xmrig | 5f7e8b8a4c56fef23d0a4c8be6de6cdcc4d7ad9b67d5cf95d7a1e5d1eb98607c

Analysis

max time kernel
116s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21-07-2024 15:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e333d9ba49bb8218c1bda76f9620ecc0N.exe
Size

1.4MB
MD5

e333d9ba49bb8218c1bda76f9620ecc0
SHA1

4707b31b037cf2fd898dcfa00f6b8d298141f2d0
SHA256

5f7e8b8a4c56fef23d0a4c8be6de6cdcc4d7ad9b67d5cf95d7a1e5d1eb98607c
SHA512

0a48705f9f205a620e327282790d679521cc96aa5620df7d993881f1ca031cffbfc4779ed6c2fc085170013d68867d86a6d6496ec4cce0533edcd2be1d103b01
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkiYQu50hCoolSncMKe0KXbrQP8YLOqz7E7:Lz071uv4BPMkiYF2KeJ+8wPY

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 25 IoCs

miner

resource	yara_rule
behavioral1/memory/2440-16-0x000000013F7A0000-0x000000013FB92000-memory.dmp	xmrig
behavioral1/memory/2700-84-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	xmrig
behavioral1/memory/2676-87-0x000000013F180000-0x000000013F572000-memory.dmp	xmrig
behavioral1/memory/2360-99-0x000000013F5A0000-0x000000013F992000-memory.dmp	xmrig
behavioral1/memory/2252-97-0x000000013FA80000-0x000000013FE72000-memory.dmp	xmrig
behavioral1/memory/1980-94-0x000000013FDE0000-0x00000001401D2000-memory.dmp	xmrig
behavioral1/memory/2668-82-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	xmrig
behavioral1/memory/2468-81-0x0000000003080000-0x0000000003472000-memory.dmp	xmrig
behavioral1/memory/2624-80-0x000000013F710000-0x000000013FB02000-memory.dmp	xmrig
behavioral1/memory/2792-78-0x000000013F930000-0x000000013FD22000-memory.dmp	xmrig
behavioral1/memory/2652-76-0x000000013FDB0000-0x00000001401A2000-memory.dmp	xmrig
behavioral1/memory/2892-71-0x000000013F920000-0x000000013FD12000-memory.dmp	xmrig
behavioral1/memory/2780-70-0x000000013FD10000-0x0000000140102000-memory.dmp	xmrig
behavioral1/memory/2440-1823-0x000000013F7A0000-0x000000013FB92000-memory.dmp	xmrig
behavioral1/memory/2624-1924-0x000000013F710000-0x000000013FB02000-memory.dmp	xmrig
behavioral1/memory/2676-1923-0x000000013F180000-0x000000013F572000-memory.dmp	xmrig
behavioral1/memory/2892-1925-0x000000013F920000-0x000000013FD12000-memory.dmp	xmrig
behavioral1/memory/2252-1921-0x000000013FA80000-0x000000013FE72000-memory.dmp	xmrig
behavioral1/memory/2792-1890-0x000000013F930000-0x000000013FD22000-memory.dmp	xmrig
behavioral1/memory/2652-1888-0x000000013FDB0000-0x00000001401A2000-memory.dmp	xmrig
behavioral1/memory/2668-1880-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	xmrig
behavioral1/memory/2700-2599-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	xmrig
behavioral1/memory/1980-2731-0x000000013FDE0000-0x00000001401D2000-memory.dmp	xmrig
behavioral1/memory/2360-2862-0x000000013F5A0000-0x000000013F992000-memory.dmp	xmrig
behavioral1/memory/2780-2874-0x000000013FD10000-0x0000000140102000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2084	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2440	AkgJnvS.exe
2780	yzfNfzE.exe
2892	dvIvMFg.exe
2652	oTJFbAN.exe
2792	ODDDrMt.exe
2624	dyrrjdL.exe
2668	WuaREFG.exe
2700	fEXDmRZ.exe
2676	IHcRtAM.exe
1980	OqKgOYu.exe
2252	KAnevVm.exe
2360	jryXYzP.exe
2728	LtNZmHk.exe
2964	GlyUexG.exe
808	kUJNZJx.exe
2988	NWECGLC.exe
1116	rjrlTRM.exe
3004	TmvxkAn.exe
2380	tJLMwqS.exe
2312	KJNCJKx.exe
2036	ftpPByR.exe
2420	MKiiKYu.exe
1684	uaIlZIR.exe
1020	XhhDhGD.exe
1972	AZnGqQf.exe
2208	pxyCflt.exe
2284	eXcvKuu.exe
2196	mMZHtNM.exe
2172	OsjQWBc.exe
1936	OXMSiep.exe
1768	rcUnIuy.exe
584	rQrsNOo.exe
1488	Tqwgsmb.exe
1696	SpFgYfQ.exe
1864	zGTkiNu.exe
824	WkSzpaF.exe
1780	qvyMvbm.exe
1200	QLzxfeq.exe
1688	SvtHYHH.exe
604	trcgKYo.exe
856	NswcuPy.exe
2568	fXRXShy.exe
864	OHmOxPf.exe
760	jlJHXRK.exe
2548	NnIOaXQ.exe
2912	AtgRxhU.exe
2392	sOztcRS.exe
2052	vultMji.exe
1872	lrknndJ.exe
1600	jjDuhij.exe
1708	pJWIkhu.exe
2840	ZHbaIMf.exe
2752	QzLZMvY.exe
2772	TnamKlQ.exe
2148	ZTFhcXj.exe
2684	dvRrGAn.exe
2184	KpXoQEI.exe
2788	DMjxsfq.exe
2696	jYpXhMb.exe
1400	aFFrdRO.exe
2560	EOccTMo.exe
2940	SfsRoWI.exe
2864	THVYodV.exe
2724	UPYHXqk.exe

Loads dropped DLL 64 IoCs

pid	Process
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2468-0-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	upx
behavioral1/files/0x000c000000014968-3.dat	upx
behavioral1/files/0x0008000000018f6e-13.dat	upx
behavioral1/files/0x001000000000558f-20.dat	upx
behavioral1/memory/2440-16-0x000000013F7A0000-0x000000013FB92000-memory.dmp	upx
behavioral1/files/0x0007000000018f84-25.dat	upx
behavioral1/files/0x0006000000018f8c-33.dat	upx
behavioral1/files/0x002a000000018f08-36.dat	upx
behavioral1/files/0x0006000000018f8e-41.dat	upx
behavioral1/files/0x0008000000018f90-45.dat	upx
behavioral1/files/0x0008000000018f94-50.dat	upx
behavioral1/files/0x0006000000018fb9-53.dat	upx
behavioral1/files/0x000500000001a201-66.dat	upx
behavioral1/memory/2700-84-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	upx
behavioral1/files/0x000500000001a25a-105.dat	upx
behavioral1/files/0x000500000001a288-122.dat	upx
behavioral1/files/0x000500000001a2a3-142.dat	upx
behavioral1/files/0x000500000001a2eb-174.dat	upx
behavioral1/files/0x000500000001a2ef-178.dat	upx
behavioral1/files/0x000500000001a2dd-170.dat	upx
behavioral1/files/0x000500000001a2ce-166.dat	upx
behavioral1/files/0x000500000001a2c7-162.dat	upx
behavioral1/files/0x000500000001a2be-158.dat	upx
behavioral1/files/0x000500000001a2ba-154.dat	upx
behavioral1/files/0x000500000001a2b7-150.dat	upx
behavioral1/files/0x000500000001a2ac-146.dat	upx
behavioral1/files/0x000500000001a2a1-139.dat	upx
behavioral1/files/0x000500000001a29f-134.dat	upx
behavioral1/files/0x000500000001a298-130.dat	upx
behavioral1/files/0x000500000001a294-126.dat	upx
behavioral1/files/0x000500000001a270-112.dat	upx
behavioral1/files/0x000500000001a272-117.dat	upx
behavioral1/files/0x000500000001a25c-108.dat	upx
behavioral1/memory/2676-87-0x000000013F180000-0x000000013F572000-memory.dmp	upx
behavioral1/memory/2360-99-0x000000013F5A0000-0x000000013F992000-memory.dmp	upx
behavioral1/memory/2252-97-0x000000013FA80000-0x000000013FE72000-memory.dmp	upx
behavioral1/memory/1980-94-0x000000013FDE0000-0x00000001401D2000-memory.dmp	upx
behavioral1/files/0x000500000001a237-93.dat	upx
behavioral1/memory/2668-82-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	upx
behavioral1/memory/2624-80-0x000000013F710000-0x000000013FB02000-memory.dmp	upx
behavioral1/memory/2792-78-0x000000013F930000-0x000000013FD22000-memory.dmp	upx
behavioral1/memory/2652-76-0x000000013FDB0000-0x00000001401A2000-memory.dmp	upx
behavioral1/memory/2892-71-0x000000013F920000-0x000000013FD12000-memory.dmp	upx
behavioral1/memory/2780-70-0x000000013FD10000-0x0000000140102000-memory.dmp	upx
behavioral1/files/0x000500000001a1fe-62.dat	upx
behavioral1/memory/2440-1823-0x000000013F7A0000-0x000000013FB92000-memory.dmp	upx
behavioral1/memory/2624-1924-0x000000013F710000-0x000000013FB02000-memory.dmp	upx
behavioral1/memory/2676-1923-0x000000013F180000-0x000000013F572000-memory.dmp	upx
behavioral1/memory/2892-1925-0x000000013F920000-0x000000013FD12000-memory.dmp	upx
behavioral1/memory/2252-1921-0x000000013FA80000-0x000000013FE72000-memory.dmp	upx
behavioral1/memory/2792-1890-0x000000013F930000-0x000000013FD22000-memory.dmp	upx
behavioral1/memory/2652-1888-0x000000013FDB0000-0x00000001401A2000-memory.dmp	upx
behavioral1/memory/2668-1880-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	upx
behavioral1/memory/2700-2599-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	upx
behavioral1/memory/1980-2731-0x000000013FDE0000-0x00000001401D2000-memory.dmp	upx
behavioral1/memory/2360-2862-0x000000013F5A0000-0x000000013F992000-memory.dmp	upx
behavioral1/memory/2780-2874-0x000000013FD10000-0x0000000140102000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\mpDbcEb.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\OJhaKNu.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\qxKApBn.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\wkwXHeo.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\wkumPjN.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\EXTrvNz.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\oTJFbAN.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\dRUzAKg.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\sQsYacz.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\zkxLALH.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\uaVBAKH.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\BbzWzcj.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\furdxiy.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\JCQMOWV.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\kEFabKR.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\oNhsSZF.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\lYxXVPx.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\GxRLkol.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\jdMmTsi.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\MSIBdtK.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\EGLRHob.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\untXGpZ.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\trcgKYo.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\HxUtgFV.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\KlDmHUb.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\FUDNXHH.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\jYpXhMb.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\UxReIzV.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\vvkwmRX.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\cECFxZL.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\ykNMbDx.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\vdywGbO.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\EhjRiYk.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\hSuvAOP.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\xhBMTOo.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\mnucWEy.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\SkoSrCh.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\wYHcCyX.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\QEzstqe.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\yjHJhlV.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\Tqwgsmb.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\QlIUYjT.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\kmVjpvU.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\SHgWDUX.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\lyAHnaS.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\WOpUspi.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\LQqTVxs.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\QUZLRVi.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\vAdWGYq.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\JVTjGCN.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\hLfjTBm.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\ZJozfTj.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\ZYLNscf.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\cOjFTVM.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\MKiiKYu.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\lqYKnAA.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\IqJjhUg.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\IvmcYUP.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\urVwYdw.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\NpiqFnM.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\OxFFYLX.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\rkgIWJF.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\KJnUMhJ.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe
File created	C:\Windows\System\KFCIewm.exe	e333d9ba49bb8218c1bda76f9620ecc0N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2084	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
Token: SeLockMemoryPrivilege	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe
Token: SeDebugPrivilege	2084	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2084	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	30
PID 2468 wrote to memory of 2084	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	30
PID 2468 wrote to memory of 2084	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	30
PID 2468 wrote to memory of 2440	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	31
PID 2468 wrote to memory of 2440	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	31
PID 2468 wrote to memory of 2440	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	31
PID 2468 wrote to memory of 2780	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	32
PID 2468 wrote to memory of 2780	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	32
PID 2468 wrote to memory of 2780	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	32
PID 2468 wrote to memory of 2892	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	33
PID 2468 wrote to memory of 2892	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	33
PID 2468 wrote to memory of 2892	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	33
PID 2468 wrote to memory of 2652	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	34
PID 2468 wrote to memory of 2652	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	34
PID 2468 wrote to memory of 2652	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	34
PID 2468 wrote to memory of 2792	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	35
PID 2468 wrote to memory of 2792	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	35
PID 2468 wrote to memory of 2792	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	35
PID 2468 wrote to memory of 2624	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	36
PID 2468 wrote to memory of 2624	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	36
PID 2468 wrote to memory of 2624	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	36
PID 2468 wrote to memory of 2668	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	37
PID 2468 wrote to memory of 2668	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	37
PID 2468 wrote to memory of 2668	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	37
PID 2468 wrote to memory of 2700	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	38
PID 2468 wrote to memory of 2700	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	38
PID 2468 wrote to memory of 2700	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	38
PID 2468 wrote to memory of 2676	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	39
PID 2468 wrote to memory of 2676	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	39
PID 2468 wrote to memory of 2676	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	39
PID 2468 wrote to memory of 1980	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	40
PID 2468 wrote to memory of 1980	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	40
PID 2468 wrote to memory of 1980	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	40
PID 2468 wrote to memory of 2252	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	41
PID 2468 wrote to memory of 2252	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	41
PID 2468 wrote to memory of 2252	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	41
PID 2468 wrote to memory of 2360	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	42
PID 2468 wrote to memory of 2360	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	42
PID 2468 wrote to memory of 2360	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	42
PID 2468 wrote to memory of 2728	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	43
PID 2468 wrote to memory of 2728	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	43
PID 2468 wrote to memory of 2728	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	43
PID 2468 wrote to memory of 2964	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	44
PID 2468 wrote to memory of 2964	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	44
PID 2468 wrote to memory of 2964	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	44
PID 2468 wrote to memory of 808	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	45
PID 2468 wrote to memory of 808	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	45
PID 2468 wrote to memory of 808	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	45
PID 2468 wrote to memory of 1116	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	46
PID 2468 wrote to memory of 1116	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	46
PID 2468 wrote to memory of 1116	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	46
PID 2468 wrote to memory of 2988	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	47
PID 2468 wrote to memory of 2988	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	47
PID 2468 wrote to memory of 2988	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	47
PID 2468 wrote to memory of 3004	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	48
PID 2468 wrote to memory of 3004	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	48
PID 2468 wrote to memory of 3004	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	48
PID 2468 wrote to memory of 2380	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	49
PID 2468 wrote to memory of 2380	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	49
PID 2468 wrote to memory of 2380	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	49
PID 2468 wrote to memory of 2312	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	50
PID 2468 wrote to memory of 2312	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	50
PID 2468 wrote to memory of 2312	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	50
PID 2468 wrote to memory of 2036	2468	e333d9ba49bb8218c1bda76f9620ecc0N.exe	51

C:\Users\Admin\AppData\Local\Temp\e333d9ba49bb8218c1bda76f9620ecc0N.exe
"C:\Users\Admin\AppData\Local\Temp\e333d9ba49bb8218c1bda76f9620ecc0N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2084
- C:\Windows\System\AkgJnvS.exe
  C:\Windows\System\AkgJnvS.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\yzfNfzE.exe
  C:\Windows\System\yzfNfzE.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\dvIvMFg.exe
  C:\Windows\System\dvIvMFg.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\oTJFbAN.exe
  C:\Windows\System\oTJFbAN.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\ODDDrMt.exe
  C:\Windows\System\ODDDrMt.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\dyrrjdL.exe
  C:\Windows\System\dyrrjdL.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\WuaREFG.exe
  C:\Windows\System\WuaREFG.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\fEXDmRZ.exe
  C:\Windows\System\fEXDmRZ.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\IHcRtAM.exe
  C:\Windows\System\IHcRtAM.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\OqKgOYu.exe
  C:\Windows\System\OqKgOYu.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\KAnevVm.exe
  C:\Windows\System\KAnevVm.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\jryXYzP.exe
  C:\Windows\System\jryXYzP.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\LtNZmHk.exe
  C:\Windows\System\LtNZmHk.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\GlyUexG.exe
  C:\Windows\System\GlyUexG.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\kUJNZJx.exe
  C:\Windows\System\kUJNZJx.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\rjrlTRM.exe
  C:\Windows\System\rjrlTRM.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\NWECGLC.exe
  C:\Windows\System\NWECGLC.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\TmvxkAn.exe
  C:\Windows\System\TmvxkAn.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\tJLMwqS.exe
  C:\Windows\System\tJLMwqS.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\KJNCJKx.exe
  C:\Windows\System\KJNCJKx.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\ftpPByR.exe
  C:\Windows\System\ftpPByR.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\MKiiKYu.exe
  C:\Windows\System\MKiiKYu.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\uaIlZIR.exe
  C:\Windows\System\uaIlZIR.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\XhhDhGD.exe
  C:\Windows\System\XhhDhGD.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\AZnGqQf.exe
  C:\Windows\System\AZnGqQf.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\pxyCflt.exe
  C:\Windows\System\pxyCflt.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\eXcvKuu.exe
  C:\Windows\System\eXcvKuu.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\mMZHtNM.exe
  C:\Windows\System\mMZHtNM.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\OsjQWBc.exe
  C:\Windows\System\OsjQWBc.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\OXMSiep.exe
  C:\Windows\System\OXMSiep.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\rcUnIuy.exe
  C:\Windows\System\rcUnIuy.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\rQrsNOo.exe
  C:\Windows\System\rQrsNOo.exe
  2⤵
  - Executes dropped EXE
  PID:584
- C:\Windows\System\Tqwgsmb.exe
  C:\Windows\System\Tqwgsmb.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\SpFgYfQ.exe
  C:\Windows\System\SpFgYfQ.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\zGTkiNu.exe
  C:\Windows\System\zGTkiNu.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\WkSzpaF.exe
  C:\Windows\System\WkSzpaF.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\qvyMvbm.exe
  C:\Windows\System\qvyMvbm.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\QLzxfeq.exe
  C:\Windows\System\QLzxfeq.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\SvtHYHH.exe
  C:\Windows\System\SvtHYHH.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\trcgKYo.exe
  C:\Windows\System\trcgKYo.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\NswcuPy.exe
  C:\Windows\System\NswcuPy.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\fXRXShy.exe
  C:\Windows\System\fXRXShy.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\OHmOxPf.exe
  C:\Windows\System\OHmOxPf.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\jlJHXRK.exe
  C:\Windows\System\jlJHXRK.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\NnIOaXQ.exe
  C:\Windows\System\NnIOaXQ.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\AtgRxhU.exe
  C:\Windows\System\AtgRxhU.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\sOztcRS.exe
  C:\Windows\System\sOztcRS.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\vultMji.exe
  C:\Windows\System\vultMji.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\lrknndJ.exe
  C:\Windows\System\lrknndJ.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\jjDuhij.exe
  C:\Windows\System\jjDuhij.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\pJWIkhu.exe
  C:\Windows\System\pJWIkhu.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\ZHbaIMf.exe
  C:\Windows\System\ZHbaIMf.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\QzLZMvY.exe
  C:\Windows\System\QzLZMvY.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\TnamKlQ.exe
  C:\Windows\System\TnamKlQ.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\ZTFhcXj.exe
  C:\Windows\System\ZTFhcXj.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\dvRrGAn.exe
  C:\Windows\System\dvRrGAn.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\KpXoQEI.exe
  C:\Windows\System\KpXoQEI.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\DMjxsfq.exe
  C:\Windows\System\DMjxsfq.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\jYpXhMb.exe
  C:\Windows\System\jYpXhMb.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\aFFrdRO.exe
  C:\Windows\System\aFFrdRO.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\EOccTMo.exe
  C:\Windows\System\EOccTMo.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\SfsRoWI.exe
  C:\Windows\System\SfsRoWI.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\THVYodV.exe
  C:\Windows\System\THVYodV.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\UPYHXqk.exe
  C:\Windows\System\UPYHXqk.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\AgLeVxh.exe
  C:\Windows\System\AgLeVxh.exe
  2⤵
  PID:2872
- C:\Windows\System\oGnUXta.exe
  C:\Windows\System\oGnUXta.exe
  2⤵
  PID:1912
- C:\Windows\System\rJMSXWC.exe
  C:\Windows\System\rJMSXWC.exe
  2⤵
  PID:1752
- C:\Windows\System\qWwgwnu.exe
  C:\Windows\System\qWwgwnu.exe
  2⤵
  PID:2192
- C:\Windows\System\OFtpcAH.exe
  C:\Windows\System\OFtpcAH.exe
  2⤵
  PID:2280
- C:\Windows\System\QlIUYjT.exe
  C:\Windows\System\QlIUYjT.exe
  2⤵
  PID:2640
- C:\Windows\System\PwwQoFg.exe
  C:\Windows\System\PwwQoFg.exe
  2⤵
  PID:2300
- C:\Windows\System\SXlBqEG.exe
  C:\Windows\System\SXlBqEG.exe
  2⤵
  PID:1856
- C:\Windows\System\ErxnniL.exe
  C:\Windows\System\ErxnniL.exe
  2⤵
  PID:2296
- C:\Windows\System\TNahKRV.exe
  C:\Windows\System\TNahKRV.exe
  2⤵
  PID:2220
- C:\Windows\System\ySEiLef.exe
  C:\Windows\System\ySEiLef.exe
  2⤵
  PID:1108
- C:\Windows\System\WTIyXlh.exe
  C:\Windows\System\WTIyXlh.exe
  2⤵
  PID:1224
- C:\Windows\System\IKMCUNF.exe
  C:\Windows\System\IKMCUNF.exe
  2⤵
  PID:2800
- C:\Windows\System\LMLQeqo.exe
  C:\Windows\System\LMLQeqo.exe
  2⤵
  PID:1016
- C:\Windows\System\fcieLni.exe
  C:\Windows\System\fcieLni.exe
  2⤵
  PID:1080
- C:\Windows\System\OLwlPML.exe
  C:\Windows\System\OLwlPML.exe
  2⤵
  PID:916
- C:\Windows\System\TAdMquD.exe
  C:\Windows\System\TAdMquD.exe
  2⤵
  PID:1816
- C:\Windows\System\HudbTsm.exe
  C:\Windows\System\HudbTsm.exe
  2⤵
  PID:932
- C:\Windows\System\UevwwBc.exe
  C:\Windows\System\UevwwBc.exe
  2⤵
  PID:2092
- C:\Windows\System\LFTzXol.exe
  C:\Windows\System\LFTzXol.exe
  2⤵
  PID:1484
- C:\Windows\System\NHYOtkp.exe
  C:\Windows\System\NHYOtkp.exe
  2⤵
  PID:2444
- C:\Windows\System\VbwYuDQ.exe
  C:\Windows\System\VbwYuDQ.exe
  2⤵
  PID:432
- C:\Windows\System\qDQilqL.exe
  C:\Windows\System\qDQilqL.exe
  2⤵
  PID:2176
- C:\Windows\System\MQxwYwD.exe
  C:\Windows\System\MQxwYwD.exe
  2⤵
  PID:1576
- C:\Windows\System\TVrdjQt.exe
  C:\Windows\System\TVrdjQt.exe
  2⤵
  PID:1592
- C:\Windows\System\Cmoamiv.exe
  C:\Windows\System\Cmoamiv.exe
  2⤵
  PID:2824
- C:\Windows\System\JrIOKCK.exe
  C:\Windows\System\JrIOKCK.exe
  2⤵
  PID:1336
- C:\Windows\System\ITBHwRV.exe
  C:\Windows\System\ITBHwRV.exe
  2⤵
  PID:2768
- C:\Windows\System\tGXoDSf.exe
  C:\Windows\System\tGXoDSf.exe
  2⤵
  PID:2636
- C:\Windows\System\bVsLGBO.exe
  C:\Windows\System\bVsLGBO.exe
  2⤵
  PID:2796
- C:\Windows\System\UnSVpoA.exe
  C:\Windows\System\UnSVpoA.exe
  2⤵
  PID:2324
- C:\Windows\System\iYBmbPo.exe
  C:\Windows\System\iYBmbPo.exe
  2⤵
  PID:2352
- C:\Windows\System\JEMxgQg.exe
  C:\Windows\System\JEMxgQg.exe
  2⤵
  PID:2608
- C:\Windows\System\vQqPzpQ.exe
  C:\Windows\System\vQqPzpQ.exe
  2⤵
  PID:1452
- C:\Windows\System\sUduNve.exe
  C:\Windows\System\sUduNve.exe
  2⤵
  PID:3016
- C:\Windows\System\KKOsRYz.exe
  C:\Windows\System\KKOsRYz.exe
  2⤵
  PID:2956
- C:\Windows\System\LXcQiKd.exe
  C:\Windows\System\LXcQiKd.exe
  2⤵
  PID:2660
- C:\Windows\System\AQYijvz.exe
  C:\Windows\System\AQYijvz.exe
  2⤵
  PID:1056
- C:\Windows\System\fVdMZFB.exe
  C:\Windows\System\fVdMZFB.exe
  2⤵
  PID:2232
- C:\Windows\System\LhUGvLQ.exe
  C:\Windows\System\LhUGvLQ.exe
  2⤵
  PID:2664
- C:\Windows\System\VRzOFiJ.exe
  C:\Windows\System\VRzOFiJ.exe
  2⤵
  PID:2204
- C:\Windows\System\akgaMMp.exe
  C:\Windows\System\akgaMMp.exe
  2⤵
  PID:1992
- C:\Windows\System\mbzzPSg.exe
  C:\Windows\System\mbzzPSg.exe
  2⤵
  PID:2536
- C:\Windows\System\xpybjtH.exe
  C:\Windows\System\xpybjtH.exe
  2⤵
  PID:1956
- C:\Windows\System\RQUsAqf.exe
  C:\Windows\System\RQUsAqf.exe
  2⤵
  PID:1548
- C:\Windows\System\NVzDKgG.exe
  C:\Windows\System\NVzDKgG.exe
  2⤵
  PID:920
- C:\Windows\System\xlcBhrc.exe
  C:\Windows\System\xlcBhrc.exe
  2⤵
  PID:936
- C:\Windows\System\mUJIdNm.exe
  C:\Windows\System\mUJIdNm.exe
  2⤵
  PID:1064
- C:\Windows\System\VwZQyQY.exe
  C:\Windows\System\VwZQyQY.exe
  2⤵
  PID:324
- C:\Windows\System\WruQAHx.exe
  C:\Windows\System\WruQAHx.exe
  2⤵
  PID:3044
- C:\Windows\System\WNMgHcl.exe
  C:\Windows\System\WNMgHcl.exe
  2⤵
  PID:1584
- C:\Windows\System\YZdSBpJ.exe
  C:\Windows\System\YZdSBpJ.exe
  2⤵
  PID:1372
- C:\Windows\System\HoxrNsM.exe
  C:\Windows\System\HoxrNsM.exe
  2⤵
  PID:2064
- C:\Windows\System\yGMTNTK.exe
  C:\Windows\System\yGMTNTK.exe
  2⤵
  PID:2140
- C:\Windows\System\dRUzAKg.exe
  C:\Windows\System\dRUzAKg.exe
  2⤵
  PID:2888
- C:\Windows\System\JmVsJvt.exe
  C:\Windows\System\JmVsJvt.exe
  2⤵
  PID:2692
- C:\Windows\System\AxJsjiJ.exe
  C:\Windows\System\AxJsjiJ.exe
  2⤵
  PID:1716
- C:\Windows\System\JXdQRPF.exe
  C:\Windows\System\JXdQRPF.exe
  2⤵
  PID:1720
- C:\Windows\System\KBVtegD.exe
  C:\Windows\System\KBVtegD.exe
  2⤵
  PID:1964
- C:\Windows\System\XMLcZju.exe
  C:\Windows\System\XMLcZju.exe
  2⤵
  PID:2852
- C:\Windows\System\SYRocxd.exe
  C:\Windows\System\SYRocxd.exe
  2⤵
  PID:1048
- C:\Windows\System\niiIlKA.exe
  C:\Windows\System\niiIlKA.exe
  2⤵
  PID:2960
- C:\Windows\System\FJQVLok.exe
  C:\Windows\System\FJQVLok.exe
  2⤵
  PID:1544
- C:\Windows\System\FUtPvud.exe
  C:\Windows\System\FUtPvud.exe
  2⤵
  PID:2180
- C:\Windows\System\gVIeNqc.exe
  C:\Windows\System\gVIeNqc.exe
  2⤵
  PID:2068
- C:\Windows\System\bBGgCDj.exe
  C:\Windows\System\bBGgCDj.exe
  2⤵
  PID:2388
- C:\Windows\System\XinpItg.exe
  C:\Windows\System\XinpItg.exe
  2⤵
  PID:2540
- C:\Windows\System\nfgtnxF.exe
  C:\Windows\System\nfgtnxF.exe
  2⤵
  PID:580
- C:\Windows\System\RrObxNG.exe
  C:\Windows\System\RrObxNG.exe
  2⤵
  PID:1284
- C:\Windows\System\mlNfksl.exe
  C:\Windows\System\mlNfksl.exe
  2⤵
  PID:2264
- C:\Windows\System\DbOWSEG.exe
  C:\Windows\System\DbOWSEG.exe
  2⤵
  PID:384
- C:\Windows\System\roJvCjZ.exe
  C:\Windows\System\roJvCjZ.exe
  2⤵
  PID:2288
- C:\Windows\System\MJmGaMF.exe
  C:\Windows\System\MJmGaMF.exe
  2⤵
  PID:572
- C:\Windows\System\KEUixvw.exe
  C:\Windows\System\KEUixvw.exe
  2⤵
  PID:1868
- C:\Windows\System\nKJePbl.exe
  C:\Windows\System\nKJePbl.exe
  2⤵
  PID:2848
- C:\Windows\System\wkumPjN.exe
  C:\Windows\System\wkumPjN.exe
  2⤵
  PID:668
- C:\Windows\System\nXBEOEG.exe
  C:\Windows\System\nXBEOEG.exe
  2⤵
  PID:1012
- C:\Windows\System\EEZCxal.exe
  C:\Windows\System\EEZCxal.exe
  2⤵
  PID:944
- C:\Windows\System\lqYKnAA.exe
  C:\Windows\System\lqYKnAA.exe
  2⤵
  PID:2740
- C:\Windows\System\mWEGrhj.exe
  C:\Windows\System\mWEGrhj.exe
  2⤵
  PID:2716
- C:\Windows\System\lDLIhAb.exe
  C:\Windows\System\lDLIhAb.exe
  2⤵
  PID:2108
- C:\Windows\System\QBxOwWu.exe
  C:\Windows\System\QBxOwWu.exe
  2⤵
  PID:2128
- C:\Windows\System\ICKImZK.exe
  C:\Windows\System\ICKImZK.exe
  2⤵
  PID:2828
- C:\Windows\System\IiKbSwE.exe
  C:\Windows\System\IiKbSwE.exe
  2⤵
  PID:3028
- C:\Windows\System\UxReIzV.exe
  C:\Windows\System\UxReIzV.exe
  2⤵
  PID:2820
- C:\Windows\System\NVvAQtY.exe
  C:\Windows\System\NVvAQtY.exe
  2⤵
  PID:2480
- C:\Windows\System\CxQVmTX.exe
  C:\Windows\System\CxQVmTX.exe
  2⤵
  PID:2120
- C:\Windows\System\PXjFnrc.exe
  C:\Windows\System\PXjFnrc.exe
  2⤵
  PID:2996
- C:\Windows\System\aSyCefi.exe
  C:\Windows\System\aSyCefi.exe
  2⤵
  PID:2436
- C:\Windows\System\MnVjtky.exe
  C:\Windows\System\MnVjtky.exe
  2⤵
  PID:2564
- C:\Windows\System\KBrqmMy.exe
  C:\Windows\System\KBrqmMy.exe
  2⤵
  PID:2584
- C:\Windows\System\lYOhcBs.exe
  C:\Windows\System\lYOhcBs.exe
  2⤵
  PID:2916
- C:\Windows\System\GPSNYhb.exe
  C:\Windows\System\GPSNYhb.exe
  2⤵
  PID:2104
- C:\Windows\System\jwfnwjG.exe
  C:\Windows\System\jwfnwjG.exe
  2⤵
  PID:2356
- C:\Windows\System\gHdhPqd.exe
  C:\Windows\System\gHdhPqd.exe
  2⤵
  PID:648
- C:\Windows\System\UDNpsSt.exe
  C:\Windows\System\UDNpsSt.exe
  2⤵
  PID:1996
- C:\Windows\System\XDMnXFU.exe
  C:\Windows\System\XDMnXFU.exe
  2⤵
  PID:1516
- C:\Windows\System\xhWTyIQ.exe
  C:\Windows\System\xhWTyIQ.exe
  2⤵
  PID:2544
- C:\Windows\System\LsqdCWm.exe
  C:\Windows\System\LsqdCWm.exe
  2⤵
  PID:1556
- C:\Windows\System\AdGMTqg.exe
  C:\Windows\System\AdGMTqg.exe
  2⤵
  PID:844
- C:\Windows\System\CiUrFVs.exe
  C:\Windows\System\CiUrFVs.exe
  2⤵
  PID:2936
- C:\Windows\System\NTekykn.exe
  C:\Windows\System\NTekykn.exe
  2⤵
  PID:2504
- C:\Windows\System\PBeKkJS.exe
  C:\Windows\System\PBeKkJS.exe
  2⤵
  PID:2376
- C:\Windows\System\GyCUeMB.exe
  C:\Windows\System\GyCUeMB.exe
  2⤵
  PID:2804
- C:\Windows\System\YXzXKiG.exe
  C:\Windows\System\YXzXKiG.exe
  2⤵
  PID:972
- C:\Windows\System\JQextBB.exe
  C:\Windows\System\JQextBB.exe
  2⤵
  PID:2880
- C:\Windows\System\cNqpgiu.exe
  C:\Windows\System\cNqpgiu.exe
  2⤵
  PID:2980
- C:\Windows\System\nnOwwIP.exe
  C:\Windows\System\nnOwwIP.exe
  2⤵
  PID:2200
- C:\Windows\System\KMOmOpP.exe
  C:\Windows\System\KMOmOpP.exe
  2⤵
  PID:3012
- C:\Windows\System\qljKuCS.exe
  C:\Windows\System\qljKuCS.exe
  2⤵
  PID:1632
- C:\Windows\System\tOaEEIo.exe
  C:\Windows\System\tOaEEIo.exe
  2⤵
  PID:908
- C:\Windows\System\jdMmTsi.exe
  C:\Windows\System\jdMmTsi.exe
  2⤵
  PID:2124
- C:\Windows\System\kZvjriJ.exe
  C:\Windows\System\kZvjriJ.exe
  2⤵
  PID:3084
- C:\Windows\System\OZTnJCL.exe
  C:\Windows\System\OZTnJCL.exe
  2⤵
  PID:3108
- C:\Windows\System\dRcMqpG.exe
  C:\Windows\System\dRcMqpG.exe
  2⤵
  PID:3124
- C:\Windows\System\CNUFzJG.exe
  C:\Windows\System\CNUFzJG.exe
  2⤵
  PID:3140
- C:\Windows\System\EXiNSeI.exe
  C:\Windows\System\EXiNSeI.exe
  2⤵
  PID:3160
- C:\Windows\System\kfHeKAw.exe
  C:\Windows\System\kfHeKAw.exe
  2⤵
  PID:3180
- C:\Windows\System\UvafWxv.exe
  C:\Windows\System\UvafWxv.exe
  2⤵
  PID:3196
- C:\Windows\System\LstFzKs.exe
  C:\Windows\System\LstFzKs.exe
  2⤵
  PID:3212
- C:\Windows\System\rvPKPvZ.exe
  C:\Windows\System\rvPKPvZ.exe
  2⤵
  PID:3228
- C:\Windows\System\EFRTGgw.exe
  C:\Windows\System\EFRTGgw.exe
  2⤵
  PID:3248
- C:\Windows\System\UhXecMc.exe
  C:\Windows\System\UhXecMc.exe
  2⤵
  PID:3264
- C:\Windows\System\sRGvRsQ.exe
  C:\Windows\System\sRGvRsQ.exe
  2⤵
  PID:3296
- C:\Windows\System\CRlxIQf.exe
  C:\Windows\System\CRlxIQf.exe
  2⤵
  PID:3340
- C:\Windows\System\TaUpnWP.exe
  C:\Windows\System\TaUpnWP.exe
  2⤵
  PID:3364
- C:\Windows\System\nLbkEZW.exe
  C:\Windows\System\nLbkEZW.exe
  2⤵
  PID:3380
- C:\Windows\System\TppseUi.exe
  C:\Windows\System\TppseUi.exe
  2⤵
  PID:3396
- C:\Windows\System\ffRIuTV.exe
  C:\Windows\System\ffRIuTV.exe
  2⤵
  PID:3416
- C:\Windows\System\smXLAfK.exe
  C:\Windows\System\smXLAfK.exe
  2⤵
  PID:3440
- C:\Windows\System\sGpAudC.exe
  C:\Windows\System\sGpAudC.exe
  2⤵
  PID:3460
- C:\Windows\System\zVkwMqf.exe
  C:\Windows\System\zVkwMqf.exe
  2⤵
  PID:3476
- C:\Windows\System\kcRZqzC.exe
  C:\Windows\System\kcRZqzC.exe
  2⤵
  PID:3492
- C:\Windows\System\cirhxwe.exe
  C:\Windows\System\cirhxwe.exe
  2⤵
  PID:3516
- C:\Windows\System\DzVxKWO.exe
  C:\Windows\System\DzVxKWO.exe
  2⤵
  PID:3544
- C:\Windows\System\dVxRKcY.exe
  C:\Windows\System\dVxRKcY.exe
  2⤵
  PID:3564
- C:\Windows\System\DMtQQsp.exe
  C:\Windows\System\DMtQQsp.exe
  2⤵
  PID:3584
- C:\Windows\System\LpJXwKw.exe
  C:\Windows\System\LpJXwKw.exe
  2⤵
  PID:3604
- C:\Windows\System\WmoBuuL.exe
  C:\Windows\System\WmoBuuL.exe
  2⤵
  PID:3624
- C:\Windows\System\OWxoVYs.exe
  C:\Windows\System\OWxoVYs.exe
  2⤵
  PID:3644
- C:\Windows\System\LiUdQIM.exe
  C:\Windows\System\LiUdQIM.exe
  2⤵
  PID:3664
- C:\Windows\System\FhbTROx.exe
  C:\Windows\System\FhbTROx.exe
  2⤵
  PID:3684
- C:\Windows\System\DNCsgVG.exe
  C:\Windows\System\DNCsgVG.exe
  2⤵
  PID:3704
- C:\Windows\System\TAyWSak.exe
  C:\Windows\System\TAyWSak.exe
  2⤵
  PID:3724
- C:\Windows\System\TjRvYRe.exe
  C:\Windows\System\TjRvYRe.exe
  2⤵
  PID:3744
- C:\Windows\System\vvkwmRX.exe
  C:\Windows\System\vvkwmRX.exe
  2⤵
  PID:3764
- C:\Windows\System\mFUYJCx.exe
  C:\Windows\System\mFUYJCx.exe
  2⤵
  PID:3784
- C:\Windows\System\kYxkswC.exe
  C:\Windows\System\kYxkswC.exe
  2⤵
  PID:3804
- C:\Windows\System\FelOzMS.exe
  C:\Windows\System\FelOzMS.exe
  2⤵
  PID:3824
- C:\Windows\System\ZtOiTmb.exe
  C:\Windows\System\ZtOiTmb.exe
  2⤵
  PID:3844
- C:\Windows\System\pEqGlHt.exe
  C:\Windows\System\pEqGlHt.exe
  2⤵
  PID:3864
- C:\Windows\System\sAcmqft.exe
  C:\Windows\System\sAcmqft.exe
  2⤵
  PID:3884
- C:\Windows\System\AYnRLOZ.exe
  C:\Windows\System\AYnRLOZ.exe
  2⤵
  PID:3904
- C:\Windows\System\gegEcwm.exe
  C:\Windows\System\gegEcwm.exe
  2⤵
  PID:3924
- C:\Windows\System\MnROVHk.exe
  C:\Windows\System\MnROVHk.exe
  2⤵
  PID:3944
- C:\Windows\System\GtLBpje.exe
  C:\Windows\System\GtLBpje.exe
  2⤵
  PID:3964
- C:\Windows\System\xsfhMsD.exe
  C:\Windows\System\xsfhMsD.exe
  2⤵
  PID:3984
- C:\Windows\System\CYgdLMw.exe
  C:\Windows\System\CYgdLMw.exe
  2⤵
  PID:4004
- C:\Windows\System\kkQXjQU.exe
  C:\Windows\System\kkQXjQU.exe
  2⤵
  PID:4024
- C:\Windows\System\nFQMZin.exe
  C:\Windows\System\nFQMZin.exe
  2⤵
  PID:4044
- C:\Windows\System\dPtgftO.exe
  C:\Windows\System\dPtgftO.exe
  2⤵
  PID:4064
- C:\Windows\System\AmJaQYt.exe
  C:\Windows\System\AmJaQYt.exe
  2⤵
  PID:4084
- C:\Windows\System\vIVkcnM.exe
  C:\Windows\System\vIVkcnM.exe
  2⤵
  PID:1792
- C:\Windows\System\nhqGPrD.exe
  C:\Windows\System\nhqGPrD.exe
  2⤵
  PID:3100
- C:\Windows\System\TFHjUKY.exe
  C:\Windows\System\TFHjUKY.exe
  2⤵
  PID:3132
- C:\Windows\System\lSUhikK.exe
  C:\Windows\System\lSUhikK.exe
  2⤵
  PID:3176
- C:\Windows\System\TZTHYFR.exe
  C:\Windows\System\TZTHYFR.exe
  2⤵
  PID:3284
- C:\Windows\System\DWuuCVr.exe
  C:\Windows\System\DWuuCVr.exe
  2⤵
  PID:3256
- C:\Windows\System\gDESgUC.exe
  C:\Windows\System\gDESgUC.exe
  2⤵
  PID:3360
- C:\Windows\System\XXikBiC.exe
  C:\Windows\System\XXikBiC.exe
  2⤵
  PID:3408
- C:\Windows\System\IqJjhUg.exe
  C:\Windows\System\IqJjhUg.exe
  2⤵
  PID:3472
- C:\Windows\System\lyAHnaS.exe
  C:\Windows\System\lyAHnaS.exe
  2⤵
  PID:3508
- C:\Windows\System\JEDnLKb.exe
  C:\Windows\System\JEDnLKb.exe
  2⤵
  PID:3484
- C:\Windows\System\zHYYDOi.exe
  C:\Windows\System\zHYYDOi.exe
  2⤵
  PID:3536
- C:\Windows\System\BHNJgjX.exe
  C:\Windows\System\BHNJgjX.exe
  2⤵
  PID:3580
- C:\Windows\System\uRqNMIH.exe
  C:\Windows\System\uRqNMIH.exe
  2⤵
  PID:3612
- C:\Windows\System\wolYxml.exe
  C:\Windows\System\wolYxml.exe
  2⤵
  PID:2316
- C:\Windows\System\wrLSzBO.exe
  C:\Windows\System\wrLSzBO.exe
  2⤵
  PID:3680
- C:\Windows\System\OHPowzr.exe
  C:\Windows\System\OHPowzr.exe
  2⤵
  PID:3700
- C:\Windows\System\NuEBrtR.exe
  C:\Windows\System\NuEBrtR.exe
  2⤵
  PID:3740
- C:\Windows\System\SlSnqpe.exe
  C:\Windows\System\SlSnqpe.exe
  2⤵
  PID:3772
- C:\Windows\System\OZXzkdg.exe
  C:\Windows\System\OZXzkdg.exe
  2⤵
  PID:3796
- C:\Windows\System\rPuFqqx.exe
  C:\Windows\System\rPuFqqx.exe
  2⤵
  PID:3852
- C:\Windows\System\elnmujY.exe
  C:\Windows\System\elnmujY.exe
  2⤵
  PID:3880
- C:\Windows\System\FlCLYno.exe
  C:\Windows\System\FlCLYno.exe
  2⤵
  PID:3912
- C:\Windows\System\hmgGXhk.exe
  C:\Windows\System\hmgGXhk.exe
  2⤵
  PID:3936
- C:\Windows\System\fZAkZyK.exe
  C:\Windows\System\fZAkZyK.exe
  2⤵
  PID:3976
- C:\Windows\System\xjlQsEt.exe
  C:\Windows\System\xjlQsEt.exe
  2⤵
  PID:4020
- C:\Windows\System\QxsGtIa.exe
  C:\Windows\System\QxsGtIa.exe
  2⤵
  PID:4040
- C:\Windows\System\uzvYgMd.exe
  C:\Windows\System\uzvYgMd.exe
  2⤵
  PID:4080
- C:\Windows\System\JXSurGa.exe
  C:\Windows\System\JXSurGa.exe
  2⤵
  PID:428
- C:\Windows\System\XNzVdOY.exe
  C:\Windows\System\XNzVdOY.exe
  2⤵
  PID:3168
- C:\Windows\System\HKagJCN.exe
  C:\Windows\System\HKagJCN.exe
  2⤵
  PID:3208
- C:\Windows\System\iDDPnAV.exe
  C:\Windows\System\iDDPnAV.exe
  2⤵
  PID:3280
- C:\Windows\System\ACGvLma.exe
  C:\Windows\System\ACGvLma.exe
  2⤵
  PID:2188
- C:\Windows\System\XzpZfns.exe
  C:\Windows\System\XzpZfns.exe
  2⤵
  PID:3308
- C:\Windows\System\agbfKju.exe
  C:\Windows\System\agbfKju.exe
  2⤵
  PID:3320
- C:\Windows\System\yMCUsbK.exe
  C:\Windows\System\yMCUsbK.exe
  2⤵
  PID:3332
- C:\Windows\System\zYNHrzA.exe
  C:\Windows\System\zYNHrzA.exe
  2⤵
  PID:3372
- C:\Windows\System\xdmfJWk.exe
  C:\Windows\System\xdmfJWk.exe
  2⤵
  PID:3448
- C:\Windows\System\GEEULAd.exe
  C:\Windows\System\GEEULAd.exe
  2⤵
  PID:3468
- C:\Windows\System\JCQMOWV.exe
  C:\Windows\System\JCQMOWV.exe
  2⤵
  PID:1644
- C:\Windows\System\DlhRNie.exe
  C:\Windows\System\DlhRNie.exe
  2⤵
  PID:3524
- C:\Windows\System\LdFRFsm.exe
  C:\Windows\System\LdFRFsm.exe
  2⤵
  PID:3600
- C:\Windows\System\htbntaP.exe
  C:\Windows\System\htbntaP.exe
  2⤵
  PID:3376
- C:\Windows\System\yXWVzgc.exe
  C:\Windows\System\yXWVzgc.exe
  2⤵
  PID:3692
- C:\Windows\System\lVhcjkq.exe
  C:\Windows\System\lVhcjkq.exe
  2⤵
  PID:3736
- C:\Windows\System\jGTvlBd.exe
  C:\Windows\System\jGTvlBd.exe
  2⤵
  PID:3776
- C:\Windows\System\kEjXiVP.exe
  C:\Windows\System\kEjXiVP.exe
  2⤵
  PID:3956
- C:\Windows\System\oNGHjJY.exe
  C:\Windows\System\oNGHjJY.exe
  2⤵
  PID:4000
- C:\Windows\System\VLQIvox.exe
  C:\Windows\System\VLQIvox.exe
  2⤵
  PID:4032
- C:\Windows\System\AbBUKze.exe
  C:\Windows\System\AbBUKze.exe
  2⤵
  PID:4052
- C:\Windows\System\wlIWVtj.exe
  C:\Windows\System\wlIWVtj.exe
  2⤵
  PID:3292
- C:\Windows\System\FZimVGE.exe
  C:\Windows\System\FZimVGE.exe
  2⤵
  PID:3156
- C:\Windows\System\bAPJhGW.exe
  C:\Windows\System\bAPJhGW.exe
  2⤵
  PID:3356
- C:\Windows\System\mpDbcEb.exe
  C:\Windows\System\mpDbcEb.exe
  2⤵
  PID:3116
- C:\Windows\System\mfQHivb.exe
  C:\Windows\System\mfQHivb.exe
  2⤵
  PID:3428
- C:\Windows\System\CATVCEi.exe
  C:\Windows\System\CATVCEi.exe
  2⤵
  PID:2972
- C:\Windows\System\IvtWoIS.exe
  C:\Windows\System\IvtWoIS.exe
  2⤵
  PID:3556
- C:\Windows\System\yAtrBda.exe
  C:\Windows\System\yAtrBda.exe
  2⤵
  PID:3760
- C:\Windows\System\BnPKIdc.exe
  C:\Windows\System\BnPKIdc.exe
  2⤵
  PID:3652
- C:\Windows\System\WathsIi.exe
  C:\Windows\System\WathsIi.exe
  2⤵
  PID:3820
- C:\Windows\System\nOJcoIu.exe
  C:\Windows\System\nOJcoIu.exe
  2⤵
  PID:3892
- C:\Windows\System\Avanebp.exe
  C:\Windows\System\Avanebp.exe
  2⤵
  PID:3972
- C:\Windows\System\GhTbhAD.exe
  C:\Windows\System\GhTbhAD.exe
  2⤵
  PID:3996
- C:\Windows\System\lumuTCS.exe
  C:\Windows\System\lumuTCS.exe
  2⤵
  PID:3096
- C:\Windows\System\tPLYpkJ.exe
  C:\Windows\System\tPLYpkJ.exe
  2⤵
  PID:3220
- C:\Windows\System\xHzCkiV.exe
  C:\Windows\System\xHzCkiV.exe
  2⤵
  PID:3504
- C:\Windows\System\FbwziQJ.exe
  C:\Windows\System\FbwziQJ.exe
  2⤵
  PID:3596
- C:\Windows\System\QzXLXer.exe
  C:\Windows\System\QzXLXer.exe
  2⤵
  PID:3660
- C:\Windows\System\XqBKCcH.exe
  C:\Windows\System\XqBKCcH.exe
  2⤵
  PID:3940
- C:\Windows\System\GmhgpDl.exe
  C:\Windows\System\GmhgpDl.exe
  2⤵
  PID:3260
- C:\Windows\System\CHFTUJZ.exe
  C:\Windows\System\CHFTUJZ.exe
  2⤵
  PID:3872
- C:\Windows\System\iRBPGNn.exe
  C:\Windows\System\iRBPGNn.exe
  2⤵
  PID:3552
- C:\Windows\System\FDZFGKv.exe
  C:\Windows\System\FDZFGKv.exe
  2⤵
  PID:3932
- C:\Windows\System\GZGtcsv.exe
  C:\Windows\System\GZGtcsv.exe
  2⤵
  PID:3328
- C:\Windows\System\mGjJUUA.exe
  C:\Windows\System\mGjJUUA.exe
  2⤵
  PID:3388
- C:\Windows\System\bdJfNKP.exe
  C:\Windows\System\bdJfNKP.exe
  2⤵
  PID:1732
- C:\Windows\System\wRAICOI.exe
  C:\Windows\System\wRAICOI.exe
  2⤵
  PID:3840
- C:\Windows\System\WUqsNWN.exe
  C:\Windows\System\WUqsNWN.exe
  2⤵
  PID:3272
- C:\Windows\System\fkcESeE.exe
  C:\Windows\System\fkcESeE.exe
  2⤵
  PID:3756
- C:\Windows\System\YUapDCB.exe
  C:\Windows\System\YUapDCB.exe
  2⤵
  PID:4108
- C:\Windows\System\URcgKGB.exe
  C:\Windows\System\URcgKGB.exe
  2⤵
  PID:4124
- C:\Windows\System\HLYUVzK.exe
  C:\Windows\System\HLYUVzK.exe
  2⤵
  PID:4140
- C:\Windows\System\hzERqVX.exe
  C:\Windows\System\hzERqVX.exe
  2⤵
  PID:4156
- C:\Windows\System\jUruIcz.exe
  C:\Windows\System\jUruIcz.exe
  2⤵
  PID:4172
- C:\Windows\System\eEaarfC.exe
  C:\Windows\System\eEaarfC.exe
  2⤵
  PID:4188
- C:\Windows\System\ntwPwEA.exe
  C:\Windows\System\ntwPwEA.exe
  2⤵
  PID:4208
- C:\Windows\System\aRZlDyJ.exe
  C:\Windows\System\aRZlDyJ.exe
  2⤵
  PID:4228
- C:\Windows\System\keJdrlA.exe
  C:\Windows\System\keJdrlA.exe
  2⤵
  PID:4276
- C:\Windows\System\kLIqhlM.exe
  C:\Windows\System\kLIqhlM.exe
  2⤵
  PID:4292
- C:\Windows\System\ZWdLwXh.exe
  C:\Windows\System\ZWdLwXh.exe
  2⤵
  PID:4308
- C:\Windows\System\vYlTAxx.exe
  C:\Windows\System\vYlTAxx.exe
  2⤵
  PID:4324
- C:\Windows\System\lpSxOOe.exe
  C:\Windows\System\lpSxOOe.exe
  2⤵
  PID:4344
- C:\Windows\System\SznJTyy.exe
  C:\Windows\System\SznJTyy.exe
  2⤵
  PID:4364
- C:\Windows\System\VLAOgKz.exe
  C:\Windows\System\VLAOgKz.exe
  2⤵
  PID:4380
- C:\Windows\System\dWUqadn.exe
  C:\Windows\System\dWUqadn.exe
  2⤵
  PID:4396
- C:\Windows\System\yiFnkKk.exe
  C:\Windows\System\yiFnkKk.exe
  2⤵
  PID:4412
- C:\Windows\System\QwxusIa.exe
  C:\Windows\System\QwxusIa.exe
  2⤵
  PID:4428
- C:\Windows\System\zfOArqH.exe
  C:\Windows\System\zfOArqH.exe
  2⤵
  PID:4444
- C:\Windows\System\pEcpqjT.exe
  C:\Windows\System\pEcpqjT.exe
  2⤵
  PID:4460
- C:\Windows\System\ToFaspl.exe
  C:\Windows\System\ToFaspl.exe
  2⤵
  PID:4476
- C:\Windows\System\jmZDZwV.exe
  C:\Windows\System\jmZDZwV.exe
  2⤵
  PID:4492
- C:\Windows\System\ywPlslk.exe
  C:\Windows\System\ywPlslk.exe
  2⤵
  PID:4508
- C:\Windows\System\YhvKrjT.exe
  C:\Windows\System\YhvKrjT.exe
  2⤵
  PID:4524
- C:\Windows\System\VaqtMDT.exe
  C:\Windows\System\VaqtMDT.exe
  2⤵
  PID:4540
- C:\Windows\System\ZnFpjvx.exe
  C:\Windows\System\ZnFpjvx.exe
  2⤵
  PID:4556
- C:\Windows\System\QmlcLXL.exe
  C:\Windows\System\QmlcLXL.exe
  2⤵
  PID:4572
- C:\Windows\System\srDJZsi.exe
  C:\Windows\System\srDJZsi.exe
  2⤵
  PID:4588
- C:\Windows\System\uSRuWtR.exe
  C:\Windows\System\uSRuWtR.exe
  2⤵
  PID:4604
- C:\Windows\System\SOdqort.exe
  C:\Windows\System\SOdqort.exe
  2⤵
  PID:4620
- C:\Windows\System\kHfwDlH.exe
  C:\Windows\System\kHfwDlH.exe
  2⤵
  PID:4636
- C:\Windows\System\sLLWttf.exe
  C:\Windows\System\sLLWttf.exe
  2⤵
  PID:4652
- C:\Windows\System\mVSOMjm.exe
  C:\Windows\System\mVSOMjm.exe
  2⤵
  PID:4668
- C:\Windows\System\fcrtVQh.exe
  C:\Windows\System\fcrtVQh.exe
  2⤵
  PID:4684
- C:\Windows\System\UHyZzZh.exe
  C:\Windows\System\UHyZzZh.exe
  2⤵
  PID:4700
- C:\Windows\System\BctbzAm.exe
  C:\Windows\System\BctbzAm.exe
  2⤵
  PID:4716
- C:\Windows\System\wDGEzhY.exe
  C:\Windows\System\wDGEzhY.exe
  2⤵
  PID:4732
- C:\Windows\System\SeOTvci.exe
  C:\Windows\System\SeOTvci.exe
  2⤵
  PID:4748
- C:\Windows\System\ypBABvq.exe
  C:\Windows\System\ypBABvq.exe
  2⤵
  PID:4764
- C:\Windows\System\DfNuRAv.exe
  C:\Windows\System\DfNuRAv.exe
  2⤵
  PID:4780
- C:\Windows\System\FmLGwKe.exe
  C:\Windows\System\FmLGwKe.exe
  2⤵
  PID:4796
- C:\Windows\System\WrcSOtM.exe
  C:\Windows\System\WrcSOtM.exe
  2⤵
  PID:4812
- C:\Windows\System\mnTzmWl.exe
  C:\Windows\System\mnTzmWl.exe
  2⤵
  PID:4828
- C:\Windows\System\DSCjgmR.exe
  C:\Windows\System\DSCjgmR.exe
  2⤵
  PID:4844
- C:\Windows\System\hMPUjDd.exe
  C:\Windows\System\hMPUjDd.exe
  2⤵
  PID:4860
- C:\Windows\System\ailazPq.exe
  C:\Windows\System\ailazPq.exe
  2⤵
  PID:4880
- C:\Windows\System\aPaOXBY.exe
  C:\Windows\System\aPaOXBY.exe
  2⤵
  PID:4896
- C:\Windows\System\WQWMoOP.exe
  C:\Windows\System\WQWMoOP.exe
  2⤵
  PID:4912
- C:\Windows\System\giKiUMA.exe
  C:\Windows\System\giKiUMA.exe
  2⤵
  PID:4928
- C:\Windows\System\RhnXNzI.exe
  C:\Windows\System\RhnXNzI.exe
  2⤵
  PID:4944
- C:\Windows\System\adJlXRi.exe
  C:\Windows\System\adJlXRi.exe
  2⤵
  PID:4960
- C:\Windows\System\xXIYsve.exe
  C:\Windows\System\xXIYsve.exe
  2⤵
  PID:4976
- C:\Windows\System\XtbYuwP.exe
  C:\Windows\System\XtbYuwP.exe
  2⤵
  PID:4992
- C:\Windows\System\OlkvpOc.exe
  C:\Windows\System\OlkvpOc.exe
  2⤵
  PID:5008
- C:\Windows\System\KQnubrv.exe
  C:\Windows\System\KQnubrv.exe
  2⤵
  PID:5024
- C:\Windows\System\ldriltW.exe
  C:\Windows\System\ldriltW.exe
  2⤵
  PID:5040
- C:\Windows\System\PfyWBxx.exe
  C:\Windows\System\PfyWBxx.exe
  2⤵
  PID:5056
- C:\Windows\System\ULFrCuz.exe
  C:\Windows\System\ULFrCuz.exe
  2⤵
  PID:5072
- C:\Windows\System\juMVeQO.exe
  C:\Windows\System\juMVeQO.exe
  2⤵
  PID:5088
- C:\Windows\System\ofVbhji.exe
  C:\Windows\System\ofVbhji.exe
  2⤵
  PID:5104
- C:\Windows\System\XxPptxk.exe
  C:\Windows\System\XxPptxk.exe
  2⤵
  PID:4060
- C:\Windows\System\rlAFpNk.exe
  C:\Windows\System\rlAFpNk.exe
  2⤵
  PID:4132
- C:\Windows\System\EiprxYP.exe
  C:\Windows\System\EiprxYP.exe
  2⤵
  PID:4196
- C:\Windows\System\pRwZTJd.exe
  C:\Windows\System\pRwZTJd.exe
  2⤵
  PID:3316
- C:\Windows\System\dEYswcV.exe
  C:\Windows\System\dEYswcV.exe
  2⤵
  PID:4184
- C:\Windows\System\sWwZzOs.exe
  C:\Windows\System\sWwZzOs.exe
  2⤵
  PID:4224
- C:\Windows\System\YmNpwdv.exe
  C:\Windows\System\YmNpwdv.exe
  2⤵
  PID:4248
- C:\Windows\System\zXFbWqC.exe
  C:\Windows\System\zXFbWqC.exe
  2⤵
  PID:316
- C:\Windows\System\YNTsGHI.exe
  C:\Windows\System\YNTsGHI.exe
  2⤵
  PID:4272
- C:\Windows\System\YSzYKDV.exe
  C:\Windows\System\YSzYKDV.exe
  2⤵
  PID:4304
- C:\Windows\System\OIDIZvZ.exe
  C:\Windows\System\OIDIZvZ.exe
  2⤵
  PID:4320
- C:\Windows\System\saRqIsZ.exe
  C:\Windows\System\saRqIsZ.exe
  2⤵
  PID:4404
- C:\Windows\System\oNhsSZF.exe
  C:\Windows\System\oNhsSZF.exe
  2⤵
  PID:4356
- C:\Windows\System\eEiglpf.exe
  C:\Windows\System\eEiglpf.exe
  2⤵
  PID:4468
- C:\Windows\System\Rvucutj.exe
  C:\Windows\System\Rvucutj.exe
  2⤵
  PID:4388
- C:\Windows\System\fqxYsbh.exe
  C:\Windows\System\fqxYsbh.exe
  2⤵
  PID:4500
- C:\Windows\System\wEOVVzt.exe
  C:\Windows\System\wEOVVzt.exe
  2⤵
  PID:4564
- C:\Windows\System\PhcDBQj.exe
  C:\Windows\System\PhcDBQj.exe
  2⤵
  PID:4596
- C:\Windows\System\MJTXWie.exe
  C:\Windows\System\MJTXWie.exe
  2⤵
  PID:4612
- C:\Windows\System\AjrCovk.exe
  C:\Windows\System\AjrCovk.exe
  2⤵
  PID:4664
- C:\Windows\System\rFnXOhR.exe
  C:\Windows\System\rFnXOhR.exe
  2⤵
  PID:4696
- C:\Windows\System\XKeycIu.exe
  C:\Windows\System\XKeycIu.exe
  2⤵
  PID:4760
- C:\Windows\System\HxUtgFV.exe
  C:\Windows\System\HxUtgFV.exe
  2⤵
  PID:4792
- C:\Windows\System\eqYbaRl.exe
  C:\Windows\System\eqYbaRl.exe
  2⤵
  PID:4708
- C:\Windows\System\kAtiGHS.exe
  C:\Windows\System\kAtiGHS.exe
  2⤵
  PID:4648
- C:\Windows\System\iJmBOrx.exe
  C:\Windows\System\iJmBOrx.exe
  2⤵
  PID:4888
- C:\Windows\System\NmGrvlm.exe
  C:\Windows\System\NmGrvlm.exe
  2⤵
  PID:4804
- C:\Windows\System\XbDKRlL.exe
  C:\Windows\System\XbDKRlL.exe
  2⤵
  PID:4876
- C:\Windows\System\rdrCieZ.exe
  C:\Windows\System\rdrCieZ.exe
  2⤵
  PID:4952
- C:\Windows\System\YtgpOdJ.exe
  C:\Windows\System\YtgpOdJ.exe
  2⤵
  PID:4988
- C:\Windows\System\NnSIyVK.exe
  C:\Windows\System\NnSIyVK.exe
  2⤵
  PID:5048
- C:\Windows\System\BMjDKDq.exe
  C:\Windows\System\BMjDKDq.exe
  2⤵
  PID:4972
- C:\Windows\System\FrKdnCE.exe
  C:\Windows\System\FrKdnCE.exe
  2⤵
  PID:5064
- C:\Windows\System\vAdWGYq.exe
  C:\Windows\System\vAdWGYq.exe
  2⤵
  PID:5084
- C:\Windows\System\qKBluuZ.exe
  C:\Windows\System\qKBluuZ.exe
  2⤵
  PID:4168
- C:\Windows\System\diXSJgS.exe
  C:\Windows\System\diXSJgS.exe
  2⤵
  PID:3916
- C:\Windows\System\KBdBIBk.exe
  C:\Windows\System\KBdBIBk.exe
  2⤵
  PID:4180
- C:\Windows\System\VZYJCYu.exe
  C:\Windows\System\VZYJCYu.exe
  2⤵
  PID:4120
- C:\Windows\System\vAvdNDz.exe
  C:\Windows\System\vAvdNDz.exe
  2⤵
  PID:4336
- C:\Windows\System\LPKXAgg.exe
  C:\Windows\System\LPKXAgg.exe
  2⤵
  PID:4420
- C:\Windows\System\LyPFQTH.exe
  C:\Windows\System\LyPFQTH.exe
  2⤵
  PID:4536
- C:\Windows\System\kEFabKR.exe
  C:\Windows\System\kEFabKR.exe
  2⤵
  PID:4548
- C:\Windows\System\zYmejeF.exe
  C:\Windows\System\zYmejeF.exe
  2⤵
  PID:4456
- C:\Windows\System\wJUAPAW.exe
  C:\Windows\System\wJUAPAW.exe
  2⤵
  PID:4772
- C:\Windows\System\SzTkKhL.exe
  C:\Windows\System\SzTkKhL.exe
  2⤵
  PID:4756
- C:\Windows\System\VSxeQPD.exe
  C:\Windows\System\VSxeQPD.exe
  2⤵
  PID:5016
- C:\Windows\System\FcqRISX.exe
  C:\Windows\System\FcqRISX.exe
  2⤵
  PID:4744
- C:\Windows\System\LITsHZb.exe
  C:\Windows\System\LITsHZb.exe
  2⤵
  PID:5068
- C:\Windows\System\PEVkTtg.exe
  C:\Windows\System\PEVkTtg.exe
  2⤵
  PID:4552
- C:\Windows\System\ZmKbAeF.exe
  C:\Windows\System\ZmKbAeF.exe
  2⤵
  PID:4236
- C:\Windows\System\OPMBbRo.exe
  C:\Windows\System\OPMBbRo.exe
  2⤵
  PID:1312
- C:\Windows\System\KjBvRYR.exe
  C:\Windows\System\KjBvRYR.exe
  2⤵
  PID:4484
- C:\Windows\System\IwYudQK.exe
  C:\Windows\System\IwYudQK.exe
  2⤵
  PID:4940
- C:\Windows\System\uyCmtLb.exe
  C:\Windows\System\uyCmtLb.exe
  2⤵
  PID:4856
- C:\Windows\System\YZvJvHh.exe
  C:\Windows\System\YZvJvHh.exe
  2⤵
  PID:2112
- C:\Windows\System\XTXglnU.exe
  C:\Windows\System\XTXglnU.exe
  2⤵
  PID:5100
- C:\Windows\System\CwHLDJF.exe
  C:\Windows\System\CwHLDJF.exe
  2⤵
  PID:4240
- C:\Windows\System\ZhfSinT.exe
  C:\Windows\System\ZhfSinT.exe
  2⤵
  PID:4872
- C:\Windows\System\AeLdOcT.exe
  C:\Windows\System\AeLdOcT.exe
  2⤵
  PID:4836
- C:\Windows\System\OzRfUZC.exe
  C:\Windows\System\OzRfUZC.exe
  2⤵
  PID:4164
- C:\Windows\System\tDCVBmj.exe
  C:\Windows\System\tDCVBmj.exe
  2⤵
  PID:4924
- C:\Windows\System\VlPxeCf.exe
  C:\Windows\System\VlPxeCf.exe
  2⤵
  PID:5136
- C:\Windows\System\PxPXuct.exe
  C:\Windows\System\PxPXuct.exe
  2⤵
  PID:5152
- C:\Windows\System\ksqJVPg.exe
  C:\Windows\System\ksqJVPg.exe
  2⤵
  PID:5168
- C:\Windows\System\CqSlzHz.exe
  C:\Windows\System\CqSlzHz.exe
  2⤵
  PID:5184
- C:\Windows\System\qusgaKL.exe
  C:\Windows\System\qusgaKL.exe
  2⤵
  PID:5200
- C:\Windows\System\bcOSlwN.exe
  C:\Windows\System\bcOSlwN.exe
  2⤵
  PID:5220
- C:\Windows\System\zPMxrEF.exe
  C:\Windows\System\zPMxrEF.exe
  2⤵
  PID:5236
- C:\Windows\System\kLIHETC.exe
  C:\Windows\System\kLIHETC.exe
  2⤵
  PID:5252
- C:\Windows\System\CiDRkLX.exe
  C:\Windows\System\CiDRkLX.exe
  2⤵
  PID:5268
- C:\Windows\System\NynzJmO.exe
  C:\Windows\System\NynzJmO.exe
  2⤵
  PID:5288
- C:\Windows\System\GLECdZx.exe
  C:\Windows\System\GLECdZx.exe
  2⤵
  PID:5304
- C:\Windows\System\JmhnhRV.exe
  C:\Windows\System\JmhnhRV.exe
  2⤵
  PID:5320
- C:\Windows\System\mZIpfVD.exe
  C:\Windows\System\mZIpfVD.exe
  2⤵
  PID:5336
- C:\Windows\System\qjpCyny.exe
  C:\Windows\System\qjpCyny.exe
  2⤵
  PID:5356
- C:\Windows\System\AkmISmP.exe
  C:\Windows\System\AkmISmP.exe
  2⤵
  PID:5372
- C:\Windows\System\lXAEWCW.exe
  C:\Windows\System\lXAEWCW.exe
  2⤵
  PID:5388
- C:\Windows\System\WNXaZmK.exe
  C:\Windows\System\WNXaZmK.exe
  2⤵
  PID:5404
- C:\Windows\System\kwrfdHs.exe
  C:\Windows\System\kwrfdHs.exe
  2⤵
  PID:5420
- C:\Windows\System\GrPJTLl.exe
  C:\Windows\System\GrPJTLl.exe
  2⤵
  PID:5436
- C:\Windows\System\ngbKmvm.exe
  C:\Windows\System\ngbKmvm.exe
  2⤵
  PID:5452
- C:\Windows\System\MgRaNqc.exe
  C:\Windows\System\MgRaNqc.exe
  2⤵
  PID:5468
- C:\Windows\System\pPlUsQu.exe
  C:\Windows\System\pPlUsQu.exe
  2⤵
  PID:5484
- C:\Windows\System\eJHckob.exe
  C:\Windows\System\eJHckob.exe
  2⤵
  PID:5500
- C:\Windows\System\zjGLPdZ.exe
  C:\Windows\System\zjGLPdZ.exe
  2⤵
  PID:5516
- C:\Windows\System\ayzxsoE.exe
  C:\Windows\System\ayzxsoE.exe
  2⤵
  PID:5532
- C:\Windows\System\yLHcESK.exe
  C:\Windows\System\yLHcESK.exe
  2⤵
  PID:5548
- C:\Windows\System\kremVrT.exe
  C:\Windows\System\kremVrT.exe
  2⤵
  PID:5568
- C:\Windows\System\JCVUGoh.exe
  C:\Windows\System\JCVUGoh.exe
  2⤵
  PID:5584
- C:\Windows\System\RBTlMaA.exe
  C:\Windows\System\RBTlMaA.exe
  2⤵
  PID:5600
- C:\Windows\System\OkrqhaD.exe
  C:\Windows\System\OkrqhaD.exe
  2⤵
  PID:5616
- C:\Windows\System\AasExye.exe
  C:\Windows\System\AasExye.exe
  2⤵
  PID:5632
- C:\Windows\System\qHvMfJf.exe
  C:\Windows\System\qHvMfJf.exe
  2⤵
  PID:5648
- C:\Windows\System\OFSOzZF.exe
  C:\Windows\System\OFSOzZF.exe
  2⤵
  PID:5664
- C:\Windows\System\ZqQLzCv.exe
  C:\Windows\System\ZqQLzCv.exe
  2⤵
  PID:5680
- C:\Windows\System\Yshpmwn.exe
  C:\Windows\System\Yshpmwn.exe
  2⤵
  PID:5696
- C:\Windows\System\tYHuCST.exe
  C:\Windows\System\tYHuCST.exe
  2⤵
  PID:5728
- C:\Windows\System\nbycWZG.exe
  C:\Windows\System\nbycWZG.exe
  2⤵
  PID:5748
- C:\Windows\System\WNtDToM.exe
  C:\Windows\System\WNtDToM.exe
  2⤵
  PID:5816
- C:\Windows\System\tbLBEVD.exe
  C:\Windows\System\tbLBEVD.exe
  2⤵
  PID:5832
- C:\Windows\System\IvmcYUP.exe
  C:\Windows\System\IvmcYUP.exe
  2⤵
  PID:5848
- C:\Windows\System\qoEhryz.exe
  C:\Windows\System\qoEhryz.exe
  2⤵
  PID:5868
- C:\Windows\System\aPRLZvP.exe
  C:\Windows\System\aPRLZvP.exe
  2⤵
  PID:5884
- C:\Windows\System\XwErZhg.exe
  C:\Windows\System\XwErZhg.exe
  2⤵
  PID:5900
- C:\Windows\System\qeFLish.exe
  C:\Windows\System\qeFLish.exe
  2⤵
  PID:5916
- C:\Windows\System\BQgYleq.exe
  C:\Windows\System\BQgYleq.exe
  2⤵
  PID:5932
- C:\Windows\System\fKVnYXJ.exe
  C:\Windows\System\fKVnYXJ.exe
  2⤵
  PID:5948
- C:\Windows\System\ZzvneLI.exe
  C:\Windows\System\ZzvneLI.exe
  2⤵
  PID:5964
- C:\Windows\System\VKVBDJN.exe
  C:\Windows\System\VKVBDJN.exe
  2⤵
  PID:5980
- C:\Windows\System\WctGKzz.exe
  C:\Windows\System\WctGKzz.exe
  2⤵
  PID:5996
- C:\Windows\System\BOGCopb.exe
  C:\Windows\System\BOGCopb.exe
  2⤵
  PID:6012
- C:\Windows\System\EZTRuhW.exe
  C:\Windows\System\EZTRuhW.exe
  2⤵
  PID:6028
- C:\Windows\System\WlAXRzZ.exe
  C:\Windows\System\WlAXRzZ.exe
  2⤵
  PID:4632
- C:\Windows\System\bfgOCrT.exe
  C:\Windows\System\bfgOCrT.exe
  2⤵
  PID:5144
- C:\Windows\System\gNuECJM.exe
  C:\Windows\System\gNuECJM.exe
  2⤵
  PID:5176
- C:\Windows\System\KIpQAIK.exe
  C:\Windows\System\KIpQAIK.exe
  2⤵
  PID:5284
- C:\Windows\System\OJhaKNu.exe
  C:\Windows\System\OJhaKNu.exe
  2⤵
  PID:5196
- C:\Windows\System\peYehcG.exe
  C:\Windows\System\peYehcG.exe
  2⤵
  PID:5296
- C:\Windows\System\RyaHtZH.exe
  C:\Windows\System\RyaHtZH.exe
  2⤵
  PID:5416
- C:\Windows\System\CSMByNb.exe
  C:\Windows\System\CSMByNb.exe
  2⤵
  PID:5432
- C:\Windows\System\INYMCqW.exe
  C:\Windows\System\INYMCqW.exe
  2⤵
  PID:5496
- C:\Windows\System\USXjdDV.exe
  C:\Windows\System\USXjdDV.exe
  2⤵
  PID:5580
- C:\Windows\System\TbWfXqT.exe
  C:\Windows\System\TbWfXqT.exe
  2⤵
  PID:5644
- C:\Windows\System\orkuVkE.exe
  C:\Windows\System\orkuVkE.exe
  2⤵
  PID:5560
- C:\Windows\System\dPVtUcW.exe
  C:\Windows\System\dPVtUcW.exe
  2⤵
  PID:5592
- C:\Windows\System\HfMHWUk.exe
  C:\Windows\System\HfMHWUk.exe
  2⤵
  PID:5688
- C:\Windows\System\Xcbzsjm.exe
  C:\Windows\System\Xcbzsjm.exe
  2⤵
  PID:5756
- C:\Windows\System\KwhEBUf.exe
  C:\Windows\System\KwhEBUf.exe
  2⤵
  PID:5740
- C:\Windows\System\RIhXatM.exe
  C:\Windows\System\RIhXatM.exe
  2⤵
  PID:5856
- C:\Windows\System\wnFdRSp.exe
  C:\Windows\System\wnFdRSp.exe
  2⤵
  PID:5860
- C:\Windows\System\gYuGtYV.exe
  C:\Windows\System\gYuGtYV.exe
  2⤵
  PID:5928
- C:\Windows\System\tShXsFf.exe
  C:\Windows\System\tShXsFf.exe
  2⤵
  PID:6024
- C:\Windows\System\MZbCsfT.exe
  C:\Windows\System\MZbCsfT.exe
  2⤵
  PID:6160
- C:\Windows\System\lZkqFFi.exe
  C:\Windows\System\lZkqFFi.exe
  2⤵
  PID:6176
- C:\Windows\System\unlAQCv.exe
  C:\Windows\System\unlAQCv.exe
  2⤵
  PID:6196
- C:\Windows\System\aauUwxB.exe
  C:\Windows\System\aauUwxB.exe
  2⤵
  PID:6212
- C:\Windows\System\BVLxyub.exe
  C:\Windows\System\BVLxyub.exe
  2⤵
  PID:6228
- C:\Windows\System\vZqYNjf.exe
  C:\Windows\System\vZqYNjf.exe
  2⤵
  PID:6248
- C:\Windows\System\MdeHjox.exe
  C:\Windows\System\MdeHjox.exe
  2⤵
  PID:6264
- C:\Windows\System\djHlaCB.exe
  C:\Windows\System\djHlaCB.exe
  2⤵
  PID:6284
- C:\Windows\System\hVBPpsw.exe
  C:\Windows\System\hVBPpsw.exe
  2⤵
  PID:6300
- C:\Windows\System\slyxhoy.exe
  C:\Windows\System\slyxhoy.exe
  2⤵
  PID:6316
- C:\Windows\System\TilJKss.exe
  C:\Windows\System\TilJKss.exe
  2⤵
  PID:6332
- C:\Windows\System\qYRylTi.exe
  C:\Windows\System\qYRylTi.exe
  2⤵
  PID:6352
- C:\Windows\System\NKYOZWe.exe
  C:\Windows\System\NKYOZWe.exe
  2⤵
  PID:6368
- C:\Windows\System\sQsYacz.exe
  C:\Windows\System\sQsYacz.exe
  2⤵
  PID:6412
- C:\Windows\System\bzuZKDu.exe
  C:\Windows\System\bzuZKDu.exe
  2⤵
  PID:6428
- C:\Windows\System\sRngFkp.exe
  C:\Windows\System\sRngFkp.exe
  2⤵
  PID:6444
- C:\Windows\System\zkxLALH.exe
  C:\Windows\System\zkxLALH.exe
  2⤵
  PID:6460
- C:\Windows\System\AWepwWe.exe
  C:\Windows\System\AWepwWe.exe
  2⤵
  PID:6484
- C:\Windows\System\gyiOpjt.exe
  C:\Windows\System\gyiOpjt.exe
  2⤵
  PID:6500
- C:\Windows\System\oouUILC.exe
  C:\Windows\System\oouUILC.exe
  2⤵
  PID:6516
- C:\Windows\System\dxeIrTc.exe
  C:\Windows\System\dxeIrTc.exe
  2⤵
  PID:6536
- C:\Windows\System\TPlEPId.exe
  C:\Windows\System\TPlEPId.exe
  2⤵
  PID:6552
- C:\Windows\System\UMYZiNm.exe
  C:\Windows\System\UMYZiNm.exe
  2⤵
  PID:6568
- C:\Windows\System\GulJeWU.exe
  C:\Windows\System\GulJeWU.exe
  2⤵
  PID:6584
- C:\Windows\System\XEBRYaP.exe
  C:\Windows\System\XEBRYaP.exe
  2⤵
  PID:6600
- C:\Windows\System\pMWKpJn.exe
  C:\Windows\System\pMWKpJn.exe
  2⤵
  PID:6616
- C:\Windows\System\JeuQFiw.exe
  C:\Windows\System\JeuQFiw.exe
  2⤵
  PID:6632
- C:\Windows\System\FvqQdqA.exe
  C:\Windows\System\FvqQdqA.exe
  2⤵
  PID:6648
- C:\Windows\System\wLoVSlo.exe
  C:\Windows\System\wLoVSlo.exe
  2⤵
  PID:6664
- C:\Windows\System\rvLsgtB.exe
  C:\Windows\System\rvLsgtB.exe
  2⤵
  PID:6680
- C:\Windows\System\kHhIpUM.exe
  C:\Windows\System\kHhIpUM.exe
  2⤵
  PID:6696
- C:\Windows\System\UNdqLmT.exe
  C:\Windows\System\UNdqLmT.exe
  2⤵
  PID:6712
- C:\Windows\System\LhmHgpj.exe
  C:\Windows\System\LhmHgpj.exe
  2⤵
  PID:6728
- C:\Windows\System\EnDiHFZ.exe
  C:\Windows\System\EnDiHFZ.exe
  2⤵
  PID:6748
- C:\Windows\System\JTPjCby.exe
  C:\Windows\System\JTPjCby.exe
  2⤵
  PID:6764
- C:\Windows\System\ocisSnY.exe
  C:\Windows\System\ocisSnY.exe
  2⤵
  PID:6780
- C:\Windows\System\oLbYuFd.exe
  C:\Windows\System\oLbYuFd.exe
  2⤵
  PID:6796
- C:\Windows\System\jtMAAuW.exe
  C:\Windows\System\jtMAAuW.exe
  2⤵
  PID:6812
- C:\Windows\System\HfPpcsJ.exe
  C:\Windows\System\HfPpcsJ.exe
  2⤵
  PID:6828
- C:\Windows\System\FXiNrph.exe
  C:\Windows\System\FXiNrph.exe
  2⤵
  PID:6844
- C:\Windows\System\pVhjUyU.exe
  C:\Windows\System\pVhjUyU.exe
  2⤵
  PID:6860
- C:\Windows\System\smwPjUT.exe
  C:\Windows\System\smwPjUT.exe
  2⤵
  PID:6876
- C:\Windows\System\vdywGbO.exe
  C:\Windows\System\vdywGbO.exe
  2⤵
  PID:6892
- C:\Windows\System\fNZvRGt.exe
  C:\Windows\System\fNZvRGt.exe
  2⤵
  PID:6908
- C:\Windows\System\jXYXFME.exe
  C:\Windows\System\jXYXFME.exe
  2⤵
  PID:6924
- C:\Windows\System\tODaSUL.exe
  C:\Windows\System\tODaSUL.exe
  2⤵
  PID:6940
- C:\Windows\System\rLOLWPZ.exe
  C:\Windows\System\rLOLWPZ.exe
  2⤵
  PID:6956
- C:\Windows\System\uSRkAAZ.exe
  C:\Windows\System\uSRkAAZ.exe
  2⤵
  PID:6972
- C:\Windows\System\WGZDjDp.exe
  C:\Windows\System\WGZDjDp.exe
  2⤵
  PID:6988
- C:\Windows\System\JmchRaC.exe
  C:\Windows\System\JmchRaC.exe
  2⤵
  PID:7004
- C:\Windows\System\RMGURZw.exe
  C:\Windows\System\RMGURZw.exe
  2⤵
  PID:7020
- C:\Windows\System\TloBXzm.exe
  C:\Windows\System\TloBXzm.exe
  2⤵
  PID:7036
- C:\Windows\System\filzCla.exe
  C:\Windows\System\filzCla.exe
  2⤵
  PID:7052
- C:\Windows\System\WgzvevB.exe
  C:\Windows\System\WgzvevB.exe
  2⤵
  PID:7068
- C:\Windows\System\pTIetIP.exe
  C:\Windows\System\pTIetIP.exe
  2⤵
  PID:7084
- C:\Windows\System\hgwQXKh.exe
  C:\Windows\System\hgwQXKh.exe
  2⤵
  PID:7100
- C:\Windows\System\HKWkTzi.exe
  C:\Windows\System\HKWkTzi.exe
  2⤵
  PID:7116
- C:\Windows\System\TMDylrt.exe
  C:\Windows\System\TMDylrt.exe
  2⤵
  PID:7132
- C:\Windows\System\rgQFndB.exe
  C:\Windows\System\rgQFndB.exe
  2⤵
  PID:7148
- C:\Windows\System\FTbGkCq.exe
  C:\Windows\System\FTbGkCq.exe
  2⤵
  PID:7164
- C:\Windows\System\QIMPUZR.exe
  C:\Windows\System\QIMPUZR.exe
  2⤵
  PID:5316
- C:\Windows\System\OenJVyw.exe
  C:\Windows\System\OenJVyw.exe
  2⤵
  PID:5428
- C:\Windows\System\bkpNAeR.exe
  C:\Windows\System\bkpNAeR.exe
  2⤵
  PID:5556
- C:\Windows\System\iyWnqhg.exe
  C:\Windows\System\iyWnqhg.exe
  2⤵
  PID:5660
- C:\Windows\System\izQNPkt.exe
  C:\Windows\System\izQNPkt.exe
  2⤵
  PID:6152
- C:\Windows\System\ynAitBT.exe
  C:\Windows\System\ynAitBT.exe
  2⤵
  PID:6220
- C:\Windows\System\PpMwkRD.exe
  C:\Windows\System\PpMwkRD.exe
  2⤵
  PID:5944
- C:\Windows\System\cgHzTRh.exe
  C:\Windows\System\cgHzTRh.exe
  2⤵
  PID:5764
- C:\Windows\System\lkZwAup.exe
  C:\Windows\System\lkZwAup.exe
  2⤵
  PID:5780
- C:\Windows\System\MSIBdtK.exe
  C:\Windows\System\MSIBdtK.exe
  2⤵
  PID:5796
- C:\Windows\System\AVplEXL.exe
  C:\Windows\System\AVplEXL.exe
  2⤵
  PID:5812
- C:\Windows\System\lnJsAqY.exe
  C:\Windows\System\lnJsAqY.exe
  2⤵
  PID:5876
- C:\Windows\System\Ctdvcon.exe
  C:\Windows\System\Ctdvcon.exe
  2⤵
  PID:6004
- C:\Windows\System\bUkLoTT.exe
  C:\Windows\System\bUkLoTT.exe
  2⤵
  PID:6040
- C:\Windows\System\aaIUxXO.exe
  C:\Windows\System\aaIUxXO.exe
  2⤵
  PID:6360
- C:\Windows\System\HvUYcJc.exe
  C:\Windows\System\HvUYcJc.exe
  2⤵
  PID:6064
- C:\Windows\System\KQqfKcd.exe
  C:\Windows\System\KQqfKcd.exe
  2⤵
  PID:6296
- C:\Windows\System\cVaswIc.exe
  C:\Windows\System\cVaswIc.exe
  2⤵
  PID:6080
- C:\Windows\System\TqdDnbH.exe
  C:\Windows\System\TqdDnbH.exe
  2⤵
  PID:6096
- C:\Windows\System\BtnThTC.exe
  C:\Windows\System\BtnThTC.exe
  2⤵
  PID:6112
- C:\Windows\System\ecKcEBB.exe
  C:\Windows\System\ecKcEBB.exe
  2⤵
  PID:6128
- C:\Windows\System\fZjwPwY.exe
  C:\Windows\System\fZjwPwY.exe
  2⤵
  PID:6420
- C:\Windows\System\jzuuPTn.exe
  C:\Windows\System\jzuuPTn.exe
  2⤵
  PID:4852
- C:\Windows\System\OIqPzcG.exe
  C:\Windows\System\OIqPzcG.exe
  2⤵
  PID:5164
- C:\Windows\System\ZssyGGd.exe
  C:\Windows\System\ZssyGGd.exe
  2⤵
  PID:5380
- C:\Windows\System\lVIkMpd.exe
  C:\Windows\System\lVIkMpd.exe
  2⤵
  PID:5708
- C:\Windows\System\sEbbMsp.exe
  C:\Windows\System\sEbbMsp.exe
  2⤵
  PID:5960
- C:\Windows\System\bIXrNSs.exe
  C:\Windows\System\bIXrNSs.exe
  2⤵
  PID:6476
- C:\Windows\System\FElXJIv.exe
  C:\Windows\System\FElXJIv.exe
  2⤵
  PID:5132
- C:\Windows\System\xHkXKPY.exe
  C:\Windows\System\xHkXKPY.exe
  2⤵
  PID:5248
- C:\Windows\System\lvtrlGD.exe
  C:\Windows\System\lvtrlGD.exe
  2⤵
  PID:5328
- C:\Windows\System\HuFaFRC.exe
  C:\Windows\System\HuFaFRC.exe
  2⤵
  PID:5512
- C:\Windows\System\KvqKQjb.exe
  C:\Windows\System\KvqKQjb.exe
  2⤵
  PID:5460
- C:\Windows\System\vVRHDMq.exe
  C:\Windows\System\vVRHDMq.exe
  2⤵
  PID:5208
- C:\Windows\System\EhjRiYk.exe
  C:\Windows\System\EhjRiYk.exe
  2⤵
  PID:6472
- C:\Windows\System\rIStBCt.exe
  C:\Windows\System\rIStBCt.exe
  2⤵
  PID:6348
- C:\Windows\System\UqNfXXX.exe
  C:\Windows\System\UqNfXXX.exe
  2⤵
  PID:6564
- C:\Windows\System\jxYTkRU.exe
  C:\Windows\System\jxYTkRU.exe
  2⤵
  PID:6404
- C:\Windows\System\XDudZhY.exe
  C:\Windows\System\XDudZhY.exe
  2⤵
  PID:6660
- C:\Windows\System\PAZxrns.exe
  C:\Windows\System\PAZxrns.exe
  2⤵
  PID:6724
- C:\Windows\System\aBaSHwH.exe
  C:\Windows\System\aBaSHwH.exe
  2⤵
  PID:6704
- C:\Windows\System\vOpWgMM.exe
  C:\Windows\System\vOpWgMM.exe
  2⤵
  PID:6676
- C:\Windows\System\Kncvdrr.exe
  C:\Windows\System\Kncvdrr.exe
  2⤵
  PID:6544
- C:\Windows\System\lwKZBuk.exe
  C:\Windows\System\lwKZBuk.exe
  2⤵
  PID:6788
- C:\Windows\System\TrpIwkz.exe
  C:\Windows\System\TrpIwkz.exe
  2⤵
  PID:6776
- C:\Windows\System\cuVjwqM.exe
  C:\Windows\System\cuVjwqM.exe
  2⤵
  PID:6836
- C:\Windows\System\SJLteAQ.exe
  C:\Windows\System\SJLteAQ.exe
  2⤵
  PID:6948
- C:\Windows\System\HwukDQh.exe
  C:\Windows\System\HwukDQh.exe
  2⤵
  PID:5924
- C:\Windows\System\NmMaufq.exe
  C:\Windows\System\NmMaufq.exe
  2⤵
  PID:6184
- C:\Windows\System\DWSdAsq.exe
  C:\Windows\System\DWSdAsq.exe
  2⤵
  PID:7092
- C:\Windows\System\QUZLRVi.exe
  C:\Windows\System\QUZLRVi.exe
  2⤵
  PID:5412
- C:\Windows\System\piuxqPk.exe
  C:\Windows\System\piuxqPk.exe
  2⤵
  PID:5976
- C:\Windows\System\LqfbXaC.exe
  C:\Windows\System\LqfbXaC.exe
  2⤵
  PID:5564
- C:\Windows\System\zgTFYJb.exe
  C:\Windows\System\zgTFYJb.exe
  2⤵
  PID:6236
- C:\Windows\System\ZbqHqUL.exe
  C:\Windows\System\ZbqHqUL.exe
  2⤵
  PID:6276
- C:\Windows\System\RaPuPTu.exe
  C:\Windows\System\RaPuPTu.exe
  2⤵
  PID:6388
- C:\Windows\System\EsDIsHY.exe
  C:\Windows\System\EsDIsHY.exe
  2⤵
  PID:6920
- C:\Windows\System\oPowQFk.exe
  C:\Windows\System\oPowQFk.exe
  2⤵
  PID:6048
- C:\Windows\System\jGUJupx.exe
  C:\Windows\System\jGUJupx.exe
  2⤵
  PID:6036
- C:\Windows\System\KeszziN.exe
  C:\Windows\System\KeszziN.exe
  2⤵
  PID:6104
- C:\Windows\System\CfyIxoy.exe
  C:\Windows\System\CfyIxoy.exe
  2⤵
  PID:6456
- C:\Windows\System\wMhIkzw.exe
  C:\Windows\System\wMhIkzw.exe
  2⤵
  PID:6092
- C:\Windows\System\SyFxwSg.exe
  C:\Windows\System\SyFxwSg.exe
  2⤵
  PID:6736
- C:\Windows\System\CMAUjyf.exe
  C:\Windows\System\CMAUjyf.exe
  2⤵
  PID:6468
- C:\Windows\System\acZGSdH.exe
  C:\Windows\System\acZGSdH.exe
  2⤵
  PID:4628
- C:\Windows\System\XuBCDkX.exe
  C:\Windows\System\XuBCDkX.exe
  2⤵
  PID:5160
- C:\Windows\System\riKJvZt.exe
  C:\Windows\System\riKJvZt.exe
  2⤵
  PID:5332
- C:\Windows\System\rgddrFA.exe
  C:\Windows\System\rgddrFA.exe
  2⤵
  PID:5244
- C:\Windows\System\CHIhPqk.exe
  C:\Windows\System\CHIhPqk.exe
  2⤵
  PID:5352
- C:\Windows\System\MkOHRtE.exe
  C:\Windows\System\MkOHRtE.exe
  2⤵
  PID:6508
- C:\Windows\System\XpbNxHq.exe
  C:\Windows\System\XpbNxHq.exe
  2⤵
  PID:6872
- C:\Windows\System\wxOtRfe.exe
  C:\Windows\System\wxOtRfe.exe
  2⤵
  PID:6720
- C:\Windows\System\BFxyldl.exe
  C:\Windows\System\BFxyldl.exe
  2⤵
  PID:6524
- C:\Windows\System\xljkuNI.exe
  C:\Windows\System\xljkuNI.exe
  2⤵
  PID:6344
- C:\Windows\System\txbjoWL.exe
  C:\Windows\System\txbjoWL.exe
  2⤵
  PID:7032
- C:\Windows\System\FMLJfAT.exe
  C:\Windows\System\FMLJfAT.exe
  2⤵
  PID:6840
- C:\Windows\System\slgDOBj.exe
  C:\Windows\System\slgDOBj.exe
  2⤵
  PID:6984
- C:\Windows\System\gKNOPTI.exe
  C:\Windows\System\gKNOPTI.exe
  2⤵
  PID:6324
- C:\Windows\System\YXbmpen.exe
  C:\Windows\System\YXbmpen.exe
  2⤵
  PID:6400
- C:\Windows\System\fGzxmkO.exe
  C:\Windows\System\fGzxmkO.exe
  2⤵
  PID:6532
- C:\Windows\System\TkhLElX.exe
  C:\Windows\System\TkhLElX.exe
  2⤵
  PID:6820
- C:\Windows\System\bUeSVbl.exe
  C:\Windows\System\bUeSVbl.exe
  2⤵
  PID:6280
- C:\Windows\System\dNLQnZV.exe
  C:\Windows\System\dNLQnZV.exe
  2⤵
  PID:6272
- C:\Windows\System\GnVfdmy.exe
  C:\Windows\System\GnVfdmy.exe
  2⤵
  PID:6548
- C:\Windows\System\urVwYdw.exe
  C:\Windows\System\urVwYdw.exe
  2⤵
  PID:6528
- C:\Windows\System\wvYEqIz.exe
  C:\Windows\System\wvYEqIz.exe
  2⤵
  PID:6192
- C:\Windows\System\JYnfjKz.exe
  C:\Windows\System\JYnfjKz.exe
  2⤵
  PID:6440
- C:\Windows\System\lXgWNSu.exe
  C:\Windows\System\lXgWNSu.exe
  2⤵
  PID:6136
- C:\Windows\System\kivSqYQ.exe
  C:\Windows\System\kivSqYQ.exe
  2⤵
  PID:5192
- C:\Windows\System\mlTzjNz.exe
  C:\Windows\System\mlTzjNz.exe
  2⤵
  PID:4288
- C:\Windows\System\iioSVJA.exe
  C:\Windows\System\iioSVJA.exe
  2⤵
  PID:7076
- C:\Windows\System\DXWMiMj.exe
  C:\Windows\System\DXWMiMj.exe
  2⤵
  PID:6884
- C:\Windows\System\xocwFLH.exe
  C:\Windows\System\xocwFLH.exe
  2⤵
  PID:5792
- C:\Windows\System\MZKnyNz.exe
  C:\Windows\System\MZKnyNz.exe
  2⤵
  PID:7184
- C:\Windows\System\kRYdfVw.exe
  C:\Windows\System\kRYdfVw.exe
  2⤵
  PID:7200
- C:\Windows\System\OrrRrdI.exe
  C:\Windows\System\OrrRrdI.exe
  2⤵
  PID:7216
- C:\Windows\System\hEltjMx.exe
  C:\Windows\System\hEltjMx.exe
  2⤵
  PID:7232
- C:\Windows\System\erYzjqm.exe
  C:\Windows\System\erYzjqm.exe
  2⤵
  PID:7248
- C:\Windows\System\JVTjGCN.exe
  C:\Windows\System\JVTjGCN.exe
  2⤵
  PID:7264
- C:\Windows\System\WsVOwha.exe
  C:\Windows\System\WsVOwha.exe
  2⤵
  PID:7280
- C:\Windows\System\PmyGOyg.exe
  C:\Windows\System\PmyGOyg.exe
  2⤵
  PID:7308
- C:\Windows\System\gNsEbmD.exe
  C:\Windows\System\gNsEbmD.exe
  2⤵
  PID:7324
- C:\Windows\System\NpiqFnM.exe
  C:\Windows\System\NpiqFnM.exe
  2⤵
  PID:7344
- C:\Windows\System\ImYFHHi.exe
  C:\Windows\System\ImYFHHi.exe
  2⤵
  PID:7360
- C:\Windows\System\vwuTGPs.exe
  C:\Windows\System\vwuTGPs.exe
  2⤵
  PID:7380
- C:\Windows\System\gVvGaOd.exe
  C:\Windows\System\gVvGaOd.exe
  2⤵
  PID:7400
- C:\Windows\System\ejjtcfA.exe
  C:\Windows\System\ejjtcfA.exe
  2⤵
  PID:7420
- C:\Windows\System\YhXMeSR.exe
  C:\Windows\System\YhXMeSR.exe
  2⤵
  PID:7436
- C:\Windows\System\SNHikrP.exe
  C:\Windows\System\SNHikrP.exe
  2⤵
  PID:7452
- C:\Windows\System\WOpUspi.exe
  C:\Windows\System\WOpUspi.exe
  2⤵
  PID:7472
- C:\Windows\System\snJMfdU.exe
  C:\Windows\System\snJMfdU.exe
  2⤵
  PID:7492
- C:\Windows\System\NGaCRra.exe
  C:\Windows\System\NGaCRra.exe
  2⤵
  PID:7548
- C:\Windows\System\aadvpuH.exe
  C:\Windows\System\aadvpuH.exe
  2⤵
  PID:7564
- C:\Windows\System\AbeOvXw.exe
  C:\Windows\System\AbeOvXw.exe
  2⤵
  PID:7580
- C:\Windows\System\OQGjDxQ.exe
  C:\Windows\System\OQGjDxQ.exe
  2⤵
  PID:7596
- C:\Windows\System\AisJeZQ.exe
  C:\Windows\System\AisJeZQ.exe
  2⤵
  PID:7692
- C:\Windows\System\ilwEfKD.exe
  C:\Windows\System\ilwEfKD.exe
  2⤵
  PID:7840
- C:\Windows\System\SORdyth.exe
  C:\Windows\System\SORdyth.exe
  2⤵
  PID:7856
- C:\Windows\System\hnrsNvd.exe
  C:\Windows\System\hnrsNvd.exe
  2⤵
  PID:7872
- C:\Windows\System\RWorzjC.exe
  C:\Windows\System\RWorzjC.exe
  2⤵
  PID:7888
- C:\Windows\System\yIekTxN.exe
  C:\Windows\System\yIekTxN.exe
  2⤵
  PID:7908
- C:\Windows\System\VveMTjq.exe
  C:\Windows\System\VveMTjq.exe
  2⤵
  PID:7924
- C:\Windows\System\IczoDCv.exe
  C:\Windows\System\IczoDCv.exe
  2⤵
  PID:7940
- C:\Windows\System\OxFFYLX.exe
  C:\Windows\System\OxFFYLX.exe
  2⤵
  PID:7956
- C:\Windows\System\fUNwvNb.exe
  C:\Windows\System\fUNwvNb.exe
  2⤵
  PID:7972
- C:\Windows\System\Xoivaly.exe
  C:\Windows\System\Xoivaly.exe
  2⤵
  PID:7988
- C:\Windows\System\pkmXmmE.exe
  C:\Windows\System\pkmXmmE.exe
  2⤵
  PID:8004
- C:\Windows\System\YGPbyun.exe
  C:\Windows\System\YGPbyun.exe
  2⤵
  PID:8024
- C:\Windows\System\oOGqCTN.exe
  C:\Windows\System\oOGqCTN.exe
  2⤵
  PID:8056
- C:\Windows\System\MsoSHCs.exe
  C:\Windows\System\MsoSHCs.exe
  2⤵
  PID:8084
- C:\Windows\System\ZQCkxZO.exe
  C:\Windows\System\ZQCkxZO.exe
  2⤵
  PID:5808
- C:\Windows\System\UfDZtkD.exe
  C:\Windows\System\UfDZtkD.exe
  2⤵
  PID:7012
- C:\Windows\System\TrrgBCz.exe
  C:\Windows\System\TrrgBCz.exe
  2⤵
  PID:6088
- C:\Windows\System\YFkglzZ.exe
  C:\Windows\System\YFkglzZ.exe
  2⤵
  PID:7224
- C:\Windows\System\upfgdts.exe
  C:\Windows\System\upfgdts.exe
  2⤵
  PID:7196
- C:\Windows\System\apkQPuA.exe
  C:\Windows\System\apkQPuA.exe
  2⤵
  PID:7260
- C:\Windows\System\ATZSivD.exe
  C:\Windows\System\ATZSivD.exe
  2⤵
  PID:6672
- C:\Windows\System\FQfhBoI.exe
  C:\Windows\System\FQfhBoI.exe
  2⤵
  PID:6964
- C:\Windows\System\EwMFHCT.exe
  C:\Windows\System\EwMFHCT.exe
  2⤵
  PID:7300
- C:\Windows\System\cHqoASQ.exe
  C:\Windows\System\cHqoASQ.exe
  2⤵
  PID:6452
- C:\Windows\System\ZXRvoLb.exe
  C:\Windows\System\ZXRvoLb.exe
  2⤵
  PID:6612
- C:\Windows\System\yjoRJla.exe
  C:\Windows\System\yjoRJla.exe
  2⤵
  PID:7060
- C:\Windows\System\KlDmHUb.exe
  C:\Windows\System\KlDmHUb.exe
  2⤵
  PID:7304
- C:\Windows\System\oIEfjwt.exe
  C:\Windows\System\oIEfjwt.exe
  2⤵
  PID:7368
- C:\Windows\System\cZQdLWT.exe
  C:\Windows\System\cZQdLWT.exe
  2⤵
  PID:7108
- C:\Windows\System\CjSivyc.exe
  C:\Windows\System\CjSivyc.exe
  2⤵
  PID:7180
- C:\Windows\System\YiQGYvr.exe
  C:\Windows\System\YiQGYvr.exe
  2⤵
  PID:7408
- C:\Windows\System\OmbGYXI.exe
  C:\Windows\System\OmbGYXI.exe
  2⤵
  PID:7448
- C:\Windows\System\QCAFkJX.exe
  C:\Windows\System\QCAFkJX.exe
  2⤵
  PID:7508
- C:\Windows\System\KdColtL.exe
  C:\Windows\System\KdColtL.exe
  2⤵
  PID:7356
- C:\Windows\System\WLYHlYi.exe
  C:\Windows\System\WLYHlYi.exe
  2⤵
  PID:7396
- C:\Windows\System\aBYpbeT.exe
  C:\Windows\System\aBYpbeT.exe
  2⤵
  PID:7560
- C:\Windows\System\cECFxZL.exe
  C:\Windows\System\cECFxZL.exe
  2⤵
  PID:7460
- C:\Windows\System\MWnXEsY.exe
  C:\Windows\System\MWnXEsY.exe
  2⤵
  PID:7616
- C:\Windows\System\FwcRJrM.exe
  C:\Windows\System\FwcRJrM.exe
  2⤵
  PID:7628
- C:\Windows\System\ACRPUal.exe
  C:\Windows\System\ACRPUal.exe
  2⤵
  PID:7516
- C:\Windows\System\bWuqUvp.exe
  C:\Windows\System\bWuqUvp.exe
  2⤵
  PID:7660
- C:\Windows\System\kmVojRa.exe
  C:\Windows\System\kmVojRa.exe
  2⤵
  PID:7524
- C:\Windows\System\fUUUmKA.exe
  C:\Windows\System\fUUUmKA.exe
  2⤵
  PID:7676
- C:\Windows\System\MwsLqqv.exe
  C:\Windows\System\MwsLqqv.exe
  2⤵
  PID:7680
- C:\Windows\System\auszEkO.exe
  C:\Windows\System\auszEkO.exe
  2⤵
  PID:7684
- C:\Windows\System\pbXyWkZ.exe
  C:\Windows\System\pbXyWkZ.exe
  2⤵
  PID:7016
- C:\Windows\System\bELZjcK.exe
  C:\Windows\System\bELZjcK.exe
  2⤵
  PID:7536
- C:\Windows\System\pZwRpsq.exe
  C:\Windows\System\pZwRpsq.exe
  2⤵
  PID:7724
- C:\Windows\System\HpOWYSJ.exe
  C:\Windows\System\HpOWYSJ.exe
  2⤵
  PID:7720
- C:\Windows\System\LtGdLcL.exe
  C:\Windows\System\LtGdLcL.exe
  2⤵
  PID:7752
- C:\Windows\System\WonUoIC.exe
  C:\Windows\System\WonUoIC.exe
  2⤵
  PID:7868
- C:\Windows\System\KQFiOMQ.exe
  C:\Windows\System\KQFiOMQ.exe
  2⤵
  PID:7772
- C:\Windows\System\ElGqaxg.exe
  C:\Windows\System\ElGqaxg.exe
  2⤵
  PID:7784
- C:\Windows\System\EOVQuvJ.exe
  C:\Windows\System\EOVQuvJ.exe
  2⤵
  PID:7800
- C:\Windows\System\nVxfosv.exe
  C:\Windows\System\nVxfosv.exe
  2⤵
  PID:7820
- C:\Windows\System\UclYDBZ.exe
  C:\Windows\System\UclYDBZ.exe
  2⤵
  PID:7836
- C:\Windows\System\vhTgszb.exe
  C:\Windows\System\vhTgszb.exe
  2⤵
  PID:7932
- C:\Windows\System\RYEwAFQ.exe
  C:\Windows\System\RYEwAFQ.exe
  2⤵
  PID:7996
- C:\Windows\System\etXtBYv.exe
  C:\Windows\System\etXtBYv.exe
  2⤵
  PID:7884
- C:\Windows\System\FkwMiMH.exe
  C:\Windows\System\FkwMiMH.exe
  2⤵
  PID:7952
- C:\Windows\System\PzWKCkf.exe
  C:\Windows\System\PzWKCkf.exe
  2⤵
  PID:8020
- C:\Windows\System\xZyWIVM.exe
  C:\Windows\System\xZyWIVM.exe
  2⤵
  PID:8036
- C:\Windows\System\WnmuxSL.exe
  C:\Windows\System\WnmuxSL.exe
  2⤵
  PID:8092
- C:\Windows\System\yHSjLeY.exe
  C:\Windows\System\yHSjLeY.exe
  2⤵
  PID:8080
- C:\Windows\System\TbYYGzZ.exe
  C:\Windows\System\TbYYGzZ.exe
  2⤵
  PID:7256
- C:\Windows\System\obRhFHP.exe
  C:\Windows\System\obRhFHP.exe
  2⤵
  PID:6808
- C:\Windows\System\sdduiNx.exe
  C:\Windows\System\sdduiNx.exe
  2⤵
  PID:5384
- C:\Windows\System\DewwnBH.exe
  C:\Windows\System\DewwnBH.exe
  2⤵
  PID:7340
- C:\Windows\System\ihxJEFd.exe
  C:\Windows\System\ihxJEFd.exe
  2⤵
  PID:7556
- C:\Windows\System\KpgpEUS.exe
  C:\Windows\System\KpgpEUS.exe
  2⤵
  PID:7592
- C:\Windows\System\uKcvTEd.exe
  C:\Windows\System\uKcvTEd.exe
  2⤵
  PID:7700
- C:\Windows\System\byXRXSk.exe
  C:\Windows\System\byXRXSk.exe
  2⤵
  PID:7668
- C:\Windows\System\xJiINwQ.exe
  C:\Windows\System\xJiINwQ.exe
  2⤵
  PID:7736
- C:\Windows\System\YCpewLa.exe
  C:\Windows\System\YCpewLa.exe
  2⤵
  PID:7832
- C:\Windows\System\kgZIqVU.exe
  C:\Windows\System\kgZIqVU.exe
  2⤵
  PID:6772
- C:\Windows\System\wWdOUcV.exe
  C:\Windows\System\wWdOUcV.exe
  2⤵
  PID:6888
- C:\Windows\System\qkIAwVN.exe
  C:\Windows\System\qkIAwVN.exe
  2⤵
  PID:8144
- C:\Windows\System\FeMXYPY.exe
  C:\Windows\System\FeMXYPY.exe
  2⤵
  PID:8160
- C:\Windows\System\sZhMbig.exe
  C:\Windows\System\sZhMbig.exe
  2⤵
  PID:8180
- C:\Windows\System\cCTvoiM.exe
  C:\Windows\System\cCTvoiM.exe
  2⤵
  PID:5216
- C:\Windows\System\mOYsEGn.exe
  C:\Windows\System\mOYsEGn.exe
  2⤵
  PID:7444
- C:\Windows\System\yoLFIlA.exe
  C:\Windows\System\yoLFIlA.exe
  2⤵
  PID:7604
- C:\Windows\System\mTYeutY.exe
  C:\Windows\System\mTYeutY.exe
  2⤵
  PID:7732
- C:\Windows\System\VooDQyO.exe
  C:\Windows\System\VooDQyO.exe
  2⤵
  PID:7240
- C:\Windows\System\fCdoiFU.exe
  C:\Windows\System\fCdoiFU.exe
  2⤵
  PID:7484
- C:\Windows\System\ZlEUCjj.exe
  C:\Windows\System\ZlEUCjj.exe
  2⤵
  PID:7504
- C:\Windows\System\IWfnXsr.exe
  C:\Windows\System\IWfnXsr.exe
  2⤵
  PID:6108
- C:\Windows\System\feyyDrD.exe
  C:\Windows\System\feyyDrD.exe
  2⤵
  PID:7776
- C:\Windows\System\adVDRJf.exe
  C:\Windows\System\adVDRJf.exe
  2⤵
  PID:8188
- C:\Windows\System\WLODzQs.exe
  C:\Windows\System\WLODzQs.exe
  2⤵
  PID:6060
- C:\Windows\System\rkgIWJF.exe
  C:\Windows\System\rkgIWJF.exe
  2⤵
  PID:8040
- C:\Windows\System\KJnUMhJ.exe
  C:\Windows\System\KJnUMhJ.exe
  2⤵
  PID:7664
- C:\Windows\System\ByYVdtG.exe
  C:\Windows\System\ByYVdtG.exe
  2⤵
  PID:7352
- C:\Windows\System\BUvNOwR.exe
  C:\Windows\System\BUvNOwR.exe
  2⤵
  PID:7808
- C:\Windows\System\NDLskny.exe
  C:\Windows\System\NDLskny.exe
  2⤵
  PID:8156
- C:\Windows\System\OeNnUQE.exe
  C:\Windows\System\OeNnUQE.exe
  2⤵
  PID:7744
- C:\Windows\System\HTZmTLL.exe
  C:\Windows\System\HTZmTLL.exe
  2⤵
  PID:7708
- C:\Windows\System\epYArjD.exe
  C:\Windows\System\epYArjD.exe
  2⤵
  PID:1076
- C:\Windows\System\XzuFMZk.exe
  C:\Windows\System\XzuFMZk.exe
  2⤵
  PID:7980
- C:\Windows\System\YKfUMmE.exe
  C:\Windows\System\YKfUMmE.exe
  2⤵
  PID:7608
- C:\Windows\System\evhBkFb.exe
  C:\Windows\System\evhBkFb.exe
  2⤵
  PID:7520
- C:\Windows\System\Ewseuic.exe
  C:\Windows\System\Ewseuic.exe
  2⤵
  PID:692
- C:\Windows\System\iZLAlKB.exe
  C:\Windows\System\iZLAlKB.exe
  2⤵
  PID:7540
- C:\Windows\System\DjJHwTV.exe
  C:\Windows\System\DjJHwTV.exe
  2⤵
  PID:7288
- C:\Windows\System\ygzMgcK.exe
  C:\Windows\System\ygzMgcK.exe
  2⤵
  PID:7296
- C:\Windows\System\JCMlWeW.exe
  C:\Windows\System\JCMlWeW.exe
  2⤵
  PID:7760
- C:\Windows\System\xQRqbDj.exe
  C:\Windows\System\xQRqbDj.exe
  2⤵
  PID:7428
- C:\Windows\System\nETyQIv.exe
  C:\Windows\System\nETyQIv.exe
  2⤵
  PID:7964
- C:\Windows\System\gFcDrjK.exe
  C:\Windows\System\gFcDrjK.exe
  2⤵
  PID:8048
- C:\Windows\System\kwXHusy.exe
  C:\Windows\System\kwXHusy.exe
  2⤵
  PID:6076
- C:\Windows\System\UnBLLcg.exe
  C:\Windows\System\UnBLLcg.exe
  2⤵
  PID:8172
- C:\Windows\System\DDobHZY.exe
  C:\Windows\System\DDobHZY.exe
  2⤵
  PID:2348
- C:\Windows\System\kwdSTzY.exe
  C:\Windows\System\kwdSTzY.exe
  2⤵
  PID:7948
- C:\Windows\System\AhLCafL.exe
  C:\Windows\System\AhLCafL.exe
  2⤵
  PID:8152
- C:\Windows\System\AVXdrIQ.exe
  C:\Windows\System\AVXdrIQ.exe
  2⤵
  PID:8184
- C:\Windows\System\CZtPWXG.exe
  C:\Windows\System\CZtPWXG.exe
  2⤵
  PID:7372
- C:\Windows\System\hSuvAOP.exe
  C:\Windows\System\hSuvAOP.exe
  2⤵
  PID:6708
- C:\Windows\System\sXoRUjv.exe
  C:\Windows\System\sXoRUjv.exe
  2⤵
  PID:7292
- C:\Windows\System\TzpBDaa.exe
  C:\Windows\System\TzpBDaa.exe
  2⤵
  PID:8052
- C:\Windows\System\ClTirYw.exe
  C:\Windows\System\ClTirYw.exe
  2⤵
  PID:8176
- C:\Windows\System\qUKyLtw.exe
  C:\Windows\System\qUKyLtw.exe
  2⤵
  PID:1180
- C:\Windows\System\uaVBAKH.exe
  C:\Windows\System\uaVBAKH.exe
  2⤵
  PID:7792
- C:\Windows\System\bdGAVnc.exe
  C:\Windows\System\bdGAVnc.exe
  2⤵
  PID:4956
- C:\Windows\System\OUZFDZx.exe
  C:\Windows\System\OUZFDZx.exe
  2⤵
  PID:8072
- C:\Windows\System\rCFfUVJ.exe
  C:\Windows\System\rCFfUVJ.exe
  2⤵
  PID:8108
- C:\Windows\System\xUPnSmT.exe
  C:\Windows\System\xUPnSmT.exe
  2⤵
  PID:8116
- C:\Windows\System\EekaLsi.exe
  C:\Windows\System\EekaLsi.exe
  2⤵
  PID:7272
- C:\Windows\System\celjimO.exe
  C:\Windows\System\celjimO.exe
  2⤵
  PID:5544
- C:\Windows\System\JoyhNxn.exe
  C:\Windows\System\JoyhNxn.exe
  2⤵
  PID:8012
- C:\Windows\System\LPYlzKd.exe
  C:\Windows\System\LPYlzKd.exe
  2⤵
  PID:7640
- C:\Windows\System\XjzYshk.exe
  C:\Windows\System\XjzYshk.exe
  2⤵
  PID:2004
- C:\Windows\System\iRyxiMt.exe
  C:\Windows\System\iRyxiMt.exe
  2⤵
  PID:2364
- C:\Windows\System\rDFRexH.exe
  C:\Windows\System\rDFRexH.exe
  2⤵
  PID:8032
- C:\Windows\System\HbLdvPV.exe
  C:\Windows\System\HbLdvPV.exe
  2⤵
  PID:8096
- C:\Windows\System\WqVizsI.exe
  C:\Windows\System\WqVizsI.exe
  2⤵
  PID:7880
- C:\Windows\System\iLFHsAQ.exe
  C:\Windows\System\iLFHsAQ.exe
  2⤵
  PID:7920
- C:\Windows\System\NMWQmEr.exe
  C:\Windows\System\NMWQmEr.exe
  2⤵
  PID:536
- C:\Windows\System\WIndiGi.exe
  C:\Windows\System\WIndiGi.exe
  2⤵
  PID:7432
- C:\Windows\System\mlEqQEm.exe
  C:\Windows\System\mlEqQEm.exe
  2⤵
  PID:7212
- C:\Windows\System\qdyxmLP.exe
  C:\Windows\System\qdyxmLP.exe
  2⤵
  PID:8212
- C:\Windows\System\jkKdYWk.exe
  C:\Windows\System\jkKdYWk.exe
  2⤵
  PID:8228
- C:\Windows\System\ZJozfTj.exe
  C:\Windows\System\ZJozfTj.exe
  2⤵
  PID:8244
- C:\Windows\System\qxKApBn.exe
  C:\Windows\System\qxKApBn.exe
  2⤵
  PID:8260
- C:\Windows\System\ozXQRun.exe
  C:\Windows\System\ozXQRun.exe
  2⤵
  PID:8280
- C:\Windows\System\ywUkJEz.exe
  C:\Windows\System\ywUkJEz.exe
  2⤵
  PID:8296
- C:\Windows\System\RHuLntq.exe
  C:\Windows\System\RHuLntq.exe
  2⤵
  PID:8336
- C:\Windows\System\EetVANy.exe
  C:\Windows\System\EetVANy.exe
  2⤵
  PID:8352
- C:\Windows\System\lDbSGbJ.exe
  C:\Windows\System\lDbSGbJ.exe
  2⤵
  PID:8408
- C:\Windows\System\liqgzVA.exe
  C:\Windows\System\liqgzVA.exe
  2⤵
  PID:8432
- C:\Windows\System\tXtSkYh.exe
  C:\Windows\System\tXtSkYh.exe
  2⤵
  PID:8448
- C:\Windows\System\yvdVyzB.exe
  C:\Windows\System\yvdVyzB.exe
  2⤵
  PID:8464
- C:\Windows\System\mXipLzt.exe
  C:\Windows\System\mXipLzt.exe
  2⤵
  PID:8480
- C:\Windows\System\uSTnmKF.exe
  C:\Windows\System\uSTnmKF.exe
  2⤵
  PID:8560
- C:\Windows\System\MemSUzM.exe
  C:\Windows\System\MemSUzM.exe
  2⤵
  PID:8576
- C:\Windows\System\owRErpK.exe
  C:\Windows\System\owRErpK.exe
  2⤵
  PID:8592
- C:\Windows\System\WdFaNjh.exe
  C:\Windows\System\WdFaNjh.exe
  2⤵
  PID:8608
- C:\Windows\System\NNoPsYL.exe
  C:\Windows\System\NNoPsYL.exe
  2⤵
  PID:8628
- C:\Windows\System\TlMNMQt.exe
  C:\Windows\System\TlMNMQt.exe
  2⤵
  PID:8648
- C:\Windows\System\ETlmXjm.exe
  C:\Windows\System\ETlmXjm.exe
  2⤵
  PID:8664
- C:\Windows\System\uXwqZcI.exe
  C:\Windows\System\uXwqZcI.exe
  2⤵
  PID:8680
- C:\Windows\System\IwEHeaU.exe
  C:\Windows\System\IwEHeaU.exe
  2⤵
  PID:8696
- C:\Windows\System\IMkFpOA.exe
  C:\Windows\System\IMkFpOA.exe
  2⤵
  PID:8712
- C:\Windows\System\AUIBZOp.exe
  C:\Windows\System\AUIBZOp.exe
  2⤵
  PID:8728
- C:\Windows\System\EupLdHa.exe
  C:\Windows\System\EupLdHa.exe
  2⤵
  PID:8744
- C:\Windows\System\tbmAiJL.exe
  C:\Windows\System\tbmAiJL.exe
  2⤵
  PID:8760
- C:\Windows\System\FvVDVoy.exe
  C:\Windows\System\FvVDVoy.exe
  2⤵
  PID:8784
- C:\Windows\System\VxBPZCr.exe
  C:\Windows\System\VxBPZCr.exe
  2⤵
  PID:8800
- C:\Windows\System\PZOOyuc.exe
  C:\Windows\System\PZOOyuc.exe
  2⤵
  PID:8820
- C:\Windows\System\DNCznjR.exe
  C:\Windows\System\DNCznjR.exe
  2⤵
  PID:8840
- C:\Windows\System\gNtOqQi.exe
  C:\Windows\System\gNtOqQi.exe
  2⤵
  PID:8856
- C:\Windows\System\TauttjB.exe
  C:\Windows\System\TauttjB.exe
  2⤵
  PID:8872
- C:\Windows\System\PGlBqYo.exe
  C:\Windows\System\PGlBqYo.exe
  2⤵
  PID:8896
- C:\Windows\System\xhBMTOo.exe
  C:\Windows\System\xhBMTOo.exe
  2⤵
  PID:8912
- C:\Windows\System\uGbqsAC.exe
  C:\Windows\System\uGbqsAC.exe
  2⤵
  PID:8968
- C:\Windows\System\msBJihX.exe
  C:\Windows\System\msBJihX.exe
  2⤵
  PID:8984
- C:\Windows\System\RewGXmp.exe
  C:\Windows\System\RewGXmp.exe
  2⤵
  PID:9000
- C:\Windows\System\wNKCsRq.exe
  C:\Windows\System\wNKCsRq.exe
  2⤵
  PID:9020
- C:\Windows\System\OfDDooB.exe
  C:\Windows\System\OfDDooB.exe
  2⤵
  PID:9052
- C:\Windows\System\kmVjpvU.exe
  C:\Windows\System\kmVjpvU.exe
  2⤵
  PID:9068
- C:\Windows\System\fJnBQvZ.exe
  C:\Windows\System\fJnBQvZ.exe
  2⤵
  PID:9084
- C:\Windows\System\hNUvkGw.exe
  C:\Windows\System\hNUvkGw.exe
  2⤵
  PID:9100
- C:\Windows\System\vdTzDOc.exe
  C:\Windows\System\vdTzDOc.exe
  2⤵
  PID:9116
- C:\Windows\System\gAwfeGd.exe
  C:\Windows\System\gAwfeGd.exe
  2⤵
  PID:9136
- C:\Windows\System\xChbUSC.exe
  C:\Windows\System\xChbUSC.exe
  2⤵
  PID:9152
- C:\Windows\System\mPYwyMG.exe
  C:\Windows\System\mPYwyMG.exe
  2⤵
  PID:9208
- C:\Windows\System\ofxqUYS.exe
  C:\Windows\System\ofxqUYS.exe
  2⤵
  PID:8364
- C:\Windows\System\ENVBLdZ.exe
  C:\Windows\System\ENVBLdZ.exe
  2⤵
  PID:8396
- C:\Windows\System\NoMjjAM.exe
  C:\Windows\System\NoMjjAM.exe
  2⤵
  PID:8380
- C:\Windows\System\jhLWoeF.exe
  C:\Windows\System\jhLWoeF.exe
  2⤵
  PID:8348
- C:\Windows\System\ZoxrGek.exe
  C:\Windows\System\ZoxrGek.exe
  2⤵
  PID:8428
- C:\Windows\System\bvhixfK.exe
  C:\Windows\System\bvhixfK.exe
  2⤵
  PID:8492
- C:\Windows\System\qWUBmxC.exe
  C:\Windows\System\qWUBmxC.exe
  2⤵
  PID:8508
- C:\Windows\System\NwPGclK.exe
  C:\Windows\System\NwPGclK.exe
  2⤵
  PID:8516
- C:\Windows\System\ruRaIRx.exe
  C:\Windows\System\ruRaIRx.exe
  2⤵
  PID:8540
- C:\Windows\System\WfePgRm.exe
  C:\Windows\System\WfePgRm.exe
  2⤵
  PID:8584
- C:\Windows\System\nOLidUn.exe
  C:\Windows\System\nOLidUn.exe
  2⤵
  PID:8624
- C:\Windows\System\HxWbLck.exe
  C:\Windows\System\HxWbLck.exe
  2⤵
  PID:8604
- C:\Windows\System\nDOXAay.exe
  C:\Windows\System\nDOXAay.exe
  2⤵
  PID:5656
- C:\Windows\System\vyLFrII.exe
  C:\Windows\System\vyLFrII.exe
  2⤵
  PID:8660
- C:\Windows\System\GqgXyWa.exe
  C:\Windows\System\GqgXyWa.exe
  2⤵
  PID:8724
- C:\Windows\System\TWgAfpV.exe
  C:\Windows\System\TWgAfpV.exe
  2⤵
  PID:8772
- C:\Windows\System\WMnUnXe.exe
  C:\Windows\System\WMnUnXe.exe
  2⤵
  PID:8704
- C:\Windows\System\EXTrvNz.exe
  C:\Windows\System\EXTrvNz.exe
  2⤵
  PID:8796
- C:\Windows\System\yAlAffF.exe
  C:\Windows\System\yAlAffF.exe
  2⤵
  PID:8848
- C:\Windows\System\oNpsxil.exe
  C:\Windows\System\oNpsxil.exe
  2⤵
  PID:8780
- C:\Windows\System\deJNTig.exe
  C:\Windows\System\deJNTig.exe
  2⤵
  PID:8808
- C:\Windows\System\QkyMSQC.exe
  C:\Windows\System\QkyMSQC.exe
  2⤵
  PID:8904
- C:\Windows\System\UVfuATl.exe
  C:\Windows\System\UVfuATl.exe
  2⤵
  PID:8928
- C:\Windows\System\dpCMnXN.exe
  C:\Windows\System\dpCMnXN.exe
  2⤵
  PID:8948
- C:\Windows\System\exTMaCK.exe
  C:\Windows\System\exTMaCK.exe
  2⤵
  PID:8980
- C:\Windows\System\bRfbNEI.exe
  C:\Windows\System\bRfbNEI.exe
  2⤵
  PID:8644
- C:\Windows\System\MExiKSI.exe
  C:\Windows\System\MExiKSI.exe
  2⤵
  PID:9028
- C:\Windows\System\sTMTNxX.exe
  C:\Windows\System\sTMTNxX.exe
  2⤵
  PID:9064
- C:\Windows\System\AiGhgJZ.exe
  C:\Windows\System\AiGhgJZ.exe
  2⤵
  PID:8220
- C:\Windows\System\iYlTsTb.exe
  C:\Windows\System\iYlTsTb.exe
  2⤵
  PID:8384
- C:\Windows\System\MVzPpTy.exe
  C:\Windows\System\MVzPpTy.exe
  2⤵
  PID:8792
- C:\Windows\System\LSoDrPb.exe
  C:\Windows\System\LSoDrPb.exe
  2⤵
  PID:8888
- C:\Windows\System\bpRiaAv.exe
  C:\Windows\System\bpRiaAv.exe
  2⤵
  PID:8720
- C:\Windows\System\NRGrWNF.exe
  C:\Windows\System\NRGrWNF.exe
  2⤵
  PID:9012
- C:\Windows\System\YIqoaSu.exe
  C:\Windows\System\YIqoaSu.exe
  2⤵
  PID:8708
- C:\Windows\System\dWNIIKP.exe
  C:\Windows\System\dWNIIKP.exe
  2⤵
  PID:8868
- C:\Windows\System\lUGUGsI.exe
  C:\Windows\System\lUGUGsI.exe
  2⤵
  PID:8996
- C:\Windows\System\kuOsTBe.exe
  C:\Windows\System\kuOsTBe.exe
  2⤵
  PID:9092
- C:\Windows\System\qFgzomV.exe
  C:\Windows\System\qFgzomV.exe
  2⤵
  PID:9160
- C:\Windows\System\TsuooeN.exe
  C:\Windows\System\TsuooeN.exe
  2⤵
  PID:1304
- C:\Windows\System\DTHFOnG.exe
  C:\Windows\System\DTHFOnG.exe
  2⤵
  PID:9112
- C:\Windows\System\tuvkMFo.exe
  C:\Windows\System\tuvkMFo.exe
  2⤵
  PID:7780
- C:\Windows\System\yNJimKp.exe
  C:\Windows\System\yNJimKp.exe
  2⤵
  PID:8512
- C:\Windows\System\jZahRjV.exe
  C:\Windows\System\jZahRjV.exe
  2⤵
  PID:8388
- C:\Windows\System\BbzWzcj.exe
  C:\Windows\System\BbzWzcj.exe
  2⤵
  PID:8500
- C:\Windows\System\lYxXVPx.exe
  C:\Windows\System\lYxXVPx.exe
  2⤵
  PID:8504
- C:\Windows\System\CIjcVJJ.exe
  C:\Windows\System\CIjcVJJ.exe
  2⤵
  PID:8252
- C:\Windows\System\pxkpuSw.exe
  C:\Windows\System\pxkpuSw.exe
  2⤵
  PID:9168
- C:\Windows\System\drtPhDX.exe
  C:\Windows\System\drtPhDX.exe
  2⤵
  PID:9188
- C:\Windows\System\ZAcPFOR.exe
  C:\Windows\System\ZAcPFOR.exe
  2⤵
  PID:8268
- C:\Windows\System\xktcjYk.exe
  C:\Windows\System\xktcjYk.exe
  2⤵
  PID:8308
- C:\Windows\System\ynOsBrs.exe
  C:\Windows\System\ynOsBrs.exe
  2⤵
  PID:8476
- C:\Windows\System\UJsHvCQ.exe
  C:\Windows\System\UJsHvCQ.exe
  2⤵
  PID:8440
- C:\Windows\System\lZsLBvr.exe
  C:\Windows\System\lZsLBvr.exe
  2⤵
  PID:8756
- C:\Windows\System\SvtQtVN.exe
  C:\Windows\System\SvtQtVN.exe
  2⤵
  PID:8620
- C:\Windows\System\FiyOysO.exe
  C:\Windows\System\FiyOysO.exe
  2⤵
  PID:2096
- C:\Windows\System\FENRTxy.exe
  C:\Windows\System\FENRTxy.exe
  2⤵
  PID:8924
- C:\Windows\System\BcrsoOm.exe
  C:\Windows\System\BcrsoOm.exe
  2⤵
  PID:8920
- C:\Windows\System\OAhSvch.exe
  C:\Windows\System\OAhSvch.exe
  2⤵
  PID:9040
- C:\Windows\System\VBGgOZM.exe
  C:\Windows\System\VBGgOZM.exe
  2⤵
  PID:8196
- C:\Windows\System\aBjMLtf.exe
  C:\Windows\System\aBjMLtf.exe
  2⤵
  PID:8552
- C:\Windows\System\mIWxoGt.exe
  C:\Windows\System\mIWxoGt.exe
  2⤵
  PID:9204
- C:\Windows\System\DAlJKCa.exe
  C:\Windows\System\DAlJKCa.exe
  2⤵
  PID:9148
- C:\Windows\System\QpMDJjA.exe
  C:\Windows\System\QpMDJjA.exe
  2⤵
  PID:8532
- C:\Windows\System\RbLEPAD.exe
  C:\Windows\System\RbLEPAD.exe
  2⤵
  PID:9144
- C:\Windows\System\srZsfWz.exe
  C:\Windows\System\srZsfWz.exe
  2⤵
  PID:8204
- C:\Windows\System\eHzpQgz.exe
  C:\Windows\System\eHzpQgz.exe
  2⤵
  PID:8312
- C:\Windows\System\nGfchZV.exe
  C:\Windows\System\nGfchZV.exe
  2⤵
  PID:8276
- C:\Windows\System\hiLsoWU.exe
  C:\Windows\System\hiLsoWU.exe
  2⤵
  PID:8992
- C:\Windows\System\sQdaqUD.exe
  C:\Windows\System\sQdaqUD.exe
  2⤵
  PID:8640
- C:\Windows\System\TyYhAoN.exe
  C:\Windows\System\TyYhAoN.exe
  2⤵
  PID:9164
- C:\Windows\System\GzeXmOp.exe
  C:\Windows\System\GzeXmOp.exe
  2⤵
  PID:9200
- C:\Windows\System\ZQliaWt.exe
  C:\Windows\System\ZQliaWt.exe
  2⤵
  PID:9176
- C:\Windows\System\sDpcWxG.exe
  C:\Windows\System\sDpcWxG.exe
  2⤵
  PID:8404
- C:\Windows\System\xzTjXJW.exe
  C:\Windows\System\xzTjXJW.exe
  2⤵
  PID:8472
- C:\Windows\System\DKTDMqb.exe
  C:\Windows\System\DKTDMqb.exe
  2⤵
  PID:8320
- C:\Windows\System\foOHaJr.exe
  C:\Windows\System\foOHaJr.exe
  2⤵
  PID:9192
- C:\Windows\System\GoFIyqE.exe
  C:\Windows\System\GoFIyqE.exe
  2⤵
  PID:8208
- C:\Windows\System\EJHdaST.exe
  C:\Windows\System\EJHdaST.exe
  2⤵
  PID:9032
- C:\Windows\System\WcBhXrN.exe
  C:\Windows\System\WcBhXrN.exe
  2⤵
  PID:9232
- C:\Windows\System\okKTQNI.exe
  C:\Windows\System\okKTQNI.exe
  2⤵
  PID:9248
- C:\Windows\System\BqwiUuy.exe
  C:\Windows\System\BqwiUuy.exe
  2⤵
  PID:9264
- C:\Windows\System\qhGnccF.exe
  C:\Windows\System\qhGnccF.exe
  2⤵
  PID:9280
- C:\Windows\System\ZzcJUpd.exe
  C:\Windows\System\ZzcJUpd.exe
  2⤵
  PID:9300
- C:\Windows\System\pIyiusE.exe
  C:\Windows\System\pIyiusE.exe
  2⤵
  PID:9316
- C:\Windows\System\BDMAbVe.exe
  C:\Windows\System\BDMAbVe.exe
  2⤵
  PID:9340
- C:\Windows\System\nARbhiy.exe
  C:\Windows\System\nARbhiy.exe
  2⤵
  PID:9364
- C:\Windows\System\INHgUia.exe
  C:\Windows\System\INHgUia.exe
  2⤵
  PID:9380
- C:\Windows\System\ASLdAgK.exe
  C:\Windows\System\ASLdAgK.exe
  2⤵
  PID:9400
- C:\Windows\System\NmunHNU.exe
  C:\Windows\System\NmunHNU.exe
  2⤵
  PID:9416
- C:\Windows\System\gtydnZg.exe
  C:\Windows\System\gtydnZg.exe
  2⤵
  PID:9436
- C:\Windows\System\daWzZwc.exe
  C:\Windows\System\daWzZwc.exe
  2⤵
  PID:9452
- C:\Windows\System\TaRPVFI.exe
  C:\Windows\System\TaRPVFI.exe
  2⤵
  PID:9468
- C:\Windows\System\zTwWuIh.exe
  C:\Windows\System\zTwWuIh.exe
  2⤵
  PID:9484
- C:\Windows\System\SQlKYBa.exe
  C:\Windows\System\SQlKYBa.exe
  2⤵
  PID:9500
- C:\Windows\System\OSIHEJt.exe
  C:\Windows\System\OSIHEJt.exe
  2⤵
  PID:9520
- C:\Windows\System\wSXlqyY.exe
  C:\Windows\System\wSXlqyY.exe
  2⤵
  PID:9536
- C:\Windows\System\WzhXGTf.exe
  C:\Windows\System\WzhXGTf.exe
  2⤵
  PID:9552
- C:\Windows\System\fvWvWSX.exe
  C:\Windows\System\fvWvWSX.exe
  2⤵
  PID:9572
- C:\Windows\System\wHHmive.exe
  C:\Windows\System\wHHmive.exe
  2⤵
  PID:9588
- C:\Windows\System\ykNMbDx.exe
  C:\Windows\System\ykNMbDx.exe
  2⤵
  PID:9608
- C:\Windows\System\KwVWBgD.exe
  C:\Windows\System\KwVWBgD.exe
  2⤵
  PID:9624
- C:\Windows\System\VdVOBsC.exe
  C:\Windows\System\VdVOBsC.exe
  2⤵
  PID:9640
- C:\Windows\System\jzHdKnz.exe
  C:\Windows\System\jzHdKnz.exe
  2⤵
  PID:9660
- C:\Windows\System\EFoxvUc.exe
  C:\Windows\System\EFoxvUc.exe
  2⤵
  PID:9676
- C:\Windows\System\lyvAQkF.exe
  C:\Windows\System\lyvAQkF.exe
  2⤵
  PID:9692
- C:\Windows\System\JEQeqCQ.exe
  C:\Windows\System\JEQeqCQ.exe
  2⤵
  PID:9708
- C:\Windows\System\AwsUhxu.exe
  C:\Windows\System\AwsUhxu.exe
  2⤵
  PID:9724
- C:\Windows\System\JVBPOAO.exe
  C:\Windows\System\JVBPOAO.exe
  2⤵
  PID:9744
- C:\Windows\System\WirCkVn.exe
  C:\Windows\System\WirCkVn.exe
  2⤵
  PID:9760
- C:\Windows\System\NNJbekt.exe
  C:\Windows\System\NNJbekt.exe
  2⤵
  PID:9776
- C:\Windows\System\GwQTcDg.exe
  C:\Windows\System\GwQTcDg.exe
  2⤵
  PID:9796
- C:\Windows\System\nMPEAEV.exe
  C:\Windows\System\nMPEAEV.exe
  2⤵
  PID:9812
- C:\Windows\System\qoSzfNX.exe
  C:\Windows\System\qoSzfNX.exe
  2⤵
  PID:9828
- C:\Windows\System\NiMjQCq.exe
  C:\Windows\System\NiMjQCq.exe
  2⤵
  PID:9844
- C:\Windows\System\iFwqZMo.exe
  C:\Windows\System\iFwqZMo.exe
  2⤵
  PID:9860
- C:\Windows\System\ZFSKMYB.exe
  C:\Windows\System\ZFSKMYB.exe
  2⤵
  PID:9876
- C:\Windows\System\OhapsiH.exe
  C:\Windows\System\OhapsiH.exe
  2⤵
  PID:9896
- C:\Windows\System\PtTvowf.exe
  C:\Windows\System\PtTvowf.exe
  2⤵
  PID:9912
- C:\Windows\System\HBMGnpS.exe
  C:\Windows\System\HBMGnpS.exe
  2⤵
  PID:9948
- C:\Windows\System\rxeGZYB.exe
  C:\Windows\System\rxeGZYB.exe
  2⤵
  PID:9964
- C:\Windows\System\hwOPJTU.exe
  C:\Windows\System\hwOPJTU.exe
  2⤵
  PID:9980
- C:\Windows\System\ffwrdKe.exe
  C:\Windows\System\ffwrdKe.exe
  2⤵
  PID:9996
- C:\Windows\System\UGxDhki.exe
  C:\Windows\System\UGxDhki.exe
  2⤵
  PID:10016
- C:\Windows\System\RRfiiuW.exe
  C:\Windows\System\RRfiiuW.exe
  2⤵
  PID:10056
- C:\Windows\System\mnucWEy.exe
  C:\Windows\System\mnucWEy.exe
  2⤵
  PID:10076
- C:\Windows\System\QUkuuyZ.exe
  C:\Windows\System\QUkuuyZ.exe
  2⤵
  PID:9656
- C:\Windows\System\EGLRHob.exe
  C:\Windows\System\EGLRHob.exe
  2⤵
  PID:9560
- C:\Windows\System\mWxVFUr.exe
  C:\Windows\System\mWxVFUr.exe
  2⤵
  PID:9688
- C:\Windows\System\lWKCwat.exe
  C:\Windows\System\lWKCwat.exe
  2⤵
  PID:9716
- C:\Windows\System\gszssNm.exe
  C:\Windows\System\gszssNm.exe
  2⤵
  PID:9752
- C:\Windows\System\OMnroIj.exe
  C:\Windows\System\OMnroIj.exe
  2⤵
  PID:9820
- C:\Windows\System\sIKQvQz.exe
  C:\Windows\System\sIKQvQz.exe
  2⤵
  PID:9736
- C:\Windows\System\HvcvyRM.exe
  C:\Windows\System\HvcvyRM.exe
  2⤵
  PID:9808
- C:\Windows\System\UkZTEtz.exe
  C:\Windows\System\UkZTEtz.exe
  2⤵
  PID:9872
- C:\Windows\System\xKBwczu.exe
  C:\Windows\System\xKBwczu.exe
  2⤵
  PID:9920
- C:\Windows\System\BhMrucF.exe
  C:\Windows\System\BhMrucF.exe
  2⤵
  PID:10100
- C:\Windows\System\SxBAxjN.exe
  C:\Windows\System\SxBAxjN.exe
  2⤵
  PID:10180
- C:\Windows\System\iXpZxMS.exe
  C:\Windows\System\iXpZxMS.exe
  2⤵
  PID:10144
- C:\Windows\System\WDZNAXB.exe
  C:\Windows\System\WDZNAXB.exe
  2⤵
  PID:10156
- C:\Windows\System\SKjKWyh.exe
  C:\Windows\System\SKjKWyh.exe
  2⤵
  PID:9636
- C:\Windows\System\yaJwhRJ.exe
  C:\Windows\System\yaJwhRJ.exe
  2⤵
  PID:10204
- C:\Windows\System\DyrVcee.exe
  C:\Windows\System\DyrVcee.exe
  2⤵
  PID:10228
- C:\Windows\System\bIdtbSt.exe
  C:\Windows\System\bIdtbSt.exe
  2⤵
  PID:6124
- C:\Windows\System\TnIGEgK.exe
  C:\Windows\System\TnIGEgK.exe
  2⤵
  PID:8836
- C:\Windows\System\jaIbviQ.exe
  C:\Windows\System\jaIbviQ.exe
  2⤵
  PID:9784
- C:\Windows\System\taLKxWR.exe
  C:\Windows\System\taLKxWR.exe
  2⤵
  PID:9740
- C:\Windows\System\dqcsosM.exe
  C:\Windows\System\dqcsosM.exe
  2⤵
  PID:8444
- C:\Windows\System\ACQMpqS.exe
  C:\Windows\System\ACQMpqS.exe
  2⤵
  PID:9412
- C:\Windows\System\bcVVsnS.exe
  C:\Windows\System\bcVVsnS.exe
  2⤵
  PID:9312
- C:\Windows\System\aYrOPki.exe
  C:\Windows\System\aYrOPki.exe
  2⤵
  PID:9336
- C:\Windows\System\WorIRMB.exe
  C:\Windows\System\WorIRMB.exe
  2⤵
  PID:9408
- C:\Windows\System\QmNPGcn.exe
  C:\Windows\System\QmNPGcn.exe
  2⤵
  PID:10120
- C:\Windows\System\fVdJmmC.exe
  C:\Windows\System\fVdJmmC.exe
  2⤵
  PID:9428
- C:\Windows\System\dlRlbmh.exe
  C:\Windows\System\dlRlbmh.exe
  2⤵
  PID:9544
- C:\Windows\System\Txxezub.exe
  C:\Windows\System\Txxezub.exe
  2⤵
  PID:9672
- C:\Windows\System\VDPTdsR.exe
  C:\Windows\System\VDPTdsR.exe
  2⤵
  PID:9772
- C:\Windows\System\CWWksGo.exe
  C:\Windows\System\CWWksGo.exe
  2⤵
  PID:9972
- C:\Windows\System\HkTMtio.exe
  C:\Windows\System\HkTMtio.exe
  2⤵
  PID:9604
- C:\Windows\System\uYeAIlk.exe
  C:\Windows\System\uYeAIlk.exe
  2⤵
  PID:10012
- C:\Windows\System\PnwgXJB.exe
  C:\Windows\System\PnwgXJB.exe
  2⤵
  PID:10200
- C:\Windows\System\GjUpEtg.exe
  C:\Windows\System\GjUpEtg.exe
  2⤵
  PID:9928
- C:\Windows\System\gQkNlsN.exe
  C:\Windows\System\gQkNlsN.exe
  2⤵
  PID:10024
- C:\Windows\System\bVVnGbb.exe
  C:\Windows\System\bVVnGbb.exe
  2⤵
  PID:10048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AZnGqQf.exe

Filesize
1.4MB

MD5
fce0087ce3e6ad0c3f11a040dfb94877

SHA1
48e98dad9db5adf627104a944cb1959ada09c3ce

SHA256
99dc94fadbf787e406666f7bcc66837e4d7151ab004ccc782ae19c159d9f4e3a

SHA512
de33cbcfa5a94bb9007fbb5cd45c86c8c901db32ceead32a3c52d792fc92c027fa872f83ec3cbd56a8ed2be2e451b43590a6f6bcda0302d43d54e339c6b6d14c

Download Submit
C:\Windows\system\GlyUexG.exe

Filesize
1.4MB

MD5
ca6e7d1cb859133e42fc23d9c7514ad8

SHA1
fd07632fe20a84b480e44783a5c75a61fbd32eb9

SHA256
f474caa35f7db787deeef5543003c193ef88e082325ba82f2b4e70851af2feab

SHA512
b2be5f5df8b307b3238d0e60349c3765c30ee1636e569b6c8ea6dbff62b71a5b819b9accee7459dd22af56dfd962dfe0507019484d07444e591802386837810e

Download Submit
C:\Windows\system\IHcRtAM.exe

Filesize
1.4MB

MD5
11a3aadf748a1cbe90e2f8dd34140e43

SHA1
9f1fdbd47359e6eba3b05d5052d25944f5586384

SHA256
74622bd4ac9a5ad7911f9176ea4e3015ff6040fc93ced4c16fb821686dd6f0c4

SHA512
e92d2a30c709993609181019e374369203545330cda4e4b04652f30225569c182c43ff05d3a972a8d24929c13adc474a144cc4b222caab75d31af1141ce3a3f6

Download Submit
C:\Windows\system\KAnevVm.exe

Filesize
1.4MB

MD5
bdf5f13e5cabbf0738fb85073469b684

SHA1
62571f0e830a7db82703f6d1958d046d1defd34e

SHA256
1edbbab54d91117ba69e8dc5c28fb1c676c5c7acc973f1cb43ee6195ef1b62de

SHA512
4b172a8a7a50b19ecf73d6d2451c0ec38171fdcb6eab00feb9220e4ab13125544cfbce31ee768f7527a7087e6f351effa9d9d51dfb1e7442716294ff6f3c61bf

Download Submit
C:\Windows\system\KJNCJKx.exe

Filesize
1.4MB

MD5
bdd9b3df0e638fb6789fb47c70364266

SHA1
075ea48eac4703d146839d05ef3bcb67c52f7cf1

SHA256
9ecc41c8bf68d491f7ee933fe24e46cafd45ec5c3aa5573da7ba26de4fc55413

SHA512
9bf8c4b19842f019e079fdee81f27df3ba9ad4754777a7abd3b9693b39b31da23fc5c78e5896632f916c4998b32686ed5c47644d1aa3c011d4522edb4a0b0341

Download Submit
C:\Windows\system\LtNZmHk.exe

Filesize
1.4MB

MD5
aa50a7a8de711b93cdf7e460b5e0eed4

SHA1
c1f2175df11cd68ce9ca5f2c826c7690d9a34689

SHA256
bdbfb87de52123d4cd76cfa458b38383d0da35800bc8ae8235bde13ded09a96f

SHA512
2531dcaeb3f99499b98bbab12e4be3e638a1c5cc6c7c643d03ae99c3d20cfb2dcc24642ae266bcd8a87a15bcc28a645c9ee525998bc6eee61ad2cdad3eacdaf0

Download Submit
C:\Windows\system\MKiiKYu.exe

Filesize
1.4MB

MD5
9bb151487907fa43fe731eaf7e0c4417

SHA1
d968d8731d64bda64c88eee070f96ad95b206b1e

SHA256
ac3746a77599903c38825d600800d698cc689a25b632553c9d5cef646128d877

SHA512
fb63d171bf2efdf8db2e8f49c12c4c6bad77479bb02370a8c40a42539e578ad82d42d1161445ae6de8748fa5fc98a70f5382343e993fcf0d97abd5930527079e

Download Submit
C:\Windows\system\NWECGLC.exe

Filesize
1.4MB

MD5
be92f9bdae36fb6df9702533c209009a

SHA1
79c942737100dcc928a91c6edc76132e0a6d9f84

SHA256
ba7c01d45466bf7e4b9576070c5228caa33ce13bd4e3ed7ed816d12cede05df5

SHA512
ac138d6b0b9273bd466137ccddf7b5bc887e559286755dea4af44be21138d7ded7eba2382643e5df114ca5a33273c391d7c629f4e6a05329ea8be4de497b5081

Download Submit
C:\Windows\system\ODDDrMt.exe

Filesize
1.4MB

MD5
603b2a3fe29ad5754edbed2c55ad044c

SHA1
f207430f8f0a1c90851cec6e8e197b93d6ade1de

SHA256
53de1dfb403b4b26c49fc508fddcddf577d47c2b9a34ef2af6ff1ec18b1e7789

SHA512
89edbc2791eee1494254025e2b63be2a08da48afbc97cf50f6081fa608ae1676d5fea7c7d95ed2fa00748d74c545747df6e1e89af5cbaa870583d5941666f92f

Download Submit
C:\Windows\system\OXMSiep.exe

Filesize
1.4MB

MD5
452bff5ba569698c96a1a2eb2b86d226

SHA1
86d411000b0cb5dbc202ecb926dd3f81fc65a94d

SHA256
e5fc5b484a73cd0b3ddb7b30bef017362a4dcb1e00ddb104132696a12bf01279

SHA512
b5adaa8c70c44fbda2174a0903fc8aa6c396dbaa1abe29aa22f7f2c88308f81bfa43dbba8011f2faa67e9421d13b965932bf93f67c9a79d242c4fdcbb41c97fb

Download Submit
C:\Windows\system\OqKgOYu.exe

Filesize
1.4MB

MD5
483c02189b0221df8dc60e050acd4e00

SHA1
6c224f993489ccce176d827d377534510c5fd499

SHA256
079da61323e025e0cb535e44eb0a64b672b0f6aee1b73bf5f10a1bd5fb53f309

SHA512
14cbf7ea8a375e2f541ebe17865fe7ed332e3e899530d0196d48309ec9d247cdfd5ac98a11bef17e7e7c4ae9652df492df4e6916516741f5590b1633d3b529da

Download Submit
C:\Windows\system\OsjQWBc.exe

Filesize
1.4MB

MD5
0d1af3d631e87261350c245daacdba4d

SHA1
253a62d49b3409f39a07fe90eea06ed8a839fd99

SHA256
540ec5a33b848bfca1adc079ebbd07e5b0a3f0a83785ca45f6f18d7524b5be10

SHA512
28bf0dd6a3efbd48b98682dee4398a9542647037604d0ef81002f71e5e0e549cd2bef62d1e835b395090ae19daffcef17d3ca2ff738e5879a09e6dfce5aca395

Download Submit
C:\Windows\system\TmvxkAn.exe

Filesize
1.4MB

MD5
a1a54fdc085d04ca3365da606c50a903

SHA1
1e3e5f7e668b1d171c4d16e86aafe24d3cd3cf7b

SHA256
cbc04fc23ca68a10e52599ebd5009d50bf71f4aeb8013a51d24af8752287666c

SHA512
307cf18a96cd813796a7501165f6b771714682d0f3ad17eb634bb00c5455cb6f1b2a0bc0de286eeb0e0dab64076bdca7b2423877716023d7a4a8e5cb17a00ac5

Download Submit
C:\Windows\system\WuaREFG.exe

Filesize
1.4MB

MD5
2dd2fe0fdafc445c14bb340b7252103a

SHA1
b9cad96a260ee9d26d4db45f176ec4e3bd6b005b

SHA256
c90963e45bd97818b7f36baad6dceb71f1a0d6dbb418101c42619b32e0b2a073

SHA512
62d75f587b62587ad583a79155ce54a8bf559e789f8792b1f4b73d8e037871fff7c58005ce594080a1a18a99844d2fd1c197d04e652f383cec124cb6d7e102f3

Download Submit
C:\Windows\system\XhhDhGD.exe

Filesize
1.4MB

MD5
08cfded5e0931ef699874f9348ac8fd7

SHA1
86daa2bf6f278e4a91f498edd464bedc1ce3fc83

SHA256
bea086732bfbfd7d8d353c835f76b1f23002cebcfccd76479a862aa6c8df5b85

SHA512
a4bb3cd9253badf2ae560c169a76df13c83761b8c4c867b4e383bdcc13deaa609f0ebb64444f90dce33930db7e6008ed4b15b413b0beece91b60282308dbc808

Download Submit
C:\Windows\system\dyrrjdL.exe

Filesize
1.4MB

MD5
96e6524848df7cfd038ac61ab4d98e4d

SHA1
34cc393dd920c9d0b4ed6ec67ad7b647dc84d7a6

SHA256
65cb22e024d450e32bebf0644cb8105569e2aa019c1558cbbc17fa10111524e6

SHA512
48ef5c528c969930ac019d3fc1c9eff30fbe076b2a3c5e062cdf8d0a89b33f39b5bc5fe4b96290abe79b92c41474a050abaf55759e56e2934279fabe0cdccd0e

Download Submit
C:\Windows\system\eXcvKuu.exe

Filesize
1.4MB

MD5
b8f96383bbf10aeacb03b77fd1406e17

SHA1
62daab2c534ec3975418c67af99d44d3e2d64d45

SHA256
3d0f1d32c95dd568cfa68f8c534e7dd327cd6ec343ce7a0edff314b76e6d82d1

SHA512
2a61947c36a90d1aa18a2dda34121466e2a1edde5e9ec3496da3e19740b7f3844056dea7b9d743eb293ec07878f310526e46d33d3f1ca4324a7c5dcf755cbf55

Download Submit
C:\Windows\system\fEXDmRZ.exe

Filesize
1.4MB

MD5
c7055ea0fbb37bf3bd8bedc98dc8d3c9

SHA1
2d93b6f587b2deab33e943e16ef3cd63ca87bcda

SHA256
7038a73557c89ff63969f7eef8d10ed10d472fbb5ff06aeb776603d0590772bc

SHA512
da59fcea24a011153caa25d84e47f990b86f362e81439151edcebbf66290ea070763ec1ca9c4b363f90aa126d05d92b314f206d2626b624f7753ac35f64dbdab

Download Submit
C:\Windows\system\ftpPByR.exe

Filesize
1.4MB

MD5
d07563924063b0631b46075e9c5dd494

SHA1
e21741d276404b483eb420e1ff32b729cf10a5b0

SHA256
cebad37b35492fc5bd75cd30d854630b1637acf9a77c76935954e9a451899680

SHA512
7e3a79eb7158651415f4fd76f4d11ee49d26756a6a2e90c83cc8d42e80ad63e553f192ff15c0d78a7e84f15959d444de554d54ad9477dca72bac73ecd88eee1e

Download Submit
C:\Windows\system\jryXYzP.exe

Filesize
1.4MB

MD5
faee0a37985cff8b49c3ea2c0b32a418

SHA1
9f1938fa78436691a792fcbde30557a889c18431

SHA256
2dbedeee6da48ef9b05a23a96016fde33859c10f86f3fc7e233f42bcf3088620

SHA512
a150add1690184476c1ecc003be12122f6049a4e17bdf295bac1156db7542869eda171e5fe5eb76897c5aa1d2a3a41736dedd071f8ec77ef24537a48a188ffea

Download Submit
C:\Windows\system\kUJNZJx.exe

Filesize
1.4MB

MD5
745f4a5e8590a523830cea79e6ca0d83

SHA1
be1aeff5021157d7ed7f214b76eb44a20b9509f9

SHA256
d957a6b5a946b3c72aeab1562004ab387e4d5f9c6edb23d6ce965efc683e6d16

SHA512
531de514e17d41f5e3172b351ab914ca2e6278cc565bd3f35f83f1cf0acbe1a62df9bc06a0eee35bee5aa308461128f469fa22dc19fa1a036b4782d2ac38f708

Download Submit
C:\Windows\system\mMZHtNM.exe

Filesize
1.4MB

MD5
b8edf8a2ab833eab123c4ea2b3862dfe

SHA1
57598cba1140b8e50a7dd0412c448c06787d64d2

SHA256
791b45c96f539e0ee056d7f859c72c53ad8069f58a3974fdd0489e53ec5c8db6

SHA512
22fe9d9c6097de3ae8fcd3fbc9101880e505594a2c79fabc40435ef9f7239cef5fd4ee6c4028f4b5f50e6b88c0d0a894695aed2eee8dd079a947b1bf37eec69d

Download Submit
C:\Windows\system\pxyCflt.exe

Filesize
1.4MB

MD5
0885bfc3f025899ec46d8bc2e8f5239c

SHA1
bbcd89dddb9edf71cc05cf60a4c225b4c13fa454

SHA256
1f70b0df39f4634ebd8c861a36a766a315865d0f3095eb18991c427bfb8df48f

SHA512
9cdef4c7fb81ca14aef78ea790b6db1783f6d2127027c098d9ac7244ea560c1e053d7036ac40f7cdb76344b9f5929d1481153ab9b58fd649b5ba3a5a072fcad8

Download Submit
C:\Windows\system\rQrsNOo.exe

Filesize
1.4MB

MD5
427146bdf7c1575cf197357f5ae30156

SHA1
db46b02b029f4f792c3f954b89e54b5ee0855b30

SHA256
c8fbbc032fe7fa42394e929fa1dc4f1d2405777ec5f683c7e232fe43463a6e85

SHA512
9fe0b3ed79b6dd9badb8040066f820cff572c9237de0c3028fc5b46ef66e102c0ec3d886d2c0a146c0f01e9833fb4cb1e48ca61f1d2095b9dcf3a166d8bbf52c

Download Submit
C:\Windows\system\rcUnIuy.exe

Filesize
1.4MB

MD5
cf12a3ec0b07216cd0e9a893ecd9caaa

SHA1
7f11fcbde0ab27771059f58d6f01626b4f51fb3e

SHA256
c416617ff427eb4da3c15e8914c4ccab53d0e3f85be18bb452fa1ddba6c45c73

SHA512
abea5034a3dd88a221998ead91aeae3744df242c5414f3bae0f458e7f9dead26ff6af337752d93c90609f2a9f0e296f5333e217ac05c618a1a0db513e2aded73

Download Submit
C:\Windows\system\tJLMwqS.exe

Filesize
1.4MB

MD5
85706fce02597b92ffad8f67317dffec

SHA1
addc34d670a2285ac77ccc29b163fdb741bca1fd

SHA256
35f0864bc9f3ea6ca636d21f3443cd0bc4c2b9f6264384b573da3544b953f6f1

SHA512
90dfd2541a1f9557ed79c8204b83f01aa0d439b9be0e077b5368db614a7dfbdb1b0b078f647340e295bd1f1c1f8be97b51116819e257454b8df1e2a4a74074e0

Download Submit
C:\Windows\system\uaIlZIR.exe

Filesize
1.4MB

MD5
6c7b0db47da13169efb261c020a53575

SHA1
e1fcbb924015ab2f26a6a7894f5f0edbd1fcb12d

SHA256
c442c0c12ce75d6c9f320a58a362a57f634115a335021110aa136217bbaf9485

SHA512
a724faa038b06703f6cf8ebcde99c40dc4ec1c3dcb1ab5d3e568962e094bc374b969ac3e50b3ddec6e76c868cfe939468756fb8f9e5bd5c4a1306f880e5b8dde

Download Submit
\Windows\system\AkgJnvS.exe

Filesize
1.4MB

MD5
863825f93d629029d95dcb01c60f812f

SHA1
489691f10026b2fbedcbb554d09640c2a920a145

SHA256
382ab96826c2e7b219d569d8bed459e382e774e28a3abf51f77878a2fa7b37db

SHA512
a721b8d428eb12513a2baa52c53c9eabbb846b6cf3152594c132b4f9b34166d9ff7f3df99f6ca8882184be3cdad6a05a9b7aad007e5eb861163d584739e627ec

Download Submit
\Windows\system\dvIvMFg.exe

Filesize
1.4MB

MD5
b4c0ac89f1a856d7baf4a67856caaaf7

SHA1
1813bfe410f0d2bd493783f2df2b59ac69ba2db6

SHA256
6ca9c92bde43c0d431617e98d93a2f89d05cc874ef15acf89e288e8908fde884

SHA512
e7d10421ecc1dec44878ea5e02bea27f1ec4dd914818ec9ecd718d055cbf8e629ff08b43badcacdf2aa9c2b5d996e7a2693ee4bb22a20329d8aad97237085036

Download Submit
\Windows\system\oTJFbAN.exe

Filesize
1.4MB

MD5
3f9e8b516d84eed1df4abbba3cb43d6d

SHA1
02de476e1f5559b5da0d2cf3058557583e717a25

SHA256
7a107672000fd87112083ffb8e473f0d13cade7aff6b3735dd128f6755526687

SHA512
baaa5c85789b88bd81cc06180927e666b62f7c23c649f864be9be83f4898d6694170b61f117ea38bf8f15c6219c2d925281e2a42209c4cbce3b62009962d6d56

Download Submit
\Windows\system\rjrlTRM.exe

Filesize
1.4MB

MD5
0312b28b06020139122faaecad1649f0

SHA1
74bb47e05b698c8f34abd154bc88afa20641bb79

SHA256
7daf075a072662e93228c104842dc3c245c2bb2c81b100c5de487f2eb76e2a69

SHA512
a7da29438e19bd8d131fb8a596d5743ff08db99c1cd952a8564594784d096a7bdc39938fb9d15781f8a854590c13605fce6c89df1020e72d5235648451f38c46

Download Submit
\Windows\system\yzfNfzE.exe

Filesize
1.4MB

MD5
bd140b4be80f88c5b745813c6d75ac24

SHA1
55b48bd029862e13a233c02ceec70ddb7501cfb5

SHA256
db9eacb5c7195dc9fecd6b7c3e389c805936902f1578774b6418ca087ae90337

SHA512
c367067c601b603a2ada274d1d4d0173be948ddd72c27957248f20396e38961e867b6d0c5f8d67282228108b128759f2b064806011de75770fbc33a84ac423cf

Download Submit
memory/1980-94-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/1980-2731-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/2084-18-0x00000000026D0000-0x0000000002750000-memory.dmp

Filesize
512KB

Download
memory/2084-68-0x000007FEF45D0000-0x000007FEF4F6D000-memory.dmp

Filesize
9.6MB

Download
memory/2084-223-0x000007FEF45D0000-0x000007FEF4F6D000-memory.dmp

Filesize
9.6MB

Download
memory/2084-56-0x0000000002270000-0x0000000002278000-memory.dmp

Filesize
32KB

Download
memory/2084-46-0x000000001B3F0000-0x000000001B6D2000-memory.dmp

Filesize
2.9MB

Download
memory/2084-103-0x000007FEF45D0000-0x000007FEF4F6D000-memory.dmp

Filesize
9.6MB

Download
memory/2084-19-0x000007FEF488E000-0x000007FEF488F000-memory.dmp

Filesize
4KB

Download
memory/2084-85-0x000007FEF45D0000-0x000007FEF4F6D000-memory.dmp

Filesize
9.6MB

Download
memory/2252-1921-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/2252-97-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/2360-2862-0x000000013F5A0000-0x000000013F992000-memory.dmp

Filesize
3.9MB

Download
memory/2360-99-0x000000013F5A0000-0x000000013F992000-memory.dmp

Filesize
3.9MB

Download
memory/2440-1823-0x000000013F7A0000-0x000000013FB92000-memory.dmp

Filesize
3.9MB

Download
memory/2440-16-0x000000013F7A0000-0x000000013FB92000-memory.dmp

Filesize
3.9MB

Download
memory/2468-96-0x0000000003080000-0x0000000003472000-memory.dmp

Filesize
3.9MB

Download
memory/2468-88-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/2468-83-0x0000000003080000-0x0000000003472000-memory.dmp

Filesize
3.9MB

Download
memory/2468-98-0x0000000003080000-0x0000000003472000-memory.dmp

Filesize
3.9MB

Download
memory/2468-81-0x0000000003080000-0x0000000003472000-memory.dmp

Filesize
3.9MB

Download
memory/2468-86-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/2468-79-0x0000000003080000-0x0000000003472000-memory.dmp

Filesize
3.9MB

Download
memory/2468-104-0x0000000003080000-0x0000000003472000-memory.dmp

Filesize
3.9MB

Download
memory/2468-77-0x0000000003080000-0x0000000003472000-memory.dmp

Filesize
3.9MB

Download
memory/2468-0-0x000000013F6D0000-0x000000013FAC2000-memory.dmp

Filesize
3.9MB

Download
memory/2468-75-0x000000013FDB0000-0x00000001401A2000-memory.dmp

Filesize
3.9MB

Download
memory/2468-12-0x0000000002820000-0x0000000002C12000-memory.dmp

Filesize
3.9MB

Download
memory/2468-1-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/2624-1924-0x000000013F710000-0x000000013FB02000-memory.dmp

Filesize
3.9MB

Download
memory/2624-80-0x000000013F710000-0x000000013FB02000-memory.dmp

Filesize
3.9MB

Download
memory/2652-76-0x000000013FDB0000-0x00000001401A2000-memory.dmp

Filesize
3.9MB

Download
memory/2652-1888-0x000000013FDB0000-0x00000001401A2000-memory.dmp

Filesize
3.9MB

Download
memory/2668-82-0x000000013F5C0000-0x000000013F9B2000-memory.dmp

Filesize
3.9MB

Download
memory/2668-1880-0x000000013F5C0000-0x000000013F9B2000-memory.dmp

Filesize
3.9MB

Download
memory/2676-1923-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/2676-87-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/2700-2599-0x000000013F7B0000-0x000000013FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/2700-84-0x000000013F7B0000-0x000000013FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/2780-2874-0x000000013FD10000-0x0000000140102000-memory.dmp

Filesize
3.9MB

Download
memory/2780-70-0x000000013FD10000-0x0000000140102000-memory.dmp

Filesize
3.9MB

Download
memory/2792-78-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/2792-1890-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/2892-1925-0x000000013F920000-0x000000013FD12000-memory.dmp

Filesize
3.9MB

Download
memory/2892-71-0x000000013F920000-0x000000013FD12000-memory.dmp

Filesize
3.9MB

Download