xmrig | 2c445e03bb1a5e76e915bdc64fc44c4ce24ab422c337eb63e19f2b1aa751bd27

Analysis

max time kernel
150s
max time network
147s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 04:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e0889f3b006e7d0e2fd702cc41480a0.exe
Size

1.1MB
MD5

3e0889f3b006e7d0e2fd702cc41480a0
SHA1

f368b18a54729f10d3f6333ac72b252b9d59be54
SHA256

2c445e03bb1a5e76e915bdc64fc44c4ce24ab422c337eb63e19f2b1aa751bd27
SHA512

2b0777177044540989fd0526b5a3825a90ca46b8d45644ed21ab1da9a77715ea32ec64aec5ca5a54d74644616efaf7668edcb08e12cd9f2db6f37b1778117d4d
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkipfzaCt3Bbm6zzLA5JgLTCMY:Lz071uv4BPMki8CfVzz0yTS

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 19 IoCs

miner

resource	yara_rule
behavioral1/memory/980-13-0x000000013F510000-0x000000013F902000-memory.dmp	xmrig
behavioral1/memory/2852-70-0x000000013F7F0000-0x000000013FBE2000-memory.dmp	xmrig
behavioral1/memory/2572-68-0x000000013FB90000-0x000000013FF82000-memory.dmp	xmrig
behavioral1/memory/2724-66-0x000000013F630000-0x000000013FA22000-memory.dmp	xmrig
behavioral1/memory/2368-65-0x0000000003450000-0x0000000003842000-memory.dmp	xmrig
behavioral1/memory/2812-64-0x000000013F470000-0x000000013F862000-memory.dmp	xmrig
behavioral1/memory/2680-62-0x000000013FD40000-0x0000000140132000-memory.dmp	xmrig
behavioral1/memory/2736-81-0x000000013FA70000-0x000000013FE62000-memory.dmp	xmrig
behavioral1/memory/2972-80-0x000000013FFA0000-0x0000000140392000-memory.dmp	xmrig
behavioral1/memory/2852-5210-0x000000013F7F0000-0x000000013FBE2000-memory.dmp	xmrig
behavioral1/memory/2680-5219-0x000000013FD40000-0x0000000140132000-memory.dmp	xmrig
behavioral1/memory/2944-5264-0x000000013F430000-0x000000013F822000-memory.dmp	xmrig
behavioral1/memory/1036-5261-0x000000013FA40000-0x000000013FE32000-memory.dmp	xmrig
behavioral1/memory/1980-5258-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	xmrig
behavioral1/memory/2812-5253-0x000000013F470000-0x000000013F862000-memory.dmp	xmrig
behavioral1/memory/632-5244-0x000000013F520000-0x000000013F912000-memory.dmp	xmrig
behavioral1/memory/2736-5237-0x000000013FA70000-0x000000013FE62000-memory.dmp	xmrig
behavioral1/memory/2972-5235-0x000000013FFA0000-0x0000000140392000-memory.dmp	xmrig
behavioral1/memory/2572-5233-0x000000013FB90000-0x000000013FF82000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
772	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
980	mUPzZlR.exe
2680	NoOUIZT.exe
2812	EnxAxWt.exe
2724	tVUMGRs.exe
2572	SeRbRIo.exe
2852	QaOpDaf.exe
2972	sodIHMx.exe
2736	UhuVPFH.exe
2944	KROYuet.exe
632	YVMcVFR.exe
1036	SfQvTtl.exe
1980	hMxVlwN.exe
2292	wFzopGh.exe
272	AVkEcqy.exe
1488	XzXXHty.exe
1528	peLrzkf.exe
2900	zUxINYL.exe
2868	MtgbCuz.exe
668	Tqqzsdm.exe
1260	bUxQVuN.exe
1892	JZEKANn.exe
1680	WQOlWsk.exe
280	emkcMrU.exe
1552	reaDzxD.exe
1536	BLXyIQl.exe
1704	pnZmjrW.exe
2928	cqANzjs.exe
2120	jerenEl.exe
1872	WoLlfoV.exe
996	WbDOXHc.exe
1380	EcnwMGZ.exe
836	ylascIC.exe
2204	AFYjoMw.exe
1648	dIkGnFP.exe
2656	SnIsLyO.exe
2836	ammvrJa.exe
2976	BoeEMPI.exe
2260	vRCvgML.exe
1964	bQYHoNL.exe
2396	CidTsSf.exe
2592	gDfOtha.exe
952	xoViqsN.exe
2168	dBEaobg.exe
2216	kKaMjlh.exe
2212	qLrZoxK.exe
1676	dnuCzJJ.exe
2708	jbubkdK.exe
2872	LKcWzVm.exe
3012	XOSztSh.exe
3104	BYOZnBu.exe
3136	EAYTxmp.exe
3168	qVQZiVf.exe
3200	MOTpwus.exe
3232	sdJqwZr.exe
3264	twCovkA.exe
3296	zQSswUI.exe
3328	uNBCmBu.exe
3360	KNSBAcd.exe
3392	DVgeCyo.exe
3424	sabTuYQ.exe
3456	Xqkfqdo.exe
3488	ioDyDjc.exe
3520	HXNgMTZ.exe
3552	kbcmkxK.exe

Loads dropped DLL 64 IoCs

pid	Process
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
2368	3e0889f3b006e7d0e2fd702cc41480a0.exe

UPX packed file 61 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2368-2-0x000000013F880000-0x000000013FC72000-memory.dmp	upx
behavioral1/files/0x00080000000122db-6.dat	upx
behavioral1/memory/980-13-0x000000013F510000-0x000000013F902000-memory.dmp	upx
behavioral1/files/0x00080000000174a8-16.dat	upx
behavioral1/files/0x0007000000004e74-21.dat	upx
behavioral1/files/0x000f000000018660-30.dat	upx
behavioral1/files/0x0007000000018784-36.dat	upx
behavioral1/files/0x0005000000019aef-48.dat	upx
behavioral1/files/0x0008000000018c0c-41.dat	upx
behavioral1/files/0x0005000000019c4d-72.dat	upx
behavioral1/memory/2944-87-0x000000013F430000-0x000000013F822000-memory.dmp	upx
behavioral1/memory/1036-88-0x000000013FA40000-0x000000013FE32000-memory.dmp	upx
behavioral1/files/0x0005000000019c66-97.dat	upx
behavioral1/files/0x0005000000019c9f-102.dat	upx
behavioral1/files/0x0005000000019f39-109.dat	upx
behavioral1/files/0x000500000001a04b-124.dat	upx
behavioral1/files/0x000500000001a41b-148.dat	upx
behavioral1/files/0x000500000001a481-173.dat	upx
behavioral1/files/0x000500000001a4a2-192.dat	upx
behavioral1/files/0x000500000001a4a4-189.dat	upx
behavioral1/files/0x000500000001a498-181.dat	upx
behavioral1/files/0x000500000001a4a8-197.dat	upx
behavioral1/files/0x000500000001a475-176.dat	upx
behavioral1/files/0x000500000001a452-167.dat	upx
behavioral1/files/0x000500000001a473-164.dat	upx
behavioral1/files/0x000500000001a425-160.dat	upx
behavioral1/files/0x000500000001a426-157.dat	upx
behavioral1/files/0x000500000001a423-151.dat	upx
behavioral1/files/0x000500000001a310-145.dat	upx
behavioral1/files/0x000500000001a419-142.dat	upx
behavioral1/files/0x0005000000019c68-99.dat	upx
behavioral1/files/0x000500000001a2df-136.dat	upx
behavioral1/files/0x000500000001a055-129.dat	upx
behavioral1/files/0x00090000000173ec-89.dat	upx
behavioral1/memory/2852-70-0x000000013F7F0000-0x000000013FBE2000-memory.dmp	upx
behavioral1/memory/2572-68-0x000000013FB90000-0x000000013FF82000-memory.dmp	upx
behavioral1/memory/2724-66-0x000000013F630000-0x000000013FA22000-memory.dmp	upx
behavioral1/memory/2812-64-0x000000013F470000-0x000000013F862000-memory.dmp	upx
behavioral1/memory/2680-62-0x000000013FD40000-0x0000000140132000-memory.dmp	upx
behavioral1/files/0x0005000000019f50-112.dat	upx
behavioral1/files/0x0005000000019d6d-106.dat	upx
behavioral1/files/0x000500000001a4a6-195.dat	upx
behavioral1/files/0x000500000001a486-180.dat	upx
behavioral1/files/0x000500000001a08c-134.dat	upx
behavioral1/memory/1980-98-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	upx
behavioral1/memory/632-84-0x000000013F520000-0x000000013F912000-memory.dmp	upx
behavioral1/files/0x0005000000019af1-82.dat	upx
behavioral1/memory/2736-81-0x000000013FA70000-0x000000013FE62000-memory.dmp	upx
behavioral1/memory/2972-80-0x000000013FFA0000-0x0000000140392000-memory.dmp	upx
behavioral1/files/0x000700000001927e-77.dat	upx
behavioral1/files/0x0006000000018679-35.dat	upx
behavioral1/memory/2852-5210-0x000000013F7F0000-0x000000013FBE2000-memory.dmp	upx
behavioral1/memory/2680-5219-0x000000013FD40000-0x0000000140132000-memory.dmp	upx
behavioral1/memory/2944-5264-0x000000013F430000-0x000000013F822000-memory.dmp	upx
behavioral1/memory/1036-5261-0x000000013FA40000-0x000000013FE32000-memory.dmp	upx
behavioral1/memory/1980-5258-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	upx
behavioral1/memory/2812-5253-0x000000013F470000-0x000000013F862000-memory.dmp	upx
behavioral1/memory/632-5244-0x000000013F520000-0x000000013F912000-memory.dmp	upx
behavioral1/memory/2736-5237-0x000000013FA70000-0x000000013FE62000-memory.dmp	upx
behavioral1/memory/2972-5235-0x000000013FFA0000-0x0000000140392000-memory.dmp	upx
behavioral1/memory/2572-5233-0x000000013FB90000-0x000000013FF82000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\FRvhpdv.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\NEtXYjU.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\YhSeyJX.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\meIFDoq.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\AZxdwAH.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\EchlRLz.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\wFjajux.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\tfNDKvW.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\erDaGCH.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\VGqQhhG.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\TNVrdeQ.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\dTGWUBK.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\peLrzkf.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\TOvjNiP.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\XLGpMDQ.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\gWMYPVm.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\aeNViek.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\BUFJnPM.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\YpiEoyQ.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\EhOAggs.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\IeCgjhh.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\iDUraNo.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\uLEuokB.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\JsBUvMB.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\BgzHegz.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\tHTQrHp.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\EPJuasy.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\PLYPKAd.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\oBXfNic.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\AxCmpsD.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\yIerwHH.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\LnxCBIq.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\WBMYEAd.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\purXvbr.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\lVIQlUn.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\UaNitNr.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\fDRaYZD.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\ZeuZrxC.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\FfpzOgf.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\NmYspXo.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\BXUhDqC.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\zdafKTH.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\dwglwBR.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\hJDRezT.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\liIFXrn.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\SGgbMZm.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\IOcNcwn.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\NOgZpRE.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\yWBfRta.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\xeufDYQ.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\KdvSUPw.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\SwhelnP.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\CtmEeSW.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\PdNDfVw.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\wEJmscz.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\GrorAoK.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\pANWanN.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\qPTwBjJ.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\WPSeekg.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\qQXRJru.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\xSkhBgu.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\vYhuGwl.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\KTZseNi.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe
File created	C:\Windows\System\KccEUMA.exe	3e0889f3b006e7d0e2fd702cc41480a0.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
772	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
Token: SeLockMemoryPrivilege	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe
Token: SeDebugPrivilege	772	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 772	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	32
PID 2368 wrote to memory of 772	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	32
PID 2368 wrote to memory of 772	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	32
PID 2368 wrote to memory of 980	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	33
PID 2368 wrote to memory of 980	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	33
PID 2368 wrote to memory of 980	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	33
PID 2368 wrote to memory of 2680	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	34
PID 2368 wrote to memory of 2680	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	34
PID 2368 wrote to memory of 2680	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	34
PID 2368 wrote to memory of 2812	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	35
PID 2368 wrote to memory of 2812	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	35
PID 2368 wrote to memory of 2812	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	35
PID 2368 wrote to memory of 2724	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	36
PID 2368 wrote to memory of 2724	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	36
PID 2368 wrote to memory of 2724	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	36
PID 2368 wrote to memory of 2572	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	37
PID 2368 wrote to memory of 2572	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	37
PID 2368 wrote to memory of 2572	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	37
PID 2368 wrote to memory of 2852	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	38
PID 2368 wrote to memory of 2852	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	38
PID 2368 wrote to memory of 2852	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	38
PID 2368 wrote to memory of 2972	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	39
PID 2368 wrote to memory of 2972	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	39
PID 2368 wrote to memory of 2972	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	39
PID 2368 wrote to memory of 2944	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	40
PID 2368 wrote to memory of 2944	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	40
PID 2368 wrote to memory of 2944	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	40
PID 2368 wrote to memory of 2736	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	41
PID 2368 wrote to memory of 2736	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	41
PID 2368 wrote to memory of 2736	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	41
PID 2368 wrote to memory of 1036	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	42
PID 2368 wrote to memory of 1036	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	42
PID 2368 wrote to memory of 1036	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	42
PID 2368 wrote to memory of 632	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	43
PID 2368 wrote to memory of 632	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	43
PID 2368 wrote to memory of 632	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	43
PID 2368 wrote to memory of 1488	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	44
PID 2368 wrote to memory of 1488	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	44
PID 2368 wrote to memory of 1488	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	44
PID 2368 wrote to memory of 1980	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	45
PID 2368 wrote to memory of 1980	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	45
PID 2368 wrote to memory of 1980	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	45
PID 2368 wrote to memory of 2900	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	46
PID 2368 wrote to memory of 2900	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	46
PID 2368 wrote to memory of 2900	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	46
PID 2368 wrote to memory of 2292	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	47
PID 2368 wrote to memory of 2292	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	47
PID 2368 wrote to memory of 2292	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	47
PID 2368 wrote to memory of 2784	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	48
PID 2368 wrote to memory of 2784	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	48
PID 2368 wrote to memory of 2784	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	48
PID 2368 wrote to memory of 272	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	49
PID 2368 wrote to memory of 272	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	49
PID 2368 wrote to memory of 272	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	49
PID 2368 wrote to memory of 1188	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	50
PID 2368 wrote to memory of 1188	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	50
PID 2368 wrote to memory of 1188	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	50
PID 2368 wrote to memory of 1528	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	51
PID 2368 wrote to memory of 1528	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	51
PID 2368 wrote to memory of 1528	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	51
PID 2368 wrote to memory of 2940	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	52
PID 2368 wrote to memory of 2940	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	52
PID 2368 wrote to memory of 2940	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	52
PID 2368 wrote to memory of 2868	2368	3e0889f3b006e7d0e2fd702cc41480a0.exe	53

C:\Users\Admin\AppData\Local\Temp\3e0889f3b006e7d0e2fd702cc41480a0.exe
"C:\Users\Admin\AppData\Local\Temp\3e0889f3b006e7d0e2fd702cc41480a0.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:772
- C:\Windows\System\mUPzZlR.exe
  C:\Windows\System\mUPzZlR.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\NoOUIZT.exe
  C:\Windows\System\NoOUIZT.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\EnxAxWt.exe
  C:\Windows\System\EnxAxWt.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\tVUMGRs.exe
  C:\Windows\System\tVUMGRs.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\SeRbRIo.exe
  C:\Windows\System\SeRbRIo.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\QaOpDaf.exe
  C:\Windows\System\QaOpDaf.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\sodIHMx.exe
  C:\Windows\System\sodIHMx.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\KROYuet.exe
  C:\Windows\System\KROYuet.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\UhuVPFH.exe
  C:\Windows\System\UhuVPFH.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\SfQvTtl.exe
  C:\Windows\System\SfQvTtl.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\YVMcVFR.exe
  C:\Windows\System\YVMcVFR.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\XzXXHty.exe
  C:\Windows\System\XzXXHty.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\hMxVlwN.exe
  C:\Windows\System\hMxVlwN.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\zUxINYL.exe
  C:\Windows\System\zUxINYL.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\wFzopGh.exe
  C:\Windows\System\wFzopGh.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\tbieZSu.exe
  C:\Windows\System\tbieZSu.exe
  2⤵
  PID:2784
- C:\Windows\System\AVkEcqy.exe
  C:\Windows\System\AVkEcqy.exe
  2⤵
  - Executes dropped EXE
  PID:272
- C:\Windows\System\NKTUrzo.exe
  C:\Windows\System\NKTUrzo.exe
  2⤵
  PID:1188
- C:\Windows\System\peLrzkf.exe
  C:\Windows\System\peLrzkf.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\eUiLPxk.exe
  C:\Windows\System\eUiLPxk.exe
  2⤵
  PID:2940
- C:\Windows\System\MtgbCuz.exe
  C:\Windows\System\MtgbCuz.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\FEQNrXQ.exe
  C:\Windows\System\FEQNrXQ.exe
  2⤵
  PID:2404
- C:\Windows\System\Tqqzsdm.exe
  C:\Windows\System\Tqqzsdm.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\ZULSRIu.exe
  C:\Windows\System\ZULSRIu.exe
  2⤵
  PID:1732
- C:\Windows\System\bUxQVuN.exe
  C:\Windows\System\bUxQVuN.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\lAZQwNr.exe
  C:\Windows\System\lAZQwNr.exe
  2⤵
  PID:1880
- C:\Windows\System\JZEKANn.exe
  C:\Windows\System\JZEKANn.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\gPfzsiy.exe
  C:\Windows\System\gPfzsiy.exe
  2⤵
  PID:2964
- C:\Windows\System\WQOlWsk.exe
  C:\Windows\System\WQOlWsk.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\ydJqFWu.exe
  C:\Windows\System\ydJqFWu.exe
  2⤵
  PID:1276
- C:\Windows\System\emkcMrU.exe
  C:\Windows\System\emkcMrU.exe
  2⤵
  - Executes dropped EXE
  PID:280
- C:\Windows\System\IiZbEGb.exe
  C:\Windows\System\IiZbEGb.exe
  2⤵
  PID:1588
- C:\Windows\System\reaDzxD.exe
  C:\Windows\System\reaDzxD.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\HiHfBcf.exe
  C:\Windows\System\HiHfBcf.exe
  2⤵
  PID:624
- C:\Windows\System\BLXyIQl.exe
  C:\Windows\System\BLXyIQl.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\XjMWbPA.exe
  C:\Windows\System\XjMWbPA.exe
  2⤵
  PID:2380
- C:\Windows\System\pnZmjrW.exe
  C:\Windows\System\pnZmjrW.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\RCSHZuR.exe
  C:\Windows\System\RCSHZuR.exe
  2⤵
  PID:1788
- C:\Windows\System\cqANzjs.exe
  C:\Windows\System\cqANzjs.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\jbTVyGH.exe
  C:\Windows\System\jbTVyGH.exe
  2⤵
  PID:2080
- C:\Windows\System\jerenEl.exe
  C:\Windows\System\jerenEl.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\jIgnUnY.exe
  C:\Windows\System\jIgnUnY.exe
  2⤵
  PID:2968
- C:\Windows\System\WoLlfoV.exe
  C:\Windows\System\WoLlfoV.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\CVLlpCQ.exe
  C:\Windows\System\CVLlpCQ.exe
  2⤵
  PID:2188
- C:\Windows\System\WbDOXHc.exe
  C:\Windows\System\WbDOXHc.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\yScvKqy.exe
  C:\Windows\System\yScvKqy.exe
  2⤵
  PID:1140
- C:\Windows\System\EcnwMGZ.exe
  C:\Windows\System\EcnwMGZ.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\otFQhAl.exe
  C:\Windows\System\otFQhAl.exe
  2⤵
  PID:992
- C:\Windows\System\ylascIC.exe
  C:\Windows\System\ylascIC.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\Eydrxfx.exe
  C:\Windows\System\Eydrxfx.exe
  2⤵
  PID:3060
- C:\Windows\System\AFYjoMw.exe
  C:\Windows\System\AFYjoMw.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\VFnGSps.exe
  C:\Windows\System\VFnGSps.exe
  2⤵
  PID:1512
- C:\Windows\System\dIkGnFP.exe
  C:\Windows\System\dIkGnFP.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\inTbRKE.exe
  C:\Windows\System\inTbRKE.exe
  2⤵
  PID:2224
- C:\Windows\System\SnIsLyO.exe
  C:\Windows\System\SnIsLyO.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\THKoChF.exe
  C:\Windows\System\THKoChF.exe
  2⤵
  PID:2996
- C:\Windows\System\ammvrJa.exe
  C:\Windows\System\ammvrJa.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\qCDcboy.exe
  C:\Windows\System\qCDcboy.exe
  2⤵
  PID:2704
- C:\Windows\System\BoeEMPI.exe
  C:\Windows\System\BoeEMPI.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\MRMrbTT.exe
  C:\Windows\System\MRMrbTT.exe
  2⤵
  PID:2600
- C:\Windows\System\vRCvgML.exe
  C:\Windows\System\vRCvgML.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\pOTdWfB.exe
  C:\Windows\System\pOTdWfB.exe
  2⤵
  PID:2848
- C:\Windows\System\bQYHoNL.exe
  C:\Windows\System\bQYHoNL.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\VyYuXcs.exe
  C:\Windows\System\VyYuXcs.exe
  2⤵
  PID:1984
- C:\Windows\System\CidTsSf.exe
  C:\Windows\System\CidTsSf.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\oRBdxVs.exe
  C:\Windows\System\oRBdxVs.exe
  2⤵
  PID:2732
- C:\Windows\System\gDfOtha.exe
  C:\Windows\System\gDfOtha.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\DzdxuZa.exe
  C:\Windows\System\DzdxuZa.exe
  2⤵
  PID:2160
- C:\Windows\System\xoViqsN.exe
  C:\Windows\System\xoViqsN.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\EgmKRoc.exe
  C:\Windows\System\EgmKRoc.exe
  2⤵
  PID:948
- C:\Windows\System\dBEaobg.exe
  C:\Windows\System\dBEaobg.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\kHfXLXZ.exe
  C:\Windows\System\kHfXLXZ.exe
  2⤵
  PID:764
- C:\Windows\System\kKaMjlh.exe
  C:\Windows\System\kKaMjlh.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\WiivNfp.exe
  C:\Windows\System\WiivNfp.exe
  2⤵
  PID:1336
- C:\Windows\System\qLrZoxK.exe
  C:\Windows\System\qLrZoxK.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\ysQeFDn.exe
  C:\Windows\System\ysQeFDn.exe
  2⤵
  PID:3056
- C:\Windows\System\dnuCzJJ.exe
  C:\Windows\System\dnuCzJJ.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\ZkVjmXX.exe
  C:\Windows\System\ZkVjmXX.exe
  2⤵
  PID:2696
- C:\Windows\System\jbubkdK.exe
  C:\Windows\System\jbubkdK.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\nZyOiGH.exe
  C:\Windows\System\nZyOiGH.exe
  2⤵
  PID:2816
- C:\Windows\System\LKcWzVm.exe
  C:\Windows\System\LKcWzVm.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\oZkEgQN.exe
  C:\Windows\System\oZkEgQN.exe
  2⤵
  PID:2336
- C:\Windows\System\XOSztSh.exe
  C:\Windows\System\XOSztSh.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\NvALkRw.exe
  C:\Windows\System\NvALkRw.exe
  2⤵
  PID:3088
- C:\Windows\System\BYOZnBu.exe
  C:\Windows\System\BYOZnBu.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\TFusEzT.exe
  C:\Windows\System\TFusEzT.exe
  2⤵
  PID:3120
- C:\Windows\System\EAYTxmp.exe
  C:\Windows\System\EAYTxmp.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\bgKRupd.exe
  C:\Windows\System\bgKRupd.exe
  2⤵
  PID:3152
- C:\Windows\System\qVQZiVf.exe
  C:\Windows\System\qVQZiVf.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\VbPJzJX.exe
  C:\Windows\System\VbPJzJX.exe
  2⤵
  PID:3184
- C:\Windows\System\MOTpwus.exe
  C:\Windows\System\MOTpwus.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\PXrwKmy.exe
  C:\Windows\System\PXrwKmy.exe
  2⤵
  PID:3216
- C:\Windows\System\sdJqwZr.exe
  C:\Windows\System\sdJqwZr.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\UBdLDgF.exe
  C:\Windows\System\UBdLDgF.exe
  2⤵
  PID:3248
- C:\Windows\System\twCovkA.exe
  C:\Windows\System\twCovkA.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\kBPiMdz.exe
  C:\Windows\System\kBPiMdz.exe
  2⤵
  PID:3280
- C:\Windows\System\zQSswUI.exe
  C:\Windows\System\zQSswUI.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\gVkxIio.exe
  C:\Windows\System\gVkxIio.exe
  2⤵
  PID:3312
- C:\Windows\System\uNBCmBu.exe
  C:\Windows\System\uNBCmBu.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\pZksrQy.exe
  C:\Windows\System\pZksrQy.exe
  2⤵
  PID:3344
- C:\Windows\System\KNSBAcd.exe
  C:\Windows\System\KNSBAcd.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\ABrJXaM.exe
  C:\Windows\System\ABrJXaM.exe
  2⤵
  PID:3376
- C:\Windows\System\DVgeCyo.exe
  C:\Windows\System\DVgeCyo.exe
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Windows\System\yyuOplQ.exe
  C:\Windows\System\yyuOplQ.exe
  2⤵
  PID:3408
- C:\Windows\System\sabTuYQ.exe
  C:\Windows\System\sabTuYQ.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\qfwDKCG.exe
  C:\Windows\System\qfwDKCG.exe
  2⤵
  PID:3440
- C:\Windows\System\Xqkfqdo.exe
  C:\Windows\System\Xqkfqdo.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\wwQCOwu.exe
  C:\Windows\System\wwQCOwu.exe
  2⤵
  PID:3472
- C:\Windows\System\ioDyDjc.exe
  C:\Windows\System\ioDyDjc.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\HlRECND.exe
  C:\Windows\System\HlRECND.exe
  2⤵
  PID:3504
- C:\Windows\System\HXNgMTZ.exe
  C:\Windows\System\HXNgMTZ.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\lTSYWFx.exe
  C:\Windows\System\lTSYWFx.exe
  2⤵
  PID:3536
- C:\Windows\System\kbcmkxK.exe
  C:\Windows\System\kbcmkxK.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\MmGNkGh.exe
  C:\Windows\System\MmGNkGh.exe
  2⤵
  PID:3568
- C:\Windows\System\SqGZMof.exe
  C:\Windows\System\SqGZMof.exe
  2⤵
  PID:3584
- C:\Windows\System\ARTXYiD.exe
  C:\Windows\System\ARTXYiD.exe
  2⤵
  PID:3600
- C:\Windows\System\EmXEjOp.exe
  C:\Windows\System\EmXEjOp.exe
  2⤵
  PID:3616
- C:\Windows\System\UdTrrjy.exe
  C:\Windows\System\UdTrrjy.exe
  2⤵
  PID:3632
- C:\Windows\System\YbvYSzK.exe
  C:\Windows\System\YbvYSzK.exe
  2⤵
  PID:3648
- C:\Windows\System\BAclBYM.exe
  C:\Windows\System\BAclBYM.exe
  2⤵
  PID:3664
- C:\Windows\System\gCZieAx.exe
  C:\Windows\System\gCZieAx.exe
  2⤵
  PID:3680
- C:\Windows\System\yALFFEM.exe
  C:\Windows\System\yALFFEM.exe
  2⤵
  PID:3696
- C:\Windows\System\mVfiPyo.exe
  C:\Windows\System\mVfiPyo.exe
  2⤵
  PID:3712
- C:\Windows\System\REIvJrY.exe
  C:\Windows\System\REIvJrY.exe
  2⤵
  PID:3728
- C:\Windows\System\qghHxca.exe
  C:\Windows\System\qghHxca.exe
  2⤵
  PID:3744
- C:\Windows\System\xKfxadV.exe
  C:\Windows\System\xKfxadV.exe
  2⤵
  PID:3760
- C:\Windows\System\FqEZwAu.exe
  C:\Windows\System\FqEZwAu.exe
  2⤵
  PID:3776
- C:\Windows\System\MwHFboi.exe
  C:\Windows\System\MwHFboi.exe
  2⤵
  PID:3792
- C:\Windows\System\hJDRezT.exe
  C:\Windows\System\hJDRezT.exe
  2⤵
  PID:3808
- C:\Windows\System\qluVKCG.exe
  C:\Windows\System\qluVKCG.exe
  2⤵
  PID:3824
- C:\Windows\System\OfEgJVo.exe
  C:\Windows\System\OfEgJVo.exe
  2⤵
  PID:3840
- C:\Windows\System\UGDcfYr.exe
  C:\Windows\System\UGDcfYr.exe
  2⤵
  PID:3856
- C:\Windows\System\UNoxDOC.exe
  C:\Windows\System\UNoxDOC.exe
  2⤵
  PID:3872
- C:\Windows\System\iHahskr.exe
  C:\Windows\System\iHahskr.exe
  2⤵
  PID:3888
- C:\Windows\System\yTMSqwZ.exe
  C:\Windows\System\yTMSqwZ.exe
  2⤵
  PID:3904
- C:\Windows\System\ccaiYle.exe
  C:\Windows\System\ccaiYle.exe
  2⤵
  PID:3920
- C:\Windows\System\HlGUpUe.exe
  C:\Windows\System\HlGUpUe.exe
  2⤵
  PID:3936
- C:\Windows\System\AdTTreV.exe
  C:\Windows\System\AdTTreV.exe
  2⤵
  PID:3952
- C:\Windows\System\ixSuuPM.exe
  C:\Windows\System\ixSuuPM.exe
  2⤵
  PID:3968
- C:\Windows\System\qBwSkwN.exe
  C:\Windows\System\qBwSkwN.exe
  2⤵
  PID:3984
- C:\Windows\System\dumkCnh.exe
  C:\Windows\System\dumkCnh.exe
  2⤵
  PID:4000
- C:\Windows\System\XCyIFWl.exe
  C:\Windows\System\XCyIFWl.exe
  2⤵
  PID:4016
- C:\Windows\System\OfWvhQR.exe
  C:\Windows\System\OfWvhQR.exe
  2⤵
  PID:4032
- C:\Windows\System\imMqDPy.exe
  C:\Windows\System\imMqDPy.exe
  2⤵
  PID:4048
- C:\Windows\System\dMQhEvG.exe
  C:\Windows\System\dMQhEvG.exe
  2⤵
  PID:4064
- C:\Windows\System\wvPcINa.exe
  C:\Windows\System\wvPcINa.exe
  2⤵
  PID:4080
- C:\Windows\System\exnzvUE.exe
  C:\Windows\System\exnzvUE.exe
  2⤵
  PID:1452
- C:\Windows\System\rLlNLXy.exe
  C:\Windows\System\rLlNLXy.exe
  2⤵
  PID:2140
- C:\Windows\System\ryLzfOC.exe
  C:\Windows\System\ryLzfOC.exe
  2⤵
  PID:2288
- C:\Windows\System\EcAtvtl.exe
  C:\Windows\System\EcAtvtl.exe
  2⤵
  PID:3112
- C:\Windows\System\ASMiMKC.exe
  C:\Windows\System\ASMiMKC.exe
  2⤵
  PID:3148
- C:\Windows\System\SOjwyvV.exe
  C:\Windows\System\SOjwyvV.exe
  2⤵
  PID:3208
- C:\Windows\System\Cnzgsrf.exe
  C:\Windows\System\Cnzgsrf.exe
  2⤵
  PID:3244
- C:\Windows\System\jYgONNv.exe
  C:\Windows\System\jYgONNv.exe
  2⤵
  PID:3276
- C:\Windows\System\AetDLxy.exe
  C:\Windows\System\AetDLxy.exe
  2⤵
  PID:2008
- C:\Windows\System\GxvMKyQ.exe
  C:\Windows\System\GxvMKyQ.exe
  2⤵
  PID:2948
- C:\Windows\System\IFskGwm.exe
  C:\Windows\System\IFskGwm.exe
  2⤵
  PID:3400
- C:\Windows\System\SbtGnZS.exe
  C:\Windows\System\SbtGnZS.exe
  2⤵
  PID:1012
- C:\Windows\System\LzsKzkK.exe
  C:\Windows\System\LzsKzkK.exe
  2⤵
  PID:3464
- C:\Windows\System\yLvlABb.exe
  C:\Windows\System\yLvlABb.exe
  2⤵
  PID:1576
- C:\Windows\System\KASaKXg.exe
  C:\Windows\System\KASaKXg.exe
  2⤵
  PID:1564
- C:\Windows\System\KCxHSWT.exe
  C:\Windows\System\KCxHSWT.exe
  2⤵
  PID:3532
- C:\Windows\System\AdFmMod.exe
  C:\Windows\System\AdFmMod.exe
  2⤵
  PID:3596
- C:\Windows\System\mQIoOEn.exe
  C:\Windows\System\mQIoOEn.exe
  2⤵
  PID:3660
- C:\Windows\System\cKzstWx.exe
  C:\Windows\System\cKzstWx.exe
  2⤵
  PID:3724
- C:\Windows\System\jgaxIgn.exe
  C:\Windows\System\jgaxIgn.exe
  2⤵
  PID:3788
- C:\Windows\System\umFxjbb.exe
  C:\Windows\System\umFxjbb.exe
  2⤵
  PID:3852
- C:\Windows\System\GNYzTFd.exe
  C:\Windows\System\GNYzTFd.exe
  2⤵
  PID:3916
- C:\Windows\System\RjzqXXG.exe
  C:\Windows\System\RjzqXXG.exe
  2⤵
  PID:3980
- C:\Windows\System\alWnzOI.exe
  C:\Windows\System\alWnzOI.exe
  2⤵
  PID:4044
- C:\Windows\System\mTgUYTg.exe
  C:\Windows\System\mTgUYTg.exe
  2⤵
  PID:2356
- C:\Windows\System\dIFekoa.exe
  C:\Windows\System\dIFekoa.exe
  2⤵
  PID:2640
- C:\Windows\System\LAORPnJ.exe
  C:\Windows\System\LAORPnJ.exe
  2⤵
  PID:3368
- C:\Windows\System\KRykADm.exe
  C:\Windows\System\KRykADm.exe
  2⤵
  PID:3500
- C:\Windows\System\ibnlCPc.exe
  C:\Windows\System\ibnlCPc.exe
  2⤵
  PID:3656
- C:\Windows\System\zHKozmy.exe
  C:\Windows\System\zHKozmy.exe
  2⤵
  PID:3912
- C:\Windows\System\WhTSlFV.exe
  C:\Windows\System\WhTSlFV.exe
  2⤵
  PID:4104
- C:\Windows\System\pedkWKf.exe
  C:\Windows\System\pedkWKf.exe
  2⤵
  PID:4120
- C:\Windows\System\ifPjoBq.exe
  C:\Windows\System\ifPjoBq.exe
  2⤵
  PID:4136
- C:\Windows\System\WBLKADM.exe
  C:\Windows\System\WBLKADM.exe
  2⤵
  PID:4152
- C:\Windows\System\BndOiPT.exe
  C:\Windows\System\BndOiPT.exe
  2⤵
  PID:4168
- C:\Windows\System\lEoZzXH.exe
  C:\Windows\System\lEoZzXH.exe
  2⤵
  PID:4184
- C:\Windows\System\DsXNEnA.exe
  C:\Windows\System\DsXNEnA.exe
  2⤵
  PID:4200
- C:\Windows\System\tVBaThg.exe
  C:\Windows\System\tVBaThg.exe
  2⤵
  PID:4216
- C:\Windows\System\BHpInZq.exe
  C:\Windows\System\BHpInZq.exe
  2⤵
  PID:4232
- C:\Windows\System\KBFGPAD.exe
  C:\Windows\System\KBFGPAD.exe
  2⤵
  PID:4248
- C:\Windows\System\FEecaRU.exe
  C:\Windows\System\FEecaRU.exe
  2⤵
  PID:4264
- C:\Windows\System\OtYBryc.exe
  C:\Windows\System\OtYBryc.exe
  2⤵
  PID:4280
- C:\Windows\System\rlmeZpq.exe
  C:\Windows\System\rlmeZpq.exe
  2⤵
  PID:4296
- C:\Windows\System\kyzboCY.exe
  C:\Windows\System\kyzboCY.exe
  2⤵
  PID:4312
- C:\Windows\System\SZcgBiU.exe
  C:\Windows\System\SZcgBiU.exe
  2⤵
  PID:4328
- C:\Windows\System\dpAcvlN.exe
  C:\Windows\System\dpAcvlN.exe
  2⤵
  PID:4344
- C:\Windows\System\Exmxwzq.exe
  C:\Windows\System\Exmxwzq.exe
  2⤵
  PID:4360
- C:\Windows\System\AxWlWNB.exe
  C:\Windows\System\AxWlWNB.exe
  2⤵
  PID:4376
- C:\Windows\System\xZDmxub.exe
  C:\Windows\System\xZDmxub.exe
  2⤵
  PID:4392
- C:\Windows\System\qxRcHmf.exe
  C:\Windows\System\qxRcHmf.exe
  2⤵
  PID:4408
- C:\Windows\System\mSOtYlw.exe
  C:\Windows\System\mSOtYlw.exe
  2⤵
  PID:4424
- C:\Windows\System\RQfCBww.exe
  C:\Windows\System\RQfCBww.exe
  2⤵
  PID:4440
- C:\Windows\System\vahQexZ.exe
  C:\Windows\System\vahQexZ.exe
  2⤵
  PID:4592
- C:\Windows\System\NsrBozX.exe
  C:\Windows\System\NsrBozX.exe
  2⤵
  PID:4760
- C:\Windows\System\CECqUvR.exe
  C:\Windows\System\CECqUvR.exe
  2⤵
  PID:4792
- C:\Windows\System\fzTTYCO.exe
  C:\Windows\System\fzTTYCO.exe
  2⤵
  PID:4808
- C:\Windows\System\jtjUsOG.exe
  C:\Windows\System\jtjUsOG.exe
  2⤵
  PID:4824
- C:\Windows\System\NkCFJkT.exe
  C:\Windows\System\NkCFJkT.exe
  2⤵
  PID:4840
- C:\Windows\System\cfkhXmi.exe
  C:\Windows\System\cfkhXmi.exe
  2⤵
  PID:4856
- C:\Windows\System\RkUqmvm.exe
  C:\Windows\System\RkUqmvm.exe
  2⤵
  PID:4872
- C:\Windows\System\pvLeLhL.exe
  C:\Windows\System\pvLeLhL.exe
  2⤵
  PID:4888
- C:\Windows\System\XmtObBJ.exe
  C:\Windows\System\XmtObBJ.exe
  2⤵
  PID:4904
- C:\Windows\System\XjlGKNs.exe
  C:\Windows\System\XjlGKNs.exe
  2⤵
  PID:4176
- C:\Windows\System\yEiwZsk.exe
  C:\Windows\System\yEiwZsk.exe
  2⤵
  PID:2892
- C:\Windows\System\HzzYBwQ.exe
  C:\Windows\System\HzzYBwQ.exe
  2⤵
  PID:2884
- C:\Windows\System\VscGkli.exe
  C:\Windows\System\VscGkli.exe
  2⤵
  PID:2880
- C:\Windows\System\jnmeuIC.exe
  C:\Windows\System\jnmeuIC.exe
  2⤵
  PID:4304
- C:\Windows\System\uHLUzbV.exe
  C:\Windows\System\uHLUzbV.exe
  2⤵
  PID:4336
- C:\Windows\System\RKMukyp.exe
  C:\Windows\System\RKMukyp.exe
  2⤵
  PID:2036
- C:\Windows\System\OIjLSGV.exe
  C:\Windows\System\OIjLSGV.exe
  2⤵
  PID:1944
- C:\Windows\System\tnPYUgS.exe
  C:\Windows\System\tnPYUgS.exe
  2⤵
  PID:2580
- C:\Windows\System\fJDvTKQ.exe
  C:\Windows\System\fJDvTKQ.exe
  2⤵
  PID:2248
- C:\Windows\System\CpSiCtB.exe
  C:\Windows\System\CpSiCtB.exe
  2⤵
  PID:672
- C:\Windows\System\JYclsVd.exe
  C:\Windows\System\JYclsVd.exe
  2⤵
  PID:4368
- C:\Windows\System\yQtFMrG.exe
  C:\Windows\System\yQtFMrG.exe
  2⤵
  PID:4432
- C:\Windows\System\YStQMOX.exe
  C:\Windows\System\YStQMOX.exe
  2⤵
  PID:4608
- C:\Windows\System\EniCBsf.exe
  C:\Windows\System\EniCBsf.exe
  2⤵
  PID:4628
- C:\Windows\System\RwKlYqI.exe
  C:\Windows\System\RwKlYqI.exe
  2⤵
  PID:4644
- C:\Windows\System\QAnbFoH.exe
  C:\Windows\System\QAnbFoH.exe
  2⤵
  PID:4660
- C:\Windows\System\NXYSRDZ.exe
  C:\Windows\System\NXYSRDZ.exe
  2⤵
  PID:4676
- C:\Windows\System\MBQOJAb.exe
  C:\Windows\System\MBQOJAb.exe
  2⤵
  PID:4692
- C:\Windows\System\TJEZCIC.exe
  C:\Windows\System\TJEZCIC.exe
  2⤵
  PID:4712
- C:\Windows\System\lNCfBdd.exe
  C:\Windows\System\lNCfBdd.exe
  2⤵
  PID:4728
- C:\Windows\System\FNlEmNg.exe
  C:\Windows\System\FNlEmNg.exe
  2⤵
  PID:4744
- C:\Windows\System\Mcaeirk.exe
  C:\Windows\System\Mcaeirk.exe
  2⤵
  PID:4800
- C:\Windows\System\gaNsJPS.exe
  C:\Windows\System\gaNsJPS.exe
  2⤵
  PID:4864
- C:\Windows\System\WYoYFRj.exe
  C:\Windows\System\WYoYFRj.exe
  2⤵
  PID:556
- C:\Windows\System\ojbvsaT.exe
  C:\Windows\System\ojbvsaT.exe
  2⤵
  PID:3144
- C:\Windows\System\eTCuKDN.exe
  C:\Windows\System\eTCuKDN.exe
  2⤵
  PID:2180
- C:\Windows\System\GBrMokZ.exe
  C:\Windows\System\GBrMokZ.exe
  2⤵
  PID:2660
- C:\Windows\System\KrslDJG.exe
  C:\Windows\System\KrslDJG.exe
  2⤵
  PID:4244
- C:\Windows\System\mKsCfZw.exe
  C:\Windows\System\mKsCfZw.exe
  2⤵
  PID:900
- C:\Windows\System\kMWddey.exe
  C:\Windows\System\kMWddey.exe
  2⤵
  PID:3720
- C:\Windows\System\fDIdjFb.exe
  C:\Windows\System\fDIdjFb.exe
  2⤵
  PID:3976
- C:\Windows\System\QNbhAEa.exe
  C:\Windows\System\QNbhAEa.exe
  2⤵
  PID:3340
- C:\Windows\System\cgOKgPV.exe
  C:\Windows\System\cgOKgPV.exe
  2⤵
  PID:4040
- C:\Windows\System\UiXpnbG.exe
  C:\Windows\System\UiXpnbG.exe
  2⤵
  PID:4160
- C:\Windows\System\snQkFeI.exe
  C:\Windows\System\snQkFeI.exe
  2⤵
  PID:2888
- C:\Windows\System\McClWeF.exe
  C:\Windows\System\McClWeF.exe
  2⤵
  PID:1144
- C:\Windows\System\GchlAOH.exe
  C:\Windows\System\GchlAOH.exe
  2⤵
  PID:3036
- C:\Windows\System\JqLVTOt.exe
  C:\Windows\System\JqLVTOt.exe
  2⤵
  PID:4736
- C:\Windows\System\WMUDdXx.exe
  C:\Windows\System\WMUDdXx.exe
  2⤵
  PID:4668
- C:\Windows\System\OVZgyqz.exe
  C:\Windows\System\OVZgyqz.exe
  2⤵
  PID:4600
- C:\Windows\System\FJSDVHW.exe
  C:\Windows\System\FJSDVHW.exe
  2⤵
  PID:864
- C:\Windows\System\ejIblOB.exe
  C:\Windows\System\ejIblOB.exe
  2⤵
  PID:2716
- C:\Windows\System\zWNysdm.exe
  C:\Windows\System\zWNysdm.exe
  2⤵
  PID:4196
- C:\Windows\System\hCnCEvT.exe
  C:\Windows\System\hCnCEvT.exe
  2⤵
  PID:3416
- C:\Windows\System\YYgMQyS.exe
  C:\Windows\System\YYgMQyS.exe
  2⤵
  PID:3640
- C:\Windows\System\EqGRbGo.exe
  C:\Windows\System\EqGRbGo.exe
  2⤵
  PID:4224
- C:\Windows\System\vqoYuHN.exe
  C:\Windows\System\vqoYuHN.exe
  2⤵
  PID:5124
- C:\Windows\System\HSyTRGA.exe
  C:\Windows\System\HSyTRGA.exe
  2⤵
  PID:5140
- C:\Windows\System\ZbQCqcw.exe
  C:\Windows\System\ZbQCqcw.exe
  2⤵
  PID:5156
- C:\Windows\System\uGedYRW.exe
  C:\Windows\System\uGedYRW.exe
  2⤵
  PID:5172
- C:\Windows\System\GCszrfu.exe
  C:\Windows\System\GCszrfu.exe
  2⤵
  PID:5188
- C:\Windows\System\VxOckcL.exe
  C:\Windows\System\VxOckcL.exe
  2⤵
  PID:5208
- C:\Windows\System\jxUuoLx.exe
  C:\Windows\System\jxUuoLx.exe
  2⤵
  PID:5224
- C:\Windows\System\bnaErBM.exe
  C:\Windows\System\bnaErBM.exe
  2⤵
  PID:5240
- C:\Windows\System\crrBQbF.exe
  C:\Windows\System\crrBQbF.exe
  2⤵
  PID:5256
- C:\Windows\System\VQETNkL.exe
  C:\Windows\System\VQETNkL.exe
  2⤵
  PID:5276
- C:\Windows\System\UImrgnc.exe
  C:\Windows\System\UImrgnc.exe
  2⤵
  PID:5296
- C:\Windows\System\qluhFOV.exe
  C:\Windows\System\qluhFOV.exe
  2⤵
  PID:5312
- C:\Windows\System\TkwScnb.exe
  C:\Windows\System\TkwScnb.exe
  2⤵
  PID:5328
- C:\Windows\System\wQVLpnQ.exe
  C:\Windows\System\wQVLpnQ.exe
  2⤵
  PID:5356
- C:\Windows\System\eoaoIop.exe
  C:\Windows\System\eoaoIop.exe
  2⤵
  PID:5372
- C:\Windows\System\HVgTXqY.exe
  C:\Windows\System\HVgTXqY.exe
  2⤵
  PID:5392
- C:\Windows\System\WRxDbNZ.exe
  C:\Windows\System\WRxDbNZ.exe
  2⤵
  PID:5408
- C:\Windows\System\gjXSeak.exe
  C:\Windows\System\gjXSeak.exe
  2⤵
  PID:5432
- C:\Windows\System\ukTVRHG.exe
  C:\Windows\System\ukTVRHG.exe
  2⤵
  PID:5448
- C:\Windows\System\hACsKwU.exe
  C:\Windows\System\hACsKwU.exe
  2⤵
  PID:5464
- C:\Windows\System\TKXIySB.exe
  C:\Windows\System\TKXIySB.exe
  2⤵
  PID:5488
- C:\Windows\System\EjUIdMD.exe
  C:\Windows\System\EjUIdMD.exe
  2⤵
  PID:5512
- C:\Windows\System\nYyJqwY.exe
  C:\Windows\System\nYyJqwY.exe
  2⤵
  PID:5528
- C:\Windows\System\lastCBg.exe
  C:\Windows\System\lastCBg.exe
  2⤵
  PID:5544
- C:\Windows\System\MNqeSqy.exe
  C:\Windows\System\MNqeSqy.exe
  2⤵
  PID:5560
- C:\Windows\System\bszoFoU.exe
  C:\Windows\System\bszoFoU.exe
  2⤵
  PID:5576
- C:\Windows\System\QZxJtFO.exe
  C:\Windows\System\QZxJtFO.exe
  2⤵
  PID:5592
- C:\Windows\System\pTpIEKI.exe
  C:\Windows\System\pTpIEKI.exe
  2⤵
  PID:5608
- C:\Windows\System\UIBgDbl.exe
  C:\Windows\System\UIBgDbl.exe
  2⤵
  PID:5624
- C:\Windows\System\peAzVsP.exe
  C:\Windows\System\peAzVsP.exe
  2⤵
  PID:5640
- C:\Windows\System\BWjIOhK.exe
  C:\Windows\System\BWjIOhK.exe
  2⤵
  PID:5656
- C:\Windows\System\xsGQMGm.exe
  C:\Windows\System\xsGQMGm.exe
  2⤵
  PID:5672
- C:\Windows\System\iEbwzhy.exe
  C:\Windows\System\iEbwzhy.exe
  2⤵
  PID:5688
- C:\Windows\System\DuFWnkk.exe
  C:\Windows\System\DuFWnkk.exe
  2⤵
  PID:5704
- C:\Windows\System\qjusyVV.exe
  C:\Windows\System\qjusyVV.exe
  2⤵
  PID:5720
- C:\Windows\System\qkdrKBb.exe
  C:\Windows\System\qkdrKBb.exe
  2⤵
  PID:5736
- C:\Windows\System\guNJTmI.exe
  C:\Windows\System\guNJTmI.exe
  2⤵
  PID:5896
- C:\Windows\System\ewYbxaK.exe
  C:\Windows\System\ewYbxaK.exe
  2⤵
  PID:5912
- C:\Windows\System\LXMVJOL.exe
  C:\Windows\System\LXMVJOL.exe
  2⤵
  PID:5928
- C:\Windows\System\mbTGybI.exe
  C:\Windows\System\mbTGybI.exe
  2⤵
  PID:5944
- C:\Windows\System\UXNqLJE.exe
  C:\Windows\System\UXNqLJE.exe
  2⤵
  PID:5960
- C:\Windows\System\bHuPFue.exe
  C:\Windows\System\bHuPFue.exe
  2⤵
  PID:5976
- C:\Windows\System\UPjDhEL.exe
  C:\Windows\System\UPjDhEL.exe
  2⤵
  PID:5992
- C:\Windows\System\EGfvrjP.exe
  C:\Windows\System\EGfvrjP.exe
  2⤵
  PID:6008
- C:\Windows\System\SXukeuW.exe
  C:\Windows\System\SXukeuW.exe
  2⤵
  PID:6028
- C:\Windows\System\zFANCgI.exe
  C:\Windows\System\zFANCgI.exe
  2⤵
  PID:6044
- C:\Windows\System\xtGaExZ.exe
  C:\Windows\System\xtGaExZ.exe
  2⤵
  PID:6060
- C:\Windows\System\CaurakO.exe
  C:\Windows\System\CaurakO.exe
  2⤵
  PID:6076
- C:\Windows\System\AitpDdx.exe
  C:\Windows\System\AitpDdx.exe
  2⤵
  PID:6092
- C:\Windows\System\taHNJmi.exe
  C:\Windows\System\taHNJmi.exe
  2⤵
  PID:6108
- C:\Windows\System\lWzZqVn.exe
  C:\Windows\System\lWzZqVn.exe
  2⤵
  PID:6124
- C:\Windows\System\nZZcaLP.exe
  C:\Windows\System\nZZcaLP.exe
  2⤵
  PID:6140
- C:\Windows\System\yehbsUK.exe
  C:\Windows\System\yehbsUK.exe
  2⤵
  PID:4324
- C:\Windows\System\soVTZWx.exe
  C:\Windows\System\soVTZWx.exe
  2⤵
  PID:2560
- C:\Windows\System\nJrrbNF.exe
  C:\Windows\System\nJrrbNF.exe
  2⤵
  PID:4388
- C:\Windows\System\nyoHEtV.exe
  C:\Windows\System\nyoHEtV.exe
  2⤵
  PID:4452
- C:\Windows\System\lrugiZy.exe
  C:\Windows\System\lrugiZy.exe
  2⤵
  PID:3948
- C:\Windows\System\OEOKSGx.exe
  C:\Windows\System\OEOKSGx.exe
  2⤵
  PID:2256
- C:\Windows\System\NwVATuu.exe
  C:\Windows\System\NwVATuu.exe
  2⤵
  PID:4700
- C:\Windows\System\oNZqzfu.exe
  C:\Windows\System\oNZqzfu.exe
  2⤵
  PID:2676
- C:\Windows\System\vtDwCCv.exe
  C:\Windows\System\vtDwCCv.exe
  2⤵
  PID:4256
- C:\Windows\System\KuCOfmY.exe
  C:\Windows\System\KuCOfmY.exe
  2⤵
  PID:2896
- C:\Windows\System\fSCruJG.exe
  C:\Windows\System\fSCruJG.exe
  2⤵
  PID:5180
- C:\Windows\System\dDfQniK.exe
  C:\Windows\System\dDfQniK.exe
  2⤵
  PID:1896
- C:\Windows\System\zdTnNSx.exe
  C:\Windows\System\zdTnNSx.exe
  2⤵
  PID:5220
- C:\Windows\System\xoWjHQJ.exe
  C:\Windows\System\xoWjHQJ.exe
  2⤵
  PID:2236
- C:\Windows\System\nMFmOdc.exe
  C:\Windows\System\nMFmOdc.exe
  2⤵
  PID:2544
- C:\Windows\System\lzGzjYC.exe
  C:\Windows\System\lzGzjYC.exe
  2⤵
  PID:5044
- C:\Windows\System\DUkECbv.exe
  C:\Windows\System\DUkECbv.exe
  2⤵
  PID:3516
- C:\Windows\System\BfVAYxX.exe
  C:\Windows\System\BfVAYxX.exe
  2⤵
  PID:5088
- C:\Windows\System\QgusByH.exe
  C:\Windows\System\QgusByH.exe
  2⤵
  PID:5084
- C:\Windows\System\SkYDmwR.exe
  C:\Windows\System\SkYDmwR.exe
  2⤵
  PID:5100
- C:\Windows\System\UZqMTow.exe
  C:\Windows\System\UZqMTow.exe
  2⤵
  PID:3772
- C:\Windows\System\PKGpwNU.exe
  C:\Windows\System\PKGpwNU.exe
  2⤵
  PID:3832
- C:\Windows\System\uMLgtue.exe
  C:\Windows\System\uMLgtue.exe
  2⤵
  PID:3896
- C:\Windows\System\fcpDfLZ.exe
  C:\Windows\System\fcpDfLZ.exe
  2⤵
  PID:804
- C:\Windows\System\ysLxZBa.exe
  C:\Windows\System\ysLxZBa.exe
  2⤵
  PID:3960
- C:\Windows\System\RrtdWca.exe
  C:\Windows\System\RrtdWca.exe
  2⤵
  PID:3692
- C:\Windows\System\TBpPoIP.exe
  C:\Windows\System\TBpPoIP.exe
  2⤵
  PID:4132
- C:\Windows\System\VQyixKD.exe
  C:\Windows\System\VQyixKD.exe
  2⤵
  PID:4740
- C:\Windows\System\mIvMrRh.exe
  C:\Windows\System\mIvMrRh.exe
  2⤵
  PID:5136
- C:\Windows\System\pMpbUdv.exe
  C:\Windows\System\pMpbUdv.exe
  2⤵
  PID:4604
- C:\Windows\System\nzCmkEp.exe
  C:\Windows\System\nzCmkEp.exe
  2⤵
  PID:5268
- C:\Windows\System\BJfVLOd.exe
  C:\Windows\System\BJfVLOd.exe
  2⤵
  PID:2032
- C:\Windows\System\dJSlidb.exe
  C:\Windows\System\dJSlidb.exe
  2⤵
  PID:264
- C:\Windows\System\jGNjUUZ.exe
  C:\Windows\System\jGNjUUZ.exe
  2⤵
  PID:2200
- C:\Windows\System\rmiMuka.exe
  C:\Windows\System\rmiMuka.exe
  2⤵
  PID:1256
- C:\Windows\System\IMpuVGh.exe
  C:\Windows\System\IMpuVGh.exe
  2⤵
  PID:2276
- C:\Windows\System\ItkiigU.exe
  C:\Windows\System\ItkiigU.exe
  2⤵
  PID:1672
- C:\Windows\System\qRQxIPA.exe
  C:\Windows\System\qRQxIPA.exe
  2⤵
  PID:1360
- C:\Windows\System\vwuyadU.exe
  C:\Windows\System\vwuyadU.exe
  2⤵
  PID:3196
- C:\Windows\System\qBrHiQI.exe
  C:\Windows\System\qBrHiQI.exe
  2⤵
  PID:3192
- C:\Windows\System\mlPaQwU.exe
  C:\Windows\System\mlPaQwU.exe
  2⤵
  PID:3256
- C:\Windows\System\aIrxiBN.exe
  C:\Windows\System\aIrxiBN.exe
  2⤵
  PID:3324
- C:\Windows\System\SHttjAv.exe
  C:\Windows\System\SHttjAv.exe
  2⤵
  PID:3512
- C:\Windows\System\OCelBHU.exe
  C:\Windows\System\OCelBHU.exe
  2⤵
  PID:1968
- C:\Windows\System\xrLUVFt.exe
  C:\Windows\System\xrLUVFt.exe
  2⤵
  PID:5440
- C:\Windows\System\JAwkuog.exe
  C:\Windows\System\JAwkuog.exe
  2⤵
  PID:4516
- C:\Windows\System\NSSXcAp.exe
  C:\Windows\System\NSSXcAp.exe
  2⤵
  PID:4532
- C:\Windows\System\WuZLzTv.exe
  C:\Windows\System\WuZLzTv.exe
  2⤵
  PID:5480
- C:\Windows\System\YtvzXEk.exe
  C:\Windows\System\YtvzXEk.exe
  2⤵
  PID:5652
- C:\Windows\System\yGcLtrI.exe
  C:\Windows\System\yGcLtrI.exe
  2⤵
  PID:5524
- C:\Windows\System\gapXDWJ.exe
  C:\Windows\System\gapXDWJ.exe
  2⤵
  PID:5712
- C:\Windows\System\ITiLMxT.exe
  C:\Windows\System\ITiLMxT.exe
  2⤵
  PID:5760
- C:\Windows\System\hTbzUJj.exe
  C:\Windows\System\hTbzUJj.exe
  2⤵
  PID:4552
- C:\Windows\System\jLYtueI.exe
  C:\Windows\System\jLYtueI.exe
  2⤵
  PID:4568
- C:\Windows\System\tjpgxrg.exe
  C:\Windows\System\tjpgxrg.exe
  2⤵
  PID:5772
- C:\Windows\System\bZDBsAB.exe
  C:\Windows\System\bZDBsAB.exe
  2⤵
  PID:4768
- C:\Windows\System\mvxeNQG.exe
  C:\Windows\System\mvxeNQG.exe
  2⤵
  PID:4788
- C:\Windows\System\WyLwpkf.exe
  C:\Windows\System\WyLwpkf.exe
  2⤵
  PID:4852
- C:\Windows\System\MwdJboQ.exe
  C:\Windows\System\MwdJboQ.exe
  2⤵
  PID:4916
- C:\Windows\System\gCyXoGg.exe
  C:\Windows\System\gCyXoGg.exe
  2⤵
  PID:4940
- C:\Windows\System\soBqzOg.exe
  C:\Windows\System\soBqzOg.exe
  2⤵
  PID:4956
- C:\Windows\System\WErATgQ.exe
  C:\Windows\System\WErATgQ.exe
  2⤵
  PID:4972
- C:\Windows\System\vnmbHxr.exe
  C:\Windows\System\vnmbHxr.exe
  2⤵
  PID:4988
- C:\Windows\System\onBSVjU.exe
  C:\Windows\System\onBSVjU.exe
  2⤵
  PID:5012
- C:\Windows\System\blXttaD.exe
  C:\Windows\System\blXttaD.exe
  2⤵
  PID:5036
- C:\Windows\System\SvHOHKJ.exe
  C:\Windows\System\SvHOHKJ.exe
  2⤵
  PID:5056
- C:\Windows\System\njNUoKW.exe
  C:\Windows\System\njNUoKW.exe
  2⤵
  PID:3084
- C:\Windows\System\MGlTKWf.exe
  C:\Windows\System\MGlTKWf.exe
  2⤵
  PID:1884
- C:\Windows\System\CEnqEFI.exe
  C:\Windows\System\CEnqEFI.exe
  2⤵
  PID:4688
- C:\Windows\System\SknbAFD.exe
  C:\Windows\System\SknbAFD.exe
  2⤵
  PID:2688
- C:\Windows\System\vPPKIeH.exe
  C:\Windows\System\vPPKIeH.exe
  2⤵
  PID:5232
- C:\Windows\System\kmsZlyM.exe
  C:\Windows\System\kmsZlyM.exe
  2⤵
  PID:2620
- C:\Windows\System\nplNhDr.exe
  C:\Windows\System\nplNhDr.exe
  2⤵
  PID:5380
- C:\Windows\System\MhvmaKi.exe
  C:\Windows\System\MhvmaKi.exe
  2⤵
  PID:5456
- C:\Windows\System\ZOQjxbx.exe
  C:\Windows\System\ZOQjxbx.exe
  2⤵
  PID:5504
- C:\Windows\System\FqyGVxg.exe
  C:\Windows\System\FqyGVxg.exe
  2⤵
  PID:5776
- C:\Windows\System\NAEjnGW.exe
  C:\Windows\System\NAEjnGW.exe
  2⤵
  PID:5636
- C:\Windows\System\DnGlbhs.exe
  C:\Windows\System\DnGlbhs.exe
  2⤵
  PID:5700
- C:\Windows\System\eVszhmM.exe
  C:\Windows\System\eVszhmM.exe
  2⤵
  PID:5800
- C:\Windows\System\hjNWmpu.exe
  C:\Windows\System\hjNWmpu.exe
  2⤵
  PID:5824
- C:\Windows\System\DTErCKT.exe
  C:\Windows\System\DTErCKT.exe
  2⤵
  PID:5840
- C:\Windows\System\kFjvLsj.exe
  C:\Windows\System\kFjvLsj.exe
  2⤵
  PID:1456
- C:\Windows\System\CvQATrJ.exe
  C:\Windows\System\CvQATrJ.exe
  2⤵
  PID:5864
- C:\Windows\System\OHPbfSx.exe
  C:\Windows\System\OHPbfSx.exe
  2⤵
  PID:2068
- C:\Windows\System\OXnrLaT.exe
  C:\Windows\System\OXnrLaT.exe
  2⤵
  PID:1104
- C:\Windows\System\ZUkigRv.exe
  C:\Windows\System\ZUkigRv.exe
  2⤵
  PID:912
- C:\Windows\System\zMWUBxF.exe
  C:\Windows\System\zMWUBxF.exe
  2⤵
  PID:5920
- C:\Windows\System\hpxhHFl.exe
  C:\Windows\System\hpxhHFl.exe
  2⤵
  PID:5940
- C:\Windows\System\PmzyDfb.exe
  C:\Windows\System\PmzyDfb.exe
  2⤵
  PID:5968
- C:\Windows\System\kOPbiPF.exe
  C:\Windows\System\kOPbiPF.exe
  2⤵
  PID:6000
- C:\Windows\System\HPowRrU.exe
  C:\Windows\System\HPowRrU.exe
  2⤵
  PID:6036
- C:\Windows\System\SIJncgh.exe
  C:\Windows\System\SIJncgh.exe
  2⤵
  PID:2576
- C:\Windows\System\YVIciLi.exe
  C:\Windows\System\YVIciLi.exe
  2⤵
  PID:6084
- C:\Windows\System\iDkbXMh.exe
  C:\Windows\System\iDkbXMh.exe
  2⤵
  PID:6116
- C:\Windows\System\OdlGDiU.exe
  C:\Windows\System\OdlGDiU.exe
  2⤵
  PID:6136
- C:\Windows\System\bIvZgtf.exe
  C:\Windows\System\bIvZgtf.exe
  2⤵
  PID:1496
- C:\Windows\System\yuvzUYw.exe
  C:\Windows\System\yuvzUYw.exe
  2⤵
  PID:4456
- C:\Windows\System\EhgJuZT.exe
  C:\Windows\System\EhgJuZT.exe
  2⤵
  PID:4028
- C:\Windows\System\XxPyDfS.exe
  C:\Windows\System\XxPyDfS.exe
  2⤵
  PID:296
- C:\Windows\System\THHBSDE.exe
  C:\Windows\System\THHBSDE.exe
  2⤵
  PID:1216
- C:\Windows\System\mcAZZuy.exe
  C:\Windows\System\mcAZZuy.exe
  2⤵
  PID:1420
- C:\Windows\System\TUqEBKb.exe
  C:\Windows\System\TUqEBKb.exe
  2⤵
  PID:5320
- C:\Windows\System\vqdsbOP.exe
  C:\Windows\System\vqdsbOP.exe
  2⤵
  PID:2376
- C:\Windows\System\FOQyksI.exe
  C:\Windows\System\FOQyksI.exe
  2⤵
  PID:5364
- C:\Windows\System\YrWOewB.exe
  C:\Windows\System\YrWOewB.exe
  2⤵
  PID:1524
- C:\Windows\System\FMbPnsj.exe
  C:\Windows\System\FMbPnsj.exe
  2⤵
  PID:3496
- C:\Windows\System\euTFtqA.exe
  C:\Windows\System\euTFtqA.exe
  2⤵
  PID:5096
- C:\Windows\System\TlaIIkp.exe
  C:\Windows\System\TlaIIkp.exe
  2⤵
  PID:1616
- C:\Windows\System\aRmELVs.exe
  C:\Windows\System\aRmELVs.exe
  2⤵
  PID:5184
- C:\Windows\System\qorrizy.exe
  C:\Windows\System\qorrizy.exe
  2⤵
  PID:3740
- C:\Windows\System\eRZiRou.exe
  C:\Windows\System\eRZiRou.exe
  2⤵
  PID:3708
- C:\Windows\System\rYUMkqM.exe
  C:\Windows\System\rYUMkqM.exe
  2⤵
  PID:5368
- C:\Windows\System\goOooFX.exe
  C:\Windows\System\goOooFX.exe
  2⤵
  PID:1640
- C:\Windows\System\DAzmYGH.exe
  C:\Windows\System\DAzmYGH.exe
  2⤵
  PID:2904
- C:\Windows\System\ZDhAZZC.exe
  C:\Windows\System\ZDhAZZC.exe
  2⤵
  PID:6024
- C:\Windows\System\NEtXYjU.exe
  C:\Windows\System\NEtXYjU.exe
  2⤵
  PID:5400
- C:\Windows\System\ECjtxBn.exe
  C:\Windows\System\ECjtxBn.exe
  2⤵
  PID:4756
- C:\Windows\System\DhXtZlh.exe
  C:\Windows\System\DhXtZlh.exe
  2⤵
  PID:2232
- C:\Windows\System\AGisZzl.exe
  C:\Windows\System\AGisZzl.exe
  2⤵
  PID:3272
- C:\Windows\System\saJbRvn.exe
  C:\Windows\System\saJbRvn.exe
  2⤵
  PID:5164
- C:\Windows\System\GPQGitF.exe
  C:\Windows\System\GPQGitF.exe
  2⤵
  PID:4832
- C:\Windows\System\qzpwfhe.exe
  C:\Windows\System\qzpwfhe.exe
  2⤵
  PID:3672
- C:\Windows\System\aBZJPni.exe
  C:\Windows\System\aBZJPni.exe
  2⤵
  PID:1544
- C:\Windows\System\RjHdQmG.exe
  C:\Windows\System\RjHdQmG.exe
  2⤵
  PID:2004
- C:\Windows\System\AJXHmQP.exe
  C:\Windows\System\AJXHmQP.exe
  2⤵
  PID:1072
- C:\Windows\System\WjMVzsd.exe
  C:\Windows\System\WjMVzsd.exe
  2⤵
  PID:872
- C:\Windows\System\TvDSkZO.exe
  C:\Windows\System\TvDSkZO.exe
  2⤵
  PID:2960
- C:\Windows\System\KkVtXQS.exe
  C:\Windows\System\KkVtXQS.exe
  2⤵
  PID:5032
- C:\Windows\System\IGSAPKf.exe
  C:\Windows\System\IGSAPKf.exe
  2⤵
  PID:3356
- C:\Windows\System\pQUNREB.exe
  C:\Windows\System\pQUNREB.exe
  2⤵
  PID:4464
- C:\Windows\System\zTQmCzG.exe
  C:\Windows\System\zTQmCzG.exe
  2⤵
  PID:4476
- C:\Windows\System\dfzFGvg.exe
  C:\Windows\System\dfzFGvg.exe
  2⤵
  PID:4488
- C:\Windows\System\ItWbYmL.exe
  C:\Windows\System\ItWbYmL.exe
  2⤵
  PID:4504
- C:\Windows\System\CudVzvv.exe
  C:\Windows\System\CudVzvv.exe
  2⤵
  PID:4528
- C:\Windows\System\KZQfcnc.exe
  C:\Windows\System\KZQfcnc.exe
  2⤵
  PID:5620
- C:\Windows\System\xrOkjqf.exe
  C:\Windows\System\xrOkjqf.exe
  2⤵
  PID:5744
- C:\Windows\System\fikIPDN.exe
  C:\Windows\System\fikIPDN.exe
  2⤵
  PID:4544
- C:\Windows\System\HzbmcrA.exe
  C:\Windows\System\HzbmcrA.exe
  2⤵
  PID:4564
- C:\Windows\System\oHzKOgP.exe
  C:\Windows\System\oHzKOgP.exe
  2⤵
  PID:4776
- C:\Windows\System\CyAKxIs.exe
  C:\Windows\System\CyAKxIs.exe
  2⤵
  PID:4848
- C:\Windows\System\IWozFHX.exe
  C:\Windows\System\IWozFHX.exe
  2⤵
  PID:4936
- C:\Windows\System\cLcFQVS.exe
  C:\Windows\System\cLcFQVS.exe
  2⤵
  PID:4952
- C:\Windows\System\UlrEAZV.exe
  C:\Windows\System\UlrEAZV.exe
  2⤵
  PID:4984
- C:\Windows\System\jOTVUjT.exe
  C:\Windows\System\jOTVUjT.exe
  2⤵
  PID:5024
- C:\Windows\System\nUsRwwV.exe
  C:\Windows\System\nUsRwwV.exe
  2⤵
  PID:5076
- C:\Windows\System\wyXPnLT.exe
  C:\Windows\System\wyXPnLT.exe
  2⤵
  PID:832
- C:\Windows\System\PgMpmzB.exe
  C:\Windows\System\PgMpmzB.exe
  2⤵
  PID:2064
- C:\Windows\System\xXGqWAs.exe
  C:\Windows\System\xXGqWAs.exe
  2⤵
  PID:5052
- C:\Windows\System\yTvzJCf.exe
  C:\Windows\System\yTvzJCf.exe
  2⤵
  PID:3164
- C:\Windows\System\rUsVGwt.exe
  C:\Windows\System\rUsVGwt.exe
  2⤵
  PID:5348
- C:\Windows\System\kCJZIeQ.exe
  C:\Windows\System\kCJZIeQ.exe
  2⤵
  PID:2332
- C:\Windows\System\RatzcwS.exe
  C:\Windows\System\RatzcwS.exe
  2⤵
  PID:5632
- C:\Windows\System\pCXWmLH.exe
  C:\Windows\System\pCXWmLH.exe
  2⤵
  PID:5416
- C:\Windows\System\dIYFjup.exe
  C:\Windows\System\dIYFjup.exe
  2⤵
  PID:5388
- C:\Windows\System\fGogEdH.exe
  C:\Windows\System\fGogEdH.exe
  2⤵
  PID:2912
- C:\Windows\System\gFUGFGm.exe
  C:\Windows\System\gFUGFGm.exe
  2⤵
  PID:5668
- C:\Windows\System\kewFVFc.exe
  C:\Windows\System\kewFVFc.exe
  2⤵
  PID:5816
- C:\Windows\System\qjodAyd.exe
  C:\Windows\System\qjodAyd.exe
  2⤵
  PID:2672
- C:\Windows\System\TXizyFx.exe
  C:\Windows\System\TXizyFx.exe
  2⤵
  PID:5872
- C:\Windows\System\mXiqIJV.exe
  C:\Windows\System\mXiqIJV.exe
  2⤵
  PID:5908
- C:\Windows\System\STYIbzX.exe
  C:\Windows\System\STYIbzX.exe
  2⤵
  PID:6020
- C:\Windows\System\SGSQEIu.exe
  C:\Windows\System\SGSQEIu.exe
  2⤵
  PID:4292
- C:\Windows\System\HVMFudR.exe
  C:\Windows\System\HVMFudR.exe
  2⤵
  PID:6052
- C:\Windows\System\evWTVUz.exe
  C:\Windows\System\evWTVUz.exe
  2⤵
  PID:4352
- C:\Windows\System\xWqlrhx.exe
  C:\Windows\System\xWqlrhx.exe
  2⤵
  PID:5148
- C:\Windows\System\hsYhnAk.exe
  C:\Windows\System\hsYhnAk.exe
  2⤵
  PID:5924
- C:\Windows\System\GPXpDYH.exe
  C:\Windows\System\GPXpDYH.exe
  2⤵
  PID:5936
- C:\Windows\System\tlThJgR.exe
  C:\Windows\System\tlThJgR.exe
  2⤵
  PID:344
- C:\Windows\System\pnhXGzs.exe
  C:\Windows\System\pnhXGzs.exe
  2⤵
  PID:3992
- C:\Windows\System\BYvRXEB.exe
  C:\Windows\System\BYvRXEB.exe
  2⤵
  PID:3676
- C:\Windows\System\epaTYjD.exe
  C:\Windows\System\epaTYjD.exe
  2⤵
  PID:3768
- C:\Windows\System\LNQEcAM.exe
  C:\Windows\System\LNQEcAM.exe
  2⤵
  PID:3452
- C:\Windows\System\UfHslfQ.exe
  C:\Windows\System\UfHslfQ.exe
  2⤵
  PID:1864
- C:\Windows\System\rFGkZsj.exe
  C:\Windows\System\rFGkZsj.exe
  2⤵
  PID:3180
- C:\Windows\System\kqGluCD.exe
  C:\Windows\System\kqGluCD.exe
  2⤵
  PID:2164
- C:\Windows\System\lgthsjl.exe
  C:\Windows\System\lgthsjl.exe
  2⤵
  PID:4400
- C:\Windows\System\sBZamlp.exe
  C:\Windows\System\sBZamlp.exe
  2⤵
  PID:3000
- C:\Windows\System\mgIeXSK.exe
  C:\Windows\System\mgIeXSK.exe
  2⤵
  PID:2456
- C:\Windows\System\esLDeby.exe
  C:\Windows\System\esLDeby.exe
  2⤵
  PID:4900
- C:\Windows\System\ROYNhUk.exe
  C:\Windows\System\ROYNhUk.exe
  2⤵
  PID:2856
- C:\Windows\System\kwnOWHr.exe
  C:\Windows\System\kwnOWHr.exe
  2⤵
  PID:300
- C:\Windows\System\aPWbGYM.exe
  C:\Windows\System\aPWbGYM.exe
  2⤵
  PID:3388
- C:\Windows\System\sgeVkJG.exe
  C:\Windows\System\sgeVkJG.exe
  2⤵
  PID:1580
- C:\Windows\System\njOBtXi.exe
  C:\Windows\System\njOBtXi.exe
  2⤵
  PID:2132
- C:\Windows\System\lFhpkZu.exe
  C:\Windows\System\lFhpkZu.exe
  2⤵
  PID:4548
- C:\Windows\System\nOxpFvu.exe
  C:\Windows\System\nOxpFvu.exe
  2⤵
  PID:1748
- C:\Windows\System\sDRUJwW.exe
  C:\Windows\System\sDRUJwW.exe
  2⤵
  PID:5020
- C:\Windows\System\aMwCKxe.exe
  C:\Windows\System\aMwCKxe.exe
  2⤵
  PID:5556
- C:\Windows\System\DlYoFbf.exe
  C:\Windows\System\DlYoFbf.exe
  2⤵
  PID:5048
- C:\Windows\System\Gzewpch.exe
  C:\Windows\System\Gzewpch.exe
  2⤵
  PID:5308
- C:\Windows\System\EWvtZLz.exe
  C:\Windows\System\EWvtZLz.exe
  2⤵
  PID:4784
- C:\Windows\System\CpCAdTx.exe
  C:\Windows\System\CpCAdTx.exe
  2⤵
  PID:5572
- C:\Windows\System\UcJibuO.exe
  C:\Windows\System\UcJibuO.exe
  2⤵
  PID:3292
- C:\Windows\System\HCjsjIm.exe
  C:\Windows\System\HCjsjIm.exe
  2⤵
  PID:4472
- C:\Windows\System\XjgLGDE.exe
  C:\Windows\System\XjgLGDE.exe
  2⤵
  PID:5588
- C:\Windows\System\uuKmUyI.exe
  C:\Windows\System\uuKmUyI.exe
  2⤵
  PID:6132
- C:\Windows\System\IFgdBMK.exe
  C:\Windows\System\IFgdBMK.exe
  2⤵
  PID:4912
- C:\Windows\System\VAoZIwW.exe
  C:\Windows\System\VAoZIwW.exe
  2⤵
  PID:1572
- C:\Windows\System\TNHFdSS.exe
  C:\Windows\System\TNHFdSS.exe
  2⤵
  PID:5868
- C:\Windows\System\wufPUbv.exe
  C:\Windows\System\wufPUbv.exe
  2⤵
  PID:1424
- C:\Windows\System\CwgZhBm.exe
  C:\Windows\System\CwgZhBm.exe
  2⤵
  PID:2616
- C:\Windows\System\gIqmyyH.exe
  C:\Windows\System\gIqmyyH.exe
  2⤵
  PID:5812
- C:\Windows\System\ptazANP.exe
  C:\Windows\System\ptazANP.exe
  2⤵
  PID:2324
- C:\Windows\System\Jbckula.exe
  C:\Windows\System\Jbckula.exe
  2⤵
  PID:5844
- C:\Windows\System\pnSPzCJ.exe
  C:\Windows\System\pnSPzCJ.exe
  2⤵
  PID:5956
- C:\Windows\System\ldWcfMi.exe
  C:\Windows\System\ldWcfMi.exe
  2⤵
  PID:5988
- C:\Windows\System\WwMpulH.exe
  C:\Windows\System\WwMpulH.exe
  2⤵
  PID:5284
- C:\Windows\System\KAsMKKV.exe
  C:\Windows\System\KAsMKKV.exe
  2⤵
  PID:4524
- C:\Windows\System\ShuEfWi.exe
  C:\Windows\System\ShuEfWi.exe
  2⤵
  PID:5216
- C:\Windows\System\dairFbN.exe
  C:\Windows\System\dairFbN.exe
  2⤵
  PID:3884
- C:\Windows\System\DibyYnY.exe
  C:\Windows\System\DibyYnY.exe
  2⤵
  PID:4092
- C:\Windows\System\XXuzKsd.exe
  C:\Windows\System\XXuzKsd.exe
  2⤵
  PID:2424
- C:\Windows\System\jfuHsGH.exe
  C:\Windows\System\jfuHsGH.exe
  2⤵
  PID:4496
- C:\Windows\System\ktbWFKp.exe
  C:\Windows\System\ktbWFKp.exe
  2⤵
  PID:1920
- C:\Windows\System\gQmqYUg.exe
  C:\Windows\System\gQmqYUg.exe
  2⤵
  PID:5568
- C:\Windows\System\yfzdgQQ.exe
  C:\Windows\System\yfzdgQQ.exe
  2⤵
  PID:3804
- C:\Windows\System\KyXvEbK.exe
  C:\Windows\System\KyXvEbK.exe
  2⤵
  PID:6016
- C:\Windows\System\gNTzLvJ.exe
  C:\Windows\System\gNTzLvJ.exe
  2⤵
  PID:6040
- C:\Windows\System\nGBhxuV.exe
  C:\Windows\System\nGBhxuV.exe
  2⤵
  PID:2920
- C:\Windows\System\oXTkfPh.exe
  C:\Windows\System\oXTkfPh.exe
  2⤵
  PID:4924
- C:\Windows\System\Nuiawhu.exe
  C:\Windows\System\Nuiawhu.exe
  2⤵
  PID:3128
- C:\Windows\System\encZaUY.exe
  C:\Windows\System\encZaUY.exe
  2⤵
  PID:5764
- C:\Windows\System\NktIBSx.exe
  C:\Windows\System\NktIBSx.exe
  2⤵
  PID:2740
- C:\Windows\System\nhvrEug.exe
  C:\Windows\System\nhvrEug.exe
  2⤵
  PID:4560
- C:\Windows\System\SOlPYsg.exe
  C:\Windows\System\SOlPYsg.exe
  2⤵
  PID:5536
- C:\Windows\System\CPabqoe.exe
  C:\Windows\System\CPabqoe.exe
  2⤵
  PID:5520
- C:\Windows\System\vCKzDXG.exe
  C:\Windows\System\vCKzDXG.exe
  2⤵
  PID:5472
- C:\Windows\System\ZEVCyfD.exe
  C:\Windows\System\ZEVCyfD.exe
  2⤵
  PID:6104
- C:\Windows\System\xwXoCGN.exe
  C:\Windows\System\xwXoCGN.exe
  2⤵
  PID:2052
- C:\Windows\System\SuXVXVo.exe
  C:\Windows\System\SuXVXVo.exe
  2⤵
  PID:3592
- C:\Windows\System\BfEHcfT.exe
  C:\Windows\System\BfEHcfT.exe
  2⤵
  PID:4896
- C:\Windows\System\zctgSuj.exe
  C:\Windows\System\zctgSuj.exe
  2⤵
  PID:4652
- C:\Windows\System\mPFbUGe.exe
  C:\Windows\System\mPFbUGe.exe
  2⤵
  PID:5404
- C:\Windows\System\LLhbPth.exe
  C:\Windows\System\LLhbPth.exe
  2⤵
  PID:5832
- C:\Windows\System\aCuDpTk.exe
  C:\Windows\System\aCuDpTk.exe
  2⤵
  PID:5092
- C:\Windows\System\yjiLOni.exe
  C:\Windows\System\yjiLOni.exe
  2⤵
  PID:5008
- C:\Windows\System\bnTMHuA.exe
  C:\Windows\System\bnTMHuA.exe
  2⤵
  PID:6156
- C:\Windows\System\ILDcNhf.exe
  C:\Windows\System\ILDcNhf.exe
  2⤵
  PID:6172
- C:\Windows\System\HmOoCQV.exe
  C:\Windows\System\HmOoCQV.exe
  2⤵
  PID:6188
- C:\Windows\System\WIxqPYX.exe
  C:\Windows\System\WIxqPYX.exe
  2⤵
  PID:6204
- C:\Windows\System\XjkeSkV.exe
  C:\Windows\System\XjkeSkV.exe
  2⤵
  PID:6220
- C:\Windows\System\qrFiFDp.exe
  C:\Windows\System\qrFiFDp.exe
  2⤵
  PID:6236
- C:\Windows\System\CORQQUA.exe
  C:\Windows\System\CORQQUA.exe
  2⤵
  PID:6252
- C:\Windows\System\CucpgkS.exe
  C:\Windows\System\CucpgkS.exe
  2⤵
  PID:6268
- C:\Windows\System\ihxkaqH.exe
  C:\Windows\System\ihxkaqH.exe
  2⤵
  PID:6284
- C:\Windows\System\pOHTMxh.exe
  C:\Windows\System\pOHTMxh.exe
  2⤵
  PID:6304
- C:\Windows\System\CVACrDB.exe
  C:\Windows\System\CVACrDB.exe
  2⤵
  PID:6320
- C:\Windows\System\zypXVke.exe
  C:\Windows\System\zypXVke.exe
  2⤵
  PID:6336
- C:\Windows\System\sQihAYq.exe
  C:\Windows\System\sQihAYq.exe
  2⤵
  PID:6352
- C:\Windows\System\TpXZTmy.exe
  C:\Windows\System\TpXZTmy.exe
  2⤵
  PID:6368
- C:\Windows\System\JlqkpBm.exe
  C:\Windows\System\JlqkpBm.exe
  2⤵
  PID:6384
- C:\Windows\System\vjSwBgw.exe
  C:\Windows\System\vjSwBgw.exe
  2⤵
  PID:6400
- C:\Windows\System\jAbNHjw.exe
  C:\Windows\System\jAbNHjw.exe
  2⤵
  PID:6416
- C:\Windows\System\eUdZEaL.exe
  C:\Windows\System\eUdZEaL.exe
  2⤵
  PID:6432
- C:\Windows\System\zUSINqY.exe
  C:\Windows\System\zUSINqY.exe
  2⤵
  PID:6448
- C:\Windows\System\EIHHfPg.exe
  C:\Windows\System\EIHHfPg.exe
  2⤵
  PID:6464
- C:\Windows\System\IohOBlr.exe
  C:\Windows\System\IohOBlr.exe
  2⤵
  PID:6480
- C:\Windows\System\JOhnkEQ.exe
  C:\Windows\System\JOhnkEQ.exe
  2⤵
  PID:6496
- C:\Windows\System\iVkhYtR.exe
  C:\Windows\System\iVkhYtR.exe
  2⤵
  PID:6512
- C:\Windows\System\quFYTha.exe
  C:\Windows\System\quFYTha.exe
  2⤵
  PID:6528
- C:\Windows\System\VAdDRDW.exe
  C:\Windows\System\VAdDRDW.exe
  2⤵
  PID:6544
- C:\Windows\System\okDQDtz.exe
  C:\Windows\System\okDQDtz.exe
  2⤵
  PID:6560
- C:\Windows\System\VhpHRao.exe
  C:\Windows\System\VhpHRao.exe
  2⤵
  PID:6576
- C:\Windows\System\NsqKBRD.exe
  C:\Windows\System\NsqKBRD.exe
  2⤵
  PID:6592
- C:\Windows\System\FDUQGHq.exe
  C:\Windows\System\FDUQGHq.exe
  2⤵
  PID:6608
- C:\Windows\System\jkbmQWv.exe
  C:\Windows\System\jkbmQWv.exe
  2⤵
  PID:6624
- C:\Windows\System\LIGfoIG.exe
  C:\Windows\System\LIGfoIG.exe
  2⤵
  PID:6640
- C:\Windows\System\lpwrEVz.exe
  C:\Windows\System\lpwrEVz.exe
  2⤵
  PID:6656
- C:\Windows\System\jrXTUZI.exe
  C:\Windows\System\jrXTUZI.exe
  2⤵
  PID:6672
- C:\Windows\System\yUtYInt.exe
  C:\Windows\System\yUtYInt.exe
  2⤵
  PID:6688
- C:\Windows\System\zizawCZ.exe
  C:\Windows\System\zizawCZ.exe
  2⤵
  PID:6704
- C:\Windows\System\oBvTwST.exe
  C:\Windows\System\oBvTwST.exe
  2⤵
  PID:6720
- C:\Windows\System\xjolwSu.exe
  C:\Windows\System\xjolwSu.exe
  2⤵
  PID:6736
- C:\Windows\System\ENQncpT.exe
  C:\Windows\System\ENQncpT.exe
  2⤵
  PID:6752
- C:\Windows\System\jdokzut.exe
  C:\Windows\System\jdokzut.exe
  2⤵
  PID:6768
- C:\Windows\System\RJPynUt.exe
  C:\Windows\System\RJPynUt.exe
  2⤵
  PID:6784
- C:\Windows\System\yaryKPg.exe
  C:\Windows\System\yaryKPg.exe
  2⤵
  PID:6800
- C:\Windows\System\tjUBGHc.exe
  C:\Windows\System\tjUBGHc.exe
  2⤵
  PID:6816
- C:\Windows\System\pANWanN.exe
  C:\Windows\System\pANWanN.exe
  2⤵
  PID:6832
- C:\Windows\System\Zigwsua.exe
  C:\Windows\System\Zigwsua.exe
  2⤵
  PID:6848
- C:\Windows\System\zDJzWGr.exe
  C:\Windows\System\zDJzWGr.exe
  2⤵
  PID:6864
- C:\Windows\System\IFltaFW.exe
  C:\Windows\System\IFltaFW.exe
  2⤵
  PID:6880
- C:\Windows\System\foiBcaF.exe
  C:\Windows\System\foiBcaF.exe
  2⤵
  PID:6900
- C:\Windows\System\JzAjnEf.exe
  C:\Windows\System\JzAjnEf.exe
  2⤵
  PID:6916
- C:\Windows\System\sRDLimJ.exe
  C:\Windows\System\sRDLimJ.exe
  2⤵
  PID:6932
- C:\Windows\System\Sltniwy.exe
  C:\Windows\System\Sltniwy.exe
  2⤵
  PID:6948
- C:\Windows\System\dLTFHTz.exe
  C:\Windows\System\dLTFHTz.exe
  2⤵
  PID:6964
- C:\Windows\System\mOvsrNs.exe
  C:\Windows\System\mOvsrNs.exe
  2⤵
  PID:6980
- C:\Windows\System\aSjEakZ.exe
  C:\Windows\System\aSjEakZ.exe
  2⤵
  PID:6996
- C:\Windows\System\sPmergS.exe
  C:\Windows\System\sPmergS.exe
  2⤵
  PID:7012
- C:\Windows\System\WYFGhvm.exe
  C:\Windows\System\WYFGhvm.exe
  2⤵
  PID:7028
- C:\Windows\System\HGYgUlL.exe
  C:\Windows\System\HGYgUlL.exe
  2⤵
  PID:7044
- C:\Windows\System\MsvIjQl.exe
  C:\Windows\System\MsvIjQl.exe
  2⤵
  PID:7060
- C:\Windows\System\jIjjFwH.exe
  C:\Windows\System\jIjjFwH.exe
  2⤵
  PID:7076
- C:\Windows\System\HjXZvzH.exe
  C:\Windows\System\HjXZvzH.exe
  2⤵
  PID:7092
- C:\Windows\System\aqZkfdJ.exe
  C:\Windows\System\aqZkfdJ.exe
  2⤵
  PID:7108
- C:\Windows\System\rVptbXn.exe
  C:\Windows\System\rVptbXn.exe
  2⤵
  PID:7124
- C:\Windows\System\DhGmqHB.exe
  C:\Windows\System\DhGmqHB.exe
  2⤵
  PID:7140
- C:\Windows\System\tbjxIOU.exe
  C:\Windows\System\tbjxIOU.exe
  2⤵
  PID:7160
- C:\Windows\System\ZWoghxL.exe
  C:\Windows\System\ZWoghxL.exe
  2⤵
  PID:6164
- C:\Windows\System\hDdwkPN.exe
  C:\Windows\System\hDdwkPN.exe
  2⤵
  PID:3260
- C:\Windows\System\FmkSGBd.exe
  C:\Windows\System\FmkSGBd.exe
  2⤵
  PID:6152
- C:\Windows\System\BqFHCcs.exe
  C:\Windows\System\BqFHCcs.exe
  2⤵
  PID:6232
- C:\Windows\System\YuvPPHa.exe
  C:\Windows\System\YuvPPHa.exe
  2⤵
  PID:6292
- C:\Windows\System\yylBgqI.exe
  C:\Windows\System\yylBgqI.exe
  2⤵
  PID:6216
- C:\Windows\System\wODGMFh.exe
  C:\Windows\System\wODGMFh.exe
  2⤵
  PID:6328
- C:\Windows\System\muUcgwI.exe
  C:\Windows\System\muUcgwI.exe
  2⤵
  PID:6316
- C:\Windows\System\SydXUvM.exe
  C:\Windows\System\SydXUvM.exe
  2⤵
  PID:6364
- C:\Windows\System\uBBiiGB.exe
  C:\Windows\System\uBBiiGB.exe
  2⤵
  PID:6380
- C:\Windows\System\kDLJAKK.exe
  C:\Windows\System\kDLJAKK.exe
  2⤵
  PID:6376
- C:\Windows\System\SxFzSLU.exe
  C:\Windows\System\SxFzSLU.exe
  2⤵
  PID:6444
- C:\Windows\System\FpnKwKj.exe
  C:\Windows\System\FpnKwKj.exe
  2⤵
  PID:6492
- C:\Windows\System\icwsOfI.exe
  C:\Windows\System\icwsOfI.exe
  2⤵
  PID:6508
- C:\Windows\System\kiZNQzz.exe
  C:\Windows\System\kiZNQzz.exe
  2⤵
  PID:6632
- C:\Windows\System\zlUfKtr.exe
  C:\Windows\System\zlUfKtr.exe
  2⤵
  PID:6700
- C:\Windows\System\jnxdWeC.exe
  C:\Windows\System\jnxdWeC.exe
  2⤵
  PID:6732
- C:\Windows\System\JftOVhR.exe
  C:\Windows\System\JftOVhR.exe
  2⤵
  PID:6764
- C:\Windows\System\hXAcNAQ.exe
  C:\Windows\System\hXAcNAQ.exe
  2⤵
  PID:6840
- C:\Windows\System\MOIYllG.exe
  C:\Windows\System\MOIYllG.exe
  2⤵
  PID:6824
- C:\Windows\System\juiGYwA.exe
  C:\Windows\System\juiGYwA.exe
  2⤵
  PID:6976
- C:\Windows\System\UUBEMLS.exe
  C:\Windows\System\UUBEMLS.exe
  2⤵
  PID:7008
- C:\Windows\System\GtdKGpe.exe
  C:\Windows\System\GtdKGpe.exe
  2⤵
  PID:7072
- C:\Windows\System\RwdWDkg.exe
  C:\Windows\System\RwdWDkg.exe
  2⤵
  PID:7136
- C:\Windows\System\SPdRQvv.exe
  C:\Windows\System\SPdRQvv.exe
  2⤵
  PID:6148
- C:\Windows\System\xSkhBgu.exe
  C:\Windows\System\xSkhBgu.exe
  2⤵
  PID:6244
- C:\Windows\System\zlPRfEX.exe
  C:\Windows\System\zlPRfEX.exe
  2⤵
  PID:6360
- C:\Windows\System\NIGpcuw.exe
  C:\Windows\System\NIGpcuw.exe
  2⤵
  PID:6460
- C:\Windows\System\HefBxkz.exe
  C:\Windows\System\HefBxkz.exe
  2⤵
  PID:6504
- C:\Windows\System\jLVRYUY.exe
  C:\Windows\System\jLVRYUY.exe
  2⤵
  PID:7056
- C:\Windows\System\vcjudCT.exe
  C:\Windows\System\vcjudCT.exe
  2⤵
  PID:5904
- C:\Windows\System\osPkWTX.exe
  C:\Windows\System\osPkWTX.exe
  2⤵
  PID:6928
- C:\Windows\System\YwZuFZD.exe
  C:\Windows\System\YwZuFZD.exe
  2⤵
  PID:6396
- C:\Windows\System\TOvjNiP.exe
  C:\Windows\System\TOvjNiP.exe
  2⤵
  PID:7024
- C:\Windows\System\qfcXiFv.exe
  C:\Windows\System\qfcXiFv.exe
  2⤵
  PID:7152
- C:\Windows\System\JPBXilU.exe
  C:\Windows\System\JPBXilU.exe
  2⤵
  PID:6812
- C:\Windows\System\OBZepzC.exe
  C:\Windows\System\OBZepzC.exe
  2⤵
  PID:6616
- C:\Windows\System\sPOxfWI.exe
  C:\Windows\System\sPOxfWI.exe
  2⤵
  PID:6584
- C:\Windows\System\pDEfJHJ.exe
  C:\Windows\System\pDEfJHJ.exe
  2⤵
  PID:6568
- C:\Windows\System\PJVgfgt.exe
  C:\Windows\System\PJVgfgt.exe
  2⤵
  PID:6696
- C:\Windows\System\rFwnqaz.exe
  C:\Windows\System\rFwnqaz.exe
  2⤵
  PID:6604
- C:\Windows\System\jMrSzaK.exe
  C:\Windows\System\jMrSzaK.exe
  2⤵
  PID:6872
- C:\Windows\System\ZaZGxvm.exe
  C:\Windows\System\ZaZGxvm.exe
  2⤵
  PID:6972
- C:\Windows\System\fMLXBfy.exe
  C:\Windows\System\fMLXBfy.exe
  2⤵
  PID:6728
- C:\Windows\System\CsvOfIt.exe
  C:\Windows\System\CsvOfIt.exe
  2⤵
  PID:6876
- C:\Windows\System\bODMPYz.exe
  C:\Windows\System\bODMPYz.exe
  2⤵
  PID:6228
- C:\Windows\System\aAGQxAD.exe
  C:\Windows\System\aAGQxAD.exe
  2⤵
  PID:6200
- C:\Windows\System\ZyYrYWo.exe
  C:\Windows\System\ZyYrYWo.exe
  2⤵
  PID:7148
- C:\Windows\System\FflxxjE.exe
  C:\Windows\System\FflxxjE.exe
  2⤵
  PID:7132
- C:\Windows\System\wrSAEcE.exe
  C:\Windows\System\wrSAEcE.exe
  2⤵
  PID:6556
- C:\Windows\System\BomDsnW.exe
  C:\Windows\System\BomDsnW.exe
  2⤵
  PID:6572
- C:\Windows\System\bCsHoBN.exe
  C:\Windows\System\bCsHoBN.exe
  2⤵
  PID:7196
- C:\Windows\System\mGlxSkM.exe
  C:\Windows\System\mGlxSkM.exe
  2⤵
  PID:7216
- C:\Windows\System\KvqHaQX.exe
  C:\Windows\System\KvqHaQX.exe
  2⤵
  PID:7232
- C:\Windows\System\Dyjhwyi.exe
  C:\Windows\System\Dyjhwyi.exe
  2⤵
  PID:7248
- C:\Windows\System\wcYYJPd.exe
  C:\Windows\System\wcYYJPd.exe
  2⤵
  PID:7268
- C:\Windows\System\oSxrvbB.exe
  C:\Windows\System\oSxrvbB.exe
  2⤵
  PID:7284
- C:\Windows\System\IIeIBzK.exe
  C:\Windows\System\IIeIBzK.exe
  2⤵
  PID:7300
- C:\Windows\System\rLDCMsg.exe
  C:\Windows\System\rLDCMsg.exe
  2⤵
  PID:7316
- C:\Windows\System\iZFvrcJ.exe
  C:\Windows\System\iZFvrcJ.exe
  2⤵
  PID:7332
- C:\Windows\System\Hnwvjgc.exe
  C:\Windows\System\Hnwvjgc.exe
  2⤵
  PID:7352
- C:\Windows\System\zQaiwAr.exe
  C:\Windows\System\zQaiwAr.exe
  2⤵
  PID:7368
- C:\Windows\System\EqxwRPx.exe
  C:\Windows\System\EqxwRPx.exe
  2⤵
  PID:7456
- C:\Windows\System\UKQedMv.exe
  C:\Windows\System\UKQedMv.exe
  2⤵
  PID:7472
- C:\Windows\System\YFTnXuq.exe
  C:\Windows\System\YFTnXuq.exe
  2⤵
  PID:7496
- C:\Windows\System\jqGIFUf.exe
  C:\Windows\System\jqGIFUf.exe
  2⤵
  PID:7520
- C:\Windows\System\ZnBdpFu.exe
  C:\Windows\System\ZnBdpFu.exe
  2⤵
  PID:7548
- C:\Windows\System\cdHWdRH.exe
  C:\Windows\System\cdHWdRH.exe
  2⤵
  PID:7572
- C:\Windows\System\rEgMaPp.exe
  C:\Windows\System\rEgMaPp.exe
  2⤵
  PID:7588
- C:\Windows\System\QqNufTq.exe
  C:\Windows\System\QqNufTq.exe
  2⤵
  PID:7608
- C:\Windows\System\kgBPlUO.exe
  C:\Windows\System\kgBPlUO.exe
  2⤵
  PID:7624
- C:\Windows\System\yrLBlgU.exe
  C:\Windows\System\yrLBlgU.exe
  2⤵
  PID:7644
- C:\Windows\System\VcfzaVT.exe
  C:\Windows\System\VcfzaVT.exe
  2⤵
  PID:7672
- C:\Windows\System\XlAIZLX.exe
  C:\Windows\System\XlAIZLX.exe
  2⤵
  PID:7688
- C:\Windows\System\mdBRyCR.exe
  C:\Windows\System\mdBRyCR.exe
  2⤵
  PID:7708
- C:\Windows\System\wNIwQLD.exe
  C:\Windows\System\wNIwQLD.exe
  2⤵
  PID:7724
- C:\Windows\System\lXgoLpQ.exe
  C:\Windows\System\lXgoLpQ.exe
  2⤵
  PID:7740
- C:\Windows\System\UpyQtAC.exe
  C:\Windows\System\UpyQtAC.exe
  2⤵
  PID:7760
- C:\Windows\System\ejdixkt.exe
  C:\Windows\System\ejdixkt.exe
  2⤵
  PID:7776
- C:\Windows\System\HSmEloA.exe
  C:\Windows\System\HSmEloA.exe
  2⤵
  PID:7792
- C:\Windows\System\HscDJXJ.exe
  C:\Windows\System\HscDJXJ.exe
  2⤵
  PID:7808
- C:\Windows\System\AoWvXbO.exe
  C:\Windows\System\AoWvXbO.exe
  2⤵
  PID:7824
- C:\Windows\System\QCLBUxU.exe
  C:\Windows\System\QCLBUxU.exe
  2⤵
  PID:7844
- C:\Windows\System\OmEnYXI.exe
  C:\Windows\System\OmEnYXI.exe
  2⤵
  PID:7872
- C:\Windows\System\QwgFVaU.exe
  C:\Windows\System\QwgFVaU.exe
  2⤵
  PID:7892
- C:\Windows\System\guqVVoc.exe
  C:\Windows\System\guqVVoc.exe
  2⤵
  PID:7912
- C:\Windows\System\EoIdCAi.exe
  C:\Windows\System\EoIdCAi.exe
  2⤵
  PID:7932
- C:\Windows\System\AoWBUBS.exe
  C:\Windows\System\AoWBUBS.exe
  2⤵
  PID:7948
- C:\Windows\System\iYizWcS.exe
  C:\Windows\System\iYizWcS.exe
  2⤵
  PID:7964
- C:\Windows\System\tbCfgBj.exe
  C:\Windows\System\tbCfgBj.exe
  2⤵
  PID:7980
- C:\Windows\System\NbYgxra.exe
  C:\Windows\System\NbYgxra.exe
  2⤵
  PID:7996
- C:\Windows\System\PWRzboj.exe
  C:\Windows\System\PWRzboj.exe
  2⤵
  PID:8016
- C:\Windows\System\vnUJBJY.exe
  C:\Windows\System\vnUJBJY.exe
  2⤵
  PID:8032
- C:\Windows\System\tUiQkpR.exe
  C:\Windows\System\tUiQkpR.exe
  2⤵
  PID:8052
- C:\Windows\System\xDaDmMI.exe
  C:\Windows\System\xDaDmMI.exe
  2⤵
  PID:8072
- C:\Windows\System\xOEfNVn.exe
  C:\Windows\System\xOEfNVn.exe
  2⤵
  PID:8092
- C:\Windows\System\rJeaXPq.exe
  C:\Windows\System\rJeaXPq.exe
  2⤵
  PID:8108
- C:\Windows\System\BpqbCwn.exe
  C:\Windows\System\BpqbCwn.exe
  2⤵
  PID:8124
- C:\Windows\System\OIQYSVX.exe
  C:\Windows\System\OIQYSVX.exe
  2⤵
  PID:8140
- C:\Windows\System\pLqhEMg.exe
  C:\Windows\System\pLqhEMg.exe
  2⤵
  PID:8160
- C:\Windows\System\fwZFNRS.exe
  C:\Windows\System\fwZFNRS.exe
  2⤵
  PID:7260
- C:\Windows\System\mUivTBZ.exe
  C:\Windows\System\mUivTBZ.exe
  2⤵
  PID:6776
- C:\Windows\System\oImgDHl.exe
  C:\Windows\System\oImgDHl.exe
  2⤵
  PID:7204
- C:\Windows\System\mqjuZgc.exe
  C:\Windows\System\mqjuZgc.exe
  2⤵
  PID:7276
- C:\Windows\System\txSmvYM.exe
  C:\Windows\System\txSmvYM.exe
  2⤵
  PID:7376
- C:\Windows\System\NBxGtGU.exe
  C:\Windows\System\NBxGtGU.exe
  2⤵
  PID:7396
- C:\Windows\System\GuLuOui.exe
  C:\Windows\System\GuLuOui.exe
  2⤵
  PID:7428
- C:\Windows\System\bfgBfUA.exe
  C:\Windows\System\bfgBfUA.exe
  2⤵
  PID:7444
- C:\Windows\System\kOthKUI.exe
  C:\Windows\System\kOthKUI.exe
  2⤵
  PID:7484
- C:\Windows\System\vhBEZBV.exe
  C:\Windows\System\vhBEZBV.exe
  2⤵
  PID:7532
- C:\Windows\System\lTtTcoJ.exe
  C:\Windows\System\lTtTcoJ.exe
  2⤵
  PID:7580
- C:\Windows\System\IOWTZMC.exe
  C:\Windows\System\IOWTZMC.exe
  2⤵
  PID:7652
- C:\Windows\System\sJKAspj.exe
  C:\Windows\System\sJKAspj.exe
  2⤵
  PID:7668
- C:\Windows\System\XMAmNPk.exe
  C:\Windows\System\XMAmNPk.exe
  2⤵
  PID:7704
- C:\Windows\System\EJoujCd.exe
  C:\Windows\System\EJoujCd.exe
  2⤵
  PID:7732
- C:\Windows\System\OkHYuFQ.exe
  C:\Windows\System\OkHYuFQ.exe
  2⤵
  PID:7804
- C:\Windows\System\opGahNU.exe
  C:\Windows\System\opGahNU.exe
  2⤵
  PID:7880
- C:\Windows\System\tdtYcyJ.exe
  C:\Windows\System\tdtYcyJ.exe
  2⤵
  PID:7956
- C:\Windows\System\QIotYxM.exe
  C:\Windows\System\QIotYxM.exe
  2⤵
  PID:7992
- C:\Windows\System\HwEIfJe.exe
  C:\Windows\System\HwEIfJe.exe
  2⤵
  PID:8028
- C:\Windows\System\aqBRZXC.exe
  C:\Windows\System\aqBRZXC.exe
  2⤵
  PID:8104
- C:\Windows\System\prnEWrP.exe
  C:\Windows\System\prnEWrP.exe
  2⤵
  PID:8176
- C:\Windows\System\voAExis.exe
  C:\Windows\System\voAExis.exe
  2⤵
  PID:7120
- C:\Windows\System\uXlhWLf.exe
  C:\Windows\System\uXlhWLf.exe
  2⤵
  PID:6168
- C:\Windows\System\SEerPZY.exe
  C:\Windows\System\SEerPZY.exe
  2⤵
  PID:7504
- C:\Windows\System\rwAoDQV.exe
  C:\Windows\System\rwAoDQV.exe
  2⤵
  PID:7556
- C:\Windows\System\PuPHILm.exe
  C:\Windows\System\PuPHILm.exe
  2⤵
  PID:8208
- C:\Windows\System\emRgzNw.exe
  C:\Windows\System\emRgzNw.exe
  2⤵
  PID:8224
- C:\Windows\System\nyThxSI.exe
  C:\Windows\System\nyThxSI.exe
  2⤵
  PID:8240
- C:\Windows\System\AEGYhCp.exe
  C:\Windows\System\AEGYhCp.exe
  2⤵
  PID:8256
- C:\Windows\System\UcDTKvR.exe
  C:\Windows\System\UcDTKvR.exe
  2⤵
  PID:8272
- C:\Windows\System\IuDudSL.exe
  C:\Windows\System\IuDudSL.exe
  2⤵
  PID:8288
- C:\Windows\System\pZwFkfx.exe
  C:\Windows\System\pZwFkfx.exe
  2⤵
  PID:8304
- C:\Windows\System\GIDlwAq.exe
  C:\Windows\System\GIDlwAq.exe
  2⤵
  PID:8340
- C:\Windows\System\ZIlfzws.exe
  C:\Windows\System\ZIlfzws.exe
  2⤵
  PID:8356
- C:\Windows\System\VUXZAKa.exe
  C:\Windows\System\VUXZAKa.exe
  2⤵
  PID:8372
- C:\Windows\System\VPZdSfS.exe
  C:\Windows\System\VPZdSfS.exe
  2⤵
  PID:8388
- C:\Windows\System\uLWmwCh.exe
  C:\Windows\System\uLWmwCh.exe
  2⤵
  PID:8404
- C:\Windows\System\IDjYdBq.exe
  C:\Windows\System\IDjYdBq.exe
  2⤵
  PID:8420
- C:\Windows\System\jjCteNL.exe
  C:\Windows\System\jjCteNL.exe
  2⤵
  PID:8436
- C:\Windows\System\uEvjGxZ.exe
  C:\Windows\System\uEvjGxZ.exe
  2⤵
  PID:8452
- C:\Windows\System\qDpnGJR.exe
  C:\Windows\System\qDpnGJR.exe
  2⤵
  PID:8468
- C:\Windows\System\KbXCOfc.exe
  C:\Windows\System\KbXCOfc.exe
  2⤵
  PID:8488
- C:\Windows\System\AFtDxaD.exe
  C:\Windows\System\AFtDxaD.exe
  2⤵
  PID:8504
- C:\Windows\System\WaMMVHE.exe
  C:\Windows\System\WaMMVHE.exe
  2⤵
  PID:8536
- C:\Windows\System\xpZksLZ.exe
  C:\Windows\System\xpZksLZ.exe
  2⤵
  PID:8564
- C:\Windows\System\LfAxglK.exe
  C:\Windows\System\LfAxglK.exe
  2⤵
  PID:8596
- C:\Windows\System\yueKEZH.exe
  C:\Windows\System\yueKEZH.exe
  2⤵
  PID:8692
- C:\Windows\System\TFsVJhF.exe
  C:\Windows\System\TFsVJhF.exe
  2⤵
  PID:8708
- C:\Windows\System\DcMzfoF.exe
  C:\Windows\System\DcMzfoF.exe
  2⤵
  PID:8728
- C:\Windows\System\zZCNzPp.exe
  C:\Windows\System\zZCNzPp.exe
  2⤵
  PID:8744
- C:\Windows\System\mpZWWdz.exe
  C:\Windows\System\mpZWWdz.exe
  2⤵
  PID:8760
- C:\Windows\System\lonUaYo.exe
  C:\Windows\System\lonUaYo.exe
  2⤵
  PID:8780
- C:\Windows\System\cjqpTkV.exe
  C:\Windows\System\cjqpTkV.exe
  2⤵
  PID:8800
- C:\Windows\System\umZZpYD.exe
  C:\Windows\System\umZZpYD.exe
  2⤵
  PID:8824
- C:\Windows\System\fgOdSHs.exe
  C:\Windows\System\fgOdSHs.exe
  2⤵
  PID:8840
- C:\Windows\System\RHjYRqy.exe
  C:\Windows\System\RHjYRqy.exe
  2⤵
  PID:8856
- C:\Windows\System\TXIhJsA.exe
  C:\Windows\System\TXIhJsA.exe
  2⤵
  PID:8872
- C:\Windows\System\JkvwnrN.exe
  C:\Windows\System\JkvwnrN.exe
  2⤵
  PID:8892
- C:\Windows\System\JIShyey.exe
  C:\Windows\System\JIShyey.exe
  2⤵
  PID:8908
- C:\Windows\System\pmVcaBb.exe
  C:\Windows\System\pmVcaBb.exe
  2⤵
  PID:8924
- C:\Windows\System\UqnMWXE.exe
  C:\Windows\System\UqnMWXE.exe
  2⤵
  PID:8940
- C:\Windows\System\RKQnIlS.exe
  C:\Windows\System\RKQnIlS.exe
  2⤵
  PID:8960
- C:\Windows\System\ynxSdgo.exe
  C:\Windows\System\ynxSdgo.exe
  2⤵
  PID:8984
- C:\Windows\System\BLsgWdu.exe
  C:\Windows\System\BLsgWdu.exe
  2⤵
  PID:9012
- C:\Windows\System\kuWHdTV.exe
  C:\Windows\System\kuWHdTV.exe
  2⤵
  PID:9032
- C:\Windows\System\UUgswwI.exe
  C:\Windows\System\UUgswwI.exe
  2⤵
  PID:9048
- C:\Windows\System\upBXhpR.exe
  C:\Windows\System\upBXhpR.exe
  2⤵
  PID:9068
- C:\Windows\System\ayAzmps.exe
  C:\Windows\System\ayAzmps.exe
  2⤵
  PID:9084
- C:\Windows\System\RlCjBPP.exe
  C:\Windows\System\RlCjBPP.exe
  2⤵
  PID:9100
- C:\Windows\System\RUFDwFl.exe
  C:\Windows\System\RUFDwFl.exe
  2⤵
  PID:9116
- C:\Windows\System\pVIOZyy.exe
  C:\Windows\System\pVIOZyy.exe
  2⤵
  PID:9136
- C:\Windows\System\siSHsts.exe
  C:\Windows\System\siSHsts.exe
  2⤵
  PID:9156
- C:\Windows\System\WOIiNhq.exe
  C:\Windows\System\WOIiNhq.exe
  2⤵
  PID:9172
- C:\Windows\System\CAblWhw.exe
  C:\Windows\System\CAblWhw.exe
  2⤵
  PID:9192
- C:\Windows\System\ybShhmW.exe
  C:\Windows\System\ybShhmW.exe
  2⤵
  PID:9208
- C:\Windows\System\QUpqlXc.exe
  C:\Windows\System\QUpqlXc.exe
  2⤵
  PID:9224
- C:\Windows\System\GQJzWbh.exe
  C:\Windows\System\GQJzWbh.exe
  2⤵
  PID:9244
- C:\Windows\System\uqvmInL.exe
  C:\Windows\System\uqvmInL.exe
  2⤵
  PID:9260
- C:\Windows\System\DqZKWmD.exe
  C:\Windows\System\DqZKWmD.exe
  2⤵
  PID:9276
- C:\Windows\System\HzuMvGS.exe
  C:\Windows\System\HzuMvGS.exe
  2⤵
  PID:9292
- C:\Windows\System\cYGMLsd.exe
  C:\Windows\System\cYGMLsd.exe
  2⤵
  PID:9308
- C:\Windows\System\SNXkRZy.exe
  C:\Windows\System\SNXkRZy.exe
  2⤵
  PID:9324
- C:\Windows\System\FiQuyje.exe
  C:\Windows\System\FiQuyje.exe
  2⤵
  PID:9344
- C:\Windows\System\DoDZIDl.exe
  C:\Windows\System\DoDZIDl.exe
  2⤵
  PID:9364
- C:\Windows\System\IZfxfYZ.exe
  C:\Windows\System\IZfxfYZ.exe
  2⤵
  PID:9380
- C:\Windows\System\vBakTHH.exe
  C:\Windows\System\vBakTHH.exe
  2⤵
  PID:9396
- C:\Windows\System\ggcrAGG.exe
  C:\Windows\System\ggcrAGG.exe
  2⤵
  PID:9412
- C:\Windows\System\qnyOeEY.exe
  C:\Windows\System\qnyOeEY.exe
  2⤵
  PID:9432
- C:\Windows\System\mRqcTKW.exe
  C:\Windows\System\mRqcTKW.exe
  2⤵
  PID:9456
- C:\Windows\System\zhcuSBM.exe
  C:\Windows\System\zhcuSBM.exe
  2⤵
  PID:9472
- C:\Windows\System\kzMlOiE.exe
  C:\Windows\System\kzMlOiE.exe
  2⤵
  PID:9504
- C:\Windows\System\VUHQilk.exe
  C:\Windows\System\VUHQilk.exe
  2⤵
  PID:9520
- C:\Windows\System\KdspZuQ.exe
  C:\Windows\System\KdspZuQ.exe
  2⤵
  PID:9548
- C:\Windows\System\IvOvgUA.exe
  C:\Windows\System\IvOvgUA.exe
  2⤵
  PID:9572
- C:\Windows\System\GrVlUdb.exe
  C:\Windows\System\GrVlUdb.exe
  2⤵
  PID:9588
- C:\Windows\System\HVibeBu.exe
  C:\Windows\System\HVibeBu.exe
  2⤵
  PID:9604
- C:\Windows\System\EmhWfrd.exe
  C:\Windows\System\EmhWfrd.exe
  2⤵
  PID:9628
- C:\Windows\System\sYzDkKa.exe
  C:\Windows\System\sYzDkKa.exe
  2⤵
  PID:9752
- C:\Windows\System\wTwqNgy.exe
  C:\Windows\System\wTwqNgy.exe
  2⤵
  PID:9768
- C:\Windows\System\zrAlXzv.exe
  C:\Windows\System\zrAlXzv.exe
  2⤵
  PID:9784
- C:\Windows\System\DBCEbNE.exe
  C:\Windows\System\DBCEbNE.exe
  2⤵
  PID:9804
- C:\Windows\System\dDdoGrv.exe
  C:\Windows\System\dDdoGrv.exe
  2⤵
  PID:9820
- C:\Windows\System\XtfODUU.exe
  C:\Windows\System\XtfODUU.exe
  2⤵
  PID:9840
- C:\Windows\System\EExuVGY.exe
  C:\Windows\System\EExuVGY.exe
  2⤵
  PID:9860
- C:\Windows\System\oCAwRNw.exe
  C:\Windows\System\oCAwRNw.exe
  2⤵
  PID:9876
- C:\Windows\System\sqpjmPi.exe
  C:\Windows\System\sqpjmPi.exe
  2⤵
  PID:9896
- C:\Windows\System\sAsIDsx.exe
  C:\Windows\System\sAsIDsx.exe
  2⤵
  PID:9912
- C:\Windows\System\VCkzPmB.exe
  C:\Windows\System\VCkzPmB.exe
  2⤵
  PID:9932
- C:\Windows\System\bxnmpcI.exe
  C:\Windows\System\bxnmpcI.exe
  2⤵
  PID:9948
- C:\Windows\System\xBVuyMz.exe
  C:\Windows\System\xBVuyMz.exe
  2⤵
  PID:9964
- C:\Windows\System\gQYGqwr.exe
  C:\Windows\System\gQYGqwr.exe
  2⤵
  PID:9980
- C:\Windows\System\zoDEBJH.exe
  C:\Windows\System\zoDEBJH.exe
  2⤵
  PID:9996
- C:\Windows\System\RcarzfZ.exe
  C:\Windows\System\RcarzfZ.exe
  2⤵
  PID:10012
- C:\Windows\System\xiysqom.exe
  C:\Windows\System\xiysqom.exe
  2⤵
  PID:10160
- C:\Windows\System\wnPBCgC.exe
  C:\Windows\System\wnPBCgC.exe
  2⤵
  PID:10176
- C:\Windows\System\MYZzgLJ.exe
  C:\Windows\System\MYZzgLJ.exe
  2⤵
  PID:10200
- C:\Windows\System\QnpbmPD.exe
  C:\Windows\System\QnpbmPD.exe
  2⤵
  PID:10216
- C:\Windows\System\oiHsCxn.exe
  C:\Windows\System\oiHsCxn.exe
  2⤵
  PID:10232
- C:\Windows\System\McLURAR.exe
  C:\Windows\System\McLURAR.exe
  2⤵
  PID:6652
- C:\Windows\System\cukokVF.exe
  C:\Windows\System\cukokVF.exe
  2⤵
  PID:7180
- C:\Windows\System\kaThsHC.exe
  C:\Windows\System\kaThsHC.exe
  2⤵
  PID:8172
- C:\Windows\System\qlDQbvv.exe
  C:\Windows\System\qlDQbvv.exe
  2⤵
  PID:7340
- C:\Windows\System\xYBBciL.exe
  C:\Windows\System\xYBBciL.exe
  2⤵
  PID:7412
- C:\Windows\System\fJzobyP.exe
  C:\Windows\System\fJzobyP.exe
  2⤵
  PID:7480
- C:\Windows\System\xnmoqHZ.exe
  C:\Windows\System\xnmoqHZ.exe
  2⤵
  PID:7840
- C:\Windows\System\MhZIvAn.exe
  C:\Windows\System\MhZIvAn.exe
  2⤵
  PID:8068
- C:\Windows\System\JlDMNCh.exe
  C:\Windows\System\JlDMNCh.exe
  2⤵
  PID:7464
- C:\Windows\System\wcKAWhP.exe
  C:\Windows\System\wcKAWhP.exe
  2⤵
  PID:8348
- C:\Windows\System\BVehcsb.exe
  C:\Windows\System\BVehcsb.exe
  2⤵
  PID:9008
- C:\Windows\System\ZcUdduR.exe
  C:\Windows\System\ZcUdduR.exe
  2⤵
  PID:9080
- C:\Windows\System\UQcSvUJ.exe
  C:\Windows\System\UQcSvUJ.exe
  2⤵
  PID:9152
- C:\Windows\System\StHbShq.exe
  C:\Windows\System\StHbShq.exe
  2⤵
  PID:9220
- C:\Windows\System\qEyjKdK.exe
  C:\Windows\System\qEyjKdK.exe
  2⤵
  PID:9288
- C:\Windows\System\hKQTbnH.exe
  C:\Windows\System\hKQTbnH.exe
  2⤵
  PID:9356
- C:\Windows\System\tuyjGWZ.exe
  C:\Windows\System\tuyjGWZ.exe
  2⤵
  PID:9428
- C:\Windows\System\WSRmfnN.exe
  C:\Windows\System\WSRmfnN.exe
  2⤵
  PID:9516
- C:\Windows\System\ywQKKom.exe
  C:\Windows\System\ywQKKom.exe
  2⤵
  PID:9600
- C:\Windows\System\JRAINwH.exe
  C:\Windows\System\JRAINwH.exe
  2⤵
  PID:9656
- C:\Windows\System\IdVtZHx.exe
  C:\Windows\System\IdVtZHx.exe
  2⤵
  PID:9688
- C:\Windows\System\eUbqgMZ.exe
  C:\Windows\System\eUbqgMZ.exe
  2⤵
  PID:8888
- C:\Windows\System\kYwpfJW.exe
  C:\Windows\System\kYwpfJW.exe
  2⤵
  PID:9564
- C:\Windows\System\koKZjwj.exe
  C:\Windows\System\koKZjwj.exe
  2⤵
  PID:9664
- C:\Windows\System\limXDon.exe
  C:\Windows\System\limXDon.exe
  2⤵
  PID:9716
- C:\Windows\System\ApoxlxM.exe
  C:\Windows\System\ApoxlxM.exe
  2⤵
  PID:9700
- C:\Windows\System\OoCpcVI.exe
  C:\Windows\System\OoCpcVI.exe
  2⤵
  PID:9744
- C:\Windows\System\mFAsIXg.exe
  C:\Windows\System\mFAsIXg.exe
  2⤵
  PID:9780
- C:\Windows\System\CZamDQd.exe
  C:\Windows\System\CZamDQd.exe
  2⤵
  PID:9852
- C:\Windows\System\TvpjcmH.exe
  C:\Windows\System\TvpjcmH.exe
  2⤵
  PID:9888
- C:\Windows\System\VaZljOI.exe
  C:\Windows\System\VaZljOI.exe
  2⤵
  PID:9956
- C:\Windows\System\SUcGLTk.exe
  C:\Windows\System\SUcGLTk.exe
  2⤵
  PID:10020
- C:\Windows\System\IIyKHbN.exe
  C:\Windows\System\IIyKHbN.exe
  2⤵
  PID:10044
- C:\Windows\System\kWRWyTx.exe
  C:\Windows\System\kWRWyTx.exe
  2⤵
  PID:10052
- C:\Windows\System\pHZfFMN.exe
  C:\Windows\System\pHZfFMN.exe
  2⤵
  PID:10076
- C:\Windows\System\FoXAsXL.exe
  C:\Windows\System\FoXAsXL.exe
  2⤵
  PID:7720
- C:\Windows\System\OxSsIZD.exe
  C:\Windows\System\OxSsIZD.exe
  2⤵
  PID:7604
- C:\Windows\System\PEIdUEH.exe
  C:\Windows\System\PEIdUEH.exe
  2⤵
  PID:7568
- C:\Windows\System\SJtSlHj.exe
  C:\Windows\System\SJtSlHj.exe
  2⤵
  PID:7748
- C:\Windows\System\vyWtohE.exe
  C:\Windows\System\vyWtohE.exe
  2⤵
  PID:7788
- C:\Windows\System\mDXFqmk.exe
  C:\Windows\System\mDXFqmk.exe
  2⤵
  PID:7856
- C:\Windows\System\AwbkoRv.exe
  C:\Windows\System\AwbkoRv.exe
  2⤵
  PID:7900
- C:\Windows\System\NKQdjCe.exe
  C:\Windows\System\NKQdjCe.exe
  2⤵
  PID:7972
- C:\Windows\System\YjVcQth.exe
  C:\Windows\System\YjVcQth.exe
  2⤵
  PID:8040
- C:\Windows\System\CzFSLla.exe
  C:\Windows\System\CzFSLla.exe
  2⤵
  PID:8084
- C:\Windows\System\CozMKDO.exe
  C:\Windows\System\CozMKDO.exe
  2⤵
  PID:8148
- C:\Windows\System\NSBXxiw.exe
  C:\Windows\System\NSBXxiw.exe
  2⤵
  PID:8168
- C:\Windows\System\rdhXIAO.exe
  C:\Windows\System\rdhXIAO.exe
  2⤵
  PID:9092
- C:\Windows\System\lxjoZsO.exe
  C:\Windows\System\lxjoZsO.exe
  2⤵
  PID:10116
- C:\Windows\System\NMGgHln.exe
  C:\Windows\System\NMGgHln.exe
  2⤵
  PID:10100
- C:\Windows\System\xfUbdDZ.exe
  C:\Windows\System\xfUbdDZ.exe
  2⤵
  PID:10148
- C:\Windows\System\gopYGgq.exe
  C:\Windows\System\gopYGgq.exe
  2⤵
  PID:10024
- C:\Windows\System\zJBTLYR.exe
  C:\Windows\System\zJBTLYR.exe
  2⤵
  PID:10224
- C:\Windows\System\wemIOwF.exe
  C:\Windows\System\wemIOwF.exe
  2⤵
  PID:8724
- C:\Windows\System\PAAwRCv.exe
  C:\Windows\System\PAAwRCv.exe
  2⤵
  PID:9792
- C:\Windows\System\LwyeJHG.exe
  C:\Windows\System\LwyeJHG.exe
  2⤵
  PID:8204
- C:\Windows\System\nuAmxEP.exe
  C:\Windows\System\nuAmxEP.exe
  2⤵
  PID:7292
- C:\Windows\System\NDxUNbh.exe
  C:\Windows\System\NDxUNbh.exe
  2⤵
  PID:7360
- C:\Windows\System\XBRuNKH.exe
  C:\Windows\System\XBRuNKH.exe
  2⤵
  PID:7436
- C:\Windows\System\XiJgqCq.exe
  C:\Windows\System\XiJgqCq.exe
  2⤵
  PID:7768
- C:\Windows\System\hzveErs.exe
  C:\Windows\System\hzveErs.exe
  2⤵
  PID:8252
- C:\Windows\System\KpUYUaA.exe
  C:\Windows\System\KpUYUaA.exe
  2⤵
  PID:8320
- C:\Windows\System\VBzakEu.exe
  C:\Windows\System\VBzakEu.exe
  2⤵
  PID:8632
- C:\Windows\System\VYplBBi.exe
  C:\Windows\System\VYplBBi.exe
  2⤵
  PID:8648
- C:\Windows\System\qrKuLdO.exe
  C:\Windows\System\qrKuLdO.exe
  2⤵
  PID:8676
- C:\Windows\System\JkskvpI.exe
  C:\Windows\System\JkskvpI.exe
  2⤵
  PID:8752
- C:\Windows\System\hzSqlQb.exe
  C:\Windows\System\hzSqlQb.exe
  2⤵
  PID:8792
- C:\Windows\System\RVKZWBC.exe
  C:\Windows\System\RVKZWBC.exe
  2⤵
  PID:8932
- C:\Windows\System\McwaUlf.exe
  C:\Windows\System\McwaUlf.exe
  2⤵
  PID:8972
- C:\Windows\System\ZhLjeep.exe
  C:\Windows\System\ZhLjeep.exe
  2⤵
  PID:9024
- C:\Windows\System\UvJJZsz.exe
  C:\Windows\System\UvJJZsz.exe
  2⤵
  PID:9128
- C:\Windows\System\XSvvAyP.exe
  C:\Windows\System\XSvvAyP.exe
  2⤵
  PID:9268
- C:\Windows\System\GbQRqda.exe
  C:\Windows\System\GbQRqda.exe
  2⤵
  PID:9272
- C:\Windows\System\qRykRjI.exe
  C:\Windows\System\qRykRjI.exe
  2⤵
  PID:9372
- C:\Windows\System\ndXRdcf.exe
  C:\Windows\System\ndXRdcf.exe
  2⤵
  PID:9440
- C:\Windows\System\FPOZSlu.exe
  C:\Windows\System\FPOZSlu.exe
  2⤵
  PID:9480
- C:\Windows\System\qpvXyCE.exe
  C:\Windows\System\qpvXyCE.exe
  2⤵
  PID:9496
- C:\Windows\System\LQvAAQD.exe
  C:\Windows\System\LQvAAQD.exe
  2⤵
  PID:9536
- C:\Windows\System\VGQbKoa.exe
  C:\Windows\System\VGQbKoa.exe
  2⤵
  PID:9616
- C:\Windows\System\UWPVUTn.exe
  C:\Windows\System\UWPVUTn.exe
  2⤵
  PID:9868
- C:\Windows\System\aqWJnCJ.exe
  C:\Windows\System\aqWJnCJ.exe
  2⤵
  PID:9828
- C:\Windows\System\xVTJQyy.exe
  C:\Windows\System\xVTJQyy.exe
  2⤵
  PID:10004
- C:\Windows\System\cDZcZGY.exe
  C:\Windows\System\cDZcZGY.exe
  2⤵
  PID:6856
- C:\Windows\System\FBnnKbf.exe
  C:\Windows\System\FBnnKbf.exe
  2⤵
  PID:8948
- C:\Windows\System\yIerwHH.exe
  C:\Windows\System\yIerwHH.exe
  2⤵
  PID:8848
- C:\Windows\System\NFvUogI.exe
  C:\Windows\System\NFvUogI.exe
  2⤵
  PID:8884
- C:\Windows\System\rGKzvng.exe
  C:\Windows\System\rGKzvng.exe
  2⤵
  PID:10212
- C:\Windows\System\ikaarEm.exe
  C:\Windows\System\ikaarEm.exe
  2⤵
  PID:7348
- C:\Windows\System\JxpxXyA.exe
  C:\Windows\System\JxpxXyA.exe
  2⤵
  PID:7404
- C:\Windows\System\bpNXqlu.exe
  C:\Windows\System\bpNXqlu.exe
  2⤵
  PID:8776
- C:\Windows\System\AijZmhx.exe
  C:\Windows\System\AijZmhx.exe
  2⤵
  PID:8736
- C:\Windows\System\IgdIoVw.exe
  C:\Windows\System\IgdIoVw.exe
  2⤵
  PID:9696
- C:\Windows\System\DRrJhgy.exe
  C:\Windows\System\DRrJhgy.exe
  2⤵
  PID:8576
- C:\Windows\System\vTMDeYY.exe
  C:\Windows\System\vTMDeYY.exe
  2⤵
  PID:8524
- C:\Windows\System\sSCGXeb.exe
  C:\Windows\System\sSCGXeb.exe
  2⤵
  PID:8480
- C:\Windows\System\ZomjdXo.exe
  C:\Windows\System\ZomjdXo.exe
  2⤵
  PID:8416
- C:\Windows\System\ynCgVZd.exe
  C:\Windows\System\ynCgVZd.exe
  2⤵
  PID:8352
- C:\Windows\System\UTnucLO.exe
  C:\Windows\System\UTnucLO.exe
  2⤵
  PID:9184
- C:\Windows\System\oyRgQiv.exe
  C:\Windows\System\oyRgQiv.exe
  2⤵
  PID:9468
- C:\Windows\System\dBRfaPG.exe
  C:\Windows\System\dBRfaPG.exe
  2⤵
  PID:9392
- C:\Windows\System\MdudGkA.exe
  C:\Windows\System\MdudGkA.exe
  2⤵
  PID:6620
- C:\Windows\System\QYqNfdp.exe
  C:\Windows\System\QYqNfdp.exe
  2⤵
  PID:9712
- C:\Windows\System\zgFuUMH.exe
  C:\Windows\System\zgFuUMH.exe
  2⤵
  PID:9920
- C:\Windows\System\tLuWmFo.exe
  C:\Windows\System\tLuWmFo.exe
  2⤵
  PID:10068
- C:\Windows\System\wTiBwbu.exe
  C:\Windows\System\wTiBwbu.exe
  2⤵
  PID:7564
- C:\Windows\System\uHnSaBQ.exe
  C:\Windows\System\uHnSaBQ.exe
  2⤵
  PID:9660
- C:\Windows\System\yqTepgm.exe
  C:\Windows\System\yqTepgm.exe
  2⤵
  PID:9684
- C:\Windows\System\qmVlBUs.exe
  C:\Windows\System\qmVlBUs.exe
  2⤵
  PID:9884
- C:\Windows\System\IpTEjAL.exe
  C:\Windows\System\IpTEjAL.exe
  2⤵
  PID:10060
- C:\Windows\System\MKvlbGF.exe
  C:\Windows\System\MKvlbGF.exe
  2⤵
  PID:7600
- C:\Windows\System\xKDJTnV.exe
  C:\Windows\System\xKDJTnV.exe
  2⤵
  PID:7784
- C:\Windows\System\HzdcYoD.exe
  C:\Windows\System\HzdcYoD.exe
  2⤵
  PID:8008
- C:\Windows\System\JZpWVZE.exe
  C:\Windows\System\JZpWVZE.exe
  2⤵
  PID:7516
- C:\Windows\System\TqxzEZe.exe
  C:\Windows\System\TqxzEZe.exe
  2⤵
  PID:9144
- C:\Windows\System\pMBkXhg.exe
  C:\Windows\System\pMBkXhg.exe
  2⤵
  PID:8796
- C:\Windows\System\lCrZhme.exe
  C:\Windows\System\lCrZhme.exe
  2⤵
  PID:9848
- C:\Windows\System\XeFFkEA.exe
  C:\Windows\System\XeFFkEA.exe
  2⤵
  PID:7928
- C:\Windows\System\qMjHLeX.exe
  C:\Windows\System\qMjHLeX.exe
  2⤵
  PID:10124
- C:\Windows\System\NyrRCdQ.exe
  C:\Windows\System\NyrRCdQ.exe
  2⤵
  PID:10092
- C:\Windows\System\oUNYmIg.exe
  C:\Windows\System\oUNYmIg.exe
  2⤵
  PID:10112
- C:\Windows\System\cjKOfaQ.exe
  C:\Windows\System\cjKOfaQ.exe
  2⤵
  PID:10152
- C:\Windows\System\JplzoVI.exe
  C:\Windows\System\JplzoVI.exe
  2⤵
  PID:7040
- C:\Windows\System\prtrYfQ.exe
  C:\Windows\System\prtrYfQ.exe
  2⤵
  PID:7452
- C:\Windows\System\UxDQZJU.exe
  C:\Windows\System\UxDQZJU.exe
  2⤵
  PID:6300
- C:\Windows\System\yrfGLFI.exe
  C:\Windows\System\yrfGLFI.exe
  2⤵
  PID:8668
- C:\Windows\System\scnvVfy.exe
  C:\Windows\System\scnvVfy.exe
  2⤵
  PID:7264
- C:\Windows\System\NPfUKei.exe
  C:\Windows\System\NPfUKei.exe
  2⤵
  PID:9620
- C:\Windows\System\OGYceon.exe
  C:\Windows\System\OGYceon.exe
  2⤵
  PID:8688
- C:\Windows\System\XGPlsHg.exe
  C:\Windows\System\XGPlsHg.exe
  2⤵
  PID:7616
- C:\Windows\System\DhDsRCI.exe
  C:\Windows\System\DhDsRCI.exe
  2⤵
  PID:7296
- C:\Windows\System\KdSKXpm.exe
  C:\Windows\System\KdSKXpm.exe
  2⤵
  PID:7512
- C:\Windows\System\dcLOaDZ.exe
  C:\Windows\System\dcLOaDZ.exe
  2⤵
  PID:8236
- C:\Windows\System\MWcWSry.exe
  C:\Windows\System\MWcWSry.exe
  2⤵
  PID:8400
- C:\Windows\System\qViwXNG.exe
  C:\Windows\System\qViwXNG.exe
  2⤵
  PID:8496
- C:\Windows\System\EBhWgTl.exe
  C:\Windows\System\EBhWgTl.exe
  2⤵
  PID:8324
- C:\Windows\System\pnhVKQK.exe
  C:\Windows\System\pnhVKQK.exe
  2⤵
  PID:8560
- C:\Windows\System\MfzvRoc.exe
  C:\Windows\System\MfzvRoc.exe
  2⤵
  PID:8612
- C:\Windows\System\ctpXlOj.exe
  C:\Windows\System\ctpXlOj.exe
  2⤵
  PID:8628
- C:\Windows\System\DqpLoUf.exe
  C:\Windows\System\DqpLoUf.exe
  2⤵
  PID:8756
- C:\Windows\System\hEQWyZU.exe
  C:\Windows\System\hEQWyZU.exe
  2⤵
  PID:8644
- C:\Windows\System\UfUNiAp.exe
  C:\Windows\System\UfUNiAp.exe
  2⤵
  PID:9200
- C:\Windows\System\ixLUDXX.exe
  C:\Windows\System\ixLUDXX.exe
  2⤵
  PID:9336
- C:\Windows\System\qAVQSIX.exe
  C:\Windows\System\qAVQSIX.exe
  2⤵
  PID:9612
- C:\Windows\System\qHAkDTu.exe
  C:\Windows\System\qHAkDTu.exe
  2⤵
  PID:7408
- C:\Windows\System\AKWGMsR.exe
  C:\Windows\System\AKWGMsR.exe
  2⤵
  PID:8812
- C:\Windows\System\evrAuOA.exe
  C:\Windows\System\evrAuOA.exe
  2⤵
  PID:6440
- C:\Windows\System\jXqoacR.exe
  C:\Windows\System\jXqoacR.exe
  2⤵
  PID:8852
- C:\Windows\System\PsRWbIE.exe
  C:\Windows\System\PsRWbIE.exe
  2⤵
  PID:10168
- C:\Windows\System\XEnMEmr.exe
  C:\Windows\System\XEnMEmr.exe
  2⤵
  PID:8768
- C:\Windows\System\zPbgGyu.exe
  C:\Windows\System\zPbgGyu.exe
  2⤵
  PID:8484
- C:\Windows\System\zsrUbnb.exe
  C:\Windows\System\zsrUbnb.exe
  2⤵
  PID:8384
- C:\Windows\System\vYqZxvf.exe
  C:\Windows\System\vYqZxvf.exe
  2⤵
  PID:9044
- C:\Windows\System\rQvXDHl.exe
  C:\Windows\System\rQvXDHl.exe
  2⤵
  PID:9148
- C:\Windows\System\LlhRfqK.exe
  C:\Windows\System\LlhRfqK.exe
  2⤵
  PID:8296
- C:\Windows\System\WoJTWMx.exe
  C:\Windows\System\WoJTWMx.exe
  2⤵
  PID:9568
- C:\Windows\System\fjAXnNL.exe
  C:\Windows\System\fjAXnNL.exe
  2⤵
  PID:10032
- C:\Windows\System\wOSBZwa.exe
  C:\Windows\System\wOSBZwa.exe
  2⤵
  PID:9652
- C:\Windows\System\XQrhedv.exe
  C:\Windows\System\XQrhedv.exe
  2⤵
  PID:9816
- C:\Windows\System\kdOqjmv.exe
  C:\Windows\System\kdOqjmv.exe
  2⤵
  PID:9992
- C:\Windows\System\PdCdsqS.exe
  C:\Windows\System\PdCdsqS.exe
  2⤵
  PID:9928
- C:\Windows\System\lJtvuAd.exe
  C:\Windows\System\lJtvuAd.exe
  2⤵
  PID:7868
- C:\Windows\System\tYHmPVc.exe
  C:\Windows\System\tYHmPVc.exe
  2⤵
  PID:7492
- C:\Windows\System\KXZSByE.exe
  C:\Windows\System\KXZSByE.exe
  2⤵
  PID:10144
- C:\Windows\System\CidSHsp.exe
  C:\Windows\System\CidSHsp.exe
  2⤵
  PID:8904
- C:\Windows\System\hVunvyY.exe
  C:\Windows\System\hVunvyY.exe
  2⤵
  PID:10104
- C:\Windows\System\tJUntSt.exe
  C:\Windows\System\tJUntSt.exe
  2⤵
  PID:10008
- C:\Windows\System\yTHTTXI.exe
  C:\Windows\System\yTHTTXI.exe
  2⤵
  PID:8328
- C:\Windows\System\bhSoxbC.exe
  C:\Windows\System\bhSoxbC.exe
  2⤵
  PID:8460
- C:\Windows\System\bBJFKRc.exe
  C:\Windows\System\bBJFKRc.exe
  2⤵
  PID:8080
- C:\Windows\System\WQtIvif.exe
  C:\Windows\System\WQtIvif.exe
  2⤵
  PID:10188
- C:\Windows\System\bUwlNdR.exe
  C:\Windows\System\bUwlNdR.exe
  2⤵
  PID:9124
- C:\Windows\System\ivPmtBI.exe
  C:\Windows\System\ivPmtBI.exe
  2⤵
  PID:7640
- C:\Windows\System\yfBEMzc.exe
  C:\Windows\System\yfBEMzc.exe
  2⤵
  PID:8064
- C:\Windows\System\qxHTZTV.exe
  C:\Windows\System\qxHTZTV.exe
  2⤵
  PID:8868
- C:\Windows\System\LpDUNCO.exe
  C:\Windows\System\LpDUNCO.exe
  2⤵
  PID:8368
- C:\Windows\System\QKZvSUP.exe
  C:\Windows\System\QKZvSUP.exe
  2⤵
  PID:7924
- C:\Windows\System\zEZveza.exe
  C:\Windows\System\zEZveza.exe
  2⤵
  PID:8864
- C:\Windows\System\LwPaJBD.exe
  C:\Windows\System\LwPaJBD.exe
  2⤵
  PID:8836
- C:\Windows\System\qbeAWqz.exe
  C:\Windows\System\qbeAWqz.exe
  2⤵
  PID:9204
- C:\Windows\System\biESstP.exe
  C:\Windows\System\biESstP.exe
  2⤵
  PID:9020
- C:\Windows\System\SFrwTqR.exe
  C:\Windows\System\SFrwTqR.exe
  2⤵
  PID:9304
- C:\Windows\System\oCKcyOI.exe
  C:\Windows\System\oCKcyOI.exe
  2⤵
  PID:9488
- C:\Windows\System\tfxXNBB.exe
  C:\Windows\System\tfxXNBB.exe
  2⤵
  PID:7224
- C:\Windows\System\dljEZFx.exe
  C:\Windows\System\dljEZFx.exe
  2⤵
  PID:8880
- C:\Windows\System\CfTNcVi.exe
  C:\Windows\System\CfTNcVi.exe
  2⤵
  PID:9832
- C:\Windows\System\SrEfnts.exe
  C:\Windows\System\SrEfnts.exe
  2⤵
  PID:8100
- C:\Windows\System\HGlypoL.exe
  C:\Windows\System\HGlypoL.exe
  2⤵
  PID:7664
- C:\Windows\System\KfvTsBe.exe
  C:\Windows\System\KfvTsBe.exe
  2⤵
  PID:8992
- C:\Windows\System\blLPApH.exe
  C:\Windows\System\blLPApH.exe
  2⤵
  PID:7440
- C:\Windows\System\CjaEPkS.exe
  C:\Windows\System\CjaEPkS.exe
  2⤵
  PID:9776
- C:\Windows\System\VEmDPdS.exe
  C:\Windows\System\VEmDPdS.exe
  2⤵
  PID:9256
- C:\Windows\System\SqASorf.exe
  C:\Windows\System\SqASorf.exe
  2⤵
  PID:9680
- C:\Windows\System\VooDCvL.exe
  C:\Windows\System\VooDCvL.exe
  2⤵
  PID:10080
- C:\Windows\System\rtNYgwc.exe
  C:\Windows\System\rtNYgwc.exe
  2⤵
  PID:7852
- C:\Windows\System\CovsrZA.exe
  C:\Windows\System\CovsrZA.exe
  2⤵
  PID:7364
- C:\Windows\System\XXfgdOx.exe
  C:\Windows\System\XXfgdOx.exe
  2⤵
  PID:9796
- C:\Windows\System\vFcIZBv.exe
  C:\Windows\System\vFcIZBv.exe
  2⤵
  PID:7176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BLXyIQl.exe

Filesize
1.1MB

MD5
d723b572df076057991f95e7a3af1c3c

SHA1
5cf2fa7c3f619fe3bff244e3f93a26fcd5072930

SHA256
e99d37c531485ad1ac5b3be108b111ea91d75ac17bf4fd7988ead06d1d9e4442

SHA512
725a16f0e9ab7354090daa6f1b3f3abf93021e7a5f2bbc41e39ab6aaa7b3efbb0b7193e92ca28968232181d6d9127ec9a67f3da63a89d7e80dd2b3bf825f693a

Download Submit
C:\Windows\system\JZEKANn.exe

Filesize
1.1MB

MD5
7bc7aabc64bfab3faae977280451c8d0

SHA1
bc9d7266e9e8be76e84bb49a4048819b5eec3977

SHA256
2dbb7ee4f2e744d95dac1aafe4ff206080ef386f0895d8047b950445c6c82b4b

SHA512
836edc7457175d12932b8bb6a951ffb5f699557aa8da4116d06dc803f676044c340504eba646353a52ff4168b8fad24cac0d8834e1eb67cf939f8d1970087b78

Download Submit
C:\Windows\system\KROYuet.exe

Filesize
1.1MB

MD5
c92749f4bc5c3b1b1d9df4cd837a901b

SHA1
9aad560c41c848914b7308704c7451afcd2657db

SHA256
42cfa6eb708875d3f4d14d6b167d0164088859745235fccb0777c61078a01a28

SHA512
8cdf3c6526bec950390a70325bc3d199133451b102c7c658701f918854d33adec7bb66f2596c4656ace264f500ce593554f5e6f39acb63eea831594f364f577d

Download Submit
C:\Windows\system\MtgbCuz.exe

Filesize
1.1MB

MD5
fe7ef85a12f57bef144b9855717531a5

SHA1
8599f03b90cda87a0f50e74aa171b98094756eb9

SHA256
8e40ffa856bd301290b91cedf4c564d64c763301d9765570606cd775868c3375

SHA512
6b9dc3afd678c11533026305dc46f6e8e7f52a00d98f7387349eee2fc5816df8d0ac64b0ef81157387f3e0fef1f07a2e305214eaac80e59132f93ba2e6433737

Download Submit
C:\Windows\system\SeRbRIo.exe

Filesize
1.1MB

MD5
8e53b20004e96baa5e5e55ca8c12a459

SHA1
7e2695ac01310c0de377596a10f37a912ec16b3c

SHA256
329df16f4b263607a2c32cd6374d1d2717c3fc8016b65dd3a5014416ceed34c3

SHA512
76f979d87c4e50fe16a83425beabf9a334fe28da00f49f07c65410ccba1f5acfd0ff6ee4a84c222b0f5d1c511e0981c8f66b849cf1127bef30d8388fd1dc2b56

Download Submit
C:\Windows\system\SfQvTtl.exe

Filesize
1.1MB

MD5
600a4a418a57ce6fc5c9dcd6920ded3f

SHA1
bf08b18d24ad771098b556a5d51ac8a44643584d

SHA256
b5be7fb3fa0bfa03b69a404e03b87fa44118c484a5c676cf46cd420ffbfaad85

SHA512
92e6e09358c369dda2c822202372f3b67beb5465504f5dd3f1ee151b403cf33c787a8396685ad2ab96ebc3d4e39223a49484d4896bcaffbaceed1e05c15467b9

Download Submit
C:\Windows\system\Tqqzsdm.exe

Filesize
1.1MB

MD5
902ee22dcc66ea9555fa46b7fa329c3f

SHA1
6502a9bca23d99c5a30facdad4d5769c7584d3bd

SHA256
6b9c15aaf6bdf61f85b62f6ff487b149e8bb4c4ebab74521b2321c822497f95a

SHA512
fee0706332e369dfcd3f5992cde7539d5b8fcc4ecae4e96be136a2f690f4440b49cb452ec6a87080a4122cbce60f03e43bb031d63a713e7dd98ed32820ff3e3d

Download Submit
C:\Windows\system\WQOlWsk.exe

Filesize
1.1MB

MD5
e4a692c662a65c64d5648e2f767614cd

SHA1
796a78fc03400fdb8ba29a3268f83685e33dfc70

SHA256
aa7d2164eb107702d4c48e6710700a8a0f36983cd12081cff558f19d81430e74

SHA512
bbeef13170df29294a82bfb8e7491640d529d16461c87b160d50db6c342bc1979f7b9364744016edad9498c6dcdb571413682d34866e35ae6d827455e05c31a4

Download Submit
C:\Windows\system\bUxQVuN.exe

Filesize
1.1MB

MD5
6b8b485c7968a5f68c88a3d87fbbb5b1

SHA1
87d07257a1fb60de2fa3c93f03476152ac78493d

SHA256
8607e4b373cb90bc98f4eb61336e4fccd38a22c993df991d6d83ae072c47da48

SHA512
17941faa278fc4d63355c059c8d416c87418cd892e4e7be3fe4ceb442c7450f9e7ddf65c737922a8a693a8a5b2f3c5e8ecce13ecafa3b9d4e67c5e5e3ff5f8a2

Download Submit
C:\Windows\system\emkcMrU.exe

Filesize
1.1MB

MD5
d61a76ff8a99edba47f4a6826fc8540c

SHA1
b5948fff08e94c94e17b8385e6f6dccb20a461e2

SHA256
fbe9b529a48f57c169664ea58c8ef1ddd647c355c171c2c2f7f2a996f117db68

SHA512
d68cf6e53fc48b553930b5f0a009359aad557398fda853fc714400e28c9a91c01d11e712bab6eb84507ecbf862fe24681102ec1eb412fd3381df12f282d3826c

Download Submit
C:\Windows\system\hMxVlwN.exe

Filesize
1.1MB

MD5
29662d2a345f64fcabe791c42e68aea4

SHA1
ed28070fe2aa173fd45595d210fafed4c79bba53

SHA256
545f546e46d0e4fdebfc778b70625d7cb0543d6d604b57270eb5935291b90254

SHA512
703a2128c4f6584a3140334320a062bda71762b39eed454c58231db9c6550b06ff837ff47ea6a549b0ab83b8bc6aa57a6c4fb8d581df5cfc660b12ecdc8cab53

Download Submit
C:\Windows\system\mUPzZlR.exe

Filesize
1.1MB

MD5
5d8c5bf606be6186473c1cb3d9a32a62

SHA1
ac6af09befc680f421d5a419072ca8273ee752cd

SHA256
447dabbccbe92bd46824d6b2114bd5129d21120be38cf2a033f59da688de2a28

SHA512
73871dc91ed019f75cdc97beb65c77f3dca46f333e1d9da4110fb4e2211b8cabb868a7a02dd781fc6b050949ce8d8a5aa551e115378f5e0fb16f8e51e3cbfef9

Download Submit
C:\Windows\system\peLrzkf.exe

Filesize
1.1MB

MD5
dfdd5de74bb565c41f355b793414c32c

SHA1
5a3fa5816a23d8a3238c7572d86a64be2d8ff55e

SHA256
204fed339c55c7a1f345e0010f42c12939694e81764aad2335e8387a525c4e0d

SHA512
cb45baf69b00845da55a9593641ec83823f1a06b028e7d867367a832824c4ad72b536190c831c704d7bb863d2fed745e1da73aeebacb24241002d4979efeeadc

Download Submit
C:\Windows\system\pnZmjrW.exe

Filesize
1.1MB

MD5
d025305951175637b6a46c92a1afe9dc

SHA1
1cd33f29a05436d86e2a0799f2c3c0c63d8c23ce

SHA256
3b63fa01f15e8152859efaf4c73ad363d3dcd8ae9d41dc0dfd151971db8b65de

SHA512
3c3ba25a670523e06067bd0f4f18e8adcde89f84e59235a9538052418cf0d231e91183c492bf364031814ed350ca60f6e396926caccfd314a84c0d4a6642184a

Download Submit
C:\Windows\system\reaDzxD.exe

Filesize
1.1MB

MD5
2bc3cf265302f8d3d02d5b78b45a8ea2

SHA1
5540a0d5fced223811781ed9ab0fcd3327f6203f

SHA256
301d45b8d7df4b82fb3fa9dceb4536170b6afb9a2bbf4766cd9311171b20d79a

SHA512
fca10504d338a74d2082919cdbb0ba50ae9d00633f8095fbe7328b430f4cc920200a23f371d88b6cb112abe2c2b63c2cf885fd2d087143a5062663f70ca5673a

Download Submit
C:\Windows\system\tVUMGRs.exe

Filesize
1.1MB

MD5
8130c09ee556ab66aa05c34632320dff

SHA1
4b86981c7b61d4744d5a3398b1189831670c8d6a

SHA256
f595bab6745fc238e000990e1ce3f973eca109b518851e068a9b3149d6ae4ad8

SHA512
3ddfaf03230bdf93d13b25d32341773d1508da45a2747892a390a728747317b0385f0b97b0eaf6aa82193fd4b8ffde51770f5b78fb6e6ad1b861f0547b1fa266

Download Submit
\Windows\system\AVkEcqy.exe

Filesize
1.1MB

MD5
ae202a1ad384b050e288fb4c21bb74ae

SHA1
d9e49046c8bc565bb431e3054e7606150abe434b

SHA256
79ed52444f5f64a8be489eca3777fc0203ddaa3badfb29e91305be5a5b0f91df

SHA512
9601e03ff56c55fd53ff0d2c5b8dd06e7a28f6769e8bae1df2190c914f3deaf16b8b629ab5d8fe562061405b5fabfbd14447d06fdfcac85f934bb9ac7d8512e6

Download Submit
\Windows\system\EnxAxWt.exe

Filesize
1.1MB

MD5
b09971f11f8fa66aa5639acc7acb2a9a

SHA1
996df30c6ce49f77257e323c7e4e9b29a6cd9042

SHA256
96855a9d8bddef44e7b953431a7c122ea9b61ce696622fab56eb892a5d6706d8

SHA512
767386f43d823202e374bcad85d3d9b0b1ca17033b64ce3404e432072567f62b7e3567a42906547903fdaced0b287aa23ce6d4270f2aa5385e7ec69a802d2ba5

Download Submit
\Windows\system\FEQNrXQ.exe

Filesize
1.1MB

MD5
ab3b2840345d65cdaaf3ee01a2404c71

SHA1
f3024f65af94fef2eaacc59a595ca43e6deb1c07

SHA256
b19a8b05a3bd666398fd109f957567c96246fc1d4a99e39db2306c6967b96c5d

SHA512
de6c406005b6fe0ff7bf9f36b3410f5752817e40c39e05d0f4fd792af19bdc082817ac3e9a0403222b3ed817937e94defb27c9197b330129e6df403ef9251a6a

Download Submit
\Windows\system\HiHfBcf.exe

Filesize
1.1MB

MD5
6bb28091c500bdb0f9013ccc47d53b3b

SHA1
49b28aa46321da0df0c74ce5595bc161ef9d7737

SHA256
9d28d3e9f393884702e915c1d19313697c127e1c720a442daaa926ae2f3488e4

SHA512
2f7c7f396f655cc6fb9d1dc05314a513f9d1956077a9636f9e0c7808cc7835958d732abbe370578fc25a199803f6322a5529bf45a9df0cd1f4ab2ac0251007e4

Download Submit
\Windows\system\IiZbEGb.exe

Filesize
1.1MB

MD5
34609fb923cd5bd41edec793c0a48915

SHA1
1b9c46a66f1ca0133572faf43930ba80f4e442c9

SHA256
b031cf884e32f09d66ddd45a188bfe0da6d1ca9f97b394661b5f7db1ae2af5b0

SHA512
99d1bbce343ab9e688d9812054dce0417ce87e57391e4df1966a78e20277d0220cf0acd8bee5cdcd4adb630b89c90b111792b9e8720ab1e8953925cda0df527e

Download Submit
\Windows\system\NKTUrzo.exe

Filesize
1.1MB

MD5
050feb021eb57515d3f8644d3a3ee956

SHA1
86b32c2abbcbe77c399c948562e4979064d8a360

SHA256
68ac8fd9835eaafbf48d8882bf1862a8305d9cd35818b1438d4364d019c90dc4

SHA512
3cdced413c08eca64155e7c83b55697deba627234b4540f5249bcadc35ed48520dfae3b299069f3c35c073d2d09f2c95e37a7e1ab09454533bcf8ff5be70e16b

Download Submit
\Windows\system\NoOUIZT.exe

Filesize
1.1MB

MD5
4cd5a90af354909b334d4babbe4fc24b

SHA1
4e179cf3dfcb7b90487a770f0c7da8e1c54ecc18

SHA256
fa7e1fd168bef54ae32220c01281c4939b75b60b122d032782b591784065104e

SHA512
651f62f20f346e722bf466720dbc4e66b2a0c5a5259daae87d7a93c0af88d9b3eaf68cd45321a154c3910709af8c55cd90d7803098c06b6c5ec4dc2b86bf6ebd

Download Submit
\Windows\system\QaOpDaf.exe

Filesize
1.1MB

MD5
2452f6a7ec3a27bcf12dc27c5a4a4998

SHA1
6b5d7d117bda2f8ab4ed4aad130694b18044248f

SHA256
25eb3070436d85fc7919f4d85ff755b1555deeeb71b4ddeac86921e8897dc581

SHA512
517ea3374bb690cda709d137d643e1b01429b442f0da3d942672227fe17de467ac411239c74007f10eba402c1eef85c7ced5e3e4a384d813ed9e951ea5f22b64

Download Submit
\Windows\system\RCSHZuR.exe

Filesize
1.1MB

MD5
7dd4eaf07ea521970a45bccb667a090a

SHA1
f9cfbf8c0fb40e9b19bd114416afc61b905a8e8d

SHA256
dcc9d4a17e919ef3e75de72ea4bb20f78b7053611fe8af03ce7c59565ff63f10

SHA512
74d2a2f4ea314dc4a37c4ed506a6f92a816a933a701e78e2ab621da8c4023353a2d629651ea25b265f6c844f41078f7ea0c02bf84fdfd0032cb71d18c2b0ee25

Download Submit
\Windows\system\UhuVPFH.exe

Filesize
1.1MB

MD5
81baee997f2299abfde7facd8611d7fd

SHA1
24452dcbf38563adb3b5a4b64f1b6cafbcc0b531

SHA256
bc7e6279a0dd1c54214dd0ef2a98beba0a94c87416843e8caf6f6ecaa706929a

SHA512
2ed8d7307ed2544816fba965877a7808410791457af4c5bc0ee2cf335b6293131afa3b88631c8673dc4a637180f970ecdefa79da37950a54d6de3ee943147225

Download Submit
\Windows\system\XjMWbPA.exe

Filesize
1.1MB

MD5
812bbe99ca26a9ad4fab57bae7d70685

SHA1
caf9fdee4d105ee484a12a68d99878752408f07d

SHA256
134ab6bb76e8ae35157d2ba217d601fb2c2dd48bc40686a64c27b37f6fdbd517

SHA512
e7513e7db745593b3231f537c75c46ef978608762fd72e6f892656218a70688cf8b01a3df4378f59da4c2f1d41846c443f07c91af19266fe5c3a8ece8545a190

Download Submit
\Windows\system\XzXXHty.exe

Filesize
1.1MB

MD5
7b6e26632f455d9db33415b7675d65bb

SHA1
24a16ba0495ab76bf1e78777aa59308c0b7800c3

SHA256
20acf9c7c22452a1137cf554b7d67b522bf73243888ea7923a10ae1de69ba85e

SHA512
7913246730a857a4407062b9238861344e6a097dab3021b1ed4317cb10eaa978c92c6ed3076d6e31a33162b6efd1e811fde005895b73eb381dfbdede26244ecd

Download Submit
\Windows\system\YVMcVFR.exe

Filesize
1.1MB

MD5
7a923b74aa282b452f02b163019586f4

SHA1
5a22f7e2760a8e15489395174fd9921287132565

SHA256
f5488fcc2b076ba77a06b9e0e6f668c6c06d799ff2a2f6cf84d607e70d857f8d

SHA512
3a3b216de2a1970de9da7669c154617988b01d4073ab10b761be0a6eb0f5174e72d043b588f2497c4e53e234c395fc0333630a23bb308a8c07b231892bd6d6cc

Download Submit
\Windows\system\ZULSRIu.exe

Filesize
1.1MB

MD5
a3ee0e8f83a7c744c2d278e8afcd5c5d

SHA1
818c07f07fad649e06da538be5289502a4c9814d

SHA256
71a78b2b2fcb07baf54f0ef484d8c049608971229a11af321779962f8ec4c8f8

SHA512
6311b015a915c68eb29e13f8b2bf0b3a200de6fe4456d477bef9fa217000f4fa974a8699703d3c8442fb76e51a44be07262965286f4f86e9aece440fc189cbec

Download Submit
\Windows\system\eUiLPxk.exe

Filesize
1.1MB

MD5
6cc5410c927744857894de1428681273

SHA1
68905775817c79b145e1b20f7d5b04a42b143d84

SHA256
d616c4a4253f6d78882763e04758b343c07db5a07dbb3ef16601e4ac765601f6

SHA512
2e6d1dc81708216bb80920b477df040c5fbb3541511ffad202bb523db8291ac4c42bc4ed49ea968a5ba707dcd48b9a4315a908b2bf5d19c960ce778ca2a2d767

Download Submit
\Windows\system\gPfzsiy.exe

Filesize
1.1MB

MD5
39d41e37d62756cdd75a57ddffe31d37

SHA1
d66e77be89e9bb0cb0ccf3e8999b15fa3fe7bbd0

SHA256
7340d2f72f13f08bcd913d54722a233e0d14045487e8b2e3ab4914ee11ffb0de

SHA512
e974f5ebfc552e22554433e866a1d23024240c6fb2e7e342eb793e3f2a1dcb43ced2ec934a619f5bf88190feed48a1da825a2faedff87da61c2232049f735598

Download Submit
\Windows\system\lAZQwNr.exe

Filesize
1.1MB

MD5
6bdba0e08f4d5b67b3a396789b1379dc

SHA1
ecca42c7f2547808c872dfbf3885458ed674e223

SHA256
74a5e43c8b6d7d8ea11015352201532ef03db3e8ee809abd96077b9361070ab1

SHA512
515ca9a2989cb2c35a4c0c756cef3b3d5925c00383c1053dfe683a5c42f1b0c8e5f3b491b0ee6cd3c73014c361c2878872b5e97d39a6fa5ecfd59d396e9747a3

Download Submit
\Windows\system\sodIHMx.exe

Filesize
1.1MB

MD5
5b8a77aeab09413ab5fe47c627dfcc8e

SHA1
bb95c1f1c70eb1e3d9632d054d84a3ddb83748d6

SHA256
b3aa42bcef60c474bf15eac73fe4d7c3071502b8adc4bfb6f4e8463d94190ce7

SHA512
86e3ee9471a46fd2926773b2c41110a03b7ed9a78707520be4f82c9ce692c13f2935d4f8d17d09033acb23a940f1236990f37a1eef9fce8eee76215e18c42b4b

Download Submit
\Windows\system\tbieZSu.exe

Filesize
1.1MB

MD5
2907b21938ec33ed1bab1d48fda168c6

SHA1
fa2a58d915301437426906a0305b75828ab4a5ff

SHA256
e55196857e8e7939f1b81b88c98b4f4b767d9da203fc2b07492ac9fb16c7f6cc

SHA512
450e6326ee37184bcb6379afc67f23b6c0a048504373dbf7150bb6e4a790834ca8ed7b34d2989202c52876ea459900a1d415e21a5f39b1f39f3dda5d1f604b2d

Download Submit
\Windows\system\wFzopGh.exe

Filesize
1.1MB

MD5
2a191924ad8cee4c59c0b407924f3b73

SHA1
5d52d82be20808efc5fe75fb992a94bd7bef5008

SHA256
e912a23438e1adf792e80b0966d93e38b3c81e8183e97691a91aa7ded3641e50

SHA512
7efb07fe0087e5bb5db37b07f10316144f4f2f3b0d391bbbfcd8985c3fdc2cf30749ffaa7dfc3e3034c515bd74c2b5cfecdab2ea1228c35774813709a25db8bc

Download Submit
\Windows\system\ydJqFWu.exe

Filesize
1.1MB

MD5
ff63eb6da07a9855356166b311911612

SHA1
2381465ca91bac64284d91491baa5547a65c3e9c

SHA256
83a087add622422805a888faa8218d3e697fd9c9f395ef7c567fcb874f1b890e

SHA512
8102034e5d1e4ca67ef0ccc3577c33f18ed607b624ea3d5d5a7a85322e42cb4df8ea5e09df34596c048751f00b3907a01d29540f75af649848cc87340055f2e1

Download Submit
\Windows\system\zUxINYL.exe

Filesize
1.1MB

MD5
de5ac6916eb64c5805cb01041c2e433f

SHA1
0355fdf3bbe4c81dfeed9de2f76469b1c8776e3d

SHA256
0f8f2fb19941ba6acb41713cefbc52dde5f44ebd44df9e5c17988928a1015cdb

SHA512
84c36ad61fbbbfef60c0447dea9a760a32ceb1665e47dd5b2254fd05781e6d8ca8d752816fa32dc81aaf6d65454146b0edd9bbaf507308aa662b2378b9359ed6

Download Submit
memory/632-5244-0x000000013F520000-0x000000013F912000-memory.dmp

Filesize
3.9MB

Download
memory/632-84-0x000000013F520000-0x000000013F912000-memory.dmp

Filesize
3.9MB

Download
memory/772-60-0x000007FEF61F0000-0x000007FEF6B8D000-memory.dmp

Filesize
9.6MB

Download
memory/772-61-0x000007FEF61F0000-0x000007FEF6B8D000-memory.dmp

Filesize
9.6MB

Download
memory/772-19-0x000000001B6D0000-0x000000001B9B2000-memory.dmp

Filesize
2.9MB

Download
memory/772-14-0x0000000002B40000-0x0000000002BC0000-memory.dmp

Filesize
512KB

Download
memory/772-1144-0x000007FEF61F0000-0x000007FEF6B8D000-memory.dmp

Filesize
9.6MB

Download
memory/772-22-0x0000000001E60000-0x0000000001E68000-memory.dmp

Filesize
32KB

Download
memory/772-15-0x000007FEF64AE000-0x000007FEF64AF000-memory.dmp

Filesize
4KB

Download
memory/772-57-0x000007FEF61F0000-0x000007FEF6B8D000-memory.dmp

Filesize
9.6MB

Download
memory/980-13-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/1036-5261-0x000000013FA40000-0x000000013FE32000-memory.dmp

Filesize
3.9MB

Download
memory/1036-88-0x000000013FA40000-0x000000013FE32000-memory.dmp

Filesize
3.9MB

Download
memory/1980-98-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/1980-5258-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2368-76-0x0000000003450000-0x0000000003842000-memory.dmp

Filesize
3.9MB

Download
memory/2368-12-0x00000000030A0000-0x0000000003492000-memory.dmp

Filesize
3.9MB

Download
memory/2368-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2368-63-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2368-93-0x0000000003450000-0x0000000003842000-memory.dmp

Filesize
3.9MB

Download
memory/2368-65-0x0000000003450000-0x0000000003842000-memory.dmp

Filesize
3.9MB

Download
memory/2368-71-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download
memory/2368-67-0x0000000003450000-0x0000000003842000-memory.dmp

Filesize
3.9MB

Download
memory/2368-94-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2368-86-0x0000000003450000-0x0000000003842000-memory.dmp

Filesize
3.9MB

Download
memory/2368-2-0x000000013F880000-0x000000013FC72000-memory.dmp

Filesize
3.9MB

Download
memory/2368-69-0x0000000003450000-0x0000000003842000-memory.dmp

Filesize
3.9MB

Download
memory/2368-75-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/2368-85-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/2368-79-0x0000000003450000-0x0000000003842000-memory.dmp

Filesize
3.9MB

Download
memory/2572-68-0x000000013FB90000-0x000000013FF82000-memory.dmp

Filesize
3.9MB

Download
memory/2572-5233-0x000000013FB90000-0x000000013FF82000-memory.dmp

Filesize
3.9MB

Download
memory/2680-5219-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/2680-62-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/2724-66-0x000000013F630000-0x000000013FA22000-memory.dmp

Filesize
3.9MB

Download
memory/2736-81-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download
memory/2736-5237-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download
memory/2812-64-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2812-5253-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2852-5210-0x000000013F7F0000-0x000000013FBE2000-memory.dmp

Filesize
3.9MB

Download
memory/2852-70-0x000000013F7F0000-0x000000013FBE2000-memory.dmp

Filesize
3.9MB

Download
memory/2944-5264-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/2944-87-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/2972-80-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download
memory/2972-5235-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download