xmrig | faa37a5596f222ae5487b9c5bdf28dfedb0dafc27fee8b0c59afd95fffec8d6e

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/08/2024, 11:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9fc0e2cb5e799c7b85583f6000887640N.exe
Size

2.4MB
MD5

9fc0e2cb5e799c7b85583f6000887640
SHA1

3da5ea0b89b3de66ec978a5b7b155a94070ff036
SHA256

faa37a5596f222ae5487b9c5bdf28dfedb0dafc27fee8b0c59afd95fffec8d6e
SHA512

14f90b4a8eba6fef068aaeb6f0dda2d18c8ac32b9c002e1c47c5f96a0df4828f02212eda7650672ee32a0eb8e8f68300bca29e165b9c08de6c59f45c6dac32df
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafMzlG:NABA

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 19 IoCs

miner

resource	yara_rule
behavioral1/memory/1184-9-0x000000013FD60000-0x0000000140152000-memory.dmp	xmrig
behavioral1/memory/1328-81-0x000000013FF20000-0x0000000140312000-memory.dmp	xmrig
behavioral1/memory/2740-82-0x000000013F500000-0x000000013F8F2000-memory.dmp	xmrig
behavioral1/memory/2696-78-0x000000013FC00000-0x000000013FFF2000-memory.dmp	xmrig
behavioral1/memory/2544-77-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	xmrig
behavioral1/memory/2588-75-0x000000013F460000-0x000000013F852000-memory.dmp	xmrig
behavioral1/memory/2560-73-0x000000013FF70000-0x0000000140362000-memory.dmp	xmrig
behavioral1/memory/2620-62-0x000000013FD40000-0x0000000140132000-memory.dmp	xmrig
behavioral1/memory/2128-53-0x000000013FAD0000-0x000000013FEC2000-memory.dmp	xmrig
behavioral1/memory/2740-2732-0x000000013F500000-0x000000013F8F2000-memory.dmp	xmrig
behavioral1/memory/2620-3465-0x000000013FD40000-0x0000000140132000-memory.dmp	xmrig
behavioral1/memory/1184-3484-0x000000013FD60000-0x0000000140152000-memory.dmp	xmrig
behavioral1/memory/2588-4066-0x000000013F460000-0x000000013F852000-memory.dmp	xmrig
behavioral1/memory/1328-4100-0x000000013FF20000-0x0000000140312000-memory.dmp	xmrig
behavioral1/memory/2544-4099-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	xmrig
behavioral1/memory/2072-4098-0x000000013F900000-0x000000013FCF2000-memory.dmp	xmrig
behavioral1/memory/2128-4097-0x000000013FAD0000-0x000000013FEC2000-memory.dmp	xmrig
behavioral1/memory/2168-4096-0x000000013FF80000-0x0000000140372000-memory.dmp	xmrig
behavioral1/memory/2560-4095-0x000000013FF70000-0x0000000140362000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2476	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1184	DguWyHY.exe
2168	dfztLyX.exe
2740	pGeXCtq.exe
2128	ZSacqtl.exe
2620	MNHnQnD.exe
2560	nDKHIQB.exe
2588	PjCeFld.exe
2544	ZoylUZW.exe
2696	tvvqSXU.exe
1328	mlIjiyp.exe
2072	lRVxzEF.exe
2964	GkFuVPO.exe
856	BLIukDG.exe
1536	UXXKbzd.exe
1828	HuAUMuB.exe
1188	IMhLuiK.exe
1692	VchtpnF.exe
1288	gCiMdOf.exe
2864	NeGbQSD.exe
1724	kujFFOj.exe
1052	mKiJJKg.exe
2084	aWzIdGO.exe
2340	xWYNwPS.exe
1916	LCWubRo.exe
2104	hckEjYp.exe
2124	ilQQLYo.exe
2224	oHPYnFo.exe
1784	iawesAu.exe
2056	elFkVpm.exe
604	YOFqACn.exe
2436	eXKszrz.exe
1860	BPMfTNJ.exe
1360	kQhSsSx.exe
2356	QyGDZKV.exe
1780	YHzTaIC.exe
2004	lQQajNB.exe
2032	dtIFHWk.exe
2504	SQJUpIj.exe
944	EdgQexd.exe
112	fMhVGHi.exe
868	cSvVark.exe
1532	wYLuoVn.exe
1964	ibJoWzQ.exe
3024	JBlUuQY.exe
1832	JpNYTwG.exe
2288	AREwayq.exe
3012	XtNIBuG.exe
1232	eDmMnRy.exe
2492	YJGsNLS.exe
1612	tiCyLbQ.exe
1508	BqlynHS.exe
1752	WpriDHf.exe
1608	HKNhxcp.exe
2904	qrGbpbm.exe
2764	guCMgrF.exe
2784	PnoKJji.exe
2704	XgKmAhL.exe
2968	UKrxkTp.exe
1716	FqVtRjU.exe
2608	uEbxfzR.exe
2144	pjTdwdI.exe
852	fKXhOkr.exe
1748	AgzXEyA.exe
520	KNtoHur.exe

Loads dropped DLL 64 IoCs

pid	Process
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe
1996	9fc0e2cb5e799c7b85583f6000887640N.exe

UPX packed file 54 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1996-0-0x000000013FE00000-0x00000001401F2000-memory.dmp	upx
behavioral1/files/0x005200000000f5ab-5.dat	upx
behavioral1/memory/1184-9-0x000000013FD60000-0x0000000140152000-memory.dmp	upx
behavioral1/files/0x0017000000018bbf-14.dat	upx
behavioral1/files/0x0007000000018d48-12.dat	upx
behavioral1/files/0x0006000000018eb8-28.dat	upx
behavioral1/files/0x001000000000558f-32.dat	upx
behavioral1/files/0x0020000000018b6e-42.dat	upx
behavioral1/files/0x0007000000018ee4-40.dat	upx
behavioral1/files/0x0009000000018f08-49.dat	upx
behavioral1/memory/2168-15-0x000000013FF80000-0x0000000140372000-memory.dmp	upx
behavioral1/files/0x0007000000018f98-58.dat	upx
behavioral1/files/0x0004000000019461-65.dat	upx
behavioral1/memory/1328-81-0x000000013FF20000-0x0000000140312000-memory.dmp	upx
behavioral1/memory/2740-82-0x000000013F500000-0x000000013F8F2000-memory.dmp	upx
behavioral1/files/0x00040000000194ec-79.dat	upx
behavioral1/memory/1996-87-0x000000013F900000-0x000000013FCF2000-memory.dmp	upx
behavioral1/memory/2696-78-0x000000013FC00000-0x000000013FFF2000-memory.dmp	upx
behavioral1/files/0x0004000000019485-98.dat	upx
behavioral1/files/0x000500000001966c-113.dat	upx
behavioral1/files/0x0005000000019f50-127.dat	upx
behavioral1/files/0x000500000001a1e8-137.dat	upx
behavioral1/files/0x000500000001a201-157.dat	upx
behavioral1/files/0x000500000001a288-187.dat	upx
behavioral1/files/0x000500000001a294-192.dat	upx
behavioral1/files/0x000500000001a272-182.dat	upx
behavioral1/files/0x000500000001a25c-168.dat	upx
behavioral1/files/0x000500000001a237-162.dat	upx
behavioral1/files/0x000500000001a270-176.dat	upx
behavioral1/files/0x000500000001a25a-166.dat	upx
behavioral1/files/0x000500000001a1fe-152.dat	upx
behavioral1/files/0x000500000001a1f1-147.dat	upx
behavioral1/files/0x000500000001a1ee-142.dat	upx
behavioral1/files/0x000500000001a056-132.dat	upx
behavioral1/files/0x00050000000196af-122.dat	upx
behavioral1/files/0x000500000001962f-120.dat	upx
behavioral1/files/0x0005000000019571-102.dat	upx
behavioral1/files/0x0005000000019575-107.dat	upx
behavioral1/files/0x0004000000019438-96.dat	upx
behavioral1/memory/2544-77-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	upx
behavioral1/memory/2588-75-0x000000013F460000-0x000000013F852000-memory.dmp	upx
behavioral1/memory/2560-73-0x000000013FF70000-0x0000000140362000-memory.dmp	upx
behavioral1/memory/2620-62-0x000000013FD40000-0x0000000140132000-memory.dmp	upx
behavioral1/memory/2128-53-0x000000013FAD0000-0x000000013FEC2000-memory.dmp	upx
behavioral1/memory/2740-2732-0x000000013F500000-0x000000013F8F2000-memory.dmp	upx
behavioral1/memory/2620-3465-0x000000013FD40000-0x0000000140132000-memory.dmp	upx
behavioral1/memory/1184-3484-0x000000013FD60000-0x0000000140152000-memory.dmp	upx
behavioral1/memory/2588-4066-0x000000013F460000-0x000000013F852000-memory.dmp	upx
behavioral1/memory/1328-4100-0x000000013FF20000-0x0000000140312000-memory.dmp	upx
behavioral1/memory/2544-4099-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	upx
behavioral1/memory/2072-4098-0x000000013F900000-0x000000013FCF2000-memory.dmp	upx
behavioral1/memory/2128-4097-0x000000013FAD0000-0x000000013FEC2000-memory.dmp	upx
behavioral1/memory/2168-4096-0x000000013FF80000-0x0000000140372000-memory.dmp	upx
behavioral1/memory/2560-4095-0x000000013FF70000-0x0000000140362000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\NzBcQlR.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\jhrWumy.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\LwyaWEQ.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\BQMSLxK.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\KvRCNEJ.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\yHoQOqQ.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\jzxDFUs.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\IOZiyyB.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\LwyeHpe.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\WWtqPGj.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\vjGuMVm.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\zRQzaUP.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\iZciRYs.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\wOebkew.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\CAMEYcC.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\WBYqSpz.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\ZPcNpcY.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\tULhdZk.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\KHGulEv.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\Bwxqhcx.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\KZNeLQy.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\OtjkshA.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\RuaGxCs.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\axDzOIO.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\fVXzvIQ.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\DTmsbmJ.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\qvoGShv.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\oNIkeum.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\PakSqGh.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\PdOhQca.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\IQQtOoq.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\XRDOGTY.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\OuWQmDx.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\vBhMJrd.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\dFCngWh.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\UQpFZYZ.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\NdGMuuD.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\nuPYApp.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\xjgSgXk.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\ilQQLYo.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\JpNYTwG.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\OhCqOcy.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\sKgRbWt.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\bShOKGN.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\bJwlUAb.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\LxOAMyj.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\jJWwvMb.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\UrIzTRY.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\LiXzHgJ.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\ZoylUZW.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\jJlsXao.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\IIEaGtI.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\znZUcbN.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\BSrSXUk.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\AXoRfdA.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\ZzkNAWA.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\GYnopep.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\WBONMRv.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\sHExtvU.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\SrpsKsL.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\VBzfsdn.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\aUsHdlb.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\dmBrxvb.exe	9fc0e2cb5e799c7b85583f6000887640N.exe
File created	C:\Windows\System\fLiHNeJ.exe	9fc0e2cb5e799c7b85583f6000887640N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2476	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1996	9fc0e2cb5e799c7b85583f6000887640N.exe
Token: SeLockMemoryPrivilege	1996	9fc0e2cb5e799c7b85583f6000887640N.exe
Token: SeDebugPrivilege	2476	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2476	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	30
PID 1996 wrote to memory of 2476	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	30
PID 1996 wrote to memory of 2476	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	30
PID 1996 wrote to memory of 1184	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	31
PID 1996 wrote to memory of 1184	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	31
PID 1996 wrote to memory of 1184	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	31
PID 1996 wrote to memory of 2168	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	32
PID 1996 wrote to memory of 2168	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	32
PID 1996 wrote to memory of 2168	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	32
PID 1996 wrote to memory of 2740	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	33
PID 1996 wrote to memory of 2740	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	33
PID 1996 wrote to memory of 2740	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	33
PID 1996 wrote to memory of 2128	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	34
PID 1996 wrote to memory of 2128	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	34
PID 1996 wrote to memory of 2128	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	34
PID 1996 wrote to memory of 2620	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	35
PID 1996 wrote to memory of 2620	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	35
PID 1996 wrote to memory of 2620	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	35
PID 1996 wrote to memory of 2560	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	36
PID 1996 wrote to memory of 2560	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	36
PID 1996 wrote to memory of 2560	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	36
PID 1996 wrote to memory of 2588	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	37
PID 1996 wrote to memory of 2588	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	37
PID 1996 wrote to memory of 2588	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	37
PID 1996 wrote to memory of 2544	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	38
PID 1996 wrote to memory of 2544	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	38
PID 1996 wrote to memory of 2544	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	38
PID 1996 wrote to memory of 2696	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	39
PID 1996 wrote to memory of 2696	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	39
PID 1996 wrote to memory of 2696	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	39
PID 1996 wrote to memory of 2964	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	40
PID 1996 wrote to memory of 2964	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	40
PID 1996 wrote to memory of 2964	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	40
PID 1996 wrote to memory of 1328	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	41
PID 1996 wrote to memory of 1328	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	41
PID 1996 wrote to memory of 1328	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	41
PID 1996 wrote to memory of 856	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	42
PID 1996 wrote to memory of 856	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	42
PID 1996 wrote to memory of 856	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	42
PID 1996 wrote to memory of 2072	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	43
PID 1996 wrote to memory of 2072	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	43
PID 1996 wrote to memory of 2072	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	43
PID 1996 wrote to memory of 1536	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	44
PID 1996 wrote to memory of 1536	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	44
PID 1996 wrote to memory of 1536	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	44
PID 1996 wrote to memory of 1828	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	45
PID 1996 wrote to memory of 1828	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	45
PID 1996 wrote to memory of 1828	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	45
PID 1996 wrote to memory of 1692	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	46
PID 1996 wrote to memory of 1692	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	46
PID 1996 wrote to memory of 1692	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	46
PID 1996 wrote to memory of 1188	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	47
PID 1996 wrote to memory of 1188	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	47
PID 1996 wrote to memory of 1188	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	47
PID 1996 wrote to memory of 1288	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	48
PID 1996 wrote to memory of 1288	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	48
PID 1996 wrote to memory of 1288	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	48
PID 1996 wrote to memory of 2864	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	49
PID 1996 wrote to memory of 2864	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	49
PID 1996 wrote to memory of 2864	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	49
PID 1996 wrote to memory of 1724	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	50
PID 1996 wrote to memory of 1724	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	50
PID 1996 wrote to memory of 1724	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	50
PID 1996 wrote to memory of 1052	1996	9fc0e2cb5e799c7b85583f6000887640N.exe	51

C:\Users\Admin\AppData\Local\Temp\9fc0e2cb5e799c7b85583f6000887640N.exe
"C:\Users\Admin\AppData\Local\Temp\9fc0e2cb5e799c7b85583f6000887640N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2476
- C:\Windows\System\DguWyHY.exe
  C:\Windows\System\DguWyHY.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\dfztLyX.exe
  C:\Windows\System\dfztLyX.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\pGeXCtq.exe
  C:\Windows\System\pGeXCtq.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\ZSacqtl.exe
  C:\Windows\System\ZSacqtl.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\MNHnQnD.exe
  C:\Windows\System\MNHnQnD.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\nDKHIQB.exe
  C:\Windows\System\nDKHIQB.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\PjCeFld.exe
  C:\Windows\System\PjCeFld.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\ZoylUZW.exe
  C:\Windows\System\ZoylUZW.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\tvvqSXU.exe
  C:\Windows\System\tvvqSXU.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\GkFuVPO.exe
  C:\Windows\System\GkFuVPO.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\mlIjiyp.exe
  C:\Windows\System\mlIjiyp.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\BLIukDG.exe
  C:\Windows\System\BLIukDG.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\lRVxzEF.exe
  C:\Windows\System\lRVxzEF.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\UXXKbzd.exe
  C:\Windows\System\UXXKbzd.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\HuAUMuB.exe
  C:\Windows\System\HuAUMuB.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\VchtpnF.exe
  C:\Windows\System\VchtpnF.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\IMhLuiK.exe
  C:\Windows\System\IMhLuiK.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\gCiMdOf.exe
  C:\Windows\System\gCiMdOf.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\NeGbQSD.exe
  C:\Windows\System\NeGbQSD.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\kujFFOj.exe
  C:\Windows\System\kujFFOj.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\mKiJJKg.exe
  C:\Windows\System\mKiJJKg.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\aWzIdGO.exe
  C:\Windows\System\aWzIdGO.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\xWYNwPS.exe
  C:\Windows\System\xWYNwPS.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\LCWubRo.exe
  C:\Windows\System\LCWubRo.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\hckEjYp.exe
  C:\Windows\System\hckEjYp.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\ilQQLYo.exe
  C:\Windows\System\ilQQLYo.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\oHPYnFo.exe
  C:\Windows\System\oHPYnFo.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\elFkVpm.exe
  C:\Windows\System\elFkVpm.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\iawesAu.exe
  C:\Windows\System\iawesAu.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\YOFqACn.exe
  C:\Windows\System\YOFqACn.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\eXKszrz.exe
  C:\Windows\System\eXKszrz.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\BPMfTNJ.exe
  C:\Windows\System\BPMfTNJ.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\kQhSsSx.exe
  C:\Windows\System\kQhSsSx.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\QyGDZKV.exe
  C:\Windows\System\QyGDZKV.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\YHzTaIC.exe
  C:\Windows\System\YHzTaIC.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\dtIFHWk.exe
  C:\Windows\System\dtIFHWk.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\lQQajNB.exe
  C:\Windows\System\lQQajNB.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\SQJUpIj.exe
  C:\Windows\System\SQJUpIj.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\EdgQexd.exe
  C:\Windows\System\EdgQexd.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\fMhVGHi.exe
  C:\Windows\System\fMhVGHi.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\cSvVark.exe
  C:\Windows\System\cSvVark.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\wYLuoVn.exe
  C:\Windows\System\wYLuoVn.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\ibJoWzQ.exe
  C:\Windows\System\ibJoWzQ.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\JBlUuQY.exe
  C:\Windows\System\JBlUuQY.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\JpNYTwG.exe
  C:\Windows\System\JpNYTwG.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\AREwayq.exe
  C:\Windows\System\AREwayq.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\XtNIBuG.exe
  C:\Windows\System\XtNIBuG.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\BqlynHS.exe
  C:\Windows\System\BqlynHS.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\eDmMnRy.exe
  C:\Windows\System\eDmMnRy.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\WpriDHf.exe
  C:\Windows\System\WpriDHf.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\YJGsNLS.exe
  C:\Windows\System\YJGsNLS.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\HKNhxcp.exe
  C:\Windows\System\HKNhxcp.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\tiCyLbQ.exe
  C:\Windows\System\tiCyLbQ.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\qrGbpbm.exe
  C:\Windows\System\qrGbpbm.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\guCMgrF.exe
  C:\Windows\System\guCMgrF.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\PnoKJji.exe
  C:\Windows\System\PnoKJji.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\XgKmAhL.exe
  C:\Windows\System\XgKmAhL.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\UKrxkTp.exe
  C:\Windows\System\UKrxkTp.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\FqVtRjU.exe
  C:\Windows\System\FqVtRjU.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\uEbxfzR.exe
  C:\Windows\System\uEbxfzR.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\pjTdwdI.exe
  C:\Windows\System\pjTdwdI.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\KWlYSsD.exe
  C:\Windows\System\KWlYSsD.exe
  2⤵
  PID:1296
- C:\Windows\System\fKXhOkr.exe
  C:\Windows\System\fKXhOkr.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\DUeaROg.exe
  C:\Windows\System\DUeaROg.exe
  2⤵
  PID:2812
- C:\Windows\System\AgzXEyA.exe
  C:\Windows\System\AgzXEyA.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\OSDubAQ.exe
  C:\Windows\System\OSDubAQ.exe
  2⤵
  PID:1564
- C:\Windows\System\KNtoHur.exe
  C:\Windows\System\KNtoHur.exe
  2⤵
  - Executes dropped EXE
  PID:520
- C:\Windows\System\wuWnGcl.exe
  C:\Windows\System\wuWnGcl.exe
  2⤵
  PID:1048
- C:\Windows\System\HfvJVUz.exe
  C:\Windows\System\HfvJVUz.exe
  2⤵
  PID:936
- C:\Windows\System\IacpZev.exe
  C:\Windows\System\IacpZev.exe
  2⤵
  PID:2364
- C:\Windows\System\rztygPO.exe
  C:\Windows\System\rztygPO.exe
  2⤵
  PID:2312
- C:\Windows\System\JpUEmMB.exe
  C:\Windows\System\JpUEmMB.exe
  2⤵
  PID:3020
- C:\Windows\System\yTviSiL.exe
  C:\Windows\System\yTviSiL.exe
  2⤵
  PID:2520
- C:\Windows\System\MzEhUum.exe
  C:\Windows\System\MzEhUum.exe
  2⤵
  PID:2412
- C:\Windows\System\EFyYxeb.exe
  C:\Windows\System\EFyYxeb.exe
  2⤵
  PID:2556
- C:\Windows\System\McMPNvE.exe
  C:\Windows\System\McMPNvE.exe
  2⤵
  PID:920
- C:\Windows\System\MXIUYnr.exe
  C:\Windows\System\MXIUYnr.exe
  2⤵
  PID:1852
- C:\Windows\System\AhFDBwB.exe
  C:\Windows\System\AhFDBwB.exe
  2⤵
  PID:2000
- C:\Windows\System\BfVfeLD.exe
  C:\Windows\System\BfVfeLD.exe
  2⤵
  PID:236
- C:\Windows\System\MINxjSp.exe
  C:\Windows\System\MINxjSp.exe
  2⤵
  PID:2320
- C:\Windows\System\NeWRQEd.exe
  C:\Windows\System\NeWRQEd.exe
  2⤵
  PID:940
- C:\Windows\System\YPtPWUV.exe
  C:\Windows\System\YPtPWUV.exe
  2⤵
  PID:324
- C:\Windows\System\Lunswof.exe
  C:\Windows\System\Lunswof.exe
  2⤵
  PID:3016
- C:\Windows\System\GyaJhxv.exe
  C:\Windows\System\GyaJhxv.exe
  2⤵
  PID:1672
- C:\Windows\System\rFhMaOt.exe
  C:\Windows\System\rFhMaOt.exe
  2⤵
  PID:3064
- C:\Windows\System\bnHMxPP.exe
  C:\Windows\System\bnHMxPP.exe
  2⤵
  PID:2656
- C:\Windows\System\jJlsXao.exe
  C:\Windows\System\jJlsXao.exe
  2⤵
  PID:2960
- C:\Windows\System\yxwcjPt.exe
  C:\Windows\System\yxwcjPt.exe
  2⤵
  PID:1096
- C:\Windows\System\fHvjPXB.exe
  C:\Windows\System\fHvjPXB.exe
  2⤵
  PID:2228
- C:\Windows\System\EAjPwMW.exe
  C:\Windows\System\EAjPwMW.exe
  2⤵
  PID:2916
- C:\Windows\System\NzBcQlR.exe
  C:\Windows\System\NzBcQlR.exe
  2⤵
  PID:2632
- C:\Windows\System\KCDMFZA.exe
  C:\Windows\System\KCDMFZA.exe
  2⤵
  PID:2584
- C:\Windows\System\snKHaOJ.exe
  C:\Windows\System\snKHaOJ.exe
  2⤵
  PID:2700
- C:\Windows\System\tzVldDU.exe
  C:\Windows\System\tzVldDU.exe
  2⤵
  PID:552
- C:\Windows\System\wWgcIWJ.exe
  C:\Windows\System\wWgcIWJ.exe
  2⤵
  PID:1448
- C:\Windows\System\OFmIKWu.exe
  C:\Windows\System\OFmIKWu.exe
  2⤵
  PID:2528
- C:\Windows\System\wTNUTUW.exe
  C:\Windows\System\wTNUTUW.exe
  2⤵
  PID:3056
- C:\Windows\System\xsmnGBc.exe
  C:\Windows\System\xsmnGBc.exe
  2⤵
  PID:2008
- C:\Windows\System\KGurkvY.exe
  C:\Windows\System\KGurkvY.exe
  2⤵
  PID:2872
- C:\Windows\System\vAcWHII.exe
  C:\Windows\System\vAcWHII.exe
  2⤵
  PID:892
- C:\Windows\System\qbTsWVJ.exe
  C:\Windows\System\qbTsWVJ.exe
  2⤵
  PID:1320
- C:\Windows\System\KSvXruN.exe
  C:\Windows\System\KSvXruN.exe
  2⤵
  PID:2240
- C:\Windows\System\pdBIjSh.exe
  C:\Windows\System\pdBIjSh.exe
  2⤵
  PID:2980
- C:\Windows\System\LVkKhKL.exe
  C:\Windows\System\LVkKhKL.exe
  2⤵
  PID:576
- C:\Windows\System\CrhMAsh.exe
  C:\Windows\System\CrhMAsh.exe
  2⤵
  PID:2216
- C:\Windows\System\QEJCRmq.exe
  C:\Windows\System\QEJCRmq.exe
  2⤵
  PID:2660
- C:\Windows\System\ithxzJS.exe
  C:\Windows\System\ithxzJS.exe
  2⤵
  PID:2760
- C:\Windows\System\BnKVwzd.exe
  C:\Windows\System\BnKVwzd.exe
  2⤵
  PID:1560
- C:\Windows\System\kbQGWTJ.exe
  C:\Windows\System\kbQGWTJ.exe
  2⤵
  PID:1736
- C:\Windows\System\VcvAWhw.exe
  C:\Windows\System\VcvAWhw.exe
  2⤵
  PID:2824
- C:\Windows\System\wdqAzvx.exe
  C:\Windows\System\wdqAzvx.exe
  2⤵
  PID:2860
- C:\Windows\System\OAXHsQp.exe
  C:\Windows\System\OAXHsQp.exe
  2⤵
  PID:668
- C:\Windows\System\GYnopep.exe
  C:\Windows\System\GYnopep.exe
  2⤵
  PID:1700
- C:\Windows\System\OeHUFFz.exe
  C:\Windows\System\OeHUFFz.exe
  2⤵
  PID:3088
- C:\Windows\System\CgXgBSg.exe
  C:\Windows\System\CgXgBSg.exe
  2⤵
  PID:3104
- C:\Windows\System\LxgCSry.exe
  C:\Windows\System\LxgCSry.exe
  2⤵
  PID:3120
- C:\Windows\System\wTHwLxs.exe
  C:\Windows\System\wTHwLxs.exe
  2⤵
  PID:3140
- C:\Windows\System\CntsNPg.exe
  C:\Windows\System\CntsNPg.exe
  2⤵
  PID:3156
- C:\Windows\System\OKBGdfq.exe
  C:\Windows\System\OKBGdfq.exe
  2⤵
  PID:3172
- C:\Windows\System\vKiqWZN.exe
  C:\Windows\System\vKiqWZN.exe
  2⤵
  PID:3188
- C:\Windows\System\eYukeqN.exe
  C:\Windows\System\eYukeqN.exe
  2⤵
  PID:3204
- C:\Windows\System\RLtsclv.exe
  C:\Windows\System\RLtsclv.exe
  2⤵
  PID:3220
- C:\Windows\System\NMFpFeF.exe
  C:\Windows\System\NMFpFeF.exe
  2⤵
  PID:3236
- C:\Windows\System\HaXMaVC.exe
  C:\Windows\System\HaXMaVC.exe
  2⤵
  PID:3256
- C:\Windows\System\PYFtAgd.exe
  C:\Windows\System\PYFtAgd.exe
  2⤵
  PID:3272
- C:\Windows\System\MoOfZbK.exe
  C:\Windows\System\MoOfZbK.exe
  2⤵
  PID:3288
- C:\Windows\System\FIdiLvp.exe
  C:\Windows\System\FIdiLvp.exe
  2⤵
  PID:3308
- C:\Windows\System\agmbfSo.exe
  C:\Windows\System\agmbfSo.exe
  2⤵
  PID:3324
- C:\Windows\System\vyPWnYd.exe
  C:\Windows\System\vyPWnYd.exe
  2⤵
  PID:3340
- C:\Windows\System\XEgEhcs.exe
  C:\Windows\System\XEgEhcs.exe
  2⤵
  PID:3356
- C:\Windows\System\DURuFJm.exe
  C:\Windows\System\DURuFJm.exe
  2⤵
  PID:3376
- C:\Windows\System\WnWuKXB.exe
  C:\Windows\System\WnWuKXB.exe
  2⤵
  PID:3556
- C:\Windows\System\qEwfzHy.exe
  C:\Windows\System\qEwfzHy.exe
  2⤵
  PID:3572
- C:\Windows\System\nnGGKYa.exe
  C:\Windows\System\nnGGKYa.exe
  2⤵
  PID:3588
- C:\Windows\System\pLjKnlQ.exe
  C:\Windows\System\pLjKnlQ.exe
  2⤵
  PID:3604
- C:\Windows\System\OJUnjcw.exe
  C:\Windows\System\OJUnjcw.exe
  2⤵
  PID:3620
- C:\Windows\System\lJXFtwD.exe
  C:\Windows\System\lJXFtwD.exe
  2⤵
  PID:3636
- C:\Windows\System\bhtAAGI.exe
  C:\Windows\System\bhtAAGI.exe
  2⤵
  PID:3652
- C:\Windows\System\muRZlvZ.exe
  C:\Windows\System\muRZlvZ.exe
  2⤵
  PID:3668
- C:\Windows\System\sHkyZTX.exe
  C:\Windows\System\sHkyZTX.exe
  2⤵
  PID:3684
- C:\Windows\System\btrtoHP.exe
  C:\Windows\System\btrtoHP.exe
  2⤵
  PID:3700
- C:\Windows\System\mFiqKJb.exe
  C:\Windows\System\mFiqKJb.exe
  2⤵
  PID:3716
- C:\Windows\System\heaTAHP.exe
  C:\Windows\System\heaTAHP.exe
  2⤵
  PID:3732
- C:\Windows\System\sExyXaP.exe
  C:\Windows\System\sExyXaP.exe
  2⤵
  PID:3788
- C:\Windows\System\BWjOOZq.exe
  C:\Windows\System\BWjOOZq.exe
  2⤵
  PID:3808
- C:\Windows\System\cgObGDD.exe
  C:\Windows\System\cgObGDD.exe
  2⤵
  PID:3828
- C:\Windows\System\ZOEPixz.exe
  C:\Windows\System\ZOEPixz.exe
  2⤵
  PID:3844
- C:\Windows\System\ujorutt.exe
  C:\Windows\System\ujorutt.exe
  2⤵
  PID:3860
- C:\Windows\System\sgBTRgN.exe
  C:\Windows\System\sgBTRgN.exe
  2⤵
  PID:3876
- C:\Windows\System\HudyxLh.exe
  C:\Windows\System\HudyxLh.exe
  2⤵
  PID:3892
- C:\Windows\System\OhCqOcy.exe
  C:\Windows\System\OhCqOcy.exe
  2⤵
  PID:3908
- C:\Windows\System\WEKmxyK.exe
  C:\Windows\System\WEKmxyK.exe
  2⤵
  PID:3924
- C:\Windows\System\UUtBfuC.exe
  C:\Windows\System\UUtBfuC.exe
  2⤵
  PID:3940
- C:\Windows\System\GqwabQL.exe
  C:\Windows\System\GqwabQL.exe
  2⤵
  PID:3956
- C:\Windows\System\EclILaS.exe
  C:\Windows\System\EclILaS.exe
  2⤵
  PID:3972
- C:\Windows\System\IIEaGtI.exe
  C:\Windows\System\IIEaGtI.exe
  2⤵
  PID:4016
- C:\Windows\System\OYJSDlz.exe
  C:\Windows\System\OYJSDlz.exe
  2⤵
  PID:4032
- C:\Windows\System\RmzHfXp.exe
  C:\Windows\System\RmzHfXp.exe
  2⤵
  PID:4052
- C:\Windows\System\RjiCBCc.exe
  C:\Windows\System\RjiCBCc.exe
  2⤵
  PID:4068
- C:\Windows\System\oHYjjAJ.exe
  C:\Windows\System\oHYjjAJ.exe
  2⤵
  PID:4084
- C:\Windows\System\OnkRxzr.exe
  C:\Windows\System\OnkRxzr.exe
  2⤵
  PID:992
- C:\Windows\System\uuEPtSx.exe
  C:\Windows\System\uuEPtSx.exe
  2⤵
  PID:2572
- C:\Windows\System\fIjvvSZ.exe
  C:\Windows\System\fIjvvSZ.exe
  2⤵
  PID:3084
- C:\Windows\System\kkbSXDl.exe
  C:\Windows\System\kkbSXDl.exe
  2⤵
  PID:2192
- C:\Windows\System\HOnCgHo.exe
  C:\Windows\System\HOnCgHo.exe
  2⤵
  PID:2268
- C:\Windows\System\EJwxknt.exe
  C:\Windows\System\EJwxknt.exe
  2⤵
  PID:3180
- C:\Windows\System\kmNLoqx.exe
  C:\Windows\System\kmNLoqx.exe
  2⤵
  PID:3244
- C:\Windows\System\YdMsrTg.exe
  C:\Windows\System\YdMsrTg.exe
  2⤵
  PID:3284
- C:\Windows\System\CpyHKoA.exe
  C:\Windows\System\CpyHKoA.exe
  2⤵
  PID:3348
- C:\Windows\System\QJoadCE.exe
  C:\Windows\System\QJoadCE.exe
  2⤵
  PID:3392
- C:\Windows\System\yTXKvZr.exe
  C:\Windows\System\yTXKvZr.exe
  2⤵
  PID:3408
- C:\Windows\System\zfvQLYD.exe
  C:\Windows\System\zfvQLYD.exe
  2⤵
  PID:3028
- C:\Windows\System\HJEhuQD.exe
  C:\Windows\System\HJEhuQD.exe
  2⤵
  PID:2292
- C:\Windows\System\AIVGmfA.exe
  C:\Windows\System\AIVGmfA.exe
  2⤵
  PID:3428
- C:\Windows\System\XyXeZnZ.exe
  C:\Windows\System\XyXeZnZ.exe
  2⤵
  PID:3440
- C:\Windows\System\EOKUgzT.exe
  C:\Windows\System\EOKUgzT.exe
  2⤵
  PID:2160
- C:\Windows\System\pLnOHcq.exe
  C:\Windows\System\pLnOHcq.exe
  2⤵
  PID:2236
- C:\Windows\System\mzsyZpa.exe
  C:\Windows\System\mzsyZpa.exe
  2⤵
  PID:3480
- C:\Windows\System\IMRMxYd.exe
  C:\Windows\System\IMRMxYd.exe
  2⤵
  PID:2684
- C:\Windows\System\WhuaHmI.exe
  C:\Windows\System\WhuaHmI.exe
  2⤵
  PID:2424
- C:\Windows\System\IkCEtWQ.exe
  C:\Windows\System\IkCEtWQ.exe
  2⤵
  PID:2116
- C:\Windows\System\lljAZjj.exe
  C:\Windows\System\lljAZjj.exe
  2⤵
  PID:2232
- C:\Windows\System\zzjPOvz.exe
  C:\Windows\System\zzjPOvz.exe
  2⤵
  PID:1776
- C:\Windows\System\ihZylKX.exe
  C:\Windows\System\ihZylKX.exe
  2⤵
  PID:1720
- C:\Windows\System\sRqJkaE.exe
  C:\Windows\System\sRqJkaE.exe
  2⤵
  PID:1376
- C:\Windows\System\xTtzKRY.exe
  C:\Windows\System\xTtzKRY.exe
  2⤵
  PID:3100
- C:\Windows\System\pqvWrKF.exe
  C:\Windows\System\pqvWrKF.exe
  2⤵
  PID:3168
- C:\Windows\System\LpOigTY.exe
  C:\Windows\System\LpOigTY.exe
  2⤵
  PID:3232
- C:\Windows\System\VgcmeYV.exe
  C:\Windows\System\VgcmeYV.exe
  2⤵
  PID:3496
- C:\Windows\System\hszUJJa.exe
  C:\Windows\System\hszUJJa.exe
  2⤵
  PID:3364
- C:\Windows\System\wESuoaJ.exe
  C:\Windows\System\wESuoaJ.exe
  2⤵
  PID:1544
- C:\Windows\System\eXbejMD.exe
  C:\Windows\System\eXbejMD.exe
  2⤵
  PID:3548
- C:\Windows\System\EddwWrn.exe
  C:\Windows\System\EddwWrn.exe
  2⤵
  PID:3612
- C:\Windows\System\QuOnFaz.exe
  C:\Windows\System\QuOnFaz.exe
  2⤵
  PID:3676
- C:\Windows\System\lKrtSWp.exe
  C:\Windows\System\lKrtSWp.exe
  2⤵
  PID:3764
- C:\Windows\System\dCNzCdW.exe
  C:\Windows\System\dCNzCdW.exe
  2⤵
  PID:3752
- C:\Windows\System\pETVEwh.exe
  C:\Windows\System\pETVEwh.exe
  2⤵
  PID:3780
- C:\Windows\System\Ilvtkxi.exe
  C:\Windows\System\Ilvtkxi.exe
  2⤵
  PID:3596
- C:\Windows\System\lqdXyvQ.exe
  C:\Windows\System\lqdXyvQ.exe
  2⤵
  PID:3796
- C:\Windows\System\WUIUpWS.exe
  C:\Windows\System\WUIUpWS.exe
  2⤵
  PID:3824
- C:\Windows\System\moWyajZ.exe
  C:\Windows\System\moWyajZ.exe
  2⤵
  PID:3988
- C:\Windows\System\BjLZzQS.exe
  C:\Windows\System\BjLZzQS.exe
  2⤵
  PID:3728
- C:\Windows\System\wKGvQdC.exe
  C:\Windows\System\wKGvQdC.exe
  2⤵
  PID:4040
- C:\Windows\System\XfiBujg.exe
  C:\Windows\System\XfiBujg.exe
  2⤵
  PID:3964
- C:\Windows\System\uyzGpIf.exe
  C:\Windows\System\uyzGpIf.exe
  2⤵
  PID:2036
- C:\Windows\System\yGqoUNd.exe
  C:\Windows\System\yGqoUNd.exe
  2⤵
  PID:3148
- C:\Windows\System\HKpLrzE.exe
  C:\Windows\System\HKpLrzE.exe
  2⤵
  PID:3868
- C:\Windows\System\zTyceAJ.exe
  C:\Windows\System\zTyceAJ.exe
  2⤵
  PID:3932
- C:\Windows\System\HACZYSr.exe
  C:\Windows\System\HACZYSr.exe
  2⤵
  PID:804
- C:\Windows\System\ExbIzYw.exe
  C:\Windows\System\ExbIzYw.exe
  2⤵
  PID:3448
- C:\Windows\System\YBTZizh.exe
  C:\Windows\System\YBTZizh.exe
  2⤵
  PID:2808
- C:\Windows\System\YbeYjPz.exe
  C:\Windows\System\YbeYjPz.exe
  2⤵
  PID:1540
- C:\Windows\System\aziDejE.exe
  C:\Windows\System\aziDejE.exe
  2⤵
  PID:2624
- C:\Windows\System\sDWzefI.exe
  C:\Windows\System\sDWzefI.exe
  2⤵
  PID:3372
- C:\Windows\System\QLpixRu.exe
  C:\Windows\System\QLpixRu.exe
  2⤵
  PID:3096
- C:\Windows\System\hPWMlwd.exe
  C:\Windows\System\hPWMlwd.exe
  2⤵
  PID:3512
- C:\Windows\System\mXxxzkj.exe
  C:\Windows\System\mXxxzkj.exe
  2⤵
  PID:3504
- C:\Windows\System\ZYmlAnk.exe
  C:\Windows\System\ZYmlAnk.exe
  2⤵
  PID:692
- C:\Windows\System\CElRxFh.exe
  C:\Windows\System\CElRxFh.exe
  2⤵
  PID:3216
- C:\Windows\System\xcMTKxw.exe
  C:\Windows\System\xcMTKxw.exe
  2⤵
  PID:3820
- C:\Windows\System\okwlLuR.exe
  C:\Windows\System\okwlLuR.exe
  2⤵
  PID:2988
- C:\Windows\System\DHZAhoM.exe
  C:\Windows\System\DHZAhoM.exe
  2⤵
  PID:3748
- C:\Windows\System\HWWTWIY.exe
  C:\Windows\System\HWWTWIY.exe
  2⤵
  PID:3404
- C:\Windows\System\dQUZyQA.exe
  C:\Windows\System\dQUZyQA.exe
  2⤵
  PID:1016
- C:\Windows\System\mdqMkRi.exe
  C:\Windows\System\mdqMkRi.exe
  2⤵
  PID:3580
- C:\Windows\System\IXLcWgO.exe
  C:\Windows\System\IXLcWgO.exe
  2⤵
  PID:3836
- C:\Windows\System\UXZYtol.exe
  C:\Windows\System\UXZYtol.exe
  2⤵
  PID:3116
- C:\Windows\System\mVGRaMX.exe
  C:\Windows\System\mVGRaMX.exe
  2⤵
  PID:3904
- C:\Windows\System\IAwdviW.exe
  C:\Windows\System\IAwdviW.exe
  2⤵
  PID:2516
- C:\Windows\System\AaFGdYF.exe
  C:\Windows\System\AaFGdYF.exe
  2⤵
  PID:3228
- C:\Windows\System\pBkEtZj.exe
  C:\Windows\System\pBkEtZj.exe
  2⤵
  PID:4108
- C:\Windows\System\RQRLKSD.exe
  C:\Windows\System\RQRLKSD.exe
  2⤵
  PID:4124
- C:\Windows\System\QRbfQsk.exe
  C:\Windows\System\QRbfQsk.exe
  2⤵
  PID:4140
- C:\Windows\System\pwQaiay.exe
  C:\Windows\System\pwQaiay.exe
  2⤵
  PID:4216
- C:\Windows\System\GNmRlrY.exe
  C:\Windows\System\GNmRlrY.exe
  2⤵
  PID:4236
- C:\Windows\System\LgPJOWq.exe
  C:\Windows\System\LgPJOWq.exe
  2⤵
  PID:4252
- C:\Windows\System\iWxEpfQ.exe
  C:\Windows\System\iWxEpfQ.exe
  2⤵
  PID:4268
- C:\Windows\System\pKfYNiZ.exe
  C:\Windows\System\pKfYNiZ.exe
  2⤵
  PID:4284
- C:\Windows\System\keSqwOn.exe
  C:\Windows\System\keSqwOn.exe
  2⤵
  PID:4300
- C:\Windows\System\NniGZEZ.exe
  C:\Windows\System\NniGZEZ.exe
  2⤵
  PID:4316
- C:\Windows\System\iMjfJEM.exe
  C:\Windows\System\iMjfJEM.exe
  2⤵
  PID:4332
- C:\Windows\System\yDyxEvE.exe
  C:\Windows\System\yDyxEvE.exe
  2⤵
  PID:4348
- C:\Windows\System\nfEuOmJ.exe
  C:\Windows\System\nfEuOmJ.exe
  2⤵
  PID:4364
- C:\Windows\System\vPfYvZb.exe
  C:\Windows\System\vPfYvZb.exe
  2⤵
  PID:4448
- C:\Windows\System\jFtYxjT.exe
  C:\Windows\System\jFtYxjT.exe
  2⤵
  PID:4468
- C:\Windows\System\CIMCeDu.exe
  C:\Windows\System\CIMCeDu.exe
  2⤵
  PID:4488
- C:\Windows\System\BZsrzmp.exe
  C:\Windows\System\BZsrzmp.exe
  2⤵
  PID:4508
- C:\Windows\System\ybFzaMk.exe
  C:\Windows\System\ybFzaMk.exe
  2⤵
  PID:4524
- C:\Windows\System\nJgYOSY.exe
  C:\Windows\System\nJgYOSY.exe
  2⤵
  PID:4540
- C:\Windows\System\uSJLOiY.exe
  C:\Windows\System\uSJLOiY.exe
  2⤵
  PID:4560
- C:\Windows\System\dwubLfA.exe
  C:\Windows\System\dwubLfA.exe
  2⤵
  PID:4576
- C:\Windows\System\IBvSzRw.exe
  C:\Windows\System\IBvSzRw.exe
  2⤵
  PID:4592
- C:\Windows\System\rUJvmCI.exe
  C:\Windows\System\rUJvmCI.exe
  2⤵
  PID:4612
- C:\Windows\System\bNOAJHX.exe
  C:\Windows\System\bNOAJHX.exe
  2⤵
  PID:4628
- C:\Windows\System\SdKpyJC.exe
  C:\Windows\System\SdKpyJC.exe
  2⤵
  PID:4644
- C:\Windows\System\FmRhVLx.exe
  C:\Windows\System\FmRhVLx.exe
  2⤵
  PID:4660
- C:\Windows\System\fCXVRsL.exe
  C:\Windows\System\fCXVRsL.exe
  2⤵
  PID:4676
- C:\Windows\System\xvueLlJ.exe
  C:\Windows\System\xvueLlJ.exe
  2⤵
  PID:4692
- C:\Windows\System\mspUkEO.exe
  C:\Windows\System\mspUkEO.exe
  2⤵
  PID:4712
- C:\Windows\System\XCjvtit.exe
  C:\Windows\System\XCjvtit.exe
  2⤵
  PID:4832
- C:\Windows\System\QBPlnGO.exe
  C:\Windows\System\QBPlnGO.exe
  2⤵
  PID:4848
- C:\Windows\System\vpyndmP.exe
  C:\Windows\System\vpyndmP.exe
  2⤵
  PID:4864
- C:\Windows\System\rRewxEg.exe
  C:\Windows\System\rRewxEg.exe
  2⤵
  PID:4880
- C:\Windows\System\jElpeiz.exe
  C:\Windows\System\jElpeiz.exe
  2⤵
  PID:4896
- C:\Windows\System\WBYqSpz.exe
  C:\Windows\System\WBYqSpz.exe
  2⤵
  PID:4912
- C:\Windows\System\wlZqnkX.exe
  C:\Windows\System\wlZqnkX.exe
  2⤵
  PID:4928
- C:\Windows\System\SijOZdy.exe
  C:\Windows\System\SijOZdy.exe
  2⤵
  PID:4944
- C:\Windows\System\pFPyaGR.exe
  C:\Windows\System\pFPyaGR.exe
  2⤵
  PID:4964
- C:\Windows\System\RXNnREK.exe
  C:\Windows\System\RXNnREK.exe
  2⤵
  PID:4980
- C:\Windows\System\QNthqtl.exe
  C:\Windows\System\QNthqtl.exe
  2⤵
  PID:4996
- C:\Windows\System\LAoZJeO.exe
  C:\Windows\System\LAoZJeO.exe
  2⤵
  PID:5012
- C:\Windows\System\uWIqTES.exe
  C:\Windows\System\uWIqTES.exe
  2⤵
  PID:5028
- C:\Windows\System\mLNkdLe.exe
  C:\Windows\System\mLNkdLe.exe
  2⤵
  PID:5044
- C:\Windows\System\hNWtnjw.exe
  C:\Windows\System\hNWtnjw.exe
  2⤵
  PID:5060
- C:\Windows\System\qMahESf.exe
  C:\Windows\System\qMahESf.exe
  2⤵
  PID:5076
- C:\Windows\System\MQTnoOf.exe
  C:\Windows\System\MQTnoOf.exe
  2⤵
  PID:5092
- C:\Windows\System\zRQzaUP.exe
  C:\Windows\System\zRQzaUP.exe
  2⤵
  PID:5108
- C:\Windows\System\oRrrSbB.exe
  C:\Windows\System\oRrrSbB.exe
  2⤵
  PID:3712
- C:\Windows\System\AOzucyv.exe
  C:\Windows\System\AOzucyv.exe
  2⤵
  PID:3664
- C:\Windows\System\BtzLLzw.exe
  C:\Windows\System\BtzLLzw.exe
  2⤵
  PID:2820
- C:\Windows\System\HrNELSC.exe
  C:\Windows\System\HrNELSC.exe
  2⤵
  PID:3456
- C:\Windows\System\gtSdjnv.exe
  C:\Windows\System\gtSdjnv.exe
  2⤵
  PID:3472
- C:\Windows\System\YrjXclw.exe
  C:\Windows\System\YrjXclw.exe
  2⤵
  PID:1604
- C:\Windows\System\wJrGXkG.exe
  C:\Windows\System\wJrGXkG.exe
  2⤵
  PID:3464
- C:\Windows\System\mkBlEdx.exe
  C:\Windows\System\mkBlEdx.exe
  2⤵
  PID:3996
- C:\Windows\System\aRhzmMs.exe
  C:\Windows\System\aRhzmMs.exe
  2⤵
  PID:3080
- C:\Windows\System\YmyfHjJ.exe
  C:\Windows\System\YmyfHjJ.exe
  2⤵
  PID:4076
- C:\Windows\System\WJIVfWK.exe
  C:\Windows\System\WJIVfWK.exe
  2⤵
  PID:1928
- C:\Windows\System\gZsiHma.exe
  C:\Windows\System\gZsiHma.exe
  2⤵
  PID:3840
- C:\Windows\System\ZsvhNEp.exe
  C:\Windows\System\ZsvhNEp.exe
  2⤵
  PID:1460
- C:\Windows\System\GcAdVzZ.exe
  C:\Windows\System\GcAdVzZ.exe
  2⤵
  PID:3296
- C:\Windows\System\jhrWumy.exe
  C:\Windows\System\jhrWumy.exe
  2⤵
  PID:3648
- C:\Windows\System\SaXgtUT.exe
  C:\Windows\System\SaXgtUT.exe
  2⤵
  PID:4200
- C:\Windows\System\ahEFrBf.exe
  C:\Windows\System\ahEFrBf.exe
  2⤵
  PID:4164
- C:\Windows\System\EKeIKEH.exe
  C:\Windows\System\EKeIKEH.exe
  2⤵
  PID:4180
- C:\Windows\System\ZPLGIyJ.exe
  C:\Windows\System\ZPLGIyJ.exe
  2⤵
  PID:4064
- C:\Windows\System\svvrCUm.exe
  C:\Windows\System\svvrCUm.exe
  2⤵
  PID:3900
- C:\Windows\System\OsKvClK.exe
  C:\Windows\System\OsKvClK.exe
  2⤵
  PID:3888
- C:\Windows\System\HzOMMqv.exe
  C:\Windows\System\HzOMMqv.exe
  2⤵
  PID:3916
- C:\Windows\System\pfSCArq.exe
  C:\Windows\System\pfSCArq.exe
  2⤵
  PID:3600
- C:\Windows\System\VznAyjk.exe
  C:\Windows\System\VznAyjk.exe
  2⤵
  PID:2100
- C:\Windows\System\ASvENnX.exe
  C:\Windows\System\ASvENnX.exe
  2⤵
  PID:3212
- C:\Windows\System\vSoOuiV.exe
  C:\Windows\System\vSoOuiV.exe
  2⤵
  PID:2096
- C:\Windows\System\rwGphiW.exe
  C:\Windows\System\rwGphiW.exe
  2⤵
  PID:3920
- C:\Windows\System\NyxLzVz.exe
  C:\Windows\System\NyxLzVz.exe
  2⤵
  PID:4024
- C:\Windows\System\nPSdNva.exe
  C:\Windows\System\nPSdNva.exe
  2⤵
  PID:4280
- C:\Windows\System\FOpDZTI.exe
  C:\Windows\System\FOpDZTI.exe
  2⤵
  PID:4340
- C:\Windows\System\PfYBZjc.exe
  C:\Windows\System\PfYBZjc.exe
  2⤵
  PID:4228
- C:\Windows\System\PQCVkbZ.exe
  C:\Windows\System\PQCVkbZ.exe
  2⤵
  PID:4260
- C:\Windows\System\ohkzjbn.exe
  C:\Windows\System\ohkzjbn.exe
  2⤵
  PID:4324
- C:\Windows\System\yFMWYxl.exe
  C:\Windows\System\yFMWYxl.exe
  2⤵
  PID:4380
- C:\Windows\System\CtPAFco.exe
  C:\Windows\System\CtPAFco.exe
  2⤵
  PID:4396
- C:\Windows\System\FGxSpSW.exe
  C:\Windows\System\FGxSpSW.exe
  2⤵
  PID:2460
- C:\Windows\System\PiXnodf.exe
  C:\Windows\System\PiXnodf.exe
  2⤵
  PID:4432
- C:\Windows\System\CSjByzG.exe
  C:\Windows\System\CSjByzG.exe
  2⤵
  PID:2640
- C:\Windows\System\AzsZaSE.exe
  C:\Windows\System\AzsZaSE.exe
  2⤵
  PID:4376
- C:\Windows\System\xQKJEBu.exe
  C:\Windows\System\xQKJEBu.exe
  2⤵
  PID:4548
- C:\Windows\System\sJMidlO.exe
  C:\Windows\System\sJMidlO.exe
  2⤵
  PID:4584
- C:\Windows\System\qYZCPHT.exe
  C:\Windows\System\qYZCPHT.exe
  2⤵
  PID:4652
- C:\Windows\System\xNJFRLz.exe
  C:\Windows\System\xNJFRLz.exe
  2⤵
  PID:4572
- C:\Windows\System\YNcQwyL.exe
  C:\Windows\System\YNcQwyL.exe
  2⤵
  PID:4568
- C:\Windows\System\LwyeHpe.exe
  C:\Windows\System\LwyeHpe.exe
  2⤵
  PID:4600
- C:\Windows\System\wmtcJkv.exe
  C:\Windows\System\wmtcJkv.exe
  2⤵
  PID:4700
- C:\Windows\System\DoYaebx.exe
  C:\Windows\System\DoYaebx.exe
  2⤵
  PID:1600
- C:\Windows\System\oJkRreT.exe
  C:\Windows\System\oJkRreT.exe
  2⤵
  PID:3036
- C:\Windows\System\xnNcHiJ.exe
  C:\Windows\System\xnNcHiJ.exe
  2⤵
  PID:2188
- C:\Windows\System\Qfdjotq.exe
  C:\Windows\System\Qfdjotq.exe
  2⤵
  PID:1072
- C:\Windows\System\cHsKRPf.exe
  C:\Windows\System\cHsKRPf.exe
  2⤵
  PID:2448
- C:\Windows\System\LzKNyez.exe
  C:\Windows\System\LzKNyez.exe
  2⤵
  PID:4740
- C:\Windows\System\DWNXqdb.exe
  C:\Windows\System\DWNXqdb.exe
  2⤵
  PID:2900
- C:\Windows\System\INFVYTV.exe
  C:\Windows\System\INFVYTV.exe
  2⤵
  PID:2948
- C:\Windows\System\ctYxjNU.exe
  C:\Windows\System\ctYxjNU.exe
  2⤵
  PID:4824
- C:\Windows\System\sgASPcA.exe
  C:\Windows\System\sgASPcA.exe
  2⤵
  PID:4856
- C:\Windows\System\ppPckFF.exe
  C:\Windows\System\ppPckFF.exe
  2⤵
  PID:4920
- C:\Windows\System\houKPxJ.exe
  C:\Windows\System\houKPxJ.exe
  2⤵
  PID:4960
- C:\Windows\System\SpYlFFK.exe
  C:\Windows\System\SpYlFFK.exe
  2⤵
  PID:1816
- C:\Windows\System\MMjMsPN.exe
  C:\Windows\System\MMjMsPN.exe
  2⤵
  PID:4904
- C:\Windows\System\llGDVjv.exe
  C:\Windows\System\llGDVjv.exe
  2⤵
  PID:5020
- C:\Windows\System\VnTFBoX.exe
  C:\Windows\System\VnTFBoX.exe
  2⤵
  PID:4976
- C:\Windows\System\byuBlAs.exe
  C:\Windows\System\byuBlAs.exe
  2⤵
  PID:5068
- C:\Windows\System\tTjEzOs.exe
  C:\Windows\System\tTjEzOs.exe
  2⤵
  PID:3468
- C:\Windows\System\CZzpbCi.exe
  C:\Windows\System\CZzpbCi.exe
  2⤵
  PID:4936
- C:\Windows\System\JDpjbvl.exe
  C:\Windows\System\JDpjbvl.exe
  2⤵
  PID:2196
- C:\Windows\System\pfBLIHa.exe
  C:\Windows\System\pfBLIHa.exe
  2⤵
  PID:3772
- C:\Windows\System\aZAJjDa.exe
  C:\Windows\System\aZAJjDa.exe
  2⤵
  PID:3804
- C:\Windows\System\OfKKAIu.exe
  C:\Windows\System\OfKKAIu.exe
  2⤵
  PID:4120
- C:\Windows\System\ybuZxAO.exe
  C:\Windows\System\ybuZxAO.exe
  2⤵
  PID:2344
- C:\Windows\System\NAaFYDp.exe
  C:\Windows\System\NAaFYDp.exe
  2⤵
  PID:2912
- C:\Windows\System\cPLhTRd.exe
  C:\Windows\System\cPLhTRd.exe
  2⤵
  PID:4196
- C:\Windows\System\chVdwTZ.exe
  C:\Windows\System\chVdwTZ.exe
  2⤵
  PID:4080
- C:\Windows\System\XAIlBpc.exe
  C:\Windows\System\XAIlBpc.exe
  2⤵
  PID:4132
- C:\Windows\System\QWeVfyj.exe
  C:\Windows\System\QWeVfyj.exe
  2⤵
  PID:4608
- C:\Windows\System\YShGSLr.exe
  C:\Windows\System\YShGSLr.exe
  2⤵
  PID:3968
- C:\Windows\System\bhQPqBw.exe
  C:\Windows\System\bhQPqBw.exe
  2⤵
  PID:4028
- C:\Windows\System\oaIQroH.exe
  C:\Windows\System\oaIQroH.exe
  2⤵
  PID:4212
- C:\Windows\System\CWcenfC.exe
  C:\Windows\System\CWcenfC.exe
  2⤵
  PID:4204
- C:\Windows\System\rIeZlOv.exe
  C:\Windows\System\rIeZlOv.exe
  2⤵
  PID:4428
- C:\Windows\System\vVTHNxe.exe
  C:\Windows\System\vVTHNxe.exe
  2⤵
  PID:4372
- C:\Windows\System\ZIwCrPL.exe
  C:\Windows\System\ZIwCrPL.exe
  2⤵
  PID:4404
- C:\Windows\System\iCSawML.exe
  C:\Windows\System\iCSawML.exe
  2⤵
  PID:4208
- C:\Windows\System\OKuFJbc.exe
  C:\Windows\System\OKuFJbc.exe
  2⤵
  PID:4556
- C:\Windows\System\TjIFUVh.exe
  C:\Windows\System\TjIFUVh.exe
  2⤵
  PID:2680
- C:\Windows\System\HorLyKq.exe
  C:\Windows\System\HorLyKq.exe
  2⤵
  PID:4536
- C:\Windows\System\tbxAjMn.exe
  C:\Windows\System\tbxAjMn.exe
  2⤵
  PID:4460
- C:\Windows\System\xfPMFog.exe
  C:\Windows\System\xfPMFog.exe
  2⤵
  PID:2148
- C:\Windows\System\WfzaRdP.exe
  C:\Windows\System\WfzaRdP.exe
  2⤵
  PID:4672
- C:\Windows\System\tpmsNlF.exe
  C:\Windows\System\tpmsNlF.exe
  2⤵
  PID:4704
- C:\Windows\System\QkBUDmp.exe
  C:\Windows\System\QkBUDmp.exe
  2⤵
  PID:1372
- C:\Windows\System\ZNmBZRz.exe
  C:\Windows\System\ZNmBZRz.exe
  2⤵
  PID:2088
- C:\Windows\System\APmJYHX.exe
  C:\Windows\System\APmJYHX.exe
  2⤵
  PID:2304
- C:\Windows\System\okaibVG.exe
  C:\Windows\System\okaibVG.exe
  2⤵
  PID:2604
- C:\Windows\System\cBHUGZJ.exe
  C:\Windows\System\cBHUGZJ.exe
  2⤵
  PID:4784
- C:\Windows\System\qEbekwK.exe
  C:\Windows\System\qEbekwK.exe
  2⤵
  PID:960
- C:\Windows\System\xYLefOu.exe
  C:\Windows\System\xYLefOu.exe
  2⤵
  PID:4816
- C:\Windows\System\dDnblMh.exe
  C:\Windows\System\dDnblMh.exe
  2⤵
  PID:2352
- C:\Windows\System\qnlGjZk.exe
  C:\Windows\System\qnlGjZk.exe
  2⤵
  PID:5072
- C:\Windows\System\NsSnjVU.exe
  C:\Windows\System\NsSnjVU.exe
  2⤵
  PID:4000
- C:\Windows\System\TQGQMBh.exe
  C:\Windows\System\TQGQMBh.exe
  2⤵
  PID:2076
- C:\Windows\System\OPwEqoP.exe
  C:\Windows\System\OPwEqoP.exe
  2⤵
  PID:3032
- C:\Windows\System\KLcytSh.exe
  C:\Windows\System\KLcytSh.exe
  2⤵
  PID:3784
- C:\Windows\System\IbhwNev.exe
  C:\Windows\System\IbhwNev.exe
  2⤵
  PID:3660
- C:\Windows\System\TtFbtKR.exe
  C:\Windows\System\TtFbtKR.exe
  2⤵
  PID:4012
- C:\Windows\System\YFDxlpm.exe
  C:\Windows\System\YFDxlpm.exe
  2⤵
  PID:528
- C:\Windows\System\pwFtIaP.exe
  C:\Windows\System\pwFtIaP.exe
  2⤵
  PID:836
- C:\Windows\System\oVtmPXU.exe
  C:\Windows\System\oVtmPXU.exe
  2⤵
  PID:4176
- C:\Windows\System\MgQeqYz.exe
  C:\Windows\System\MgQeqYz.exe
  2⤵
  PID:4464
- C:\Windows\System\azVckWv.exe
  C:\Windows\System\azVckWv.exe
  2⤵
  PID:2976
- C:\Windows\System\ZQwTekW.exe
  C:\Windows\System\ZQwTekW.exe
  2⤵
  PID:4752
- C:\Windows\System\ckSxWQn.exe
  C:\Windows\System\ckSxWQn.exe
  2⤵
  PID:2568
- C:\Windows\System\kaXfhGt.exe
  C:\Windows\System\kaXfhGt.exe
  2⤵
  PID:1620
- C:\Windows\System\yaUNnul.exe
  C:\Windows\System\yaUNnul.exe
  2⤵
  PID:4808
- C:\Windows\System\dFUMCuK.exe
  C:\Windows\System\dFUMCuK.exe
  2⤵
  PID:4444
- C:\Windows\System\CPCeKgU.exe
  C:\Windows\System\CPCeKgU.exe
  2⤵
  PID:1240
- C:\Windows\System\CGrmLIi.exe
  C:\Windows\System\CGrmLIi.exe
  2⤵
  PID:4748
- C:\Windows\System\rQVdZjf.exe
  C:\Windows\System\rQVdZjf.exe
  2⤵
  PID:3136
- C:\Windows\System\taQPQQU.exe
  C:\Windows\System\taQPQQU.exe
  2⤵
  PID:4988
- C:\Windows\System\PEcEPnt.exe
  C:\Windows\System\PEcEPnt.exe
  2⤵
  PID:888
- C:\Windows\System\vzIuCAT.exe
  C:\Windows\System\vzIuCAT.exe
  2⤵
  PID:4104
- C:\Windows\System\utLdGod.exe
  C:\Windows\System\utLdGod.exe
  2⤵
  PID:2636
- C:\Windows\System\iXlBivS.exe
  C:\Windows\System\iXlBivS.exe
  2⤵
  PID:4688
- C:\Windows\System\oekYGfa.exe
  C:\Windows\System\oekYGfa.exe
  2⤵
  PID:4972
- C:\Windows\System\iJXiFFt.exe
  C:\Windows\System\iJXiFFt.exe
  2⤵
  PID:4888
- C:\Windows\System\rZhuTjH.exe
  C:\Windows\System\rZhuTjH.exe
  2⤵
  PID:4812
- C:\Windows\System\TypmyOf.exe
  C:\Windows\System\TypmyOf.exe
  2⤵
  PID:2576
- C:\Windows\System\DkLybmt.exe
  C:\Windows\System\DkLybmt.exe
  2⤵
  PID:4620
- C:\Windows\System\ifWGEVJ.exe
  C:\Windows\System\ifWGEVJ.exe
  2⤵
  PID:4388
- C:\Windows\System\diqwmMI.exe
  C:\Windows\System\diqwmMI.exe
  2⤵
  PID:4800
- C:\Windows\System\lNYPOCv.exe
  C:\Windows\System\lNYPOCv.exe
  2⤵
  PID:4872
- C:\Windows\System\rsqhswI.exe
  C:\Windows\System\rsqhswI.exe
  2⤵
  PID:4408
- C:\Windows\System\lbPDUvQ.exe
  C:\Windows\System\lbPDUvQ.exe
  2⤵
  PID:4776
- C:\Windows\System\xClcBIj.exe
  C:\Windows\System\xClcBIj.exe
  2⤵
  PID:4476
- C:\Windows\System\YpTZJZV.exe
  C:\Windows\System\YpTZJZV.exe
  2⤵
  PID:3948
- C:\Windows\System\fruuhPw.exe
  C:\Windows\System\fruuhPw.exe
  2⤵
  PID:5136
- C:\Windows\System\kaYWDyD.exe
  C:\Windows\System\kaYWDyD.exe
  2⤵
  PID:5160
- C:\Windows\System\oIyaCmz.exe
  C:\Windows\System\oIyaCmz.exe
  2⤵
  PID:5188
- C:\Windows\System\iKtKAfH.exe
  C:\Windows\System\iKtKAfH.exe
  2⤵
  PID:5204
- C:\Windows\System\nFxymAh.exe
  C:\Windows\System\nFxymAh.exe
  2⤵
  PID:5224
- C:\Windows\System\oqyKCNe.exe
  C:\Windows\System\oqyKCNe.exe
  2⤵
  PID:5260
- C:\Windows\System\FXFCLGY.exe
  C:\Windows\System\FXFCLGY.exe
  2⤵
  PID:5284
- C:\Windows\System\HAPYHQI.exe
  C:\Windows\System\HAPYHQI.exe
  2⤵
  PID:5300
- C:\Windows\System\pJvFjjH.exe
  C:\Windows\System\pJvFjjH.exe
  2⤵
  PID:5316
- C:\Windows\System\hbUEzhe.exe
  C:\Windows\System\hbUEzhe.exe
  2⤵
  PID:5332
- C:\Windows\System\ZMkrgFA.exe
  C:\Windows\System\ZMkrgFA.exe
  2⤵
  PID:5348
- C:\Windows\System\LwyaWEQ.exe
  C:\Windows\System\LwyaWEQ.exe
  2⤵
  PID:5364
- C:\Windows\System\PXXZTaz.exe
  C:\Windows\System\PXXZTaz.exe
  2⤵
  PID:5380
- C:\Windows\System\kVcQsyA.exe
  C:\Windows\System\kVcQsyA.exe
  2⤵
  PID:5396
- C:\Windows\System\wZxniIP.exe
  C:\Windows\System\wZxniIP.exe
  2⤵
  PID:5412
- C:\Windows\System\UhCemUJ.exe
  C:\Windows\System\UhCemUJ.exe
  2⤵
  PID:5428
- C:\Windows\System\UvbWukS.exe
  C:\Windows\System\UvbWukS.exe
  2⤵
  PID:5448
- C:\Windows\System\JaCbRub.exe
  C:\Windows\System\JaCbRub.exe
  2⤵
  PID:5468
- C:\Windows\System\cVCojHe.exe
  C:\Windows\System\cVCojHe.exe
  2⤵
  PID:5484
- C:\Windows\System\WRgQvAo.exe
  C:\Windows\System\WRgQvAo.exe
  2⤵
  PID:5500
- C:\Windows\System\pjTVPxt.exe
  C:\Windows\System\pjTVPxt.exe
  2⤵
  PID:5516
- C:\Windows\System\ESYuRyO.exe
  C:\Windows\System\ESYuRyO.exe
  2⤵
  PID:5532
- C:\Windows\System\PGNJutL.exe
  C:\Windows\System\PGNJutL.exe
  2⤵
  PID:5548
- C:\Windows\System\AABXfzQ.exe
  C:\Windows\System\AABXfzQ.exe
  2⤵
  PID:5564
- C:\Windows\System\efOMvXi.exe
  C:\Windows\System\efOMvXi.exe
  2⤵
  PID:5580
- C:\Windows\System\wAeVIFR.exe
  C:\Windows\System\wAeVIFR.exe
  2⤵
  PID:5596
- C:\Windows\System\WWtqPGj.exe
  C:\Windows\System\WWtqPGj.exe
  2⤵
  PID:5616
- C:\Windows\System\aMlxSoi.exe
  C:\Windows\System\aMlxSoi.exe
  2⤵
  PID:5632
- C:\Windows\System\ThGKFYU.exe
  C:\Windows\System\ThGKFYU.exe
  2⤵
  PID:5652
- C:\Windows\System\EjeyHXu.exe
  C:\Windows\System\EjeyHXu.exe
  2⤵
  PID:5668
- C:\Windows\System\bDuXVrI.exe
  C:\Windows\System\bDuXVrI.exe
  2⤵
  PID:5684
- C:\Windows\System\OFHusbI.exe
  C:\Windows\System\OFHusbI.exe
  2⤵
  PID:5700
- C:\Windows\System\aCcbHlH.exe
  C:\Windows\System\aCcbHlH.exe
  2⤵
  PID:5720
- C:\Windows\System\wceLhfS.exe
  C:\Windows\System\wceLhfS.exe
  2⤵
  PID:5736
- C:\Windows\System\cHNwSaD.exe
  C:\Windows\System\cHNwSaD.exe
  2⤵
  PID:5752
- C:\Windows\System\AGOGUmr.exe
  C:\Windows\System\AGOGUmr.exe
  2⤵
  PID:5768
- C:\Windows\System\JysmePn.exe
  C:\Windows\System\JysmePn.exe
  2⤵
  PID:5784
- C:\Windows\System\axDzOIO.exe
  C:\Windows\System\axDzOIO.exe
  2⤵
  PID:5800
- C:\Windows\System\Xcbathu.exe
  C:\Windows\System\Xcbathu.exe
  2⤵
  PID:5816
- C:\Windows\System\VGjGmdY.exe
  C:\Windows\System\VGjGmdY.exe
  2⤵
  PID:5832
- C:\Windows\System\bbxionC.exe
  C:\Windows\System\bbxionC.exe
  2⤵
  PID:5848
- C:\Windows\System\uiFVHit.exe
  C:\Windows\System\uiFVHit.exe
  2⤵
  PID:5864
- C:\Windows\System\LTilvup.exe
  C:\Windows\System\LTilvup.exe
  2⤵
  PID:5880
- C:\Windows\System\GjNvByM.exe
  C:\Windows\System\GjNvByM.exe
  2⤵
  PID:5896
- C:\Windows\System\MhSuXwO.exe
  C:\Windows\System\MhSuXwO.exe
  2⤵
  PID:5912
- C:\Windows\System\pbJoSIk.exe
  C:\Windows\System\pbJoSIk.exe
  2⤵
  PID:5928
- C:\Windows\System\GjyVcoY.exe
  C:\Windows\System\GjyVcoY.exe
  2⤵
  PID:5944
- C:\Windows\System\ZJLgFmw.exe
  C:\Windows\System\ZJLgFmw.exe
  2⤵
  PID:5960
- C:\Windows\System\LgFYprd.exe
  C:\Windows\System\LgFYprd.exe
  2⤵
  PID:5976
- C:\Windows\System\gjcikzO.exe
  C:\Windows\System\gjcikzO.exe
  2⤵
  PID:6016
- C:\Windows\System\YwHfhuT.exe
  C:\Windows\System\YwHfhuT.exe
  2⤵
  PID:6032
- C:\Windows\System\eJitBkI.exe
  C:\Windows\System\eJitBkI.exe
  2⤵
  PID:6048
- C:\Windows\System\WKUaAOw.exe
  C:\Windows\System\WKUaAOw.exe
  2⤵
  PID:6064
- C:\Windows\System\voJBvoW.exe
  C:\Windows\System\voJBvoW.exe
  2⤵
  PID:6088
- C:\Windows\System\ePwLAfa.exe
  C:\Windows\System\ePwLAfa.exe
  2⤵
  PID:6108
- C:\Windows\System\yYLqoDq.exe
  C:\Windows\System\yYLqoDq.exe
  2⤵
  PID:6124
- C:\Windows\System\gVZIILB.exe
  C:\Windows\System\gVZIILB.exe
  2⤵
  PID:6140
- C:\Windows\System\cyAqBUp.exe
  C:\Windows\System\cyAqBUp.exe
  2⤵
  PID:2204
- C:\Windows\System\TOFjGEB.exe
  C:\Windows\System\TOFjGEB.exe
  2⤵
  PID:4840
- C:\Windows\System\tKYojVb.exe
  C:\Windows\System\tKYojVb.exe
  2⤵
  PID:5148
- C:\Windows\System\epgkwVK.exe
  C:\Windows\System\epgkwVK.exe
  2⤵
  PID:5156
- C:\Windows\System\IMmZJUN.exe
  C:\Windows\System\IMmZJUN.exe
  2⤵
  PID:4360
- C:\Windows\System\YEGQeJz.exe
  C:\Windows\System\YEGQeJz.exe
  2⤵
  PID:3436
- C:\Windows\System\FLwdurW.exe
  C:\Windows\System\FLwdurW.exe
  2⤵
  PID:5232
- C:\Windows\System\xdjUVzW.exe
  C:\Windows\System\xdjUVzW.exe
  2⤵
  PID:5292
- C:\Windows\System\WhjttNS.exe
  C:\Windows\System\WhjttNS.exe
  2⤵
  PID:5244
- C:\Windows\System\bxniAgA.exe
  C:\Windows\System\bxniAgA.exe
  2⤵
  PID:5424
- C:\Windows\System\EGpbcKC.exe
  C:\Windows\System\EGpbcKC.exe
  2⤵
  PID:2420
- C:\Windows\System\klPfllM.exe
  C:\Windows\System\klPfllM.exe
  2⤵
  PID:1984
- C:\Windows\System\qeStXBL.exe
  C:\Windows\System\qeStXBL.exe
  2⤵
  PID:5176
- C:\Windows\System\nMjmZSp.exe
  C:\Windows\System\nMjmZSp.exe
  2⤵
  PID:5268
- C:\Windows\System\KMqFTke.exe
  C:\Windows\System\KMqFTke.exe
  2⤵
  PID:5344
- C:\Windows\System\LuEDrJt.exe
  C:\Windows\System\LuEDrJt.exe
  2⤵
  PID:5444
- C:\Windows\System\yrdrlgX.exe
  C:\Windows\System\yrdrlgX.exe
  2⤵
  PID:5524
- C:\Windows\System\DKszGfv.exe
  C:\Windows\System\DKszGfv.exe
  2⤵
  PID:5272
- C:\Windows\System\VyEjCVT.exe
  C:\Windows\System\VyEjCVT.exe
  2⤵
  PID:5408
- C:\Windows\System\aVNxqxU.exe
  C:\Windows\System\aVNxqxU.exe
  2⤵
  PID:5480
- C:\Windows\System\RzBfKuK.exe
  C:\Windows\System\RzBfKuK.exe
  2⤵
  PID:5624
- C:\Windows\System\UJAQFYw.exe
  C:\Windows\System\UJAQFYw.exe
  2⤵
  PID:5692
- C:\Windows\System\ktKidQh.exe
  C:\Windows\System\ktKidQh.exe
  2⤵
  PID:5732
- C:\Windows\System\ArhjdVI.exe
  C:\Windows\System\ArhjdVI.exe
  2⤵
  PID:5648
- C:\Windows\System\rfYjinQ.exe
  C:\Windows\System\rfYjinQ.exe
  2⤵
  PID:880
- C:\Windows\System\SSasyhE.exe
  C:\Windows\System\SSasyhE.exe
  2⤵
  PID:5748
- C:\Windows\System\cYAIBLy.exe
  C:\Windows\System\cYAIBLy.exe
  2⤵
  PID:5576
- C:\Windows\System\uaHhZkT.exe
  C:\Windows\System\uaHhZkT.exe
  2⤵
  PID:5812
- C:\Windows\System\dFCngWh.exe
  C:\Windows\System\dFCngWh.exe
  2⤵
  PID:5796
- C:\Windows\System\accsQaI.exe
  C:\Windows\System\accsQaI.exe
  2⤵
  PID:5888
- C:\Windows\System\JwTzgEw.exe
  C:\Windows\System\JwTzgEw.exe
  2⤵
  PID:5828
- C:\Windows\System\eSGjfjN.exe
  C:\Windows\System\eSGjfjN.exe
  2⤵
  PID:5908
- C:\Windows\System\hOPBpDp.exe
  C:\Windows\System\hOPBpDp.exe
  2⤵
  PID:5952
- C:\Windows\System\xHHpwQi.exe
  C:\Windows\System\xHHpwQi.exe
  2⤵
  PID:5988
- C:\Windows\System\eBZgIVE.exe
  C:\Windows\System\eBZgIVE.exe
  2⤵
  PID:6040
- C:\Windows\System\znZUcbN.exe
  C:\Windows\System\znZUcbN.exe
  2⤵
  PID:6084
- C:\Windows\System\WpDovzL.exe
  C:\Windows\System\WpDovzL.exe
  2⤵
  PID:4296
- C:\Windows\System\HwCHqnQ.exe
  C:\Windows\System\HwCHqnQ.exe
  2⤵
  PID:6028
- C:\Windows\System\AMxpjLI.exe
  C:\Windows\System\AMxpjLI.exe
  2⤵
  PID:6100
- C:\Windows\System\VEhfwJn.exe
  C:\Windows\System\VEhfwJn.exe
  2⤵
  PID:5252
- C:\Windows\System\vzqmZog.exe
  C:\Windows\System\vzqmZog.exe
  2⤵
  PID:5116
- C:\Windows\System\qfZowDo.exe
  C:\Windows\System\qfZowDo.exe
  2⤵
  PID:5324
- C:\Windows\System\QjRUPvd.exe
  C:\Windows\System\QjRUPvd.exe
  2⤵
  PID:4504
- C:\Windows\System\RyjRWEX.exe
  C:\Windows\System\RyjRWEX.exe
  2⤵
  PID:3280
- C:\Windows\System\gxfZVNR.exe
  C:\Windows\System\gxfZVNR.exe
  2⤵
  PID:5328
- C:\Windows\System\ZNaPNBl.exe
  C:\Windows\System\ZNaPNBl.exe
  2⤵
  PID:2688
- C:\Windows\System\fJBJTlb.exe
  C:\Windows\System\fJBJTlb.exe
  2⤵
  PID:5392
- C:\Windows\System\juxgvsQ.exe
  C:\Windows\System\juxgvsQ.exe
  2⤵
  PID:3444
- C:\Windows\System\tBpCxhT.exe
  C:\Windows\System\tBpCxhT.exe
  2⤵
  PID:5436
- C:\Windows\System\JZIYWCq.exe
  C:\Windows\System\JZIYWCq.exe
  2⤵
  PID:5660
- C:\Windows\System\fBjXGAG.exe
  C:\Windows\System\fBjXGAG.exe
  2⤵
  PID:5180
- C:\Windows\System\UMUdMlt.exe
  C:\Windows\System\UMUdMlt.exe
  2⤵
  PID:5608
- C:\Windows\System\UXkwnSZ.exe
  C:\Windows\System\UXkwnSZ.exe
  2⤵
  PID:5872
- C:\Windows\System\URzDxCI.exe
  C:\Windows\System\URzDxCI.exe
  2⤵
  PID:5992
- C:\Windows\System\LNJArUS.exe
  C:\Windows\System\LNJArUS.exe
  2⤵
  PID:5512
- C:\Windows\System\PnjQNlg.exe
  C:\Windows\System\PnjQNlg.exe
  2⤵
  PID:5508
- C:\Windows\System\mEQFmZK.exe
  C:\Windows\System\mEQFmZK.exe
  2⤵
  PID:5544
- C:\Windows\System\pkLDUsp.exe
  C:\Windows\System\pkLDUsp.exe
  2⤵
  PID:5680
- C:\Windows\System\eelavCa.exe
  C:\Windows\System\eelavCa.exe
  2⤵
  PID:5824
- C:\Windows\System\DczWLWH.exe
  C:\Windows\System\DczWLWH.exe
  2⤵
  PID:6004
- C:\Windows\System\cmoxnJL.exe
  C:\Windows\System\cmoxnJL.exe
  2⤵
  PID:6120
- C:\Windows\System\BYkZXlY.exe
  C:\Windows\System\BYkZXlY.exe
  2⤵
  PID:6136
- C:\Windows\System\SUhYVgS.exe
  C:\Windows\System\SUhYVgS.exe
  2⤵
  PID:4804
- C:\Windows\System\iWfvEvw.exe
  C:\Windows\System\iWfvEvw.exe
  2⤵
  PID:5144
- C:\Windows\System\QTJwGeS.exe
  C:\Windows\System\QTJwGeS.exe
  2⤵
  PID:6080
- C:\Windows\System\wUMoVvm.exe
  C:\Windows\System\wUMoVvm.exe
  2⤵
  PID:5216
- C:\Windows\System\BOZKdrK.exe
  C:\Windows\System\BOZKdrK.exe
  2⤵
  PID:6000
- C:\Windows\System\fMQhpBN.exe
  C:\Windows\System\fMQhpBN.exe
  2⤵
  PID:5876
- C:\Windows\System\gQVQFTt.exe
  C:\Windows\System\gQVQFTt.exe
  2⤵
  PID:5860
- C:\Windows\System\aOUsyAG.exe
  C:\Windows\System\aOUsyAG.exe
  2⤵
  PID:5308
- C:\Windows\System\UrIzTRY.exe
  C:\Windows\System\UrIzTRY.exe
  2⤵
  PID:5376
- C:\Windows\System\kggGuMb.exe
  C:\Windows\System\kggGuMb.exe
  2⤵
  PID:5356
- C:\Windows\System\nKQqzHu.exe
  C:\Windows\System\nKQqzHu.exe
  2⤵
  PID:5764
- C:\Windows\System\IHjoSZS.exe
  C:\Windows\System\IHjoSZS.exe
  2⤵
  PID:6076
- C:\Windows\System\mxGdOuo.exe
  C:\Windows\System\mxGdOuo.exe
  2⤵
  PID:6096
- C:\Windows\System\WLhskRg.exe
  C:\Windows\System\WLhskRg.exe
  2⤵
  PID:2744
- C:\Windows\System\gpulnkT.exe
  C:\Windows\System\gpulnkT.exe
  2⤵
  PID:5464
- C:\Windows\System\FsryBzh.exe
  C:\Windows\System\FsryBzh.exe
  2⤵
  PID:5940
- C:\Windows\System\bGIFEAa.exe
  C:\Windows\System\bGIFEAa.exe
  2⤵
  PID:6072
- C:\Windows\System\FXblOAD.exe
  C:\Windows\System\FXblOAD.exe
  2⤵
  PID:5476
- C:\Windows\System\pcFxDzZ.exe
  C:\Windows\System\pcFxDzZ.exe
  2⤵
  PID:5972
- C:\Windows\System\WBONMRv.exe
  C:\Windows\System\WBONMRv.exe
  2⤵
  PID:5460
- C:\Windows\System\eYmVUYW.exe
  C:\Windows\System\eYmVUYW.exe
  2⤵
  PID:5560
- C:\Windows\System\yxNHtre.exe
  C:\Windows\System\yxNHtre.exe
  2⤵
  PID:6148
- C:\Windows\System\ixbDCTC.exe
  C:\Windows\System\ixbDCTC.exe
  2⤵
  PID:6164
- C:\Windows\System\xdgBpyg.exe
  C:\Windows\System\xdgBpyg.exe
  2⤵
  PID:6180
- C:\Windows\System\vaGZRsZ.exe
  C:\Windows\System\vaGZRsZ.exe
  2⤵
  PID:6196
- C:\Windows\System\gKXeifB.exe
  C:\Windows\System\gKXeifB.exe
  2⤵
  PID:6212
- C:\Windows\System\OFNVCzz.exe
  C:\Windows\System\OFNVCzz.exe
  2⤵
  PID:6228
- C:\Windows\System\CBByFXH.exe
  C:\Windows\System\CBByFXH.exe
  2⤵
  PID:6244
- C:\Windows\System\CICFFsL.exe
  C:\Windows\System\CICFFsL.exe
  2⤵
  PID:6260
- C:\Windows\System\tuuHEXj.exe
  C:\Windows\System\tuuHEXj.exe
  2⤵
  PID:6276
- C:\Windows\System\uEmllUT.exe
  C:\Windows\System\uEmllUT.exe
  2⤵
  PID:6292
- C:\Windows\System\lJRMoJr.exe
  C:\Windows\System\lJRMoJr.exe
  2⤵
  PID:6308
- C:\Windows\System\luUrqhl.exe
  C:\Windows\System\luUrqhl.exe
  2⤵
  PID:6324
- C:\Windows\System\iZzmexA.exe
  C:\Windows\System\iZzmexA.exe
  2⤵
  PID:6340
- C:\Windows\System\FSYtSpz.exe
  C:\Windows\System\FSYtSpz.exe
  2⤵
  PID:6356
- C:\Windows\System\bynayuO.exe
  C:\Windows\System\bynayuO.exe
  2⤵
  PID:6372
- C:\Windows\System\yqbcozl.exe
  C:\Windows\System\yqbcozl.exe
  2⤵
  PID:6392
- C:\Windows\System\qunZbpH.exe
  C:\Windows\System\qunZbpH.exe
  2⤵
  PID:6408
- C:\Windows\System\LLdziUb.exe
  C:\Windows\System\LLdziUb.exe
  2⤵
  PID:6424
- C:\Windows\System\QkaYkxW.exe
  C:\Windows\System\QkaYkxW.exe
  2⤵
  PID:6440
- C:\Windows\System\ggrbySt.exe
  C:\Windows\System\ggrbySt.exe
  2⤵
  PID:6456
- C:\Windows\System\YPjkvDR.exe
  C:\Windows\System\YPjkvDR.exe
  2⤵
  PID:6472
- C:\Windows\System\FNFbWkW.exe
  C:\Windows\System\FNFbWkW.exe
  2⤵
  PID:6488
- C:\Windows\System\WBJoaky.exe
  C:\Windows\System\WBJoaky.exe
  2⤵
  PID:6504
- C:\Windows\System\ogxWwbf.exe
  C:\Windows\System\ogxWwbf.exe
  2⤵
  PID:6520
- C:\Windows\System\DnAbpLQ.exe
  C:\Windows\System\DnAbpLQ.exe
  2⤵
  PID:6536
- C:\Windows\System\yMkPlxb.exe
  C:\Windows\System\yMkPlxb.exe
  2⤵
  PID:6552
- C:\Windows\System\LtKWSkW.exe
  C:\Windows\System\LtKWSkW.exe
  2⤵
  PID:6568
- C:\Windows\System\fdzuzlf.exe
  C:\Windows\System\fdzuzlf.exe
  2⤵
  PID:6584
- C:\Windows\System\DAuaoyB.exe
  C:\Windows\System\DAuaoyB.exe
  2⤵
  PID:6600
- C:\Windows\System\rtBxXAx.exe
  C:\Windows\System\rtBxXAx.exe
  2⤵
  PID:6616
- C:\Windows\System\KaEyixc.exe
  C:\Windows\System\KaEyixc.exe
  2⤵
  PID:6632
- C:\Windows\System\FfOfJQO.exe
  C:\Windows\System\FfOfJQO.exe
  2⤵
  PID:6648
- C:\Windows\System\aBCWYph.exe
  C:\Windows\System\aBCWYph.exe
  2⤵
  PID:6664
- C:\Windows\System\bPBsemi.exe
  C:\Windows\System\bPBsemi.exe
  2⤵
  PID:6680
- C:\Windows\System\vracQTc.exe
  C:\Windows\System\vracQTc.exe
  2⤵
  PID:6696
- C:\Windows\System\OreyAhG.exe
  C:\Windows\System\OreyAhG.exe
  2⤵
  PID:6712
- C:\Windows\System\vCKtIYr.exe
  C:\Windows\System\vCKtIYr.exe
  2⤵
  PID:6728
- C:\Windows\System\HvWvRfr.exe
  C:\Windows\System\HvWvRfr.exe
  2⤵
  PID:6744
- C:\Windows\System\AGdqGul.exe
  C:\Windows\System\AGdqGul.exe
  2⤵
  PID:6760
- C:\Windows\System\ioRrOJm.exe
  C:\Windows\System\ioRrOJm.exe
  2⤵
  PID:6776
- C:\Windows\System\NzOKJYf.exe
  C:\Windows\System\NzOKJYf.exe
  2⤵
  PID:6792
- C:\Windows\System\pFpJZke.exe
  C:\Windows\System\pFpJZke.exe
  2⤵
  PID:6808
- C:\Windows\System\dtSvPFx.exe
  C:\Windows\System\dtSvPFx.exe
  2⤵
  PID:6824
- C:\Windows\System\xhtMzBw.exe
  C:\Windows\System\xhtMzBw.exe
  2⤵
  PID:6840
- C:\Windows\System\wejzmjy.exe
  C:\Windows\System\wejzmjy.exe
  2⤵
  PID:6856
- C:\Windows\System\jNlRHEk.exe
  C:\Windows\System\jNlRHEk.exe
  2⤵
  PID:6872
- C:\Windows\System\mLmtRTl.exe
  C:\Windows\System\mLmtRTl.exe
  2⤵
  PID:6888
- C:\Windows\System\ajUoOiQ.exe
  C:\Windows\System\ajUoOiQ.exe
  2⤵
  PID:6904
- C:\Windows\System\TpEpqtW.exe
  C:\Windows\System\TpEpqtW.exe
  2⤵
  PID:6920
- C:\Windows\System\LjCjPLI.exe
  C:\Windows\System\LjCjPLI.exe
  2⤵
  PID:6936
- C:\Windows\System\NIEFwpc.exe
  C:\Windows\System\NIEFwpc.exe
  2⤵
  PID:6952
- C:\Windows\System\tELoZec.exe
  C:\Windows\System\tELoZec.exe
  2⤵
  PID:6968
- C:\Windows\System\fKvpibP.exe
  C:\Windows\System\fKvpibP.exe
  2⤵
  PID:6984
- C:\Windows\System\BsAnyNM.exe
  C:\Windows\System\BsAnyNM.exe
  2⤵
  PID:7000
- C:\Windows\System\UUfNYNl.exe
  C:\Windows\System\UUfNYNl.exe
  2⤵
  PID:7016
- C:\Windows\System\EMZHdIi.exe
  C:\Windows\System\EMZHdIi.exe
  2⤵
  PID:7032
- C:\Windows\System\vTvDsEi.exe
  C:\Windows\System\vTvDsEi.exe
  2⤵
  PID:7048
- C:\Windows\System\iNIGFMH.exe
  C:\Windows\System\iNIGFMH.exe
  2⤵
  PID:7064
- C:\Windows\System\kkIjATo.exe
  C:\Windows\System\kkIjATo.exe
  2⤵
  PID:7080
- C:\Windows\System\DOVnMzL.exe
  C:\Windows\System\DOVnMzL.exe
  2⤵
  PID:7096
- C:\Windows\System\PXvEuVU.exe
  C:\Windows\System\PXvEuVU.exe
  2⤵
  PID:7112
- C:\Windows\System\OTsthyQ.exe
  C:\Windows\System\OTsthyQ.exe
  2⤵
  PID:7128
- C:\Windows\System\EKMiNaH.exe
  C:\Windows\System\EKMiNaH.exe
  2⤵
  PID:7144
- C:\Windows\System\rJqsVEM.exe
  C:\Windows\System\rJqsVEM.exe
  2⤵
  PID:7160
- C:\Windows\System\BPYvrlF.exe
  C:\Windows\System\BPYvrlF.exe
  2⤵
  PID:5296
- C:\Windows\System\bvSnodW.exe
  C:\Windows\System\bvSnodW.exe
  2⤵
  PID:6160
- C:\Windows\System\ONyvfxT.exe
  C:\Windows\System\ONyvfxT.exe
  2⤵
  PID:6208
- C:\Windows\System\EhJuwfz.exe
  C:\Windows\System\EhJuwfz.exe
  2⤵
  PID:6272
- C:\Windows\System\PlPJWnB.exe
  C:\Windows\System\PlPJWnB.exe
  2⤵
  PID:6252
- C:\Windows\System\ccdGbXf.exe
  C:\Windows\System\ccdGbXf.exe
  2⤵
  PID:6284
- C:\Windows\System\fOjWoNn.exe
  C:\Windows\System\fOjWoNn.exe
  2⤵
  PID:6316
- C:\Windows\System\IjobkWj.exe
  C:\Windows\System\IjobkWj.exe
  2⤵
  PID:6404
- C:\Windows\System\CEgvGWc.exe
  C:\Windows\System\CEgvGWc.exe
  2⤵
  PID:6468
- C:\Windows\System\LujUYwA.exe
  C:\Windows\System\LujUYwA.exe
  2⤵
  PID:6348
- C:\Windows\System\kCvVuKO.exe
  C:\Windows\System\kCvVuKO.exe
  2⤵
  PID:6484
- C:\Windows\System\bKIUsZD.exe
  C:\Windows\System\bKIUsZD.exe
  2⤵
  PID:6500
- C:\Windows\System\SvGqrRp.exe
  C:\Windows\System\SvGqrRp.exe
  2⤵
  PID:6532
- C:\Windows\System\ynMLwnR.exe
  C:\Windows\System\ynMLwnR.exe
  2⤵
  PID:6548
- C:\Windows\System\OavFELH.exe
  C:\Windows\System\OavFELH.exe
  2⤵
  PID:6580
- C:\Windows\System\HCmJJXw.exe
  C:\Windows\System\HCmJJXw.exe
  2⤵
  PID:6608
- C:\Windows\System\CPcwiDW.exe
  C:\Windows\System\CPcwiDW.exe
  2⤵
  PID:6656
- C:\Windows\System\EAwDnrN.exe
  C:\Windows\System\EAwDnrN.exe
  2⤵
  PID:6720
- C:\Windows\System\ZPcNpcY.exe
  C:\Windows\System\ZPcNpcY.exe
  2⤵
  PID:6676
- C:\Windows\System\HbvLyNb.exe
  C:\Windows\System\HbvLyNb.exe
  2⤵
  PID:6736
- C:\Windows\System\mQKRMvf.exe
  C:\Windows\System\mQKRMvf.exe
  2⤵
  PID:6816
- C:\Windows\System\gAbWywK.exe
  C:\Windows\System\gAbWywK.exe
  2⤵
  PID:6024
- C:\Windows\System\xoMeUIa.exe
  C:\Windows\System\xoMeUIa.exe
  2⤵
  PID:6800
- C:\Windows\System\hNmtjzQ.exe
  C:\Windows\System\hNmtjzQ.exe
  2⤵
  PID:6804
- C:\Windows\System\bFBfRnK.exe
  C:\Windows\System\bFBfRnK.exe
  2⤵
  PID:6916
- C:\Windows\System\EDyikNf.exe
  C:\Windows\System\EDyikNf.exe
  2⤵
  PID:6948
- C:\Windows\System\WFjxSYz.exe
  C:\Windows\System\WFjxSYz.exe
  2⤵
  PID:7012
- C:\Windows\System\mMbFgUA.exe
  C:\Windows\System\mMbFgUA.exe
  2⤵
  PID:6964
- C:\Windows\System\ACNdAaW.exe
  C:\Windows\System\ACNdAaW.exe
  2⤵
  PID:7040
- C:\Windows\System\vijudyF.exe
  C:\Windows\System\vijudyF.exe
  2⤵
  PID:7056
- C:\Windows\System\JDrmegs.exe
  C:\Windows\System\JDrmegs.exe
  2⤵
  PID:7108
- C:\Windows\System\aQObuFq.exe
  C:\Windows\System\aQObuFq.exe
  2⤵
  PID:5196
- C:\Windows\System\CAfalVb.exe
  C:\Windows\System\CAfalVb.exe
  2⤵
  PID:6188
- C:\Windows\System\SuOdYnh.exe
  C:\Windows\System\SuOdYnh.exe
  2⤵
  PID:6436
- C:\Windows\System\yIazWFC.exe
  C:\Windows\System\yIazWFC.exe
  2⤵
  PID:7120
- C:\Windows\System\cnqaNyS.exe
  C:\Windows\System\cnqaNyS.exe
  2⤵
  PID:7156
- C:\Windows\System\WZTmQpM.exe
  C:\Windows\System\WZTmQpM.exe
  2⤵
  PID:6256
- C:\Windows\System\ewMjXxB.exe
  C:\Windows\System\ewMjXxB.exe
  2⤵
  PID:6452
- C:\Windows\System\FSrIKTO.exe
  C:\Windows\System\FSrIKTO.exe
  2⤵
  PID:6416
- C:\Windows\System\GcmBTDm.exe
  C:\Windows\System\GcmBTDm.exe
  2⤵
  PID:6592
- C:\Windows\System\BwzQQPY.exe
  C:\Windows\System\BwzQQPY.exe
  2⤵
  PID:6672
- C:\Windows\System\SDeiiwx.exe
  C:\Windows\System\SDeiiwx.exe
  2⤵
  PID:6628
- C:\Windows\System\AawmDvp.exe
  C:\Windows\System\AawmDvp.exe
  2⤵
  PID:6788
- C:\Windows\System\iDEPRNu.exe
  C:\Windows\System\iDEPRNu.exe
  2⤵
  PID:6884
- C:\Windows\System\vmsvWyf.exe
  C:\Windows\System\vmsvWyf.exe
  2⤵
  PID:7008
- C:\Windows\System\zxcogtP.exe
  C:\Windows\System\zxcogtP.exe
  2⤵
  PID:6848
- C:\Windows\System\DwoXVGY.exe
  C:\Windows\System\DwoXVGY.exe
  2⤵
  PID:7076
- C:\Windows\System\KrfztDe.exe
  C:\Windows\System\KrfztDe.exe
  2⤵
  PID:6960
- C:\Windows\System\EGifbdz.exe
  C:\Windows\System\EGifbdz.exe
  2⤵
  PID:6204
- C:\Windows\System\eyQHbFK.exe
  C:\Windows\System\eyQHbFK.exe
  2⤵
  PID:6336
- C:\Windows\System\ItMXkzG.exe
  C:\Windows\System\ItMXkzG.exe
  2⤵
  PID:6400
- C:\Windows\System\ZIhTqXo.exe
  C:\Windows\System\ZIhTqXo.exe
  2⤵
  PID:6420
- C:\Windows\System\ezeQgHu.exe
  C:\Windows\System\ezeQgHu.exe
  2⤵
  PID:6388
- C:\Windows\System\JQkOALi.exe
  C:\Windows\System\JQkOALi.exe
  2⤵
  PID:6692
- C:\Windows\System\dyFUudh.exe
  C:\Windows\System\dyFUudh.exe
  2⤵
  PID:6996
- C:\Windows\System\ybYDLEu.exe
  C:\Windows\System\ybYDLEu.exe
  2⤵
  PID:7124
- C:\Windows\System\ypzwMEI.exe
  C:\Windows\System\ypzwMEI.exe
  2⤵
  PID:6640
- C:\Windows\System\cgvzpGp.exe
  C:\Windows\System\cgvzpGp.exe
  2⤵
  PID:6304
- C:\Windows\System\agJIcrq.exe
  C:\Windows\System\agJIcrq.exe
  2⤵
  PID:6624
- C:\Windows\System\gHhYhjd.exe
  C:\Windows\System\gHhYhjd.exe
  2⤵
  PID:6928
- C:\Windows\System\BPAHRMg.exe
  C:\Windows\System\BPAHRMg.exe
  2⤵
  PID:6192
- C:\Windows\System\FTGYsQB.exe
  C:\Windows\System\FTGYsQB.exe
  2⤵
  PID:6300
- C:\Windows\System\AlVFnTd.exe
  C:\Windows\System\AlVFnTd.exe
  2⤵
  PID:6740
- C:\Windows\System\FCDzTWS.exe
  C:\Windows\System\FCDzTWS.exe
  2⤵
  PID:7140
- C:\Windows\System\uKueqLg.exe
  C:\Windows\System\uKueqLg.exe
  2⤵
  PID:6496
- C:\Windows\System\FEaIFVO.exe
  C:\Windows\System\FEaIFVO.exe
  2⤵
  PID:7184
- C:\Windows\System\rEwqsyJ.exe
  C:\Windows\System\rEwqsyJ.exe
  2⤵
  PID:7200
- C:\Windows\System\zafmUKK.exe
  C:\Windows\System\zafmUKK.exe
  2⤵
  PID:7216
- C:\Windows\System\fbUgnZs.exe
  C:\Windows\System\fbUgnZs.exe
  2⤵
  PID:7232
- C:\Windows\System\YmsqnaM.exe
  C:\Windows\System\YmsqnaM.exe
  2⤵
  PID:7248
- C:\Windows\System\oRQRnGE.exe
  C:\Windows\System\oRQRnGE.exe
  2⤵
  PID:7264
- C:\Windows\System\rpoZQCD.exe
  C:\Windows\System\rpoZQCD.exe
  2⤵
  PID:7280
- C:\Windows\System\iABnJMp.exe
  C:\Windows\System\iABnJMp.exe
  2⤵
  PID:7296
- C:\Windows\System\oEBTulQ.exe
  C:\Windows\System\oEBTulQ.exe
  2⤵
  PID:7312
- C:\Windows\System\beqPWEg.exe
  C:\Windows\System\beqPWEg.exe
  2⤵
  PID:7328
- C:\Windows\System\nUfNBNi.exe
  C:\Windows\System\nUfNBNi.exe
  2⤵
  PID:7344
- C:\Windows\System\akNSiSS.exe
  C:\Windows\System\akNSiSS.exe
  2⤵
  PID:7368
- C:\Windows\System\KuvQxUR.exe
  C:\Windows\System\KuvQxUR.exe
  2⤵
  PID:7388
- C:\Windows\System\EUtjCLB.exe
  C:\Windows\System\EUtjCLB.exe
  2⤵
  PID:7404
- C:\Windows\System\bayGpkL.exe
  C:\Windows\System\bayGpkL.exe
  2⤵
  PID:7420
- C:\Windows\System\NeIqtgq.exe
  C:\Windows\System\NeIqtgq.exe
  2⤵
  PID:7440
- C:\Windows\System\alVLCwP.exe
  C:\Windows\System\alVLCwP.exe
  2⤵
  PID:7456
- C:\Windows\System\GmnrdyJ.exe
  C:\Windows\System\GmnrdyJ.exe
  2⤵
  PID:7472
- C:\Windows\System\nrvhZgK.exe
  C:\Windows\System\nrvhZgK.exe
  2⤵
  PID:7488
- C:\Windows\System\tKjPLUA.exe
  C:\Windows\System\tKjPLUA.exe
  2⤵
  PID:7504
- C:\Windows\System\mhIZvHk.exe
  C:\Windows\System\mhIZvHk.exe
  2⤵
  PID:7520
- C:\Windows\System\FdqzWwC.exe
  C:\Windows\System\FdqzWwC.exe
  2⤵
  PID:7536
- C:\Windows\System\xqMMQug.exe
  C:\Windows\System\xqMMQug.exe
  2⤵
  PID:7552
- C:\Windows\System\FBVSVKp.exe
  C:\Windows\System\FBVSVKp.exe
  2⤵
  PID:7568
- C:\Windows\System\rWqpNMn.exe
  C:\Windows\System\rWqpNMn.exe
  2⤵
  PID:7584
- C:\Windows\System\IUWArxS.exe
  C:\Windows\System\IUWArxS.exe
  2⤵
  PID:7600
- C:\Windows\System\iIjYhDf.exe
  C:\Windows\System\iIjYhDf.exe
  2⤵
  PID:7620
- C:\Windows\System\UQpFZYZ.exe
  C:\Windows\System\UQpFZYZ.exe
  2⤵
  PID:7636
- C:\Windows\System\JWJnwQa.exe
  C:\Windows\System\JWJnwQa.exe
  2⤵
  PID:7652
- C:\Windows\System\CjWxmDM.exe
  C:\Windows\System\CjWxmDM.exe
  2⤵
  PID:7668
- C:\Windows\System\wlspqQs.exe
  C:\Windows\System\wlspqQs.exe
  2⤵
  PID:7688
- C:\Windows\System\sMfUesp.exe
  C:\Windows\System\sMfUesp.exe
  2⤵
  PID:7704
- C:\Windows\System\KBleHqI.exe
  C:\Windows\System\KBleHqI.exe
  2⤵
  PID:7720
- C:\Windows\System\tFgGyoY.exe
  C:\Windows\System\tFgGyoY.exe
  2⤵
  PID:7736
- C:\Windows\System\wsGirTv.exe
  C:\Windows\System\wsGirTv.exe
  2⤵
  PID:7752
- C:\Windows\System\zjwwvkZ.exe
  C:\Windows\System\zjwwvkZ.exe
  2⤵
  PID:7788
- C:\Windows\System\bShOKGN.exe
  C:\Windows\System\bShOKGN.exe
  2⤵
  PID:7804
- C:\Windows\System\QrfpFcw.exe
  C:\Windows\System\QrfpFcw.exe
  2⤵
  PID:7820
- C:\Windows\System\yhNQfqN.exe
  C:\Windows\System\yhNQfqN.exe
  2⤵
  PID:7836
- C:\Windows\System\cjEwvND.exe
  C:\Windows\System\cjEwvND.exe
  2⤵
  PID:7852
- C:\Windows\System\LQRsciX.exe
  C:\Windows\System\LQRsciX.exe
  2⤵
  PID:7868
- C:\Windows\System\jmouwud.exe
  C:\Windows\System\jmouwud.exe
  2⤵
  PID:7884
- C:\Windows\System\JMPxSli.exe
  C:\Windows\System\JMPxSli.exe
  2⤵
  PID:7900
- C:\Windows\System\RSBMQGD.exe
  C:\Windows\System\RSBMQGD.exe
  2⤵
  PID:7916
- C:\Windows\System\uXTiymD.exe
  C:\Windows\System\uXTiymD.exe
  2⤵
  PID:7932
- C:\Windows\System\ZPERNYt.exe
  C:\Windows\System\ZPERNYt.exe
  2⤵
  PID:7948
- C:\Windows\System\HacaiRu.exe
  C:\Windows\System\HacaiRu.exe
  2⤵
  PID:7968
- C:\Windows\System\UaMYkgm.exe
  C:\Windows\System\UaMYkgm.exe
  2⤵
  PID:7984
- C:\Windows\System\iFjjdUQ.exe
  C:\Windows\System\iFjjdUQ.exe
  2⤵
  PID:8000
- C:\Windows\System\PiRRSPC.exe
  C:\Windows\System\PiRRSPC.exe
  2⤵
  PID:8020
- C:\Windows\System\eUOlMQS.exe
  C:\Windows\System\eUOlMQS.exe
  2⤵
  PID:8036
- C:\Windows\System\VAbIkRV.exe
  C:\Windows\System\VAbIkRV.exe
  2⤵
  PID:8052
- C:\Windows\System\Mymbfga.exe
  C:\Windows\System\Mymbfga.exe
  2⤵
  PID:8068
- C:\Windows\System\BaOWgRO.exe
  C:\Windows\System\BaOWgRO.exe
  2⤵
  PID:8084
- C:\Windows\System\lhFmPtS.exe
  C:\Windows\System\lhFmPtS.exe
  2⤵
  PID:8100
- C:\Windows\System\LAKYAHc.exe
  C:\Windows\System\LAKYAHc.exe
  2⤵
  PID:8124
- C:\Windows\System\jinlvlL.exe
  C:\Windows\System\jinlvlL.exe
  2⤵
  PID:8140
- C:\Windows\System\krQKHWX.exe
  C:\Windows\System\krQKHWX.exe
  2⤵
  PID:8156
- C:\Windows\System\IWZoaFU.exe
  C:\Windows\System\IWZoaFU.exe
  2⤵
  PID:8172
- C:\Windows\System\QKarJpz.exe
  C:\Windows\System\QKarJpz.exe
  2⤵
  PID:8188
- C:\Windows\System\uhLmuOG.exe
  C:\Windows\System\uhLmuOG.exe
  2⤵
  PID:7224
- C:\Windows\System\WdNApjo.exe
  C:\Windows\System\WdNApjo.exe
  2⤵
  PID:7256
- C:\Windows\System\GnBmMyK.exe
  C:\Windows\System\GnBmMyK.exe
  2⤵
  PID:7240
- C:\Windows\System\WjMwioe.exe
  C:\Windows\System\WjMwioe.exe
  2⤵
  PID:7272
- C:\Windows\System\yxnKHvk.exe
  C:\Windows\System\yxnKHvk.exe
  2⤵
  PID:7324
- C:\Windows\System\wLglrQr.exe
  C:\Windows\System\wLglrQr.exe
  2⤵
  PID:7308
- C:\Windows\System\UUnZXJu.exe
  C:\Windows\System\UUnZXJu.exe
  2⤵
  PID:7376
- C:\Windows\System\YdmpvBO.exe
  C:\Windows\System\YdmpvBO.exe
  2⤵
  PID:7412
- C:\Windows\System\zBSkUuW.exe
  C:\Windows\System\zBSkUuW.exe
  2⤵
  PID:7428
- C:\Windows\System\OlwbiyD.exe
  C:\Windows\System\OlwbiyD.exe
  2⤵
  PID:7468
- C:\Windows\System\FnhsbAZ.exe
  C:\Windows\System\FnhsbAZ.exe
  2⤵
  PID:7560
- C:\Windows\System\UihBQuo.exe
  C:\Windows\System\UihBQuo.exe
  2⤵
  PID:7448
- C:\Windows\System\SpcXVTQ.exe
  C:\Windows\System\SpcXVTQ.exe
  2⤵
  PID:7484
- C:\Windows\System\fqGFgQh.exe
  C:\Windows\System\fqGFgQh.exe
  2⤵
  PID:7616
- C:\Windows\System\hjZofFn.exe
  C:\Windows\System\hjZofFn.exe
  2⤵
  PID:7580
- C:\Windows\System\jWhTTtW.exe
  C:\Windows\System\jWhTTtW.exe
  2⤵
  PID:7664
- C:\Windows\System\vjxzXRC.exe
  C:\Windows\System\vjxzXRC.exe
  2⤵
  PID:7648
- C:\Windows\System\PEPEQIk.exe
  C:\Windows\System\PEPEQIk.exe
  2⤵
  PID:7712
- C:\Windows\System\YxQYIgi.exe
  C:\Windows\System\YxQYIgi.exe
  2⤵
  PID:7744
- C:\Windows\System\amvKotk.exe
  C:\Windows\System\amvKotk.exe
  2⤵
  PID:7776
- C:\Windows\System\ryGobKk.exe
  C:\Windows\System\ryGobKk.exe
  2⤵
  PID:7816
- C:\Windows\System\gRPdeIF.exe
  C:\Windows\System\gRPdeIF.exe
  2⤵
  PID:7828
- C:\Windows\System\icampTq.exe
  C:\Windows\System\icampTq.exe
  2⤵
  PID:7844
- C:\Windows\System\hvYNczM.exe
  C:\Windows\System\hvYNczM.exe
  2⤵
  PID:7944
- C:\Windows\System\ZzcJUeu.exe
  C:\Windows\System\ZzcJUeu.exe
  2⤵
  PID:7976
- C:\Windows\System\EgnqloE.exe
  C:\Windows\System\EgnqloE.exe
  2⤵
  PID:7924
- C:\Windows\System\hKfZnWw.exe
  C:\Windows\System\hKfZnWw.exe
  2⤵
  PID:7996
- C:\Windows\System\xLcPZZh.exe
  C:\Windows\System\xLcPZZh.exe
  2⤵
  PID:8048
- C:\Windows\System\pcOZAgL.exe
  C:\Windows\System\pcOZAgL.exe
  2⤵
  PID:8092
- C:\Windows\System\zHNNPlp.exe
  C:\Windows\System\zHNNPlp.exe
  2⤵
  PID:8112
- C:\Windows\System\NdGMuuD.exe
  C:\Windows\System\NdGMuuD.exe
  2⤵
  PID:8180
- C:\Windows\System\cNxFlXA.exe
  C:\Windows\System\cNxFlXA.exe
  2⤵
  PID:7288
- C:\Windows\System\eXSWKGV.exe
  C:\Windows\System\eXSWKGV.exe
  2⤵
  PID:7196
- C:\Windows\System\hAAaeNC.exe
  C:\Windows\System\hAAaeNC.exe
  2⤵
  PID:7396
- C:\Windows\System\FBKzQxS.exe
  C:\Windows\System\FBKzQxS.exe
  2⤵
  PID:7612
- C:\Windows\System\EiumQzN.exe
  C:\Windows\System\EiumQzN.exe
  2⤵
  PID:7676
- C:\Windows\System\ijFolTy.exe
  C:\Windows\System\ijFolTy.exe
  2⤵
  PID:7880
- C:\Windows\System\FyeBXZJ.exe
  C:\Windows\System\FyeBXZJ.exe
  2⤵
  PID:7896
- C:\Windows\System\zvkABLy.exe
  C:\Windows\System\zvkABLy.exe
  2⤵
  PID:7320
- C:\Windows\System\fVXzvIQ.exe
  C:\Windows\System\fVXzvIQ.exe
  2⤵
  PID:7452
- C:\Windows\System\aOlIBPN.exe
  C:\Windows\System\aOlIBPN.exe
  2⤵
  PID:7516
- C:\Windows\System\FuPAwRf.exe
  C:\Windows\System\FuPAwRf.exe
  2⤵
  PID:7760
- C:\Windows\System\LZgDgOH.exe
  C:\Windows\System\LZgDgOH.exe
  2⤵
  PID:7908
- C:\Windows\System\RvALCyK.exe
  C:\Windows\System\RvALCyK.exe
  2⤵
  PID:8060
- C:\Windows\System\taIKFRw.exe
  C:\Windows\System\taIKFRw.exe
  2⤵
  PID:8032
- C:\Windows\System\TedHHmj.exe
  C:\Windows\System\TedHHmj.exe
  2⤵
  PID:8080
- C:\Windows\System\aesGghf.exe
  C:\Windows\System\aesGghf.exe
  2⤵
  PID:8164
- C:\Windows\System\bJwlUAb.exe
  C:\Windows\System\bJwlUAb.exe
  2⤵
  PID:8096
- C:\Windows\System\LCknorN.exe
  C:\Windows\System\LCknorN.exe
  2⤵
  PID:8012
- C:\Windows\System\unPVlGL.exe
  C:\Windows\System\unPVlGL.exe
  2⤵
  PID:7768
- C:\Windows\System\wyamNVq.exe
  C:\Windows\System\wyamNVq.exe
  2⤵
  PID:7072
- C:\Windows\System\CrpoBfy.exe
  C:\Windows\System\CrpoBfy.exe
  2⤵
  PID:7960
- C:\Windows\System\ywfkxFY.exe
  C:\Windows\System\ywfkxFY.exe
  2⤵
  PID:8168
- C:\Windows\System\nrEbDJi.exe
  C:\Windows\System\nrEbDJi.exe
  2⤵
  PID:7732
- C:\Windows\System\afqmlox.exe
  C:\Windows\System\afqmlox.exe
  2⤵
  PID:8200
- C:\Windows\System\UlZtzZa.exe
  C:\Windows\System\UlZtzZa.exe
  2⤵
  PID:8216
- C:\Windows\System\tZAzmxr.exe
  C:\Windows\System\tZAzmxr.exe
  2⤵
  PID:8232
- C:\Windows\System\nHTLrkw.exe
  C:\Windows\System\nHTLrkw.exe
  2⤵
  PID:8264
- C:\Windows\System\rTODWUF.exe
  C:\Windows\System\rTODWUF.exe
  2⤵
  PID:8280
- C:\Windows\System\jMRrgpZ.exe
  C:\Windows\System\jMRrgpZ.exe
  2⤵
  PID:8296
- C:\Windows\System\VYMvjKf.exe
  C:\Windows\System\VYMvjKf.exe
  2⤵
  PID:8312
- C:\Windows\System\TuAwIKn.exe
  C:\Windows\System\TuAwIKn.exe
  2⤵
  PID:8328
- C:\Windows\System\BSrSXUk.exe
  C:\Windows\System\BSrSXUk.exe
  2⤵
  PID:8344
- C:\Windows\System\KJmwwbp.exe
  C:\Windows\System\KJmwwbp.exe
  2⤵
  PID:8360
- C:\Windows\System\VdMuNQB.exe
  C:\Windows\System\VdMuNQB.exe
  2⤵
  PID:8408
- C:\Windows\System\PXpErch.exe
  C:\Windows\System\PXpErch.exe
  2⤵
  PID:8428
- C:\Windows\System\sHQuyYZ.exe
  C:\Windows\System\sHQuyYZ.exe
  2⤵
  PID:8444
- C:\Windows\System\TWBBNpg.exe
  C:\Windows\System\TWBBNpg.exe
  2⤵
  PID:8468
- C:\Windows\System\MlmIEql.exe
  C:\Windows\System\MlmIEql.exe
  2⤵
  PID:8504
- C:\Windows\System\aCBRfUn.exe
  C:\Windows\System\aCBRfUn.exe
  2⤵
  PID:8524
- C:\Windows\System\vkgujXP.exe
  C:\Windows\System\vkgujXP.exe
  2⤵
  PID:8540
- C:\Windows\System\wfNWZus.exe
  C:\Windows\System\wfNWZus.exe
  2⤵
  PID:8556
- C:\Windows\System\bCQhloR.exe
  C:\Windows\System\bCQhloR.exe
  2⤵
  PID:8572
- C:\Windows\System\eSAnuDe.exe
  C:\Windows\System\eSAnuDe.exe
  2⤵
  PID:8588
- C:\Windows\System\wxnYMXD.exe
  C:\Windows\System\wxnYMXD.exe
  2⤵
  PID:8604
- C:\Windows\System\IlIpnXY.exe
  C:\Windows\System\IlIpnXY.exe
  2⤵
  PID:8624
- C:\Windows\System\DGJwrYa.exe
  C:\Windows\System\DGJwrYa.exe
  2⤵
  PID:8640
- C:\Windows\System\nuPYApp.exe
  C:\Windows\System\nuPYApp.exe
  2⤵
  PID:8656
- C:\Windows\System\lUeylkk.exe
  C:\Windows\System\lUeylkk.exe
  2⤵
  PID:8672
- C:\Windows\System\vLfNjml.exe
  C:\Windows\System\vLfNjml.exe
  2⤵
  PID:8688
- C:\Windows\System\rJWZgVk.exe
  C:\Windows\System\rJWZgVk.exe
  2⤵
  PID:8704
- C:\Windows\System\VtUMeYB.exe
  C:\Windows\System\VtUMeYB.exe
  2⤵
  PID:8720
- C:\Windows\System\NEWOgsb.exe
  C:\Windows\System\NEWOgsb.exe
  2⤵
  PID:8740
- C:\Windows\System\Asqyzue.exe
  C:\Windows\System\Asqyzue.exe
  2⤵
  PID:8764
- C:\Windows\System\hqNRqGM.exe
  C:\Windows\System\hqNRqGM.exe
  2⤵
  PID:8780
- C:\Windows\System\RokQpxg.exe
  C:\Windows\System\RokQpxg.exe
  2⤵
  PID:8796
- C:\Windows\System\PDEClFP.exe
  C:\Windows\System\PDEClFP.exe
  2⤵
  PID:8820
- C:\Windows\System\IEmoMrP.exe
  C:\Windows\System\IEmoMrP.exe
  2⤵
  PID:8836
- C:\Windows\System\vHbdFxp.exe
  C:\Windows\System\vHbdFxp.exe
  2⤵
  PID:8852
- C:\Windows\System\lAbMrHD.exe
  C:\Windows\System\lAbMrHD.exe
  2⤵
  PID:8868
- C:\Windows\System\aGDJYgS.exe
  C:\Windows\System\aGDJYgS.exe
  2⤵
  PID:8884
- C:\Windows\System\IHGkxfO.exe
  C:\Windows\System\IHGkxfO.exe
  2⤵
  PID:8900
- C:\Windows\System\XGkqiOt.exe
  C:\Windows\System\XGkqiOt.exe
  2⤵
  PID:8916
- C:\Windows\System\taWpNCD.exe
  C:\Windows\System\taWpNCD.exe
  2⤵
  PID:8932
- C:\Windows\System\lMksHUL.exe
  C:\Windows\System\lMksHUL.exe
  2⤵
  PID:8948
- C:\Windows\System\hqbSzwq.exe
  C:\Windows\System\hqbSzwq.exe
  2⤵
  PID:8964
- C:\Windows\System\oVSXRso.exe
  C:\Windows\System\oVSXRso.exe
  2⤵
  PID:8980
- C:\Windows\System\imgmODB.exe
  C:\Windows\System\imgmODB.exe
  2⤵
  PID:8996
- C:\Windows\System\rdulnzz.exe
  C:\Windows\System\rdulnzz.exe
  2⤵
  PID:9012
- C:\Windows\System\GdAJRJm.exe
  C:\Windows\System\GdAJRJm.exe
  2⤵
  PID:9028
- C:\Windows\System\FSuaBRi.exe
  C:\Windows\System\FSuaBRi.exe
  2⤵
  PID:9044
- C:\Windows\System\ACFtDod.exe
  C:\Windows\System\ACFtDod.exe
  2⤵
  PID:9064
- C:\Windows\System\PcagnPB.exe
  C:\Windows\System\PcagnPB.exe
  2⤵
  PID:9080
- C:\Windows\System\LvTSuyD.exe
  C:\Windows\System\LvTSuyD.exe
  2⤵
  PID:9096
- C:\Windows\System\oQIcwwH.exe
  C:\Windows\System\oQIcwwH.exe
  2⤵
  PID:9176
- C:\Windows\System\YqetAhb.exe
  C:\Windows\System\YqetAhb.exe
  2⤵
  PID:9192
- C:\Windows\System\UsBHMwk.exe
  C:\Windows\System\UsBHMwk.exe
  2⤵
  PID:9212
- C:\Windows\System\kBLxlgD.exe
  C:\Windows\System\kBLxlgD.exe
  2⤵
  PID:7356
- C:\Windows\System\KPBtEfw.exe
  C:\Windows\System\KPBtEfw.exe
  2⤵
  PID:7496
- C:\Windows\System\yOKUcNZ.exe
  C:\Windows\System\yOKUcNZ.exe
  2⤵
  PID:7812
- C:\Windows\System\SVplDAx.exe
  C:\Windows\System\SVplDAx.exe
  2⤵
  PID:8044
- C:\Windows\System\yIRDbLt.exe
  C:\Windows\System\yIRDbLt.exe
  2⤵
  PID:7544
- C:\Windows\System\RXBOlXL.exe
  C:\Windows\System\RXBOlXL.exe
  2⤵
  PID:8108
- C:\Windows\System\ZJqAJEG.exe
  C:\Windows\System\ZJqAJEG.exe
  2⤵
  PID:8240
- C:\Windows\System\UAdzjSF.exe
  C:\Windows\System\UAdzjSF.exe
  2⤵
  PID:8252
- C:\Windows\System\KipLyqz.exe
  C:\Windows\System\KipLyqz.exe
  2⤵
  PID:8320
- C:\Windows\System\BSYeDAo.exe
  C:\Windows\System\BSYeDAo.exe
  2⤵
  PID:8308
- C:\Windows\System\azcrxAF.exe
  C:\Windows\System\azcrxAF.exe
  2⤵
  PID:8340
- C:\Windows\System\gDiNzId.exe
  C:\Windows\System\gDiNzId.exe
  2⤵
  PID:8384
- C:\Windows\System\suIjLGH.exe
  C:\Windows\System\suIjLGH.exe
  2⤵
  PID:8400
- C:\Windows\System\AqpSRKd.exe
  C:\Windows\System\AqpSRKd.exe
  2⤵
  PID:8476
- C:\Windows\System\GuDydXk.exe
  C:\Windows\System\GuDydXk.exe
  2⤵
  PID:8488
- C:\Windows\System\SRVwKhr.exe
  C:\Windows\System\SRVwKhr.exe
  2⤵
  PID:8516
- C:\Windows\System\YHrFEHb.exe
  C:\Windows\System\YHrFEHb.exe
  2⤵
  PID:8584
- C:\Windows\System\giOiZof.exe
  C:\Windows\System\giOiZof.exe
  2⤵
  PID:8652
- C:\Windows\System\WkNkbsv.exe
  C:\Windows\System\WkNkbsv.exe
  2⤵
  PID:8748
- C:\Windows\System\tUJTkat.exe
  C:\Windows\System\tUJTkat.exe
  2⤵
  PID:8760
- C:\Windows\System\FMKFBTe.exe
  C:\Windows\System\FMKFBTe.exe
  2⤵
  PID:8696
- C:\Windows\System\CfbFfBR.exe
  C:\Windows\System\CfbFfBR.exe
  2⤵
  PID:8772
- C:\Windows\System\lSLoOba.exe
  C:\Windows\System\lSLoOba.exe
  2⤵
  PID:8596
- C:\Windows\System\mLAHLPE.exe
  C:\Windows\System\mLAHLPE.exe
  2⤵
  PID:8788
- C:\Windows\System\mCFUIBj.exe
  C:\Windows\System\mCFUIBj.exe
  2⤵
  PID:8804
- C:\Windows\System\yVNjzrO.exe
  C:\Windows\System\yVNjzrO.exe
  2⤵
  PID:8864
- C:\Windows\System\ncjCWKj.exe
  C:\Windows\System\ncjCWKj.exe
  2⤵
  PID:8896
- C:\Windows\System\JZLSjZB.exe
  C:\Windows\System\JZLSjZB.exe
  2⤵
  PID:8960
- C:\Windows\System\oJGPFoI.exe
  C:\Windows\System\oJGPFoI.exe
  2⤵
  PID:9024
- C:\Windows\System\pcVNOfx.exe
  C:\Windows\System\pcVNOfx.exe
  2⤵
  PID:8844
- C:\Windows\System\EiGmZHD.exe
  C:\Windows\System\EiGmZHD.exe
  2⤵
  PID:8976
- C:\Windows\System\mTmMiAn.exe
  C:\Windows\System\mTmMiAn.exe
  2⤵
  PID:9052
- C:\Windows\System\hprMyAe.exe
  C:\Windows\System\hprMyAe.exe
  2⤵
  PID:9092
- C:\Windows\System\ZTWpbOs.exe
  C:\Windows\System\ZTWpbOs.exe
  2⤵
  PID:8464
- C:\Windows\System\OiKrnsw.exe
  C:\Windows\System\OiKrnsw.exe
  2⤵
  PID:7576
- C:\Windows\System\waSGQzP.exe
  C:\Windows\System\waSGQzP.exe
  2⤵
  PID:8152
- C:\Windows\System\gLCnUkb.exe
  C:\Windows\System\gLCnUkb.exe
  2⤵
  PID:8224
- C:\Windows\System\JQCJGyH.exe
  C:\Windows\System\JQCJGyH.exe
  2⤵
  PID:8276
- C:\Windows\System\NwdawLi.exe
  C:\Windows\System\NwdawLi.exe
  2⤵
  PID:9112
- C:\Windows\System\mfhtODn.exe
  C:\Windows\System\mfhtODn.exe
  2⤵
  PID:9172
- C:\Windows\System\NkrDjie.exe
  C:\Windows\System\NkrDjie.exe
  2⤵
  PID:8736
- C:\Windows\System\nutDkLY.exe
  C:\Windows\System\nutDkLY.exe
  2⤵
  PID:8860
- C:\Windows\System\OafYfHT.exe
  C:\Windows\System\OafYfHT.exe
  2⤵
  PID:8484
- C:\Windows\System\hYRFBKO.exe
  C:\Windows\System\hYRFBKO.exe
  2⤵
  PID:8716
- C:\Windows\System\DgegpJd.exe
  C:\Windows\System\DgegpJd.exe
  2⤵
  PID:8564
- C:\Windows\System\rZmjqzm.exe
  C:\Windows\System\rZmjqzm.exe
  2⤵
  PID:8892
- C:\Windows\System\oxSxhSD.exe
  C:\Windows\System\oxSxhSD.exe
  2⤵
  PID:8828
- C:\Windows\System\PdoDTfP.exe
  C:\Windows\System\PdoDTfP.exe
  2⤵
  PID:8440
- C:\Windows\System\cMLqxNF.exe
  C:\Windows\System\cMLqxNF.exe
  2⤵
  PID:8956
- C:\Windows\System\CwuUBhK.exe
  C:\Windows\System\CwuUBhK.exe
  2⤵
  PID:8880
- C:\Windows\System\AkrzxQY.exe
  C:\Windows\System\AkrzxQY.exe
  2⤵
  PID:9060
- C:\Windows\System\EhhaMKZ.exe
  C:\Windows\System\EhhaMKZ.exe
  2⤵
  PID:7208
- C:\Windows\System\OjKwfHj.exe
  C:\Windows\System\OjKwfHj.exe
  2⤵
  PID:9108
- C:\Windows\System\QZZPwFE.exe
  C:\Windows\System\QZZPwFE.exe
  2⤵
  PID:8292
- C:\Windows\System\emwNKIp.exe
  C:\Windows\System\emwNKIp.exe
  2⤵
  PID:9128
- C:\Windows\System\NgHNNnr.exe
  C:\Windows\System\NgHNNnr.exe
  2⤵
  PID:9136
- C:\Windows\System\HKSAmEs.exe
  C:\Windows\System\HKSAmEs.exe
  2⤵
  PID:9152
- C:\Windows\System\pTYCvJy.exe
  C:\Windows\System\pTYCvJy.exe
  2⤵
  PID:9204
- C:\Windows\System\rKOeVFo.exe
  C:\Windows\System\rKOeVFo.exe
  2⤵
  PID:7292
- C:\Windows\System\VGPnAnG.exe
  C:\Windows\System\VGPnAnG.exe
  2⤵
  PID:8520
- C:\Windows\System\nkvKjJR.exe
  C:\Windows\System\nkvKjJR.exe
  2⤵
  PID:9220
- C:\Windows\System\XTinHQW.exe
  C:\Windows\System\XTinHQW.exe
  2⤵
  PID:9236
- C:\Windows\System\iQImHVM.exe
  C:\Windows\System\iQImHVM.exe
  2⤵
  PID:9252
- C:\Windows\System\QkCTisY.exe
  C:\Windows\System\QkCTisY.exe
  2⤵
  PID:9268
- C:\Windows\System\tZtCkVJ.exe
  C:\Windows\System\tZtCkVJ.exe
  2⤵
  PID:9284
- C:\Windows\System\IHrQtVf.exe
  C:\Windows\System\IHrQtVf.exe
  2⤵
  PID:9304
- C:\Windows\System\mRZFQoa.exe
  C:\Windows\System\mRZFQoa.exe
  2⤵
  PID:9320
- C:\Windows\System\bORXljY.exe
  C:\Windows\System\bORXljY.exe
  2⤵
  PID:9336
- C:\Windows\System\hyeqbUH.exe
  C:\Windows\System\hyeqbUH.exe
  2⤵
  PID:9352
- C:\Windows\System\ChxMTPz.exe
  C:\Windows\System\ChxMTPz.exe
  2⤵
  PID:9368
- C:\Windows\System\mBQRmuq.exe
  C:\Windows\System\mBQRmuq.exe
  2⤵
  PID:9396
- C:\Windows\System\lTldKmG.exe
  C:\Windows\System\lTldKmG.exe
  2⤵
  PID:9412
- C:\Windows\System\oioMwMx.exe
  C:\Windows\System\oioMwMx.exe
  2⤵
  PID:9428
- C:\Windows\System\BDLlMwH.exe
  C:\Windows\System\BDLlMwH.exe
  2⤵
  PID:9444
- C:\Windows\System\OPJjiFX.exe
  C:\Windows\System\OPJjiFX.exe
  2⤵
  PID:9464
- C:\Windows\System\EIQHtjm.exe
  C:\Windows\System\EIQHtjm.exe
  2⤵
  PID:9480
- C:\Windows\System\TmsAmlj.exe
  C:\Windows\System\TmsAmlj.exe
  2⤵
  PID:9496
- C:\Windows\System\hZNwYik.exe
  C:\Windows\System\hZNwYik.exe
  2⤵
  PID:9516
- C:\Windows\System\omSMYWg.exe
  C:\Windows\System\omSMYWg.exe
  2⤵
  PID:9532
- C:\Windows\System\pmFyUvQ.exe
  C:\Windows\System\pmFyUvQ.exe
  2⤵
  PID:9740
- C:\Windows\System\AirJABe.exe
  C:\Windows\System\AirJABe.exe
  2⤵
  PID:9764
- C:\Windows\System\ePhWagu.exe
  C:\Windows\System\ePhWagu.exe
  2⤵
  PID:9788
- C:\Windows\System\MiPPUzJ.exe
  C:\Windows\System\MiPPUzJ.exe
  2⤵
  PID:9812
- C:\Windows\System\DMymWAY.exe
  C:\Windows\System\DMymWAY.exe
  2⤵
  PID:9952
- C:\Windows\System\DGMfgcL.exe
  C:\Windows\System\DGMfgcL.exe
  2⤵
  PID:10140
- C:\Windows\System\upiPKCK.exe
  C:\Windows\System\upiPKCK.exe
  2⤵
  PID:10156
- C:\Windows\System\xjgSgXk.exe
  C:\Windows\System\xjgSgXk.exe
  2⤵
  PID:10172
- C:\Windows\System\MelBqza.exe
  C:\Windows\System\MelBqza.exe
  2⤵
  PID:10188
- C:\Windows\System\skcVIFA.exe
  C:\Windows\System\skcVIFA.exe
  2⤵
  PID:10204
- C:\Windows\System\ApmuoOp.exe
  C:\Windows\System\ApmuoOp.exe
  2⤵
  PID:10220
- C:\Windows\System\VGKbHhp.exe
  C:\Windows\System\VGKbHhp.exe
  2⤵
  PID:10236
- C:\Windows\System\QURwrOU.exe
  C:\Windows\System\QURwrOU.exe
  2⤵
  PID:8208
- C:\Windows\System\pqnxjtQ.exe
  C:\Windows\System\pqnxjtQ.exe
  2⤵
  PID:8380
- C:\Windows\System\uQobzFK.exe
  C:\Windows\System\uQobzFK.exe
  2⤵
  PID:8668
- C:\Windows\System\BLcoxyR.exe
  C:\Windows\System\BLcoxyR.exe
  2⤵
  PID:8396
- C:\Windows\System\RIiZDnb.exe
  C:\Windows\System\RIiZDnb.exe
  2⤵
  PID:9140
- C:\Windows\System\aMsaRVw.exe
  C:\Windows\System\aMsaRVw.exe
  2⤵
  PID:9120
- C:\Windows\System\DztbtBh.exe
  C:\Windows\System\DztbtBh.exe
  2⤵
  PID:9260
- C:\Windows\System\aFdHzNG.exe
  C:\Windows\System\aFdHzNG.exe
  2⤵
  PID:9328
- C:\Windows\System\oGWCSWm.exe
  C:\Windows\System\oGWCSWm.exe
  2⤵
  PID:9364
- C:\Windows\System\sExuUbE.exe
  C:\Windows\System\sExuUbE.exe
  2⤵
  PID:9040
- C:\Windows\System\FmKJwxb.exe
  C:\Windows\System\FmKJwxb.exe
  2⤵
  PID:9148
- C:\Windows\System\TMYaqnx.exe
  C:\Windows\System\TMYaqnx.exe
  2⤵
  PID:9344
- C:\Windows\System\DpihbrL.exe
  C:\Windows\System\DpihbrL.exe
  2⤵
  PID:9388
- C:\Windows\System\oNIkeum.exe
  C:\Windows\System\oNIkeum.exe
  2⤵
  PID:9312
- C:\Windows\System\ZOeeTiC.exe
  C:\Windows\System\ZOeeTiC.exe
  2⤵
  PID:9392
- C:\Windows\System\YoOkyjQ.exe
  C:\Windows\System\YoOkyjQ.exe
  2⤵
  PID:9456
- C:\Windows\System\KvRCNEJ.exe
  C:\Windows\System\KvRCNEJ.exe
  2⤵
  PID:9476
- C:\Windows\System\TEzwpNv.exe
  C:\Windows\System\TEzwpNv.exe
  2⤵
  PID:9508
- C:\Windows\System\BwfcrFX.exe
  C:\Windows\System\BwfcrFX.exe
  2⤵
  PID:9760
- C:\Windows\System\lFJwMcY.exe
  C:\Windows\System\lFJwMcY.exe
  2⤵
  PID:9800
- C:\Windows\System\YAbZhIo.exe
  C:\Windows\System\YAbZhIo.exe
  2⤵
  PID:9624
- C:\Windows\System\LCUkNTB.exe
  C:\Windows\System\LCUkNTB.exe
  2⤵
  PID:9672
- C:\Windows\System\xZyqHOf.exe
  C:\Windows\System\xZyqHOf.exe
  2⤵
  PID:9544
- C:\Windows\System\PuCZjkc.exe
  C:\Windows\System\PuCZjkc.exe
  2⤵
  PID:9548
- C:\Windows\System\FziDhnU.exe
  C:\Windows\System\FziDhnU.exe
  2⤵
  PID:9556
- C:\Windows\System\GbuStXz.exe
  C:\Windows\System\GbuStXz.exe
  2⤵
  PID:9568
- C:\Windows\System\zLrSjJG.exe
  C:\Windows\System\zLrSjJG.exe
  2⤵
  PID:9916
- C:\Windows\System\bcfmHGu.exe
  C:\Windows\System\bcfmHGu.exe
  2⤵
  PID:9604
- C:\Windows\System\HAQgJIH.exe
  C:\Windows\System\HAQgJIH.exe
  2⤵
  PID:9636
- C:\Windows\System\BhWJURX.exe
  C:\Windows\System\BhWJURX.exe
  2⤵
  PID:9656
- C:\Windows\System\tVnljay.exe
  C:\Windows\System\tVnljay.exe
  2⤵
  PID:9676
- C:\Windows\System\fukQNri.exe
  C:\Windows\System\fukQNri.exe
  2⤵
  PID:9692
- C:\Windows\System\SuyFnqY.exe
  C:\Windows\System\SuyFnqY.exe
  2⤵
  PID:9712
- C:\Windows\System\shVKqKH.exe
  C:\Windows\System\shVKqKH.exe
  2⤵
  PID:9728
- C:\Windows\System\lnksOIG.exe
  C:\Windows\System\lnksOIG.exe
  2⤵
  PID:9824
- C:\Windows\System\dcZRPMu.exe
  C:\Windows\System\dcZRPMu.exe
  2⤵
  PID:9864
- C:\Windows\System\VTdlqFw.exe
  C:\Windows\System\VTdlqFw.exe
  2⤵
  PID:9888
- C:\Windows\System\kGWtrFU.exe
  C:\Windows\System\kGWtrFU.exe
  2⤵
  PID:9900
- C:\Windows\System\WXOcYWF.exe
  C:\Windows\System\WXOcYWF.exe
  2⤵
  PID:9928
- C:\Windows\System\acNoCia.exe
  C:\Windows\System\acNoCia.exe
  2⤵
  PID:9920
- C:\Windows\System\PxAHDdN.exe
  C:\Windows\System\PxAHDdN.exe
  2⤵
  PID:1952
- C:\Windows\System\bYItGew.exe
  C:\Windows\System\bYItGew.exe
  2⤵
  PID:9976
- C:\Windows\System\iKMIRTs.exe
  C:\Windows\System\iKMIRTs.exe
  2⤵
  PID:9996
- C:\Windows\System\xOhFSLb.exe
  C:\Windows\System\xOhFSLb.exe
  2⤵
  PID:10008
- C:\Windows\System\fhuTsSw.exe
  C:\Windows\System\fhuTsSw.exe
  2⤵
  PID:10044
- C:\Windows\System\YZnHuWt.exe
  C:\Windows\System\YZnHuWt.exe
  2⤵
  PID:10152
- C:\Windows\System\VlyQmiN.exe
  C:\Windows\System\VlyQmiN.exe
  2⤵
  PID:10212
- C:\Windows\System\pLHLwbY.exe
  C:\Windows\System\pLHLwbY.exe
  2⤵
  PID:7416
- C:\Windows\System\yAmboPA.exe
  C:\Windows\System\yAmboPA.exe
  2⤵
  PID:9232
- C:\Windows\System\zaOfOVu.exe
  C:\Windows\System\zaOfOVu.exe
  2⤵
  PID:10004
- C:\Windows\System\gNYMjSo.exe
  C:\Windows\System\gNYMjSo.exe
  2⤵
  PID:10040
- C:\Windows\System\kdsxTEO.exe
  C:\Windows\System\kdsxTEO.exe
  2⤵
  PID:9360
- C:\Windows\System\bzmAJHw.exe
  C:\Windows\System\bzmAJHw.exe
  2⤵
  PID:8712
- C:\Windows\System\lwjngXu.exe
  C:\Windows\System\lwjngXu.exe
  2⤵
  PID:1792
- C:\Windows\System\FUuqIak.exe
  C:\Windows\System\FUuqIak.exe
  2⤵
  PID:10104
- C:\Windows\System\rUvEngb.exe
  C:\Windows\System\rUvEngb.exe
  2⤵
  PID:10116
- C:\Windows\System\vFhMjpr.exe
  C:\Windows\System\vFhMjpr.exe
  2⤵
  PID:10060
- C:\Windows\System\CgmJtve.exe
  C:\Windows\System\CgmJtve.exe
  2⤵
  PID:9452
- C:\Windows\System\jioHZrs.exe
  C:\Windows\System\jioHZrs.exe
  2⤵
  PID:10200
- C:\Windows\System\wqlvKes.exe
  C:\Windows\System\wqlvKes.exe
  2⤵
  PID:10092
- C:\Windows\System\qZUzndf.exe
  C:\Windows\System\qZUzndf.exe
  2⤵
  PID:10132
- C:\Windows\System\UMmmXVZ.exe
  C:\Windows\System\UMmmXVZ.exe
  2⤵
  PID:8620
- C:\Windows\System\KsozzqI.exe
  C:\Windows\System\KsozzqI.exe
  2⤵
  PID:8496
- C:\Windows\System\WXKtfWf.exe
  C:\Windows\System\WXKtfWf.exe
  2⤵
  PID:7304
- C:\Windows\System\yxfxXnR.exe
  C:\Windows\System\yxfxXnR.exe
  2⤵
  PID:2332
- C:\Windows\System\lquobve.exe
  C:\Windows\System\lquobve.exe
  2⤵
  PID:9756
- C:\Windows\System\MpvvQiJ.exe
  C:\Windows\System\MpvvQiJ.exe
  2⤵
  PID:2496
- C:\Windows\System\bNpkNJk.exe
  C:\Windows\System\bNpkNJk.exe
  2⤵
  PID:1660
- C:\Windows\System\IEbuvDC.exe
  C:\Windows\System\IEbuvDC.exe
  2⤵
  PID:9156
- C:\Windows\System\MjhKJRD.exe
  C:\Windows\System\MjhKJRD.exe
  2⤵
  PID:1824
- C:\Windows\System\sHExtvU.exe
  C:\Windows\System\sHExtvU.exe
  2⤵
  PID:9804
- C:\Windows\System\iPajirI.exe
  C:\Windows\System\iPajirI.exe
  2⤵
  PID:9440
- C:\Windows\System\nkonYkr.exe
  C:\Windows\System\nkonYkr.exe
  2⤵
  PID:9720
- C:\Windows\System\lzOKCht.exe
  C:\Windows\System\lzOKCht.exe
  2⤵
  PID:9840
- C:\Windows\System\fBIiWxR.exe
  C:\Windows\System\fBIiWxR.exe
  2⤵
  PID:9732
- C:\Windows\System\DyeiFiZ.exe
  C:\Windows\System\DyeiFiZ.exe
  2⤵
  PID:9880
- C:\Windows\System\wHoxxEh.exe
  C:\Windows\System\wHoxxEh.exe
  2⤵
  PID:9660
- C:\Windows\System\eEIuOqA.exe
  C:\Windows\System\eEIuOqA.exe
  2⤵
  PID:9784
- C:\Windows\System\fpEtlTX.exe
  C:\Windows\System\fpEtlTX.exe
  2⤵
  PID:9564
- C:\Windows\System\qdWxwot.exe
  C:\Windows\System\qdWxwot.exe
  2⤵
  PID:9844
- C:\Windows\System\avQatRi.exe
  C:\Windows\System\avQatRi.exe
  2⤵
  PID:9724
- C:\Windows\System\THlVmmT.exe
  C:\Windows\System\THlVmmT.exe
  2⤵
  PID:9892
- C:\Windows\System\xdMfADS.exe
  C:\Windows\System\xdMfADS.exe
  2⤵
  PID:9924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BLIukDG.exe

Filesize
2.4MB

MD5
2339376edf226e443aeab5026217a802

SHA1
63d56d6d6def8d1f62ddcfb1e94228f263bc8ad5

SHA256
3ebd4010d5933e34697668c47323539cc607781bbaaea9d3bb0babe6532d592a

SHA512
a37d3e88980ea07e00f62b0927137a5afee6123306255a5a422e0971e85bbd8205d6131c718a36fd8bcd25666117cebe042e760f168aaa06d6af3813fe430e20

Download Submit
C:\Windows\system\BPMfTNJ.exe

Filesize
2.4MB

MD5
7a1df7f5c065ca2766ca2981da9b0130

SHA1
1aa5577cee729b12f522bea4d39b4efa3e8dcd54

SHA256
a2bd08fc10a04ed49c91debf02fe8c12403910948d2eadf5cd605d241108ad88

SHA512
4afa117a5b45912485689d8981098532ef646fe930b8531acdff66227b90f2017a7685f803c1c985bfa901bac7783284b73e049e85c169cfeef8b74a374b75b5

Download Submit
C:\Windows\system\DguWyHY.exe

Filesize
2.4MB

MD5
561a26c761a4af9aabfc65f54b2c5836

SHA1
b1d935b96bb198464fc872a595e461a22f15f6c9

SHA256
671b1ed6d1452482d9c6244e2dcf748191dba599a616f48d3a8653ebc6af54eb

SHA512
f194e1ace45a58b8b850169274bcc110baeb17c87e01a3ab3964ce65059e553f329d0d30ca08c037cc0a6c0808588d25a487827d442485fd88ff25f0196fc21f

Download Submit
C:\Windows\system\GkFuVPO.exe

Filesize
2.4MB

MD5
553bdbfbeb60f917d0f3d56e7289c495

SHA1
286acbb2c1e4eab9cda1c2ad39bef3742324ded2

SHA256
2ce3eea84efc197a15de7716acfbc577389441ac25716e128a614b44b4b583eb

SHA512
8cedaeb27126641e545f74c59b0fe56a953e7a7f98ebb04471c21ab276d82366fb36338c2760d0fddbb3dd1bc0169c3ef9bf8bc4d703e4f2d192837168c4686d

Download Submit
C:\Windows\system\HuAUMuB.exe

Filesize
2.4MB

MD5
ec680400208668d527afb87b25caf60c

SHA1
4cae84f8724f0661843530e3fa49ce22e61187d4

SHA256
ab70800f17611bc380001319688d70d51bb84e0bd7c45ec3c5ec1c5bc8e72b35

SHA512
98fedd79c78d3ffbe7abc35303388202a3c7ceb0a9381c1525bfb7746c6a4c4ce505dd1b42d2370cf52dc3723c518b7ae8523495e6cc669b872cff8cc2d938e2

Download Submit
C:\Windows\system\IMhLuiK.exe

Filesize
2.4MB

MD5
63815b04443d4ce5f000e68fe66eb860

SHA1
f57adbac467ade5163088beb90ba081ebf034221

SHA256
6628065d5b91ee3b4779fe577266c5fcf514ce53095df5f6f876d5d111da4756

SHA512
e9e3fd67aedfc9bc0b1c68fc771e608ed0032bd1b6c53b5c35dd794819eb4bdd425d1dc158c2a9fcb932313b23044638714bf6ebffaabe2686a87b0397af2cea

Download Submit
C:\Windows\system\LCWubRo.exe

Filesize
2.4MB

MD5
090695087e1fdbd6e2d4e98d532813a5

SHA1
d59813c3bf53c885a4a92d8261b8a470535eb723

SHA256
f9faff959bfa8ab4e9521156107781d3f6ee44e7878d35dfbdcd700da87ab807

SHA512
ee176a332c6aa54431da44c1c4b15ba5049ddad787faa7719915c231cec97911b8299eec4ecce3610d54b64a0c94321f39f154400c63acd48f4709bfdc9708f9

Download Submit
C:\Windows\system\NeGbQSD.exe

Filesize
2.4MB

MD5
1b3db41f28a75a4e39d4d8540b1935f9

SHA1
910b2afdfc976f543910e77c9ee70d32d55a3a07

SHA256
bfa2f9a6dfcc4bf783455c53f6f8c6a7f9d1adbcd3490cd7538b3b4642e6b663

SHA512
b90acaab73af44bdd62ac8edb740ba78ad41f171cd3df848e2375f4f990e1c90acc983e0c2ee99a9abc3555884e1bca273fedc7a7ac2f7eb4e20840fbee02766

Download Submit
C:\Windows\system\UXXKbzd.exe

Filesize
2.4MB

MD5
2533472f2e6f6829627b8d79221f7b3b

SHA1
3ea8daf13a9ae236402aa714081b805353ba05b1

SHA256
1cdce49e3c3e2c290da4436a7fa364a472eae56eb4605aea12c38fb56a8b6ab5

SHA512
6ab49bfd47c4bbdcb337dfcff9045a924796e2a2bfda9ab179b1bc6fba1e6eabe84eb3af192c58b76b3a41c6817b3ba1c7d15dddd983f2564ea8616f9e93bcb0

Download Submit
C:\Windows\system\VchtpnF.exe

Filesize
2.4MB

MD5
d770d9124ca3aaec4878203a1be99943

SHA1
73bfaf520b2e237b58ea6c45aa59a07de2c01b88

SHA256
c29370f20f3cfa77fa974f18b917619e62a9f128361a5a8fa04b1abe137fb2b8

SHA512
89be35ed7a731fced6da7f7179b363db0956beee359c2fb451cac6a26366875cd9078d174414ceb75035028c97d8e77dd1a6645acd159fa76681bd996fa6041b

Download Submit
C:\Windows\system\YOFqACn.exe

Filesize
2.4MB

MD5
fcc49df37951f929195e8fa91df079cd

SHA1
a9235d379083ff93f8cab394d3ac1b35b8f90063

SHA256
d72db1afe14cec3c10f0f9b5b837eb940f98cc8daf1933c92ac6d28bd70c89dd

SHA512
7f9ad41f806f6bf4c1ecb7cd6aae8a4d3a960e5cc99535458987ebd1437e25062a8d97673d238cabd28a1f4c4d81c608ed13f272fae1b48ead67e67acdb47060

Download Submit
C:\Windows\system\ZoylUZW.exe

Filesize
2.4MB

MD5
a6bfaaaa5a7c7d215ff44beaf14c96e5

SHA1
16b361eefc5ee9701e73e254a61001d8bfe7146c

SHA256
a17e758e3effa44a0eca60928da5ea16783560447e23fd3b63d67aeda0d76b77

SHA512
2353f3cc3a12e085e9469d9c2b1ddd37abd00f776b15340966a6fe8afede8a95764b483d9fbc389f50d89e51c069b9d058128330789f2b2180b3b44076dcff41

Download Submit
C:\Windows\system\aWzIdGO.exe

Filesize
2.4MB

MD5
c750fe54e04c1a62fb4a373f27a7f155

SHA1
dd8a23dfa93550421b445774b68f8118b57060f3

SHA256
e1377a56db1efde8545366953d7a11f76b24b2221c0bec0b4c3ee9ba4db31104

SHA512
960e413d09a10adb7c770466b577e8571372582077f889230b7986ae5d13b3323af9ff902a33103e508a8842d1435e25fc405829530777256654c80955e299eb

Download Submit
C:\Windows\system\dfztLyX.exe

Filesize
2.4MB

MD5
680e7f53093854941d072fb6debff44f

SHA1
c0ea06358197af749b2ba82ccc88173011d66167

SHA256
95183c16ea61498f9cce4063c1d097029f7bc9695113142f954b415ad31d2a01

SHA512
baba24587be18903598628b3608d6a39e8fc0816024d0e55a8979d8668a13b9c9d1f50d65f83653a79f029a596590489ea77e08cd5ccb8c84fed365e52399d28

Download Submit
C:\Windows\system\eXKszrz.exe

Filesize
2.4MB

MD5
04d3dd5bbbe0899d2a17fa419ea673f3

SHA1
6d610195c65900911cc5d07ad0a5462256b89dec

SHA256
da3b81c68c71333f1f069c3dbe927c1562922d498a24636926f4121e554ff731

SHA512
a7b6b4cbd4d42970f81f8415d10d82a4cca096baa784781661ca39bdaf2e781f974fe4147c3c7b86f67e258fb2bcf162c919ffe7b9eddcf07f98890afdf72551

Download Submit
C:\Windows\system\gCiMdOf.exe

Filesize
2.4MB

MD5
760ad6adf27f9c72ceb6aafcc972857e

SHA1
63e3174d1ec8a06b2f0482bd56e7c9af01bd0de2

SHA256
dc400d1fdcc33c70b7f28e88ec9b9f6259f766e33ed3128bd1eff9aff85c6d5b

SHA512
c2e3c0b186e93bb1e33fb47205a682922fc88a522f7ca87954307800bedbf554303a111f9831d865dd4e57b5c94f97459b2b82f84274ae73db25ec7fbc3b10ae

Download Submit
C:\Windows\system\hckEjYp.exe

Filesize
2.4MB

MD5
3a4478cf6741663dcc0296dd687a1128

SHA1
e628b8ac7bbfe9f2bf68ed49a6f89db23afdddff

SHA256
a332acf6c5386b2af459994ee92aa0f79053868d6daa97ca3554ed61287896ce

SHA512
64a85e5372450e3d686ee2786d937474903bbf1bddbe4f7b29a28924bba1ed8a4a7bdf35b1208b226bdc88560f02327ad1c43d9f5e6c99d98cde86003176e834

Download Submit
C:\Windows\system\iawesAu.exe

Filesize
2.4MB

MD5
41ffe02e2ac6b0c644f87932d94e5713

SHA1
215c737abb074328ce4b0b07b4cac474d182e328

SHA256
062bbe64c7679432b6a7fd1d24b2db8233f7294a1f868ff48bf484f7c5a68fe2

SHA512
1e0c7f5a648de06e7034103519580750b27c98c31af350675259d4d502aa23119518db0175f5cc0a039f2f63b9cef37f1c2ddf32d3b9a4272cccb9351bb37657

Download Submit
C:\Windows\system\ilQQLYo.exe

Filesize
2.4MB

MD5
670823b7118b85a8ee1dc805dcf7a7b8

SHA1
14b90c4a862d3d6579d0b66ef2d296ef2aca23a7

SHA256
1bc06239e2ca37ddb32df3eca520e453c60b843805b40dba9026dfac9dbcbe32

SHA512
b76f85cc526dee931e6f91ee0a58b16f8136b1a2e5eb582b0cb25cac14c501da906b5f51d099713e8cfee6b1b6a5f2271506f9d0abb364c625c1c9bc45d183de

Download Submit
C:\Windows\system\kujFFOj.exe

Filesize
2.4MB

MD5
f0e217a1c459977f474708bd9e5420eb

SHA1
64c6f42bdb4341d208cf8932206ed1505d01aef3

SHA256
23886430a0fbe795a57848c75d7dc572458a55ffa5dc4b358fb9210f5220f9bb

SHA512
b421d1ab88215cb465beb4c26f96a25e1d5604db244e658951085bb68a71ae3edd845b929bd634837cea67f3c63855aa63fe794fbcc6b86d8d60efac9cc54800

Download Submit
C:\Windows\system\mKiJJKg.exe

Filesize
2.4MB

MD5
8cd4203f96fc0da18e620031ab1af0cc

SHA1
73b2ab07f149c473445532c185cafaf75426a0e9

SHA256
cb6e52c5532e03fda104784f6961931392720e91c318560dd744dfee5a3b9cd5

SHA512
95a4679abb7276b3de7511cdbce06e56f9ffc7abac54c43552382c085a21c74cc4621e15a9ce8076af1a022139d57eebb5b1dc144778cd3a4852eb57d731e8f2

Download Submit
C:\Windows\system\nDKHIQB.exe

Filesize
2.4MB

MD5
745195474c07da3f8850eb290e580682

SHA1
57359e6e75f176c9be27d4891a9ac80fb237f97e

SHA256
4d9f164613bca7764b60f8dff0760d34c8b0114bf80de381c07f08e3d96f33c7

SHA512
0b2461bd431ff2406c3ccc39908b9861f570ef05aff104656aaf73f2d477afdfcccdcb5e740666dff263e556af601052f022714486317402d2b4a713dce2aff8

Download Submit
C:\Windows\system\oHPYnFo.exe

Filesize
2.4MB

MD5
ab1c9477eff8f73544682a8484dcf0fb

SHA1
576e4287580ed0e85fedd2f29ae2f06b70afafd2

SHA256
0c44beb3d74af07c847279524fcfe4736e53157746829765ec1f13ff15c4a08f

SHA512
8dae61548645a57b6eb158a7485a981307a5d1334ee10b23ca16b013752c9d9896119b1ddaa20e8653319a18bd374948be338a625494af320ee55e1221fd0ea5

Download Submit
C:\Windows\system\pGeXCtq.exe

Filesize
2.4MB

MD5
bd004098c2edf3839c0972ae551533b7

SHA1
142be881a1daacbd7434691814915f5684a49e5d

SHA256
1cd4735a69926e9d24a4973bb0545951032823efe741c0a55776e9d212e434de

SHA512
044aa84247ef7785859e4a9d1b1383038022625bf555467895c0c0191280d81dfc7ef5726546bd37252d05655df3e4dc37dc8aa9504b7537ebd245c4c8680944

Download Submit
C:\Windows\system\tvvqSXU.exe

Filesize
2.4MB

MD5
1d274db7985e86aba59aa5355de4b5ea

SHA1
c5b9c59cf747b13b35e80ce1fe00ba313a415c9d

SHA256
c07b014ff8fcd2e71226c589ac5a65e0dea3a6bd3304cda63366ab9a0235a813

SHA512
543cd1b2a83cbf1763c3927fd2732cd7cff4ac0bb266841b447810e3032c34c657989fc1d9bec9ef3627b8f8ce7540407e764aa4d1c13db2c3f7e07b0a35db07

Download Submit
C:\Windows\system\xWYNwPS.exe

Filesize
2.4MB

MD5
16fb690f5489f50648abf8e0db795715

SHA1
e36ed2f59490481696949cc5e096b1e32e78c781

SHA256
70488490646b80349c9d7082b0e29a339dc5ba261e954621a5dc4bed59a6cf6e

SHA512
a1fc4f6d060c3b99e62564b1ebaed493e496844bd7b8e8204f7bafff3fb4c175f219bd663ab094f94014e8a279c25fe96bc996b7d9e1390dc1491bc66457fab6

Download Submit
\Windows\system\MNHnQnD.exe

Filesize
2.4MB

MD5
8d38199ad6fe28f32ffa5882579e0209

SHA1
6774640a25cb1fb021329af3ce6a66f7dd6a5694

SHA256
e1ceec28ad2f2e65f79ee73f34e9ec4b746e6cc9fccf673a9cf88a1ddfaff85f

SHA512
a9197a54d4378bdb1bcf90d939dec4eb3691dfb7f949b9d9120879205fe4c45b47d1e7f7f214d6ac56802d4cb662539b73db6a286acede8d3360a3c8369f73c1

Download Submit
\Windows\system\PjCeFld.exe

Filesize
2.4MB

MD5
0b324be06faed5f68133b6e3d3c095aa

SHA1
999ca06a429bc5c4ded090fd1d7475d7318ae1ca

SHA256
53397c28830371a73d72a7ab1dcd3ac5353afe5620f5d545f09e3c5b6f8bc214

SHA512
972975f8720fd5e0370718ffb97f5653ec2817ded70b83e57e5a30fc6d7b36a4d7a2b02165a9d83eb031a4adce945e96632ce1b341fdf4448e840d7aeedd94da

Download Submit
\Windows\system\ZSacqtl.exe

Filesize
2.4MB

MD5
f335dd115d53817905b3f3f4c2272227

SHA1
c4de1eb7a822c4f6e56e09195220a3cd9f83e7f1

SHA256
74ca893a44dfb3feba86cf1313b6d27fa727e3e1e3c03d4747e8a6299eacbfe8

SHA512
06acb11765b2c39049cbf8c62b59b652e62a721ce5858f8b96e2823c4451c48caeb16e317c444dcaf06ba227c27dad073aac69be3c8cb46ba64d9fc1ab792894

Download Submit
\Windows\system\elFkVpm.exe

Filesize
2.4MB

MD5
790a3e954a80ecc1f31210df3eb90892

SHA1
ab47b536c5baf82d108f44bbf902b3fc76dc188f

SHA256
fbc2312f3a380f204b5628860f5cc6ecef91e0a53defcbde7c6bbc9aafd66842

SHA512
fa3c6f0f51e8148846222a2639850616cc7038b2ce21790f19e252b38188596fc9395381f45a83299d8ef08d61d6f419b2712e0d23870f912eab16a01e3f9ecc

Download Submit
\Windows\system\lRVxzEF.exe

Filesize
2.4MB

MD5
dbd7223d0bb6ad8cdf2e035ed43cf8a9

SHA1
fbca8aacdc976c5b12837f9003594f0fba82dc5e

SHA256
7f6856155480a89a2f9c208528eb8efbcb90e5022ad22254b0a9b37a2413f097

SHA512
2774f3a65bad2f9b262485bce42096be0239486f7e19a50d96dc709a6be73cbf200f6f607597038215b1b4aff174a2e569a694d484755f82bb9855d5da2002d4

Download Submit
\Windows\system\mlIjiyp.exe

Filesize
2.4MB

MD5
bf4fcb230ee1763a842b4d798e82132e

SHA1
98533f59725f38e3817f193e2d815a2ff93bb8c4

SHA256
db5538f821daeb923e95d6052da04658d965a1ecbe752840c7801107a1b9ad0a

SHA512
7d362c85c95b25f2bbd17306ba0b83ec992910880d6d5cbacba699f328afb913b79bef29b304c0a9092c8ad7ebbaedf130a426357793a71a441a4881bb4d4f45

Download Submit
memory/1184-3484-0x000000013FD60000-0x0000000140152000-memory.dmp

Filesize
3.9MB

Download
memory/1184-9-0x000000013FD60000-0x0000000140152000-memory.dmp

Filesize
3.9MB

Download
memory/1328-4100-0x000000013FF20000-0x0000000140312000-memory.dmp

Filesize
3.9MB

Download
memory/1328-81-0x000000013FF20000-0x0000000140312000-memory.dmp

Filesize
3.9MB

Download
memory/1996-84-0x0000000002C60000-0x0000000003052000-memory.dmp

Filesize
3.9MB

Download
memory/1996-0-0x000000013FE00000-0x00000001401F2000-memory.dmp

Filesize
3.9MB

Download
memory/1996-76-0x000000013F9E0000-0x000000013FDD2000-memory.dmp

Filesize
3.9MB

Download
memory/1996-74-0x000000013F460000-0x000000013F852000-memory.dmp

Filesize
3.9MB

Download
memory/1996-1-0x0000000000180000-0x0000000000190000-memory.dmp

Filesize
64KB

Download
memory/1996-57-0x0000000002C60000-0x0000000003052000-memory.dmp

Filesize
3.9MB

Download
memory/1996-85-0x000000013F450000-0x000000013F842000-memory.dmp

Filesize
3.9MB

Download
memory/1996-51-0x0000000002C60000-0x0000000003052000-memory.dmp

Filesize
3.9MB

Download
memory/1996-87-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/1996-86-0x0000000002C60000-0x0000000003052000-memory.dmp

Filesize
3.9MB

Download
memory/1996-26-0x000000013F500000-0x000000013F8F2000-memory.dmp

Filesize
3.9MB

Download
memory/1996-70-0x0000000002C60000-0x0000000003052000-memory.dmp

Filesize
3.9MB

Download
memory/1996-8-0x0000000002C60000-0x0000000003052000-memory.dmp

Filesize
3.9MB

Download
memory/1996-13-0x0000000002C60000-0x0000000003052000-memory.dmp

Filesize
3.9MB

Download
memory/1996-80-0x0000000002C60000-0x0000000003052000-memory.dmp

Filesize
3.9MB

Download
memory/2072-4098-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/2128-4097-0x000000013FAD0000-0x000000013FEC2000-memory.dmp

Filesize
3.9MB

Download
memory/2128-53-0x000000013FAD0000-0x000000013FEC2000-memory.dmp

Filesize
3.9MB

Download
memory/2168-4096-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/2168-15-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/2476-320-0x0000000002410000-0x0000000002418000-memory.dmp

Filesize
32KB

Download
memory/2476-50-0x000007FEF6050000-0x000007FEF69ED000-memory.dmp

Filesize
9.6MB

Download
memory/2476-27-0x000007FEF630E000-0x000007FEF630F000-memory.dmp

Filesize
4KB

Download
memory/2476-83-0x000007FEF6050000-0x000007FEF69ED000-memory.dmp

Filesize
9.6MB

Download
memory/2476-88-0x000000001B480000-0x000000001B762000-memory.dmp

Filesize
2.9MB

Download
memory/2476-94-0x000007FEF6050000-0x000007FEF69ED000-memory.dmp

Filesize
9.6MB

Download
memory/2476-1378-0x000007FEF6050000-0x000007FEF69ED000-memory.dmp

Filesize
9.6MB

Download
memory/2544-4099-0x000000013F9E0000-0x000000013FDD2000-memory.dmp

Filesize
3.9MB

Download
memory/2544-77-0x000000013F9E0000-0x000000013FDD2000-memory.dmp

Filesize
3.9MB

Download
memory/2560-73-0x000000013FF70000-0x0000000140362000-memory.dmp

Filesize
3.9MB

Download
memory/2560-4095-0x000000013FF70000-0x0000000140362000-memory.dmp

Filesize
3.9MB

Download
memory/2588-4066-0x000000013F460000-0x000000013F852000-memory.dmp

Filesize
3.9MB

Download
memory/2588-75-0x000000013F460000-0x000000013F852000-memory.dmp

Filesize
3.9MB

Download
memory/2620-3465-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/2620-62-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/2696-78-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-2732-0x000000013F500000-0x000000013F8F2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-82-0x000000013F500000-0x000000013F8F2000-memory.dmp

Filesize
3.9MB

Download