xmrig | 3b802972c0b90d5df4fcabe2f1c29955ccaa17a5100536cd845687f430c5b317

Analysis

max time kernel
120s
max time network
118s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
03/08/2024, 04:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
Size

2.1MB
MD5

4cc6293b8fdcb31f470b90aa1a2f0d20
SHA1

5a5cfdf6a6465db56974f24f6430b0d6f8e420e0
SHA256

3b802972c0b90d5df4fcabe2f1c29955ccaa17a5100536cd845687f430c5b317
SHA512

01904618323e2e88e99f2af6b8af3e7567c65ded9228b1f924c74aaf2d3b38fb8fe2149c03efed4e8536e61f734c3969ce1ac2c1019b1decb0ae64f2aea4f707
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PT0nVs:NABJ

Score

10^/10

xmrig execution miner persistence privilege_escalation upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 25 IoCs

miner

resource	yara_rule
behavioral1/memory/2172-23-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	xmrig
behavioral1/memory/2524-104-0x000000013FAA0000-0x000000013FE92000-memory.dmp	xmrig
behavioral1/memory/2820-109-0x000000013FFC0000-0x00000001403B2000-memory.dmp	xmrig
behavioral1/memory/2160-108-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	xmrig
behavioral1/memory/2884-106-0x000000013F150000-0x000000013F542000-memory.dmp	xmrig
behavioral1/memory/2252-102-0x000000013FFB0000-0x00000001403A2000-memory.dmp	xmrig
behavioral1/memory/2724-100-0x000000013FCF0000-0x00000001400E2000-memory.dmp	xmrig
behavioral1/memory/2668-98-0x000000013F1A0000-0x000000013F592000-memory.dmp	xmrig
behavioral1/memory/1496-97-0x000000013F1A0000-0x000000013F592000-memory.dmp	xmrig
behavioral1/memory/2728-96-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	xmrig
behavioral1/memory/2888-94-0x000000013FC90000-0x0000000140082000-memory.dmp	xmrig
behavioral1/memory/1872-92-0x000000013F060000-0x000000013F452000-memory.dmp	xmrig
behavioral1/memory/2824-90-0x000000013F240000-0x000000013F632000-memory.dmp	xmrig
behavioral1/memory/2252-4002-0x000000013FFB0000-0x00000001403A2000-memory.dmp	xmrig
behavioral1/memory/2824-4001-0x000000013F240000-0x000000013F632000-memory.dmp	xmrig
behavioral1/memory/2668-4006-0x000000013F1A0000-0x000000013F592000-memory.dmp	xmrig
behavioral1/memory/2728-4007-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	xmrig
behavioral1/memory/2888-4005-0x000000013FC90000-0x0000000140082000-memory.dmp	xmrig
behavioral1/memory/2172-4004-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	xmrig
behavioral1/memory/2884-4003-0x000000013F150000-0x000000013F542000-memory.dmp	xmrig
behavioral1/memory/2724-4011-0x000000013FCF0000-0x00000001400E2000-memory.dmp	xmrig
behavioral1/memory/2160-4013-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	xmrig
behavioral1/memory/2820-4014-0x000000013FFC0000-0x00000001403B2000-memory.dmp	xmrig
behavioral1/memory/2524-4017-0x000000013FAA0000-0x000000013FE92000-memory.dmp	xmrig
behavioral1/memory/1872-4016-0x000000013F060000-0x000000013F452000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2408	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2172	sBJhVfE.exe
2820	gxnFxIi.exe
2824	pZekcGZ.exe
1872	mjohiYp.exe
2888	IQlPUmP.exe
2728	OHzTTEx.exe
2668	iDFrqAb.exe
2724	wljUvvT.exe
2252	JbhaDZJ.exe
2524	SUgvdOa.exe
2884	IEtANCt.exe
2160	vBdDOhR.exe
2508	QAodFDY.exe
2332	tDTrEeK.exe
2008	njHeiKc.exe
2100	OduXMZQ.exe
316	JdwCLiL.exe
1112	eBLKqOe.exe
1600	cNeboWe.exe
2876	PwwqSmw.exe
2036	FPuoFQb.exe
1156	nwrILOi.exe
696	bXpIHPV.exe
1952	wyDOyRC.exe
1412	VqdzyBf.exe
1492	iMIVfCF.exe
788	WQXAnYD.exe
1476	hVjyfyh.exe
2488	wcjCtfp.exe
1344	kokyIYl.exe
2140	OFCvRhF.exe
884	GMVLyOl.exe
2452	zhfCWpP.exe
920	ITbDApX.exe
2416	RCCcGLd.exe
1892	BXKGVOl.exe
1736	BOWaweX.exe
1884	pxOazGA.exe
1348	qYmsnYa.exe
2868	JovZIMI.exe
1096	GcfsYKY.exe
2496	fKLygWT.exe
560	vCbOTLn.exe
280	qlQftPD.exe
1524	BSzWjrF.exe
888	OqqiJIm.exe
680	ODFptQJ.exe
2304	wOwwDij.exe
1716	fXBZBce.exe
1612	dlCjZBk.exe
1376	fkvxxBy.exe
2288	Pmbopjb.exe
2808	LzMhbFh.exe
2680	xxWMktP.exe
2848	nPZOzWU.exe
2676	nTyOzcX.exe
2796	YkmaYwu.exe
3012	jMqoBLn.exe
1280	jZYLzpq.exe
2404	qhbwtaC.exe
2360	toDMvjY.exe
1904	KkPxbla.exe
2880	TfxPGjV.exe
772	wNeSAVs.exe

Loads dropped DLL 64 IoCs

pid	Process
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe

UPX packed file 58 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1496-0-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	upx
behavioral1/files/0x00080000000120f9-3.dat	upx
behavioral1/files/0x0009000000016433-7.dat	upx
behavioral1/files/0x0008000000016527-9.dat	upx
behavioral1/files/0x000f00000000549c-26.dat	upx
behavioral1/memory/2172-23-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	upx
behavioral1/files/0x0007000000016c49-44.dat	upx
behavioral1/files/0x00050000000193c5-59.dat	upx
behavioral1/files/0x00050000000193df-63.dat	upx
behavioral1/files/0x000500000001940b-71.dat	upx
behavioral1/files/0x0005000000019409-68.dat	upx
behavioral1/files/0x00050000000193bb-55.dat	upx
behavioral1/files/0x0009000000016c5a-51.dat	upx
behavioral1/files/0x0007000000016c51-48.dat	upx
behavioral1/files/0x0007000000016a93-39.dat	upx
behavioral1/files/0x00090000000167b4-35.dat	upx
behavioral1/memory/2524-104-0x000000013FAA0000-0x000000013FE92000-memory.dmp	upx
behavioral1/files/0x000500000001961b-174.dat	upx
behavioral1/files/0x000500000001945a-184.dat	upx
behavioral1/files/0x0005000000019619-168.dat	upx
behavioral1/files/0x000500000001961d-177.dat	upx
behavioral1/files/0x0005000000019613-160.dat	upx
behavioral1/files/0x000500000001960d-152.dat	upx
behavioral1/files/0x0005000000019609-144.dat	upx
behavioral1/files/0x00050000000195d8-137.dat	upx
behavioral1/files/0x000500000001950b-129.dat	upx
behavioral1/files/0x000500000001961e-182.dat	upx
behavioral1/files/0x0005000000019615-166.dat	upx
behavioral1/files/0x000500000001960f-158.dat	upx
behavioral1/files/0x000500000001960b-149.dat	upx
behavioral1/files/0x0005000000019607-142.dat	upx
behavioral1/files/0x0005000000019452-114.dat	upx
behavioral1/files/0x0005000000019585-133.dat	upx
behavioral1/files/0x00050000000194f7-126.dat	upx
behavioral1/files/0x0037000000015fd2-118.dat	upx
behavioral1/memory/2820-109-0x000000013FFC0000-0x00000001403B2000-memory.dmp	upx
behavioral1/memory/2160-108-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	upx
behavioral1/memory/2884-106-0x000000013F150000-0x000000013F542000-memory.dmp	upx
behavioral1/memory/2252-102-0x000000013FFB0000-0x00000001403A2000-memory.dmp	upx
behavioral1/memory/2724-100-0x000000013FCF0000-0x00000001400E2000-memory.dmp	upx
behavioral1/memory/2668-98-0x000000013F1A0000-0x000000013F592000-memory.dmp	upx
behavioral1/memory/2728-96-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	upx
behavioral1/memory/2888-94-0x000000013FC90000-0x0000000140082000-memory.dmp	upx
behavioral1/memory/1872-92-0x000000013F060000-0x000000013F452000-memory.dmp	upx
behavioral1/memory/2824-90-0x000000013F240000-0x000000013F632000-memory.dmp	upx
behavioral1/files/0x0005000000019427-75.dat	upx
behavioral1/memory/2252-4002-0x000000013FFB0000-0x00000001403A2000-memory.dmp	upx
behavioral1/memory/2824-4001-0x000000013F240000-0x000000013F632000-memory.dmp	upx
behavioral1/memory/2668-4006-0x000000013F1A0000-0x000000013F592000-memory.dmp	upx
behavioral1/memory/2728-4007-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	upx
behavioral1/memory/2888-4005-0x000000013FC90000-0x0000000140082000-memory.dmp	upx
behavioral1/memory/2172-4004-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	upx
behavioral1/memory/2884-4003-0x000000013F150000-0x000000013F542000-memory.dmp	upx
behavioral1/memory/2724-4011-0x000000013FCF0000-0x00000001400E2000-memory.dmp	upx
behavioral1/memory/2160-4013-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	upx
behavioral1/memory/2820-4014-0x000000013FFC0000-0x00000001403B2000-memory.dmp	upx
behavioral1/memory/2524-4017-0x000000013FAA0000-0x000000013FE92000-memory.dmp	upx
behavioral1/memory/1872-4016-0x000000013F060000-0x000000013F452000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\OCmwAlQ.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\niXUCxS.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\GfmARuw.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\sZkdaZX.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\uIGaIih.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\BestlOE.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\AwkhCgG.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\tAZVeeK.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\geWfBgt.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\mhahXmp.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\uaxCxmj.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\OEOxPWV.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\SVaiCKf.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\fcOaEqZ.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\kFihEoR.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\QoSzDRS.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\VCmqxmn.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\JhUKUWN.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\zQditve.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\wlJBxsS.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\svaaMzS.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\kZtIXsG.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\yVLyDwZ.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\YLFlggQ.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\qIzIbMk.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\nADsAoD.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\jKHrzQc.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\KjTXnOP.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\vGdvcIR.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\toXBGiP.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\CKnkMPX.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\zjenAWZ.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\uVXcBeM.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\yOQyVzz.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\SDeQEqz.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\TDnsTKs.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\OYpHUzx.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\iiJYZNC.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\HMRzjAx.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\CEiuydh.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\JovZIMI.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\xbpkYtZ.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\LHQIcQY.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\qgXZmUr.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\OREJzui.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\GSkJyVU.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\FOvmvWb.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\KfAaGoL.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\wrRwrpx.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\dlfSgdu.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\rYjaXvQ.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\RMpQddN.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\JIMPsOz.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\kINOtXw.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\kRDmWhY.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\zSuIvLI.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\WIrPfYz.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\sjDebWv.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\SrIkcXx.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\ZczmVmR.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\DcAENgc.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\KFvnWxo.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\LAYbpRJ.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
File created	C:\Windows\System\oInmGNK.exe	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2408	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
Token: SeLockMemoryPrivilege	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
Token: SeDebugPrivilege	2408	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 2408	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	31
PID 1496 wrote to memory of 2408	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	31
PID 1496 wrote to memory of 2408	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	31
PID 1496 wrote to memory of 2172	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	32
PID 1496 wrote to memory of 2172	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	32
PID 1496 wrote to memory of 2172	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	32
PID 1496 wrote to memory of 2820	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	33
PID 1496 wrote to memory of 2820	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	33
PID 1496 wrote to memory of 2820	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	33
PID 1496 wrote to memory of 2824	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	34
PID 1496 wrote to memory of 2824	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	34
PID 1496 wrote to memory of 2824	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	34
PID 1496 wrote to memory of 1872	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	35
PID 1496 wrote to memory of 1872	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	35
PID 1496 wrote to memory of 1872	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	35
PID 1496 wrote to memory of 2888	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	36
PID 1496 wrote to memory of 2888	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	36
PID 1496 wrote to memory of 2888	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	36
PID 1496 wrote to memory of 2728	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	37
PID 1496 wrote to memory of 2728	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	37
PID 1496 wrote to memory of 2728	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	37
PID 1496 wrote to memory of 2668	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	38
PID 1496 wrote to memory of 2668	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	38
PID 1496 wrote to memory of 2668	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	38
PID 1496 wrote to memory of 2724	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	39
PID 1496 wrote to memory of 2724	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	39
PID 1496 wrote to memory of 2724	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	39
PID 1496 wrote to memory of 2252	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	40
PID 1496 wrote to memory of 2252	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	40
PID 1496 wrote to memory of 2252	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	40
PID 1496 wrote to memory of 2524	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	41
PID 1496 wrote to memory of 2524	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	41
PID 1496 wrote to memory of 2524	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	41
PID 1496 wrote to memory of 2884	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	42
PID 1496 wrote to memory of 2884	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	42
PID 1496 wrote to memory of 2884	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	42
PID 1496 wrote to memory of 2160	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	43
PID 1496 wrote to memory of 2160	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	43
PID 1496 wrote to memory of 2160	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	43
PID 1496 wrote to memory of 2508	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	44
PID 1496 wrote to memory of 2508	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	44
PID 1496 wrote to memory of 2508	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	44
PID 1496 wrote to memory of 2332	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	45
PID 1496 wrote to memory of 2332	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	45
PID 1496 wrote to memory of 2332	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	45
PID 1496 wrote to memory of 2008	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	46
PID 1496 wrote to memory of 2008	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	46
PID 1496 wrote to memory of 2008	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	46
PID 1496 wrote to memory of 2100	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	47
PID 1496 wrote to memory of 2100	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	47
PID 1496 wrote to memory of 2100	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	47
PID 1496 wrote to memory of 316	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	48
PID 1496 wrote to memory of 316	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	48
PID 1496 wrote to memory of 316	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	48
PID 1496 wrote to memory of 1492	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	49
PID 1496 wrote to memory of 1492	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	49
PID 1496 wrote to memory of 1492	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	49
PID 1496 wrote to memory of 1112	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	50
PID 1496 wrote to memory of 1112	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	50
PID 1496 wrote to memory of 1112	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	50
PID 1496 wrote to memory of 788	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	51
PID 1496 wrote to memory of 788	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	51
PID 1496 wrote to memory of 788	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	51
PID 1496 wrote to memory of 1600	1496	4cc6293b8fdcb31f470b90aa1a2f0d20N.exe	52

C:\Users\Admin\AppData\Local\Temp\4cc6293b8fdcb31f470b90aa1a2f0d20N.exe
"C:\Users\Admin\AppData\Local\Temp\4cc6293b8fdcb31f470b90aa1a2f0d20N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2408
- C:\Windows\System\sBJhVfE.exe
  C:\Windows\System\sBJhVfE.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\gxnFxIi.exe
  C:\Windows\System\gxnFxIi.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\pZekcGZ.exe
  C:\Windows\System\pZekcGZ.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\mjohiYp.exe
  C:\Windows\System\mjohiYp.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\IQlPUmP.exe
  C:\Windows\System\IQlPUmP.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\OHzTTEx.exe
  C:\Windows\System\OHzTTEx.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\iDFrqAb.exe
  C:\Windows\System\iDFrqAb.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\wljUvvT.exe
  C:\Windows\System\wljUvvT.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\JbhaDZJ.exe
  C:\Windows\System\JbhaDZJ.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\SUgvdOa.exe
  C:\Windows\System\SUgvdOa.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\IEtANCt.exe
  C:\Windows\System\IEtANCt.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\vBdDOhR.exe
  C:\Windows\System\vBdDOhR.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\QAodFDY.exe
  C:\Windows\System\QAodFDY.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\tDTrEeK.exe
  C:\Windows\System\tDTrEeK.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\njHeiKc.exe
  C:\Windows\System\njHeiKc.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\OduXMZQ.exe
  C:\Windows\System\OduXMZQ.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\JdwCLiL.exe
  C:\Windows\System\JdwCLiL.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\iMIVfCF.exe
  C:\Windows\System\iMIVfCF.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\eBLKqOe.exe
  C:\Windows\System\eBLKqOe.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\WQXAnYD.exe
  C:\Windows\System\WQXAnYD.exe
  2⤵
  - Executes dropped EXE
  PID:788
- C:\Windows\System\cNeboWe.exe
  C:\Windows\System\cNeboWe.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\hVjyfyh.exe
  C:\Windows\System\hVjyfyh.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\PwwqSmw.exe
  C:\Windows\System\PwwqSmw.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\wcjCtfp.exe
  C:\Windows\System\wcjCtfp.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\FPuoFQb.exe
  C:\Windows\System\FPuoFQb.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\kokyIYl.exe
  C:\Windows\System\kokyIYl.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\nwrILOi.exe
  C:\Windows\System\nwrILOi.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\OFCvRhF.exe
  C:\Windows\System\OFCvRhF.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\bXpIHPV.exe
  C:\Windows\System\bXpIHPV.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\GMVLyOl.exe
  C:\Windows\System\GMVLyOl.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\wyDOyRC.exe
  C:\Windows\System\wyDOyRC.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\zhfCWpP.exe
  C:\Windows\System\zhfCWpP.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\VqdzyBf.exe
  C:\Windows\System\VqdzyBf.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\RCCcGLd.exe
  C:\Windows\System\RCCcGLd.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\ITbDApX.exe
  C:\Windows\System\ITbDApX.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\BXKGVOl.exe
  C:\Windows\System\BXKGVOl.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\BOWaweX.exe
  C:\Windows\System\BOWaweX.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\pxOazGA.exe
  C:\Windows\System\pxOazGA.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\qYmsnYa.exe
  C:\Windows\System\qYmsnYa.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\JovZIMI.exe
  C:\Windows\System\JovZIMI.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\GcfsYKY.exe
  C:\Windows\System\GcfsYKY.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\fKLygWT.exe
  C:\Windows\System\fKLygWT.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\vCbOTLn.exe
  C:\Windows\System\vCbOTLn.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\qlQftPD.exe
  C:\Windows\System\qlQftPD.exe
  2⤵
  - Executes dropped EXE
  PID:280
- C:\Windows\System\BSzWjrF.exe
  C:\Windows\System\BSzWjrF.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\OqqiJIm.exe
  C:\Windows\System\OqqiJIm.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\ODFptQJ.exe
  C:\Windows\System\ODFptQJ.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\wOwwDij.exe
  C:\Windows\System\wOwwDij.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\fXBZBce.exe
  C:\Windows\System\fXBZBce.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\dlCjZBk.exe
  C:\Windows\System\dlCjZBk.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\fkvxxBy.exe
  C:\Windows\System\fkvxxBy.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\Pmbopjb.exe
  C:\Windows\System\Pmbopjb.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\LzMhbFh.exe
  C:\Windows\System\LzMhbFh.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\xxWMktP.exe
  C:\Windows\System\xxWMktP.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\nPZOzWU.exe
  C:\Windows\System\nPZOzWU.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\nTyOzcX.exe
  C:\Windows\System\nTyOzcX.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\YkmaYwu.exe
  C:\Windows\System\YkmaYwu.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\jMqoBLn.exe
  C:\Windows\System\jMqoBLn.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\jZYLzpq.exe
  C:\Windows\System\jZYLzpq.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\qhbwtaC.exe
  C:\Windows\System\qhbwtaC.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\toDMvjY.exe
  C:\Windows\System\toDMvjY.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\KkPxbla.exe
  C:\Windows\System\KkPxbla.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\TfxPGjV.exe
  C:\Windows\System\TfxPGjV.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\wNeSAVs.exe
  C:\Windows\System\wNeSAVs.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\xnfquEx.exe
  C:\Windows\System\xnfquEx.exe
  2⤵
  PID:2128
- C:\Windows\System\uRYDTWm.exe
  C:\Windows\System\uRYDTWm.exe
  2⤵
  PID:2704
- C:\Windows\System\SmOdIzI.exe
  C:\Windows\System\SmOdIzI.exe
  2⤵
  PID:3064
- C:\Windows\System\qZnVotY.exe
  C:\Windows\System\qZnVotY.exe
  2⤵
  PID:548
- C:\Windows\System\wBoAkFC.exe
  C:\Windows\System\wBoAkFC.exe
  2⤵
  PID:2924
- C:\Windows\System\AHzmmnu.exe
  C:\Windows\System\AHzmmnu.exe
  2⤵
  PID:1184
- C:\Windows\System\gIUpSMC.exe
  C:\Windows\System\gIUpSMC.exe
  2⤵
  PID:2156
- C:\Windows\System\YeQMmPC.exe
  C:\Windows\System\YeQMmPC.exe
  2⤵
  PID:2356
- C:\Windows\System\eaWwqaL.exe
  C:\Windows\System\eaWwqaL.exe
  2⤵
  PID:3068
- C:\Windows\System\hWNjMMg.exe
  C:\Windows\System\hWNjMMg.exe
  2⤵
  PID:3032
- C:\Windows\System\ktjXYrE.exe
  C:\Windows\System\ktjXYrE.exe
  2⤵
  PID:2776
- C:\Windows\System\mIIEvST.exe
  C:\Windows\System\mIIEvST.exe
  2⤵
  PID:2276
- C:\Windows\System\RhBbuYG.exe
  C:\Windows\System\RhBbuYG.exe
  2⤵
  PID:2420
- C:\Windows\System\LpsTble.exe
  C:\Windows\System\LpsTble.exe
  2⤵
  PID:2176
- C:\Windows\System\xwPwVNi.exe
  C:\Windows\System\xwPwVNi.exe
  2⤵
  PID:1628
- C:\Windows\System\DdrCkUJ.exe
  C:\Windows\System\DdrCkUJ.exe
  2⤵
  PID:2464
- C:\Windows\System\OCmwAlQ.exe
  C:\Windows\System\OCmwAlQ.exe
  2⤵
  PID:616
- C:\Windows\System\VrRDadI.exe
  C:\Windows\System\VrRDadI.exe
  2⤵
  PID:1724
- C:\Windows\System\yOQyVzz.exe
  C:\Windows\System\yOQyVzz.exe
  2⤵
  PID:1876
- C:\Windows\System\VosoARY.exe
  C:\Windows\System\VosoARY.exe
  2⤵
  PID:2196
- C:\Windows\System\XXVRTxj.exe
  C:\Windows\System\XXVRTxj.exe
  2⤵
  PID:1748
- C:\Windows\System\LqqUCft.exe
  C:\Windows\System\LqqUCft.exe
  2⤵
  PID:576
- C:\Windows\System\SDsEMig.exe
  C:\Windows\System\SDsEMig.exe
  2⤵
  PID:2904
- C:\Windows\System\pAwbBhY.exe
  C:\Windows\System\pAwbBhY.exe
  2⤵
  PID:2412
- C:\Windows\System\QLcxFFy.exe
  C:\Windows\System\QLcxFFy.exe
  2⤵
  PID:2368
- C:\Windows\System\VNCQIVc.exe
  C:\Windows\System\VNCQIVc.exe
  2⤵
  PID:1316
- C:\Windows\System\IFdwzxj.exe
  C:\Windows\System\IFdwzxj.exe
  2⤵
  PID:468
- C:\Windows\System\qqGnbqz.exe
  C:\Windows\System\qqGnbqz.exe
  2⤵
  PID:1632
- C:\Windows\System\VCmqxmn.exe
  C:\Windows\System\VCmqxmn.exe
  2⤵
  PID:304
- C:\Windows\System\ZyCDedu.exe
  C:\Windows\System\ZyCDedu.exe
  2⤵
  PID:1732
- C:\Windows\System\BTutNDH.exe
  C:\Windows\System\BTutNDH.exe
  2⤵
  PID:436
- C:\Windows\System\kbDhCsH.exe
  C:\Windows\System\kbDhCsH.exe
  2⤵
  PID:2340
- C:\Windows\System\ceUeCZi.exe
  C:\Windows\System\ceUeCZi.exe
  2⤵
  PID:2760
- C:\Windows\System\zqgFouW.exe
  C:\Windows\System\zqgFouW.exe
  2⤵
  PID:1520
- C:\Windows\System\YLEoMCg.exe
  C:\Windows\System\YLEoMCg.exe
  2⤵
  PID:380
- C:\Windows\System\XTnRuue.exe
  C:\Windows\System\XTnRuue.exe
  2⤵
  PID:1588
- C:\Windows\System\FNttOLa.exe
  C:\Windows\System\FNttOLa.exe
  2⤵
  PID:2316
- C:\Windows\System\SoTgABC.exe
  C:\Windows\System\SoTgABC.exe
  2⤵
  PID:2592
- C:\Windows\System\gGYfkVc.exe
  C:\Windows\System\gGYfkVc.exe
  2⤵
  PID:1656
- C:\Windows\System\JxCcntp.exe
  C:\Windows\System\JxCcntp.exe
  2⤵
  PID:2840
- C:\Windows\System\bcPCbVN.exe
  C:\Windows\System\bcPCbVN.exe
  2⤵
  PID:2852
- C:\Windows\System\nhfsNHl.exe
  C:\Windows\System\nhfsNHl.exe
  2⤵
  PID:2256
- C:\Windows\System\wZAfbfr.exe
  C:\Windows\System\wZAfbfr.exe
  2⤵
  PID:3048
- C:\Windows\System\odOlLmk.exe
  C:\Windows\System\odOlLmk.exe
  2⤵
  PID:744
- C:\Windows\System\peqYkhV.exe
  C:\Windows\System\peqYkhV.exe
  2⤵
  PID:644
- C:\Windows\System\QQdGZdq.exe
  C:\Windows\System\QQdGZdq.exe
  2⤵
  PID:2136
- C:\Windows\System\Rqdxfis.exe
  C:\Windows\System\Rqdxfis.exe
  2⤵
  PID:2492
- C:\Windows\System\ufBRaAU.exe
  C:\Windows\System\ufBRaAU.exe
  2⤵
  PID:2040
- C:\Windows\System\tXfvpHI.exe
  C:\Windows\System\tXfvpHI.exe
  2⤵
  PID:2712
- C:\Windows\System\egUdMFK.exe
  C:\Windows\System\egUdMFK.exe
  2⤵
  PID:2248
- C:\Windows\System\mhahXmp.exe
  C:\Windows\System\mhahXmp.exe
  2⤵
  PID:1100
- C:\Windows\System\zQdTMcm.exe
  C:\Windows\System\zQdTMcm.exe
  2⤵
  PID:3040
- C:\Windows\System\fvJNMeX.exe
  C:\Windows\System\fvJNMeX.exe
  2⤵
  PID:2980
- C:\Windows\System\tgmVaqd.exe
  C:\Windows\System\tgmVaqd.exe
  2⤵
  PID:2292
- C:\Windows\System\aGrMVkD.exe
  C:\Windows\System\aGrMVkD.exe
  2⤵
  PID:2060
- C:\Windows\System\nfhHXmg.exe
  C:\Windows\System\nfhHXmg.exe
  2⤵
  PID:3080
- C:\Windows\System\aNaIIXv.exe
  C:\Windows\System\aNaIIXv.exe
  2⤵
  PID:3096
- C:\Windows\System\FGAjvyL.exe
  C:\Windows\System\FGAjvyL.exe
  2⤵
  PID:3112
- C:\Windows\System\JEGapHz.exe
  C:\Windows\System\JEGapHz.exe
  2⤵
  PID:3128
- C:\Windows\System\uKNZstL.exe
  C:\Windows\System\uKNZstL.exe
  2⤵
  PID:3144
- C:\Windows\System\uLBvtaA.exe
  C:\Windows\System\uLBvtaA.exe
  2⤵
  PID:3160
- C:\Windows\System\JLKdIln.exe
  C:\Windows\System\JLKdIln.exe
  2⤵
  PID:3176
- C:\Windows\System\yPItUls.exe
  C:\Windows\System\yPItUls.exe
  2⤵
  PID:3192
- C:\Windows\System\CJdPODt.exe
  C:\Windows\System\CJdPODt.exe
  2⤵
  PID:3208
- C:\Windows\System\SJTkFzR.exe
  C:\Windows\System\SJTkFzR.exe
  2⤵
  PID:3224
- C:\Windows\System\CdbosaG.exe
  C:\Windows\System\CdbosaG.exe
  2⤵
  PID:3240
- C:\Windows\System\JScSMyk.exe
  C:\Windows\System\JScSMyk.exe
  2⤵
  PID:3256
- C:\Windows\System\zQsPAlq.exe
  C:\Windows\System\zQsPAlq.exe
  2⤵
  PID:3272
- C:\Windows\System\hlbpWtd.exe
  C:\Windows\System\hlbpWtd.exe
  2⤵
  PID:3288
- C:\Windows\System\GJsUidh.exe
  C:\Windows\System\GJsUidh.exe
  2⤵
  PID:3304
- C:\Windows\System\qmUpwjU.exe
  C:\Windows\System\qmUpwjU.exe
  2⤵
  PID:3320
- C:\Windows\System\XTYfCVx.exe
  C:\Windows\System\XTYfCVx.exe
  2⤵
  PID:3336
- C:\Windows\System\oWvrinf.exe
  C:\Windows\System\oWvrinf.exe
  2⤵
  PID:3352
- C:\Windows\System\SmVmbIb.exe
  C:\Windows\System\SmVmbIb.exe
  2⤵
  PID:3368
- C:\Windows\System\xWDWWVU.exe
  C:\Windows\System\xWDWWVU.exe
  2⤵
  PID:3384
- C:\Windows\System\EhleJzz.exe
  C:\Windows\System\EhleJzz.exe
  2⤵
  PID:3400
- C:\Windows\System\MdJdevE.exe
  C:\Windows\System\MdJdevE.exe
  2⤵
  PID:3416
- C:\Windows\System\NHGInsJ.exe
  C:\Windows\System\NHGInsJ.exe
  2⤵
  PID:3432
- C:\Windows\System\pWrTSnG.exe
  C:\Windows\System\pWrTSnG.exe
  2⤵
  PID:3448
- C:\Windows\System\movRoUD.exe
  C:\Windows\System\movRoUD.exe
  2⤵
  PID:3464
- C:\Windows\System\OtNZsck.exe
  C:\Windows\System\OtNZsck.exe
  2⤵
  PID:3480
- C:\Windows\System\VRYCUKI.exe
  C:\Windows\System\VRYCUKI.exe
  2⤵
  PID:3496
- C:\Windows\System\jLoWvEZ.exe
  C:\Windows\System\jLoWvEZ.exe
  2⤵
  PID:3512
- C:\Windows\System\ziqGuqc.exe
  C:\Windows\System\ziqGuqc.exe
  2⤵
  PID:3528
- C:\Windows\System\opqimxS.exe
  C:\Windows\System\opqimxS.exe
  2⤵
  PID:3544
- C:\Windows\System\lIaZnUo.exe
  C:\Windows\System\lIaZnUo.exe
  2⤵
  PID:3560
- C:\Windows\System\dGsUDAm.exe
  C:\Windows\System\dGsUDAm.exe
  2⤵
  PID:3576
- C:\Windows\System\ofQrBIQ.exe
  C:\Windows\System\ofQrBIQ.exe
  2⤵
  PID:3592
- C:\Windows\System\eZlQauT.exe
  C:\Windows\System\eZlQauT.exe
  2⤵
  PID:3608
- C:\Windows\System\rBLmdLI.exe
  C:\Windows\System\rBLmdLI.exe
  2⤵
  PID:3624
- C:\Windows\System\iyClXeQ.exe
  C:\Windows\System\iyClXeQ.exe
  2⤵
  PID:3640
- C:\Windows\System\dvvNqyT.exe
  C:\Windows\System\dvvNqyT.exe
  2⤵
  PID:3656
- C:\Windows\System\wExpiae.exe
  C:\Windows\System\wExpiae.exe
  2⤵
  PID:3672
- C:\Windows\System\DqYoMjJ.exe
  C:\Windows\System\DqYoMjJ.exe
  2⤵
  PID:3688
- C:\Windows\System\adRrzgL.exe
  C:\Windows\System\adRrzgL.exe
  2⤵
  PID:3704
- C:\Windows\System\asGgWhc.exe
  C:\Windows\System\asGgWhc.exe
  2⤵
  PID:3720
- C:\Windows\System\ancwIkr.exe
  C:\Windows\System\ancwIkr.exe
  2⤵
  PID:3736
- C:\Windows\System\JdxvdCx.exe
  C:\Windows\System\JdxvdCx.exe
  2⤵
  PID:3752
- C:\Windows\System\CzAtfhL.exe
  C:\Windows\System\CzAtfhL.exe
  2⤵
  PID:3768
- C:\Windows\System\dcgKNOF.exe
  C:\Windows\System\dcgKNOF.exe
  2⤵
  PID:3968
- C:\Windows\System\vaOYaei.exe
  C:\Windows\System\vaOYaei.exe
  2⤵
  PID:3984
- C:\Windows\System\JowdUbP.exe
  C:\Windows\System\JowdUbP.exe
  2⤵
  PID:4000
- C:\Windows\System\KcuICul.exe
  C:\Windows\System\KcuICul.exe
  2⤵
  PID:4016
- C:\Windows\System\mpnMCoz.exe
  C:\Windows\System\mpnMCoz.exe
  2⤵
  PID:4032
- C:\Windows\System\YlbjMjF.exe
  C:\Windows\System\YlbjMjF.exe
  2⤵
  PID:4048
- C:\Windows\System\NbPqRRc.exe
  C:\Windows\System\NbPqRRc.exe
  2⤵
  PID:4064
- C:\Windows\System\aXgMTDY.exe
  C:\Windows\System\aXgMTDY.exe
  2⤵
  PID:4080
- C:\Windows\System\CSpkyUT.exe
  C:\Windows\System\CSpkyUT.exe
  2⤵
  PID:1088
- C:\Windows\System\TtKqlJu.exe
  C:\Windows\System\TtKqlJu.exe
  2⤵
  PID:112
- C:\Windows\System\RDGtKRU.exe
  C:\Windows\System\RDGtKRU.exe
  2⤵
  PID:1072
- C:\Windows\System\TPioOAh.exe
  C:\Windows\System\TPioOAh.exe
  2⤵
  PID:3200
- C:\Windows\System\qoxmXSe.exe
  C:\Windows\System\qoxmXSe.exe
  2⤵
  PID:2976
- C:\Windows\System\wcSLcYh.exe
  C:\Windows\System\wcSLcYh.exe
  2⤵
  PID:1396
- C:\Windows\System\OScAauA.exe
  C:\Windows\System\OScAauA.exe
  2⤵
  PID:2716
- C:\Windows\System\uBzVpgO.exe
  C:\Windows\System\uBzVpgO.exe
  2⤵
  PID:2764
- C:\Windows\System\bYLVNsW.exe
  C:\Windows\System\bYLVNsW.exe
  2⤵
  PID:3232
- C:\Windows\System\BmSMkxp.exe
  C:\Windows\System\BmSMkxp.exe
  2⤵
  PID:3360
- C:\Windows\System\RBmcFqJ.exe
  C:\Windows\System\RBmcFqJ.exe
  2⤵
  PID:3488
- C:\Windows\System\pCdBFcE.exe
  C:\Windows\System\pCdBFcE.exe
  2⤵
  PID:3616
- C:\Windows\System\dxiTLqy.exe
  C:\Windows\System\dxiTLqy.exe
  2⤵
  PID:780
- C:\Windows\System\sDqwOlI.exe
  C:\Windows\System\sDqwOlI.exe
  2⤵
  PID:528
- C:\Windows\System\IgcXiXb.exe
  C:\Windows\System\IgcXiXb.exe
  2⤵
  PID:2828
- C:\Windows\System\QOqVrmp.exe
  C:\Windows\System\QOqVrmp.exe
  2⤵
  PID:2512
- C:\Windows\System\VxYDZXv.exe
  C:\Windows\System\VxYDZXv.exe
  2⤵
  PID:964
- C:\Windows\System\kpGWujd.exe
  C:\Windows\System\kpGWujd.exe
  2⤵
  PID:1332
- C:\Windows\System\sHLbuNJ.exe
  C:\Windows\System\sHLbuNJ.exe
  2⤵
  PID:3136
- C:\Windows\System\xYwmAVJ.exe
  C:\Windows\System\xYwmAVJ.exe
  2⤵
  PID:3204
- C:\Windows\System\tfjJwWu.exe
  C:\Windows\System\tfjJwWu.exe
  2⤵
  PID:3332
- C:\Windows\System\CdvJeKI.exe
  C:\Windows\System\CdvJeKI.exe
  2⤵
  PID:3460
- C:\Windows\System\QbFBpCS.exe
  C:\Windows\System\QbFBpCS.exe
  2⤵
  PID:3588
- C:\Windows\System\yJZTjhE.exe
  C:\Windows\System\yJZTjhE.exe
  2⤵
  PID:3684
- C:\Windows\System\ioRnxIa.exe
  C:\Windows\System\ioRnxIa.exe
  2⤵
  PID:3748
- C:\Windows\System\UYMXBqt.exe
  C:\Windows\System\UYMXBqt.exe
  2⤵
  PID:3796
- C:\Windows\System\YkZIMyT.exe
  C:\Windows\System\YkZIMyT.exe
  2⤵
  PID:3812
- C:\Windows\System\AFhUblw.exe
  C:\Windows\System\AFhUblw.exe
  2⤵
  PID:3828
- C:\Windows\System\bjDvYEt.exe
  C:\Windows\System\bjDvYEt.exe
  2⤵
  PID:3844
- C:\Windows\System\JISZPrS.exe
  C:\Windows\System\JISZPrS.exe
  2⤵
  PID:3860
- C:\Windows\System\ZCgGpsG.exe
  C:\Windows\System\ZCgGpsG.exe
  2⤵
  PID:3876
- C:\Windows\System\cODdvwJ.exe
  C:\Windows\System\cODdvwJ.exe
  2⤵
  PID:3892
- C:\Windows\System\CWCrRqN.exe
  C:\Windows\System\CWCrRqN.exe
  2⤵
  PID:3908
- C:\Windows\System\hzPPrPH.exe
  C:\Windows\System\hzPPrPH.exe
  2⤵
  PID:3920
- C:\Windows\System\uTgolBe.exe
  C:\Windows\System\uTgolBe.exe
  2⤵
  PID:3944
- C:\Windows\System\CJsAsNR.exe
  C:\Windows\System\CJsAsNR.exe
  2⤵
  PID:3956
- C:\Windows\System\WrOJzdi.exe
  C:\Windows\System\WrOJzdi.exe
  2⤵
  PID:2864
- C:\Windows\System\ipgFlli.exe
  C:\Windows\System\ipgFlli.exe
  2⤵
  PID:3052
- C:\Windows\System\LetEijd.exe
  C:\Windows\System\LetEijd.exe
  2⤵
  PID:3152
- C:\Windows\System\KbXqRLk.exe
  C:\Windows\System\KbXqRLk.exe
  2⤵
  PID:3280
- C:\Windows\System\oskjOue.exe
  C:\Windows\System\oskjOue.exe
  2⤵
  PID:2448
- C:\Windows\System\CihPEmR.exe
  C:\Windows\System\CihPEmR.exe
  2⤵
  PID:556
- C:\Windows\System\WLarpwe.exe
  C:\Windows\System\WLarpwe.exe
  2⤵
  PID:2756
- C:\Windows\System\QTdygGj.exe
  C:\Windows\System\QTdygGj.exe
  2⤵
  PID:1232
- C:\Windows\System\siqwFoM.exe
  C:\Windows\System\siqwFoM.exe
  2⤵
  PID:2328
- C:\Windows\System\UboBdBT.exe
  C:\Windows\System\UboBdBT.exe
  2⤵
  PID:2504
- C:\Windows\System\LQCzBWo.exe
  C:\Windows\System\LQCzBWo.exe
  2⤵
  PID:1880
- C:\Windows\System\blmuLjW.exe
  C:\Windows\System\blmuLjW.exe
  2⤵
  PID:3124
- C:\Windows\System\EaINIKj.exe
  C:\Windows\System\EaINIKj.exe
  2⤵
  PID:3252
- C:\Windows\System\NKPMrvp.exe
  C:\Windows\System\NKPMrvp.exe
  2⤵
  PID:3344
- C:\Windows\System\KDLvPob.exe
  C:\Windows\System\KDLvPob.exe
  2⤵
  PID:3664
- C:\Windows\System\ChhXRUh.exe
  C:\Windows\System\ChhXRUh.exe
  2⤵
  PID:3728
- C:\Windows\System\msHMxeq.exe
  C:\Windows\System\msHMxeq.exe
  2⤵
  PID:3380
- C:\Windows\System\QNwbLyf.exe
  C:\Windows\System\QNwbLyf.exe
  2⤵
  PID:4056
- C:\Windows\System\mPMMarX.exe
  C:\Windows\System\mPMMarX.exe
  2⤵
  PID:3648
- C:\Windows\System\puWuqhZ.exe
  C:\Windows\System\puWuqhZ.exe
  2⤵
  PID:4100
- C:\Windows\System\ffVNxYT.exe
  C:\Windows\System\ffVNxYT.exe
  2⤵
  PID:4116
- C:\Windows\System\zjbQzlq.exe
  C:\Windows\System\zjbQzlq.exe
  2⤵
  PID:4132
- C:\Windows\System\JmNUFfK.exe
  C:\Windows\System\JmNUFfK.exe
  2⤵
  PID:4148
- C:\Windows\System\MQRUHVw.exe
  C:\Windows\System\MQRUHVw.exe
  2⤵
  PID:4164
- C:\Windows\System\xEvMlHR.exe
  C:\Windows\System\xEvMlHR.exe
  2⤵
  PID:4180
- C:\Windows\System\pbvmTZb.exe
  C:\Windows\System\pbvmTZb.exe
  2⤵
  PID:4196
- C:\Windows\System\dQhXhts.exe
  C:\Windows\System\dQhXhts.exe
  2⤵
  PID:4212
- C:\Windows\System\NpLhDRF.exe
  C:\Windows\System\NpLhDRF.exe
  2⤵
  PID:4228
- C:\Windows\System\MQYOPVJ.exe
  C:\Windows\System\MQYOPVJ.exe
  2⤵
  PID:4244
- C:\Windows\System\WISMZdY.exe
  C:\Windows\System\WISMZdY.exe
  2⤵
  PID:4260
- C:\Windows\System\LDiSxAZ.exe
  C:\Windows\System\LDiSxAZ.exe
  2⤵
  PID:4276
- C:\Windows\System\hxzsEpN.exe
  C:\Windows\System\hxzsEpN.exe
  2⤵
  PID:4292
- C:\Windows\System\TYTYNyt.exe
  C:\Windows\System\TYTYNyt.exe
  2⤵
  PID:4308
- C:\Windows\System\GbmRvNs.exe
  C:\Windows\System\GbmRvNs.exe
  2⤵
  PID:4324
- C:\Windows\System\aevyAYn.exe
  C:\Windows\System\aevyAYn.exe
  2⤵
  PID:4340
- C:\Windows\System\clfdHfr.exe
  C:\Windows\System\clfdHfr.exe
  2⤵
  PID:4356
- C:\Windows\System\rhtAcbu.exe
  C:\Windows\System\rhtAcbu.exe
  2⤵
  PID:4372
- C:\Windows\System\QVpHFFs.exe
  C:\Windows\System\QVpHFFs.exe
  2⤵
  PID:4388
- C:\Windows\System\oSfdTus.exe
  C:\Windows\System\oSfdTus.exe
  2⤵
  PID:4404
- C:\Windows\System\LjQgjPV.exe
  C:\Windows\System\LjQgjPV.exe
  2⤵
  PID:4420
- C:\Windows\System\MLRobTV.exe
  C:\Windows\System\MLRobTV.exe
  2⤵
  PID:4436
- C:\Windows\System\iiTfyqT.exe
  C:\Windows\System\iiTfyqT.exe
  2⤵
  PID:4452
- C:\Windows\System\VByHAAI.exe
  C:\Windows\System\VByHAAI.exe
  2⤵
  PID:4468
- C:\Windows\System\SDeQEqz.exe
  C:\Windows\System\SDeQEqz.exe
  2⤵
  PID:4484
- C:\Windows\System\wAzlHsy.exe
  C:\Windows\System\wAzlHsy.exe
  2⤵
  PID:4500
- C:\Windows\System\IepxzdD.exe
  C:\Windows\System\IepxzdD.exe
  2⤵
  PID:4516
- C:\Windows\System\GBIQPHH.exe
  C:\Windows\System\GBIQPHH.exe
  2⤵
  PID:4532
- C:\Windows\System\zCdNOdV.exe
  C:\Windows\System\zCdNOdV.exe
  2⤵
  PID:4548
- C:\Windows\System\CJYWxVI.exe
  C:\Windows\System\CJYWxVI.exe
  2⤵
  PID:4564
- C:\Windows\System\ihPgwEN.exe
  C:\Windows\System\ihPgwEN.exe
  2⤵
  PID:4580
- C:\Windows\System\bhqDijk.exe
  C:\Windows\System\bhqDijk.exe
  2⤵
  PID:4596
- C:\Windows\System\sIJVZti.exe
  C:\Windows\System\sIJVZti.exe
  2⤵
  PID:4612
- C:\Windows\System\mJPBhKC.exe
  C:\Windows\System\mJPBhKC.exe
  2⤵
  PID:4628
- C:\Windows\System\NWgArQp.exe
  C:\Windows\System\NWgArQp.exe
  2⤵
  PID:4644
- C:\Windows\System\lXfiMaU.exe
  C:\Windows\System\lXfiMaU.exe
  2⤵
  PID:4660
- C:\Windows\System\hleQIaz.exe
  C:\Windows\System\hleQIaz.exe
  2⤵
  PID:4676
- C:\Windows\System\IlMafxq.exe
  C:\Windows\System\IlMafxq.exe
  2⤵
  PID:4692
- C:\Windows\System\KukRySg.exe
  C:\Windows\System\KukRySg.exe
  2⤵
  PID:4708
- C:\Windows\System\FVxeLSS.exe
  C:\Windows\System\FVxeLSS.exe
  2⤵
  PID:4724
- C:\Windows\System\VJYYRpr.exe
  C:\Windows\System\VJYYRpr.exe
  2⤵
  PID:4740
- C:\Windows\System\cdrZzRP.exe
  C:\Windows\System\cdrZzRP.exe
  2⤵
  PID:4756
- C:\Windows\System\PhsBCYn.exe
  C:\Windows\System\PhsBCYn.exe
  2⤵
  PID:4772
- C:\Windows\System\LzEORpv.exe
  C:\Windows\System\LzEORpv.exe
  2⤵
  PID:4788
- C:\Windows\System\ONSsgVD.exe
  C:\Windows\System\ONSsgVD.exe
  2⤵
  PID:4804
- C:\Windows\System\AUXoPXl.exe
  C:\Windows\System\AUXoPXl.exe
  2⤵
  PID:4820
- C:\Windows\System\yGYCbmj.exe
  C:\Windows\System\yGYCbmj.exe
  2⤵
  PID:4836
- C:\Windows\System\HqmnQOf.exe
  C:\Windows\System\HqmnQOf.exe
  2⤵
  PID:4852
- C:\Windows\System\TWhzPuT.exe
  C:\Windows\System\TWhzPuT.exe
  2⤵
  PID:4868
- C:\Windows\System\aIvxcdf.exe
  C:\Windows\System\aIvxcdf.exe
  2⤵
  PID:4884
- C:\Windows\System\GSkJyVU.exe
  C:\Windows\System\GSkJyVU.exe
  2⤵
  PID:4900
- C:\Windows\System\rbrLNfC.exe
  C:\Windows\System\rbrLNfC.exe
  2⤵
  PID:4916
- C:\Windows\System\GQDGCXC.exe
  C:\Windows\System\GQDGCXC.exe
  2⤵
  PID:4932
- C:\Windows\System\SLDkQil.exe
  C:\Windows\System\SLDkQil.exe
  2⤵
  PID:4948
- C:\Windows\System\erDBigt.exe
  C:\Windows\System\erDBigt.exe
  2⤵
  PID:4964
- C:\Windows\System\FvMRlOC.exe
  C:\Windows\System\FvMRlOC.exe
  2⤵
  PID:4984
- C:\Windows\System\FAZjGKF.exe
  C:\Windows\System\FAZjGKF.exe
  2⤵
  PID:4240
- C:\Windows\System\XiOvPMt.exe
  C:\Windows\System\XiOvPMt.exe
  2⤵
  PID:4224
- C:\Windows\System\gDHAwJR.exe
  C:\Windows\System\gDHAwJR.exe
  2⤵
  PID:4288
- C:\Windows\System\TRmdskg.exe
  C:\Windows\System\TRmdskg.exe
  2⤵
  PID:4352
- C:\Windows\System\ahyNuTX.exe
  C:\Windows\System\ahyNuTX.exe
  2⤵
  PID:4416
- C:\Windows\System\HvvPAEo.exe
  C:\Windows\System\HvvPAEo.exe
  2⤵
  PID:4540
- C:\Windows\System\qtpRIvl.exe
  C:\Windows\System\qtpRIvl.exe
  2⤵
  PID:4400
- C:\Windows\System\kkmOSxD.exe
  C:\Windows\System\kkmOSxD.exe
  2⤵
  PID:4816
- C:\Windows\System\WjbbRqJ.exe
  C:\Windows\System\WjbbRqJ.exe
  2⤵
  PID:4040
- C:\Windows\System\sjDebWv.exe
  C:\Windows\System\sjDebWv.exe
  2⤵
  PID:2124
- C:\Windows\System\VHyvPaf.exe
  C:\Windows\System\VHyvPaf.exe
  2⤵
  PID:5096
- C:\Windows\System\AcXJzfc.exe
  C:\Windows\System\AcXJzfc.exe
  2⤵
  PID:3804
- C:\Windows\System\NpVhhIv.exe
  C:\Windows\System\NpVhhIv.exe
  2⤵
  PID:1700
- C:\Windows\System\BaGffAU.exe
  C:\Windows\System\BaGffAU.exe
  2⤵
  PID:3444
- C:\Windows\System\uOdqXdY.exe
  C:\Windows\System\uOdqXdY.exe
  2⤵
  PID:3508
- C:\Windows\System\KUVddNp.exe
  C:\Windows\System\KUVddNp.exe
  2⤵
  PID:3980
- C:\Windows\System\XBYKaYv.exe
  C:\Windows\System\XBYKaYv.exe
  2⤵
  PID:4524
- C:\Windows\System\GLsdVxa.exe
  C:\Windows\System\GLsdVxa.exe
  2⤵
  PID:2912
- C:\Windows\System\zBIngbi.exe
  C:\Windows\System\zBIngbi.exe
  2⤵
  PID:2300
- C:\Windows\System\vEcFpGA.exe
  C:\Windows\System\vEcFpGA.exe
  2⤵
  PID:3524
- C:\Windows\System\vjhDONw.exe
  C:\Windows\System\vjhDONw.exe
  2⤵
  PID:4204
- C:\Windows\System\SDjFZyp.exe
  C:\Windows\System\SDjFZyp.exe
  2⤵
  PID:1252
- C:\Windows\System\oaayltS.exe
  C:\Windows\System\oaayltS.exe
  2⤵
  PID:4332
- C:\Windows\System\BWlxJPT.exe
  C:\Windows\System\BWlxJPT.exe
  2⤵
  PID:3868
- C:\Windows\System\PXeasQo.exe
  C:\Windows\System\PXeasQo.exe
  2⤵
  PID:676
- C:\Windows\System\SDVGJSg.exe
  C:\Windows\System\SDVGJSg.exe
  2⤵
  PID:3316
- C:\Windows\System\heWjRmk.exe
  C:\Windows\System\heWjRmk.exe
  2⤵
  PID:3924
- C:\Windows\System\TJkZyhZ.exe
  C:\Windows\System\TJkZyhZ.exe
  2⤵
  PID:3824
- C:\Windows\System\FpoNWms.exe
  C:\Windows\System\FpoNWms.exe
  2⤵
  PID:3652
- C:\Windows\System\ZhkNuhg.exe
  C:\Windows\System\ZhkNuhg.exe
  2⤵
  PID:4024
- C:\Windows\System\oXQLEih.exe
  C:\Windows\System\oXQLEih.exe
  2⤵
  PID:3600
- C:\Windows\System\rlrPxPh.exe
  C:\Windows\System\rlrPxPh.exe
  2⤵
  PID:3172
- C:\Windows\System\ckbnxHm.exe
  C:\Windows\System\ckbnxHm.exe
  2⤵
  PID:1660
- C:\Windows\System\CEzIDkT.exe
  C:\Windows\System\CEzIDkT.exe
  2⤵
  PID:3188
- C:\Windows\System\NnSIvnh.exe
  C:\Windows\System\NnSIvnh.exe
  2⤵
  PID:1324
- C:\Windows\System\fcqWNdb.exe
  C:\Windows\System\fcqWNdb.exe
  2⤵
  PID:4156
- C:\Windows\System\RVCGhLz.exe
  C:\Windows\System\RVCGhLz.exe
  2⤵
  PID:4176
- C:\Windows\System\QqLUOCy.exe
  C:\Windows\System\QqLUOCy.exe
  2⤵
  PID:4144
- C:\Windows\System\xbpkYtZ.exe
  C:\Windows\System\xbpkYtZ.exe
  2⤵
  PID:4256
- C:\Windows\System\olRdiCR.exe
  C:\Windows\System\olRdiCR.exe
  2⤵
  PID:4476
- C:\Windows\System\LdsaoLL.exe
  C:\Windows\System\LdsaoLL.exe
  2⤵
  PID:4604
- C:\Windows\System\dkxdNTz.exe
  C:\Windows\System\dkxdNTz.exe
  2⤵
  PID:4636
- C:\Windows\System\vkmyljW.exe
  C:\Windows\System\vkmyljW.exe
  2⤵
  PID:4732
- C:\Windows\System\mkaitOT.exe
  C:\Windows\System\mkaitOT.exe
  2⤵
  PID:4576
- C:\Windows\System\uboXrKg.exe
  C:\Windows\System\uboXrKg.exe
  2⤵
  PID:4860
- C:\Windows\System\AbUidaA.exe
  C:\Windows\System\AbUidaA.exe
  2⤵
  PID:840
- C:\Windows\System\muQPzwA.exe
  C:\Windows\System\muQPzwA.exe
  2⤵
  PID:4892
- C:\Windows\System\DzZCcdX.exe
  C:\Windows\System\DzZCcdX.exe
  2⤵
  PID:5068
- C:\Windows\System\bPlbyKl.exe
  C:\Windows\System\bPlbyKl.exe
  2⤵
  PID:5044
- C:\Windows\System\VkuSqTm.exe
  C:\Windows\System\VkuSqTm.exe
  2⤵
  PID:5060
- C:\Windows\System\zOrMSSP.exe
  C:\Windows\System\zOrMSSP.exe
  2⤵
  PID:5072
- C:\Windows\System\stLyKBd.exe
  C:\Windows\System\stLyKBd.exe
  2⤵
  PID:5104
- C:\Windows\System\mPMducT.exe
  C:\Windows\System\mPMducT.exe
  2⤵
  PID:1672
- C:\Windows\System\MhTkxat.exe
  C:\Windows\System\MhTkxat.exe
  2⤵
  PID:3376
- C:\Windows\System\eIkNMtz.exe
  C:\Windows\System\eIkNMtz.exe
  2⤵
  PID:4268
- C:\Windows\System\EqRdNal.exe
  C:\Windows\System\EqRdNal.exe
  2⤵
  PID:3604
- C:\Windows\System\RsJvYjb.exe
  C:\Windows\System\RsJvYjb.exe
  2⤵
  PID:2032
- C:\Windows\System\DYXOPTq.exe
  C:\Windows\System\DYXOPTq.exe
  2⤵
  PID:2192
- C:\Windows\System\YFlmcEU.exe
  C:\Windows\System\YFlmcEU.exe
  2⤵
  PID:3456
- C:\Windows\System\ogFKvqF.exe
  C:\Windows\System\ogFKvqF.exe
  2⤵
  PID:4620
- C:\Windows\System\cHRAznw.exe
  C:\Windows\System\cHRAznw.exe
  2⤵
  PID:4464
- C:\Windows\System\CsrpjdP.exe
  C:\Windows\System\CsrpjdP.exe
  2⤵
  PID:4688
- C:\Windows\System\bUjGoOq.exe
  C:\Windows\System\bUjGoOq.exe
  2⤵
  PID:2552
- C:\Windows\System\wFAXsvr.exe
  C:\Windows\System\wFAXsvr.exe
  2⤵
  PID:4752
- C:\Windows\System\QqWwpVc.exe
  C:\Windows\System\QqWwpVc.exe
  2⤵
  PID:4780
- C:\Windows\System\FzQDfWp.exe
  C:\Windows\System\FzQDfWp.exe
  2⤵
  PID:1416
- C:\Windows\System\ozWvdIu.exe
  C:\Windows\System\ozWvdIu.exe
  2⤵
  PID:4368
- C:\Windows\System\ZUGkPDg.exe
  C:\Windows\System\ZUGkPDg.exe
  2⤵
  PID:1900
- C:\Windows\System\yfUtkBq.exe
  C:\Windows\System\yfUtkBq.exe
  2⤵
  PID:3940
- C:\Windows\System\zpuDfQj.exe
  C:\Windows\System\zpuDfQj.exe
  2⤵
  PID:1616
- C:\Windows\System\EpiNbkP.exe
  C:\Windows\System\EpiNbkP.exe
  2⤵
  PID:5052
- C:\Windows\System\scjwqIP.exe
  C:\Windows\System\scjwqIP.exe
  2⤵
  PID:3948
- C:\Windows\System\kMHFTIF.exe
  C:\Windows\System\kMHFTIF.exe
  2⤵
  PID:3820
- C:\Windows\System\ZwOlTfm.exe
  C:\Windows\System\ZwOlTfm.exe
  2⤵
  PID:3680
- C:\Windows\System\ISjHibc.exe
  C:\Windows\System\ISjHibc.exe
  2⤵
  PID:4092
- C:\Windows\System\KYSgvyY.exe
  C:\Windows\System\KYSgvyY.exe
  2⤵
  PID:3044
- C:\Windows\System\SXNdcew.exe
  C:\Windows\System\SXNdcew.exe
  2⤵
  PID:3636
- C:\Windows\System\rkrnJeE.exe
  C:\Windows\System\rkrnJeE.exe
  2⤵
  PID:3024
- C:\Windows\System\SGyZsNU.exe
  C:\Windows\System\SGyZsNU.exe
  2⤵
  PID:2944
- C:\Windows\System\QAsTUGm.exe
  C:\Windows\System\QAsTUGm.exe
  2⤵
  PID:3584
- C:\Windows\System\qxwzVUJ.exe
  C:\Windows\System\qxwzVUJ.exe
  2⤵
  PID:4172
- C:\Windows\System\LAYbpRJ.exe
  C:\Windows\System\LAYbpRJ.exe
  2⤵
  PID:4284
- C:\Windows\System\KWNxkBI.exe
  C:\Windows\System\KWNxkBI.exe
  2⤵
  PID:4784
- C:\Windows\System\svaaMzS.exe
  C:\Windows\System\svaaMzS.exe
  2⤵
  PID:4976
- C:\Windows\System\dnMnTgK.exe
  C:\Windows\System\dnMnTgK.exe
  2⤵
  PID:2956
- C:\Windows\System\LFTzOIV.exe
  C:\Windows\System\LFTzOIV.exe
  2⤵
  PID:4960
- C:\Windows\System\tzmkUVf.exe
  C:\Windows\System\tzmkUVf.exe
  2⤵
  PID:4592
- C:\Windows\System\NttseLX.exe
  C:\Windows\System\NttseLX.exe
  2⤵
  PID:2284
- C:\Windows\System\YtcGqVX.exe
  C:\Windows\System\YtcGqVX.exe
  2⤵
  PID:3248
- C:\Windows\System\wChmXnh.exe
  C:\Windows\System\wChmXnh.exe
  2⤵
  PID:4812
- C:\Windows\System\IDXrgAp.exe
  C:\Windows\System\IDXrgAp.exe
  2⤵
  PID:1764
- C:\Windows\System\yZSbuqi.exe
  C:\Windows\System\yZSbuqi.exe
  2⤵
  PID:3788
- C:\Windows\System\nZNMrgJ.exe
  C:\Windows\System\nZNMrgJ.exe
  2⤵
  PID:3424
- C:\Windows\System\zhYeRoI.exe
  C:\Windows\System\zhYeRoI.exe
  2⤵
  PID:5064
- C:\Windows\System\FQOOjKJ.exe
  C:\Windows\System\FQOOjKJ.exe
  2⤵
  PID:5124
- C:\Windows\System\Thbfzfs.exe
  C:\Windows\System\Thbfzfs.exe
  2⤵
  PID:5140
- C:\Windows\System\BnseWNK.exe
  C:\Windows\System\BnseWNK.exe
  2⤵
  PID:5160
- C:\Windows\System\wCcdsnX.exe
  C:\Windows\System\wCcdsnX.exe
  2⤵
  PID:5176
- C:\Windows\System\QKDwYzI.exe
  C:\Windows\System\QKDwYzI.exe
  2⤵
  PID:5192
- C:\Windows\System\wrsrIOS.exe
  C:\Windows\System\wrsrIOS.exe
  2⤵
  PID:5208
- C:\Windows\System\aVkhGFQ.exe
  C:\Windows\System\aVkhGFQ.exe
  2⤵
  PID:5228
- C:\Windows\System\MZxZzxS.exe
  C:\Windows\System\MZxZzxS.exe
  2⤵
  PID:5244
- C:\Windows\System\ZqKTlxH.exe
  C:\Windows\System\ZqKTlxH.exe
  2⤵
  PID:5260
- C:\Windows\System\nxzbyic.exe
  C:\Windows\System\nxzbyic.exe
  2⤵
  PID:5276
- C:\Windows\System\xxNvCOS.exe
  C:\Windows\System\xxNvCOS.exe
  2⤵
  PID:5296
- C:\Windows\System\ffAHwUQ.exe
  C:\Windows\System\ffAHwUQ.exe
  2⤵
  PID:5312
- C:\Windows\System\jEDDyzM.exe
  C:\Windows\System\jEDDyzM.exe
  2⤵
  PID:5328
- C:\Windows\System\mztkYUZ.exe
  C:\Windows\System\mztkYUZ.exe
  2⤵
  PID:5344
- C:\Windows\System\TmDILWk.exe
  C:\Windows\System\TmDILWk.exe
  2⤵
  PID:5360
- C:\Windows\System\oInmGNK.exe
  C:\Windows\System\oInmGNK.exe
  2⤵
  PID:5376
- C:\Windows\System\OLojadf.exe
  C:\Windows\System\OLojadf.exe
  2⤵
  PID:5400
- C:\Windows\System\GYruhpk.exe
  C:\Windows\System\GYruhpk.exe
  2⤵
  PID:5416
- C:\Windows\System\jAQOLJo.exe
  C:\Windows\System\jAQOLJo.exe
  2⤵
  PID:5432
- C:\Windows\System\KtopbEZ.exe
  C:\Windows\System\KtopbEZ.exe
  2⤵
  PID:5448
- C:\Windows\System\cPRCNZA.exe
  C:\Windows\System\cPRCNZA.exe
  2⤵
  PID:5464
- C:\Windows\System\MAIsxIj.exe
  C:\Windows\System\MAIsxIj.exe
  2⤵
  PID:5480
- C:\Windows\System\RFDFVPd.exe
  C:\Windows\System\RFDFVPd.exe
  2⤵
  PID:5496
- C:\Windows\System\toCPsPx.exe
  C:\Windows\System\toCPsPx.exe
  2⤵
  PID:5516
- C:\Windows\System\NLlDSQx.exe
  C:\Windows\System\NLlDSQx.exe
  2⤵
  PID:5532
- C:\Windows\System\LVacabj.exe
  C:\Windows\System\LVacabj.exe
  2⤵
  PID:5548
- C:\Windows\System\YpvURBg.exe
  C:\Windows\System\YpvURBg.exe
  2⤵
  PID:5568
- C:\Windows\System\DGPtAAA.exe
  C:\Windows\System\DGPtAAA.exe
  2⤵
  PID:5584
- C:\Windows\System\UwUoFld.exe
  C:\Windows\System\UwUoFld.exe
  2⤵
  PID:5600
- C:\Windows\System\UrHrTrv.exe
  C:\Windows\System\UrHrTrv.exe
  2⤵
  PID:5616
- C:\Windows\System\SrIkcXx.exe
  C:\Windows\System\SrIkcXx.exe
  2⤵
  PID:5632
- C:\Windows\System\rghGCAJ.exe
  C:\Windows\System\rghGCAJ.exe
  2⤵
  PID:5652
- C:\Windows\System\saXOwDC.exe
  C:\Windows\System\saXOwDC.exe
  2⤵
  PID:5668
- C:\Windows\System\VVnJXKG.exe
  C:\Windows\System\VVnJXKG.exe
  2⤵
  PID:5692
- C:\Windows\System\lbmqgmI.exe
  C:\Windows\System\lbmqgmI.exe
  2⤵
  PID:5708
- C:\Windows\System\nVneSbU.exe
  C:\Windows\System\nVneSbU.exe
  2⤵
  PID:5752
- C:\Windows\System\mRIbpxr.exe
  C:\Windows\System\mRIbpxr.exe
  2⤵
  PID:5768
- C:\Windows\System\KhbCjqK.exe
  C:\Windows\System\KhbCjqK.exe
  2⤵
  PID:5784
- C:\Windows\System\xKmDArp.exe
  C:\Windows\System\xKmDArp.exe
  2⤵
  PID:5800
- C:\Windows\System\nDPntQG.exe
  C:\Windows\System\nDPntQG.exe
  2⤵
  PID:5816
- C:\Windows\System\VSNnrfq.exe
  C:\Windows\System\VSNnrfq.exe
  2⤵
  PID:5832
- C:\Windows\System\FYyOawE.exe
  C:\Windows\System\FYyOawE.exe
  2⤵
  PID:5856
- C:\Windows\System\AMFCNLG.exe
  C:\Windows\System\AMFCNLG.exe
  2⤵
  PID:5876
- C:\Windows\System\titHgfs.exe
  C:\Windows\System\titHgfs.exe
  2⤵
  PID:5892
- C:\Windows\System\dccbRau.exe
  C:\Windows\System\dccbRau.exe
  2⤵
  PID:5908
- C:\Windows\System\JJuNdEg.exe
  C:\Windows\System\JJuNdEg.exe
  2⤵
  PID:5924
- C:\Windows\System\mWKfdnj.exe
  C:\Windows\System\mWKfdnj.exe
  2⤵
  PID:5940
- C:\Windows\System\jAfnCdJ.exe
  C:\Windows\System\jAfnCdJ.exe
  2⤵
  PID:5956
- C:\Windows\System\CvBTEsi.exe
  C:\Windows\System\CvBTEsi.exe
  2⤵
  PID:5972
- C:\Windows\System\ZeeerZj.exe
  C:\Windows\System\ZeeerZj.exe
  2⤵
  PID:5988
- C:\Windows\System\ezqsjhE.exe
  C:\Windows\System\ezqsjhE.exe
  2⤵
  PID:6096
- C:\Windows\System\fFKHnLT.exe
  C:\Windows\System\fFKHnLT.exe
  2⤵
  PID:6116
- C:\Windows\System\iZojKRQ.exe
  C:\Windows\System\iZojKRQ.exe
  2⤵
  PID:6132
- C:\Windows\System\kKVBjnX.exe
  C:\Windows\System\kKVBjnX.exe
  2⤵
  PID:2832
- C:\Windows\System\CsjeBmq.exe
  C:\Windows\System\CsjeBmq.exe
  2⤵
  PID:4492
- C:\Windows\System\JKUNqjJ.exe
  C:\Windows\System\JKUNqjJ.exe
  2⤵
  PID:4448
- C:\Windows\System\iwIxJDD.exe
  C:\Windows\System\iwIxJDD.exe
  2⤵
  PID:5272
- C:\Windows\System\voQnbJY.exe
  C:\Windows\System\voQnbJY.exe
  2⤵
  PID:5204
- C:\Windows\System\aSLPCgG.exe
  C:\Windows\System\aSLPCgG.exe
  2⤵
  PID:5136
- C:\Windows\System\jLtYakM.exe
  C:\Windows\System\jLtYakM.exe
  2⤵
  PID:5340
- C:\Windows\System\ELKiLXW.exe
  C:\Windows\System\ELKiLXW.exe
  2⤵
  PID:5508
- C:\Windows\System\cWYesTE.exe
  C:\Windows\System\cWYesTE.exe
  2⤵
  PID:5576
- C:\Windows\System\QVOuuoF.exe
  C:\Windows\System\QVOuuoF.exe
  2⤵
  PID:5644
- C:\Windows\System\LQYLHth.exe
  C:\Windows\System\LQYLHth.exe
  2⤵
  PID:5472
- C:\Windows\System\hTJyvIs.exe
  C:\Windows\System\hTJyvIs.exe
  2⤵
  PID:4844
- C:\Windows\System\JveLnAW.exe
  C:\Windows\System\JveLnAW.exe
  2⤵
  PID:4656
- C:\Windows\System\ndLOWtS.exe
  C:\Windows\System\ndLOWtS.exe
  2⤵
  PID:2700
- C:\Windows\System\ylddLJF.exe
  C:\Windows\System\ylddLJF.exe
  2⤵
  PID:4828
- C:\Windows\System\FRqXjcb.exe
  C:\Windows\System\FRqXjcb.exe
  2⤵
  PID:5152
- C:\Windows\System\lMnqpaL.exe
  C:\Windows\System\lMnqpaL.exe
  2⤵
  PID:5252
- C:\Windows\System\vamrluI.exe
  C:\Windows\System\vamrluI.exe
  2⤵
  PID:5352
- C:\Windows\System\ZQmnXYh.exe
  C:\Windows\System\ZQmnXYh.exe
  2⤵
  PID:5428
- C:\Windows\System\XGdJwUs.exe
  C:\Windows\System\XGdJwUs.exe
  2⤵
  PID:5528
- C:\Windows\System\DgnFaOL.exe
  C:\Windows\System\DgnFaOL.exe
  2⤵
  PID:5628
- C:\Windows\System\MlAhvKt.exe
  C:\Windows\System\MlAhvKt.exe
  2⤵
  PID:2364
- C:\Windows\System\CoQwgvj.exe
  C:\Windows\System\CoQwgvj.exe
  2⤵
  PID:5080
- C:\Windows\System\lEehTdC.exe
  C:\Windows\System\lEehTdC.exe
  2⤵
  PID:3088
- C:\Windows\System\GGsIhCN.exe
  C:\Windows\System\GGsIhCN.exe
  2⤵
  PID:3572
- C:\Windows\System\vBiSBVP.exe
  C:\Windows\System\vBiSBVP.exe
  2⤵
  PID:4848
- C:\Windows\System\DYYiwUc.exe
  C:\Windows\System\DYYiwUc.exe
  2⤵
  PID:3900
- C:\Windows\System\JxJFmlh.exe
  C:\Windows\System\JxJFmlh.exe
  2⤵
  PID:2972
- C:\Windows\System\AEwqWCu.exe
  C:\Windows\System\AEwqWCu.exe
  2⤵
  PID:4572
- C:\Windows\System\kUimDdD.exe
  C:\Windows\System\kUimDdD.exe
  2⤵
  PID:4768
- C:\Windows\System\jXoOlYq.exe
  C:\Windows\System\jXoOlYq.exe
  2⤵
  PID:5040
- C:\Windows\System\bOOZghu.exe
  C:\Windows\System\bOOZghu.exe
  2⤵
  PID:3716
- C:\Windows\System\zBRJCpL.exe
  C:\Windows\System\zBRJCpL.exe
  2⤵
  PID:3552
- C:\Windows\System\kNPneln.exe
  C:\Windows\System\kNPneln.exe
  2⤵
  PID:5256
- C:\Windows\System\IHPbmEu.exe
  C:\Windows\System\IHPbmEu.exe
  2⤵
  PID:5392
- C:\Windows\System\kXDCVKV.exe
  C:\Windows\System\kXDCVKV.exe
  2⤵
  PID:5592
- C:\Windows\System\YGGHaZq.exe
  C:\Windows\System\YGGHaZq.exe
  2⤵
  PID:5724
- C:\Windows\System\yikIFoh.exe
  C:\Windows\System\yikIFoh.exe
  2⤵
  PID:5700
- C:\Windows\System\TdEKmAl.exe
  C:\Windows\System\TdEKmAl.exe
  2⤵
  PID:5748
- C:\Windows\System\NlqeOqj.exe
  C:\Windows\System\NlqeOqj.exe
  2⤵
  PID:5808
- C:\Windows\System\MeOmMjb.exe
  C:\Windows\System\MeOmMjb.exe
  2⤵
  PID:5792
- C:\Windows\System\DgbqEJl.exe
  C:\Windows\System\DgbqEJl.exe
  2⤵
  PID:5844
- C:\Windows\System\WuuzIZk.exe
  C:\Windows\System\WuuzIZk.exe
  2⤵
  PID:6000
- C:\Windows\System\cBcrJfU.exe
  C:\Windows\System\cBcrJfU.exe
  2⤵
  PID:5840
- C:\Windows\System\zptAeRJ.exe
  C:\Windows\System\zptAeRJ.exe
  2⤵
  PID:5864
- C:\Windows\System\ovEnucc.exe
  C:\Windows\System\ovEnucc.exe
  2⤵
  PID:5996
- C:\Windows\System\gNXyVjW.exe
  C:\Windows\System\gNXyVjW.exe
  2⤵
  PID:5920
- C:\Windows\System\CQkSIKx.exe
  C:\Windows\System\CQkSIKx.exe
  2⤵
  PID:5936
- C:\Windows\System\feIyhHK.exe
  C:\Windows\System\feIyhHK.exe
  2⤵
  PID:5948
- C:\Windows\System\kuoElrq.exe
  C:\Windows\System\kuoElrq.exe
  2⤵
  PID:6040
- C:\Windows\System\KjTXnOP.exe
  C:\Windows\System\KjTXnOP.exe
  2⤵
  PID:6056
- C:\Windows\System\hZHvdaZ.exe
  C:\Windows\System\hZHvdaZ.exe
  2⤵
  PID:6068
- C:\Windows\System\oGMAixB.exe
  C:\Windows\System\oGMAixB.exe
  2⤵
  PID:956
- C:\Windows\System\qIGoCon.exe
  C:\Windows\System\qIGoCon.exe
  2⤵
  PID:6140
- C:\Windows\System\ZdtKXKA.exe
  C:\Windows\System\ZdtKXKA.exe
  2⤵
  PID:5236
- C:\Windows\System\LBLHQCE.exe
  C:\Windows\System\LBLHQCE.exe
  2⤵
  PID:5408
- C:\Windows\System\PyuJYKp.exe
  C:\Windows\System\PyuJYKp.exe
  2⤵
  PID:4460
- C:\Windows\System\irnrUfR.exe
  C:\Windows\System\irnrUfR.exe
  2⤵
  PID:6076
- C:\Windows\System\AwZbXtB.exe
  C:\Windows\System\AwZbXtB.exe
  2⤵
  PID:5608
- C:\Windows\System\RyAiwZj.exe
  C:\Windows\System\RyAiwZj.exe
  2⤵
  PID:6124
- C:\Windows\System\bcakmJB.exe
  C:\Windows\System\bcakmJB.exe
  2⤵
  PID:5304
- C:\Windows\System\hVjGlDQ.exe
  C:\Windows\System\hVjGlDQ.exe
  2⤵
  PID:5476
- C:\Windows\System\oIfhShb.exe
  C:\Windows\System\oIfhShb.exe
  2⤵
  PID:4300
- C:\Windows\System\gAqyBOU.exe
  C:\Windows\System\gAqyBOU.exe
  2⤵
  PID:3220
- C:\Windows\System\jjsTZjS.exe
  C:\Windows\System\jjsTZjS.exe
  2⤵
  PID:5424
- C:\Windows\System\HrzTdnQ.exe
  C:\Windows\System\HrzTdnQ.exe
  2⤵
  PID:4396
- C:\Windows\System\gKBDGHH.exe
  C:\Windows\System\gKBDGHH.exe
  2⤵
  PID:3936
- C:\Windows\System\ubWAXxh.exe
  C:\Windows\System\ubWAXxh.exe
  2⤵
  PID:320
- C:\Windows\System\qJpavwC.exe
  C:\Windows\System\qJpavwC.exe
  2⤵
  PID:5324
- C:\Windows\System\HWeAOLp.exe
  C:\Windows\System\HWeAOLp.exe
  2⤵
  PID:5736
- C:\Windows\System\JASsHYC.exe
  C:\Windows\System\JASsHYC.exe
  2⤵
  PID:4704
- C:\Windows\System\SafmWLk.exe
  C:\Windows\System\SafmWLk.exe
  2⤵
  PID:5964
- C:\Windows\System\ywMAwzC.exe
  C:\Windows\System\ywMAwzC.exe
  2⤵
  PID:5492
- C:\Windows\System\xXzVuoM.exe
  C:\Windows\System\xXzVuoM.exe
  2⤵
  PID:6048
- C:\Windows\System\pjSgpuS.exe
  C:\Windows\System\pjSgpuS.exe
  2⤵
  PID:4304
- C:\Windows\System\VSMRyKq.exe
  C:\Windows\System\VSMRyKq.exe
  2⤵
  PID:5904
- C:\Windows\System\sMnfYmq.exe
  C:\Windows\System\sMnfYmq.exe
  2⤵
  PID:6024
- C:\Windows\System\aThladD.exe
  C:\Windows\System\aThladD.exe
  2⤵
  PID:5824
- C:\Windows\System\vJXaUXH.exe
  C:\Windows\System\vJXaUXH.exe
  2⤵
  PID:5720
- C:\Windows\System\rCnnHSL.exe
  C:\Windows\System\rCnnHSL.exe
  2⤵
  PID:5224
- C:\Windows\System\WiCKEhz.exe
  C:\Windows\System\WiCKEhz.exe
  2⤵
  PID:6108
- C:\Windows\System\YBZSduO.exe
  C:\Windows\System\YBZSduO.exe
  2⤵
  PID:924
- C:\Windows\System\wHRZaUi.exe
  C:\Windows\System\wHRZaUi.exe
  2⤵
  PID:3964
- C:\Windows\System\KLQsFGA.exe
  C:\Windows\System\KLQsFGA.exe
  2⤵
  PID:3884
- C:\Windows\System\VGCvNcH.exe
  C:\Windows\System\VGCvNcH.exe
  2⤵
  PID:5368
- C:\Windows\System\oIujEaI.exe
  C:\Windows\System\oIujEaI.exe
  2⤵
  PID:5220
- C:\Windows\System\EKQiBKh.exe
  C:\Windows\System\EKQiBKh.exe
  2⤵
  PID:5624
- C:\Windows\System\wbUzkHx.exe
  C:\Windows\System\wbUzkHx.exe
  2⤵
  PID:4140
- C:\Windows\System\OWdLHrk.exe
  C:\Windows\System\OWdLHrk.exe
  2⤵
  PID:5900
- C:\Windows\System\bWeDpaF.exe
  C:\Windows\System\bWeDpaF.exe
  2⤵
  PID:5932
- C:\Windows\System\bUUSZNY.exe
  C:\Windows\System\bUUSZNY.exe
  2⤵
  PID:6028
- C:\Windows\System\ssudHcx.exe
  C:\Windows\System\ssudHcx.exe
  2⤵
  PID:4588
- C:\Windows\System\GHUHXdZ.exe
  C:\Windows\System\GHUHXdZ.exe
  2⤵
  PID:3992
- C:\Windows\System\vXyBfNb.exe
  C:\Windows\System\vXyBfNb.exe
  2⤵
  PID:6064
- C:\Windows\System\rqUJVLi.exe
  C:\Windows\System\rqUJVLi.exe
  2⤵
  PID:5308
- C:\Windows\System\UgZcWDE.exe
  C:\Windows\System\UgZcWDE.exe
  2⤵
  PID:5540
- C:\Windows\System\fGzLgCx.exe
  C:\Windows\System\fGzLgCx.exe
  2⤵
  PID:5188
- C:\Windows\System\WufTJuv.exe
  C:\Windows\System\WufTJuv.exe
  2⤵
  PID:5680
- C:\Windows\System\xhLXbrQ.exe
  C:\Windows\System\xhLXbrQ.exe
  2⤵
  PID:5384
- C:\Windows\System\WlBUCTV.exe
  C:\Windows\System\WlBUCTV.exe
  2⤵
  PID:4880
- C:\Windows\System\SfBOGQW.exe
  C:\Windows\System\SfBOGQW.exe
  2⤵
  PID:5760
- C:\Windows\System\BJwRFZf.exe
  C:\Windows\System\BJwRFZf.exe
  2⤵
  PID:4668
- C:\Windows\System\LVBJmnE.exe
  C:\Windows\System\LVBJmnE.exe
  2⤵
  PID:3792
- C:\Windows\System\HSfYPJd.exe
  C:\Windows\System\HSfYPJd.exe
  2⤵
  PID:4208
- C:\Windows\System\QjufqHh.exe
  C:\Windows\System\QjufqHh.exe
  2⤵
  PID:5560
- C:\Windows\System\QODbNqb.exe
  C:\Windows\System\QODbNqb.exe
  2⤵
  PID:6152
- C:\Windows\System\TQBlibj.exe
  C:\Windows\System\TQBlibj.exe
  2⤵
  PID:6168
- C:\Windows\System\sqVXsaR.exe
  C:\Windows\System\sqVXsaR.exe
  2⤵
  PID:6184
- C:\Windows\System\fcOaEqZ.exe
  C:\Windows\System\fcOaEqZ.exe
  2⤵
  PID:6200
- C:\Windows\System\lGBBsrq.exe
  C:\Windows\System\lGBBsrq.exe
  2⤵
  PID:6216
- C:\Windows\System\BFHxTKP.exe
  C:\Windows\System\BFHxTKP.exe
  2⤵
  PID:6232
- C:\Windows\System\HpHyLVL.exe
  C:\Windows\System\HpHyLVL.exe
  2⤵
  PID:6248
- C:\Windows\System\LdWQNgu.exe
  C:\Windows\System\LdWQNgu.exe
  2⤵
  PID:6268
- C:\Windows\System\GnMOonB.exe
  C:\Windows\System\GnMOonB.exe
  2⤵
  PID:6292
- C:\Windows\System\dTVLBFT.exe
  C:\Windows\System\dTVLBFT.exe
  2⤵
  PID:6308
- C:\Windows\System\JRrmtcG.exe
  C:\Windows\System\JRrmtcG.exe
  2⤵
  PID:6324
- C:\Windows\System\hYMqtIT.exe
  C:\Windows\System\hYMqtIT.exe
  2⤵
  PID:6340
- C:\Windows\System\aOlKXxV.exe
  C:\Windows\System\aOlKXxV.exe
  2⤵
  PID:6356
- C:\Windows\System\ZZuUnUH.exe
  C:\Windows\System\ZZuUnUH.exe
  2⤵
  PID:6372
- C:\Windows\System\DtYbnLA.exe
  C:\Windows\System\DtYbnLA.exe
  2⤵
  PID:6388
- C:\Windows\System\YJqKuOa.exe
  C:\Windows\System\YJqKuOa.exe
  2⤵
  PID:6404
- C:\Windows\System\mcWJMyG.exe
  C:\Windows\System\mcWJMyG.exe
  2⤵
  PID:6420
- C:\Windows\System\vbqAgnv.exe
  C:\Windows\System\vbqAgnv.exe
  2⤵
  PID:6436
- C:\Windows\System\AqMjHCf.exe
  C:\Windows\System\AqMjHCf.exe
  2⤵
  PID:6452
- C:\Windows\System\SVxaIqI.exe
  C:\Windows\System\SVxaIqI.exe
  2⤵
  PID:6468
- C:\Windows\System\IOXDrzA.exe
  C:\Windows\System\IOXDrzA.exe
  2⤵
  PID:6484
- C:\Windows\System\sfSVjOe.exe
  C:\Windows\System\sfSVjOe.exe
  2⤵
  PID:6500
- C:\Windows\System\QyPxnwg.exe
  C:\Windows\System\QyPxnwg.exe
  2⤵
  PID:6516
- C:\Windows\System\SRkuMpk.exe
  C:\Windows\System\SRkuMpk.exe
  2⤵
  PID:6536
- C:\Windows\System\POviiQK.exe
  C:\Windows\System\POviiQK.exe
  2⤵
  PID:6552
- C:\Windows\System\eWsNBER.exe
  C:\Windows\System\eWsNBER.exe
  2⤵
  PID:6568
- C:\Windows\System\XnsMThB.exe
  C:\Windows\System\XnsMThB.exe
  2⤵
  PID:6584
- C:\Windows\System\jdGxDPA.exe
  C:\Windows\System\jdGxDPA.exe
  2⤵
  PID:6604
- C:\Windows\System\oNntGUR.exe
  C:\Windows\System\oNntGUR.exe
  2⤵
  PID:6620
- C:\Windows\System\HfsSOLH.exe
  C:\Windows\System\HfsSOLH.exe
  2⤵
  PID:6648
- C:\Windows\System\hAHOUUa.exe
  C:\Windows\System\hAHOUUa.exe
  2⤵
  PID:6668
- C:\Windows\System\vnMAyay.exe
  C:\Windows\System\vnMAyay.exe
  2⤵
  PID:6688
- C:\Windows\System\amaPcvh.exe
  C:\Windows\System\amaPcvh.exe
  2⤵
  PID:6704
- C:\Windows\System\YgTFjpr.exe
  C:\Windows\System\YgTFjpr.exe
  2⤵
  PID:6720
- C:\Windows\System\RTQWena.exe
  C:\Windows\System\RTQWena.exe
  2⤵
  PID:6736
- C:\Windows\System\FdWsYhS.exe
  C:\Windows\System\FdWsYhS.exe
  2⤵
  PID:6752
- C:\Windows\System\QwZteTI.exe
  C:\Windows\System\QwZteTI.exe
  2⤵
  PID:6768
- C:\Windows\System\EOCCGbS.exe
  C:\Windows\System\EOCCGbS.exe
  2⤵
  PID:6784
- C:\Windows\System\vfYnGmo.exe
  C:\Windows\System\vfYnGmo.exe
  2⤵
  PID:6800
- C:\Windows\System\KRuxwUy.exe
  C:\Windows\System\KRuxwUy.exe
  2⤵
  PID:6816
- C:\Windows\System\MAtcTlH.exe
  C:\Windows\System\MAtcTlH.exe
  2⤵
  PID:6832
- C:\Windows\System\RUvLaiL.exe
  C:\Windows\System\RUvLaiL.exe
  2⤵
  PID:6848
- C:\Windows\System\kFUpMDi.exe
  C:\Windows\System\kFUpMDi.exe
  2⤵
  PID:6864
- C:\Windows\System\EUkRsHL.exe
  C:\Windows\System\EUkRsHL.exe
  2⤵
  PID:6880
- C:\Windows\System\SGTptJp.exe
  C:\Windows\System\SGTptJp.exe
  2⤵
  PID:6896
- C:\Windows\System\hUxDpgZ.exe
  C:\Windows\System\hUxDpgZ.exe
  2⤵
  PID:6912
- C:\Windows\System\dlFdgXd.exe
  C:\Windows\System\dlFdgXd.exe
  2⤵
  PID:6928
- C:\Windows\System\NcOzHru.exe
  C:\Windows\System\NcOzHru.exe
  2⤵
  PID:6944
- C:\Windows\System\LMmzuXd.exe
  C:\Windows\System\LMmzuXd.exe
  2⤵
  PID:6960
- C:\Windows\System\ReWXJns.exe
  C:\Windows\System\ReWXJns.exe
  2⤵
  PID:6976
- C:\Windows\System\Xsgknnk.exe
  C:\Windows\System\Xsgknnk.exe
  2⤵
  PID:6992
- C:\Windows\System\DhaPHgo.exe
  C:\Windows\System\DhaPHgo.exe
  2⤵
  PID:7008
- C:\Windows\System\ACRFanw.exe
  C:\Windows\System\ACRFanw.exe
  2⤵
  PID:7024
- C:\Windows\System\ajpizlE.exe
  C:\Windows\System\ajpizlE.exe
  2⤵
  PID:7040
- C:\Windows\System\eSbCQBb.exe
  C:\Windows\System\eSbCQBb.exe
  2⤵
  PID:7056
- C:\Windows\System\uMxAAGn.exe
  C:\Windows\System\uMxAAGn.exe
  2⤵
  PID:7072
- C:\Windows\System\twAlxqp.exe
  C:\Windows\System\twAlxqp.exe
  2⤵
  PID:7088
- C:\Windows\System\LGpHZrC.exe
  C:\Windows\System\LGpHZrC.exe
  2⤵
  PID:7104
- C:\Windows\System\ErwMVjj.exe
  C:\Windows\System\ErwMVjj.exe
  2⤵
  PID:7120
- C:\Windows\System\qHfCipj.exe
  C:\Windows\System\qHfCipj.exe
  2⤵
  PID:7136
- C:\Windows\System\ZczmVmR.exe
  C:\Windows\System\ZczmVmR.exe
  2⤵
  PID:7152
- C:\Windows\System\LiLbISO.exe
  C:\Windows\System\LiLbISO.exe
  2⤵
  PID:6160
- C:\Windows\System\EdnejZw.exe
  C:\Windows\System\EdnejZw.exe
  2⤵
  PID:5092
- C:\Windows\System\zZWqeeL.exe
  C:\Windows\System\zZWqeeL.exe
  2⤵
  PID:6016
- C:\Windows\System\IRQtDzz.exe
  C:\Windows\System\IRQtDzz.exe
  2⤵
  PID:5684
- C:\Windows\System\FOvmvWb.exe
  C:\Windows\System\FOvmvWb.exe
  2⤵
  PID:6008
- C:\Windows\System\sTshxEZ.exe
  C:\Windows\System\sTshxEZ.exe
  2⤵
  PID:5288
- C:\Windows\System\VTBxWXR.exe
  C:\Windows\System\VTBxWXR.exe
  2⤵
  PID:4496
- C:\Windows\System\jUUiZgb.exe
  C:\Windows\System\jUUiZgb.exe
  2⤵
  PID:6208
- C:\Windows\System\GOEmeMi.exe
  C:\Windows\System\GOEmeMi.exe
  2⤵
  PID:6212
- C:\Windows\System\xxhWOVK.exe
  C:\Windows\System\xxhWOVK.exe
  2⤵
  PID:6276
- C:\Windows\System\PkcUGcU.exe
  C:\Windows\System\PkcUGcU.exe
  2⤵
  PID:6336
- C:\Windows\System\RdcrxGg.exe
  C:\Windows\System\RdcrxGg.exe
  2⤵
  PID:6396
- C:\Windows\System\jqGrKRJ.exe
  C:\Windows\System\jqGrKRJ.exe
  2⤵
  PID:6464
- C:\Windows\System\RJbGGNZ.exe
  C:\Windows\System\RJbGGNZ.exe
  2⤵
  PID:6320
- C:\Windows\System\jFnADHe.exe
  C:\Windows\System\jFnADHe.exe
  2⤵
  PID:6528
- C:\Windows\System\LHQIcQY.exe
  C:\Windows\System\LHQIcQY.exe
  2⤵
  PID:6348
- C:\Windows\System\MPzYRZh.exe
  C:\Windows\System\MPzYRZh.exe
  2⤵
  PID:6448
- C:\Windows\System\ZhovNhA.exe
  C:\Windows\System\ZhovNhA.exe
  2⤵
  PID:6560
- C:\Windows\System\FlEKIJN.exe
  C:\Windows\System\FlEKIJN.exe
  2⤵
  PID:6476
- C:\Windows\System\JXcFatB.exe
  C:\Windows\System\JXcFatB.exe
  2⤵
  PID:6548
- C:\Windows\System\gxWokFd.exe
  C:\Windows\System\gxWokFd.exe
  2⤵
  PID:6576
- C:\Windows\System\KOwbzid.exe
  C:\Windows\System\KOwbzid.exe
  2⤵
  PID:6580
- C:\Windows\System\zZTZGcY.exe
  C:\Windows\System\zZTZGcY.exe
  2⤵
  PID:6612
- C:\Windows\System\KCRpcrd.exe
  C:\Windows\System\KCRpcrd.exe
  2⤵
  PID:6664
- C:\Windows\System\foZEdaw.exe
  C:\Windows\System\foZEdaw.exe
  2⤵
  PID:6700
- C:\Windows\System\VjKAtrx.exe
  C:\Windows\System\VjKAtrx.exe
  2⤵
  PID:6748
- C:\Windows\System\pgNMgjV.exe
  C:\Windows\System\pgNMgjV.exe
  2⤵
  PID:6812
- C:\Windows\System\ziYDBPa.exe
  C:\Windows\System\ziYDBPa.exe
  2⤵
  PID:6876
- C:\Windows\System\BFCjJzT.exe
  C:\Windows\System\BFCjJzT.exe
  2⤵
  PID:6892
- C:\Windows\System\yILjhNh.exe
  C:\Windows\System\yILjhNh.exe
  2⤵
  PID:6824
- C:\Windows\System\Kpkcfkz.exe
  C:\Windows\System\Kpkcfkz.exe
  2⤵
  PID:6760
- C:\Windows\System\srTiGae.exe
  C:\Windows\System\srTiGae.exe
  2⤵
  PID:6952
- C:\Windows\System\MOCafNK.exe
  C:\Windows\System\MOCafNK.exe
  2⤵
  PID:6972
- C:\Windows\System\yBKSuzt.exe
  C:\Windows\System\yBKSuzt.exe
  2⤵
  PID:7016
- C:\Windows\System\ggIitNo.exe
  C:\Windows\System\ggIitNo.exe
  2⤵
  PID:7036
- C:\Windows\System\aRpqrpp.exe
  C:\Windows\System\aRpqrpp.exe
  2⤵
  PID:7052
- C:\Windows\System\FJGrAEm.exe
  C:\Windows\System\FJGrAEm.exe
  2⤵
  PID:7096
- C:\Windows\System\BtUxjGB.exe
  C:\Windows\System\BtUxjGB.exe
  2⤵
  PID:7160
- C:\Windows\System\cRNAwdW.exe
  C:\Windows\System\cRNAwdW.exe
  2⤵
  PID:7144
- C:\Windows\System\WUQFBiS.exe
  C:\Windows\System\WUQFBiS.exe
  2⤵
  PID:5460
- C:\Windows\System\AwpcOnZ.exe
  C:\Windows\System\AwpcOnZ.exe
  2⤵
  PID:5852
- C:\Windows\System\Rfqrhed.exe
  C:\Windows\System\Rfqrhed.exe
  2⤵
  PID:6260
- C:\Windows\System\CFjjiJj.exe
  C:\Windows\System\CFjjiJj.exe
  2⤵
  PID:6244
- C:\Windows\System\ItJjiQj.exe
  C:\Windows\System\ItJjiQj.exe
  2⤵
  PID:6284
- C:\Windows\System\HgjFJsB.exe
  C:\Windows\System\HgjFJsB.exe
  2⤵
  PID:6380
- C:\Windows\System\SVIJEkz.exe
  C:\Windows\System\SVIJEkz.exe
  2⤵
  PID:6368
- C:\Windows\System\RMVnyIw.exe
  C:\Windows\System\RMVnyIw.exe
  2⤵
  PID:6592
- C:\Windows\System\izffaQy.exe
  C:\Windows\System\izffaQy.exe
  2⤵
  PID:6492
- C:\Windows\System\mMHeZMs.exe
  C:\Windows\System\mMHeZMs.exe
  2⤵
  PID:6508
- C:\Windows\System\AKlDkUl.exe
  C:\Windows\System\AKlDkUl.exe
  2⤵
  PID:6684
- C:\Windows\System\ASfmpOi.exe
  C:\Windows\System\ASfmpOi.exe
  2⤵
  PID:6808
- C:\Windows\System\iTcAdTL.exe
  C:\Windows\System\iTcAdTL.exe
  2⤵
  PID:6744
- C:\Windows\System\wLDrJuA.exe
  C:\Windows\System\wLDrJuA.exe
  2⤵
  PID:6968
- C:\Windows\System\qVjsERS.exe
  C:\Windows\System\qVjsERS.exe
  2⤵
  PID:7084
- C:\Windows\System\pjDEuVw.exe
  C:\Windows\System\pjDEuVw.exe
  2⤵
  PID:5640
- C:\Windows\System\OEjBlut.exe
  C:\Windows\System\OEjBlut.exe
  2⤵
  PID:6432
- C:\Windows\System\awyqSrZ.exe
  C:\Windows\System\awyqSrZ.exe
  2⤵
  PID:932
- C:\Windows\System\CirdSpj.exe
  C:\Windows\System\CirdSpj.exe
  2⤵
  PID:6780
- C:\Windows\System\ZUICRCL.exe
  C:\Windows\System\ZUICRCL.exe
  2⤵
  PID:6196
- C:\Windows\System\mztdbRO.exe
  C:\Windows\System\mztdbRO.exe
  2⤵
  PID:6792
- C:\Windows\System\PSKDVkh.exe
  C:\Windows\System\PSKDVkh.exe
  2⤵
  PID:7180
- C:\Windows\System\irjetyz.exe
  C:\Windows\System\irjetyz.exe
  2⤵
  PID:7216
- C:\Windows\System\vzbpZus.exe
  C:\Windows\System\vzbpZus.exe
  2⤵
  PID:7240
- C:\Windows\System\IWcTAkk.exe
  C:\Windows\System\IWcTAkk.exe
  2⤵
  PID:7256
- C:\Windows\System\KYiObHn.exe
  C:\Windows\System\KYiObHn.exe
  2⤵
  PID:7272
- C:\Windows\System\BohEHuT.exe
  C:\Windows\System\BohEHuT.exe
  2⤵
  PID:7292
- C:\Windows\System\ycqrkEf.exe
  C:\Windows\System\ycqrkEf.exe
  2⤵
  PID:7308
- C:\Windows\System\EilyUHr.exe
  C:\Windows\System\EilyUHr.exe
  2⤵
  PID:7324
- C:\Windows\System\EmoDYHc.exe
  C:\Windows\System\EmoDYHc.exe
  2⤵
  PID:7340
- C:\Windows\System\TmSVjiv.exe
  C:\Windows\System\TmSVjiv.exe
  2⤵
  PID:7356
- C:\Windows\System\hIujYiC.exe
  C:\Windows\System\hIujYiC.exe
  2⤵
  PID:7372
- C:\Windows\System\niXUCxS.exe
  C:\Windows\System\niXUCxS.exe
  2⤵
  PID:7388
- C:\Windows\System\yxZtjpT.exe
  C:\Windows\System\yxZtjpT.exe
  2⤵
  PID:7404
- C:\Windows\System\OMlGpSq.exe
  C:\Windows\System\OMlGpSq.exe
  2⤵
  PID:7420
- C:\Windows\System\mFnydvI.exe
  C:\Windows\System\mFnydvI.exe
  2⤵
  PID:7436
- C:\Windows\System\uIEmjME.exe
  C:\Windows\System\uIEmjME.exe
  2⤵
  PID:7452
- C:\Windows\System\eLWLGmj.exe
  C:\Windows\System\eLWLGmj.exe
  2⤵
  PID:7468
- C:\Windows\System\FbXhNZs.exe
  C:\Windows\System\FbXhNZs.exe
  2⤵
  PID:7484
- C:\Windows\System\btFKVgN.exe
  C:\Windows\System\btFKVgN.exe
  2⤵
  PID:7500
- C:\Windows\System\tcMqsoH.exe
  C:\Windows\System\tcMqsoH.exe
  2⤵
  PID:7516
- C:\Windows\System\rRdeJiJ.exe
  C:\Windows\System\rRdeJiJ.exe
  2⤵
  PID:7532
- C:\Windows\System\QTrvmNk.exe
  C:\Windows\System\QTrvmNk.exe
  2⤵
  PID:7548
- C:\Windows\System\GjNEUsS.exe
  C:\Windows\System\GjNEUsS.exe
  2⤵
  PID:7564
- C:\Windows\System\QKAzeWr.exe
  C:\Windows\System\QKAzeWr.exe
  2⤵
  PID:7580
- C:\Windows\System\iGUZcBs.exe
  C:\Windows\System\iGUZcBs.exe
  2⤵
  PID:7596
- C:\Windows\System\ZoJApuK.exe
  C:\Windows\System\ZoJApuK.exe
  2⤵
  PID:7612
- C:\Windows\System\uwDcTLs.exe
  C:\Windows\System\uwDcTLs.exe
  2⤵
  PID:7628
- C:\Windows\System\JOGTtlj.exe
  C:\Windows\System\JOGTtlj.exe
  2⤵
  PID:7644
- C:\Windows\System\GqlQmBE.exe
  C:\Windows\System\GqlQmBE.exe
  2⤵
  PID:7660
- C:\Windows\System\TrwHufj.exe
  C:\Windows\System\TrwHufj.exe
  2⤵
  PID:7680
- C:\Windows\System\EouMzPg.exe
  C:\Windows\System\EouMzPg.exe
  2⤵
  PID:7696
- C:\Windows\System\jUyDCqU.exe
  C:\Windows\System\jUyDCqU.exe
  2⤵
  PID:7716
- C:\Windows\System\layBXKG.exe
  C:\Windows\System\layBXKG.exe
  2⤵
  PID:7732
- C:\Windows\System\yfXFgMn.exe
  C:\Windows\System\yfXFgMn.exe
  2⤵
  PID:7748
- C:\Windows\System\WwCwaea.exe
  C:\Windows\System\WwCwaea.exe
  2⤵
  PID:7764
- C:\Windows\System\pcmXlRL.exe
  C:\Windows\System\pcmXlRL.exe
  2⤵
  PID:7780
- C:\Windows\System\pvxZhmo.exe
  C:\Windows\System\pvxZhmo.exe
  2⤵
  PID:7796
- C:\Windows\System\ZSrvsuJ.exe
  C:\Windows\System\ZSrvsuJ.exe
  2⤵
  PID:7812
- C:\Windows\System\hJpXtqi.exe
  C:\Windows\System\hJpXtqi.exe
  2⤵
  PID:7828
- C:\Windows\System\yuoMITo.exe
  C:\Windows\System\yuoMITo.exe
  2⤵
  PID:7844
- C:\Windows\System\DpgwpVh.exe
  C:\Windows\System\DpgwpVh.exe
  2⤵
  PID:7860
- C:\Windows\System\IYqayhe.exe
  C:\Windows\System\IYqayhe.exe
  2⤵
  PID:7876
- C:\Windows\System\kEFxvXA.exe
  C:\Windows\System\kEFxvXA.exe
  2⤵
  PID:7892
- C:\Windows\System\fXhdQSJ.exe
  C:\Windows\System\fXhdQSJ.exe
  2⤵
  PID:7908
- C:\Windows\System\gTBQUqy.exe
  C:\Windows\System\gTBQUqy.exe
  2⤵
  PID:7928
- C:\Windows\System\MGIvfgD.exe
  C:\Windows\System\MGIvfgD.exe
  2⤵
  PID:7944
- C:\Windows\System\NbVKuSX.exe
  C:\Windows\System\NbVKuSX.exe
  2⤵
  PID:7960
- C:\Windows\System\zPCRHRd.exe
  C:\Windows\System\zPCRHRd.exe
  2⤵
  PID:7976
- C:\Windows\System\vQfkHgb.exe
  C:\Windows\System\vQfkHgb.exe
  2⤵
  PID:7992
- C:\Windows\System\XxBSVEr.exe
  C:\Windows\System\XxBSVEr.exe
  2⤵
  PID:8008
- C:\Windows\System\YUMuEJm.exe
  C:\Windows\System\YUMuEJm.exe
  2⤵
  PID:8024
- C:\Windows\System\svBZygn.exe
  C:\Windows\System\svBZygn.exe
  2⤵
  PID:8040
- C:\Windows\System\vGdvcIR.exe
  C:\Windows\System\vGdvcIR.exe
  2⤵
  PID:8056
- C:\Windows\System\MyfiMZF.exe
  C:\Windows\System\MyfiMZF.exe
  2⤵
  PID:8076
- C:\Windows\System\feevMIh.exe
  C:\Windows\System\feevMIh.exe
  2⤵
  PID:8092
- C:\Windows\System\UwlPCuc.exe
  C:\Windows\System\UwlPCuc.exe
  2⤵
  PID:8108
- C:\Windows\System\NIHsxWZ.exe
  C:\Windows\System\NIHsxWZ.exe
  2⤵
  PID:8124
- C:\Windows\System\Iziruxi.exe
  C:\Windows\System\Iziruxi.exe
  2⤵
  PID:8140
- C:\Windows\System\csvktyM.exe
  C:\Windows\System\csvktyM.exe
  2⤵
  PID:8156
- C:\Windows\System\qAvIgnr.exe
  C:\Windows\System\qAvIgnr.exe
  2⤵
  PID:8172
- C:\Windows\System\FzsXrwd.exe
  C:\Windows\System\FzsXrwd.exe
  2⤵
  PID:8188
- C:\Windows\System\QeugnST.exe
  C:\Windows\System\QeugnST.exe
  2⤵
  PID:6716
- C:\Windows\System\vUXrYol.exe
  C:\Windows\System\vUXrYol.exe
  2⤵
  PID:7188
- C:\Windows\System\wXTnSDq.exe
  C:\Windows\System\wXTnSDq.exe
  2⤵
  PID:6828
- C:\Windows\System\EtKIKeU.exe
  C:\Windows\System\EtKIKeU.exe
  2⤵
  PID:7068
- C:\Windows\System\rwTeDhm.exe
  C:\Windows\System\rwTeDhm.exe
  2⤵
  PID:6280
- C:\Windows\System\WJJtoli.exe
  C:\Windows\System\WJJtoli.exe
  2⤵
  PID:7224
- C:\Windows\System\jnUcjgM.exe
  C:\Windows\System\jnUcjgM.exe
  2⤵
  PID:7268
- C:\Windows\System\csRzEwm.exe
  C:\Windows\System\csRzEwm.exe
  2⤵
  PID:7300
- C:\Windows\System\heuqGwD.exe
  C:\Windows\System\heuqGwD.exe
  2⤵
  PID:7368
- C:\Windows\System\RAMqAoV.exe
  C:\Windows\System\RAMqAoV.exe
  2⤵
  PID:7432
- C:\Windows\System\AjTpdih.exe
  C:\Windows\System\AjTpdih.exe
  2⤵
  PID:7492
- C:\Windows\System\WFbdZol.exe
  C:\Windows\System\WFbdZol.exe
  2⤵
  PID:7560
- C:\Windows\System\GxSHbaH.exe
  C:\Windows\System\GxSHbaH.exe
  2⤵
  PID:7620
- C:\Windows\System\qcieZCg.exe
  C:\Windows\System\qcieZCg.exe
  2⤵
  PID:7688
- C:\Windows\System\oScSDQl.exe
  C:\Windows\System\oScSDQl.exe
  2⤵
  PID:7724
- C:\Windows\System\KNMyxdM.exe
  C:\Windows\System\KNMyxdM.exe
  2⤵
  PID:7788
- C:\Windows\System\gjYqjYC.exe
  C:\Windows\System\gjYqjYC.exe
  2⤵
  PID:7856
- C:\Windows\System\qjrqSpL.exe
  C:\Windows\System\qjrqSpL.exe
  2⤵
  PID:7916
- C:\Windows\System\wNRDXdw.exe
  C:\Windows\System\wNRDXdw.exe
  2⤵
  PID:7984
- C:\Windows\System\TRFjrtd.exe
  C:\Windows\System\TRFjrtd.exe
  2⤵
  PID:7348
- C:\Windows\System\AKZBFgU.exe
  C:\Windows\System\AKZBFgU.exe
  2⤵
  PID:7544
- C:\Windows\System\kAdZrql.exe
  C:\Windows\System\kAdZrql.exe
  2⤵
  PID:7744
- C:\Windows\System\awgoIpb.exe
  C:\Windows\System\awgoIpb.exe
  2⤵
  PID:7836
- C:\Windows\System\GJHqalw.exe
  C:\Windows\System\GJHqalw.exe
  2⤵
  PID:7940
- C:\Windows\System\VpcngBx.exe
  C:\Windows\System\VpcngBx.exe
  2⤵
  PID:8064
- C:\Windows\System\ylQziCD.exe
  C:\Windows\System\ylQziCD.exe
  2⤵
  PID:7872
- C:\Windows\System\nXAoTXc.exe
  C:\Windows\System\nXAoTXc.exe
  2⤵
  PID:7320
- C:\Windows\System\KuJlExA.exe
  C:\Windows\System\KuJlExA.exe
  2⤵
  PID:7448
- C:\Windows\System\WrzMwct.exe
  C:\Windows\System\WrzMwct.exe
  2⤵
  PID:7384
- C:\Windows\System\viaagnl.exe
  C:\Windows\System\viaagnl.exe
  2⤵
  PID:8088
- C:\Windows\System\yAdhusl.exe
  C:\Windows\System\yAdhusl.exe
  2⤵
  PID:8184
- C:\Windows\System\FllXDDD.exe
  C:\Windows\System\FllXDDD.exe
  2⤵
  PID:6676
- C:\Windows\System\knUevwC.exe
  C:\Windows\System\knUevwC.exe
  2⤵
  PID:8132
- C:\Windows\System\yloeGHO.exe
  C:\Windows\System\yloeGHO.exe
  2⤵
  PID:8068
- C:\Windows\System\KrMsckF.exe
  C:\Windows\System\KrMsckF.exe
  2⤵
  PID:6416
- C:\Windows\System\gndHODO.exe
  C:\Windows\System\gndHODO.exe
  2⤵
  PID:6304
- C:\Windows\System\leoghKj.exe
  C:\Windows\System\leoghKj.exe
  2⤵
  PID:936
- C:\Windows\System\MeWXNxu.exe
  C:\Windows\System\MeWXNxu.exe
  2⤵
  PID:7032
- C:\Windows\System\UlrwIBp.exe
  C:\Windows\System\UlrwIBp.exe
  2⤵
  PID:6888
- C:\Windows\System\xhlStSR.exe
  C:\Windows\System\xhlStSR.exe
  2⤵
  PID:7208
- C:\Windows\System\FFTrhjR.exe
  C:\Windows\System\FFTrhjR.exe
  2⤵
  PID:6644
- C:\Windows\System\RgTlwXa.exe
  C:\Windows\System\RgTlwXa.exe
  2⤵
  PID:7528
- C:\Windows\System\FFAYbzd.exe
  C:\Windows\System\FFAYbzd.exe
  2⤵
  PID:7364
- C:\Windows\System\kINOtXw.exe
  C:\Windows\System\kINOtXw.exe
  2⤵
  PID:7232
- C:\Windows\System\zZfxjYm.exe
  C:\Windows\System\zZfxjYm.exe
  2⤵
  PID:7588
- C:\Windows\System\eKhiGVO.exe
  C:\Windows\System\eKhiGVO.exe
  2⤵
  PID:7740
- C:\Windows\System\FtdVbfA.exe
  C:\Windows\System\FtdVbfA.exe
  2⤵
  PID:7868
- C:\Windows\System\UjxGvcF.exe
  C:\Windows\System\UjxGvcF.exe
  2⤵
  PID:7804
- C:\Windows\System\NQILFmO.exe
  C:\Windows\System\NQILFmO.exe
  2⤵
  PID:6728
- C:\Windows\System\URzfnpJ.exe
  C:\Windows\System\URzfnpJ.exe
  2⤵
  PID:7904
- C:\Windows\System\TWHNKKm.exe
  C:\Windows\System\TWHNKKm.exe
  2⤵
  PID:8000
- C:\Windows\System\BqYaxNS.exe
  C:\Windows\System\BqYaxNS.exe
  2⤵
  PID:7636
- C:\Windows\System\QvzKwKF.exe
  C:\Windows\System\QvzKwKF.exe
  2⤵
  PID:7604
- C:\Windows\System\UmdAevE.exe
  C:\Windows\System\UmdAevE.exe
  2⤵
  PID:7512
- C:\Windows\System\fSqHZCF.exe
  C:\Windows\System\fSqHZCF.exe
  2⤵
  PID:8084
- C:\Windows\System\EUEKAHi.exe
  C:\Windows\System\EUEKAHi.exe
  2⤵
  PID:7316
- C:\Windows\System\lNTQjwD.exe
  C:\Windows\System\lNTQjwD.exe
  2⤵
  PID:8016
- C:\Windows\System\RnhqQJj.exe
  C:\Windows\System\RnhqQJj.exe
  2⤵
  PID:8072
- C:\Windows\System\zNkdMEg.exe
  C:\Windows\System\zNkdMEg.exe
  2⤵
  PID:6632
- C:\Windows\System\UMtEFDD.exe
  C:\Windows\System\UMtEFDD.exe
  2⤵
  PID:7956
- C:\Windows\System\FDCbSJB.exe
  C:\Windows\System\FDCbSJB.exe
  2⤵
  PID:7288
- C:\Windows\System\azZBINV.exe
  C:\Windows\System\azZBINV.exe
  2⤵
  PID:7480
- C:\Windows\System\oUiUywF.exe
  C:\Windows\System\oUiUywF.exe
  2⤵
  PID:8196
- C:\Windows\System\zeTbqvn.exe
  C:\Windows\System\zeTbqvn.exe
  2⤵
  PID:8216
- C:\Windows\System\DlMwMgz.exe
  C:\Windows\System\DlMwMgz.exe
  2⤵
  PID:8372
- C:\Windows\System\JCQaNFm.exe
  C:\Windows\System\JCQaNFm.exe
  2⤵
  PID:8388
- C:\Windows\System\lAGMvop.exe
  C:\Windows\System\lAGMvop.exe
  2⤵
  PID:8404
- C:\Windows\System\jYckepY.exe
  C:\Windows\System\jYckepY.exe
  2⤵
  PID:8424
- C:\Windows\System\UqkZXCY.exe
  C:\Windows\System\UqkZXCY.exe
  2⤵
  PID:8440
- C:\Windows\System\XCjMnYM.exe
  C:\Windows\System\XCjMnYM.exe
  2⤵
  PID:8456
- C:\Windows\System\ljuKOlY.exe
  C:\Windows\System\ljuKOlY.exe
  2⤵
  PID:8472
- C:\Windows\System\DYdPqog.exe
  C:\Windows\System\DYdPqog.exe
  2⤵
  PID:8488
- C:\Windows\System\qLhZFXb.exe
  C:\Windows\System\qLhZFXb.exe
  2⤵
  PID:8504
- C:\Windows\System\XBWAplD.exe
  C:\Windows\System\XBWAplD.exe
  2⤵
  PID:8520
- C:\Windows\System\LmluREx.exe
  C:\Windows\System\LmluREx.exe
  2⤵
  PID:8536
- C:\Windows\System\RUtbNPf.exe
  C:\Windows\System\RUtbNPf.exe
  2⤵
  PID:8552
- C:\Windows\System\tWqbhaD.exe
  C:\Windows\System\tWqbhaD.exe
  2⤵
  PID:8568
- C:\Windows\System\AMxxuXC.exe
  C:\Windows\System\AMxxuXC.exe
  2⤵
  PID:8584
- C:\Windows\System\junsPjE.exe
  C:\Windows\System\junsPjE.exe
  2⤵
  PID:8600
- C:\Windows\System\GCOlhVr.exe
  C:\Windows\System\GCOlhVr.exe
  2⤵
  PID:8616
- C:\Windows\System\jlJeRDf.exe
  C:\Windows\System\jlJeRDf.exe
  2⤵
  PID:8632
- C:\Windows\System\wyzpYGJ.exe
  C:\Windows\System\wyzpYGJ.exe
  2⤵
  PID:8648
- C:\Windows\System\dOTWkJC.exe
  C:\Windows\System\dOTWkJC.exe
  2⤵
  PID:8664
- C:\Windows\System\utiADAp.exe
  C:\Windows\System\utiADAp.exe
  2⤵
  PID:8680
- C:\Windows\System\TDnsTKs.exe
  C:\Windows\System\TDnsTKs.exe
  2⤵
  PID:8696
- C:\Windows\System\zyQURRO.exe
  C:\Windows\System\zyQURRO.exe
  2⤵
  PID:8712
- C:\Windows\System\jySajvb.exe
  C:\Windows\System\jySajvb.exe
  2⤵
  PID:8728
- C:\Windows\System\oumkFkS.exe
  C:\Windows\System\oumkFkS.exe
  2⤵
  PID:8744
- C:\Windows\System\cKMMdvP.exe
  C:\Windows\System\cKMMdvP.exe
  2⤵
  PID:8760
- C:\Windows\System\esbpuHK.exe
  C:\Windows\System\esbpuHK.exe
  2⤵
  PID:8776
- C:\Windows\System\NhVuyHn.exe
  C:\Windows\System\NhVuyHn.exe
  2⤵
  PID:8792
- C:\Windows\System\jBpivjg.exe
  C:\Windows\System\jBpivjg.exe
  2⤵
  PID:8812
- C:\Windows\System\UjRmJCk.exe
  C:\Windows\System\UjRmJCk.exe
  2⤵
  PID:8828
- C:\Windows\System\RXUxRYi.exe
  C:\Windows\System\RXUxRYi.exe
  2⤵
  PID:8844
- C:\Windows\System\ItXfeME.exe
  C:\Windows\System\ItXfeME.exe
  2⤵
  PID:8860
- C:\Windows\System\wZyjnkR.exe
  C:\Windows\System\wZyjnkR.exe
  2⤵
  PID:8876
- C:\Windows\System\GpvlErF.exe
  C:\Windows\System\GpvlErF.exe
  2⤵
  PID:8892
- C:\Windows\System\UPyegqK.exe
  C:\Windows\System\UPyegqK.exe
  2⤵
  PID:8908
- C:\Windows\System\trPUYxZ.exe
  C:\Windows\System\trPUYxZ.exe
  2⤵
  PID:8924
- C:\Windows\System\DbzGzYH.exe
  C:\Windows\System\DbzGzYH.exe
  2⤵
  PID:8940
- C:\Windows\System\oaJtbXS.exe
  C:\Windows\System\oaJtbXS.exe
  2⤵
  PID:8956
- C:\Windows\System\MnALjaj.exe
  C:\Windows\System\MnALjaj.exe
  2⤵
  PID:8972
- C:\Windows\System\wgqFmzk.exe
  C:\Windows\System\wgqFmzk.exe
  2⤵
  PID:8988
- C:\Windows\System\FAFEWGI.exe
  C:\Windows\System\FAFEWGI.exe
  2⤵
  PID:9004
- C:\Windows\System\nwiwOFi.exe
  C:\Windows\System\nwiwOFi.exe
  2⤵
  PID:9020
- C:\Windows\System\pjRmwKA.exe
  C:\Windows\System\pjRmwKA.exe
  2⤵
  PID:9036
- C:\Windows\System\YgVqrTN.exe
  C:\Windows\System\YgVqrTN.exe
  2⤵
  PID:9052
- C:\Windows\System\degkBKd.exe
  C:\Windows\System\degkBKd.exe
  2⤵
  PID:9068
- C:\Windows\System\FKmeldh.exe
  C:\Windows\System\FKmeldh.exe
  2⤵
  PID:9084
- C:\Windows\System\dzXfZZs.exe
  C:\Windows\System\dzXfZZs.exe
  2⤵
  PID:9100
- C:\Windows\System\ByIFxFE.exe
  C:\Windows\System\ByIFxFE.exe
  2⤵
  PID:9116
- C:\Windows\System\rhiGIhI.exe
  C:\Windows\System\rhiGIhI.exe
  2⤵
  PID:9132
- C:\Windows\System\PNvbbSN.exe
  C:\Windows\System\PNvbbSN.exe
  2⤵
  PID:9148
- C:\Windows\System\XBFjuMK.exe
  C:\Windows\System\XBFjuMK.exe
  2⤵
  PID:9164
- C:\Windows\System\lmFnCJl.exe
  C:\Windows\System\lmFnCJl.exe
  2⤵
  PID:9180
- C:\Windows\System\YIJFXbe.exe
  C:\Windows\System\YIJFXbe.exe
  2⤵
  PID:9196
- C:\Windows\System\BGZoBke.exe
  C:\Windows\System\BGZoBke.exe
  2⤵
  PID:9212
- C:\Windows\System\qghnnvP.exe
  C:\Windows\System\qghnnvP.exe
  2⤵
  PID:7676
- C:\Windows\System\EMpmpsE.exe
  C:\Windows\System\EMpmpsE.exe
  2⤵
  PID:7304
- C:\Windows\System\UPrjaOI.exe
  C:\Windows\System\UPrjaOI.exe
  2⤵
  PID:8224
- C:\Windows\System\xwTXqVl.exe
  C:\Windows\System\xwTXqVl.exe
  2⤵
  PID:7264
- C:\Windows\System\PJYbDOD.exe
  C:\Windows\System\PJYbDOD.exe
  2⤵
  PID:7640
- C:\Windows\System\xUvkDCn.exe
  C:\Windows\System\xUvkDCn.exe
  2⤵
  PID:7572
- C:\Windows\System\IrudsVa.exe
  C:\Windows\System\IrudsVa.exe
  2⤵
  PID:8288
- C:\Windows\System\TojOscG.exe
  C:\Windows\System\TojOscG.exe
  2⤵
  PID:6872
- C:\Windows\System\UqauvFf.exe
  C:\Windows\System\UqauvFf.exe
  2⤵
  PID:7196
- C:\Windows\System\LnbtAOI.exe
  C:\Windows\System\LnbtAOI.exe
  2⤵
  PID:7400
- C:\Windows\System\ObClSKk.exe
  C:\Windows\System\ObClSKk.exe
  2⤵
  PID:7336
- C:\Windows\System\QvZjwPB.exe
  C:\Windows\System\QvZjwPB.exe
  2⤵
  PID:7200
- C:\Windows\System\ypcXTqa.exe
  C:\Windows\System\ypcXTqa.exe
  2⤵
  PID:8228
- C:\Windows\System\yqFnStq.exe
  C:\Windows\System\yqFnStq.exe
  2⤵
  PID:8240
- C:\Windows\System\gJFRCBV.exe
  C:\Windows\System\gJFRCBV.exe
  2⤵
  PID:8260
- C:\Windows\System\QlZdcnR.exe
  C:\Windows\System\QlZdcnR.exe
  2⤵
  PID:8284
- C:\Windows\System\FHCkVlz.exe
  C:\Windows\System\FHCkVlz.exe
  2⤵
  PID:8320
- C:\Windows\System\gCzDMrp.exe
  C:\Windows\System\gCzDMrp.exe
  2⤵
  PID:8324
- C:\Windows\System\tSeVnHF.exe
  C:\Windows\System\tSeVnHF.exe
  2⤵
  PID:8340
- C:\Windows\System\hrHwAst.exe
  C:\Windows\System\hrHwAst.exe
  2⤵
  PID:8352
- C:\Windows\System\MTEzYga.exe
  C:\Windows\System\MTEzYga.exe
  2⤵
  PID:8384
- C:\Windows\System\uCkBCFE.exe
  C:\Windows\System\uCkBCFE.exe
  2⤵
  PID:8452
- C:\Windows\System\hJiRVSi.exe
  C:\Windows\System\hJiRVSi.exe
  2⤵
  PID:8516
- C:\Windows\System\DcLqUpp.exe
  C:\Windows\System\DcLqUpp.exe
  2⤵
  PID:8608
- C:\Windows\System\hXLMqet.exe
  C:\Windows\System\hXLMqet.exe
  2⤵
  PID:8672
- C:\Windows\System\zRRqXQZ.exe
  C:\Windows\System\zRRqXQZ.exe
  2⤵
  PID:8736
- C:\Windows\System\pIWebAU.exe
  C:\Windows\System\pIWebAU.exe
  2⤵
  PID:8396
- C:\Windows\System\xmdLODU.exe
  C:\Windows\System\xmdLODU.exe
  2⤵
  PID:8532
- C:\Windows\System\DGcFLfF.exe
  C:\Windows\System\DGcFLfF.exe
  2⤵
  PID:8768
- C:\Windows\System\dlCjnQn.exe
  C:\Windows\System\dlCjnQn.exe
  2⤵
  PID:8804
- C:\Windows\System\ecZQXVR.exe
  C:\Windows\System\ecZQXVR.exe
  2⤵
  PID:8836
- C:\Windows\System\ZMtVzYS.exe
  C:\Windows\System\ZMtVzYS.exe
  2⤵
  PID:8788
- C:\Windows\System\QviWKBD.exe
  C:\Windows\System\QviWKBD.exe
  2⤵
  PID:8868
- C:\Windows\System\PQjlmKE.exe
  C:\Windows\System\PQjlmKE.exe
  2⤵
  PID:8432
- C:\Windows\System\uAGAGNS.exe
  C:\Windows\System\uAGAGNS.exe
  2⤵
  PID:8784
- C:\Windows\System\YGvpdmZ.exe
  C:\Windows\System\YGvpdmZ.exe
  2⤵
  PID:9000
- C:\Windows\System\eNrerjz.exe
  C:\Windows\System\eNrerjz.exe
  2⤵
  PID:9028
- C:\Windows\System\jIyDHBJ.exe
  C:\Windows\System\jIyDHBJ.exe
  2⤵
  PID:8884
- C:\Windows\System\CwPfmak.exe
  C:\Windows\System\CwPfmak.exe
  2⤵
  PID:9096
- C:\Windows\System\BckOsmg.exe
  C:\Windows\System\BckOsmg.exe
  2⤵
  PID:9156
- C:\Windows\System\UYsACDY.exe
  C:\Windows\System\UYsACDY.exe
  2⤵
  PID:9160
- C:\Windows\System\AWMdmlz.exe
  C:\Windows\System\AWMdmlz.exe
  2⤵
  PID:8952
- C:\Windows\System\SjnKYJp.exe
  C:\Windows\System\SjnKYJp.exe
  2⤵
  PID:9012
- C:\Windows\System\BztxkrQ.exe
  C:\Windows\System\BztxkrQ.exe
  2⤵
  PID:7004
- C:\Windows\System\pTSsXcB.exe
  C:\Windows\System\pTSsXcB.exe
  2⤵
  PID:8888
- C:\Windows\System\bkjFRtH.exe
  C:\Windows\System\bkjFRtH.exe
  2⤵
  PID:6176
- C:\Windows\System\pCfZpXs.exe
  C:\Windows\System\pCfZpXs.exe
  2⤵
  PID:8180
- C:\Windows\System\uYqNjHI.exe
  C:\Windows\System\uYqNjHI.exe
  2⤵
  PID:9112
- C:\Windows\System\xjxTxrc.exe
  C:\Windows\System\xjxTxrc.exe
  2⤵
  PID:9176
- C:\Windows\System\KTVHUVP.exe
  C:\Windows\System\KTVHUVP.exe
  2⤵
  PID:8300
- C:\Windows\System\BtChlkS.exe
  C:\Windows\System\BtChlkS.exe
  2⤵
  PID:9144
- C:\Windows\System\HSvoncj.exe
  C:\Windows\System\HSvoncj.exe
  2⤵
  PID:9208
- C:\Windows\System\FAooZFF.exe
  C:\Windows\System\FAooZFF.exe
  2⤵
  PID:8168
- C:\Windows\System\XgDipZL.exe
  C:\Windows\System\XgDipZL.exe
  2⤵
  PID:7132
- C:\Windows\System\ZXCCJCO.exe
  C:\Windows\System\ZXCCJCO.exe
  2⤵
  PID:8232
- C:\Windows\System\ThtaFhe.exe
  C:\Windows\System\ThtaFhe.exe
  2⤵
  PID:8364
- C:\Windows\System\iXsUjer.exe
  C:\Windows\System\iXsUjer.exe
  2⤵
  PID:8512
- C:\Windows\System\qWitioh.exe
  C:\Windows\System\qWitioh.exe
  2⤵
  PID:8348
- C:\Windows\System\KzINahQ.exe
  C:\Windows\System\KzINahQ.exe
  2⤵
  PID:9064
- C:\Windows\System\DikYsvh.exe
  C:\Windows\System\DikYsvh.exe
  2⤵
  PID:7464
- C:\Windows\System\xqdFHCO.exe
  C:\Windows\System\xqdFHCO.exe
  2⤵
  PID:8500
- C:\Windows\System\czYUooH.exe
  C:\Windows\System\czYUooH.exe
  2⤵
  PID:7524
- C:\Windows\System\VVfbZqW.exe
  C:\Windows\System\VVfbZqW.exe
  2⤵
  PID:9076
- C:\Windows\System\ZWIoAlh.exe
  C:\Windows\System\ZWIoAlh.exe
  2⤵
  PID:8824
- C:\Windows\System\ylUCkgK.exe
  C:\Windows\System\ylUCkgK.exe
  2⤵
  PID:8692
- C:\Windows\System\KircowX.exe
  C:\Windows\System\KircowX.exe
  2⤵
  PID:8436
- C:\Windows\System\bEfTdrK.exe
  C:\Windows\System\bEfTdrK.exe
  2⤵
  PID:6092
- C:\Windows\System\GtplIug.exe
  C:\Windows\System\GtplIug.exe
  2⤵
  PID:8312
- C:\Windows\System\gQcyHJS.exe
  C:\Windows\System\gQcyHJS.exe
  2⤵
  PID:8336
- C:\Windows\System\KfWSRWc.exe
  C:\Windows\System\KfWSRWc.exe
  2⤵
  PID:8280
- C:\Windows\System\eFBmulJ.exe
  C:\Windows\System\eFBmulJ.exe
  2⤵
  PID:8148
- C:\Windows\System\XVoHQPi.exe
  C:\Windows\System\XVoHQPi.exe
  2⤵
  PID:8344
- C:\Windows\System\FgGntCJ.exe
  C:\Windows\System\FgGntCJ.exe
  2⤵
  PID:8564
- C:\Windows\System\kNHJuCs.exe
  C:\Windows\System\kNHJuCs.exe
  2⤵
  PID:8756
- C:\Windows\System\UtmYosI.exe
  C:\Windows\System\UtmYosI.exe
  2⤵
  PID:8624
- C:\Windows\System\agEqIPX.exe
  C:\Windows\System\agEqIPX.exe
  2⤵
  PID:8464
- C:\Windows\System\zJSXLGA.exe
  C:\Windows\System\zJSXLGA.exe
  2⤵
  PID:8720
- C:\Windows\System\aKFHyky.exe
  C:\Windows\System\aKFHyky.exe
  2⤵
  PID:6696
- C:\Windows\System\uaxCxmj.exe
  C:\Windows\System\uaxCxmj.exe
  2⤵
  PID:9228
- C:\Windows\System\YBLgHrg.exe
  C:\Windows\System\YBLgHrg.exe
  2⤵
  PID:9304
- C:\Windows\System\RSdQTPf.exe
  C:\Windows\System\RSdQTPf.exe
  2⤵
  PID:9320
- C:\Windows\System\toXBGiP.exe
  C:\Windows\System\toXBGiP.exe
  2⤵
  PID:9336
- C:\Windows\System\KlPpExI.exe
  C:\Windows\System\KlPpExI.exe
  2⤵
  PID:9352
- C:\Windows\System\xbPaShC.exe
  C:\Windows\System\xbPaShC.exe
  2⤵
  PID:9368
- C:\Windows\System\qPANAOJ.exe
  C:\Windows\System\qPANAOJ.exe
  2⤵
  PID:9384
- C:\Windows\System\YjIapJG.exe
  C:\Windows\System\YjIapJG.exe
  2⤵
  PID:9404
- C:\Windows\System\MSJjJnB.exe
  C:\Windows\System\MSJjJnB.exe
  2⤵
  PID:9432
- C:\Windows\System\FLQaVvy.exe
  C:\Windows\System\FLQaVvy.exe
  2⤵
  PID:9448
- C:\Windows\System\HgfjatE.exe
  C:\Windows\System\HgfjatE.exe
  2⤵
  PID:9464
- C:\Windows\System\azKRziK.exe
  C:\Windows\System\azKRziK.exe
  2⤵
  PID:9480
- C:\Windows\System\HPWaudY.exe
  C:\Windows\System\HPWaudY.exe
  2⤵
  PID:9496
- C:\Windows\System\ruAXjRn.exe
  C:\Windows\System\ruAXjRn.exe
  2⤵
  PID:9512
- C:\Windows\System\hPeUZCp.exe
  C:\Windows\System\hPeUZCp.exe
  2⤵
  PID:9528
- C:\Windows\System\xpVKYqy.exe
  C:\Windows\System\xpVKYqy.exe
  2⤵
  PID:9544
- C:\Windows\System\XiDxaKt.exe
  C:\Windows\System\XiDxaKt.exe
  2⤵
  PID:9560
- C:\Windows\System\fOgoEYb.exe
  C:\Windows\System\fOgoEYb.exe
  2⤵
  PID:9576
- C:\Windows\System\OEOxPWV.exe
  C:\Windows\System\OEOxPWV.exe
  2⤵
  PID:9596
- C:\Windows\System\otKfdGi.exe
  C:\Windows\System\otKfdGi.exe
  2⤵
  PID:9612
- C:\Windows\System\gPvHwqB.exe
  C:\Windows\System\gPvHwqB.exe
  2⤵
  PID:9628
- C:\Windows\System\WtgtOpc.exe
  C:\Windows\System\WtgtOpc.exe
  2⤵
  PID:9644
- C:\Windows\System\NzDgGqH.exe
  C:\Windows\System\NzDgGqH.exe
  2⤵
  PID:9660
- C:\Windows\System\YEMaZrp.exe
  C:\Windows\System\YEMaZrp.exe
  2⤵
  PID:9684
- C:\Windows\System\LJgkFKy.exe
  C:\Windows\System\LJgkFKy.exe
  2⤵
  PID:9700
- C:\Windows\System\WbrMYCk.exe
  C:\Windows\System\WbrMYCk.exe
  2⤵
  PID:9716
- C:\Windows\System\WvfYBnD.exe
  C:\Windows\System\WvfYBnD.exe
  2⤵
  PID:9732
- C:\Windows\System\iCUYtvT.exe
  C:\Windows\System\iCUYtvT.exe
  2⤵
  PID:9748
- C:\Windows\System\jNanGUU.exe
  C:\Windows\System\jNanGUU.exe
  2⤵
  PID:9764
- C:\Windows\System\zUJIEvN.exe
  C:\Windows\System\zUJIEvN.exe
  2⤵
  PID:9780
- C:\Windows\System\ybxYkmP.exe
  C:\Windows\System\ybxYkmP.exe
  2⤵
  PID:9796
- C:\Windows\System\uKTVwUo.exe
  C:\Windows\System\uKTVwUo.exe
  2⤵
  PID:9812
- C:\Windows\System\okaXGvF.exe
  C:\Windows\System\okaXGvF.exe
  2⤵
  PID:9828
- C:\Windows\System\czBSdfg.exe
  C:\Windows\System\czBSdfg.exe
  2⤵
  PID:9844
- C:\Windows\System\rGxDPGC.exe
  C:\Windows\System\rGxDPGC.exe
  2⤵
  PID:9860
- C:\Windows\System\ttegyRj.exe
  C:\Windows\System\ttegyRj.exe
  2⤵
  PID:9876
- C:\Windows\System\sWMcpaW.exe
  C:\Windows\System\sWMcpaW.exe
  2⤵
  PID:9892
- C:\Windows\System\oyXtjQR.exe
  C:\Windows\System\oyXtjQR.exe
  2⤵
  PID:9908
- C:\Windows\System\AGslcHB.exe
  C:\Windows\System\AGslcHB.exe
  2⤵
  PID:9924
- C:\Windows\System\xmlxZrc.exe
  C:\Windows\System\xmlxZrc.exe
  2⤵
  PID:9940
- C:\Windows\System\qvmklAX.exe
  C:\Windows\System\qvmklAX.exe
  2⤵
  PID:9956
- C:\Windows\System\JEsQDlS.exe
  C:\Windows\System\JEsQDlS.exe
  2⤵
  PID:9972
- C:\Windows\System\piHVBAb.exe
  C:\Windows\System\piHVBAb.exe
  2⤵
  PID:9988
- C:\Windows\System\FSqpUpm.exe
  C:\Windows\System\FSqpUpm.exe
  2⤵
  PID:10004
- C:\Windows\System\xbPBuwg.exe
  C:\Windows\System\xbPBuwg.exe
  2⤵
  PID:10020
- C:\Windows\System\FFUgFxl.exe
  C:\Windows\System\FFUgFxl.exe
  2⤵
  PID:10036
- C:\Windows\System\XMlcRLF.exe
  C:\Windows\System\XMlcRLF.exe
  2⤵
  PID:10052
- C:\Windows\System\GOcKnmM.exe
  C:\Windows\System\GOcKnmM.exe
  2⤵
  PID:10068
- C:\Windows\System\wdpKqCL.exe
  C:\Windows\System\wdpKqCL.exe
  2⤵
  PID:10084
- C:\Windows\System\tLLyAVr.exe
  C:\Windows\System\tLLyAVr.exe
  2⤵
  PID:10100
- C:\Windows\System\LpeFNty.exe
  C:\Windows\System\LpeFNty.exe
  2⤵
  PID:10116
- C:\Windows\System\GXobqRr.exe
  C:\Windows\System\GXobqRr.exe
  2⤵
  PID:10132
- C:\Windows\System\XZYQegu.exe
  C:\Windows\System\XZYQegu.exe
  2⤵
  PID:10148
- C:\Windows\System\YydcGQT.exe
  C:\Windows\System\YydcGQT.exe
  2⤵
  PID:10164
- C:\Windows\System\pwxXwAj.exe
  C:\Windows\System\pwxXwAj.exe
  2⤵
  PID:10180
- C:\Windows\System\IcOSoeI.exe
  C:\Windows\System\IcOSoeI.exe
  2⤵
  PID:10196
- C:\Windows\System\habXpWQ.exe
  C:\Windows\System\habXpWQ.exe
  2⤵
  PID:10216
- C:\Windows\System\skazBgV.exe
  C:\Windows\System\skazBgV.exe
  2⤵
  PID:6924
- C:\Windows\System\DlsNnsA.exe
  C:\Windows\System\DlsNnsA.exe
  2⤵
  PID:7712
- C:\Windows\System\OvidrHY.exe
  C:\Windows\System\OvidrHY.exe
  2⤵
  PID:9128
- C:\Windows\System\toWKnhi.exe
  C:\Windows\System\toWKnhi.exe
  2⤵
  PID:8644
- C:\Windows\System\eddmAAp.exe
  C:\Windows\System\eddmAAp.exe
  2⤵
  PID:8368
- C:\Windows\System\oWwohtZ.exe
  C:\Windows\System\oWwohtZ.exe
  2⤵
  PID:8996
- C:\Windows\System\SDaqgXM.exe
  C:\Windows\System\SDaqgXM.exe
  2⤵
  PID:9224
- C:\Windows\System\iSjGAJt.exe
  C:\Windows\System\iSjGAJt.exe
  2⤵
  PID:9268
- C:\Windows\System\oiawkSO.exe
  C:\Windows\System\oiawkSO.exe
  2⤵
  PID:9288
- C:\Windows\System\HRqYYyX.exe
  C:\Windows\System\HRqYYyX.exe
  2⤵
  PID:9348
- C:\Windows\System\TStuUOB.exe
  C:\Windows\System\TStuUOB.exe
  2⤵
  PID:9416
- C:\Windows\System\QMdjATl.exe
  C:\Windows\System\QMdjATl.exe
  2⤵
  PID:9364
- C:\Windows\System\nFXpswx.exe
  C:\Windows\System\nFXpswx.exe
  2⤵
  PID:9460
- C:\Windows\System\DPkBqMu.exe
  C:\Windows\System\DPkBqMu.exe
  2⤵
  PID:9300
- C:\Windows\System\yhsCxwC.exe
  C:\Windows\System\yhsCxwC.exe
  2⤵
  PID:9400
- C:\Windows\System\kaDFwlF.exe
  C:\Windows\System\kaDFwlF.exe
  2⤵
  PID:9640
- C:\Windows\System\CbCNssZ.exe
  C:\Windows\System\CbCNssZ.exe
  2⤵
  PID:9820
- C:\Windows\System\upeSipE.exe
  C:\Windows\System\upeSipE.exe
  2⤵
  PID:9884
- C:\Windows\System\VcFDyBD.exe
  C:\Windows\System\VcFDyBD.exe
  2⤵
  PID:9948
- C:\Windows\System\KHaDHiD.exe
  C:\Windows\System\KHaDHiD.exe
  2⤵
  PID:9840
- C:\Windows\System\QdhYAnZ.exe
  C:\Windows\System\QdhYAnZ.exe
  2⤵
  PID:9744
- C:\Windows\System\HGwpchO.exe
  C:\Windows\System\HGwpchO.exe
  2⤵
  PID:9932
- C:\Windows\System\RmJfycM.exe
  C:\Windows\System\RmJfycM.exe
  2⤵
  PID:10012
- C:\Windows\System\vocCxRa.exe
  C:\Windows\System\vocCxRa.exe
  2⤵
  PID:10076
- C:\Windows\System\pecNbYG.exe
  C:\Windows\System\pecNbYG.exe
  2⤵
  PID:10112
- C:\Windows\System\iLJMvtr.exe
  C:\Windows\System\iLJMvtr.exe
  2⤵
  PID:9968
- C:\Windows\System\bCcaPTA.exe
  C:\Windows\System\bCcaPTA.exe
  2⤵
  PID:10028
- C:\Windows\System\hrQbQCK.exe
  C:\Windows\System\hrQbQCK.exe
  2⤵
  PID:10092
- C:\Windows\System\xbsGNyA.exe
  C:\Windows\System\xbsGNyA.exe
  2⤵
  PID:10124
- C:\Windows\System\wpAwKAO.exe
  C:\Windows\System\wpAwKAO.exe
  2⤵
  PID:10192
- C:\Windows\System\ZWiSptQ.exe
  C:\Windows\System\ZWiSptQ.exe
  2⤵
  PID:10228
- C:\Windows\System\tKXpHXA.exe
  C:\Windows\System\tKXpHXA.exe
  2⤵
  PID:8292
- C:\Windows\System\mazwqBq.exe
  C:\Windows\System\mazwqBq.exe
  2⤵
  PID:8708
- C:\Windows\System\ZmYLNzm.exe
  C:\Windows\System\ZmYLNzm.exe
  2⤵
  PID:8316
- C:\Windows\System\ZIKKoWQ.exe
  C:\Windows\System\ZIKKoWQ.exe
  2⤵
  PID:9380
- C:\Windows\System\JhMaTHp.exe
  C:\Windows\System\JhMaTHp.exe
  2⤵
  PID:9440
- C:\Windows\System\GzYggJp.exe
  C:\Windows\System\GzYggJp.exe
  2⤵
  PID:9296
- C:\Windows\System\SVaiCKf.exe
  C:\Windows\System\SVaiCKf.exe
  2⤵
  PID:9520
- C:\Windows\System\fxQbReI.exe
  C:\Windows\System\fxQbReI.exe
  2⤵
  PID:9584
- C:\Windows\System\pGAyXcc.exe
  C:\Windows\System\pGAyXcc.exe
  2⤵
  PID:9592
- C:\Windows\System\NrkeQhf.exe
  C:\Windows\System\NrkeQhf.exe
  2⤵
  PID:9724
- C:\Windows\System\QEsvABV.exe
  C:\Windows\System\QEsvABV.exe
  2⤵
  PID:9572
- C:\Windows\System\eOlyLVE.exe
  C:\Windows\System\eOlyLVE.exe
  2⤵
  PID:9772
- C:\Windows\System\PUKVcDp.exe
  C:\Windows\System\PUKVcDp.exe
  2⤵
  PID:9712
- C:\Windows\System\zCOSypE.exe
  C:\Windows\System\zCOSypE.exe
  2⤵
  PID:10048
- C:\Windows\System\XlYgNEU.exe
  C:\Windows\System\XlYgNEU.exe
  2⤵
  PID:10064
- C:\Windows\System\LsPFyQQ.exe
  C:\Windows\System\LsPFyQQ.exe
  2⤵
  PID:10156
- C:\Windows\System\FvpCIyZ.exe
  C:\Windows\System\FvpCIyZ.exe
  2⤵
  PID:9788
- C:\Windows\System\ONJnSHR.exe
  C:\Windows\System\ONJnSHR.exe
  2⤵
  PID:9916
- C:\Windows\System\hNavuvb.exe
  C:\Windows\System\hNavuvb.exe
  2⤵
  PID:9980
- C:\Windows\System\uIUuJqI.exe
  C:\Windows\System\uIUuJqI.exe
  2⤵
  PID:10000
- C:\Windows\System\fkiEgnu.exe
  C:\Windows\System\fkiEgnu.exe
  2⤵
  PID:9672
- C:\Windows\System\cgLZJYe.exe
  C:\Windows\System\cgLZJYe.exe
  2⤵
  PID:9900
- C:\Windows\System\QzRahbO.exe
  C:\Windows\System\QzRahbO.exe
  2⤵
  PID:9172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\FPuoFQb.exe

Filesize
2.1MB

MD5
05e260e1bb6880007de5fbb3eb27fd44

SHA1
885db4846d44d59744a827e8f891e3d226dc030f

SHA256
ee6e17b4af04b355ba04fb82da1683dc1ba9a50683448272e1bb8a773a68bde5

SHA512
f780161e0f6736d04e4dfda90b9b2f009bd78251ae289d9e278a4d89cc21530d226cc6994c93fb27b47877118b40e507cfd22dbec37eb4d516abcbb6d7936714

Download Submit
C:\Windows\system\IEtANCt.exe

Filesize
2.1MB

MD5
bae206da4992da3d3b86589c6fef3194

SHA1
a7fb6f26c91ccd4504057f683bb4ffa7c32918df

SHA256
fa0ad52c152306f9420881bae32348f5d27f2e86a1db4da128b46e26ded99c81

SHA512
c7c0eeaf5ffc676e1a7a28b021c8e3b6a2aead26d260fce1f30ed163d6bf30841813436a6258df9d69ecab152e196333bc175b8821a8d9ee95802c7e3c4ec64d

Download Submit
C:\Windows\system\IQlPUmP.exe

Filesize
2.1MB

MD5
e48517bb83618275b29fe506616d449d

SHA1
725b79e402b292dd0783876ba7b2b81cbf6639a0

SHA256
b8098bb9d660172dc1a022bf3af9ea29361daea829a659d46f64bdea5d3b05f6

SHA512
f306cff9cb1114a8f03c4663db1968781928ba670ad14c06ccca824a961d63358c089b515461982a7986d4112be897a1fc80c407a32b001d15d5e43f82b8e8b7

Download Submit
C:\Windows\system\JbhaDZJ.exe

Filesize
2.1MB

MD5
3cade7be7d296432e7905c59e6510f54

SHA1
56ab91e0e7d4afb09d8ed54fa007b426590a59c0

SHA256
b336d44effa4f1ab822749229878ec5a72c78a189a68743a2ae7130500762e19

SHA512
74b2426cb18660dadeecf45b87c94cfec7cea2135bfed395b0f423cde3b0b7d9f7d28d61bb142d6ae12abee30cbe6b67f816ce12316dec9b00b768878fb52d71

Download Submit
C:\Windows\system\JdwCLiL.exe

Filesize
2.1MB

MD5
df944bbe766008bcd8759cfe674243e6

SHA1
e9210a2fa290fa5e88d7d6deb4a0d11ab57589f5

SHA256
ba009c72b6e1333cc4f5ef53d643faf2f457eabd60f6f246516b5d73bdc1cffc

SHA512
30ff310453ac5669c80498a481ae3409c5172adf2ca8cb198181864faef679328a909aedf35838ef9ae3340ed0319b9eaa4c75f59ac945c691d9ed9274fa5c79

Download Submit
C:\Windows\system\OHzTTEx.exe

Filesize
2.1MB

MD5
f5cf946e1d99c3ff8d3953d7445553ce

SHA1
9e3130aec805b4eff24009e8b8988ae83239a6d0

SHA256
5ed38ae23432e8875f174059543e519402382aae2bf3da318d8b5b136292ecaf

SHA512
dd606b6ffb1dc4edc4221c2fedb578803ca0107a58f3935b26af18348c4888f29c660dd1ed858bb22948fd25d9c17c176ae57cb4197d0080918f9f8523e15c6f

Download Submit
C:\Windows\system\OduXMZQ.exe

Filesize
2.1MB

MD5
84a0db898d3b8b85e7d15f3acb1c372b

SHA1
5424e1e28f190784be573b0487dc110b796ac61a

SHA256
1ffc58f353211dd48d929a7f498c15702a656f492df339d44f9aa33fd73761c0

SHA512
63a3cdee3b713aa4926c2af125f9b331c7a854f1a21d2e06b2258bab20cf69b40d773a9af10ea92373486efe570bef5bb8e4b6e4b51bed5e018d7fbda73f23e0

Download Submit
C:\Windows\system\PwwqSmw.exe

Filesize
2.1MB

MD5
bf3e47370cb5d685ed87ba4962bd15dc

SHA1
d12e3e8a0e057f65829b203f153bb2a0fc8c4276

SHA256
e7980ae7a95e7662534dbff8c85aef11584784ab5d5d8616ed51c4add95398e7

SHA512
daf0bd22bae14c9df07885d939e913a97ceea164a6f73b10cf7af545bbc4d8be704c0a0c6e7697e713a50ebdccd31c08c77ec41d032b42f9408687c26ec1b942

Download Submit
C:\Windows\system\QAodFDY.exe

Filesize
2.1MB

MD5
cc5a0e8627d19f10b35aaf19a5838790

SHA1
b37b6e8a9b0d5d857160b2ead79a46dfa8e657ea

SHA256
320839ff1a057d985d464cf674e1d10cfeefc8befa0b4924c63adc68baade15d

SHA512
94d92d673b34e0c5bc05fc1a99fda4996b664b031d55d177f6900a6c17a64e9b188fb1f3c92a3ce1a2a156d0f3fff20ae016103655cb3aab98b981bbdd089d52

Download Submit
C:\Windows\system\SUgvdOa.exe

Filesize
2.1MB

MD5
772cd165c2b3b1b2dcf79228c669da9f

SHA1
f637c275a45e00da3741b8219f150f124c4fd3d7

SHA256
4af40c09b58334c8633f4415b81311e2cd2020a2ce0eb79f6a9e79cf6059e0c2

SHA512
24c2ee8d2e77e1de0095b091565684b4ddbe928029398315b01404a6bdf1b691d4c0a5c376321f871c649d2a53ac5430acaaf05d09ffb4e11b46780296247ed8

Download Submit
C:\Windows\system\VqdzyBf.exe

Filesize
2.1MB

MD5
cc226cc43e0be4369271c01599114dc9

SHA1
a23521c6bc0618eae9b7d9904e1f761052147b4a

SHA256
dcfb2a1ea276ac60ec527e05af1e9bb2ed28490c6c150a797d4bf12968ee92d2

SHA512
cbacacfbc583e0ecdc4d344d7b5bf438f5accb69708fcb213b49f65459c1dce50ddd2630a4bd1216b2c7bd46ada8f9ba03df41b1d0126559a87a6691287f597e

Download Submit
C:\Windows\system\bXpIHPV.exe

Filesize
2.1MB

MD5
575adde6babde991a00ca37292462b3b

SHA1
1bce46917243e67992441e9fd67a572e4999e648

SHA256
feba47b33e7f1d97429882d022cebeb8962774fb672ca4bc30052e7c4daa42a4

SHA512
74fb98bf2353142667009ed216049b0a95ccc1c64b2312a9fe53c2c0eea665703d0863d1df19c159e07fb334e1f4779432c0f9591001f11fce93465282ee90dc

Download Submit
C:\Windows\system\cNeboWe.exe

Filesize
2.1MB

MD5
c059f2b09beb8c85c9fb0552f50e60c6

SHA1
501d4c0fa0ce7fc37dc2f21629c5efce0a5e2121

SHA256
40ea1360f87b010d4f485afe2df1ff28e4c48f04f38dd4814181bc51d7a5a7b0

SHA512
47e9cd093bf227edbe27c5c97e019424b099127f79c89c98b3255f7ef4c8c9ca3fa631cab12dc88466444cfcafd4dfbeceb9f12330bd8a4b7d4c06b43a1c7fd2

Download Submit
C:\Windows\system\eBLKqOe.exe

Filesize
2.1MB

MD5
477c308506955fb6e16cc74ffd405c33

SHA1
c19a3f7633fd81d78b08ea93f9a2f4bf45b77baa

SHA256
7fc4f69e074be51a780da595b30a51d47f94f24ad58f008ae6c5a9eaa26b3d9e

SHA512
5aed237ca9d3bb04da19dbb4845652d6be6db965cfd9d0d9c31e2a25ce19b14d6cb9d3ab96be87f198525cdb58352fb29bb05ccd139340874a6934be70b9303c

Download Submit
C:\Windows\system\iDFrqAb.exe

Filesize
2.1MB

MD5
a5ec202b834ad9ea01168d51b26bc1af

SHA1
9125073a2741c2ceef9d4b6bb086aad50c8b8e8d

SHA256
3d599075b11fdee0be4183b58ea7fcdc56151bdc5ccd62024741ab6174c223c7

SHA512
6d31c486b93877b732695a9690b1fe8be368c668ac55fb2248241ebcf113f7bf6e23060211a1ea4ccabe6ffef76f440d148487f39f867228e02af3ba4ade12ae

Download Submit
C:\Windows\system\iMIVfCF.exe

Filesize
2.1MB

MD5
f97ecb2d2f0e0fc0adbc938ae363f0f5

SHA1
b0378e201972ff2dfbf54a974f67d57c866c92fe

SHA256
6f704d50758d8efa8e8fd71c8d52e46d30c553992b186e911db5677f8767b071

SHA512
139ef214c0e5e00235b57856e9e3353195415d394ee3506eb870b64cd204cb741b238a6e8109538aeaca345b4e502ee955bb645d77176361c11c81d25c6cc403

Download Submit
C:\Windows\system\njHeiKc.exe

Filesize
2.1MB

MD5
31d98f08e2b5426f5aa69ea5f70379be

SHA1
bed3c05cd7c746df8338045e964c5db15e078385

SHA256
b40550a17d4b8ffe4636e7b1fc48f78b4b97938d40b68d549e1598e13b3bf153

SHA512
60604501cfed8bd5b8404295394925d863cbb807f535dfdda3222c7dbed51510b8d575e3ee7ccfe4217f71d4121f6983fef8f2e4c56de5443165025c64664e56

Download Submit
C:\Windows\system\nwrILOi.exe

Filesize
2.1MB

MD5
c7099b71a65d0239ee4b703920b42a59

SHA1
53bde6eac4b172e6efc20e19e5024a9b894a9c21

SHA256
fa486fb3fd37fd41db49d4ead8f90e98f6ee823d73254a6a4f40921f00965013

SHA512
32d5bd888fe025ee6609388f836848e992ec32d057e4c9c87bed8a0f592852d836eabf10c5a024a0809e9490f9e59ca2a1f521e91541436e6056c30267e3b550

Download Submit
C:\Windows\system\pZekcGZ.exe

Filesize
2.1MB

MD5
cb525f393328880c0288cb06dfab2978

SHA1
1a6e70aa6b0286f4e5c269ba80b825ab1b595920

SHA256
ba3c1560dd2ce2ff4b916b9ab3be9e1b6e261fdf56d4f0b72dd98c711d8141e1

SHA512
18ae31e2b4eab81c1d06920bb5cbdccbd216e5d4ac338c32744fed8c9c5eb6a86d0156859a2b71ea09b85ae42c23178eda60ea18fc9acd3083667875b104b923

Download Submit
C:\Windows\system\tDTrEeK.exe

Filesize
2.1MB

MD5
755fea95e7c92972998e90e01942f5be

SHA1
832ca04b1e6870a6a864bac4f8f180121e037f90

SHA256
a7cc52b841f8a41b83978dcf3c52206b07781c61c77ccb8276b84343d8c6ad02

SHA512
cd4c5a79fa7fb2b3ab0d42a88d9444d1e63fcdc6ba1398e9f44ddf97fe90bba7305a5d1ba47576f233b33fddab1d07b17a1b73faccb326e49aedb7c25804c1c7

Download Submit
C:\Windows\system\vBdDOhR.exe

Filesize
2.1MB

MD5
cc80ee646784bd775a922a9e64834f15

SHA1
8d678cc263c5fe49138681aaa43155641c655d7c

SHA256
0694edb6ef85b733800f1149f38f08ee4ed887e1ad0bb89db301c197a3902420

SHA512
9d4de9b253c5384f2ea65b792d6be229c4b3df4af4700dc03342a13fe623a915e2af732a6558ad7131dd28258ae757a478d6ea561cf6dbb3cc0d89cd1cf4a28a

Download Submit
C:\Windows\system\wljUvvT.exe

Filesize
2.1MB

MD5
a85f54ce44bc7f64538f0e020df95b45

SHA1
46f0303abce5a8373faa5cbdd8d8d36206e64830

SHA256
96587b0f3b3fced882bd0409a8baf70bae24ebf7208fa8b5fa10b7d02da1f889

SHA512
c8b812a0087bc30a443b7bae5ac566c5a6e0f7bc2ffa4fadfa8d2ff5dbabc2a9b94ec0f8cc7f15b9ca05cfe841b3fc89fc39354d8109db2ec44b9ab45de01633

Download Submit
C:\Windows\system\wyDOyRC.exe

Filesize
2.1MB

MD5
fe0d8cb52fb43aede0c25c167ee2973d

SHA1
2385dd4d7897ea5f47c1f97e92dd7f1b96b2d4a8

SHA256
adadf042beff567778c4fc6cae9fb1dba6fbac4e2e8866b682e77ccdad5f2ef1

SHA512
d675a3c49af7f5d8a16cea690673d661e1f7f6814bad780b8a1ce1565c7215968d4981fcd2e0856509f926083c27921470b7b1236421d7458f8d0979b1a640e7

Download Submit
\Windows\system\GMVLyOl.exe

Filesize
2.1MB

MD5
02a697e89edfe6589b545502ef940f07

SHA1
50e95753eb271e056d5023b65c51da2a4918dc7d

SHA256
b6fdf0d56f0af119fd4d6693f1e544314bce98666b7811e2d656578b78c90f4e

SHA512
d81007a11e172c66ae28de3ebb33d070679d1c2b09e70affe1d9b1d203cfdb38aa6742246c7a88b7b7de1d025dd83c5badc191a38d2abce792779e5451686f32

Download Submit
\Windows\system\OFCvRhF.exe

Filesize
2.1MB

MD5
d6a91cefe3f56c929813e2056330d97a

SHA1
618738d6967d269b0b5881b8d1057357e4abf74b

SHA256
92ebe3c80cecad6c83792dceb5efea9e7313ea897408d3163f797fa43e677863

SHA512
bf28618285ff8908299fb5e2ebd26519b24beca331452bd4d694d04924e2054ad1fcc7b6f0568d119416a4b60c8d9c8220970a0b7ac627d0414213ab8551d6bf

Download Submit
\Windows\system\WQXAnYD.exe

Filesize
2.1MB

MD5
f2ae3dd6d87792231a48c905dcfbfdac

SHA1
1068bb0b3fe1a52ee6190c3c5ea410b523675b54

SHA256
976e2ac571588752951681abf2c6cec23b959a436043efb38ffebba46a6170a9

SHA512
3e3d398106ce98f25e1d0b62879166be8a1b1bc2a0cb7f12eb736242871f4eec4fd54350dde0a0a91848d422a26c2cc5ee243e521227ab8b74a3ca94d356f09a

Download Submit
\Windows\system\gxnFxIi.exe

Filesize
2.1MB

MD5
98debd72062d48ea291a7a061e7f26d8

SHA1
8c9948ef372fc00794bedbad9e01114e0309d507

SHA256
589be37ef2ff57c31062b1dc3b44fd736cd5294cd95791d71b34b433fae8384b

SHA512
335ea777c2eb679907bf29a7a5bf888543f098d95bb04f90476f51d516a71b0167f01e18bd30cea27e408f7590f1de61381482e777c27dea48a5ebf3065bad30

Download Submit
\Windows\system\hVjyfyh.exe

Filesize
2.1MB

MD5
97348937f0abf16ef8d7627dd015d8c9

SHA1
33e68af6618edac1165ee408570294036ae741ea

SHA256
cc3de664a8dbad230537db0bc7a3acc5df04e765809c7422d0fb2b1933760862

SHA512
3cb2e50343e9dd2260472d5bcb01961aef3026ca8e8156f6878c0ade4cf0d32eb178428dedaf990cd8aa7aa7c5b75994885e7c73a1a7331cff192da29c516aae

Download Submit
\Windows\system\kokyIYl.exe

Filesize
2.1MB

MD5
324ddc5c295165e349d46a0502c26e03

SHA1
cd7ae7a1525304c88bd8404faa6f87120fcb07c1

SHA256
3e6d3e9ab22c36a14e0b3c669e55dc8fe20512b4285defc5cf4a2e924028a647

SHA512
ea5a2261ba30024caa159eef19b1f2f68f44b959ceb690d139e256e5cedad221650c8df22c26715131cf80d2c1676e02b54c5a0121ca65afe17a909794eefd86

Download Submit
\Windows\system\mjohiYp.exe

Filesize
2.1MB

MD5
ba00ed62b99988604920642c4c9b6b9b

SHA1
322d149f13896b50c5430e2c7cfef2610ead247e

SHA256
40daf6d96a991cec777a6ef1f3188c2da861aa49bceda45e8ff73d0351f1cfe4

SHA512
86bedfcee1537506be7c26d35890a19c046821e6632382e2fd95785d0652a78fabc82dba417fc7f720f6964f48739bea7a08892956182aa2db850cdf48fec7a8

Download Submit
\Windows\system\sBJhVfE.exe

Filesize
2.1MB

MD5
b76ab318d558de53c009678fcdb03b07

SHA1
a98d17f4c080887f2a5ec1b3a85372bcf9eec41c

SHA256
343da11823c9a7c387ba5733beb21cb0465e91bd61d88515feff34c0326d725b

SHA512
6d0db9e5d12042e627886cb47fae133711d6269743e0c82c076b000bb202781240833911a7517133695b672c8a31965603738c7fbef949bfb4a2cc21d403d3a7

Download Submit
\Windows\system\wcjCtfp.exe

Filesize
2.1MB

MD5
5effde4e7ae7d96e0aa42dea071ea56a

SHA1
da87a71970ea3bf3c0498c585a84ea35a1f31497

SHA256
c40419390f8263b14f628580fcab828b06d6258265e82ff4ca1a6f08d86cb101

SHA512
a1f5ed4e1546d50d1b40c278dd197ea4d08caacdbd9f3eac49e1227b4038b1b2787c0e7182da5e78d567a6bc2003ef2ace65e399b1fe57c4e5a1fdba34f7e253

Download Submit
\Windows\system\zhfCWpP.exe

Filesize
2.1MB

MD5
c993bf0a2b49d33218363db870f69d36

SHA1
e8aeaa4c54de42b148e98cf2015c15e70354e73f

SHA256
d76a3f31be34328bdb02d8c8760636e1cf7113db5ebb9a2d4103f8a744508486

SHA512
a0c510d2d76b52bb08640ba28aee52fd40b31c532ad9a6d61183274590b33978c2b9e19b7216394b1b5d1ba7adb6d30b538334d8a53a17a8f5cf25136cb4ac04

Download Submit
memory/1496-84-0x000000013F240000-0x000000013F632000-memory.dmp

Filesize
3.9MB

Download
memory/1496-1-0x00000000003F0000-0x0000000000400000-memory.dmp

Filesize
64KB

Download
memory/1496-93-0x000000013FC90000-0x0000000140082000-memory.dmp

Filesize
3.9MB

Download
memory/1496-95-0x00000000033F0000-0x00000000037E2000-memory.dmp

Filesize
3.9MB

Download
memory/1496-24-0x000000013FFC0000-0x00000001403B2000-memory.dmp

Filesize
3.9MB

Download
memory/1496-0-0x000000013F6E0000-0x000000013FAD2000-memory.dmp

Filesize
3.9MB

Download
memory/1496-22-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/1496-103-0x00000000033F0000-0x00000000037E2000-memory.dmp

Filesize
3.9MB

Download
memory/1496-110-0x000000013F060000-0x000000013F452000-memory.dmp

Filesize
3.9MB

Download
memory/1496-97-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/1496-99-0x000000013FCF0000-0x00000001400E2000-memory.dmp

Filesize
3.9MB

Download
memory/1496-107-0x00000000033F0000-0x00000000037E2000-memory.dmp

Filesize
3.9MB

Download
memory/1496-101-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/1496-105-0x000000013F150000-0x000000013F542000-memory.dmp

Filesize
3.9MB

Download
memory/1872-92-0x000000013F060000-0x000000013F452000-memory.dmp

Filesize
3.9MB

Download
memory/1872-4016-0x000000013F060000-0x000000013F452000-memory.dmp

Filesize
3.9MB

Download
memory/2160-4013-0x000000013F4E0000-0x000000013F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/2160-108-0x000000013F4E0000-0x000000013F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/2172-4004-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2172-23-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2252-102-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/2252-4002-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/2408-1092-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmp

Filesize
9.6MB

Download
memory/2408-25-0x000007FEF5EAE000-0x000007FEF5EAF000-memory.dmp

Filesize
4KB

Download
memory/2408-27-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

Filesize
2.9MB

Download
memory/2408-28-0x0000000001FE0000-0x0000000001FE8000-memory.dmp

Filesize
32KB

Download
memory/2408-91-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmp

Filesize
9.6MB

Download
memory/2408-77-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmp

Filesize
9.6MB

Download
memory/2524-104-0x000000013FAA0000-0x000000013FE92000-memory.dmp

Filesize
3.9MB

Download
memory/2524-4017-0x000000013FAA0000-0x000000013FE92000-memory.dmp

Filesize
3.9MB

Download
memory/2668-98-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/2668-4006-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/2724-100-0x000000013FCF0000-0x00000001400E2000-memory.dmp

Filesize
3.9MB

Download
memory/2724-4011-0x000000013FCF0000-0x00000001400E2000-memory.dmp

Filesize
3.9MB

Download
memory/2728-96-0x000000013F3F0000-0x000000013F7E2000-memory.dmp

Filesize
3.9MB

Download
memory/2728-4007-0x000000013F3F0000-0x000000013F7E2000-memory.dmp

Filesize
3.9MB

Download
memory/2820-109-0x000000013FFC0000-0x00000001403B2000-memory.dmp

Filesize
3.9MB

Download
memory/2820-4014-0x000000013FFC0000-0x00000001403B2000-memory.dmp

Filesize
3.9MB

Download
memory/2824-4001-0x000000013F240000-0x000000013F632000-memory.dmp

Filesize
3.9MB

Download
memory/2824-90-0x000000013F240000-0x000000013F632000-memory.dmp

Filesize
3.9MB

Download
memory/2884-4003-0x000000013F150000-0x000000013F542000-memory.dmp

Filesize
3.9MB

Download
memory/2884-106-0x000000013F150000-0x000000013F542000-memory.dmp

Filesize
3.9MB

Download
memory/2888-4005-0x000000013FC90000-0x0000000140082000-memory.dmp

Filesize
3.9MB

Download
memory/2888-94-0x000000013FC90000-0x0000000140082000-memory.dmp

Filesize
3.9MB

Download