xmrig | a51c4f02dc8f76da4d0386dfad253461718cb0adaf62ad8ef2fc858ed143d138

Analysis

max time kernel
119s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
06/08/2024, 00:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e42ae430721c949ff5a71ddcf1e1400N.exe
Size

1.3MB
MD5

2e42ae430721c949ff5a71ddcf1e1400
SHA1

859587d6ca01ba0f69efa0ac63ff570cc0571ddd
SHA256

a51c4f02dc8f76da4d0386dfad253461718cb0adaf62ad8ef2fc858ed143d138
SHA512

2031a2dd4d32540e6fc265811e6444b611d3baeaedc7aa4013c3b990baabb6f2836fcd9fad2b2edc145782b4294f801b4d706840656c7c74d1cacc580fe4c0c8
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYsfLGrAvWWXkCV+1MKTbcMfHLmB:Lz071uv4BPMkibTIA5sf6r+WVc2HLa

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 21 IoCs

miner

resource	yara_rule
behavioral1/memory/2788-13-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	xmrig
behavioral1/memory/2792-43-0x000000013FF80000-0x0000000140372000-memory.dmp	xmrig
behavioral1/memory/2868-117-0x000000013F350000-0x000000013F742000-memory.dmp	xmrig
behavioral1/memory/1376-109-0x000000013FED0000-0x00000001402C2000-memory.dmp	xmrig
behavioral1/memory/2924-107-0x000000013F480000-0x000000013F872000-memory.dmp	xmrig
behavioral1/memory/2096-106-0x000000013FB10000-0x000000013FF02000-memory.dmp	xmrig
behavioral1/memory/2928-104-0x000000013FA60000-0x000000013FE52000-memory.dmp	xmrig
behavioral1/memory/2644-60-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	xmrig
behavioral1/memory/2588-58-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	xmrig
behavioral1/memory/2520-56-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	xmrig
behavioral1/memory/2572-54-0x000000013F550000-0x000000013F942000-memory.dmp	xmrig
behavioral1/memory/2216-52-0x000000013F830000-0x000000013FC22000-memory.dmp	xmrig
behavioral1/memory/2788-4397-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	xmrig
behavioral1/memory/2644-4411-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	xmrig
behavioral1/memory/2216-4442-0x000000013F830000-0x000000013FC22000-memory.dmp	xmrig
behavioral1/memory/2520-4437-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	xmrig
behavioral1/memory/2096-4658-0x000000013FB10000-0x000000013FF02000-memory.dmp	xmrig
behavioral1/memory/2572-4661-0x000000013F550000-0x000000013F942000-memory.dmp	xmrig
behavioral1/memory/2588-4669-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	xmrig
behavioral1/memory/2928-4664-0x000000013FA60000-0x000000013FE52000-memory.dmp	xmrig
behavioral1/memory/2868-4716-0x000000013F350000-0x000000013F742000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2268	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2788	lfUgiUd.exe
2792	ltycYQi.exe
2216	FrwTbZg.exe
2572	ZSBhkEe.exe
2520	LlIQvMg.exe
2588	usiAtzX.exe
2644	Qiqotnp.exe
2928	CrvpKAO.exe
2096	wZapFaQ.exe
1376	bONAUhS.exe
2868	zUqEpcB.exe
2064	LxyQktM.exe
2860	zPSjYIp.exe
1396	uGWHXQh.exe
1148	RhApCkB.exe
2832	IzVyTyR.exe
1860	EufdMCG.exe
1644	uoneKub.exe
2148	jFlwVsg.exe
2112	KNFvcza.exe
2060	gOAWtOa.exe
2984	xRaLRxr.exe
1628	kDinUvN.exe
1036	ZxlwUxu.exe
1096	UvyrzTu.exe
1816	YHkuKQi.exe
2420	jRTodFw.exe
1892	yuGiqHh.exe
2384	AHnZJwN.exe
1040	ZiXSGhg.exe
1756	OSDTYsn.exe
2232	jpHdXQJ.exe
1684	kdAkvXY.exe
1760	edfVUrN.exe
2040	UpCVIik.exe
1016	TPbgQfl.exe
2132	yTDqKSi.exe
1632	UZEupGO.exe
2024	rNlCcHQ.exe
2320	OpwlCYG.exe
2092	BGEzaNw.exe
668	MXXvTKs.exe
1896	kvzZKwe.exe
1492	wGNUMVQ.exe
1504	IPqlZNv.exe
1128	bRJRMPJ.exe
1596	jJhNFzO.exe
1600	OBDvIsF.exe
2672	rtAJcPU.exe
2240	mKhVnMQ.exe
2732	aaOdNhL.exe
2724	BYhiIlc.exe
3028	zZSDTST.exe
1796	IfVIgnc.exe
1380	DHtkldV.exe
2944	yadwjWn.exe
2688	IWizRNQ.exe
1988	NseqvwL.exe
3000	dsyZHHx.exe
1124	xNBZHPJ.exe
2636	tdGBEFi.exe
2896	MHMBftw.exe
2864	NyUFBsA.exe
1980	eQxEbZd.exe

Loads dropped DLL 64 IoCs

pid	Process
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
2924	2e42ae430721c949ff5a71ddcf1e1400N.exe

UPX packed file 53 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2924-0-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	upx
behavioral1/files/0x0009000000016c5e-3.dat	upx
behavioral1/memory/2788-13-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	upx
behavioral1/files/0x0008000000016d3a-19.dat	upx
behavioral1/files/0x001c000000005591-20.dat	upx
behavioral1/files/0x0008000000016d5b-29.dat	upx
behavioral1/files/0x0007000000016d5f-33.dat	upx
behavioral1/files/0x0007000000018716-36.dat	upx
behavioral1/memory/2792-43-0x000000013FF80000-0x0000000140372000-memory.dmp	upx
behavioral1/files/0x0005000000018718-40.dat	upx
behavioral1/files/0x0006000000018be0-94.dat	upx
behavioral1/files/0x0006000000018bf2-98.dat	upx
behavioral1/files/0x0006000000018bc7-89.dat	upx
behavioral1/memory/2868-117-0x000000013F350000-0x000000013F742000-memory.dmp	upx
behavioral1/files/0x0006000000018c16-123.dat	upx
behavioral1/files/0x0006000000018c44-135.dat	upx
behavioral1/files/0x00050000000193b7-145.dat	upx
behavioral1/files/0x000500000001940f-153.dat	upx
behavioral1/files/0x0005000000019526-191.dat	upx
behavioral1/files/0x00050000000194f3-190.dat	upx
behavioral1/files/0x00050000000194e0-189.dat	upx
behavioral1/files/0x00050000000194cc-188.dat	upx
behavioral1/files/0x0005000000019503-186.dat	upx
behavioral1/files/0x00050000000194e9-185.dat	upx
behavioral1/files/0x00050000000194d4-176.dat	upx
behavioral1/files/0x0005000000019419-175.dat	upx
behavioral1/files/0x00050000000193e6-150.dat	upx
behavioral1/files/0x0005000000019209-140.dat	upx
behavioral1/memory/1376-109-0x000000013FED0000-0x00000001402C2000-memory.dmp	upx
behavioral1/memory/2096-106-0x000000013FB10000-0x000000013FF02000-memory.dmp	upx
behavioral1/memory/2928-104-0x000000013FA60000-0x000000013FE52000-memory.dmp	upx
behavioral1/files/0x0006000000018c3b-130.dat	upx
behavioral1/files/0x0010000000016cf5-120.dat	upx
behavioral1/files/0x0006000000018bbc-101.dat	upx
behavioral1/files/0x0006000000018ba5-73.dat	upx
behavioral1/files/0x0006000000018bc1-86.dat	upx
behavioral1/files/0x0005000000018728-65.dat	upx
behavioral1/files/0x0006000000018bb8-78.dat	upx
behavioral1/files/0x0006000000018b7d-70.dat	upx
behavioral1/memory/2644-60-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	upx
behavioral1/memory/2588-58-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	upx
behavioral1/memory/2520-56-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	upx
behavioral1/memory/2572-54-0x000000013F550000-0x000000013F942000-memory.dmp	upx
behavioral1/memory/2216-52-0x000000013F830000-0x000000013FC22000-memory.dmp	upx
behavioral1/memory/2788-4397-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	upx
behavioral1/memory/2644-4411-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	upx
behavioral1/memory/2216-4442-0x000000013F830000-0x000000013FC22000-memory.dmp	upx
behavioral1/memory/2520-4437-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	upx
behavioral1/memory/2096-4658-0x000000013FB10000-0x000000013FF02000-memory.dmp	upx
behavioral1/memory/2572-4661-0x000000013F550000-0x000000013F942000-memory.dmp	upx
behavioral1/memory/2588-4669-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	upx
behavioral1/memory/2928-4664-0x000000013FA60000-0x000000013FE52000-memory.dmp	upx
behavioral1/memory/2868-4716-0x000000013F350000-0x000000013F742000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\pstNYjx.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\hPzPPKO.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\BgtOwim.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\HWTdkxy.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\wkJJGwa.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\PCwCdab.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\UNlXtlq.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\VQZGFSR.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\LBkXjbv.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\hUHpygD.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\eIWMbBh.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\sHItrlQ.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\jRAOoVT.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\LTeOxWN.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\MdLGmaZ.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\NzNkcSB.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\FhRatVh.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\DcOrZcE.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\KNIlfMd.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\nalXodQ.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\GLJzjdQ.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\gwPIEiI.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\cszEjhc.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\YPOlxNj.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\wTsDXxw.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\GYJuGHJ.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\khzaasK.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\WIJPqOD.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\ehPFzqg.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\OMkDBWT.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\SvHgGCI.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\QhwLnpm.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\vScJpZb.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\VWdiEgM.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\YtsalXz.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\axjIjdH.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\JcCoGOb.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\sheFQLp.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\JsUNAIc.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\LZvZasn.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\WXtAFjH.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\VlFerXb.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\RqUmyzb.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\lLocqco.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\JOWExIV.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\sAXbObw.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\hZKTcQs.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\aYNAUvg.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\EkrNtXu.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\TzmbIuS.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\TwbrYoT.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\tAKWcto.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\Dntxdbe.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\RnKsovH.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\dKKHSuM.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\Vntjeoq.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\BHYPFBo.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\maZZOeb.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\IcszIJn.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\tTJpFCH.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\iLANDcu.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\cswEGxV.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\fHYZhKi.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe
File created	C:\Windows\System\yiZCVQP.exe	2e42ae430721c949ff5a71ddcf1e1400N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2268	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
Token: SeLockMemoryPrivilege	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe
Token: SeDebugPrivilege	2268	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2268	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	32
PID 2924 wrote to memory of 2268	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	32
PID 2924 wrote to memory of 2268	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	32
PID 2924 wrote to memory of 2788	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	33
PID 2924 wrote to memory of 2788	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	33
PID 2924 wrote to memory of 2788	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	33
PID 2924 wrote to memory of 2792	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	34
PID 2924 wrote to memory of 2792	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	34
PID 2924 wrote to memory of 2792	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	34
PID 2924 wrote to memory of 2216	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	35
PID 2924 wrote to memory of 2216	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	35
PID 2924 wrote to memory of 2216	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	35
PID 2924 wrote to memory of 2572	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	36
PID 2924 wrote to memory of 2572	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	36
PID 2924 wrote to memory of 2572	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	36
PID 2924 wrote to memory of 2520	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	37
PID 2924 wrote to memory of 2520	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	37
PID 2924 wrote to memory of 2520	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	37
PID 2924 wrote to memory of 2588	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	38
PID 2924 wrote to memory of 2588	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	38
PID 2924 wrote to memory of 2588	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	38
PID 2924 wrote to memory of 2644	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	39
PID 2924 wrote to memory of 2644	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	39
PID 2924 wrote to memory of 2644	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	39
PID 2924 wrote to memory of 2928	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	40
PID 2924 wrote to memory of 2928	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	40
PID 2924 wrote to memory of 2928	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	40
PID 2924 wrote to memory of 2096	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	41
PID 2924 wrote to memory of 2096	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	41
PID 2924 wrote to memory of 2096	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	41
PID 2924 wrote to memory of 2860	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	42
PID 2924 wrote to memory of 2860	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	42
PID 2924 wrote to memory of 2860	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	42
PID 2924 wrote to memory of 1376	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	43
PID 2924 wrote to memory of 1376	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	43
PID 2924 wrote to memory of 1376	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	43
PID 2924 wrote to memory of 1396	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	44
PID 2924 wrote to memory of 1396	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	44
PID 2924 wrote to memory of 1396	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	44
PID 2924 wrote to memory of 2868	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	45
PID 2924 wrote to memory of 2868	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	45
PID 2924 wrote to memory of 2868	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	45
PID 2924 wrote to memory of 1148	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	46
PID 2924 wrote to memory of 1148	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	46
PID 2924 wrote to memory of 1148	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	46
PID 2924 wrote to memory of 2064	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	47
PID 2924 wrote to memory of 2064	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	47
PID 2924 wrote to memory of 2064	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	47
PID 2924 wrote to memory of 2832	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	48
PID 2924 wrote to memory of 2832	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	48
PID 2924 wrote to memory of 2832	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	48
PID 2924 wrote to memory of 1860	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	49
PID 2924 wrote to memory of 1860	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	49
PID 2924 wrote to memory of 1860	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	49
PID 2924 wrote to memory of 1644	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	50
PID 2924 wrote to memory of 1644	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	50
PID 2924 wrote to memory of 1644	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	50
PID 2924 wrote to memory of 2148	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	51
PID 2924 wrote to memory of 2148	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	51
PID 2924 wrote to memory of 2148	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	51
PID 2924 wrote to memory of 2112	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	52
PID 2924 wrote to memory of 2112	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	52
PID 2924 wrote to memory of 2112	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	52
PID 2924 wrote to memory of 2060	2924	2e42ae430721c949ff5a71ddcf1e1400N.exe	53

C:\Users\Admin\AppData\Local\Temp\2e42ae430721c949ff5a71ddcf1e1400N.exe
"C:\Users\Admin\AppData\Local\Temp\2e42ae430721c949ff5a71ddcf1e1400N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2268
- C:\Windows\System\lfUgiUd.exe
  C:\Windows\System\lfUgiUd.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\ltycYQi.exe
  C:\Windows\System\ltycYQi.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\FrwTbZg.exe
  C:\Windows\System\FrwTbZg.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\ZSBhkEe.exe
  C:\Windows\System\ZSBhkEe.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\LlIQvMg.exe
  C:\Windows\System\LlIQvMg.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\usiAtzX.exe
  C:\Windows\System\usiAtzX.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\Qiqotnp.exe
  C:\Windows\System\Qiqotnp.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\CrvpKAO.exe
  C:\Windows\System\CrvpKAO.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\wZapFaQ.exe
  C:\Windows\System\wZapFaQ.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\zPSjYIp.exe
  C:\Windows\System\zPSjYIp.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\bONAUhS.exe
  C:\Windows\System\bONAUhS.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\uGWHXQh.exe
  C:\Windows\System\uGWHXQh.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\zUqEpcB.exe
  C:\Windows\System\zUqEpcB.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\RhApCkB.exe
  C:\Windows\System\RhApCkB.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\LxyQktM.exe
  C:\Windows\System\LxyQktM.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\IzVyTyR.exe
  C:\Windows\System\IzVyTyR.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\EufdMCG.exe
  C:\Windows\System\EufdMCG.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\uoneKub.exe
  C:\Windows\System\uoneKub.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\jFlwVsg.exe
  C:\Windows\System\jFlwVsg.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\KNFvcza.exe
  C:\Windows\System\KNFvcza.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\gOAWtOa.exe
  C:\Windows\System\gOAWtOa.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\xRaLRxr.exe
  C:\Windows\System\xRaLRxr.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\kDinUvN.exe
  C:\Windows\System\kDinUvN.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\yuGiqHh.exe
  C:\Windows\System\yuGiqHh.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\ZxlwUxu.exe
  C:\Windows\System\ZxlwUxu.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\AHnZJwN.exe
  C:\Windows\System\AHnZJwN.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\UvyrzTu.exe
  C:\Windows\System\UvyrzTu.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\ZiXSGhg.exe
  C:\Windows\System\ZiXSGhg.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\YHkuKQi.exe
  C:\Windows\System\YHkuKQi.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\OSDTYsn.exe
  C:\Windows\System\OSDTYsn.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\jRTodFw.exe
  C:\Windows\System\jRTodFw.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\jpHdXQJ.exe
  C:\Windows\System\jpHdXQJ.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\kdAkvXY.exe
  C:\Windows\System\kdAkvXY.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\edfVUrN.exe
  C:\Windows\System\edfVUrN.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\UpCVIik.exe
  C:\Windows\System\UpCVIik.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\TPbgQfl.exe
  C:\Windows\System\TPbgQfl.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\yTDqKSi.exe
  C:\Windows\System\yTDqKSi.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\UZEupGO.exe
  C:\Windows\System\UZEupGO.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\rNlCcHQ.exe
  C:\Windows\System\rNlCcHQ.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\OpwlCYG.exe
  C:\Windows\System\OpwlCYG.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\BGEzaNw.exe
  C:\Windows\System\BGEzaNw.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\MXXvTKs.exe
  C:\Windows\System\MXXvTKs.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\kvzZKwe.exe
  C:\Windows\System\kvzZKwe.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\wGNUMVQ.exe
  C:\Windows\System\wGNUMVQ.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\IPqlZNv.exe
  C:\Windows\System\IPqlZNv.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\bRJRMPJ.exe
  C:\Windows\System\bRJRMPJ.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\jJhNFzO.exe
  C:\Windows\System\jJhNFzO.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\OBDvIsF.exe
  C:\Windows\System\OBDvIsF.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\rtAJcPU.exe
  C:\Windows\System\rtAJcPU.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\mKhVnMQ.exe
  C:\Windows\System\mKhVnMQ.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\aaOdNhL.exe
  C:\Windows\System\aaOdNhL.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\BYhiIlc.exe
  C:\Windows\System\BYhiIlc.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\zZSDTST.exe
  C:\Windows\System\zZSDTST.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\IfVIgnc.exe
  C:\Windows\System\IfVIgnc.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\DHtkldV.exe
  C:\Windows\System\DHtkldV.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\yadwjWn.exe
  C:\Windows\System\yadwjWn.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\IWizRNQ.exe
  C:\Windows\System\IWizRNQ.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\NseqvwL.exe
  C:\Windows\System\NseqvwL.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\dsyZHHx.exe
  C:\Windows\System\dsyZHHx.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\xNBZHPJ.exe
  C:\Windows\System\xNBZHPJ.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\tdGBEFi.exe
  C:\Windows\System\tdGBEFi.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\MHMBftw.exe
  C:\Windows\System\MHMBftw.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\NyUFBsA.exe
  C:\Windows\System\NyUFBsA.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\eQxEbZd.exe
  C:\Windows\System\eQxEbZd.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\eZIsUzQ.exe
  C:\Windows\System\eZIsUzQ.exe
  2⤵
  PID:1476
- C:\Windows\System\jeUDdiJ.exe
  C:\Windows\System\jeUDdiJ.exe
  2⤵
  PID:2772
- C:\Windows\System\fIEYZmB.exe
  C:\Windows\System\fIEYZmB.exe
  2⤵
  PID:1640
- C:\Windows\System\HkFGjPc.exe
  C:\Windows\System\HkFGjPc.exe
  2⤵
  PID:2980
- C:\Windows\System\YJGhEOb.exe
  C:\Windows\System\YJGhEOb.exe
  2⤵
  PID:2668
- C:\Windows\System\CVJfFya.exe
  C:\Windows\System\CVJfFya.exe
  2⤵
  PID:2756
- C:\Windows\System\IxzCiPr.exe
  C:\Windows\System\IxzCiPr.exe
  2⤵
  PID:2736
- C:\Windows\System\AucJzxt.exe
  C:\Windows\System\AucJzxt.exe
  2⤵
  PID:1076
- C:\Windows\System\bjspcGR.exe
  C:\Windows\System\bjspcGR.exe
  2⤵
  PID:800
- C:\Windows\System\eitBDAF.exe
  C:\Windows\System\eitBDAF.exe
  2⤵
  PID:2848
- C:\Windows\System\cHturVq.exe
  C:\Windows\System\cHturVq.exe
  2⤵
  PID:920
- C:\Windows\System\FnQfUGS.exe
  C:\Windows\System\FnQfUGS.exe
  2⤵
  PID:816
- C:\Windows\System\cXbzWKW.exe
  C:\Windows\System\cXbzWKW.exe
  2⤵
  PID:1936
- C:\Windows\System\KgEPOMM.exe
  C:\Windows\System\KgEPOMM.exe
  2⤵
  PID:2488
- C:\Windows\System\IpOknjG.exe
  C:\Windows\System\IpOknjG.exe
  2⤵
  PID:1352
- C:\Windows\System\ChbCmbB.exe
  C:\Windows\System\ChbCmbB.exe
  2⤵
  PID:844
- C:\Windows\System\dAABezk.exe
  C:\Windows\System\dAABezk.exe
  2⤵
  PID:1568
- C:\Windows\System\kDaErZI.exe
  C:\Windows\System\kDaErZI.exe
  2⤵
  PID:2468
- C:\Windows\System\oaJFuAx.exe
  C:\Windows\System\oaJFuAx.exe
  2⤵
  PID:2364
- C:\Windows\System\CYEdmtI.exe
  C:\Windows\System\CYEdmtI.exe
  2⤵
  PID:980
- C:\Windows\System\ULDJyfn.exe
  C:\Windows\System\ULDJyfn.exe
  2⤵
  PID:2204
- C:\Windows\System\dOCmqzQ.exe
  C:\Windows\System\dOCmqzQ.exe
  2⤵
  PID:600
- C:\Windows\System\maZZOeb.exe
  C:\Windows\System\maZZOeb.exe
  2⤵
  PID:1500
- C:\Windows\System\hLRsUtu.exe
  C:\Windows\System\hLRsUtu.exe
  2⤵
  PID:1708
- C:\Windows\System\GnJcZhu.exe
  C:\Windows\System\GnJcZhu.exe
  2⤵
  PID:1604
- C:\Windows\System\dplyTGJ.exe
  C:\Windows\System\dplyTGJ.exe
  2⤵
  PID:2752
- C:\Windows\System\PjYRksi.exe
  C:\Windows\System\PjYRksi.exe
  2⤵
  PID:2692
- C:\Windows\System\lAMLNPk.exe
  C:\Windows\System\lAMLNPk.exe
  2⤵
  PID:2596
- C:\Windows\System\npqnQaS.exe
  C:\Windows\System\npqnQaS.exe
  2⤵
  PID:3024
- C:\Windows\System\FqVNdqS.exe
  C:\Windows\System\FqVNdqS.exe
  2⤵
  PID:3052
- C:\Windows\System\xlJIlxB.exe
  C:\Windows\System\xlJIlxB.exe
  2⤵
  PID:3060
- C:\Windows\System\VbqLeIq.exe
  C:\Windows\System\VbqLeIq.exe
  2⤵
  PID:2172
- C:\Windows\System\bYdSgVG.exe
  C:\Windows\System\bYdSgVG.exe
  2⤵
  PID:2880
- C:\Windows\System\MBCrtxq.exe
  C:\Windows\System\MBCrtxq.exe
  2⤵
  PID:2764
- C:\Windows\System\eMAryjM.exe
  C:\Windows\System\eMAryjM.exe
  2⤵
  PID:1156
- C:\Windows\System\HmrzeIo.exe
  C:\Windows\System\HmrzeIo.exe
  2⤵
  PID:860
- C:\Windows\System\QAdJmgS.exe
  C:\Windows\System\QAdJmgS.exe
  2⤵
  PID:404
- C:\Windows\System\OrPnEra.exe
  C:\Windows\System\OrPnEra.exe
  2⤵
  PID:1184
- C:\Windows\System\jjcMSHT.exe
  C:\Windows\System\jjcMSHT.exe
  2⤵
  PID:1176
- C:\Windows\System\vWrQrQX.exe
  C:\Windows\System\vWrQrQX.exe
  2⤵
  PID:1256
- C:\Windows\System\ZPVKuBd.exe
  C:\Windows\System\ZPVKuBd.exe
  2⤵
  PID:2156
- C:\Windows\System\wqimZfB.exe
  C:\Windows\System\wqimZfB.exe
  2⤵
  PID:2440
- C:\Windows\System\PceIHUT.exe
  C:\Windows\System\PceIHUT.exe
  2⤵
  PID:856
- C:\Windows\System\HyawroN.exe
  C:\Windows\System\HyawroN.exe
  2⤵
  PID:1136
- C:\Windows\System\ZUAvWOL.exe
  C:\Windows\System\ZUAvWOL.exe
  2⤵
  PID:1192
- C:\Windows\System\ZvriJOd.exe
  C:\Windows\System\ZvriJOd.exe
  2⤵
  PID:592
- C:\Windows\System\qTCPLXe.exe
  C:\Windows\System\qTCPLXe.exe
  2⤵
  PID:1480
- C:\Windows\System\KaBMCyu.exe
  C:\Windows\System\KaBMCyu.exe
  2⤵
  PID:1012
- C:\Windows\System\XjSXaPL.exe
  C:\Windows\System\XjSXaPL.exe
  2⤵
  PID:2108
- C:\Windows\System\kfWJdqX.exe
  C:\Windows\System\kfWJdqX.exe
  2⤵
  PID:268
- C:\Windows\System\nRYcydv.exe
  C:\Windows\System\nRYcydv.exe
  2⤵
  PID:2200
- C:\Windows\System\gNJeNVz.exe
  C:\Windows\System\gNJeNVz.exe
  2⤵
  PID:2036
- C:\Windows\System\oeFyfUk.exe
  C:\Windows\System\oeFyfUk.exe
  2⤵
  PID:1916
- C:\Windows\System\apidUGe.exe
  C:\Windows\System\apidUGe.exe
  2⤵
  PID:2556
- C:\Windows\System\JSzTUov.exe
  C:\Windows\System\JSzTUov.exe
  2⤵
  PID:612
- C:\Windows\System\nFattzT.exe
  C:\Windows\System\nFattzT.exe
  2⤵
  PID:1496
- C:\Windows\System\ZjoLfkY.exe
  C:\Windows\System\ZjoLfkY.exe
  2⤵
  PID:596
- C:\Windows\System\LBkXjbv.exe
  C:\Windows\System\LBkXjbv.exe
  2⤵
  PID:1000
- C:\Windows\System\FQoHeBO.exe
  C:\Windows\System\FQoHeBO.exe
  2⤵
  PID:1336
- C:\Windows\System\NuRdANB.exe
  C:\Windows\System\NuRdANB.exe
  2⤵
  PID:656
- C:\Windows\System\uUiZCGV.exe
  C:\Windows\System\uUiZCGV.exe
  2⤵
  PID:2548
- C:\Windows\System\fOpLeXL.exe
  C:\Windows\System\fOpLeXL.exe
  2⤵
  PID:2600
- C:\Windows\System\gzmuRLG.exe
  C:\Windows\System\gzmuRLG.exe
  2⤵
  PID:1248
- C:\Windows\System\RyIHBmU.exe
  C:\Windows\System\RyIHBmU.exe
  2⤵
  PID:3056
- C:\Windows\System\LueLEzA.exe
  C:\Windows\System\LueLEzA.exe
  2⤵
  PID:2152
- C:\Windows\System\copjuTF.exe
  C:\Windows\System\copjuTF.exe
  2⤵
  PID:2472
- C:\Windows\System\ERwxwag.exe
  C:\Windows\System\ERwxwag.exe
  2⤵
  PID:2180
- C:\Windows\System\uIiuJaO.exe
  C:\Windows\System\uIiuJaO.exe
  2⤵
  PID:840
- C:\Windows\System\qWQoCxQ.exe
  C:\Windows\System\qWQoCxQ.exe
  2⤵
  PID:1808
- C:\Windows\System\mUyubCQ.exe
  C:\Windows\System\mUyubCQ.exe
  2⤵
  PID:1348
- C:\Windows\System\xTpzMDO.exe
  C:\Windows\System\xTpzMDO.exe
  2⤵
  PID:2976
- C:\Windows\System\wtleNQJ.exe
  C:\Windows\System\wtleNQJ.exe
  2⤵
  PID:2452
- C:\Windows\System\XbnoNCe.exe
  C:\Windows\System\XbnoNCe.exe
  2⤵
  PID:1672
- C:\Windows\System\IcMsQbX.exe
  C:\Windows\System\IcMsQbX.exe
  2⤵
  PID:1532
- C:\Windows\System\EtHGySY.exe
  C:\Windows\System\EtHGySY.exe
  2⤵
  PID:1408
- C:\Windows\System\rOsmQBv.exe
  C:\Windows\System\rOsmQBv.exe
  2⤵
  PID:3016
- C:\Windows\System\ZPDMLdl.exe
  C:\Windows\System\ZPDMLdl.exe
  2⤵
  PID:2504
- C:\Windows\System\QSFUlDY.exe
  C:\Windows\System\QSFUlDY.exe
  2⤵
  PID:2412
- C:\Windows\System\KUkHRyl.exe
  C:\Windows\System\KUkHRyl.exe
  2⤵
  PID:2804
- C:\Windows\System\TyxkThG.exe
  C:\Windows\System\TyxkThG.exe
  2⤵
  PID:1976
- C:\Windows\System\GMnlHld.exe
  C:\Windows\System\GMnlHld.exe
  2⤵
  PID:1084
- C:\Windows\System\eXJOVmC.exe
  C:\Windows\System\eXJOVmC.exe
  2⤵
  PID:864
- C:\Windows\System\UrJagzs.exe
  C:\Windows\System\UrJagzs.exe
  2⤵
  PID:2988
- C:\Windows\System\qKkrywl.exe
  C:\Windows\System\qKkrywl.exe
  2⤵
  PID:2404
- C:\Windows\System\KUSpMqt.exe
  C:\Windows\System\KUSpMqt.exe
  2⤵
  PID:2056
- C:\Windows\System\JogIdZg.exe
  C:\Windows\System\JogIdZg.exe
  2⤵
  PID:1884
- C:\Windows\System\UoOfrdc.exe
  C:\Windows\System\UoOfrdc.exe
  2⤵
  PID:2620
- C:\Windows\System\ZwHAKQN.exe
  C:\Windows\System\ZwHAKQN.exe
  2⤵
  PID:1764
- C:\Windows\System\rwrEEEK.exe
  C:\Windows\System\rwrEEEK.exe
  2⤵
  PID:576
- C:\Windows\System\QWONqCG.exe
  C:\Windows\System\QWONqCG.exe
  2⤵
  PID:560
- C:\Windows\System\IwqDezE.exe
  C:\Windows\System\IwqDezE.exe
  2⤵
  PID:692
- C:\Windows\System\BvjrDFY.exe
  C:\Windows\System\BvjrDFY.exe
  2⤵
  PID:1608
- C:\Windows\System\UyAaXDg.exe
  C:\Windows\System\UyAaXDg.exe
  2⤵
  PID:1548
- C:\Windows\System\kowHywE.exe
  C:\Windows\System\kowHywE.exe
  2⤵
  PID:572
- C:\Windows\System\rMYisSd.exe
  C:\Windows\System\rMYisSd.exe
  2⤵
  PID:2176
- C:\Windows\System\VKZqPmJ.exe
  C:\Windows\System\VKZqPmJ.exe
  2⤵
  PID:900
- C:\Windows\System\qSMzzmX.exe
  C:\Windows\System\qSMzzmX.exe
  2⤵
  PID:3076
- C:\Windows\System\AstJGUV.exe
  C:\Windows\System\AstJGUV.exe
  2⤵
  PID:3092
- C:\Windows\System\eXFbReC.exe
  C:\Windows\System\eXFbReC.exe
  2⤵
  PID:3108
- C:\Windows\System\woZIHsU.exe
  C:\Windows\System\woZIHsU.exe
  2⤵
  PID:3124
- C:\Windows\System\YYrAmUX.exe
  C:\Windows\System\YYrAmUX.exe
  2⤵
  PID:3168
- C:\Windows\System\xjALGFv.exe
  C:\Windows\System\xjALGFv.exe
  2⤵
  PID:3184
- C:\Windows\System\lgydqvF.exe
  C:\Windows\System\lgydqvF.exe
  2⤵
  PID:3200
- C:\Windows\System\rPlYNaW.exe
  C:\Windows\System\rPlYNaW.exe
  2⤵
  PID:3216
- C:\Windows\System\SyrttaW.exe
  C:\Windows\System\SyrttaW.exe
  2⤵
  PID:3232
- C:\Windows\System\zEYtLnQ.exe
  C:\Windows\System\zEYtLnQ.exe
  2⤵
  PID:3248
- C:\Windows\System\oFBodDa.exe
  C:\Windows\System\oFBodDa.exe
  2⤵
  PID:3268
- C:\Windows\System\uwxWlbZ.exe
  C:\Windows\System\uwxWlbZ.exe
  2⤵
  PID:3284
- C:\Windows\System\UCSmYBJ.exe
  C:\Windows\System\UCSmYBJ.exe
  2⤵
  PID:3300
- C:\Windows\System\TEzOtaU.exe
  C:\Windows\System\TEzOtaU.exe
  2⤵
  PID:3316
- C:\Windows\System\jPtXoUK.exe
  C:\Windows\System\jPtXoUK.exe
  2⤵
  PID:3332
- C:\Windows\System\sjHiBJR.exe
  C:\Windows\System\sjHiBJR.exe
  2⤵
  PID:3352
- C:\Windows\System\bUizCXO.exe
  C:\Windows\System\bUizCXO.exe
  2⤵
  PID:3368
- C:\Windows\System\NRjqYKN.exe
  C:\Windows\System\NRjqYKN.exe
  2⤵
  PID:3384
- C:\Windows\System\OQZkNyp.exe
  C:\Windows\System\OQZkNyp.exe
  2⤵
  PID:3400
- C:\Windows\System\XAmlFSi.exe
  C:\Windows\System\XAmlFSi.exe
  2⤵
  PID:3416
- C:\Windows\System\AokjDsD.exe
  C:\Windows\System\AokjDsD.exe
  2⤵
  PID:3432
- C:\Windows\System\RcIUrKZ.exe
  C:\Windows\System\RcIUrKZ.exe
  2⤵
  PID:3448
- C:\Windows\System\TXHwmTk.exe
  C:\Windows\System\TXHwmTk.exe
  2⤵
  PID:3464
- C:\Windows\System\XUOXcqw.exe
  C:\Windows\System\XUOXcqw.exe
  2⤵
  PID:3480
- C:\Windows\System\LiRrvAY.exe
  C:\Windows\System\LiRrvAY.exe
  2⤵
  PID:3496
- C:\Windows\System\obhWoAa.exe
  C:\Windows\System\obhWoAa.exe
  2⤵
  PID:3524
- C:\Windows\System\IlmKSxo.exe
  C:\Windows\System\IlmKSxo.exe
  2⤵
  PID:3540
- C:\Windows\System\JcikTjt.exe
  C:\Windows\System\JcikTjt.exe
  2⤵
  PID:3616
- C:\Windows\System\DUZStxx.exe
  C:\Windows\System\DUZStxx.exe
  2⤵
  PID:3632
- C:\Windows\System\rXbhcqd.exe
  C:\Windows\System\rXbhcqd.exe
  2⤵
  PID:3648
- C:\Windows\System\ZLSSTWM.exe
  C:\Windows\System\ZLSSTWM.exe
  2⤵
  PID:3664
- C:\Windows\System\bJOeIhE.exe
  C:\Windows\System\bJOeIhE.exe
  2⤵
  PID:3680
- C:\Windows\System\xsOKnjj.exe
  C:\Windows\System\xsOKnjj.exe
  2⤵
  PID:3696
- C:\Windows\System\bJeZTdv.exe
  C:\Windows\System\bJeZTdv.exe
  2⤵
  PID:3712
- C:\Windows\System\sibLzcU.exe
  C:\Windows\System\sibLzcU.exe
  2⤵
  PID:3728
- C:\Windows\System\pOVptIz.exe
  C:\Windows\System\pOVptIz.exe
  2⤵
  PID:3764
- C:\Windows\System\wyhYYKq.exe
  C:\Windows\System\wyhYYKq.exe
  2⤵
  PID:3780
- C:\Windows\System\LxEfEqi.exe
  C:\Windows\System\LxEfEqi.exe
  2⤵
  PID:3796
- C:\Windows\System\PSxkCvk.exe
  C:\Windows\System\PSxkCvk.exe
  2⤵
  PID:3812
- C:\Windows\System\jURxvxL.exe
  C:\Windows\System\jURxvxL.exe
  2⤵
  PID:3828
- C:\Windows\System\YtsalXz.exe
  C:\Windows\System\YtsalXz.exe
  2⤵
  PID:3844
- C:\Windows\System\MyvlRnH.exe
  C:\Windows\System\MyvlRnH.exe
  2⤵
  PID:3860
- C:\Windows\System\mWWyvas.exe
  C:\Windows\System\mWWyvas.exe
  2⤵
  PID:3876
- C:\Windows\System\bTeMnwU.exe
  C:\Windows\System\bTeMnwU.exe
  2⤵
  PID:3892
- C:\Windows\System\ciztSPC.exe
  C:\Windows\System\ciztSPC.exe
  2⤵
  PID:3908
- C:\Windows\System\fhTcCnu.exe
  C:\Windows\System\fhTcCnu.exe
  2⤵
  PID:3928
- C:\Windows\System\khkpiBH.exe
  C:\Windows\System\khkpiBH.exe
  2⤵
  PID:3944
- C:\Windows\System\uPrPYGd.exe
  C:\Windows\System\uPrPYGd.exe
  2⤵
  PID:4052
- C:\Windows\System\kxsHDLe.exe
  C:\Windows\System\kxsHDLe.exe
  2⤵
  PID:4068
- C:\Windows\System\iKwyQlW.exe
  C:\Windows\System\iKwyQlW.exe
  2⤵
  PID:4084
- C:\Windows\System\OMsRPDJ.exe
  C:\Windows\System\OMsRPDJ.exe
  2⤵
  PID:2528
- C:\Windows\System\sayYtTG.exe
  C:\Windows\System\sayYtTG.exe
  2⤵
  PID:2280
- C:\Windows\System\zVsPLHQ.exe
  C:\Windows\System\zVsPLHQ.exe
  2⤵
  PID:880
- C:\Windows\System\GhDhfus.exe
  C:\Windows\System\GhDhfus.exe
  2⤵
  PID:3116
- C:\Windows\System\HYNdaAB.exe
  C:\Windows\System\HYNdaAB.exe
  2⤵
  PID:1464
- C:\Windows\System\VxygdKB.exe
  C:\Windows\System\VxygdKB.exe
  2⤵
  PID:3104
- C:\Windows\System\FWebBMu.exe
  C:\Windows\System\FWebBMu.exe
  2⤵
  PID:3148
- C:\Windows\System\KHoAtsB.exe
  C:\Windows\System\KHoAtsB.exe
  2⤵
  PID:3180
- C:\Windows\System\IgDTEAD.exe
  C:\Windows\System\IgDTEAD.exe
  2⤵
  PID:3192
- C:\Windows\System\xZvyvDP.exe
  C:\Windows\System\xZvyvDP.exe
  2⤵
  PID:3224
- C:\Windows\System\XouuiVn.exe
  C:\Windows\System\XouuiVn.exe
  2⤵
  PID:3340
- C:\Windows\System\kshQlDi.exe
  C:\Windows\System\kshQlDi.exe
  2⤵
  PID:3312
- C:\Windows\System\GcNAhfh.exe
  C:\Windows\System\GcNAhfh.exe
  2⤵
  PID:3380
- C:\Windows\System\gcUiQqG.exe
  C:\Windows\System\gcUiQqG.exe
  2⤵
  PID:3476
- C:\Windows\System\vRQjGUI.exe
  C:\Windows\System\vRQjGUI.exe
  2⤵
  PID:3516
- C:\Windows\System\CMbREye.exe
  C:\Windows\System\CMbREye.exe
  2⤵
  PID:3560
- C:\Windows\System\GqmYdPh.exe
  C:\Windows\System\GqmYdPh.exe
  2⤵
  PID:3576
- C:\Windows\System\pXlpzZT.exe
  C:\Windows\System\pXlpzZT.exe
  2⤵
  PID:3592
- C:\Windows\System\CMQdaXq.exe
  C:\Windows\System\CMQdaXq.exe
  2⤵
  PID:3608
- C:\Windows\System\AKTmGPD.exe
  C:\Windows\System\AKTmGPD.exe
  2⤵
  PID:3672
- C:\Windows\System\zGYElzb.exe
  C:\Windows\System\zGYElzb.exe
  2⤵
  PID:3736
- C:\Windows\System\ZkkpXGn.exe
  C:\Windows\System\ZkkpXGn.exe
  2⤵
  PID:3264
- C:\Windows\System\XfmXeey.exe
  C:\Windows\System\XfmXeey.exe
  2⤵
  PID:3752
- C:\Windows\System\pOTObEg.exe
  C:\Windows\System\pOTObEg.exe
  2⤵
  PID:3360
- C:\Windows\System\gfrhgPH.exe
  C:\Windows\System\gfrhgPH.exe
  2⤵
  PID:1524
- C:\Windows\System\ismQVGq.exe
  C:\Windows\System\ismQVGq.exe
  2⤵
  PID:3884
- C:\Windows\System\fzkKXCQ.exe
  C:\Windows\System\fzkKXCQ.exe
  2⤵
  PID:3924
- C:\Windows\System\eHEOEJL.exe
  C:\Windows\System\eHEOEJL.exe
  2⤵
  PID:3964
- C:\Windows\System\flpXYBO.exe
  C:\Windows\System\flpXYBO.exe
  2⤵
  PID:3980
- C:\Windows\System\lJoSEbh.exe
  C:\Windows\System\lJoSEbh.exe
  2⤵
  PID:4004
- C:\Windows\System\HvYnNLt.exe
  C:\Windows\System\HvYnNLt.exe
  2⤵
  PID:3688
- C:\Windows\System\IeHAHZk.exe
  C:\Windows\System\IeHAHZk.exe
  2⤵
  PID:1820
- C:\Windows\System\QPmpDKh.exe
  C:\Windows\System\QPmpDKh.exe
  2⤵
  PID:1900
- C:\Windows\System\qRJovvN.exe
  C:\Windows\System\qRJovvN.exe
  2⤵
  PID:2952
- C:\Windows\System\nBaBEGw.exe
  C:\Windows\System\nBaBEGw.exe
  2⤵
  PID:4036
- C:\Windows\System\IKsfcef.exe
  C:\Windows\System\IKsfcef.exe
  2⤵
  PID:3392
- C:\Windows\System\eGUJWKd.exe
  C:\Windows\System\eGUJWKd.exe
  2⤵
  PID:3460
- C:\Windows\System\ajWHbyj.exe
  C:\Windows\System\ajWHbyj.exe
  2⤵
  PID:3536
- C:\Windows\System\hUHpygD.exe
  C:\Windows\System\hUHpygD.exe
  2⤵
  PID:4104
- C:\Windows\System\rIGyRLa.exe
  C:\Windows\System\rIGyRLa.exe
  2⤵
  PID:4260
- C:\Windows\System\BtHzTDM.exe
  C:\Windows\System\BtHzTDM.exe
  2⤵
  PID:4304
- C:\Windows\System\SpxrJpg.exe
  C:\Windows\System\SpxrJpg.exe
  2⤵
  PID:4320
- C:\Windows\System\KfFEpPH.exe
  C:\Windows\System\KfFEpPH.exe
  2⤵
  PID:4352
- C:\Windows\System\HLGdYYC.exe
  C:\Windows\System\HLGdYYC.exe
  2⤵
  PID:4368
- C:\Windows\System\WckFftO.exe
  C:\Windows\System\WckFftO.exe
  2⤵
  PID:4384
- C:\Windows\System\gfhLvGp.exe
  C:\Windows\System\gfhLvGp.exe
  2⤵
  PID:4400
- C:\Windows\System\cVSPUPh.exe
  C:\Windows\System\cVSPUPh.exe
  2⤵
  PID:4416
- C:\Windows\System\VvanWaG.exe
  C:\Windows\System\VvanWaG.exe
  2⤵
  PID:4432
- C:\Windows\System\TnefPwO.exe
  C:\Windows\System\TnefPwO.exe
  2⤵
  PID:4452
- C:\Windows\System\waFEATA.exe
  C:\Windows\System\waFEATA.exe
  2⤵
  PID:4468
- C:\Windows\System\oabOXaa.exe
  C:\Windows\System\oabOXaa.exe
  2⤵
  PID:4484
- C:\Windows\System\gwPIEiI.exe
  C:\Windows\System\gwPIEiI.exe
  2⤵
  PID:4500
- C:\Windows\System\lIrLKDm.exe
  C:\Windows\System\lIrLKDm.exe
  2⤵
  PID:4516
- C:\Windows\System\YXpMylO.exe
  C:\Windows\System\YXpMylO.exe
  2⤵
  PID:4604
- C:\Windows\System\ahyPMgT.exe
  C:\Windows\System\ahyPMgT.exe
  2⤵
  PID:4620
- C:\Windows\System\TxBCeOc.exe
  C:\Windows\System\TxBCeOc.exe
  2⤵
  PID:4636
- C:\Windows\System\PHIQAzm.exe
  C:\Windows\System\PHIQAzm.exe
  2⤵
  PID:4652
- C:\Windows\System\rLNKdIn.exe
  C:\Windows\System\rLNKdIn.exe
  2⤵
  PID:4668
- C:\Windows\System\RKeIcrA.exe
  C:\Windows\System\RKeIcrA.exe
  2⤵
  PID:4684
- C:\Windows\System\WnDXOSB.exe
  C:\Windows\System\WnDXOSB.exe
  2⤵
  PID:4700
- C:\Windows\System\IIlOdAk.exe
  C:\Windows\System\IIlOdAk.exe
  2⤵
  PID:4720
- C:\Windows\System\QIoXhpW.exe
  C:\Windows\System\QIoXhpW.exe
  2⤵
  PID:4736
- C:\Windows\System\bSaghVz.exe
  C:\Windows\System\bSaghVz.exe
  2⤵
  PID:4752
- C:\Windows\System\wCGeTqc.exe
  C:\Windows\System\wCGeTqc.exe
  2⤵
  PID:4768
- C:\Windows\System\npLwmuo.exe
  C:\Windows\System\npLwmuo.exe
  2⤵
  PID:4784
- C:\Windows\System\Kgywvmr.exe
  C:\Windows\System\Kgywvmr.exe
  2⤵
  PID:4800
- C:\Windows\System\TnKZyqu.exe
  C:\Windows\System\TnKZyqu.exe
  2⤵
  PID:4820
- C:\Windows\System\wkMiroM.exe
  C:\Windows\System\wkMiroM.exe
  2⤵
  PID:4836
- C:\Windows\System\CKRNrPi.exe
  C:\Windows\System\CKRNrPi.exe
  2⤵
  PID:4852
- C:\Windows\System\PCwCdab.exe
  C:\Windows\System\PCwCdab.exe
  2⤵
  PID:4868
- C:\Windows\System\QPLtRvF.exe
  C:\Windows\System\QPLtRvF.exe
  2⤵
  PID:4884
- C:\Windows\System\zhFJhZK.exe
  C:\Windows\System\zhFJhZK.exe
  2⤵
  PID:4904
- C:\Windows\System\fgVNTHs.exe
  C:\Windows\System\fgVNTHs.exe
  2⤵
  PID:4924
- C:\Windows\System\ithcKdq.exe
  C:\Windows\System\ithcKdq.exe
  2⤵
  PID:5000
- C:\Windows\System\GWvuWKb.exe
  C:\Windows\System\GWvuWKb.exe
  2⤵
  PID:5016
- C:\Windows\System\YLDkuuv.exe
  C:\Windows\System\YLDkuuv.exe
  2⤵
  PID:5032
- C:\Windows\System\ZPYlBUs.exe
  C:\Windows\System\ZPYlBUs.exe
  2⤵
  PID:5048
- C:\Windows\System\aSKsGRI.exe
  C:\Windows\System\aSKsGRI.exe
  2⤵
  PID:5064
- C:\Windows\System\szaSSmY.exe
  C:\Windows\System\szaSSmY.exe
  2⤵
  PID:5108
- C:\Windows\System\UXquzmU.exe
  C:\Windows\System\UXquzmU.exe
  2⤵
  PID:3720
- C:\Windows\System\LJLCOui.exe
  C:\Windows\System\LJLCOui.exe
  2⤵
  PID:3324
- C:\Windows\System\PQORJeF.exe
  C:\Windows\System\PQORJeF.exe
  2⤵
  PID:3804
- C:\Windows\System\wFRzETv.exe
  C:\Windows\System\wFRzETv.exe
  2⤵
  PID:3872
- C:\Windows\System\Imwgule.exe
  C:\Windows\System\Imwgule.exe
  2⤵
  PID:4092
- C:\Windows\System\ZDhUmzB.exe
  C:\Windows\System\ZDhUmzB.exe
  2⤵
  PID:1432
- C:\Windows\System\mhFbOEZ.exe
  C:\Windows\System\mhFbOEZ.exe
  2⤵
  PID:3156
- C:\Windows\System\NGYUqfm.exe
  C:\Windows\System\NGYUqfm.exe
  2⤵
  PID:3136
- C:\Windows\System\dldMnci.exe
  C:\Windows\System\dldMnci.exe
  2⤵
  PID:3512
- C:\Windows\System\eoBsnqZ.exe
  C:\Windows\System\eoBsnqZ.exe
  2⤵
  PID:3584
- C:\Windows\System\ajcxLpJ.exe
  C:\Windows\System\ajcxLpJ.exe
  2⤵
  PID:3212
- C:\Windows\System\PtZTylS.exe
  C:\Windows\System\PtZTylS.exe
  2⤵
  PID:3308
- C:\Windows\System\yDPBZNB.exe
  C:\Windows\System\yDPBZNB.exe
  2⤵
  PID:3444
- C:\Windows\System\ZxDxfqF.exe
  C:\Windows\System\ZxDxfqF.exe
  2⤵
  PID:3960
- C:\Windows\System\YCZCYXK.exe
  C:\Windows\System\YCZCYXK.exe
  2⤵
  PID:3492
- C:\Windows\System\sozijzz.exe
  C:\Windows\System\sozijzz.exe
  2⤵
  PID:4128
- C:\Windows\System\aoccGJs.exe
  C:\Windows\System\aoccGJs.exe
  2⤵
  PID:4144
- C:\Windows\System\UyvzzIy.exe
  C:\Windows\System\UyvzzIy.exe
  2⤵
  PID:4172
- C:\Windows\System\ysGpkMk.exe
  C:\Windows\System\ysGpkMk.exe
  2⤵
  PID:4192
- C:\Windows\System\zPUoRya.exe
  C:\Windows\System\zPUoRya.exe
  2⤵
  PID:4208
- C:\Windows\System\wWSlYus.exe
  C:\Windows\System\wWSlYus.exe
  2⤵
  PID:3708
- C:\Windows\System\afjJtax.exe
  C:\Windows\System\afjJtax.exe
  2⤵
  PID:4224
- C:\Windows\System\nuWfgFQ.exe
  C:\Windows\System\nuWfgFQ.exe
  2⤵
  PID:4236
- C:\Windows\System\ofuPwnO.exe
  C:\Windows\System\ofuPwnO.exe
  2⤵
  PID:4028
- C:\Windows\System\RaXkblj.exe
  C:\Windows\System\RaXkblj.exe
  2⤵
  PID:2484
- C:\Windows\System\dykJAzi.exe
  C:\Windows\System\dykJAzi.exe
  2⤵
  PID:3920
- C:\Windows\System\HUqlljm.exe
  C:\Windows\System\HUqlljm.exe
  2⤵
  PID:1812
- C:\Windows\System\LHcopKb.exe
  C:\Windows\System\LHcopKb.exe
  2⤵
  PID:3456
- C:\Windows\System\DIYVXrI.exe
  C:\Windows\System\DIYVXrI.exe
  2⤵
  PID:4360
- C:\Windows\System\LYDEykj.exe
  C:\Windows\System\LYDEykj.exe
  2⤵
  PID:4424
- C:\Windows\System\DGHlLiM.exe
  C:\Windows\System\DGHlLiM.exe
  2⤵
  PID:4296
- C:\Windows\System\nfNUwrg.exe
  C:\Windows\System\nfNUwrg.exe
  2⤵
  PID:4412
- C:\Windows\System\ORyLoFn.exe
  C:\Windows\System\ORyLoFn.exe
  2⤵
  PID:4480
- C:\Windows\System\EslDAvG.exe
  C:\Windows\System\EslDAvG.exe
  2⤵
  PID:4476
- C:\Windows\System\tFDNlOI.exe
  C:\Windows\System\tFDNlOI.exe
  2⤵
  PID:4540
- C:\Windows\System\CPvgfYc.exe
  C:\Windows\System\CPvgfYc.exe
  2⤵
  PID:4568
- C:\Windows\System\mWVLPGO.exe
  C:\Windows\System\mWVLPGO.exe
  2⤵
  PID:4588
- C:\Windows\System\kcOWxAr.exe
  C:\Windows\System\kcOWxAr.exe
  2⤵
  PID:3988
- C:\Windows\System\wLhVhOz.exe
  C:\Windows\System\wLhVhOz.exe
  2⤵
  PID:4728
- C:\Windows\System\MTKodVz.exe
  C:\Windows\System\MTKodVz.exe
  2⤵
  PID:4860
- C:\Windows\System\RnKsovH.exe
  C:\Windows\System\RnKsovH.exe
  2⤵
  PID:4712
- C:\Windows\System\DFCnRDp.exe
  C:\Windows\System\DFCnRDp.exe
  2⤵
  PID:4716
- C:\Windows\System\LIKyRHD.exe
  C:\Windows\System\LIKyRHD.exe
  2⤵
  PID:4748
- C:\Windows\System\lSRroRk.exe
  C:\Windows\System\lSRroRk.exe
  2⤵
  PID:4844
- C:\Windows\System\WPhapiP.exe
  C:\Windows\System\WPhapiP.exe
  2⤵
  PID:4920
- C:\Windows\System\LiwqzHd.exe
  C:\Windows\System\LiwqzHd.exe
  2⤵
  PID:4944
- C:\Windows\System\ZOdUnGd.exe
  C:\Windows\System\ZOdUnGd.exe
  2⤵
  PID:4960
- C:\Windows\System\PgaliHL.exe
  C:\Windows\System\PgaliHL.exe
  2⤵
  PID:4976
- C:\Windows\System\NCEUsBA.exe
  C:\Windows\System\NCEUsBA.exe
  2⤵
  PID:5056
- C:\Windows\System\zeWNqTk.exe
  C:\Windows\System\zeWNqTk.exe
  2⤵
  PID:5040
- C:\Windows\System\oQILPFT.exe
  C:\Windows\System\oQILPFT.exe
  2⤵
  PID:5088
- C:\Windows\System\JlQxqXZ.exe
  C:\Windows\System\JlQxqXZ.exe
  2⤵
  PID:5116
- C:\Windows\System\WhHpqKj.exe
  C:\Windows\System\WhHpqKj.exe
  2⤵
  PID:4064
- C:\Windows\System\ObWgYai.exe
  C:\Windows\System\ObWgYai.exe
  2⤵
  PID:3840
- C:\Windows\System\wkJJGwa.exe
  C:\Windows\System\wkJJGwa.exe
  2⤵
  PID:2244
- C:\Windows\System\rBlGYvk.exe
  C:\Windows\System\rBlGYvk.exe
  2⤵
  PID:3164
- C:\Windows\System\WCFDJrV.exe
  C:\Windows\System\WCFDJrV.exe
  2⤵
  PID:3760
- C:\Windows\System\IFVLPcm.exe
  C:\Windows\System\IFVLPcm.exe
  2⤵
  PID:3956
- C:\Windows\System\IzMBEPJ.exe
  C:\Windows\System\IzMBEPJ.exe
  2⤵
  PID:3412
- C:\Windows\System\KsIIvUu.exe
  C:\Windows\System\KsIIvUu.exe
  2⤵
  PID:3556
- C:\Windows\System\tDvTPJM.exe
  C:\Windows\System\tDvTPJM.exe
  2⤵
  PID:3856
- C:\Windows\System\looFjFr.exe
  C:\Windows\System\looFjFr.exe
  2⤵
  PID:4020
- C:\Windows\System\uVvaklw.exe
  C:\Windows\System\uVvaklw.exe
  2⤵
  PID:4152
- C:\Windows\System\leBpecs.exe
  C:\Windows\System\leBpecs.exe
  2⤵
  PID:4164
- C:\Windows\System\czrgmvc.exe
  C:\Windows\System\czrgmvc.exe
  2⤵
  PID:4156
- C:\Windows\System\QAYlHDA.exe
  C:\Windows\System\QAYlHDA.exe
  2⤵
  PID:4232
- C:\Windows\System\GQlwqfv.exe
  C:\Windows\System\GQlwqfv.exe
  2⤵
  PID:4496
- C:\Windows\System\QtOBZaZ.exe
  C:\Windows\System\QtOBZaZ.exe
  2⤵
  PID:4408
- C:\Windows\System\cwipnDy.exe
  C:\Windows\System\cwipnDy.exe
  2⤵
  PID:4444
- C:\Windows\System\BOrGaUG.exe
  C:\Windows\System\BOrGaUG.exe
  2⤵
  PID:4576
- C:\Windows\System\FXHOyBp.exe
  C:\Windows\System\FXHOyBp.exe
  2⤵
  PID:4692
- C:\Windows\System\DrGIQYi.exe
  C:\Windows\System\DrGIQYi.exe
  2⤵
  PID:4508
- C:\Windows\System\UAKXruS.exe
  C:\Windows\System\UAKXruS.exe
  2⤵
  PID:4760
- C:\Windows\System\rWHzrPd.exe
  C:\Windows\System\rWHzrPd.exe
  2⤵
  PID:4764
- C:\Windows\System\rDQNplt.exe
  C:\Windows\System\rDQNplt.exe
  2⤵
  PID:4896
- C:\Windows\System\rHKFaWU.exe
  C:\Windows\System\rHKFaWU.exe
  2⤵
  PID:4648
- C:\Windows\System\eWobltv.exe
  C:\Windows\System\eWobltv.exe
  2⤵
  PID:4816
- C:\Windows\System\vbDXcDc.exe
  C:\Windows\System\vbDXcDc.exe
  2⤵
  PID:4916
- C:\Windows\System\SgWgwpC.exe
  C:\Windows\System\SgWgwpC.exe
  2⤵
  PID:4972
- C:\Windows\System\SgUIPLt.exe
  C:\Windows\System\SgUIPLt.exe
  2⤵
  PID:4996
- C:\Windows\System\veXkbfm.exe
  C:\Windows\System\veXkbfm.exe
  2⤵
  PID:5028
- C:\Windows\System\nqEjjoV.exe
  C:\Windows\System\nqEjjoV.exe
  2⤵
  PID:5080
- C:\Windows\System\HlsSnlW.exe
  C:\Windows\System\HlsSnlW.exe
  2⤵
  PID:4076
- C:\Windows\System\fUZgvgC.exe
  C:\Windows\System\fUZgvgC.exe
  2⤵
  PID:3176
- C:\Windows\System\RQeuuqB.exe
  C:\Windows\System\RQeuuqB.exe
  2⤵
  PID:3836
- C:\Windows\System\fuDIftR.exe
  C:\Windows\System\fuDIftR.exe
  2⤵
  PID:2884
- C:\Windows\System\QSVZMyy.exe
  C:\Windows\System\QSVZMyy.exe
  2⤵
  PID:3440
- C:\Windows\System\cBwsUvB.exe
  C:\Windows\System\cBwsUvB.exe
  2⤵
  PID:3280
- C:\Windows\System\WrHeCwW.exe
  C:\Windows\System\WrHeCwW.exe
  2⤵
  PID:3852
- C:\Windows\System\oWdjDGh.exe
  C:\Windows\System\oWdjDGh.exe
  2⤵
  PID:1520
- C:\Windows\System\xVwpsWp.exe
  C:\Windows\System\xVwpsWp.exe
  2⤵
  PID:4136
- C:\Windows\System\PnvceMc.exe
  C:\Windows\System\PnvceMc.exe
  2⤵
  PID:3656
- C:\Windows\System\FgvLJKQ.exe
  C:\Windows\System\FgvLJKQ.exe
  2⤵
  PID:4256
- C:\Windows\System\ROghgDE.exe
  C:\Windows\System\ROghgDE.exe
  2⤵
  PID:4200
- C:\Windows\System\wUsUkjJ.exe
  C:\Windows\System\wUsUkjJ.exe
  2⤵
  PID:3428
- C:\Windows\System\XslQHbp.exe
  C:\Windows\System\XslQHbp.exe
  2⤵
  PID:3624
- C:\Windows\System\dnOvEKK.exe
  C:\Windows\System\dnOvEKK.exe
  2⤵
  PID:3792
- C:\Windows\System\HSnBFPr.exe
  C:\Windows\System\HSnBFPr.exe
  2⤵
  PID:3424
- C:\Windows\System\mBrNaaA.exe
  C:\Windows\System\mBrNaaA.exe
  2⤵
  PID:4376
- C:\Windows\System\kksDnLz.exe
  C:\Windows\System\kksDnLz.exe
  2⤵
  PID:4988
- C:\Windows\System\ldHyciP.exe
  C:\Windows\System\ldHyciP.exe
  2⤵
  PID:4596
- C:\Windows\System\YxTzOcY.exe
  C:\Windows\System\YxTzOcY.exe
  2⤵
  PID:4628
- C:\Windows\System\DiAHBam.exe
  C:\Windows\System\DiAHBam.exe
  2⤵
  PID:5124
- C:\Windows\System\TbILpOX.exe
  C:\Windows\System\TbILpOX.exe
  2⤵
  PID:5140
- C:\Windows\System\ZSsUDOA.exe
  C:\Windows\System\ZSsUDOA.exe
  2⤵
  PID:5156
- C:\Windows\System\JDsvrhR.exe
  C:\Windows\System\JDsvrhR.exe
  2⤵
  PID:5172
- C:\Windows\System\RMxajeK.exe
  C:\Windows\System\RMxajeK.exe
  2⤵
  PID:5192
- C:\Windows\System\weHIkOa.exe
  C:\Windows\System\weHIkOa.exe
  2⤵
  PID:5208
- C:\Windows\System\qNgbWKh.exe
  C:\Windows\System\qNgbWKh.exe
  2⤵
  PID:5284
- C:\Windows\System\wpghnCW.exe
  C:\Windows\System\wpghnCW.exe
  2⤵
  PID:5312
- C:\Windows\System\AQdWCpp.exe
  C:\Windows\System\AQdWCpp.exe
  2⤵
  PID:5392
- C:\Windows\System\rYINJBf.exe
  C:\Windows\System\rYINJBf.exe
  2⤵
  PID:5408
- C:\Windows\System\BylXobJ.exe
  C:\Windows\System\BylXobJ.exe
  2⤵
  PID:5424
- C:\Windows\System\NAkHnuF.exe
  C:\Windows\System\NAkHnuF.exe
  2⤵
  PID:5440
- C:\Windows\System\HqbpWAz.exe
  C:\Windows\System\HqbpWAz.exe
  2⤵
  PID:5456
- C:\Windows\System\qmdiWOx.exe
  C:\Windows\System\qmdiWOx.exe
  2⤵
  PID:5472
- C:\Windows\System\BwHQIZG.exe
  C:\Windows\System\BwHQIZG.exe
  2⤵
  PID:5492
- C:\Windows\System\vhabPim.exe
  C:\Windows\System\vhabPim.exe
  2⤵
  PID:5508
- C:\Windows\System\rRStLAb.exe
  C:\Windows\System\rRStLAb.exe
  2⤵
  PID:5524
- C:\Windows\System\rqhrCDO.exe
  C:\Windows\System\rqhrCDO.exe
  2⤵
  PID:5540
- C:\Windows\System\sklZWIp.exe
  C:\Windows\System\sklZWIp.exe
  2⤵
  PID:5556
- C:\Windows\System\cGOerUz.exe
  C:\Windows\System\cGOerUz.exe
  2⤵
  PID:5572
- C:\Windows\System\TjtKtSf.exe
  C:\Windows\System\TjtKtSf.exe
  2⤵
  PID:5592
- C:\Windows\System\iqQEAZa.exe
  C:\Windows\System\iqQEAZa.exe
  2⤵
  PID:5608
- C:\Windows\System\PidJxwB.exe
  C:\Windows\System\PidJxwB.exe
  2⤵
  PID:5624
- C:\Windows\System\BixYwCC.exe
  C:\Windows\System\BixYwCC.exe
  2⤵
  PID:5644
- C:\Windows\System\tAlWPYu.exe
  C:\Windows\System\tAlWPYu.exe
  2⤵
  PID:5660
- C:\Windows\System\McKOwLs.exe
  C:\Windows\System\McKOwLs.exe
  2⤵
  PID:5676
- C:\Windows\System\SLxEibh.exe
  C:\Windows\System\SLxEibh.exe
  2⤵
  PID:5692
- C:\Windows\System\XwgagbA.exe
  C:\Windows\System\XwgagbA.exe
  2⤵
  PID:5712
- C:\Windows\System\NylCVxx.exe
  C:\Windows\System\NylCVxx.exe
  2⤵
  PID:5728
- C:\Windows\System\iKSdUPh.exe
  C:\Windows\System\iKSdUPh.exe
  2⤵
  PID:5744
- C:\Windows\System\lxqSwtY.exe
  C:\Windows\System\lxqSwtY.exe
  2⤵
  PID:5760
- C:\Windows\System\NbPXVkD.exe
  C:\Windows\System\NbPXVkD.exe
  2⤵
  PID:5776
- C:\Windows\System\LwozicG.exe
  C:\Windows\System\LwozicG.exe
  2⤵
  PID:5792
- C:\Windows\System\ObjvaJC.exe
  C:\Windows\System\ObjvaJC.exe
  2⤵
  PID:5812
- C:\Windows\System\SCLrUqE.exe
  C:\Windows\System\SCLrUqE.exe
  2⤵
  PID:5828
- C:\Windows\System\jvkUjaO.exe
  C:\Windows\System\jvkUjaO.exe
  2⤵
  PID:5848
- C:\Windows\System\hSRYJEg.exe
  C:\Windows\System\hSRYJEg.exe
  2⤵
  PID:5864
- C:\Windows\System\RFCRWNx.exe
  C:\Windows\System\RFCRWNx.exe
  2⤵
  PID:5880
- C:\Windows\System\zkSgQVl.exe
  C:\Windows\System\zkSgQVl.exe
  2⤵
  PID:5896
- C:\Windows\System\mUsUgtn.exe
  C:\Windows\System\mUsUgtn.exe
  2⤵
  PID:5916
- C:\Windows\System\riCjJlP.exe
  C:\Windows\System\riCjJlP.exe
  2⤵
  PID:5932
- C:\Windows\System\whqCWjH.exe
  C:\Windows\System\whqCWjH.exe
  2⤵
  PID:5948
- C:\Windows\System\qIXBkwG.exe
  C:\Windows\System\qIXBkwG.exe
  2⤵
  PID:5964
- C:\Windows\System\RlwfkuJ.exe
  C:\Windows\System\RlwfkuJ.exe
  2⤵
  PID:5980
- C:\Windows\System\BkESmSI.exe
  C:\Windows\System\BkESmSI.exe
  2⤵
  PID:6000
- C:\Windows\System\JyGBGVL.exe
  C:\Windows\System\JyGBGVL.exe
  2⤵
  PID:6016
- C:\Windows\System\qQzWgOC.exe
  C:\Windows\System\qQzWgOC.exe
  2⤵
  PID:6032
- C:\Windows\System\UAKGLtt.exe
  C:\Windows\System\UAKGLtt.exe
  2⤵
  PID:6048
- C:\Windows\System\mZQHeCq.exe
  C:\Windows\System\mZQHeCq.exe
  2⤵
  PID:6064
- C:\Windows\System\IdjYfrb.exe
  C:\Windows\System\IdjYfrb.exe
  2⤵
  PID:6080
- C:\Windows\System\BpTBtKn.exe
  C:\Windows\System\BpTBtKn.exe
  2⤵
  PID:6100
- C:\Windows\System\BTFrViu.exe
  C:\Windows\System\BTFrViu.exe
  2⤵
  PID:6116
- C:\Windows\System\gIUlSQz.exe
  C:\Windows\System\gIUlSQz.exe
  2⤵
  PID:6136
- C:\Windows\System\WbBiEIj.exe
  C:\Windows\System\WbBiEIj.exe
  2⤵
  PID:4124
- C:\Windows\System\DxzBddB.exe
  C:\Windows\System\DxzBddB.exe
  2⤵
  PID:3788
- C:\Windows\System\MujSYvo.exe
  C:\Windows\System\MujSYvo.exe
  2⤵
  PID:4464
- C:\Windows\System\QrRwBrD.exe
  C:\Windows\System\QrRwBrD.exe
  2⤵
  PID:4948
- C:\Windows\System\zDvXcvr.exe
  C:\Windows\System\zDvXcvr.exe
  2⤵
  PID:5148
- C:\Windows\System\vBZJMhW.exe
  C:\Windows\System\vBZJMhW.exe
  2⤵
  PID:5188
- C:\Windows\System\WLBMfOq.exe
  C:\Windows\System\WLBMfOq.exe
  2⤵
  PID:4564
- C:\Windows\System\jcQZoRs.exe
  C:\Windows\System\jcQZoRs.exe
  2⤵
  PID:3296
- C:\Windows\System\ApEoINU.exe
  C:\Windows\System\ApEoINU.exe
  2⤵
  PID:4680
- C:\Windows\System\AbAkgGT.exe
  C:\Windows\System\AbAkgGT.exe
  2⤵
  PID:4992
- C:\Windows\System\ApSUOxp.exe
  C:\Windows\System\ApSUOxp.exe
  2⤵
  PID:4012
- C:\Windows\System\UiTCFfu.exe
  C:\Windows\System\UiTCFfu.exe
  2⤵
  PID:3744
- C:\Windows\System\CSranPu.exe
  C:\Windows\System\CSranPu.exe
  2⤵
  PID:5204
- C:\Windows\System\oxVkzbG.exe
  C:\Windows\System\oxVkzbG.exe
  2⤵
  PID:3604
- C:\Windows\System\yspYONw.exe
  C:\Windows\System\yspYONw.exe
  2⤵
  PID:2248
- C:\Windows\System\LittBGZ.exe
  C:\Windows\System\LittBGZ.exe
  2⤵
  PID:5132
- C:\Windows\System\OCGOlYx.exe
  C:\Windows\System\OCGOlYx.exe
  2⤵
  PID:5228
- C:\Windows\System\nJRIOSu.exe
  C:\Windows\System\nJRIOSu.exe
  2⤵
  PID:4188
- C:\Windows\System\Rnygame.exe
  C:\Windows\System\Rnygame.exe
  2⤵
  PID:5244
- C:\Windows\System\CqRieyn.exe
  C:\Windows\System\CqRieyn.exe
  2⤵
  PID:5260
- C:\Windows\System\nyrXnoK.exe
  C:\Windows\System\nyrXnoK.exe
  2⤵
  PID:5280
- C:\Windows\System\EKvDdmT.exe
  C:\Windows\System\EKvDdmT.exe
  2⤵
  PID:5300
- C:\Windows\System\eSSWUHg.exe
  C:\Windows\System\eSSWUHg.exe
  2⤵
  PID:5324
- C:\Windows\System\XWfjHwz.exe
  C:\Windows\System\XWfjHwz.exe
  2⤵
  PID:5344
- C:\Windows\System\lkiTvgz.exe
  C:\Windows\System\lkiTvgz.exe
  2⤵
  PID:5360
- C:\Windows\System\cBplFXB.exe
  C:\Windows\System\cBplFXB.exe
  2⤵
  PID:5376
- C:\Windows\System\omHogOi.exe
  C:\Windows\System\omHogOi.exe
  2⤵
  PID:5400
- C:\Windows\System\VPjTdWq.exe
  C:\Windows\System\VPjTdWq.exe
  2⤵
  PID:5452
- C:\Windows\System\fdnqGkg.exe
  C:\Windows\System\fdnqGkg.exe
  2⤵
  PID:5404
- C:\Windows\System\laZdAOq.exe
  C:\Windows\System\laZdAOq.exe
  2⤵
  PID:5616
- C:\Windows\System\XnOrsVc.exe
  C:\Windows\System\XnOrsVc.exe
  2⤵
  PID:5588
- C:\Windows\System\alcRYMt.exe
  C:\Windows\System\alcRYMt.exe
  2⤵
  PID:5688
- C:\Windows\System\wEMUiYv.exe
  C:\Windows\System\wEMUiYv.exe
  2⤵
  PID:5756
- C:\Windows\System\dqdjDrx.exe
  C:\Windows\System\dqdjDrx.exe
  2⤵
  PID:5824
- C:\Windows\System\uwVvQMg.exe
  C:\Windows\System\uwVvQMg.exe
  2⤵
  PID:5464
- C:\Windows\System\CvamCtx.exe
  C:\Windows\System\CvamCtx.exe
  2⤵
  PID:5532
- C:\Windows\System\SctfJlr.exe
  C:\Windows\System\SctfJlr.exe
  2⤵
  PID:5604
- C:\Windows\System\LcGYqew.exe
  C:\Windows\System\LcGYqew.exe
  2⤵
  PID:5640
- C:\Windows\System\kAXfPkm.exe
  C:\Windows\System\kAXfPkm.exe
  2⤵
  PID:5704
- C:\Windows\System\ZdfLzuX.exe
  C:\Windows\System\ZdfLzuX.exe
  2⤵
  PID:5772
- C:\Windows\System\zDNanmn.exe
  C:\Windows\System\zDNanmn.exe
  2⤵
  PID:5836
- C:\Windows\System\qQLNXgP.exe
  C:\Windows\System\qQLNXgP.exe
  2⤵
  PID:5912
- C:\Windows\System\pGMrClD.exe
  C:\Windows\System\pGMrClD.exe
  2⤵
  PID:6012
- C:\Windows\System\Miwgjwx.exe
  C:\Windows\System\Miwgjwx.exe
  2⤵
  PID:6132
- C:\Windows\System\ysBhRal.exe
  C:\Windows\System\ysBhRal.exe
  2⤵
  PID:5180
- C:\Windows\System\SNYISIX.exe
  C:\Windows\System\SNYISIX.exe
  2⤵
  PID:3628
- C:\Windows\System\FFpGAvR.exe
  C:\Windows\System\FFpGAvR.exe
  2⤵
  PID:4492
- C:\Windows\System\DTRTXwm.exe
  C:\Windows\System\DTRTXwm.exe
  2⤵
  PID:3772
- C:\Windows\System\CvWdzPD.exe
  C:\Windows\System\CvWdzPD.exe
  2⤵
  PID:6056
- C:\Windows\System\EzmMdxa.exe
  C:\Windows\System\EzmMdxa.exe
  2⤵
  PID:4396
- C:\Windows\System\dyTkmGV.exe
  C:\Windows\System\dyTkmGV.exe
  2⤵
  PID:4932
- C:\Windows\System\mgGnDoV.exe
  C:\Windows\System\mgGnDoV.exe
  2⤵
  PID:5076
- C:\Windows\System\DIKmjcw.exe
  C:\Windows\System\DIKmjcw.exe
  2⤵
  PID:6044
- C:\Windows\System\zOqYlDc.exe
  C:\Windows\System\zOqYlDc.exe
  2⤵
  PID:5976
- C:\Windows\System\BpvFOKf.exe
  C:\Windows\System\BpvFOKf.exe
  2⤵
  PID:4584
- C:\Windows\System\vRllaEN.exe
  C:\Windows\System\vRllaEN.exe
  2⤵
  PID:5252
- C:\Windows\System\CcLcpTC.exe
  C:\Windows\System\CcLcpTC.exe
  2⤵
  PID:5332
- C:\Windows\System\oWCxfnS.exe
  C:\Windows\System\oWCxfnS.exe
  2⤵
  PID:5308
- C:\Windows\System\JzhDmIs.exe
  C:\Windows\System\JzhDmIs.exe
  2⤵
  PID:5200
- C:\Windows\System\vhbvcnv.exe
  C:\Windows\System\vhbvcnv.exe
  2⤵
  PID:5268
- C:\Windows\System\tfTTYkZ.exe
  C:\Windows\System\tfTTYkZ.exe
  2⤵
  PID:5420
- C:\Windows\System\HPDyddK.exe
  C:\Windows\System\HPDyddK.exe
  2⤵
  PID:5356
- C:\Windows\System\JIQgsht.exe
  C:\Windows\System\JIQgsht.exe
  2⤵
  PID:5684
- C:\Windows\System\gCpoyng.exe
  C:\Windows\System\gCpoyng.exe
  2⤵
  PID:5504
- C:\Windows\System\knvpeSH.exe
  C:\Windows\System\knvpeSH.exe
  2⤵
  PID:5724
- C:\Windows\System\xNxiAIV.exe
  C:\Windows\System\xNxiAIV.exe
  2⤵
  PID:5568
- C:\Windows\System\EEDabyE.exe
  C:\Windows\System\EEDabyE.exe
  2⤵
  PID:5580
- C:\Windows\System\TyWJfNX.exe
  C:\Windows\System\TyWJfNX.exe
  2⤵
  PID:5752
- C:\Windows\System\tYKJsoM.exe
  C:\Windows\System\tYKJsoM.exe
  2⤵
  PID:5700
- C:\Windows\System\nvwAluU.exe
  C:\Windows\System\nvwAluU.exe
  2⤵
  PID:5768
- C:\Windows\System\DhncKOb.exe
  C:\Windows\System\DhncKOb.exe
  2⤵
  PID:5904
- C:\Windows\System\aZrkqwr.exe
  C:\Windows\System\aZrkqwr.exe
  2⤵
  PID:5944
- C:\Windows\System\iabpWVy.exe
  C:\Windows\System\iabpWVy.exe
  2⤵
  PID:4892
- C:\Windows\System\QTWRCuA.exe
  C:\Windows\System\QTWRCuA.exe
  2⤵
  PID:4984
- C:\Windows\System\cQOUhpx.exe
  C:\Windows\System\cQOUhpx.exe
  2⤵
  PID:3144
- C:\Windows\System\cBhaPHY.exe
  C:\Windows\System\cBhaPHY.exe
  2⤵
  PID:5956
- C:\Windows\System\CGYwIot.exe
  C:\Windows\System\CGYwIot.exe
  2⤵
  PID:5924
- C:\Windows\System\pwNiTKW.exe
  C:\Windows\System\pwNiTKW.exe
  2⤵
  PID:6088
- C:\Windows\System\OKJbOvU.exe
  C:\Windows\System\OKJbOvU.exe
  2⤵
  PID:4080
- C:\Windows\System\xyzilGw.exe
  C:\Windows\System\xyzilGw.exe
  2⤵
  PID:4532
- C:\Windows\System\KuDdeFK.exe
  C:\Windows\System\KuDdeFK.exe
  2⤵
  PID:5240
- C:\Windows\System\ZUQHAej.exe
  C:\Windows\System\ZUQHAej.exe
  2⤵
  PID:5500
- C:\Windows\System\eyqtolO.exe
  C:\Windows\System\eyqtolO.exe
  2⤵
  PID:5168
- C:\Windows\System\OrlCCKK.exe
  C:\Windows\System\OrlCCKK.exe
  2⤵
  PID:5972
- C:\Windows\System\ljQlMip.exe
  C:\Windows\System\ljQlMip.exe
  2⤵
  PID:5488
- C:\Windows\System\heboPok.exe
  C:\Windows\System\heboPok.exe
  2⤵
  PID:5368
- C:\Windows\System\qnXviWx.exe
  C:\Windows\System\qnXviWx.exe
  2⤵
  PID:5436
- C:\Windows\System\jFmrnLa.exe
  C:\Windows\System\jFmrnLa.exe
  2⤵
  PID:5888
- C:\Windows\System\weWWtTD.exe
  C:\Windows\System\weWWtTD.exe
  2⤵
  PID:5992
- C:\Windows\System\oIZCEJP.exe
  C:\Windows\System\oIZCEJP.exe
  2⤵
  PID:4364
- C:\Windows\System\awptVdx.exe
  C:\Windows\System\awptVdx.exe
  2⤵
  PID:6128
- C:\Windows\System\OsbtvPa.exe
  C:\Windows\System\OsbtvPa.exe
  2⤵
  PID:6028
- C:\Windows\System\geKRdQW.exe
  C:\Windows\System\geKRdQW.exe
  2⤵
  PID:3348
- C:\Windows\System\YUtWaTR.exe
  C:\Windows\System\YUtWaTR.exe
  2⤵
  PID:5292
- C:\Windows\System\ULxACVU.exe
  C:\Windows\System\ULxACVU.exe
  2⤵
  PID:5564
- C:\Windows\System\piggpvG.exe
  C:\Windows\System\piggpvG.exe
  2⤵
  PID:4936
- C:\Windows\System\tOwRkJP.exe
  C:\Windows\System\tOwRkJP.exe
  2⤵
  PID:5876
- C:\Windows\System\QVGXjyp.exe
  C:\Windows\System\QVGXjyp.exe
  2⤵
  PID:4612
- C:\Windows\System\czCYqtC.exe
  C:\Windows\System\czCYqtC.exe
  2⤵
  PID:5820
- C:\Windows\System\HFSoPMi.exe
  C:\Windows\System\HFSoPMi.exe
  2⤵
  PID:5484
- C:\Windows\System\OqVvwgO.exe
  C:\Windows\System\OqVvwgO.exe
  2⤵
  PID:5892
- C:\Windows\System\borVbqB.exe
  C:\Windows\System\borVbqB.exe
  2⤵
  PID:6160
- C:\Windows\System\tfrGGcJ.exe
  C:\Windows\System\tfrGGcJ.exe
  2⤵
  PID:6180
- C:\Windows\System\djbnkbA.exe
  C:\Windows\System\djbnkbA.exe
  2⤵
  PID:6196
- C:\Windows\System\jQRxjzi.exe
  C:\Windows\System\jQRxjzi.exe
  2⤵
  PID:6212
- C:\Windows\System\pFyMhON.exe
  C:\Windows\System\pFyMhON.exe
  2⤵
  PID:6228
- C:\Windows\System\CfnbamL.exe
  C:\Windows\System\CfnbamL.exe
  2⤵
  PID:6244
- C:\Windows\System\TYVXpjS.exe
  C:\Windows\System\TYVXpjS.exe
  2⤵
  PID:6260
- C:\Windows\System\GgBassf.exe
  C:\Windows\System\GgBassf.exe
  2⤵
  PID:6284
- C:\Windows\System\tYsrRFj.exe
  C:\Windows\System\tYsrRFj.exe
  2⤵
  PID:6300
- C:\Windows\System\OzGMiea.exe
  C:\Windows\System\OzGMiea.exe
  2⤵
  PID:6316
- C:\Windows\System\WyRkhrZ.exe
  C:\Windows\System\WyRkhrZ.exe
  2⤵
  PID:6332
- C:\Windows\System\deSXROq.exe
  C:\Windows\System\deSXROq.exe
  2⤵
  PID:6348
- C:\Windows\System\GcnrlpT.exe
  C:\Windows\System\GcnrlpT.exe
  2⤵
  PID:6364
- C:\Windows\System\pjjnDsD.exe
  C:\Windows\System\pjjnDsD.exe
  2⤵
  PID:6380
- C:\Windows\System\QauQtoh.exe
  C:\Windows\System\QauQtoh.exe
  2⤵
  PID:6396
- C:\Windows\System\reIWHcZ.exe
  C:\Windows\System\reIWHcZ.exe
  2⤵
  PID:6420
- C:\Windows\System\YdoYULv.exe
  C:\Windows\System\YdoYULv.exe
  2⤵
  PID:6436
- C:\Windows\System\wVmkoAn.exe
  C:\Windows\System\wVmkoAn.exe
  2⤵
  PID:6456
- C:\Windows\System\FVNjilK.exe
  C:\Windows\System\FVNjilK.exe
  2⤵
  PID:6472
- C:\Windows\System\KmHPJkH.exe
  C:\Windows\System\KmHPJkH.exe
  2⤵
  PID:6488
- C:\Windows\System\anukiDm.exe
  C:\Windows\System\anukiDm.exe
  2⤵
  PID:6504
- C:\Windows\System\DJDfIMP.exe
  C:\Windows\System\DJDfIMP.exe
  2⤵
  PID:6524
- C:\Windows\System\LxlknOD.exe
  C:\Windows\System\LxlknOD.exe
  2⤵
  PID:6540
- C:\Windows\System\qXFFAUX.exe
  C:\Windows\System\qXFFAUX.exe
  2⤵
  PID:6556
- C:\Windows\System\LtKLqPe.exe
  C:\Windows\System\LtKLqPe.exe
  2⤵
  PID:6572
- C:\Windows\System\YJAzsCx.exe
  C:\Windows\System\YJAzsCx.exe
  2⤵
  PID:6588
- C:\Windows\System\ctQPFml.exe
  C:\Windows\System\ctQPFml.exe
  2⤵
  PID:6604
- C:\Windows\System\UMstpWJ.exe
  C:\Windows\System\UMstpWJ.exe
  2⤵
  PID:6620
- C:\Windows\System\RbBuxXp.exe
  C:\Windows\System\RbBuxXp.exe
  2⤵
  PID:6636
- C:\Windows\System\QAhNNGI.exe
  C:\Windows\System\QAhNNGI.exe
  2⤵
  PID:6652
- C:\Windows\System\plejBNl.exe
  C:\Windows\System\plejBNl.exe
  2⤵
  PID:6672
- C:\Windows\System\SjkvTod.exe
  C:\Windows\System\SjkvTod.exe
  2⤵
  PID:6688
- C:\Windows\System\ehSYqdg.exe
  C:\Windows\System\ehSYqdg.exe
  2⤵
  PID:6704
- C:\Windows\System\mDMRtNZ.exe
  C:\Windows\System\mDMRtNZ.exe
  2⤵
  PID:6728
- C:\Windows\System\MYUpOIS.exe
  C:\Windows\System\MYUpOIS.exe
  2⤵
  PID:6748
- C:\Windows\System\XveQczK.exe
  C:\Windows\System\XveQczK.exe
  2⤵
  PID:6764
- C:\Windows\System\FlexHfs.exe
  C:\Windows\System\FlexHfs.exe
  2⤵
  PID:6780
- C:\Windows\System\qYMLyOx.exe
  C:\Windows\System\qYMLyOx.exe
  2⤵
  PID:6796
- C:\Windows\System\jBDHpRY.exe
  C:\Windows\System\jBDHpRY.exe
  2⤵
  PID:6812
- C:\Windows\System\PFzRYxr.exe
  C:\Windows\System\PFzRYxr.exe
  2⤵
  PID:6832
- C:\Windows\System\RfdhnTX.exe
  C:\Windows\System\RfdhnTX.exe
  2⤵
  PID:6848
- C:\Windows\System\MUOSWwN.exe
  C:\Windows\System\MUOSWwN.exe
  2⤵
  PID:6864
- C:\Windows\System\cwPrflW.exe
  C:\Windows\System\cwPrflW.exe
  2⤵
  PID:6880
- C:\Windows\System\YGBlIzs.exe
  C:\Windows\System\YGBlIzs.exe
  2⤵
  PID:6896
- C:\Windows\System\rYEOVDs.exe
  C:\Windows\System\rYEOVDs.exe
  2⤵
  PID:6916
- C:\Windows\System\ZczCApa.exe
  C:\Windows\System\ZczCApa.exe
  2⤵
  PID:6932
- C:\Windows\System\aqYUGzT.exe
  C:\Windows\System\aqYUGzT.exe
  2⤵
  PID:6948
- C:\Windows\System\nSuenFU.exe
  C:\Windows\System\nSuenFU.exe
  2⤵
  PID:6964
- C:\Windows\System\FGAjeAy.exe
  C:\Windows\System\FGAjeAy.exe
  2⤵
  PID:6980
- C:\Windows\System\otkkovs.exe
  C:\Windows\System\otkkovs.exe
  2⤵
  PID:6996
- C:\Windows\System\oxKreLZ.exe
  C:\Windows\System\oxKreLZ.exe
  2⤵
  PID:7012
- C:\Windows\System\wcayzth.exe
  C:\Windows\System\wcayzth.exe
  2⤵
  PID:7028
- C:\Windows\System\VeOORQF.exe
  C:\Windows\System\VeOORQF.exe
  2⤵
  PID:7044
- C:\Windows\System\pJGNglM.exe
  C:\Windows\System\pJGNglM.exe
  2⤵
  PID:7060
- C:\Windows\System\VCfRmpw.exe
  C:\Windows\System\VCfRmpw.exe
  2⤵
  PID:7076
- C:\Windows\System\GRTvCMf.exe
  C:\Windows\System\GRTvCMf.exe
  2⤵
  PID:7144
- C:\Windows\System\GKMNdCi.exe
  C:\Windows\System\GKMNdCi.exe
  2⤵
  PID:7164
- C:\Windows\System\glxTwDZ.exe
  C:\Windows\System\glxTwDZ.exe
  2⤵
  PID:5656
- C:\Windows\System\OwWZVeD.exe
  C:\Windows\System\OwWZVeD.exe
  2⤵
  PID:6220
- C:\Windows\System\cszEjhc.exe
  C:\Windows\System\cszEjhc.exe
  2⤵
  PID:6292
- C:\Windows\System\bKAHiRo.exe
  C:\Windows\System\bKAHiRo.exe
  2⤵
  PID:6356
- C:\Windows\System\zURsrfH.exe
  C:\Windows\System\zURsrfH.exe
  2⤵
  PID:6168
- C:\Windows\System\hxjTLVk.exe
  C:\Windows\System\hxjTLVk.exe
  2⤵
  PID:6208
- C:\Windows\System\uuPZueQ.exe
  C:\Windows\System\uuPZueQ.exe
  2⤵
  PID:6272
- C:\Windows\System\hEHYxIH.exe
  C:\Windows\System\hEHYxIH.exe
  2⤵
  PID:6312
- C:\Windows\System\jXSthiy.exe
  C:\Windows\System\jXSthiy.exe
  2⤵
  PID:6376
- C:\Windows\System\fPBTXlp.exe
  C:\Windows\System\fPBTXlp.exe
  2⤵
  PID:6416
- C:\Windows\System\ihAoLur.exe
  C:\Windows\System\ihAoLur.exe
  2⤵
  PID:6496
- C:\Windows\System\YPOlxNj.exe
  C:\Windows\System\YPOlxNj.exe
  2⤵
  PID:6568
- C:\Windows\System\QKgeofP.exe
  C:\Windows\System\QKgeofP.exe
  2⤵
  PID:6632
- C:\Windows\System\dtlzvok.exe
  C:\Windows\System\dtlzvok.exe
  2⤵
  PID:6696
- C:\Windows\System\vRKDRpZ.exe
  C:\Windows\System\vRKDRpZ.exe
  2⤵
  PID:6516
- C:\Windows\System\qjgSgLG.exe
  C:\Windows\System\qjgSgLG.exe
  2⤵
  PID:6712
- C:\Windows\System\tBWgtMJ.exe
  C:\Windows\System\tBWgtMJ.exe
  2⤵
  PID:6776
- C:\Windows\System\xjsNljn.exe
  C:\Windows\System\xjsNljn.exe
  2⤵
  PID:6844
- C:\Windows\System\nEhRXIE.exe
  C:\Windows\System\nEhRXIE.exe
  2⤵
  PID:6904
- C:\Windows\System\lgGFDab.exe
  C:\Windows\System\lgGFDab.exe
  2⤵
  PID:6552
- C:\Windows\System\dCVWLdU.exe
  C:\Windows\System\dCVWLdU.exe
  2⤵
  PID:6616
- C:\Windows\System\AgBeMHL.exe
  C:\Windows\System\AgBeMHL.exe
  2⤵
  PID:6716
- C:\Windows\System\XejUJdt.exe
  C:\Windows\System\XejUJdt.exe
  2⤵
  PID:6760
- C:\Windows\System\rjSlmiQ.exe
  C:\Windows\System\rjSlmiQ.exe
  2⤵
  PID:6824
- C:\Windows\System\acVYOEo.exe
  C:\Windows\System\acVYOEo.exe
  2⤵
  PID:6860
- C:\Windows\System\dGJcsDj.exe
  C:\Windows\System\dGJcsDj.exe
  2⤵
  PID:6976
- C:\Windows\System\cYPcmyF.exe
  C:\Windows\System\cYPcmyF.exe
  2⤵
  PID:7040
- C:\Windows\System\xBsBPga.exe
  C:\Windows\System\xBsBPga.exe
  2⤵
  PID:7072
- C:\Windows\System\ClmbIMu.exe
  C:\Windows\System\ClmbIMu.exe
  2⤵
  PID:6924
- C:\Windows\System\GFfqCwD.exe
  C:\Windows\System\GFfqCwD.exe
  2⤵
  PID:7084
- C:\Windows\System\ARtCLgQ.exe
  C:\Windows\System\ARtCLgQ.exe
  2⤵
  PID:7108
- C:\Windows\System\ODlizDr.exe
  C:\Windows\System\ODlizDr.exe
  2⤵
  PID:7116
- C:\Windows\System\VmPSBZP.exe
  C:\Windows\System\VmPSBZP.exe
  2⤵
  PID:6188
- C:\Windows\System\QntMWAS.exe
  C:\Windows\System\QntMWAS.exe
  2⤵
  PID:7124
- C:\Windows\System\aMpOwIZ.exe
  C:\Windows\System\aMpOwIZ.exe
  2⤵
  PID:7140
- C:\Windows\System\InzhxfA.exe
  C:\Windows\System\InzhxfA.exe
  2⤵
  PID:6256
- C:\Windows\System\ZCEbJlz.exe
  C:\Windows\System\ZCEbJlz.exe
  2⤵
  PID:5872
- C:\Windows\System\RYOHRbk.exe
  C:\Windows\System\RYOHRbk.exe
  2⤵
  PID:6428
- C:\Windows\System\lgijUNN.exe
  C:\Windows\System\lgijUNN.exe
  2⤵
  PID:3724
- C:\Windows\System\cYgRAvJ.exe
  C:\Windows\System\cYgRAvJ.exe
  2⤵
  PID:6240
- C:\Windows\System\IlVjtOk.exe
  C:\Windows\System\IlVjtOk.exe
  2⤵
  PID:6344
- C:\Windows\System\YRmWkPA.exe
  C:\Windows\System\YRmWkPA.exe
  2⤵
  PID:6536
- C:\Windows\System\HgpwCcM.exe
  C:\Windows\System\HgpwCcM.exe
  2⤵
  PID:6744
- C:\Windows\System\edfMfMn.exe
  C:\Windows\System\edfMfMn.exe
  2⤵
  PID:6464
- C:\Windows\System\kOHGqXh.exe
  C:\Windows\System\kOHGqXh.exe
  2⤵
  PID:6484
- C:\Windows\System\QZBBnNZ.exe
  C:\Windows\System\QZBBnNZ.exe
  2⤵
  PID:6468
- C:\Windows\System\AGLVObF.exe
  C:\Windows\System\AGLVObF.exe
  2⤵
  PID:6548
- C:\Windows\System\syVtVvG.exe
  C:\Windows\System\syVtVvG.exe
  2⤵
  PID:6944
- C:\Windows\System\dKKHSuM.exe
  C:\Windows\System\dKKHSuM.exe
  2⤵
  PID:6584
- C:\Windows\System\IcszIJn.exe
  C:\Windows\System\IcszIJn.exe
  2⤵
  PID:6756
- C:\Windows\System\SfOrGsc.exe
  C:\Windows\System\SfOrGsc.exe
  2⤵
  PID:7036
- C:\Windows\System\ejaMBzU.exe
  C:\Windows\System\ejaMBzU.exe
  2⤵
  PID:7052
- C:\Windows\System\rMKuXFh.exe
  C:\Windows\System\rMKuXFh.exe
  2⤵
  PID:7092
- C:\Windows\System\HoDTgDa.exe
  C:\Windows\System\HoDTgDa.exe
  2⤵
  PID:7120
- C:\Windows\System\lKWzxMi.exe
  C:\Windows\System\lKWzxMi.exe
  2⤵
  PID:7172
- C:\Windows\System\bPEKRyV.exe
  C:\Windows\System\bPEKRyV.exe
  2⤵
  PID:7188
- C:\Windows\System\BvBjHbc.exe
  C:\Windows\System\BvBjHbc.exe
  2⤵
  PID:7208
- C:\Windows\System\iwTiryb.exe
  C:\Windows\System\iwTiryb.exe
  2⤵
  PID:7228
- C:\Windows\System\UyiAiNo.exe
  C:\Windows\System\UyiAiNo.exe
  2⤵
  PID:7244
- C:\Windows\System\CVlRdbC.exe
  C:\Windows\System\CVlRdbC.exe
  2⤵
  PID:7264
- C:\Windows\System\wETIBdW.exe
  C:\Windows\System\wETIBdW.exe
  2⤵
  PID:7280
- C:\Windows\System\DkLxOKs.exe
  C:\Windows\System\DkLxOKs.exe
  2⤵
  PID:7296
- C:\Windows\System\hjafudw.exe
  C:\Windows\System\hjafudw.exe
  2⤵
  PID:7312
- C:\Windows\System\igDMYvJ.exe
  C:\Windows\System\igDMYvJ.exe
  2⤵
  PID:7328
- C:\Windows\System\iKXnfDH.exe
  C:\Windows\System\iKXnfDH.exe
  2⤵
  PID:7344
- C:\Windows\System\vxNqQlQ.exe
  C:\Windows\System\vxNqQlQ.exe
  2⤵
  PID:7360
- C:\Windows\System\mzijLKO.exe
  C:\Windows\System\mzijLKO.exe
  2⤵
  PID:7376
- C:\Windows\System\TpgpvpA.exe
  C:\Windows\System\TpgpvpA.exe
  2⤵
  PID:7392
- C:\Windows\System\GTJELVw.exe
  C:\Windows\System\GTJELVw.exe
  2⤵
  PID:7408
- C:\Windows\System\DcOrZcE.exe
  C:\Windows\System\DcOrZcE.exe
  2⤵
  PID:7424
- C:\Windows\System\PlabXlD.exe
  C:\Windows\System\PlabXlD.exe
  2⤵
  PID:7444
- C:\Windows\System\axjIjdH.exe
  C:\Windows\System\axjIjdH.exe
  2⤵
  PID:7472
- C:\Windows\System\prceVuo.exe
  C:\Windows\System\prceVuo.exe
  2⤵
  PID:7488
- C:\Windows\System\chkdBTJ.exe
  C:\Windows\System\chkdBTJ.exe
  2⤵
  PID:7504
- C:\Windows\System\fDDFEQt.exe
  C:\Windows\System\fDDFEQt.exe
  2⤵
  PID:7520
- C:\Windows\System\nhNScHw.exe
  C:\Windows\System\nhNScHw.exe
  2⤵
  PID:7544
- C:\Windows\System\qMmjGMK.exe
  C:\Windows\System\qMmjGMK.exe
  2⤵
  PID:7560
- C:\Windows\System\FPkztcA.exe
  C:\Windows\System\FPkztcA.exe
  2⤵
  PID:7576
- C:\Windows\System\pZJOtvD.exe
  C:\Windows\System\pZJOtvD.exe
  2⤵
  PID:7592
- C:\Windows\System\bbcDjfh.exe
  C:\Windows\System\bbcDjfh.exe
  2⤵
  PID:7608
- C:\Windows\System\fAyGIjp.exe
  C:\Windows\System\fAyGIjp.exe
  2⤵
  PID:7636
- C:\Windows\System\tSrQzDA.exe
  C:\Windows\System\tSrQzDA.exe
  2⤵
  PID:7652
- C:\Windows\System\QPElGcr.exe
  C:\Windows\System\QPElGcr.exe
  2⤵
  PID:7668
- C:\Windows\System\EBDfUyv.exe
  C:\Windows\System\EBDfUyv.exe
  2⤵
  PID:7688
- C:\Windows\System\PDRbBDp.exe
  C:\Windows\System\PDRbBDp.exe
  2⤵
  PID:7704
- C:\Windows\System\HqLlMbr.exe
  C:\Windows\System\HqLlMbr.exe
  2⤵
  PID:7720
- C:\Windows\System\oMAibSy.exe
  C:\Windows\System\oMAibSy.exe
  2⤵
  PID:7736
- C:\Windows\System\xCYPWTS.exe
  C:\Windows\System\xCYPWTS.exe
  2⤵
  PID:7752
- C:\Windows\System\acYlmTf.exe
  C:\Windows\System\acYlmTf.exe
  2⤵
  PID:7768
- C:\Windows\System\ZqEMEhD.exe
  C:\Windows\System\ZqEMEhD.exe
  2⤵
  PID:7784
- C:\Windows\System\cLrOPbR.exe
  C:\Windows\System\cLrOPbR.exe
  2⤵
  PID:7800
- C:\Windows\System\VGEqqkp.exe
  C:\Windows\System\VGEqqkp.exe
  2⤵
  PID:7816
- C:\Windows\System\CrqBfUo.exe
  C:\Windows\System\CrqBfUo.exe
  2⤵
  PID:7844
- C:\Windows\System\DVoBykq.exe
  C:\Windows\System\DVoBykq.exe
  2⤵
  PID:7860
- C:\Windows\System\LWaOktN.exe
  C:\Windows\System\LWaOktN.exe
  2⤵
  PID:7876
- C:\Windows\System\IuIuZJr.exe
  C:\Windows\System\IuIuZJr.exe
  2⤵
  PID:7892
- C:\Windows\System\xPiuaKG.exe
  C:\Windows\System\xPiuaKG.exe
  2⤵
  PID:7908
- C:\Windows\System\ZLTgHgH.exe
  C:\Windows\System\ZLTgHgH.exe
  2⤵
  PID:7924
- C:\Windows\System\QFioQJS.exe
  C:\Windows\System\QFioQJS.exe
  2⤵
  PID:7940
- C:\Windows\System\VlCzAyD.exe
  C:\Windows\System\VlCzAyD.exe
  2⤵
  PID:7964
- C:\Windows\System\urOcwVe.exe
  C:\Windows\System\urOcwVe.exe
  2⤵
  PID:7980
- C:\Windows\System\YzmfkLB.exe
  C:\Windows\System\YzmfkLB.exe
  2⤵
  PID:8000
- C:\Windows\System\sojfsmZ.exe
  C:\Windows\System\sojfsmZ.exe
  2⤵
  PID:8016
- C:\Windows\System\YDSQXOP.exe
  C:\Windows\System\YDSQXOP.exe
  2⤵
  PID:8032
- C:\Windows\System\tjVmuRe.exe
  C:\Windows\System\tjVmuRe.exe
  2⤵
  PID:8048
- C:\Windows\System\sUaLefG.exe
  C:\Windows\System\sUaLefG.exe
  2⤵
  PID:8064
- C:\Windows\System\NNYhWuz.exe
  C:\Windows\System\NNYhWuz.exe
  2⤵
  PID:8084
- C:\Windows\System\TziDFIm.exe
  C:\Windows\System\TziDFIm.exe
  2⤵
  PID:8100
- C:\Windows\System\fjQLgUs.exe
  C:\Windows\System\fjQLgUs.exe
  2⤵
  PID:8116
- C:\Windows\System\MZiRuAo.exe
  C:\Windows\System\MZiRuAo.exe
  2⤵
  PID:8132
- C:\Windows\System\CwlsjUT.exe
  C:\Windows\System\CwlsjUT.exe
  2⤵
  PID:8152
- C:\Windows\System\GhhSjFr.exe
  C:\Windows\System\GhhSjFr.exe
  2⤵
  PID:8168
- C:\Windows\System\wdlxMDF.exe
  C:\Windows\System\wdlxMDF.exe
  2⤵
  PID:8184
- C:\Windows\System\FyHPshx.exe
  C:\Windows\System\FyHPshx.exe
  2⤵
  PID:6532
- C:\Windows\System\aHXVGLi.exe
  C:\Windows\System\aHXVGLi.exe
  2⤵
  PID:6392
- C:\Windows\System\mvZBPzQ.exe
  C:\Windows\System\mvZBPzQ.exe
  2⤵
  PID:6772
- C:\Windows\System\HaGpEJw.exe
  C:\Windows\System\HaGpEJw.exe
  2⤵
  PID:6956
- C:\Windows\System\oimmqpu.exe
  C:\Windows\System\oimmqpu.exe
  2⤵
  PID:7020
- C:\Windows\System\ItcyuHM.exe
  C:\Windows\System\ItcyuHM.exe
  2⤵
  PID:7196
- C:\Windows\System\IAHLJqW.exe
  C:\Windows\System\IAHLJqW.exe
  2⤵
  PID:7276
- C:\Windows\System\ENFmLgS.exe
  C:\Windows\System\ENFmLgS.exe
  2⤵
  PID:7340
- C:\Windows\System\sULknap.exe
  C:\Windows\System\sULknap.exe
  2⤵
  PID:7404
- C:\Windows\System\edyyRzk.exe
  C:\Windows\System\edyyRzk.exe
  2⤵
  PID:6408
- C:\Windows\System\ETVIIJz.exe
  C:\Windows\System\ETVIIJz.exe
  2⤵
  PID:7484
- C:\Windows\System\YhfyJBY.exe
  C:\Windows\System\YhfyJBY.exe
  2⤵
  PID:6112
- C:\Windows\System\HiqLudJ.exe
  C:\Windows\System\HiqLudJ.exe
  2⤵
  PID:6840
- C:\Windows\System\kCertNF.exe
  C:\Windows\System\kCertNF.exe
  2⤵
  PID:6960
- C:\Windows\System\NzNkcSB.exe
  C:\Windows\System\NzNkcSB.exe
  2⤵
  PID:7568
- C:\Windows\System\PfSAmdL.exe
  C:\Windows\System\PfSAmdL.exe
  2⤵
  PID:7440
- C:\Windows\System\gsLeakQ.exe
  C:\Windows\System\gsLeakQ.exe
  2⤵
  PID:7552
- C:\Windows\System\HNJIfdC.exe
  C:\Windows\System\HNJIfdC.exe
  2⤵
  PID:7684
- C:\Windows\System\keezrcC.exe
  C:\Windows\System\keezrcC.exe
  2⤵
  PID:7748
- C:\Windows\System\xVDftrN.exe
  C:\Windows\System\xVDftrN.exe
  2⤵
  PID:7808
- C:\Windows\System\bfiUDZe.exe
  C:\Windows\System\bfiUDZe.exe
  2⤵
  PID:7840
- C:\Windows\System\AhPtukM.exe
  C:\Windows\System\AhPtukM.exe
  2⤵
  PID:7824
- C:\Windows\System\SdSxeHF.exe
  C:\Windows\System\SdSxeHF.exe
  2⤵
  PID:7760
- C:\Windows\System\hTeAqwF.exe
  C:\Windows\System\hTeAqwF.exe
  2⤵
  PID:7696
- C:\Windows\System\HWkvyJF.exe
  C:\Windows\System\HWkvyJF.exe
  2⤵
  PID:7628
- C:\Windows\System\TEBCyvd.exe
  C:\Windows\System\TEBCyvd.exe
  2⤵
  PID:7884
- C:\Windows\System\TIwalOJ.exe
  C:\Windows\System\TIwalOJ.exe
  2⤵
  PID:7948
- C:\Windows\System\lTesJFl.exe
  C:\Windows\System\lTesJFl.exe
  2⤵
  PID:7996
- C:\Windows\System\UyLBFpW.exe
  C:\Windows\System\UyLBFpW.exe
  2⤵
  PID:8056
- C:\Windows\System\jPGdjQd.exe
  C:\Windows\System\jPGdjQd.exe
  2⤵
  PID:8124
- C:\Windows\System\VuzwsSP.exe
  C:\Windows\System\VuzwsSP.exe
  2⤵
  PID:6808
- C:\Windows\System\AOJgnFe.exe
  C:\Windows\System\AOJgnFe.exe
  2⤵
  PID:7184
- C:\Windows\System\uDNLcbZ.exe
  C:\Windows\System\uDNLcbZ.exe
  2⤵
  PID:7252
- C:\Windows\System\rleaFCb.exe
  C:\Windows\System\rleaFCb.exe
  2⤵
  PID:7292
- C:\Windows\System\MRxPkrH.exe
  C:\Windows\System\MRxPkrH.exe
  2⤵
  PID:7900
- C:\Windows\System\wumsGha.exe
  C:\Windows\System\wumsGha.exe
  2⤵
  PID:7972
- C:\Windows\System\xMyyEug.exe
  C:\Windows\System\xMyyEug.exe
  2⤵
  PID:8044
- C:\Windows\System\iMvLfzV.exe
  C:\Windows\System\iMvLfzV.exe
  2⤵
  PID:8080
- C:\Windows\System\xoOiuqy.exe
  C:\Windows\System\xoOiuqy.exe
  2⤵
  PID:8144
- C:\Windows\System\NtuzCTg.exe
  C:\Windows\System\NtuzCTg.exe
  2⤵
  PID:5808
- C:\Windows\System\dkEMHmP.exe
  C:\Windows\System\dkEMHmP.exe
  2⤵
  PID:7100
- C:\Windows\System\wtKUNKa.exe
  C:\Windows\System\wtKUNKa.exe
  2⤵
  PID:7436
- C:\Windows\System\ZcNKwRo.exe
  C:\Windows\System\ZcNKwRo.exe
  2⤵
  PID:7648
- C:\Windows\System\uzZrkhK.exe
  C:\Windows\System\uzZrkhK.exe
  2⤵
  PID:7780
- C:\Windows\System\zVtuGVW.exe
  C:\Windows\System\zVtuGVW.exe
  2⤵
  PID:7764
- C:\Windows\System\aoxuEip.exe
  C:\Windows\System\aoxuEip.exe
  2⤵
  PID:7728
- C:\Windows\System\tEOTTpQ.exe
  C:\Windows\System\tEOTTpQ.exe
  2⤵
  PID:8024
- C:\Windows\System\PZokoNP.exe
  C:\Windows\System\PZokoNP.exe
  2⤵
  PID:7988
- C:\Windows\System\fArQZzv.exe
  C:\Windows\System\fArQZzv.exe
  2⤵
  PID:7624
- C:\Windows\System\UpPfpDF.exe
  C:\Windows\System\UpPfpDF.exe
  2⤵
  PID:5520
- C:\Windows\System\uBqhJSi.exe
  C:\Windows\System\uBqhJSi.exe
  2⤵
  PID:7400
- C:\Windows\System\EpUsmRZ.exe
  C:\Windows\System\EpUsmRZ.exe
  2⤵
  PID:6564
- C:\Windows\System\tTJpFCH.exe
  C:\Windows\System\tTJpFCH.exe
  2⤵
  PID:7976
- C:\Windows\System\oBplHLZ.exe
  C:\Windows\System\oBplHLZ.exe
  2⤵
  PID:6792
- C:\Windows\System\jlEnGkQ.exe
  C:\Windows\System\jlEnGkQ.exe
  2⤵
  PID:7932
- C:\Windows\System\NxlnPGh.exe
  C:\Windows\System\NxlnPGh.exe
  2⤵
  PID:7868
- C:\Windows\System\dCTmRTE.exe
  C:\Windows\System\dCTmRTE.exe
  2⤵
  PID:8076
- C:\Windows\System\CfuvGnk.exe
  C:\Windows\System\CfuvGnk.exe
  2⤵
  PID:7336
- C:\Windows\System\GDXkKZJ.exe
  C:\Windows\System\GDXkKZJ.exe
  2⤵
  PID:6724
- C:\Windows\System\OFrbpGz.exe
  C:\Windows\System\OFrbpGz.exe
  2⤵
  PID:7388
- C:\Windows\System\uVHxGYc.exe
  C:\Windows\System\uVHxGYc.exe
  2⤵
  PID:7420
- C:\Windows\System\UWMCDOc.exe
  C:\Windows\System\UWMCDOc.exe
  2⤵
  PID:7496
- C:\Windows\System\GBAppMt.exe
  C:\Windows\System\GBAppMt.exe
  2⤵
  PID:5552
- C:\Windows\System\mrlMChk.exe
  C:\Windows\System\mrlMChk.exe
  2⤵
  PID:7516
- C:\Windows\System\WeHRnlC.exe
  C:\Windows\System\WeHRnlC.exe
  2⤵
  PID:7240
- C:\Windows\System\gQvNNYm.exe
  C:\Windows\System\gQvNNYm.exe
  2⤵
  PID:7792
- C:\Windows\System\eSmZYUP.exe
  C:\Windows\System\eSmZYUP.exe
  2⤵
  PID:7744
- C:\Windows\System\DWBPJxe.exe
  C:\Windows\System\DWBPJxe.exe
  2⤵
  PID:7136
- C:\Windows\System\fVAnMEc.exe
  C:\Windows\System\fVAnMEc.exe
  2⤵
  PID:7660
- C:\Windows\System\UOsQxiV.exe
  C:\Windows\System\UOsQxiV.exe
  2⤵
  PID:7960
- C:\Windows\System\fgbgdIp.exe
  C:\Windows\System\fgbgdIp.exe
  2⤵
  PID:6820
- C:\Windows\System\TfVTDoh.exe
  C:\Windows\System\TfVTDoh.exe
  2⤵
  PID:6308
- C:\Windows\System\vXjRtub.exe
  C:\Windows\System\vXjRtub.exe
  2⤵
  PID:7464
- C:\Windows\System\nzFxBDf.exe
  C:\Windows\System\nzFxBDf.exe
  2⤵
  PID:4876
- C:\Windows\System\zbPFaEU.exe
  C:\Windows\System\zbPFaEU.exe
  2⤵
  PID:7324
- C:\Windows\System\kEwjcmi.exe
  C:\Windows\System\kEwjcmi.exe
  2⤵
  PID:7528
- C:\Windows\System\ioZSvaY.exe
  C:\Windows\System\ioZSvaY.exe
  2⤵
  PID:7916
- C:\Windows\System\fIYamWZ.exe
  C:\Windows\System\fIYamWZ.exe
  2⤵
  PID:7272
- C:\Windows\System\PBrqpDf.exe
  C:\Windows\System\PBrqpDf.exe
  2⤵
  PID:6912
- C:\Windows\System\ndAmWtB.exe
  C:\Windows\System\ndAmWtB.exe
  2⤵
  PID:7540
- C:\Windows\System\KlJZuTg.exe
  C:\Windows\System\KlJZuTg.exe
  2⤵
  PID:8096
- C:\Windows\System\GUDOMPU.exe
  C:\Windows\System\GUDOMPU.exe
  2⤵
  PID:7288
- C:\Windows\System\ayiUKot.exe
  C:\Windows\System\ayiUKot.exe
  2⤵
  PID:6892
- C:\Windows\System\OZetaZq.exe
  C:\Windows\System\OZetaZq.exe
  2⤵
  PID:8112
- C:\Windows\System\WzFaaox.exe
  C:\Windows\System\WzFaaox.exe
  2⤵
  PID:7604
- C:\Windows\System\mQeZcPu.exe
  C:\Windows\System\mQeZcPu.exe
  2⤵
  PID:8196
- C:\Windows\System\wCKzioA.exe
  C:\Windows\System\wCKzioA.exe
  2⤵
  PID:8212
- C:\Windows\System\kjAPEwe.exe
  C:\Windows\System\kjAPEwe.exe
  2⤵
  PID:8228
- C:\Windows\System\ysewFvk.exe
  C:\Windows\System\ysewFvk.exe
  2⤵
  PID:8248
- C:\Windows\System\lxPtYFP.exe
  C:\Windows\System\lxPtYFP.exe
  2⤵
  PID:8264
- C:\Windows\System\gRGdKta.exe
  C:\Windows\System\gRGdKta.exe
  2⤵
  PID:8280
- C:\Windows\System\pBvkgKQ.exe
  C:\Windows\System\pBvkgKQ.exe
  2⤵
  PID:8300
- C:\Windows\System\aMKVJMN.exe
  C:\Windows\System\aMKVJMN.exe
  2⤵
  PID:8368
- C:\Windows\System\qvkXYGW.exe
  C:\Windows\System\qvkXYGW.exe
  2⤵
  PID:8384
- C:\Windows\System\ruyTwXy.exe
  C:\Windows\System\ruyTwXy.exe
  2⤵
  PID:8400
- C:\Windows\System\nMQHnEu.exe
  C:\Windows\System\nMQHnEu.exe
  2⤵
  PID:8416
- C:\Windows\System\zbsdgMW.exe
  C:\Windows\System\zbsdgMW.exe
  2⤵
  PID:8448
- C:\Windows\System\ZMcsGqp.exe
  C:\Windows\System\ZMcsGqp.exe
  2⤵
  PID:8464
- C:\Windows\System\Vntjeoq.exe
  C:\Windows\System\Vntjeoq.exe
  2⤵
  PID:8488
- C:\Windows\System\PnNzBzm.exe
  C:\Windows\System\PnNzBzm.exe
  2⤵
  PID:8504
- C:\Windows\System\BfsrxnC.exe
  C:\Windows\System\BfsrxnC.exe
  2⤵
  PID:8520
- C:\Windows\System\kSTvlMJ.exe
  C:\Windows\System\kSTvlMJ.exe
  2⤵
  PID:8536
- C:\Windows\System\cLLifYQ.exe
  C:\Windows\System\cLLifYQ.exe
  2⤵
  PID:8552
- C:\Windows\System\Kloiqym.exe
  C:\Windows\System\Kloiqym.exe
  2⤵
  PID:8568
- C:\Windows\System\ioJqxwC.exe
  C:\Windows\System\ioJqxwC.exe
  2⤵
  PID:8584
- C:\Windows\System\uYtgTPR.exe
  C:\Windows\System\uYtgTPR.exe
  2⤵
  PID:8600
- C:\Windows\System\CpMxZCn.exe
  C:\Windows\System\CpMxZCn.exe
  2⤵
  PID:8616
- C:\Windows\System\TRlEYFA.exe
  C:\Windows\System\TRlEYFA.exe
  2⤵
  PID:8640
- C:\Windows\System\xhGXbxj.exe
  C:\Windows\System\xhGXbxj.exe
  2⤵
  PID:8660
- C:\Windows\System\GVSpnWB.exe
  C:\Windows\System\GVSpnWB.exe
  2⤵
  PID:8676
- C:\Windows\System\EXYhmsi.exe
  C:\Windows\System\EXYhmsi.exe
  2⤵
  PID:8692
- C:\Windows\System\UaGbqam.exe
  C:\Windows\System\UaGbqam.exe
  2⤵
  PID:8708
- C:\Windows\System\GkhHPyK.exe
  C:\Windows\System\GkhHPyK.exe
  2⤵
  PID:8724
- C:\Windows\System\miTEeQq.exe
  C:\Windows\System\miTEeQq.exe
  2⤵
  PID:8740
- C:\Windows\System\cMFdheY.exe
  C:\Windows\System\cMFdheY.exe
  2⤵
  PID:8760
- C:\Windows\System\uStQeBT.exe
  C:\Windows\System\uStQeBT.exe
  2⤵
  PID:8776
- C:\Windows\System\hCgQiaP.exe
  C:\Windows\System\hCgQiaP.exe
  2⤵
  PID:8792
- C:\Windows\System\IFYbgwA.exe
  C:\Windows\System\IFYbgwA.exe
  2⤵
  PID:8808
- C:\Windows\System\locPuQu.exe
  C:\Windows\System\locPuQu.exe
  2⤵
  PID:8832
- C:\Windows\System\jbZEAGF.exe
  C:\Windows\System\jbZEAGF.exe
  2⤵
  PID:8852
- C:\Windows\System\SluIEjy.exe
  C:\Windows\System\SluIEjy.exe
  2⤵
  PID:8872
- C:\Windows\System\ygsXaZm.exe
  C:\Windows\System\ygsXaZm.exe
  2⤵
  PID:8888
- C:\Windows\System\FaxpVCf.exe
  C:\Windows\System\FaxpVCf.exe
  2⤵
  PID:8996
- C:\Windows\System\GejjRzt.exe
  C:\Windows\System\GejjRzt.exe
  2⤵
  PID:9016
- C:\Windows\System\rJUnuGi.exe
  C:\Windows\System\rJUnuGi.exe
  2⤵
  PID:9032
- C:\Windows\System\bJFkNoh.exe
  C:\Windows\System\bJFkNoh.exe
  2⤵
  PID:9048
- C:\Windows\System\IZKElWp.exe
  C:\Windows\System\IZKElWp.exe
  2⤵
  PID:9068
- C:\Windows\System\buvPMaY.exe
  C:\Windows\System\buvPMaY.exe
  2⤵
  PID:9084
- C:\Windows\System\LlxHcWi.exe
  C:\Windows\System\LlxHcWi.exe
  2⤵
  PID:9104
- C:\Windows\System\ShDlGHv.exe
  C:\Windows\System\ShDlGHv.exe
  2⤵
  PID:9120
- C:\Windows\System\jrJlsVv.exe
  C:\Windows\System\jrJlsVv.exe
  2⤵
  PID:9136
- C:\Windows\System\oUUcblt.exe
  C:\Windows\System\oUUcblt.exe
  2⤵
  PID:9152
- C:\Windows\System\oXmBjaL.exe
  C:\Windows\System\oXmBjaL.exe
  2⤵
  PID:9168
- C:\Windows\System\JeIqjdv.exe
  C:\Windows\System\JeIqjdv.exe
  2⤵
  PID:9184
- C:\Windows\System\ydGLyhK.exe
  C:\Windows\System\ydGLyhK.exe
  2⤵
  PID:9200
- C:\Windows\System\DORNQyO.exe
  C:\Windows\System\DORNQyO.exe
  2⤵
  PID:8204
- C:\Windows\System\PISxjiY.exe
  C:\Windows\System\PISxjiY.exe
  2⤵
  PID:8288
- C:\Windows\System\ySvOGRP.exe
  C:\Windows\System\ySvOGRP.exe
  2⤵
  PID:8316
- C:\Windows\System\iJHBavw.exe
  C:\Windows\System\iJHBavw.exe
  2⤵
  PID:8336
- C:\Windows\System\dRTQhaf.exe
  C:\Windows\System\dRTQhaf.exe
  2⤵
  PID:8440
- C:\Windows\System\APQSApc.exe
  C:\Windows\System\APQSApc.exe
  2⤵
  PID:8472
- C:\Windows\System\zzLNKvt.exe
  C:\Windows\System\zzLNKvt.exe
  2⤵
  PID:8516
- C:\Windows\System\nktpKDe.exe
  C:\Windows\System\nktpKDe.exe
  2⤵
  PID:8580
- C:\Windows\System\xmGdfMx.exe
  C:\Windows\System\xmGdfMx.exe
  2⤵
  PID:8648
- C:\Windows\System\BcSMUrX.exe
  C:\Windows\System\BcSMUrX.exe
  2⤵
  PID:8592
- C:\Windows\System\QjhlCfX.exe
  C:\Windows\System\QjhlCfX.exe
  2⤵
  PID:8632
- C:\Windows\System\ADXQLQn.exe
  C:\Windows\System\ADXQLQn.exe
  2⤵
  PID:8496
- C:\Windows\System\OafWljO.exe
  C:\Windows\System\OafWljO.exe
  2⤵
  PID:8668
- C:\Windows\System\TasydGW.exe
  C:\Windows\System\TasydGW.exe
  2⤵
  PID:8700
- C:\Windows\System\poKEQub.exe
  C:\Windows\System\poKEQub.exe
  2⤵
  PID:8732
- C:\Windows\System\JTEamnR.exe
  C:\Windows\System\JTEamnR.exe
  2⤵
  PID:8772
- C:\Windows\System\xIyPWbO.exe
  C:\Windows\System\xIyPWbO.exe
  2⤵
  PID:8804
- C:\Windows\System\pRWjfxc.exe
  C:\Windows\System\pRWjfxc.exe
  2⤵
  PID:8840
- C:\Windows\System\iLANDcu.exe
  C:\Windows\System\iLANDcu.exe
  2⤵
  PID:8848
- C:\Windows\System\JtdUUAe.exe
  C:\Windows\System\JtdUUAe.exe
  2⤵
  PID:9004
- C:\Windows\System\BZurNYW.exe
  C:\Windows\System\BZurNYW.exe
  2⤵
  PID:9044
- C:\Windows\System\mmMhWmm.exe
  C:\Windows\System\mmMhWmm.exe
  2⤵
  PID:9116
- C:\Windows\System\BWcQvYz.exe
  C:\Windows\System\BWcQvYz.exe
  2⤵
  PID:9180
- C:\Windows\System\mRtrGuL.exe
  C:\Windows\System\mRtrGuL.exe
  2⤵
  PID:8896
- C:\Windows\System\NDbkMmW.exe
  C:\Windows\System\NDbkMmW.exe
  2⤵
  PID:9128
- C:\Windows\System\pYZKeUO.exe
  C:\Windows\System\pYZKeUO.exe
  2⤵
  PID:7680
- C:\Windows\System\qvikSYB.exe
  C:\Windows\System\qvikSYB.exe
  2⤵
  PID:8920
- C:\Windows\System\OPLanst.exe
  C:\Windows\System\OPLanst.exe
  2⤵
  PID:8936
- C:\Windows\System\SyCKntW.exe
  C:\Windows\System\SyCKntW.exe
  2⤵
  PID:8960
- C:\Windows\System\kVFWbCD.exe
  C:\Windows\System\kVFWbCD.exe
  2⤵
  PID:8984
- C:\Windows\System\rypOyBL.exe
  C:\Windows\System\rypOyBL.exe
  2⤵
  PID:9028
- C:\Windows\System\dOrbATP.exe
  C:\Windows\System\dOrbATP.exe
  2⤵
  PID:9096
- C:\Windows\System\SJhvrHa.exe
  C:\Windows\System\SJhvrHa.exe
  2⤵
  PID:9192
- C:\Windows\System\EyhIWLt.exe
  C:\Windows\System\EyhIWLt.exe
  2⤵
  PID:7852
- C:\Windows\System\CeDeajO.exe
  C:\Windows\System\CeDeajO.exe
  2⤵
  PID:7180
- C:\Windows\System\rIsrtPN.exe
  C:\Windows\System\rIsrtPN.exe
  2⤵
  PID:7616
- C:\Windows\System\sFaErJV.exe
  C:\Windows\System\sFaErJV.exe
  2⤵
  PID:8224
- C:\Windows\System\Gpuylrb.exe
  C:\Windows\System\Gpuylrb.exe
  2⤵
  PID:8328
- C:\Windows\System\nocuEPF.exe
  C:\Windows\System\nocuEPF.exe
  2⤵
  PID:8308
- C:\Windows\System\RBBwacK.exe
  C:\Windows\System\RBBwacK.exe
  2⤵
  PID:8412
- C:\Windows\System\AwvCZyO.exe
  C:\Windows\System\AwvCZyO.exe
  2⤵
  PID:8548
- C:\Windows\System\ZmkZvti.exe
  C:\Windows\System\ZmkZvti.exe
  2⤵
  PID:8684
- C:\Windows\System\fTSVQnc.exe
  C:\Windows\System\fTSVQnc.exe
  2⤵
  PID:8484
- C:\Windows\System\ucRNIam.exe
  C:\Windows\System\ucRNIam.exe
  2⤵
  PID:8380
- C:\Windows\System\eVvatOp.exe
  C:\Windows\System\eVvatOp.exe
  2⤵
  PID:8628
- C:\Windows\System\EyLcfRt.exe
  C:\Windows\System\EyLcfRt.exe
  2⤵
  PID:8716
- C:\Windows\System\pnVwglD.exe
  C:\Windows\System\pnVwglD.exe
  2⤵
  PID:8532
- C:\Windows\System\VPlNfmm.exe
  C:\Windows\System\VPlNfmm.exe
  2⤵
  PID:8884
- C:\Windows\System\LlsfXLc.exe
  C:\Windows\System\LlsfXLc.exe
  2⤵
  PID:8560
- C:\Windows\System\ITTyJLf.exe
  C:\Windows\System\ITTyJLf.exe
  2⤵
  PID:8756
- C:\Windows\System\IylTMiP.exe
  C:\Windows\System\IylTMiP.exe
  2⤵
  PID:9012
- C:\Windows\System\FyldrTe.exe
  C:\Windows\System\FyldrTe.exe
  2⤵
  PID:7532
- C:\Windows\System\ORhmXEX.exe
  C:\Windows\System\ORhmXEX.exe
  2⤵
  PID:9064
- C:\Windows\System\HCYaLDy.exe
  C:\Windows\System\HCYaLDy.exe
  2⤵
  PID:8236
- C:\Windows\System\LesseOi.exe
  C:\Windows\System\LesseOi.exe
  2⤵
  PID:8972
- C:\Windows\System\NctlQuX.exe
  C:\Windows\System\NctlQuX.exe
  2⤵
  PID:9060
- C:\Windows\System\aseNbxx.exe
  C:\Windows\System\aseNbxx.exe
  2⤵
  PID:9024
- C:\Windows\System\KdZrgSH.exe
  C:\Windows\System\KdZrgSH.exe
  2⤵
  PID:7872
- C:\Windows\System\FSmHnZJ.exe
  C:\Windows\System\FSmHnZJ.exe
  2⤵
  PID:8364
- C:\Windows\System\ROmPSGZ.exe
  C:\Windows\System\ROmPSGZ.exe
  2⤵
  PID:8564
- C:\Windows\System\hNKtxJi.exe
  C:\Windows\System\hNKtxJi.exe
  2⤵
  PID:8376
- C:\Windows\System\ZeDhnjt.exe
  C:\Windows\System\ZeDhnjt.exe
  2⤵
  PID:8864
- C:\Windows\System\erPTTkf.exe
  C:\Windows\System\erPTTkf.exe
  2⤵
  PID:8528
- C:\Windows\System\qqMrkfg.exe
  C:\Windows\System\qqMrkfg.exe
  2⤵
  PID:8932
- C:\Windows\System\fsIgdaR.exe
  C:\Windows\System\fsIgdaR.exe
  2⤵
  PID:7468
- C:\Windows\System\XAWwOeh.exe
  C:\Windows\System\XAWwOeh.exe
  2⤵
  PID:8820
- C:\Windows\System\UBmIUpU.exe
  C:\Windows\System\UBmIUpU.exe
  2⤵
  PID:9220
- C:\Windows\System\eRcFdTg.exe
  C:\Windows\System\eRcFdTg.exe
  2⤵
  PID:9244
- C:\Windows\System\DFffpfY.exe
  C:\Windows\System\DFffpfY.exe
  2⤵
  PID:9260
- C:\Windows\System\EBOHOCm.exe
  C:\Windows\System\EBOHOCm.exe
  2⤵
  PID:9276
- C:\Windows\System\gFIywAx.exe
  C:\Windows\System\gFIywAx.exe
  2⤵
  PID:9292
- C:\Windows\System\uTCdwgv.exe
  C:\Windows\System\uTCdwgv.exe
  2⤵
  PID:9324
- C:\Windows\System\asXKBky.exe
  C:\Windows\System\asXKBky.exe
  2⤵
  PID:9364
- C:\Windows\System\pNwROCq.exe
  C:\Windows\System\pNwROCq.exe
  2⤵
  PID:9380
- C:\Windows\System\AiTFYkk.exe
  C:\Windows\System\AiTFYkk.exe
  2⤵
  PID:9396
- C:\Windows\System\SDWLLUI.exe
  C:\Windows\System\SDWLLUI.exe
  2⤵
  PID:9416
- C:\Windows\System\oWmaDht.exe
  C:\Windows\System\oWmaDht.exe
  2⤵
  PID:9432
- C:\Windows\System\jmyudCl.exe
  C:\Windows\System\jmyudCl.exe
  2⤵
  PID:9456
- C:\Windows\System\wTsDXxw.exe
  C:\Windows\System\wTsDXxw.exe
  2⤵
  PID:9472
- C:\Windows\System\cMvWjIv.exe
  C:\Windows\System\cMvWjIv.exe
  2⤵
  PID:9488
- C:\Windows\System\lgDooXT.exe
  C:\Windows\System\lgDooXT.exe
  2⤵
  PID:9504
- C:\Windows\System\eXUWvXS.exe
  C:\Windows\System\eXUWvXS.exe
  2⤵
  PID:9520
- C:\Windows\System\BpiOzSb.exe
  C:\Windows\System\BpiOzSb.exe
  2⤵
  PID:9536
- C:\Windows\System\LqmFOsq.exe
  C:\Windows\System\LqmFOsq.exe
  2⤵
  PID:9552
- C:\Windows\System\CnzacZM.exe
  C:\Windows\System\CnzacZM.exe
  2⤵
  PID:9568
- C:\Windows\System\ptvmLqx.exe
  C:\Windows\System\ptvmLqx.exe
  2⤵
  PID:9584
- C:\Windows\System\BiFMpyX.exe
  C:\Windows\System\BiFMpyX.exe
  2⤵
  PID:9600
- C:\Windows\System\RxbgEHp.exe
  C:\Windows\System\RxbgEHp.exe
  2⤵
  PID:9636
- C:\Windows\System\WClCGWN.exe
  C:\Windows\System\WClCGWN.exe
  2⤵
  PID:9652
- C:\Windows\System\oQbOfIX.exe
  C:\Windows\System\oQbOfIX.exe
  2⤵
  PID:9676
- C:\Windows\System\dOnsotX.exe
  C:\Windows\System\dOnsotX.exe
  2⤵
  PID:9692
- C:\Windows\System\opeAitQ.exe
  C:\Windows\System\opeAitQ.exe
  2⤵
  PID:9708
- C:\Windows\System\ucEIAwp.exe
  C:\Windows\System\ucEIAwp.exe
  2⤵
  PID:9724
- C:\Windows\System\SMHOtjl.exe
  C:\Windows\System\SMHOtjl.exe
  2⤵
  PID:9740
- C:\Windows\System\ycMIWqm.exe
  C:\Windows\System\ycMIWqm.exe
  2⤵
  PID:9760
- C:\Windows\System\lJouOxo.exe
  C:\Windows\System\lJouOxo.exe
  2⤵
  PID:9780
- C:\Windows\System\BOWkdSD.exe
  C:\Windows\System\BOWkdSD.exe
  2⤵
  PID:9796
- C:\Windows\System\uGCVdpc.exe
  C:\Windows\System\uGCVdpc.exe
  2⤵
  PID:9816
- C:\Windows\System\eVSECsx.exe
  C:\Windows\System\eVSECsx.exe
  2⤵
  PID:9840
- C:\Windows\System\FBiMDVH.exe
  C:\Windows\System\FBiMDVH.exe
  2⤵
  PID:9864
- C:\Windows\System\qEVfIyq.exe
  C:\Windows\System\qEVfIyq.exe
  2⤵
  PID:9880
- C:\Windows\System\CGCtYwY.exe
  C:\Windows\System\CGCtYwY.exe
  2⤵
  PID:9896
- C:\Windows\System\ccorUVk.exe
  C:\Windows\System\ccorUVk.exe
  2⤵
  PID:9912
- C:\Windows\System\JcKNeXg.exe
  C:\Windows\System\JcKNeXg.exe
  2⤵
  PID:9928
- C:\Windows\System\uuZHpDU.exe
  C:\Windows\System\uuZHpDU.exe
  2⤵
  PID:9944
- C:\Windows\System\ZLtBtxV.exe
  C:\Windows\System\ZLtBtxV.exe
  2⤵
  PID:9964
- C:\Windows\System\vwmYqAI.exe
  C:\Windows\System\vwmYqAI.exe
  2⤵
  PID:9980
- C:\Windows\System\NnqYNuP.exe
  C:\Windows\System\NnqYNuP.exe
  2⤵
  PID:9996
- C:\Windows\System\xWmoOCO.exe
  C:\Windows\System\xWmoOCO.exe
  2⤵
  PID:10012
- C:\Windows\System\RWNFClc.exe
  C:\Windows\System\RWNFClc.exe
  2⤵
  PID:10028
- C:\Windows\System\OjkMWbZ.exe
  C:\Windows\System\OjkMWbZ.exe
  2⤵
  PID:10044
- C:\Windows\System\QitAwCL.exe
  C:\Windows\System\QitAwCL.exe
  2⤵
  PID:10064
- C:\Windows\System\zgbPSTc.exe
  C:\Windows\System\zgbPSTc.exe
  2⤵
  PID:10080
- C:\Windows\System\LHxqRwz.exe
  C:\Windows\System\LHxqRwz.exe
  2⤵
  PID:10096
- C:\Windows\System\lguxBJY.exe
  C:\Windows\System\lguxBJY.exe
  2⤵
  PID:10112
- C:\Windows\System\hNHMIlz.exe
  C:\Windows\System\hNHMIlz.exe
  2⤵
  PID:10128
- C:\Windows\System\sqdMsWV.exe
  C:\Windows\System\sqdMsWV.exe
  2⤵
  PID:10152
- C:\Windows\System\xmguBOL.exe
  C:\Windows\System\xmguBOL.exe
  2⤵
  PID:10168
- C:\Windows\System\zFUgRMS.exe
  C:\Windows\System\zFUgRMS.exe
  2⤵
  PID:10208
- C:\Windows\System\VsTKVYu.exe
  C:\Windows\System\VsTKVYu.exe
  2⤵
  PID:10224
- C:\Windows\System\wLYrneh.exe
  C:\Windows\System\wLYrneh.exe
  2⤵
  PID:8428
- C:\Windows\System\QAeXODi.exe
  C:\Windows\System\QAeXODi.exe
  2⤵
  PID:7384
- C:\Windows\System\YrOuZMh.exe
  C:\Windows\System\YrOuZMh.exe
  2⤵
  PID:9232
- C:\Windows\System\vzYhrbg.exe
  C:\Windows\System\vzYhrbg.exe
  2⤵
  PID:9272
- C:\Windows\System\jjpIFVw.exe
  C:\Windows\System\jjpIFVw.exe
  2⤵
  PID:9316
- C:\Windows\System\gNwdHZH.exe
  C:\Windows\System\gNwdHZH.exe
  2⤵
  PID:9212
- C:\Windows\System\juHHSTk.exe
  C:\Windows\System\juHHSTk.exe
  2⤵
  PID:8952
- C:\Windows\System\izikuYX.exe
  C:\Windows\System\izikuYX.exe
  2⤵
  PID:8860
- C:\Windows\System\lPHwzAh.exe
  C:\Windows\System\lPHwzAh.exe
  2⤵
  PID:8948
- C:\Windows\System\PRwuhDm.exe
  C:\Windows\System\PRwuhDm.exe
  2⤵
  PID:9332
- C:\Windows\System\swPWqAr.exe
  C:\Windows\System\swPWqAr.exe
  2⤵
  PID:9372
- C:\Windows\System\SvHgGCI.exe
  C:\Windows\System\SvHgGCI.exe
  2⤵
  PID:9480
- C:\Windows\System\xKRSoXt.exe
  C:\Windows\System\xKRSoXt.exe
  2⤵
  PID:9452
- C:\Windows\System\DEDlJla.exe
  C:\Windows\System\DEDlJla.exe
  2⤵
  PID:9608
- C:\Windows\System\CJzOxdM.exe
  C:\Windows\System\CJzOxdM.exe
  2⤵
  PID:9448
- C:\Windows\System\TuzxTcW.exe
  C:\Windows\System\TuzxTcW.exe
  2⤵
  PID:9628
- C:\Windows\System\CukbuzR.exe
  C:\Windows\System\CukbuzR.exe
  2⤵
  PID:9672
- C:\Windows\System\hUASSqt.exe
  C:\Windows\System\hUASSqt.exe
  2⤵
  PID:9704
- C:\Windows\System\QJAqnkn.exe
  C:\Windows\System\QJAqnkn.exe
  2⤵
  PID:9772
- C:\Windows\System\aBuKNom.exe
  C:\Windows\System\aBuKNom.exe
  2⤵
  PID:9812
- C:\Windows\System\yErFAYA.exe
  C:\Windows\System\yErFAYA.exe
  2⤵
  PID:9860
- C:\Windows\System\tuYEmfp.exe
  C:\Windows\System\tuYEmfp.exe
  2⤵
  PID:9920
- C:\Windows\System\wAQMRlM.exe
  C:\Windows\System\wAQMRlM.exe
  2⤵
  PID:9960
- C:\Windows\System\bVxnJvw.exe
  C:\Windows\System\bVxnJvw.exe
  2⤵
  PID:10024
- C:\Windows\System\AFfLEWu.exe
  C:\Windows\System\AFfLEWu.exe
  2⤵
  PID:10056
- C:\Windows\System\zgHVGxp.exe
  C:\Windows\System\zgHVGxp.exe
  2⤵
  PID:10092
- C:\Windows\System\oLqQXmi.exe
  C:\Windows\System\oLqQXmi.exe
  2⤵
  PID:10164
- C:\Windows\System\yqMhOvF.exe
  C:\Windows\System\yqMhOvF.exe
  2⤵
  PID:9464
- C:\Windows\System\TDKLfXJ.exe
  C:\Windows\System\TDKLfXJ.exe
  2⤵
  PID:9528
- C:\Windows\System\nvcpZrl.exe
  C:\Windows\System\nvcpZrl.exe
  2⤵
  PID:9592
- C:\Windows\System\WUwXegX.exe
  C:\Windows\System\WUwXegX.exe
  2⤵
  PID:9936
- C:\Windows\System\OZkHjGx.exe
  C:\Windows\System\OZkHjGx.exe
  2⤵
  PID:9720
- C:\Windows\System\ZpvgAkF.exe
  C:\Windows\System\ZpvgAkF.exe
  2⤵
  PID:9756
- C:\Windows\System\XqgZrZW.exe
  C:\Windows\System\XqgZrZW.exe
  2⤵
  PID:9828
- C:\Windows\System\LdgyuHS.exe
  C:\Windows\System\LdgyuHS.exe
  2⤵
  PID:9876
- C:\Windows\System\eRDdkae.exe
  C:\Windows\System\eRDdkae.exe
  2⤵
  PID:9972
- C:\Windows\System\GzclXqR.exe
  C:\Windows\System\GzclXqR.exe
  2⤵
  PID:10036
- C:\Windows\System\uXgrHPk.exe
  C:\Windows\System\uXgrHPk.exe
  2⤵
  PID:10204
- C:\Windows\System\yRdiwMQ.exe
  C:\Windows\System\yRdiwMQ.exe
  2⤵
  PID:10136
- C:\Windows\System\MYUeVAS.exe
  C:\Windows\System\MYUeVAS.exe
  2⤵
  PID:10200
- C:\Windows\System\CGqHQrq.exe
  C:\Windows\System\CGqHQrq.exe
  2⤵
  PID:8824
- C:\Windows\System\ukUlKbK.exe
  C:\Windows\System\ukUlKbK.exe
  2⤵
  PID:10236
- C:\Windows\System\UgjHukk.exe
  C:\Windows\System\UgjHukk.exe
  2⤵
  PID:8980
- C:\Windows\System\YJuAjeM.exe
  C:\Windows\System\YJuAjeM.exe
  2⤵
  PID:9304
- C:\Windows\System\hcGlMfO.exe
  C:\Windows\System\hcGlMfO.exe
  2⤵
  PID:6324
- C:\Windows\System\YzCWDOC.exe
  C:\Windows\System\YzCWDOC.exe
  2⤵
  PID:9284
- C:\Windows\System\ObaviqL.exe
  C:\Windows\System\ObaviqL.exe
  2⤵
  PID:8956
- C:\Windows\System\szzmfTg.exe
  C:\Windows\System\szzmfTg.exe
  2⤵
  PID:9412
- C:\Windows\System\bUtFVng.exe
  C:\Windows\System\bUtFVng.exe
  2⤵
  PID:9580
- C:\Windows\System\ZVHCvQj.exe
  C:\Windows\System\ZVHCvQj.exe
  2⤵
  PID:9620
- C:\Windows\System\qllPifZ.exe
  C:\Windows\System\qllPifZ.exe
  2⤵
  PID:9664
- C:\Windows\System\IUJOluE.exe
  C:\Windows\System\IUJOluE.exe
  2⤵
  PID:9808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AHnZJwN.exe

Filesize
1.3MB

MD5
bdb5481614d89cad27fad18ea296337e

SHA1
cdce1ebf1438554f48d0d96b49b5133083a97054

SHA256
870972a0157b1caaa7e3136db5e11781d05a01b69dc0b44bb8b4f6b816e8fd86

SHA512
c79df4df94651b56d5502cdc47d3b6601bd94cae1098fbcebf5c042ee414fae9c56dcaf0049ed00dc5d55b0a65cdafb5553661f71a24af95c3592149798410a2

Download Submit
C:\Windows\system\CrvpKAO.exe

Filesize
1.3MB

MD5
a8dae1d3ad195fa4db8d45eac09f4cec

SHA1
25480fe775bfe56b1a482ed54c90495b3f239d99

SHA256
b944ba79bd5b94c81f0cab2b6e5f2344f55f49ce8273e98a5ade8bec0a182307

SHA512
fafa247e31f31c165a99dc4c8f08658771ce788b9df9767401d2f3bd221a1515cbce089a83a6f7afb504e3af99dbe1dc33f26d668747b7c53de9e306aba9972a

Download Submit
C:\Windows\system\EufdMCG.exe

Filesize
1.3MB

MD5
198ab54c1de5ce90dea6d5d35ffac8e4

SHA1
045bfdd376618463e6f5325375e23a9708f5c081

SHA256
244a061ad8bf5504bf004f930eeef19c43355b3d9645a361497bdf45bed1a377

SHA512
412b0b39444fdffec826e5fb41faa94b062d996a61ce5908d0d2d680bfe3f27557aaf57fac4ecfdaa25b51216199a94799ae796b508063bd7a8e0f67d13d8fe6

Download Submit
C:\Windows\system\KNFvcza.exe

Filesize
1.3MB

MD5
fe4404232964bd6d911bfb320d9ac2f2

SHA1
8f9ba8e78fa11c61af9a3aa3fc983b0465e79743

SHA256
55e5f726983eef80af9ff410c515bd7aa6aeab58b586d41d3036c81f39f2ff8f

SHA512
0d949a591b882dbd3da392c452a3fc28570dfef1831028401dfc48ff33d1181be13502f0212661bfaaf74c35ff73ab6cb2294b3399ba9ef3da70fca41fd1c0e8

Download Submit
C:\Windows\system\LlIQvMg.exe

Filesize
1.3MB

MD5
f534352445ba6b01b5792af354c1d3c4

SHA1
15746c3c2a9553bbf98a9c8c9597c7d41a926a91

SHA256
59cb5f93ac333a0afc1a085a32d7071b0a0f0a30ad620f3afec079ca5b6f3c65

SHA512
c0dc523543ef34e566eca3e28c50acd808fcd8ddaa94cfceae082bd132273565a919baac54f4aa4a2741bcca93cfbac8627d6cb7c62bb1a97fce4f48d2608aa8

Download Submit
C:\Windows\system\LxyQktM.exe

Filesize
1.3MB

MD5
a3c129c2d5a92e482b332e0d679eff75

SHA1
00bfd030efa9f18c9e5efb880a3ba00f4b9355b1

SHA256
c8de2311e3f339564a2b6e09b5fd3cf09862f9a24a3de9a618a4426da9b3b417

SHA512
dbf33bd9f7b9d7ea75e06b0b4af2925b1efd59caf3ce134e641b17dedd3553e731705c451b65537f479a90897399acbe3743fe873f90c64a4ad2e0dc6b087041

Download Submit
C:\Windows\system\OPakbRg.exe

Filesize
8B

MD5
a257d1bcd374e9c692a56d2b09c4d4c6

SHA1
fd7b453a12a3fe0b69ae1fe337904eefb7879e55

SHA256
a25dc43282bd3510cc01378411d9a94015c933d193f8d16151e6e365a4531e86

SHA512
6e4d7bf7992dbf1e9f80227f3076417eef7082f38d550158a027b1b3541da2774d20a66cb5d80e0f31b6a2779220807ba93da1274669b0abe668efaf3713d948

Download Submit
C:\Windows\system\OSDTYsn.exe

Filesize
1.3MB

MD5
b94e1df44c0a9e3b64976de99ba64b74

SHA1
34fb23da4de6c868820b431dfaac1c9518268f07

SHA256
09babfa3d9cef4a6d6b29385d412c0182a3177188122686c5b6bf50a4181a972

SHA512
5dfc5bc6a622cca008900cf1fb75fd97318374ad67fde4eff73cde21246b5ef23c3322c4d5c4e14d5d0d3e01d47fd2d2f7603d6dd18aab82ce3c6eff17cd240e

Download Submit
C:\Windows\system\Qiqotnp.exe

Filesize
1.3MB

MD5
2ce401038ed40d8de32b8ceda4055f71

SHA1
54d0fd1e2662d89622cda14cc5306440103010fd

SHA256
644b27502bd491381e2d997a79bf867a6b060654c0aa56d56f0d4015d4bd04b8

SHA512
d7693c919d6d502c690544d66b30d7592dc08f10a94b67d589e4a2f5e2552001d916050473128414e09fc0ed3f9887d67b2b411c8a3f182528e7983a80121554

Download Submit
C:\Windows\system\UvyrzTu.exe

Filesize
1.3MB

MD5
642e90b0133740436be9364be0274f09

SHA1
94757a669f20fac48ad99dd5009169cd6a38f6fc

SHA256
84dd6a1e5db66a9ce1a68421c217b39c7c9aaadeb49ebf4052dca2add3396bfa

SHA512
1cc058f244af2bf2290cc3ddcc21fbf4421608444777fa7c00d50af0d38252d57ddf9fb736dc024f5a66d3e0e05fbba64bb94777e5ed9e1017d580fb860e4284

Download Submit
C:\Windows\system\YHkuKQi.exe

Filesize
1.3MB

MD5
2ed0e791b218207fb254cb050346c452

SHA1
19372e629b2c6db609e11e767ffa241e85c8ad16

SHA256
8344f93d8876155f7ec6edb6b95baacd4baef35df46ac2c671ed16bf56d27cc3

SHA512
83b8a8efc71860b517cebfe86a9cc23efa6551ef2429ff2ae170bf05dd87d9d9282a673d68e2fe983e9cca867761838afdd8e7f9df820c83b8852ce59167a816

Download Submit
C:\Windows\system\ZSBhkEe.exe

Filesize
1.3MB

MD5
b6eba54ebb38db6a26765b43d3b7af8d

SHA1
614dbb22f76c55fbd9f85b8a29bd5f7eade724c9

SHA256
93564cef1a5a8d043a12dd92fc84fd825e8ada8af80bc3c2868fae65f1c8b7b5

SHA512
d5a8617a4ccb7fba4bc1ace4495e2f0cea46fca4ebbc4f9365b570a72d3685576968fdd835d9c1956299adbfdd22c6c0b48f77ad2463ae0def3140c4e80116bc

Download Submit
C:\Windows\system\ZiXSGhg.exe

Filesize
1.3MB

MD5
d581d10e18140f01b1916cadc1a64bd6

SHA1
6bf8168f0bb396570694825a6a8047c78b12e079

SHA256
d1a87120eeaa42a1c200f20cd44779c81110d4fcd6bd0fd1e7add83c0b0067d9

SHA512
2ace16fbffd0bcaa505db1359f502156f5b33b6a8656ef962eba70f1b35e0b107cdbed96cde93fde79384ec26cff35eb5b289d5528041ce37100ec9833d7c52e

Download Submit
C:\Windows\system\ZxlwUxu.exe

Filesize
1.3MB

MD5
7613c3ace1e613947f2bd63354363e8e

SHA1
82ad9bbc06bda45a44a06514780423e0609198d7

SHA256
4bb44aee42ac1a435d612fe2b10757f0924631114e17e8e76d2398b564b857b1

SHA512
4f825f530f2fbec6e171e19f6dc445cad9dbfb18b21447e79676362b12c65f620047cfe5047b1000f4caeb16c9f3721b82b677d55ee96db51972adb582d7a9cc

Download Submit
C:\Windows\system\bONAUhS.exe

Filesize
1.3MB

MD5
4d87c400ee14ac5da372bbec378eb872

SHA1
60a435d3f29334dfe714d4ceb0be017fba573fc8

SHA256
7f83bb38ca98ed0954a17c1639d3ac9a9987f2eb762d9e5f93dcd090c7f849ed

SHA512
de1de368373b9e5efe8a421a8c54b8ff7685e5224ef636f6e353c7a37f1a26033ca0b8b4260d2cc7faa9fa82e003f637bc625b8e4950b5a57f11c889825d5d2f

Download Submit
C:\Windows\system\gOAWtOa.exe

Filesize
1.3MB

MD5
831627e75a3bda19d641fd782d4f2224

SHA1
f73399ec75f45344e01cc180d27be1f20a99f511

SHA256
d530a37cdb219b3463ff69b5640e4d748fdc91d6d068143fb7a8d84a60f5f9ca

SHA512
f35e75915eb558e3aa7ea76ccb96abec83a29abae2f499f637aec5e074931261dc939e9bd3861e07ad4fc8d9b8931ebd39a02baeed4586b803fec22dd2e024a6

Download Submit
C:\Windows\system\jFlwVsg.exe

Filesize
1.3MB

MD5
67d2d27b22796fbb7f74c9b2e1054765

SHA1
c1b82517cd0b416d5266817d59e60aba5bc12bda

SHA256
45d77deea8b061346678a523bb6f578279d5c89a6a0d2c6271d4edbc7d9935dc

SHA512
259a133a502d5e9eec60bb980f8ccee52f9a05014909c104a89531935a65a3517455e248c71d9d1d715c423232cebf09e02b52e985cec44e0e5fd4ff8c1f2102

Download Submit
C:\Windows\system\jRTodFw.exe

Filesize
1.3MB

MD5
dd6a6f03220e5931acabdd5d49bfe67c

SHA1
eb4e7fc271d4c62fff4d46c9d807f030f405e428

SHA256
6df0fcd809bd41905be54b1ce4e1c0ab08505ed01873ee3bfceb397248001ba2

SHA512
20436804afcc76982b6ccbb853a56b61204b5c9c68c39d6b4f4a842dc06101374c6f4d04960a9412cb8e27d344d5a1196175591651f42ed0cefd0a3c940efabe

Download Submit
C:\Windows\system\jpHdXQJ.exe

Filesize
1.3MB

MD5
6b03b110f8df55be8e2907fdf85b99aa

SHA1
9c554d6f5b4e982906bf5648333907a5940b1c71

SHA256
ae5f5182f5745ea5417191ddc8e00005121d0487845b3d2dc78773439da3efae

SHA512
00c415935b602b6f5f2361d5798b2b366c929eaeb44972c4fd237fa1f774229cac74fdc8ae61ba1453539f7c3a4baa0cfe084cc857ea59f1c70bd2bbcdab92f4

Download Submit
C:\Windows\system\kDinUvN.exe

Filesize
1.3MB

MD5
77c4a51d698e9f6b388849209e95c9c0

SHA1
e88ac1f3f11bff92a95e7301adc96ae98d60866d

SHA256
9d35336897c8e73698fb024bfd198a896ff31d01120512c45697fb832d95c82f

SHA512
9b80179e47ed5b54790b04e5d4523c97a0bde6673313f02fa1e74e22153c6e0839f35e3803f0365a6e3ba075572a09aaae83283ada730d306020bc3bdb04eea7

Download Submit
C:\Windows\system\ltycYQi.exe

Filesize
1.3MB

MD5
cdee3c426bb32a073a96e398361daa38

SHA1
63749a68e635def24a8a0efbc4a53086b4afbddd

SHA256
e90230fac6b83e9b8c743a0e622f6f766a97b15e69590af7029bc27ff9ba3729

SHA512
2868e513ac4ab7882f4f9d38a2de98cec8ba94658c89a02303517285ed31856bd56caeb45da96239489a70cecec0914e04d063b8dcd512029527a936a1e28c9a

Download Submit
C:\Windows\system\uGWHXQh.exe

Filesize
1.3MB

MD5
505fe6c4886f654e0189fed8b168fdc0

SHA1
7c6b4634e7445912696b5daf3e054eaf0278a6bf

SHA256
61a583e010e7d1886ef5928aa891eef6c4792027072d903a27945b57aa780bab

SHA512
a8d25329445e672783456f30a3405c17c5e6717c64223890921cbf88320d939b45c20ac6228d579fe5d39955baf9391b49c18342af661f5dc53c1380fc264e11

Download Submit
C:\Windows\system\usiAtzX.exe

Filesize
1.3MB

MD5
37d61d4e651fe55166d28f1c0c6f0226

SHA1
e47cf72ddfbad5a8042add1a89aac2e663bee51a

SHA256
cd84a7235d8baa71a6b9ebc34a58192d32538a6f4028ca4143f061cd3318d9b2

SHA512
22979e1bba12be4b853d54375d177eb3d943423d2702a1d28e899cc3f996c59e06482bff64a0b7bdb7165e820e6d30a109304e3a34d30da007fd1abb942fde8b

Download Submit
C:\Windows\system\wZapFaQ.exe

Filesize
1.3MB

MD5
8d1f275f95d5faa463d820b2579a4c22

SHA1
65339186147a6d352d17510b0d76616a95952260

SHA256
602073da3c5554f0b98d6b248b41ebdf39858c277ddc711bdc6d4099d94cc57b

SHA512
f6d9e9bc498a0777464e392e2e766aae9b4dc8a2dd79a4e109c3eb7b42099f75b5f63b5018ff1dbc7f396c64e9302fe769d2086a3b855b0c23a10da5564ff05c

Download Submit
C:\Windows\system\xRaLRxr.exe

Filesize
1.3MB

MD5
ed07d48da053ae1defd51a05a56b9b2c

SHA1
7da74a8ec6922e2f01efd752ac6278738dfcf714

SHA256
7beb485b01dc5f2e22170db7ead995b9e8112bf1d2d7dab04f6647b316ee3fa9

SHA512
3d804a298a37911b55a759c10aa5bb6d0abe3c909eae870aa455016f5bed95b4a7bcd798d86b0b52ac6c0918a25b8533273a57f8486f20b3cf76602527e6fbb2

Download Submit
C:\Windows\system\zUqEpcB.exe

Filesize
1.3MB

MD5
6f6dadf5067211960adf54863869fff0

SHA1
363b0da8608878ef45b7282cbcff3bb1aea50f84

SHA256
de136b75570fdd8ec246a0245f41d4344320e844168e565116f729178da5331f

SHA512
7110a645a2673e4f2e3ebd9597c42bf6f90eff0579063722cc88c4b35876a4096c69538060941f2f180eb49ddb0073a87c1b796fcff5b5fd159bfa9f8bc28f41

Download Submit
\Windows\system\FrwTbZg.exe

Filesize
1.3MB

MD5
bdf70d572f3e9978e2e7eb41ec8521b5

SHA1
5544953951f0bdad646fdc6a23fc2de6d4deaa04

SHA256
5b7846f94743b255585a77ef167320316b7de70bc639cd0fc5dc73559bf86a3e

SHA512
c2ca3edb9fed3b0bbfade79e3a203f7b21d71faceea908fe4ae973ebb2e241ff502bfbd064fd9cd1c867be95a64c5356a591b2a83dd2169a81ecf87a939917ee

Download Submit
\Windows\system\IzVyTyR.exe

Filesize
1.3MB

MD5
3863489c42cc6a152c5435ca1e009f92

SHA1
edaaa4b627385b07f67e1459f0717779098c2710

SHA256
a6f5c14da0d881893f95300ac69b4e90cc4d75431c6ba89811d03b0f56d59b48

SHA512
33b7827204d4d8ec38b54900affd9b00fc5df9a6347882abc2ca83657c06bd226df89c9c35eb6050d6fcaefd1e871f1d8e15a4eab34876f9c893469431180dc8

Download Submit
\Windows\system\RhApCkB.exe

Filesize
1.3MB

MD5
d5af5c03d854eabdeb95c34e54f66638

SHA1
234ac286950ac2db30fbd9e01ac42eba1c94169c

SHA256
59562c8d3418982b0927e594ee99a42fe8a4f76be43ffc7a5874f01e0187ef3a

SHA512
92d2a2440f914e2cf0349051055827363eb89f30d3029d3cb2f51ea77c13ed5e2a6bb9b79b2aa813c82325dccf2125d21fb639e45c3dd929a719939420d47704

Download Submit
\Windows\system\lfUgiUd.exe

Filesize
1.3MB

MD5
25e87e76af39cfe9e2965516f4a49d95

SHA1
f1251219ac28e133855065ac0fdb35a2b17db79e

SHA256
c9aa4efbf7fedafb542d0269eb51db561fac8b75825f0496e9b016f2bf74bc6e

SHA512
261126633a6c6992bb2b09d89a7b788bb627b9f2d29ee006bbd0072e2ed2d4201c9b3c8954bca8d8dc7f1ff26ea57522598fb88d5ea102abb3f74744e0fdc291

Download Submit
\Windows\system\uoneKub.exe

Filesize
1.3MB

MD5
bdea5ad98965efdc9d6723ba1244b39d

SHA1
47b36ddc24f3d9e542ecd4b9fb2f7fe7b35dc72b

SHA256
14e3723f00120e912abf2e3deb474da9a35a9eb70d1f49ce8731b876a15500df

SHA512
970c5d5536b136103eb0085356ddb2536cd5154d66e8b5074e107bfb6215cefa34b57f690ecbdb71197db7cdd0832c750c375ecfd431d4256d25e7a5bd26bffa

Download Submit
\Windows\system\yuGiqHh.exe

Filesize
1.3MB

MD5
25d44d9df3b1f03c7d7774ceae1d4551

SHA1
e9dd89957cfdbb11e53cd4bb307fd32fc03145fd

SHA256
16f9b2a15359d9a8c0a806b620551d460465bbb44a285857cdfc8ba076b75297

SHA512
147db1b05227f218c423c31d81264a6c3366206a1b4bc2a7437670aed5d2f37e78cf887f4ade92ed7c468e7b4dc67f2ce89e3481ae178d135af3650738b90e1d

Download Submit
\Windows\system\zPSjYIp.exe

Filesize
1.3MB

MD5
31e3d6c0fdd83edd14275dc9ac7f384b

SHA1
061a273247c47869d258a973bf2ee0fb88d2e84b

SHA256
1d8f896ce7f565e7d13934bdbc148c7f3479910f63656a30f8ab490c168ec72c

SHA512
bb1ee309cc78cabb0c4d7378efa53775b718a5df9b3571d6a4f3f5b1d942b1c19529f607ac0a6ef42d514e6cac25fa44155f22e4c09d9daa905cf80557a38cce

Download Submit
memory/1376-109-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/2096-106-0x000000013FB10000-0x000000013FF02000-memory.dmp

Filesize
3.9MB

Download
memory/2096-4658-0x000000013FB10000-0x000000013FF02000-memory.dmp

Filesize
3.9MB

Download
memory/2216-52-0x000000013F830000-0x000000013FC22000-memory.dmp

Filesize
3.9MB

Download
memory/2216-4442-0x000000013F830000-0x000000013FC22000-memory.dmp

Filesize
3.9MB

Download
memory/2268-21-0x000000001B730000-0x000000001BA12000-memory.dmp

Filesize
2.9MB

Download
memory/2268-51-0x000007FEF52B0000-0x000007FEF5C4D000-memory.dmp

Filesize
9.6MB

Download
memory/2268-44-0x00000000027E0000-0x00000000027E8000-memory.dmp

Filesize
32KB

Download
memory/2268-156-0x000007FEF52B0000-0x000007FEF5C4D000-memory.dmp

Filesize
9.6MB

Download
memory/2268-42-0x000007FEF52B0000-0x000007FEF5C4D000-memory.dmp

Filesize
9.6MB

Download
memory/2268-15-0x000007FEF556E000-0x000007FEF556F000-memory.dmp

Filesize
4KB

Download
memory/2268-14-0x0000000002D10000-0x0000000002D90000-memory.dmp

Filesize
512KB

Download
memory/2268-61-0x000007FEF52B0000-0x000007FEF5C4D000-memory.dmp

Filesize
9.6MB

Download
memory/2520-4437-0x000000013F0D0000-0x000000013F4C2000-memory.dmp

Filesize
3.9MB

Download
memory/2520-56-0x000000013F0D0000-0x000000013F4C2000-memory.dmp

Filesize
3.9MB

Download
memory/2572-54-0x000000013F550000-0x000000013F942000-memory.dmp

Filesize
3.9MB

Download
memory/2572-4661-0x000000013F550000-0x000000013F942000-memory.dmp

Filesize
3.9MB

Download
memory/2588-58-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2588-4669-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2644-4411-0x000000013FAC0000-0x000000013FEB2000-memory.dmp

Filesize
3.9MB

Download
memory/2644-60-0x000000013FAC0000-0x000000013FEB2000-memory.dmp

Filesize
3.9MB

Download
memory/2788-4397-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/2788-13-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/2792-43-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/2868-4716-0x000000013F350000-0x000000013F742000-memory.dmp

Filesize
3.9MB

Download
memory/2868-117-0x000000013F350000-0x000000013F742000-memory.dmp

Filesize
3.9MB

Download
memory/2924-12-0x0000000003010000-0x0000000003402000-memory.dmp

Filesize
3.9MB

Download
memory/2924-59-0x0000000003520000-0x0000000003912000-memory.dmp

Filesize
3.9MB

Download
memory/2924-103-0x0000000003520000-0x0000000003912000-memory.dmp

Filesize
3.9MB

Download
memory/2924-55-0x000000013F0D0000-0x000000013F4C2000-memory.dmp

Filesize
3.9MB

Download
memory/2924-0-0x000000013FBB0000-0x000000013FFA2000-memory.dmp

Filesize
3.9MB

Download
memory/2924-53-0x000000013F550000-0x000000013F942000-memory.dmp

Filesize
3.9MB

Download
memory/2924-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2924-115-0x000000013F350000-0x000000013F742000-memory.dmp

Filesize
3.9MB

Download
memory/2924-105-0x0000000003520000-0x0000000003912000-memory.dmp

Filesize
3.9MB

Download
memory/2924-57-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2924-107-0x000000013F480000-0x000000013F872000-memory.dmp

Filesize
3.9MB

Download
memory/2924-48-0x0000000003520000-0x0000000003912000-memory.dmp

Filesize
3.9MB

Download
memory/2924-108-0x0000000003520000-0x0000000003912000-memory.dmp

Filesize
3.9MB

Download
memory/2924-114-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/2924-62-0x0000000003010000-0x0000000003402000-memory.dmp

Filesize
3.9MB

Download
memory/2928-4664-0x000000013FA60000-0x000000013FE52000-memory.dmp

Filesize
3.9MB

Download
memory/2928-104-0x000000013FA60000-0x000000013FE52000-memory.dmp

Filesize
3.9MB

Download