵
  PID:5092
- C:\Windows\System\qMeDcOz.exe
  C:\Windows\System\qMeDcOz.exe
  2⤵
  PID:5108
- C:\Windows\System\qfKSuTe.exe
  C:\Windows\System\qfKSuTe.exe
  2⤵
  PID:4116
- C:\Windows\System\iFZSnyt.exe
  C:\Windows\System\iFZSnyt.exe
  2⤵
  PID:3812
- C:\Windows\System\Bflskxd.exe
  C:\Windows\System\Bflskxd.exe
  2⤵
  PID:4148
- C:\Windows\System\HNDQibD.exe
  C:\Windows\System\HNDQibD.exe
  2⤵
  PID:4212
- C:\Windows\System\viQcOLN.exe
  C:\Windows\System\viQcOLN.exe
  2⤵
  PID:3272
- C:\Windows\System\pCMvYal.exe
  C:\Windows\System\pCMvYal.exe
  2⤵
  PID:3508
- C:\Windows\System\CPBGrwr.exe
  C:\Windows\System\CPBGrwr.exe
  2⤵
  PID:4136
- C:\Windows\System\vGoARIN.exe
  C:\Windows\System\vGoARIN.exe
  2⤵
  PID:4200
- C:\Windows\System\taIyfVY.exe
  C:\Windows\System\taIyfVY.exe
  2⤵
  PID:4248
- C:\Windows\System\sviTUzH.exe
  C:\Windows\System\sviTUzH.exe
  2⤵
  PID:4312
- C:\Windows\System\HMqnMnC.exe
  C:\Windows\System\HMqnMnC.exe
  2⤵
  PID:4376
- C:\Windows\System\qgxugcX.exe
  C:\Windows\System\qgxugcX.exe
  2⤵
  PID:4292
- C:\Windows\System\UklEcYA.exe
  C:\Windows\System\UklEcYA.exe
  2⤵
  PID:4332
- C:\Windows\System\WqLYAeq.exe
  C:\Windows\System\WqLYAeq.exe
  2⤵
  PID:4556
- C:\Windows\System\MbGUrDa.exe
  C:\Windows\System\MbGUrDa.exe
  2⤵
  PID:4456
- C:\Windows\System\DzXfgwr.exe
  C:\Windows\System\DzXfgwr.exe
  2⤵
  PID:4392
- C:\Windows\System\akNHchA.exe
  C:\Windows\System\akNHchA.exe
  2⤵
  PID:4652
- C:\Windows\System\tirIwbS.exe
  C:\Windows\System\tirIwbS.exe
  2⤵
  PID:4716
- C:\Windows\System\dszyiaG.exe
  C:\Windows\System\dszyiaG.exe
  2⤵
  PID:4780
- C:\Windows\System\FSWXobd.exe
  C:\Windows\System\FSWXobd.exe
  2⤵
  PID:4408
- C:\Windows\System\kyyptTN.exe
  C:\Windows\System\kyyptTN.exe
  2⤵
  PID:4444
- C:\Windows\System\zGrsQSD.exe
  C:\Windows\System\zGrsQSD.exe
  2⤵
  PID:4508
- C:\Windows\System\IkKUdjT.exe
  C:\Windows\System\IkKUdjT.exe
  2⤵
  PID:4572
- C:\Windows\System\rrZiAkY.exe
  C:\Windows\System\rrZiAkY.exe
  2⤵
  PID:4636
- C:\Windows\System\cuNuRKI.exe
  C:\Windows\System\cuNuRKI.exe
  2⤵
  PID:4700
- C:\Windows\System\Fcqpdzb.exe
  C:\Windows\System\Fcqpdzb.exe
  2⤵
  PID:4736
- C:\Windows\System\biuJkjk.exe
  C:\Windows\System\biuJkjk.exe
  2⤵
  PID:4800
- C:\Windows\System\isefCrp.exe
  C:\Windows\System\isefCrp.exe
  2⤵
  PID:4908
- C:\Windows\System\PKDmhvm.exe
  C:\Windows\System\PKDmhvm.exe
  2⤵
  PID:4956
- C:\Windows\System\vxnsijY.exe
  C:\Windows\System\vxnsijY.exe
  2⤵
  PID:5084
- C:\Windows\System\sEeFnKm.exe
  C:\Windows\System\sEeFnKm.exe
  2⤵
  PID:4112
- C:\Windows\System\ykQBVKq.exe
  C:\Windows\System\ykQBVKq.exe
  2⤵
  PID:356
- C:\Windows\System\iizdtFL.exe
  C:\Windows\System\iizdtFL.exe
  2⤵
  PID:4972
- C:\Windows\System\CxOmXGU.exe
  C:\Windows\System\CxOmXGU.exe
  2⤵
  PID:5100
- C:\Windows\System\aYpTfZt.exe
  C:\Windows\System\aYpTfZt.exe
  2⤵
  PID:4132
- C:\Windows\System\myeZssR.exe
  C:\Windows\System\myeZssR.exe
  2⤵
  PID:4348
- C:\Windows\System\cshTJJs.exe
  C:\Windows\System\cshTJJs.exe
  2⤵
  PID:4180
- C:\Windows\System\TVFTgMY.exe
  C:\Windows\System\TVFTgMY.exe
  2⤵
  PID:4360
- C:\Windows\System\rlxjWER.exe
  C:\Windows\System\rlxjWER.exe
  2⤵
  PID:4168
- C:\Windows\System\JKEzYyH.exe
  C:\Windows\System\JKEzYyH.exe
  2⤵
  PID:4648
- C:\Windows\System\OonwGsy.exe
  C:\Windows\System\OonwGsy.exe
  2⤵
  PID:4412
- C:\Windows\System\bGrPzpl.exe
  C:\Windows\System\bGrPzpl.exe
  2⤵
  PID:4196
- C:\Windows\System\CGmPdBV.exe
  C:\Windows\System\CGmPdBV.exe
  2⤵
  PID:4264
- C:\Windows\System\JTypnSC.exe
  C:\Windows\System\JTypnSC.exe
  2⤵
  PID:4688
- C:\Windows\System\VKCJHbD.exe
  C:\Windows\System\VKCJHbD.exe
  2⤵
  PID:4476
- C:\Windows\System\uoBNduH.exe
  C:\Windows\System\uoBNduH.exe
  2⤵
  PID:4732
- C:\Windows\System\FehPQft.exe
  C:\Windows\System\FehPQft.exe
  2⤵
  PID:4768
- C:\Windows\System\QUEmeKR.exe
  C:\Windows\System\QUEmeKR.exe
  2⤵
  PID:4832
- C:\Windows\System\Onxbehu.exe
  C:\Windows\System\Onxbehu.exe
  2⤵
  PID:4864
- C:\Windows\System\xPSNHDR.exe
  C:\Windows\System\xPSNHDR.exe
  2⤵
  PID:4904
- C:\Windows\System\jsMtZXI.exe
  C:\Windows\System\jsMtZXI.exe
  2⤵
  PID:5088
- C:\Windows\System\tXkPpbE.exe
  C:\Windows\System\tXkPpbE.exe
  2⤵
  PID:5020
- C:\Windows\System\PEipBIz.exe
  C:\Windows\System\PEipBIz.exe
  2⤵
  PID:3420
- C:\Windows\System\BxNOywp.exe
  C:\Windows\System\BxNOywp.exe
  2⤵
  PID:4748
- C:\Windows\System\rXDXqnj.exe
  C:\Windows\System\rXDXqnj.exe
  2⤵
  PID:4540
- C:\Windows\System\dQTvvhL.exe
  C:\Windows\System\dQTvvhL.exe
  2⤵
  PID:5008
- C:\Windows\System\hnXvODS.exe
  C:\Windows\System\hnXvODS.exe
  2⤵
  PID:4428
- C:\Windows\System\Mffohou.exe
  C:\Windows\System\Mffohou.exe
  2⤵
  PID:4488
- C:\Windows\System\AHhgSCU.exe
  C:\Windows\System\AHhgSCU.exe
  2⤵
  PID:4404
- C:\Windows\System\puGAsmZ.exe
  C:\Windows\System\puGAsmZ.exe
  2⤵
  PID:4860
- C:\Windows\System\WvTbVfR.exe
  C:\Windows\System\WvTbVfR.exe
  2⤵
  PID:4100
- C:\Windows\System\OKCEZjH.exe
  C:\Windows\System\OKCEZjH.exe
  2⤵
  PID:4828
- C:\Windows\System\bSVQRrL.exe
  C:\Windows\System\bSVQRrL.exe
  2⤵
  PID:4848
- C:\Windows\System\lWhxgAx.exe
  C:\Windows\System\lWhxgAx.exe
  2⤵
  PID:3964
- C:\Windows\System\rlgjwin.exe
  C:\Windows\System\rlgjwin.exe
  2⤵
  PID:4988
- C:\Windows\System\FrjLQCC.exe
  C:\Windows\System\FrjLQCC.exe
  2⤵
  PID:4260
- C:\Windows\System\riaykjc.exe
  C:\Windows\System\riaykjc.exe
  2⤵
  PID:5132
- C:\Windows\System\mpcppwB.exe
  C:\Windows\System\mpcppwB.exe
  2⤵
  PID:5148
- C:\Windows\System\Bctuupr.exe
  C:\Windows\System\Bctuupr.exe
  2⤵
  PID:5164
- C:\Windows\System\UEHBchz.exe
  C:\Windows\System\UEHBchz.exe
  2⤵
  PID:5180
- C:\Windows\System\oQqBbqH.exe
  C:\Windows\System\oQqBbqH.exe
  2⤵
  PID:5196
- C:\Windows\System\bOoyOvZ.exe
  C:\Windows\System\bOoyOvZ.exe
  2⤵
  PID:5212
- C:\Windows\System\fdUkqzI.exe
  C:\Windows\System\fdUkqzI.exe
  2⤵
  PID:5228
- C:\Windows\System\WCMhilR.exe
  C:\Windows\System\WCMhilR.exe
  2⤵
  PID:5244
- C:\Windows\System\YSmBOMU.exe
  C:\Windows\System\YSmBOMU.exe
  2⤵
  PID:5264
- C:\Windows\System\ytmIuoE.exe
  C:\Windows\System\ytmIuoE.exe
  2⤵
  PID:5280
- C:\Windows\System\vreKEZr.exe
  C:\Windows\System\vreKEZr.exe
  2⤵
  PID:5296
- C:\Windows\System\jCLvxKW.exe
  C:\Windows\System\jCLvxKW.exe
  2⤵
  PID:5312
- C:\Windows\System\WhZOzEs.exe
  C:\Windows\System\WhZOzEs.exe
  2⤵
  PID:5328
- C:\Windows\System\iUIxvit.exe
  C:\Windows\System\iUIxvit.exe
  2⤵
  PID:5344
- C:\Windows\System\miHITlt.exe
  C:\Windows\System\miHITlt.exe
  2⤵
  PID:5364
- C:\Windows\System\JVQUsYp.exe
  C:\Windows\System\JVQUsYp.exe
  2⤵
  PID:5380
- C:\Windows\System\ugJmrFX.exe
  C:\Windows\System\ugJmrFX.exe
  2⤵
  PID:5396
- C:\Windows\System\ngHUbPW.exe
  C:\Windows\System\ngHUbPW.exe
  2⤵
  PID:5412
- C:\Windows\System\PPlTIFA.exe
  C:\Windows\System\PPlTIFA.exe
  2⤵
  PID:5428
- C:\Windows\System\Hwxfreg.exe
  C:\Windows\System\Hwxfreg.exe
  2⤵
  PID:5444
- C:\Windows\System\EpgbvFS.exe
  C:\Windows\System\EpgbvFS.exe
  2⤵
  PID:5460
- C:\Windows\System\JzZKhQh.exe
  C:\Windows\System\JzZKhQh.exe
  2⤵
  PID:5480
- C:\Windows\System\WJfCWOR.exe
  C:\Windows\System\WJfCWOR.exe
  2⤵
  PID:5496
- C:\Windows\System\CLVcmaW.exe
  C:\Windows\System\CLVcmaW.exe
  2⤵
  PID:5512
- C:\Windows\System\efGouFY.exe
  C:\Windows\System\efGouFY.exe
  2⤵
  PID:5532
- C:\Windows\System\csoSBXx.exe
  C:\Windows\System\csoSBXx.exe
  2⤵
  PID:5548
- C:\Windows\System\jSIKlZH.exe
  C:\Windows\System\jSIKlZH.exe
  2⤵
  PID:5564
- C:\Windows\System\AIKzKqa.exe
  C:\Windows\System\AIKzKqa.exe
  2⤵
  PID:5584
- C:\Windows\System\MRAevrr.exe
  C:\Windows\System\MRAevrr.exe
  2⤵
  PID:5600
- C:\Windows\System\PySNItb.exe
  C:\Windows\System\PySNItb.exe
  2⤵
  PID:5616
- C:\Windows\System\WqxZXvx.exe
  C:\Windows\System\WqxZXvx.exe
  2⤵
  PID:5632
- C:\Windows\System\pwwzZYz.exe
  C:\Windows\System\pwwzZYz.exe
  2⤵
  PID:5652
- C:\Windows\System\bPVfiQP.exe
  C:\Windows\System\bPVfiQP.exe
  2⤵
  PID:5668
- C:\Windows\System\rdlvKRD.exe
  C:\Windows\System\rdlvKRD.exe
  2⤵
  PID:5684
- C:\Windows\System\dmuttUm.exe
  C:\Windows\System\dmuttUm.exe
  2⤵
  PID:5700
- C:\Windows\System\fBNJlHR.exe
  C:\Windows\System\fBNJlHR.exe
  2⤵
  PID:5716
- C:\Windows\System\YEKBGsR.exe
  C:\Windows\System\YEKBGsR.exe
  2⤵
  PID:5748
- C:\Windows\System\qtmmmAA.exe
  C:\Windows\System\qtmmmAA.exe
  2⤵
  PID:5764
- C:\Windows\System\SyFQHqu.exe
  C:\Windows\System\SyFQHqu.exe
  2⤵
  PID:5780
- C:\Windows\System\yPnXVsb.exe
  C:\Windows\System\yPnXVsb.exe
  2⤵
  PID:5796
- C:\Windows\System\gyftFmx.exe
  C:\Windows\System\gyftFmx.exe
  2⤵
  PID:5816
- C:\Windows\System\ExTPJVg.exe
  C:\Windows\System\ExTPJVg.exe
  2⤵
  PID:5832
- C:\Windows\System\NAsohcM.exe
  C:\Windows\System\NAsohcM.exe
  2⤵
  PID:5848
- C:\Windows\System\BMYiNnM.exe
  C:\Windows\System\BMYiNnM.exe
  2⤵
  PID:5864
- C:\Windows\System\lsaufpb.exe
  C:\Windows\System\lsaufpb.exe
  2⤵
  PID:5884
- C:\Windows\System\CBoqwiH.exe
  C:\Windows\System\CBoqwiH.exe
  2⤵
  PID:5900
- C:\Windows\System\dycAOLA.exe
  C:\Windows\System\dycAOLA.exe
  2⤵
  PID:5916
- C:\Windows\System\wMLRoHh.exe
  C:\Windows\System\wMLRoHh.exe
  2⤵
  PID:5932
- C:\Windows\System\qFBsFMB.exe
  C:\Windows\System\qFBsFMB.exe
  2⤵
  PID:5952
- C:\Windows\System\LhzFPHA.exe
  C:\Windows\System\LhzFPHA.exe
  2⤵
  PID:5968
- C:\Windows\System\sGgPTDe.exe
  C:\Windows\System\sGgPTDe.exe
  2⤵
  PID:5984
- C:\Windows\System\ZWoOHoX.exe
  C:\Windows\System\ZWoOHoX.exe
  2⤵
  PID:6000
- C:\Windows\System\nptGcKb.exe
  C:\Windows\System\nptGcKb.exe
  2⤵
  PID:6016
- C:\Windows\System\EHTcFEe.exe
  C:\Windows\System\EHTcFEe.exe
  2⤵
  PID:6032
- C:\Windows\System\ItTENTK.exe
  C:\Windows\System\ItTENTK.exe
  2⤵
  PID:6048
- C:\Windows\System\beRSpIF.exe
  C:\Windows\System\beRSpIF.exe
  2⤵
  PID:6064
- C:\Windows\System\bDVMqYa.exe
  C:\Windows\System\bDVMqYa.exe
  2⤵
  PID:6080
- C:\Windows\System\DctjIpe.exe
  C:\Windows\System\DctjIpe.exe
  2⤵
  PID:6096
- C:\Windows\System\jxNoqlc.exe
  C:\Windows\System\jxNoqlc.exe
  2⤵
  PID:6112
- C:\Windows\System\ltnqUch.exe
  C:\Windows\System\ltnqUch.exe
  2⤵
  PID:6128
- C:\Windows\System\diqXogH.exe
  C:\Windows\System\diqXogH.exe
  2⤵
  PID:5124
- C:\Windows\System\ZYKwPRK.exe
  C:\Windows\System\ZYKwPRK.exe
  2⤵
  PID:5128
- C:\Windows\System\DJCDneu.exe
  C:\Windows\System\DJCDneu.exe
  2⤵
  PID:4568
- C:\Windows\System\foBoOiS.exe
  C:\Windows\System\foBoOiS.exe
  2⤵
  PID:5160
- C:\Windows\System\OaeEXTm.exe
  C:\Windows\System\OaeEXTm.exe
  2⤵
  PID:4940
- C:\Windows\System\dAopWRa.exe
  C:\Windows\System\dAopWRa.exe
  2⤵
  PID:5224
- C:\Windows\System\dTMblhZ.exe
  C:\Windows\System\dTMblhZ.exe
  2⤵
  PID:5292
- C:\Windows\System\MnMEbXx.exe
  C:\Windows\System\MnMEbXx.exe
  2⤵
  PID:5140
- C:\Windows\System\VUXTEAw.exe
  C:\Windows\System\VUXTEAw.exe
  2⤵
  PID:5208
- C:\Windows\System\dbSimpo.exe
  C:\Windows\System\dbSimpo.exe
  2⤵
  PID:5304
- C:\Windows\System\oOwlJWn.exe
  C:\Windows\System\oOwlJWn.exe
  2⤵
  PID:5372
- C:\Windows\System\GHlfWce.exe
  C:\Windows\System\GHlfWce.exe
  2⤵
  PID:5388
- C:\Windows\System\njIQYdi.exe
  C:\Windows\System\njIQYdi.exe
  2⤵
  PID:5452
- C:\Windows\System\kUceZMC.exe
  C:\Windows\System\kUceZMC.exe
  2⤵
  PID:5520
- C:\Windows\System\XvtugKi.exe
  C:\Windows\System\XvtugKi.exe
  2⤵
  PID:5560
- C:\Windows\System\pfFnBtn.exe
  C:\Windows\System\pfFnBtn.exe
  2⤵
  PID:5628
- C:\Windows\System\XzwqQPh.exe
  C:\Windows\System\XzwqQPh.exe
  2⤵
  PID:5664
- C:\Windows\System\aKAxNuP.exe
  C:\Windows\System\aKAxNuP.exe
  2⤵
  PID:5440
- C:\Windows\System\FyWZThj.exe
  C:\Windows\System\FyWZThj.exe
  2⤵
  PID:5508
- C:\Windows\System\XYsAmPK.exe
  C:\Windows\System\XYsAmPK.exe
  2⤵
  PID:5576
- C:\Windows\System\fBFDnHV.exe
  C:\Windows\System\fBFDnHV.exe
  2⤵
  PID:5640
- C:\Windows\System\vJgLIAy.exe
  C:\Windows\System\vJgLIAy.exe
  2⤵
  PID:5680
- C:\Windows\System\iJToWJb.exe
  C:\Windows\System\iJToWJb.exe
  2⤵
  PID:5712
- C:\Windows\System\czaEGNQ.exe
  C:\Windows\System\czaEGNQ.exe
  2⤵
  PID:5740
- C:\Windows\System\XEaexzH.exe
  C:\Windows\System\XEaexzH.exe
  2⤵
  PID:5804
- C:\Windows\System\kAWcGWf.exe
  C:\Windows\System\kAWcGWf.exe
  2⤵
  PID:5840
- C:\Windows\System\zbZRUyY.exe
  C:\Windows\System\zbZRUyY.exe
  2⤵
  PID:5880
- C:\Windows\System\DEtktSr.exe
  C:\Windows\System\DEtktSr.exe
  2⤵
  PID:5944
- C:\Windows\System\lpXYseJ.exe
  C:\Windows\System\lpXYseJ.exe
  2⤵
  PID:6012
- C:\Windows\System\NsvtiUD.exe
  C:\Windows\System\NsvtiUD.exe
  2⤵
  PID:5792
- C:\Windows\System\tGCwwiM.exe
  C:\Windows\System\tGCwwiM.exe
  2⤵
  PID:6076
- C:\Windows\System\WQzAhdE.exe
  C:\Windows\System\WQzAhdE.exe
  2⤵
  PID:5856
- C:\Windows\System\TRjDgEm.exe
  C:\Windows\System\TRjDgEm.exe
  2⤵
  PID:5924
- C:\Windows\System\WFffzYZ.exe
  C:\Windows\System\WFffzYZ.exe
  2⤵
  PID:5996
- C:\Windows\System\aXzBXtF.exe
  C:\Windows\System\aXzBXtF.exe
  2⤵
  PID:6136
- C:\Windows\System\eSyYfHg.exe
  C:\Windows\System\eSyYfHg.exe
  2⤵
  PID:6056
- C:\Windows\System\VQQhNeF.exe
  C:\Windows\System\VQQhNeF.exe
  2⤵
  PID:6124
- C:\Windows\System\EHPlVHy.exe
  C:\Windows\System\EHPlVHy.exe
  2⤵
  PID:5288
- C:\Windows\System\PJMYrCc.exe
  C:\Windows\System\PJMYrCc.exe
  2⤵
  PID:5340
- C:\Windows\System\viHdNsh.exe
  C:\Windows\System\viHdNsh.exe
  2⤵
  PID:5476
- C:\Windows\System\lInTMMM.exe
  C:\Windows\System\lInTMMM.exe
  2⤵
  PID:5612
- C:\Windows\System\ZcVHsBS.exe
  C:\Windows\System\ZcVHsBS.exe
  2⤵
  PID:4424
- C:\Windows\System\BeErteH.exe
  C:\Windows\System\BeErteH.exe
  2⤵
  PID:5436
- C:\Windows\System\ocXqvvr.exe
  C:\Windows\System\ocXqvvr.exe
  2⤵
  PID:5776
- C:\Windows\System\jqCyQee.exe
  C:\Windows\System\jqCyQee.exe
  2⤵
  PID:5276
- C:\Windows\System\qaBoRvM.exe
  C:\Windows\System\qaBoRvM.exe
  2⤵
  PID:5596
- C:\Windows\System\aSwRNXh.exe
  C:\Windows\System\aSwRNXh.exe
  2⤵
  PID:5408
- C:\Windows\System\aelxRjA.exe
  C:\Windows\System\aelxRjA.exe
  2⤵
  PID:5676
- C:\Windows\System\oBXMegX.exe
  C:\Windows\System\oBXMegX.exe
  2⤵
  PID:6072
- C:\Windows\System\YrjxOMO.exe
  C:\Windows\System\YrjxOMO.exe
  2⤵
  PID:5940
- C:\Windows\System\sjnJvxT.exe
  C:\Windows\System\sjnJvxT.exe
  2⤵
  PID:6092
- C:\Windows\System\KMwdmID.exe
  C:\Windows\System\KMwdmID.exe
  2⤵
  PID:5788
- C:\Windows\System\WCdcQrP.exe
  C:\Windows\System\WCdcQrP.exe
  2⤵
  PID:5964
- C:\Windows\System\FKujCgK.exe
  C:\Windows\System\FKujCgK.exe
  2⤵
  PID:5256
- C:\Windows\System\Ocdeogp.exe
  C:\Windows\System\Ocdeogp.exe
  2⤵
  PID:5556
- C:\Windows\System\rjSjDNa.exe
  C:\Windows\System\rjSjDNa.exe
  2⤵
  PID:4888
- C:\Windows\System\uFPZDrR.exe
  C:\Windows\System\uFPZDrR.exe
  2⤵
  PID:5980
- C:\Windows\System\zKWqbBu.exe
  C:\Windows\System\zKWqbBu.exe
  2⤵
  PID:6108
- C:\Windows\System\TOLdKzs.exe
  C:\Windows\System\TOLdKzs.exe
  2⤵
  PID:5708
- C:\Windows\System\RvKnGox.exe
  C:\Windows\System\RvKnGox.exe
  2⤵
  PID:5528
- C:\Windows\System\MbYVtQk.exe
  C:\Windows\System\MbYVtQk.exe
  2⤵
  PID:5736
- C:\Windows\System\LsLhiMV.exe
  C:\Windows\System\LsLhiMV.exe
  2⤵
  PID:5572
- C:\Windows\System\hIgyCZL.exe
  C:\Windows\System\hIgyCZL.exe
  2⤵
  PID:5728
- C:\Windows\System\SKPFboD.exe
  C:\Windows\System\SKPFboD.exe
  2⤵
  PID:5876
- C:\Windows\System\xGTuEuF.exe
  C:\Windows\System\xGTuEuF.exe
  2⤵
  PID:5732
- C:\Windows\System\CHFBxRX.exe
  C:\Windows\System\CHFBxRX.exe
  2⤵
  PID:5772
- C:\Windows\System\bYkvjDL.exe
  C:\Windows\System\bYkvjDL.exe
  2⤵
  PID:5892
- C:\Windows\System\srfwpTg.exe
  C:\Windows\System\srfwpTg.exe
  2⤵
  PID:5036
- C:\Windows\System\WPjZxeY.exe
  C:\Windows\System\WPjZxeY.exe
  2⤵
  PID:5912
- C:\Windows\System\zddlrrh.exe
  C:\Windows\System\zddlrrh.exe
  2⤵
  PID:4396
- C:\Windows\System\ZOtkTlH.exe
  C:\Windows\System\ZOtkTlH.exe
  2⤵
  PID:6156
- C:\Windows\System\pizBpwo.exe
  C:\Windows\System\pizBpwo.exe
  2⤵
  PID:6172
- C:\Windows\System\gytdySs.exe
  C:\Windows\System\gytdySs.exe
  2⤵
  PID:6188
- C:\Windows\System\sAKsZpI.exe
  C:\Windows\System\sAKsZpI.exe
  2⤵
  PID:6204
- C:\Windows\System\tWgSiCn.exe
  C:\Windows\System\tWgSiCn.exe
  2⤵
  PID:6220
- C:\Windows\System\ySrQrjB.exe
  C:\Windows\System\ySrQrjB.exe
  2⤵
  PID:6236
- C:\Windows\System\eKAtFcE.exe
  C:\Windows\System\eKAtFcE.exe
  2⤵
  PID:6256
- C:\Windows\System\leWLiyv.exe
  C:\Windows\System\leWLiyv.exe
  2⤵
  PID:6272
- C:\Windows\System\hMmIywx.exe
  C:\Windows\System\hMmIywx.exe
  2⤵
  PID:6288
- C:\Windows\System\soRhEKw.exe
  C:\Windows\System\soRhEKw.exe
  2⤵
  PID:6308
- C:\Windows\System\ADvjKhE.exe
  C:\Windows\System\ADvjKhE.exe
  2⤵
  PID:6324
- C:\Windows\System\AEGOeeS.exe
  C:\Windows\System\AEGOeeS.exe
  2⤵
  PID:6340
- C:\Windows\System\LJFOliY.exe
  C:\Windows\System\LJFOliY.exe
  2⤵
  PID:6356
- C:\Windows\System\xlmgYup.exe
  C:\Windows\System\xlmgYup.exe
  2⤵
  PID:6376
- C:\Windows\System\KLXSaEe.exe
  C:\Windows\System\KLXSaEe.exe
  2⤵
  PID:6392
- C:\Windows\System\LtlPelT.exe
  C:\Windows\System\LtlPelT.exe
  2⤵
  PID:6408
- C:\Windows\System\rQHSLYW.exe
  C:\Windows\System\rQHSLYW.exe
  2⤵
  PID:6424
- C:\Windows\System\rWluLWp.exe
  C:\Windows\System\rWluLWp.exe
  2⤵
  PID:6440
- C:\Windows\System\mdwBxGi.exe
  C:\Windows\System\mdwBxGi.exe
  2⤵
  PID:6456
- C:\Windows\System\dJmbNXN.exe
  C:\Windows\System\dJmbNXN.exe
  2⤵
  PID:6472
- C:\Windows\System\oLIYHTq.exe
  C:\Windows\System\oLIYHTq.exe
  2⤵
  PID:6492
- C:\Windows\System\KcdvMqq.exe
  C:\Windows\System\KcdvMqq.exe
  2⤵
  PID:6512
- C:\Windows\System\WYLfEuF.exe
  C:\Windows\System\WYLfEuF.exe
  2⤵
  PID:6532
- C:\Windows\System\NlqjIBk.exe
  C:\Windows\System\NlqjIBk.exe
  2⤵
  PID:6548
- C:\Windows\System\QLjPyVa.exe
  C:\Windows\System\QLjPyVa.exe
  2⤵
  PID:6568
- C:\Windows\System\NFRWSNK.exe
  C:\Windows\System\NFRWSNK.exe
  2⤵
  PID:6584
- C:\Windows\System\RoyLvqz.exe
  C:\Windows\System\RoyLvqz.exe
  2⤵
  PID:6608
- C:\Windows\System\esNKBxa.exe
  C:\Windows\System\esNKBxa.exe
  2⤵
  PID:6628
- C:\Windows\System\NkdkgwD.exe
  C:\Windows\System\NkdkgwD.exe
  2⤵
  PID:6644
- C:\Windows\System\jDsoXSP.exe
  C:\Windows\System\jDsoXSP.exe
  2⤵
  PID:6664
- C:\Windows\System\wNwEfmo.exe
  C:\Windows\System\wNwEfmo.exe
  2⤵
  PID:6680
- C:\Windows\System\LMKTVNU.exe
  C:\Windows\System\LMKTVNU.exe
  2⤵
  PID:6696
- C:\Windows\System\jRskRiz.exe
  C:\Windows\System\jRskRiz.exe
  2⤵
  PID:6712
- C:\Windows\System\JDszxYW.exe
  C:\Windows\System\JDszxYW.exe
  2⤵
  PID:6732
- C:\Windows\System\AwMknxB.exe
  C:\Windows\System\AwMknxB.exe
  2⤵
  PID:6752
- C:\Windows\System\EYellJU.exe
  C:\Windows\System\EYellJU.exe
  2⤵
  PID:6776
- C:\Windows\System\LdiKgCz.exe
  C:\Windows\System\LdiKgCz.exe
  2⤵
  PID:6796
- C:\Windows\System\lrnlTGB.exe
  C:\Windows\System\lrnlTGB.exe
  2⤵
  PID:6816
- C:\Windows\System\YrHTSUu.exe
  C:\Windows\System\YrHTSUu.exe
  2⤵
  PID:6832
- C:\Windows\System\Tejaqft.exe
  C:\Windows\System\Tejaqft.exe
  2⤵
  PID:6852
- C:\Windows\System\AdKjpJP.exe
  C:\Windows\System\AdKjpJP.exe
  2⤵
  PID:6872
- C:\Windows\System\rXhqjOV.exe
  C:\Windows\System\rXhqjOV.exe
  2⤵
  PID:6888
- C:\Windows\System\CJsKzrc.exe
  C:\Windows\System\CJsKzrc.exe
  2⤵
  PID:6908
- C:\Windows\System\YJQZOEc.exe
  C:\Windows\System\YJQZOEc.exe
  2⤵
  PID:6928
- C:\Windows\System\OEqZlwJ.exe
  C:\Windows\System\OEqZlwJ.exe
  2⤵
  PID:6944
- C:\Windows\System\UPFcldQ.exe
  C:\Windows\System\UPFcldQ.exe
  2⤵
  PID:6960
- C:\Windows\System\XsaZPFI.exe
  C:\Windows\System\XsaZPFI.exe
  2⤵
  PID:6976
- C:\Windows\System\ihtkfZX.exe
  C:\Windows\System\ihtkfZX.exe
  2⤵
  PID:6992
- C:\Windows\System\enMHlAg.exe
  C:\Windows\System\enMHlAg.exe
  2⤵
  PID:7008
- C:\Windows\System\eQiyymd.exe
  C:\Windows\System\eQiyymd.exe
  2⤵
  PID:7024
- C:\Windows\System\AYWAHwF.exe
  C:\Windows\System\AYWAHwF.exe
  2⤵
  PID:7040
- C:\Windows\System\MmTKPSu.exe
  C:\Windows\System\MmTKPSu.exe
  2⤵
  PID:7056
- C:\Windows\System\VyzGjFZ.exe
  C:\Windows\System\VyzGjFZ.exe
  2⤵
  PID:7072
- C:\Windows\System\KGgMwBT.exe
  C:\Windows\System\KGgMwBT.exe
  2⤵
  PID:7088
- C:\Windows\System\RAtEnzb.exe
  C:\Windows\System\RAtEnzb.exe
  2⤵
  PID:7104
- C:\Windows\System\DbCnUYf.exe
  C:\Windows\System\DbCnUYf.exe
  2⤵
  PID:7120
- C:\Windows\System\JrKaGwr.exe
  C:\Windows\System\JrKaGwr.exe
  2⤵
  PID:7144
- C:\Windows\System\MvVWIuJ.exe
  C:\Windows\System\MvVWIuJ.exe
  2⤵
  PID:7160
- C:\Windows\System\BEMUtMq.exe
  C:\Windows\System\BEMUtMq.exe
  2⤵
  PID:6024
- C:\Windows\System\gTOLbvJ.exe
  C:\Windows\System\gTOLbvJ.exe
  2⤵
  PID:7052
- C:\Windows\System\NmaudBG.exe
  C:\Windows\System\NmaudBG.exe
  2⤵
  PID:7136
- C:\Windows\System\gpFwlMA.exe
  C:\Windows\System\gpFwlMA.exe
  2⤵
  PID:5260
- C:\Windows\System\Uorfikr.exe
  C:\Windows\System\Uorfikr.exe
  2⤵
  PID:7152
- C:\Windows\System\YliEGCB.exe
  C:\Windows\System\YliEGCB.exe
  2⤵
  PID:6216
- C:\Windows\System\DyYEIqO.exe
  C:\Windows\System\DyYEIqO.exe
  2⤵
  PID:6252
- C:\Windows\System\zRFfKjf.exe
  C:\Windows\System\zRFfKjf.exe
  2⤵
  PID:6284
- C:\Windows\System\TmSuCxi.exe
  C:\Windows\System\TmSuCxi.exe
  2⤵
  PID:6336
- C:\Windows\System\NShXIEk.exe
  C:\Windows\System\NShXIEk.exe
  2⤵
  PID:6372
- C:\Windows\System\dYgrwaq.exe
  C:\Windows\System\dYgrwaq.exe
  2⤵
  PID:6452
- C:\Windows\System\JUlteDW.exe
  C:\Windows\System\JUlteDW.exe
  2⤵
  PID:6436
- C:\Windows\System\zdPQtKT.exe
  C:\Windows\System\zdPQtKT.exe
  2⤵
  PID:6468
- C:\Windows\System\SfPQTgm.exe
  C:\Windows\System\SfPQTgm.exe
  2⤵
  PID:6152
- C:\Windows\System\cVlbvmV.exe
  C:\Windows\System\cVlbvmV.exe
  2⤵
  PID:6556
- C:\Windows\System\UOoIOmp.exe
  C:\Windows\System\UOoIOmp.exe
  2⤵
  PID:6596
- C:\Windows\System\TKmLZBd.exe
  C:\Windows\System\TKmLZBd.exe
  2⤵
  PID:6576
- C:\Windows\System\aPVByER.exe
  C:\Windows\System\aPVByER.exe
  2⤵
  PID:6624
- C:\Windows\System\YboOLQL.exe
  C:\Windows\System\YboOLQL.exe
  2⤵
  PID:6704
- C:\Windows\System\GFfOkmn.exe
  C:\Windows\System\GFfOkmn.exe
  2⤵
  PID:6616
- C:\Windows\System\eSgiQjs.exe
  C:\Windows\System\eSgiQjs.exe
  2⤵
  PID:6688
- C:\Windows\System\RMGSxuG.exe
  C:\Windows\System\RMGSxuG.exe
  2⤵
  PID:6724
- C:\Windows\System\NXsiLdB.exe
  C:\Windows\System\NXsiLdB.exe
  2⤵
  PID:6764
- C:\Windows\System\CSKCUyR.exe
  C:\Windows\System\CSKCUyR.exe
  2⤵
  PID:6792
- C:\Windows\System\YyPflFr.exe
  C:\Windows\System\YyPflFr.exe
  2⤵
  PID:6860
- C:\Windows\System\OskbTaC.exe
  C:\Windows\System\OskbTaC.exe
  2⤵
  PID:6900
- C:\Windows\System\DGmnPUd.exe
  C:\Windows\System\DGmnPUd.exe
  2⤵
  PID:6848
- C:\Windows\System\hHZxADU.exe
  C:\Windows\System\hHZxADU.exe
  2⤵
  PID:6808
- C:\Windows\System\sHNjsIt.exe
  C:\Windows\System\sHNjsIt.exe
  2⤵
  PID:6920
- C:\Windows\System\piVRqPe.exe
  C:\Windows\System\piVRqPe.exe
  2⤵
  PID:6972
- C:\Windows\System\UEKcHXD.exe
  C:\Windows\System\UEKcHXD.exe
  2⤵
  PID:7004
- C:\Windows\System\WGyyPFk.exe
  C:\Windows\System\WGyyPFk.exe
  2⤵
  PID:7016
- C:\Windows\System\aeyridG.exe
  C:\Windows\System\aeyridG.exe
  2⤵
  PID:7096
- C:\Windows\System\SQZPyYc.exe
  C:\Windows\System\SQZPyYc.exe
  2⤵
  PID:7112
- C:\Windows\System\nvrIekb.exe
  C:\Windows\System\nvrIekb.exe
  2⤵
  PID:7156
- C:\Windows\System\inCMQSY.exe
  C:\Windows\System\inCMQSY.exe
  2⤵
  PID:6280
- C:\Windows\System\QCLlody.exe
  C:\Windows\System\QCLlody.exe
  2⤵
  PID:6508
- C:\Windows\System\xfGgmog.exe
  C:\Windows\System\xfGgmog.exe
  2⤵
  PID:6524
- C:\Windows\System\fyOzidx.exe
  C:\Windows\System\fyOzidx.exe
  2⤵
  PID:6676
- C:\Windows\System\UNqafXT.exe
  C:\Windows\System\UNqafXT.exe
  2⤵
  PID:6760
- C:\Windows\System\XqOanfc.exe
  C:\Windows\System\XqOanfc.exe
  2⤵
  PID:6936
- C:\Windows\System\VIutZDl.exe
  C:\Windows\System\VIutZDl.exe
  2⤵
  PID:5336
- C:\Windows\System\VLgIxOZ.exe
  C:\Windows\System\VLgIxOZ.exe
  2⤵
  PID:6940
- C:\Windows\System\pAPvQSp.exe
  C:\Windows\System\pAPvQSp.exe
  2⤵
  PID:6484
- C:\Windows\System\JgTbEhy.exe
  C:\Windows\System\JgTbEhy.exe
  2⤵
  PID:6968
- C:\Windows\System\jMMyArB.exe
  C:\Windows\System\jMMyArB.exe
  2⤵
  PID:6656
- C:\Windows\System\MBjskys.exe
  C:\Windows\System\MBjskys.exe
  2⤵
  PID:6880
- C:\Windows\System\equolbu.exe
  C:\Windows\System\equolbu.exe
  2⤵
  PID:6984
- C:\Windows\System\bfxcVvM.exe
  C:\Windows\System\bfxcVvM.exe
  2⤵
  PID:7068
- C:\Windows\System\FFXKykn.exe
  C:\Windows\System\FFXKykn.exe
  2⤵
  PID:6404
- C:\Windows\System\vOVRskd.exe
  C:\Windows\System\vOVRskd.exe
  2⤵
  PID:6828
- C:\Windows\System\YoSzpPS.exe
  C:\Windows\System\YoSzpPS.exe
  2⤵
  PID:6244
- C:\Windows\System\RrBJteq.exe
  C:\Windows\System\RrBJteq.exe
  2⤵
  PID:7048
- C:\Windows\System\jSstMzp.exe
  C:\Windows\System\jSstMzp.exe
  2⤵
  PID:6660
- C:\Windows\System\inRGMPA.exe
  C:\Windows\System\inRGMPA.exe
  2⤵
  PID:6740
- C:\Windows\System\KuwPNln.exe
  C:\Windows\System\KuwPNln.exe
  2⤵
  PID:6564
- C:\Windows\System\FCQeAyU.exe
  C:\Windows\System\FCQeAyU.exe
  2⤵
  PID:5492
- C:\Windows\System\eeqjPRy.exe
  C:\Windows\System\eeqjPRy.exe
  2⤵
  PID:6884
- C:\Windows\System\SwcuuaT.exe
  C:\Windows\System\SwcuuaT.exe
  2⤵
  PID:6672
- C:\Windows\System\uYmwnaA.exe
  C:\Windows\System\uYmwnaA.exe
  2⤵
  PID:5424
- C:\Windows\System\wFQVIRl.exe
  C:\Windows\System\wFQVIRl.exe
  2⤵
  PID:7180
- C:\Windows\System\eRNBLEG.exe
  C:\Windows\System\eRNBLEG.exe
  2⤵
  PID:7196
- C:\Windows\System\tDughpK.exe
  C:\Windows\System\tDughpK.exe
  2⤵
  PID:7212
- C:\Windows\System\fQpNhbP.exe
  C:\Windows\System\fQpNhbP.exe
  2⤵
  PID:7228
- C:\Windows\System\sBuyLzo.exe
  C:\Windows\System\sBuyLzo.exe
  2⤵
  PID:7244
- C:\Windows\System\srOPfov.exe
  C:\Windows\System\srOPfov.exe
  2⤵
  PID:7260
- C:\Windows\System\vXQVXLX.exe
  C:\Windows\System\vXQVXLX.exe
  2⤵
  PID:7276
- C:\Windows\System\jWLErbW.exe
  C:\Windows\System\jWLErbW.exe
  2⤵
  PID:7292
- C:\Windows\System\KSRfXki.exe
  C:\Windows\System\KSRfXki.exe
  2⤵
  PID:7308
- C:\Windows\System\EnsvOhA.exe
  C:\Windows\System\EnsvOhA.exe
  2⤵
  PID:7324
- C:\Windows\System\anephfc.exe
  C:\Windows\System\anephfc.exe
  2⤵
  PID:7340
- C:\Windows\System\DygXeVq.exe
  C:\Windows\System\DygXeVq.exe
  2⤵
  PID:7356
- C:\Windows\System\JyjrmxO.exe
  C:\Windows\System\JyjrmxO.exe
  2⤵
  PID:7372
- C:\Windows\System\WRBsCWM.exe
  C:\Windows\System\WRBsCWM.exe
  2⤵
  PID:7388
- C:\Windows\System\DBlXbjD.exe
  C:\Windows\System\DBlXbjD.exe
  2⤵
  PID:7404
- C:\Windows\System\jNHldwB.exe
  C:\Windows\System\jNHldwB.exe
  2⤵
  PID:7420
- C:\Windows\System\xQPgoyx.exe
  C:\Windows\System\xQPgoyx.exe
  2⤵
  PID:7436
- C:\Windows\System\NHpVuOv.exe
  C:\Windows\System\NHpVuOv.exe
  2⤵
  PID:7452
- C:\Windows\System\cXPscaw.exe
  C:\Windows\System\cXPscaw.exe
  2⤵
  PID:7468
- C:\Windows\System\VNQpUge.exe
  C:\Windows\System\VNQpUge.exe
  2⤵
  PID:7484
- C:\Windows\System\yTVHeRs.exe
  C:\Windows\System\yTVHeRs.exe
  2⤵
  PID:7500
- C:\Windows\System\WynZKoP.exe
  C:\Windows\System\WynZKoP.exe
  2⤵
  PID:7516
- C:\Windows\System\pDECjaM.exe
  C:\Windows\System\pDECjaM.exe
  2⤵
  PID:7532
- C:\Windows\System\aDQtxeK.exe
  C:\Windows\System\aDQtxeK.exe
  2⤵
  PID:7548
- C:\Windows\System\mROYFBy.exe
  C:\Windows\System\mROYFBy.exe
  2⤵
  PID:7564
- C:\Windows\System\nJbZtFI.exe
  C:\Windows\System\nJbZtFI.exe
  2⤵
  PID:7580
- C:\Windows\System\BjUoulQ.exe
  C:\Windows\System\BjUoulQ.exe
  2⤵
  PID:7596
- C:\Windows\System\Pupkgga.exe
  C:\Windows\System\Pupkgga.exe
  2⤵
  PID:7612
- C:\Windows\System\pRJNvhH.exe
  C:\Windows\System\pRJNvhH.exe
  2⤵
  PID:7628
- C:\Windows\System\dCMSIgw.exe
  C:\Windows\System\dCMSIgw.exe
  2⤵
  PID:7644
- C:\Windows\System\CcEBMqO.exe
  C:\Windows\System\CcEBMqO.exe
  2⤵
  PID:7660
- C:\Windows\System\CxhUWxj.exe
  C:\Windows\System\CxhUWxj.exe
  2⤵
  PID:7676
- C:\Windows\System\IblYrFq.exe
  C:\Windows\System\IblYrFq.exe
  2⤵
  PID:7692
- C:\Windows\System\zJUXKaP.exe
  C:\Windows\System\zJUXKaP.exe
  2⤵
  PID:7708
- C:\Windows\System\ZPPuvwZ.exe
  C:\Windows\System\ZPPuvwZ.exe
  2⤵
  PID:7724
- C:\Windows\System\PwdHIHK.exe
  C:\Windows\System\PwdHIHK.exe
  2⤵
  PID:7740
- C:\Windows\System\jCtbXMA.exe
  C:\Windows\System\jCtbXMA.exe
  2⤵
  PID:7756
- C:\Windows\System\sRcqire.exe
  C:\Windows\System\sRcqire.exe
  2⤵
  PID:7772
- C:\Windows\System\ZJBmJEi.exe
  C:\Windows\System\ZJBmJEi.exe
  2⤵
  PID:7788
- C:\Windows\System\BFwQCKD.exe
  C:\Windows\System\BFwQCKD.exe
  2⤵
  PID:7804
- C:\Windows\System\ZogojOB.exe
  C:\Windows\System\ZogojOB.exe
  2⤵
  PID:7820
- C:\Windows\System\LddtkQy.exe
  C:\Windows\System\LddtkQy.exe
  2⤵
  PID:7836
- C:\Windows\System\ZfXTqzL.exe
  C:\Windows\System\ZfXTqzL.exe
  2⤵
  PID:7852
- C:\Windows\System\ssvXlcb.exe
  C:\Windows\System\ssvXlcb.exe
  2⤵
  PID:7868
- C:\Windows\System\AiHKURJ.exe
  C:\Windows\System\AiHKURJ.exe
  2⤵
  PID:7884
- C:\Windows\System\DpPvpYY.exe
  C:\Windows\System\DpPvpYY.exe
  2⤵
  PID:7900
- C:\Windows\System\drPWKnh.exe
  C:\Windows\System\drPWKnh.exe
  2⤵
  PID:7916
- C:\Windows\System\VobGSnn.exe
  C:\Windows\System\VobGSnn.exe
  2⤵
  PID:7932
- C:\Windows\System\nGYIQpz.exe
  C:\Windows\System\nGYIQpz.exe
  2⤵
  PID:7948
- C:\Windows\System\upSDcMj.exe
  C:\Windows\System\upSDcMj.exe
  2⤵
  PID:7964
- C:\Windows\System\ottBaVG.exe
  C:\Windows\System\ottBaVG.exe
  2⤵
  PID:7980
- C:\Windows\System\mROUOCI.exe
  C:\Windows\System\mROUOCI.exe
  2⤵
  PID:7996
- C:\Windows\System\IsiuMMG.exe
  C:\Windows\System\IsiuMMG.exe
  2⤵
  PID:8012
- C:\Windows\System\wkANByG.exe
  C:\Windows\System\wkANByG.exe
  2⤵
  PID:8028
- C:\Windows\System\bYcdsBX.exe
  C:\Windows\System\bYcdsBX.exe
  2⤵
  PID:8044
- C:\Windows\System\IkwRWij.exe
  C:\Windows\System\IkwRWij.exe
  2⤵
  PID:8060
- C:\Windows\System\VCjeJtY.exe
  C:\Windows\System\VCjeJtY.exe
  2⤵
  PID:8076
- C:\Windows\System\OjXiDWe.exe
  C:\Windows\System\OjXiDWe.exe
  2⤵
  PID:8092
- C:\Windows\System\YPMqfYD.exe
  C:\Windows\System\YPMqfYD.exe
  2⤵
  PID:8108
- C:\Windows\System\AtEZCTC.exe
  C:\Windows\System\AtEZCTC.exe
  2⤵
  PID:8124
- C:\Windows\System\yavYrIA.exe
  C:\Windows\System\yavYrIA.exe
  2⤵
  PID:8140
- C:\Windows\System\hoPzaGC.exe
  C:\Windows\System\hoPzaGC.exe
  2⤵
  PID:8156
- C:\Windows\System\GRQqRpf.exe
  C:\Windows\System\GRQqRpf.exe
  2⤵
  PID:8172
- C:\Windows\System\lZsorQS.exe
  C:\Windows\System\lZsorQS.exe
  2⤵
  PID:8188
- C:\Windows\System\wolwIhU.exe
  C:\Windows\System\wolwIhU.exe
  2⤵
  PID:6540
- C:\Windows\System\EeMuoxs.exe
  C:\Windows\System\EeMuoxs.exe
  2⤵
  PID:7208
- C:\Windows\System\LbsTLpO.exe
  C:\Windows\System\LbsTLpO.exe
  2⤵
  PID:7236
- C:\Windows\System\PKrJsKF.exe
  C:\Windows\System\PKrJsKF.exe
  2⤵
  PID:7100
- C:\Windows\System\WEzHWbV.exe
  C:\Windows\System\WEzHWbV.exe
  2⤵
  PID:6604
- C:\Windows\System\YMclHog.exe
  C:\Windows\System\YMclHog.exe
  2⤵
  PID:7284
- C:\Windows\System\gGOAjxj.exe
  C:\Windows\System\gGOAjxj.exe
  2⤵
  PID:7336
- C:\Windows\System\lKOndxq.exe
  C:\Windows\System\lKOndxq.exe
  2⤵
  PID:7316
- C:\Windows\System\iFtsyLt.exe
  C:\Windows\System\iFtsyLt.exe
  2⤵
  PID:7364
- C:\Windows\System\zUdZLQe.exe
  C:\Windows\System\zUdZLQe.exe
  2⤵
  PID:7428
- C:\Windows\System\KUiAsua.exe
  C:\Windows\System\KUiAsua.exe
  2⤵
  PID:7412
- C:\Windows\System\jfKttNk.exe
  C:\Windows\System\jfKttNk.exe
  2⤵
  PID:7416
- C:\Windows\System\bEJQgSI.exe
  C:\Windows\System\bEJQgSI.exe
  2⤵
  PID:7524
- C:\Windows\System\wAsnWCc.exe
  C:\Windows\System\wAsnWCc.exe
  2⤵
  PID:7528
- C:\Windows\System\BVhXLUm.exe
  C:\Windows\System\BVhXLUm.exe
  2⤵
  PID:7588
- C:\Windows\System\YhtNNBK.exe
  C:\Windows\System\YhtNNBK.exe
  2⤵
  PID:7652
- C:\Windows\System\gpuKShs.exe
  C:\Windows\System\gpuKShs.exe
  2⤵
  PID:7716
- C:\Windows\System\gVshCNK.exe
  C:\Windows\System\gVshCNK.exe
  2⤵
  PID:7720
- C:\Windows\System\RqujDEY.exe
  C:\Windows\System\RqujDEY.exe
  2⤵
  PID:7604
- C:\Windows\System\MovsANX.exe
  C:\Windows\System\MovsANX.exe
  2⤵
  PID:7544
- C:\Windows\System\EHFeHuB.exe
  C:\Windows\System\EHFeHuB.exe
  2⤵
  PID:7848
- C:\Windows\System\zmwbkzG.exe
  C:\Windows\System\zmwbkzG.exe
  2⤵
  PID:7672
- C:\Windows\System\odLSUZf.exe
  C:\Windows\System\odLSUZf.exe
  2⤵
  PID:7944
- C:\Windows\System\RUJfmvw.exe
  C:\Windows\System\RUJfmvw.exe
  2⤵
  PID:7732
- C:\Windows\System\YwDQhiQ.exe
  C:\Windows\System\YwDQhiQ.exe
  2⤵
  PID:8036
- C:\Windows\System\UdYDucM.exe
  C:\Windows\System\UdYDucM.exe
  2⤵
  PID:8072
- C:\Windows\System\BnbvUcw.exe
  C:\Windows\System\BnbvUcw.exe
  2⤵
  PID:7924
- C:\Windows\System\drKrnOb.exe
  C:\Windows\System\drKrnOb.exe
  2⤵
  PID:7832
- C:\Windows\System\NysiKyA.exe
  C:\Windows\System\NysiKyA.exe
  2⤵
  PID:8136
- C:\Windows\System\ESaqRlC.exe
  C:\Windows\System\ESaqRlC.exe
  2⤵
  PID:7988
- C:\Windows\System\LsHGSNG.exe
  C:\Windows\System\LsHGSNG.exe
  2⤵
  PID:8088
- C:\Windows\System\DZhaVHR.exe
  C:\Windows\System\DZhaVHR.exe
  2⤵
  PID:8148
- C:\Windows\System\sDrPFJa.exe
  C:\Windows\System\sDrPFJa.exe
  2⤵
  PID:8168
- C:\Windows\System\xLbYHJd.exe
  C:\Windows\System\xLbYHJd.exe
  2⤵
  PID:6148
- C:\Windows\System\fxuWTfj.exe
  C:\Windows\System\fxuWTfj.exe
  2⤵
  PID:7332
- C:\Windows\System\CrKDLMI.exe
  C:\Windows\System\CrKDLMI.exe
  2⤵
  PID:7460
- C:\Windows\System\KsYKBIj.exe
  C:\Windows\System\KsYKBIj.exe
  2⤵
  PID:7224
- C:\Windows\System\juNfpLD.exe
  C:\Windows\System\juNfpLD.exe
  2⤵
  PID:7252
- C:\Windows\System\pNDpRNn.exe
  C:\Windows\System\pNDpRNn.exe
  2⤵
  PID:7556
- C:\Windows\System\rhnzVAQ.exe
  C:\Windows\System\rhnzVAQ.exe
  2⤵
  PID:7480
- C:\Windows\System\LXvgPfI.exe
  C:\Windows\System\LXvgPfI.exe
  2⤵
  PID:7620
- C:\Windows\System\MJwRssW.exe
  C:\Windows\System\MJwRssW.exe
  2⤵
  PID:7576
- C:\Windows\System\PIiMVni.exe
  C:\Windows\System\PIiMVni.exe
  2⤵
  PID:7608
- C:\Windows\System\hbJWCwF.exe
  C:\Windows\System\hbJWCwF.exe
  2⤵
  PID:7844
- C:\Windows\System\huZvGcY.exe
  C:\Windows\System\huZvGcY.exe
  2⤵
  PID:7940
- C:\Windows\System\arXrnvu.exe
  C:\Windows\System\arXrnvu.exe
  2⤵
  PID:8056
- C:\Windows\System\xCJglNX.exe
  C:\Windows\System\xCJglNX.exe
  2⤵
  PID:8008
- C:\Windows\System\XrrvZtT.exe
  C:\Windows\System\XrrvZtT.exe
  2⤵
  PID:7800
- C:\Windows\System\PtoOgDA.exe
  C:\Windows\System\PtoOgDA.exe
  2⤵
  PID:8020
- C:\Windows\System\YMhvgpc.exe
  C:\Windows\System\YMhvgpc.exe
  2⤵
  PID:8052
- C:\Windows\System\NSWxfnw.exe
  C:\Windows\System\NSWxfnw.exe
  2⤵
  PID:7272
- C:\Windows\System\vgDtKtV.exe
  C:\Windows\System\vgDtKtV.exe
  2⤵
  PID:8184
- C:\Windows\System\PzwfwJO.exe
  C:\Windows\System\PzwfwJO.exe
  2⤵
  PID:7348
- C:\Windows\System\rZPuzqV.exe
  C:\Windows\System\rZPuzqV.exe
  2⤵
  PID:7560
- C:\Windows\System\yQUMqGX.exe
  C:\Windows\System\yQUMqGX.exe
  2⤵
  PID:7476
- C:\Windows\System\DOJHZNB.exe
  C:\Windows\System\DOJHZNB.exe
  2⤵
  PID:7908
- C:\Windows\System\xmWUxfy.exe
  C:\Windows\System\xmWUxfy.exe
  2⤵
  PID:7688
- C:\Windows\System\xOraLpl.exe
  C:\Windows\System\xOraLpl.exe
  2⤵
  PID:7636
- C:\Windows\System\TUVUpAj.exe
  C:\Windows\System\TUVUpAj.exe
  2⤵
  PID:8084
- C:\Windows\System\mhylboZ.exe
  C:\Windows\System\mhylboZ.exe
  2⤵
  PID:8120
- C:\Windows\System\FFxZaXD.exe
  C:\Windows\System\FFxZaXD.exe
  2⤵
  PID:7448
- C:\Windows\System\uJGTYyC.exe
  C:\Windows\System\uJGTYyC.exe
  2⤵
  PID:7064
- C:\Windows\System\dVxWanW.exe
  C:\Windows\System\dVxWanW.exe
  2⤵
  PID:7816
- C:\Windows\System\UwfoQTP.exe
  C:\Windows\System\UwfoQTP.exe
  2⤵
  PID:7928
- C:\Windows\System\NawkIcq.exe
  C:\Windows\System\NawkIcq.exe
  2⤵
  PID:7684
- C:\Windows\System\FxDHdeE.exe
  C:\Windows\System\FxDHdeE.exe
  2⤵
  PID:8196
- C:\Windows\System\WIxcMDi.exe
  C:\Windows\System\WIxcMDi.exe
  2⤵
  PID:8216
- C:\Windows\System\QdjLvEb.exe
  C:\Windows\System\QdjLvEb.exe
  2⤵
  PID:8232
- C:\Windows\System\jilcXnD.exe
  C:\Windows\System\jilcXnD.exe
  2⤵
  PID:8248
- C:\Windows\System\OmfYWKe.exe
  C:\Windows\System\OmfYWKe.exe
  2⤵
  PID:8264
- C:\Windows\System\ovceLBN.exe
  C:\Windows\System\ovceLBN.exe
  2⤵
  PID:8284
- C:\Windows\System\zcAGZpc.exe
  C:\Windows\System\zcAGZpc.exe
  2⤵
  PID:8300
- C:\Windows\System\bIDHNBI.exe
  C:\Windows\System\bIDHNBI.exe
  2⤵
  PID:8320
- C:\Windows\System\xIWnhVl.exe
  C:\Windows\System\xIWnhVl.exe
  2⤵
  PID:8336
- C:\Windows\System\XKjAzrZ.exe
  C:\Windows\System\XKjAzrZ.exe
  2⤵
  PID:8352
- C:\Windows\System\dchYcog.exe
  C:\Windows\System\dchYcog.exe
  2⤵
  PID:8368
- C:\Windows\System\nMzcjbg.exe
  C:\Windows\System\nMzcjbg.exe
  2⤵
  PID:8384
- C:\Windows\System\QUAPiQI.exe
  C:\Windows\System\QUAPiQI.exe
  2⤵
  PID:8400
- C:\Windows\System\GfyaICD.exe
  C:\Windows\System\GfyaICD.exe
  2⤵
  PID:8416
- C:\Windows\System\EDQJbyp.exe
  C:\Windows\System\EDQJbyp.exe
  2⤵
  PID:8432
- C:\Windows\System\seSxfPC.exe
  C:\Windows\System\seSxfPC.exe
  2⤵
  PID:8452
- C:\Windows\System\aCmZXFc.exe
  C:\Windows\System\aCmZXFc.exe
  2⤵
  PID:8468
- C:\Windows\System\TtwLaNU.exe
  C:\Windows\System\TtwLaNU.exe
  2⤵
  PID:8484
- C:\Windows\System\XADgkZV.exe
  C:\Windows\System\XADgkZV.exe
  2⤵
  PID:8500
- C:\Windows\System\hGYlybc.exe
  C:\Windows\System\hGYlybc.exe
  2⤵
  PID:8516
- C:\Windows\System\FTWTOtl.exe
  C:\Windows\System\FTWTOtl.exe
  2⤵
  PID:8532
- C:\Windows\System\zzeVuIc.exe
  C:\Windows\System\zzeVuIc.exe
  2⤵
  PID:8548
- C:\Windows\System\EUPJNAk.exe
  C:\Windows\System\EUPJNAk.exe
  2⤵
  PID:8564
- C:\Windows\System\XtyVlVa.exe
  C:\Windows\System\XtyVlVa.exe
  2⤵
  PID:8580
- C:\Windows\System\kDSGgrh.exe
  C:\Windows\System\kDSGgrh.exe
  2⤵
  PID:8596
- C:\Windows\System\zgjzxFg.exe
  C:\Windows\System\zgjzxFg.exe
  2⤵
  PID:8612
- C:\Windows\System\cJlIWJc.exe
  C:\Windows\System\cJlIWJc.exe
  2⤵
  PID:8628
- C:\Windows\System\cnfTCjo.exe
  C:\Windows\System\cnfTCjo.exe
  2⤵
  PID:8644
- C:\Windows\System\NGGfltB.exe
  C:\Windows\System\NGGfltB.exe
  2⤵
  PID:8660
- C:\Windows\System\MDagyIU.exe
  C:\Windows\System\MDagyIU.exe
  2⤵
  PID:8676
- C:\Windows\System\PUFjpiN.exe
  C:\Windows\System\PUFjpiN.exe
  2⤵
  PID:8692
- C:\Windows\System\FMvkePj.exe
  C:\Windows\System\FMvkePj.exe
  2⤵
  PID:8708
- C:\Windows\System\RTuYmlS.exe
  C:\Windows\System\RTuYmlS.exe
  2⤵
  PID:8724
- C:\Windows\System\DhPothg.exe
  C:\Windows\System\DhPothg.exe
  2⤵
  PID:8740
- C:\Windows\System\iCuDhHO.exe
  C:\Windows\System\iCuDhHO.exe
  2⤵
  PID:8756
- C:\Windows\System\VyslodV.exe
  C:\Windows\System\VyslodV.exe
  2⤵
  PID:8772
- C:\Windows\System\IQbRoDl.exe
  C:\Windows\System\IQbRoDl.exe
  2⤵
  PID:8788
- C:\Windows\System\Ewibqrt.exe
  C:\Windows\System\Ewibqrt.exe
  2⤵
  PID:8804
- C:\Windows\System\QpRWtJn.exe
  C:\Windows\System\QpRWtJn.exe
  2⤵
  PID:8820
- C:\Windows\System\ymxdBJT.exe
  C:\Windows\System\ymxdBJT.exe
  2⤵
  PID:8836
- C:\Windows\System\YkwJIgB.exe
  C:\Windows\System\YkwJIgB.exe
  2⤵
  PID:8856
- C:\Windows\System\LmeTjGY.exe
  C:\Windows\System\LmeTjGY.exe
  2⤵
  PID:8876
- C:\Windows\System\jfWWSCu.exe
  C:\Windows\System\jfWWSCu.exe
  2⤵
  PID:8896
- C:\Windows\System\REHHyPp.exe
  C:\Windows\System\REHHyPp.exe
  2⤵
  PID:8912
- C:\Windows\System\SBBsUpw.exe
  C:\Windows\System\SBBsUpw.exe
  2⤵
  PID:8928
- C:\Windows\System\zskFQMT.exe
  C:\Windows\System\zskFQMT.exe
  2⤵
  PID:8944
- C:\Windows\System\FkfJFbd.exe
  C:\Windows\System\FkfJFbd.exe
  2⤵
  PID:8964
- C:\Windows\System\McCWjck.exe
  C:\Windows\System\McCWjck.exe
  2⤵
  PID:8980
- C:\Windows\System\GibHdvm.exe
  C:\Windows\System\GibHdvm.exe
  2⤵
  PID:8996
- C:\Windows\System\UAxyIzO.exe
  C:\Windows\System\UAxyIzO.exe
  2⤵
  PID:9012
- C:\Windows\System\BMrQNyG.exe
  C:\Windows\System\BMrQNyG.exe
  2⤵
  PID:9028
- C:\Windows\System\lZZMdCZ.exe
  C:\Windows\System\lZZMdCZ.exe
  2⤵
  PID:9048
- C:\Windows\System\oiUJUFc.exe
  C:\Windows\System\oiUJUFc.exe
  2⤵
  PID:9068
- C:\Windows\System\wqjbIgV.exe
  C:\Windows\System\wqjbIgV.exe
  2⤵
  PID:9088
- C:\Windows\System\YDPdQFq.exe
  C:\Windows\System\YDPdQFq.exe
  2⤵
  PID:9104
- C:\Windows\System\zfcEkkM.exe
  C:\Windows\System\zfcEkkM.exe
  2⤵
  PID:9124
- C:\Windows\System\SkmafJK.exe
  C:\Windows\System\SkmafJK.exe
  2⤵
  PID:9144
- C:\Windows\System\DZIkyfC.exe
  C:\Windows\System\DZIkyfC.exe
  2⤵
  PID:9164
- C:\Windows\System\xJGbPDx.exe
  C:\Windows\System\xJGbPDx.exe
  2⤵
  PID:9180
- C:\Windows\System\IHwaDHE.exe
  C:\Windows\System\IHwaDHE.exe
  2⤵
  PID:9196
- C:\Windows\System\fQrSuxe.exe
  C:\Windows\System\fQrSuxe.exe
  2⤵
  PID:7896
- C:\Windows\System\UPqZsjL.exe
  C:\Windows\System\UPqZsjL.exe
  2⤵
  PID:8132
- C:\Windows\System\puBbLyi.exe
  C:\Windows\System\puBbLyi.exe
  2⤵
  PID:8244
- C:\Windows\System\jCNBnqx.exe
  C:\Windows\System\jCNBnqx.exe
  2⤵
  PID:8276
- C:\Windows\System\xTjAEhR.exe
  C:\Windows\System\xTjAEhR.exe
  2⤵
  PID:8256
- C:\Windows\System\maDCwRS.exe
  C:\Windows\System\maDCwRS.exe
  2⤵
  PID:7304
- C:\Windows\System\zAqjhdm.exe
  C:\Windows\System\zAqjhdm.exe
  2⤵
  PID:8312
- C:\Windows\System\YTepMAA.exe
  C:\Windows\System\YTepMAA.exe
  2⤵
  PID:8376
- C:\Windows\System\VwhhLro.exe
  C:\Windows\System\VwhhLro.exe
  2⤵
  PID:8360
- C:\Windows\System\zULcJVM.exe
  C:\Windows\System\zULcJVM.exe
  2⤵
  PID:8424
- C:\Windows\System\vwTxqRZ.exe
  C:\Windows\System\vwTxqRZ.exe
  2⤵
  PID:8480
- C:\Windows\System\NjAXrBz.exe
  C:\Windows\System\NjAXrBz.exe
  2⤵
  PID:8464
- C:\Windows\System\zSYZYCW.exe
  C:\Windows\System\zSYZYCW.exe
  2⤵
  PID:8540
- C:\Windows\System\WxDSBAY.exe
  C:\Windows\System\WxDSBAY.exe
  2⤵
  PID:8604
- C:\Windows\System\QeLVNOv.exe
  C:\Windows\System\QeLVNOv.exe
  2⤵
  PID:8592
- C:\Windows\System\KcNEHpq.exe
  C:\Windows\System\KcNEHpq.exe
  2⤵
  PID:8652
- C:\Windows\System\wJjplGV.exe
  C:\Windows\System\wJjplGV.exe
  2⤵
  PID:8700
- C:\Windows\System\vETVuJn.exe
  C:\Windows\System\vETVuJn.exe
  2⤵
  PID:8684
- C:\Windows\System\PEysOVz.exe
  C:\Windows\System\PEysOVz.exe
  2⤵
  PID:8768
- C:\Windows\System\CPxCgnN.exe
  C:\Windows\System\CPxCgnN.exe
  2⤵
  PID:8784
- C:\Windows\System\LdEcxtj.exe
  C:\Windows\System\LdEcxtj.exe
  2⤵
  PID:8864
- C:\Windows\System\qNQBsdU.exe
  C:\Windows\System\qNQBsdU.exe
  2⤵
  PID:8780
- C:\Windows\System\AlSOyLi.exe
  C:\Windows\System\AlSOyLi.exe
  2⤵
  PID:8936
- C:\Windows\System\xPMfeSZ.exe
  C:\Windows\System\xPMfeSZ.exe
  2⤵
  PID:9004
- C:\Windows\System\ApuYKSw.exe
  C:\Windows\System\ApuYKSw.exe
  2⤵
  PID:9044
- C:\Windows\System\ZDScdIf.exe
  C:\Windows\System\ZDScdIf.exe
  2⤵
  PID:9112
- C:\Windows\System\lSNTqDC.exe
  C:\Windows\System\lSNTqDC.exe
  2⤵
  PID:9156
- C:\Windows\System\IxGEvXg.exe
  C:\Windows\System\IxGEvXg.exe
  2⤵
  PID:8204
- C:\Windows\System\ngUnYjl.exe
  C:\Windows\System\ngUnYjl.exe
  2⤵
  PID:8884
- C:\Windows\System\leVGyNv.exe
  C:\Windows\System\leVGyNv.exe
  2⤵
  PID:7976
- C:\Windows\System\IMqibEW.exe
  C:\Windows\System\IMqibEW.exe
  2⤵
  PID:8892
- C:\Windows\System\CtSsrZC.exe
  C:\Windows\System\CtSsrZC.exe
  2⤵
  PID:8924
- C:\Windows\System\XrFTsPj.exe
  C:\Windows\System\XrFTsPj.exe
  2⤵
  PID:8292
- C:\Windows\System\UdlRKIs.exe
  C:\Windows\System\UdlRKIs.exe
  2⤵
  PID:9208
- C:\Windows\System\OtmEOuj.exe
  C:\Windows\System\OtmEOuj.exe
  2⤵
  PID:8228
- C:\Windows\System\gGmvSUo.exe
  C:\Windows\System\gGmvSUo.exe
  2⤵
  PID:9204
- C:\Windows\System\NCdtpGN.exe
  C:\Windows\System\NCdtpGN.exe
  2⤵
  PID:9096
- C:\Windows\System\HJbrHqC.exe
  C:\Windows\System\HJbrHqC.exe
  2⤵
  PID:8328
- C:\Windows\System\vlPOTVZ.exe
  C:\Windows\System\vlPOTVZ.exe
  2⤵
  PID:8364
- C:\Windows\System\TyXnAqV.exe
  C:\Windows\System\TyXnAqV.exe
  2⤵
  PID:8444
- C:\Windows\System\tSwoxRA.exe
  C:\Windows\System\tSwoxRA.exe
  2⤵
  PID:8492
- C:\Windows\System\bqwpRxy.exe
  C:\Windows\System\bqwpRxy.exe
  2⤵
  PID:8668
- C:\Windows\System\YnsQXkV.exe
  C:\Windows\System\YnsQXkV.exe
  2⤵
  PID:8800
- C:\Windows\System\bOYZajC.exe
  C:\Windows\System\bOYZajC.exe
  2⤵
  PID:8748
- C:\Windows\System\GOXcCed.exe
  C:\Windows\System\GOXcCed.exe
  2⤵
  PID:8560
- C:\Windows\System\kpJkAYP.exe
  C:\Windows\System\kpJkAYP.exe
  2⤵
  PID:8624
- C:\Windows\System\anREZfz.exe
  C:\Windows\System\anREZfz.exe
  2⤵
  PID:8848
- C:\Windows\System\cwNnavU.exe
  C:\Windows\System\cwNnavU.exe
  2⤵
  PID:9084
- C:\Windows\System\noRutGe.exe
  C:\Windows\System\noRutGe.exe
  2⤵
  PID:9188
- C:\Windows\System\tEjuNHa.exe
  C:\Windows\System\tEjuNHa.exe
  2⤵
  PID:8104
- C:\Windows\System\mocuOFC.exe
  C:\Windows\System\mocuOFC.exe
  2⤵
  PID:8920
- C:\Windows\System\SApclDt.exe
  C:\Windows\System\SApclDt.exe
  2⤵
  PID:8888
- C:\Windows\System\ObZiYSq.exe
  C:\Windows\System\ObZiYSq.exe
  2⤵
  PID:9176
- C:\Windows\System\sCiJHLo.exe
  C:\Windows\System\sCiJHLo.exe
  2⤵
  PID:9100
- C:\Windows\System\IRZpLKQ.exe
  C:\Windows\System\IRZpLKQ.exe
  2⤵
  PID:9056
- C:\Windows\System\jBPoIlB.exe
  C:\Windows\System\jBPoIlB.exe
  2⤵
  PID:8408
- C:\Windows\System\pYQNgrz.exe
  C:\Windows\System\pYQNgrz.exe
  2⤵
  PID:8736
- C:\Windows\System\uUbmgeu.exe
  C:\Windows\System\uUbmgeu.exe
  2⤵
  PID:8588
- C:\Windows\System\xydadZV.exe
  C:\Windows\System\xydadZV.exe
  2⤵
  PID:8832
- C:\Windows\System\agAGGjG.exe
  C:\Windows\System\agAGGjG.exe
  2⤵
  PID:8844
- C:\Windows\System\zMCBxKh.exe
  C:\Windows\System\zMCBxKh.exe
  2⤵
  PID:9136
- C:\Windows\System\sHedOAa.exe
  C:\Windows\System\sHedOAa.exe
  2⤵
  PID:9140
- C:\Windows\System\KtJeeso.exe
  C:\Windows\System\KtJeeso.exe
  2⤵
  PID:7204
- C:\Windows\System\aXnqUnH.exe
  C:\Windows\System\aXnqUnH.exe
  2⤵
  PID:7668
- C:\Windows\System\FjPWOef.exe
  C:\Windows\System\FjPWOef.exe
  2⤵
  PID:9080
- C:\Windows\System\RMHMnvy.exe
  C:\Windows\System\RMHMnvy.exe
  2⤵
  PID:8224
- C:\Windows\System\WHrmmmL.exe
  C:\Windows\System\WHrmmmL.exe
  2⤵
  PID:8872
- C:\Windows\System\iqVYAyE.exe
  C:\Windows\System\iqVYAyE.exe
  2⤵
  PID:8908
- C:\Windows\System\tPqAkUJ.exe
  C:\Windows\System\tPqAkUJ.exe
  2⤵
  PID:9224
- C:\Windows\System\PJraXce.exe
  C:\Windows\System\PJraXce.exe
  2⤵
  PID:9244
- C:\Windows\System\SwGcmgk.exe
  C:\Windows\System\SwGcmgk.exe
  2⤵
  PID:9260
- C:\Windows\System\DSQxfqH.exe
  C:\Windows\System\DSQxfqH.exe
  2⤵
  PID:9276
- C:\Windows\System\Zvtrcez.exe
  C:\Windows\System\Zvtrcez.exe
  2⤵
  PID:9292
- C:\Windows\System\VTSZQdK.exe
  C:\Windows\System\VTSZQdK.exe
  2⤵
  PID:9308
- C:\Windows\System\bbeLAin.exe
  C:\Windows\System\bbeLAin.exe
  2⤵
  PID:9324
- C:\Windows\System\QQqaMoC.exe
  C:\Windows\System\QQqaMoC.exe
  2⤵
  PID:9344
- C:\Windows\System\bzGbEgW.exe
  C:\Windows\System\bzGbEgW.exe
  2⤵
  PID:9364
- C:\Windows\System\tYVJmjr.exe
  C:\Windows\System\tYVJmjr.exe
  2⤵
  PID:9380
- C:\Windows\System\kdjsWaK.exe
  C:\Windows\System\kdjsWaK.exe
  2⤵
  PID:9396
- C:\Windows\System\xlzvIHL.exe
  C:\Windows\System\xlzvIHL.exe
  2⤵
  PID:9412
- C:\Windows\System\uqogXex.exe
  C:\Windows\System\uqogXex.exe
  2⤵
  PID:9428
- C:\Windows\System\ycsIRIo.exe
  C:\Windows\System\ycsIRIo.exe
  2⤵
  PID:9444
- C:\Windows\System\WnIjGwS.exe
  C:\Windows\System\WnIjGwS.exe
  2⤵
  PID:9460
- C:\Windows\System\AZqBvmQ.exe
  C:\Windows\System\AZqBvmQ.exe
  2⤵
  PID:9476
- C:\Windows\System\bbvLsSN.exe
  C:\Windows\System\bbvLsSN.exe
  2⤵
  PID:9504
- C:\Windows\System\uCSJdgo.exe
  C:\Windows\System\uCSJdgo.exe
  2⤵
  PID:9520
- C:\Windows\System\OmLqIYs.exe
  C:\Windows\System\OmLqIYs.exe
  2⤵
  PID:9536
- C:\Windows\System\YTLKfoB.exe
  C:\Windows\System\YTLKfoB.exe
  2⤵
  PID:9552
- C:\Windows\System\IjdjqZD.exe
  C:\Windows\System\IjdjqZD.exe
  2⤵
  PID:9568
- C:\Windows\System\uNaGlNp.exe
  C:\Windows\System\uNaGlNp.exe
  2⤵
  PID:9584
- C:\Windows\System\iXucXBi.exe
  C:\Windows\System\iXucXBi.exe
  2⤵
  PID:9600
- C:\Windows\System\VLNRdby.exe
  C:\Windows\System\VLNRdby.exe
  2⤵
  PID:9616
- C:\Windows\System\FbpZcgn.exe
  C:\Windows\System\FbpZcgn.exe
  2⤵
  PID:9632
- C:\Windows\System\tcyuqML.exe
  C:\Windows\System\tcyuqML.exe
  2⤵
  PID:9648
- C:\Windows\System\tbeeHFL.exe
  C:\Windows\System\tbeeHFL.exe
  2⤵
  PID:9664
- C:\Windows\System\HbVluwa.exe
  C:\Windows\System\HbVluwa.exe
  2⤵
  PID:9680
- C:\Windows\System\eglbxrS.exe
  C:\Windows\System\eglbxrS.exe
  2⤵
  PID:9700
- C:\Windows\System\vtYJsVt.exe
  C:\Windows\System\vtYJsVt.exe
  2⤵
  PID:9716
- C:\Windows\System\MVmxgKP.exe
  C:\Windows\System\MVmxgKP.exe
  2⤵
  PID:9732
- C:\Windows\System\gEOLJQJ.exe
  C:\Windows\System\gEOLJQJ.exe
  2⤵
  PID:9748
- C:\Windows\System\EQJRxju.exe
  C:\Windows\System\EQJRxju.exe
  2⤵
  PID:9764
- C:\Windows\System\NhgMIpt.exe
  C:\Windows\System\NhgMIpt.exe
  2⤵
  PID:9780
- C:\Windows\System\lqbWPqM.exe
  C:\Windows\System\lqbWPqM.exe
  2⤵
  PID:9796
- C:\Windows\System\UkDZFwf.exe
  C:\Windows\System\UkDZFwf.exe
  2⤵
  PID:9812
- C:\Windows\System\HFDOuKy.exe
  C:\Windows\System\HFDOuKy.exe
  2⤵
  PID:9828
- C:\Windows\System\FqDaMwt.exe
  C:\Windows\System\FqDaMwt.exe
  2⤵
  PID:9844
- C:\Windows\System\AnDqtrc.exe
  C:\Windows\System\AnDqtrc.exe
  2⤵
  PID:9860
- C:\Windows\System\AzCWLbm.exe
  C:\Windows\System\AzCWLbm.exe
  2⤵
  PID:9876
- C:\Windows\System\NenUJso.exe
  C:\Windows\System\NenUJso.exe
  2⤵
  PID:9892
- C:\Windows\System\idCGFkG.exe
  C:\Windows\System\idCGFkG.exe
  2⤵
  PID:9908
- C:\Windows\System\PAODATs.exe
  C:\Windows\System\PAODATs.exe
  2⤵
  PID:9924
- C:\Windows\System\yHrmAgS.exe
  C:\Windows\System\yHrmAgS.exe
  2⤵
  PID:9940
- C:\Windows\System\tPnqBhp.exe
  C:\Windows\System\tPnqBhp.exe
  2⤵
  PID:9956
- C:\Windows\System\yvWTzGu.exe
  C:\Windows\System\yvWTzGu.exe
  2⤵
  PID:9972
- C:\Windows\System\WHMXARQ.exe
  C:\Windows\System\WHMXARQ.exe
  2⤵
  PID:9988
- C:\Windows\System\NAjwOyS.exe
  C:\Windows\System\NAjwOyS.exe
  2⤵
  PID:10004
- C:\Windows\System\SqcBAVR.exe
  C:\Windows\System\SqcBAVR.exe
  2⤵
  PID:10020
- C:\Windows\System\hthhaUm.exe
  C:\Windows\System\hthhaUm.exe
  2⤵
  PID:10036
- C:\Windows\System\BPZTRUB.exe
  C:\Windows\System\BPZTRUB.exe
  2⤵
  PID:10052
- C:\Windows\System\gtZcnEc.exe
  C:\Windows\System\gtZcnEc.exe
  2⤵
  PID:10068
- C:\Windows\System\kmhiwza.exe
  C:\Windows\System\kmhiwza.exe
  2⤵
  PID:10084
- C:\Windows\System\OcWsFRI.exe
  C:\Windows\System\OcWsFRI.exe
  2⤵
  PID:10100
- C:\Windows\System\ddWPDXq.exe
  C:\Windows\System\ddWPDXq.exe
  2⤵
  PID:10116
- C:\Windows\System\aGelYME.exe
  C:\Windows\System\aGelYME.exe
  2⤵
  PID:10132
- C:\Windows\System\LLuxJjK.exe
  C:\Windows\System\LLuxJjK.exe
  2⤵
  PID:10148
- C:\Windows\System\TydkxQu.exe
  C:\Windows\System\TydkxQu.exe
  2⤵
  PID:10164
- C:\Windows\System\YXNfotv.exe
  C:\Windows\System\YXNfotv.exe
  2⤵
  PID:10180
- C:\Windows\System\XWWbDUY.exe
  C:\Windows\System\XWWbDUY.exe
  2⤵
  PID:10200
- C:\Windows\System\dqtLmCL.exe
  C:\Windows\System\dqtLmCL.exe
  2⤵
  PID:10216
- C:\Windows\System\eYoWQsP.exe
  C:\Windows\System\eYoWQsP.exe
  2⤵
  PID:10232
- C:\Windows\System\GeelLGm.exe
  C:\Windows\System\GeelLGm.exe
  2⤵
  PID:8296
- C:\Windows\System\qOSNtlj.exe
  C:\Windows\System\qOSNtlj.exe
  2⤵
  PID:8764
- C:\Windows\System\rWGINDY.exe
  C:\Windows\System\rWGINDY.exe
  2⤵
  PID:9220
- C:\Windows\System\FbykFHy.exe
  C:\Windows\System\FbykFHy.exe
  2⤵
  PID:9252
- C:\Windows\System\TxdjqSb.exe
  C:\Windows\System\TxdjqSb.exe
  2⤵
  PID:9332
- C:\Windows\System\SIeVDUU.exe
  C:\Windows\System\SIeVDUU.exe
  2⤵
  PID:9376
- C:\Windows\System\imPwtsJ.exe
  C:\Windows\System\imPwtsJ.exe
  2⤵
  PID:9436
- C:\Windows\System\mEYrgaq.exe
  C:\Windows\System\mEYrgaq.exe
  2⤵
  PID:9356
- C:\Windows\System\CZgdnns.exe
  C:\Windows\System\CZgdnns.exe
  2⤵
  PID:9484
- C:\Windows\System\IxftkVR.exe
  C:\Windows\System\IxftkVR.exe
  2⤵
  PID:9456
- C:\Windows\System\XOMcpuT.exe
  C:\Windows\System\XOMcpuT.exe
  2⤵
  PID:9388
- C:\Windows\System\uMtuuoK.exe
  C:\Windows\System\uMtuuoK.exe
  2⤵
  PID:9516
- C:\Windows\System\hFlgChq.exe
  C:\Windows\System\hFlgChq.exe
  2⤵
  PID:9580
- C:\Windows\System\ziJaayp.exe
  C:\Windows\System\ziJaayp.exe
  2⤵
  PID:9644
- C:\Windows\System\NEsNlQq.exe
  C:\Windows\System\NEsNlQq.exe
  2⤵
  PID:9708
- C:\Windows\System\YqtKiwo.exe
  C:\Windows\System\YqtKiwo.exe
  2⤵
  PID:9692
- C:\Windows\System\zZLlvjs.exe
  C:\Windows\System\zZLlvjs.exe
  2⤵
  PID:9656
- C:\Windows\System\IctpmjX.exe
  C:\Windows\System\IctpmjX.exe
  2⤵
  PID:9744
- C:\Windows\System\PUhukEs.exe
  C:\Windows\System\PUhukEs.exe
  2⤵
  PID:9760
- C:\Windows\System\sTeedZk.exe
  C:\Windows\System\sTeedZk.exe
  2⤵
  PID:9804
- C:\Windows\System\NsynVkh.exe
  C:\Windows\System\NsynVkh.exe
  2⤵
  PID:9820
- C:\Windows\System\KqrHVkm.exe
  C:\Windows\System\KqrHVkm.exe
  2⤵
  PID:9824
- C:\Windows\System\htmLFjj.exe
  C:\Windows\System\htmLFjj.exe
  2⤵
  PID:9900
- C:\Windows\System\uDpALCc.exe
  C:\Windows\System\uDpALCc.exe
  2⤵
  PID:9932
- C:\Windows\System\RrEYxFk.exe
  C:\Windows\System\RrEYxFk.exe
  2⤵
  PID:9964
- C:\Windows\System\vVSTOWh.exe
  C:\Windows\System\vVSTOWh.exe
  2⤵
  PID:9996
- C:\Windows\System\zaTRyyv.exe
  C:\Windows\System\zaTRyyv.exe
  2⤵
  PID:10032
- C:\Windows\System\CLgDgtz.exe
  C:\Windows\System\CLgDgtz.exe
  2⤵
  PID:10076
- C:\Windows\System\viLgzQd.exe
  C:\Windows\System\viLgzQd.exe
  2⤵
  PID:10128
- C:\Windows\System\orMlFXY.exe
  C:\Windows\System\orMlFXY.exe
  2⤵
  PID:10108
- C:\Windows\System\CWsaXzk.exe
  C:\Windows\System\CWsaXzk.exe
  2⤵
  PID:10160
- C:\Windows\System\uUfCzCm.exe
  C:\Windows\System\uUfCzCm.exe
  2⤵
  PID:10176
- C:\Windows\System\aEfqzyN.exe
  C:\Windows\System\aEfqzyN.exe
  2⤵
  PID:10208
- C:\Windows\System\hrRYseS.exe
  C:\Windows\System\hrRYseS.exe
  2⤵
  PID:10212
- C:\Windows\System\OwJtDAl.exe
  C:\Windows\System\OwJtDAl.exe
  2⤵
  PID:8212
- C:\Windows\System\fnoXkDb.exe
  C:\Windows\System\fnoXkDb.exe
  2⤵
  PID:9468
- C:\Windows\System\gPsfPVa.exe
  C:\Windows\System\gPsfPVa.exe
  2⤵
  PID:9304
- C:\Windows\System\MFzrDmv.exe
  C:\Windows\System\MFzrDmv.exe
  2⤵
  PID:9392
- C:\Windows\System\HNhZJFE.exe
  C:\Windows\System\HNhZJFE.exe
  2⤵
  PID:9288
- C:\Windows\System\CxqjRgW.exe
  C:\Windows\System\CxqjRgW.exe
  2⤵
  PID:9564
- C:\Windows\System\ymmIFSG.exe
  C:\Windows\System\ymmIFSG.exe
  2⤵
  PID:9548
- C:\Windows\System\DoNIeGR.exe
  C:\Windows\System\DoNIeGR.exe
  2⤵
  PID:9788
- C:\Windows\System\CdvXZiI.exe
  C:\Windows\System\CdvXZiI.exe
  2⤵
  PID:9792
- C:\Windows\System\ZBuywTR.exe
  C:\Windows\System\ZBuywTR.exe
  2⤵
  PID:9984
- C:\Windows\System\JWBUBVS.exe
  C:\Windows\System\JWBUBVS.exe
  2⤵
  PID:9628
- C:\Windows\System\DJltvxd.exe
  C:\Windows\System\DJltvxd.exe
  2⤵
  PID:9840
- C:\Windows\System\dnXAkrw.exe
  C:\Windows\System\dnXAkrw.exe
  2⤵
  PID:9888
- C:\Windows\System\uAlbiTN.exe
  C:\Windows\System\uAlbiTN.exe
  2⤵
  PID:10028
- C:\Windows\System\RIBHAEl.exe
  C:\Windows\System\RIBHAEl.exe
  2⤵
  PID:10048
- C:\Windows\System\NJMxWSY.exe
  C:\Windows\System\NJMxWSY.exe
  2⤵
  PID:10172
- C:\Windows\System\hwynVRi.exe
  C:\Windows\System\hwynVRi.exe
  2⤵
  PID:9372
- C:\Windows\System\TMKXXRI.exe
  C:\Windows\System\TMKXXRI.exe
  2⤵
  PID:10144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BfJIStL.exe

Filesize
3.1MB

MD5
2bd742bdb1c2d8abae909440fbcbdb6d

SHA1
a0f63dc9863abd8a3ca2f74f65bd4a9ab0c5a6c8

SHA256
8c91cda5e2ae3c997f9952b0a30bfc9816ad31a1eb482f099ff5a5df4be445a8

SHA512
25669bde919981e9d756091c64ffc148e0e057634f7e7bddd45a0bebee21363c305e529a7b6d930dad5110922b7820414102d62ebb6882664cefae221b5debd3

Download Submit
C:\Windows\system\EXBaOJX.exe

Filesize
3.1MB

MD5
f205a7166d9d753b263f893ed2f6a5ae

SHA1
2db4c3dba15eae4d78a222737fc07973f9f7cfd0

SHA256
15ed53a744b1659cef81c6b281701338668bb376269713b2e2df0a135ae03949

SHA512
ca17ce8058cf4bb1b588622cd539f59b049d97e11aab04ede95aba75e9381b5e944b4ee67d6793a51c5c766566dfc9f51a5aa9e8e56a417e6fa6e8bcf7e97599

Download Submit
C:\Windows\system\EsDqNVO.exe

Filesize
3.1MB

MD5
8391f4aa738f9613ef93f818b6d46f0f

SHA1
62670029f44d7bdf9e4fa621aec5538c02b42ab8

SHA256
960c3aa6e616155e6810dec16e2b051459d914949c6acf60140aede638ced563

SHA512
1de04479090c4284bc84fd686fae4043204cd83728415993544a5628553d460a53a24bfeaba8947d1ac7e89e21ad70b4bc8e18b7f080d437b91dbad9ccb3e973

Download Submit
C:\Windows\system\FOjmilQ.exe

Filesize
3.1MB

MD5
64b880abb6c220b79376b48d6f37dfd9

SHA1
5b85ca579736a8c930c5b39aa9aeb5c4f203c2a7

SHA256
f1ca7264035fc5f5c81ba1909b2bd136247b2cde80c7d65b07139b53a80ad842

SHA512
e4475e4f903939a3d4ed512fdaa611a23f7d351e6eb0f563b55b5f1b61e8341a2099ad4d1f80d922c108c8b12db4256a2ef6545562dad4fbbf36e98a28c89f23

Download Submit
C:\Windows\system\GFKRaGk.exe

Filesize
3.1MB

MD5
e53413dcc6ee6a611470348ec7782abd

SHA1
adf2b1b2aabc316a5ac958ca77d6e59a847f2dd4

SHA256
7bb99b69007abaabe59f7e4c51d93621f505090f31a151c654f536682fd9444b

SHA512
3694cbb8a74d6e4040da61636ae5065201d65602886e66809ce117bf0cf56c6b57c4ba6fad201228e0c1919ac5298c0f5c523d6b208db24bac3ee61005464b07

Download Submit
C:\Windows\system\IeZUZsD.exe

Filesize
3.1MB

MD5
5ef305eda1144920f1c7cd02fd6a3235

SHA1
16dea839b6149f0e9ec54732e3b4d7beb61af85a

SHA256
1a9de7abc8d8b9d6efd993e1ed5f31c9e0577a017542fb32e62dede6b5ed0d73

SHA512
c6aca24ad38465fc2db5013e6ae93ea992daa1ea4dfdaa91a41a6992f1eb53e4eb8fdc72d286cfd97f3eb72bfdc823ce1f5c20618ce3cda560f8dc8fc2af4a9f

Download Submit
C:\Windows\system\MLUiant.exe

Filesize
3.1MB

MD5
20de9d762e4e25baece79a18bc2b0a42

SHA1
6a9ceb7fc0fa8524ebec507ad2a0677c22135b8c

SHA256
e385b7e1278715ae637dc8baef914a6cf99718c04788730500d212003860e6b4

SHA512
e1a2c0b372f0a7d3a8c0fd927a212a9234f5573f9197ac879fb1e7f4b2e3c6fee32258acf08641b098af11272fdba9733e9d46881fc5135b58512c14f871af2e

Download Submit
C:\Windows\system\VJnhpas.exe

Filesize
3.1MB

MD5
fd9f09c6c8f37dea832074cac65a0cba

SHA1
a831371535a99f8fc1172b57b8bb26eb86fc9f6f

SHA256
348db1e213f1e018c4bb72ff91c6306b8e699cb6ce19e9209dc52338886763d2

SHA512
a793114fe36bd405f4d3d4118c0a029f8c08ef2764ef23811443b1d22b8a508904a8dbf1ebd66b5014b5d45ded6e1675d413b5ef147d5ac9062ff677c7d4d06b

Download Submit
C:\Windows\system\YHzMapK.exe

Filesize
3.1MB

MD5
388c1dd0f0c353f36bf1ba7cc58008bc

SHA1
d68b511f948103f12099857045fd633c57a4c5ed

SHA256
5ef6b1d25ea2dc5103fd0216baedcfe478320d0d821a9af6cc013587822dd7f0

SHA512
7163fddaccc316b503f7fa2ff30e70204ab40857a9ca87a01a0f1773a5281763eefbec9d60e9d3a6be86d5874657cd1358cbad532d2c74ac601f93046343364d

Download Submit
C:\Windows\system\adIiDNy.exe

Filesize
3.1MB

MD5
e518cd5fb64062705fb80e8bcd577162

SHA1
18c49778be78c81f36b7de33f4baed678dc71c5b

SHA256
3f71926275dcda28e9f611d60476aa85a5d2dd02ee4e57fd29f5e1bfea50f07f

SHA512
55be7bcc825eff5af659f144dda8de58b80611d9ea3deb0d46ebb518b8a73ae7b44be8a25122b61a2ad4e87653053cd96934a91cfcd349e910583dedd38c2092

Download Submit
C:\Windows\system\cVRpiJC.exe

Filesize
3.1MB

MD5
04d36b1a4c3bbda056f235e24f4f28aa

SHA1
fc48a6010f3c91f184b0e67fee1042ed6ffb0cdf

SHA256
682f2356e161cff6708fb4983605c0c5b1442ecd15ff87ba80b0fb13f0500729

SHA512
c789acaf5b7f0fb820522a6dc06cf06371d8eb1a1b5603f0864b9019129e9306ac7d6f92e9d7f083ad12463a66c9316ae3214ace0c746e0bba180064246ea645

Download Submit
C:\Windows\system\ctkdVLR.exe

Filesize
3.1MB

MD5
da9bc4fb11ba8c96e35d0816e9cc7b86

SHA1
bf64049dce463cd9dab8ba2c94d11918ba232a2e

SHA256
040d28f31ed2261479e8419409c560e2ef86c1901c96585dcbc0bf86261ed28f

SHA512
d96c23a9db09462622b7de368a83bf06855cada99526f0079a45d738956d46fecddcf2c51f06b78b74512de9c4961501bd5a666b5322bc88e5ee2de325759f75

Download Submit
C:\Windows\system\lgvgitT.exe

Filesize
3.1MB

MD5
078de75ae1ace87af3b7334cbdb4c107

SHA1
1aa4c61e294b0effe84f61abc230f21daa9ab571

SHA256
d3708c856f235841fd6efb0daeca46ae177e8c4104c16ca73ff0277399631797

SHA512
4e9eb934b42127b150fe16c3c6ec2cc15a2969f8a652900c1b608c092fe1fb55d2093ab29ee31a05115fd674904ef5b41271387173acdf07006c15449e1df74a

Download Submit
C:\Windows\system\pVhrZdS.exe

Filesize
3.1MB

MD5
2e64cc844f352c0be0b67c120320de1b

SHA1
346501bc4a5366503a20afab980a624bd50261b8

SHA256
85255491c588ea3ac33f4e49dda015dff46a0308396c13c5b792b1fcd71f24cc

SHA512
647b1b909ed6bfc9c1c7f21bc07bb299e53f16042c6eb1a7d9859140d7f832965c6fa48586db7ca76ff586ce65005429c177c315fb55e0209a22a5abf9e188a7

Download Submit
C:\Windows\system\ucHhhSg.exe

Filesize
3.1MB

MD5
92716fb7503a5ff2203dcd9cfb9f5114

SHA1
9f6ebdaaf364653c622d27d32d39109180cb2c40

SHA256
73a0fc19f1de10f210314636a57a0acef42ba14f2f41b8225f55654d0917229d

SHA512
5f41f9b20d311d11e2b8c663841820655130d3c310fc4cabae5b215bc71e084458798bff3cb725eca5679fe4237a22fa897932ac9a084be31c98137ab43fa0c6

Download Submit
C:\Windows\system\wdJEcpD.exe

Filesize
3.1MB

MD5
27733921ff282169ab8f7f30053c3065

SHA1
b64f7e58731c066dd89481dc675bc3fa68058e43

SHA256
1b93507fd63f9ad49567b9e4ed4c7df138c580b853f80e9b0ede4753accd2bc9

SHA512
198cacf6c1d8eae4a3d36b23bcb28f206b79c26a849f0566beaef8c0e669da1bbc9dc9748423291a06235db85b45e21ac3da783c109bc426f139f931497af538

Download Submit
C:\Windows\system\zhaSLpd.exe

Filesize
3.1MB

MD5
a8da16c574dc6fca78083e159ccf5331

SHA1
96568f9b64cfe630a3da043294a203525a285f52

SHA256
53c2fa068e5d4d8bc162292276803b87f7a1122e208a3dc343a6edc42af7d18a

SHA512
77f668d6119a02e2f2042ab5d0f52b677e5136f286cb3768f61bfd797687f39785ea201848b953b5960500c5496bc950cc109a87969294cf79f7c47f963151e9

Download Submit
\Windows\system\AvjDwFo.exe

Filesize
3.1MB

MD5
e2b98149dd1a015458b0576167b5a1ad

SHA1
b855f0d98dcc710993749e2255f7b26ce13030f4

SHA256
ecfbc3b7a97e83081071a438866b8140b926a81e97245a3cd1b9fb2a0f969b82

SHA512
9a64740de772d0688074d09e5f2f5bd9a10e5f55d218cb2c323f3e661bb4a0b7b63361fec94b5ee2d8e5f577498db804a954dcff56ca68ff746f71ce3d1cf6aa

Download Submit
\Windows\system\BnaKgro.exe

Filesize
3.1MB

MD5
7338f0d15b432080fc15d0de44be03c2

SHA1
1f420f82acbcf21fb6979de1df493ed8f007aa85

SHA256
1e375c44df11560fe1bd8efbbfccedccd39ddb6e01474c169bc1784ea880122f

SHA512
186c618f7bdc5c15208a574991c90897f29be21e53db09a47f5b3f89010ba4e643f6f74400ef0edc7e78031533868418fdbc51922f2407f432385dcff9f96001

Download Submit
\Windows\system\FYHdlCG.exe

Filesize
3.1MB

MD5
5db9d571f2b464de3588d749283a1e3d

SHA1
a8766cea772f2eae225296038015d5c6d454619e

SHA256
2c31fe229a64ad254ba188de1fd0ab49274383e81ea0fc4770962790ae41646d

SHA512
87e127485f62f9c1beb82fc172ff8d5ffbcadb1c3cdc02671201a0cc9e61fb641871d15bf3f5795b5b2b6ba9395707f234ca7ac9ac059a0d3b64753c7bfc596a

Download Submit
\Windows\system\GpWfoNb.exe

Filesize
3.1MB

MD5
ae08d9297813104dde190abea6302510

SHA1
1b33eecf053118c972cdfda122a8dcc0ea93b10b

SHA256
47d5e4fddb2d2475b9ec733bc18ffb344d50a855fc2b8785cf11e749d02c5046

SHA512
27e1acc673f9d2d2cf0a25991bc6685bff0365fde045d19d81d81bf5a4c938536add5d321dd4a6536d31312cde0218867e0f0fd967cae1478c1e8cf28aaedc5c

Download Submit
\Windows\system\IzQsmzG.exe

Filesize
3.1MB

MD5
80d25123dcfcaaf19c1f454d5ce5f07f

SHA1
401addcbdc42ed19203bd9b4ca0a3950c97d743d

SHA256
70a88949fdaaf3fb5a12a5eb77eb17e1655d6523f24cca9c2ccff4c1ff8ba338

SHA512
dbdbcaacc592627b75ddf96cfb6bbabed52e7aceba302604a16b8a6048590a4d5f72dea35e3149a921d0e86f56bfd685b1f16b0682f30636c87127ecf02c3b7c

Download Submit
\Windows\system\LwMGVvB.exe

Filesize
3.1MB

MD5
7b3cc946bfff5f952b56489382e07d7b

SHA1
34dd40a10f743a215b9d2dac85f97cb5686184fa

SHA256
166d25384b8a08f22651315d9f3c134723e8d0ba92bb69c2e621a0cd0f37be96

SHA512
ed9d4cd3efa78272e8c9054ef91a9df9754d060407e4b6fb13c1a6d3be1261a18739680a05f78514aa99162f13ccfd03c7ee05b53a2c24a4acbcd1ca384775c7

Download Submit
\Windows\system\PeXUniM.exe

Filesize
3.1MB

MD5
e331251ad695e55514b2af1838d4641f

SHA1
19bb52fc9e52c7ea7156b7373a64d7ca1db2881f

SHA256
8c47c9415ef4daa6077eeea79dfd254b5711ffdad95559f20b64eaa22149c401

SHA512
8bef45f327e772c222e5dadd58b1bbece796a73fc404fcd37631568a73323c71c742ca3654c0968125ab24fdc284c3527a41e94d652be6559b55bdc2ea110418

Download Submit
\Windows\system\QCevkSW.exe

Filesize
3.1MB

MD5
6e9866718f6eea205c259605b2fe70c5

SHA1
09620cf3f2a7a9dcd33b4dc0205f51ca58b6ff5d

SHA256
20048cf6cb76c86d233f98b671913bfa2a8e85db4ee6128d46fa432a77ba08f7

SHA512
a913588e538acb9c3f5367018dcc177677698b2f3660e2f598d377aacb09bae6c917bfdba53544daaf1553e5616a8af2289eaf61a515eb04fc65202084b45c3d

Download Submit
\Windows\system\QVKggGy.exe

Filesize
3.1MB

MD5
2670f6fd900b0e08a8fc3f016117e80b

SHA1
fd86409004f0d5cb0b849b7ac78785bd322d8bc2

SHA256
b4252f9dfe598b3eb976d218ef7cf3ff1e2d3e7100b6a1d57ae8b1c700352bb2

SHA512
3a948e5a4ae890cbbda07c501015dbf595729eeb8c9cf6cf067f709a9dea80ebd618222f54480a349a7bc85455796f5213154919e96e9423bdd6fb964401a2bf

Download Submit
\Windows\system\QslTrYE.exe

Filesize
3.1MB

MD5
15c7bab69d231b9f17a2bf4ab0341922

SHA1
15d744383b57e2185910729025705874086421dc

SHA256
3b9a54166018c48990d0c301840328daf8c03f0787f48bf19755b4ac18b23668

SHA512
760a26027e32bb884639d23a86a26c44a5bae3a3d6ea89eb47f56461fcf15415db21e3c2c718c9b33e3310fdfdd7fc9a93623a1be5bb8fe8dcb574968aef760e

Download Submit
\Windows\system\crOVQcG.exe

Filesize
3.1MB

MD5
ebbc5b986af2b5bafaf61a4e9cc2d720

SHA1
b80c0b46e23e1342d22b4729c90bea3e099f90ed

SHA256
6b045b7820993071389f2aa1e777b4edb32490fd0a38a0eaa8bd154094e55d43

SHA512
a1d98e2359b4c2c5b4c5693872d44d6c5b9fd6f5b77073d5a8bf0003bd299c66b39b39a4e89f116895464854e5c830e6d22c9fea8f2d9fceeb1316f29f2673af

Download Submit
\Windows\system\eHWQMnS.exe

Filesize
3.1MB

MD5
ac4285d3e5b32742c30fabd77365b1ec

SHA1
37f749f8783ad20fcaab8de87cf78bc28d007f86

SHA256
0592460a2c9bae0bb7d2e8420e3edcffa10d9b80af0722af16b182a9ec9725bd

SHA512
4d0cc1d223da3391e2e14c445e68f1e7e2ebb33cda0b120c8e93dbff65fb9f183c9c02bb5197f3c81345f4a25a8c1a7d37eb2c557b89e85955164610215cef92

Download Submit
\Windows\system\ovXsnwG.exe

Filesize
3.1MB

MD5
6b3b1d1e279d61a50d317999ff106b3e

SHA1
8775f8183ab6ea02e08d98be49e8cb307e9e536d

SHA256
a76464c0f6f89402ed0df15ca7f63a79861568e8a26db8148f2b3c7faa3daf15

SHA512
7c932d6fd6d430d5a65562436838ac6ad27afedc882abb0a4559efd5dd7a82eb4fd1172f578c013f1075d5acfb5c3bf1285176867b22b3d8e8e21ab85fb75e27

Download Submit
\Windows\system\qdfjrqO.exe

Filesize
3.1MB

MD5
0fe267b19dd68dcaaef778b25691877a

SHA1
0c709266b7ec26a93b63dc4b45a3e08cbc5c72b0

SHA256
1bbf4caab5854c240cddb9b53708716f41cb13d1a26a7df3e361c7c09d045221

SHA512
89890b77e3884cccf14c9e180c679eb82e7c7c554d8fd81fc607c0e5cef4f9e222639daccfc2af3210601887e735639f0a57adddd6a481a1616e08cc5a6b2a93

Download Submit
\Windows\system\rgfYWxe.exe

Filesize
3.1MB

MD5
f2826baec48ef061e445171569aa2217

SHA1
52406e43c4316bdd4ff3c2a1022d5490b792fc66

SHA256
c08ce3f3ab64af64c4c85ff876a92694034f20668091d02de7eb5f4082cf3e11

SHA512
e3d352688c815f50df38fa84e8a061347f3d083632b058447ebc3be12e67f9497370a3c15f0919f44f321c03ab9f537052cdf7c59dbf81f903eae9ea24e06cba

Download Submit
\Windows\system\wYevmBe.exe

Filesize
3.1MB

MD5
09bec056bc7e90aa61b6e303060151b8

SHA1
5c3bc81f576c2dce132c88eac36adffa086e396a

SHA256
e816d467c1cfb6e29b2cdeaa996af9caab683bc50ad8425f077c0b52b3be8828

SHA512
19c04b34f76f37b7400a69a96f197a578a24b51ec252620f8fd7344b59a9e7293adf650336c1675892102f3ac94b1a7f88f6517a2cd614f13ecd928d92fb5e36

Download Submit
memory/380-78-0x000000013F930000-0x000000013FD26000-memory.dmp

Filesize
4.0MB

Download
memory/380-6273-0x000000013F930000-0x000000013FD26000-memory.dmp

Filesize
4.0MB

Download
memory/2104-93-0x000000013FB30000-0x000000013FF26000-memory.dmp

Filesize
4.0MB

Download
memory/2104-121-0x0000000003270000-0x0000000003666000-memory.dmp

Filesize
4.0MB

Download
memory/2104-101-0x000000013FD40000-0x0000000140136000-memory.dmp

Filesize
4.0MB

Download
memory/2104-6352-0x000000013F710000-0x000000013FB06000-memory.dmp

Filesize
4.0MB

Download
memory/2104-110-0x0000000003270000-0x0000000003666000-memory.dmp

Filesize
4.0MB

Download
memory/2104-151-0x000000013FBE0000-0x000000013FFD6000-memory.dmp

Filesize
4.0MB

Download
memory/2104-142-0x000000013F220000-0x000000013F616000-memory.dmp

Filesize
4.0MB

Download
memory/2104-1-0x000000013F710000-0x000000013FB06000-memory.dmp

Filesize
4.0MB

Download
memory/2104-85-0x0000000003270000-0x0000000003666000-memory.dmp

Filesize
4.0MB

Download
memory/2104-163-0x0000000003270000-0x0000000003666000-memory.dmp

Filesize
4.0MB

Download
memory/2104-129-0x0000000003270000-0x0000000003666000-memory.dmp

Filesize
4.0MB

Download
memory/2104-153-0x0000000003270000-0x0000000003666000-memory.dmp

Filesize
4.0MB

Download
memory/2104-10-0x0000000003010000-0x0000000003406000-memory.dmp

Filesize
4.0MB

Download
memory/2104-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2104-145-0x000000013FDF0000-0x00000001401E6000-memory.dmp

Filesize
4.0MB

Download
memory/2108-161-0x000000013FD90000-0x0000000140186000-memory.dmp

Filesize
4.0MB

Download
memory/2344-17-0x000000013F8C0000-0x000000013FCB6000-memory.dmp

Filesize
4.0MB

Download
memory/2600-6297-0x000000013F220000-0x000000013F616000-memory.dmp

Filesize
4.0MB

Download
memory/2600-144-0x000000013F220000-0x000000013F616000-memory.dmp

Filesize
4.0MB

Download
memory/2660-6275-0x000000013F3F0000-0x000000013F7E6000-memory.dmp

Filesize
4.0MB

Download
memory/2660-90-0x000000013F3F0000-0x000000013F7E6000-memory.dmp

Filesize
4.0MB

Download
memory/2672-127-0x000000013F7B0000-0x000000013FBA6000-memory.dmp

Filesize
4.0MB

Download
memory/2672-6282-0x000000013F7B0000-0x000000013FBA6000-memory.dmp

Filesize
4.0MB

Download
memory/2676-100-0x000000013FB30000-0x000000013FF26000-memory.dmp

Filesize
4.0MB

Download
memory/2676-6293-0x000000013FB30000-0x000000013FF26000-memory.dmp

Filesize
4.0MB

Download
memory/2768-107-0x000000013FD40000-0x0000000140136000-memory.dmp

Filesize
4.0MB

Download
memory/2768-6281-0x000000013FD40000-0x0000000140136000-memory.dmp

Filesize
4.0MB

Download
memory/2876-141-0x000000013F9A0000-0x000000013FD96000-memory.dmp

Filesize
4.0MB

Download
memory/2876-6292-0x000000013F9A0000-0x000000013FD96000-memory.dmp

Filesize
4.0MB

Download
memory/2956-117-0x000000013F750000-0x000000013FB46000-memory.dmp

Filesize
4.0MB

Download
memory/2956-6285-0x000000013F750000-0x000000013FB46000-memory.dmp

Filesize
4.0MB

Download
memory/3052-150-0x000000013FDF0000-0x00000001401E6000-memory.dmp

Filesize
4.0MB

Download
memory/3052-6349-0x000000013FDF0000-0x00000001401E6000-memory.dmp

Filesize
4.0MB

Download
memory/3060-68-0x000007FEF5950000-0x000007FEF62ED000-memory.dmp

Filesize
9.6MB

Download
memory/3060-18-0x000007FEF5C0E000-0x000007FEF5C0F000-memory.dmp

Filesize
4KB

Download
memory/3060-208-0x000000001B780000-0x000000001BA62000-memory.dmp

Filesize
2.9MB

Download
memory/3060-209-0x0000000002240000-0x0000000002248000-memory.dmp

Filesize
32KB

Download
memory/3060-326-0x000007FEF5950000-0x000007FEF62ED000-memory.dmp

Filesize
9.6MB

Download