xmrig | 686dc5419077046a015ac2bd70034bf8c214ceed88af53a2e1e26102a8243cf5

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 08:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

afea276ea4da6b808e2b73e1aa416df0N.exe
Size

1.9MB
MD5

afea276ea4da6b808e2b73e1aa416df0
SHA1

aacafee92f713aa970e77c6fe922789b630af8d2
SHA256

686dc5419077046a015ac2bd70034bf8c214ceed88af53a2e1e26102a8243cf5
SHA512

1031dc45232139719125f81c5a32684696c274e2be7a0a7d89f9cad3376c049ac8695046ec4ef46adb473605096579cc6f414fb89defb0d1bd300eb4997a68c5
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupQF4g6FReQwUzN6Rf0Zra+JsqAhV:Lz071uv4BPMki8CnfZFOzZu1

Score

10^/10

xmrig discovery execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 19 IoCs

miner

resource	yara_rule
behavioral1/memory/1784-57-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	xmrig
behavioral1/memory/2420-54-0x000000013FF50000-0x0000000140342000-memory.dmp	xmrig
behavioral1/memory/2748-67-0x000000013F810000-0x000000013FC02000-memory.dmp	xmrig
behavioral1/memory/2892-63-0x000000013F0A0000-0x000000013F492000-memory.dmp	xmrig
behavioral1/memory/2284-61-0x000000013F210000-0x000000013F602000-memory.dmp	xmrig
behavioral1/memory/2968-60-0x000000013FD00000-0x00000001400F2000-memory.dmp	xmrig
behavioral1/memory/2416-39-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	xmrig
behavioral1/memory/2808-87-0x000000013F530000-0x000000013F922000-memory.dmp	xmrig
behavioral1/memory/2100-27-0x000000013F1A0000-0x000000013F592000-memory.dmp	xmrig
behavioral1/memory/2748-6152-0x000000013F810000-0x000000013FC02000-memory.dmp	xmrig
behavioral1/memory/2112-6162-0x000000013F870000-0x000000013FC62000-memory.dmp	xmrig
behavioral1/memory/1784-6171-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	xmrig
behavioral1/memory/2100-6170-0x000000013F1A0000-0x000000013F592000-memory.dmp	xmrig
behavioral1/memory/2892-6199-0x000000013F0A0000-0x000000013F492000-memory.dmp	xmrig
behavioral1/memory/2808-6192-0x000000013F530000-0x000000013F922000-memory.dmp	xmrig
behavioral1/memory/2420-6189-0x000000013FF50000-0x0000000140342000-memory.dmp	xmrig
behavioral1/memory/2968-6174-0x000000013FD00000-0x00000001400F2000-memory.dmp	xmrig
behavioral1/memory/2284-6188-0x000000013F210000-0x000000013F602000-memory.dmp	xmrig
behavioral1/memory/2416-6185-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2176	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2100	lLOOFIX.exe
2416	gYXQJZL.exe
2420	LKXdQNV.exe
1784	RUlOiru.exe
2968	mOqYzLs.exe
2284	TtTgIbY.exe
2748	accGxUi.exe
2892	jQyNSTu.exe
2808	ZdidFXv.exe
2112	QjWnjhW.exe
2920	MKtCMZL.exe
1956	DNpWGJE.exe
1120	MPwKGRV.exe
2860	pSIbWBW.exe
1624	WgszdBo.exe
3048	XVmEQHr.exe
2300	FfDkHJv.exe
1992	ljuemmX.exe
2456	xGvIOnO.exe
1052	MhdqoMm.exe
2928	cEelLzc.exe
2604	mfIPLWC.exe
2988	KwHaJnw.exe
912	FIrHGNS.exe
464	WseXjmf.exe
2268	CYhSuFO.exe
1676	fvZbLQK.exe
2540	bcygwRg.exe
2672	dLAXfMU.exe
2272	QoFyUGS.exe
344	FDjmfth.exe
1264	AGVNhmg.exe
2536	LRWkFRz.exe
1436	MoNSLVo.exe
884	VFvkZFA.exe
1652	fLbVhwu.exe
2460	rxPKzkD.exe
2336	vtcklZd.exe
2960	efPqKOP.exe
2636	siLbgUa.exe
2448	nFjSVUX.exe
1596	DETapgI.exe
2352	aZTbgzd.exe
3036	vkRdkzg.exe
1748	inOVijY.exe
292	jDUusRi.exe
264	Wssrqiu.exe
1304	RufnsfU.exe
3088	NSeqvZB.exe
1172	NqNkgWz.exe
3128	XcwiJrg.exe
3160	uYGnVPX.exe
3204	GhfhxtX.exe
268	rHwFkXG.exe
3240	zweAjPF.exe
1760	mpVeWVj.exe
1512	MjONxTD.exe
3284	UgWubiu.exe
1328	oszUHtW.exe
2504	jSCCYtB.exe
2452	TlsFJuX.exe
316	qvgQtXJ.exe
776	WWURkhh.exe
2392	DQMKcKq.exe

Loads dropped DLL 64 IoCs

pid	Process
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe
304	afea276ea4da6b808e2b73e1aa416df0N.exe

UPX packed file 60 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00090000000120f8-3.dat	upx
behavioral1/files/0x0007000000016d07-32.dat	upx
behavioral1/files/0x00060000000173eb-53.dat	upx
behavioral1/memory/1784-57-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	upx
behavioral1/memory/2420-54-0x000000013FF50000-0x0000000140342000-memory.dmp	upx
behavioral1/files/0x0008000000016d21-52.dat	upx
behavioral1/files/0x0006000000018b83-111.dat	upx
behavioral1/files/0x00060000000186f3-149.dat	upx
behavioral1/files/0x0005000000019431-176.dat	upx
behavioral1/files/0x00090000000162f0-124.dat	upx
behavioral1/files/0x000f0000000054a8-143.dat	upx
behavioral1/files/0x000500000001948a-190.dat	upx
behavioral1/files/0x00050000000186f7-185.dat	upx
behavioral1/files/0x000500000001944b-180.dat	upx
behavioral1/files/0x000500000001941e-172.dat	upx
behavioral1/files/0x00060000000175cc-167.dat	upx
behavioral1/files/0x00060000000173b8-165.dat	upx
behavioral1/files/0x000500000001938f-160.dat	upx
behavioral1/files/0x0009000000016d19-155.dat	upx
behavioral1/files/0x0005000000019354-151.dat	upx
behavioral1/files/0x000500000001927c-133.dat	upx
behavioral1/files/0x0006000000018bcd-113.dat	upx
behavioral1/files/0x0006000000018b00-106.dat	upx
behavioral1/files/0x000500000001872e-99.dat	upx
behavioral1/files/0x0005000000018736-97.dat	upx
behavioral1/files/0x000500000001871e-92.dat	upx
behavioral1/files/0x000500000001872a-88.dat	upx
behavioral1/files/0x0007000000016cdb-73.dat	upx
behavioral1/memory/304-68-0x000000013FEA0000-0x0000000140292000-memory.dmp	upx
behavioral1/memory/2748-67-0x000000013F810000-0x000000013FC02000-memory.dmp	upx
behavioral1/memory/2892-63-0x000000013F0A0000-0x000000013F492000-memory.dmp	upx
behavioral1/memory/2284-61-0x000000013F210000-0x000000013F602000-memory.dmp	upx
behavioral1/memory/2968-60-0x000000013FD00000-0x00000001400F2000-memory.dmp	upx
behavioral1/memory/2416-39-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	upx
behavioral1/files/0x0005000000019456-188.dat	upx
behavioral1/files/0x0007000000016c49-16.dat	upx
behavioral1/files/0x0005000000019412-170.dat	upx
behavioral1/files/0x0005000000019372-158.dat	upx
behavioral1/files/0x000500000001927e-142.dat	upx
behavioral1/files/0x000600000001902b-129.dat	upx
behavioral1/files/0x0006000000018bd2-121.dat	upx
behavioral1/files/0x0005000000018780-105.dat	upx
behavioral1/memory/2112-96-0x000000013F870000-0x000000013FC62000-memory.dmp	upx
behavioral1/memory/2808-87-0x000000013F530000-0x000000013F922000-memory.dmp	upx
behavioral1/files/0x00060000000175d0-80.dat	upx
behavioral1/files/0x0008000000016c5c-43.dat	upx
behavioral1/memory/2100-27-0x000000013F1A0000-0x000000013F592000-memory.dmp	upx
behavioral1/files/0x0007000000016cae-23.dat	upx
behavioral1/files/0x0008000000016610-13.dat	upx
behavioral1/memory/304-0-0x000000013F030000-0x000000013F422000-memory.dmp	upx
behavioral1/memory/2748-6152-0x000000013F810000-0x000000013FC02000-memory.dmp	upx
behavioral1/memory/2112-6162-0x000000013F870000-0x000000013FC62000-memory.dmp	upx
behavioral1/memory/1784-6171-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	upx
behavioral1/memory/2100-6170-0x000000013F1A0000-0x000000013F592000-memory.dmp	upx
behavioral1/memory/2892-6199-0x000000013F0A0000-0x000000013F492000-memory.dmp	upx
behavioral1/memory/2808-6192-0x000000013F530000-0x000000013F922000-memory.dmp	upx
behavioral1/memory/2420-6189-0x000000013FF50000-0x0000000140342000-memory.dmp	upx
behavioral1/memory/2968-6174-0x000000013FD00000-0x00000001400F2000-memory.dmp	upx
behavioral1/memory/2284-6188-0x000000013F210000-0x000000013F602000-memory.dmp	upx
behavioral1/memory/2416-6185-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\bniGOcK.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\hDtdXSl.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\WkrrjYw.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\NIdwSwV.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\UwtdDVt.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\hGheMCA.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\BfFaVTJ.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\oSxLcYJ.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\AhZTrGV.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\hyoWNbO.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\saVmxpb.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\NvmeDHb.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\ZdpeJpc.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\kVMGIeI.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\aZoRbLN.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\kuWbnDo.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\bBcymWj.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\RPKcuYe.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\QVwCnMW.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\FgdHVqJ.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\BglJeFV.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\wSfJReP.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\UfAGxCb.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\qQmxIFS.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\SuiUHBj.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\BwUVMhG.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\SfzMvjh.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\xTFppNA.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\EanvYPd.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\rYBICYD.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\GEsQMUz.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\FtbPOIx.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\TNKArTD.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\JuXRJsI.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\ErjtQml.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\yiEGPhL.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\iSLOlUX.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\sVisnRJ.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\wSLYgpl.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\AqAqBtL.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\rpazDtY.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\mhPINGh.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\VjTXcJD.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\rzjwWPu.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\dlUIfED.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\MzEGtRq.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\uAeLYhX.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\rcvefZv.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\XDnwmCY.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\QjWnjhW.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\oqnepjq.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\tqgbvhs.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\EWRZIKn.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\LzsIqUA.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\TMMTEeb.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\dLxblMm.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\bOjVcwD.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\BPREPTK.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\dLAXfMU.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\FhpnGln.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\AXUaEWb.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\vbKGcyY.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\dAKELun.exe	afea276ea4da6b808e2b73e1aa416df0N.exe
File created	C:\Windows\System\GqTYNYS.exe	afea276ea4da6b808e2b73e1aa416df0N.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2108	mhPINGh.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2176	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	304	afea276ea4da6b808e2b73e1aa416df0N.exe
Token: SeLockMemoryPrivilege	304	afea276ea4da6b808e2b73e1aa416df0N.exe
Token: SeDebugPrivilege	2176	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 304 wrote to memory of 2176	304	afea276ea4da6b808e2b73e1aa416df0N.exe	31
PID 304 wrote to memory of 2176	304	afea276ea4da6b808e2b73e1aa416df0N.exe	31
PID 304 wrote to memory of 2176	304	afea276ea4da6b808e2b73e1aa416df0N.exe	31
PID 304 wrote to memory of 2100	304	afea276ea4da6b808e2b73e1aa416df0N.exe	32
PID 304 wrote to memory of 2100	304	afea276ea4da6b808e2b73e1aa416df0N.exe	32
PID 304 wrote to memory of 2100	304	afea276ea4da6b808e2b73e1aa416df0N.exe	32
PID 304 wrote to memory of 2416	304	afea276ea4da6b808e2b73e1aa416df0N.exe	33
PID 304 wrote to memory of 2416	304	afea276ea4da6b808e2b73e1aa416df0N.exe	33
PID 304 wrote to memory of 2416	304	afea276ea4da6b808e2b73e1aa416df0N.exe	33
PID 304 wrote to memory of 2420	304	afea276ea4da6b808e2b73e1aa416df0N.exe	34
PID 304 wrote to memory of 2420	304	afea276ea4da6b808e2b73e1aa416df0N.exe	34
PID 304 wrote to memory of 2420	304	afea276ea4da6b808e2b73e1aa416df0N.exe	34
PID 304 wrote to memory of 2284	304	afea276ea4da6b808e2b73e1aa416df0N.exe	35
PID 304 wrote to memory of 2284	304	afea276ea4da6b808e2b73e1aa416df0N.exe	35
PID 304 wrote to memory of 2284	304	afea276ea4da6b808e2b73e1aa416df0N.exe	35
PID 304 wrote to memory of 1784	304	afea276ea4da6b808e2b73e1aa416df0N.exe	36
PID 304 wrote to memory of 1784	304	afea276ea4da6b808e2b73e1aa416df0N.exe	36
PID 304 wrote to memory of 1784	304	afea276ea4da6b808e2b73e1aa416df0N.exe	36
PID 304 wrote to memory of 2808	304	afea276ea4da6b808e2b73e1aa416df0N.exe	37
PID 304 wrote to memory of 2808	304	afea276ea4da6b808e2b73e1aa416df0N.exe	37
PID 304 wrote to memory of 2808	304	afea276ea4da6b808e2b73e1aa416df0N.exe	37
PID 304 wrote to memory of 2968	304	afea276ea4da6b808e2b73e1aa416df0N.exe	38
PID 304 wrote to memory of 2968	304	afea276ea4da6b808e2b73e1aa416df0N.exe	38
PID 304 wrote to memory of 2968	304	afea276ea4da6b808e2b73e1aa416df0N.exe	38
PID 304 wrote to memory of 2456	304	afea276ea4da6b808e2b73e1aa416df0N.exe	39
PID 304 wrote to memory of 2456	304	afea276ea4da6b808e2b73e1aa416df0N.exe	39
PID 304 wrote to memory of 2456	304	afea276ea4da6b808e2b73e1aa416df0N.exe	39
PID 304 wrote to memory of 2748	304	afea276ea4da6b808e2b73e1aa416df0N.exe	40
PID 304 wrote to memory of 2748	304	afea276ea4da6b808e2b73e1aa416df0N.exe	40
PID 304 wrote to memory of 2748	304	afea276ea4da6b808e2b73e1aa416df0N.exe	40
PID 304 wrote to memory of 2928	304	afea276ea4da6b808e2b73e1aa416df0N.exe	41
PID 304 wrote to memory of 2928	304	afea276ea4da6b808e2b73e1aa416df0N.exe	41
PID 304 wrote to memory of 2928	304	afea276ea4da6b808e2b73e1aa416df0N.exe	41
PID 304 wrote to memory of 2892	304	afea276ea4da6b808e2b73e1aa416df0N.exe	42
PID 304 wrote to memory of 2892	304	afea276ea4da6b808e2b73e1aa416df0N.exe	42
PID 304 wrote to memory of 2892	304	afea276ea4da6b808e2b73e1aa416df0N.exe	42
PID 304 wrote to memory of 2604	304	afea276ea4da6b808e2b73e1aa416df0N.exe	43
PID 304 wrote to memory of 2604	304	afea276ea4da6b808e2b73e1aa416df0N.exe	43
PID 304 wrote to memory of 2604	304	afea276ea4da6b808e2b73e1aa416df0N.exe	43
PID 304 wrote to memory of 2112	304	afea276ea4da6b808e2b73e1aa416df0N.exe	44
PID 304 wrote to memory of 2112	304	afea276ea4da6b808e2b73e1aa416df0N.exe	44
PID 304 wrote to memory of 2112	304	afea276ea4da6b808e2b73e1aa416df0N.exe	44
PID 304 wrote to memory of 464	304	afea276ea4da6b808e2b73e1aa416df0N.exe	45
PID 304 wrote to memory of 464	304	afea276ea4da6b808e2b73e1aa416df0N.exe	45
PID 304 wrote to memory of 464	304	afea276ea4da6b808e2b73e1aa416df0N.exe	45
PID 304 wrote to memory of 2920	304	afea276ea4da6b808e2b73e1aa416df0N.exe	46
PID 304 wrote to memory of 2920	304	afea276ea4da6b808e2b73e1aa416df0N.exe	46
PID 304 wrote to memory of 2920	304	afea276ea4da6b808e2b73e1aa416df0N.exe	46
PID 304 wrote to memory of 1676	304	afea276ea4da6b808e2b73e1aa416df0N.exe	47
PID 304 wrote to memory of 1676	304	afea276ea4da6b808e2b73e1aa416df0N.exe	47
PID 304 wrote to memory of 1676	304	afea276ea4da6b808e2b73e1aa416df0N.exe	47
PID 304 wrote to memory of 1956	304	afea276ea4da6b808e2b73e1aa416df0N.exe	48
PID 304 wrote to memory of 1956	304	afea276ea4da6b808e2b73e1aa416df0N.exe	48
PID 304 wrote to memory of 1956	304	afea276ea4da6b808e2b73e1aa416df0N.exe	48
PID 304 wrote to memory of 2672	304	afea276ea4da6b808e2b73e1aa416df0N.exe	49
PID 304 wrote to memory of 2672	304	afea276ea4da6b808e2b73e1aa416df0N.exe	49
PID 304 wrote to memory of 2672	304	afea276ea4da6b808e2b73e1aa416df0N.exe	49
PID 304 wrote to memory of 1120	304	afea276ea4da6b808e2b73e1aa416df0N.exe	50
PID 304 wrote to memory of 1120	304	afea276ea4da6b808e2b73e1aa416df0N.exe	50
PID 304 wrote to memory of 1120	304	afea276ea4da6b808e2b73e1aa416df0N.exe	50
PID 304 wrote to memory of 1264	304	afea276ea4da6b808e2b73e1aa416df0N.exe	51
PID 304 wrote to memory of 1264	304	afea276ea4da6b808e2b73e1aa416df0N.exe	51
PID 304 wrote to memory of 1264	304	afea276ea4da6b808e2b73e1aa416df0N.exe	51
PID 304 wrote to memory of 2860	304	afea276ea4da6b808e2b73e1aa416df0N.exe	52

C:\Users\Admin\AppData\Local\Temp\afea276ea4da6b808e2b73e1aa416df0N.exe
"C:\Users\Admin\AppData\Local\Temp\afea276ea4da6b808e2b73e1aa416df0N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2176
- C:\Windows\System\lLOOFIX.exe
  C:\Windows\System\lLOOFIX.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\gYXQJZL.exe
  C:\Windows\System\gYXQJZL.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\LKXdQNV.exe
  C:\Windows\System\LKXdQNV.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\TtTgIbY.exe
  C:\Windows\System\TtTgIbY.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\RUlOiru.exe
  C:\Windows\System\RUlOiru.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\ZdidFXv.exe
  C:\Windows\System\ZdidFXv.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\mOqYzLs.exe
  C:\Windows\System\mOqYzLs.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\xGvIOnO.exe
  C:\Windows\System\xGvIOnO.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\accGxUi.exe
  C:\Windows\System\accGxUi.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\cEelLzc.exe
  C:\Windows\System\cEelLzc.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\jQyNSTu.exe
  C:\Windows\System\jQyNSTu.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\mfIPLWC.exe
  C:\Windows\System\mfIPLWC.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\QjWnjhW.exe
  C:\Windows\System\QjWnjhW.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\WseXjmf.exe
  C:\Windows\System\WseXjmf.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\MKtCMZL.exe
  C:\Windows\System\MKtCMZL.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\fvZbLQK.exe
  C:\Windows\System\fvZbLQK.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\DNpWGJE.exe
  C:\Windows\System\DNpWGJE.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\dLAXfMU.exe
  C:\Windows\System\dLAXfMU.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\MPwKGRV.exe
  C:\Windows\System\MPwKGRV.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\AGVNhmg.exe
  C:\Windows\System\AGVNhmg.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\pSIbWBW.exe
  C:\Windows\System\pSIbWBW.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\MoNSLVo.exe
  C:\Windows\System\MoNSLVo.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\WgszdBo.exe
  C:\Windows\System\WgszdBo.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\fLbVhwu.exe
  C:\Windows\System\fLbVhwu.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\XVmEQHr.exe
  C:\Windows\System\XVmEQHr.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\rxPKzkD.exe
  C:\Windows\System\rxPKzkD.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\FfDkHJv.exe
  C:\Windows\System\FfDkHJv.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\nFjSVUX.exe
  C:\Windows\System\nFjSVUX.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\ljuemmX.exe
  C:\Windows\System\ljuemmX.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\RufnsfU.exe
  C:\Windows\System\RufnsfU.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\MhdqoMm.exe
  C:\Windows\System\MhdqoMm.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\NqNkgWz.exe
  C:\Windows\System\NqNkgWz.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\KwHaJnw.exe
  C:\Windows\System\KwHaJnw.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\rHwFkXG.exe
  C:\Windows\System\rHwFkXG.exe
  2⤵
  - Executes dropped EXE
  PID:268
- C:\Windows\System\FIrHGNS.exe
  C:\Windows\System\FIrHGNS.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\mpVeWVj.exe
  C:\Windows\System\mpVeWVj.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\CYhSuFO.exe
  C:\Windows\System\CYhSuFO.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\MjONxTD.exe
  C:\Windows\System\MjONxTD.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\bcygwRg.exe
  C:\Windows\System\bcygwRg.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\oszUHtW.exe
  C:\Windows\System\oszUHtW.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\QoFyUGS.exe
  C:\Windows\System\QoFyUGS.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\jSCCYtB.exe
  C:\Windows\System\jSCCYtB.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\FDjmfth.exe
  C:\Windows\System\FDjmfth.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\TlsFJuX.exe
  C:\Windows\System\TlsFJuX.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\LRWkFRz.exe
  C:\Windows\System\LRWkFRz.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\qvgQtXJ.exe
  C:\Windows\System\qvgQtXJ.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\VFvkZFA.exe
  C:\Windows\System\VFvkZFA.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\WWURkhh.exe
  C:\Windows\System\WWURkhh.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\vtcklZd.exe
  C:\Windows\System\vtcklZd.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\DQMKcKq.exe
  C:\Windows\System\DQMKcKq.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\efPqKOP.exe
  C:\Windows\System\efPqKOP.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\DaaOemT.exe
  C:\Windows\System\DaaOemT.exe
  2⤵
  PID:2804
- C:\Windows\System\siLbgUa.exe
  C:\Windows\System\siLbgUa.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\Ohuzlqj.exe
  C:\Windows\System\Ohuzlqj.exe
  2⤵
  PID:1588
- C:\Windows\System\DETapgI.exe
  C:\Windows\System\DETapgI.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\oCyELCe.exe
  C:\Windows\System\oCyELCe.exe
  2⤵
  PID:2896
- C:\Windows\System\aZTbgzd.exe
  C:\Windows\System\aZTbgzd.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\HatbUHz.exe
  C:\Windows\System\HatbUHz.exe
  2⤵
  PID:2568
- C:\Windows\System\vkRdkzg.exe
  C:\Windows\System\vkRdkzg.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\ayrWERl.exe
  C:\Windows\System\ayrWERl.exe
  2⤵
  PID:2220
- C:\Windows\System\inOVijY.exe
  C:\Windows\System\inOVijY.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\NHYRJDW.exe
  C:\Windows\System\NHYRJDW.exe
  2⤵
  PID:2316
- C:\Windows\System\jDUusRi.exe
  C:\Windows\System\jDUusRi.exe
  2⤵
  - Executes dropped EXE
  PID:292
- C:\Windows\System\WUTSGcV.exe
  C:\Windows\System\WUTSGcV.exe
  2⤵
  PID:1544
- C:\Windows\System\Wssrqiu.exe
  C:\Windows\System\Wssrqiu.exe
  2⤵
  - Executes dropped EXE
  PID:264
- C:\Windows\System\gDJHfmm.exe
  C:\Windows\System\gDJHfmm.exe
  2⤵
  PID:2764
- C:\Windows\System\NSeqvZB.exe
  C:\Windows\System\NSeqvZB.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\YdoYCvl.exe
  C:\Windows\System\YdoYCvl.exe
  2⤵
  PID:3104
- C:\Windows\System\XcwiJrg.exe
  C:\Windows\System\XcwiJrg.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\OcOxOXy.exe
  C:\Windows\System\OcOxOXy.exe
  2⤵
  PID:3144
- C:\Windows\System\uYGnVPX.exe
  C:\Windows\System\uYGnVPX.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\FQdJuue.exe
  C:\Windows\System\FQdJuue.exe
  2⤵
  PID:3180
- C:\Windows\System\GhfhxtX.exe
  C:\Windows\System\GhfhxtX.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\AmWuDRl.exe
  C:\Windows\System\AmWuDRl.exe
  2⤵
  PID:3220
- C:\Windows\System\zweAjPF.exe
  C:\Windows\System\zweAjPF.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\KGwrzsV.exe
  C:\Windows\System\KGwrzsV.exe
  2⤵
  PID:3256
- C:\Windows\System\UgWubiu.exe
  C:\Windows\System\UgWubiu.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\FrFDeRg.exe
  C:\Windows\System\FrFDeRg.exe
  2⤵
  PID:3300
- C:\Windows\System\eOYIXni.exe
  C:\Windows\System\eOYIXni.exe
  2⤵
  PID:3404
- C:\Windows\System\nXXKugu.exe
  C:\Windows\System\nXXKugu.exe
  2⤵
  PID:3424
- C:\Windows\System\LfRVmQL.exe
  C:\Windows\System\LfRVmQL.exe
  2⤵
  PID:3444
- C:\Windows\System\YripeqR.exe
  C:\Windows\System\YripeqR.exe
  2⤵
  PID:3460
- C:\Windows\System\bWpKwxJ.exe
  C:\Windows\System\bWpKwxJ.exe
  2⤵
  PID:3480
- C:\Windows\System\rYCyntw.exe
  C:\Windows\System\rYCyntw.exe
  2⤵
  PID:3500
- C:\Windows\System\sXfdylO.exe
  C:\Windows\System\sXfdylO.exe
  2⤵
  PID:3528
- C:\Windows\System\pwOPumQ.exe
  C:\Windows\System\pwOPumQ.exe
  2⤵
  PID:3548
- C:\Windows\System\XAzYngE.exe
  C:\Windows\System\XAzYngE.exe
  2⤵
  PID:3572
- C:\Windows\System\ypSdlYh.exe
  C:\Windows\System\ypSdlYh.exe
  2⤵
  PID:3592
- C:\Windows\System\EUcmQui.exe
  C:\Windows\System\EUcmQui.exe
  2⤵
  PID:3612
- C:\Windows\System\eOBrBhc.exe
  C:\Windows\System\eOBrBhc.exe
  2⤵
  PID:3628
- C:\Windows\System\hSQPmXl.exe
  C:\Windows\System\hSQPmXl.exe
  2⤵
  PID:3648
- C:\Windows\System\QhSNUfT.exe
  C:\Windows\System\QhSNUfT.exe
  2⤵
  PID:3664
- C:\Windows\System\eULDbhe.exe
  C:\Windows\System\eULDbhe.exe
  2⤵
  PID:3684
- C:\Windows\System\iKRbuLO.exe
  C:\Windows\System\iKRbuLO.exe
  2⤵
  PID:3700
- C:\Windows\System\SGdeGfK.exe
  C:\Windows\System\SGdeGfK.exe
  2⤵
  PID:3736
- C:\Windows\System\XaXojut.exe
  C:\Windows\System\XaXojut.exe
  2⤵
  PID:3752
- C:\Windows\System\ccDhldW.exe
  C:\Windows\System\ccDhldW.exe
  2⤵
  PID:3772
- C:\Windows\System\fvZfRtw.exe
  C:\Windows\System\fvZfRtw.exe
  2⤵
  PID:3788
- C:\Windows\System\Gosqhet.exe
  C:\Windows\System\Gosqhet.exe
  2⤵
  PID:3812
- C:\Windows\System\kgDwCKn.exe
  C:\Windows\System\kgDwCKn.exe
  2⤵
  PID:3828
- C:\Windows\System\BHyjXAK.exe
  C:\Windows\System\BHyjXAK.exe
  2⤵
  PID:3848
- C:\Windows\System\mtrqcPl.exe
  C:\Windows\System\mtrqcPl.exe
  2⤵
  PID:3864
- C:\Windows\System\HWbujkN.exe
  C:\Windows\System\HWbujkN.exe
  2⤵
  PID:3900
- C:\Windows\System\qqdFGNx.exe
  C:\Windows\System\qqdFGNx.exe
  2⤵
  PID:3916
- C:\Windows\System\MvjdVZk.exe
  C:\Windows\System\MvjdVZk.exe
  2⤵
  PID:3940
- C:\Windows\System\HbfsmqV.exe
  C:\Windows\System\HbfsmqV.exe
  2⤵
  PID:3956
- C:\Windows\System\iNzDucF.exe
  C:\Windows\System\iNzDucF.exe
  2⤵
  PID:3976
- C:\Windows\System\mBdhaZq.exe
  C:\Windows\System\mBdhaZq.exe
  2⤵
  PID:3992
- C:\Windows\System\NWlyREr.exe
  C:\Windows\System\NWlyREr.exe
  2⤵
  PID:4012
- C:\Windows\System\FbrMYAr.exe
  C:\Windows\System\FbrMYAr.exe
  2⤵
  PID:4028
- C:\Windows\System\ENkzvPi.exe
  C:\Windows\System\ENkzvPi.exe
  2⤵
  PID:4060
- C:\Windows\System\KJbtVkT.exe
  C:\Windows\System\KJbtVkT.exe
  2⤵
  PID:4080
- C:\Windows\System\BSOFzRL.exe
  C:\Windows\System\BSOFzRL.exe
  2⤵
  PID:2736
- C:\Windows\System\tNGzqZs.exe
  C:\Windows\System\tNGzqZs.exe
  2⤵
  PID:2508
- C:\Windows\System\TKDSkXE.exe
  C:\Windows\System\TKDSkXE.exe
  2⤵
  PID:992
- C:\Windows\System\TUAsHHe.exe
  C:\Windows\System\TUAsHHe.exe
  2⤵
  PID:1332
- C:\Windows\System\ThfhFrU.exe
  C:\Windows\System\ThfhFrU.exe
  2⤵
  PID:2356
- C:\Windows\System\wQKaeoa.exe
  C:\Windows\System\wQKaeoa.exe
  2⤵
  PID:3096
- C:\Windows\System\rESPzda.exe
  C:\Windows\System\rESPzda.exe
  2⤵
  PID:3176
- C:\Windows\System\RBZvLMh.exe
  C:\Windows\System\RBZvLMh.exe
  2⤵
  PID:3248
- C:\Windows\System\bCNssEp.exe
  C:\Windows\System\bCNssEp.exe
  2⤵
  PID:876
- C:\Windows\System\WlMEnTH.exe
  C:\Windows\System\WlMEnTH.exe
  2⤵
  PID:2692
- C:\Windows\System\wFbtooR.exe
  C:\Windows\System\wFbtooR.exe
  2⤵
  PID:3060
- C:\Windows\System\OMHRrzm.exe
  C:\Windows\System\OMHRrzm.exe
  2⤵
  PID:2832
- C:\Windows\System\ukZFaXH.exe
  C:\Windows\System\ukZFaXH.exe
  2⤵
  PID:2052
- C:\Windows\System\RNakDuV.exe
  C:\Windows\System\RNakDuV.exe
  2⤵
  PID:2096
- C:\Windows\System\nwDnAwZ.exe
  C:\Windows\System\nwDnAwZ.exe
  2⤵
  PID:932
- C:\Windows\System\wTtjeMl.exe
  C:\Windows\System\wTtjeMl.exe
  2⤵
  PID:1680
- C:\Windows\System\lDighlr.exe
  C:\Windows\System\lDighlr.exe
  2⤵
  PID:564
- C:\Windows\System\GTFErJc.exe
  C:\Windows\System\GTFErJc.exe
  2⤵
  PID:1148
- C:\Windows\System\FWaEKcU.exe
  C:\Windows\System\FWaEKcU.exe
  2⤵
  PID:892
- C:\Windows\System\XjAdgJI.exe
  C:\Windows\System\XjAdgJI.exe
  2⤵
  PID:1212
- C:\Windows\System\zJmwgxi.exe
  C:\Windows\System\zJmwgxi.exe
  2⤵
  PID:3192
- C:\Windows\System\elJwYAM.exe
  C:\Windows\System\elJwYAM.exe
  2⤵
  PID:3276
- C:\Windows\System\tQPkxUB.exe
  C:\Windows\System\tQPkxUB.exe
  2⤵
  PID:3320
- C:\Windows\System\uiSMgrt.exe
  C:\Windows\System\uiSMgrt.exe
  2⤵
  PID:3340
- C:\Windows\System\VqOvbbu.exe
  C:\Windows\System\VqOvbbu.exe
  2⤵
  PID:3416
- C:\Windows\System\tZMVCJD.exe
  C:\Windows\System\tZMVCJD.exe
  2⤵
  PID:3364
- C:\Windows\System\lpsiwhH.exe
  C:\Windows\System\lpsiwhH.exe
  2⤵
  PID:3384
- C:\Windows\System\ZHNqtyS.exe
  C:\Windows\System\ZHNqtyS.exe
  2⤵
  PID:3236
- C:\Windows\System\gEoCSrG.exe
  C:\Windows\System\gEoCSrG.exe
  2⤵
  PID:3156
- C:\Windows\System\scAzFsS.exe
  C:\Windows\System\scAzFsS.exe
  2⤵
  PID:3084
- C:\Windows\System\DSzqDtI.exe
  C:\Windows\System\DSzqDtI.exe
  2⤵
  PID:1380
- C:\Windows\System\YMPOAma.exe
  C:\Windows\System\YMPOAma.exe
  2⤵
  PID:1060
- C:\Windows\System\fzZgbIF.exe
  C:\Windows\System\fzZgbIF.exe
  2⤵
  PID:1564
- C:\Windows\System\IgrsPbb.exe
  C:\Windows\System\IgrsPbb.exe
  2⤵
  PID:1920
- C:\Windows\System\nZnJpLC.exe
  C:\Windows\System\nZnJpLC.exe
  2⤵
  PID:2216
- C:\Windows\System\ABGGueG.exe
  C:\Windows\System\ABGGueG.exe
  2⤵
  PID:3400
- C:\Windows\System\RMYIAsq.exe
  C:\Windows\System\RMYIAsq.exe
  2⤵
  PID:3476
- C:\Windows\System\JaEgiwS.exe
  C:\Windows\System\JaEgiwS.exe
  2⤵
  PID:3588
- C:\Windows\System\LJPRNPD.exe
  C:\Windows\System\LJPRNPD.exe
  2⤵
  PID:3520
- C:\Windows\System\VRrmIvv.exe
  C:\Windows\System\VRrmIvv.exe
  2⤵
  PID:3656
- C:\Windows\System\AWGjJqC.exe
  C:\Windows\System\AWGjJqC.exe
  2⤵
  PID:3600
- C:\Windows\System\WDpdlIa.exe
  C:\Windows\System\WDpdlIa.exe
  2⤵
  PID:2888
- C:\Windows\System\SJPwMXc.exe
  C:\Windows\System\SJPwMXc.exe
  2⤵
  PID:3784
- C:\Windows\System\vvyjdEC.exe
  C:\Windows\System\vvyjdEC.exe
  2⤵
  PID:3712
- C:\Windows\System\huFOLrd.exe
  C:\Windows\System\huFOLrd.exe
  2⤵
  PID:3728
- C:\Windows\System\hSLOthW.exe
  C:\Windows\System\hSLOthW.exe
  2⤵
  PID:2224
- C:\Windows\System\LSGOYmg.exe
  C:\Windows\System\LSGOYmg.exe
  2⤵
  PID:3952
- C:\Windows\System\pvfKZSn.exe
  C:\Windows\System\pvfKZSn.exe
  2⤵
  PID:3844
- C:\Windows\System\BznXSIf.exe
  C:\Windows\System\BznXSIf.exe
  2⤵
  PID:3984
- C:\Windows\System\vfEKKdf.exe
  C:\Windows\System\vfEKKdf.exe
  2⤵
  PID:3896
- C:\Windows\System\EATvbyd.exe
  C:\Windows\System\EATvbyd.exe
  2⤵
  PID:3932
- C:\Windows\System\lqKmIYV.exe
  C:\Windows\System\lqKmIYV.exe
  2⤵
  PID:4072
- C:\Windows\System\pSMiMJP.exe
  C:\Windows\System\pSMiMJP.exe
  2⤵
  PID:2516
- C:\Windows\System\cSAnogi.exe
  C:\Windows\System\cSAnogi.exe
  2⤵
  PID:4004
- C:\Windows\System\SYnnvLz.exe
  C:\Windows\System\SYnnvLz.exe
  2⤵
  PID:4048
- C:\Windows\System\qExqwsd.exe
  C:\Windows\System\qExqwsd.exe
  2⤵
  PID:3216
- C:\Windows\System\rpazDtY.exe
  C:\Windows\System\rpazDtY.exe
  2⤵
  PID:948
- C:\Windows\System\wACwKGR.exe
  C:\Windows\System\wACwKGR.exe
  2⤵
  PID:2348
- C:\Windows\System\dNuBkJa.exe
  C:\Windows\System\dNuBkJa.exe
  2⤵
  PID:2136
- C:\Windows\System\lnVUnKs.exe
  C:\Windows\System\lnVUnKs.exe
  2⤵
  PID:808
- C:\Windows\System\sLvdUmv.exe
  C:\Windows\System\sLvdUmv.exe
  2⤵
  PID:1572
- C:\Windows\System\HqDQkdW.exe
  C:\Windows\System\HqDQkdW.exe
  2⤵
  PID:2060
- C:\Windows\System\vwJDGyz.exe
  C:\Windows\System\vwJDGyz.exe
  2⤵
  PID:3272
- C:\Windows\System\dgEqpix.exe
  C:\Windows\System\dgEqpix.exe
  2⤵
  PID:1608
- C:\Windows\System\GZMJvBo.exe
  C:\Windows\System\GZMJvBo.exe
  2⤵
  PID:888
- C:\Windows\System\zKuNTbZ.exe
  C:\Windows\System\zKuNTbZ.exe
  2⤵
  PID:2844
- C:\Windows\System\RixPBbZ.exe
  C:\Windows\System\RixPBbZ.exe
  2⤵
  PID:3388
- C:\Windows\System\GITqYHn.exe
  C:\Windows\System\GITqYHn.exe
  2⤵
  PID:3112
- C:\Windows\System\oEhtpaf.exe
  C:\Windows\System\oEhtpaf.exe
  2⤵
  PID:2544
- C:\Windows\System\CBdxlCL.exe
  C:\Windows\System\CBdxlCL.exe
  2⤵
  PID:2944
- C:\Windows\System\bTtgyaK.exe
  C:\Windows\System\bTtgyaK.exe
  2⤵
  PID:3356
- C:\Windows\System\HhxnuYb.exe
  C:\Windows\System\HhxnuYb.exe
  2⤵
  PID:3120
- C:\Windows\System\zOTmGnj.exe
  C:\Windows\System\zOTmGnj.exe
  2⤵
  PID:3808
- C:\Windows\System\nAQXWtL.exe
  C:\Windows\System\nAQXWtL.exe
  2⤵
  PID:3440
- C:\Windows\System\uKAuoEB.exe
  C:\Windows\System\uKAuoEB.exe
  2⤵
  PID:2396
- C:\Windows\System\tMzTkKK.exe
  C:\Windows\System\tMzTkKK.exe
  2⤵
  PID:3692
- C:\Windows\System\UPfPuCS.exe
  C:\Windows\System\UPfPuCS.exe
  2⤵
  PID:3380
- C:\Windows\System\cFkjzie.exe
  C:\Windows\System\cFkjzie.exe
  2⤵
  PID:3488
- C:\Windows\System\dvLVVkS.exe
  C:\Windows\System\dvLVVkS.exe
  2⤵
  PID:3512
- C:\Windows\System\jvuxeTC.exe
  C:\Windows\System\jvuxeTC.exe
  2⤵
  PID:3604
- C:\Windows\System\AxEoVYO.exe
  C:\Windows\System\AxEoVYO.exe
  2⤵
  PID:3912
- C:\Windows\System\prniPiP.exe
  C:\Windows\System\prniPiP.exe
  2⤵
  PID:3824
- C:\Windows\System\lzoHnGI.exe
  C:\Windows\System\lzoHnGI.exe
  2⤵
  PID:3680
- C:\Windows\System\ycgkYTO.exe
  C:\Windows\System\ycgkYTO.exe
  2⤵
  PID:3908
- C:\Windows\System\nDhkStQ.exe
  C:\Windows\System\nDhkStQ.exe
  2⤵
  PID:2768
- C:\Windows\System\VNNDehn.exe
  C:\Windows\System\VNNDehn.exe
  2⤵
  PID:3168
- C:\Windows\System\kHDKRKI.exe
  C:\Windows\System\kHDKRKI.exe
  2⤵
  PID:3292
- C:\Windows\System\pdRkOjM.exe
  C:\Windows\System\pdRkOjM.exe
  2⤵
  PID:4000
- C:\Windows\System\UNgRutH.exe
  C:\Windows\System\UNgRutH.exe
  2⤵
  PID:2760
- C:\Windows\System\qlQFsFh.exe
  C:\Windows\System\qlQFsFh.exe
  2⤵
  PID:3456
- C:\Windows\System\oTHFXxm.exe
  C:\Windows\System\oTHFXxm.exe
  2⤵
  PID:3892
- C:\Windows\System\veWGzJJ.exe
  C:\Windows\System\veWGzJJ.exe
  2⤵
  PID:2372
- C:\Windows\System\muAgJJC.exe
  C:\Windows\System\muAgJJC.exe
  2⤵
  PID:3188
- C:\Windows\System\qgLDeDz.exe
  C:\Windows\System\qgLDeDz.exe
  2⤵
  PID:4020
- C:\Windows\System\DTGTMsv.exe
  C:\Windows\System\DTGTMsv.exe
  2⤵
  PID:1528
- C:\Windows\System\DOOounv.exe
  C:\Windows\System\DOOounv.exe
  2⤵
  PID:844
- C:\Windows\System\NCBGtcp.exe
  C:\Windows\System\NCBGtcp.exe
  2⤵
  PID:1864
- C:\Windows\System\KKapUmQ.exe
  C:\Windows\System\KKapUmQ.exe
  2⤵
  PID:2792
- C:\Windows\System\bdMFyNr.exe
  C:\Windows\System\bdMFyNr.exe
  2⤵
  PID:3332
- C:\Windows\System\NBbeuTy.exe
  C:\Windows\System\NBbeuTy.exe
  2⤵
  PID:2608
- C:\Windows\System\yKvlGta.exe
  C:\Windows\System\yKvlGta.exe
  2⤵
  PID:3232
- C:\Windows\System\QOthvyS.exe
  C:\Windows\System\QOthvyS.exe
  2⤵
  PID:2432
- C:\Windows\System\zWqRpDh.exe
  C:\Windows\System\zWqRpDh.exe
  2⤵
  PID:4068
- C:\Windows\System\dtDtfxS.exe
  C:\Windows\System\dtDtfxS.exe
  2⤵
  PID:4100
- C:\Windows\System\XzYoLrh.exe
  C:\Windows\System\XzYoLrh.exe
  2⤵
  PID:4116
- C:\Windows\System\sprtZOg.exe
  C:\Windows\System\sprtZOg.exe
  2⤵
  PID:4136
- C:\Windows\System\goBzJva.exe
  C:\Windows\System\goBzJva.exe
  2⤵
  PID:4152
- C:\Windows\System\OEehyNS.exe
  C:\Windows\System\OEehyNS.exe
  2⤵
  PID:4180
- C:\Windows\System\lZGPrAs.exe
  C:\Windows\System\lZGPrAs.exe
  2⤵
  PID:4196
- C:\Windows\System\UzSoZSA.exe
  C:\Windows\System\UzSoZSA.exe
  2⤵
  PID:4212
- C:\Windows\System\HMQlPOo.exe
  C:\Windows\System\HMQlPOo.exe
  2⤵
  PID:4232
- C:\Windows\System\ltdNSbx.exe
  C:\Windows\System\ltdNSbx.exe
  2⤵
  PID:4252
- C:\Windows\System\SMDVFkp.exe
  C:\Windows\System\SMDVFkp.exe
  2⤵
  PID:4268
- C:\Windows\System\dUOkRQG.exe
  C:\Windows\System\dUOkRQG.exe
  2⤵
  PID:4284
- C:\Windows\System\nVEJUBN.exe
  C:\Windows\System\nVEJUBN.exe
  2⤵
  PID:4300
- C:\Windows\System\uegoOOq.exe
  C:\Windows\System\uegoOOq.exe
  2⤵
  PID:4320
- C:\Windows\System\ZiBSXFv.exe
  C:\Windows\System\ZiBSXFv.exe
  2⤵
  PID:4336
- C:\Windows\System\klqoOWo.exe
  C:\Windows\System\klqoOWo.exe
  2⤵
  PID:4352
- C:\Windows\System\QIXQnLU.exe
  C:\Windows\System\QIXQnLU.exe
  2⤵
  PID:4368
- C:\Windows\System\PLPWOJQ.exe
  C:\Windows\System\PLPWOJQ.exe
  2⤵
  PID:4392
- C:\Windows\System\haBpaay.exe
  C:\Windows\System\haBpaay.exe
  2⤵
  PID:4408
- C:\Windows\System\DWnFKZJ.exe
  C:\Windows\System\DWnFKZJ.exe
  2⤵
  PID:4428
- C:\Windows\System\kMbtttr.exe
  C:\Windows\System\kMbtttr.exe
  2⤵
  PID:4444
- C:\Windows\System\ekGDCXA.exe
  C:\Windows\System\ekGDCXA.exe
  2⤵
  PID:4464
- C:\Windows\System\VhOGCGz.exe
  C:\Windows\System\VhOGCGz.exe
  2⤵
  PID:4480
- C:\Windows\System\ofeHyLE.exe
  C:\Windows\System\ofeHyLE.exe
  2⤵
  PID:4500
- C:\Windows\System\JdaOVpJ.exe
  C:\Windows\System\JdaOVpJ.exe
  2⤵
  PID:4516
- C:\Windows\System\ckYBsev.exe
  C:\Windows\System\ckYBsev.exe
  2⤵
  PID:4532
- C:\Windows\System\KHyRTlz.exe
  C:\Windows\System\KHyRTlz.exe
  2⤵
  PID:4548
- C:\Windows\System\DwANTnf.exe
  C:\Windows\System\DwANTnf.exe
  2⤵
  PID:4568
- C:\Windows\System\JChqpJG.exe
  C:\Windows\System\JChqpJG.exe
  2⤵
  PID:4584
- C:\Windows\System\wXtgHxC.exe
  C:\Windows\System\wXtgHxC.exe
  2⤵
  PID:4600
- C:\Windows\System\rwRnMaB.exe
  C:\Windows\System\rwRnMaB.exe
  2⤵
  PID:4620
- C:\Windows\System\eZJgoBq.exe
  C:\Windows\System\eZJgoBq.exe
  2⤵
  PID:4636
- C:\Windows\System\ilJIyUo.exe
  C:\Windows\System\ilJIyUo.exe
  2⤵
  PID:4652
- C:\Windows\System\ehMNILm.exe
  C:\Windows\System\ehMNILm.exe
  2⤵
  PID:4684
- C:\Windows\System\xMNSYyu.exe
  C:\Windows\System\xMNSYyu.exe
  2⤵
  PID:4708
- C:\Windows\System\NgvETav.exe
  C:\Windows\System\NgvETav.exe
  2⤵
  PID:4724
- C:\Windows\System\JIGaqvK.exe
  C:\Windows\System\JIGaqvK.exe
  2⤵
  PID:4740
- C:\Windows\System\PeHlihP.exe
  C:\Windows\System\PeHlihP.exe
  2⤵
  PID:4756
- C:\Windows\System\aCnOxUW.exe
  C:\Windows\System\aCnOxUW.exe
  2⤵
  PID:4772
- C:\Windows\System\ewzFbCd.exe
  C:\Windows\System\ewzFbCd.exe
  2⤵
  PID:4788
- C:\Windows\System\jNyhbYl.exe
  C:\Windows\System\jNyhbYl.exe
  2⤵
  PID:4804
- C:\Windows\System\UfFypMW.exe
  C:\Windows\System\UfFypMW.exe
  2⤵
  PID:4820
- C:\Windows\System\mePUyUH.exe
  C:\Windows\System\mePUyUH.exe
  2⤵
  PID:4836
- C:\Windows\System\KIIKnmK.exe
  C:\Windows\System\KIIKnmK.exe
  2⤵
  PID:4852
- C:\Windows\System\bUUBgCo.exe
  C:\Windows\System\bUUBgCo.exe
  2⤵
  PID:4868
- C:\Windows\System\IYpYxBu.exe
  C:\Windows\System\IYpYxBu.exe
  2⤵
  PID:4884
- C:\Windows\System\URTRHpv.exe
  C:\Windows\System\URTRHpv.exe
  2⤵
  PID:4900
- C:\Windows\System\vUwKezJ.exe
  C:\Windows\System\vUwKezJ.exe
  2⤵
  PID:4916
- C:\Windows\System\SIgfaQS.exe
  C:\Windows\System\SIgfaQS.exe
  2⤵
  PID:4936
- C:\Windows\System\UMGaHeo.exe
  C:\Windows\System\UMGaHeo.exe
  2⤵
  PID:4952
- C:\Windows\System\NTDrdMe.exe
  C:\Windows\System\NTDrdMe.exe
  2⤵
  PID:4968
- C:\Windows\System\BZPHNuz.exe
  C:\Windows\System\BZPHNuz.exe
  2⤵
  PID:4984
- C:\Windows\System\wpdmJhd.exe
  C:\Windows\System\wpdmJhd.exe
  2⤵
  PID:5000
- C:\Windows\System\EMDoiAq.exe
  C:\Windows\System\EMDoiAq.exe
  2⤵
  PID:5016
- C:\Windows\System\RAjAbLW.exe
  C:\Windows\System\RAjAbLW.exe
  2⤵
  PID:5032
- C:\Windows\System\HPnGoEt.exe
  C:\Windows\System\HPnGoEt.exe
  2⤵
  PID:5048
- C:\Windows\System\HgpLGot.exe
  C:\Windows\System\HgpLGot.exe
  2⤵
  PID:5064
- C:\Windows\System\LcXsnPT.exe
  C:\Windows\System\LcXsnPT.exe
  2⤵
  PID:5080
- C:\Windows\System\rPqwQRe.exe
  C:\Windows\System\rPqwQRe.exe
  2⤵
  PID:5096
- C:\Windows\System\wIPEIYS.exe
  C:\Windows\System\wIPEIYS.exe
  2⤵
  PID:5112
- C:\Windows\System\hNnadYE.exe
  C:\Windows\System\hNnadYE.exe
  2⤵
  PID:2924
- C:\Windows\System\pHPtDVI.exe
  C:\Windows\System\pHPtDVI.exe
  2⤵
  PID:3376
- C:\Windows\System\BYEwLhT.exe
  C:\Windows\System\BYEwLhT.exe
  2⤵
  PID:1604
- C:\Windows\System\WGPKZRI.exe
  C:\Windows\System\WGPKZRI.exe
  2⤵
  PID:1656
- C:\Windows\System\lhBFifo.exe
  C:\Windows\System\lhBFifo.exe
  2⤵
  PID:3016
- C:\Windows\System\TtgadpU.exe
  C:\Windows\System\TtgadpU.exe
  2⤵
  PID:4112
- C:\Windows\System\RPKcuYe.exe
  C:\Windows\System\RPKcuYe.exe
  2⤵
  PID:1484
- C:\Windows\System\GfrjEHK.exe
  C:\Windows\System\GfrjEHK.exe
  2⤵
  PID:4192
- C:\Windows\System\bFoDBgF.exe
  C:\Windows\System\bFoDBgF.exe
  2⤵
  PID:1816
- C:\Windows\System\UwSHlml.exe
  C:\Windows\System\UwSHlml.exe
  2⤵
  PID:4228
- C:\Windows\System\mcppdbf.exe
  C:\Windows\System\mcppdbf.exe
  2⤵
  PID:2976
- C:\Windows\System\tgAimdM.exe
  C:\Windows\System\tgAimdM.exe
  2⤵
  PID:4296
- C:\Windows\System\uJBfUXq.exe
  C:\Windows\System\uJBfUXq.exe
  2⤵
  PID:4364
- C:\Windows\System\KEJCiQY.exe
  C:\Windows\System\KEJCiQY.exe
  2⤵
  PID:4440
- C:\Windows\System\hwnjYYZ.exe
  C:\Windows\System\hwnjYYZ.exe
  2⤵
  PID:1752
- C:\Windows\System\cFJvwuY.exe
  C:\Windows\System\cFJvwuY.exe
  2⤵
  PID:1488
- C:\Windows\System\oLYtEbZ.exe
  C:\Windows\System\oLYtEbZ.exe
  2⤵
  PID:3624
- C:\Windows\System\BxzRxZl.exe
  C:\Windows\System\BxzRxZl.exe
  2⤵
  PID:3760
- C:\Windows\System\LzsIqUA.exe
  C:\Windows\System\LzsIqUA.exe
  2⤵
  PID:3308
- C:\Windows\System\gTockkF.exe
  C:\Windows\System\gTockkF.exe
  2⤵
  PID:1672
- C:\Windows\System\hPIlVgb.exe
  C:\Windows\System\hPIlVgb.exe
  2⤵
  PID:4040
- C:\Windows\System\krHrWRA.exe
  C:\Windows\System\krHrWRA.exe
  2⤵
  PID:2520
- C:\Windows\System\KdAWnnD.exe
  C:\Windows\System\KdAWnnD.exe
  2⤵
  PID:3012
- C:\Windows\System\mhPINGh.exe
  C:\Windows\System\mhPINGh.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2108
- C:\Windows\System\dZavVAM.exe
  C:\Windows\System\dZavVAM.exe
  2⤵
  PID:4544
- C:\Windows\System\rLzlmJi.exe
  C:\Windows\System\rLzlmJi.exe
  2⤵
  PID:3496
- C:\Windows\System\eLfMHQz.exe
  C:\Windows\System\eLfMHQz.exe
  2⤵
  PID:4576
- C:\Windows\System\hrNbUGf.exe
  C:\Windows\System\hrNbUGf.exe
  2⤵
  PID:3124
- C:\Windows\System\pcLkOFm.exe
  C:\Windows\System\pcLkOFm.exe
  2⤵
  PID:1860
- C:\Windows\System\IdeNuhK.exe
  C:\Windows\System\IdeNuhK.exe
  2⤵
  PID:3964
- C:\Windows\System\xEwZFPU.exe
  C:\Windows\System\xEwZFPU.exe
  2⤵
  PID:4160
- C:\Windows\System\oewyzzx.exe
  C:\Windows\System\oewyzzx.exe
  2⤵
  PID:4204
- C:\Windows\System\pzjSAWL.exe
  C:\Windows\System\pzjSAWL.exe
  2⤵
  PID:4244
- C:\Windows\System\yJwNPrb.exe
  C:\Windows\System\yJwNPrb.exe
  2⤵
  PID:4308
- C:\Windows\System\KNkXWmE.exe
  C:\Windows\System\KNkXWmE.exe
  2⤵
  PID:4348
- C:\Windows\System\akNShAr.exe
  C:\Windows\System\akNShAr.exe
  2⤵
  PID:4384
- C:\Windows\System\UNEYDnI.exe
  C:\Windows\System\UNEYDnI.exe
  2⤵
  PID:4424
- C:\Windows\System\euIsJYt.exe
  C:\Windows\System\euIsJYt.exe
  2⤵
  PID:4488
- C:\Windows\System\TsLyIJg.exe
  C:\Windows\System\TsLyIJg.exe
  2⤵
  PID:4528
- C:\Windows\System\gRYqsOb.exe
  C:\Windows\System\gRYqsOb.exe
  2⤵
  PID:4596
- C:\Windows\System\EHnfQwP.exe
  C:\Windows\System\EHnfQwP.exe
  2⤵
  PID:4628
- C:\Windows\System\NvzOmJT.exe
  C:\Windows\System\NvzOmJT.exe
  2⤵
  PID:4692
- C:\Windows\System\eRcHTIh.exe
  C:\Windows\System\eRcHTIh.exe
  2⤵
  PID:4732
- C:\Windows\System\PeRbFzS.exe
  C:\Windows\System\PeRbFzS.exe
  2⤵
  PID:4752
- C:\Windows\System\nxdKuJP.exe
  C:\Windows\System\nxdKuJP.exe
  2⤵
  PID:4796
- C:\Windows\System\hgLfXbz.exe
  C:\Windows\System\hgLfXbz.exe
  2⤵
  PID:4816
- C:\Windows\System\HiZTQMP.exe
  C:\Windows\System\HiZTQMP.exe
  2⤵
  PID:2228
- C:\Windows\System\naWERFh.exe
  C:\Windows\System\naWERFh.exe
  2⤵
  PID:4860
- C:\Windows\System\mmrngso.exe
  C:\Windows\System\mmrngso.exe
  2⤵
  PID:4892
- C:\Windows\System\hqWnfJr.exe
  C:\Windows\System\hqWnfJr.exe
  2⤵
  PID:4924
- C:\Windows\System\XcXUDzF.exe
  C:\Windows\System\XcXUDzF.exe
  2⤵
  PID:4948
- C:\Windows\System\AFckPOB.exe
  C:\Windows\System\AFckPOB.exe
  2⤵
  PID:4992
- C:\Windows\System\fcYXJHO.exe
  C:\Windows\System\fcYXJHO.exe
  2⤵
  PID:5012
- C:\Windows\System\cIiqjTM.exe
  C:\Windows\System\cIiqjTM.exe
  2⤵
  PID:5056
- C:\Windows\System\esbsScL.exe
  C:\Windows\System\esbsScL.exe
  2⤵
  PID:5088
- C:\Windows\System\GunvVjy.exe
  C:\Windows\System\GunvVjy.exe
  2⤵
  PID:5104
- C:\Windows\System\KMFYPmM.exe
  C:\Windows\System\KMFYPmM.exe
  2⤵
  PID:3780
- C:\Windows\System\AhInngp.exe
  C:\Windows\System\AhInngp.exe
  2⤵
  PID:1728
- C:\Windows\System\pPzRMPu.exe
  C:\Windows\System\pPzRMPu.exe
  2⤵
  PID:4144
- C:\Windows\System\PcGdKpq.exe
  C:\Windows\System\PcGdKpq.exe
  2⤵
  PID:4108
- C:\Windows\System\NnIISgR.exe
  C:\Windows\System\NnIISgR.exe
  2⤵
  PID:300
- C:\Windows\System\EjJNeZw.exe
  C:\Windows\System\EjJNeZw.exe
  2⤵
  PID:664
- C:\Windows\System\UPutpie.exe
  C:\Windows\System\UPutpie.exe
  2⤵
  PID:4292
- C:\Windows\System\szyMzwg.exe
  C:\Windows\System\szyMzwg.exe
  2⤵
  PID:2600
- C:\Windows\System\pSQOojO.exe
  C:\Windows\System\pSQOojO.exe
  2⤵
  PID:4508
- C:\Windows\System\IcAgyPQ.exe
  C:\Windows\System\IcAgyPQ.exe
  2⤵
  PID:3876
- C:\Windows\System\pXsobkk.exe
  C:\Windows\System\pXsobkk.exe
  2⤵
  PID:3860
- C:\Windows\System\TgZWUts.exe
  C:\Windows\System\TgZWUts.exe
  2⤵
  PID:532
- C:\Windows\System\nChwXoJ.exe
  C:\Windows\System\nChwXoJ.exe
  2⤵
  PID:2388
- C:\Windows\System\GDYYiwT.exe
  C:\Windows\System\GDYYiwT.exe
  2⤵
  PID:1064
- C:\Windows\System\ndYYKWh.exe
  C:\Windows\System\ndYYKWh.exe
  2⤵
  PID:1732
- C:\Windows\System\RShyaeV.exe
  C:\Windows\System\RShyaeV.exe
  2⤵
  PID:4128
- C:\Windows\System\UCyVwhU.exe
  C:\Windows\System\UCyVwhU.exe
  2⤵
  PID:4580
- C:\Windows\System\xbKwtpB.exe
  C:\Windows\System\xbKwtpB.exe
  2⤵
  PID:4316
- C:\Windows\System\VIawrIH.exe
  C:\Windows\System\VIawrIH.exe
  2⤵
  PID:4608
- C:\Windows\System\OnDkgIe.exe
  C:\Windows\System\OnDkgIe.exe
  2⤵
  PID:4496
- C:\Windows\System\kFWZOMe.exe
  C:\Windows\System\kFWZOMe.exe
  2⤵
  PID:4592
- C:\Windows\System\QHrpeDW.exe
  C:\Windows\System\QHrpeDW.exe
  2⤵
  PID:4660
- C:\Windows\System\YrMgRkw.exe
  C:\Windows\System\YrMgRkw.exe
  2⤵
  PID:4736
- C:\Windows\System\DnHnOWn.exe
  C:\Windows\System\DnHnOWn.exe
  2⤵
  PID:4812
- C:\Windows\System\ZhqPkvC.exe
  C:\Windows\System\ZhqPkvC.exe
  2⤵
  PID:4844
- C:\Windows\System\MviqONx.exe
  C:\Windows\System\MviqONx.exe
  2⤵
  PID:4928
- C:\Windows\System\zYFgMVo.exe
  C:\Windows\System\zYFgMVo.exe
  2⤵
  PID:4964
- C:\Windows\System\PviQYTI.exe
  C:\Windows\System\PviQYTI.exe
  2⤵
  PID:5060
- C:\Windows\System\ycFmoNk.exe
  C:\Windows\System\ycFmoNk.exe
  2⤵
  PID:1968
- C:\Windows\System\YMRhaos.exe
  C:\Windows\System\YMRhaos.exe
  2⤵
  PID:1188
- C:\Windows\System\uHnvEZB.exe
  C:\Windows\System\uHnvEZB.exe
  2⤵
  PID:2184
- C:\Windows\System\fgxpHdt.exe
  C:\Windows\System\fgxpHdt.exe
  2⤵
  PID:4332
- C:\Windows\System\jmvuwhB.exe
  C:\Windows\System\jmvuwhB.exe
  2⤵
  PID:3636
- C:\Windows\System\PmMkPnz.exe
  C:\Windows\System\PmMkPnz.exe
  2⤵
  PID:4044
- C:\Windows\System\gavIAaU.exe
  C:\Windows\System\gavIAaU.exe
  2⤵
  PID:4932
- C:\Windows\System\QuJtHBl.exe
  C:\Windows\System\QuJtHBl.exe
  2⤵
  PID:3540
- C:\Windows\System\uTVOgVh.exe
  C:\Windows\System\uTVOgVh.exe
  2⤵
  PID:1764
- C:\Windows\System\BupPXbs.exe
  C:\Windows\System\BupPXbs.exe
  2⤵
  PID:4276
- C:\Windows\System\EETEIYf.exe
  C:\Windows\System\EETEIYf.exe
  2⤵
  PID:2864
- C:\Windows\System\apuRFQr.exe
  C:\Windows\System\apuRFQr.exe
  2⤵
  PID:2956
- C:\Windows\System\rEbRaaQ.exe
  C:\Windows\System\rEbRaaQ.exe
  2⤵
  PID:1952
- C:\Windows\System\adrOgOL.exe
  C:\Windows\System\adrOgOL.exe
  2⤵
  PID:2908
- C:\Windows\System\imcMYvi.exe
  C:\Windows\System\imcMYvi.exe
  2⤵
  PID:2476
- C:\Windows\System\dlUIfED.exe
  C:\Windows\System\dlUIfED.exe
  2⤵
  PID:4456
- C:\Windows\System\BoIvWSb.exe
  C:\Windows\System\BoIvWSb.exe
  2⤵
  PID:4648
- C:\Windows\System\jvXZCRE.exe
  C:\Windows\System\jvXZCRE.exe
  2⤵
  PID:4800
- C:\Windows\System\AAhuNZE.exe
  C:\Windows\System\AAhuNZE.exe
  2⤵
  PID:4896
- C:\Windows\System\ETUigBr.exe
  C:\Windows\System\ETUigBr.exe
  2⤵
  PID:5040
- C:\Windows\System\yGtBtsk.exe
  C:\Windows\System\yGtBtsk.exe
  2⤵
  PID:3840
- C:\Windows\System\VnHHuWR.exe
  C:\Windows\System\VnHHuWR.exe
  2⤵
  PID:1812
- C:\Windows\System\rpIxIfI.exe
  C:\Windows\System\rpIxIfI.exe
  2⤵
  PID:3856
- C:\Windows\System\PqIZvkB.exe
  C:\Windows\System\PqIZvkB.exe
  2⤵
  PID:3336
- C:\Windows\System\XExeeLW.exe
  C:\Windows\System\XExeeLW.exe
  2⤵
  PID:2868
- C:\Windows\System\shWXoKf.exe
  C:\Windows\System\shWXoKf.exe
  2⤵
  PID:1944
- C:\Windows\System\jQTuzpI.exe
  C:\Windows\System\jQTuzpI.exe
  2⤵
  PID:848
- C:\Windows\System\hULgmrg.exe
  C:\Windows\System\hULgmrg.exe
  2⤵
  PID:4524
- C:\Windows\System\aFkwLOV.exe
  C:\Windows\System\aFkwLOV.exe
  2⤵
  PID:5128
- C:\Windows\System\erTuipj.exe
  C:\Windows\System\erTuipj.exe
  2⤵
  PID:5188
- C:\Windows\System\LXxkfbU.exe
  C:\Windows\System\LXxkfbU.exe
  2⤵
  PID:5224
- C:\Windows\System\hBgqdxb.exe
  C:\Windows\System\hBgqdxb.exe
  2⤵
  PID:5240
- C:\Windows\System\badQAHk.exe
  C:\Windows\System\badQAHk.exe
  2⤵
  PID:5256
- C:\Windows\System\SBjQezk.exe
  C:\Windows\System\SBjQezk.exe
  2⤵
  PID:5272
- C:\Windows\System\erCpYcr.exe
  C:\Windows\System\erCpYcr.exe
  2⤵
  PID:5288
- C:\Windows\System\bkOUtis.exe
  C:\Windows\System\bkOUtis.exe
  2⤵
  PID:5304
- C:\Windows\System\obwcfbT.exe
  C:\Windows\System\obwcfbT.exe
  2⤵
  PID:5320
- C:\Windows\System\rZRtwhL.exe
  C:\Windows\System\rZRtwhL.exe
  2⤵
  PID:5336
- C:\Windows\System\eSKwLxD.exe
  C:\Windows\System\eSKwLxD.exe
  2⤵
  PID:5352
- C:\Windows\System\aoGDGyx.exe
  C:\Windows\System\aoGDGyx.exe
  2⤵
  PID:5368
- C:\Windows\System\vsEUOJr.exe
  C:\Windows\System\vsEUOJr.exe
  2⤵
  PID:5384
- C:\Windows\System\KHWwRec.exe
  C:\Windows\System\KHWwRec.exe
  2⤵
  PID:5400
- C:\Windows\System\USymiZg.exe
  C:\Windows\System\USymiZg.exe
  2⤵
  PID:5416
- C:\Windows\System\oqnepjq.exe
  C:\Windows\System\oqnepjq.exe
  2⤵
  PID:5432
- C:\Windows\System\BQLPSIr.exe
  C:\Windows\System\BQLPSIr.exe
  2⤵
  PID:5448
- C:\Windows\System\WbVzVqb.exe
  C:\Windows\System\WbVzVqb.exe
  2⤵
  PID:5464
- C:\Windows\System\KfBKqhA.exe
  C:\Windows\System\KfBKqhA.exe
  2⤵
  PID:5480
- C:\Windows\System\fYbBNCv.exe
  C:\Windows\System\fYbBNCv.exe
  2⤵
  PID:5496
- C:\Windows\System\TjJYGqh.exe
  C:\Windows\System\TjJYGqh.exe
  2⤵
  PID:5512
- C:\Windows\System\mYKEGSe.exe
  C:\Windows\System\mYKEGSe.exe
  2⤵
  PID:5528
- C:\Windows\System\HiuUskS.exe
  C:\Windows\System\HiuUskS.exe
  2⤵
  PID:5544
- C:\Windows\System\OCljAHP.exe
  C:\Windows\System\OCljAHP.exe
  2⤵
  PID:5560
- C:\Windows\System\tjRIXIf.exe
  C:\Windows\System\tjRIXIf.exe
  2⤵
  PID:5576
- C:\Windows\System\JEGhBEU.exe
  C:\Windows\System\JEGhBEU.exe
  2⤵
  PID:5592
- C:\Windows\System\IRJJkhO.exe
  C:\Windows\System\IRJJkhO.exe
  2⤵
  PID:5608
- C:\Windows\System\CUlRDYL.exe
  C:\Windows\System\CUlRDYL.exe
  2⤵
  PID:5624
- C:\Windows\System\FTEnhud.exe
  C:\Windows\System\FTEnhud.exe
  2⤵
  PID:5640
- C:\Windows\System\ESvBRcl.exe
  C:\Windows\System\ESvBRcl.exe
  2⤵
  PID:5668
- C:\Windows\System\aAoJSaE.exe
  C:\Windows\System\aAoJSaE.exe
  2⤵
  PID:5684
- C:\Windows\System\wtDhGcf.exe
  C:\Windows\System\wtDhGcf.exe
  2⤵
  PID:5700
- C:\Windows\System\sYJiiia.exe
  C:\Windows\System\sYJiiia.exe
  2⤵
  PID:5716
- C:\Windows\System\mDxPglI.exe
  C:\Windows\System\mDxPglI.exe
  2⤵
  PID:5732
- C:\Windows\System\biIBMdB.exe
  C:\Windows\System\biIBMdB.exe
  2⤵
  PID:5748
- C:\Windows\System\tWogsHd.exe
  C:\Windows\System\tWogsHd.exe
  2⤵
  PID:5764
- C:\Windows\System\RUtahDX.exe
  C:\Windows\System\RUtahDX.exe
  2⤵
  PID:5780
- C:\Windows\System\UZOOpJI.exe
  C:\Windows\System\UZOOpJI.exe
  2⤵
  PID:5796
- C:\Windows\System\qbCgTsW.exe
  C:\Windows\System\qbCgTsW.exe
  2⤵
  PID:5892
- C:\Windows\System\hMAnIoS.exe
  C:\Windows\System\hMAnIoS.exe
  2⤵
  PID:5916
- C:\Windows\System\GMGzuBW.exe
  C:\Windows\System\GMGzuBW.exe
  2⤵
  PID:5944
- C:\Windows\System\GSthxeR.exe
  C:\Windows\System\GSthxeR.exe
  2⤵
  PID:5964
- C:\Windows\System\EqYOzyo.exe
  C:\Windows\System\EqYOzyo.exe
  2⤵
  PID:5980
- C:\Windows\System\DTxcQZJ.exe
  C:\Windows\System\DTxcQZJ.exe
  2⤵
  PID:6000
- C:\Windows\System\FMaEjDG.exe
  C:\Windows\System\FMaEjDG.exe
  2⤵
  PID:6024
- C:\Windows\System\AoDTsHb.exe
  C:\Windows\System\AoDTsHb.exe
  2⤵
  PID:6040
- C:\Windows\System\NZNjQvs.exe
  C:\Windows\System\NZNjQvs.exe
  2⤵
  PID:6064
- C:\Windows\System\mdGCTVh.exe
  C:\Windows\System\mdGCTVh.exe
  2⤵
  PID:6080
- C:\Windows\System\yyZIwoy.exe
  C:\Windows\System\yyZIwoy.exe
  2⤵
  PID:6104
- C:\Windows\System\uQafqRA.exe
  C:\Windows\System\uQafqRA.exe
  2⤵
  PID:6124
- C:\Windows\System\wwneBkl.exe
  C:\Windows\System\wwneBkl.exe
  2⤵
  PID:1720
- C:\Windows\System\GdwuOxg.exe
  C:\Windows\System\GdwuOxg.exe
  2⤵
  PID:2872
- C:\Windows\System\KqYmBeT.exe
  C:\Windows\System\KqYmBeT.exe
  2⤵
  PID:2148
- C:\Windows\System\CiYsFbj.exe
  C:\Windows\System\CiYsFbj.exe
  2⤵
  PID:5196
- C:\Windows\System\gSbiTOO.exe
  C:\Windows\System\gSbiTOO.exe
  2⤵
  PID:5028
- C:\Windows\System\pRBPyGw.exe
  C:\Windows\System\pRBPyGw.exe
  2⤵
  PID:5172
- C:\Windows\System\AyyFpKx.exe
  C:\Windows\System\AyyFpKx.exe
  2⤵
  PID:4540
- C:\Windows\System\BJrQjrB.exe
  C:\Windows\System\BJrQjrB.exe
  2⤵
  PID:5212
- C:\Windows\System\wWfddhk.exe
  C:\Windows\System\wWfddhk.exe
  2⤵
  PID:5156
- C:\Windows\System\DRbSzyj.exe
  C:\Windows\System\DRbSzyj.exe
  2⤵
  PID:5176
- C:\Windows\System\KiMCgBo.exe
  C:\Windows\System\KiMCgBo.exe
  2⤵
  PID:5252
- C:\Windows\System\gPfQciE.exe
  C:\Windows\System\gPfQciE.exe
  2⤵
  PID:5312
- C:\Windows\System\rsKRTvg.exe
  C:\Windows\System\rsKRTvg.exe
  2⤵
  PID:5344
- C:\Windows\System\VrWVnXH.exe
  C:\Windows\System\VrWVnXH.exe
  2⤵
  PID:5376
- C:\Windows\System\TUKGlSh.exe
  C:\Windows\System\TUKGlSh.exe
  2⤵
  PID:5360
- C:\Windows\System\FDkULpV.exe
  C:\Windows\System\FDkULpV.exe
  2⤵
  PID:5412
- C:\Windows\System\DTdmhSH.exe
  C:\Windows\System\DTdmhSH.exe
  2⤵
  PID:5396
- C:\Windows\System\JswDcNP.exe
  C:\Windows\System\JswDcNP.exe
  2⤵
  PID:5424
- C:\Windows\System\KwuMhTU.exe
  C:\Windows\System\KwuMhTU.exe
  2⤵
  PID:5636
- C:\Windows\System\JuSnZBY.exe
  C:\Windows\System\JuSnZBY.exe
  2⤵
  PID:5708
- C:\Windows\System\ZENBcpN.exe
  C:\Windows\System\ZENBcpN.exe
  2⤵
  PID:5772
- C:\Windows\System\xqTrkLO.exe
  C:\Windows\System\xqTrkLO.exe
  2⤵
  PID:5812
- C:\Windows\System\XbgWDuC.exe
  C:\Windows\System\XbgWDuC.exe
  2⤵
  PID:5492
- C:\Windows\System\eDyiLjG.exe
  C:\Windows\System\eDyiLjG.exe
  2⤵
  PID:5836
- C:\Windows\System\oiSVbbc.exe
  C:\Windows\System\oiSVbbc.exe
  2⤵
  PID:5852
- C:\Windows\System\AjumbMy.exe
  C:\Windows\System\AjumbMy.exe
  2⤵
  PID:5552
- C:\Windows\System\zRPrAOH.exe
  C:\Windows\System\zRPrAOH.exe
  2⤵
  PID:5588
- C:\Windows\System\VnxUbSx.exe
  C:\Windows\System\VnxUbSx.exe
  2⤵
  PID:5872
- C:\Windows\System\PvLrtjR.exe
  C:\Windows\System\PvLrtjR.exe
  2⤵
  PID:5616
- C:\Windows\System\GqLRupV.exe
  C:\Windows\System\GqLRupV.exe
  2⤵
  PID:5656
- C:\Windows\System\qnNdLUs.exe
  C:\Windows\System\qnNdLUs.exe
  2⤵
  PID:1984
- C:\Windows\System\bKCRyKb.exe
  C:\Windows\System\bKCRyKb.exe
  2⤵
  PID:2776
- C:\Windows\System\ULZpIRZ.exe
  C:\Windows\System\ULZpIRZ.exe
  2⤵
  PID:1540
- C:\Windows\System\PrZtqLH.exe
  C:\Windows\System\PrZtqLH.exe
  2⤵
  PID:760
- C:\Windows\System\rBFaCcP.exe
  C:\Windows\System\rBFaCcP.exe
  2⤵
  PID:2616
- C:\Windows\System\DnGhVWR.exe
  C:\Windows\System\DnGhVWR.exe
  2⤵
  PID:5904
- C:\Windows\System\PlkAyDB.exe
  C:\Windows\System\PlkAyDB.exe
  2⤵
  PID:5936
- C:\Windows\System\wSrZgcG.exe
  C:\Windows\System\wSrZgcG.exe
  2⤵
  PID:5760
- C:\Windows\System\wqvVYmW.exe
  C:\Windows\System\wqvVYmW.exe
  2⤵
  PID:5792
- C:\Windows\System\oQupHPF.exe
  C:\Windows\System\oQupHPF.exe
  2⤵
  PID:5988
- C:\Windows\System\kuKQTQC.exe
  C:\Windows\System\kuKQTQC.exe
  2⤵
  PID:5972
- C:\Windows\System\VogfHEZ.exe
  C:\Windows\System\VogfHEZ.exe
  2⤵
  PID:6016
- C:\Windows\System\qQmxIFS.exe
  C:\Windows\System\qQmxIFS.exe
  2⤵
  PID:6076
- C:\Windows\System\MPynmoA.exe
  C:\Windows\System\MPynmoA.exe
  2⤵
  PID:6056
- C:\Windows\System\GIpipcD.exe
  C:\Windows\System\GIpipcD.exe
  2⤵
  PID:6112
- C:\Windows\System\WJJRWOi.exe
  C:\Windows\System\WJJRWOi.exe
  2⤵
  PID:6120
- C:\Windows\System\XwzrsLy.exe
  C:\Windows\System\XwzrsLy.exe
  2⤵
  PID:2012
- C:\Windows\System\XKMvvGt.exe
  C:\Windows\System\XKMvvGt.exe
  2⤵
  PID:4360
- C:\Windows\System\UgFAYAa.exe
  C:\Windows\System\UgFAYAa.exe
  2⤵
  PID:2824
- C:\Windows\System\HEqTKfg.exe
  C:\Windows\System\HEqTKfg.exe
  2⤵
  PID:5284
- C:\Windows\System\gKaJidI.exe
  C:\Windows\System\gKaJidI.exe
  2⤵
  PID:5300
- C:\Windows\System\tqgbvhs.exe
  C:\Windows\System\tqgbvhs.exe
  2⤵
  PID:5216
- C:\Windows\System\AamIXfU.exe
  C:\Windows\System\AamIXfU.exe
  2⤵
  PID:5220
- C:\Windows\System\cRWWIFi.exe
  C:\Windows\System\cRWWIFi.exe
  2⤵
  PID:5268
- C:\Windows\System\SWkpzvb.exe
  C:\Windows\System\SWkpzvb.exe
  2⤵
  PID:5248
- C:\Windows\System\QOzrBqW.exe
  C:\Windows\System\QOzrBqW.exe
  2⤵
  PID:5804
- C:\Windows\System\tOQleYZ.exe
  C:\Windows\System\tOQleYZ.exe
  2⤵
  PID:5724
- C:\Windows\System\djVxxNP.exe
  C:\Windows\System\djVxxNP.exe
  2⤵
  PID:6012
- C:\Windows\System\XHwCAop.exe
  C:\Windows\System\XHwCAop.exe
  2⤵
  PID:6052
- C:\Windows\System\UbrAPOG.exe
  C:\Windows\System\UbrAPOG.exe
  2⤵
  PID:4172
- C:\Windows\System\mCkJpyP.exe
  C:\Windows\System\mCkJpyP.exe
  2⤵
  PID:1236
- C:\Windows\System\eBZAwEo.exe
  C:\Windows\System\eBZAwEo.exe
  2⤵
  PID:5476
- C:\Windows\System\mpiOUpf.exe
  C:\Windows\System\mpiOUpf.exe
  2⤵
  PID:5008
- C:\Windows\System\wVxDVlg.exe
  C:\Windows\System\wVxDVlg.exe
  2⤵
  PID:5504
- C:\Windows\System\yfAuIfs.exe
  C:\Windows\System\yfAuIfs.exe
  2⤵
  PID:5536
- C:\Windows\System\vHFvmiE.exe
  C:\Windows\System\vHFvmiE.exe
  2⤵
  PID:5572
- C:\Windows\System\NGIBani.exe
  C:\Windows\System\NGIBani.exe
  2⤵
  PID:5828
- C:\Windows\System\BEfQYpi.exe
  C:\Windows\System\BEfQYpi.exe
  2⤵
  PID:5584
- C:\Windows\System\kbqReEP.exe
  C:\Windows\System\kbqReEP.exe
  2⤵
  PID:5808
- C:\Windows\System\fHcnIVA.exe
  C:\Windows\System\fHcnIVA.exe
  2⤵
  PID:5696
- C:\Windows\System\HSpjgLn.exe
  C:\Windows\System\HSpjgLn.exe
  2⤵
  PID:5960
- C:\Windows\System\gaLAyhv.exe
  C:\Windows\System\gaLAyhv.exe
  2⤵
  PID:1340
- C:\Windows\System\AXzrUFU.exe
  C:\Windows\System\AXzrUFU.exe
  2⤵
  PID:2876
- C:\Windows\System\yvmbYlO.exe
  C:\Windows\System\yvmbYlO.exe
  2⤵
  PID:2644
- C:\Windows\System\MeIxGIH.exe
  C:\Windows\System\MeIxGIH.exe
  2⤵
  PID:6148
- C:\Windows\System\BujTzqJ.exe
  C:\Windows\System\BujTzqJ.exe
  2⤵
  PID:6168
- C:\Windows\System\BwRntNy.exe
  C:\Windows\System\BwRntNy.exe
  2⤵
  PID:6184
- C:\Windows\System\hLfnaCr.exe
  C:\Windows\System\hLfnaCr.exe
  2⤵
  PID:6328
- C:\Windows\System\lknuqhq.exe
  C:\Windows\System\lknuqhq.exe
  2⤵
  PID:6348
- C:\Windows\System\vpxSQyp.exe
  C:\Windows\System\vpxSQyp.exe
  2⤵
  PID:6364
- C:\Windows\System\BADyDgK.exe
  C:\Windows\System\BADyDgK.exe
  2⤵
  PID:6388
- C:\Windows\System\XREUttB.exe
  C:\Windows\System\XREUttB.exe
  2⤵
  PID:6404
- C:\Windows\System\gTXXTru.exe
  C:\Windows\System\gTXXTru.exe
  2⤵
  PID:6420
- C:\Windows\System\ZUYDeSQ.exe
  C:\Windows\System\ZUYDeSQ.exe
  2⤵
  PID:6436
- C:\Windows\System\LVNlgzN.exe
  C:\Windows\System\LVNlgzN.exe
  2⤵
  PID:6452
- C:\Windows\System\htKEJIJ.exe
  C:\Windows\System\htKEJIJ.exe
  2⤵
  PID:6468
- C:\Windows\System\MwyRqoh.exe
  C:\Windows\System\MwyRqoh.exe
  2⤵
  PID:6484
- C:\Windows\System\vrcDHxY.exe
  C:\Windows\System\vrcDHxY.exe
  2⤵
  PID:6504
- C:\Windows\System\juVztzQ.exe
  C:\Windows\System\juVztzQ.exe
  2⤵
  PID:6520
- C:\Windows\System\aIyDuLp.exe
  C:\Windows\System\aIyDuLp.exe
  2⤵
  PID:6536
- C:\Windows\System\XgfzjMt.exe
  C:\Windows\System\XgfzjMt.exe
  2⤵
  PID:6552
- C:\Windows\System\hXaawwi.exe
  C:\Windows\System\hXaawwi.exe
  2⤵
  PID:6568
- C:\Windows\System\dnYHArb.exe
  C:\Windows\System\dnYHArb.exe
  2⤵
  PID:6584
- C:\Windows\System\ZzQirRr.exe
  C:\Windows\System\ZzQirRr.exe
  2⤵
  PID:6600
- C:\Windows\System\JqYlLau.exe
  C:\Windows\System\JqYlLau.exe
  2⤵
  PID:6616
- C:\Windows\System\beLfHGG.exe
  C:\Windows\System\beLfHGG.exe
  2⤵
  PID:6640
- C:\Windows\System\zkfqBXi.exe
  C:\Windows\System\zkfqBXi.exe
  2⤵
  PID:6656
- C:\Windows\System\RNTYRci.exe
  C:\Windows\System\RNTYRci.exe
  2⤵
  PID:6676
- C:\Windows\System\KzVdEny.exe
  C:\Windows\System\KzVdEny.exe
  2⤵
  PID:6692
- C:\Windows\System\dekcXhQ.exe
  C:\Windows\System\dekcXhQ.exe
  2⤵
  PID:6712
- C:\Windows\System\iTjmGHb.exe
  C:\Windows\System\iTjmGHb.exe
  2⤵
  PID:6728
- C:\Windows\System\rrEBbPU.exe
  C:\Windows\System\rrEBbPU.exe
  2⤵
  PID:6744
- C:\Windows\System\QIjABmC.exe
  C:\Windows\System\QIjABmC.exe
  2⤵
  PID:6760
- C:\Windows\System\HavhbnU.exe
  C:\Windows\System\HavhbnU.exe
  2⤵
  PID:6780
- C:\Windows\System\KnRdaFO.exe
  C:\Windows\System\KnRdaFO.exe
  2⤵
  PID:6796
- C:\Windows\System\gDfDFtS.exe
  C:\Windows\System\gDfDFtS.exe
  2⤵
  PID:6812
- C:\Windows\System\OQryaoZ.exe
  C:\Windows\System\OQryaoZ.exe
  2⤵
  PID:6828
- C:\Windows\System\isLffPr.exe
  C:\Windows\System\isLffPr.exe
  2⤵
  PID:6844
- C:\Windows\System\mPWOBys.exe
  C:\Windows\System\mPWOBys.exe
  2⤵
  PID:6860
- C:\Windows\System\yJBnCmh.exe
  C:\Windows\System\yJBnCmh.exe
  2⤵
  PID:6876
- C:\Windows\System\sYnCpfr.exe
  C:\Windows\System\sYnCpfr.exe
  2⤵
  PID:6892
- C:\Windows\System\PzjbLTV.exe
  C:\Windows\System\PzjbLTV.exe
  2⤵
  PID:6908
- C:\Windows\System\TTIAQVz.exe
  C:\Windows\System\TTIAQVz.exe
  2⤵
  PID:6924
- C:\Windows\System\rxcqdIB.exe
  C:\Windows\System\rxcqdIB.exe
  2⤵
  PID:6940
- C:\Windows\System\aHLxlNH.exe
  C:\Windows\System\aHLxlNH.exe
  2⤵
  PID:6956
- C:\Windows\System\nVhXAfM.exe
  C:\Windows\System\nVhXAfM.exe
  2⤵
  PID:6972
- C:\Windows\System\mQNkrbt.exe
  C:\Windows\System\mQNkrbt.exe
  2⤵
  PID:6988
- C:\Windows\System\wOOIvIL.exe
  C:\Windows\System\wOOIvIL.exe
  2⤵
  PID:7004
- C:\Windows\System\DNvBQEs.exe
  C:\Windows\System\DNvBQEs.exe
  2⤵
  PID:7020
- C:\Windows\System\VMMcNmQ.exe
  C:\Windows\System\VMMcNmQ.exe
  2⤵
  PID:7036
- C:\Windows\System\TPOakyi.exe
  C:\Windows\System\TPOakyi.exe
  2⤵
  PID:7052
- C:\Windows\System\axpHYuY.exe
  C:\Windows\System\axpHYuY.exe
  2⤵
  PID:7068
- C:\Windows\System\MKKXdDj.exe
  C:\Windows\System\MKKXdDj.exe
  2⤵
  PID:7084
- C:\Windows\System\syCTqXN.exe
  C:\Windows\System\syCTqXN.exe
  2⤵
  PID:7100
- C:\Windows\System\JlbDTaI.exe
  C:\Windows\System\JlbDTaI.exe
  2⤵
  PID:7116
- C:\Windows\System\QCFosiK.exe
  C:\Windows\System\QCFosiK.exe
  2⤵
  PID:7132
- C:\Windows\System\PsEZwRd.exe
  C:\Windows\System\PsEZwRd.exe
  2⤵
  PID:7148
- C:\Windows\System\aRwSpqZ.exe
  C:\Windows\System\aRwSpqZ.exe
  2⤵
  PID:7164
- C:\Windows\System\SuiUHBj.exe
  C:\Windows\System\SuiUHBj.exe
  2⤵
  PID:5664
- C:\Windows\System\wIxEboJ.exe
  C:\Windows\System\wIxEboJ.exe
  2⤵
  PID:5168
- C:\Windows\System\oFEzoEj.exe
  C:\Windows\System\oFEzoEj.exe
  2⤵
  PID:5540
- C:\Windows\System\qwNSapB.exe
  C:\Windows\System\qwNSapB.exe
  2⤵
  PID:5692
- C:\Windows\System\iGYcSCp.exe
  C:\Windows\System\iGYcSCp.exe
  2⤵
  PID:2828
- C:\Windows\System\eHODNIF.exe
  C:\Windows\System\eHODNIF.exe
  2⤵
  PID:6164
- C:\Windows\System\TseuOHM.exe
  C:\Windows\System\TseuOHM.exe
  2⤵
  PID:6208
- C:\Windows\System\euUQyLr.exe
  C:\Windows\System\euUQyLr.exe
  2⤵
  PID:6224
- C:\Windows\System\sZRCncn.exe
  C:\Windows\System\sZRCncn.exe
  2⤵
  PID:6240
- C:\Windows\System\bvJvGcE.exe
  C:\Windows\System\bvJvGcE.exe
  2⤵
  PID:6256
- C:\Windows\System\qVgMmgF.exe
  C:\Windows\System\qVgMmgF.exe
  2⤵
  PID:6272
- C:\Windows\System\LFtLeca.exe
  C:\Windows\System\LFtLeca.exe
  2⤵
  PID:6072
- C:\Windows\System\flUJzIV.exe
  C:\Windows\System\flUJzIV.exe
  2⤵
  PID:6300
- C:\Windows\System\rvOPtbm.exe
  C:\Windows\System\rvOPtbm.exe
  2⤵
  PID:6200
- C:\Windows\System\kYabXua.exe
  C:\Windows\System\kYabXua.exe
  2⤵
  PID:6048
- C:\Windows\System\JhWEnAz.exe
  C:\Windows\System\JhWEnAz.exe
  2⤵
  PID:1664
- C:\Windows\System\AOUXDdV.exe
  C:\Windows\System\AOUXDdV.exe
  2⤵
  PID:5600
- C:\Windows\System\pkYteKF.exe
  C:\Windows\System\pkYteKF.exe
  2⤵
  PID:5848
- C:\Windows\System\pmsCOpf.exe
  C:\Windows\System\pmsCOpf.exe
  2⤵
  PID:5888
- C:\Windows\System\qjsSTuc.exe
  C:\Windows\System\qjsSTuc.exe
  2⤵
  PID:6344
- C:\Windows\System\cAAtJNK.exe
  C:\Windows\System\cAAtJNK.exe
  2⤵
  PID:6412
- C:\Windows\System\CQDmCTw.exe
  C:\Windows\System\CQDmCTw.exe
  2⤵
  PID:6304
- C:\Windows\System\qNbOAgB.exe
  C:\Windows\System\qNbOAgB.exe
  2⤵
  PID:6460
- C:\Windows\System\cfVwEzH.exe
  C:\Windows\System\cfVwEzH.exe
  2⤵
  PID:6500
- C:\Windows\System\EAWKidl.exe
  C:\Windows\System\EAWKidl.exe
  2⤵
  PID:6564
- C:\Windows\System\OoeBpDe.exe
  C:\Windows\System\OoeBpDe.exe
  2⤵
  PID:6624
- C:\Windows\System\yVbdHfe.exe
  C:\Windows\System\yVbdHfe.exe
  2⤵
  PID:6664
- C:\Windows\System\ClmOElL.exe
  C:\Windows\System\ClmOElL.exe
  2⤵
  PID:2376
- C:\Windows\System\aFtXJnj.exe
  C:\Windows\System\aFtXJnj.exe
  2⤵
  PID:6740
- C:\Windows\System\tIMZicR.exe
  C:\Windows\System\tIMZicR.exe
  2⤵
  PID:6804
- C:\Windows\System\QhWHejY.exe
  C:\Windows\System\QhWHejY.exe
  2⤵
  PID:6840
- C:\Windows\System\SWRxSXW.exe
  C:\Windows\System\SWRxSXW.exe
  2⤵
  PID:6904
- C:\Windows\System\zGvFKwD.exe
  C:\Windows\System\zGvFKwD.exe
  2⤵
  PID:6608
- C:\Windows\System\PtlKhOT.exe
  C:\Windows\System\PtlKhOT.exe
  2⤵
  PID:7016
- C:\Windows\System\QPJXKGg.exe
  C:\Windows\System\QPJXKGg.exe
  2⤵
  PID:7144
- C:\Windows\System\MaElUGc.exe
  C:\Windows\System\MaElUGc.exe
  2⤵
  PID:5868
- C:\Windows\System\kUuFyHi.exe
  C:\Windows\System\kUuFyHi.exe
  2⤵
  PID:6196
- C:\Windows\System\uJyqygz.exe
  C:\Windows\System\uJyqygz.exe
  2⤵
  PID:6648
- C:\Windows\System\dEpsxNd.exe
  C:\Windows\System\dEpsxNd.exe
  2⤵
  PID:6884
- C:\Windows\System\AHvpvEO.exe
  C:\Windows\System\AHvpvEO.exe
  2⤵
  PID:7060
- C:\Windows\System\lOTXJKR.exe
  C:\Windows\System\lOTXJKR.exe
  2⤵
  PID:7124
- C:\Windows\System\JBCXoep.exe
  C:\Windows\System\JBCXoep.exe
  2⤵
  PID:6116
- C:\Windows\System\oSxLcYJ.exe
  C:\Windows\System\oSxLcYJ.exe
  2⤵
  PID:6156
- C:\Windows\System\oJdAvlm.exe
  C:\Windows\System\oJdAvlm.exe
  2⤵
  PID:6248
- C:\Windows\System\mceGOFv.exe
  C:\Windows\System\mceGOFv.exe
  2⤵
  PID:6720
- C:\Windows\System\ONXaQpd.exe
  C:\Windows\System\ONXaQpd.exe
  2⤵
  PID:2812
- C:\Windows\System\OthixxE.exe
  C:\Windows\System\OthixxE.exe
  2⤵
  PID:6820
- C:\Windows\System\CjDCIJy.exe
  C:\Windows\System\CjDCIJy.exe
  2⤵
  PID:6920
- C:\Windows\System\ivyeuQo.exe
  C:\Windows\System\ivyeuQo.exe
  2⤵
  PID:6296
- C:\Windows\System\jkeltNl.exe
  C:\Windows\System\jkeltNl.exe
  2⤵
  PID:3452
- C:\Windows\System\XPogoYN.exe
  C:\Windows\System\XPogoYN.exe
  2⤵
  PID:6292
- C:\Windows\System\joUIcMp.exe
  C:\Windows\System\joUIcMp.exe
  2⤵
  PID:2632
- C:\Windows\System\WIJnNII.exe
  C:\Windows\System\WIJnNII.exe
  2⤵
  PID:6036
- C:\Windows\System\Fgczuvc.exe
  C:\Windows\System\Fgczuvc.exe
  2⤵
  PID:6336
- C:\Windows\System\RtNzPIm.exe
  C:\Windows\System\RtNzPIm.exe
  2⤵
  PID:6360
- C:\Windows\System\NgWpHHl.exe
  C:\Windows\System\NgWpHHl.exe
  2⤵
  PID:6532
- C:\Windows\System\CYKkYFf.exe
  C:\Windows\System\CYKkYFf.exe
  2⤵
  PID:6736
- C:\Windows\System\KXtMscC.exe
  C:\Windows\System\KXtMscC.exe
  2⤵
  PID:6324
- C:\Windows\System\NCYDzSO.exe
  C:\Windows\System\NCYDzSO.exe
  2⤵
  PID:6544
- C:\Windows\System\WJGYYwE.exe
  C:\Windows\System\WJGYYwE.exe
  2⤵
  PID:6576
- C:\Windows\System\UzaRbKQ.exe
  C:\Windows\System\UzaRbKQ.exe
  2⤵
  PID:6596
- C:\Windows\System\agYhvqx.exe
  C:\Windows\System\agYhvqx.exe
  2⤵
  PID:6776
- C:\Windows\System\xQhBGfD.exe
  C:\Windows\System\xQhBGfD.exe
  2⤵
  PID:6772
- C:\Windows\System\PkIWLLR.exe
  C:\Windows\System\PkIWLLR.exe
  2⤵
  PID:6836
- C:\Windows\System\LaHElFi.exe
  C:\Windows\System\LaHElFi.exe
  2⤵
  PID:7108
- C:\Windows\System\vMRgZvd.exe
  C:\Windows\System\vMRgZvd.exe
  2⤵
  PID:6204
- C:\Windows\System\VCANCuO.exe
  C:\Windows\System\VCANCuO.exe
  2⤵
  PID:6264
- C:\Windows\System\YMgWjAQ.exe
  C:\Windows\System\YMgWjAQ.exe
  2⤵
  PID:7076
- C:\Windows\System\sMHGXYe.exe
  C:\Windows\System\sMHGXYe.exe
  2⤵
  PID:5488
- C:\Windows\System\bniGOcK.exe
  C:\Windows\System\bniGOcK.exe
  2⤵
  PID:6888
- C:\Windows\System\FxBzwRS.exe
  C:\Windows\System\FxBzwRS.exe
  2⤵
  PID:6032
- C:\Windows\System\jEJUSWN.exe
  C:\Windows\System\jEJUSWN.exe
  2⤵
  PID:6724
- C:\Windows\System\FsCPImT.exe
  C:\Windows\System\FsCPImT.exe
  2⤵
  PID:7096
- C:\Windows\System\YiwflEI.exe
  C:\Windows\System\YiwflEI.exe
  2⤵
  PID:5740
- C:\Windows\System\CmwObYN.exe
  C:\Windows\System\CmwObYN.exe
  2⤵
  PID:2652
- C:\Windows\System\OtVpThL.exe
  C:\Windows\System\OtVpThL.exe
  2⤵
  PID:6176
- C:\Windows\System\ryuPbDH.exe
  C:\Windows\System\ryuPbDH.exe
  2⤵
  PID:6316
- C:\Windows\System\SPfdvzG.exe
  C:\Windows\System\SPfdvzG.exe
  2⤵
  PID:6708
- C:\Windows\System\RZYOuSz.exe
  C:\Windows\System\RZYOuSz.exe
  2⤵
  PID:7048
- C:\Windows\System\WFAVOWQ.exe
  C:\Windows\System\WFAVOWQ.exe
  2⤵
  PID:6548
- C:\Windows\System\AfmmDMk.exe
  C:\Windows\System\AfmmDMk.exe
  2⤵
  PID:6984
- C:\Windows\System\iXJNNgA.exe
  C:\Windows\System\iXJNNgA.exe
  2⤵
  PID:6444
- C:\Windows\System\SXlhunp.exe
  C:\Windows\System\SXlhunp.exe
  2⤵
  PID:6856
- C:\Windows\System\IiyOvdh.exe
  C:\Windows\System\IiyOvdh.exe
  2⤵
  PID:6384
- C:\Windows\System\ctYUcMe.exe
  C:\Windows\System\ctYUcMe.exe
  2⤵
  PID:6236
- C:\Windows\System\zgmaSgS.exe
  C:\Windows\System\zgmaSgS.exe
  2⤵
  PID:6792
- C:\Windows\System\xDiIVTY.exe
  C:\Windows\System\xDiIVTY.exe
  2⤵
  PID:6428
- C:\Windows\System\ItnFWih.exe
  C:\Windows\System\ItnFWih.exe
  2⤵
  PID:3052
- C:\Windows\System\FdtgTCu.exe
  C:\Windows\System\FdtgTCu.exe
  2⤵
  PID:6448
- C:\Windows\System\aOCiSbK.exe
  C:\Windows\System\aOCiSbK.exe
  2⤵
  PID:6380
- C:\Windows\System\UtXEQiQ.exe
  C:\Windows\System\UtXEQiQ.exe
  2⤵
  PID:6416
- C:\Windows\System\xTDQQoQ.exe
  C:\Windows\System\xTDQQoQ.exe
  2⤵
  PID:5652
- C:\Windows\System\HjiajfS.exe
  C:\Windows\System\HjiajfS.exe
  2⤵
  PID:6852
- C:\Windows\System\qKBxlCQ.exe
  C:\Windows\System\qKBxlCQ.exe
  2⤵
  PID:7112
- C:\Windows\System\tVpWwet.exe
  C:\Windows\System\tVpWwet.exe
  2⤵
  PID:6180
- C:\Windows\System\ZUKCahd.exe
  C:\Windows\System\ZUKCahd.exe
  2⤵
  PID:5392
- C:\Windows\System\lQhZigF.exe
  C:\Windows\System\lQhZigF.exe
  2⤵
  PID:7184
- C:\Windows\System\kYYZWdy.exe
  C:\Windows\System\kYYZWdy.exe
  2⤵
  PID:7200
- C:\Windows\System\SqZttOc.exe
  C:\Windows\System\SqZttOc.exe
  2⤵
  PID:7216
- C:\Windows\System\EyXItWr.exe
  C:\Windows\System\EyXItWr.exe
  2⤵
  PID:7232
- C:\Windows\System\VHgPwwk.exe
  C:\Windows\System\VHgPwwk.exe
  2⤵
  PID:7248
- C:\Windows\System\QfbCQoS.exe
  C:\Windows\System\QfbCQoS.exe
  2⤵
  PID:7264
- C:\Windows\System\vAKiITF.exe
  C:\Windows\System\vAKiITF.exe
  2⤵
  PID:7280
- C:\Windows\System\pzAxYZp.exe
  C:\Windows\System\pzAxYZp.exe
  2⤵
  PID:7296
- C:\Windows\System\lVurqwF.exe
  C:\Windows\System\lVurqwF.exe
  2⤵
  PID:7312
- C:\Windows\System\VZdvPRS.exe
  C:\Windows\System\VZdvPRS.exe
  2⤵
  PID:7328
- C:\Windows\System\mbHXLwg.exe
  C:\Windows\System\mbHXLwg.exe
  2⤵
  PID:7344
- C:\Windows\System\sPyLyhF.exe
  C:\Windows\System\sPyLyhF.exe
  2⤵
  PID:7360
- C:\Windows\System\ssPhhtw.exe
  C:\Windows\System\ssPhhtw.exe
  2⤵
  PID:7384
- C:\Windows\System\safStWA.exe
  C:\Windows\System\safStWA.exe
  2⤵
  PID:7400
- C:\Windows\System\BeFgQzl.exe
  C:\Windows\System\BeFgQzl.exe
  2⤵
  PID:7420
- C:\Windows\System\QeSFiUl.exe
  C:\Windows\System\QeSFiUl.exe
  2⤵
  PID:7436
- C:\Windows\System\vHdWfvS.exe
  C:\Windows\System\vHdWfvS.exe
  2⤵
  PID:7452
- C:\Windows\System\BVZzyzq.exe
  C:\Windows\System\BVZzyzq.exe
  2⤵
  PID:7468
- C:\Windows\System\viKChdk.exe
  C:\Windows\System\viKChdk.exe
  2⤵
  PID:7484
- C:\Windows\System\YrFvLYZ.exe
  C:\Windows\System\YrFvLYZ.exe
  2⤵
  PID:7500
- C:\Windows\System\CDxHFBt.exe
  C:\Windows\System\CDxHFBt.exe
  2⤵
  PID:7516
- C:\Windows\System\YmpEnEY.exe
  C:\Windows\System\YmpEnEY.exe
  2⤵
  PID:7536
- C:\Windows\System\ElhSiuP.exe
  C:\Windows\System\ElhSiuP.exe
  2⤵
  PID:7552
- C:\Windows\System\NcMphFM.exe
  C:\Windows\System\NcMphFM.exe
  2⤵
  PID:7568
- C:\Windows\System\OHgxkYQ.exe
  C:\Windows\System\OHgxkYQ.exe
  2⤵
  PID:7584
- C:\Windows\System\dyhNNOK.exe
  C:\Windows\System\dyhNNOK.exe
  2⤵
  PID:7600
- C:\Windows\System\VamMnhE.exe
  C:\Windows\System\VamMnhE.exe
  2⤵
  PID:7616
- C:\Windows\System\ZqcSpOL.exe
  C:\Windows\System\ZqcSpOL.exe
  2⤵
  PID:7632
- C:\Windows\System\mgJmrba.exe
  C:\Windows\System\mgJmrba.exe
  2⤵
  PID:7648
- C:\Windows\System\aWZAFdn.exe
  C:\Windows\System\aWZAFdn.exe
  2⤵
  PID:7664
- C:\Windows\System\oBPnYcQ.exe
  C:\Windows\System\oBPnYcQ.exe
  2⤵
  PID:7680
- C:\Windows\System\HdTVtFX.exe
  C:\Windows\System\HdTVtFX.exe
  2⤵
  PID:7696
- C:\Windows\System\hDrFHJW.exe
  C:\Windows\System\hDrFHJW.exe
  2⤵
  PID:7712
- C:\Windows\System\RmGohef.exe
  C:\Windows\System\RmGohef.exe
  2⤵
  PID:7728
- C:\Windows\System\aKUuKwL.exe
  C:\Windows\System\aKUuKwL.exe
  2⤵
  PID:7744
- C:\Windows\System\rJpXLdk.exe
  C:\Windows\System\rJpXLdk.exe
  2⤵
  PID:7760
- C:\Windows\System\UMSAuQQ.exe
  C:\Windows\System\UMSAuQQ.exe
  2⤵
  PID:7776
- C:\Windows\System\xXDiBAv.exe
  C:\Windows\System\xXDiBAv.exe
  2⤵
  PID:7792
- C:\Windows\System\cEyGUWr.exe
  C:\Windows\System\cEyGUWr.exe
  2⤵
  PID:7808
- C:\Windows\System\zJZnUeW.exe
  C:\Windows\System\zJZnUeW.exe
  2⤵
  PID:7824
- C:\Windows\System\HnwSVyw.exe
  C:\Windows\System\HnwSVyw.exe
  2⤵
  PID:7840
- C:\Windows\System\MLXjiYi.exe
  C:\Windows\System\MLXjiYi.exe
  2⤵
  PID:7856
- C:\Windows\System\pzodltn.exe
  C:\Windows\System\pzodltn.exe
  2⤵
  PID:7872
- C:\Windows\System\uhnRUwo.exe
  C:\Windows\System\uhnRUwo.exe
  2⤵
  PID:7888
- C:\Windows\System\XRSQcDc.exe
  C:\Windows\System\XRSQcDc.exe
  2⤵
  PID:7904
- C:\Windows\System\GhKRwCh.exe
  C:\Windows\System\GhKRwCh.exe
  2⤵
  PID:7920
- C:\Windows\System\ivTHtwY.exe
  C:\Windows\System\ivTHtwY.exe
  2⤵
  PID:7936
- C:\Windows\System\RjZObVm.exe
  C:\Windows\System\RjZObVm.exe
  2⤵
  PID:7952
- C:\Windows\System\qmfiiiw.exe
  C:\Windows\System\qmfiiiw.exe
  2⤵
  PID:7968
- C:\Windows\System\zgpZduA.exe
  C:\Windows\System\zgpZduA.exe
  2⤵
  PID:7984
- C:\Windows\System\tvmAwZa.exe
  C:\Windows\System\tvmAwZa.exe
  2⤵
  PID:8000
- C:\Windows\System\nGijJuV.exe
  C:\Windows\System\nGijJuV.exe
  2⤵
  PID:8016
- C:\Windows\System\kugDQrh.exe
  C:\Windows\System\kugDQrh.exe
  2⤵
  PID:8032
- C:\Windows\System\mFYzdch.exe
  C:\Windows\System\mFYzdch.exe
  2⤵
  PID:8048
- C:\Windows\System\peisqRg.exe
  C:\Windows\System\peisqRg.exe
  2⤵
  PID:8064
- C:\Windows\System\HJRRVel.exe
  C:\Windows\System\HJRRVel.exe
  2⤵
  PID:8080
- C:\Windows\System\MYarSOj.exe
  C:\Windows\System\MYarSOj.exe
  2⤵
  PID:8096
- C:\Windows\System\NvmeDHb.exe
  C:\Windows\System\NvmeDHb.exe
  2⤵
  PID:8112
- C:\Windows\System\CEjyqid.exe
  C:\Windows\System\CEjyqid.exe
  2⤵
  PID:8128
- C:\Windows\System\QiybqGm.exe
  C:\Windows\System\QiybqGm.exe
  2⤵
  PID:8144
- C:\Windows\System\eOjtGBT.exe
  C:\Windows\System\eOjtGBT.exe
  2⤵
  PID:8160
- C:\Windows\System\xpZbreX.exe
  C:\Windows\System\xpZbreX.exe
  2⤵
  PID:8176
- C:\Windows\System\HyDAeVX.exe
  C:\Windows\System\HyDAeVX.exe
  2⤵
  PID:7140
- C:\Windows\System\awMjHPK.exe
  C:\Windows\System\awMjHPK.exe
  2⤵
  PID:820
- C:\Windows\System\rGJXQTG.exe
  C:\Windows\System\rGJXQTG.exe
  2⤵
  PID:7212
- C:\Windows\System\UKmaQBz.exe
  C:\Windows\System\UKmaQBz.exe
  2⤵
  PID:7276
- C:\Windows\System\WPSaCXW.exe
  C:\Windows\System\WPSaCXW.exe
  2⤵
  PID:7256
- C:\Windows\System\qzfklBn.exe
  C:\Windows\System\qzfklBn.exe
  2⤵
  PID:7192
- C:\Windows\System\FRrVTan.exe
  C:\Windows\System\FRrVTan.exe
  2⤵
  PID:7292
- C:\Windows\System\eauLdrV.exe
  C:\Windows\System\eauLdrV.exe
  2⤵
  PID:7356
- C:\Windows\System\HNElyHl.exe
  C:\Windows\System\HNElyHl.exe
  2⤵
  PID:7428
- C:\Windows\System\NNpYTTT.exe
  C:\Windows\System\NNpYTTT.exe
  2⤵
  PID:7368
- C:\Windows\System\pMsQKGy.exe
  C:\Windows\System\pMsQKGy.exe
  2⤵
  PID:7416
- C:\Windows\System\ZEJPYrx.exe
  C:\Windows\System\ZEJPYrx.exe
  2⤵
  PID:7492
- C:\Windows\System\LadXEOq.exe
  C:\Windows\System\LadXEOq.exe
  2⤵
  PID:7448
- C:\Windows\System\hyRnRQJ.exe
  C:\Windows\System\hyRnRQJ.exe
  2⤵
  PID:7512
- C:\Windows\System\RGRMASb.exe
  C:\Windows\System\RGRMASb.exe
  2⤵
  PID:7560
- C:\Windows\System\SIdZCKw.exe
  C:\Windows\System\SIdZCKw.exe
  2⤵
  PID:7548
- C:\Windows\System\NMwXWqi.exe
  C:\Windows\System\NMwXWqi.exe
  2⤵
  PID:7580
- C:\Windows\System\uzSUCfv.exe
  C:\Windows\System\uzSUCfv.exe
  2⤵
  PID:7612
- C:\Windows\System\tkfLQYH.exe
  C:\Windows\System\tkfLQYH.exe
  2⤵
  PID:7672
- C:\Windows\System\TaXUkaK.exe
  C:\Windows\System\TaXUkaK.exe
  2⤵
  PID:7692
- C:\Windows\System\GHrxDlG.exe
  C:\Windows\System\GHrxDlG.exe
  2⤵
  PID:7736
- C:\Windows\System\lDcfaKi.exe
  C:\Windows\System\lDcfaKi.exe
  2⤵
  PID:7800
- C:\Windows\System\BZpNlPl.exe
  C:\Windows\System\BZpNlPl.exe
  2⤵
  PID:7836
- C:\Windows\System\vtfawHR.exe
  C:\Windows\System\vtfawHR.exe
  2⤵
  PID:7788
- C:\Windows\System\tOHXoXZ.exe
  C:\Windows\System\tOHXoXZ.exe
  2⤵
  PID:7928
- C:\Windows\System\nxyJFPN.exe
  C:\Windows\System\nxyJFPN.exe
  2⤵
  PID:8060
- C:\Windows\System\DZMmMhZ.exe
  C:\Windows\System\DZMmMhZ.exe
  2⤵
  PID:7848
- C:\Windows\System\UZZlXdp.exe
  C:\Windows\System\UZZlXdp.exe
  2⤵
  PID:8156
- C:\Windows\System\TMMTEeb.exe
  C:\Windows\System\TMMTEeb.exe
  2⤵
  PID:6636
- C:\Windows\System\ujhylcj.exe
  C:\Windows\System\ujhylcj.exe
  2⤵
  PID:8072
- C:\Windows\System\zjILhUd.exe
  C:\Windows\System\zjILhUd.exe
  2⤵
  PID:8104
- C:\Windows\System\jtUBGWe.exe
  C:\Windows\System\jtUBGWe.exe
  2⤵
  PID:8040
- C:\Windows\System\lGUXpwu.exe
  C:\Windows\System\lGUXpwu.exe
  2⤵
  PID:8172
- C:\Windows\System\OprHljv.exe
  C:\Windows\System\OprHljv.exe
  2⤵
  PID:7272
- C:\Windows\System\QIowjyp.exe
  C:\Windows\System\QIowjyp.exe
  2⤵
  PID:7352
- C:\Windows\System\nHKgdyb.exe
  C:\Windows\System\nHKgdyb.exe
  2⤵
  PID:7460
- C:\Windows\System\idFbEDG.exe
  C:\Windows\System\idFbEDG.exe
  2⤵
  PID:7592
- C:\Windows\System\jWViWBU.exe
  C:\Windows\System\jWViWBU.exe
  2⤵
  PID:7688
- C:\Windows\System\YIlGNfJ.exe
  C:\Windows\System\YIlGNfJ.exe
  2⤵
  PID:7308
- C:\Windows\System\bUncXOA.exe
  C:\Windows\System\bUncXOA.exe
  2⤵
  PID:7408
- C:\Windows\System\kPuSoiF.exe
  C:\Windows\System\kPuSoiF.exe
  2⤵
  PID:7624
- C:\Windows\System\WdCazOY.exe
  C:\Windows\System\WdCazOY.exe
  2⤵
  PID:6376
- C:\Windows\System\XPdCtZY.exe
  C:\Windows\System\XPdCtZY.exe
  2⤵
  PID:7832
- C:\Windows\System\PvOXvhG.exe
  C:\Windows\System\PvOXvhG.exe
  2⤵
  PID:7784
- C:\Windows\System\kVMGIeI.exe
  C:\Windows\System\kVMGIeI.exe
  2⤵
  PID:8028
- C:\Windows\System\IGHicaS.exe
  C:\Windows\System\IGHicaS.exe
  2⤵
  PID:7912
- C:\Windows\System\mHhNGkG.exe
  C:\Windows\System\mHhNGkG.exe
  2⤵
  PID:7976
- C:\Windows\System\fjsqoPZ.exe
  C:\Windows\System\fjsqoPZ.exe
  2⤵
  PID:8152
- C:\Windows\System\JRIRXFp.exe
  C:\Windows\System\JRIRXFp.exe
  2⤵
  PID:8056
- C:\Windows\System\QDXXxVP.exe
  C:\Windows\System\QDXXxVP.exe
  2⤵
  PID:7244
- C:\Windows\System\ElWNcaz.exe
  C:\Windows\System\ElWNcaz.exe
  2⤵
  PID:7660
- C:\Windows\System\GbutZlT.exe
  C:\Windows\System\GbutZlT.exe
  2⤵
  PID:8184
- C:\Windows\System\odACalx.exe
  C:\Windows\System\odACalx.exe
  2⤵
  PID:7900
- C:\Windows\System\nLwKHdK.exe
  C:\Windows\System\nLwKHdK.exe
  2⤵
  PID:7756
- C:\Windows\System\WQEeoPh.exe
  C:\Windows\System\WQEeoPh.exe
  2⤵
  PID:7532
- C:\Windows\System\uunfTnN.exe
  C:\Windows\System\uunfTnN.exe
  2⤵
  PID:7392
- C:\Windows\System\CttyBpU.exe
  C:\Windows\System\CttyBpU.exe
  2⤵
  PID:7772
- C:\Windows\System\lcPxNLj.exe
  C:\Windows\System\lcPxNLj.exe
  2⤵
  PID:7180
- C:\Windows\System\IfiHphx.exe
  C:\Windows\System\IfiHphx.exe
  2⤵
  PID:8168
- C:\Windows\System\vzCniUL.exe
  C:\Windows\System\vzCniUL.exe
  2⤵
  PID:7916
- C:\Windows\System\iCUMBXQ.exe
  C:\Windows\System\iCUMBXQ.exe
  2⤵
  PID:7752
- C:\Windows\System\RJgHwfz.exe
  C:\Windows\System\RJgHwfz.exe
  2⤵
  PID:7768
- C:\Windows\System\ddAwrnN.exe
  C:\Windows\System\ddAwrnN.exe
  2⤵
  PID:7820
- C:\Windows\System\cQHuDxK.exe
  C:\Windows\System\cQHuDxK.exe
  2⤵
  PID:7816
- C:\Windows\System\CIbqehN.exe
  C:\Windows\System\CIbqehN.exe
  2⤵
  PID:7704
- C:\Windows\System\vsxXmip.exe
  C:\Windows\System\vsxXmip.exe
  2⤵
  PID:7324
- C:\Windows\System\jafnmwL.exe
  C:\Windows\System\jafnmwL.exe
  2⤵
  PID:8208
- C:\Windows\System\zqVUvZK.exe
  C:\Windows\System\zqVUvZK.exe
  2⤵
  PID:8224
- C:\Windows\System\qzGLwFb.exe
  C:\Windows\System\qzGLwFb.exe
  2⤵
  PID:8240
- C:\Windows\System\VxeFjSq.exe
  C:\Windows\System\VxeFjSq.exe
  2⤵
  PID:8256
- C:\Windows\System\hpafbsh.exe
  C:\Windows\System\hpafbsh.exe
  2⤵
  PID:8272
- C:\Windows\System\hqbJVtw.exe
  C:\Windows\System\hqbJVtw.exe
  2⤵
  PID:8288
- C:\Windows\System\vyAmDSw.exe
  C:\Windows\System\vyAmDSw.exe
  2⤵
  PID:8304
- C:\Windows\System\IqCymOC.exe
  C:\Windows\System\IqCymOC.exe
  2⤵
  PID:8320
- C:\Windows\System\sNMLaCy.exe
  C:\Windows\System\sNMLaCy.exe
  2⤵
  PID:8336
- C:\Windows\System\gRUGuLm.exe
  C:\Windows\System\gRUGuLm.exe
  2⤵
  PID:8352
- C:\Windows\System\LUUzNvp.exe
  C:\Windows\System\LUUzNvp.exe
  2⤵
  PID:8368
- C:\Windows\System\vqWhWpA.exe
  C:\Windows\System\vqWhWpA.exe
  2⤵
  PID:8384
- C:\Windows\System\ynSPIDE.exe
  C:\Windows\System\ynSPIDE.exe
  2⤵
  PID:8400
- C:\Windows\System\WGyhBok.exe
  C:\Windows\System\WGyhBok.exe
  2⤵
  PID:8416
- C:\Windows\System\urQYvtj.exe
  C:\Windows\System\urQYvtj.exe
  2⤵
  PID:8432
- C:\Windows\System\urVGuHK.exe
  C:\Windows\System\urVGuHK.exe
  2⤵
  PID:8448
- C:\Windows\System\AGTWDwA.exe
  C:\Windows\System\AGTWDwA.exe
  2⤵
  PID:8464
- C:\Windows\System\sdqOUtv.exe
  C:\Windows\System\sdqOUtv.exe
  2⤵
  PID:8480
- C:\Windows\System\QWhqera.exe
  C:\Windows\System\QWhqera.exe
  2⤵
  PID:8496
- C:\Windows\System\kAhpnPG.exe
  C:\Windows\System\kAhpnPG.exe
  2⤵
  PID:8512
- C:\Windows\System\zlBcCdW.exe
  C:\Windows\System\zlBcCdW.exe
  2⤵
  PID:8528
- C:\Windows\System\wFgyklv.exe
  C:\Windows\System\wFgyklv.exe
  2⤵
  PID:8544
- C:\Windows\System\DbXBFHT.exe
  C:\Windows\System\DbXBFHT.exe
  2⤵
  PID:8560
- C:\Windows\System\BKAoiOU.exe
  C:\Windows\System\BKAoiOU.exe
  2⤵
  PID:8580
- C:\Windows\System\ZpXGihy.exe
  C:\Windows\System\ZpXGihy.exe
  2⤵
  PID:8596
- C:\Windows\System\JqKaTJm.exe
  C:\Windows\System\JqKaTJm.exe
  2⤵
  PID:8612
- C:\Windows\System\Bdmjabt.exe
  C:\Windows\System\Bdmjabt.exe
  2⤵
  PID:8628
- C:\Windows\System\jIkroom.exe
  C:\Windows\System\jIkroom.exe
  2⤵
  PID:8644
- C:\Windows\System\EtjQcnH.exe
  C:\Windows\System\EtjQcnH.exe
  2⤵
  PID:8660
- C:\Windows\System\pZBfWHx.exe
  C:\Windows\System\pZBfWHx.exe
  2⤵
  PID:8676
- C:\Windows\System\mIrZBKx.exe
  C:\Windows\System\mIrZBKx.exe
  2⤵
  PID:8692
- C:\Windows\System\NEreqCB.exe
  C:\Windows\System\NEreqCB.exe
  2⤵
  PID:8708
- C:\Windows\System\IJvoWeF.exe
  C:\Windows\System\IJvoWeF.exe
  2⤵
  PID:8724
- C:\Windows\System\bjnbTWq.exe
  C:\Windows\System\bjnbTWq.exe
  2⤵
  PID:8740
- C:\Windows\System\FCRYGLs.exe
  C:\Windows\System\FCRYGLs.exe
  2⤵
  PID:8756
- C:\Windows\System\cETeMQn.exe
  C:\Windows\System\cETeMQn.exe
  2⤵
  PID:8772
- C:\Windows\System\vFYHeMk.exe
  C:\Windows\System\vFYHeMk.exe
  2⤵
  PID:8788
- C:\Windows\System\XedLtXB.exe
  C:\Windows\System\XedLtXB.exe
  2⤵
  PID:8804
- C:\Windows\System\NrTULgz.exe
  C:\Windows\System\NrTULgz.exe
  2⤵
  PID:8820
- C:\Windows\System\pDPgMPh.exe
  C:\Windows\System\pDPgMPh.exe
  2⤵
  PID:8836
- C:\Windows\System\UYIwsaU.exe
  C:\Windows\System\UYIwsaU.exe
  2⤵
  PID:8852
- C:\Windows\System\maqyKzg.exe
  C:\Windows\System\maqyKzg.exe
  2⤵
  PID:8868
- C:\Windows\System\yPogsIK.exe
  C:\Windows\System\yPogsIK.exe
  2⤵
  PID:8884
- C:\Windows\System\OctxjPv.exe
  C:\Windows\System\OctxjPv.exe
  2⤵
  PID:8900
- C:\Windows\System\MzEGtRq.exe
  C:\Windows\System\MzEGtRq.exe
  2⤵
  PID:8916
- C:\Windows\System\aZoRbLN.exe
  C:\Windows\System\aZoRbLN.exe
  2⤵
  PID:8932
- C:\Windows\System\BwUVMhG.exe
  C:\Windows\System\BwUVMhG.exe
  2⤵
  PID:8948
- C:\Windows\System\ezlfAZh.exe
  C:\Windows\System\ezlfAZh.exe
  2⤵
  PID:8964
- C:\Windows\System\AJHMlBz.exe
  C:\Windows\System\AJHMlBz.exe
  2⤵
  PID:8980
- C:\Windows\System\gqrIrVr.exe
  C:\Windows\System\gqrIrVr.exe
  2⤵
  PID:8996
- C:\Windows\System\eaGvGlm.exe
  C:\Windows\System\eaGvGlm.exe
  2⤵
  PID:9012
- C:\Windows\System\hQQXYLj.exe
  C:\Windows\System\hQQXYLj.exe
  2⤵
  PID:9028
- C:\Windows\System\UOUYiIj.exe
  C:\Windows\System\UOUYiIj.exe
  2⤵
  PID:9044
- C:\Windows\System\YAZXRVw.exe
  C:\Windows\System\YAZXRVw.exe
  2⤵
  PID:9060
- C:\Windows\System\gRCRQEA.exe
  C:\Windows\System\gRCRQEA.exe
  2⤵
  PID:9076
- C:\Windows\System\OeNongA.exe
  C:\Windows\System\OeNongA.exe
  2⤵
  PID:9092
- C:\Windows\System\ZfvivCS.exe
  C:\Windows\System\ZfvivCS.exe
  2⤵
  PID:9108
- C:\Windows\System\ktXmWyx.exe
  C:\Windows\System\ktXmWyx.exe
  2⤵
  PID:9124
- C:\Windows\System\CqoBpMY.exe
  C:\Windows\System\CqoBpMY.exe
  2⤵
  PID:9140
- C:\Windows\System\bxABNGB.exe
  C:\Windows\System\bxABNGB.exe
  2⤵
  PID:9156
- C:\Windows\System\DyhPEZC.exe
  C:\Windows\System\DyhPEZC.exe
  2⤵
  PID:9172
- C:\Windows\System\JHrkvXl.exe
  C:\Windows\System\JHrkvXl.exe
  2⤵
  PID:9188
- C:\Windows\System\qidGCBc.exe
  C:\Windows\System\qidGCBc.exe
  2⤵
  PID:9204
- C:\Windows\System\zKXvZNL.exe
  C:\Windows\System\zKXvZNL.exe
  2⤵
  PID:6432
- C:\Windows\System\QmcYjnZ.exe
  C:\Windows\System\QmcYjnZ.exe
  2⤵
  PID:7884
- C:\Windows\System\NtMBPef.exe
  C:\Windows\System\NtMBPef.exe
  2⤵
  PID:8216
- C:\Windows\System\UinTCPV.exe
  C:\Windows\System\UinTCPV.exe
  2⤵
  PID:8248
- C:\Windows\System\EnDsBqO.exe
  C:\Windows\System\EnDsBqO.exe
  2⤵
  PID:8300
- C:\Windows\System\HANcQLB.exe
  C:\Windows\System\HANcQLB.exe
  2⤵
  PID:8344
- C:\Windows\System\qeqBEhX.exe
  C:\Windows\System\qeqBEhX.exe
  2⤵
  PID:8364
- C:\Windows\System\gQjljYo.exe
  C:\Windows\System\gQjljYo.exe
  2⤵
  PID:8424
- C:\Windows\System\OZvgXZE.exe
  C:\Windows\System\OZvgXZE.exe
  2⤵
  PID:8488
- C:\Windows\System\nNiwQVS.exe
  C:\Windows\System\nNiwQVS.exe
  2⤵
  PID:8380
- C:\Windows\System\edIFFfl.exe
  C:\Windows\System\edIFFfl.exe
  2⤵
  PID:8472
- C:\Windows\System\ndaioyK.exe
  C:\Windows\System\ndaioyK.exe
  2⤵
  PID:8508
- C:\Windows\System\qamBbdk.exe
  C:\Windows\System\qamBbdk.exe
  2⤵
  PID:8408
- C:\Windows\System\ZnjFuso.exe
  C:\Windows\System\ZnjFuso.exe
  2⤵
  PID:8572
- C:\Windows\System\rRhawmk.exe
  C:\Windows\System\rRhawmk.exe
  2⤵
  PID:8624
- C:\Windows\System\tarDEqQ.exe
  C:\Windows\System\tarDEqQ.exe
  2⤵
  PID:8688
- C:\Windows\System\iKRocUM.exe
  C:\Windows\System\iKRocUM.exe
  2⤵
  PID:8812
- C:\Windows\System\EohzeCG.exe
  C:\Windows\System\EohzeCG.exe
  2⤵
  PID:8816
- C:\Windows\System\kqdLopX.exe
  C:\Windows\System\kqdLopX.exe
  2⤵
  PID:8844
- C:\Windows\System\aJmEupM.exe
  C:\Windows\System\aJmEupM.exe
  2⤵
  PID:9004
- C:\Windows\System\sBIhIGv.exe
  C:\Windows\System\sBIhIGv.exe
  2⤵
  PID:9040
- C:\Windows\System\FsNuZYV.exe
  C:\Windows\System\FsNuZYV.exe
  2⤵
  PID:8944
- C:\Windows\System\KJuLDqU.exe
  C:\Windows\System\KJuLDqU.exe
  2⤵
  PID:9136
- C:\Windows\System\ValVhNZ.exe
  C:\Windows\System\ValVhNZ.exe
  2⤵
  PID:9200
- C:\Windows\System\OliHIhe.exe
  C:\Windows\System\OliHIhe.exe
  2⤵
  PID:9052
- C:\Windows\System\dtPvbHQ.exe
  C:\Windows\System\dtPvbHQ.exe
  2⤵
  PID:8988
- C:\Windows\System\qVCFTpp.exe
  C:\Windows\System\qVCFTpp.exe
  2⤵
  PID:8924
- C:\Windows\System\SsxqtoR.exe
  C:\Windows\System\SsxqtoR.exe
  2⤵
  PID:8860
- C:\Windows\System\dnUyWuG.exe
  C:\Windows\System\dnUyWuG.exe
  2⤵
  PID:8704
- C:\Windows\System\fBDcTOX.exe
  C:\Windows\System\fBDcTOX.exe
  2⤵
  PID:7396
- C:\Windows\System\QpEDitU.exe
  C:\Windows\System\QpEDitU.exe
  2⤵
  PID:8604
- C:\Windows\System\VitgxGD.exe
  C:\Windows\System\VitgxGD.exe
  2⤵
  PID:8636
- C:\Windows\System\OdnzgCe.exe
  C:\Windows\System\OdnzgCe.exe
  2⤵
  PID:8280
- C:\Windows\System\uURmdtQ.exe
  C:\Windows\System\uURmdtQ.exe
  2⤵
  PID:8456
- C:\Windows\System\rRoyGry.exe
  C:\Windows\System\rRoyGry.exe
  2⤵
  PID:8268
- C:\Windows\System\DieQFnX.exe
  C:\Windows\System\DieQFnX.exe
  2⤵
  PID:8444
- C:\Windows\System\KmWUadb.exe
  C:\Windows\System\KmWUadb.exe
  2⤵
  PID:8748
- C:\Windows\System\VevYAlB.exe
  C:\Windows\System\VevYAlB.exe
  2⤵
  PID:8908
- C:\Windows\System\IBiwGOa.exe
  C:\Windows\System\IBiwGOa.exe
  2⤵
  PID:9056
- C:\Windows\System\PfjIlxh.exe
  C:\Windows\System\PfjIlxh.exe
  2⤵
  PID:9196
- C:\Windows\System\ikoOJJw.exe
  C:\Windows\System\ikoOJJw.exe
  2⤵
  PID:9164
- C:\Windows\System\pFFXmKp.exe
  C:\Windows\System\pFFXmKp.exe
  2⤵
  PID:8524
- C:\Windows\System\DzZcNOZ.exe
  C:\Windows\System\DzZcNOZ.exe
  2⤵
  PID:8656
- C:\Windows\System\ifFRFTK.exe
  C:\Windows\System\ifFRFTK.exe
  2⤵
  PID:9072
- C:\Windows\System\KDdRVGh.exe
  C:\Windows\System\KDdRVGh.exe
  2⤵
  PID:8764
- C:\Windows\System\hqYyVPR.exe
  C:\Windows\System\hqYyVPR.exe
  2⤵
  PID:8668
- C:\Windows\System\dBhxpVV.exe
  C:\Windows\System\dBhxpVV.exe
  2⤵
  PID:9088
- C:\Windows\System\WkeGwAE.exe
  C:\Windows\System\WkeGwAE.exe
  2⤵
  PID:9120
- C:\Windows\System\ktLGAuq.exe
  C:\Windows\System\ktLGAuq.exe
  2⤵
  PID:8232
- C:\Windows\System\MymOmCz.exe
  C:\Windows\System\MymOmCz.exe
  2⤵
  PID:8396
- C:\Windows\System\iWEbTJW.exe
  C:\Windows\System\iWEbTJW.exe
  2⤵
  PID:8556
- C:\Windows\System\XevEqtJ.exe
  C:\Windows\System\XevEqtJ.exe
  2⤵
  PID:8540
- C:\Windows\System\bBiapss.exe
  C:\Windows\System\bBiapss.exe
  2⤵
  PID:8956
- C:\Windows\System\dqsSVdY.exe
  C:\Windows\System\dqsSVdY.exe
  2⤵
  PID:9232
- C:\Windows\System\qPwilpD.exe
  C:\Windows\System\qPwilpD.exe
  2⤵
  PID:9248
- C:\Windows\System\zdeOFRQ.exe
  C:\Windows\System\zdeOFRQ.exe
  2⤵
  PID:9264
- C:\Windows\System\nfDfpRS.exe
  C:\Windows\System\nfDfpRS.exe
  2⤵
  PID:9280
- C:\Windows\System\PXHlUZX.exe
  C:\Windows\System\PXHlUZX.exe
  2⤵
  PID:9296
- C:\Windows\System\oWoCrtx.exe
  C:\Windows\System\oWoCrtx.exe
  2⤵
  PID:9316
- C:\Windows\System\kwYaHmr.exe
  C:\Windows\System\kwYaHmr.exe
  2⤵
  PID:9332
- C:\Windows\System\CJWBEAe.exe
  C:\Windows\System\CJWBEAe.exe
  2⤵
  PID:9352
- C:\Windows\System\YmvpugZ.exe
  C:\Windows\System\YmvpugZ.exe
  2⤵
  PID:9368
- C:\Windows\System\esmyTbM.exe
  C:\Windows\System\esmyTbM.exe
  2⤵
  PID:9384
- C:\Windows\System\PtFoFny.exe
  C:\Windows\System\PtFoFny.exe
  2⤵
  PID:9400
- C:\Windows\System\uSFHCxm.exe
  C:\Windows\System\uSFHCxm.exe
  2⤵
  PID:9420
- C:\Windows\System\ujKPTVz.exe
  C:\Windows\System\ujKPTVz.exe
  2⤵
  PID:9504
- C:\Windows\System\OHjSIrf.exe
  C:\Windows\System\OHjSIrf.exe
  2⤵
  PID:9520
- C:\Windows\System\uDUMeJq.exe
  C:\Windows\System\uDUMeJq.exe
  2⤵
  PID:9536
- C:\Windows\System\dOeZSYi.exe
  C:\Windows\System\dOeZSYi.exe
  2⤵
  PID:9556
- C:\Windows\System\BuxQrSj.exe
  C:\Windows\System\BuxQrSj.exe
  2⤵
  PID:9572
- C:\Windows\System\Dnjfuoz.exe
  C:\Windows\System\Dnjfuoz.exe
  2⤵
  PID:9592
- C:\Windows\System\LzcJHUV.exe
  C:\Windows\System\LzcJHUV.exe
  2⤵
  PID:9608
- C:\Windows\System\LnQiZhw.exe
  C:\Windows\System\LnQiZhw.exe
  2⤵
  PID:9624
- C:\Windows\System\vrGiSGL.exe
  C:\Windows\System\vrGiSGL.exe
  2⤵
  PID:9640
- C:\Windows\System\LQXfiwb.exe
  C:\Windows\System\LQXfiwb.exe
  2⤵
  PID:9656
- C:\Windows\System\NYVpUVC.exe
  C:\Windows\System\NYVpUVC.exe
  2⤵
  PID:9672
- C:\Windows\System\eOrSezz.exe
  C:\Windows\System\eOrSezz.exe
  2⤵
  PID:9688
- C:\Windows\System\cNtThLh.exe
  C:\Windows\System\cNtThLh.exe
  2⤵
  PID:9704
- C:\Windows\System\NdxtmFE.exe
  C:\Windows\System\NdxtmFE.exe
  2⤵
  PID:9724
- C:\Windows\System\AegTQCx.exe
  C:\Windows\System\AegTQCx.exe
  2⤵
  PID:9740
- C:\Windows\System\QfJaydA.exe
  C:\Windows\System\QfJaydA.exe
  2⤵
  PID:9756
- C:\Windows\System\pHVpQrQ.exe
  C:\Windows\System\pHVpQrQ.exe
  2⤵
  PID:9772
- C:\Windows\System\rmwbGJZ.exe
  C:\Windows\System\rmwbGJZ.exe
  2⤵
  PID:9788
- C:\Windows\System\qlkFrYo.exe
  C:\Windows\System\qlkFrYo.exe
  2⤵
  PID:9804
- C:\Windows\System\NXWGfZc.exe
  C:\Windows\System\NXWGfZc.exe
  2⤵
  PID:9824
- C:\Windows\System\hVhvgMz.exe
  C:\Windows\System\hVhvgMz.exe
  2⤵
  PID:9840
- C:\Windows\System\YSziVtt.exe
  C:\Windows\System\YSziVtt.exe
  2⤵
  PID:9856
- C:\Windows\System\pAFTgpj.exe
  C:\Windows\System\pAFTgpj.exe
  2⤵
  PID:9872
- C:\Windows\System\eXAuPtN.exe
  C:\Windows\System\eXAuPtN.exe
  2⤵
  PID:9888
- C:\Windows\System\CdKtQoJ.exe
  C:\Windows\System\CdKtQoJ.exe
  2⤵
  PID:9904
- C:\Windows\System\OAPxJSh.exe
  C:\Windows\System\OAPxJSh.exe
  2⤵
  PID:9920
- C:\Windows\System\HOTFZmv.exe
  C:\Windows\System\HOTFZmv.exe
  2⤵
  PID:9936
- C:\Windows\System\RdDLwoy.exe
  C:\Windows\System\RdDLwoy.exe
  2⤵
  PID:9952
- C:\Windows\System\CYacYpF.exe
  C:\Windows\System\CYacYpF.exe
  2⤵
  PID:9968
- C:\Windows\System\glRttDD.exe
  C:\Windows\System\glRttDD.exe
  2⤵
  PID:9984
- C:\Windows\System\ZJsMLut.exe
  C:\Windows\System\ZJsMLut.exe
  2⤵
  PID:10000
- C:\Windows\System\PBfVLac.exe
  C:\Windows\System\PBfVLac.exe
  2⤵
  PID:10016
- C:\Windows\System\wDgiiDQ.exe
  C:\Windows\System\wDgiiDQ.exe
  2⤵
  PID:10032
- C:\Windows\System\qCBAiVN.exe
  C:\Windows\System\qCBAiVN.exe
  2⤵
  PID:10048
- C:\Windows\System\VtrEOQl.exe
  C:\Windows\System\VtrEOQl.exe
  2⤵
  PID:10064
- C:\Windows\System\myEUORX.exe
  C:\Windows\System\myEUORX.exe
  2⤵
  PID:10080
- C:\Windows\System\ypOtKjE.exe
  C:\Windows\System\ypOtKjE.exe
  2⤵
  PID:10096
- C:\Windows\System\mUoOFMY.exe
  C:\Windows\System\mUoOFMY.exe
  2⤵
  PID:10112
- C:\Windows\System\ycBBaMT.exe
  C:\Windows\System\ycBBaMT.exe
  2⤵
  PID:10128
- C:\Windows\System\TTiEXfx.exe
  C:\Windows\System\TTiEXfx.exe
  2⤵
  PID:10144
- C:\Windows\System\wrYMTNl.exe
  C:\Windows\System\wrYMTNl.exe
  2⤵
  PID:10160
- C:\Windows\System\sHBaCtL.exe
  C:\Windows\System\sHBaCtL.exe
  2⤵
  PID:10176
- C:\Windows\System\SNlmIml.exe
  C:\Windows\System\SNlmIml.exe
  2⤵
  PID:10192
- C:\Windows\System\ryknGUD.exe
  C:\Windows\System\ryknGUD.exe
  2⤵
  PID:10208
- C:\Windows\System\ZQvNSuO.exe
  C:\Windows\System\ZQvNSuO.exe
  2⤵
  PID:10224
- C:\Windows\System\elZzXCR.exe
  C:\Windows\System\elZzXCR.exe
  2⤵
  PID:8736
- C:\Windows\System\sgBRfhV.exe
  C:\Windows\System\sgBRfhV.exe
  2⤵
  PID:8880
- C:\Windows\System\UZhaqQt.exe
  C:\Windows\System\UZhaqQt.exe
  2⤵
  PID:8588
- C:\Windows\System\yPbBdne.exe
  C:\Windows\System\yPbBdne.exe
  2⤵
  PID:8784
- C:\Windows\System\jKZVXKz.exe
  C:\Windows\System\jKZVXKz.exe
  2⤵
  PID:8892
- C:\Windows\System\jAZBcaS.exe
  C:\Windows\System\jAZBcaS.exe
  2⤵
  PID:9312
- C:\Windows\System\nsTCosN.exe
  C:\Windows\System\nsTCosN.exe
  2⤵
  PID:8864
- C:\Windows\System\NhADezv.exe
  C:\Windows\System\NhADezv.exe
  2⤵
  PID:9184
- C:\Windows\System\deuSlLL.exe
  C:\Windows\System\deuSlLL.exe
  2⤵
  PID:8360
- C:\Windows\System\karJeVY.exe
  C:\Windows\System\karJeVY.exe
  2⤵
  PID:9228
- C:\Windows\System\COJBREj.exe
  C:\Windows\System\COJBREj.exe
  2⤵
  PID:9292
- C:\Windows\System\CcgDQkh.exe
  C:\Windows\System\CcgDQkh.exe
  2⤵
  PID:9348
- C:\Windows\System\fmExFIj.exe
  C:\Windows\System\fmExFIj.exe
  2⤵
  PID:9412
- C:\Windows\System\aSZTSdN.exe
  C:\Windows\System\aSZTSdN.exe
  2⤵
  PID:9328
- C:\Windows\System\yrWfvFg.exe
  C:\Windows\System\yrWfvFg.exe
  2⤵
  PID:9396
- C:\Windows\System\YMYyOQP.exe
  C:\Windows\System\YMYyOQP.exe
  2⤵
  PID:9440
- C:\Windows\System\NJeTZSz.exe
  C:\Windows\System\NJeTZSz.exe
  2⤵
  PID:9456
- C:\Windows\System\CYIcPTM.exe
  C:\Windows\System\CYIcPTM.exe
  2⤵
  PID:9472
- C:\Windows\System\oRbmrmg.exe
  C:\Windows\System\oRbmrmg.exe
  2⤵
  PID:9484
- C:\Windows\System\ZMDDOGJ.exe
  C:\Windows\System\ZMDDOGJ.exe
  2⤵
  PID:9528
- C:\Windows\System\njeyLlM.exe
  C:\Windows\System\njeyLlM.exe
  2⤵
  PID:9512
- C:\Windows\System\Prczjdw.exe
  C:\Windows\System\Prczjdw.exe
  2⤵
  PID:9552
- C:\Windows\System\vRjceRm.exe
  C:\Windows\System\vRjceRm.exe
  2⤵
  PID:9620
- C:\Windows\System\FSANyzz.exe
  C:\Windows\System\FSANyzz.exe
  2⤵
  PID:9712
- C:\Windows\System\KwPicBi.exe
  C:\Windows\System\KwPicBi.exe
  2⤵
  PID:9752
- C:\Windows\System\byDzVOl.exe
  C:\Windows\System\byDzVOl.exe
  2⤵
  PID:9816
- C:\Windows\System\HMpsMiy.exe
  C:\Windows\System\HMpsMiy.exe
  2⤵
  PID:9868
- C:\Windows\System\pNoWTaX.exe
  C:\Windows\System\pNoWTaX.exe
  2⤵
  PID:9664
- C:\Windows\System\bNrBbBu.exe
  C:\Windows\System\bNrBbBu.exe
  2⤵
  PID:9600
- C:\Windows\System\jiDrJQU.exe
  C:\Windows\System\jiDrJQU.exe
  2⤵
  PID:9768
- C:\Windows\System\ggvBdhj.exe
  C:\Windows\System\ggvBdhj.exe
  2⤵
  PID:9928
- C:\Windows\System\WuSRBtl.exe
  C:\Windows\System\WuSRBtl.exe
  2⤵
  PID:9800
- C:\Windows\System\gFcyPIQ.exe
  C:\Windows\System\gFcyPIQ.exe
  2⤵
  PID:9864
- C:\Windows\System\lfiJioD.exe
  C:\Windows\System\lfiJioD.exe
  2⤵
  PID:10028
- C:\Windows\System\CDNTSji.exe
  C:\Windows\System\CDNTSji.exe
  2⤵
  PID:9944
- C:\Windows\System\DSzVFyW.exe
  C:\Windows\System\DSzVFyW.exe
  2⤵
  PID:10120
- C:\Windows\System\NVbMhfV.exe
  C:\Windows\System\NVbMhfV.exe
  2⤵
  PID:10124
- C:\Windows\System\mleGJPe.exe
  C:\Windows\System\mleGJPe.exe
  2⤵
  PID:10156
- C:\Windows\System\wOJJWht.exe
  C:\Windows\System\wOJJWht.exe
  2⤵
  PID:10172
- C:\Windows\System\oxyJdcT.exe
  C:\Windows\System\oxyJdcT.exe
  2⤵
  PID:10184
- C:\Windows\System\cEmDCvb.exe
  C:\Windows\System\cEmDCvb.exe
  2⤵
  PID:8800
- C:\Windows\System\uoTurZV.exe
  C:\Windows\System\uoTurZV.exe
  2⤵
  PID:7964
- C:\Windows\System\dvuJvCL.exe
  C:\Windows\System\dvuJvCL.exe
  2⤵
  PID:8720
- C:\Windows\System\frCqDsr.exe
  C:\Windows\System\frCqDsr.exe
  2⤵
  PID:8672
- C:\Windows\System\QdAELTd.exe
  C:\Windows\System\QdAELTd.exe
  2⤵
  PID:9324
- C:\Windows\System\ODiLqdP.exe
  C:\Windows\System\ODiLqdP.exe
  2⤵
  PID:9340
- C:\Windows\System\KJMZUwh.exe
  C:\Windows\System\KJMZUwh.exe
  2⤵
  PID:9492
- C:\Windows\System\HxmHTZK.exe
  C:\Windows\System\HxmHTZK.exe
  2⤵
  PID:9548
- C:\Windows\System\iTMkXvW.exe
  C:\Windows\System\iTMkXvW.exe
  2⤵
  PID:9288
- C:\Windows\System\GNpbNog.exe
  C:\Windows\System\GNpbNog.exe
  2⤵
  PID:9452
- C:\Windows\System\ibPunDl.exe
  C:\Windows\System\ibPunDl.exe
  2⤵
  PID:9496
- C:\Windows\System\kuWbnDo.exe
  C:\Windows\System\kuWbnDo.exe
  2⤵
  PID:9684
- C:\Windows\System\MpGGHbV.exe
  C:\Windows\System\MpGGHbV.exe
  2⤵
  PID:9636
- C:\Windows\System\FaIMPOQ.exe
  C:\Windows\System\FaIMPOQ.exe
  2⤵
  PID:9996
- C:\Windows\System\eFgZyjv.exe
  C:\Windows\System\eFgZyjv.exe
  2⤵
  PID:9748
- C:\Windows\System\irGZCdB.exe
  C:\Windows\System\irGZCdB.exe
  2⤵
  PID:9836
- C:\Windows\System\OTkTgFR.exe
  C:\Windows\System\OTkTgFR.exe
  2⤵
  PID:10060
- C:\Windows\System\WFVguiF.exe
  C:\Windows\System\WFVguiF.exe
  2⤵
  PID:10088
- C:\Windows\System\TlPxjek.exe
  C:\Windows\System\TlPxjek.exe
  2⤵
  PID:10008
- C:\Windows\System\oFKLAmi.exe
  C:\Windows\System\oFKLAmi.exe
  2⤵
  PID:9152
- C:\Windows\System\TJpQYEM.exe
  C:\Windows\System\TJpQYEM.exe
  2⤵
  PID:10136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CYhSuFO.exe

Filesize
1.9MB

MD5
7d962c1efd159642e4eee880fd7a68ad

SHA1
cefb25e673e49a087a371aea6515f07df38449d7

SHA256
dcbf93b01fda31a79aaef7eb232aec467f4c063f106721eb1d3a296f3e8a3773

SHA512
691eadfe566ad5722603000d5692e6c8076ad83fe207cfef45437b83ab03d8db9ea24e4c08c36433a964f1b1fa298f20c68cbf859397f9eb3c5cf595975d4e3b

Download Submit
C:\Windows\system\DNpWGJE.exe

Filesize
1.9MB

MD5
637662f35821da28c93fcfcc054cd107

SHA1
49d8df88160f3d6dafa4e61045f764bbf3d6de86

SHA256
44c8223484d9b277e44a419e5750c4350811ccd290f2c2c10e80928f13c1adca

SHA512
be8a6270b46efeb64054d72b018a544a25de71e0631000d980543d569f83dbf4c70e3c77580d37451c25bd1ef7eb834befee0fe41438c705a6eb28ccc411b9fe

Download Submit
C:\Windows\system\FfDkHJv.exe

Filesize
1.9MB

MD5
0047391b5611b125c49f66bb465e52da

SHA1
8e4f4223cd98d5bbd0e0f874e205dd9c99c94860

SHA256
0b2bb07e8355385d7684364fc8fdead55f728ce3c94c2311f6cf2466fed8e87e

SHA512
121c2cbf55d80d0aa6b3aa776f726aa08e34fae13a534e20476a633048e2603ad93c3c74ab4f97388779242c661642a6b863c06476e7b118953ed56dae71cd60

Download Submit
C:\Windows\system\KwHaJnw.exe

Filesize
1.9MB

MD5
9b3ae117665c8b96e0538c21f87f33c0

SHA1
6523214a76e34ee10e99e1c3a6e994ba207bb9ed

SHA256
38890d0dfc88b12a645ecfcc2f01a798d4ff3f85873b41d4e372a8508cc42300

SHA512
7e9ec41d9beaf885f08d5604af42ed75ceec4a26a0191c2f31e6e821da2ad43a88916ebe9ae953b1d853c56a000aaf42fa0b7a169c1303abd564370f99332a62

Download Submit
C:\Windows\system\LKXdQNV.exe

Filesize
1.9MB

MD5
d0b681665a477ee78767423e25f095d8

SHA1
e01b23b67b6de2b9fb7672ef785a5a837965f8a9

SHA256
810001484c004af0daa083cf38ff61882269b5fb0c45a19acd7626bf9f1b92fc

SHA512
90e81545676b43fad84edaaf4b0829d108c0f098ca819a045d3a072b8710f8a7549782b23ae3f4c3c797868e0dba403533d8edac28efb5fa3904d0f1276989e0

Download Submit
C:\Windows\system\MKtCMZL.exe

Filesize
1.9MB

MD5
480dd22197711d38101fd34b5d5b73ba

SHA1
4580d15035e1324330c1024d1d6254c906094643

SHA256
e8b9743c9b6c69d81ccee065644955bd1b268f26a0471c5dd9001fcccfa44ff6

SHA512
66e8ceb5ca77f45cc3ba9dee28f29b1f23b9b0253f381e193190d12f806270f39396af5a592771a139023feaa62fa83f727cbbf270e93580695216a4d860a862

Download Submit
C:\Windows\system\MPwKGRV.exe

Filesize
1.9MB

MD5
c34820d5d6fac8fd546a4eab19cf4bc6

SHA1
8b26023628c167882dedb8ed096267963304f9c0

SHA256
5dd63c21f0961cde29882829e65969bc29c395662fb403a76c8f52c23b2ea748

SHA512
e1105e1283134bcbb5dd89fd658225bac2f564f322116442fd5b21ab9f9e35a5eb504890ed74e13cc4b60a469f24fb1e73f5852112d119c9022feb5da008b8ef

Download Submit
C:\Windows\system\MhdqoMm.exe

Filesize
1.9MB

MD5
49361eaf906b1a5901fa05abb1fe267e

SHA1
d0c299db69645d3b4473684c1b827828f09a0b0a

SHA256
bbbc134f450c426d4f3e3503a52ddd9fdd0c919aa6d1581ae796227c85d23726

SHA512
5bb383cf6509a0629a468388e42eb4167b48d82ea06f3988eac135c9ef03ab997d41204d0d3379b4b44e5750bea0531b02ccf8ead15c4dca6e8dc726fd161793

Download Submit
C:\Windows\system\QjWnjhW.exe

Filesize
1.9MB

MD5
f6cec82327ff508ae103e212ff9a84c5

SHA1
8a893aa6c18036da568f06473295981dc9267f8c

SHA256
e7692a9e5a56accfc2fef68120d31623e3f932c018b9713c9b428d1e8cb44602

SHA512
5d3f0a44656e6fecc10d92d71110dcd01fa6e49632bd57013ada4e2798c101c474f7c5b01453edcef8675b79f2f5ad47566b71ad211c6b9da616a53179e9c447

Download Submit
C:\Windows\system\RUlOiru.exe

Filesize
1.9MB

MD5
b734555f7d9cb94c686e928b3b616e30

SHA1
e5676190747f0914912993d1ecd6502af9557291

SHA256
36945d6944f2d413b56daaf6aa045e68b2a9d6bc4b85ad61902a68a6ba3992b4

SHA512
42b0c2c56000aa075b29e93396f298f9d73b17571b194bcfa178497dca50d9a9c9d39201b08f59e72acf24bd1ae8d8fa4e3b7d186dc5af9ed12b321424db9d89

Download Submit
C:\Windows\system\TtTgIbY.exe

Filesize
1.9MB

MD5
e826a259f42167241e8664d4e50e707b

SHA1
d884b542e558e489a9afea9958a27ac684fa7976

SHA256
2e9eecfe1fb785efba5ec758928dfa3f4e49987baadaadc0d46e0b83180400b6

SHA512
4e29cc4b4adbf45bfcf80948a3f889cdc01420c6e1ac26826d7442642f84d6a84ce5cd7d43b9d6c77aa873f15ddd212c27993ca160fedb92d0dbcf1c28a72bec

Download Submit
C:\Windows\system\WgszdBo.exe

Filesize
1.9MB

MD5
451420c5e286c4eff5f2a5db6b644a35

SHA1
b5124bdced53b8abbba622131a7605debd2a90a4

SHA256
d8c313831615adf371ce37e14e795470b2466f1d1b9bd99f0959a9ad669525f1

SHA512
6224abee4447cdafe4b8f91ab243e9804e4b8c4f64ea75949342392694f85f8761f532b7c3e64875595067d4c1f922c43c1c127973239bea8d7f403aa6800541

Download Submit
C:\Windows\system\WseXjmf.exe

Filesize
1.9MB

MD5
66bae26c4a8fb606521816666c570ecd

SHA1
62cd33e85f2f2761fbdc2d1c91e2e40b8a7a6c52

SHA256
dcd9d6436d1af7bbdc2545ca2895f348b2d1717104bd1548c7dd66049c8fb768

SHA512
25609b2d1048963bee8bdba7f5b11513d6f90ce74efe14af7e3ea4e63fe157f128e10f264398321bed0a2931f243083bb10990ef606119f1a326b0209231bf02

Download Submit
C:\Windows\system\XVmEQHr.exe

Filesize
1.9MB

MD5
13b10be0031b352b29d7c3cfc0b1dee0

SHA1
84e099372ef9333c48ece66dcdd2c7d813f31418

SHA256
27d1ade164509649024de33b919e87edc419df1394a976cda5d266dde89b1780

SHA512
dc7daddf8c5d045a51e78caa2d561ad7b4f307423994ff417d9f72b6d14b45ae536035f14f1980e7d03e3c4071855404689710382d0882fdb12a27740373fed3

Download Submit
C:\Windows\system\ZdidFXv.exe

Filesize
1.9MB

MD5
045087d08e76f81203f4bb0593d24202

SHA1
bf3871e4b27041d42647f6ca58ea888d0a05a085

SHA256
aa6e1583131327fe3477c32bf438f021bc56e6ce9b0e1414958304c78f1e4e74

SHA512
5c8bc83b94334b722e3dc1f436baa1b4295c3a6ddc1d86be5475798a52cae1dcb4d2b6ef7b65185371ff13db5e155440df6fd093e1d0972271d205051b9e3904

Download Submit
C:\Windows\system\accGxUi.exe

Filesize
1.9MB

MD5
70333d096dfdd95e692d7ccd19682681

SHA1
8fab50bc7dd243e47050c55e515508704dd9d53e

SHA256
16dc29a333251cc3820c131d18be8708cc866f8f3664a1d960e693d01fe4f27c

SHA512
e0484bcd2b6111fa9327f4f0971dbd66fa8860ab4210f876b96b1e814fd9eaf695324adb8f589422015283076d59e78022c5cdcded155fd67bf24a470343ddfa

Download Submit
C:\Windows\system\cEelLzc.exe

Filesize
1.9MB

MD5
f8747c3db366281647487b27e67d71f5

SHA1
b3604c5e8b51d4466f3c2e949848808bb45c2eed

SHA256
e5a22a649f316f765c44dc2b729077b9b9f3caa77828017e83d1e8d02905ba16

SHA512
db4ca3295f4a21c1a7974e03d88338cdabda552d484efb04ef4a8ee2f81b58000b33db87d4885ff9ea4f8558e0946ea44e27316ebff6f4db8b5f668045a96f32

Download Submit
C:\Windows\system\gYXQJZL.exe

Filesize
1.9MB

MD5
6b4909474a3474bb93319ef4fb926541

SHA1
4c80961c79846e3388e71f9f8a7c1b64d86fc1bc

SHA256
6663537c2388c778b55423a6566c61f6d576477a7f009f0c618270d66b01c954

SHA512
90db882db2d6eb549bbe85bc9a23d052c617a44f6fac07e6a0c77a49301258f11ed5cccadaac5e73a2efa1c3155c10b3cc4fa74dacd6504054e3c73139cefa00

Download Submit
C:\Windows\system\jQyNSTu.exe

Filesize
1.9MB

MD5
1c2ad128266c80316ba91671c26a7bc1

SHA1
d38bc4a41d70c1a3469dd7dfa76fefe4b45a7289

SHA256
4c20be89a21493efed321ed2f97d160649197428c1f62f8bb22dc877c6fcf8fa

SHA512
a6daba0d4e731fc338df90d8854df60adf9e968d5421617e2f77cbb08b8351b8503214fbd6693d9066248300bcecc3a5cb58ff4d42e06f9b440359844cdb0ddc

Download Submit
C:\Windows\system\ljuemmX.exe

Filesize
1.9MB

MD5
a871d9a769f73aff508f3c9758265f51

SHA1
3111b3799459206f342e700c0cabe4e32019547c

SHA256
abda8a7817b0dece02c6c6596908447ee818fcff271d19fa90f99e3ce4158f09

SHA512
bdc45985fe9116166eaf5fb94ee5e4916364da4ae3c80be09713defdc80705e033182dd9c0a7f52e618c4d57409289c2d2f4e54fd5a18646c02b6e7233fe6e3a

Download Submit
C:\Windows\system\mfIPLWC.exe

Filesize
1.9MB

MD5
87bab2e561df32283160cde5ef34cff2

SHA1
fa421be9ffc6934a46a0532c69fa4539f8680159

SHA256
29b67675ac4d1d099d7db320624e95216cbd1cacafd5de800117ba9fd0e6f4a8

SHA512
aa513c8ab16d15644308670b19faeec2f94c85866009804331836214dad2d9bb5410df89e256698e10d86daed664d2dd72c1e842bd305f31227f5834e113952e

Download Submit
C:\Windows\system\pSIbWBW.exe

Filesize
1.9MB

MD5
dc54c5b77da4338cbede9fb60979ff16

SHA1
745dd3fc7cc5bd23b63cbcb916ccf5c5e18174dd

SHA256
b5348bd0b05ff7a7c43a055a240d2f2c1c84b57a49012b4863cd022d81681370

SHA512
b7dd01677febc012ebdae51db43be47c010e308a4d429d5d945a46be8c16a73293e7a3f2b8df2dbc01f103e3c63c09707af6530428b91df5a01ce2827ac19206

Download Submit
C:\Windows\system\xGvIOnO.exe

Filesize
1.9MB

MD5
83ee864618e166e80261d4ab63b6e61a

SHA1
315581a9f53f3212859a4212fd7af2c8237bd3b7

SHA256
b7666b7e4f65248e413a8382bb250cc138bd806e8773ffcf85428a7cc7ebbcd1

SHA512
28e9f2468dbd5630dd91144797f42337fa355d7868e28d59fa0bfea9df52467dcdc722f7e4f5ba9fc3da3ac7a5c7eabad2d90eae318b22735af19be25a110b31

Download Submit
\Windows\system\AGVNhmg.exe

Filesize
1.9MB

MD5
aee70badeb4dc9a9d3536766ea207844

SHA1
a3cfb53bc84f9d8daf2e44faf051f26836e934d0

SHA256
c83498c764e82e9fd62825d14ea01fcd6a95f3c7d1ca3c0b5af321c4d396566f

SHA512
88e0a21d75c50e5a185ecd0a82638ccb2242c6b28aef7ef98a5b2adaa8847d9dde0382896eb52f5ebd1e35d8ca0fb70dae198999ea7b3bef255d94e5e7b0b6e9

Download Submit
\Windows\system\FIrHGNS.exe

Filesize
1.9MB

MD5
ad8b96006ba4801458d79b9f8f8ba558

SHA1
95dfc7aed475c1694ff148768cde8225675423b5

SHA256
5f37eb101375bd1a95d26f6e1c1545ec36fa27453766c33787602e44bb1dbf32

SHA512
0ae5408110f502b907baa00ab3d5bd30778b94b44d9e374d6df4005c99cab33d212a479f30ce2a5204809fd09a919cde697b7dbb4381ef47e38f934336c62565

Download Submit
\Windows\system\MjONxTD.exe

Filesize
1.9MB

MD5
de2f337d24e0cd0bfd380f11994be185

SHA1
a7f16b31944d37124c0027ee585eda92c733c100

SHA256
8f936a7b0a14244be152cebc389d2962627951c80a608ed823bcae470f588589

SHA512
fb259d055dcd38000c6305ebb58b9ebe973815da4117e0b730939cb01666441698904231a2ffb2b2f06f458c29bd3d5c35709941ccd9f4a9fe4947c6ed59a84c

Download Submit
\Windows\system\MoNSLVo.exe

Filesize
1.9MB

MD5
cf10f2e7736b7240bc1bdb40f6401086

SHA1
83dd90ef56b27e4fe5d6770867f09c60f89b477a

SHA256
d93749e246ecb638b3a79e5d079f3eb940c18bc799944d08da595b0547503989

SHA512
645514ff63d55cd462a7a2247aece7f027b03e91e59c179bd250fdb753edcb19d5cdee430cd4fe552dc27d3023301e8a792b3d028de7c15f4d9b67679d187152

Download Submit
\Windows\system\NqNkgWz.exe

Filesize
1.9MB

MD5
accb56af827a36308436461f1d1150f4

SHA1
45930856049efc6d5d8402ff325a6c9873c8a08a

SHA256
a2fa7c4ba338e4693305eae47b6a508fd3536400716f45537a437f7839a53c5f

SHA512
c7dcf4c00e58bd73aa28339c9bbc91320fc64b525e6483f3562fd2073bc28da249b46d4df3329032689d7d03d79d6f1a554f9e89afac46eb92f94014d5bc060b

Download Submit
\Windows\system\RufnsfU.exe

Filesize
1.9MB

MD5
b106dd1e74c3b197b1ce6b21c7e278a5

SHA1
137a631b701bb4dfc72be3f91d6d573ed9c4ee82

SHA256
3a57d690517c2e61f731b2edc89af204be69b1b9057243691e33e957f23a1da2

SHA512
e22cdcd27f9b9041143332c86827b5f15b3960baf92aa83d4730e4e697a83d523820a35c7355f21355b7ba5ba2d2a7bf9dba59415fcbbeb21be63a8b06d3d6d1

Download Submit
\Windows\system\dLAXfMU.exe

Filesize
1.9MB

MD5
06d95d364ab67a9265bb44ffe410200f

SHA1
25ef314b83dc90a60a44955485aad50ec3d36682

SHA256
51a6cb49578566c4c5c338ad9b1789d2540e8eee44040b7885f37b8de724d251

SHA512
7540784a7bedab321328bb45d100a3e3c7fe9a2165b48757dda6f713a6653dad94b0ccb026655bf5f1b83d542fee9c83d4db41368dc11828fa379823ccd2f3a9

Download Submit
\Windows\system\fLbVhwu.exe

Filesize
1.9MB

MD5
e0c57f03a237dd25190d12f22dc8ff88

SHA1
ff3ae5cb54fd395f75898c5554cd52931531b6ba

SHA256
395a53243d5c37e0b147b45e8134169999c48e57f439cdbb2561074634f2a1a4

SHA512
33e791a17eb7a006c8aa0083c5881a4aa55696dc38f016a4b84b1079162463b563a2c5aa40d1cd383902835767b14dabcc3f4a0b6e631656a887996f1fc116e9

Download Submit
\Windows\system\fvZbLQK.exe

Filesize
1.9MB

MD5
5cf74890d9d2c15529240c415a47554a

SHA1
f9f154ea9b20317bcda581711f2ba0784e3b045b

SHA256
7e1ff071aea4b364b5d96548e2d6047da296970893b32dc0c7b6977db06de51d

SHA512
9c16abb83c47814307164d162ee5730925b796030ae2efa3b5a74341f98fb68811e7de892b22c7cca1dd3a8b60af012ea23797354ebf7822ea69e99dce89cc8d

Download Submit
\Windows\system\lLOOFIX.exe

Filesize
1.9MB

MD5
4d5cdea99fe4bba1a4c6970a48610d95

SHA1
c05278fcbca1407fcc455ebb1569eaa63df3fd2d

SHA256
98d46ed9dae76db709ebae356c7de13fd7f452a8297dd40cd5e80cc32596acf1

SHA512
d9dae6201ffa6588fcf4cadbb28ef5d74f1b8b7ebfdaa43e6abe4956e3190c746715bb701de7e801fd32808e386492a8d14226aa8e7a71bf96b2296fd33071f1

Download Submit
\Windows\system\mOqYzLs.exe

Filesize
1.9MB

MD5
f8fd9fa39acaab177df30691ef41e6cb

SHA1
cb497c82d498b62eb80c2626d9235615450f3e34

SHA256
39988cafbdd9545b288ac6185d50079d579088013e6e0891a2aba43eaad05b7a

SHA512
458fb422f5c99f2f72d7e63ca9bd710e66401e2afb937116fa3e507b85b25dba306047645982021e919cc55d8eb3a2282ac0a1f8932d7001a9ae17bb26443860

Download Submit
\Windows\system\mpVeWVj.exe

Filesize
1.9MB

MD5
bfa6c6f18ee3a46245987ce34e6f5e83

SHA1
d89276808c699c8b312ae5e592f25362440583e4

SHA256
d07e3ab5d2757a34f427e57f5877a5b3adbc81ef5b0ad925144ab2ffab3ff3c3

SHA512
a6773a15216be74090eb59291e2c93ee52568914fbab050006097fe771e5ce5ee58781534213237e5b5bd19142f9d70fecb0ed6ef9b59feda31626048e32adbd

Download Submit
\Windows\system\nFjSVUX.exe

Filesize
1.9MB

MD5
d56e3dce244c9486f8a9ff1c9f0368c5

SHA1
8beb97831dc4e0eaf77ff4df5656ec334ada4cfb

SHA256
eb7d8b6f005cbb75210166c83803f1b54e026316d6df82a0f9173d09a867d21d

SHA512
a4c8963f74ec11f9b750d06cfa0754093976da505755649428c348d65cb5e43ace174c2bca374a2deb8fcc478a983022cdc97a6e21e8a4a7eff56ad924500937

Download Submit
\Windows\system\rHwFkXG.exe

Filesize
1.9MB

MD5
7190bcb29e482b1de02cc0c7b4e517a9

SHA1
fc617caa46f5f2519cb4e332a74425250b3493e4

SHA256
f2056f8ec879be962eed80bfe77a7ff14ee5b353c8269662d73c1e84d6a47da4

SHA512
1af92e1996ab8d63149ac44004d3abc2920ca7dec2f8a567d9ace2a4542905c8588beab843932115d28a0aa2939a54cd048d2efa49390ec5d9fa2fcc02dcd07d

Download Submit
\Windows\system\rxPKzkD.exe

Filesize
1.9MB

MD5
0a02de792259b37f0f4548a93fff202d

SHA1
2bfc00ebce4dbc0860c8775a477fe8ec2c4f0914

SHA256
ae49a400b27eb6d5323cc3a9198cd19ea4fe4a9d0de1b01f7f3e32442415ddb1

SHA512
6553846e7b5508b343080c28b8a4889894a2f9905e89902cf4cff75d1535fd0f1e2f75fe9fc617e865588212d3ed6bb0eaa76332aac197167bc0643b2f2cfdbb

Download Submit
memory/304-65-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/304-0-0x000000013F030000-0x000000013F422000-memory.dmp

Filesize
3.9MB

Download
memory/304-62-0x000000013F910000-0x000000013FD02000-memory.dmp

Filesize
3.9MB

Download
memory/304-56-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/304-25-0x0000000002E20000-0x0000000003212000-memory.dmp

Filesize
3.9MB

Download
memory/304-59-0x000000013FF20000-0x0000000140312000-memory.dmp

Filesize
3.9MB

Download
memory/304-51-0x0000000002E20000-0x0000000003212000-memory.dmp

Filesize
3.9MB

Download
memory/304-31-0x000000013FF50000-0x0000000140342000-memory.dmp

Filesize
3.9MB

Download
memory/304-64-0x000000013FBB0000-0x000000013FFA2000-memory.dmp

Filesize
3.9MB

Download
memory/304-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/304-66-0x000000013FD00000-0x00000001400F2000-memory.dmp

Filesize
3.9MB

Download
memory/304-103-0x000000013FBC0000-0x000000013FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/304-68-0x000000013FEA0000-0x0000000140292000-memory.dmp

Filesize
3.9MB

Download
memory/304-91-0x000000013F870000-0x000000013FC62000-memory.dmp

Filesize
3.9MB

Download
memory/1784-57-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/1784-6171-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/2100-6170-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/2100-27-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/2112-96-0x000000013F870000-0x000000013FC62000-memory.dmp

Filesize
3.9MB

Download
memory/2112-6162-0x000000013F870000-0x000000013FC62000-memory.dmp

Filesize
3.9MB

Download
memory/2176-385-0x0000000002720000-0x0000000002728000-memory.dmp

Filesize
32KB

Download
memory/2176-348-0x000000001B560000-0x000000001B842000-memory.dmp

Filesize
2.9MB

Download
memory/2284-61-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/2284-6188-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/2416-6185-0x000000013FBB0000-0x000000013FFA2000-memory.dmp

Filesize
3.9MB

Download
memory/2416-39-0x000000013FBB0000-0x000000013FFA2000-memory.dmp

Filesize
3.9MB

Download
memory/2420-6189-0x000000013FF50000-0x0000000140342000-memory.dmp

Filesize
3.9MB

Download
memory/2420-54-0x000000013FF50000-0x0000000140342000-memory.dmp

Filesize
3.9MB

Download
memory/2748-6152-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/2748-67-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/2808-6192-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/2808-87-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/2892-6199-0x000000013F0A0000-0x000000013F492000-memory.dmp

Filesize
3.9MB

Download
memory/2892-63-0x000000013F0A0000-0x000000013F492000-memory.dmp

Filesize
3.9MB

Download
memory/2968-6174-0x000000013FD00000-0x00000001400F2000-memory.dmp

Filesize
3.9MB

Download
memory/2968-60-0x000000013FD00000-0x00000001400F2000-memory.dmp

Filesize
3.9MB

Download