xmrig | be8f36c37ce2d5dd3500d9fc79367fa4cbdc259cb816de78d010359db525d2d2

Analysis

max time kernel
116s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 18:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

43818f356317a3fdaf9c4740c25fe070N.exe
Size

1.6MB
MD5

43818f356317a3fdaf9c4740c25fe070
SHA1

9297178a00b4475dbbd153e0980852487a36d68e
SHA256

be8f36c37ce2d5dd3500d9fc79367fa4cbdc259cb816de78d010359db525d2d2
SHA512

70dfbe26c21603dd48a513eb03dd7678a5e0713544b69e0fa483df8a78620c27e3cf8c7f05daf2fa3544d5b9321807836ae28097dceee4478cf3a8b0655dc501
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTnHzlyPGkd+TKqxxLV:Lz071uv4BPMkFfdk2auTlGGxZ

Score

10^/10

xmrig execution miner persistence privilege_escalation upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 28 IoCs

miner

resource	yara_rule
behavioral1/memory/2800-9-0x000000013F390000-0x000000013F782000-memory.dmp	xmrig
behavioral1/memory/2584-26-0x000000013F730000-0x000000013FB22000-memory.dmp	xmrig
behavioral1/memory/2964-91-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	xmrig
behavioral1/memory/2800-211-0x000000013F390000-0x000000013F782000-memory.dmp	xmrig
behavioral1/memory/3036-214-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	xmrig
behavioral1/memory/2744-212-0x000000013FD90000-0x0000000140182000-memory.dmp	xmrig
behavioral1/memory/2728-210-0x000000013F480000-0x000000013F872000-memory.dmp	xmrig
behavioral1/memory/1976-256-0x000000013FEB0000-0x00000001402A2000-memory.dmp	xmrig
behavioral1/memory/916-259-0x000000013F3A0000-0x000000013F792000-memory.dmp	xmrig
behavioral1/memory/1420-257-0x000000013F4A0000-0x000000013F892000-memory.dmp	xmrig
behavioral1/memory/2400-265-0x000000013F790000-0x000000013FB82000-memory.dmp	xmrig
behavioral1/memory/2900-264-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	xmrig
behavioral1/memory/2572-263-0x000000013F390000-0x000000013F782000-memory.dmp	xmrig
behavioral1/memory/2108-90-0x000000013F020000-0x000000013F412000-memory.dmp	xmrig
behavioral1/memory/1440-74-0x000000013FD60000-0x0000000140152000-memory.dmp	xmrig
behavioral1/memory/2684-69-0x000000013F1A0000-0x000000013F592000-memory.dmp	xmrig
behavioral1/memory/3036-56-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	xmrig
behavioral1/memory/3036-2422-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	xmrig
behavioral1/memory/1440-2965-0x000000013FD60000-0x0000000140152000-memory.dmp	xmrig
behavioral1/memory/2108-3001-0x000000013F020000-0x000000013F412000-memory.dmp	xmrig
behavioral1/memory/2684-3000-0x000000013F1A0000-0x000000013F592000-memory.dmp	xmrig
behavioral1/memory/1976-2994-0x000000013FEB0000-0x00000001402A2000-memory.dmp	xmrig
behavioral1/memory/2800-3019-0x000000013F390000-0x000000013F782000-memory.dmp	xmrig
behavioral1/memory/2744-3023-0x000000013FD90000-0x0000000140182000-memory.dmp	xmrig
behavioral1/memory/916-3034-0x000000013F3A0000-0x000000013F792000-memory.dmp	xmrig
behavioral1/memory/2584-3018-0x000000013F730000-0x000000013FB22000-memory.dmp	xmrig
behavioral1/memory/2964-3075-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	xmrig
behavioral1/memory/1420-3068-0x000000013F4A0000-0x000000013F892000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2884	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2800	uuKVSWk.exe
2744	hWerbFC.exe
2584	FeTGObm.exe
3036	cMSVOvY.exe
1976	GThrvLS.exe
1420	SBesyJa.exe
2684	TnjzmqO.exe
916	rBLfXiO.exe
1440	IbUgmNv.exe
2108	wVPHMFD.exe
2964	kHffbhv.exe
2900	sKDeZVU.exe
2572	FETGirQ.exe
2400	eVXPHWh.exe
2204	KRgnTZG.exe
2488	HnISkdG.exe
2140	RAXKOiK.exe
596	IYxhNpJ.exe
668	xrMvtfZ.exe
1352	lilaOju.exe
2232	nBarezK.exe
2176	gmGHGCq.exe
2532	aIdDZCb.exe
2228	apZkRnD.exe
2120	ZuRHXkt.exe
1688	yPjQqiu.exe
2180	heZqrqf.exe
556	uLeErKX.exe
2328	sZAsQuy.exe
1604	StlTzAs.exe
1132	doezzjo.exe
1640	DzWAlAS.exe
1760	ubulydc.exe
608	VGHDWFJ.exe
2948	NPPPIyY.exe
2324	DNesCJl.exe
1064	bZtokqP.exe
2456	zLqSmRP.exe
2380	ANZExZq.exe
1584	YIJwEJJ.exe
3020	IuNVfSG.exe
752	UQqNihO.exe
1136	CmWjDnU.exe
1752	ZBALBWn.exe
864	dGmVImc.exe
2332	jAZGRfu.exe
2824	YxlfNpv.exe
1708	QPCMUsp.exe
2716	MaiMuuS.exe
1072	lCBnjIw.exe
2564	qWVDmCw.exe
2000	bgSNEvv.exe
2976	TwvxUcM.exe
364	TlZoyjh.exe
2124	EXhbPEV.exe
2916	TuueHqn.exe
2272	xyaqyfa.exe
2856	EkTbogt.exe
1424	hjIPulk.exe
2348	sNRZTht.exe
2420	nRptlOT.exe
2136	KtaNRUl.exe
832	ptZgwzL.exe
684	Swxfxtm.exe

Loads dropped DLL 64 IoCs

pid	Process
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe
2728	43818f356317a3fdaf9c4740c25fe070N.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2728-1-0x000000013F480000-0x000000013F872000-memory.dmp	upx
behavioral1/files/0x000b000000016d58-3.dat	upx
behavioral1/memory/2800-9-0x000000013F390000-0x000000013F782000-memory.dmp	upx
behavioral1/files/0x00070000000177da-10.dat	upx
behavioral1/files/0x0003000000017801-23.dat	upx
behavioral1/memory/2584-26-0x000000013F730000-0x000000013FB22000-memory.dmp	upx
behavioral1/memory/2744-15-0x000000013FD90000-0x0000000140182000-memory.dmp	upx
behavioral1/files/0x001000000000558f-30.dat	upx
behavioral1/files/0x000e000000016d90-37.dat	upx
behavioral1/files/0x00080000000186b7-40.dat	upx
behavioral1/files/0x00070000000186bb-45.dat	upx
behavioral1/files/0x0006000000018d48-48.dat	upx
behavioral1/memory/2964-91-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	upx
behavioral1/files/0x0005000000018fb8-104.dat	upx
behavioral1/files/0x0005000000018fb5-103.dat	upx
behavioral1/files/0x0005000000018fc1-116.dat	upx
behavioral1/files/0x0005000000018fc2-119.dat	upx
behavioral1/files/0x0005000000018fe2-135.dat	upx
behavioral1/files/0x0004000000019206-162.dat	upx
behavioral1/files/0x0004000000019438-173.dat	upx
behavioral1/files/0x0004000000019485-185.dat	upx
behavioral1/files/0x0005000000019571-195.dat	upx
behavioral1/files/0x00040000000194ec-190.dat	upx
behavioral1/memory/2800-211-0x000000013F390000-0x000000013F782000-memory.dmp	upx
behavioral1/memory/3036-214-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	upx
behavioral1/memory/2744-212-0x000000013FD90000-0x0000000140182000-memory.dmp	upx
behavioral1/memory/2728-210-0x000000013F480000-0x000000013F872000-memory.dmp	upx
behavioral1/files/0x00040000000192ad-165.dat	upx
behavioral1/files/0x0004000000019461-178.dat	upx
behavioral1/files/0x0005000000019078-151.dat	upx
behavioral1/memory/1976-256-0x000000013FEB0000-0x00000001402A2000-memory.dmp	upx
behavioral1/memory/916-259-0x000000013F3A0000-0x000000013F792000-memory.dmp	upx
behavioral1/memory/1420-257-0x000000013F4A0000-0x000000013F892000-memory.dmp	upx
behavioral1/memory/2400-265-0x000000013F790000-0x000000013FB82000-memory.dmp	upx
behavioral1/memory/2900-264-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	upx
behavioral1/memory/2572-263-0x000000013F390000-0x000000013F782000-memory.dmp	upx
behavioral1/files/0x0004000000019380-168.dat	upx
behavioral1/files/0x0005000000018fe4-145.dat	upx
behavioral1/files/0x00040000000192a8-157.dat	upx
behavioral1/files/0x0005000000018fcd-127.dat	upx
behavioral1/files/0x0005000000018fcb-123.dat	upx
behavioral1/files/0x0005000000018fba-111.dat	upx
behavioral1/files/0x0005000000018fb9-108.dat	upx
behavioral1/memory/2108-90-0x000000013F020000-0x000000013F412000-memory.dmp	upx
behavioral1/memory/1440-74-0x000000013FD60000-0x0000000140152000-memory.dmp	upx
behavioral1/memory/916-71-0x000000013F3A0000-0x000000013F792000-memory.dmp	upx
behavioral1/memory/2684-69-0x000000013F1A0000-0x000000013F592000-memory.dmp	upx
behavioral1/memory/1420-67-0x000000013F4A0000-0x000000013F892000-memory.dmp	upx
behavioral1/files/0x0005000000018fb0-64.dat	upx
behavioral1/files/0x0005000000018fb6-95.dat	upx
behavioral1/files/0x0005000000018fb4-82.dat	upx
behavioral1/memory/1976-58-0x000000013FEB0000-0x00000001402A2000-memory.dmp	upx
behavioral1/memory/3036-56-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	upx
behavioral1/files/0x0005000000018fac-53.dat	upx
behavioral1/memory/3036-2422-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	upx
behavioral1/memory/1440-2965-0x000000013FD60000-0x0000000140152000-memory.dmp	upx
behavioral1/memory/2108-3001-0x000000013F020000-0x000000013F412000-memory.dmp	upx
behavioral1/memory/2684-3000-0x000000013F1A0000-0x000000013F592000-memory.dmp	upx
behavioral1/memory/1976-2994-0x000000013FEB0000-0x00000001402A2000-memory.dmp	upx
behavioral1/memory/2800-3019-0x000000013F390000-0x000000013F782000-memory.dmp	upx
behavioral1/memory/2744-3023-0x000000013FD90000-0x0000000140182000-memory.dmp	upx
behavioral1/memory/916-3034-0x000000013F3A0000-0x000000013F792000-memory.dmp	upx
behavioral1/memory/2584-3018-0x000000013F730000-0x000000013FB22000-memory.dmp	upx
behavioral1/memory/2964-3075-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\LXPqzJl.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\cWrikQY.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\HcThuXF.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\OOHDMKY.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\vdytvHR.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\gsiCQvq.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\GRnPKzZ.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\gQFEfrU.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\rXuIdyH.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\dGELlfj.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\ZWHuMnP.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\lbzZNew.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\IuHmixt.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\ixSmLXj.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\QdRimFy.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\CwVvsCI.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\rBLfXiO.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\BKpywOj.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\yGXMCse.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\DYgoHpM.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\fpZaZwj.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\PwnSbnC.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\LdnlIoc.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\kcsWnNm.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\xsEsyys.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\kCDahgl.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\ftYePHR.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\GurrhXh.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\hjIPulk.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\kUKYOLG.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\jgFligi.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\JmVotDp.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\HnISkdG.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\lXaRjUu.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\EVFwEqz.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\aeTLzqS.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\BOCCFJr.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\sWbjbwS.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\MGbqhMG.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\cMSVOvY.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\QxtDQcG.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\KODIEkE.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\nLLZSjS.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\ixSyhkM.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\LSeRKyT.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\gzTuyNg.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\DaMrkzE.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\EEBDwSc.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\PtxQebA.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\zjDdYlQ.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\POqjZxu.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\npfqJwC.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\dhqcVVy.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\SBPMYqj.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\TuueHqn.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\VkfRiID.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\vyoaEWB.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\rWltTwS.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\aQrFWDn.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\ptZgwzL.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\QTXBBMK.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\gEnLiJc.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\sTcvOXE.exe	43818f356317a3fdaf9c4740c25fe070N.exe
File created	C:\Windows\System\KJKOttc.exe	43818f356317a3fdaf9c4740c25fe070N.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2884	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2728	43818f356317a3fdaf9c4740c25fe070N.exe
Token: SeLockMemoryPrivilege	2728	43818f356317a3fdaf9c4740c25fe070N.exe
Token: SeDebugPrivilege	2884	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 2884	2728	43818f356317a3fdaf9c4740c25fe070N.exe	31
PID 2728 wrote to memory of 2884	2728	43818f356317a3fdaf9c4740c25fe070N.exe	31
PID 2728 wrote to memory of 2884	2728	43818f356317a3fdaf9c4740c25fe070N.exe	31
PID 2728 wrote to memory of 2800	2728	43818f356317a3fdaf9c4740c25fe070N.exe	32
PID 2728 wrote to memory of 2800	2728	43818f356317a3fdaf9c4740c25fe070N.exe	32
PID 2728 wrote to memory of 2800	2728	43818f356317a3fdaf9c4740c25fe070N.exe	32
PID 2728 wrote to memory of 2744	2728	43818f356317a3fdaf9c4740c25fe070N.exe	33
PID 2728 wrote to memory of 2744	2728	43818f356317a3fdaf9c4740c25fe070N.exe	33
PID 2728 wrote to memory of 2744	2728	43818f356317a3fdaf9c4740c25fe070N.exe	33
PID 2728 wrote to memory of 2584	2728	43818f356317a3fdaf9c4740c25fe070N.exe	34
PID 2728 wrote to memory of 2584	2728	43818f356317a3fdaf9c4740c25fe070N.exe	34
PID 2728 wrote to memory of 2584	2728	43818f356317a3fdaf9c4740c25fe070N.exe	34
PID 2728 wrote to memory of 3036	2728	43818f356317a3fdaf9c4740c25fe070N.exe	35
PID 2728 wrote to memory of 3036	2728	43818f356317a3fdaf9c4740c25fe070N.exe	35
PID 2728 wrote to memory of 3036	2728	43818f356317a3fdaf9c4740c25fe070N.exe	35
PID 2728 wrote to memory of 1976	2728	43818f356317a3fdaf9c4740c25fe070N.exe	36
PID 2728 wrote to memory of 1976	2728	43818f356317a3fdaf9c4740c25fe070N.exe	36
PID 2728 wrote to memory of 1976	2728	43818f356317a3fdaf9c4740c25fe070N.exe	36
PID 2728 wrote to memory of 1420	2728	43818f356317a3fdaf9c4740c25fe070N.exe	37
PID 2728 wrote to memory of 1420	2728	43818f356317a3fdaf9c4740c25fe070N.exe	37
PID 2728 wrote to memory of 1420	2728	43818f356317a3fdaf9c4740c25fe070N.exe	37
PID 2728 wrote to memory of 2684	2728	43818f356317a3fdaf9c4740c25fe070N.exe	38
PID 2728 wrote to memory of 2684	2728	43818f356317a3fdaf9c4740c25fe070N.exe	38
PID 2728 wrote to memory of 2684	2728	43818f356317a3fdaf9c4740c25fe070N.exe	38
PID 2728 wrote to memory of 916	2728	43818f356317a3fdaf9c4740c25fe070N.exe	39
PID 2728 wrote to memory of 916	2728	43818f356317a3fdaf9c4740c25fe070N.exe	39
PID 2728 wrote to memory of 916	2728	43818f356317a3fdaf9c4740c25fe070N.exe	39
PID 2728 wrote to memory of 1440	2728	43818f356317a3fdaf9c4740c25fe070N.exe	40
PID 2728 wrote to memory of 1440	2728	43818f356317a3fdaf9c4740c25fe070N.exe	40
PID 2728 wrote to memory of 1440	2728	43818f356317a3fdaf9c4740c25fe070N.exe	40
PID 2728 wrote to memory of 2964	2728	43818f356317a3fdaf9c4740c25fe070N.exe	41
PID 2728 wrote to memory of 2964	2728	43818f356317a3fdaf9c4740c25fe070N.exe	41
PID 2728 wrote to memory of 2964	2728	43818f356317a3fdaf9c4740c25fe070N.exe	41
PID 2728 wrote to memory of 2108	2728	43818f356317a3fdaf9c4740c25fe070N.exe	42
PID 2728 wrote to memory of 2108	2728	43818f356317a3fdaf9c4740c25fe070N.exe	42
PID 2728 wrote to memory of 2108	2728	43818f356317a3fdaf9c4740c25fe070N.exe	42
PID 2728 wrote to memory of 2572	2728	43818f356317a3fdaf9c4740c25fe070N.exe	43
PID 2728 wrote to memory of 2572	2728	43818f356317a3fdaf9c4740c25fe070N.exe	43
PID 2728 wrote to memory of 2572	2728	43818f356317a3fdaf9c4740c25fe070N.exe	43
PID 2728 wrote to memory of 2900	2728	43818f356317a3fdaf9c4740c25fe070N.exe	44
PID 2728 wrote to memory of 2900	2728	43818f356317a3fdaf9c4740c25fe070N.exe	44
PID 2728 wrote to memory of 2900	2728	43818f356317a3fdaf9c4740c25fe070N.exe	44
PID 2728 wrote to memory of 2400	2728	43818f356317a3fdaf9c4740c25fe070N.exe	45
PID 2728 wrote to memory of 2400	2728	43818f356317a3fdaf9c4740c25fe070N.exe	45
PID 2728 wrote to memory of 2400	2728	43818f356317a3fdaf9c4740c25fe070N.exe	45
PID 2728 wrote to memory of 2204	2728	43818f356317a3fdaf9c4740c25fe070N.exe	46
PID 2728 wrote to memory of 2204	2728	43818f356317a3fdaf9c4740c25fe070N.exe	46
PID 2728 wrote to memory of 2204	2728	43818f356317a3fdaf9c4740c25fe070N.exe	46
PID 2728 wrote to memory of 2488	2728	43818f356317a3fdaf9c4740c25fe070N.exe	47
PID 2728 wrote to memory of 2488	2728	43818f356317a3fdaf9c4740c25fe070N.exe	47
PID 2728 wrote to memory of 2488	2728	43818f356317a3fdaf9c4740c25fe070N.exe	47
PID 2728 wrote to memory of 2140	2728	43818f356317a3fdaf9c4740c25fe070N.exe	48
PID 2728 wrote to memory of 2140	2728	43818f356317a3fdaf9c4740c25fe070N.exe	48
PID 2728 wrote to memory of 2140	2728	43818f356317a3fdaf9c4740c25fe070N.exe	48
PID 2728 wrote to memory of 596	2728	43818f356317a3fdaf9c4740c25fe070N.exe	49
PID 2728 wrote to memory of 596	2728	43818f356317a3fdaf9c4740c25fe070N.exe	49
PID 2728 wrote to memory of 596	2728	43818f356317a3fdaf9c4740c25fe070N.exe	49
PID 2728 wrote to memory of 668	2728	43818f356317a3fdaf9c4740c25fe070N.exe	50
PID 2728 wrote to memory of 668	2728	43818f356317a3fdaf9c4740c25fe070N.exe	50
PID 2728 wrote to memory of 668	2728	43818f356317a3fdaf9c4740c25fe070N.exe	50
PID 2728 wrote to memory of 1352	2728	43818f356317a3fdaf9c4740c25fe070N.exe	51
PID 2728 wrote to memory of 1352	2728	43818f356317a3fdaf9c4740c25fe070N.exe	51
PID 2728 wrote to memory of 1352	2728	43818f356317a3fdaf9c4740c25fe070N.exe	51
PID 2728 wrote to memory of 2232	2728	43818f356317a3fdaf9c4740c25fe070N.exe	52

C:\Users\Admin\AppData\Local\Temp\43818f356317a3fdaf9c4740c25fe070N.exe
"C:\Users\Admin\AppData\Local\Temp\43818f356317a3fdaf9c4740c25fe070N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2884
- C:\Windows\System\uuKVSWk.exe
  C:\Windows\System\uuKVSWk.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\hWerbFC.exe
  C:\Windows\System\hWerbFC.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\FeTGObm.exe
  C:\Windows\System\FeTGObm.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\cMSVOvY.exe
  C:\Windows\System\cMSVOvY.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\GThrvLS.exe
  C:\Windows\System\GThrvLS.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\SBesyJa.exe
  C:\Windows\System\SBesyJa.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\TnjzmqO.exe
  C:\Windows\System\TnjzmqO.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\rBLfXiO.exe
  C:\Windows\System\rBLfXiO.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\IbUgmNv.exe
  C:\Windows\System\IbUgmNv.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\kHffbhv.exe
  C:\Windows\System\kHffbhv.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\wVPHMFD.exe
  C:\Windows\System\wVPHMFD.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\FETGirQ.exe
  C:\Windows\System\FETGirQ.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\sKDeZVU.exe
  C:\Windows\System\sKDeZVU.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\eVXPHWh.exe
  C:\Windows\System\eVXPHWh.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\KRgnTZG.exe
  C:\Windows\System\KRgnTZG.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\HnISkdG.exe
  C:\Windows\System\HnISkdG.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\RAXKOiK.exe
  C:\Windows\System\RAXKOiK.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\IYxhNpJ.exe
  C:\Windows\System\IYxhNpJ.exe
  2⤵
  - Executes dropped EXE
  PID:596
- C:\Windows\System\xrMvtfZ.exe
  C:\Windows\System\xrMvtfZ.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\lilaOju.exe
  C:\Windows\System\lilaOju.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\nBarezK.exe
  C:\Windows\System\nBarezK.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\gmGHGCq.exe
  C:\Windows\System\gmGHGCq.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\aIdDZCb.exe
  C:\Windows\System\aIdDZCb.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\ZuRHXkt.exe
  C:\Windows\System\ZuRHXkt.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\apZkRnD.exe
  C:\Windows\System\apZkRnD.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\yPjQqiu.exe
  C:\Windows\System\yPjQqiu.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\heZqrqf.exe
  C:\Windows\System\heZqrqf.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\sZAsQuy.exe
  C:\Windows\System\sZAsQuy.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\uLeErKX.exe
  C:\Windows\System\uLeErKX.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\StlTzAs.exe
  C:\Windows\System\StlTzAs.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\doezzjo.exe
  C:\Windows\System\doezzjo.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\DzWAlAS.exe
  C:\Windows\System\DzWAlAS.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\ubulydc.exe
  C:\Windows\System\ubulydc.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\VGHDWFJ.exe
  C:\Windows\System\VGHDWFJ.exe
  2⤵
  - Executes dropped EXE
  PID:608
- C:\Windows\System\NPPPIyY.exe
  C:\Windows\System\NPPPIyY.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\DNesCJl.exe
  C:\Windows\System\DNesCJl.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\bZtokqP.exe
  C:\Windows\System\bZtokqP.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\zLqSmRP.exe
  C:\Windows\System\zLqSmRP.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\ANZExZq.exe
  C:\Windows\System\ANZExZq.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\YIJwEJJ.exe
  C:\Windows\System\YIJwEJJ.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\IuNVfSG.exe
  C:\Windows\System\IuNVfSG.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\UQqNihO.exe
  C:\Windows\System\UQqNihO.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\CmWjDnU.exe
  C:\Windows\System\CmWjDnU.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\ZBALBWn.exe
  C:\Windows\System\ZBALBWn.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\dGmVImc.exe
  C:\Windows\System\dGmVImc.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\jAZGRfu.exe
  C:\Windows\System\jAZGRfu.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\YxlfNpv.exe
  C:\Windows\System\YxlfNpv.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\QPCMUsp.exe
  C:\Windows\System\QPCMUsp.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\MaiMuuS.exe
  C:\Windows\System\MaiMuuS.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\lCBnjIw.exe
  C:\Windows\System\lCBnjIw.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\qWVDmCw.exe
  C:\Windows\System\qWVDmCw.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\bgSNEvv.exe
  C:\Windows\System\bgSNEvv.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\TwvxUcM.exe
  C:\Windows\System\TwvxUcM.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\TlZoyjh.exe
  C:\Windows\System\TlZoyjh.exe
  2⤵
  - Executes dropped EXE
  PID:364
- C:\Windows\System\EXhbPEV.exe
  C:\Windows\System\EXhbPEV.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\TuueHqn.exe
  C:\Windows\System\TuueHqn.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\xyaqyfa.exe
  C:\Windows\System\xyaqyfa.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\EkTbogt.exe
  C:\Windows\System\EkTbogt.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\hjIPulk.exe
  C:\Windows\System\hjIPulk.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\sNRZTht.exe
  C:\Windows\System\sNRZTht.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\nRptlOT.exe
  C:\Windows\System\nRptlOT.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\ptZgwzL.exe
  C:\Windows\System\ptZgwzL.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\KtaNRUl.exe
  C:\Windows\System\KtaNRUl.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\Swxfxtm.exe
  C:\Windows\System\Swxfxtm.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\ZvSSJQo.exe
  C:\Windows\System\ZvSSJQo.exe
  2⤵
  PID:2184
- C:\Windows\System\LjrkPgd.exe
  C:\Windows\System\LjrkPgd.exe
  2⤵
  PID:1492
- C:\Windows\System\zkPRNAa.exe
  C:\Windows\System\zkPRNAa.exe
  2⤵
  PID:2284
- C:\Windows\System\sASEpHW.exe
  C:\Windows\System\sASEpHW.exe
  2⤵
  PID:2252
- C:\Windows\System\bWcoYnz.exe
  C:\Windows\System\bWcoYnz.exe
  2⤵
  PID:2216
- C:\Windows\System\JYWSUWH.exe
  C:\Windows\System\JYWSUWH.exe
  2⤵
  PID:1792
- C:\Windows\System\ybputwV.exe
  C:\Windows\System\ybputwV.exe
  2⤵
  PID:1464
- C:\Windows\System\FhdULxR.exe
  C:\Windows\System\FhdULxR.exe
  2⤵
  PID:2100
- C:\Windows\System\TXCsTvS.exe
  C:\Windows\System\TXCsTvS.exe
  2⤵
  PID:1892
- C:\Windows\System\lrTtopK.exe
  C:\Windows\System\lrTtopK.exe
  2⤵
  PID:1528
- C:\Windows\System\iDsLtHw.exe
  C:\Windows\System\iDsLtHw.exe
  2⤵
  PID:2444
- C:\Windows\System\COvFRDm.exe
  C:\Windows\System\COvFRDm.exe
  2⤵
  PID:2004
- C:\Windows\System\gDBTHlI.exe
  C:\Windows\System\gDBTHlI.exe
  2⤵
  PID:1732
- C:\Windows\System\oHEYDWs.exe
  C:\Windows\System\oHEYDWs.exe
  2⤵
  PID:2988
- C:\Windows\System\jSDKvyu.exe
  C:\Windows\System\jSDKvyu.exe
  2⤵
  PID:1380
- C:\Windows\System\EEBDwSc.exe
  C:\Windows\System\EEBDwSc.exe
  2⤵
  PID:764
- C:\Windows\System\DLTyYZr.exe
  C:\Windows\System\DLTyYZr.exe
  2⤵
  PID:2356
- C:\Windows\System\eBjLhnK.exe
  C:\Windows\System\eBjLhnK.exe
  2⤵
  PID:1628
- C:\Windows\System\MwgVlFN.exe
  C:\Windows\System\MwgVlFN.exe
  2⤵
  PID:1124
- C:\Windows\System\qmMPSab.exe
  C:\Windows\System\qmMPSab.exe
  2⤵
  PID:676
- C:\Windows\System\qbpgldL.exe
  C:\Windows\System\qbpgldL.exe
  2⤵
  PID:1676
- C:\Windows\System\uMNEYzD.exe
  C:\Windows\System\uMNEYzD.exe
  2⤵
  PID:1664
- C:\Windows\System\dIFBZDQ.exe
  C:\Windows\System\dIFBZDQ.exe
  2⤵
  PID:1016
- C:\Windows\System\HyAhiGW.exe
  C:\Windows\System\HyAhiGW.exe
  2⤵
  PID:2196
- C:\Windows\System\BsxdSjI.exe
  C:\Windows\System\BsxdSjI.exe
  2⤵
  PID:2460
- C:\Windows\System\EJJlUbn.exe
  C:\Windows\System\EJJlUbn.exe
  2⤵
  PID:1580
- C:\Windows\System\MhEBZUD.exe
  C:\Windows\System\MhEBZUD.exe
  2⤵
  PID:2700
- C:\Windows\System\SnOmHsa.exe
  C:\Windows\System\SnOmHsa.exe
  2⤵
  PID:2592
- C:\Windows\System\ZiKrZlN.exe
  C:\Windows\System\ZiKrZlN.exe
  2⤵
  PID:1780
- C:\Windows\System\sWXrzRt.exe
  C:\Windows\System\sWXrzRt.exe
  2⤵
  PID:2736
- C:\Windows\System\BsetShR.exe
  C:\Windows\System\BsetShR.exe
  2⤵
  PID:2376
- C:\Windows\System\WQHtUIM.exe
  C:\Windows\System\WQHtUIM.exe
  2⤵
  PID:1084
- C:\Windows\System\hnEKCfw.exe
  C:\Windows\System\hnEKCfw.exe
  2⤵
  PID:652
- C:\Windows\System\IXgcIyl.exe
  C:\Windows\System\IXgcIyl.exe
  2⤵
  PID:2896
- C:\Windows\System\whkOBoZ.exe
  C:\Windows\System\whkOBoZ.exe
  2⤵
  PID:2384
- C:\Windows\System\LDZbGdf.exe
  C:\Windows\System\LDZbGdf.exe
  2⤵
  PID:1104
- C:\Windows\System\POqjZxu.exe
  C:\Windows\System\POqjZxu.exe
  2⤵
  PID:2796
- C:\Windows\System\qKcoeWH.exe
  C:\Windows\System\qKcoeWH.exe
  2⤵
  PID:2392
- C:\Windows\System\NagEQCX.exe
  C:\Windows\System\NagEQCX.exe
  2⤵
  PID:2832
- C:\Windows\System\UobiGcI.exe
  C:\Windows\System\UobiGcI.exe
  2⤵
  PID:2396
- C:\Windows\System\SnADPCj.exe
  C:\Windows\System\SnADPCj.exe
  2⤵
  PID:2844
- C:\Windows\System\pjsvDdT.exe
  C:\Windows\System\pjsvDdT.exe
  2⤵
  PID:2148
- C:\Windows\System\Eelescs.exe
  C:\Windows\System\Eelescs.exe
  2⤵
  PID:2040
- C:\Windows\System\NfJrTjT.exe
  C:\Windows\System\NfJrTjT.exe
  2⤵
  PID:2128
- C:\Windows\System\SEgfciB.exe
  C:\Windows\System\SEgfciB.exe
  2⤵
  PID:2032
- C:\Windows\System\XTPAZBS.exe
  C:\Windows\System\XTPAZBS.exe
  2⤵
  PID:1228
- C:\Windows\System\SmKyCCL.exe
  C:\Windows\System\SmKyCCL.exe
  2⤵
  PID:2244
- C:\Windows\System\cqkjoMR.exe
  C:\Windows\System\cqkjoMR.exe
  2⤵
  PID:732
- C:\Windows\System\qENkRNv.exe
  C:\Windows\System\qENkRNv.exe
  2⤵
  PID:1288
- C:\Windows\System\gnLNloG.exe
  C:\Windows\System\gnLNloG.exe
  2⤵
  PID:1516
- C:\Windows\System\rksVhdd.exe
  C:\Windows\System\rksVhdd.exe
  2⤵
  PID:3048
- C:\Windows\System\lbzZNew.exe
  C:\Windows\System\lbzZNew.exe
  2⤵
  PID:2224
- C:\Windows\System\eUzgTNn.exe
  C:\Windows\System\eUzgTNn.exe
  2⤵
  PID:2664
- C:\Windows\System\VivMmFH.exe
  C:\Windows\System\VivMmFH.exe
  2⤵
  PID:2756
- C:\Windows\System\ZDJrGTg.exe
  C:\Windows\System\ZDJrGTg.exe
  2⤵
  PID:2992
- C:\Windows\System\SflgVVl.exe
  C:\Windows\System\SflgVVl.exe
  2⤵
  PID:2424
- C:\Windows\System\rbLAPON.exe
  C:\Windows\System\rbLAPON.exe
  2⤵
  PID:1128
- C:\Windows\System\FJXjuYd.exe
  C:\Windows\System\FJXjuYd.exe
  2⤵
  PID:3000
- C:\Windows\System\zVRUAyX.exe
  C:\Windows\System\zVRUAyX.exe
  2⤵
  PID:2472
- C:\Windows\System\YrbFuwv.exe
  C:\Windows\System\YrbFuwv.exe
  2⤵
  PID:2520
- C:\Windows\System\cQYgdGV.exe
  C:\Windows\System\cQYgdGV.exe
  2⤵
  PID:336
- C:\Windows\System\pckGkvN.exe
  C:\Windows\System\pckGkvN.exe
  2⤵
  PID:2464
- C:\Windows\System\PwBLKSK.exe
  C:\Windows\System\PwBLKSK.exe
  2⤵
  PID:2644
- C:\Windows\System\kEojAYL.exe
  C:\Windows\System\kEojAYL.exe
  2⤵
  PID:2008
- C:\Windows\System\UuHnlXf.exe
  C:\Windows\System\UuHnlXf.exe
  2⤵
  PID:2268
- C:\Windows\System\sDEpkqS.exe
  C:\Windows\System\sDEpkqS.exe
  2⤵
  PID:1444
- C:\Windows\System\omwUkzI.exe
  C:\Windows\System\omwUkzI.exe
  2⤵
  PID:1964
- C:\Windows\System\ddzjifb.exe
  C:\Windows\System\ddzjifb.exe
  2⤵
  PID:2936
- C:\Windows\System\ixSyhkM.exe
  C:\Windows\System\ixSyhkM.exe
  2⤵
  PID:2060
- C:\Windows\System\gqmIFKv.exe
  C:\Windows\System\gqmIFKv.exe
  2⤵
  PID:2016
- C:\Windows\System\ZBVLvfD.exe
  C:\Windows\System\ZBVLvfD.exe
  2⤵
  PID:1660
- C:\Windows\System\rZDCilq.exe
  C:\Windows\System\rZDCilq.exe
  2⤵
  PID:2416
- C:\Windows\System\zNXEOGJ.exe
  C:\Windows\System\zNXEOGJ.exe
  2⤵
  PID:2340
- C:\Windows\System\MEbBSAu.exe
  C:\Windows\System\MEbBSAu.exe
  2⤵
  PID:1164
- C:\Windows\System\TxphWrj.exe
  C:\Windows\System\TxphWrj.exe
  2⤵
  PID:1712
- C:\Windows\System\FdpOmXI.exe
  C:\Windows\System\FdpOmXI.exe
  2⤵
  PID:2448
- C:\Windows\System\iYfSpiq.exe
  C:\Windows\System\iYfSpiq.exe
  2⤵
  PID:2112
- C:\Windows\System\GGHriRe.exe
  C:\Windows\System\GGHriRe.exe
  2⤵
  PID:1152
- C:\Windows\System\dJHhyXm.exe
  C:\Windows\System\dJHhyXm.exe
  2⤵
  PID:1432
- C:\Windows\System\XWpFARI.exe
  C:\Windows\System\XWpFARI.exe
  2⤵
  PID:1812
- C:\Windows\System\BVZqogk.exe
  C:\Windows\System\BVZqogk.exe
  2⤵
  PID:1588
- C:\Windows\System\fHhlSpA.exe
  C:\Windows\System\fHhlSpA.exe
  2⤵
  PID:884
- C:\Windows\System\bhTobtK.exe
  C:\Windows\System\bhTobtK.exe
  2⤵
  PID:960
- C:\Windows\System\QEgeVRn.exe
  C:\Windows\System\QEgeVRn.exe
  2⤵
  PID:2212
- C:\Windows\System\IuHmixt.exe
  C:\Windows\System\IuHmixt.exe
  2⤵
  PID:1988
- C:\Windows\System\gomgAEo.exe
  C:\Windows\System\gomgAEo.exe
  2⤵
  PID:616
- C:\Windows\System\MeqHvgU.exe
  C:\Windows\System\MeqHvgU.exe
  2⤵
  PID:1048
- C:\Windows\System\QfjEWic.exe
  C:\Windows\System\QfjEWic.exe
  2⤵
  PID:432
- C:\Windows\System\BqLIevV.exe
  C:\Windows\System\BqLIevV.exe
  2⤵
  PID:2372
- C:\Windows\System\AwbIjri.exe
  C:\Windows\System\AwbIjri.exe
  2⤵
  PID:1972
- C:\Windows\System\SBzMkwI.exe
  C:\Windows\System\SBzMkwI.exe
  2⤵
  PID:2556
- C:\Windows\System\hidDZma.exe
  C:\Windows\System\hidDZma.exe
  2⤵
  PID:1816
- C:\Windows\System\vAYLLbg.exe
  C:\Windows\System\vAYLLbg.exe
  2⤵
  PID:2096
- C:\Windows\System\rJDarrZ.exe
  C:\Windows\System\rJDarrZ.exe
  2⤵
  PID:1008
- C:\Windows\System\SKXqZjW.exe
  C:\Windows\System\SKXqZjW.exe
  2⤵
  PID:3044
- C:\Windows\System\MWoDvqo.exe
  C:\Windows\System\MWoDvqo.exe
  2⤵
  PID:1728
- C:\Windows\System\BKpywOj.exe
  C:\Windows\System\BKpywOj.exe
  2⤵
  PID:1348
- C:\Windows\System\zPkircv.exe
  C:\Windows\System\zPkircv.exe
  2⤵
  PID:572
- C:\Windows\System\qPUTeYA.exe
  C:\Windows\System\qPUTeYA.exe
  2⤵
  PID:2980
- C:\Windows\System\kYVVMCE.exe
  C:\Windows\System\kYVVMCE.exe
  2⤵
  PID:2116
- C:\Windows\System\GHCMKhC.exe
  C:\Windows\System\GHCMKhC.exe
  2⤵
  PID:3056
- C:\Windows\System\tvQhomX.exe
  C:\Windows\System\tvQhomX.exe
  2⤵
  PID:2276
- C:\Windows\System\jdwLNvj.exe
  C:\Windows\System\jdwLNvj.exe
  2⤵
  PID:1336
- C:\Windows\System\KQVQUmO.exe
  C:\Windows\System\KQVQUmO.exe
  2⤵
  PID:1372
- C:\Windows\System\POZItDc.exe
  C:\Windows\System\POZItDc.exe
  2⤵
  PID:3092
- C:\Windows\System\kaOJtna.exe
  C:\Windows\System\kaOJtna.exe
  2⤵
  PID:3112
- C:\Windows\System\EOsDiLq.exe
  C:\Windows\System\EOsDiLq.exe
  2⤵
  PID:3128
- C:\Windows\System\KkAuTxL.exe
  C:\Windows\System\KkAuTxL.exe
  2⤵
  PID:3148
- C:\Windows\System\KJKOttc.exe
  C:\Windows\System\KJKOttc.exe
  2⤵
  PID:3164
- C:\Windows\System\oUzNbXW.exe
  C:\Windows\System\oUzNbXW.exe
  2⤵
  PID:3272
- C:\Windows\System\kUKYOLG.exe
  C:\Windows\System\kUKYOLG.exe
  2⤵
  PID:3288
- C:\Windows\System\uCzAoOA.exe
  C:\Windows\System\uCzAoOA.exe
  2⤵
  PID:3308
- C:\Windows\System\dpaLHJn.exe
  C:\Windows\System\dpaLHJn.exe
  2⤵
  PID:3332
- C:\Windows\System\GIdQEil.exe
  C:\Windows\System\GIdQEil.exe
  2⤵
  PID:3348
- C:\Windows\System\TBnFdSz.exe
  C:\Windows\System\TBnFdSz.exe
  2⤵
  PID:3368
- C:\Windows\System\voKEhZL.exe
  C:\Windows\System\voKEhZL.exe
  2⤵
  PID:3392
- C:\Windows\System\LdnlIoc.exe
  C:\Windows\System\LdnlIoc.exe
  2⤵
  PID:3412
- C:\Windows\System\wVroMGf.exe
  C:\Windows\System\wVroMGf.exe
  2⤵
  PID:3440
- C:\Windows\System\niLqUGW.exe
  C:\Windows\System\niLqUGW.exe
  2⤵
  PID:3460
- C:\Windows\System\ssQkPqj.exe
  C:\Windows\System\ssQkPqj.exe
  2⤵
  PID:3480
- C:\Windows\System\cuBZOgc.exe
  C:\Windows\System\cuBZOgc.exe
  2⤵
  PID:3496
- C:\Windows\System\BOyYRzW.exe
  C:\Windows\System\BOyYRzW.exe
  2⤵
  PID:3516
- C:\Windows\System\gDuePeb.exe
  C:\Windows\System\gDuePeb.exe
  2⤵
  PID:3536
- C:\Windows\System\FXjIbYp.exe
  C:\Windows\System\FXjIbYp.exe
  2⤵
  PID:3600
- C:\Windows\System\fGzBGYx.exe
  C:\Windows\System\fGzBGYx.exe
  2⤵
  PID:3616
- C:\Windows\System\KUlTzbr.exe
  C:\Windows\System\KUlTzbr.exe
  2⤵
  PID:3636
- C:\Windows\System\IVcASwi.exe
  C:\Windows\System\IVcASwi.exe
  2⤵
  PID:3656
- C:\Windows\System\JTurcRx.exe
  C:\Windows\System\JTurcRx.exe
  2⤵
  PID:3676
- C:\Windows\System\crCqBxf.exe
  C:\Windows\System\crCqBxf.exe
  2⤵
  PID:3696
- C:\Windows\System\wDQMdtU.exe
  C:\Windows\System\wDQMdtU.exe
  2⤵
  PID:3720
- C:\Windows\System\DRcFAIA.exe
  C:\Windows\System\DRcFAIA.exe
  2⤵
  PID:3740
- C:\Windows\System\SszZGwk.exe
  C:\Windows\System\SszZGwk.exe
  2⤵
  PID:3764
- C:\Windows\System\kgIpWMY.exe
  C:\Windows\System\kgIpWMY.exe
  2⤵
  PID:3780
- C:\Windows\System\QhQohTL.exe
  C:\Windows\System\QhQohTL.exe
  2⤵
  PID:3804
- C:\Windows\System\huqocCB.exe
  C:\Windows\System\huqocCB.exe
  2⤵
  PID:3820
- C:\Windows\System\SJUhnTU.exe
  C:\Windows\System\SJUhnTU.exe
  2⤵
  PID:3840
- C:\Windows\System\PBJfwBD.exe
  C:\Windows\System\PBJfwBD.exe
  2⤵
  PID:3860
- C:\Windows\System\XsuvEWY.exe
  C:\Windows\System\XsuvEWY.exe
  2⤵
  PID:3884
- C:\Windows\System\HbiIkdM.exe
  C:\Windows\System\HbiIkdM.exe
  2⤵
  PID:3900
- C:\Windows\System\ILJPSrZ.exe
  C:\Windows\System\ILJPSrZ.exe
  2⤵
  PID:3920
- C:\Windows\System\vyoaEWB.exe
  C:\Windows\System\vyoaEWB.exe
  2⤵
  PID:3940
- C:\Windows\System\NsLeTVk.exe
  C:\Windows\System\NsLeTVk.exe
  2⤵
  PID:3964
- C:\Windows\System\DqerbkN.exe
  C:\Windows\System\DqerbkN.exe
  2⤵
  PID:3980
- C:\Windows\System\drdYxTB.exe
  C:\Windows\System\drdYxTB.exe
  2⤵
  PID:4004
- C:\Windows\System\QYkAfrQ.exe
  C:\Windows\System\QYkAfrQ.exe
  2⤵
  PID:4020
- C:\Windows\System\yUiaUgA.exe
  C:\Windows\System\yUiaUgA.exe
  2⤵
  PID:4044
- C:\Windows\System\IaWgNEV.exe
  C:\Windows\System\IaWgNEV.exe
  2⤵
  PID:4060
- C:\Windows\System\jgFligi.exe
  C:\Windows\System\jgFligi.exe
  2⤵
  PID:4084
- C:\Windows\System\JZhNGTZ.exe
  C:\Windows\System\JZhNGTZ.exe
  2⤵
  PID:1740
- C:\Windows\System\vuRAQiB.exe
  C:\Windows\System\vuRAQiB.exe
  2⤵
  PID:1668
- C:\Windows\System\tlQngRE.exe
  C:\Windows\System\tlQngRE.exe
  2⤵
  PID:2620
- C:\Windows\System\jolYzwj.exe
  C:\Windows\System\jolYzwj.exe
  2⤵
  PID:2484
- C:\Windows\System\tqWXFEt.exe
  C:\Windows\System\tqWXFEt.exe
  2⤵
  PID:3136
- C:\Windows\System\bOszKAu.exe
  C:\Windows\System\bOszKAu.exe
  2⤵
  PID:1284
- C:\Windows\System\ixSmLXj.exe
  C:\Windows\System\ixSmLXj.exe
  2⤵
  PID:3184
- C:\Windows\System\kTCvFMV.exe
  C:\Windows\System\kTCvFMV.exe
  2⤵
  PID:3100
- C:\Windows\System\jTHAyqJ.exe
  C:\Windows\System\jTHAyqJ.exe
  2⤵
  PID:3144
- C:\Windows\System\afptwVB.exe
  C:\Windows\System\afptwVB.exe
  2⤵
  PID:3200
- C:\Windows\System\MCBfJtu.exe
  C:\Windows\System\MCBfJtu.exe
  2⤵
  PID:3240
- C:\Windows\System\BUseLiC.exe
  C:\Windows\System\BUseLiC.exe
  2⤵
  PID:3212
- C:\Windows\System\luqZAIq.exe
  C:\Windows\System\luqZAIq.exe
  2⤵
  PID:3176
- C:\Windows\System\kcsWnNm.exe
  C:\Windows\System\kcsWnNm.exe
  2⤵
  PID:3304
- C:\Windows\System\fyHENCQ.exe
  C:\Windows\System\fyHENCQ.exe
  2⤵
  PID:3328
- C:\Windows\System\KOLvBSE.exe
  C:\Windows\System\KOLvBSE.exe
  2⤵
  PID:3356
- C:\Windows\System\bsVVYgs.exe
  C:\Windows\System\bsVVYgs.exe
  2⤵
  PID:3384
- C:\Windows\System\uZFNZfe.exe
  C:\Windows\System\uZFNZfe.exe
  2⤵
  PID:3404
- C:\Windows\System\druldsD.exe
  C:\Windows\System\druldsD.exe
  2⤵
  PID:3408
- C:\Windows\System\nsakbRF.exe
  C:\Windows\System\nsakbRF.exe
  2⤵
  PID:3452
- C:\Windows\System\WPEROvw.exe
  C:\Windows\System\WPEROvw.exe
  2⤵
  PID:3488
- C:\Windows\System\NMfZzov.exe
  C:\Windows\System\NMfZzov.exe
  2⤵
  PID:3524
- C:\Windows\System\zuDcRsR.exe
  C:\Windows\System\zuDcRsR.exe
  2⤵
  PID:3576
- C:\Windows\System\YHsAinW.exe
  C:\Windows\System\YHsAinW.exe
  2⤵
  PID:3568
- C:\Windows\System\orXSWOc.exe
  C:\Windows\System\orXSWOc.exe
  2⤵
  PID:3552
- C:\Windows\System\OXsuPxa.exe
  C:\Windows\System\OXsuPxa.exe
  2⤵
  PID:3624
- C:\Windows\System\egzpEUp.exe
  C:\Windows\System\egzpEUp.exe
  2⤵
  PID:3652
- C:\Windows\System\TyZZJHI.exe
  C:\Windows\System\TyZZJHI.exe
  2⤵
  PID:3668
- C:\Windows\System\kMkBnsD.exe
  C:\Windows\System\kMkBnsD.exe
  2⤵
  PID:3692
- C:\Windows\System\bySVQCq.exe
  C:\Windows\System\bySVQCq.exe
  2⤵
  PID:3732
- C:\Windows\System\dKGpRCT.exe
  C:\Windows\System\dKGpRCT.exe
  2⤵
  PID:3772
- C:\Windows\System\urCWAFP.exe
  C:\Windows\System\urCWAFP.exe
  2⤵
  PID:3852
- C:\Windows\System\bKbXVZD.exe
  C:\Windows\System\bKbXVZD.exe
  2⤵
  PID:3896
- C:\Windows\System\TSozQsI.exe
  C:\Windows\System\TSozQsI.exe
  2⤵
  PID:3936
- C:\Windows\System\ZHiIhYM.exe
  C:\Windows\System\ZHiIhYM.exe
  2⤵
  PID:3956
- C:\Windows\System\hpuZuNk.exe
  C:\Windows\System\hpuZuNk.exe
  2⤵
  PID:3976
- C:\Windows\System\nSRJYji.exe
  C:\Windows\System\nSRJYji.exe
  2⤵
  PID:3992
- C:\Windows\System\ruhGlcF.exe
  C:\Windows\System\ruhGlcF.exe
  2⤵
  PID:4036
- C:\Windows\System\MtaeXPA.exe
  C:\Windows\System\MtaeXPA.exe
  2⤵
  PID:4056
- C:\Windows\System\rWltTwS.exe
  C:\Windows\System\rWltTwS.exe
  2⤵
  PID:3716
- C:\Windows\System\dlRSroz.exe
  C:\Windows\System\dlRSroz.exe
  2⤵
  PID:2792
- C:\Windows\System\kSwPEHB.exe
  C:\Windows\System\kSwPEHB.exe
  2⤵
  PID:1196
- C:\Windows\System\ukeYQqy.exe
  C:\Windows\System\ukeYQqy.exe
  2⤵
  PID:3252
- C:\Windows\System\JTwdMQm.exe
  C:\Windows\System\JTwdMQm.exe
  2⤵
  PID:3140
- C:\Windows\System\wKOFTwi.exe
  C:\Windows\System\wKOFTwi.exe
  2⤵
  PID:3220
- C:\Windows\System\KowwLbg.exe
  C:\Windows\System\KowwLbg.exe
  2⤵
  PID:3260
- C:\Windows\System\BDbnUrl.exe
  C:\Windows\System\BDbnUrl.exe
  2⤵
  PID:3344
- C:\Windows\System\cWrikQY.exe
  C:\Windows\System\cWrikQY.exe
  2⤵
  PID:3400
- C:\Windows\System\AHCNFmt.exe
  C:\Windows\System\AHCNFmt.exe
  2⤵
  PID:3324
- C:\Windows\System\pjoEPbm.exe
  C:\Windows\System\pjoEPbm.exe
  2⤵
  PID:3560
- C:\Windows\System\KoZobBP.exe
  C:\Windows\System\KoZobBP.exe
  2⤵
  PID:3608
- C:\Windows\System\BpdJYIE.exe
  C:\Windows\System\BpdJYIE.exe
  2⤵
  PID:3672
- C:\Windows\System\wgEldjx.exe
  C:\Windows\System\wgEldjx.exe
  2⤵
  PID:3736
- C:\Windows\System\zpVRaxo.exe
  C:\Windows\System\zpVRaxo.exe
  2⤵
  PID:3528
- C:\Windows\System\tJaHPpO.exe
  C:\Windows\System\tJaHPpO.exe
  2⤵
  PID:2192
- C:\Windows\System\gTKeQjC.exe
  C:\Windows\System\gTKeQjC.exe
  2⤵
  PID:3836
- C:\Windows\System\jYCfHQa.exe
  C:\Windows\System\jYCfHQa.exe
  2⤵
  PID:3644
- C:\Windows\System\VIpsPNZ.exe
  C:\Windows\System\VIpsPNZ.exe
  2⤵
  PID:3688
- C:\Windows\System\SqSsTdE.exe
  C:\Windows\System\SqSsTdE.exe
  2⤵
  PID:2152
- C:\Windows\System\GpJwyuc.exe
  C:\Windows\System\GpJwyuc.exe
  2⤵
  PID:3996
- C:\Windows\System\AmduBrY.exe
  C:\Windows\System\AmduBrY.exe
  2⤵
  PID:2480
- C:\Windows\System\ECrnGhS.exe
  C:\Windows\System\ECrnGhS.exe
  2⤵
  PID:3236
- C:\Windows\System\MkgFnpG.exe
  C:\Windows\System\MkgFnpG.exe
  2⤵
  PID:3216
- C:\Windows\System\iSYjqHS.exe
  C:\Windows\System\iSYjqHS.exe
  2⤵
  PID:3268
- C:\Windows\System\gsiCQvq.exe
  C:\Windows\System\gsiCQvq.exe
  2⤵
  PID:3504
- C:\Windows\System\HqZaCMl.exe
  C:\Windows\System\HqZaCMl.exe
  2⤵
  PID:3340
- C:\Windows\System\FQdncBk.exe
  C:\Windows\System\FQdncBk.exe
  2⤵
  PID:3544
- C:\Windows\System\iqbKoEV.exe
  C:\Windows\System\iqbKoEV.exe
  2⤵
  PID:3848
- C:\Windows\System\WYXQWVt.exe
  C:\Windows\System\WYXQWVt.exe
  2⤵
  PID:3892
- C:\Windows\System\pJNjqQc.exe
  C:\Windows\System\pJNjqQc.exe
  2⤵
  PID:3880
- C:\Windows\System\lFEAbDr.exe
  C:\Windows\System\lFEAbDr.exe
  2⤵
  PID:3428
- C:\Windows\System\sTdToWo.exe
  C:\Windows\System\sTdToWo.exe
  2⤵
  PID:3124
- C:\Windows\System\vCBLujr.exe
  C:\Windows\System\vCBLujr.exe
  2⤵
  PID:3664
- C:\Windows\System\vCczlnY.exe
  C:\Windows\System\vCczlnY.exe
  2⤵
  PID:3828
- C:\Windows\System\GQeXhzu.exe
  C:\Windows\System\GQeXhzu.exe
  2⤵
  PID:4016
- C:\Windows\System\syvvHUx.exe
  C:\Windows\System\syvvHUx.exe
  2⤵
  PID:3376
- C:\Windows\System\dQWvkrJ.exe
  C:\Windows\System\dQWvkrJ.exe
  2⤵
  PID:4032
- C:\Windows\System\XQoKvML.exe
  C:\Windows\System\XQoKvML.exe
  2⤵
  PID:3580
- C:\Windows\System\iwjTDqK.exe
  C:\Windows\System\iwjTDqK.exe
  2⤵
  PID:3792
- C:\Windows\System\QnbvFKU.exe
  C:\Windows\System\QnbvFKU.exe
  2⤵
  PID:4092
- C:\Windows\System\ntdsfVc.exe
  C:\Windows\System\ntdsfVc.exe
  2⤵
  PID:3192
- C:\Windows\System\CaPBIcx.exe
  C:\Windows\System\CaPBIcx.exe
  2⤵
  PID:3708
- C:\Windows\System\AeazbRa.exe
  C:\Windows\System\AeazbRa.exe
  2⤵
  PID:4108
- C:\Windows\System\HkHBCbB.exe
  C:\Windows\System\HkHBCbB.exe
  2⤵
  PID:4124
- C:\Windows\System\VPcsmwg.exe
  C:\Windows\System\VPcsmwg.exe
  2⤵
  PID:4148
- C:\Windows\System\BLAKCuN.exe
  C:\Windows\System\BLAKCuN.exe
  2⤵
  PID:4172
- C:\Windows\System\sahOMrO.exe
  C:\Windows\System\sahOMrO.exe
  2⤵
  PID:4188
- C:\Windows\System\qMCpsqR.exe
  C:\Windows\System\qMCpsqR.exe
  2⤵
  PID:4216
- C:\Windows\System\tNAQEpO.exe
  C:\Windows\System\tNAQEpO.exe
  2⤵
  PID:4236
- C:\Windows\System\wzaRWzK.exe
  C:\Windows\System\wzaRWzK.exe
  2⤵
  PID:4256
- C:\Windows\System\OraeuBs.exe
  C:\Windows\System\OraeuBs.exe
  2⤵
  PID:4272
- C:\Windows\System\jGyUjGR.exe
  C:\Windows\System\jGyUjGR.exe
  2⤵
  PID:4288
- C:\Windows\System\ogTSqYL.exe
  C:\Windows\System\ogTSqYL.exe
  2⤵
  PID:4304
- C:\Windows\System\qYqrFQw.exe
  C:\Windows\System\qYqrFQw.exe
  2⤵
  PID:4324
- C:\Windows\System\mXwHikw.exe
  C:\Windows\System\mXwHikw.exe
  2⤵
  PID:4340
- C:\Windows\System\NEcXpwS.exe
  C:\Windows\System\NEcXpwS.exe
  2⤵
  PID:4364
- C:\Windows\System\xfmOTRD.exe
  C:\Windows\System\xfmOTRD.exe
  2⤵
  PID:4384
- C:\Windows\System\jWgFQWc.exe
  C:\Windows\System\jWgFQWc.exe
  2⤵
  PID:4400
- C:\Windows\System\tyItsHV.exe
  C:\Windows\System\tyItsHV.exe
  2⤵
  PID:4424
- C:\Windows\System\leQnJyK.exe
  C:\Windows\System\leQnJyK.exe
  2⤵
  PID:4444
- C:\Windows\System\KJHcVug.exe
  C:\Windows\System\KJHcVug.exe
  2⤵
  PID:4476
- C:\Windows\System\IHwppeG.exe
  C:\Windows\System\IHwppeG.exe
  2⤵
  PID:4492
- C:\Windows\System\SHazrjg.exe
  C:\Windows\System\SHazrjg.exe
  2⤵
  PID:4544
- C:\Windows\System\RPFDhZr.exe
  C:\Windows\System\RPFDhZr.exe
  2⤵
  PID:4600
- C:\Windows\System\FcrRlfa.exe
  C:\Windows\System\FcrRlfa.exe
  2⤵
  PID:4616
- C:\Windows\System\uDMzQXu.exe
  C:\Windows\System\uDMzQXu.exe
  2⤵
  PID:4632
- C:\Windows\System\QxtDQcG.exe
  C:\Windows\System\QxtDQcG.exe
  2⤵
  PID:4648
- C:\Windows\System\oDygdFw.exe
  C:\Windows\System\oDygdFw.exe
  2⤵
  PID:4664
- C:\Windows\System\dAFTbKM.exe
  C:\Windows\System\dAFTbKM.exe
  2⤵
  PID:4680
- C:\Windows\System\fcwdqDC.exe
  C:\Windows\System\fcwdqDC.exe
  2⤵
  PID:4700
- C:\Windows\System\yZCCGgY.exe
  C:\Windows\System\yZCCGgY.exe
  2⤵
  PID:4716
- C:\Windows\System\XeCCNNc.exe
  C:\Windows\System\XeCCNNc.exe
  2⤵
  PID:4732
- C:\Windows\System\bujejCr.exe
  C:\Windows\System\bujejCr.exe
  2⤵
  PID:4748
- C:\Windows\System\KzCLQId.exe
  C:\Windows\System\KzCLQId.exe
  2⤵
  PID:4764
- C:\Windows\System\rNVmpMB.exe
  C:\Windows\System\rNVmpMB.exe
  2⤵
  PID:4780
- C:\Windows\System\iZCeZXR.exe
  C:\Windows\System\iZCeZXR.exe
  2⤵
  PID:4796
- C:\Windows\System\pMdmcqH.exe
  C:\Windows\System\pMdmcqH.exe
  2⤵
  PID:4812
- C:\Windows\System\nSogaqp.exe
  C:\Windows\System\nSogaqp.exe
  2⤵
  PID:4828
- C:\Windows\System\SzmAjrO.exe
  C:\Windows\System\SzmAjrO.exe
  2⤵
  PID:4844
- C:\Windows\System\IixZdTL.exe
  C:\Windows\System\IixZdTL.exe
  2⤵
  PID:4860
- C:\Windows\System\hCGtLAd.exe
  C:\Windows\System\hCGtLAd.exe
  2⤵
  PID:4884
- C:\Windows\System\CGYVNBj.exe
  C:\Windows\System\CGYVNBj.exe
  2⤵
  PID:4900
- C:\Windows\System\aobElPK.exe
  C:\Windows\System\aobElPK.exe
  2⤵
  PID:4916
- C:\Windows\System\ZTpZkos.exe
  C:\Windows\System\ZTpZkos.exe
  2⤵
  PID:4932
- C:\Windows\System\wqffBDI.exe
  C:\Windows\System\wqffBDI.exe
  2⤵
  PID:4948
- C:\Windows\System\lPbdEUF.exe
  C:\Windows\System\lPbdEUF.exe
  2⤵
  PID:4968
- C:\Windows\System\ORCgfvE.exe
  C:\Windows\System\ORCgfvE.exe
  2⤵
  PID:4984
- C:\Windows\System\JmVotDp.exe
  C:\Windows\System\JmVotDp.exe
  2⤵
  PID:5000
- C:\Windows\System\qjnzCaZ.exe
  C:\Windows\System\qjnzCaZ.exe
  2⤵
  PID:5016
- C:\Windows\System\ntrYWCh.exe
  C:\Windows\System\ntrYWCh.exe
  2⤵
  PID:5044
- C:\Windows\System\zkHxLHT.exe
  C:\Windows\System\zkHxLHT.exe
  2⤵
  PID:5060
- C:\Windows\System\ybVEyOD.exe
  C:\Windows\System\ybVEyOD.exe
  2⤵
  PID:5076
- C:\Windows\System\cQSNmeF.exe
  C:\Windows\System\cQSNmeF.exe
  2⤵
  PID:5104
- C:\Windows\System\xAmlCyw.exe
  C:\Windows\System\xAmlCyw.exe
  2⤵
  PID:3812
- C:\Windows\System\uiBTMWq.exe
  C:\Windows\System\uiBTMWq.exe
  2⤵
  PID:4076
- C:\Windows\System\tZBRKkL.exe
  C:\Windows\System\tZBRKkL.exe
  2⤵
  PID:4116
- C:\Windows\System\RpneqvH.exe
  C:\Windows\System\RpneqvH.exe
  2⤵
  PID:3752
- C:\Windows\System\vwNnQVj.exe
  C:\Windows\System\vwNnQVj.exe
  2⤵
  PID:4132
- C:\Windows\System\FQwBLRq.exe
  C:\Windows\System\FQwBLRq.exe
  2⤵
  PID:4140
- C:\Windows\System\SYPcMkC.exe
  C:\Windows\System\SYPcMkC.exe
  2⤵
  PID:4156
- C:\Windows\System\vVLNqej.exe
  C:\Windows\System\vVLNqej.exe
  2⤵
  PID:4204
- C:\Windows\System\GNnYQhu.exe
  C:\Windows\System\GNnYQhu.exe
  2⤵
  PID:4136
- C:\Windows\System\obmiHdS.exe
  C:\Windows\System\obmiHdS.exe
  2⤵
  PID:4180
- C:\Windows\System\juwbjbA.exe
  C:\Windows\System\juwbjbA.exe
  2⤵
  PID:4280
- C:\Windows\System\NaEnykS.exe
  C:\Windows\System\NaEnykS.exe
  2⤵
  PID:4316
- C:\Windows\System\odgHrRw.exe
  C:\Windows\System\odgHrRw.exe
  2⤵
  PID:4300
- C:\Windows\System\HIvbguW.exe
  C:\Windows\System\HIvbguW.exe
  2⤵
  PID:4360
- C:\Windows\System\xYvWiPg.exe
  C:\Windows\System\xYvWiPg.exe
  2⤵
  PID:4392
- C:\Windows\System\sQWnphg.exe
  C:\Windows\System\sQWnphg.exe
  2⤵
  PID:4440
- C:\Windows\System\salgaOZ.exe
  C:\Windows\System\salgaOZ.exe
  2⤵
  PID:4416
- C:\Windows\System\ZzaCost.exe
  C:\Windows\System\ZzaCost.exe
  2⤵
  PID:4516
- C:\Windows\System\kcmWkAA.exe
  C:\Windows\System\kcmWkAA.exe
  2⤵
  PID:4512
- C:\Windows\System\ELNnWSN.exe
  C:\Windows\System\ELNnWSN.exe
  2⤵
  PID:4556
- C:\Windows\System\bvXcQxk.exe
  C:\Windows\System\bvXcQxk.exe
  2⤵
  PID:4568
- C:\Windows\System\aIKGRyX.exe
  C:\Windows\System\aIKGRyX.exe
  2⤵
  PID:4612
- C:\Windows\System\OSszput.exe
  C:\Windows\System\OSszput.exe
  2⤵
  PID:4708
- C:\Windows\System\YgpzMDG.exe
  C:\Windows\System\YgpzMDG.exe
  2⤵
  PID:4712
- C:\Windows\System\cNGFqRU.exe
  C:\Windows\System\cNGFqRU.exe
  2⤵
  PID:4776
- C:\Windows\System\KReWEUT.exe
  C:\Windows\System\KReWEUT.exe
  2⤵
  PID:4688
- C:\Windows\System\eUcEVQZ.exe
  C:\Windows\System\eUcEVQZ.exe
  2⤵
  PID:4724
- C:\Windows\System\aMhWBSh.exe
  C:\Windows\System\aMhWBSh.exe
  2⤵
  PID:4820
- C:\Windows\System\sncbtsU.exe
  C:\Windows\System\sncbtsU.exe
  2⤵
  PID:4856
- C:\Windows\System\YIONFLu.exe
  C:\Windows\System\YIONFLu.exe
  2⤵
  PID:4880
- C:\Windows\System\XEtuJBh.exe
  C:\Windows\System\XEtuJBh.exe
  2⤵
  PID:4912
- C:\Windows\System\WaWTUpF.exe
  C:\Windows\System\WaWTUpF.exe
  2⤵
  PID:4940
- C:\Windows\System\HcThuXF.exe
  C:\Windows\System\HcThuXF.exe
  2⤵
  PID:5024
- C:\Windows\System\ClGFAVx.exe
  C:\Windows\System\ClGFAVx.exe
  2⤵
  PID:5028
- C:\Windows\System\glafCJr.exe
  C:\Windows\System\glafCJr.exe
  2⤵
  PID:4976
- C:\Windows\System\YDopQDP.exe
  C:\Windows\System\YDopQDP.exe
  2⤵
  PID:5116
- C:\Windows\System\BtVhqTL.exe
  C:\Windows\System\BtVhqTL.exe
  2⤵
  PID:3160
- C:\Windows\System\LAmWwDh.exe
  C:\Windows\System\LAmWwDh.exe
  2⤵
  PID:4380
- C:\Windows\System\pzLIGwD.exe
  C:\Windows\System\pzLIGwD.exe
  2⤵
  PID:4420
- C:\Windows\System\DjosXVD.exe
  C:\Windows\System\DjosXVD.exe
  2⤵
  PID:4532
- C:\Windows\System\DFDjlhO.exe
  C:\Windows\System\DFDjlhO.exe
  2⤵
  PID:4592
- C:\Windows\System\BIJvDQR.exe
  C:\Windows\System\BIJvDQR.exe
  2⤵
  PID:4660
- C:\Windows\System\GrmqNhc.exe
  C:\Windows\System\GrmqNhc.exe
  2⤵
  PID:4596
- C:\Windows\System\VVLgLUw.exe
  C:\Windows\System\VVLgLUw.exe
  2⤵
  PID:4908
- C:\Windows\System\gBFxAZD.exe
  C:\Windows\System\gBFxAZD.exe
  2⤵
  PID:4924
- C:\Windows\System\tofkxDa.exe
  C:\Windows\System\tofkxDa.exe
  2⤵
  PID:4876
- C:\Windows\System\SmfNvHw.exe
  C:\Windows\System\SmfNvHw.exe
  2⤵
  PID:5072
- C:\Windows\System\ffEqWJZ.exe
  C:\Windows\System\ffEqWJZ.exe
  2⤵
  PID:5096
- C:\Windows\System\NneVWmw.exe
  C:\Windows\System\NneVWmw.exe
  2⤵
  PID:5112
- C:\Windows\System\RNxLHXf.exe
  C:\Windows\System\RNxLHXf.exe
  2⤵
  PID:4144
- C:\Windows\System\qKCXJUL.exe
  C:\Windows\System\qKCXJUL.exe
  2⤵
  PID:2240
- C:\Windows\System\moPowSx.exe
  C:\Windows\System\moPowSx.exe
  2⤵
  PID:4248
- C:\Windows\System\LSeRKyT.exe
  C:\Windows\System\LSeRKyT.exe
  2⤵
  PID:4376
- C:\Windows\System\SPqbaQF.exe
  C:\Windows\System\SPqbaQF.exe
  2⤵
  PID:4436
- C:\Windows\System\qmknGIq.exe
  C:\Windows\System\qmknGIq.exe
  2⤵
  PID:3232
- C:\Windows\System\NkgqoSD.exe
  C:\Windows\System\NkgqoSD.exe
  2⤵
  PID:4228
- C:\Windows\System\YJbwkCy.exe
  C:\Windows\System\YJbwkCy.exe
  2⤵
  PID:4536
- C:\Windows\System\LLUDGIc.exe
  C:\Windows\System\LLUDGIc.exe
  2⤵
  PID:4840
- C:\Windows\System\qZYUOPj.exe
  C:\Windows\System\qZYUOPj.exe
  2⤵
  PID:5068
- C:\Windows\System\ODMiUKK.exe
  C:\Windows\System\ODMiUKK.exe
  2⤵
  PID:4744
- C:\Windows\System\QCzRRcU.exe
  C:\Windows\System\QCzRRcU.exe
  2⤵
  PID:4640
- C:\Windows\System\tCaPoMG.exe
  C:\Windows\System\tCaPoMG.exe
  2⤵
  PID:4928
- C:\Windows\System\aEaMgjU.exe
  C:\Windows\System\aEaMgjU.exe
  2⤵
  PID:5100
- C:\Windows\System\yyetQzg.exe
  C:\Windows\System\yyetQzg.exe
  2⤵
  PID:4168
- C:\Windows\System\IPuYYah.exe
  C:\Windows\System\IPuYYah.exe
  2⤵
  PID:4336
- C:\Windows\System\GurrhXh.exe
  C:\Windows\System\GurrhXh.exe
  2⤵
  PID:4484
- C:\Windows\System\GRnPKzZ.exe
  C:\Windows\System\GRnPKzZ.exe
  2⤵
  PID:3476
- C:\Windows\System\ZEEjzMp.exe
  C:\Windows\System\ZEEjzMp.exe
  2⤵
  PID:4528
- C:\Windows\System\cTsDyIa.exe
  C:\Windows\System\cTsDyIa.exe
  2⤵
  PID:4372
- C:\Windows\System\YOHLLIh.exe
  C:\Windows\System\YOHLLIh.exe
  2⤵
  PID:4808
- C:\Windows\System\KiezeqA.exe
  C:\Windows\System\KiezeqA.exe
  2⤵
  PID:5052
- C:\Windows\System\ZHRKiYp.exe
  C:\Windows\System\ZHRKiYp.exe
  2⤵
  PID:4676
- C:\Windows\System\LGCSpwu.exe
  C:\Windows\System\LGCSpwu.exe
  2⤵
  PID:904
- C:\Windows\System\RZUTbZL.exe
  C:\Windows\System\RZUTbZL.exe
  2⤵
  PID:4320
- C:\Windows\System\THziAjY.exe
  C:\Windows\System\THziAjY.exe
  2⤵
  PID:4264
- C:\Windows\System\KLaoald.exe
  C:\Windows\System\KLaoald.exe
  2⤵
  PID:4836
- C:\Windows\System\qrWZvWX.exe
  C:\Windows\System\qrWZvWX.exe
  2⤵
  PID:4576
- C:\Windows\System\gYObkXk.exe
  C:\Windows\System\gYObkXk.exe
  2⤵
  PID:3912
- C:\Windows\System\ChoJqpr.exe
  C:\Windows\System\ChoJqpr.exe
  2⤵
  PID:4564
- C:\Windows\System\FkWBOCX.exe
  C:\Windows\System\FkWBOCX.exe
  2⤵
  PID:5084
- C:\Windows\System\OJtnqBH.exe
  C:\Windows\System\OJtnqBH.exe
  2⤵
  PID:3788
- C:\Windows\System\PHkXYwp.exe
  C:\Windows\System\PHkXYwp.exe
  2⤵
  PID:4656
- C:\Windows\System\kRsBwSK.exe
  C:\Windows\System\kRsBwSK.exe
  2⤵
  PID:5132
- C:\Windows\System\yhFyVdK.exe
  C:\Windows\System\yhFyVdK.exe
  2⤵
  PID:5152
- C:\Windows\System\eUxdETb.exe
  C:\Windows\System\eUxdETb.exe
  2⤵
  PID:5168
- C:\Windows\System\inEosol.exe
  C:\Windows\System\inEosol.exe
  2⤵
  PID:5184
- C:\Windows\System\fupUQRt.exe
  C:\Windows\System\fupUQRt.exe
  2⤵
  PID:5200
- C:\Windows\System\FNwyMrx.exe
  C:\Windows\System\FNwyMrx.exe
  2⤵
  PID:5216
- C:\Windows\System\lXaRjUu.exe
  C:\Windows\System\lXaRjUu.exe
  2⤵
  PID:5232
- C:\Windows\System\gzTuyNg.exe
  C:\Windows\System\gzTuyNg.exe
  2⤵
  PID:5248
- C:\Windows\System\SpFEcnb.exe
  C:\Windows\System\SpFEcnb.exe
  2⤵
  PID:5264
- C:\Windows\System\OOHDMKY.exe
  C:\Windows\System\OOHDMKY.exe
  2⤵
  PID:5280
- C:\Windows\System\hvHTCKX.exe
  C:\Windows\System\hvHTCKX.exe
  2⤵
  PID:5296
- C:\Windows\System\tfToOif.exe
  C:\Windows\System\tfToOif.exe
  2⤵
  PID:5316
- C:\Windows\System\XNDKibX.exe
  C:\Windows\System\XNDKibX.exe
  2⤵
  PID:5332
- C:\Windows\System\yGXMCse.exe
  C:\Windows\System\yGXMCse.exe
  2⤵
  PID:5348
- C:\Windows\System\aFFmXDN.exe
  C:\Windows\System\aFFmXDN.exe
  2⤵
  PID:5364
- C:\Windows\System\WUpYSpj.exe
  C:\Windows\System\WUpYSpj.exe
  2⤵
  PID:5384
- C:\Windows\System\AqBGWuc.exe
  C:\Windows\System\AqBGWuc.exe
  2⤵
  PID:5400
- C:\Windows\System\ymWyTmF.exe
  C:\Windows\System\ymWyTmF.exe
  2⤵
  PID:5416
- C:\Windows\System\lCNOnbg.exe
  C:\Windows\System\lCNOnbg.exe
  2⤵
  PID:5432
- C:\Windows\System\zWYnmJM.exe
  C:\Windows\System\zWYnmJM.exe
  2⤵
  PID:5448
- C:\Windows\System\FMcxASJ.exe
  C:\Windows\System\FMcxASJ.exe
  2⤵
  PID:5468
- C:\Windows\System\JhuJoUA.exe
  C:\Windows\System\JhuJoUA.exe
  2⤵
  PID:5484
- C:\Windows\System\BOCCFJr.exe
  C:\Windows\System\BOCCFJr.exe
  2⤵
  PID:5504
- C:\Windows\System\DDXoSdP.exe
  C:\Windows\System\DDXoSdP.exe
  2⤵
  PID:5524
- C:\Windows\System\yLQgPaP.exe
  C:\Windows\System\yLQgPaP.exe
  2⤵
  PID:5540
- C:\Windows\System\RZAIbIV.exe
  C:\Windows\System\RZAIbIV.exe
  2⤵
  PID:5560
- C:\Windows\System\SyeSGuK.exe
  C:\Windows\System\SyeSGuK.exe
  2⤵
  PID:5576
- C:\Windows\System\cZDqpOe.exe
  C:\Windows\System\cZDqpOe.exe
  2⤵
  PID:5592
- C:\Windows\System\sqPwCKN.exe
  C:\Windows\System\sqPwCKN.exe
  2⤵
  PID:5608
- C:\Windows\System\mHoqSgC.exe
  C:\Windows\System\mHoqSgC.exe
  2⤵
  PID:5628
- C:\Windows\System\KccuakA.exe
  C:\Windows\System\KccuakA.exe
  2⤵
  PID:5644
- C:\Windows\System\XkcmzCe.exe
  C:\Windows\System\XkcmzCe.exe
  2⤵
  PID:5660
- C:\Windows\System\rgQYIwT.exe
  C:\Windows\System\rgQYIwT.exe
  2⤵
  PID:5676
- C:\Windows\System\NWLBeCn.exe
  C:\Windows\System\NWLBeCn.exe
  2⤵
  PID:5696
- C:\Windows\System\xsEsyys.exe
  C:\Windows\System\xsEsyys.exe
  2⤵
  PID:5712
- C:\Windows\System\rZPRiif.exe
  C:\Windows\System\rZPRiif.exe
  2⤵
  PID:5728
- C:\Windows\System\PYiPqeK.exe
  C:\Windows\System\PYiPqeK.exe
  2⤵
  PID:5744
- C:\Windows\System\OtVVtuy.exe
  C:\Windows\System\OtVVtuy.exe
  2⤵
  PID:5760
- C:\Windows\System\yjLdAmI.exe
  C:\Windows\System\yjLdAmI.exe
  2⤵
  PID:5776
- C:\Windows\System\zlNgvLq.exe
  C:\Windows\System\zlNgvLq.exe
  2⤵
  PID:5792
- C:\Windows\System\btUjqKp.exe
  C:\Windows\System\btUjqKp.exe
  2⤵
  PID:5812
- C:\Windows\System\pCkZkhQ.exe
  C:\Windows\System\pCkZkhQ.exe
  2⤵
  PID:5832
- C:\Windows\System\ycERTeX.exe
  C:\Windows\System\ycERTeX.exe
  2⤵
  PID:5848
- C:\Windows\System\oaHMwRp.exe
  C:\Windows\System\oaHMwRp.exe
  2⤵
  PID:5864
- C:\Windows\System\gCfJjFy.exe
  C:\Windows\System\gCfJjFy.exe
  2⤵
  PID:5892
- C:\Windows\System\YiIoxQD.exe
  C:\Windows\System\YiIoxQD.exe
  2⤵
  PID:5912
- C:\Windows\System\dTmsFEc.exe
  C:\Windows\System\dTmsFEc.exe
  2⤵
  PID:5932
- C:\Windows\System\hfIZnSb.exe
  C:\Windows\System\hfIZnSb.exe
  2⤵
  PID:5948
- C:\Windows\System\AzvIpRz.exe
  C:\Windows\System\AzvIpRz.exe
  2⤵
  PID:5964
- C:\Windows\System\ovFMlQw.exe
  C:\Windows\System\ovFMlQw.exe
  2⤵
  PID:5980
- C:\Windows\System\eNouSqY.exe
  C:\Windows\System\eNouSqY.exe
  2⤵
  PID:5996
- C:\Windows\System\IXgQfSf.exe
  C:\Windows\System\IXgQfSf.exe
  2⤵
  PID:6012
- C:\Windows\System\pkkXQzI.exe
  C:\Windows\System\pkkXQzI.exe
  2⤵
  PID:6032
- C:\Windows\System\DgKtBrD.exe
  C:\Windows\System\DgKtBrD.exe
  2⤵
  PID:6052
- C:\Windows\System\WHFenJA.exe
  C:\Windows\System\WHFenJA.exe
  2⤵
  PID:6068
- C:\Windows\System\MUOtIAa.exe
  C:\Windows\System\MUOtIAa.exe
  2⤵
  PID:6084
- C:\Windows\System\nKwoMIL.exe
  C:\Windows\System\nKwoMIL.exe
  2⤵
  PID:6104
- C:\Windows\System\itEGSkK.exe
  C:\Windows\System\itEGSkK.exe
  2⤵
  PID:6120
- C:\Windows\System\dGxJzTd.exe
  C:\Windows\System\dGxJzTd.exe
  2⤵
  PID:6136
- C:\Windows\System\VeHdLgP.exe
  C:\Windows\System\VeHdLgP.exe
  2⤵
  PID:4488
- C:\Windows\System\iJvWbtJ.exe
  C:\Windows\System\iJvWbtJ.exe
  2⤵
  PID:4100
- C:\Windows\System\CizpaUe.exe
  C:\Windows\System\CizpaUe.exe
  2⤵
  PID:5196
- C:\Windows\System\iMNjPuq.exe
  C:\Windows\System\iMNjPuq.exe
  2⤵
  PID:5148
- C:\Windows\System\FYwkVRr.exe
  C:\Windows\System\FYwkVRr.exe
  2⤵
  PID:5292
- C:\Windows\System\YUOoJRw.exe
  C:\Windows\System\YUOoJRw.exe
  2⤵
  PID:5212
- C:\Windows\System\XPdPVKV.exe
  C:\Windows\System\XPdPVKV.exe
  2⤵
  PID:5356
- C:\Windows\System\WvsOQWV.exe
  C:\Windows\System\WvsOQWV.exe
  2⤵
  PID:5272
- C:\Windows\System\nkfipBi.exe
  C:\Windows\System\nkfipBi.exe
  2⤵
  PID:5372
- C:\Windows\System\LyhmDWI.exe
  C:\Windows\System\LyhmDWI.exe
  2⤵
  PID:5456
- C:\Windows\System\XkxFjLM.exe
  C:\Windows\System\XkxFjLM.exe
  2⤵
  PID:5492
- C:\Windows\System\cNabxwV.exe
  C:\Windows\System\cNabxwV.exe
  2⤵
  PID:5408
- C:\Windows\System\JUNgdKa.exe
  C:\Windows\System\JUNgdKa.exe
  2⤵
  PID:5476
- C:\Windows\System\gRkKtHR.exe
  C:\Windows\System\gRkKtHR.exe
  2⤵
  PID:5520
- C:\Windows\System\AzNxLgO.exe
  C:\Windows\System\AzNxLgO.exe
  2⤵
  PID:5600
- C:\Windows\System\npfqJwC.exe
  C:\Windows\System\npfqJwC.exe
  2⤵
  PID:5552
- C:\Windows\System\iFlrFZY.exe
  C:\Windows\System\iFlrFZY.exe
  2⤵
  PID:5672
- C:\Windows\System\vjfovCi.exe
  C:\Windows\System\vjfovCi.exe
  2⤵
  PID:5704
- C:\Windows\System\sriRyPb.exe
  C:\Windows\System\sriRyPb.exe
  2⤵
  PID:5708
- C:\Windows\System\SzKlqgC.exe
  C:\Windows\System\SzKlqgC.exe
  2⤵
  PID:5772
- C:\Windows\System\cKIsoHI.exe
  C:\Windows\System\cKIsoHI.exe
  2⤵
  PID:5844
- C:\Windows\System\EVFwEqz.exe
  C:\Windows\System\EVFwEqz.exe
  2⤵
  PID:5880
- C:\Windows\System\vdytvHR.exe
  C:\Windows\System\vdytvHR.exe
  2⤵
  PID:5856
- C:\Windows\System\lBSDbgk.exe
  C:\Windows\System\lBSDbgk.exe
  2⤵
  PID:5860
- C:\Windows\System\ThUYOgP.exe
  C:\Windows\System\ThUYOgP.exe
  2⤵
  PID:5928
- C:\Windows\System\PYwjfVk.exe
  C:\Windows\System\PYwjfVk.exe
  2⤵
  PID:5972
- C:\Windows\System\AJpMFfe.exe
  C:\Windows\System\AJpMFfe.exe
  2⤵
  PID:5992
- C:\Windows\System\GrgqZoR.exe
  C:\Windows\System\GrgqZoR.exe
  2⤵
  PID:5976
- C:\Windows\System\ExxLdhe.exe
  C:\Windows\System\ExxLdhe.exe
  2⤵
  PID:6028
- C:\Windows\System\KxbKQfS.exe
  C:\Windows\System\KxbKQfS.exe
  2⤵
  PID:5164
- C:\Windows\System\MYoAMOh.exe
  C:\Windows\System\MYoAMOh.exe
  2⤵
  PID:4584
- C:\Windows\System\Bkoajcr.exe
  C:\Windows\System\Bkoajcr.exe
  2⤵
  PID:5144
- C:\Windows\System\PohiWtG.exe
  C:\Windows\System\PohiWtG.exe
  2⤵
  PID:5208
- C:\Windows\System\BDiteTb.exe
  C:\Windows\System\BDiteTb.exe
  2⤵
  PID:5308
- C:\Windows\System\hmCcxgW.exe
  C:\Windows\System\hmCcxgW.exe
  2⤵
  PID:4196
- C:\Windows\System\hmiJArO.exe
  C:\Windows\System\hmiJArO.exe
  2⤵
  PID:5424
- C:\Windows\System\QSjqVOP.exe
  C:\Windows\System\QSjqVOP.exe
  2⤵
  PID:5480
- C:\Windows\System\RRIkABT.exe
  C:\Windows\System\RRIkABT.exe
  2⤵
  PID:5344
- C:\Windows\System\LgeOkZT.exe
  C:\Windows\System\LgeOkZT.exe
  2⤵
  PID:5532
- C:\Windows\System\HtRzJLw.exe
  C:\Windows\System\HtRzJLw.exe
  2⤵
  PID:5640
- C:\Windows\System\glJHozc.exe
  C:\Windows\System\glJHozc.exe
  2⤵
  PID:5692
- C:\Windows\System\ymNTRCD.exe
  C:\Windows\System\ymNTRCD.exe
  2⤵
  PID:5588
- C:\Windows\System\wzVUxuQ.exe
  C:\Windows\System\wzVUxuQ.exe
  2⤵
  PID:5840
- C:\Windows\System\idCaEcE.exe
  C:\Windows\System\idCaEcE.exe
  2⤵
  PID:5876
- C:\Windows\System\ZCuyAkx.exe
  C:\Windows\System\ZCuyAkx.exe
  2⤵
  PID:5940
- C:\Windows\System\QQSJVeP.exe
  C:\Windows\System\QQSJVeP.exe
  2⤵
  PID:6004
- C:\Windows\System\rCgCneI.exe
  C:\Windows\System\rCgCneI.exe
  2⤵
  PID:5128
- C:\Windows\System\oBXAMMW.exe
  C:\Windows\System\oBXAMMW.exe
  2⤵
  PID:6080
- C:\Windows\System\XJCYiyT.exe
  C:\Windows\System\XJCYiyT.exe
  2⤵
  PID:5228
- C:\Windows\System\UDvjHWO.exe
  C:\Windows\System\UDvjHWO.exe
  2⤵
  PID:5192
- C:\Windows\System\IsHHVRy.exe
  C:\Windows\System\IsHHVRy.exe
  2⤵
  PID:6076
- C:\Windows\System\laeJURc.exe
  C:\Windows\System\laeJURc.exe
  2⤵
  PID:5768
- C:\Windows\System\SzQEBHK.exe
  C:\Windows\System\SzQEBHK.exe
  2⤵
  PID:5392
- C:\Windows\System\bDMEnUE.exe
  C:\Windows\System\bDMEnUE.exe
  2⤵
  PID:5752
- C:\Windows\System\qmaTjeB.exe
  C:\Windows\System\qmaTjeB.exe
  2⤵
  PID:5908
- C:\Windows\System\dhqcVVy.exe
  C:\Windows\System\dhqcVVy.exe
  2⤵
  PID:5620
- C:\Windows\System\JxXFJFO.exe
  C:\Windows\System\JxXFJFO.exe
  2⤵
  PID:5176
- C:\Windows\System\XvnnzVy.exe
  C:\Windows\System\XvnnzVy.exe
  2⤵
  PID:5668
- C:\Windows\System\aTTsjek.exe
  C:\Windows\System\aTTsjek.exe
  2⤵
  PID:5244
- C:\Windows\System\IIrfCpT.exe
  C:\Windows\System\IIrfCpT.exe
  2⤵
  PID:5572
- C:\Windows\System\GXYYRwT.exe
  C:\Windows\System\GXYYRwT.exe
  2⤵
  PID:5824
- C:\Windows\System\kjKpSRd.exe
  C:\Windows\System\kjKpSRd.exe
  2⤵
  PID:6128
- C:\Windows\System\UmyyLmI.exe
  C:\Windows\System\UmyyLmI.exe
  2⤵
  PID:6100
- C:\Windows\System\QTXBBMK.exe
  C:\Windows\System\QTXBBMK.exe
  2⤵
  PID:6160
- C:\Windows\System\GaRXcqp.exe
  C:\Windows\System\GaRXcqp.exe
  2⤵
  PID:6176
- C:\Windows\System\UOLfRLM.exe
  C:\Windows\System\UOLfRLM.exe
  2⤵
  PID:6192
- C:\Windows\System\LKWhUZg.exe
  C:\Windows\System\LKWhUZg.exe
  2⤵
  PID:6244
- C:\Windows\System\UkkIwln.exe
  C:\Windows\System\UkkIwln.exe
  2⤵
  PID:6260
- C:\Windows\System\JkxDbBa.exe
  C:\Windows\System\JkxDbBa.exe
  2⤵
  PID:6276
- C:\Windows\System\kCDahgl.exe
  C:\Windows\System\kCDahgl.exe
  2⤵
  PID:6292
- C:\Windows\System\OxodydR.exe
  C:\Windows\System\OxodydR.exe
  2⤵
  PID:6308
- C:\Windows\System\fpZaZwj.exe
  C:\Windows\System\fpZaZwj.exe
  2⤵
  PID:6328
- C:\Windows\System\BvxnofA.exe
  C:\Windows\System\BvxnofA.exe
  2⤵
  PID:6344
- C:\Windows\System\tHthnlE.exe
  C:\Windows\System\tHthnlE.exe
  2⤵
  PID:6360
- C:\Windows\System\dlfqlDK.exe
  C:\Windows\System\dlfqlDK.exe
  2⤵
  PID:6376
- C:\Windows\System\ebJRUvC.exe
  C:\Windows\System\ebJRUvC.exe
  2⤵
  PID:6392
- C:\Windows\System\dSJCMgS.exe
  C:\Windows\System\dSJCMgS.exe
  2⤵
  PID:6464
- C:\Windows\System\yWJEtjr.exe
  C:\Windows\System\yWJEtjr.exe
  2⤵
  PID:6480
- C:\Windows\System\dFrxQUQ.exe
  C:\Windows\System\dFrxQUQ.exe
  2⤵
  PID:6500
- C:\Windows\System\hdAZHCY.exe
  C:\Windows\System\hdAZHCY.exe
  2⤵
  PID:6516
- C:\Windows\System\DYgoHpM.exe
  C:\Windows\System\DYgoHpM.exe
  2⤵
  PID:6532
- C:\Windows\System\JsMuxkW.exe
  C:\Windows\System\JsMuxkW.exe
  2⤵
  PID:6548
- C:\Windows\System\peuFlXA.exe
  C:\Windows\System\peuFlXA.exe
  2⤵
  PID:6564
- C:\Windows\System\ewAcwrO.exe
  C:\Windows\System\ewAcwrO.exe
  2⤵
  PID:6580
- C:\Windows\System\QVKtbTm.exe
  C:\Windows\System\QVKtbTm.exe
  2⤵
  PID:6596
- C:\Windows\System\FXnqFbP.exe
  C:\Windows\System\FXnqFbP.exe
  2⤵
  PID:6612
- C:\Windows\System\SBPMYqj.exe
  C:\Windows\System\SBPMYqj.exe
  2⤵
  PID:6628
- C:\Windows\System\aqIflsv.exe
  C:\Windows\System\aqIflsv.exe
  2⤵
  PID:6644
- C:\Windows\System\YjJbCPJ.exe
  C:\Windows\System\YjJbCPJ.exe
  2⤵
  PID:6660
- C:\Windows\System\kgszuLU.exe
  C:\Windows\System\kgszuLU.exe
  2⤵
  PID:6676
- C:\Windows\System\TbhikWf.exe
  C:\Windows\System\TbhikWf.exe
  2⤵
  PID:6692
- C:\Windows\System\hcKcGEC.exe
  C:\Windows\System\hcKcGEC.exe
  2⤵
  PID:6752
- C:\Windows\System\nIDeQqg.exe
  C:\Windows\System\nIDeQqg.exe
  2⤵
  PID:6768
- C:\Windows\System\Pucmzwh.exe
  C:\Windows\System\Pucmzwh.exe
  2⤵
  PID:6784
- C:\Windows\System\eQnipHi.exe
  C:\Windows\System\eQnipHi.exe
  2⤵
  PID:6800
- C:\Windows\System\hAUOWFp.exe
  C:\Windows\System\hAUOWFp.exe
  2⤵
  PID:6816
- C:\Windows\System\CVkZrNi.exe
  C:\Windows\System\CVkZrNi.exe
  2⤵
  PID:6832
- C:\Windows\System\EQdjeXv.exe
  C:\Windows\System\EQdjeXv.exe
  2⤵
  PID:6848
- C:\Windows\System\pbimzTL.exe
  C:\Windows\System\pbimzTL.exe
  2⤵
  PID:6864
- C:\Windows\System\HPPdFxW.exe
  C:\Windows\System\HPPdFxW.exe
  2⤵
  PID:6880
- C:\Windows\System\vtWMTBt.exe
  C:\Windows\System\vtWMTBt.exe
  2⤵
  PID:6896
- C:\Windows\System\UoRsUlO.exe
  C:\Windows\System\UoRsUlO.exe
  2⤵
  PID:6912
- C:\Windows\System\kzupCBQ.exe
  C:\Windows\System\kzupCBQ.exe
  2⤵
  PID:6928
- C:\Windows\System\aHzkJLr.exe
  C:\Windows\System\aHzkJLr.exe
  2⤵
  PID:6944
- C:\Windows\System\SAVrhhx.exe
  C:\Windows\System\SAVrhhx.exe
  2⤵
  PID:6960
- C:\Windows\System\YlbNCoi.exe
  C:\Windows\System\YlbNCoi.exe
  2⤵
  PID:6976
- C:\Windows\System\XLixkba.exe
  C:\Windows\System\XLixkba.exe
  2⤵
  PID:6992
- C:\Windows\System\JXNxtTa.exe
  C:\Windows\System\JXNxtTa.exe
  2⤵
  PID:7012
- C:\Windows\System\SMutaEG.exe
  C:\Windows\System\SMutaEG.exe
  2⤵
  PID:7044
- C:\Windows\System\HwtHmqJ.exe
  C:\Windows\System\HwtHmqJ.exe
  2⤵
  PID:7060
- C:\Windows\System\DYvKTPQ.exe
  C:\Windows\System\DYvKTPQ.exe
  2⤵
  PID:7084
- C:\Windows\System\vqjTDoF.exe
  C:\Windows\System\vqjTDoF.exe
  2⤵
  PID:6368
- C:\Windows\System\sdsOTIT.exe
  C:\Windows\System\sdsOTIT.exe
  2⤵
  PID:6708
- C:\Windows\System\AhQwbfk.exe
  C:\Windows\System\AhQwbfk.exe
  2⤵
  PID:6732
- C:\Windows\System\YhxzLru.exe
  C:\Windows\System\YhxzLru.exe
  2⤵
  PID:6744
- C:\Windows\System\CgtoIiT.exe
  C:\Windows\System\CgtoIiT.exe
  2⤵
  PID:6908
- C:\Windows\System\qZjjrLy.exe
  C:\Windows\System\qZjjrLy.exe
  2⤵
  PID:7000
- C:\Windows\System\eOybWir.exe
  C:\Windows\System\eOybWir.exe
  2⤵
  PID:6492
- C:\Windows\System\wHNyHLk.exe
  C:\Windows\System\wHNyHLk.exe
  2⤵
  PID:6620
- C:\Windows\System\GajYBwA.exe
  C:\Windows\System\GajYBwA.exe
  2⤵
  PID:6688
- C:\Windows\System\PdcRbKZ.exe
  C:\Windows\System\PdcRbKZ.exe
  2⤵
  PID:6448
- C:\Windows\System\KITaIWJ.exe
  C:\Windows\System\KITaIWJ.exe
  2⤵
  PID:2292
- C:\Windows\System\xBNlteg.exe
  C:\Windows\System\xBNlteg.exe
  2⤵
  PID:7024
- C:\Windows\System\myysHnB.exe
  C:\Windows\System\myysHnB.exe
  2⤵
  PID:7092
- C:\Windows\System\hyZtzKE.exe
  C:\Windows\System\hyZtzKE.exe
  2⤵
  PID:5944
- C:\Windows\System\NcfKRtM.exe
  C:\Windows\System\NcfKRtM.exe
  2⤵
  PID:6156
- C:\Windows\System\gfigmaz.exe
  C:\Windows\System\gfigmaz.exe
  2⤵
  PID:5828
- C:\Windows\System\IodUzTz.exe
  C:\Windows\System\IodUzTz.exe
  2⤵
  PID:6172
- C:\Windows\System\VvilAbN.exe
  C:\Windows\System\VvilAbN.exe
  2⤵
  PID:6300
- C:\Windows\System\JwyVtGq.exe
  C:\Windows\System\JwyVtGq.exe
  2⤵
  PID:6508
- C:\Windows\System\mrzLDSW.exe
  C:\Windows\System\mrzLDSW.exe
  2⤵
  PID:6672
- C:\Windows\System\rFRkBLQ.exe
  C:\Windows\System\rFRkBLQ.exe
  2⤵
  PID:6540
- C:\Windows\System\CCVLoSK.exe
  C:\Windows\System\CCVLoSK.exe
  2⤵
  PID:6624
- C:\Windows\System\JoLFSHL.exe
  C:\Windows\System\JoLFSHL.exe
  2⤵
  PID:6776
- C:\Windows\System\MMklBPp.exe
  C:\Windows\System\MMklBPp.exe
  2⤵
  PID:6636
- C:\Windows\System\gEnLiJc.exe
  C:\Windows\System\gEnLiJc.exe
  2⤵
  PID:6444
- C:\Windows\System\CQNyIfK.exe
  C:\Windows\System\CQNyIfK.exe
  2⤵
  PID:6556
- C:\Windows\System\cZjvpss.exe
  C:\Windows\System\cZjvpss.exe
  2⤵
  PID:6432
- C:\Windows\System\KODIEkE.exe
  C:\Windows\System\KODIEkE.exe
  2⤵
  PID:6712
- C:\Windows\System\PMqVoQk.exe
  C:\Windows\System\PMqVoQk.exe
  2⤵
  PID:6488
- C:\Windows\System\IyfBPDY.exe
  C:\Windows\System\IyfBPDY.exe
  2⤵
  PID:1500
- C:\Windows\System\ZfQFYqV.exe
  C:\Windows\System\ZfQFYqV.exe
  2⤵
  PID:6436
- C:\Windows\System\BDQPzhK.exe
  C:\Windows\System\BDQPzhK.exe
  2⤵
  PID:7160
- C:\Windows\System\WyyZHAT.exe
  C:\Windows\System\WyyZHAT.exe
  2⤵
  PID:5556
- C:\Windows\System\RSQSsow.exe
  C:\Windows\System\RSQSsow.exe
  2⤵
  PID:6956
- C:\Windows\System\IgcczSM.exe
  C:\Windows\System\IgcczSM.exe
  2⤵
  PID:7020
- C:\Windows\System\kuxZAlD.exe
  C:\Windows\System\kuxZAlD.exe
  2⤵
  PID:6588
- C:\Windows\System\UssDSBd.exe
  C:\Windows\System\UssDSBd.exe
  2⤵
  PID:6792
- C:\Windows\System\eGDvVgW.exe
  C:\Windows\System\eGDvVgW.exe
  2⤵
  PID:6888
- C:\Windows\System\DgLoFrO.exe
  C:\Windows\System\DgLoFrO.exe
  2⤵
  PID:1724
- C:\Windows\System\jRAyGtf.exe
  C:\Windows\System\jRAyGtf.exe
  2⤵
  PID:6212
- C:\Windows\System\evJOMRz.exe
  C:\Windows\System\evJOMRz.exe
  2⤵
  PID:5288
- C:\Windows\System\ApMDerK.exe
  C:\Windows\System\ApMDerK.exe
  2⤵
  PID:6092
- C:\Windows\System\PjgoSJY.exe
  C:\Windows\System\PjgoSJY.exe
  2⤵
  PID:5904
- C:\Windows\System\DaMrkzE.exe
  C:\Windows\System\DaMrkzE.exe
  2⤵
  PID:6288
- C:\Windows\System\pMULMmP.exe
  C:\Windows\System\pMULMmP.exe
  2⤵
  PID:6152
- C:\Windows\System\NomGtpH.exe
  C:\Windows\System\NomGtpH.exe
  2⤵
  PID:7156
- C:\Windows\System\mnThDZl.exe
  C:\Windows\System\mnThDZl.exe
  2⤵
  PID:6216
- C:\Windows\System\hDmwEqq.exe
  C:\Windows\System\hDmwEqq.exe
  2⤵
  PID:6224
- C:\Windows\System\rkEkZRm.exe
  C:\Windows\System\rkEkZRm.exe
  2⤵
  PID:6240
- C:\Windows\System\zkYGjAl.exe
  C:\Windows\System\zkYGjAl.exe
  2⤵
  PID:6388
- C:\Windows\System\xCnurLn.exe
  C:\Windows\System\xCnurLn.exe
  2⤵
  PID:3016
- C:\Windows\System\oBomoND.exe
  C:\Windows\System\oBomoND.exe
  2⤵
  PID:6384
- C:\Windows\System\tovqlmx.exe
  C:\Windows\System\tovqlmx.exe
  2⤵
  PID:6936
- C:\Windows\System\cZsmuml.exe
  C:\Windows\System\cZsmuml.exe
  2⤵
  PID:6572
- C:\Windows\System\HptdqMC.exe
  C:\Windows\System\HptdqMC.exe
  2⤵
  PID:2544
- C:\Windows\System\qkKpRoz.exe
  C:\Windows\System\qkKpRoz.exe
  2⤵
  PID:6740
- C:\Windows\System\FQDrMvS.exe
  C:\Windows\System\FQDrMvS.exe
  2⤵
  PID:6604
- C:\Windows\System\oTwMXRr.exe
  C:\Windows\System\oTwMXRr.exe
  2⤵
  PID:1596
- C:\Windows\System\SGRhajw.exe
  C:\Windows\System\SGRhajw.exe
  2⤵
  PID:2516
- C:\Windows\System\TCklPqZ.exe
  C:\Windows\System\TCklPqZ.exe
  2⤵
  PID:6720
- C:\Windows\System\JfTpgVw.exe
  C:\Windows\System\JfTpgVw.exe
  2⤵
  PID:7152
- C:\Windows\System\ejeLqSK.exe
  C:\Windows\System\ejeLqSK.exe
  2⤵
  PID:1696
- C:\Windows\System\mhGPxqt.exe
  C:\Windows\System\mhGPxqt.exe
  2⤵
  PID:7028
- C:\Windows\System\OFhvAVe.exe
  C:\Windows\System\OFhvAVe.exe
  2⤵
  PID:7104
- C:\Windows\System\fVlyzCy.exe
  C:\Windows\System\fVlyzCy.exe
  2⤵
  PID:3592
- C:\Windows\System\RDLWIti.exe
  C:\Windows\System\RDLWIti.exe
  2⤵
  PID:7032
- C:\Windows\System\kzThAkm.exe
  C:\Windows\System\kzThAkm.exe
  2⤵
  PID:6856
- C:\Windows\System\ZBPSisK.exe
  C:\Windows\System\ZBPSisK.exe
  2⤵
  PID:6876
- C:\Windows\System\ZhpgIUp.exe
  C:\Windows\System\ZhpgIUp.exe
  2⤵
  PID:6428
- C:\Windows\System\ZVvxWie.exe
  C:\Windows\System\ZVvxWie.exe
  2⤵
  PID:6476
- C:\Windows\System\RpqoNUw.exe
  C:\Windows\System\RpqoNUw.exe
  2⤵
  PID:6968
- C:\Windows\System\EnOCjCd.exe
  C:\Windows\System\EnOCjCd.exe
  2⤵
  PID:6324
- C:\Windows\System\sJxykvd.exe
  C:\Windows\System\sJxykvd.exe
  2⤵
  PID:7080
- C:\Windows\System\mUGAbFy.exe
  C:\Windows\System\mUGAbFy.exe
  2⤵
  PID:6828
- C:\Windows\System\XLMTPFa.exe
  C:\Windows\System\XLMTPFa.exe
  2⤵
  PID:7040
- C:\Windows\System\kKygZWf.exe
  C:\Windows\System\kKygZWf.exe
  2⤵
  PID:6320
- C:\Windows\System\mFrOdEp.exe
  C:\Windows\System\mFrOdEp.exe
  2⤵
  PID:7096
- C:\Windows\System\nLLZSjS.exe
  C:\Windows\System\nLLZSjS.exe
  2⤵
  PID:6892
- C:\Windows\System\xGZbjnF.exe
  C:\Windows\System\xGZbjnF.exe
  2⤵
  PID:6524
- C:\Windows\System\Jxqihzc.exe
  C:\Windows\System\Jxqihzc.exe
  2⤵
  PID:1600
- C:\Windows\System\zBCwxpQ.exe
  C:\Windows\System\zBCwxpQ.exe
  2⤵
  PID:6372
- C:\Windows\System\pwtVbJn.exe
  C:\Windows\System\pwtVbJn.exe
  2⤵
  PID:6656
- C:\Windows\System\MsdPJIM.exe
  C:\Windows\System\MsdPJIM.exe
  2⤵
  PID:6168
- C:\Windows\System\enaCJxu.exe
  C:\Windows\System\enaCJxu.exe
  2⤵
  PID:6232
- C:\Windows\System\MKRVcXe.exe
  C:\Windows\System\MKRVcXe.exe
  2⤵
  PID:5652
- C:\Windows\System\MENXiFb.exe
  C:\Windows\System\MENXiFb.exe
  2⤵
  PID:6872
- C:\Windows\System\RaqdgDO.exe
  C:\Windows\System\RaqdgDO.exe
  2⤵
  PID:6252
- C:\Windows\System\WuBcgyC.exe
  C:\Windows\System\WuBcgyC.exe
  2⤵
  PID:7136
- C:\Windows\System\HnwSfTB.exe
  C:\Windows\System\HnwSfTB.exe
  2⤵
  PID:2320
- C:\Windows\System\OMsHWWJ.exe
  C:\Windows\System\OMsHWWJ.exe
  2⤵
  PID:7164
- C:\Windows\System\cPsbjMJ.exe
  C:\Windows\System\cPsbjMJ.exe
  2⤵
  PID:6304
- C:\Windows\System\REiBozI.exe
  C:\Windows\System\REiBozI.exe
  2⤵
  PID:7072
- C:\Windows\System\EHqGVqr.exe
  C:\Windows\System\EHqGVqr.exe
  2⤵
  PID:7132
- C:\Windows\System\PMfRNLp.exe
  C:\Windows\System\PMfRNLp.exe
  2⤵
  PID:6256
- C:\Windows\System\bIZbqKf.exe
  C:\Windows\System\bIZbqKf.exe
  2⤵
  PID:6812
- C:\Windows\System\sTcvOXE.exe
  C:\Windows\System\sTcvOXE.exe
  2⤵
  PID:7184
- C:\Windows\System\gaAxKsS.exe
  C:\Windows\System\gaAxKsS.exe
  2⤵
  PID:7200
- C:\Windows\System\UcrzDlg.exe
  C:\Windows\System\UcrzDlg.exe
  2⤵
  PID:7216
- C:\Windows\System\ecMaXeT.exe
  C:\Windows\System\ecMaXeT.exe
  2⤵
  PID:7232
- C:\Windows\System\MTJPrcZ.exe
  C:\Windows\System\MTJPrcZ.exe
  2⤵
  PID:7248
- C:\Windows\System\ZbijKae.exe
  C:\Windows\System\ZbijKae.exe
  2⤵
  PID:7264
- C:\Windows\System\ELoSTZE.exe
  C:\Windows\System\ELoSTZE.exe
  2⤵
  PID:7280
- C:\Windows\System\wcayzmX.exe
  C:\Windows\System\wcayzmX.exe
  2⤵
  PID:7296
- C:\Windows\System\FSCECau.exe
  C:\Windows\System\FSCECau.exe
  2⤵
  PID:7312
- C:\Windows\System\oxuQkYw.exe
  C:\Windows\System\oxuQkYw.exe
  2⤵
  PID:7328
- C:\Windows\System\WuPVuBy.exe
  C:\Windows\System\WuPVuBy.exe
  2⤵
  PID:7344
- C:\Windows\System\wloBixQ.exe
  C:\Windows\System\wloBixQ.exe
  2⤵
  PID:7360
- C:\Windows\System\MTxOOvr.exe
  C:\Windows\System\MTxOOvr.exe
  2⤵
  PID:7376
- C:\Windows\System\dTZxpsz.exe
  C:\Windows\System\dTZxpsz.exe
  2⤵
  PID:7392
- C:\Windows\System\HYTVGul.exe
  C:\Windows\System\HYTVGul.exe
  2⤵
  PID:7408
- C:\Windows\System\NfVFqGJ.exe
  C:\Windows\System\NfVFqGJ.exe
  2⤵
  PID:7424
- C:\Windows\System\uwhqFAb.exe
  C:\Windows\System\uwhqFAb.exe
  2⤵
  PID:7440
- C:\Windows\System\UuvFLUB.exe
  C:\Windows\System\UuvFLUB.exe
  2⤵
  PID:7456
- C:\Windows\System\chzicbc.exe
  C:\Windows\System\chzicbc.exe
  2⤵
  PID:7472
- C:\Windows\System\iIemCKq.exe
  C:\Windows\System\iIemCKq.exe
  2⤵
  PID:7488
- C:\Windows\System\PysonQu.exe
  C:\Windows\System\PysonQu.exe
  2⤵
  PID:7504
- C:\Windows\System\tfpGQJj.exe
  C:\Windows\System\tfpGQJj.exe
  2⤵
  PID:7520
- C:\Windows\System\gQFEfrU.exe
  C:\Windows\System\gQFEfrU.exe
  2⤵
  PID:7536
- C:\Windows\System\VkfRiID.exe
  C:\Windows\System\VkfRiID.exe
  2⤵
  PID:7552
- C:\Windows\System\euTtzRW.exe
  C:\Windows\System\euTtzRW.exe
  2⤵
  PID:7568
- C:\Windows\System\gWeqjRO.exe
  C:\Windows\System\gWeqjRO.exe
  2⤵
  PID:7584
- C:\Windows\System\XmZUJDd.exe
  C:\Windows\System\XmZUJDd.exe
  2⤵
  PID:7600
- C:\Windows\System\arhtiTd.exe
  C:\Windows\System\arhtiTd.exe
  2⤵
  PID:7616
- C:\Windows\System\kceuGqq.exe
  C:\Windows\System\kceuGqq.exe
  2⤵
  PID:7632
- C:\Windows\System\XlWeHEU.exe
  C:\Windows\System\XlWeHEU.exe
  2⤵
  PID:7648
- C:\Windows\System\RcFbgPq.exe
  C:\Windows\System\RcFbgPq.exe
  2⤵
  PID:7668
- C:\Windows\System\AxFEjdu.exe
  C:\Windows\System\AxFEjdu.exe
  2⤵
  PID:7684
- C:\Windows\System\XlJEhIw.exe
  C:\Windows\System\XlJEhIw.exe
  2⤵
  PID:7700
- C:\Windows\System\NBIrZID.exe
  C:\Windows\System\NBIrZID.exe
  2⤵
  PID:7716
- C:\Windows\System\GpbMxEr.exe
  C:\Windows\System\GpbMxEr.exe
  2⤵
  PID:7732
- C:\Windows\System\mkzoAmD.exe
  C:\Windows\System\mkzoAmD.exe
  2⤵
  PID:7748
- C:\Windows\System\JRmnbvk.exe
  C:\Windows\System\JRmnbvk.exe
  2⤵
  PID:7764
- C:\Windows\System\OCQfkLt.exe
  C:\Windows\System\OCQfkLt.exe
  2⤵
  PID:7780
- C:\Windows\System\qgRKExD.exe
  C:\Windows\System\qgRKExD.exe
  2⤵
  PID:8072
- C:\Windows\System\zlpOJMp.exe
  C:\Windows\System\zlpOJMp.exe
  2⤵
  PID:8088
- C:\Windows\System\QdRimFy.exe
  C:\Windows\System\QdRimFy.exe
  2⤵
  PID:8104
- C:\Windows\System\rWRQqSL.exe
  C:\Windows\System\rWRQqSL.exe
  2⤵
  PID:8120
- C:\Windows\System\MTnNcuF.exe
  C:\Windows\System\MTnNcuF.exe
  2⤵
  PID:8136
- C:\Windows\System\sITkEIm.exe
  C:\Windows\System\sITkEIm.exe
  2⤵
  PID:7176
- C:\Windows\System\aQrFWDn.exe
  C:\Windows\System\aQrFWDn.exe
  2⤵
  PID:7208
- C:\Windows\System\TgnYMjW.exe
  C:\Windows\System\TgnYMjW.exe
  2⤵
  PID:7196
- C:\Windows\System\OjyncFz.exe
  C:\Windows\System\OjyncFz.exe
  2⤵
  PID:7228
- C:\Windows\System\DAhCOXZ.exe
  C:\Windows\System\DAhCOXZ.exe
  2⤵
  PID:7304
- C:\Windows\System\KAcTHph.exe
  C:\Windows\System\KAcTHph.exe
  2⤵
  PID:7340
- C:\Windows\System\yjRTGvx.exe
  C:\Windows\System\yjRTGvx.exe
  2⤵
  PID:7372
- C:\Windows\System\fJfJmmX.exe
  C:\Windows\System\fJfJmmX.exe
  2⤵
  PID:7432
- C:\Windows\System\jWQAXCB.exe
  C:\Windows\System\jWQAXCB.exe
  2⤵
  PID:7448
- C:\Windows\System\sLkXRWA.exe
  C:\Windows\System\sLkXRWA.exe
  2⤵
  PID:7452
- C:\Windows\System\MjUPrdT.exe
  C:\Windows\System\MjUPrdT.exe
  2⤵
  PID:7532
- C:\Windows\System\KwfuSkb.exe
  C:\Windows\System\KwfuSkb.exe
  2⤵
  PID:7576
- C:\Windows\System\UJgqyQL.exe
  C:\Windows\System\UJgqyQL.exe
  2⤵
  PID:7772
- C:\Windows\System\BKPBmxO.exe
  C:\Windows\System\BKPBmxO.exe
  2⤵
  PID:7828
- C:\Windows\System\WtOVHRh.exe
  C:\Windows\System\WtOVHRh.exe
  2⤵
  PID:8004
- C:\Windows\System\gJLuEfS.exe
  C:\Windows\System\gJLuEfS.exe
  2⤵
  PID:8020
- C:\Windows\System\MGbqhMG.exe
  C:\Windows\System\MGbqhMG.exe
  2⤵
  PID:8036
- C:\Windows\System\TmguFFG.exe
  C:\Windows\System\TmguFFG.exe
  2⤵
  PID:8048
- C:\Windows\System\PtxQebA.exe
  C:\Windows\System\PtxQebA.exe
  2⤵
  PID:7808
- C:\Windows\System\ngIJEkt.exe
  C:\Windows\System\ngIJEkt.exe
  2⤵
  PID:8128
- C:\Windows\System\kimGEkG.exe
  C:\Windows\System\kimGEkG.exe
  2⤵
  PID:5740
- C:\Windows\System\liLDEaG.exe
  C:\Windows\System\liLDEaG.exe
  2⤵
  PID:8144
- C:\Windows\System\AwJwnkh.exe
  C:\Windows\System\AwJwnkh.exe
  2⤵
  PID:8172
- C:\Windows\System\CSWlXCm.exe
  C:\Windows\System\CSWlXCm.exe
  2⤵
  PID:8188
- C:\Windows\System\SlFHuSG.exe
  C:\Windows\System\SlFHuSG.exe
  2⤵
  PID:7224
- C:\Windows\System\gFByAGx.exe
  C:\Windows\System\gFByAGx.exe
  2⤵
  PID:7192
- C:\Windows\System\GKLrbox.exe
  C:\Windows\System\GKLrbox.exe
  2⤵
  PID:7368
- C:\Windows\System\LrnJImu.exe
  C:\Windows\System\LrnJImu.exe
  2⤵
  PID:7388
- C:\Windows\System\fQqZhPG.exe
  C:\Windows\System\fQqZhPG.exe
  2⤵
  PID:7464
- C:\Windows\System\kteFEzw.exe
  C:\Windows\System\kteFEzw.exe
  2⤵
  PID:7484
- C:\Windows\System\DxAVrox.exe
  C:\Windows\System\DxAVrox.exe
  2⤵
  PID:7596
- C:\Windows\System\zreMHVT.exe
  C:\Windows\System\zreMHVT.exe
  2⤵
  PID:7548
- C:\Windows\System\CJdcRsQ.exe
  C:\Windows\System\CJdcRsQ.exe
  2⤵
  PID:1532
- C:\Windows\System\PBSPxKs.exe
  C:\Windows\System\PBSPxKs.exe
  2⤵
  PID:2768
- C:\Windows\System\YuRIzcS.exe
  C:\Windows\System\YuRIzcS.exe
  2⤵
  PID:7608
- C:\Windows\System\uXUjZTy.exe
  C:\Windows\System\uXUjZTy.exe
  2⤵
  PID:8052
- C:\Windows\System\PXUOppL.exe
  C:\Windows\System\PXUOppL.exe
  2⤵
  PID:7864
- C:\Windows\System\cjarkqL.exe
  C:\Windows\System\cjarkqL.exe
  2⤵
  PID:8148
- C:\Windows\System\WBjmbkY.exe
  C:\Windows\System\WBjmbkY.exe
  2⤵
  PID:7776
- C:\Windows\System\PHtnWJZ.exe
  C:\Windows\System\PHtnWJZ.exe
  2⤵
  PID:8028
- C:\Windows\System\QLbRgaF.exe
  C:\Windows\System\QLbRgaF.exe
  2⤵
  PID:7896
- C:\Windows\System\pUMrjgT.exe
  C:\Windows\System\pUMrjgT.exe
  2⤵
  PID:7612
- C:\Windows\System\NiCDkOS.exe
  C:\Windows\System\NiCDkOS.exe
  2⤵
  PID:7952
- C:\Windows\System\NhHMDka.exe
  C:\Windows\System\NhHMDka.exe
  2⤵
  PID:8184
- C:\Windows\System\ubRjafN.exe
  C:\Windows\System\ubRjafN.exe
  2⤵
  PID:7760
- C:\Windows\System\HjKYQWM.exe
  C:\Windows\System\HjKYQWM.exe
  2⤵
  PID:7820
- C:\Windows\System\sHvwPbO.exe
  C:\Windows\System\sHvwPbO.exe
  2⤵
  PID:7848
- C:\Windows\System\wZqVrEQ.exe
  C:\Windows\System\wZqVrEQ.exe
  2⤵
  PID:7892
- C:\Windows\System\TGzrIMe.exe
  C:\Windows\System\TGzrIMe.exe
  2⤵
  PID:7876
- C:\Windows\System\rXowpkU.exe
  C:\Windows\System\rXowpkU.exe
  2⤵
  PID:7964
- C:\Windows\System\gjCAjGG.exe
  C:\Windows\System\gjCAjGG.exe
  2⤵
  PID:7240
- C:\Windows\System\FPpOFfn.exe
  C:\Windows\System\FPpOFfn.exe
  2⤵
  PID:8064
- C:\Windows\System\kBEBFLY.exe
  C:\Windows\System\kBEBFLY.exe
  2⤵
  PID:7872
- C:\Windows\System\HeSPIGR.exe
  C:\Windows\System\HeSPIGR.exe
  2⤵
  PID:7968
- C:\Windows\System\OpuYOCo.exe
  C:\Windows\System\OpuYOCo.exe
  2⤵
  PID:7244
- C:\Windows\System\RrCqztJ.exe
  C:\Windows\System\RrCqztJ.exe
  2⤵
  PID:8168
- C:\Windows\System\AfhTGIE.exe
  C:\Windows\System\AfhTGIE.exe
  2⤵
  PID:7624
- C:\Windows\System\oMUsMzb.exe
  C:\Windows\System\oMUsMzb.exe
  2⤵
  PID:6840
- C:\Windows\System\efPqRVv.exe
  C:\Windows\System\efPqRVv.exe
  2⤵
  PID:8156
- C:\Windows\System\zEdPMgz.exe
  C:\Windows\System\zEdPMgz.exe
  2⤵
  PID:7832
- C:\Windows\System\jBAhmDR.exe
  C:\Windows\System\jBAhmDR.exe
  2⤵
  PID:7916
- C:\Windows\System\lKFQfgq.exe
  C:\Windows\System\lKFQfgq.exe
  2⤵
  PID:7924
- C:\Windows\System\WxypfpA.exe
  C:\Windows\System\WxypfpA.exe
  2⤵
  PID:7496
- C:\Windows\System\MKcupRB.exe
  C:\Windows\System\MKcupRB.exe
  2⤵
  PID:7676
- C:\Windows\System\SMnjBMi.exe
  C:\Windows\System\SMnjBMi.exe
  2⤵
  PID:7740
- C:\Windows\System\ftYePHR.exe
  C:\Windows\System\ftYePHR.exe
  2⤵
  PID:7980
- C:\Windows\System\IokIQMp.exe
  C:\Windows\System\IokIQMp.exe
  2⤵
  PID:7292
- C:\Windows\System\dQeBduV.exe
  C:\Windows\System\dQeBduV.exe
  2⤵
  PID:7840
- C:\Windows\System\oupNCVh.exe
  C:\Windows\System\oupNCVh.exe
  2⤵
  PID:7956
- C:\Windows\System\cmQMnbN.exe
  C:\Windows\System\cmQMnbN.exe
  2⤵
  PID:7984
- C:\Windows\System\yIameFR.exe
  C:\Windows\System\yIameFR.exe
  2⤵
  PID:7936
- C:\Windows\System\sCxDXUh.exe
  C:\Windows\System\sCxDXUh.exe
  2⤵
  PID:8084
- C:\Windows\System\QCyhkQC.exe
  C:\Windows\System\QCyhkQC.exe
  2⤵
  PID:7260
- C:\Windows\System\aLydJdr.exe
  C:\Windows\System\aLydJdr.exe
  2⤵
  PID:7660
- C:\Windows\System\HAfrTtB.exe
  C:\Windows\System\HAfrTtB.exe
  2⤵
  PID:7796
- C:\Windows\System\hyGwlcr.exe
  C:\Windows\System\hyGwlcr.exe
  2⤵
  PID:7880
- C:\Windows\System\KESFRwC.exe
  C:\Windows\System\KESFRwC.exe
  2⤵
  PID:7844
- C:\Windows\System\EMmtCgj.exe
  C:\Windows\System\EMmtCgj.exe
  2⤵
  PID:7756
- C:\Windows\System\PMRWxnx.exe
  C:\Windows\System\PMRWxnx.exe
  2⤵
  PID:7932
- C:\Windows\System\dWKRSvg.exe
  C:\Windows\System\dWKRSvg.exe
  2⤵
  PID:8216
- C:\Windows\System\dIQMRFH.exe
  C:\Windows\System\dIQMRFH.exe
  2⤵
  PID:8232
- C:\Windows\System\vhptSId.exe
  C:\Windows\System\vhptSId.exe
  2⤵
  PID:8248
- C:\Windows\System\BvQzUWK.exe
  C:\Windows\System\BvQzUWK.exe
  2⤵
  PID:8264
- C:\Windows\System\sWbjbwS.exe
  C:\Windows\System\sWbjbwS.exe
  2⤵
  PID:8280
- C:\Windows\System\jJWyzhj.exe
  C:\Windows\System\jJWyzhj.exe
  2⤵
  PID:8300
- C:\Windows\System\WCDfgBH.exe
  C:\Windows\System\WCDfgBH.exe
  2⤵
  PID:8316
- C:\Windows\System\IoPSvAU.exe
  C:\Windows\System\IoPSvAU.exe
  2⤵
  PID:8332
- C:\Windows\System\TBBwLAJ.exe
  C:\Windows\System\TBBwLAJ.exe
  2⤵
  PID:8348
- C:\Windows\System\WRbzoBV.exe
  C:\Windows\System\WRbzoBV.exe
  2⤵
  PID:8364
- C:\Windows\System\BLRCRaD.exe
  C:\Windows\System\BLRCRaD.exe
  2⤵
  PID:8380
- C:\Windows\System\lRolwZN.exe
  C:\Windows\System\lRolwZN.exe
  2⤵
  PID:8396
- C:\Windows\System\OVTLvXQ.exe
  C:\Windows\System\OVTLvXQ.exe
  2⤵
  PID:8412
- C:\Windows\System\sgZgQXS.exe
  C:\Windows\System\sgZgQXS.exe
  2⤵
  PID:8428
- C:\Windows\System\jHXlNMf.exe
  C:\Windows\System\jHXlNMf.exe
  2⤵
  PID:8444
- C:\Windows\System\KXMORji.exe
  C:\Windows\System\KXMORji.exe
  2⤵
  PID:8460
- C:\Windows\System\qMMcRfe.exe
  C:\Windows\System\qMMcRfe.exe
  2⤵
  PID:8476
- C:\Windows\System\AAITnks.exe
  C:\Windows\System\AAITnks.exe
  2⤵
  PID:8492
- C:\Windows\System\NuixgLT.exe
  C:\Windows\System\NuixgLT.exe
  2⤵
  PID:8508
- C:\Windows\System\miKQFaV.exe
  C:\Windows\System\miKQFaV.exe
  2⤵
  PID:8524
- C:\Windows\System\KMkAnhb.exe
  C:\Windows\System\KMkAnhb.exe
  2⤵
  PID:8540
- C:\Windows\System\rXuIdyH.exe
  C:\Windows\System\rXuIdyH.exe
  2⤵
  PID:8556
- C:\Windows\System\qYRKKIL.exe
  C:\Windows\System\qYRKKIL.exe
  2⤵
  PID:8572
- C:\Windows\System\UXQKWYe.exe
  C:\Windows\System\UXQKWYe.exe
  2⤵
  PID:8592
- C:\Windows\System\JcrlFNv.exe
  C:\Windows\System\JcrlFNv.exe
  2⤵
  PID:8608
- C:\Windows\System\CwVvsCI.exe
  C:\Windows\System\CwVvsCI.exe
  2⤵
  PID:8624
- C:\Windows\System\CyAEXil.exe
  C:\Windows\System\CyAEXil.exe
  2⤵
  PID:8640
- C:\Windows\System\iFHZNlj.exe
  C:\Windows\System\iFHZNlj.exe
  2⤵
  PID:8656
- C:\Windows\System\mIHgxir.exe
  C:\Windows\System\mIHgxir.exe
  2⤵
  PID:8672
- C:\Windows\System\JevLros.exe
  C:\Windows\System\JevLros.exe
  2⤵
  PID:8688
- C:\Windows\System\kCLGMza.exe
  C:\Windows\System\kCLGMza.exe
  2⤵
  PID:8708
- C:\Windows\System\pyRZDFe.exe
  C:\Windows\System\pyRZDFe.exe
  2⤵
  PID:8724
- C:\Windows\System\cQPTyOu.exe
  C:\Windows\System\cQPTyOu.exe
  2⤵
  PID:8740
- C:\Windows\System\czTZOwu.exe
  C:\Windows\System\czTZOwu.exe
  2⤵
  PID:8756
- C:\Windows\System\otlsgwN.exe
  C:\Windows\System\otlsgwN.exe
  2⤵
  PID:8772
- C:\Windows\System\jeBrrSZ.exe
  C:\Windows\System\jeBrrSZ.exe
  2⤵
  PID:8788
- C:\Windows\System\mgfMBUb.exe
  C:\Windows\System\mgfMBUb.exe
  2⤵
  PID:8804
- C:\Windows\System\LJiksew.exe
  C:\Windows\System\LJiksew.exe
  2⤵
  PID:8820
- C:\Windows\System\xqlOdRi.exe
  C:\Windows\System\xqlOdRi.exe
  2⤵
  PID:8840
- C:\Windows\System\pqNLhIQ.exe
  C:\Windows\System\pqNLhIQ.exe
  2⤵
  PID:8856
- C:\Windows\System\bOsWahJ.exe
  C:\Windows\System\bOsWahJ.exe
  2⤵
  PID:8872
- C:\Windows\System\OQgFXCd.exe
  C:\Windows\System\OQgFXCd.exe
  2⤵
  PID:8888
- C:\Windows\System\hcBvlen.exe
  C:\Windows\System\hcBvlen.exe
  2⤵
  PID:8904
- C:\Windows\System\AcqiXhG.exe
  C:\Windows\System\AcqiXhG.exe
  2⤵
  PID:8920
- C:\Windows\System\sHeKufa.exe
  C:\Windows\System\sHeKufa.exe
  2⤵
  PID:8936
- C:\Windows\System\ixruTjy.exe
  C:\Windows\System\ixruTjy.exe
  2⤵
  PID:8952
- C:\Windows\System\PwnSbnC.exe
  C:\Windows\System\PwnSbnC.exe
  2⤵
  PID:8968
- C:\Windows\System\xqpAahM.exe
  C:\Windows\System\xqpAahM.exe
  2⤵
  PID:8984
- C:\Windows\System\rVMVnmD.exe
  C:\Windows\System\rVMVnmD.exe
  2⤵
  PID:9004
- C:\Windows\System\IVFWIcN.exe
  C:\Windows\System\IVFWIcN.exe
  2⤵
  PID:9020
- C:\Windows\System\ezEpRJp.exe
  C:\Windows\System\ezEpRJp.exe
  2⤵
  PID:9036
- C:\Windows\System\DnscxHq.exe
  C:\Windows\System\DnscxHq.exe
  2⤵
  PID:9052
- C:\Windows\System\JEZxMwh.exe
  C:\Windows\System\JEZxMwh.exe
  2⤵
  PID:9068
- C:\Windows\System\nIhamFw.exe
  C:\Windows\System\nIhamFw.exe
  2⤵
  PID:9084
- C:\Windows\System\qaBTPBt.exe
  C:\Windows\System\qaBTPBt.exe
  2⤵
  PID:9100
- C:\Windows\System\LionIji.exe
  C:\Windows\System\LionIji.exe
  2⤵
  PID:9116
- C:\Windows\System\DEemoFw.exe
  C:\Windows\System\DEemoFw.exe
  2⤵
  PID:9132
- C:\Windows\System\YJNNTFD.exe
  C:\Windows\System\YJNNTFD.exe
  2⤵
  PID:9148
- C:\Windows\System\FXXwGvE.exe
  C:\Windows\System\FXXwGvE.exe
  2⤵
  PID:9164
- C:\Windows\System\QpGzgHU.exe
  C:\Windows\System\QpGzgHU.exe
  2⤵
  PID:9180
- C:\Windows\System\VaWxePD.exe
  C:\Windows\System\VaWxePD.exe
  2⤵
  PID:9196
- C:\Windows\System\HDQdVub.exe
  C:\Windows\System\HDQdVub.exe
  2⤵
  PID:9212
- C:\Windows\System\AMMhJfD.exe
  C:\Windows\System\AMMhJfD.exe
  2⤵
  PID:7868
- C:\Windows\System\vmbHdeI.exe
  C:\Windows\System\vmbHdeI.exe
  2⤵
  PID:7788
- C:\Windows\System\EnMmNlp.exe
  C:\Windows\System\EnMmNlp.exe
  2⤵
  PID:8200
- C:\Windows\System\HwvinyL.exe
  C:\Windows\System\HwvinyL.exe
  2⤵
  PID:7812
- C:\Windows\System\CIndQFC.exe
  C:\Windows\System\CIndQFC.exe
  2⤵
  PID:7972
- C:\Windows\System\aeTLzqS.exe
  C:\Windows\System\aeTLzqS.exe
  2⤵
  PID:8240
- C:\Windows\System\dmQlAZB.exe
  C:\Windows\System\dmQlAZB.exe
  2⤵
  PID:8228
- C:\Windows\System\FLWTKjm.exe
  C:\Windows\System\FLWTKjm.exe
  2⤵
  PID:8308
- C:\Windows\System\DRdVTEz.exe
  C:\Windows\System\DRdVTEz.exe
  2⤵
  PID:8344
- C:\Windows\System\xyDfiwm.exe
  C:\Windows\System\xyDfiwm.exe
  2⤵
  PID:8372
- C:\Windows\System\afUEIYF.exe
  C:\Windows\System\afUEIYF.exe
  2⤵
  PID:8404
- C:\Windows\System\HPIfYFk.exe
  C:\Windows\System\HPIfYFk.exe
  2⤵
  PID:8468
- C:\Windows\System\mRNPLcj.exe
  C:\Windows\System\mRNPLcj.exe
  2⤵
  PID:8388
- C:\Windows\System\PYhMCML.exe
  C:\Windows\System\PYhMCML.exe
  2⤵
  PID:8452
- C:\Windows\System\SkdYFwu.exe
  C:\Windows\System\SkdYFwu.exe
  2⤵
  PID:8520
- C:\Windows\System\ksDRQMs.exe
  C:\Windows\System\ksDRQMs.exe
  2⤵
  PID:8548
- C:\Windows\System\rCikIFk.exe
  C:\Windows\System\rCikIFk.exe
  2⤵
  PID:8600
- C:\Windows\System\DLqNpmy.exe
  C:\Windows\System\DLqNpmy.exe
  2⤵
  PID:8636
- C:\Windows\System\slPVULT.exe
  C:\Windows\System\slPVULT.exe
  2⤵
  PID:8696
- C:\Windows\System\ucppDIb.exe
  C:\Windows\System\ucppDIb.exe
  2⤵
  PID:8736
- C:\Windows\System\igecUKv.exe
  C:\Windows\System\igecUKv.exe
  2⤵
  PID:8652
- C:\Windows\System\WdBdQXT.exe
  C:\Windows\System\WdBdQXT.exe
  2⤵
  PID:8684
- C:\Windows\System\uGJJQro.exe
  C:\Windows\System\uGJJQro.exe
  2⤵
  PID:8748
- C:\Windows\System\FMssRxk.exe
  C:\Windows\System\FMssRxk.exe
  2⤵
  PID:8800
- C:\Windows\System\JbJhyqi.exe
  C:\Windows\System\JbJhyqi.exe
  2⤵
  PID:8828
- C:\Windows\System\zjDdYlQ.exe
  C:\Windows\System\zjDdYlQ.exe
  2⤵
  PID:8868
- C:\Windows\System\KVctUmj.exe
  C:\Windows\System\KVctUmj.exe
  2⤵
  PID:8932
- C:\Windows\System\JExlbSn.exe
  C:\Windows\System\JExlbSn.exe
  2⤵
  PID:8996
- C:\Windows\System\ZIjdMvN.exe
  C:\Windows\System\ZIjdMvN.exe
  2⤵
  PID:9032
- C:\Windows\System\zJYMiTx.exe
  C:\Windows\System\zJYMiTx.exe
  2⤵
  PID:8948
- C:\Windows\System\YpQflDV.exe
  C:\Windows\System\YpQflDV.exe
  2⤵
  PID:9096
- C:\Windows\System\HdpXZHV.exe
  C:\Windows\System\HdpXZHV.exe
  2⤵
  PID:8980
- C:\Windows\System\erZzWgk.exe
  C:\Windows\System\erZzWgk.exe
  2⤵
  PID:9128
- C:\Windows\System\aWSdJYN.exe
  C:\Windows\System\aWSdJYN.exe
  2⤵
  PID:9080
- C:\Windows\System\rfHiZvp.exe
  C:\Windows\System\rfHiZvp.exe
  2⤵
  PID:8704
- C:\Windows\System\GSYuuxG.exe
  C:\Windows\System\GSYuuxG.exe
  2⤵
  PID:9144
- C:\Windows\System\UoOcNfe.exe
  C:\Windows\System\UoOcNfe.exe
  2⤵
  PID:9208
- C:\Windows\System\hcHoMUq.exe
  C:\Windows\System\hcHoMUq.exe
  2⤵
  PID:7988
- C:\Windows\System\zIOhvYG.exe
  C:\Windows\System\zIOhvYG.exe
  2⤵
  PID:7640
- C:\Windows\System\AtvrocO.exe
  C:\Windows\System\AtvrocO.exe
  2⤵
  PID:8208
- C:\Windows\System\GnqUhQe.exe
  C:\Windows\System\GnqUhQe.exe
  2⤵
  PID:8312
- C:\Windows\System\ERxaHCg.exe
  C:\Windows\System\ERxaHCg.exe
  2⤵
  PID:8500
- C:\Windows\System\nsjmiOe.exe
  C:\Windows\System\nsjmiOe.exe
  2⤵
  PID:8440
- C:\Windows\System\VTSSKMR.exe
  C:\Windows\System\VTSSKMR.exe
  2⤵
  PID:8484
- C:\Windows\System\tdjTHHW.exe
  C:\Windows\System\tdjTHHW.exe
  2⤵
  PID:8424
- C:\Windows\System\dGELlfj.exe
  C:\Windows\System\dGELlfj.exe
  2⤵
  PID:8536
- C:\Windows\System\mgxZIXm.exe
  C:\Windows\System\mgxZIXm.exe
  2⤵
  PID:8732
- C:\Windows\System\zJxXNyY.exe
  C:\Windows\System\zJxXNyY.exe
  2⤵
  PID:8720
- C:\Windows\System\xBzjaaO.exe
  C:\Windows\System\xBzjaaO.exe
  2⤵
  PID:8832
- C:\Windows\System\SyqvnAA.exe
  C:\Windows\System\SyqvnAA.exe
  2⤵
  PID:9028
- C:\Windows\System\EkkAOmG.exe
  C:\Windows\System\EkkAOmG.exe
  2⤵
  PID:8864
- C:\Windows\System\zhZjdLo.exe
  C:\Windows\System\zhZjdLo.exe
  2⤵
  PID:8044
- C:\Windows\System\MxIgHdS.exe
  C:\Windows\System\MxIgHdS.exe
  2⤵
  PID:8880
- C:\Windows\System\EfreqBs.exe
  C:\Windows\System\EfreqBs.exe
  2⤵
  PID:9156
- C:\Windows\System\GiVdShC.exe
  C:\Windows\System\GiVdShC.exe
  2⤵
  PID:9140
- C:\Windows\System\pmRQLzU.exe
  C:\Windows\System\pmRQLzU.exe
  2⤵
  PID:7708
- C:\Windows\System\ltkuUbY.exe
  C:\Windows\System\ltkuUbY.exe
  2⤵
  PID:8328
- C:\Windows\System\cLEsZxl.exe
  C:\Windows\System\cLEsZxl.exe
  2⤵
  PID:8080
- C:\Windows\System\JpbCdEV.exe
  C:\Windows\System\JpbCdEV.exe
  2⤵
  PID:7112
- C:\Windows\System\lBpLesr.exe
  C:\Windows\System\lBpLesr.exe
  2⤵
  PID:8532
- C:\Windows\System\QLFQjGb.exe
  C:\Windows\System\QLFQjGb.exe
  2⤵
  PID:8992
- C:\Windows\System\nzklBQN.exe
  C:\Windows\System\nzklBQN.exe
  2⤵
  PID:9192
- C:\Windows\System\hxJCemW.exe
  C:\Windows\System\hxJCemW.exe
  2⤵
  PID:9240
- C:\Windows\System\yyZpBvN.exe
  C:\Windows\System\yyZpBvN.exe
  2⤵
  PID:9256
- C:\Windows\System\kKbwCCG.exe
  C:\Windows\System\kKbwCCG.exe
  2⤵
  PID:9272
- C:\Windows\System\xyKbdwT.exe
  C:\Windows\System\xyKbdwT.exe
  2⤵
  PID:9288
- C:\Windows\System\GgiMphT.exe
  C:\Windows\System\GgiMphT.exe
  2⤵
  PID:9304
- C:\Windows\System\ZWHuMnP.exe
  C:\Windows\System\ZWHuMnP.exe
  2⤵
  PID:9320
- C:\Windows\System\LXPqzJl.exe
  C:\Windows\System\LXPqzJl.exe
  2⤵
  PID:9336
- C:\Windows\System\xxKQyhY.exe
  C:\Windows\System\xxKQyhY.exe
  2⤵
  PID:9352
- C:\Windows\System\qdqFzSJ.exe
  C:\Windows\System\qdqFzSJ.exe
  2⤵
  PID:9380
- C:\Windows\System\WJJVKsX.exe
  C:\Windows\System\WJJVKsX.exe
  2⤵
  PID:9396
- C:\Windows\System\SVIOcjE.exe
  C:\Windows\System\SVIOcjE.exe
  2⤵
  PID:9416
- C:\Windows\System\qSsMwkU.exe
  C:\Windows\System\qSsMwkU.exe
  2⤵
  PID:9432
- C:\Windows\System\PdadOeU.exe
  C:\Windows\System\PdadOeU.exe
  2⤵
  PID:9448
- C:\Windows\System\NnWibWi.exe
  C:\Windows\System\NnWibWi.exe
  2⤵
  PID:9468
- C:\Windows\System\xTACKgo.exe
  C:\Windows\System\xTACKgo.exe
  2⤵
  PID:9484
- C:\Windows\System\HIBAsNX.exe
  C:\Windows\System\HIBAsNX.exe
  2⤵
  PID:9504
- C:\Windows\System\qCJZqqr.exe
  C:\Windows\System\qCJZqqr.exe
  2⤵
  PID:9524
- C:\Windows\System\rcdvQIX.exe
  C:\Windows\System\rcdvQIX.exe
  2⤵
  PID:9540
- C:\Windows\System\EQejSOy.exe
  C:\Windows\System\EQejSOy.exe
  2⤵
  PID:9556
- C:\Windows\System\DlFsEKa.exe
  C:\Windows\System\DlFsEKa.exe
  2⤵
  PID:9572
- C:\Windows\System\lWwTvWp.exe
  C:\Windows\System\lWwTvWp.exe
  2⤵
  PID:9588
- C:\Windows\System\uPMTmHS.exe
  C:\Windows\System\uPMTmHS.exe
  2⤵
  PID:9604
- C:\Windows\System\RWuxlHF.exe
  C:\Windows\System\RWuxlHF.exe
  2⤵
  PID:9620
- C:\Windows\System\hlpIPpO.exe
  C:\Windows\System\hlpIPpO.exe
  2⤵
  PID:9636
- C:\Windows\System\HLQMrkE.exe
  C:\Windows\System\HLQMrkE.exe
  2⤵
  PID:9652
- C:\Windows\System\nwpImSH.exe
  C:\Windows\System\nwpImSH.exe
  2⤵
  PID:9668
- C:\Windows\System\UwfIlom.exe
  C:\Windows\System\UwfIlom.exe
  2⤵
  PID:9684
- C:\Windows\System\awsvoVe.exe
  C:\Windows\System\awsvoVe.exe
  2⤵
  PID:9700
- C:\Windows\System\BrBtkix.exe
  C:\Windows\System\BrBtkix.exe
  2⤵
  PID:9716
- C:\Windows\System\hSShAKt.exe
  C:\Windows\System\hSShAKt.exe
  2⤵
  PID:9732
- C:\Windows\System\nGeoidC.exe
  C:\Windows\System\nGeoidC.exe
  2⤵
  PID:9748
- C:\Windows\System\eogxrSV.exe
  C:\Windows\System\eogxrSV.exe
  2⤵
  PID:9768
- C:\Windows\System\jNDVtNW.exe
  C:\Windows\System\jNDVtNW.exe
  2⤵
  PID:9784
- C:\Windows\System\XgOcMoM.exe
  C:\Windows\System\XgOcMoM.exe
  2⤵
  PID:9800
- C:\Windows\System\drdTqBl.exe
  C:\Windows\System\drdTqBl.exe
  2⤵
  PID:9820
- C:\Windows\System\slLMxaU.exe
  C:\Windows\System\slLMxaU.exe
  2⤵
  PID:9836
- C:\Windows\System\dmSvueW.exe
  C:\Windows\System\dmSvueW.exe
  2⤵
  PID:9860
- C:\Windows\System\gnbikiO.exe
  C:\Windows\System\gnbikiO.exe
  2⤵
  PID:9876
- C:\Windows\System\DLnqqMq.exe
  C:\Windows\System\DLnqqMq.exe
  2⤵
  PID:9892
- C:\Windows\System\qXyCJQY.exe
  C:\Windows\System\qXyCJQY.exe
  2⤵
  PID:9908
- C:\Windows\System\hFLxYRt.exe
  C:\Windows\System\hFLxYRt.exe
  2⤵
  PID:9924
- C:\Windows\System\EGcAcwV.exe
  C:\Windows\System\EGcAcwV.exe
  2⤵
  PID:9944
- C:\Windows\System\pHkwUzT.exe
  C:\Windows\System\pHkwUzT.exe
  2⤵
  PID:9960
- C:\Windows\System\MWLQMgY.exe
  C:\Windows\System\MWLQMgY.exe
  2⤵
  PID:9980
- C:\Windows\System\iLlkGdx.exe
  C:\Windows\System\iLlkGdx.exe
  2⤵
  PID:9996
- C:\Windows\System\xMkqNix.exe
  C:\Windows\System\xMkqNix.exe
  2⤵
  PID:10012
- C:\Windows\System\LhwEGnF.exe
  C:\Windows\System\LhwEGnF.exe
  2⤵
  PID:10028
- C:\Windows\System\dHKiwnh.exe
  C:\Windows\System\dHKiwnh.exe
  2⤵
  PID:10048
- C:\Windows\System\xrWrEWd.exe
  C:\Windows\System\xrWrEWd.exe
  2⤵
  PID:10064
- C:\Windows\System\AhjCwXE.exe
  C:\Windows\System\AhjCwXE.exe
  2⤵
  PID:10080
- C:\Windows\System\MUYvgyN.exe
  C:\Windows\System\MUYvgyN.exe
  2⤵
  PID:10096
- C:\Windows\System\vvQdUwY.exe
  C:\Windows\System\vvQdUwY.exe
  2⤵
  PID:10116
- C:\Windows\System\QXoRdXX.exe
  C:\Windows\System\QXoRdXX.exe
  2⤵
  PID:10132
- C:\Windows\System\qvKMFbz.exe
  C:\Windows\System\qvKMFbz.exe
  2⤵
  PID:10148
- C:\Windows\System\BfwlaPt.exe
  C:\Windows\System\BfwlaPt.exe
  2⤵
  PID:10164
- C:\Windows\System\VfuNDsU.exe
  C:\Windows\System\VfuNDsU.exe
  2⤵
  PID:10180
- C:\Windows\System\HiSUbXW.exe
  C:\Windows\System\HiSUbXW.exe
  2⤵
  PID:10196
- C:\Windows\System\CJgrcDO.exe
  C:\Windows\System\CJgrcDO.exe
  2⤵
  PID:10212
- C:\Windows\System\dFxjVxL.exe
  C:\Windows\System\dFxjVxL.exe
  2⤵
  PID:10228
- C:\Windows\System\eqCLEId.exe
  C:\Windows\System\eqCLEId.exe
  2⤵
  PID:8568
- C:\Windows\System\KHEDnFY.exe
  C:\Windows\System\KHEDnFY.exe
  2⤵
  PID:8160
- C:\Windows\System\vgzBiSv.exe
  C:\Windows\System\vgzBiSv.exe
  2⤵
  PID:8928
- C:\Windows\System\dXtBFcT.exe
  C:\Windows\System\dXtBFcT.exe
  2⤵
  PID:9112
- C:\Windows\System\mESwfCQ.exe
  C:\Windows\System\mESwfCQ.exe
  2⤵
  PID:9108
- C:\Windows\System\GNlNReZ.exe
  C:\Windows\System\GNlNReZ.exe
  2⤵
  PID:8488
- C:\Windows\System\khijaRY.exe
  C:\Windows\System\khijaRY.exe
  2⤵
  PID:9268
- C:\Windows\System\VyHtGad.exe
  C:\Windows\System\VyHtGad.exe
  2⤵
  PID:9252
- C:\Windows\System\XMeJjba.exe
  C:\Windows\System\XMeJjba.exe
  2⤵
  PID:9280
- C:\Windows\System\PSkvmXK.exe
  C:\Windows\System\PSkvmXK.exe
  2⤵
  PID:9344
- C:\Windows\System\rvYqcIP.exe
  C:\Windows\System\rvYqcIP.exe
  2⤵
  PID:9404
- C:\Windows\System\wqUsavF.exe
  C:\Windows\System\wqUsavF.exe
  2⤵
  PID:8812
- C:\Windows\System\zTwWiqH.exe
  C:\Windows\System\zTwWiqH.exe
  2⤵
  PID:9392
- C:\Windows\System\VZOldCE.exe
  C:\Windows\System\VZOldCE.exe
  2⤵
  PID:9456
- C:\Windows\System\JAQEGjt.exe
  C:\Windows\System\JAQEGjt.exe
  2⤵
  PID:9408
- C:\Windows\System\BABXgKv.exe
  C:\Windows\System\BABXgKv.exe
  2⤵
  PID:9548
- C:\Windows\System\QxnbUFZ.exe
  C:\Windows\System\QxnbUFZ.exe
  2⤵
  PID:9616
- C:\Windows\System\sADboLX.exe
  C:\Windows\System\sADboLX.exe
  2⤵
  PID:9676
- C:\Windows\System\jalboqU.exe
  C:\Windows\System\jalboqU.exe
  2⤵
  PID:9740
- C:\Windows\System\HduxJTe.exe
  C:\Windows\System\HduxJTe.exe
  2⤵
  PID:9808
- C:\Windows\System\OTpJjEQ.exe
  C:\Windows\System\OTpJjEQ.exe
  2⤵
  PID:9812
- C:\Windows\System\LKmwdTH.exe
  C:\Windows\System\LKmwdTH.exe
  2⤵
  PID:9848
- C:\Windows\System\JgPPdqg.exe
  C:\Windows\System\JgPPdqg.exe
  2⤵
  PID:9564
- C:\Windows\System\toMAzMv.exe
  C:\Windows\System\toMAzMv.exe
  2⤵
  PID:9632
- C:\Windows\System\hSKZaZW.exe
  C:\Windows\System\hSKZaZW.exe
  2⤵
  PID:9696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DzWAlAS.exe

Filesize
1.6MB

MD5
0e386439082d91f2acc04dc205c581ac

SHA1
d80fa5f8954331dc31a601adf2b5e8c25479d2f3

SHA256
fb3b4ead0a5b601bf13d6a9734ea03e45b8272aa34b052f240203e800a9bbd2a

SHA512
b3bcc24344d5507e64bf085fc6080e3c8f1db6592529fa3158630205adb83c49ef2694f1b4dd0ed114bcad261e22df71e4bfca08ca5aabbcc7e7b43e0cd41b2b

Download Submit
C:\Windows\system\FETGirQ.exe

Filesize
1.6MB

MD5
4ef1a06c55905c09c53b84d63b84165a

SHA1
4152e4da393bdb5fcbec40bc739bbb9aa8f801d4

SHA256
ac6fae00dcc7442b10984eaa14900c85a9d414c10956842d7bf8ffd5e833ad5b

SHA512
26686292e7ad36f8af1a0ad64206dd9d171ecc0c94da4a3717a43d8325cf2d4bccee2fbce29ac1351a3514e9bc8da019923a1e641d53724efffa3a2c2c0d9d45

Download Submit
C:\Windows\system\FeTGObm.exe

Filesize
1.6MB

MD5
23e5d0b39a0ed06f63ae9729aff20206

SHA1
eb15f2a15c78b1e36a8d36465414e9fae9b59053

SHA256
7913d12748a1f57acbe68d9b84d6a2a59aca682140218d12c0a52a4e4e6cceea

SHA512
be8e542d1f8c65aa8157d40ed2f99eb7df185464834c97d7de991f804fe4fad1696a5034f2a8d8f726213f1139628bfd067a4947feacedfd2c9e4f540a854a85

Download Submit
C:\Windows\system\GThrvLS.exe

Filesize
1.6MB

MD5
de55948e8cb5b3610ae1be5e3136c95d

SHA1
f88119793fc71b72f55eb461b3be1c82fa84d97d

SHA256
6ab1899e0ede5f2d6a476f92f66078d706cb6d8654e199717cbb0d00fd61b176

SHA512
3d996d334417fb351b3014480a8bab7c0d16d63fbf8d6f856ff27f43c229463dc7bf742ba62073a5ecfc841f7b47e11c202f04755b339ac9582a5aba848ecb4d

Download Submit
C:\Windows\system\HnISkdG.exe

Filesize
1.6MB

MD5
3a1a9c7ded4b178d0b1bd24afba8bc50

SHA1
e51c25dc2a8c855054e67ba3c3f6eb32f8740aa3

SHA256
44493e8baeff08d317e6c7685611a2cc3c83a871dbeb10a21a3518f1001cb0df

SHA512
ea5cb3a8fba108d106d12f6b4aa1459c19a290dbd9f95005f87af7e91e89efdff6b0c43313d202062799865ad2d610125d142e7f6457dba291fb4190c4c47d64

Download Submit
C:\Windows\system\IYxhNpJ.exe

Filesize
1.6MB

MD5
31f1be1682485094001c64e7d373b05d

SHA1
19bf5086b492a8621382db3bad7c981a09d3b582

SHA256
e57074c0b21b083fa55fbfa4eee470bbcbe0ced6590cb6349171e9744f376639

SHA512
0751faccaaa674011a1b88c85f0612d56507e22db564eb9b90af61b1c34ef846862a6abb03ff05f9010ef56281cb5b151f769985081728f53073b8bd9f86fe07

Download Submit
C:\Windows\system\IbUgmNv.exe

Filesize
1.6MB

MD5
bc1f7b9deac5edfbc0b4f9f753d255a5

SHA1
82804b40f92eef9f5f8c78e0675ac390bbd0ce87

SHA256
2e755a3999ed67c59b2d1d2a24e7fc45a3929c307c82921e266f59a6c249748f

SHA512
71489b76b3bb2d10ce51e62d20109d69e968894ed498a2dcc80a1da72ccd4a95de2414ec4fb37c93e3012dc23b097fb74a5def6e85c946f7914faceda7d79a02

Download Submit
C:\Windows\system\KRgnTZG.exe

Filesize
1.6MB

MD5
d5338fa2022f0f541e5e8ee04c444cfa

SHA1
bc8e46b41919416af9ffbae7ced993d61fdb047c

SHA256
d582d6d2e0a0df9c7d04fc5bec25fa53c100ef0ab1f7026c33f1d6e8b8880072

SHA512
137e10b707bc34e5943cff2d3b1729ce8fdf9bfc0a754b80940a53c8e312ba65ac156667d96c7864f3704448af5ca226f39afec3a9567924a680117b861e1f75

Download Submit
C:\Windows\system\RAXKOiK.exe

Filesize
1.6MB

MD5
cf589352397064d8d3fbc6321138c065

SHA1
af0c082417967bca7051df1774690fcfba033e0a

SHA256
0733c56d3a3c8819c7be74a24e51ec34166ee82ca233153a8222d453a8922969

SHA512
3914743be73d022f24bdd6779d600356d5b72f9df30013dcab285565a959fcee50dee021dbb6bf636cb4e5e9a5707817b28a13e80c25151a6f68c89696033594

Download Submit
C:\Windows\system\SBesyJa.exe

Filesize
1.6MB

MD5
442a7756285c9523ecb58032a7e8ba67

SHA1
49d32b0e66b47b0ecc3453e5dfad387aed4216de

SHA256
bee8ee4113318fd51126bbce228a1fef973b5ea1f8ac32c338e68e517870a96f

SHA512
437fa404ae5d567ffabafcdc8362fc02f771ffb8d1af9edd40f815974e23c2a487f4d8e010d52325054c5d3a9a3df8ef75525ca8d445744a1a540264e5b2ab3a

Download Submit
C:\Windows\system\StlTzAs.exe

Filesize
1.6MB

MD5
82b1fb8a99fb78d912c493af14931aba

SHA1
f948663365a87d0369097e1fbbbaab98dbc5688e

SHA256
1f11667d18d4171e03d2e58830176a3487b6dd7624d76ccc323a6114542c3401

SHA512
136b0a2c01302bfd148185ac9f550a982156ef8db13a9c78a6910b83e7fb9247e8d2058ed108d8cc893706a9a97c824f5d41d08f24d7654ee90d081856354fe5

Download Submit
C:\Windows\system\TnjzmqO.exe

Filesize
1.6MB

MD5
7344df0927d2174e9be7cffb16a6da21

SHA1
043fdbfdc74e7d3938b23299720b0a457fddc12d

SHA256
73e94c27feaa3fad6c389861ea721522ec4eb37e8513f0355c44d8bd5ae80dac

SHA512
952e56c53368eab939029c7518d299b9da552924b2c14a2bfab7538e20c9248a5109085fad161650936240e50000994755cd6b3dc1eab427fed0d587969cd440

Download Submit
C:\Windows\system\ZuRHXkt.exe

Filesize
1.6MB

MD5
c13c7aca7d67a5fd4d8d17dbf03ca749

SHA1
a6794b9604d84103a6b82f32b8db6260157c3010

SHA256
c1874214932408e5d1fafc299bdedd822511c2fbc5046af19d6a6b4311f44cfb

SHA512
765efb21ddeb216f65ad5022de67a4e6aef691d807163a9af75ed193faff360530f779ab296d3a62c94b2f21bffa503635dc0647d910ca2764f8e1ea2a612d77

Download Submit
C:\Windows\system\aIdDZCb.exe

Filesize
1.6MB

MD5
1fdc8502390f1370048a0ee7dec36b5f

SHA1
a4a2f863f74fb02729c8fa5188040d8da4c37009

SHA256
90dcf97168c04a3a157e634a92b181c3505739b1bfc28fb91017f74fa575efe9

SHA512
8d12cf37c6834d749b5552e341e9fc34472c25b5264e20c3bc2897beccd8b7c43ea39ddadcf89b994997fdd70e6583a0e3fefcfb1639fa5ba7ddcd7129edc278

Download Submit
C:\Windows\system\apZkRnD.exe

Filesize
1.6MB

MD5
e79055ca53b474a3b8da964d9b3227f8

SHA1
c8dee994a16276711c824d7db67528100b03352f

SHA256
77e91d97f2ee6b0cad729fbfc7f96f7a765fd66a5bfcfd2701bc9a164e845432

SHA512
ea980fad267bdc38c0ef51ba6e673e399f2cdc73693019beb730cd12e5aea0136ba74d6d7c0bc397db270fc097fc674f90165e5e0f98d6f61c8f61ec66205af7

Download Submit
C:\Windows\system\doezzjo.exe

Filesize
1.6MB

MD5
7f39d981e1045a67dc735c2b7bdf6996

SHA1
57cedf2b606caa2edc5e9cc473321f222b839553

SHA256
3729da141778ce72021ea33b30aa4c6da660f1800bd96d69f7363bf8e105ec35

SHA512
21032a6b4cf2c5d31b14cdc4b742f86d3497756dc174b4af9fb9c74384d342371666ea67da8275db7e21ffff4f533915be18e7f455f74b7b5814f02306a55c14

Download Submit
C:\Windows\system\eVXPHWh.exe

Filesize
1.6MB

MD5
1dcd1fd8462183e2d497c6a01e2cafcc

SHA1
3360b0b4da2c261db91cf0d5a23f7883ec5074da

SHA256
4a92611ea168fae4d39709ca438202c76f2d7bcbc35e43343ab44d24ca050573

SHA512
fccfd81d865be6bd0c92beb9d7b14bf48b97e4b6a8d2ce47cc1e40980981c62a09833e0bd41133ff63c5393fcaa81e402eac71143f330e32d312e4a031ae138c

Download Submit
C:\Windows\system\gmGHGCq.exe

Filesize
1.6MB

MD5
fd41b44c900808151f1f20afdf51f24e

SHA1
ce5776737a4c819354c0ab0a79db0d395a1637c8

SHA256
e208db1846e84d4bf94aaaeddfe01d4fc91338ef60571c3444a964d614547ccd

SHA512
bf21a7c285e5350eac547a48b95b824cdc2d9db46cc1dd6e4776d63bc9760bde0241c6ef1062187eea7520c6163e328cb985a110cc5fe286d43fd6d2744df5cc

Download Submit
C:\Windows\system\heZqrqf.exe

Filesize
1.6MB

MD5
c67f60d42ca43f4babcb8995bc60d407

SHA1
5f00ed9fe8d2d4f8453d1ba37530155eb007e21f

SHA256
3b666ebb9526c02129f63395606ccae3296aad7cec9bb685629f6d2a1c314ad1

SHA512
24f8fd66c63ec96a2b42645f2369d4786b23b4564fa5a260c6283694b13ffa4f224ce18339427389dfaabcf1f469b2207abc7e37b447a64553b1802b6f5a6273

Download Submit
C:\Windows\system\lilaOju.exe

Filesize
1.6MB

MD5
6d421de0fc7253909e541852bbb2e616

SHA1
8d1855462b55975bff3a149f8d301dce94034e98

SHA256
b30d56799ebcf5a1856db4860bee6866a9c99603245be684dca0b2b5a9e8b64b

SHA512
b2d94af5e1a7180e70139eec3baa261c143c7b873094cf25c57bd95ae53282d3b4e0a84dc9a24ae2e18735b2149cf07a870a4c3eb47a78071d41d20104041db8

Download Submit
C:\Windows\system\nBarezK.exe

Filesize
1.6MB

MD5
28581cfed419d542c80025228074165e

SHA1
05e523d46770364040d53bd10be39d0e1254d9dd

SHA256
f5054c4693ec5fcf31184e698ccd7168ecf6b2cd03ff043d1c9619f4c95e84b7

SHA512
7a1c0583d48087718f29c5c366131417fc7ad569620afb01836638ef4b7ef6c15f78dd664ba807713dda0236384ac87066d61269c78bdafb20b7b8ecd6364ccd

Download Submit
C:\Windows\system\rBLfXiO.exe

Filesize
1.6MB

MD5
10084eb5c53f3e5a3a38a4d2de6e95d8

SHA1
e7a170118cb3440d2e7b379547ffc4244a610e28

SHA256
7f380998c52f5a90d0346e08a995048fdfbd8b7705cf2deb1a62daab76388fbf

SHA512
062afe7297ee6a653eff7f7a28d201239e640103592a253fe01479e2c9144d8dd37e3eef27745451807b5463be873589cc2d260bc0052417f0f72a4c6e2b048c

Download Submit
C:\Windows\system\sKDeZVU.exe

Filesize
1.6MB

MD5
a74ecf56241b871c3dd5b8bc1aeda4cc

SHA1
a5523592cad49d019e83c279c882cddbbfc2a197

SHA256
5e90d285cedff1b7a253359dc63e21580fd04930a8e2d20482d961868d3cb55b

SHA512
0f2b346c6758aa78509161143f89a87957c264b2883651e50a36b903854777d0d358cf8d0c73b4fcd6bee63ffc51d25a05eb70b02e12c56fb6edfa2d67801258

Download Submit
C:\Windows\system\uLeErKX.exe

Filesize
1.6MB

MD5
8148ea110804966d1b49764d5a436c9b

SHA1
109ddfe7e835429ff7e7a960c8c02b1d74ca423d

SHA256
4c0330afe546a17e6dc011583b2923a4031512972332964491408d1b60359fdb

SHA512
751841eee97d31a2c9c18c24a2c0f2892d9bc70f7d1088a6839ac664cf948fa45a779638ec38d91fbcb6e6aa8ad879b00506e7cf936fa6db1d149a7aad5b57d7

Download Submit
C:\Windows\system\wVPHMFD.exe

Filesize
1.6MB

MD5
d2eca28bffe4078c9a48fb52a085aa63

SHA1
d8ae0c3b708254b33f8dbb6d5b85f1b1929de403

SHA256
77fad8cb10df94f6f61d575ec8060cec42ec069eaaf759499273e8df8c7c7c2e

SHA512
783739318220b954952cd9bda76dc8e39e8fb9fe55a01a686497a36a638d0288ebfafe684093e0d2ddf2326b547055037d95799eb18e6025e8826a47579d5290

Download Submit
C:\Windows\system\xrMvtfZ.exe

Filesize
1.6MB

MD5
ebd5b3fcd9f4df511e3ce82ee1af88af

SHA1
7a1b83ba332fa8548a1cd32b764d69a1a00773fa

SHA256
02b514de1263337d2eced0e372df5dfa4a9242de273c4fd868ff704ba234a6ce

SHA512
9394360d363b308737badac4eb52570f3093f87a8180ad007c9fba56a1cfd043da920777c694eb7d4600f1203cc0fc69d07c0d9d492b62550da476825f4ae7b6

Download Submit
C:\Windows\system\yPjQqiu.exe

Filesize
1.6MB

MD5
1bddb0136e81273d78dc0fff7aaf07ea

SHA1
bf00382ee4322cb55fb1eb3fc4d23ea3e9e13baa

SHA256
c503252acc71ee9b4b00e870e292a631c0f61a39cd24dc362d1d91ce3aa8c2f3

SHA512
752ea9929418f7ad9493647cf2b2e660103e40b2edb58f775116074b1b39547d7b73c9b9e1df070d43dacf569fb2a602d8e73bf401ee940c4ce8545ee08a9e36

Download Submit
\Windows\system\cMSVOvY.exe

Filesize
1.6MB

MD5
90b0547004a833fb094698232841f923

SHA1
689e39794e29f01983ad59d71c4f243ba31740a1

SHA256
5f3c43d56cff3df44299478f2530dda6369a0ba60f5e2671d030b22c540ff011

SHA512
6b6d66abf23f5b75cd914b4c6d1db20dbb43200bfc06188a343f9b4d51fcd894aeda167c5ae8b7a39910ed9fc2a85510f27cdc0821384b603c2c5e3e029f23e7

Download Submit
\Windows\system\hWerbFC.exe

Filesize
1.6MB

MD5
325d35b4714cf1ef39d7861749002ba3

SHA1
9c22719dabcd9ceead7283a5d4a36e2add1084d1

SHA256
dd9e523ebe5a21f14eafaa3452582d1000abebce5366be470b713af9115e5914

SHA512
64f9c3a5132d0a7aafb87b667914a9548cedcd058539421824b4737d4afdc7bff9024f6046a09aade438e39fdbaa2c76fa5a91a68ccf3112bc951f8367394edc

Download Submit
\Windows\system\kHffbhv.exe

Filesize
1.6MB

MD5
341ce002ac43e1c690a21f34ceba15f4

SHA1
8489412b7c29fd65f29698fbb303d5943b27a036

SHA256
70510892bbc1218bd07e6e94429f807213d203897634b7a1e885eaac71639c8d

SHA512
433753bcf627b5073dc1ce429fac427ebd6ffe2ea6400c7698c65e4649a153146aff054a94fb4f5fb489725e2178528a2f0f468cc66225ea02eb84d225958bdf

Download Submit
\Windows\system\sZAsQuy.exe

Filesize
1.6MB

MD5
11204e840ee063b14350821963ae5d7b

SHA1
85d65ecbbeb94bf41d1ba09613ef83eb8ebb59ee

SHA256
890834913cb6ac329a84467cf013a694db9c5585c229a96a13758e651389ba20

SHA512
05f822c8c88acf83a1c5cfaa54d5cb77e59d89de9078ec2378a72ea09932c6e1cccff48b5716184783848081d036a37d9910f247ccc5bef994cb7f2675b7e089

Download Submit
\Windows\system\uuKVSWk.exe

Filesize
1.6MB

MD5
a7e3ac12507dfe83cf1dba4a877fac95

SHA1
864e548fd586b663f6471414ca789069e803a936

SHA256
1fb628dc9eeaff3d2202fdf482cabb2f17c322ce96ea89b9202c6a8dd979767f

SHA512
5ead5a05922ee847717819dd3af80389418f8ce6de08d4bd09e5de089decd8c47f1237fd4d2b8db5283f8b1a24028ea826bd28d50f1c3ac72fe9008979011e10

Download Submit
memory/916-71-0x000000013F3A0000-0x000000013F792000-memory.dmp

Filesize
3.9MB

Download
memory/916-259-0x000000013F3A0000-0x000000013F792000-memory.dmp

Filesize
3.9MB

Download
memory/916-3034-0x000000013F3A0000-0x000000013F792000-memory.dmp

Filesize
3.9MB

Download
memory/1420-3068-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/1420-67-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/1420-257-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/1440-2965-0x000000013FD60000-0x0000000140152000-memory.dmp

Filesize
3.9MB

Download
memory/1440-74-0x000000013FD60000-0x0000000140152000-memory.dmp

Filesize
3.9MB

Download
memory/1976-2994-0x000000013FEB0000-0x00000001402A2000-memory.dmp

Filesize
3.9MB

Download
memory/1976-256-0x000000013FEB0000-0x00000001402A2000-memory.dmp

Filesize
3.9MB

Download
memory/1976-58-0x000000013FEB0000-0x00000001402A2000-memory.dmp

Filesize
3.9MB

Download
memory/2108-3001-0x000000013F020000-0x000000013F412000-memory.dmp

Filesize
3.9MB

Download
memory/2108-90-0x000000013F020000-0x000000013F412000-memory.dmp

Filesize
3.9MB

Download
memory/2400-265-0x000000013F790000-0x000000013FB82000-memory.dmp

Filesize
3.9MB

Download
memory/2572-263-0x000000013F390000-0x000000013F782000-memory.dmp

Filesize
3.9MB

Download
memory/2584-26-0x000000013F730000-0x000000013FB22000-memory.dmp

Filesize
3.9MB

Download
memory/2584-3018-0x000000013F730000-0x000000013FB22000-memory.dmp

Filesize
3.9MB

Download
memory/2684-69-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/2684-3000-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/2728-102-0x0000000003280000-0x0000000003672000-memory.dmp

Filesize
3.9MB

Download
memory/2728-68-0x0000000003280000-0x0000000003672000-memory.dmp

Filesize
3.9MB

Download
memory/2728-59-0x0000000003280000-0x0000000003672000-memory.dmp

Filesize
3.9MB

Download
memory/2728-7-0x0000000002DE0000-0x00000000031D2000-memory.dmp

Filesize
3.9MB

Download
memory/2728-89-0x000000013F020000-0x000000013F412000-memory.dmp

Filesize
3.9MB

Download
memory/2728-75-0x0000000003280000-0x0000000003672000-memory.dmp

Filesize
3.9MB

Download
memory/2728-70-0x0000000003280000-0x0000000003672000-memory.dmp

Filesize
3.9MB

Download
memory/2728-73-0x000000013FD60000-0x0000000140152000-memory.dmp

Filesize
3.9MB

Download
memory/2728-1-0x000000013F480000-0x000000013F872000-memory.dmp

Filesize
3.9MB

Download
memory/2728-13-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2728-210-0x000000013F480000-0x000000013F872000-memory.dmp

Filesize
3.9MB

Download
memory/2728-0-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/2728-25-0x0000000003280000-0x0000000003672000-memory.dmp

Filesize
3.9MB

Download
memory/2728-57-0x000000013FEB0000-0x00000001402A2000-memory.dmp

Filesize
3.9MB

Download
memory/2728-76-0x0000000003280000-0x0000000003672000-memory.dmp

Filesize
3.9MB

Download
memory/2728-98-0x0000000003280000-0x0000000003672000-memory.dmp

Filesize
3.9MB

Download
memory/2744-3023-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2744-15-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2744-212-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2800-211-0x000000013F390000-0x000000013F782000-memory.dmp

Filesize
3.9MB

Download
memory/2800-3019-0x000000013F390000-0x000000013F782000-memory.dmp

Filesize
3.9MB

Download
memory/2800-9-0x000000013F390000-0x000000013F782000-memory.dmp

Filesize
3.9MB

Download
memory/2884-50-0x000000001B320000-0x000000001B602000-memory.dmp

Filesize
2.9MB

Download
memory/2884-55-0x000007FEF5750000-0x000007FEF60ED000-memory.dmp

Filesize
9.6MB

Download
memory/2884-27-0x00000000029F0000-0x0000000002A70000-memory.dmp

Filesize
512KB

Download
memory/2884-146-0x000007FEF5750000-0x000007FEF60ED000-memory.dmp

Filesize
9.6MB

Download
memory/2884-28-0x000007FEF5A0E000-0x000007FEF5A0F000-memory.dmp

Filesize
4KB

Download
memory/2884-61-0x0000000002470000-0x0000000002478000-memory.dmp

Filesize
32KB

Download
memory/2884-72-0x000007FEF5750000-0x000007FEF60ED000-memory.dmp

Filesize
9.6MB

Download
memory/2900-264-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/2964-91-0x000000013F0C0000-0x000000013F4B2000-memory.dmp

Filesize
3.9MB

Download
memory/2964-3075-0x000000013F0C0000-0x000000013F4B2000-memory.dmp

Filesize
3.9MB

Download
memory/3036-2422-0x000000013F0E0000-0x000000013F4D2000-memory.dmp

Filesize
3.9MB

Download
memory/3036-56-0x000000013F0E0000-0x000000013F4D2000-memory.dmp

Filesize
3.9MB

Download
memory/3036-214-0x000000013F0E0000-0x000000013F4D2000-memory.dmp

Filesize
3.9MB

Download