xmrig | 9524b5ada5b1f1caa1982b0bb58c3cd0acedc4fdc98e62ce5e587884e312a05b

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 02:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54438984039cb84b5be67abfc4b51bf0N.exe
Size

1.6MB
MD5

54438984039cb84b5be67abfc4b51bf0
SHA1

a8499463b3e6b5339faf697f29a09a8fd17c7fa6
SHA256

9524b5ada5b1f1caa1982b0bb58c3cd0acedc4fdc98e62ce5e587884e312a05b
SHA512

9d316a0048f876d6de915f83f70260ca7a08c04b342048ee5019d55e4fbb2b29783d8fe27033c1ae76f9270d99916d8a1ade2fbdf3c1361b4846bf8a5a5a5c14
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTnHzlyPGkd+TKqxxv:Lz071uv4BPMkFfdk2auTlGGxv

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 17 IoCs

miner

resource	yara_rule
behavioral1/memory/2220-83-0x000000013F270000-0x000000013F662000-memory.dmp	xmrig
behavioral1/memory/2768-40-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	xmrig
behavioral1/memory/1720-36-0x000000013F770000-0x000000013FB62000-memory.dmp	xmrig
behavioral1/memory/2888-34-0x000000013F310000-0x000000013F702000-memory.dmp	xmrig
behavioral1/memory/2884-31-0x000000013FCD0000-0x00000001400C2000-memory.dmp	xmrig
behavioral1/memory/2728-29-0x000000013FFB0000-0x00000001403A2000-memory.dmp	xmrig
behavioral1/memory/2700-1295-0x000000013F400000-0x000000013F7F2000-memory.dmp	xmrig
behavioral1/memory/1720-5312-0x000000013F770000-0x000000013FB62000-memory.dmp	xmrig
behavioral1/memory/2476-5933-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	xmrig
behavioral1/memory/2884-5932-0x000000013FCD0000-0x00000001400C2000-memory.dmp	xmrig
behavioral1/memory/2728-5931-0x000000013FFB0000-0x00000001403A2000-memory.dmp	xmrig
behavioral1/memory/704-5954-0x000000013FC50000-0x0000000140042000-memory.dmp	xmrig
behavioral1/memory/2888-5968-0x000000013F310000-0x000000013F702000-memory.dmp	xmrig
behavioral1/memory/2220-5967-0x000000013F270000-0x000000013F662000-memory.dmp	xmrig
behavioral1/memory/2032-5934-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	xmrig
behavioral1/memory/2768-5973-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	xmrig
behavioral1/memory/1908-5975-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2848	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2728	ZivapsA.exe
2884	olcEZwJ.exe
2888	atYNAzI.exe
1720	GFLHsJD.exe
2768	tjOytUN.exe
2032	HOSpUWm.exe
704	ZxNsQFi.exe
1908	CjBSdHT.exe
996	nzQhwyu.exe
2220	ByMuUGh.exe
2476	WXgYVvO.exe
1788	pOqCzxe.exe
2420	qWfLcIL.exe
2656	TWawgdk.exe
1220	EeGfWLc.exe
1804	DPNQFQs.exe
1640	jdbvhkQ.exe
2184	nxEUiie.exe
2192	fOxuucQ.exe
2112	lskPnww.exe
2540	juVMTuV.exe
2320	zzQzlBp.exe
1592	kELIfGl.exe
1336	dXLTbDt.exe
2248	pETYXgg.exe
868	UIlwbpk.exe
3036	qwKdIBu.exe
3068	vYfFUBe.exe
1428	SmKLTpO.exe
1028	QsQzIuk.exe
1680	QJtwmpg.exe
1856	sLeueso.exe
1748	xmKNgnH.exe
2308	zSESMax.exe
1580	HxOnpAj.exe
2916	FkVKutg.exe
2784	tpIlKsI.exe
2948	xaTPiyV.exe
3028	KvFgQVZ.exe
2256	PjsQZEx.exe
2940	lLzcCnD.exe
952	cWrZRNc.exe
1816	uwkFDTq.exe
352	GGCzCRp.exe
2708	fAmZrmB.exe
2868	ApupRBb.exe
2312	kIlSmMB.exe
3088	DxlRGfS.exe
3124	GyFdeow.exe
3192	kRfYNiJ.exe
2424	eoEqaFT.exe
3232	XrVyXET.exe
3264	gLKEUbw.exe
3300	qWvzwbn.exe
3336	GaYPKIK.exe
3372	zQfHTYd.exe
3404	FQHgvPq.exe
3436	fElCQmy.exe
3468	IzTqWdH.exe
3500	gvsSfsv.exe
3532	sLrekGb.exe
3568	SfdLrYn.exe
3608	AgsNacH.exe
3640	LxKHGgV.exe

Loads dropped DLL 64 IoCs

pid	Process
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe
2700	54438984039cb84b5be67abfc4b51bf0N.exe

UPX packed file 62 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2700-0-0x000000013F400000-0x000000013F7F2000-memory.dmp	upx
behavioral1/files/0x000a000000012115-3.dat	upx
behavioral1/files/0x000a000000018671-22.dat	upx
behavioral1/files/0x0008000000017487-21.dat	upx
behavioral1/files/0x0008000000017041-7.dat	upx
behavioral1/files/0x0008000000017491-15.dat	upx
behavioral1/memory/2032-45-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	upx
behavioral1/files/0x0005000000019330-61.dat	upx
behavioral1/files/0x000600000001867d-41.dat	upx
behavioral1/files/0x000700000001927c-66.dat	upx
behavioral1/files/0x00050000000193ae-82.dat	upx
behavioral1/files/0x00050000000194b1-110.dat	upx
behavioral1/files/0x0005000000019571-141.dat	upx
behavioral1/files/0x0005000000019617-162.dat	upx
behavioral1/files/0x000500000001961a-168.dat	upx
behavioral1/files/0x000500000001961d-175.dat	upx
behavioral1/files/0x000500000001961f-180.dat	upx
behavioral1/memory/2476-89-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	upx
behavioral1/files/0x00050000000193bc-85.dat	upx
behavioral1/files/0x0030000000016de1-112.dat	upx
behavioral1/files/0x000500000001948a-106.dat	upx
behavioral1/files/0x00050000000194a1-102.dat	upx
behavioral1/files/0x000500000001943b-98.dat	upx
behavioral1/files/0x0005000000019449-95.dat	upx
behavioral1/files/0x00050000000193aa-76.dat	upx
behavioral1/files/0x0005000000019621-187.dat	upx
behavioral1/files/0x0005000000019623-186.dat	upx
behavioral1/files/0x000500000001961b-171.dat	upx
behavioral1/files/0x0007000000004e74-71.dat	upx
behavioral1/files/0x0005000000019619-164.dat	upx
behavioral1/files/0x00050000000195a1-155.dat	upx
behavioral1/files/0x00050000000195e6-152.dat	upx
behavioral1/files/0x000500000001957d-146.dat	upx
behavioral1/files/0x0005000000019506-136.dat	upx
behavioral1/files/0x00050000000194fa-129.dat	upx
behavioral1/files/0x00050000000194e5-119.dat	upx
behavioral1/files/0x0005000000019625-191.dat	upx
behavioral1/files/0x0005000000019504-135.dat	upx
behavioral1/files/0x00050000000194f0-124.dat	upx
behavioral1/files/0x00050000000194c1-118.dat	upx
behavioral1/memory/2220-83-0x000000013F270000-0x000000013F662000-memory.dmp	upx
behavioral1/files/0x0006000000019398-75.dat	upx
behavioral1/memory/996-67-0x000000013F2E0000-0x000000013F6D2000-memory.dmp	upx
behavioral1/files/0x00060000000186de-47.dat	upx
behavioral1/memory/2768-40-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	upx
behavioral1/memory/1720-36-0x000000013F770000-0x000000013FB62000-memory.dmp	upx
behavioral1/memory/2888-34-0x000000013F310000-0x000000013F702000-memory.dmp	upx
behavioral1/memory/2884-31-0x000000013FCD0000-0x00000001400C2000-memory.dmp	upx
behavioral1/memory/2728-29-0x000000013FFB0000-0x00000001403A2000-memory.dmp	upx
behavioral1/memory/1908-62-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	upx
behavioral1/memory/704-60-0x000000013FC50000-0x0000000140042000-memory.dmp	upx
behavioral1/memory/2700-1295-0x000000013F400000-0x000000013F7F2000-memory.dmp	upx
behavioral1/memory/1720-5312-0x000000013F770000-0x000000013FB62000-memory.dmp	upx
behavioral1/memory/2476-5933-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	upx
behavioral1/memory/2884-5932-0x000000013FCD0000-0x00000001400C2000-memory.dmp	upx
behavioral1/memory/2728-5931-0x000000013FFB0000-0x00000001403A2000-memory.dmp	upx
behavioral1/memory/704-5954-0x000000013FC50000-0x0000000140042000-memory.dmp	upx
behavioral1/memory/2888-5968-0x000000013F310000-0x000000013F702000-memory.dmp	upx
behavioral1/memory/2220-5967-0x000000013F270000-0x000000013F662000-memory.dmp	upx
behavioral1/memory/2032-5934-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	upx
behavioral1/memory/2768-5973-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	upx
behavioral1/memory/1908-5975-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\aqbXgAt.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\cIvsqiC.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\RWUqfCS.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\pZIAthx.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\RppaKHD.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\leNjHWZ.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\pzvlaEA.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\XoqvqrC.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\oaemmqF.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\GUvWAah.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\mDLlGJD.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\qWLCqDb.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\LBGeafp.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\KfmPVfI.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\ZkUyPcY.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\xugAPqW.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\TwMHhtp.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\ULVTfup.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\JrhtJfg.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\nKazyzx.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\mlZKpml.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\WiiwOcA.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\pZsCQAp.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\aJguQcU.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\oNnCrQg.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\WHQDPHZ.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\kHJoexx.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\HhZBAkj.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\SXSswsf.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\GbbVhOg.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\JrDJHZW.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\gMeFZfk.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\LeVecWx.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\AkKZcaq.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\lRsIqIP.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\xiNhSnn.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\PshDFxZ.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\xelUfQH.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\JsWsGQX.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\DpRattD.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\dRnOUwH.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\gSQRziJ.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\VtsdgPc.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\vJEBPwl.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\SORXIuV.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\HffGfWA.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\xQvBYAP.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\GkjbNqQ.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\nzQhwyu.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\RTDFZKa.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\MyzOKxz.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\obNkAeM.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\BnXXRaV.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\tvBdsyl.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\NPpmifM.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\TZgQTgp.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\hCtyyCg.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\BVnghIq.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\DHHzNlW.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\URnNZgc.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\mUnkMOx.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\YgdXIgo.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\mODKQTs.exe	54438984039cb84b5be67abfc4b51bf0N.exe
File created	C:\Windows\System\UOjeKyp.exe	54438984039cb84b5be67abfc4b51bf0N.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2848	powershell.exe
2848	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2700	54438984039cb84b5be67abfc4b51bf0N.exe
Token: SeLockMemoryPrivilege	2700	54438984039cb84b5be67abfc4b51bf0N.exe
Token: SeDebugPrivilege	2848	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2848	2700	54438984039cb84b5be67abfc4b51bf0N.exe	31
PID 2700 wrote to memory of 2848	2700	54438984039cb84b5be67abfc4b51bf0N.exe	31
PID 2700 wrote to memory of 2848	2700	54438984039cb84b5be67abfc4b51bf0N.exe	31
PID 2700 wrote to memory of 2728	2700	54438984039cb84b5be67abfc4b51bf0N.exe	32
PID 2700 wrote to memory of 2728	2700	54438984039cb84b5be67abfc4b51bf0N.exe	32
PID 2700 wrote to memory of 2728	2700	54438984039cb84b5be67abfc4b51bf0N.exe	32
PID 2700 wrote to memory of 2884	2700	54438984039cb84b5be67abfc4b51bf0N.exe	33
PID 2700 wrote to memory of 2884	2700	54438984039cb84b5be67abfc4b51bf0N.exe	33
PID 2700 wrote to memory of 2884	2700	54438984039cb84b5be67abfc4b51bf0N.exe	33
PID 2700 wrote to memory of 2888	2700	54438984039cb84b5be67abfc4b51bf0N.exe	34
PID 2700 wrote to memory of 2888	2700	54438984039cb84b5be67abfc4b51bf0N.exe	34
PID 2700 wrote to memory of 2888	2700	54438984039cb84b5be67abfc4b51bf0N.exe	34
PID 2700 wrote to memory of 2768	2700	54438984039cb84b5be67abfc4b51bf0N.exe	35
PID 2700 wrote to memory of 2768	2700	54438984039cb84b5be67abfc4b51bf0N.exe	35
PID 2700 wrote to memory of 2768	2700	54438984039cb84b5be67abfc4b51bf0N.exe	35
PID 2700 wrote to memory of 1720	2700	54438984039cb84b5be67abfc4b51bf0N.exe	36
PID 2700 wrote to memory of 1720	2700	54438984039cb84b5be67abfc4b51bf0N.exe	36
PID 2700 wrote to memory of 1720	2700	54438984039cb84b5be67abfc4b51bf0N.exe	36
PID 2700 wrote to memory of 2032	2700	54438984039cb84b5be67abfc4b51bf0N.exe	37
PID 2700 wrote to memory of 2032	2700	54438984039cb84b5be67abfc4b51bf0N.exe	37
PID 2700 wrote to memory of 2032	2700	54438984039cb84b5be67abfc4b51bf0N.exe	37
PID 2700 wrote to memory of 704	2700	54438984039cb84b5be67abfc4b51bf0N.exe	38
PID 2700 wrote to memory of 704	2700	54438984039cb84b5be67abfc4b51bf0N.exe	38
PID 2700 wrote to memory of 704	2700	54438984039cb84b5be67abfc4b51bf0N.exe	38
PID 2700 wrote to memory of 996	2700	54438984039cb84b5be67abfc4b51bf0N.exe	39
PID 2700 wrote to memory of 996	2700	54438984039cb84b5be67abfc4b51bf0N.exe	39
PID 2700 wrote to memory of 996	2700	54438984039cb84b5be67abfc4b51bf0N.exe	39
PID 2700 wrote to memory of 1908	2700	54438984039cb84b5be67abfc4b51bf0N.exe	40
PID 2700 wrote to memory of 1908	2700	54438984039cb84b5be67abfc4b51bf0N.exe	40
PID 2700 wrote to memory of 1908	2700	54438984039cb84b5be67abfc4b51bf0N.exe	40
PID 2700 wrote to memory of 2220	2700	54438984039cb84b5be67abfc4b51bf0N.exe	41
PID 2700 wrote to memory of 2220	2700	54438984039cb84b5be67abfc4b51bf0N.exe	41
PID 2700 wrote to memory of 2220	2700	54438984039cb84b5be67abfc4b51bf0N.exe	41
PID 2700 wrote to memory of 2476	2700	54438984039cb84b5be67abfc4b51bf0N.exe	42
PID 2700 wrote to memory of 2476	2700	54438984039cb84b5be67abfc4b51bf0N.exe	42
PID 2700 wrote to memory of 2476	2700	54438984039cb84b5be67abfc4b51bf0N.exe	42
PID 2700 wrote to memory of 2540	2700	54438984039cb84b5be67abfc4b51bf0N.exe	43
PID 2700 wrote to memory of 2540	2700	54438984039cb84b5be67abfc4b51bf0N.exe	43
PID 2700 wrote to memory of 2540	2700	54438984039cb84b5be67abfc4b51bf0N.exe	43
PID 2700 wrote to memory of 1788	2700	54438984039cb84b5be67abfc4b51bf0N.exe	44
PID 2700 wrote to memory of 1788	2700	54438984039cb84b5be67abfc4b51bf0N.exe	44
PID 2700 wrote to memory of 1788	2700	54438984039cb84b5be67abfc4b51bf0N.exe	44
PID 2700 wrote to memory of 1428	2700	54438984039cb84b5be67abfc4b51bf0N.exe	45
PID 2700 wrote to memory of 1428	2700	54438984039cb84b5be67abfc4b51bf0N.exe	45
PID 2700 wrote to memory of 1428	2700	54438984039cb84b5be67abfc4b51bf0N.exe	45
PID 2700 wrote to memory of 2420	2700	54438984039cb84b5be67abfc4b51bf0N.exe	46
PID 2700 wrote to memory of 2420	2700	54438984039cb84b5be67abfc4b51bf0N.exe	46
PID 2700 wrote to memory of 2420	2700	54438984039cb84b5be67abfc4b51bf0N.exe	46
PID 2700 wrote to memory of 1680	2700	54438984039cb84b5be67abfc4b51bf0N.exe	47
PID 2700 wrote to memory of 1680	2700	54438984039cb84b5be67abfc4b51bf0N.exe	47
PID 2700 wrote to memory of 1680	2700	54438984039cb84b5be67abfc4b51bf0N.exe	47
PID 2700 wrote to memory of 2656	2700	54438984039cb84b5be67abfc4b51bf0N.exe	48
PID 2700 wrote to memory of 2656	2700	54438984039cb84b5be67abfc4b51bf0N.exe	48
PID 2700 wrote to memory of 2656	2700	54438984039cb84b5be67abfc4b51bf0N.exe	48
PID 2700 wrote to memory of 2916	2700	54438984039cb84b5be67abfc4b51bf0N.exe	49
PID 2700 wrote to memory of 2916	2700	54438984039cb84b5be67abfc4b51bf0N.exe	49
PID 2700 wrote to memory of 2916	2700	54438984039cb84b5be67abfc4b51bf0N.exe	49
PID 2700 wrote to memory of 1220	2700	54438984039cb84b5be67abfc4b51bf0N.exe	50
PID 2700 wrote to memory of 1220	2700	54438984039cb84b5be67abfc4b51bf0N.exe	50
PID 2700 wrote to memory of 1220	2700	54438984039cb84b5be67abfc4b51bf0N.exe	50
PID 2700 wrote to memory of 2940	2700	54438984039cb84b5be67abfc4b51bf0N.exe	51
PID 2700 wrote to memory of 2940	2700	54438984039cb84b5be67abfc4b51bf0N.exe	51
PID 2700 wrote to memory of 2940	2700	54438984039cb84b5be67abfc4b51bf0N.exe	51
PID 2700 wrote to memory of 1804	2700	54438984039cb84b5be67abfc4b51bf0N.exe	52

C:\Users\Admin\AppData\Local\Temp\54438984039cb84b5be67abfc4b51bf0N.exe
"C:\Users\Admin\AppData\Local\Temp\54438984039cb84b5be67abfc4b51bf0N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2848
- C:\Windows\System\ZivapsA.exe
  C:\Windows\System\ZivapsA.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\olcEZwJ.exe
  C:\Windows\System\olcEZwJ.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\atYNAzI.exe
  C:\Windows\System\atYNAzI.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\tjOytUN.exe
  C:\Windows\System\tjOytUN.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\GFLHsJD.exe
  C:\Windows\System\GFLHsJD.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\HOSpUWm.exe
  C:\Windows\System\HOSpUWm.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\ZxNsQFi.exe
  C:\Windows\System\ZxNsQFi.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\nzQhwyu.exe
  C:\Windows\System\nzQhwyu.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\CjBSdHT.exe
  C:\Windows\System\CjBSdHT.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\ByMuUGh.exe
  C:\Windows\System\ByMuUGh.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\WXgYVvO.exe
  C:\Windows\System\WXgYVvO.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\juVMTuV.exe
  C:\Windows\System\juVMTuV.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\pOqCzxe.exe
  C:\Windows\System\pOqCzxe.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\SmKLTpO.exe
  C:\Windows\System\SmKLTpO.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\qWfLcIL.exe
  C:\Windows\System\qWfLcIL.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\QJtwmpg.exe
  C:\Windows\System\QJtwmpg.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\TWawgdk.exe
  C:\Windows\System\TWawgdk.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\FkVKutg.exe
  C:\Windows\System\FkVKutg.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\EeGfWLc.exe
  C:\Windows\System\EeGfWLc.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\lLzcCnD.exe
  C:\Windows\System\lLzcCnD.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\DPNQFQs.exe
  C:\Windows\System\DPNQFQs.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\GGCzCRp.exe
  C:\Windows\System\GGCzCRp.exe
  2⤵
  - Executes dropped EXE
  PID:352
- C:\Windows\System\jdbvhkQ.exe
  C:\Windows\System\jdbvhkQ.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\eoEqaFT.exe
  C:\Windows\System\eoEqaFT.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\nxEUiie.exe
  C:\Windows\System\nxEUiie.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\JrnCNsN.exe
  C:\Windows\System\JrnCNsN.exe
  2⤵
  PID:1812
- C:\Windows\System\fOxuucQ.exe
  C:\Windows\System\fOxuucQ.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\UYdUjOz.exe
  C:\Windows\System\UYdUjOz.exe
  2⤵
  PID:1956
- C:\Windows\System\lskPnww.exe
  C:\Windows\System\lskPnww.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\tWVstTf.exe
  C:\Windows\System\tWVstTf.exe
  2⤵
  PID:2004
- C:\Windows\System\zzQzlBp.exe
  C:\Windows\System\zzQzlBp.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\qXQlvIS.exe
  C:\Windows\System\qXQlvIS.exe
  2⤵
  PID:1120
- C:\Windows\System\kELIfGl.exe
  C:\Windows\System\kELIfGl.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\fXjvblA.exe
  C:\Windows\System\fXjvblA.exe
  2⤵
  PID:1992
- C:\Windows\System\dXLTbDt.exe
  C:\Windows\System\dXLTbDt.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\fQJsSmd.exe
  C:\Windows\System\fQJsSmd.exe
  2⤵
  PID:1528
- C:\Windows\System\pETYXgg.exe
  C:\Windows\System\pETYXgg.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\qYzfMMU.exe
  C:\Windows\System\qYzfMMU.exe
  2⤵
  PID:2316
- C:\Windows\System\UIlwbpk.exe
  C:\Windows\System\UIlwbpk.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\mexJbhT.exe
  C:\Windows\System\mexJbhT.exe
  2⤵
  PID:692
- C:\Windows\System\qwKdIBu.exe
  C:\Windows\System\qwKdIBu.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\tsskNiD.exe
  C:\Windows\System\tsskNiD.exe
  2⤵
  PID:2152
- C:\Windows\System\vYfFUBe.exe
  C:\Windows\System\vYfFUBe.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\qQHvJWh.exe
  C:\Windows\System\qQHvJWh.exe
  2⤵
  PID:544
- C:\Windows\System\QsQzIuk.exe
  C:\Windows\System\QsQzIuk.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\GakYshx.exe
  C:\Windows\System\GakYshx.exe
  2⤵
  PID:2536
- C:\Windows\System\sLeueso.exe
  C:\Windows\System\sLeueso.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\ePvMSyh.exe
  C:\Windows\System\ePvMSyh.exe
  2⤵
  PID:1628
- C:\Windows\System\xmKNgnH.exe
  C:\Windows\System\xmKNgnH.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\vOJUmBF.exe
  C:\Windows\System\vOJUmBF.exe
  2⤵
  PID:2412
- C:\Windows\System\zSESMax.exe
  C:\Windows\System\zSESMax.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\SsnTava.exe
  C:\Windows\System\SsnTava.exe
  2⤵
  PID:664
- C:\Windows\System\HxOnpAj.exe
  C:\Windows\System\HxOnpAj.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\gfswJHd.exe
  C:\Windows\System\gfswJHd.exe
  2⤵
  PID:1548
- C:\Windows\System\tpIlKsI.exe
  C:\Windows\System\tpIlKsI.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\vkCizrX.exe
  C:\Windows\System\vkCizrX.exe
  2⤵
  PID:2820
- C:\Windows\System\xaTPiyV.exe
  C:\Windows\System\xaTPiyV.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\CDzrSEV.exe
  C:\Windows\System\CDzrSEV.exe
  2⤵
  PID:1588
- C:\Windows\System\KvFgQVZ.exe
  C:\Windows\System\KvFgQVZ.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\JaPXOQv.exe
  C:\Windows\System\JaPXOQv.exe
  2⤵
  PID:1268
- C:\Windows\System\PjsQZEx.exe
  C:\Windows\System\PjsQZEx.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\EfcWxrc.exe
  C:\Windows\System\EfcWxrc.exe
  2⤵
  PID:2432
- C:\Windows\System\cWrZRNc.exe
  C:\Windows\System\cWrZRNc.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\yIkmION.exe
  C:\Windows\System\yIkmION.exe
  2⤵
  PID:2488
- C:\Windows\System\uwkFDTq.exe
  C:\Windows\System\uwkFDTq.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\EodFCsJ.exe
  C:\Windows\System\EodFCsJ.exe
  2⤵
  PID:2772
- C:\Windows\System\fAmZrmB.exe
  C:\Windows\System\fAmZrmB.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\LwFihvR.exe
  C:\Windows\System\LwFihvR.exe
  2⤵
  PID:1700
- C:\Windows\System\ApupRBb.exe
  C:\Windows\System\ApupRBb.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\MEiIeYm.exe
  C:\Windows\System\MEiIeYm.exe
  2⤵
  PID:2576
- C:\Windows\System\kIlSmMB.exe
  C:\Windows\System\kIlSmMB.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\ZigQoNA.exe
  C:\Windows\System\ZigQoNA.exe
  2⤵
  PID:1732
- C:\Windows\System\DxlRGfS.exe
  C:\Windows\System\DxlRGfS.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\QnFWjXB.exe
  C:\Windows\System\QnFWjXB.exe
  2⤵
  PID:3108
- C:\Windows\System\GyFdeow.exe
  C:\Windows\System\GyFdeow.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\gTzldEQ.exe
  C:\Windows\System\gTzldEQ.exe
  2⤵
  PID:3140
- C:\Windows\System\kRfYNiJ.exe
  C:\Windows\System\kRfYNiJ.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\KoMAbxt.exe
  C:\Windows\System\KoMAbxt.exe
  2⤵
  PID:3216
- C:\Windows\System\XrVyXET.exe
  C:\Windows\System\XrVyXET.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\nGbNLoN.exe
  C:\Windows\System\nGbNLoN.exe
  2⤵
  PID:3248
- C:\Windows\System\gLKEUbw.exe
  C:\Windows\System\gLKEUbw.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\QqSQgCX.exe
  C:\Windows\System\QqSQgCX.exe
  2⤵
  PID:3284
- C:\Windows\System\qWvzwbn.exe
  C:\Windows\System\qWvzwbn.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\NlueaHO.exe
  C:\Windows\System\NlueaHO.exe
  2⤵
  PID:3320
- C:\Windows\System\GaYPKIK.exe
  C:\Windows\System\GaYPKIK.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\HwMfLTy.exe
  C:\Windows\System\HwMfLTy.exe
  2⤵
  PID:3352
- C:\Windows\System\zQfHTYd.exe
  C:\Windows\System\zQfHTYd.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\nKROkod.exe
  C:\Windows\System\nKROkod.exe
  2⤵
  PID:3388
- C:\Windows\System\FQHgvPq.exe
  C:\Windows\System\FQHgvPq.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\IRqQiyq.exe
  C:\Windows\System\IRqQiyq.exe
  2⤵
  PID:3420
- C:\Windows\System\fElCQmy.exe
  C:\Windows\System\fElCQmy.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\aeXuBNg.exe
  C:\Windows\System\aeXuBNg.exe
  2⤵
  PID:3452
- C:\Windows\System\IzTqWdH.exe
  C:\Windows\System\IzTqWdH.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\OsiDdMc.exe
  C:\Windows\System\OsiDdMc.exe
  2⤵
  PID:3484
- C:\Windows\System\gvsSfsv.exe
  C:\Windows\System\gvsSfsv.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\WjuyQHm.exe
  C:\Windows\System\WjuyQHm.exe
  2⤵
  PID:3516
- C:\Windows\System\sLrekGb.exe
  C:\Windows\System\sLrekGb.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\ODfQcDk.exe
  C:\Windows\System\ODfQcDk.exe
  2⤵
  PID:3552
- C:\Windows\System\SfdLrYn.exe
  C:\Windows\System\SfdLrYn.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\DNjDOKx.exe
  C:\Windows\System\DNjDOKx.exe
  2⤵
  PID:3592
- C:\Windows\System\AgsNacH.exe
  C:\Windows\System\AgsNacH.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\iPOZavE.exe
  C:\Windows\System\iPOZavE.exe
  2⤵
  PID:3624
- C:\Windows\System\LxKHGgV.exe
  C:\Windows\System\LxKHGgV.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\wOxAAHy.exe
  C:\Windows\System\wOxAAHy.exe
  2⤵
  PID:3656
- C:\Windows\System\YyTRKlr.exe
  C:\Windows\System\YyTRKlr.exe
  2⤵
  PID:3672
- C:\Windows\System\aROWrzj.exe
  C:\Windows\System\aROWrzj.exe
  2⤵
  PID:3688
- C:\Windows\System\xVLAHmP.exe
  C:\Windows\System\xVLAHmP.exe
  2⤵
  PID:3704
- C:\Windows\System\McakNgT.exe
  C:\Windows\System\McakNgT.exe
  2⤵
  PID:3724
- C:\Windows\System\zRuRiOh.exe
  C:\Windows\System\zRuRiOh.exe
  2⤵
  PID:3740
- C:\Windows\System\CKuxyIv.exe
  C:\Windows\System\CKuxyIv.exe
  2⤵
  PID:3756
- C:\Windows\System\HseYlVt.exe
  C:\Windows\System\HseYlVt.exe
  2⤵
  PID:3772
- C:\Windows\System\qrbXRyJ.exe
  C:\Windows\System\qrbXRyJ.exe
  2⤵
  PID:3792
- C:\Windows\System\hUlcUKu.exe
  C:\Windows\System\hUlcUKu.exe
  2⤵
  PID:3820
- C:\Windows\System\BGGGEnp.exe
  C:\Windows\System\BGGGEnp.exe
  2⤵
  PID:3844
- C:\Windows\System\RHtpOyl.exe
  C:\Windows\System\RHtpOyl.exe
  2⤵
  PID:3860
- C:\Windows\System\xOyImgd.exe
  C:\Windows\System\xOyImgd.exe
  2⤵
  PID:3876
- C:\Windows\System\AXTfcUg.exe
  C:\Windows\System\AXTfcUg.exe
  2⤵
  PID:3892
- C:\Windows\System\rBpPJzK.exe
  C:\Windows\System\rBpPJzK.exe
  2⤵
  PID:3908
- C:\Windows\System\xiNhSnn.exe
  C:\Windows\System\xiNhSnn.exe
  2⤵
  PID:3924
- C:\Windows\System\EkvdOQa.exe
  C:\Windows\System\EkvdOQa.exe
  2⤵
  PID:3944
- C:\Windows\System\UIYYgLP.exe
  C:\Windows\System\UIYYgLP.exe
  2⤵
  PID:3960
- C:\Windows\System\iojnGel.exe
  C:\Windows\System\iojnGel.exe
  2⤵
  PID:3980
- C:\Windows\System\jpeNGve.exe
  C:\Windows\System\jpeNGve.exe
  2⤵
  PID:4000
- C:\Windows\System\oaBVWOj.exe
  C:\Windows\System\oaBVWOj.exe
  2⤵
  PID:4016
- C:\Windows\System\JMDDtsB.exe
  C:\Windows\System\JMDDtsB.exe
  2⤵
  PID:4032
- C:\Windows\System\OPGZnfI.exe
  C:\Windows\System\OPGZnfI.exe
  2⤵
  PID:4048
- C:\Windows\System\wiyrnGi.exe
  C:\Windows\System\wiyrnGi.exe
  2⤵
  PID:4064
- C:\Windows\System\wTzJbRc.exe
  C:\Windows\System\wTzJbRc.exe
  2⤵
  PID:4080
- C:\Windows\System\EDTfLLt.exe
  C:\Windows\System\EDTfLLt.exe
  2⤵
  PID:892
- C:\Windows\System\zhdOThe.exe
  C:\Windows\System\zhdOThe.exe
  2⤵
  PID:1308
- C:\Windows\System\YoomvZX.exe
  C:\Windows\System\YoomvZX.exe
  2⤵
  PID:3100
- C:\Windows\System\WUqLocp.exe
  C:\Windows\System\WUqLocp.exe
  2⤵
  PID:3136
- C:\Windows\System\dBBbXKY.exe
  C:\Windows\System\dBBbXKY.exe
  2⤵
  PID:3244
- C:\Windows\System\uUvNUVO.exe
  C:\Windows\System\uUvNUVO.exe
  2⤵
  PID:3308
- C:\Windows\System\czAeEKw.exe
  C:\Windows\System\czAeEKw.exe
  2⤵
  PID:3380
- C:\Windows\System\zjANKxV.exe
  C:\Windows\System\zjANKxV.exe
  2⤵
  PID:3444
- C:\Windows\System\hJDVxzs.exe
  C:\Windows\System\hJDVxzs.exe
  2⤵
  PID:3508
- C:\Windows\System\CiZSTgN.exe
  C:\Windows\System\CiZSTgN.exe
  2⤵
  PID:592
- C:\Windows\System\dCjKoGs.exe
  C:\Windows\System\dCjKoGs.exe
  2⤵
  PID:3588
- C:\Windows\System\yqenWqU.exe
  C:\Windows\System\yqenWqU.exe
  2⤵
  PID:2108
- C:\Windows\System\HYpiUFj.exe
  C:\Windows\System\HYpiUFj.exe
  2⤵
  PID:1752
- C:\Windows\System\DjfPTbN.exe
  C:\Windows\System\DjfPTbN.exe
  2⤵
  PID:2176
- C:\Windows\System\sZwnqHc.exe
  C:\Windows\System\sZwnqHc.exe
  2⤵
  PID:3780
- C:\Windows\System\dFAhdYl.exe
  C:\Windows\System\dFAhdYl.exe
  2⤵
  PID:3836
- C:\Windows\System\zynpjTX.exe
  C:\Windows\System\zynpjTX.exe
  2⤵
  PID:4112
- C:\Windows\System\hzcyjSE.exe
  C:\Windows\System\hzcyjSE.exe
  2⤵
  PID:4128
- C:\Windows\System\vlQujpH.exe
  C:\Windows\System\vlQujpH.exe
  2⤵
  PID:4144
- C:\Windows\System\OXAmyGi.exe
  C:\Windows\System\OXAmyGi.exe
  2⤵
  PID:4160
- C:\Windows\System\NgThIYO.exe
  C:\Windows\System\NgThIYO.exe
  2⤵
  PID:4176
- C:\Windows\System\dDUgPTQ.exe
  C:\Windows\System\dDUgPTQ.exe
  2⤵
  PID:4192
- C:\Windows\System\YLBgcPR.exe
  C:\Windows\System\YLBgcPR.exe
  2⤵
  PID:4208
- C:\Windows\System\HnqALkx.exe
  C:\Windows\System\HnqALkx.exe
  2⤵
  PID:4224
- C:\Windows\System\RAJmafT.exe
  C:\Windows\System\RAJmafT.exe
  2⤵
  PID:4240
- C:\Windows\System\WVkdYQC.exe
  C:\Windows\System\WVkdYQC.exe
  2⤵
  PID:4256
- C:\Windows\System\GKppsIq.exe
  C:\Windows\System\GKppsIq.exe
  2⤵
  PID:4272
- C:\Windows\System\CBChGbu.exe
  C:\Windows\System\CBChGbu.exe
  2⤵
  PID:4288
- C:\Windows\System\ddxJyAc.exe
  C:\Windows\System\ddxJyAc.exe
  2⤵
  PID:4304
- C:\Windows\System\oXCLpji.exe
  C:\Windows\System\oXCLpji.exe
  2⤵
  PID:4320
- C:\Windows\System\yUWbAKx.exe
  C:\Windows\System\yUWbAKx.exe
  2⤵
  PID:4336
- C:\Windows\System\mpMPmik.exe
  C:\Windows\System\mpMPmik.exe
  2⤵
  PID:4352
- C:\Windows\System\JqVWcky.exe
  C:\Windows\System\JqVWcky.exe
  2⤵
  PID:4368
- C:\Windows\System\VRLYfSL.exe
  C:\Windows\System\VRLYfSL.exe
  2⤵
  PID:4384
- C:\Windows\System\XtTcnWP.exe
  C:\Windows\System\XtTcnWP.exe
  2⤵
  PID:4400
- C:\Windows\System\ZKbbsgN.exe
  C:\Windows\System\ZKbbsgN.exe
  2⤵
  PID:4416
- C:\Windows\System\frMZmyP.exe
  C:\Windows\System\frMZmyP.exe
  2⤵
  PID:4432
- C:\Windows\System\mvSgbmB.exe
  C:\Windows\System\mvSgbmB.exe
  2⤵
  PID:4448
- C:\Windows\System\jWefahe.exe
  C:\Windows\System\jWefahe.exe
  2⤵
  PID:4464
- C:\Windows\System\tgJZHdP.exe
  C:\Windows\System\tgJZHdP.exe
  2⤵
  PID:4480
- C:\Windows\System\bXGCPMD.exe
  C:\Windows\System\bXGCPMD.exe
  2⤵
  PID:4508
- C:\Windows\System\ZwRrNVR.exe
  C:\Windows\System\ZwRrNVR.exe
  2⤵
  PID:4528
- C:\Windows\System\OFbvHIy.exe
  C:\Windows\System\OFbvHIy.exe
  2⤵
  PID:4548
- C:\Windows\System\nhXTMNV.exe
  C:\Windows\System\nhXTMNV.exe
  2⤵
  PID:4572
- C:\Windows\System\hZnbtGo.exe
  C:\Windows\System\hZnbtGo.exe
  2⤵
  PID:4600
- C:\Windows\System\grjVvat.exe
  C:\Windows\System\grjVvat.exe
  2⤵
  PID:4620
- C:\Windows\System\fqVYPte.exe
  C:\Windows\System\fqVYPte.exe
  2⤵
  PID:4664
- C:\Windows\System\SGzddWY.exe
  C:\Windows\System\SGzddWY.exe
  2⤵
  PID:4680
- C:\Windows\System\unNsbwC.exe
  C:\Windows\System\unNsbwC.exe
  2⤵
  PID:4696
- C:\Windows\System\KQnHUTr.exe
  C:\Windows\System\KQnHUTr.exe
  2⤵
  PID:4712
- C:\Windows\System\FDmAKFi.exe
  C:\Windows\System\FDmAKFi.exe
  2⤵
  PID:4728
- C:\Windows\System\RcfmpYs.exe
  C:\Windows\System\RcfmpYs.exe
  2⤵
  PID:4744
- C:\Windows\System\FJIXFUP.exe
  C:\Windows\System\FJIXFUP.exe
  2⤵
  PID:4760
- C:\Windows\System\oogTVJQ.exe
  C:\Windows\System\oogTVJQ.exe
  2⤵
  PID:4776
- C:\Windows\System\TwMHhtp.exe
  C:\Windows\System\TwMHhtp.exe
  2⤵
  PID:4796
- C:\Windows\System\AyIMFPG.exe
  C:\Windows\System\AyIMFPG.exe
  2⤵
  PID:4812
- C:\Windows\System\kRHrJmu.exe
  C:\Windows\System\kRHrJmu.exe
  2⤵
  PID:4840
- C:\Windows\System\GAsPCxY.exe
  C:\Windows\System\GAsPCxY.exe
  2⤵
  PID:4856
- C:\Windows\System\kmklkOq.exe
  C:\Windows\System\kmklkOq.exe
  2⤵
  PID:4872
- C:\Windows\System\wLlmhQr.exe
  C:\Windows\System\wLlmhQr.exe
  2⤵
  PID:4888
- C:\Windows\System\SzGpNtc.exe
  C:\Windows\System\SzGpNtc.exe
  2⤵
  PID:4904
- C:\Windows\System\JMGuoxH.exe
  C:\Windows\System\JMGuoxH.exe
  2⤵
  PID:4920
- C:\Windows\System\sbXPIlM.exe
  C:\Windows\System\sbXPIlM.exe
  2⤵
  PID:4936
- C:\Windows\System\FgXDclR.exe
  C:\Windows\System\FgXDclR.exe
  2⤵
  PID:4952
- C:\Windows\System\APwGjfH.exe
  C:\Windows\System\APwGjfH.exe
  2⤵
  PID:4972
- C:\Windows\System\FdRmWuG.exe
  C:\Windows\System\FdRmWuG.exe
  2⤵
  PID:4988
- C:\Windows\System\vcTFQxA.exe
  C:\Windows\System\vcTFQxA.exe
  2⤵
  PID:5004
- C:\Windows\System\GiKSWUG.exe
  C:\Windows\System\GiKSWUG.exe
  2⤵
  PID:5020
- C:\Windows\System\pmHVecw.exe
  C:\Windows\System\pmHVecw.exe
  2⤵
  PID:5036
- C:\Windows\System\agfjYpv.exe
  C:\Windows\System\agfjYpv.exe
  2⤵
  PID:5052
- C:\Windows\System\VHUrESe.exe
  C:\Windows\System\VHUrESe.exe
  2⤵
  PID:2684
- C:\Windows\System\vHUTxpf.exe
  C:\Windows\System\vHUTxpf.exe
  2⤵
  PID:3412
- C:\Windows\System\BxXDkBv.exe
  C:\Windows\System\BxXDkBv.exe
  2⤵
  PID:3620
- C:\Windows\System\ntWqQqm.exe
  C:\Windows\System\ntWqQqm.exe
  2⤵
  PID:3752
- C:\Windows\System\HqxCOsC.exe
  C:\Windows\System\HqxCOsC.exe
  2⤵
  PID:1948
- C:\Windows\System\uxYiXJI.exe
  C:\Windows\System\uxYiXJI.exe
  2⤵
  PID:3788
- C:\Windows\System\hVmgvsv.exe
  C:\Windows\System\hVmgvsv.exe
  2⤵
  PID:4152
- C:\Windows\System\xKhrCsh.exe
  C:\Windows\System\xKhrCsh.exe
  2⤵
  PID:4216
- C:\Windows\System\vPJFUYZ.exe
  C:\Windows\System\vPJFUYZ.exe
  2⤵
  PID:4280
- C:\Windows\System\efWRYdO.exe
  C:\Windows\System\efWRYdO.exe
  2⤵
  PID:2000
- C:\Windows\System\XdPdqKu.exe
  C:\Windows\System\XdPdqKu.exe
  2⤵
  PID:4376
- C:\Windows\System\qeBjbkX.exe
  C:\Windows\System\qeBjbkX.exe
  2⤵
  PID:2664
- C:\Windows\System\cydFXbB.exe
  C:\Windows\System\cydFXbB.exe
  2⤵
  PID:4440
- C:\Windows\System\BdUMdDJ.exe
  C:\Windows\System\BdUMdDJ.exe
  2⤵
  PID:4516
- C:\Windows\System\XBaPvtQ.exe
  C:\Windows\System\XBaPvtQ.exe
  2⤵
  PID:4564
- C:\Windows\System\VGvrrfp.exe
  C:\Windows\System\VGvrrfp.exe
  2⤵
  PID:1444
- C:\Windows\System\moxPlQO.exe
  C:\Windows\System\moxPlQO.exe
  2⤵
  PID:916
- C:\Windows\System\WHHPEEz.exe
  C:\Windows\System\WHHPEEz.exe
  2⤵
  PID:3044
- C:\Windows\System\dEtJFyk.exe
  C:\Windows\System\dEtJFyk.exe
  2⤵
  PID:1048
- C:\Windows\System\DcDHEoD.exe
  C:\Windows\System\DcDHEoD.exe
  2⤵
  PID:2356
- C:\Windows\System\cONzZYV.exe
  C:\Windows\System\cONzZYV.exe
  2⤵
  PID:1708
- C:\Windows\System\bxLqKkw.exe
  C:\Windows\System\bxLqKkw.exe
  2⤵
  PID:2008
- C:\Windows\System\aOUDfzb.exe
  C:\Windows\System\aOUDfzb.exe
  2⤵
  PID:4608
- C:\Windows\System\XOrcHJc.exe
  C:\Windows\System\XOrcHJc.exe
  2⤵
  PID:2960
- C:\Windows\System\txmilnP.exe
  C:\Windows\System\txmilnP.exe
  2⤵
  PID:4672
- C:\Windows\System\dhVLliw.exe
  C:\Windows\System\dhVLliw.exe
  2⤵
  PID:4736
- C:\Windows\System\fWJsgEg.exe
  C:\Windows\System\fWJsgEg.exe
  2⤵
  PID:5536
- C:\Windows\System\GOEAqWo.exe
  C:\Windows\System\GOEAqWo.exe
  2⤵
  PID:5552
- C:\Windows\System\aaCLksp.exe
  C:\Windows\System\aaCLksp.exe
  2⤵
  PID:5568
- C:\Windows\System\fAuxZJW.exe
  C:\Windows\System\fAuxZJW.exe
  2⤵
  PID:5588
- C:\Windows\System\pMZIAoa.exe
  C:\Windows\System\pMZIAoa.exe
  2⤵
  PID:5684
- C:\Windows\System\QPNtvbZ.exe
  C:\Windows\System\QPNtvbZ.exe
  2⤵
  PID:5700
- C:\Windows\System\MNnxkxq.exe
  C:\Windows\System\MNnxkxq.exe
  2⤵
  PID:5764
- C:\Windows\System\BaFaSLz.exe
  C:\Windows\System\BaFaSLz.exe
  2⤵
  PID:5792
- C:\Windows\System\PqPMwJA.exe
  C:\Windows\System\PqPMwJA.exe
  2⤵
  PID:5808
- C:\Windows\System\IxARVsC.exe
  C:\Windows\System\IxARVsC.exe
  2⤵
  PID:5824
- C:\Windows\System\KYnJNyb.exe
  C:\Windows\System\KYnJNyb.exe
  2⤵
  PID:5840
- C:\Windows\System\vniImob.exe
  C:\Windows\System\vniImob.exe
  2⤵
  PID:5856
- C:\Windows\System\nzBkKEA.exe
  C:\Windows\System\nzBkKEA.exe
  2⤵
  PID:5872
- C:\Windows\System\uZeObLn.exe
  C:\Windows\System\uZeObLn.exe
  2⤵
  PID:5888
- C:\Windows\System\wttpIrP.exe
  C:\Windows\System\wttpIrP.exe
  2⤵
  PID:5904
- C:\Windows\System\lXzvTrQ.exe
  C:\Windows\System\lXzvTrQ.exe
  2⤵
  PID:5920
- C:\Windows\System\BKYSVEx.exe
  C:\Windows\System\BKYSVEx.exe
  2⤵
  PID:5936
- C:\Windows\System\qJhoEqI.exe
  C:\Windows\System\qJhoEqI.exe
  2⤵
  PID:5952
- C:\Windows\System\KVXbbqW.exe
  C:\Windows\System\KVXbbqW.exe
  2⤵
  PID:5968
- C:\Windows\System\eHyvofs.exe
  C:\Windows\System\eHyvofs.exe
  2⤵
  PID:5984
- C:\Windows\System\wQNfrlF.exe
  C:\Windows\System\wQNfrlF.exe
  2⤵
  PID:6000
- C:\Windows\System\eAdkwdF.exe
  C:\Windows\System\eAdkwdF.exe
  2⤵
  PID:6016
- C:\Windows\System\ZaBPneQ.exe
  C:\Windows\System\ZaBPneQ.exe
  2⤵
  PID:6032
- C:\Windows\System\jPFKKRt.exe
  C:\Windows\System\jPFKKRt.exe
  2⤵
  PID:6048
- C:\Windows\System\hkzvNEA.exe
  C:\Windows\System\hkzvNEA.exe
  2⤵
  PID:6064
- C:\Windows\System\wCVGExR.exe
  C:\Windows\System\wCVGExR.exe
  2⤵
  PID:6080
- C:\Windows\System\beOOQCD.exe
  C:\Windows\System\beOOQCD.exe
  2⤵
  PID:6100
- C:\Windows\System\ilsAjzn.exe
  C:\Windows\System\ilsAjzn.exe
  2⤵
  PID:6116
- C:\Windows\System\aFokHmo.exe
  C:\Windows\System\aFokHmo.exe
  2⤵
  PID:6132
- C:\Windows\System\wqAVweH.exe
  C:\Windows\System\wqAVweH.exe
  2⤵
  PID:2288
- C:\Windows\System\ixSYswO.exe
  C:\Windows\System\ixSYswO.exe
  2⤵
  PID:3432
- C:\Windows\System\CAfJapA.exe
  C:\Windows\System\CAfJapA.exe
  2⤵
  PID:3364
- C:\Windows\System\VXsaahl.exe
  C:\Windows\System\VXsaahl.exe
  2⤵
  PID:3296
- C:\Windows\System\yPqmGgA.exe
  C:\Windows\System\yPqmGgA.exe
  2⤵
  PID:3228
- C:\Windows\System\auxJuKA.exe
  C:\Windows\System\auxJuKA.exe
  2⤵
  PID:3120
- C:\Windows\System\nsfXvGS.exe
  C:\Windows\System\nsfXvGS.exe
  2⤵
  PID:2188
- C:\Windows\System\RbOjueO.exe
  C:\Windows\System\RbOjueO.exe
  2⤵
  PID:1864
- C:\Windows\System\OINTkvk.exe
  C:\Windows\System\OINTkvk.exe
  2⤵
  PID:5580
- C:\Windows\System\GUvWAah.exe
  C:\Windows\System\GUvWAah.exe
  2⤵
  PID:2464
- C:\Windows\System\nRMYCGs.exe
  C:\Windows\System\nRMYCGs.exe
  2⤵
  PID:1576
- C:\Windows\System\demyaZe.exe
  C:\Windows\System\demyaZe.exe
  2⤵
  PID:3032
- C:\Windows\System\vKTdvVN.exe
  C:\Windows\System\vKTdvVN.exe
  2⤵
  PID:2808
- C:\Windows\System\xIzvqfa.exe
  C:\Windows\System\xIzvqfa.exe
  2⤵
  PID:3160
- C:\Windows\System\aBoITkU.exe
  C:\Windows\System\aBoITkU.exe
  2⤵
  PID:2104
- C:\Windows\System\igspoDB.exe
  C:\Windows\System\igspoDB.exe
  2⤵
  PID:3492
- C:\Windows\System\kWBFcsx.exe
  C:\Windows\System\kWBFcsx.exe
  2⤵
  PID:3812
- C:\Windows\System\XellFkn.exe
  C:\Windows\System\XellFkn.exe
  2⤵
  PID:4544
- C:\Windows\System\WPkBIWO.exe
  C:\Windows\System\WPkBIWO.exe
  2⤵
  PID:4640
- C:\Windows\System\gcpSwcG.exe
  C:\Windows\System\gcpSwcG.exe
  2⤵
  PID:4792
- C:\Windows\System\mUnkMOx.exe
  C:\Windows\System\mUnkMOx.exe
  2⤵
  PID:5064
- C:\Windows\System\TdHvMlK.exe
  C:\Windows\System\TdHvMlK.exe
  2⤵
  PID:5088
- C:\Windows\System\kAubfbE.exe
  C:\Windows\System\kAubfbE.exe
  2⤵
  PID:3832
- C:\Windows\System\wgVgXqU.exe
  C:\Windows\System\wgVgXqU.exe
  2⤵
  PID:2692
- C:\Windows\System\ZxPzpBX.exe
  C:\Windows\System\ZxPzpBX.exe
  2⤵
  PID:4008
- C:\Windows\System\lgbncID.exe
  C:\Windows\System\lgbncID.exe
  2⤵
  PID:4072
- C:\Windows\System\ZBAhhWz.exe
  C:\Windows\System\ZBAhhWz.exe
  2⤵
  PID:904
- C:\Windows\System\rdPafvA.exe
  C:\Windows\System\rdPafvA.exe
  2⤵
  PID:2384
- C:\Windows\System\qKyoEsz.exe
  C:\Windows\System\qKyoEsz.exe
  2⤵
  PID:2872
- C:\Windows\System\plxtIUB.exe
  C:\Windows\System\plxtIUB.exe
  2⤵
  PID:4768
- C:\Windows\System\BonFSja.exe
  C:\Windows\System\BonFSja.exe
  2⤵
  PID:4852
- C:\Windows\System\OBHiBHt.exe
  C:\Windows\System\OBHiBHt.exe
  2⤵
  PID:4916
- C:\Windows\System\UauQdpS.exe
  C:\Windows\System\UauQdpS.exe
  2⤵
  PID:4984
- C:\Windows\System\xTUGFrV.exe
  C:\Windows\System\xTUGFrV.exe
  2⤵
  PID:2180
- C:\Windows\System\rIvXCqy.exe
  C:\Windows\System\rIvXCqy.exe
  2⤵
  PID:2572
- C:\Windows\System\uvgDukD.exe
  C:\Windows\System\uvgDukD.exe
  2⤵
  PID:1396
- C:\Windows\System\juYQOWa.exe
  C:\Windows\System\juYQOWa.exe
  2⤵
  PID:5496
- C:\Windows\System\QBsrnXN.exe
  C:\Windows\System\QBsrnXN.exe
  2⤵
  PID:5512
- C:\Windows\System\LGyNGpG.exe
  C:\Windows\System\LGyNGpG.exe
  2⤵
  PID:5524
- C:\Windows\System\uMugvyn.exe
  C:\Windows\System\uMugvyn.exe
  2⤵
  PID:5564
- C:\Windows\System\DUSonKu.exe
  C:\Windows\System\DUSonKu.exe
  2⤵
  PID:3528
- C:\Windows\System\rQjBxUX.exe
  C:\Windows\System\rQjBxUX.exe
  2⤵
  PID:5616
- C:\Windows\System\JpRDvPB.exe
  C:\Windows\System\JpRDvPB.exe
  2⤵
  PID:5632
- C:\Windows\System\wlLFLpF.exe
  C:\Windows\System\wlLFLpF.exe
  2⤵
  PID:5648
- C:\Windows\System\mqvKKng.exe
  C:\Windows\System\mqvKKng.exe
  2⤵
  PID:4520
- C:\Windows\System\VWzrPuK.exe
  C:\Windows\System\VWzrPuK.exe
  2⤵
  PID:4344
- C:\Windows\System\YZXaMqB.exe
  C:\Windows\System\YZXaMqB.exe
  2⤵
  PID:4120
- C:\Windows\System\DwvRniP.exe
  C:\Windows\System\DwvRniP.exe
  2⤵
  PID:3540
- C:\Windows\System\GHnRfCB.exe
  C:\Windows\System\GHnRfCB.exe
  2⤵
  PID:5028
- C:\Windows\System\PcwvxUY.exe
  C:\Windows\System\PcwvxUY.exe
  2⤵
  PID:4964
- C:\Windows\System\mDLlGJD.exe
  C:\Windows\System\mDLlGJD.exe
  2⤵
  PID:4896
- C:\Windows\System\QGlWGPp.exe
  C:\Windows\System\QGlWGPp.exe
  2⤵
  PID:4832
- C:\Windows\System\SULNqTW.exe
  C:\Windows\System\SULNqTW.exe
  2⤵
  PID:4752
- C:\Windows\System\FSExtmv.exe
  C:\Windows\System\FSExtmv.exe
  2⤵
  PID:4688
- C:\Windows\System\gqPFBEv.exe
  C:\Windows\System\gqPFBEv.exe
  2⤵
  PID:4580
- C:\Windows\System\PLGSCHw.exe
  C:\Windows\System\PLGSCHw.exe
  2⤵
  PID:4488
- C:\Windows\System\Vodzqpn.exe
  C:\Windows\System\Vodzqpn.exe
  2⤵
  PID:4424
- C:\Windows\System\hWMkkBH.exe
  C:\Windows\System\hWMkkBH.exe
  2⤵
  PID:4360
- C:\Windows\System\tamIAFr.exe
  C:\Windows\System\tamIAFr.exe
  2⤵
  PID:4296
- C:\Windows\System\YzGkhwH.exe
  C:\Windows\System\YzGkhwH.exe
  2⤵
  PID:4232
- C:\Windows\System\iLeBrRX.exe
  C:\Windows\System\iLeBrRX.exe
  2⤵
  PID:4168
- C:\Windows\System\mUtatuD.exe
  C:\Windows\System\mUtatuD.exe
  2⤵
  PID:4104
- C:\Windows\System\UjZrouf.exe
  C:\Windows\System\UjZrouf.exe
  2⤵
  PID:284
- C:\Windows\System\VWjdCgm.exe
  C:\Windows\System\VWjdCgm.exe
  2⤵
  PID:3476
- C:\Windows\System\JodNHOs.exe
  C:\Windows\System\JodNHOs.exe
  2⤵
  PID:3204
- C:\Windows\System\EoXIzoB.exe
  C:\Windows\System\EoXIzoB.exe
  2⤵
  PID:4088
- C:\Windows\System\BnXXRaV.exe
  C:\Windows\System\BnXXRaV.exe
  2⤵
  PID:4024
- C:\Windows\System\vdNcwFg.exe
  C:\Windows\System\vdNcwFg.exe
  2⤵
  PID:3956
- C:\Windows\System\aEDOPrk.exe
  C:\Windows\System\aEDOPrk.exe
  2⤵
  PID:3916
- C:\Windows\System\UjLohXB.exe
  C:\Windows\System\UjLohXB.exe
  2⤵
  PID:3856
- C:\Windows\System\GerGLfy.exe
  C:\Windows\System\GerGLfy.exe
  2⤵
  PID:3764
- C:\Windows\System\HGasXFS.exe
  C:\Windows\System\HGasXFS.exe
  2⤵
  PID:3696
- C:\Windows\System\LZNpLQh.exe
  C:\Windows\System\LZNpLQh.exe
  2⤵
  PID:3632
- C:\Windows\System\mVvaLjw.exe
  C:\Windows\System\mVvaLjw.exe
  2⤵
  PID:3560
- C:\Windows\System\uOQBTga.exe
  C:\Windows\System\uOQBTga.exe
  2⤵
  PID:5720
- C:\Windows\System\vPqkbwl.exe
  C:\Windows\System\vPqkbwl.exe
  2⤵
  PID:5816
- C:\Windows\System\rRoXKEC.exe
  C:\Windows\System\rRoXKEC.exe
  2⤵
  PID:5820
- C:\Windows\System\VBaWnis.exe
  C:\Windows\System\VBaWnis.exe
  2⤵
  PID:5836
- C:\Windows\System\ItPeRNh.exe
  C:\Windows\System\ItPeRNh.exe
  2⤵
  PID:5868
- C:\Windows\System\uaCyTrA.exe
  C:\Windows\System\uaCyTrA.exe
  2⤵
  PID:5912
- C:\Windows\System\MjHdxrB.exe
  C:\Windows\System\MjHdxrB.exe
  2⤵
  PID:5932
- C:\Windows\System\gWWHhKs.exe
  C:\Windows\System\gWWHhKs.exe
  2⤵
  PID:5976
- C:\Windows\System\qOGlRsj.exe
  C:\Windows\System\qOGlRsj.exe
  2⤵
  PID:5992
- C:\Windows\System\SQJUQEe.exe
  C:\Windows\System\SQJUQEe.exe
  2⤵
  PID:6040
- C:\Windows\System\lQMcuxE.exe
  C:\Windows\System\lQMcuxE.exe
  2⤵
  PID:6060
- C:\Windows\System\KoIFfxt.exe
  C:\Windows\System\KoIFfxt.exe
  2⤵
  PID:6092
- C:\Windows\System\FkzoDiU.exe
  C:\Windows\System\FkzoDiU.exe
  2⤵
  PID:6140
- C:\Windows\System\legRVAX.exe
  C:\Windows\System\legRVAX.exe
  2⤵
  PID:3460
- C:\Windows\System\fumVjtR.exe
  C:\Windows\System\fumVjtR.exe
  2⤵
  PID:3260
- C:\Windows\System\ZybpLKM.exe
  C:\Windows\System\ZybpLKM.exe
  2⤵
  PID:3080
- C:\Windows\System\qmlCwjx.exe
  C:\Windows\System\qmlCwjx.exe
  2⤵
  PID:1916
- C:\Windows\System\GXzxnfR.exe
  C:\Windows\System\GXzxnfR.exe
  2⤵
  PID:556
- C:\Windows\System\OahoqMR.exe
  C:\Windows\System\OahoqMR.exe
  2⤵
  PID:1556
- C:\Windows\System\KutzPUQ.exe
  C:\Windows\System\KutzPUQ.exe
  2⤵
  PID:3152
- C:\Windows\System\gJRdQJR.exe
  C:\Windows\System\gJRdQJR.exe
  2⤵
  PID:3804
- C:\Windows\System\EfyDBrg.exe
  C:\Windows\System\EfyDBrg.exe
  2⤵
  PID:4592
- C:\Windows\System\VLAMOIQ.exe
  C:\Windows\System\VLAMOIQ.exe
  2⤵
  PID:4960
- C:\Windows\System\OWcQbho.exe
  C:\Windows\System\OWcQbho.exe
  2⤵
  PID:5084
- C:\Windows\System\cGZGDHS.exe
  C:\Windows\System\cGZGDHS.exe
  2⤵
  PID:3904
- C:\Windows\System\aUgkcaV.exe
  C:\Windows\System\aUgkcaV.exe
  2⤵
  PID:4040
- C:\Windows\System\jItzoTX.exe
  C:\Windows\System\jItzoTX.exe
  2⤵
  PID:328
- C:\Windows\System\KjPxLqn.exe
  C:\Windows\System\KjPxLqn.exe
  2⤵
  PID:4616
- C:\Windows\System\gBReqTH.exe
  C:\Windows\System\gBReqTH.exe
  2⤵
  PID:4884
- C:\Windows\System\OOwnqNG.exe
  C:\Windows\System\OOwnqNG.exe
  2⤵
  PID:2140
- C:\Windows\System\HtVAVYH.exe
  C:\Windows\System\HtVAVYH.exe
  2⤵
  PID:4316
- C:\Windows\System\rfIOylA.exe
  C:\Windows\System\rfIOylA.exe
  2⤵
  PID:1368
- C:\Windows\System\PQiEFzk.exe
  C:\Windows\System\PQiEFzk.exe
  2⤵
  PID:5560
- C:\Windows\System\OoMvanm.exe
  C:\Windows\System\OoMvanm.exe
  2⤵
  PID:5624
- C:\Windows\System\HYGaEuU.exe
  C:\Windows\System\HYGaEuU.exe
  2⤵
  PID:5644
- C:\Windows\System\rmnFvFr.exe
  C:\Windows\System\rmnFvFr.exe
  2⤵
  PID:4248
- C:\Windows\System\qnaVAWj.exe
  C:\Windows\System\qnaVAWj.exe
  2⤵
  PID:3940
- C:\Windows\System\XXRiSoc.exe
  C:\Windows\System\XXRiSoc.exe
  2⤵
  PID:4928
- C:\Windows\System\POKllLb.exe
  C:\Windows\System\POKllLb.exe
  2⤵
  PID:4784
- C:\Windows\System\OQRQxUq.exe
  C:\Windows\System\OQRQxUq.exe
  2⤵
  PID:4628
- C:\Windows\System\ruTuFjj.exe
  C:\Windows\System\ruTuFjj.exe
  2⤵
  PID:4456
- C:\Windows\System\hbYQuZg.exe
  C:\Windows\System\hbYQuZg.exe
  2⤵
  PID:4328
- C:\Windows\System\EyEthcT.exe
  C:\Windows\System\EyEthcT.exe
  2⤵
  PID:4236
- C:\Windows\System\HKSbcQr.exe
  C:\Windows\System\HKSbcQr.exe
  2⤵
  PID:4136
- C:\Windows\System\bGmBKIj.exe
  C:\Windows\System\bGmBKIj.exe
  2⤵
  PID:3480
- C:\Windows\System\NsDpyFu.exe
  C:\Windows\System\NsDpyFu.exe
  2⤵
  PID:4056
- C:\Windows\System\CwmgYCx.exe
  C:\Windows\System\CwmgYCx.exe
  2⤵
  PID:5960
- C:\Windows\System\OFdqgPC.exe
  C:\Windows\System\OFdqgPC.exe
  2⤵
  PID:6024
- C:\Windows\System\ysMVMFC.exe
  C:\Windows\System\ysMVMFC.exe
  2⤵
  PID:6112
- C:\Windows\System\vnbEvgG.exe
  C:\Windows\System\vnbEvgG.exe
  2⤵
  PID:3464
- C:\Windows\System\mbvvIeY.exe
  C:\Windows\System\mbvvIeY.exe
  2⤵
  PID:3156
- C:\Windows\System\wVDhaLJ.exe
  C:\Windows\System\wVDhaLJ.exe
  2⤵
  PID:4596
- C:\Windows\System\zGnokbf.exe
  C:\Windows\System\zGnokbf.exe
  2⤵
  PID:5080
- C:\Windows\System\oRGTynH.exe
  C:\Windows\System\oRGTynH.exe
  2⤵
  PID:4044
- C:\Windows\System\kTPCxcA.exe
  C:\Windows\System\kTPCxcA.exe
  2⤵
  PID:4848
- C:\Windows\System\MfWgSAT.exe
  C:\Windows\System\MfWgSAT.exe
  2⤵
  PID:3020
- C:\Windows\System\QcDEBrx.exe
  C:\Windows\System\QcDEBrx.exe
  2⤵
  PID:5520
- C:\Windows\System\GCRcBFf.exe
  C:\Windows\System\GCRcBFf.exe
  2⤵
  PID:5628
- C:\Windows\System\RTDFZKa.exe
  C:\Windows\System\RTDFZKa.exe
  2⤵
  PID:5660
- C:\Windows\System\tSmzRgA.exe
  C:\Windows\System\tSmzRgA.exe
  2⤵
  PID:5032
- C:\Windows\System\RppaKHD.exe
  C:\Windows\System\RppaKHD.exe
  2⤵
  PID:4584
- C:\Windows\System\lsJENUU.exe
  C:\Windows\System\lsJENUU.exe
  2⤵
  PID:844
- C:\Windows\System\ibvUpse.exe
  C:\Windows\System\ibvUpse.exe
  2⤵
  PID:4172
- C:\Windows\System\qbuFtUs.exe
  C:\Windows\System\qbuFtUs.exe
  2⤵
  PID:4392
- C:\Windows\System\gCxpZub.exe
  C:\Windows\System\gCxpZub.exe
  2⤵
  PID:1840
- C:\Windows\System\ORdiDKE.exe
  C:\Windows\System\ORdiDKE.exe
  2⤵
  PID:2216
- C:\Windows\System\tzJyLUy.exe
  C:\Windows\System\tzJyLUy.exe
  2⤵
  PID:3888
- C:\Windows\System\NIAGNik.exe
  C:\Windows\System\NIAGNik.exe
  2⤵
  PID:3732
- C:\Windows\System\rbzfjxt.exe
  C:\Windows\System\rbzfjxt.exe
  2⤵
  PID:2596
- C:\Windows\System\ZXMaGMf.exe
  C:\Windows\System\ZXMaGMf.exe
  2⤵
  PID:5708
- C:\Windows\System\KQfiBcN.exe
  C:\Windows\System\KQfiBcN.exe
  2⤵
  PID:272
- C:\Windows\System\KqKmknN.exe
  C:\Windows\System\KqKmknN.exe
  2⤵
  PID:2800
- C:\Windows\System\IIYAfjT.exe
  C:\Windows\System\IIYAfjT.exe
  2⤵
  PID:1692
- C:\Windows\System\hJHYkHx.exe
  C:\Windows\System\hJHYkHx.exe
  2⤵
  PID:2492
- C:\Windows\System\nICsaoC.exe
  C:\Windows\System\nICsaoC.exe
  2⤵
  PID:5788
- C:\Windows\System\QZWLOle.exe
  C:\Windows\System\QZWLOle.exe
  2⤵
  PID:264
- C:\Windows\System\GQJTcfj.exe
  C:\Windows\System\GQJTcfj.exe
  2⤵
  PID:2796
- C:\Windows\System\UWLegbk.exe
  C:\Windows\System\UWLegbk.exe
  2⤵
  PID:6076
- C:\Windows\System\SXSswsf.exe
  C:\Windows\System\SXSswsf.exe
  2⤵
  PID:6044
- C:\Windows\System\nslsRLV.exe
  C:\Windows\System\nslsRLV.exe
  2⤵
  PID:1568
- C:\Windows\System\HVyAsOt.exe
  C:\Windows\System\HVyAsOt.exe
  2⤵
  PID:3076
- C:\Windows\System\OJNxvCe.exe
  C:\Windows\System\OJNxvCe.exe
  2⤵
  PID:6008
- C:\Windows\System\EhohhZZ.exe
  C:\Windows\System\EhohhZZ.exe
  2⤵
  PID:5060
- C:\Windows\System\NCaUvhJ.exe
  C:\Windows\System\NCaUvhJ.exe
  2⤵
  PID:4864
- C:\Windows\System\MSVjulr.exe
  C:\Windows\System\MSVjulr.exe
  2⤵
  PID:4124
- C:\Windows\System\qjJNNQW.exe
  C:\Windows\System\qjJNNQW.exe
  2⤵
  PID:2328
- C:\Windows\System\UMozqCK.exe
  C:\Windows\System\UMozqCK.exe
  2⤵
  PID:5692
- C:\Windows\System\xmuothW.exe
  C:\Windows\System\xmuothW.exe
  2⤵
  PID:2444
- C:\Windows\System\RDYtOFZ.exe
  C:\Windows\System\RDYtOFZ.exe
  2⤵
  PID:5804
- C:\Windows\System\wqTvUqw.exe
  C:\Windows\System\wqTvUqw.exe
  2⤵
  PID:2268
- C:\Windows\System\OZKGXwT.exe
  C:\Windows\System\OZKGXwT.exe
  2⤵
  PID:3096
- C:\Windows\System\iLFAYSM.exe
  C:\Windows\System\iLFAYSM.exe
  2⤵
  PID:2060
- C:\Windows\System\GEuxRgz.exe
  C:\Windows\System\GEuxRgz.exe
  2⤵
  PID:2044
- C:\Windows\System\hTtxTNP.exe
  C:\Windows\System\hTtxTNP.exe
  2⤵
  PID:5852
- C:\Windows\System\sLuynpc.exe
  C:\Windows\System\sLuynpc.exe
  2⤵
  PID:1348
- C:\Windows\System\DEYVBhe.exe
  C:\Windows\System\DEYVBhe.exe
  2⤵
  PID:2480
- C:\Windows\System\tluIAvC.exe
  C:\Windows\System\tluIAvC.exe
  2⤵
  PID:2164
- C:\Windows\System\CJcugxL.exe
  C:\Windows\System\CJcugxL.exe
  2⤵
  PID:2212
- C:\Windows\System\TSlWLXP.exe
  C:\Windows\System\TSlWLXP.exe
  2⤵
  PID:4264
- C:\Windows\System\EAUqLKf.exe
  C:\Windows\System\EAUqLKf.exe
  2⤵
  PID:3868
- C:\Windows\System\ujkHTtK.exe
  C:\Windows\System\ujkHTtK.exe
  2⤵
  PID:344
- C:\Windows\System\qWLCqDb.exe
  C:\Windows\System\qWLCqDb.exe
  2⤵
  PID:2028
- C:\Windows\System\VVHnPEB.exe
  C:\Windows\System\VVHnPEB.exe
  2⤵
  PID:4900
- C:\Windows\System\jlnNTuz.exe
  C:\Windows\System\jlnNTuz.exe
  2⤵
  PID:3240
- C:\Windows\System\kDjPOOK.exe
  C:\Windows\System\kDjPOOK.exe
  2⤵
  PID:6156
- C:\Windows\System\zkpXKJQ.exe
  C:\Windows\System\zkpXKJQ.exe
  2⤵
  PID:6172
- C:\Windows\System\WWKdpdF.exe
  C:\Windows\System\WWKdpdF.exe
  2⤵
  PID:6188
- C:\Windows\System\goMMEKV.exe
  C:\Windows\System\goMMEKV.exe
  2⤵
  PID:6204
- C:\Windows\System\nnLmRLK.exe
  C:\Windows\System\nnLmRLK.exe
  2⤵
  PID:6220
- C:\Windows\System\OYUHnQd.exe
  C:\Windows\System\OYUHnQd.exe
  2⤵
  PID:6236
- C:\Windows\System\bdiGsjL.exe
  C:\Windows\System\bdiGsjL.exe
  2⤵
  PID:6252
- C:\Windows\System\AWMzQvi.exe
  C:\Windows\System\AWMzQvi.exe
  2⤵
  PID:6268
- C:\Windows\System\WVFWAOX.exe
  C:\Windows\System\WVFWAOX.exe
  2⤵
  PID:6284
- C:\Windows\System\wUPVdVF.exe
  C:\Windows\System\wUPVdVF.exe
  2⤵
  PID:6300
- C:\Windows\System\KFMdFrI.exe
  C:\Windows\System\KFMdFrI.exe
  2⤵
  PID:6316
- C:\Windows\System\lABspMt.exe
  C:\Windows\System\lABspMt.exe
  2⤵
  PID:6332
- C:\Windows\System\IKoLnvo.exe
  C:\Windows\System\IKoLnvo.exe
  2⤵
  PID:6348
- C:\Windows\System\BPlAzCi.exe
  C:\Windows\System\BPlAzCi.exe
  2⤵
  PID:6364
- C:\Windows\System\jLIuLKU.exe
  C:\Windows\System\jLIuLKU.exe
  2⤵
  PID:6380
- C:\Windows\System\hHULHKR.exe
  C:\Windows\System\hHULHKR.exe
  2⤵
  PID:6416
- C:\Windows\System\KLPpSRy.exe
  C:\Windows\System\KLPpSRy.exe
  2⤵
  PID:6432
- C:\Windows\System\KsmSVGC.exe
  C:\Windows\System\KsmSVGC.exe
  2⤵
  PID:6448
- C:\Windows\System\AykDQmC.exe
  C:\Windows\System\AykDQmC.exe
  2⤵
  PID:6464
- C:\Windows\System\BohpWjK.exe
  C:\Windows\System\BohpWjK.exe
  2⤵
  PID:6480
- C:\Windows\System\udFzlRg.exe
  C:\Windows\System\udFzlRg.exe
  2⤵
  PID:6496
- C:\Windows\System\WMklxAg.exe
  C:\Windows\System\WMklxAg.exe
  2⤵
  PID:6512
- C:\Windows\System\SWLhKmH.exe
  C:\Windows\System\SWLhKmH.exe
  2⤵
  PID:6528
- C:\Windows\System\PFHAGbz.exe
  C:\Windows\System\PFHAGbz.exe
  2⤵
  PID:6544
- C:\Windows\System\JEVBBlq.exe
  C:\Windows\System\JEVBBlq.exe
  2⤵
  PID:6560
- C:\Windows\System\OkdDzHb.exe
  C:\Windows\System\OkdDzHb.exe
  2⤵
  PID:6576
- C:\Windows\System\rkqoQdc.exe
  C:\Windows\System\rkqoQdc.exe
  2⤵
  PID:6592
- C:\Windows\System\kKyRpnX.exe
  C:\Windows\System\kKyRpnX.exe
  2⤵
  PID:6608
- C:\Windows\System\DURBcXh.exe
  C:\Windows\System\DURBcXh.exe
  2⤵
  PID:6624
- C:\Windows\System\sXKyWFP.exe
  C:\Windows\System\sXKyWFP.exe
  2⤵
  PID:6640
- C:\Windows\System\MCFUIke.exe
  C:\Windows\System\MCFUIke.exe
  2⤵
  PID:6656
- C:\Windows\System\VbAveXH.exe
  C:\Windows\System\VbAveXH.exe
  2⤵
  PID:6672
- C:\Windows\System\CpCqTOJ.exe
  C:\Windows\System\CpCqTOJ.exe
  2⤵
  PID:6688
- C:\Windows\System\RXXeDAV.exe
  C:\Windows\System\RXXeDAV.exe
  2⤵
  PID:6704
- C:\Windows\System\oaYIuAF.exe
  C:\Windows\System\oaYIuAF.exe
  2⤵
  PID:6720
- C:\Windows\System\doAAfNB.exe
  C:\Windows\System\doAAfNB.exe
  2⤵
  PID:6736
- C:\Windows\System\ddNvHXj.exe
  C:\Windows\System\ddNvHXj.exe
  2⤵
  PID:6752
- C:\Windows\System\iFfqbaW.exe
  C:\Windows\System\iFfqbaW.exe
  2⤵
  PID:6768
- C:\Windows\System\ygFaomV.exe
  C:\Windows\System\ygFaomV.exe
  2⤵
  PID:6788
- C:\Windows\System\aXqGiHX.exe
  C:\Windows\System\aXqGiHX.exe
  2⤵
  PID:6804
- C:\Windows\System\TXoEExo.exe
  C:\Windows\System\TXoEExo.exe
  2⤵
  PID:6820
- C:\Windows\System\IjhTrHw.exe
  C:\Windows\System\IjhTrHw.exe
  2⤵
  PID:6836
- C:\Windows\System\tWbRhrg.exe
  C:\Windows\System\tWbRhrg.exe
  2⤵
  PID:6852
- C:\Windows\System\wxeRVXA.exe
  C:\Windows\System\wxeRVXA.exe
  2⤵
  PID:6868
- C:\Windows\System\psTHjge.exe
  C:\Windows\System\psTHjge.exe
  2⤵
  PID:6884
- C:\Windows\System\kiwOTKu.exe
  C:\Windows\System\kiwOTKu.exe
  2⤵
  PID:6900
- C:\Windows\System\EKtfZXJ.exe
  C:\Windows\System\EKtfZXJ.exe
  2⤵
  PID:6916
- C:\Windows\System\ouDdmhZ.exe
  C:\Windows\System\ouDdmhZ.exe
  2⤵
  PID:6936
- C:\Windows\System\kSWfBPl.exe
  C:\Windows\System\kSWfBPl.exe
  2⤵
  PID:6952
- C:\Windows\System\fNnvINn.exe
  C:\Windows\System\fNnvINn.exe
  2⤵
  PID:6968
- C:\Windows\System\IljRiyI.exe
  C:\Windows\System\IljRiyI.exe
  2⤵
  PID:6988
- C:\Windows\System\yncWBbS.exe
  C:\Windows\System\yncWBbS.exe
  2⤵
  PID:7004
- C:\Windows\System\tUJVXUI.exe
  C:\Windows\System\tUJVXUI.exe
  2⤵
  PID:7116
- C:\Windows\System\DfufZVS.exe
  C:\Windows\System\DfufZVS.exe
  2⤵
  PID:6456
- C:\Windows\System\WGKmvtp.exe
  C:\Windows\System\WGKmvtp.exe
  2⤵
  PID:6404
- C:\Windows\System\VcaWQnf.exe
  C:\Windows\System\VcaWQnf.exe
  2⤵
  PID:3700
- C:\Windows\System\dMjAoEu.exe
  C:\Windows\System\dMjAoEu.exe
  2⤵
  PID:2208
- C:\Windows\System\COSjVYQ.exe
  C:\Windows\System\COSjVYQ.exe
  2⤵
  PID:6536
- C:\Windows\System\yycmbsc.exe
  C:\Windows\System\yycmbsc.exe
  2⤵
  PID:6504
- C:\Windows\System\BuAnFLg.exe
  C:\Windows\System\BuAnFLg.exe
  2⤵
  PID:6716
- C:\Windows\System\OvTWKHY.exe
  C:\Windows\System\OvTWKHY.exe
  2⤵
  PID:6764
- C:\Windows\System\suRKDLl.exe
  C:\Windows\System\suRKDLl.exe
  2⤵
  PID:6784
- C:\Windows\System\wRSWsrQ.exe
  C:\Windows\System\wRSWsrQ.exe
  2⤵
  PID:6812
- C:\Windows\System\kmgxhfZ.exe
  C:\Windows\System\kmgxhfZ.exe
  2⤵
  PID:6928
- C:\Windows\System\Lyrngyz.exe
  C:\Windows\System\Lyrngyz.exe
  2⤵
  PID:6960
- C:\Windows\System\SGkTEoo.exe
  C:\Windows\System\SGkTEoo.exe
  2⤵
  PID:7000
- C:\Windows\System\GZwJecW.exe
  C:\Windows\System\GZwJecW.exe
  2⤵
  PID:7056
- C:\Windows\System\hNuJNZF.exe
  C:\Windows\System\hNuJNZF.exe
  2⤵
  PID:1560
- C:\Windows\System\MUndEUq.exe
  C:\Windows\System\MUndEUq.exe
  2⤵
  PID:7156
- C:\Windows\System\WiONZsv.exe
  C:\Windows\System\WiONZsv.exe
  2⤵
  PID:5896
- C:\Windows\System\ODMePul.exe
  C:\Windows\System\ODMePul.exe
  2⤵
  PID:6180
- C:\Windows\System\DjmpqGR.exe
  C:\Windows\System\DjmpqGR.exe
  2⤵
  PID:6340
- C:\Windows\System\hALPdDH.exe
  C:\Windows\System\hALPdDH.exe
  2⤵
  PID:6424
- C:\Windows\System\GRMztWZ.exe
  C:\Windows\System\GRMztWZ.exe
  2⤵
  PID:6196
- C:\Windows\System\NptnPdl.exe
  C:\Windows\System\NptnPdl.exe
  2⤵
  PID:2740
- C:\Windows\System\hqIDiKf.exe
  C:\Windows\System\hqIDiKf.exe
  2⤵
  PID:6264
- C:\Windows\System\CqDPtRt.exe
  C:\Windows\System\CqDPtRt.exe
  2⤵
  PID:6356
- C:\Windows\System\WHZlFay.exe
  C:\Windows\System\WHZlFay.exe
  2⤵
  PID:6392
- C:\Windows\System\rDDDwVl.exe
  C:\Windows\System\rDDDwVl.exe
  2⤵
  PID:6400
- C:\Windows\System\HrLvwmg.exe
  C:\Windows\System\HrLvwmg.exe
  2⤵
  PID:6520
- C:\Windows\System\nWUBAEe.exe
  C:\Windows\System\nWUBAEe.exe
  2⤵
  PID:6848
- C:\Windows\System\XTaBtvl.exe
  C:\Windows\System\XTaBtvl.exe
  2⤵
  PID:6828
- C:\Windows\System\tWdqpik.exe
  C:\Windows\System\tWdqpik.exe
  2⤵
  PID:6976
- C:\Windows\System\pwDzhaV.exe
  C:\Windows\System\pwDzhaV.exe
  2⤵
  PID:7048
- C:\Windows\System\fmbLOOV.exe
  C:\Windows\System\fmbLOOV.exe
  2⤵
  PID:7140
- C:\Windows\System\tTsZRlW.exe
  C:\Windows\System\tTsZRlW.exe
  2⤵
  PID:7160
- C:\Windows\System\CFWbyiE.exe
  C:\Windows\System\CFWbyiE.exe
  2⤵
  PID:6712
- C:\Windows\System\WRmOeFa.exe
  C:\Windows\System\WRmOeFa.exe
  2⤵
  PID:7124
- C:\Windows\System\ddmxRZP.exe
  C:\Windows\System\ddmxRZP.exe
  2⤵
  PID:7104
- C:\Windows\System\TTUFFSK.exe
  C:\Windows\System\TTUFFSK.exe
  2⤵
  PID:7164
- C:\Windows\System\Ajbtvyb.exe
  C:\Windows\System\Ajbtvyb.exe
  2⤵
  PID:1608
- C:\Windows\System\KXtMFEn.exe
  C:\Windows\System\KXtMFEn.exe
  2⤵
  PID:3808
- C:\Windows\System\APCNFoy.exe
  C:\Windows\System\APCNFoy.exe
  2⤵
  PID:2612
- C:\Windows\System\pZsCQAp.exe
  C:\Windows\System\pZsCQAp.exe
  2⤵
  PID:6648
- C:\Windows\System\wECxSuy.exe
  C:\Windows\System\wECxSuy.exe
  2⤵
  PID:6632
- C:\Windows\System\ZFYVwdd.exe
  C:\Windows\System\ZFYVwdd.exe
  2⤵
  PID:6668
- C:\Windows\System\XMJFTeh.exe
  C:\Windows\System\XMJFTeh.exe
  2⤵
  PID:6748
- C:\Windows\System\HBhOxpR.exe
  C:\Windows\System\HBhOxpR.exe
  2⤵
  PID:6728
- C:\Windows\System\ViGfAkD.exe
  C:\Windows\System\ViGfAkD.exe
  2⤵
  PID:6760
- C:\Windows\System\tWdtxqq.exe
  C:\Windows\System\tWdtxqq.exe
  2⤵
  PID:6948
- C:\Windows\System\BnAkNOH.exe
  C:\Windows\System\BnAkNOH.exe
  2⤵
  PID:6260
- C:\Windows\System\QDiycGn.exe
  C:\Windows\System\QDiycGn.exe
  2⤵
  PID:7184
- C:\Windows\System\XzmYnDz.exe
  C:\Windows\System\XzmYnDz.exe
  2⤵
  PID:7200
- C:\Windows\System\BaAIedA.exe
  C:\Windows\System\BaAIedA.exe
  2⤵
  PID:7216
- C:\Windows\System\KgSdOcg.exe
  C:\Windows\System\KgSdOcg.exe
  2⤵
  PID:7232
- C:\Windows\System\GLXWhGh.exe
  C:\Windows\System\GLXWhGh.exe
  2⤵
  PID:7248
- C:\Windows\System\amSQyRQ.exe
  C:\Windows\System\amSQyRQ.exe
  2⤵
  PID:7264
- C:\Windows\System\iqTWLyZ.exe
  C:\Windows\System\iqTWLyZ.exe
  2⤵
  PID:7280
- C:\Windows\System\DjjIzak.exe
  C:\Windows\System\DjjIzak.exe
  2⤵
  PID:7304
- C:\Windows\System\EAbqdAY.exe
  C:\Windows\System\EAbqdAY.exe
  2⤵
  PID:7320
- C:\Windows\System\xxVNPOn.exe
  C:\Windows\System\xxVNPOn.exe
  2⤵
  PID:7336
- C:\Windows\System\hKhEffv.exe
  C:\Windows\System\hKhEffv.exe
  2⤵
  PID:7356
- C:\Windows\System\XYcWKyI.exe
  C:\Windows\System\XYcWKyI.exe
  2⤵
  PID:7372
- C:\Windows\System\aoKZjny.exe
  C:\Windows\System\aoKZjny.exe
  2⤵
  PID:7388
- C:\Windows\System\xDALLlL.exe
  C:\Windows\System\xDALLlL.exe
  2⤵
  PID:7404
- C:\Windows\System\VBXYxMz.exe
  C:\Windows\System\VBXYxMz.exe
  2⤵
  PID:7420
- C:\Windows\System\tFyPgil.exe
  C:\Windows\System\tFyPgil.exe
  2⤵
  PID:7436
- C:\Windows\System\VtsdgPc.exe
  C:\Windows\System\VtsdgPc.exe
  2⤵
  PID:7452
- C:\Windows\System\ilLjbjz.exe
  C:\Windows\System\ilLjbjz.exe
  2⤵
  PID:7468
- C:\Windows\System\QaOACYp.exe
  C:\Windows\System\QaOACYp.exe
  2⤵
  PID:7484
- C:\Windows\System\tjzzBKw.exe
  C:\Windows\System\tjzzBKw.exe
  2⤵
  PID:7500
- C:\Windows\System\kzhWtPR.exe
  C:\Windows\System\kzhWtPR.exe
  2⤵
  PID:7516
- C:\Windows\System\sdfNwNj.exe
  C:\Windows\System\sdfNwNj.exe
  2⤵
  PID:7552
- C:\Windows\System\kqdnYEs.exe
  C:\Windows\System\kqdnYEs.exe
  2⤵
  PID:7580
- C:\Windows\System\gXVyYTn.exe
  C:\Windows\System\gXVyYTn.exe
  2⤵
  PID:7600
- C:\Windows\System\tKQOhPc.exe
  C:\Windows\System\tKQOhPc.exe
  2⤵
  PID:7624
- C:\Windows\System\wGcEUZu.exe
  C:\Windows\System\wGcEUZu.exe
  2⤵
  PID:7648
- C:\Windows\System\vocaePW.exe
  C:\Windows\System\vocaePW.exe
  2⤵
  PID:7672
- C:\Windows\System\FtovLGu.exe
  C:\Windows\System\FtovLGu.exe
  2⤵
  PID:7692
- C:\Windows\System\ysWKKmc.exe
  C:\Windows\System\ysWKKmc.exe
  2⤵
  PID:7708
- C:\Windows\System\STygUiF.exe
  C:\Windows\System\STygUiF.exe
  2⤵
  PID:7724
- C:\Windows\System\FADSTVT.exe
  C:\Windows\System\FADSTVT.exe
  2⤵
  PID:7740
- C:\Windows\System\XqpRmsO.exe
  C:\Windows\System\XqpRmsO.exe
  2⤵
  PID:7756
- C:\Windows\System\dXkzlQb.exe
  C:\Windows\System\dXkzlQb.exe
  2⤵
  PID:7772
- C:\Windows\System\xSoMWkY.exe
  C:\Windows\System\xSoMWkY.exe
  2⤵
  PID:7788
- C:\Windows\System\AUJUkIZ.exe
  C:\Windows\System\AUJUkIZ.exe
  2⤵
  PID:7804
- C:\Windows\System\gKFDERc.exe
  C:\Windows\System\gKFDERc.exe
  2⤵
  PID:7820
- C:\Windows\System\xmrARtU.exe
  C:\Windows\System\xmrARtU.exe
  2⤵
  PID:7836
- C:\Windows\System\zZXYnws.exe
  C:\Windows\System\zZXYnws.exe
  2⤵
  PID:7852
- C:\Windows\System\pCjGbBH.exe
  C:\Windows\System\pCjGbBH.exe
  2⤵
  PID:7868
- C:\Windows\System\BDlJTmd.exe
  C:\Windows\System\BDlJTmd.exe
  2⤵
  PID:7884
- C:\Windows\System\OGkRErR.exe
  C:\Windows\System\OGkRErR.exe
  2⤵
  PID:7900
- C:\Windows\System\BMUBrkB.exe
  C:\Windows\System\BMUBrkB.exe
  2⤵
  PID:7916
- C:\Windows\System\mwpsTGz.exe
  C:\Windows\System\mwpsTGz.exe
  2⤵
  PID:7932
- C:\Windows\System\jnMpgTr.exe
  C:\Windows\System\jnMpgTr.exe
  2⤵
  PID:7948
- C:\Windows\System\JrItHeA.exe
  C:\Windows\System\JrItHeA.exe
  2⤵
  PID:7964
- C:\Windows\System\Wyekmrt.exe
  C:\Windows\System\Wyekmrt.exe
  2⤵
  PID:7980
- C:\Windows\System\zUyxIdj.exe
  C:\Windows\System\zUyxIdj.exe
  2⤵
  PID:7996
- C:\Windows\System\iPDQfZG.exe
  C:\Windows\System\iPDQfZG.exe
  2⤵
  PID:8012
- C:\Windows\System\AdroDGv.exe
  C:\Windows\System\AdroDGv.exe
  2⤵
  PID:8028
- C:\Windows\System\YMOTyWp.exe
  C:\Windows\System\YMOTyWp.exe
  2⤵
  PID:8044
- C:\Windows\System\tMfNaJq.exe
  C:\Windows\System\tMfNaJq.exe
  2⤵
  PID:8064
- C:\Windows\System\UlLsnde.exe
  C:\Windows\System\UlLsnde.exe
  2⤵
  PID:8080
- C:\Windows\System\JzZkHnq.exe
  C:\Windows\System\JzZkHnq.exe
  2⤵
  PID:8096
- C:\Windows\System\DZpqrcV.exe
  C:\Windows\System\DZpqrcV.exe
  2⤵
  PID:8112
- C:\Windows\System\XKgCHia.exe
  C:\Windows\System\XKgCHia.exe
  2⤵
  PID:8128
- C:\Windows\System\uVduAMn.exe
  C:\Windows\System\uVduAMn.exe
  2⤵
  PID:8144
- C:\Windows\System\WpTRyya.exe
  C:\Windows\System\WpTRyya.exe
  2⤵
  PID:8160
- C:\Windows\System\FzIPgbz.exe
  C:\Windows\System\FzIPgbz.exe
  2⤵
  PID:8176
- C:\Windows\System\PHChgSW.exe
  C:\Windows\System\PHChgSW.exe
  2⤵
  PID:6276
- C:\Windows\System\nNrTdef.exe
  C:\Windows\System\nNrTdef.exe
  2⤵
  PID:7148
- C:\Windows\System\uzCPCrt.exe
  C:\Windows\System\uzCPCrt.exe
  2⤵
  PID:6908
- C:\Windows\System\YNweHyH.exe
  C:\Windows\System\YNweHyH.exe
  2⤵
  PID:5928
- C:\Windows\System\kLzNUgV.exe
  C:\Windows\System\kLzNUgV.exe
  2⤵
  PID:6652
- C:\Windows\System\qRBIWPX.exe
  C:\Windows\System\qRBIWPX.exe
  2⤵
  PID:6860
- C:\Windows\System\draNyGq.exe
  C:\Windows\System\draNyGq.exe
  2⤵
  PID:7192
- C:\Windows\System\RJNpdWi.exe
  C:\Windows\System\RJNpdWi.exe
  2⤵
  PID:7012
- C:\Windows\System\GCNtZOe.exe
  C:\Windows\System\GCNtZOe.exe
  2⤵
  PID:2736
- C:\Windows\System\MLjxxpj.exe
  C:\Windows\System\MLjxxpj.exe
  2⤵
  PID:2824
- C:\Windows\System\eXgvaFm.exe
  C:\Windows\System\eXgvaFm.exe
  2⤵
  PID:7040
- C:\Windows\System\ZVKzIEK.exe
  C:\Windows\System\ZVKzIEK.exe
  2⤵
  PID:7288
- C:\Windows\System\GWUCTJp.exe
  C:\Windows\System\GWUCTJp.exe
  2⤵
  PID:7332
- C:\Windows\System\TyNTWOf.exe
  C:\Windows\System\TyNTWOf.exe
  2⤵
  PID:7400
- C:\Windows\System\DlrmBPg.exe
  C:\Windows\System\DlrmBPg.exe
  2⤵
  PID:7428
- C:\Windows\System\LgHcQLm.exe
  C:\Windows\System\LgHcQLm.exe
  2⤵
  PID:6492
- C:\Windows\System\zIKwaXW.exe
  C:\Windows\System\zIKwaXW.exe
  2⤵
  PID:6372
- C:\Windows\System\hcrPsSs.exe
  C:\Windows\System\hcrPsSs.exe
  2⤵
  PID:6980
- C:\Windows\System\jcnxZkF.exe
  C:\Windows\System\jcnxZkF.exe
  2⤵
  PID:6440
- C:\Windows\System\pEJxVsV.exe
  C:\Windows\System\pEJxVsV.exe
  2⤵
  PID:6776
- C:\Windows\System\jhaxRyO.exe
  C:\Windows\System\jhaxRyO.exe
  2⤵
  PID:7208
- C:\Windows\System\OTRXYTG.exe
  C:\Windows\System\OTRXYTG.exe
  2⤵
  PID:7240
- C:\Windows\System\NCuXVof.exe
  C:\Windows\System\NCuXVof.exe
  2⤵
  PID:7272
- C:\Windows\System\SVXeafU.exe
  C:\Windows\System\SVXeafU.exe
  2⤵
  PID:7276
- C:\Windows\System\sgJkPwK.exe
  C:\Windows\System\sgJkPwK.exe
  2⤵
  PID:7348
- C:\Windows\System\IAsWgkt.exe
  C:\Windows\System\IAsWgkt.exe
  2⤵
  PID:7448
- C:\Windows\System\bRLjcYn.exe
  C:\Windows\System\bRLjcYn.exe
  2⤵
  PID:7532
- C:\Windows\System\RSbwHjU.exe
  C:\Windows\System\RSbwHjU.exe
  2⤵
  PID:7548
- C:\Windows\System\nwOHgCa.exe
  C:\Windows\System\nwOHgCa.exe
  2⤵
  PID:7564
- C:\Windows\System\jptZJuq.exe
  C:\Windows\System\jptZJuq.exe
  2⤵
  PID:7592
- C:\Windows\System\VIWdIMa.exe
  C:\Windows\System\VIWdIMa.exe
  2⤵
  PID:7636
- C:\Windows\System\aDTSLFR.exe
  C:\Windows\System\aDTSLFR.exe
  2⤵
  PID:7620
- C:\Windows\System\fahpCRE.exe
  C:\Windows\System\fahpCRE.exe
  2⤵
  PID:7656
- C:\Windows\System\zmcTYjY.exe
  C:\Windows\System\zmcTYjY.exe
  2⤵
  PID:7688
- C:\Windows\System\jPZhraN.exe
  C:\Windows\System\jPZhraN.exe
  2⤵
  PID:7720
- C:\Windows\System\pQZWXWi.exe
  C:\Windows\System\pQZWXWi.exe
  2⤵
  PID:7768
- C:\Windows\System\zDuazBs.exe
  C:\Windows\System\zDuazBs.exe
  2⤵
  PID:7860
- C:\Windows\System\rpIXDTm.exe
  C:\Windows\System\rpIXDTm.exe
  2⤵
  PID:7896
- C:\Windows\System\nLRwRVd.exe
  C:\Windows\System\nLRwRVd.exe
  2⤵
  PID:7960
- C:\Windows\System\CZqHIIq.exe
  C:\Windows\System\CZqHIIq.exe
  2⤵
  PID:8024
- C:\Windows\System\hfjihoU.exe
  C:\Windows\System\hfjihoU.exe
  2⤵
  PID:7876
- C:\Windows\System\WuOfPsY.exe
  C:\Windows\System\WuOfPsY.exe
  2⤵
  PID:7748
- C:\Windows\System\tVxZoPw.exe
  C:\Windows\System\tVxZoPw.exe
  2⤵
  PID:7784
- C:\Windows\System\MrAxsne.exe
  C:\Windows\System\MrAxsne.exe
  2⤵
  PID:7944
- C:\Windows\System\faNwFpt.exe
  C:\Windows\System\faNwFpt.exe
  2⤵
  PID:8040
- C:\Windows\System\hQExcBq.exe
  C:\Windows\System\hQExcBq.exe
  2⤵
  PID:8092
- C:\Windows\System\pIDtpoG.exe
  C:\Windows\System\pIDtpoG.exe
  2⤵
  PID:8152
- C:\Windows\System\chbWCoy.exe
  C:\Windows\System\chbWCoy.exe
  2⤵
  PID:8076
- C:\Windows\System\KtZLqjm.exe
  C:\Windows\System\KtZLqjm.exe
  2⤵
  PID:8104
- C:\Windows\System\neFRknj.exe
  C:\Windows\System\neFRknj.exe
  2⤵
  PID:8140
- C:\Windows\System\VbcwdwD.exe
  C:\Windows\System\VbcwdwD.exe
  2⤵
  PID:6216
- C:\Windows\System\aAsRpZj.exe
  C:\Windows\System\aAsRpZj.exe
  2⤵
  PID:2360
- C:\Windows\System\ZheWRaX.exe
  C:\Windows\System\ZheWRaX.exe
  2⤵
  PID:6328
- C:\Windows\System\CdhGvbb.exe
  C:\Windows\System\CdhGvbb.exe
  2⤵
  PID:6096
- C:\Windows\System\yRXkSoh.exe
  C:\Windows\System\yRXkSoh.exe
  2⤵
  PID:7368
- C:\Windows\System\HhZBAkj.exe
  C:\Windows\System\HhZBAkj.exe
  2⤵
  PID:6388
- C:\Windows\System\atCiMIp.exe
  C:\Windows\System\atCiMIp.exe
  2⤵
  PID:7460
- C:\Windows\System\rPcnaVQ.exe
  C:\Windows\System\rPcnaVQ.exe
  2⤵
  PID:3600
- C:\Windows\System\IXMuggR.exe
  C:\Windows\System\IXMuggR.exe
  2⤵
  PID:7212
- C:\Windows\System\iuKfwTN.exe
  C:\Windows\System\iuKfwTN.exe
  2⤵
  PID:6324
- C:\Windows\System\zwngBRH.exe
  C:\Windows\System\zwngBRH.exe
  2⤵
  PID:7544
- C:\Windows\System\VRxFyWs.exe
  C:\Windows\System\VRxFyWs.exe
  2⤵
  PID:7344
- C:\Windows\System\dlZQGug.exe
  C:\Windows\System\dlZQGug.exe
  2⤵
  PID:7588
- C:\Windows\System\jTZOdKc.exe
  C:\Windows\System\jTZOdKc.exe
  2⤵
  PID:7644
- C:\Windows\System\FJXTEZw.exe
  C:\Windows\System\FJXTEZw.exe
  2⤵
  PID:7832
- C:\Windows\System\qmSwUzQ.exe
  C:\Windows\System\qmSwUzQ.exe
  2⤵
  PID:7844
- C:\Windows\System\hDsqndy.exe
  C:\Windows\System\hDsqndy.exe
  2⤵
  PID:8004
- C:\Windows\System\TXHNybl.exe
  C:\Windows\System\TXHNybl.exe
  2⤵
  PID:6932
- C:\Windows\System\mfWOUeu.exe
  C:\Windows\System\mfWOUeu.exe
  2⤵
  PID:6244
- C:\Windows\System\ccMJLrv.exe
  C:\Windows\System\ccMJLrv.exe
  2⤵
  PID:7680
- C:\Windows\System\timMtPL.exe
  C:\Windows\System\timMtPL.exe
  2⤵
  PID:7024
- C:\Windows\System\MJCXSvU.exe
  C:\Windows\System\MJCXSvU.exe
  2⤵
  PID:8188
- C:\Windows\System\saETrOg.exe
  C:\Windows\System\saETrOg.exe
  2⤵
  PID:7992
- C:\Windows\System\JplxeOo.exe
  C:\Windows\System\JplxeOo.exe
  2⤵
  PID:7912
- C:\Windows\System\KLWaXSU.exe
  C:\Windows\System\KLWaXSU.exe
  2⤵
  PID:7300
- C:\Windows\System\gyNqXIb.exe
  C:\Windows\System\gyNqXIb.exe
  2⤵
  PID:6552
- C:\Windows\System\OVQKMxK.exe
  C:\Windows\System\OVQKMxK.exe
  2⤵
  PID:7328
- C:\Windows\System\PRNfARG.exe
  C:\Windows\System\PRNfARG.exe
  2⤵
  PID:2232
- C:\Windows\System\uQySOKi.exe
  C:\Windows\System\uQySOKi.exe
  2⤵
  PID:7540
- C:\Windows\System\ewnhZvV.exe
  C:\Windows\System\ewnhZvV.exe
  2⤵
  PID:7716
- C:\Windows\System\mVpKAuF.exe
  C:\Windows\System\mVpKAuF.exe
  2⤵
  PID:7660
- C:\Windows\System\VrOFzmf.exe
  C:\Windows\System\VrOFzmf.exe
  2⤵
  PID:7020
- C:\Windows\System\VcaiyvF.exe
  C:\Windows\System\VcaiyvF.exe
  2⤵
  PID:7956
- C:\Windows\System\craWhgc.exe
  C:\Windows\System\craWhgc.exe
  2⤵
  PID:7668
- C:\Windows\System\IUJzGQq.exe
  C:\Windows\System\IUJzGQq.exe
  2⤵
  PID:8124
- C:\Windows\System\hhnNPOH.exe
  C:\Windows\System\hhnNPOH.exe
  2⤵
  PID:6280
- C:\Windows\System\BacsGaZ.exe
  C:\Windows\System\BacsGaZ.exe
  2⤵
  PID:8172
- C:\Windows\System\UKUbMjB.exe
  C:\Windows\System\UKUbMjB.exe
  2⤵
  PID:7260
- C:\Windows\System\yDFtfaQ.exe
  C:\Windows\System\yDFtfaQ.exe
  2⤵
  PID:7780
- C:\Windows\System\efxhHnD.exe
  C:\Windows\System\efxhHnD.exe
  2⤵
  PID:7764
- C:\Windows\System\vYgByDU.exe
  C:\Windows\System\vYgByDU.exe
  2⤵
  PID:6168
- C:\Windows\System\yOuziyH.exe
  C:\Windows\System\yOuziyH.exe
  2⤵
  PID:7576
- C:\Windows\System\IdTXGdy.exe
  C:\Windows\System\IdTXGdy.exe
  2⤵
  PID:8052
- C:\Windows\System\mbHclnV.exe
  C:\Windows\System\mbHclnV.exe
  2⤵
  PID:3256
- C:\Windows\System\gIRQket.exe
  C:\Windows\System\gIRQket.exe
  2⤵
  PID:7244
- C:\Windows\System\QFRHNUw.exe
  C:\Windows\System\QFRHNUw.exe
  2⤵
  PID:8208
- C:\Windows\System\xJApxKS.exe
  C:\Windows\System\xJApxKS.exe
  2⤵
  PID:8224
- C:\Windows\System\LdNKFwv.exe
  C:\Windows\System\LdNKFwv.exe
  2⤵
  PID:8240
- C:\Windows\System\tOrPfkN.exe
  C:\Windows\System\tOrPfkN.exe
  2⤵
  PID:8256
- C:\Windows\System\UrDNECZ.exe
  C:\Windows\System\UrDNECZ.exe
  2⤵
  PID:8272
- C:\Windows\System\tnkKPNC.exe
  C:\Windows\System\tnkKPNC.exe
  2⤵
  PID:8288
- C:\Windows\System\bUKLLAi.exe
  C:\Windows\System\bUKLLAi.exe
  2⤵
  PID:8304
- C:\Windows\System\ltvlvah.exe
  C:\Windows\System\ltvlvah.exe
  2⤵
  PID:8320
- C:\Windows\System\sFewIjF.exe
  C:\Windows\System\sFewIjF.exe
  2⤵
  PID:8336
- C:\Windows\System\YZHdwLE.exe
  C:\Windows\System\YZHdwLE.exe
  2⤵
  PID:8352
- C:\Windows\System\KGsvMbS.exe
  C:\Windows\System\KGsvMbS.exe
  2⤵
  PID:8368
- C:\Windows\System\CksNarv.exe
  C:\Windows\System\CksNarv.exe
  2⤵
  PID:8384
- C:\Windows\System\lLGmKvR.exe
  C:\Windows\System\lLGmKvR.exe
  2⤵
  PID:8400
- C:\Windows\System\pYMBRFa.exe
  C:\Windows\System\pYMBRFa.exe
  2⤵
  PID:8416
- C:\Windows\System\OehKTor.exe
  C:\Windows\System\OehKTor.exe
  2⤵
  PID:8432
- C:\Windows\System\rMfxiie.exe
  C:\Windows\System\rMfxiie.exe
  2⤵
  PID:8448
- C:\Windows\System\XHELYIj.exe
  C:\Windows\System\XHELYIj.exe
  2⤵
  PID:8464
- C:\Windows\System\gYuUAQV.exe
  C:\Windows\System\gYuUAQV.exe
  2⤵
  PID:8480
- C:\Windows\System\xJBkWQJ.exe
  C:\Windows\System\xJBkWQJ.exe
  2⤵
  PID:8496
- C:\Windows\System\hoeTVsH.exe
  C:\Windows\System\hoeTVsH.exe
  2⤵
  PID:8512
- C:\Windows\System\RdtjNrQ.exe
  C:\Windows\System\RdtjNrQ.exe
  2⤵
  PID:8528
- C:\Windows\System\leNjHWZ.exe
  C:\Windows\System\leNjHWZ.exe
  2⤵
  PID:8544
- C:\Windows\System\HPqOess.exe
  C:\Windows\System\HPqOess.exe
  2⤵
  PID:8560
- C:\Windows\System\sEPaifm.exe
  C:\Windows\System\sEPaifm.exe
  2⤵
  PID:8576
- C:\Windows\System\UqmIuEA.exe
  C:\Windows\System\UqmIuEA.exe
  2⤵
  PID:8592
- C:\Windows\System\oqYsaxR.exe
  C:\Windows\System\oqYsaxR.exe
  2⤵
  PID:8608
- C:\Windows\System\QQdVefv.exe
  C:\Windows\System\QQdVefv.exe
  2⤵
  PID:8624
- C:\Windows\System\ZsZIDXB.exe
  C:\Windows\System\ZsZIDXB.exe
  2⤵
  PID:8640
- C:\Windows\System\UxcQWSo.exe
  C:\Windows\System\UxcQWSo.exe
  2⤵
  PID:8656
- C:\Windows\System\XhiBtoW.exe
  C:\Windows\System\XhiBtoW.exe
  2⤵
  PID:8672
- C:\Windows\System\qBkOsXB.exe
  C:\Windows\System\qBkOsXB.exe
  2⤵
  PID:8688
- C:\Windows\System\ALcLrlN.exe
  C:\Windows\System\ALcLrlN.exe
  2⤵
  PID:8704
- C:\Windows\System\GvcYEBF.exe
  C:\Windows\System\GvcYEBF.exe
  2⤵
  PID:8720
- C:\Windows\System\VdtKrDO.exe
  C:\Windows\System\VdtKrDO.exe
  2⤵
  PID:8736
- C:\Windows\System\cJNpgdy.exe
  C:\Windows\System\cJNpgdy.exe
  2⤵
  PID:8752
- C:\Windows\System\GLNSONW.exe
  C:\Windows\System\GLNSONW.exe
  2⤵
  PID:8768
- C:\Windows\System\ULVTfup.exe
  C:\Windows\System\ULVTfup.exe
  2⤵
  PID:8784
- C:\Windows\System\UJYJZZi.exe
  C:\Windows\System\UJYJZZi.exe
  2⤵
  PID:8800
- C:\Windows\System\EgRDblg.exe
  C:\Windows\System\EgRDblg.exe
  2⤵
  PID:8816
- C:\Windows\System\IryvWhP.exe
  C:\Windows\System\IryvWhP.exe
  2⤵
  PID:8832
- C:\Windows\System\xplPDIf.exe
  C:\Windows\System\xplPDIf.exe
  2⤵
  PID:8848
- C:\Windows\System\fgRbhYZ.exe
  C:\Windows\System\fgRbhYZ.exe
  2⤵
  PID:8864
- C:\Windows\System\JFrsTPH.exe
  C:\Windows\System\JFrsTPH.exe
  2⤵
  PID:8880
- C:\Windows\System\oBbmWlO.exe
  C:\Windows\System\oBbmWlO.exe
  2⤵
  PID:8896
- C:\Windows\System\KqxsIQy.exe
  C:\Windows\System\KqxsIQy.exe
  2⤵
  PID:8912
- C:\Windows\System\uSxFmph.exe
  C:\Windows\System\uSxFmph.exe
  2⤵
  PID:8928
- C:\Windows\System\JCYFBKR.exe
  C:\Windows\System\JCYFBKR.exe
  2⤵
  PID:8944
- C:\Windows\System\HNiGsKe.exe
  C:\Windows\System\HNiGsKe.exe
  2⤵
  PID:8960
- C:\Windows\System\vAasYmY.exe
  C:\Windows\System\vAasYmY.exe
  2⤵
  PID:8976
- C:\Windows\System\qguaqME.exe
  C:\Windows\System\qguaqME.exe
  2⤵
  PID:8992
- C:\Windows\System\JwsOUzI.exe
  C:\Windows\System\JwsOUzI.exe
  2⤵
  PID:9008
- C:\Windows\System\EVEdKcg.exe
  C:\Windows\System\EVEdKcg.exe
  2⤵
  PID:9024
- C:\Windows\System\HdwDFFe.exe
  C:\Windows\System\HdwDFFe.exe
  2⤵
  PID:9040
- C:\Windows\System\AWMLxYt.exe
  C:\Windows\System\AWMLxYt.exe
  2⤵
  PID:9056
- C:\Windows\System\prOIWop.exe
  C:\Windows\System\prOIWop.exe
  2⤵
  PID:9072
- C:\Windows\System\HIZsFBF.exe
  C:\Windows\System\HIZsFBF.exe
  2⤵
  PID:9088
- C:\Windows\System\LHQNFpr.exe
  C:\Windows\System\LHQNFpr.exe
  2⤵
  PID:9104
- C:\Windows\System\YSTFyDG.exe
  C:\Windows\System\YSTFyDG.exe
  2⤵
  PID:9120
- C:\Windows\System\LFGjILL.exe
  C:\Windows\System\LFGjILL.exe
  2⤵
  PID:9136
- C:\Windows\System\wcmpbWC.exe
  C:\Windows\System\wcmpbWC.exe
  2⤵
  PID:9152
- C:\Windows\System\qcytPqc.exe
  C:\Windows\System\qcytPqc.exe
  2⤵
  PID:9168
- C:\Windows\System\RdAzQlc.exe
  C:\Windows\System\RdAzQlc.exe
  2⤵
  PID:9184
- C:\Windows\System\HtPSEMI.exe
  C:\Windows\System\HtPSEMI.exe
  2⤵
  PID:9200
- C:\Windows\System\mkHeesb.exe
  C:\Windows\System\mkHeesb.exe
  2⤵
  PID:7616
- C:\Windows\System\UclxOxq.exe
  C:\Windows\System\UclxOxq.exe
  2⤵
  PID:8200
- C:\Windows\System\jJmDEGU.exe
  C:\Windows\System\jJmDEGU.exe
  2⤵
  PID:8216
- C:\Windows\System\zIiFjOZ.exe
  C:\Windows\System\zIiFjOZ.exe
  2⤵
  PID:8248
- C:\Windows\System\gzziimB.exe
  C:\Windows\System\gzziimB.exe
  2⤵
  PID:8312
- C:\Windows\System\NkSXFrC.exe
  C:\Windows\System\NkSXFrC.exe
  2⤵
  PID:8376
- C:\Windows\System\ibaKpvL.exe
  C:\Windows\System\ibaKpvL.exe
  2⤵
  PID:8232
- C:\Windows\System\lIWpSPD.exe
  C:\Windows\System\lIWpSPD.exe
  2⤵
  PID:8396
- C:\Windows\System\tONmuEn.exe
  C:\Windows\System\tONmuEn.exe
  2⤵
  PID:8424
- C:\Windows\System\PFUTARn.exe
  C:\Windows\System\PFUTARn.exe
  2⤵
  PID:8444
- C:\Windows\System\LFVxLpg.exe
  C:\Windows\System\LFVxLpg.exe
  2⤵
  PID:8476
- C:\Windows\System\erKWiDa.exe
  C:\Windows\System\erKWiDa.exe
  2⤵
  PID:8536
- C:\Windows\System\oHqWDyP.exe
  C:\Windows\System\oHqWDyP.exe
  2⤵
  PID:8460
- C:\Windows\System\ALQWxUf.exe
  C:\Windows\System\ALQWxUf.exe
  2⤵
  PID:8524
- C:\Windows\System\VcnDpls.exe
  C:\Windows\System\VcnDpls.exe
  2⤵
  PID:8616
- C:\Windows\System\ItpxKww.exe
  C:\Windows\System\ItpxKww.exe
  2⤵
  PID:8620
- C:\Windows\System\QfzIFIn.exe
  C:\Windows\System\QfzIFIn.exe
  2⤵
  PID:8684
- C:\Windows\System\UKEfFOE.exe
  C:\Windows\System\UKEfFOE.exe
  2⤵
  PID:8632
- C:\Windows\System\KyKLtDM.exe
  C:\Windows\System\KyKLtDM.exe
  2⤵
  PID:8696
- C:\Windows\System\fiafBhp.exe
  C:\Windows\System\fiafBhp.exe
  2⤵
  PID:8760
- C:\Windows\System\DJPlJfS.exe
  C:\Windows\System\DJPlJfS.exe
  2⤵
  PID:8824
- C:\Windows\System\rgjAxyT.exe
  C:\Windows\System\rgjAxyT.exe
  2⤵
  PID:8888
- C:\Windows\System\BNIzqAB.exe
  C:\Windows\System\BNIzqAB.exe
  2⤵
  PID:8956
- C:\Windows\System\xmQEkvt.exe
  C:\Windows\System\xmQEkvt.exe
  2⤵
  PID:9004
- C:\Windows\System\YxzNLSh.exe
  C:\Windows\System\YxzNLSh.exe
  2⤵
  PID:9020
- C:\Windows\System\hDopTkq.exe
  C:\Windows\System\hDopTkq.exe
  2⤵
  PID:8776
- C:\Windows\System\fDfEXqV.exe
  C:\Windows\System\fDfEXqV.exe
  2⤵
  PID:9084
- C:\Windows\System\NHGnvhd.exe
  C:\Windows\System\NHGnvhd.exe
  2⤵
  PID:8876
- C:\Windows\System\HKZZmUB.exe
  C:\Windows\System\HKZZmUB.exe
  2⤵
  PID:9144
- C:\Windows\System\qnagZxg.exe
  C:\Windows\System\qnagZxg.exe
  2⤵
  PID:8968
- C:\Windows\System\hQprmsP.exe
  C:\Windows\System\hQprmsP.exe
  2⤵
  PID:9064
- C:\Windows\System\XilYJyq.exe
  C:\Windows\System\XilYJyq.exe
  2⤵
  PID:9068
- C:\Windows\System\GbbVhOg.exe
  C:\Windows\System\GbbVhOg.exe
  2⤵
  PID:9160
- C:\Windows\System\iwxTXGC.exe
  C:\Windows\System\iwxTXGC.exe
  2⤵
  PID:9180
- C:\Windows\System\GRiDJok.exe
  C:\Windows\System\GRiDJok.exe
  2⤵
  PID:7560
- C:\Windows\System\hScmNfz.exe
  C:\Windows\System\hScmNfz.exe
  2⤵
  PID:8184
- C:\Windows\System\UnYsBLv.exe
  C:\Windows\System\UnYsBLv.exe
  2⤵
  PID:8344
- C:\Windows\System\teopixc.exe
  C:\Windows\System\teopixc.exe
  2⤵
  PID:8328
- C:\Windows\System\ENKpnNk.exe
  C:\Windows\System\ENKpnNk.exe
  2⤵
  PID:8472
- C:\Windows\System\kUUUmCs.exe
  C:\Windows\System\kUUUmCs.exe
  2⤵
  PID:8268
- C:\Windows\System\uMymbLs.exe
  C:\Windows\System\uMymbLs.exe
  2⤵
  PID:8584
- C:\Windows\System\baPAWuK.exe
  C:\Windows\System\baPAWuK.exe
  2⤵
  PID:8600
- C:\Windows\System\bhQspVz.exe
  C:\Windows\System\bhQspVz.exe
  2⤵
  PID:8664
- C:\Windows\System\ZYWPZVQ.exe
  C:\Windows\System\ZYWPZVQ.exe
  2⤵
  PID:8728
- C:\Windows\System\rnmMJsL.exe
  C:\Windows\System\rnmMJsL.exe
  2⤵
  PID:8920
- C:\Windows\System\fZdOxBS.exe
  C:\Windows\System\fZdOxBS.exe
  2⤵
  PID:8988
- C:\Windows\System\gefplWb.exe
  C:\Windows\System\gefplWb.exe
  2⤵
  PID:8812
- C:\Windows\System\QXspSuE.exe
  C:\Windows\System\QXspSuE.exe
  2⤵
  PID:9116
- C:\Windows\System\wBWVALU.exe
  C:\Windows\System\wBWVALU.exe
  2⤵
  PID:8844
- C:\Windows\System\QpOIHIr.exe
  C:\Windows\System\QpOIHIr.exe
  2⤵
  PID:9196
- C:\Windows\System\vPRfLJE.exe
  C:\Windows\System\vPRfLJE.exe
  2⤵
  PID:8940
- C:\Windows\System\pBPXVBP.exe
  C:\Windows\System\pBPXVBP.exe
  2⤵
  PID:1544
- C:\Windows\System\tvjFmxs.exe
  C:\Windows\System\tvjFmxs.exe
  2⤵
  PID:8408
- C:\Windows\System\kuZgqSq.exe
  C:\Windows\System\kuZgqSq.exe
  2⤵
  PID:8556
- C:\Windows\System\cKofojj.exe
  C:\Windows\System\cKofojj.exe
  2⤵
  PID:8652
- C:\Windows\System\NboIjly.exe
  C:\Windows\System\NboIjly.exe
  2⤵
  PID:8744
- C:\Windows\System\BJQsQdn.exe
  C:\Windows\System\BJQsQdn.exe
  2⤵
  PID:8952
- C:\Windows\System\WxiUepd.exe
  C:\Windows\System\WxiUepd.exe
  2⤵
  PID:8860
- C:\Windows\System\DacVAas.exe
  C:\Windows\System\DacVAas.exe
  2⤵
  PID:9132
- C:\Windows\System\vqvZxrO.exe
  C:\Windows\System\vqvZxrO.exe
  2⤵
  PID:8284
- C:\Windows\System\agyaYTo.exe
  C:\Windows\System\agyaYTo.exe
  2⤵
  PID:9164
- C:\Windows\System\YqOzBCj.exe
  C:\Windows\System\YqOzBCj.exe
  2⤵
  PID:8588
- C:\Windows\System\lwRqjpE.exe
  C:\Windows\System\lwRqjpE.exe
  2⤵
  PID:8504
- C:\Windows\System\CUVdSyr.exe
  C:\Windows\System\CUVdSyr.exe
  2⤵
  PID:8936
- C:\Windows\System\gmCwAbX.exe
  C:\Windows\System\gmCwAbX.exe
  2⤵
  PID:9080
- C:\Windows\System\JrDJHZW.exe
  C:\Windows\System\JrDJHZW.exe
  2⤵
  PID:9128
- C:\Windows\System\uVhHZUv.exe
  C:\Windows\System\uVhHZUv.exe
  2⤵
  PID:9228
- C:\Windows\System\qEbobhU.exe
  C:\Windows\System\qEbobhU.exe
  2⤵
  PID:9244
- C:\Windows\System\RkNTAGi.exe
  C:\Windows\System\RkNTAGi.exe
  2⤵
  PID:9260
- C:\Windows\System\NtkQoca.exe
  C:\Windows\System\NtkQoca.exe
  2⤵
  PID:9276
- C:\Windows\System\adYdslh.exe
  C:\Windows\System\adYdslh.exe
  2⤵
  PID:9292
- C:\Windows\System\UwsMZyD.exe
  C:\Windows\System\UwsMZyD.exe
  2⤵
  PID:9308
- C:\Windows\System\xFnKiHE.exe
  C:\Windows\System\xFnKiHE.exe
  2⤵
  PID:9324
- C:\Windows\System\vqFTsZu.exe
  C:\Windows\System\vqFTsZu.exe
  2⤵
  PID:9340
- C:\Windows\System\kRJTOdg.exe
  C:\Windows\System\kRJTOdg.exe
  2⤵
  PID:9356
- C:\Windows\System\FkNpxrE.exe
  C:\Windows\System\FkNpxrE.exe
  2⤵
  PID:9372
- C:\Windows\System\wXGNQPX.exe
  C:\Windows\System\wXGNQPX.exe
  2⤵
  PID:9388
- C:\Windows\System\XtteZdn.exe
  C:\Windows\System\XtteZdn.exe
  2⤵
  PID:9404
- C:\Windows\System\NTDTLHd.exe
  C:\Windows\System\NTDTLHd.exe
  2⤵
  PID:9420
- C:\Windows\System\coidksh.exe
  C:\Windows\System\coidksh.exe
  2⤵
  PID:9436
- C:\Windows\System\wIvvdLW.exe
  C:\Windows\System\wIvvdLW.exe
  2⤵
  PID:9452
- C:\Windows\System\ShlUxPN.exe
  C:\Windows\System\ShlUxPN.exe
  2⤵
  PID:9468
- C:\Windows\System\iuFLqxb.exe
  C:\Windows\System\iuFLqxb.exe
  2⤵
  PID:9484
- C:\Windows\System\vBXtZXP.exe
  C:\Windows\System\vBXtZXP.exe
  2⤵
  PID:9500
- C:\Windows\System\CzxwstK.exe
  C:\Windows\System\CzxwstK.exe
  2⤵
  PID:9516
- C:\Windows\System\sScUbxD.exe
  C:\Windows\System\sScUbxD.exe
  2⤵
  PID:9532
- C:\Windows\System\EuQYyKf.exe
  C:\Windows\System\EuQYyKf.exe
  2⤵
  PID:9548
- C:\Windows\System\lOdURZT.exe
  C:\Windows\System\lOdURZT.exe
  2⤵
  PID:9564
- C:\Windows\System\XFzrtey.exe
  C:\Windows\System\XFzrtey.exe
  2⤵
  PID:9580
- C:\Windows\System\zpZPaGI.exe
  C:\Windows\System\zpZPaGI.exe
  2⤵
  PID:9596
- C:\Windows\System\vGFVjIh.exe
  C:\Windows\System\vGFVjIh.exe
  2⤵
  PID:9612
- C:\Windows\System\NlPRKzc.exe
  C:\Windows\System\NlPRKzc.exe
  2⤵
  PID:9628
- C:\Windows\System\NIKHAgw.exe
  C:\Windows\System\NIKHAgw.exe
  2⤵
  PID:9644
- C:\Windows\System\GwgQyyG.exe
  C:\Windows\System\GwgQyyG.exe
  2⤵
  PID:9660
- C:\Windows\System\zhQfooe.exe
  C:\Windows\System\zhQfooe.exe
  2⤵
  PID:9676
- C:\Windows\System\OHtcIsj.exe
  C:\Windows\System\OHtcIsj.exe
  2⤵
  PID:9692
- C:\Windows\System\TPenAzZ.exe
  C:\Windows\System\TPenAzZ.exe
  2⤵
  PID:9708
- C:\Windows\System\ApIjRVX.exe
  C:\Windows\System\ApIjRVX.exe
  2⤵
  PID:9724
- C:\Windows\System\gZYFewL.exe
  C:\Windows\System\gZYFewL.exe
  2⤵
  PID:9740
- C:\Windows\System\mOnzLqN.exe
  C:\Windows\System\mOnzLqN.exe
  2⤵
  PID:9756
- C:\Windows\System\jQJnvVT.exe
  C:\Windows\System\jQJnvVT.exe
  2⤵
  PID:9772
- C:\Windows\System\BUrWxBk.exe
  C:\Windows\System\BUrWxBk.exe
  2⤵
  PID:9788
- C:\Windows\System\stJwrZr.exe
  C:\Windows\System\stJwrZr.exe
  2⤵
  PID:9804
- C:\Windows\System\OlpBgWU.exe
  C:\Windows\System\OlpBgWU.exe
  2⤵
  PID:9820
- C:\Windows\System\juCQlqL.exe
  C:\Windows\System\juCQlqL.exe
  2⤵
  PID:9836
- C:\Windows\System\RHezlIt.exe
  C:\Windows\System\RHezlIt.exe
  2⤵
  PID:9852
- C:\Windows\System\pIhLVsd.exe
  C:\Windows\System\pIhLVsd.exe
  2⤵
  PID:9872
- C:\Windows\System\TeEStcL.exe
  C:\Windows\System\TeEStcL.exe
  2⤵
  PID:9888
- C:\Windows\System\rJjQjxZ.exe
  C:\Windows\System\rJjQjxZ.exe
  2⤵
  PID:9904
- C:\Windows\System\nuFAMLB.exe
  C:\Windows\System\nuFAMLB.exe
  2⤵
  PID:9920
- C:\Windows\System\tcYzCTD.exe
  C:\Windows\System\tcYzCTD.exe
  2⤵
  PID:9936
- C:\Windows\System\cEvSqJA.exe
  C:\Windows\System\cEvSqJA.exe
  2⤵
  PID:9952
- C:\Windows\System\kkyPUIF.exe
  C:\Windows\System\kkyPUIF.exe
  2⤵
  PID:9968
- C:\Windows\System\nXpWhMy.exe
  C:\Windows\System\nXpWhMy.exe
  2⤵
  PID:9984
- C:\Windows\System\BPCirAP.exe
  C:\Windows\System\BPCirAP.exe
  2⤵
  PID:10000
- C:\Windows\System\znGHrfR.exe
  C:\Windows\System\znGHrfR.exe
  2⤵
  PID:10016
- C:\Windows\System\qVRjIQI.exe
  C:\Windows\System\qVRjIQI.exe
  2⤵
  PID:10036
- C:\Windows\System\NBnYpYw.exe
  C:\Windows\System\NBnYpYw.exe
  2⤵
  PID:10052
- C:\Windows\System\itHTBAu.exe
  C:\Windows\System\itHTBAu.exe
  2⤵
  PID:10068
- C:\Windows\System\XLYiEEM.exe
  C:\Windows\System\XLYiEEM.exe
  2⤵
  PID:10088
- C:\Windows\System\qESsFdL.exe
  C:\Windows\System\qESsFdL.exe
  2⤵
  PID:10104
- C:\Windows\System\HUGWpgv.exe
  C:\Windows\System\HUGWpgv.exe
  2⤵
  PID:10120
- C:\Windows\System\UXTwCsy.exe
  C:\Windows\System\UXTwCsy.exe
  2⤵
  PID:10136
- C:\Windows\System\mFtvooX.exe
  C:\Windows\System\mFtvooX.exe
  2⤵
  PID:10152
- C:\Windows\System\lohFAaC.exe
  C:\Windows\System\lohFAaC.exe
  2⤵
  PID:10168
- C:\Windows\System\SqyZUKx.exe
  C:\Windows\System\SqyZUKx.exe
  2⤵
  PID:10184
- C:\Windows\System\ZZGMwOa.exe
  C:\Windows\System\ZZGMwOa.exe
  2⤵
  PID:10200
- C:\Windows\System\VoFqDIW.exe
  C:\Windows\System\VoFqDIW.exe
  2⤵
  PID:10216
- C:\Windows\System\ZiBZsuh.exe
  C:\Windows\System\ZiBZsuh.exe
  2⤵
  PID:10232
- C:\Windows\System\PrHaaQJ.exe
  C:\Windows\System\PrHaaQJ.exe
  2⤵
  PID:9252
- C:\Windows\System\PGfkKoZ.exe
  C:\Windows\System\PGfkKoZ.exe
  2⤵
  PID:8508
- C:\Windows\System\UEQakgW.exe
  C:\Windows\System\UEQakgW.exe
  2⤵
  PID:8008
- C:\Windows\System\DZJFxsH.exe
  C:\Windows\System\DZJFxsH.exe
  2⤵
  PID:9268
- C:\Windows\System\ZErycSv.exe
  C:\Windows\System\ZErycSv.exe
  2⤵
  PID:9364
- C:\Windows\System\GFDwAHi.exe
  C:\Windows\System\GFDwAHi.exe
  2⤵
  PID:9480
- C:\Windows\System\cRtYmPM.exe
  C:\Windows\System\cRtYmPM.exe
  2⤵
  PID:9540
- C:\Windows\System\MHpWTCm.exe
  C:\Windows\System\MHpWTCm.exe
  2⤵
  PID:9460
- C:\Windows\System\VAvFOYN.exe
  C:\Windows\System\VAvFOYN.exe
  2⤵
  PID:9556
- C:\Windows\System\Wmvjfsw.exe
  C:\Windows\System\Wmvjfsw.exe
  2⤵
  PID:9524
- C:\Windows\System\jHDblIN.exe
  C:\Windows\System\jHDblIN.exe
  2⤵
  PID:9636
- C:\Windows\System\YMsZvDH.exe
  C:\Windows\System\YMsZvDH.exe
  2⤵
  PID:9640
- C:\Windows\System\sdXZmzR.exe
  C:\Windows\System\sdXZmzR.exe
  2⤵
  PID:9560
- C:\Windows\System\IxKIioU.exe
  C:\Windows\System\IxKIioU.exe
  2⤵
  PID:9652
- C:\Windows\System\Ycasmqr.exe
  C:\Windows\System\Ycasmqr.exe
  2⤵
  PID:9700
- C:\Windows\System\YFfmOPk.exe
  C:\Windows\System\YFfmOPk.exe
  2⤵
  PID:9716
- C:\Windows\System\mhxnZiu.exe
  C:\Windows\System\mhxnZiu.exe
  2⤵
  PID:9796
- C:\Windows\System\zKJwRdz.exe
  C:\Windows\System\zKJwRdz.exe
  2⤵
  PID:9800
- C:\Windows\System\bTQsupz.exe
  C:\Windows\System\bTQsupz.exe
  2⤵
  PID:9812
- C:\Windows\System\OWedOpx.exe
  C:\Windows\System\OWedOpx.exe
  2⤵
  PID:9864
- C:\Windows\System\oGOcneq.exe
  C:\Windows\System\oGOcneq.exe
  2⤵
  PID:9880
- C:\Windows\System\qvfDYBT.exe
  C:\Windows\System\qvfDYBT.exe
  2⤵
  PID:9932
- C:\Windows\System\xukFVyg.exe
  C:\Windows\System\xukFVyg.exe
  2⤵
  PID:9944
- C:\Windows\System\aonBkiR.exe
  C:\Windows\System\aonBkiR.exe
  2⤵
  PID:9980
- C:\Windows\System\TQkMROi.exe
  C:\Windows\System\TQkMROi.exe
  2⤵
  PID:10012
- C:\Windows\System\URREOOh.exe
  C:\Windows\System\URREOOh.exe
  2⤵
  PID:10064
- C:\Windows\System\cSwiRru.exe
  C:\Windows\System\cSwiRru.exe
  2⤵
  PID:10096
- C:\Windows\System\dLWjqLo.exe
  C:\Windows\System\dLWjqLo.exe
  2⤵
  PID:10084
- C:\Windows\System\pDCDLrn.exe
  C:\Windows\System\pDCDLrn.exe
  2⤵
  PID:10080
- C:\Windows\System\TSHwTFs.exe
  C:\Windows\System\TSHwTFs.exe
  2⤵
  PID:10144
- C:\Windows\System\SOKSDFs.exe
  C:\Windows\System\SOKSDFs.exe
  2⤵
  PID:10212
- C:\Windows\System\QgdUQdg.exe
  C:\Windows\System\QgdUQdg.exe
  2⤵
  PID:10196
- C:\Windows\System\GbVZunw.exe
  C:\Windows\System\GbVZunw.exe
  2⤵
  PID:8748
- C:\Windows\System\XHtxiSR.exe
  C:\Windows\System\XHtxiSR.exe
  2⤵
  PID:9352
- C:\Windows\System\ZZenCGm.exe
  C:\Windows\System\ZZenCGm.exe
  2⤵
  PID:9384
- C:\Windows\System\nqIhAls.exe
  C:\Windows\System\nqIhAls.exe
  2⤵
  PID:9272
- C:\Windows\System\ggJrVdT.exe
  C:\Windows\System\ggJrVdT.exe
  2⤵
  PID:9400
- C:\Windows\System\vPvSbaB.exe
  C:\Windows\System\vPvSbaB.exe
  2⤵
  PID:9608
- C:\Windows\System\oSQZVcF.exe
  C:\Windows\System\oSQZVcF.exe
  2⤵
  PID:9544
- C:\Windows\System\TgatxWF.exe
  C:\Windows\System\TgatxWF.exe
  2⤵
  PID:9832
- C:\Windows\System\VlMonAQ.exe
  C:\Windows\System\VlMonAQ.exe
  2⤵
  PID:9752
- C:\Windows\System\jrUzILw.exe
  C:\Windows\System\jrUzILw.exe
  2⤵
  PID:9528
- C:\Windows\System\hiuUazp.exe
  C:\Windows\System\hiuUazp.exe
  2⤵
  PID:9996
- C:\Windows\System\IIuJAEL.exe
  C:\Windows\System\IIuJAEL.exe
  2⤵
  PID:9588
- C:\Windows\System\OWhtPJe.exe
  C:\Windows\System\OWhtPJe.exe
  2⤵
  PID:9736
- C:\Windows\System\ydxWPCV.exe
  C:\Windows\System\ydxWPCV.exe
  2⤵
  PID:9816
- C:\Windows\System\tWIZEaX.exe
  C:\Windows\System\tWIZEaX.exe
  2⤵
  PID:9224
- C:\Windows\System\TaiqiCL.exe
  C:\Windows\System\TaiqiCL.exe
  2⤵
  PID:10060
- C:\Windows\System\ztlaezV.exe
  C:\Windows\System\ztlaezV.exe
  2⤵
  PID:10224
- C:\Windows\System\IHpWVhC.exe
  C:\Windows\System\IHpWVhC.exe
  2⤵
  PID:10148
- C:\Windows\System\YhuXvNs.exe
  C:\Windows\System\YhuXvNs.exe
  2⤵
  PID:9428
- C:\Windows\System\powbmlz.exe
  C:\Windows\System\powbmlz.exe
  2⤵
  PID:9592
- C:\Windows\System\dXdwpuY.exe
  C:\Windows\System\dXdwpuY.exe
  2⤵
  PID:9964
- C:\Windows\System\QfLPHdr.exe
  C:\Windows\System\QfLPHdr.exe
  2⤵
  PID:10180
- C:\Windows\System\eDlOgaJ.exe
  C:\Windows\System\eDlOgaJ.exe
  2⤵
  PID:9976
- C:\Windows\System\Xqssruh.exe
  C:\Windows\System\Xqssruh.exe
  2⤵
  PID:10132
- C:\Windows\System\uHwhkSV.exe
  C:\Windows\System\uHwhkSV.exe
  2⤵
  PID:10116
- C:\Windows\System\uIXcedo.exe
  C:\Windows\System\uIXcedo.exe
  2⤵
  PID:9868
- C:\Windows\System\NDKooui.exe
  C:\Windows\System\NDKooui.exe
  2⤵
  PID:9432
- C:\Windows\System\ZtxBCwM.exe
  C:\Windows\System\ZtxBCwM.exe
  2⤵
  PID:9512
- C:\Windows\System\rAKWQcA.exe
  C:\Windows\System\rAKWQcA.exe
  2⤵
  PID:9784
- C:\Windows\System\HoPvWXD.exe
  C:\Windows\System\HoPvWXD.exe
  2⤵
  PID:9768
- C:\Windows\System\FYfcIwm.exe
  C:\Windows\System\FYfcIwm.exe
  2⤵
  PID:10164
- C:\Windows\System\kFwfJLp.exe
  C:\Windows\System\kFwfJLp.exe
  2⤵
  PID:9928
- C:\Windows\System\GPFBdqU.exe
  C:\Windows\System\GPFBdqU.exe
  2⤵
  PID:10260
- C:\Windows\System\cvLrCYn.exe
  C:\Windows\System\cvLrCYn.exe
  2⤵
  PID:10276
- C:\Windows\System\xShESgi.exe
  C:\Windows\System\xShESgi.exe
  2⤵
  PID:10292
- C:\Windows\System\dfvdCVc.exe
  C:\Windows\System\dfvdCVc.exe
  2⤵
  PID:10308
- C:\Windows\System\TNeSVlT.exe
  C:\Windows\System\TNeSVlT.exe
  2⤵
  PID:10324
- C:\Windows\System\UFKLlil.exe
  C:\Windows\System\UFKLlil.exe
  2⤵
  PID:10340
- C:\Windows\System\CjHbrms.exe
  C:\Windows\System\CjHbrms.exe
  2⤵
  PID:10356
- C:\Windows\System\qsYdFeH.exe
  C:\Windows\System\qsYdFeH.exe
  2⤵
  PID:10372
- C:\Windows\System\XaIALpI.exe
  C:\Windows\System\XaIALpI.exe
  2⤵
  PID:10388
- C:\Windows\System\FvEEvFM.exe
  C:\Windows\System\FvEEvFM.exe
  2⤵
  PID:10404
- C:\Windows\System\VtWBKaz.exe
  C:\Windows\System\VtWBKaz.exe
  2⤵
  PID:10420
- C:\Windows\System\OGAfOyn.exe
  C:\Windows\System\OGAfOyn.exe
  2⤵
  PID:10436
- C:\Windows\System\tUqksBJ.exe
  C:\Windows\System\tUqksBJ.exe
  2⤵
  PID:10452
- C:\Windows\System\SVlYCrN.exe
  C:\Windows\System\SVlYCrN.exe
  2⤵
  PID:10468
- C:\Windows\System\eMInGCc.exe
  C:\Windows\System\eMInGCc.exe
  2⤵
  PID:10484
- C:\Windows\System\yvnoMDA.exe
  C:\Windows\System\yvnoMDA.exe
  2⤵
  PID:10500
- C:\Windows\System\GeeLfwj.exe
  C:\Windows\System\GeeLfwj.exe
  2⤵
  PID:10520
- C:\Windows\System\xTnYwgq.exe
  C:\Windows\System\xTnYwgq.exe
  2⤵
  PID:10536
- C:\Windows\System\aIWVwYK.exe
  C:\Windows\System\aIWVwYK.exe
  2⤵
  PID:10556
- C:\Windows\System\zhIDPkp.exe
  C:\Windows\System\zhIDPkp.exe
  2⤵
  PID:10572
- C:\Windows\System\cywMzWQ.exe
  C:\Windows\System\cywMzWQ.exe
  2⤵
  PID:10588
- C:\Windows\System\buznyQS.exe
  C:\Windows\System\buznyQS.exe
  2⤵
  PID:10608
- C:\Windows\System\nvFbdJm.exe
  C:\Windows\System\nvFbdJm.exe
  2⤵
  PID:10624
- C:\Windows\System\wOIKlvm.exe
  C:\Windows\System\wOIKlvm.exe
  2⤵
  PID:10644
- C:\Windows\System\gMKpUJY.exe
  C:\Windows\System\gMKpUJY.exe
  2⤵
  PID:10660
- C:\Windows\System\uAblQOq.exe
  C:\Windows\System\uAblQOq.exe
  2⤵
  PID:10676
- C:\Windows\System\OVGLeKe.exe
  C:\Windows\System\OVGLeKe.exe
  2⤵
  PID:10696
- C:\Windows\System\CPcICxB.exe
  C:\Windows\System\CPcICxB.exe
  2⤵
  PID:10712
- C:\Windows\System\chUSekm.exe
  C:\Windows\System\chUSekm.exe
  2⤵
  PID:10732
- C:\Windows\System\rVjMXDT.exe
  C:\Windows\System\rVjMXDT.exe
  2⤵
  PID:10752
- C:\Windows\System\fsFhFQq.exe
  C:\Windows\System\fsFhFQq.exe
  2⤵
  PID:10768
- C:\Windows\System\vxYxKLp.exe
  C:\Windows\System\vxYxKLp.exe
  2⤵
  PID:10796
- C:\Windows\System\KKwJXEB.exe
  C:\Windows\System\KKwJXEB.exe
  2⤵
  PID:10816
- C:\Windows\System\vEIvxKQ.exe
  C:\Windows\System\vEIvxKQ.exe
  2⤵
  PID:10832
- C:\Windows\System\EmNCLyJ.exe
  C:\Windows\System\EmNCLyJ.exe
  2⤵
  PID:10852
- C:\Windows\System\dEFbwrJ.exe
  C:\Windows\System\dEFbwrJ.exe
  2⤵
  PID:10868
- C:\Windows\System\qbEQzWn.exe
  C:\Windows\System\qbEQzWn.exe
  2⤵
  PID:10884
- C:\Windows\System\tTeppol.exe
  C:\Windows\System\tTeppol.exe
  2⤵
  PID:10900
- C:\Windows\System\oESeVxm.exe
  C:\Windows\System\oESeVxm.exe
  2⤵
  PID:10916
- C:\Windows\System\vUbyeeR.exe
  C:\Windows\System\vUbyeeR.exe
  2⤵
  PID:10936
- C:\Windows\System\CfcmjzP.exe
  C:\Windows\System\CfcmjzP.exe
  2⤵
  PID:10952
- C:\Windows\System\fLamenG.exe
  C:\Windows\System\fLamenG.exe
  2⤵
  PID:10968
- C:\Windows\System\GlhyHfM.exe
  C:\Windows\System\GlhyHfM.exe
  2⤵
  PID:10984
- C:\Windows\System\yUrwAOC.exe
  C:\Windows\System\yUrwAOC.exe
  2⤵
  PID:11000
- C:\Windows\System\VsxaAEO.exe
  C:\Windows\System\VsxaAEO.exe
  2⤵
  PID:11016
- C:\Windows\System\BRncyYB.exe
  C:\Windows\System\BRncyYB.exe
  2⤵
  PID:11032
- C:\Windows\System\PpDyuOL.exe
  C:\Windows\System\PpDyuOL.exe
  2⤵
  PID:11048
- C:\Windows\System\peeEQNg.exe
  C:\Windows\System\peeEQNg.exe
  2⤵
  PID:11064
- C:\Windows\System\josvKgU.exe
  C:\Windows\System\josvKgU.exe
  2⤵
  PID:11080
- C:\Windows\System\NsXxUWK.exe
  C:\Windows\System\NsXxUWK.exe
  2⤵
  PID:11096
- C:\Windows\System\BxpjwdJ.exe
  C:\Windows\System\BxpjwdJ.exe
  2⤵
  PID:11112
- C:\Windows\System\skiEDlP.exe
  C:\Windows\System\skiEDlP.exe
  2⤵
  PID:11128
- C:\Windows\System\cfLEVmO.exe
  C:\Windows\System\cfLEVmO.exe
  2⤵
  PID:11144
- C:\Windows\System\RDXeOur.exe
  C:\Windows\System\RDXeOur.exe
  2⤵
  PID:11160
- C:\Windows\System\CcZIznD.exe
  C:\Windows\System\CcZIznD.exe
  2⤵
  PID:11176
- C:\Windows\System\ubDXqDR.exe
  C:\Windows\System\ubDXqDR.exe
  2⤵
  PID:11192
- C:\Windows\System\ZilhZvb.exe
  C:\Windows\System\ZilhZvb.exe
  2⤵
  PID:11212
- C:\Windows\System\hWaJmRS.exe
  C:\Windows\System\hWaJmRS.exe
  2⤵
  PID:11232
- C:\Windows\System\DkQNtEz.exe
  C:\Windows\System\DkQNtEz.exe
  2⤵
  PID:11248
- C:\Windows\System\PfwAclK.exe
  C:\Windows\System\PfwAclK.exe
  2⤵
  PID:10160
- C:\Windows\System\TtejxVK.exe
  C:\Windows\System\TtejxVK.exe
  2⤵
  PID:10268
- C:\Windows\System\gTNoYhp.exe
  C:\Windows\System\gTNoYhp.exe
  2⤵
  PID:10332
- C:\Windows\System\HxwQIKN.exe
  C:\Windows\System\HxwQIKN.exe
  2⤵
  PID:10396
- C:\Windows\System\LDXAbTP.exe
  C:\Windows\System\LDXAbTP.exe
  2⤵
  PID:10428
- C:\Windows\System\CQppDyf.exe
  C:\Windows\System\CQppDyf.exe
  2⤵
  PID:10492
- C:\Windows\System\zuxoQCO.exe
  C:\Windows\System\zuxoQCO.exe
  2⤵
  PID:10528
- C:\Windows\System\JbiOlAs.exe
  C:\Windows\System\JbiOlAs.exe
  2⤵
  PID:10600
- C:\Windows\System\hebTNVV.exe
  C:\Windows\System\hebTNVV.exe
  2⤵
  PID:10288
- C:\Windows\System\hdNXXYU.exe
  C:\Windows\System\hdNXXYU.exe
  2⤵
  PID:10352
- C:\Windows\System\yXMdjWK.exe
  C:\Windows\System\yXMdjWK.exe
  2⤵
  PID:10448
- C:\Windows\System\UJonPUJ.exe
  C:\Windows\System\UJonPUJ.exe
  2⤵
  PID:10580
- C:\Windows\System\HfGEAfW.exe
  C:\Windows\System\HfGEAfW.exe
  2⤵
  PID:10416
- C:\Windows\System\qNzVwRz.exe
  C:\Windows\System\qNzVwRz.exe
  2⤵
  PID:10508
- C:\Windows\System\JdKzDRB.exe
  C:\Windows\System\JdKzDRB.exe
  2⤵
  PID:10552
- C:\Windows\System\lNwHdwA.exe
  C:\Windows\System\lNwHdwA.exe
  2⤵
  PID:10668
- C:\Windows\System\lALrvcf.exe
  C:\Windows\System\lALrvcf.exe
  2⤵
  PID:10688
- C:\Windows\System\NyQDUEQ.exe
  C:\Windows\System\NyQDUEQ.exe
  2⤵
  PID:10724
- C:\Windows\System\XwhgDes.exe
  C:\Windows\System\XwhgDes.exe
  2⤵
  PID:10740
- C:\Windows\System\plcBFyq.exe
  C:\Windows\System\plcBFyq.exe
  2⤵
  PID:10784
- C:\Windows\System\MlHBTox.exe
  C:\Windows\System\MlHBTox.exe
  2⤵
  PID:10848
- C:\Windows\System\rnKRNdV.exe
  C:\Windows\System\rnKRNdV.exe
  2⤵
  PID:10896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ByMuUGh.exe

Filesize
1.6MB

MD5
e3a36f441be67ef43b01baddb37c9093

SHA1
ef71d7bd41f9320f62a9c9e0c1504e10b063f8a0

SHA256
12180137fc1601d5e7efcff4178b6fad76125a8df0d532ad2b49eac07ac35318

SHA512
9a47082113717d411ff847315aeef8118a23c509dc4cd9e3199cfa95f21d567ff4940d50cac3600d30b612f4f17d046db9bd820c0cd95cc0420a7a3867256aa5

Download Submit
C:\Windows\system\CjBSdHT.exe

Filesize
1.6MB

MD5
b524f22eb527c5ced79c13e20f10e7de

SHA1
a5b5defde2eb2ccb08c78a088d2813ef06f93875

SHA256
b413e211778ca5bc6998147280bc5620f566d48280ce9c35da9d949c03731480

SHA512
1ac11373968935100a82407a04a3066ef6262828c252576e5bdfd33ff85171c2b28bac44d5e9ad43b6d421fa2777952d802927f54bf344cdb11822d14cf76e11

Download Submit
C:\Windows\system\DPNQFQs.exe

Filesize
1.7MB

MD5
7a47d6980bf29b7ba1a8b368c3978d3d

SHA1
4014a4f3a40efce2bb8629256dcad0da9d906c08

SHA256
90dab1c05d37bd12d9e3e7c9133b198f490aaa445ee26b645e03c1d04f651953

SHA512
a7afc3665b1e6bc6b6971a1dc59be41361590ba1428f9acc6f03c42067ee9839e13d111438f1845669bf99dff4e31c5474e735dafc62e25f5b920afd9f743f53

Download Submit
C:\Windows\system\EeGfWLc.exe

Filesize
1.7MB

MD5
4ac123c79ab7c01b05ec137fea521393

SHA1
37ec6309a9bf0dfb3d71b8e390e200e77b7651c1

SHA256
a90123d36ebb8afee4bb84861ea9ef74623d8cdd8ca1992c7c7bc380b01b4b59

SHA512
ed8dbdc1f45e3d71ab1f055e77f8a6bfcf7a03600e0ecc63c93b0f96ca2b7b3958d771d576d3d335fe7963cd7c1a2a9285c9420d7a2c02f458e9c967659e1724

Download Submit
C:\Windows\system\GFLHsJD.exe

Filesize
1.6MB

MD5
10347fb7c559fd47f05b69db72f1cf2f

SHA1
8bc0b3f363ee626186c70972df5f8e15bf9b4342

SHA256
f975a0e5388434e38f688d798f602a0557b4d026927a18b1d5dc523827a7f873

SHA512
9a231923a9e3d0d4a140a0ab6e10019d6bfd6b8c5ed0fc9df8facf2e4c2c41020513215fba52ce2afe46b944033020989debf3aad21f4aff7f6d222cd98dbb15

Download Submit
C:\Windows\system\HOSpUWm.exe

Filesize
1.6MB

MD5
608c05ed141355b4adfde76a9fa51021

SHA1
ca74619eaea64b29cc4dac475641ab2b4b8d5d10

SHA256
7d8297d892c9be8b9277f45de9c6781016e42117f313005adfe98d8cbda39f28

SHA512
f638b9a2cd6f314155ac12d2429ba77901f25d256e81e3b2069bbba3ee2da85ccb57211478cf3bdbed6532c76a93653fad89d8463b93ed051a86e0ec9135b1ac

Download Submit
C:\Windows\system\TWawgdk.exe

Filesize
1.7MB

MD5
23ef9d0b1f3723d0d9c5ef5a7a536c99

SHA1
af53d0d51074c9b97d646d8578defdd4ddf7eb5d

SHA256
3d5e33144d3bace89caa842cf21930858906bfdcc7d22d5e2fe9e9ba59015ee8

SHA512
a527a84143e16bf6bfceff6c9053f85e9a447cc3e231bca00085eac447c397603e61e0a70f136a8a7e5b239e29370c5feed36475197bb806bbc0f38a903d24bd

Download Submit
C:\Windows\system\WXgYVvO.exe

Filesize
1.6MB

MD5
1751da51fa85c35173f04842084703b1

SHA1
d67144d592022c2b2f752b9bc7252c2a2936ae92

SHA256
46f7c338d9fafd051a194207e61c64c402fc7e8416fd0b3e9c85a3f9e6c85d11

SHA512
9979f4c1492cc572f37b3bdd8c513020d1ecdddcbf408e85a42264ef68e9465182c38b87bc5053ee29bc2d2607747fbdee66efaa9470c558c7a79ab08525ee2b

Download Submit
C:\Windows\system\ZfcajhM.exe

Filesize
8B

MD5
68703642e5faeaf00b4b9f791a04a7f5

SHA1
2e8f5d51bda54b6b227caed2cb4535020c7a482c

SHA256
76bc446e18daed4e6417440c778e757728762c893f014de08ffa5f0fe98668bd

SHA512
0c1919485a30576b5fdf963204dc04b356f524c23dfb4ffaecdbb8a8ea4a0993cf3ac05bee011edf07b5b637ac7455499983eac22f5cdd87cd869e7a046115a5

Download Submit
C:\Windows\system\ZxNsQFi.exe

Filesize
1.6MB

MD5
221c9d1d0b2c3fe07e98e2090ce04e2e

SHA1
af49fb34d0412aa95277e8d88f2399b453f0bccb

SHA256
18ffa22bb8bf1d1a1339191bcbf8966a5eee89831e3629259090e11bb05459ab

SHA512
907255b144b1c7898b6d23ffe8a0dbf2803023d2deb3db5d42df84dd84a1393a70add085b03da4769ddf842138e17b232e2e024791b9245a7fb80d28f2302b80

Download Submit
C:\Windows\system\atYNAzI.exe

Filesize
1.6MB

MD5
d0699abd267f74f8c240ec728ed0764e

SHA1
35aeb262a79db39da96ddb93536b29cba9ddc47f

SHA256
771115c681ae6cbcd754616d16de94e9e495b6c70c7a973d256f46c038f28254

SHA512
b2369cfc2ddce642834a46cb5bdba704e3048eb3e2f64a3e97bbdf14208c33373a86f7485fa5d7af5022e99b1da6c89dd2d8f6607f887673a5ceac7073baf9dd

Download Submit
C:\Windows\system\fOxuucQ.exe

Filesize
1.7MB

MD5
5b3d9d3f37f841afd8d9125cd26e8981

SHA1
3bec5efbdb1c3dd09d539602ed26f86ed36fe766

SHA256
90a86de5d6598b5b9d01802440f0077389e6438955b23ef7b2b2d33b54155af4

SHA512
e1e847dd01b2f4d7efecf1cc4b773e964b64589cd5b4afe00ad8ec2d477174851cd4f886d947976e07d57e305976c1b08e2b15a773ffc5e58664c1599cfc0a9f

Download Submit
C:\Windows\system\jdbvhkQ.exe

Filesize
1.7MB

MD5
8b0421bd7ee39155aa1193a2bd690d9a

SHA1
45d7a14fea85398c0ba6ce04656e700faab18a77

SHA256
d662c0fe5f06de734e39fa0bbd5c61962829cec882089a5f5bfdcd6d552a7a9b

SHA512
756a6edcb133478344dbbdf63fc0cc484ba8380f4b388e2b808b857607642920a625013321aa78d4f8de2f3b80325a16e313fa27e137a2f856286149730e220e

Download Submit
C:\Windows\system\lskPnww.exe

Filesize
1.7MB

MD5
dcacb87681e68c62f2f4d51d1a4bba39

SHA1
6ed5493d3cc47d2573e59b580dc2e36651ddcf0a

SHA256
7ab0a2d9c07f6318df9a0cc455be68d8b116d9d686c7eff98675e69409327bd2

SHA512
8bb8bd39560dac6a29bacbfd1d0baa6f45af42e03be89de62117f15cfb2ed1c477e865dcdaf8da4d00ffcdeb22a4147423f66178ea8e1fc7111a3c1b3ac1a1d6

Download Submit
C:\Windows\system\nxEUiie.exe

Filesize
1.7MB

MD5
06c3740343720a9b096df180759f00a8

SHA1
4ea0068ca57b10c0eae1c4f370546a3e22f54898

SHA256
98f274d8251fb8856f10b6c312d96f0ed3b347d82db86ebd11c8c2c3cf96fa30

SHA512
2f89cdfa3bd3534fecf9658ab63b3fedbc857ef7ca1231b24fcede4d19873fd61145fa9f7e4946d13884783039ae51fd9404965dc6754c8580efabbf7c6f54a0

Download Submit
C:\Windows\system\nzQhwyu.exe

Filesize
1.6MB

MD5
ae30f697bd4b97ae52d65f22268eac1d

SHA1
b54512719689bb9faa5635c7232d4a884f371baa

SHA256
1abc6375bf6116abc19375a6973c8c9724fdacc638e31e795dbcd03cabc9deb4

SHA512
d64adba198a75bd43e1ae9066e7e01e4fd3ada0adcbff0de746a5a231f1a20eaf0168c5fba8c89d9224ebf37922d7d667d1bb854b3a027b910004058f6fd9183

Download Submit
C:\Windows\system\pETYXgg.exe

Filesize
1.7MB

MD5
126b6b75243e3dc295346b4618c59b08

SHA1
bc667f9064021a89c6d8454b8be5faa6eaa051b9

SHA256
a1e85599a30bb8336c980d85d735874b8502c6206b3bc939e924917a6d3cf912

SHA512
8126735854ef47d617a0e3408b5629bc947a804f457405e21c2cf7fbf18755e4a1ab3c80205cd497eeba35f9a06d138de82425e7a0da03542a460af9205509d2

Download Submit
C:\Windows\system\pOqCzxe.exe

Filesize
1.6MB

MD5
ec2be25f7f5ac443955903c3e1ad6087

SHA1
a4b1f3b50f2f3b144411e9d469b557cdb07cf5d4

SHA256
0d2a7b94e6a4cb47dc40f5c6a33844f0b7d764bf305289542bd8f5e956873516

SHA512
2f842a6dc484d68ccbc1728f6458112294333b0960f7821005ad20492d6be131155393b8a9fa38bdb2e448e5e5690d31c79ba317798142484025362573f193a8

Download Submit
C:\Windows\system\qWfLcIL.exe

Filesize
1.7MB

MD5
a0fb7588833422f49d0d11f11731ae61

SHA1
8ac6eceb0e343cc3bc3c785b7acf7e41450e153b

SHA256
60eeb68d14c2f82dd579b0fb0dd3daa631b63b20187383f3b7b3eb8a65e7e125

SHA512
953465c041f9af011367a7b6687d5c023841a6bc310d3c448d9645bf016c2b5e71713f95407d663014f3052fe9ac8b12afb019375e24b1ceed1c56f9e6e5f346

Download Submit
C:\Windows\system\tbUKRmg.exe

Filesize
18B

MD5
1e115887da89dd331527c9a56198c05a

SHA1
775fd7400acf7d0ce532fe6e77c75a22fe9e230c

SHA256
1f3da7dc011cb34515f387ca2a526d38913785ce0fa141ec7fb7693fbec54d85

SHA512
ff900fcd4057e1f7839c6d429bf4ccbe12ce14bbb4a5dbaaf6535bdaf022b8b29e789eed53a21534de8dcc350cf129f984fa6cec2a0d3d4df59644bd36d66dd9

Download Submit
C:\Windows\system\zzQzlBp.exe

Filesize
1.7MB

MD5
0ac52879502eedd9eb4d8629e6ca327d

SHA1
160056b43b79adee9e775d2864c8350620cbcaca

SHA256
901426b6313b33b172e8d7ea4bb273486e20ec72434ce1ff88cd23b794edc508

SHA512
6ef1995fb9c6b598c0ff173339c8579b4bd9a02d411670576ef43327e867e91ad7c7869bbe3e0ef90975d6404860d21141e66294e6ab5841a7276db9b51ea260

Download Submit
\Windows\system\FkVKutg.exe

Filesize
1.7MB

MD5
6e8f051577dc75acae7c1370542ab4e2

SHA1
8250cb8e0c365ac92490e982f2c0d1f0433551e0

SHA256
8b0da0fdecb95ba04d044ad8ed9c3dcdc97270cd1b11852d9757449f3b7eee2c

SHA512
0077f52ff125467c6b4a5cca245871af490587623e431bf93b096778d756af4964a43acf11e2d1d0985f4324595999c3a6fff8077d669f0ef90d36d70267d907

Download Submit
\Windows\system\GGCzCRp.exe

Filesize
1.7MB

MD5
9132543302b2a591c7d59aa8f3df6a14

SHA1
2683173c0c3cecce8c9e0ce6e07fd34104d0f7f3

SHA256
44734e7d1d6d14d4ddb137167a949578566ff6783a6dab12c5f1bfe574174946

SHA512
8452d22dc6e24d079d93893c6175ddd1686e51d972f095ba6a40d4099f0e7baebcd2a2d65c90d5ae6a347c928a275eb8c631dcd8f62e053955bd0b06131ff031

Download Submit
\Windows\system\JrnCNsN.exe

Filesize
1.7MB

MD5
967054da17647ccef95b845d68f10265

SHA1
129edd914bfab5e7aa4ed057c6a0d8e900977482

SHA256
2e739c9dec7f780a99848dae2995605b73c305d2ffc6165d0554d4bccdf92201

SHA512
ca3506046ddfdeb829d5ecd782e7a855b407f2d0721133f748615e54ea796881332e8831623b6ef4fd11744535483a3c867dbab10d7993d8b546cc0d7ab4a6cf

Download Submit
\Windows\system\QJtwmpg.exe

Filesize
1.7MB

MD5
1fc0f166c28b0642e78f4a3bdf261e80

SHA1
8131eeb54117bf3a3a6d060a96e91f89be8c1593

SHA256
86fc967d94be820f386d8c5dd62f28c9c1077785ec7a4c74d94c6c175adda299

SHA512
6988d18c6492153b67a739dc007c1c47582dba9c8b526b9d6c8a4c6d9b5b1cc9636ec885d4915fa694ad75ab147d947b5362d5c97c3444c49a7a67539f192e99

Download Submit
\Windows\system\SmKLTpO.exe

Filesize
1.7MB

MD5
a846f78c0b58f35fa4f936f5a0cfbfbd

SHA1
201b6e4fc2c5792d9bb067982d333957f5896578

SHA256
b458cb0475250fb6c6a37177a256ec33a36963b9a794117a76e85fbeb6122d4c

SHA512
0c37722c3b48490741ed73fcf152acf0ab5c09ed9b7eabb93608caf7c5b94de8436af641fe7cfa823d6db49128e9ee74c3d49fb93bc1096ea02ea965998f9f26

Download Submit
\Windows\system\UIlwbpk.exe

Filesize
1.7MB

MD5
48eaaa665532fb7d962c28b3f01842ef

SHA1
cde51a8a44c3826239430fd116c71225a04af4bf

SHA256
fd5a1a10abc7656d788cb90684781ac6ef735b06a7d7cb777ce9467b8e356a69

SHA512
2814dab7f6a5db6b54f6ab0bf32cb118c4498a32179bf247c583fa35132317ad5f7255cd1fc7300f59e1cdaed443951f14c36f98234b77cb1d988a09250a3ba7

Download Submit
\Windows\system\UYdUjOz.exe

Filesize
1.7MB

MD5
daebdf39e4ed3ef3c028c8ba1366660f

SHA1
9ddf7abb49af01cb8e5b58e5d4d751f92dcbb901

SHA256
6b875de6468a9eb89b09e66026cb562ebb644b23572a1f7f85877081ec8282ec

SHA512
ae613b566fcb02f3b746c8944ca188220eece792892cce7b1444bf0df5c72b2570a45c9f5ed8e0fad2bbf0a95c8eb529edfd3848a85e313c3aa4367cc7e1145d

Download Submit
\Windows\system\ZivapsA.exe

Filesize
1.6MB

MD5
6b807eacaa8f979640b4e9c48c9a9210

SHA1
1447e7f337496fe6d0613f96ae7aec0365080756

SHA256
e49cf773a27ad722dadb6d79b70231be4a5c56c8914bf49094e75d357b0dcb77

SHA512
4f0bf3dc81458063944653770bb4d63f9e327b121f80046b740dff13a116e7a4741c65c3a3ecd41b309c60220d1698fa4b288c42b53085e01d4245641c869081

Download Submit
\Windows\system\dXLTbDt.exe

Filesize
1.7MB

MD5
63faa56568df4ed146f30df3e2371c9c

SHA1
a20a045e5c896044bba5bf78d968ede9de109ef7

SHA256
db85f64d2359821a0731b1c8b57c081ba33a01208c6578656192ab77def3ccea

SHA512
8d61664b7ed1aa70e45949da109d1351844addbdd1979fc11158c500db7c5f0fe91edd94ea5b7bd0ac94d955f72014cc6240810f69422e2c506dd81ba6b06125

Download Submit
\Windows\system\eoEqaFT.exe

Filesize
1.7MB

MD5
362dc59098d4d567150938ebf031c287

SHA1
3a90e492694ed770180e6f9b73896e425f08f849

SHA256
8f7f7801ea130db524a6dcd9dfc8a7bedb29678cd899917abcded2ee7f7d499f

SHA512
5e2c073f0a94dc0a2a59303ff2d80acbacb452ae87a44601c21522b2c2618f2fb749bdc6ac7b31572d9abffacb081fd186543bee425089bd43027afc52c5c298

Download Submit
\Windows\system\fQJsSmd.exe

Filesize
1.7MB

MD5
42132a1f17e9b8196499f0f6e17f6c2a

SHA1
b4218a57dbcde2f2564c90e5db1c9a78cbd9f92f

SHA256
fea7ff2a0f4e55c3e18a51f73d4ac5e5b414eabf5538b69ccae094de55bef166

SHA512
a5674b97e56f2eeba112ab90f88beca40ce3d18d1e8026435668a0cf746c995edcae7e530ac68e72cfe92e8a64c88fbec67c8b395f7f28ee0b5cfd01612ee944

Download Submit
\Windows\system\fXjvblA.exe

Filesize
1.7MB

MD5
57d4cbac4f772fc79c9a396e75a6628e

SHA1
2910dd4f9cb02c84d2b24e9102ec3fd376ea901b

SHA256
b92c000460b599e9094c38032172e4220403bcb7b05c956288f110779b8cbf32

SHA512
d49d37f1eda9ad67ec913a18bf0071ce8f787bf6500b4d5f43da00f4f5de1b84bed97ebed7a47678f229a4fa96661d7f08627127efc963b0f95ecc42d81a1d2d

Download Submit
\Windows\system\juVMTuV.exe

Filesize
1.6MB

MD5
c294ed86fe40ec80e061dd45e93a5bc9

SHA1
f806439a736b67fabfde446d3f23479d9e655bb3

SHA256
5597576b0cfdc5d0526c063c8ddeec8e4f5ef258db29fdee6a445f3a98af6324

SHA512
31968f5d7f8384b50650e05340bae3f49b25efb98bc7f39221b7d319cfd1b56104f0fe644aa6e203e2029336581580df57ca222aa3419e24e01778e46fd75569

Download Submit
\Windows\system\kELIfGl.exe

Filesize
1.7MB

MD5
0bef90448dc1435be3a77a268040d0c4

SHA1
e6565cdc19764f978df5bd595cc7947b9b19fbe5

SHA256
dc951f15e3788477e4e6896cd277cef9c821fade0ff044eb2703aa435a24db2a

SHA512
25a132bc18931043798fb7c741a9ca53a16e26f6e8c8d9956f7d5494f830cacc77e8125715ad217cc49c93bdb3c638503a623c8f9c8306934feff4580cf314f8

Download Submit
\Windows\system\lLzcCnD.exe

Filesize
1.7MB

MD5
08b7960e9092a458a86962fd8a2e11bd

SHA1
3e71dd8d81039e4be369df4ee72c29be163e98f4

SHA256
c6a5424ac9e18894f08df85ae9bd2321151990090ea96327320f1bffc1e01e66

SHA512
6233294db8996994d8c9d231cf36d2cbca161437076b147039482d7b06105526ecb5c31d6c8c83f9c1f046a8cbb5b16f2548c5cb29001da59ec59d9470967ef6

Download Submit
\Windows\system\olcEZwJ.exe

Filesize
1.6MB

MD5
f956d639ca807a8ee586ecb0d9c5e14f

SHA1
fab425a1e5d664bd963d8e36c5fbe5aa53c14fba

SHA256
d91e8b343288ce4cb8a3ef26780876bdfa1217d3070122338657181e6f7a9bde

SHA512
5e5c5444e06c42c20ffec4247933ac7e6a89ce846e447fc45b2f29339d84c75488097d07387e4c6711cf63d096a8c178f2305961d340ae01317605a209018efc

Download Submit
\Windows\system\qXQlvIS.exe

Filesize
1.7MB

MD5
32c350d1c5e4e7642c35067862b53aed

SHA1
ba617e19f20d3bd9678539fc390508724b3ee168

SHA256
0d5322e0b3ba857631b338fac3e315c1ded324894e76f05db413a3a1d71cf496

SHA512
f7a2cf88a59691514ee4cb5d14dbdc36e4d07e3ffa56b3067cc1804f544db7c9814044ac94371edefbcc07547e30ad45ea28f1cdc5d2a47c9f0433247fb6c1f8

Download Submit
\Windows\system\qYzfMMU.exe

Filesize
1.7MB

MD5
d057579eb7b11e5d6ae0d8c6647bc76f

SHA1
e798b2ef011034e9bd0880809963d1c5fb824ce0

SHA256
b6040fa9fe3c2cc0507d2b502c5610caee9ab7570eafb93dbe1e96bed02b9d05

SHA512
2592e1c8b77c2923eb153a2aa29ffc4f158ac468427c66b1613e38c3bab70767566e783566ff36a911be86b2e31414102e88cff86af58874a0f713149dbd9523

Download Submit
\Windows\system\tWVstTf.exe

Filesize
1.7MB

MD5
7d1ee28b7b5e2e075e90cd35f6846de9

SHA1
249c3f7957afe020a9616706b72a3820c774cfaf

SHA256
39b3e2c4f798711b32cee8d6af07fdb4701f7f1fdfd15380c09149fb0dad2ae8

SHA512
43b9b1a8d0acfed5b6e97d7947ecfd4b6164b28d2b60320755f0801671f11e66b13b1bbad42bd175ffa264d0c5760c43ae4dccb8596d9a4f241d35e652a67a9d

Download Submit
\Windows\system\tjOytUN.exe

Filesize
1.6MB

MD5
83e151c38b434a318c8bade3a4e42269

SHA1
52a93106ae1346ab573163724be87671969f99ba

SHA256
93163006fe80dc0ccab5f222ed2c401ff8a5a9fe2d802f5a0ae2461304f2b74c

SHA512
8f54c0ab8f4b98297e85cb5d0cd2b023dcd6b1016369763a495ac41007fe81776de57f75b6ea3582ce12e0b703a746ca1511254be0418fb2688a33c0c837610f

Download Submit
memory/704-5954-0x000000013FC50000-0x0000000140042000-memory.dmp

Filesize
3.9MB

Download
memory/704-60-0x000000013FC50000-0x0000000140042000-memory.dmp

Filesize
3.9MB

Download
memory/996-67-0x000000013F2E0000-0x000000013F6D2000-memory.dmp

Filesize
3.9MB

Download
memory/1720-36-0x000000013F770000-0x000000013FB62000-memory.dmp

Filesize
3.9MB

Download
memory/1720-5312-0x000000013F770000-0x000000013FB62000-memory.dmp

Filesize
3.9MB

Download
memory/1908-5975-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Filesize
3.9MB

Download
memory/1908-62-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Filesize
3.9MB

Download
memory/2032-45-0x000000013F0D0000-0x000000013F4C2000-memory.dmp

Filesize
3.9MB

Download
memory/2032-5934-0x000000013F0D0000-0x000000013F4C2000-memory.dmp

Filesize
3.9MB

Download
memory/2220-83-0x000000013F270000-0x000000013F662000-memory.dmp

Filesize
3.9MB

Download
memory/2220-5967-0x000000013F270000-0x000000013F662000-memory.dmp

Filesize
3.9MB

Download
memory/2476-89-0x000000013F6E0000-0x000000013FAD2000-memory.dmp

Filesize
3.9MB

Download
memory/2476-5933-0x000000013F6E0000-0x000000013FAD2000-memory.dmp

Filesize
3.9MB

Download
memory/2700-32-0x0000000002EB0000-0x00000000032A2000-memory.dmp

Filesize
3.9MB

Download
memory/2700-84-0x0000000003190000-0x0000000003582000-memory.dmp

Filesize
3.9MB

Download
memory/2700-0-0x000000013F400000-0x000000013F7F2000-memory.dmp

Filesize
3.9MB

Download
memory/2700-65-0x0000000003190000-0x0000000003582000-memory.dmp

Filesize
3.9MB

Download
memory/2700-33-0x0000000002EB0000-0x00000000032A2000-memory.dmp

Filesize
3.9MB

Download
memory/2700-64-0x0000000003190000-0x0000000003582000-memory.dmp

Filesize
3.9MB

Download
memory/2700-48-0x000000013FC50000-0x0000000140042000-memory.dmp

Filesize
3.9MB

Download
memory/2700-37-0x0000000002EB0000-0x00000000032A2000-memory.dmp

Filesize
3.9MB

Download
memory/2700-27-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/2700-94-0x000000013F890000-0x000000013FC82000-memory.dmp

Filesize
3.9MB

Download
memory/2700-105-0x000000013FBB0000-0x000000013FFA2000-memory.dmp

Filesize
3.9MB

Download
memory/2700-1295-0x000000013F400000-0x000000013F7F2000-memory.dmp

Filesize
3.9MB

Download
memory/2700-38-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/2700-1-0x0000000000300000-0x0000000000310000-memory.dmp

Filesize
64KB

Download
memory/2728-29-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/2728-5931-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/2768-5973-0x000000013F6C0000-0x000000013FAB2000-memory.dmp

Filesize
3.9MB

Download
memory/2768-40-0x000000013F6C0000-0x000000013FAB2000-memory.dmp

Filesize
3.9MB

Download
memory/2848-1012-0x0000000001F80000-0x0000000001F88000-memory.dmp

Filesize
32KB

Download
memory/2848-764-0x000000001B670000-0x000000001B952000-memory.dmp

Filesize
2.9MB

Download
memory/2884-5932-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/2884-31-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/2888-5968-0x000000013F310000-0x000000013F702000-memory.dmp

Filesize
3.9MB

Download
memory/2888-34-0x000000013F310000-0x000000013F702000-memory.dmp

Filesize
3.9MB

Download