strela | 3e825483c73471f4c51e85c5e69cf018281d10fdee275637116d20f50a03abbc

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
23-08-2024 23:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
Size

1.9MB
MD5

f6a2f8ca9a76933e54bc45598ea3e4c0
SHA1

6daf24adedb0a014403a3854dc29e78b361ca61d
SHA256

3e825483c73471f4c51e85c5e69cf018281d10fdee275637116d20f50a03abbc
SHA512

1b67a4414844ae2989bdef9857894be0dbed7ea0ccc21e944ccce666fa4150bc99e29485e5b5a58e1f2895d42ed0b5c4c577d5d20baceae954a10315c0cb73fb
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7fI+7RrTFl6hvVju:Lz071uv4BPMkyW10/w16BvZX71Fq8+A

Score

10^/10

strela xmrig execution miner stealer upx

Malware Config

Signatures

Detects Strela Stealer payload 1 IoCs

resource	yara_rule
behavioral1/memory/2852-5768-0x0000000002FE0000-0x00000000033D2000-memory.dmp	family_strela

Strela stealer
An info stealer targeting mail credentials first seen in late 2022.
stealer strela
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 21 IoCs

miner

resource	yara_rule
behavioral1/memory/2820-9-0x000000013FA80000-0x000000013FE72000-memory.dmp	xmrig
behavioral1/memory/2628-365-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	xmrig
behavioral1/memory/2508-468-0x000000013F3A0000-0x000000013F792000-memory.dmp	xmrig
behavioral1/memory/1440-548-0x000000013F280000-0x000000013F672000-memory.dmp	xmrig
behavioral1/memory/2292-546-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	xmrig
behavioral1/memory/2716-530-0x000000013FCB0000-0x00000001400A2000-memory.dmp	xmrig
behavioral1/memory/1856-526-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	xmrig
behavioral1/memory/1272-522-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	xmrig
behavioral1/memory/2568-519-0x000000013FF80000-0x0000000140372000-memory.dmp	xmrig
behavioral1/memory/2532-404-0x000000013FA00000-0x000000013FDF2000-memory.dmp	xmrig
behavioral1/memory/2756-383-0x000000013FFB0000-0x00000001403A2000-memory.dmp	xmrig
behavioral1/memory/2556-425-0x000000013F090000-0x000000013F482000-memory.dmp	xmrig
behavioral1/memory/2532-4591-0x000000013FA00000-0x000000013FDF2000-memory.dmp	xmrig
behavioral1/memory/2508-4594-0x000000013F3A0000-0x000000013F792000-memory.dmp	xmrig
behavioral1/memory/1856-4600-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	xmrig
behavioral1/memory/2568-4597-0x000000013FF80000-0x0000000140372000-memory.dmp	xmrig
behavioral1/memory/2292-4607-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	xmrig
behavioral1/memory/1272-4616-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	xmrig
behavioral1/memory/2716-4618-0x000000013FCB0000-0x00000001400A2000-memory.dmp	xmrig
behavioral1/memory/1440-4632-0x000000013F280000-0x000000013F672000-memory.dmp	xmrig
behavioral1/memory/2628-4663-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2656	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2820	CSdsMuT.exe
2628	nXiXGoc.exe
2756	xUeKeTT.exe
2532	LDjGwGe.exe
2556	UsDpEXL.exe
2508	wuJcRpj.exe
2568	kCpGWSa.exe
1272	JirRrwy.exe
1856	eClnhJn.exe
2716	JfqPGaq.exe
2292	VFkJwBc.exe
1440	KJTseMe.exe
1956	OSmBEqh.exe
2492	kQGIVbF.exe
2772	hLKHEIJ.exe
2936	aruZVXy.exe
1220	aeOxqzf.exe
1480	pNwpcet.exe
2732	XhjHxvX.exe
484	cfROCqn.exe
2340	VCBPeSe.exe
1976	maUsQVj.exe
1104	UxPJLws.exe
1724	LVVOFYh.exe
992	azfzorK.exe
2412	lutkDtB.exe
2952	XlpuOPU.exe
1568	TkPerXH.exe
1556	YhQjDmf.exe
1904	qAHtlZm.exe
2928	SgDJiEJ.exe
536	pSNlLlh.exe
1936	yODeLYk.exe
1336	vojklcr.exe
2184	IsJeuOR.exe
968	UMZZFeL.exe
1340	kHkyetZ.exe
868	JZLcMtA.exe
3068	pLPYFuz.exe
2132	FUfoSIL.exe
3032	pwFJOSQ.exe
1660	EGQWGqB.exe
1868	XQyFKtS.exe
3040	AjBGYut.exe
1096	CaZNCrH.exe
2108	AaUZQac.exe
2068	YasPbWq.exe
560	ogsqcGH.exe
2388	jGoOhob.exe
2596	nmqzRtT.exe
2152	xFQRBSQ.exe
1320	wsmQzHf.exe
1508	oBoIKzk.exe
864	pHVKjyr.exe
2392	ywWcYEf.exe
1072	qPCYKEl.exe
2196	tVqJrZw.exe
1612	WkSKJMi.exe
2616	DlqxNgW.exe
2784	OQuqAAC.exe
1376	mDlvPfu.exe
2564	xqMmqFi.exe
1716	bRHrXMo.exe
2552	TukwqRX.exe

Loads dropped DLL 64 IoCs

pid	Process
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe

UPX packed file 59 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2852-0-0x000000013F6A0000-0x000000013FA92000-memory.dmp	upx
behavioral1/files/0x0005000000010300-5.dat	upx
behavioral1/memory/2820-9-0x000000013FA80000-0x000000013FE72000-memory.dmp	upx
behavioral1/files/0x0017000000018649-18.dat	upx
behavioral1/files/0x000f00000000549c-22.dat	upx
behavioral1/files/0x00070000000186ed-27.dat	upx
behavioral1/files/0x00060000000186ff-36.dat	upx
behavioral1/files/0x0008000000018764-42.dat	upx
behavioral1/files/0x00060000000196e4-50.dat	upx
behavioral1/files/0x0007000000019409-47.dat	upx
behavioral1/files/0x00050000000196e9-56.dat	upx
behavioral1/files/0x0005000000019700-61.dat	upx
behavioral1/files/0x00050000000198f1-76.dat	upx
behavioral1/files/0x000500000001a461-170.dat	upx
behavioral1/files/0x000500000001a459-162.dat	upx
behavioral1/memory/2628-365-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	upx
behavioral1/files/0x000500000001a3fd-155.dat	upx
behavioral1/files/0x000500000001a0da-147.dat	upx
behavioral1/files/0x000500000001a09b-138.dat	upx
behavioral1/files/0x000500000001a033-131.dat	upx
behavioral1/files/0x0005000000019eb7-122.dat	upx
behavioral1/files/0x0005000000019c4d-106.dat	upx
behavioral1/files/0x0005000000019db2-115.dat	upx
behavioral1/files/0x000500000001a463-173.dat	upx
behavioral1/files/0x000500000001a45b-168.dat	upx
behavioral1/files/0x000500000001a453-159.dat	upx
behavioral1/memory/2508-468-0x000000013F3A0000-0x000000013F792000-memory.dmp	upx
behavioral1/memory/1440-548-0x000000013F280000-0x000000013F672000-memory.dmp	upx
behavioral1/memory/2292-546-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	upx
behavioral1/memory/2716-530-0x000000013FCB0000-0x00000001400A2000-memory.dmp	upx
behavioral1/memory/1856-526-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/memory/1272-522-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/memory/2568-519-0x000000013FF80000-0x0000000140372000-memory.dmp	upx
behavioral1/memory/2532-404-0x000000013FA00000-0x000000013FDF2000-memory.dmp	upx
behavioral1/memory/2756-383-0x000000013FFB0000-0x00000001403A2000-memory.dmp	upx
behavioral1/memory/2556-425-0x000000013F090000-0x000000013F482000-memory.dmp	upx
behavioral1/files/0x000500000001a3c3-152.dat	upx
behavioral1/files/0x000500000001a0a1-144.dat	upx
behavioral1/files/0x000500000001a03b-136.dat	upx
behavioral1/files/0x0005000000019f13-128.dat	upx
behavioral1/files/0x0005000000019c49-99.dat	upx
behavioral1/files/0x0005000000019db4-119.dat	upx
behavioral1/files/0x0005000000019d55-112.dat	upx
behavioral1/files/0x0005000000019c4b-102.dat	upx
behavioral1/files/0x0005000000019ade-91.dat	upx
behavioral1/files/0x000500000001997b-86.dat	upx
behavioral1/files/0x000500000001994f-81.dat	upx
behavioral1/files/0x00050000000198ed-71.dat	upx
behavioral1/files/0x000500000001971e-66.dat	upx
behavioral1/files/0x00060000000186ef-31.dat	upx
behavioral1/memory/2532-4591-0x000000013FA00000-0x000000013FDF2000-memory.dmp	upx
behavioral1/memory/2508-4594-0x000000013F3A0000-0x000000013F792000-memory.dmp	upx
behavioral1/memory/1856-4600-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/memory/2568-4597-0x000000013FF80000-0x0000000140372000-memory.dmp	upx
behavioral1/memory/2292-4607-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	upx
behavioral1/memory/1272-4616-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/memory/2716-4618-0x000000013FCB0000-0x00000001400A2000-memory.dmp	upx
behavioral1/memory/1440-4632-0x000000013F280000-0x000000013F672000-memory.dmp	upx
behavioral1/memory/2628-4663-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\HpaYUJv.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\xpuLJVz.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\JMoJbqL.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\zSlceWX.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\gsjKQwE.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\GJCMcfB.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\VFkJwBc.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\ZhaQfIZ.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\SUDpnYz.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\CLoPibI.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\fjngwxy.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\OtttdHT.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\sdTQLum.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\wOLouGO.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\kBygaAb.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\GvFLjoP.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\oXlgZNG.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\DDnkeBn.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\pcpoEEb.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\NUzpVpg.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\eqXXAJM.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\OjlSvAB.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\vMesPqp.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\EUNKXRn.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\sGgQMso.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\TjqkpRv.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\BXAZIHd.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\zkEAIYW.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\puWPCSj.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\JqgEDAD.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\QWubSJf.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\cwjJHnP.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\HrsqEJb.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\eIIbWrB.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\HPhmzgC.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\SRCdKcp.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\CDMqVCf.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\hqRwynB.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\onxlMpk.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\kqxYgKf.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\vXWrAAE.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\nCUnIDN.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\doAHDil.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\NRgwRRj.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\pIbYGRA.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\KPNmlHq.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\BwxjwJQ.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\aWPOVCJ.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\UJHNegF.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\oBoIKzk.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\HrcONUj.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\LNQykHp.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\QRQkyXT.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\meEmKFF.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\MMFHIFJ.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\AiKTBHq.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\zDYvPcB.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\cQxSmjM.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\VDxrQEV.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\bOzAUHh.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\jyzcHRY.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\ggVNXcd.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\oUYeuLW.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\nNhRLDE.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2656	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
Token: SeDebugPrivilege	2656	powershell.exe
Token: SeLockMemoryPrivilege	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 2656	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	31
PID 2852 wrote to memory of 2656	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	31
PID 2852 wrote to memory of 2656	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	31
PID 2852 wrote to memory of 2820	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	32
PID 2852 wrote to memory of 2820	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	32
PID 2852 wrote to memory of 2820	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	32
PID 2852 wrote to memory of 2628	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	33
PID 2852 wrote to memory of 2628	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	33
PID 2852 wrote to memory of 2628	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	33
PID 2852 wrote to memory of 2756	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	34
PID 2852 wrote to memory of 2756	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	34
PID 2852 wrote to memory of 2756	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	34
PID 2852 wrote to memory of 2532	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	35
PID 2852 wrote to memory of 2532	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	35
PID 2852 wrote to memory of 2532	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	35
PID 2852 wrote to memory of 2556	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	36
PID 2852 wrote to memory of 2556	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	36
PID 2852 wrote to memory of 2556	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	36
PID 2852 wrote to memory of 2508	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	37
PID 2852 wrote to memory of 2508	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	37
PID 2852 wrote to memory of 2508	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	37
PID 2852 wrote to memory of 2568	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	38
PID 2852 wrote to memory of 2568	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	38
PID 2852 wrote to memory of 2568	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	38
PID 2852 wrote to memory of 1272	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	39
PID 2852 wrote to memory of 1272	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	39
PID 2852 wrote to memory of 1272	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	39
PID 2852 wrote to memory of 1856	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	40
PID 2852 wrote to memory of 1856	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	40
PID 2852 wrote to memory of 1856	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	40
PID 2852 wrote to memory of 2716	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	41
PID 2852 wrote to memory of 2716	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	41
PID 2852 wrote to memory of 2716	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	41
PID 2852 wrote to memory of 2292	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	42
PID 2852 wrote to memory of 2292	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	42
PID 2852 wrote to memory of 2292	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	42
PID 2852 wrote to memory of 1440	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	43
PID 2852 wrote to memory of 1440	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	43
PID 2852 wrote to memory of 1440	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	43
PID 2852 wrote to memory of 1956	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	44
PID 2852 wrote to memory of 1956	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	44
PID 2852 wrote to memory of 1956	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	44
PID 2852 wrote to memory of 2492	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	45
PID 2852 wrote to memory of 2492	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	45
PID 2852 wrote to memory of 2492	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	45
PID 2852 wrote to memory of 2772	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	46
PID 2852 wrote to memory of 2772	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	46
PID 2852 wrote to memory of 2772	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	46
PID 2852 wrote to memory of 2936	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	47
PID 2852 wrote to memory of 2936	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	47
PID 2852 wrote to memory of 2936	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	47
PID 2852 wrote to memory of 1220	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	48
PID 2852 wrote to memory of 1220	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	48
PID 2852 wrote to memory of 1220	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	48
PID 2852 wrote to memory of 1480	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	49
PID 2852 wrote to memory of 1480	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	49
PID 2852 wrote to memory of 1480	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	49
PID 2852 wrote to memory of 2732	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	50
PID 2852 wrote to memory of 2732	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	50
PID 2852 wrote to memory of 2732	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	50
PID 2852 wrote to memory of 2928	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	51
PID 2852 wrote to memory of 2928	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	51
PID 2852 wrote to memory of 2928	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	51
PID 2852 wrote to memory of 484	2852	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	52

C:\Users\Admin\AppData\Local\Temp\f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
"C:\Users\Admin\AppData\Local\Temp\f6a2f8ca9a76933e54bc45598ea3e4c0N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2656
- C:\Windows\System\CSdsMuT.exe
  C:\Windows\System\CSdsMuT.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\nXiXGoc.exe
  C:\Windows\System\nXiXGoc.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\xUeKeTT.exe
  C:\Windows\System\xUeKeTT.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\LDjGwGe.exe
  C:\Windows\System\LDjGwGe.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\UsDpEXL.exe
  C:\Windows\System\UsDpEXL.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\wuJcRpj.exe
  C:\Windows\System\wuJcRpj.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\kCpGWSa.exe
  C:\Windows\System\kCpGWSa.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\JirRrwy.exe
  C:\Windows\System\JirRrwy.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\eClnhJn.exe
  C:\Windows\System\eClnhJn.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\JfqPGaq.exe
  C:\Windows\System\JfqPGaq.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\VFkJwBc.exe
  C:\Windows\System\VFkJwBc.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\KJTseMe.exe
  C:\Windows\System\KJTseMe.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\OSmBEqh.exe
  C:\Windows\System\OSmBEqh.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\kQGIVbF.exe
  C:\Windows\System\kQGIVbF.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\hLKHEIJ.exe
  C:\Windows\System\hLKHEIJ.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\aruZVXy.exe
  C:\Windows\System\aruZVXy.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\aeOxqzf.exe
  C:\Windows\System\aeOxqzf.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\pNwpcet.exe
  C:\Windows\System\pNwpcet.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\XhjHxvX.exe
  C:\Windows\System\XhjHxvX.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\SgDJiEJ.exe
  C:\Windows\System\SgDJiEJ.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\cfROCqn.exe
  C:\Windows\System\cfROCqn.exe
  2⤵
  - Executes dropped EXE
  PID:484
- C:\Windows\System\pSNlLlh.exe
  C:\Windows\System\pSNlLlh.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\VCBPeSe.exe
  C:\Windows\System\VCBPeSe.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\yODeLYk.exe
  C:\Windows\System\yODeLYk.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\maUsQVj.exe
  C:\Windows\System\maUsQVj.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\vojklcr.exe
  C:\Windows\System\vojklcr.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\UxPJLws.exe
  C:\Windows\System\UxPJLws.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\IsJeuOR.exe
  C:\Windows\System\IsJeuOR.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\LVVOFYh.exe
  C:\Windows\System\LVVOFYh.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\UMZZFeL.exe
  C:\Windows\System\UMZZFeL.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\azfzorK.exe
  C:\Windows\System\azfzorK.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\kHkyetZ.exe
  C:\Windows\System\kHkyetZ.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\lutkDtB.exe
  C:\Windows\System\lutkDtB.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\JZLcMtA.exe
  C:\Windows\System\JZLcMtA.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\XlpuOPU.exe
  C:\Windows\System\XlpuOPU.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\pLPYFuz.exe
  C:\Windows\System\pLPYFuz.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\TkPerXH.exe
  C:\Windows\System\TkPerXH.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\FUfoSIL.exe
  C:\Windows\System\FUfoSIL.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\YhQjDmf.exe
  C:\Windows\System\YhQjDmf.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\pwFJOSQ.exe
  C:\Windows\System\pwFJOSQ.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\qAHtlZm.exe
  C:\Windows\System\qAHtlZm.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\EGQWGqB.exe
  C:\Windows\System\EGQWGqB.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\XQyFKtS.exe
  C:\Windows\System\XQyFKtS.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\AjBGYut.exe
  C:\Windows\System\AjBGYut.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\CaZNCrH.exe
  C:\Windows\System\CaZNCrH.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\AaUZQac.exe
  C:\Windows\System\AaUZQac.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\YasPbWq.exe
  C:\Windows\System\YasPbWq.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\ogsqcGH.exe
  C:\Windows\System\ogsqcGH.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\jGoOhob.exe
  C:\Windows\System\jGoOhob.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\nmqzRtT.exe
  C:\Windows\System\nmqzRtT.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\xFQRBSQ.exe
  C:\Windows\System\xFQRBSQ.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\wsmQzHf.exe
  C:\Windows\System\wsmQzHf.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\oBoIKzk.exe
  C:\Windows\System\oBoIKzk.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\pHVKjyr.exe
  C:\Windows\System\pHVKjyr.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\ywWcYEf.exe
  C:\Windows\System\ywWcYEf.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\qPCYKEl.exe
  C:\Windows\System\qPCYKEl.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\tVqJrZw.exe
  C:\Windows\System\tVqJrZw.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\WkSKJMi.exe
  C:\Windows\System\WkSKJMi.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\DlqxNgW.exe
  C:\Windows\System\DlqxNgW.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\OQuqAAC.exe
  C:\Windows\System\OQuqAAC.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\mDlvPfu.exe
  C:\Windows\System\mDlvPfu.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\xqMmqFi.exe
  C:\Windows\System\xqMmqFi.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\bRHrXMo.exe
  C:\Windows\System\bRHrXMo.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\TukwqRX.exe
  C:\Windows\System\TukwqRX.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\jNCjqJP.exe
  C:\Windows\System\jNCjqJP.exe
  2⤵
  PID:2632
- C:\Windows\System\DAyNtzu.exe
  C:\Windows\System\DAyNtzu.exe
  2⤵
  PID:2168
- C:\Windows\System\wkeCNsM.exe
  C:\Windows\System\wkeCNsM.exe
  2⤵
  PID:744
- C:\Windows\System\pHZoGQz.exe
  C:\Windows\System\pHZoGQz.exe
  2⤵
  PID:2400
- C:\Windows\System\UUFuxmR.exe
  C:\Windows\System\UUFuxmR.exe
  2⤵
  PID:1692
- C:\Windows\System\SVqJipv.exe
  C:\Windows\System\SVqJipv.exe
  2⤵
  PID:2840
- C:\Windows\System\hqBIKWf.exe
  C:\Windows\System\hqBIKWf.exe
  2⤵
  PID:2224
- C:\Windows\System\vCrXjiD.exe
  C:\Windows\System\vCrXjiD.exe
  2⤵
  PID:2580
- C:\Windows\System\BGNFdby.exe
  C:\Windows\System\BGNFdby.exe
  2⤵
  PID:2792
- C:\Windows\System\MnBJsvI.exe
  C:\Windows\System\MnBJsvI.exe
  2⤵
  PID:2884
- C:\Windows\System\sMctrwH.exe
  C:\Windows\System\sMctrwH.exe
  2⤵
  PID:2584
- C:\Windows\System\QAjkZEy.exe
  C:\Windows\System\QAjkZEy.exe
  2⤵
  PID:1524
- C:\Windows\System\mQkRgVZ.exe
  C:\Windows\System\mQkRgVZ.exe
  2⤵
  PID:2692
- C:\Windows\System\sdOgENz.exe
  C:\Windows\System\sdOgENz.exe
  2⤵
  PID:2664
- C:\Windows\System\PeJmdpr.exe
  C:\Windows\System\PeJmdpr.exe
  2⤵
  PID:2908
- C:\Windows\System\yoFQEas.exe
  C:\Windows\System\yoFQEas.exe
  2⤵
  PID:1908
- C:\Windows\System\yOObdVP.exe
  C:\Windows\System\yOObdVP.exe
  2⤵
  PID:1812
- C:\Windows\System\mKgIUOT.exe
  C:\Windows\System\mKgIUOT.exe
  2⤵
  PID:2060
- C:\Windows\System\ZhZmvrO.exe
  C:\Windows\System\ZhZmvrO.exe
  2⤵
  PID:668
- C:\Windows\System\eqmTGvT.exe
  C:\Windows\System\eqmTGvT.exe
  2⤵
  PID:2128
- C:\Windows\System\UBbDTVE.exe
  C:\Windows\System\UBbDTVE.exe
  2⤵
  PID:2220
- C:\Windows\System\nVtFMYZ.exe
  C:\Windows\System\nVtFMYZ.exe
  2⤵
  PID:1176
- C:\Windows\System\jTWYPuc.exe
  C:\Windows\System\jTWYPuc.exe
  2⤵
  PID:1884
- C:\Windows\System\ZZEZwoC.exe
  C:\Windows\System\ZZEZwoC.exe
  2⤵
  PID:1984
- C:\Windows\System\iipOmny.exe
  C:\Windows\System\iipOmny.exe
  2⤵
  PID:772
- C:\Windows\System\kxrMpLb.exe
  C:\Windows\System\kxrMpLb.exe
  2⤵
  PID:2280
- C:\Windows\System\hngrsRU.exe
  C:\Windows\System\hngrsRU.exe
  2⤵
  PID:2264
- C:\Windows\System\bEqRySr.exe
  C:\Windows\System\bEqRySr.exe
  2⤵
  PID:1168
- C:\Windows\System\LRuLWpQ.exe
  C:\Windows\System\LRuLWpQ.exe
  2⤵
  PID:2028
- C:\Windows\System\oXlgZNG.exe
  C:\Windows\System\oXlgZNG.exe
  2⤵
  PID:2372
- C:\Windows\System\oCBEFzQ.exe
  C:\Windows\System\oCBEFzQ.exe
  2⤵
  PID:1932
- C:\Windows\System\FBepVYa.exe
  C:\Windows\System\FBepVYa.exe
  2⤵
  PID:2444
- C:\Windows\System\LYtOwgf.exe
  C:\Windows\System\LYtOwgf.exe
  2⤵
  PID:2516
- C:\Windows\System\xCVKekA.exe
  C:\Windows\System\xCVKekA.exe
  2⤵
  PID:2008
- C:\Windows\System\JQGmgcH.exe
  C:\Windows\System\JQGmgcH.exe
  2⤵
  PID:2524
- C:\Windows\System\ctaAOjh.exe
  C:\Windows\System\ctaAOjh.exe
  2⤵
  PID:656
- C:\Windows\System\oZxBhEC.exe
  C:\Windows\System\oZxBhEC.exe
  2⤵
  PID:2912
- C:\Windows\System\dWogZsd.exe
  C:\Windows\System\dWogZsd.exe
  2⤵
  PID:3024
- C:\Windows\System\JWAWYEQ.exe
  C:\Windows\System\JWAWYEQ.exe
  2⤵
  PID:2180
- C:\Windows\System\fITHexo.exe
  C:\Windows\System\fITHexo.exe
  2⤵
  PID:1496
- C:\Windows\System\pIbYGRA.exe
  C:\Windows\System\pIbYGRA.exe
  2⤵
  PID:1968
- C:\Windows\System\pgCSqJA.exe
  C:\Windows\System\pgCSqJA.exe
  2⤵
  PID:2944
- C:\Windows\System\YAJXnGZ.exe
  C:\Windows\System\YAJXnGZ.exe
  2⤵
  PID:2708
- C:\Windows\System\RLDWYcB.exe
  C:\Windows\System\RLDWYcB.exe
  2⤵
  PID:2800
- C:\Windows\System\xjIUmst.exe
  C:\Windows\System\xjIUmst.exe
  2⤵
  PID:264
- C:\Windows\System\DBOmkbq.exe
  C:\Windows\System\DBOmkbq.exe
  2⤵
  PID:2312
- C:\Windows\System\YTjNDjR.exe
  C:\Windows\System\YTjNDjR.exe
  2⤵
  PID:2112
- C:\Windows\System\BLSEtTh.exe
  C:\Windows\System\BLSEtTh.exe
  2⤵
  PID:1216
- C:\Windows\System\ZoEjKeM.exe
  C:\Windows\System\ZoEjKeM.exe
  2⤵
  PID:1136
- C:\Windows\System\LOfboVY.exe
  C:\Windows\System\LOfboVY.exe
  2⤵
  PID:832
- C:\Windows\System\tNXoTDV.exe
  C:\Windows\System\tNXoTDV.exe
  2⤵
  PID:2460
- C:\Windows\System\cFyxnNb.exe
  C:\Windows\System\cFyxnNb.exe
  2⤵
  PID:952
- C:\Windows\System\MMFHIFJ.exe
  C:\Windows\System\MMFHIFJ.exe
  2⤵
  PID:1876
- C:\Windows\System\FNNhzxk.exe
  C:\Windows\System\FNNhzxk.exe
  2⤵
  PID:1636
- C:\Windows\System\ATJbnCc.exe
  C:\Windows\System\ATJbnCc.exe
  2⤵
  PID:1020
- C:\Windows\System\YFwmXwx.exe
  C:\Windows\System\YFwmXwx.exe
  2⤵
  PID:1748
- C:\Windows\System\ZuZHyRm.exe
  C:\Windows\System\ZuZHyRm.exe
  2⤵
  PID:3080
- C:\Windows\System\gehhfBO.exe
  C:\Windows\System\gehhfBO.exe
  2⤵
  PID:3096
- C:\Windows\System\kAKhILv.exe
  C:\Windows\System\kAKhILv.exe
  2⤵
  PID:3112
- C:\Windows\System\wZgvcCL.exe
  C:\Windows\System\wZgvcCL.exe
  2⤵
  PID:3132
- C:\Windows\System\BzAMIts.exe
  C:\Windows\System\BzAMIts.exe
  2⤵
  PID:3148
- C:\Windows\System\tuvLHxc.exe
  C:\Windows\System\tuvLHxc.exe
  2⤵
  PID:3168
- C:\Windows\System\zuefLUL.exe
  C:\Windows\System\zuefLUL.exe
  2⤵
  PID:3188
- C:\Windows\System\cChtTbE.exe
  C:\Windows\System\cChtTbE.exe
  2⤵
  PID:3204
- C:\Windows\System\viXkRgJ.exe
  C:\Windows\System\viXkRgJ.exe
  2⤵
  PID:3220
- C:\Windows\System\GVuDEOd.exe
  C:\Windows\System\GVuDEOd.exe
  2⤵
  PID:3236
- C:\Windows\System\RyBaDBV.exe
  C:\Windows\System\RyBaDBV.exe
  2⤵
  PID:3252
- C:\Windows\System\CQgvyxG.exe
  C:\Windows\System\CQgvyxG.exe
  2⤵
  PID:3268
- C:\Windows\System\CXSTVKA.exe
  C:\Windows\System\CXSTVKA.exe
  2⤵
  PID:3288
- C:\Windows\System\HJzNghy.exe
  C:\Windows\System\HJzNghy.exe
  2⤵
  PID:3304
- C:\Windows\System\yAvMcWL.exe
  C:\Windows\System\yAvMcWL.exe
  2⤵
  PID:3320
- C:\Windows\System\POrhfWt.exe
  C:\Windows\System\POrhfWt.exe
  2⤵
  PID:3336
- C:\Windows\System\gaDhYJn.exe
  C:\Windows\System\gaDhYJn.exe
  2⤵
  PID:3352
- C:\Windows\System\ZTLUaFg.exe
  C:\Windows\System\ZTLUaFg.exe
  2⤵
  PID:3372
- C:\Windows\System\BNjdiUe.exe
  C:\Windows\System\BNjdiUe.exe
  2⤵
  PID:3388
- C:\Windows\System\BcEypgl.exe
  C:\Windows\System\BcEypgl.exe
  2⤵
  PID:3404
- C:\Windows\System\TkYsMKR.exe
  C:\Windows\System\TkYsMKR.exe
  2⤵
  PID:3424
- C:\Windows\System\nQeqMzI.exe
  C:\Windows\System\nQeqMzI.exe
  2⤵
  PID:3444
- C:\Windows\System\VdZcjyc.exe
  C:\Windows\System\VdZcjyc.exe
  2⤵
  PID:3464
- C:\Windows\System\xEuwShi.exe
  C:\Windows\System\xEuwShi.exe
  2⤵
  PID:3484
- C:\Windows\System\aPWGoXq.exe
  C:\Windows\System\aPWGoXq.exe
  2⤵
  PID:3500
- C:\Windows\System\BZPnvvS.exe
  C:\Windows\System\BZPnvvS.exe
  2⤵
  PID:3520
- C:\Windows\System\cMShsoJ.exe
  C:\Windows\System\cMShsoJ.exe
  2⤵
  PID:3536
- C:\Windows\System\wJmKgwo.exe
  C:\Windows\System\wJmKgwo.exe
  2⤵
  PID:3552
- C:\Windows\System\VaPQXWr.exe
  C:\Windows\System\VaPQXWr.exe
  2⤵
  PID:3568
- C:\Windows\System\UlCnXCw.exe
  C:\Windows\System\UlCnXCw.exe
  2⤵
  PID:3588
- C:\Windows\System\hiQUGJU.exe
  C:\Windows\System\hiQUGJU.exe
  2⤵
  PID:3604
- C:\Windows\System\CPyYNBn.exe
  C:\Windows\System\CPyYNBn.exe
  2⤵
  PID:3620
- C:\Windows\System\dAjttRw.exe
  C:\Windows\System\dAjttRw.exe
  2⤵
  PID:3636
- C:\Windows\System\vUVVUrk.exe
  C:\Windows\System\vUVVUrk.exe
  2⤵
  PID:3652
- C:\Windows\System\MEvdZTN.exe
  C:\Windows\System\MEvdZTN.exe
  2⤵
  PID:3668
- C:\Windows\System\ZaCDPZP.exe
  C:\Windows\System\ZaCDPZP.exe
  2⤵
  PID:3688
- C:\Windows\System\YReDTnx.exe
  C:\Windows\System\YReDTnx.exe
  2⤵
  PID:3704
- C:\Windows\System\ELWNreX.exe
  C:\Windows\System\ELWNreX.exe
  2⤵
  PID:3720
- C:\Windows\System\FSMkYek.exe
  C:\Windows\System\FSMkYek.exe
  2⤵
  PID:3736
- C:\Windows\System\zPSRjYP.exe
  C:\Windows\System\zPSRjYP.exe
  2⤵
  PID:3752
- C:\Windows\System\xnXOWSj.exe
  C:\Windows\System\xnXOWSj.exe
  2⤵
  PID:3768
- C:\Windows\System\SGBUJIF.exe
  C:\Windows\System\SGBUJIF.exe
  2⤵
  PID:3788
- C:\Windows\System\wWSnuvf.exe
  C:\Windows\System\wWSnuvf.exe
  2⤵
  PID:3804
- C:\Windows\System\CJxTgUt.exe
  C:\Windows\System\CJxTgUt.exe
  2⤵
  PID:3820
- C:\Windows\System\iqyQHfh.exe
  C:\Windows\System\iqyQHfh.exe
  2⤵
  PID:3980
- C:\Windows\System\MUxfzbp.exe
  C:\Windows\System\MUxfzbp.exe
  2⤵
  PID:3996
- C:\Windows\System\GQzPOJD.exe
  C:\Windows\System\GQzPOJD.exe
  2⤵
  PID:4012
- C:\Windows\System\abDBCqQ.exe
  C:\Windows\System\abDBCqQ.exe
  2⤵
  PID:4028
- C:\Windows\System\HQatpUh.exe
  C:\Windows\System\HQatpUh.exe
  2⤵
  PID:4044
- C:\Windows\System\DivjeGI.exe
  C:\Windows\System\DivjeGI.exe
  2⤵
  PID:4060
- C:\Windows\System\VzjVkId.exe
  C:\Windows\System\VzjVkId.exe
  2⤵
  PID:4076
- C:\Windows\System\eQOlYVg.exe
  C:\Windows\System\eQOlYVg.exe
  2⤵
  PID:4092
- C:\Windows\System\pDWkeJU.exe
  C:\Windows\System\pDWkeJU.exe
  2⤵
  PID:1404
- C:\Windows\System\uoVwJSe.exe
  C:\Windows\System\uoVwJSe.exe
  2⤵
  PID:1808
- C:\Windows\System\PxDSFgr.exe
  C:\Windows\System\PxDSFgr.exe
  2⤵
  PID:988
- C:\Windows\System\ZMWxZVr.exe
  C:\Windows\System\ZMWxZVr.exe
  2⤵
  PID:1872
- C:\Windows\System\njgdUHs.exe
  C:\Windows\System\njgdUHs.exe
  2⤵
  PID:1380
- C:\Windows\System\gxjOIbt.exe
  C:\Windows\System\gxjOIbt.exe
  2⤵
  PID:1924
- C:\Windows\System\fvRHwUT.exe
  C:\Windows\System\fvRHwUT.exe
  2⤵
  PID:2488
- C:\Windows\System\tbOQDPB.exe
  C:\Windows\System\tbOQDPB.exe
  2⤵
  PID:3360
- C:\Windows\System\OqQlacU.exe
  C:\Windows\System\OqQlacU.exe
  2⤵
  PID:2324
- C:\Windows\System\woaGpTs.exe
  C:\Windows\System\woaGpTs.exe
  2⤵
  PID:2336
- C:\Windows\System\VmhgmXc.exe
  C:\Windows\System\VmhgmXc.exe
  2⤵
  PID:904
- C:\Windows\System\rvAVvqp.exe
  C:\Windows\System\rvAVvqp.exe
  2⤵
  PID:3120
- C:\Windows\System\ocBEfEk.exe
  C:\Windows\System\ocBEfEk.exe
  2⤵
  PID:3164
- C:\Windows\System\YHPfJcH.exe
  C:\Windows\System\YHPfJcH.exe
  2⤵
  PID:3232
- C:\Windows\System\gzRtPAQ.exe
  C:\Windows\System\gzRtPAQ.exe
  2⤵
  PID:3300
- C:\Windows\System\GjLZOPG.exe
  C:\Windows\System\GjLZOPG.exe
  2⤵
  PID:3396
- C:\Windows\System\BOFVZnL.exe
  C:\Windows\System\BOFVZnL.exe
  2⤵
  PID:3436
- C:\Windows\System\lXGBaIU.exe
  C:\Windows\System\lXGBaIU.exe
  2⤵
  PID:3512
- C:\Windows\System\edtKJfA.exe
  C:\Windows\System\edtKJfA.exe
  2⤵
  PID:3576
- C:\Windows\System\vVQnDBN.exe
  C:\Windows\System\vVQnDBN.exe
  2⤵
  PID:3616
- C:\Windows\System\KXRnyWT.exe
  C:\Windows\System\KXRnyWT.exe
  2⤵
  PID:3684
- C:\Windows\System\dxXJSLs.exe
  C:\Windows\System\dxXJSLs.exe
  2⤵
  PID:3748
- C:\Windows\System\LEKLhIX.exe
  C:\Windows\System\LEKLhIX.exe
  2⤵
  PID:3816
- C:\Windows\System\qivkXIM.exe
  C:\Windows\System\qivkXIM.exe
  2⤵
  PID:380
- C:\Windows\System\FSqwVTM.exe
  C:\Windows\System\FSqwVTM.exe
  2⤵
  PID:2116
- C:\Windows\System\sORvtrE.exe
  C:\Windows\System\sORvtrE.exe
  2⤵
  PID:3280
- C:\Windows\System\XjdzDNt.exe
  C:\Windows\System\XjdzDNt.exe
  2⤵
  PID:3800
- C:\Windows\System\psAjqHz.exe
  C:\Windows\System\psAjqHz.exe
  2⤵
  PID:3856
- C:\Windows\System\WXVPwun.exe
  C:\Windows\System\WXVPwun.exe
  2⤵
  PID:3888
- C:\Windows\System\kGbvDMI.exe
  C:\Windows\System\kGbvDMI.exe
  2⤵
  PID:2316
- C:\Windows\System\QdRtUka.exe
  C:\Windows\System\QdRtUka.exe
  2⤵
  PID:376
- C:\Windows\System\hWRuqer.exe
  C:\Windows\System\hWRuqer.exe
  2⤵
  PID:2248
- C:\Windows\System\iUrQEIq.exe
  C:\Windows\System\iUrQEIq.exe
  2⤵
  PID:2644
- C:\Windows\System\Rkctjcn.exe
  C:\Windows\System\Rkctjcn.exe
  2⤵
  PID:3008
- C:\Windows\System\aeRLfNz.exe
  C:\Windows\System\aeRLfNz.exe
  2⤵
  PID:1684
- C:\Windows\System\NXuURSF.exe
  C:\Windows\System\NXuURSF.exe
  2⤵
  PID:1240
- C:\Windows\System\RNjIybv.exe
  C:\Windows\System\RNjIybv.exe
  2⤵
  PID:2468
- C:\Windows\System\pcAbGpR.exe
  C:\Windows\System\pcAbGpR.exe
  2⤵
  PID:2380
- C:\Windows\System\wXxUlKB.exe
  C:\Windows\System\wXxUlKB.exe
  2⤵
  PID:3104
- C:\Windows\System\HpaYUJv.exe
  C:\Windows\System\HpaYUJv.exe
  2⤵
  PID:3176
- C:\Windows\System\kKBcTnJ.exe
  C:\Windows\System\kKBcTnJ.exe
  2⤵
  PID:3244
- C:\Windows\System\AjTUEHR.exe
  C:\Windows\System\AjTUEHR.exe
  2⤵
  PID:3284
- C:\Windows\System\yKGKPPz.exe
  C:\Windows\System\yKGKPPz.exe
  2⤵
  PID:3380
- C:\Windows\System\wogHeLG.exe
  C:\Windows\System\wogHeLG.exe
  2⤵
  PID:3416
- C:\Windows\System\tzVbTBh.exe
  C:\Windows\System\tzVbTBh.exe
  2⤵
  PID:3496
- C:\Windows\System\LTmxchB.exe
  C:\Windows\System\LTmxchB.exe
  2⤵
  PID:3564
- C:\Windows\System\IYCXOua.exe
  C:\Windows\System\IYCXOua.exe
  2⤵
  PID:3660
- C:\Windows\System\yIEmunJ.exe
  C:\Windows\System\yIEmunJ.exe
  2⤵
  PID:3732
- C:\Windows\System\QEAYIGW.exe
  C:\Windows\System\QEAYIGW.exe
  2⤵
  PID:3900
- C:\Windows\System\zobtTLL.exe
  C:\Windows\System\zobtTLL.exe
  2⤵
  PID:3916
- C:\Windows\System\avESdtn.exe
  C:\Windows\System\avESdtn.exe
  2⤵
  PID:3936
- C:\Windows\System\qUUJFmZ.exe
  C:\Windows\System\qUUJFmZ.exe
  2⤵
  PID:3952
- C:\Windows\System\rrNxOLR.exe
  C:\Windows\System\rrNxOLR.exe
  2⤵
  PID:4020
- C:\Windows\System\ouEjXOP.exe
  C:\Windows\System\ouEjXOP.exe
  2⤵
  PID:4052
- C:\Windows\System\tXtXAur.exe
  C:\Windows\System\tXtXAur.exe
  2⤵
  PID:4084
- C:\Windows\System\pCQbsLI.exe
  C:\Windows\System\pCQbsLI.exe
  2⤵
  PID:3044
- C:\Windows\System\zmtLhit.exe
  C:\Windows\System\zmtLhit.exe
  2⤵
  PID:2256
- C:\Windows\System\iUHkiZo.exe
  C:\Windows\System\iUHkiZo.exe
  2⤵
  PID:1676
- C:\Windows\System\qDITiNh.exe
  C:\Windows\System\qDITiNh.exe
  2⤵
  PID:2832
- C:\Windows\System\mBuXZLU.exe
  C:\Windows\System\mBuXZLU.exe
  2⤵
  PID:2612
- C:\Windows\System\SqjEirc.exe
  C:\Windows\System\SqjEirc.exe
  2⤵
  PID:1964
- C:\Windows\System\GSnUxHk.exe
  C:\Windows\System\GSnUxHk.exe
  2⤵
  PID:3128
- C:\Windows\System\BckDcAO.exe
  C:\Windows\System\BckDcAO.exe
  2⤵
  PID:3364
- C:\Windows\System\CipaXph.exe
  C:\Windows\System\CipaXph.exe
  2⤵
  PID:3400
- C:\Windows\System\PriEtLz.exe
  C:\Windows\System\PriEtLz.exe
  2⤵
  PID:3544
- C:\Windows\System\QtlZwAc.exe
  C:\Windows\System\QtlZwAc.exe
  2⤵
  PID:3676
- C:\Windows\System\KEgUUDQ.exe
  C:\Windows\System\KEgUUDQ.exe
  2⤵
  PID:3784
- C:\Windows\System\WFOPBdK.exe
  C:\Windows\System\WFOPBdK.exe
  2⤵
  PID:820
- C:\Windows\System\hHSWsbi.exe
  C:\Windows\System\hHSWsbi.exe
  2⤵
  PID:3460
- C:\Windows\System\bzuWXpH.exe
  C:\Windows\System\bzuWXpH.exe
  2⤵
  PID:3872
- C:\Windows\System\bNNLMnB.exe
  C:\Windows\System\bNNLMnB.exe
  2⤵
  PID:2396
- C:\Windows\System\RRztCfu.exe
  C:\Windows\System\RRztCfu.exe
  2⤵
  PID:344
- C:\Windows\System\eQiccjH.exe
  C:\Windows\System\eQiccjH.exe
  2⤵
  PID:2636
- C:\Windows\System\OkgRwAr.exe
  C:\Windows\System\OkgRwAr.exe
  2⤵
  PID:4112
- C:\Windows\System\HXevUjq.exe
  C:\Windows\System\HXevUjq.exe
  2⤵
  PID:4128
- C:\Windows\System\gUnhIdK.exe
  C:\Windows\System\gUnhIdK.exe
  2⤵
  PID:4144
- C:\Windows\System\rfufhTQ.exe
  C:\Windows\System\rfufhTQ.exe
  2⤵
  PID:4160
- C:\Windows\System\FUPmesl.exe
  C:\Windows\System\FUPmesl.exe
  2⤵
  PID:4176
- C:\Windows\System\NpuRJRZ.exe
  C:\Windows\System\NpuRJRZ.exe
  2⤵
  PID:4192
- C:\Windows\System\nKvuGjk.exe
  C:\Windows\System\nKvuGjk.exe
  2⤵
  PID:4208
- C:\Windows\System\zhZBVne.exe
  C:\Windows\System\zhZBVne.exe
  2⤵
  PID:4224
- C:\Windows\System\UZGNHiT.exe
  C:\Windows\System\UZGNHiT.exe
  2⤵
  PID:4240
- C:\Windows\System\BwxjwJQ.exe
  C:\Windows\System\BwxjwJQ.exe
  2⤵
  PID:4256
- C:\Windows\System\TkqNTtT.exe
  C:\Windows\System\TkqNTtT.exe
  2⤵
  PID:4272
- C:\Windows\System\GOLoNrz.exe
  C:\Windows\System\GOLoNrz.exe
  2⤵
  PID:4288
- C:\Windows\System\TYoAYFg.exe
  C:\Windows\System\TYoAYFg.exe
  2⤵
  PID:4304
- C:\Windows\System\rFfDTEe.exe
  C:\Windows\System\rFfDTEe.exe
  2⤵
  PID:4320
- C:\Windows\System\upTQqYA.exe
  C:\Windows\System\upTQqYA.exe
  2⤵
  PID:4336
- C:\Windows\System\irtFINM.exe
  C:\Windows\System\irtFINM.exe
  2⤵
  PID:4352
- C:\Windows\System\IVUGXNs.exe
  C:\Windows\System\IVUGXNs.exe
  2⤵
  PID:4368
- C:\Windows\System\HrXDoyL.exe
  C:\Windows\System\HrXDoyL.exe
  2⤵
  PID:4384
- C:\Windows\System\UmdJhqu.exe
  C:\Windows\System\UmdJhqu.exe
  2⤵
  PID:4400
- C:\Windows\System\ouwLpiJ.exe
  C:\Windows\System\ouwLpiJ.exe
  2⤵
  PID:4416
- C:\Windows\System\BZaSYsR.exe
  C:\Windows\System\BZaSYsR.exe
  2⤵
  PID:4432
- C:\Windows\System\INNtbmb.exe
  C:\Windows\System\INNtbmb.exe
  2⤵
  PID:4448
- C:\Windows\System\aozYmQo.exe
  C:\Windows\System\aozYmQo.exe
  2⤵
  PID:4464
- C:\Windows\System\vjEXnDw.exe
  C:\Windows\System\vjEXnDw.exe
  2⤵
  PID:4480
- C:\Windows\System\veZjqLB.exe
  C:\Windows\System\veZjqLB.exe
  2⤵
  PID:4496
- C:\Windows\System\jguhlEF.exe
  C:\Windows\System\jguhlEF.exe
  2⤵
  PID:4512
- C:\Windows\System\TyxQqMc.exe
  C:\Windows\System\TyxQqMc.exe
  2⤵
  PID:4528
- C:\Windows\System\FQVYNjG.exe
  C:\Windows\System\FQVYNjG.exe
  2⤵
  PID:4544
- C:\Windows\System\rekSFQB.exe
  C:\Windows\System\rekSFQB.exe
  2⤵
  PID:4560
- C:\Windows\System\HoiHZOS.exe
  C:\Windows\System\HoiHZOS.exe
  2⤵
  PID:4576
- C:\Windows\System\FvkIBxR.exe
  C:\Windows\System\FvkIBxR.exe
  2⤵
  PID:4592
- C:\Windows\System\ERihSdJ.exe
  C:\Windows\System\ERihSdJ.exe
  2⤵
  PID:4672
- C:\Windows\System\hmluWwt.exe
  C:\Windows\System\hmluWwt.exe
  2⤵
  PID:4688
- C:\Windows\System\jwVuNVF.exe
  C:\Windows\System\jwVuNVF.exe
  2⤵
  PID:4704
- C:\Windows\System\fVMKWvl.exe
  C:\Windows\System\fVMKWvl.exe
  2⤵
  PID:4720
- C:\Windows\System\AncPlxg.exe
  C:\Windows\System\AncPlxg.exe
  2⤵
  PID:4736
- C:\Windows\System\FZOqfjT.exe
  C:\Windows\System\FZOqfjT.exe
  2⤵
  PID:4752
- C:\Windows\System\isKZyGQ.exe
  C:\Windows\System\isKZyGQ.exe
  2⤵
  PID:4768
- C:\Windows\System\QgCInFm.exe
  C:\Windows\System\QgCInFm.exe
  2⤵
  PID:4784
- C:\Windows\System\JdOJwuE.exe
  C:\Windows\System\JdOJwuE.exe
  2⤵
  PID:4800
- C:\Windows\System\KLRqIuN.exe
  C:\Windows\System\KLRqIuN.exe
  2⤵
  PID:4816
- C:\Windows\System\jJcavfM.exe
  C:\Windows\System\jJcavfM.exe
  2⤵
  PID:4832
- C:\Windows\System\rExdLsU.exe
  C:\Windows\System\rExdLsU.exe
  2⤵
  PID:4848
- C:\Windows\System\QIAdzcr.exe
  C:\Windows\System\QIAdzcr.exe
  2⤵
  PID:4864
- C:\Windows\System\dceRNUl.exe
  C:\Windows\System\dceRNUl.exe
  2⤵
  PID:4880
- C:\Windows\System\EYvPZfL.exe
  C:\Windows\System\EYvPZfL.exe
  2⤵
  PID:4896
- C:\Windows\System\nfNeuGy.exe
  C:\Windows\System\nfNeuGy.exe
  2⤵
  PID:4912
- C:\Windows\System\ptLCWDl.exe
  C:\Windows\System\ptLCWDl.exe
  2⤵
  PID:4928
- C:\Windows\System\MNGXvHW.exe
  C:\Windows\System\MNGXvHW.exe
  2⤵
  PID:4944
- C:\Windows\System\GYtcEUC.exe
  C:\Windows\System\GYtcEUC.exe
  2⤵
  PID:4960
- C:\Windows\System\sewJweC.exe
  C:\Windows\System\sewJweC.exe
  2⤵
  PID:4976
- C:\Windows\System\TqkNYMy.exe
  C:\Windows\System\TqkNYMy.exe
  2⤵
  PID:4992
- C:\Windows\System\XGFMEax.exe
  C:\Windows\System\XGFMEax.exe
  2⤵
  PID:5008
- C:\Windows\System\KdAZQQH.exe
  C:\Windows\System\KdAZQQH.exe
  2⤵
  PID:5024
- C:\Windows\System\PJFVHIs.exe
  C:\Windows\System\PJFVHIs.exe
  2⤵
  PID:5040
- C:\Windows\System\qtxDMzT.exe
  C:\Windows\System\qtxDMzT.exe
  2⤵
  PID:5056
- C:\Windows\System\ujJslyJ.exe
  C:\Windows\System\ujJslyJ.exe
  2⤵
  PID:5072
- C:\Windows\System\VpBZcSH.exe
  C:\Windows\System\VpBZcSH.exe
  2⤵
  PID:5088
- C:\Windows\System\gxwpNRm.exe
  C:\Windows\System\gxwpNRm.exe
  2⤵
  PID:5104
- C:\Windows\System\CJohyqH.exe
  C:\Windows\System\CJohyqH.exe
  2⤵
  PID:2056
- C:\Windows\System\cITxJVx.exe
  C:\Windows\System\cITxJVx.exe
  2⤵
  PID:3296
- C:\Windows\System\oLkCwfM.exe
  C:\Windows\System\oLkCwfM.exe
  2⤵
  PID:5132
- C:\Windows\System\hiIcGGd.exe
  C:\Windows\System\hiIcGGd.exe
  2⤵
  PID:5148
- C:\Windows\System\rJWwlAL.exe
  C:\Windows\System\rJWwlAL.exe
  2⤵
  PID:5164
- C:\Windows\System\sJSnxEM.exe
  C:\Windows\System\sJSnxEM.exe
  2⤵
  PID:5180
- C:\Windows\System\gprszuU.exe
  C:\Windows\System\gprszuU.exe
  2⤵
  PID:5196
- C:\Windows\System\SgIczhP.exe
  C:\Windows\System\SgIczhP.exe
  2⤵
  PID:5212
- C:\Windows\System\yIHgVEy.exe
  C:\Windows\System\yIHgVEy.exe
  2⤵
  PID:5228
- C:\Windows\System\XbGNPNv.exe
  C:\Windows\System\XbGNPNv.exe
  2⤵
  PID:5244
- C:\Windows\System\PxOlzQA.exe
  C:\Windows\System\PxOlzQA.exe
  2⤵
  PID:5260
- C:\Windows\System\UDLAUyA.exe
  C:\Windows\System\UDLAUyA.exe
  2⤵
  PID:5276
- C:\Windows\System\nyjmxUO.exe
  C:\Windows\System\nyjmxUO.exe
  2⤵
  PID:5292
- C:\Windows\System\LgicFLF.exe
  C:\Windows\System\LgicFLF.exe
  2⤵
  PID:5308
- C:\Windows\System\ARZaFWv.exe
  C:\Windows\System\ARZaFWv.exe
  2⤵
  PID:5324
- C:\Windows\System\BBTDKWK.exe
  C:\Windows\System\BBTDKWK.exe
  2⤵
  PID:5340
- C:\Windows\System\tmWQNnp.exe
  C:\Windows\System\tmWQNnp.exe
  2⤵
  PID:5356
- C:\Windows\System\CeeXdMJ.exe
  C:\Windows\System\CeeXdMJ.exe
  2⤵
  PID:5380
- C:\Windows\System\ohRPEpt.exe
  C:\Windows\System\ohRPEpt.exe
  2⤵
  PID:5408
- C:\Windows\System\CtglqaH.exe
  C:\Windows\System\CtglqaH.exe
  2⤵
  PID:5424
- C:\Windows\System\FXmOTEF.exe
  C:\Windows\System\FXmOTEF.exe
  2⤵
  PID:5440
- C:\Windows\System\IMHsiCT.exe
  C:\Windows\System\IMHsiCT.exe
  2⤵
  PID:5456
- C:\Windows\System\TYPuyPO.exe
  C:\Windows\System\TYPuyPO.exe
  2⤵
  PID:5520
- C:\Windows\System\RrgXURq.exe
  C:\Windows\System\RrgXURq.exe
  2⤵
  PID:5540
- C:\Windows\System\KujSIxH.exe
  C:\Windows\System\KujSIxH.exe
  2⤵
  PID:5556
- C:\Windows\System\neIIVVy.exe
  C:\Windows\System\neIIVVy.exe
  2⤵
  PID:5572
- C:\Windows\System\qfUxslU.exe
  C:\Windows\System\qfUxslU.exe
  2⤵
  PID:5588
- C:\Windows\System\agVgXNP.exe
  C:\Windows\System\agVgXNP.exe
  2⤵
  PID:5604
- C:\Windows\System\tNpjCPu.exe
  C:\Windows\System\tNpjCPu.exe
  2⤵
  PID:5620
- C:\Windows\System\FsofIih.exe
  C:\Windows\System\FsofIih.exe
  2⤵
  PID:5636
- C:\Windows\System\YzEUdiV.exe
  C:\Windows\System\YzEUdiV.exe
  2⤵
  PID:5652
- C:\Windows\System\CzyYsIo.exe
  C:\Windows\System\CzyYsIo.exe
  2⤵
  PID:5672
- C:\Windows\System\ngPylBZ.exe
  C:\Windows\System\ngPylBZ.exe
  2⤵
  PID:5688
- C:\Windows\System\GnPaTMq.exe
  C:\Windows\System\GnPaTMq.exe
  2⤵
  PID:5704
- C:\Windows\System\HRXTFSr.exe
  C:\Windows\System\HRXTFSr.exe
  2⤵
  PID:5720
- C:\Windows\System\GNRvcMC.exe
  C:\Windows\System\GNRvcMC.exe
  2⤵
  PID:5740
- C:\Windows\System\WnajNZp.exe
  C:\Windows\System\WnajNZp.exe
  2⤵
  PID:5756
- C:\Windows\System\FJLDOcP.exe
  C:\Windows\System\FJLDOcP.exe
  2⤵
  PID:5772
- C:\Windows\System\QCQUhSW.exe
  C:\Windows\System\QCQUhSW.exe
  2⤵
  PID:5792
- C:\Windows\System\JFXxxfd.exe
  C:\Windows\System\JFXxxfd.exe
  2⤵
  PID:5808
- C:\Windows\System\GALVKUu.exe
  C:\Windows\System\GALVKUu.exe
  2⤵
  PID:5824
- C:\Windows\System\EeILFzN.exe
  C:\Windows\System\EeILFzN.exe
  2⤵
  PID:5840
- C:\Windows\System\dSqjdbX.exe
  C:\Windows\System\dSqjdbX.exe
  2⤵
  PID:5856
- C:\Windows\System\ApszhVa.exe
  C:\Windows\System\ApszhVa.exe
  2⤵
  PID:5872
- C:\Windows\System\zKGiIAm.exe
  C:\Windows\System\zKGiIAm.exe
  2⤵
  PID:5888
- C:\Windows\System\xTwSHBW.exe
  C:\Windows\System\xTwSHBW.exe
  2⤵
  PID:5904
- C:\Windows\System\QUJoDgM.exe
  C:\Windows\System\QUJoDgM.exe
  2⤵
  PID:5920
- C:\Windows\System\OLZhQTb.exe
  C:\Windows\System\OLZhQTb.exe
  2⤵
  PID:5936
- C:\Windows\System\MbPECPP.exe
  C:\Windows\System\MbPECPP.exe
  2⤵
  PID:5952
- C:\Windows\System\fmKseIE.exe
  C:\Windows\System\fmKseIE.exe
  2⤵
  PID:5968
- C:\Windows\System\UXbgGIt.exe
  C:\Windows\System\UXbgGIt.exe
  2⤵
  PID:5984
- C:\Windows\System\AiKTBHq.exe
  C:\Windows\System\AiKTBHq.exe
  2⤵
  PID:6000
- C:\Windows\System\wzPdXBm.exe
  C:\Windows\System\wzPdXBm.exe
  2⤵
  PID:6016
- C:\Windows\System\SruYVbO.exe
  C:\Windows\System\SruYVbO.exe
  2⤵
  PID:6032
- C:\Windows\System\mmGkTXJ.exe
  C:\Windows\System\mmGkTXJ.exe
  2⤵
  PID:6048
- C:\Windows\System\ILwcOKX.exe
  C:\Windows\System\ILwcOKX.exe
  2⤵
  PID:6064
- C:\Windows\System\hyuxEhP.exe
  C:\Windows\System\hyuxEhP.exe
  2⤵
  PID:6080
- C:\Windows\System\qlGJLib.exe
  C:\Windows\System\qlGJLib.exe
  2⤵
  PID:6096
- C:\Windows\System\Zyacwmk.exe
  C:\Windows\System\Zyacwmk.exe
  2⤵
  PID:6112
- C:\Windows\System\KxybNyT.exe
  C:\Windows\System\KxybNyT.exe
  2⤵
  PID:6128
- C:\Windows\System\TLnXnco.exe
  C:\Windows\System\TLnXnco.exe
  2⤵
  PID:1608
- C:\Windows\System\AmOlzWB.exe
  C:\Windows\System\AmOlzWB.exe
  2⤵
  PID:3144
- C:\Windows\System\HqvMnvI.exe
  C:\Windows\System\HqvMnvI.exe
  2⤵
  PID:3412
- C:\Windows\System\skgzcni.exe
  C:\Windows\System\skgzcni.exe
  2⤵
  PID:3728
- C:\Windows\System\uwuiqEb.exe
  C:\Windows\System\uwuiqEb.exe
  2⤵
  PID:3948
- C:\Windows\System\mhzhTuU.exe
  C:\Windows\System\mhzhTuU.exe
  2⤵
  PID:4088
- C:\Windows\System\njaSMcL.exe
  C:\Windows\System\njaSMcL.exe
  2⤵
  PID:3088
- C:\Windows\System\lTCpkpf.exe
  C:\Windows\System\lTCpkpf.exe
  2⤵
  PID:3548
- C:\Windows\System\KwpHGeD.exe
  C:\Windows\System\KwpHGeD.exe
  2⤵
  PID:2520
- C:\Windows\System\iHsiUHY.exe
  C:\Windows\System\iHsiUHY.exe
  2⤵
  PID:4168
- C:\Windows\System\QERXYEf.exe
  C:\Windows\System\QERXYEf.exe
  2⤵
  PID:4232
- C:\Windows\System\KjYrXex.exe
  C:\Windows\System\KjYrXex.exe
  2⤵
  PID:4296
- C:\Windows\System\sxtXusH.exe
  C:\Windows\System\sxtXusH.exe
  2⤵
  PID:4360
- C:\Windows\System\MKvsrwK.exe
  C:\Windows\System\MKvsrwK.exe
  2⤵
  PID:4428
- C:\Windows\System\vVdSNwC.exe
  C:\Windows\System\vVdSNwC.exe
  2⤵
  PID:4492
- C:\Windows\System\dUIJvEn.exe
  C:\Windows\System\dUIJvEn.exe
  2⤵
  PID:4556
- C:\Windows\System\RqMrsaT.exe
  C:\Windows\System\RqMrsaT.exe
  2⤵
  PID:4684
- C:\Windows\System\ZYPMAUN.exe
  C:\Windows\System\ZYPMAUN.exe
  2⤵
  PID:4748
- C:\Windows\System\SHWkAzg.exe
  C:\Windows\System\SHWkAzg.exe
  2⤵
  PID:4812
- C:\Windows\System\VyitxMB.exe
  C:\Windows\System\VyitxMB.exe
  2⤵
  PID:4872
- C:\Windows\System\vPGFHWn.exe
  C:\Windows\System\vPGFHWn.exe
  2⤵
  PID:4936
- C:\Windows\System\LMkZWsS.exe
  C:\Windows\System\LMkZWsS.exe
  2⤵
  PID:5000
- C:\Windows\System\fsXYBEU.exe
  C:\Windows\System\fsXYBEU.exe
  2⤵
  PID:5064
- C:\Windows\System\NiVRYXx.exe
  C:\Windows\System\NiVRYXx.exe
  2⤵
  PID:2100
- C:\Windows\System\FzOjKkq.exe
  C:\Windows\System\FzOjKkq.exe
  2⤵
  PID:5172
- C:\Windows\System\MFHdzyw.exe
  C:\Windows\System\MFHdzyw.exe
  2⤵
  PID:5236
- C:\Windows\System\mKTLjvd.exe
  C:\Windows\System\mKTLjvd.exe
  2⤵
  PID:5300
- C:\Windows\System\snGOiFG.exe
  C:\Windows\System\snGOiFG.exe
  2⤵
  PID:5364
- C:\Windows\System\nSLaxfe.exe
  C:\Windows\System\nSLaxfe.exe
  2⤵
  PID:5368
- C:\Windows\System\eysgZUY.exe
  C:\Windows\System\eysgZUY.exe
  2⤵
  PID:5252
- C:\Windows\System\GRRFmFP.exe
  C:\Windows\System\GRRFmFP.exe
  2⤵
  PID:5416
- C:\Windows\System\lxwSdlx.exe
  C:\Windows\System\lxwSdlx.exe
  2⤵
  PID:3076
- C:\Windows\System\wXHfsIZ.exe
  C:\Windows\System\wXHfsIZ.exe
  2⤵
  PID:3316
- C:\Windows\System\KHXFzxs.exe
  C:\Windows\System\KHXFzxs.exe
  2⤵
  PID:3632
- C:\Windows\System\oPCiiAM.exe
  C:\Windows\System\oPCiiAM.exe
  2⤵
  PID:3928
- C:\Windows\System\bQeIBkY.exe
  C:\Windows\System\bQeIBkY.exe
  2⤵
  PID:4036
- C:\Windows\System\WJRaHfp.exe
  C:\Windows\System\WJRaHfp.exe
  2⤵
  PID:1756
- C:\Windows\System\fDUGdmD.exe
  C:\Windows\System\fDUGdmD.exe
  2⤵
  PID:3432
- C:\Windows\System\MNiaNcJ.exe
  C:\Windows\System\MNiaNcJ.exe
  2⤵
  PID:3184
- C:\Windows\System\EFILQmZ.exe
  C:\Windows\System\EFILQmZ.exe
  2⤵
  PID:2668
- C:\Windows\System\KFwAEJh.exe
  C:\Windows\System\KFwAEJh.exe
  2⤵
  PID:4152
- C:\Windows\System\wGmdwmh.exe
  C:\Windows\System\wGmdwmh.exe
  2⤵
  PID:4216
- C:\Windows\System\EWwZvmF.exe
  C:\Windows\System\EWwZvmF.exe
  2⤵
  PID:4280
- C:\Windows\System\sHUFQlB.exe
  C:\Windows\System\sHUFQlB.exe
  2⤵
  PID:4344
- C:\Windows\System\gmDpMOu.exe
  C:\Windows\System\gmDpMOu.exe
  2⤵
  PID:4408
- C:\Windows\System\BvdIQEE.exe
  C:\Windows\System\BvdIQEE.exe
  2⤵
  PID:4472
- C:\Windows\System\ijwJlGK.exe
  C:\Windows\System\ijwJlGK.exe
  2⤵
  PID:4540
- C:\Windows\System\BfndJRA.exe
  C:\Windows\System\BfndJRA.exe
  2⤵
  PID:4600
- C:\Windows\System\HyELfqR.exe
  C:\Windows\System\HyELfqR.exe
  2⤵
  PID:4616
- C:\Windows\System\fLrnEHy.exe
  C:\Windows\System\fLrnEHy.exe
  2⤵
  PID:4632
- C:\Windows\System\EZGNUnv.exe
  C:\Windows\System\EZGNUnv.exe
  2⤵
  PID:4648
- C:\Windows\System\ymsBBga.exe
  C:\Windows\System\ymsBBga.exe
  2⤵
  PID:4664
- C:\Windows\System\lSfgfKB.exe
  C:\Windows\System\lSfgfKB.exe
  2⤵
  PID:4728
- C:\Windows\System\unpHHcb.exe
  C:\Windows\System\unpHHcb.exe
  2⤵
  PID:4796
- C:\Windows\System\mWFIzXj.exe
  C:\Windows\System\mWFIzXj.exe
  2⤵
  PID:4860
- C:\Windows\System\BabqGEp.exe
  C:\Windows\System\BabqGEp.exe
  2⤵
  PID:4924
- C:\Windows\System\NcygoAs.exe
  C:\Windows\System\NcygoAs.exe
  2⤵
  PID:4988
- C:\Windows\System\wumLdrx.exe
  C:\Windows\System\wumLdrx.exe
  2⤵
  PID:5052
- C:\Windows\System\tssuccf.exe
  C:\Windows\System\tssuccf.exe
  2⤵
  PID:5124
- C:\Windows\System\xSXGQPW.exe
  C:\Windows\System\xSXGQPW.exe
  2⤵
  PID:5188
- C:\Windows\System\uPkXmBa.exe
  C:\Windows\System\uPkXmBa.exe
  2⤵
  PID:5256
- C:\Windows\System\TPBXZfl.exe
  C:\Windows\System\TPBXZfl.exe
  2⤵
  PID:5348
- C:\Windows\System\ZJaCjkD.exe
  C:\Windows\System\ZJaCjkD.exe
  2⤵
  PID:2208
- C:\Windows\System\GDvWIUc.exe
  C:\Windows\System\GDvWIUc.exe
  2⤵
  PID:5532
- C:\Windows\System\VgfzpdZ.exe
  C:\Windows\System\VgfzpdZ.exe
  2⤵
  PID:5600
- C:\Windows\System\tarYnKL.exe
  C:\Windows\System\tarYnKL.exe
  2⤵
  PID:5396
- C:\Windows\System\ZhaQfIZ.exe
  C:\Windows\System\ZhaQfIZ.exe
  2⤵
  PID:5436
- C:\Windows\System\aSTNPKv.exe
  C:\Windows\System\aSTNPKv.exe
  2⤵
  PID:5664
- C:\Windows\System\CTtdjGt.exe
  C:\Windows\System\CTtdjGt.exe
  2⤵
  PID:5580
- C:\Windows\System\WpFVNQA.exe
  C:\Windows\System\WpFVNQA.exe
  2⤵
  PID:5644
- C:\Windows\System\PSyxIis.exe
  C:\Windows\System\PSyxIis.exe
  2⤵
  PID:5684
- C:\Windows\System\sFRcHSU.exe
  C:\Windows\System\sFRcHSU.exe
  2⤵
  PID:3160
- C:\Windows\System\PnriqmU.exe
  C:\Windows\System\PnriqmU.exe
  2⤵
  PID:5768
- C:\Windows\System\LaEogBy.exe
  C:\Windows\System\LaEogBy.exe
  2⤵
  PID:3440
- C:\Windows\System\sEfgGKu.exe
  C:\Windows\System\sEfgGKu.exe
  2⤵
  PID:5836
- C:\Windows\System\oRfbOsw.exe
  C:\Windows\System\oRfbOsw.exe
  2⤵
  PID:5820
- C:\Windows\System\WwnsBAP.exe
  C:\Windows\System\WwnsBAP.exe
  2⤵
  PID:5852
- C:\Windows\System\BMkLLvl.exe
  C:\Windows\System\BMkLLvl.exe
  2⤵
  PID:5960
- C:\Windows\System\ZgGqytK.exe
  C:\Windows\System\ZgGqytK.exe
  2⤵
  PID:5992
- C:\Windows\System\BLCYghx.exe
  C:\Windows\System\BLCYghx.exe
  2⤵
  PID:6024
- C:\Windows\System\PaYwvZw.exe
  C:\Windows\System\PaYwvZw.exe
  2⤵
  PID:5980
- C:\Windows\System\bdAfqHR.exe
  C:\Windows\System\bdAfqHR.exe
  2⤵
  PID:6012
- C:\Windows\System\gmQPoCw.exe
  C:\Windows\System\gmQPoCw.exe
  2⤵
  PID:6072
- C:\Windows\System\iabvYbN.exe
  C:\Windows\System\iabvYbN.exe
  2⤵
  PID:6108
- C:\Windows\System\NdaVuYT.exe
  C:\Windows\System\NdaVuYT.exe
  2⤵
  PID:3560
- C:\Windows\System\FosAvlc.exe
  C:\Windows\System\FosAvlc.exe
  2⤵
  PID:4008
- C:\Windows\System\IyKttLx.exe
  C:\Windows\System\IyKttLx.exe
  2⤵
  PID:3264
- C:\Windows\System\YJHfArR.exe
  C:\Windows\System\YJHfArR.exe
  2⤵
  PID:4140
- C:\Windows\System\zyQsomE.exe
  C:\Windows\System\zyQsomE.exe
  2⤵
  PID:4264
- C:\Windows\System\XmDTuxQ.exe
  C:\Windows\System\XmDTuxQ.exe
  2⤵
  PID:4396
- C:\Windows\System\lpLCkWG.exe
  C:\Windows\System\lpLCkWG.exe
  2⤵
  PID:4524
- C:\Windows\System\QeqoAvH.exe
  C:\Windows\System\QeqoAvH.exe
  2⤵
  PID:4488
- C:\Windows\System\wEEJzpV.exe
  C:\Windows\System\wEEJzpV.exe
  2⤵
  PID:4844
- C:\Windows\System\sWWTNQv.exe
  C:\Windows\System\sWWTNQv.exe
  2⤵
  PID:3344
- C:\Windows\System\PqBajnZ.exe
  C:\Windows\System\PqBajnZ.exe
  2⤵
  PID:3228
- C:\Windows\System\sfAzFsx.exe
  C:\Windows\System\sfAzFsx.exe
  2⤵
  PID:3880
- C:\Windows\System\iPZQKLs.exe
  C:\Windows\System\iPZQKLs.exe
  2⤵
  PID:4120
- C:\Windows\System\TIjCgeK.exe
  C:\Windows\System\TIjCgeK.exe
  2⤵
  PID:1332
- C:\Windows\System\kodOxEG.exe
  C:\Windows\System\kodOxEG.exe
  2⤵
  PID:4628
- C:\Windows\System\KzYAydS.exe
  C:\Windows\System\KzYAydS.exe
  2⤵
  PID:4760
- C:\Windows\System\IjJkjMt.exe
  C:\Windows\System\IjJkjMt.exe
  2⤵
  PID:5160
- C:\Windows\System\iegKLgt.exe
  C:\Windows\System\iegKLgt.exe
  2⤵
  PID:5320
- C:\Windows\System\HULyciX.exe
  C:\Windows\System\HULyciX.exe
  2⤵
  PID:5612
- C:\Windows\System\tmrVHPP.exe
  C:\Windows\System\tmrVHPP.exe
  2⤵
  PID:6092
- C:\Windows\System\IRtBWHb.exe
  C:\Windows\System\IRtBWHb.exe
  2⤵
  PID:5780
- C:\Windows\System\rYFijgg.exe
  C:\Windows\System\rYFijgg.exe
  2⤵
  PID:4696
- C:\Windows\System\kedjiYi.exe
  C:\Windows\System\kedjiYi.exe
  2⤵
  PID:5912
- C:\Windows\System\YBQYXgW.exe
  C:\Windows\System\YBQYXgW.exe
  2⤵
  PID:6056
- C:\Windows\System\OhAbcfG.exe
  C:\Windows\System\OhAbcfG.exe
  2⤵
  PID:5552
- C:\Windows\System\YSYRemM.exe
  C:\Windows\System\YSYRemM.exe
  2⤵
  PID:5900
- C:\Windows\System\hgoMExe.exe
  C:\Windows\System\hgoMExe.exe
  2⤵
  PID:3860
- C:\Windows\System\FzPdDYl.exe
  C:\Windows\System\FzPdDYl.exe
  2⤵
  PID:2072
- C:\Windows\System\RplYSyZ.exe
  C:\Windows\System\RplYSyZ.exe
  2⤵
  PID:4904
- C:\Windows\System\VFzveMl.exe
  C:\Windows\System\VFzveMl.exe
  2⤵
  PID:4568
- C:\Windows\System\TGQPHTY.exe
  C:\Windows\System\TGQPHTY.exe
  2⤵
  PID:5804
- C:\Windows\System\ErNRyyz.exe
  C:\Windows\System\ErNRyyz.exe
  2⤵
  PID:6008
- C:\Windows\System\ZrAHtUS.exe
  C:\Windows\System\ZrAHtUS.exe
  2⤵
  PID:6044
- C:\Windows\System\TruWDGP.exe
  C:\Windows\System\TruWDGP.exe
  2⤵
  PID:4072
- C:\Windows\System\iAGJrTe.exe
  C:\Windows\System\iAGJrTe.exe
  2⤵
  PID:4332
- C:\Windows\System\qHRPNkv.exe
  C:\Windows\System\qHRPNkv.exe
  2⤵
  PID:5648
- C:\Windows\System\EIokMUL.exe
  C:\Windows\System\EIokMUL.exe
  2⤵
  PID:5084
- C:\Windows\System\RKLMfBq.exe
  C:\Windows\System\RKLMfBq.exe
  2⤵
  PID:5224
- C:\Windows\System\wkfKfJv.exe
  C:\Windows\System\wkfKfJv.exe
  2⤵
  PID:3012
- C:\Windows\System\sttpWdx.exe
  C:\Windows\System\sttpWdx.exe
  2⤵
  PID:3884
- C:\Windows\System\OSTiJLE.exe
  C:\Windows\System\OSTiJLE.exe
  2⤵
  PID:888
- C:\Windows\System\tULkbVI.exe
  C:\Windows\System\tULkbVI.exe
  2⤵
  PID:5140
- C:\Windows\System\XLygCgm.exe
  C:\Windows\System\XLygCgm.exe
  2⤵
  PID:2856
- C:\Windows\System\BFREZcM.exe
  C:\Windows\System\BFREZcM.exe
  2⤵
  PID:5144
- C:\Windows\System\ugeoDsK.exe
  C:\Windows\System\ugeoDsK.exe
  2⤵
  PID:5336
- C:\Windows\System\lPJmRFA.exe
  C:\Windows\System\lPJmRFA.exe
  2⤵
  PID:5268
- C:\Windows\System\TpxPEIg.exe
  C:\Windows\System\TpxPEIg.exe
  2⤵
  PID:1740
- C:\Windows\System\WrdApSY.exe
  C:\Windows\System\WrdApSY.exe
  2⤵
  PID:3628
- C:\Windows\System\uERidqC.exe
  C:\Windows\System\uERidqC.exe
  2⤵
  PID:2776
- C:\Windows\System\kTXhbjk.exe
  C:\Windows\System\kTXhbjk.exe
  2⤵
  PID:4040
- C:\Windows\System\JpxRvJA.exe
  C:\Windows\System\JpxRvJA.exe
  2⤵
  PID:3964
- C:\Windows\System\KgIagfv.exe
  C:\Windows\System\KgIagfv.exe
  2⤵
  PID:4412
- C:\Windows\System\JtHirKV.exe
  C:\Windows\System\JtHirKV.exe
  2⤵
  PID:3972
- C:\Windows\System\EjLsuDb.exe
  C:\Windows\System\EjLsuDb.exe
  2⤵
  PID:4508
- C:\Windows\System\UByAOOX.exe
  C:\Windows\System\UByAOOX.exe
  2⤵
  PID:2032
- C:\Windows\System\HrcONUj.exe
  C:\Windows\System\HrcONUj.exe
  2⤵
  PID:4504
- C:\Windows\System\QcGjdzS.exe
  C:\Windows\System\QcGjdzS.exe
  2⤵
  PID:5316
- C:\Windows\System\lJOrrjx.exe
  C:\Windows\System\lJOrrjx.exe
  2⤵
  PID:5392
- C:\Windows\System\JrmLLDS.exe
  C:\Windows\System\JrmLLDS.exe
  2⤵
  PID:5632
- C:\Windows\System\pDoVGNB.exe
  C:\Windows\System\pDoVGNB.exe
  2⤵
  PID:5880
- C:\Windows\System\YdLBiBq.exe
  C:\Windows\System\YdLBiBq.exe
  2⤵
  PID:5948
- C:\Windows\System\hPLExiq.exe
  C:\Windows\System\hPLExiq.exe
  2⤵
  PID:5976
- C:\Windows\System\CqWxuBb.exe
  C:\Windows\System\CqWxuBb.exe
  2⤵
  PID:5204
- C:\Windows\System\xdwefcq.exe
  C:\Windows\System\xdwefcq.exe
  2⤵
  PID:5448
- C:\Windows\System\HkbjPph.exe
  C:\Windows\System\HkbjPph.exe
  2⤵
  PID:1880
- C:\Windows\System\JYjfgzm.exe
  C:\Windows\System\JYjfgzm.exe
  2⤵
  PID:4252
- C:\Windows\System\rfJqdMW.exe
  C:\Windows\System\rfJqdMW.exe
  2⤵
  PID:4588
- C:\Windows\System\XlaPZbM.exe
  C:\Windows\System\XlaPZbM.exe
  2⤵
  PID:5388
- C:\Windows\System\LTheCJr.exe
  C:\Windows\System\LTheCJr.exe
  2⤵
  PID:5376
- C:\Windows\System\mFATbTj.exe
  C:\Windows\System\mFATbTj.exe
  2⤵
  PID:4624
- C:\Windows\System\QqsfwJq.exe
  C:\Windows\System\QqsfwJq.exe
  2⤵
  PID:6156
- C:\Windows\System\uIdziNM.exe
  C:\Windows\System\uIdziNM.exe
  2⤵
  PID:6172
- C:\Windows\System\dkdKjRS.exe
  C:\Windows\System\dkdKjRS.exe
  2⤵
  PID:6188
- C:\Windows\System\nFIytwq.exe
  C:\Windows\System\nFIytwq.exe
  2⤵
  PID:6204
- C:\Windows\System\CagestA.exe
  C:\Windows\System\CagestA.exe
  2⤵
  PID:6224
- C:\Windows\System\XOMRPaY.exe
  C:\Windows\System\XOMRPaY.exe
  2⤵
  PID:6248
- C:\Windows\System\tqZUgec.exe
  C:\Windows\System\tqZUgec.exe
  2⤵
  PID:6264
- C:\Windows\System\wOLouGO.exe
  C:\Windows\System\wOLouGO.exe
  2⤵
  PID:6280
- C:\Windows\System\rrRsxjC.exe
  C:\Windows\System\rrRsxjC.exe
  2⤵
  PID:6300
- C:\Windows\System\CSBQuEH.exe
  C:\Windows\System\CSBQuEH.exe
  2⤵
  PID:6316
- C:\Windows\System\qzVwlYf.exe
  C:\Windows\System\qzVwlYf.exe
  2⤵
  PID:6332
- C:\Windows\System\ugeKgsg.exe
  C:\Windows\System\ugeKgsg.exe
  2⤵
  PID:6352
- C:\Windows\System\AioOTmD.exe
  C:\Windows\System\AioOTmD.exe
  2⤵
  PID:6376
- C:\Windows\System\FwiuGXr.exe
  C:\Windows\System\FwiuGXr.exe
  2⤵
  PID:6392
- C:\Windows\System\axpbMmw.exe
  C:\Windows\System\axpbMmw.exe
  2⤵
  PID:6408
- C:\Windows\System\KDmxsdr.exe
  C:\Windows\System\KDmxsdr.exe
  2⤵
  PID:6428
- C:\Windows\System\EQycvyH.exe
  C:\Windows\System\EQycvyH.exe
  2⤵
  PID:6444
- C:\Windows\System\umPoWEU.exe
  C:\Windows\System\umPoWEU.exe
  2⤵
  PID:6464
- C:\Windows\System\DVFwZzv.exe
  C:\Windows\System\DVFwZzv.exe
  2⤵
  PID:6480
- C:\Windows\System\EoejbVx.exe
  C:\Windows\System\EoejbVx.exe
  2⤵
  PID:6504
- C:\Windows\System\xoIfyiC.exe
  C:\Windows\System\xoIfyiC.exe
  2⤵
  PID:6520
- C:\Windows\System\hbIzaWF.exe
  C:\Windows\System\hbIzaWF.exe
  2⤵
  PID:6536
- C:\Windows\System\lcZNEyt.exe
  C:\Windows\System\lcZNEyt.exe
  2⤵
  PID:6552
- C:\Windows\System\XoEtOom.exe
  C:\Windows\System\XoEtOom.exe
  2⤵
  PID:6576
- C:\Windows\System\XhfwUBo.exe
  C:\Windows\System\XhfwUBo.exe
  2⤵
  PID:6592
- C:\Windows\System\wQQViNI.exe
  C:\Windows\System\wQQViNI.exe
  2⤵
  PID:6612
- C:\Windows\System\MVtIxNi.exe
  C:\Windows\System\MVtIxNi.exe
  2⤵
  PID:6628
- C:\Windows\System\eKCNIhU.exe
  C:\Windows\System\eKCNIhU.exe
  2⤵
  PID:6644
- C:\Windows\System\nwqSfUB.exe
  C:\Windows\System\nwqSfUB.exe
  2⤵
  PID:6664
- C:\Windows\System\mdoelfX.exe
  C:\Windows\System\mdoelfX.exe
  2⤵
  PID:6680
- C:\Windows\System\QkIfURi.exe
  C:\Windows\System\QkIfURi.exe
  2⤵
  PID:6696
- C:\Windows\System\KsoQevb.exe
  C:\Windows\System\KsoQevb.exe
  2⤵
  PID:6712
- C:\Windows\System\ylHgLNa.exe
  C:\Windows\System\ylHgLNa.exe
  2⤵
  PID:6728
- C:\Windows\System\VDxrQEV.exe
  C:\Windows\System\VDxrQEV.exe
  2⤵
  PID:6744
- C:\Windows\System\DiGgeGY.exe
  C:\Windows\System\DiGgeGY.exe
  2⤵
  PID:6764
- C:\Windows\System\BwMFQlk.exe
  C:\Windows\System\BwMFQlk.exe
  2⤵
  PID:6780
- C:\Windows\System\rJInsdh.exe
  C:\Windows\System\rJInsdh.exe
  2⤵
  PID:6796
- C:\Windows\System\rlUfMIe.exe
  C:\Windows\System\rlUfMIe.exe
  2⤵
  PID:6812
- C:\Windows\System\rrHEcER.exe
  C:\Windows\System\rrHEcER.exe
  2⤵
  PID:6828
- C:\Windows\System\iBkZkHc.exe
  C:\Windows\System\iBkZkHc.exe
  2⤵
  PID:6844
- C:\Windows\System\UyhZbvZ.exe
  C:\Windows\System\UyhZbvZ.exe
  2⤵
  PID:6860
- C:\Windows\System\nsVWTHe.exe
  C:\Windows\System\nsVWTHe.exe
  2⤵
  PID:6876
- C:\Windows\System\aCZeOqJ.exe
  C:\Windows\System\aCZeOqJ.exe
  2⤵
  PID:6900
- C:\Windows\System\blSBwzl.exe
  C:\Windows\System\blSBwzl.exe
  2⤵
  PID:6916
- C:\Windows\System\VmHNJFG.exe
  C:\Windows\System\VmHNJFG.exe
  2⤵
  PID:6932
- C:\Windows\System\dVsWGzZ.exe
  C:\Windows\System\dVsWGzZ.exe
  2⤵
  PID:6948
- C:\Windows\System\FzmpqrQ.exe
  C:\Windows\System\FzmpqrQ.exe
  2⤵
  PID:6972
- C:\Windows\System\hZUKGsf.exe
  C:\Windows\System\hZUKGsf.exe
  2⤵
  PID:6988
- C:\Windows\System\DXGeweb.exe
  C:\Windows\System\DXGeweb.exe
  2⤵
  PID:7004
- C:\Windows\System\MHkinYL.exe
  C:\Windows\System\MHkinYL.exe
  2⤵
  PID:7024
- C:\Windows\System\JVOkcFb.exe
  C:\Windows\System\JVOkcFb.exe
  2⤵
  PID:6232
- C:\Windows\System\OpcGaNC.exe
  C:\Windows\System\OpcGaNC.exe
  2⤵
  PID:6272
- C:\Windows\System\ucRvrin.exe
  C:\Windows\System\ucRvrin.exe
  2⤵
  PID:6340
- C:\Windows\System\MfPwOVg.exe
  C:\Windows\System\MfPwOVg.exe
  2⤵
  PID:6388
- C:\Windows\System\KOIPhKt.exe
  C:\Windows\System\KOIPhKt.exe
  2⤵
  PID:4660
- C:\Windows\System\ijCbBMv.exe
  C:\Windows\System\ijCbBMv.exe
  2⤵
  PID:6424
- C:\Windows\System\zzRgSvc.exe
  C:\Windows\System\zzRgSvc.exe
  2⤵
  PID:6456
- C:\Windows\System\tPrEFRP.exe
  C:\Windows\System\tPrEFRP.exe
  2⤵
  PID:6152
- C:\Windows\System\AlBzGCe.exe
  C:\Windows\System\AlBzGCe.exe
  2⤵
  PID:6532
- C:\Windows\System\jCJLwLJ.exe
  C:\Windows\System\jCJLwLJ.exe
  2⤵
  PID:6572
- C:\Windows\System\PESvhBX.exe
  C:\Windows\System\PESvhBX.exe
  2⤵
  PID:6292
- C:\Windows\System\JyRdoCt.exe
  C:\Windows\System\JyRdoCt.exe
  2⤵
  PID:6640
- C:\Windows\System\swtvMYK.exe
  C:\Windows\System\swtvMYK.exe
  2⤵
  PID:6676
- C:\Windows\System\IliSBxh.exe
  C:\Windows\System\IliSBxh.exe
  2⤵
  PID:4644
- C:\Windows\System\qXaqBac.exe
  C:\Windows\System\qXaqBac.exe
  2⤵
  PID:4984
- C:\Windows\System\BVeCXJz.exe
  C:\Windows\System\BVeCXJz.exe
  2⤵
  PID:5528
- C:\Windows\System\lYHlppK.exe
  C:\Windows\System\lYHlppK.exe
  2⤵
  PID:6808
- C:\Windows\System\fjEBkmO.exe
  C:\Windows\System\fjEBkmO.exe
  2⤵
  PID:6216
- C:\Windows\System\yFdXQVI.exe
  C:\Windows\System\yFdXQVI.exe
  2⤵
  PID:6872
- C:\Windows\System\NqtmCrp.exe
  C:\Windows\System\NqtmCrp.exe
  2⤵
  PID:6912
- C:\Windows\System\KNUQlLR.exe
  C:\Windows\System\KNUQlLR.exe
  2⤵
  PID:6980
- C:\Windows\System\khwFyuZ.exe
  C:\Windows\System\khwFyuZ.exe
  2⤵
  PID:6652
- C:\Windows\System\OOhAXuV.exe
  C:\Windows\System\OOhAXuV.exe
  2⤵
  PID:4552
- C:\Windows\System\coBFSYu.exe
  C:\Windows\System\coBFSYu.exe
  2⤵
  PID:6296
- C:\Windows\System\vXWrAAE.exe
  C:\Windows\System\vXWrAAE.exe
  2⤵
  PID:4956
- C:\Windows\System\cKfStdv.exe
  C:\Windows\System\cKfStdv.exe
  2⤵
  PID:5032
- C:\Windows\System\vbKGCTC.exe
  C:\Windows\System\vbKGCTC.exe
  2⤵
  PID:5548
- C:\Windows\System\ZPHxkvT.exe
  C:\Windows\System\ZPHxkvT.exe
  2⤵
  PID:5208
- C:\Windows\System\rPTddWH.exe
  C:\Windows\System\rPTddWH.exe
  2⤵
  PID:5332
- C:\Windows\System\UvWWWdc.exe
  C:\Windows\System\UvWWWdc.exe
  2⤵
  PID:444
- C:\Windows\System\PLAaxgu.exe
  C:\Windows\System\PLAaxgu.exe
  2⤵
  PID:5732
- C:\Windows\System\umQUgpq.exe
  C:\Windows\System\umQUgpq.exe
  2⤵
  PID:5404
- C:\Windows\System\kPDKsfc.exe
  C:\Windows\System\kPDKsfc.exe
  2⤵
  PID:4680
- C:\Windows\System\qengsZy.exe
  C:\Windows\System\qengsZy.exe
  2⤵
  PID:3852
- C:\Windows\System\HryFpUP.exe
  C:\Windows\System\HryFpUP.exe
  2⤵
  PID:4612
- C:\Windows\System\AspMzbD.exe
  C:\Windows\System\AspMzbD.exe
  2⤵
  PID:6516
- C:\Windows\System\ehLnjsu.exe
  C:\Windows\System\ehLnjsu.exe
  2⤵
  PID:6220
- C:\Windows\System\ggVNXcd.exe
  C:\Windows\System\ggVNXcd.exe
  2⤵
  PID:6956
- C:\Windows\System\iJuqDyf.exe
  C:\Windows\System\iJuqDyf.exe
  2⤵
  PID:6720
- C:\Windows\System\dMvmqtN.exe
  C:\Windows\System\dMvmqtN.exe
  2⤵
  PID:6404
- C:\Windows\System\boDXiZJ.exe
  C:\Windows\System\boDXiZJ.exe
  2⤵
  PID:6792
- C:\Windows\System\XkZwbVt.exe
  C:\Windows\System\XkZwbVt.exe
  2⤵
  PID:6856
- C:\Windows\System\OwhjOKx.exe
  C:\Windows\System\OwhjOKx.exe
  2⤵
  PID:6756
- C:\Windows\System\fxznbOC.exe
  C:\Windows\System\fxznbOC.exe
  2⤵
  PID:7048
- C:\Windows\System\umHTzfx.exe
  C:\Windows\System\umHTzfx.exe
  2⤵
  PID:6964
- C:\Windows\System\eaalfEp.exe
  C:\Windows\System\eaalfEp.exe
  2⤵
  PID:7032
- C:\Windows\System\MzzUpsc.exe
  C:\Windows\System\MzzUpsc.exe
  2⤵
  PID:7076
- C:\Windows\System\zQkOxdd.exe
  C:\Windows\System\zQkOxdd.exe
  2⤵
  PID:7124
- C:\Windows\System\XmaMQLn.exe
  C:\Windows\System\XmaMQLn.exe
  2⤵
  PID:7072
- C:\Windows\System\WEPHZZQ.exe
  C:\Windows\System\WEPHZZQ.exe
  2⤵
  PID:7088
- C:\Windows\System\cZMymre.exe
  C:\Windows\System\cZMymre.exe
  2⤵
  PID:7140
- C:\Windows\System\CiThoLv.exe
  C:\Windows\System\CiThoLv.exe
  2⤵
  PID:7156
- C:\Windows\System\rhHcCmI.exe
  C:\Windows\System\rhHcCmI.exe
  2⤵
  PID:6196
- C:\Windows\System\WwbzdYe.exe
  C:\Windows\System\WwbzdYe.exe
  2⤵
  PID:6384
- C:\Windows\System\ZsVIgVZ.exe
  C:\Windows\System\ZsVIgVZ.exe
  2⤵
  PID:6492
- C:\Windows\System\prEphVZ.exe
  C:\Windows\System\prEphVZ.exe
  2⤵
  PID:5716
- C:\Windows\System\daeXTVn.exe
  C:\Windows\System\daeXTVn.exe
  2⤵
  PID:6180
- C:\Windows\System\cKNlZBq.exe
  C:\Windows\System\cKNlZBq.exe
  2⤵
  PID:7012
- C:\Windows\System\WTDZwPE.exe
  C:\Windows\System\WTDZwPE.exe
  2⤵
  PID:6688
- C:\Windows\System\juRruyt.exe
  C:\Windows\System\juRruyt.exe
  2⤵
  PID:2308
- C:\Windows\System\uPIFeWK.exe
  C:\Windows\System\uPIFeWK.exe
  2⤵
  PID:6308
- C:\Windows\System\FDpSbPp.exe
  C:\Windows\System\FDpSbPp.exe
  2⤵
  PID:1064
- C:\Windows\System\CLulTMB.exe
  C:\Windows\System\CLulTMB.exe
  2⤵
  PID:6500
- C:\Windows\System\vbHKRCQ.exe
  C:\Windows\System\vbHKRCQ.exe
  2⤵
  PID:6148
- C:\Windows\System\WzqYsZS.exe
  C:\Windows\System\WzqYsZS.exe
  2⤵
  PID:5848
- C:\Windows\System\VwIRJIj.exe
  C:\Windows\System\VwIRJIj.exe
  2⤵
  PID:6400
- C:\Windows\System\YoqYfjA.exe
  C:\Windows\System\YoqYfjA.exe
  2⤵
  PID:7080
- C:\Windows\System\QWyeQMy.exe
  C:\Windows\System\QWyeQMy.exe
  2⤵
  PID:4108
- C:\Windows\System\KXfkHdc.exe
  C:\Windows\System\KXfkHdc.exe
  2⤵
  PID:7096
- C:\Windows\System\XAFALEp.exe
  C:\Windows\System\XAFALEp.exe
  2⤵
  PID:7160
- C:\Windows\System\TVJmrzM.exe
  C:\Windows\System\TVJmrzM.exe
  2⤵
  PID:6840
- C:\Windows\System\rZMTerx.exe
  C:\Windows\System\rZMTerx.exe
  2⤵
  PID:6564
- C:\Windows\System\BmrRuZq.exe
  C:\Windows\System\BmrRuZq.exe
  2⤵
  PID:6636
- C:\Windows\System\WMxmXIN.exe
  C:\Windows\System\WMxmXIN.exe
  2⤵
  PID:6908
- C:\Windows\System\ofGkcER.exe
  C:\Windows\System\ofGkcER.exe
  2⤵
  PID:6168
- C:\Windows\System\LLEClfN.exe
  C:\Windows\System\LLEClfN.exe
  2⤵
  PID:6364
- C:\Windows\System\HQThdBK.exe
  C:\Windows\System\HQThdBK.exe
  2⤵
  PID:6548
- C:\Windows\System\SOoGMpl.exe
  C:\Windows\System\SOoGMpl.exe
  2⤵
  PID:5868
- C:\Windows\System\MKBrTbB.exe
  C:\Windows\System\MKBrTbB.exe
  2⤵
  PID:6892
- C:\Windows\System\KSrxsCZ.exe
  C:\Windows\System\KSrxsCZ.exe
  2⤵
  PID:3216
- C:\Windows\System\ABlGgrI.exe
  C:\Windows\System\ABlGgrI.exe
  2⤵
  PID:3696
- C:\Windows\System\JDetvNC.exe
  C:\Windows\System\JDetvNC.exe
  2⤵
  PID:6328
- C:\Windows\System\xzJYwRZ.exe
  C:\Windows\System\xzJYwRZ.exe
  2⤵
  PID:6360
- C:\Windows\System\gXXlTUm.exe
  C:\Windows\System\gXXlTUm.exe
  2⤵
  PID:7068
- C:\Windows\System\EPhlyxa.exe
  C:\Windows\System\EPhlyxa.exe
  2⤵
  PID:6944
- C:\Windows\System\clWzcQf.exe
  C:\Windows\System\clWzcQf.exe
  2⤵
  PID:4972
- C:\Windows\System\ZHJPbnv.exe
  C:\Windows\System\ZHJPbnv.exe
  2⤵
  PID:5516
- C:\Windows\System\HxHSZsF.exe
  C:\Windows\System\HxHSZsF.exe
  2⤵
  PID:4444
- C:\Windows\System\UxnXsKH.exe
  C:\Windows\System\UxnXsKH.exe
  2⤵
  PID:4204
- C:\Windows\System\EjzeOnj.exe
  C:\Windows\System\EjzeOnj.exe
  2⤵
  PID:4920
- C:\Windows\System\HrsqEJb.exe
  C:\Windows\System\HrsqEJb.exe
  2⤵
  PID:6776
- C:\Windows\System\VrXSntA.exe
  C:\Windows\System\VrXSntA.exe
  2⤵
  PID:6512
- C:\Windows\System\pdcuzHm.exe
  C:\Windows\System\pdcuzHm.exe
  2⤵
  PID:7064
- C:\Windows\System\rRIZGpX.exe
  C:\Windows\System\rRIZGpX.exe
  2⤵
  PID:6740
- C:\Windows\System\eTPnhcX.exe
  C:\Windows\System\eTPnhcX.exe
  2⤵
  PID:6660
- C:\Windows\System\DdwkCvx.exe
  C:\Windows\System\DdwkCvx.exe
  2⤵
  PID:6472
- C:\Windows\System\xpuLJVz.exe
  C:\Windows\System\xpuLJVz.exe
  2⤵
  PID:6256
- C:\Windows\System\aramlSb.exe
  C:\Windows\System\aramlSb.exe
  2⤵
  PID:6868
- C:\Windows\System\alygibJ.exe
  C:\Windows\System\alygibJ.exe
  2⤵
  PID:7152
- C:\Windows\System\bPqGZvs.exe
  C:\Windows\System\bPqGZvs.exe
  2⤵
  PID:6200
- C:\Windows\System\kqgoUzr.exe
  C:\Windows\System\kqgoUzr.exe
  2⤵
  PID:6788
- C:\Windows\System\kBiveej.exe
  C:\Windows\System\kBiveej.exe
  2⤵
  PID:4188
- C:\Windows\System\whmDDXo.exe
  C:\Windows\System\whmDDXo.exe
  2⤵
  PID:4328
- C:\Windows\System\MCUzOSf.exe
  C:\Windows\System\MCUzOSf.exe
  2⤵
  PID:2012
- C:\Windows\System\qEtUdYe.exe
  C:\Windows\System\qEtUdYe.exe
  2⤵
  PID:7184
- C:\Windows\System\BCPfHyH.exe
  C:\Windows\System\BCPfHyH.exe
  2⤵
  PID:7200
- C:\Windows\System\iwCQxSZ.exe
  C:\Windows\System\iwCQxSZ.exe
  2⤵
  PID:7216
- C:\Windows\System\KFQOurf.exe
  C:\Windows\System\KFQOurf.exe
  2⤵
  PID:7236
- C:\Windows\System\aAVbaCe.exe
  C:\Windows\System\aAVbaCe.exe
  2⤵
  PID:7252
- C:\Windows\System\yKdZlwH.exe
  C:\Windows\System\yKdZlwH.exe
  2⤵
  PID:7268
- C:\Windows\System\aXgnAic.exe
  C:\Windows\System\aXgnAic.exe
  2⤵
  PID:7284
- C:\Windows\System\XgKpxWe.exe
  C:\Windows\System\XgKpxWe.exe
  2⤵
  PID:7300
- C:\Windows\System\OArKRTZ.exe
  C:\Windows\System\OArKRTZ.exe
  2⤵
  PID:7316
- C:\Windows\System\haJcmPJ.exe
  C:\Windows\System\haJcmPJ.exe
  2⤵
  PID:7332
- C:\Windows\System\vRbZwOe.exe
  C:\Windows\System\vRbZwOe.exe
  2⤵
  PID:7348
- C:\Windows\System\fEvBuVO.exe
  C:\Windows\System\fEvBuVO.exe
  2⤵
  PID:7364
- C:\Windows\System\kKyhOIr.exe
  C:\Windows\System\kKyhOIr.exe
  2⤵
  PID:7380
- C:\Windows\System\ylnODIz.exe
  C:\Windows\System\ylnODIz.exe
  2⤵
  PID:7396
- C:\Windows\System\FDClTWw.exe
  C:\Windows\System\FDClTWw.exe
  2⤵
  PID:7412
- C:\Windows\System\SKWkyhJ.exe
  C:\Windows\System\SKWkyhJ.exe
  2⤵
  PID:7428
- C:\Windows\System\EyQnvLk.exe
  C:\Windows\System\EyQnvLk.exe
  2⤵
  PID:7444
- C:\Windows\System\evKKJLo.exe
  C:\Windows\System\evKKJLo.exe
  2⤵
  PID:7460
- C:\Windows\System\pvedqqr.exe
  C:\Windows\System\pvedqqr.exe
  2⤵
  PID:7476
- C:\Windows\System\MVabMAI.exe
  C:\Windows\System\MVabMAI.exe
  2⤵
  PID:7492
- C:\Windows\System\VSAVciS.exe
  C:\Windows\System\VSAVciS.exe
  2⤵
  PID:7508
- C:\Windows\System\lLfkCGG.exe
  C:\Windows\System\lLfkCGG.exe
  2⤵
  PID:7524
- C:\Windows\System\BnjDgWu.exe
  C:\Windows\System\BnjDgWu.exe
  2⤵
  PID:7540
- C:\Windows\System\HqAyOpd.exe
  C:\Windows\System\HqAyOpd.exe
  2⤵
  PID:7556
- C:\Windows\System\aWPOVCJ.exe
  C:\Windows\System\aWPOVCJ.exe
  2⤵
  PID:7572
- C:\Windows\System\FOitksB.exe
  C:\Windows\System\FOitksB.exe
  2⤵
  PID:7588
- C:\Windows\System\lkiJLsS.exe
  C:\Windows\System\lkiJLsS.exe
  2⤵
  PID:7604
- C:\Windows\System\GtqprtW.exe
  C:\Windows\System\GtqprtW.exe
  2⤵
  PID:7620
- C:\Windows\System\IbmGYkf.exe
  C:\Windows\System\IbmGYkf.exe
  2⤵
  PID:7636
- C:\Windows\System\sKdPzYb.exe
  C:\Windows\System\sKdPzYb.exe
  2⤵
  PID:7652
- C:\Windows\System\YRBCKnD.exe
  C:\Windows\System\YRBCKnD.exe
  2⤵
  PID:7668
- C:\Windows\System\vhpSYrI.exe
  C:\Windows\System\vhpSYrI.exe
  2⤵
  PID:7684
- C:\Windows\System\WhOpAYM.exe
  C:\Windows\System\WhOpAYM.exe
  2⤵
  PID:7700
- C:\Windows\System\TVzBHFR.exe
  C:\Windows\System\TVzBHFR.exe
  2⤵
  PID:7716
- C:\Windows\System\kGIVrUs.exe
  C:\Windows\System\kGIVrUs.exe
  2⤵
  PID:7732
- C:\Windows\System\Amdkvgc.exe
  C:\Windows\System\Amdkvgc.exe
  2⤵
  PID:7748
- C:\Windows\System\ngcbKzf.exe
  C:\Windows\System\ngcbKzf.exe
  2⤵
  PID:7764
- C:\Windows\System\wwvNCdb.exe
  C:\Windows\System\wwvNCdb.exe
  2⤵
  PID:7780
- C:\Windows\System\WCILUSA.exe
  C:\Windows\System\WCILUSA.exe
  2⤵
  PID:7796
- C:\Windows\System\pNOUZkp.exe
  C:\Windows\System\pNOUZkp.exe
  2⤵
  PID:7812
- C:\Windows\System\IUkddtx.exe
  C:\Windows\System\IUkddtx.exe
  2⤵
  PID:7828
- C:\Windows\System\hYYtVdD.exe
  C:\Windows\System\hYYtVdD.exe
  2⤵
  PID:7844
- C:\Windows\System\EoPJvvy.exe
  C:\Windows\System\EoPJvvy.exe
  2⤵
  PID:7860
- C:\Windows\System\teFGirQ.exe
  C:\Windows\System\teFGirQ.exe
  2⤵
  PID:7876
- C:\Windows\System\ocNlfro.exe
  C:\Windows\System\ocNlfro.exe
  2⤵
  PID:7892
- C:\Windows\System\HeMkPaT.exe
  C:\Windows\System\HeMkPaT.exe
  2⤵
  PID:7908
- C:\Windows\System\nIPvgIX.exe
  C:\Windows\System\nIPvgIX.exe
  2⤵
  PID:7924
- C:\Windows\System\wxwuZal.exe
  C:\Windows\System\wxwuZal.exe
  2⤵
  PID:7940
- C:\Windows\System\UcNGjXx.exe
  C:\Windows\System\UcNGjXx.exe
  2⤵
  PID:7956
- C:\Windows\System\dadnmSj.exe
  C:\Windows\System\dadnmSj.exe
  2⤵
  PID:7972
- C:\Windows\System\YrYGKkM.exe
  C:\Windows\System\YrYGKkM.exe
  2⤵
  PID:7988
- C:\Windows\System\YBtNnfF.exe
  C:\Windows\System\YBtNnfF.exe
  2⤵
  PID:8004
- C:\Windows\System\lOoInJm.exe
  C:\Windows\System\lOoInJm.exe
  2⤵
  PID:8020
- C:\Windows\System\MDmuEre.exe
  C:\Windows\System\MDmuEre.exe
  2⤵
  PID:8036
- C:\Windows\System\cIKSrLE.exe
  C:\Windows\System\cIKSrLE.exe
  2⤵
  PID:8052
- C:\Windows\System\jkCEjqo.exe
  C:\Windows\System\jkCEjqo.exe
  2⤵
  PID:8068
- C:\Windows\System\FBBBPXU.exe
  C:\Windows\System\FBBBPXU.exe
  2⤵
  PID:8084
- C:\Windows\System\fTMTRIW.exe
  C:\Windows\System\fTMTRIW.exe
  2⤵
  PID:8100
- C:\Windows\System\PChPsrk.exe
  C:\Windows\System\PChPsrk.exe
  2⤵
  PID:8116
- C:\Windows\System\KPRnNmP.exe
  C:\Windows\System\KPRnNmP.exe
  2⤵
  PID:8132
- C:\Windows\System\YZIKuMt.exe
  C:\Windows\System\YZIKuMt.exe
  2⤵
  PID:8148
- C:\Windows\System\ZAlLjgo.exe
  C:\Windows\System\ZAlLjgo.exe
  2⤵
  PID:8164
- C:\Windows\System\KHmOIeg.exe
  C:\Windows\System\KHmOIeg.exe
  2⤵
  PID:8180
- C:\Windows\System\hsbIhgC.exe
  C:\Windows\System\hsbIhgC.exe
  2⤵
  PID:7196
- C:\Windows\System\VJgfuWJ.exe
  C:\Windows\System\VJgfuWJ.exe
  2⤵
  PID:7228
- C:\Windows\System\wWjLaFe.exe
  C:\Windows\System\wWjLaFe.exe
  2⤵
  PID:7292
- C:\Windows\System\IqiRYyG.exe
  C:\Windows\System\IqiRYyG.exe
  2⤵
  PID:7328
- C:\Windows\System\yXwUXnb.exe
  C:\Windows\System\yXwUXnb.exe
  2⤵
  PID:7360
- C:\Windows\System\roVvJnL.exe
  C:\Windows\System\roVvJnL.exe
  2⤵
  PID:7420
- C:\Windows\System\xKATVXG.exe
  C:\Windows\System\xKATVXG.exe
  2⤵
  PID:7208
- C:\Windows\System\knFjFrD.exe
  C:\Windows\System\knFjFrD.exe
  2⤵
  PID:7372
- C:\Windows\System\MTiMGVI.exe
  C:\Windows\System\MTiMGVI.exe
  2⤵
  PID:7244
- C:\Windows\System\dTdHeiZ.exe
  C:\Windows\System\dTdHeiZ.exe
  2⤵
  PID:7276
- C:\Windows\System\iIyWSly.exe
  C:\Windows\System\iIyWSly.exe
  2⤵
  PID:7340
- C:\Windows\System\cwtQmzQ.exe
  C:\Windows\System\cwtQmzQ.exe
  2⤵
  PID:7520
- C:\Windows\System\hXUblOE.exe
  C:\Windows\System\hXUblOE.exe
  2⤵
  PID:7548
- C:\Windows\System\nvvSTbg.exe
  C:\Windows\System\nvvSTbg.exe
  2⤵
  PID:7552
- C:\Windows\System\tTcEXzb.exe
  C:\Windows\System\tTcEXzb.exe
  2⤵
  PID:7580
- C:\Windows\System\dTchXeK.exe
  C:\Windows\System\dTchXeK.exe
  2⤵
  PID:7616
- C:\Windows\System\vUKKfRJ.exe
  C:\Windows\System\vUKKfRJ.exe
  2⤵
  PID:7676
- C:\Windows\System\iryREUD.exe
  C:\Windows\System\iryREUD.exe
  2⤵
  PID:7600
- C:\Windows\System\GGOatXL.exe
  C:\Windows\System\GGOatXL.exe
  2⤵
  PID:7632
- C:\Windows\System\xenaPxO.exe
  C:\Windows\System\xenaPxO.exe
  2⤵
  PID:7664
- C:\Windows\System\pFMdQFm.exe
  C:\Windows\System\pFMdQFm.exe
  2⤵
  PID:7692
- C:\Windows\System\OpXFPqC.exe
  C:\Windows\System\OpXFPqC.exe
  2⤵
  PID:7840
- C:\Windows\System\ccRUHsC.exe
  C:\Windows\System\ccRUHsC.exe
  2⤵
  PID:7824
- C:\Windows\System\zlQfCfl.exe
  C:\Windows\System\zlQfCfl.exe
  2⤵
  PID:7852
- C:\Windows\System\VokSwhH.exe
  C:\Windows\System\VokSwhH.exe
  2⤵
  PID:7884
- C:\Windows\System\WuxiUdG.exe
  C:\Windows\System\WuxiUdG.exe
  2⤵
  PID:7932
- C:\Windows\System\PoYVaZo.exe
  C:\Windows\System\PoYVaZo.exe
  2⤵
  PID:7948
- C:\Windows\System\HLYSGrF.exe
  C:\Windows\System\HLYSGrF.exe
  2⤵
  PID:7980
- C:\Windows\System\NRzrsaJ.exe
  C:\Windows\System\NRzrsaJ.exe
  2⤵
  PID:8028
- C:\Windows\System\rzDEdBQ.exe
  C:\Windows\System\rzDEdBQ.exe
  2⤵
  PID:8064
- C:\Windows\System\UQuUJMr.exe
  C:\Windows\System\UQuUJMr.exe
  2⤵
  PID:8124
- C:\Windows\System\AFukOPg.exe
  C:\Windows\System\AFukOPg.exe
  2⤵
  PID:8188
- C:\Windows\System\MNMwNEL.exe
  C:\Windows\System\MNMwNEL.exe
  2⤵
  PID:7356
- C:\Windows\System\GENDLWN.exe
  C:\Windows\System\GENDLWN.exe
  2⤵
  PID:7180
- C:\Windows\System\RJRxVoa.exe
  C:\Windows\System\RJRxVoa.exe
  2⤵
  PID:7308
- C:\Windows\System\oodCZJA.exe
  C:\Windows\System\oodCZJA.exe
  2⤵
  PID:8172
- C:\Windows\System\ujytrQS.exe
  C:\Windows\System\ujytrQS.exe
  2⤵
  PID:7648
- C:\Windows\System\dqjBWuI.exe
  C:\Windows\System\dqjBWuI.exe
  2⤵
  PID:6528
- C:\Windows\System\SITSFAY.exe
  C:\Windows\System\SITSFAY.exe
  2⤵
  PID:6348
- C:\Windows\System\DDnkeBn.exe
  C:\Windows\System\DDnkeBn.exe
  2⤵
  PID:7564
- C:\Windows\System\JAPDNTx.exe
  C:\Windows\System\JAPDNTx.exe
  2⤵
  PID:8140
- C:\Windows\System\rrYzUWV.exe
  C:\Windows\System\rrYzUWV.exe
  2⤵
  PID:8112
- C:\Windows\System\frgwLPF.exe
  C:\Windows\System\frgwLPF.exe
  2⤵
  PID:7500
- C:\Windows\System\qZFujuI.exe
  C:\Windows\System\qZFujuI.exe
  2⤵
  PID:7808
- C:\Windows\System\zVAJimy.exe
  C:\Windows\System\zVAJimy.exe
  2⤵
  PID:7136
- C:\Windows\System\hkYizPu.exe
  C:\Windows\System\hkYizPu.exe
  2⤵
  PID:7984
- C:\Windows\System\KArXwjO.exe
  C:\Windows\System\KArXwjO.exe
  2⤵
  PID:7264
- C:\Windows\System\lHtKbMm.exe
  C:\Windows\System\lHtKbMm.exe
  2⤵
  PID:7536
- C:\Windows\System\PRInDFJ.exe
  C:\Windows\System\PRInDFJ.exe
  2⤵
  PID:7472
- C:\Windows\System\QgTvbsi.exe
  C:\Windows\System\QgTvbsi.exe
  2⤵
  PID:7176
- C:\Windows\System\slizyqc.exe
  C:\Windows\System\slizyqc.exe
  2⤵
  PID:7760
- C:\Windows\System\wpTzfBp.exe
  C:\Windows\System\wpTzfBp.exe
  2⤵
  PID:8156
- C:\Windows\System\TrDOFQw.exe
  C:\Windows\System\TrDOFQw.exe
  2⤵
  PID:7776
- C:\Windows\System\bOCywJC.exe
  C:\Windows\System\bOCywJC.exe
  2⤵
  PID:7728
- C:\Windows\System\lLpajhz.exe
  C:\Windows\System\lLpajhz.exe
  2⤵
  PID:7900
- C:\Windows\System\ymaTSOP.exe
  C:\Windows\System\ymaTSOP.exe
  2⤵
  PID:7232
- C:\Windows\System\TJzYgbt.exe
  C:\Windows\System\TJzYgbt.exe
  2⤵
  PID:8076
- C:\Windows\System\lCFKjLU.exe
  C:\Windows\System\lCFKjLU.exe
  2⤵
  PID:8048
- C:\Windows\System\iuZdloM.exe
  C:\Windows\System\iuZdloM.exe
  2⤵
  PID:7456
- C:\Windows\System\SaPCJQC.exe
  C:\Windows\System\SaPCJQC.exe
  2⤵
  PID:7916
- C:\Windows\System\UAchDtW.exe
  C:\Windows\System\UAchDtW.exe
  2⤵
  PID:7772
- C:\Windows\System\OwGcLhU.exe
  C:\Windows\System\OwGcLhU.exe
  2⤵
  PID:4824
- C:\Windows\System\droilII.exe
  C:\Windows\System\droilII.exe
  2⤵
  PID:8200
- C:\Windows\System\UKQzsNi.exe
  C:\Windows\System\UKQzsNi.exe
  2⤵
  PID:8216
- C:\Windows\System\faREjTa.exe
  C:\Windows\System\faREjTa.exe
  2⤵
  PID:8232
- C:\Windows\System\bnMBYfQ.exe
  C:\Windows\System\bnMBYfQ.exe
  2⤵
  PID:8248
- C:\Windows\System\WulrFMx.exe
  C:\Windows\System\WulrFMx.exe
  2⤵
  PID:8264
- C:\Windows\System\YzgbWMA.exe
  C:\Windows\System\YzgbWMA.exe
  2⤵
  PID:8280
- C:\Windows\System\EqNnuDi.exe
  C:\Windows\System\EqNnuDi.exe
  2⤵
  PID:8300
- C:\Windows\System\KIYDLFE.exe
  C:\Windows\System\KIYDLFE.exe
  2⤵
  PID:8316
- C:\Windows\System\JIczfSp.exe
  C:\Windows\System\JIczfSp.exe
  2⤵
  PID:8332
- C:\Windows\System\VxfmQUY.exe
  C:\Windows\System\VxfmQUY.exe
  2⤵
  PID:8348
- C:\Windows\System\zVpPioC.exe
  C:\Windows\System\zVpPioC.exe
  2⤵
  PID:8364
- C:\Windows\System\wDPVqRw.exe
  C:\Windows\System\wDPVqRw.exe
  2⤵
  PID:8380
- C:\Windows\System\AhdYepM.exe
  C:\Windows\System\AhdYepM.exe
  2⤵
  PID:8396
- C:\Windows\System\OuWfTUC.exe
  C:\Windows\System\OuWfTUC.exe
  2⤵
  PID:8412
- C:\Windows\System\mvJTqSt.exe
  C:\Windows\System\mvJTqSt.exe
  2⤵
  PID:8428
- C:\Windows\System\nWHHPEE.exe
  C:\Windows\System\nWHHPEE.exe
  2⤵
  PID:8444
- C:\Windows\System\oRZMVil.exe
  C:\Windows\System\oRZMVil.exe
  2⤵
  PID:8460
- C:\Windows\System\JlKSMWW.exe
  C:\Windows\System\JlKSMWW.exe
  2⤵
  PID:8476
- C:\Windows\System\vhBxcrd.exe
  C:\Windows\System\vhBxcrd.exe
  2⤵
  PID:8492
- C:\Windows\System\oCtRTEd.exe
  C:\Windows\System\oCtRTEd.exe
  2⤵
  PID:8508
- C:\Windows\System\ccUflvn.exe
  C:\Windows\System\ccUflvn.exe
  2⤵
  PID:8524
- C:\Windows\System\zUrOpWC.exe
  C:\Windows\System\zUrOpWC.exe
  2⤵
  PID:8540
- C:\Windows\System\yqKNROW.exe
  C:\Windows\System\yqKNROW.exe
  2⤵
  PID:8556
- C:\Windows\System\MPBtBYf.exe
  C:\Windows\System\MPBtBYf.exe
  2⤵
  PID:8572
- C:\Windows\System\MfsPdpM.exe
  C:\Windows\System\MfsPdpM.exe
  2⤵
  PID:8588
- C:\Windows\System\RAmtrjf.exe
  C:\Windows\System\RAmtrjf.exe
  2⤵
  PID:8604
- C:\Windows\System\RFeOtyx.exe
  C:\Windows\System\RFeOtyx.exe
  2⤵
  PID:8620
- C:\Windows\System\WcvntvF.exe
  C:\Windows\System\WcvntvF.exe
  2⤵
  PID:8636
- C:\Windows\System\zcfFYXf.exe
  C:\Windows\System\zcfFYXf.exe
  2⤵
  PID:8652
- C:\Windows\System\KoWDtWk.exe
  C:\Windows\System\KoWDtWk.exe
  2⤵
  PID:8668
- C:\Windows\System\nmEGmGC.exe
  C:\Windows\System\nmEGmGC.exe
  2⤵
  PID:8684
- C:\Windows\System\jhKeizt.exe
  C:\Windows\System\jhKeizt.exe
  2⤵
  PID:8700
- C:\Windows\System\ogfcwKe.exe
  C:\Windows\System\ogfcwKe.exe
  2⤵
  PID:8716
- C:\Windows\System\nPTEgxw.exe
  C:\Windows\System\nPTEgxw.exe
  2⤵
  PID:8732
- C:\Windows\System\jrFnpCz.exe
  C:\Windows\System\jrFnpCz.exe
  2⤵
  PID:8748
- C:\Windows\System\GptwFLd.exe
  C:\Windows\System\GptwFLd.exe
  2⤵
  PID:8764
- C:\Windows\System\pcpoEEb.exe
  C:\Windows\System\pcpoEEb.exe
  2⤵
  PID:8780
- C:\Windows\System\XNtwvvw.exe
  C:\Windows\System\XNtwvvw.exe
  2⤵
  PID:8796
- C:\Windows\System\SErDIYW.exe
  C:\Windows\System\SErDIYW.exe
  2⤵
  PID:8812
- C:\Windows\System\RTpnneO.exe
  C:\Windows\System\RTpnneO.exe
  2⤵
  PID:8828
- C:\Windows\System\DATlNKs.exe
  C:\Windows\System\DATlNKs.exe
  2⤵
  PID:8844
- C:\Windows\System\sJQotzr.exe
  C:\Windows\System\sJQotzr.exe
  2⤵
  PID:8860
- C:\Windows\System\Lmrakgt.exe
  C:\Windows\System\Lmrakgt.exe
  2⤵
  PID:8876
- C:\Windows\System\ZMQaceH.exe
  C:\Windows\System\ZMQaceH.exe
  2⤵
  PID:8892
- C:\Windows\System\eFyEhxn.exe
  C:\Windows\System\eFyEhxn.exe
  2⤵
  PID:8912
- C:\Windows\System\dYcvFme.exe
  C:\Windows\System\dYcvFme.exe
  2⤵
  PID:8928
- C:\Windows\System\TKvmsYa.exe
  C:\Windows\System\TKvmsYa.exe
  2⤵
  PID:8944
- C:\Windows\System\kDtTzEa.exe
  C:\Windows\System\kDtTzEa.exe
  2⤵
  PID:8960
- C:\Windows\System\FrOwqbD.exe
  C:\Windows\System\FrOwqbD.exe
  2⤵
  PID:8976
- C:\Windows\System\SfTyrXT.exe
  C:\Windows\System\SfTyrXT.exe
  2⤵
  PID:8992
- C:\Windows\System\DzqQKeu.exe
  C:\Windows\System\DzqQKeu.exe
  2⤵
  PID:9008
- C:\Windows\System\cFnacYJ.exe
  C:\Windows\System\cFnacYJ.exe
  2⤵
  PID:9024
- C:\Windows\System\trqglze.exe
  C:\Windows\System\trqglze.exe
  2⤵
  PID:9040
- C:\Windows\System\xDcfAmI.exe
  C:\Windows\System\xDcfAmI.exe
  2⤵
  PID:9056
- C:\Windows\System\qPKFlwl.exe
  C:\Windows\System\qPKFlwl.exe
  2⤵
  PID:9072
- C:\Windows\System\qaXocFn.exe
  C:\Windows\System\qaXocFn.exe
  2⤵
  PID:9088
- C:\Windows\System\KQkHodi.exe
  C:\Windows\System\KQkHodi.exe
  2⤵
  PID:9104
- C:\Windows\System\YxOqvwc.exe
  C:\Windows\System\YxOqvwc.exe
  2⤵
  PID:9120
- C:\Windows\System\KSXwRMV.exe
  C:\Windows\System\KSXwRMV.exe
  2⤵
  PID:9136
- C:\Windows\System\BwShRnv.exe
  C:\Windows\System\BwShRnv.exe
  2⤵
  PID:9152
- C:\Windows\System\GYQnpNg.exe
  C:\Windows\System\GYQnpNg.exe
  2⤵
  PID:9168
- C:\Windows\System\fhcqWay.exe
  C:\Windows\System\fhcqWay.exe
  2⤵
  PID:9184
- C:\Windows\System\edXmuWi.exe
  C:\Windows\System\edXmuWi.exe
  2⤵
  PID:9200
- C:\Windows\System\OWvagnr.exe
  C:\Windows\System\OWvagnr.exe
  2⤵
  PID:7408
- C:\Windows\System\MIAStsu.exe
  C:\Windows\System\MIAStsu.exe
  2⤵
  PID:8224
- C:\Windows\System\NrdWkDL.exe
  C:\Windows\System\NrdWkDL.exe
  2⤵
  PID:8288
- C:\Windows\System\eCaJSwe.exe
  C:\Windows\System\eCaJSwe.exe
  2⤵
  PID:8356
- C:\Windows\System\xKMwQwB.exe
  C:\Windows\System\xKMwQwB.exe
  2⤵
  PID:8420
- C:\Windows\System\RNCqXFJ.exe
  C:\Windows\System\RNCqXFJ.exe
  2⤵
  PID:8456
- C:\Windows\System\pQNUcSP.exe
  C:\Windows\System\pQNUcSP.exe
  2⤵
  PID:8520
- C:\Windows\System\PWjhums.exe
  C:\Windows\System\PWjhums.exe
  2⤵
  PID:8584
- C:\Windows\System\CfFLhjq.exe
  C:\Windows\System\CfFLhjq.exe
  2⤵
  PID:8644
- C:\Windows\System\fPEJeLu.exe
  C:\Windows\System\fPEJeLu.exe
  2⤵
  PID:8080
- C:\Windows\System\NHRylTI.exe
  C:\Windows\System\NHRylTI.exe
  2⤵
  PID:8712
- C:\Windows\System\gaOLNpd.exe
  C:\Windows\System\gaOLNpd.exe
  2⤵
  PID:8564
- C:\Windows\System\yBdaCnN.exe
  C:\Windows\System\yBdaCnN.exe
  2⤵
  PID:8344
- C:\Windows\System\kgfidCb.exe
  C:\Windows\System\kgfidCb.exe
  2⤵
  PID:8308
- C:\Windows\System\uTlOzLd.exe
  C:\Windows\System\uTlOzLd.exe
  2⤵
  PID:8632
- C:\Windows\System\DYGJxmh.exe
  C:\Windows\System\DYGJxmh.exe
  2⤵
  PID:8212
- C:\Windows\System\htBkmhO.exe
  C:\Windows\System\htBkmhO.exe
  2⤵
  PID:7820
- C:\Windows\System\qVPaIru.exe
  C:\Windows\System\qVPaIru.exe
  2⤵
  PID:8408
- C:\Windows\System\MnlWQYl.exe
  C:\Windows\System\MnlWQYl.exe
  2⤵
  PID:8440
- C:\Windows\System\QpecEaa.exe
  C:\Windows\System\QpecEaa.exe
  2⤵
  PID:8532
- C:\Windows\System\pqEXnPK.exe
  C:\Windows\System\pqEXnPK.exe
  2⤵
  PID:8728
- C:\Windows\System\XOZIoxj.exe
  C:\Windows\System\XOZIoxj.exe
  2⤵
  PID:8776
- C:\Windows\System\LuSjdYm.exe
  C:\Windows\System\LuSjdYm.exe
  2⤵
  PID:8824
- C:\Windows\System\fctkDhV.exe
  C:\Windows\System\fctkDhV.exe
  2⤵
  PID:8936
- C:\Windows\System\kzhpnfE.exe
  C:\Windows\System\kzhpnfE.exe
  2⤵
  PID:8884
- C:\Windows\System\qCEfpVB.exe
  C:\Windows\System\qCEfpVB.exe
  2⤵
  PID:8952
- C:\Windows\System\nHhiIDU.exe
  C:\Windows\System\nHhiIDU.exe
  2⤵
  PID:8984
- C:\Windows\System\OVjqhMp.exe
  C:\Windows\System\OVjqhMp.exe
  2⤵
  PID:9036
- C:\Windows\System\NKabvgL.exe
  C:\Windows\System\NKabvgL.exe
  2⤵
  PID:9096
- C:\Windows\System\EIildqv.exe
  C:\Windows\System\EIildqv.exe
  2⤵
  PID:9160
- C:\Windows\System\XlFdXnw.exe
  C:\Windows\System\XlFdXnw.exe
  2⤵
  PID:7680
- C:\Windows\System\wJKgGNy.exe
  C:\Windows\System\wJKgGNy.exe
  2⤵
  PID:8324
- C:\Windows\System\yOYkPin.exe
  C:\Windows\System\yOYkPin.exe
  2⤵
  PID:8676
- C:\Windows\System\DOJRFrb.exe
  C:\Windows\System\DOJRFrb.exe
  2⤵
  PID:9144
- C:\Windows\System\bCZyYWm.exe
  C:\Windows\System\bCZyYWm.exe
  2⤵
  PID:9020
- C:\Windows\System\IlpXlRb.exe
  C:\Windows\System\IlpXlRb.exe
  2⤵
  PID:9180
- C:\Windows\System\yPSuPHH.exe
  C:\Windows\System\yPSuPHH.exe
  2⤵
  PID:8680
- C:\Windows\System\fDTQyZa.exe
  C:\Windows\System\fDTQyZa.exe
  2⤵
  PID:9112
- C:\Windows\System\HZHhxmp.exe
  C:\Windows\System\HZHhxmp.exe
  2⤵
  PID:9208
- C:\Windows\System\LSmgjGI.exe
  C:\Windows\System\LSmgjGI.exe
  2⤵
  PID:8488
- C:\Windows\System\iIyuCAh.exe
  C:\Windows\System\iIyuCAh.exe
  2⤵
  PID:8372
- C:\Windows\System\LeUmfHn.exe
  C:\Windows\System\LeUmfHn.exe
  2⤵
  PID:8240
- C:\Windows\System\IwQFKQT.exe
  C:\Windows\System\IwQFKQT.exe
  2⤵
  PID:8016
- C:\Windows\System\KruxcJO.exe
  C:\Windows\System\KruxcJO.exe
  2⤵
  PID:8744
- C:\Windows\System\AedoeOg.exe
  C:\Windows\System\AedoeOg.exe
  2⤵
  PID:8760
- C:\Windows\System\Kvzgqxa.exe
  C:\Windows\System\Kvzgqxa.exe
  2⤵
  PID:8820
- C:\Windows\System\FjDBQjZ.exe
  C:\Windows\System\FjDBQjZ.exe
  2⤵
  PID:8856
- C:\Windows\System\osnlYNV.exe
  C:\Windows\System\osnlYNV.exe
  2⤵
  PID:9000
- C:\Windows\System\FJZAmXF.exe
  C:\Windows\System\FJZAmXF.exe
  2⤵
  PID:8840
- C:\Windows\System\LwvHLCg.exe
  C:\Windows\System\LwvHLCg.exe
  2⤵
  PID:9132
- C:\Windows\System\zwPZBdv.exe
  C:\Windows\System\zwPZBdv.exe
  2⤵
  PID:8972
- C:\Windows\System\dJXNcXv.exe
  C:\Windows\System\dJXNcXv.exe
  2⤵
  PID:9052
- C:\Windows\System\ELWjgbn.exe
  C:\Windows\System\ELWjgbn.exe
  2⤵
  PID:8504
- C:\Windows\System\XYAdsNM.exe
  C:\Windows\System\XYAdsNM.exe
  2⤵
  PID:9128
- C:\Windows\System\LcIIJUW.exe
  C:\Windows\System\LcIIJUW.exe
  2⤵
  PID:1580
- C:\Windows\System\UDtSLLu.exe
  C:\Windows\System\UDtSLLu.exe
  2⤵
  PID:7488
- C:\Windows\System\OoWnTXd.exe
  C:\Windows\System\OoWnTXd.exe
  2⤵
  PID:9224
- C:\Windows\System\PJwffRc.exe
  C:\Windows\System\PJwffRc.exe
  2⤵
  PID:9244
- C:\Windows\System\ZmjMmkU.exe
  C:\Windows\System\ZmjMmkU.exe
  2⤵
  PID:9260
- C:\Windows\System\NxaVhrP.exe
  C:\Windows\System\NxaVhrP.exe
  2⤵
  PID:9276
- C:\Windows\System\IXHeEWR.exe
  C:\Windows\System\IXHeEWR.exe
  2⤵
  PID:9292
- C:\Windows\System\ENqdcKs.exe
  C:\Windows\System\ENqdcKs.exe
  2⤵
  PID:9308
- C:\Windows\System\BoLFWSq.exe
  C:\Windows\System\BoLFWSq.exe
  2⤵
  PID:9324
- C:\Windows\System\vtMNHrq.exe
  C:\Windows\System\vtMNHrq.exe
  2⤵
  PID:9340
- C:\Windows\System\fnWYMLj.exe
  C:\Windows\System\fnWYMLj.exe
  2⤵
  PID:9356
- C:\Windows\System\suIljHz.exe
  C:\Windows\System\suIljHz.exe
  2⤵
  PID:9372
- C:\Windows\System\PIwMDEb.exe
  C:\Windows\System\PIwMDEb.exe
  2⤵
  PID:9388
- C:\Windows\System\UtaHYpH.exe
  C:\Windows\System\UtaHYpH.exe
  2⤵
  PID:9404
- C:\Windows\System\GLBGSYc.exe
  C:\Windows\System\GLBGSYc.exe
  2⤵
  PID:9420
- C:\Windows\System\lnOSteJ.exe
  C:\Windows\System\lnOSteJ.exe
  2⤵
  PID:9436
- C:\Windows\System\svdGyyy.exe
  C:\Windows\System\svdGyyy.exe
  2⤵
  PID:9452
- C:\Windows\System\djidEYj.exe
  C:\Windows\System\djidEYj.exe
  2⤵
  PID:9468
- C:\Windows\System\pCFfmnx.exe
  C:\Windows\System\pCFfmnx.exe
  2⤵
  PID:9484
- C:\Windows\System\mHBJzsq.exe
  C:\Windows\System\mHBJzsq.exe
  2⤵
  PID:9500
- C:\Windows\System\lPBlKeL.exe
  C:\Windows\System\lPBlKeL.exe
  2⤵
  PID:9516
- C:\Windows\System\qTCSgfV.exe
  C:\Windows\System\qTCSgfV.exe
  2⤵
  PID:9532
- C:\Windows\System\UrpgZrV.exe
  C:\Windows\System\UrpgZrV.exe
  2⤵
  PID:9548
- C:\Windows\System\ZLbIccS.exe
  C:\Windows\System\ZLbIccS.exe
  2⤵
  PID:9564
- C:\Windows\System\nveGUrA.exe
  C:\Windows\System\nveGUrA.exe
  2⤵
  PID:9580
- C:\Windows\System\rGdCdwr.exe
  C:\Windows\System\rGdCdwr.exe
  2⤵
  PID:9596
- C:\Windows\System\xvCBKIs.exe
  C:\Windows\System\xvCBKIs.exe
  2⤵
  PID:9612
- C:\Windows\System\galCNAV.exe
  C:\Windows\System\galCNAV.exe
  2⤵
  PID:9628
- C:\Windows\System\fTcYJmu.exe
  C:\Windows\System\fTcYJmu.exe
  2⤵
  PID:9644
- C:\Windows\System\fwOYsBA.exe
  C:\Windows\System\fwOYsBA.exe
  2⤵
  PID:9660
- C:\Windows\System\zCtbxuN.exe
  C:\Windows\System\zCtbxuN.exe
  2⤵
  PID:9692
- C:\Windows\System\gmsQDkP.exe
  C:\Windows\System\gmsQDkP.exe
  2⤵
  PID:9732
- C:\Windows\System\UWvXmbc.exe
  C:\Windows\System\UWvXmbc.exe
  2⤵
  PID:9788
- C:\Windows\System\LItscwX.exe
  C:\Windows\System\LItscwX.exe
  2⤵
  PID:9824
- C:\Windows\System\BPPdEQW.exe
  C:\Windows\System\BPPdEQW.exe
  2⤵
  PID:9892
- C:\Windows\System\xmsqGZo.exe
  C:\Windows\System\xmsqGZo.exe
  2⤵
  PID:10072
- C:\Windows\System\oBgEgVI.exe
  C:\Windows\System\oBgEgVI.exe
  2⤵
  PID:10088
- C:\Windows\System\ZErfZrg.exe
  C:\Windows\System\ZErfZrg.exe
  2⤵
  PID:10104
- C:\Windows\System\weRyjVI.exe
  C:\Windows\System\weRyjVI.exe
  2⤵
  PID:10124
- C:\Windows\System\HjLtSev.exe
  C:\Windows\System\HjLtSev.exe
  2⤵
  PID:10144
- C:\Windows\System\CxMKOdp.exe
  C:\Windows\System\CxMKOdp.exe
  2⤵
  PID:10160
- C:\Windows\System\adUIQgt.exe
  C:\Windows\System\adUIQgt.exe
  2⤵
  PID:10176
- C:\Windows\System\KHVqXKZ.exe
  C:\Windows\System\KHVqXKZ.exe
  2⤵
  PID:10192
- C:\Windows\System\qUAFLMD.exe
  C:\Windows\System\qUAFLMD.exe
  2⤵
  PID:10208
- C:\Windows\System\dysrJDn.exe
  C:\Windows\System\dysrJDn.exe
  2⤵
  PID:10224
- C:\Windows\System\WygGhxg.exe
  C:\Windows\System\WygGhxg.exe
  2⤵
  PID:9032
- C:\Windows\System\VyrPYmg.exe
  C:\Windows\System\VyrPYmg.exe
  2⤵
  PID:8208
- C:\Windows\System\CQYgAkI.exe
  C:\Windows\System\CQYgAkI.exe
  2⤵
  PID:8696
- C:\Windows\System\xwIXSDO.exe
  C:\Windows\System\xwIXSDO.exe
  2⤵
  PID:9268
- C:\Windows\System\nCUnIDN.exe
  C:\Windows\System\nCUnIDN.exe
  2⤵
  PID:9332
- C:\Windows\System\hYqsCGU.exe
  C:\Windows\System\hYqsCGU.exe
  2⤵
  PID:9048
- C:\Windows\System\skJZjbA.exe
  C:\Windows\System\skJZjbA.exe
  2⤵
  PID:8552
- C:\Windows\System\cYyZpUR.exe
  C:\Windows\System\cYyZpUR.exe
  2⤵
  PID:8516
- C:\Windows\System\oXHxvgc.exe
  C:\Windows\System\oXHxvgc.exe
  2⤵
  PID:8924
- C:\Windows\System\JdzXdkD.exe
  C:\Windows\System\JdzXdkD.exe
  2⤵
  PID:9400
- C:\Windows\System\BnHlnda.exe
  C:\Windows\System\BnHlnda.exe
  2⤵
  PID:9464
- C:\Windows\System\fxQmCxN.exe
  C:\Windows\System\fxQmCxN.exe
  2⤵
  PID:9528
- C:\Windows\System\wHErlJy.exe
  C:\Windows\System\wHErlJy.exe
  2⤵
  PID:9592
- C:\Windows\System\XCjNtiq.exe
  C:\Windows\System\XCjNtiq.exe
  2⤵
  PID:9656
- C:\Windows\System\plnsYky.exe
  C:\Windows\System\plnsYky.exe
  2⤵
  PID:8868
- C:\Windows\System\YXuaxri.exe
  C:\Windows\System\YXuaxri.exe
  2⤵
  PID:9284
- C:\Windows\System\FZyzqRl.exe
  C:\Windows\System\FZyzqRl.exe
  2⤵
  PID:9352
- C:\Windows\System\nfrOgZo.exe
  C:\Windows\System\nfrOgZo.exe
  2⤵
  PID:9444
- C:\Windows\System\LwhuTFb.exe
  C:\Windows\System\LwhuTFb.exe
  2⤵
  PID:9540
- C:\Windows\System\LQDRpcO.exe
  C:\Windows\System\LQDRpcO.exe
  2⤵
  PID:9668
- C:\Windows\System\yBlWOFN.exe
  C:\Windows\System\yBlWOFN.exe
  2⤵
  PID:9684
- C:\Windows\System\ptIBPuH.exe
  C:\Windows\System\ptIBPuH.exe
  2⤵
  PID:9220
- C:\Windows\System\nIstTwZ.exe
  C:\Windows\System\nIstTwZ.exe
  2⤵
  PID:9544
- C:\Windows\System\SzpTaYH.exe
  C:\Windows\System\SzpTaYH.exe
  2⤵
  PID:9740
- C:\Windows\System\bAXhxvh.exe
  C:\Windows\System\bAXhxvh.exe
  2⤵
  PID:9772
- C:\Windows\System\HTRaVpR.exe
  C:\Windows\System\HTRaVpR.exe
  2⤵
  PID:9724
- C:\Windows\System\cpCEfZV.exe
  C:\Windows\System\cpCEfZV.exe
  2⤵
  PID:9716
- C:\Windows\System\MBoYqGb.exe
  C:\Windows\System\MBoYqGb.exe
  2⤵
  PID:9804
- C:\Windows\System\glQymvE.exe
  C:\Windows\System\glQymvE.exe
  2⤵
  PID:9812
- C:\Windows\System\uDtawrA.exe
  C:\Windows\System\uDtawrA.exe
  2⤵
  PID:9848
- C:\Windows\System\rdxayFq.exe
  C:\Windows\System\rdxayFq.exe
  2⤵
  PID:9864
- C:\Windows\System\nzLLLcV.exe
  C:\Windows\System\nzLLLcV.exe
  2⤵
  PID:9832
- C:\Windows\System\LooIlIU.exe
  C:\Windows\System\LooIlIU.exe
  2⤵
  PID:9916
- C:\Windows\System\PBvmtqO.exe
  C:\Windows\System\PBvmtqO.exe
  2⤵
  PID:9928
- C:\Windows\System\fkRenZm.exe
  C:\Windows\System\fkRenZm.exe
  2⤵
  PID:9944
- C:\Windows\System\NGTcLTd.exe
  C:\Windows\System\NGTcLTd.exe
  2⤵
  PID:9960
- C:\Windows\System\bpRHXFG.exe
  C:\Windows\System\bpRHXFG.exe
  2⤵
  PID:9976
- C:\Windows\System\YXEgsgA.exe
  C:\Windows\System\YXEgsgA.exe
  2⤵
  PID:9992
- C:\Windows\System\UNzPqPB.exe
  C:\Windows\System\UNzPqPB.exe
  2⤵
  PID:10008
- C:\Windows\System\xQMqmrt.exe
  C:\Windows\System\xQMqmrt.exe
  2⤵
  PID:10024
- C:\Windows\System\OmVGTGh.exe
  C:\Windows\System\OmVGTGh.exe
  2⤵
  PID:10036
- C:\Windows\System\GXwppbo.exe
  C:\Windows\System\GXwppbo.exe
  2⤵
  PID:10040
- C:\Windows\System\UCquLPy.exe
  C:\Windows\System\UCquLPy.exe
  2⤵
  PID:10096
- C:\Windows\System\SHXhbrk.exe
  C:\Windows\System\SHXhbrk.exe
  2⤵
  PID:10112
- C:\Windows\System\zWwETmT.exe
  C:\Windows\System\zWwETmT.exe
  2⤵
  PID:10136
- C:\Windows\System\SISycQP.exe
  C:\Windows\System\SISycQP.exe
  2⤵
  PID:8436
- C:\Windows\System\CQIlgYX.exe
  C:\Windows\System\CQIlgYX.exe
  2⤵
  PID:9232
- C:\Windows\System\Wkhwnje.exe
  C:\Windows\System\Wkhwnje.exe
  2⤵
  PID:8660
- C:\Windows\System\TuVzoqz.exe
  C:\Windows\System\TuVzoqz.exe
  2⤵
  PID:10204
- C:\Windows\System\oUlpNjb.exe
  C:\Windows\System\oUlpNjb.exe
  2⤵
  PID:9560
- C:\Windows\System\biWVZUg.exe
  C:\Windows\System\biWVZUg.exe
  2⤵
  PID:9316
- C:\Windows\System\jCfAefB.exe
  C:\Windows\System\jCfAefB.exe
  2⤵
  PID:9300
- C:\Windows\System\eQOjOiP.exe
  C:\Windows\System\eQOjOiP.exe
  2⤵
  PID:9252
- C:\Windows\System\MSBqKlo.exe
  C:\Windows\System\MSBqKlo.exe
  2⤵
  PID:8788
- C:\Windows\System\vYxnBbb.exe
  C:\Windows\System\vYxnBbb.exe
  2⤵
  PID:9412
- C:\Windows\System\RnEkdue.exe
  C:\Windows\System\RnEkdue.exe
  2⤵
  PID:8956
- C:\Windows\System\FWFbdDt.exe
  C:\Windows\System\FWFbdDt.exe
  2⤵
  PID:10232
- C:\Windows\System\HTRydRf.exe
  C:\Windows\System\HTRydRf.exe
  2⤵
  PID:9384
- C:\Windows\System\oVbxrYI.exe
  C:\Windows\System\oVbxrYI.exe
  2⤵
  PID:9760
- C:\Windows\System\DMNQHce.exe
  C:\Windows\System\DMNQHce.exe
  2⤵
  PID:9856
- C:\Windows\System\TZkqbBG.exe
  C:\Windows\System\TZkqbBG.exe
  2⤵
  PID:9936
- C:\Windows\System\LjxYfbY.exe
  C:\Windows\System\LjxYfbY.exe
  2⤵
  PID:10000
- C:\Windows\System\FXLLHPi.exe
  C:\Windows\System\FXLLHPi.exe
  2⤵
  PID:10060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CSdsMuT.exe

Filesize
1.9MB

MD5
e17da6b9b3bdd766fdadb3296d344357

SHA1
5cf8bad692bb873ef684ea22d4d4b913e92f9b1f

SHA256
be1c820ebab2fc6736fb73cb554a9e4eaedac29c72f4c02a7e16ef88c862e8bf

SHA512
4e71721fc444e3903f6585b2c3914336bb2bbf596b700020c960a2d8bb18b1bcbf040e9861fe86fd7f6197327e19edf1acbbcceba4dbd3aa6b04e02c3fada15a

Download Submit
C:\Windows\system\JfqPGaq.exe

Filesize
1.9MB

MD5
b81cdc3486f231d869def43e186588e8

SHA1
6d15c4399ff0f867a7f2a8b9607bc09aa9c5f1ee

SHA256
b56ecd5af05e4463362dcef6aacb3d89079f3b28618e0f706c4d12633881ee8d

SHA512
069761b506cfe145d64b7a5fd6b0aec16ff1ffe515db033987f85f40f9c09011747756a66d3fd0829986c6ce13a6def6c72929bcfbfbee322f0b19f580964299

Download Submit
C:\Windows\system\JirRrwy.exe

Filesize
1.9MB

MD5
93a16dc02156e1d970f826abe05b3fc6

SHA1
acbd18bbbf9b34fcdc292df7fac54189ef71e961

SHA256
ac7b4a154553565361371b066cee921c27ee43244b40530381250d64a5801f1a

SHA512
8b2f5a21ba94e15bf868cfad4671be8b45f34804dfeda7f3e67b423bd362a074453b998239d4e9d1c2d4d027c61108ffd27f3a00e386d8f63a25a0d997732370

Download Submit
C:\Windows\system\KJTseMe.exe

Filesize
1.9MB

MD5
763cdddf2b8c49a24440761188b3f96e

SHA1
b6e63d02e9aed5a4a51b6841e08bc4b1aee99ecc

SHA256
8db561446dd09a11cc620594e63085f3a42c57a79e482cc82765d4925e25716d

SHA512
75a652dfd8046e89d034932c6beff0428364e911e0cf006e6d2aca470bbab9cd80127443b757e024e97391438205750a948567be9be81cce3b89c5d7eed3b835

Download Submit
C:\Windows\system\LDjGwGe.exe

Filesize
1.9MB

MD5
ea0b1f988c295a1ff540069b2e8f3287

SHA1
73591449451b5ef791b1044b0c2b6a4eedd2a327

SHA256
49660cb88705387e3012b2d3d69d94ca7af5faa9c83dc3d2b267f4a68705dd72

SHA512
b02c45ac3619e4804c4f46cf2094caeb6fbd9dcb82520f45569e156fd3b3ec105d36fc29b5d3ab69bb1632a33f79ee136ac9cc6771687beda8d3788713809877

Download Submit
C:\Windows\system\LVVOFYh.exe

Filesize
1.9MB

MD5
30a49ecd04548554762ef5f1dd1779ed

SHA1
a8114371156843dc649df5934dd38186d79a583b

SHA256
c9f300a90b0ae21e55f6eb0454f8e50bb7532963a31e10a82ef78fcfcbda7829

SHA512
bf99c9f390dcff40f5621d3b6e34cba26e6d524c17fc518a4f4efc7cd2c151f692e1cf651098be626da55af75c91f3084e800397bf45ee1b40d563b0ce9889df

Download Submit
C:\Windows\system\OSmBEqh.exe

Filesize
1.9MB

MD5
b486fbb5859dc2a25669aff8c92b3284

SHA1
c01a223d691325f9dfe7523b6ceb3667ba9877ed

SHA256
fc010b5ed9c05f23bb142798ddac266143d5b40750a4928afa647df09ff73621

SHA512
6b60fd37da2d355fa16247f3ea3597c5de397d700fac1f226781553dcf2706d77663ebd7b8634da9f39d20eb381a8c7253a0f4326dd29bcebaf93c8dccd414f2

Download Submit
C:\Windows\system\UsDpEXL.exe

Filesize
1.9MB

MD5
96947c21356d62b0efe5e1c23020cd80

SHA1
476b27fe8e44e1dca2cc1842fe441b01138ea970

SHA256
0872fab2ecffd6cc0edd675aa9d760cad2fb62140bc5d52c7bcad7f81a33c43e

SHA512
7d27c86377d452cc9aed0afc7714727ced6110432ec1e8d7031712b6a9456dbda12c022f83aa31ec86f17091f5921f5faa48354caed42689e3864bb2887c7b98

Download Submit
C:\Windows\system\UxPJLws.exe

Filesize
1.9MB

MD5
396ee5bd1ad20c021596e891fb5695a7

SHA1
6a8a446ec5427a4d171835a401eaa462255d9358

SHA256
2f2a102e37ecd08fda22bc30c426b26276b37ee30b2d691854dcab8dab228dec

SHA512
f7c1a1156f0ce005f80fe4504824bf0c626c610679ee5ec7d295fe9ead01395d4820c3d03d1c22249c8b15c74a37cce14ddf65593fcb74cd3630013d471ab1c2

Download Submit
C:\Windows\system\VCBPeSe.exe

Filesize
1.9MB

MD5
710d413f87e88684b3d2fff8f3e50739

SHA1
917a611b29dd6e978c6411b61a4a50d7c752199d

SHA256
4cc0b1c3a0692bf24040a3f703a53a5724a64e30566873376eb81c364814fda6

SHA512
5e0a2e0ac948e4a0d0e9d7d40af4bd92959c5b008d364e0c81976f4b6e1a377ab7d13494e1a837afb574cebc4015d57f50b628b913f8aa2070510313176687b0

Download Submit
C:\Windows\system\VFkJwBc.exe

Filesize
1.9MB

MD5
c9bad4c9d239a6b5415447f346b6fa74

SHA1
a2ca2d84d954cdd782fb5ff74786bf438ccaee22

SHA256
c7678b3ce49866f90332589b73bab228aad1295a7917f5987ba2f91cbdffe680

SHA512
bb61e97c5eb44299d6a2913926f462e63b2cfa17f2a1f53393d1518b675ac8140669b0fa01cc39093bb2ccd44c1084b40f63c4f2c5e145df431bb3a33ff583ca

Download Submit
C:\Windows\system\XhjHxvX.exe

Filesize
1.9MB

MD5
27a204d68fe4239e114db560260c98b1

SHA1
ec31bc690da7279fed31bd775a38363545e7245f

SHA256
e9b6925b2a0d6ef473d1d4d2dbb768a2ef39c153b5f2ccd75b337144d2a36e38

SHA512
88696f1205112650c5993c2940aa0f4a784afd030a796e54ae6e3943f36fd46fb3f65a41ee742bb0adfcb7075a86514394447ae4bd5c63886a720a279269f01d

Download Submit
C:\Windows\system\XlpuOPU.exe

Filesize
1.9MB

MD5
dcc31ca04a729dce3fbe5f29a56e1a8e

SHA1
1a0449584d1deaa2cbd9a7d4552ff57f770f4ee3

SHA256
cb9af725fbfe901b8f54e9339831cd188e7c41c0f4548395969f0f0182176c57

SHA512
fd18f6e6c2d15f7c1b7828989ebdea88d1d59e75f1f966727403c1601a8f819fd94d4a5843697d325dfdd448500934b9bdce7ea8c885b4f188ea3f64be4e4e45

Download Submit
C:\Windows\system\aeOxqzf.exe

Filesize
1.9MB

MD5
467872fe1f478f962bceebdf88f1e510

SHA1
9a6704ad128e1444a69d86d9357d6a236d5f9000

SHA256
a40021f5bb05bc27fc8145c48b0ce0b5c238c977fdfc7c325133997640b78606

SHA512
848a32bee921a033811a44e721719b6293cd6d9397c368217ac2245a8dd566b1cbe414122ec19ed238055a91c38b283a3d388315502f0a9542af36585c6b5979

Download Submit
C:\Windows\system\aruZVXy.exe

Filesize
1.9MB

MD5
791a9829f1105e4cd9cd735e49e7635d

SHA1
1680ab7f36caac8647ec395e01b63519fd3c8e6f

SHA256
08ddd576c1592496d2c3e92b7f9f779ed8e16a10e4d93dab25774737b3e5dbfa

SHA512
dbb9c05011caa9fcfb4c5317a5392b4c9e6b3b192811a665a68b5ecbbb12c2aa3c3b77065fe84b71e953895e6676717b05d308823d7456b54f3447358bdb23a9

Download Submit
C:\Windows\system\azfzorK.exe

Filesize
1.9MB

MD5
5af88ac572567010023d3b332746c68d

SHA1
b0368d2c4cc7a7cc5db5345c24d896dc4d898b61

SHA256
920c3d8ea11a40c98c20a9ffd3b954b7fca21e89c57fcd946353e00ccf78712d

SHA512
e2dd62f86749fd74db8a67a09d89efbfa03667f7b73f9d2f61bab4550b3b5fde99752dd00f1021cd23fa87f60643d995c7c6b6983023602274b28f706e291ca4

Download Submit
C:\Windows\system\cfROCqn.exe

Filesize
1.9MB

MD5
f6b5f37ece5f33a1fc47e50afccea8bf

SHA1
b1b699459f94302b56934ff00482a0d2a1f52563

SHA256
1dee88c4de8f377c467c473c44f865a824ed2d3895bb05070ac02311e85a477b

SHA512
5a1790f6871023d36285abd858e12c2449bd0d998767a3c61101c53bf560f84e7ad8c4e497d8d60d5d70986abe5755775a5cd03ce67fe94ecc77eba3e0948cec

Download Submit
C:\Windows\system\eClnhJn.exe

Filesize
1.9MB

MD5
c655e6919febe9fe660620c36c2a7f2a

SHA1
e7a2b410836c7ef2024e63b34430999fbbba28ab

SHA256
87f5d38ae6f81d4f988ff2d2a207033aa63d81d9e106d6e617e3d8e20ef3fc02

SHA512
ee08acc9a2134913fc17dd689136f48a99c287d31c53a4578fdd3f443b1af91d8bbd00382aae20121d8abe27595518fef000e44f21c3b37c6f317d75158b8bca

Download Submit
C:\Windows\system\hLKHEIJ.exe

Filesize
1.9MB

MD5
d3a49dc2aaddbcb6a27856a22835b78e

SHA1
c9463a8af34afa3b687f40e95ea7e946525cdaa8

SHA256
2b289902e9e48c89f7b0fa9a6dc57e66af25f87af55f5d3572dd6470295793fb

SHA512
6ccf77ea5fbd1cec43ef3ea9d332fbd9d70496ff466053df58551b3f4a2a0e6d980fdcc0d5d85944311e6c6539ac4330d68e7a57fd54d23cb7fa8650b9ba02b2

Download Submit
C:\Windows\system\kCpGWSa.exe

Filesize
1.9MB

MD5
f3aff3dfb569d660752fbfc905df649c

SHA1
09d50c9d1bdbf49fe1407f32e36f95880cc76fe1

SHA256
e40d9e7e285aa78ac8e4a1e374e77af3476651cb031ccb93d2f091abb2795ff6

SHA512
588665e186319f649d57e5c11b849c7c25801aa7a6508af90cb265d40300ad63aa0164572b842a2879ec5bf5e590d277a5a2082ab702dd435b96dd7d338a5611

Download Submit
C:\Windows\system\kQGIVbF.exe

Filesize
1.9MB

MD5
e15bd2aae9a76628b47f85518ba74489

SHA1
ee05a997337d8ea6463aad4131fe0dc92ad67587

SHA256
7a18c85c21b79ede7252913536d43f5bc6e0fa676ca32a2fe85f7391bfae9900

SHA512
dc0bee3e58db97454526d43344c0fd7690af4d265c043b3bda0e781d49f8b43e4227ee8bca3277962e07fd1c34bf4ddb6aaf644feb454583a8fdaa1f8e2e40a9

Download Submit
C:\Windows\system\lutkDtB.exe

Filesize
1.9MB

MD5
83ab83feaec5e054c851fa5f1edb4f23

SHA1
251c1eacffbb342ed5fb14ffa2a510db0d70d998

SHA256
cdfe93feac1ddb085b649e521be273d8b687be19489b7b2d68875fd5e5065eea

SHA512
b8ae4a86ebaf7fd7a77db546f5a8b01fac3a83442a3cff2556c4f931ec84ab5bbf022774bd2a23064aa1b43b0d43fbeea827036548f3a00d030cab08e46fe2fe

Download Submit
C:\Windows\system\maUsQVj.exe

Filesize
1.9MB

MD5
2bcc12648c63f2e277dcd9fa4ef12005

SHA1
677b498910d5722d79cbb8ee16f974e8543c0de8

SHA256
7145772402e70f2ae55dd5e2c4494dba9f586a14583b68445383b03ffebacbe6

SHA512
f22373c3b1deb53bdf913e43b192528e16d73f80d6aff349d07ffe726a52d35e6bcf8f40f0432b807de3b068fa4054f36ee76f158f361f45328764bfa8dd7f6f

Download Submit
C:\Windows\system\nXiXGoc.exe

Filesize
1.9MB

MD5
66c958b1fb116c4f729b654d9aa5ffc5

SHA1
f0e85ffb8e52a6bec0279b4821f48e46a1c7e122

SHA256
01380f6112f673db9668bda38bc2b72fa8c8dffc149394ec1e7037610cb31f5f

SHA512
2d26e7b3edb0f6e4ae0e09584008ade6d3a9a75033dfd856a02c6c3279e901aac714bcd41b13567a5aa91ac51129a79f00f61f7c3c89ef1267fc9e8d1b73bb9c

Download Submit
C:\Windows\system\pNwpcet.exe

Filesize
1.9MB

MD5
01eb14e4530113c39b72da2cc9228d7d

SHA1
f76a1b424b4e6c881c8846fda0ae8e3c693511e2

SHA256
3f5d70b171afbb958e4b22ea04fa738d99f39eaa0073c7d1762a18e8233faec0

SHA512
490f16104139c40c6f7f4588cca32e78449949d127d6da2f7e18bb3fe00031c4563a4e8cf2c218d7fc5336a7032d0fc2fa3594b525bac34f147a2e90057b58cf

Download Submit
C:\Windows\system\wuJcRpj.exe

Filesize
1.9MB

MD5
b573d06d120c17a391ea8b3450c8512d

SHA1
523829821d0c0b11ca3efbd404d7df14b90e72cf

SHA256
5314d1cc141abad338e1abe33bac0ae16e634a9a3df3f52edcc865b8a725b00a

SHA512
9c478cdb3ea406e595e3a81e6cda56038fccdce9b79f43051d632964188f3e458cb365e077abc3e0fbdd80f3dcdd303b80b3796e7dd2b3fd2cbc9661d51046b6

Download Submit
C:\Windows\system\xUeKeTT.exe

Filesize
1.9MB

MD5
83d8727a8bae3ba283e72bb632c4a22b

SHA1
2600abd55a4b77df509a461c2f7e116df94d5a48

SHA256
4aec5eeb4b3a4f53bd4872e62da192b724a63018a587c13120885fb0d3858f48

SHA512
07cfe6ceeb2731c9420bd35c6c1eee6d9fa57c7892484853e841be5568cefbb04d3e38a8fa40e0b83be540a5e07863d0771ce8adf7aebf328351f3ab929e7f74

Download Submit
\Windows\system\IsJeuOR.exe

Filesize
1.9MB

MD5
7fab39bb4fc32df8b8ab82e3d403c402

SHA1
a25f264c76498cc7c2af77da713fb5a502b50fce

SHA256
1e7e55c628dd9c9b8d8da56fe4c5dd40dac6bf9ba1ee28f22766729a5e6beeb2

SHA512
8ac757c8be147a99ef23cf55fa905d45baa96426cebeb292eda85765b6540297c66fb1984b50c81c2e213cc9b8dcdc8f56d6f3e3a1a83a06fa1a58bef3e15d26

Download Submit
\Windows\system\JZLcMtA.exe

Filesize
1.9MB

MD5
f81831d117de96f54c5a65107893cf6a

SHA1
c41720441e9c91ab8faf6630c8b93ad10fd57faf

SHA256
06a350c7c1771e0c1a161b2b722410d736591217f4c7c48b8d583cb6bea145e8

SHA512
841b57d813318cba7b04422424faac8ea1d25fcf22a7615cfcae2fa8ef6019d7306d3a9381493d10738cff9a9a20f857dc06318bc73717825b0d2de5d952d2f0

Download Submit
\Windows\system\SgDJiEJ.exe

Filesize
1.9MB

MD5
ad54954607ac4f3be8fba262184eb517

SHA1
dc6528950b7b068db43081bb0cc64cb69290f44c

SHA256
5f7c2a98c43ab570ac5ceaf98305e5eb7beed14d3792739a8888b3b5b29d05a3

SHA512
494c6c7fb0d7798d3bd9e70047912140cce638c0fb3e485e80394abc2fb92109cd4006d436fc42d75a8b0c18d791cab3a1973b812ae4cfc36d9b37e90ab91170

Download Submit
\Windows\system\TkPerXH.exe

Filesize
1.9MB

MD5
77801ac017d2164028576fc87152fe2e

SHA1
bf97941e467deea3ae4cd6b8620be92b12c8e21b

SHA256
d70b888bccfa8c71a84b5ec034b24799ae713a48b9185b948c8a047e104c9256

SHA512
b0222a78ae3881c6ee7abe074a6f832e9ec80f84756b183a623e596830dc05f3c1ebdf87f60719a764f6d47f71bdd82b8d24c0882a300ee1bd03045576b56c27

Download Submit
\Windows\system\UMZZFeL.exe

Filesize
1.9MB

MD5
b3aa22c4996ba7661a5466b1c77532b2

SHA1
80096de6a02eea983038a0a8f3b7a80fcc726bde

SHA256
7d85c0689ea7eb37a8dd12dd3800ac42445735f164380c172498c01c0ae29e97

SHA512
66224b316ab5c9874c9d509fabd230679ad45e868d66a3b30b28745d11af24f1e5c6b7d5cdb2fb583dff12695747919cd6b22145176f8bbf0310e1838536c1ca

Download Submit
\Windows\system\kHkyetZ.exe

Filesize
1.9MB

MD5
fa392f32f3ce7400f2641bd9db8befcc

SHA1
874c8e8920457431f0a794aea2f2a56e79004913

SHA256
75a95b63fe80a0555aa049c6f422a61a6ca55dab6902e4c4147ec4a6fb811d9f

SHA512
50121cf6e212225354c4638f8d479cc2344a0fc5ddc157997ee803fd4cb86642f900637ad181a2c952bc044434805ba74c567e14d7197c08def03b1fca7b4ce2

Download Submit
\Windows\system\pLPYFuz.exe

Filesize
1.9MB

MD5
0f649abcd9ae2ef8521376730f1922fd

SHA1
900193ec85f922637c6e554ed33bce4df6b48a59

SHA256
50d304b8c53c81c6a227e48229da4ba23b555c98ed8bbb8a0252b8288c364aac

SHA512
ab23074b677a6eed2a4c57ae90bceb3ef6a4cf81ff8a71835e228dd6d8a615e44dafb9566e0e47fee5bbc535c6d87cf418f204a9198cdb3ff044bdafec8bfe64

Download Submit
\Windows\system\pSNlLlh.exe

Filesize
1.9MB

MD5
b9ba23f001b36a55a3d52167da897956

SHA1
4c5ed05f50991df6804ce413518429d3593f5b59

SHA256
ff0731e74c185c8f3c088cbae45c41a9ef15b2337351ba2e01d37ea3b645d2a4

SHA512
7ab03ed6dfbeb4ad04026a0f91cb2b94fa3435f45462ea91bdfc507e9d7e17c26ef90683863b6956d4790b43040534d4610c9dbb89187276b7002c237577c636

Download Submit
\Windows\system\vojklcr.exe

Filesize
1.9MB

MD5
f78f2942b7c6ebcb50f2613a2c529e36

SHA1
b429442981e28bb57a4100686d3d7947339bc1a4

SHA256
f79adf8a7f03cbb3f389f3c11e284a74f2cc478641222ecb9cf78a77e5dd9197

SHA512
0a0bde0979dfd28888a79a8e3895cb60a931c550fe13ec33eb4514f588f7fac9a5100f9bf3eddb2abfc1419ab6e609618788afdd853d0632c07d27520c7a88ea

Download Submit
\Windows\system\yODeLYk.exe

Filesize
1.9MB

MD5
95a277e8ecbc8c96099ee1e8e9fbae39

SHA1
7b8a0a7a2980cf2174493a9636071e62a06f8315

SHA256
07c532f43e8063ed6f6084c38779790b523c2ac9ca5b7817a9b9c9ebad6e0dcc

SHA512
087d66683e6d34e8fdc894e11f039263759aec08a5e2c822f98b2d78fb8eade5bac3da2cb797bf5ace37b16a66ebdf095a7eb4ce5b6bb421df8fea6f7435e54d

Download Submit
memory/1272-4616-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/1272-522-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/1440-4632-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/1440-548-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/1856-4600-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/1856-526-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2292-4607-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2292-546-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2508-4594-0x000000013F3A0000-0x000000013F792000-memory.dmp

Filesize
3.9MB

Download
memory/2508-468-0x000000013F3A0000-0x000000013F792000-memory.dmp

Filesize
3.9MB

Download
memory/2532-4591-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/2532-404-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/2556-425-0x000000013F090000-0x000000013F482000-memory.dmp

Filesize
3.9MB

Download
memory/2568-519-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/2568-4597-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/2628-365-0x000000013F8D0000-0x000000013FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/2628-4663-0x000000013F8D0000-0x000000013FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/2656-897-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp

Filesize
9.6MB

Download
memory/2656-95-0x0000000001E10000-0x0000000001E18000-memory.dmp

Filesize
32KB

Download
memory/2656-324-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp

Filesize
9.6MB

Download
memory/2656-341-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp

Filesize
9.6MB

Download
memory/2656-14-0x000007FEF5A8E000-0x000007FEF5A8F000-memory.dmp

Filesize
4KB

Download
memory/2656-94-0x000000001B750000-0x000000001BA32000-memory.dmp

Filesize
2.9MB

Download
memory/2716-4618-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2716-530-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2756-383-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/2820-9-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/2852-463-0x0000000002FE0000-0x00000000033D2000-memory.dmp

Filesize
3.9MB

Download
memory/2852-524-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2852-8-0x0000000002FE0000-0x00000000033D2000-memory.dmp

Filesize
3.9MB

Download
memory/2852-405-0x000000013F090000-0x000000013F482000-memory.dmp

Filesize
3.9MB

Download
memory/2852-1-0x00000000003F0000-0x0000000000400000-memory.dmp

Filesize
64KB

Download
memory/2852-520-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2852-0-0x000000013F6A0000-0x000000013FA92000-memory.dmp

Filesize
3.9MB

Download
memory/2852-373-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/2852-516-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/2852-531-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2852-547-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/2852-528-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2852-549-0x0000000002FE0000-0x00000000033D2000-memory.dmp

Filesize
3.9MB

Download
memory/2852-393-0x0000000002FE0000-0x00000000033D2000-memory.dmp

Filesize
3.9MB

Download
memory/2852-5523-0x0000000002FE0000-0x00000000033D2000-memory.dmp

Filesize
3.9MB

Download
memory/2852-5733-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2852-5739-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/2852-5737-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2852-5735-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2852-5717-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2852-5555-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/2852-5548-0x0000000002FE0000-0x00000000033D2000-memory.dmp

Filesize
3.9MB

Download
memory/2852-5544-0x000000013F090000-0x000000013F482000-memory.dmp

Filesize
3.9MB

Download
memory/2852-5768-0x0000000002FE0000-0x00000000033D2000-memory.dmp

Filesize
3.9MB

Download