xmrig | d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0

Analysis

max time kernel
150s
max time network
143s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
02-08-2024 05:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
Size

1.3MB
MD5

18bba484a007b8c525a50ca2a4908834
SHA1

5b47eaf15b02514267b5c6a81113e7fda4debbc2
SHA256

d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0
SHA512

f89f75623709061dc08697faaa438f5038a5935365ab72afdd00d7e23972ea20dff755aabff45a45ea5037e1f5e33738b113776daf56c948ae5970e16f2fd710
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYRLZcyZ2nywSUHN0:Lz071uv4BPMkibTIA5JnIyKN0

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 17 IoCs

miner

resource	yara_rule
behavioral1/memory/2992-43-0x000000013FA00000-0x000000013FDF2000-memory.dmp	xmrig
behavioral1/memory/2980-47-0x000000013FA50000-0x000000013FE42000-memory.dmp	xmrig
behavioral1/memory/2920-44-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	xmrig
behavioral1/memory/2824-57-0x000000013FA00000-0x000000013FDF2000-memory.dmp	xmrig
behavioral1/memory/3024-56-0x000000013F120000-0x000000013F512000-memory.dmp	xmrig
behavioral1/memory/2164-54-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	xmrig
behavioral1/memory/2244-85-0x000000013FDB0000-0x00000001401A2000-memory.dmp	xmrig
behavioral1/memory/2508-91-0x000000013F0A0000-0x000000013F492000-memory.dmp	xmrig
behavioral1/memory/1388-79-0x000000013F320000-0x000000013F712000-memory.dmp	xmrig
behavioral1/memory/2256-65-0x000000013F280000-0x000000013F672000-memory.dmp	xmrig
behavioral1/memory/1948-72-0x000000013F510000-0x000000013F902000-memory.dmp	xmrig
behavioral1/memory/2820-50-0x000000013FD90000-0x0000000140182000-memory.dmp	xmrig
behavioral1/memory/2992-4135-0x000000013FA00000-0x000000013FDF2000-memory.dmp	xmrig
behavioral1/memory/2920-4203-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	xmrig
behavioral1/memory/1948-4329-0x000000013F510000-0x000000013F902000-memory.dmp	xmrig
behavioral1/memory/1388-4343-0x000000013F320000-0x000000013F712000-memory.dmp	xmrig
behavioral1/memory/2508-4356-0x000000013F0A0000-0x000000013F492000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2400	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2992	lclkOuU.exe
2920	iiTXjVH.exe
2980	dFeOnin.exe
2820	WfuJPLU.exe
2164	WmBfyiY.exe
3024	bqqwnoB.exe
2824	YHFkACS.exe
2256	ngiGAxn.exe
1948	nIVuFxh.exe
1388	pkgPkmL.exe
2244	iftCPgR.exe
2508	gyXBkmn.exe
1932	pystnKr.exe
712	MNaFrsW.exe
940	TzFDVso.exe
2864	rHheNtP.exe
2196	HkSpUKZ.exe
2892	ImoGGpJ.exe
3004	uKShGHq.exe
2868	PtXotnk.exe
1756	qNYdeLZ.exe
792	zSBUUyz.exe
776	UHJOxHB.exe
2376	gkaSAeU.exe
2368	NeLeTHs.exe
2060	TRiAXaZ.exe
1448	zqvZYwn.exe
1584	kPfjtcd.exe
1820	UeeHJNU.exe
1144	iOPFCcW.exe
848	zWdHSjS.exe
2020	HRoKGhn.exe
1792	duBCoHB.exe
3052	MVfptFx.exe
1136	lBcPpCx.exe
1380	NIEGzJN.exe
1680	eXzUlYy.exe
1816	yupDIoZ.exe
1628	cHEUrnL.exe
1060	vijhVVU.exe
2220	tGhOQIl.exe
1308	YJzkTiK.exe
1664	VlCAWgQ.exe
316	sVyaQVL.exe
2600	PNgBgsM.exe
2240	HkgDrSz.exe
2540	XsEEMrW.exe
1920	oouznCq.exe
1632	tOmCmII.exe
872	KuqDJyh.exe
2740	TUDpTZy.exe
1528	iVNVKTn.exe
2340	RovWNok.exe
1612	naMLTZj.exe
2768	wvhIpFd.exe
2148	cPNnSWO.exe
2096	YqcTzDE.exe
268	orqxxDs.exe
2940	cZdeeRp.exe
2116	dnDpvZR.exe
2976	ilwAXYj.exe
2688	RrBOikl.exe
1288	CkWXtSC.exe
3064	jQePVXu.exe

Loads dropped DLL 64 IoCs

pid	Process
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe

UPX packed file 50 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2296-1-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	upx
behavioral1/files/0x000900000001202f-6.dat	upx
behavioral1/files/0x0008000000016c83-15.dat	upx
behavioral1/files/0x0007000000004e74-19.dat	upx
behavioral1/files/0x0007000000016d2d-24.dat	upx
behavioral1/files/0x0008000000016d04-23.dat	upx
behavioral1/files/0x0007000000016d46-38.dat	upx
behavioral1/memory/2992-43-0x000000013FA00000-0x000000013FDF2000-memory.dmp	upx
behavioral1/files/0x0007000000016d3e-42.dat	upx
behavioral1/memory/2980-47-0x000000013FA50000-0x000000013FE42000-memory.dmp	upx
behavioral1/memory/2920-44-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	upx
behavioral1/memory/2824-57-0x000000013FA00000-0x000000013FDF2000-memory.dmp	upx
behavioral1/memory/3024-56-0x000000013F120000-0x000000013F512000-memory.dmp	upx
behavioral1/memory/2164-54-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	upx
behavioral1/files/0x0009000000016d5a-63.dat	upx
behavioral1/files/0x0011000000018676-75.dat	upx
behavioral1/memory/2244-85-0x000000013FDB0000-0x00000001401A2000-memory.dmp	upx
behavioral1/files/0x000600000001903f-109.dat	upx
behavioral1/files/0x0005000000019207-129.dat	upx
behavioral1/files/0x000500000001926a-159.dat	upx
behavioral1/files/0x0005000000019386-189.dat	upx
behavioral1/files/0x0005000000019372-184.dat	upx
behavioral1/files/0x000500000001935b-179.dat	upx
behavioral1/files/0x0005000000019358-175.dat	upx
behavioral1/files/0x0005000000019297-169.dat	upx
behavioral1/files/0x000500000001928e-164.dat	upx
behavioral1/files/0x0005000000019267-154.dat	upx
behavioral1/files/0x000500000001925d-149.dat	upx
behavioral1/files/0x000500000001925a-144.dat	upx
behavioral1/files/0x0005000000019248-139.dat	upx
behavioral1/files/0x0005000000019230-134.dat	upx
behavioral1/files/0x00050000000191da-124.dat	upx
behavioral1/files/0x00060000000190e5-119.dat	upx
behavioral1/files/0x00060000000190d2-114.dat	upx
behavioral1/files/0x0006000000018f58-104.dat	upx
behavioral1/files/0x0006000000018c2c-99.dat	upx
behavioral1/files/0x0006000000018c22-94.dat	upx
behavioral1/memory/2508-91-0x000000013F0A0000-0x000000013F492000-memory.dmp	upx
behavioral1/files/0x0005000000018798-88.dat	upx
behavioral1/memory/1388-79-0x000000013F320000-0x000000013F712000-memory.dmp	upx
behavioral1/files/0x00050000000186c8-82.dat	upx
behavioral1/memory/2256-65-0x000000013F280000-0x000000013F672000-memory.dmp	upx
behavioral1/memory/1948-72-0x000000013F510000-0x000000013F902000-memory.dmp	upx
behavioral1/files/0x0008000000016d9e-68.dat	upx
behavioral1/memory/2820-50-0x000000013FD90000-0x0000000140182000-memory.dmp	upx
behavioral1/memory/2992-4135-0x000000013FA00000-0x000000013FDF2000-memory.dmp	upx
behavioral1/memory/2920-4203-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	upx
behavioral1/memory/1948-4329-0x000000013F510000-0x000000013F902000-memory.dmp	upx
behavioral1/memory/1388-4343-0x000000013F320000-0x000000013F712000-memory.dmp	upx
behavioral1/memory/2508-4356-0x000000013F0A0000-0x000000013F492000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\qqxEvSY.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\fvhAuOX.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\ZJsnXqn.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\XCyutbV.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\tGcgRDg.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\rdlTSfR.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\BFbsUzg.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\ITTZmfi.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\vyzhLaf.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\ewbSNrl.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\DDiEdvt.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\sxNNduC.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\svIPPcL.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\awYHSry.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\dpRHBIH.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\OOYXCjQ.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\TznsUdu.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\iQoulND.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\fiBxSvF.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\SanHDYe.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\kFjFCge.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\uBXkxHc.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\VOkRRgK.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\iOTPwge.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\LJhGgZm.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\pxZnwpg.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\AJzaZfW.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\PSnawDz.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\VqSxNpU.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\ZXlKSbb.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\raYTRFA.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\hWEqlCA.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\aKiTmLS.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\XXrAuNG.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\dppWmIr.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\qrKMnls.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\ZqVEiFA.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\wDKJZwp.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\TsJuuCz.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\dpszMbi.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\rAioNvK.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\CELhcfi.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\vXxQmwg.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\IJDOcNy.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\oqzeRmL.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\KVEyBsy.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\QxkfgBq.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\ynSrrQI.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\eQDHbmt.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\ZdEePEn.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\McqGWIJ.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\XnjkaQm.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\IBuVsPr.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\SOaVGBf.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\Rtbgzrg.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\BJWroMw.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\GbasmIZ.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\jYyhxKO.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\lfFJgtk.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\ceORyPY.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\dnTjuVb.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\ZzMFCGs.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\AlzopEZ.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\tgLnLbW.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2400	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
Token: SeLockMemoryPrivilege	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
Token: SeDebugPrivilege	2400	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2400	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	31
PID 2296 wrote to memory of 2400	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	31
PID 2296 wrote to memory of 2400	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	31
PID 2296 wrote to memory of 2992	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	32
PID 2296 wrote to memory of 2992	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	32
PID 2296 wrote to memory of 2992	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	32
PID 2296 wrote to memory of 2920	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	33
PID 2296 wrote to memory of 2920	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	33
PID 2296 wrote to memory of 2920	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	33
PID 2296 wrote to memory of 2980	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	34
PID 2296 wrote to memory of 2980	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	34
PID 2296 wrote to memory of 2980	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	34
PID 2296 wrote to memory of 2820	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	35
PID 2296 wrote to memory of 2820	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	35
PID 2296 wrote to memory of 2820	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	35
PID 2296 wrote to memory of 2164	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	36
PID 2296 wrote to memory of 2164	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	36
PID 2296 wrote to memory of 2164	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	36
PID 2296 wrote to memory of 2824	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	37
PID 2296 wrote to memory of 2824	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	37
PID 2296 wrote to memory of 2824	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	37
PID 2296 wrote to memory of 3024	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	38
PID 2296 wrote to memory of 3024	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	38
PID 2296 wrote to memory of 3024	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	38
PID 2296 wrote to memory of 2256	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	39
PID 2296 wrote to memory of 2256	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	39
PID 2296 wrote to memory of 2256	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	39
PID 2296 wrote to memory of 1948	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	40
PID 2296 wrote to memory of 1948	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	40
PID 2296 wrote to memory of 1948	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	40
PID 2296 wrote to memory of 1388	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	41
PID 2296 wrote to memory of 1388	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	41
PID 2296 wrote to memory of 1388	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	41
PID 2296 wrote to memory of 2244	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	42
PID 2296 wrote to memory of 2244	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	42
PID 2296 wrote to memory of 2244	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	42
PID 2296 wrote to memory of 2508	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	43
PID 2296 wrote to memory of 2508	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	43
PID 2296 wrote to memory of 2508	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	43
PID 2296 wrote to memory of 1932	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	44
PID 2296 wrote to memory of 1932	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	44
PID 2296 wrote to memory of 1932	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	44
PID 2296 wrote to memory of 712	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	45
PID 2296 wrote to memory of 712	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	45
PID 2296 wrote to memory of 712	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	45
PID 2296 wrote to memory of 940	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	46
PID 2296 wrote to memory of 940	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	46
PID 2296 wrote to memory of 940	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	46
PID 2296 wrote to memory of 2864	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	47
PID 2296 wrote to memory of 2864	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	47
PID 2296 wrote to memory of 2864	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	47
PID 2296 wrote to memory of 2196	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	48
PID 2296 wrote to memory of 2196	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	48
PID 2296 wrote to memory of 2196	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	48
PID 2296 wrote to memory of 2892	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	49
PID 2296 wrote to memory of 2892	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	49
PID 2296 wrote to memory of 2892	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	49
PID 2296 wrote to memory of 3004	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	50
PID 2296 wrote to memory of 3004	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	50
PID 2296 wrote to memory of 3004	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	50
PID 2296 wrote to memory of 2868	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	51
PID 2296 wrote to memory of 2868	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	51
PID 2296 wrote to memory of 2868	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	51
PID 2296 wrote to memory of 1756	2296	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	52

C:\Users\Admin\AppData\Local\Temp\d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
"C:\Users\Admin\AppData\Local\Temp\d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2400
- C:\Windows\System\lclkOuU.exe
  C:\Windows\System\lclkOuU.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\iiTXjVH.exe
  C:\Windows\System\iiTXjVH.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\dFeOnin.exe
  C:\Windows\System\dFeOnin.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\WfuJPLU.exe
  C:\Windows\System\WfuJPLU.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\WmBfyiY.exe
  C:\Windows\System\WmBfyiY.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\YHFkACS.exe
  C:\Windows\System\YHFkACS.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\bqqwnoB.exe
  C:\Windows\System\bqqwnoB.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\ngiGAxn.exe
  C:\Windows\System\ngiGAxn.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\nIVuFxh.exe
  C:\Windows\System\nIVuFxh.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\pkgPkmL.exe
  C:\Windows\System\pkgPkmL.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\iftCPgR.exe
  C:\Windows\System\iftCPgR.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\gyXBkmn.exe
  C:\Windows\System\gyXBkmn.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\pystnKr.exe
  C:\Windows\System\pystnKr.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\MNaFrsW.exe
  C:\Windows\System\MNaFrsW.exe
  2⤵
  - Executes dropped EXE
  PID:712
- C:\Windows\System\TzFDVso.exe
  C:\Windows\System\TzFDVso.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\rHheNtP.exe
  C:\Windows\System\rHheNtP.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\HkSpUKZ.exe
  C:\Windows\System\HkSpUKZ.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\ImoGGpJ.exe
  C:\Windows\System\ImoGGpJ.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\uKShGHq.exe
  C:\Windows\System\uKShGHq.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\PtXotnk.exe
  C:\Windows\System\PtXotnk.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\qNYdeLZ.exe
  C:\Windows\System\qNYdeLZ.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\zSBUUyz.exe
  C:\Windows\System\zSBUUyz.exe
  2⤵
  - Executes dropped EXE
  PID:792
- C:\Windows\System\UHJOxHB.exe
  C:\Windows\System\UHJOxHB.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\gkaSAeU.exe
  C:\Windows\System\gkaSAeU.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\NeLeTHs.exe
  C:\Windows\System\NeLeTHs.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\TRiAXaZ.exe
  C:\Windows\System\TRiAXaZ.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\zqvZYwn.exe
  C:\Windows\System\zqvZYwn.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\kPfjtcd.exe
  C:\Windows\System\kPfjtcd.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\UeeHJNU.exe
  C:\Windows\System\UeeHJNU.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\iOPFCcW.exe
  C:\Windows\System\iOPFCcW.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\zWdHSjS.exe
  C:\Windows\System\zWdHSjS.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\HRoKGhn.exe
  C:\Windows\System\HRoKGhn.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\duBCoHB.exe
  C:\Windows\System\duBCoHB.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\MVfptFx.exe
  C:\Windows\System\MVfptFx.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\lBcPpCx.exe
  C:\Windows\System\lBcPpCx.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\NIEGzJN.exe
  C:\Windows\System\NIEGzJN.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\eXzUlYy.exe
  C:\Windows\System\eXzUlYy.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\yupDIoZ.exe
  C:\Windows\System\yupDIoZ.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\cHEUrnL.exe
  C:\Windows\System\cHEUrnL.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\vijhVVU.exe
  C:\Windows\System\vijhVVU.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\tGhOQIl.exe
  C:\Windows\System\tGhOQIl.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\YJzkTiK.exe
  C:\Windows\System\YJzkTiK.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\VlCAWgQ.exe
  C:\Windows\System\VlCAWgQ.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\sVyaQVL.exe
  C:\Windows\System\sVyaQVL.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\PNgBgsM.exe
  C:\Windows\System\PNgBgsM.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\HkgDrSz.exe
  C:\Windows\System\HkgDrSz.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\XsEEMrW.exe
  C:\Windows\System\XsEEMrW.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\oouznCq.exe
  C:\Windows\System\oouznCq.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\tOmCmII.exe
  C:\Windows\System\tOmCmII.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\KuqDJyh.exe
  C:\Windows\System\KuqDJyh.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\TUDpTZy.exe
  C:\Windows\System\TUDpTZy.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\iVNVKTn.exe
  C:\Windows\System\iVNVKTn.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\RovWNok.exe
  C:\Windows\System\RovWNok.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\naMLTZj.exe
  C:\Windows\System\naMLTZj.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\wvhIpFd.exe
  C:\Windows\System\wvhIpFd.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\cPNnSWO.exe
  C:\Windows\System\cPNnSWO.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\YqcTzDE.exe
  C:\Windows\System\YqcTzDE.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\orqxxDs.exe
  C:\Windows\System\orqxxDs.exe
  2⤵
  - Executes dropped EXE
  PID:268
- C:\Windows\System\cZdeeRp.exe
  C:\Windows\System\cZdeeRp.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\dnDpvZR.exe
  C:\Windows\System\dnDpvZR.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\ilwAXYj.exe
  C:\Windows\System\ilwAXYj.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\RrBOikl.exe
  C:\Windows\System\RrBOikl.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\CkWXtSC.exe
  C:\Windows\System\CkWXtSC.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\jQePVXu.exe
  C:\Windows\System\jQePVXu.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\zlQdqmL.exe
  C:\Windows\System\zlQdqmL.exe
  2⤵
  PID:2692
- C:\Windows\System\yXUZqwP.exe
  C:\Windows\System\yXUZqwP.exe
  2⤵
  PID:2888
- C:\Windows\System\FgaJvxi.exe
  C:\Windows\System\FgaJvxi.exe
  2⤵
  PID:1504
- C:\Windows\System\SoxYQmO.exe
  C:\Windows\System\SoxYQmO.exe
  2⤵
  PID:1696
- C:\Windows\System\KVEyBsy.exe
  C:\Windows\System\KVEyBsy.exe
  2⤵
  PID:2648
- C:\Windows\System\mLnncVg.exe
  C:\Windows\System\mLnncVg.exe
  2⤵
  PID:2856
- C:\Windows\System\auHBqoE.exe
  C:\Windows\System\auHBqoE.exe
  2⤵
  PID:3044
- C:\Windows\System\OBWfXda.exe
  C:\Windows\System\OBWfXda.exe
  2⤵
  PID:1988
- C:\Windows\System\iIMwnCT.exe
  C:\Windows\System\iIMwnCT.exe
  2⤵
  PID:2112
- C:\Windows\System\kVANStB.exe
  C:\Windows\System\kVANStB.exe
  2⤵
  PID:1588
- C:\Windows\System\McfiyqF.exe
  C:\Windows\System\McfiyqF.exe
  2⤵
  PID:1128
- C:\Windows\System\VNOynHX.exe
  C:\Windows\System\VNOynHX.exe
  2⤵
  PID:2452
- C:\Windows\System\qCYBshN.exe
  C:\Windows\System\qCYBshN.exe
  2⤵
  PID:1764
- C:\Windows\System\qFeUMTC.exe
  C:\Windows\System\qFeUMTC.exe
  2⤵
  PID:636
- C:\Windows\System\YVIwumX.exe
  C:\Windows\System\YVIwumX.exe
  2⤵
  PID:1996
- C:\Windows\System\qEBvhOx.exe
  C:\Windows\System\qEBvhOx.exe
  2⤵
  PID:2088
- C:\Windows\System\EcNPBqy.exe
  C:\Windows\System\EcNPBqy.exe
  2⤵
  PID:1548
- C:\Windows\System\qibTQEx.exe
  C:\Windows\System\qibTQEx.exe
  2⤵
  PID:2604
- C:\Windows\System\SqyBEon.exe
  C:\Windows\System\SqyBEon.exe
  2⤵
  PID:1512
- C:\Windows\System\RcYeNgp.exe
  C:\Windows\System\RcYeNgp.exe
  2⤵
  PID:992
- C:\Windows\System\qiFykAT.exe
  C:\Windows\System\qiFykAT.exe
  2⤵
  PID:1264
- C:\Windows\System\YKeZxZX.exe
  C:\Windows\System\YKeZxZX.exe
  2⤵
  PID:2996
- C:\Windows\System\PKKxnHG.exe
  C:\Windows\System\PKKxnHG.exe
  2⤵
  PID:1772
- C:\Windows\System\wwIuLuv.exe
  C:\Windows\System\wwIuLuv.exe
  2⤵
  PID:2456
- C:\Windows\System\knejDgY.exe
  C:\Windows\System\knejDgY.exe
  2⤵
  PID:1880
- C:\Windows\System\YPBSqSd.exe
  C:\Windows\System\YPBSqSd.exe
  2⤵
  PID:1580
- C:\Windows\System\DIguQyA.exe
  C:\Windows\System\DIguQyA.exe
  2⤵
  PID:2132
- C:\Windows\System\xGGgXxD.exe
  C:\Windows\System\xGGgXxD.exe
  2⤵
  PID:2924
- C:\Windows\System\HxQBKsj.exe
  C:\Windows\System\HxQBKsj.exe
  2⤵
  PID:2936
- C:\Windows\System\gRMHtTI.exe
  C:\Windows\System\gRMHtTI.exe
  2⤵
  PID:2944
- C:\Windows\System\DDiRwwS.exe
  C:\Windows\System\DDiRwwS.exe
  2⤵
  PID:3040
- C:\Windows\System\TNlJOAI.exe
  C:\Windows\System\TNlJOAI.exe
  2⤵
  PID:2188
- C:\Windows\System\cSRdYoa.exe
  C:\Windows\System\cSRdYoa.exe
  2⤵
  PID:2440
- C:\Windows\System\pfeuRxQ.exe
  C:\Windows\System\pfeuRxQ.exe
  2⤵
  PID:2872
- C:\Windows\System\BZJprHn.exe
  C:\Windows\System\BZJprHn.exe
  2⤵
  PID:2880
- C:\Windows\System\pNlCtpE.exe
  C:\Windows\System\pNlCtpE.exe
  2⤵
  PID:304
- C:\Windows\System\VRaFkSx.exe
  C:\Windows\System\VRaFkSx.exe
  2⤵
  PID:2876
- C:\Windows\System\oCQEIEk.exe
  C:\Windows\System\oCQEIEk.exe
  2⤵
  PID:1400
- C:\Windows\System\QhLRdqV.exe
  C:\Windows\System\QhLRdqV.exe
  2⤵
  PID:2572
- C:\Windows\System\bowGerF.exe
  C:\Windows\System\bowGerF.exe
  2⤵
  PID:2084
- C:\Windows\System\yVqsNLu.exe
  C:\Windows\System\yVqsNLu.exe
  2⤵
  PID:880
- C:\Windows\System\uReLdkk.exe
  C:\Windows\System\uReLdkk.exe
  2⤵
  PID:2320
- C:\Windows\System\CRAFZxJ.exe
  C:\Windows\System\CRAFZxJ.exe
  2⤵
  PID:1084
- C:\Windows\System\XCHryZe.exe
  C:\Windows\System\XCHryZe.exe
  2⤵
  PID:2280
- C:\Windows\System\VSCkvBe.exe
  C:\Windows\System\VSCkvBe.exe
  2⤵
  PID:764
- C:\Windows\System\zdYPLge.exe
  C:\Windows\System\zdYPLge.exe
  2⤵
  PID:1940
- C:\Windows\System\FuPapJC.exe
  C:\Windows\System\FuPapJC.exe
  2⤵
  PID:2532
- C:\Windows\System\uISBAuF.exe
  C:\Windows\System\uISBAuF.exe
  2⤵
  PID:1520
- C:\Windows\System\DVlLDZj.exe
  C:\Windows\System\DVlLDZj.exe
  2⤵
  PID:1304
- C:\Windows\System\cTHWJiE.exe
  C:\Windows\System\cTHWJiE.exe
  2⤵
  PID:1608
- C:\Windows\System\LtckPMB.exe
  C:\Windows\System\LtckPMB.exe
  2⤵
  PID:2080
- C:\Windows\System\HrzSrkG.exe
  C:\Windows\System\HrzSrkG.exe
  2⤵
  PID:2832
- C:\Windows\System\hcXgrtq.exe
  C:\Windows\System\hcXgrtq.exe
  2⤵
  PID:2172
- C:\Windows\System\MtCqtdZ.exe
  C:\Windows\System\MtCqtdZ.exe
  2⤵
  PID:2684
- C:\Windows\System\MtJgDYN.exe
  C:\Windows\System\MtJgDYN.exe
  2⤵
  PID:2720
- C:\Windows\System\ZosKnQT.exe
  C:\Windows\System\ZosKnQT.exe
  2⤵
  PID:3020
- C:\Windows\System\BkFwfzw.exe
  C:\Windows\System\BkFwfzw.exe
  2⤵
  PID:2412
- C:\Windows\System\EPcIdzc.exe
  C:\Windows\System\EPcIdzc.exe
  2⤵
  PID:2124
- C:\Windows\System\optknXH.exe
  C:\Windows\System\optknXH.exe
  2⤵
  PID:2432
- C:\Windows\System\sPxykpz.exe
  C:\Windows\System\sPxykpz.exe
  2⤵
  PID:1276
- C:\Windows\System\eNYOixE.exe
  C:\Windows\System\eNYOixE.exe
  2⤵
  PID:1244
- C:\Windows\System\FJwBUKn.exe
  C:\Windows\System\FJwBUKn.exe
  2⤵
  PID:2308
- C:\Windows\System\vlYoIUg.exe
  C:\Windows\System\vlYoIUg.exe
  2⤵
  PID:2232
- C:\Windows\System\uqTvYbg.exe
  C:\Windows\System\uqTvYbg.exe
  2⤵
  PID:1516
- C:\Windows\System\mJhCnoC.exe
  C:\Windows\System\mJhCnoC.exe
  2⤵
  PID:1604
- C:\Windows\System\kdFZwOp.exe
  C:\Windows\System\kdFZwOp.exe
  2⤵
  PID:1684
- C:\Windows\System\HMZnzUu.exe
  C:\Windows\System\HMZnzUu.exe
  2⤵
  PID:584
- C:\Windows\System\GNCeDDz.exe
  C:\Windows\System\GNCeDDz.exe
  2⤵
  PID:2672
- C:\Windows\System\suHIIyZ.exe
  C:\Windows\System\suHIIyZ.exe
  2⤵
  PID:2396
- C:\Windows\System\cnnqlqJ.exe
  C:\Windows\System\cnnqlqJ.exe
  2⤵
  PID:2972
- C:\Windows\System\wdFykxh.exe
  C:\Windows\System\wdFykxh.exe
  2⤵
  PID:2916
- C:\Windows\System\fQFwmdu.exe
  C:\Windows\System\fQFwmdu.exe
  2⤵
  PID:2860
- C:\Windows\System\OQIPTsc.exe
  C:\Windows\System\OQIPTsc.exe
  2⤵
  PID:3008
- C:\Windows\System\VgDRUwc.exe
  C:\Windows\System\VgDRUwc.exe
  2⤵
  PID:2632
- C:\Windows\System\cngtlXb.exe
  C:\Windows\System\cngtlXb.exe
  2⤵
  PID:2268
- C:\Windows\System\uwyxEOS.exe
  C:\Windows\System\uwyxEOS.exe
  2⤵
  PID:340
- C:\Windows\System\RoMYhYR.exe
  C:\Windows\System\RoMYhYR.exe
  2⤵
  PID:1944
- C:\Windows\System\MQYQHjE.exe
  C:\Windows\System\MQYQHjE.exe
  2⤵
  PID:1968
- C:\Windows\System\CrbMMpZ.exe
  C:\Windows\System\CrbMMpZ.exe
  2⤵
  PID:580
- C:\Windows\System\vrdfOWE.exe
  C:\Windows\System\vrdfOWE.exe
  2⤵
  PID:2800
- C:\Windows\System\VntKAIa.exe
  C:\Windows\System\VntKAIa.exe
  2⤵
  PID:2728
- C:\Windows\System\iYtqvWP.exe
  C:\Windows\System\iYtqvWP.exe
  2⤵
  PID:2576
- C:\Windows\System\DsMHCVd.exe
  C:\Windows\System\DsMHCVd.exe
  2⤵
  PID:552
- C:\Windows\System\idOxcKK.exe
  C:\Windows\System\idOxcKK.exe
  2⤵
  PID:3012
- C:\Windows\System\BRUhSNt.exe
  C:\Windows\System\BRUhSNt.exe
  2⤵
  PID:3056
- C:\Windows\System\BFlWgRF.exe
  C:\Windows\System\BFlWgRF.exe
  2⤵
  PID:972
- C:\Windows\System\tOshcwq.exe
  C:\Windows\System\tOshcwq.exe
  2⤵
  PID:2108
- C:\Windows\System\ivRBOuf.exe
  C:\Windows\System\ivRBOuf.exe
  2⤵
  PID:2168
- C:\Windows\System\YvOhiHI.exe
  C:\Windows\System\YvOhiHI.exe
  2⤵
  PID:2176
- C:\Windows\System\ECbaheW.exe
  C:\Windows\System\ECbaheW.exe
  2⤵
  PID:2700
- C:\Windows\System\emMMRsj.exe
  C:\Windows\System\emMMRsj.exe
  2⤵
  PID:588
- C:\Windows\System\uYCGasF.exe
  C:\Windows\System\uYCGasF.exe
  2⤵
  PID:2180
- C:\Windows\System\veWKLnf.exe
  C:\Windows\System\veWKLnf.exe
  2⤵
  PID:1544
- C:\Windows\System\GRSzPPm.exe
  C:\Windows\System\GRSzPPm.exe
  2⤵
  PID:3084
- C:\Windows\System\MghMsfi.exe
  C:\Windows\System\MghMsfi.exe
  2⤵
  PID:3104
- C:\Windows\System\kSNSZTH.exe
  C:\Windows\System\kSNSZTH.exe
  2⤵
  PID:3120
- C:\Windows\System\eCCMbTC.exe
  C:\Windows\System\eCCMbTC.exe
  2⤵
  PID:3252
- C:\Windows\System\QKEGWVA.exe
  C:\Windows\System\QKEGWVA.exe
  2⤵
  PID:3588
- C:\Windows\System\xWquJYt.exe
  C:\Windows\System\xWquJYt.exe
  2⤵
  PID:3608
- C:\Windows\System\ZKCwZvL.exe
  C:\Windows\System\ZKCwZvL.exe
  2⤵
  PID:3628
- C:\Windows\System\GMgsXbA.exe
  C:\Windows\System\GMgsXbA.exe
  2⤵
  PID:3644
- C:\Windows\System\aGcOrKj.exe
  C:\Windows\System\aGcOrKj.exe
  2⤵
  PID:3660
- C:\Windows\System\BuIuSly.exe
  C:\Windows\System\BuIuSly.exe
  2⤵
  PID:3684
- C:\Windows\System\xUlNgtM.exe
  C:\Windows\System\xUlNgtM.exe
  2⤵
  PID:3704
- C:\Windows\System\YfUHoRb.exe
  C:\Windows\System\YfUHoRb.exe
  2⤵
  PID:3720
- C:\Windows\System\ujBpsfE.exe
  C:\Windows\System\ujBpsfE.exe
  2⤵
  PID:3952
- C:\Windows\System\RiUmgOn.exe
  C:\Windows\System\RiUmgOn.exe
  2⤵
  PID:3968
- C:\Windows\System\CCOiyzl.exe
  C:\Windows\System\CCOiyzl.exe
  2⤵
  PID:3984
- C:\Windows\System\lggdKeM.exe
  C:\Windows\System\lggdKeM.exe
  2⤵
  PID:4000
- C:\Windows\System\XuEUBbh.exe
  C:\Windows\System\XuEUBbh.exe
  2⤵
  PID:4020
- C:\Windows\System\vEPRduG.exe
  C:\Windows\System\vEPRduG.exe
  2⤵
  PID:4036
- C:\Windows\System\iKhuQuN.exe
  C:\Windows\System\iKhuQuN.exe
  2⤵
  PID:4052
- C:\Windows\System\AcFNwTZ.exe
  C:\Windows\System\AcFNwTZ.exe
  2⤵
  PID:4072
- C:\Windows\System\VNWNOGg.exe
  C:\Windows\System\VNWNOGg.exe
  2⤵
  PID:4088
- C:\Windows\System\WgYxzXy.exe
  C:\Windows\System\WgYxzXy.exe
  2⤵
  PID:1356
- C:\Windows\System\lMmvPDd.exe
  C:\Windows\System\lMmvPDd.exe
  2⤵
  PID:484
- C:\Windows\System\aOTxxxh.exe
  C:\Windows\System\aOTxxxh.exe
  2⤵
  PID:320
- C:\Windows\System\REJWBal.exe
  C:\Windows\System\REJWBal.exe
  2⤵
  PID:2744
- C:\Windows\System\hWGAOcV.exe
  C:\Windows\System\hWGAOcV.exe
  2⤵
  PID:3076
- C:\Windows\System\svXMwGK.exe
  C:\Windows\System\svXMwGK.exe
  2⤵
  PID:3260
- C:\Windows\System\jmwTZQw.exe
  C:\Windows\System\jmwTZQw.exe
  2⤵
  PID:3596
- C:\Windows\System\XlhtIWF.exe
  C:\Windows\System\XlhtIWF.exe
  2⤵
  PID:2716
- C:\Windows\System\pztwDte.exe
  C:\Windows\System\pztwDte.exe
  2⤵
  PID:3656
- C:\Windows\System\rofvSLx.exe
  C:\Windows\System\rofvSLx.exe
  2⤵
  PID:3752
- C:\Windows\System\LvLCpKX.exe
  C:\Windows\System\LvLCpKX.exe
  2⤵
  PID:3976
- C:\Windows\System\NyRwluY.exe
  C:\Windows\System\NyRwluY.exe
  2⤵
  PID:3944
- C:\Windows\System\LxblxoZ.exe
  C:\Windows\System\LxblxoZ.exe
  2⤵
  PID:4104
- C:\Windows\System\OiLaQpz.exe
  C:\Windows\System\OiLaQpz.exe
  2⤵
  PID:4120
- C:\Windows\System\cMGHXUH.exe
  C:\Windows\System\cMGHXUH.exe
  2⤵
  PID:4136
- C:\Windows\System\VxkEvXj.exe
  C:\Windows\System\VxkEvXj.exe
  2⤵
  PID:4256
- C:\Windows\System\Livnbfj.exe
  C:\Windows\System\Livnbfj.exe
  2⤵
  PID:4272
- C:\Windows\System\ndoiQND.exe
  C:\Windows\System\ndoiQND.exe
  2⤵
  PID:4288
- C:\Windows\System\UEFVXHO.exe
  C:\Windows\System\UEFVXHO.exe
  2⤵
  PID:4304
- C:\Windows\System\GnLOdMe.exe
  C:\Windows\System\GnLOdMe.exe
  2⤵
  PID:4320
- C:\Windows\System\WYgPEry.exe
  C:\Windows\System\WYgPEry.exe
  2⤵
  PID:4336
- C:\Windows\System\KgwqmtP.exe
  C:\Windows\System\KgwqmtP.exe
  2⤵
  PID:4352
- C:\Windows\System\NIdSxUQ.exe
  C:\Windows\System\NIdSxUQ.exe
  2⤵
  PID:4368
- C:\Windows\System\YFVAzSF.exe
  C:\Windows\System\YFVAzSF.exe
  2⤵
  PID:4384
- C:\Windows\System\KHYrVzp.exe
  C:\Windows\System\KHYrVzp.exe
  2⤵
  PID:4400
- C:\Windows\System\TmfbnyY.exe
  C:\Windows\System\TmfbnyY.exe
  2⤵
  PID:4416
- C:\Windows\System\GDURaLS.exe
  C:\Windows\System\GDURaLS.exe
  2⤵
  PID:4432
- C:\Windows\System\yfjVBlS.exe
  C:\Windows\System\yfjVBlS.exe
  2⤵
  PID:4448
- C:\Windows\System\jUXWAue.exe
  C:\Windows\System\jUXWAue.exe
  2⤵
  PID:4464
- C:\Windows\System\GALNOVp.exe
  C:\Windows\System\GALNOVp.exe
  2⤵
  PID:4480
- C:\Windows\System\ThWOZzO.exe
  C:\Windows\System\ThWOZzO.exe
  2⤵
  PID:4496
- C:\Windows\System\oXCHqfW.exe
  C:\Windows\System\oXCHqfW.exe
  2⤵
  PID:4512
- C:\Windows\System\DAioUtU.exe
  C:\Windows\System\DAioUtU.exe
  2⤵
  PID:4528
- C:\Windows\System\PXaRMea.exe
  C:\Windows\System\PXaRMea.exe
  2⤵
  PID:4544
- C:\Windows\System\pCjzARR.exe
  C:\Windows\System\pCjzARR.exe
  2⤵
  PID:4812
- C:\Windows\System\yfxUVPP.exe
  C:\Windows\System\yfxUVPP.exe
  2⤵
  PID:4828
- C:\Windows\System\bFLeeXm.exe
  C:\Windows\System\bFLeeXm.exe
  2⤵
  PID:4844
- C:\Windows\System\jHBShFA.exe
  C:\Windows\System\jHBShFA.exe
  2⤵
  PID:4860
- C:\Windows\System\LHjAznH.exe
  C:\Windows\System\LHjAznH.exe
  2⤵
  PID:4876
- C:\Windows\System\lvsJRJz.exe
  C:\Windows\System\lvsJRJz.exe
  2⤵
  PID:4892
- C:\Windows\System\qLfqtOq.exe
  C:\Windows\System\qLfqtOq.exe
  2⤵
  PID:4912
- C:\Windows\System\zqnMsBK.exe
  C:\Windows\System\zqnMsBK.exe
  2⤵
  PID:4928
- C:\Windows\System\Wgfaweo.exe
  C:\Windows\System\Wgfaweo.exe
  2⤵
  PID:4944
- C:\Windows\System\VntqjSy.exe
  C:\Windows\System\VntqjSy.exe
  2⤵
  PID:4964
- C:\Windows\System\lokfGQB.exe
  C:\Windows\System\lokfGQB.exe
  2⤵
  PID:4980
- C:\Windows\System\QxQStuS.exe
  C:\Windows\System\QxQStuS.exe
  2⤵
  PID:4996
- C:\Windows\System\oRwEYzd.exe
  C:\Windows\System\oRwEYzd.exe
  2⤵
  PID:5012
- C:\Windows\System\KjtALUd.exe
  C:\Windows\System\KjtALUd.exe
  2⤵
  PID:5028
- C:\Windows\System\ONtlXwB.exe
  C:\Windows\System\ONtlXwB.exe
  2⤵
  PID:5048
- C:\Windows\System\GWRxjGN.exe
  C:\Windows\System\GWRxjGN.exe
  2⤵
  PID:5064
- C:\Windows\System\VliWOEu.exe
  C:\Windows\System\VliWOEu.exe
  2⤵
  PID:5080
- C:\Windows\System\QGxcrJJ.exe
  C:\Windows\System\QGxcrJJ.exe
  2⤵
  PID:5096
- C:\Windows\System\RflERLy.exe
  C:\Windows\System\RflERLy.exe
  2⤵
  PID:5112
- C:\Windows\System\lJVPJmj.exe
  C:\Windows\System\lJVPJmj.exe
  2⤵
  PID:3980
- C:\Windows\System\xoAnhUX.exe
  C:\Windows\System\xoAnhUX.exe
  2⤵
  PID:4048
- C:\Windows\System\kObOuBR.exe
  C:\Windows\System\kObOuBR.exe
  2⤵
  PID:1652
- C:\Windows\System\GpwJjHG.exe
  C:\Windows\System\GpwJjHG.exe
  2⤵
  PID:2772
- C:\Windows\System\RCBFkSn.exe
  C:\Windows\System\RCBFkSn.exe
  2⤵
  PID:2468
- C:\Windows\System\LUAmtyD.exe
  C:\Windows\System\LUAmtyD.exe
  2⤵
  PID:3744
- C:\Windows\System\UHFhijm.exe
  C:\Windows\System\UHFhijm.exe
  2⤵
  PID:4144
- C:\Windows\System\MNEJuLV.exe
  C:\Windows\System\MNEJuLV.exe
  2⤵
  PID:2680
- C:\Windows\System\UhHmxBh.exe
  C:\Windows\System\UhHmxBh.exe
  2⤵
  PID:2736
- C:\Windows\System\dWzvOPq.exe
  C:\Windows\System\dWzvOPq.exe
  2⤵
  PID:4148
- C:\Windows\System\Yqhyeth.exe
  C:\Windows\System\Yqhyeth.exe
  2⤵
  PID:3668
- C:\Windows\System\PszeDNM.exe
  C:\Windows\System\PszeDNM.exe
  2⤵
  PID:3960
- C:\Windows\System\ilyRgwO.exe
  C:\Windows\System\ilyRgwO.exe
  2⤵
  PID:4280
- C:\Windows\System\mlRIrBh.exe
  C:\Windows\System\mlRIrBh.exe
  2⤵
  PID:4344
- C:\Windows\System\iaZCrYV.exe
  C:\Windows\System\iaZCrYV.exe
  2⤵
  PID:4408
- C:\Windows\System\JfYRMWo.exe
  C:\Windows\System\JfYRMWo.exe
  2⤵
  PID:4472
- C:\Windows\System\eQAdmTq.exe
  C:\Windows\System\eQAdmTq.exe
  2⤵
  PID:4536
- C:\Windows\System\wUgOgYO.exe
  C:\Windows\System\wUgOgYO.exe
  2⤵
  PID:4460
- C:\Windows\System\DdGpfZA.exe
  C:\Windows\System\DdGpfZA.exe
  2⤵
  PID:4580
- C:\Windows\System\ROPabbL.exe
  C:\Windows\System\ROPabbL.exe
  2⤵
  PID:4592
- C:\Windows\System\KIDqPHC.exe
  C:\Windows\System\KIDqPHC.exe
  2⤵
  PID:5132
- C:\Windows\System\bmaxUiv.exe
  C:\Windows\System\bmaxUiv.exe
  2⤵
  PID:5148
- C:\Windows\System\tirJgfQ.exe
  C:\Windows\System\tirJgfQ.exe
  2⤵
  PID:5168
- C:\Windows\System\QxkfgBq.exe
  C:\Windows\System\QxkfgBq.exe
  2⤵
  PID:5184
- C:\Windows\System\lYdjMkQ.exe
  C:\Windows\System\lYdjMkQ.exe
  2⤵
  PID:5200
- C:\Windows\System\qwlKFJc.exe
  C:\Windows\System\qwlKFJc.exe
  2⤵
  PID:5216
- C:\Windows\System\UXruCkX.exe
  C:\Windows\System\UXruCkX.exe
  2⤵
  PID:5232
- C:\Windows\System\BaEGvZJ.exe
  C:\Windows\System\BaEGvZJ.exe
  2⤵
  PID:5252
- C:\Windows\System\XxUazZn.exe
  C:\Windows\System\XxUazZn.exe
  2⤵
  PID:5268
- C:\Windows\System\CUrsGAn.exe
  C:\Windows\System\CUrsGAn.exe
  2⤵
  PID:5284
- C:\Windows\System\MmZHHcZ.exe
  C:\Windows\System\MmZHHcZ.exe
  2⤵
  PID:5300
- C:\Windows\System\VrgZmAt.exe
  C:\Windows\System\VrgZmAt.exe
  2⤵
  PID:5316
- C:\Windows\System\retYpcJ.exe
  C:\Windows\System\retYpcJ.exe
  2⤵
  PID:5332
- C:\Windows\System\xQryGCD.exe
  C:\Windows\System\xQryGCD.exe
  2⤵
  PID:5352
- C:\Windows\System\JDCyxUS.exe
  C:\Windows\System\JDCyxUS.exe
  2⤵
  PID:5368
- C:\Windows\System\qVgbQkV.exe
  C:\Windows\System\qVgbQkV.exe
  2⤵
  PID:5384
- C:\Windows\System\xINzMYO.exe
  C:\Windows\System\xINzMYO.exe
  2⤵
  PID:5400
- C:\Windows\System\NAmYsZk.exe
  C:\Windows\System\NAmYsZk.exe
  2⤵
  PID:5420
- C:\Windows\System\UKDnkZn.exe
  C:\Windows\System\UKDnkZn.exe
  2⤵
  PID:5436
- C:\Windows\System\VFFgPxm.exe
  C:\Windows\System\VFFgPxm.exe
  2⤵
  PID:5452
- C:\Windows\System\DyhCzhm.exe
  C:\Windows\System\DyhCzhm.exe
  2⤵
  PID:5468
- C:\Windows\System\ovIPBIM.exe
  C:\Windows\System\ovIPBIM.exe
  2⤵
  PID:5484
- C:\Windows\System\AcHEUoi.exe
  C:\Windows\System\AcHEUoi.exe
  2⤵
  PID:5504
- C:\Windows\System\xtvzyGR.exe
  C:\Windows\System\xtvzyGR.exe
  2⤵
  PID:5520
- C:\Windows\System\lIGFrTB.exe
  C:\Windows\System\lIGFrTB.exe
  2⤵
  PID:5536
- C:\Windows\System\EctYapa.exe
  C:\Windows\System\EctYapa.exe
  2⤵
  PID:5552
- C:\Windows\System\bxmLYWE.exe
  C:\Windows\System\bxmLYWE.exe
  2⤵
  PID:5568
- C:\Windows\System\aojDfgM.exe
  C:\Windows\System\aojDfgM.exe
  2⤵
  PID:5584
- C:\Windows\System\SIkmJED.exe
  C:\Windows\System\SIkmJED.exe
  2⤵
  PID:5600
- C:\Windows\System\fWSXhiJ.exe
  C:\Windows\System\fWSXhiJ.exe
  2⤵
  PID:5616
- C:\Windows\System\JxoWkgO.exe
  C:\Windows\System\JxoWkgO.exe
  2⤵
  PID:5640
- C:\Windows\System\txdGxbj.exe
  C:\Windows\System\txdGxbj.exe
  2⤵
  PID:5656
- C:\Windows\System\okmSfQS.exe
  C:\Windows\System\okmSfQS.exe
  2⤵
  PID:5672
- C:\Windows\System\zUDYKEO.exe
  C:\Windows\System\zUDYKEO.exe
  2⤵
  PID:5692
- C:\Windows\System\bupXoSi.exe
  C:\Windows\System\bupXoSi.exe
  2⤵
  PID:5708
- C:\Windows\System\VoNrqKb.exe
  C:\Windows\System\VoNrqKb.exe
  2⤵
  PID:5724
- C:\Windows\System\tpuhhsP.exe
  C:\Windows\System\tpuhhsP.exe
  2⤵
  PID:5740
- C:\Windows\System\rcQcupz.exe
  C:\Windows\System\rcQcupz.exe
  2⤵
  PID:5760
- C:\Windows\System\CNxFDPU.exe
  C:\Windows\System\CNxFDPU.exe
  2⤵
  PID:5776
- C:\Windows\System\tqkzNEN.exe
  C:\Windows\System\tqkzNEN.exe
  2⤵
  PID:5792
- C:\Windows\System\CiAIMHR.exe
  C:\Windows\System\CiAIMHR.exe
  2⤵
  PID:5812
- C:\Windows\System\rAzaRBQ.exe
  C:\Windows\System\rAzaRBQ.exe
  2⤵
  PID:5896
- C:\Windows\System\edPfyqy.exe
  C:\Windows\System\edPfyqy.exe
  2⤵
  PID:5912
- C:\Windows\System\yEUaCiV.exe
  C:\Windows\System\yEUaCiV.exe
  2⤵
  PID:5928
- C:\Windows\System\LAgAarY.exe
  C:\Windows\System\LAgAarY.exe
  2⤵
  PID:5944
- C:\Windows\System\XmFfwMJ.exe
  C:\Windows\System\XmFfwMJ.exe
  2⤵
  PID:5960
- C:\Windows\System\srkQJDI.exe
  C:\Windows\System\srkQJDI.exe
  2⤵
  PID:5976
- C:\Windows\System\OCPHXPG.exe
  C:\Windows\System\OCPHXPG.exe
  2⤵
  PID:5992
- C:\Windows\System\xCWZMvA.exe
  C:\Windows\System\xCWZMvA.exe
  2⤵
  PID:2156
- C:\Windows\System\XxcRBSA.exe
  C:\Windows\System\XxcRBSA.exe
  2⤵
  PID:4068
- C:\Windows\System\QnYGcWq.exe
  C:\Windows\System\QnYGcWq.exe
  2⤵
  PID:1620
- C:\Windows\System\WeStObP.exe
  C:\Windows\System\WeStObP.exe
  2⤵
  PID:4756
- C:\Windows\System\MCcMGEY.exe
  C:\Windows\System\MCcMGEY.exe
  2⤵
  PID:4568
- C:\Windows\System\DUNymoe.exe
  C:\Windows\System\DUNymoe.exe
  2⤵
  PID:4268
- C:\Windows\System\enTJnUU.exe
  C:\Windows\System\enTJnUU.exe
  2⤵
  PID:5192
- C:\Windows\System\FCaEfLr.exe
  C:\Windows\System\FCaEfLr.exe
  2⤵
  PID:5228
- C:\Windows\System\DKzkcmb.exe
  C:\Windows\System\DKzkcmb.exe
  2⤵
  PID:4328
- C:\Windows\System\cWzfVZL.exe
  C:\Windows\System\cWzfVZL.exe
  2⤵
  PID:4772
- C:\Windows\System\bUffsRb.exe
  C:\Windows\System\bUffsRb.exe
  2⤵
  PID:4396
- C:\Windows\System\yDyvjBC.exe
  C:\Windows\System\yDyvjBC.exe
  2⤵
  PID:4792
- C:\Windows\System\iuxYPwT.exe
  C:\Windows\System\iuxYPwT.exe
  2⤵
  PID:4804
- C:\Windows\System\ihRlOho.exe
  C:\Windows\System\ihRlOho.exe
  2⤵
  PID:5328
- C:\Windows\System\KaiQfYn.exe
  C:\Windows\System\KaiQfYn.exe
  2⤵
  PID:4976
- C:\Windows\System\bbhAIUY.exe
  C:\Windows\System\bbhAIUY.exe
  2⤵
  PID:5072
- C:\Windows\System\JbINqYh.exe
  C:\Windows\System\JbINqYh.exe
  2⤵
  PID:4952
- C:\Windows\System\NXjPQWD.exe
  C:\Windows\System\NXjPQWD.exe
  2⤵
  PID:5464
- C:\Windows\System\OWaqhCn.exe
  C:\Windows\System\OWaqhCn.exe
  2⤵
  PID:2656
- C:\Windows\System\dFxJNUu.exe
  C:\Windows\System\dFxJNUu.exe
  2⤵
  PID:5020
- C:\Windows\System\trHfTuZ.exe
  C:\Windows\System\trHfTuZ.exe
  2⤵
  PID:4252
- C:\Windows\System\tOVgVQE.exe
  C:\Windows\System\tOVgVQE.exe
  2⤵
  PID:4084
- C:\Windows\System\EyJSEJE.exe
  C:\Windows\System\EyJSEJE.exe
  2⤵
  PID:2664
- C:\Windows\System\tIdXPLV.exe
  C:\Windows\System\tIdXPLV.exe
  2⤵
  PID:2732
- C:\Windows\System\wdIrUXd.exe
  C:\Windows\System\wdIrUXd.exe
  2⤵
  PID:3996
- C:\Windows\System\aZDJOQu.exe
  C:\Windows\System\aZDJOQu.exe
  2⤵
  PID:5460
- C:\Windows\System\ClwgTCb.exe
  C:\Windows\System\ClwgTCb.exe
  2⤵
  PID:4440
- C:\Windows\System\wVxoyiE.exe
  C:\Windows\System\wVxoyiE.exe
  2⤵
  PID:4820
- C:\Windows\System\SWlMhPg.exe
  C:\Windows\System\SWlMhPg.exe
  2⤵
  PID:5804
- C:\Windows\System\lDSHsmR.exe
  C:\Windows\System\lDSHsmR.exe
  2⤵
  PID:5276
- C:\Windows\System\IaLCEiV.exe
  C:\Windows\System\IaLCEiV.exe
  2⤵
  PID:5340
- C:\Windows\System\hICSEcB.exe
  C:\Windows\System\hICSEcB.exe
  2⤵
  PID:5380
- C:\Windows\System\mtcPXUm.exe
  C:\Windows\System\mtcPXUm.exe
  2⤵
  PID:5476
- C:\Windows\System\aejbtfL.exe
  C:\Windows\System\aejbtfL.exe
  2⤵
  PID:5652
- C:\Windows\System\XgYtdOL.exe
  C:\Windows\System\XgYtdOL.exe
  2⤵
  PID:5832
- C:\Windows\System\XqfSERW.exe
  C:\Windows\System\XqfSERW.exe
  2⤵
  PID:5360
- C:\Windows\System\nxRtcwl.exe
  C:\Windows\System\nxRtcwl.exe
  2⤵
  PID:4840
- C:\Windows\System\CZjgeKG.exe
  C:\Windows\System\CZjgeKG.exe
  2⤵
  PID:5592
- C:\Windows\System\KnGzblT.exe
  C:\Windows\System\KnGzblT.exe
  2⤵
  PID:5564
- C:\Windows\System\RIEFZFO.exe
  C:\Windows\System\RIEFZFO.exe
  2⤵
  PID:5848
- C:\Windows\System\WwfqkWD.exe
  C:\Windows\System\WwfqkWD.exe
  2⤵
  PID:5864
- C:\Windows\System\xUyEAgU.exe
  C:\Windows\System\xUyEAgU.exe
  2⤵
  PID:5704
- C:\Windows\System\wTcuWrB.exe
  C:\Windows\System\wTcuWrB.exe
  2⤵
  PID:5528
- C:\Windows\System\NuhthSu.exe
  C:\Windows\System\NuhthSu.exe
  2⤵
  PID:5824
- C:\Windows\System\nPDttPy.exe
  C:\Windows\System\nPDttPy.exe
  2⤵
  PID:5548
- C:\Windows\System\HhZPuRi.exe
  C:\Windows\System\HhZPuRi.exe
  2⤵
  PID:5688
- C:\Windows\System\nBfyoei.exe
  C:\Windows\System\nBfyoei.exe
  2⤵
  PID:5480
- C:\Windows\System\qdvUusN.exe
  C:\Windows\System\qdvUusN.exe
  2⤵
  PID:5716
- C:\Windows\System\eJBBdMq.exe
  C:\Windows\System\eJBBdMq.exe
  2⤵
  PID:2140
- C:\Windows\System\yiKlThu.exe
  C:\Windows\System\yiKlThu.exe
  2⤵
  PID:5988
- C:\Windows\System\iEXEgHV.exe
  C:\Windows\System\iEXEgHV.exe
  2⤵
  PID:6024
- C:\Windows\System\qIPccdt.exe
  C:\Windows\System\qIPccdt.exe
  2⤵
  PID:5972
- C:\Windows\System\xrgmASZ.exe
  C:\Windows\System\xrgmASZ.exe
  2⤵
  PID:5984
- C:\Windows\System\hboeLhV.exe
  C:\Windows\System\hboeLhV.exe
  2⤵
  PID:6072
- C:\Windows\System\YFBpAmn.exe
  C:\Windows\System\YFBpAmn.exe
  2⤵
  PID:6108
- C:\Windows\System\KsaMAUL.exe
  C:\Windows\System\KsaMAUL.exe
  2⤵
  PID:6128
- C:\Windows\System\fylbaah.exe
  C:\Windows\System\fylbaah.exe
  2⤵
  PID:4748
- C:\Windows\System\WMvZgaz.exe
  C:\Windows\System\WMvZgaz.exe
  2⤵
  PID:3624
- C:\Windows\System\wHqvzJC.exe
  C:\Windows\System\wHqvzJC.exe
  2⤵
  PID:4716
- C:\Windows\System\TkEuOHP.exe
  C:\Windows\System\TkEuOHP.exe
  2⤵
  PID:4732
- C:\Windows\System\sJOrQzC.exe
  C:\Windows\System\sJOrQzC.exe
  2⤵
  PID:3940
- C:\Windows\System\dHjwyeH.exe
  C:\Windows\System\dHjwyeH.exe
  2⤵
  PID:4132
- C:\Windows\System\mprGfUz.exe
  C:\Windows\System\mprGfUz.exe
  2⤵
  PID:4264
- C:\Windows\System\ngFPSOX.exe
  C:\Windows\System\ngFPSOX.exe
  2⤵
  PID:4296
- C:\Windows\System\UdHlyeY.exe
  C:\Windows\System\UdHlyeY.exe
  2⤵
  PID:4800
- C:\Windows\System\eNvulqG.exe
  C:\Windows\System\eNvulqG.exe
  2⤵
  PID:4428
- C:\Windows\System\VvUBkmW.exe
  C:\Windows\System\VvUBkmW.exe
  2⤵
  PID:4808
- C:\Windows\System\wutSkwI.exe
  C:\Windows\System\wutSkwI.exe
  2⤵
  PID:4900
- C:\Windows\System\bwMZmrL.exe
  C:\Windows\System\bwMZmrL.exe
  2⤵
  PID:4936
- C:\Windows\System\AWBNBEd.exe
  C:\Windows\System\AWBNBEd.exe
  2⤵
  PID:5040
- C:\Windows\System\lTQTcvI.exe
  C:\Windows\System\lTQTcvI.exe
  2⤵
  PID:5104
- C:\Windows\System\GyoSjgH.exe
  C:\Windows\System\GyoSjgH.exe
  2⤵
  PID:4992
- C:\Windows\System\FLhrOKT.exe
  C:\Windows\System\FLhrOKT.exe
  2⤵
  PID:2512
- C:\Windows\System\kZjDgEq.exe
  C:\Windows\System\kZjDgEq.exe
  2⤵
  PID:3604
- C:\Windows\System\piFxiCt.exe
  C:\Windows\System\piFxiCt.exe
  2⤵
  PID:4508
- C:\Windows\System\rrPNBrn.exe
  C:\Windows\System\rrPNBrn.exe
  2⤵
  PID:4312
- C:\Windows\System\cCFyRcZ.exe
  C:\Windows\System\cCFyRcZ.exe
  2⤵
  PID:4456
- C:\Windows\System\oeTpyzh.exe
  C:\Windows\System\oeTpyzh.exe
  2⤵
  PID:5176
- C:\Windows\System\rtQRfOo.exe
  C:\Windows\System\rtQRfOo.exe
  2⤵
  PID:5312
- C:\Windows\System\baOYMwT.exe
  C:\Windows\System\baOYMwT.exe
  2⤵
  PID:5448
- C:\Windows\System\RyWAWLg.exe
  C:\Windows\System\RyWAWLg.exe
  2⤵
  PID:5392
- C:\Windows\System\JuoXwtx.exe
  C:\Windows\System\JuoXwtx.exe
  2⤵
  PID:5860
- C:\Windows\System\memLcCu.exe
  C:\Windows\System\memLcCu.exe
  2⤵
  PID:5648
- C:\Windows\System\CozgAxI.exe
  C:\Windows\System\CozgAxI.exe
  2⤵
  PID:5560
- C:\Windows\System\YIwSnLb.exe
  C:\Windows\System\YIwSnLb.exe
  2⤵
  PID:5840
- C:\Windows\System\gxykWse.exe
  C:\Windows\System\gxykWse.exe
  2⤵
  PID:5544
- C:\Windows\System\Hvyprqa.exe
  C:\Windows\System\Hvyprqa.exe
  2⤵
  PID:5952
- C:\Windows\System\EvsLrsd.exe
  C:\Windows\System\EvsLrsd.exe
  2⤵
  PID:6012
- C:\Windows\System\wUlEYCG.exe
  C:\Windows\System\wUlEYCG.exe
  2⤵
  PID:6092
- C:\Windows\System\Bciaphq.exe
  C:\Windows\System\Bciaphq.exe
  2⤵
  PID:2120
- C:\Windows\System\wEfmVFJ.exe
  C:\Windows\System\wEfmVFJ.exe
  2⤵
  PID:4060
- C:\Windows\System\fsXPBJK.exe
  C:\Windows\System\fsXPBJK.exe
  2⤵
  PID:2812
- C:\Windows\System\UjJKYxx.exe
  C:\Windows\System\UjJKYxx.exe
  2⤵
  PID:6064
- C:\Windows\System\UNKQhfb.exe
  C:\Windows\System\UNKQhfb.exe
  2⤵
  PID:6016
- C:\Windows\System\SsyxHvt.exe
  C:\Windows\System\SsyxHvt.exe
  2⤵
  PID:6032
- C:\Windows\System\BFYYvPD.exe
  C:\Windows\System\BFYYvPD.exe
  2⤵
  PID:4708
- C:\Windows\System\jGMIdtu.exe
  C:\Windows\System\jGMIdtu.exe
  2⤵
  PID:4728
- C:\Windows\System\aiwMLoz.exe
  C:\Windows\System\aiwMLoz.exe
  2⤵
  PID:1004
- C:\Windows\System\VpjDNVn.exe
  C:\Windows\System\VpjDNVn.exe
  2⤵
  PID:5164
- C:\Windows\System\tSnhLzU.exe
  C:\Windows\System\tSnhLzU.exe
  2⤵
  PID:4520
- C:\Windows\System\QqhrpON.exe
  C:\Windows\System\QqhrpON.exe
  2⤵
  PID:2324
- C:\Windows\System\jqvxWeC.exe
  C:\Windows\System\jqvxWeC.exe
  2⤵
  PID:5244
- C:\Windows\System\rzlMKyp.exe
  C:\Windows\System\rzlMKyp.exe
  2⤵
  PID:5248
- C:\Windows\System\fgfujQx.exe
  C:\Windows\System\fgfujQx.exe
  2⤵
  PID:1552
- C:\Windows\System\EViIHHZ.exe
  C:\Windows\System\EViIHHZ.exe
  2⤵
  PID:5904
- C:\Windows\System\sxCSTQf.exe
  C:\Windows\System\sxCSTQf.exe
  2⤵
  PID:5936
- C:\Windows\System\ZpPityo.exe
  C:\Windows\System\ZpPityo.exe
  2⤵
  PID:5412
- C:\Windows\System\QMMsuOi.exe
  C:\Windows\System\QMMsuOi.exe
  2⤵
  PID:5736
- C:\Windows\System\NIUKcBD.exe
  C:\Windows\System\NIUKcBD.exe
  2⤵
  PID:6008
- C:\Windows\System\HUSABDT.exe
  C:\Windows\System\HUSABDT.exe
  2⤵
  PID:4852
- C:\Windows\System\rDtdIUL.exe
  C:\Windows\System\rDtdIUL.exe
  2⤵
  PID:2360
- C:\Windows\System\RGvezVM.exe
  C:\Windows\System\RGvezVM.exe
  2⤵
  PID:2052
- C:\Windows\System\XuGVdtE.exe
  C:\Windows\System\XuGVdtE.exe
  2⤵
  PID:3080
- C:\Windows\System\LiplJjS.exe
  C:\Windows\System\LiplJjS.exe
  2⤵
  PID:3156
- C:\Windows\System\YdFunGX.exe
  C:\Windows\System\YdFunGX.exe
  2⤵
  PID:4364
- C:\Windows\System\IPqFZPl.exe
  C:\Windows\System\IPqFZPl.exe
  2⤵
  PID:4524
- C:\Windows\System\DfQegPM.exe
  C:\Windows\System\DfQegPM.exe
  2⤵
  PID:2660
- C:\Windows\System\ohaLmeN.exe
  C:\Windows\System\ohaLmeN.exe
  2⤵
  PID:5004
- C:\Windows\System\LXzXRNb.exe
  C:\Windows\System\LXzXRNb.exe
  2⤵
  PID:5044
- C:\Windows\System\CMTsuTW.exe
  C:\Windows\System\CMTsuTW.exe
  2⤵
  PID:2676
- C:\Windows\System\sxLbGiI.exe
  C:\Windows\System\sxLbGiI.exe
  2⤵
  PID:3712
- C:\Windows\System\oeaPkqE.exe
  C:\Windows\System\oeaPkqE.exe
  2⤵
  PID:5752
- C:\Windows\System\qOvjWlp.exe
  C:\Windows\System\qOvjWlp.exe
  2⤵
  PID:5144
- C:\Windows\System\zIlxPBd.exe
  C:\Windows\System\zIlxPBd.exe
  2⤵
  PID:5516
- C:\Windows\System\azrJqEx.exe
  C:\Windows\System\azrJqEx.exe
  2⤵
  PID:6020
- C:\Windows\System\zTCWpKk.exe
  C:\Windows\System\zTCWpKk.exe
  2⤵
  PID:4740
- C:\Windows\System\rBTuGhP.exe
  C:\Windows\System\rBTuGhP.exe
  2⤵
  PID:4752
- C:\Windows\System\jLaKyOB.exe
  C:\Windows\System\jLaKyOB.exe
  2⤵
  PID:4868
- C:\Windows\System\QUmCTWz.exe
  C:\Windows\System\QUmCTWz.exe
  2⤵
  PID:5664
- C:\Windows\System\qRVjsVI.exe
  C:\Windows\System\qRVjsVI.exe
  2⤵
  PID:4032
- C:\Windows\System\pflEbvV.exe
  C:\Windows\System\pflEbvV.exe
  2⤵
  PID:5820
- C:\Windows\System\qmVscXI.exe
  C:\Windows\System\qmVscXI.exe
  2⤵
  PID:2724
- C:\Windows\System\DIwpvhf.exe
  C:\Windows\System\DIwpvhf.exe
  2⤵
  PID:4780
- C:\Windows\System\uPmJdgT.exe
  C:\Windows\System\uPmJdgT.exe
  2⤵
  PID:5208
- C:\Windows\System\roBcRNg.exe
  C:\Windows\System\roBcRNg.exe
  2⤵
  PID:5800
- C:\Windows\System\lvxeANw.exe
  C:\Windows\System\lvxeANw.exe
  2⤵
  PID:5348
- C:\Windows\System\bXwvCMt.exe
  C:\Windows\System\bXwvCMt.exe
  2⤵
  PID:4872
- C:\Windows\System\qBfbKrR.exe
  C:\Windows\System\qBfbKrR.exe
  2⤵
  PID:5628
- C:\Windows\System\SbNbXCS.exe
  C:\Windows\System\SbNbXCS.exe
  2⤵
  PID:4836
- C:\Windows\System\QHgchdT.exe
  C:\Windows\System\QHgchdT.exe
  2⤵
  PID:6060
- C:\Windows\System\MYMvrcI.exe
  C:\Windows\System\MYMvrcI.exe
  2⤵
  PID:5008
- C:\Windows\System\OGuioTZ.exe
  C:\Windows\System\OGuioTZ.exe
  2⤵
  PID:5748
- C:\Windows\System\OmOFTgZ.exe
  C:\Windows\System\OmOFTgZ.exe
  2⤵
  PID:3060
- C:\Windows\System\FCWGdtO.exe
  C:\Windows\System\FCWGdtO.exe
  2⤵
  PID:3736
- C:\Windows\System\MhlYJvu.exe
  C:\Windows\System\MhlYJvu.exe
  2⤵
  PID:1656
- C:\Windows\System\naASvlB.exe
  C:\Windows\System\naASvlB.exe
  2⤵
  PID:6160
- C:\Windows\System\TOTJRIv.exe
  C:\Windows\System\TOTJRIv.exe
  2⤵
  PID:6176
- C:\Windows\System\nLPcmfu.exe
  C:\Windows\System\nLPcmfu.exe
  2⤵
  PID:6200
- C:\Windows\System\lHArMJD.exe
  C:\Windows\System\lHArMJD.exe
  2⤵
  PID:6216
- C:\Windows\System\KvMoDDo.exe
  C:\Windows\System\KvMoDDo.exe
  2⤵
  PID:6232
- C:\Windows\System\olqarOR.exe
  C:\Windows\System\olqarOR.exe
  2⤵
  PID:6248
- C:\Windows\System\BrHuYxH.exe
  C:\Windows\System\BrHuYxH.exe
  2⤵
  PID:6264
- C:\Windows\System\JjkuJfr.exe
  C:\Windows\System\JjkuJfr.exe
  2⤵
  PID:6284
- C:\Windows\System\iBFxRgP.exe
  C:\Windows\System\iBFxRgP.exe
  2⤵
  PID:6300
- C:\Windows\System\rKMMRma.exe
  C:\Windows\System\rKMMRma.exe
  2⤵
  PID:6316
- C:\Windows\System\FdfzNar.exe
  C:\Windows\System\FdfzNar.exe
  2⤵
  PID:6332
- C:\Windows\System\fukTkzC.exe
  C:\Windows\System\fukTkzC.exe
  2⤵
  PID:6400
- C:\Windows\System\VcgWHRA.exe
  C:\Windows\System\VcgWHRA.exe
  2⤵
  PID:6420
- C:\Windows\System\NnJSige.exe
  C:\Windows\System\NnJSige.exe
  2⤵
  PID:6436
- C:\Windows\System\sbZwDyy.exe
  C:\Windows\System\sbZwDyy.exe
  2⤵
  PID:6452
- C:\Windows\System\pTxtQQU.exe
  C:\Windows\System\pTxtQQU.exe
  2⤵
  PID:6508
- C:\Windows\System\jbLrFVt.exe
  C:\Windows\System\jbLrFVt.exe
  2⤵
  PID:6524
- C:\Windows\System\ArWeXtt.exe
  C:\Windows\System\ArWeXtt.exe
  2⤵
  PID:6540
- C:\Windows\System\TWIVgHm.exe
  C:\Windows\System\TWIVgHm.exe
  2⤵
  PID:6560
- C:\Windows\System\gBEgmJy.exe
  C:\Windows\System\gBEgmJy.exe
  2⤵
  PID:6584
- C:\Windows\System\hfZAbnO.exe
  C:\Windows\System\hfZAbnO.exe
  2⤵
  PID:6600
- C:\Windows\System\pprotGN.exe
  C:\Windows\System\pprotGN.exe
  2⤵
  PID:6616
- C:\Windows\System\HSZhSXB.exe
  C:\Windows\System\HSZhSXB.exe
  2⤵
  PID:6636
- C:\Windows\System\ulemMNF.exe
  C:\Windows\System\ulemMNF.exe
  2⤵
  PID:6652
- C:\Windows\System\dlhuOms.exe
  C:\Windows\System\dlhuOms.exe
  2⤵
  PID:6668
- C:\Windows\System\vGTjbeb.exe
  C:\Windows\System\vGTjbeb.exe
  2⤵
  PID:6688
- C:\Windows\System\DNDvhsm.exe
  C:\Windows\System\DNDvhsm.exe
  2⤵
  PID:6704
- C:\Windows\System\zaFuwbl.exe
  C:\Windows\System\zaFuwbl.exe
  2⤵
  PID:6720
- C:\Windows\System\rOkhXOu.exe
  C:\Windows\System\rOkhXOu.exe
  2⤵
  PID:6740
- C:\Windows\System\hmbewOq.exe
  C:\Windows\System\hmbewOq.exe
  2⤵
  PID:6756
- C:\Windows\System\OpPufFM.exe
  C:\Windows\System\OpPufFM.exe
  2⤵
  PID:6808
- C:\Windows\System\dbfGDVe.exe
  C:\Windows\System\dbfGDVe.exe
  2⤵
  PID:6824
- C:\Windows\System\ynSrrQI.exe
  C:\Windows\System\ynSrrQI.exe
  2⤵
  PID:6840
- C:\Windows\System\vHBovrY.exe
  C:\Windows\System\vHBovrY.exe
  2⤵
  PID:6856
- C:\Windows\System\ZGWbrSU.exe
  C:\Windows\System\ZGWbrSU.exe
  2⤵
  PID:6872
- C:\Windows\System\fwgwdko.exe
  C:\Windows\System\fwgwdko.exe
  2⤵
  PID:6892
- C:\Windows\System\bTgSbFR.exe
  C:\Windows\System\bTgSbFR.exe
  2⤵
  PID:6908
- C:\Windows\System\uyBALqN.exe
  C:\Windows\System\uyBALqN.exe
  2⤵
  PID:6924
- C:\Windows\System\YdXaNKe.exe
  C:\Windows\System\YdXaNKe.exe
  2⤵
  PID:6940
- C:\Windows\System\pYaLRfv.exe
  C:\Windows\System\pYaLRfv.exe
  2⤵
  PID:6980
- C:\Windows\System\nponbJF.exe
  C:\Windows\System\nponbJF.exe
  2⤵
  PID:7000
- C:\Windows\System\hYUbcSr.exe
  C:\Windows\System\hYUbcSr.exe
  2⤵
  PID:7016
- C:\Windows\System\FHHyzNi.exe
  C:\Windows\System\FHHyzNi.exe
  2⤵
  PID:7032
- C:\Windows\System\HqDxEzp.exe
  C:\Windows\System\HqDxEzp.exe
  2⤵
  PID:7052
- C:\Windows\System\BLCEHcF.exe
  C:\Windows\System\BLCEHcF.exe
  2⤵
  PID:7068
- C:\Windows\System\djBRNKZ.exe
  C:\Windows\System\djBRNKZ.exe
  2⤵
  PID:7084
- C:\Windows\System\wxDbqZJ.exe
  C:\Windows\System\wxDbqZJ.exe
  2⤵
  PID:7100
- C:\Windows\System\fjmspPN.exe
  C:\Windows\System\fjmspPN.exe
  2⤵
  PID:7116
- C:\Windows\System\tEOqMcU.exe
  C:\Windows\System\tEOqMcU.exe
  2⤵
  PID:7132
- C:\Windows\System\CyfHYqn.exe
  C:\Windows\System\CyfHYqn.exe
  2⤵
  PID:7148
- C:\Windows\System\JGDGWvf.exe
  C:\Windows\System\JGDGWvf.exe
  2⤵
  PID:7164
- C:\Windows\System\maSrFLl.exe
  C:\Windows\System\maSrFLl.exe
  2⤵
  PID:3176
- C:\Windows\System\goISwzo.exe
  C:\Windows\System\goISwzo.exe
  2⤵
  PID:5924
- C:\Windows\System\aToAzrm.exe
  C:\Windows\System\aToAzrm.exe
  2⤵
  PID:6240
- C:\Windows\System\XKdIceL.exe
  C:\Windows\System\XKdIceL.exe
  2⤵
  PID:6312
- C:\Windows\System\BasTgHH.exe
  C:\Windows\System\BasTgHH.exe
  2⤵
  PID:5884
- C:\Windows\System\aLOcFWy.exe
  C:\Windows\System\aLOcFWy.exe
  2⤵
  PID:1732
- C:\Windows\System\coOCeHS.exe
  C:\Windows\System\coOCeHS.exe
  2⤵
  PID:5624
- C:\Windows\System\JriAruD.exe
  C:\Windows\System\JriAruD.exe
  2⤵
  PID:6244
- C:\Windows\System\mHSeJYA.exe
  C:\Windows\System\mHSeJYA.exe
  2⤵
  PID:6360
- C:\Windows\System\YymzEBE.exe
  C:\Windows\System\YymzEBE.exe
  2⤵
  PID:6380
- C:\Windows\System\HUDjHOg.exe
  C:\Windows\System\HUDjHOg.exe
  2⤵
  PID:6396
- C:\Windows\System\hQFfahb.exe
  C:\Windows\System\hQFfahb.exe
  2⤵
  PID:6156
- C:\Windows\System\YwNRHpz.exe
  C:\Windows\System\YwNRHpz.exe
  2⤵
  PID:6196
- C:\Windows\System\fwLILTx.exe
  C:\Windows\System\fwLILTx.exe
  2⤵
  PID:6260
- C:\Windows\System\wRlUcgA.exe
  C:\Windows\System\wRlUcgA.exe
  2⤵
  PID:6408
- C:\Windows\System\cawgRPX.exe
  C:\Windows\System\cawgRPX.exe
  2⤵
  PID:6460
- C:\Windows\System\InULYio.exe
  C:\Windows\System\InULYio.exe
  2⤵
  PID:6476
- C:\Windows\System\lVTddmC.exe
  C:\Windows\System\lVTddmC.exe
  2⤵
  PID:6492
- C:\Windows\System\bplbuSd.exe
  C:\Windows\System\bplbuSd.exe
  2⤵
  PID:6532
- C:\Windows\System\fFdvMWF.exe
  C:\Windows\System\fFdvMWF.exe
  2⤵
  PID:6728
- C:\Windows\System\yCLZJqP.exe
  C:\Windows\System\yCLZJqP.exe
  2⤵
  PID:6768
- C:\Windows\System\YreiYQJ.exe
  C:\Windows\System\YreiYQJ.exe
  2⤵
  PID:6784
- C:\Windows\System\BYzrLJB.exe
  C:\Windows\System\BYzrLJB.exe
  2⤵
  PID:6816
- C:\Windows\System\tKsssdL.exe
  C:\Windows\System\tKsssdL.exe
  2⤵
  PID:6852
- C:\Windows\System\RLyfEBh.exe
  C:\Windows\System\RLyfEBh.exe
  2⤵
  PID:6888
- C:\Windows\System\NabdUtz.exe
  C:\Windows\System\NabdUtz.exe
  2⤵
  PID:6952
- C:\Windows\System\XPbbRUo.exe
  C:\Windows\System\XPbbRUo.exe
  2⤵
  PID:6960
- C:\Windows\System\dkdXLJu.exe
  C:\Windows\System\dkdXLJu.exe
  2⤵
  PID:6936
- C:\Windows\System\jPsbeQG.exe
  C:\Windows\System\jPsbeQG.exe
  2⤵
  PID:6900
- C:\Windows\System\jPOtHCf.exe
  C:\Windows\System\jPOtHCf.exe
  2⤵
  PID:6368
- C:\Windows\System\HgHCyTS.exe
  C:\Windows\System\HgHCyTS.exe
  2⤵
  PID:7040
- C:\Windows\System\qVainMz.exe
  C:\Windows\System\qVainMz.exe
  2⤵
  PID:7108
- C:\Windows\System\ZuqwviM.exe
  C:\Windows\System\ZuqwviM.exe
  2⤵
  PID:4784
- C:\Windows\System\fMzbbzZ.exe
  C:\Windows\System\fMzbbzZ.exe
  2⤵
  PID:6348
- C:\Windows\System\upgrhdd.exe
  C:\Windows\System\upgrhdd.exe
  2⤵
  PID:7140
- C:\Windows\System\pizbciG.exe
  C:\Windows\System\pizbciG.exe
  2⤵
  PID:6356
- C:\Windows\System\IMnArpE.exe
  C:\Windows\System\IMnArpE.exe
  2⤵
  PID:6208
- C:\Windows\System\cpUtUtV.exe
  C:\Windows\System\cpUtUtV.exe
  2⤵
  PID:4768
- C:\Windows\System\EGRAfIk.exe
  C:\Windows\System\EGRAfIk.exe
  2⤵
  PID:7128
- C:\Windows\System\yXgfijB.exe
  C:\Windows\System\yXgfijB.exe
  2⤵
  PID:7064
- C:\Windows\System\aeQYcsv.exe
  C:\Windows\System\aeQYcsv.exe
  2⤵
  PID:6152
- C:\Windows\System\LsfOGiB.exe
  C:\Windows\System\LsfOGiB.exe
  2⤵
  PID:6448
- C:\Windows\System\BTzqIUN.exe
  C:\Windows\System\BTzqIUN.exe
  2⤵
  PID:6468
- C:\Windows\System\yaFMAwC.exe
  C:\Windows\System\yaFMAwC.exe
  2⤵
  PID:6628
- C:\Windows\System\rPqvfKS.exe
  C:\Windows\System\rPqvfKS.exe
  2⤵
  PID:6712
- C:\Windows\System\vxLAVkD.exe
  C:\Windows\System\vxLAVkD.exe
  2⤵
  PID:6608
- C:\Windows\System\OsevNZI.exe
  C:\Windows\System\OsevNZI.exe
  2⤵
  PID:6592
- C:\Windows\System\OkTKceb.exe
  C:\Windows\System\OkTKceb.exe
  2⤵
  PID:6680
- C:\Windows\System\xHfJNNy.exe
  C:\Windows\System\xHfJNNy.exe
  2⤵
  PID:6624
- C:\Windows\System\OtIpvCv.exe
  C:\Windows\System\OtIpvCv.exe
  2⤵
  PID:6776
- C:\Windows\System\yXpbAcM.exe
  C:\Windows\System\yXpbAcM.exe
  2⤵
  PID:6948
- C:\Windows\System\sMPGvwA.exe
  C:\Windows\System\sMPGvwA.exe
  2⤵
  PID:6992
- C:\Windows\System\amCsODc.exe
  C:\Windows\System\amCsODc.exe
  2⤵
  PID:6880
- C:\Windows\System\ZqRmbcM.exe
  C:\Windows\System\ZqRmbcM.exe
  2⤵
  PID:6868
- C:\Windows\System\YpvVfOh.exe
  C:\Windows\System\YpvVfOh.exe
  2⤵
  PID:7144
- C:\Windows\System\emubMvN.exe
  C:\Windows\System\emubMvN.exe
  2⤵
  PID:6392
- C:\Windows\System\yoHhSLi.exe
  C:\Windows\System\yoHhSLi.exe
  2⤵
  PID:6432
- C:\Windows\System\LbbTvzU.exe
  C:\Windows\System\LbbTvzU.exe
  2⤵
  PID:6372
- C:\Windows\System\uHGrASX.exe
  C:\Windows\System\uHGrASX.exe
  2⤵
  PID:7080
- C:\Windows\System\wQiUmLW.exe
  C:\Windows\System\wQiUmLW.exe
  2⤵
  PID:6136
- C:\Windows\System\fxbGOnz.exe
  C:\Windows\System\fxbGOnz.exe
  2⤵
  PID:6516
- C:\Windows\System\yQTPoby.exe
  C:\Windows\System\yQTPoby.exe
  2⤵
  PID:6660
- C:\Windows\System\XtKsjHE.exe
  C:\Windows\System\XtKsjHE.exe
  2⤵
  PID:7096
- C:\Windows\System\zFRNaJx.exe
  C:\Windows\System\zFRNaJx.exe
  2⤵
  PID:6572
- C:\Windows\System\SdUrKlL.exe
  C:\Windows\System\SdUrKlL.exe
  2⤵
  PID:6700
- C:\Windows\System\aUfDVbx.exe
  C:\Windows\System\aUfDVbx.exe
  2⤵
  PID:6520
- C:\Windows\System\QzueQAN.exe
  C:\Windows\System\QzueQAN.exe
  2⤵
  PID:6796
- C:\Windows\System\WykKhCa.exe
  C:\Windows\System\WykKhCa.exe
  2⤵
  PID:6800
- C:\Windows\System\bWGBMoY.exe
  C:\Windows\System\bWGBMoY.exe
  2⤵
  PID:6324
- C:\Windows\System\MjclYYg.exe
  C:\Windows\System\MjclYYg.exe
  2⤵
  PID:6488
- C:\Windows\System\JBYizeV.exe
  C:\Windows\System\JBYizeV.exe
  2⤵
  PID:6444
- C:\Windows\System\uqWgfEt.exe
  C:\Windows\System\uqWgfEt.exe
  2⤵
  PID:6684
- C:\Windows\System\uknYDUW.exe
  C:\Windows\System\uknYDUW.exe
  2⤵
  PID:6988
- C:\Windows\System\LqombNC.exe
  C:\Windows\System\LqombNC.exe
  2⤵
  PID:6864
- C:\Windows\System\aovszvs.exe
  C:\Windows\System\aovszvs.exe
  2⤵
  PID:6664
- C:\Windows\System\UHPzXgV.exe
  C:\Windows\System\UHPzXgV.exe
  2⤵
  PID:6612
- C:\Windows\System\YeWXGlz.exe
  C:\Windows\System\YeWXGlz.exe
  2⤵
  PID:6296
- C:\Windows\System\mDJcLCC.exe
  C:\Windows\System\mDJcLCC.exe
  2⤵
  PID:6792
- C:\Windows\System\NXErOps.exe
  C:\Windows\System\NXErOps.exe
  2⤵
  PID:6764
- C:\Windows\System\aUiZHgj.exe
  C:\Windows\System\aUiZHgj.exe
  2⤵
  PID:7012
- C:\Windows\System\uQqdAeG.exe
  C:\Windows\System\uQqdAeG.exe
  2⤵
  PID:7180
- C:\Windows\System\kucShYu.exe
  C:\Windows\System\kucShYu.exe
  2⤵
  PID:7196
- C:\Windows\System\VXDhBlm.exe
  C:\Windows\System\VXDhBlm.exe
  2⤵
  PID:7212
- C:\Windows\System\kZRPVql.exe
  C:\Windows\System\kZRPVql.exe
  2⤵
  PID:7236
- C:\Windows\System\jIgMHmO.exe
  C:\Windows\System\jIgMHmO.exe
  2⤵
  PID:7252
- C:\Windows\System\dTffAHx.exe
  C:\Windows\System\dTffAHx.exe
  2⤵
  PID:7268
- C:\Windows\System\ExWPUpg.exe
  C:\Windows\System\ExWPUpg.exe
  2⤵
  PID:7284
- C:\Windows\System\IDVZYVf.exe
  C:\Windows\System\IDVZYVf.exe
  2⤵
  PID:7304
- C:\Windows\System\FdHqsOh.exe
  C:\Windows\System\FdHqsOh.exe
  2⤵
  PID:7324
- C:\Windows\System\traUnTG.exe
  C:\Windows\System\traUnTG.exe
  2⤵
  PID:7340
- C:\Windows\System\DtvpAMv.exe
  C:\Windows\System\DtvpAMv.exe
  2⤵
  PID:7356
- C:\Windows\System\XlwNjYD.exe
  C:\Windows\System\XlwNjYD.exe
  2⤵
  PID:7372
- C:\Windows\System\tPcuqLf.exe
  C:\Windows\System\tPcuqLf.exe
  2⤵
  PID:7488
- C:\Windows\System\Zscapyv.exe
  C:\Windows\System\Zscapyv.exe
  2⤵
  PID:7516
- C:\Windows\System\OEQDIvj.exe
  C:\Windows\System\OEQDIvj.exe
  2⤵
  PID:7532
- C:\Windows\System\oBZzQLH.exe
  C:\Windows\System\oBZzQLH.exe
  2⤵
  PID:7548
- C:\Windows\System\ZgnatAD.exe
  C:\Windows\System\ZgnatAD.exe
  2⤵
  PID:7568
- C:\Windows\System\lAvyNHL.exe
  C:\Windows\System\lAvyNHL.exe
  2⤵
  PID:7584
- C:\Windows\System\xaEIUhr.exe
  C:\Windows\System\xaEIUhr.exe
  2⤵
  PID:7684
- C:\Windows\System\ufjAzYU.exe
  C:\Windows\System\ufjAzYU.exe
  2⤵
  PID:7700
- C:\Windows\System\qnBMAzr.exe
  C:\Windows\System\qnBMAzr.exe
  2⤵
  PID:7716
- C:\Windows\System\WQxzHbk.exe
  C:\Windows\System\WQxzHbk.exe
  2⤵
  PID:7732
- C:\Windows\System\iPPKlAV.exe
  C:\Windows\System\iPPKlAV.exe
  2⤵
  PID:7752
- C:\Windows\System\BvWLmwX.exe
  C:\Windows\System\BvWLmwX.exe
  2⤵
  PID:7768
- C:\Windows\System\nEHlomg.exe
  C:\Windows\System\nEHlomg.exe
  2⤵
  PID:7788
- C:\Windows\System\bRzpzRC.exe
  C:\Windows\System\bRzpzRC.exe
  2⤵
  PID:7808
- C:\Windows\System\PaHscpR.exe
  C:\Windows\System\PaHscpR.exe
  2⤵
  PID:7824
- C:\Windows\System\HMrNlsA.exe
  C:\Windows\System\HMrNlsA.exe
  2⤵
  PID:7840
- C:\Windows\System\wrCtaYa.exe
  C:\Windows\System\wrCtaYa.exe
  2⤵
  PID:7856
- C:\Windows\System\PWWbPov.exe
  C:\Windows\System\PWWbPov.exe
  2⤵
  PID:7876
- C:\Windows\System\VQQvihI.exe
  C:\Windows\System\VQQvihI.exe
  2⤵
  PID:7924
- C:\Windows\System\EympOdJ.exe
  C:\Windows\System\EympOdJ.exe
  2⤵
  PID:7940
- C:\Windows\System\KbllRVA.exe
  C:\Windows\System\KbllRVA.exe
  2⤵
  PID:7960
- C:\Windows\System\RSxtggh.exe
  C:\Windows\System\RSxtggh.exe
  2⤵
  PID:7980
- C:\Windows\System\omVxxlo.exe
  C:\Windows\System\omVxxlo.exe
  2⤵
  PID:7996
- C:\Windows\System\Zdxxymi.exe
  C:\Windows\System\Zdxxymi.exe
  2⤵
  PID:8012
- C:\Windows\System\jUAxIYo.exe
  C:\Windows\System\jUAxIYo.exe
  2⤵
  PID:8028
- C:\Windows\System\lJJkLnU.exe
  C:\Windows\System\lJJkLnU.exe
  2⤵
  PID:8044
- C:\Windows\System\ObnfpnN.exe
  C:\Windows\System\ObnfpnN.exe
  2⤵
  PID:8060
- C:\Windows\System\vZOcUWo.exe
  C:\Windows\System\vZOcUWo.exe
  2⤵
  PID:8076
- C:\Windows\System\WjhmMWA.exe
  C:\Windows\System\WjhmMWA.exe
  2⤵
  PID:8100
- C:\Windows\System\WqRDhni.exe
  C:\Windows\System\WqRDhni.exe
  2⤵
  PID:8116
- C:\Windows\System\JUDXbij.exe
  C:\Windows\System\JUDXbij.exe
  2⤵
  PID:8132
- C:\Windows\System\SwZGCWz.exe
  C:\Windows\System\SwZGCWz.exe
  2⤵
  PID:8148
- C:\Windows\System\LyRRtkk.exe
  C:\Windows\System\LyRRtkk.exe
  2⤵
  PID:8168
- C:\Windows\System\RSuLoRo.exe
  C:\Windows\System\RSuLoRo.exe
  2⤵
  PID:8184
- C:\Windows\System\YreckuY.exe
  C:\Windows\System\YreckuY.exe
  2⤵
  PID:6412
- C:\Windows\System\yMNcIxn.exe
  C:\Windows\System\yMNcIxn.exe
  2⤵
  PID:7248
- C:\Windows\System\hWIPjWv.exe
  C:\Windows\System\hWIPjWv.exe
  2⤵
  PID:7188
- C:\Windows\System\IcjVwkY.exe
  C:\Windows\System\IcjVwkY.exe
  2⤵
  PID:6836
- C:\Windows\System\oVgOput.exe
  C:\Windows\System\oVgOput.exe
  2⤵
  PID:6256
- C:\Windows\System\IciBCSX.exe
  C:\Windows\System\IciBCSX.exe
  2⤵
  PID:7228
- C:\Windows\System\NlEKbKp.exe
  C:\Windows\System\NlEKbKp.exe
  2⤵
  PID:7280
- C:\Windows\System\RgRcDez.exe
  C:\Windows\System\RgRcDez.exe
  2⤵
  PID:7300
- C:\Windows\System\Tljuymj.exe
  C:\Windows\System\Tljuymj.exe
  2⤵
  PID:7336
- C:\Windows\System\jgKYJHD.exe
  C:\Windows\System\jgKYJHD.exe
  2⤵
  PID:7348
- C:\Windows\System\MCIwtXA.exe
  C:\Windows\System\MCIwtXA.exe
  2⤵
  PID:7396
- C:\Windows\System\hNjQfuj.exe
  C:\Windows\System\hNjQfuj.exe
  2⤵
  PID:7412
- C:\Windows\System\gdPMLkR.exe
  C:\Windows\System\gdPMLkR.exe
  2⤵
  PID:7424
- C:\Windows\System\YcFCMzA.exe
  C:\Windows\System\YcFCMzA.exe
  2⤵
  PID:7444
- C:\Windows\System\QLZVvjj.exe
  C:\Windows\System\QLZVvjj.exe
  2⤵
  PID:7460
- C:\Windows\System\egeWswd.exe
  C:\Windows\System\egeWswd.exe
  2⤵
  PID:7476
- C:\Windows\System\KidDhoL.exe
  C:\Windows\System\KidDhoL.exe
  2⤵
  PID:7556
- C:\Windows\System\nyJTHTn.exe
  C:\Windows\System\nyJTHTn.exe
  2⤵
  PID:7580
- C:\Windows\System\FgPGcqZ.exe
  C:\Windows\System\FgPGcqZ.exe
  2⤵
  PID:7512
- C:\Windows\System\vrNogPl.exe
  C:\Windows\System\vrNogPl.exe
  2⤵
  PID:7592
- C:\Windows\System\cfYvlcJ.exe
  C:\Windows\System\cfYvlcJ.exe
  2⤵
  PID:7608
- C:\Windows\System\XrFBGWm.exe
  C:\Windows\System\XrFBGWm.exe
  2⤵
  PID:7624
- C:\Windows\System\oWusbAM.exe
  C:\Windows\System\oWusbAM.exe
  2⤵
  PID:7640
- C:\Windows\System\UsDRwuN.exe
  C:\Windows\System\UsDRwuN.exe
  2⤵
  PID:7656
- C:\Windows\System\vuKzKHO.exe
  C:\Windows\System\vuKzKHO.exe
  2⤵
  PID:7672
- C:\Windows\System\zIkfTjF.exe
  C:\Windows\System\zIkfTjF.exe
  2⤵
  PID:7796
- C:\Windows\System\nVfXpzl.exe
  C:\Windows\System\nVfXpzl.exe
  2⤵
  PID:7872
- C:\Windows\System\xgTwUjo.exe
  C:\Windows\System\xgTwUjo.exe
  2⤵
  PID:7952
- C:\Windows\System\UVcXHgH.exe
  C:\Windows\System\UVcXHgH.exe
  2⤵
  PID:8052
- C:\Windows\System\odqdvOO.exe
  C:\Windows\System\odqdvOO.exe
  2⤵
  PID:8084
- C:\Windows\System\rzApcSD.exe
  C:\Windows\System\rzApcSD.exe
  2⤵
  PID:8164
- C:\Windows\System\VuVeriE.exe
  C:\Windows\System\VuVeriE.exe
  2⤵
  PID:7836
- C:\Windows\System\FtzwZsD.exe
  C:\Windows\System\FtzwZsD.exe
  2⤵
  PID:8180
- C:\Windows\System\fPNFbja.exe
  C:\Windows\System\fPNFbja.exe
  2⤵
  PID:6504
- C:\Windows\System\PYDSGlj.exe
  C:\Windows\System\PYDSGlj.exe
  2⤵
  PID:916
- C:\Windows\System\jwUmZmU.exe
  C:\Windows\System\jwUmZmU.exe
  2⤵
  PID:7364
- C:\Windows\System\pxzkAUp.exe
  C:\Windows\System\pxzkAUp.exe
  2⤵
  PID:7420
- C:\Windows\System\QSXfaub.exe
  C:\Windows\System\QSXfaub.exe
  2⤵
  PID:7456
- C:\Windows\System\AOwgQCB.exe
  C:\Windows\System\AOwgQCB.exe
  2⤵
  PID:7632
- C:\Windows\System\JHismcz.exe
  C:\Windows\System\JHismcz.exe
  2⤵
  PID:7496
- C:\Windows\System\YbnBdVt.exe
  C:\Windows\System\YbnBdVt.exe
  2⤵
  PID:6552
- C:\Windows\System\QIlYjmc.exe
  C:\Windows\System\QIlYjmc.exe
  2⤵
  PID:7260
- C:\Windows\System\azVxBOZ.exe
  C:\Windows\System\azVxBOZ.exe
  2⤵
  PID:7436
- C:\Windows\System\QuIIvBf.exe
  C:\Windows\System\QuIIvBf.exe
  2⤵
  PID:7620
- C:\Windows\System\weuZEJj.exe
  C:\Windows\System\weuZEJj.exe
  2⤵
  PID:7820
- C:\Windows\System\vYAdDLU.exe
  C:\Windows\System\vYAdDLU.exe
  2⤵
  PID:7748
- C:\Windows\System\qGPjycp.exe
  C:\Windows\System\qGPjycp.exe
  2⤵
  PID:7884
- C:\Windows\System\snRFNgQ.exe
  C:\Windows\System\snRFNgQ.exe
  2⤵
  PID:7776
- C:\Windows\System\UIbXsLu.exe
  C:\Windows\System\UIbXsLu.exe
  2⤵
  PID:7896
- C:\Windows\System\xcJNDxe.exe
  C:\Windows\System\xcJNDxe.exe
  2⤵
  PID:7764
- C:\Windows\System\MRKAWxg.exe
  C:\Windows\System\MRKAWxg.exe
  2⤵
  PID:7392
- C:\Windows\System\onrZUYa.exe
  C:\Windows\System\onrZUYa.exe
  2⤵
  PID:8124
- C:\Windows\System\oGYKfyx.exe
  C:\Windows\System\oGYKfyx.exe
  2⤵
  PID:7800
- C:\Windows\System\OvfDJMG.exe
  C:\Windows\System\OvfDJMG.exe
  2⤵
  PID:7868
- C:\Windows\System\EOKctPA.exe
  C:\Windows\System\EOKctPA.exe
  2⤵
  PID:8160
- C:\Windows\System\Llpwzqd.exe
  C:\Windows\System\Llpwzqd.exe
  2⤵
  PID:8008
- C:\Windows\System\xjAlINx.exe
  C:\Windows\System\xjAlINx.exe
  2⤵
  PID:8068
- C:\Windows\System\YQLKOfS.exe
  C:\Windows\System\YQLKOfS.exe
  2⤵
  PID:8140
- C:\Windows\System\RrHbiBg.exe
  C:\Windows\System\RrHbiBg.exe
  2⤵
  PID:6696
- C:\Windows\System\ABJLFKc.exe
  C:\Windows\System\ABJLFKc.exe
  2⤵
  PID:7508
- C:\Windows\System\qiCdXyc.exe
  C:\Windows\System\qiCdXyc.exe
  2⤵
  PID:7368
- C:\Windows\System\iTKsioC.exe
  C:\Windows\System\iTKsioC.exe
  2⤵
  PID:7528
- C:\Windows\System\fUNFmGn.exe
  C:\Windows\System\fUNFmGn.exe
  2⤵
  PID:7220
- C:\Windows\System\CxdKlmr.exe
  C:\Windows\System\CxdKlmr.exe
  2⤵
  PID:7316
- C:\Windows\System\RdrCPOz.exe
  C:\Windows\System\RdrCPOz.exe
  2⤵
  PID:6328
- C:\Windows\System\sfGwJWE.exe
  C:\Windows\System\sfGwJWE.exe
  2⤵
  PID:7816
- C:\Windows\System\ipMttPI.exe
  C:\Windows\System\ipMttPI.exe
  2⤵
  PID:8156
- C:\Windows\System\msUfpkT.exe
  C:\Windows\System\msUfpkT.exe
  2⤵
  PID:7472
- C:\Windows\System\KhliTqr.exe
  C:\Windows\System\KhliTqr.exe
  2⤵
  PID:6428
- C:\Windows\System\bYzYHWZ.exe
  C:\Windows\System\bYzYHWZ.exe
  2⤵
  PID:7972
- C:\Windows\System\bPYZTCc.exe
  C:\Windows\System\bPYZTCc.exe
  2⤵
  PID:8128
- C:\Windows\System\DPRSCrr.exe
  C:\Windows\System\DPRSCrr.exe
  2⤵
  PID:7668
- C:\Windows\System\lhjfDkx.exe
  C:\Windows\System\lhjfDkx.exe
  2⤵
  PID:7900
- C:\Windows\System\xSwGKcQ.exe
  C:\Windows\System\xSwGKcQ.exe
  2⤵
  PID:7936
- C:\Windows\System\hGrDjps.exe
  C:\Windows\System\hGrDjps.exe
  2⤵
  PID:8108
- C:\Windows\System\QQGQKJP.exe
  C:\Windows\System\QQGQKJP.exe
  2⤵
  PID:7452
- C:\Windows\System\PstfjQb.exe
  C:\Windows\System\PstfjQb.exe
  2⤵
  PID:7468
- C:\Windows\System\LvpDZiU.exe
  C:\Windows\System\LvpDZiU.exe
  2⤵
  PID:7912
- C:\Windows\System\INRrLeF.exe
  C:\Windows\System\INRrLeF.exe
  2⤵
  PID:7692
- C:\Windows\System\JPvQINg.exe
  C:\Windows\System\JPvQINg.exe
  2⤵
  PID:8024
- C:\Windows\System\LQKwboB.exe
  C:\Windows\System\LQKwboB.exe
  2⤵
  PID:7976
- C:\Windows\System\JjZdVsV.exe
  C:\Windows\System\JjZdVsV.exe
  2⤵
  PID:7172
- C:\Windows\System\ftIuRCJ.exe
  C:\Windows\System\ftIuRCJ.exe
  2⤵
  PID:8204
- C:\Windows\System\nYMXkLY.exe
  C:\Windows\System\nYMXkLY.exe
  2⤵
  PID:8220
- C:\Windows\System\tUFrITA.exe
  C:\Windows\System\tUFrITA.exe
  2⤵
  PID:8236
- C:\Windows\System\IutPbhA.exe
  C:\Windows\System\IutPbhA.exe
  2⤵
  PID:8252
- C:\Windows\System\CototPx.exe
  C:\Windows\System\CototPx.exe
  2⤵
  PID:8268
- C:\Windows\System\tgOvswO.exe
  C:\Windows\System\tgOvswO.exe
  2⤵
  PID:8288
- C:\Windows\System\yDkMfGo.exe
  C:\Windows\System\yDkMfGo.exe
  2⤵
  PID:8304
- C:\Windows\System\ngcqArn.exe
  C:\Windows\System\ngcqArn.exe
  2⤵
  PID:8320
- C:\Windows\System\rWKLhHD.exe
  C:\Windows\System\rWKLhHD.exe
  2⤵
  PID:8336
- C:\Windows\System\qZlQLsV.exe
  C:\Windows\System\qZlQLsV.exe
  2⤵
  PID:8352
- C:\Windows\System\kzDbqLt.exe
  C:\Windows\System\kzDbqLt.exe
  2⤵
  PID:8372
- C:\Windows\System\wSTQrrh.exe
  C:\Windows\System\wSTQrrh.exe
  2⤵
  PID:8388
- C:\Windows\System\xKOpUkL.exe
  C:\Windows\System\xKOpUkL.exe
  2⤵
  PID:8404
- C:\Windows\System\XGJYdCa.exe
  C:\Windows\System\XGJYdCa.exe
  2⤵
  PID:8420
- C:\Windows\System\AMXWHvu.exe
  C:\Windows\System\AMXWHvu.exe
  2⤵
  PID:8440
- C:\Windows\System\yaPftyc.exe
  C:\Windows\System\yaPftyc.exe
  2⤵
  PID:8456
- C:\Windows\System\XFLSEqw.exe
  C:\Windows\System\XFLSEqw.exe
  2⤵
  PID:8472
- C:\Windows\System\iUeLPGN.exe
  C:\Windows\System\iUeLPGN.exe
  2⤵
  PID:8488
- C:\Windows\System\ghFLXyJ.exe
  C:\Windows\System\ghFLXyJ.exe
  2⤵
  PID:8504
- C:\Windows\System\tqqhdHI.exe
  C:\Windows\System\tqqhdHI.exe
  2⤵
  PID:8520
- C:\Windows\System\LhkBZrK.exe
  C:\Windows\System\LhkBZrK.exe
  2⤵
  PID:8536
- C:\Windows\System\zJmnlNU.exe
  C:\Windows\System\zJmnlNU.exe
  2⤵
  PID:8552
- C:\Windows\System\eyYIjcg.exe
  C:\Windows\System\eyYIjcg.exe
  2⤵
  PID:8568
- C:\Windows\System\gkiKuWJ.exe
  C:\Windows\System\gkiKuWJ.exe
  2⤵
  PID:8584
- C:\Windows\System\MwCjZrf.exe
  C:\Windows\System\MwCjZrf.exe
  2⤵
  PID:8600
- C:\Windows\System\YjuzYWj.exe
  C:\Windows\System\YjuzYWj.exe
  2⤵
  PID:8624
- C:\Windows\System\ycsRVhi.exe
  C:\Windows\System\ycsRVhi.exe
  2⤵
  PID:8640
- C:\Windows\System\oJAfghZ.exe
  C:\Windows\System\oJAfghZ.exe
  2⤵
  PID:8656
- C:\Windows\System\lWlSBOP.exe
  C:\Windows\System\lWlSBOP.exe
  2⤵
  PID:8676
- C:\Windows\System\ADryMYG.exe
  C:\Windows\System\ADryMYG.exe
  2⤵
  PID:8692
- C:\Windows\System\rIbQJGo.exe
  C:\Windows\System\rIbQJGo.exe
  2⤵
  PID:8708
- C:\Windows\System\TRCWSym.exe
  C:\Windows\System\TRCWSym.exe
  2⤵
  PID:8724
- C:\Windows\System\JhCAapU.exe
  C:\Windows\System\JhCAapU.exe
  2⤵
  PID:8744
- C:\Windows\System\XDSWFVi.exe
  C:\Windows\System\XDSWFVi.exe
  2⤵
  PID:8760
- C:\Windows\System\vISdNHj.exe
  C:\Windows\System\vISdNHj.exe
  2⤵
  PID:8776
- C:\Windows\System\wPvEEVy.exe
  C:\Windows\System\wPvEEVy.exe
  2⤵
  PID:8792
- C:\Windows\System\FDiCInn.exe
  C:\Windows\System\FDiCInn.exe
  2⤵
  PID:8808
- C:\Windows\System\fXjHvAj.exe
  C:\Windows\System\fXjHvAj.exe
  2⤵
  PID:8828
- C:\Windows\System\cwShaqb.exe
  C:\Windows\System\cwShaqb.exe
  2⤵
  PID:8876
- C:\Windows\System\SOaVGBf.exe
  C:\Windows\System\SOaVGBf.exe
  2⤵
  PID:8892
- C:\Windows\System\GWUONHY.exe
  C:\Windows\System\GWUONHY.exe
  2⤵
  PID:8908
- C:\Windows\System\rAVcbyp.exe
  C:\Windows\System\rAVcbyp.exe
  2⤵
  PID:8924
- C:\Windows\System\FjNHqJW.exe
  C:\Windows\System\FjNHqJW.exe
  2⤵
  PID:8940
- C:\Windows\System\IvnYbRm.exe
  C:\Windows\System\IvnYbRm.exe
  2⤵
  PID:8956
- C:\Windows\System\TlBRZnW.exe
  C:\Windows\System\TlBRZnW.exe
  2⤵
  PID:8976
- C:\Windows\System\JSzvtAE.exe
  C:\Windows\System\JSzvtAE.exe
  2⤵
  PID:8992
- C:\Windows\System\GfiEgza.exe
  C:\Windows\System\GfiEgza.exe
  2⤵
  PID:9008
- C:\Windows\System\HdkVzRD.exe
  C:\Windows\System\HdkVzRD.exe
  2⤵
  PID:9024
- C:\Windows\System\NhvxDce.exe
  C:\Windows\System\NhvxDce.exe
  2⤵
  PID:9044
- C:\Windows\System\lHvagdp.exe
  C:\Windows\System\lHvagdp.exe
  2⤵
  PID:9060
- C:\Windows\System\uGRUxPl.exe
  C:\Windows\System\uGRUxPl.exe
  2⤵
  PID:9076
- C:\Windows\System\pBoNAZI.exe
  C:\Windows\System\pBoNAZI.exe
  2⤵
  PID:9092
- C:\Windows\System\CKRsqAu.exe
  C:\Windows\System\CKRsqAu.exe
  2⤵
  PID:9108
- C:\Windows\System\YTgHVod.exe
  C:\Windows\System\YTgHVod.exe
  2⤵
  PID:9128
- C:\Windows\System\DwdAKkZ.exe
  C:\Windows\System\DwdAKkZ.exe
  2⤵
  PID:9144
- C:\Windows\System\ioTYgHY.exe
  C:\Windows\System\ioTYgHY.exe
  2⤵
  PID:8264
- C:\Windows\System\YguBeDN.exe
  C:\Windows\System\YguBeDN.exe
  2⤵
  PID:7384
- C:\Windows\System\CjbLrtD.exe
  C:\Windows\System\CjbLrtD.exe
  2⤵
  PID:8300
- C:\Windows\System\dtuUIob.exe
  C:\Windows\System\dtuUIob.exe
  2⤵
  PID:8284
- C:\Windows\System\vLVbjwd.exe
  C:\Windows\System\vLVbjwd.exe
  2⤵
  PID:8244
- C:\Windows\System\MlBHYuv.exe
  C:\Windows\System\MlBHYuv.exe
  2⤵
  PID:7408
- C:\Windows\System\RLqsgfJ.exe
  C:\Windows\System\RLqsgfJ.exe
  2⤵
  PID:8348
- C:\Windows\System\opBhjeS.exe
  C:\Windows\System\opBhjeS.exe
  2⤵
  PID:8396
- C:\Windows\System\zRuYdiP.exe
  C:\Windows\System\zRuYdiP.exe
  2⤵
  PID:8436
- C:\Windows\System\WXwcemO.exe
  C:\Windows\System\WXwcemO.exe
  2⤵
  PID:8496
- C:\Windows\System\qkPuDOR.exe
  C:\Windows\System\qkPuDOR.exe
  2⤵
  PID:8560
- C:\Windows\System\JeQFQRx.exe
  C:\Windows\System\JeQFQRx.exe
  2⤵
  PID:8384
- C:\Windows\System\oDzmEgL.exe
  C:\Windows\System\oDzmEgL.exe
  2⤵
  PID:8672
- C:\Windows\System\fBVaRBV.exe
  C:\Windows\System\fBVaRBV.exe
  2⤵
  PID:8704
- C:\Windows\System\hoIToqd.exe
  C:\Windows\System\hoIToqd.exe
  2⤵
  PID:8740
- C:\Windows\System\xTWOCrs.exe
  C:\Windows\System\xTWOCrs.exe
  2⤵
  PID:8752
- C:\Windows\System\KYNRDQQ.exe
  C:\Windows\System\KYNRDQQ.exe
  2⤵
  PID:8544
- C:\Windows\System\dJBJBDT.exe
  C:\Windows\System\dJBJBDT.exe
  2⤵
  PID:8608
- C:\Windows\System\zysZETi.exe
  C:\Windows\System\zysZETi.exe
  2⤵
  PID:8620
- C:\Windows\System\vKdpyas.exe
  C:\Windows\System\vKdpyas.exe
  2⤵
  PID:8800
- C:\Windows\System\VdPNkRW.exe
  C:\Windows\System\VdPNkRW.exe
  2⤵
  PID:8816
- C:\Windows\System\bZJZObx.exe
  C:\Windows\System\bZJZObx.exe
  2⤵
  PID:8844
- C:\Windows\System\fAFgIJh.exe
  C:\Windows\System\fAFgIJh.exe
  2⤵
  PID:8864
- C:\Windows\System\QsoELPI.exe
  C:\Windows\System\QsoELPI.exe
  2⤵
  PID:8932
- C:\Windows\System\gcReIZh.exe
  C:\Windows\System\gcReIZh.exe
  2⤵
  PID:8972
- C:\Windows\System\BkREpmv.exe
  C:\Windows\System\BkREpmv.exe
  2⤵
  PID:9036
- C:\Windows\System\kjhMPUA.exe
  C:\Windows\System\kjhMPUA.exe
  2⤵
  PID:9020
- C:\Windows\System\CXrADAS.exe
  C:\Windows\System\CXrADAS.exe
  2⤵
  PID:8884
- C:\Windows\System\vdUhowl.exe
  C:\Windows\System\vdUhowl.exe
  2⤵
  PID:9072
- C:\Windows\System\VXumpCO.exe
  C:\Windows\System\VXumpCO.exe
  2⤵
  PID:8948
- C:\Windows\System\zMJdAGu.exe
  C:\Windows\System\zMJdAGu.exe
  2⤵
  PID:9084
- C:\Windows\System\gpiDjMq.exe
  C:\Windows\System\gpiDjMq.exe
  2⤵
  PID:9156
- C:\Windows\System\DsTgIkY.exe
  C:\Windows\System\DsTgIkY.exe
  2⤵
  PID:9180
- C:\Windows\System\MSeAFPK.exe
  C:\Windows\System\MSeAFPK.exe
  2⤵
  PID:9192
- C:\Windows\System\dnZoUFW.exe
  C:\Windows\System\dnZoUFW.exe
  2⤵
  PID:9208
- C:\Windows\System\bbtjFdi.exe
  C:\Windows\System\bbtjFdi.exe
  2⤵
  PID:8176
- C:\Windows\System\gdPsBbP.exe
  C:\Windows\System\gdPsBbP.exe
  2⤵
  PID:8260
- C:\Windows\System\TYRRlWQ.exe
  C:\Windows\System\TYRRlWQ.exe
  2⤵
  PID:7576
- C:\Windows\System\acwFqXZ.exe
  C:\Windows\System\acwFqXZ.exe
  2⤵
  PID:8368
- C:\Windows\System\WPMmYPs.exe
  C:\Windows\System\WPMmYPs.exe
  2⤵
  PID:8468
- C:\Windows\System\RionXJZ.exe
  C:\Windows\System\RionXJZ.exe
  2⤵
  PID:8700
- C:\Windows\System\fHJsvYC.exe
  C:\Windows\System\fHJsvYC.exe
  2⤵
  PID:7664
- C:\Windows\System\PrvcJtF.exe
  C:\Windows\System\PrvcJtF.exe
  2⤵
  PID:8096
- C:\Windows\System\MzXrKrG.exe
  C:\Windows\System\MzXrKrG.exe
  2⤵
  PID:8432
- C:\Windows\System\cZPDTuU.exe
  C:\Windows\System\cZPDTuU.exe
  2⤵
  PID:8648
- C:\Windows\System\LUCOmxU.exe
  C:\Windows\System\LUCOmxU.exe
  2⤵
  PID:8664
- C:\Windows\System\RHBUDOO.exe
  C:\Windows\System\RHBUDOO.exe
  2⤵
  PID:8736
- C:\Windows\System\TIJFqMJ.exe
  C:\Windows\System\TIJFqMJ.exe
  2⤵
  PID:8772
- C:\Windows\System\zHaBcBA.exe
  C:\Windows\System\zHaBcBA.exe
  2⤵
  PID:8856
- C:\Windows\System\GZgsfFa.exe
  C:\Windows\System\GZgsfFa.exe
  2⤵
  PID:8872
- C:\Windows\System\iePlTPB.exe
  C:\Windows\System\iePlTPB.exe
  2⤵
  PID:9120
- C:\Windows\System\SITnuYh.exe
  C:\Windows\System\SITnuYh.exe
  2⤵
  PID:9140
- C:\Windows\System\xgnvHSr.exe
  C:\Windows\System\xgnvHSr.exe
  2⤵
  PID:8848
- C:\Windows\System\LuvdqYo.exe
  C:\Windows\System\LuvdqYo.exe
  2⤵
  PID:8916
- C:\Windows\System\aozneZB.exe
  C:\Windows\System\aozneZB.exe
  2⤵
  PID:9164
- C:\Windows\System\kItPUPr.exe
  C:\Windows\System\kItPUPr.exe
  2⤵
  PID:9188
- C:\Windows\System\KvvuAme.exe
  C:\Windows\System\KvvuAme.exe
  2⤵
  PID:7948
- C:\Windows\System\TzNRUcN.exe
  C:\Windows\System\TzNRUcN.exe
  2⤵
  PID:8480
- C:\Windows\System\fyDyNDm.exe
  C:\Windows\System\fyDyNDm.exe
  2⤵
  PID:8428
- C:\Windows\System\oNsISrd.exe
  C:\Windows\System\oNsISrd.exe
  2⤵
  PID:8512
- C:\Windows\System\ZYXJxsU.exe
  C:\Windows\System\ZYXJxsU.exe
  2⤵
  PID:9116
- C:\Windows\System\YLLnvPY.exe
  C:\Windows\System\YLLnvPY.exe
  2⤵
  PID:8820
- C:\Windows\System\TJPOYNf.exe
  C:\Windows\System\TJPOYNf.exe
  2⤵
  PID:9184
- C:\Windows\System\hnjqjZB.exe
  C:\Windows\System\hnjqjZB.exe
  2⤵
  PID:8312
- C:\Windows\System\kqLutoH.exe
  C:\Windows\System\kqLutoH.exe
  2⤵
  PID:8580
- C:\Windows\System\EbfZwRz.exe
  C:\Windows\System\EbfZwRz.exe
  2⤵
  PID:8888
- C:\Windows\System\NNFERrF.exe
  C:\Windows\System\NNFERrF.exe
  2⤵
  PID:8964
- C:\Windows\System\ITrnkAL.exe
  C:\Windows\System\ITrnkAL.exe
  2⤵
  PID:8200
- C:\Windows\System\yNHBAOw.exe
  C:\Windows\System\yNHBAOw.exe
  2⤵
  PID:8684
- C:\Windows\System\EGbiMZs.exe
  C:\Windows\System\EGbiMZs.exe
  2⤵
  PID:8248
- C:\Windows\System\wJRzJvT.exe
  C:\Windows\System\wJRzJvT.exe
  2⤵
  PID:9172
- C:\Windows\System\GatDdGC.exe
  C:\Windows\System\GatDdGC.exe
  2⤵
  PID:7204
- C:\Windows\System\ZJsnXqn.exe
  C:\Windows\System\ZJsnXqn.exe
  2⤵
  PID:8412
- C:\Windows\System\wTvtbRo.exe
  C:\Windows\System\wTvtbRo.exe
  2⤵
  PID:8216
- C:\Windows\System\CckqoKG.exe
  C:\Windows\System\CckqoKG.exe
  2⤵
  PID:9052
- C:\Windows\System\HmLGATf.exe
  C:\Windows\System\HmLGATf.exe
  2⤵
  PID:8920
- C:\Windows\System\ZpMxCfI.exe
  C:\Windows\System\ZpMxCfI.exe
  2⤵
  PID:9240
- C:\Windows\System\VeKnHfE.exe
  C:\Windows\System\VeKnHfE.exe
  2⤵
  PID:9256
- C:\Windows\System\qPNitUx.exe
  C:\Windows\System\qPNitUx.exe
  2⤵
  PID:9272
- C:\Windows\System\wXOULKn.exe
  C:\Windows\System\wXOULKn.exe
  2⤵
  PID:9288
- C:\Windows\System\KTXZofj.exe
  C:\Windows\System\KTXZofj.exe
  2⤵
  PID:9304
- C:\Windows\System\hiCyOLn.exe
  C:\Windows\System\hiCyOLn.exe
  2⤵
  PID:9320
- C:\Windows\System\gWFbovN.exe
  C:\Windows\System\gWFbovN.exe
  2⤵
  PID:9336
- C:\Windows\System\jOSTOdv.exe
  C:\Windows\System\jOSTOdv.exe
  2⤵
  PID:9352
- C:\Windows\System\cJrZQqr.exe
  C:\Windows\System\cJrZQqr.exe
  2⤵
  PID:9368
- C:\Windows\System\ZXlKSbb.exe
  C:\Windows\System\ZXlKSbb.exe
  2⤵
  PID:9384
- C:\Windows\System\ePzwmwN.exe
  C:\Windows\System\ePzwmwN.exe
  2⤵
  PID:9400
- C:\Windows\System\zzmjuVB.exe
  C:\Windows\System\zzmjuVB.exe
  2⤵
  PID:9416
- C:\Windows\System\LhxhiPu.exe
  C:\Windows\System\LhxhiPu.exe
  2⤵
  PID:9432
- C:\Windows\System\NlnIbGH.exe
  C:\Windows\System\NlnIbGH.exe
  2⤵
  PID:9448
- C:\Windows\System\rONGerO.exe
  C:\Windows\System\rONGerO.exe
  2⤵
  PID:9464
- C:\Windows\System\NXjcXiw.exe
  C:\Windows\System\NXjcXiw.exe
  2⤵
  PID:9480
- C:\Windows\System\YQZYLBw.exe
  C:\Windows\System\YQZYLBw.exe
  2⤵
  PID:9496
- C:\Windows\System\MIUMrep.exe
  C:\Windows\System\MIUMrep.exe
  2⤵
  PID:9516
- C:\Windows\System\JpLBkbN.exe
  C:\Windows\System\JpLBkbN.exe
  2⤵
  PID:9532
- C:\Windows\System\eYtsean.exe
  C:\Windows\System\eYtsean.exe
  2⤵
  PID:9548
- C:\Windows\System\vPivQTv.exe
  C:\Windows\System\vPivQTv.exe
  2⤵
  PID:9564
- C:\Windows\System\xaZEquv.exe
  C:\Windows\System\xaZEquv.exe
  2⤵
  PID:9584
- C:\Windows\System\CfOByaA.exe
  C:\Windows\System\CfOByaA.exe
  2⤵
  PID:9600
- C:\Windows\System\WhBAWdz.exe
  C:\Windows\System\WhBAWdz.exe
  2⤵
  PID:9616
- C:\Windows\System\WxtojBt.exe
  C:\Windows\System\WxtojBt.exe
  2⤵
  PID:9636
- C:\Windows\System\tPZGovp.exe
  C:\Windows\System\tPZGovp.exe
  2⤵
  PID:9652
- C:\Windows\System\yLErhlq.exe
  C:\Windows\System\yLErhlq.exe
  2⤵
  PID:9668
- C:\Windows\System\eKvAhaI.exe
  C:\Windows\System\eKvAhaI.exe
  2⤵
  PID:9684
- C:\Windows\System\vyzhLaf.exe
  C:\Windows\System\vyzhLaf.exe
  2⤵
  PID:9704
- C:\Windows\System\QGQGozt.exe
  C:\Windows\System\QGQGozt.exe
  2⤵
  PID:9720
- C:\Windows\System\zrIaDlk.exe
  C:\Windows\System\zrIaDlk.exe
  2⤵
  PID:9736
- C:\Windows\System\XAUPMeq.exe
  C:\Windows\System\XAUPMeq.exe
  2⤵
  PID:9756
- C:\Windows\System\SouQTvv.exe
  C:\Windows\System\SouQTvv.exe
  2⤵
  PID:9784
- C:\Windows\System\hVwWRIt.exe
  C:\Windows\System\hVwWRIt.exe
  2⤵
  PID:9800
- C:\Windows\System\ucKscby.exe
  C:\Windows\System\ucKscby.exe
  2⤵
  PID:9816
- C:\Windows\System\PAxhQbS.exe
  C:\Windows\System\PAxhQbS.exe
  2⤵
  PID:9832
- C:\Windows\System\FkDpEDv.exe
  C:\Windows\System\FkDpEDv.exe
  2⤵
  PID:9848
- C:\Windows\System\fPzgKqN.exe
  C:\Windows\System\fPzgKqN.exe
  2⤵
  PID:9864
- C:\Windows\System\QcSDeis.exe
  C:\Windows\System\QcSDeis.exe
  2⤵
  PID:9880
- C:\Windows\System\RsYZhOt.exe
  C:\Windows\System\RsYZhOt.exe
  2⤵
  PID:9896
- C:\Windows\System\TjeoMfO.exe
  C:\Windows\System\TjeoMfO.exe
  2⤵
  PID:9912
- C:\Windows\System\gaRjKgt.exe
  C:\Windows\System\gaRjKgt.exe
  2⤵
  PID:9928
- C:\Windows\System\iNnSqtI.exe
  C:\Windows\System\iNnSqtI.exe
  2⤵
  PID:9944
- C:\Windows\System\BhqWJMg.exe
  C:\Windows\System\BhqWJMg.exe
  2⤵
  PID:9960
- C:\Windows\System\VcXwHkk.exe
  C:\Windows\System\VcXwHkk.exe
  2⤵
  PID:9976
- C:\Windows\System\KmGqCYZ.exe
  C:\Windows\System\KmGqCYZ.exe
  2⤵
  PID:9992
- C:\Windows\System\upzmZLu.exe
  C:\Windows\System\upzmZLu.exe
  2⤵
  PID:10008
- C:\Windows\System\whSDQWl.exe
  C:\Windows\System\whSDQWl.exe
  2⤵
  PID:10032
- C:\Windows\System\nhCrzCR.exe
  C:\Windows\System\nhCrzCR.exe
  2⤵
  PID:10108
- C:\Windows\System\DRCjRsF.exe
  C:\Windows\System\DRCjRsF.exe
  2⤵
  PID:10124
- C:\Windows\System\oJMTDdT.exe
  C:\Windows\System\oJMTDdT.exe
  2⤵
  PID:10140
- C:\Windows\System\DOfxbsw.exe
  C:\Windows\System\DOfxbsw.exe
  2⤵
  PID:10156
- C:\Windows\System\NLQucOF.exe
  C:\Windows\System\NLQucOF.exe
  2⤵
  PID:10176
- C:\Windows\System\fQEcLrK.exe
  C:\Windows\System\fQEcLrK.exe
  2⤵
  PID:10228
- C:\Windows\System\oTMJiWP.exe
  C:\Windows\System\oTMJiWP.exe
  2⤵
  PID:8968
- C:\Windows\System\mXrBVPo.exe
  C:\Windows\System\mXrBVPo.exe
  2⤵
  PID:9280
- C:\Windows\System\fBhWmkb.exe
  C:\Windows\System\fBhWmkb.exe
  2⤵
  PID:8612
- C:\Windows\System\hyOPiUD.exe
  C:\Windows\System\hyOPiUD.exe
  2⤵
  PID:8344
- C:\Windows\System\hxrgVsq.exe
  C:\Windows\System\hxrgVsq.exe
  2⤵
  PID:9236
- C:\Windows\System\XjCpBrq.exe
  C:\Windows\System\XjCpBrq.exe
  2⤵
  PID:9296
- C:\Windows\System\zmYjXQj.exe
  C:\Windows\System\zmYjXQj.exe
  2⤵
  PID:9328
- C:\Windows\System\AhZYvDY.exe
  C:\Windows\System\AhZYvDY.exe
  2⤵
  PID:9408
- C:\Windows\System\BbqDbfm.exe
  C:\Windows\System\BbqDbfm.exe
  2⤵
  PID:9360
- C:\Windows\System\PopWEhG.exe
  C:\Windows\System\PopWEhG.exe
  2⤵
  PID:9396
- C:\Windows\System\kRxeXNp.exe
  C:\Windows\System\kRxeXNp.exe
  2⤵
  PID:9644
- C:\Windows\System\zaxOHEz.exe
  C:\Windows\System\zaxOHEz.exe
  2⤵
  PID:9528
- C:\Windows\System\tLSXhFi.exe
  C:\Windows\System\tLSXhFi.exe
  2⤵
  PID:9596
- C:\Windows\System\TurLKya.exe
  C:\Windows\System\TurLKya.exe
  2⤵
  PID:9680
- C:\Windows\System\WKnZwAO.exe
  C:\Windows\System\WKnZwAO.exe
  2⤵
  PID:9752
- C:\Windows\System\rYfVrTI.exe
  C:\Windows\System\rYfVrTI.exe
  2⤵
  PID:9664
- C:\Windows\System\wimpptc.exe
  C:\Windows\System\wimpptc.exe
  2⤵
  PID:8232
- C:\Windows\System\tFPjlro.exe
  C:\Windows\System\tFPjlro.exe
  2⤵
  PID:9828
- C:\Windows\System\qTNYVOu.exe
  C:\Windows\System\qTNYVOu.exe
  2⤵
  PID:9888
- C:\Windows\System\sNfAtij.exe
  C:\Windows\System\sNfAtij.exe
  2⤵
  PID:9924
- C:\Windows\System\uooCROi.exe
  C:\Windows\System\uooCROi.exe
  2⤵
  PID:9968
- C:\Windows\System\PqBXqRF.exe
  C:\Windows\System\PqBXqRF.exe
  2⤵
  PID:9872
- C:\Windows\System\WPSeOaF.exe
  C:\Windows\System\WPSeOaF.exe
  2⤵
  PID:9936
- C:\Windows\System\EDsHBRL.exe
  C:\Windows\System\EDsHBRL.exe
  2⤵
  PID:10004
- C:\Windows\System\xMeZWQs.exe
  C:\Windows\System\xMeZWQs.exe
  2⤵
  PID:10024
- C:\Windows\System\iQHOrTw.exe
  C:\Windows\System\iQHOrTw.exe
  2⤵
  PID:10056
- C:\Windows\System\jaZSPNb.exe
  C:\Windows\System\jaZSPNb.exe
  2⤵
  PID:10072
- C:\Windows\System\uSYOjnr.exe
  C:\Windows\System\uSYOjnr.exe
  2⤵
  PID:10084
- C:\Windows\System\xQUgTjJ.exe
  C:\Windows\System\xQUgTjJ.exe
  2⤵
  PID:9472
- C:\Windows\System\ljxxnCT.exe
  C:\Windows\System\ljxxnCT.exe
  2⤵
  PID:9544
- C:\Windows\System\veViuQl.exe
  C:\Windows\System\veViuQl.exe
  2⤵
  PID:9524
- C:\Windows\System\VEYujCx.exe
  C:\Windows\System\VEYujCx.exe
  2⤵
  PID:9776
- C:\Windows\System\PTMGegG.exe
  C:\Windows\System\PTMGegG.exe
  2⤵
  PID:9716
- C:\Windows\System\rLMIvAR.exe
  C:\Windows\System\rLMIvAR.exe
  2⤵
  PID:9920
- C:\Windows\System\GszCFbu.exe
  C:\Windows\System\GszCFbu.exe
  2⤵
  PID:10220
- C:\Windows\System\cVLvFNs.exe
  C:\Windows\System\cVLvFNs.exe
  2⤵
  PID:9252
- C:\Windows\System\ADAwPoT.exe
  C:\Windows\System\ADAwPoT.exe
  2⤵
  PID:9224
- C:\Windows\System\ulKLYKz.exe
  C:\Windows\System\ulKLYKz.exe
  2⤵
  PID:9444
- C:\Windows\System\lXLbUIk.exe
  C:\Windows\System\lXLbUIk.exe
  2⤵
  PID:9488
- C:\Windows\System\fuBHpaN.exe
  C:\Windows\System\fuBHpaN.exe
  2⤵
  PID:9632
- C:\Windows\System\GaLZHkF.exe
  C:\Windows\System\GaLZHkF.exe
  2⤵
  PID:9844
- C:\Windows\System\bDrPmmc.exe
  C:\Windows\System\bDrPmmc.exe
  2⤵
  PID:9768
- C:\Windows\System\LZkZaLX.exe
  C:\Windows\System\LZkZaLX.exe
  2⤵
  PID:9512
- C:\Windows\System\qZzvSxN.exe
  C:\Windows\System\qZzvSxN.exe
  2⤵
  PID:8768
- C:\Windows\System\UDSTEYQ.exe
  C:\Windows\System\UDSTEYQ.exe
  2⤵
  PID:10148
- C:\Windows\System\anzewMq.exe
  C:\Windows\System\anzewMq.exe
  2⤵
  PID:9904
- C:\Windows\System\nlQNXyt.exe
  C:\Windows\System\nlQNXyt.exe
  2⤵
  PID:9792
- C:\Windows\System\mSBvBMJ.exe
  C:\Windows\System\mSBvBMJ.exe
  2⤵
  PID:9732
- C:\Windows\System\HKSSODO.exe
  C:\Windows\System\HKSSODO.exe
  2⤵
  PID:10052
- C:\Windows\System\PRQrFQT.exe
  C:\Windows\System\PRQrFQT.exe
  2⤵
  PID:10188
- C:\Windows\System\sIosMPd.exe
  C:\Windows\System\sIosMPd.exe
  2⤵
  PID:9796
- C:\Windows\System\wOFxPBh.exe
  C:\Windows\System\wOFxPBh.exe
  2⤵
  PID:10212
- C:\Windows\System\TuqjfRI.exe
  C:\Windows\System\TuqjfRI.exe
  2⤵
  PID:10040
- C:\Windows\System\vyMShCY.exe
  C:\Windows\System\vyMShCY.exe
  2⤵
  PID:10196
- C:\Windows\System\ENlzkYB.exe
  C:\Windows\System\ENlzkYB.exe
  2⤵
  PID:9228
- C:\Windows\System\rjnjcXK.exe
  C:\Windows\System\rjnjcXK.exe
  2⤵
  PID:9572
- C:\Windows\System\pnNPidx.exe
  C:\Windows\System\pnNPidx.exe
  2⤵
  PID:8636
- C:\Windows\System\DbzRPSj.exe
  C:\Windows\System\DbzRPSj.exe
  2⤵
  PID:9824
- C:\Windows\System\nnQksoH.exe
  C:\Windows\System\nnQksoH.exe
  2⤵
  PID:10252
- C:\Windows\System\iqmAubp.exe
  C:\Windows\System\iqmAubp.exe
  2⤵
  PID:10268
- C:\Windows\System\LWVgDJs.exe
  C:\Windows\System\LWVgDJs.exe
  2⤵
  PID:10284
- C:\Windows\System\SYfwZlK.exe
  C:\Windows\System\SYfwZlK.exe
  2⤵
  PID:10304
- C:\Windows\System\jYyhxKO.exe
  C:\Windows\System\jYyhxKO.exe
  2⤵
  PID:10320
- C:\Windows\System\UWsaSUS.exe
  C:\Windows\System\UWsaSUS.exe
  2⤵
  PID:10336
- C:\Windows\System\DUAXZQY.exe
  C:\Windows\System\DUAXZQY.exe
  2⤵
  PID:10352
- C:\Windows\System\idySOOf.exe
  C:\Windows\System\idySOOf.exe
  2⤵
  PID:10368
- C:\Windows\System\iymtjZk.exe
  C:\Windows\System\iymtjZk.exe
  2⤵
  PID:10384
- C:\Windows\System\VqCQyOK.exe
  C:\Windows\System\VqCQyOK.exe
  2⤵
  PID:10400
- C:\Windows\System\AmHISAC.exe
  C:\Windows\System\AmHISAC.exe
  2⤵
  PID:10416
- C:\Windows\System\xUgcHSU.exe
  C:\Windows\System\xUgcHSU.exe
  2⤵
  PID:10432
- C:\Windows\System\NyMgKXC.exe
  C:\Windows\System\NyMgKXC.exe
  2⤵
  PID:10456
- C:\Windows\System\GRiCtKQ.exe
  C:\Windows\System\GRiCtKQ.exe
  2⤵
  PID:10472
- C:\Windows\System\VvlMECh.exe
  C:\Windows\System\VvlMECh.exe
  2⤵
  PID:10488
- C:\Windows\System\FompImS.exe
  C:\Windows\System\FompImS.exe
  2⤵
  PID:10508
- C:\Windows\System\erYKIbs.exe
  C:\Windows\System\erYKIbs.exe
  2⤵
  PID:10532
- C:\Windows\System\EqsVOqx.exe
  C:\Windows\System\EqsVOqx.exe
  2⤵
  PID:10556
- C:\Windows\System\zxpfOeM.exe
  C:\Windows\System\zxpfOeM.exe
  2⤵
  PID:10576
- C:\Windows\System\PudmPow.exe
  C:\Windows\System\PudmPow.exe
  2⤵
  PID:10592
- C:\Windows\System\SJrSRSo.exe
  C:\Windows\System\SJrSRSo.exe
  2⤵
  PID:10608
- C:\Windows\System\cEawzKv.exe
  C:\Windows\System\cEawzKv.exe
  2⤵
  PID:10628
- C:\Windows\System\yZpIplh.exe
  C:\Windows\System\yZpIplh.exe
  2⤵
  PID:10644
- C:\Windows\System\GlXRhFS.exe
  C:\Windows\System\GlXRhFS.exe
  2⤵
  PID:10660
- C:\Windows\System\xjXxeaO.exe
  C:\Windows\System\xjXxeaO.exe
  2⤵
  PID:10676
- C:\Windows\System\aXBORKb.exe
  C:\Windows\System\aXBORKb.exe
  2⤵
  PID:10748
- C:\Windows\System\NzROwcZ.exe
  C:\Windows\System\NzROwcZ.exe
  2⤵
  PID:10768
- C:\Windows\System\yQizxzQ.exe
  C:\Windows\System\yQizxzQ.exe
  2⤵
  PID:10816
- C:\Windows\System\KLsbkGY.exe
  C:\Windows\System\KLsbkGY.exe
  2⤵
  PID:10832
- C:\Windows\System\kzwxThl.exe
  C:\Windows\System\kzwxThl.exe
  2⤵
  PID:10848
- C:\Windows\System\gaAUZuh.exe
  C:\Windows\System\gaAUZuh.exe
  2⤵
  PID:10864
- C:\Windows\System\qrKMnls.exe
  C:\Windows\System\qrKMnls.exe
  2⤵
  PID:10880
- C:\Windows\System\tdJyyFQ.exe
  C:\Windows\System\tdJyyFQ.exe
  2⤵
  PID:10896
- C:\Windows\System\lKlVZPB.exe
  C:\Windows\System\lKlVZPB.exe
  2⤵
  PID:10916
- C:\Windows\System\PAoCHXO.exe
  C:\Windows\System\PAoCHXO.exe
  2⤵
  PID:10932
- C:\Windows\System\ndKOFcf.exe
  C:\Windows\System\ndKOFcf.exe
  2⤵
  PID:10948
- C:\Windows\System\TNKnqnx.exe
  C:\Windows\System\TNKnqnx.exe
  2⤵
  PID:10964
- C:\Windows\System\nvhTIlf.exe
  C:\Windows\System\nvhTIlf.exe
  2⤵
  PID:10980
- C:\Windows\System\gOiwUIW.exe
  C:\Windows\System\gOiwUIW.exe
  2⤵
  PID:10996
- C:\Windows\System\CULOTDM.exe
  C:\Windows\System\CULOTDM.exe
  2⤵
  PID:11016
- C:\Windows\System\QILzWsH.exe
  C:\Windows\System\QILzWsH.exe
  2⤵
  PID:11032
- C:\Windows\System\WmtMEmr.exe
  C:\Windows\System\WmtMEmr.exe
  2⤵
  PID:11056
- C:\Windows\System\UdOHGiO.exe
  C:\Windows\System\UdOHGiO.exe
  2⤵
  PID:11072
- C:\Windows\System\RzHiZsp.exe
  C:\Windows\System\RzHiZsp.exe
  2⤵
  PID:11092
- C:\Windows\System\fSkiYwJ.exe
  C:\Windows\System\fSkiYwJ.exe
  2⤵
  PID:11192
- C:\Windows\System\EVCHygS.exe
  C:\Windows\System\EVCHygS.exe
  2⤵
  PID:11208
- C:\Windows\System\GVGMVgC.exe
  C:\Windows\System\GVGMVgC.exe
  2⤵
  PID:11224
- C:\Windows\System\rDSoNZX.exe
  C:\Windows\System\rDSoNZX.exe
  2⤵
  PID:11244
- C:\Windows\System\WPpsmnA.exe
  C:\Windows\System\WPpsmnA.exe
  2⤵
  PID:11260
- C:\Windows\System\cdPcycg.exe
  C:\Windows\System\cdPcycg.exe
  2⤵
  PID:10080
- C:\Windows\System\tLNsRFW.exe
  C:\Windows\System\tLNsRFW.exe
  2⤵
  PID:9492
- C:\Windows\System\iCSQqvy.exe
  C:\Windows\System\iCSQqvy.exe
  2⤵
  PID:10360
- C:\Windows\System\VawvDvf.exe
  C:\Windows\System\VawvDvf.exe
  2⤵
  PID:10464
- C:\Windows\System\crOkjAy.exe
  C:\Windows\System\crOkjAy.exe
  2⤵
  PID:10236
- C:\Windows\System\jLbhdev.exe
  C:\Windows\System\jLbhdev.exe
  2⤵
  PID:9612
- C:\Windows\System\msPKlKl.exe
  C:\Windows\System\msPKlKl.exe
  2⤵
  PID:9956
- C:\Windows\System\jeiWZfW.exe
  C:\Windows\System\jeiWZfW.exe
  2⤵
  PID:10296
- C:\Windows\System\ZNajPgt.exe
  C:\Windows\System\ZNajPgt.exe
  2⤵
  PID:10392
- C:\Windows\System\zSJHghB.exe
  C:\Windows\System\zSJHghB.exe
  2⤵
  PID:10548
- C:\Windows\System\ZKLyOif.exe
  C:\Windows\System\ZKLyOif.exe
  2⤵
  PID:10652
- C:\Windows\System\vaPmbpy.exe
  C:\Windows\System\vaPmbpy.exe
  2⤵
  PID:9504
- C:\Windows\System\vaaqCWN.exe
  C:\Windows\System\vaaqCWN.exe
  2⤵
  PID:9840
- C:\Windows\System\odcJWsg.exe
  C:\Windows\System\odcJWsg.exe
  2⤵
  PID:9312
- C:\Windows\System\znXKtUu.exe
  C:\Windows\System\znXKtUu.exe
  2⤵
  PID:10172
- C:\Windows\System\NTJwaOe.exe
  C:\Windows\System\NTJwaOe.exe
  2⤵
  PID:9316
- C:\Windows\System\tLEGxbc.exe
  C:\Windows\System\tLEGxbc.exe
  2⤵
  PID:10276
- C:\Windows\System\UtFTzIG.exe
  C:\Windows\System\UtFTzIG.exe
  2⤵
  PID:10344
- C:\Windows\System\sKJUQTH.exe
  C:\Windows\System\sKJUQTH.exe
  2⤵
  PID:9728
- C:\Windows\System\pIhagDT.exe
  C:\Windows\System\pIhagDT.exe
  2⤵
  PID:10804
- C:\Windows\System\DGzSFIY.exe
  C:\Windows\System\DGzSFIY.exe
  2⤵
  PID:10872
- C:\Windows\System\OVKpXvQ.exe
  C:\Windows\System\OVKpXvQ.exe
  2⤵
  PID:10912
- C:\Windows\System\gwAePhn.exe
  C:\Windows\System\gwAePhn.exe
  2⤵
  PID:10976
- C:\Windows\System\IxyUBSq.exe
  C:\Windows\System\IxyUBSq.exe
  2⤵
  PID:11040
- C:\Windows\System\upHaIxV.exe
  C:\Windows\System\upHaIxV.exe
  2⤵
  PID:11080
- C:\Windows\System\eVTGfoj.exe
  C:\Windows\System\eVTGfoj.exe
  2⤵
  PID:10828
- C:\Windows\System\PUbojHW.exe
  C:\Windows\System\PUbojHW.exe
  2⤵
  PID:10928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\HRoKGhn.exe

Filesize
1.3MB

MD5
d75ff18ed4b53b1f00ceff3598af3ee6

SHA1
9b64935174708e02fd1b6342659ca4363473d897

SHA256
8fcbb2aaf3e3a1aa3433f3a30f4da3e1efc4770e8e2e73fd68486e972ee94b25

SHA512
cff5b4a7fb8b787e315709323bcbca7a73cf8f3bcf4c3c67051a96334ac9647c9771fbce167e8325de5921b501cd71876148b4993bec5b4abb3d99a81ae433f6

Download Submit
C:\Windows\system\HkSpUKZ.exe

Filesize
1.3MB

MD5
b847437e1b71d5f90c43ab75c139372a

SHA1
0a949463b9fb56fcce5a870a4e68eb021fa0124f

SHA256
c95be4db3f46558d0539e27dac928a4f890bf7a767affe5c3f022f052d12260e

SHA512
b05f16b0aec01609e769b50c7b1a5aee87d0ff1c25c8c8aa5bf1815b1b76dcab99ce63e8c5e46522f6480cd6d466a0d530ec9e448844336b408ef8e40aca82ce

Download Submit
C:\Windows\system\ImoGGpJ.exe

Filesize
1.3MB

MD5
38942f9a9cae2f5d5beb1f95dfc6127f

SHA1
01491818c7f651b85499802dbee8c4d0cd192d6c

SHA256
d76880a3f36178adcbc12b3c7d187842c767b476f98288ab4458b03cc95ebb4e

SHA512
f9e2def516cf610bdb40c5af3d1ba7b72196c3cd7d30a16fb70f518fabf0ef82ca1bac77b104cb6c76e11d08773ccfbdf9aed41e95a7ba45e36d509d4c19c969

Download Submit
C:\Windows\system\MNaFrsW.exe

Filesize
1.3MB

MD5
27da600dac82c9f1a8c6414486874f68

SHA1
3655438c528bf2dc0510cdf6d4745856ea87810c

SHA256
6447dca99a7a47d507da2f940428ded266060ae0fd2e624a955f6ba4ec6acb60

SHA512
2b2063772938ab3b6c429a5766914000b00cdeea0beca653132732271984993e8fab1722a5d7e3c10cfbdc7fda346efe36b342567c7fa6459c06c0615a275089

Download Submit
C:\Windows\system\NeLeTHs.exe

Filesize
1.3MB

MD5
8cbb28fa4b6f60394d01f986af472a0d

SHA1
c08bbcc3c6e2cbd606ee1a27eddad81e52be5b17

SHA256
cfe87644ab49178fcd8409b093e834121d83ac6bfe562df4227b4b05be5841f4

SHA512
4162efaa22e8262a1692b4fa0fc48bf8cfe1884d22dcbb3e320862c8e63d6c4826eebd11d950bb6365196cca626a6d66c24951f5d7424e8faec89f3308729846

Download Submit
C:\Windows\system\PtXotnk.exe

Filesize
1.3MB

MD5
e58d3921a9ff2b9c506207d6455cc6d5

SHA1
18974cd04a95d22be075ba012d6e67dc0e0a3d5d

SHA256
8c714e0de64a5272c93ae47223bc5f11ab1561aa28794fdd6c8f85b61a5d77e4

SHA512
eae07b8f77057d1c67f97d83d52c6837865d9fa5b0cf5f23d9beef348974658e47de7474839e4f22b0a02d46c87ddfc6589188cd2fa5aec7ad793737f9d97b57

Download Submit
C:\Windows\system\TRiAXaZ.exe

Filesize
1.3MB

MD5
7bf55c1073d3e62b51e5298622b456a6

SHA1
499842a45713ad5eb76ba556d51bec4484203f6e

SHA256
ea1003d7496497af425b977fe3b7ad458feed48961b0456c2e3f924fde32165f

SHA512
2de34949338949de277adb58721b6bc7ddf27a95666257af56d82f26add65f8085781f1432b7ab96250cab9e33ddc9d2badaf1c8d4f26ff1f6e3387952269d98

Download Submit
C:\Windows\system\TzFDVso.exe

Filesize
1.3MB

MD5
5d7331f9b906edff5c88101a5f89dccb

SHA1
6c9a9b5690e94fb35b911a8f784f5ba2b828c67a

SHA256
d07c4bd5ef56524882cfd75edac44256e7e5a67022cab984d9ca5253a15c6dc9

SHA512
ffc97f7dff27e50927cef0ec997d1606bf21343c1adecfd3d94f82c8bb85857459fb960d8d65bb66876bc136328eae569d9ed78838bd09601aeb1c0ab75c64f3

Download Submit
C:\Windows\system\UHJOxHB.exe

Filesize
1.3MB

MD5
7ed21f0cf11561b69bcd92c925d78511

SHA1
b6c64b0fae56558ec5e253d971d4dc27450f013b

SHA256
5b135c350c2f91ac44347f7c53455f12bf960512637c74a125d32cd16aeb317e

SHA512
fb8a6ceee1f0e9ae0c2a661af82c81f6c053f5da0f74a78c65907ec816eb1323024be3ced49a6aa2854e2291c7fb72392eb181e9987e33caab6488c44a489b60

Download Submit
C:\Windows\system\UeeHJNU.exe

Filesize
1.3MB

MD5
83796f8840e789afec3a34d03383ee9f

SHA1
2d9e12d978d93d2476ae69fe12ef81228c3e98de

SHA256
e45c121c5188204be6c10d87baa9f89ee81d9962ecd4363ab49b51409fb7a28a

SHA512
22b5fd3552670c1da8b81c9b8ae46e79c792c627b49122377cfb8d1e790b40923e173fdf69431691a73d99cf460bae54179541be3973e425a5d3f74dd065af5d

Download Submit
C:\Windows\system\WfuJPLU.exe

Filesize
1.3MB

MD5
1c84908ea609dd6ab05450ff2ea197e6

SHA1
a0149d8130cac23d8ba65662d71ad43a50e7977e

SHA256
3e02eec7d3e86b741a6ac871579239e450f508ffe117d958b2df2b60b0e420a2

SHA512
9dd3012d59db9a8471829cfb21710125629bf80067e306cf9442dedff4f26ae9dfc4a246c7a078f88b5b8bba76e5f1eca579fff97a38eb72da39e50dfac71116

Download Submit
C:\Windows\system\YHFkACS.exe

Filesize
1.3MB

MD5
993fb94e1173de0e2a693ab5bdf30dc9

SHA1
3ed7cdbf20efd4bc802d9efcc0996501795250a2

SHA256
5d4c125640014f5b1b0f4b9d53a4670708349d6761faa5a3d86057a40612693c

SHA512
844efbf00ffda08ca18ec5297fe802a484e661dbc5c2ad50d45b4b4342318cdb09049fd7a54911350ce19de97e9cf1908f84ae8a70b065bc91cd43d306045279

Download Submit
C:\Windows\system\aMtpQjs.exe

Filesize
8B

MD5
9cb4bf9fd9671df0839f651b7291ada1

SHA1
65a07e22b4bb88cf278eb1826c308150ded29593

SHA256
7188099eb9c8547d41ed9f4696ce901a0066852814ae83835a5ed6cbffc1cf40

SHA512
6f35a15b3248c656029fbcfa880774f447f590d87875077936e1e0e583b3b4b43f507832937ba7994137923090cc3abaa893880b066cf5189f7fd87f77593929

Download Submit
C:\Windows\system\bqqwnoB.exe

Filesize
1.3MB

MD5
c91892fc7f7823f23f8278549263c2e0

SHA1
1b05244d58ac17d28dea588ee792b7587856649b

SHA256
cccad582c0414d12a96b4c1f29c58bef3e849e81e3a769a8dc87f04ace8a962d

SHA512
ee87541d780ce1c0bc89f55152389b7a7cd6b0c6f3b0009fc54409d72dbb56ca41f474db04de493087dfc56e73952e1b2c739408d4873031b10ebb2f8ac6f43d

Download Submit
C:\Windows\system\dFeOnin.exe

Filesize
1.3MB

MD5
e08f26a9fb8b2e2bda1e3f4dc1070177

SHA1
ae570eabfae53b740ff62420397ef39014bb7299

SHA256
51996a0bb89032790c64041ff7f6743088466ab44ea55c225d9b4af18dc11ece

SHA512
b1885884bd34819dc78bb6aa0f5bf7f85aa480bd4eff89a64c9804227c097835f5d2a4eb010dfc98fd9b2d403f12889f8a061a7852ecf6ba94147410e99daf2f

Download Submit
C:\Windows\system\gkaSAeU.exe

Filesize
1.3MB

MD5
91cab066aafd9ead12adc25efd9527c6

SHA1
06e4dd950e09568653a0b4d6cc1ffd25933beb73

SHA256
92c458cd9ff43123cddd85e392235bf3f9cce6e16d7d8b25c182630ba8c9fa98

SHA512
f34810de0e7319c765023ebd5a411b511ed316d2dcba879c01a1ae7625de2588e48d582dcb8d23b660ace284a84d3f214b608b2123c6b876f94e47e81ea291f0

Download Submit
C:\Windows\system\gyXBkmn.exe

Filesize
1.3MB

MD5
e3517e98c379e382e55cbadf2bd7d8fc

SHA1
6fc3a3ae29e463fe4bf3da9e9663aa1d07d4ad34

SHA256
ba16583ed9bc2bf4ec91fce955dc2135ed20c0c77fc8cdd5af34377a94bb2f7e

SHA512
e5a047194cac9f9b39f5309b1c100f3fe17ef13809634dd9947ba8867805b4e61115c386ec6e59c23765a74fea21c54595425e2079b8bbe3ac5ca7e4e5daca9c

Download Submit
C:\Windows\system\iOPFCcW.exe

Filesize
1.3MB

MD5
ba94e5fe4d42bc1d9c60099966fb1e26

SHA1
dcc70717ffa2c4a74c46aed956bb87e26ced1759

SHA256
86ff7c375cf15b6f677eff76ebf87644f9c9f08dbd9e1fa8730dfcd1662c3f48

SHA512
f9d50ef1ef67bc2de6fc5450a8ee6cac8b2dc7cd8acb9cad4340fc423a620f5b8f5ec933f13d714523019b0aa5404646c0100f6f183c355b77a7a7077a8ac243

Download Submit
C:\Windows\system\iftCPgR.exe

Filesize
1.3MB

MD5
9962c86652693f15d58ec488d75376f9

SHA1
4e3a19896dc5fc4e15a8c00953d58852341989ae

SHA256
cd13ae92a29f7f37b9f9a5910ac7115af5eba661fc6d71e8301588ab88360eac

SHA512
70f256bcd53bb95b25e54acc5db7bcf0ab4fdc5ceef62bb70f46d94ff81d34ad0d93e5d223c59b791fd0c40d1bd3e97ce60ad1b69d454c391c51b76e2d0ee6fa

Download Submit
C:\Windows\system\iiTXjVH.exe

Filesize
1.3MB

MD5
9646bccf4ec9ded68bf2fd74c0cda147

SHA1
a5689dc77af6dd2219035207212fed9f129829f9

SHA256
f14e05d034759877cfdd9e48c888c9f41467fa7532ce43644065c306adad3692

SHA512
96ba11b359eb7716c4d59520c26dcb7e9fc15a84cd9aecd922d3d885e76f6e3766b399dc037d1d1d7cf293e2fa544b95f11fa28950e7045f9ea8c9ffddf32191

Download Submit
C:\Windows\system\kPfjtcd.exe

Filesize
1.3MB

MD5
02cd8388b2d5528b782bddaf455079ee

SHA1
b8673da3eeb0344e7002f9f39aaa291c311efc80

SHA256
75cca19386ba07c296fe1411e20ebc466b6945356d424ff085754798a2975ba1

SHA512
6a12cef089a409788c06742c9fbe767b7c215a55a73c692fbaac05a89fe29c4c08de317b91ed47dd3f3cda0609db42861f5f4f01faf587cb2f9b0fea39ec74a1

Download Submit
C:\Windows\system\lclkOuU.exe

Filesize
1.3MB

MD5
e4e8fa16c4d21de0c8ef1702bf7252ae

SHA1
74bd5c7309ff6feca9557ef8e62979334ebc52d9

SHA256
1d00215fc453f922225a1aee140492ccc179f28cae113443d3b25b3ec9165aa2

SHA512
5646177c22b10cb22eed542c674b7907bfa62e063412aeffad23dbc87efd3d728f7833b1343be4337680683848185d0d8635f2d280f1e959ba68bf53c5c206ee

Download Submit
C:\Windows\system\nIVuFxh.exe

Filesize
1.3MB

MD5
29dcfe230c2ffa97380622399fa8f846

SHA1
5b5db3eabb78ef99c142bc865341713b72b09dcb

SHA256
42bb5dea7eac0dab944f09cb3c657b06000fd746b3c51e04b96bba3e894814a0

SHA512
9d57f729d678d4c0026cfe3e840081dd8c98985357292822e41ebdc6ab5ba06ad232a30e1e906d10c8fa47d919eb941492b4cd3758f955dd05f624f1f1c3180f

Download Submit
C:\Windows\system\ngiGAxn.exe

Filesize
1.3MB

MD5
4a6e8cb151b71bba5e3adcf408790c78

SHA1
3589111ac81017dc25be9a18658568b29fb2c446

SHA256
534d0ce5495db4ffd9c71d9928333113ce2ea5df8e214ed8e48a0f7dbbc6f62a

SHA512
ec7aeb226c59b70987d7adce910e814cfdc70283381e95bc1a3c1f095afa62192e7e32749b75989d32e8baa9821d4e591e091c7e5b85e19bbd11dc03a27c8e95

Download Submit
C:\Windows\system\pkgPkmL.exe

Filesize
1.3MB

MD5
865c1e89c40a4cce97cbdb03645f8545

SHA1
a6eb3a78d53796cfacf315349391f46ad58e25c0

SHA256
fdd7389603d31e9a1a7ea62b5d96c50fdd5beb0a77bb075d2d9cecff3c4918b9

SHA512
3470f809b28c78a5a881dcb44103cf6afe53440d079b7a36a6334658381d4a28c35310a1442bbdac4cdfc948d59636fe475b8c0ca7b2a0f12daa7e8212550120

Download Submit
C:\Windows\system\pystnKr.exe

Filesize
1.3MB

MD5
3e4a03bb2f6e32bf3e574bb6ed127d0b

SHA1
9aea117835ec0de2a1d88d9f93edb1e0f59ea7a2

SHA256
04debab98bb1fbd9e3477d2e67e3ad338670696cf38c2fc202ebd8b87b13f63a

SHA512
b470c0770817665118d52a1cf4abc97dbcd36bb79706795dbdc351408d4c3745641d26112cc41696709260e3fe5b46c5df4821d0767b39bf31678fca1a303801

Download Submit
C:\Windows\system\qNYdeLZ.exe

Filesize
1.3MB

MD5
dcd6c68593bc3e868d95f993cf667868

SHA1
4c8b7fedeafc118f7b8b8c780a83195d4e2c945c

SHA256
9969f3ccd7d4583c747778f8bd2db28b67c8db61f2576a4fe1f925f216f5b295

SHA512
dce4c979eddf5b2f61c6271ff6ab6b210835d434910ce3de271c7c827878d5e8fb7278e88d8a7ccd031a65c94b48028d5729eab41e94f86642d68511e2443890

Download Submit
C:\Windows\system\rHheNtP.exe

Filesize
1.3MB

MD5
7096fceced3c3ac41607387a1f39a9ed

SHA1
41e4f8ba7783e065abec2abc00133b352d742499

SHA256
cfcd66e6abe6df07000c3d4976d206fe9e8e3c296deb4efe14f012e8e4513d05

SHA512
ea4867c17d3eb6a5f935e23205b0a01497fecb347ef36a8832dc26efe27929361e71c305cf4df94123ab7dc08df36cfbcdd87255a4dfac7a46f9355793cedf36

Download Submit
C:\Windows\system\uKShGHq.exe

Filesize
1.3MB

MD5
805ffa069b399f8508eb7fd55359305d

SHA1
2e83485895e16e7f11f561c54f5a141219b5b912

SHA256
9736236b8c7edf507b57281fbec3232178d5d09ab9ddd74188ac53f90f04f32f

SHA512
3d05340c2ecafcccceead5d21c7962c28760775faca9adc826102c2d1d4f87de5482c10134e375860955a6194fadfa60e9baa6d0029ab10d7bc1a63c709588e0

Download Submit
C:\Windows\system\zSBUUyz.exe

Filesize
1.3MB

MD5
5b369a655219e6a0641c3163b6e4b001

SHA1
840032a34fc62a850723503b499a31b60df6b751

SHA256
abe84da174fa386b45e5349cd366eb286d4b23d74247baaa6ed12bc21b3096a1

SHA512
98a60ff3dfb2475d380059a01883b5f1bd3d68cfc31d5de4410a6db0df1b39c46ffcc8d94e6a317f554c41accc989b180a4af0e92e072fde06504a8d7b06bab7

Download Submit
C:\Windows\system\zWdHSjS.exe

Filesize
1.3MB

MD5
9f91ed2556817d9d7f855935c297b543

SHA1
5f1f754c203f06ead21545b99dc9822efd046cf2

SHA256
739b436fba61787ef055c697c15ddf6a8f8718610eae088f4be46817e3a7287a

SHA512
83729f24d43582481f4e13276d977ae8794450076bbc2dbf077172fa84fb887fb35794b772a9a5f5e0960fd49a4af6f24714139e8b590ad1d7a675ffca9c2a78

Download Submit
C:\Windows\system\zqvZYwn.exe

Filesize
1.3MB

MD5
f116cdabf87802bb37fd2d8341f1d4c7

SHA1
b012f8ea936a3034251d75637b816e66068e2628

SHA256
32c2ae7494df21c9eda32b0e962244ef97e74fd053c7a1a39cde4968a44a86e8

SHA512
189c7be5fbc8fbcd8cacbd9dc79b1adefbf6b718bffbbe86d9cc033bea78e302f8cf34593acd865fc6e04ae885b0abb5c6c1f501bff0da344b4aff5bee38cfce

Download Submit
\Windows\system\WmBfyiY.exe

Filesize
1.3MB

MD5
666041e8cae3d7b7ff13eaf2fa487513

SHA1
e58940e8b75dbfa9b077d27e73ec4d8963bea1b8

SHA256
0c5fbbbfe40fc2fc7948597f32079840926b5a7e01c7764303fb9819485955d4

SHA512
d4907f07ee8206eacf77abba881e522b6a8351c082efc27c7806ac11a19653bc8d143ac8e2e1904e4827aa3f82489f65b8d4995245377d826da9dd9f07a47185

Download Submit
memory/1388-79-0x000000013F320000-0x000000013F712000-memory.dmp

Filesize
3.9MB

Download
memory/1388-4343-0x000000013F320000-0x000000013F712000-memory.dmp

Filesize
3.9MB

Download
memory/1948-72-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/1948-4329-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/2164-54-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Filesize
3.9MB

Download
memory/2244-85-0x000000013FDB0000-0x00000001401A2000-memory.dmp

Filesize
3.9MB

Download
memory/2256-65-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/2296-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2296-71-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/2296-1-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/2296-58-0x000000013F5E0000-0x000000013F9D2000-memory.dmp

Filesize
3.9MB

Download
memory/2296-55-0x0000000003420000-0x0000000003812000-memory.dmp

Filesize
3.9MB

Download
memory/2296-51-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Filesize
3.9MB

Download
memory/2296-8648-0x0000000003420000-0x0000000003812000-memory.dmp

Filesize
3.9MB

Download
memory/2296-46-0x000000013FA50000-0x000000013FE42000-memory.dmp

Filesize
3.9MB

Download
memory/2296-10163-0x0000000003420000-0x0000000003812000-memory.dmp

Filesize
3.9MB

Download
memory/2296-78-0x0000000003420000-0x0000000003812000-memory.dmp

Filesize
3.9MB

Download
memory/2296-1945-0x0000000003420000-0x0000000003812000-memory.dmp

Filesize
3.9MB

Download
memory/2296-1323-0x0000000003420000-0x0000000003812000-memory.dmp

Filesize
3.9MB

Download
memory/2296-52-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/2296-48-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2296-61-0x0000000003420000-0x0000000003812000-memory.dmp

Filesize
3.9MB

Download
memory/2296-41-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/2400-49-0x00000000028E0000-0x00000000028E8000-memory.dmp

Filesize
32KB

Download
memory/2400-53-0x00000000026D0000-0x0000000002750000-memory.dmp

Filesize
512KB

Download
memory/2400-1322-0x00000000026D0000-0x0000000002750000-memory.dmp

Filesize
512KB

Download
memory/2400-40-0x000000001B730000-0x000000001BA12000-memory.dmp

Filesize
2.9MB

Download
memory/2508-4356-0x000000013F0A0000-0x000000013F492000-memory.dmp

Filesize
3.9MB

Download
memory/2508-91-0x000000013F0A0000-0x000000013F492000-memory.dmp

Filesize
3.9MB

Download
memory/2820-50-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2824-57-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/2920-4203-0x000000013F5E0000-0x000000013F9D2000-memory.dmp

Filesize
3.9MB

Download
memory/2920-44-0x000000013F5E0000-0x000000013F9D2000-memory.dmp

Filesize
3.9MB

Download
memory/2980-47-0x000000013FA50000-0x000000013FE42000-memory.dmp

Filesize
3.9MB

Download
memory/2992-43-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/2992-4135-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/3024-56-0x000000013F120000-0x000000013F512000-memory.dmp

Filesize
3.9MB

Download