xmrig | 94d608f28f6ed5142d5c7bb0bea1ca9c84b5d91457b35806553981690fb9e9c9

Analysis

max time kernel
119s
max time network
117s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 11:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bad1dea2682fd1f0291cbff7c7185f90N.exe
Size

1.2MB
MD5

bad1dea2682fd1f0291cbff7c7185f90
SHA1

5bb240b775dc4b513528cf576c9622e47b74463f
SHA256

94d608f28f6ed5142d5c7bb0bea1ca9c84b5d91457b35806553981690fb9e9c9
SHA512

c7a3a600ad75a4702716c76708fd9727f0be0e9252a2d5147f0f94e5f9b8b006d90ed825de6d6cd69ca36784f4493764b3cde03ced17110f97407da322cb47b0
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwg3Hl5pCB:Lz071uv4BPMkHC0IlnAC7+

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 24 IoCs

miner

resource	yara_rule
behavioral1/memory/1116-9-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	xmrig
behavioral1/memory/2324-452-0x000000013FDD0000-0x00000001401C2000-memory.dmp	xmrig
behavioral1/memory/2668-450-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	xmrig
behavioral1/memory/2636-448-0x000000013FDE0000-0x00000001401D2000-memory.dmp	xmrig
behavioral1/memory/2804-446-0x000000013FB00000-0x000000013FEF2000-memory.dmp	xmrig
behavioral1/memory/2660-444-0x000000013FCB0000-0x00000001400A2000-memory.dmp	xmrig
behavioral1/memory/2912-442-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	xmrig
behavioral1/memory/2224-440-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	xmrig
behavioral1/memory/2760-438-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	xmrig
behavioral1/memory/2920-436-0x000000013F450000-0x000000013F842000-memory.dmp	xmrig
behavioral1/memory/2744-435-0x000000013F930000-0x000000013FD22000-memory.dmp	xmrig
behavioral1/memory/2128-432-0x000000013FCE0000-0x00000001400D2000-memory.dmp	xmrig
behavioral1/memory/2760-4537-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	xmrig
behavioral1/memory/2660-4539-0x000000013FCB0000-0x00000001400A2000-memory.dmp	xmrig
behavioral1/memory/1116-4540-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	xmrig
behavioral1/memory/2804-4538-0x000000013FB00000-0x000000013FEF2000-memory.dmp	xmrig
behavioral1/memory/2668-4547-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	xmrig
behavioral1/memory/2744-4554-0x000000013F930000-0x000000013FD22000-memory.dmp	xmrig
behavioral1/memory/2912-4543-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	xmrig
behavioral1/memory/2224-4544-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	xmrig
behavioral1/memory/2128-4578-0x000000013FCE0000-0x00000001400D2000-memory.dmp	xmrig
behavioral1/memory/2324-4650-0x000000013FDD0000-0x00000001401C2000-memory.dmp	xmrig
behavioral1/memory/2636-4645-0x000000013FDE0000-0x00000001401D2000-memory.dmp	xmrig
behavioral1/memory/2920-4648-0x000000013F450000-0x000000013F842000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2972	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1116	JYDRBHq.exe
2128	BAHMgap.exe
2744	pEQVLeu.exe
2920	mSTRXqT.exe
2760	AwDHKzF.exe
2224	EVXGIYm.exe
2912	ukAJRQo.exe
2660	PGDXsHw.exe
2804	fmbQhcf.exe
2636	jAbGMQD.exe
2668	IMRexRt.exe
2324	fJjNJqi.exe
604	FVSoOvM.exe
1928	PEtFQfJ.exe
2996	XoBbyem.exe
2984	uMXojbd.exe
2624	QhubAqN.exe
2852	Ifbyqea.exe
1748	ABKxUvg.exe
1792	jYRvbiK.exe
1944	leTfJCm.exe
1420	CNAFTSh.exe
1548	oCYIfNR.exe
844	kCyvZQr.exe
2132	UysEWNW.exe
2364	BUnhumc.exe
3052	gRRIxdM.exe
2828	CJzdVeT.exe
1064	GgXOpBJ.exe
1032	XExCkrC.exe
1612	wrpyuaz.exe
888	JfVXLDm.exe
2212	NJrVqVf.exe
536	HPMGFVw.exe
2444	MhZOKDR.exe
324	GBlrxdO.exe
2416	taDModT.exe
1688	MkSbxhQ.exe
1524	ZEiRHsd.exe
592	QvzOStX.exe
448	FKXwZeo.exe
2752	gbWbwVJ.exe
2748	WxwDGFJ.exe
2756	ajmWqzi.exe
680	UxLNtLY.exe
1196	tazXzLD.exe
2600	SjqTswR.exe
2204	szsRvft.exe
2256	igZCZBj.exe
1092	RhlvTcu.exe
2908	vYGxPEi.exe
2456	JqVQCTu.exe
1768	jbEawvu.exe
876	AsKKREI.exe
1540	nVZcRbG.exe
2068	vyyTSgz.exe
596	cSIbjJv.exe
2160	CXxbOOu.exe
288	WxCyTcc.exe
2176	LkezHkM.exe
1512	SpcTmba.exe
924	MrCHcYf.exe
3108	GdGkgaX.exe
3152	WcneJME.exe

Loads dropped DLL 64 IoCs

pid	Process
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
1580	bad1dea2682fd1f0291cbff7c7185f90N.exe

UPX packed file 59 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1580-0-0x000000013F840000-0x000000013FC32000-memory.dmp	upx
behavioral1/files/0x000700000001211a-6.dat	upx
behavioral1/memory/1116-9-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	upx
behavioral1/files/0x000700000001870f-10.dat	upx
behavioral1/files/0x0007000000004e74-28.dat	upx
behavioral1/files/0x0006000000019244-37.dat	upx
behavioral1/files/0x000600000001924a-43.dat	upx
behavioral1/files/0x0008000000019259-48.dat	upx
behavioral1/files/0x000800000001925d-52.dat	upx
behavioral1/files/0x00050000000194ba-62.dat	upx
behavioral1/files/0x000500000001951c-67.dat	upx
behavioral1/files/0x00050000000195a6-77.dat	upx
behavioral1/files/0x0005000000019620-98.dat	upx
behavioral1/files/0x0005000000019621-103.dat	upx
behavioral1/files/0x0005000000019626-117.dat	upx
behavioral1/files/0x0005000000019702-146.dat	upx
behavioral1/files/0x000500000001962a-127.dat	upx
behavioral1/files/0x000500000001967e-140.dat	upx
behavioral1/files/0x0005000000019d3c-172.dat	upx
behavioral1/files/0x0005000000019c6b-169.dat	upx
behavioral1/files/0x0005000000019c50-152.dat	upx
behavioral1/memory/2324-452-0x000000013FDD0000-0x00000001401C2000-memory.dmp	upx
behavioral1/memory/2668-450-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	upx
behavioral1/memory/2636-448-0x000000013FDE0000-0x00000001401D2000-memory.dmp	upx
behavioral1/memory/2804-446-0x000000013FB00000-0x000000013FEF2000-memory.dmp	upx
behavioral1/memory/2660-444-0x000000013FCB0000-0x00000001400A2000-memory.dmp	upx
behavioral1/memory/2912-442-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	upx
behavioral1/memory/2224-440-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/memory/2760-438-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	upx
behavioral1/memory/2920-436-0x000000013F450000-0x000000013F842000-memory.dmp	upx
behavioral1/memory/2744-435-0x000000013F930000-0x000000013FD22000-memory.dmp	upx
behavioral1/memory/2128-432-0x000000013FCE0000-0x00000001400D2000-memory.dmp	upx
behavioral1/files/0x0005000000019c53-166.dat	upx
behavioral1/files/0x0005000000019c51-161.dat	upx
behavioral1/files/0x0005000000019994-160.dat	upx
behavioral1/files/0x00050000000196bf-143.dat	upx
behavioral1/files/0x000500000001963a-133.dat	upx
behavioral1/files/0x0005000000019628-123.dat	upx
behavioral1/files/0x0005000000019624-113.dat	upx
behavioral1/files/0x0005000000019622-107.dat	upx
behavioral1/files/0x000500000001961e-92.dat	upx
behavioral1/files/0x000500000001961c-88.dat	upx
behavioral1/files/0x00050000000195e5-82.dat	upx
behavioral1/files/0x0005000000019524-72.dat	upx
behavioral1/files/0x00050000000194a4-57.dat	upx
behavioral1/files/0x00070000000191f1-33.dat	upx
behavioral1/files/0x0007000000018712-21.dat	upx
behavioral1/memory/2760-4537-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	upx
behavioral1/memory/2660-4539-0x000000013FCB0000-0x00000001400A2000-memory.dmp	upx
behavioral1/memory/1116-4540-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	upx
behavioral1/memory/2804-4538-0x000000013FB00000-0x000000013FEF2000-memory.dmp	upx
behavioral1/memory/2668-4547-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	upx
behavioral1/memory/2744-4554-0x000000013F930000-0x000000013FD22000-memory.dmp	upx
behavioral1/memory/2912-4543-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	upx
behavioral1/memory/2224-4544-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/memory/2128-4578-0x000000013FCE0000-0x00000001400D2000-memory.dmp	upx
behavioral1/memory/2324-4650-0x000000013FDD0000-0x00000001401C2000-memory.dmp	upx
behavioral1/memory/2636-4645-0x000000013FDE0000-0x00000001401D2000-memory.dmp	upx
behavioral1/memory/2920-4648-0x000000013F450000-0x000000013F842000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ddgiusX.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\IWdgYZf.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\sWNPwvK.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\DaAWsWz.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\hFlyTNM.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\YofNOcy.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\pBuuFoE.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\pKzEbNX.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\OqjqQgP.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\rZezCmK.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\eVPaxwD.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\RelLjVr.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\FAHljal.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\EtDQeqX.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\SmnwgSN.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\WRmHWMV.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\UAefEQI.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\rQWKuwD.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\MImgCFM.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\wOsvymt.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\xiOycSy.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\HhkWnSN.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\cCNvnuT.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\nLpApCB.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\lsnpPyg.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\cSrYphf.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\kYlMfyD.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\LiwArtT.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\RAFjOfH.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\PEtFQfJ.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\DLdCPpB.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\FgsciGg.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\zvLWIyq.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\IyoUfwb.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\eYmXtxu.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\VfPmsbY.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\jqlVyhh.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\ccwWUZf.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\VymURLr.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\pEqntUA.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\gTVMKzP.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\qoBoyJF.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\EjxtUlQ.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\OlLVrsj.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\rtqBefA.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\iONgRrI.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\FZCZlfm.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\whieRpV.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\tCGQmWA.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\TKXCOYJ.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\obChram.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\dkhXNMN.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\dsegjNv.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\ugckocR.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\vZFyEtV.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\fHHCvch.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\MzVDcba.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\udSErRu.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\HjJPdjA.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\MZDCfao.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\jztCYai.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\gBSZICe.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\dBEkiQx.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe
File created	C:\Windows\System\YOUVQHe.exe	bad1dea2682fd1f0291cbff7c7185f90N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2972	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
Token: SeLockMemoryPrivilege	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe
Token: SeDebugPrivilege	2972	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 2972	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	31
PID 1580 wrote to memory of 2972	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	31
PID 1580 wrote to memory of 2972	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	31
PID 1580 wrote to memory of 1116	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	32
PID 1580 wrote to memory of 1116	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	32
PID 1580 wrote to memory of 1116	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	32
PID 1580 wrote to memory of 2128	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	33
PID 1580 wrote to memory of 2128	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	33
PID 1580 wrote to memory of 2128	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	33
PID 1580 wrote to memory of 2744	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	34
PID 1580 wrote to memory of 2744	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	34
PID 1580 wrote to memory of 2744	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	34
PID 1580 wrote to memory of 2920	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	35
PID 1580 wrote to memory of 2920	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	35
PID 1580 wrote to memory of 2920	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	35
PID 1580 wrote to memory of 2760	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	36
PID 1580 wrote to memory of 2760	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	36
PID 1580 wrote to memory of 2760	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	36
PID 1580 wrote to memory of 2224	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	37
PID 1580 wrote to memory of 2224	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	37
PID 1580 wrote to memory of 2224	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	37
PID 1580 wrote to memory of 2912	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	38
PID 1580 wrote to memory of 2912	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	38
PID 1580 wrote to memory of 2912	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	38
PID 1580 wrote to memory of 2660	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	39
PID 1580 wrote to memory of 2660	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	39
PID 1580 wrote to memory of 2660	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	39
PID 1580 wrote to memory of 2804	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	40
PID 1580 wrote to memory of 2804	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	40
PID 1580 wrote to memory of 2804	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	40
PID 1580 wrote to memory of 2636	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	41
PID 1580 wrote to memory of 2636	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	41
PID 1580 wrote to memory of 2636	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	41
PID 1580 wrote to memory of 2668	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	42
PID 1580 wrote to memory of 2668	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	42
PID 1580 wrote to memory of 2668	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	42
PID 1580 wrote to memory of 2324	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	43
PID 1580 wrote to memory of 2324	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	43
PID 1580 wrote to memory of 2324	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	43
PID 1580 wrote to memory of 604	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	44
PID 1580 wrote to memory of 604	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	44
PID 1580 wrote to memory of 604	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	44
PID 1580 wrote to memory of 1928	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	45
PID 1580 wrote to memory of 1928	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	45
PID 1580 wrote to memory of 1928	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	45
PID 1580 wrote to memory of 2996	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	46
PID 1580 wrote to memory of 2996	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	46
PID 1580 wrote to memory of 2996	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	46
PID 1580 wrote to memory of 2984	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	47
PID 1580 wrote to memory of 2984	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	47
PID 1580 wrote to memory of 2984	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	47
PID 1580 wrote to memory of 2624	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	48
PID 1580 wrote to memory of 2624	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	48
PID 1580 wrote to memory of 2624	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	48
PID 1580 wrote to memory of 2852	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	49
PID 1580 wrote to memory of 2852	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	49
PID 1580 wrote to memory of 2852	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	49
PID 1580 wrote to memory of 1748	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	50
PID 1580 wrote to memory of 1748	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	50
PID 1580 wrote to memory of 1748	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	50
PID 1580 wrote to memory of 1792	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	51
PID 1580 wrote to memory of 1792	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	51
PID 1580 wrote to memory of 1792	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	51
PID 1580 wrote to memory of 1944	1580	bad1dea2682fd1f0291cbff7c7185f90N.exe	52

C:\Users\Admin\AppData\Local\Temp\bad1dea2682fd1f0291cbff7c7185f90N.exe
"C:\Users\Admin\AppData\Local\Temp\bad1dea2682fd1f0291cbff7c7185f90N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2972
- C:\Windows\System\JYDRBHq.exe
  C:\Windows\System\JYDRBHq.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\BAHMgap.exe
  C:\Windows\System\BAHMgap.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\pEQVLeu.exe
  C:\Windows\System\pEQVLeu.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\mSTRXqT.exe
  C:\Windows\System\mSTRXqT.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\AwDHKzF.exe
  C:\Windows\System\AwDHKzF.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\EVXGIYm.exe
  C:\Windows\System\EVXGIYm.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\ukAJRQo.exe
  C:\Windows\System\ukAJRQo.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\PGDXsHw.exe
  C:\Windows\System\PGDXsHw.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\fmbQhcf.exe
  C:\Windows\System\fmbQhcf.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\jAbGMQD.exe
  C:\Windows\System\jAbGMQD.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\IMRexRt.exe
  C:\Windows\System\IMRexRt.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\fJjNJqi.exe
  C:\Windows\System\fJjNJqi.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\FVSoOvM.exe
  C:\Windows\System\FVSoOvM.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\PEtFQfJ.exe
  C:\Windows\System\PEtFQfJ.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\XoBbyem.exe
  C:\Windows\System\XoBbyem.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\uMXojbd.exe
  C:\Windows\System\uMXojbd.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\QhubAqN.exe
  C:\Windows\System\QhubAqN.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\Ifbyqea.exe
  C:\Windows\System\Ifbyqea.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\ABKxUvg.exe
  C:\Windows\System\ABKxUvg.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\jYRvbiK.exe
  C:\Windows\System\jYRvbiK.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\leTfJCm.exe
  C:\Windows\System\leTfJCm.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\CNAFTSh.exe
  C:\Windows\System\CNAFTSh.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\oCYIfNR.exe
  C:\Windows\System\oCYIfNR.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\kCyvZQr.exe
  C:\Windows\System\kCyvZQr.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\UysEWNW.exe
  C:\Windows\System\UysEWNW.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\BUnhumc.exe
  C:\Windows\System\BUnhumc.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\gRRIxdM.exe
  C:\Windows\System\gRRIxdM.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\FKXwZeo.exe
  C:\Windows\System\FKXwZeo.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\CJzdVeT.exe
  C:\Windows\System\CJzdVeT.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\igZCZBj.exe
  C:\Windows\System\igZCZBj.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\GgXOpBJ.exe
  C:\Windows\System\GgXOpBJ.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\XExCkrC.exe
  C:\Windows\System\XExCkrC.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\RhlvTcu.exe
  C:\Windows\System\RhlvTcu.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\wrpyuaz.exe
  C:\Windows\System\wrpyuaz.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\bjlgiAd.exe
  C:\Windows\System\bjlgiAd.exe
  2⤵
  PID:1736
- C:\Windows\System\JfVXLDm.exe
  C:\Windows\System\JfVXLDm.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\ySDUUYQ.exe
  C:\Windows\System\ySDUUYQ.exe
  2⤵
  PID:1596
- C:\Windows\System\NJrVqVf.exe
  C:\Windows\System\NJrVqVf.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\zRjrgnp.exe
  C:\Windows\System\zRjrgnp.exe
  2⤵
  PID:2604
- C:\Windows\System\HPMGFVw.exe
  C:\Windows\System\HPMGFVw.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\ovcNdnk.exe
  C:\Windows\System\ovcNdnk.exe
  2⤵
  PID:2556
- C:\Windows\System\MhZOKDR.exe
  C:\Windows\System\MhZOKDR.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\kZDQTOJ.exe
  C:\Windows\System\kZDQTOJ.exe
  2⤵
  PID:1680
- C:\Windows\System\GBlrxdO.exe
  C:\Windows\System\GBlrxdO.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\ZBjlCmj.exe
  C:\Windows\System\ZBjlCmj.exe
  2⤵
  PID:1604
- C:\Windows\System\taDModT.exe
  C:\Windows\System\taDModT.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\DDsUMmG.exe
  C:\Windows\System\DDsUMmG.exe
  2⤵
  PID:2448
- C:\Windows\System\MkSbxhQ.exe
  C:\Windows\System\MkSbxhQ.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\hoPNAGf.exe
  C:\Windows\System\hoPNAGf.exe
  2⤵
  PID:772
- C:\Windows\System\ZEiRHsd.exe
  C:\Windows\System\ZEiRHsd.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\yravclZ.exe
  C:\Windows\System\yravclZ.exe
  2⤵
  PID:2888
- C:\Windows\System\QvzOStX.exe
  C:\Windows\System\QvzOStX.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\QnNUeOm.exe
  C:\Windows\System\QnNUeOm.exe
  2⤵
  PID:2784
- C:\Windows\System\gbWbwVJ.exe
  C:\Windows\System\gbWbwVJ.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\KDCkQxN.exe
  C:\Windows\System\KDCkQxN.exe
  2⤵
  PID:2664
- C:\Windows\System\WxwDGFJ.exe
  C:\Windows\System\WxwDGFJ.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\Zhmpjjs.exe
  C:\Windows\System\Zhmpjjs.exe
  2⤵
  PID:2648
- C:\Windows\System\ajmWqzi.exe
  C:\Windows\System\ajmWqzi.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\ABFgFwM.exe
  C:\Windows\System\ABFgFwM.exe
  2⤵
  PID:1544
- C:\Windows\System\UxLNtLY.exe
  C:\Windows\System\UxLNtLY.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\kThrTTj.exe
  C:\Windows\System\kThrTTj.exe
  2⤵
  PID:2736
- C:\Windows\System\tazXzLD.exe
  C:\Windows\System\tazXzLD.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\DxOPtSL.exe
  C:\Windows\System\DxOPtSL.exe
  2⤵
  PID:2820
- C:\Windows\System\SjqTswR.exe
  C:\Windows\System\SjqTswR.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\kuJFnyT.exe
  C:\Windows\System\kuJFnyT.exe
  2⤵
  PID:1796
- C:\Windows\System\szsRvft.exe
  C:\Windows\System\szsRvft.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\zrPPFgo.exe
  C:\Windows\System\zrPPFgo.exe
  2⤵
  PID:560
- C:\Windows\System\vYGxPEi.exe
  C:\Windows\System\vYGxPEi.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\rHMlshW.exe
  C:\Windows\System\rHMlshW.exe
  2⤵
  PID:2692
- C:\Windows\System\JqVQCTu.exe
  C:\Windows\System\JqVQCTu.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\plPfyGW.exe
  C:\Windows\System\plPfyGW.exe
  2⤵
  PID:2864
- C:\Windows\System\jbEawvu.exe
  C:\Windows\System\jbEawvu.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\hyMWYlv.exe
  C:\Windows\System\hyMWYlv.exe
  2⤵
  PID:1560
- C:\Windows\System\AsKKREI.exe
  C:\Windows\System\AsKKREI.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\LOyNMLc.exe
  C:\Windows\System\LOyNMLc.exe
  2⤵
  PID:960
- C:\Windows\System\nVZcRbG.exe
  C:\Windows\System\nVZcRbG.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\jZBCUmW.exe
  C:\Windows\System\jZBCUmW.exe
  2⤵
  PID:1696
- C:\Windows\System\vyyTSgz.exe
  C:\Windows\System\vyyTSgz.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\IRdMmoN.exe
  C:\Windows\System\IRdMmoN.exe
  2⤵
  PID:1296
- C:\Windows\System\cSIbjJv.exe
  C:\Windows\System\cSIbjJv.exe
  2⤵
  - Executes dropped EXE
  PID:596
- C:\Windows\System\CVAswQY.exe
  C:\Windows\System\CVAswQY.exe
  2⤵
  PID:3004
- C:\Windows\System\CXxbOOu.exe
  C:\Windows\System\CXxbOOu.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\PEdbEyQ.exe
  C:\Windows\System\PEdbEyQ.exe
  2⤵
  PID:2104
- C:\Windows\System\WxCyTcc.exe
  C:\Windows\System\WxCyTcc.exe
  2⤵
  - Executes dropped EXE
  PID:288
- C:\Windows\System\laKJPMa.exe
  C:\Windows\System\laKJPMa.exe
  2⤵
  PID:1920
- C:\Windows\System\LkezHkM.exe
  C:\Windows\System\LkezHkM.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\IqIgHCn.exe
  C:\Windows\System\IqIgHCn.exe
  2⤵
  PID:376
- C:\Windows\System\SpcTmba.exe
  C:\Windows\System\SpcTmba.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\PYKsYNh.exe
  C:\Windows\System\PYKsYNh.exe
  2⤵
  PID:2880
- C:\Windows\System\MrCHcYf.exe
  C:\Windows\System\MrCHcYf.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\mDuhOCh.exe
  C:\Windows\System\mDuhOCh.exe
  2⤵
  PID:3088
- C:\Windows\System\GdGkgaX.exe
  C:\Windows\System\GdGkgaX.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\ugckocR.exe
  C:\Windows\System\ugckocR.exe
  2⤵
  PID:3128
- C:\Windows\System\WcneJME.exe
  C:\Windows\System\WcneJME.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\WrXUXoi.exe
  C:\Windows\System\WrXUXoi.exe
  2⤵
  PID:3168
- C:\Windows\System\OjTgXmz.exe
  C:\Windows\System\OjTgXmz.exe
  2⤵
  PID:3188
- C:\Windows\System\NEojDKZ.exe
  C:\Windows\System\NEojDKZ.exe
  2⤵
  PID:3204
- C:\Windows\System\WTsPICK.exe
  C:\Windows\System\WTsPICK.exe
  2⤵
  PID:3220
- C:\Windows\System\wUGXjtO.exe
  C:\Windows\System\wUGXjtO.exe
  2⤵
  PID:3236
- C:\Windows\System\rZaKJiz.exe
  C:\Windows\System\rZaKJiz.exe
  2⤵
  PID:3252
- C:\Windows\System\sEdJjai.exe
  C:\Windows\System\sEdJjai.exe
  2⤵
  PID:3268
- C:\Windows\System\PInSODa.exe
  C:\Windows\System\PInSODa.exe
  2⤵
  PID:3284
- C:\Windows\System\VqxHFRg.exe
  C:\Windows\System\VqxHFRg.exe
  2⤵
  PID:3300
- C:\Windows\System\ZebmNAe.exe
  C:\Windows\System\ZebmNAe.exe
  2⤵
  PID:3316
- C:\Windows\System\SmJgIdA.exe
  C:\Windows\System\SmJgIdA.exe
  2⤵
  PID:3332
- C:\Windows\System\xpxAgjc.exe
  C:\Windows\System\xpxAgjc.exe
  2⤵
  PID:3348
- C:\Windows\System\GvdRPAG.exe
  C:\Windows\System\GvdRPAG.exe
  2⤵
  PID:3364
- C:\Windows\System\KYrrZhz.exe
  C:\Windows\System\KYrrZhz.exe
  2⤵
  PID:3388
- C:\Windows\System\dzkEHcY.exe
  C:\Windows\System\dzkEHcY.exe
  2⤵
  PID:3404
- C:\Windows\System\kTYXhhp.exe
  C:\Windows\System\kTYXhhp.exe
  2⤵
  PID:3424
- C:\Windows\System\pxqFrhY.exe
  C:\Windows\System\pxqFrhY.exe
  2⤵
  PID:3440
- C:\Windows\System\KickiPP.exe
  C:\Windows\System\KickiPP.exe
  2⤵
  PID:3456
- C:\Windows\System\gEWViVc.exe
  C:\Windows\System\gEWViVc.exe
  2⤵
  PID:3472
- C:\Windows\System\pyYvyzx.exe
  C:\Windows\System\pyYvyzx.exe
  2⤵
  PID:3496
- C:\Windows\System\WoLBraF.exe
  C:\Windows\System\WoLBraF.exe
  2⤵
  PID:3512
- C:\Windows\System\glqwYdA.exe
  C:\Windows\System\glqwYdA.exe
  2⤵
  PID:3528
- C:\Windows\System\IeRcwBU.exe
  C:\Windows\System\IeRcwBU.exe
  2⤵
  PID:3648
- C:\Windows\System\WfKJuRK.exe
  C:\Windows\System\WfKJuRK.exe
  2⤵
  PID:3664
- C:\Windows\System\NrdZNKz.exe
  C:\Windows\System\NrdZNKz.exe
  2⤵
  PID:3684
- C:\Windows\System\fWicWSr.exe
  C:\Windows\System\fWicWSr.exe
  2⤵
  PID:3712
- C:\Windows\System\DKQSNjn.exe
  C:\Windows\System\DKQSNjn.exe
  2⤵
  PID:3728
- C:\Windows\System\GCpKZOz.exe
  C:\Windows\System\GCpKZOz.exe
  2⤵
  PID:3744
- C:\Windows\System\pWVXTmL.exe
  C:\Windows\System\pWVXTmL.exe
  2⤵
  PID:3760
- C:\Windows\System\kmyjFbZ.exe
  C:\Windows\System\kmyjFbZ.exe
  2⤵
  PID:3780
- C:\Windows\System\iLVflIp.exe
  C:\Windows\System\iLVflIp.exe
  2⤵
  PID:3796
- C:\Windows\System\NqJMEmx.exe
  C:\Windows\System\NqJMEmx.exe
  2⤵
  PID:3812
- C:\Windows\System\wBsAKPD.exe
  C:\Windows\System\wBsAKPD.exe
  2⤵
  PID:3828
- C:\Windows\System\SmUgAwM.exe
  C:\Windows\System\SmUgAwM.exe
  2⤵
  PID:3952
- C:\Windows\System\tOGpZmx.exe
  C:\Windows\System\tOGpZmx.exe
  2⤵
  PID:3968
- C:\Windows\System\ktlWUWD.exe
  C:\Windows\System\ktlWUWD.exe
  2⤵
  PID:3040
- C:\Windows\System\qWjCcEl.exe
  C:\Windows\System\qWjCcEl.exe
  2⤵
  PID:2840
- C:\Windows\System\WXwbHBZ.exe
  C:\Windows\System\WXwbHBZ.exe
  2⤵
  PID:3160
- C:\Windows\System\KFrEIXu.exe
  C:\Windows\System\KFrEIXu.exe
  2⤵
  PID:2028
- C:\Windows\System\EVXUgjX.exe
  C:\Windows\System\EVXUgjX.exe
  2⤵
  PID:2156
- C:\Windows\System\CZZIgAu.exe
  C:\Windows\System\CZZIgAu.exe
  2⤵
  PID:1168
- C:\Windows\System\DManbVo.exe
  C:\Windows\System\DManbVo.exe
  2⤵
  PID:2504
- C:\Windows\System\mnlXrCI.exe
  C:\Windows\System\mnlXrCI.exe
  2⤵
  PID:1720
- C:\Windows\System\EsSuMxZ.exe
  C:\Windows\System\EsSuMxZ.exe
  2⤵
  PID:3084
- C:\Windows\System\mAsZVWD.exe
  C:\Windows\System\mAsZVWD.exe
  2⤵
  PID:3228
- C:\Windows\System\uLSxaoc.exe
  C:\Windows\System\uLSxaoc.exe
  2⤵
  PID:3296
- C:\Windows\System\FZhdRvT.exe
  C:\Windows\System\FZhdRvT.exe
  2⤵
  PID:3504
- C:\Windows\System\QuikPoO.exe
  C:\Windows\System\QuikPoO.exe
  2⤵
  PID:3400
- C:\Windows\System\SMtsSua.exe
  C:\Windows\System\SMtsSua.exe
  2⤵
  PID:3544
- C:\Windows\System\vMCKhAk.exe
  C:\Windows\System\vMCKhAk.exe
  2⤵
  PID:3560
- C:\Windows\System\TeFgcuY.exe
  C:\Windows\System\TeFgcuY.exe
  2⤵
  PID:3588
- C:\Windows\System\IDlZbft.exe
  C:\Windows\System\IDlZbft.exe
  2⤵
  PID:3608
- C:\Windows\System\pXxBCSo.exe
  C:\Windows\System\pXxBCSo.exe
  2⤵
  PID:3620
- C:\Windows\System\fMmTnRU.exe
  C:\Windows\System\fMmTnRU.exe
  2⤵
  PID:3636
- C:\Windows\System\dhuQypC.exe
  C:\Windows\System\dhuQypC.exe
  2⤵
  PID:3724
- C:\Windows\System\iMTcjFP.exe
  C:\Windows\System\iMTcjFP.exe
  2⤵
  PID:3024
- C:\Windows\System\JwWfIDG.exe
  C:\Windows\System\JwWfIDG.exe
  2⤵
  PID:800
- C:\Windows\System\kjoRBvM.exe
  C:\Windows\System\kjoRBvM.exe
  2⤵
  PID:3820
- C:\Windows\System\QjMSWRu.exe
  C:\Windows\System\QjMSWRu.exe
  2⤵
  PID:988
- C:\Windows\System\gZdxptu.exe
  C:\Windows\System\gZdxptu.exe
  2⤵
  PID:2484
- C:\Windows\System\zQjjkhl.exe
  C:\Windows\System\zQjjkhl.exe
  2⤵
  PID:2520
- C:\Windows\System\NRRqzFc.exe
  C:\Windows\System\NRRqzFc.exe
  2⤵
  PID:3100
- C:\Windows\System\ymGEgDT.exe
  C:\Windows\System\ymGEgDT.exe
  2⤵
  PID:3176
- C:\Windows\System\VXsceHq.exe
  C:\Windows\System\VXsceHq.exe
  2⤵
  PID:3244
- C:\Windows\System\ovLoRLB.exe
  C:\Windows\System\ovLoRLB.exe
  2⤵
  PID:3312
- C:\Windows\System\meWwRrc.exe
  C:\Windows\System\meWwRrc.exe
  2⤵
  PID:3380
- C:\Windows\System\ngPCcTS.exe
  C:\Windows\System\ngPCcTS.exe
  2⤵
  PID:3448
- C:\Windows\System\wDkscQA.exe
  C:\Windows\System\wDkscQA.exe
  2⤵
  PID:3492
- C:\Windows\System\xVRqdUj.exe
  C:\Windows\System\xVRqdUj.exe
  2⤵
  PID:3660
- C:\Windows\System\MFWMDBZ.exe
  C:\Windows\System\MFWMDBZ.exe
  2⤵
  PID:3708
- C:\Windows\System\DKACQdo.exe
  C:\Windows\System\DKACQdo.exe
  2⤵
  PID:3776
- C:\Windows\System\cIiafUO.exe
  C:\Windows\System\cIiafUO.exe
  2⤵
  PID:3844
- C:\Windows\System\lsnpPyg.exe
  C:\Windows\System\lsnpPyg.exe
  2⤵
  PID:1528
- C:\Windows\System\QsEmexz.exe
  C:\Windows\System\QsEmexz.exe
  2⤵
  PID:1728
- C:\Windows\System\dSZmzKW.exe
  C:\Windows\System\dSZmzKW.exe
  2⤵
  PID:484
- C:\Windows\System\eJamIJG.exe
  C:\Windows\System\eJamIJG.exe
  2⤵
  PID:2712
- C:\Windows\System\RRPzpUW.exe
  C:\Windows\System\RRPzpUW.exe
  2⤵
  PID:1900
- C:\Windows\System\jRcdOKN.exe
  C:\Windows\System\jRcdOKN.exe
  2⤵
  PID:3892
- C:\Windows\System\xxLbmMh.exe
  C:\Windows\System\xxLbmMh.exe
  2⤵
  PID:320
- C:\Windows\System\duItDxt.exe
  C:\Windows\System\duItDxt.exe
  2⤵
  PID:3012
- C:\Windows\System\YBfBdZf.exe
  C:\Windows\System\YBfBdZf.exe
  2⤵
  PID:3964
- C:\Windows\System\tPvBtoq.exe
  C:\Windows\System\tPvBtoq.exe
  2⤵
  PID:4084
- C:\Windows\System\mGcpZVr.exe
  C:\Windows\System\mGcpZVr.exe
  2⤵
  PID:2992
- C:\Windows\System\Zratibk.exe
  C:\Windows\System\Zratibk.exe
  2⤵
  PID:916
- C:\Windows\System\nFOrYFt.exe
  C:\Windows\System\nFOrYFt.exe
  2⤵
  PID:2084
- C:\Windows\System\CQPgOgH.exe
  C:\Windows\System\CQPgOgH.exe
  2⤵
  PID:2108
- C:\Windows\System\kRVGNCx.exe
  C:\Windows\System\kRVGNCx.exe
  2⤵
  PID:1712
- C:\Windows\System\KoFhUwA.exe
  C:\Windows\System\KoFhUwA.exe
  2⤵
  PID:2016
- C:\Windows\System\hbjJBeG.exe
  C:\Windows\System\hbjJBeG.exe
  2⤵
  PID:2140
- C:\Windows\System\nSkGYeV.exe
  C:\Windows\System\nSkGYeV.exe
  2⤵
  PID:2496
- C:\Windows\System\nUFtDzo.exe
  C:\Windows\System\nUFtDzo.exe
  2⤵
  PID:2564
- C:\Windows\System\WkOnzET.exe
  C:\Windows\System\WkOnzET.exe
  2⤵
  PID:1552
- C:\Windows\System\HrssKCh.exe
  C:\Windows\System\HrssKCh.exe
  2⤵
  PID:3120
- C:\Windows\System\yhDHMqe.exe
  C:\Windows\System\yhDHMqe.exe
  2⤵
  PID:3164
- C:\Windows\System\Rnmblae.exe
  C:\Windows\System\Rnmblae.exe
  2⤵
  PID:3264
- C:\Windows\System\CrxvJhM.exe
  C:\Windows\System\CrxvJhM.exe
  2⤵
  PID:3432
- C:\Windows\System\DiIsiks.exe
  C:\Windows\System\DiIsiks.exe
  2⤵
  PID:3584
- C:\Windows\System\CxcCbiL.exe
  C:\Windows\System\CxcCbiL.exe
  2⤵
  PID:2096
- C:\Windows\System\AfeDEtA.exe
  C:\Windows\System\AfeDEtA.exe
  2⤵
  PID:3644
- C:\Windows\System\smcrnzF.exe
  C:\Windows\System\smcrnzF.exe
  2⤵
  PID:3680
- C:\Windows\System\sFYCidl.exe
  C:\Windows\System\sFYCidl.exe
  2⤵
  PID:3788
- C:\Windows\System\szygYSF.exe
  C:\Windows\System\szygYSF.exe
  2⤵
  PID:3824
- C:\Windows\System\JWyPWkR.exe
  C:\Windows\System\JWyPWkR.exe
  2⤵
  PID:1256
- C:\Windows\System\GakHeiZ.exe
  C:\Windows\System\GakHeiZ.exe
  2⤵
  PID:1884
- C:\Windows\System\FqGsmJe.exe
  C:\Windows\System\FqGsmJe.exe
  2⤵
  PID:3136
- C:\Windows\System\TotULVI.exe
  C:\Windows\System\TotULVI.exe
  2⤵
  PID:3148
- C:\Windows\System\UGpmGbS.exe
  C:\Windows\System\UGpmGbS.exe
  2⤵
  PID:3212
- C:\Windows\System\RfEntft.exe
  C:\Windows\System\RfEntft.exe
  2⤵
  PID:3376
- C:\Windows\System\ZmfFMzo.exe
  C:\Windows\System\ZmfFMzo.exe
  2⤵
  PID:3656
- C:\Windows\System\yfHoCMf.exe
  C:\Windows\System\yfHoCMf.exe
  2⤵
  PID:3704
- C:\Windows\System\ThSkLGy.exe
  C:\Windows\System\ThSkLGy.exe
  2⤵
  PID:3808
- C:\Windows\System\YzGHNsG.exe
  C:\Windows\System\YzGHNsG.exe
  2⤵
  PID:3856
- C:\Windows\System\XtLLDrj.exe
  C:\Windows\System\XtLLDrj.exe
  2⤵
  PID:2560
- C:\Windows\System\VRFaRGw.exe
  C:\Windows\System\VRFaRGw.exe
  2⤵
  PID:2292
- C:\Windows\System\tVlDlvO.exe
  C:\Windows\System\tVlDlvO.exe
  2⤵
  PID:1100
- C:\Windows\System\CHGwTCs.exe
  C:\Windows\System\CHGwTCs.exe
  2⤵
  PID:1860
- C:\Windows\System\IKyvDof.exe
  C:\Windows\System\IKyvDof.exe
  2⤵
  PID:3976
- C:\Windows\System\GwZvLeF.exe
  C:\Windows\System\GwZvLeF.exe
  2⤵
  PID:620
- C:\Windows\System\NrDEQiZ.exe
  C:\Windows\System\NrDEQiZ.exe
  2⤵
  PID:920
- C:\Windows\System\LfwIAus.exe
  C:\Windows\System\LfwIAus.exe
  2⤵
  PID:1988
- C:\Windows\System\dMUQpPq.exe
  C:\Windows\System\dMUQpPq.exe
  2⤵
  PID:2472
- C:\Windows\System\zeibipS.exe
  C:\Windows\System\zeibipS.exe
  2⤵
  PID:2684
- C:\Windows\System\rNorMhD.exe
  C:\Windows\System\rNorMhD.exe
  2⤵
  PID:380
- C:\Windows\System\UDWcPjD.exe
  C:\Windows\System\UDWcPjD.exe
  2⤵
  PID:2396
- C:\Windows\System\VEylxNF.exe
  C:\Windows\System\VEylxNF.exe
  2⤵
  PID:2844
- C:\Windows\System\LfWsjNr.exe
  C:\Windows\System\LfWsjNr.exe
  2⤵
  PID:3568
- C:\Windows\System\CUJYkBE.exe
  C:\Windows\System\CUJYkBE.exe
  2⤵
  PID:3600
- C:\Windows\System\laodDGm.exe
  C:\Windows\System\laodDGm.exe
  2⤵
  PID:2900
- C:\Windows\System\QltYUeV.exe
  C:\Windows\System\QltYUeV.exe
  2⤵
  PID:3792
- C:\Windows\System\RILQUOk.exe
  C:\Windows\System\RILQUOk.exe
  2⤵
  PID:1448
- C:\Windows\System\jqkXMQw.exe
  C:\Windows\System\jqkXMQw.exe
  2⤵
  PID:1912
- C:\Windows\System\qvVOCzF.exe
  C:\Windows\System\qvVOCzF.exe
  2⤵
  PID:3096
- C:\Windows\System\ddgiusX.exe
  C:\Windows\System\ddgiusX.exe
  2⤵
  PID:3480
- C:\Windows\System\nWFgVoQ.exe
  C:\Windows\System\nWFgVoQ.exe
  2⤵
  PID:3416
- C:\Windows\System\mTJIXbR.exe
  C:\Windows\System\mTJIXbR.exe
  2⤵
  PID:2152
- C:\Windows\System\KlwETVW.exe
  C:\Windows\System\KlwETVW.exe
  2⤵
  PID:3056
- C:\Windows\System\PonuRjZ.exe
  C:\Windows\System\PonuRjZ.exe
  2⤵
  PID:780
- C:\Windows\System\aqFvSwv.exe
  C:\Windows\System\aqFvSwv.exe
  2⤵
  PID:3920
- C:\Windows\System\PTgGzKA.exe
  C:\Windows\System\PTgGzKA.exe
  2⤵
  PID:4092
- C:\Windows\System\aYgVSAs.exe
  C:\Windows\System\aYgVSAs.exe
  2⤵
  PID:4076
- C:\Windows\System\EXXSdKp.exe
  C:\Windows\System\EXXSdKp.exe
  2⤵
  PID:2476
- C:\Windows\System\vUcSSWt.exe
  C:\Windows\System\vUcSSWt.exe
  2⤵
  PID:3196
- C:\Windows\System\yfCqEuE.exe
  C:\Windows\System\yfCqEuE.exe
  2⤵
  PID:3124
- C:\Windows\System\gmfqxsC.exe
  C:\Windows\System\gmfqxsC.exe
  2⤵
  PID:3468
- C:\Windows\System\KXkHQrL.exe
  C:\Windows\System\KXkHQrL.exe
  2⤵
  PID:3436
- C:\Windows\System\YZujCWE.exe
  C:\Windows\System\YZujCWE.exe
  2⤵
  PID:3628
- C:\Windows\System\yqOHHEH.exe
  C:\Windows\System\yqOHHEH.exe
  2⤵
  PID:1124
- C:\Windows\System\lJtYlJe.exe
  C:\Windows\System\lJtYlJe.exe
  2⤵
  PID:2812
- C:\Windows\System\wReaDuv.exe
  C:\Windows\System\wReaDuv.exe
  2⤵
  PID:3276
- C:\Windows\System\ClgToba.exe
  C:\Windows\System\ClgToba.exe
  2⤵
  PID:3960
- C:\Windows\System\sfvwPZW.exe
  C:\Windows\System\sfvwPZW.exe
  2⤵
  PID:700
- C:\Windows\System\Yjvouzv.exe
  C:\Windows\System\Yjvouzv.exe
  2⤵
  PID:2240
- C:\Windows\System\cehUaCP.exe
  C:\Windows\System\cehUaCP.exe
  2⤵
  PID:1476
- C:\Windows\System\rCQgEfq.exe
  C:\Windows\System\rCQgEfq.exe
  2⤵
  PID:2652
- C:\Windows\System\NFZXqfC.exe
  C:\Windows\System\NFZXqfC.exe
  2⤵
  PID:3536
- C:\Windows\System\aeDomeG.exe
  C:\Windows\System\aeDomeG.exe
  2⤵
  PID:3580
- C:\Windows\System\ZfzgkTm.exe
  C:\Windows\System\ZfzgkTm.exe
  2⤵
  PID:1700
- C:\Windows\System\KagZQpR.exe
  C:\Windows\System\KagZQpR.exe
  2⤵
  PID:3772
- C:\Windows\System\PrIwPiP.exe
  C:\Windows\System\PrIwPiP.exe
  2⤵
  PID:3988
- C:\Windows\System\ahpCaTI.exe
  C:\Windows\System\ahpCaTI.exe
  2⤵
  PID:4004
- C:\Windows\System\AxAXbhf.exe
  C:\Windows\System\AxAXbhf.exe
  2⤵
  PID:4032
- C:\Windows\System\lLZEQGw.exe
  C:\Windows\System\lLZEQGw.exe
  2⤵
  PID:4048
- C:\Windows\System\hOpfOUB.exe
  C:\Windows\System\hOpfOUB.exe
  2⤵
  PID:4064
- C:\Windows\System\EosZoBZ.exe
  C:\Windows\System\EosZoBZ.exe
  2⤵
  PID:2248
- C:\Windows\System\THWmyYQ.exe
  C:\Windows\System\THWmyYQ.exe
  2⤵
  PID:4100
- C:\Windows\System\cqvMErf.exe
  C:\Windows\System\cqvMErf.exe
  2⤵
  PID:4116
- C:\Windows\System\sUDPiCA.exe
  C:\Windows\System\sUDPiCA.exe
  2⤵
  PID:4132
- C:\Windows\System\ClUFIYt.exe
  C:\Windows\System\ClUFIYt.exe
  2⤵
  PID:4148
- C:\Windows\System\yBmWkmI.exe
  C:\Windows\System\yBmWkmI.exe
  2⤵
  PID:4176
- C:\Windows\System\UshtKiY.exe
  C:\Windows\System\UshtKiY.exe
  2⤵
  PID:4196
- C:\Windows\System\hGgXZcJ.exe
  C:\Windows\System\hGgXZcJ.exe
  2⤵
  PID:4212
- C:\Windows\System\GSTZAAj.exe
  C:\Windows\System\GSTZAAj.exe
  2⤵
  PID:4228
- C:\Windows\System\MrUyhFt.exe
  C:\Windows\System\MrUyhFt.exe
  2⤵
  PID:4244
- C:\Windows\System\xwbbWUH.exe
  C:\Windows\System\xwbbWUH.exe
  2⤵
  PID:4260
- C:\Windows\System\phEEwjy.exe
  C:\Windows\System\phEEwjy.exe
  2⤵
  PID:4276
- C:\Windows\System\XyMNrbn.exe
  C:\Windows\System\XyMNrbn.exe
  2⤵
  PID:4292
- C:\Windows\System\prBgzDq.exe
  C:\Windows\System\prBgzDq.exe
  2⤵
  PID:4308
- C:\Windows\System\UCeSbgM.exe
  C:\Windows\System\UCeSbgM.exe
  2⤵
  PID:4328
- C:\Windows\System\exMQdPc.exe
  C:\Windows\System\exMQdPc.exe
  2⤵
  PID:4344
- C:\Windows\System\UmkDkTF.exe
  C:\Windows\System\UmkDkTF.exe
  2⤵
  PID:4364
- C:\Windows\System\vohTZAh.exe
  C:\Windows\System\vohTZAh.exe
  2⤵
  PID:4380
- C:\Windows\System\PVMFEKC.exe
  C:\Windows\System\PVMFEKC.exe
  2⤵
  PID:4452
- C:\Windows\System\xxdEnCM.exe
  C:\Windows\System\xxdEnCM.exe
  2⤵
  PID:4480
- C:\Windows\System\urEGAyu.exe
  C:\Windows\System\urEGAyu.exe
  2⤵
  PID:4500
- C:\Windows\System\DNVoSLj.exe
  C:\Windows\System\DNVoSLj.exe
  2⤵
  PID:4528
- C:\Windows\System\dvoiGNm.exe
  C:\Windows\System\dvoiGNm.exe
  2⤵
  PID:4544
- C:\Windows\System\kQEqzIq.exe
  C:\Windows\System\kQEqzIq.exe
  2⤵
  PID:4560
- C:\Windows\System\QBMkEec.exe
  C:\Windows\System\QBMkEec.exe
  2⤵
  PID:4580
- C:\Windows\System\XcClIDD.exe
  C:\Windows\System\XcClIDD.exe
  2⤵
  PID:4596
- C:\Windows\System\mbawuHm.exe
  C:\Windows\System\mbawuHm.exe
  2⤵
  PID:4616
- C:\Windows\System\ftGlNUr.exe
  C:\Windows\System\ftGlNUr.exe
  2⤵
  PID:4632
- C:\Windows\System\EIkNcwW.exe
  C:\Windows\System\EIkNcwW.exe
  2⤵
  PID:4648
- C:\Windows\System\PVfqfFG.exe
  C:\Windows\System\PVfqfFG.exe
  2⤵
  PID:4664
- C:\Windows\System\ZeMACaL.exe
  C:\Windows\System\ZeMACaL.exe
  2⤵
  PID:4780
- C:\Windows\System\xCZrNZj.exe
  C:\Windows\System\xCZrNZj.exe
  2⤵
  PID:4800
- C:\Windows\System\wCnsOMN.exe
  C:\Windows\System\wCnsOMN.exe
  2⤵
  PID:4832
- C:\Windows\System\GhlmRCx.exe
  C:\Windows\System\GhlmRCx.exe
  2⤵
  PID:4848
- C:\Windows\System\zGfgMHM.exe
  C:\Windows\System\zGfgMHM.exe
  2⤵
  PID:4864
- C:\Windows\System\twWmMBR.exe
  C:\Windows\System\twWmMBR.exe
  2⤵
  PID:4888
- C:\Windows\System\TVupXVs.exe
  C:\Windows\System\TVupXVs.exe
  2⤵
  PID:4904
- C:\Windows\System\ndrtXYo.exe
  C:\Windows\System\ndrtXYo.exe
  2⤵
  PID:4920
- C:\Windows\System\lYPdEwS.exe
  C:\Windows\System\lYPdEwS.exe
  2⤵
  PID:4936
- C:\Windows\System\PzXpirU.exe
  C:\Windows\System\PzXpirU.exe
  2⤵
  PID:4956
- C:\Windows\System\XWHZiVc.exe
  C:\Windows\System\XWHZiVc.exe
  2⤵
  PID:4972
- C:\Windows\System\XQktgFQ.exe
  C:\Windows\System\XQktgFQ.exe
  2⤵
  PID:4988
- C:\Windows\System\FYjyfhV.exe
  C:\Windows\System\FYjyfhV.exe
  2⤵
  PID:5004
- C:\Windows\System\eQjXwlz.exe
  C:\Windows\System\eQjXwlz.exe
  2⤵
  PID:5020
- C:\Windows\System\NndZfQX.exe
  C:\Windows\System\NndZfQX.exe
  2⤵
  PID:5036
- C:\Windows\System\uCvbOaI.exe
  C:\Windows\System\uCvbOaI.exe
  2⤵
  PID:5052
- C:\Windows\System\jhviFdU.exe
  C:\Windows\System\jhviFdU.exe
  2⤵
  PID:5068
- C:\Windows\System\rvmbmqY.exe
  C:\Windows\System\rvmbmqY.exe
  2⤵
  PID:5084
- C:\Windows\System\lCmYRcL.exe
  C:\Windows\System\lCmYRcL.exe
  2⤵
  PID:5104
- C:\Windows\System\VxvaIlF.exe
  C:\Windows\System\VxvaIlF.exe
  2⤵
  PID:2788
- C:\Windows\System\sxFKspG.exe
  C:\Windows\System\sxFKspG.exe
  2⤵
  PID:2732
- C:\Windows\System\ogtCNxM.exe
  C:\Windows\System\ogtCNxM.exe
  2⤵
  PID:4272
- C:\Windows\System\RipJbqF.exe
  C:\Windows\System\RipJbqF.exe
  2⤵
  PID:4336
- C:\Windows\System\UypnSde.exe
  C:\Windows\System\UypnSde.exe
  2⤵
  PID:1388
- C:\Windows\System\lutEcCx.exe
  C:\Windows\System\lutEcCx.exe
  2⤵
  PID:4068
- C:\Windows\System\ekBqYrE.exe
  C:\Windows\System\ekBqYrE.exe
  2⤵
  PID:4112
- C:\Windows\System\QfrKwKm.exe
  C:\Windows\System\QfrKwKm.exe
  2⤵
  PID:4392
- C:\Windows\System\ZNALjMF.exe
  C:\Windows\System\ZNALjMF.exe
  2⤵
  PID:2932
- C:\Windows\System\BKfhUkW.exe
  C:\Windows\System\BKfhUkW.exe
  2⤵
  PID:4008
- C:\Windows\System\gisCjFV.exe
  C:\Windows\System\gisCjFV.exe
  2⤵
  PID:4144
- C:\Windows\System\AhDosJK.exe
  C:\Windows\System\AhDosJK.exe
  2⤵
  PID:4220
- C:\Windows\System\lpUHnKV.exe
  C:\Windows\System\lpUHnKV.exe
  2⤵
  PID:4352
- C:\Windows\System\MbQXhSG.exe
  C:\Windows\System\MbQXhSG.exe
  2⤵
  PID:4420
- C:\Windows\System\Ykscvdt.exe
  C:\Windows\System\Ykscvdt.exe
  2⤵
  PID:4436
- C:\Windows\System\CxJvHNm.exe
  C:\Windows\System\CxJvHNm.exe
  2⤵
  PID:4444
- C:\Windows\System\uamPYLe.exe
  C:\Windows\System\uamPYLe.exe
  2⤵
  PID:4508
- C:\Windows\System\ztxoBZd.exe
  C:\Windows\System\ztxoBZd.exe
  2⤵
  PID:4516
- C:\Windows\System\fRXlXPd.exe
  C:\Windows\System\fRXlXPd.exe
  2⤵
  PID:4556
- C:\Windows\System\KFhXmeb.exe
  C:\Windows\System\KFhXmeb.exe
  2⤵
  PID:4552
- C:\Windows\System\dnKMvNq.exe
  C:\Windows\System\dnKMvNq.exe
  2⤵
  PID:4612
- C:\Windows\System\slCgtIZ.exe
  C:\Windows\System\slCgtIZ.exe
  2⤵
  PID:4656
- C:\Windows\System\XNevRFd.exe
  C:\Windows\System\XNevRFd.exe
  2⤵
  PID:4676
- C:\Windows\System\LYdglGB.exe
  C:\Windows\System\LYdglGB.exe
  2⤵
  PID:4672
- C:\Windows\System\SzaEvjc.exe
  C:\Windows\System\SzaEvjc.exe
  2⤵
  PID:4692
- C:\Windows\System\MgHlXBE.exe
  C:\Windows\System\MgHlXBE.exe
  2⤵
  PID:4708
- C:\Windows\System\TSGpBWC.exe
  C:\Windows\System\TSGpBWC.exe
  2⤵
  PID:4732
- C:\Windows\System\eLqgIbu.exe
  C:\Windows\System\eLqgIbu.exe
  2⤵
  PID:4752
- C:\Windows\System\HXHTsly.exe
  C:\Windows\System\HXHTsly.exe
  2⤵
  PID:4768
- C:\Windows\System\pUCUSwI.exe
  C:\Windows\System\pUCUSwI.exe
  2⤵
  PID:4872
- C:\Windows\System\KFbbwly.exe
  C:\Windows\System\KFbbwly.exe
  2⤵
  PID:4984
- C:\Windows\System\mhArVdO.exe
  C:\Windows\System\mhArVdO.exe
  2⤵
  PID:4856
- C:\Windows\System\CFlKcLp.exe
  C:\Windows\System\CFlKcLp.exe
  2⤵
  PID:4896
- C:\Windows\System\ZXYtZjF.exe
  C:\Windows\System\ZXYtZjF.exe
  2⤵
  PID:5028
- C:\Windows\System\PYObQrJ.exe
  C:\Windows\System\PYObQrJ.exe
  2⤵
  PID:5060
- C:\Windows\System\rcBDvSl.exe
  C:\Windows\System\rcBDvSl.exe
  2⤵
  PID:5096
- C:\Windows\System\UZrxjjV.exe
  C:\Windows\System\UZrxjjV.exe
  2⤵
  PID:4900
- C:\Windows\System\bcjIFrt.exe
  C:\Windows\System\bcjIFrt.exe
  2⤵
  PID:2940
- C:\Windows\System\EnjsuEo.exe
  C:\Windows\System\EnjsuEo.exe
  2⤵
  PID:4160
- C:\Windows\System\CUDEhrJ.exe
  C:\Windows\System\CUDEhrJ.exe
  2⤵
  PID:4168
- C:\Windows\System\DoGiWym.exe
  C:\Windows\System\DoGiWym.exe
  2⤵
  PID:4376
- C:\Windows\System\TqvTsoq.exe
  C:\Windows\System\TqvTsoq.exe
  2⤵
  PID:3604
- C:\Windows\System\NXanZGc.exe
  C:\Windows\System\NXanZGc.exe
  2⤵
  PID:4256
- C:\Windows\System\XaHyprE.exe
  C:\Windows\System\XaHyprE.exe
  2⤵
  PID:4040
- C:\Windows\System\NXHBKAh.exe
  C:\Windows\System\NXHBKAh.exe
  2⤵
  PID:2772
- C:\Windows\System\ewpeWlX.exe
  C:\Windows\System\ewpeWlX.exe
  2⤵
  PID:1084
- C:\Windows\System\WsXMQXx.exe
  C:\Windows\System\WsXMQXx.exe
  2⤵
  PID:4412
- C:\Windows\System\jRrcupr.exe
  C:\Windows\System\jRrcupr.exe
  2⤵
  PID:4428
- C:\Windows\System\uuctOZJ.exe
  C:\Windows\System\uuctOZJ.exe
  2⤵
  PID:4524
- C:\Windows\System\BRMVUOQ.exe
  C:\Windows\System\BRMVUOQ.exe
  2⤵
  PID:4568
- C:\Windows\System\KGilUxk.exe
  C:\Windows\System\KGilUxk.exe
  2⤵
  PID:4736
- C:\Windows\System\FFWrNZn.exe
  C:\Windows\System\FFWrNZn.exe
  2⤵
  PID:4772
- C:\Windows\System\UxfMcWo.exe
  C:\Windows\System\UxfMcWo.exe
  2⤵
  PID:4628
- C:\Windows\System\wMwbibB.exe
  C:\Windows\System\wMwbibB.exe
  2⤵
  PID:4816
- C:\Windows\System\chIdcko.exe
  C:\Windows\System\chIdcko.exe
  2⤵
  PID:4760
- C:\Windows\System\rRfBceN.exe
  C:\Windows\System\rRfBceN.exe
  2⤵
  PID:4880
- C:\Windows\System\lNaYglL.exe
  C:\Windows\System\lNaYglL.exe
  2⤵
  PID:4952
- C:\Windows\System\ilZLSWc.exe
  C:\Windows\System\ilZLSWc.exe
  2⤵
  PID:4980
- C:\Windows\System\UjWLeiT.exe
  C:\Windows\System\UjWLeiT.exe
  2⤵
  PID:4820
- C:\Windows\System\UaZuhwu.exe
  C:\Windows\System\UaZuhwu.exe
  2⤵
  PID:4824
- C:\Windows\System\OyVtTLc.exe
  C:\Windows\System\OyVtTLc.exe
  2⤵
  PID:5076
- C:\Windows\System\DWOKpUb.exe
  C:\Windows\System\DWOKpUb.exe
  2⤵
  PID:4860
- C:\Windows\System\mWwwMBz.exe
  C:\Windows\System\mWwwMBz.exe
  2⤵
  PID:4052
- C:\Windows\System\ORNyYwB.exe
  C:\Windows\System\ORNyYwB.exe
  2⤵
  PID:2464
- C:\Windows\System\RMHtdnw.exe
  C:\Windows\System\RMHtdnw.exe
  2⤵
  PID:4340
- C:\Windows\System\InNNvfl.exe
  C:\Windows\System\InNNvfl.exe
  2⤵
  PID:4204
- C:\Windows\System\feROrPd.exe
  C:\Windows\System\feROrPd.exe
  2⤵
  PID:4288
- C:\Windows\System\EzJRIpL.exe
  C:\Windows\System\EzJRIpL.exe
  2⤵
  PID:3992
- C:\Windows\System\BRnfTFt.exe
  C:\Windows\System\BRnfTFt.exe
  2⤵
  PID:4400
- C:\Windows\System\jGnfjxB.exe
  C:\Windows\System\jGnfjxB.exe
  2⤵
  PID:4460
- C:\Windows\System\SptVkdi.exe
  C:\Windows\System\SptVkdi.exe
  2⤵
  PID:4700
- C:\Windows\System\ifMMeWZ.exe
  C:\Windows\System\ifMMeWZ.exe
  2⤵
  PID:4520
- C:\Windows\System\htQvDOe.exe
  C:\Windows\System\htQvDOe.exe
  2⤵
  PID:4712
- C:\Windows\System\ARnfmfF.exe
  C:\Windows\System\ARnfmfF.exe
  2⤵
  PID:4764
- C:\Windows\System\UfSScbz.exe
  C:\Windows\System\UfSScbz.exe
  2⤵
  PID:5128
- C:\Windows\System\RbuQwdX.exe
  C:\Windows\System\RbuQwdX.exe
  2⤵
  PID:5152
- C:\Windows\System\RSPPols.exe
  C:\Windows\System\RSPPols.exe
  2⤵
  PID:5168
- C:\Windows\System\CRJJocZ.exe
  C:\Windows\System\CRJJocZ.exe
  2⤵
  PID:5184
- C:\Windows\System\FVLXMLE.exe
  C:\Windows\System\FVLXMLE.exe
  2⤵
  PID:5204
- C:\Windows\System\taeQrzA.exe
  C:\Windows\System\taeQrzA.exe
  2⤵
  PID:5220
- C:\Windows\System\ivRMBvy.exe
  C:\Windows\System\ivRMBvy.exe
  2⤵
  PID:5240
- C:\Windows\System\StUWJbq.exe
  C:\Windows\System\StUWJbq.exe
  2⤵
  PID:5256
- C:\Windows\System\rLVMxhD.exe
  C:\Windows\System\rLVMxhD.exe
  2⤵
  PID:5272
- C:\Windows\System\LnIbIrL.exe
  C:\Windows\System\LnIbIrL.exe
  2⤵
  PID:5292
- C:\Windows\System\hGsqSJg.exe
  C:\Windows\System\hGsqSJg.exe
  2⤵
  PID:5308
- C:\Windows\System\tsDPcLT.exe
  C:\Windows\System\tsDPcLT.exe
  2⤵
  PID:5324
- C:\Windows\System\oTjxUVb.exe
  C:\Windows\System\oTjxUVb.exe
  2⤵
  PID:5344
- C:\Windows\System\GlwOWnY.exe
  C:\Windows\System\GlwOWnY.exe
  2⤵
  PID:5360
- C:\Windows\System\FvYjYiC.exe
  C:\Windows\System\FvYjYiC.exe
  2⤵
  PID:5376
- C:\Windows\System\imIOYpV.exe
  C:\Windows\System\imIOYpV.exe
  2⤵
  PID:5396
- C:\Windows\System\ZlPYMFx.exe
  C:\Windows\System\ZlPYMFx.exe
  2⤵
  PID:5528
- C:\Windows\System\ZYWahTj.exe
  C:\Windows\System\ZYWahTj.exe
  2⤵
  PID:5548
- C:\Windows\System\iTeNejf.exe
  C:\Windows\System\iTeNejf.exe
  2⤵
  PID:5564
- C:\Windows\System\CTDDjPh.exe
  C:\Windows\System\CTDDjPh.exe
  2⤵
  PID:5580
- C:\Windows\System\EHEUeJi.exe
  C:\Windows\System\EHEUeJi.exe
  2⤵
  PID:5596
- C:\Windows\System\hrtAAwG.exe
  C:\Windows\System\hrtAAwG.exe
  2⤵
  PID:5612
- C:\Windows\System\MGmSxWW.exe
  C:\Windows\System\MGmSxWW.exe
  2⤵
  PID:5628
- C:\Windows\System\dMAzNZB.exe
  C:\Windows\System\dMAzNZB.exe
  2⤵
  PID:5648
- C:\Windows\System\nfIbxep.exe
  C:\Windows\System\nfIbxep.exe
  2⤵
  PID:5664
- C:\Windows\System\VIUcUtc.exe
  C:\Windows\System\VIUcUtc.exe
  2⤵
  PID:5680
- C:\Windows\System\biIJSmY.exe
  C:\Windows\System\biIJSmY.exe
  2⤵
  PID:5696
- C:\Windows\System\JupRsWm.exe
  C:\Windows\System\JupRsWm.exe
  2⤵
  PID:5716
- C:\Windows\System\kUrRTTf.exe
  C:\Windows\System\kUrRTTf.exe
  2⤵
  PID:5732
- C:\Windows\System\UopRIES.exe
  C:\Windows\System\UopRIES.exe
  2⤵
  PID:5752
- C:\Windows\System\jHBAisI.exe
  C:\Windows\System\jHBAisI.exe
  2⤵
  PID:5768
- C:\Windows\System\UGiBKOc.exe
  C:\Windows\System\UGiBKOc.exe
  2⤵
  PID:5784
- C:\Windows\System\sPIjXQP.exe
  C:\Windows\System\sPIjXQP.exe
  2⤵
  PID:5804
- C:\Windows\System\yBPtEdL.exe
  C:\Windows\System\yBPtEdL.exe
  2⤵
  PID:5820
- C:\Windows\System\tdPLwHv.exe
  C:\Windows\System\tdPLwHv.exe
  2⤵
  PID:5872
- C:\Windows\System\sXgLrcc.exe
  C:\Windows\System\sXgLrcc.exe
  2⤵
  PID:5888
- C:\Windows\System\wrrbMfr.exe
  C:\Windows\System\wrrbMfr.exe
  2⤵
  PID:5904
- C:\Windows\System\IMWpBvM.exe
  C:\Windows\System\IMWpBvM.exe
  2⤵
  PID:5920
- C:\Windows\System\nRldlOv.exe
  C:\Windows\System\nRldlOv.exe
  2⤵
  PID:5936
- C:\Windows\System\IJIRtAW.exe
  C:\Windows\System\IJIRtAW.exe
  2⤵
  PID:5952
- C:\Windows\System\TECjoJc.exe
  C:\Windows\System\TECjoJc.exe
  2⤵
  PID:5968
- C:\Windows\System\mCzonMM.exe
  C:\Windows\System\mCzonMM.exe
  2⤵
  PID:5984
- C:\Windows\System\yakzORC.exe
  C:\Windows\System\yakzORC.exe
  2⤵
  PID:6000
- C:\Windows\System\kKhDRGT.exe
  C:\Windows\System\kKhDRGT.exe
  2⤵
  PID:6016
- C:\Windows\System\VrNyxgO.exe
  C:\Windows\System\VrNyxgO.exe
  2⤵
  PID:6032
- C:\Windows\System\CxWOHJi.exe
  C:\Windows\System\CxWOHJi.exe
  2⤵
  PID:6048
- C:\Windows\System\jdjVwAW.exe
  C:\Windows\System\jdjVwAW.exe
  2⤵
  PID:6064
- C:\Windows\System\DFoNiBh.exe
  C:\Windows\System\DFoNiBh.exe
  2⤵
  PID:6080
- C:\Windows\System\Ckvnwdj.exe
  C:\Windows\System\Ckvnwdj.exe
  2⤵
  PID:4624
- C:\Windows\System\UdDIkmK.exe
  C:\Windows\System\UdDIkmK.exe
  2⤵
  PID:4796
- C:\Windows\System\RqZFeVL.exe
  C:\Windows\System\RqZFeVL.exe
  2⤵
  PID:5000
- C:\Windows\System\dXtIEyi.exe
  C:\Windows\System\dXtIEyi.exe
  2⤵
  PID:5144
- C:\Windows\System\WebZxwy.exe
  C:\Windows\System\WebZxwy.exe
  2⤵
  PID:5212
- C:\Windows\System\foAniGZ.exe
  C:\Windows\System\foAniGZ.exe
  2⤵
  PID:4432
- C:\Windows\System\IWdgYZf.exe
  C:\Windows\System\IWdgYZf.exe
  2⤵
  PID:5252
- C:\Windows\System\dAKNwWT.exe
  C:\Windows\System\dAKNwWT.exe
  2⤵
  PID:5320
- C:\Windows\System\vmBxyRQ.exe
  C:\Windows\System\vmBxyRQ.exe
  2⤵
  PID:5388
- C:\Windows\System\xzvnmYL.exe
  C:\Windows\System\xzvnmYL.exe
  2⤵
  PID:4728
- C:\Windows\System\qUaXSzD.exe
  C:\Windows\System\qUaXSzD.exe
  2⤵
  PID:4536
- C:\Windows\System\APEhFnr.exe
  C:\Windows\System\APEhFnr.exe
  2⤵
  PID:5228
- C:\Windows\System\GmaoepW.exe
  C:\Windows\System\GmaoepW.exe
  2⤵
  PID:5304
- C:\Windows\System\EOrzacH.exe
  C:\Windows\System\EOrzacH.exe
  2⤵
  PID:4724
- C:\Windows\System\gSWpTgs.exe
  C:\Windows\System\gSWpTgs.exe
  2⤵
  PID:4840
- C:\Windows\System\bXEWrMa.exe
  C:\Windows\System\bXEWrMa.exe
  2⤵
  PID:5092
- C:\Windows\System\WnTMiwL.exe
  C:\Windows\System\WnTMiwL.exe
  2⤵
  PID:5432
- C:\Windows\System\lDvWZVt.exe
  C:\Windows\System\lDvWZVt.exe
  2⤵
  PID:5448
- C:\Windows\System\NDDzPBX.exe
  C:\Windows\System\NDDzPBX.exe
  2⤵
  PID:5464
- C:\Windows\System\JdSlnqE.exe
  C:\Windows\System\JdSlnqE.exe
  2⤵
  PID:5472
- C:\Windows\System\xhuTYSq.exe
  C:\Windows\System\xhuTYSq.exe
  2⤵
  PID:5492
- C:\Windows\System\InbOSrE.exe
  C:\Windows\System\InbOSrE.exe
  2⤵
  PID:5508
- C:\Windows\System\UuDXBPS.exe
  C:\Windows\System\UuDXBPS.exe
  2⤵
  PID:5524
- C:\Windows\System\mVUsAuW.exe
  C:\Windows\System\mVUsAuW.exe
  2⤵
  PID:5636
- C:\Windows\System\xiOycSy.exe
  C:\Windows\System\xiOycSy.exe
  2⤵
  PID:5572
- C:\Windows\System\TjRJauo.exe
  C:\Windows\System\TjRJauo.exe
  2⤵
  PID:5676
- C:\Windows\System\iljGjAd.exe
  C:\Windows\System\iljGjAd.exe
  2⤵
  PID:5744
- C:\Windows\System\YyLMAPZ.exe
  C:\Windows\System\YyLMAPZ.exe
  2⤵
  PID:5620
- C:\Windows\System\ddxRSWL.exe
  C:\Windows\System\ddxRSWL.exe
  2⤵
  PID:5688
- C:\Windows\System\GVwRivq.exe
  C:\Windows\System\GVwRivq.exe
  2⤵
  PID:5764
- C:\Windows\System\WOpBZFu.exe
  C:\Windows\System\WOpBZFu.exe
  2⤵
  PID:5792
- C:\Windows\System\pxpMbSd.exe
  C:\Windows\System\pxpMbSd.exe
  2⤵
  PID:5796
- C:\Windows\System\mVXeKjy.exe
  C:\Windows\System\mVXeKjy.exe
  2⤵
  PID:5844
- C:\Windows\System\uTRMCLx.exe
  C:\Windows\System\uTRMCLx.exe
  2⤵
  PID:5868
- C:\Windows\System\pzeTTWU.exe
  C:\Windows\System\pzeTTWU.exe
  2⤵
  PID:5900
- C:\Windows\System\htUEILb.exe
  C:\Windows\System\htUEILb.exe
  2⤵
  PID:5944
- C:\Windows\System\rxJxqHE.exe
  C:\Windows\System\rxJxqHE.exe
  2⤵
  PID:5960
- C:\Windows\System\EwKBVYJ.exe
  C:\Windows\System\EwKBVYJ.exe
  2⤵
  PID:5996
- C:\Windows\System\YYlsJqz.exe
  C:\Windows\System\YYlsJqz.exe
  2⤵
  PID:6028
- C:\Windows\System\mdqtvuJ.exe
  C:\Windows\System\mdqtvuJ.exe
  2⤵
  PID:4464
- C:\Windows\System\wAityWy.exe
  C:\Windows\System\wAityWy.exe
  2⤵
  PID:6044
- C:\Windows\System\lSyIpQp.exe
  C:\Windows\System\lSyIpQp.exe
  2⤵
  PID:5284
- C:\Windows\System\eqFKAWW.exe
  C:\Windows\System\eqFKAWW.exe
  2⤵
  PID:5288
- C:\Windows\System\MaagDYc.exe
  C:\Windows\System\MaagDYc.exe
  2⤵
  PID:5404
- C:\Windows\System\QRhWuvV.exe
  C:\Windows\System\QRhWuvV.exe
  2⤵
  PID:5012
- C:\Windows\System\CnIepXK.exe
  C:\Windows\System\CnIepXK.exe
  2⤵
  PID:6128
- C:\Windows\System\gLPrmBG.exe
  C:\Windows\System\gLPrmBG.exe
  2⤵
  PID:4876
- C:\Windows\System\FLaAxGm.exe
  C:\Windows\System\FLaAxGm.exe
  2⤵
  PID:4056
- C:\Windows\System\VaIngVL.exe
  C:\Windows\System\VaIngVL.exe
  2⤵
  PID:4720
- C:\Windows\System\SJeTfST.exe
  C:\Windows\System\SJeTfST.exe
  2⤵
  PID:4164
- C:\Windows\System\yFAaIQT.exe
  C:\Windows\System\yFAaIQT.exe
  2⤵
  PID:5544
- C:\Windows\System\psHDQYy.exe
  C:\Windows\System\psHDQYy.exe
  2⤵
  PID:5860
- C:\Windows\System\bBVovhJ.exe
  C:\Windows\System\bBVovhJ.exe
  2⤵
  PID:6132
- C:\Windows\System\NXSsalc.exe
  C:\Windows\System\NXSsalc.exe
  2⤵
  PID:5488
- C:\Windows\System\ThkAzEn.exe
  C:\Windows\System\ThkAzEn.exe
  2⤵
  PID:5712
- C:\Windows\System\kJBtFIo.exe
  C:\Windows\System\kJBtFIo.exe
  2⤵
  PID:5660
- C:\Windows\System\qNNApoZ.exe
  C:\Windows\System\qNNApoZ.exe
  2⤵
  PID:5848
- C:\Windows\System\VMoQhop.exe
  C:\Windows\System\VMoQhop.exe
  2⤵
  PID:5932
- C:\Windows\System\pvCHueW.exe
  C:\Windows\System\pvCHueW.exe
  2⤵
  PID:6040
- C:\Windows\System\rvFittu.exe
  C:\Windows\System\rvFittu.exe
  2⤵
  PID:1972
- C:\Windows\System\rEQkbaE.exe
  C:\Windows\System\rEQkbaE.exe
  2⤵
  PID:5100
- C:\Windows\System\WdKvnte.exe
  C:\Windows\System\WdKvnte.exe
  2⤵
  PID:5080
- C:\Windows\System\rSYhJya.exe
  C:\Windows\System\rSYhJya.exe
  2⤵
  PID:5196
- C:\Windows\System\YdozYpt.exe
  C:\Windows\System\YdozYpt.exe
  2⤵
  PID:5368
- C:\Windows\System\tLyyGvM.exe
  C:\Windows\System\tLyyGvM.exe
  2⤵
  PID:5728
- C:\Windows\System\alYlLvH.exe
  C:\Windows\System\alYlLvH.exe
  2⤵
  PID:5300
- C:\Windows\System\oGFCoGR.exe
  C:\Windows\System\oGFCoGR.exe
  2⤵
  PID:5416
- C:\Windows\System\RlTdHLP.exe
  C:\Windows\System\RlTdHLP.exe
  2⤵
  PID:5816
- C:\Windows\System\rCzfEQx.exe
  C:\Windows\System\rCzfEQx.exe
  2⤵
  PID:5672
- C:\Windows\System\EKglZJA.exe
  C:\Windows\System\EKglZJA.exe
  2⤵
  PID:5560
- C:\Windows\System\ExXOSKG.exe
  C:\Windows\System\ExXOSKG.exe
  2⤵
  PID:5852
- C:\Windows\System\ZRAODsg.exe
  C:\Windows\System\ZRAODsg.exe
  2⤵
  PID:5460
- C:\Windows\System\GwTPoCH.exe
  C:\Windows\System\GwTPoCH.exe
  2⤵
  PID:6164
- C:\Windows\System\gkpgLmw.exe
  C:\Windows\System\gkpgLmw.exe
  2⤵
  PID:6180
- C:\Windows\System\bqasCWg.exe
  C:\Windows\System\bqasCWg.exe
  2⤵
  PID:6196
- C:\Windows\System\vZFyEtV.exe
  C:\Windows\System\vZFyEtV.exe
  2⤵
  PID:6216
- C:\Windows\System\CrEAWGO.exe
  C:\Windows\System\CrEAWGO.exe
  2⤵
  PID:6232
- C:\Windows\System\XVDaIQR.exe
  C:\Windows\System\XVDaIQR.exe
  2⤵
  PID:6248
- C:\Windows\System\FiHyHBz.exe
  C:\Windows\System\FiHyHBz.exe
  2⤵
  PID:6268
- C:\Windows\System\eFrpVTX.exe
  C:\Windows\System\eFrpVTX.exe
  2⤵
  PID:6284
- C:\Windows\System\acfYflk.exe
  C:\Windows\System\acfYflk.exe
  2⤵
  PID:6304
- C:\Windows\System\aAfQmYs.exe
  C:\Windows\System\aAfQmYs.exe
  2⤵
  PID:6320
- C:\Windows\System\aEZwwrF.exe
  C:\Windows\System\aEZwwrF.exe
  2⤵
  PID:6336
- C:\Windows\System\fHuQujx.exe
  C:\Windows\System\fHuQujx.exe
  2⤵
  PID:6356
- C:\Windows\System\KxGIVWc.exe
  C:\Windows\System\KxGIVWc.exe
  2⤵
  PID:6476
- C:\Windows\System\kUyFutw.exe
  C:\Windows\System\kUyFutw.exe
  2⤵
  PID:6496
- C:\Windows\System\UvYZuqF.exe
  C:\Windows\System\UvYZuqF.exe
  2⤵
  PID:6512
- C:\Windows\System\lxWCAqc.exe
  C:\Windows\System\lxWCAqc.exe
  2⤵
  PID:6528
- C:\Windows\System\dbbqjHa.exe
  C:\Windows\System\dbbqjHa.exe
  2⤵
  PID:6548
- C:\Windows\System\AkOVQmb.exe
  C:\Windows\System\AkOVQmb.exe
  2⤵
  PID:6564
- C:\Windows\System\DDcOePt.exe
  C:\Windows\System\DDcOePt.exe
  2⤵
  PID:6580
- C:\Windows\System\RpnBEeF.exe
  C:\Windows\System\RpnBEeF.exe
  2⤵
  PID:6596
- C:\Windows\System\CmFxxhW.exe
  C:\Windows\System\CmFxxhW.exe
  2⤵
  PID:6616
- C:\Windows\System\RRxJsQo.exe
  C:\Windows\System\RRxJsQo.exe
  2⤵
  PID:6632
- C:\Windows\System\xpBOiXO.exe
  C:\Windows\System\xpBOiXO.exe
  2⤵
  PID:6648
- C:\Windows\System\QPsuAVh.exe
  C:\Windows\System\QPsuAVh.exe
  2⤵
  PID:6664
- C:\Windows\System\diuSpls.exe
  C:\Windows\System\diuSpls.exe
  2⤵
  PID:6740
- C:\Windows\System\GMrDTKM.exe
  C:\Windows\System\GMrDTKM.exe
  2⤵
  PID:6756
- C:\Windows\System\dnWKScY.exe
  C:\Windows\System\dnWKScY.exe
  2⤵
  PID:6776
- C:\Windows\System\yQvHxGC.exe
  C:\Windows\System\yQvHxGC.exe
  2⤵
  PID:6804
- C:\Windows\System\hHozESG.exe
  C:\Windows\System\hHozESG.exe
  2⤵
  PID:6832
- C:\Windows\System\rYVfLKI.exe
  C:\Windows\System\rYVfLKI.exe
  2⤵
  PID:6856
- C:\Windows\System\dUIRGZd.exe
  C:\Windows\System\dUIRGZd.exe
  2⤵
  PID:6872
- C:\Windows\System\biMcnss.exe
  C:\Windows\System\biMcnss.exe
  2⤵
  PID:6896
- C:\Windows\System\EnGWypc.exe
  C:\Windows\System\EnGWypc.exe
  2⤵
  PID:6912
- C:\Windows\System\LSkOjKy.exe
  C:\Windows\System\LSkOjKy.exe
  2⤵
  PID:6932
- C:\Windows\System\RrsbgUv.exe
  C:\Windows\System\RrsbgUv.exe
  2⤵
  PID:6948
- C:\Windows\System\OMmWiaf.exe
  C:\Windows\System\OMmWiaf.exe
  2⤵
  PID:6964
- C:\Windows\System\kVnRHhq.exe
  C:\Windows\System\kVnRHhq.exe
  2⤵
  PID:6980
- C:\Windows\System\JasAMXN.exe
  C:\Windows\System\JasAMXN.exe
  2⤵
  PID:6996
- C:\Windows\System\MekKeHq.exe
  C:\Windows\System\MekKeHq.exe
  2⤵
  PID:7012
- C:\Windows\System\ZnLsbze.exe
  C:\Windows\System\ZnLsbze.exe
  2⤵
  PID:7032
- C:\Windows\System\AyUVSKQ.exe
  C:\Windows\System\AyUVSKQ.exe
  2⤵
  PID:7048
- C:\Windows\System\VccUTrF.exe
  C:\Windows\System\VccUTrF.exe
  2⤵
  PID:7064
- C:\Windows\System\eqiZSTK.exe
  C:\Windows\System\eqiZSTK.exe
  2⤵
  PID:7080
- C:\Windows\System\TuIdRfN.exe
  C:\Windows\System\TuIdRfN.exe
  2⤵
  PID:7096
- C:\Windows\System\WOIxQVO.exe
  C:\Windows\System\WOIxQVO.exe
  2⤵
  PID:7112
- C:\Windows\System\jdrrdeL.exe
  C:\Windows\System\jdrrdeL.exe
  2⤵
  PID:7132
- C:\Windows\System\UOjyyVY.exe
  C:\Windows\System\UOjyyVY.exe
  2⤵
  PID:7148
- C:\Windows\System\HlLyCxA.exe
  C:\Windows\System\HlLyCxA.exe
  2⤵
  PID:7164
- C:\Windows\System\zarcyzo.exe
  C:\Windows\System\zarcyzo.exe
  2⤵
  PID:5200
- C:\Windows\System\VEBWjPA.exe
  C:\Windows\System\VEBWjPA.exe
  2⤵
  PID:5980
- C:\Windows\System\ArBTQAK.exe
  C:\Windows\System\ArBTQAK.exe
  2⤵
  PID:5776
- C:\Windows\System\fsAsZUW.exe
  C:\Windows\System\fsAsZUW.exe
  2⤵
  PID:6008
- C:\Windows\System\AmkKkGt.exe
  C:\Windows\System\AmkKkGt.exe
  2⤵
  PID:4268
- C:\Windows\System\VZIxGDg.exe
  C:\Windows\System\VZIxGDg.exe
  2⤵
  PID:6316
- C:\Windows\System\FYEPngP.exe
  C:\Windows\System\FYEPngP.exe
  2⤵
  PID:6348
- C:\Windows\System\dRZOMjE.exe
  C:\Windows\System\dRZOMjE.exe
  2⤵
  PID:6076
- C:\Windows\System\rPNotRC.exe
  C:\Windows\System\rPNotRC.exe
  2⤵
  PID:6060
- C:\Windows\System\KKLIGwM.exe
  C:\Windows\System\KKLIGwM.exe
  2⤵
  PID:6056
- C:\Windows\System\TtKDMkX.exe
  C:\Windows\System\TtKDMkX.exe
  2⤵
  PID:5180
- C:\Windows\System\zVosGww.exe
  C:\Windows\System\zVosGww.exe
  2⤵
  PID:6332
- C:\Windows\System\TmQtxaO.exe
  C:\Windows\System\TmQtxaO.exe
  2⤵
  PID:6376
- C:\Windows\System\lhWjnqi.exe
  C:\Windows\System\lhWjnqi.exe
  2⤵
  PID:5604
- C:\Windows\System\DuPilHf.exe
  C:\Windows\System\DuPilHf.exe
  2⤵
  PID:5520
- C:\Windows\System\mJTDQaY.exe
  C:\Windows\System\mJTDQaY.exe
  2⤵
  PID:6140
- C:\Windows\System\yHtfTfo.exe
  C:\Windows\System\yHtfTfo.exe
  2⤵
  PID:5408
- C:\Windows\System\BumscEG.exe
  C:\Windows\System\BumscEG.exe
  2⤵
  PID:5704
- C:\Windows\System\owXCNQJ.exe
  C:\Windows\System\owXCNQJ.exe
  2⤵
  PID:6160
- C:\Windows\System\LBlpLLJ.exe
  C:\Windows\System\LBlpLLJ.exe
  2⤵
  PID:6264
- C:\Windows\System\LvXQIxc.exe
  C:\Windows\System\LvXQIxc.exe
  2⤵
  PID:6384
- C:\Windows\System\lMQKBli.exe
  C:\Windows\System\lMQKBli.exe
  2⤵
  PID:6400
- C:\Windows\System\TDUezGD.exe
  C:\Windows\System\TDUezGD.exe
  2⤵
  PID:6416
- C:\Windows\System\YPexanH.exe
  C:\Windows\System\YPexanH.exe
  2⤵
  PID:6432
- C:\Windows\System\IvDMluh.exe
  C:\Windows\System\IvDMluh.exe
  2⤵
  PID:6452
- C:\Windows\System\CTvXAjs.exe
  C:\Windows\System\CTvXAjs.exe
  2⤵
  PID:6468
- C:\Windows\System\mYEJfHS.exe
  C:\Windows\System\mYEJfHS.exe
  2⤵
  PID:6492
- C:\Windows\System\HSVaVof.exe
  C:\Windows\System\HSVaVof.exe
  2⤵
  PID:6624
- C:\Windows\System\PojxFtk.exe
  C:\Windows\System\PojxFtk.exe
  2⤵
  PID:6660
- C:\Windows\System\bQVFkwz.exe
  C:\Windows\System\bQVFkwz.exe
  2⤵
  PID:6544
- C:\Windows\System\CewaPJo.exe
  C:\Windows\System\CewaPJo.exe
  2⤵
  PID:6752
- C:\Windows\System\RUslnsv.exe
  C:\Windows\System\RUslnsv.exe
  2⤵
  PID:6712
- C:\Windows\System\AaepicL.exe
  C:\Windows\System\AaepicL.exe
  2⤵
  PID:6608
- C:\Windows\System\wDhpnhu.exe
  C:\Windows\System\wDhpnhu.exe
  2⤵
  PID:6728
- C:\Windows\System\lthjwBE.exe
  C:\Windows\System\lthjwBE.exe
  2⤵
  PID:6736
- C:\Windows\System\UpZXUEy.exe
  C:\Windows\System\UpZXUEy.exe
  2⤵
  PID:6784
- C:\Windows\System\gXltzNR.exe
  C:\Windows\System\gXltzNR.exe
  2⤵
  PID:6708
- C:\Windows\System\lRLlwbk.exe
  C:\Windows\System\lRLlwbk.exe
  2⤵
  PID:6720
- C:\Windows\System\nzMmfNI.exe
  C:\Windows\System\nzMmfNI.exe
  2⤵
  PID:6824
- C:\Windows\System\XIspXqo.exe
  C:\Windows\System\XIspXqo.exe
  2⤵
  PID:6828
- C:\Windows\System\ZlMNjur.exe
  C:\Windows\System\ZlMNjur.exe
  2⤵
  PID:6844
- C:\Windows\System\HbQikRw.exe
  C:\Windows\System\HbQikRw.exe
  2⤵
  PID:6920
- C:\Windows\System\YmUuabv.exe
  C:\Windows\System\YmUuabv.exe
  2⤵
  PID:6960
- C:\Windows\System\tMOiiVe.exe
  C:\Windows\System\tMOiiVe.exe
  2⤵
  PID:6940
- C:\Windows\System\MgfpQbY.exe
  C:\Windows\System\MgfpQbY.exe
  2⤵
  PID:7180
- C:\Windows\System\PwVVMaZ.exe
  C:\Windows\System\PwVVMaZ.exe
  2⤵
  PID:7204
- C:\Windows\System\tKSAbQx.exe
  C:\Windows\System\tKSAbQx.exe
  2⤵
  PID:7220
- C:\Windows\System\PqYLiLm.exe
  C:\Windows\System\PqYLiLm.exe
  2⤵
  PID:7236
- C:\Windows\System\SXdGHMb.exe
  C:\Windows\System\SXdGHMb.exe
  2⤵
  PID:7252
- C:\Windows\System\XvYTwMZ.exe
  C:\Windows\System\XvYTwMZ.exe
  2⤵
  PID:7272
- C:\Windows\System\MOgpuUX.exe
  C:\Windows\System\MOgpuUX.exe
  2⤵
  PID:7288
- C:\Windows\System\OrdyhHv.exe
  C:\Windows\System\OrdyhHv.exe
  2⤵
  PID:7416
- C:\Windows\System\plnHzdy.exe
  C:\Windows\System\plnHzdy.exe
  2⤵
  PID:7448
- C:\Windows\System\EoNmSFf.exe
  C:\Windows\System\EoNmSFf.exe
  2⤵
  PID:7464
- C:\Windows\System\WVkviPL.exe
  C:\Windows\System\WVkviPL.exe
  2⤵
  PID:7480
- C:\Windows\System\euZQPCa.exe
  C:\Windows\System\euZQPCa.exe
  2⤵
  PID:7496
- C:\Windows\System\OHzJQGv.exe
  C:\Windows\System\OHzJQGv.exe
  2⤵
  PID:7512
- C:\Windows\System\OPhPOYA.exe
  C:\Windows\System\OPhPOYA.exe
  2⤵
  PID:7528
- C:\Windows\System\KSGAPnp.exe
  C:\Windows\System\KSGAPnp.exe
  2⤵
  PID:7544
- C:\Windows\System\IeMSWaW.exe
  C:\Windows\System\IeMSWaW.exe
  2⤵
  PID:7560
- C:\Windows\System\IjgCuiy.exe
  C:\Windows\System\IjgCuiy.exe
  2⤵
  PID:7576
- C:\Windows\System\ATZCnAu.exe
  C:\Windows\System\ATZCnAu.exe
  2⤵
  PID:7596
- C:\Windows\System\vWxqxdt.exe
  C:\Windows\System\vWxqxdt.exe
  2⤵
  PID:7612
- C:\Windows\System\vwWoiUE.exe
  C:\Windows\System\vwWoiUE.exe
  2⤵
  PID:7628
- C:\Windows\System\naYeDaE.exe
  C:\Windows\System\naYeDaE.exe
  2⤵
  PID:7644
- C:\Windows\System\IGkmuSc.exe
  C:\Windows\System\IGkmuSc.exe
  2⤵
  PID:7660
- C:\Windows\System\gPFwJRh.exe
  C:\Windows\System\gPFwJRh.exe
  2⤵
  PID:7676
- C:\Windows\System\pAeoBaQ.exe
  C:\Windows\System\pAeoBaQ.exe
  2⤵
  PID:7696
- C:\Windows\System\azJBfzd.exe
  C:\Windows\System\azJBfzd.exe
  2⤵
  PID:7712
- C:\Windows\System\FwuUvfq.exe
  C:\Windows\System\FwuUvfq.exe
  2⤵
  PID:7732
- C:\Windows\System\KsnrYap.exe
  C:\Windows\System\KsnrYap.exe
  2⤵
  PID:7748
- C:\Windows\System\eEAZOuf.exe
  C:\Windows\System\eEAZOuf.exe
  2⤵
  PID:7764
- C:\Windows\System\DRLcMWW.exe
  C:\Windows\System\DRLcMWW.exe
  2⤵
  PID:7780
- C:\Windows\System\lVqlWYT.exe
  C:\Windows\System\lVqlWYT.exe
  2⤵
  PID:7796
- C:\Windows\System\vEhpyIr.exe
  C:\Windows\System\vEhpyIr.exe
  2⤵
  PID:7812
- C:\Windows\System\omgyVVb.exe
  C:\Windows\System\omgyVVb.exe
  2⤵
  PID:7832
- C:\Windows\System\kRWXwOb.exe
  C:\Windows\System\kRWXwOb.exe
  2⤵
  PID:7848
- C:\Windows\System\zzoCTRD.exe
  C:\Windows\System\zzoCTRD.exe
  2⤵
  PID:7864
- C:\Windows\System\EVLFoXp.exe
  C:\Windows\System\EVLFoXp.exe
  2⤵
  PID:7880
- C:\Windows\System\HpvocDs.exe
  C:\Windows\System\HpvocDs.exe
  2⤵
  PID:7896
- C:\Windows\System\ZoWGija.exe
  C:\Windows\System\ZoWGija.exe
  2⤵
  PID:7912
- C:\Windows\System\hqGOKyO.exe
  C:\Windows\System\hqGOKyO.exe
  2⤵
  PID:7932
- C:\Windows\System\tCGQmWA.exe
  C:\Windows\System\tCGQmWA.exe
  2⤵
  PID:7948
- C:\Windows\System\encjWMB.exe
  C:\Windows\System\encjWMB.exe
  2⤵
  PID:7964
- C:\Windows\System\rzThAtK.exe
  C:\Windows\System\rzThAtK.exe
  2⤵
  PID:7980
- C:\Windows\System\cKyrXUx.exe
  C:\Windows\System\cKyrXUx.exe
  2⤵
  PID:7996
- C:\Windows\System\AdooXPt.exe
  C:\Windows\System\AdooXPt.exe
  2⤵
  PID:8012
- C:\Windows\System\EIHZtpu.exe
  C:\Windows\System\EIHZtpu.exe
  2⤵
  PID:8028
- C:\Windows\System\hPBWSag.exe
  C:\Windows\System\hPBWSag.exe
  2⤵
  PID:8044
- C:\Windows\System\YgCeFJB.exe
  C:\Windows\System\YgCeFJB.exe
  2⤵
  PID:8060
- C:\Windows\System\jQYLhUz.exe
  C:\Windows\System\jQYLhUz.exe
  2⤵
  PID:8080
- C:\Windows\System\cLjWIUm.exe
  C:\Windows\System\cLjWIUm.exe
  2⤵
  PID:8096
- C:\Windows\System\HLeXXpj.exe
  C:\Windows\System\HLeXXpj.exe
  2⤵
  PID:8112
- C:\Windows\System\DweVhZF.exe
  C:\Windows\System\DweVhZF.exe
  2⤵
  PID:8128
- C:\Windows\System\bGciQvc.exe
  C:\Windows\System\bGciQvc.exe
  2⤵
  PID:8148
- C:\Windows\System\JjQhgsY.exe
  C:\Windows\System\JjQhgsY.exe
  2⤵
  PID:8164
- C:\Windows\System\YOdrJpx.exe
  C:\Windows\System\YOdrJpx.exe
  2⤵
  PID:8180
- C:\Windows\System\eIQzpvz.exe
  C:\Windows\System\eIQzpvz.exe
  2⤵
  PID:5164
- C:\Windows\System\uHMMLwr.exe
  C:\Windows\System\uHMMLwr.exe
  2⤵
  PID:5484
- C:\Windows\System\mUTlQig.exe
  C:\Windows\System\mUTlQig.exe
  2⤵
  PID:7108
- C:\Windows\System\GQeCjXW.exe
  C:\Windows\System\GQeCjXW.exe
  2⤵
  PID:7004
- C:\Windows\System\RsumyzM.exe
  C:\Windows\System\RsumyzM.exe
  2⤵
  PID:5428
- C:\Windows\System\qSTIQfW.exe
  C:\Windows\System\qSTIQfW.exe
  2⤵
  PID:6396
- C:\Windows\System\udxBxAm.exe
  C:\Windows\System\udxBxAm.exe
  2⤵
  PID:7020
- C:\Windows\System\YiVDiff.exe
  C:\Windows\System\YiVDiff.exe
  2⤵
  PID:6556
- C:\Windows\System\TTtzqnS.exe
  C:\Windows\System\TTtzqnS.exe
  2⤵
  PID:6540
- C:\Windows\System\UtDaBLV.exe
  C:\Windows\System\UtDaBLV.exe
  2⤵
  PID:6644
- C:\Windows\System\fCMvQHL.exe
  C:\Windows\System\fCMvQHL.exe
  2⤵
  PID:6840
- C:\Windows\System\fVccehA.exe
  C:\Windows\System\fVccehA.exe
  2⤵
  PID:7024
- C:\Windows\System\qUCIIva.exe
  C:\Windows\System\qUCIIva.exe
  2⤵
  PID:7092
- C:\Windows\System\nCXHESl.exe
  C:\Windows\System\nCXHESl.exe
  2⤵
  PID:7232
- C:\Windows\System\QCdrWgW.exe
  C:\Windows\System\QCdrWgW.exe
  2⤵
  PID:6260
- C:\Windows\System\msrAsuc.exe
  C:\Windows\System\msrAsuc.exe
  2⤵
  PID:5928
- C:\Windows\System\ayIbWiZ.exe
  C:\Windows\System\ayIbWiZ.exe
  2⤵
  PID:5248
- C:\Windows\System\DiNPaaS.exe
  C:\Windows\System\DiNPaaS.exe
  2⤵
  PID:6344
- C:\Windows\System\gDYFgUg.exe
  C:\Windows\System\gDYFgUg.exe
  2⤵
  PID:6560
- C:\Windows\System\FgLXseV.exe
  C:\Windows\System\FgLXseV.exe
  2⤵
  PID:7192
- C:\Windows\System\TWIhNxs.exe
  C:\Windows\System\TWIhNxs.exe
  2⤵
  PID:2708
- C:\Windows\System\mDLPXgJ.exe
  C:\Windows\System\mDLPXgJ.exe
  2⤵
  PID:5372
- C:\Windows\System\MFotRXc.exe
  C:\Windows\System\MFotRXc.exe
  2⤵
  PID:5476
- C:\Windows\System\taVVBqe.exe
  C:\Windows\System\taVVBqe.exe
  2⤵
  PID:6408
- C:\Windows\System\plJsFsb.exe
  C:\Windows\System\plJsFsb.exe
  2⤵
  PID:6256
- C:\Windows\System\XaWBNxP.exe
  C:\Windows\System\XaWBNxP.exe
  2⤵
  PID:7316
- C:\Windows\System\XgEiEor.exe
  C:\Windows\System\XgEiEor.exe
  2⤵
  PID:6908
- C:\Windows\System\DodgXFh.exe
  C:\Windows\System\DodgXFh.exe
  2⤵
  PID:7248
- C:\Windows\System\eBQTKIn.exe
  C:\Windows\System\eBQTKIn.exe
  2⤵
  PID:5264
- C:\Windows\System\JGxpQeg.exe
  C:\Windows\System\JGxpQeg.exe
  2⤵
  PID:5392
- C:\Windows\System\DHeqgYi.exe
  C:\Windows\System\DHeqgYi.exe
  2⤵
  PID:5812
- C:\Windows\System\AjYLMck.exe
  C:\Windows\System\AjYLMck.exe
  2⤵
  PID:6764
- C:\Windows\System\lVqaxRd.exe
  C:\Windows\System\lVqaxRd.exe
  2⤵
  PID:7364
- C:\Windows\System\XOSGLzz.exe
  C:\Windows\System\XOSGLzz.exe
  2⤵
  PID:7380
- C:\Windows\System\mhvndwa.exe
  C:\Windows\System\mhvndwa.exe
  2⤵
  PID:7396
- C:\Windows\System\fbfZsuI.exe
  C:\Windows\System\fbfZsuI.exe
  2⤵
  PID:7412
- C:\Windows\System\lfeLmcU.exe
  C:\Windows\System\lfeLmcU.exe
  2⤵
  PID:7436
- C:\Windows\System\cidbtMk.exe
  C:\Windows\System\cidbtMk.exe
  2⤵
  PID:7460
- C:\Windows\System\vzrxnrw.exe
  C:\Windows\System\vzrxnrw.exe
  2⤵
  PID:7524
- C:\Windows\System\dwMDzbP.exe
  C:\Windows\System\dwMDzbP.exe
  2⤵
  PID:7592
- C:\Windows\System\NesmJsr.exe
  C:\Windows\System\NesmJsr.exe
  2⤵
  PID:7652
- C:\Windows\System\iDAMqhv.exe
  C:\Windows\System\iDAMqhv.exe
  2⤵
  PID:7688
- C:\Windows\System\WpgGJJz.exe
  C:\Windows\System\WpgGJJz.exe
  2⤵
  PID:7472
- C:\Windows\System\RAFjOfH.exe
  C:\Windows\System\RAFjOfH.exe
  2⤵
  PID:7536
- C:\Windows\System\hEYhBFv.exe
  C:\Windows\System\hEYhBFv.exe
  2⤵
  PID:7640
- C:\Windows\System\DJVKjHI.exe
  C:\Windows\System\DJVKjHI.exe
  2⤵
  PID:7760
- C:\Windows\System\IlRjVxm.exe
  C:\Windows\System\IlRjVxm.exe
  2⤵
  PID:7824
- C:\Windows\System\CjWbpYN.exe
  C:\Windows\System\CjWbpYN.exe
  2⤵
  PID:7740
- C:\Windows\System\GwpjQbm.exe
  C:\Windows\System\GwpjQbm.exe
  2⤵
  PID:7888
- C:\Windows\System\fLlbxOn.exe
  C:\Windows\System\fLlbxOn.exe
  2⤵
  PID:7804
- C:\Windows\System\jfafBhn.exe
  C:\Windows\System\jfafBhn.exe
  2⤵
  PID:7872
- C:\Windows\System\YOYfbIL.exe
  C:\Windows\System\YOYfbIL.exe
  2⤵
  PID:7956
- C:\Windows\System\zUBIsAQ.exe
  C:\Windows\System\zUBIsAQ.exe
  2⤵
  PID:8024
- C:\Windows\System\HOeusnX.exe
  C:\Windows\System\HOeusnX.exe
  2⤵
  PID:8088
- C:\Windows\System\vhpXCso.exe
  C:\Windows\System\vhpXCso.exe
  2⤵
  PID:8156
- C:\Windows\System\bBXeYWY.exe
  C:\Windows\System\bBXeYWY.exe
  2⤵
  PID:7140
- C:\Windows\System\AmsvPgX.exe
  C:\Windows\System\AmsvPgX.exe
  2⤵
  PID:8004
- C:\Windows\System\jztCYai.exe
  C:\Windows\System\jztCYai.exe
  2⤵
  PID:8036
- C:\Windows\System\UpQVwoC.exe
  C:\Windows\System\UpQVwoC.exe
  2⤵
  PID:6888
- C:\Windows\System\AuKSLyW.exe
  C:\Windows\System\AuKSLyW.exe
  2⤵
  PID:8076
- C:\Windows\System\Ojolsci.exe
  C:\Windows\System\Ojolsci.exe
  2⤵
  PID:8136
- C:\Windows\System\dnaspRW.exe
  C:\Windows\System\dnaspRW.exe
  2⤵
  PID:2272
- C:\Windows\System\FisOjNY.exe
  C:\Windows\System\FisOjNY.exe
  2⤵
  PID:7076
- C:\Windows\System\DUHXsFJ.exe
  C:\Windows\System\DUHXsFJ.exe
  2⤵
  PID:5468
- C:\Windows\System\SKmLsCk.exe
  C:\Windows\System\SKmLsCk.exe
  2⤵
  PID:6732
- C:\Windows\System\HQUqJdo.exe
  C:\Windows\System\HQUqJdo.exe
  2⤵
  PID:6536
- C:\Windows\System\xgoVIMT.exe
  C:\Windows\System\xgoVIMT.exe
  2⤵
  PID:7124
- C:\Windows\System\bkNMtzr.exe
  C:\Windows\System\bkNMtzr.exe
  2⤵
  PID:7296
- C:\Windows\System\lGjXaFS.exe
  C:\Windows\System\lGjXaFS.exe
  2⤵
  PID:7308
- C:\Windows\System\cqggGwm.exe
  C:\Windows\System\cqggGwm.exe
  2⤵
  PID:6448
- C:\Windows\System\lqbmkYi.exe
  C:\Windows\System\lqbmkYi.exe
  2⤵
  PID:7044
- C:\Windows\System\pEqntUA.exe
  C:\Windows\System\pEqntUA.exe
  2⤵
  PID:6924
- C:\Windows\System\EohjrJo.exe
  C:\Windows\System\EohjrJo.exe
  2⤵
  PID:6328
- C:\Windows\System\THMrfVm.exe
  C:\Windows\System\THMrfVm.exe
  2⤵
  PID:6864
- C:\Windows\System\iCVLJhu.exe
  C:\Windows\System\iCVLJhu.exe
  2⤵
  PID:7188
- C:\Windows\System\CdqcfNv.exe
  C:\Windows\System\CdqcfNv.exe
  2⤵
  PID:6300
- C:\Windows\System\WPJEZau.exe
  C:\Windows\System\WPJEZau.exe
  2⤵
  PID:4640
- C:\Windows\System\THgjOMj.exe
  C:\Windows\System\THgjOMj.exe
  2⤵
  PID:6604
- C:\Windows\System\hObchHv.exe
  C:\Windows\System\hObchHv.exe
  2⤵
  PID:6848
- C:\Windows\System\QQltuQa.exe
  C:\Windows\System\QQltuQa.exe
  2⤵
  PID:7280
- C:\Windows\System\rHfJIjG.exe
  C:\Windows\System\rHfJIjG.exe
  2⤵
  PID:7332
- C:\Windows\System\rBbXkdA.exe
  C:\Windows\System\rBbXkdA.exe
  2⤵
  PID:7392
- C:\Windows\System\QaRrzZW.exe
  C:\Windows\System\QaRrzZW.exe
  2⤵
  PID:7520
- C:\Windows\System\SMBDcVg.exe
  C:\Windows\System\SMBDcVg.exe
  2⤵
  PID:7604
- C:\Windows\System\WEcdnqt.exe
  C:\Windows\System\WEcdnqt.exe
  2⤵
  PID:7988
- C:\Windows\System\MiONnIM.exe
  C:\Windows\System\MiONnIM.exe
  2⤵
  PID:8188
- C:\Windows\System\FIgudVy.exe
  C:\Windows\System\FIgudVy.exe
  2⤵
  PID:8144
- C:\Windows\System\LTmyrOO.exe
  C:\Windows\System\LTmyrOO.exe
  2⤵
  PID:8176
- C:\Windows\System\msFJdQw.exe
  C:\Windows\System\msFJdQw.exe
  2⤵
  PID:7508
- C:\Windows\System\olPGmAY.exe
  C:\Windows\System\olPGmAY.exe
  2⤵
  PID:7856
- C:\Windows\System\AfLQhuC.exe
  C:\Windows\System\AfLQhuC.exe
  2⤵
  PID:6972
- C:\Windows\System\eQzTCBn.exe
  C:\Windows\System\eQzTCBn.exe
  2⤵
  PID:7408
- C:\Windows\System\gelwEpo.exe
  C:\Windows\System\gelwEpo.exe
  2⤵
  PID:7920
- C:\Windows\System\pBWCLpc.exe
  C:\Windows\System\pBWCLpc.exe
  2⤵
  PID:7928
- C:\Windows\System\jFTBAjM.exe
  C:\Windows\System\jFTBAjM.exe
  2⤵
  PID:7200
- C:\Windows\System\UqgmRKq.exe
  C:\Windows\System\UqgmRKq.exe
  2⤵
  PID:6904
- C:\Windows\System\NKAPgPU.exe
  C:\Windows\System\NKAPgPU.exe
  2⤵
  PID:7196
- C:\Windows\System\Tlpwgew.exe
  C:\Windows\System\Tlpwgew.exe
  2⤵
  PID:7324
- C:\Windows\System\sIMciGe.exe
  C:\Windows\System\sIMciGe.exe
  2⤵
  PID:7432
- C:\Windows\System\ZfaxLCa.exe
  C:\Windows\System\ZfaxLCa.exe
  2⤵
  PID:6680
- C:\Windows\System\FWfzMeE.exe
  C:\Windows\System\FWfzMeE.exe
  2⤵
  PID:6688
- C:\Windows\System\dmGdjxt.exe
  C:\Windows\System\dmGdjxt.exe
  2⤵
  PID:7388
- C:\Windows\System\oaoyhaN.exe
  C:\Windows\System\oaoyhaN.exe
  2⤵
  PID:7624
- C:\Windows\System\FCsUyvc.exe
  C:\Windows\System\FCsUyvc.exe
  2⤵
  PID:7668
- C:\Windows\System\IZGNZgM.exe
  C:\Windows\System\IZGNZgM.exe
  2⤵
  PID:7572
- C:\Windows\System\Gllvowp.exe
  C:\Windows\System\Gllvowp.exe
  2⤵
  PID:7844
- C:\Windows\System\veGJIRk.exe
  C:\Windows\System\veGJIRk.exe
  2⤵
  PID:6436
- C:\Windows\System\aOSjhqG.exe
  C:\Windows\System\aOSjhqG.exe
  2⤵
  PID:7972
- C:\Windows\System\eOxdmen.exe
  C:\Windows\System\eOxdmen.exe
  2⤵
  PID:7908
- C:\Windows\System\cHjCLPZ.exe
  C:\Windows\System\cHjCLPZ.exe
  2⤵
  PID:6884
- C:\Windows\System\pgnapco.exe
  C:\Windows\System\pgnapco.exe
  2⤵
  PID:6292
- C:\Windows\System\tDdoBHp.exe
  C:\Windows\System\tDdoBHp.exe
  2⤵
  PID:7160
- C:\Windows\System\ezwXFwD.exe
  C:\Windows\System\ezwXFwD.exe
  2⤵
  PID:5424
- C:\Windows\System\oUWuKgx.exe
  C:\Windows\System\oUWuKgx.exe
  2⤵
  PID:7608
- C:\Windows\System\GIDCFZO.exe
  C:\Windows\System\GIDCFZO.exe
  2⤵
  PID:5268
- C:\Windows\System\FFXFbDz.exe
  C:\Windows\System\FFXFbDz.exe
  2⤵
  PID:6524
- C:\Windows\System\GFRODDS.exe
  C:\Windows\System\GFRODDS.exe
  2⤵
  PID:7312
- C:\Windows\System\BoQFEHH.exe
  C:\Windows\System\BoQFEHH.exe
  2⤵
  PID:7244
- C:\Windows\System\qSQIZFp.exe
  C:\Windows\System\qSQIZFp.exe
  2⤵
  PID:7336
- C:\Windows\System\cUURKWJ.exe
  C:\Windows\System\cUURKWJ.exe
  2⤵
  PID:7692
- C:\Windows\System\PuRGINK.exe
  C:\Windows\System\PuRGINK.exe
  2⤵
  PID:6212
- C:\Windows\System\QjftWfk.exe
  C:\Windows\System\QjftWfk.exe
  2⤵
  PID:7860
- C:\Windows\System\XdYLTAf.exe
  C:\Windows\System\XdYLTAf.exe
  2⤵
  PID:7704
- C:\Windows\System\lUeJxeM.exe
  C:\Windows\System\lUeJxeM.exe
  2⤵
  PID:5724
- C:\Windows\System\SyXCgEy.exe
  C:\Windows\System\SyXCgEy.exe
  2⤵
  PID:7304
- C:\Windows\System\SrgJTnc.exe
  C:\Windows\System\SrgJTnc.exe
  2⤵
  PID:8196
- C:\Windows\System\VIqzIkn.exe
  C:\Windows\System\VIqzIkn.exe
  2⤵
  PID:8212
- C:\Windows\System\fMkNPkJ.exe
  C:\Windows\System\fMkNPkJ.exe
  2⤵
  PID:8228
- C:\Windows\System\JOjCLAv.exe
  C:\Windows\System\JOjCLAv.exe
  2⤵
  PID:8244
- C:\Windows\System\RZJNBDN.exe
  C:\Windows\System\RZJNBDN.exe
  2⤵
  PID:8260
- C:\Windows\System\HhgQBOX.exe
  C:\Windows\System\HhgQBOX.exe
  2⤵
  PID:8276
- C:\Windows\System\pwxDVIj.exe
  C:\Windows\System\pwxDVIj.exe
  2⤵
  PID:8292
- C:\Windows\System\tpoJcAQ.exe
  C:\Windows\System\tpoJcAQ.exe
  2⤵
  PID:8308
- C:\Windows\System\PBhsTxr.exe
  C:\Windows\System\PBhsTxr.exe
  2⤵
  PID:8324
- C:\Windows\System\JbeWadv.exe
  C:\Windows\System\JbeWadv.exe
  2⤵
  PID:8340
- C:\Windows\System\RoNGART.exe
  C:\Windows\System\RoNGART.exe
  2⤵
  PID:8356
- C:\Windows\System\gnXNBXI.exe
  C:\Windows\System\gnXNBXI.exe
  2⤵
  PID:8372
- C:\Windows\System\HNtIClm.exe
  C:\Windows\System\HNtIClm.exe
  2⤵
  PID:8388
- C:\Windows\System\sMxpjXR.exe
  C:\Windows\System\sMxpjXR.exe
  2⤵
  PID:8404
- C:\Windows\System\RpJgKbu.exe
  C:\Windows\System\RpJgKbu.exe
  2⤵
  PID:8420
- C:\Windows\System\WXcdMqV.exe
  C:\Windows\System\WXcdMqV.exe
  2⤵
  PID:8436
- C:\Windows\System\yOjzXhO.exe
  C:\Windows\System\yOjzXhO.exe
  2⤵
  PID:8452
- C:\Windows\System\KNOVFse.exe
  C:\Windows\System\KNOVFse.exe
  2⤵
  PID:8468
- C:\Windows\System\cNGoLCQ.exe
  C:\Windows\System\cNGoLCQ.exe
  2⤵
  PID:8484
- C:\Windows\System\NtMyBUQ.exe
  C:\Windows\System\NtMyBUQ.exe
  2⤵
  PID:8500
- C:\Windows\System\ioGyAVN.exe
  C:\Windows\System\ioGyAVN.exe
  2⤵
  PID:8516
- C:\Windows\System\WSSoKRC.exe
  C:\Windows\System\WSSoKRC.exe
  2⤵
  PID:8532
- C:\Windows\System\jnAjNiC.exe
  C:\Windows\System\jnAjNiC.exe
  2⤵
  PID:8548
- C:\Windows\System\ZNwBvhk.exe
  C:\Windows\System\ZNwBvhk.exe
  2⤵
  PID:8564
- C:\Windows\System\RPXmMww.exe
  C:\Windows\System\RPXmMww.exe
  2⤵
  PID:8588
- C:\Windows\System\mWSZTtb.exe
  C:\Windows\System\mWSZTtb.exe
  2⤵
  PID:8604
- C:\Windows\System\mJTDdxc.exe
  C:\Windows\System\mJTDdxc.exe
  2⤵
  PID:8620
- C:\Windows\System\lgXcArO.exe
  C:\Windows\System\lgXcArO.exe
  2⤵
  PID:8636
- C:\Windows\System\hEaXtKY.exe
  C:\Windows\System\hEaXtKY.exe
  2⤵
  PID:8652
- C:\Windows\System\ssBBHDO.exe
  C:\Windows\System\ssBBHDO.exe
  2⤵
  PID:8668
- C:\Windows\System\alXrTrY.exe
  C:\Windows\System\alXrTrY.exe
  2⤵
  PID:8684
- C:\Windows\System\hXfNAEL.exe
  C:\Windows\System\hXfNAEL.exe
  2⤵
  PID:8700
- C:\Windows\System\GNRuDth.exe
  C:\Windows\System\GNRuDth.exe
  2⤵
  PID:8716
- C:\Windows\System\rDVkfnJ.exe
  C:\Windows\System\rDVkfnJ.exe
  2⤵
  PID:8736
- C:\Windows\System\tuiEGkZ.exe
  C:\Windows\System\tuiEGkZ.exe
  2⤵
  PID:8760
- C:\Windows\System\OdREaYn.exe
  C:\Windows\System\OdREaYn.exe
  2⤵
  PID:8776
- C:\Windows\System\CUYXzDc.exe
  C:\Windows\System\CUYXzDc.exe
  2⤵
  PID:8792
- C:\Windows\System\twfMKLT.exe
  C:\Windows\System\twfMKLT.exe
  2⤵
  PID:8808
- C:\Windows\System\Dfiyowk.exe
  C:\Windows\System\Dfiyowk.exe
  2⤵
  PID:8824
- C:\Windows\System\VUlbfTv.exe
  C:\Windows\System\VUlbfTv.exe
  2⤵
  PID:8844
- C:\Windows\System\kHahoBi.exe
  C:\Windows\System\kHahoBi.exe
  2⤵
  PID:8860
- C:\Windows\System\OMafyKg.exe
  C:\Windows\System\OMafyKg.exe
  2⤵
  PID:8876
- C:\Windows\System\PUvANov.exe
  C:\Windows\System\PUvANov.exe
  2⤵
  PID:8896
- C:\Windows\System\xRyGIYb.exe
  C:\Windows\System\xRyGIYb.exe
  2⤵
  PID:8912
- C:\Windows\System\mHTWUof.exe
  C:\Windows\System\mHTWUof.exe
  2⤵
  PID:8932
- C:\Windows\System\iocHcYy.exe
  C:\Windows\System\iocHcYy.exe
  2⤵
  PID:9000
- C:\Windows\System\TQcHTvc.exe
  C:\Windows\System\TQcHTvc.exe
  2⤵
  PID:9016
- C:\Windows\System\kKXKgmt.exe
  C:\Windows\System\kKXKgmt.exe
  2⤵
  PID:9032
- C:\Windows\System\AnMBSaC.exe
  C:\Windows\System\AnMBSaC.exe
  2⤵
  PID:9048
- C:\Windows\System\uzndCGh.exe
  C:\Windows\System\uzndCGh.exe
  2⤵
  PID:9064
- C:\Windows\System\rZHiEfr.exe
  C:\Windows\System\rZHiEfr.exe
  2⤵
  PID:9080
- C:\Windows\System\YQxJLJG.exe
  C:\Windows\System\YQxJLJG.exe
  2⤵
  PID:9100
- C:\Windows\System\mdYKGka.exe
  C:\Windows\System\mdYKGka.exe
  2⤵
  PID:9116
- C:\Windows\System\IPbgIFK.exe
  C:\Windows\System\IPbgIFK.exe
  2⤵
  PID:9132
- C:\Windows\System\CMSgSVe.exe
  C:\Windows\System\CMSgSVe.exe
  2⤵
  PID:9148
- C:\Windows\System\pyOREuv.exe
  C:\Windows\System\pyOREuv.exe
  2⤵
  PID:9164
- C:\Windows\System\ovOjZzc.exe
  C:\Windows\System\ovOjZzc.exe
  2⤵
  PID:9180
- C:\Windows\System\SGUPusm.exe
  C:\Windows\System\SGUPusm.exe
  2⤵
  PID:9196
- C:\Windows\System\KmULMBj.exe
  C:\Windows\System\KmULMBj.exe
  2⤵
  PID:9212
- C:\Windows\System\XfxtmHz.exe
  C:\Windows\System\XfxtmHz.exe
  2⤵
  PID:6464
- C:\Windows\System\ZZuJaRS.exe
  C:\Windows\System\ZZuJaRS.exe
  2⤵
  PID:6796
- C:\Windows\System\fToDPMy.exe
  C:\Windows\System\fToDPMy.exe
  2⤵
  PID:7556
- C:\Windows\System\zCgZJTo.exe
  C:\Windows\System\zCgZJTo.exe
  2⤵
  PID:6444
- C:\Windows\System\uxjwLpR.exe
  C:\Windows\System\uxjwLpR.exe
  2⤵
  PID:7584
- C:\Windows\System\ZsEscMo.exe
  C:\Windows\System\ZsEscMo.exe
  2⤵
  PID:8208
- C:\Windows\System\pixlHFG.exe
  C:\Windows\System\pixlHFG.exe
  2⤵
  PID:8336
- C:\Windows\System\GBsrvcT.exe
  C:\Windows\System\GBsrvcT.exe
  2⤵
  PID:8428
- C:\Windows\System\ZXUMKpf.exe
  C:\Windows\System\ZXUMKpf.exe
  2⤵
  PID:8496
- C:\Windows\System\HWTQGXh.exe
  C:\Windows\System\HWTQGXh.exe
  2⤵
  PID:8560
- C:\Windows\System\fQrxJfA.exe
  C:\Windows\System\fQrxJfA.exe
  2⤵
  PID:8412
- C:\Windows\System\jMxGvXy.exe
  C:\Windows\System\jMxGvXy.exe
  2⤵
  PID:7504
- C:\Windows\System\xnjkViJ.exe
  C:\Windows\System\xnjkViJ.exe
  2⤵
  PID:8252
- C:\Windows\System\RYJidBt.exe
  C:\Windows\System\RYJidBt.exe
  2⤵
  PID:8352
- C:\Windows\System\IXCcOkW.exe
  C:\Windows\System\IXCcOkW.exe
  2⤵
  PID:8444
- C:\Windows\System\OiwzzZW.exe
  C:\Windows\System\OiwzzZW.exe
  2⤵
  PID:8508
- C:\Windows\System\KIFCXEd.exe
  C:\Windows\System\KIFCXEd.exe
  2⤵
  PID:8596
- C:\Windows\System\nrEmDKd.exe
  C:\Windows\System\nrEmDKd.exe
  2⤵
  PID:8612
- C:\Windows\System\ArIWMwS.exe
  C:\Windows\System\ArIWMwS.exe
  2⤵
  PID:8692
- C:\Windows\System\clZpqKr.exe
  C:\Windows\System\clZpqKr.exe
  2⤵
  PID:8732
- C:\Windows\System\mxRqJgb.exe
  C:\Windows\System\mxRqJgb.exe
  2⤵
  PID:8800
- C:\Windows\System\SWiRwra.exe
  C:\Windows\System\SWiRwra.exe
  2⤵
  PID:8840
- C:\Windows\System\wsSrMWc.exe
  C:\Windows\System\wsSrMWc.exe
  2⤵
  PID:8836
- C:\Windows\System\WzGCcnA.exe
  C:\Windows\System\WzGCcnA.exe
  2⤵
  PID:8644
- C:\Windows\System\CpdJDcH.exe
  C:\Windows\System\CpdJDcH.exe
  2⤵
  PID:8940
- C:\Windows\System\CurbbMa.exe
  C:\Windows\System\CurbbMa.exe
  2⤵
  PID:8816
- C:\Windows\System\iLGzaFy.exe
  C:\Windows\System\iLGzaFy.exe
  2⤵
  PID:8884
- C:\Windows\System\khotNkC.exe
  C:\Windows\System\khotNkC.exe
  2⤵
  PID:8928
- C:\Windows\System\cOGmxOz.exe
  C:\Windows\System\cOGmxOz.exe
  2⤵
  PID:8948
- C:\Windows\System\fVoWcXy.exe
  C:\Windows\System\fVoWcXy.exe
  2⤵
  PID:8972
- C:\Windows\System\kQJLDbH.exe
  C:\Windows\System\kQJLDbH.exe
  2⤵
  PID:8984
- C:\Windows\System\QpqewsL.exe
  C:\Windows\System\QpqewsL.exe
  2⤵
  PID:9024
- C:\Windows\System\HjFREfl.exe
  C:\Windows\System\HjFREfl.exe
  2⤵
  PID:9088
- C:\Windows\System\uHeFqgf.exe
  C:\Windows\System\uHeFqgf.exe
  2⤵
  PID:9160
- C:\Windows\System\tCWFZVn.exe
  C:\Windows\System\tCWFZVn.exe
  2⤵
  PID:9072
- C:\Windows\System\BUrTXjt.exe
  C:\Windows\System\BUrTXjt.exe
  2⤵
  PID:9076
- C:\Windows\System\LUpDKgq.exe
  C:\Windows\System\LUpDKgq.exe
  2⤵
  PID:8268
- C:\Windows\System\KLbxaoo.exe
  C:\Windows\System\KLbxaoo.exe
  2⤵
  PID:9112
- C:\Windows\System\PVxcnMx.exe
  C:\Windows\System\PVxcnMx.exe
  2⤵
  PID:9172
- C:\Windows\System\lUIFEpp.exe
  C:\Windows\System\lUIFEpp.exe
  2⤵
  PID:8492
- C:\Windows\System\BVkPKaD.exe
  C:\Windows\System\BVkPKaD.exe
  2⤵
  PID:7440
- C:\Windows\System\CyFXIGT.exe
  C:\Windows\System\CyFXIGT.exe
  2⤵
  PID:8396
- C:\Windows\System\cyiTWoM.exe
  C:\Windows\System\cyiTWoM.exe
  2⤵
  PID:9208
- C:\Windows\System\NWTTToA.exe
  C:\Windows\System\NWTTToA.exe
  2⤵
  PID:8348
- C:\Windows\System\ppEMNNW.exe
  C:\Windows\System\ppEMNNW.exe
  2⤵
  PID:8728
- C:\Windows\System\BSJFuNZ.exe
  C:\Windows\System\BSJFuNZ.exe
  2⤵
  PID:8712
- C:\Windows\System\PmIxNUT.exe
  C:\Windows\System\PmIxNUT.exe
  2⤵
  PID:8924
- C:\Windows\System\khlzoLL.exe
  C:\Windows\System\khlzoLL.exe
  2⤵
  PID:8664
- C:\Windows\System\sWNPwvK.exe
  C:\Windows\System\sWNPwvK.exe
  2⤵
  PID:8384
- C:\Windows\System\SIKzTfQ.exe
  C:\Windows\System\SIKzTfQ.exe
  2⤵
  PID:8660
- C:\Windows\System\XIxPwHl.exe
  C:\Windows\System\XIxPwHl.exe
  2⤵
  PID:8904
- C:\Windows\System\EJONnBR.exe
  C:\Windows\System\EJONnBR.exe
  2⤵
  PID:8852
- C:\Windows\System\aDSXZjX.exe
  C:\Windows\System\aDSXZjX.exe
  2⤵
  PID:8956
- C:\Windows\System\pccqeZB.exe
  C:\Windows\System\pccqeZB.exe
  2⤵
  PID:8980
- C:\Windows\System\POQVeYw.exe
  C:\Windows\System\POQVeYw.exe
  2⤵
  PID:8996
- C:\Windows\System\mkRsYCB.exe
  C:\Windows\System\mkRsYCB.exe
  2⤵
  PID:9012
- C:\Windows\System\wjiGiVS.exe
  C:\Windows\System\wjiGiVS.exe
  2⤵
  PID:8204
- C:\Windows\System\YVrzTBa.exe
  C:\Windows\System\YVrzTBa.exe
  2⤵
  PID:9156
- C:\Windows\System\DDTUAZr.exe
  C:\Windows\System\DDTUAZr.exe
  2⤵
  PID:8556
- C:\Windows\System\DSrgnIB.exe
  C:\Windows\System\DSrgnIB.exe
  2⤵
  PID:8724
- C:\Windows\System\AHBErkM.exe
  C:\Windows\System\AHBErkM.exe
  2⤵
  PID:8224
- C:\Windows\System\BwOIyiG.exe
  C:\Windows\System\BwOIyiG.exe
  2⤵
  PID:8968
- C:\Windows\System\lZhqyAV.exe
  C:\Windows\System\lZhqyAV.exe
  2⤵
  PID:9188
- C:\Windows\System\zAHcbzv.exe
  C:\Windows\System\zAHcbzv.exe
  2⤵
  PID:8920
- C:\Windows\System\lvYpEEp.exe
  C:\Windows\System\lvYpEEp.exe
  2⤵
  PID:8332
- C:\Windows\System\eEeFscn.exe
  C:\Windows\System\eEeFscn.exe
  2⤵
  PID:9056
- C:\Windows\System\ZmKaDGJ.exe
  C:\Windows\System\ZmKaDGJ.exe
  2⤵
  PID:7428
- C:\Windows\System\MPHRMtA.exe
  C:\Windows\System\MPHRMtA.exe
  2⤵
  PID:8628
- C:\Windows\System\ykVLctj.exe
  C:\Windows\System\ykVLctj.exe
  2⤵
  PID:8708
- C:\Windows\System\aKMKqlp.exe
  C:\Windows\System\aKMKqlp.exe
  2⤵
  PID:8748
- C:\Windows\System\OnNLNHc.exe
  C:\Windows\System\OnNLNHc.exe
  2⤵
  PID:9124
- C:\Windows\System\LAvPuTF.exe
  C:\Windows\System\LAvPuTF.exe
  2⤵
  PID:9220
- C:\Windows\System\HSvRBOM.exe
  C:\Windows\System\HSvRBOM.exe
  2⤵
  PID:9236
- C:\Windows\System\wGuYWQn.exe
  C:\Windows\System\wGuYWQn.exe
  2⤵
  PID:9252
- C:\Windows\System\wdBlWPz.exe
  C:\Windows\System\wdBlWPz.exe
  2⤵
  PID:9268
- C:\Windows\System\VfPmsbY.exe
  C:\Windows\System\VfPmsbY.exe
  2⤵
  PID:9284
- C:\Windows\System\lQKPbQp.exe
  C:\Windows\System\lQKPbQp.exe
  2⤵
  PID:9300
- C:\Windows\System\tWsSfZg.exe
  C:\Windows\System\tWsSfZg.exe
  2⤵
  PID:9316
- C:\Windows\System\gOESolM.exe
  C:\Windows\System\gOESolM.exe
  2⤵
  PID:9332
- C:\Windows\System\xBysHwH.exe
  C:\Windows\System\xBysHwH.exe
  2⤵
  PID:9348
- C:\Windows\System\mbSNxZb.exe
  C:\Windows\System\mbSNxZb.exe
  2⤵
  PID:9364
- C:\Windows\System\HYTZvdw.exe
  C:\Windows\System\HYTZvdw.exe
  2⤵
  PID:9380
- C:\Windows\System\OYKxyVk.exe
  C:\Windows\System\OYKxyVk.exe
  2⤵
  PID:9396
- C:\Windows\System\MtXuFPM.exe
  C:\Windows\System\MtXuFPM.exe
  2⤵
  PID:9412
- C:\Windows\System\yPSnxIo.exe
  C:\Windows\System\yPSnxIo.exe
  2⤵
  PID:9428
- C:\Windows\System\ZAvpiTz.exe
  C:\Windows\System\ZAvpiTz.exe
  2⤵
  PID:9444
- C:\Windows\System\dWTZNti.exe
  C:\Windows\System\dWTZNti.exe
  2⤵
  PID:9460
- C:\Windows\System\TbVficd.exe
  C:\Windows\System\TbVficd.exe
  2⤵
  PID:9476
- C:\Windows\System\hLqPWUz.exe
  C:\Windows\System\hLqPWUz.exe
  2⤵
  PID:9492
- C:\Windows\System\aUAQXEF.exe
  C:\Windows\System\aUAQXEF.exe
  2⤵
  PID:9508
- C:\Windows\System\pypUJJw.exe
  C:\Windows\System\pypUJJw.exe
  2⤵
  PID:9524
- C:\Windows\System\JHiyjIe.exe
  C:\Windows\System\JHiyjIe.exe
  2⤵
  PID:9540
- C:\Windows\System\vSVvlQl.exe
  C:\Windows\System\vSVvlQl.exe
  2⤵
  PID:9556
- C:\Windows\System\PRLItiU.exe
  C:\Windows\System\PRLItiU.exe
  2⤵
  PID:9572
- C:\Windows\System\JqEjeKG.exe
  C:\Windows\System\JqEjeKG.exe
  2⤵
  PID:9588
- C:\Windows\System\gTVMKzP.exe
  C:\Windows\System\gTVMKzP.exe
  2⤵
  PID:9604
- C:\Windows\System\SvCFolN.exe
  C:\Windows\System\SvCFolN.exe
  2⤵
  PID:9624
- C:\Windows\System\jtzsNBl.exe
  C:\Windows\System\jtzsNBl.exe
  2⤵
  PID:9640
- C:\Windows\System\gyyPqRd.exe
  C:\Windows\System\gyyPqRd.exe
  2⤵
  PID:9656
- C:\Windows\System\kfRDMos.exe
  C:\Windows\System\kfRDMos.exe
  2⤵
  PID:9672
- C:\Windows\System\pEtuuHY.exe
  C:\Windows\System\pEtuuHY.exe
  2⤵
  PID:9688
- C:\Windows\System\MicGaLP.exe
  C:\Windows\System\MicGaLP.exe
  2⤵
  PID:9704
- C:\Windows\System\kOVhpTR.exe
  C:\Windows\System\kOVhpTR.exe
  2⤵
  PID:9720
- C:\Windows\System\bQpkBVP.exe
  C:\Windows\System\bQpkBVP.exe
  2⤵
  PID:9736
- C:\Windows\System\zTPllft.exe
  C:\Windows\System\zTPllft.exe
  2⤵
  PID:9752
- C:\Windows\System\mAPnfWB.exe
  C:\Windows\System\mAPnfWB.exe
  2⤵
  PID:9768
- C:\Windows\System\FWAozdv.exe
  C:\Windows\System\FWAozdv.exe
  2⤵
  PID:9784
- C:\Windows\System\nRCFtdI.exe
  C:\Windows\System\nRCFtdI.exe
  2⤵
  PID:9800
- C:\Windows\System\RTViIAT.exe
  C:\Windows\System\RTViIAT.exe
  2⤵
  PID:9816
- C:\Windows\System\kCgDgNk.exe
  C:\Windows\System\kCgDgNk.exe
  2⤵
  PID:9832
- C:\Windows\System\hEQsSXF.exe
  C:\Windows\System\hEQsSXF.exe
  2⤵
  PID:9848
- C:\Windows\System\qvCRTHh.exe
  C:\Windows\System\qvCRTHh.exe
  2⤵
  PID:9864
- C:\Windows\System\JmAeUZq.exe
  C:\Windows\System\JmAeUZq.exe
  2⤵
  PID:9880
- C:\Windows\System\GZKEvKk.exe
  C:\Windows\System\GZKEvKk.exe
  2⤵
  PID:9896
- C:\Windows\System\NKVWseW.exe
  C:\Windows\System\NKVWseW.exe
  2⤵
  PID:9912
- C:\Windows\System\WDmSBcZ.exe
  C:\Windows\System\WDmSBcZ.exe
  2⤵
  PID:9928
- C:\Windows\System\YLadLRr.exe
  C:\Windows\System\YLadLRr.exe
  2⤵
  PID:9944
- C:\Windows\System\duTelok.exe
  C:\Windows\System\duTelok.exe
  2⤵
  PID:9960
- C:\Windows\System\dcZqgpn.exe
  C:\Windows\System\dcZqgpn.exe
  2⤵
  PID:9976
- C:\Windows\System\cNBcjkd.exe
  C:\Windows\System\cNBcjkd.exe
  2⤵
  PID:9992
- C:\Windows\System\uvdVwJL.exe
  C:\Windows\System\uvdVwJL.exe
  2⤵
  PID:10008
- C:\Windows\System\pVfwXQV.exe
  C:\Windows\System\pVfwXQV.exe
  2⤵
  PID:10024
- C:\Windows\System\wNlvXtx.exe
  C:\Windows\System\wNlvXtx.exe
  2⤵
  PID:10040
- C:\Windows\System\MclMyNG.exe
  C:\Windows\System\MclMyNG.exe
  2⤵
  PID:10056
- C:\Windows\System\MLksEjL.exe
  C:\Windows\System\MLksEjL.exe
  2⤵
  PID:10072
- C:\Windows\System\xnZkLhB.exe
  C:\Windows\System\xnZkLhB.exe
  2⤵
  PID:10088
- C:\Windows\System\ZhnOTaQ.exe
  C:\Windows\System\ZhnOTaQ.exe
  2⤵
  PID:10104
- C:\Windows\System\CFNbZWv.exe
  C:\Windows\System\CFNbZWv.exe
  2⤵
  PID:10120
- C:\Windows\System\KPGFGUv.exe
  C:\Windows\System\KPGFGUv.exe
  2⤵
  PID:10140
- C:\Windows\System\biouQeG.exe
  C:\Windows\System\biouQeG.exe
  2⤵
  PID:10160
- C:\Windows\System\KHgMrhC.exe
  C:\Windows\System\KHgMrhC.exe
  2⤵
  PID:10176
- C:\Windows\System\dIvyUtU.exe
  C:\Windows\System\dIvyUtU.exe
  2⤵
  PID:10192
- C:\Windows\System\iCnOgSF.exe
  C:\Windows\System\iCnOgSF.exe
  2⤵
  PID:10208
- C:\Windows\System\JCrDTZP.exe
  C:\Windows\System\JCrDTZP.exe
  2⤵
  PID:10228
- C:\Windows\System\CdaCUTY.exe
  C:\Windows\System\CdaCUTY.exe
  2⤵
  PID:9060
- C:\Windows\System\KExBeNp.exe
  C:\Windows\System\KExBeNp.exe
  2⤵
  PID:8528
- C:\Windows\System\wvdoYHW.exe
  C:\Windows\System\wvdoYHW.exe
  2⤵
  PID:9456
- C:\Windows\System\yVuEAwB.exe
  C:\Windows\System\yVuEAwB.exe
  2⤵
  PID:9260
- C:\Windows\System\ZzGwfAS.exe
  C:\Windows\System\ZzGwfAS.exe
  2⤵
  PID:9324
- C:\Windows\System\jyKSmBp.exe
  C:\Windows\System\jyKSmBp.exe
  2⤵
  PID:9388
- C:\Windows\System\yFfXQZs.exe
  C:\Windows\System\yFfXQZs.exe
  2⤵
  PID:9452
- C:\Windows\System\bZGdhZx.exe
  C:\Windows\System\bZGdhZx.exe
  2⤵
  PID:9520
- C:\Windows\System\PmGdYnC.exe
  C:\Windows\System\PmGdYnC.exe
  2⤵
  PID:9580
- C:\Windows\System\TKXCOYJ.exe
  C:\Windows\System\TKXCOYJ.exe
  2⤵
  PID:9648
- C:\Windows\System\MjWLTJK.exe
  C:\Windows\System\MjWLTJK.exe
  2⤵
  PID:9712
- C:\Windows\System\bVMcMix.exe
  C:\Windows\System\bVMcMix.exe
  2⤵
  PID:9776
- C:\Windows\System\CyEUsmb.exe
  C:\Windows\System\CyEUsmb.exe
  2⤵
  PID:9840
- C:\Windows\System\LkZZGVo.exe
  C:\Windows\System\LkZZGVo.exe
  2⤵
  PID:9904
- C:\Windows\System\yZdZnuM.exe
  C:\Windows\System\yZdZnuM.exe
  2⤵
  PID:10000
- C:\Windows\System\JvAhwQl.exe
  C:\Windows\System\JvAhwQl.exe
  2⤵
  PID:10064
- C:\Windows\System\mQCUUji.exe
  C:\Windows\System\mQCUUji.exe
  2⤵
  PID:8572
- C:\Windows\System\ptHWrgz.exe
  C:\Windows\System\ptHWrgz.exe
  2⤵
  PID:8944
- C:\Windows\System\CGZAAMt.exe
  C:\Windows\System\CGZAAMt.exe
  2⤵
  PID:9280
- C:\Windows\System\uuzlmlQ.exe
  C:\Windows\System\uuzlmlQ.exe
  2⤵
  PID:9344
- C:\Windows\System\RrbARYz.exe
  C:\Windows\System\RrbARYz.exe
  2⤵
  PID:9796
- C:\Windows\System\jVIFjxF.exe
  C:\Windows\System\jVIFjxF.exe
  2⤵
  PID:9372
- C:\Windows\System\DyBFTQW.exe
  C:\Windows\System\DyBFTQW.exe
  2⤵
  PID:9408
- C:\Windows\System\eGyFWlg.exe
  C:\Windows\System\eGyFWlg.exe
  2⤵
  PID:9920
- C:\Windows\System\fbJLaKk.exe
  C:\Windows\System\fbJLaKk.exe
  2⤵
  PID:9564
- C:\Windows\System\yePocBc.exe
  C:\Windows\System\yePocBc.exe
  2⤵
  PID:9600
- C:\Windows\System\kgeMYoL.exe
  C:\Windows\System\kgeMYoL.exe
  2⤵
  PID:9696
- C:\Windows\System\IPxkSHW.exe
  C:\Windows\System\IPxkSHW.exe
  2⤵
  PID:9828
- C:\Windows\System\mwNsoOg.exe
  C:\Windows\System\mwNsoOg.exe
  2⤵
  PID:9956
- C:\Windows\System\cSnJkzX.exe
  C:\Windows\System\cSnJkzX.exe
  2⤵
  PID:10052
- C:\Windows\System\ckmGMKp.exe
  C:\Windows\System\ckmGMKp.exe
  2⤵
  PID:10152
- C:\Windows\System\EnFGupM.exe
  C:\Windows\System\EnFGupM.exe
  2⤵
  PID:10200
- C:\Windows\System\gbDeqYn.exe
  C:\Windows\System\gbDeqYn.exe
  2⤵
  PID:9228
- C:\Windows\System\HhkWnSN.exe
  C:\Windows\System\HhkWnSN.exe
  2⤵
  PID:9424
- C:\Windows\System\jSpJUDI.exe
  C:\Windows\System\jSpJUDI.exe
  2⤵
  PID:9808
- C:\Windows\System\SimoAQv.exe
  C:\Windows\System\SimoAQv.exe
  2⤵
  PID:10096
- C:\Windows\System\sDcgotY.exe
  C:\Windows\System\sDcgotY.exe
  2⤵
  PID:9276
- C:\Windows\System\OodkkUT.exe
  C:\Windows\System\OodkkUT.exe
  2⤵
  PID:9504
- C:\Windows\System\GMOsaWE.exe
  C:\Windows\System\GMOsaWE.exe
  2⤵
  PID:10084
- C:\Windows\System\hgWXaNd.exe
  C:\Windows\System\hgWXaNd.exe
  2⤵
  PID:9668
- C:\Windows\System\vlyrhZi.exe
  C:\Windows\System\vlyrhZi.exe
  2⤵
  PID:10148
- C:\Windows\System\HqrhXKn.exe
  C:\Windows\System\HqrhXKn.exe
  2⤵
  PID:9680
- C:\Windows\System\wrhPAYk.exe
  C:\Windows\System\wrhPAYk.exe
  2⤵
  PID:10252
- C:\Windows\System\ueopWgP.exe
  C:\Windows\System\ueopWgP.exe
  2⤵
  PID:10280
- C:\Windows\System\vVAvoUT.exe
  C:\Windows\System\vVAvoUT.exe
  2⤵
  PID:10296
- C:\Windows\System\XbPRFid.exe
  C:\Windows\System\XbPRFid.exe
  2⤵
  PID:10312
- C:\Windows\System\LjDQUFr.exe
  C:\Windows\System\LjDQUFr.exe
  2⤵
  PID:10328
- C:\Windows\System\CHJpFyF.exe
  C:\Windows\System\CHJpFyF.exe
  2⤵
  PID:10344
- C:\Windows\System\aCQEUzm.exe
  C:\Windows\System\aCQEUzm.exe
  2⤵
  PID:10360
- C:\Windows\System\jghSbrt.exe
  C:\Windows\System\jghSbrt.exe
  2⤵
  PID:10376
- C:\Windows\System\OJEPaJp.exe
  C:\Windows\System\OJEPaJp.exe
  2⤵
  PID:10392
- C:\Windows\System\fQQaAAP.exe
  C:\Windows\System\fQQaAAP.exe
  2⤵
  PID:10408
- C:\Windows\System\wtXtrcl.exe
  C:\Windows\System\wtXtrcl.exe
  2⤵
  PID:10424
- C:\Windows\System\FCLxLLr.exe
  C:\Windows\System\FCLxLLr.exe
  2⤵
  PID:10440
- C:\Windows\System\TndoDse.exe
  C:\Windows\System\TndoDse.exe
  2⤵
  PID:10456
- C:\Windows\System\rLnusDd.exe
  C:\Windows\System\rLnusDd.exe
  2⤵
  PID:10472
- C:\Windows\System\lICejCG.exe
  C:\Windows\System\lICejCG.exe
  2⤵
  PID:10488
- C:\Windows\System\njCIsol.exe
  C:\Windows\System\njCIsol.exe
  2⤵
  PID:10504
- C:\Windows\System\lSYXAYz.exe
  C:\Windows\System\lSYXAYz.exe
  2⤵
  PID:10520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ABKxUvg.exe

Filesize
1.2MB

MD5
62b1af5f04f906334dd2b301645b89a3

SHA1
c59ab02aa87eaeb74d3b45e153a30ec26cd18f08

SHA256
433600834c458ee05448080a297073e73962cffa93e667495719bea6ae30b5c5

SHA512
aa12d42ee47187e9d6ecb9fe7eff5e8d45f1f3b359660e1dacf7a7fa9616fe8f32b19b6aca9596242972b6ae4226e596a9e6411d913b059b8f398b2116a87d26

Download Submit
C:\Windows\system\AwDHKzF.exe

Filesize
1.2MB

MD5
ef0735145ccefa010a123ea6d61a6a1a

SHA1
9f4980c89842592613b9532cb8c00a71a70dc74c

SHA256
f87772a208dc21d79d19d0455f7ccb094f29bd14272a78433ce169fd2d1257f3

SHA512
cd674cc8366c5428af484f307a744679230df27cb90088d43032da9ede880f4b1f850f6092d937db050eef7d8743cdd2acb156a11168be93b0d6143a60f8fce7

Download Submit
C:\Windows\system\BUnhumc.exe

Filesize
1.2MB

MD5
837a33cef8e845193a8ba6e29a86685b

SHA1
895ca4a0d4c1f1cf9fe066b24024060ea949fabf

SHA256
670de21db7c2e6c9c483f8708bd4e032dc2e4fbe67bef10f4e20333c82a6a028

SHA512
cd5327369e77e127b170b830577156e4b82787ee8939060a6555cbb6188aedd676e5711e557ff7f064907d06da9b93e9def5ece4d8c9f7edb50a52e22b82ed8e

Download Submit
C:\Windows\system\CJzdVeT.exe

Filesize
1.2MB

MD5
23430e404803daeb6c53c7fe99448def

SHA1
3baa01bf5f6e3b2616d073cc9f9194850b991f25

SHA256
a2077429b51510cc954195b3f9c44bbbfea517337a5c614880e8279beaf4d419

SHA512
4a825d60dd3278503364504d2fdf76ea7ecc2acba65e6c50abf76bd341d8ace01cdb81223a30fc3ceb1860d0561e582bbe5406b80ff57a19ba67271d0e08e769

Download Submit
C:\Windows\system\CNAFTSh.exe

Filesize
1.2MB

MD5
33e7e6607690cddab26cb6badb5bf4ba

SHA1
ad160ff1b8f9e7dacbf16953d9bfcdb252f110e0

SHA256
439bca6ae9bcc3302271eac622fc46d1d8bd9e2e93cd10ce4d1f365936515e06

SHA512
e762c652e1eba96a28fc34cf57bb4c9c409fd790c19736ad693ef1e42ee94b3295fdeb07c6bf753c6df202e08706337f92dc6af906f1eb1531712b0bea6fe9ab

Download Submit
C:\Windows\system\EVXGIYm.exe

Filesize
1.2MB

MD5
4689b09b19846927148f20c674e5f100

SHA1
789f8b1f641e9999d09c51808c989d40a27faf88

SHA256
b2355148a0fc3df15721dc337d82810ac7e80c2ebbd8b9830d0f77331ab803d2

SHA512
569de4886b8850432cef2fba592fa1276854bca59f250bed2d8e74af85f4cb0a5c9fe318349e92084f059c94cb3842a8926904c6b2aa0ec64049d61e2d045b72

Download Submit
C:\Windows\system\FVSoOvM.exe

Filesize
1.2MB

MD5
93ff36c281c8dff1b1d1c94158685ed9

SHA1
07e5a94a2b10e18aa6f4ca947e241aaaa4d852db

SHA256
2ac06f23b387ae60ca28905f6e6f6c6d29947e8191237972ba432db7ef29c497

SHA512
e286d07841a127d8fea90ce4fdeaeaade0321ad98f4e2e3869adcec95d339a776477ff4131e89dd53cc5ffe88bad419659e39e2939474bfed7afaa25fa5fb986

Download Submit
C:\Windows\system\GgXOpBJ.exe

Filesize
1.2MB

MD5
967eb1c39596eb8c91a5f974a5cf5dd5

SHA1
94c5b8eebb6421a66dcab4fe552c621d0197351c

SHA256
36151beee64a09eb91cdf3a8b4c1538fec82fdce76287b7071d675a8d46876b6

SHA512
e103d1c394d86597c229326ce33581b9bc6dc94b382b48a58bdbdadf793ad8b79b4269cecacd573e6c3d535dd3d6a44ac2296f78072c0d4ad71f2534ec873dd7

Download Submit
C:\Windows\system\IMRexRt.exe

Filesize
1.2MB

MD5
0f2879a7841783adc6fda80a7b45a8ef

SHA1
5273703c1922c2d3ebc08a7e26fce3ed09075842

SHA256
76b31c6d8095dc4e3e5a612f9517addcb7e370b558e82f723d503262363a8f44

SHA512
64eb307c0598a8bc1158d49bf826c5c57277376bc8a1d5dc0f22afe60fa158f0510a3c0fea9ab79ade822b68fbc8f31cc6e1fd849221737f6366adf2e4b0974c

Download Submit
C:\Windows\system\Ifbyqea.exe

Filesize
1.2MB

MD5
70d50d78ae933a134824fbfbdc0533b2

SHA1
c3822c84d087218684e5040e4eeec91e52b3f119

SHA256
eec8cf85e29567893e6bd020e2e004156144d3fa8f625949156ef3e28f232ea8

SHA512
d91dab752918dc11f2e2e9d81d3ad253e5f39165fb51ed3806179665fe3a5c500812d59cb320f30578a39a2578bf6280a1eb8604c60ced85f09688fe8ffa66dc

Download Submit
C:\Windows\system\JYDRBHq.exe

Filesize
1.2MB

MD5
0651a409eeccc20c67ac652bee5eb6cf

SHA1
35754e15572aa80f0aac9de1c42854eb2ec7e655

SHA256
a62e7c2d92139858ccfe8dd30527c9db2db90ecdcfe731a11ece4d1e6ead4b02

SHA512
ca32db54cc48557ecd676a365bbbb7c5530615ef79f5d928108169d1b765c45b321c294b1288890f5737c365a1ba8d1492d68a3ab72758d3f12e9981e6c3627b

Download Submit
C:\Windows\system\PEtFQfJ.exe

Filesize
1.2MB

MD5
d8e055447a859dcfdaeacd05709d2a2f

SHA1
b025f7cbf44391b527355656eaea97ecd1c52904

SHA256
77d242b47202266ac5a9a0a4e1bf028bc0afb1dd117938688eaccc32f10e900f

SHA512
fad950a187983e009d45fffd9dc7e6cce7182408493bab289b6ea429ed3eb457b227721cadd5081c9e97c59fe9a95c001e8d24f9387c1550e807985a0399b060

Download Submit
C:\Windows\system\PGDXsHw.exe

Filesize
1.2MB

MD5
5f836f0ff0f8b7b2285b1b88458b2d45

SHA1
2cac470706798011b285d49e6ee12b8aab4d1661

SHA256
64274cff58995920ec92953ca5a3468d478ce9e2d4b91dfb62ce05472d2227b0

SHA512
4a5e04a6e0ef321284cbdedb14256a8a0242601c6c58f72bfd8556dc034913478ae0a12070bda00ed5475d37b24cd3f6f64360d9cd1f345831a26ab08d7d5c13

Download Submit
C:\Windows\system\QhubAqN.exe

Filesize
1.2MB

MD5
90023245c798286425c279f7e352c2ff

SHA1
bbf1063d01ea00004303f83d6be1ce35b39d9bef

SHA256
0333ac94105d0fe6a523c5c4274483cbdcec6d628071384281f7b848bb956056

SHA512
7e39560e57032db5b17f141abede525bc0557643f17ec51032f4bd2edfbff9042b96efc9249106fbae543d0cb73cbc9ca5dc60a6afb411d6b16a269e97b3abb7

Download Submit
C:\Windows\system\UysEWNW.exe

Filesize
1.2MB

MD5
e6c3c19d8a3d93037c5017f5a9b0ee57

SHA1
c00fed516ce90b9674984d421257c14b6a83e521

SHA256
fb1fc4b5c33ab72cf5a69f13d72f5754057910507a31ebdde0470d04386826dd

SHA512
00522f46b1b24113e52c8d5c68fd19407a28bddfb0631151f33d4ccd5ce2b56d3fa8efd9effee112263dd85b45135af18e20aa2329833d4c375b58bcf34f72f1

Download Submit
C:\Windows\system\XExCkrC.exe

Filesize
1.2MB

MD5
61c2e96f95add4c37d3969e07da27d77

SHA1
7a796f5ab6218410455fd1c8eb81a7e2db8efcbd

SHA256
79d573f1dfef351cdda6caf2e8624868df265eafc2b99fb928c388ef5eb9d381

SHA512
d0f42dd5c85892d841f807a4dc725da6b0fe535d47501e87d390a1647ab67d19a7429c53bb88bc0e9b1081808199305015e6ea23cee9df257792e6c475f31ce8

Download Submit
C:\Windows\system\XoBbyem.exe

Filesize
1.2MB

MD5
068e42a7f9b0e15d98548161f90c63ec

SHA1
3e766a9c07587aaebebff1e4cf2aa797963124ea

SHA256
8de3cfd253468cac01acc1785ff50848e6518c6c91fabc735814cf5123003789

SHA512
f9a476ecd9dbb16cc95b08ae9d1298f68d5b1c5cad8fce9483d226c27a43ea85b56a067dc8df583c6735f8c64e0002d773d43c1bf69c224504d71d618bc98559

Download Submit
C:\Windows\system\fJjNJqi.exe

Filesize
1.2MB

MD5
4f416ee7efb28b09e91d8d7ac162da4b

SHA1
59566905813a2b6944be2fd837f77b802caf7d80

SHA256
da6065fe5a1127ef91163eb547df7bb81da1e9fbf11e97018409736e8ac6fed1

SHA512
42a50502dbb16192934ad39b03d9fb3ac85479ae432b0341bdc8689fe86e87a0b28c50d5b0fead70e8fc3bc0f08dd02d9818cd1a832e9cb42d6440a3aea401e4

Download Submit
C:\Windows\system\fmbQhcf.exe

Filesize
1.2MB

MD5
4fa57adeab0f155c8a8cb2f2face0521

SHA1
78c54703dc0787effbe1bdd5af6f1b6fb920e8d7

SHA256
10901c88aeb7e0de18d89e3a3edeb84c1298143a944b9b9ffcdf56bec8281fb3

SHA512
d6c5a4d22955990d9c4fdece9996b259f7d8ab25b7ca5b27dff4e39c1946e0b2f010c41abe69caebf1752075a4c05e5df87f8de14443ecad359478c368fb262d

Download Submit
C:\Windows\system\gRRIxdM.exe

Filesize
1.2MB

MD5
85cd7b2fbca1c45743a0cee43d52a396

SHA1
88708e5d939802c04337faca4cdc1914b7c451d4

SHA256
bc2301f42c4ba156726f9546009120b8bdfbd288f5083a3d312d5f85849d4120

SHA512
675ffb29c051d0aaed0433f8ab1a7a5b4898f4ec94838791e82ef447457fd1f047610ff534073f289b15c2a0c1dfbbfc4112bae2daf8cd17428939cb8be6f778

Download Submit
C:\Windows\system\jAbGMQD.exe

Filesize
1.2MB

MD5
1f764c092f778068429e759bcda23feb

SHA1
28299b72774d6b45e5de3a6c08a8452b8393f928

SHA256
218d9eeb00e874664a635119a2cb399ac9a24459f26f1e01b9676c9d2b1b0801

SHA512
8754d24969f47bfe0e74c2f02baf9ddc95dff9dccea891daf47bbcfa6f1f323d8b45ab01c41534549d1b7b995505540b5d0a08cb7c97412666b7faf6153a3076

Download Submit
C:\Windows\system\jYRvbiK.exe

Filesize
1.2MB

MD5
ade65eac42324ea12e9eee9b0977fcf1

SHA1
234d3b27098503f28c04a1a2ff28cc6b9ccaa952

SHA256
8b9de4419f45824b8bcaff3239a036334e22ee43ebe428f072c7521f3cc2f952

SHA512
fa102c84cfb2394d2f36c08b246144c18ad36acd548d713c9df6b86878de7465eeb812fdc6f5686ee732998e119d1e89f64b4d2f09d0e9c7a4962b86c6f9f8b8

Download Submit
C:\Windows\system\kCyvZQr.exe

Filesize
1.2MB

MD5
0daaa190bee55da5c349907b5032e7af

SHA1
677c1651e333077533baa4136fe0f0fdcb801afe

SHA256
e6cb45237d8c65e2a6c2c6cc93627a76b70b3e7d02cbb1d647002f7eaf5a87c2

SHA512
a43677722b4f01ffba5dc39c14e97f92c0153f14d5f71877312cd08fe76181d20b436a24539fbd8d5a487227cea452413f8734079452322ea3c91a2cb06689fa

Download Submit
C:\Windows\system\lKfACwn.exe

Filesize
8B

MD5
dab91f43054b6e50e7f72a0892c8dcb3

SHA1
8804e97ba4de55ea3d0be8416132189ff0332285

SHA256
9db6016a6acaebc6f2ddb355a7ecc96478051b888899fe73200db7a3cfcfa9dd

SHA512
9a85876336db0e0c4292987f185772d793c54b7312a061d217cd860fb4d9dbc1f5f3d8118d9b66e0059e52b59906704cc11054aecd9c662fddc81ac1f35ffb1f

Download Submit
C:\Windows\system\leTfJCm.exe

Filesize
1.2MB

MD5
152efb1671217f5860146da16671d638

SHA1
66fabb90ab21512787cda3d9b2451eb29023c8db

SHA256
8e53bae2fcaa794014f94dfcc192229242bf09a14027e4cbf7d8ccb1d5ff2c7c

SHA512
b4e5ea67d9f6e402956e7bd28dca1f43c5531973cc0e47ff17aeeb5363cdea9d64be9b89787269cb1d9dccd0613c39ac94cf5dd818c7835ae06933e26d7d8924

Download Submit
C:\Windows\system\mSTRXqT.exe

Filesize
1.2MB

MD5
f6ea7d8fa6b92e7659da30b0c0cfaa34

SHA1
9a46273de987ac3753a218082123d9f691f46355

SHA256
fb1b6e270f02c984f7955976d55c3cfe8e9bb16fdd3b9a5831e8f14d8a96a0be

SHA512
ece54745517e1dd36fc9a700c2c784c568531f5ec7985645657ed43904775b39dc137afdaf09b02f8cd7f4c8b038d04b7e80065046913f00c54af3ff891c1158

Download Submit
C:\Windows\system\oCYIfNR.exe

Filesize
1.2MB

MD5
daee6f242f4837d5aa8883ef20e834e7

SHA1
f0d2c40b3859a20e32a4afd1a4f1d718840d57c1

SHA256
c6fcacdb36682dc642dd417ac080b2647158da6b1ded3ba840e397d3135a5fc7

SHA512
af4dc82ee58e05121076747708466d3b9d82ada38db9ce33ffc84bbd7e543e733e13bb71a31e998ec339b1c471d54e711589c111d6aa7d08aaf3efd61e740259

Download Submit
C:\Windows\system\pEQVLeu.exe

Filesize
1.2MB

MD5
4c71e8f0b5ae50cb5277165c62de2836

SHA1
b0aac04764e11961d2583c1d0d12e8d8f307b88b

SHA256
95fa3433bc2d326637f5d8651616a81fa832736dc43175d434dd116d1db087c8

SHA512
de1c4f043f65b673a764ec69ad07e919add9bb432193e4d3dac1b8c7e91958657463212f9191e5284ff2b8fb2cd2f96f8568b1b1ce851ba7ce708c08f4134cb2

Download Submit
C:\Windows\system\uMXojbd.exe

Filesize
1.2MB

MD5
aad17c381441f74f7b9e6c8a4eacabf0

SHA1
dfa433b785360feaffe566c287ba970ddfdf16ea

SHA256
e9b57aaac7c10b44beed39aa1b6670849ba0ca64623a7d165a523cad793cccb7

SHA512
afaaa7c7837f102e422b4aaa1c99a8dafa16a89133838400ff09eaf966ead34ca2cbdf191c0c8145b9f90c86721ac492129ac3bf42c69a42074187b0ce6fe2cf

Download Submit
C:\Windows\system\ukAJRQo.exe

Filesize
1.2MB

MD5
92279c69daa434639da2e56d5aced613

SHA1
0a7bb1904bee312c9927766e28905bebba07f333

SHA256
cc8474b5d7e02f270b4287b76d836dbdd30477a3b40d5c51a974f622aaeeffe5

SHA512
5772c2c30f8aaa9634eb9e3c117f6171234564eb5d7a868ea26a7baaa5fc30040df75c6ee4ca2b8096f4b0f394b649307f4d5a47ae489fa12734e0345c9bad18

Download Submit
\Windows\system\BAHMgap.exe

Filesize
1.2MB

MD5
0b60a7d43d925ba053eaec30b78f9601

SHA1
66cc6274a9f16dc76178918ba8c0a878467cf1dd

SHA256
be47e5e27c9c5fac21ecd16169694b477f40fcc59b671d9ce86b51ab9ba3f82b

SHA512
e08c0dfe21bb59c1d30084cdbe4e6ae92a55b728d53ac93190d312ebb9fb58bea9269ea4eacd3703fce63bd40e2aef686e852fc1e6a998382fed50972c69f839

Download Submit
\Windows\system\FKXwZeo.exe

Filesize
1.2MB

MD5
0cde1ee04f22fb9fedd1c1e66db3a73f

SHA1
43a2f5c3c7457a732738d6ee51f5bca75f769ee6

SHA256
fbd8ce1cc8fa84d63839d43dfd5c6474adadedc5df9ee3ca779876145cae9af9

SHA512
0fddd8cccbe11426b6598631c43459e1da243abe3a875f88f2e97027562be0eaec58b59f70e8ebd0242d2a873cc0e89146da0f04f45dfb2bebb48073ac0ddaa2

Download Submit
\Windows\system\RhlvTcu.exe

Filesize
1.2MB

MD5
cf5b7380c7310d1dfdc7b8b5711757e0

SHA1
f58f06e6f5b815e159a4466929ebd5c3a49b21ff

SHA256
194da756ba3196614be8f22b31b2142e46be14af291e9d053c5e90846c76515e

SHA512
7c16bf810b205fd56556c8b0819dcea938755dddf2508a7a7f8b3d0e0f5ba8a66155a6d8f3575abaab4bfb690828b8f00b2788c3098c19ced2c94bda9c450fad

Download Submit
\Windows\system\igZCZBj.exe

Filesize
1.2MB

MD5
4b8bdcd7b20ed6bbd56830be105deff5

SHA1
55d42af121bfd6fc058140998330aa8c33d85326

SHA256
e0686d5eb3a4acae8dbb6ea305491556d23876632acf958d66699b177ba406ae

SHA512
a683b29b2721cbe124a5201eaf7628a6347beb1746bdce37bcfa88c9ada69d573bd1d45e1baa2bc6e8503dd4df66db16954ba1dd4fd93963e8074a27f72e7104

Download Submit
\Windows\system\wrpyuaz.exe

Filesize
1.2MB

MD5
44ef457d86256367af9a6ddb605127e6

SHA1
65c1e36ead4b193f0c1d8ad752b957842c41c4ae

SHA256
0ca7012db4f8297e90113a062061f37ff11c177fd5eb4b0c803447d7b5624e0c

SHA512
929e86be339ba791c9512e6358b3a3a3c9f3ad50cefd6f0006e7296b2f5fbedde0d049f25ab93b7da2d2c0968a3639ca5539485e85a64f24c2807c29dd6518c1

Download Submit
memory/1116-9-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/1116-4540-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/1580-23-0x000000013FCE0000-0x00000001400D2000-memory.dmp

Filesize
3.9MB

Download
memory/1580-453-0x0000000003150000-0x0000000003542000-memory.dmp

Filesize
3.9MB

Download
memory/1580-439-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/1580-437-0x0000000003150000-0x0000000003542000-memory.dmp

Filesize
3.9MB

Download
memory/1580-451-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/1580-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1580-449-0x000000013F1D0000-0x000000013F5C2000-memory.dmp

Filesize
3.9MB

Download
memory/1580-433-0x0000000003150000-0x0000000003542000-memory.dmp

Filesize
3.9MB

Download
memory/1580-8-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/1580-447-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/1580-445-0x0000000003150000-0x0000000003542000-memory.dmp

Filesize
3.9MB

Download
memory/1580-441-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/1580-0-0x000000013F840000-0x000000013FC32000-memory.dmp

Filesize
3.9MB

Download
memory/1580-443-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2128-4578-0x000000013FCE0000-0x00000001400D2000-memory.dmp

Filesize
3.9MB

Download
memory/2128-432-0x000000013FCE0000-0x00000001400D2000-memory.dmp

Filesize
3.9MB

Download
memory/2224-440-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2224-4544-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2324-4650-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/2324-452-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/2636-448-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/2636-4645-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/2660-444-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2660-4539-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2668-450-0x000000013F1D0000-0x000000013F5C2000-memory.dmp

Filesize
3.9MB

Download
memory/2668-4547-0x000000013F1D0000-0x000000013F5C2000-memory.dmp

Filesize
3.9MB

Download
memory/2744-435-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/2744-4554-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/2760-438-0x000000013F4F0000-0x000000013F8E2000-memory.dmp

Filesize
3.9MB

Download
memory/2760-4537-0x000000013F4F0000-0x000000013F8E2000-memory.dmp

Filesize
3.9MB

Download
memory/2804-4538-0x000000013FB00000-0x000000013FEF2000-memory.dmp

Filesize
3.9MB

Download
memory/2804-446-0x000000013FB00000-0x000000013FEF2000-memory.dmp

Filesize
3.9MB

Download
memory/2912-4543-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/2912-442-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/2920-436-0x000000013F450000-0x000000013F842000-memory.dmp

Filesize
3.9MB

Download
memory/2920-4648-0x000000013F450000-0x000000013F842000-memory.dmp

Filesize
3.9MB

Download
memory/2972-136-0x00000000027E0000-0x00000000027E8000-memory.dmp

Filesize
32KB

Download
memory/2972-24-0x000007FEF666E000-0x000007FEF666F000-memory.dmp

Filesize
4KB

Download
memory/2972-434-0x000007FEF63B0000-0x000007FEF6D4D000-memory.dmp

Filesize
9.6MB

Download
memory/2972-431-0x000007FEF63B0000-0x000007FEF6D4D000-memory.dmp

Filesize
9.6MB

Download
memory/2972-130-0x000000001B770000-0x000000001BA52000-memory.dmp

Filesize
2.9MB

Download