xmrig | 6e90d14024fd2b0bb779d957d4d4e581a9e2007e71a17aa84593214d1447d7c6

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 00:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

34afd124f7553fc378fdf3316230d3a0N.exe
Size

1.6MB
MD5

34afd124f7553fc378fdf3316230d3a0
SHA1

e15c7c5f88a14fb6d0e4734d23a4d86d1d2e7957
SHA256

6e90d14024fd2b0bb779d957d4d4e581a9e2007e71a17aa84593214d1447d7c6
SHA512

ead2ca14e0716e84dc5a225deb89eb5d80c85d4ecf19c33798a121e4ab6d5a82b95f490edbe4b6c4cbe0db2bb78289d35b13c0b24ff321b6b3a94c01bbecdf11
SSDEEP

49152:Lz071uv4BPMkyW10/wKV7hjSe5CtAlM22t:NAB5

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 28 IoCs

miner

resource	yara_rule
behavioral1/memory/2144-8-0x000000013F290000-0x000000013F682000-memory.dmp	xmrig
behavioral1/memory/2864-48-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	xmrig
behavioral1/memory/2760-50-0x000000013FC40000-0x0000000140032000-memory.dmp	xmrig
behavioral1/memory/2892-61-0x000000013F710000-0x000000013FB02000-memory.dmp	xmrig
behavioral1/memory/2888-77-0x000000013FA70000-0x000000013FE62000-memory.dmp	xmrig
behavioral1/memory/2968-76-0x000000013FC60000-0x0000000140052000-memory.dmp	xmrig
behavioral1/memory/2152-235-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	xmrig
behavioral1/memory/2152-65-0x000000013FA70000-0x000000013FE62000-memory.dmp	xmrig
behavioral1/memory/1672-284-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	xmrig
behavioral1/memory/2692-315-0x000000013F930000-0x000000013FD22000-memory.dmp	xmrig
behavioral1/memory/2644-317-0x000000013FCC0000-0x00000001400B2000-memory.dmp	xmrig
behavioral1/memory/2152-295-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	xmrig
behavioral1/memory/2404-376-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	xmrig
behavioral1/memory/2924-375-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	xmrig
behavioral1/memory/1984-374-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	xmrig
behavioral1/memory/2912-372-0x000000013FD40000-0x0000000140132000-memory.dmp	xmrig
behavioral1/memory/2868-377-0x000000013F430000-0x000000013F822000-memory.dmp	xmrig
behavioral1/memory/2152-531-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	xmrig
behavioral1/memory/1868-368-0x000000013F8A0000-0x000000013FC92000-memory.dmp	xmrig
behavioral1/memory/1996-370-0x000000013F790000-0x000000013FB82000-memory.dmp	xmrig
behavioral1/memory/2300-622-0x000000013F060000-0x000000013F452000-memory.dmp	xmrig
behavioral1/memory/2864-2892-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	xmrig
behavioral1/memory/2644-3261-0x000000013FCC0000-0x00000001400B2000-memory.dmp	xmrig
behavioral1/memory/2968-3427-0x000000013FC60000-0x0000000140052000-memory.dmp	xmrig
behavioral1/memory/2912-4174-0x000000013FD40000-0x0000000140132000-memory.dmp	xmrig
behavioral1/memory/2888-4206-0x000000013FA70000-0x000000013FE62000-memory.dmp	xmrig
behavioral1/memory/2300-4991-0x000000013F060000-0x000000013F452000-memory.dmp	xmrig
behavioral1/memory/2144-5016-0x000000013F290000-0x000000013F682000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2192	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2144	mzqVPlR.exe
1672	MJioGZk.exe
2864	zVSSltE.exe
2760	yAfNEvu.exe
2892	jnkOntL.exe
2968	kmYpIux.exe
2888	EPFLgTl.exe
2644	XPMlsMy.exe
2300	IQilvMi.exe
2912	YNBnbfQ.exe
2692	DMFQBNs.exe
1868	IkRXsxD.exe
1996	DCQfBpG.exe
1984	fpERwPq.exe
2924	nnGlJts.exe
2404	ovvjhwE.exe
2868	vGNkBDm.exe
3064	tDlnqqw.exe
1544	bkfYQvg.exe
2004	bDkuUTW.exe
2452	pelcfOs.exe
2244	yfSXajV.exe
2260	mvMqYlH.exe
2468	IpxJlpY.exe
680	onZwlgK.exe
1812	nqZAoxI.exe
1552	EXPBDVB.exe
2168	iiaBPOW.exe
1712	MRJMjsP.exe
820	aGrSIcp.exe
2116	TImHIqi.exe
2572	zMbQrvb.exe
1196	gXCDnTG.exe
2392	zlwYiHj.exe
1284	CfLcCKS.exe
2208	bQtyyoR.exe
864	yTsmHMh.exe
688	djjgXaf.exe
1584	NzQfqPb.exe
2420	TmXfwHP.exe
3020	VWNzLpv.exe
2440	VAkjZtl.exe
2764	ysIGkEX.exe
1408	LLmpeXi.exe
2928	OrTmEGZ.exe
2660	wHPNwYw.exe
800	mtvaTVU.exe
1372	gxxZJEZ.exe
2724	bMFFvaZ.exe
2672	XmGPeJE.exe
624	DKzkSmF.exe
2132	VBTRFrZ.exe
1612	KKFUaup.exe
2540	JxNpOWF.exe
2528	fyTaHTF.exe
2148	aGwjbby.exe
1972	AzQUGzL.exe
2792	DTMQHpC.exe
768	nodfgyU.exe
2712	AXBRufa.exe
1592	pxdxDuo.exe
952	NVfHyOu.exe
3100	vfQxEwT.exe
3132	IqkKWZI.exe

Loads dropped DLL 64 IoCs

pid	Process
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe
2152	34afd124f7553fc378fdf3316230d3a0N.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2152-0-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/files/0x000c000000016d58-3.dat	upx
behavioral1/memory/2144-8-0x000000013F290000-0x000000013F682000-memory.dmp	upx
behavioral1/files/0x000900000001722f-9.dat	upx
behavioral1/memory/1672-14-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	upx
behavioral1/files/0x00070000000174d0-11.dat	upx
behavioral1/files/0x001000000000558f-26.dat	upx
behavioral1/files/0x000b000000016d89-30.dat	upx
behavioral1/files/0x00050000000186b7-46.dat	upx
behavioral1/memory/2864-48-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	upx
behavioral1/memory/2760-50-0x000000013FC40000-0x0000000140032000-memory.dmp	upx
behavioral1/files/0x0004000000017801-38.dat	upx
behavioral1/memory/2892-61-0x000000013F710000-0x000000013FB02000-memory.dmp	upx
behavioral1/files/0x0005000000018fb8-66.dat	upx
behavioral1/files/0x00050000000186c2-60.dat	upx
behavioral1/files/0x0005000000018fba-87.dat	upx
behavioral1/files/0x0005000000018fc1-100.dat	upx
behavioral1/files/0x0005000000018fb9-98.dat	upx
behavioral1/files/0x0007000000018b3e-96.dat	upx
behavioral1/files/0x00050000000186bb-94.dat	upx
behavioral1/memory/2912-92-0x000000013FD40000-0x0000000140132000-memory.dmp	upx
behavioral1/memory/2888-77-0x000000013FA70000-0x000000013FE62000-memory.dmp	upx
behavioral1/files/0x0005000000018fe4-122.dat	upx
behavioral1/files/0x0004000000019206-129.dat	upx
behavioral1/files/0x00040000000192ad-134.dat	upx
behavioral1/files/0x0005000000018fcd-114.dat	upx
behavioral1/memory/2968-76-0x000000013FC60000-0x0000000140052000-memory.dmp	upx
behavioral1/files/0x0004000000019438-144.dat	upx
behavioral1/memory/2152-235-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/files/0x000500000001a1ee-186.dat	upx
behavioral1/files/0x000500000001a056-178.dat	upx
behavioral1/files/0x00050000000196af-171.dat	upx
behavioral1/files/0x000500000001962f-164.dat	upx
behavioral1/files/0x0005000000019571-157.dat	upx
behavioral1/files/0x0004000000019485-150.dat	upx
behavioral1/memory/2300-73-0x000000013F060000-0x000000013F452000-memory.dmp	upx
behavioral1/memory/2644-72-0x000000013FCC0000-0x00000001400B2000-memory.dmp	upx
behavioral1/files/0x0005000000018fc2-103.dat	upx
behavioral1/memory/1672-284-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	upx
behavioral1/memory/2692-315-0x000000013F930000-0x000000013FD22000-memory.dmp	upx
behavioral1/memory/2644-317-0x000000013FCC0000-0x00000001400B2000-memory.dmp	upx
behavioral1/memory/2152-295-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/memory/2404-376-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	upx
behavioral1/memory/2924-375-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	upx
behavioral1/memory/1984-374-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	upx
behavioral1/memory/2912-372-0x000000013FD40000-0x0000000140132000-memory.dmp	upx
behavioral1/memory/2868-377-0x000000013F430000-0x000000013F822000-memory.dmp	upx
behavioral1/files/0x0005000000018fcb-107.dat	upx
behavioral1/memory/2152-531-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/files/0x0005000000019078-124.dat	upx
behavioral1/files/0x0005000000018fe2-117.dat	upx
behavioral1/files/0x0004000000019380-138.dat	upx
behavioral1/files/0x00040000000192a8-131.dat	upx
behavioral1/files/0x0004000000019461-145.dat	upx
behavioral1/files/0x00040000000194ec-152.dat	upx
behavioral1/memory/1868-368-0x000000013F8A0000-0x000000013FC92000-memory.dmp	upx
behavioral1/files/0x000500000001a1e8-180.dat	upx
behavioral1/files/0x0005000000019f50-173.dat	upx
behavioral1/files/0x000500000001966c-166.dat	upx
behavioral1/files/0x0005000000019575-159.dat	upx
behavioral1/memory/1996-370-0x000000013F790000-0x000000013FB82000-memory.dmp	upx
behavioral1/memory/2300-622-0x000000013F060000-0x000000013F452000-memory.dmp	upx
behavioral1/memory/2864-2892-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	upx
behavioral1/memory/2644-3261-0x000000013FCC0000-0x00000001400B2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\OPBYvKC.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\yPiGIaX.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\hXZkOFm.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\SUtTcyw.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\zbVORiI.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\hlkotGR.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\vgQBmot.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\PUcvedB.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\LVruENm.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\mGmLKLW.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\YxOzUhV.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\QMxqwyU.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\ELrOdMN.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\Bgnvieq.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\FVFpAzJ.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\bIcNaNs.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\XXTUqNa.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\UPBziSg.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\qnNOhZw.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\bdDXsiv.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\wxEqgzx.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\IoRamKc.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\aDBKWJj.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\FTeTijr.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\TNNgQEV.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\MAwlFsU.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\QjKcVke.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\gEGpSOe.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\MZNmbkT.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\aWBEJsW.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\wgnsyra.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\lnoUAum.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\knAKJiK.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\hVlDzev.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\dSttmCk.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\ZalTxse.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\UEkIObe.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\YnnAjBZ.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\FVBCuuZ.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\Hankyfp.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\UOUYKaZ.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\AoJjADP.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\IBPtlFx.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\LFCjabi.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\RGlHGXD.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\jMdfrpM.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\ABPuvtA.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\ugpKccQ.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\ybKJCOk.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\Qxbgcig.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\gzXfBUY.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\GuwByUC.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\XDlOCEi.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\fMxQxcV.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\ploFgGW.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\spwPwwE.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\MFIijAi.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\EanKWmw.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\KeEfvaM.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\lfANjra.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\aOWWpCm.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\VPgLmiP.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\PKHYhls.exe	34afd124f7553fc378fdf3316230d3a0N.exe
File created	C:\Windows\System\ilxxDtY.exe	34afd124f7553fc378fdf3316230d3a0N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2192	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2152	34afd124f7553fc378fdf3316230d3a0N.exe
Token: SeLockMemoryPrivilege	2152	34afd124f7553fc378fdf3316230d3a0N.exe
Token: SeDebugPrivilege	2192	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2192	2152	34afd124f7553fc378fdf3316230d3a0N.exe	30
PID 2152 wrote to memory of 2192	2152	34afd124f7553fc378fdf3316230d3a0N.exe	30
PID 2152 wrote to memory of 2192	2152	34afd124f7553fc378fdf3316230d3a0N.exe	30
PID 2152 wrote to memory of 2144	2152	34afd124f7553fc378fdf3316230d3a0N.exe	31
PID 2152 wrote to memory of 2144	2152	34afd124f7553fc378fdf3316230d3a0N.exe	31
PID 2152 wrote to memory of 2144	2152	34afd124f7553fc378fdf3316230d3a0N.exe	31
PID 2152 wrote to memory of 1672	2152	34afd124f7553fc378fdf3316230d3a0N.exe	32
PID 2152 wrote to memory of 1672	2152	34afd124f7553fc378fdf3316230d3a0N.exe	32
PID 2152 wrote to memory of 1672	2152	34afd124f7553fc378fdf3316230d3a0N.exe	32
PID 2152 wrote to memory of 2864	2152	34afd124f7553fc378fdf3316230d3a0N.exe	33
PID 2152 wrote to memory of 2864	2152	34afd124f7553fc378fdf3316230d3a0N.exe	33
PID 2152 wrote to memory of 2864	2152	34afd124f7553fc378fdf3316230d3a0N.exe	33
PID 2152 wrote to memory of 2760	2152	34afd124f7553fc378fdf3316230d3a0N.exe	34
PID 2152 wrote to memory of 2760	2152	34afd124f7553fc378fdf3316230d3a0N.exe	34
PID 2152 wrote to memory of 2760	2152	34afd124f7553fc378fdf3316230d3a0N.exe	34
PID 2152 wrote to memory of 2892	2152	34afd124f7553fc378fdf3316230d3a0N.exe	35
PID 2152 wrote to memory of 2892	2152	34afd124f7553fc378fdf3316230d3a0N.exe	35
PID 2152 wrote to memory of 2892	2152	34afd124f7553fc378fdf3316230d3a0N.exe	35
PID 2152 wrote to memory of 2888	2152	34afd124f7553fc378fdf3316230d3a0N.exe	36
PID 2152 wrote to memory of 2888	2152	34afd124f7553fc378fdf3316230d3a0N.exe	36
PID 2152 wrote to memory of 2888	2152	34afd124f7553fc378fdf3316230d3a0N.exe	36
PID 2152 wrote to memory of 2968	2152	34afd124f7553fc378fdf3316230d3a0N.exe	37
PID 2152 wrote to memory of 2968	2152	34afd124f7553fc378fdf3316230d3a0N.exe	37
PID 2152 wrote to memory of 2968	2152	34afd124f7553fc378fdf3316230d3a0N.exe	37
PID 2152 wrote to memory of 2692	2152	34afd124f7553fc378fdf3316230d3a0N.exe	38
PID 2152 wrote to memory of 2692	2152	34afd124f7553fc378fdf3316230d3a0N.exe	38
PID 2152 wrote to memory of 2692	2152	34afd124f7553fc378fdf3316230d3a0N.exe	38
PID 2152 wrote to memory of 2644	2152	34afd124f7553fc378fdf3316230d3a0N.exe	39
PID 2152 wrote to memory of 2644	2152	34afd124f7553fc378fdf3316230d3a0N.exe	39
PID 2152 wrote to memory of 2644	2152	34afd124f7553fc378fdf3316230d3a0N.exe	39
PID 2152 wrote to memory of 1868	2152	34afd124f7553fc378fdf3316230d3a0N.exe	40
PID 2152 wrote to memory of 1868	2152	34afd124f7553fc378fdf3316230d3a0N.exe	40
PID 2152 wrote to memory of 1868	2152	34afd124f7553fc378fdf3316230d3a0N.exe	40
PID 2152 wrote to memory of 2300	2152	34afd124f7553fc378fdf3316230d3a0N.exe	41
PID 2152 wrote to memory of 2300	2152	34afd124f7553fc378fdf3316230d3a0N.exe	41
PID 2152 wrote to memory of 2300	2152	34afd124f7553fc378fdf3316230d3a0N.exe	41
PID 2152 wrote to memory of 1996	2152	34afd124f7553fc378fdf3316230d3a0N.exe	42
PID 2152 wrote to memory of 1996	2152	34afd124f7553fc378fdf3316230d3a0N.exe	42
PID 2152 wrote to memory of 1996	2152	34afd124f7553fc378fdf3316230d3a0N.exe	42
PID 2152 wrote to memory of 2912	2152	34afd124f7553fc378fdf3316230d3a0N.exe	43
PID 2152 wrote to memory of 2912	2152	34afd124f7553fc378fdf3316230d3a0N.exe	43
PID 2152 wrote to memory of 2912	2152	34afd124f7553fc378fdf3316230d3a0N.exe	43
PID 2152 wrote to memory of 1984	2152	34afd124f7553fc378fdf3316230d3a0N.exe	44
PID 2152 wrote to memory of 1984	2152	34afd124f7553fc378fdf3316230d3a0N.exe	44
PID 2152 wrote to memory of 1984	2152	34afd124f7553fc378fdf3316230d3a0N.exe	44
PID 2152 wrote to memory of 2924	2152	34afd124f7553fc378fdf3316230d3a0N.exe	45
PID 2152 wrote to memory of 2924	2152	34afd124f7553fc378fdf3316230d3a0N.exe	45
PID 2152 wrote to memory of 2924	2152	34afd124f7553fc378fdf3316230d3a0N.exe	45
PID 2152 wrote to memory of 2404	2152	34afd124f7553fc378fdf3316230d3a0N.exe	46
PID 2152 wrote to memory of 2404	2152	34afd124f7553fc378fdf3316230d3a0N.exe	46
PID 2152 wrote to memory of 2404	2152	34afd124f7553fc378fdf3316230d3a0N.exe	46
PID 2152 wrote to memory of 2868	2152	34afd124f7553fc378fdf3316230d3a0N.exe	47
PID 2152 wrote to memory of 2868	2152	34afd124f7553fc378fdf3316230d3a0N.exe	47
PID 2152 wrote to memory of 2868	2152	34afd124f7553fc378fdf3316230d3a0N.exe	47
PID 2152 wrote to memory of 2984	2152	34afd124f7553fc378fdf3316230d3a0N.exe	48
PID 2152 wrote to memory of 2984	2152	34afd124f7553fc378fdf3316230d3a0N.exe	48
PID 2152 wrote to memory of 2984	2152	34afd124f7553fc378fdf3316230d3a0N.exe	48
PID 2152 wrote to memory of 3064	2152	34afd124f7553fc378fdf3316230d3a0N.exe	49
PID 2152 wrote to memory of 3064	2152	34afd124f7553fc378fdf3316230d3a0N.exe	49
PID 2152 wrote to memory of 3064	2152	34afd124f7553fc378fdf3316230d3a0N.exe	49
PID 2152 wrote to memory of 2596	2152	34afd124f7553fc378fdf3316230d3a0N.exe	50
PID 2152 wrote to memory of 2596	2152	34afd124f7553fc378fdf3316230d3a0N.exe	50
PID 2152 wrote to memory of 2596	2152	34afd124f7553fc378fdf3316230d3a0N.exe	50
PID 2152 wrote to memory of 1544	2152	34afd124f7553fc378fdf3316230d3a0N.exe	51

C:\Users\Admin\AppData\Local\Temp\34afd124f7553fc378fdf3316230d3a0N.exe
"C:\Users\Admin\AppData\Local\Temp\34afd124f7553fc378fdf3316230d3a0N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2192
- C:\Windows\System\mzqVPlR.exe
  C:\Windows\System\mzqVPlR.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\MJioGZk.exe
  C:\Windows\System\MJioGZk.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\zVSSltE.exe
  C:\Windows\System\zVSSltE.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\yAfNEvu.exe
  C:\Windows\System\yAfNEvu.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\jnkOntL.exe
  C:\Windows\System\jnkOntL.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\EPFLgTl.exe
  C:\Windows\System\EPFLgTl.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\kmYpIux.exe
  C:\Windows\System\kmYpIux.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\DMFQBNs.exe
  C:\Windows\System\DMFQBNs.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\XPMlsMy.exe
  C:\Windows\System\XPMlsMy.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\IkRXsxD.exe
  C:\Windows\System\IkRXsxD.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\IQilvMi.exe
  C:\Windows\System\IQilvMi.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\DCQfBpG.exe
  C:\Windows\System\DCQfBpG.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\YNBnbfQ.exe
  C:\Windows\System\YNBnbfQ.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\fpERwPq.exe
  C:\Windows\System\fpERwPq.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\nnGlJts.exe
  C:\Windows\System\nnGlJts.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\ovvjhwE.exe
  C:\Windows\System\ovvjhwE.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\vGNkBDm.exe
  C:\Windows\System\vGNkBDm.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\NTEBTVw.exe
  C:\Windows\System\NTEBTVw.exe
  2⤵
  PID:2984
- C:\Windows\System\tDlnqqw.exe
  C:\Windows\System\tDlnqqw.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\MJnPAkm.exe
  C:\Windows\System\MJnPAkm.exe
  2⤵
  PID:2596
- C:\Windows\System\bkfYQvg.exe
  C:\Windows\System\bkfYQvg.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\ZfKjWbr.exe
  C:\Windows\System\ZfKjWbr.exe
  2⤵
  PID:1744
- C:\Windows\System\bDkuUTW.exe
  C:\Windows\System\bDkuUTW.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\vzlmfHV.exe
  C:\Windows\System\vzlmfHV.exe
  2⤵
  PID:2448
- C:\Windows\System\pelcfOs.exe
  C:\Windows\System\pelcfOs.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\RBfdtXV.exe
  C:\Windows\System\RBfdtXV.exe
  2⤵
  PID:1016
- C:\Windows\System\yfSXajV.exe
  C:\Windows\System\yfSXajV.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\ckoXFTW.exe
  C:\Windows\System\ckoXFTW.exe
  2⤵
  PID:2284
- C:\Windows\System\mvMqYlH.exe
  C:\Windows\System\mvMqYlH.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\UKvolfh.exe
  C:\Windows\System\UKvolfh.exe
  2⤵
  PID:3024
- C:\Windows\System\IpxJlpY.exe
  C:\Windows\System\IpxJlpY.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\rufGgWp.exe
  C:\Windows\System\rufGgWp.exe
  2⤵
  PID:936
- C:\Windows\System\onZwlgK.exe
  C:\Windows\System\onZwlgK.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\SbMGKNe.exe
  C:\Windows\System\SbMGKNe.exe
  2⤵
  PID:1096
- C:\Windows\System\nqZAoxI.exe
  C:\Windows\System\nqZAoxI.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\CMQIImz.exe
  C:\Windows\System\CMQIImz.exe
  2⤵
  PID:1908
- C:\Windows\System\EXPBDVB.exe
  C:\Windows\System\EXPBDVB.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\nAsjARz.exe
  C:\Windows\System\nAsjARz.exe
  2⤵
  PID:948
- C:\Windows\System\iiaBPOW.exe
  C:\Windows\System\iiaBPOW.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\XsuHLDL.exe
  C:\Windows\System\XsuHLDL.exe
  2⤵
  PID:1820
- C:\Windows\System\MRJMjsP.exe
  C:\Windows\System\MRJMjsP.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\PSDoBVH.exe
  C:\Windows\System\PSDoBVH.exe
  2⤵
  PID:272
- C:\Windows\System\aGrSIcp.exe
  C:\Windows\System\aGrSIcp.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\OxQCyFU.exe
  C:\Windows\System\OxQCyFU.exe
  2⤵
  PID:2944
- C:\Windows\System\TImHIqi.exe
  C:\Windows\System\TImHIqi.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\uEZlzYO.exe
  C:\Windows\System\uEZlzYO.exe
  2⤵
  PID:916
- C:\Windows\System\zMbQrvb.exe
  C:\Windows\System\zMbQrvb.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\aMTFRkP.exe
  C:\Windows\System\aMTFRkP.exe
  2⤵
  PID:1616
- C:\Windows\System\gXCDnTG.exe
  C:\Windows\System\gXCDnTG.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\KBGgaZw.exe
  C:\Windows\System\KBGgaZw.exe
  2⤵
  PID:2120
- C:\Windows\System\zlwYiHj.exe
  C:\Windows\System\zlwYiHj.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\tnyExAb.exe
  C:\Windows\System\tnyExAb.exe
  2⤵
  PID:2280
- C:\Windows\System\CfLcCKS.exe
  C:\Windows\System\CfLcCKS.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\oNaUCRJ.exe
  C:\Windows\System\oNaUCRJ.exe
  2⤵
  PID:2288
- C:\Windows\System\bQtyyoR.exe
  C:\Windows\System\bQtyyoR.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\fDVexBB.exe
  C:\Windows\System\fDVexBB.exe
  2⤵
  PID:1508
- C:\Windows\System\yTsmHMh.exe
  C:\Windows\System\yTsmHMh.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\QpuqyBv.exe
  C:\Windows\System\QpuqyBv.exe
  2⤵
  PID:3044
- C:\Windows\System\djjgXaf.exe
  C:\Windows\System\djjgXaf.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\julVHtB.exe
  C:\Windows\System\julVHtB.exe
  2⤵
  PID:2332
- C:\Windows\System\NzQfqPb.exe
  C:\Windows\System\NzQfqPb.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\SWUGLNf.exe
  C:\Windows\System\SWUGLNf.exe
  2⤵
  PID:2156
- C:\Windows\System\TmXfwHP.exe
  C:\Windows\System\TmXfwHP.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\DzsFaAj.exe
  C:\Windows\System\DzsFaAj.exe
  2⤵
  PID:2732
- C:\Windows\System\VWNzLpv.exe
  C:\Windows\System\VWNzLpv.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\AWWvahY.exe
  C:\Windows\System\AWWvahY.exe
  2⤵
  PID:1688
- C:\Windows\System\VAkjZtl.exe
  C:\Windows\System\VAkjZtl.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\GfUJJeA.exe
  C:\Windows\System\GfUJJeA.exe
  2⤵
  PID:2900
- C:\Windows\System\ysIGkEX.exe
  C:\Windows\System\ysIGkEX.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\GQqclry.exe
  C:\Windows\System\GQqclry.exe
  2⤵
  PID:2684
- C:\Windows\System\LLmpeXi.exe
  C:\Windows\System\LLmpeXi.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\SUtTcyw.exe
  C:\Windows\System\SUtTcyw.exe
  2⤵
  PID:1660
- C:\Windows\System\OrTmEGZ.exe
  C:\Windows\System\OrTmEGZ.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\jCySAhP.exe
  C:\Windows\System\jCySAhP.exe
  2⤵
  PID:2624
- C:\Windows\System\wHPNwYw.exe
  C:\Windows\System\wHPNwYw.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\FKaGQci.exe
  C:\Windows\System\FKaGQci.exe
  2⤵
  PID:2304
- C:\Windows\System\mtvaTVU.exe
  C:\Windows\System\mtvaTVU.exe
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\System\bvvssvb.exe
  C:\Windows\System\bvvssvb.exe
  2⤵
  PID:944
- C:\Windows\System\gxxZJEZ.exe
  C:\Windows\System\gxxZJEZ.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\GQcQjgH.exe
  C:\Windows\System\GQcQjgH.exe
  2⤵
  PID:2432
- C:\Windows\System\bMFFvaZ.exe
  C:\Windows\System\bMFFvaZ.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\qSpdhvC.exe
  C:\Windows\System\qSpdhvC.exe
  2⤵
  PID:2188
- C:\Windows\System\XmGPeJE.exe
  C:\Windows\System\XmGPeJE.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\kurfVXS.exe
  C:\Windows\System\kurfVXS.exe
  2⤵
  PID:1352
- C:\Windows\System\DKzkSmF.exe
  C:\Windows\System\DKzkSmF.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\dAILBWV.exe
  C:\Windows\System\dAILBWV.exe
  2⤵
  PID:1848
- C:\Windows\System\VBTRFrZ.exe
  C:\Windows\System\VBTRFrZ.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\cgOKYaz.exe
  C:\Windows\System\cgOKYaz.exe
  2⤵
  PID:836
- C:\Windows\System\KKFUaup.exe
  C:\Windows\System\KKFUaup.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\DZTZMCc.exe
  C:\Windows\System\DZTZMCc.exe
  2⤵
  PID:1304
- C:\Windows\System\JxNpOWF.exe
  C:\Windows\System\JxNpOWF.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\gsPYqSc.exe
  C:\Windows\System\gsPYqSc.exe
  2⤵
  PID:3032
- C:\Windows\System\fyTaHTF.exe
  C:\Windows\System\fyTaHTF.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\PFzvsad.exe
  C:\Windows\System\PFzvsad.exe
  2⤵
  PID:824
- C:\Windows\System\aGwjbby.exe
  C:\Windows\System\aGwjbby.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\SVojoVQ.exe
  C:\Windows\System\SVojoVQ.exe
  2⤵
  PID:2816
- C:\Windows\System\AzQUGzL.exe
  C:\Windows\System\AzQUGzL.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\zKRQERz.exe
  C:\Windows\System\zKRQERz.exe
  2⤵
  PID:2728
- C:\Windows\System\DTMQHpC.exe
  C:\Windows\System\DTMQHpC.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\DEQinDE.exe
  C:\Windows\System\DEQinDE.exe
  2⤵
  PID:236
- C:\Windows\System\nodfgyU.exe
  C:\Windows\System\nodfgyU.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\hvAyjvo.exe
  C:\Windows\System\hvAyjvo.exe
  2⤵
  PID:1988
- C:\Windows\System\AXBRufa.exe
  C:\Windows\System\AXBRufa.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\cajhxEA.exe
  C:\Windows\System\cajhxEA.exe
  2⤵
  PID:2532
- C:\Windows\System\pxdxDuo.exe
  C:\Windows\System\pxdxDuo.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\SIDUxnG.exe
  C:\Windows\System\SIDUxnG.exe
  2⤵
  PID:2536
- C:\Windows\System\NVfHyOu.exe
  C:\Windows\System\NVfHyOu.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\qNXlxUy.exe
  C:\Windows\System\qNXlxUy.exe
  2⤵
  PID:3084
- C:\Windows\System\vfQxEwT.exe
  C:\Windows\System\vfQxEwT.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\WOdhrZl.exe
  C:\Windows\System\WOdhrZl.exe
  2⤵
  PID:3116
- C:\Windows\System\IqkKWZI.exe
  C:\Windows\System\IqkKWZI.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\LGmHwJp.exe
  C:\Windows\System\LGmHwJp.exe
  2⤵
  PID:3148
- C:\Windows\System\VuFBrAh.exe
  C:\Windows\System\VuFBrAh.exe
  2⤵
  PID:3164
- C:\Windows\System\FazHfOP.exe
  C:\Windows\System\FazHfOP.exe
  2⤵
  PID:3180
- C:\Windows\System\KmivJWw.exe
  C:\Windows\System\KmivJWw.exe
  2⤵
  PID:3196
- C:\Windows\System\RdFCQFw.exe
  C:\Windows\System\RdFCQFw.exe
  2⤵
  PID:3212
- C:\Windows\System\RWhxYPm.exe
  C:\Windows\System\RWhxYPm.exe
  2⤵
  PID:3228
- C:\Windows\System\wcvZDWL.exe
  C:\Windows\System\wcvZDWL.exe
  2⤵
  PID:3244
- C:\Windows\System\AaCxrov.exe
  C:\Windows\System\AaCxrov.exe
  2⤵
  PID:3260
- C:\Windows\System\tLPxZTU.exe
  C:\Windows\System\tLPxZTU.exe
  2⤵
  PID:3276
- C:\Windows\System\qLhaVtg.exe
  C:\Windows\System\qLhaVtg.exe
  2⤵
  PID:3292
- C:\Windows\System\yyncaFE.exe
  C:\Windows\System\yyncaFE.exe
  2⤵
  PID:3308
- C:\Windows\System\GKVrUKG.exe
  C:\Windows\System\GKVrUKG.exe
  2⤵
  PID:3336
- C:\Windows\System\GGaOUIF.exe
  C:\Windows\System\GGaOUIF.exe
  2⤵
  PID:3372
- C:\Windows\System\wssesyW.exe
  C:\Windows\System\wssesyW.exe
  2⤵
  PID:3388
- C:\Windows\System\PxWIBgd.exe
  C:\Windows\System\PxWIBgd.exe
  2⤵
  PID:3404
- C:\Windows\System\mYNEYjt.exe
  C:\Windows\System\mYNEYjt.exe
  2⤵
  PID:3420
- C:\Windows\System\dLjnztm.exe
  C:\Windows\System\dLjnztm.exe
  2⤵
  PID:3436
- C:\Windows\System\uDfdHGZ.exe
  C:\Windows\System\uDfdHGZ.exe
  2⤵
  PID:3452
- C:\Windows\System\HnbZrBv.exe
  C:\Windows\System\HnbZrBv.exe
  2⤵
  PID:3468
- C:\Windows\System\iYLSXVE.exe
  C:\Windows\System\iYLSXVE.exe
  2⤵
  PID:3484
- C:\Windows\System\ctUJeed.exe
  C:\Windows\System\ctUJeed.exe
  2⤵
  PID:3500
- C:\Windows\System\AmFFibO.exe
  C:\Windows\System\AmFFibO.exe
  2⤵
  PID:3516
- C:\Windows\System\VxFqhdP.exe
  C:\Windows\System\VxFqhdP.exe
  2⤵
  PID:3532
- C:\Windows\System\cIutxsE.exe
  C:\Windows\System\cIutxsE.exe
  2⤵
  PID:3548
- C:\Windows\System\UImVxbz.exe
  C:\Windows\System\UImVxbz.exe
  2⤵
  PID:3564
- C:\Windows\System\KWovkQY.exe
  C:\Windows\System\KWovkQY.exe
  2⤵
  PID:3580
- C:\Windows\System\qIUDJhG.exe
  C:\Windows\System\qIUDJhG.exe
  2⤵
  PID:3596
- C:\Windows\System\KXRQHvg.exe
  C:\Windows\System\KXRQHvg.exe
  2⤵
  PID:3612
- C:\Windows\System\rlagKdi.exe
  C:\Windows\System\rlagKdi.exe
  2⤵
  PID:3628
- C:\Windows\System\JHKPOXP.exe
  C:\Windows\System\JHKPOXP.exe
  2⤵
  PID:3644
- C:\Windows\System\ZRgHYol.exe
  C:\Windows\System\ZRgHYol.exe
  2⤵
  PID:3660
- C:\Windows\System\vdKSZFC.exe
  C:\Windows\System\vdKSZFC.exe
  2⤵
  PID:3676
- C:\Windows\System\TPBvkKB.exe
  C:\Windows\System\TPBvkKB.exe
  2⤵
  PID:3692
- C:\Windows\System\idopdCw.exe
  C:\Windows\System\idopdCw.exe
  2⤵
  PID:3708
- C:\Windows\System\LaXqQTa.exe
  C:\Windows\System\LaXqQTa.exe
  2⤵
  PID:3724
- C:\Windows\System\FmpUAAz.exe
  C:\Windows\System\FmpUAAz.exe
  2⤵
  PID:3740
- C:\Windows\System\RGlHGXD.exe
  C:\Windows\System\RGlHGXD.exe
  2⤵
  PID:3756
- C:\Windows\System\WpcuNok.exe
  C:\Windows\System\WpcuNok.exe
  2⤵
  PID:3772
- C:\Windows\System\epcybCw.exe
  C:\Windows\System\epcybCw.exe
  2⤵
  PID:3788
- C:\Windows\System\xLhgvYG.exe
  C:\Windows\System\xLhgvYG.exe
  2⤵
  PID:3804
- C:\Windows\System\kbsgUjv.exe
  C:\Windows\System\kbsgUjv.exe
  2⤵
  PID:3820
- C:\Windows\System\deMIYQu.exe
  C:\Windows\System\deMIYQu.exe
  2⤵
  PID:3836
- C:\Windows\System\NDzsZTp.exe
  C:\Windows\System\NDzsZTp.exe
  2⤵
  PID:3852
- C:\Windows\System\GNulJHE.exe
  C:\Windows\System\GNulJHE.exe
  2⤵
  PID:3868
- C:\Windows\System\lMdyUZP.exe
  C:\Windows\System\lMdyUZP.exe
  2⤵
  PID:3884
- C:\Windows\System\PhGAwFO.exe
  C:\Windows\System\PhGAwFO.exe
  2⤵
  PID:3900
- C:\Windows\System\vfChKDB.exe
  C:\Windows\System\vfChKDB.exe
  2⤵
  PID:3916
- C:\Windows\System\CCKmtxE.exe
  C:\Windows\System\CCKmtxE.exe
  2⤵
  PID:3932
- C:\Windows\System\FpaVaDH.exe
  C:\Windows\System\FpaVaDH.exe
  2⤵
  PID:3952
- C:\Windows\System\uyCokLq.exe
  C:\Windows\System\uyCokLq.exe
  2⤵
  PID:3968
- C:\Windows\System\MqutoYL.exe
  C:\Windows\System\MqutoYL.exe
  2⤵
  PID:3984
- C:\Windows\System\PpnWUBy.exe
  C:\Windows\System\PpnWUBy.exe
  2⤵
  PID:4000
- C:\Windows\System\pYTgSRT.exe
  C:\Windows\System\pYTgSRT.exe
  2⤵
  PID:4016
- C:\Windows\System\xjcfjuK.exe
  C:\Windows\System\xjcfjuK.exe
  2⤵
  PID:4032
- C:\Windows\System\GCHWRDy.exe
  C:\Windows\System\GCHWRDy.exe
  2⤵
  PID:4048
- C:\Windows\System\EratIla.exe
  C:\Windows\System\EratIla.exe
  2⤵
  PID:4064
- C:\Windows\System\ARoioIY.exe
  C:\Windows\System\ARoioIY.exe
  2⤵
  PID:4080
- C:\Windows\System\JsXmyVB.exe
  C:\Windows\System\JsXmyVB.exe
  2⤵
  PID:3076
- C:\Windows\System\NLDvfkM.exe
  C:\Windows\System\NLDvfkM.exe
  2⤵
  PID:1860
- C:\Windows\System\MuHfyPx.exe
  C:\Windows\System\MuHfyPx.exe
  2⤵
  PID:2916
- C:\Windows\System\QPZbbNl.exe
  C:\Windows\System\QPZbbNl.exe
  2⤵
  PID:3176
- C:\Windows\System\nzrJptD.exe
  C:\Windows\System\nzrJptD.exe
  2⤵
  PID:3240
- C:\Windows\System\aDkYiSO.exe
  C:\Windows\System\aDkYiSO.exe
  2⤵
  PID:3304
- C:\Windows\System\YAVtrMS.exe
  C:\Windows\System\YAVtrMS.exe
  2⤵
  PID:3400
- C:\Windows\System\hCyvFpn.exe
  C:\Windows\System\hCyvFpn.exe
  2⤵
  PID:3464
- C:\Windows\System\thkYqTN.exe
  C:\Windows\System\thkYqTN.exe
  2⤵
  PID:3524
- C:\Windows\System\YININud.exe
  C:\Windows\System\YININud.exe
  2⤵
  PID:3588
- C:\Windows\System\KBhbWgU.exe
  C:\Windows\System\KBhbWgU.exe
  2⤵
  PID:3352
- C:\Windows\System\HjzUvYt.exe
  C:\Windows\System\HjzUvYt.exe
  2⤵
  PID:3368
- C:\Windows\System\AaQIsPg.exe
  C:\Windows\System\AaQIsPg.exe
  2⤵
  PID:1364
- C:\Windows\System\uiGLDEP.exe
  C:\Windows\System\uiGLDEP.exe
  2⤵
  PID:3720
- C:\Windows\System\LXBhgGt.exe
  C:\Windows\System\LXBhgGt.exe
  2⤵
  PID:3784
- C:\Windows\System\DkRfDEK.exe
  C:\Windows\System\DkRfDEK.exe
  2⤵
  PID:1720
- C:\Windows\System\YbpynjA.exe
  C:\Windows\System\YbpynjA.exe
  2⤵
  PID:3880
- C:\Windows\System\gUisMEx.exe
  C:\Windows\System\gUisMEx.exe
  2⤵
  PID:3944
- C:\Windows\System\YKPAMZs.exe
  C:\Windows\System\YKPAMZs.exe
  2⤵
  PID:1676
- C:\Windows\System\aWBEJsW.exe
  C:\Windows\System\aWBEJsW.exe
  2⤵
  PID:4072
- C:\Windows\System\iSDLLvY.exe
  C:\Windows\System\iSDLLvY.exe
  2⤵
  PID:1168
- C:\Windows\System\rPuyzJg.exe
  C:\Windows\System\rPuyzJg.exe
  2⤵
  PID:3300
- C:\Windows\System\HqGVsJI.exe
  C:\Windows\System\HqGVsJI.exe
  2⤵
  PID:3556
- C:\Windows\System\QbnKVIE.exe
  C:\Windows\System\QbnKVIE.exe
  2⤵
  PID:3688
- C:\Windows\System\VQQIuZf.exe
  C:\Windows\System\VQQIuZf.exe
  2⤵
  PID:3912
- C:\Windows\System\WyEgKvl.exe
  C:\Windows\System\WyEgKvl.exe
  2⤵
  PID:4040
- C:\Windows\System\MJfHygJ.exe
  C:\Windows\System\MJfHygJ.exe
  2⤵
  PID:1580
- C:\Windows\System\zimtvzI.exe
  C:\Windows\System\zimtvzI.exe
  2⤵
  PID:3948
- C:\Windows\System\dhmeRcb.exe
  C:\Windows\System\dhmeRcb.exe
  2⤵
  PID:1684
- C:\Windows\System\fBLbuzB.exe
  C:\Windows\System\fBLbuzB.exe
  2⤵
  PID:4112
- C:\Windows\System\bcZFXTX.exe
  C:\Windows\System\bcZFXTX.exe
  2⤵
  PID:4128
- C:\Windows\System\WBfYbHs.exe
  C:\Windows\System\WBfYbHs.exe
  2⤵
  PID:4152
- C:\Windows\System\QdMoDrw.exe
  C:\Windows\System\QdMoDrw.exe
  2⤵
  PID:4184
- C:\Windows\System\NQrbwEv.exe
  C:\Windows\System\NQrbwEv.exe
  2⤵
  PID:4204
- C:\Windows\System\NVEBYCe.exe
  C:\Windows\System\NVEBYCe.exe
  2⤵
  PID:4220
- C:\Windows\System\EXVKsKs.exe
  C:\Windows\System\EXVKsKs.exe
  2⤵
  PID:4236
- C:\Windows\System\PNNTKTc.exe
  C:\Windows\System\PNNTKTc.exe
  2⤵
  PID:4252
- C:\Windows\System\ZlIbjnn.exe
  C:\Windows\System\ZlIbjnn.exe
  2⤵
  PID:4268
- C:\Windows\System\bByPdCM.exe
  C:\Windows\System\bByPdCM.exe
  2⤵
  PID:4284
- C:\Windows\System\cfnAuIu.exe
  C:\Windows\System\cfnAuIu.exe
  2⤵
  PID:4300
- C:\Windows\System\CqtZWzg.exe
  C:\Windows\System\CqtZWzg.exe
  2⤵
  PID:4316
- C:\Windows\System\cPSmiKC.exe
  C:\Windows\System\cPSmiKC.exe
  2⤵
  PID:4332
- C:\Windows\System\GTokkek.exe
  C:\Windows\System\GTokkek.exe
  2⤵
  PID:4348
- C:\Windows\System\EhHYfgB.exe
  C:\Windows\System\EhHYfgB.exe
  2⤵
  PID:4364
- C:\Windows\System\RhZvSOq.exe
  C:\Windows\System\RhZvSOq.exe
  2⤵
  PID:4380
- C:\Windows\System\EcKuuWP.exe
  C:\Windows\System\EcKuuWP.exe
  2⤵
  PID:4396
- C:\Windows\System\aYdHfmy.exe
  C:\Windows\System\aYdHfmy.exe
  2⤵
  PID:4412
- C:\Windows\System\EOWUgEe.exe
  C:\Windows\System\EOWUgEe.exe
  2⤵
  PID:4428
- C:\Windows\System\mlNYCmM.exe
  C:\Windows\System\mlNYCmM.exe
  2⤵
  PID:4444
- C:\Windows\System\jyQhXot.exe
  C:\Windows\System\jyQhXot.exe
  2⤵
  PID:4460
- C:\Windows\System\QNeYRXZ.exe
  C:\Windows\System\QNeYRXZ.exe
  2⤵
  PID:4480
- C:\Windows\System\UTuLNyP.exe
  C:\Windows\System\UTuLNyP.exe
  2⤵
  PID:4496
- C:\Windows\System\Hankyfp.exe
  C:\Windows\System\Hankyfp.exe
  2⤵
  PID:4512
- C:\Windows\System\xYcwIQC.exe
  C:\Windows\System\xYcwIQC.exe
  2⤵
  PID:4528
- C:\Windows\System\oBmtbBT.exe
  C:\Windows\System\oBmtbBT.exe
  2⤵
  PID:4544
- C:\Windows\System\neASptE.exe
  C:\Windows\System\neASptE.exe
  2⤵
  PID:4560
- C:\Windows\System\RQSdJgF.exe
  C:\Windows\System\RQSdJgF.exe
  2⤵
  PID:4576
- C:\Windows\System\BXnTuKW.exe
  C:\Windows\System\BXnTuKW.exe
  2⤵
  PID:4592
- C:\Windows\System\CNDHWrB.exe
  C:\Windows\System\CNDHWrB.exe
  2⤵
  PID:4608
- C:\Windows\System\eqJzBRJ.exe
  C:\Windows\System\eqJzBRJ.exe
  2⤵
  PID:4624
- C:\Windows\System\iPrNfFP.exe
  C:\Windows\System\iPrNfFP.exe
  2⤵
  PID:4640
- C:\Windows\System\cXomXMN.exe
  C:\Windows\System\cXomXMN.exe
  2⤵
  PID:4656
- C:\Windows\System\mrmFGoT.exe
  C:\Windows\System\mrmFGoT.exe
  2⤵
  PID:4672
- C:\Windows\System\UtZoWkb.exe
  C:\Windows\System\UtZoWkb.exe
  2⤵
  PID:4688
- C:\Windows\System\SZwkhps.exe
  C:\Windows\System\SZwkhps.exe
  2⤵
  PID:4704
- C:\Windows\System\TfMYjQI.exe
  C:\Windows\System\TfMYjQI.exe
  2⤵
  PID:4720
- C:\Windows\System\KcAVTAj.exe
  C:\Windows\System\KcAVTAj.exe
  2⤵
  PID:4740
- C:\Windows\System\HpJOtHF.exe
  C:\Windows\System\HpJOtHF.exe
  2⤵
  PID:4756
- C:\Windows\System\fMqIMNC.exe
  C:\Windows\System\fMqIMNC.exe
  2⤵
  PID:4816
- C:\Windows\System\JHZcBZW.exe
  C:\Windows\System\JHZcBZW.exe
  2⤵
  PID:4832
- C:\Windows\System\tGIwtos.exe
  C:\Windows\System\tGIwtos.exe
  2⤵
  PID:4848
- C:\Windows\System\yCKqwkO.exe
  C:\Windows\System\yCKqwkO.exe
  2⤵
  PID:4864
- C:\Windows\System\FXgqpWR.exe
  C:\Windows\System\FXgqpWR.exe
  2⤵
  PID:4880
- C:\Windows\System\PUcvedB.exe
  C:\Windows\System\PUcvedB.exe
  2⤵
  PID:4896
- C:\Windows\System\FhEONNu.exe
  C:\Windows\System\FhEONNu.exe
  2⤵
  PID:4912
- C:\Windows\System\nfUqiQb.exe
  C:\Windows\System\nfUqiQb.exe
  2⤵
  PID:4928
- C:\Windows\System\HPMKaOq.exe
  C:\Windows\System\HPMKaOq.exe
  2⤵
  PID:4944
- C:\Windows\System\lfANjra.exe
  C:\Windows\System\lfANjra.exe
  2⤵
  PID:4960
- C:\Windows\System\jszEFkx.exe
  C:\Windows\System\jszEFkx.exe
  2⤵
  PID:4976
- C:\Windows\System\BSMqvkz.exe
  C:\Windows\System\BSMqvkz.exe
  2⤵
  PID:4992
- C:\Windows\System\bhofNqo.exe
  C:\Windows\System\bhofNqo.exe
  2⤵
  PID:5008
- C:\Windows\System\VIhyXeA.exe
  C:\Windows\System\VIhyXeA.exe
  2⤵
  PID:5024
- C:\Windows\System\FHzfUfN.exe
  C:\Windows\System\FHzfUfN.exe
  2⤵
  PID:5040
- C:\Windows\System\PkDZyac.exe
  C:\Windows\System\PkDZyac.exe
  2⤵
  PID:5056
- C:\Windows\System\XWoqQYA.exe
  C:\Windows\System\XWoqQYA.exe
  2⤵
  PID:5072
- C:\Windows\System\YARBlkL.exe
  C:\Windows\System\YARBlkL.exe
  2⤵
  PID:5088
- C:\Windows\System\KfqePjv.exe
  C:\Windows\System\KfqePjv.exe
  2⤵
  PID:5104
- C:\Windows\System\ChwYiLM.exe
  C:\Windows\System\ChwYiLM.exe
  2⤵
  PID:4104
- C:\Windows\System\BHfilZX.exe
  C:\Windows\System\BHfilZX.exe
  2⤵
  PID:4136
- C:\Windows\System\xCyqDlx.exe
  C:\Windows\System\xCyqDlx.exe
  2⤵
  PID:4200
- C:\Windows\System\sDUWDuB.exe
  C:\Windows\System\sDUWDuB.exe
  2⤵
  PID:4260
- C:\Windows\System\YibxsNH.exe
  C:\Windows\System\YibxsNH.exe
  2⤵
  PID:4296
- C:\Windows\System\DBAFWJX.exe
  C:\Windows\System\DBAFWJX.exe
  2⤵
  PID:4360
- C:\Windows\System\VkkBuDU.exe
  C:\Windows\System\VkkBuDU.exe
  2⤵
  PID:4424
- C:\Windows\System\IHGpkSO.exe
  C:\Windows\System\IHGpkSO.exe
  2⤵
  PID:4524
- C:\Windows\System\QMxqwyU.exe
  C:\Windows\System\QMxqwyU.exe
  2⤵
  PID:4828
- C:\Windows\System\Mayxhsd.exe
  C:\Windows\System\Mayxhsd.exe
  2⤵
  PID:4988
- C:\Windows\System\PZCFViv.exe
  C:\Windows\System\PZCFViv.exe
  2⤵
  PID:1780
- C:\Windows\System\DzzHuQc.exe
  C:\Windows\System\DzzHuQc.exe
  2⤵
  PID:2856
- C:\Windows\System\GwPJytC.exe
  C:\Windows\System\GwPJytC.exe
  2⤵
  PID:4588
- C:\Windows\System\glAEYOU.exe
  C:\Windows\System\glAEYOU.exe
  2⤵
  PID:4648
- C:\Windows\System\axryhej.exe
  C:\Windows\System\axryhej.exe
  2⤵
  PID:4684
- C:\Windows\System\NXkMsVL.exe
  C:\Windows\System\NXkMsVL.exe
  2⤵
  PID:4584
- C:\Windows\System\VEiAptl.exe
  C:\Windows\System\VEiAptl.exe
  2⤵
  PID:5016
- C:\Windows\System\rhpybJU.exe
  C:\Windows\System\rhpybJU.exe
  2⤵
  PID:4192
- C:\Windows\System\hlhVFRb.exe
  C:\Windows\System\hlhVFRb.exe
  2⤵
  PID:4144
- C:\Windows\System\yKPiBeQ.exe
  C:\Windows\System\yKPiBeQ.exe
  2⤵
  PID:1528
- C:\Windows\System\UKmcMbT.exe
  C:\Windows\System\UKmcMbT.exe
  2⤵
  PID:1244
- C:\Windows\System\bzvdFyD.exe
  C:\Windows\System\bzvdFyD.exe
  2⤵
  PID:1340
- C:\Windows\System\xbgWsQn.exe
  C:\Windows\System\xbgWsQn.exe
  2⤵
  PID:2564
- C:\Windows\System\ZnsjMxc.exe
  C:\Windows\System\ZnsjMxc.exe
  2⤵
  PID:4680
- C:\Windows\System\zPBPzMQ.exe
  C:\Windows\System\zPBPzMQ.exe
  2⤵
  PID:632
- C:\Windows\System\UPNtYGn.exe
  C:\Windows\System\UPNtYGn.exe
  2⤵
  PID:2100
- C:\Windows\System\syRRLgf.exe
  C:\Windows\System\syRRLgf.exe
  2⤵
  PID:2080
- C:\Windows\System\EPosKbZ.exe
  C:\Windows\System\EPosKbZ.exe
  2⤵
  PID:1728
- C:\Windows\System\UtBhVMX.exe
  C:\Windows\System\UtBhVMX.exe
  2⤵
  PID:2236
- C:\Windows\System\XILamfG.exe
  C:\Windows\System\XILamfG.exe
  2⤵
  PID:1804
- C:\Windows\System\plcuWzr.exe
  C:\Windows\System\plcuWzr.exe
  2⤵
  PID:3048
- C:\Windows\System\DQiYUiP.exe
  C:\Windows\System\DQiYUiP.exe
  2⤵
  PID:1808
- C:\Windows\System\IMLhSZc.exe
  C:\Windows\System\IMLhSZc.exe
  2⤵
  PID:1968
- C:\Windows\System\qpUNOHU.exe
  C:\Windows\System\qpUNOHU.exe
  2⤵
  PID:3128
- C:\Windows\System\JCaYxMM.exe
  C:\Windows\System\JCaYxMM.exe
  2⤵
  PID:3220
- C:\Windows\System\sOcFphH.exe
  C:\Windows\System\sOcFphH.exe
  2⤵
  PID:3320
- C:\Windows\System\UwdVDat.exe
  C:\Windows\System\UwdVDat.exe
  2⤵
  PID:3412
- C:\Windows\System\DTbxmIe.exe
  C:\Windows\System\DTbxmIe.exe
  2⤵
  PID:3512
- C:\Windows\System\fEEGZyU.exe
  C:\Windows\System\fEEGZyU.exe
  2⤵
  PID:3608
- C:\Windows\System\pRtZfVl.exe
  C:\Windows\System\pRtZfVl.exe
  2⤵
  PID:3704
- C:\Windows\System\LurtdPQ.exe
  C:\Windows\System\LurtdPQ.exe
  2⤵
  PID:3800
- C:\Windows\System\kCkZLiP.exe
  C:\Windows\System\kCkZLiP.exe
  2⤵
  PID:3896
- C:\Windows\System\dAVioor.exe
  C:\Windows\System\dAVioor.exe
  2⤵
  PID:4060
- C:\Windows\System\UDOMqXg.exe
  C:\Windows\System\UDOMqXg.exe
  2⤵
  PID:3236
- C:\Windows\System\UOUYKaZ.exe
  C:\Windows\System\UOUYKaZ.exe
  2⤵
  PID:3624
- C:\Windows\System\XCmANYH.exe
  C:\Windows\System\XCmANYH.exe
  2⤵
  PID:3848
- C:\Windows\System\VqRTAdQ.exe
  C:\Windows\System\VqRTAdQ.exe
  2⤵
  PID:3112
- C:\Windows\System\oamLqdT.exe
  C:\Windows\System\oamLqdT.exe
  2⤵
  PID:3816
- C:\Windows\System\bPzidiF.exe
  C:\Windows\System\bPzidiF.exe
  2⤵
  PID:3364
- C:\Windows\System\IwDJkju.exe
  C:\Windows\System\IwDJkju.exe
  2⤵
  PID:4180
- C:\Windows\System\lhkgLfQ.exe
  C:\Windows\System\lhkgLfQ.exe
  2⤵
  PID:4248
- C:\Windows\System\HuEvdCY.exe
  C:\Windows\System\HuEvdCY.exe
  2⤵
  PID:4344
- C:\Windows\System\gLbFAlZ.exe
  C:\Windows\System\gLbFAlZ.exe
  2⤵
  PID:4504
- C:\Windows\System\VZgmCMm.exe
  C:\Windows\System\VZgmCMm.exe
  2⤵
  PID:4600
- C:\Windows\System\espircj.exe
  C:\Windows\System\espircj.exe
  2⤵
  PID:4700
- C:\Windows\System\gzXfBUY.exe
  C:\Windows\System\gzXfBUY.exe
  2⤵
  PID:4796
- C:\Windows\System\LGjXIUG.exe
  C:\Windows\System\LGjXIUG.exe
  2⤵
  PID:924
- C:\Windows\System\InhXizN.exe
  C:\Windows\System\InhXizN.exe
  2⤵
  PID:2264
- C:\Windows\System\ekZWkgG.exe
  C:\Windows\System\ekZWkgG.exe
  2⤵
  PID:2860
- C:\Windows\System\GBedHYI.exe
  C:\Windows\System\GBedHYI.exe
  2⤵
  PID:1608
- C:\Windows\System\DCcPGIv.exe
  C:\Windows\System\DCcPGIv.exe
  2⤵
  PID:3056
- C:\Windows\System\FKpTjkb.exe
  C:\Windows\System\FKpTjkb.exe
  2⤵
  PID:1964
- C:\Windows\System\ewjIbvm.exe
  C:\Windows\System\ewjIbvm.exe
  2⤵
  PID:1220
- C:\Windows\System\azlfOeH.exe
  C:\Windows\System\azlfOeH.exe
  2⤵
  PID:3252
- C:\Windows\System\roVUHyH.exe
  C:\Windows\System\roVUHyH.exe
  2⤵
  PID:3476
- C:\Windows\System\nydFDmW.exe
  C:\Windows\System\nydFDmW.exe
  2⤵
  PID:3636
- C:\Windows\System\zbVORiI.exe
  C:\Windows\System\zbVORiI.exe
  2⤵
  PID:3828
- C:\Windows\System\lGFnFkg.exe
  C:\Windows\System\lGFnFkg.exe
  2⤵
  PID:3992
- C:\Windows\System\bNzWQYz.exe
  C:\Windows\System\bNzWQYz.exe
  2⤵
  PID:3140
- C:\Windows\System\AySfVhp.exe
  C:\Windows\System\AySfVhp.exe
  2⤵
  PID:4408
- C:\Windows\System\SGXHpPc.exe
  C:\Windows\System\SGXHpPc.exe
  2⤵
  PID:4340
- C:\Windows\System\ydKqaja.exe
  C:\Windows\System\ydKqaja.exe
  2⤵
  PID:4536
- C:\Windows\System\dnISBxL.exe
  C:\Windows\System\dnISBxL.exe
  2⤵
  PID:4696
- C:\Windows\System\pOjTnCG.exe
  C:\Windows\System\pOjTnCG.exe
  2⤵
  PID:4788
- C:\Windows\System\hriQTPJ.exe
  C:\Windows\System\hriQTPJ.exe
  2⤵
  PID:4872
- C:\Windows\System\kXTYSFz.exe
  C:\Windows\System\kXTYSFz.exe
  2⤵
  PID:4936
- C:\Windows\System\KVrYHgk.exe
  C:\Windows\System\KVrYHgk.exe
  2⤵
  PID:5032
- C:\Windows\System\qloMrBX.exe
  C:\Windows\System\qloMrBX.exe
  2⤵
  PID:5100
- C:\Windows\System\dPUWsLy.exe
  C:\Windows\System\dPUWsLy.exe
  2⤵
  PID:4356
- C:\Windows\System\VtRpjMK.exe
  C:\Windows\System\VtRpjMK.exe
  2⤵
  PID:4492
- C:\Windows\System\SKtdOpv.exe
  C:\Windows\System\SKtdOpv.exe
  2⤵
  PID:4892
- C:\Windows\System\fYwvLwF.exe
  C:\Windows\System\fYwvLwF.exe
  2⤵
  PID:4952
- C:\Windows\System\dAgZtDk.exe
  C:\Windows\System\dAgZtDk.exe
  2⤵
  PID:4024
- C:\Windows\System\bVzygGe.exe
  C:\Windows\System\bVzygGe.exe
  2⤵
  PID:4620
- C:\Windows\System\OPBYvKC.exe
  C:\Windows\System\OPBYvKC.exe
  2⤵
  PID:4716
- C:\Windows\System\JiamFGW.exe
  C:\Windows\System\JiamFGW.exe
  2⤵
  PID:2632
- C:\Windows\System\SVzeJTo.exe
  C:\Windows\System\SVzeJTo.exe
  2⤵
  PID:2936
- C:\Windows\System\xmGSYtK.exe
  C:\Windows\System\xmGSYtK.exe
  2⤵
  PID:2676
- C:\Windows\System\DBNbTDg.exe
  C:\Windows\System\DBNbTDg.exe
  2⤵
  PID:4800
- C:\Windows\System\PBAFtTH.exe
  C:\Windows\System\PBAFtTH.exe
  2⤵
  PID:2956
- C:\Windows\System\tLvaJac.exe
  C:\Windows\System\tLvaJac.exe
  2⤵
  PID:4784
- C:\Windows\System\ZuyCSdw.exe
  C:\Windows\System\ZuyCSdw.exe
  2⤵
  PID:2320
- C:\Windows\System\SybbFPP.exe
  C:\Windows\System\SybbFPP.exe
  2⤵
  PID:2608
- C:\Windows\System\GzViAiS.exe
  C:\Windows\System\GzViAiS.exe
  2⤵
  PID:1700
- C:\Windows\System\qATFLLx.exe
  C:\Windows\System\qATFLLx.exe
  2⤵
  PID:2108
- C:\Windows\System\gFnbdkU.exe
  C:\Windows\System\gFnbdkU.exe
  2⤵
  PID:2248
- C:\Windows\System\azzqFdq.exe
  C:\Windows\System\azzqFdq.exe
  2⤵
  PID:2308
- C:\Windows\System\ReyuKCR.exe
  C:\Windows\System\ReyuKCR.exe
  2⤵
  PID:576
- C:\Windows\System\BdxTeko.exe
  C:\Windows\System\BdxTeko.exe
  2⤵
  PID:3000
- C:\Windows\System\KndtGuv.exe
  C:\Windows\System\KndtGuv.exe
  2⤵
  PID:3188
- C:\Windows\System\HNIsZoN.exe
  C:\Windows\System\HNIsZoN.exe
  2⤵
  PID:3096
- C:\Windows\System\MhAnhpc.exe
  C:\Windows\System\MhAnhpc.exe
  2⤵
  PID:3380
- C:\Windows\System\tnWKWJE.exe
  C:\Windows\System\tnWKWJE.exe
  2⤵
  PID:3576
- C:\Windows\System\yPiGIaX.exe
  C:\Windows\System\yPiGIaX.exe
  2⤵
  PID:3964
- C:\Windows\System\yESoRZc.exe
  C:\Windows\System\yESoRZc.exe
  2⤵
  PID:3444
- C:\Windows\System\kazDVwK.exe
  C:\Windows\System\kazDVwK.exe
  2⤵
  PID:3324
- C:\Windows\System\nHIHXnR.exe
  C:\Windows\System\nHIHXnR.exe
  2⤵
  PID:4216
- C:\Windows\System\VTgWTZz.exe
  C:\Windows\System\VTgWTZz.exe
  2⤵
  PID:3752
- C:\Windows\System\vypfrSG.exe
  C:\Windows\System\vypfrSG.exe
  2⤵
  PID:3864
- C:\Windows\System\uKXfjqn.exe
  C:\Windows\System\uKXfjqn.exe
  2⤵
  PID:4440
- C:\Windows\System\vUsfOmG.exe
  C:\Windows\System\vUsfOmG.exe
  2⤵
  PID:4968
- C:\Windows\System\kdyzzzj.exe
  C:\Windows\System\kdyzzzj.exe
  2⤵
  PID:4780
- C:\Windows\System\XCVMrUy.exe
  C:\Windows\System\XCVMrUy.exe
  2⤵
  PID:2972
- C:\Windows\System\EMxTKgL.exe
  C:\Windows\System\EMxTKgL.exe
  2⤵
  PID:4312
- C:\Windows\System\PuIHzIO.exe
  C:\Windows\System\PuIHzIO.exe
  2⤵
  PID:580
- C:\Windows\System\hQFqKlv.exe
  C:\Windows\System\hQFqKlv.exe
  2⤵
  PID:692
- C:\Windows\System\zlwPivl.exe
  C:\Windows\System\zlwPivl.exe
  2⤵
  PID:3328
- C:\Windows\System\jMdfrpM.exe
  C:\Windows\System\jMdfrpM.exe
  2⤵
  PID:3572
- C:\Windows\System\NzQxGtg.exe
  C:\Windows\System\NzQxGtg.exe
  2⤵
  PID:3732
- C:\Windows\System\IZGvJIJ.exe
  C:\Windows\System\IZGvJIJ.exe
  2⤵
  PID:4664
- C:\Windows\System\UqHjzSv.exe
  C:\Windows\System\UqHjzSv.exe
  2⤵
  PID:5004
- C:\Windows\System\CEZLHAD.exe
  C:\Windows\System\CEZLHAD.exe
  2⤵
  PID:3924
- C:\Windows\System\PmxUysa.exe
  C:\Windows\System\PmxUysa.exe
  2⤵
  PID:3656
- C:\Windows\System\uxPMHEW.exe
  C:\Windows\System\uxPMHEW.exe
  2⤵
  PID:4776
- C:\Windows\System\ATzJmDy.exe
  C:\Windows\System\ATzJmDy.exe
  2⤵
  PID:1788
- C:\Windows\System\qYbCYXR.exe
  C:\Windows\System\qYbCYXR.exe
  2⤵
  PID:1072
- C:\Windows\System\evXekDb.exe
  C:\Windows\System\evXekDb.exe
  2⤵
  PID:2488
- C:\Windows\System\cWGdBnw.exe
  C:\Windows\System\cWGdBnw.exe
  2⤵
  PID:5052
- C:\Windows\System\EXzibTx.exe
  C:\Windows\System\EXzibTx.exe
  2⤵
  PID:2396
- C:\Windows\System\HQCMycj.exe
  C:\Windows\System\HQCMycj.exe
  2⤵
  PID:2508
- C:\Windows\System\ZBUTteN.exe
  C:\Windows\System\ZBUTteN.exe
  2⤵
  PID:2796
- C:\Windows\System\dKyHpQa.exe
  C:\Windows\System\dKyHpQa.exe
  2⤵
  PID:2472
- C:\Windows\System\wIhTDgH.exe
  C:\Windows\System\wIhTDgH.exe
  2⤵
  PID:552
- C:\Windows\System\VpJOCou.exe
  C:\Windows\System\VpJOCou.exe
  2⤵
  PID:3544
- C:\Windows\System\sLBVhFc.exe
  C:\Windows\System\sLBVhFc.exe
  2⤵
  PID:2980
- C:\Windows\System\aDBKWJj.exe
  C:\Windows\System\aDBKWJj.exe
  2⤵
  PID:3796
- C:\Windows\System\ysXAVKw.exe
  C:\Windows\System\ysXAVKw.exe
  2⤵
  PID:3668
- C:\Windows\System\cKDgpNE.exe
  C:\Windows\System\cKDgpNE.exe
  2⤵
  PID:3068
- C:\Windows\System\POnSrHq.exe
  C:\Windows\System\POnSrHq.exe
  2⤵
  PID:2496
- C:\Windows\System\mLUrURC.exe
  C:\Windows\System\mLUrURC.exe
  2⤵
  PID:4772
- C:\Windows\System\TUSDAtP.exe
  C:\Windows\System\TUSDAtP.exe
  2⤵
  PID:1960
- C:\Windows\System\WfNCUbU.exe
  C:\Windows\System\WfNCUbU.exe
  2⤵
  PID:4804
- C:\Windows\System\KlkqWAT.exe
  C:\Windows\System\KlkqWAT.exe
  2⤵
  PID:860
- C:\Windows\System\mCJHapK.exe
  C:\Windows\System\mCJHapK.exe
  2⤵
  PID:4168
- C:\Windows\System\ehFZhsv.exe
  C:\Windows\System\ehFZhsv.exe
  2⤵
  PID:5124
- C:\Windows\System\MqxXPwL.exe
  C:\Windows\System\MqxXPwL.exe
  2⤵
  PID:5140
- C:\Windows\System\AoJjADP.exe
  C:\Windows\System\AoJjADP.exe
  2⤵
  PID:5156
- C:\Windows\System\LSwAMiH.exe
  C:\Windows\System\LSwAMiH.exe
  2⤵
  PID:5172
- C:\Windows\System\qUmFPPx.exe
  C:\Windows\System\qUmFPPx.exe
  2⤵
  PID:5188
- C:\Windows\System\ilxxDtY.exe
  C:\Windows\System\ilxxDtY.exe
  2⤵
  PID:5208
- C:\Windows\System\umqGSvl.exe
  C:\Windows\System\umqGSvl.exe
  2⤵
  PID:5224
- C:\Windows\System\zAuekuN.exe
  C:\Windows\System\zAuekuN.exe
  2⤵
  PID:5240
- C:\Windows\System\tkluZFD.exe
  C:\Windows\System\tkluZFD.exe
  2⤵
  PID:5256
- C:\Windows\System\ZNReGyD.exe
  C:\Windows\System\ZNReGyD.exe
  2⤵
  PID:5272
- C:\Windows\System\pFWdMwM.exe
  C:\Windows\System\pFWdMwM.exe
  2⤵
  PID:5288
- C:\Windows\System\VGMbLLh.exe
  C:\Windows\System\VGMbLLh.exe
  2⤵
  PID:5304
- C:\Windows\System\yPoxxfd.exe
  C:\Windows\System\yPoxxfd.exe
  2⤵
  PID:5320
- C:\Windows\System\NPLEzNN.exe
  C:\Windows\System\NPLEzNN.exe
  2⤵
  PID:5336
- C:\Windows\System\FjxgYYQ.exe
  C:\Windows\System\FjxgYYQ.exe
  2⤵
  PID:5352
- C:\Windows\System\zGADhjx.exe
  C:\Windows\System\zGADhjx.exe
  2⤵
  PID:5368
- C:\Windows\System\TArthQv.exe
  C:\Windows\System\TArthQv.exe
  2⤵
  PID:5384
- C:\Windows\System\xVpzWbq.exe
  C:\Windows\System\xVpzWbq.exe
  2⤵
  PID:5400
- C:\Windows\System\VmYgBwD.exe
  C:\Windows\System\VmYgBwD.exe
  2⤵
  PID:5416
- C:\Windows\System\ImTEpyF.exe
  C:\Windows\System\ImTEpyF.exe
  2⤵
  PID:5432
- C:\Windows\System\YNeqTWd.exe
  C:\Windows\System\YNeqTWd.exe
  2⤵
  PID:5448
- C:\Windows\System\FkNvyGt.exe
  C:\Windows\System\FkNvyGt.exe
  2⤵
  PID:5464
- C:\Windows\System\cabygKo.exe
  C:\Windows\System\cabygKo.exe
  2⤵
  PID:5480
- C:\Windows\System\hEyDZZm.exe
  C:\Windows\System\hEyDZZm.exe
  2⤵
  PID:5496
- C:\Windows\System\poqZTWX.exe
  C:\Windows\System\poqZTWX.exe
  2⤵
  PID:5512
- C:\Windows\System\auTwXMW.exe
  C:\Windows\System\auTwXMW.exe
  2⤵
  PID:5528
- C:\Windows\System\gmHWkQd.exe
  C:\Windows\System\gmHWkQd.exe
  2⤵
  PID:5544
- C:\Windows\System\agreRzJ.exe
  C:\Windows\System\agreRzJ.exe
  2⤵
  PID:5560
- C:\Windows\System\TNeCwsI.exe
  C:\Windows\System\TNeCwsI.exe
  2⤵
  PID:5576
- C:\Windows\System\cCgEaTK.exe
  C:\Windows\System\cCgEaTK.exe
  2⤵
  PID:5592
- C:\Windows\System\aGxrfhh.exe
  C:\Windows\System\aGxrfhh.exe
  2⤵
  PID:5608
- C:\Windows\System\CAtibPz.exe
  C:\Windows\System\CAtibPz.exe
  2⤵
  PID:5624
- C:\Windows\System\TyXNKYK.exe
  C:\Windows\System\TyXNKYK.exe
  2⤵
  PID:5640
- C:\Windows\System\iICSAPp.exe
  C:\Windows\System\iICSAPp.exe
  2⤵
  PID:5656
- C:\Windows\System\JdYhMYC.exe
  C:\Windows\System\JdYhMYC.exe
  2⤵
  PID:5672
- C:\Windows\System\LPKziIi.exe
  C:\Windows\System\LPKziIi.exe
  2⤵
  PID:5688
- C:\Windows\System\wrYCTic.exe
  C:\Windows\System\wrYCTic.exe
  2⤵
  PID:5704
- C:\Windows\System\EFCDFiV.exe
  C:\Windows\System\EFCDFiV.exe
  2⤵
  PID:5720
- C:\Windows\System\lyKnBYF.exe
  C:\Windows\System\lyKnBYF.exe
  2⤵
  PID:5736
- C:\Windows\System\JfMStai.exe
  C:\Windows\System\JfMStai.exe
  2⤵
  PID:5752
- C:\Windows\System\gEwIIoM.exe
  C:\Windows\System\gEwIIoM.exe
  2⤵
  PID:5768
- C:\Windows\System\jQQAMfN.exe
  C:\Windows\System\jQQAMfN.exe
  2⤵
  PID:5784
- C:\Windows\System\XZSJSDB.exe
  C:\Windows\System\XZSJSDB.exe
  2⤵
  PID:5800
- C:\Windows\System\uZcaRjm.exe
  C:\Windows\System\uZcaRjm.exe
  2⤵
  PID:5816
- C:\Windows\System\OGNvGQp.exe
  C:\Windows\System\OGNvGQp.exe
  2⤵
  PID:5832
- C:\Windows\System\iClkqph.exe
  C:\Windows\System\iClkqph.exe
  2⤵
  PID:5848
- C:\Windows\System\UtGFMlo.exe
  C:\Windows\System\UtGFMlo.exe
  2⤵
  PID:5864
- C:\Windows\System\ntFmrBh.exe
  C:\Windows\System\ntFmrBh.exe
  2⤵
  PID:5880
- C:\Windows\System\hQxGsDh.exe
  C:\Windows\System\hQxGsDh.exe
  2⤵
  PID:5896
- C:\Windows\System\ENRXPLE.exe
  C:\Windows\System\ENRXPLE.exe
  2⤵
  PID:5912
- C:\Windows\System\esIjehR.exe
  C:\Windows\System\esIjehR.exe
  2⤵
  PID:5928
- C:\Windows\System\xvNsTHa.exe
  C:\Windows\System\xvNsTHa.exe
  2⤵
  PID:5944
- C:\Windows\System\ydaLrSU.exe
  C:\Windows\System\ydaLrSU.exe
  2⤵
  PID:5960
- C:\Windows\System\VcdLMjy.exe
  C:\Windows\System\VcdLMjy.exe
  2⤵
  PID:5976
- C:\Windows\System\MUlPbYV.exe
  C:\Windows\System\MUlPbYV.exe
  2⤵
  PID:5992
- C:\Windows\System\XXiXHoE.exe
  C:\Windows\System\XXiXHoE.exe
  2⤵
  PID:6008
- C:\Windows\System\rKHUeLM.exe
  C:\Windows\System\rKHUeLM.exe
  2⤵
  PID:6024
- C:\Windows\System\xpdiTJq.exe
  C:\Windows\System\xpdiTJq.exe
  2⤵
  PID:6040
- C:\Windows\System\oGYacCm.exe
  C:\Windows\System\oGYacCm.exe
  2⤵
  PID:6056
- C:\Windows\System\DZRonAv.exe
  C:\Windows\System\DZRonAv.exe
  2⤵
  PID:6072
- C:\Windows\System\qHseETD.exe
  C:\Windows\System\qHseETD.exe
  2⤵
  PID:6092
- C:\Windows\System\PyTOiAo.exe
  C:\Windows\System\PyTOiAo.exe
  2⤵
  PID:6108
- C:\Windows\System\UGTyjbw.exe
  C:\Windows\System\UGTyjbw.exe
  2⤵
  PID:6124
- C:\Windows\System\VKzIInP.exe
  C:\Windows\System\VKzIInP.exe
  2⤵
  PID:6140
- C:\Windows\System\OVGOiCm.exe
  C:\Windows\System\OVGOiCm.exe
  2⤵
  PID:3960
- C:\Windows\System\uvJAvCp.exe
  C:\Windows\System\uvJAvCp.exe
  2⤵
  PID:4468
- C:\Windows\System\oKGorHd.exe
  C:\Windows\System\oKGorHd.exe
  2⤵
  PID:4056
- C:\Windows\System\ejmgKsn.exe
  C:\Windows\System\ejmgKsn.exe
  2⤵
  PID:2780
- C:\Windows\System\YvpCuBp.exe
  C:\Windows\System\YvpCuBp.exe
  2⤵
  PID:2988
- C:\Windows\System\UeBWSHw.exe
  C:\Windows\System\UeBWSHw.exe
  2⤵
  PID:3672
- C:\Windows\System\nGPqrcX.exe
  C:\Windows\System\nGPqrcX.exe
  2⤵
  PID:5064
- C:\Windows\System\bqZNncw.exe
  C:\Windows\System\bqZNncw.exe
  2⤵
  PID:1636
- C:\Windows\System\AIGzIrx.exe
  C:\Windows\System\AIGzIrx.exe
  2⤵
  PID:5132
- C:\Windows\System\gVxWOhj.exe
  C:\Windows\System\gVxWOhj.exe
  2⤵
  PID:3384
- C:\Windows\System\VVdnpVC.exe
  C:\Windows\System\VVdnpVC.exe
  2⤵
  PID:2044
- C:\Windows\System\BzcJBgZ.exe
  C:\Windows\System\BzcJBgZ.exe
  2⤵
  PID:2400
- C:\Windows\System\Qevvxkj.exe
  C:\Windows\System\Qevvxkj.exe
  2⤵
  PID:1344
- C:\Windows\System\jZGdMfz.exe
  C:\Windows\System\jZGdMfz.exe
  2⤵
  PID:2736
- C:\Windows\System\ChNnlSf.exe
  C:\Windows\System\ChNnlSf.exe
  2⤵
  PID:2696
- C:\Windows\System\TinGFEu.exe
  C:\Windows\System\TinGFEu.exe
  2⤵
  PID:5168
- C:\Windows\System\kRbSbuT.exe
  C:\Windows\System\kRbSbuT.exe
  2⤵
  PID:5184
- C:\Windows\System\XIYMyAT.exe
  C:\Windows\System\XIYMyAT.exe
  2⤵
  PID:5232
- C:\Windows\System\gYYLdHE.exe
  C:\Windows\System\gYYLdHE.exe
  2⤵
  PID:5268
- C:\Windows\System\uCCAGVT.exe
  C:\Windows\System\uCCAGVT.exe
  2⤵
  PID:5236
- C:\Windows\System\TMKpIjX.exe
  C:\Windows\System\TMKpIjX.exe
  2⤵
  PID:5344
- C:\Windows\System\RpHKxeo.exe
  C:\Windows\System\RpHKxeo.exe
  2⤵
  PID:5380
- C:\Windows\System\sYXiczl.exe
  C:\Windows\System\sYXiczl.exe
  2⤵
  PID:5332
- C:\Windows\System\RcNPxAZ.exe
  C:\Windows\System\RcNPxAZ.exe
  2⤵
  PID:3980
- C:\Windows\System\vIClfiA.exe
  C:\Windows\System\vIClfiA.exe
  2⤵
  PID:5396
- C:\Windows\System\RsDmoIP.exe
  C:\Windows\System\RsDmoIP.exe
  2⤵
  PID:5492
- C:\Windows\System\prCvCpg.exe
  C:\Windows\System\prCvCpg.exe
  2⤵
  PID:5540
- C:\Windows\System\jayhhrV.exe
  C:\Windows\System\jayhhrV.exe
  2⤵
  PID:5600
- C:\Windows\System\BTQxAqm.exe
  C:\Windows\System\BTQxAqm.exe
  2⤵
  PID:5664
- C:\Windows\System\jMmHsIn.exe
  C:\Windows\System\jMmHsIn.exe
  2⤵
  PID:5428
- C:\Windows\System\nCxXVIw.exe
  C:\Windows\System\nCxXVIw.exe
  2⤵
  PID:5556
- C:\Windows\System\KNHdfnw.exe
  C:\Windows\System\KNHdfnw.exe
  2⤵
  PID:5620
- C:\Windows\System\arqQnQg.exe
  C:\Windows\System\arqQnQg.exe
  2⤵
  PID:5684
- C:\Windows\System\datxtTk.exe
  C:\Windows\System\datxtTk.exe
  2⤵
  PID:5716
- C:\Windows\System\OWqceIh.exe
  C:\Windows\System\OWqceIh.exe
  2⤵
  PID:5780
- C:\Windows\System\BHAeeCT.exe
  C:\Windows\System\BHAeeCT.exe
  2⤵
  PID:5732
- C:\Windows\System\WYPdond.exe
  C:\Windows\System\WYPdond.exe
  2⤵
  PID:5796
- C:\Windows\System\NCZpmNd.exe
  C:\Windows\System\NCZpmNd.exe
  2⤵
  PID:5860
- C:\Windows\System\XfyZIMr.exe
  C:\Windows\System\XfyZIMr.exe
  2⤵
  PID:5936
- C:\Windows\System\fUYWkJf.exe
  C:\Windows\System\fUYWkJf.exe
  2⤵
  PID:5908
- C:\Windows\System\YWFYWdW.exe
  C:\Windows\System\YWFYWdW.exe
  2⤵
  PID:6004
- C:\Windows\System\gbFZcPU.exe
  C:\Windows\System\gbFZcPU.exe
  2⤵
  PID:5984
- C:\Windows\System\vNQMkee.exe
  C:\Windows\System\vNQMkee.exe
  2⤵
  PID:5988
- C:\Windows\System\aztRkKx.exe
  C:\Windows\System\aztRkKx.exe
  2⤵
  PID:6048
- C:\Windows\System\uNalpip.exe
  C:\Windows\System\uNalpip.exe
  2⤵
  PID:6100
- C:\Windows\System\qWUriWU.exe
  C:\Windows\System\qWUriWU.exe
  2⤵
  PID:6088
- C:\Windows\System\LOvUZrZ.exe
  C:\Windows\System\LOvUZrZ.exe
  2⤵
  PID:4860
- C:\Windows\System\IqAzRAL.exe
  C:\Windows\System\IqAzRAL.exe
  2⤵
  PID:2820
- C:\Windows\System\aDlJivs.exe
  C:\Windows\System\aDlJivs.exe
  2⤵
  PID:2824
- C:\Windows\System\nJvKBnS.exe
  C:\Windows\System\nJvKBnS.exe
  2⤵
  PID:4824
- C:\Windows\System\ncwSuYY.exe
  C:\Windows\System\ncwSuYY.exe
  2⤵
  PID:3288
- C:\Windows\System\guAsCyB.exe
  C:\Windows\System\guAsCyB.exe
  2⤵
  PID:4668
- C:\Windows\System\JuuYyxF.exe
  C:\Windows\System\JuuYyxF.exe
  2⤵
  PID:4572
- C:\Windows\System\pxxTTsF.exe
  C:\Windows\System\pxxTTsF.exe
  2⤵
  PID:5136
- C:\Windows\System\hrwqSAm.exe
  C:\Windows\System\hrwqSAm.exe
  2⤵
  PID:5280
- C:\Windows\System\uXOUDFO.exe
  C:\Windows\System\uXOUDFO.exe
  2⤵
  PID:5440
- C:\Windows\System\bdDXsiv.exe
  C:\Windows\System\bdDXsiv.exe
  2⤵
  PID:5568
- C:\Windows\System\PDyIoCl.exe
  C:\Windows\System\PDyIoCl.exe
  2⤵
  PID:2848
- C:\Windows\System\pbVdLNk.exe
  C:\Windows\System\pbVdLNk.exe
  2⤵
  PID:4164
- C:\Windows\System\DgngkGz.exe
  C:\Windows\System\DgngkGz.exe
  2⤵
  PID:5312
- C:\Windows\System\KdUtYuL.exe
  C:\Windows\System\KdUtYuL.exe
  2⤵
  PID:5636
- C:\Windows\System\vylkbwu.exe
  C:\Windows\System\vylkbwu.exe
  2⤵
  PID:5616
- C:\Windows\System\UKEGYvS.exe
  C:\Windows\System\UKEGYvS.exe
  2⤵
  PID:5808
- C:\Windows\System\dVYqqOI.exe
  C:\Windows\System\dVYqqOI.exe
  2⤵
  PID:5460
- C:\Windows\System\VLbmMPo.exe
  C:\Windows\System\VLbmMPo.exe
  2⤵
  PID:5652
- C:\Windows\System\GrTtOgo.exe
  C:\Windows\System\GrTtOgo.exe
  2⤵
  PID:5872
- C:\Windows\System\LoXLpuF.exe
  C:\Windows\System\LoXLpuF.exe
  2⤵
  PID:6000
- C:\Windows\System\qqsWWpl.exe
  C:\Windows\System\qqsWWpl.exe
  2⤵
  PID:5792
- C:\Windows\System\LtvHpsO.exe
  C:\Windows\System\LtvHpsO.exe
  2⤵
  PID:6016
- C:\Windows\System\BABlHEH.exe
  C:\Windows\System\BABlHEH.exe
  2⤵
  PID:6104
- C:\Windows\System\CJXTLTS.exe
  C:\Windows\System\CJXTLTS.exe
  2⤵
  PID:6116
- C:\Windows\System\RyPVesE.exe
  C:\Windows\System\RyPVesE.exe
  2⤵
  PID:2788
- C:\Windows\System\GikdVnN.exe
  C:\Windows\System\GikdVnN.exe
  2⤵
  PID:3316
- C:\Windows\System\YjIvytx.exe
  C:\Windows\System\YjIvytx.exe
  2⤵
  PID:2656
- C:\Windows\System\hVlDzev.exe
  C:\Windows\System\hVlDzev.exe
  2⤵
  PID:2964
- C:\Windows\System\wZoWFYj.exe
  C:\Windows\System\wZoWFYj.exe
  2⤵
  PID:5248
- C:\Windows\System\rRFRgmh.exe
  C:\Windows\System\rRFRgmh.exe
  2⤵
  PID:5316
- C:\Windows\System\NThknzD.exe
  C:\Windows\System\NThknzD.exe
  2⤵
  PID:5508
- C:\Windows\System\MqwudFP.exe
  C:\Windows\System\MqwudFP.exe
  2⤵
  PID:5364
- C:\Windows\System\lJYKdhd.exe
  C:\Windows\System\lJYKdhd.exe
  2⤵
  PID:5748
- C:\Windows\System\AINayTp.exe
  C:\Windows\System\AINayTp.exe
  2⤵
  PID:5840
- C:\Windows\System\bGRdBbl.exe
  C:\Windows\System\bGRdBbl.exe
  2⤵
  PID:6068
- C:\Windows\System\nmJYHEc.exe
  C:\Windows\System\nmJYHEc.exe
  2⤵
  PID:3604
- C:\Windows\System\fnxfQbH.exe
  C:\Windows\System\fnxfQbH.exe
  2⤵
  PID:1028
- C:\Windows\System\wSVIAok.exe
  C:\Windows\System\wSVIAok.exe
  2⤵
  PID:5180
- C:\Windows\System\hSmTWVl.exe
  C:\Windows\System\hSmTWVl.exe
  2⤵
  PID:5300
- C:\Windows\System\ullKVKL.exe
  C:\Windows\System\ullKVKL.exe
  2⤵
  PID:5844
- C:\Windows\System\HzKcxNN.exe
  C:\Windows\System\HzKcxNN.exe
  2⤵
  PID:6084
- C:\Windows\System\NeeqVBM.exe
  C:\Windows\System\NeeqVBM.exe
  2⤵
  PID:5096
- C:\Windows\System\GdxkVKd.exe
  C:\Windows\System\GdxkVKd.exe
  2⤵
  PID:6120
- C:\Windows\System\iFqeStq.exe
  C:\Windows\System\iFqeStq.exe
  2⤵
  PID:5876
- C:\Windows\System\rGGFHLo.exe
  C:\Windows\System\rGGFHLo.exe
  2⤵
  PID:4520
- C:\Windows\System\kEGUcGQ.exe
  C:\Windows\System\kEGUcGQ.exe
  2⤵
  PID:6152
- C:\Windows\System\xyEQXDa.exe
  C:\Windows\System\xyEQXDa.exe
  2⤵
  PID:6168
- C:\Windows\System\CunjWUQ.exe
  C:\Windows\System\CunjWUQ.exe
  2⤵
  PID:6184
- C:\Windows\System\LivpvNd.exe
  C:\Windows\System\LivpvNd.exe
  2⤵
  PID:6200
- C:\Windows\System\GZlhWLJ.exe
  C:\Windows\System\GZlhWLJ.exe
  2⤵
  PID:6216
- C:\Windows\System\KYPgrEX.exe
  C:\Windows\System\KYPgrEX.exe
  2⤵
  PID:6232
- C:\Windows\System\vXryPbn.exe
  C:\Windows\System\vXryPbn.exe
  2⤵
  PID:6248
- C:\Windows\System\isqDRPX.exe
  C:\Windows\System\isqDRPX.exe
  2⤵
  PID:6264
- C:\Windows\System\aARkdou.exe
  C:\Windows\System\aARkdou.exe
  2⤵
  PID:6280
- C:\Windows\System\OJDusAr.exe
  C:\Windows\System\OJDusAr.exe
  2⤵
  PID:6296
- C:\Windows\System\PYNXaFy.exe
  C:\Windows\System\PYNXaFy.exe
  2⤵
  PID:6312
- C:\Windows\System\LsfGiVi.exe
  C:\Windows\System\LsfGiVi.exe
  2⤵
  PID:6328
- C:\Windows\System\gKnGaNA.exe
  C:\Windows\System\gKnGaNA.exe
  2⤵
  PID:6344
- C:\Windows\System\QxROUQI.exe
  C:\Windows\System\QxROUQI.exe
  2⤵
  PID:6360
- C:\Windows\System\OKygDwX.exe
  C:\Windows\System\OKygDwX.exe
  2⤵
  PID:6376
- C:\Windows\System\taXLdfX.exe
  C:\Windows\System\taXLdfX.exe
  2⤵
  PID:6392
- C:\Windows\System\EERvIta.exe
  C:\Windows\System\EERvIta.exe
  2⤵
  PID:6408
- C:\Windows\System\GPEZLyl.exe
  C:\Windows\System\GPEZLyl.exe
  2⤵
  PID:6424
- C:\Windows\System\AjHAxvf.exe
  C:\Windows\System\AjHAxvf.exe
  2⤵
  PID:6440
- C:\Windows\System\DqVlqgu.exe
  C:\Windows\System\DqVlqgu.exe
  2⤵
  PID:6456
- C:\Windows\System\WqAJjZK.exe
  C:\Windows\System\WqAJjZK.exe
  2⤵
  PID:6472
- C:\Windows\System\zBbtyQg.exe
  C:\Windows\System\zBbtyQg.exe
  2⤵
  PID:6488
- C:\Windows\System\ICGyahF.exe
  C:\Windows\System\ICGyahF.exe
  2⤵
  PID:6504
- C:\Windows\System\zaPKnEO.exe
  C:\Windows\System\zaPKnEO.exe
  2⤵
  PID:6520
- C:\Windows\System\aCkNEUA.exe
  C:\Windows\System\aCkNEUA.exe
  2⤵
  PID:6536
- C:\Windows\System\ofCJRwO.exe
  C:\Windows\System\ofCJRwO.exe
  2⤵
  PID:6552
- C:\Windows\System\wmqgwRU.exe
  C:\Windows\System\wmqgwRU.exe
  2⤵
  PID:6632
- C:\Windows\System\LhpVDaE.exe
  C:\Windows\System\LhpVDaE.exe
  2⤵
  PID:6648
- C:\Windows\System\XZQPlRk.exe
  C:\Windows\System\XZQPlRk.exe
  2⤵
  PID:6664
- C:\Windows\System\rcBSVUp.exe
  C:\Windows\System\rcBSVUp.exe
  2⤵
  PID:6680
- C:\Windows\System\VlolQuB.exe
  C:\Windows\System\VlolQuB.exe
  2⤵
  PID:6696
- C:\Windows\System\LMxxqfB.exe
  C:\Windows\System\LMxxqfB.exe
  2⤵
  PID:6712
- C:\Windows\System\heDUYaw.exe
  C:\Windows\System\heDUYaw.exe
  2⤵
  PID:6728
- C:\Windows\System\zMIwwzD.exe
  C:\Windows\System\zMIwwzD.exe
  2⤵
  PID:6744
- C:\Windows\System\diQKhgM.exe
  C:\Windows\System\diQKhgM.exe
  2⤵
  PID:6760
- C:\Windows\System\LkUDHjV.exe
  C:\Windows\System\LkUDHjV.exe
  2⤵
  PID:6776
- C:\Windows\System\oltonYo.exe
  C:\Windows\System\oltonYo.exe
  2⤵
  PID:6792
- C:\Windows\System\IaQHRMs.exe
  C:\Windows\System\IaQHRMs.exe
  2⤵
  PID:6808
- C:\Windows\System\pAmvEss.exe
  C:\Windows\System\pAmvEss.exe
  2⤵
  PID:6824
- C:\Windows\System\FumCnWS.exe
  C:\Windows\System\FumCnWS.exe
  2⤵
  PID:6840
- C:\Windows\System\PXgsgck.exe
  C:\Windows\System\PXgsgck.exe
  2⤵
  PID:6856
- C:\Windows\System\tbaCmZh.exe
  C:\Windows\System\tbaCmZh.exe
  2⤵
  PID:6872
- C:\Windows\System\qkBPTex.exe
  C:\Windows\System\qkBPTex.exe
  2⤵
  PID:6888
- C:\Windows\System\IBPtlFx.exe
  C:\Windows\System\IBPtlFx.exe
  2⤵
  PID:6904
- C:\Windows\System\UsmGsvU.exe
  C:\Windows\System\UsmGsvU.exe
  2⤵
  PID:6920
- C:\Windows\System\bJlAKzf.exe
  C:\Windows\System\bJlAKzf.exe
  2⤵
  PID:6936
- C:\Windows\System\orywTBS.exe
  C:\Windows\System\orywTBS.exe
  2⤵
  PID:6952
- C:\Windows\System\sVkxTTw.exe
  C:\Windows\System\sVkxTTw.exe
  2⤵
  PID:6968
- C:\Windows\System\byVvWGs.exe
  C:\Windows\System\byVvWGs.exe
  2⤵
  PID:6984
- C:\Windows\System\HDRMrLO.exe
  C:\Windows\System\HDRMrLO.exe
  2⤵
  PID:7000
- C:\Windows\System\wepVwNX.exe
  C:\Windows\System\wepVwNX.exe
  2⤵
  PID:7016
- C:\Windows\System\VXlOIPj.exe
  C:\Windows\System\VXlOIPj.exe
  2⤵
  PID:7032
- C:\Windows\System\AEbrYvK.exe
  C:\Windows\System\AEbrYvK.exe
  2⤵
  PID:7048
- C:\Windows\System\sPlyUnI.exe
  C:\Windows\System\sPlyUnI.exe
  2⤵
  PID:7064
- C:\Windows\System\yWizvhP.exe
  C:\Windows\System\yWizvhP.exe
  2⤵
  PID:7080
- C:\Windows\System\stdMMQe.exe
  C:\Windows\System\stdMMQe.exe
  2⤵
  PID:7096
- C:\Windows\System\uYLDBmv.exe
  C:\Windows\System\uYLDBmv.exe
  2⤵
  PID:7112
- C:\Windows\System\QYRJMXm.exe
  C:\Windows\System\QYRJMXm.exe
  2⤵
  PID:7128
- C:\Windows\System\mJOnkmR.exe
  C:\Windows\System\mJOnkmR.exe
  2⤵
  PID:7144
- C:\Windows\System\WtylUbq.exe
  C:\Windows\System\WtylUbq.exe
  2⤵
  PID:7164
- C:\Windows\System\rwcSIXT.exe
  C:\Windows\System\rwcSIXT.exe
  2⤵
  PID:6160
- C:\Windows\System\tGeGOZP.exe
  C:\Windows\System\tGeGOZP.exe
  2⤵
  PID:5216
- C:\Windows\System\qYzoswu.exe
  C:\Windows\System\qYzoswu.exe
  2⤵
  PID:6180
- C:\Windows\System\HvnbmyC.exe
  C:\Windows\System\HvnbmyC.exe
  2⤵
  PID:6228
- C:\Windows\System\dRSckPQ.exe
  C:\Windows\System\dRSckPQ.exe
  2⤵
  PID:6244
- C:\Windows\System\KWDIjqN.exe
  C:\Windows\System\KWDIjqN.exe
  2⤵
  PID:6292
- C:\Windows\System\mhNjWCt.exe
  C:\Windows\System\mhNjWCt.exe
  2⤵
  PID:6352
- C:\Windows\System\CWGNWcM.exe
  C:\Windows\System\CWGNWcM.exe
  2⤵
  PID:6336
- C:\Windows\System\QUasDVY.exe
  C:\Windows\System\QUasDVY.exe
  2⤵
  PID:6368
- C:\Windows\System\RsXETGf.exe
  C:\Windows\System\RsXETGf.exe
  2⤵
  PID:6372
- C:\Windows\System\bJyyhoD.exe
  C:\Windows\System\bJyyhoD.exe
  2⤵
  PID:6404
- C:\Windows\System\qTFLFvF.exe
  C:\Windows\System\qTFLFvF.exe
  2⤵
  PID:6516
- C:\Windows\System\nLJbxTr.exe
  C:\Windows\System\nLJbxTr.exe
  2⤵
  PID:6500
- C:\Windows\System\SQzULCQ.exe
  C:\Windows\System\SQzULCQ.exe
  2⤵
  PID:6624
- C:\Windows\System\MsXyMnC.exe
  C:\Windows\System\MsXyMnC.exe
  2⤵
  PID:6656
- C:\Windows\System\hHAaNet.exe
  C:\Windows\System\hHAaNet.exe
  2⤵
  PID:6676
- C:\Windows\System\cnBqDow.exe
  C:\Windows\System\cnBqDow.exe
  2⤵
  PID:6708
- C:\Windows\System\pjnnPKs.exe
  C:\Windows\System\pjnnPKs.exe
  2⤵
  PID:6724
- C:\Windows\System\NUpDsJq.exe
  C:\Windows\System\NUpDsJq.exe
  2⤵
  PID:6784
- C:\Windows\System\EqqvYof.exe
  C:\Windows\System\EqqvYof.exe
  2⤵
  PID:6816
- C:\Windows\System\QtilblM.exe
  C:\Windows\System\QtilblM.exe
  2⤵
  PID:6848
- C:\Windows\System\KFctmqJ.exe
  C:\Windows\System\KFctmqJ.exe
  2⤵
  PID:6880
- C:\Windows\System\Teurgcq.exe
  C:\Windows\System\Teurgcq.exe
  2⤵
  PID:6912
- C:\Windows\System\XCQTnxF.exe
  C:\Windows\System\XCQTnxF.exe
  2⤵
  PID:6932
- C:\Windows\System\JGRURvS.exe
  C:\Windows\System\JGRURvS.exe
  2⤵
  PID:6976
- C:\Windows\System\djeobfL.exe
  C:\Windows\System\djeobfL.exe
  2⤵
  PID:7024
- C:\Windows\System\woXQtuB.exe
  C:\Windows\System\woXQtuB.exe
  2⤵
  PID:7040
- C:\Windows\System\KynWuBi.exe
  C:\Windows\System\KynWuBi.exe
  2⤵
  PID:7060
- C:\Windows\System\VwluClu.exe
  C:\Windows\System\VwluClu.exe
  2⤵
  PID:7076
- C:\Windows\System\oawVMQJ.exe
  C:\Windows\System\oawVMQJ.exe
  2⤵
  PID:7108
- C:\Windows\System\FTeTijr.exe
  C:\Windows\System\FTeTijr.exe
  2⤵
  PID:7160
- C:\Windows\System\hjuGecv.exe
  C:\Windows\System\hjuGecv.exe
  2⤵
  PID:6164
- C:\Windows\System\WfieuXQ.exe
  C:\Windows\System\WfieuXQ.exe
  2⤵
  PID:2464
- C:\Windows\System\ZwggRfS.exe
  C:\Windows\System\ZwggRfS.exe
  2⤵
  PID:6240
- C:\Windows\System\ZJjbKHg.exe
  C:\Windows\System\ZJjbKHg.exe
  2⤵
  PID:6420
- C:\Windows\System\vRIUCgy.exe
  C:\Windows\System\vRIUCgy.exe
  2⤵
  PID:6480
- C:\Windows\System\VGUbEbC.exe
  C:\Windows\System\VGUbEbC.exe
  2⤵
  PID:6484
- C:\Windows\System\qOfPsBj.exe
  C:\Windows\System\qOfPsBj.exe
  2⤵
  PID:6644
- C:\Windows\System\IoGLCeP.exe
  C:\Windows\System\IoGLCeP.exe
  2⤵
  PID:6672
- C:\Windows\System\jJORAso.exe
  C:\Windows\System\jJORAso.exe
  2⤵
  PID:6740
- C:\Windows\System\XBDIFzn.exe
  C:\Windows\System\XBDIFzn.exe
  2⤵
  PID:6800
- C:\Windows\System\IAcYUNs.exe
  C:\Windows\System\IAcYUNs.exe
  2⤵
  PID:6944
- C:\Windows\System\oJRmxWV.exe
  C:\Windows\System\oJRmxWV.exe
  2⤵
  PID:6836
- C:\Windows\System\PLmdqVy.exe
  C:\Windows\System\PLmdqVy.exe
  2⤵
  PID:6964
- C:\Windows\System\iYUVCVi.exe
  C:\Windows\System\iYUVCVi.exe
  2⤵
  PID:7072
- C:\Windows\System\VQUSusJ.exe
  C:\Windows\System\VQUSusJ.exe
  2⤵
  PID:7124
- C:\Windows\System\kRuwfDJ.exe
  C:\Windows\System\kRuwfDJ.exe
  2⤵
  PID:6196
- C:\Windows\System\ggedDCC.exe
  C:\Windows\System\ggedDCC.exe
  2⤵
  PID:7152
- C:\Windows\System\xUNpkRp.exe
  C:\Windows\System\xUNpkRp.exe
  2⤵
  PID:6384
- C:\Windows\System\PGlhtxJ.exe
  C:\Windows\System\PGlhtxJ.exe
  2⤵
  PID:6468
- C:\Windows\System\vWbkxPA.exe
  C:\Windows\System\vWbkxPA.exe
  2⤵
  PID:6720
- C:\Windows\System\KZNWzhY.exe
  C:\Windows\System\KZNWzhY.exe
  2⤵
  PID:6772
- C:\Windows\System\RroNtiU.exe
  C:\Windows\System\RroNtiU.exe
  2⤵
  PID:6992
- C:\Windows\System\UTRbFWv.exe
  C:\Windows\System\UTRbFWv.exe
  2⤵
  PID:7088
- C:\Windows\System\dxJhYzk.exe
  C:\Windows\System\dxJhYzk.exe
  2⤵
  PID:7156
- C:\Windows\System\CsglDXH.exe
  C:\Windows\System\CsglDXH.exe
  2⤵
  PID:6432
- C:\Windows\System\jpVfyGO.exe
  C:\Windows\System\jpVfyGO.exe
  2⤵
  PID:6752
- C:\Windows\System\nbDvCsH.exe
  C:\Windows\System\nbDvCsH.exe
  2⤵
  PID:7044
- C:\Windows\System\YQAlghA.exe
  C:\Windows\System\YQAlghA.exe
  2⤵
  PID:5892
- C:\Windows\System\kdqfxBr.exe
  C:\Windows\System\kdqfxBr.exe
  2⤵
  PID:7180
- C:\Windows\System\NkvmFeS.exe
  C:\Windows\System\NkvmFeS.exe
  2⤵
  PID:7196
- C:\Windows\System\PQxOkgB.exe
  C:\Windows\System\PQxOkgB.exe
  2⤵
  PID:7212
- C:\Windows\System\zUacAGE.exe
  C:\Windows\System\zUacAGE.exe
  2⤵
  PID:7228
- C:\Windows\System\PzoGkek.exe
  C:\Windows\System\PzoGkek.exe
  2⤵
  PID:7244
- C:\Windows\System\YMujQxc.exe
  C:\Windows\System\YMujQxc.exe
  2⤵
  PID:7260
- C:\Windows\System\NKKEGZt.exe
  C:\Windows\System\NKKEGZt.exe
  2⤵
  PID:7276
- C:\Windows\System\KMYTDOJ.exe
  C:\Windows\System\KMYTDOJ.exe
  2⤵
  PID:7292
- C:\Windows\System\vkoMzAy.exe
  C:\Windows\System\vkoMzAy.exe
  2⤵
  PID:7308
- C:\Windows\System\cIdzHAg.exe
  C:\Windows\System\cIdzHAg.exe
  2⤵
  PID:7324
- C:\Windows\System\vbXReIy.exe
  C:\Windows\System\vbXReIy.exe
  2⤵
  PID:7340
- C:\Windows\System\wvQgLNe.exe
  C:\Windows\System\wvQgLNe.exe
  2⤵
  PID:7356
- C:\Windows\System\exwptci.exe
  C:\Windows\System\exwptci.exe
  2⤵
  PID:7372
- C:\Windows\System\zwqlZuD.exe
  C:\Windows\System\zwqlZuD.exe
  2⤵
  PID:7388
- C:\Windows\System\xsyXYmX.exe
  C:\Windows\System\xsyXYmX.exe
  2⤵
  PID:7404
- C:\Windows\System\HUlEctG.exe
  C:\Windows\System\HUlEctG.exe
  2⤵
  PID:7420
- C:\Windows\System\rXJcDmW.exe
  C:\Windows\System\rXJcDmW.exe
  2⤵
  PID:7436
- C:\Windows\System\qJkmdyS.exe
  C:\Windows\System\qJkmdyS.exe
  2⤵
  PID:7452
- C:\Windows\System\SNvUofo.exe
  C:\Windows\System\SNvUofo.exe
  2⤵
  PID:7468
- C:\Windows\System\HTbNhSK.exe
  C:\Windows\System\HTbNhSK.exe
  2⤵
  PID:7484
- C:\Windows\System\RdYKPtk.exe
  C:\Windows\System\RdYKPtk.exe
  2⤵
  PID:7500
- C:\Windows\System\jFYYGif.exe
  C:\Windows\System\jFYYGif.exe
  2⤵
  PID:7516
- C:\Windows\System\cfpMLtx.exe
  C:\Windows\System\cfpMLtx.exe
  2⤵
  PID:7532
- C:\Windows\System\QggMiZP.exe
  C:\Windows\System\QggMiZP.exe
  2⤵
  PID:7552
- C:\Windows\System\GLihAYa.exe
  C:\Windows\System\GLihAYa.exe
  2⤵
  PID:7568
- C:\Windows\System\VxnQdaO.exe
  C:\Windows\System\VxnQdaO.exe
  2⤵
  PID:7584
- C:\Windows\System\FwxTLUk.exe
  C:\Windows\System\FwxTLUk.exe
  2⤵
  PID:7600
- C:\Windows\System\LJHmvyC.exe
  C:\Windows\System\LJHmvyC.exe
  2⤵
  PID:7616
- C:\Windows\System\BpKpIbF.exe
  C:\Windows\System\BpKpIbF.exe
  2⤵
  PID:7632
- C:\Windows\System\BkKAogd.exe
  C:\Windows\System\BkKAogd.exe
  2⤵
  PID:7648
- C:\Windows\System\NxgAXen.exe
  C:\Windows\System\NxgAXen.exe
  2⤵
  PID:7664
- C:\Windows\System\gYCpFdr.exe
  C:\Windows\System\gYCpFdr.exe
  2⤵
  PID:7680
- C:\Windows\System\goQMutM.exe
  C:\Windows\System\goQMutM.exe
  2⤵
  PID:7696
- C:\Windows\System\WaoLUnW.exe
  C:\Windows\System\WaoLUnW.exe
  2⤵
  PID:7712
- C:\Windows\System\eyKbkfo.exe
  C:\Windows\System\eyKbkfo.exe
  2⤵
  PID:7728
- C:\Windows\System\zUFKDfO.exe
  C:\Windows\System\zUFKDfO.exe
  2⤵
  PID:7744
- C:\Windows\System\pgRThUn.exe
  C:\Windows\System\pgRThUn.exe
  2⤵
  PID:7760
- C:\Windows\System\hFoWqIy.exe
  C:\Windows\System\hFoWqIy.exe
  2⤵
  PID:7776
- C:\Windows\System\UXEmtYr.exe
  C:\Windows\System\UXEmtYr.exe
  2⤵
  PID:7792
- C:\Windows\System\htPsCvi.exe
  C:\Windows\System\htPsCvi.exe
  2⤵
  PID:7808
- C:\Windows\System\GgMicHW.exe
  C:\Windows\System\GgMicHW.exe
  2⤵
  PID:7824
- C:\Windows\System\KxMfLWQ.exe
  C:\Windows\System\KxMfLWQ.exe
  2⤵
  PID:7840
- C:\Windows\System\dmrDBHR.exe
  C:\Windows\System\dmrDBHR.exe
  2⤵
  PID:7856
- C:\Windows\System\VCrTCmj.exe
  C:\Windows\System\VCrTCmj.exe
  2⤵
  PID:7872
- C:\Windows\System\YKXbxCj.exe
  C:\Windows\System\YKXbxCj.exe
  2⤵
  PID:7888
- C:\Windows\System\hGCScWU.exe
  C:\Windows\System\hGCScWU.exe
  2⤵
  PID:7904
- C:\Windows\System\FxmxyuV.exe
  C:\Windows\System\FxmxyuV.exe
  2⤵
  PID:7920
- C:\Windows\System\VroLzuG.exe
  C:\Windows\System\VroLzuG.exe
  2⤵
  PID:7936
- C:\Windows\System\hlySHIc.exe
  C:\Windows\System\hlySHIc.exe
  2⤵
  PID:7952
- C:\Windows\System\FfiOQvE.exe
  C:\Windows\System\FfiOQvE.exe
  2⤵
  PID:7968
- C:\Windows\System\llHjkrM.exe
  C:\Windows\System\llHjkrM.exe
  2⤵
  PID:7984
- C:\Windows\System\oqpdmol.exe
  C:\Windows\System\oqpdmol.exe
  2⤵
  PID:8000
- C:\Windows\System\vaHpdxI.exe
  C:\Windows\System\vaHpdxI.exe
  2⤵
  PID:8016
- C:\Windows\System\mwgDCTZ.exe
  C:\Windows\System\mwgDCTZ.exe
  2⤵
  PID:8032
- C:\Windows\System\AGTiwNM.exe
  C:\Windows\System\AGTiwNM.exe
  2⤵
  PID:8048
- C:\Windows\System\taRWghp.exe
  C:\Windows\System\taRWghp.exe
  2⤵
  PID:8064
- C:\Windows\System\VXfhUra.exe
  C:\Windows\System\VXfhUra.exe
  2⤵
  PID:8080
- C:\Windows\System\JvmwPgx.exe
  C:\Windows\System\JvmwPgx.exe
  2⤵
  PID:8096
- C:\Windows\System\xxqsgUb.exe
  C:\Windows\System\xxqsgUb.exe
  2⤵
  PID:8112
- C:\Windows\System\xDgUnGG.exe
  C:\Windows\System\xDgUnGG.exe
  2⤵
  PID:8128
- C:\Windows\System\kwVteoT.exe
  C:\Windows\System\kwVteoT.exe
  2⤵
  PID:8144
- C:\Windows\System\avFkXtg.exe
  C:\Windows\System\avFkXtg.exe
  2⤵
  PID:8160
- C:\Windows\System\jSIxcSn.exe
  C:\Windows\System\jSIxcSn.exe
  2⤵
  PID:8176
- C:\Windows\System\pGzQrlo.exe
  C:\Windows\System\pGzQrlo.exe
  2⤵
  PID:6400
- C:\Windows\System\clXsIML.exe
  C:\Windows\System\clXsIML.exe
  2⤵
  PID:7188
- C:\Windows\System\fgxKNGi.exe
  C:\Windows\System\fgxKNGi.exe
  2⤵
  PID:7224
- C:\Windows\System\KwiploS.exe
  C:\Windows\System\KwiploS.exe
  2⤵
  PID:7272
- C:\Windows\System\eLkYjoM.exe
  C:\Windows\System\eLkYjoM.exe
  2⤵
  PID:7268
- C:\Windows\System\SrxPeyK.exe
  C:\Windows\System\SrxPeyK.exe
  2⤵
  PID:7332
- C:\Windows\System\hNYvDxv.exe
  C:\Windows\System\hNYvDxv.exe
  2⤵
  PID:7368
- C:\Windows\System\DIwuyuR.exe
  C:\Windows\System\DIwuyuR.exe
  2⤵
  PID:7288
- C:\Windows\System\FxSRnwG.exe
  C:\Windows\System\FxSRnwG.exe
  2⤵
  PID:7428
- C:\Windows\System\GXajRxR.exe
  C:\Windows\System\GXajRxR.exe
  2⤵
  PID:7380
- C:\Windows\System\wnufabU.exe
  C:\Windows\System\wnufabU.exe
  2⤵
  PID:7444
- C:\Windows\System\UVjpFZS.exe
  C:\Windows\System\UVjpFZS.exe
  2⤵
  PID:7476
- C:\Windows\System\rQTUDJU.exe
  C:\Windows\System\rQTUDJU.exe
  2⤵
  PID:7528
- C:\Windows\System\hnENXpu.exe
  C:\Windows\System\hnENXpu.exe
  2⤵
  PID:7512
- C:\Windows\System\BVwkJmH.exe
  C:\Windows\System\BVwkJmH.exe
  2⤵
  PID:6324
- C:\Windows\System\XrYzcGR.exe
  C:\Windows\System\XrYzcGR.exe
  2⤵
  PID:7596
- C:\Windows\System\LVRotxQ.exe
  C:\Windows\System\LVRotxQ.exe
  2⤵
  PID:7628
- C:\Windows\System\DvtoGkZ.exe
  C:\Windows\System\DvtoGkZ.exe
  2⤵
  PID:7660
- C:\Windows\System\bbNNFfR.exe
  C:\Windows\System\bbNNFfR.exe
  2⤵
  PID:7788
- C:\Windows\System\NrnznjK.exe
  C:\Windows\System\NrnznjK.exe
  2⤵
  PID:7820
- C:\Windows\System\jFmoOmT.exe
  C:\Windows\System\jFmoOmT.exe
  2⤵
  PID:7880
- C:\Windows\System\mKDbpcM.exe
  C:\Windows\System\mKDbpcM.exe
  2⤵
  PID:7772
- C:\Windows\System\GRAYPMg.exe
  C:\Windows\System\GRAYPMg.exe
  2⤵
  PID:7676
- C:\Windows\System\wjoNdWT.exe
  C:\Windows\System\wjoNdWT.exe
  2⤵
  PID:7800
- C:\Windows\System\asZPusr.exe
  C:\Windows\System\asZPusr.exe
  2⤵
  PID:7928
- C:\Windows\System\xNSGGrc.exe
  C:\Windows\System\xNSGGrc.exe
  2⤵
  PID:7896
- C:\Windows\System\fZOWqkd.exe
  C:\Windows\System\fZOWqkd.exe
  2⤵
  PID:7964
- C:\Windows\System\wxyLxqd.exe
  C:\Windows\System\wxyLxqd.exe
  2⤵
  PID:7992
- C:\Windows\System\tfjOiVq.exe
  C:\Windows\System\tfjOiVq.exe
  2⤵
  PID:8044
- C:\Windows\System\YrDTBau.exe
  C:\Windows\System\YrDTBau.exe
  2⤵
  PID:8060
- C:\Windows\System\ouTHNsO.exe
  C:\Windows\System\ouTHNsO.exe
  2⤵
  PID:8092
- C:\Windows\System\eWgLvrP.exe
  C:\Windows\System\eWgLvrP.exe
  2⤵
  PID:8136
- C:\Windows\System\ktpnWst.exe
  C:\Windows\System\ktpnWst.exe
  2⤵
  PID:8172
- C:\Windows\System\OfWMkoy.exe
  C:\Windows\System\OfWMkoy.exe
  2⤵
  PID:6148
- C:\Windows\System\wcmluSC.exe
  C:\Windows\System\wcmluSC.exe
  2⤵
  PID:7008
- C:\Windows\System\VLlrjlY.exe
  C:\Windows\System\VLlrjlY.exe
  2⤵
  PID:7300
- C:\Windows\System\HsHgcvS.exe
  C:\Windows\System\HsHgcvS.exe
  2⤵
  PID:7316
- C:\Windows\System\eAccoJD.exe
  C:\Windows\System\eAccoJD.exe
  2⤵
  PID:7352
- C:\Windows\System\kRDJrkH.exe
  C:\Windows\System\kRDJrkH.exe
  2⤵
  PID:7432
- C:\Windows\System\MREwlKY.exe
  C:\Windows\System\MREwlKY.exe
  2⤵
  PID:7496
- C:\Windows\System\MLPyLyP.exe
  C:\Windows\System\MLPyLyP.exe
  2⤵
  PID:7564
- C:\Windows\System\GrUGTOA.exe
  C:\Windows\System\GrUGTOA.exe
  2⤵
  PID:7688
- C:\Windows\System\VTvahpj.exe
  C:\Windows\System\VTvahpj.exe
  2⤵
  PID:7608
- C:\Windows\System\YykmrXS.exe
  C:\Windows\System\YykmrXS.exe
  2⤵
  PID:7724
- C:\Windows\System\TijwJCv.exe
  C:\Windows\System\TijwJCv.exe
  2⤵
  PID:7912
- C:\Windows\System\PxPhZaK.exe
  C:\Windows\System\PxPhZaK.exe
  2⤵
  PID:7864
- C:\Windows\System\TXKzUMY.exe
  C:\Windows\System\TXKzUMY.exe
  2⤵
  PID:7960
- C:\Windows\System\nGvzAVq.exe
  C:\Windows\System\nGvzAVq.exe
  2⤵
  PID:8040
- C:\Windows\System\buQjnGU.exe
  C:\Windows\System\buQjnGU.exe
  2⤵
  PID:8108
- C:\Windows\System\bRWcJGN.exe
  C:\Windows\System\bRWcJGN.exe
  2⤵
  PID:8188
- C:\Windows\System\TuSbBLb.exe
  C:\Windows\System\TuSbBLb.exe
  2⤵
  PID:8184
- C:\Windows\System\sndrswa.exe
  C:\Windows\System\sndrswa.exe
  2⤵
  PID:7348
- C:\Windows\System\RGQNpbu.exe
  C:\Windows\System\RGQNpbu.exe
  2⤵
  PID:7560
- C:\Windows\System\eWfOGJi.exe
  C:\Windows\System\eWfOGJi.exe
  2⤵
  PID:7708
- C:\Windows\System\yGQuegI.exe
  C:\Windows\System\yGQuegI.exe
  2⤵
  PID:7448
- C:\Windows\System\rxckLeE.exe
  C:\Windows\System\rxckLeE.exe
  2⤵
  PID:7644
- C:\Windows\System\QvPjVKZ.exe
  C:\Windows\System\QvPjVKZ.exe
  2⤵
  PID:7612
- C:\Windows\System\uZSLWHH.exe
  C:\Windows\System\uZSLWHH.exe
  2⤵
  PID:8024
- C:\Windows\System\DaGLgba.exe
  C:\Windows\System\DaGLgba.exe
  2⤵
  PID:7208
- C:\Windows\System\RYATxiS.exe
  C:\Windows\System\RYATxiS.exe
  2⤵
  PID:7396
- C:\Windows\System\RUNwVlU.exe
  C:\Windows\System\RUNwVlU.exe
  2⤵
  PID:7948
- C:\Windows\System\tkxtceE.exe
  C:\Windows\System\tkxtceE.exe
  2⤵
  PID:8216
- C:\Windows\System\VyVEFuV.exe
  C:\Windows\System\VyVEFuV.exe
  2⤵
  PID:8244
- C:\Windows\System\BYEaixE.exe
  C:\Windows\System\BYEaixE.exe
  2⤵
  PID:8260
- C:\Windows\System\DNKaXHO.exe
  C:\Windows\System\DNKaXHO.exe
  2⤵
  PID:8276
- C:\Windows\System\ArpQZHV.exe
  C:\Windows\System\ArpQZHV.exe
  2⤵
  PID:8292
- C:\Windows\System\aunBswm.exe
  C:\Windows\System\aunBswm.exe
  2⤵
  PID:8312
- C:\Windows\System\kuvKMkm.exe
  C:\Windows\System\kuvKMkm.exe
  2⤵
  PID:8348
- C:\Windows\System\zwNtGAg.exe
  C:\Windows\System\zwNtGAg.exe
  2⤵
  PID:8364
- C:\Windows\System\azNhtvk.exe
  C:\Windows\System\azNhtvk.exe
  2⤵
  PID:8380
- C:\Windows\System\FrwFPRm.exe
  C:\Windows\System\FrwFPRm.exe
  2⤵
  PID:8396
- C:\Windows\System\XGMAJsh.exe
  C:\Windows\System\XGMAJsh.exe
  2⤵
  PID:8412
- C:\Windows\System\YrVJaEu.exe
  C:\Windows\System\YrVJaEu.exe
  2⤵
  PID:8428
- C:\Windows\System\FvNXRaf.exe
  C:\Windows\System\FvNXRaf.exe
  2⤵
  PID:8444
- C:\Windows\System\mBqqNTZ.exe
  C:\Windows\System\mBqqNTZ.exe
  2⤵
  PID:8460
- C:\Windows\System\JkQuvNA.exe
  C:\Windows\System\JkQuvNA.exe
  2⤵
  PID:8476
- C:\Windows\System\MErZeur.exe
  C:\Windows\System\MErZeur.exe
  2⤵
  PID:8508
- C:\Windows\System\wsPNBzi.exe
  C:\Windows\System\wsPNBzi.exe
  2⤵
  PID:8524
- C:\Windows\System\CwONmab.exe
  C:\Windows\System\CwONmab.exe
  2⤵
  PID:8548
- C:\Windows\System\mRgyzMW.exe
  C:\Windows\System\mRgyzMW.exe
  2⤵
  PID:8576
- C:\Windows\System\OvRukcA.exe
  C:\Windows\System\OvRukcA.exe
  2⤵
  PID:8592
- C:\Windows\System\iRaePOU.exe
  C:\Windows\System\iRaePOU.exe
  2⤵
  PID:8608
- C:\Windows\System\hrJZolo.exe
  C:\Windows\System\hrJZolo.exe
  2⤵
  PID:8628
- C:\Windows\System\laBgrKr.exe
  C:\Windows\System\laBgrKr.exe
  2⤵
  PID:8648
- C:\Windows\System\NHLqPzk.exe
  C:\Windows\System\NHLqPzk.exe
  2⤵
  PID:8664
- C:\Windows\System\AGwjWFR.exe
  C:\Windows\System\AGwjWFR.exe
  2⤵
  PID:8680
- C:\Windows\System\MNEnisQ.exe
  C:\Windows\System\MNEnisQ.exe
  2⤵
  PID:8696
- C:\Windows\System\aRvbwnZ.exe
  C:\Windows\System\aRvbwnZ.exe
  2⤵
  PID:8712
- C:\Windows\System\QaJtASC.exe
  C:\Windows\System\QaJtASC.exe
  2⤵
  PID:8728
- C:\Windows\System\CkWQxdg.exe
  C:\Windows\System\CkWQxdg.exe
  2⤵
  PID:8748
- C:\Windows\System\APTxYnQ.exe
  C:\Windows\System\APTxYnQ.exe
  2⤵
  PID:8764
- C:\Windows\System\SKchdTZ.exe
  C:\Windows\System\SKchdTZ.exe
  2⤵
  PID:8780
- C:\Windows\System\pwCawCO.exe
  C:\Windows\System\pwCawCO.exe
  2⤵
  PID:8800
- C:\Windows\System\icvBJLT.exe
  C:\Windows\System\icvBJLT.exe
  2⤵
  PID:8860
- C:\Windows\System\WeZUIfb.exe
  C:\Windows\System\WeZUIfb.exe
  2⤵
  PID:8880
- C:\Windows\System\ptLbOlU.exe
  C:\Windows\System\ptLbOlU.exe
  2⤵
  PID:8896
- C:\Windows\System\LnAUtCU.exe
  C:\Windows\System\LnAUtCU.exe
  2⤵
  PID:8916
- C:\Windows\System\LjUnnel.exe
  C:\Windows\System\LjUnnel.exe
  2⤵
  PID:8936
- C:\Windows\System\MYXObDH.exe
  C:\Windows\System\MYXObDH.exe
  2⤵
  PID:8952
- C:\Windows\System\rukhaqA.exe
  C:\Windows\System\rukhaqA.exe
  2⤵
  PID:8968
- C:\Windows\System\MPTnZxy.exe
  C:\Windows\System\MPTnZxy.exe
  2⤵
  PID:8984
- C:\Windows\System\xjFeGzs.exe
  C:\Windows\System\xjFeGzs.exe
  2⤵
  PID:9000
- C:\Windows\System\aRGaGLz.exe
  C:\Windows\System\aRGaGLz.exe
  2⤵
  PID:9056
- C:\Windows\System\zrmrgka.exe
  C:\Windows\System\zrmrgka.exe
  2⤵
  PID:9072
- C:\Windows\System\DysjeIr.exe
  C:\Windows\System\DysjeIr.exe
  2⤵
  PID:9088
- C:\Windows\System\kQJwUQR.exe
  C:\Windows\System\kQJwUQR.exe
  2⤵
  PID:9104
- C:\Windows\System\aJImMib.exe
  C:\Windows\System\aJImMib.exe
  2⤵
  PID:9120
- C:\Windows\System\eAdOAny.exe
  C:\Windows\System\eAdOAny.exe
  2⤵
  PID:9140
- C:\Windows\System\rmJAtEs.exe
  C:\Windows\System\rmJAtEs.exe
  2⤵
  PID:9156
- C:\Windows\System\kcpTBjr.exe
  C:\Windows\System\kcpTBjr.exe
  2⤵
  PID:9172
- C:\Windows\System\YvvZeYP.exe
  C:\Windows\System\YvvZeYP.exe
  2⤵
  PID:9188
- C:\Windows\System\wpbRyeY.exe
  C:\Windows\System\wpbRyeY.exe
  2⤵
  PID:9204
- C:\Windows\System\MiBkNge.exe
  C:\Windows\System\MiBkNge.exe
  2⤵
  PID:7256
- C:\Windows\System\ABPBRnh.exe
  C:\Windows\System\ABPBRnh.exe
  2⤵
  PID:7720
- C:\Windows\System\ukuJSXb.exe
  C:\Windows\System\ukuJSXb.exe
  2⤵
  PID:7868
- C:\Windows\System\bbZVJRC.exe
  C:\Windows\System\bbZVJRC.exe
  2⤵
  PID:7672
- C:\Windows\System\IBdGQvM.exe
  C:\Windows\System\IBdGQvM.exe
  2⤵
  PID:8228
- C:\Windows\System\kGaCbWR.exe
  C:\Windows\System\kGaCbWR.exe
  2⤵
  PID:8256
- C:\Windows\System\DtZHfwd.exe
  C:\Windows\System\DtZHfwd.exe
  2⤵
  PID:8320
- C:\Windows\System\oTUVNwI.exe
  C:\Windows\System\oTUVNwI.exe
  2⤵
  PID:8328
- C:\Windows\System\BlSxopb.exe
  C:\Windows\System\BlSxopb.exe
  2⤵
  PID:8404
- C:\Windows\System\YxhKmfH.exe
  C:\Windows\System\YxhKmfH.exe
  2⤵
  PID:8472
- C:\Windows\System\CYNZBPb.exe
  C:\Windows\System\CYNZBPb.exe
  2⤵
  PID:8516
- C:\Windows\System\NMTNwqT.exe
  C:\Windows\System\NMTNwqT.exe
  2⤵
  PID:8452
- C:\Windows\System\EtZcXmf.exe
  C:\Windows\System\EtZcXmf.exe
  2⤵
  PID:8492
- C:\Windows\System\HWIOiZd.exe
  C:\Windows\System\HWIOiZd.exe
  2⤵
  PID:8532
- C:\Windows\System\fGFqIPY.exe
  C:\Windows\System\fGFqIPY.exe
  2⤵
  PID:8560
- C:\Windows\System\VWakTup.exe
  C:\Windows\System\VWakTup.exe
  2⤵
  PID:8568
- C:\Windows\System\XlXtfxG.exe
  C:\Windows\System\XlXtfxG.exe
  2⤵
  PID:8848
- C:\Windows\System\OUbNjjz.exe
  C:\Windows\System\OUbNjjz.exe
  2⤵
  PID:8892
- C:\Windows\System\axAqxeV.exe
  C:\Windows\System\axAqxeV.exe
  2⤵
  PID:8960
- C:\Windows\System\pJJWUMt.exe
  C:\Windows\System\pJJWUMt.exe
  2⤵
  PID:8564
- C:\Windows\System\UdbOPeL.exe
  C:\Windows\System\UdbOPeL.exe
  2⤵
  PID:8616
- C:\Windows\System\xGrREUf.exe
  C:\Windows\System\xGrREUf.exe
  2⤵
  PID:8660
- C:\Windows\System\MPoXULl.exe
  C:\Windows\System\MPoXULl.exe
  2⤵
  PID:8796
- C:\Windows\System\PTUeCUZ.exe
  C:\Windows\System\PTUeCUZ.exe
  2⤵
  PID:9012
- C:\Windows\System\LoYOHBL.exe
  C:\Windows\System\LoYOHBL.exe
  2⤵
  PID:9136
- C:\Windows\System\JGMKnhT.exe
  C:\Windows\System\JGMKnhT.exe
  2⤵
  PID:9200
- C:\Windows\System\ZNOemkN.exe
  C:\Windows\System\ZNOemkN.exe
  2⤵
  PID:8200
- C:\Windows\System\DnXuFIS.exe
  C:\Windows\System\DnXuFIS.exe
  2⤵
  PID:8300
- C:\Windows\System\qBIFbOa.exe
  C:\Windows\System\qBIFbOa.exe
  2⤵
  PID:9044
- C:\Windows\System\gfktNMt.exe
  C:\Windows\System\gfktNMt.exe
  2⤵
  PID:8912
- C:\Windows\System\zCrKDrl.exe
  C:\Windows\System\zCrKDrl.exe
  2⤵
  PID:9008
- C:\Windows\System\hiSjVmX.exe
  C:\Windows\System\hiSjVmX.exe
  2⤵
  PID:9016
- C:\Windows\System\BInmKyc.exe
  C:\Windows\System\BInmKyc.exe
  2⤵
  PID:9116
- C:\Windows\System\xnwAbIM.exe
  C:\Windows\System\xnwAbIM.exe
  2⤵
  PID:9212
- C:\Windows\System\fabCKkf.exe
  C:\Windows\System\fabCKkf.exe
  2⤵
  PID:9112
- C:\Windows\System\dPfpvCq.exe
  C:\Windows\System\dPfpvCq.exe
  2⤵
  PID:6820
- C:\Windows\System\RKQfvev.exe
  C:\Windows\System\RKQfvev.exe
  2⤵
  PID:8212
- C:\Windows\System\urNLNkD.exe
  C:\Windows\System\urNLNkD.exe
  2⤵
  PID:8408
- C:\Windows\System\VLQMair.exe
  C:\Windows\System\VLQMair.exe
  2⤵
  PID:8360
- C:\Windows\System\qQPkvQb.exe
  C:\Windows\System\qQPkvQb.exe
  2⤵
  PID:8572
- C:\Windows\System\EkAUmCj.exe
  C:\Windows\System\EkAUmCj.exe
  2⤵
  PID:8372
- C:\Windows\System\FVcgpcE.exe
  C:\Windows\System\FVcgpcE.exe
  2⤵
  PID:8536
- C:\Windows\System\kdzmyrU.exe
  C:\Windows\System\kdzmyrU.exe
  2⤵
  PID:8672
- C:\Windows\System\WwHWGzA.exe
  C:\Windows\System\WwHWGzA.exe
  2⤵
  PID:8736
- C:\Windows\System\wYFfYMU.exe
  C:\Windows\System\wYFfYMU.exe
  2⤵
  PID:8776
- C:\Windows\System\RLUrtpR.exe
  C:\Windows\System\RLUrtpR.exe
  2⤵
  PID:8824
- C:\Windows\System\RYtehoC.exe
  C:\Windows\System\RYtehoC.exe
  2⤵
  PID:8688
- C:\Windows\System\KqgzSLX.exe
  C:\Windows\System\KqgzSLX.exe
  2⤵
  PID:8932
- C:\Windows\System\AhqrsTQ.exe
  C:\Windows\System\AhqrsTQ.exe
  2⤵
  PID:8812
- C:\Windows\System\BnyUrUE.exe
  C:\Windows\System\BnyUrUE.exe
  2⤵
  PID:8756
- C:\Windows\System\ploFgGW.exe
  C:\Windows\System\ploFgGW.exe
  2⤵
  PID:8792
- C:\Windows\System\TOWmpYQ.exe
  C:\Windows\System\TOWmpYQ.exe
  2⤵
  PID:7416
- C:\Windows\System\SpNfEue.exe
  C:\Windows\System\SpNfEue.exe
  2⤵
  PID:8948
- C:\Windows\System\YPHVGad.exe
  C:\Windows\System\YPHVGad.exe
  2⤵
  PID:9164
- C:\Windows\System\vAGRTYx.exe
  C:\Windows\System\vAGRTYx.exe
  2⤵
  PID:8908
- C:\Windows\System\JOJuLtM.exe
  C:\Windows\System\JOJuLtM.exe
  2⤵
  PID:9036
- C:\Windows\System\iVicCdd.exe
  C:\Windows\System\iVicCdd.exe
  2⤵
  PID:9080
- C:\Windows\System\IZwmSIL.exe
  C:\Windows\System\IZwmSIL.exe
  2⤵
  PID:9184
- C:\Windows\System\gLvdilU.exe
  C:\Windows\System\gLvdilU.exe
  2⤵
  PID:8392
- C:\Windows\System\dNWtQOl.exe
  C:\Windows\System\dNWtQOl.exe
  2⤵
  PID:8340
- C:\Windows\System\SiJagVQ.exe
  C:\Windows\System\SiJagVQ.exe
  2⤵
  PID:8540
- C:\Windows\System\dnouihV.exe
  C:\Windows\System\dnouihV.exe
  2⤵
  PID:8840
- C:\Windows\System\NYhSTPn.exe
  C:\Windows\System\NYhSTPn.exe
  2⤵
  PID:8344
- C:\Windows\System\RkyLkmi.exe
  C:\Windows\System\RkyLkmi.exe
  2⤵
  PID:8820
- C:\Windows\System\RvFkeHb.exe
  C:\Windows\System\RvFkeHb.exe
  2⤵
  PID:8856
- C:\Windows\System\HWwHSZM.exe
  C:\Windows\System\HWwHSZM.exe
  2⤵
  PID:8620
- C:\Windows\System\CkZJAVJ.exe
  C:\Windows\System\CkZJAVJ.exe
  2⤵
  PID:9128
- C:\Windows\System\UPEIqIu.exe
  C:\Windows\System\UPEIqIu.exe
  2⤵
  PID:8236
- C:\Windows\System\TVfnMRF.exe
  C:\Windows\System\TVfnMRF.exe
  2⤵
  PID:8224
- C:\Windows\System\OpKrWnd.exe
  C:\Windows\System\OpKrWnd.exe
  2⤵
  PID:8140
- C:\Windows\System\ulSzirO.exe
  C:\Windows\System\ulSzirO.exe
  2⤵
  PID:9032
- C:\Windows\System\TUqdksj.exe
  C:\Windows\System\TUqdksj.exe
  2⤵
  PID:8772
- C:\Windows\System\dOoPkKd.exe
  C:\Windows\System\dOoPkKd.exe
  2⤵
  PID:8996
- C:\Windows\System\CangKQq.exe
  C:\Windows\System\CangKQq.exe
  2⤵
  PID:8724
- C:\Windows\System\BhCQcWf.exe
  C:\Windows\System\BhCQcWf.exe
  2⤵
  PID:8288
- C:\Windows\System\oBAbRUf.exe
  C:\Windows\System\oBAbRUf.exe
  2⤵
  PID:8556
- C:\Windows\System\yEtinND.exe
  C:\Windows\System\yEtinND.exe
  2⤵
  PID:8644
- C:\Windows\System\hYyapre.exe
  C:\Windows\System\hYyapre.exe
  2⤵
  PID:8420
- C:\Windows\System\OeXycbD.exe
  C:\Windows\System\OeXycbD.exe
  2⤵
  PID:8928
- C:\Windows\System\EsHkNpj.exe
  C:\Windows\System\EsHkNpj.exe
  2⤵
  PID:9228
- C:\Windows\System\CpWpreS.exe
  C:\Windows\System\CpWpreS.exe
  2⤵
  PID:9244
- C:\Windows\System\YBFQtnx.exe
  C:\Windows\System\YBFQtnx.exe
  2⤵
  PID:9268
- C:\Windows\System\npvPTMP.exe
  C:\Windows\System\npvPTMP.exe
  2⤵
  PID:9284
- C:\Windows\System\BtbDmVK.exe
  C:\Windows\System\BtbDmVK.exe
  2⤵
  PID:9300
- C:\Windows\System\fnkEYFj.exe
  C:\Windows\System\fnkEYFj.exe
  2⤵
  PID:9316
- C:\Windows\System\lzwTHaa.exe
  C:\Windows\System\lzwTHaa.exe
  2⤵
  PID:9332
- C:\Windows\System\TYmpncK.exe
  C:\Windows\System\TYmpncK.exe
  2⤵
  PID:9348
- C:\Windows\System\BDoCPzu.exe
  C:\Windows\System\BDoCPzu.exe
  2⤵
  PID:9364
- C:\Windows\System\peITysa.exe
  C:\Windows\System\peITysa.exe
  2⤵
  PID:9380
- C:\Windows\System\mSWKMLO.exe
  C:\Windows\System\mSWKMLO.exe
  2⤵
  PID:9400
- C:\Windows\System\ASsoHyg.exe
  C:\Windows\System\ASsoHyg.exe
  2⤵
  PID:9416
- C:\Windows\System\DSBzgrq.exe
  C:\Windows\System\DSBzgrq.exe
  2⤵
  PID:9432
- C:\Windows\System\lAESRzD.exe
  C:\Windows\System\lAESRzD.exe
  2⤵
  PID:9448
- C:\Windows\System\NMoTWKe.exe
  C:\Windows\System\NMoTWKe.exe
  2⤵
  PID:9464
- C:\Windows\System\mLNqtGA.exe
  C:\Windows\System\mLNqtGA.exe
  2⤵
  PID:9480
- C:\Windows\System\bFgBvkU.exe
  C:\Windows\System\bFgBvkU.exe
  2⤵
  PID:9496
- C:\Windows\System\kkRAaCo.exe
  C:\Windows\System\kkRAaCo.exe
  2⤵
  PID:9512
- C:\Windows\System\PVdERxB.exe
  C:\Windows\System\PVdERxB.exe
  2⤵
  PID:9528
- C:\Windows\System\CIRvNyZ.exe
  C:\Windows\System\CIRvNyZ.exe
  2⤵
  PID:9544
- C:\Windows\System\ineZzWd.exe
  C:\Windows\System\ineZzWd.exe
  2⤵
  PID:9560
- C:\Windows\System\jVLIndp.exe
  C:\Windows\System\jVLIndp.exe
  2⤵
  PID:9576
- C:\Windows\System\wdnqjjg.exe
  C:\Windows\System\wdnqjjg.exe
  2⤵
  PID:9592
- C:\Windows\System\bwvOftn.exe
  C:\Windows\System\bwvOftn.exe
  2⤵
  PID:9608
- C:\Windows\System\rYZZwsf.exe
  C:\Windows\System\rYZZwsf.exe
  2⤵
  PID:9624
- C:\Windows\System\VGGHJOR.exe
  C:\Windows\System\VGGHJOR.exe
  2⤵
  PID:9640
- C:\Windows\System\paSrBKl.exe
  C:\Windows\System\paSrBKl.exe
  2⤵
  PID:9656
- C:\Windows\System\yxGEmKt.exe
  C:\Windows\System\yxGEmKt.exe
  2⤵
  PID:9672
- C:\Windows\System\hPLtQly.exe
  C:\Windows\System\hPLtQly.exe
  2⤵
  PID:9688
- C:\Windows\System\dXFafjn.exe
  C:\Windows\System\dXFafjn.exe
  2⤵
  PID:9704
- C:\Windows\System\SpsEjzb.exe
  C:\Windows\System\SpsEjzb.exe
  2⤵
  PID:9720
- C:\Windows\System\DjxCIMU.exe
  C:\Windows\System\DjxCIMU.exe
  2⤵
  PID:9736
- C:\Windows\System\kGpQlzI.exe
  C:\Windows\System\kGpQlzI.exe
  2⤵
  PID:9752
- C:\Windows\System\VHuCjgJ.exe
  C:\Windows\System\VHuCjgJ.exe
  2⤵
  PID:9768
- C:\Windows\System\suwyonC.exe
  C:\Windows\System\suwyonC.exe
  2⤵
  PID:9784
- C:\Windows\System\imFEXBL.exe
  C:\Windows\System\imFEXBL.exe
  2⤵
  PID:9800
- C:\Windows\System\ELrOdMN.exe
  C:\Windows\System\ELrOdMN.exe
  2⤵
  PID:9816
- C:\Windows\System\MHztJGo.exe
  C:\Windows\System\MHztJGo.exe
  2⤵
  PID:9832
- C:\Windows\System\VqPmYLq.exe
  C:\Windows\System\VqPmYLq.exe
  2⤵
  PID:9848
- C:\Windows\System\cnqghVh.exe
  C:\Windows\System\cnqghVh.exe
  2⤵
  PID:9864
- C:\Windows\System\njzzatV.exe
  C:\Windows\System\njzzatV.exe
  2⤵
  PID:9880
- C:\Windows\System\kMouKxH.exe
  C:\Windows\System\kMouKxH.exe
  2⤵
  PID:9896
- C:\Windows\System\oZeaXPE.exe
  C:\Windows\System\oZeaXPE.exe
  2⤵
  PID:9916
- C:\Windows\System\dXBeNzp.exe
  C:\Windows\System\dXBeNzp.exe
  2⤵
  PID:9932
- C:\Windows\System\ILxueeb.exe
  C:\Windows\System\ILxueeb.exe
  2⤵
  PID:9952
- C:\Windows\System\SPJYcgx.exe
  C:\Windows\System\SPJYcgx.exe
  2⤵
  PID:9976
- C:\Windows\System\eUpQIQl.exe
  C:\Windows\System\eUpQIQl.exe
  2⤵
  PID:9992
- C:\Windows\System\ReKMfRS.exe
  C:\Windows\System\ReKMfRS.exe
  2⤵
  PID:10012
- C:\Windows\System\RKEZFfh.exe
  C:\Windows\System\RKEZFfh.exe
  2⤵
  PID:10028
- C:\Windows\System\GJkZRKf.exe
  C:\Windows\System\GJkZRKf.exe
  2⤵
  PID:10048
- C:\Windows\System\hegEzIN.exe
  C:\Windows\System\hegEzIN.exe
  2⤵
  PID:10064
- C:\Windows\System\cCWXxIu.exe
  C:\Windows\System\cCWXxIu.exe
  2⤵
  PID:10080
- C:\Windows\System\TQCtAGF.exe
  C:\Windows\System\TQCtAGF.exe
  2⤵
  PID:10100
- C:\Windows\System\gYHElIV.exe
  C:\Windows\System\gYHElIV.exe
  2⤵
  PID:10116
- C:\Windows\System\aichqqA.exe
  C:\Windows\System\aichqqA.exe
  2⤵
  PID:10144
- C:\Windows\System\qVbpgAn.exe
  C:\Windows\System\qVbpgAn.exe
  2⤵
  PID:10160
- C:\Windows\System\shWASjz.exe
  C:\Windows\System\shWASjz.exe
  2⤵
  PID:10176
- C:\Windows\System\iMpLYsu.exe
  C:\Windows\System\iMpLYsu.exe
  2⤵
  PID:10192
- C:\Windows\System\NGjrTSV.exe
  C:\Windows\System\NGjrTSV.exe
  2⤵
  PID:10208
- C:\Windows\System\VzVWWgF.exe
  C:\Windows\System\VzVWWgF.exe
  2⤵
  PID:10224
- C:\Windows\System\FbBzDjr.exe
  C:\Windows\System\FbBzDjr.exe
  2⤵
  PID:9084
- C:\Windows\System\cldLUGC.exe
  C:\Windows\System\cldLUGC.exe
  2⤵
  PID:9240
- C:\Windows\System\bXcYQWL.exe
  C:\Windows\System\bXcYQWL.exe
  2⤵
  PID:9312
- C:\Windows\System\JCLMxOJ.exe
  C:\Windows\System\JCLMxOJ.exe
  2⤵
  PID:9372
- C:\Windows\System\lmoEqVd.exe
  C:\Windows\System\lmoEqVd.exe
  2⤵
  PID:9224
- C:\Windows\System\AaJWUCZ.exe
  C:\Windows\System\AaJWUCZ.exe
  2⤵
  PID:9264
- C:\Windows\System\kRrgPUv.exe
  C:\Windows\System\kRrgPUv.exe
  2⤵
  PID:9356
- C:\Windows\System\wmazHdj.exe
  C:\Windows\System\wmazHdj.exe
  2⤵
  PID:9444
- C:\Windows\System\PUHxwgM.exe
  C:\Windows\System\PUHxwgM.exe
  2⤵
  PID:9504
- C:\Windows\System\ZgIWeWM.exe
  C:\Windows\System\ZgIWeWM.exe
  2⤵
  PID:9568
- C:\Windows\System\VUNjIrt.exe
  C:\Windows\System\VUNjIrt.exe
  2⤵
  PID:9424
- C:\Windows\System\PjiYpRg.exe
  C:\Windows\System\PjiYpRg.exe
  2⤵
  PID:9488
- C:\Windows\System\TZIIeFq.exe
  C:\Windows\System\TZIIeFq.exe
  2⤵
  PID:9552
- C:\Windows\System\nyYnjNY.exe
  C:\Windows\System\nyYnjNY.exe
  2⤵
  PID:9616
- C:\Windows\System\VBlmuDF.exe
  C:\Windows\System\VBlmuDF.exe
  2⤵
  PID:9648
- C:\Windows\System\EdDMhIL.exe
  C:\Windows\System\EdDMhIL.exe
  2⤵
  PID:9700
- C:\Windows\System\dzyMGfK.exe
  C:\Windows\System\dzyMGfK.exe
  2⤵
  PID:9680
- C:\Windows\System\xnbCRId.exe
  C:\Windows\System\xnbCRId.exe
  2⤵
  PID:9716
- C:\Windows\System\FiwCwyV.exe
  C:\Windows\System\FiwCwyV.exe
  2⤵
  PID:9796
- C:\Windows\System\uuROgPP.exe
  C:\Windows\System\uuROgPP.exe
  2⤵
  PID:9828
- C:\Windows\System\yzCaOEE.exe
  C:\Windows\System\yzCaOEE.exe
  2⤵
  PID:9872
- C:\Windows\System\uSwQkxi.exe
  C:\Windows\System\uSwQkxi.exe
  2⤵
  PID:9928
- C:\Windows\System\mPJkXmD.exe
  C:\Windows\System\mPJkXmD.exe
  2⤵
  PID:9940
- C:\Windows\System\cqEarbB.exe
  C:\Windows\System\cqEarbB.exe
  2⤵
  PID:9892
- C:\Windows\System\pqwIniU.exe
  C:\Windows\System\pqwIniU.exe
  2⤵
  PID:9972
- C:\Windows\System\mCMRUlX.exe
  C:\Windows\System\mCMRUlX.exe
  2⤵
  PID:10040
- C:\Windows\System\xxtzKwQ.exe
  C:\Windows\System\xxtzKwQ.exe
  2⤵
  PID:10108
- C:\Windows\System\RYiLMmb.exe
  C:\Windows\System\RYiLMmb.exe
  2⤵
  PID:10020
- C:\Windows\System\IZPhrwW.exe
  C:\Windows\System\IZPhrwW.exe
  2⤵
  PID:10060
- C:\Windows\System\hlkotGR.exe
  C:\Windows\System\hlkotGR.exe
  2⤵
  PID:9396
- C:\Windows\System\aGMKqcy.exe
  C:\Windows\System\aGMKqcy.exe
  2⤵
  PID:10188
- C:\Windows\System\LlmhaMp.exe
  C:\Windows\System\LlmhaMp.exe
  2⤵
  PID:9236
- C:\Windows\System\tBlqlRU.exe
  C:\Windows\System\tBlqlRU.exe
  2⤵
  PID:10136
- C:\Windows\System\vqloyLG.exe
  C:\Windows\System\vqloyLG.exe
  2⤵
  PID:10204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DCQfBpG.exe

Filesize
1.6MB

MD5
33edc1507ecb50705de2a2afbb9e6a78

SHA1
ec9cfa24273c833b3d779b5e48e9cfc0046f322f

SHA256
8b8a43ed8a6ed7fb58ae4046d0e60078bdf7c38b5c8f3084b57efbf50dcab960

SHA512
4d5e1f8f710a664d0f0ded89c5e9a64e30547a641025f8eb2607534e3e82a7add06ea0a0f1ac231b3181fda8451e445c3a3ee78497e265b03a057ce71d3ef85a

Download Submit
C:\Windows\system\DMFQBNs.exe

Filesize
1.6MB

MD5
96802e93142b2451c65832d40cf8ec03

SHA1
94077f1adca5646b2a2ccbee507a958290d99cf8

SHA256
96820955a8c12ff2f364e72f46c875a199a0dd4714833c8bf2a268b5f873cc38

SHA512
6a7acc2a8b729652936aedcb680255442486bc756b5b5487f491b58819fddca657f1a1b820e53d5ee4abcdbd1ae20ecf1a68158dae1cf0ff11b20d90244ebb6d

Download Submit
C:\Windows\system\EXPBDVB.exe

Filesize
1.6MB

MD5
2fd5e289abcff8f34f4c2d0c55bf327d

SHA1
19aa41782f7968e4e58941bd0ef1b283f8ddafbd

SHA256
5418fb02fcd1fdf32131dbebc4d49240a3d1d6a5ad8ca80b613ae01f6ffacfda

SHA512
533592445cedd6e0f7c1e142f0a51e078d0dd379c5fb286f65cef030c7623c487a8ec3f86786f16962b95315209b8478d998b8f171b1277ef8c27b51da468e40

Download Submit
C:\Windows\system\IkRXsxD.exe

Filesize
1.6MB

MD5
aa2de31db2f24e6733aa892ce814307e

SHA1
2ce5a88bef0afb48a6df860e7e0e18bd4764a371

SHA256
9d49d18e9d4325f0bcbb5246d8e7fdfcc381ca28dcb967e98b5448ec180c93ee

SHA512
261e4e92b1309809068873299ae4dffa9391d2ad597ef3d69fe86ac6c5a056f1a9ece5cb5d8995a48a1ff4c0929f97e2891e0856c1ca7001e4dd41bc79fe440f

Download Submit
C:\Windows\system\IpxJlpY.exe

Filesize
1.6MB

MD5
e3680085aaa3e9d66f07c7bb1ab6b179

SHA1
c3834a45342c60ca65faeef7ffc2a430101e1237

SHA256
4871df64d32048c77e01d866ff3f1bfc83b5f2724a5ae070d486353233738c91

SHA512
de1e1574d1051fb36a51171db01f5eaad8932765b88f448e5e271ef6d92979c0c227508fb32dedad53dc0a1592299df88513ceb7d2a1873811950d82b0c805ba

Download Submit
C:\Windows\system\XPMlsMy.exe

Filesize
1.6MB

MD5
d7da58b5838e58014fcaf86845a93cc3

SHA1
949c7f17a76ed564b1214a07ebfb36354cbfd517

SHA256
82e68d41b5fd924af230aed563c32272aa03a145e38ec3ca29dcab88bddd4b55

SHA512
d2bdcd967879779032c1a2774c5553fc8162ce7dd554ef6af54e40cae81bc2f7aa4b979879c568da179e79eaf8bb1c1910ebe66ad9ec5d11043070c4af54eebd

Download Submit
C:\Windows\system\YNBnbfQ.exe

Filesize
1.6MB

MD5
210dd3cf4ad1e092ff02aec261b28267

SHA1
a6fe5f393db04bcc7b9cdf9be17e7419a99426ec

SHA256
64ff3b467a7eae0492c03a31aa447d9d0222fd1b0be1b6f4d3a726ed433789d8

SHA512
685be7e3ccb4f74994af3edc53e3448dae4aed43c8d22f81f594f4baef501f33e1b18fe65e178ba09c287bdffc99ee4f2400b23a3c62b3ebeaecf8dc7eafc3a0

Download Submit
C:\Windows\system\bkfYQvg.exe

Filesize
1.6MB

MD5
c550441e8f8a87e36e715d8915b5e9c3

SHA1
f682a65106419a314823cc36fc6b021efc631ca8

SHA256
01df6c0bcf0f7fe3946023ebedbf1d329efbaca2626a098883ec926f824305ed

SHA512
2bdc502fea593b73793847747974b813d77dc16b7d0428aff175d53361573d8ddd2f25becf161219c1898d6ed679b934307b40a664670e170ef1ec9969e7df52

Download Submit
C:\Windows\system\fpERwPq.exe

Filesize
1.6MB

MD5
b23fe82a0fc494a61f18fd1ab006d2f4

SHA1
d405278d009c85befe82c05cb7ef040526a2d02c

SHA256
802df4e1044bc146d96174c488f4bd6935a42f5775a49c370c52bce86c0ac2e5

SHA512
e6bc4e0bcdd9a6dc187a205fe2eac9fbef031ab2204448e816e8f084342e9b6c585344ce526adeffbaa4321a1672e073d2639e650ace560c2dd596958f975f7f

Download Submit
C:\Windows\system\kmYpIux.exe

Filesize
1.6MB

MD5
24b2da199dbf89b0fe98dc32b305fa2f

SHA1
9bb4103d34f3921b59a10fbbc7a244aa555682f6

SHA256
5ea1b01d4ac72b9239fac5833d8d3330f91041302f9d2580ab3f7c8cdda3f586

SHA512
b6588e11a59fdbdba319e5d1a34897d4dbe7bc5ce3bee906d2c71ef0f8560ff867ccb9096ed16f396702f038339112172a4b438c678e43f88bc495df506db6b1

Download Submit
C:\Windows\system\mvMqYlH.exe

Filesize
1.6MB

MD5
5f0a96d523bd373b9cda8a812f9ee6b8

SHA1
52e6cfc60306c36a6f5b648657bb4f019831568d

SHA256
8e1f9ac1f064a1dcd31ca6b7f58d0ed7e97a8498fd80e9513beb9dcf78b801d0

SHA512
77af96f8826527c0cbde8789c685ff129ff3c5c7c9e783945edb1341e487389282b03cf3c8550ee93b4318d64d4655d5eaab7cbb0562cd8ae953480716c1de2f

Download Submit
C:\Windows\system\nnGlJts.exe

Filesize
1.6MB

MD5
89e9ddc9f66a92712de8dec889310c84

SHA1
11feaca32dabdc8dbd06291d43149e5509b7b24b

SHA256
9964ffb4ad41cc4276dd94e8f0e52876cc44b91629f8a43e57d591aa72613daa

SHA512
ca75737471363446b566592a249e6577e69d3c2b8622cebd3b0410d34fa0a7c78225470998b13b3754c7d9ec53ea421a212c65cc030e8a8c1bcdebfeb72ceefa

Download Submit
C:\Windows\system\nqZAoxI.exe

Filesize
1.6MB

MD5
afa3233c21c8210e445bd3cf3a2c98b4

SHA1
1eff938e669fe16fae32902605d281d2be3d3fc3

SHA256
56e7e81baeb2bb75daf9de181b639196b300b80063a671ac2d9d2af3dede74e6

SHA512
035351959fcc272a6f12e422a51f50c0d4bc88b8afb14d8db4ec43eefd1154ea0110122327a22675411cc8bcd964bd03905873b4779fdfaa565b2ef9cad35697

Download Submit
C:\Windows\system\onZwlgK.exe

Filesize
1.6MB

MD5
39c1b5b1a56144531117dde0b1ef9c23

SHA1
541cc178aecb4097852f5740c7fce52791b326c2

SHA256
09bd22a63d21f3866e8477f530289884dbea9a1583e541c22f989f7f28a59eb5

SHA512
ede721d81fc04c8552620406e7521babb8a44e0f89a9b2c7f1307133a0a6f7b551f9320989c9803221e42f829450550b9d88732642319eef2664f11ca66b380c

Download Submit
C:\Windows\system\pelcfOs.exe

Filesize
1.6MB

MD5
2b8583acfa132b6551d1a3820b4993df

SHA1
0e7313017544b4b741c7d82e4cd501edbb40a370

SHA256
407db01932572bff9ad80b3976bb01b10a41f4a2ae34f7b92f03b4130bf5854d

SHA512
c0caea4fd12caf2d56910ab780c18486ea87fdb68b71866451a60d332104e1b06b61f58f374bf57494170a1648792a4006f2eb6ac214ccaae25f47bf35a8781d

Download Submit
C:\Windows\system\tDlnqqw.exe

Filesize
1.6MB

MD5
540613ed72fe0ca209114f0215b14de9

SHA1
f2ac69cba917253b651285d5854be5ff7cc4aa0b

SHA256
be50fa88bf7c4f4420eb2a925605fa0f9cb597dbd06dd862600f56139865373d

SHA512
ca0746a417709d3bd8256d36dd0bbdb33338a690c847a150b1bf2a88990c840525f61e0356f378c107ec5ce406c3fec13d1cf2715182fca663b2964cf14fef8c

Download Submit
C:\Windows\system\vGNkBDm.exe

Filesize
1.6MB

MD5
aabdb455d5cf751fc2c10ea85ae73bdb

SHA1
c2b23df1c11f2a83b06a5c038f762e39ee4309de

SHA256
2fddf95c1bbd4f1dd7615f3d62307b473617b3d37d188257710afb3cec4a57af

SHA512
e81728c06fa4e0154ed8ec27af760117913b24854fc1d96a56d6f85fc24b85b7c0ab06c6718d9fd0b9c25271f6a1a165a9a52687fa2c865dd032c6c769fac3e5

Download Submit
C:\Windows\system\yfSXajV.exe

Filesize
1.6MB

MD5
0b844b7341778682c025e7f61b45daae

SHA1
f92951ca91791a9366c083d9a752ee01d5c24220

SHA256
7f13c56bcd579a91847c63bda4d1e67d69a849182bc0d681d4bbf81f4db4d5fe

SHA512
bfadc535fd03a9167306af43d45263261e2076584958467fbeff60aadb748e2c28d41bf3970bab6bde90ad2715d924f20a150bf82a2d712eb30e4282f00eb493

Download Submit
C:\Windows\system\zVSSltE.exe

Filesize
1.6MB

MD5
3eabca4dbdcce12d3d0fa7a4d547582e

SHA1
ec149e1956398c61bea6dc6fdcc5d249cb82e12e

SHA256
8c23bebf91dde566a1c144d848ef164890086b7271fa62280beeda12edda0cf7

SHA512
e929c4ec059f7320ca7023005f97d051da32c086d0e2d990de520db4d2472a4ee381390122c34aae60216d368dcbec9fb174f0f2f49aa4bd47f7d01bcf39d1c8

Download Submit
\Windows\system\CMQIImz.exe

Filesize
1.6MB

MD5
e354129f440ca1bee67c343bccbd4318

SHA1
ff5a8d72ce92d4a26f2fcccc4d022c935016cfd6

SHA256
30a9fced21b2433f678483c4dc4683de33c7d5473c35c9fb9080ce5435a6d0e0

SHA512
08a092b21d3dc89fa67eca66363838805a2f76a3f6e1fafa241bb8df9a7299cd9cff7e2502f6d112a386b0103041b2c2feb6ff4b7bc0634d97d4f9818b7b0bf6

Download Submit
\Windows\system\EPFLgTl.exe

Filesize
1.6MB

MD5
0702f0ce4654fb91a231b64841176c18

SHA1
4b08d7655a3cd47bf43d28a106f4802899b89e36

SHA256
8117d1f173eb944a8f4c2d874c967759ba396f88383410d3c9f5fcf00b04162e

SHA512
ccdfec083aa80b6119c0a89638cec05ec933253f0dcb182d2ceab28f543eb68f8e547934e456379d7cb1e8f4cd17047660a4133700e32e1129e7a40452988842

Download Submit
\Windows\system\IQilvMi.exe

Filesize
1.6MB

MD5
96d44c4952f201ad01832dad12d10f11

SHA1
ba9dbe636ded77b570c6c4c33a7e11c81862bff2

SHA256
d1903cf0d23e23192d2f1926b5bb25fc72342e7028a0fa57c874c179b5cff9ad

SHA512
7d630de2e843eb9adc959bcceb499a1e16808716ddb3edf0a34d8c678edb1d92d1f066f998e47a6dec074b5a9c363ddea9ab153f465769a90af25c8341871188

Download Submit
\Windows\system\MJioGZk.exe

Filesize
1.6MB

MD5
43015849236f8a8abdab92b60fb885e1

SHA1
ebab554d4716f70a5c42c781ace866ce6ca90328

SHA256
96595c9d0220029e184913320634bca5773f64ad23cbc88b741478b910caa3a4

SHA512
c826f92d2e44dcea6ae4124419d961218c6f2765a847cf5f61c3b001b057fe6ad83994375e616860c93670526d77644bf3501a509aa279234c0e6350e10e88ea

Download Submit
\Windows\system\MJnPAkm.exe

Filesize
1.6MB

MD5
387bbaa227a3d94b0f1ce3e70344cd6e

SHA1
c7f6275f9a579ef295a9875f304a2bbdd873d366

SHA256
65c949b420d6f44136722d5dda556c05bdba3124dafb9f4b1ca0ff797f22d582

SHA512
2a6d1c2091041f52d9a34a7543972c6c23c75ef8c801918415d5f4848d1afcb3bfd1bf2407e18fb491a482c9d6f23b767a9e10af15a4b4d05ff9210e6304a2d9

Download Submit
\Windows\system\NTEBTVw.exe

Filesize
1.6MB

MD5
efc9cfe77a1afa4c3191056311fcd85d

SHA1
82f6f797a21a606c9e0e7fac374a3e754b04afa4

SHA256
4d3db9ab8f0a8bb333e4179a4ba1c414642cc8dc7cf7b9f308c1c008a3943e2e

SHA512
c2f4bfafdf8204354afe1d1cd451c788c594972c52df24bdf2d3e8de35a8a9bba35babc2b9fefb611cd0b374048f0bb5399dfb3c93b36fa1cfb666baa8d5b60b

Download Submit
\Windows\system\RBfdtXV.exe

Filesize
1.6MB

MD5
c8ca411e245766cfdf08c782a81c2157

SHA1
16297c206d421225bbf442538210e5be919873b5

SHA256
e0775e9dd4f82a81c0cd8008528101fa330d80ca03ab862b4eb9cc73d14ef615

SHA512
07d01d991013e42cd3e0346ddf512ecbea0d76bd4ab8a9c59afe37220c20e4d27f98a41ce007f97b1966a437a5f4bfafd560c5cf61882ec43d4727cebd4ee1fa

Download Submit
\Windows\system\SbMGKNe.exe

Filesize
1.6MB

MD5
2caeb5cef69aadee14967442a5c6cc88

SHA1
a1e49ea542c393d5cf0f78c94e28d2c58dd08b09

SHA256
b9f9212e9d08d47bc1eaa108462c5f4c7e10d5638f20d6f95a7403fb215c7acb

SHA512
1620431eddeb686d1092a4df982f560d6170b6b469309c30163f0dfed6e49a597b611701a05bde2842a8f33a3041565a28da54325474ec7cde64f2b0f49764e5

Download Submit
\Windows\system\UKvolfh.exe

Filesize
1.6MB

MD5
9724005b2d6f61c8b65d96cd4fd36e4b

SHA1
950d1104afe8b9d45e441401fe138eae03aa305c

SHA256
352f4dd69f20919749c519543a51de66ee68ad85c9a811ccfc3575f68db826bd

SHA512
102e93df922cd8ade8972ce81c4e62f2dcf49ea13bb58a23e94b7ca5be4dec467f08886480f2ed72139eeb6935ac81dd64d2372a83ece6029708bed164ea6bf3

Download Submit
\Windows\system\ZfKjWbr.exe

Filesize
1.6MB

MD5
3d4bb2481090a5739698b0ab3614149b

SHA1
b7a4017d60b8c0a87433683e0cc374bee34adbf3

SHA256
109cd1bb2f2073c008a7503917aacd03d2520f96726d47b07f750971d7642a6b

SHA512
777fa484b9e2ff2892ff27ede5f2b283379732f4c54adc2c335c239de4f235eedb3fb30fade622623f9128f46405ba421a19f2e1171fc02af2cc5b9b52996d6e

Download Submit
\Windows\system\bDkuUTW.exe

Filesize
1.6MB

MD5
0044fd5256f68f50d64d084fb82afe0f

SHA1
8cb79d83bf5516455a107d3946b2d16f958284d1

SHA256
56a8d297dc5eafc07fde47f15af103b3379f515f7c5fbdb829f3ebd9c73829cd

SHA512
19ec2eb290aebb49f96c9d4becfb9d8c1d9a02bf17f024fca69f3b5a1ac612ea3d3de18154816aac15addae954f49ac798e476008c424a8e41e6fc1fbdd5ca35

Download Submit
\Windows\system\ckoXFTW.exe

Filesize
1.6MB

MD5
ae9a22c7336024d2f75ffdee0e0a52b8

SHA1
12af3e8d1abfb45beee36274152ca4c51485c1ca

SHA256
cb6b6b82d8002407f542c7c90490813fc1797984dca894edb12246e75e879add

SHA512
af29beba1711eec064dff500ef6eb79daf078bd423ec60c03db721394cfe1184e4cc6552018c422073dc87fc333926feb090f560d1cf8634abd02dfcf25585bb

Download Submit
\Windows\system\jnkOntL.exe

Filesize
1.6MB

MD5
22f117f66e25b56b566dc38f4846b013

SHA1
d5326b65139bc185d152ab73177418705356c69b

SHA256
994db04a64adc427c009e3b3572e03e15f733c148069933907ceca1306b47ef5

SHA512
36194a17b258c7a0a1e2ee6cadbc07bbd7a880945d1a46b38c8710d29ddd1a3d3260cdd503bc3068286978d065dc9166751d3506d6dc5ecd7ec42b2b4c28203a

Download Submit
\Windows\system\mzqVPlR.exe

Filesize
1.6MB

MD5
0af29a5a7449f7ed0fc396adf9e0151f

SHA1
35a179d3728827fa0e3bf913a64f1c601bac9283

SHA256
d1b9249962d2d209d2d35832d21a625bd86d3172fabb9a677dbe0d2bf6a5966f

SHA512
1140b7575a0453b6dc1398821af7f5f655a53d4881da2f75355e4ba3499d22e0e4805ade7719cde5641380bda70b3b3456be4b6d3c088451a7afa9e007c04506

Download Submit
\Windows\system\ovvjhwE.exe

Filesize
1.6MB

MD5
1fd284ef6b5b4637715610d07b5863db

SHA1
9e1f0316a9ca1a7fc51cf719059f8ae2486b3d7d

SHA256
c43ea3903dbbd0e7a984cbec81a2aa22e5d1f564d48ecac1babc57c2942c93c7

SHA512
c02bf4ee77d7aac1b06f27e59a9d8326d77f3280d1764acce76cf4675b743fbf057fc13384d9b20808571b6c8a3f608c531d9cf8f6d314b3f9261abb304d0892

Download Submit
\Windows\system\rufGgWp.exe

Filesize
1.6MB

MD5
f6033fd3af8bee794ec9c81ed00741e6

SHA1
747a18df457ebbb2d1e6c353bbdf9168d68f277d

SHA256
7984b2aab5ef86e57f6bbbcf930477a772112ba0c4c3e7cf3d140240b57ff5bf

SHA512
ad55b53eb17b42e25ce1b65e7d9f44e62be536701e457f3ba62b2f727a216067f659f856cf3eb1b109fda831610f79f52bffae907168a0b8e1ce9c26c5c79062

Download Submit
\Windows\system\vzlmfHV.exe

Filesize
1.6MB

MD5
5b7bcecb99ada76a3848144101cd2093

SHA1
be1fbf1e213cb504ed53e347b80c4cb561de1cbc

SHA256
726a142480a070d17a61ef102dc60a8c139f2b11d31d8e7c040e45293a637527

SHA512
f49ff6adcca08e3eacb36ae0f5ad5fc913ca5a1cefaf433986919a3c8ea66e7ed4cdb4992d730c0031e90c4e5b082967ef4c47b3c422e7deb4043af3f57e6fb0

Download Submit
\Windows\system\yAfNEvu.exe

Filesize
1.6MB

MD5
f808b588a67e0fddccb01983d50fad97

SHA1
02d4692fc61c9d4da103871879fbf6dbf9898495

SHA256
1b7effcb26b588a36eb732ab664a683157574476a6ffe9c055fd0c9e61bfaf62

SHA512
3303f70dbb3b01dce83e39edceed8f097c6f3f091e8aab576e9007af38408b66c72577d8d594cbfa90364d61374d469fd459c993d48f7c8d89b44763736aa3e9

Download Submit
memory/1672-14-0x000000013F4C0000-0x000000013F8B2000-memory.dmp

Filesize
3.9MB

Download
memory/1672-284-0x000000013F4C0000-0x000000013F8B2000-memory.dmp

Filesize
3.9MB

Download
memory/1868-368-0x000000013F8A0000-0x000000013FC92000-memory.dmp

Filesize
3.9MB

Download
memory/1984-374-0x000000013F0C0000-0x000000013F4B2000-memory.dmp

Filesize
3.9MB

Download
memory/1996-370-0x000000013F790000-0x000000013FB82000-memory.dmp

Filesize
3.9MB

Download
memory/2144-8-0x000000013F290000-0x000000013F682000-memory.dmp

Filesize
3.9MB

Download
memory/2144-5016-0x000000013F290000-0x000000013F682000-memory.dmp

Filesize
3.9MB

Download
memory/2152-51-0x000000013F710000-0x000000013FB02000-memory.dmp

Filesize
3.9MB

Download
memory/2152-88-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/2152-0-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2152-13-0x000000013F4C0000-0x000000013F8B2000-memory.dmp

Filesize
3.9MB

Download
memory/2152-74-0x0000000003080000-0x0000000003472000-memory.dmp

Filesize
3.9MB

Download
memory/2152-78-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download
memory/2152-67-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/2152-79-0x000000013F790000-0x000000013FB82000-memory.dmp

Filesize
3.9MB

Download
memory/2152-49-0x000000013FC40000-0x0000000140032000-memory.dmp

Filesize
3.9MB

Download
memory/2152-65-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download
memory/2152-531-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2152-235-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2152-1-0x0000000000200000-0x0000000000210000-memory.dmp

Filesize
64KB

Download
memory/2152-75-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/2152-295-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2152-4950-0x0000000003080000-0x0000000003472000-memory.dmp

Filesize
3.9MB

Download
memory/2192-42-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/2192-619-0x000007FEF620E000-0x000007FEF620F000-memory.dmp

Filesize
4KB

Download
memory/2192-36-0x0000000001F40000-0x0000000001F48000-memory.dmp

Filesize
32KB

Download
memory/2192-620-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/2192-19-0x000007FEF620E000-0x000007FEF620F000-memory.dmp

Filesize
4KB

Download
memory/2192-450-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/2192-41-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/2192-970-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/2192-537-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/2192-45-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/2192-32-0x000000001B480000-0x000000001B762000-memory.dmp

Filesize
2.9MB

Download
memory/2300-4991-0x000000013F060000-0x000000013F452000-memory.dmp

Filesize
3.9MB

Download
memory/2300-622-0x000000013F060000-0x000000013F452000-memory.dmp

Filesize
3.9MB

Download
memory/2300-73-0x000000013F060000-0x000000013F452000-memory.dmp

Filesize
3.9MB

Download
memory/2404-376-0x000000013F4E0000-0x000000013F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/2644-72-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download
memory/2644-317-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download
memory/2644-3261-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download
memory/2692-315-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/2760-50-0x000000013FC40000-0x0000000140032000-memory.dmp

Filesize
3.9MB

Download
memory/2864-48-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2864-2892-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2868-377-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/2888-4206-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download
memory/2888-77-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download
memory/2892-61-0x000000013F710000-0x000000013FB02000-memory.dmp

Filesize
3.9MB

Download
memory/2912-4174-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/2912-92-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/2912-372-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/2924-375-0x000000013F9E0000-0x000000013FDD2000-memory.dmp

Filesize
3.9MB

Download
memory/2968-76-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/2968-3427-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download