xmrig | 326c34f027603caacb14b06ffa4e366a71bef55f68bfc135a696f6a6198f166e

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 03:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2635c6e24c5e0499294ac08a27fbdb30N.exe
Size

1.7MB
MD5

2635c6e24c5e0499294ac08a27fbdb30
SHA1

9c6a1ba0fc0669bc821b27777e82d03bedc5e433
SHA256

326c34f027603caacb14b06ffa4e366a71bef55f68bfc135a696f6a6198f166e
SHA512

ecf67b29dd82d87c681fbf4efea2f1e1a0cb41f099b2f1a23b1c8482fcb98bea79ad300cf7a8188cf3769fd669ce3fecd2a4f553763e01e0be59bc4cf249d5ef
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkFfkeMlNIZbElhzBXeCnfJCwCc4MAKFpMloooIXru5:Lz071uv4BPMkFfdgIZohteLMxRgu2m+e

Score

10^/10

xmrig execution miner persistence privilege_escalation upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 21 IoCs

miner

resource	yara_rule
behavioral1/memory/2780-17-0x000000013F080000-0x000000013F472000-memory.dmp	xmrig
behavioral1/memory/2892-21-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	xmrig
behavioral1/memory/2844-61-0x000000013F810000-0x000000013FC02000-memory.dmp	xmrig
behavioral1/memory/2656-63-0x000000013FF30000-0x0000000140322000-memory.dmp	xmrig
behavioral1/memory/2820-65-0x000000013F600000-0x000000013F9F2000-memory.dmp	xmrig
behavioral1/memory/2884-67-0x000000013FD30000-0x0000000140122000-memory.dmp	xmrig
behavioral1/memory/2748-55-0x000000013FD60000-0x0000000140152000-memory.dmp	xmrig
behavioral1/memory/2548-217-0x000000013FF90000-0x0000000140382000-memory.dmp	xmrig
behavioral1/memory/2548-216-0x000000013FF90000-0x0000000140382000-memory.dmp	xmrig
behavioral1/memory/952-530-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	xmrig
behavioral1/memory/2844-1441-0x000000013F810000-0x000000013FC02000-memory.dmp	xmrig
behavioral1/memory/2656-1387-0x000000013FF30000-0x0000000140322000-memory.dmp	xmrig
behavioral1/memory/2780-1385-0x000000013F080000-0x000000013F472000-memory.dmp	xmrig
behavioral1/memory/2372-1369-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	xmrig
behavioral1/memory/2820-1414-0x000000013F600000-0x000000013F9F2000-memory.dmp	xmrig
behavioral1/memory/2884-1460-0x000000013FD30000-0x0000000140122000-memory.dmp	xmrig
behavioral1/memory/2052-1456-0x000000013FF00000-0x00000001402F2000-memory.dmp	xmrig
behavioral1/memory/2748-1413-0x000000013FD60000-0x0000000140152000-memory.dmp	xmrig
behavioral1/memory/952-1410-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	xmrig
behavioral1/memory/2892-1406-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	xmrig
behavioral1/memory/2672-1404-0x000000013FFC0000-0x00000001403B2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2288	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2780	ZfUlKsY.exe
2892	PEirUEY.exe
2748	PJhdFBV.exe
2844	KkcADmv.exe
2656	cZyRFAl.exe
2820	ELZteaW.exe
2884	oqaAsxy.exe
952	VVfkKbm.exe
2372	ZGGjyTH.exe
2672	UezRivM.exe
2052	nNFUXhu.exe
2012	FBatQYX.exe
1700	LiGmkkq.exe
2692	AAEbzqr.exe
2128	omTKQEV.exe
2940	liNggmO.exe
2916	iUcIcYN.exe
1512	cFbjUge.exe
1616	WlRxtRt.exe
1504	grGbOGX.exe
3004	MQRkBSD.exe
2408	bFNjmIA.exe
2136	gymPZvS.exe
2416	hiyCeAG.exe
2376	eckhuLP.exe
1376	nzpGFBu.exe
776	xomFucN.exe
1360	fwzpPNb.exe
1472	VwXZlsh.exe
968	ZgVfxDU.exe
2768	LprmSgS.exe
1688	oZWKHdB.exe
1536	SGOfIAU.exe
2100	IxeabRA.exe
1840	VOoKwvg.exe
2196	uQubETJ.exe
2452	vOBPJUs.exe
2260	SOScxvk.exe
1692	umXLwpP.exe
824	gYKGiHj.exe
1028	wEZabmq.exe
548	JmbaDrp.exe
2868	TgVTdRy.exe
692	JsouzBz.exe
1508	MkZprUN.exe
2732	MojwyMq.exe
768	VKAVLGq.exe
2624	dBURyGI.exe
924	JCyMCAH.exe
1264	erOZzYd.exe
2484	JABKCYH.exe
1808	xHXMqrW.exe
2076	FyuYGDf.exe
2332	FEmDFam.exe
2216	CExSxXJ.exe
1604	IefmuUy.exe
2464	KhBZDcs.exe
1988	hTITJtB.exe
2896	qYXYmtX.exe
2800	woqisIs.exe
2680	HssYIlQ.exe
2340	eLvyXFJ.exe
1060	mvVwUfz.exe
2944	IpvgICk.exe

Loads dropped DLL 64 IoCs

pid	Process
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
2548	2635c6e24c5e0499294ac08a27fbdb30N.exe

UPX packed file 62 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2548-0-0x000000013FF90000-0x0000000140382000-memory.dmp	upx
behavioral1/files/0x000c000000015635-6.dat	upx
behavioral1/memory/2780-17-0x000000013F080000-0x000000013F472000-memory.dmp	upx
behavioral1/files/0x001000000000558f-26.dat	upx
behavioral1/memory/2892-21-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	upx
behavioral1/files/0x0007000000018f9c-31.dat	upx
behavioral1/files/0x0006000000018f9e-39.dat	upx
behavioral1/files/0x0006000000018fa0-45.dat	upx
behavioral1/files/0x0009000000018fa2-47.dat	upx
behavioral1/files/0x002b000000018f84-30.dat	upx
behavioral1/files/0x0008000000018f90-16.dat	upx
behavioral1/files/0x0007000000018fcb-56.dat	upx
behavioral1/memory/2844-61-0x000000013F810000-0x000000013FC02000-memory.dmp	upx
behavioral1/memory/2656-63-0x000000013FF30000-0x0000000140322000-memory.dmp	upx
behavioral1/memory/2820-65-0x000000013F600000-0x000000013F9F2000-memory.dmp	upx
behavioral1/memory/2884-67-0x000000013FD30000-0x0000000140122000-memory.dmp	upx
behavioral1/files/0x0005000000019078-76.dat	upx
behavioral1/memory/2372-81-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	upx
behavioral1/files/0x00040000000192a8-92.dat	upx
behavioral1/memory/2052-96-0x000000013FF00000-0x00000001402F2000-memory.dmp	upx
behavioral1/files/0x0004000000019206-84.dat	upx
behavioral1/memory/952-75-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	upx
behavioral1/files/0x0004000000019380-103.dat	upx
behavioral1/files/0x00040000000192ad-105.dat	upx
behavioral1/files/0x0006000000018fe4-69.dat	upx
behavioral1/files/0x0004000000019438-114.dat	upx
behavioral1/files/0x00040000000194ec-128.dat	upx
behavioral1/files/0x0004000000019485-123.dat	upx
behavioral1/files/0x000500000001966c-143.dat	upx
behavioral1/files/0x000500000001a1f1-166.dat	upx
behavioral1/files/0x000500000001a201-173.dat	upx
behavioral1/files/0x000500000001a25a-178.dat	upx
behavioral1/files/0x000500000001a270-188.dat	upx
behavioral1/files/0x000500000001a1e8-159.dat	upx
behavioral1/files/0x0005000000019f50-152.dat	upx
behavioral1/files/0x0005000000019575-138.dat	upx
behavioral1/files/0x0004000000019461-118.dat	upx
behavioral1/files/0x0005000000019571-130.dat	upx
behavioral1/files/0x000500000001962f-140.dat	upx
behavioral1/files/0x000500000001a237-175.dat	upx
behavioral1/files/0x000500000001a272-189.dat	upx
behavioral1/files/0x000500000001a25c-182.dat	upx
behavioral1/files/0x000500000001a1fe-168.dat	upx
behavioral1/memory/2672-89-0x000000013FFC0000-0x00000001403B2000-memory.dmp	upx
behavioral1/memory/2748-55-0x000000013FD60000-0x0000000140152000-memory.dmp	upx
behavioral1/memory/2548-217-0x000000013FF90000-0x0000000140382000-memory.dmp	upx
behavioral1/files/0x00050000000196af-147.dat	upx
behavioral1/files/0x000500000001a1ee-161.dat	upx
behavioral1/files/0x000500000001a056-154.dat	upx
behavioral1/memory/2548-216-0x000000013FF90000-0x0000000140382000-memory.dmp	upx
behavioral1/memory/952-530-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	upx
behavioral1/memory/2844-1441-0x000000013F810000-0x000000013FC02000-memory.dmp	upx
behavioral1/memory/2656-1387-0x000000013FF30000-0x0000000140322000-memory.dmp	upx
behavioral1/memory/2780-1385-0x000000013F080000-0x000000013F472000-memory.dmp	upx
behavioral1/memory/2372-1369-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	upx
behavioral1/memory/2820-1414-0x000000013F600000-0x000000013F9F2000-memory.dmp	upx
behavioral1/memory/2884-1460-0x000000013FD30000-0x0000000140122000-memory.dmp	upx
behavioral1/memory/2052-1456-0x000000013FF00000-0x00000001402F2000-memory.dmp	upx
behavioral1/memory/2748-1413-0x000000013FD60000-0x0000000140152000-memory.dmp	upx
behavioral1/memory/952-1410-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	upx
behavioral1/memory/2892-1406-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	upx
behavioral1/memory/2672-1404-0x000000013FFC0000-0x00000001403B2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\AEATZRp.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\ecQPiWH.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\pZaXyxC.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\wtJUUbp.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\vCltcEB.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\UQIUFRW.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\fLgqYme.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\xHXMqrW.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\UACTikB.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\IAneDfX.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\xdpVSYc.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\aAlsEEu.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\eNCqLJK.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\ydBsnKh.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\jAFmTnm.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\MImzSLg.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\uiZwctt.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\qIZyEOZ.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\YZEefLt.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\fakKrfA.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\IyZNGuQ.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\jYiDgha.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\PEirUEY.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\wECTjzu.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\zrMZcbY.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\XkfnFcp.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\DZZSdUK.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\cYdtdgD.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\wsaoyDy.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\pQFRuIy.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\CExSxXJ.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\gFeMiHZ.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\tLZkivk.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\FkjOhDn.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\RcCWCYX.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\kcZSzcB.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\RgFlrxn.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\mfWvrVY.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\jdMtBqh.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\OHNYXLb.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\ZTWhHLh.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\NlLBUXj.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\EbKIqRd.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\SdquvHX.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\dTyOTvH.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\fSdFExc.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\rmrAQll.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\EPyBCdy.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\uwlRXJo.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\TgVTdRy.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\kLGhnha.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\imBrrTX.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\qQYhdCP.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\EwQdYmi.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\txxAvwd.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\IyrKwFc.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\uPimoOW.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\jvQURRb.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\xyzRMci.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\AqinScL.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\smVVfTU.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\jydpBCQ.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\KIXHkMJ.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe
File created	C:\Windows\System\KPlUaEy.exe	2635c6e24c5e0499294ac08a27fbdb30N.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2288	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
Token: SeLockMemoryPrivilege	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe
Token: SeDebugPrivilege	2288	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2288	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	30
PID 2548 wrote to memory of 2288	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	30
PID 2548 wrote to memory of 2288	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	30
PID 2548 wrote to memory of 2780	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	31
PID 2548 wrote to memory of 2780	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	31
PID 2548 wrote to memory of 2780	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	31
PID 2548 wrote to memory of 2892	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	32
PID 2548 wrote to memory of 2892	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	32
PID 2548 wrote to memory of 2892	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	32
PID 2548 wrote to memory of 2748	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	33
PID 2548 wrote to memory of 2748	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	33
PID 2548 wrote to memory of 2748	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	33
PID 2548 wrote to memory of 2844	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	34
PID 2548 wrote to memory of 2844	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	34
PID 2548 wrote to memory of 2844	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	34
PID 2548 wrote to memory of 2656	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	35
PID 2548 wrote to memory of 2656	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	35
PID 2548 wrote to memory of 2656	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	35
PID 2548 wrote to memory of 2820	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	36
PID 2548 wrote to memory of 2820	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	36
PID 2548 wrote to memory of 2820	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	36
PID 2548 wrote to memory of 2884	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	37
PID 2548 wrote to memory of 2884	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	37
PID 2548 wrote to memory of 2884	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	37
PID 2548 wrote to memory of 2672	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	38
PID 2548 wrote to memory of 2672	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	38
PID 2548 wrote to memory of 2672	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	38
PID 2548 wrote to memory of 952	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	39
PID 2548 wrote to memory of 952	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	39
PID 2548 wrote to memory of 952	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	39
PID 2548 wrote to memory of 2052	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	40
PID 2548 wrote to memory of 2052	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	40
PID 2548 wrote to memory of 2052	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	40
PID 2548 wrote to memory of 2372	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	41
PID 2548 wrote to memory of 2372	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	41
PID 2548 wrote to memory of 2372	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	41
PID 2548 wrote to memory of 1700	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	42
PID 2548 wrote to memory of 1700	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	42
PID 2548 wrote to memory of 1700	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	42
PID 2548 wrote to memory of 2012	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	43
PID 2548 wrote to memory of 2012	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	43
PID 2548 wrote to memory of 2012	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	43
PID 2548 wrote to memory of 2692	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	44
PID 2548 wrote to memory of 2692	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	44
PID 2548 wrote to memory of 2692	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	44
PID 2548 wrote to memory of 2128	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	45
PID 2548 wrote to memory of 2128	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	45
PID 2548 wrote to memory of 2128	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	45
PID 2548 wrote to memory of 2940	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	46
PID 2548 wrote to memory of 2940	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	46
PID 2548 wrote to memory of 2940	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	46
PID 2548 wrote to memory of 2916	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	47
PID 2548 wrote to memory of 2916	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	47
PID 2548 wrote to memory of 2916	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	47
PID 2548 wrote to memory of 1512	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	48
PID 2548 wrote to memory of 1512	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	48
PID 2548 wrote to memory of 1512	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	48
PID 2548 wrote to memory of 1616	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	49
PID 2548 wrote to memory of 1616	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	49
PID 2548 wrote to memory of 1616	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	49
PID 2548 wrote to memory of 1504	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	50
PID 2548 wrote to memory of 1504	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	50
PID 2548 wrote to memory of 1504	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	50
PID 2548 wrote to memory of 3004	2548	2635c6e24c5e0499294ac08a27fbdb30N.exe	51

C:\Users\Admin\AppData\Local\Temp\2635c6e24c5e0499294ac08a27fbdb30N.exe
"C:\Users\Admin\AppData\Local\Temp\2635c6e24c5e0499294ac08a27fbdb30N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2288
- C:\Windows\System\ZfUlKsY.exe
  C:\Windows\System\ZfUlKsY.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\PEirUEY.exe
  C:\Windows\System\PEirUEY.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\PJhdFBV.exe
  C:\Windows\System\PJhdFBV.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\KkcADmv.exe
  C:\Windows\System\KkcADmv.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\cZyRFAl.exe
  C:\Windows\System\cZyRFAl.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\ELZteaW.exe
  C:\Windows\System\ELZteaW.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\oqaAsxy.exe
  C:\Windows\System\oqaAsxy.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\UezRivM.exe
  C:\Windows\System\UezRivM.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\VVfkKbm.exe
  C:\Windows\System\VVfkKbm.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\nNFUXhu.exe
  C:\Windows\System\nNFUXhu.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\ZGGjyTH.exe
  C:\Windows\System\ZGGjyTH.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\LiGmkkq.exe
  C:\Windows\System\LiGmkkq.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\FBatQYX.exe
  C:\Windows\System\FBatQYX.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\AAEbzqr.exe
  C:\Windows\System\AAEbzqr.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\omTKQEV.exe
  C:\Windows\System\omTKQEV.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\liNggmO.exe
  C:\Windows\System\liNggmO.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\iUcIcYN.exe
  C:\Windows\System\iUcIcYN.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\cFbjUge.exe
  C:\Windows\System\cFbjUge.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\WlRxtRt.exe
  C:\Windows\System\WlRxtRt.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\grGbOGX.exe
  C:\Windows\System\grGbOGX.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\MQRkBSD.exe
  C:\Windows\System\MQRkBSD.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\uQubETJ.exe
  C:\Windows\System\uQubETJ.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\bFNjmIA.exe
  C:\Windows\System\bFNjmIA.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\vOBPJUs.exe
  C:\Windows\System\vOBPJUs.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\gymPZvS.exe
  C:\Windows\System\gymPZvS.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\SOScxvk.exe
  C:\Windows\System\SOScxvk.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\hiyCeAG.exe
  C:\Windows\System\hiyCeAG.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\umXLwpP.exe
  C:\Windows\System\umXLwpP.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\eckhuLP.exe
  C:\Windows\System\eckhuLP.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\gYKGiHj.exe
  C:\Windows\System\gYKGiHj.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\nzpGFBu.exe
  C:\Windows\System\nzpGFBu.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\JmbaDrp.exe
  C:\Windows\System\JmbaDrp.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\xomFucN.exe
  C:\Windows\System\xomFucN.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\JsouzBz.exe
  C:\Windows\System\JsouzBz.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\fwzpPNb.exe
  C:\Windows\System\fwzpPNb.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\MkZprUN.exe
  C:\Windows\System\MkZprUN.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\VwXZlsh.exe
  C:\Windows\System\VwXZlsh.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\VKAVLGq.exe
  C:\Windows\System\VKAVLGq.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\ZgVfxDU.exe
  C:\Windows\System\ZgVfxDU.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\JCyMCAH.exe
  C:\Windows\System\JCyMCAH.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\LprmSgS.exe
  C:\Windows\System\LprmSgS.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\erOZzYd.exe
  C:\Windows\System\erOZzYd.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\oZWKHdB.exe
  C:\Windows\System\oZWKHdB.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\JABKCYH.exe
  C:\Windows\System\JABKCYH.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\SGOfIAU.exe
  C:\Windows\System\SGOfIAU.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\FyuYGDf.exe
  C:\Windows\System\FyuYGDf.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\IxeabRA.exe
  C:\Windows\System\IxeabRA.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\FEmDFam.exe
  C:\Windows\System\FEmDFam.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\VOoKwvg.exe
  C:\Windows\System\VOoKwvg.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\IefmuUy.exe
  C:\Windows\System\IefmuUy.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\wEZabmq.exe
  C:\Windows\System\wEZabmq.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\KhBZDcs.exe
  C:\Windows\System\KhBZDcs.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\TgVTdRy.exe
  C:\Windows\System\TgVTdRy.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\qYXYmtX.exe
  C:\Windows\System\qYXYmtX.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\MojwyMq.exe
  C:\Windows\System\MojwyMq.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\woqisIs.exe
  C:\Windows\System\woqisIs.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\dBURyGI.exe
  C:\Windows\System\dBURyGI.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\HssYIlQ.exe
  C:\Windows\System\HssYIlQ.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\xHXMqrW.exe
  C:\Windows\System\xHXMqrW.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\eLvyXFJ.exe
  C:\Windows\System\eLvyXFJ.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\CExSxXJ.exe
  C:\Windows\System\CExSxXJ.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\mvVwUfz.exe
  C:\Windows\System\mvVwUfz.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\hTITJtB.exe
  C:\Windows\System\hTITJtB.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\IpvgICk.exe
  C:\Windows\System\IpvgICk.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\kQIQDBG.exe
  C:\Windows\System\kQIQDBG.exe
  2⤵
  PID:1980
- C:\Windows\System\qxGyEht.exe
  C:\Windows\System\qxGyEht.exe
  2⤵
  PID:1912
- C:\Windows\System\JcMDzal.exe
  C:\Windows\System\JcMDzal.exe
  2⤵
  PID:1092
- C:\Windows\System\kiVEBFX.exe
  C:\Windows\System\kiVEBFX.exe
  2⤵
  PID:2164
- C:\Windows\System\DXXaxQY.exe
  C:\Windows\System\DXXaxQY.exe
  2⤵
  PID:1992
- C:\Windows\System\wECTjzu.exe
  C:\Windows\System\wECTjzu.exe
  2⤵
  PID:632
- C:\Windows\System\mjZAfpl.exe
  C:\Windows\System\mjZAfpl.exe
  2⤵
  PID:2036
- C:\Windows\System\dxbnHfs.exe
  C:\Windows\System\dxbnHfs.exe
  2⤵
  PID:1296
- C:\Windows\System\MaINJVe.exe
  C:\Windows\System\MaINJVe.exe
  2⤵
  PID:2292
- C:\Windows\System\RLmxHVt.exe
  C:\Windows\System\RLmxHVt.exe
  2⤵
  PID:2552
- C:\Windows\System\YSgROuy.exe
  C:\Windows\System\YSgROuy.exe
  2⤵
  PID:2212
- C:\Windows\System\fLyQJEO.exe
  C:\Windows\System\fLyQJEO.exe
  2⤵
  PID:2312
- C:\Windows\System\oeJOWVc.exe
  C:\Windows\System\oeJOWVc.exe
  2⤵
  PID:2904
- C:\Windows\System\cYdtdgD.exe
  C:\Windows\System\cYdtdgD.exe
  2⤵
  PID:1308
- C:\Windows\System\tpBKbbj.exe
  C:\Windows\System\tpBKbbj.exe
  2⤵
  PID:1648
- C:\Windows\System\ooVclmX.exe
  C:\Windows\System\ooVclmX.exe
  2⤵
  PID:2788
- C:\Windows\System\fVpEhkg.exe
  C:\Windows\System\fVpEhkg.exe
  2⤵
  PID:2772
- C:\Windows\System\jMEZPms.exe
  C:\Windows\System\jMEZPms.exe
  2⤵
  PID:2616
- C:\Windows\System\epXvsJk.exe
  C:\Windows\System\epXvsJk.exe
  2⤵
  PID:2912
- C:\Windows\System\njRRZxK.exe
  C:\Windows\System\njRRZxK.exe
  2⤵
  PID:844
- C:\Windows\System\uPimoOW.exe
  C:\Windows\System\uPimoOW.exe
  2⤵
  PID:1052
- C:\Windows\System\pZopsrO.exe
  C:\Windows\System\pZopsrO.exe
  2⤵
  PID:432
- C:\Windows\System\FfhBxvc.exe
  C:\Windows\System\FfhBxvc.exe
  2⤵
  PID:2104
- C:\Windows\System\IIFTCdd.exe
  C:\Windows\System\IIFTCdd.exe
  2⤵
  PID:2832
- C:\Windows\System\XbIBNNr.exe
  C:\Windows\System\XbIBNNr.exe
  2⤵
  PID:2352
- C:\Windows\System\wrQdllw.exe
  C:\Windows\System\wrQdllw.exe
  2⤵
  PID:472
- C:\Windows\System\IiNhqgT.exe
  C:\Windows\System\IiNhqgT.exe
  2⤵
  PID:592
- C:\Windows\System\dozKKEj.exe
  C:\Windows\System\dozKKEj.exe
  2⤵
  PID:2064
- C:\Windows\System\zPLEnNA.exe
  C:\Windows\System\zPLEnNA.exe
  2⤵
  PID:2828
- C:\Windows\System\gBZhUMN.exe
  C:\Windows\System\gBZhUMN.exe
  2⤵
  PID:2796
- C:\Windows\System\umnuXzM.exe
  C:\Windows\System\umnuXzM.exe
  2⤵
  PID:672
- C:\Windows\System\LdCEbUO.exe
  C:\Windows\System\LdCEbUO.exe
  2⤵
  PID:2600
- C:\Windows\System\bPxqrET.exe
  C:\Windows\System\bPxqrET.exe
  2⤵
  PID:2304
- C:\Windows\System\ZPHBfWI.exe
  C:\Windows\System\ZPHBfWI.exe
  2⤵
  PID:1732
- C:\Windows\System\yuJCZer.exe
  C:\Windows\System\yuJCZer.exe
  2⤵
  PID:2016
- C:\Windows\System\VnMfVuB.exe
  C:\Windows\System\VnMfVuB.exe
  2⤵
  PID:2040
- C:\Windows\System\TnxvACh.exe
  C:\Windows\System\TnxvACh.exe
  2⤵
  PID:796
- C:\Windows\System\BRkJUem.exe
  C:\Windows\System\BRkJUem.exe
  2⤵
  PID:2592
- C:\Windows\System\MxXbeEo.exe
  C:\Windows\System\MxXbeEo.exe
  2⤵
  PID:1436
- C:\Windows\System\OUJZQQb.exe
  C:\Windows\System\OUJZQQb.exe
  2⤵
  PID:948
- C:\Windows\System\jmYHLEi.exe
  C:\Windows\System\jmYHLEi.exe
  2⤵
  PID:1588
- C:\Windows\System\XBIryOR.exe
  C:\Windows\System\XBIryOR.exe
  2⤵
  PID:1572
- C:\Windows\System\BrcWmKK.exe
  C:\Windows\System\BrcWmKK.exe
  2⤵
  PID:2968
- C:\Windows\System\CtwYCwL.exe
  C:\Windows\System\CtwYCwL.exe
  2⤵
  PID:2528
- C:\Windows\System\sfrTeZk.exe
  C:\Windows\System\sfrTeZk.exe
  2⤵
  PID:1916
- C:\Windows\System\GmMbmiw.exe
  C:\Windows\System\GmMbmiw.exe
  2⤵
  PID:664
- C:\Windows\System\katgzvs.exe
  C:\Windows\System\katgzvs.exe
  2⤵
  PID:1096
- C:\Windows\System\fHLQpgZ.exe
  C:\Windows\System\fHLQpgZ.exe
  2⤵
  PID:2060
- C:\Windows\System\GJOAxpe.exe
  C:\Windows\System\GJOAxpe.exe
  2⤵
  PID:2964
- C:\Windows\System\rUmAeGQ.exe
  C:\Windows\System\rUmAeGQ.exe
  2⤵
  PID:2668
- C:\Windows\System\gjmkrOJ.exe
  C:\Windows\System\gjmkrOJ.exe
  2⤵
  PID:2852
- C:\Windows\System\Qamaumy.exe
  C:\Windows\System\Qamaumy.exe
  2⤵
  PID:112
- C:\Windows\System\ngzwLjb.exe
  C:\Windows\System\ngzwLjb.exe
  2⤵
  PID:960
- C:\Windows\System\FDuECky.exe
  C:\Windows\System\FDuECky.exe
  2⤵
  PID:2348
- C:\Windows\System\waPyTFb.exe
  C:\Windows\System\waPyTFb.exe
  2⤵
  PID:1120
- C:\Windows\System\tJcqWWV.exe
  C:\Windows\System\tJcqWWV.exe
  2⤵
  PID:1252
- C:\Windows\System\lTKQoVt.exe
  C:\Windows\System\lTKQoVt.exe
  2⤵
  PID:1932
- C:\Windows\System\buzGswX.exe
  C:\Windows\System\buzGswX.exe
  2⤵
  PID:524
- C:\Windows\System\zznAumx.exe
  C:\Windows\System\zznAumx.exe
  2⤵
  PID:2028
- C:\Windows\System\bVftDlS.exe
  C:\Windows\System\bVftDlS.exe
  2⤵
  PID:1680
- C:\Windows\System\kLGhnha.exe
  C:\Windows\System\kLGhnha.exe
  2⤵
  PID:928
- C:\Windows\System\HUzNhJN.exe
  C:\Windows\System\HUzNhJN.exe
  2⤵
  PID:2156
- C:\Windows\System\EwQdYmi.exe
  C:\Windows\System\EwQdYmi.exe
  2⤵
  PID:2248
- C:\Windows\System\veDgnAX.exe
  C:\Windows\System\veDgnAX.exe
  2⤵
  PID:1564
- C:\Windows\System\dVgohBz.exe
  C:\Windows\System\dVgohBz.exe
  2⤵
  PID:1800
- C:\Windows\System\zPHJyjm.exe
  C:\Windows\System\zPHJyjm.exe
  2⤵
  PID:2412
- C:\Windows\System\hauMijh.exe
  C:\Windows\System\hauMijh.exe
  2⤵
  PID:2228
- C:\Windows\System\NLiejea.exe
  C:\Windows\System\NLiejea.exe
  2⤵
  PID:2688
- C:\Windows\System\sPayosK.exe
  C:\Windows\System\sPayosK.exe
  2⤵
  PID:2876
- C:\Windows\System\IdcWoDt.exe
  C:\Windows\System\IdcWoDt.exe
  2⤵
  PID:1232
- C:\Windows\System\HlItCjx.exe
  C:\Windows\System\HlItCjx.exe
  2⤵
  PID:2860
- C:\Windows\System\PHgXrQv.exe
  C:\Windows\System\PHgXrQv.exe
  2⤵
  PID:972
- C:\Windows\System\taZTRhb.exe
  C:\Windows\System\taZTRhb.exe
  2⤵
  PID:276
- C:\Windows\System\sSphlob.exe
  C:\Windows\System\sSphlob.exe
  2⤵
  PID:780
- C:\Windows\System\bYXLwUx.exe
  C:\Windows\System\bYXLwUx.exe
  2⤵
  PID:1356
- C:\Windows\System\pQZOXFj.exe
  C:\Windows\System\pQZOXFj.exe
  2⤵
  PID:1172
- C:\Windows\System\LxJBKqs.exe
  C:\Windows\System\LxJBKqs.exe
  2⤵
  PID:1760
- C:\Windows\System\TgKxrHd.exe
  C:\Windows\System\TgKxrHd.exe
  2⤵
  PID:2744
- C:\Windows\System\gAyLrIq.exe
  C:\Windows\System\gAyLrIq.exe
  2⤵
  PID:1500
- C:\Windows\System\UIqTdLb.exe
  C:\Windows\System\UIqTdLb.exe
  2⤵
  PID:2648
- C:\Windows\System\fOtceyJ.exe
  C:\Windows\System\fOtceyJ.exe
  2⤵
  PID:1860
- C:\Windows\System\vBGbxlK.exe
  C:\Windows\System\vBGbxlK.exe
  2⤵
  PID:2676
- C:\Windows\System\ncahSBD.exe
  C:\Windows\System\ncahSBD.exe
  2⤵
  PID:2504
- C:\Windows\System\YrEdcTX.exe
  C:\Windows\System\YrEdcTX.exe
  2⤵
  PID:2948
- C:\Windows\System\cEIwxao.exe
  C:\Windows\System\cEIwxao.exe
  2⤵
  PID:1596
- C:\Windows\System\rSGowlc.exe
  C:\Windows\System\rSGowlc.exe
  2⤵
  PID:2880
- C:\Windows\System\SJFvVJW.exe
  C:\Windows\System\SJFvVJW.exe
  2⤵
  PID:388
- C:\Windows\System\JMTalbJ.exe
  C:\Windows\System\JMTalbJ.exe
  2⤵
  PID:320
- C:\Windows\System\sVOllta.exe
  C:\Windows\System\sVOllta.exe
  2⤵
  PID:884
- C:\Windows\System\PewMNHM.exe
  C:\Windows\System\PewMNHM.exe
  2⤵
  PID:1972
- C:\Windows\System\UYqKlpD.exe
  C:\Windows\System\UYqKlpD.exe
  2⤵
  PID:456
- C:\Windows\System\fiXhgpK.exe
  C:\Windows\System\fiXhgpK.exe
  2⤵
  PID:1324
- C:\Windows\System\Zhgirbl.exe
  C:\Windows\System\Zhgirbl.exe
  2⤵
  PID:1748
- C:\Windows\System\qSbyPTU.exe
  C:\Windows\System\qSbyPTU.exe
  2⤵
  PID:2972
- C:\Windows\System\sFUrKWM.exe
  C:\Windows\System\sFUrKWM.exe
  2⤵
  PID:2232
- C:\Windows\System\hvvVpQa.exe
  C:\Windows\System\hvvVpQa.exe
  2⤵
  PID:1552
- C:\Windows\System\UyXFBvK.exe
  C:\Windows\System\UyXFBvK.exe
  2⤵
  PID:2220
- C:\Windows\System\GFrbbwx.exe
  C:\Windows\System\GFrbbwx.exe
  2⤵
  PID:2088
- C:\Windows\System\OrlLCfT.exe
  C:\Windows\System\OrlLCfT.exe
  2⤵
  PID:2092
- C:\Windows\System\trmnjmG.exe
  C:\Windows\System\trmnjmG.exe
  2⤵
  PID:3000
- C:\Windows\System\pQFRuIy.exe
  C:\Windows\System\pQFRuIy.exe
  2⤵
  PID:2148
- C:\Windows\System\gdLuSdL.exe
  C:\Windows\System\gdLuSdL.exe
  2⤵
  PID:2856
- C:\Windows\System\TWWdvLB.exe
  C:\Windows\System\TWWdvLB.exe
  2⤵
  PID:2532
- C:\Windows\System\BNodtxW.exe
  C:\Windows\System\BNodtxW.exe
  2⤵
  PID:3016
- C:\Windows\System\iDtKaVI.exe
  C:\Windows\System\iDtKaVI.exe
  2⤵
  PID:288
- C:\Windows\System\cOXZcEl.exe
  C:\Windows\System\cOXZcEl.exe
  2⤵
  PID:3096
- C:\Windows\System\nGRJzGK.exe
  C:\Windows\System\nGRJzGK.exe
  2⤵
  PID:3116
- C:\Windows\System\dxDvSHF.exe
  C:\Windows\System\dxDvSHF.exe
  2⤵
  PID:3132
- C:\Windows\System\opqSzmY.exe
  C:\Windows\System\opqSzmY.exe
  2⤵
  PID:3156
- C:\Windows\System\imBrrTX.exe
  C:\Windows\System\imBrrTX.exe
  2⤵
  PID:3172
- C:\Windows\System\jPYIfku.exe
  C:\Windows\System\jPYIfku.exe
  2⤵
  PID:3204
- C:\Windows\System\RotBQqv.exe
  C:\Windows\System\RotBQqv.exe
  2⤵
  PID:3228
- C:\Windows\System\NIsfqyB.exe
  C:\Windows\System\NIsfqyB.exe
  2⤵
  PID:3244
- C:\Windows\System\HZzlNFS.exe
  C:\Windows\System\HZzlNFS.exe
  2⤵
  PID:3268
- C:\Windows\System\tsAVWCv.exe
  C:\Windows\System\tsAVWCv.exe
  2⤵
  PID:3284
- C:\Windows\System\dwbgyLO.exe
  C:\Windows\System\dwbgyLO.exe
  2⤵
  PID:3308
- C:\Windows\System\cDafvOb.exe
  C:\Windows\System\cDafvOb.exe
  2⤵
  PID:3328
- C:\Windows\System\SjueGyM.exe
  C:\Windows\System\SjueGyM.exe
  2⤵
  PID:3352
- C:\Windows\System\GxKgdAl.exe
  C:\Windows\System\GxKgdAl.exe
  2⤵
  PID:3368
- C:\Windows\System\rsspvwu.exe
  C:\Windows\System\rsspvwu.exe
  2⤵
  PID:3388
- C:\Windows\System\HdAgbKB.exe
  C:\Windows\System\HdAgbKB.exe
  2⤵
  PID:3408
- C:\Windows\System\IyELDcJ.exe
  C:\Windows\System\IyELDcJ.exe
  2⤵
  PID:3428
- C:\Windows\System\weJTURD.exe
  C:\Windows\System\weJTURD.exe
  2⤵
  PID:3448
- C:\Windows\System\ibTCEba.exe
  C:\Windows\System\ibTCEba.exe
  2⤵
  PID:3472
- C:\Windows\System\TEqHwzP.exe
  C:\Windows\System\TEqHwzP.exe
  2⤵
  PID:3488
- C:\Windows\System\uhxCaii.exe
  C:\Windows\System\uhxCaii.exe
  2⤵
  PID:3508
- C:\Windows\System\dVrpXZs.exe
  C:\Windows\System\dVrpXZs.exe
  2⤵
  PID:3528
- C:\Windows\System\MwtKlTN.exe
  C:\Windows\System\MwtKlTN.exe
  2⤵
  PID:3552
- C:\Windows\System\xeEhHOJ.exe
  C:\Windows\System\xeEhHOJ.exe
  2⤵
  PID:3568
- C:\Windows\System\IAHqWNv.exe
  C:\Windows\System\IAHqWNv.exe
  2⤵
  PID:3592
- C:\Windows\System\pyQYpEx.exe
  C:\Windows\System\pyQYpEx.exe
  2⤵
  PID:3656
- C:\Windows\System\wJOItRS.exe
  C:\Windows\System\wJOItRS.exe
  2⤵
  PID:3672
- C:\Windows\System\QZaliIQ.exe
  C:\Windows\System\QZaliIQ.exe
  2⤵
  PID:3704
- C:\Windows\System\mPNqyBk.exe
  C:\Windows\System\mPNqyBk.exe
  2⤵
  PID:3720
- C:\Windows\System\bSSPWUL.exe
  C:\Windows\System\bSSPWUL.exe
  2⤵
  PID:3740
- C:\Windows\System\iuifJEj.exe
  C:\Windows\System\iuifJEj.exe
  2⤵
  PID:3760
- C:\Windows\System\dnRCqMC.exe
  C:\Windows\System\dnRCqMC.exe
  2⤵
  PID:3780
- C:\Windows\System\bUBPDUd.exe
  C:\Windows\System\bUBPDUd.exe
  2⤵
  PID:3804
- C:\Windows\System\rQZbIfD.exe
  C:\Windows\System\rQZbIfD.exe
  2⤵
  PID:3820
- C:\Windows\System\WFXaCxF.exe
  C:\Windows\System\WFXaCxF.exe
  2⤵
  PID:3840
- C:\Windows\System\rHXsYfH.exe
  C:\Windows\System\rHXsYfH.exe
  2⤵
  PID:3860
- C:\Windows\System\UVLWKVJ.exe
  C:\Windows\System\UVLWKVJ.exe
  2⤵
  PID:3880
- C:\Windows\System\hrzxHzv.exe
  C:\Windows\System\hrzxHzv.exe
  2⤵
  PID:3900
- C:\Windows\System\JGJWbLP.exe
  C:\Windows\System\JGJWbLP.exe
  2⤵
  PID:3924
- C:\Windows\System\ybcqHyT.exe
  C:\Windows\System\ybcqHyT.exe
  2⤵
  PID:3940
- C:\Windows\System\vwpLNDQ.exe
  C:\Windows\System\vwpLNDQ.exe
  2⤵
  PID:3968
- C:\Windows\System\oUASSxh.exe
  C:\Windows\System\oUASSxh.exe
  2⤵
  PID:3984
- C:\Windows\System\EaCZoTe.exe
  C:\Windows\System\EaCZoTe.exe
  2⤵
  PID:4008
- C:\Windows\System\bokVVWG.exe
  C:\Windows\System\bokVVWG.exe
  2⤵
  PID:4024
- C:\Windows\System\gcHAtml.exe
  C:\Windows\System\gcHAtml.exe
  2⤵
  PID:4044
- C:\Windows\System\tosGxNh.exe
  C:\Windows\System\tosGxNh.exe
  2⤵
  PID:4064
- C:\Windows\System\POKVfkC.exe
  C:\Windows\System\POKVfkC.exe
  2⤵
  PID:4084
- C:\Windows\System\XerNGTC.exe
  C:\Windows\System\XerNGTC.exe
  2⤵
  PID:3080
- C:\Windows\System\mfWvrVY.exe
  C:\Windows\System\mfWvrVY.exe
  2⤵
  PID:2512
- C:\Windows\System\UcpaOiL.exe
  C:\Windows\System\UcpaOiL.exe
  2⤵
  PID:3164
- C:\Windows\System\rwvabAG.exe
  C:\Windows\System\rwvabAG.exe
  2⤵
  PID:3108
- C:\Windows\System\kNygdpm.exe
  C:\Windows\System\kNygdpm.exe
  2⤵
  PID:3148
- C:\Windows\System\TbFsSdO.exe
  C:\Windows\System\TbFsSdO.exe
  2⤵
  PID:3188
- C:\Windows\System\sUwyqEN.exe
  C:\Windows\System\sUwyqEN.exe
  2⤵
  PID:3224
- C:\Windows\System\nbFxyUO.exe
  C:\Windows\System\nbFxyUO.exe
  2⤵
  PID:3240
- C:\Windows\System\fNApszf.exe
  C:\Windows\System\fNApszf.exe
  2⤵
  PID:584
- C:\Windows\System\HlFANNx.exe
  C:\Windows\System\HlFANNx.exe
  2⤵
  PID:3300
- C:\Windows\System\TqTKaMa.exe
  C:\Windows\System\TqTKaMa.exe
  2⤵
  PID:3324
- C:\Windows\System\wzZEiQN.exe
  C:\Windows\System\wzZEiQN.exe
  2⤵
  PID:3348
- C:\Windows\System\ZTWhHLh.exe
  C:\Windows\System\ZTWhHLh.exe
  2⤵
  PID:3376
- C:\Windows\System\pMSYcmd.exe
  C:\Windows\System\pMSYcmd.exe
  2⤵
  PID:1712
- C:\Windows\System\wEMIaRb.exe
  C:\Windows\System\wEMIaRb.exe
  2⤵
  PID:3436
- C:\Windows\System\QYWghax.exe
  C:\Windows\System\QYWghax.exe
  2⤵
  PID:3464
- C:\Windows\System\TXROVho.exe
  C:\Windows\System\TXROVho.exe
  2⤵
  PID:3484
- C:\Windows\System\ZJkRlap.exe
  C:\Windows\System\ZJkRlap.exe
  2⤵
  PID:3576
- C:\Windows\System\BzDHzbe.exe
  C:\Windows\System\BzDHzbe.exe
  2⤵
  PID:3260
- C:\Windows\System\TGmrPjI.exe
  C:\Windows\System\TGmrPjI.exe
  2⤵
  PID:3620
- C:\Windows\System\YKTMbHn.exe
  C:\Windows\System\YKTMbHn.exe
  2⤵
  PID:3632
- C:\Windows\System\AfCJpqc.exe
  C:\Windows\System\AfCJpqc.exe
  2⤵
  PID:3664
- C:\Windows\System\scrobqx.exe
  C:\Windows\System\scrobqx.exe
  2⤵
  PID:3696
- C:\Windows\System\UrxdSVV.exe
  C:\Windows\System\UrxdSVV.exe
  2⤵
  PID:3684
- C:\Windows\System\LLCvIFG.exe
  C:\Windows\System\LLCvIFG.exe
  2⤵
  PID:3736
- C:\Windows\System\fntJfEL.exe
  C:\Windows\System\fntJfEL.exe
  2⤵
  PID:3772
- C:\Windows\System\TwkevCd.exe
  C:\Windows\System\TwkevCd.exe
  2⤵
  PID:3796
- C:\Windows\System\AOPPaSH.exe
  C:\Windows\System\AOPPaSH.exe
  2⤵
  PID:3816
- C:\Windows\System\pQOFbce.exe
  C:\Windows\System\pQOFbce.exe
  2⤵
  PID:3856
- C:\Windows\System\KCJowlz.exe
  C:\Windows\System\KCJowlz.exe
  2⤵
  PID:3888
- C:\Windows\System\XjlwIAN.exe
  C:\Windows\System\XjlwIAN.exe
  2⤵
  PID:3920
- C:\Windows\System\pZaXyxC.exe
  C:\Windows\System\pZaXyxC.exe
  2⤵
  PID:3936
- C:\Windows\System\EqlxaVS.exe
  C:\Windows\System\EqlxaVS.exe
  2⤵
  PID:3956
- C:\Windows\System\GFarocu.exe
  C:\Windows\System\GFarocu.exe
  2⤵
  PID:4004
- C:\Windows\System\HfpBQwZ.exe
  C:\Windows\System\HfpBQwZ.exe
  2⤵
  PID:4032
- C:\Windows\System\YZqrJTy.exe
  C:\Windows\System\YZqrJTy.exe
  2⤵
  PID:4060
- C:\Windows\System\aHPMbpX.exe
  C:\Windows\System\aHPMbpX.exe
  2⤵
  PID:3700
- C:\Windows\System\sfrtHoI.exe
  C:\Windows\System\sfrtHoI.exe
  2⤵
  PID:896
- C:\Windows\System\FCxyXZZ.exe
  C:\Windows\System\FCxyXZZ.exe
  2⤵
  PID:1560
- C:\Windows\System\ABgMpNj.exe
  C:\Windows\System\ABgMpNj.exe
  2⤵
  PID:1696
- C:\Windows\System\HvvYyio.exe
  C:\Windows\System\HvvYyio.exe
  2⤵
  PID:3168
- C:\Windows\System\NjrDqKP.exe
  C:\Windows\System\NjrDqKP.exe
  2⤵
  PID:3144
- C:\Windows\System\OYlvqBA.exe
  C:\Windows\System\OYlvqBA.exe
  2⤵
  PID:3220
- C:\Windows\System\OLarFGU.exe
  C:\Windows\System\OLarFGU.exe
  2⤵
  PID:3196
- C:\Windows\System\CNBDuYx.exe
  C:\Windows\System\CNBDuYx.exe
  2⤵
  PID:3316
- C:\Windows\System\HoanUVy.exe
  C:\Windows\System\HoanUVy.exe
  2⤵
  PID:3480
- C:\Windows\System\poLOfKC.exe
  C:\Windows\System\poLOfKC.exe
  2⤵
  PID:3544
- C:\Windows\System\FIbquBC.exe
  C:\Windows\System\FIbquBC.exe
  2⤵
  PID:3400
- C:\Windows\System\AgdGvoj.exe
  C:\Windows\System\AgdGvoj.exe
  2⤵
  PID:3540
- C:\Windows\System\vorZrQe.exe
  C:\Windows\System\vorZrQe.exe
  2⤵
  PID:3680
- C:\Windows\System\kPYPTqc.exe
  C:\Windows\System\kPYPTqc.exe
  2⤵
  PID:3600
- C:\Windows\System\VyCKRze.exe
  C:\Windows\System\VyCKRze.exe
  2⤵
  PID:3960
- C:\Windows\System\TiLuBsj.exe
  C:\Windows\System\TiLuBsj.exe
  2⤵
  PID:1404
- C:\Windows\System\nxQAqxq.exe
  C:\Windows\System\nxQAqxq.exe
  2⤵
  PID:4100
- C:\Windows\System\KPjUUst.exe
  C:\Windows\System\KPjUUst.exe
  2⤵
  PID:4116
- C:\Windows\System\yimnskb.exe
  C:\Windows\System\yimnskb.exe
  2⤵
  PID:4140
- C:\Windows\System\zoIhdYv.exe
  C:\Windows\System\zoIhdYv.exe
  2⤵
  PID:4160
- C:\Windows\System\UBfXsih.exe
  C:\Windows\System\UBfXsih.exe
  2⤵
  PID:4180
- C:\Windows\System\KXqyVtX.exe
  C:\Windows\System\KXqyVtX.exe
  2⤵
  PID:4236
- C:\Windows\System\LCgfUIa.exe
  C:\Windows\System\LCgfUIa.exe
  2⤵
  PID:4260
- C:\Windows\System\TmdgIPX.exe
  C:\Windows\System\TmdgIPX.exe
  2⤵
  PID:4284
- C:\Windows\System\bdHSHgO.exe
  C:\Windows\System\bdHSHgO.exe
  2⤵
  PID:4300
- C:\Windows\System\zjinCPS.exe
  C:\Windows\System\zjinCPS.exe
  2⤵
  PID:4316
- C:\Windows\System\JuWbAmu.exe
  C:\Windows\System\JuWbAmu.exe
  2⤵
  PID:4332
- C:\Windows\System\hMQXrHQ.exe
  C:\Windows\System\hMQXrHQ.exe
  2⤵
  PID:4348
- C:\Windows\System\OHNYXLb.exe
  C:\Windows\System\OHNYXLb.exe
  2⤵
  PID:4364
- C:\Windows\System\ViduuPT.exe
  C:\Windows\System\ViduuPT.exe
  2⤵
  PID:4380
- C:\Windows\System\uKqwatX.exe
  C:\Windows\System\uKqwatX.exe
  2⤵
  PID:4396
- C:\Windows\System\wsaoyDy.exe
  C:\Windows\System\wsaoyDy.exe
  2⤵
  PID:4412
- C:\Windows\System\aIKDSQc.exe
  C:\Windows\System\aIKDSQc.exe
  2⤵
  PID:4428
- C:\Windows\System\nHZZGAw.exe
  C:\Windows\System\nHZZGAw.exe
  2⤵
  PID:4444
- C:\Windows\System\XkhwKtq.exe
  C:\Windows\System\XkhwKtq.exe
  2⤵
  PID:4552
- C:\Windows\System\tMhyHOZ.exe
  C:\Windows\System\tMhyHOZ.exe
  2⤵
  PID:4576
- C:\Windows\System\xXpohDd.exe
  C:\Windows\System\xXpohDd.exe
  2⤵
  PID:4600
- C:\Windows\System\kjKBdtx.exe
  C:\Windows\System\kjKBdtx.exe
  2⤵
  PID:4616
- C:\Windows\System\JCnOGFq.exe
  C:\Windows\System\JCnOGFq.exe
  2⤵
  PID:4632
- C:\Windows\System\scFJWph.exe
  C:\Windows\System\scFJWph.exe
  2⤵
  PID:4652
- C:\Windows\System\hsFgrJN.exe
  C:\Windows\System\hsFgrJN.exe
  2⤵
  PID:4668
- C:\Windows\System\TtprhAk.exe
  C:\Windows\System\TtprhAk.exe
  2⤵
  PID:4684
- C:\Windows\System\HkBLLDQ.exe
  C:\Windows\System\HkBLLDQ.exe
  2⤵
  PID:4704
- C:\Windows\System\jcdrgGq.exe
  C:\Windows\System\jcdrgGq.exe
  2⤵
  PID:4720
- C:\Windows\System\PWXUAEk.exe
  C:\Windows\System\PWXUAEk.exe
  2⤵
  PID:4736
- C:\Windows\System\wbjUxsq.exe
  C:\Windows\System\wbjUxsq.exe
  2⤵
  PID:4752
- C:\Windows\System\cAoAheR.exe
  C:\Windows\System\cAoAheR.exe
  2⤵
  PID:4768
- C:\Windows\System\MVxxuIy.exe
  C:\Windows\System\MVxxuIy.exe
  2⤵
  PID:4784
- C:\Windows\System\lHGfTXW.exe
  C:\Windows\System\lHGfTXW.exe
  2⤵
  PID:4872
- C:\Windows\System\EedyNaD.exe
  C:\Windows\System\EedyNaD.exe
  2⤵
  PID:4888
- C:\Windows\System\bYPUSLW.exe
  C:\Windows\System\bYPUSLW.exe
  2⤵
  PID:4904
- C:\Windows\System\TOvsaLF.exe
  C:\Windows\System\TOvsaLF.exe
  2⤵
  PID:4920
- C:\Windows\System\oXVoPyQ.exe
  C:\Windows\System\oXVoPyQ.exe
  2⤵
  PID:4936
- C:\Windows\System\hdexvmD.exe
  C:\Windows\System\hdexvmD.exe
  2⤵
  PID:4952
- C:\Windows\System\qYfjXvC.exe
  C:\Windows\System\qYfjXvC.exe
  2⤵
  PID:4968
- C:\Windows\System\jGxXNiG.exe
  C:\Windows\System\jGxXNiG.exe
  2⤵
  PID:4984
- C:\Windows\System\xqbkGXT.exe
  C:\Windows\System\xqbkGXT.exe
  2⤵
  PID:5000
- C:\Windows\System\GebJvDP.exe
  C:\Windows\System\GebJvDP.exe
  2⤵
  PID:5016
- C:\Windows\System\HxOAsrq.exe
  C:\Windows\System\HxOAsrq.exe
  2⤵
  PID:5032
- C:\Windows\System\gIKHhKB.exe
  C:\Windows\System\gIKHhKB.exe
  2⤵
  PID:5052
- C:\Windows\System\olKaAgw.exe
  C:\Windows\System\olKaAgw.exe
  2⤵
  PID:5068
- C:\Windows\System\WCGeTDq.exe
  C:\Windows\System\WCGeTDq.exe
  2⤵
  PID:5084
- C:\Windows\System\UPNiCmV.exe
  C:\Windows\System\UPNiCmV.exe
  2⤵
  PID:5100
- C:\Windows\System\qQKcRjn.exe
  C:\Windows\System\qQKcRjn.exe
  2⤵
  PID:5116
- C:\Windows\System\ZccJGVX.exe
  C:\Windows\System\ZccJGVX.exe
  2⤵
  PID:3908
- C:\Windows\System\HAXsTka.exe
  C:\Windows\System\HAXsTka.exe
  2⤵
  PID:4020
- C:\Windows\System\moZZssI.exe
  C:\Windows\System\moZZssI.exe
  2⤵
  PID:3076
- C:\Windows\System\EwCoOPm.exe
  C:\Windows\System\EwCoOPm.exe
  2⤵
  PID:3580
- C:\Windows\System\bEinrcn.exe
  C:\Windows\System\bEinrcn.exe
  2⤵
  PID:3504
- C:\Windows\System\oUTlSyO.exe
  C:\Windows\System\oUTlSyO.exe
  2⤵
  PID:3536
- C:\Windows\System\yZOQNpj.exe
  C:\Windows\System\yZOQNpj.exe
  2⤵
  PID:4196
- C:\Windows\System\MngksBX.exe
  C:\Windows\System\MngksBX.exe
  2⤵
  PID:4216
- C:\Windows\System\CmPFIrt.exe
  C:\Windows\System\CmPFIrt.exe
  2⤵
  PID:3756
- C:\Windows\System\SJhPQiA.exe
  C:\Windows\System\SJhPQiA.exe
  2⤵
  PID:4192
- C:\Windows\System\ZUAotmt.exe
  C:\Windows\System\ZUAotmt.exe
  2⤵
  PID:4308
- C:\Windows\System\BNtgVzR.exe
  C:\Windows\System\BNtgVzR.exe
  2⤵
  PID:3932
- C:\Windows\System\vyjGNMr.exe
  C:\Windows\System\vyjGNMr.exe
  2⤵
  PID:4000
- C:\Windows\System\hsYKhFG.exe
  C:\Windows\System\hsYKhFG.exe
  2⤵
  PID:2652
- C:\Windows\System\IDowJaP.exe
  C:\Windows\System\IDowJaP.exe
  2⤵
  PID:3184
- C:\Windows\System\AEATZRp.exe
  C:\Windows\System\AEATZRp.exe
  2⤵
  PID:3420
- C:\Windows\System\GxUXfkB.exe
  C:\Windows\System\GxUXfkB.exe
  2⤵
  PID:4172
- C:\Windows\System\lWTRSsR.exe
  C:\Windows\System\lWTRSsR.exe
  2⤵
  PID:4404
- C:\Windows\System\PpoEsce.exe
  C:\Windows\System\PpoEsce.exe
  2⤵
  PID:4344
- C:\Windows\System\fdaFwJl.exe
  C:\Windows\System\fdaFwJl.exe
  2⤵
  PID:4372
- C:\Windows\System\ttSNKZu.exe
  C:\Windows\System\ttSNKZu.exe
  2⤵
  PID:3564
- C:\Windows\System\tDHhmhl.exe
  C:\Windows\System\tDHhmhl.exe
  2⤵
  PID:4124
- C:\Windows\System\oiOCqYb.exe
  C:\Windows\System\oiOCqYb.exe
  2⤵
  PID:4168
- C:\Windows\System\zJtgxXN.exe
  C:\Windows\System\zJtgxXN.exe
  2⤵
  PID:4536
- C:\Windows\System\trEMxlS.exe
  C:\Windows\System\trEMxlS.exe
  2⤵
  PID:4460
- C:\Windows\System\HthQTbV.exe
  C:\Windows\System\HthQTbV.exe
  2⤵
  PID:4296
- C:\Windows\System\ElcDvoN.exe
  C:\Windows\System\ElcDvoN.exe
  2⤵
  PID:4356
- C:\Windows\System\qCdKlqE.exe
  C:\Windows\System\qCdKlqE.exe
  2⤵
  PID:4424
- C:\Windows\System\bsaBGtH.exe
  C:\Windows\System\bsaBGtH.exe
  2⤵
  PID:4560
- C:\Windows\System\KKPdMwK.exe
  C:\Windows\System\KKPdMwK.exe
  2⤵
  PID:4492
- C:\Windows\System\ssBLiQf.exe
  C:\Windows\System\ssBLiQf.exe
  2⤵
  PID:4508
- C:\Windows\System\coDMNFS.exe
  C:\Windows\System\coDMNFS.exe
  2⤵
  PID:4532
- C:\Windows\System\MyHQzGx.exe
  C:\Windows\System\MyHQzGx.exe
  2⤵
  PID:4564
- C:\Windows\System\xXxSfiA.exe
  C:\Windows\System\xXxSfiA.exe
  2⤵
  PID:4592
- C:\Windows\System\vEXbQiR.exe
  C:\Windows\System\vEXbQiR.exe
  2⤵
  PID:4680
- C:\Windows\System\BLKIfvR.exe
  C:\Windows\System\BLKIfvR.exe
  2⤵
  PID:4624
- C:\Windows\System\QjyEUtp.exe
  C:\Windows\System\QjyEUtp.exe
  2⤵
  PID:4660
- C:\Windows\System\OOTTWLY.exe
  C:\Windows\System\OOTTWLY.exe
  2⤵
  PID:4700
- C:\Windows\System\tGwJqrM.exe
  C:\Windows\System\tGwJqrM.exe
  2⤵
  PID:4832
- C:\Windows\System\pXWkIoo.exe
  C:\Windows\System\pXWkIoo.exe
  2⤵
  PID:4860
- C:\Windows\System\AcXBSjX.exe
  C:\Windows\System\AcXBSjX.exe
  2⤵
  PID:4880
- C:\Windows\System\afKIldK.exe
  C:\Windows\System\afKIldK.exe
  2⤵
  PID:4960
- C:\Windows\System\DTxAIUj.exe
  C:\Windows\System\DTxAIUj.exe
  2⤵
  PID:5108
- C:\Windows\System\mJohBCF.exe
  C:\Windows\System\mJohBCF.exe
  2⤵
  PID:4944
- C:\Windows\System\GVvLqaT.exe
  C:\Windows\System\GVvLqaT.exe
  2⤵
  PID:5092
- C:\Windows\System\TxIxrtF.exe
  C:\Windows\System\TxIxrtF.exe
  2⤵
  PID:3716
- C:\Windows\System\oNlXXPo.exe
  C:\Windows\System\oNlXXPo.exe
  2⤵
  PID:3648
- C:\Windows\System\pBJCXup.exe
  C:\Windows\System\pBJCXup.exe
  2⤵
  PID:3692
- C:\Windows\System\xgmjGrR.exe
  C:\Windows\System\xgmjGrR.exe
  2⤵
  PID:4280
- C:\Windows\System\ObHhvlu.exe
  C:\Windows\System\ObHhvlu.exe
  2⤵
  PID:4036
- C:\Windows\System\vsSmZGQ.exe
  C:\Windows\System\vsSmZGQ.exe
  2⤵
  PID:4436
- C:\Windows\System\CZvLVam.exe
  C:\Windows\System\CZvLVam.exe
  2⤵
  PID:4524
- C:\Windows\System\KGjGuJJ.exe
  C:\Windows\System\KGjGuJJ.exe
  2⤵
  PID:4484
- C:\Windows\System\EtlEmuw.exe
  C:\Windows\System\EtlEmuw.exe
  2⤵
  PID:4340
- C:\Windows\System\qCqxQGq.exe
  C:\Windows\System\qCqxQGq.exe
  2⤵
  PID:4136
- C:\Windows\System\CvNrupo.exe
  C:\Windows\System\CvNrupo.exe
  2⤵
  PID:4328
- C:\Windows\System\uqNpgXm.exe
  C:\Windows\System\uqNpgXm.exe
  2⤵
  PID:4472
- C:\Windows\System\YRSsHAi.exe
  C:\Windows\System\YRSsHAi.exe
  2⤵
  PID:4504
- C:\Windows\System\rmrAQll.exe
  C:\Windows\System\rmrAQll.exe
  2⤵
  PID:4712
- C:\Windows\System\eKGnmKd.exe
  C:\Windows\System\eKGnmKd.exe
  2⤵
  PID:4748
- C:\Windows\System\DgkFmxY.exe
  C:\Windows\System\DgkFmxY.exe
  2⤵
  PID:4840
- C:\Windows\System\qUpSpGf.exe
  C:\Windows\System\qUpSpGf.exe
  2⤵
  PID:4816
- C:\Windows\System\jdMtBqh.exe
  C:\Windows\System\jdMtBqh.exe
  2⤵
  PID:4780
- C:\Windows\System\ifOXuZX.exe
  C:\Windows\System\ifOXuZX.exe
  2⤵
  PID:4932
- C:\Windows\System\QCZddMw.exe
  C:\Windows\System\QCZddMw.exe
  2⤵
  PID:4916
- C:\Windows\System\EFVjVxZ.exe
  C:\Windows\System\EFVjVxZ.exe
  2⤵
  PID:4980
- C:\Windows\System\MJbRejR.exe
  C:\Windows\System\MJbRejR.exe
  2⤵
  PID:5008
- C:\Windows\System\sVpYunA.exe
  C:\Windows\System\sVpYunA.exe
  2⤵
  PID:4080
- C:\Windows\System\ufmOIuv.exe
  C:\Windows\System\ufmOIuv.exe
  2⤵
  PID:4268
- C:\Windows\System\WSHzkzt.exe
  C:\Windows\System\WSHzkzt.exe
  2⤵
  PID:4016
- C:\Windows\System\ZblNOjc.exe
  C:\Windows\System\ZblNOjc.exe
  2⤵
  PID:3992
- C:\Windows\System\boioqlj.exe
  C:\Windows\System\boioqlj.exe
  2⤵
  PID:3236
- C:\Windows\System\wgvsLvh.exe
  C:\Windows\System\wgvsLvh.exe
  2⤵
  PID:3180
- C:\Windows\System\ajOwWdy.exe
  C:\Windows\System\ajOwWdy.exe
  2⤵
  PID:3812
- C:\Windows\System\uSoxvrz.exe
  C:\Windows\System\uSoxvrz.exe
  2⤵
  PID:4732
- C:\Windows\System\xmsnTYh.exe
  C:\Windows\System\xmsnTYh.exe
  2⤵
  PID:4312
- C:\Windows\System\omoKutE.exe
  C:\Windows\System\omoKutE.exe
  2⤵
  PID:4760
- C:\Windows\System\rWOImET.exe
  C:\Windows\System\rWOImET.exe
  2⤵
  PID:3364
- C:\Windows\System\AZdnKgL.exe
  C:\Windows\System\AZdnKgL.exe
  2⤵
  PID:4132
- C:\Windows\System\NYrPTic.exe
  C:\Windows\System\NYrPTic.exe
  2⤵
  PID:4608
- C:\Windows\System\PSsDUMm.exe
  C:\Windows\System\PSsDUMm.exe
  2⤵
  PID:4900
- C:\Windows\System\GebawVD.exe
  C:\Windows\System\GebawVD.exe
  2⤵
  PID:5096
- C:\Windows\System\iRgQKdJ.exe
  C:\Windows\System\iRgQKdJ.exe
  2⤵
  PID:4776
- C:\Windows\System\JDtqbjU.exe
  C:\Windows\System\JDtqbjU.exe
  2⤵
  PID:4156
- C:\Windows\System\nPSHCQS.exe
  C:\Windows\System\nPSHCQS.exe
  2⤵
  PID:3964
- C:\Windows\System\sydvmOW.exe
  C:\Windows\System\sydvmOW.exe
  2⤵
  PID:3092
- C:\Windows\System\ICHxbSL.exe
  C:\Windows\System\ICHxbSL.exe
  2⤵
  PID:3140
- C:\Windows\System\AnZqxkd.exe
  C:\Windows\System\AnZqxkd.exe
  2⤵
  PID:5064
- C:\Windows\System\mhMIQcP.exe
  C:\Windows\System\mhMIQcP.exe
  2⤵
  PID:4112
- C:\Windows\System\LIKrOtZ.exe
  C:\Windows\System\LIKrOtZ.exe
  2⤵
  PID:4500
- C:\Windows\System\YRsblyc.exe
  C:\Windows\System\YRsblyc.exe
  2⤵
  PID:4644
- C:\Windows\System\qIZyEOZ.exe
  C:\Windows\System\qIZyEOZ.exe
  2⤵
  PID:3524
- C:\Windows\System\AgBVkbl.exe
  C:\Windows\System\AgBVkbl.exe
  2⤵
  PID:5060
- C:\Windows\System\ksDelVx.exe
  C:\Windows\System\ksDelVx.exe
  2⤵
  PID:3468
- C:\Windows\System\hCnsTuH.exe
  C:\Windows\System\hCnsTuH.exe
  2⤵
  PID:3832
- C:\Windows\System\YWjrvfd.exe
  C:\Windows\System\YWjrvfd.exe
  2⤵
  PID:5112
- C:\Windows\System\ZXENIWr.exe
  C:\Windows\System\ZXENIWr.exe
  2⤵
  PID:4664
- C:\Windows\System\xmUDgmG.exe
  C:\Windows\System\xmUDgmG.exe
  2⤵
  PID:4148
- C:\Windows\System\nGOYVLc.exe
  C:\Windows\System\nGOYVLc.exe
  2⤵
  PID:3500
- C:\Windows\System\cGOgrSj.exe
  C:\Windows\System\cGOgrSj.exe
  2⤵
  PID:5124
- C:\Windows\System\zhByeLl.exe
  C:\Windows\System\zhByeLl.exe
  2⤵
  PID:5292
- C:\Windows\System\ooGshUC.exe
  C:\Windows\System\ooGshUC.exe
  2⤵
  PID:5308
- C:\Windows\System\DvhRPAc.exe
  C:\Windows\System\DvhRPAc.exe
  2⤵
  PID:5324
- C:\Windows\System\iVAuFWm.exe
  C:\Windows\System\iVAuFWm.exe
  2⤵
  PID:5340
- C:\Windows\System\xTVriuX.exe
  C:\Windows\System\xTVriuX.exe
  2⤵
  PID:5356
- C:\Windows\System\ytnqldx.exe
  C:\Windows\System\ytnqldx.exe
  2⤵
  PID:5372
- C:\Windows\System\sIgNrpJ.exe
  C:\Windows\System\sIgNrpJ.exe
  2⤵
  PID:5388
- C:\Windows\System\rqQQtId.exe
  C:\Windows\System\rqQQtId.exe
  2⤵
  PID:5476
- C:\Windows\System\yWZtSoa.exe
  C:\Windows\System\yWZtSoa.exe
  2⤵
  PID:5512
- C:\Windows\System\ANHoiGg.exe
  C:\Windows\System\ANHoiGg.exe
  2⤵
  PID:5672
- C:\Windows\System\eSvOWak.exe
  C:\Windows\System\eSvOWak.exe
  2⤵
  PID:5688
- C:\Windows\System\rwXxSnT.exe
  C:\Windows\System\rwXxSnT.exe
  2⤵
  PID:5704
- C:\Windows\System\vguTJAL.exe
  C:\Windows\System\vguTJAL.exe
  2⤵
  PID:5720
- C:\Windows\System\rRslpVy.exe
  C:\Windows\System\rRslpVy.exe
  2⤵
  PID:5736
- C:\Windows\System\oRewzpw.exe
  C:\Windows\System\oRewzpw.exe
  2⤵
  PID:5752
- C:\Windows\System\cRomlkI.exe
  C:\Windows\System\cRomlkI.exe
  2⤵
  PID:5780
- C:\Windows\System\Evbkncl.exe
  C:\Windows\System\Evbkncl.exe
  2⤵
  PID:5796
- C:\Windows\System\MzWZjnS.exe
  C:\Windows\System\MzWZjnS.exe
  2⤵
  PID:5816
- C:\Windows\System\hYlLPHB.exe
  C:\Windows\System\hYlLPHB.exe
  2⤵
  PID:5872
- C:\Windows\System\pOmPFvf.exe
  C:\Windows\System\pOmPFvf.exe
  2⤵
  PID:5892
- C:\Windows\System\uNHzzYJ.exe
  C:\Windows\System\uNHzzYJ.exe
  2⤵
  PID:5908
- C:\Windows\System\ckHPXcn.exe
  C:\Windows\System\ckHPXcn.exe
  2⤵
  PID:5932
- C:\Windows\System\HGtMTvg.exe
  C:\Windows\System\HGtMTvg.exe
  2⤵
  PID:5948
- C:\Windows\System\zwGXPDv.exe
  C:\Windows\System\zwGXPDv.exe
  2⤵
  PID:5964
- C:\Windows\System\DAPurdN.exe
  C:\Windows\System\DAPurdN.exe
  2⤵
  PID:5984
- C:\Windows\System\qbZtypY.exe
  C:\Windows\System\qbZtypY.exe
  2⤵
  PID:6000
- C:\Windows\System\tQqWkpK.exe
  C:\Windows\System\tQqWkpK.exe
  2⤵
  PID:6016
- C:\Windows\System\bZoGtca.exe
  C:\Windows\System\bZoGtca.exe
  2⤵
  PID:6036
- C:\Windows\System\azdrcBP.exe
  C:\Windows\System\azdrcBP.exe
  2⤵
  PID:6056
- C:\Windows\System\EPeXOxG.exe
  C:\Windows\System\EPeXOxG.exe
  2⤵
  PID:6092
- C:\Windows\System\vAsEWWG.exe
  C:\Windows\System\vAsEWWG.exe
  2⤵
  PID:6108
- C:\Windows\System\yfjyfBJ.exe
  C:\Windows\System\yfjyfBJ.exe
  2⤵
  PID:6128
- C:\Windows\System\xoQoDsy.exe
  C:\Windows\System\xoQoDsy.exe
  2⤵
  PID:4964
- C:\Windows\System\ETYHRRL.exe
  C:\Windows\System\ETYHRRL.exe
  2⤵
  PID:4868
- C:\Windows\System\PRMEjOT.exe
  C:\Windows\System\PRMEjOT.exe
  2⤵
  PID:4696
- C:\Windows\System\meBcuqo.exe
  C:\Windows\System\meBcuqo.exe
  2⤵
  PID:4716
- C:\Windows\System\AeuQMKb.exe
  C:\Windows\System\AeuQMKb.exe
  2⤵
  PID:5148
- C:\Windows\System\wxqfNKb.exe
  C:\Windows\System\wxqfNKb.exe
  2⤵
  PID:5404
- C:\Windows\System\vCltcEB.exe
  C:\Windows\System\vCltcEB.exe
  2⤵
  PID:5468
- C:\Windows\System\TDjKjfG.exe
  C:\Windows\System\TDjKjfG.exe
  2⤵
  PID:5208
- C:\Windows\System\OQPeyZN.exe
  C:\Windows\System\OQPeyZN.exe
  2⤵
  PID:5176
- C:\Windows\System\qzihlgI.exe
  C:\Windows\System\qzihlgI.exe
  2⤵
  PID:5224
- C:\Windows\System\IuuvjBo.exe
  C:\Windows\System\IuuvjBo.exe
  2⤵
  PID:5240
- C:\Windows\System\LSzuwYS.exe
  C:\Windows\System\LSzuwYS.exe
  2⤵
  PID:5276
- C:\Windows\System\mXPwNqk.exe
  C:\Windows\System\mXPwNqk.exe
  2⤵
  PID:5136
- C:\Windows\System\nBWZPda.exe
  C:\Windows\System\nBWZPda.exe
  2⤵
  PID:5380
- C:\Windows\System\ZIJzzaQ.exe
  C:\Windows\System\ZIJzzaQ.exe
  2⤵
  PID:5260
- C:\Windows\System\GYTMDMh.exe
  C:\Windows\System\GYTMDMh.exe
  2⤵
  PID:5508
- C:\Windows\System\NWAElvG.exe
  C:\Windows\System\NWAElvG.exe
  2⤵
  PID:5528
- C:\Windows\System\kHpsxKL.exe
  C:\Windows\System\kHpsxKL.exe
  2⤵
  PID:5620
- C:\Windows\System\ueQKuKg.exe
  C:\Windows\System\ueQKuKg.exe
  2⤵
  PID:5648
- C:\Windows\System\pTAXIMa.exe
  C:\Windows\System\pTAXIMa.exe
  2⤵
  PID:5664
- C:\Windows\System\FzvIXtt.exe
  C:\Windows\System\FzvIXtt.exe
  2⤵
  PID:5712
- C:\Windows\System\ZHIHMZO.exe
  C:\Windows\System\ZHIHMZO.exe
  2⤵
  PID:5788
- C:\Windows\System\IEOqtRn.exe
  C:\Windows\System\IEOqtRn.exe
  2⤵
  PID:5792
- C:\Windows\System\EjtDjBM.exe
  C:\Windows\System\EjtDjBM.exe
  2⤵
  PID:5840
- C:\Windows\System\uutAkOr.exe
  C:\Windows\System\uutAkOr.exe
  2⤵
  PID:5812
- C:\Windows\System\bhszleI.exe
  C:\Windows\System\bhszleI.exe
  2⤵
  PID:5900
- C:\Windows\System\MBphQSG.exe
  C:\Windows\System\MBphQSG.exe
  2⤵
  PID:5972
- C:\Windows\System\CnoJEug.exe
  C:\Windows\System\CnoJEug.exe
  2⤵
  PID:6012
- C:\Windows\System\oVsEGYm.exe
  C:\Windows\System\oVsEGYm.exe
  2⤵
  PID:5764
- C:\Windows\System\kmIabYm.exe
  C:\Windows\System\kmIabYm.exe
  2⤵
  PID:5920
- C:\Windows\System\krbpxQv.exe
  C:\Windows\System\krbpxQv.exe
  2⤵
  PID:6140
- C:\Windows\System\uySMhXC.exe
  C:\Windows\System\uySMhXC.exe
  2⤵
  PID:4744
- C:\Windows\System\CJmYDxY.exe
  C:\Windows\System\CJmYDxY.exe
  2⤵
  PID:5452
- C:\Windows\System\LDGwQuA.exe
  C:\Windows\System\LDGwQuA.exe
  2⤵
  PID:5184
- C:\Windows\System\wrSGFCF.exe
  C:\Windows\System\wrSGFCF.exe
  2⤵
  PID:5288
- C:\Windows\System\nsMjERA.exe
  C:\Windows\System\nsMjERA.exe
  2⤵
  PID:5188
- C:\Windows\System\BXjqDbM.exe
  C:\Windows\System\BXjqDbM.exe
  2⤵
  PID:5880
- C:\Windows\System\mbMWmDK.exe
  C:\Windows\System\mbMWmDK.exe
  2⤵
  PID:5928
- C:\Windows\System\qQYhdCP.exe
  C:\Windows\System\qQYhdCP.exe
  2⤵
  PID:5572
- C:\Windows\System\DsGJzgb.exe
  C:\Windows\System\DsGJzgb.exe
  2⤵
  PID:5856
- C:\Windows\System\ixxStLA.exe
  C:\Windows\System\ixxStLA.exe
  2⤵
  PID:5808
- C:\Windows\System\dHYjNAW.exe
  C:\Windows\System\dHYjNAW.exe
  2⤵
  PID:6104
- C:\Windows\System\WkYjFLK.exe
  C:\Windows\System\WkYjFLK.exe
  2⤵
  PID:5220
- C:\Windows\System\alGMhNJ.exe
  C:\Windows\System\alGMhNJ.exe
  2⤵
  PID:6100
- C:\Windows\System\YRVlpHq.exe
  C:\Windows\System\YRVlpHq.exe
  2⤵
  PID:5632
- C:\Windows\System\SvlmZQc.exe
  C:\Windows\System\SvlmZQc.exe
  2⤵
  PID:6152
- C:\Windows\System\txxAvwd.exe
  C:\Windows\System\txxAvwd.exe
  2⤵
  PID:6172
- C:\Windows\System\ogknBzo.exe
  C:\Windows\System\ogknBzo.exe
  2⤵
  PID:6188
- C:\Windows\System\jOAsPwZ.exe
  C:\Windows\System\jOAsPwZ.exe
  2⤵
  PID:6204
- C:\Windows\System\ILFqvzq.exe
  C:\Windows\System\ILFqvzq.exe
  2⤵
  PID:6224
- C:\Windows\System\LGITRSF.exe
  C:\Windows\System\LGITRSF.exe
  2⤵
  PID:6244
- C:\Windows\System\NPGmfmB.exe
  C:\Windows\System\NPGmfmB.exe
  2⤵
  PID:6268
- C:\Windows\System\MiBTbgf.exe
  C:\Windows\System\MiBTbgf.exe
  2⤵
  PID:6288
- C:\Windows\System\LbJgkNO.exe
  C:\Windows\System\LbJgkNO.exe
  2⤵
  PID:6308
- C:\Windows\System\XXeLFyj.exe
  C:\Windows\System\XXeLFyj.exe
  2⤵
  PID:6328
- C:\Windows\System\WjaZIfb.exe
  C:\Windows\System\WjaZIfb.exe
  2⤵
  PID:6344
- C:\Windows\System\bfULjFZ.exe
  C:\Windows\System\bfULjFZ.exe
  2⤵
  PID:6360
- C:\Windows\System\HlTwVUQ.exe
  C:\Windows\System\HlTwVUQ.exe
  2⤵
  PID:6376
- C:\Windows\System\ZiIczBm.exe
  C:\Windows\System\ZiIczBm.exe
  2⤵
  PID:6392
- C:\Windows\System\VwMnvqp.exe
  C:\Windows\System\VwMnvqp.exe
  2⤵
  PID:6408
- C:\Windows\System\Xtlaoww.exe
  C:\Windows\System\Xtlaoww.exe
  2⤵
  PID:6424
- C:\Windows\System\iBXJlOh.exe
  C:\Windows\System\iBXJlOh.exe
  2⤵
  PID:6440
- C:\Windows\System\SxxOtpu.exe
  C:\Windows\System\SxxOtpu.exe
  2⤵
  PID:6456
- C:\Windows\System\PwpJYJz.exe
  C:\Windows\System\PwpJYJz.exe
  2⤵
  PID:6492
- C:\Windows\System\igTVtql.exe
  C:\Windows\System\igTVtql.exe
  2⤵
  PID:6512
- C:\Windows\System\QpfTxTw.exe
  C:\Windows\System\QpfTxTw.exe
  2⤵
  PID:6528
- C:\Windows\System\YInQhEb.exe
  C:\Windows\System\YInQhEb.exe
  2⤵
  PID:6544
- C:\Windows\System\GbxPwvM.exe
  C:\Windows\System\GbxPwvM.exe
  2⤵
  PID:6564
- C:\Windows\System\XAGOteX.exe
  C:\Windows\System\XAGOteX.exe
  2⤵
  PID:6580
- C:\Windows\System\RrjbgNV.exe
  C:\Windows\System\RrjbgNV.exe
  2⤵
  PID:6596
- C:\Windows\System\MFElHie.exe
  C:\Windows\System\MFElHie.exe
  2⤵
  PID:6616
- C:\Windows\System\UACTikB.exe
  C:\Windows\System\UACTikB.exe
  2⤵
  PID:6632
- C:\Windows\System\JlPAcuZ.exe
  C:\Windows\System\JlPAcuZ.exe
  2⤵
  PID:6648
- C:\Windows\System\NuEaKTo.exe
  C:\Windows\System\NuEaKTo.exe
  2⤵
  PID:6664
- C:\Windows\System\CUPZAnL.exe
  C:\Windows\System\CUPZAnL.exe
  2⤵
  PID:6680
- C:\Windows\System\CiNkoBk.exe
  C:\Windows\System\CiNkoBk.exe
  2⤵
  PID:6696
- C:\Windows\System\svymgrA.exe
  C:\Windows\System\svymgrA.exe
  2⤵
  PID:6716
- C:\Windows\System\KtFoSLz.exe
  C:\Windows\System\KtFoSLz.exe
  2⤵
  PID:6732
- C:\Windows\System\spdlire.exe
  C:\Windows\System\spdlire.exe
  2⤵
  PID:6964
- C:\Windows\System\eyBHYGj.exe
  C:\Windows\System\eyBHYGj.exe
  2⤵
  PID:6984
- C:\Windows\System\hwoIKia.exe
  C:\Windows\System\hwoIKia.exe
  2⤵
  PID:7000
- C:\Windows\System\QKWgyvD.exe
  C:\Windows\System\QKWgyvD.exe
  2⤵
  PID:7024
- C:\Windows\System\PbkpJpL.exe
  C:\Windows\System\PbkpJpL.exe
  2⤵
  PID:7040
- C:\Windows\System\nyMHRld.exe
  C:\Windows\System\nyMHRld.exe
  2⤵
  PID:7056
- C:\Windows\System\DFXSDYS.exe
  C:\Windows\System\DFXSDYS.exe
  2⤵
  PID:7076
- C:\Windows\System\ZixQIfK.exe
  C:\Windows\System\ZixQIfK.exe
  2⤵
  PID:7092
- C:\Windows\System\dFZwcba.exe
  C:\Windows\System\dFZwcba.exe
  2⤵
  PID:7108
- C:\Windows\System\FtcFPxM.exe
  C:\Windows\System\FtcFPxM.exe
  2⤵
  PID:7128
- C:\Windows\System\tWXezQp.exe
  C:\Windows\System\tWXezQp.exe
  2⤵
  PID:7144
- C:\Windows\System\GrXXYEu.exe
  C:\Windows\System\GrXXYEu.exe
  2⤵
  PID:5884
- C:\Windows\System\RgHYqUC.exe
  C:\Windows\System\RgHYqUC.exe
  2⤵
  PID:5140
- C:\Windows\System\oGyqzpj.exe
  C:\Windows\System\oGyqzpj.exe
  2⤵
  PID:5300
- C:\Windows\System\KbQTIYD.exe
  C:\Windows\System\KbQTIYD.exe
  2⤵
  PID:5368
- C:\Windows\System\layGRRH.exe
  C:\Windows\System\layGRRH.exe
  2⤵
  PID:6068
- C:\Windows\System\ORKFndl.exe
  C:\Windows\System\ORKFndl.exe
  2⤵
  PID:5492
- C:\Windows\System\WZOGCaf.exe
  C:\Windows\System\WZOGCaf.exe
  2⤵
  PID:4800
- C:\Windows\System\rggVeki.exe
  C:\Windows\System\rggVeki.exe
  2⤵
  PID:6740
- C:\Windows\System\zFQPRfl.exe
  C:\Windows\System\zFQPRfl.exe
  2⤵
  PID:6724
- C:\Windows\System\YXWpTzc.exe
  C:\Windows\System\YXWpTzc.exe
  2⤵
  PID:6052
- C:\Windows\System\GqRPagS.exe
  C:\Windows\System\GqRPagS.exe
  2⤵
  PID:6136
- C:\Windows\System\HfEuYDi.exe
  C:\Windows\System\HfEuYDi.exe
  2⤵
  PID:6220
- C:\Windows\System\YZEefLt.exe
  C:\Windows\System\YZEefLt.exe
  2⤵
  PID:6300
- C:\Windows\System\QtZwSPw.exe
  C:\Windows\System\QtZwSPw.exe
  2⤵
  PID:6388
- C:\Windows\System\hVZiVvH.exe
  C:\Windows\System\hVZiVvH.exe
  2⤵
  PID:6452
- C:\Windows\System\mnaZftG.exe
  C:\Windows\System\mnaZftG.exe
  2⤵
  PID:6540
- C:\Windows\System\SbWVCpc.exe
  C:\Windows\System\SbWVCpc.exe
  2⤵
  PID:6608
- C:\Windows\System\qVghFze.exe
  C:\Windows\System\qVghFze.exe
  2⤵
  PID:6372
- C:\Windows\System\FFDuSyG.exe
  C:\Windows\System\FFDuSyG.exe
  2⤵
  PID:6436
- C:\Windows\System\cGIgGNK.exe
  C:\Windows\System\cGIgGNK.exe
  2⤵
  PID:6476
- C:\Windows\System\FxuccJQ.exe
  C:\Windows\System\FxuccJQ.exe
  2⤵
  PID:6556
- C:\Windows\System\bLpsOnt.exe
  C:\Windows\System\bLpsOnt.exe
  2⤵
  PID:6708
- C:\Windows\System\rkHlGph.exe
  C:\Windows\System\rkHlGph.exe
  2⤵
  PID:7088
- C:\Windows\System\KrakmDN.exe
  C:\Windows\System\KrakmDN.exe
  2⤵
  PID:6780
- C:\Windows\System\NJVmWQS.exe
  C:\Windows\System\NJVmWQS.exe
  2⤵
  PID:6796
- C:\Windows\System\fAqENPK.exe
  C:\Windows\System\fAqENPK.exe
  2⤵
  PID:6820
- C:\Windows\System\VOKkzNz.exe
  C:\Windows\System\VOKkzNz.exe
  2⤵
  PID:6844
- C:\Windows\System\ZqSXgny.exe
  C:\Windows\System\ZqSXgny.exe
  2⤵
  PID:6860
- C:\Windows\System\NiyxSYm.exe
  C:\Windows\System\NiyxSYm.exe
  2⤵
  PID:6880
- C:\Windows\System\krUUWAR.exe
  C:\Windows\System\krUUWAR.exe
  2⤵
  PID:6900
- C:\Windows\System\kFxLjAo.exe
  C:\Windows\System\kFxLjAo.exe
  2⤵
  PID:6920
- C:\Windows\System\EEHWxGl.exe
  C:\Windows\System\EEHWxGl.exe
  2⤵
  PID:6824
- C:\Windows\System\RQjqCkY.exe
  C:\Windows\System\RQjqCkY.exe
  2⤵
  PID:6952
- C:\Windows\System\sRFHHET.exe
  C:\Windows\System\sRFHHET.exe
  2⤵
  PID:7100
- C:\Windows\System\jGxMsBD.exe
  C:\Windows\System\jGxMsBD.exe
  2⤵
  PID:6908
- C:\Windows\System\OblXRhu.exe
  C:\Windows\System\OblXRhu.exe
  2⤵
  PID:7016
- C:\Windows\System\jPgHQVV.exe
  C:\Windows\System\jPgHQVV.exe
  2⤵
  PID:7124
- C:\Windows\System\WJtwGIS.exe
  C:\Windows\System\WJtwGIS.exe
  2⤵
  PID:5500
- C:\Windows\System\HiOBmMf.exe
  C:\Windows\System\HiOBmMf.exe
  2⤵
  PID:5552
- C:\Windows\System\WdselRL.exe
  C:\Windows\System\WdselRL.exe
  2⤵
  PID:5196
- C:\Windows\System\weAtzcJ.exe
  C:\Windows\System\weAtzcJ.exe
  2⤵
  PID:5440
- C:\Windows\System\TaVBzIJ.exe
  C:\Windows\System\TaVBzIJ.exe
  2⤵
  PID:6256
- C:\Windows\System\HWYgtww.exe
  C:\Windows\System\HWYgtww.exe
  2⤵
  PID:7084
- C:\Windows\System\hiNxmdJ.exe
  C:\Windows\System\hiNxmdJ.exe
  2⤵
  PID:7064
- C:\Windows\System\EFLrcik.exe
  C:\Windows\System\EFLrcik.exe
  2⤵
  PID:6976
- C:\Windows\System\fRcbCrE.exe
  C:\Windows\System\fRcbCrE.exe
  2⤵
  PID:5400
- C:\Windows\System\kWcZHrq.exe
  C:\Windows\System\kWcZHrq.exe
  2⤵
  PID:5592
- C:\Windows\System\MfZqlqs.exe
  C:\Windows\System\MfZqlqs.exe
  2⤵
  PID:5612
- C:\Windows\System\UjPprbo.exe
  C:\Windows\System\UjPprbo.exe
  2⤵
  PID:6008
- C:\Windows\System\WRjvfTf.exe
  C:\Windows\System\WRjvfTf.exe
  2⤵
  PID:7156
- C:\Windows\System\eRtamzx.exe
  C:\Windows\System\eRtamzx.exe
  2⤵
  PID:5844
- C:\Windows\System\xsRKveN.exe
  C:\Windows\System\xsRKveN.exe
  2⤵
  PID:5996
- C:\Windows\System\Xtcdzzq.exe
  C:\Windows\System\Xtcdzzq.exe
  2⤵
  PID:6064
- C:\Windows\System\kgFmVso.exe
  C:\Windows\System\kgFmVso.exe
  2⤵
  PID:5364
- C:\Windows\System\sHCkhfI.exe
  C:\Windows\System\sHCkhfI.exe
  2⤵
  PID:5172
- C:\Windows\System\gkezyGF.exe
  C:\Windows\System\gkezyGF.exe
  2⤵
  PID:5556
- C:\Windows\System\FDtwCoX.exe
  C:\Windows\System\FDtwCoX.exe
  2⤵
  PID:5580
- C:\Windows\System\jvQURRb.exe
  C:\Windows\System\jvQURRb.exe
  2⤵
  PID:5616
- C:\Windows\System\KqhzNmp.exe
  C:\Windows\System\KqhzNmp.exe
  2⤵
  PID:5544
- C:\Windows\System\PfhtwlY.exe
  C:\Windows\System\PfhtwlY.exe
  2⤵
  PID:5768
- C:\Windows\System\MpmyMYn.exe
  C:\Windows\System\MpmyMYn.exe
  2⤵
  PID:5472
- C:\Windows\System\GbuqOdE.exe
  C:\Windows\System\GbuqOdE.exe
  2⤵
  PID:5640
- C:\Windows\System\ETfEQor.exe
  C:\Windows\System\ETfEQor.exe
  2⤵
  PID:6356
- C:\Windows\System\YQiXxDr.exe
  C:\Windows\System\YQiXxDr.exe
  2⤵
  PID:6552
- C:\Windows\System\qMTvBhc.exe
  C:\Windows\System\qMTvBhc.exe
  2⤵
  PID:6692
- C:\Windows\System\WmIXYHc.exe
  C:\Windows\System\WmIXYHc.exe
  2⤵
  PID:6892
- C:\Windows\System\uOqCdHZ.exe
  C:\Windows\System\uOqCdHZ.exe
  2⤵
  PID:5464
- C:\Windows\System\qhIwrWm.exe
  C:\Windows\System\qhIwrWm.exe
  2⤵
  PID:6216
- C:\Windows\System\iiRbNXq.exe
  C:\Windows\System\iiRbNXq.exe
  2⤵
  PID:6508
- C:\Windows\System\whOEEGD.exe
  C:\Windows\System\whOEEGD.exe
  2⤵
  PID:6972
- C:\Windows\System\VFpspva.exe
  C:\Windows\System\VFpspva.exe
  2⤵
  PID:6928
- C:\Windows\System\oUAdTKI.exe
  C:\Windows\System\oUAdTKI.exe
  2⤵
  PID:6240
- C:\Windows\System\nMLtoZq.exe
  C:\Windows\System\nMLtoZq.exe
  2⤵
  PID:5588
- C:\Windows\System\PMqcWWJ.exe
  C:\Windows\System\PMqcWWJ.exe
  2⤵
  PID:5696
- C:\Windows\System\FWQKXjk.exe
  C:\Windows\System\FWQKXjk.exe
  2⤵
  PID:6028
- C:\Windows\System\ccAPuhX.exe
  C:\Windows\System\ccAPuhX.exe
  2⤵
  PID:6592
- C:\Windows\System\ZkfTFtm.exe
  C:\Windows\System\ZkfTFtm.exe
  2⤵
  PID:6076
- C:\Windows\System\mEwiOth.exe
  C:\Windows\System\mEwiOth.exe
  2⤵
  PID:5944
- C:\Windows\System\GvrxkjZ.exe
  C:\Windows\System\GvrxkjZ.exe
  2⤵
  PID:7052
- C:\Windows\System\EKpNHkX.exe
  C:\Windows\System\EKpNHkX.exe
  2⤵
  PID:6164
- C:\Windows\System\ABWipje.exe
  C:\Windows\System\ABWipje.exe
  2⤵
  PID:6940
- C:\Windows\System\nfQsuob.exe
  C:\Windows\System\nfQsuob.exe
  2⤵
  PID:7140
- C:\Windows\System\tCmXFog.exe
  C:\Windows\System\tCmXFog.exe
  2⤵
  PID:2752
- C:\Windows\System\qniALVl.exe
  C:\Windows\System\qniALVl.exe
  2⤵
  PID:3024
- C:\Windows\System\RzTXFQJ.exe
  C:\Windows\System\RzTXFQJ.exe
  2⤵
  PID:2468
- C:\Windows\System\FTySnjt.exe
  C:\Windows\System\FTySnjt.exe
  2⤵
  PID:6088
- C:\Windows\System\NwGMwlo.exe
  C:\Windows\System\NwGMwlo.exe
  2⤵
  PID:6368
- C:\Windows\System\XyqarmM.exe
  C:\Windows\System\XyqarmM.exe
  2⤵
  PID:6808
- C:\Windows\System\GpXxDRC.exe
  C:\Windows\System\GpXxDRC.exe
  2⤵
  PID:7072
- C:\Windows\System\qTIBNLt.exe
  C:\Windows\System\qTIBNLt.exe
  2⤵
  PID:7220
- C:\Windows\System\SspxWsc.exe
  C:\Windows\System\SspxWsc.exe
  2⤵
  PID:7236
- C:\Windows\System\hOyEdTH.exe
  C:\Windows\System\hOyEdTH.exe
  2⤵
  PID:7252
- C:\Windows\System\atmIEeU.exe
  C:\Windows\System\atmIEeU.exe
  2⤵
  PID:7268
- C:\Windows\System\aZDJZnj.exe
  C:\Windows\System\aZDJZnj.exe
  2⤵
  PID:7284
- C:\Windows\System\tcEnGov.exe
  C:\Windows\System\tcEnGov.exe
  2⤵
  PID:7300
- C:\Windows\System\RDXhKXs.exe
  C:\Windows\System\RDXhKXs.exe
  2⤵
  PID:7316
- C:\Windows\System\fakKrfA.exe
  C:\Windows\System\fakKrfA.exe
  2⤵
  PID:7332
- C:\Windows\System\egekAJh.exe
  C:\Windows\System\egekAJh.exe
  2⤵
  PID:7348
- C:\Windows\System\ymwQLAp.exe
  C:\Windows\System\ymwQLAp.exe
  2⤵
  PID:7476
- C:\Windows\System\oBAYmMV.exe
  C:\Windows\System\oBAYmMV.exe
  2⤵
  PID:7492
- C:\Windows\System\CJUPXvj.exe
  C:\Windows\System\CJUPXvj.exe
  2⤵
  PID:7508
- C:\Windows\System\biCEOfa.exe
  C:\Windows\System\biCEOfa.exe
  2⤵
  PID:7528
- C:\Windows\System\FoPPNws.exe
  C:\Windows\System\FoPPNws.exe
  2⤵
  PID:7544
- C:\Windows\System\fFXdYTZ.exe
  C:\Windows\System\fFXdYTZ.exe
  2⤵
  PID:7560
- C:\Windows\System\IVWPsCW.exe
  C:\Windows\System\IVWPsCW.exe
  2⤵
  PID:7576
- C:\Windows\System\chvXraJ.exe
  C:\Windows\System\chvXraJ.exe
  2⤵
  PID:7592
- C:\Windows\System\wWLtRJP.exe
  C:\Windows\System\wWLtRJP.exe
  2⤵
  PID:7608
- C:\Windows\System\GkjsMqQ.exe
  C:\Windows\System\GkjsMqQ.exe
  2⤵
  PID:7624
- C:\Windows\System\uwqlUBJ.exe
  C:\Windows\System\uwqlUBJ.exe
  2⤵
  PID:7640
- C:\Windows\System\OvyZaFk.exe
  C:\Windows\System\OvyZaFk.exe
  2⤵
  PID:7656
- C:\Windows\System\ifxgcJY.exe
  C:\Windows\System\ifxgcJY.exe
  2⤵
  PID:7672
- C:\Windows\System\vgpqNrL.exe
  C:\Windows\System\vgpqNrL.exe
  2⤵
  PID:7688
- C:\Windows\System\pbzzCiH.exe
  C:\Windows\System\pbzzCiH.exe
  2⤵
  PID:7704
- C:\Windows\System\VTrXyaV.exe
  C:\Windows\System\VTrXyaV.exe
  2⤵
  PID:7720
- C:\Windows\System\eNCqLJK.exe
  C:\Windows\System\eNCqLJK.exe
  2⤵
  PID:7864
- C:\Windows\System\NtHfquw.exe
  C:\Windows\System\NtHfquw.exe
  2⤵
  PID:7964
- C:\Windows\System\HtmHfBO.exe
  C:\Windows\System\HtmHfBO.exe
  2⤵
  PID:7980
- C:\Windows\System\ZJASFmy.exe
  C:\Windows\System\ZJASFmy.exe
  2⤵
  PID:8032
- C:\Windows\System\dJDJril.exe
  C:\Windows\System\dJDJril.exe
  2⤵
  PID:8144
- C:\Windows\System\ZyVtldM.exe
  C:\Windows\System\ZyVtldM.exe
  2⤵
  PID:8172
- C:\Windows\System\rrerxRn.exe
  C:\Windows\System\rrerxRn.exe
  2⤵
  PID:8188
- C:\Windows\System\pAkUlIx.exe
  C:\Windows\System\pAkUlIx.exe
  2⤵
  PID:6196
- C:\Windows\System\xctyXDo.exe
  C:\Windows\System\xctyXDo.exe
  2⤵
  PID:5028
- C:\Windows\System\easlmAj.exe
  C:\Windows\System\easlmAj.exe
  2⤵
  PID:6768
- C:\Windows\System\OZyiQCB.exe
  C:\Windows\System\OZyiQCB.exe
  2⤵
  PID:6572
- C:\Windows\System\INgGisC.exe
  C:\Windows\System\INgGisC.exe
  2⤵
  PID:6744
- C:\Windows\System\OKqRdVq.exe
  C:\Windows\System\OKqRdVq.exe
  2⤵
  PID:6184
- C:\Windows\System\MEvIxqw.exe
  C:\Windows\System\MEvIxqw.exe
  2⤵
  PID:6124
- C:\Windows\System\LDVxIbd.exe
  C:\Windows\System\LDVxIbd.exe
  2⤵
  PID:5868
- C:\Windows\System\MFhAvBv.exe
  C:\Windows\System\MFhAvBv.exe
  2⤵
  PID:5332
- C:\Windows\System\lBkNqSr.exe
  C:\Windows\System\lBkNqSr.exe
  2⤵
  PID:7260
- C:\Windows\System\WTvOzKz.exe
  C:\Windows\System\WTvOzKz.exe
  2⤵
  PID:2704
- C:\Windows\System\kKThBwf.exe
  C:\Windows\System\kKThBwf.exe
  2⤵
  PID:7384
- C:\Windows\System\zYMKTPI.exe
  C:\Windows\System\zYMKTPI.exe
  2⤵
  PID:7364
- C:\Windows\System\rlcUsHy.exe
  C:\Windows\System\rlcUsHy.exe
  2⤵
  PID:7380
- C:\Windows\System\ZXyUUdO.exe
  C:\Windows\System\ZXyUUdO.exe
  2⤵
  PID:7404
- C:\Windows\System\EaYHWbL.exe
  C:\Windows\System\EaYHWbL.exe
  2⤵
  PID:7068
- C:\Windows\System\PMyhRvL.exe
  C:\Windows\System\PMyhRvL.exe
  2⤵
  PID:6032
- C:\Windows\System\YcRxmCl.exe
  C:\Windows\System\YcRxmCl.exe
  2⤵
  PID:6488
- C:\Windows\System\ksBtNhV.exe
  C:\Windows\System\ksBtNhV.exe
  2⤵
  PID:7416
- C:\Windows\System\IyrKwFc.exe
  C:\Windows\System\IyrKwFc.exe
  2⤵
  PID:7432
- C:\Windows\System\GulPDuy.exe
  C:\Windows\System\GulPDuy.exe
  2⤵
  PID:7460
- C:\Windows\System\iAIsjVA.exe
  C:\Windows\System\iAIsjVA.exe
  2⤵
  PID:7468
- C:\Windows\System\uklDebM.exe
  C:\Windows\System\uklDebM.exe
  2⤵
  PID:6840
- C:\Windows\System\bBvasdT.exe
  C:\Windows\System\bBvasdT.exe
  2⤵
  PID:6996
- C:\Windows\System\cFUsTkq.exe
  C:\Windows\System\cFUsTkq.exe
  2⤵
  PID:2716
- C:\Windows\System\dVefwGI.exe
  C:\Windows\System\dVefwGI.exe
  2⤵
  PID:7172
- C:\Windows\System\vUYNhDx.exe
  C:\Windows\System\vUYNhDx.exe
  2⤵
  PID:7136
- C:\Windows\System\BprMGNU.exe
  C:\Windows\System\BprMGNU.exe
  2⤵
  PID:6284
- C:\Windows\System\cpaEPCs.exe
  C:\Windows\System\cpaEPCs.exe
  2⤵
  PID:7312
- C:\Windows\System\totAGPA.exe
  C:\Windows\System\totAGPA.exe
  2⤵
  PID:6264
- C:\Windows\System\HvIsrKn.exe
  C:\Windows\System\HvIsrKn.exe
  2⤵
  PID:5284
- C:\Windows\System\Anmwbiu.exe
  C:\Windows\System\Anmwbiu.exe
  2⤵
  PID:5352
- C:\Windows\System\kCZwdgm.exe
  C:\Windows\System\kCZwdgm.exe
  2⤵
  PID:5624
- C:\Windows\System\kXhBYDN.exe
  C:\Windows\System\kXhBYDN.exe
  2⤵
  PID:6200
- C:\Windows\System\DqnnHFZ.exe
  C:\Windows\System\DqnnHFZ.exe
  2⤵
  PID:7176
- C:\Windows\System\VZeADqP.exe
  C:\Windows\System\VZeADqP.exe
  2⤵
  PID:7200
- C:\Windows\System\NBQdaVo.exe
  C:\Windows\System\NBQdaVo.exe
  2⤵
  PID:7216
- C:\Windows\System\oKaIVGU.exe
  C:\Windows\System\oKaIVGU.exe
  2⤵
  PID:7308
- C:\Windows\System\nBRraLz.exe
  C:\Windows\System\nBRraLz.exe
  2⤵
  PID:7588
- C:\Windows\System\KmLSpTf.exe
  C:\Windows\System\KmLSpTf.exe
  2⤵
  PID:7524
- C:\Windows\System\enLxmsR.exe
  C:\Windows\System\enLxmsR.exe
  2⤵
  PID:7648
- C:\Windows\System\dgNzpPb.exe
  C:\Windows\System\dgNzpPb.exe
  2⤵
  PID:7712
- C:\Windows\System\wjTDglO.exe
  C:\Windows\System\wjTDglO.exe
  2⤵
  PID:7504
- C:\Windows\System\gPMzgrK.exe
  C:\Windows\System\gPMzgrK.exe
  2⤵
  PID:7536
- C:\Windows\System\cGooZjF.exe
  C:\Windows\System\cGooZjF.exe
  2⤵
  PID:7600
- C:\Windows\System\GSYdAzT.exe
  C:\Windows\System\GSYdAzT.exe
  2⤵
  PID:7700
- C:\Windows\System\hfvsOOf.exe
  C:\Windows\System\hfvsOOf.exe
  2⤵
  PID:7388
- C:\Windows\System\VWCwjoj.exe
  C:\Windows\System\VWCwjoj.exe
  2⤵
  PID:7880
- C:\Windows\System\QvQauSm.exe
  C:\Windows\System\QvQauSm.exe
  2⤵
  PID:7896
- C:\Windows\System\CVtJIOi.exe
  C:\Windows\System\CVtJIOi.exe
  2⤵
  PID:7912
- C:\Windows\System\xjxtjVh.exe
  C:\Windows\System\xjxtjVh.exe
  2⤵
  PID:7924
- C:\Windows\System\jydpBCQ.exe
  C:\Windows\System\jydpBCQ.exe
  2⤵
  PID:7948
- C:\Windows\System\VkiZZyZ.exe
  C:\Windows\System\VkiZZyZ.exe
  2⤵
  PID:7992
- C:\Windows\System\vFblpYE.exe
  C:\Windows\System\vFblpYE.exe
  2⤵
  PID:8016
- C:\Windows\System\jSmGDgK.exe
  C:\Windows\System\jSmGDgK.exe
  2⤵
  PID:7940
- C:\Windows\System\akFxPmO.exe
  C:\Windows\System\akFxPmO.exe
  2⤵
  PID:7752
- C:\Windows\System\jBHLlSJ.exe
  C:\Windows\System\jBHLlSJ.exe
  2⤵
  PID:7780
- C:\Windows\System\iLhObvf.exe
  C:\Windows\System\iLhObvf.exe
  2⤵
  PID:7800
- C:\Windows\System\vjtUSBh.exe
  C:\Windows\System\vjtUSBh.exe
  2⤵
  PID:7816
- C:\Windows\System\ieEWFVM.exe
  C:\Windows\System\ieEWFVM.exe
  2⤵
  PID:8040
- C:\Windows\System\fcchdvj.exe
  C:\Windows\System\fcchdvj.exe
  2⤵
  PID:8072
- C:\Windows\System\EjwolLF.exe
  C:\Windows\System\EjwolLF.exe
  2⤵
  PID:8088
- C:\Windows\System\inRvOJL.exe
  C:\Windows\System\inRvOJL.exe
  2⤵
  PID:8108
- C:\Windows\System\FAgoOOX.exe
  C:\Windows\System\FAgoOOX.exe
  2⤵
  PID:8124
- C:\Windows\System\CNfamgg.exe
  C:\Windows\System\CNfamgg.exe
  2⤵
  PID:7764
- C:\Windows\System\VRqzJtz.exe
  C:\Windows\System\VRqzJtz.exe
  2⤵
  PID:8060
- C:\Windows\System\QImSEio.exe
  C:\Windows\System\QImSEio.exe
  2⤵
  PID:6772
- C:\Windows\System\OMaKSDO.exe
  C:\Windows\System\OMaKSDO.exe
  2⤵
  PID:8184
- C:\Windows\System\fMQaBLn.exe
  C:\Windows\System\fMQaBLn.exe
  2⤵
  PID:6816
- C:\Windows\System\axIaLcQ.exe
  C:\Windows\System\axIaLcQ.exe
  2⤵
  PID:7232
- C:\Windows\System\cmifEcJ.exe
  C:\Windows\System\cmifEcJ.exe
  2⤵
  PID:6236
- C:\Windows\System\IspyqFS.exe
  C:\Windows\System\IspyqFS.exe
  2⤵
  PID:6792
- C:\Windows\System\CgdyjSk.exe
  C:\Windows\System\CgdyjSk.exe
  2⤵
  PID:6948
- C:\Windows\System\xGXoFNV.exe
  C:\Windows\System\xGXoFNV.exe
  2⤵
  PID:7292
- C:\Windows\System\DlGxjld.exe
  C:\Windows\System\DlGxjld.exe
  2⤵
  PID:7376
- C:\Windows\System\KCdBZbh.exe
  C:\Windows\System\KCdBZbh.exe
  2⤵
  PID:7324
- C:\Windows\System\jhzrhFd.exe
  C:\Windows\System\jhzrhFd.exe
  2⤵
  PID:7356
- C:\Windows\System\jVTJLwg.exe
  C:\Windows\System\jVTJLwg.exe
  2⤵
  PID:5644
- C:\Windows\System\IAhWbPk.exe
  C:\Windows\System\IAhWbPk.exe
  2⤵
  PID:3020
- C:\Windows\System\tCfnDdD.exe
  C:\Windows\System\tCfnDdD.exe
  2⤵
  PID:7444
- C:\Windows\System\fpdjJef.exe
  C:\Windows\System\fpdjJef.exe
  2⤵
  PID:6280
- C:\Windows\System\EIzSDFG.exe
  C:\Windows\System\EIzSDFG.exe
  2⤵
  PID:1940
- C:\Windows\System\rBRhMrw.exe
  C:\Windows\System\rBRhMrw.exe
  2⤵
  PID:7424
- C:\Windows\System\iUuucbv.exe
  C:\Windows\System\iUuucbv.exe
  2⤵
  PID:6604
- C:\Windows\System\OuTDwEC.exe
  C:\Windows\System\OuTDwEC.exe
  2⤵
  PID:5436
- C:\Windows\System\UiBdbil.exe
  C:\Windows\System\UiBdbil.exe
  2⤵
  PID:6992
- C:\Windows\System\sMfobKh.exe
  C:\Windows\System\sMfobKh.exe
  2⤵
  PID:1948
- C:\Windows\System\SEqlYic.exe
  C:\Windows\System\SEqlYic.exe
  2⤵
  PID:5444
- C:\Windows\System\zzcRxeC.exe
  C:\Windows\System\zzcRxeC.exe
  2⤵
  PID:7280
- C:\Windows\System\SvsWIAh.exe
  C:\Windows\System\SvsWIAh.exe
  2⤵
  PID:5596
- C:\Windows\System\SVOEPva.exe
  C:\Windows\System\SVOEPva.exe
  2⤵
  PID:7500
- C:\Windows\System\HTyhsFl.exe
  C:\Windows\System\HTyhsFl.exe
  2⤵
  PID:7696
- C:\Windows\System\IlqpChn.exe
  C:\Windows\System\IlqpChn.exe
  2⤵
  PID:7572
- C:\Windows\System\IAzRdzP.exe
  C:\Windows\System\IAzRdzP.exe
  2⤵
  PID:7872
- C:\Windows\System\NiIxSyt.exe
  C:\Windows\System\NiIxSyt.exe
  2⤵
  PID:7888
- C:\Windows\System\TgLFhLZ.exe
  C:\Windows\System\TgLFhLZ.exe
  2⤵
  PID:8000
- C:\Windows\System\cwSsDQM.exe
  C:\Windows\System\cwSsDQM.exe
  2⤵
  PID:8028
- C:\Windows\System\GVrVtPG.exe
  C:\Windows\System\GVrVtPG.exe
  2⤵
  PID:7960
- C:\Windows\System\YPiLhOd.exe
  C:\Windows\System\YPiLhOd.exe
  2⤵
  PID:7768
- C:\Windows\System\aQeVjHk.exe
  C:\Windows\System\aQeVjHk.exe
  2⤵
  PID:7808
- C:\Windows\System\AcTgesh.exe
  C:\Windows\System\AcTgesh.exe
  2⤵
  PID:5748
- C:\Windows\System\OFwSFuu.exe
  C:\Windows\System\OFwSFuu.exe
  2⤵
  PID:7420
- C:\Windows\System\aAlsEEu.exe
  C:\Windows\System\aAlsEEu.exe
  2⤵
  PID:8080
- C:\Windows\System\RQLVfzS.exe
  C:\Windows\System\RQLVfzS.exe
  2⤵
  PID:1156
- C:\Windows\System\Nejbgen.exe
  C:\Windows\System\Nejbgen.exe
  2⤵
  PID:2344
- C:\Windows\System\dQzltOo.exe
  C:\Windows\System\dQzltOo.exe
  2⤵
  PID:7792
- C:\Windows\System\TZyWTFd.exe
  C:\Windows\System\TZyWTFd.exe
  2⤵
  PID:6304
- C:\Windows\System\BZAptQL.exe
  C:\Windows\System\BZAptQL.exe
  2⤵
  PID:7456
- C:\Windows\System\aMheWGo.exe
  C:\Windows\System\aMheWGo.exe
  2⤵
  PID:6448
- C:\Windows\System\lEkRYrw.exe
  C:\Windows\System\lEkRYrw.exe
  2⤵
  PID:8048
- C:\Windows\System\cWxaihc.exe
  C:\Windows\System\cWxaihc.exe
  2⤵
  PID:7248
- C:\Windows\System\nxnIuqL.exe
  C:\Windows\System\nxnIuqL.exe
  2⤵
  PID:7340
- C:\Windows\System\zyxGfMQ.exe
  C:\Windows\System\zyxGfMQ.exe
  2⤵
  PID:7556
- C:\Windows\System\wDIkdTM.exe
  C:\Windows\System\wDIkdTM.exe
  2⤵
  PID:7516
- C:\Windows\System\qhzPHGX.exe
  C:\Windows\System\qhzPHGX.exe
  2⤵
  PID:7584
- C:\Windows\System\GRMxjxl.exe
  C:\Windows\System\GRMxjxl.exe
  2⤵
  PID:5832
- C:\Windows\System\ebbFDwl.exe
  C:\Windows\System\ebbFDwl.exe
  2⤵
  PID:8068
- C:\Windows\System\fLgqYme.exe
  C:\Windows\System\fLgqYme.exe
  2⤵
  PID:7920
- C:\Windows\System\kLxJgRh.exe
  C:\Windows\System\kLxJgRh.exe
  2⤵
  PID:7848
- C:\Windows\System\YQJCXOt.exe
  C:\Windows\System\YQJCXOt.exe
  2⤵
  PID:5828
- C:\Windows\System\EPyBCdy.exe
  C:\Windows\System\EPyBCdy.exe
  2⤵
  PID:8100
- C:\Windows\System\ksGFxBH.exe
  C:\Windows\System\ksGFxBH.exe
  2⤵
  PID:7840
- C:\Windows\System\cgjbnWj.exe
  C:\Windows\System\cgjbnWj.exe
  2⤵
  PID:8152
- C:\Windows\System\XedinMT.exe
  C:\Windows\System\XedinMT.exe
  2⤵
  PID:8096
- C:\Windows\System\xxJonNM.exe
  C:\Windows\System\xxJonNM.exe
  2⤵
  PID:8064
- C:\Windows\System\bBAIZye.exe
  C:\Windows\System\bBAIZye.exe
  2⤵
  PID:7824
- C:\Windows\System\wtwritt.exe
  C:\Windows\System\wtwritt.exe
  2⤵
  PID:7180
- C:\Windows\System\snIhpDl.exe
  C:\Windows\System\snIhpDl.exe
  2⤵
  PID:7856
- C:\Windows\System\yBSwTfu.exe
  C:\Windows\System\yBSwTfu.exe
  2⤵
  PID:2564
- C:\Windows\System\ufswAeh.exe
  C:\Windows\System\ufswAeh.exe
  2⤵
  PID:7036
- C:\Windows\System\wbscCZD.exe
  C:\Windows\System\wbscCZD.exe
  2⤵
  PID:7192
- C:\Windows\System\RoaYjWU.exe
  C:\Windows\System\RoaYjWU.exe
  2⤵
  PID:8120
- C:\Windows\System\jBegmmw.exe
  C:\Windows\System\jBegmmw.exe
  2⤵
  PID:7936
- C:\Windows\System\yICZlZv.exe
  C:\Windows\System\yICZlZv.exe
  2⤵
  PID:7276
- C:\Windows\System\hOqGdLN.exe
  C:\Windows\System\hOqGdLN.exe
  2⤵
  PID:6628
- C:\Windows\System\qXyLnTD.exe
  C:\Windows\System\qXyLnTD.exe
  2⤵
  PID:8004
- C:\Windows\System\KThdIsz.exe
  C:\Windows\System\KThdIsz.exe
  2⤵
  PID:6672
- C:\Windows\System\qBcRbEC.exe
  C:\Windows\System\qBcRbEC.exe
  2⤵
  PID:5200
- C:\Windows\System\wkApoWU.exe
  C:\Windows\System\wkApoWU.exe
  2⤵
  PID:8212
- C:\Windows\System\KPuRWEh.exe
  C:\Windows\System\KPuRWEh.exe
  2⤵
  PID:8228
- C:\Windows\System\vjwzWjW.exe
  C:\Windows\System\vjwzWjW.exe
  2⤵
  PID:8340
- C:\Windows\System\mhJjsYf.exe
  C:\Windows\System\mhJjsYf.exe
  2⤵
  PID:8356
- C:\Windows\System\enxDUOd.exe
  C:\Windows\System\enxDUOd.exe
  2⤵
  PID:8412
- C:\Windows\System\bYfHzoP.exe
  C:\Windows\System\bYfHzoP.exe
  2⤵
  PID:8428
- C:\Windows\System\JacmaAh.exe
  C:\Windows\System\JacmaAh.exe
  2⤵
  PID:8444
- C:\Windows\System\ZiTbUNC.exe
  C:\Windows\System\ZiTbUNC.exe
  2⤵
  PID:8460
- C:\Windows\System\DVJBYjV.exe
  C:\Windows\System\DVJBYjV.exe
  2⤵
  PID:8476
- C:\Windows\System\LvomQkR.exe
  C:\Windows\System\LvomQkR.exe
  2⤵
  PID:8500
- C:\Windows\System\OADXvmS.exe
  C:\Windows\System\OADXvmS.exe
  2⤵
  PID:8516
- C:\Windows\System\FsCvkNH.exe
  C:\Windows\System\FsCvkNH.exe
  2⤵
  PID:8532
- C:\Windows\System\nWTRgtm.exe
  C:\Windows\System\nWTRgtm.exe
  2⤵
  PID:8548
- C:\Windows\System\KIXHkMJ.exe
  C:\Windows\System\KIXHkMJ.exe
  2⤵
  PID:8568
- C:\Windows\System\FxbjfJw.exe
  C:\Windows\System\FxbjfJw.exe
  2⤵
  PID:8584
- C:\Windows\System\gvvZYyh.exe
  C:\Windows\System\gvvZYyh.exe
  2⤵
  PID:8620
- C:\Windows\System\YDzfmZN.exe
  C:\Windows\System\YDzfmZN.exe
  2⤵
  PID:8648
- C:\Windows\System\oGJEyWD.exe
  C:\Windows\System\oGJEyWD.exe
  2⤵
  PID:8664
- C:\Windows\System\hEtljtZ.exe
  C:\Windows\System\hEtljtZ.exe
  2⤵
  PID:8680
- C:\Windows\System\doZMUlu.exe
  C:\Windows\System\doZMUlu.exe
  2⤵
  PID:8696
- C:\Windows\System\LclNHJn.exe
  C:\Windows\System\LclNHJn.exe
  2⤵
  PID:8712
- C:\Windows\System\qbOlyck.exe
  C:\Windows\System\qbOlyck.exe
  2⤵
  PID:8732
- C:\Windows\System\HnbSsag.exe
  C:\Windows\System\HnbSsag.exe
  2⤵
  PID:8752
- C:\Windows\System\BluzwmO.exe
  C:\Windows\System\BluzwmO.exe
  2⤵
  PID:8772
- C:\Windows\System\oMOUkUu.exe
  C:\Windows\System\oMOUkUu.exe
  2⤵
  PID:8788
- C:\Windows\System\HAqXvXb.exe
  C:\Windows\System\HAqXvXb.exe
  2⤵
  PID:8812
- C:\Windows\System\UYUaBzy.exe
  C:\Windows\System\UYUaBzy.exe
  2⤵
  PID:8828
- C:\Windows\System\iQOyuJa.exe
  C:\Windows\System\iQOyuJa.exe
  2⤵
  PID:8876
- C:\Windows\System\BlGZtqo.exe
  C:\Windows\System\BlGZtqo.exe
  2⤵
  PID:8920
- C:\Windows\System\qoZTzPh.exe
  C:\Windows\System\qoZTzPh.exe
  2⤵
  PID:8936
- C:\Windows\System\GJTnfBX.exe
  C:\Windows\System\GJTnfBX.exe
  2⤵
  PID:8956
- C:\Windows\System\CSbCtZV.exe
  C:\Windows\System\CSbCtZV.exe
  2⤵
  PID:8972
- C:\Windows\System\hsMTWPu.exe
  C:\Windows\System\hsMTWPu.exe
  2⤵
  PID:8988
- C:\Windows\System\wIzcSMa.exe
  C:\Windows\System\wIzcSMa.exe
  2⤵
  PID:9004
- C:\Windows\System\pUjMSCm.exe
  C:\Windows\System\pUjMSCm.exe
  2⤵
  PID:9020
- C:\Windows\System\gmktdKu.exe
  C:\Windows\System\gmktdKu.exe
  2⤵
  PID:9036
- C:\Windows\System\XYdWRbx.exe
  C:\Windows\System\XYdWRbx.exe
  2⤵
  PID:9052
- C:\Windows\System\eeGwylW.exe
  C:\Windows\System\eeGwylW.exe
  2⤵
  PID:9068
- C:\Windows\System\hRiwoxx.exe
  C:\Windows\System\hRiwoxx.exe
  2⤵
  PID:9084
- C:\Windows\System\vCRXAxW.exe
  C:\Windows\System\vCRXAxW.exe
  2⤵
  PID:9100
- C:\Windows\System\KgJmnhL.exe
  C:\Windows\System\KgJmnhL.exe
  2⤵
  PID:9124
- C:\Windows\System\cPCutDr.exe
  C:\Windows\System\cPCutDr.exe
  2⤵
  PID:9140
- C:\Windows\System\ToqMEKJ.exe
  C:\Windows\System\ToqMEKJ.exe
  2⤵
  PID:9156
- C:\Windows\System\xRVVTWh.exe
  C:\Windows\System\xRVVTWh.exe
  2⤵
  PID:9172
- C:\Windows\System\GWpjTej.exe
  C:\Windows\System\GWpjTej.exe
  2⤵
  PID:9188
- C:\Windows\System\uNjuGqz.exe
  C:\Windows\System\uNjuGqz.exe
  2⤵
  PID:9204
- C:\Windows\System\ndxIGKV.exe
  C:\Windows\System\ndxIGKV.exe
  2⤵
  PID:6276
- C:\Windows\System\mPwXuLX.exe
  C:\Windows\System\mPwXuLX.exe
  2⤵
  PID:8348
- C:\Windows\System\PBATByD.exe
  C:\Windows\System\PBATByD.exe
  2⤵
  PID:2516
- C:\Windows\System\vKWLqIs.exe
  C:\Windows\System\vKWLqIs.exe
  2⤵
  PID:6856
- C:\Windows\System\rRJaDeY.exe
  C:\Windows\System\rRJaDeY.exe
  2⤵
  PID:8116
- C:\Windows\System\zrMZcbY.exe
  C:\Windows\System\zrMZcbY.exe
  2⤵
  PID:1776
- C:\Windows\System\uyozFsb.exe
  C:\Windows\System\uyozFsb.exe
  2⤵
  PID:8484
- C:\Windows\System\cVxZsIg.exe
  C:\Windows\System\cVxZsIg.exe
  2⤵
  PID:1340
- C:\Windows\System\UKZEOAY.exe
  C:\Windows\System\UKZEOAY.exe
  2⤵
  PID:8208
- C:\Windows\System\jMsczLQ.exe
  C:\Windows\System\jMsczLQ.exe
  2⤵
  PID:7744
- C:\Windows\System\jdBkOvr.exe
  C:\Windows\System\jdBkOvr.exe
  2⤵
  PID:8256
- C:\Windows\System\HkpCOnH.exe
  C:\Windows\System\HkpCOnH.exe
  2⤵
  PID:8200
- C:\Windows\System\LYpavhA.exe
  C:\Windows\System\LYpavhA.exe
  2⤵
  PID:8380
- C:\Windows\System\MHMNspH.exe
  C:\Windows\System\MHMNspH.exe
  2⤵
  PID:8276
- C:\Windows\System\nhsUSDx.exe
  C:\Windows\System\nhsUSDx.exe
  2⤵
  PID:8292
- C:\Windows\System\IItOXhn.exe
  C:\Windows\System\IItOXhn.exe
  2⤵
  PID:8312
- C:\Windows\System\dypJpcn.exe
  C:\Windows\System\dypJpcn.exe
  2⤵
  PID:8324
- C:\Windows\System\nTnGLLe.exe
  C:\Windows\System\nTnGLLe.exe
  2⤵
  PID:8368
- C:\Windows\System\vuifKAG.exe
  C:\Windows\System\vuifKAG.exe
  2⤵
  PID:8388
- C:\Windows\System\sfDnEXO.exe
  C:\Windows\System\sfDnEXO.exe
  2⤵
  PID:8524
- C:\Windows\System\sAXCJsK.exe
  C:\Windows\System\sAXCJsK.exe
  2⤵
  PID:8544
- C:\Windows\System\nRvKZqA.exe
  C:\Windows\System\nRvKZqA.exe
  2⤵
  PID:8628
- C:\Windows\System\GswgYxG.exe
  C:\Windows\System\GswgYxG.exe
  2⤵
  PID:8672
- C:\Windows\System\ydlWpCm.exe
  C:\Windows\System\ydlWpCm.exe
  2⤵
  PID:8596
- C:\Windows\System\ujSOQPs.exe
  C:\Windows\System\ujSOQPs.exe
  2⤵
  PID:8540
- C:\Windows\System\eetXrUG.exe
  C:\Windows\System\eetXrUG.exe
  2⤵
  PID:8740
- C:\Windows\System\jOoHQVM.exe
  C:\Windows\System\jOoHQVM.exe
  2⤵
  PID:8676
- C:\Windows\System\qaSMcGD.exe
  C:\Windows\System\qaSMcGD.exe
  2⤵
  PID:8692
- C:\Windows\System\fjpRFEp.exe
  C:\Windows\System\fjpRFEp.exe
  2⤵
  PID:8768
- C:\Windows\System\ICTOVdf.exe
  C:\Windows\System\ICTOVdf.exe
  2⤵
  PID:8892
- C:\Windows\System\zmkQGYZ.exe
  C:\Windows\System\zmkQGYZ.exe
  2⤵
  PID:8952
- C:\Windows\System\DnVJqXB.exe
  C:\Windows\System\DnVJqXB.exe
  2⤵
  PID:9016
- C:\Windows\System\RQhPLvc.exe
  C:\Windows\System\RQhPLvc.exe
  2⤵
  PID:9080
- C:\Windows\System\WpYiqIp.exe
  C:\Windows\System\WpYiqIp.exe
  2⤵
  PID:8604
- C:\Windows\System\hIAYWVa.exe
  C:\Windows\System\hIAYWVa.exe
  2⤵
  PID:8720
- C:\Windows\System\XMIcNiL.exe
  C:\Windows\System\XMIcNiL.exe
  2⤵
  PID:8808
- C:\Windows\System\uwlRXJo.exe
  C:\Windows\System\uwlRXJo.exe
  2⤵
  PID:8848
- C:\Windows\System\ZAvLcpk.exe
  C:\Windows\System\ZAvLcpk.exe
  2⤵
  PID:8928
- C:\Windows\System\RHAYjBR.exe
  C:\Windows\System\RHAYjBR.exe
  2⤵
  PID:8996
- C:\Windows\System\GLClmay.exe
  C:\Windows\System\GLClmay.exe
  2⤵
  PID:9064
- C:\Windows\System\lGgYfqy.exe
  C:\Windows\System\lGgYfqy.exe
  2⤵
  PID:8860
- C:\Windows\System\JSzFZaa.exe
  C:\Windows\System\JSzFZaa.exe
  2⤵
  PID:8948
- C:\Windows\System\qUFizVW.exe
  C:\Windows\System\qUFizVW.exe
  2⤵
  PID:9132
- C:\Windows\System\ZQlGkxT.exe
  C:\Windows\System\ZQlGkxT.exe
  2⤵
  PID:7852
- C:\Windows\System\MWykLSb.exe
  C:\Windows\System\MWykLSb.exe
  2⤵
  PID:9212
- C:\Windows\System\ljAufpz.exe
  C:\Windows\System\ljAufpz.exe
  2⤵
  PID:8456
- C:\Windows\System\JdIIwfa.exe
  C:\Windows\System\JdIIwfa.exe
  2⤵
  PID:4176
- C:\Windows\System\aKdJODv.exe
  C:\Windows\System\aKdJODv.exe
  2⤵
  PID:8248
- C:\Windows\System\SMnwuSY.exe
  C:\Windows\System\SMnwuSY.exe
  2⤵
  PID:8328
- C:\Windows\System\HPkOqAm.exe
  C:\Windows\System\HPkOqAm.exe
  2⤵
  PID:8420
- C:\Windows\System\JKCtmus.exe
  C:\Windows\System\JKCtmus.exe
  2⤵
  PID:8424
- C:\Windows\System\iKmcIqa.exe
  C:\Windows\System\iKmcIqa.exe
  2⤵
  PID:8820
- C:\Windows\System\YGuRVKk.exe
  C:\Windows\System\YGuRVKk.exe
  2⤵
  PID:8260
- C:\Windows\System\wssjiDS.exe
  C:\Windows\System\wssjiDS.exe
  2⤵
  PID:8296
- C:\Windows\System\LBOqraa.exe
  C:\Windows\System\LBOqraa.exe
  2⤵
  PID:8304
- C:\Windows\System\hlvKSXa.exe
  C:\Windows\System\hlvKSXa.exe
  2⤵
  PID:8224
- C:\Windows\System\RASjdzr.exe
  C:\Windows\System\RASjdzr.exe
  2⤵
  PID:8512
- C:\Windows\System\TnnEjyw.exe
  C:\Windows\System\TnnEjyw.exe
  2⤵
  PID:7616
- C:\Windows\System\ZfWPQKF.exe
  C:\Windows\System\ZfWPQKF.exe
  2⤵
  PID:8364
- C:\Windows\System\hmYBkaz.exe
  C:\Windows\System\hmYBkaz.exe
  2⤵
  PID:8608
- C:\Windows\System\EPeGDwg.exe
  C:\Windows\System\EPeGDwg.exe
  2⤵
  PID:8392
- C:\Windows\System\KPlUaEy.exe
  C:\Windows\System\KPlUaEy.exe
  2⤵
  PID:8888
- C:\Windows\System\EPXspzB.exe
  C:\Windows\System\EPXspzB.exe
  2⤵
  PID:9076
- C:\Windows\System\VNqZsaR.exe
  C:\Windows\System\VNqZsaR.exe
  2⤵
  PID:9028
- C:\Windows\System\ZswgMFJ.exe
  C:\Windows\System\ZswgMFJ.exe
  2⤵
  PID:8856
- C:\Windows\System\UQIUFRW.exe
  C:\Windows\System\UQIUFRW.exe
  2⤵
  PID:8796
- C:\Windows\System\hLlgLPx.exe
  C:\Windows\System\hLlgLPx.exe
  2⤵
  PID:9032
- C:\Windows\System\KzvGdnD.exe
  C:\Windows\System\KzvGdnD.exe
  2⤵
  PID:2824
- C:\Windows\System\PemaGoY.exe
  C:\Windows\System\PemaGoY.exe
  2⤵
  PID:8488
- C:\Windows\System\rKPXdfJ.exe
  C:\Windows\System\rKPXdfJ.exe
  2⤵
  PID:7828
- C:\Windows\System\lgVmWcc.exe
  C:\Windows\System\lgVmWcc.exe
  2⤵
  PID:8336
- C:\Windows\System\gdswtqK.exe
  C:\Windows\System\gdswtqK.exe
  2⤵
  PID:8904
- C:\Windows\System\pHDlsbZ.exe
  C:\Windows\System\pHDlsbZ.exe
  2⤵
  PID:7400
- C:\Windows\System\BLyMYFp.exe
  C:\Windows\System\BLyMYFp.exe
  2⤵
  PID:8472
- C:\Windows\System\tsaQhTN.exe
  C:\Windows\System\tsaQhTN.exe
  2⤵
  PID:9012
- C:\Windows\System\PIwuJeg.exe
  C:\Windows\System\PIwuJeg.exe
  2⤵
  PID:8600
- C:\Windows\System\nqajZQZ.exe
  C:\Windows\System\nqajZQZ.exe
  2⤵
  PID:8404
- C:\Windows\System\EOlCAmV.exe
  C:\Windows\System\EOlCAmV.exe
  2⤵
  PID:2508
- C:\Windows\System\heTRIOp.exe
  C:\Windows\System\heTRIOp.exe
  2⤵
  PID:8496
- C:\Windows\System\nnqtJjX.exe
  C:\Windows\System\nnqtJjX.exe
  2⤵
  PID:8396
- C:\Windows\System\WaJCeLl.exe
  C:\Windows\System\WaJCeLl.exe
  2⤵
  PID:9200
- C:\Windows\System\oOrumnr.exe
  C:\Windows\System\oOrumnr.exe
  2⤵
  PID:8564
- C:\Windows\System\IhYxIlJ.exe
  C:\Windows\System\IhYxIlJ.exe
  2⤵
  PID:8592
- C:\Windows\System\qUMtDEV.exe
  C:\Windows\System\qUMtDEV.exe
  2⤵
  PID:8288
- C:\Windows\System\BHjtLSa.exe
  C:\Windows\System\BHjtLSa.exe
  2⤵
  PID:8824
- C:\Windows\System\PqMvySD.exe
  C:\Windows\System\PqMvySD.exe
  2⤵
  PID:6468
- C:\Windows\System\WnQDbga.exe
  C:\Windows\System\WnQDbga.exe
  2⤵
  PID:8916
- C:\Windows\System\GrEohYB.exe
  C:\Windows\System\GrEohYB.exe
  2⤵
  PID:6752
- C:\Windows\System\SgtDuFJ.exe
  C:\Windows\System\SgtDuFJ.exe
  2⤵
  PID:9180
- C:\Windows\System\chICMoV.exe
  C:\Windows\System\chICMoV.exe
  2⤵
  PID:8556
- C:\Windows\System\JnfmVNY.exe
  C:\Windows\System\JnfmVNY.exe
  2⤵
  PID:8308
- C:\Windows\System\MlIXSHQ.exe
  C:\Windows\System\MlIXSHQ.exe
  2⤵
  PID:9096
- C:\Windows\System\NWYnSGY.exe
  C:\Windows\System\NWYnSGY.exe
  2⤵
  PID:8244
- C:\Windows\System\qoTbvYd.exe
  C:\Windows\System\qoTbvYd.exe
  2⤵
  PID:8400
- C:\Windows\System\YMLnUvd.exe
  C:\Windows\System\YMLnUvd.exe
  2⤵
  PID:8748
- C:\Windows\System\gYdNbVt.exe
  C:\Windows\System\gYdNbVt.exe
  2⤵
  PID:8284
- C:\Windows\System\YmgLSjZ.exe
  C:\Windows\System\YmgLSjZ.exe
  2⤵
  PID:9228
- C:\Windows\System\pxrLvzI.exe
  C:\Windows\System\pxrLvzI.exe
  2⤵
  PID:9244
- C:\Windows\System\smVVfTU.exe
  C:\Windows\System\smVVfTU.exe
  2⤵
  PID:9260
- C:\Windows\System\hfztVHg.exe
  C:\Windows\System\hfztVHg.exe
  2⤵
  PID:9276
- C:\Windows\System\TDLjiRV.exe
  C:\Windows\System\TDLjiRV.exe
  2⤵
  PID:9292
- C:\Windows\System\AVAIhAn.exe
  C:\Windows\System\AVAIhAn.exe
  2⤵
  PID:9308
- C:\Windows\System\NVwrVVG.exe
  C:\Windows\System\NVwrVVG.exe
  2⤵
  PID:9324
- C:\Windows\System\OaEMILc.exe
  C:\Windows\System\OaEMILc.exe
  2⤵
  PID:9340
- C:\Windows\System\pOsHKIl.exe
  C:\Windows\System\pOsHKIl.exe
  2⤵
  PID:9356
- C:\Windows\System\dSVpKht.exe
  C:\Windows\System\dSVpKht.exe
  2⤵
  PID:9372
- C:\Windows\System\LFUtIYi.exe
  C:\Windows\System\LFUtIYi.exe
  2⤵
  PID:9388
- C:\Windows\System\XwMGBiJ.exe
  C:\Windows\System\XwMGBiJ.exe
  2⤵
  PID:9404
- C:\Windows\System\hndADtv.exe
  C:\Windows\System\hndADtv.exe
  2⤵
  PID:9420
- C:\Windows\System\TqFQlTC.exe
  C:\Windows\System\TqFQlTC.exe
  2⤵
  PID:9436
- C:\Windows\System\yHFmCQP.exe
  C:\Windows\System\yHFmCQP.exe
  2⤵
  PID:9452
- C:\Windows\System\Mnvdvvs.exe
  C:\Windows\System\Mnvdvvs.exe
  2⤵
  PID:9468
- C:\Windows\System\NciCKyG.exe
  C:\Windows\System\NciCKyG.exe
  2⤵
  PID:9484
- C:\Windows\System\dBzZDEq.exe
  C:\Windows\System\dBzZDEq.exe
  2⤵
  PID:9500
- C:\Windows\System\clkgXgw.exe
  C:\Windows\System\clkgXgw.exe
  2⤵
  PID:9516
- C:\Windows\System\fZUmzTs.exe
  C:\Windows\System\fZUmzTs.exe
  2⤵
  PID:9532
- C:\Windows\System\kaXNWKa.exe
  C:\Windows\System\kaXNWKa.exe
  2⤵
  PID:9548
- C:\Windows\System\QDXeAiv.exe
  C:\Windows\System\QDXeAiv.exe
  2⤵
  PID:9564
- C:\Windows\System\jjNKjda.exe
  C:\Windows\System\jjNKjda.exe
  2⤵
  PID:9580
- C:\Windows\System\smZkESp.exe
  C:\Windows\System\smZkESp.exe
  2⤵
  PID:9596
- C:\Windows\System\obqqYAW.exe
  C:\Windows\System\obqqYAW.exe
  2⤵
  PID:9612
- C:\Windows\System\LnXhoIC.exe
  C:\Windows\System\LnXhoIC.exe
  2⤵
  PID:9628
- C:\Windows\System\HSbQpeE.exe
  C:\Windows\System\HSbQpeE.exe
  2⤵
  PID:9644
- C:\Windows\System\kdOoMcI.exe
  C:\Windows\System\kdOoMcI.exe
  2⤵
  PID:9660
- C:\Windows\System\GAIUpSf.exe
  C:\Windows\System\GAIUpSf.exe
  2⤵
  PID:9676
- C:\Windows\System\BBpxSIA.exe
  C:\Windows\System\BBpxSIA.exe
  2⤵
  PID:9692
- C:\Windows\System\XrPYKFi.exe
  C:\Windows\System\XrPYKFi.exe
  2⤵
  PID:9712
- C:\Windows\System\oHvDoib.exe
  C:\Windows\System\oHvDoib.exe
  2⤵
  PID:9728
- C:\Windows\System\RuOtuab.exe
  C:\Windows\System\RuOtuab.exe
  2⤵
  PID:9744
- C:\Windows\System\bntEfwZ.exe
  C:\Windows\System\bntEfwZ.exe
  2⤵
  PID:9760
- C:\Windows\System\ONFXtmY.exe
  C:\Windows\System\ONFXtmY.exe
  2⤵
  PID:9776
- C:\Windows\System\Dkjpxvj.exe
  C:\Windows\System\Dkjpxvj.exe
  2⤵
  PID:9792
- C:\Windows\System\DSkWMaA.exe
  C:\Windows\System\DSkWMaA.exe
  2⤵
  PID:9808
- C:\Windows\System\RcCWCYX.exe
  C:\Windows\System\RcCWCYX.exe
  2⤵
  PID:9824
- C:\Windows\System\tNQIuFN.exe
  C:\Windows\System\tNQIuFN.exe
  2⤵
  PID:9840
- C:\Windows\System\VfpztDQ.exe
  C:\Windows\System\VfpztDQ.exe
  2⤵
  PID:9856
- C:\Windows\System\oVNDUEf.exe
  C:\Windows\System\oVNDUEf.exe
  2⤵
  PID:9872
- C:\Windows\System\cUZevDH.exe
  C:\Windows\System\cUZevDH.exe
  2⤵
  PID:9888
- C:\Windows\System\VHjWCth.exe
  C:\Windows\System\VHjWCth.exe
  2⤵
  PID:9904
- C:\Windows\System\KUfDtHH.exe
  C:\Windows\System\KUfDtHH.exe
  2⤵
  PID:9920
- C:\Windows\System\VekzbjM.exe
  C:\Windows\System\VekzbjM.exe
  2⤵
  PID:9936
- C:\Windows\System\vlSckOZ.exe
  C:\Windows\System\vlSckOZ.exe
  2⤵
  PID:9952
- C:\Windows\System\UgkVqlU.exe
  C:\Windows\System\UgkVqlU.exe
  2⤵
  PID:9968
- C:\Windows\System\XBkLeVv.exe
  C:\Windows\System\XBkLeVv.exe
  2⤵
  PID:9984
- C:\Windows\System\WNQNZUM.exe
  C:\Windows\System\WNQNZUM.exe
  2⤵
  PID:10000
- C:\Windows\System\zEhJIeb.exe
  C:\Windows\System\zEhJIeb.exe
  2⤵
  PID:10016
- C:\Windows\System\RnJFfIB.exe
  C:\Windows\System\RnJFfIB.exe
  2⤵
  PID:10032
- C:\Windows\System\ulwhePW.exe
  C:\Windows\System\ulwhePW.exe
  2⤵
  PID:10048
- C:\Windows\System\bAxLnsl.exe
  C:\Windows\System\bAxLnsl.exe
  2⤵
  PID:10064
- C:\Windows\System\uqdwksX.exe
  C:\Windows\System\uqdwksX.exe
  2⤵
  PID:10080
- C:\Windows\System\LERSdja.exe
  C:\Windows\System\LERSdja.exe
  2⤵
  PID:10096
- C:\Windows\System\mjhVtfs.exe
  C:\Windows\System\mjhVtfs.exe
  2⤵
  PID:10112
- C:\Windows\System\AJOVAkD.exe
  C:\Windows\System\AJOVAkD.exe
  2⤵
  PID:10128
- C:\Windows\System\nBNkdQJ.exe
  C:\Windows\System\nBNkdQJ.exe
  2⤵
  PID:10144
- C:\Windows\System\aktqjcC.exe
  C:\Windows\System\aktqjcC.exe
  2⤵
  PID:10160
- C:\Windows\System\QImojuK.exe
  C:\Windows\System\QImojuK.exe
  2⤵
  PID:10176
- C:\Windows\System\PaBYRED.exe
  C:\Windows\System\PaBYRED.exe
  2⤵
  PID:10192
- C:\Windows\System\vSzAluM.exe
  C:\Windows\System\vSzAluM.exe
  2⤵
  PID:10208
- C:\Windows\System\xgolkno.exe
  C:\Windows\System\xgolkno.exe
  2⤵
  PID:10224
- C:\Windows\System\mTbtivs.exe
  C:\Windows\System\mTbtivs.exe
  2⤵
  PID:8964
- C:\Windows\System\CkKVzWo.exe
  C:\Windows\System\CkKVzWo.exe
  2⤵
  PID:9252
- C:\Windows\System\MfPnaxX.exe
  C:\Windows\System\MfPnaxX.exe
  2⤵
  PID:9284
- C:\Windows\System\KkxskEg.exe
  C:\Windows\System\KkxskEg.exe
  2⤵
  PID:9240
- C:\Windows\System\BuBjtTw.exe
  C:\Windows\System\BuBjtTw.exe
  2⤵
  PID:8908
- C:\Windows\System\pvKwHFf.exe
  C:\Windows\System\pvKwHFf.exe
  2⤵
  PID:9336
- C:\Windows\System\xdpVSYc.exe
  C:\Windows\System\xdpVSYc.exe
  2⤵
  PID:9380
- C:\Windows\System\xBSwbWL.exe
  C:\Windows\System\xBSwbWL.exe
  2⤵
  PID:9428
- C:\Windows\System\oncGZRC.exe
  C:\Windows\System\oncGZRC.exe
  2⤵
  PID:9432
- C:\Windows\System\LhfYuAW.exe
  C:\Windows\System\LhfYuAW.exe
  2⤵
  PID:9448
- C:\Windows\System\Wcqxgxx.exe
  C:\Windows\System\Wcqxgxx.exe
  2⤵
  PID:9496
- C:\Windows\System\LCiRcVN.exe
  C:\Windows\System\LCiRcVN.exe
  2⤵
  PID:9528
- C:\Windows\System\LwiMjsN.exe
  C:\Windows\System\LwiMjsN.exe
  2⤵
  PID:9540
- C:\Windows\System\CufwKRa.exe
  C:\Windows\System\CufwKRa.exe
  2⤵
  PID:9624
- C:\Windows\System\YehyQgL.exe
  C:\Windows\System\YehyQgL.exe
  2⤵
  PID:9576
- C:\Windows\System\DvbIjyI.exe
  C:\Windows\System\DvbIjyI.exe
  2⤵
  PID:9640
- C:\Windows\System\eVmMLMa.exe
  C:\Windows\System\eVmMLMa.exe
  2⤵
  PID:9688
- C:\Windows\System\unhNSsH.exe
  C:\Windows\System\unhNSsH.exe
  2⤵
  PID:9736
- C:\Windows\System\EysIyXW.exe
  C:\Windows\System\EysIyXW.exe
  2⤵
  PID:9772
- C:\Windows\System\mYtMYsV.exe
  C:\Windows\System\mYtMYsV.exe
  2⤵
  PID:9832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AAEbzqr.exe

Filesize
1.8MB

MD5
b6f5c7169c961157999b3ed1790e2ddf

SHA1
a80e20d6a552cd1396c3064aea66e34d1557d130

SHA256
1f54da1f4eb17b1a922d231c0e2d8c00195d08ceb83707c6388b8121a0e52d11

SHA512
9ca152df048214db7bdf1afb9763d3b8f89ce0de58039976c543d0dce0017789f038db3d8ab13700f127aba91c1d952e1ed3ffbe7d6c683c0f1d406390feaca5

Download Submit
C:\Windows\system\ELZteaW.exe

Filesize
1.8MB

MD5
798fd734844a693242e0a3f6817320a4

SHA1
2c2d312f93bc9bc2f6bdd510bf8730eea5f9cbf3

SHA256
bbee7dfbc78f4d1e8ce40b6c4daa1e735dbfcc33da8627c00c2d16b1d623bb20

SHA512
6b3c035ecbd4625ceaafbd075a0f3fcf8b94ff9ffe821038263a44c636c7edf5f391678923eb5f8da6150ce21d88aa8de61cde90aaa58ad74ef98701784296ad

Download Submit
C:\Windows\system\KkcADmv.exe

Filesize
1.7MB

MD5
9056d17aa06054a09b9439f18694eaa8

SHA1
a381e632adecc6f5cf0123780785ee4623009d6c

SHA256
7ea326eb068e48104699c99833556c00bb39d2dbf8a4325be90ef7eff15dc4ca

SHA512
a6333dda7c93ddced159692675fdb1faca744d814e46d705ebee8dfa25e120a000cfdcc7ccad6a20a7f3f5927bff1202fd370b1b61bd4472204620e2ae46dd5c

Download Submit
C:\Windows\system\MQRkBSD.exe

Filesize
1.8MB

MD5
c8952740fc809333628f89f7d2d3a45d

SHA1
f7e19735c8c7b72eac152cc3e540ffa58c416d3a

SHA256
29e831a2f2262a008e8bf28ee6f8221c4a0847633bfb461f928e6dc958bc6589

SHA512
d05b484054c6fefea7841026a85576182efb0a4f56295291cfb94630e4e20394cd102e987855c8260f23075e6f5550457c7d920196cd7c0b7dedd51d95ab13eb

Download Submit
C:\Windows\system\PEirUEY.exe

Filesize
1.7MB

MD5
a3f4f742787d8e9981a4733c1f7242c8

SHA1
6e1d1ba54f582b0dde354df6577f4a880d10a63b

SHA256
4573a56de5c06c438fb6986f538184e39172f603a47fff4406281fd60dd40062

SHA512
7524703f06175105c04f0bc5b1321abfb737696381ff9d99ccc15fb1589f160e17e53139b75880678bf9bf28a8d16a06ce08ef0e1d5a26ccf20cdf9d3639f848

Download Submit
C:\Windows\system\PJhdFBV.exe

Filesize
1.7MB

MD5
61171631f95d517d7caed33678d9377d

SHA1
6da98937e38d71fd35534dd0c41e4abd6f1e1297

SHA256
5cbfafda7a2ec6d64afa15757f8425ab652f32db9610e2fc568eafd7dd823863

SHA512
6e4a063ff6a3e0d2618b59ec78c1bdee875d23151438bc0daa89d62a5a29906731f42fcbe9da1cca90d90c2dc8cd4e4b984b8605704a3d84b55346b9b625d120

Download Submit
C:\Windows\system\WlRxtRt.exe

Filesize
1.8MB

MD5
3c712f3df059de90b4bbc678beaec80b

SHA1
fa848aa67771efece1d96e582cdfc0218643c934

SHA256
5d7bd40583163fefe6b900039abe5a235115a8146fa389a77ca8832e9475260e

SHA512
c2d383afa78213795cc556dccdfa8081bbc34af3ecffea8b34077a201aa6cd07ac551ae46c658e12d49aa1f1651aa567f6e341f2d7c57130990d132a5b7034b0

Download Submit
C:\Windows\system\ZfUlKsY.exe

Filesize
1.7MB

MD5
c3eb36e769fe6c8f7e8948fffcffb6e7

SHA1
6b768078b0de16a1301ab0d32f69f56ccf4464f2

SHA256
7600445127d777eb13922c5496e474f35be5158b5a64764cc8bb188ec288ac22

SHA512
9b3069b4a82a72f4c3a2f18e7a1d6004b1c09d1244cb69d5a4f84d8f962fecbd561c667c232b2d9a5261d274e863839054e29efa7f2829535f785ad5c8418f32

Download Submit
C:\Windows\system\cFbjUge.exe

Filesize
1.8MB

MD5
c34889bb9f397b4b59b0777f02ad8a12

SHA1
2b53ebd47ce46bf75e358be77b635ede94485231

SHA256
b547b2c307e33034cbcf1e3953563d4ed4530faa89b5648b8bdbcc61d44b3e46

SHA512
3ea9ec3099b7f049608c155040a462492b7f035c2be41048a589414a13df03d44010bb3af707625e850854786abc55854433a3433f3a9e0b202b8fa2dfcca66f

Download Submit
C:\Windows\system\eckhuLP.exe

Filesize
1.8MB

MD5
82e50c520b30cba576f6567e1afbd795

SHA1
b092564a907d2de64aeaa80390286d4454f00862

SHA256
f58b4892d982fadc41040ab9265b8897ee5d7c433919f48ab32d2eea88d3a288

SHA512
453a7664ce21ab25045a47064f63f94e079e52a03ad3796463813eb454aca8f1eb9ca9af307107893423ffed1757ebe0f3b90907ff0e794ad79c78002b4a1793

Download Submit
C:\Windows\system\fwzpPNb.exe

Filesize
1.8MB

MD5
9f45cdcacf11b85f744fbe5f1d15b966

SHA1
c08d14ef2d86032dda2500e8c7cc18a9d9a5c45b

SHA256
e09642ce584982f3511936068a7aafd867c7eba108fab5121569a8d9e17ff3d0

SHA512
4569c7860797431bc81ff7ab07155f6b127d04a961643d5c19a943b74015dee428c50856bdbd3c70e168d173816faca1e5f2f696ec443e10d161459024d8217f

Download Submit
C:\Windows\system\gymPZvS.exe

Filesize
1.8MB

MD5
f82dd706dabdaac210f71ae62ee33494

SHA1
2fdc4a44a594489af4266e4acd708d56b2c50f1c

SHA256
ab0119ffa21f05d9865d8591912f81f92ff47f7783cf5034c9bfb07ddada6ae0

SHA512
8454eb44ac6a7b6156dff308505d541de8562d1ecf00da96a18a950ab29a5b5788bfb913c166d207a878b558e856b31b9789fb32de884ee692486039eac15f0f

Download Submit
C:\Windows\system\hiyCeAG.exe

Filesize
1.8MB

MD5
5eebb1821c8a056a1369e7c28026a40a

SHA1
0176c06d6b5c91eea52042f7fbc08f400308d59d

SHA256
6bc6ed19a4bbc49c6977f7fc4bbf6298b9930676b7903ad977204bbedd162337

SHA512
9c29b2fa238cc73ec0545b03060488c8abca0c7406b014c7891040124e2b17a07e2a8f84bd97ae21865e7bc9f1bc231e58ebe5f277a6361da01d931d79234dc6

Download Submit
C:\Windows\system\iUcIcYN.exe

Filesize
1.8MB

MD5
8864c81773a146e7ab0bc94de3d75ba7

SHA1
6f63a23d33a9aa64b44767ba0d31fd86a6a9d1a2

SHA256
7bd2d4992f9c8aeb1376ac8fa4c05650ec72052942d3b6e1e64bebb9a348ca86

SHA512
9d1a019764af6f8e55c4b007d39c7527acad0498aeb76d9d6c54beb3343159ff75538eca0a1928d0a9f97db679502fba86c8211ec82a6632ca9de926fcb61071

Download Submit
C:\Windows\system\liNggmO.exe

Filesize
1.8MB

MD5
7775d3b0e5a63bbaacff1f19605d2e86

SHA1
841b0f8f0f8bfcc160f080521feddcb37b217322

SHA256
4ff0ea2d3761acd632e99b71911aab025a6d58deda3d95cd1147f9f909be57e3

SHA512
39b688c95f4c6dca90acb21088cc5c2758c626eda460710232c11043948f6b36fd3fa26a66a90076a779e9e9bf81a1553a76747d043aeac8b53083d806e755e4

Download Submit
C:\Windows\system\nzpGFBu.exe

Filesize
1.8MB

MD5
a9d9732dd1739a3f43d2acc6d45c14e8

SHA1
a5111994ef425968d0a822d06bc14c75e47156a7

SHA256
ad6ad162c447a5db887c1b5321a2e9f70090d14759d9c06b97f6d786b6172571

SHA512
0f14f49ce598308c32f865f88f9fb2b96e4c432c6dde96f54d8331d3fa473f7aec38d99c69a7ee5962cb81f096f358a394182ab671b228cfcd549bba45cc90e5

Download Submit
C:\Windows\system\oqaAsxy.exe

Filesize
1.8MB

MD5
dec566c1fcf640ebd21c85cb6614510e

SHA1
c14f461d4ea69af98144f21630c7de5e47d37bd6

SHA256
5097b0c29bea57332bf89d64779a02abcf9711d1c51c3a19569d003595454ef3

SHA512
4688ad05f7c9f08f49802169ebee051496c7457d955c9c7bbe809030f2fa8681f67d345ec17b86c6902196e91b0d60afda50fbb6fd143cdf03b637b032171afc

Download Submit
\Windows\system\FBatQYX.exe

Filesize
1.8MB

MD5
68f2fdf31c65b15085798ba1a70d4795

SHA1
770012ab1bdbb41acbe765ab3ba79304a29162aa

SHA256
e1f67f59c161bca8623d901581f595d929b706da853fab07a7595bb3c4a76433

SHA512
d178f2b9a80e4d11de79bc185e26dbee47743f7e38410b16c3ce03ceb6eb2e0ddb709d2648a1642e840a3830011432504536a3fc2337e1e30897da6383b3d61b

Download Submit
\Windows\system\JmbaDrp.exe

Filesize
1.8MB

MD5
39ada9fb93d3466d528c9b0f11d8e4ca

SHA1
7189eb4709dbbab6fb4c1edcaff041e1a77c993c

SHA256
6251e2dedbfd0ce57cb417638f9c2128ae483c7e3b088e7ae0ed72da54a418ef

SHA512
3bff39356d8b18c650219bdf62e31d28a6b0e03fcedf65f6a4717f03c6ba41aae4b16850ae7330491847cc469120a113f5172c689e5fd0000ed7233617e26811

Download Submit
\Windows\system\JsouzBz.exe

Filesize
1.8MB

MD5
62f1bd67f1be8c9af4c67bae247980a5

SHA1
a2d108ef464e0c160ea69d5e4b1f06ce46f1b8cd

SHA256
01b759b025aacb6b2e88beee8e08480744da0645b5f2ad2a68393798472cd829

SHA512
f299f4704b5b8e7fb43d0c2e6f84dd9aa54eb7565ba1e376b430e7bd0b7f40bf7961a9b1e95a3d8db6a700adfbfccd3b46c47c8e6b0aa8fcf7031ae6ff7500fc

Download Submit
\Windows\system\LiGmkkq.exe

Filesize
1.8MB

MD5
dc724bef726f67a68388414dd2b678de

SHA1
8999a0e99a6e4c1162c5502a50f08a183ecf650f

SHA256
36e70024c2ff8c6cb7cb2c4046d4a89a761121f4f613f0d95d0f39ac61634f1a

SHA512
30bce654b723964e9aa2bfce1790f49ebd12735b3a459535af82c46e7d7fbdd860606f9edc62cdf22f009c26b0a683cc8908c6c91a80ca75135ca78141f309ea

Download Submit
\Windows\system\MkZprUN.exe

Filesize
1.8MB

MD5
74dea5b4152c1fa9c564c9a0a0ba0d83

SHA1
e91898fe56a31db07dbc7fe4426671f11e092a76

SHA256
3b535cbeb06c16138aec336c73bd86b2331c997906077d2fea89ac7eac59b638

SHA512
b9abbc03f365e1b906becf56847ad05640314b01b022c863bb537685fb4d2ae878aa68b0d0844c7a5e32ef38fa1e7d5b26e9088db210321324db0fb7ce50e8eb

Download Submit
\Windows\system\SOScxvk.exe

Filesize
1.8MB

MD5
a4d02bfdc8a1ec7e73b4980e8733a44e

SHA1
7331ebf562841dc48f8522c8f4ae4ec4bccc0966

SHA256
f8e2e3907a1504ce131f83d9bba5a311805681cddb4c062b04a4d1a55f7f356e

SHA512
c973fdbf7beb5fb2ffe3faca812c17f26d0f190382c4e654bc9255e096d491c40fab042dc42c64aef52d538792fbfb2952345dd4e450c7e0f5da76006a3420aa

Download Submit
\Windows\system\UezRivM.exe

Filesize
1.8MB

MD5
0962ede8e0262d26aad07127db2a1e5d

SHA1
1c24bef4ee7152cf9a9e321c0c87ea1e841c96bc

SHA256
797c20699c0e2e219cc799c900fe79f923afbec4f2f83e56a272b02cff86bd96

SHA512
ec58ee1a5ffdff8195cd7b1f95a54a05ccba9b5fabf743f3b90f15e43b7bc6a909b0caaef1c5552403301590a577eff689fd5c55c6bea855b84b446c97949b2b

Download Submit
\Windows\system\VVfkKbm.exe

Filesize
1.8MB

MD5
ab0b634b1d74373a1b0d6aa6b474cf39

SHA1
28c2f75a88101a01b3c610d8ab2558f411c729e3

SHA256
02dd84f9cdf30a349db0adedf876a89fef4e57532920abcf64829bafaf077dd8

SHA512
fdc05478505ad6432793befe886f7a4fe6b33e3675ece56b0617fbbf6dd90bbcc2bd2a8f16b29d248bc03ac6fb39a8646add667f04a022446093e44cdbf2b178

Download Submit
\Windows\system\ZGGjyTH.exe

Filesize
1.8MB

MD5
d1d619a52cd9dc8754373eab4addde47

SHA1
dc5fd00c9cd1f8432a1ccad6fc8d7567187c6d68

SHA256
5b95121472cfe40ab696cd61b82bc5d54699a745bd87014c004f83069fd79fab

SHA512
3e2f42b9884ee7a8232b416523574900de8432f6dfd75ebc1a72bdcb8a5e6abbbbf4839f2a0e8873452d292cd6cbeaa47bbebca7eacedc7fb56a3147ceb4afe9

Download Submit
\Windows\system\bFNjmIA.exe

Filesize
1.8MB

MD5
ba41af1a65ed457d24bfedb67ff48ff1

SHA1
2768981fc132b2b4e60df99b4cac906102305068

SHA256
49245553250d5e92014f6241ff53b4a08d5b49b9155380011f294aa2a23cc2e8

SHA512
630d544cf571adf0fb453af9e7c0e2ead233f58b8b91e24a3e62fe454c001798af5eee1ddbc344e24cfd3af7b95435df2f7cab60cb5d5cd8fc56ae2d373ae1ae

Download Submit
\Windows\system\cZyRFAl.exe

Filesize
1.8MB

MD5
098dbbed2906182020e6189f63add3ca

SHA1
58b9325a97f38886d72dd6717f165f0b1d53c521

SHA256
6308bf8fb44a1412ffd4dd291fc307f3cea1b8a702d5eafa3f8e83d70906c527

SHA512
f56efa0b8c38d21c135e6d0215d1f543d68b7ee1dd938cf0b07dde04c715c8c58449e05068abdefd3c87333552bb26cd506908a1560c1cd351c85c195b2ff723

Download Submit
\Windows\system\gYKGiHj.exe

Filesize
1.8MB

MD5
e32743e5228d64b75b035b7d2361a85d

SHA1
c7c45678ae52e1a91209b8b435141424bf97232e

SHA256
8ea48f222f6cd777394b2b39c3a5e20d1076d7ca4f7a0869c5ed59dff1acd7ed

SHA512
f00d61e5dddca1a3ad323b2727db10e49183b103e717d1d1f4180e2bbc567de9e7f6ded7c6cacff287387f93c4a46fdb77f29a1f193cf183c17236aba4ce3694

Download Submit
\Windows\system\grGbOGX.exe

Filesize
1.8MB

MD5
03a7ec628ff5b53598427e02223a1320

SHA1
387f5f32409cb453c0a14abfa4983a0be37f98bb

SHA256
bc13e453251215c772ed9b7b41a8ece86a9257ffcda2ff8e6d2f37cd58fe8011

SHA512
f83dd5ca0ff5680ecae3748ee9cab478f1155ca067f7ec23588104de0fbfe60da447f0189a474d26c7118b2187f4cb2a131633e891bea8216af3a384a8343e00

Download Submit
\Windows\system\nNFUXhu.exe

Filesize
1.8MB

MD5
0d048885c20a704252b46bf94c79dc79

SHA1
679c3d0e31a3c8f1f3bb3d6f4b36e8777d2cfe29

SHA256
a35d1943163f1dec4390c1b08f7508a94b4930cdaab06e0df4a6cf506e40b846

SHA512
61ec1f14f357a21bb438fc66ab0b9af008e9313a3946e75c10a0070d2fba627f148be6a9b1e67edf06fe912be4c78875bd04f5bc1f957262f088ceae5be68eb7

Download Submit
\Windows\system\omTKQEV.exe

Filesize
1.8MB

MD5
3b3e2af587de3c2672cc304282c0f758

SHA1
cb9fd24e213f47a20a00f7e82559eefb7cdb705e

SHA256
53aa486f4dbc051780ecfd967ad89ffdd5521a338a71f557088aff6009eae473

SHA512
91ccbba7f52db66d2878a6fb5dbf9cbdde6fd60236c9f91d1e6448fe520e25bb86e9ace2d1ab25ca3a17aeff94b484a2e1e4fa6496a7fb0fe4d774ebe02fbdb6

Download Submit
\Windows\system\uQubETJ.exe

Filesize
1.8MB

MD5
6c7c597db62261a33fdf79ceb0576abd

SHA1
f62a65a697ecc240ad4febc2c397653ad9a9f0fd

SHA256
72f3f8fd2959ba10ba3f29c898e5887fb8b59427c098c0f477d0351ce0ab4e75

SHA512
493c2303e868e6c0477ea605404566e753e3a071992b691c19010a7173eee8887aadb8aa77f5cd587e917871e5b480d5c642c8922c64e7e021c4261c2b0d2398

Download Submit
\Windows\system\umXLwpP.exe

Filesize
1.8MB

MD5
7a2e3ef83f2d3b45ec38df71fa2a399e

SHA1
4001757d9b4b2f07bb5e8b3197738c01ddc8a155

SHA256
060c751835d04a17b0a05ac0c65cd0e45c020cf158bb93e8f6c6d24d34bf8845

SHA512
4cc2d1f24d41ba1a4f3663e7d586ef51f0883bb48dfb2d746a0e09028a104a6dfc2301430994f7bfb443404bda48369412ad66804e47d00dda5953ed17df296f

Download Submit
\Windows\system\vOBPJUs.exe

Filesize
1.8MB

MD5
7edce09d1942eb7161d9fc77392136db

SHA1
ec30cfbb7feb069ba19cc7e816473c95abcddb01

SHA256
38a8e66bf5623906684cad817243712e9dc0aa8da61bb011cae5c3bc535adcf5

SHA512
08c3ac3fed5908bdec7771f78bfa953c4340bd469c63be926ba858e00254ec8b21e428a80bd72165b6b71f09bacf1ddf4bee2fe1a7f2795db15d71da84a86d37

Download Submit
\Windows\system\xomFucN.exe

Filesize
1.8MB

MD5
b4d5491ad31ddaf285dfe064db66b26c

SHA1
3e4979470c0f930e1cc5522153f5e6cdc2f07b70

SHA256
94ad952f82416be1c4cad77fdc7d6242b2bf84ae41d377083a8f3dbc23de5486

SHA512
8794055d71cfae4080e4ec33ee5b669795e179c57791b7053b09d23b7f63310dd5c6100efbd1defe10bc4120ea34b89fe00f986423f42d9fd1a400869d6a65df

Download Submit
memory/952-530-0x000000013F2C0000-0x000000013F6B2000-memory.dmp

Filesize
3.9MB

Download
memory/952-75-0x000000013F2C0000-0x000000013F6B2000-memory.dmp

Filesize
3.9MB

Download
memory/952-1410-0x000000013F2C0000-0x000000013F6B2000-memory.dmp

Filesize
3.9MB

Download
memory/2052-1456-0x000000013FF00000-0x00000001402F2000-memory.dmp

Filesize
3.9MB

Download
memory/2052-96-0x000000013FF00000-0x00000001402F2000-memory.dmp

Filesize
3.9MB

Download
memory/2288-54-0x00000000024F0000-0x00000000024F8000-memory.dmp

Filesize
32KB

Download
memory/2288-71-0x000007FEF6580000-0x000007FEF6F1D000-memory.dmp

Filesize
9.6MB

Download
memory/2288-18-0x00000000023D0000-0x0000000002450000-memory.dmp

Filesize
512KB

Download
memory/2288-49-0x000000001B1B0000-0x000000001B492000-memory.dmp

Filesize
2.9MB

Download
memory/2288-22-0x000007FEF683E000-0x000007FEF683F000-memory.dmp

Filesize
4KB

Download
memory/2288-50-0x000007FEF6580000-0x000007FEF6F1D000-memory.dmp

Filesize
9.6MB

Download
memory/2288-274-0x000007FEF6580000-0x000007FEF6F1D000-memory.dmp

Filesize
9.6MB

Download
memory/2288-53-0x000007FEF6580000-0x000007FEF6F1D000-memory.dmp

Filesize
9.6MB

Download
memory/2372-1369-0x000000013F0D0000-0x000000013F4C2000-memory.dmp

Filesize
3.9MB

Download
memory/2372-81-0x000000013F0D0000-0x000000013F4C2000-memory.dmp

Filesize
3.9MB

Download
memory/2548-0-0x000000013FF90000-0x0000000140382000-memory.dmp

Filesize
3.9MB

Download
memory/2548-80-0x000000013F0D0000-0x000000013F4C2000-memory.dmp

Filesize
3.9MB

Download
memory/2548-73-0x00000000031A0000-0x0000000003592000-memory.dmp

Filesize
3.9MB

Download
memory/2548-728-0x00000000031A0000-0x0000000003592000-memory.dmp

Filesize
3.9MB

Download
memory/2548-64-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/2548-62-0x00000000031A0000-0x0000000003592000-memory.dmp

Filesize
3.9MB

Download
memory/2548-1-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/2548-20-0x0000000002D70000-0x0000000003162000-memory.dmp

Filesize
3.9MB

Download
memory/2548-726-0x00000000031A0000-0x0000000003592000-memory.dmp

Filesize
3.9MB

Download
memory/2548-74-0x000000013F2C0000-0x000000013F6B2000-memory.dmp

Filesize
3.9MB

Download
memory/2548-217-0x000000013FF90000-0x0000000140382000-memory.dmp

Filesize
3.9MB

Download
memory/2548-216-0x000000013FF90000-0x0000000140382000-memory.dmp

Filesize
3.9MB

Download
memory/2548-68-0x00000000031A0000-0x0000000003592000-memory.dmp

Filesize
3.9MB

Download
memory/2548-12-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/2548-58-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/2548-77-0x00000000031A0000-0x0000000003592000-memory.dmp

Filesize
3.9MB

Download
memory/2548-99-0x000000013F320000-0x000000013F712000-memory.dmp

Filesize
3.9MB

Download
memory/2548-66-0x00000000031A0000-0x0000000003592000-memory.dmp

Filesize
3.9MB

Download
memory/2656-1387-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2656-63-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2672-89-0x000000013FFC0000-0x00000001403B2000-memory.dmp

Filesize
3.9MB

Download
memory/2672-1404-0x000000013FFC0000-0x00000001403B2000-memory.dmp

Filesize
3.9MB

Download
memory/2748-1413-0x000000013FD60000-0x0000000140152000-memory.dmp

Filesize
3.9MB

Download
memory/2748-55-0x000000013FD60000-0x0000000140152000-memory.dmp

Filesize
3.9MB

Download
memory/2780-17-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/2780-1385-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/2820-1414-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/2820-65-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/2844-1441-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/2844-61-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/2884-1460-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/2884-67-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/2892-21-0x000000013FBC0000-0x000000013FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/2892-1406-0x000000013FBC0000-0x000000013FFB2000-memory.dmp

Filesize
3.9MB

Download