xmrig | 7ae736a812292256971e8f2e35c24151c383968516538fa7a9e67e752f948e06

Analysis

max time kernel
120s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 11:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c3d9929e7ecc1fc8437882cee4fa740N.exe
Size

1.6MB
MD5

8c3d9929e7ecc1fc8437882cee4fa740
SHA1

7db406b14522009e9c552472c49c78d4817fb577
SHA256

7ae736a812292256971e8f2e35c24151c383968516538fa7a9e67e752f948e06
SHA512

cb77195ad9c6cb6f2d535a5bbbce049e4a1b1a453f41809606cabec4484fb8ec861f34cb090114de9225b1035bb1c6c5783ae69699544a0cc59d5709930f65fb
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW7r+kQQ7dXQARBa5eJ/CtAcS2o5:Lz071uv4BPMkyW10/wKV7hjSe5CtAl5

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 24 IoCs

miner

resource	yara_rule
behavioral1/memory/2824-13-0x000000013FFF0000-0x00000001403E2000-memory.dmp	xmrig
behavioral1/memory/580-154-0x000000013F960000-0x000000013FD52000-memory.dmp	xmrig
behavioral1/memory/788-149-0x000000013F600000-0x000000013F9F2000-memory.dmp	xmrig
behavioral1/memory/2752-162-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	xmrig
behavioral1/memory/2144-161-0x000000013F1A0000-0x000000013F592000-memory.dmp	xmrig
behavioral1/memory/2468-159-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	xmrig
behavioral1/memory/556-157-0x000000013F820000-0x000000013FC12000-memory.dmp	xmrig
behavioral1/memory/2360-144-0x000000013F1A0000-0x000000013F592000-memory.dmp	xmrig
behavioral1/memory/2672-142-0x000000013F670000-0x000000013FA62000-memory.dmp	xmrig
behavioral1/memory/2612-140-0x000000013FC40000-0x0000000140032000-memory.dmp	xmrig
behavioral1/memory/2792-138-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	xmrig
behavioral1/memory/2752-137-0x00000000031C0000-0x00000000035B2000-memory.dmp	xmrig
behavioral1/memory/2560-136-0x000000013F2A0000-0x000000013F692000-memory.dmp	xmrig
behavioral1/memory/2792-5740-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	xmrig
behavioral1/memory/788-5796-0x000000013F600000-0x000000013F9F2000-memory.dmp	xmrig
behavioral1/memory/2672-5797-0x000000013F670000-0x000000013FA62000-memory.dmp	xmrig
behavioral1/memory/556-5800-0x000000013F820000-0x000000013FC12000-memory.dmp	xmrig
behavioral1/memory/2144-5895-0x000000013F1A0000-0x000000013F592000-memory.dmp	xmrig
behavioral1/memory/2560-6584-0x000000013F2A0000-0x000000013F692000-memory.dmp	xmrig
behavioral1/memory/2612-6585-0x000000013FC40000-0x0000000140032000-memory.dmp	xmrig
behavioral1/memory/2468-6588-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	xmrig
behavioral1/memory/2360-6606-0x000000013F1A0000-0x000000013F592000-memory.dmp	xmrig
behavioral1/memory/580-6612-0x000000013F960000-0x000000013FD52000-memory.dmp	xmrig
behavioral1/memory/2752-7641-0x000000013F6A0000-0x000000013FA92000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2800	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2824	iwVffcs.exe
2560	DwJUjIe.exe
2792	mdbuiim.exe
2612	ryBJMng.exe
2672	ttYAUYr.exe
2360	usckLjn.exe
788	fPGLSkY.exe
580	tbFmYrD.exe
556	cRzrrxo.exe
2468	FIuJGNj.exe
2144	IWNyIOO.exe
2940	jzksSUC.exe
2512	jmVDKih.exe
2948	XIxvhlX.exe
2684	rkEtuvf.exe
2696	IZnlHCr.exe
3040	kCfbkdW.exe
2776	SgrIHJC.exe
2868	uToJQsk.exe
2548	FgNtUON.exe
2328	oeyvizt.exe
2128	rREUEYn.exe
1380	uiXQHgS.exe
2540	qEjeezj.exe
2200	PcAIJEY.exe
1472	gHLDewm.exe
1132	CWkcBvP.exe
712	ZIhIkqM.exe
680	fwdCsiv.exe
1512	TeymwTW.exe
1660	RnVtgLY.exe
1304	OiRHVUy.exe
640	hLaGcbm.exe
1284	XavziBL.exe
1548	lJVWpZK.exe
968	WxLdgfJ.exe
1356	fAnzWey.exe
1664	CRVjoSJ.exe
916	lMfEbku.exe
2284	mytXBMJ.exe
292	aVOqugO.exe
568	sSTjswX.exe
2368	yNJgIRk.exe
1748	eaulQVe.exe
1740	eSmohja.exe
2892	ycRvtof.exe
2132	zXFpPGS.exe
324	YEJcYLH.exe
2164	VYBzYCF.exe
2620	oZwqEnO.exe
952	PNkaCSw.exe
780	GDOvTUz.exe
2856	gkchAdw.exe
2600	ylTpmUq.exe
2944	WhpBMOg.exe
3032	wmTlYrl.exe
2316	PAIaCIC.exe
3016	dQgWNuY.exe
1428	NcqfXJn.exe
1436	ogavOoM.exe
908	voOcvzd.exe
1256	FxzYRIk.exe
2452	XsOeqrf.exe
1424	HncRzdQ.exe

Loads dropped DLL 64 IoCs

pid	Process
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe

UPX packed file 58 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00090000000120f1-3.dat	upx
behavioral1/memory/2752-0-0x000000013F6A0000-0x000000013FA92000-memory.dmp	upx
behavioral1/memory/2824-13-0x000000013FFF0000-0x00000001403E2000-memory.dmp	upx
behavioral1/files/0x00070000000186e9-19.dat	upx
behavioral1/files/0x0007000000004e74-23.dat	upx
behavioral1/files/0x0007000000018736-33.dat	upx
behavioral1/files/0x000600000001879f-43.dat	upx
behavioral1/files/0x000600000001878c-38.dat	upx
behavioral1/files/0x00050000000194e5-62.dat	upx
behavioral1/files/0x00050000000194fa-71.dat	upx
behavioral1/files/0x00050000000194f0-64.dat	upx
behavioral1/files/0x000500000001957d-90.dat	upx
behavioral1/files/0x00050000000195e6-100.dat	upx
behavioral1/files/0x00050000000195a1-99.dat	upx
behavioral1/files/0x000500000001961f-130.dat	upx
behavioral1/files/0x000500000001961d-134.dat	upx
behavioral1/memory/580-154-0x000000013F960000-0x000000013FD52000-memory.dmp	upx
behavioral1/files/0x0005000000019c50-189.dat	upx
behavioral1/files/0x000500000001970b-182.dat	upx
behavioral1/files/0x0005000000019679-173.dat	upx
behavioral1/files/0x0005000000019625-165.dat	upx
behavioral1/memory/788-149-0x000000013F600000-0x000000013F9F2000-memory.dmp	upx
behavioral1/files/0x0005000000019621-146.dat	upx
behavioral1/files/0x0005000000019c52-192.dat	upx
behavioral1/files/0x00050000000199ba-188.dat	upx
behavioral1/files/0x00050000000196b9-180.dat	upx
behavioral1/files/0x0005000000019637-170.dat	upx
behavioral1/files/0x000500000001961a-119.dat	upx
behavioral1/files/0x0005000000019617-117.dat	upx
behavioral1/memory/2144-161-0x000000013F1A0000-0x000000013F592000-memory.dmp	upx
behavioral1/memory/2468-159-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	upx
behavioral1/memory/556-157-0x000000013F820000-0x000000013FC12000-memory.dmp	upx
behavioral1/files/0x0005000000019623-155.dat	upx
behavioral1/memory/2360-144-0x000000013F1A0000-0x000000013F592000-memory.dmp	upx
behavioral1/memory/2672-142-0x000000013F670000-0x000000013FA62000-memory.dmp	upx
behavioral1/memory/2612-140-0x000000013FC40000-0x0000000140032000-memory.dmp	upx
behavioral1/memory/2792-138-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	upx
behavioral1/memory/2560-136-0x000000013F2A0000-0x000000013F692000-memory.dmp	upx
behavioral1/files/0x000500000001961b-123.dat	upx
behavioral1/files/0x0005000000019619-110.dat	upx
behavioral1/files/0x0005000000019571-88.dat	upx
behavioral1/files/0x0005000000019504-79.dat	upx
behavioral1/files/0x0005000000019506-83.dat	upx
behavioral1/files/0x00050000000194c1-59.dat	upx
behavioral1/files/0x000800000001923b-53.dat	upx
behavioral1/files/0x0007000000018bfc-49.dat	upx
behavioral1/files/0x0008000000018722-29.dat	upx
behavioral1/memory/2792-5740-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	upx
behavioral1/memory/788-5796-0x000000013F600000-0x000000013F9F2000-memory.dmp	upx
behavioral1/memory/2672-5797-0x000000013F670000-0x000000013FA62000-memory.dmp	upx
behavioral1/memory/556-5800-0x000000013F820000-0x000000013FC12000-memory.dmp	upx
behavioral1/memory/2144-5895-0x000000013F1A0000-0x000000013F592000-memory.dmp	upx
behavioral1/memory/2560-6584-0x000000013F2A0000-0x000000013F692000-memory.dmp	upx
behavioral1/memory/2612-6585-0x000000013FC40000-0x0000000140032000-memory.dmp	upx
behavioral1/memory/2468-6588-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	upx
behavioral1/memory/2360-6606-0x000000013F1A0000-0x000000013F592000-memory.dmp	upx
behavioral1/memory/580-6612-0x000000013F960000-0x000000013FD52000-memory.dmp	upx
behavioral1/memory/2752-7641-0x000000013F6A0000-0x000000013FA92000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\uJuBLbG.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\MmTBJEN.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\ptaBRhD.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\RgMzJhG.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\NJlFKpF.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\bgnchHJ.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\cAGmMMn.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\CAiEZFJ.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\qVyjzol.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\YQSwcNJ.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\CIuahZW.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\LwycOpA.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\xMHDLXC.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\pOKjbpS.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\yYdfapN.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\leFIyzY.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\GQGvFQJ.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\dgMdTzL.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\yXzCcYV.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\idevdYt.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\AVwbJFe.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\SJyklxA.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\SCOUOBq.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\pndpPmx.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\sUBxKLT.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\rtXzhJk.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\nubUsfO.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\smSZPXJ.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\VMdJthA.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\vRvlZJz.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\whZxIYM.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\hPoCWwl.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\BWtJYSb.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\ocByzRr.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\MCeerwg.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\rVlzakw.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\JHqevjK.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\yIuoDYp.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\ScsIaSn.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\uDiujMp.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\MkIYmaY.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\SFscOJg.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\zJanZWd.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\iOSguhs.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\aLOcGWH.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\pfMoszL.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\LytycKy.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\EeCjVOE.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\nIWaVkd.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\BIUZjCb.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\DJvDWqo.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\MYjoyFv.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\CiJgNUs.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\EEPNXtm.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\QFlBCjR.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\qzmTtKL.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\FJLyDOd.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\vQEOwWr.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\gigkGvd.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\qRlUEfD.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\zSjQgCA.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\nexOofl.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\BQfgLuz.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe
File created	C:\Windows\System\OZJszGa.exe	8c3d9929e7ecc1fc8437882cee4fa740N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2800	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
Token: SeLockMemoryPrivilege	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe
Token: SeDebugPrivilege	2800	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 2800	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	31
PID 2752 wrote to memory of 2800	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	31
PID 2752 wrote to memory of 2800	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	31
PID 2752 wrote to memory of 2824	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	32
PID 2752 wrote to memory of 2824	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	32
PID 2752 wrote to memory of 2824	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	32
PID 2752 wrote to memory of 2560	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	33
PID 2752 wrote to memory of 2560	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	33
PID 2752 wrote to memory of 2560	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	33
PID 2752 wrote to memory of 2792	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	34
PID 2752 wrote to memory of 2792	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	34
PID 2752 wrote to memory of 2792	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	34
PID 2752 wrote to memory of 2612	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	35
PID 2752 wrote to memory of 2612	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	35
PID 2752 wrote to memory of 2612	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	35
PID 2752 wrote to memory of 2672	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	36
PID 2752 wrote to memory of 2672	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	36
PID 2752 wrote to memory of 2672	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	36
PID 2752 wrote to memory of 2360	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	37
PID 2752 wrote to memory of 2360	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	37
PID 2752 wrote to memory of 2360	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	37
PID 2752 wrote to memory of 788	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	38
PID 2752 wrote to memory of 788	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	38
PID 2752 wrote to memory of 788	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	38
PID 2752 wrote to memory of 580	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	39
PID 2752 wrote to memory of 580	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	39
PID 2752 wrote to memory of 580	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	39
PID 2752 wrote to memory of 556	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	40
PID 2752 wrote to memory of 556	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	40
PID 2752 wrote to memory of 556	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	40
PID 2752 wrote to memory of 2468	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	41
PID 2752 wrote to memory of 2468	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	41
PID 2752 wrote to memory of 2468	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	41
PID 2752 wrote to memory of 2144	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	42
PID 2752 wrote to memory of 2144	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	42
PID 2752 wrote to memory of 2144	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	42
PID 2752 wrote to memory of 2512	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	43
PID 2752 wrote to memory of 2512	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	43
PID 2752 wrote to memory of 2512	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	43
PID 2752 wrote to memory of 2940	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	44
PID 2752 wrote to memory of 2940	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	44
PID 2752 wrote to memory of 2940	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	44
PID 2752 wrote to memory of 2948	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	45
PID 2752 wrote to memory of 2948	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	45
PID 2752 wrote to memory of 2948	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	45
PID 2752 wrote to memory of 2684	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	46
PID 2752 wrote to memory of 2684	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	46
PID 2752 wrote to memory of 2684	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	46
PID 2752 wrote to memory of 2696	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	47
PID 2752 wrote to memory of 2696	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	47
PID 2752 wrote to memory of 2696	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	47
PID 2752 wrote to memory of 3040	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	48
PID 2752 wrote to memory of 3040	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	48
PID 2752 wrote to memory of 3040	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	48
PID 2752 wrote to memory of 2776	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	49
PID 2752 wrote to memory of 2776	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	49
PID 2752 wrote to memory of 2776	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	49
PID 2752 wrote to memory of 2868	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	50
PID 2752 wrote to memory of 2868	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	50
PID 2752 wrote to memory of 2868	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	50
PID 2752 wrote to memory of 2328	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	51
PID 2752 wrote to memory of 2328	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	51
PID 2752 wrote to memory of 2328	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	51
PID 2752 wrote to memory of 2548	2752	8c3d9929e7ecc1fc8437882cee4fa740N.exe	52

C:\Users\Admin\AppData\Local\Temp\8c3d9929e7ecc1fc8437882cee4fa740N.exe
"C:\Users\Admin\AppData\Local\Temp\8c3d9929e7ecc1fc8437882cee4fa740N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2800
- C:\Windows\System\iwVffcs.exe
  C:\Windows\System\iwVffcs.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\DwJUjIe.exe
  C:\Windows\System\DwJUjIe.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\mdbuiim.exe
  C:\Windows\System\mdbuiim.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\ryBJMng.exe
  C:\Windows\System\ryBJMng.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\ttYAUYr.exe
  C:\Windows\System\ttYAUYr.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\usckLjn.exe
  C:\Windows\System\usckLjn.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\fPGLSkY.exe
  C:\Windows\System\fPGLSkY.exe
  2⤵
  - Executes dropped EXE
  PID:788
- C:\Windows\System\tbFmYrD.exe
  C:\Windows\System\tbFmYrD.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\cRzrrxo.exe
  C:\Windows\System\cRzrrxo.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\FIuJGNj.exe
  C:\Windows\System\FIuJGNj.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\IWNyIOO.exe
  C:\Windows\System\IWNyIOO.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\jmVDKih.exe
  C:\Windows\System\jmVDKih.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\jzksSUC.exe
  C:\Windows\System\jzksSUC.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\XIxvhlX.exe
  C:\Windows\System\XIxvhlX.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\rkEtuvf.exe
  C:\Windows\System\rkEtuvf.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\IZnlHCr.exe
  C:\Windows\System\IZnlHCr.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\kCfbkdW.exe
  C:\Windows\System\kCfbkdW.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\SgrIHJC.exe
  C:\Windows\System\SgrIHJC.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\uToJQsk.exe
  C:\Windows\System\uToJQsk.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\oeyvizt.exe
  C:\Windows\System\oeyvizt.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\FgNtUON.exe
  C:\Windows\System\FgNtUON.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\rREUEYn.exe
  C:\Windows\System\rREUEYn.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\uiXQHgS.exe
  C:\Windows\System\uiXQHgS.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\PcAIJEY.exe
  C:\Windows\System\PcAIJEY.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\qEjeezj.exe
  C:\Windows\System\qEjeezj.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\OiRHVUy.exe
  C:\Windows\System\OiRHVUy.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\gHLDewm.exe
  C:\Windows\System\gHLDewm.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\hLaGcbm.exe
  C:\Windows\System\hLaGcbm.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\CWkcBvP.exe
  C:\Windows\System\CWkcBvP.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\XavziBL.exe
  C:\Windows\System\XavziBL.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\ZIhIkqM.exe
  C:\Windows\System\ZIhIkqM.exe
  2⤵
  - Executes dropped EXE
  PID:712
- C:\Windows\System\WxLdgfJ.exe
  C:\Windows\System\WxLdgfJ.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\fwdCsiv.exe
  C:\Windows\System\fwdCsiv.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\fAnzWey.exe
  C:\Windows\System\fAnzWey.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\TeymwTW.exe
  C:\Windows\System\TeymwTW.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\CRVjoSJ.exe
  C:\Windows\System\CRVjoSJ.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\RnVtgLY.exe
  C:\Windows\System\RnVtgLY.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\lMfEbku.exe
  C:\Windows\System\lMfEbku.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\lJVWpZK.exe
  C:\Windows\System\lJVWpZK.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\mytXBMJ.exe
  C:\Windows\System\mytXBMJ.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\aVOqugO.exe
  C:\Windows\System\aVOqugO.exe
  2⤵
  - Executes dropped EXE
  PID:292
- C:\Windows\System\sSTjswX.exe
  C:\Windows\System\sSTjswX.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\yNJgIRk.exe
  C:\Windows\System\yNJgIRk.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\eaulQVe.exe
  C:\Windows\System\eaulQVe.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\eSmohja.exe
  C:\Windows\System\eSmohja.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\YEJcYLH.exe
  C:\Windows\System\YEJcYLH.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\ycRvtof.exe
  C:\Windows\System\ycRvtof.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\zbdFDan.exe
  C:\Windows\System\zbdFDan.exe
  2⤵
  PID:1976
- C:\Windows\System\zXFpPGS.exe
  C:\Windows\System\zXFpPGS.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\cAOYcSu.exe
  C:\Windows\System\cAOYcSu.exe
  2⤵
  PID:1568
- C:\Windows\System\VYBzYCF.exe
  C:\Windows\System\VYBzYCF.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\hKZWxYc.exe
  C:\Windows\System\hKZWxYc.exe
  2⤵
  PID:2876
- C:\Windows\System\oZwqEnO.exe
  C:\Windows\System\oZwqEnO.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\DZVMytL.exe
  C:\Windows\System\DZVMytL.exe
  2⤵
  PID:2732
- C:\Windows\System\PNkaCSw.exe
  C:\Windows\System\PNkaCSw.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\ZTSxzEx.exe
  C:\Windows\System\ZTSxzEx.exe
  2⤵
  PID:2652
- C:\Windows\System\GDOvTUz.exe
  C:\Windows\System\GDOvTUz.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\CKrkSRS.exe
  C:\Windows\System\CKrkSRS.exe
  2⤵
  PID:2536
- C:\Windows\System\gkchAdw.exe
  C:\Windows\System\gkchAdw.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\JGveLDZ.exe
  C:\Windows\System\JGveLDZ.exe
  2⤵
  PID:2096
- C:\Windows\System\ylTpmUq.exe
  C:\Windows\System\ylTpmUq.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\vzNvtXC.exe
  C:\Windows\System\vzNvtXC.exe
  2⤵
  PID:668
- C:\Windows\System\WhpBMOg.exe
  C:\Windows\System\WhpBMOg.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\QDcpblS.exe
  C:\Windows\System\QDcpblS.exe
  2⤵
  PID:2936
- C:\Windows\System\wmTlYrl.exe
  C:\Windows\System\wmTlYrl.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\EJktHLW.exe
  C:\Windows\System\EJktHLW.exe
  2⤵
  PID:2504
- C:\Windows\System\PAIaCIC.exe
  C:\Windows\System\PAIaCIC.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\wlcOMvy.exe
  C:\Windows\System\wlcOMvy.exe
  2⤵
  PID:2308
- C:\Windows\System\dQgWNuY.exe
  C:\Windows\System\dQgWNuY.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\DmAgDpx.exe
  C:\Windows\System\DmAgDpx.exe
  2⤵
  PID:2440
- C:\Windows\System\NcqfXJn.exe
  C:\Windows\System\NcqfXJn.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\MfnckyI.exe
  C:\Windows\System\MfnckyI.exe
  2⤵
  PID:1296
- C:\Windows\System\ogavOoM.exe
  C:\Windows\System\ogavOoM.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\TFwdEDk.exe
  C:\Windows\System\TFwdEDk.exe
  2⤵
  PID:1648
- C:\Windows\System\voOcvzd.exe
  C:\Windows\System\voOcvzd.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\byZNUyb.exe
  C:\Windows\System\byZNUyb.exe
  2⤵
  PID:2020
- C:\Windows\System\FxzYRIk.exe
  C:\Windows\System\FxzYRIk.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\BmEdtrn.exe
  C:\Windows\System\BmEdtrn.exe
  2⤵
  PID:2496
- C:\Windows\System\XsOeqrf.exe
  C:\Windows\System\XsOeqrf.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\zSjQgCA.exe
  C:\Windows\System\zSjQgCA.exe
  2⤵
  PID:1480
- C:\Windows\System\HncRzdQ.exe
  C:\Windows\System\HncRzdQ.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\UaSUoIf.exe
  C:\Windows\System\UaSUoIf.exe
  2⤵
  PID:876
- C:\Windows\System\KIbinUs.exe
  C:\Windows\System\KIbinUs.exe
  2⤵
  PID:2768
- C:\Windows\System\EeCjVOE.exe
  C:\Windows\System\EeCjVOE.exe
  2⤵
  PID:1820
- C:\Windows\System\tUEqSbB.exe
  C:\Windows\System\tUEqSbB.exe
  2⤵
  PID:3008
- C:\Windows\System\tlrWaUc.exe
  C:\Windows\System\tlrWaUc.exe
  2⤵
  PID:2916
- C:\Windows\System\JrgyKwS.exe
  C:\Windows\System\JrgyKwS.exe
  2⤵
  PID:3084
- C:\Windows\System\GFOluem.exe
  C:\Windows\System\GFOluem.exe
  2⤵
  PID:3100
- C:\Windows\System\fSnkTpk.exe
  C:\Windows\System\fSnkTpk.exe
  2⤵
  PID:3116
- C:\Windows\System\ulXzZsI.exe
  C:\Windows\System\ulXzZsI.exe
  2⤵
  PID:3132
- C:\Windows\System\RLhibqX.exe
  C:\Windows\System\RLhibqX.exe
  2⤵
  PID:3148
- C:\Windows\System\urPGMNZ.exe
  C:\Windows\System\urPGMNZ.exe
  2⤵
  PID:3164
- C:\Windows\System\NefXOmO.exe
  C:\Windows\System\NefXOmO.exe
  2⤵
  PID:3180
- C:\Windows\System\yoXXARA.exe
  C:\Windows\System\yoXXARA.exe
  2⤵
  PID:3196
- C:\Windows\System\ODMOlHf.exe
  C:\Windows\System\ODMOlHf.exe
  2⤵
  PID:3212
- C:\Windows\System\dbqDaCu.exe
  C:\Windows\System\dbqDaCu.exe
  2⤵
  PID:3228
- C:\Windows\System\AVwbJFe.exe
  C:\Windows\System\AVwbJFe.exe
  2⤵
  PID:3244
- C:\Windows\System\oCnlPLR.exe
  C:\Windows\System\oCnlPLR.exe
  2⤵
  PID:3260
- C:\Windows\System\LlAHEzC.exe
  C:\Windows\System\LlAHEzC.exe
  2⤵
  PID:3276
- C:\Windows\System\yENwwrN.exe
  C:\Windows\System\yENwwrN.exe
  2⤵
  PID:3292
- C:\Windows\System\URxSsgS.exe
  C:\Windows\System\URxSsgS.exe
  2⤵
  PID:3308
- C:\Windows\System\ByokHbm.exe
  C:\Windows\System\ByokHbm.exe
  2⤵
  PID:3324
- C:\Windows\System\XDRITsR.exe
  C:\Windows\System\XDRITsR.exe
  2⤵
  PID:3340
- C:\Windows\System\MGpyqMG.exe
  C:\Windows\System\MGpyqMG.exe
  2⤵
  PID:3356
- C:\Windows\System\SxsMXKy.exe
  C:\Windows\System\SxsMXKy.exe
  2⤵
  PID:3372
- C:\Windows\System\oGMSBGV.exe
  C:\Windows\System\oGMSBGV.exe
  2⤵
  PID:3388
- C:\Windows\System\fGuulCJ.exe
  C:\Windows\System\fGuulCJ.exe
  2⤵
  PID:3404
- C:\Windows\System\qUONkvx.exe
  C:\Windows\System\qUONkvx.exe
  2⤵
  PID:3420
- C:\Windows\System\MBXlZpf.exe
  C:\Windows\System\MBXlZpf.exe
  2⤵
  PID:3436
- C:\Windows\System\LzHLHEu.exe
  C:\Windows\System\LzHLHEu.exe
  2⤵
  PID:3452
- C:\Windows\System\tIFLJIE.exe
  C:\Windows\System\tIFLJIE.exe
  2⤵
  PID:3468
- C:\Windows\System\QDpXbmq.exe
  C:\Windows\System\QDpXbmq.exe
  2⤵
  PID:3484
- C:\Windows\System\QmQgVjy.exe
  C:\Windows\System\QmQgVjy.exe
  2⤵
  PID:3500
- C:\Windows\System\mLXpPqp.exe
  C:\Windows\System\mLXpPqp.exe
  2⤵
  PID:3516
- C:\Windows\System\xKepYTU.exe
  C:\Windows\System\xKepYTU.exe
  2⤵
  PID:3532
- C:\Windows\System\MOXRfwK.exe
  C:\Windows\System\MOXRfwK.exe
  2⤵
  PID:3692
- C:\Windows\System\SPnFkHs.exe
  C:\Windows\System\SPnFkHs.exe
  2⤵
  PID:3708
- C:\Windows\System\gCCafdz.exe
  C:\Windows\System\gCCafdz.exe
  2⤵
  PID:3724
- C:\Windows\System\PHIzjAQ.exe
  C:\Windows\System\PHIzjAQ.exe
  2⤵
  PID:3740
- C:\Windows\System\QUuIqwH.exe
  C:\Windows\System\QUuIqwH.exe
  2⤵
  PID:3756
- C:\Windows\System\PqhLJAo.exe
  C:\Windows\System\PqhLJAo.exe
  2⤵
  PID:3772
- C:\Windows\System\gkeEUka.exe
  C:\Windows\System\gkeEUka.exe
  2⤵
  PID:3788
- C:\Windows\System\vbmXbOC.exe
  C:\Windows\System\vbmXbOC.exe
  2⤵
  PID:3812
- C:\Windows\System\bIHoCgo.exe
  C:\Windows\System\bIHoCgo.exe
  2⤵
  PID:3828
- C:\Windows\System\dFouzuo.exe
  C:\Windows\System\dFouzuo.exe
  2⤵
  PID:3844
- C:\Windows\System\HCcNeOH.exe
  C:\Windows\System\HCcNeOH.exe
  2⤵
  PID:3860
- C:\Windows\System\ZHBfVIy.exe
  C:\Windows\System\ZHBfVIy.exe
  2⤵
  PID:3876
- C:\Windows\System\VnLikIh.exe
  C:\Windows\System\VnLikIh.exe
  2⤵
  PID:3892
- C:\Windows\System\wGUeeMe.exe
  C:\Windows\System\wGUeeMe.exe
  2⤵
  PID:3908
- C:\Windows\System\wDybIiB.exe
  C:\Windows\System\wDybIiB.exe
  2⤵
  PID:3924
- C:\Windows\System\vLVjHtK.exe
  C:\Windows\System\vLVjHtK.exe
  2⤵
  PID:3940
- C:\Windows\System\HENiMgo.exe
  C:\Windows\System\HENiMgo.exe
  2⤵
  PID:3956
- C:\Windows\System\FhYqbkX.exe
  C:\Windows\System\FhYqbkX.exe
  2⤵
  PID:3972
- C:\Windows\System\rvWdbRX.exe
  C:\Windows\System\rvWdbRX.exe
  2⤵
  PID:3988
- C:\Windows\System\UgpEHTu.exe
  C:\Windows\System\UgpEHTu.exe
  2⤵
  PID:4004
- C:\Windows\System\uIRwKbg.exe
  C:\Windows\System\uIRwKbg.exe
  2⤵
  PID:4020
- C:\Windows\System\hinCtVg.exe
  C:\Windows\System\hinCtVg.exe
  2⤵
  PID:4036
- C:\Windows\System\dElDLZD.exe
  C:\Windows\System\dElDLZD.exe
  2⤵
  PID:4052
- C:\Windows\System\iLHtnfv.exe
  C:\Windows\System\iLHtnfv.exe
  2⤵
  PID:4068
- C:\Windows\System\gmoMezl.exe
  C:\Windows\System\gmoMezl.exe
  2⤵
  PID:4084
- C:\Windows\System\bhCKJwt.exe
  C:\Windows\System\bhCKJwt.exe
  2⤵
  PID:2904
- C:\Windows\System\xbqvNqq.exe
  C:\Windows\System\xbqvNqq.exe
  2⤵
  PID:2248
- C:\Windows\System\ZbYzmzb.exe
  C:\Windows\System\ZbYzmzb.exe
  2⤵
  PID:2984
- C:\Windows\System\mtgNbld.exe
  C:\Windows\System\mtgNbld.exe
  2⤵
  PID:856
- C:\Windows\System\jWlEtfR.exe
  C:\Windows\System\jWlEtfR.exe
  2⤵
  PID:1560
- C:\Windows\System\NWRKTeu.exe
  C:\Windows\System\NWRKTeu.exe
  2⤵
  PID:964
- C:\Windows\System\FGuNfTi.exe
  C:\Windows\System\FGuNfTi.exe
  2⤵
  PID:3124
- C:\Windows\System\xOkafbp.exe
  C:\Windows\System\xOkafbp.exe
  2⤵
  PID:3160
- C:\Windows\System\dlHAAfH.exe
  C:\Windows\System\dlHAAfH.exe
  2⤵
  PID:3224
- C:\Windows\System\NBBsydm.exe
  C:\Windows\System\NBBsydm.exe
  2⤵
  PID:3288
- C:\Windows\System\pHfttdy.exe
  C:\Windows\System\pHfttdy.exe
  2⤵
  PID:3352
- C:\Windows\System\dsRxOcH.exe
  C:\Windows\System\dsRxOcH.exe
  2⤵
  PID:3416
- C:\Windows\System\FDFSXQy.exe
  C:\Windows\System\FDFSXQy.exe
  2⤵
  PID:2520
- C:\Windows\System\FyeObiZ.exe
  C:\Windows\System\FyeObiZ.exe
  2⤵
  PID:3004
- C:\Windows\System\uZzIljy.exe
  C:\Windows\System\uZzIljy.exe
  2⤵
  PID:1772
- C:\Windows\System\hzrjAgU.exe
  C:\Windows\System\hzrjAgU.exe
  2⤵
  PID:2656
- C:\Windows\System\vzipbir.exe
  C:\Windows\System\vzipbir.exe
  2⤵
  PID:2116
- C:\Windows\System\HZeribB.exe
  C:\Windows\System\HZeribB.exe
  2⤵
  PID:1360
- C:\Windows\System\IhZIKdk.exe
  C:\Windows\System\IhZIKdk.exe
  2⤵
  PID:2148
- C:\Windows\System\sGmGlPu.exe
  C:\Windows\System\sGmGlPu.exe
  2⤵
  PID:2872
- C:\Windows\System\PROdqCS.exe
  C:\Windows\System\PROdqCS.exe
  2⤵
  PID:1916
- C:\Windows\System\sUBxKLT.exe
  C:\Windows\System\sUBxKLT.exe
  2⤵
  PID:872
- C:\Windows\System\HtEGOpF.exe
  C:\Windows\System\HtEGOpF.exe
  2⤵
  PID:2500
- C:\Windows\System\nWnxfZC.exe
  C:\Windows\System\nWnxfZC.exe
  2⤵
  PID:2596
- C:\Windows\System\doZRFFG.exe
  C:\Windows\System\doZRFFG.exe
  2⤵
  PID:1848
- C:\Windows\System\kOHVnca.exe
  C:\Windows\System\kOHVnca.exe
  2⤵
  PID:3044
- C:\Windows\System\LpzHKdB.exe
  C:\Windows\System\LpzHKdB.exe
  2⤵
  PID:2772
- C:\Windows\System\GQGvFQJ.exe
  C:\Windows\System\GQGvFQJ.exe
  2⤵
  PID:3512
- C:\Windows\System\UNVSXxD.exe
  C:\Windows\System\UNVSXxD.exe
  2⤵
  PID:3552
- C:\Windows\System\Xffrrwa.exe
  C:\Windows\System\Xffrrwa.exe
  2⤵
  PID:3568
- C:\Windows\System\YDTWsWk.exe
  C:\Windows\System\YDTWsWk.exe
  2⤵
  PID:3584
- C:\Windows\System\ExIFIvw.exe
  C:\Windows\System\ExIFIvw.exe
  2⤵
  PID:3600
- C:\Windows\System\iFFtCqz.exe
  C:\Windows\System\iFFtCqz.exe
  2⤵
  PID:3616
- C:\Windows\System\nqAXhei.exe
  C:\Windows\System\nqAXhei.exe
  2⤵
  PID:3632
- C:\Windows\System\aafIpNv.exe
  C:\Windows\System\aafIpNv.exe
  2⤵
  PID:3648
- C:\Windows\System\htjLdss.exe
  C:\Windows\System\htjLdss.exe
  2⤵
  PID:3664
- C:\Windows\System\rBaijNa.exe
  C:\Windows\System\rBaijNa.exe
  2⤵
  PID:3680
- C:\Windows\System\PDYITiM.exe
  C:\Windows\System\PDYITiM.exe
  2⤵
  PID:2176
- C:\Windows\System\ItHatbd.exe
  C:\Windows\System\ItHatbd.exe
  2⤵
  PID:3752
- C:\Windows\System\ItjRNMF.exe
  C:\Windows\System\ItjRNMF.exe
  2⤵
  PID:3824
- C:\Windows\System\sLPjuLk.exe
  C:\Windows\System\sLPjuLk.exe
  2⤵
  PID:3888
- C:\Windows\System\vlxXwfH.exe
  C:\Windows\System\vlxXwfH.exe
  2⤵
  PID:2024
- C:\Windows\System\wJSsDrV.exe
  C:\Windows\System\wJSsDrV.exe
  2⤵
  PID:3984
- C:\Windows\System\LPTomfm.exe
  C:\Windows\System\LPTomfm.exe
  2⤵
  PID:4048
- C:\Windows\System\SpjfoGG.exe
  C:\Windows\System\SpjfoGG.exe
  2⤵
  PID:3256
- C:\Windows\System\NMdGFXs.exe
  C:\Windows\System\NMdGFXs.exe
  2⤵
  PID:3048
- C:\Windows\System\mrtMRDH.exe
  C:\Windows\System\mrtMRDH.exe
  2⤵
  PID:584
- C:\Windows\System\nwOHfGM.exe
  C:\Windows\System\nwOHfGM.exe
  2⤵
  PID:2604
- C:\Windows\System\DfuUSqg.exe
  C:\Windows\System\DfuUSqg.exe
  2⤵
  PID:316
- C:\Windows\System\FpiTZyM.exe
  C:\Windows\System\FpiTZyM.exe
  2⤵
  PID:3560
- C:\Windows\System\uYzxOug.exe
  C:\Windows\System\uYzxOug.exe
  2⤵
  PID:3628
- C:\Windows\System\yhAgOxi.exe
  C:\Windows\System\yhAgOxi.exe
  2⤵
  PID:3544
- C:\Windows\System\CizcLFt.exe
  C:\Windows\System\CizcLFt.exe
  2⤵
  PID:3920
- C:\Windows\System\sGmoIPa.exe
  C:\Windows\System\sGmoIPa.exe
  2⤵
  PID:2312
- C:\Windows\System\jrGrKhU.exe
  C:\Windows\System\jrGrKhU.exe
  2⤵
  PID:2616
- C:\Windows\System\vKQjvCn.exe
  C:\Windows\System\vKQjvCn.exe
  2⤵
  PID:2628
- C:\Windows\System\kXRNzwg.exe
  C:\Windows\System\kXRNzwg.exe
  2⤵
  PID:3660
- C:\Windows\System\MjbNWmN.exe
  C:\Windows\System\MjbNWmN.exe
  2⤵
  PID:4100
- C:\Windows\System\AnWhQzO.exe
  C:\Windows\System\AnWhQzO.exe
  2⤵
  PID:4116
- C:\Windows\System\MCYCSwb.exe
  C:\Windows\System\MCYCSwb.exe
  2⤵
  PID:4132
- C:\Windows\System\rufXTDZ.exe
  C:\Windows\System\rufXTDZ.exe
  2⤵
  PID:4148
- C:\Windows\System\CUUfUjO.exe
  C:\Windows\System\CUUfUjO.exe
  2⤵
  PID:4164
- C:\Windows\System\JDtgxKA.exe
  C:\Windows\System\JDtgxKA.exe
  2⤵
  PID:4180
- C:\Windows\System\vZuCIpk.exe
  C:\Windows\System\vZuCIpk.exe
  2⤵
  PID:4196
- C:\Windows\System\wyyeXek.exe
  C:\Windows\System\wyyeXek.exe
  2⤵
  PID:4212
- C:\Windows\System\GEeNVXj.exe
  C:\Windows\System\GEeNVXj.exe
  2⤵
  PID:4228
- C:\Windows\System\ANfAFhA.exe
  C:\Windows\System\ANfAFhA.exe
  2⤵
  PID:4244
- C:\Windows\System\phFowHs.exe
  C:\Windows\System\phFowHs.exe
  2⤵
  PID:4260
- C:\Windows\System\JUEjjyM.exe
  C:\Windows\System\JUEjjyM.exe
  2⤵
  PID:4276
- C:\Windows\System\CiVisvH.exe
  C:\Windows\System\CiVisvH.exe
  2⤵
  PID:4292
- C:\Windows\System\ouizVRy.exe
  C:\Windows\System\ouizVRy.exe
  2⤵
  PID:4308
- C:\Windows\System\UgFWVUS.exe
  C:\Windows\System\UgFWVUS.exe
  2⤵
  PID:4460
- C:\Windows\System\cTzFtGZ.exe
  C:\Windows\System\cTzFtGZ.exe
  2⤵
  PID:4648
- C:\Windows\System\DYKhnXl.exe
  C:\Windows\System\DYKhnXl.exe
  2⤵
  PID:4664
- C:\Windows\System\bdpMzKn.exe
  C:\Windows\System\bdpMzKn.exe
  2⤵
  PID:4680
- C:\Windows\System\cjEmDFW.exe
  C:\Windows\System\cjEmDFW.exe
  2⤵
  PID:4696
- C:\Windows\System\BoaIrEI.exe
  C:\Windows\System\BoaIrEI.exe
  2⤵
  PID:4712
- C:\Windows\System\gwavKEF.exe
  C:\Windows\System\gwavKEF.exe
  2⤵
  PID:4728
- C:\Windows\System\LXivljd.exe
  C:\Windows\System\LXivljd.exe
  2⤵
  PID:4744
- C:\Windows\System\xlpoodF.exe
  C:\Windows\System\xlpoodF.exe
  2⤵
  PID:4760
- C:\Windows\System\tprInsr.exe
  C:\Windows\System\tprInsr.exe
  2⤵
  PID:4860
- C:\Windows\System\BhLzwBi.exe
  C:\Windows\System\BhLzwBi.exe
  2⤵
  PID:4876
- C:\Windows\System\sewOikY.exe
  C:\Windows\System\sewOikY.exe
  2⤵
  PID:4892
- C:\Windows\System\SLncWQR.exe
  C:\Windows\System\SLncWQR.exe
  2⤵
  PID:4908
- C:\Windows\System\khLfHke.exe
  C:\Windows\System\khLfHke.exe
  2⤵
  PID:4924
- C:\Windows\System\kUvKmOI.exe
  C:\Windows\System\kUvKmOI.exe
  2⤵
  PID:4944
- C:\Windows\System\jOIjOjm.exe
  C:\Windows\System\jOIjOjm.exe
  2⤵
  PID:4960
- C:\Windows\System\vosayPb.exe
  C:\Windows\System\vosayPb.exe
  2⤵
  PID:4976
- C:\Windows\System\DROmIdR.exe
  C:\Windows\System\DROmIdR.exe
  2⤵
  PID:4992
- C:\Windows\System\kSmeCRD.exe
  C:\Windows\System\kSmeCRD.exe
  2⤵
  PID:5020
- C:\Windows\System\AKzegMF.exe
  C:\Windows\System\AKzegMF.exe
  2⤵
  PID:5044
- C:\Windows\System\MvAaheL.exe
  C:\Windows\System\MvAaheL.exe
  2⤵
  PID:5060
- C:\Windows\System\LfVIjBg.exe
  C:\Windows\System\LfVIjBg.exe
  2⤵
  PID:5084
- C:\Windows\System\SplyOVK.exe
  C:\Windows\System\SplyOVK.exe
  2⤵
  PID:5100
- C:\Windows\System\NGpAdpi.exe
  C:\Windows\System\NGpAdpi.exe
  2⤵
  PID:5116
- C:\Windows\System\UZhSMbL.exe
  C:\Windows\System\UZhSMbL.exe
  2⤵
  PID:2076
- C:\Windows\System\XDHSVil.exe
  C:\Windows\System\XDHSVil.exe
  2⤵
  PID:4160
- C:\Windows\System\BEoTKdn.exe
  C:\Windows\System\BEoTKdn.exe
  2⤵
  PID:4220
- C:\Windows\System\QcAVkQC.exe
  C:\Windows\System\QcAVkQC.exe
  2⤵
  PID:4256
- C:\Windows\System\xPYZwiV.exe
  C:\Windows\System\xPYZwiV.exe
  2⤵
  PID:1952
- C:\Windows\System\obDZZAz.exe
  C:\Windows\System\obDZZAz.exe
  2⤵
  PID:4320
- C:\Windows\System\ogOpEdJ.exe
  C:\Windows\System\ogOpEdJ.exe
  2⤵
  PID:1752
- C:\Windows\System\CVZsYnx.exe
  C:\Windows\System\CVZsYnx.exe
  2⤵
  PID:1924
- C:\Windows\System\dgdlbrY.exe
  C:\Windows\System\dgdlbrY.exe
  2⤵
  PID:328
- C:\Windows\System\dQjqxOi.exe
  C:\Windows\System\dQjqxOi.exe
  2⤵
  PID:2196
- C:\Windows\System\njjVQeQ.exe
  C:\Windows\System\njjVQeQ.exe
  2⤵
  PID:2364
- C:\Windows\System\yhEJPvK.exe
  C:\Windows\System\yhEJPvK.exe
  2⤵
  PID:3076
- C:\Windows\System\dLNrgBB.exe
  C:\Windows\System\dLNrgBB.exe
  2⤵
  PID:3140
- C:\Windows\System\fMrwGRg.exe
  C:\Windows\System\fMrwGRg.exe
  2⤵
  PID:3204
- C:\Windows\System\uIhqfcN.exe
  C:\Windows\System\uIhqfcN.exe
  2⤵
  PID:3268
- C:\Windows\System\FAUWMjH.exe
  C:\Windows\System\FAUWMjH.exe
  2⤵
  PID:3332
- C:\Windows\System\kEIlVdd.exe
  C:\Windows\System\kEIlVdd.exe
  2⤵
  PID:3396
- C:\Windows\System\RtYtqus.exe
  C:\Windows\System\RtYtqus.exe
  2⤵
  PID:3460
- C:\Windows\System\AaWplcu.exe
  C:\Windows\System\AaWplcu.exe
  2⤵
  PID:3524
- C:\Windows\System\FNkraWs.exe
  C:\Windows\System\FNkraWs.exe
  2⤵
  PID:4344
- C:\Windows\System\GYxtlNW.exe
  C:\Windows\System\GYxtlNW.exe
  2⤵
  PID:4368
- C:\Windows\System\JBmyzHD.exe
  C:\Windows\System\JBmyzHD.exe
  2⤵
  PID:4384
- C:\Windows\System\gXKvdkt.exe
  C:\Windows\System\gXKvdkt.exe
  2⤵
  PID:4408
- C:\Windows\System\nBYxiIZ.exe
  C:\Windows\System\nBYxiIZ.exe
  2⤵
  PID:1036
- C:\Windows\System\WnCcetS.exe
  C:\Windows\System\WnCcetS.exe
  2⤵
  PID:2492
- C:\Windows\System\gyCpJLN.exe
  C:\Windows\System\gyCpJLN.exe
  2⤵
  PID:2956
- C:\Windows\System\DfneRwg.exe
  C:\Windows\System\DfneRwg.exe
  2⤵
  PID:3624
- C:\Windows\System\GNuSUji.exe
  C:\Windows\System\GNuSUji.exe
  2⤵
  PID:2300
- C:\Windows\System\FBQurxI.exe
  C:\Windows\System\FBQurxI.exe
  2⤵
  PID:4112
- C:\Windows\System\YOSfxyH.exe
  C:\Windows\System\YOSfxyH.exe
  2⤵
  PID:4176
- C:\Windows\System\jdzNSne.exe
  C:\Windows\System\jdzNSne.exe
  2⤵
  PID:4240
- C:\Windows\System\sVUZEtT.exe
  C:\Windows\System\sVUZEtT.exe
  2⤵
  PID:4304
- C:\Windows\System\HCCRKhM.exe
  C:\Windows\System\HCCRKhM.exe
  2⤵
  PID:4432
- C:\Windows\System\FEDkXce.exe
  C:\Windows\System\FEDkXce.exe
  2⤵
  PID:2820
- C:\Windows\System\QnqnYwg.exe
  C:\Windows\System\QnqnYwg.exe
  2⤵
  PID:3980
- C:\Windows\System\lnmdEAV.exe
  C:\Windows\System\lnmdEAV.exe
  2⤵
  PID:3676
- C:\Windows\System\Tacpuwy.exe
  C:\Windows\System\Tacpuwy.exe
  2⤵
  PID:3640
- C:\Windows\System\lOeGlaP.exe
  C:\Windows\System\lOeGlaP.exe
  2⤵
  PID:1508
- C:\Windows\System\DMhJPkI.exe
  C:\Windows\System\DMhJPkI.exe
  2⤵
  PID:1800
- C:\Windows\System\jHOmZKu.exe
  C:\Windows\System\jHOmZKu.exe
  2⤵
  PID:1744
- C:\Windows\System\gSdSTPX.exe
  C:\Windows\System\gSdSTPX.exe
  2⤵
  PID:896
- C:\Windows\System\TGvcrYl.exe
  C:\Windows\System\TGvcrYl.exe
  2⤵
  PID:1588
- C:\Windows\System\KqhXvTw.exe
  C:\Windows\System\KqhXvTw.exe
  2⤵
  PID:3220
- C:\Windows\System\ivqitdt.exe
  C:\Windows\System\ivqitdt.exe
  2⤵
  PID:2748
- C:\Windows\System\mXsKlhg.exe
  C:\Windows\System\mXsKlhg.exe
  2⤵
  PID:772
- C:\Windows\System\PUdSLBf.exe
  C:\Windows\System\PUdSLBf.exe
  2⤵
  PID:4032
- C:\Windows\System\fjWqztc.exe
  C:\Windows\System\fjWqztc.exe
  2⤵
  PID:3968
- C:\Windows\System\rLKNbiy.exe
  C:\Windows\System\rLKNbiy.exe
  2⤵
  PID:3904
- C:\Windows\System\XjmcrOS.exe
  C:\Windows\System\XjmcrOS.exe
  2⤵
  PID:3840
- C:\Windows\System\XEjmAZi.exe
  C:\Windows\System\XEjmAZi.exe
  2⤵
  PID:3768
- C:\Windows\System\CMnrpVU.exe
  C:\Windows\System\CMnrpVU.exe
  2⤵
  PID:3704
- C:\Windows\System\lmmAqoe.exe
  C:\Windows\System\lmmAqoe.exe
  2⤵
  PID:4484
- C:\Windows\System\oAkfsYP.exe
  C:\Windows\System\oAkfsYP.exe
  2⤵
  PID:4480
- C:\Windows\System\qfLpEXQ.exe
  C:\Windows\System\qfLpEXQ.exe
  2⤵
  PID:4488
- C:\Windows\System\LNhqoYP.exe
  C:\Windows\System\LNhqoYP.exe
  2⤵
  PID:4500
- C:\Windows\System\Hkcqfse.exe
  C:\Windows\System\Hkcqfse.exe
  2⤵
  PID:4520
- C:\Windows\System\wkDPVrZ.exe
  C:\Windows\System\wkDPVrZ.exe
  2⤵
  PID:2816
- C:\Windows\System\orohdcn.exe
  C:\Windows\System\orohdcn.exe
  2⤵
  PID:4544
- C:\Windows\System\tJnOlAd.exe
  C:\Windows\System\tJnOlAd.exe
  2⤵
  PID:4560
- C:\Windows\System\jVutWnq.exe
  C:\Windows\System\jVutWnq.exe
  2⤵
  PID:4576
- C:\Windows\System\NmOTbAH.exe
  C:\Windows\System\NmOTbAH.exe
  2⤵
  PID:4592
- C:\Windows\System\UorWrvm.exe
  C:\Windows\System\UorWrvm.exe
  2⤵
  PID:4608
- C:\Windows\System\RFRMoJY.exe
  C:\Windows\System\RFRMoJY.exe
  2⤵
  PID:4624
- C:\Windows\System\Bagcnaf.exe
  C:\Windows\System\Bagcnaf.exe
  2⤵
  PID:2928
- C:\Windows\System\pIpjbpH.exe
  C:\Windows\System\pIpjbpH.exe
  2⤵
  PID:2632
- C:\Windows\System\TFmhxRr.exe
  C:\Windows\System\TFmhxRr.exe
  2⤵
  PID:2088
- C:\Windows\System\gZLTDRM.exe
  C:\Windows\System\gZLTDRM.exe
  2⤵
  PID:4724
- C:\Windows\System\YREbTPe.exe
  C:\Windows\System\YREbTPe.exe
  2⤵
  PID:2888
- C:\Windows\System\tTLJJzE.exe
  C:\Windows\System\tTLJJzE.exe
  2⤵
  PID:1096
- C:\Windows\System\LwycOpA.exe
  C:\Windows\System\LwycOpA.exe
  2⤵
  PID:4708
- C:\Windows\System\oKRdLLg.exe
  C:\Windows\System\oKRdLLg.exe
  2⤵
  PID:4900
- C:\Windows\System\BXwRNiA.exe
  C:\Windows\System\BXwRNiA.exe
  2⤵
  PID:4968
- C:\Windows\System\FlalluY.exe
  C:\Windows\System\FlalluY.exe
  2⤵
  PID:4884
- C:\Windows\System\OyssOvA.exe
  C:\Windows\System\OyssOvA.exe
  2⤵
  PID:4676
- C:\Windows\System\BNYDcyS.exe
  C:\Windows\System\BNYDcyS.exe
  2⤵
  PID:5004
- C:\Windows\System\nJQFXBI.exe
  C:\Windows\System\nJQFXBI.exe
  2⤵
  PID:5052
- C:\Windows\System\fkjPXDu.exe
  C:\Windows\System\fkjPXDu.exe
  2⤵
  PID:3412
- C:\Windows\System\dtRwXos.exe
  C:\Windows\System\dtRwXos.exe
  2⤵
  PID:4192
- C:\Windows\System\LGpPjVV.exe
  C:\Windows\System\LGpPjVV.exe
  2⤵
  PID:1620
- C:\Windows\System\TiYXkVF.exe
  C:\Windows\System\TiYXkVF.exe
  2⤵
  PID:4792
- C:\Windows\System\PTgcWxC.exe
  C:\Windows\System\PTgcWxC.exe
  2⤵
  PID:4808
- C:\Windows\System\HNsUAJl.exe
  C:\Windows\System\HNsUAJl.exe
  2⤵
  PID:4824
- C:\Windows\System\NbFfoWB.exe
  C:\Windows\System\NbFfoWB.exe
  2⤵
  PID:4840
- C:\Windows\System\NdflqHv.exe
  C:\Windows\System\NdflqHv.exe
  2⤵
  PID:4856
- C:\Windows\System\yEizXBl.exe
  C:\Windows\System\yEizXBl.exe
  2⤵
  PID:4920
- C:\Windows\System\SXOAQXL.exe
  C:\Windows\System\SXOAQXL.exe
  2⤵
  PID:4988
- C:\Windows\System\HAnwHgs.exe
  C:\Windows\System\HAnwHgs.exe
  2⤵
  PID:5036
- C:\Windows\System\mzPZQSU.exe
  C:\Windows\System\mzPZQSU.exe
  2⤵
  PID:3000
- C:\Windows\System\BfDxcyu.exe
  C:\Windows\System\BfDxcyu.exe
  2⤵
  PID:676
- C:\Windows\System\yiUvYao.exe
  C:\Windows\System\yiUvYao.exe
  2⤵
  PID:3108
- C:\Windows\System\TtpLwQc.exe
  C:\Windows\System\TtpLwQc.exe
  2⤵
  PID:4252
- C:\Windows\System\mGNzvhY.exe
  C:\Windows\System\mGNzvhY.exe
  2⤵
  PID:5112
- C:\Windows\System\iawYFwE.exe
  C:\Windows\System\iawYFwE.exe
  2⤵
  PID:756
- C:\Windows\System\xFfbOau.exe
  C:\Windows\System\xFfbOau.exe
  2⤵
  PID:2092
- C:\Windows\System\cqPWaGK.exe
  C:\Windows\System\cqPWaGK.exe
  2⤵
  PID:3240
- C:\Windows\System\yfLoVed.exe
  C:\Windows\System\yfLoVed.exe
  2⤵
  PID:3492
- C:\Windows\System\KDFIzFc.exe
  C:\Windows\System\KDFIzFc.exe
  2⤵
  PID:2480
- C:\Windows\System\GfcpoEP.exe
  C:\Windows\System\GfcpoEP.exe
  2⤵
  PID:4404
- C:\Windows\System\RefZfzJ.exe
  C:\Windows\System\RefZfzJ.exe
  2⤵
  PID:1932
- C:\Windows\System\sPbajEL.exe
  C:\Windows\System\sPbajEL.exe
  2⤵
  PID:4336
- C:\Windows\System\RpCEFJa.exe
  C:\Windows\System\RpCEFJa.exe
  2⤵
  PID:4380
- C:\Windows\System\mLHRKuH.exe
  C:\Windows\System\mLHRKuH.exe
  2⤵
  PID:4416
- C:\Windows\System\DviBGHr.exe
  C:\Windows\System\DviBGHr.exe
  2⤵
  PID:2660
- C:\Windows\System\ZFLALOo.exe
  C:\Windows\System\ZFLALOo.exe
  2⤵
  PID:4108
- C:\Windows\System\XXsicPO.exe
  C:\Windows\System\XXsicPO.exe
  2⤵
  PID:2304
- C:\Windows\System\CHphHOX.exe
  C:\Windows\System\CHphHOX.exe
  2⤵
  PID:4300
- C:\Windows\System\XEftjTQ.exe
  C:\Windows\System\XEftjTQ.exe
  2⤵
  PID:4080
- C:\Windows\System\sglRSFT.exe
  C:\Windows\System\sglRSFT.exe
  2⤵
  PID:2968
- C:\Windows\System\cxZLxQU.exe
  C:\Windows\System\cxZLxQU.exe
  2⤵
  PID:3576
- C:\Windows\System\Kjjdabm.exe
  C:\Windows\System\Kjjdabm.exe
  2⤵
  PID:3856
- C:\Windows\System\GcHrFSh.exe
  C:\Windows\System\GcHrFSh.exe
  2⤵
  PID:3012
- C:\Windows\System\TniIvcV.exe
  C:\Windows\System\TniIvcV.exe
  2⤵
  PID:4064
- C:\Windows\System\jfGtudr.exe
  C:\Windows\System\jfGtudr.exe
  2⤵
  PID:3796
- C:\Windows\System\UINazqD.exe
  C:\Windows\System\UINazqD.exe
  2⤵
  PID:2932
- C:\Windows\System\LvhXmKH.exe
  C:\Windows\System\LvhXmKH.exe
  2⤵
  PID:4516
- C:\Windows\System\AVzyKKc.exe
  C:\Windows\System\AVzyKKc.exe
  2⤵
  PID:4568
- C:\Windows\System\qrahoLr.exe
  C:\Windows\System\qrahoLr.exe
  2⤵
  PID:1080
- C:\Windows\System\RcpPorq.exe
  C:\Windows\System\RcpPorq.exe
  2⤵
  PID:3028
- C:\Windows\System\zLYEnGs.exe
  C:\Windows\System\zLYEnGs.exe
  2⤵
  PID:768
- C:\Windows\System\uHhHmwp.exe
  C:\Windows\System\uHhHmwp.exe
  2⤵
  PID:1320
- C:\Windows\System\CIWYbML.exe
  C:\Windows\System\CIWYbML.exe
  2⤵
  PID:3868
- C:\Windows\System\YtajHqb.exe
  C:\Windows\System\YtajHqb.exe
  2⤵
  PID:2860
- C:\Windows\System\EjKTHMr.exe
  C:\Windows\System\EjKTHMr.exe
  2⤵
  PID:4584
- C:\Windows\System\TwYQbjr.exe
  C:\Windows\System\TwYQbjr.exe
  2⤵
  PID:4532
- C:\Windows\System\iDkmqVG.exe
  C:\Windows\System\iDkmqVG.exe
  2⤵
  PID:4620
- C:\Windows\System\XFodOdF.exe
  C:\Windows\System\XFodOdF.exe
  2⤵
  PID:4756
- C:\Windows\System\TFNDOTY.exe
  C:\Windows\System\TFNDOTY.exe
  2⤵
  PID:4692
- C:\Windows\System\hjzezcm.exe
  C:\Windows\System\hjzezcm.exe
  2⤵
  PID:2008
- C:\Windows\System\MHnsKck.exe
  C:\Windows\System\MHnsKck.exe
  2⤵
  PID:1736
- C:\Windows\System\AlyfTni.exe
  C:\Windows\System\AlyfTni.exe
  2⤵
  PID:5092
- C:\Windows\System\RBAsQiq.exe
  C:\Windows\System\RBAsQiq.exe
  2⤵
  PID:2980
- C:\Windows\System\VFrwZwK.exe
  C:\Windows\System\VFrwZwK.exe
  2⤵
  PID:5008
- C:\Windows\System\hAqvzPB.exe
  C:\Windows\System\hAqvzPB.exe
  2⤵
  PID:1680
- C:\Windows\System\XZUETWS.exe
  C:\Windows\System\XZUETWS.exe
  2⤵
  PID:4816
- C:\Windows\System\caceYUP.exe
  C:\Windows\System\caceYUP.exe
  2⤵
  PID:4956
- C:\Windows\System\DpfzjDt.exe
  C:\Windows\System\DpfzjDt.exe
  2⤵
  PID:548
- C:\Windows\System\aaiZayU.exe
  C:\Windows\System\aaiZayU.exe
  2⤵
  PID:2472
- C:\Windows\System\KpdEFQP.exe
  C:\Windows\System\KpdEFQP.exe
  2⤵
  PID:4836
- C:\Windows\System\lSbJjHA.exe
  C:\Windows\System\lSbJjHA.exe
  2⤵
  PID:2272
- C:\Windows\System\lrqbOrz.exe
  C:\Windows\System\lrqbOrz.exe
  2⤵
  PID:4156
- C:\Windows\System\ZuCukzS.exe
  C:\Windows\System\ZuCukzS.exe
  2⤵
  PID:3368
- C:\Windows\System\axnodRX.exe
  C:\Windows\System\axnodRX.exe
  2⤵
  PID:4364
- C:\Windows\System\rNukIoz.exe
  C:\Windows\System\rNukIoz.exe
  2⤵
  PID:3428
- C:\Windows\System\NaUpOPq.exe
  C:\Windows\System\NaUpOPq.exe
  2⤵
  PID:2476
- C:\Windows\System\HGPbLGA.exe
  C:\Windows\System\HGPbLGA.exe
  2⤵
  PID:2100
- C:\Windows\System\MOjtcvS.exe
  C:\Windows\System\MOjtcvS.exe
  2⤵
  PID:3564
- C:\Windows\System\gPTGXNI.exe
  C:\Windows\System\gPTGXNI.exe
  2⤵
  PID:1584
- C:\Windows\System\bMNkWdg.exe
  C:\Windows\System\bMNkWdg.exe
  2⤵
  PID:3096
- C:\Windows\System\NNIISMH.exe
  C:\Windows\System\NNIISMH.exe
  2⤵
  PID:2556
- C:\Windows\System\cAGmMMn.exe
  C:\Windows\System\cAGmMMn.exe
  2⤵
  PID:4604
- C:\Windows\System\ebRfwuV.exe
  C:\Windows\System\ebRfwuV.exe
  2⤵
  PID:3732
- C:\Windows\System\hbeEAUa.exe
  C:\Windows\System\hbeEAUa.exe
  2⤵
  PID:4556
- C:\Windows\System\jPXyKHX.exe
  C:\Windows\System\jPXyKHX.exe
  2⤵
  PID:3748
- C:\Windows\System\xoHkBvB.exe
  C:\Windows\System\xoHkBvB.exe
  2⤵
  PID:2668
- C:\Windows\System\pbywXco.exe
  C:\Windows\System\pbywXco.exe
  2⤵
  PID:3024
- C:\Windows\System\jHakugh.exe
  C:\Windows\System\jHakugh.exe
  2⤵
  PID:4600
- C:\Windows\System\TvNZSSS.exe
  C:\Windows\System\TvNZSSS.exe
  2⤵
  PID:4496
- C:\Windows\System\RrPQPfh.exe
  C:\Windows\System\RrPQPfh.exe
  2⤵
  PID:4660
- C:\Windows\System\gaDEgFE.exe
  C:\Windows\System\gaDEgFE.exe
  2⤵
  PID:4768
- C:\Windows\System\vjWGELa.exe
  C:\Windows\System\vjWGELa.exe
  2⤵
  PID:4788
- C:\Windows\System\dLnjTPZ.exe
  C:\Windows\System\dLnjTPZ.exe
  2⤵
  PID:4832
- C:\Windows\System\SLqvDYO.exe
  C:\Windows\System\SLqvDYO.exe
  2⤵
  PID:1792
- C:\Windows\System\njMLyHj.exe
  C:\Windows\System\njMLyHj.exe
  2⤵
  PID:5068
- C:\Windows\System\YTHUeKi.exe
  C:\Windows\System\YTHUeKi.exe
  2⤵
  PID:1908
- C:\Windows\System\qIaOXsJ.exe
  C:\Windows\System\qIaOXsJ.exe
  2⤵
  PID:4852
- C:\Windows\System\diOADlz.exe
  C:\Windows\System\diOADlz.exe
  2⤵
  PID:1900
- C:\Windows\System\DXwEoeg.exe
  C:\Windows\System\DXwEoeg.exe
  2⤵
  PID:3612
- C:\Windows\System\jUYQmxs.exe
  C:\Windows\System\jUYQmxs.exe
  2⤵
  PID:3480
- C:\Windows\System\GYBOxwU.exe
  C:\Windows\System\GYBOxwU.exe
  2⤵
  PID:1232
- C:\Windows\System\sIyUIeQ.exe
  C:\Windows\System\sIyUIeQ.exe
  2⤵
  PID:3112
- C:\Windows\System\dwLPqlJ.exe
  C:\Windows\System\dwLPqlJ.exe
  2⤵
  PID:3176
- C:\Windows\System\KVzhzXO.exe
  C:\Windows\System\KVzhzXO.exe
  2⤵
  PID:4376
- C:\Windows\System\GsCnPKT.exe
  C:\Windows\System\GsCnPKT.exe
  2⤵
  PID:4436
- C:\Windows\System\XlUrBbj.exe
  C:\Windows\System\XlUrBbj.exe
  2⤵
  PID:1836
- C:\Windows\System\gZEymlg.exe
  C:\Windows\System\gZEymlg.exe
  2⤵
  PID:4888
- C:\Windows\System\LxPeAib.exe
  C:\Windows\System\LxPeAib.exe
  2⤵
  PID:1968
- C:\Windows\System\sjUmJBx.exe
  C:\Windows\System\sjUmJBx.exe
  2⤵
  PID:4704
- C:\Windows\System\hivojpu.exe
  C:\Windows\System\hivojpu.exe
  2⤵
  PID:2764
- C:\Windows\System\zUWTmUC.exe
  C:\Windows\System\zUWTmUC.exe
  2⤵
  PID:3936
- C:\Windows\System\hcahJoz.exe
  C:\Windows\System\hcahJoz.exe
  2⤵
  PID:4540
- C:\Windows\System\DuNpCqx.exe
  C:\Windows\System\DuNpCqx.exe
  2⤵
  PID:1572
- C:\Windows\System\rZCqvhU.exe
  C:\Windows\System\rZCqvhU.exe
  2⤵
  PID:3872
- C:\Windows\System\lWQEEKQ.exe
  C:\Windows\System\lWQEEKQ.exe
  2⤵
  PID:4644
- C:\Windows\System\NHfXCfS.exe
  C:\Windows\System\NHfXCfS.exe
  2⤵
  PID:3052
- C:\Windows\System\mXudhuG.exe
  C:\Windows\System\mXudhuG.exe
  2⤵
  PID:4448
- C:\Windows\System\AJtOvva.exe
  C:\Windows\System\AJtOvva.exe
  2⤵
  PID:4172
- C:\Windows\System\BokVutt.exe
  C:\Windows\System\BokVutt.exe
  2⤵
  PID:3580
- C:\Windows\System\hixfkdx.exe
  C:\Windows\System\hixfkdx.exe
  2⤵
  PID:5264
- C:\Windows\System\KdEEksA.exe
  C:\Windows\System\KdEEksA.exe
  2⤵
  PID:5372
- C:\Windows\System\rtXzhJk.exe
  C:\Windows\System\rtXzhJk.exe
  2⤵
  PID:5396
- C:\Windows\System\JHJlXyU.exe
  C:\Windows\System\JHJlXyU.exe
  2⤵
  PID:5412
- C:\Windows\System\cpErAAg.exe
  C:\Windows\System\cpErAAg.exe
  2⤵
  PID:5452
- C:\Windows\System\VEcNQYF.exe
  C:\Windows\System\VEcNQYF.exe
  2⤵
  PID:5524
- C:\Windows\System\kpeSrgR.exe
  C:\Windows\System\kpeSrgR.exe
  2⤵
  PID:5540
- C:\Windows\System\gIngAgV.exe
  C:\Windows\System\gIngAgV.exe
  2⤵
  PID:5560
- C:\Windows\System\IckxEqj.exe
  C:\Windows\System\IckxEqj.exe
  2⤵
  PID:5696
- C:\Windows\System\YSeYsOq.exe
  C:\Windows\System\YSeYsOq.exe
  2⤵
  PID:5720
- C:\Windows\System\sEoTQRF.exe
  C:\Windows\System\sEoTQRF.exe
  2⤵
  PID:5744
- C:\Windows\System\kmUKXwc.exe
  C:\Windows\System\kmUKXwc.exe
  2⤵
  PID:5768
- C:\Windows\System\xtrcfMd.exe
  C:\Windows\System\xtrcfMd.exe
  2⤵
  PID:5784
- C:\Windows\System\YtIyqzK.exe
  C:\Windows\System\YtIyqzK.exe
  2⤵
  PID:5800
- C:\Windows\System\vBkaFwO.exe
  C:\Windows\System\vBkaFwO.exe
  2⤵
  PID:5816
- C:\Windows\System\KmhTaZj.exe
  C:\Windows\System\KmhTaZj.exe
  2⤵
  PID:5832
- C:\Windows\System\kRHgVLy.exe
  C:\Windows\System\kRHgVLy.exe
  2⤵
  PID:5848
- C:\Windows\System\TuGfPbE.exe
  C:\Windows\System\TuGfPbE.exe
  2⤵
  PID:5864
- C:\Windows\System\jpXpNPg.exe
  C:\Windows\System\jpXpNPg.exe
  2⤵
  PID:5880
- C:\Windows\System\XwQmbHM.exe
  C:\Windows\System\XwQmbHM.exe
  2⤵
  PID:5896
- C:\Windows\System\yCCSOEB.exe
  C:\Windows\System\yCCSOEB.exe
  2⤵
  PID:5912
- C:\Windows\System\NDgSTgb.exe
  C:\Windows\System\NDgSTgb.exe
  2⤵
  PID:5928
- C:\Windows\System\lUEUpcZ.exe
  C:\Windows\System\lUEUpcZ.exe
  2⤵
  PID:5944
- C:\Windows\System\YCPspWv.exe
  C:\Windows\System\YCPspWv.exe
  2⤵
  PID:5960
- C:\Windows\System\CpGytsF.exe
  C:\Windows\System\CpGytsF.exe
  2⤵
  PID:5976
- C:\Windows\System\cbjbeZb.exe
  C:\Windows\System\cbjbeZb.exe
  2⤵
  PID:5992
- C:\Windows\System\MEItneY.exe
  C:\Windows\System\MEItneY.exe
  2⤵
  PID:6008
- C:\Windows\System\JDzsxEo.exe
  C:\Windows\System\JDzsxEo.exe
  2⤵
  PID:6024
- C:\Windows\System\womgpFu.exe
  C:\Windows\System\womgpFu.exe
  2⤵
  PID:6040
- C:\Windows\System\KhdQPqM.exe
  C:\Windows\System\KhdQPqM.exe
  2⤵
  PID:6056
- C:\Windows\System\HOyOIMV.exe
  C:\Windows\System\HOyOIMV.exe
  2⤵
  PID:6072
- C:\Windows\System\prhBVqJ.exe
  C:\Windows\System\prhBVqJ.exe
  2⤵
  PID:6092
- C:\Windows\System\SalBJMg.exe
  C:\Windows\System\SalBJMg.exe
  2⤵
  PID:6108
- C:\Windows\System\HaPnoQQ.exe
  C:\Windows\System\HaPnoQQ.exe
  2⤵
  PID:6124
- C:\Windows\System\yZygQRY.exe
  C:\Windows\System\yZygQRY.exe
  2⤵
  PID:6140
- C:\Windows\System\UWoNnqM.exe
  C:\Windows\System\UWoNnqM.exe
  2⤵
  PID:2108
- C:\Windows\System\dXHdATd.exe
  C:\Windows\System\dXHdATd.exe
  2⤵
  PID:5136
- C:\Windows\System\vSfyYhn.exe
  C:\Windows\System\vSfyYhn.exe
  2⤵
  PID:5152
- C:\Windows\System\pcJAAzv.exe
  C:\Windows\System\pcJAAzv.exe
  2⤵
  PID:5168
- C:\Windows\System\msjyUra.exe
  C:\Windows\System\msjyUra.exe
  2⤵
  PID:5184
- C:\Windows\System\aJZhwol.exe
  C:\Windows\System\aJZhwol.exe
  2⤵
  PID:5028
- C:\Windows\System\XgyxaDD.exe
  C:\Windows\System\XgyxaDD.exe
  2⤵
  PID:5284
- C:\Windows\System\NZbwPow.exe
  C:\Windows\System\NZbwPow.exe
  2⤵
  PID:5288
- C:\Windows\System\iUCMvzI.exe
  C:\Windows\System\iUCMvzI.exe
  2⤵
  PID:5300
- C:\Windows\System\YIbSqgE.exe
  C:\Windows\System\YIbSqgE.exe
  2⤵
  PID:5204
- C:\Windows\System\wvpXWqg.exe
  C:\Windows\System\wvpXWqg.exe
  2⤵
  PID:5240
- C:\Windows\System\mLNpDek.exe
  C:\Windows\System\mLNpDek.exe
  2⤵
  PID:1644
- C:\Windows\System\BjfxxMW.exe
  C:\Windows\System\BjfxxMW.exe
  2⤵
  PID:5336
- C:\Windows\System\vgbQghS.exe
  C:\Windows\System\vgbQghS.exe
  2⤵
  PID:5460
- C:\Windows\System\LgkNfPt.exe
  C:\Windows\System\LgkNfPt.exe
  2⤵
  PID:5392
- C:\Windows\System\OybSYDX.exe
  C:\Windows\System\OybSYDX.exe
  2⤵
  PID:5388
- C:\Windows\System\lXKLvvL.exe
  C:\Windows\System\lXKLvvL.exe
  2⤵
  PID:5428
- C:\Windows\System\qsseOyo.exe
  C:\Windows\System\qsseOyo.exe
  2⤵
  PID:5444
- C:\Windows\System\niZbHes.exe
  C:\Windows\System\niZbHes.exe
  2⤵
  PID:5536
- C:\Windows\System\eUOEdMl.exe
  C:\Windows\System\eUOEdMl.exe
  2⤵
  PID:5496
- C:\Windows\System\oFGQaHK.exe
  C:\Windows\System\oFGQaHK.exe
  2⤵
  PID:5572
- C:\Windows\System\jtETAAy.exe
  C:\Windows\System\jtETAAy.exe
  2⤵
  PID:5620
- C:\Windows\System\sLYvaTD.exe
  C:\Windows\System\sLYvaTD.exe
  2⤵
  PID:5652
- C:\Windows\System\udFgfLP.exe
  C:\Windows\System\udFgfLP.exe
  2⤵
  PID:5576
- C:\Windows\System\sfMvviP.exe
  C:\Windows\System\sfMvviP.exe
  2⤵
  PID:5648
- C:\Windows\System\HQhwslW.exe
  C:\Windows\System\HQhwslW.exe
  2⤵
  PID:5592
- C:\Windows\System\sJOWySe.exe
  C:\Windows\System\sJOWySe.exe
  2⤵
  PID:5732
- C:\Windows\System\ESJMgzX.exe
  C:\Windows\System\ESJMgzX.exe
  2⤵
  PID:5844
- C:\Windows\System\EANezDx.exe
  C:\Windows\System\EANezDx.exe
  2⤵
  PID:5904
- C:\Windows\System\Bboqdjc.exe
  C:\Windows\System\Bboqdjc.exe
  2⤵
  PID:5940
- C:\Windows\System\qJwPqfl.exe
  C:\Windows\System\qJwPqfl.exe
  2⤵
  PID:5856
- C:\Windows\System\dMNOMWA.exe
  C:\Windows\System\dMNOMWA.exe
  2⤵
  PID:5956
- C:\Windows\System\neaVVzC.exe
  C:\Windows\System\neaVVzC.exe
  2⤵
  PID:6004
- C:\Windows\System\gNkVDnA.exe
  C:\Windows\System\gNkVDnA.exe
  2⤵
  PID:6104
- C:\Windows\System\zRnSGNP.exe
  C:\Windows\System\zRnSGNP.exe
  2⤵
  PID:5132
- C:\Windows\System\fTfohVy.exe
  C:\Windows\System\fTfohVy.exe
  2⤵
  PID:5224
- C:\Windows\System\xruswYc.exe
  C:\Windows\System\xruswYc.exe
  2⤵
  PID:5208
- C:\Windows\System\dGTrqlc.exe
  C:\Windows\System\dGTrqlc.exe
  2⤵
  PID:5360
- C:\Windows\System\DliGtUR.exe
  C:\Windows\System\DliGtUR.exe
  2⤵
  PID:5180
- C:\Windows\System\cqTakJw.exe
  C:\Windows\System\cqTakJw.exe
  2⤵
  PID:5232
- C:\Windows\System\zcJQrjL.exe
  C:\Windows\System\zcJQrjL.exe
  2⤵
  PID:5324
- C:\Windows\System\iFnrIwM.exe
  C:\Windows\System\iFnrIwM.exe
  2⤵
  PID:5532
- C:\Windows\System\FApGrun.exe
  C:\Windows\System\FApGrun.exe
  2⤵
  PID:5596
- C:\Windows\System\SqmHnPf.exe
  C:\Windows\System\SqmHnPf.exe
  2⤵
  PID:5616
- C:\Windows\System\BVRZxli.exe
  C:\Windows\System\BVRZxli.exe
  2⤵
  PID:5636
- C:\Windows\System\JKDloQS.exe
  C:\Windows\System\JKDloQS.exe
  2⤵
  PID:5644
- C:\Windows\System\AiuqPyB.exe
  C:\Windows\System\AiuqPyB.exe
  2⤵
  PID:5704
- C:\Windows\System\GPtqyKp.exe
  C:\Windows\System\GPtqyKp.exe
  2⤵
  PID:5808
- C:\Windows\System\LGnGXlk.exe
  C:\Windows\System\LGnGXlk.exe
  2⤵
  PID:5756
- C:\Windows\System\DwbVgUT.exe
  C:\Windows\System\DwbVgUT.exe
  2⤵
  PID:5740
- C:\Windows\System\dLAhLAq.exe
  C:\Windows\System\dLAhLAq.exe
  2⤵
  PID:5796
- C:\Windows\System\VjJtPYP.exe
  C:\Windows\System\VjJtPYP.exe
  2⤵
  PID:6036
- C:\Windows\System\WIOvfYc.exe
  C:\Windows\System\WIOvfYc.exe
  2⤵
  PID:5160
- C:\Windows\System\bfNlDIH.exe
  C:\Windows\System\bfNlDIH.exe
  2⤵
  PID:5276
- C:\Windows\System\rKzoISF.exe
  C:\Windows\System\rKzoISF.exe
  2⤵
  PID:5476
- C:\Windows\System\KXJPudl.exe
  C:\Windows\System\KXJPudl.exe
  2⤵
  PID:5608
- C:\Windows\System\fDhUxOa.exe
  C:\Windows\System\fDhUxOa.exe
  2⤵
  PID:6160
- C:\Windows\System\GOPrEMS.exe
  C:\Windows\System\GOPrEMS.exe
  2⤵
  PID:6176
- C:\Windows\System\OnNdBiG.exe
  C:\Windows\System\OnNdBiG.exe
  2⤵
  PID:6192
- C:\Windows\System\hFyPYYk.exe
  C:\Windows\System\hFyPYYk.exe
  2⤵
  PID:6208
- C:\Windows\System\yPrumcT.exe
  C:\Windows\System\yPrumcT.exe
  2⤵
  PID:6228
- C:\Windows\System\fRQeAJT.exe
  C:\Windows\System\fRQeAJT.exe
  2⤵
  PID:6244
- C:\Windows\System\Tedkfwn.exe
  C:\Windows\System\Tedkfwn.exe
  2⤵
  PID:6260
- C:\Windows\System\JJHVQQM.exe
  C:\Windows\System\JJHVQQM.exe
  2⤵
  PID:6324
- C:\Windows\System\jrBkMrc.exe
  C:\Windows\System\jrBkMrc.exe
  2⤵
  PID:6340
- C:\Windows\System\NtwTKar.exe
  C:\Windows\System\NtwTKar.exe
  2⤵
  PID:6356
- C:\Windows\System\CZGdkxx.exe
  C:\Windows\System\CZGdkxx.exe
  2⤵
  PID:6372
- C:\Windows\System\ZrIrydQ.exe
  C:\Windows\System\ZrIrydQ.exe
  2⤵
  PID:6388
- C:\Windows\System\vIkMmla.exe
  C:\Windows\System\vIkMmla.exe
  2⤵
  PID:6404
- C:\Windows\System\CrmXNEh.exe
  C:\Windows\System\CrmXNEh.exe
  2⤵
  PID:6420
- C:\Windows\System\QeCXmZv.exe
  C:\Windows\System\QeCXmZv.exe
  2⤵
  PID:6440
- C:\Windows\System\YrcXfQp.exe
  C:\Windows\System\YrcXfQp.exe
  2⤵
  PID:6456
- C:\Windows\System\eORPgYv.exe
  C:\Windows\System\eORPgYv.exe
  2⤵
  PID:6472
- C:\Windows\System\RRBGZNJ.exe
  C:\Windows\System\RRBGZNJ.exe
  2⤵
  PID:6488
- C:\Windows\System\vBrfuBg.exe
  C:\Windows\System\vBrfuBg.exe
  2⤵
  PID:6504
- C:\Windows\System\gvYsARr.exe
  C:\Windows\System\gvYsARr.exe
  2⤵
  PID:6520
- C:\Windows\System\POMQzow.exe
  C:\Windows\System\POMQzow.exe
  2⤵
  PID:6536
- C:\Windows\System\pXSbowe.exe
  C:\Windows\System\pXSbowe.exe
  2⤵
  PID:6552
- C:\Windows\System\YpeSYMV.exe
  C:\Windows\System\YpeSYMV.exe
  2⤵
  PID:6568
- C:\Windows\System\GCdAupx.exe
  C:\Windows\System\GCdAupx.exe
  2⤵
  PID:6584
- C:\Windows\System\PDZbjVg.exe
  C:\Windows\System\PDZbjVg.exe
  2⤵
  PID:6608
- C:\Windows\System\VYXcfmo.exe
  C:\Windows\System\VYXcfmo.exe
  2⤵
  PID:6624
- C:\Windows\System\EUoERkI.exe
  C:\Windows\System\EUoERkI.exe
  2⤵
  PID:6640
- C:\Windows\System\KAZXUyO.exe
  C:\Windows\System\KAZXUyO.exe
  2⤵
  PID:6656
- C:\Windows\System\iVoAuTH.exe
  C:\Windows\System\iVoAuTH.exe
  2⤵
  PID:6672
- C:\Windows\System\DGdOvBy.exe
  C:\Windows\System\DGdOvBy.exe
  2⤵
  PID:6688
- C:\Windows\System\VdAHXsS.exe
  C:\Windows\System\VdAHXsS.exe
  2⤵
  PID:6704
- C:\Windows\System\SfHyGDv.exe
  C:\Windows\System\SfHyGDv.exe
  2⤵
  PID:6720
- C:\Windows\System\iwuLfMF.exe
  C:\Windows\System\iwuLfMF.exe
  2⤵
  PID:6736
- C:\Windows\System\VzYYEWl.exe
  C:\Windows\System\VzYYEWl.exe
  2⤵
  PID:6752
- C:\Windows\System\YiYgnym.exe
  C:\Windows\System\YiYgnym.exe
  2⤵
  PID:6768
- C:\Windows\System\kYNkDPj.exe
  C:\Windows\System\kYNkDPj.exe
  2⤵
  PID:6784
- C:\Windows\System\oMAvlmJ.exe
  C:\Windows\System\oMAvlmJ.exe
  2⤵
  PID:6800
- C:\Windows\System\DcBVdjM.exe
  C:\Windows\System\DcBVdjM.exe
  2⤵
  PID:6816
- C:\Windows\System\CVglzes.exe
  C:\Windows\System\CVglzes.exe
  2⤵
  PID:6832
- C:\Windows\System\kCRVGAx.exe
  C:\Windows\System\kCRVGAx.exe
  2⤵
  PID:6848
- C:\Windows\System\ISwzZXG.exe
  C:\Windows\System\ISwzZXG.exe
  2⤵
  PID:6864
- C:\Windows\System\GZlGgeI.exe
  C:\Windows\System\GZlGgeI.exe
  2⤵
  PID:6880
- C:\Windows\System\fFJbYQq.exe
  C:\Windows\System\fFJbYQq.exe
  2⤵
  PID:6896
- C:\Windows\System\CadUzYN.exe
  C:\Windows\System\CadUzYN.exe
  2⤵
  PID:6912
- C:\Windows\System\XMbZkQA.exe
  C:\Windows\System\XMbZkQA.exe
  2⤵
  PID:6928
- C:\Windows\System\fIBQTtH.exe
  C:\Windows\System\fIBQTtH.exe
  2⤵
  PID:6948
- C:\Windows\System\lxzTRdm.exe
  C:\Windows\System\lxzTRdm.exe
  2⤵
  PID:6964
- C:\Windows\System\FoVKsCk.exe
  C:\Windows\System\FoVKsCk.exe
  2⤵
  PID:6980
- C:\Windows\System\mvKIoOV.exe
  C:\Windows\System\mvKIoOV.exe
  2⤵
  PID:6996
- C:\Windows\System\jrFsvHV.exe
  C:\Windows\System\jrFsvHV.exe
  2⤵
  PID:7012
- C:\Windows\System\GKhmjWa.exe
  C:\Windows\System\GKhmjWa.exe
  2⤵
  PID:7028
- C:\Windows\System\mUSpKCn.exe
  C:\Windows\System\mUSpKCn.exe
  2⤵
  PID:7044
- C:\Windows\System\VvYQXVS.exe
  C:\Windows\System\VvYQXVS.exe
  2⤵
  PID:7060
- C:\Windows\System\kmpiSmf.exe
  C:\Windows\System\kmpiSmf.exe
  2⤵
  PID:7076
- C:\Windows\System\YAuLVcR.exe
  C:\Windows\System\YAuLVcR.exe
  2⤵
  PID:7092
- C:\Windows\System\fxbyeDv.exe
  C:\Windows\System\fxbyeDv.exe
  2⤵
  PID:7108
- C:\Windows\System\iwWtxee.exe
  C:\Windows\System\iwWtxee.exe
  2⤵
  PID:7124
- C:\Windows\System\XGWfnMA.exe
  C:\Windows\System\XGWfnMA.exe
  2⤵
  PID:7140
- C:\Windows\System\qvjFzxe.exe
  C:\Windows\System\qvjFzxe.exe
  2⤵
  PID:7156
- C:\Windows\System\JPHpwsP.exe
  C:\Windows\System\JPHpwsP.exe
  2⤵
  PID:5812
- C:\Windows\System\FiwtgDR.exe
  C:\Windows\System\FiwtgDR.exe
  2⤵
  PID:5952
- C:\Windows\System\GTzfWeF.exe
  C:\Windows\System\GTzfWeF.exe
  2⤵
  PID:6168
- C:\Windows\System\NrvwcXS.exe
  C:\Windows\System\NrvwcXS.exe
  2⤵
  PID:6236
- C:\Windows\System\yCkmdxn.exe
  C:\Windows\System\yCkmdxn.exe
  2⤵
  PID:6280
- C:\Windows\System\hGxlKWH.exe
  C:\Windows\System\hGxlKWH.exe
  2⤵
  PID:6296
- C:\Windows\System\khoTYXf.exe
  C:\Windows\System\khoTYXf.exe
  2⤵
  PID:6308
- C:\Windows\System\BAdHBfN.exe
  C:\Windows\System\BAdHBfN.exe
  2⤵
  PID:5716
- C:\Windows\System\yymuCLl.exe
  C:\Windows\System\yymuCLl.exe
  2⤵
  PID:880
- C:\Windows\System\hqYwjcd.exe
  C:\Windows\System\hqYwjcd.exe
  2⤵
  PID:5680
- C:\Windows\System\ZntcCIa.exe
  C:\Windows\System\ZntcCIa.exe
  2⤵
  PID:5872
- C:\Windows\System\XLAzdIq.exe
  C:\Windows\System\XLAzdIq.exe
  2⤵
  PID:5972
- C:\Windows\System\NxPSERp.exe
  C:\Windows\System\NxPSERp.exe
  2⤵
  PID:5164
- C:\Windows\System\qKHRHnZ.exe
  C:\Windows\System\qKHRHnZ.exe
  2⤵
  PID:5408
- C:\Windows\System\eUtSNYL.exe
  C:\Windows\System\eUtSNYL.exe
  2⤵
  PID:5252
- C:\Windows\System\rGbUnSs.exe
  C:\Windows\System\rGbUnSs.exe
  2⤵
  PID:5484
- C:\Windows\System\IiAzyKf.exe
  C:\Windows\System\IiAzyKf.exe
  2⤵
  PID:6088
- C:\Windows\System\WrJbbtm.exe
  C:\Windows\System\WrJbbtm.exe
  2⤵
  PID:6048
- C:\Windows\System\jIaYzQF.exe
  C:\Windows\System\jIaYzQF.exe
  2⤵
  PID:2836
- C:\Windows\System\gtoLVte.exe
  C:\Windows\System\gtoLVte.exe
  2⤵
  PID:5308
- C:\Windows\System\PMPvvlw.exe
  C:\Windows\System\PMPvvlw.exe
  2⤵
  PID:5320
- C:\Windows\System\EdwwvYJ.exe
  C:\Windows\System\EdwwvYJ.exe
  2⤵
  PID:5776
- C:\Windows\System\KzBwhmO.exe
  C:\Windows\System\KzBwhmO.exe
  2⤵
  PID:6068
- C:\Windows\System\LLgkxZh.exe
  C:\Windows\System\LLgkxZh.exe
  2⤵
  PID:6152
- C:\Windows\System\BoINuas.exe
  C:\Windows\System\BoINuas.exe
  2⤵
  PID:6220
- C:\Windows\System\igFKVpG.exe
  C:\Windows\System\igFKVpG.exe
  2⤵
  PID:6256
- C:\Windows\System\kQMjsZH.exe
  C:\Windows\System\kQMjsZH.exe
  2⤵
  PID:6320
- C:\Windows\System\MbqYajM.exe
  C:\Windows\System\MbqYajM.exe
  2⤵
  PID:6384
- C:\Windows\System\rVOrwQP.exe
  C:\Windows\System\rVOrwQP.exe
  2⤵
  PID:6452
- C:\Windows\System\MIkwnVv.exe
  C:\Windows\System\MIkwnVv.exe
  2⤵
  PID:6332
- C:\Windows\System\zyZYUFy.exe
  C:\Windows\System\zyZYUFy.exe
  2⤵
  PID:6396
- C:\Windows\System\CJqaOjg.exe
  C:\Windows\System\CJqaOjg.exe
  2⤵
  PID:6576
- C:\Windows\System\SJxTGXl.exe
  C:\Windows\System\SJxTGXl.exe
  2⤵
  PID:6428
- C:\Windows\System\OfdZWRo.exe
  C:\Windows\System\OfdZWRo.exe
  2⤵
  PID:6468
- C:\Windows\System\VpUhhLv.exe
  C:\Windows\System\VpUhhLv.exe
  2⤵
  PID:6532
- C:\Windows\System\xoIBhbt.exe
  C:\Windows\System\xoIBhbt.exe
  2⤵
  PID:6620
- C:\Windows\System\ohwlILn.exe
  C:\Windows\System\ohwlILn.exe
  2⤵
  PID:6684
- C:\Windows\System\DfHCJiB.exe
  C:\Windows\System\DfHCJiB.exe
  2⤵
  PID:6596
- C:\Windows\System\HbItlTC.exe
  C:\Windows\System\HbItlTC.exe
  2⤵
  PID:6636
- C:\Windows\System\ZLsZAAf.exe
  C:\Windows\System\ZLsZAAf.exe
  2⤵
  PID:6668
- C:\Windows\System\nHiygpC.exe
  C:\Windows\System\nHiygpC.exe
  2⤵
  PID:6732
- C:\Windows\System\JWqNyiR.exe
  C:\Windows\System\JWqNyiR.exe
  2⤵
  PID:6748
- C:\Windows\System\GbmVBIM.exe
  C:\Windows\System\GbmVBIM.exe
  2⤵
  PID:6812
- C:\Windows\System\teapxjN.exe
  C:\Windows\System\teapxjN.exe
  2⤵
  PID:6872
- C:\Windows\System\KXlQMnO.exe
  C:\Windows\System\KXlQMnO.exe
  2⤵
  PID:6828
- C:\Windows\System\NXbnSeR.exe
  C:\Windows\System\NXbnSeR.exe
  2⤵
  PID:6888
- C:\Windows\System\RyrkuDh.exe
  C:\Windows\System\RyrkuDh.exe
  2⤵
  PID:6944
- C:\Windows\System\VMKgBzp.exe
  C:\Windows\System\VMKgBzp.exe
  2⤵
  PID:6972
- C:\Windows\System\peLukXQ.exe
  C:\Windows\System\peLukXQ.exe
  2⤵
  PID:7004
- C:\Windows\System\GFCyDSs.exe
  C:\Windows\System\GFCyDSs.exe
  2⤵
  PID:7036
- C:\Windows\System\jcKmAyp.exe
  C:\Windows\System\jcKmAyp.exe
  2⤵
  PID:7084
- C:\Windows\System\nSYSOOn.exe
  C:\Windows\System\nSYSOOn.exe
  2⤵
  PID:7100
- C:\Windows\System\vdlZQQs.exe
  C:\Windows\System\vdlZQQs.exe
  2⤵
  PID:7164
- C:\Windows\System\kngOcAa.exe
  C:\Windows\System\kngOcAa.exe
  2⤵
  PID:5352
- C:\Windows\System\jOqcAeF.exe
  C:\Windows\System\jOqcAeF.exe
  2⤵
  PID:2436
- C:\Windows\System\WnDTGbd.exe
  C:\Windows\System\WnDTGbd.exe
  2⤵
  PID:6204
- C:\Windows\System\poaJTLl.exe
  C:\Windows\System\poaJTLl.exe
  2⤵
  PID:6276
- C:\Windows\System\wsmmZvn.exe
  C:\Windows\System\wsmmZvn.exe
  2⤵
  PID:5708
- C:\Windows\System\VdakwdY.exe
  C:\Windows\System\VdakwdY.exe
  2⤵
  PID:5256
- C:\Windows\System\JeEvYVr.exe
  C:\Windows\System\JeEvYVr.exe
  2⤵
  PID:6120
- C:\Windows\System\CuGjyMJ.exe
  C:\Windows\System\CuGjyMJ.exe
  2⤵
  PID:5968
- C:\Windows\System\gvlxdCr.exe
  C:\Windows\System\gvlxdCr.exe
  2⤵
  PID:5440
- C:\Windows\System\MSlyIic.exe
  C:\Windows\System\MSlyIic.exe
  2⤵
  PID:5260
- C:\Windows\System\JGpkuiq.exe
  C:\Windows\System\JGpkuiq.exe
  2⤵
  PID:3320
- C:\Windows\System\JJlmyeW.exe
  C:\Windows\System\JJlmyeW.exe
  2⤵
  PID:5936
- C:\Windows\System\WaoYajS.exe
  C:\Windows\System\WaoYajS.exe
  2⤵
  PID:6272
- C:\Windows\System\LuEekAo.exe
  C:\Windows\System\LuEekAo.exe
  2⤵
  PID:6368
- C:\Windows\System\PVIpaqW.exe
  C:\Windows\System\PVIpaqW.exe
  2⤵
  PID:6528
- C:\Windows\System\XXegESm.exe
  C:\Windows\System\XXegESm.exe
  2⤵
  PID:6632
- C:\Windows\System\yVZJVNe.exe
  C:\Windows\System\yVZJVNe.exe
  2⤵
  PID:6824
- C:\Windows\System\lZWWTVg.exe
  C:\Windows\System\lZWWTVg.exe
  2⤵
  PID:6924
- C:\Windows\System\UXLYOJw.exe
  C:\Windows\System\UXLYOJw.exe
  2⤵
  PID:7040
- C:\Windows\System\joYbllB.exe
  C:\Windows\System\joYbllB.exe
  2⤵
  PID:7152
- C:\Windows\System\xEbFIBM.exe
  C:\Windows\System\xEbFIBM.exe
  2⤵
  PID:5472
- C:\Windows\System\dgMdTzL.exe
  C:\Windows\System\dgMdTzL.exe
  2⤵
  PID:5380
- C:\Windows\System\iMgjgrC.exe
  C:\Windows\System\iMgjgrC.exe
  2⤵
  PID:6364
- C:\Windows\System\XfWnUrP.exe
  C:\Windows\System\XfWnUrP.exe
  2⤵
  PID:6716
- C:\Windows\System\RZOUPuy.exe
  C:\Windows\System\RZOUPuy.exe
  2⤵
  PID:6908
- C:\Windows\System\WkQkuJS.exe
  C:\Windows\System\WkQkuJS.exe
  2⤵
  PID:6920
- C:\Windows\System\tqLAKQU.exe
  C:\Windows\System\tqLAKQU.exe
  2⤵
  PID:7020
- C:\Windows\System\WzJzfTo.exe
  C:\Windows\System\WzJzfTo.exe
  2⤵
  PID:6268
- C:\Windows\System\PtcOQZD.exe
  C:\Windows\System\PtcOQZD.exe
  2⤵
  PID:5692
- C:\Windows\System\CQoSoSv.exe
  C:\Windows\System\CQoSoSv.exe
  2⤵
  PID:5404
- C:\Windows\System\EdBMspQ.exe
  C:\Windows\System\EdBMspQ.exe
  2⤵
  PID:6512
- C:\Windows\System\JdIiKwe.exe
  C:\Windows\System\JdIiKwe.exe
  2⤵
  PID:6808
- C:\Windows\System\fGAjDHF.exe
  C:\Windows\System\fGAjDHF.exe
  2⤵
  PID:5508
- C:\Windows\System\KHJkaOh.exe
  C:\Windows\System\KHJkaOh.exe
  2⤵
  PID:5424
- C:\Windows\System\ebgIJay.exe
  C:\Windows\System\ebgIJay.exe
  2⤵
  PID:6484
- C:\Windows\System\qyEliDX.exe
  C:\Windows\System\qyEliDX.exe
  2⤵
  PID:6664
- C:\Windows\System\HVstTTl.exe
  C:\Windows\System\HVstTTl.exe
  2⤵
  PID:6992
- C:\Windows\System\ilsyEPs.exe
  C:\Windows\System\ilsyEPs.exe
  2⤵
  PID:6500
- C:\Windows\System\FuxozWS.exe
  C:\Windows\System\FuxozWS.exe
  2⤵
  PID:6464
- C:\Windows\System\jUdOGEp.exe
  C:\Windows\System\jUdOGEp.exe
  2⤵
  PID:7116
- C:\Windows\System\wGkkmRJ.exe
  C:\Windows\System\wGkkmRJ.exe
  2⤵
  PID:2192
- C:\Windows\System\ZUpToTa.exe
  C:\Windows\System\ZUpToTa.exe
  2⤵
  PID:5588
- C:\Windows\System\dBnfXjY.exe
  C:\Windows\System\dBnfXjY.exe
  2⤵
  PID:6604
- C:\Windows\System\qDeWULg.exe
  C:\Windows\System\qDeWULg.exe
  2⤵
  PID:6316
- C:\Windows\System\EBFGoLa.exe
  C:\Windows\System\EBFGoLa.exe
  2⤵
  PID:6956
- C:\Windows\System\QUGAPiw.exe
  C:\Windows\System\QUGAPiw.exe
  2⤵
  PID:7088
- C:\Windows\System\hQNOJmW.exe
  C:\Windows\System\hQNOJmW.exe
  2⤵
  PID:6380
- C:\Windows\System\wCTMzRI.exe
  C:\Windows\System\wCTMzRI.exe
  2⤵
  PID:5840
- C:\Windows\System\dnZaVXE.exe
  C:\Windows\System\dnZaVXE.exe
  2⤵
  PID:6744
- C:\Windows\System\AHEZsWG.exe
  C:\Windows\System\AHEZsWG.exe
  2⤵
  PID:6188
- C:\Windows\System\fqQPUaw.exe
  C:\Windows\System\fqQPUaw.exe
  2⤵
  PID:6352
- C:\Windows\System\CQjCyvf.exe
  C:\Windows\System\CQjCyvf.exe
  2⤵
  PID:7176
- C:\Windows\System\lMjajMO.exe
  C:\Windows\System\lMjajMO.exe
  2⤵
  PID:7196
- C:\Windows\System\OyxBVis.exe
  C:\Windows\System\OyxBVis.exe
  2⤵
  PID:7212
- C:\Windows\System\QNbrxjB.exe
  C:\Windows\System\QNbrxjB.exe
  2⤵
  PID:7228
- C:\Windows\System\IHOPlvA.exe
  C:\Windows\System\IHOPlvA.exe
  2⤵
  PID:7244
- C:\Windows\System\ptaBRhD.exe
  C:\Windows\System\ptaBRhD.exe
  2⤵
  PID:7260
- C:\Windows\System\TxedCoO.exe
  C:\Windows\System\TxedCoO.exe
  2⤵
  PID:7276
- C:\Windows\System\wyRCmcd.exe
  C:\Windows\System\wyRCmcd.exe
  2⤵
  PID:7292
- C:\Windows\System\wUmqeNd.exe
  C:\Windows\System\wUmqeNd.exe
  2⤵
  PID:7308
- C:\Windows\System\PNZzatV.exe
  C:\Windows\System\PNZzatV.exe
  2⤵
  PID:7324
- C:\Windows\System\pkugNlt.exe
  C:\Windows\System\pkugNlt.exe
  2⤵
  PID:7340
- C:\Windows\System\NZjLcNF.exe
  C:\Windows\System\NZjLcNF.exe
  2⤵
  PID:7356
- C:\Windows\System\UhIxPDK.exe
  C:\Windows\System\UhIxPDK.exe
  2⤵
  PID:7372
- C:\Windows\System\nIWaVkd.exe
  C:\Windows\System\nIWaVkd.exe
  2⤵
  PID:7388
- C:\Windows\System\zKhZTjj.exe
  C:\Windows\System\zKhZTjj.exe
  2⤵
  PID:7404
- C:\Windows\System\TjEYhgF.exe
  C:\Windows\System\TjEYhgF.exe
  2⤵
  PID:7420
- C:\Windows\System\fdusqPK.exe
  C:\Windows\System\fdusqPK.exe
  2⤵
  PID:7436
- C:\Windows\System\XdqZTVE.exe
  C:\Windows\System\XdqZTVE.exe
  2⤵
  PID:7452
- C:\Windows\System\jfWORBp.exe
  C:\Windows\System\jfWORBp.exe
  2⤵
  PID:7468
- C:\Windows\System\wCmExZY.exe
  C:\Windows\System\wCmExZY.exe
  2⤵
  PID:7484
- C:\Windows\System\GeNEFHQ.exe
  C:\Windows\System\GeNEFHQ.exe
  2⤵
  PID:7500
- C:\Windows\System\THmQOia.exe
  C:\Windows\System\THmQOia.exe
  2⤵
  PID:7520
- C:\Windows\System\ILZvyPy.exe
  C:\Windows\System\ILZvyPy.exe
  2⤵
  PID:7536
- C:\Windows\System\mkZAxVz.exe
  C:\Windows\System\mkZAxVz.exe
  2⤵
  PID:7552
- C:\Windows\System\YHcSJkj.exe
  C:\Windows\System\YHcSJkj.exe
  2⤵
  PID:7568
- C:\Windows\System\lSrnSEg.exe
  C:\Windows\System\lSrnSEg.exe
  2⤵
  PID:7584
- C:\Windows\System\RkbFpIc.exe
  C:\Windows\System\RkbFpIc.exe
  2⤵
  PID:7600
- C:\Windows\System\JHRgdEV.exe
  C:\Windows\System\JHRgdEV.exe
  2⤵
  PID:7616
- C:\Windows\System\VYGTeVp.exe
  C:\Windows\System\VYGTeVp.exe
  2⤵
  PID:7632
- C:\Windows\System\DVtStkN.exe
  C:\Windows\System\DVtStkN.exe
  2⤵
  PID:7648
- C:\Windows\System\aKRfKSr.exe
  C:\Windows\System\aKRfKSr.exe
  2⤵
  PID:7664
- C:\Windows\System\OSHquIw.exe
  C:\Windows\System\OSHquIw.exe
  2⤵
  PID:7680
- C:\Windows\System\DDJCCnM.exe
  C:\Windows\System\DDJCCnM.exe
  2⤵
  PID:7696
- C:\Windows\System\DhxPxbo.exe
  C:\Windows\System\DhxPxbo.exe
  2⤵
  PID:7712
- C:\Windows\System\usXnVIo.exe
  C:\Windows\System\usXnVIo.exe
  2⤵
  PID:7728
- C:\Windows\System\RQMKUdK.exe
  C:\Windows\System\RQMKUdK.exe
  2⤵
  PID:7744
- C:\Windows\System\itvInVp.exe
  C:\Windows\System\itvInVp.exe
  2⤵
  PID:7760
- C:\Windows\System\TyethYB.exe
  C:\Windows\System\TyethYB.exe
  2⤵
  PID:7776
- C:\Windows\System\SJyklxA.exe
  C:\Windows\System\SJyklxA.exe
  2⤵
  PID:7792
- C:\Windows\System\RyKrZrE.exe
  C:\Windows\System\RyKrZrE.exe
  2⤵
  PID:7808
- C:\Windows\System\BFiMaCg.exe
  C:\Windows\System\BFiMaCg.exe
  2⤵
  PID:7824
- C:\Windows\System\ZXZtheE.exe
  C:\Windows\System\ZXZtheE.exe
  2⤵
  PID:7840
- C:\Windows\System\mftckJc.exe
  C:\Windows\System\mftckJc.exe
  2⤵
  PID:7856
- C:\Windows\System\jawsGds.exe
  C:\Windows\System\jawsGds.exe
  2⤵
  PID:7872
- C:\Windows\System\AYNeZQu.exe
  C:\Windows\System\AYNeZQu.exe
  2⤵
  PID:7888
- C:\Windows\System\dXNtFmk.exe
  C:\Windows\System\dXNtFmk.exe
  2⤵
  PID:7904
- C:\Windows\System\yPCiBRD.exe
  C:\Windows\System\yPCiBRD.exe
  2⤵
  PID:7920
- C:\Windows\System\uvupoBw.exe
  C:\Windows\System\uvupoBw.exe
  2⤵
  PID:7936
- C:\Windows\System\OBVfrbC.exe
  C:\Windows\System\OBVfrbC.exe
  2⤵
  PID:7952
- C:\Windows\System\JJpfZOR.exe
  C:\Windows\System\JJpfZOR.exe
  2⤵
  PID:7968
- C:\Windows\System\ABrWjpD.exe
  C:\Windows\System\ABrWjpD.exe
  2⤵
  PID:7984
- C:\Windows\System\ADufUjm.exe
  C:\Windows\System\ADufUjm.exe
  2⤵
  PID:8000
- C:\Windows\System\MFHJrlN.exe
  C:\Windows\System\MFHJrlN.exe
  2⤵
  PID:8020
- C:\Windows\System\schyKQS.exe
  C:\Windows\System\schyKQS.exe
  2⤵
  PID:8036
- C:\Windows\System\vDpzRgm.exe
  C:\Windows\System\vDpzRgm.exe
  2⤵
  PID:8052
- C:\Windows\System\jhCBkAO.exe
  C:\Windows\System\jhCBkAO.exe
  2⤵
  PID:8068
- C:\Windows\System\RubqFeB.exe
  C:\Windows\System\RubqFeB.exe
  2⤵
  PID:8084
- C:\Windows\System\cWLzLvx.exe
  C:\Windows\System\cWLzLvx.exe
  2⤵
  PID:8100
- C:\Windows\System\VSvngKi.exe
  C:\Windows\System\VSvngKi.exe
  2⤵
  PID:8116
- C:\Windows\System\QurUXYy.exe
  C:\Windows\System\QurUXYy.exe
  2⤵
  PID:8132
- C:\Windows\System\ybtDAkW.exe
  C:\Windows\System\ybtDAkW.exe
  2⤵
  PID:8148
- C:\Windows\System\uYElGvd.exe
  C:\Windows\System\uYElGvd.exe
  2⤵
  PID:8164
- C:\Windows\System\RBZLtBQ.exe
  C:\Windows\System\RBZLtBQ.exe
  2⤵
  PID:8180
- C:\Windows\System\MZhNAej.exe
  C:\Windows\System\MZhNAej.exe
  2⤵
  PID:7172
- C:\Windows\System\opZEGAr.exe
  C:\Windows\System\opZEGAr.exe
  2⤵
  PID:7240
- C:\Windows\System\FlyIXWg.exe
  C:\Windows\System\FlyIXWg.exe
  2⤵
  PID:7304
- C:\Windows\System\pPKAcdB.exe
  C:\Windows\System\pPKAcdB.exe
  2⤵
  PID:7368
- C:\Windows\System\zlGriTg.exe
  C:\Windows\System\zlGriTg.exe
  2⤵
  PID:6080
- C:\Windows\System\tizyGJi.exe
  C:\Windows\System\tizyGJi.exe
  2⤵
  PID:7380
- C:\Windows\System\hUqtiXk.exe
  C:\Windows\System\hUqtiXk.exe
  2⤵
  PID:5824
- C:\Windows\System\YJRMkEp.exe
  C:\Windows\System\YJRMkEp.exe
  2⤵
  PID:5176
- C:\Windows\System\xrnYvBd.exe
  C:\Windows\System\xrnYvBd.exe
  2⤵
  PID:7192
- C:\Windows\System\yWhUiCU.exe
  C:\Windows\System\yWhUiCU.exe
  2⤵
  PID:7256
- C:\Windows\System\izlERFD.exe
  C:\Windows\System\izlERFD.exe
  2⤵
  PID:7288
- C:\Windows\System\APImRUN.exe
  C:\Windows\System\APImRUN.exe
  2⤵
  PID:7416
- C:\Windows\System\OYNGJcX.exe
  C:\Windows\System\OYNGJcX.exe
  2⤵
  PID:7512
- C:\Windows\System\poaBqTX.exe
  C:\Windows\System\poaBqTX.exe
  2⤵
  PID:7480
- C:\Windows\System\QqhQPAb.exe
  C:\Windows\System\QqhQPAb.exe
  2⤵
  PID:7560
- C:\Windows\System\rnoVznk.exe
  C:\Windows\System\rnoVznk.exe
  2⤵
  PID:7624
- C:\Windows\System\WzslMMV.exe
  C:\Windows\System\WzslMMV.exe
  2⤵
  PID:7576
- C:\Windows\System\emQJCDq.exe
  C:\Windows\System\emQJCDq.exe
  2⤵
  PID:7644
- C:\Windows\System\FMhoUJC.exe
  C:\Windows\System\FMhoUJC.exe
  2⤵
  PID:7672
- C:\Windows\System\SNckuzk.exe
  C:\Windows\System\SNckuzk.exe
  2⤵
  PID:7736
- C:\Windows\System\wncIYpc.exe
  C:\Windows\System\wncIYpc.exe
  2⤵
  PID:7720
- C:\Windows\System\UBOOYOQ.exe
  C:\Windows\System\UBOOYOQ.exe
  2⤵
  PID:7788
- C:\Windows\System\lxSlJgc.exe
  C:\Windows\System\lxSlJgc.exe
  2⤵
  PID:7852
- C:\Windows\System\PtVzqAW.exe
  C:\Windows\System\PtVzqAW.exe
  2⤵
  PID:7832
- C:\Windows\System\UhTHAFl.exe
  C:\Windows\System\UhTHAFl.exe
  2⤵
  PID:7944
- C:\Windows\System\zrofjFv.exe
  C:\Windows\System\zrofjFv.exe
  2⤵
  PID:7976
- C:\Windows\System\NMRSrCD.exe
  C:\Windows\System\NMRSrCD.exe
  2⤵
  PID:7900
- C:\Windows\System\IiFsLtc.exe
  C:\Windows\System\IiFsLtc.exe
  2⤵
  PID:8080
- C:\Windows\System\GvnGNCK.exe
  C:\Windows\System\GvnGNCK.exe
  2⤵
  PID:7896
- C:\Windows\System\dbqGrcl.exe
  C:\Windows\System\dbqGrcl.exe
  2⤵
  PID:7964
- C:\Windows\System\IyPCrJl.exe
  C:\Windows\System\IyPCrJl.exe
  2⤵
  PID:8064
- C:\Windows\System\zlUywnd.exe
  C:\Windows\System\zlUywnd.exe
  2⤵
  PID:8124
- C:\Windows\System\dRWAmoY.exe
  C:\Windows\System\dRWAmoY.exe
  2⤵
  PID:8144
- C:\Windows\System\XzcPRbp.exe
  C:\Windows\System\XzcPRbp.exe
  2⤵
  PID:7236
- C:\Windows\System\riydpKI.exe
  C:\Windows\System\riydpKI.exe
  2⤵
  PID:7336
- C:\Windows\System\dvsFClt.exe
  C:\Windows\System\dvsFClt.exe
  2⤵
  PID:7272
- C:\Windows\System\DUhQSCg.exe
  C:\Windows\System\DUhQSCg.exe
  2⤵
  PID:5828
- C:\Windows\System\wOjlmFE.exe
  C:\Windows\System\wOjlmFE.exe
  2⤵
  PID:7348
- C:\Windows\System\tMuhslT.exe
  C:\Windows\System\tMuhslT.exe
  2⤵
  PID:5144
- C:\Windows\System\pICWFwg.exe
  C:\Windows\System\pICWFwg.exe
  2⤵
  PID:7612
- C:\Windows\System\vhXPoLx.exe
  C:\Windows\System\vhXPoLx.exe
  2⤵
  PID:7460
- C:\Windows\System\PYbLDdn.exe
  C:\Windows\System\PYbLDdn.exe
  2⤵
  PID:7756
- C:\Windows\System\kzJElBa.exe
  C:\Windows\System\kzJElBa.exe
  2⤵
  PID:7772
- C:\Windows\System\EyYeAVr.exe
  C:\Windows\System\EyYeAVr.exe
  2⤵
  PID:7868
- C:\Windows\System\uAHfRjL.exe
  C:\Windows\System\uAHfRjL.exe
  2⤵
  PID:8060
- C:\Windows\System\wLLCcZu.exe
  C:\Windows\System\wLLCcZu.exe
  2⤵
  PID:8008
- C:\Windows\System\mKrwIrx.exe
  C:\Windows\System\mKrwIrx.exe
  2⤵
  PID:7676
- C:\Windows\System\SxPDOfr.exe
  C:\Windows\System\SxPDOfr.exe
  2⤵
  PID:7848
- C:\Windows\System\fOrOSIP.exe
  C:\Windows\System\fOrOSIP.exe
  2⤵
  PID:8176
- C:\Windows\System\uFiWObC.exe
  C:\Windows\System\uFiWObC.exe
  2⤵
  PID:7252
- C:\Windows\System\RURmebB.exe
  C:\Windows\System\RURmebB.exe
  2⤵
  PID:7916
- C:\Windows\System\ZolmWxp.exe
  C:\Windows\System\ZolmWxp.exe
  2⤵
  PID:5192
- C:\Windows\System\YozngoZ.exe
  C:\Windows\System\YozngoZ.exe
  2⤵
  PID:7708
- C:\Windows\System\SebtkTt.exe
  C:\Windows\System\SebtkTt.exe
  2⤵
  PID:8140
- C:\Windows\System\URadkCB.exe
  C:\Windows\System\URadkCB.exe
  2⤵
  PID:7496
- C:\Windows\System\kApGAgQ.exe
  C:\Windows\System\kApGAgQ.exe
  2⤵
  PID:7752
- C:\Windows\System\ezQHUbI.exe
  C:\Windows\System\ezQHUbI.exe
  2⤵
  PID:6796
- C:\Windows\System\YGRpbwE.exe
  C:\Windows\System\YGRpbwE.exe
  2⤵
  PID:7884
- C:\Windows\System\xvcMxsI.exe
  C:\Windows\System\xvcMxsI.exe
  2⤵
  PID:8160
- C:\Windows\System\rYyKNzx.exe
  C:\Windows\System\rYyKNzx.exe
  2⤵
  PID:8032
- C:\Windows\System\fohxPBw.exe
  C:\Windows\System\fohxPBw.exe
  2⤵
  PID:7492
- C:\Windows\System\NWFyGoY.exe
  C:\Windows\System\NWFyGoY.exe
  2⤵
  PID:7432
- C:\Windows\System\mKceFSJ.exe
  C:\Windows\System\mKceFSJ.exe
  2⤵
  PID:7704
- C:\Windows\System\hkyHbzt.exe
  C:\Windows\System\hkyHbzt.exe
  2⤵
  PID:8128
- C:\Windows\System\GuiPzzR.exe
  C:\Windows\System\GuiPzzR.exe
  2⤵
  PID:8112
- C:\Windows\System\qsYwbAm.exe
  C:\Windows\System\qsYwbAm.exe
  2⤵
  PID:8200
- C:\Windows\System\gEsCDOv.exe
  C:\Windows\System\gEsCDOv.exe
  2⤵
  PID:8216
- C:\Windows\System\VoXEeJv.exe
  C:\Windows\System\VoXEeJv.exe
  2⤵
  PID:8232
- C:\Windows\System\xltpFCS.exe
  C:\Windows\System\xltpFCS.exe
  2⤵
  PID:8248
- C:\Windows\System\LdSBbXl.exe
  C:\Windows\System\LdSBbXl.exe
  2⤵
  PID:8272
- C:\Windows\System\NQSUgsf.exe
  C:\Windows\System\NQSUgsf.exe
  2⤵
  PID:8288
- C:\Windows\System\RGhBzHa.exe
  C:\Windows\System\RGhBzHa.exe
  2⤵
  PID:8304
- C:\Windows\System\vDwpDUC.exe
  C:\Windows\System\vDwpDUC.exe
  2⤵
  PID:8320
- C:\Windows\System\vJtsEua.exe
  C:\Windows\System\vJtsEua.exe
  2⤵
  PID:8336
- C:\Windows\System\vOZdjGh.exe
  C:\Windows\System\vOZdjGh.exe
  2⤵
  PID:8352
- C:\Windows\System\tJtcZFq.exe
  C:\Windows\System\tJtcZFq.exe
  2⤵
  PID:8368
- C:\Windows\System\jNtfPmX.exe
  C:\Windows\System\jNtfPmX.exe
  2⤵
  PID:8388
- C:\Windows\System\ROaNkAS.exe
  C:\Windows\System\ROaNkAS.exe
  2⤵
  PID:8404
- C:\Windows\System\OVpZDjQ.exe
  C:\Windows\System\OVpZDjQ.exe
  2⤵
  PID:8420
- C:\Windows\System\bhDioTc.exe
  C:\Windows\System\bhDioTc.exe
  2⤵
  PID:8436
- C:\Windows\System\uZqyzgu.exe
  C:\Windows\System\uZqyzgu.exe
  2⤵
  PID:8452
- C:\Windows\System\bhtcEis.exe
  C:\Windows\System\bhtcEis.exe
  2⤵
  PID:8468
- C:\Windows\System\gPLLVuV.exe
  C:\Windows\System\gPLLVuV.exe
  2⤵
  PID:8484
- C:\Windows\System\kJxJfdj.exe
  C:\Windows\System\kJxJfdj.exe
  2⤵
  PID:8500
- C:\Windows\System\fJQuMnK.exe
  C:\Windows\System\fJQuMnK.exe
  2⤵
  PID:8516
- C:\Windows\System\HTaDSnQ.exe
  C:\Windows\System\HTaDSnQ.exe
  2⤵
  PID:8532
- C:\Windows\System\OAccyOV.exe
  C:\Windows\System\OAccyOV.exe
  2⤵
  PID:8548
- C:\Windows\System\yIuoDYp.exe
  C:\Windows\System\yIuoDYp.exe
  2⤵
  PID:8564
- C:\Windows\System\IRUvyqT.exe
  C:\Windows\System\IRUvyqT.exe
  2⤵
  PID:8580
- C:\Windows\System\GwQzpJC.exe
  C:\Windows\System\GwQzpJC.exe
  2⤵
  PID:8596
- C:\Windows\System\LWVVDNb.exe
  C:\Windows\System\LWVVDNb.exe
  2⤵
  PID:8612
- C:\Windows\System\inRDseB.exe
  C:\Windows\System\inRDseB.exe
  2⤵
  PID:8628
- C:\Windows\System\rYpiYqy.exe
  C:\Windows\System\rYpiYqy.exe
  2⤵
  PID:8644
- C:\Windows\System\HybNoxe.exe
  C:\Windows\System\HybNoxe.exe
  2⤵
  PID:8660
- C:\Windows\System\khAoPOx.exe
  C:\Windows\System\khAoPOx.exe
  2⤵
  PID:8676
- C:\Windows\System\zgkfjWF.exe
  C:\Windows\System\zgkfjWF.exe
  2⤵
  PID:8692
- C:\Windows\System\mWwWlaO.exe
  C:\Windows\System\mWwWlaO.exe
  2⤵
  PID:8708
- C:\Windows\System\vMzHJvx.exe
  C:\Windows\System\vMzHJvx.exe
  2⤵
  PID:8724
- C:\Windows\System\MdZbBKR.exe
  C:\Windows\System\MdZbBKR.exe
  2⤵
  PID:8740
- C:\Windows\System\KaXXSgr.exe
  C:\Windows\System\KaXXSgr.exe
  2⤵
  PID:8756
- C:\Windows\System\NxOTCeF.exe
  C:\Windows\System\NxOTCeF.exe
  2⤵
  PID:8772
- C:\Windows\System\mSVapaj.exe
  C:\Windows\System\mSVapaj.exe
  2⤵
  PID:8788
- C:\Windows\System\GfKOdin.exe
  C:\Windows\System\GfKOdin.exe
  2⤵
  PID:8804
- C:\Windows\System\AnyyTDr.exe
  C:\Windows\System\AnyyTDr.exe
  2⤵
  PID:8820
- C:\Windows\System\SLnjGIO.exe
  C:\Windows\System\SLnjGIO.exe
  2⤵
  PID:8836
- C:\Windows\System\cUWoZWt.exe
  C:\Windows\System\cUWoZWt.exe
  2⤵
  PID:8852
- C:\Windows\System\qfAbhUp.exe
  C:\Windows\System\qfAbhUp.exe
  2⤵
  PID:8868
- C:\Windows\System\UnmVoqq.exe
  C:\Windows\System\UnmVoqq.exe
  2⤵
  PID:8884
- C:\Windows\System\hvLfGQo.exe
  C:\Windows\System\hvLfGQo.exe
  2⤵
  PID:8904
- C:\Windows\System\TINWqSP.exe
  C:\Windows\System\TINWqSP.exe
  2⤵
  PID:8920
- C:\Windows\System\HaViZol.exe
  C:\Windows\System\HaViZol.exe
  2⤵
  PID:8936
- C:\Windows\System\psBClgO.exe
  C:\Windows\System\psBClgO.exe
  2⤵
  PID:8952
- C:\Windows\System\WUWbpNW.exe
  C:\Windows\System\WUWbpNW.exe
  2⤵
  PID:8968
- C:\Windows\System\uHhYPFK.exe
  C:\Windows\System\uHhYPFK.exe
  2⤵
  PID:8984
- C:\Windows\System\fagZqgO.exe
  C:\Windows\System\fagZqgO.exe
  2⤵
  PID:9000
- C:\Windows\System\PihGcOV.exe
  C:\Windows\System\PihGcOV.exe
  2⤵
  PID:9016
- C:\Windows\System\DvsWFwv.exe
  C:\Windows\System\DvsWFwv.exe
  2⤵
  PID:9032
- C:\Windows\System\nqKkcKR.exe
  C:\Windows\System\nqKkcKR.exe
  2⤵
  PID:9048
- C:\Windows\System\sGAPUvH.exe
  C:\Windows\System\sGAPUvH.exe
  2⤵
  PID:9064
- C:\Windows\System\dWHGwTM.exe
  C:\Windows\System\dWHGwTM.exe
  2⤵
  PID:9080
- C:\Windows\System\SRFkYTG.exe
  C:\Windows\System\SRFkYTG.exe
  2⤵
  PID:9096
- C:\Windows\System\eUEmHOi.exe
  C:\Windows\System\eUEmHOi.exe
  2⤵
  PID:9112
- C:\Windows\System\YyPdLaY.exe
  C:\Windows\System\YyPdLaY.exe
  2⤵
  PID:9128
- C:\Windows\System\DMPJiSU.exe
  C:\Windows\System\DMPJiSU.exe
  2⤵
  PID:9144
- C:\Windows\System\eLIAsxB.exe
  C:\Windows\System\eLIAsxB.exe
  2⤵
  PID:9160
- C:\Windows\System\BIUZjCb.exe
  C:\Windows\System\BIUZjCb.exe
  2⤵
  PID:9176
- C:\Windows\System\uxAhdIg.exe
  C:\Windows\System\uxAhdIg.exe
  2⤵
  PID:9192
- C:\Windows\System\NUYpTsR.exe
  C:\Windows\System\NUYpTsR.exe
  2⤵
  PID:9208
- C:\Windows\System\NvxpTZZ.exe
  C:\Windows\System\NvxpTZZ.exe
  2⤵
  PID:8076
- C:\Windows\System\PzMHyXL.exe
  C:\Windows\System\PzMHyXL.exe
  2⤵
  PID:7300
- C:\Windows\System\cDxMyTe.exe
  C:\Windows\System\cDxMyTe.exe
  2⤵
  PID:8256
- C:\Windows\System\KEBodiG.exe
  C:\Windows\System\KEBodiG.exe
  2⤵
  PID:8260
- C:\Windows\System\XnhddPG.exe
  C:\Windows\System\XnhddPG.exe
  2⤵
  PID:8312
- C:\Windows\System\SSMxDzp.exe
  C:\Windows\System\SSMxDzp.exe
  2⤵
  PID:8384
- C:\Windows\System\BiDcIfk.exe
  C:\Windows\System\BiDcIfk.exe
  2⤵
  PID:8364
- C:\Windows\System\uQdFcNu.exe
  C:\Windows\System\uQdFcNu.exe
  2⤵
  PID:8300
- C:\Windows\System\bXXfXkc.exe
  C:\Windows\System\bXXfXkc.exe
  2⤵
  PID:8412
- C:\Windows\System\pemPvZv.exe
  C:\Windows\System\pemPvZv.exe
  2⤵
  PID:8492
- C:\Windows\System\tHbWtwE.exe
  C:\Windows\System\tHbWtwE.exe
  2⤵
  PID:8556
- C:\Windows\System\YqonRWf.exe
  C:\Windows\System\YqonRWf.exe
  2⤵
  PID:8476
- C:\Windows\System\YzRiGjK.exe
  C:\Windows\System\YzRiGjK.exe
  2⤵
  PID:8540
- C:\Windows\System\uPNFCfd.exe
  C:\Windows\System\uPNFCfd.exe
  2⤵
  PID:8604
- C:\Windows\System\vddDZNb.exe
  C:\Windows\System\vddDZNb.exe
  2⤵
  PID:8432
- C:\Windows\System\GZYmPeO.exe
  C:\Windows\System\GZYmPeO.exe
  2⤵
  PID:8624
- C:\Windows\System\IfDnhFn.exe
  C:\Windows\System\IfDnhFn.exe
  2⤵
  PID:8656
- C:\Windows\System\hxQRMst.exe
  C:\Windows\System\hxQRMst.exe
  2⤵
  PID:8720
- C:\Windows\System\oVzylss.exe
  C:\Windows\System\oVzylss.exe
  2⤵
  PID:8784
- C:\Windows\System\vdAMHNK.exe
  C:\Windows\System\vdAMHNK.exe
  2⤵
  PID:8848
- C:\Windows\System\KcgBiNL.exe
  C:\Windows\System\KcgBiNL.exe
  2⤵
  PID:8916
- C:\Windows\System\sJEMhhN.exe
  C:\Windows\System\sJEMhhN.exe
  2⤵
  PID:8980
- C:\Windows\System\wLKhcXA.exe
  C:\Windows\System\wLKhcXA.exe
  2⤵
  PID:9040
- C:\Windows\System\FlsYTHD.exe
  C:\Windows\System\FlsYTHD.exe
  2⤵
  PID:8732
- C:\Windows\System\dgwPIQS.exe
  C:\Windows\System\dgwPIQS.exe
  2⤵
  PID:8768
- C:\Windows\System\AmFRWkc.exe
  C:\Windows\System\AmFRWkc.exe
  2⤵
  PID:8860
- C:\Windows\System\uXzACWP.exe
  C:\Windows\System\uXzACWP.exe
  2⤵
  PID:8932
- C:\Windows\System\QXsLshy.exe
  C:\Windows\System\QXsLshy.exe
  2⤵
  PID:8996
- C:\Windows\System\XilQoKw.exe
  C:\Windows\System\XilQoKw.exe
  2⤵
  PID:9044
- C:\Windows\System\nwkgFDf.exe
  C:\Windows\System\nwkgFDf.exe
  2⤵
  PID:9060
- C:\Windows\System\olLwQKq.exe
  C:\Windows\System\olLwQKq.exe
  2⤵
  PID:9124
- C:\Windows\System\PhASTho.exe
  C:\Windows\System\PhASTho.exe
  2⤵
  PID:9168
- C:\Windows\System\gGhgYNP.exe
  C:\Windows\System\gGhgYNP.exe
  2⤵
  PID:9152
- C:\Windows\System\rieUrNg.exe
  C:\Windows\System\rieUrNg.exe
  2⤵
  PID:6564
- C:\Windows\System\zQftMPG.exe
  C:\Windows\System\zQftMPG.exe
  2⤵
  PID:8208
- C:\Windows\System\sHRtyku.exe
  C:\Windows\System\sHRtyku.exe
  2⤵
  PID:8348
- C:\Windows\System\PMAsjlQ.exe
  C:\Windows\System\PMAsjlQ.exe
  2⤵
  PID:8376
- C:\Windows\System\vZGsvRf.exe
  C:\Windows\System\vZGsvRf.exe
  2⤵
  PID:8464
- C:\Windows\System\oPMeIFe.exe
  C:\Windows\System\oPMeIFe.exe
  2⤵
  PID:8448
- C:\Windows\System\fEnAXFg.exe
  C:\Windows\System\fEnAXFg.exe
  2⤵
  PID:8528
- C:\Windows\System\PYBnPbc.exe
  C:\Windows\System\PYBnPbc.exe
  2⤵
  PID:8512
- C:\Windows\System\FJRExjZ.exe
  C:\Windows\System\FJRExjZ.exe
  2⤵
  PID:8640
- C:\Windows\System\JRxehpI.exe
  C:\Windows\System\JRxehpI.exe
  2⤵
  PID:8844
- C:\Windows\System\pUDPnhx.exe
  C:\Windows\System\pUDPnhx.exe
  2⤵
  PID:8704
- C:\Windows\System\HbvVUVY.exe
  C:\Windows\System\HbvVUVY.exe
  2⤵
  PID:8780
- C:\Windows\System\bdZzIlM.exe
  C:\Windows\System\bdZzIlM.exe
  2⤵
  PID:9012
- C:\Windows\System\svLdcfb.exe
  C:\Windows\System\svLdcfb.exe
  2⤵
  PID:9076
- C:\Windows\System\AEnvVkU.exe
  C:\Windows\System\AEnvVkU.exe
  2⤵
  PID:9184
- C:\Windows\System\XtUxPPm.exe
  C:\Windows\System\XtUxPPm.exe
  2⤵
  PID:8224
- C:\Windows\System\ZxvoJuA.exe
  C:\Windows\System\ZxvoJuA.exe
  2⤵
  PID:7508
- C:\Windows\System\jXCYLLs.exe
  C:\Windows\System\jXCYLLs.exe
  2⤵
  PID:9120
- C:\Windows\System\jHsmrJh.exe
  C:\Windows\System\jHsmrJh.exe
  2⤵
  PID:8228
- C:\Windows\System\BCiHIHz.exe
  C:\Windows\System\BCiHIHz.exe
  2⤵
  PID:8576
- C:\Windows\System\khgAgTS.exe
  C:\Windows\System\khgAgTS.exe
  2⤵
  PID:8592
- C:\Windows\System\zUyEREA.exe
  C:\Windows\System\zUyEREA.exe
  2⤵
  PID:8700
- C:\Windows\System\GxpteOT.exe
  C:\Windows\System\GxpteOT.exe
  2⤵
  PID:8880
- C:\Windows\System\taoqgvN.exe
  C:\Windows\System\taoqgvN.exe
  2⤵
  PID:9204
- C:\Windows\System\kqDVAib.exe
  C:\Windows\System\kqDVAib.exe
  2⤵
  PID:8816
- C:\Windows\System\EZFmFpo.exe
  C:\Windows\System\EZFmFpo.exe
  2⤵
  PID:8992
- C:\Windows\System\xTApOJU.exe
  C:\Windows\System\xTApOJU.exe
  2⤵
  PID:7640
- C:\Windows\System\QUgpnUR.exe
  C:\Windows\System\QUgpnUR.exe
  2⤵
  PID:8620
- C:\Windows\System\IiKEAQO.exe
  C:\Windows\System\IiKEAQO.exe
  2⤵
  PID:8800
- C:\Windows\System\CFRmPGd.exe
  C:\Windows\System\CFRmPGd.exe
  2⤵
  PID:8212
- C:\Windows\System\devCcAX.exe
  C:\Windows\System\devCcAX.exe
  2⤵
  PID:8268
- C:\Windows\System\TLDnJsd.exe
  C:\Windows\System\TLDnJsd.exe
  2⤵
  PID:9224
- C:\Windows\System\lsMTbpD.exe
  C:\Windows\System\lsMTbpD.exe
  2⤵
  PID:9240
- C:\Windows\System\yiUSShC.exe
  C:\Windows\System\yiUSShC.exe
  2⤵
  PID:9260
- C:\Windows\System\hnXlrxR.exe
  C:\Windows\System\hnXlrxR.exe
  2⤵
  PID:9276
- C:\Windows\System\QOFIsAt.exe
  C:\Windows\System\QOFIsAt.exe
  2⤵
  PID:9292
- C:\Windows\System\APgUPkp.exe
  C:\Windows\System\APgUPkp.exe
  2⤵
  PID:9308
- C:\Windows\System\LJdDFLN.exe
  C:\Windows\System\LJdDFLN.exe
  2⤵
  PID:9324
- C:\Windows\System\rjCaCSx.exe
  C:\Windows\System\rjCaCSx.exe
  2⤵
  PID:9340
- C:\Windows\System\dJlRaVf.exe
  C:\Windows\System\dJlRaVf.exe
  2⤵
  PID:9356
- C:\Windows\System\aovnngu.exe
  C:\Windows\System\aovnngu.exe
  2⤵
  PID:9372
- C:\Windows\System\xzcLeTM.exe
  C:\Windows\System\xzcLeTM.exe
  2⤵
  PID:9388
- C:\Windows\System\sGeNwxB.exe
  C:\Windows\System\sGeNwxB.exe
  2⤵
  PID:9404
- C:\Windows\System\oeasXjP.exe
  C:\Windows\System\oeasXjP.exe
  2⤵
  PID:9420
- C:\Windows\System\NzeSYuU.exe
  C:\Windows\System\NzeSYuU.exe
  2⤵
  PID:9436
- C:\Windows\System\QfiQFyx.exe
  C:\Windows\System\QfiQFyx.exe
  2⤵
  PID:9452
- C:\Windows\System\QlYoIUH.exe
  C:\Windows\System\QlYoIUH.exe
  2⤵
  PID:9468
- C:\Windows\System\AHyourm.exe
  C:\Windows\System\AHyourm.exe
  2⤵
  PID:9484
- C:\Windows\System\aqTQVJg.exe
  C:\Windows\System\aqTQVJg.exe
  2⤵
  PID:9500
- C:\Windows\System\SuaVuTk.exe
  C:\Windows\System\SuaVuTk.exe
  2⤵
  PID:9516
- C:\Windows\System\bciGTir.exe
  C:\Windows\System\bciGTir.exe
  2⤵
  PID:9532
- C:\Windows\System\glIbelS.exe
  C:\Windows\System\glIbelS.exe
  2⤵
  PID:9548
- C:\Windows\System\fdxiKAK.exe
  C:\Windows\System\fdxiKAK.exe
  2⤵
  PID:9564
- C:\Windows\System\FUhIQSa.exe
  C:\Windows\System\FUhIQSa.exe
  2⤵
  PID:9580
- C:\Windows\System\TGSyvJo.exe
  C:\Windows\System\TGSyvJo.exe
  2⤵
  PID:9596
- C:\Windows\System\UmrvdMh.exe
  C:\Windows\System\UmrvdMh.exe
  2⤵
  PID:9612
- C:\Windows\System\apqpkCo.exe
  C:\Windows\System\apqpkCo.exe
  2⤵
  PID:9628
- C:\Windows\System\InZwibD.exe
  C:\Windows\System\InZwibD.exe
  2⤵
  PID:9644
- C:\Windows\System\phuOkOQ.exe
  C:\Windows\System\phuOkOQ.exe
  2⤵
  PID:9664
- C:\Windows\System\XpZIptJ.exe
  C:\Windows\System\XpZIptJ.exe
  2⤵
  PID:9680
- C:\Windows\System\UezISmh.exe
  C:\Windows\System\UezISmh.exe
  2⤵
  PID:9700
- C:\Windows\System\MJujnVj.exe
  C:\Windows\System\MJujnVj.exe
  2⤵
  PID:9716
- C:\Windows\System\njxUmOe.exe
  C:\Windows\System\njxUmOe.exe
  2⤵
  PID:9732
- C:\Windows\System\QCIbjgm.exe
  C:\Windows\System\QCIbjgm.exe
  2⤵
  PID:9748
- C:\Windows\System\eaXYLPV.exe
  C:\Windows\System\eaXYLPV.exe
  2⤵
  PID:9764
- C:\Windows\System\YFfzneQ.exe
  C:\Windows\System\YFfzneQ.exe
  2⤵
  PID:9780
- C:\Windows\System\IsSrihS.exe
  C:\Windows\System\IsSrihS.exe
  2⤵
  PID:9800
- C:\Windows\System\IrfcWgr.exe
  C:\Windows\System\IrfcWgr.exe
  2⤵
  PID:9816
- C:\Windows\System\tgGRYcA.exe
  C:\Windows\System\tgGRYcA.exe
  2⤵
  PID:9832
- C:\Windows\System\gESnwAo.exe
  C:\Windows\System\gESnwAo.exe
  2⤵
  PID:9848
- C:\Windows\System\RtUlYlR.exe
  C:\Windows\System\RtUlYlR.exe
  2⤵
  PID:9864
- C:\Windows\System\NYijhHj.exe
  C:\Windows\System\NYijhHj.exe
  2⤵
  PID:9880
- C:\Windows\System\uToGejw.exe
  C:\Windows\System\uToGejw.exe
  2⤵
  PID:9896
- C:\Windows\System\ZvFaYPw.exe
  C:\Windows\System\ZvFaYPw.exe
  2⤵
  PID:9912
- C:\Windows\System\QsONukK.exe
  C:\Windows\System\QsONukK.exe
  2⤵
  PID:9928
- C:\Windows\System\pFUecwX.exe
  C:\Windows\System\pFUecwX.exe
  2⤵
  PID:9944
- C:\Windows\System\URADpuu.exe
  C:\Windows\System\URADpuu.exe
  2⤵
  PID:9960
- C:\Windows\System\VByDMWx.exe
  C:\Windows\System\VByDMWx.exe
  2⤵
  PID:9976
- C:\Windows\System\GtXNKAQ.exe
  C:\Windows\System\GtXNKAQ.exe
  2⤵
  PID:9992
- C:\Windows\System\WJhygmC.exe
  C:\Windows\System\WJhygmC.exe
  2⤵
  PID:10008
- C:\Windows\System\UZvXBrp.exe
  C:\Windows\System\UZvXBrp.exe
  2⤵
  PID:10024
- C:\Windows\System\woGjWmm.exe
  C:\Windows\System\woGjWmm.exe
  2⤵
  PID:10040
- C:\Windows\System\sjZecoR.exe
  C:\Windows\System\sjZecoR.exe
  2⤵
  PID:10056
- C:\Windows\System\nnxmASx.exe
  C:\Windows\System\nnxmASx.exe
  2⤵
  PID:10072
- C:\Windows\System\kfsrsUU.exe
  C:\Windows\System\kfsrsUU.exe
  2⤵
  PID:10088
- C:\Windows\System\FYpOrbD.exe
  C:\Windows\System\FYpOrbD.exe
  2⤵
  PID:10104
- C:\Windows\System\WlfaGDN.exe
  C:\Windows\System\WlfaGDN.exe
  2⤵
  PID:10120
- C:\Windows\System\xeRobJZ.exe
  C:\Windows\System\xeRobJZ.exe
  2⤵
  PID:10136
- C:\Windows\System\eKzmjqO.exe
  C:\Windows\System\eKzmjqO.exe
  2⤵
  PID:10152
- C:\Windows\System\imCcSNN.exe
  C:\Windows\System\imCcSNN.exe
  2⤵
  PID:10168
- C:\Windows\System\gmngOmM.exe
  C:\Windows\System\gmngOmM.exe
  2⤵
  PID:10184
- C:\Windows\System\aKUMvnf.exe
  C:\Windows\System\aKUMvnf.exe
  2⤵
  PID:10200
- C:\Windows\System\oHOQUfe.exe
  C:\Windows\System\oHOQUfe.exe
  2⤵
  PID:10216
- C:\Windows\System\ROaBTSl.exe
  C:\Windows\System\ROaBTSl.exe
  2⤵
  PID:10232
- C:\Windows\System\NweAYPY.exe
  C:\Windows\System\NweAYPY.exe
  2⤵
  PID:8752
- C:\Windows\System\BCLewVt.exe
  C:\Windows\System\BCLewVt.exe
  2⤵
  PID:9200
- C:\Windows\System\hycKCXN.exe
  C:\Windows\System\hycKCXN.exe
  2⤵
  PID:9272
- C:\Windows\System\JPiMoQO.exe
  C:\Windows\System\JPiMoQO.exe
  2⤵
  PID:9256
- C:\Windows\System\aNvRVER.exe
  C:\Windows\System\aNvRVER.exe
  2⤵
  PID:9288
- C:\Windows\System\WPuwzwm.exe
  C:\Windows\System\WPuwzwm.exe
  2⤵
  PID:9316
- C:\Windows\System\DPPcfhO.exe
  C:\Windows\System\DPPcfhO.exe
  2⤵
  PID:9400
- C:\Windows\System\GgHcMJs.exe
  C:\Windows\System\GgHcMJs.exe
  2⤵
  PID:9464
- C:\Windows\System\fjIJiKz.exe
  C:\Windows\System\fjIJiKz.exe
  2⤵
  PID:9352
- C:\Windows\System\YvxbqPa.exe
  C:\Windows\System\YvxbqPa.exe
  2⤵
  PID:9556
- C:\Windows\System\qzZCapc.exe
  C:\Windows\System\qzZCapc.exe
  2⤵
  PID:9476
- C:\Windows\System\aijdzEk.exe
  C:\Windows\System\aijdzEk.exe
  2⤵
  PID:9508
- C:\Windows\System\GJvUDhr.exe
  C:\Windows\System\GJvUDhr.exe
  2⤵
  PID:9572
- C:\Windows\System\cezbGGX.exe
  C:\Windows\System\cezbGGX.exe
  2⤵
  PID:9620
- C:\Windows\System\VbSWhTZ.exe
  C:\Windows\System\VbSWhTZ.exe
  2⤵
  PID:9604
- C:\Windows\System\ouQTiPC.exe
  C:\Windows\System\ouQTiPC.exe
  2⤵
  PID:9660
- C:\Windows\System\vvusvpv.exe
  C:\Windows\System\vvusvpv.exe
  2⤵
  PID:9692
- C:\Windows\System\dbwyYbw.exe
  C:\Windows\System\dbwyYbw.exe
  2⤵
  PID:9708
- C:\Windows\System\vhjdcVm.exe
  C:\Windows\System\vhjdcVm.exe
  2⤵
  PID:9792
- C:\Windows\System\aCLIlch.exe
  C:\Windows\System\aCLIlch.exe
  2⤵
  PID:9856
- C:\Windows\System\JSHUjYs.exe
  C:\Windows\System\JSHUjYs.exe
  2⤵
  PID:9920
- C:\Windows\System\muJrzdY.exe
  C:\Windows\System\muJrzdY.exe
  2⤵
  PID:9956
- C:\Windows\System\PpJgUgk.exe
  C:\Windows\System\PpJgUgk.exe
  2⤵
  PID:10016
- C:\Windows\System\BCYdCZb.exe
  C:\Windows\System\BCYdCZb.exe
  2⤵
  PID:10080
- C:\Windows\System\tpRqmGf.exe
  C:\Windows\System\tpRqmGf.exe
  2⤵
  PID:10144
- C:\Windows\System\FwMfGQV.exe
  C:\Windows\System\FwMfGQV.exe
  2⤵
  PID:9808
- C:\Windows\System\bFQEUbO.exe
  C:\Windows\System\bFQEUbO.exe
  2⤵
  PID:9236
- C:\Windows\System\qaxHtSJ.exe
  C:\Windows\System\qaxHtSJ.exe
  2⤵
  PID:9268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CWkcBvP.exe

Filesize
1.6MB

MD5
2da64af43be774561c046c12d034bb55

SHA1
31fea07b4ce65b796f5feab07afdac83a9d3b89a

SHA256
2ab8fe7923ad648f4bd6d58bb0acc3c9f17788ae0f13d57cdffb6ff17e62a53b

SHA512
68d2406e62a3415a5b033fe2efdec2fcb0fedd06b6795cdfae7a0a4c8bce9f294a3f99b1ae73bc105019d4cee3364132f2fbe695dff613e4f126fd9a3a26844e

Download Submit
C:\Windows\system\DwJUjIe.exe

Filesize
1.6MB

MD5
06f9217e69bae0fbbe1e9b7f5faec7b6

SHA1
404491eed9260085dfd9507a615e8571e300abdd

SHA256
213e4ac7c5142928b39aee1055cbde9a2d9fa46da08d81a89d75adabdc39a3f3

SHA512
84b9c302225565d9ab22454a84ab9948c186cbea0f47dcddea9eae2b70d4dfd7061fdc362bafe3aaf2a34a9dfeaad3e26b8bd0bc12007c6b46185ea303a0e151

Download Submit
C:\Windows\system\FIuJGNj.exe

Filesize
1.6MB

MD5
234bb1cb29907f9f8660bbf6acd3d1e8

SHA1
eaa99dc5b5903f0dff987ffbf78d976065f1a88c

SHA256
1b68b948bb989d019b51095f18bbc8875efc6a0a3c803e5b121891e3d0f0d9d0

SHA512
7698bd3269e3b32118b8ffa50d1dbe2baa7215fee7bdd76c09ac47abdc9cf2c3d0f6896735a37e10805b422ceb0f5994328aa1af706199481372688e088c827a

Download Submit
C:\Windows\system\FgNtUON.exe

Filesize
1.6MB

MD5
ea3f853f5cf8a6d83ebedd9943a13982

SHA1
2c9ce027039f5a53743bffbe78e810a2b3baed36

SHA256
99e3252565b0c1b3d4d548798f6f3b0f3809556cc0d316a40cf3400d493c7493

SHA512
14636dbba632935bdd8d39892f38acd720973e0b911f0b14d5d480845daad170f6595b0ee8a3834d39618c69d7614fe10821180bd8fb69124321bda63da59653

Download Submit
C:\Windows\system\IWNyIOO.exe

Filesize
1.6MB

MD5
f7695ce7866ecbc6175ad352c9b427b0

SHA1
dc81aef4175d87bb89b2083a52b517b94b197aa3

SHA256
272b721829ba2c9b26ab921881ad3faf2166277b72b91713aa7b3454f032a36d

SHA512
e9b010e72e72a05ca723ac7db9567eb5080d20edd7304e0d80548aa35831102e1c397b318aa94ae0679c8e14254a42f0f54fdd99ed14a85f329cf29e091927ce

Download Submit
C:\Windows\system\IZnlHCr.exe

Filesize
1.6MB

MD5
f084aeeb2f1072e3ec426fb4ab27ecb8

SHA1
c790356b8ba34841dd72e08eac453260cadb6109

SHA256
216f4f698657440666d41304f5d4a872b29c79434f7e23e096c673f5846508da

SHA512
522484e8d5d352dd2d85247e862bc853a40239eb1073242d9449b9b79550ea830ea802e178831949a354d4f22814bea62f232c70bc549158fd6ca7acb6ac8900

Download Submit
C:\Windows\system\MDksFxl.exe

Filesize
8B

MD5
27e34d8b138784fdf905ed03cfbd7a48

SHA1
a9982e7138c6a855ea7239958475778300c40391

SHA256
21d37a3399878787c4265d73047eaa3fbc9b4670efe3c5a07b3a04ca3fdcf8bf

SHA512
c13920b965726f0af30468ff7102de0a3ecfcfdd480b4236001cf12792719e2847a0c741559de7d71679249ee891369d3be79483f72992ea2e036543a82f9995

Download Submit
C:\Windows\system\PcAIJEY.exe

Filesize
1.6MB

MD5
dc6ea5848aba2f8d77f07837f30042a6

SHA1
bda775a25aba27cb9010e066c61c033a59a30c26

SHA256
dbfce053e4e066fa0f1ee5ac099cdae62372bcabf2579aa9b1ab1ebbae14212d

SHA512
1dd2d90171811e79960884208a119f969db205e2e07eace0859ede79ce7ad7310d92d39c67763d4753db9ec4401f91481eea0ce29c35c2ce500d457ef529a254

Download Submit
C:\Windows\system\SgrIHJC.exe

Filesize
1.6MB

MD5
8914529e335eb2f2a15d2136fc01904c

SHA1
44544a710ef1dc889593bd73220409fe835d9f30

SHA256
aeb7f79f11ba1b8c7858a8b4a21b11bf3916b95264dbf5b347d691cb1d6a905e

SHA512
71d691bdd009f567a119b3a99a5770ed833b9faaf65482c48ce3db9c5cd9bcec27eca5b7bbce3bed20f71ddcd3f37ce81b676aaca913cb45da8136dc89d4e461

Download Submit
C:\Windows\system\XIxvhlX.exe

Filesize
1.6MB

MD5
92ddd7f0fa3afe44f06398bfeebb162d

SHA1
1ec21b66ebcb0c5a2284e53f581d98a9254db5a0

SHA256
251585463fdeefb17608b6643bce0089e06bc7a86b810e358b12f7440a845844

SHA512
0ce5941329eaa4eadc4f98e1c25e4be922dd54bf8926364f1fdf4c02667ebde0c24bd84fa6a35cbe9bcd844326a19aa0e9e97a53a44c4f893db0540b14cee40e

Download Submit
C:\Windows\system\ZIhIkqM.exe

Filesize
1.6MB

MD5
9d3795d1afbcafa9b67d79737214df79

SHA1
a3ebafe0598f96d3648969701c679c641e1423ad

SHA256
446d5582e4afe4bacac38ad55d3347fb4b2ae6b16187c01266c4a97366e2672b

SHA512
2301e004f46a4be1ed0008fff1a9dd3ec50d4eb379d98eef01ed7fb84461a7ad10425f362e74fd92587bdd1bea6dcbad3ddf80a5a741d988f49d6b49f29fda88

Download Submit
C:\Windows\system\cRzrrxo.exe

Filesize
1.6MB

MD5
b7b7db9101fac0e2e38e1e8e84b035ac

SHA1
2d2136751244ab2bd8537d94d761d4678074bcb8

SHA256
1b94b1d7007c56f4ad26b1b0782b2312bef34d6612bef5ed373b9bc04b06bf38

SHA512
5b39713c1ffec76a116f18dcb88dc723106b7bf1c4ae6fbf241b3740a20c66d1ab55b197aac4454fb70bc79ebfddaa94a2fbd5ff5d43cd7622ac97ff6100f059

Download Submit
C:\Windows\system\fPGLSkY.exe

Filesize
1.6MB

MD5
5a09fef06be62938bce04ac3281b1cb9

SHA1
8d253c585fb9ec2b7ed5504c37caf8c398fcdd58

SHA256
9619fcc1a035e4b0ed9b057e270361c81403368d11e69519b4dd5f45ce41c0db

SHA512
1235cef9d4f54b4c0198276b01e27fbd8e70637b0e280edb05552bcad8579ff507ba57ffeca9961d0a91924575513d2ca9711ebd44ff1097843ee38390ba3594

Download Submit
C:\Windows\system\fwdCsiv.exe

Filesize
1.6MB

MD5
d97e936ed1dfeaf90d523f64509a4b03

SHA1
69720069eede8216399c9743292be71ba9939d44

SHA256
8e038523d2f2bd21d09671c2bed72f9b62772561303f9731496a94b5520fa18f

SHA512
57e73053fd832a53d485e8c734a042db91421a8b605f987a0943ea1693a285d4990e8fe432a03daa43562ac48a444a0f509dc6a5a9705046ae28efcf785aab55

Download Submit
C:\Windows\system\gHLDewm.exe

Filesize
1.6MB

MD5
bf5767745a880f7f8ddca3e566111cb3

SHA1
d9ef915e528625e3a34be42793fee7913eeaaeb7

SHA256
8e6d88a017e6a6d2335de15b9fcc1ceb064998f6c176b196089575e01a652e7b

SHA512
21289f42cf09a227c60050ce01f97cc680c72f5fefac99aaadf9323c82f1baa7134a4c9ba5d7c018a10cbf60c7560fb6a368e69b2a33d20559eff579aaa085ad

Download Submit
C:\Windows\system\jzksSUC.exe

Filesize
1.6MB

MD5
e03ff81a7b4fbe0727682fda3bb0e1b2

SHA1
78e0b0461fb2c9a3b3d42c0f4ae4a2fe1e8baa7e

SHA256
b233bfefa3082fd6959db657d28a707e3abb1c0783d25ab0294c90ff2fc0a538

SHA512
d6b5cfade85c52afa2db1c5a1c9020c8a8e67308f5201e35bb8ae76ce73e7c15da9df3f3e7b49a393e103f0319a7b081e928163c5f9a1b691f50d1042b661ef2

Download Submit
C:\Windows\system\mdbuiim.exe

Filesize
1.6MB

MD5
b992cfcafcdd2dd4e8b77d684fd66065

SHA1
3e43d7f5e20308c6a575807ffcac2d47d3ae4ab2

SHA256
de3adc6e763d1d65cb7cc249c3c0b719d18b1155e82cb33800d7cf3651d7aa54

SHA512
6c05763c33067954afe32eaf840fd1a1a04a566febe504646c013d739accd2179c4dec105dc5746c17781dc2d536de692de9cb45ff01fc5341c80980239ee5b6

Download Submit
C:\Windows\system\oeyvizt.exe

Filesize
1.6MB

MD5
7a601d596ff65d9b59e3388f6d9ee468

SHA1
0f1264f638e508797993e28d46e9b86b4df3de2a

SHA256
9457a6c8af032a8b9d153bb456642f4a3a8802bee61b0f983577d49c38784b0e

SHA512
d5c433ac85a11e2fb91fc90c1093eb8e6c6fb048472c444ce4a2a15b470ed043d18771455af866701477c5bb42c4bff6dd2a9dc024d3d546d701ca8f5b6c0c93

Download Submit
C:\Windows\system\qEjeezj.exe

Filesize
1.6MB

MD5
b757dac35cd9c8ad58ea59939cceda2c

SHA1
05974b7851df40d0ad7a633a6bf828379cc7e617

SHA256
c81cae5b1a27ff0f020220fbbd1a108481a6466bd708cdcf697180aaf4941afd

SHA512
704a48bd3f841c90abf7300f17ff55e6177bd7f5c0d081cdf9bb6c654f478d563873c1fe6d7b42b137f3e083629eed331d4aa64bb468be0c2c19dc30291b0096

Download Submit
C:\Windows\system\rREUEYn.exe

Filesize
1.6MB

MD5
5c072100f8395750d57c6f1ef5a8cd64

SHA1
2462ea585fca09aed28d1adc382147954b29efea

SHA256
0537f6683f4c4287f2cb22aec101ca70e332d8c0674b38c53bd453effac9b5de

SHA512
f5f09b0a2a090f1e0c0a9d201ab4eff90328ecee865288650a296cd200ce15a835d926a278ff8fcf6dcf9f67d8e2c11fc086f3d29374619ab26cd1faab630af0

Download Submit
C:\Windows\system\rkEtuvf.exe

Filesize
1.6MB

MD5
e7d54ed9ac9c6f97888aa5772cc377b6

SHA1
dcc7e487ea4c84f42bf6e9ec61c4e80f30c648ed

SHA256
8e6e98612b756f665c169de0cdae0811b5632d1d0d17fd1460e16ff232166530

SHA512
f14797d303c60cd657e2d184bcb22ad875f35a7bfb727c205270d672282132c77da26cce3e7a6d325921a011d55cf7fae24b19577bc2875f653ea45ca6817586

Download Submit
C:\Windows\system\ryBJMng.exe

Filesize
1.6MB

MD5
e7d384b2fedcde2439f80ed109a5b6d2

SHA1
f2fa32c0789b28d0f3562d2606027cf0e220f29e

SHA256
64af5486cb5c6984146b60c9ab05261b276760bbb35b5315433315483f9abfc2

SHA512
0a65ac82cc112de14467364b87bd0b0f9b819e5415c9546e5c73240bdc42b79b532580ae47a0a695f4224a47602fb21f13adc5186c4816396a5947d22e24c014

Download Submit
C:\Windows\system\tbFmYrD.exe

Filesize
1.6MB

MD5
22ece5dfb0c2cec33bb13d502290a809

SHA1
716eae7d5b32847c7f515e534a2c4b5efb8ab7c7

SHA256
b0e4e8d46e29ee0a1ad6c87c43061edefca446860a9594866f3085e7d435cd82

SHA512
59ddd0ed288301e9deb712014c613200702a664bc02703c4f710c2c474844c1b97f4abaace5e291ead9fa9e565e695906488e72e3794d3ff37088d5b41660c70

Download Submit
C:\Windows\system\ttYAUYr.exe

Filesize
1.6MB

MD5
bd3d2e9d54c57da6e5c980bddb289a77

SHA1
79c89b06f95415771528a31af383d981e5ecbbbb

SHA256
2375170bd46319beffe3e57ccc0cf27af892e4868f05ac93918262edc8466f0c

SHA512
2a6cb186a6b247d5c8eb39281862fd49a188cddc69c434955852d89695e84f91549ef0a0c8c6c275e26847de424d1fd5b1a4a4f0c8429b435159282c7846770e

Download Submit
C:\Windows\system\uiXQHgS.exe

Filesize
1.6MB

MD5
16bd55ba7e51ffb3b94f90c9aefac70a

SHA1
476bfa56d5985cec4977406b92ed8238f4e2be2c

SHA256
c704820dec639c9c520d9efb3b91c591226fa6b55913e43e0af06de06921fab8

SHA512
a2724f8d8b64433d6f57fd8cc2be20f082f4a7cf3dd023c23bfc2b7ecabe92031f941b5e523a5af90f0aa3ed17f504799e2d4341e59de9614f9fbf958a8d8d5a

Download Submit
C:\Windows\system\usckLjn.exe

Filesize
1.6MB

MD5
f7c4a587e02a083f79ffd5ac266b5fb1

SHA1
76de88bed36c34979f6c56c13402e7a88f79d95c

SHA256
dce90cb504d1492e6efae675bebfbe49b8f7527707ee2e964e896a2877cc6306

SHA512
621c29e577ea23c365fccd2f78e22aa6445fb1b0f0521ec1699ee694c15df0b8bf5a664698bdd829d8e8d8c56dd9a88a72d33d2503c390cbca7e0383f5c5ebd1

Download Submit
\Windows\system\OiRHVUy.exe

Filesize
1.6MB

MD5
b16b21ac7bf243de368958c904c3df52

SHA1
9e51c2b8487d48854321af9883ec9592fce167a7

SHA256
4cc0ec059bfa53d7d1e3aad6b6218bb8d35fb35c203a1f17fac4ba68ef7078c1

SHA512
3245d451c2277a8f56c4eef9c46b5329485cde3d16db34488be260dbd5b3a83de508b3402d9feda3d08ff1f2a772abe0ad2b2f3f3a577ae808f1e5b5c8b3af45

Download Submit
\Windows\system\TeymwTW.exe

Filesize
1.6MB

MD5
6bd4e7411ad70528f0bfa58faea172e1

SHA1
91897de73a892988787cd1bc1f7520b450bc4ca0

SHA256
8e4973613b8bdae8684df12bf753199b68c2c0cd18afccea277bf65d9a3412e8

SHA512
2012da223f49b002658cfe735f0db35b63d5bad72b435501b89113709b375413610a515eccf869844213784cf993e137435e1c829084853c0fa55c67aadc899d

Download Submit
\Windows\system\WxLdgfJ.exe

Filesize
1.6MB

MD5
bc92b7453ebbf4db6ff38d3c66bae3ea

SHA1
6848809b27347414bdc7a7b15d6d16505490103d

SHA256
b85b84d3f2513b0898f9ee32b21e78d9841a212281df9d1ad48059933999b9f4

SHA512
3545bcb7b8dbd2a674a8d0c4103f48191645c83cb7206c9b0d68053d521c440ddc973d1cf8f7a2fec4792261f0029330326390e18cceaf1a4a5d196e536ffa47

Download Submit
\Windows\system\XavziBL.exe

Filesize
1.6MB

MD5
d6c56c3f6c108fbe75c323354aaf125d

SHA1
24d064cde12a8bf3ea6b337f0b448aef41aa2d92

SHA256
1b0b9f4763f2926bbcb001af4ce733eaee17d13ddce48648330c279e8ccd4c08

SHA512
4ee5776fccc848dd74e9fb69639f315acf669d6f92fea2a1fb1f96e16d0070330422d40b3a4311779d6b0feef8ea8315b9d744a42389be3b2a4e780a58abce2f

Download Submit
\Windows\system\fAnzWey.exe

Filesize
1.6MB

MD5
03cbdbb260c88b1ea1f45d733abc8292

SHA1
652912328606f8c35f9ad941950637391ca48473

SHA256
692cf98688a3c895a2814500a221f5dcfcd7abbff29769654ee54c6edd65f31c

SHA512
69938be8dac19f2dc0bbd8db26b548a11a519c75d7d4a5a9783a6ed2c90a326fc3918ee3f41717ae6a05b1e6952fef40a674be527325fcb8a22ac350551447a0

Download Submit
\Windows\system\hLaGcbm.exe

Filesize
1.6MB

MD5
3a2d35e216bad5f3344de545459185ee

SHA1
4d8cde3c9bfb143c1c660f95c4fa75d7da2a0e9c

SHA256
d9b2cb2747843f1c034d81afbe5d3ab62cb37b8320a372011daecdea682857f7

SHA512
e54d57afb3771b56a70bb3084e22acb09a6e2e08d289350d235d0540b86d84a5a7e1d69b02904ae26a3ad6b00ed116cdc558012ca870dae2de6c0c8d894c4c40

Download Submit
\Windows\system\iwVffcs.exe

Filesize
1.6MB

MD5
fbddd689a944fc9720e7874874c536aa

SHA1
b2c0dc294bb6e2531fc0bc33bec3097e0fd99072

SHA256
b1c097f5e620cca2b65b72241593f49e46cf6ed31d37d7639b47021e7f152779

SHA512
db511621ca6671315a0acfbf1b30769a767bcaca3e0d31deb97c9fdd338bdf3d634c6f3dd65a0d3b747516a9e03224232b4f5a815593313192ff5aa85a785e1e

Download Submit
\Windows\system\jmVDKih.exe

Filesize
1.6MB

MD5
d22186425f717e64db4231eb10c18a4f

SHA1
2fa67119dcd3b8453faf453f1da279beefca543c

SHA256
35f3bdd580d01c9d64e01c506eba2738b80151828d170c35ac6f7eddd4516985

SHA512
91e6b5f379351799538786dab2f7f921e148fc99cb153d953fe65867985bc88aa129083f5a63c47524d3d755815e10c372b9bcddbfed71179577a3f0c1c1972c

Download Submit
\Windows\system\kCfbkdW.exe

Filesize
1.6MB

MD5
176ed3fec21111493460c20771a401d3

SHA1
c70e89336f9d1ca7672446a8e084f08e6e08bdfd

SHA256
f14b071acac3cb6b63bab1b1bccf11363c555db3a37fbab2e663b9e3a756bd65

SHA512
855f76796307fbb4857f4f2512362516634579ed21a0fff94166c0396dec7e966823668fc426a4f0e423df597ca70412bbf38091bd19de393ae278a82eadf371

Download Submit
\Windows\system\uToJQsk.exe

Filesize
1.6MB

MD5
07c68d34a15f70ec6e845d51fc19d3cd

SHA1
91be283bbdaecddf12432b93e867d1bc23ca5b53

SHA256
ad5e871bc22eca2d44677fa4a0c90c632dc5b2a2153e008a5626794d912dd450

SHA512
10e98c7c0631fae63ec1308d73ac46bca3ae358bda449ca4e9c116ce8ad07710f2a4e638cbda40099041e60f183533afa6b9a598ed150f9c9ae474fdb4456882

Download Submit
memory/556-157-0x000000013F820000-0x000000013FC12000-memory.dmp

Filesize
3.9MB

Download
memory/556-5800-0x000000013F820000-0x000000013FC12000-memory.dmp

Filesize
3.9MB

Download
memory/580-154-0x000000013F960000-0x000000013FD52000-memory.dmp

Filesize
3.9MB

Download
memory/580-6612-0x000000013F960000-0x000000013FD52000-memory.dmp

Filesize
3.9MB

Download
memory/788-5796-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/788-149-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/2144-161-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/2144-5895-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/2360-6606-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/2360-144-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/2468-159-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Filesize
3.9MB

Download
memory/2468-6588-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Filesize
3.9MB

Download
memory/2560-136-0x000000013F2A0000-0x000000013F692000-memory.dmp

Filesize
3.9MB

Download
memory/2560-6584-0x000000013F2A0000-0x000000013F692000-memory.dmp

Filesize
3.9MB

Download
memory/2612-6585-0x000000013FC40000-0x0000000140032000-memory.dmp

Filesize
3.9MB

Download
memory/2612-140-0x000000013FC40000-0x0000000140032000-memory.dmp

Filesize
3.9MB

Download
memory/2672-142-0x000000013F670000-0x000000013FA62000-memory.dmp

Filesize
3.9MB

Download
memory/2672-5797-0x000000013F670000-0x000000013FA62000-memory.dmp

Filesize
3.9MB

Download
memory/2752-153-0x00000000035C0000-0x00000000039B2000-memory.dmp

Filesize
3.9MB

Download
memory/2752-164-0x000000013F2A0000-0x000000013F692000-memory.dmp

Filesize
3.9MB

Download
memory/2752-7641-0x000000013F6A0000-0x000000013FA92000-memory.dmp

Filesize
3.9MB

Download
memory/2752-158-0x00000000035C0000-0x00000000039B2000-memory.dmp

Filesize
3.9MB

Download
memory/2752-139-0x000000013FC40000-0x0000000140032000-memory.dmp

Filesize
3.9MB

Download
memory/2752-137-0x00000000031C0000-0x00000000035B2000-memory.dmp

Filesize
3.9MB

Download
memory/2752-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2752-163-0x000000013F1F0000-0x000000013F5E2000-memory.dmp

Filesize
3.9MB

Download
memory/2752-141-0x00000000031C0000-0x00000000035B2000-memory.dmp

Filesize
3.9MB

Download
memory/2752-0-0x000000013F6A0000-0x000000013FA92000-memory.dmp

Filesize
3.9MB

Download
memory/2752-6-0x000000013FFF0000-0x00000001403E2000-memory.dmp

Filesize
3.9MB

Download
memory/2752-145-0x00000000035C0000-0x00000000039B2000-memory.dmp

Filesize
3.9MB

Download
memory/2752-143-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/2752-156-0x00000000035C0000-0x00000000039B2000-memory.dmp

Filesize
3.9MB

Download
memory/2752-162-0x000000013F0C0000-0x000000013F4B2000-memory.dmp

Filesize
3.9MB

Download
memory/2752-160-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/2792-5740-0x000000013F4E0000-0x000000013F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/2792-138-0x000000013F4E0000-0x000000013F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/2800-15-0x000007FEF5D6E000-0x000007FEF5D6F000-memory.dmp

Filesize
4KB

Download
memory/2800-14-0x00000000027D0000-0x0000000002850000-memory.dmp

Filesize
512KB

Download
memory/2800-228-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

Filesize
2.9MB

Download
memory/2800-702-0x000007FEF5AB0000-0x000007FEF644D000-memory.dmp

Filesize
9.6MB

Download
memory/2800-230-0x0000000002790000-0x0000000002798000-memory.dmp

Filesize
32KB

Download
memory/2800-135-0x000007FEF5AB0000-0x000007FEF644D000-memory.dmp

Filesize
9.6MB

Download
memory/2824-13-0x000000013FFF0000-0x00000001403E2000-memory.dmp

Filesize
3.9MB

Download