xmrig | 81f924925a5327a169701722ec0816a243a3e93d9fdacc4d32f3cb0d94bf08dc

Analysis

max time kernel
119s
max time network
117s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 23:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
Size

1.9MB
MD5

1f9a1ef5c1cc15c14c4eaef1ac92bdd0
SHA1

86e14787d75590e1aad94f40c61ed1772c34a7b4
SHA256

81f924925a5327a169701722ec0816a243a3e93d9fdacc4d32f3cb0d94bf08dc
SHA512

f7ad48ca95f5d83f528e5e266350ae2658f81f2bfc9d71d05fa4034988776af8f48feb423d4da7589543cf301e768c3af9cf7189fad64097bed000ed67d2ef55
SSDEEP

49152:Lz071uv4BPMkyW10/w16BvZX71Fq86z71pg:NABI

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 8 IoCs

miner

resource	yara_rule
behavioral1/memory/1952-9-0x000000013F910000-0x000000013FD02000-memory.dmp	xmrig
behavioral1/memory/2240-16-0x000000013F890000-0x000000013FC82000-memory.dmp	xmrig
behavioral1/memory/1108-57-0x000000013FB50000-0x000000013FF42000-memory.dmp	xmrig
behavioral1/memory/3000-29-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	xmrig
behavioral1/memory/1952-4027-0x000000013F910000-0x000000013FD02000-memory.dmp	xmrig
behavioral1/memory/2240-4028-0x000000013F890000-0x000000013FC82000-memory.dmp	xmrig
behavioral1/memory/2136-4034-0x000000013F130000-0x000000013F522000-memory.dmp	xmrig
behavioral1/memory/2416-6273-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2532	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1952	arvQdHc.exe
2240	TwapcIm.exe
3000	tNhRWtK.exe
1108	WuMOKXy.exe
2136	yZZvFSK.exe
2828	ZtoUCGT.exe
2728	bbZWXsC.exe
2996	nefOluA.exe
2164	sUqvaCF.exe
2652	YJhUphF.exe
2344	sEffNVF.exe
2596	kxfJIvv.exe
2936	SKTivFA.exe
2516	BryuBSO.exe
2788	NieImPh.exe
2896	wagsXQh.exe
2040	QmOZKYP.exe
876	DwCinZC.exe
3024	FJTMnSS.exe
868	wlRJqBN.exe
2824	xxqKbfg.exe
3032	eIRRstr.exe
1960	ZRosUMK.exe
1696	cXdNhnd.exe
1548	FpiDByu.exe
760	qKmftFD.exe
3004	NQvmmpU.exe
344	nrizsHz.exe
844	ctNNPop.exe
2068	mMJcuas.exe
1572	xTTVKgf.exe
2544	cukLcKx.exe
980	SGBZmhP.exe
3080	MpCMpqr.exe
3116	vYoNllX.exe
3156	rnwcmhW.exe
3188	JRQIekZ.exe
3236	wKErRdm.exe
3272	EJmuFia.exe
3304	iMOATWM.exe
3340	gsZnSlN.exe
3376	ZYyNFPb.exe
2744	RSpzMXI.exe
2648	KSiyugz.exe
2612	FpvFGjy.exe
2660	MSjNsOK.exe
1316	EKPoGKO.exe
2708	ryEteFh.exe
1688	EftOjor.exe
1092	cbNAUir.exe
2892	ARRelyM.exe
3524	KJUTmBL.exe
2388	TMoGcEn.exe
3028	aNdDUCb.exe
3064	EMwTSGE.exe
1948	WQcZnem.exe
3052	jNkHLdM.exe
1680	PIxhrwm.exe
1088	XLvUpRs.exe
356	TqfLGze.exe
3556	quYdwsJ.exe
1764	xHrcgKM.exe
320	YCVhFCR.exe
708	ypXFesS.exe

Loads dropped DLL 64 IoCs

pid	Process
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe

UPX packed file 54 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2416-0-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	upx
behavioral1/files/0x00080000000120f9-6.dat	upx
behavioral1/memory/1952-9-0x000000013F910000-0x000000013FD02000-memory.dmp	upx
behavioral1/files/0x0008000000015d29-10.dat	upx
behavioral1/memory/2240-16-0x000000013F890000-0x000000013FC82000-memory.dmp	upx
behavioral1/files/0x0007000000015d4b-14.dat	upx
behavioral1/files/0x0007000000015d57-22.dat	upx
behavioral1/files/0x000500000001945a-196.dat	upx
behavioral1/files/0x0005000000019427-191.dat	upx
behavioral1/files/0x0005000000019409-190.dat	upx
behavioral1/memory/2416-188-0x0000000003600000-0x00000000039F2000-memory.dmp	upx
behavioral1/files/0x00050000000193c5-186.dat	upx
behavioral1/files/0x0005000000019338-184.dat	upx
behavioral1/files/0x00060000000190bc-183.dat	upx
behavioral1/files/0x000500000001960f-182.dat	upx
behavioral1/files/0x000500000001960b-176.dat	upx
behavioral1/files/0x0005000000019607-170.dat	upx
behavioral1/files/0x0005000000019585-163.dat	upx
behavioral1/files/0x00050000000194f7-157.dat	upx
behavioral1/files/0x0007000000015d68-146.dat	upx
behavioral1/files/0x0005000000019452-143.dat	upx
behavioral1/files/0x000500000001940b-136.dat	upx
behavioral1/files/0x00050000000193df-130.dat	upx
behavioral1/files/0x0009000000018654-119.dat	upx
behavioral1/files/0x0008000000016c49-118.dat	upx
behavioral1/files/0x00050000000193bb-115.dat	upx
behavioral1/files/0x00050000000192fd-108.dat	upx
behavioral1/files/0x0009000000015d74-103.dat	upx
behavioral1/files/0x0009000000015cd6-101.dat	upx
behavioral1/files/0x0006000000018bcd-100.dat	upx
behavioral1/files/0x0006000000018b6a-91.dat	upx
behavioral1/memory/2136-87-0x000000013F130000-0x000000013F522000-memory.dmp	upx
behavioral1/files/0x000500000001877e-84.dat	upx
behavioral1/files/0x0007000000015d5f-79.dat	upx
behavioral1/files/0x0006000000018764-76.dat	upx
behavioral1/files/0x00050000000186ff-70.dat	upx
behavioral1/files/0x00050000000186ed-59.dat	upx
behavioral1/files/0x0015000000018649-51.dat	upx
behavioral1/files/0x0009000000015d88-43.dat	upx
behavioral1/files/0x000500000001960d-179.dat	upx
behavioral1/files/0x000500000001950b-160.dat	upx
behavioral1/files/0x0006000000018bb9-129.dat	upx
behavioral1/files/0x0005000000018792-128.dat	upx
behavioral1/files/0x0005000000018777-127.dat	upx
behavioral1/files/0x000f00000000549c-126.dat	upx
behavioral1/files/0x00050000000186ef-123.dat	upx
behavioral1/files/0x0005000000019609-173.dat	upx
behavioral1/files/0x00050000000195d8-166.dat	upx
behavioral1/memory/1108-57-0x000000013FB50000-0x000000013FF42000-memory.dmp	upx
behavioral1/memory/3000-29-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	upx
behavioral1/memory/1952-4027-0x000000013F910000-0x000000013FD02000-memory.dmp	upx
behavioral1/memory/2240-4028-0x000000013F890000-0x000000013FC82000-memory.dmp	upx
behavioral1/memory/2136-4034-0x000000013F130000-0x000000013F522000-memory.dmp	upx
behavioral1/memory/2416-6273-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\NaxJTXB.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\TiomWOB.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\hgeUKZn.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\MXzRPYe.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\BSAAzxY.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\tUPZTdP.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\NoLEdCv.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\bhpHvLE.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\sVEgNap.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\VOUpXMZ.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\MBJypyM.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\bSnbGPB.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\iybLYPA.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\shREOeX.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\MFXkASO.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\vRILkQJ.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\jfviIRT.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\zOUprek.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\pddWNTb.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\xIhElaC.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\adXBhTI.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\ETgVAqZ.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\TaFXaaa.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\EwHogCd.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\goimQTn.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\ZxryLSP.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\fXouHnh.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\MHLVOUG.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\DGNgbnR.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\OXsmnvN.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\AXmZTdc.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\DjWYhXE.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\BilGnxk.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\tHfoTiM.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\ITokFeJ.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\YAUtERD.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\pbmoCrX.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\SyyFiiv.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\ddLRSNx.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\gthTfRt.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\gLcoolV.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\JsqgJWV.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\PlbYPRm.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\naGzfrz.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\HhtnDiG.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\VmPRrjf.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\JJWtwkO.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\ycPArua.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\OvxBDtN.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\asBHTqV.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\EgJaXuQ.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\agzOlAu.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\XRfgrNS.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\MlDnXHw.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\oUlkscT.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\RZXDcXa.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\sBggtNX.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\tSTJkIR.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\uGXquop.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\XXjgPVx.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\vUOGQnq.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\HhJkvRU.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\VBYfqma.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
File created	C:\Windows\System\BVUbJZB.exe	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2532	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
Token: SeLockMemoryPrivilege	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
Token: SeDebugPrivilege	2532	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2532	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	31
PID 2416 wrote to memory of 2532	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	31
PID 2416 wrote to memory of 2532	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	31
PID 2416 wrote to memory of 1952	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	32
PID 2416 wrote to memory of 1952	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	32
PID 2416 wrote to memory of 1952	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	32
PID 2416 wrote to memory of 2240	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	33
PID 2416 wrote to memory of 2240	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	33
PID 2416 wrote to memory of 2240	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	33
PID 2416 wrote to memory of 3000	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	34
PID 2416 wrote to memory of 3000	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	34
PID 2416 wrote to memory of 3000	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	34
PID 2416 wrote to memory of 1108	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	35
PID 2416 wrote to memory of 1108	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	35
PID 2416 wrote to memory of 1108	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	35
PID 2416 wrote to memory of 2136	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	37
PID 2416 wrote to memory of 2136	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	37
PID 2416 wrote to memory of 2136	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	37
PID 2416 wrote to memory of 2828	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	38
PID 2416 wrote to memory of 2828	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	38
PID 2416 wrote to memory of 2828	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	38
PID 2416 wrote to memory of 2788	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	39
PID 2416 wrote to memory of 2788	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	39
PID 2416 wrote to memory of 2788	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	39
PID 2416 wrote to memory of 2728	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	40
PID 2416 wrote to memory of 2728	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	40
PID 2416 wrote to memory of 2728	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	40
PID 2416 wrote to memory of 2744	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	41
PID 2416 wrote to memory of 2744	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	41
PID 2416 wrote to memory of 2744	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	41
PID 2416 wrote to memory of 2996	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	42
PID 2416 wrote to memory of 2996	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	42
PID 2416 wrote to memory of 2996	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	42
PID 2416 wrote to memory of 2648	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	43
PID 2416 wrote to memory of 2648	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	43
PID 2416 wrote to memory of 2648	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	43
PID 2416 wrote to memory of 2164	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	44
PID 2416 wrote to memory of 2164	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	44
PID 2416 wrote to memory of 2164	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	44
PID 2416 wrote to memory of 2612	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	45
PID 2416 wrote to memory of 2612	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	45
PID 2416 wrote to memory of 2612	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	45
PID 2416 wrote to memory of 2652	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	46
PID 2416 wrote to memory of 2652	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	46
PID 2416 wrote to memory of 2652	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	46
PID 2416 wrote to memory of 2660	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	47
PID 2416 wrote to memory of 2660	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	47
PID 2416 wrote to memory of 2660	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	47
PID 2416 wrote to memory of 2344	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	48
PID 2416 wrote to memory of 2344	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	48
PID 2416 wrote to memory of 2344	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	48
PID 2416 wrote to memory of 1316	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	49
PID 2416 wrote to memory of 1316	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	49
PID 2416 wrote to memory of 1316	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	49
PID 2416 wrote to memory of 2596	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	50
PID 2416 wrote to memory of 2596	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	50
PID 2416 wrote to memory of 2596	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	50
PID 2416 wrote to memory of 2708	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	51
PID 2416 wrote to memory of 2708	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	51
PID 2416 wrote to memory of 2708	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	51
PID 2416 wrote to memory of 2936	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	52
PID 2416 wrote to memory of 2936	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	52
PID 2416 wrote to memory of 2936	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	52
PID 2416 wrote to memory of 1688	2416	1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe	53

C:\Users\Admin\AppData\Local\Temp\1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe
"C:\Users\Admin\AppData\Local\Temp\1f9a1ef5c1cc15c14c4eaef1ac92bdd0N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2532
- C:\Windows\System\arvQdHc.exe
  C:\Windows\System\arvQdHc.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\TwapcIm.exe
  C:\Windows\System\TwapcIm.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\tNhRWtK.exe
  C:\Windows\System\tNhRWtK.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\WuMOKXy.exe
  C:\Windows\System\WuMOKXy.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\yZZvFSK.exe
  C:\Windows\System\yZZvFSK.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\ZtoUCGT.exe
  C:\Windows\System\ZtoUCGT.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\NieImPh.exe
  C:\Windows\System\NieImPh.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\bbZWXsC.exe
  C:\Windows\System\bbZWXsC.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\RSpzMXI.exe
  C:\Windows\System\RSpzMXI.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\nefOluA.exe
  C:\Windows\System\nefOluA.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\KSiyugz.exe
  C:\Windows\System\KSiyugz.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\sUqvaCF.exe
  C:\Windows\System\sUqvaCF.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\FpvFGjy.exe
  C:\Windows\System\FpvFGjy.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\YJhUphF.exe
  C:\Windows\System\YJhUphF.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\MSjNsOK.exe
  C:\Windows\System\MSjNsOK.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\sEffNVF.exe
  C:\Windows\System\sEffNVF.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\EKPoGKO.exe
  C:\Windows\System\EKPoGKO.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\kxfJIvv.exe
  C:\Windows\System\kxfJIvv.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\ryEteFh.exe
  C:\Windows\System\ryEteFh.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\SKTivFA.exe
  C:\Windows\System\SKTivFA.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\EftOjor.exe
  C:\Windows\System\EftOjor.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\BryuBSO.exe
  C:\Windows\System\BryuBSO.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\cbNAUir.exe
  C:\Windows\System\cbNAUir.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\wagsXQh.exe
  C:\Windows\System\wagsXQh.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\ARRelyM.exe
  C:\Windows\System\ARRelyM.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\QmOZKYP.exe
  C:\Windows\System\QmOZKYP.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\TMoGcEn.exe
  C:\Windows\System\TMoGcEn.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\DwCinZC.exe
  C:\Windows\System\DwCinZC.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\aNdDUCb.exe
  C:\Windows\System\aNdDUCb.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\FJTMnSS.exe
  C:\Windows\System\FJTMnSS.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\EMwTSGE.exe
  C:\Windows\System\EMwTSGE.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\wlRJqBN.exe
  C:\Windows\System\wlRJqBN.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\WQcZnem.exe
  C:\Windows\System\WQcZnem.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\xxqKbfg.exe
  C:\Windows\System\xxqKbfg.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\jNkHLdM.exe
  C:\Windows\System\jNkHLdM.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\eIRRstr.exe
  C:\Windows\System\eIRRstr.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\PIxhrwm.exe
  C:\Windows\System\PIxhrwm.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\ZRosUMK.exe
  C:\Windows\System\ZRosUMK.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\XLvUpRs.exe
  C:\Windows\System\XLvUpRs.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\cXdNhnd.exe
  C:\Windows\System\cXdNhnd.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\TqfLGze.exe
  C:\Windows\System\TqfLGze.exe
  2⤵
  - Executes dropped EXE
  PID:356
- C:\Windows\System\FpiDByu.exe
  C:\Windows\System\FpiDByu.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\xHrcgKM.exe
  C:\Windows\System\xHrcgKM.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\qKmftFD.exe
  C:\Windows\System\qKmftFD.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\YCVhFCR.exe
  C:\Windows\System\YCVhFCR.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\NQvmmpU.exe
  C:\Windows\System\NQvmmpU.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\ypXFesS.exe
  C:\Windows\System\ypXFesS.exe
  2⤵
  - Executes dropped EXE
  PID:708
- C:\Windows\System\nrizsHz.exe
  C:\Windows\System\nrizsHz.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\jGxEyRP.exe
  C:\Windows\System\jGxEyRP.exe
  2⤵
  PID:2404
- C:\Windows\System\ctNNPop.exe
  C:\Windows\System\ctNNPop.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\ZBvpHQN.exe
  C:\Windows\System\ZBvpHQN.exe
  2⤵
  PID:872
- C:\Windows\System\mMJcuas.exe
  C:\Windows\System\mMJcuas.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\qZlwhps.exe
  C:\Windows\System\qZlwhps.exe
  2⤵
  PID:1340
- C:\Windows\System\xTTVKgf.exe
  C:\Windows\System\xTTVKgf.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\HpWcwoX.exe
  C:\Windows\System\HpWcwoX.exe
  2⤵
  PID:1612
- C:\Windows\System\cukLcKx.exe
  C:\Windows\System\cukLcKx.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\arAbrkZ.exe
  C:\Windows\System\arAbrkZ.exe
  2⤵
  PID:2688
- C:\Windows\System\SGBZmhP.exe
  C:\Windows\System\SGBZmhP.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\azwPliN.exe
  C:\Windows\System\azwPliN.exe
  2⤵
  PID:2740
- C:\Windows\System\MpCMpqr.exe
  C:\Windows\System\MpCMpqr.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\QlFUevW.exe
  C:\Windows\System\QlFUevW.exe
  2⤵
  PID:3096
- C:\Windows\System\vYoNllX.exe
  C:\Windows\System\vYoNllX.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\prIuTiz.exe
  C:\Windows\System\prIuTiz.exe
  2⤵
  PID:3132
- C:\Windows\System\rnwcmhW.exe
  C:\Windows\System\rnwcmhW.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\kNIFncW.exe
  C:\Windows\System\kNIFncW.exe
  2⤵
  PID:3172
- C:\Windows\System\JRQIekZ.exe
  C:\Windows\System\JRQIekZ.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\dLyrXLx.exe
  C:\Windows\System\dLyrXLx.exe
  2⤵
  PID:3216
- C:\Windows\System\wKErRdm.exe
  C:\Windows\System\wKErRdm.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\uKyEnQf.exe
  C:\Windows\System\uKyEnQf.exe
  2⤵
  PID:3252
- C:\Windows\System\EJmuFia.exe
  C:\Windows\System\EJmuFia.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\eoBySNs.exe
  C:\Windows\System\eoBySNs.exe
  2⤵
  PID:3288
- C:\Windows\System\iMOATWM.exe
  C:\Windows\System\iMOATWM.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System\lwELlYn.exe
  C:\Windows\System\lwELlYn.exe
  2⤵
  PID:3320
- C:\Windows\System\gsZnSlN.exe
  C:\Windows\System\gsZnSlN.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\qjdesde.exe
  C:\Windows\System\qjdesde.exe
  2⤵
  PID:3360
- C:\Windows\System\ZYyNFPb.exe
  C:\Windows\System\ZYyNFPb.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\SZFDUXO.exe
  C:\Windows\System\SZFDUXO.exe
  2⤵
  PID:3504
- C:\Windows\System\KJUTmBL.exe
  C:\Windows\System\KJUTmBL.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\lXOvIjX.exe
  C:\Windows\System\lXOvIjX.exe
  2⤵
  PID:3540
- C:\Windows\System\quYdwsJ.exe
  C:\Windows\System\quYdwsJ.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\qVXpwMc.exe
  C:\Windows\System\qVXpwMc.exe
  2⤵
  PID:3576
- C:\Windows\System\iqIKbdB.exe
  C:\Windows\System\iqIKbdB.exe
  2⤵
  PID:3592
- C:\Windows\System\cqKYtXd.exe
  C:\Windows\System\cqKYtXd.exe
  2⤵
  PID:3608
- C:\Windows\System\VxzIttJ.exe
  C:\Windows\System\VxzIttJ.exe
  2⤵
  PID:3632
- C:\Windows\System\gQwhgEO.exe
  C:\Windows\System\gQwhgEO.exe
  2⤵
  PID:3648
- C:\Windows\System\xJboNXc.exe
  C:\Windows\System\xJboNXc.exe
  2⤵
  PID:3664
- C:\Windows\System\KcUcNWi.exe
  C:\Windows\System\KcUcNWi.exe
  2⤵
  PID:3680
- C:\Windows\System\nQFAwdD.exe
  C:\Windows\System\nQFAwdD.exe
  2⤵
  PID:3700
- C:\Windows\System\lWUmfAz.exe
  C:\Windows\System\lWUmfAz.exe
  2⤵
  PID:3716
- C:\Windows\System\WhUKdHp.exe
  C:\Windows\System\WhUKdHp.exe
  2⤵
  PID:3732
- C:\Windows\System\sifqSQC.exe
  C:\Windows\System\sifqSQC.exe
  2⤵
  PID:3820
- C:\Windows\System\QDlFfPs.exe
  C:\Windows\System\QDlFfPs.exe
  2⤵
  PID:3836
- C:\Windows\System\SuiNuMS.exe
  C:\Windows\System\SuiNuMS.exe
  2⤵
  PID:3856
- C:\Windows\System\yHNMxrx.exe
  C:\Windows\System\yHNMxrx.exe
  2⤵
  PID:3872
- C:\Windows\System\JnWpyOs.exe
  C:\Windows\System\JnWpyOs.exe
  2⤵
  PID:3892
- C:\Windows\System\pHFAwiA.exe
  C:\Windows\System\pHFAwiA.exe
  2⤵
  PID:3908
- C:\Windows\System\xXttjyh.exe
  C:\Windows\System\xXttjyh.exe
  2⤵
  PID:3928
- C:\Windows\System\INsDBqs.exe
  C:\Windows\System\INsDBqs.exe
  2⤵
  PID:3944
- C:\Windows\System\tdWEzuw.exe
  C:\Windows\System\tdWEzuw.exe
  2⤵
  PID:3964
- C:\Windows\System\MBwwBBX.exe
  C:\Windows\System\MBwwBBX.exe
  2⤵
  PID:3980
- C:\Windows\System\ULcUOUC.exe
  C:\Windows\System\ULcUOUC.exe
  2⤵
  PID:4004
- C:\Windows\System\eSWkRoR.exe
  C:\Windows\System\eSWkRoR.exe
  2⤵
  PID:4020
- C:\Windows\System\KdIGcQp.exe
  C:\Windows\System\KdIGcQp.exe
  2⤵
  PID:4040
- C:\Windows\System\hLAKkFt.exe
  C:\Windows\System\hLAKkFt.exe
  2⤵
  PID:4056
- C:\Windows\System\DYYOXtD.exe
  C:\Windows\System\DYYOXtD.exe
  2⤵
  PID:4076
- C:\Windows\System\uHSGwWD.exe
  C:\Windows\System\uHSGwWD.exe
  2⤵
  PID:4092
- C:\Windows\System\hZcNioR.exe
  C:\Windows\System\hZcNioR.exe
  2⤵
  PID:2972
- C:\Windows\System\mhudEDD.exe
  C:\Windows\System\mhudEDD.exe
  2⤵
  PID:2608
- C:\Windows\System\qcXzply.exe
  C:\Windows\System\qcXzply.exe
  2⤵
  PID:2056
- C:\Windows\System\dnUYvZJ.exe
  C:\Windows\System\dnUYvZJ.exe
  2⤵
  PID:1992
- C:\Windows\System\kcCVIXA.exe
  C:\Windows\System\kcCVIXA.exe
  2⤵
  PID:300
- C:\Windows\System\sCyagcf.exe
  C:\Windows\System\sCyagcf.exe
  2⤵
  PID:2968
- C:\Windows\System\BHUQutd.exe
  C:\Windows\System\BHUQutd.exe
  2⤵
  PID:2888
- C:\Windows\System\EhzdNil.exe
  C:\Windows\System\EhzdNil.exe
  2⤵
  PID:1620
- C:\Windows\System\kUBWVOK.exe
  C:\Windows\System\kUBWVOK.exe
  2⤵
  PID:1348
- C:\Windows\System\dZJJAty.exe
  C:\Windows\System\dZJJAty.exe
  2⤵
  PID:1940
- C:\Windows\System\uHnMkKb.exe
  C:\Windows\System\uHnMkKb.exe
  2⤵
  PID:2308
- C:\Windows\System\tSTJkIR.exe
  C:\Windows\System\tSTJkIR.exe
  2⤵
  PID:880
- C:\Windows\System\PpiYtkc.exe
  C:\Windows\System\PpiYtkc.exe
  2⤵
  PID:1712
- C:\Windows\System\hmZuHmA.exe
  C:\Windows\System\hmZuHmA.exe
  2⤵
  PID:2800
- C:\Windows\System\uMwHoLj.exe
  C:\Windows\System\uMwHoLj.exe
  2⤵
  PID:3128
- C:\Windows\System\LNpDSVM.exe
  C:\Windows\System\LNpDSVM.exe
  2⤵
  PID:3200
- C:\Windows\System\OKZgVsr.exe
  C:\Windows\System\OKZgVsr.exe
  2⤵
  PID:3352
- C:\Windows\System\oymfFhr.exe
  C:\Windows\System\oymfFhr.exe
  2⤵
  PID:3532
- C:\Windows\System\JAbZfBn.exe
  C:\Windows\System\JAbZfBn.exe
  2⤵
  PID:2332
- C:\Windows\System\rWQorLX.exe
  C:\Windows\System\rWQorLX.exe
  2⤵
  PID:900
- C:\Windows\System\bohKBqM.exe
  C:\Windows\System\bohKBqM.exe
  2⤵
  PID:3600
- C:\Windows\System\QdntBvN.exe
  C:\Windows\System\QdntBvN.exe
  2⤵
  PID:3672
- C:\Windows\System\QuPvNSS.exe
  C:\Windows\System\QuPvNSS.exe
  2⤵
  PID:3748
- C:\Windows\System\LnGATmC.exe
  C:\Windows\System\LnGATmC.exe
  2⤵
  PID:3772
- C:\Windows\System\kqnXKDR.exe
  C:\Windows\System\kqnXKDR.exe
  2⤵
  PID:3792
- C:\Windows\System\DAegsAu.exe
  C:\Windows\System\DAegsAu.exe
  2⤵
  PID:3812
- C:\Windows\System\ndYIHVa.exe
  C:\Windows\System\ndYIHVa.exe
  2⤵
  PID:3880
- C:\Windows\System\mMDFMVN.exe
  C:\Windows\System\mMDFMVN.exe
  2⤵
  PID:2224
- C:\Windows\System\geblxhz.exe
  C:\Windows\System\geblxhz.exe
  2⤵
  PID:636
- C:\Windows\System\xmpzOby.exe
  C:\Windows\System\xmpzOby.exe
  2⤵
  PID:3124
- C:\Windows\System\AWKuFie.exe
  C:\Windows\System\AWKuFie.exe
  2⤵
  PID:916
- C:\Windows\System\sePjWnw.exe
  C:\Windows\System\sePjWnw.exe
  2⤵
  PID:1976
- C:\Windows\System\tVYdfku.exe
  C:\Windows\System\tVYdfku.exe
  2⤵
  PID:3332
- C:\Windows\System\QynrwVt.exe
  C:\Windows\System\QynrwVt.exe
  2⤵
  PID:2296
- C:\Windows\System\RfclzKg.exe
  C:\Windows\System\RfclzKg.exe
  2⤵
  PID:1240
- C:\Windows\System\BrSuTuS.exe
  C:\Windows\System\BrSuTuS.exe
  2⤵
  PID:1824
- C:\Windows\System\wzsJgoE.exe
  C:\Windows\System\wzsJgoE.exe
  2⤵
  PID:3368
- C:\Windows\System\feHSIGR.exe
  C:\Windows\System\feHSIGR.exe
  2⤵
  PID:3296
- C:\Windows\System\RkJXSjC.exe
  C:\Windows\System\RkJXSjC.exe
  2⤵
  PID:3180
- C:\Windows\System\HxVhUzh.exe
  C:\Windows\System\HxVhUzh.exe
  2⤵
  PID:3076
- C:\Windows\System\lvVcahD.exe
  C:\Windows\System\lvVcahD.exe
  2⤵
  PID:3588
- C:\Windows\System\OzKbhuf.exe
  C:\Windows\System\OzKbhuf.exe
  2⤵
  PID:3248
- C:\Windows\System\EKUCrvg.exe
  C:\Windows\System\EKUCrvg.exe
  2⤵
  PID:3348
- C:\Windows\System\qqqasdy.exe
  C:\Windows\System\qqqasdy.exe
  2⤵
  PID:2152
- C:\Windows\System\QQCTMHq.exe
  C:\Windows\System\QQCTMHq.exe
  2⤵
  PID:1736
- C:\Windows\System\aHXWepo.exe
  C:\Windows\System\aHXWepo.exe
  2⤵
  PID:3744
- C:\Windows\System\suJSMcL.exe
  C:\Windows\System\suJSMcL.exe
  2⤵
  PID:3784
- C:\Windows\System\zYzllsJ.exe
  C:\Windows\System\zYzllsJ.exe
  2⤵
  PID:3852
- C:\Windows\System\ImaEfjw.exe
  C:\Windows\System\ImaEfjw.exe
  2⤵
  PID:3692
- C:\Windows\System\QYrobXW.exe
  C:\Windows\System\QYrobXW.exe
  2⤵
  PID:2244
- C:\Windows\System\uDDFpSo.exe
  C:\Windows\System\uDDFpSo.exe
  2⤵
  PID:2880
- C:\Windows\System\yBTbrBj.exe
  C:\Windows\System\yBTbrBj.exe
  2⤵
  PID:3900
- C:\Windows\System\fRXTSoR.exe
  C:\Windows\System\fRXTSoR.exe
  2⤵
  PID:3400
- C:\Windows\System\NKuigeq.exe
  C:\Windows\System\NKuigeq.exe
  2⤵
  PID:2988
- C:\Windows\System\ySEwTPA.exe
  C:\Windows\System\ySEwTPA.exe
  2⤵
  PID:2628
- C:\Windows\System\QRrDQNu.exe
  C:\Windows\System\QRrDQNu.exe
  2⤵
  PID:1476
- C:\Windows\System\WPnLEWu.exe
  C:\Windows\System\WPnLEWu.exe
  2⤵
  PID:2032
- C:\Windows\System\oFiLaCE.exe
  C:\Windows\System\oFiLaCE.exe
  2⤵
  PID:2796
- C:\Windows\System\gewMWqs.exe
  C:\Windows\System\gewMWqs.exe
  2⤵
  PID:1516
- C:\Windows\System\YvBwKIc.exe
  C:\Windows\System\YvBwKIc.exe
  2⤵
  PID:1312
- C:\Windows\System\nCvhzUf.exe
  C:\Windows\System\nCvhzUf.exe
  2⤵
  PID:3640
- C:\Windows\System\SznFBGz.exe
  C:\Windows\System\SznFBGz.exe
  2⤵
  PID:3760
- C:\Windows\System\YlrqwwB.exe
  C:\Windows\System\YlrqwwB.exe
  2⤵
  PID:3804
- C:\Windows\System\SxfqgCa.exe
  C:\Windows\System\SxfqgCa.exe
  2⤵
  PID:3920
- C:\Windows\System\wQZluER.exe
  C:\Windows\System\wQZluER.exe
  2⤵
  PID:3956
- C:\Windows\System\ILNvrmM.exe
  C:\Windows\System\ILNvrmM.exe
  2⤵
  PID:3992
- C:\Windows\System\zkyfoIe.exe
  C:\Windows\System\zkyfoIe.exe
  2⤵
  PID:1592
- C:\Windows\System\fpLPgXC.exe
  C:\Windows\System\fpLPgXC.exe
  2⤵
  PID:3196
- C:\Windows\System\AajKFjy.exe
  C:\Windows\System\AajKFjy.exe
  2⤵
  PID:1496
- C:\Windows\System\BSvoxrO.exe
  C:\Windows\System\BSvoxrO.exe
  2⤵
  PID:1924
- C:\Windows\System\RTurymj.exe
  C:\Windows\System\RTurymj.exe
  2⤵
  PID:676
- C:\Windows\System\HqArQMP.exe
  C:\Windows\System\HqArQMP.exe
  2⤵
  PID:4052
- C:\Windows\System\TwUupfO.exe
  C:\Windows\System\TwUupfO.exe
  2⤵
  PID:448
- C:\Windows\System\ucnybZE.exe
  C:\Windows\System\ucnybZE.exe
  2⤵
  PID:3208
- C:\Windows\System\FJNOkOk.exe
  C:\Windows\System\FJNOkOk.exe
  2⤵
  PID:3088
- C:\Windows\System\zYBtNIc.exe
  C:\Windows\System\zYBtNIc.exe
  2⤵
  PID:3232
- C:\Windows\System\ptpHoWK.exe
  C:\Windows\System\ptpHoWK.exe
  2⤵
  PID:3516
- C:\Windows\System\qfvooqa.exe
  C:\Windows\System\qfvooqa.exe
  2⤵
  PID:3224
- C:\Windows\System\PUnICDV.exe
  C:\Windows\System\PUnICDV.exe
  2⤵
  PID:2312
- C:\Windows\System\oOSjjYs.exe
  C:\Windows\System\oOSjjYs.exe
  2⤵
  PID:2036
- C:\Windows\System\yCLveIg.exe
  C:\Windows\System\yCLveIg.exe
  2⤵
  PID:2992
- C:\Windows\System\WTdmlZc.exe
  C:\Windows\System\WTdmlZc.exe
  2⤵
  PID:1984
- C:\Windows\System\rcgcRCO.exe
  C:\Windows\System\rcgcRCO.exe
  2⤵
  PID:2704
- C:\Windows\System\ljqgZKd.exe
  C:\Windows\System\ljqgZKd.exe
  2⤵
  PID:2724
- C:\Windows\System\iXhfSGF.exe
  C:\Windows\System\iXhfSGF.exe
  2⤵
  PID:3776
- C:\Windows\System\gpCAuBO.exe
  C:\Windows\System\gpCAuBO.exe
  2⤵
  PID:1956
- C:\Windows\System\aWiMTaR.exe
  C:\Windows\System\aWiMTaR.exe
  2⤵
  PID:2792
- C:\Windows\System\sHpnkQq.exe
  C:\Windows\System\sHpnkQq.exe
  2⤵
  PID:2976
- C:\Windows\System\HGSJOHt.exe
  C:\Windows\System\HGSJOHt.exe
  2⤵
  PID:2536
- C:\Windows\System\HKzlXcA.exe
  C:\Windows\System\HKzlXcA.exe
  2⤵
  PID:3808
- C:\Windows\System\TCyJAhE.exe
  C:\Windows\System\TCyJAhE.exe
  2⤵
  PID:4064
- C:\Windows\System\NSqXzcx.exe
  C:\Windows\System\NSqXzcx.exe
  2⤵
  PID:1920
- C:\Windows\System\MzkjXaY.exe
  C:\Windows\System\MzkjXaY.exe
  2⤵
  PID:804
- C:\Windows\System\wistFkF.exe
  C:\Windows\System\wistFkF.exe
  2⤵
  PID:2264
- C:\Windows\System\ELSlSWq.exe
  C:\Windows\System\ELSlSWq.exe
  2⤵
  PID:3584
- C:\Windows\System\ApnwqMD.exe
  C:\Windows\System\ApnwqMD.exe
  2⤵
  PID:2692
- C:\Windows\System\MFUtsmu.exe
  C:\Windows\System\MFUtsmu.exe
  2⤵
  PID:3936
- C:\Windows\System\lUctXtE.exe
  C:\Windows\System\lUctXtE.exe
  2⤵
  PID:2748
- C:\Windows\System\ZJrsUfx.exe
  C:\Windows\System\ZJrsUfx.exe
  2⤵
  PID:4016
- C:\Windows\System\FVyJAUF.exe
  C:\Windows\System\FVyJAUF.exe
  2⤵
  PID:4068
- C:\Windows\System\MLZUnzv.exe
  C:\Windows\System\MLZUnzv.exe
  2⤵
  PID:4108
- C:\Windows\System\oniEyDG.exe
  C:\Windows\System\oniEyDG.exe
  2⤵
  PID:4124
- C:\Windows\System\CuyYnHd.exe
  C:\Windows\System\CuyYnHd.exe
  2⤵
  PID:4140
- C:\Windows\System\tNcamkd.exe
  C:\Windows\System\tNcamkd.exe
  2⤵
  PID:4160
- C:\Windows\System\eOMTZxl.exe
  C:\Windows\System\eOMTZxl.exe
  2⤵
  PID:4180
- C:\Windows\System\UosmqMd.exe
  C:\Windows\System\UosmqMd.exe
  2⤵
  PID:4200
- C:\Windows\System\bJptcVU.exe
  C:\Windows\System\bJptcVU.exe
  2⤵
  PID:4216
- C:\Windows\System\EqMsGlp.exe
  C:\Windows\System\EqMsGlp.exe
  2⤵
  PID:4232
- C:\Windows\System\tcmPkFm.exe
  C:\Windows\System\tcmPkFm.exe
  2⤵
  PID:4252
- C:\Windows\System\UCBXmVf.exe
  C:\Windows\System\UCBXmVf.exe
  2⤵
  PID:4272
- C:\Windows\System\EGxTtkr.exe
  C:\Windows\System\EGxTtkr.exe
  2⤵
  PID:4288
- C:\Windows\System\gtLCEdo.exe
  C:\Windows\System\gtLCEdo.exe
  2⤵
  PID:4308
- C:\Windows\System\wPWIdlo.exe
  C:\Windows\System\wPWIdlo.exe
  2⤵
  PID:4324
- C:\Windows\System\JILQnAS.exe
  C:\Windows\System\JILQnAS.exe
  2⤵
  PID:4340
- C:\Windows\System\dCiuXWQ.exe
  C:\Windows\System\dCiuXWQ.exe
  2⤵
  PID:4360
- C:\Windows\System\ndmLxBr.exe
  C:\Windows\System\ndmLxBr.exe
  2⤵
  PID:4376
- C:\Windows\System\ziOqRXD.exe
  C:\Windows\System\ziOqRXD.exe
  2⤵
  PID:4396
- C:\Windows\System\pivCaZT.exe
  C:\Windows\System\pivCaZT.exe
  2⤵
  PID:4412
- C:\Windows\System\YvVECRU.exe
  C:\Windows\System\YvVECRU.exe
  2⤵
  PID:4428
- C:\Windows\System\fgOsoun.exe
  C:\Windows\System\fgOsoun.exe
  2⤵
  PID:4448
- C:\Windows\System\CluUbOa.exe
  C:\Windows\System\CluUbOa.exe
  2⤵
  PID:4468
- C:\Windows\System\BsSCCdu.exe
  C:\Windows\System\BsSCCdu.exe
  2⤵
  PID:4484
- C:\Windows\System\EfVHNgS.exe
  C:\Windows\System\EfVHNgS.exe
  2⤵
  PID:4504
- C:\Windows\System\wSswTic.exe
  C:\Windows\System\wSswTic.exe
  2⤵
  PID:4520
- C:\Windows\System\iGBoxSt.exe
  C:\Windows\System\iGBoxSt.exe
  2⤵
  PID:4540
- C:\Windows\System\TFKarqg.exe
  C:\Windows\System\TFKarqg.exe
  2⤵
  PID:4560
- C:\Windows\System\zGFtsYz.exe
  C:\Windows\System\zGFtsYz.exe
  2⤵
  PID:4576
- C:\Windows\System\WFtJRxT.exe
  C:\Windows\System\WFtJRxT.exe
  2⤵
  PID:4596
- C:\Windows\System\nIgysoA.exe
  C:\Windows\System\nIgysoA.exe
  2⤵
  PID:4612
- C:\Windows\System\DMPNVae.exe
  C:\Windows\System\DMPNVae.exe
  2⤵
  PID:4632
- C:\Windows\System\txeeLhc.exe
  C:\Windows\System\txeeLhc.exe
  2⤵
  PID:4648
- C:\Windows\System\bzgOkmL.exe
  C:\Windows\System\bzgOkmL.exe
  2⤵
  PID:4672
- C:\Windows\System\hznSqUI.exe
  C:\Windows\System\hznSqUI.exe
  2⤵
  PID:4688
- C:\Windows\System\KUgDAWr.exe
  C:\Windows\System\KUgDAWr.exe
  2⤵
  PID:4704
- C:\Windows\System\rvyvCFD.exe
  C:\Windows\System\rvyvCFD.exe
  2⤵
  PID:4720
- C:\Windows\System\SwTLBsc.exe
  C:\Windows\System\SwTLBsc.exe
  2⤵
  PID:4736
- C:\Windows\System\SVkbSrw.exe
  C:\Windows\System\SVkbSrw.exe
  2⤵
  PID:4752
- C:\Windows\System\lzQbBeb.exe
  C:\Windows\System\lzQbBeb.exe
  2⤵
  PID:4768
- C:\Windows\System\oJMetuI.exe
  C:\Windows\System\oJMetuI.exe
  2⤵
  PID:4784
- C:\Windows\System\WSitBaT.exe
  C:\Windows\System\WSitBaT.exe
  2⤵
  PID:4820
- C:\Windows\System\IQCvfhJ.exe
  C:\Windows\System\IQCvfhJ.exe
  2⤵
  PID:4836
- C:\Windows\System\CNCTrND.exe
  C:\Windows\System\CNCTrND.exe
  2⤵
  PID:4852
- C:\Windows\System\SDcIrQP.exe
  C:\Windows\System\SDcIrQP.exe
  2⤵
  PID:4868
- C:\Windows\System\RPUdujO.exe
  C:\Windows\System\RPUdujO.exe
  2⤵
  PID:4884
- C:\Windows\System\egNYdoQ.exe
  C:\Windows\System\egNYdoQ.exe
  2⤵
  PID:4900
- C:\Windows\System\yzrJUqK.exe
  C:\Windows\System\yzrJUqK.exe
  2⤵
  PID:4916
- C:\Windows\System\sNPYKiY.exe
  C:\Windows\System\sNPYKiY.exe
  2⤵
  PID:4932
- C:\Windows\System\FHDJeqe.exe
  C:\Windows\System\FHDJeqe.exe
  2⤵
  PID:4948
- C:\Windows\System\myYHLEj.exe
  C:\Windows\System\myYHLEj.exe
  2⤵
  PID:4964
- C:\Windows\System\nhpNwZe.exe
  C:\Windows\System\nhpNwZe.exe
  2⤵
  PID:4980
- C:\Windows\System\pBiqovW.exe
  C:\Windows\System\pBiqovW.exe
  2⤵
  PID:4996
- C:\Windows\System\xXdLcVc.exe
  C:\Windows\System\xXdLcVc.exe
  2⤵
  PID:5012
- C:\Windows\System\BEkJcqz.exe
  C:\Windows\System\BEkJcqz.exe
  2⤵
  PID:5028
- C:\Windows\System\myTmJpK.exe
  C:\Windows\System\myTmJpK.exe
  2⤵
  PID:5044
- C:\Windows\System\LTNVfEt.exe
  C:\Windows\System\LTNVfEt.exe
  2⤵
  PID:5060
- C:\Windows\System\izHVlgO.exe
  C:\Windows\System\izHVlgO.exe
  2⤵
  PID:5076
- C:\Windows\System\GWnehsQ.exe
  C:\Windows\System\GWnehsQ.exe
  2⤵
  PID:5092
- C:\Windows\System\iakVScQ.exe
  C:\Windows\System\iakVScQ.exe
  2⤵
  PID:5108
- C:\Windows\System\FidReyD.exe
  C:\Windows\System\FidReyD.exe
  2⤵
  PID:4100
- C:\Windows\System\MuLwNwQ.exe
  C:\Windows\System\MuLwNwQ.exe
  2⤵
  PID:4168
- C:\Windows\System\LRJQmgg.exe
  C:\Windows\System\LRJQmgg.exe
  2⤵
  PID:4212
- C:\Windows\System\rJvLhhU.exe
  C:\Windows\System\rJvLhhU.exe
  2⤵
  PID:4248
- C:\Windows\System\oFzZuYd.exe
  C:\Windows\System\oFzZuYd.exe
  2⤵
  PID:4316
- C:\Windows\System\XWRccjl.exe
  C:\Windows\System\XWRccjl.exe
  2⤵
  PID:2120
- C:\Windows\System\aRYCiHa.exe
  C:\Windows\System\aRYCiHa.exe
  2⤵
  PID:4420
- C:\Windows\System\kRxZioH.exe
  C:\Windows\System\kRxZioH.exe
  2⤵
  PID:4464
- C:\Windows\System\czVehoQ.exe
  C:\Windows\System\czVehoQ.exe
  2⤵
  PID:4528
- C:\Windows\System\VdCNqwr.exe
  C:\Windows\System\VdCNqwr.exe
  2⤵
  PID:4572
- C:\Windows\System\elEwVFk.exe
  C:\Windows\System\elEwVFk.exe
  2⤵
  PID:1804
- C:\Windows\System\PxMleAA.exe
  C:\Windows\System\PxMleAA.exe
  2⤵
  PID:992
- C:\Windows\System\JyeqXyb.exe
  C:\Windows\System\JyeqXyb.exe
  2⤵
  PID:2428
- C:\Windows\System\sRcbFlN.exe
  C:\Windows\System\sRcbFlN.exe
  2⤵
  PID:3620
- C:\Windows\System\TyNPrUH.exe
  C:\Windows\System\TyNPrUH.exe
  2⤵
  PID:3016
- C:\Windows\System\vnIhsjq.exe
  C:\Windows\System\vnIhsjq.exe
  2⤵
  PID:4712
- C:\Windows\System\ikEPyiA.exe
  C:\Windows\System\ikEPyiA.exe
  2⤵
  PID:336
- C:\Windows\System\cjzhLtC.exe
  C:\Windows\System\cjzhLtC.exe
  2⤵
  PID:3864
- C:\Windows\System\AFHuBKP.exe
  C:\Windows\System\AFHuBKP.exe
  2⤵
  PID:2772
- C:\Windows\System\zAJnWKS.exe
  C:\Windows\System\zAJnWKS.exe
  2⤵
  PID:1768
- C:\Windows\System\kGFCWGM.exe
  C:\Windows\System\kGFCWGM.exe
  2⤵
  PID:1132
- C:\Windows\System\BJJMyBb.exe
  C:\Windows\System\BJJMyBb.exe
  2⤵
  PID:3988
- C:\Windows\System\wSUgovh.exe
  C:\Windows\System\wSUgovh.exe
  2⤵
  PID:4716
- C:\Windows\System\ALxIhnu.exe
  C:\Windows\System\ALxIhnu.exe
  2⤵
  PID:2632
- C:\Windows\System\UElEtkp.exe
  C:\Windows\System\UElEtkp.exe
  2⤵
  PID:2108
- C:\Windows\System\qHWQfrX.exe
  C:\Windows\System\qHWQfrX.exe
  2⤵
  PID:3268
- C:\Windows\System\rxZvMgu.exe
  C:\Windows\System\rxZvMgu.exe
  2⤵
  PID:3372
- C:\Windows\System\EuZJSBs.exe
  C:\Windows\System\EuZJSBs.exe
  2⤵
  PID:3312
- C:\Windows\System\QxiAopV.exe
  C:\Windows\System\QxiAopV.exe
  2⤵
  PID:2980
- C:\Windows\System\mlZRTFN.exe
  C:\Windows\System\mlZRTFN.exe
  2⤵
  PID:3660
- C:\Windows\System\nCVLPwU.exe
  C:\Windows\System\nCVLPwU.exe
  2⤵
  PID:840
- C:\Windows\System\LhOpjFs.exe
  C:\Windows\System\LhOpjFs.exe
  2⤵
  PID:2476
- C:\Windows\System\jtVhMRq.exe
  C:\Windows\System\jtVhMRq.exe
  2⤵
  PID:3264
- C:\Windows\System\hqfpVST.exe
  C:\Windows\System\hqfpVST.exe
  2⤵
  PID:2940
- C:\Windows\System\FBjufLW.exe
  C:\Windows\System\FBjufLW.exe
  2⤵
  PID:3688
- C:\Windows\System\kZvATfc.exe
  C:\Windows\System\kZvATfc.exe
  2⤵
  PID:4152
- C:\Windows\System\dkyaBqF.exe
  C:\Windows\System\dkyaBqF.exe
  2⤵
  PID:4196
- C:\Windows\System\QzkWclN.exe
  C:\Windows\System\QzkWclN.exe
  2⤵
  PID:4268
- C:\Windows\System\EXCTTvI.exe
  C:\Windows\System\EXCTTvI.exe
  2⤵
  PID:4776
- C:\Windows\System\iiSxNgz.exe
  C:\Windows\System\iiSxNgz.exe
  2⤵
  PID:4368
- C:\Windows\System\iJRzYMC.exe
  C:\Windows\System\iJRzYMC.exe
  2⤵
  PID:4436
- C:\Windows\System\hYeKszX.exe
  C:\Windows\System\hYeKszX.exe
  2⤵
  PID:4480
- C:\Windows\System\MzILdSZ.exe
  C:\Windows\System\MzILdSZ.exe
  2⤵
  PID:4552
- C:\Windows\System\uJDNnES.exe
  C:\Windows\System\uJDNnES.exe
  2⤵
  PID:4592
- C:\Windows\System\aOTdNZj.exe
  C:\Windows\System\aOTdNZj.exe
  2⤵
  PID:4656
- C:\Windows\System\vnSyliv.exe
  C:\Windows\System\vnSyliv.exe
  2⤵
  PID:4700
- C:\Windows\System\RmXnyYg.exe
  C:\Windows\System\RmXnyYg.exe
  2⤵
  PID:4760
- C:\Windows\System\KglFAjr.exe
  C:\Windows\System\KglFAjr.exe
  2⤵
  PID:4832
- C:\Windows\System\nBIFIDW.exe
  C:\Windows\System\nBIFIDW.exe
  2⤵
  PID:4848
- C:\Windows\System\atHVDUz.exe
  C:\Windows\System\atHVDUz.exe
  2⤵
  PID:4880
- C:\Windows\System\RGAbJTy.exe
  C:\Windows\System\RGAbJTy.exe
  2⤵
  PID:4912
- C:\Windows\System\MrrtjZY.exe
  C:\Windows\System\MrrtjZY.exe
  2⤵
  PID:4944
- C:\Windows\System\lkmLzqs.exe
  C:\Windows\System\lkmLzqs.exe
  2⤵
  PID:4976
- C:\Windows\System\rTDdXTB.exe
  C:\Windows\System\rTDdXTB.exe
  2⤵
  PID:5008
- C:\Windows\System\RjhsYOp.exe
  C:\Windows\System\RjhsYOp.exe
  2⤵
  PID:5040
- C:\Windows\System\PXNwMhM.exe
  C:\Windows\System\PXNwMhM.exe
  2⤵
  PID:5072
- C:\Windows\System\pDesltf.exe
  C:\Windows\System\pDesltf.exe
  2⤵
  PID:5104
- C:\Windows\System\GVxedqZ.exe
  C:\Windows\System\GVxedqZ.exe
  2⤵
  PID:4104
- C:\Windows\System\viUfHkr.exe
  C:\Windows\System\viUfHkr.exe
  2⤵
  PID:1448
- C:\Windows\System\NKVfaMw.exe
  C:\Windows\System\NKVfaMw.exe
  2⤵
  PID:4352
- C:\Windows\System\udgXIXg.exe
  C:\Windows\System\udgXIXg.exe
  2⤵
  PID:4492
- C:\Windows\System\QUkMzZT.exe
  C:\Windows\System\QUkMzZT.exe
  2⤵
  PID:4608
- C:\Windows\System\xRJpPrp.exe
  C:\Windows\System\xRJpPrp.exe
  2⤵
  PID:2084
- C:\Windows\System\IwogFGF.exe
  C:\Windows\System\IwogFGF.exe
  2⤵
  PID:2060
- C:\Windows\System\gJrEpwk.exe
  C:\Windows\System\gJrEpwk.exe
  2⤵
  PID:3104
- C:\Windows\System\XvLSRzj.exe
  C:\Windows\System\XvLSRzj.exe
  2⤵
  PID:3844
- C:\Windows\System\JHShSoJ.exe
  C:\Windows\System\JHShSoJ.exe
  2⤵
  PID:2156
- C:\Windows\System\rhpqnDh.exe
  C:\Windows\System\rhpqnDh.exe
  2⤵
  PID:1776
- C:\Windows\System\qWTROBP.exe
  C:\Windows\System\qWTROBP.exe
  2⤵
  PID:2448
- C:\Windows\System\TueHIEh.exe
  C:\Windows\System\TueHIEh.exe
  2⤵
  PID:1988
- C:\Windows\System\Gvmxlsp.exe
  C:\Windows\System\Gvmxlsp.exe
  2⤵
  PID:1320
- C:\Windows\System\UQKUzXm.exe
  C:\Windows\System\UQKUzXm.exe
  2⤵
  PID:1748
- C:\Windows\System\ITokFeJ.exe
  C:\Windows\System\ITokFeJ.exe
  2⤵
  PID:3656
- C:\Windows\System\aPGaIzb.exe
  C:\Windows\System\aPGaIzb.exe
  2⤵
  PID:3168
- C:\Windows\System\auJKXAP.exe
  C:\Windows\System\auJKXAP.exe
  2⤵
  PID:1616
- C:\Windows\System\doGhxMs.exe
  C:\Windows\System\doGhxMs.exe
  2⤵
  PID:4148
- C:\Windows\System\MHTGjOJ.exe
  C:\Windows\System\MHTGjOJ.exe
  2⤵
  PID:4300
- C:\Windows\System\eLXJXTF.exe
  C:\Windows\System\eLXJXTF.exe
  2⤵
  PID:4408
- C:\Windows\System\mUHviFA.exe
  C:\Windows\System\mUHviFA.exe
  2⤵
  PID:4476
- C:\Windows\System\RJASzdy.exe
  C:\Windows\System\RJASzdy.exe
  2⤵
  PID:2700
- C:\Windows\System\mWNEjFm.exe
  C:\Windows\System\mWNEjFm.exe
  2⤵
  PID:4732
- C:\Windows\System\FGYWVoy.exe
  C:\Windows\System\FGYWVoy.exe
  2⤵
  PID:4844
- C:\Windows\System\jwNHyWU.exe
  C:\Windows\System\jwNHyWU.exe
  2⤵
  PID:4892
- C:\Windows\System\szTPFNK.exe
  C:\Windows\System\szTPFNK.exe
  2⤵
  PID:4956
- C:\Windows\System\SLskSRy.exe
  C:\Windows\System\SLskSRy.exe
  2⤵
  PID:5036
- C:\Windows\System\KEmsGfs.exe
  C:\Windows\System\KEmsGfs.exe
  2⤵
  PID:5068
- C:\Windows\System\nCofaNQ.exe
  C:\Windows\System\nCofaNQ.exe
  2⤵
  PID:4244
- C:\Windows\System\HpjJOws.exe
  C:\Windows\System\HpjJOws.exe
  2⤵
  PID:4392
- C:\Windows\System\RIQQsIa.exe
  C:\Windows\System\RIQQsIa.exe
  2⤵
  PID:4640
- C:\Windows\System\kDqmzyp.exe
  C:\Windows\System\kDqmzyp.exe
  2⤵
  PID:2256
- C:\Windows\System\WmdVShc.exe
  C:\Windows\System\WmdVShc.exe
  2⤵
  PID:3568
- C:\Windows\System\djyIimD.exe
  C:\Windows\System\djyIimD.exe
  2⤵
  PID:3756
- C:\Windows\System\Hownetk.exe
  C:\Windows\System\Hownetk.exe
  2⤵
  PID:4084
- C:\Windows\System\ZPAlXRj.exe
  C:\Windows\System\ZPAlXRj.exe
  2⤵
  PID:960
- C:\Windows\System\dIpdVcQ.exe
  C:\Windows\System\dIpdVcQ.exe
  2⤵
  PID:2624
- C:\Windows\System\nVHStzW.exe
  C:\Windows\System\nVHStzW.exe
  2⤵
  PID:4876
- C:\Windows\System\dMEkfbi.exe
  C:\Windows\System\dMEkfbi.exe
  2⤵
  PID:4188
- C:\Windows\System\ZdOolDK.exe
  C:\Windows\System\ZdOolDK.exe
  2⤵
  PID:4332
- C:\Windows\System\XDGociS.exe
  C:\Windows\System\XDGociS.exe
  2⤵
  PID:4584
- C:\Windows\System\jEKmhFL.exe
  C:\Windows\System\jEKmhFL.exe
  2⤵
  PID:4792
- C:\Windows\System\uLCRIxU.exe
  C:\Windows\System\uLCRIxU.exe
  2⤵
  PID:1060
- C:\Windows\System\yHjVTGE.exe
  C:\Windows\System\yHjVTGE.exe
  2⤵
  PID:1668
- C:\Windows\System\oaDYPaL.exe
  C:\Windows\System\oaDYPaL.exe
  2⤵
  PID:4988
- C:\Windows\System\GiBFvRR.exe
  C:\Windows\System\GiBFvRR.exe
  2⤵
  PID:5004
- C:\Windows\System\zjeHDBj.exe
  C:\Windows\System\zjeHDBj.exe
  2⤵
  PID:5116
- C:\Windows\System\rsaqQGl.exe
  C:\Windows\System\rsaqQGl.exe
  2⤵
  PID:4456
- C:\Windows\System\VaBVapp.exe
  C:\Windows\System\VaBVapp.exe
  2⤵
  PID:3972
- C:\Windows\System\IiJexDq.exe
  C:\Windows\System\IiJexDq.exe
  2⤵
  PID:1936
- C:\Windows\System\FNXdxWE.exe
  C:\Windows\System\FNXdxWE.exe
  2⤵
  PID:1236
- C:\Windows\System\iCEGRKI.exe
  C:\Windows\System\iCEGRKI.exe
  2⤵
  PID:5136
- C:\Windows\System\TDCnRNA.exe
  C:\Windows\System\TDCnRNA.exe
  2⤵
  PID:5152
- C:\Windows\System\KBhBeot.exe
  C:\Windows\System\KBhBeot.exe
  2⤵
  PID:5168
- C:\Windows\System\WDONACC.exe
  C:\Windows\System\WDONACC.exe
  2⤵
  PID:5184
- C:\Windows\System\yFGMlxH.exe
  C:\Windows\System\yFGMlxH.exe
  2⤵
  PID:5200
- C:\Windows\System\EOQtgtO.exe
  C:\Windows\System\EOQtgtO.exe
  2⤵
  PID:5216
- C:\Windows\System\vVZQOoT.exe
  C:\Windows\System\vVZQOoT.exe
  2⤵
  PID:5232
- C:\Windows\System\pPOMvsz.exe
  C:\Windows\System\pPOMvsz.exe
  2⤵
  PID:5252
- C:\Windows\System\ytdxbpU.exe
  C:\Windows\System\ytdxbpU.exe
  2⤵
  PID:5272
- C:\Windows\System\owRxgqE.exe
  C:\Windows\System\owRxgqE.exe
  2⤵
  PID:5288
- C:\Windows\System\hWuRakF.exe
  C:\Windows\System\hWuRakF.exe
  2⤵
  PID:5308
- C:\Windows\System\kNoCizQ.exe
  C:\Windows\System\kNoCizQ.exe
  2⤵
  PID:5324
- C:\Windows\System\SomHExw.exe
  C:\Windows\System\SomHExw.exe
  2⤵
  PID:5340
- C:\Windows\System\pFUkgZf.exe
  C:\Windows\System\pFUkgZf.exe
  2⤵
  PID:5356
- C:\Windows\System\TpxhYPQ.exe
  C:\Windows\System\TpxhYPQ.exe
  2⤵
  PID:5372
- C:\Windows\System\hExDiAh.exe
  C:\Windows\System\hExDiAh.exe
  2⤵
  PID:5388
- C:\Windows\System\wDHGBYR.exe
  C:\Windows\System\wDHGBYR.exe
  2⤵
  PID:5404
- C:\Windows\System\GTBodvj.exe
  C:\Windows\System\GTBodvj.exe
  2⤵
  PID:5424
- C:\Windows\System\ePGEeEB.exe
  C:\Windows\System\ePGEeEB.exe
  2⤵
  PID:5440
- C:\Windows\System\lrnQoTi.exe
  C:\Windows\System\lrnQoTi.exe
  2⤵
  PID:5456
- C:\Windows\System\aCsSfqd.exe
  C:\Windows\System\aCsSfqd.exe
  2⤵
  PID:5472
- C:\Windows\System\PKgMAws.exe
  C:\Windows\System\PKgMAws.exe
  2⤵
  PID:5488
- C:\Windows\System\wwdZlyi.exe
  C:\Windows\System\wwdZlyi.exe
  2⤵
  PID:5504
- C:\Windows\System\UrEuoco.exe
  C:\Windows\System\UrEuoco.exe
  2⤵
  PID:5520
- C:\Windows\System\VFanXpy.exe
  C:\Windows\System\VFanXpy.exe
  2⤵
  PID:5536
- C:\Windows\System\HDPUrWi.exe
  C:\Windows\System\HDPUrWi.exe
  2⤵
  PID:5552
- C:\Windows\System\YYfYSmM.exe
  C:\Windows\System\YYfYSmM.exe
  2⤵
  PID:5568
- C:\Windows\System\GeMCWlN.exe
  C:\Windows\System\GeMCWlN.exe
  2⤵
  PID:5584
- C:\Windows\System\WTOSrdz.exe
  C:\Windows\System\WTOSrdz.exe
  2⤵
  PID:5600
- C:\Windows\System\KEujfps.exe
  C:\Windows\System\KEujfps.exe
  2⤵
  PID:5656
- C:\Windows\System\gvgwpmh.exe
  C:\Windows\System\gvgwpmh.exe
  2⤵
  PID:5696
- C:\Windows\System\hOmrNFm.exe
  C:\Windows\System\hOmrNFm.exe
  2⤵
  PID:5712
- C:\Windows\System\lEFYsOe.exe
  C:\Windows\System\lEFYsOe.exe
  2⤵
  PID:5728
- C:\Windows\System\EtjDUue.exe
  C:\Windows\System\EtjDUue.exe
  2⤵
  PID:5744
- C:\Windows\System\WkglUBW.exe
  C:\Windows\System\WkglUBW.exe
  2⤵
  PID:5848
- C:\Windows\System\PDpFbJY.exe
  C:\Windows\System\PDpFbJY.exe
  2⤵
  PID:5872
- C:\Windows\System\QqxiEbt.exe
  C:\Windows\System\QqxiEbt.exe
  2⤵
  PID:5984
- C:\Windows\System\aQTRRqg.exe
  C:\Windows\System\aQTRRqg.exe
  2⤵
  PID:6016
- C:\Windows\System\lZbyzxr.exe
  C:\Windows\System\lZbyzxr.exe
  2⤵
  PID:6032
- C:\Windows\System\wRMwwLS.exe
  C:\Windows\System\wRMwwLS.exe
  2⤵
  PID:6060
- C:\Windows\System\XeeYqBh.exe
  C:\Windows\System\XeeYqBh.exe
  2⤵
  PID:2620
- C:\Windows\System\wEEuojv.exe
  C:\Windows\System\wEEuojv.exe
  2⤵
  PID:5208
- C:\Windows\System\epabUoE.exe
  C:\Windows\System\epabUoE.exe
  2⤵
  PID:5244
- C:\Windows\System\BviwCCI.exe
  C:\Windows\System\BviwCCI.exe
  2⤵
  PID:5580
- C:\Windows\System\uwUuoRa.exe
  C:\Windows\System\uwUuoRa.exe
  2⤵
  PID:996
- C:\Windows\System\aUhEiuM.exe
  C:\Windows\System\aUhEiuM.exe
  2⤵
  PID:5644
- C:\Windows\System\XUCgVQO.exe
  C:\Windows\System\XUCgVQO.exe
  2⤵
  PID:4684
- C:\Windows\System\uQSspkB.exe
  C:\Windows\System\uQSspkB.exe
  2⤵
  PID:2128
- C:\Windows\System\acnaqyF.exe
  C:\Windows\System\acnaqyF.exe
  2⤵
  PID:4664
- C:\Windows\System\ISuJqAc.exe
  C:\Windows\System\ISuJqAc.exe
  2⤵
  PID:5708
- C:\Windows\System\eaYVkxD.exe
  C:\Windows\System\eaYVkxD.exe
  2⤵
  PID:1452
- C:\Windows\System\hNlEenG.exe
  C:\Windows\System\hNlEenG.exe
  2⤵
  PID:5668
- C:\Windows\System\XICZQTU.exe
  C:\Windows\System\XICZQTU.exe
  2⤵
  PID:5268
- C:\Windows\System\hDmoWjU.exe
  C:\Windows\System\hDmoWjU.exe
  2⤵
  PID:4388
- C:\Windows\System\rvsVqhi.exe
  C:\Windows\System\rvsVqhi.exe
  2⤵
  PID:5500
- C:\Windows\System\enYRwcG.exe
  C:\Windows\System\enYRwcG.exe
  2⤵
  PID:5796
- C:\Windows\System\KtssuEE.exe
  C:\Windows\System\KtssuEE.exe
  2⤵
  PID:5820
- C:\Windows\System\ucHAbPM.exe
  C:\Windows\System\ucHAbPM.exe
  2⤵
  PID:5888
- C:\Windows\System\qmgLDVC.exe
  C:\Windows\System\qmgLDVC.exe
  2⤵
  PID:5916
- C:\Windows\System\mIKLZXw.exe
  C:\Windows\System\mIKLZXw.exe
  2⤵
  PID:5956
- C:\Windows\System\tSqBOPB.exe
  C:\Windows\System\tSqBOPB.exe
  2⤵
  PID:5972
- C:\Windows\System\LmbdIGH.exe
  C:\Windows\System\LmbdIGH.exe
  2⤵
  PID:5968
- C:\Windows\System\kjqnCHf.exe
  C:\Windows\System\kjqnCHf.exe
  2⤵
  PID:1520
- C:\Windows\System\CEvkYDX.exe
  C:\Windows\System\CEvkYDX.exe
  2⤵
  PID:6040
- C:\Windows\System\axpnMDl.exe
  C:\Windows\System\axpnMDl.exe
  2⤵
  PID:6080
- C:\Windows\System\LAjLzvI.exe
  C:\Windows\System\LAjLzvI.exe
  2⤵
  PID:6088
- C:\Windows\System\pbljCsF.exe
  C:\Windows\System\pbljCsF.exe
  2⤵
  PID:6108
- C:\Windows\System\yfUWILr.exe
  C:\Windows\System\yfUWILr.exe
  2⤵
  PID:6124
- C:\Windows\System\RpNYphd.exe
  C:\Windows\System\RpNYphd.exe
  2⤵
  PID:6136
- C:\Windows\System\vukQLOC.exe
  C:\Windows\System\vukQLOC.exe
  2⤵
  PID:1676
- C:\Windows\System\XeusgVD.exe
  C:\Windows\System\XeusgVD.exe
  2⤵
  PID:5448
- C:\Windows\System\hYmAMWR.exe
  C:\Windows\System\hYmAMWR.exe
  2⤵
  PID:5212
- C:\Windows\System\CzqWHQr.exe
  C:\Windows\System\CzqWHQr.exe
  2⤵
  PID:4516
- C:\Windows\System\KkQaMLM.exe
  C:\Windows\System\KkQaMLM.exe
  2⤵
  PID:5384
- C:\Windows\System\YOrJlyB.exe
  C:\Windows\System\YOrJlyB.exe
  2⤵
  PID:5612
- C:\Windows\System\IppIewT.exe
  C:\Windows\System\IppIewT.exe
  2⤵
  PID:5632
- C:\Windows\System\qIXqgjz.exe
  C:\Windows\System\qIXqgjz.exe
  2⤵
  PID:2736
- C:\Windows\System\maMaPtV.exe
  C:\Windows\System\maMaPtV.exe
  2⤵
  PID:4536
- C:\Windows\System\WXZWNIb.exe
  C:\Windows\System\WXZWNIb.exe
  2⤵
  PID:2008
- C:\Windows\System\sxVByZS.exe
  C:\Windows\System\sxVByZS.exe
  2⤵
  PID:5224
- C:\Windows\System\ueEVuQP.exe
  C:\Windows\System\ueEVuQP.exe
  2⤵
  PID:5132
- C:\Windows\System\AcYLCsC.exe
  C:\Windows\System\AcYLCsC.exe
  2⤵
  PID:896
- C:\Windows\System\jfviIRT.exe
  C:\Windows\System\jfviIRT.exe
  2⤵
  PID:5680
- C:\Windows\System\clOMzLF.exe
  C:\Windows\System\clOMzLF.exe
  2⤵
  PID:5756
- C:\Windows\System\ZqakaHi.exe
  C:\Windows\System\ZqakaHi.exe
  2⤵
  PID:5304
- C:\Windows\System\ZOSpfPe.exe
  C:\Windows\System\ZOSpfPe.exe
  2⤵
  PID:5396
- C:\Windows\System\oSMzKKD.exe
  C:\Windows\System\oSMzKKD.exe
  2⤵
  PID:5688
- C:\Windows\System\OqxeLOn.exe
  C:\Windows\System\OqxeLOn.exe
  2⤵
  PID:5720
- C:\Windows\System\csFWewc.exe
  C:\Windows\System\csFWewc.exe
  2⤵
  PID:5464
- C:\Windows\System\GHuKVNr.exe
  C:\Windows\System\GHuKVNr.exe
  2⤵
  PID:5768
- C:\Windows\System\bhEHHHY.exe
  C:\Windows\System\bhEHHHY.exe
  2⤵
  PID:5784
- C:\Windows\System\hAAUKlv.exe
  C:\Windows\System\hAAUKlv.exe
  2⤵
  PID:5776
- C:\Windows\System\OnuHMuN.exe
  C:\Windows\System\OnuHMuN.exe
  2⤵
  PID:5808
- C:\Windows\System\dHAGkKr.exe
  C:\Windows\System\dHAGkKr.exe
  2⤵
  PID:5800
- C:\Windows\System\QJMYQNK.exe
  C:\Windows\System\QJMYQNK.exe
  2⤵
  PID:5884
- C:\Windows\System\vaVLUYV.exe
  C:\Windows\System\vaVLUYV.exe
  2⤵
  PID:5828
- C:\Windows\System\etBbtqA.exe
  C:\Windows\System\etBbtqA.exe
  2⤵
  PID:5908
- C:\Windows\System\qNOnWpB.exe
  C:\Windows\System\qNOnWpB.exe
  2⤵
  PID:5928
- C:\Windows\System\PopCvJM.exe
  C:\Windows\System\PopCvJM.exe
  2⤵
  PID:5904
- C:\Windows\System\evzizXH.exe
  C:\Windows\System\evzizXH.exe
  2⤵
  PID:2776
- C:\Windows\System\cXXAJke.exe
  C:\Windows\System\cXXAJke.exe
  2⤵
  PID:3336
- C:\Windows\System\oZxOqlv.exe
  C:\Windows\System\oZxOqlv.exe
  2⤵
  PID:6028
- C:\Windows\System\tKRaNKx.exe
  C:\Windows\System\tKRaNKx.exe
  2⤵
  PID:6116
- C:\Windows\System\OUpekch.exe
  C:\Windows\System\OUpekch.exe
  2⤵
  PID:5948
- C:\Windows\System\LjoJWZb.exe
  C:\Windows\System\LjoJWZb.exe
  2⤵
  PID:6044
- C:\Windows\System\WdiBWnr.exe
  C:\Windows\System\WdiBWnr.exe
  2⤵
  PID:6132
- C:\Windows\System\QiKnIAk.exe
  C:\Windows\System\QiKnIAk.exe
  2⤵
  PID:2180
- C:\Windows\System\hZqIEhz.exe
  C:\Windows\System\hZqIEhz.exe
  2⤵
  PID:5320
- C:\Windows\System\ArBsvfG.exe
  C:\Windows\System\ArBsvfG.exe
  2⤵
  PID:5228
- C:\Windows\System\lPOKceM.exe
  C:\Windows\System\lPOKceM.exe
  2⤵
  PID:2324
- C:\Windows\System\rPFnYnD.exe
  C:\Windows\System\rPFnYnD.exe
  2⤵
  PID:5692
- C:\Windows\System\IlFvmLg.exe
  C:\Windows\System\IlFvmLg.exe
  2⤵
  PID:5636
- C:\Windows\System\UcgndpE.exe
  C:\Windows\System\UcgndpE.exe
  2⤵
  PID:5760
- C:\Windows\System\NnzcnKx.exe
  C:\Windows\System\NnzcnKx.exe
  2⤵
  PID:5652
- C:\Windows\System\RJKvpqz.exe
  C:\Windows\System\RJKvpqz.exe
  2⤵
  PID:2540
- C:\Windows\System\aumUJrH.exe
  C:\Windows\System\aumUJrH.exe
  2⤵
  PID:2932
- C:\Windows\System\eIuYEiQ.exe
  C:\Windows\System\eIuYEiQ.exe
  2⤵
  PID:5672
- C:\Windows\System\GvrGSjC.exe
  C:\Windows\System\GvrGSjC.exe
  2⤵
  PID:5676
- C:\Windows\System\dVkIPVW.exe
  C:\Windows\System\dVkIPVW.exe
  2⤵
  PID:5940
- C:\Windows\System\BRBAGOT.exe
  C:\Windows\System\BRBAGOT.exe
  2⤵
  PID:5780
- C:\Windows\System\sHgMtLk.exe
  C:\Windows\System\sHgMtLk.exe
  2⤵
  PID:6024
- C:\Windows\System\eFRJjJt.exe
  C:\Windows\System\eFRJjJt.exe
  2⤵
  PID:5880
- C:\Windows\System\lwsbkoy.exe
  C:\Windows\System\lwsbkoy.exe
  2⤵
  PID:5616
- C:\Windows\System\ioVPXRm.exe
  C:\Windows\System\ioVPXRm.exe
  2⤵
  PID:5920
- C:\Windows\System\ftvhyYw.exe
  C:\Windows\System\ftvhyYw.exe
  2⤵
  PID:5352
- C:\Windows\System\AAVvYfU.exe
  C:\Windows\System\AAVvYfU.exe
  2⤵
  PID:5964
- C:\Windows\System\BGdhuwk.exe
  C:\Windows\System\BGdhuwk.exe
  2⤵
  PID:5740
- C:\Windows\System\MkJBAPe.exe
  C:\Windows\System\MkJBAPe.exe
  2⤵
  PID:5176
- C:\Windows\System\UnJoHqX.exe
  C:\Windows\System\UnJoHqX.exe
  2⤵
  PID:2868
- C:\Windows\System\ZvzPVaV.exe
  C:\Windows\System\ZvzPVaV.exe
  2⤵
  PID:5840
- C:\Windows\System\kpfjPId.exe
  C:\Windows\System\kpfjPId.exe
  2⤵
  PID:5368
- C:\Windows\System\LHMnLJw.exe
  C:\Windows\System\LHMnLJw.exe
  2⤵
  PID:5816
- C:\Windows\System\IzyDjkN.exe
  C:\Windows\System\IzyDjkN.exe
  2⤵
  PID:4296
- C:\Windows\System\JoNmteQ.exe
  C:\Windows\System\JoNmteQ.exe
  2⤵
  PID:5936
- C:\Windows\System\SfmACDP.exe
  C:\Windows\System\SfmACDP.exe
  2⤵
  PID:5912
- C:\Windows\System\EaUxCue.exe
  C:\Windows\System\EaUxCue.exe
  2⤵
  PID:5532
- C:\Windows\System\BHmePhn.exe
  C:\Windows\System\BHmePhn.exe
  2⤵
  PID:5844
- C:\Windows\System\xvtbrJc.exe
  C:\Windows\System\xvtbrJc.exe
  2⤵
  PID:6152
- C:\Windows\System\iLZeKbo.exe
  C:\Windows\System\iLZeKbo.exe
  2⤵
  PID:6168
- C:\Windows\System\pFwmdhO.exe
  C:\Windows\System\pFwmdhO.exe
  2⤵
  PID:6184
- C:\Windows\System\RFdzaNn.exe
  C:\Windows\System\RFdzaNn.exe
  2⤵
  PID:6200
- C:\Windows\System\vsKvwIp.exe
  C:\Windows\System\vsKvwIp.exe
  2⤵
  PID:6216
- C:\Windows\System\bonAZxI.exe
  C:\Windows\System\bonAZxI.exe
  2⤵
  PID:6232
- C:\Windows\System\SPTiAJx.exe
  C:\Windows\System\SPTiAJx.exe
  2⤵
  PID:6248
- C:\Windows\System\VMFYbpC.exe
  C:\Windows\System\VMFYbpC.exe
  2⤵
  PID:6264
- C:\Windows\System\sBGSCLJ.exe
  C:\Windows\System\sBGSCLJ.exe
  2⤵
  PID:6280
- C:\Windows\System\MMpjACQ.exe
  C:\Windows\System\MMpjACQ.exe
  2⤵
  PID:6296
- C:\Windows\System\wdwAOoA.exe
  C:\Windows\System\wdwAOoA.exe
  2⤵
  PID:6312
- C:\Windows\System\vXxIPQJ.exe
  C:\Windows\System\vXxIPQJ.exe
  2⤵
  PID:6328
- C:\Windows\System\ubxQsJr.exe
  C:\Windows\System\ubxQsJr.exe
  2⤵
  PID:6344
- C:\Windows\System\QXpevni.exe
  C:\Windows\System\QXpevni.exe
  2⤵
  PID:6360
- C:\Windows\System\QuswQcx.exe
  C:\Windows\System\QuswQcx.exe
  2⤵
  PID:6376
- C:\Windows\System\YRymdXW.exe
  C:\Windows\System\YRymdXW.exe
  2⤵
  PID:6392
- C:\Windows\System\rCESudI.exe
  C:\Windows\System\rCESudI.exe
  2⤵
  PID:6408
- C:\Windows\System\rYygRsr.exe
  C:\Windows\System\rYygRsr.exe
  2⤵
  PID:6424
- C:\Windows\System\eCKrlft.exe
  C:\Windows\System\eCKrlft.exe
  2⤵
  PID:6440
- C:\Windows\System\hAUvqOZ.exe
  C:\Windows\System\hAUvqOZ.exe
  2⤵
  PID:6456
- C:\Windows\System\YrmwDPZ.exe
  C:\Windows\System\YrmwDPZ.exe
  2⤵
  PID:6472
- C:\Windows\System\uuijyVr.exe
  C:\Windows\System\uuijyVr.exe
  2⤵
  PID:6488
- C:\Windows\System\EDsJtaS.exe
  C:\Windows\System\EDsJtaS.exe
  2⤵
  PID:6504
- C:\Windows\System\hwMuKbW.exe
  C:\Windows\System\hwMuKbW.exe
  2⤵
  PID:6520
- C:\Windows\System\DEvrsME.exe
  C:\Windows\System\DEvrsME.exe
  2⤵
  PID:6536
- C:\Windows\System\oqKBTcQ.exe
  C:\Windows\System\oqKBTcQ.exe
  2⤵
  PID:6552
- C:\Windows\System\uWwXaVq.exe
  C:\Windows\System\uWwXaVq.exe
  2⤵
  PID:6568
- C:\Windows\System\LlFXbYy.exe
  C:\Windows\System\LlFXbYy.exe
  2⤵
  PID:6584
- C:\Windows\System\WMIAsyQ.exe
  C:\Windows\System\WMIAsyQ.exe
  2⤵
  PID:6600
- C:\Windows\System\aiSqngc.exe
  C:\Windows\System\aiSqngc.exe
  2⤵
  PID:6616
- C:\Windows\System\MxWniQf.exe
  C:\Windows\System\MxWniQf.exe
  2⤵
  PID:6632
- C:\Windows\System\cXRGumB.exe
  C:\Windows\System\cXRGumB.exe
  2⤵
  PID:6648
- C:\Windows\System\OqyoTXo.exe
  C:\Windows\System\OqyoTXo.exe
  2⤵
  PID:6664
- C:\Windows\System\SnmumCN.exe
  C:\Windows\System\SnmumCN.exe
  2⤵
  PID:6680
- C:\Windows\System\sCtAyMC.exe
  C:\Windows\System\sCtAyMC.exe
  2⤵
  PID:6696
- C:\Windows\System\JLkswMI.exe
  C:\Windows\System\JLkswMI.exe
  2⤵
  PID:6712
- C:\Windows\System\MMrtnBy.exe
  C:\Windows\System\MMrtnBy.exe
  2⤵
  PID:6728
- C:\Windows\System\ZOynaLL.exe
  C:\Windows\System\ZOynaLL.exe
  2⤵
  PID:6744
- C:\Windows\System\CnFVIMX.exe
  C:\Windows\System\CnFVIMX.exe
  2⤵
  PID:6760
- C:\Windows\System\IsfggIv.exe
  C:\Windows\System\IsfggIv.exe
  2⤵
  PID:6776
- C:\Windows\System\oqifYly.exe
  C:\Windows\System\oqifYly.exe
  2⤵
  PID:6792
- C:\Windows\System\MQZvktp.exe
  C:\Windows\System\MQZvktp.exe
  2⤵
  PID:6808
- C:\Windows\System\pCYIDRM.exe
  C:\Windows\System\pCYIDRM.exe
  2⤵
  PID:6824
- C:\Windows\System\ECHuetb.exe
  C:\Windows\System\ECHuetb.exe
  2⤵
  PID:6840
- C:\Windows\System\PRdmwLC.exe
  C:\Windows\System\PRdmwLC.exe
  2⤵
  PID:6856
- C:\Windows\System\ZGTDgnr.exe
  C:\Windows\System\ZGTDgnr.exe
  2⤵
  PID:6872
- C:\Windows\System\prIZGnm.exe
  C:\Windows\System\prIZGnm.exe
  2⤵
  PID:6888
- C:\Windows\System\YQHMkQY.exe
  C:\Windows\System\YQHMkQY.exe
  2⤵
  PID:6904
- C:\Windows\System\zSyjyIj.exe
  C:\Windows\System\zSyjyIj.exe
  2⤵
  PID:6920
- C:\Windows\System\QXgVjPk.exe
  C:\Windows\System\QXgVjPk.exe
  2⤵
  PID:6936
- C:\Windows\System\YjPvdWA.exe
  C:\Windows\System\YjPvdWA.exe
  2⤵
  PID:6952
- C:\Windows\System\QdAsLwy.exe
  C:\Windows\System\QdAsLwy.exe
  2⤵
  PID:6968
- C:\Windows\System\hHnsOOT.exe
  C:\Windows\System\hHnsOOT.exe
  2⤵
  PID:6984
- C:\Windows\System\UNbHXLm.exe
  C:\Windows\System\UNbHXLm.exe
  2⤵
  PID:7000
- C:\Windows\System\ZiXIqPf.exe
  C:\Windows\System\ZiXIqPf.exe
  2⤵
  PID:7016
- C:\Windows\System\rgrZWWx.exe
  C:\Windows\System\rgrZWWx.exe
  2⤵
  PID:7032
- C:\Windows\System\oGSTefH.exe
  C:\Windows\System\oGSTefH.exe
  2⤵
  PID:7048
- C:\Windows\System\PpYNeyn.exe
  C:\Windows\System\PpYNeyn.exe
  2⤵
  PID:7064
- C:\Windows\System\WpucLUZ.exe
  C:\Windows\System\WpucLUZ.exe
  2⤵
  PID:7084
- C:\Windows\System\fmqMiux.exe
  C:\Windows\System\fmqMiux.exe
  2⤵
  PID:7100
- C:\Windows\System\bDbWolA.exe
  C:\Windows\System\bDbWolA.exe
  2⤵
  PID:7116
- C:\Windows\System\yqtgoeQ.exe
  C:\Windows\System\yqtgoeQ.exe
  2⤵
  PID:7132
- C:\Windows\System\QhpUeeV.exe
  C:\Windows\System\QhpUeeV.exe
  2⤵
  PID:7148
- C:\Windows\System\FPMfyeA.exe
  C:\Windows\System\FPMfyeA.exe
  2⤵
  PID:4176
- C:\Windows\System\qaZsaId.exe
  C:\Windows\System\qaZsaId.exe
  2⤵
  PID:6180
- C:\Windows\System\wyYOcDZ.exe
  C:\Windows\System\wyYOcDZ.exe
  2⤵
  PID:6240
- C:\Windows\System\NcqNNPV.exe
  C:\Windows\System\NcqNNPV.exe
  2⤵
  PID:6004
- C:\Windows\System\EbIDiyD.exe
  C:\Windows\System\EbIDiyD.exe
  2⤵
  PID:6276
- C:\Windows\System\vjweqro.exe
  C:\Windows\System\vjweqro.exe
  2⤵
  PID:6336
- C:\Windows\System\xJryCkJ.exe
  C:\Windows\System\xJryCkJ.exe
  2⤵
  PID:6400
- C:\Windows\System\QqpUTQm.exe
  C:\Windows\System\QqpUTQm.exe
  2⤵
  PID:6496
- C:\Windows\System\eYPbkfe.exe
  C:\Windows\System\eYPbkfe.exe
  2⤵
  PID:6560
- C:\Windows\System\ecGGXSJ.exe
  C:\Windows\System\ecGGXSJ.exe
  2⤵
  PID:428
- C:\Windows\System\guwiVxv.exe
  C:\Windows\System\guwiVxv.exe
  2⤵
  PID:5868
- C:\Windows\System\xQwUkiA.exe
  C:\Windows\System\xQwUkiA.exe
  2⤵
  PID:6196
- C:\Windows\System\MxUyFsb.exe
  C:\Windows\System\MxUyFsb.exe
  2⤵
  PID:6596
- C:\Windows\System\yhhNimm.exe
  C:\Windows\System\yhhNimm.exe
  2⤵
  PID:6660
- C:\Windows\System\zUttXth.exe
  C:\Windows\System\zUttXth.exe
  2⤵
  PID:6724
- C:\Windows\System\RcTIjwO.exe
  C:\Windows\System\RcTIjwO.exe
  2⤵
  PID:6784
- C:\Windows\System\XpaSbMR.exe
  C:\Windows\System\XpaSbMR.exe
  2⤵
  PID:6160
- C:\Windows\System\ZsYVLLG.exe
  C:\Windows\System\ZsYVLLG.exe
  2⤵
  PID:6852
- C:\Windows\System\dPpYFwx.exe
  C:\Windows\System\dPpYFwx.exe
  2⤵
  PID:6292
- C:\Windows\System\xePZVtb.exe
  C:\Windows\System\xePZVtb.exe
  2⤵
  PID:6884
- C:\Windows\System\ILFpOuI.exe
  C:\Windows\System\ILFpOuI.exe
  2⤵
  PID:6916
- C:\Windows\System\ColffiO.exe
  C:\Windows\System\ColffiO.exe
  2⤵
  PID:6356
- C:\Windows\System\OuMzQaB.exe
  C:\Windows\System\OuMzQaB.exe
  2⤵
  PID:6388
- C:\Windows\System\VNohbuP.exe
  C:\Windows\System\VNohbuP.exe
  2⤵
  PID:6448
- C:\Windows\System\trpZDdt.exe
  C:\Windows\System\trpZDdt.exe
  2⤵
  PID:6976
- C:\Windows\System\xGbEBlo.exe
  C:\Windows\System\xGbEBlo.exe
  2⤵
  PID:6928
- C:\Windows\System\UwliduA.exe
  C:\Windows\System\UwliduA.exe
  2⤵
  PID:7108
- C:\Windows\System\UoAIRpS.exe
  C:\Windows\System\UoAIRpS.exe
  2⤵
  PID:5164
- C:\Windows\System\aFpRTMl.exe
  C:\Windows\System\aFpRTMl.exe
  2⤵
  PID:7128
- C:\Windows\System\oTINsnY.exe
  C:\Windows\System\oTINsnY.exe
  2⤵
  PID:6176
- C:\Windows\System\hxuWksn.exe
  C:\Windows\System\hxuWksn.exe
  2⤵
  PID:5144
- C:\Windows\System\NmYhNQv.exe
  C:\Windows\System\NmYhNQv.exe
  2⤵
  PID:7164
- C:\Windows\System\bakGNQw.exe
  C:\Windows\System\bakGNQw.exe
  2⤵
  PID:1552
- C:\Windows\System\gqNXIVh.exe
  C:\Windows\System\gqNXIVh.exe
  2⤵
  PID:6308
- C:\Windows\System\XWbnRIq.exe
  C:\Windows\System\XWbnRIq.exe
  2⤵
  PID:6224
- C:\Windows\System\gDqNnlS.exe
  C:\Windows\System\gDqNnlS.exe
  2⤵
  PID:6628
- C:\Windows\System\Coznntt.exe
  C:\Windows\System\Coznntt.exe
  2⤵
  PID:6528
- C:\Windows\System\WheHkvK.exe
  C:\Windows\System\WheHkvK.exe
  2⤵
  PID:6372
- C:\Windows\System\MQOrscF.exe
  C:\Windows\System\MQOrscF.exe
  2⤵
  PID:6368
- C:\Windows\System\wWygIMQ.exe
  C:\Windows\System\wWygIMQ.exe
  2⤵
  PID:1720
- C:\Windows\System\qqJFegz.exe
  C:\Windows\System\qqJFegz.exe
  2⤵
  PID:6480
- C:\Windows\System\pZsjARI.exe
  C:\Windows\System\pZsjARI.exe
  2⤵
  PID:6676
- C:\Windows\System\iJYIoUq.exe
  C:\Windows\System\iJYIoUq.exe
  2⤵
  PID:6800
- C:\Windows\System\RRqcBYz.exe
  C:\Windows\System\RRqcBYz.exe
  2⤵
  PID:6740
- C:\Windows\System\pxIJdOw.exe
  C:\Windows\System\pxIJdOw.exe
  2⤵
  PID:6580
- C:\Windows\System\IkDZDtM.exe
  C:\Windows\System\IkDZDtM.exe
  2⤵
  PID:6576
- C:\Windows\System\uuQqoNA.exe
  C:\Windows\System\uuQqoNA.exe
  2⤵
  PID:6644
- C:\Windows\System\IHHMITE.exe
  C:\Windows\System\IHHMITE.exe
  2⤵
  PID:6804
- C:\Windows\System\VwQoyle.exe
  C:\Windows\System\VwQoyle.exe
  2⤵
  PID:6868
- C:\Windows\System\qVqklwZ.exe
  C:\Windows\System\qVqklwZ.exe
  2⤵
  PID:7172
- C:\Windows\System\KsxxoMl.exe
  C:\Windows\System\KsxxoMl.exe
  2⤵
  PID:7188
- C:\Windows\System\jBHsGDH.exe
  C:\Windows\System\jBHsGDH.exe
  2⤵
  PID:7204
- C:\Windows\System\tGTpGDL.exe
  C:\Windows\System\tGTpGDL.exe
  2⤵
  PID:7220
- C:\Windows\System\RCLCtta.exe
  C:\Windows\System\RCLCtta.exe
  2⤵
  PID:7236
- C:\Windows\System\FiwVPHR.exe
  C:\Windows\System\FiwVPHR.exe
  2⤵
  PID:7252
- C:\Windows\System\dcJJVpe.exe
  C:\Windows\System\dcJJVpe.exe
  2⤵
  PID:7268
- C:\Windows\System\ggIOQmY.exe
  C:\Windows\System\ggIOQmY.exe
  2⤵
  PID:7284
- C:\Windows\System\tMbojAZ.exe
  C:\Windows\System\tMbojAZ.exe
  2⤵
  PID:7300
- C:\Windows\System\BKnJfUX.exe
  C:\Windows\System\BKnJfUX.exe
  2⤵
  PID:7316
- C:\Windows\System\LLnqBQo.exe
  C:\Windows\System\LLnqBQo.exe
  2⤵
  PID:7332
- C:\Windows\System\CCwTPLX.exe
  C:\Windows\System\CCwTPLX.exe
  2⤵
  PID:7348
- C:\Windows\System\gfNQhIE.exe
  C:\Windows\System\gfNQhIE.exe
  2⤵
  PID:7364
- C:\Windows\System\Thewtah.exe
  C:\Windows\System\Thewtah.exe
  2⤵
  PID:7380
- C:\Windows\System\KlsSUNG.exe
  C:\Windows\System\KlsSUNG.exe
  2⤵
  PID:7396
- C:\Windows\System\KipkJhi.exe
  C:\Windows\System\KipkJhi.exe
  2⤵
  PID:7412
- C:\Windows\System\krHNRZX.exe
  C:\Windows\System\krHNRZX.exe
  2⤵
  PID:7428
- C:\Windows\System\xxDwsiA.exe
  C:\Windows\System\xxDwsiA.exe
  2⤵
  PID:7444
- C:\Windows\System\BmDvoDp.exe
  C:\Windows\System\BmDvoDp.exe
  2⤵
  PID:7460
- C:\Windows\System\HLsIbxl.exe
  C:\Windows\System\HLsIbxl.exe
  2⤵
  PID:7476
- C:\Windows\System\YLSHlMm.exe
  C:\Windows\System\YLSHlMm.exe
  2⤵
  PID:7492
- C:\Windows\System\VMGrVML.exe
  C:\Windows\System\VMGrVML.exe
  2⤵
  PID:7508
- C:\Windows\System\SavVguP.exe
  C:\Windows\System\SavVguP.exe
  2⤵
  PID:7536
- C:\Windows\System\gcxuYOS.exe
  C:\Windows\System\gcxuYOS.exe
  2⤵
  PID:7552
- C:\Windows\System\NaxJTXB.exe
  C:\Windows\System\NaxJTXB.exe
  2⤵
  PID:7572
- C:\Windows\System\cpcXQvG.exe
  C:\Windows\System\cpcXQvG.exe
  2⤵
  PID:7588
- C:\Windows\System\xfnUuRs.exe
  C:\Windows\System\xfnUuRs.exe
  2⤵
  PID:7608
- C:\Windows\System\uRPrtrg.exe
  C:\Windows\System\uRPrtrg.exe
  2⤵
  PID:7636
- C:\Windows\System\ndRVWCg.exe
  C:\Windows\System\ndRVWCg.exe
  2⤵
  PID:7652
- C:\Windows\System\brUEHMc.exe
  C:\Windows\System\brUEHMc.exe
  2⤵
  PID:7668
- C:\Windows\System\RyGKnYZ.exe
  C:\Windows\System\RyGKnYZ.exe
  2⤵
  PID:7684
- C:\Windows\System\zNZmJmB.exe
  C:\Windows\System\zNZmJmB.exe
  2⤵
  PID:7700
- C:\Windows\System\lFYoAaF.exe
  C:\Windows\System\lFYoAaF.exe
  2⤵
  PID:7716
- C:\Windows\System\vYYdLTh.exe
  C:\Windows\System\vYYdLTh.exe
  2⤵
  PID:7732
- C:\Windows\System\ZuSgsFP.exe
  C:\Windows\System\ZuSgsFP.exe
  2⤵
  PID:7748
- C:\Windows\System\rjIVgge.exe
  C:\Windows\System\rjIVgge.exe
  2⤵
  PID:7764
- C:\Windows\System\sidBZsq.exe
  C:\Windows\System\sidBZsq.exe
  2⤵
  PID:7780
- C:\Windows\System\YtTbuAA.exe
  C:\Windows\System\YtTbuAA.exe
  2⤵
  PID:7816
- C:\Windows\System\dsVDwqW.exe
  C:\Windows\System\dsVDwqW.exe
  2⤵
  PID:7832
- C:\Windows\System\HdlYbNU.exe
  C:\Windows\System\HdlYbNU.exe
  2⤵
  PID:7848
- C:\Windows\System\VjOwmfd.exe
  C:\Windows\System\VjOwmfd.exe
  2⤵
  PID:7864
- C:\Windows\System\wUfaEgh.exe
  C:\Windows\System\wUfaEgh.exe
  2⤵
  PID:7880
- C:\Windows\System\IOXJchn.exe
  C:\Windows\System\IOXJchn.exe
  2⤵
  PID:7896
- C:\Windows\System\slJVFna.exe
  C:\Windows\System\slJVFna.exe
  2⤵
  PID:7928
- C:\Windows\System\VQNkGzH.exe
  C:\Windows\System\VQNkGzH.exe
  2⤵
  PID:7948
- C:\Windows\System\FPNqdQL.exe
  C:\Windows\System\FPNqdQL.exe
  2⤵
  PID:7964
- C:\Windows\System\VJPaVeO.exe
  C:\Windows\System\VJPaVeO.exe
  2⤵
  PID:7980
- C:\Windows\System\flvPAQY.exe
  C:\Windows\System\flvPAQY.exe
  2⤵
  PID:8000
- C:\Windows\System\zRbmlMz.exe
  C:\Windows\System\zRbmlMz.exe
  2⤵
  PID:8016
- C:\Windows\System\dWQmChs.exe
  C:\Windows\System\dWQmChs.exe
  2⤵
  PID:8036
- C:\Windows\System\RCitUTK.exe
  C:\Windows\System\RCitUTK.exe
  2⤵
  PID:8052
- C:\Windows\System\HdqrXsQ.exe
  C:\Windows\System\HdqrXsQ.exe
  2⤵
  PID:8072
- C:\Windows\System\QwdXigd.exe
  C:\Windows\System\QwdXigd.exe
  2⤵
  PID:8092
- C:\Windows\System\xNYrqXH.exe
  C:\Windows\System\xNYrqXH.exe
  2⤵
  PID:8108
- C:\Windows\System\hTimOwn.exe
  C:\Windows\System\hTimOwn.exe
  2⤵
  PID:8124
- C:\Windows\System\ZwKOUCH.exe
  C:\Windows\System\ZwKOUCH.exe
  2⤵
  PID:8144
- C:\Windows\System\LHAWIPz.exe
  C:\Windows\System\LHAWIPz.exe
  2⤵
  PID:8160
- C:\Windows\System\oLwQuqy.exe
  C:\Windows\System\oLwQuqy.exe
  2⤵
  PID:8176
- C:\Windows\System\DTuxSvZ.exe
  C:\Windows\System\DTuxSvZ.exe
  2⤵
  PID:7076
- C:\Windows\System\qVyXWXw.exe
  C:\Windows\System\qVyXWXw.exe
  2⤵
  PID:6992
- C:\Windows\System\EgRJoTx.exe
  C:\Windows\System\EgRJoTx.exe
  2⤵
  PID:6432
- C:\Windows\System\tVpJEVu.exe
  C:\Windows\System\tVpJEVu.exe
  2⤵
  PID:2468
- C:\Windows\System\WsHFLWR.exe
  C:\Windows\System\WsHFLWR.exe
  2⤵
  PID:6352
- C:\Windows\System\EAsQfAw.exe
  C:\Windows\System\EAsQfAw.exe
  2⤵
  PID:6640
- C:\Windows\System\vwlljFE.exe
  C:\Windows\System\vwlljFE.exe
  2⤵
  PID:7180
- C:\Windows\System\QRjbWJl.exe
  C:\Windows\System\QRjbWJl.exe
  2⤵
  PID:7244
- C:\Windows\System\wihYbpz.exe
  C:\Windows\System\wihYbpz.exe
  2⤵
  PID:7308
- C:\Windows\System\NYJUuxu.exe
  C:\Windows\System\NYJUuxu.exe
  2⤵
  PID:7372
- C:\Windows\System\hTTjGLW.exe
  C:\Windows\System\hTTjGLW.exe
  2⤵
  PID:7436
- C:\Windows\System\rXvvWzk.exe
  C:\Windows\System\rXvvWzk.exe
  2⤵
  PID:7500
- C:\Windows\System\GgwcGqY.exe
  C:\Windows\System\GgwcGqY.exe
  2⤵
  PID:7544
- C:\Windows\System\jsfLCcg.exe
  C:\Windows\System\jsfLCcg.exe
  2⤵
  PID:7624
- C:\Windows\System\oAnpcTk.exe
  C:\Windows\System\oAnpcTk.exe
  2⤵
  PID:7692
- C:\Windows\System\CRmwJNy.exe
  C:\Windows\System\CRmwJNy.exe
  2⤵
  PID:7756
- C:\Windows\System\ewrrQFb.exe
  C:\Windows\System\ewrrQFb.exe
  2⤵
  PID:7796
- C:\Windows\System\QDuYlLP.exe
  C:\Windows\System\QDuYlLP.exe
  2⤵
  PID:7904
- C:\Windows\System\hJcQTdp.exe
  C:\Windows\System\hJcQTdp.exe
  2⤵
  PID:7812
- C:\Windows\System\nHiwSvr.exe
  C:\Windows\System\nHiwSvr.exe
  2⤵
  PID:7876
- C:\Windows\System\liCyYLv.exe
  C:\Windows\System\liCyYLv.exe
  2⤵
  PID:7912
- C:\Windows\System\FwZhodU.exe
  C:\Windows\System\FwZhodU.exe
  2⤵
  PID:7388
- C:\Windows\System\MoICbSF.exe
  C:\Windows\System\MoICbSF.exe
  2⤵
  PID:7140
- C:\Windows\System\mmbwikO.exe
  C:\Windows\System\mmbwikO.exe
  2⤵
  PID:6256
- C:\Windows\System\EvKSTfm.exe
  C:\Windows\System\EvKSTfm.exe
  2⤵
  PID:6288
- C:\Windows\System\hjEoeYK.exe
  C:\Windows\System\hjEoeYK.exe
  2⤵
  PID:6820
- C:\Windows\System\HQdSKBT.exe
  C:\Windows\System\HQdSKBT.exe
  2⤵
  PID:5284
- C:\Windows\System\HfgFdNl.exe
  C:\Windows\System\HfgFdNl.exe
  2⤵
  PID:7740
- C:\Windows\System\TnTrOzy.exe
  C:\Windows\System\TnTrOzy.exe
  2⤵
  PID:7596
- C:\Windows\System\JcJdQOD.exe
  C:\Windows\System\JcJdQOD.exe
  2⤵
  PID:7644
- C:\Windows\System\qIPFqpS.exe
  C:\Windows\System\qIPFqpS.exe
  2⤵
  PID:7532
- C:\Windows\System\ISkthlv.exe
  C:\Windows\System\ISkthlv.exe
  2⤵
  PID:7484
- C:\Windows\System\utkZrqp.exe
  C:\Windows\System\utkZrqp.exe
  2⤵
  PID:7420
- C:\Windows\System\PhgtXVj.exe
  C:\Windows\System\PhgtXVj.exe
  2⤵
  PID:7328
- C:\Windows\System\jlyyglY.exe
  C:\Windows\System\jlyyglY.exe
  2⤵
  PID:7424
- C:\Windows\System\ECWUbFM.exe
  C:\Windows\System\ECWUbFM.exe
  2⤵
  PID:7200
- C:\Windows\System\OBiypvP.exe
  C:\Windows\System\OBiypvP.exe
  2⤵
  PID:7232
- C:\Windows\System\IAqCStt.exe
  C:\Windows\System\IAqCStt.exe
  2⤵
  PID:7676
- C:\Windows\System\WhRHcBc.exe
  C:\Windows\System\WhRHcBc.exe
  2⤵
  PID:8008
- C:\Windows\System\JKQsmFQ.exe
  C:\Windows\System\JKQsmFQ.exe
  2⤵
  PID:7892
- C:\Windows\System\bloCiSP.exe
  C:\Windows\System\bloCiSP.exe
  2⤵
  PID:7856
- C:\Windows\System\dnfbvWm.exe
  C:\Windows\System\dnfbvWm.exe
  2⤵
  PID:7012
- C:\Windows\System\SltopOk.exe
  C:\Windows\System\SltopOk.exe
  2⤵
  PID:8064
- C:\Windows\System\rkKbPEs.exe
  C:\Windows\System\rkKbPEs.exe
  2⤵
  PID:7992
- C:\Windows\System\llCLhhv.exe
  C:\Windows\System\llCLhhv.exe
  2⤵
  PID:7996
- C:\Windows\System\fWojyJc.exe
  C:\Windows\System\fWojyJc.exe
  2⤵
  PID:8100
- C:\Windows\System\OQnFuGy.exe
  C:\Windows\System\OQnFuGy.exe
  2⤵
  PID:8104
- C:\Windows\System\ktTbRAS.exe
  C:\Windows\System\ktTbRAS.exe
  2⤵
  PID:8168
- C:\Windows\System\FekTOLI.exe
  C:\Windows\System\FekTOLI.exe
  2⤵
  PID:6212
- C:\Windows\System\iHxvgRu.exe
  C:\Windows\System\iHxvgRu.exe
  2⤵
  PID:6692
- C:\Windows\System\SayptGo.exe
  C:\Windows\System\SayptGo.exe
  2⤵
  PID:6836
- C:\Windows\System\bhaSSSz.exe
  C:\Windows\System\bhaSSSz.exe
  2⤵
  PID:7408
- C:\Windows\System\xdGxMEQ.exe
  C:\Windows\System\xdGxMEQ.exe
  2⤵
  PID:6548
- C:\Windows\System\BmLoKAp.exe
  C:\Windows\System\BmLoKAp.exe
  2⤵
  PID:6516
- C:\Windows\System\MHrmxIN.exe
  C:\Windows\System\MHrmxIN.exe
  2⤵
  PID:7788
- C:\Windows\System\BvXTcdm.exe
  C:\Windows\System\BvXTcdm.exe
  2⤵
  PID:7580
- C:\Windows\System\ZJlSsmo.exe
  C:\Windows\System\ZJlSsmo.exe
  2⤵
  PID:7728
- C:\Windows\System\DNTmgPu.exe
  C:\Windows\System\DNTmgPu.exe
  2⤵
  PID:7956
- C:\Windows\System\yHAumYb.exe
  C:\Windows\System\yHAumYb.exe
  2⤵
  PID:7840
- C:\Windows\System\vharfmO.exe
  C:\Windows\System\vharfmO.exe
  2⤵
  PID:6384
- C:\Windows\System\KxgmRfN.exe
  C:\Windows\System\KxgmRfN.exe
  2⤵
  PID:8012
- C:\Windows\System\uYFXalp.exe
  C:\Windows\System\uYFXalp.exe
  2⤵
  PID:7560
- C:\Windows\System\jZnyrFj.exe
  C:\Windows\System\jZnyrFj.exe
  2⤵
  PID:6260
- C:\Windows\System\lSYyZvQ.exe
  C:\Windows\System\lSYyZvQ.exe
  2⤵
  PID:6944
- C:\Windows\System\fgZZXZN.exe
  C:\Windows\System\fgZZXZN.exe
  2⤵
  PID:7936
- C:\Windows\System\ruFeRey.exe
  C:\Windows\System\ruFeRey.exe
  2⤵
  PID:7988
- C:\Windows\System\EFUIyER.exe
  C:\Windows\System\EFUIyER.exe
  2⤵
  PID:8184
- C:\Windows\System\hLPsYiU.exe
  C:\Windows\System\hLPsYiU.exe
  2⤵
  PID:6832
- C:\Windows\System\cajwntU.exe
  C:\Windows\System\cajwntU.exe
  2⤵
  PID:7344
- C:\Windows\System\cGqcVHi.exe
  C:\Windows\System\cGqcVHi.exe
  2⤵
  PID:7056
- C:\Windows\System\pOWfRPQ.exe
  C:\Windows\System\pOWfRPQ.exe
  2⤵
  PID:6096
- C:\Windows\System\SPtgSVn.exe
  C:\Windows\System\SPtgSVn.exe
  2⤵
  PID:6996
- C:\Windows\System\LXeFrsb.exe
  C:\Windows\System\LXeFrsb.exe
  2⤵
  PID:7360
- C:\Windows\System\twNlhvL.exe
  C:\Windows\System\twNlhvL.exe
  2⤵
  PID:7292
- C:\Windows\System\gxrRJEW.exe
  C:\Windows\System\gxrRJEW.exe
  2⤵
  PID:6980
- C:\Windows\System\jvJRFFU.exe
  C:\Windows\System\jvJRFFU.exe
  2⤵
  PID:8188
- C:\Windows\System\ZRMlNjV.exe
  C:\Windows\System\ZRMlNjV.exe
  2⤵
  PID:7280
- C:\Windows\System\DGNgbnR.exe
  C:\Windows\System\DGNgbnR.exe
  2⤵
  PID:7340
- C:\Windows\System\wsKhsyn.exe
  C:\Windows\System\wsKhsyn.exe
  2⤵
  PID:7872
- C:\Windows\System\gsVEFJA.exe
  C:\Windows\System\gsVEFJA.exe
  2⤵
  PID:7228
- C:\Windows\System\mMFACDe.exe
  C:\Windows\System\mMFACDe.exe
  2⤵
  PID:8156
- C:\Windows\System\ilBzlzf.exe
  C:\Windows\System\ilBzlzf.exe
  2⤵
  PID:7712
- C:\Windows\System\qTXqbKq.exe
  C:\Windows\System\qTXqbKq.exe
  2⤵
  PID:7940
- C:\Windows\System\nEIVmRS.exe
  C:\Windows\System\nEIVmRS.exe
  2⤵
  PID:7804
- C:\Windows\System\TQCvNMO.exe
  C:\Windows\System\TQCvNMO.exe
  2⤵
  PID:6708
- C:\Windows\System\OFHeyOq.exe
  C:\Windows\System\OFHeyOq.exe
  2⤵
  PID:8088
- C:\Windows\System\KfEwlBk.exe
  C:\Windows\System\KfEwlBk.exe
  2⤵
  PID:8208
- C:\Windows\System\Dnvipqn.exe
  C:\Windows\System\Dnvipqn.exe
  2⤵
  PID:8224
- C:\Windows\System\sjgJppH.exe
  C:\Windows\System\sjgJppH.exe
  2⤵
  PID:8240
- C:\Windows\System\bJQRqGR.exe
  C:\Windows\System\bJQRqGR.exe
  2⤵
  PID:8256
- C:\Windows\System\bGhHBhu.exe
  C:\Windows\System\bGhHBhu.exe
  2⤵
  PID:8272
- C:\Windows\System\OAZAIfE.exe
  C:\Windows\System\OAZAIfE.exe
  2⤵
  PID:8288
- C:\Windows\System\oNHkaXv.exe
  C:\Windows\System\oNHkaXv.exe
  2⤵
  PID:8304
- C:\Windows\System\GGwZbnJ.exe
  C:\Windows\System\GGwZbnJ.exe
  2⤵
  PID:8320
- C:\Windows\System\lRPhRQI.exe
  C:\Windows\System\lRPhRQI.exe
  2⤵
  PID:8336
- C:\Windows\System\nXVLvei.exe
  C:\Windows\System\nXVLvei.exe
  2⤵
  PID:8356
- C:\Windows\System\kecZobr.exe
  C:\Windows\System\kecZobr.exe
  2⤵
  PID:8372
- C:\Windows\System\kSpWnWZ.exe
  C:\Windows\System\kSpWnWZ.exe
  2⤵
  PID:8388
- C:\Windows\System\yrYifEY.exe
  C:\Windows\System\yrYifEY.exe
  2⤵
  PID:8404
- C:\Windows\System\LsyjSqJ.exe
  C:\Windows\System\LsyjSqJ.exe
  2⤵
  PID:8420
- C:\Windows\System\CGvcJhM.exe
  C:\Windows\System\CGvcJhM.exe
  2⤵
  PID:8436
- C:\Windows\System\bayqXta.exe
  C:\Windows\System\bayqXta.exe
  2⤵
  PID:8452
- C:\Windows\System\xpCbQWc.exe
  C:\Windows\System\xpCbQWc.exe
  2⤵
  PID:8468
- C:\Windows\System\rhBWCzu.exe
  C:\Windows\System\rhBWCzu.exe
  2⤵
  PID:8484
- C:\Windows\System\DjNlMIr.exe
  C:\Windows\System\DjNlMIr.exe
  2⤵
  PID:8500
- C:\Windows\System\vtLjYPh.exe
  C:\Windows\System\vtLjYPh.exe
  2⤵
  PID:8516
- C:\Windows\System\XOGaKSE.exe
  C:\Windows\System\XOGaKSE.exe
  2⤵
  PID:8532
- C:\Windows\System\HlDHMsc.exe
  C:\Windows\System\HlDHMsc.exe
  2⤵
  PID:8548
- C:\Windows\System\BmdeJLv.exe
  C:\Windows\System\BmdeJLv.exe
  2⤵
  PID:8564
- C:\Windows\System\oaSvCfF.exe
  C:\Windows\System\oaSvCfF.exe
  2⤵
  PID:8580
- C:\Windows\System\BvbqGXg.exe
  C:\Windows\System\BvbqGXg.exe
  2⤵
  PID:8596
- C:\Windows\System\vWTrkPF.exe
  C:\Windows\System\vWTrkPF.exe
  2⤵
  PID:8612
- C:\Windows\System\EuvQEmi.exe
  C:\Windows\System\EuvQEmi.exe
  2⤵
  PID:8628
- C:\Windows\System\byaTJax.exe
  C:\Windows\System\byaTJax.exe
  2⤵
  PID:8644
- C:\Windows\System\CMQBNBA.exe
  C:\Windows\System\CMQBNBA.exe
  2⤵
  PID:8660
- C:\Windows\System\bJlTGFY.exe
  C:\Windows\System\bJlTGFY.exe
  2⤵
  PID:8676
- C:\Windows\System\NxOCUtA.exe
  C:\Windows\System\NxOCUtA.exe
  2⤵
  PID:8692
- C:\Windows\System\FvDlQdG.exe
  C:\Windows\System\FvDlQdG.exe
  2⤵
  PID:8708
- C:\Windows\System\mwKlhlJ.exe
  C:\Windows\System\mwKlhlJ.exe
  2⤵
  PID:8724
- C:\Windows\System\ehVuBEm.exe
  C:\Windows\System\ehVuBEm.exe
  2⤵
  PID:8740
- C:\Windows\System\aGuTkbV.exe
  C:\Windows\System\aGuTkbV.exe
  2⤵
  PID:8756
- C:\Windows\System\DhECUQT.exe
  C:\Windows\System\DhECUQT.exe
  2⤵
  PID:8772
- C:\Windows\System\LokqwXL.exe
  C:\Windows\System\LokqwXL.exe
  2⤵
  PID:8788
- C:\Windows\System\fABTQHt.exe
  C:\Windows\System\fABTQHt.exe
  2⤵
  PID:8804
- C:\Windows\System\LnWgihW.exe
  C:\Windows\System\LnWgihW.exe
  2⤵
  PID:8820
- C:\Windows\System\tUPZTdP.exe
  C:\Windows\System\tUPZTdP.exe
  2⤵
  PID:8836
- C:\Windows\System\EZMmqhK.exe
  C:\Windows\System\EZMmqhK.exe
  2⤵
  PID:8852
- C:\Windows\System\OuyeKsB.exe
  C:\Windows\System\OuyeKsB.exe
  2⤵
  PID:8868
- C:\Windows\System\pdiGcTJ.exe
  C:\Windows\System\pdiGcTJ.exe
  2⤵
  PID:8884
- C:\Windows\System\IAwYhtQ.exe
  C:\Windows\System\IAwYhtQ.exe
  2⤵
  PID:8900
- C:\Windows\System\njoZjoM.exe
  C:\Windows\System\njoZjoM.exe
  2⤵
  PID:8916
- C:\Windows\System\LcVIjsD.exe
  C:\Windows\System\LcVIjsD.exe
  2⤵
  PID:8932
- C:\Windows\System\edMeOqy.exe
  C:\Windows\System\edMeOqy.exe
  2⤵
  PID:8948
- C:\Windows\System\CDfsiYd.exe
  C:\Windows\System\CDfsiYd.exe
  2⤵
  PID:8964
- C:\Windows\System\Rrhcjeo.exe
  C:\Windows\System\Rrhcjeo.exe
  2⤵
  PID:8980
- C:\Windows\System\HLsXnHI.exe
  C:\Windows\System\HLsXnHI.exe
  2⤵
  PID:8996
- C:\Windows\System\vKuGDRM.exe
  C:\Windows\System\vKuGDRM.exe
  2⤵
  PID:9012
- C:\Windows\System\tQZQMfA.exe
  C:\Windows\System\tQZQMfA.exe
  2⤵
  PID:9028
- C:\Windows\System\jspyVgA.exe
  C:\Windows\System\jspyVgA.exe
  2⤵
  PID:9044
- C:\Windows\System\UiZzEQM.exe
  C:\Windows\System\UiZzEQM.exe
  2⤵
  PID:9060
- C:\Windows\System\VfMRdCx.exe
  C:\Windows\System\VfMRdCx.exe
  2⤵
  PID:9076
- C:\Windows\System\NAOClfm.exe
  C:\Windows\System\NAOClfm.exe
  2⤵
  PID:9092
- C:\Windows\System\aInOQDX.exe
  C:\Windows\System\aInOQDX.exe
  2⤵
  PID:9108
- C:\Windows\System\hgmHqIR.exe
  C:\Windows\System\hgmHqIR.exe
  2⤵
  PID:9124
- C:\Windows\System\YjKSgLq.exe
  C:\Windows\System\YjKSgLq.exe
  2⤵
  PID:9140
- C:\Windows\System\fpEUfZA.exe
  C:\Windows\System\fpEUfZA.exe
  2⤵
  PID:9156
- C:\Windows\System\GmPycad.exe
  C:\Windows\System\GmPycad.exe
  2⤵
  PID:9172
- C:\Windows\System\acRBOlh.exe
  C:\Windows\System\acRBOlh.exe
  2⤵
  PID:9188
- C:\Windows\System\lQivcBz.exe
  C:\Windows\System\lQivcBz.exe
  2⤵
  PID:9204
- C:\Windows\System\ZZcvgYi.exe
  C:\Windows\System\ZZcvgYi.exe
  2⤵
  PID:8204
- C:\Windows\System\ByKGzIz.exe
  C:\Windows\System\ByKGzIz.exe
  2⤵
  PID:8236
- C:\Windows\System\jOUaOTH.exe
  C:\Windows\System\jOUaOTH.exe
  2⤵
  PID:6320
- C:\Windows\System\KrhcLQx.exe
  C:\Windows\System\KrhcLQx.exe
  2⤵
  PID:8032
- C:\Windows\System\hYtFAwz.exe
  C:\Windows\System\hYtFAwz.exe
  2⤵
  PID:7680
- C:\Windows\System\mNRKmYj.exe
  C:\Windows\System\mNRKmYj.exe
  2⤵
  PID:8264
- C:\Windows\System\zxYiDak.exe
  C:\Windows\System\zxYiDak.exe
  2⤵
  PID:8328
- C:\Windows\System\UEnrgvH.exe
  C:\Windows\System\UEnrgvH.exe
  2⤵
  PID:7456
- C:\Windows\System\OXBUmqf.exe
  C:\Windows\System\OXBUmqf.exe
  2⤵
  PID:8248
- C:\Windows\System\tZipgwm.exe
  C:\Windows\System\tZipgwm.exe
  2⤵
  PID:8312
- C:\Windows\System\WSKyzFQ.exe
  C:\Windows\System\WSKyzFQ.exe
  2⤵
  PID:8368
- C:\Windows\System\QuTmRKh.exe
  C:\Windows\System\QuTmRKh.exe
  2⤵
  PID:8432
- C:\Windows\System\wRyNQrq.exe
  C:\Windows\System\wRyNQrq.exe
  2⤵
  PID:8496
- C:\Windows\System\OqWAkBV.exe
  C:\Windows\System\OqWAkBV.exe
  2⤵
  PID:8352
- C:\Windows\System\sZkzFRz.exe
  C:\Windows\System\sZkzFRz.exe
  2⤵
  PID:8384
- C:\Windows\System\BoYVuOf.exe
  C:\Windows\System\BoYVuOf.exe
  2⤵
  PID:8444
- C:\Windows\System\kjkqIPs.exe
  C:\Windows\System\kjkqIPs.exe
  2⤵
  PID:8508
- C:\Windows\System\mPBTfMF.exe
  C:\Windows\System\mPBTfMF.exe
  2⤵
  PID:8624
- C:\Windows\System\olqmtXS.exe
  C:\Windows\System\olqmtXS.exe
  2⤵
  PID:8576
- C:\Windows\System\AkwASfU.exe
  C:\Windows\System\AkwASfU.exe
  2⤵
  PID:8720
- C:\Windows\System\YIvVmPH.exe
  C:\Windows\System\YIvVmPH.exe
  2⤵
  PID:8640
- C:\Windows\System\QYgGZyQ.exe
  C:\Windows\System\QYgGZyQ.exe
  2⤵
  PID:8752
- C:\Windows\System\miTANSF.exe
  C:\Windows\System\miTANSF.exe
  2⤵
  PID:8784
- C:\Windows\System\cRXOehS.exe
  C:\Windows\System\cRXOehS.exe
  2⤵
  PID:8768
- C:\Windows\System\TlSegBW.exe
  C:\Windows\System\TlSegBW.exe
  2⤵
  PID:8800
- C:\Windows\System\aqRLCce.exe
  C:\Windows\System\aqRLCce.exe
  2⤵
  PID:8880
- C:\Windows\System\qpbxQqv.exe
  C:\Windows\System\qpbxQqv.exe
  2⤵
  PID:8944
- C:\Windows\System\ZkCmRGA.exe
  C:\Windows\System\ZkCmRGA.exe
  2⤵
  PID:9004
- C:\Windows\System\liUSDCC.exe
  C:\Windows\System\liUSDCC.exe
  2⤵
  PID:9036
- C:\Windows\System\CxqewCG.exe
  C:\Windows\System\CxqewCG.exe
  2⤵
  PID:8896
- C:\Windows\System\wdgvalh.exe
  C:\Windows\System\wdgvalh.exe
  2⤵
  PID:9040
- C:\Windows\System\ZbnUtwv.exe
  C:\Windows\System\ZbnUtwv.exe
  2⤵
  PID:8992
- C:\Windows\System\ObtLigX.exe
  C:\Windows\System\ObtLigX.exe
  2⤵
  PID:9056
- C:\Windows\System\CEMdknk.exe
  C:\Windows\System\CEMdknk.exe
  2⤵
  PID:9088
- C:\Windows\System\SJJjeiV.exe
  C:\Windows\System\SJJjeiV.exe
  2⤵
  PID:9164
- C:\Windows\System\gPWDUME.exe
  C:\Windows\System\gPWDUME.exe
  2⤵
  PID:9180
- C:\Windows\System\myVRAxi.exe
  C:\Windows\System\myVRAxi.exe
  2⤵
  PID:9200
- C:\Windows\System\saVoPqy.exe
  C:\Windows\System\saVoPqy.exe
  2⤵
  PID:7324
- C:\Windows\System\VnoLwlh.exe
  C:\Windows\System\VnoLwlh.exe
  2⤵
  PID:8024
- C:\Windows\System\XLNMcKa.exe
  C:\Windows\System\XLNMcKa.exe
  2⤵
  PID:8428
- C:\Windows\System\xvEuQad.exe
  C:\Windows\System\xvEuQad.exe
  2⤵
  PID:8592
- C:\Windows\System\nYFWdZr.exe
  C:\Windows\System\nYFWdZr.exe
  2⤵
  PID:8684
- C:\Windows\System\LXXZxbY.exe
  C:\Windows\System\LXXZxbY.exe
  2⤵
  PID:8812
- C:\Windows\System\AIayxaR.exe
  C:\Windows\System\AIayxaR.exe
  2⤵
  PID:8300
- C:\Windows\System\gzAoTPb.exe
  C:\Windows\System\gzAoTPb.exe
  2⤵
  PID:8284
- C:\Windows\System\yyRwIfR.exe
  C:\Windows\System\yyRwIfR.exe
  2⤵
  PID:7844
- C:\Windows\System\PplXmQv.exe
  C:\Windows\System\PplXmQv.exe
  2⤵
  PID:7664
- C:\Windows\System\EOylyDf.exe
  C:\Windows\System\EOylyDf.exe
  2⤵
  PID:8976
- C:\Windows\System\awrUqCJ.exe
  C:\Windows\System\awrUqCJ.exe
  2⤵
  PID:8380
- C:\Windows\System\XPbCAjB.exe
  C:\Windows\System\XPbCAjB.exe
  2⤵
  PID:8796
- C:\Windows\System\cnQPjdo.exe
  C:\Windows\System\cnQPjdo.exe
  2⤵
  PID:8892
- C:\Windows\System\xRpjKXJ.exe
  C:\Windows\System\xRpjKXJ.exe
  2⤵
  PID:9008
- C:\Windows\System\AmaCaGz.exe
  C:\Windows\System\AmaCaGz.exe
  2⤵
  PID:9104
- C:\Windows\System\WkbpqbE.exe
  C:\Windows\System\WkbpqbE.exe
  2⤵
  PID:9196
- C:\Windows\System\bIoFDgl.exe
  C:\Windows\System\bIoFDgl.exe
  2⤵
  PID:7264
- C:\Windows\System\kmFafNj.exe
  C:\Windows\System\kmFafNj.exe
  2⤵
  PID:9184
- C:\Windows\System\lNljRpv.exe
  C:\Windows\System\lNljRpv.exe
  2⤵
  PID:6436
- C:\Windows\System\RKnrgBg.exe
  C:\Windows\System\RKnrgBg.exe
  2⤵
  PID:7028
- C:\Windows\System\qKXUdiU.exe
  C:\Windows\System\qKXUdiU.exe
  2⤵
  PID:9212
- C:\Windows\System\DFSUhTb.exe
  C:\Windows\System\DFSUhTb.exe
  2⤵
  PID:8876
- C:\Windows\System\EpMEqPZ.exe
  C:\Windows\System\EpMEqPZ.exe
  2⤵
  PID:8668
- C:\Windows\System\ijAhkZL.exe
  C:\Windows\System\ijAhkZL.exe
  2⤵
  PID:8732
- C:\Windows\System\OIJOyNp.exe
  C:\Windows\System\OIJOyNp.exe
  2⤵
  PID:8864
- C:\Windows\System\CInxMIL.exe
  C:\Windows\System\CInxMIL.exe
  2⤵
  PID:8960
- C:\Windows\System\BtjkFrS.exe
  C:\Windows\System\BtjkFrS.exe
  2⤵
  PID:8848
- C:\Windows\System\uYfDgxj.exe
  C:\Windows\System\uYfDgxj.exe
  2⤵
  PID:8492
- C:\Windows\System\zWiktqZ.exe
  C:\Windows\System\zWiktqZ.exe
  2⤵
  PID:9052
- C:\Windows\System\JpUSIkc.exe
  C:\Windows\System\JpUSIkc.exe
  2⤵
  PID:8540
- C:\Windows\System\mMvfUMH.exe
  C:\Windows\System\mMvfUMH.exe
  2⤵
  PID:8364
- C:\Windows\System\BaWcYmk.exe
  C:\Windows\System\BaWcYmk.exe
  2⤵
  PID:8940
- C:\Windows\System\adRIBTc.exe
  C:\Windows\System\adRIBTc.exe
  2⤵
  PID:8200
- C:\Windows\System\EpkwbtC.exe
  C:\Windows\System\EpkwbtC.exe
  2⤵
  PID:9220
- C:\Windows\System\vsFAFpy.exe
  C:\Windows\System\vsFAFpy.exe
  2⤵
  PID:9236
- C:\Windows\System\fwENDZZ.exe
  C:\Windows\System\fwENDZZ.exe
  2⤵
  PID:9252
- C:\Windows\System\NasLJUB.exe
  C:\Windows\System\NasLJUB.exe
  2⤵
  PID:9268
- C:\Windows\System\eFAXhik.exe
  C:\Windows\System\eFAXhik.exe
  2⤵
  PID:9284
- C:\Windows\System\wpoWmKF.exe
  C:\Windows\System\wpoWmKF.exe
  2⤵
  PID:9300
- C:\Windows\System\ZOZoriu.exe
  C:\Windows\System\ZOZoriu.exe
  2⤵
  PID:9316
- C:\Windows\System\PBOKYtl.exe
  C:\Windows\System\PBOKYtl.exe
  2⤵
  PID:9332
- C:\Windows\System\pvKXFCl.exe
  C:\Windows\System\pvKXFCl.exe
  2⤵
  PID:9348
- C:\Windows\System\nLRSsxK.exe
  C:\Windows\System\nLRSsxK.exe
  2⤵
  PID:9364
- C:\Windows\System\MFmeWPO.exe
  C:\Windows\System\MFmeWPO.exe
  2⤵
  PID:9380
- C:\Windows\System\lWIkRDF.exe
  C:\Windows\System\lWIkRDF.exe
  2⤵
  PID:9396
- C:\Windows\System\zEOjoPK.exe
  C:\Windows\System\zEOjoPK.exe
  2⤵
  PID:9412
- C:\Windows\System\ZYQCmaD.exe
  C:\Windows\System\ZYQCmaD.exe
  2⤵
  PID:9428
- C:\Windows\System\tSaQBhS.exe
  C:\Windows\System\tSaQBhS.exe
  2⤵
  PID:9444
- C:\Windows\System\GddwxMq.exe
  C:\Windows\System\GddwxMq.exe
  2⤵
  PID:9460
- C:\Windows\System\TwvhNlr.exe
  C:\Windows\System\TwvhNlr.exe
  2⤵
  PID:9476
- C:\Windows\System\nnAebRA.exe
  C:\Windows\System\nnAebRA.exe
  2⤵
  PID:9492
- C:\Windows\System\ssPYFCJ.exe
  C:\Windows\System\ssPYFCJ.exe
  2⤵
  PID:9508
- C:\Windows\System\cVAwSQb.exe
  C:\Windows\System\cVAwSQb.exe
  2⤵
  PID:9524
- C:\Windows\System\LuGUCHv.exe
  C:\Windows\System\LuGUCHv.exe
  2⤵
  PID:9540
- C:\Windows\System\JnierNW.exe
  C:\Windows\System\JnierNW.exe
  2⤵
  PID:9556
- C:\Windows\System\qSBuAiH.exe
  C:\Windows\System\qSBuAiH.exe
  2⤵
  PID:9572
- C:\Windows\System\bURApCU.exe
  C:\Windows\System\bURApCU.exe
  2⤵
  PID:9588
- C:\Windows\System\oTQakjE.exe
  C:\Windows\System\oTQakjE.exe
  2⤵
  PID:9604
- C:\Windows\System\tiekjEe.exe
  C:\Windows\System\tiekjEe.exe
  2⤵
  PID:9620
- C:\Windows\System\UEYJfmx.exe
  C:\Windows\System\UEYJfmx.exe
  2⤵
  PID:9636
- C:\Windows\System\qNtiCQa.exe
  C:\Windows\System\qNtiCQa.exe
  2⤵
  PID:9652
- C:\Windows\System\wTsBbef.exe
  C:\Windows\System\wTsBbef.exe
  2⤵
  PID:9668
- C:\Windows\System\ltDOHFM.exe
  C:\Windows\System\ltDOHFM.exe
  2⤵
  PID:9684
- C:\Windows\System\cduFcIo.exe
  C:\Windows\System\cduFcIo.exe
  2⤵
  PID:9700
- C:\Windows\System\NMtgBAt.exe
  C:\Windows\System\NMtgBAt.exe
  2⤵
  PID:9716
- C:\Windows\System\PQRyUKU.exe
  C:\Windows\System\PQRyUKU.exe
  2⤵
  PID:9732
- C:\Windows\System\blbAQEQ.exe
  C:\Windows\System\blbAQEQ.exe
  2⤵
  PID:9748
- C:\Windows\System\QbrWbPU.exe
  C:\Windows\System\QbrWbPU.exe
  2⤵
  PID:9764
- C:\Windows\System\DKmpVRW.exe
  C:\Windows\System\DKmpVRW.exe
  2⤵
  PID:9780
- C:\Windows\System\sfAbJiP.exe
  C:\Windows\System\sfAbJiP.exe
  2⤵
  PID:9796
- C:\Windows\System\cnUGewy.exe
  C:\Windows\System\cnUGewy.exe
  2⤵
  PID:9812
- C:\Windows\System\ZXOJIxQ.exe
  C:\Windows\System\ZXOJIxQ.exe
  2⤵
  PID:9828
- C:\Windows\System\gJbDskD.exe
  C:\Windows\System\gJbDskD.exe
  2⤵
  PID:9844
- C:\Windows\System\BvcnDfu.exe
  C:\Windows\System\BvcnDfu.exe
  2⤵
  PID:9860
- C:\Windows\System\bEmZShW.exe
  C:\Windows\System\bEmZShW.exe
  2⤵
  PID:9876
- C:\Windows\System\iyoUZNL.exe
  C:\Windows\System\iyoUZNL.exe
  2⤵
  PID:9892
- C:\Windows\System\ZxgyjPq.exe
  C:\Windows\System\ZxgyjPq.exe
  2⤵
  PID:9908
- C:\Windows\System\hTycuxf.exe
  C:\Windows\System\hTycuxf.exe
  2⤵
  PID:9924
- C:\Windows\System\PYvRRpw.exe
  C:\Windows\System\PYvRRpw.exe
  2⤵
  PID:9940
- C:\Windows\System\wiRiamw.exe
  C:\Windows\System\wiRiamw.exe
  2⤵
  PID:9956
- C:\Windows\System\YdOQtmX.exe
  C:\Windows\System\YdOQtmX.exe
  2⤵
  PID:9972
- C:\Windows\System\jbDWfbM.exe
  C:\Windows\System\jbDWfbM.exe
  2⤵
  PID:9988
- C:\Windows\System\KQXBCXW.exe
  C:\Windows\System\KQXBCXW.exe
  2⤵
  PID:10008
- C:\Windows\System\OPhkrke.exe
  C:\Windows\System\OPhkrke.exe
  2⤵
  PID:10024
- C:\Windows\System\OUUruDt.exe
  C:\Windows\System\OUUruDt.exe
  2⤵
  PID:10040
- C:\Windows\System\ovgiONR.exe
  C:\Windows\System\ovgiONR.exe
  2⤵
  PID:10056
- C:\Windows\System\hPpFLgE.exe
  C:\Windows\System\hPpFLgE.exe
  2⤵
  PID:10072
- C:\Windows\System\OZBdUTD.exe
  C:\Windows\System\OZBdUTD.exe
  2⤵
  PID:10088
- C:\Windows\System\MarbpnC.exe
  C:\Windows\System\MarbpnC.exe
  2⤵
  PID:10104
- C:\Windows\System\rKxFKDa.exe
  C:\Windows\System\rKxFKDa.exe
  2⤵
  PID:10120
- C:\Windows\System\KXtGarG.exe
  C:\Windows\System\KXtGarG.exe
  2⤵
  PID:10136
- C:\Windows\System\MpfRdrc.exe
  C:\Windows\System\MpfRdrc.exe
  2⤵
  PID:10152
- C:\Windows\System\aHhBRFe.exe
  C:\Windows\System\aHhBRFe.exe
  2⤵
  PID:10168
- C:\Windows\System\ODiKVBL.exe
  C:\Windows\System\ODiKVBL.exe
  2⤵
  PID:10184
- C:\Windows\System\DBejdzL.exe
  C:\Windows\System\DBejdzL.exe
  2⤵
  PID:10200
- C:\Windows\System\TccHYXz.exe
  C:\Windows\System\TccHYXz.exe
  2⤵
  PID:10216
- C:\Windows\System\GQabTkp.exe
  C:\Windows\System\GQabTkp.exe
  2⤵
  PID:10232
- C:\Windows\System\QOWcQHv.exe
  C:\Windows\System\QOWcQHv.exe
  2⤵
  PID:9244
- C:\Windows\System\ZLjrfOB.exe
  C:\Windows\System\ZLjrfOB.exe
  2⤵
  PID:9308
- C:\Windows\System\CuwhJTJ.exe
  C:\Windows\System\CuwhJTJ.exe
  2⤵
  PID:9152
- C:\Windows\System\vHzTEmI.exe
  C:\Windows\System\vHzTEmI.exe
  2⤵
  PID:9372
- C:\Windows\System\eDQwxvw.exe
  C:\Windows\System\eDQwxvw.exe
  2⤵
  PID:9228
- C:\Windows\System\bSLpXNH.exe
  C:\Windows\System\bSLpXNH.exe
  2⤵
  PID:9296
- C:\Windows\System\nLEOzGd.exe
  C:\Windows\System\nLEOzGd.exe
  2⤵
  PID:9356
- C:\Windows\System\vcNmSCn.exe
  C:\Windows\System\vcNmSCn.exe
  2⤵
  PID:9436
- C:\Windows\System\nvBsNFx.exe
  C:\Windows\System\nvBsNFx.exe
  2⤵
  PID:9500
- C:\Windows\System\PaRzYRh.exe
  C:\Windows\System\PaRzYRh.exe
  2⤵
  PID:9452
- C:\Windows\System\oeKypPo.exe
  C:\Windows\System\oeKypPo.exe
  2⤵
  PID:9536
- C:\Windows\System\JUnYKNK.exe
  C:\Windows\System\JUnYKNK.exe
  2⤵
  PID:9600
- C:\Windows\System\rQCythp.exe
  C:\Windows\System\rQCythp.exe
  2⤵
  PID:9516
- C:\Windows\System\WCmsEEy.exe
  C:\Windows\System\WCmsEEy.exe
  2⤵
  PID:9696
- C:\Windows\System\pmowgrK.exe
  C:\Windows\System\pmowgrK.exe
  2⤵
  PID:9756
- C:\Windows\System\DkykhUw.exe
  C:\Windows\System\DkykhUw.exe
  2⤵
  PID:9584
- C:\Windows\System\CFKptwT.exe
  C:\Windows\System\CFKptwT.exe
  2⤵
  PID:9676
- C:\Windows\System\RZhyZiD.exe
  C:\Windows\System\RZhyZiD.exe
  2⤵
  PID:9776
- C:\Windows\System\owqZoKR.exe
  C:\Windows\System\owqZoKR.exe
  2⤵
  PID:9648
- C:\Windows\System\GjiKmoW.exe
  C:\Windows\System\GjiKmoW.exe
  2⤵
  PID:9852
- C:\Windows\System\XjmSDdD.exe
  C:\Windows\System\XjmSDdD.exe
  2⤵
  PID:9804
- C:\Windows\System\CBdNRzk.exe
  C:\Windows\System\CBdNRzk.exe
  2⤵
  PID:9868
- C:\Windows\System\mgZXxmT.exe
  C:\Windows\System\mgZXxmT.exe
  2⤵
  PID:9948
- C:\Windows\System\DOsVEEP.exe
  C:\Windows\System\DOsVEEP.exe
  2⤵
  PID:9900
- C:\Windows\System\DPtxpqU.exe
  C:\Windows\System\DPtxpqU.exe
  2⤵
  PID:9936
- C:\Windows\System\RsZCchQ.exe
  C:\Windows\System\RsZCchQ.exe
  2⤵
  PID:10020
- C:\Windows\System\zSbRizK.exe
  C:\Windows\System\zSbRizK.exe
  2⤵
  PID:10084
- C:\Windows\System\lPRwngT.exe
  C:\Windows\System\lPRwngT.exe
  2⤵
  PID:10144
- C:\Windows\System\OmBKSqy.exe
  C:\Windows\System\OmBKSqy.exe
  2⤵
  PID:10212
- C:\Windows\System\YQStvMA.exe
  C:\Windows\System\YQStvMA.exe
  2⤵
  PID:7660
- C:\Windows\System\oFQvHYg.exe
  C:\Windows\System\oFQvHYg.exe
  2⤵
  PID:10064
- C:\Windows\System\dVwJgMe.exe
  C:\Windows\System\dVwJgMe.exe
  2⤵
  PID:10128
- C:\Windows\System\WOdiWhc.exe
  C:\Windows\System\WOdiWhc.exe
  2⤵
  PID:10192
- C:\Windows\System\yihydHA.exe
  C:\Windows\System\yihydHA.exe
  2⤵
  PID:9276
- C:\Windows\System\mdxKtya.exe
  C:\Windows\System\mdxKtya.exe
  2⤵
  PID:8688
- C:\Windows\System\bdpkPLb.exe
  C:\Windows\System\bdpkPLb.exe
  2⤵
  PID:9344
- C:\Windows\System\KtSYggJ.exe
  C:\Windows\System\KtSYggJ.exe
  2⤵
  PID:9392
- C:\Windows\System\rxBGAEL.exe
  C:\Windows\System\rxBGAEL.exe
  2⤵
  PID:9504
- C:\Windows\System\bQQExfn.exe
  C:\Windows\System\bQQExfn.exe
  2⤵
  PID:9728
- C:\Windows\System\jXwvqCI.exe
  C:\Windows\System\jXwvqCI.exe
  2⤵
  PID:9616
- C:\Windows\System\tNfTWus.exe
  C:\Windows\System\tNfTWus.exe
  2⤵
  PID:9708
- C:\Windows\System\CrfJOFT.exe
  C:\Windows\System\CrfJOFT.exe
  2⤵
  PID:9788
- C:\Windows\System\CYciynt.exe
  C:\Windows\System\CYciynt.exe
  2⤵
  PID:9884
- C:\Windows\System\tIFvWXm.exe
  C:\Windows\System\tIFvWXm.exe
  2⤵
  PID:9920
- C:\Windows\System\KcWttpC.exe
  C:\Windows\System\KcWttpC.exe
  2⤵
  PID:9840
- C:\Windows\System\ScJjlfQ.exe
  C:\Windows\System\ScJjlfQ.exe
  2⤵
  PID:9984
- C:\Windows\System\iowVPrG.exe
  C:\Windows\System\iowVPrG.exe
  2⤵
  PID:10176
- C:\Windows\System\yCSKyYR.exe
  C:\Windows\System\yCSKyYR.exe
  2⤵
  PID:10036
- C:\Windows\System\NolwkAz.exe
  C:\Windows\System\NolwkAz.exe
  2⤵
  PID:9404
- C:\Windows\System\lPwvOvQ.exe
  C:\Windows\System\lPwvOvQ.exe
  2⤵
  PID:10116
- C:\Windows\System\RMOyiMI.exe
  C:\Windows\System\RMOyiMI.exe
  2⤵
  PID:9456
- C:\Windows\System\KIGggcC.exe
  C:\Windows\System\KIGggcC.exe
  2⤵
  PID:9408
- C:\Windows\System\jnlMucP.exe
  C:\Windows\System\jnlMucP.exe
  2⤵
  PID:9596
- C:\Windows\System\dteZVoe.exe
  C:\Windows\System\dteZVoe.exe
  2⤵
  PID:9836
- C:\Windows\System\lAbknwq.exe
  C:\Windows\System\lAbknwq.exe
  2⤵
  PID:10164
- C:\Windows\System\HMwTkyL.exe
  C:\Windows\System\HMwTkyL.exe
  2⤵
  PID:10228
- C:\Windows\System\HhTwGQg.exe
  C:\Windows\System\HhTwGQg.exe
  2⤵
  PID:9632
- C:\Windows\System\KhikDpI.exe
  C:\Windows\System\KhikDpI.exe
  2⤵
  PID:10252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BryuBSO.exe

Filesize
1.9MB

MD5
590640e442819165cac0e40a820ce1dc

SHA1
f177eab39366170cfb050c21f2fe307b365a76a0

SHA256
d7873c59741db2207067101583bf35e632091cb1d8741a69802201d466cd84ac

SHA512
30399dd5ae93ca304aa01787ae017b7609575dcb92f85774a625823168c2c229497cd5ffc3e85ca4cdb7c72e6e9549d2bfab39638118e21eb73c118fa486eefe

Download Submit
C:\Windows\system\DwCinZC.exe

Filesize
1.9MB

MD5
2679c50737190b3440c3c436536e7d62

SHA1
748b41be9efb2a4d26ddb99d14c3eb6d001a0a1c

SHA256
61696080d9acdc3b58d629bda35a3508ad84e574f029e9071bc6ca02081dd535

SHA512
84ff9a7a7afd51aa7e09ae3e32795aca08333e9debfcf3d07abcc68b13b83a87f89d838c8f83f3007ac6c1b247c533f4bbeebebdde1b98255249519880327082

Download Submit
C:\Windows\system\FJTMnSS.exe

Filesize
1.9MB

MD5
bdfac8df1a93ad08812728223afc5143

SHA1
90478723fd4787a859010ad0091ba54b74ed7e11

SHA256
7a2650a51fd97e8c4602eb74a3bf65dce37bc8841b8424266d2743fa1db41ef1

SHA512
173915b15a5c5b530a7ef061e95e05ee9b172e9d67215faacb59420d9d9461779e6fd9e821faac67ef768aa82cdded83820be27e53fb6870441f6786bf93d5b9

Download Submit
C:\Windows\system\NieImPh.exe

Filesize
1.9MB

MD5
96761144a1ada9bf7765079e8970a09a

SHA1
cd7e3a6c180b8b13819bc0177b7f9a45bf41dded

SHA256
65e91b2c5a03f59ada78888ec12064947892167ab48f867b0cb29543e8cd9b56

SHA512
3ba24ab67544e8f7c3fd2fb190bc697555f60e547ef26a1d070ce0f1aa884228a067ba4fd800cabccfc24b32cc82c7e80a9bf36b2710b950fe02a04991d5be88

Download Submit
C:\Windows\system\QmOZKYP.exe

Filesize
1.9MB

MD5
ce19db76a775a37db39fbffd034a6a8e

SHA1
1771b930c940f9ebf8792bc730b0ab08db362704

SHA256
b86f3996cd591f02ae15baae19523d4738b87893397dd586611f1768ab82a0d5

SHA512
86445b5371feb001501045c2fb9b7795fe72682949e81ba4d5c3037c8234fe3458a2bbb9690504c910378027d769536e67cb5795e9e3b8b9d32acc207ab305fd

Download Submit
C:\Windows\system\SKTivFA.exe

Filesize
1.9MB

MD5
4b8702e283dac9a6d273c9ae294afc26

SHA1
1c1dce8a8b879c5398408264f7c7414476099da5

SHA256
aeb94279518fedb74160373363512b711b041153b53c361a85b844a1e8ad16cb

SHA512
a49817a1979d5569e806791d948c5b59ab76bfdc808a664f48960ce922e768e2d34aeb85a1939599c62e7522a52b467f55203250d8c7fdf736da7abb3fc4588c

Download Submit
C:\Windows\system\YJhUphF.exe

Filesize
1.9MB

MD5
cc45034de67746d8503a8f11a7eebe60

SHA1
1b05a1a71bc0820d5207dfa4d3b004fa5196f946

SHA256
88d57773517285cef9ccc33f2fc31c802636c41515a51b3010253379645c8b29

SHA512
ce39271063e8d2510a8945cb543bd68aab3cf63994685d872722b49168417ec5c12a01263f3e517b16a20503fe38ab656bd42eec1d3edaab0f86b809b0b8fe2e

Download Submit
C:\Windows\system\ZtoUCGT.exe

Filesize
1.9MB

MD5
fafd4b546b0e03bc1ac58d04836d2c7b

SHA1
0a393eb67fa4cd4f68c9d66a15fb03e4fae72547

SHA256
c23f73e9e28f44a3770eae2050d856b9767a17dc3b97febf1734e5b7d7f78b81

SHA512
e0c5af12f0452380931c711e9f5375ff3b92a247b3b158d791ba4f0f9eb1c137a2b787459ba604789a450b05880eee93e5e0e39a6a6d8867667c31bed0c39d47

Download Submit
C:\Windows\system\arvQdHc.exe

Filesize
1.9MB

MD5
484e5f3e60c91b5175b735f82a87e90b

SHA1
41c5eee4a50e10db4010e18677124295941a78b3

SHA256
c1e5ac13c95d64dbf7f259f4903ea73c20ce2589aa5eacdf3b9aab428028a050

SHA512
2145a7bf6dbe036c31225b9d2af221382cd6397b5e80300793db151293bfe5f19640f3b96ba0189edb3a03afcf6c28048aed4afcd75e91e03e8afe7a88938a45

Download Submit
C:\Windows\system\bbZWXsC.exe

Filesize
1.9MB

MD5
6daba12de34d3394fde0ad3d621d3cdc

SHA1
455b2ccafbcab7664eb7be0c5648aed9793dbd0b

SHA256
98b0096d0f45d3f27822e487a5a40796e01a641a4ceb371689875f3ce210a732

SHA512
d5a8ef361ee2e4856eb035b8ad26b37ab3516eac81a96a144c62686cd32e97c65566bb9a58ecfddbaee3d4cabc8d451b83cb510fe049b4d311f91725421be2ad

Download Submit
C:\Windows\system\kxfJIvv.exe

Filesize
1.9MB

MD5
826c638a1ee623efcb4fbd981e9906af

SHA1
d91c1d756aea3b729f093c09ad8b1624fe5a49b5

SHA256
d712221569981df939b4345edae084752576999146de622569d248e23a5e1fb8

SHA512
f8f2829d5611eb198f4968b5784063881a92eb6bbc2795a6523a4b31a9350e1202e4e24a06524f061a73ab74749d6e2da044fa6bef8b0a4535227b3107e086d1

Download Submit
C:\Windows\system\nefOluA.exe

Filesize
1.9MB

MD5
4ee42da9edbef96efad48a940951f3e9

SHA1
cfeef20a89c862453ff757da4ee03b653a636f8d

SHA256
acd06328e4cfb590f21db4cb6e4c1f0d79813abae4b06b282f0fe9d09118c957

SHA512
58064e446cc70a20f812bd3af4c98dcbe49ff7c3a4714e734ebc8a2eb91a3aa87ab836dc153cadd55d2df30e0cb89455914c01d10e597d47fc8c914cf5165731

Download Submit
C:\Windows\system\sEffNVF.exe

Filesize
1.9MB

MD5
c3ed85822e633db196c983d14ce214ee

SHA1
ad79d9abb966dea357902870211303900a91b521

SHA256
b0ce85aa37c10d4386255dfe3674ecfef1e4ed8e3dcfeda58c05fa215c4774de

SHA512
d08178bd1eed522bc05e11c8323d3a135022da917d58f55e9bda10a71d309fd2b5a1e8bc653993d9cf1d256faaf2a4a68e33443bba63e32eb8f92f0e91f982bb

Download Submit
C:\Windows\system\sUqvaCF.exe

Filesize
1.9MB

MD5
bd47c702d40bdab93602e924d0368192

SHA1
afbf2c7e22b3c652d1543d0e9201029dba3f2a4a

SHA256
4e4856a15bb7659a2116637bd008ac53f20c6e6d737d6560012509ac0900b60e

SHA512
2b0aa27b79c841d0efecaab39a4e9c6c16f244e79fb72b57029b2ae9ed7d3d2fd39729318a20115b889bd28b108cc47a655d661e9001d987406a95f085b2c6fb

Download Submit
C:\Windows\system\tNhRWtK.exe

Filesize
1.9MB

MD5
eb734c53b6a7d34a4acd84f0eadf1b4f

SHA1
7ad51c480f1a35783ae97950bade7dc517a4553a

SHA256
d14c894c7153dcc97b1f5fe48331155832240c4fe739039af2c7974ffe7961c6

SHA512
f2f76d4760fe302226bd43013f50707af8881d830a1395d8464a55a5a836b24ceadc543a0cd8d44f2bc784d6c0f9e9e28bc6174bc536b097e9fd3e037ef33ac2

Download Submit
C:\Windows\system\wagsXQh.exe

Filesize
1.9MB

MD5
a69b70ad9b01047175ed22dbd6c73967

SHA1
389d6aaa9437fecbc989c19e4889803740a3f01f

SHA256
03206ea28ce1cfef3db50d000ca14a29e8de09672bdf61ae9bcd0cbf37ea649f

SHA512
0f980535bfe4e078c7297e6680bcf388895464e23c9606a66fbe1510dee073b025675afb61954248bdae534e0b7ae96d8dcda5797cca406e1872db413c661e44

Download Submit
C:\Windows\system\wlRJqBN.exe

Filesize
1.9MB

MD5
8b364fd7fbc5252c4e139847051dca52

SHA1
472b67b6982f41a2a1577e705a8ac118a6095c3d

SHA256
b1dc3ba440cf2d3b1a9af354504aaf4cfc2649ca9efc3173d09c8fd808c08025

SHA512
17361d3a7bef8e76a2388b69806ff001d9a968af84b36ac55322a36cabcadc5303a7fb9362c16886aeb8f23882b2d8ef63d8c86c949638ff7cd97c50616ee81c

Download Submit
C:\Windows\system\xxqKbfg.exe

Filesize
1.9MB

MD5
246c984e512837e7e999b0a1f6dfd4d7

SHA1
f91e565a5827569943d705f9c83f378e69565e4c

SHA256
355b3d8da43aec5962c1595fda5ac890627e6ceb17d1a1153ae30c70dfd0d906

SHA512
7ce35e95c1d676190a10fd7ca2e033029e1da48d534f4c3eb16453ea0198e4165a7e1676cf20e05ddd86b5f2fcf4675e691fc66a8761aa05d1204f3282286784

Download Submit
C:\Windows\system\yZZvFSK.exe

Filesize
1.9MB

MD5
5da9fb5f70ed23ff5cffaac83362e5dd

SHA1
345030b3a316cb1f26530689d256f70beae76190

SHA256
54c1bac8af5bb685174c0ac0b74a87913823a35dd373958f9602355f2c89184a

SHA512
2c7c6adf9ed9f6cd388c2e2509961953d07da078cf93a5001516fa85742749c4105c16139fa5d04b4f99c23142699d832b4142bf13487b98704d68e88639caca

Download Submit
\Windows\system\ARRelyM.exe

Filesize
1.9MB

MD5
9c329870c787f3f9303872c9abafaca8

SHA1
c6ac7fe425df13a6ad5e1912ac9618fe1ee5fd11

SHA256
ba3d267245ae16e5608930cce6baca16e7b4a9e5edc3a4debfac3ea60d028f73

SHA512
0bea5570fab0d0f104aefab42e899cec49648030fef361aa04668846d2235ec014d517f01f67a385e19703ff889df97acecd8a0e0c18b8a70ae5ba23440314ac

Download Submit
\Windows\system\EKPoGKO.exe

Filesize
1.9MB

MD5
b79e3b9b31b289dbac24912b8deda862

SHA1
71e71647428da2f3cf9036465df27510cdd746b8

SHA256
3312aca2787ff31223f017efbbd353ebcbfab439c7a66b1dbd97c5d08e915ba9

SHA512
40b5abd8ef13c54af1119df03e2ed49fdb1dadf5034d3d80d9a3fbc97de60e819970580c83a7f15b714e7eb080958642edbcbc5b3db653813ce4a4804ef01ac5

Download Submit
\Windows\system\EMwTSGE.exe

Filesize
1.9MB

MD5
e0218c20693233b2c42dae4aa04710bf

SHA1
e3ed35e2543256ef38239b0de569a717972506da

SHA256
6afb302c36fa3ad80124782434e43588e5bdf7bffdacc133c57d6d18438619dd

SHA512
5a0aee2b752aa79f34aca719bda980e6962df3e609a3dce0e0dd1903cf57e68806021cf8b44573cb219b2b056c26b4ad9a21f44a8b4c1c6234fdf90f235ee126

Download Submit
\Windows\system\EftOjor.exe

Filesize
1.9MB

MD5
a196c731c67acaf90a5c509a565b7c9d

SHA1
c19d9fe236f3bab59f8a240f157dd0bf0533737c

SHA256
2f201317bfcbfcde98bb971ebe7ca4c875e3f4c738b93bda5653e220bb6faa24

SHA512
9201be3e1ca9dc8cc41721ac1caadf52f34a968cbc4e5589a97b25047454f8f2b4a965160158b4257208fd17c3ef589012dfa42e8e6af86ca277e1f66523ad06

Download Submit
\Windows\system\FpiDByu.exe

Filesize
1.9MB

MD5
ec75186683fdf28cd75f52a8310c4798

SHA1
cd2eab11f7e8df9589ccd0b89f6f6c863b30d87a

SHA256
26c2096232bb5c85093098a8a212f5f6495a59e30f6f116f2643210ff9d6c477

SHA512
9a96a30931b384f4650b18da7a4068da95e25d3712b07bec15eb09452d88682b3464f572b4f1169020d11516ec04cac4c204bdf0b8fe9d08e78a08eab67d62d9

Download Submit
\Windows\system\FpvFGjy.exe

Filesize
1.9MB

MD5
c347c072be36cb908306e29f345d06fb

SHA1
ffd199d97e8f76e874a62f54d3aebeb7a7bb64b4

SHA256
2a102eaea7f3277565dc9ab37f77499fd82a61b5fc6950ec30d556e43ab2e35c

SHA512
b32328d3ba00a58d54424967c2c5481ed5d6f0f74b801eebcc453d9f4a3db168f435079db6d0f5ae1ffdf2919fbf2e12ebd8e75c6707e22112658603d5edbb3e

Download Submit
\Windows\system\KSiyugz.exe

Filesize
1.9MB

MD5
a147a1774551f012e13d01f6db772b4c

SHA1
b42faccdada10366e989bac7dd9cda38f71cf6d3

SHA256
2c13d878554707a743bc87de7db4b62ffbf78958ed80e74d9e29e1761922ca48

SHA512
ec7acd8b107ba7bdb0e4dfed13f1b42c2efc2662da5106cb7adc0aa54006b9f1b2002514918b0678b4559cb9a04cb72a714f53498598065ce25aebf5c8d069ea

Download Submit
\Windows\system\MSjNsOK.exe

Filesize
1.9MB

MD5
d1542818f39dd20fd35acdb2a5e6e03a

SHA1
c0f24cc30773bec06d663857e0ad0c472446e806

SHA256
dfc49a6b0796eb6d8a03011246edc43578ad7c6664a2c78cab04af66baaa9372

SHA512
d46c126d680d6aecc8a1253e97f3ee3d6f540cad0ef744da0b7096581f54d0da600a4f894df01b1f78b6f89ae0735aef213877dec92faa56c3faa59ae1d8e0cf

Download Submit
\Windows\system\PIxhrwm.exe

Filesize
1.9MB

MD5
e92c04695d21d839b83613c6f5336e1f

SHA1
bbe729096259be7cfd5ccbff09d3fcae7fd47aec

SHA256
8c36968ea11a085294bd4d7107a1f2eac2264552f312deea22447baf72bd7810

SHA512
bc3fc0957a83111a8881c654fc2cc41f637039bd4302bed07b89c462a7b5c576b33ec67e7624a1899f2abb291fb446f1b55a9adc66bfdda5c41ead353cb5d42d

Download Submit
\Windows\system\RSpzMXI.exe

Filesize
1.9MB

MD5
6321aba21a1797366280de201b5730cb

SHA1
e83e4fc9dc7e2863c6d16869afaaeef20c4e37c3

SHA256
e8d6a1d9101ad761c8d7974992ce5d2577515c21c546e67d5acec471e6480599

SHA512
b44b062ad4e42572a84a720580e3f498d776deb2e6783c589e034346bed4f6354d0b91e9501ad1bc3ca0091d3fc18fd5e5ba597aa768985d9770ac5e9627c136

Download Submit
\Windows\system\TMoGcEn.exe

Filesize
1.9MB

MD5
9b5b64b3a1934abe5417239268f1cafc

SHA1
39ba486a148a06221cdcf0dad91222938c02b106

SHA256
24e0722c83714c2b466894094596624ed8dd37e220fb1178ed00ac58f91daa08

SHA512
f80c84fb8ef923ca101c0633214dfd02c7b6f6693cd654342ebfdc965dcf4dbff1e50d792844fcdc37ec01d04369245543860b161388d6b01fd819bd1fb705e1

Download Submit
\Windows\system\TqfLGze.exe

Filesize
1.9MB

MD5
bb72af411717bcd0de962b07a7691f0d

SHA1
ae8923fc333cc87f808a1bb81535d1d4a6e0dbb5

SHA256
bc60f1a7e83652cf3aae076d3ace1c130e3622b7bf478180417ef7e6843e569c

SHA512
299e91fc059f4cfbe8460c1b8222385d09b24c26eabf7e37129c3e58118d945980e7ff970524bcd8459429bc84790050d9b7241d770815e1d20bb235ed37728c

Download Submit
\Windows\system\TwapcIm.exe

Filesize
1.9MB

MD5
2d74f66b36370c356ba04cae54873a9b

SHA1
f4a1577f185c660b7821d93fcd7e0bc2546b70cb

SHA256
aa4ec2a7ae97be8c57943ebe9df09d4582016931649f9dc41aacf5d96707992f

SHA512
b2be209f603df7c79962d5487e3feda1216582b69516abd49c2b7966b5d8fd2d142d487c43821efd9d66a3d29ce08dc8f8ca4d1e85b4fccda8418cf17a95a81f

Download Submit
\Windows\system\WQcZnem.exe

Filesize
1.9MB

MD5
228734d3b41ad21ac6c2665a4be3d0f5

SHA1
883965bee95f1f8148509613a20ed5b8d1e8234d

SHA256
f937288693193b9db2dbddda3e5fbadc6ca1f0d35dd32025cda0b499b283862d

SHA512
f38109febc002827996302037ce7fee65db95f693b0ea880da5dd0f81d387b514bdc81dc2474946e6e44c9f8d986d648b77ccd3425d76cc7943ceec2913751fd

Download Submit
\Windows\system\WuMOKXy.exe

Filesize
1.9MB

MD5
555994205647000d8e0cc010ce7e4bba

SHA1
d9a16fa38eb53f3427df46455f8ea7fcae417964

SHA256
61ec2f0cc86b10ce6c50ff702684fef4a41bf5c23981b5afa72ad6f7bcb6af14

SHA512
807ceddaf8a32e01586a6160f818273e145b4d70e10ff395559b9872d8a552b20439766a2168c37188b99adf84b0790540b10d58121d2d14552b65824c45f6c3

Download Submit
\Windows\system\XLvUpRs.exe

Filesize
1.9MB

MD5
adbfd06a9b5ec20142f02c2bc045f2b9

SHA1
772c6f6df0910c07db45237634c135b497912120

SHA256
9784035f57b4df24e1917b4d4a58f863b46873580e47203884805460c799be62

SHA512
d23be0a1fca461e1beee086ad4ff6ed35c935d6b84947953da3daa0c38f3913026a4d1fb29060ae20099014548ef617067b630fb69dba1a6af40666fc6f7067f

Download Submit
\Windows\system\ZRosUMK.exe

Filesize
1.9MB

MD5
1c0da81132cf9c6aa817db9c0e0c3860

SHA1
a65e6198dba83b2218c5818612159bd2b799b0c6

SHA256
a91b225496ec7d8b672410441b17a5674a6243fa990ccc3339725abb577c31de

SHA512
686996bfecdb88d114d6ac5ebdc5661a29f3af8361db4f6a0a6c67d56e6629ddbe34b06103dad24225405b4f506411a5edfd1fa25bfde417351465fec466ba87

Download Submit
\Windows\system\aNdDUCb.exe

Filesize
1.9MB

MD5
94713d04a8ea9304a35ec62e3e836915

SHA1
c9c488532df2c831aeb89eac314794115bc3beb4

SHA256
e3caa7f6f3c7cf2d2969d12ac891fe2e1accbd38bed632b0c193a2c21bdb0780

SHA512
ee7c911ea1d68a1477a0c0bbed3e84daae06044fdb79fc31dc1c49ccc269fb1dfcd8a54fa7be8da2c3c8c6da53f7b31d23ea78b43251b54976e30f88d166dc81

Download Submit
\Windows\system\cXdNhnd.exe

Filesize
1.9MB

MD5
1db4f398eae44574fc2d96dea38e8260

SHA1
9fdd641ebd8ea40e8eadcb7462e8f997dd42d4bb

SHA256
784e70f01350293e390a78a3dec88b0711ecc4b0580de5403c67e74291cf2cc6

SHA512
6110f86ab303f945ba8ffe262a1ddd81c29b9e00e42373811589a30abc2c7f436fed94b841652aa4221c67d6d013585b232ea81ea47120b69ac4df1d9a4201f3

Download Submit
\Windows\system\cbNAUir.exe

Filesize
1.9MB

MD5
c7fb5b4dc7815610f3a96cc5e78144bf

SHA1
067c1ea5998a745832a667d5e20047ce51083b8d

SHA256
215aa253f1d89eefb3a6f8d8c9e35e705699323d46f6fa1c0433a3fab2583794

SHA512
efc49463834979b98e66556b873b44150299f87f874d6efea9c01abbf43e226ed78d612a678099a04ed04fc2c73cd436e3cbb3290fa0a487420e2c4df122b91d

Download Submit
\Windows\system\eIRRstr.exe

Filesize
1.9MB

MD5
48c4ef54d69062d8665885b18d84eee8

SHA1
9874f0678cabf0de79594a97fe20d7ea31371966

SHA256
f53ef3f3a4ea0297da7a784521ddba3e57c81ec0dba81edc4fb41d301e8d3b2f

SHA512
61cf3c0dfedf6178b42becab353dc1e83fe3189425794c1ed5cba99ac4388ce0dbeed2c35312f72082ae15aa26bda073d214bef6feaa30b27dfee7e036c88773

Download Submit
\Windows\system\jNkHLdM.exe

Filesize
1.9MB

MD5
d6f8214991da92d26e220b61954e177a

SHA1
56bd7ceef5b28b637b5cb4fe4d901d639d7ac370

SHA256
50fc67c27bc5afbe2520f27371eeb3986fdfb4f50e051dbf5b6c8de936f5fc19

SHA512
b9cf83a60acea6402d1c7c20e5400d134016cc86239503269ecfc16112d4d9d9198a91cee2f9d8f8b439135e2cd43f81930b045e22d30ed88787b3d1fd0c8cce

Download Submit
\Windows\system\ryEteFh.exe

Filesize
1.9MB

MD5
27af5d067f03ac672cafae55fffc2340

SHA1
529d21026a15368a5d410706a1a661ec06dcfb05

SHA256
c3b8db00d9babeb8dae6572f05f73e181b23ae93589e383ee8b37ec0d398b89a

SHA512
34fe5b58754533fbbf15e705559a5635b339fb4fae624d067779279c7bada0fd36bc9504d32a29f28fc8371a81d8fe6fb88ea7f2c0ec6829bc75bbf937df4eb1

Download Submit
\Windows\system\xHrcgKM.exe

Filesize
1.9MB

MD5
74c8b2100654bf38ef27d6c3437cd20e

SHA1
083b023878d4b43b5a51137f4a8d19f6d8a65d42

SHA256
d6a3668c15b42a5b48546acd2ac5f8c258a63a8f254c3584ab93f56d17c76669

SHA512
3c8b42b8a37794f7055c22df131f6de9a731692b9e147a3334241bc55d7aaa17fa44771c3e3d280f2e66cd6a763d150a82bc6f96aaeab2df09ea9574a07e1bc8

Download Submit
memory/1108-57-0x000000013FB50000-0x000000013FF42000-memory.dmp

Filesize
3.9MB

Download
memory/1952-4027-0x000000013F910000-0x000000013FD02000-memory.dmp

Filesize
3.9MB

Download
memory/1952-9-0x000000013F910000-0x000000013FD02000-memory.dmp

Filesize
3.9MB

Download
memory/2136-4034-0x000000013F130000-0x000000013F522000-memory.dmp

Filesize
3.9MB

Download
memory/2136-87-0x000000013F130000-0x000000013F522000-memory.dmp

Filesize
3.9MB

Download
memory/2240-16-0x000000013F890000-0x000000013FC82000-memory.dmp

Filesize
3.9MB

Download
memory/2240-4028-0x000000013F890000-0x000000013FC82000-memory.dmp

Filesize
3.9MB

Download
memory/2416-1-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/2416-99-0x0000000003600000-0x00000000039F2000-memory.dmp

Filesize
3.9MB

Download
memory/2416-8-0x000000013F910000-0x000000013FD02000-memory.dmp

Filesize
3.9MB

Download
memory/2416-7375-0x0000000003600000-0x00000000039F2000-memory.dmp

Filesize
3.9MB

Download
memory/2416-188-0x0000000003600000-0x00000000039F2000-memory.dmp

Filesize
3.9MB

Download
memory/2416-18-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2416-168-0x000000013FC10000-0x0000000140002000-memory.dmp

Filesize
3.9MB

Download
memory/2416-192-0x0000000003600000-0x00000000039F2000-memory.dmp

Filesize
3.9MB

Download
memory/2416-80-0x000000013F920000-0x000000013FD12000-memory.dmp

Filesize
3.9MB

Download
memory/2416-95-0x000000013F9F0000-0x000000013FDE2000-memory.dmp

Filesize
3.9MB

Download
memory/2416-69-0x000000013F970000-0x000000013FD62000-memory.dmp

Filesize
3.9MB

Download
memory/2416-53-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/2416-50-0x000000013FF20000-0x0000000140312000-memory.dmp

Filesize
3.9MB

Download
memory/2416-42-0x000000013F0A0000-0x000000013F492000-memory.dmp

Filesize
3.9MB

Download
memory/2416-34-0x0000000003600000-0x00000000039F2000-memory.dmp

Filesize
3.9MB

Download
memory/2416-30-0x000000013FB50000-0x000000013FF42000-memory.dmp

Filesize
3.9MB

Download
memory/2416-6273-0x000000013F4E0000-0x000000013F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/2416-12-0x0000000002F60000-0x0000000003352000-memory.dmp

Filesize
3.9MB

Download
memory/2416-0-0x000000013F4E0000-0x000000013F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/2532-148-0x000000001B580000-0x000000001B862000-memory.dmp

Filesize
2.9MB

Download
memory/2532-149-0x0000000001F10000-0x0000000001F18000-memory.dmp

Filesize
32KB

Download
memory/3000-29-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download