xmrig | 6976f75a5d03245619d1cf76029841c0a7596a3e13ec8aea5ff2a7b0063cf1bb

Analysis

max time kernel
83s
max time network
117s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12/09/2024, 18:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e6e33ab2926ef82ffd641a2b1e47af80N.exe
Size

1.9MB
MD5

e6e33ab2926ef82ffd641a2b1e47af80
SHA1

4ad36884a5c74cf73b1e2f9a8a605f593b099cee
SHA256

6976f75a5d03245619d1cf76029841c0a7596a3e13ec8aea5ff2a7b0063cf1bb
SHA512

cc0417e166dcaa6a51a51637cfad5458045cc2615c97e1c314bb5b7d709b4e0beb05380a6d596eb9672e4ff2d8575d1222fe021d327e7e0f4b9a270ab8224c50
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjpbc8nJwbomvu2Nrlum7+a7EtLgCPimz+:Lz071uv4BPMkHC0IBcAUNRSa7kj5zo3b

Score

10^/10

xmrig execution miner persistence privilege_escalation upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 25 IoCs

miner

resource	yara_rule
behavioral1/memory/2704-13-0x000000013F110000-0x000000013F502000-memory.dmp	xmrig
behavioral1/memory/2896-379-0x000000013F840000-0x000000013FC32000-memory.dmp	xmrig
behavioral1/memory/2720-1031-0x000000013F530000-0x000000013F922000-memory.dmp	xmrig
behavioral1/memory/2488-635-0x000000013FA00000-0x000000013FDF2000-memory.dmp	xmrig
behavioral1/memory/2108-217-0x000000013FA20000-0x000000013FE12000-memory.dmp	xmrig
behavioral1/memory/3044-105-0x000000013F1F0000-0x000000013F5E2000-memory.dmp	xmrig
behavioral1/memory/2692-97-0x000000013F930000-0x000000013FD22000-memory.dmp	xmrig
behavioral1/memory/2580-96-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	xmrig
behavioral1/memory/2640-94-0x000000013F040000-0x000000013F432000-memory.dmp	xmrig
behavioral1/memory/2644-92-0x000000013FCB0000-0x00000001400A2000-memory.dmp	xmrig
behavioral1/memory/2800-91-0x000000013F040000-0x000000013F432000-memory.dmp	xmrig
behavioral1/memory/2720-77-0x000000013F530000-0x000000013F922000-memory.dmp	xmrig
behavioral1/memory/2716-58-0x000000013FC40000-0x0000000140032000-memory.dmp	xmrig
behavioral1/memory/2800-28-0x000000013F040000-0x000000013F432000-memory.dmp	xmrig
behavioral1/memory/2704-5070-0x000000013F110000-0x000000013F502000-memory.dmp	xmrig
behavioral1/memory/2640-5164-0x000000013F040000-0x000000013F432000-memory.dmp	xmrig
behavioral1/memory/2800-5165-0x000000013F040000-0x000000013F432000-memory.dmp	xmrig
behavioral1/memory/3044-5159-0x000000013F1F0000-0x000000013F5E2000-memory.dmp	xmrig
behavioral1/memory/2716-5154-0x000000013FC40000-0x0000000140032000-memory.dmp	xmrig
behavioral1/memory/2580-5151-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	xmrig
behavioral1/memory/2896-5170-0x000000013F840000-0x000000013FC32000-memory.dmp	xmrig
behavioral1/memory/2108-5186-0x000000013FA20000-0x000000013FE12000-memory.dmp	xmrig
behavioral1/memory/2692-5192-0x000000013F930000-0x000000013FD22000-memory.dmp	xmrig
behavioral1/memory/2644-5191-0x000000013FCB0000-0x00000001400A2000-memory.dmp	xmrig
behavioral1/memory/2680-7328-0x000000013FDA0000-0x0000000140192000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2816	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2704	jEIRiit.exe
2800	ftfTOWJ.exe
2716	aVNCEkW.exe
2580	nMCKZup.exe
2692	mJgABPH.exe
2644	xAdCgqx.exe
3044	vcmkCjc.exe
2108	CIvwBZL.exe
2896	RsRTpfo.exe
2488	NEOLTfp.exe
2640	tGyuhXo.exe
2680	nInRwdL.exe
3020	BqtpDeb.exe
1152	SUippxj.exe
1436	zTAhVqR.exe
1456	lpPWADw.exe
1100	NfIwsRB.exe
984	dfRtIaY.exe
2964	CVHuYie.exe
2080	kTioljg.exe
2416	zUoqhUx.exe
2956	wAvXDyg.exe
2228	tiTOdlp.exe
592	kFnTcuv.exe
1788	jyUYOYb.exe
1696	ChApmrh.exe
1476	pxDEAjl.exe
2188	HDoflkS.exe
2184	IOcUlaD.exe
1912	CAjLtyO.exe
952	MlqkPQY.exe
1684	kidjCyO.exe
1200	VBUcSYj.exe
2252	XiqHyna.exe
1164	NxcdXrc.exe
2660	iWOVYeD.exe
1964	mCWxRiD.exe
912	cLjFdbx.exe
548	IDhACja.exe
948	SBNUDge.exe
680	KKCHzlg.exe
2296	jtXgguT.exe
2336	GmqdUFB.exe
2140	hCDullr.exe
292	zIiPAkl.exe
1988	RLCcpKD.exe
2200	giafjtr.exe
2516	coaKrCg.exe
1924	hGBmWcz.exe
656	fOjCfwu.exe
1744	MjjjeeX.exe
356	yHmWTsh.exe
1836	CMZaRAX.exe
2168	uiKlyhE.exe
2940	HhqWqWl.exe
1608	SEZjsax.exe
1604	yMvZPTI.exe
2960	rDBhlFe.exe
2696	MNPViUt.exe
2820	DuPlwgq.exe
2808	YSsCsFf.exe
2700	urAmuop.exe
2712	bWqVvju.exe
272	aOWztVp.exe

Loads dropped DLL 64 IoCs

pid	Process
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2720-0-0x000000013F530000-0x000000013F922000-memory.dmp	upx
behavioral1/files/0x000700000001211b-6.dat	upx
behavioral1/memory/2704-13-0x000000013F110000-0x000000013F502000-memory.dmp	upx
behavioral1/files/0x0008000000016141-17.dat	upx
behavioral1/files/0x0007000000016a83-32.dat	upx
behavioral1/files/0x0009000000016578-22.dat	upx
behavioral1/files/0x000700000001683c-38.dat	upx
behavioral1/files/0x0007000000004e74-37.dat	upx
behavioral1/files/0x0007000000016c4b-56.dat	upx
behavioral1/files/0x0009000000016c65-65.dat	upx
behavioral1/files/0x0006000000016dcf-76.dat	upx
behavioral1/files/0x000600000001756a-137.dat	upx
behavioral1/files/0x0005000000019244-181.dat	upx
behavioral1/memory/2896-379-0x000000013F840000-0x000000013FC32000-memory.dmp	upx
behavioral1/memory/2720-1031-0x000000013F530000-0x000000013F922000-memory.dmp	upx
behavioral1/memory/2488-635-0x000000013FA00000-0x000000013FDF2000-memory.dmp	upx
behavioral1/memory/2108-217-0x000000013FA20000-0x000000013FE12000-memory.dmp	upx
behavioral1/files/0x000500000001924a-185.dat	upx
behavioral1/files/0x00050000000191f1-177.dat	upx
behavioral1/files/0x00050000000191dc-173.dat	upx
behavioral1/files/0x0006000000018bc8-169.dat	upx
behavioral1/files/0x0005000000018712-165.dat	upx
behavioral1/files/0x000500000001870f-161.dat	upx
behavioral1/files/0x0005000000018701-157.dat	upx
behavioral1/files/0x00050000000186f7-153.dat	upx
behavioral1/files/0x0008000000018681-149.dat	upx
behavioral1/files/0x0006000000018660-145.dat	upx
behavioral1/files/0x00060000000175ed-141.dat	upx
behavioral1/files/0x00060000000174f5-133.dat	upx
behavioral1/files/0x00060000000174af-129.dat	upx
behavioral1/files/0x00060000000174a8-125.dat	upx
behavioral1/files/0x00060000000173de-121.dat	upx
behavioral1/files/0x00060000000173c8-117.dat	upx
behavioral1/files/0x00060000000173c2-113.dat	upx
behavioral1/files/0x0006000000016fb3-109.dat	upx
behavioral1/memory/3044-105-0x000000013F1F0000-0x000000013F5E2000-memory.dmp	upx
behavioral1/memory/2680-104-0x000000013FDA0000-0x0000000140192000-memory.dmp	upx
behavioral1/files/0x0006000000016e9f-101.dat	upx
behavioral1/memory/2692-97-0x000000013F930000-0x000000013FD22000-memory.dmp	upx
behavioral1/memory/2580-96-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	upx
behavioral1/memory/2640-94-0x000000013F040000-0x000000013F432000-memory.dmp	upx
behavioral1/memory/2644-92-0x000000013FCB0000-0x00000001400A2000-memory.dmp	upx
behavioral1/memory/2800-91-0x000000013F040000-0x000000013F432000-memory.dmp	upx
behavioral1/files/0x0006000000016ddf-88.dat	upx
behavioral1/memory/2488-79-0x000000013FA00000-0x000000013FDF2000-memory.dmp	upx
behavioral1/memory/2720-77-0x000000013F530000-0x000000013F922000-memory.dmp	upx
behavioral1/memory/2896-72-0x000000013F840000-0x000000013FC32000-memory.dmp	upx
behavioral1/memory/2108-67-0x000000013FA20000-0x000000013FE12000-memory.dmp	upx
behavioral1/files/0x0031000000015f61-70.dat	upx
behavioral1/memory/3044-61-0x000000013F1F0000-0x000000013F5E2000-memory.dmp	upx
behavioral1/memory/2716-58-0x000000013FC40000-0x0000000140032000-memory.dmp	upx
behavioral1/memory/2644-48-0x000000013FCB0000-0x00000001400A2000-memory.dmp	upx
behavioral1/memory/2692-44-0x000000013F930000-0x000000013FD22000-memory.dmp	upx
behavioral1/memory/2580-43-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	upx
behavioral1/memory/2800-28-0x000000013F040000-0x000000013F432000-memory.dmp	upx
behavioral1/memory/2704-5070-0x000000013F110000-0x000000013F502000-memory.dmp	upx
behavioral1/memory/2640-5164-0x000000013F040000-0x000000013F432000-memory.dmp	upx
behavioral1/memory/2800-5165-0x000000013F040000-0x000000013F432000-memory.dmp	upx
behavioral1/memory/3044-5159-0x000000013F1F0000-0x000000013F5E2000-memory.dmp	upx
behavioral1/memory/2716-5154-0x000000013FC40000-0x0000000140032000-memory.dmp	upx
behavioral1/memory/2580-5151-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	upx
behavioral1/memory/2896-5170-0x000000013F840000-0x000000013FC32000-memory.dmp	upx
behavioral1/memory/2108-5186-0x000000013FA20000-0x000000013FE12000-memory.dmp	upx
behavioral1/memory/2692-5192-0x000000013F930000-0x000000013FD22000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\KtzwDmh.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\luuVmix.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\lTXbOJP.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\JFAApia.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\eKBOYxd.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\lkQxFKJ.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\QLmttBh.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\OsKDRLe.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\ClNlfnr.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\nzeYuCe.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\fGKnNDN.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\KuPJWPq.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\nXvsLKQ.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\OZPeNGl.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\dgQNvrq.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\EpUzUza.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\FcAyUIL.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\LRshQwO.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\BzANcNh.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\siBCYsr.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\RsRTpfo.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\OKcRbcN.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\PxsBQsz.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\XPvTlFh.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\ZoLkmQl.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\qsMbZXs.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\eWDFxvj.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\IMiCSCA.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\PuHTUQg.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\fsbYZqL.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\CXfzcjO.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\BxYaaIL.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\xYcHdfB.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\JAkrYbi.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\GIgyJlW.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\RFXwPbV.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\wfcRSnM.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\OScbieH.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\CSMBIOP.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\RxdkISU.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\AgMFxLS.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\VbakXSF.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\UvWcdnY.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\XogBGox.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\FrMjdAW.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\tycpCTX.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\IfwIyyQ.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\NNhnVrY.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\erzvEXA.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\mAxiPYH.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\dzVXZAU.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\PgmEYCw.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\VYoBqNy.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\ZpbFJAc.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\mnJADHs.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\cfDNoXB.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\ENjfElX.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\twjYRjA.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\ojGECiD.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\SMxICJV.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\pcVCuch.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\TCRTaCd.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\uotFUDP.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe
File created	C:\Windows\System\XLVVdIe.exe	e6e33ab2926ef82ffd641a2b1e47af80N.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2816	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
Token: SeLockMemoryPrivilege	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe
Token: SeDebugPrivilege	2816	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 2816	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	31
PID 2720 wrote to memory of 2816	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	31
PID 2720 wrote to memory of 2816	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	31
PID 2720 wrote to memory of 2704	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	32
PID 2720 wrote to memory of 2704	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	32
PID 2720 wrote to memory of 2704	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	32
PID 2720 wrote to memory of 2800	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	33
PID 2720 wrote to memory of 2800	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	33
PID 2720 wrote to memory of 2800	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	33
PID 2720 wrote to memory of 2716	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	34
PID 2720 wrote to memory of 2716	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	34
PID 2720 wrote to memory of 2716	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	34
PID 2720 wrote to memory of 2692	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	35
PID 2720 wrote to memory of 2692	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	35
PID 2720 wrote to memory of 2692	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	35
PID 2720 wrote to memory of 2580	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	36
PID 2720 wrote to memory of 2580	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	36
PID 2720 wrote to memory of 2580	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	36
PID 2720 wrote to memory of 2644	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	37
PID 2720 wrote to memory of 2644	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	37
PID 2720 wrote to memory of 2644	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	37
PID 2720 wrote to memory of 3044	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	38
PID 2720 wrote to memory of 3044	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	38
PID 2720 wrote to memory of 3044	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	38
PID 2720 wrote to memory of 2108	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	39
PID 2720 wrote to memory of 2108	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	39
PID 2720 wrote to memory of 2108	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	39
PID 2720 wrote to memory of 2896	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	40
PID 2720 wrote to memory of 2896	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	40
PID 2720 wrote to memory of 2896	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	40
PID 2720 wrote to memory of 2488	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	41
PID 2720 wrote to memory of 2488	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	41
PID 2720 wrote to memory of 2488	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	41
PID 2720 wrote to memory of 2640	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	42
PID 2720 wrote to memory of 2640	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	42
PID 2720 wrote to memory of 2640	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	42
PID 2720 wrote to memory of 2680	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	43
PID 2720 wrote to memory of 2680	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	43
PID 2720 wrote to memory of 2680	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	43
PID 2720 wrote to memory of 3020	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	44
PID 2720 wrote to memory of 3020	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	44
PID 2720 wrote to memory of 3020	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	44
PID 2720 wrote to memory of 1152	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	45
PID 2720 wrote to memory of 1152	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	45
PID 2720 wrote to memory of 1152	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	45
PID 2720 wrote to memory of 1436	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	46
PID 2720 wrote to memory of 1436	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	46
PID 2720 wrote to memory of 1436	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	46
PID 2720 wrote to memory of 1456	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	47
PID 2720 wrote to memory of 1456	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	47
PID 2720 wrote to memory of 1456	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	47
PID 2720 wrote to memory of 1100	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	48
PID 2720 wrote to memory of 1100	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	48
PID 2720 wrote to memory of 1100	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	48
PID 2720 wrote to memory of 984	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	49
PID 2720 wrote to memory of 984	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	49
PID 2720 wrote to memory of 984	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	49
PID 2720 wrote to memory of 2964	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	50
PID 2720 wrote to memory of 2964	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	50
PID 2720 wrote to memory of 2964	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	50
PID 2720 wrote to memory of 2080	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	51
PID 2720 wrote to memory of 2080	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	51
PID 2720 wrote to memory of 2080	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	51
PID 2720 wrote to memory of 2416	2720	e6e33ab2926ef82ffd641a2b1e47af80N.exe	52

C:\Users\Admin\AppData\Local\Temp\e6e33ab2926ef82ffd641a2b1e47af80N.exe
"C:\Users\Admin\AppData\Local\Temp\e6e33ab2926ef82ffd641a2b1e47af80N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2816
- C:\Windows\System\jEIRiit.exe
  C:\Windows\System\jEIRiit.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\ftfTOWJ.exe
  C:\Windows\System\ftfTOWJ.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\aVNCEkW.exe
  C:\Windows\System\aVNCEkW.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\mJgABPH.exe
  C:\Windows\System\mJgABPH.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\nMCKZup.exe
  C:\Windows\System\nMCKZup.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\xAdCgqx.exe
  C:\Windows\System\xAdCgqx.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\vcmkCjc.exe
  C:\Windows\System\vcmkCjc.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\CIvwBZL.exe
  C:\Windows\System\CIvwBZL.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\RsRTpfo.exe
  C:\Windows\System\RsRTpfo.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\NEOLTfp.exe
  C:\Windows\System\NEOLTfp.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\tGyuhXo.exe
  C:\Windows\System\tGyuhXo.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\nInRwdL.exe
  C:\Windows\System\nInRwdL.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\BqtpDeb.exe
  C:\Windows\System\BqtpDeb.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\SUippxj.exe
  C:\Windows\System\SUippxj.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\zTAhVqR.exe
  C:\Windows\System\zTAhVqR.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\lpPWADw.exe
  C:\Windows\System\lpPWADw.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\NfIwsRB.exe
  C:\Windows\System\NfIwsRB.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\dfRtIaY.exe
  C:\Windows\System\dfRtIaY.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\CVHuYie.exe
  C:\Windows\System\CVHuYie.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\kTioljg.exe
  C:\Windows\System\kTioljg.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\zUoqhUx.exe
  C:\Windows\System\zUoqhUx.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\wAvXDyg.exe
  C:\Windows\System\wAvXDyg.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\tiTOdlp.exe
  C:\Windows\System\tiTOdlp.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\kFnTcuv.exe
  C:\Windows\System\kFnTcuv.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\jyUYOYb.exe
  C:\Windows\System\jyUYOYb.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\ChApmrh.exe
  C:\Windows\System\ChApmrh.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\pxDEAjl.exe
  C:\Windows\System\pxDEAjl.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\HDoflkS.exe
  C:\Windows\System\HDoflkS.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\IOcUlaD.exe
  C:\Windows\System\IOcUlaD.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\CAjLtyO.exe
  C:\Windows\System\CAjLtyO.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\MlqkPQY.exe
  C:\Windows\System\MlqkPQY.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\kidjCyO.exe
  C:\Windows\System\kidjCyO.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\VBUcSYj.exe
  C:\Windows\System\VBUcSYj.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\XiqHyna.exe
  C:\Windows\System\XiqHyna.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\NxcdXrc.exe
  C:\Windows\System\NxcdXrc.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\iWOVYeD.exe
  C:\Windows\System\iWOVYeD.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\mCWxRiD.exe
  C:\Windows\System\mCWxRiD.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\cLjFdbx.exe
  C:\Windows\System\cLjFdbx.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\IDhACja.exe
  C:\Windows\System\IDhACja.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\SBNUDge.exe
  C:\Windows\System\SBNUDge.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\KKCHzlg.exe
  C:\Windows\System\KKCHzlg.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\jtXgguT.exe
  C:\Windows\System\jtXgguT.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\GmqdUFB.exe
  C:\Windows\System\GmqdUFB.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\hCDullr.exe
  C:\Windows\System\hCDullr.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\zIiPAkl.exe
  C:\Windows\System\zIiPAkl.exe
  2⤵
  - Executes dropped EXE
  PID:292
- C:\Windows\System\RLCcpKD.exe
  C:\Windows\System\RLCcpKD.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\giafjtr.exe
  C:\Windows\System\giafjtr.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\coaKrCg.exe
  C:\Windows\System\coaKrCg.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\hGBmWcz.exe
  C:\Windows\System\hGBmWcz.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\fOjCfwu.exe
  C:\Windows\System\fOjCfwu.exe
  2⤵
  - Executes dropped EXE
  PID:656
- C:\Windows\System\MjjjeeX.exe
  C:\Windows\System\MjjjeeX.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\yHmWTsh.exe
  C:\Windows\System\yHmWTsh.exe
  2⤵
  - Executes dropped EXE
  PID:356
- C:\Windows\System\CMZaRAX.exe
  C:\Windows\System\CMZaRAX.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\uiKlyhE.exe
  C:\Windows\System\uiKlyhE.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\HhqWqWl.exe
  C:\Windows\System\HhqWqWl.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\SEZjsax.exe
  C:\Windows\System\SEZjsax.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\yMvZPTI.exe
  C:\Windows\System\yMvZPTI.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\rDBhlFe.exe
  C:\Windows\System\rDBhlFe.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\MNPViUt.exe
  C:\Windows\System\MNPViUt.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\DuPlwgq.exe
  C:\Windows\System\DuPlwgq.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\YSsCsFf.exe
  C:\Windows\System\YSsCsFf.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\urAmuop.exe
  C:\Windows\System\urAmuop.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\bWqVvju.exe
  C:\Windows\System\bWqVvju.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\aOWztVp.exe
  C:\Windows\System\aOWztVp.exe
  2⤵
  - Executes dropped EXE
  PID:272
- C:\Windows\System\QrrXLWi.exe
  C:\Windows\System\QrrXLWi.exe
  2⤵
  PID:536
- C:\Windows\System\UTdxdGP.exe
  C:\Windows\System\UTdxdGP.exe
  2⤵
  PID:2076
- C:\Windows\System\sAACvYj.exe
  C:\Windows\System\sAACvYj.exe
  2⤵
  PID:2888
- C:\Windows\System\SZzqQdz.exe
  C:\Windows\System\SZzqQdz.exe
  2⤵
  PID:1520
- C:\Windows\System\GYhKKsN.exe
  C:\Windows\System\GYhKKsN.exe
  2⤵
  PID:788
- C:\Windows\System\hjRHyPe.exe
  C:\Windows\System\hjRHyPe.exe
  2⤵
  PID:2044
- C:\Windows\System\hDTGItr.exe
  C:\Windows\System\hDTGItr.exe
  2⤵
  PID:1756
- C:\Windows\System\JPWnkoF.exe
  C:\Windows\System\JPWnkoF.exe
  2⤵
  PID:2104
- C:\Windows\System\NufzPdC.exe
  C:\Windows\System\NufzPdC.exe
  2⤵
  PID:2428
- C:\Windows\System\sMlYEQf.exe
  C:\Windows\System\sMlYEQf.exe
  2⤵
  PID:2824
- C:\Windows\System\vmYlEcy.exe
  C:\Windows\System\vmYlEcy.exe
  2⤵
  PID:1224
- C:\Windows\System\TpvVbki.exe
  C:\Windows\System\TpvVbki.exe
  2⤵
  PID:800
- C:\Windows\System\Lunmeor.exe
  C:\Windows\System\Lunmeor.exe
  2⤵
  PID:2412
- C:\Windows\System\iNgLsjd.exe
  C:\Windows\System\iNgLsjd.exe
  2⤵
  PID:1548
- C:\Windows\System\sLWzXJg.exe
  C:\Windows\System\sLWzXJg.exe
  2⤵
  PID:2000
- C:\Windows\System\Jkvpcgp.exe
  C:\Windows\System\Jkvpcgp.exe
  2⤵
  PID:1960
- C:\Windows\System\FhZuLBP.exe
  C:\Windows\System\FhZuLBP.exe
  2⤵
  PID:2352
- C:\Windows\System\lKECihA.exe
  C:\Windows\System\lKECihA.exe
  2⤵
  PID:904
- C:\Windows\System\VDGfMDf.exe
  C:\Windows\System\VDGfMDf.exe
  2⤵
  PID:1620
- C:\Windows\System\guYpUXk.exe
  C:\Windows\System\guYpUXk.exe
  2⤵
  PID:1940
- C:\Windows\System\zgLQwsa.exe
  C:\Windows\System\zgLQwsa.exe
  2⤵
  PID:2060
- C:\Windows\System\qundAhn.exe
  C:\Windows\System\qundAhn.exe
  2⤵
  PID:2324
- C:\Windows\System\iZeCWBD.exe
  C:\Windows\System\iZeCWBD.exe
  2⤵
  PID:3000
- C:\Windows\System\RqHwCgf.exe
  C:\Windows\System\RqHwCgf.exe
  2⤵
  PID:352
- C:\Windows\System\hPhqwkk.exe
  C:\Windows\System\hPhqwkk.exe
  2⤵
  PID:1528
- C:\Windows\System\tbOqeEe.exe
  C:\Windows\System\tbOqeEe.exe
  2⤵
  PID:2588
- C:\Windows\System\OTcqzQf.exe
  C:\Windows\System\OTcqzQf.exe
  2⤵
  PID:2476
- C:\Windows\System\pYCkjdA.exe
  C:\Windows\System\pYCkjdA.exe
  2⤵
  PID:2348
- C:\Windows\System\gLWoDXC.exe
  C:\Windows\System\gLWoDXC.exe
  2⤵
  PID:1700
- C:\Windows\System\udXvQiL.exe
  C:\Windows\System\udXvQiL.exe
  2⤵
  PID:2944
- C:\Windows\System\fsWWUzl.exe
  C:\Windows\System\fsWWUzl.exe
  2⤵
  PID:2948
- C:\Windows\System\pVyYthY.exe
  C:\Windows\System\pVyYthY.exe
  2⤵
  PID:2632
- C:\Windows\System\ULTlNPB.exe
  C:\Windows\System\ULTlNPB.exe
  2⤵
  PID:2804
- C:\Windows\System\nMRplze.exe
  C:\Windows\System\nMRplze.exe
  2⤵
  PID:2176
- C:\Windows\System\WfkZdPz.exe
  C:\Windows\System\WfkZdPz.exe
  2⤵
  PID:1276
- C:\Windows\System\cUZOCjU.exe
  C:\Windows\System\cUZOCjU.exe
  2⤵
  PID:812
- C:\Windows\System\eognrLj.exe
  C:\Windows\System\eognrLj.exe
  2⤵
  PID:1496
- C:\Windows\System\WdLZKTQ.exe
  C:\Windows\System\WdLZKTQ.exe
  2⤵
  PID:2468
- C:\Windows\System\qfYytLc.exe
  C:\Windows\System\qfYytLc.exe
  2⤵
  PID:2560
- C:\Windows\System\PYJuBnT.exe
  C:\Windows\System\PYJuBnT.exe
  2⤵
  PID:2424
- C:\Windows\System\FFfQaoh.exe
  C:\Windows\System\FFfQaoh.exe
  2⤵
  PID:3088
- C:\Windows\System\wcKkTOx.exe
  C:\Windows\System\wcKkTOx.exe
  2⤵
  PID:3104
- C:\Windows\System\osLWMQU.exe
  C:\Windows\System\osLWMQU.exe
  2⤵
  PID:3120
- C:\Windows\System\IRivFmZ.exe
  C:\Windows\System\IRivFmZ.exe
  2⤵
  PID:3136
- C:\Windows\System\UIEQrec.exe
  C:\Windows\System\UIEQrec.exe
  2⤵
  PID:3152
- C:\Windows\System\OdWbBqM.exe
  C:\Windows\System\OdWbBqM.exe
  2⤵
  PID:3168
- C:\Windows\System\DYYoXLr.exe
  C:\Windows\System\DYYoXLr.exe
  2⤵
  PID:3184
- C:\Windows\System\xtSPFul.exe
  C:\Windows\System\xtSPFul.exe
  2⤵
  PID:3200
- C:\Windows\System\rrWAfYO.exe
  C:\Windows\System\rrWAfYO.exe
  2⤵
  PID:3216
- C:\Windows\System\OhQDALo.exe
  C:\Windows\System\OhQDALo.exe
  2⤵
  PID:3232
- C:\Windows\System\RojXeTG.exe
  C:\Windows\System\RojXeTG.exe
  2⤵
  PID:3248
- C:\Windows\System\YdgmRwK.exe
  C:\Windows\System\YdgmRwK.exe
  2⤵
  PID:3264
- C:\Windows\System\XpUVxvI.exe
  C:\Windows\System\XpUVxvI.exe
  2⤵
  PID:3280
- C:\Windows\System\OCjWhCp.exe
  C:\Windows\System\OCjWhCp.exe
  2⤵
  PID:3296
- C:\Windows\System\zcYeIsO.exe
  C:\Windows\System\zcYeIsO.exe
  2⤵
  PID:3312
- C:\Windows\System\SzrcKcr.exe
  C:\Windows\System\SzrcKcr.exe
  2⤵
  PID:3332
- C:\Windows\System\UvWcdnY.exe
  C:\Windows\System\UvWcdnY.exe
  2⤵
  PID:3348
- C:\Windows\System\LTPhEtL.exe
  C:\Windows\System\LTPhEtL.exe
  2⤵
  PID:3364
- C:\Windows\System\mBHOePq.exe
  C:\Windows\System\mBHOePq.exe
  2⤵
  PID:3380
- C:\Windows\System\VcHMTXr.exe
  C:\Windows\System\VcHMTXr.exe
  2⤵
  PID:3396
- C:\Windows\System\jqYiOuA.exe
  C:\Windows\System\jqYiOuA.exe
  2⤵
  PID:3412
- C:\Windows\System\qgWnKiR.exe
  C:\Windows\System\qgWnKiR.exe
  2⤵
  PID:3428
- C:\Windows\System\YnyiGmc.exe
  C:\Windows\System\YnyiGmc.exe
  2⤵
  PID:3444
- C:\Windows\System\lKuehvY.exe
  C:\Windows\System\lKuehvY.exe
  2⤵
  PID:3460
- C:\Windows\System\OYErNAp.exe
  C:\Windows\System\OYErNAp.exe
  2⤵
  PID:3480
- C:\Windows\System\MFxAfXO.exe
  C:\Windows\System\MFxAfXO.exe
  2⤵
  PID:3496
- C:\Windows\System\omlKSUw.exe
  C:\Windows\System\omlKSUw.exe
  2⤵
  PID:3512
- C:\Windows\System\KJrahmi.exe
  C:\Windows\System\KJrahmi.exe
  2⤵
  PID:3528
- C:\Windows\System\KuPJWPq.exe
  C:\Windows\System\KuPJWPq.exe
  2⤵
  PID:3544
- C:\Windows\System\lwJzCgr.exe
  C:\Windows\System\lwJzCgr.exe
  2⤵
  PID:3560
- C:\Windows\System\KEMRrnl.exe
  C:\Windows\System\KEMRrnl.exe
  2⤵
  PID:3576
- C:\Windows\System\hyPxHTc.exe
  C:\Windows\System\hyPxHTc.exe
  2⤵
  PID:3592
- C:\Windows\System\UqTGzZD.exe
  C:\Windows\System\UqTGzZD.exe
  2⤵
  PID:3608
- C:\Windows\System\GwHWgGR.exe
  C:\Windows\System\GwHWgGR.exe
  2⤵
  PID:3624
- C:\Windows\System\adRDyVZ.exe
  C:\Windows\System\adRDyVZ.exe
  2⤵
  PID:3640
- C:\Windows\System\VwADnbw.exe
  C:\Windows\System\VwADnbw.exe
  2⤵
  PID:3656
- C:\Windows\System\eaSDGfd.exe
  C:\Windows\System\eaSDGfd.exe
  2⤵
  PID:3672
- C:\Windows\System\XfiwxhW.exe
  C:\Windows\System\XfiwxhW.exe
  2⤵
  PID:3688
- C:\Windows\System\NgFWjLN.exe
  C:\Windows\System\NgFWjLN.exe
  2⤵
  PID:3704
- C:\Windows\System\HGyIxDU.exe
  C:\Windows\System\HGyIxDU.exe
  2⤵
  PID:3720
- C:\Windows\System\cUmDDYU.exe
  C:\Windows\System\cUmDDYU.exe
  2⤵
  PID:3736
- C:\Windows\System\HBOwTSw.exe
  C:\Windows\System\HBOwTSw.exe
  2⤵
  PID:3752
- C:\Windows\System\pXjETII.exe
  C:\Windows\System\pXjETII.exe
  2⤵
  PID:3768
- C:\Windows\System\jDLUanm.exe
  C:\Windows\System\jDLUanm.exe
  2⤵
  PID:3784
- C:\Windows\System\NrilSCB.exe
  C:\Windows\System\NrilSCB.exe
  2⤵
  PID:3800
- C:\Windows\System\slpFyGl.exe
  C:\Windows\System\slpFyGl.exe
  2⤵
  PID:3816
- C:\Windows\System\KZyHdED.exe
  C:\Windows\System\KZyHdED.exe
  2⤵
  PID:3832
- C:\Windows\System\UtziTvU.exe
  C:\Windows\System\UtziTvU.exe
  2⤵
  PID:3848
- C:\Windows\System\vyHZLOs.exe
  C:\Windows\System\vyHZLOs.exe
  2⤵
  PID:3864
- C:\Windows\System\aJfgrfM.exe
  C:\Windows\System\aJfgrfM.exe
  2⤵
  PID:3880
- C:\Windows\System\FQvBRtp.exe
  C:\Windows\System\FQvBRtp.exe
  2⤵
  PID:3896
- C:\Windows\System\nmhfSyA.exe
  C:\Windows\System\nmhfSyA.exe
  2⤵
  PID:3912
- C:\Windows\System\dYEoRSu.exe
  C:\Windows\System\dYEoRSu.exe
  2⤵
  PID:3928
- C:\Windows\System\ZXAlYpX.exe
  C:\Windows\System\ZXAlYpX.exe
  2⤵
  PID:3944
- C:\Windows\System\ubuqKSo.exe
  C:\Windows\System\ubuqKSo.exe
  2⤵
  PID:3960
- C:\Windows\System\ITRNzOY.exe
  C:\Windows\System\ITRNzOY.exe
  2⤵
  PID:3976
- C:\Windows\System\wzYAuJF.exe
  C:\Windows\System\wzYAuJF.exe
  2⤵
  PID:3992
- C:\Windows\System\dNGQXlb.exe
  C:\Windows\System\dNGQXlb.exe
  2⤵
  PID:4008
- C:\Windows\System\McPNIHX.exe
  C:\Windows\System\McPNIHX.exe
  2⤵
  PID:4024
- C:\Windows\System\FjJuhEU.exe
  C:\Windows\System\FjJuhEU.exe
  2⤵
  PID:4040
- C:\Windows\System\nwNAadt.exe
  C:\Windows\System\nwNAadt.exe
  2⤵
  PID:4056
- C:\Windows\System\QcTXoTq.exe
  C:\Windows\System\QcTXoTq.exe
  2⤵
  PID:4072
- C:\Windows\System\bkIXeGt.exe
  C:\Windows\System\bkIXeGt.exe
  2⤵
  PID:4088
- C:\Windows\System\WaIoEHM.exe
  C:\Windows\System\WaIoEHM.exe
  2⤵
  PID:1908
- C:\Windows\System\UhkXDPy.exe
  C:\Windows\System\UhkXDPy.exe
  2⤵
  PID:2004
- C:\Windows\System\ShDrBHU.exe
  C:\Windows\System\ShDrBHU.exe
  2⤵
  PID:1664
- C:\Windows\System\IFfKZjj.exe
  C:\Windows\System\IFfKZjj.exe
  2⤵
  PID:2328
- C:\Windows\System\XUFlqCS.exe
  C:\Windows\System\XUFlqCS.exe
  2⤵
  PID:1672
- C:\Windows\System\FndpCKn.exe
  C:\Windows\System\FndpCKn.exe
  2⤵
  PID:1512
- C:\Windows\System\uIrxDld.exe
  C:\Windows\System\uIrxDld.exe
  2⤵
  PID:3052
- C:\Windows\System\eYoKace.exe
  C:\Windows\System\eYoKace.exe
  2⤵
  PID:2780
- C:\Windows\System\kxIsHPw.exe
  C:\Windows\System\kxIsHPw.exe
  2⤵
  PID:2596
- C:\Windows\System\AFkgTXc.exe
  C:\Windows\System\AFkgTXc.exe
  2⤵
  PID:2280
- C:\Windows\System\XPvkxoD.exe
  C:\Windows\System\XPvkxoD.exe
  2⤵
  PID:2344
- C:\Windows\System\gkukhNO.exe
  C:\Windows\System\gkukhNO.exe
  2⤵
  PID:1772
- C:\Windows\System\xdwshUJ.exe
  C:\Windows\System\xdwshUJ.exe
  2⤵
  PID:1136
- C:\Windows\System\aNBQNHj.exe
  C:\Windows\System\aNBQNHj.exe
  2⤵
  PID:3096
- C:\Windows\System\BHodOHw.exe
  C:\Windows\System\BHodOHw.exe
  2⤵
  PID:3116
- C:\Windows\System\voiIwpy.exe
  C:\Windows\System\voiIwpy.exe
  2⤵
  PID:3148
- C:\Windows\System\DqDNrfy.exe
  C:\Windows\System\DqDNrfy.exe
  2⤵
  PID:3192
- C:\Windows\System\yOKJJzf.exe
  C:\Windows\System\yOKJJzf.exe
  2⤵
  PID:3212
- C:\Windows\System\luuVmix.exe
  C:\Windows\System\luuVmix.exe
  2⤵
  PID:3260
- C:\Windows\System\hQBDKnJ.exe
  C:\Windows\System\hQBDKnJ.exe
  2⤵
  PID:3276
- C:\Windows\System\vHskopT.exe
  C:\Windows\System\vHskopT.exe
  2⤵
  PID:3308
- C:\Windows\System\zqDSQFW.exe
  C:\Windows\System\zqDSQFW.exe
  2⤵
  PID:3344
- C:\Windows\System\FeheSzs.exe
  C:\Windows\System\FeheSzs.exe
  2⤵
  PID:3388
- C:\Windows\System\hVatTZo.exe
  C:\Windows\System\hVatTZo.exe
  2⤵
  PID:3424
- C:\Windows\System\MiMFNiU.exe
  C:\Windows\System\MiMFNiU.exe
  2⤵
  PID:3456
- C:\Windows\System\CSMBIOP.exe
  C:\Windows\System\CSMBIOP.exe
  2⤵
  PID:1996
- C:\Windows\System\BOAGFlt.exe
  C:\Windows\System\BOAGFlt.exe
  2⤵
  PID:3492
- C:\Windows\System\pylOQpG.exe
  C:\Windows\System\pylOQpG.exe
  2⤵
  PID:3524
- C:\Windows\System\lXsRnaD.exe
  C:\Windows\System\lXsRnaD.exe
  2⤵
  PID:3556
- C:\Windows\System\RhvsSrw.exe
  C:\Windows\System\RhvsSrw.exe
  2⤵
  PID:3588
- C:\Windows\System\UBJQsLy.exe
  C:\Windows\System\UBJQsLy.exe
  2⤵
  PID:3604
- C:\Windows\System\vxjnwgt.exe
  C:\Windows\System\vxjnwgt.exe
  2⤵
  PID:3652
- C:\Windows\System\zsEnlwX.exe
  C:\Windows\System\zsEnlwX.exe
  2⤵
  PID:3684
- C:\Windows\System\qbPWJNq.exe
  C:\Windows\System\qbPWJNq.exe
  2⤵
  PID:3712
- C:\Windows\System\NDIkAeE.exe
  C:\Windows\System\NDIkAeE.exe
  2⤵
  PID:3748
- C:\Windows\System\KYMGQrA.exe
  C:\Windows\System\KYMGQrA.exe
  2⤵
  PID:3764
- C:\Windows\System\MYBLVFE.exe
  C:\Windows\System\MYBLVFE.exe
  2⤵
  PID:3812
- C:\Windows\System\uotFUDP.exe
  C:\Windows\System\uotFUDP.exe
  2⤵
  PID:3828
- C:\Windows\System\vXxOXOV.exe
  C:\Windows\System\vXxOXOV.exe
  2⤵
  PID:3860
- C:\Windows\System\CLokcYR.exe
  C:\Windows\System\CLokcYR.exe
  2⤵
  PID:3888
- C:\Windows\System\usfIlOu.exe
  C:\Windows\System\usfIlOu.exe
  2⤵
  PID:3940
- C:\Windows\System\SoASNnL.exe
  C:\Windows\System\SoASNnL.exe
  2⤵
  PID:3972
- C:\Windows\System\uLXpTTG.exe
  C:\Windows\System\uLXpTTG.exe
  2⤵
  PID:3988
- C:\Windows\System\WPTBvHG.exe
  C:\Windows\System\WPTBvHG.exe
  2⤵
  PID:4020
- C:\Windows\System\SpuFAer.exe
  C:\Windows\System\SpuFAer.exe
  2⤵
  PID:4052
- C:\Windows\System\ldDfkMH.exe
  C:\Windows\System\ldDfkMH.exe
  2⤵
  PID:4084
- C:\Windows\System\dVaDNKC.exe
  C:\Windows\System\dVaDNKC.exe
  2⤵
  PID:2244
- C:\Windows\System\mVeyWXy.exe
  C:\Windows\System\mVeyWXy.exe
  2⤵
  PID:2124
- C:\Windows\System\MjlvJTi.exe
  C:\Windows\System\MjlvJTi.exe
  2⤵
  PID:884
- C:\Windows\System\siRrgsG.exe
  C:\Windows\System\siRrgsG.exe
  2⤵
  PID:1600
- C:\Windows\System\giieCXq.exe
  C:\Windows\System\giieCXq.exe
  2⤵
  PID:2620
- C:\Windows\System\VYpwDcH.exe
  C:\Windows\System\VYpwDcH.exe
  2⤵
  PID:1488
- C:\Windows\System\gdItMFn.exe
  C:\Windows\System\gdItMFn.exe
  2⤵
  PID:3084
- C:\Windows\System\wTcczlu.exe
  C:\Windows\System\wTcczlu.exe
  2⤵
  PID:3176
- C:\Windows\System\QlNJBIx.exe
  C:\Windows\System\QlNJBIx.exe
  2⤵
  PID:3224
- C:\Windows\System\dIqUBvN.exe
  C:\Windows\System\dIqUBvN.exe
  2⤵
  PID:3304
- C:\Windows\System\tYDqFYM.exe
  C:\Windows\System\tYDqFYM.exe
  2⤵
  PID:3356
- C:\Windows\System\GbZSQCt.exe
  C:\Windows\System\GbZSQCt.exe
  2⤵
  PID:3420
- C:\Windows\System\RSbKsjQ.exe
  C:\Windows\System\RSbKsjQ.exe
  2⤵
  PID:2656
- C:\Windows\System\gsktuuz.exe
  C:\Windows\System\gsktuuz.exe
  2⤵
  PID:2648
- C:\Windows\System\mgujfwv.exe
  C:\Windows\System\mgujfwv.exe
  2⤵
  PID:3620
- C:\Windows\System\mAxiPYH.exe
  C:\Windows\System\mAxiPYH.exe
  2⤵
  PID:3636
- C:\Windows\System\NooQkau.exe
  C:\Windows\System\NooQkau.exe
  2⤵
  PID:4112
- C:\Windows\System\kaQWIId.exe
  C:\Windows\System\kaQWIId.exe
  2⤵
  PID:4128
- C:\Windows\System\jXSnGVG.exe
  C:\Windows\System\jXSnGVG.exe
  2⤵
  PID:4144
- C:\Windows\System\qazlJEU.exe
  C:\Windows\System\qazlJEU.exe
  2⤵
  PID:4160
- C:\Windows\System\SmXbztT.exe
  C:\Windows\System\SmXbztT.exe
  2⤵
  PID:4176
- C:\Windows\System\xxZLsAS.exe
  C:\Windows\System\xxZLsAS.exe
  2⤵
  PID:4192
- C:\Windows\System\ZxAexWi.exe
  C:\Windows\System\ZxAexWi.exe
  2⤵
  PID:4208
- C:\Windows\System\BFZKNvD.exe
  C:\Windows\System\BFZKNvD.exe
  2⤵
  PID:4224
- C:\Windows\System\iEBoOLT.exe
  C:\Windows\System\iEBoOLT.exe
  2⤵
  PID:4240
- C:\Windows\System\tVbHmxv.exe
  C:\Windows\System\tVbHmxv.exe
  2⤵
  PID:4256
- C:\Windows\System\sXYmtxD.exe
  C:\Windows\System\sXYmtxD.exe
  2⤵
  PID:4272
- C:\Windows\System\EPCmDRF.exe
  C:\Windows\System\EPCmDRF.exe
  2⤵
  PID:4288
- C:\Windows\System\lMhSGyP.exe
  C:\Windows\System\lMhSGyP.exe
  2⤵
  PID:4304
- C:\Windows\System\cbXacBm.exe
  C:\Windows\System\cbXacBm.exe
  2⤵
  PID:4320
- C:\Windows\System\ylErPao.exe
  C:\Windows\System\ylErPao.exe
  2⤵
  PID:4336
- C:\Windows\System\OVyAxIq.exe
  C:\Windows\System\OVyAxIq.exe
  2⤵
  PID:4352
- C:\Windows\System\saXqELq.exe
  C:\Windows\System\saXqELq.exe
  2⤵
  PID:4368
- C:\Windows\System\vlwIWhQ.exe
  C:\Windows\System\vlwIWhQ.exe
  2⤵
  PID:4384
- C:\Windows\System\OMXDUUu.exe
  C:\Windows\System\OMXDUUu.exe
  2⤵
  PID:4400
- C:\Windows\System\nXvsLKQ.exe
  C:\Windows\System\nXvsLKQ.exe
  2⤵
  PID:4416
- C:\Windows\System\YIdhUFf.exe
  C:\Windows\System\YIdhUFf.exe
  2⤵
  PID:4432
- C:\Windows\System\WBmkeoc.exe
  C:\Windows\System\WBmkeoc.exe
  2⤵
  PID:4448
- C:\Windows\System\APWyeKN.exe
  C:\Windows\System\APWyeKN.exe
  2⤵
  PID:4464
- C:\Windows\System\NBwOOJQ.exe
  C:\Windows\System\NBwOOJQ.exe
  2⤵
  PID:4480
- C:\Windows\System\stkDVTt.exe
  C:\Windows\System\stkDVTt.exe
  2⤵
  PID:4496
- C:\Windows\System\JYfztqr.exe
  C:\Windows\System\JYfztqr.exe
  2⤵
  PID:4512
- C:\Windows\System\SoGUhfQ.exe
  C:\Windows\System\SoGUhfQ.exe
  2⤵
  PID:4532
- C:\Windows\System\fBSSWCf.exe
  C:\Windows\System\fBSSWCf.exe
  2⤵
  PID:4548
- C:\Windows\System\fCyhCkw.exe
  C:\Windows\System\fCyhCkw.exe
  2⤵
  PID:4564
- C:\Windows\System\kKQqGUh.exe
  C:\Windows\System\kKQqGUh.exe
  2⤵
  PID:4580
- C:\Windows\System\wOJFrVn.exe
  C:\Windows\System\wOJFrVn.exe
  2⤵
  PID:4596
- C:\Windows\System\MiSwKtm.exe
  C:\Windows\System\MiSwKtm.exe
  2⤵
  PID:4612
- C:\Windows\System\noLrGCn.exe
  C:\Windows\System\noLrGCn.exe
  2⤵
  PID:4628
- C:\Windows\System\gLmHzjU.exe
  C:\Windows\System\gLmHzjU.exe
  2⤵
  PID:4644
- C:\Windows\System\CFbubeX.exe
  C:\Windows\System\CFbubeX.exe
  2⤵
  PID:4660
- C:\Windows\System\sxwAAsQ.exe
  C:\Windows\System\sxwAAsQ.exe
  2⤵
  PID:4676
- C:\Windows\System\FFHCAvg.exe
  C:\Windows\System\FFHCAvg.exe
  2⤵
  PID:4692
- C:\Windows\System\JFaBezo.exe
  C:\Windows\System\JFaBezo.exe
  2⤵
  PID:4708
- C:\Windows\System\iCHFtRD.exe
  C:\Windows\System\iCHFtRD.exe
  2⤵
  PID:4724
- C:\Windows\System\FKeGLwV.exe
  C:\Windows\System\FKeGLwV.exe
  2⤵
  PID:4740
- C:\Windows\System\GDVTnlz.exe
  C:\Windows\System\GDVTnlz.exe
  2⤵
  PID:4756
- C:\Windows\System\ueJYnwI.exe
  C:\Windows\System\ueJYnwI.exe
  2⤵
  PID:4772
- C:\Windows\System\McfbAzy.exe
  C:\Windows\System\McfbAzy.exe
  2⤵
  PID:4788
- C:\Windows\System\xuqXtgZ.exe
  C:\Windows\System\xuqXtgZ.exe
  2⤵
  PID:4804
- C:\Windows\System\HfaXcmL.exe
  C:\Windows\System\HfaXcmL.exe
  2⤵
  PID:4820
- C:\Windows\System\lZFKdbB.exe
  C:\Windows\System\lZFKdbB.exe
  2⤵
  PID:4836
- C:\Windows\System\ZUXERAr.exe
  C:\Windows\System\ZUXERAr.exe
  2⤵
  PID:4852
- C:\Windows\System\eqGoeMj.exe
  C:\Windows\System\eqGoeMj.exe
  2⤵
  PID:4868
- C:\Windows\System\qKFjLxZ.exe
  C:\Windows\System\qKFjLxZ.exe
  2⤵
  PID:4884
- C:\Windows\System\KnPHsYA.exe
  C:\Windows\System\KnPHsYA.exe
  2⤵
  PID:4900
- C:\Windows\System\uFBZZog.exe
  C:\Windows\System\uFBZZog.exe
  2⤵
  PID:4916
- C:\Windows\System\FMILHkG.exe
  C:\Windows\System\FMILHkG.exe
  2⤵
  PID:4932
- C:\Windows\System\AFAMKEo.exe
  C:\Windows\System\AFAMKEo.exe
  2⤵
  PID:4948
- C:\Windows\System\OTazEku.exe
  C:\Windows\System\OTazEku.exe
  2⤵
  PID:4964
- C:\Windows\System\dSIYbUd.exe
  C:\Windows\System\dSIYbUd.exe
  2⤵
  PID:4980
- C:\Windows\System\hWvoYGK.exe
  C:\Windows\System\hWvoYGK.exe
  2⤵
  PID:4996
- C:\Windows\System\jxDvdhq.exe
  C:\Windows\System\jxDvdhq.exe
  2⤵
  PID:5012
- C:\Windows\System\npEZmAR.exe
  C:\Windows\System\npEZmAR.exe
  2⤵
  PID:5028
- C:\Windows\System\YkQfSvY.exe
  C:\Windows\System\YkQfSvY.exe
  2⤵
  PID:5044
- C:\Windows\System\MdXdsiO.exe
  C:\Windows\System\MdXdsiO.exe
  2⤵
  PID:5060
- C:\Windows\System\eRaRmvW.exe
  C:\Windows\System\eRaRmvW.exe
  2⤵
  PID:5076
- C:\Windows\System\eksxMFA.exe
  C:\Windows\System\eksxMFA.exe
  2⤵
  PID:5092
- C:\Windows\System\LBDvBys.exe
  C:\Windows\System\LBDvBys.exe
  2⤵
  PID:5108
- C:\Windows\System\XaTPNgF.exe
  C:\Windows\System\XaTPNgF.exe
  2⤵
  PID:3668
- C:\Windows\System\ityeShN.exe
  C:\Windows\System\ityeShN.exe
  2⤵
  PID:3744
- C:\Windows\System\UxaPzWv.exe
  C:\Windows\System\UxaPzWv.exe
  2⤵
  PID:3776
- C:\Windows\System\xoGJsXA.exe
  C:\Windows\System\xoGJsXA.exe
  2⤵
  PID:3840
- C:\Windows\System\MlSARQO.exe
  C:\Windows\System\MlSARQO.exe
  2⤵
  PID:3908
- C:\Windows\System\TBFPAMn.exe
  C:\Windows\System\TBFPAMn.exe
  2⤵
  PID:4000
- C:\Windows\System\FkCEkqD.exe
  C:\Windows\System\FkCEkqD.exe
  2⤵
  PID:4016
- C:\Windows\System\zTERpoo.exe
  C:\Windows\System\zTERpoo.exe
  2⤵
  PID:4080
- C:\Windows\System\OPXkrAA.exe
  C:\Windows\System\OPXkrAA.exe
  2⤵
  PID:348
- C:\Windows\System\dlCufxt.exe
  C:\Windows\System\dlCufxt.exe
  2⤵
  PID:2172
- C:\Windows\System\fTsyLIH.exe
  C:\Windows\System\fTsyLIH.exe
  2⤵
  PID:2472
- C:\Windows\System\CREXjsq.exe
  C:\Windows\System\CREXjsq.exe
  2⤵
  PID:3208
- C:\Windows\System\MnRWSGl.exe
  C:\Windows\System\MnRWSGl.exe
  2⤵
  PID:3272
- C:\Windows\System\YsasqlP.exe
  C:\Windows\System\YsasqlP.exe
  2⤵
  PID:3468
- C:\Windows\System\KtbTTxv.exe
  C:\Windows\System\KtbTTxv.exe
  2⤵
  PID:3552
- C:\Windows\System\rbsGawl.exe
  C:\Windows\System\rbsGawl.exe
  2⤵
  PID:4104
- C:\Windows\System\QvdwRbV.exe
  C:\Windows\System\QvdwRbV.exe
  2⤵
  PID:4120
- C:\Windows\System\XBBFZOj.exe
  C:\Windows\System\XBBFZOj.exe
  2⤵
  PID:4152
- C:\Windows\System\PbYrhEh.exe
  C:\Windows\System\PbYrhEh.exe
  2⤵
  PID:4184
- C:\Windows\System\LeNdFCL.exe
  C:\Windows\System\LeNdFCL.exe
  2⤵
  PID:4216
- C:\Windows\System\wBclHBM.exe
  C:\Windows\System\wBclHBM.exe
  2⤵
  PID:4248
- C:\Windows\System\cqitpIu.exe
  C:\Windows\System\cqitpIu.exe
  2⤵
  PID:4296
- C:\Windows\System\ZmOdSOT.exe
  C:\Windows\System\ZmOdSOT.exe
  2⤵
  PID:4328
- C:\Windows\System\dQQbWCi.exe
  C:\Windows\System\dQQbWCi.exe
  2⤵
  PID:4360
- C:\Windows\System\EUQHLjL.exe
  C:\Windows\System\EUQHLjL.exe
  2⤵
  PID:4376
- C:\Windows\System\OGEulCm.exe
  C:\Windows\System\OGEulCm.exe
  2⤵
  PID:4408
- C:\Windows\System\OYRWdyI.exe
  C:\Windows\System\OYRWdyI.exe
  2⤵
  PID:4440
- C:\Windows\System\dGiAIkM.exe
  C:\Windows\System\dGiAIkM.exe
  2⤵
  PID:4472
- C:\Windows\System\DVcAQKq.exe
  C:\Windows\System\DVcAQKq.exe
  2⤵
  PID:4492
- C:\Windows\System\nxuYbZp.exe
  C:\Windows\System\nxuYbZp.exe
  2⤵
  PID:4524
- C:\Windows\System\dVhSkEc.exe
  C:\Windows\System\dVhSkEc.exe
  2⤵
  PID:4560
- C:\Windows\System\TaGodzW.exe
  C:\Windows\System\TaGodzW.exe
  2⤵
  PID:4592
- C:\Windows\System\muQEJLh.exe
  C:\Windows\System\muQEJLh.exe
  2⤵
  PID:4608
- C:\Windows\System\twZpnXL.exe
  C:\Windows\System\twZpnXL.exe
  2⤵
  PID:4656
- C:\Windows\System\gDVxkaq.exe
  C:\Windows\System\gDVxkaq.exe
  2⤵
  PID:4688
- C:\Windows\System\AEEtUxc.exe
  C:\Windows\System\AEEtUxc.exe
  2⤵
  PID:4704
- C:\Windows\System\KUdxBGB.exe
  C:\Windows\System\KUdxBGB.exe
  2⤵
  PID:4748
- C:\Windows\System\PmtIvck.exe
  C:\Windows\System\PmtIvck.exe
  2⤵
  PID:4784
- C:\Windows\System\ZGTsXbZ.exe
  C:\Windows\System\ZGTsXbZ.exe
  2⤵
  PID:4812
- C:\Windows\System\EExBStB.exe
  C:\Windows\System\EExBStB.exe
  2⤵
  PID:4844
- C:\Windows\System\kXdYNnA.exe
  C:\Windows\System\kXdYNnA.exe
  2⤵
  PID:4876
- C:\Windows\System\aFBRhos.exe
  C:\Windows\System\aFBRhos.exe
  2⤵
  PID:4908
- C:\Windows\System\aHdKPvh.exe
  C:\Windows\System\aHdKPvh.exe
  2⤵
  PID:4940
- C:\Windows\System\SkemYFm.exe
  C:\Windows\System\SkemYFm.exe
  2⤵
  PID:4956
- C:\Windows\System\bQuiKlu.exe
  C:\Windows\System\bQuiKlu.exe
  2⤵
  PID:5004
- C:\Windows\System\xzcpoxi.exe
  C:\Windows\System\xzcpoxi.exe
  2⤵
  PID:5036
- C:\Windows\System\OLGEUEl.exe
  C:\Windows\System\OLGEUEl.exe
  2⤵
  PID:5056
- C:\Windows\System\QJXFblN.exe
  C:\Windows\System\QJXFblN.exe
  2⤵
  PID:5084
- C:\Windows\System\VqQqjJn.exe
  C:\Windows\System\VqQqjJn.exe
  2⤵
  PID:5104
- C:\Windows\System\iogVyon.exe
  C:\Windows\System\iogVyon.exe
  2⤵
  PID:3728
- C:\Windows\System\hmljARA.exe
  C:\Windows\System\hmljARA.exe
  2⤵
  PID:3856
- C:\Windows\System\qKtWmyX.exe
  C:\Windows\System\qKtWmyX.exe
  2⤵
  PID:3920
- C:\Windows\System\yKzxrQG.exe
  C:\Windows\System\yKzxrQG.exe
  2⤵
  PID:4064
- C:\Windows\System\twsWVKw.exe
  C:\Windows\System\twsWVKw.exe
  2⤵
  PID:2988
- C:\Windows\System\OKJKyUe.exe
  C:\Windows\System\OKJKyUe.exe
  2⤵
  PID:696
- C:\Windows\System\OgJaPBV.exe
  C:\Windows\System\OgJaPBV.exe
  2⤵
  PID:3240
- C:\Windows\System\brsJtoM.exe
  C:\Windows\System\brsJtoM.exe
  2⤵
  PID:2092
- C:\Windows\System\NiBTmql.exe
  C:\Windows\System\NiBTmql.exe
  2⤵
  PID:4124
- C:\Windows\System\hQOTJwQ.exe
  C:\Windows\System\hQOTJwQ.exe
  2⤵
  PID:4204
- C:\Windows\System\YrLFTnp.exe
  C:\Windows\System\YrLFTnp.exe
  2⤵
  PID:4252
- C:\Windows\System\izpfSaL.exe
  C:\Windows\System\izpfSaL.exe
  2⤵
  PID:4332
- C:\Windows\System\ZoLkmQl.exe
  C:\Windows\System\ZoLkmQl.exe
  2⤵
  PID:4396
- C:\Windows\System\lvzOtZG.exe
  C:\Windows\System\lvzOtZG.exe
  2⤵
  PID:2796
- C:\Windows\System\bfJAucA.exe
  C:\Windows\System\bfJAucA.exe
  2⤵
  PID:4520
- C:\Windows\System\xgodqpw.exe
  C:\Windows\System\xgodqpw.exe
  2⤵
  PID:4544
- C:\Windows\System\yUULpiu.exe
  C:\Windows\System\yUULpiu.exe
  2⤵
  PID:4620
- C:\Windows\System\UVHyhuQ.exe
  C:\Windows\System\UVHyhuQ.exe
  2⤵
  PID:4668
- C:\Windows\System\hHVgNXv.exe
  C:\Windows\System\hHVgNXv.exe
  2⤵
  PID:4732
- C:\Windows\System\KZBizcS.exe
  C:\Windows\System\KZBizcS.exe
  2⤵
  PID:4816
- C:\Windows\System\acqUBMT.exe
  C:\Windows\System\acqUBMT.exe
  2⤵
  PID:4848
- C:\Windows\System\pmatnaw.exe
  C:\Windows\System\pmatnaw.exe
  2⤵
  PID:4944
- C:\Windows\System\kSBfLul.exe
  C:\Windows\System\kSBfLul.exe
  2⤵
  PID:4976
- C:\Windows\System\YXQdZXK.exe
  C:\Windows\System\YXQdZXK.exe
  2⤵
  PID:5124
- C:\Windows\System\oLlJFFx.exe
  C:\Windows\System\oLlJFFx.exe
  2⤵
  PID:5140
- C:\Windows\System\JeVznLx.exe
  C:\Windows\System\JeVznLx.exe
  2⤵
  PID:5156
- C:\Windows\System\pXGVMFj.exe
  C:\Windows\System\pXGVMFj.exe
  2⤵
  PID:5172
- C:\Windows\System\gUcsaCX.exe
  C:\Windows\System\gUcsaCX.exe
  2⤵
  PID:5188
- C:\Windows\System\aohiOug.exe
  C:\Windows\System\aohiOug.exe
  2⤵
  PID:5204
- C:\Windows\System\WnFQVXR.exe
  C:\Windows\System\WnFQVXR.exe
  2⤵
  PID:5220
- C:\Windows\System\bGROfww.exe
  C:\Windows\System\bGROfww.exe
  2⤵
  PID:5240
- C:\Windows\System\QNybsaO.exe
  C:\Windows\System\QNybsaO.exe
  2⤵
  PID:5260
- C:\Windows\System\BuJmSES.exe
  C:\Windows\System\BuJmSES.exe
  2⤵
  PID:5276
- C:\Windows\System\mLYnefh.exe
  C:\Windows\System\mLYnefh.exe
  2⤵
  PID:5292
- C:\Windows\System\WiBqZMo.exe
  C:\Windows\System\WiBqZMo.exe
  2⤵
  PID:5308
- C:\Windows\System\YYeUwev.exe
  C:\Windows\System\YYeUwev.exe
  2⤵
  PID:5324
- C:\Windows\System\rOWdSVZ.exe
  C:\Windows\System\rOWdSVZ.exe
  2⤵
  PID:5340
- C:\Windows\System\xGpKNCr.exe
  C:\Windows\System\xGpKNCr.exe
  2⤵
  PID:5356
- C:\Windows\System\pyfmbNu.exe
  C:\Windows\System\pyfmbNu.exe
  2⤵
  PID:5372
- C:\Windows\System\NlHHTlL.exe
  C:\Windows\System\NlHHTlL.exe
  2⤵
  PID:5388
- C:\Windows\System\YLtzzko.exe
  C:\Windows\System\YLtzzko.exe
  2⤵
  PID:5404
- C:\Windows\System\BWHwDak.exe
  C:\Windows\System\BWHwDak.exe
  2⤵
  PID:5420
- C:\Windows\System\mbNXjvu.exe
  C:\Windows\System\mbNXjvu.exe
  2⤵
  PID:5436
- C:\Windows\System\HvORVNk.exe
  C:\Windows\System\HvORVNk.exe
  2⤵
  PID:5452
- C:\Windows\System\JLVHkmO.exe
  C:\Windows\System\JLVHkmO.exe
  2⤵
  PID:5468
- C:\Windows\System\rAdvBJY.exe
  C:\Windows\System\rAdvBJY.exe
  2⤵
  PID:5484
- C:\Windows\System\ZrQskRL.exe
  C:\Windows\System\ZrQskRL.exe
  2⤵
  PID:5500
- C:\Windows\System\ZBcckXc.exe
  C:\Windows\System\ZBcckXc.exe
  2⤵
  PID:5516
- C:\Windows\System\bJTxBQO.exe
  C:\Windows\System\bJTxBQO.exe
  2⤵
  PID:5532
- C:\Windows\System\ggZVWpu.exe
  C:\Windows\System\ggZVWpu.exe
  2⤵
  PID:5548
- C:\Windows\System\eABnhVN.exe
  C:\Windows\System\eABnhVN.exe
  2⤵
  PID:5564
- C:\Windows\System\UgjAjvA.exe
  C:\Windows\System\UgjAjvA.exe
  2⤵
  PID:5580
- C:\Windows\System\bDFeCLp.exe
  C:\Windows\System\bDFeCLp.exe
  2⤵
  PID:5596
- C:\Windows\System\GairEVS.exe
  C:\Windows\System\GairEVS.exe
  2⤵
  PID:5612
- C:\Windows\System\pwEDRZp.exe
  C:\Windows\System\pwEDRZp.exe
  2⤵
  PID:5628
- C:\Windows\System\mzQFKGc.exe
  C:\Windows\System\mzQFKGc.exe
  2⤵
  PID:5644
- C:\Windows\System\pgeKQqX.exe
  C:\Windows\System\pgeKQqX.exe
  2⤵
  PID:5660
- C:\Windows\System\WMTCJBZ.exe
  C:\Windows\System\WMTCJBZ.exe
  2⤵
  PID:5676
- C:\Windows\System\qqbGise.exe
  C:\Windows\System\qqbGise.exe
  2⤵
  PID:5692
- C:\Windows\System\ckZbFoC.exe
  C:\Windows\System\ckZbFoC.exe
  2⤵
  PID:5708
- C:\Windows\System\JqRTnyN.exe
  C:\Windows\System\JqRTnyN.exe
  2⤵
  PID:5724
- C:\Windows\System\pQSBiyF.exe
  C:\Windows\System\pQSBiyF.exe
  2⤵
  PID:5740
- C:\Windows\System\WWZQnxe.exe
  C:\Windows\System\WWZQnxe.exe
  2⤵
  PID:5756
- C:\Windows\System\RVNEkrT.exe
  C:\Windows\System\RVNEkrT.exe
  2⤵
  PID:5776
- C:\Windows\System\qHEViiP.exe
  C:\Windows\System\qHEViiP.exe
  2⤵
  PID:5792
- C:\Windows\System\suTxmZn.exe
  C:\Windows\System\suTxmZn.exe
  2⤵
  PID:5808
- C:\Windows\System\Xqrcetq.exe
  C:\Windows\System\Xqrcetq.exe
  2⤵
  PID:5824
- C:\Windows\System\ryLNRjg.exe
  C:\Windows\System\ryLNRjg.exe
  2⤵
  PID:5840
- C:\Windows\System\sDXogBz.exe
  C:\Windows\System\sDXogBz.exe
  2⤵
  PID:5856
- C:\Windows\System\PLqxOzO.exe
  C:\Windows\System\PLqxOzO.exe
  2⤵
  PID:5872
- C:\Windows\System\imCquWE.exe
  C:\Windows\System\imCquWE.exe
  2⤵
  PID:5888
- C:\Windows\System\PwMOmSW.exe
  C:\Windows\System\PwMOmSW.exe
  2⤵
  PID:5904
- C:\Windows\System\TQkpwKf.exe
  C:\Windows\System\TQkpwKf.exe
  2⤵
  PID:5920
- C:\Windows\System\uAwQKXJ.exe
  C:\Windows\System\uAwQKXJ.exe
  2⤵
  PID:5936
- C:\Windows\System\JOluEUj.exe
  C:\Windows\System\JOluEUj.exe
  2⤵
  PID:5952
- C:\Windows\System\UvIrlQy.exe
  C:\Windows\System\UvIrlQy.exe
  2⤵
  PID:5968
- C:\Windows\System\yOLnDyQ.exe
  C:\Windows\System\yOLnDyQ.exe
  2⤵
  PID:5984
- C:\Windows\System\uMAuqyU.exe
  C:\Windows\System\uMAuqyU.exe
  2⤵
  PID:6000
- C:\Windows\System\vLIwEhu.exe
  C:\Windows\System\vLIwEhu.exe
  2⤵
  PID:6016
- C:\Windows\System\FdnfnbI.exe
  C:\Windows\System\FdnfnbI.exe
  2⤵
  PID:6032
- C:\Windows\System\WbzaGKS.exe
  C:\Windows\System\WbzaGKS.exe
  2⤵
  PID:6048
- C:\Windows\System\gPSfYOn.exe
  C:\Windows\System\gPSfYOn.exe
  2⤵
  PID:6064
- C:\Windows\System\fabHifm.exe
  C:\Windows\System\fabHifm.exe
  2⤵
  PID:6080
- C:\Windows\System\fZCGKWk.exe
  C:\Windows\System\fZCGKWk.exe
  2⤵
  PID:6096
- C:\Windows\System\uOSwaeQ.exe
  C:\Windows\System\uOSwaeQ.exe
  2⤵
  PID:6112
- C:\Windows\System\kktHCiF.exe
  C:\Windows\System\kktHCiF.exe
  2⤵
  PID:6128
- C:\Windows\System\iyquXSg.exe
  C:\Windows\System\iyquXSg.exe
  2⤵
  PID:5040
- C:\Windows\System\tTYbKUg.exe
  C:\Windows\System\tTYbKUg.exe
  2⤵
  PID:5100
- C:\Windows\System\HXwrlho.exe
  C:\Windows\System\HXwrlho.exe
  2⤵
  PID:3032
- C:\Windows\System\OuHuwhS.exe
  C:\Windows\System\OuHuwhS.exe
  2⤵
  PID:4032
- C:\Windows\System\qjOGMio.exe
  C:\Windows\System\qjOGMio.exe
  2⤵
  PID:3288
- C:\Windows\System\AqAYoxr.exe
  C:\Windows\System\AqAYoxr.exe
  2⤵
  PID:3540
- C:\Windows\System\tGfMhPZ.exe
  C:\Windows\System\tGfMhPZ.exe
  2⤵
  PID:4172
- C:\Windows\System\PbuifVU.exe
  C:\Windows\System\PbuifVU.exe
  2⤵
  PID:4316
- C:\Windows\System\PiLcesG.exe
  C:\Windows\System\PiLcesG.exe
  2⤵
  PID:4284
- C:\Windows\System\diSXeTz.exe
  C:\Windows\System\diSXeTz.exe
  2⤵
  PID:4476
- C:\Windows\System\rEVGylo.exe
  C:\Windows\System\rEVGylo.exe
  2⤵
  PID:4508
- C:\Windows\System\EsgOooX.exe
  C:\Windows\System\EsgOooX.exe
  2⤵
  PID:4684
- C:\Windows\System\eRJgdAy.exe
  C:\Windows\System\eRJgdAy.exe
  2⤵
  PID:4796
- C:\Windows\System\hMoVyCs.exe
  C:\Windows\System\hMoVyCs.exe
  2⤵
  PID:4924
- C:\Windows\System\DywBTeq.exe
  C:\Windows\System\DywBTeq.exe
  2⤵
  PID:5136
- C:\Windows\System\DZWXfuM.exe
  C:\Windows\System\DZWXfuM.exe
  2⤵
  PID:5152
- C:\Windows\System\RNKCOEA.exe
  C:\Windows\System\RNKCOEA.exe
  2⤵
  PID:5200
- C:\Windows\System\chcIIkX.exe
  C:\Windows\System\chcIIkX.exe
  2⤵
  PID:5216
- C:\Windows\System\JenKOSK.exe
  C:\Windows\System\JenKOSK.exe
  2⤵
  PID:5272
- C:\Windows\System\JoqTGcf.exe
  C:\Windows\System\JoqTGcf.exe
  2⤵
  PID:5288
- C:\Windows\System\RTGrKvI.exe
  C:\Windows\System\RTGrKvI.exe
  2⤵
  PID:5320
- C:\Windows\System\mVqUPnM.exe
  C:\Windows\System\mVqUPnM.exe
  2⤵
  PID:5396
- C:\Windows\System\YIeKYBT.exe
  C:\Windows\System\YIeKYBT.exe
  2⤵
  PID:5384
- C:\Windows\System\OdEvmTZ.exe
  C:\Windows\System\OdEvmTZ.exe
  2⤵
  PID:5432
- C:\Windows\System\npPzVhn.exe
  C:\Windows\System\npPzVhn.exe
  2⤵
  PID:5464
- C:\Windows\System\JcTsDwg.exe
  C:\Windows\System\JcTsDwg.exe
  2⤵
  PID:5544
- C:\Windows\System\hLyPpoP.exe
  C:\Windows\System\hLyPpoP.exe
  2⤵
  PID:5576
- C:\Windows\System\YyaXWaB.exe
  C:\Windows\System\YyaXWaB.exe
  2⤵
  PID:5624
- C:\Windows\System\nucyeWD.exe
  C:\Windows\System\nucyeWD.exe
  2⤵
  PID:5656
- C:\Windows\System\dxCMYnS.exe
  C:\Windows\System\dxCMYnS.exe
  2⤵
  PID:5688
- C:\Windows\System\cSQhNHa.exe
  C:\Windows\System\cSQhNHa.exe
  2⤵
  PID:5704
- C:\Windows\System\tEvbkgQ.exe
  C:\Windows\System\tEvbkgQ.exe
  2⤵
  PID:5752
- C:\Windows\System\qsMbZXs.exe
  C:\Windows\System\qsMbZXs.exe
  2⤵
  PID:5768
- C:\Windows\System\JCFvUXc.exe
  C:\Windows\System\JCFvUXc.exe
  2⤵
  PID:5804
- C:\Windows\System\DIodUMJ.exe
  C:\Windows\System\DIodUMJ.exe
  2⤵
  PID:5852
- C:\Windows\System\lDdchaX.exe
  C:\Windows\System\lDdchaX.exe
  2⤵
  PID:5884
- C:\Windows\System\gwbGtkH.exe
  C:\Windows\System\gwbGtkH.exe
  2⤵
  PID:5916
- C:\Windows\System\uQOKqzU.exe
  C:\Windows\System\uQOKqzU.exe
  2⤵
  PID:5948
- C:\Windows\System\XogBGox.exe
  C:\Windows\System\XogBGox.exe
  2⤵
  PID:5980
- C:\Windows\System\NscPote.exe
  C:\Windows\System\NscPote.exe
  2⤵
  PID:6012
- C:\Windows\System\rATZshN.exe
  C:\Windows\System\rATZshN.exe
  2⤵
  PID:580
- C:\Windows\System\rbJqgeQ.exe
  C:\Windows\System\rbJqgeQ.exe
  2⤵
  PID:2068
- C:\Windows\System\SfcwJfa.exe
  C:\Windows\System\SfcwJfa.exe
  2⤵
  PID:2464
- C:\Windows\System\evmclUE.exe
  C:\Windows\System\evmclUE.exe
  2⤵
  PID:2540
- C:\Windows\System\ClXOKCy.exe
  C:\Windows\System\ClXOKCy.exe
  2⤵
  PID:932
- C:\Windows\System\fussgpQ.exe
  C:\Windows\System\fussgpQ.exe
  2⤵
  PID:6044
- C:\Windows\System\BwBviBI.exe
  C:\Windows\System\BwBviBI.exe
  2⤵
  PID:916
- C:\Windows\System\lkXcnqE.exe
  C:\Windows\System\lkXcnqE.exe
  2⤵
  PID:6076
- C:\Windows\System\mycQxKh.exe
  C:\Windows\System\mycQxKh.exe
  2⤵
  PID:6108
- C:\Windows\System\UojOmaE.exe
  C:\Windows\System\UojOmaE.exe
  2⤵
  PID:6136
- C:\Windows\System\kMMGcFA.exe
  C:\Windows\System\kMMGcFA.exe
  2⤵
  PID:1560
- C:\Windows\System\kRkTIpF.exe
  C:\Windows\System\kRkTIpF.exe
  2⤵
  PID:2924
- C:\Windows\System\FfeAlzh.exe
  C:\Windows\System\FfeAlzh.exe
  2⤵
  PID:3984
- C:\Windows\System\FUnsueX.exe
  C:\Windows\System\FUnsueX.exe
  2⤵
  PID:668
- C:\Windows\System\AzaeLug.exe
  C:\Windows\System\AzaeLug.exe
  2⤵
  PID:3436
- C:\Windows\System\cRcjXBX.exe
  C:\Windows\System\cRcjXBX.exe
  2⤵
  PID:1856
- C:\Windows\System\fUbyIdD.exe
  C:\Windows\System\fUbyIdD.exe
  2⤵
  PID:4556
- C:\Windows\System\eZClPGk.exe
  C:\Windows\System\eZClPGk.exe
  2⤵
  PID:1576
- C:\Windows\System\agCPFqR.exe
  C:\Windows\System\agCPFqR.exe
  2⤵
  PID:4780
- C:\Windows\System\jdNuctB.exe
  C:\Windows\System\jdNuctB.exe
  2⤵
  PID:5184
- C:\Windows\System\yEHyqhz.exe
  C:\Windows\System\yEHyqhz.exe
  2⤵
  PID:5268
- C:\Windows\System\orLUDkl.exe
  C:\Windows\System\orLUDkl.exe
  2⤵
  PID:4892
- C:\Windows\System\QXIMSAW.exe
  C:\Windows\System\QXIMSAW.exe
  2⤵
  PID:5448
- C:\Windows\System\AICUAPv.exe
  C:\Windows\System\AICUAPv.exe
  2⤵
  PID:5212
- C:\Windows\System\qXwzoSX.exe
  C:\Windows\System\qXwzoSX.exe
  2⤵
  PID:5364
- C:\Windows\System\ruatPdi.exe
  C:\Windows\System\ruatPdi.exe
  2⤵
  PID:5492
- C:\Windows\System\ZXszKjx.exe
  C:\Windows\System\ZXszKjx.exe
  2⤵
  PID:5512
- C:\Windows\System\zYdoSme.exe
  C:\Windows\System\zYdoSme.exe
  2⤵
  PID:5540
- C:\Windows\System\FmakQZh.exe
  C:\Windows\System\FmakQZh.exe
  2⤵
  PID:5608
- C:\Windows\System\PKZOLvf.exe
  C:\Windows\System\PKZOLvf.exe
  2⤵
  PID:5672
- C:\Windows\System\lQLiIlH.exe
  C:\Windows\System\lQLiIlH.exe
  2⤵
  PID:5788
- C:\Windows\System\aHCHpJz.exe
  C:\Windows\System\aHCHpJz.exe
  2⤵
  PID:5836
- C:\Windows\System\mPRMyTz.exe
  C:\Windows\System\mPRMyTz.exe
  2⤵
  PID:5900
- C:\Windows\System\kdpjhEE.exe
  C:\Windows\System\kdpjhEE.exe
  2⤵
  PID:5932
- C:\Windows\System\wLJfDWw.exe
  C:\Windows\System\wLJfDWw.exe
  2⤵
  PID:6008
- C:\Windows\System\CJBfMNP.exe
  C:\Windows\System\CJBfMNP.exe
  2⤵
  PID:872
- C:\Windows\System\HIqOYVs.exe
  C:\Windows\System\HIqOYVs.exe
  2⤵
  PID:2224
- C:\Windows\System\AZLFnOM.exe
  C:\Windows\System\AZLFnOM.exe
  2⤵
  PID:6040
- C:\Windows\System\wFNJTBL.exe
  C:\Windows\System\wFNJTBL.exe
  2⤵
  PID:6072
- C:\Windows\System\iAuxRMV.exe
  C:\Windows\System\iAuxRMV.exe
  2⤵
  PID:6120
- C:\Windows\System\JSrljNN.exe
  C:\Windows\System\JSrljNN.exe
  2⤵
  PID:2204
- C:\Windows\System\wdwVcZE.exe
  C:\Windows\System\wdwVcZE.exe
  2⤵
  PID:992
- C:\Windows\System\LChczyu.exe
  C:\Windows\System\LChczyu.exe
  2⤵
  PID:4268
- C:\Windows\System\kABdLWg.exe
  C:\Windows\System\kABdLWg.exe
  2⤵
  PID:2608
- C:\Windows\System\xSOTIAL.exe
  C:\Windows\System\xSOTIAL.exe
  2⤵
  PID:5132
- C:\Windows\System\JlRBPwH.exe
  C:\Windows\System\JlRBPwH.exe
  2⤵
  PID:5336
- C:\Windows\System\thCpUxp.exe
  C:\Windows\System\thCpUxp.exe
  2⤵
  PID:5304
- C:\Windows\System\ENtIaCu.exe
  C:\Windows\System\ENtIaCu.exe
  2⤵
  PID:5428
- C:\Windows\System\cEHkktx.exe
  C:\Windows\System\cEHkktx.exe
  2⤵
  PID:5604
- C:\Windows\System\AGIMdCV.exe
  C:\Windows\System\AGIMdCV.exe
  2⤵
  PID:5748
- C:\Windows\System\jCaDuQv.exe
  C:\Windows\System\jCaDuQv.exe
  2⤵
  PID:5996
- C:\Windows\System\jBTcnei.exe
  C:\Windows\System\jBTcnei.exe
  2⤵
  PID:1120
- C:\Windows\System\tXpNPUO.exe
  C:\Windows\System\tXpNPUO.exe
  2⤵
  PID:896
- C:\Windows\System\lURrduf.exe
  C:\Windows\System\lURrduf.exe
  2⤵
  PID:1628
- C:\Windows\System\PhOfzxA.exe
  C:\Windows\System\PhOfzxA.exe
  2⤵
  PID:2548
- C:\Windows\System\WTUmhIX.exe
  C:\Windows\System\WTUmhIX.exe
  2⤵
  PID:2240
- C:\Windows\System\buwSLUN.exe
  C:\Windows\System\buwSLUN.exe
  2⤵
  PID:4344
- C:\Windows\System\qpQlUJF.exe
  C:\Windows\System\qpQlUJF.exe
  2⤵
  PID:4972
- C:\Windows\System\pduSjAa.exe
  C:\Windows\System\pduSjAa.exe
  2⤵
  PID:5556
- C:\Windows\System\wfcRSnM.exe
  C:\Windows\System\wfcRSnM.exe
  2⤵
  PID:5380
- C:\Windows\System\wNKtnBd.exe
  C:\Windows\System\wNKtnBd.exe
  2⤵
  PID:5800
- C:\Windows\System\nqzEwxA.exe
  C:\Windows\System\nqzEwxA.exe
  2⤵
  PID:5416
- C:\Windows\System\fGKnNDN.exe
  C:\Windows\System\fGKnNDN.exe
  2⤵
  PID:2556
- C:\Windows\System\DHhsZmT.exe
  C:\Windows\System\DHhsZmT.exe
  2⤵
  PID:760
- C:\Windows\System\pMGJXrb.exe
  C:\Windows\System\pMGJXrb.exe
  2⤵
  PID:3792
- C:\Windows\System\blHMESC.exe
  C:\Windows\System\blHMESC.exe
  2⤵
  PID:2876
- C:\Windows\System\RxdkISU.exe
  C:\Windows\System\RxdkISU.exe
  2⤵
  PID:5528
- C:\Windows\System\YGuyheY.exe
  C:\Windows\System\YGuyheY.exe
  2⤵
  PID:6156
- C:\Windows\System\yfyMtvD.exe
  C:\Windows\System\yfyMtvD.exe
  2⤵
  PID:6172
- C:\Windows\System\mMZoNqb.exe
  C:\Windows\System\mMZoNqb.exe
  2⤵
  PID:6188
- C:\Windows\System\cMJlQDt.exe
  C:\Windows\System\cMJlQDt.exe
  2⤵
  PID:6204
- C:\Windows\System\BUuoTyB.exe
  C:\Windows\System\BUuoTyB.exe
  2⤵
  PID:6220
- C:\Windows\System\KLGUfNa.exe
  C:\Windows\System\KLGUfNa.exe
  2⤵
  PID:6236
- C:\Windows\System\gDgnugf.exe
  C:\Windows\System\gDgnugf.exe
  2⤵
  PID:6252
- C:\Windows\System\xQAoaHL.exe
  C:\Windows\System\xQAoaHL.exe
  2⤵
  PID:6268
- C:\Windows\System\cLXboiQ.exe
  C:\Windows\System\cLXboiQ.exe
  2⤵
  PID:6284
- C:\Windows\System\xEhexeg.exe
  C:\Windows\System\xEhexeg.exe
  2⤵
  PID:6300
- C:\Windows\System\KKQEdPg.exe
  C:\Windows\System\KKQEdPg.exe
  2⤵
  PID:6316
- C:\Windows\System\kPQNTOo.exe
  C:\Windows\System\kPQNTOo.exe
  2⤵
  PID:6332
- C:\Windows\System\FtjfnZm.exe
  C:\Windows\System\FtjfnZm.exe
  2⤵
  PID:6348
- C:\Windows\System\WSjmxRr.exe
  C:\Windows\System\WSjmxRr.exe
  2⤵
  PID:6364
- C:\Windows\System\BByLHjl.exe
  C:\Windows\System\BByLHjl.exe
  2⤵
  PID:6380
- C:\Windows\System\pqaiZJC.exe
  C:\Windows\System\pqaiZJC.exe
  2⤵
  PID:6396
- C:\Windows\System\CdFwGfy.exe
  C:\Windows\System\CdFwGfy.exe
  2⤵
  PID:6412
- C:\Windows\System\TIKtjQI.exe
  C:\Windows\System\TIKtjQI.exe
  2⤵
  PID:6428
- C:\Windows\System\NmAwedF.exe
  C:\Windows\System\NmAwedF.exe
  2⤵
  PID:6444
- C:\Windows\System\wTtFWkw.exe
  C:\Windows\System\wTtFWkw.exe
  2⤵
  PID:6460
- C:\Windows\System\lMlxKiu.exe
  C:\Windows\System\lMlxKiu.exe
  2⤵
  PID:6476
- C:\Windows\System\ztXzLhv.exe
  C:\Windows\System\ztXzLhv.exe
  2⤵
  PID:6496
- C:\Windows\System\CXfzcjO.exe
  C:\Windows\System\CXfzcjO.exe
  2⤵
  PID:6512
- C:\Windows\System\bBVVKxJ.exe
  C:\Windows\System\bBVVKxJ.exe
  2⤵
  PID:6528
- C:\Windows\System\keITiWo.exe
  C:\Windows\System\keITiWo.exe
  2⤵
  PID:6544
- C:\Windows\System\NFwKENv.exe
  C:\Windows\System\NFwKENv.exe
  2⤵
  PID:6560
- C:\Windows\System\ByCvAZJ.exe
  C:\Windows\System\ByCvAZJ.exe
  2⤵
  PID:6576
- C:\Windows\System\QNvITZy.exe
  C:\Windows\System\QNvITZy.exe
  2⤵
  PID:6592
- C:\Windows\System\jWolmOS.exe
  C:\Windows\System\jWolmOS.exe
  2⤵
  PID:6608
- C:\Windows\System\ClsXMpq.exe
  C:\Windows\System\ClsXMpq.exe
  2⤵
  PID:6624
- C:\Windows\System\gwDUrni.exe
  C:\Windows\System\gwDUrni.exe
  2⤵
  PID:6640
- C:\Windows\System\lTXbOJP.exe
  C:\Windows\System\lTXbOJP.exe
  2⤵
  PID:6656
- C:\Windows\System\IgTaRcv.exe
  C:\Windows\System\IgTaRcv.exe
  2⤵
  PID:6672
- C:\Windows\System\vyHUHgH.exe
  C:\Windows\System\vyHUHgH.exe
  2⤵
  PID:6688
- C:\Windows\System\QTnyVML.exe
  C:\Windows\System\QTnyVML.exe
  2⤵
  PID:6704
- C:\Windows\System\DzZWTNE.exe
  C:\Windows\System\DzZWTNE.exe
  2⤵
  PID:6720
- C:\Windows\System\rJAGzjb.exe
  C:\Windows\System\rJAGzjb.exe
  2⤵
  PID:6736
- C:\Windows\System\cLXmlmI.exe
  C:\Windows\System\cLXmlmI.exe
  2⤵
  PID:6752
- C:\Windows\System\ynaGzPC.exe
  C:\Windows\System\ynaGzPC.exe
  2⤵
  PID:6768
- C:\Windows\System\QfDnKik.exe
  C:\Windows\System\QfDnKik.exe
  2⤵
  PID:6784
- C:\Windows\System\yYmRqvY.exe
  C:\Windows\System\yYmRqvY.exe
  2⤵
  PID:6800
- C:\Windows\System\qNUGaCu.exe
  C:\Windows\System\qNUGaCu.exe
  2⤵
  PID:6816
- C:\Windows\System\YteIwJt.exe
  C:\Windows\System\YteIwJt.exe
  2⤵
  PID:6832
- C:\Windows\System\skxUDxE.exe
  C:\Windows\System\skxUDxE.exe
  2⤵
  PID:6848
- C:\Windows\System\HhZtySg.exe
  C:\Windows\System\HhZtySg.exe
  2⤵
  PID:6864
- C:\Windows\System\hxzPQEK.exe
  C:\Windows\System\hxzPQEK.exe
  2⤵
  PID:6880
- C:\Windows\System\cuIgzBi.exe
  C:\Windows\System\cuIgzBi.exe
  2⤵
  PID:6896
- C:\Windows\System\EWfJCaa.exe
  C:\Windows\System\EWfJCaa.exe
  2⤵
  PID:6912
- C:\Windows\System\iZRKaiu.exe
  C:\Windows\System\iZRKaiu.exe
  2⤵
  PID:6928
- C:\Windows\System\hgZszYF.exe
  C:\Windows\System\hgZszYF.exe
  2⤵
  PID:6944
- C:\Windows\System\WTpAFBC.exe
  C:\Windows\System\WTpAFBC.exe
  2⤵
  PID:6960
- C:\Windows\System\cHGeYPn.exe
  C:\Windows\System\cHGeYPn.exe
  2⤵
  PID:6976
- C:\Windows\System\VwPygpi.exe
  C:\Windows\System\VwPygpi.exe
  2⤵
  PID:6992
- C:\Windows\System\bJRCHhx.exe
  C:\Windows\System\bJRCHhx.exe
  2⤵
  PID:7008
- C:\Windows\System\cWWLBMz.exe
  C:\Windows\System\cWWLBMz.exe
  2⤵
  PID:7024
- C:\Windows\System\fzhxnXJ.exe
  C:\Windows\System\fzhxnXJ.exe
  2⤵
  PID:7040
- C:\Windows\System\zozrtnQ.exe
  C:\Windows\System\zozrtnQ.exe
  2⤵
  PID:7056
- C:\Windows\System\ZpbFJAc.exe
  C:\Windows\System\ZpbFJAc.exe
  2⤵
  PID:7072
- C:\Windows\System\fRIrIiX.exe
  C:\Windows\System\fRIrIiX.exe
  2⤵
  PID:7088
- C:\Windows\System\wWKKgvG.exe
  C:\Windows\System\wWKKgvG.exe
  2⤵
  PID:7104
- C:\Windows\System\CCxCerN.exe
  C:\Windows\System\CCxCerN.exe
  2⤵
  PID:7120
- C:\Windows\System\BpJHIZo.exe
  C:\Windows\System\BpJHIZo.exe
  2⤵
  PID:7136
- C:\Windows\System\gdYesLV.exe
  C:\Windows\System\gdYesLV.exe
  2⤵
  PID:7152
- C:\Windows\System\kUnviuQ.exe
  C:\Windows\System\kUnviuQ.exe
  2⤵
  PID:2932
- C:\Windows\System\qFOOEQX.exe
  C:\Windows\System\qFOOEQX.exe
  2⤵
  PID:5684
- C:\Windows\System\MoImsKM.exe
  C:\Windows\System\MoImsKM.exe
  2⤵
  PID:1884
- C:\Windows\System\ZDfvket.exe
  C:\Windows\System\ZDfvket.exe
  2⤵
  PID:3040
- C:\Windows\System\YoIwGZX.exe
  C:\Windows\System\YoIwGZX.exe
  2⤵
  PID:2052
- C:\Windows\System\fXrMbDD.exe
  C:\Windows\System\fXrMbDD.exe
  2⤵
  PID:6180
- C:\Windows\System\NdKqyUg.exe
  C:\Windows\System\NdKqyUg.exe
  2⤵
  PID:6184
- C:\Windows\System\smgoFOn.exe
  C:\Windows\System\smgoFOn.exe
  2⤵
  PID:6232
- C:\Windows\System\iGJRuwp.exe
  C:\Windows\System\iGJRuwp.exe
  2⤵
  PID:6264
- C:\Windows\System\BvkLNvN.exe
  C:\Windows\System\BvkLNvN.exe
  2⤵
  PID:6296
- C:\Windows\System\QAXgwnE.exe
  C:\Windows\System\QAXgwnE.exe
  2⤵
  PID:1680
- C:\Windows\System\iygixuP.exe
  C:\Windows\System\iygixuP.exe
  2⤵
  PID:6324
- C:\Windows\System\dyYhWLB.exe
  C:\Windows\System\dyYhWLB.exe
  2⤵
  PID:6360
- C:\Windows\System\iwcsjdD.exe
  C:\Windows\System\iwcsjdD.exe
  2⤵
  PID:6372
- C:\Windows\System\FhvEoXi.exe
  C:\Windows\System\FhvEoXi.exe
  2⤵
  PID:6420
- C:\Windows\System\KzKyHYn.exe
  C:\Windows\System\KzKyHYn.exe
  2⤵
  PID:7180
- C:\Windows\System\olDvDHS.exe
  C:\Windows\System\olDvDHS.exe
  2⤵
  PID:7196
- C:\Windows\System\ZCVjGcK.exe
  C:\Windows\System\ZCVjGcK.exe
  2⤵
  PID:7212
- C:\Windows\System\tAHomQp.exe
  C:\Windows\System\tAHomQp.exe
  2⤵
  PID:7228
- C:\Windows\System\FWSOWNI.exe
  C:\Windows\System\FWSOWNI.exe
  2⤵
  PID:7244
- C:\Windows\System\KLhNiZf.exe
  C:\Windows\System\KLhNiZf.exe
  2⤵
  PID:7260
- C:\Windows\System\xOsPMZS.exe
  C:\Windows\System\xOsPMZS.exe
  2⤵
  PID:7276
- C:\Windows\System\XBWYHvX.exe
  C:\Windows\System\XBWYHvX.exe
  2⤵
  PID:7292
- C:\Windows\System\rwOdAbe.exe
  C:\Windows\System\rwOdAbe.exe
  2⤵
  PID:7308
- C:\Windows\System\hkeuPSL.exe
  C:\Windows\System\hkeuPSL.exe
  2⤵
  PID:7324
- C:\Windows\System\ISQNsRl.exe
  C:\Windows\System\ISQNsRl.exe
  2⤵
  PID:7340
- C:\Windows\System\LXUkwWC.exe
  C:\Windows\System\LXUkwWC.exe
  2⤵
  PID:7356
- C:\Windows\System\oPUdzmB.exe
  C:\Windows\System\oPUdzmB.exe
  2⤵
  PID:7372
- C:\Windows\System\fFIfROl.exe
  C:\Windows\System\fFIfROl.exe
  2⤵
  PID:7388
- C:\Windows\System\JwxvXwX.exe
  C:\Windows\System\JwxvXwX.exe
  2⤵
  PID:7404
- C:\Windows\System\cwsIbiE.exe
  C:\Windows\System\cwsIbiE.exe
  2⤵
  PID:7420
- C:\Windows\System\evHkQLR.exe
  C:\Windows\System\evHkQLR.exe
  2⤵
  PID:7436
- C:\Windows\System\igRlaAd.exe
  C:\Windows\System\igRlaAd.exe
  2⤵
  PID:7452
- C:\Windows\System\qIOPZbZ.exe
  C:\Windows\System\qIOPZbZ.exe
  2⤵
  PID:7468
- C:\Windows\System\XiSHSDb.exe
  C:\Windows\System\XiSHSDb.exe
  2⤵
  PID:7484
- C:\Windows\System\LCLKYis.exe
  C:\Windows\System\LCLKYis.exe
  2⤵
  PID:7500
- C:\Windows\System\sQDPOSa.exe
  C:\Windows\System\sQDPOSa.exe
  2⤵
  PID:7516
- C:\Windows\System\yiRURTO.exe
  C:\Windows\System\yiRURTO.exe
  2⤵
  PID:7532
- C:\Windows\System\DudCRym.exe
  C:\Windows\System\DudCRym.exe
  2⤵
  PID:7548
- C:\Windows\System\yhPTPpo.exe
  C:\Windows\System\yhPTPpo.exe
  2⤵
  PID:7564
- C:\Windows\System\olqJqJl.exe
  C:\Windows\System\olqJqJl.exe
  2⤵
  PID:7580
- C:\Windows\System\ceWnSDv.exe
  C:\Windows\System\ceWnSDv.exe
  2⤵
  PID:7596
- C:\Windows\System\KmdKPBO.exe
  C:\Windows\System\KmdKPBO.exe
  2⤵
  PID:7612
- C:\Windows\System\aLrRXUB.exe
  C:\Windows\System\aLrRXUB.exe
  2⤵
  PID:7628
- C:\Windows\System\YzLoTHw.exe
  C:\Windows\System\YzLoTHw.exe
  2⤵
  PID:7644
- C:\Windows\System\zPYeKXi.exe
  C:\Windows\System\zPYeKXi.exe
  2⤵
  PID:7660
- C:\Windows\System\SmAtmuu.exe
  C:\Windows\System\SmAtmuu.exe
  2⤵
  PID:7676
- C:\Windows\System\lGbwUhI.exe
  C:\Windows\System\lGbwUhI.exe
  2⤵
  PID:7692
- C:\Windows\System\QIQpuDL.exe
  C:\Windows\System\QIQpuDL.exe
  2⤵
  PID:7708
- C:\Windows\System\ECkTfEt.exe
  C:\Windows\System\ECkTfEt.exe
  2⤵
  PID:7724
- C:\Windows\System\KvkMKcg.exe
  C:\Windows\System\KvkMKcg.exe
  2⤵
  PID:7740
- C:\Windows\System\GodXSCj.exe
  C:\Windows\System\GodXSCj.exe
  2⤵
  PID:7756
- C:\Windows\System\uPJgCme.exe
  C:\Windows\System\uPJgCme.exe
  2⤵
  PID:7772
- C:\Windows\System\JIkpkHu.exe
  C:\Windows\System\JIkpkHu.exe
  2⤵
  PID:7788
- C:\Windows\System\rNndwAg.exe
  C:\Windows\System\rNndwAg.exe
  2⤵
  PID:7804
- C:\Windows\System\gzvFZot.exe
  C:\Windows\System\gzvFZot.exe
  2⤵
  PID:7820
- C:\Windows\System\EvAmxKT.exe
  C:\Windows\System\EvAmxKT.exe
  2⤵
  PID:7836
- C:\Windows\System\xijYOZu.exe
  C:\Windows\System\xijYOZu.exe
  2⤵
  PID:7852
- C:\Windows\System\MhDFWbz.exe
  C:\Windows\System\MhDFWbz.exe
  2⤵
  PID:7868
- C:\Windows\System\flTlBPN.exe
  C:\Windows\System\flTlBPN.exe
  2⤵
  PID:7884
- C:\Windows\System\qNNMWhQ.exe
  C:\Windows\System\qNNMWhQ.exe
  2⤵
  PID:7900
- C:\Windows\System\XnDYbuP.exe
  C:\Windows\System\XnDYbuP.exe
  2⤵
  PID:7916
- C:\Windows\System\eLRWiRj.exe
  C:\Windows\System\eLRWiRj.exe
  2⤵
  PID:7932
- C:\Windows\System\jZrZPig.exe
  C:\Windows\System\jZrZPig.exe
  2⤵
  PID:7948
- C:\Windows\System\TPxEtcH.exe
  C:\Windows\System\TPxEtcH.exe
  2⤵
  PID:7964
- C:\Windows\System\DyjkMcQ.exe
  C:\Windows\System\DyjkMcQ.exe
  2⤵
  PID:7980
- C:\Windows\System\AocFCmW.exe
  C:\Windows\System\AocFCmW.exe
  2⤵
  PID:7996
- C:\Windows\System\MPejNZG.exe
  C:\Windows\System\MPejNZG.exe
  2⤵
  PID:8012
- C:\Windows\System\ZOeTTxl.exe
  C:\Windows\System\ZOeTTxl.exe
  2⤵
  PID:8028
- C:\Windows\System\XNsPKai.exe
  C:\Windows\System\XNsPKai.exe
  2⤵
  PID:8044
- C:\Windows\System\LpNqLRK.exe
  C:\Windows\System\LpNqLRK.exe
  2⤵
  PID:8060
- C:\Windows\System\bfeFAdr.exe
  C:\Windows\System\bfeFAdr.exe
  2⤵
  PID:8076
- C:\Windows\System\KIjsnsl.exe
  C:\Windows\System\KIjsnsl.exe
  2⤵
  PID:8092
- C:\Windows\System\ZDJgAil.exe
  C:\Windows\System\ZDJgAil.exe
  2⤵
  PID:8108
- C:\Windows\System\UXYyrdk.exe
  C:\Windows\System\UXYyrdk.exe
  2⤵
  PID:8124
- C:\Windows\System\aWCrjNA.exe
  C:\Windows\System\aWCrjNA.exe
  2⤵
  PID:8140
- C:\Windows\System\Mgukdun.exe
  C:\Windows\System\Mgukdun.exe
  2⤵
  PID:8156
- C:\Windows\System\qGgJLnT.exe
  C:\Windows\System\qGgJLnT.exe
  2⤵
  PID:8172
- C:\Windows\System\bZkgxxP.exe
  C:\Windows\System\bZkgxxP.exe
  2⤵
  PID:8188
- C:\Windows\System\ARsweXB.exe
  C:\Windows\System\ARsweXB.exe
  2⤵
  PID:8208
- C:\Windows\System\elpvXQl.exe
  C:\Windows\System\elpvXQl.exe
  2⤵
  PID:8224
- C:\Windows\System\rDOJQMT.exe
  C:\Windows\System\rDOJQMT.exe
  2⤵
  PID:8240
- C:\Windows\System\egbXuxL.exe
  C:\Windows\System\egbXuxL.exe
  2⤵
  PID:8256
- C:\Windows\System\ZkZucAZ.exe
  C:\Windows\System\ZkZucAZ.exe
  2⤵
  PID:8272
- C:\Windows\System\hBnWdHz.exe
  C:\Windows\System\hBnWdHz.exe
  2⤵
  PID:8288
- C:\Windows\System\hYhJRGa.exe
  C:\Windows\System\hYhJRGa.exe
  2⤵
  PID:8304
- C:\Windows\System\LxmMugB.exe
  C:\Windows\System\LxmMugB.exe
  2⤵
  PID:8320
- C:\Windows\System\aRJPUXG.exe
  C:\Windows\System\aRJPUXG.exe
  2⤵
  PID:8336
- C:\Windows\System\SArwZSJ.exe
  C:\Windows\System\SArwZSJ.exe
  2⤵
  PID:8352
- C:\Windows\System\YqQETPN.exe
  C:\Windows\System\YqQETPN.exe
  2⤵
  PID:8368
- C:\Windows\System\vnrqDcW.exe
  C:\Windows\System\vnrqDcW.exe
  2⤵
  PID:8384
- C:\Windows\System\GKLmnVM.exe
  C:\Windows\System\GKLmnVM.exe
  2⤵
  PID:8400
- C:\Windows\System\FMNxfAZ.exe
  C:\Windows\System\FMNxfAZ.exe
  2⤵
  PID:8416
- C:\Windows\System\hdwdDXs.exe
  C:\Windows\System\hdwdDXs.exe
  2⤵
  PID:8432
- C:\Windows\System\DZEHUqt.exe
  C:\Windows\System\DZEHUqt.exe
  2⤵
  PID:8448
- C:\Windows\System\OMVINMx.exe
  C:\Windows\System\OMVINMx.exe
  2⤵
  PID:8464
- C:\Windows\System\rqvEwZB.exe
  C:\Windows\System\rqvEwZB.exe
  2⤵
  PID:8480
- C:\Windows\System\DxFaCte.exe
  C:\Windows\System\DxFaCte.exe
  2⤵
  PID:8496
- C:\Windows\System\iGoppvD.exe
  C:\Windows\System\iGoppvD.exe
  2⤵
  PID:8512
- C:\Windows\System\JTosdLv.exe
  C:\Windows\System\JTosdLv.exe
  2⤵
  PID:8528
- C:\Windows\System\XIwEFRN.exe
  C:\Windows\System\XIwEFRN.exe
  2⤵
  PID:8544
- C:\Windows\System\ylcGusJ.exe
  C:\Windows\System\ylcGusJ.exe
  2⤵
  PID:8560
- C:\Windows\System\CCnnHtX.exe
  C:\Windows\System\CCnnHtX.exe
  2⤵
  PID:8576
- C:\Windows\System\jKHERhO.exe
  C:\Windows\System\jKHERhO.exe
  2⤵
  PID:8592
- C:\Windows\System\EQOhoLJ.exe
  C:\Windows\System\EQOhoLJ.exe
  2⤵
  PID:8608
- C:\Windows\System\GBYYkWQ.exe
  C:\Windows\System\GBYYkWQ.exe
  2⤵
  PID:8624
- C:\Windows\System\vXNLUJq.exe
  C:\Windows\System\vXNLUJq.exe
  2⤵
  PID:8640
- C:\Windows\System\wSNIsbs.exe
  C:\Windows\System\wSNIsbs.exe
  2⤵
  PID:8656
- C:\Windows\System\mZbPNfU.exe
  C:\Windows\System\mZbPNfU.exe
  2⤵
  PID:8672
- C:\Windows\System\WlJHhWZ.exe
  C:\Windows\System\WlJHhWZ.exe
  2⤵
  PID:8688
- C:\Windows\System\SVxciDY.exe
  C:\Windows\System\SVxciDY.exe
  2⤵
  PID:8704
- C:\Windows\System\oxwNROH.exe
  C:\Windows\System\oxwNROH.exe
  2⤵
  PID:8724
- C:\Windows\System\dXxQtUP.exe
  C:\Windows\System\dXxQtUP.exe
  2⤵
  PID:8740
- C:\Windows\System\uJjqpei.exe
  C:\Windows\System\uJjqpei.exe
  2⤵
  PID:8756
- C:\Windows\System\JyBHGqJ.exe
  C:\Windows\System\JyBHGqJ.exe
  2⤵
  PID:8772
- C:\Windows\System\pOOFkDg.exe
  C:\Windows\System\pOOFkDg.exe
  2⤵
  PID:8788
- C:\Windows\System\qHXfnvq.exe
  C:\Windows\System\qHXfnvq.exe
  2⤵
  PID:8804
- C:\Windows\System\KPlZfDW.exe
  C:\Windows\System\KPlZfDW.exe
  2⤵
  PID:8820
- C:\Windows\System\qOxWzrV.exe
  C:\Windows\System\qOxWzrV.exe
  2⤵
  PID:8836
- C:\Windows\System\uCPfptA.exe
  C:\Windows\System\uCPfptA.exe
  2⤵
  PID:8852
- C:\Windows\System\dbUSkIA.exe
  C:\Windows\System\dbUSkIA.exe
  2⤵
  PID:8868
- C:\Windows\System\eiYHgnH.exe
  C:\Windows\System\eiYHgnH.exe
  2⤵
  PID:8884
- C:\Windows\System\kHNOPou.exe
  C:\Windows\System\kHNOPou.exe
  2⤵
  PID:8900
- C:\Windows\System\zOeNIim.exe
  C:\Windows\System\zOeNIim.exe
  2⤵
  PID:8916
- C:\Windows\System\nIbPbvC.exe
  C:\Windows\System\nIbPbvC.exe
  2⤵
  PID:8932
- C:\Windows\System\yoQKvxH.exe
  C:\Windows\System\yoQKvxH.exe
  2⤵
  PID:8948
- C:\Windows\System\GSFkKBN.exe
  C:\Windows\System\GSFkKBN.exe
  2⤵
  PID:8964
- C:\Windows\System\UwRrqlA.exe
  C:\Windows\System\UwRrqlA.exe
  2⤵
  PID:8980
- C:\Windows\System\xcIrStp.exe
  C:\Windows\System\xcIrStp.exe
  2⤵
  PID:8996
- C:\Windows\System\cvMNSfI.exe
  C:\Windows\System\cvMNSfI.exe
  2⤵
  PID:9012
- C:\Windows\System\lgrXRDV.exe
  C:\Windows\System\lgrXRDV.exe
  2⤵
  PID:9028
- C:\Windows\System\PshqHMx.exe
  C:\Windows\System\PshqHMx.exe
  2⤵
  PID:9044
- C:\Windows\System\UYuJgWk.exe
  C:\Windows\System\UYuJgWk.exe
  2⤵
  PID:9060
- C:\Windows\System\gmPrRqe.exe
  C:\Windows\System\gmPrRqe.exe
  2⤵
  PID:9076
- C:\Windows\System\iZCsVWa.exe
  C:\Windows\System\iZCsVWa.exe
  2⤵
  PID:9092
- C:\Windows\System\nrrzriV.exe
  C:\Windows\System\nrrzriV.exe
  2⤵
  PID:9108
- C:\Windows\System\GQRhlgF.exe
  C:\Windows\System\GQRhlgF.exe
  2⤵
  PID:9124
- C:\Windows\System\YlDvxts.exe
  C:\Windows\System\YlDvxts.exe
  2⤵
  PID:9140
- C:\Windows\System\iVzYmcl.exe
  C:\Windows\System\iVzYmcl.exe
  2⤵
  PID:9156
- C:\Windows\System\GnAVCUM.exe
  C:\Windows\System\GnAVCUM.exe
  2⤵
  PID:9172
- C:\Windows\System\FSIoUia.exe
  C:\Windows\System\FSIoUia.exe
  2⤵
  PID:9188
- C:\Windows\System\LQbqiuB.exe
  C:\Windows\System\LQbqiuB.exe
  2⤵
  PID:9204
- C:\Windows\System\BiqDrJy.exe
  C:\Windows\System\BiqDrJy.exe
  2⤵
  PID:9224
- C:\Windows\System\ANQqNfs.exe
  C:\Windows\System\ANQqNfs.exe
  2⤵
  PID:9240
- C:\Windows\System\cCDsgQq.exe
  C:\Windows\System\cCDsgQq.exe
  2⤵
  PID:9256
- C:\Windows\System\lCLZXTs.exe
  C:\Windows\System\lCLZXTs.exe
  2⤵
  PID:9272
- C:\Windows\System\HKubVnO.exe
  C:\Windows\System\HKubVnO.exe
  2⤵
  PID:9288
- C:\Windows\System\EOEkLuB.exe
  C:\Windows\System\EOEkLuB.exe
  2⤵
  PID:9304
- C:\Windows\System\tXMPwyb.exe
  C:\Windows\System\tXMPwyb.exe
  2⤵
  PID:9320
- C:\Windows\System\gRkHioK.exe
  C:\Windows\System\gRkHioK.exe
  2⤵
  PID:9336
- C:\Windows\System\CzDOtgq.exe
  C:\Windows\System\CzDOtgq.exe
  2⤵
  PID:9352
- C:\Windows\System\HQlNUpj.exe
  C:\Windows\System\HQlNUpj.exe
  2⤵
  PID:9368
- C:\Windows\System\vNuMVag.exe
  C:\Windows\System\vNuMVag.exe
  2⤵
  PID:9384
- C:\Windows\System\UsNKMtr.exe
  C:\Windows\System\UsNKMtr.exe
  2⤵
  PID:9400
- C:\Windows\System\QXlQaDO.exe
  C:\Windows\System\QXlQaDO.exe
  2⤵
  PID:9416
- C:\Windows\System\viyZxoC.exe
  C:\Windows\System\viyZxoC.exe
  2⤵
  PID:9432
- C:\Windows\System\omTsoPu.exe
  C:\Windows\System\omTsoPu.exe
  2⤵
  PID:9448
- C:\Windows\System\yhirzkZ.exe
  C:\Windows\System\yhirzkZ.exe
  2⤵
  PID:9464
- C:\Windows\System\dmxDXqM.exe
  C:\Windows\System\dmxDXqM.exe
  2⤵
  PID:9480
- C:\Windows\System\zobpeKd.exe
  C:\Windows\System\zobpeKd.exe
  2⤵
  PID:9496
- C:\Windows\System\ryuezew.exe
  C:\Windows\System\ryuezew.exe
  2⤵
  PID:9512
- C:\Windows\System\QQRMUax.exe
  C:\Windows\System\QQRMUax.exe
  2⤵
  PID:9528
- C:\Windows\System\CFcbyRo.exe
  C:\Windows\System\CFcbyRo.exe
  2⤵
  PID:9544
- C:\Windows\System\UBKfAPW.exe
  C:\Windows\System\UBKfAPW.exe
  2⤵
  PID:9560
- C:\Windows\System\THcogQc.exe
  C:\Windows\System\THcogQc.exe
  2⤵
  PID:9576
- C:\Windows\System\MwvIzmx.exe
  C:\Windows\System\MwvIzmx.exe
  2⤵
  PID:9592
- C:\Windows\System\kLyKyXu.exe
  C:\Windows\System\kLyKyXu.exe
  2⤵
  PID:9608
- C:\Windows\System\CSGBsay.exe
  C:\Windows\System\CSGBsay.exe
  2⤵
  PID:9624
- C:\Windows\System\cgfDrYs.exe
  C:\Windows\System\cgfDrYs.exe
  2⤵
  PID:9640
- C:\Windows\System\gGSWHAI.exe
  C:\Windows\System\gGSWHAI.exe
  2⤵
  PID:9656
- C:\Windows\System\NeInhjE.exe
  C:\Windows\System\NeInhjE.exe
  2⤵
  PID:9672
- C:\Windows\System\VmvCGoV.exe
  C:\Windows\System\VmvCGoV.exe
  2⤵
  PID:9688
- C:\Windows\System\mOZTIns.exe
  C:\Windows\System\mOZTIns.exe
  2⤵
  PID:9704
- C:\Windows\System\qOtActN.exe
  C:\Windows\System\qOtActN.exe
  2⤵
  PID:9724
- C:\Windows\System\eJfVXLx.exe
  C:\Windows\System\eJfVXLx.exe
  2⤵
  PID:9740
- C:\Windows\System\VYoBqNy.exe
  C:\Windows\System\VYoBqNy.exe
  2⤵
  PID:9760
- C:\Windows\System\xyggRPu.exe
  C:\Windows\System\xyggRPu.exe
  2⤵
  PID:9776
- C:\Windows\System\YQPvlHy.exe
  C:\Windows\System\YQPvlHy.exe
  2⤵
  PID:9792
- C:\Windows\System\JIBLItG.exe
  C:\Windows\System\JIBLItG.exe
  2⤵
  PID:9808
- C:\Windows\System\ItUYUPn.exe
  C:\Windows\System\ItUYUPn.exe
  2⤵
  PID:9824
- C:\Windows\System\DvLSnoq.exe
  C:\Windows\System\DvLSnoq.exe
  2⤵
  PID:9840
- C:\Windows\System\eivVuXv.exe
  C:\Windows\System\eivVuXv.exe
  2⤵
  PID:9856
- C:\Windows\System\VYQpMhZ.exe
  C:\Windows\System\VYQpMhZ.exe
  2⤵
  PID:9872
- C:\Windows\System\ZZJOwDA.exe
  C:\Windows\System\ZZJOwDA.exe
  2⤵
  PID:9888
- C:\Windows\System\SxhfJAn.exe
  C:\Windows\System\SxhfJAn.exe
  2⤵
  PID:9904
- C:\Windows\System\kWpPIYO.exe
  C:\Windows\System\kWpPIYO.exe
  2⤵
  PID:9920
- C:\Windows\System\eEeekJP.exe
  C:\Windows\System\eEeekJP.exe
  2⤵
  PID:9936
- C:\Windows\System\SldLloh.exe
  C:\Windows\System\SldLloh.exe
  2⤵
  PID:9952
- C:\Windows\System\hmzBJrh.exe
  C:\Windows\System\hmzBJrh.exe
  2⤵
  PID:9968
- C:\Windows\System\KDrYvib.exe
  C:\Windows\System\KDrYvib.exe
  2⤵
  PID:9984
- C:\Windows\System\WevAEsO.exe
  C:\Windows\System\WevAEsO.exe
  2⤵
  PID:10000
- C:\Windows\System\SyWOdWk.exe
  C:\Windows\System\SyWOdWk.exe
  2⤵
  PID:10016
- C:\Windows\System\DOngYBx.exe
  C:\Windows\System\DOngYBx.exe
  2⤵
  PID:10036
- C:\Windows\System\FqmnhGH.exe
  C:\Windows\System\FqmnhGH.exe
  2⤵
  PID:10088
- C:\Windows\System\YjRiStI.exe
  C:\Windows\System\YjRiStI.exe
  2⤵
  PID:10104
- C:\Windows\System\JSxXeJm.exe
  C:\Windows\System\JSxXeJm.exe
  2⤵
  PID:10120
- C:\Windows\System\tVdsBQE.exe
  C:\Windows\System\tVdsBQE.exe
  2⤵
  PID:10136
- C:\Windows\System\PDcjvGG.exe
  C:\Windows\System\PDcjvGG.exe
  2⤵
  PID:10152
- C:\Windows\System\EWzBtxo.exe
  C:\Windows\System\EWzBtxo.exe
  2⤵
  PID:10168
- C:\Windows\System\MPLIdfa.exe
  C:\Windows\System\MPLIdfa.exe
  2⤵
  PID:10184
- C:\Windows\System\SRwkmKK.exe
  C:\Windows\System\SRwkmKK.exe
  2⤵
  PID:10200
- C:\Windows\System\wIpozXV.exe
  C:\Windows\System\wIpozXV.exe
  2⤵
  PID:10216
- C:\Windows\System\FrMjdAW.exe
  C:\Windows\System\FrMjdAW.exe
  2⤵
  PID:10232
- C:\Windows\System\hWvSHxf.exe
  C:\Windows\System\hWvSHxf.exe
  2⤵
  PID:10252
- C:\Windows\System\fazgeeR.exe
  C:\Windows\System\fazgeeR.exe
  2⤵
  PID:10268
- C:\Windows\System\qkEABbH.exe
  C:\Windows\System\qkEABbH.exe
  2⤵
  PID:10284
- C:\Windows\System\XNQbTtM.exe
  C:\Windows\System\XNQbTtM.exe
  2⤵
  PID:10300
- C:\Windows\System\CNMRLcw.exe
  C:\Windows\System\CNMRLcw.exe
  2⤵
  PID:10316
- C:\Windows\System\icRULjG.exe
  C:\Windows\System\icRULjG.exe
  2⤵
  PID:10332
- C:\Windows\System\ryeDHNz.exe
  C:\Windows\System\ryeDHNz.exe
  2⤵
  PID:10348
- C:\Windows\System\nPLWwnZ.exe
  C:\Windows\System\nPLWwnZ.exe
  2⤵
  PID:10364
- C:\Windows\System\PxsBQsz.exe
  C:\Windows\System\PxsBQsz.exe
  2⤵
  PID:10380
- C:\Windows\System\IfwIyyQ.exe
  C:\Windows\System\IfwIyyQ.exe
  2⤵
  PID:10396
- C:\Windows\System\MFGlOTs.exe
  C:\Windows\System\MFGlOTs.exe
  2⤵
  PID:10412
- C:\Windows\System\ltAqLoN.exe
  C:\Windows\System\ltAqLoN.exe
  2⤵
  PID:10428
- C:\Windows\System\xeZAPot.exe
  C:\Windows\System\xeZAPot.exe
  2⤵
  PID:10444
- C:\Windows\System\bvRzLIb.exe
  C:\Windows\System\bvRzLIb.exe
  2⤵
  PID:10460
- C:\Windows\System\bPHePRQ.exe
  C:\Windows\System\bPHePRQ.exe
  2⤵
  PID:10476
- C:\Windows\System\HatrcDe.exe
  C:\Windows\System\HatrcDe.exe
  2⤵
  PID:10492
- C:\Windows\System\tLGGMOO.exe
  C:\Windows\System\tLGGMOO.exe
  2⤵
  PID:10512
- C:\Windows\System\FDZDFjj.exe
  C:\Windows\System\FDZDFjj.exe
  2⤵
  PID:10584
- C:\Windows\System\hsjSrdr.exe
  C:\Windows\System\hsjSrdr.exe
  2⤵
  PID:10600
- C:\Windows\System\uVOuzAK.exe
  C:\Windows\System\uVOuzAK.exe
  2⤵
  PID:10616
- C:\Windows\System\CAfGadp.exe
  C:\Windows\System\CAfGadp.exe
  2⤵
  PID:10632
- C:\Windows\System\yaumAad.exe
  C:\Windows\System\yaumAad.exe
  2⤵
  PID:10648
- C:\Windows\System\gXJXIvH.exe
  C:\Windows\System\gXJXIvH.exe
  2⤵
  PID:10664
- C:\Windows\System\oALCUAR.exe
  C:\Windows\System\oALCUAR.exe
  2⤵
  PID:10680
- C:\Windows\System\KjclJWv.exe
  C:\Windows\System\KjclJWv.exe
  2⤵
  PID:10696
- C:\Windows\System\IySaSFA.exe
  C:\Windows\System\IySaSFA.exe
  2⤵
  PID:10724
- C:\Windows\System\MCfqzKp.exe
  C:\Windows\System\MCfqzKp.exe
  2⤵
  PID:10740
- C:\Windows\System\yFBECIY.exe
  C:\Windows\System\yFBECIY.exe
  2⤵
  PID:10760
- C:\Windows\System\ONbHSsG.exe
  C:\Windows\System\ONbHSsG.exe
  2⤵
  PID:10776
- C:\Windows\System\HKIDYMF.exe
  C:\Windows\System\HKIDYMF.exe
  2⤵
  PID:10792
- C:\Windows\System\NfNKcpa.exe
  C:\Windows\System\NfNKcpa.exe
  2⤵
  PID:10808
- C:\Windows\System\uhZfRVd.exe
  C:\Windows\System\uhZfRVd.exe
  2⤵
  PID:10824
- C:\Windows\System\SjCNKZC.exe
  C:\Windows\System\SjCNKZC.exe
  2⤵
  PID:10840
- C:\Windows\System\rGyzKsW.exe
  C:\Windows\System\rGyzKsW.exe
  2⤵
  PID:10860
- C:\Windows\System\XCfZfyx.exe
  C:\Windows\System\XCfZfyx.exe
  2⤵
  PID:10876
- C:\Windows\System\ZiiBdaU.exe
  C:\Windows\System\ZiiBdaU.exe
  2⤵
  PID:10892
- C:\Windows\System\nJLuyoq.exe
  C:\Windows\System\nJLuyoq.exe
  2⤵
  PID:10908
- C:\Windows\System\gvHDSWf.exe
  C:\Windows\System\gvHDSWf.exe
  2⤵
  PID:10924
- C:\Windows\System\ddguyLc.exe
  C:\Windows\System\ddguyLc.exe
  2⤵
  PID:10940
- C:\Windows\System\fhEmzVT.exe
  C:\Windows\System\fhEmzVT.exe
  2⤵
  PID:10960
- C:\Windows\System\jFOSmSh.exe
  C:\Windows\System\jFOSmSh.exe
  2⤵
  PID:10976
- C:\Windows\System\KZKJkvo.exe
  C:\Windows\System\KZKJkvo.exe
  2⤵
  PID:10992
- C:\Windows\System\XoNVAxp.exe
  C:\Windows\System\XoNVAxp.exe
  2⤵
  PID:11008
- C:\Windows\System\oTTSieg.exe
  C:\Windows\System\oTTSieg.exe
  2⤵
  PID:11024
- C:\Windows\System\mnJADHs.exe
  C:\Windows\System\mnJADHs.exe
  2⤵
  PID:11040
- C:\Windows\System\OsinTQN.exe
  C:\Windows\System\OsinTQN.exe
  2⤵
  PID:11056
- C:\Windows\System\tQLiZsQ.exe
  C:\Windows\System\tQLiZsQ.exe
  2⤵
  PID:11072
- C:\Windows\System\KJOOQgw.exe
  C:\Windows\System\KJOOQgw.exe
  2⤵
  PID:11088
- C:\Windows\System\BkxzvCX.exe
  C:\Windows\System\BkxzvCX.exe
  2⤵
  PID:11104
- C:\Windows\System\YzqYKrs.exe
  C:\Windows\System\YzqYKrs.exe
  2⤵
  PID:11120
- C:\Windows\System\kupzGkf.exe
  C:\Windows\System\kupzGkf.exe
  2⤵
  PID:11136
- C:\Windows\System\hHkSPWZ.exe
  C:\Windows\System\hHkSPWZ.exe
  2⤵
  PID:11156
- C:\Windows\System\Cfpdrkp.exe
  C:\Windows\System\Cfpdrkp.exe
  2⤵
  PID:11172
- C:\Windows\System\IVvrQpE.exe
  C:\Windows\System\IVvrQpE.exe
  2⤵
  PID:11188
- C:\Windows\System\tilACAQ.exe
  C:\Windows\System\tilACAQ.exe
  2⤵
  PID:11204
- C:\Windows\System\hoRswMg.exe
  C:\Windows\System\hoRswMg.exe
  2⤵
  PID:11220
- C:\Windows\System\ONayguj.exe
  C:\Windows\System\ONayguj.exe
  2⤵
  PID:11236
- C:\Windows\System\MlCghLs.exe
  C:\Windows\System\MlCghLs.exe
  2⤵
  PID:11252
- C:\Windows\System\DmsXeYv.exe
  C:\Windows\System\DmsXeYv.exe
  2⤵
  PID:11272
- C:\Windows\System\hpkIuMG.exe
  C:\Windows\System\hpkIuMG.exe
  2⤵
  PID:11288
- C:\Windows\System\EyxGvWQ.exe
  C:\Windows\System\EyxGvWQ.exe
  2⤵
  PID:11304
- C:\Windows\System\FrHpwwb.exe
  C:\Windows\System\FrHpwwb.exe
  2⤵
  PID:11320
- C:\Windows\System\LXUQTwx.exe
  C:\Windows\System\LXUQTwx.exe
  2⤵
  PID:11336
- C:\Windows\System\iLRxzht.exe
  C:\Windows\System\iLRxzht.exe
  2⤵
  PID:11352
- C:\Windows\System\UmyYuhJ.exe
  C:\Windows\System\UmyYuhJ.exe
  2⤵
  PID:11368
- C:\Windows\System\zOiQwAI.exe
  C:\Windows\System\zOiQwAI.exe
  2⤵
  PID:11384
- C:\Windows\System\eMXtXEl.exe
  C:\Windows\System\eMXtXEl.exe
  2⤵
  PID:11912
- C:\Windows\System\cIDOlEV.exe
  C:\Windows\System\cIDOlEV.exe
  2⤵
  PID:11944
- C:\Windows\System\dkCACyY.exe
  C:\Windows\System\dkCACyY.exe
  2⤵
  PID:11960
- C:\Windows\System\vbARTht.exe
  C:\Windows\System\vbARTht.exe
  2⤵
  PID:11976
- C:\Windows\System\QsAfmbp.exe
  C:\Windows\System\QsAfmbp.exe
  2⤵
  PID:11992
- C:\Windows\System\ksraCPR.exe
  C:\Windows\System\ksraCPR.exe
  2⤵
  PID:12008
- C:\Windows\System\eSVvfYE.exe
  C:\Windows\System\eSVvfYE.exe
  2⤵
  PID:12024
- C:\Windows\System\nvihAEx.exe
  C:\Windows\System\nvihAEx.exe
  2⤵
  PID:12044
- C:\Windows\System\ONTvuDq.exe
  C:\Windows\System\ONTvuDq.exe
  2⤵
  PID:12064
- C:\Windows\System\vFSMieH.exe
  C:\Windows\System\vFSMieH.exe
  2⤵
  PID:12080
- C:\Windows\System\gcLWukE.exe
  C:\Windows\System\gcLWukE.exe
  2⤵
  PID:12096
- C:\Windows\System\HuMYeZI.exe
  C:\Windows\System\HuMYeZI.exe
  2⤵
  PID:12204
- C:\Windows\System\aftwbBr.exe
  C:\Windows\System\aftwbBr.exe
  2⤵
  PID:12260
- C:\Windows\System\jscpqtT.exe
  C:\Windows\System\jscpqtT.exe
  2⤵
  PID:12276
- C:\Windows\System\Vtndtjy.exe
  C:\Windows\System\Vtndtjy.exe
  2⤵
  PID:6376
- C:\Windows\System\XohyCcR.exe
  C:\Windows\System\XohyCcR.exe
  2⤵
  PID:6588
- C:\Windows\System\eymAasK.exe
  C:\Windows\System\eymAasK.exe
  2⤵
  PID:6680
- C:\Windows\System\jdUkdin.exe
  C:\Windows\System\jdUkdin.exe
  2⤵
  PID:6552
- C:\Windows\System\LeRbeCj.exe
  C:\Windows\System\LeRbeCj.exe
  2⤵
  PID:6872
- C:\Windows\System\tMfNHpt.exe
  C:\Windows\System\tMfNHpt.exe
  2⤵
  PID:6748
- C:\Windows\System\gXiJmWP.exe
  C:\Windows\System\gXiJmWP.exe
  2⤵
  PID:1724
- C:\Windows\System\XNFZRLr.exe
  C:\Windows\System\XNFZRLr.exe
  2⤵
  PID:7348
- C:\Windows\System\TvTezdq.exe
  C:\Windows\System\TvTezdq.exe
  2⤵
  PID:7448
- C:\Windows\System\MzTXwGF.exe
  C:\Windows\System\MzTXwGF.exe
  2⤵
  PID:7640
- C:\Windows\System\BTvcvCP.exe
  C:\Windows\System\BTvcvCP.exe
  2⤵
  PID:7796
- C:\Windows\System\HEZABQV.exe
  C:\Windows\System\HEZABQV.exe
  2⤵
  PID:7864
- C:\Windows\System\UMStYEK.exe
  C:\Windows\System\UMStYEK.exe
  2⤵
  PID:7928
- C:\Windows\System\CAqRPrE.exe
  C:\Windows\System\CAqRPrE.exe
  2⤵
  PID:7512
- C:\Windows\System\xFMNfek.exe
  C:\Windows\System\xFMNfek.exe
  2⤵
  PID:8116
- C:\Windows\System\brcENNg.exe
  C:\Windows\System\brcENNg.exe
  2⤵
  PID:8180
- C:\Windows\System\TCKDcVc.exe
  C:\Windows\System\TCKDcVc.exe
  2⤵
  PID:8020
- C:\Windows\System\FBqXPHI.exe
  C:\Windows\System\FBqXPHI.exe
  2⤵
  PID:8252
- C:\Windows\System\mRQztwe.exe
  C:\Windows\System\mRQztwe.exe
  2⤵
  PID:8316
- C:\Windows\System\oopPmNv.exe
  C:\Windows\System\oopPmNv.exe
  2⤵
  PID:8380
- C:\Windows\System\PBUXetq.exe
  C:\Windows\System\PBUXetq.exe
  2⤵
  PID:8444
- C:\Windows\System\HVOHJcH.exe
  C:\Windows\System\HVOHJcH.exe
  2⤵
  PID:8508
- C:\Windows\System\GXZbCmG.exe
  C:\Windows\System\GXZbCmG.exe
  2⤵
  PID:8860
- C:\Windows\System\HppCpKe.exe
  C:\Windows\System\HppCpKe.exe
  2⤵
  PID:8924
- C:\Windows\System\iSRpesN.exe
  C:\Windows\System\iSRpesN.exe
  2⤵
  PID:8988
- C:\Windows\System\HuvITvt.exe
  C:\Windows\System\HuvITvt.exe
  2⤵
  PID:9052
- C:\Windows\System\lIRhSbL.exe
  C:\Windows\System\lIRhSbL.exe
  2⤵
  PID:9116
- C:\Windows\System\WczFiCt.exe
  C:\Windows\System\WczFiCt.exe
  2⤵
  PID:9220
- C:\Windows\System\cUdDWoF.exe
  C:\Windows\System\cUdDWoF.exe
  2⤵
  PID:9696
- C:\Windows\System\iTQlPTt.exe
  C:\Windows\System\iTQlPTt.exe
  2⤵
  PID:9768
- C:\Windows\System\VutQlwB.exe
  C:\Windows\System\VutQlwB.exe
  2⤵
  PID:9836
- C:\Windows\System\rdMvkcN.exe
  C:\Windows\System\rdMvkcN.exe
  2⤵
  PID:10160
- C:\Windows\System\UxyJjXr.exe
  C:\Windows\System\UxyJjXr.exe
  2⤵
  PID:6484
- C:\Windows\System\JHrvCpI.exe
  C:\Windows\System\JHrvCpI.exe
  2⤵
  PID:10260
- C:\Windows\System\EICJGQA.exe
  C:\Windows\System\EICJGQA.exe
  2⤵
  PID:10324
- C:\Windows\System\QVzbLwH.exe
  C:\Windows\System\QVzbLwH.exe
  2⤵
  PID:10420
- C:\Windows\System\TvjrVbK.exe
  C:\Windows\System\TvjrVbK.exe
  2⤵
  PID:10484
- C:\Windows\System\duckygl.exe
  C:\Windows\System\duckygl.exe
  2⤵
  PID:9380
- C:\Windows\System\lvgegpM.exe
  C:\Windows\System\lvgegpM.exe
  2⤵
  PID:9472
- C:\Windows\System\ntEXZtA.exe
  C:\Windows\System\ntEXZtA.exe
  2⤵
  PID:9536
- C:\Windows\System\ESDbmGS.exe
  C:\Windows\System\ESDbmGS.exe
  2⤵
  PID:9868
- C:\Windows\System\AUijQfV.exe
  C:\Windows\System\AUijQfV.exe
  2⤵
  PID:9964
- C:\Windows\System\hBHnsLw.exe
  C:\Windows\System\hBHnsLw.exe
  2⤵
  PID:6492
- C:\Windows\System\bJHQWOS.exe
  C:\Windows\System\bJHQWOS.exe
  2⤵
  PID:10532
- C:\Windows\System\sESXZmb.exe
  C:\Windows\System\sESXZmb.exe
  2⤵
  PID:10548
- C:\Windows\System\PuXsDdm.exe
  C:\Windows\System\PuXsDdm.exe
  2⤵
  PID:6292
- C:\Windows\System\FcAyUIL.exe
  C:\Windows\System\FcAyUIL.exe
  2⤵
  PID:7236
- C:\Windows\System\dKUsBfL.exe
  C:\Windows\System\dKUsBfL.exe
  2⤵
  PID:7300
- C:\Windows\System\XbCNfJJ.exe
  C:\Windows\System\XbCNfJJ.exe
  2⤵
  PID:7396
- C:\Windows\System\NZnchfE.exe
  C:\Windows\System\NZnchfE.exe
  2⤵
  PID:7492
- C:\Windows\System\AfifRuR.exe
  C:\Windows\System\AfifRuR.exe
  2⤵
  PID:7588
- C:\Windows\System\xtnnUKZ.exe
  C:\Windows\System\xtnnUKZ.exe
  2⤵
  PID:7652
- C:\Windows\System\umyLTRw.exe
  C:\Windows\System\umyLTRw.exe
  2⤵
  PID:7748
- C:\Windows\System\AgMFxLS.exe
  C:\Windows\System\AgMFxLS.exe
  2⤵
  PID:7812
- C:\Windows\System\AOkZqMa.exe
  C:\Windows\System\AOkZqMa.exe
  2⤵
  PID:7880
- C:\Windows\System\uLyuYNy.exe
  C:\Windows\System\uLyuYNy.exe
  2⤵
  PID:7944
- C:\Windows\System\YgKwrcQ.exe
  C:\Windows\System\YgKwrcQ.exe
  2⤵
  PID:8008
- C:\Windows\System\hGObOuv.exe
  C:\Windows\System\hGObOuv.exe
  2⤵
  PID:8100
- C:\Windows\System\FfCJmdA.exe
  C:\Windows\System\FfCJmdA.exe
  2⤵
  PID:8200
- C:\Windows\System\tqAJaor.exe
  C:\Windows\System\tqAJaor.exe
  2⤵
  PID:8328
- C:\Windows\System\SkTZwJb.exe
  C:\Windows\System\SkTZwJb.exe
  2⤵
  PID:8392
- C:\Windows\System\rfFDjiI.exe
  C:\Windows\System\rfFDjiI.exe
  2⤵
  PID:8456
- C:\Windows\System\oVzkZAp.exe
  C:\Windows\System\oVzkZAp.exe
  2⤵
  PID:8524
- C:\Windows\System\tSKkUDd.exe
  C:\Windows\System\tSKkUDd.exe
  2⤵
  PID:8588
- C:\Windows\System\CsMaIYj.exe
  C:\Windows\System\CsMaIYj.exe
  2⤵
  PID:8652
- C:\Windows\System\HngFiSH.exe
  C:\Windows\System\HngFiSH.exe
  2⤵
  PID:8716
- C:\Windows\System\YYwCJMB.exe
  C:\Windows\System\YYwCJMB.exe
  2⤵
  PID:8780
- C:\Windows\System\MNfDxHK.exe
  C:\Windows\System\MNfDxHK.exe
  2⤵
  PID:8844
- C:\Windows\System\tsaTqXk.exe
  C:\Windows\System\tsaTqXk.exe
  2⤵
  PID:8908
- C:\Windows\System\kLYVUgs.exe
  C:\Windows\System\kLYVUgs.exe
  2⤵
  PID:8972
- C:\Windows\System\MBkQdYy.exe
  C:\Windows\System\MBkQdYy.exe
  2⤵
  PID:9036
- C:\Windows\System\sNhMCMe.exe
  C:\Windows\System\sNhMCMe.exe
  2⤵
  PID:9100
- C:\Windows\System\UEKoCCh.exe
  C:\Windows\System\UEKoCCh.exe
  2⤵
  PID:9164
- C:\Windows\System\FsCsmVe.exe
  C:\Windows\System\FsCsmVe.exe
  2⤵
  PID:9232
- C:\Windows\System\gnlezEQ.exe
  C:\Windows\System\gnlezEQ.exe
  2⤵
  PID:9296
- C:\Windows\System\oMZKlok.exe
  C:\Windows\System\oMZKlok.exe
  2⤵
  PID:9360
- C:\Windows\System\cNdiZIQ.exe
  C:\Windows\System\cNdiZIQ.exe
  2⤵
  PID:9424
- C:\Windows\System\FcgOYhL.exe
  C:\Windows\System\FcgOYhL.exe
  2⤵
  PID:9488
- C:\Windows\System\yRQCzVf.exe
  C:\Windows\System\yRQCzVf.exe
  2⤵
  PID:9524
- C:\Windows\System\fsbYZqL.exe
  C:\Windows\System\fsbYZqL.exe
  2⤵
  PID:9652
- C:\Windows\System\XFSWzAm.exe
  C:\Windows\System\XFSWzAm.exe
  2⤵
  PID:9716
- C:\Windows\System\qUljZCi.exe
  C:\Windows\System\qUljZCi.exe
  2⤵
  PID:9756
- C:\Windows\System\bAEkLbk.exe
  C:\Windows\System\bAEkLbk.exe
  2⤵
  PID:9820
- C:\Windows\System\bzBnYmH.exe
  C:\Windows\System\bzBnYmH.exe
  2⤵
  PID:9884
- C:\Windows\System\ZlMkefv.exe
  C:\Windows\System\ZlMkefv.exe
  2⤵
  PID:9948
- C:\Windows\System\acnGmdV.exe
  C:\Windows\System\acnGmdV.exe
  2⤵
  PID:10012
- C:\Windows\System\vaSiugF.exe
  C:\Windows\System\vaSiugF.exe
  2⤵
  PID:10056
- C:\Windows\System\pQBOzQV.exe
  C:\Windows\System\pQBOzQV.exe
  2⤵
  PID:10076
- C:\Windows\System\gAVXzlg.exe
  C:\Windows\System\gAVXzlg.exe
  2⤵
  PID:10116
- C:\Windows\System\NjTEXEs.exe
  C:\Windows\System\NjTEXEs.exe
  2⤵
  PID:10180
- C:\Windows\System\VAgmDfS.exe
  C:\Windows\System\VAgmDfS.exe
  2⤵
  PID:10248
- C:\Windows\System\QJQHzdp.exe
  C:\Windows\System\QJQHzdp.exe
  2⤵
  PID:10340
- C:\Windows\System\QkjRwFK.exe
  C:\Windows\System\QkjRwFK.exe
  2⤵
  PID:10404
- C:\Windows\System\CIKRppE.exe
  C:\Windows\System\CIKRppE.exe
  2⤵
  PID:10468
- C:\Windows\System\yGAjFaw.exe
  C:\Windows\System\yGAjFaw.exe
  2⤵
  PID:10508
- C:\Windows\System\eghjPRI.exe
  C:\Windows\System\eghjPRI.exe
  2⤵
  PID:11200
- C:\Windows\System\SyHtJCS.exe
  C:\Windows\System\SyHtJCS.exe
  2⤵
  PID:11268
- C:\Windows\System\YyfOeEt.exe
  C:\Windows\System\YyfOeEt.exe
  2⤵
  PID:11332
- C:\Windows\System\ddVUQEC.exe
  C:\Windows\System\ddVUQEC.exe
  2⤵
  PID:11400
- C:\Windows\System\bRShKQv.exe
  C:\Windows\System\bRShKQv.exe
  2⤵
  PID:11416
- C:\Windows\System\umrWaLh.exe
  C:\Windows\System\umrWaLh.exe
  2⤵
  PID:11432
- C:\Windows\System\enhcRmS.exe
  C:\Windows\System\enhcRmS.exe
  2⤵
  PID:11448
- C:\Windows\System\IhILsBq.exe
  C:\Windows\System\IhILsBq.exe
  2⤵
  PID:11464
- C:\Windows\System\zhaWFat.exe
  C:\Windows\System\zhaWFat.exe
  2⤵
  PID:11480
- C:\Windows\System\VnkDDNb.exe
  C:\Windows\System\VnkDDNb.exe
  2⤵
  PID:11496
- C:\Windows\System\SaNussz.exe
  C:\Windows\System\SaNussz.exe
  2⤵
  PID:11512
- C:\Windows\System\ZCYARza.exe
  C:\Windows\System\ZCYARza.exe
  2⤵
  PID:11528
- C:\Windows\System\ompTbTY.exe
  C:\Windows\System\ompTbTY.exe
  2⤵
  PID:11544
- C:\Windows\System\zoOhuDT.exe
  C:\Windows\System\zoOhuDT.exe
  2⤵
  PID:11560
- C:\Windows\System\uKweQRn.exe
  C:\Windows\System\uKweQRn.exe
  2⤵
  PID:11576
- C:\Windows\System\TyQNrHY.exe
  C:\Windows\System\TyQNrHY.exe
  2⤵
  PID:11592
- C:\Windows\System\BRpWiqH.exe
  C:\Windows\System\BRpWiqH.exe
  2⤵
  PID:11608
- C:\Windows\System\lxGMYnX.exe
  C:\Windows\System\lxGMYnX.exe
  2⤵
  PID:11624
- C:\Windows\System\QKLIKQl.exe
  C:\Windows\System\QKLIKQl.exe
  2⤵
  PID:11640
- C:\Windows\System\nQTgrKw.exe
  C:\Windows\System\nQTgrKw.exe
  2⤵
  PID:11656
- C:\Windows\System\aHreZPT.exe
  C:\Windows\System\aHreZPT.exe
  2⤵
  PID:11672
- C:\Windows\System\NPFCdCK.exe
  C:\Windows\System\NPFCdCK.exe
  2⤵
  PID:11692
- C:\Windows\System\pmNXxrh.exe
  C:\Windows\System\pmNXxrh.exe
  2⤵
  PID:11708
- C:\Windows\System\ZKkJTfp.exe
  C:\Windows\System\ZKkJTfp.exe
  2⤵
  PID:11724
- C:\Windows\System\fCvmuUv.exe
  C:\Windows\System\fCvmuUv.exe
  2⤵
  PID:11740
- C:\Windows\System\aTgHlTO.exe
  C:\Windows\System\aTgHlTO.exe
  2⤵
  PID:11756
- C:\Windows\System\oMKInGa.exe
  C:\Windows\System\oMKInGa.exe
  2⤵
  PID:11772
- C:\Windows\System\uNhIBvs.exe
  C:\Windows\System\uNhIBvs.exe
  2⤵
  PID:11788
- C:\Windows\System\TJjXQlD.exe
  C:\Windows\System\TJjXQlD.exe
  2⤵
  PID:10656
- C:\Windows\System\MIqUybj.exe
  C:\Windows\System\MIqUybj.exe
  2⤵
  PID:9600
- C:\Windows\System\KUhUKei.exe
  C:\Windows\System\KUhUKei.exe
  2⤵
  PID:10672
- C:\Windows\System\SvXTtaK.exe
  C:\Windows\System\SvXTtaK.exe
  2⤵
  PID:10816
- C:\Windows\System\peiaRrg.exe
  C:\Windows\System\peiaRrg.exe
  2⤵
  PID:10916
- C:\Windows\System\GsVmFDE.exe
  C:\Windows\System\GsVmFDE.exe
  2⤵
  PID:10640
- C:\Windows\System\dqCQyyW.exe
  C:\Windows\System\dqCQyyW.exe
  2⤵
  PID:10820
- C:\Windows\System\UAtRgER.exe
  C:\Windows\System\UAtRgER.exe
  2⤵
  PID:10952
- C:\Windows\System\VwHMmTf.exe
  C:\Windows\System\VwHMmTf.exe
  2⤵
  PID:10612
- C:\Windows\System\dBOFJCT.exe
  C:\Windows\System\dBOFJCT.exe
  2⤵
  PID:9616
- C:\Windows\System\fPtUWVG.exe
  C:\Windows\System\fPtUWVG.exe
  2⤵
  PID:10872
- C:\Windows\System\LQWKeSI.exe
  C:\Windows\System\LQWKeSI.exe
  2⤵
  PID:10596
- C:\Windows\System\TJMrXCV.exe
  C:\Windows\System\TJMrXCV.exe
  2⤵
  PID:10800
- C:\Windows\System\hfasgrm.exe
  C:\Windows\System\hfasgrm.exe
  2⤵
  PID:11000
- C:\Windows\System\bUUtvBg.exe
  C:\Windows\System\bUUtvBg.exe
  2⤵
  PID:10676
- C:\Windows\System\UGyJmmz.exe
  C:\Windows\System\UGyJmmz.exe
  2⤵
  PID:11112
- C:\Windows\System\hqzyjaa.exe
  C:\Windows\System\hqzyjaa.exe
  2⤵
  PID:11116
- C:\Windows\System\titAaKJ.exe
  C:\Windows\System\titAaKJ.exe
  2⤵
  PID:10772
- C:\Windows\System\zVXYWfI.exe
  C:\Windows\System\zVXYWfI.exe
  2⤵
  PID:11908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BqtpDeb.exe

Filesize
1.9MB

MD5
b5ced820ebfd95644733b3929b5136bc

SHA1
fac02140f6bf0b04870165c7b8cf17d252c8022d

SHA256
17a63819d193e72766416d1943472c59bbcb5db97d3d34a0446da80ecc3b3bcb

SHA512
f42487714522ace3fa6fc4bf3f8f443c0fb0a25c935f94caa59e613830c3cc9fe3eceb68d3d7b993f5a6b35189327e610077f625c5f2b7ce1f936a83b4efc29b

Download Submit
C:\Windows\system\CAjLtyO.exe

Filesize
1.9MB

MD5
45a9258a3c7849a101b360af368e5442

SHA1
9f7a079f2f55f06fa11bbe538b269954c6f4aba0

SHA256
82d07a9fd02966432885f1712190487102b5e23cfa5c6e492d93e03bd0c3e4be

SHA512
11912c797159a2f4aa939cf5ad01fe05717f291d5bbd8ff627b89d7f9b867f6042c0b4eaa09025d1f31db347351a9fae7fd063b9b5285e826a04937a64267a6b

Download Submit
C:\Windows\system\CIvwBZL.exe

Filesize
1.9MB

MD5
4753d03ac50955b942d25638657bdda7

SHA1
7230401a8aaae9675d4a72f9bc60b72388b37abc

SHA256
0f1c8f6de44f5fcb60897fca8e235980db65d16fa14f62307b32a657b7776d69

SHA512
e8273a3b55a88e46870f6b8bdf49f7f104ad8106648b06c90b4c8f8102c06e2f5e254a64e324d3df7fbe33e3022e99086367c83ad05b9f5e23e3a048dd398384

Download Submit
C:\Windows\system\CVHuYie.exe

Filesize
1.9MB

MD5
7ce09e416614c200e1483b48d7ef7750

SHA1
efe4f649b7e69ba7d6ae7880fce68c608d26ceff

SHA256
e0a381b9a57ff0851e0dcdac487646344c2bf13d04fe6d91c33f67d810800ab3

SHA512
d82fe80adc0496c3e992fc8ea0570f832f2e0a4dff4eb175247ace51264b51147e42e3c4dfb0281d8de3cc98bd1fbca08a308c097c101be55e72718cc8a57ea7

Download Submit
C:\Windows\system\ChApmrh.exe

Filesize
1.9MB

MD5
f432bc96092248d9907517736ffd1c4a

SHA1
b5563d8eeb9e9ad4a9fa0ddc16290e1b25ecad62

SHA256
5b6c5cf7c0d3b44785354c1424ba6436776bd6b1d0433cae5f085269267d1b11

SHA512
4f12a0e499941d0c749dfbe1c5ae19702fb8dd1e7cb7ff3a524b4b26020a5b8a6e46ce588c2d71293dcb21f1a19204e58fe37ae06aaa1eb37a747b32427aa076

Download Submit
C:\Windows\system\HDoflkS.exe

Filesize
1.9MB

MD5
082f8957362e812809404d87435c562a

SHA1
69014246992735f0dc13600fb0d01cb1e192c4a1

SHA256
9a18987e61abc15a30b25362cc0de1aed0f8363b52388554f6dbe80e67c5e95a

SHA512
21f26b177000f66f64c3702bd4e71bb8f85fec32c88f2ba2672d640bd5bc560460f61067d86d8911995dd3b28fc6283548b76671fa3a8b30714f4dfcefc27aca

Download Submit
C:\Windows\system\IOcUlaD.exe

Filesize
1.9MB

MD5
1703484708b53836329722046f6d8c04

SHA1
9c49561b6cb2c7280a546e92e5435f14ffb28d94

SHA256
5dcf3beed5e7495b9a199ba1cfb431ec1f4b4a40105cdbd02ee9115ef9a99bc1

SHA512
47e1665781220094139c0f75fec4a22a7c4a67a1f76875b6eb180f21aee8cb2c3fa7ae4692f0ecec879b13ba9bf310e0f63432d354caeef16f29a09cba236621

Download Submit
C:\Windows\system\MlqkPQY.exe

Filesize
1.9MB

MD5
625df68e10384c6071c9664dba5df3e9

SHA1
12174cbcfbc62d3ce31ebf0d8cc2a771117917fb

SHA256
f22d01c4c053f6f5f15760a5b2dd9beade636cc740e6d89b1b99f830d0e94928

SHA512
710fb5ff0608ac6e8e130edc6cd5fd67c0e0ae13618c4fe7adcd349212a7c67a8c30aab98a52b57683cfbd1b09053c33d19cd7d98909c511ac98828602beb0bd

Download Submit
C:\Windows\system\NEOLTfp.exe

Filesize
1.9MB

MD5
b0a80f50b4f05b2f36c7f04127a271eb

SHA1
6ae7436c945119ec7bf2703c8cf343c6456dca8e

SHA256
69aa95c1b1165289c5a825ec74fe7417a6086279aae9843cabef339761846d73

SHA512
b92adcf761dbe4a5c5a7ac908bbbb2c1ecae3161e8efce3eebfbcb7df27fac747dee88a531eb76f827e1107cca6d91149fcde1d0b4615cf9d71980c5f4976b19

Download Submit
C:\Windows\system\NfIwsRB.exe

Filesize
1.9MB

MD5
d5378ea9f903e1685eb9eaaee62e650b

SHA1
81ee2f868fa2d044245badce75f86885ebb7b7aa

SHA256
57eb823536e7db87398c3ec64afa3463845b0baf1078a6069ae3ee292fbffec8

SHA512
615ec1b800a20210a12351c25c324da985ee590106fa814e2d25ea4333e7cd0618992ebd90c5353da5d1b6d1bb775d947b97768cdcf74e3bf1166375527069e1

Download Submit
C:\Windows\system\RsRTpfo.exe

Filesize
1.9MB

MD5
1e6c4c635a9551ab47a701b3698348b9

SHA1
6e4b608702956abcd115b5c9e44f90925de65646

SHA256
0fbfdf01528e9fcc9c86bba4754b6c7d4f1030ea5b382a0dfcd7f0350ba6fd2c

SHA512
0bed5d139899aabab17e55b7b55faca57fd4c2ac8e46ede8b91d38db7c8c6ba25dfe98fa8060080aa79f6f4fda2bd8f6a429727c3f514508de2aec32baaee850

Download Submit
C:\Windows\system\SUippxj.exe

Filesize
1.9MB

MD5
affd6ea9b43ceae94be02e91faf37d9a

SHA1
5b16f0a5b27b2f22a7df9d34f4cb453ce9c3de35

SHA256
f40609def9261c897e65aebe722fe9e80a8eed4002df932d86db788dee37ae3e

SHA512
c31573d66d8378eaa0b2135711dda4b9f75a60dc70de93c21e4e457f5f3e61a3e26d92283c5a8162492e057751f1624d6ad120ae09f7f19e49ff8dcec3e6d55c

Download Submit
C:\Windows\system\aVNCEkW.exe

Filesize
1.9MB

MD5
f513ddf65f671a2b6c341c0e5d01c3fb

SHA1
7fbd5d86bb0afc650d199aefcbe9a62637e086b1

SHA256
875bbf7f2154aee3a113e9e29491b9a0fc2f56a18a11d78d60f752f6065b9c9e

SHA512
571d006bbb4937c1e469459290e1651b8f5d2dd7ba09c506443f4d2de67397dc576e17c63c0be3ec7ff0e3b4266f01692f54475bc63a385c4c5abd08621ae0df

Download Submit
C:\Windows\system\dfRtIaY.exe

Filesize
1.9MB

MD5
66f1bb4d2bbf9d7417c6cbe3a54757d0

SHA1
3ee818f319b7c6966b5768fa256fdc5c03a877ce

SHA256
630ae2cba13b8d93e442dcb62d7c95199599ca3b389552de1b2b2600ba4777b0

SHA512
bfb696c688fd9b590ecfd96456785d981e8a4208e347d906aae9362f5837c11fef58a33175c1f16e6c4abf3f0800f153e64ad784f5b8f2939f0c7dfb600e3672

Download Submit
C:\Windows\system\ftfTOWJ.exe

Filesize
1.9MB

MD5
6740dcb549c6522a0e503468e4aeb854

SHA1
af35dd8dc792e9e1c15324a5693fbe3471e9f474

SHA256
191d1cf3299088e793eb36c0baa1dc79cf0c12ac3aa954cd3fe4671dcdf0e036

SHA512
9175defe8650126bc0c20b7f54bba7e5d8fdf6c95bf63284ed447ed4be1dc3c949ae61b6ae28e0d9cd18efd32f0a6ab6183b99391e23918956e55aaaea0903e7

Download Submit
C:\Windows\system\jEIRiit.exe

Filesize
1.9MB

MD5
e2eedc9e3dc6e940fa8ae989a6ca1e1e

SHA1
f36bf672016672c0e18c3c0f1aa67f1eb6df42bb

SHA256
378a6319e4912c268c3c0cfd9e8ba7ea608245ea86c6b6aec4a735db009ac964

SHA512
fd8ff0800a3ba9e99e4aa3c8d09c8d55b9a156ec7fe6d99d5bfc1ee861cddfd88325130a7f091fe33ec5ef9d2248f5eb37580ac8fa1bce79039846d653321ff7

Download Submit
C:\Windows\system\jyUYOYb.exe

Filesize
1.9MB

MD5
efe0057a5144e1b2479dbf2cd06c0f0d

SHA1
4b8af46e31e56407dfab735de189532b3f269367

SHA256
a7ce946a040308d6428b2f854f585e547d47265be23452b5448fda6ba8aa28f2

SHA512
09c049c28f6b41585402fb36c1300678266fc8162008a44b6afdb37447c6e7ebe030aa6cf636e109c3d53a3615d79e3d7c2662ffc8af123b639b2796e54c021d

Download Submit
C:\Windows\system\kFnTcuv.exe

Filesize
1.9MB

MD5
8d100e1fe32a07336ad566b231abfb17

SHA1
bb65999b1b1361abe2d8e2fd828a9f1b1e142476

SHA256
1efbedc48e5ac325cb80309f31867e95c4be5b447da0fb0c8a4cd4ad3bb4d4b6

SHA512
60357290f1c45b8d7a718d8d4949656f6d577d23a649fdb379a0702ce4bdb7ef0878c02db49c171338dc89cb1e99aee29a4dd83cde1e19c1f86c1347f6b170ef

Download Submit
C:\Windows\system\kTioljg.exe

Filesize
1.9MB

MD5
4ffc23c31b7afb9378ea8451894bdf7c

SHA1
a04fd745cd0179461b093015d640f76f0179ccad

SHA256
376aeef0c3aa5d3ad5f722af77ba08805ebdfc016b6a38f3c4cabe75a94e351c

SHA512
4df7ae55ff97aeaddf6067b9f08613534a3f28b454824dfd2ac66bbe8e0b64a6451b1654a8e8272f9833914010771c87e7ddc7a868f05a8cc2b717226c83359a

Download Submit
C:\Windows\system\kidjCyO.exe

Filesize
1.9MB

MD5
34ff64c9f403d5d41f8b42e2a05fe821

SHA1
a451e774dc0dd91bd9e56a2e5574fe07e7f58bf4

SHA256
22dee13b1504e22977a732052838ca4d998d68325161d14cb32d04a065fe2e6b

SHA512
c2ff098e23fa44c3b2e76d249d8a741f32f94f39f9605b7769149da6a98b5e1ed86a9a87efe2853aae3a88c086da55f776fe7e2836132228bedbabd21d75bfa3

Download Submit
C:\Windows\system\lpPWADw.exe

Filesize
1.9MB

MD5
3a1e7c8df5aa12f42629bec156232296

SHA1
16d2f4ef977367f8e64ca15a355d163fa755a068

SHA256
a9e7c96f98aaa8de23ef31a4cf5651c6cdc476c5388d273b09b869bf150a230b

SHA512
0f179d34d47a12ee2ab59a0573dd999ca704e5844f95c0c7e449a9721e96bad32a8cd4107df1bc9a50d9715638f798c549dc5f437124f1ebf6f0319946618366

Download Submit
C:\Windows\system\nInRwdL.exe

Filesize
1.9MB

MD5
09b3bde6fb6bf22961eac4210cc1f792

SHA1
34733f3983c4227818e0847347805e15c960a68e

SHA256
9106388f08667b49f0dd18da9e6e58f77db4d1a93b4521010949b99b0fed5d7f

SHA512
348db33f9dbf08fb6d5674673785c9d98953314996c73c541aed323a8d2573ab3edb079115a5ddd6c8c06cfe8135ea953aa38f9ade016f2dcd47558c2c89351c

Download Submit
C:\Windows\system\nMCKZup.exe

Filesize
1.9MB

MD5
0886392953b04f5f227bad55c18e6a00

SHA1
c24b5ffec0731077b919c26019791164a01d03c3

SHA256
24b307771e62a7c2fdae843eb9234499e587e9f3d1e3ada30ae5eebb8295fae9

SHA512
d6355ee65e10fbe6f150fde251cc4bea9cac4a604dd38231caacf56495ca5f679c50813a8d6f44c13b20b23bba946c32596ea0c31fb6f840d2218b8accc5af8f

Download Submit
C:\Windows\system\pxDEAjl.exe

Filesize
1.9MB

MD5
5a5753fd08742b5bb936a7dd9eda97e1

SHA1
8179601e752c05f7ae092bbaa59389354c6a0b78

SHA256
47cde1dd5578dabeb61127a7457ca2cb4369153201d3537233bd14e0b91bdc77

SHA512
9cd41ff2e3434d2a874e042fba7f3e151c9b3acb884a805dca855371a2dabccd0f57a20545e8d54bf0f61005009db3fcab767ed9642be0a28e7e6d190c92fee8

Download Submit
C:\Windows\system\tGyuhXo.exe

Filesize
1.9MB

MD5
deac62a27470272974c49c63fa536a91

SHA1
ff46c833ff013642320330fdbc903f20bfd470aa

SHA256
e17a89fb2f62839a253310e95160143d50aeb5e06f0113464d38d7da7ed9ae74

SHA512
0f5ff95d69824f776204ece3c079edcd8469f3f40353d93a0ae94f8ff732fca34a4754c46161b1acb4c1aa2df547b2529f6f30f381b6fb1ebc039c43a0d72f63

Download Submit
C:\Windows\system\tiTOdlp.exe

Filesize
1.9MB

MD5
b11e373700cace1af4e0474755c886d0

SHA1
aa706426c3fab24b71dc9bc0fcbdf088ea601bd2

SHA256
8ca285b23a4250a2abcc661a3b9301cce0c332cf37c0c145d525e8dff9c55c26

SHA512
5c82de7abc0a93eb2bf0c0991355ded3aaf0afc985d72abc1de974c61ec5f98e4182fc8b0ab32a1ab12729ac779e6845cdaf3f356abfca66ea334e18e2bf0d65

Download Submit
C:\Windows\system\vcmkCjc.exe

Filesize
1.9MB

MD5
6aada811477d7bcdc7c8aa4a8bb9a22f

SHA1
a88050fd1a761654fbba487727c02cec36af93f2

SHA256
03ae58170b043e70803fd532103e2beceebc75c910f0007fb32e974bb3132e53

SHA512
da4c9f975e18a599cde837e1402e0729cbf3f7d7ca4767cacf16d006a7464fc9a9d6f2ae81daeaa3bbc90144999a4fff7a162d3d68c9efd11f74bded0c173ee6

Download Submit
C:\Windows\system\wAvXDyg.exe

Filesize
1.9MB

MD5
01b7a23de74ce657b05a59a17d8fcaa3

SHA1
6647fd2dfb405c95626c2213154ed50c1fd09aea

SHA256
2929093d4643a68b06bcedf31137ae62f11574bfe6ac913df0a9eed222fa122f

SHA512
d794edc638d74b6aed07d78daa8ef71f2568a319ec015f7daca15625cb182625b20c16270c9c6a5f35d5674d936999e06e276490caa2361fc363a0155fb9b2b0

Download Submit
C:\Windows\system\zTAhVqR.exe

Filesize
1.9MB

MD5
25ee593c1f9302adac80588409000153

SHA1
92a59f88b2b1c2562a21fba3f220d7f6d570c627

SHA256
1209115b539503defcedfca6cabb6f2cf5fc2a7a23ea52e69b943a162e50bb8f

SHA512
c43e062ef9e1e13d64062997595f9a378460800fdf9ac480d104c458499946b15ca3b3d2ecece89ba2a4fd0324574f2cf242d9fb23035fa2f7eed16902fa3351

Download Submit
C:\Windows\system\zUoqhUx.exe

Filesize
1.9MB

MD5
1007dab9760e552a1dea07dd20e1943b

SHA1
b7051a12d6775384d1d6e1eeeb8c0641dc85429d

SHA256
acecd54b03b668e29b194fb35e71a2a1e2633f8f62dab6802a64e62c269bc4c6

SHA512
67a926ffcc1275ad5aa94510d6aebe13a3b860675f09042fbf7e3930969a35698dbfec3f5cd0d3a549f8e78cca86b55bbcdc8b58b51c0f8320cf1f19c1b6255e

Download Submit
\Windows\system\mJgABPH.exe

Filesize
1.9MB

MD5
f8213006342fc0b002b0c542affbee89

SHA1
24ece3f7b181401b8b248a5c008f681a8abdcde8

SHA256
e8eeca77ec67dce1d2e6bc0e754f8ed87837a4f23dfc4244dfd659f6c4447c01

SHA512
86a8d3e8d4bedcd252ea649d710c10ff83574096c97a9edac3aecee7f3799cffa1ae188a8f8e9f49b481ff47978a5c9c515dd523b6b4b27eb94fcac7cc6bdec8

Download Submit
\Windows\system\xAdCgqx.exe

Filesize
1.9MB

MD5
f41a39298963586ae52f72257ccc7572

SHA1
76a668c4b29e53664e68fce532b704a01db63ba0

SHA256
46d259b757f69c18a996738a27d2af07f9216a1538ecc47e9c5fc97959d37fd6

SHA512
200c6811ea372b286070e715d054c14b85852cd06f27c54a283f1b49632debe9ebd3555286df7d78a3ab98e1eb451ffe5b66c24590b0ab5701d4c29d3af17314

Download Submit
memory/2108-67-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/2108-217-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/2108-5186-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/2488-635-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/2488-79-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/2580-96-0x000000013F9E0000-0x000000013FDD2000-memory.dmp

Filesize
3.9MB

Download
memory/2580-43-0x000000013F9E0000-0x000000013FDD2000-memory.dmp

Filesize
3.9MB

Download
memory/2580-5151-0x000000013F9E0000-0x000000013FDD2000-memory.dmp

Filesize
3.9MB

Download
memory/2640-94-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/2640-5164-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/2644-5191-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2644-92-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2644-48-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2680-104-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2680-7328-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2692-5192-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/2692-97-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/2692-44-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/2704-5070-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download
memory/2704-13-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download
memory/2716-5154-0x000000013FC40000-0x0000000140032000-memory.dmp

Filesize
3.9MB

Download
memory/2716-58-0x000000013FC40000-0x0000000140032000-memory.dmp

Filesize
3.9MB

Download
memory/2720-1172-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2720-54-0x000000013FC40000-0x0000000140032000-memory.dmp

Filesize
3.9MB

Download
memory/2720-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2720-8-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download
memory/2720-103-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2720-36-0x000000013F9E0000-0x000000013FDD2000-memory.dmp

Filesize
3.9MB

Download
memory/2720-78-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download
memory/2720-77-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/2720-34-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/2720-71-0x00000000036E0000-0x0000000003AD2000-memory.dmp

Filesize
3.9MB

Download
memory/2720-934-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/2720-66-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/2720-1031-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/2720-19-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/2720-102-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2720-59-0x00000000036E0000-0x0000000003AD2000-memory.dmp

Filesize
3.9MB

Download
memory/2720-0-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/2720-57-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2720-93-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/2800-28-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/2800-91-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/2800-5165-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/2816-41-0x000000001B770000-0x000000001BA52000-memory.dmp

Filesize
2.9MB

Download
memory/2816-30-0x000007FEF5EDE000-0x000007FEF5EDF000-memory.dmp

Filesize
4KB

Download
memory/2816-42-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Filesize
9.6MB

Download
memory/2816-60-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Filesize
9.6MB

Download
memory/2816-95-0x0000000002E70000-0x0000000002EF0000-memory.dmp

Filesize
512KB

Download
memory/2816-83-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Filesize
9.6MB

Download
memory/2816-5131-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Filesize
9.6MB

Download
memory/2816-55-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Filesize
9.6MB

Download
memory/2816-53-0x0000000001F00000-0x0000000001F08000-memory.dmp

Filesize
32KB

Download
memory/2816-98-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Filesize
9.6MB

Download
memory/2816-29-0x0000000002E70000-0x0000000002EF0000-memory.dmp

Filesize
512KB

Download
memory/2896-72-0x000000013F840000-0x000000013FC32000-memory.dmp

Filesize
3.9MB

Download
memory/2896-5170-0x000000013F840000-0x000000013FC32000-memory.dmp

Filesize
3.9MB

Download
memory/2896-379-0x000000013F840000-0x000000013FC32000-memory.dmp

Filesize
3.9MB

Download
memory/3044-5159-0x000000013F1F0000-0x000000013F5E2000-memory.dmp

Filesize
3.9MB

Download
memory/3044-105-0x000000013F1F0000-0x000000013F5E2000-memory.dmp

Filesize
3.9MB

Download
memory/3044-61-0x000000013F1F0000-0x000000013F5E2000-memory.dmp

Filesize
3.9MB

Download