xmrig | 8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00

Analysis

max time kernel
150s
max time network
143s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
08/08/2024, 00:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
Size

3.8MB
MD5

1f2c853cecf687e2b8fc5c9e7013b993
SHA1

050a6e4989e5343eff6b4e138560f2038de5ab06
SHA256

8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00
SHA512

259ee151b1e7a29a6876f1dd546b5bdc34370b06b272db76807a6aea593ffd202e9abf3d9a7bb6525105f6dd02515aed2fd10eea3867a7995104e790e74b8d31
SSDEEP

98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW0:7bBeSFk4

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 59 IoCs

miner

resource	yara_rule
behavioral1/memory/2388-1-0x000000013FD60000-0x0000000140156000-memory.dmp	xmrig
behavioral1/files/0x00070000000120fe-3.dat	xmrig
behavioral1/files/0x0008000000018b2b-6.dat	xmrig
behavioral1/memory/2388-9-0x0000000002630000-0x0000000002A26000-memory.dmp	xmrig
behavioral1/memory/1264-14-0x000000013FD90000-0x0000000140186000-memory.dmp	xmrig
behavioral1/memory/2748-13-0x000000013F1B0000-0x000000013F5A6000-memory.dmp	xmrig
behavioral1/files/0x0008000000018b5c-8.dat	xmrig
behavioral1/files/0x0007000000018bec-27.dat	xmrig
behavioral1/files/0x0006000000019234-40.dat	xmrig
behavioral1/files/0x0006000000019221-37.dat	xmrig
behavioral1/files/0x0037000000018715-26.dat	xmrig
behavioral1/files/0x0006000000019217-36.dat	xmrig
behavioral1/memory/2388-55-0x000000013F620000-0x000000013FA16000-memory.dmp	xmrig
behavioral1/memory/2776-50-0x000000013FBE0000-0x000000013FFD6000-memory.dmp	xmrig
behavioral1/files/0x000800000001923a-61.dat	xmrig
behavioral1/memory/2728-60-0x000000013F850000-0x000000013FC46000-memory.dmp	xmrig
behavioral1/memory/2464-59-0x000000013F340000-0x000000013F736000-memory.dmp	xmrig
behavioral1/memory/2628-57-0x000000013F620000-0x000000013FA16000-memory.dmp	xmrig
behavioral1/memory/2904-46-0x000000013F6C0000-0x000000013FAB6000-memory.dmp	xmrig
behavioral1/memory/2476-69-0x000000013F2E0000-0x000000013F6D6000-memory.dmp	xmrig
behavioral1/memory/1060-76-0x000000013F400000-0x000000013F7F6000-memory.dmp	xmrig
behavioral1/memory/2588-82-0x000000013F490000-0x000000013F886000-memory.dmp	xmrig
behavioral1/files/0x0005000000019f7e-96.dat	xmrig
behavioral1/files/0x000500000001a092-112.dat	xmrig
behavioral1/files/0x000500000001a48c-154.dat	xmrig
behavioral1/memory/1264-529-0x000000013FD90000-0x0000000140186000-memory.dmp	xmrig
behavioral1/files/0x000500000001a4a3-168.dat	xmrig
behavioral1/files/0x000500000001a49d-164.dat	xmrig
behavioral1/files/0x000500000001a48e-160.dat	xmrig
behavioral1/files/0x000500000001a481-152.dat	xmrig
behavioral1/files/0x000500000001a47f-148.dat	xmrig
behavioral1/files/0x000500000001a463-144.dat	xmrig
behavioral1/files/0x000500000001a421-140.dat	xmrig
behavioral1/files/0x000500000001a41b-136.dat	xmrig
behavioral1/files/0x000500000001a417-132.dat	xmrig
behavioral1/files/0x000500000001a410-128.dat	xmrig
behavioral1/files/0x000500000001a40f-124.dat	xmrig
behavioral1/files/0x000500000001a34d-120.dat	xmrig
behavioral1/files/0x000500000001a2fb-116.dat	xmrig
behavioral1/files/0x000500000001a072-108.dat	xmrig
behavioral1/files/0x000500000001a069-104.dat	xmrig
behavioral1/files/0x0005000000019f9a-100.dat	xmrig
behavioral1/files/0x0005000000019db1-92.dat	xmrig
behavioral1/memory/1924-89-0x000000013F040000-0x000000013F436000-memory.dmp	xmrig
behavioral1/memory/2388-88-0x000000013F040000-0x000000013F436000-memory.dmp	xmrig
behavioral1/memory/2748-87-0x000000013F1B0000-0x000000013F5A6000-memory.dmp	xmrig
behavioral1/files/0x0005000000019d9d-85.dat	xmrig
behavioral1/files/0x0006000000019ce4-79.dat	xmrig
behavioral1/memory/2388-74-0x000000013FD60000-0x0000000140156000-memory.dmp	xmrig
behavioral1/files/0x0007000000004e74-73.dat	xmrig
behavioral1/memory/2736-33-0x000000013F3D0000-0x000000013F7C6000-memory.dmp	xmrig
behavioral1/memory/1264-5298-0x000000013FD90000-0x0000000140186000-memory.dmp	xmrig
behavioral1/memory/2476-5292-0x000000013F2E0000-0x000000013F6D6000-memory.dmp	xmrig
behavioral1/memory/2904-5390-0x000000013F6C0000-0x000000013FAB6000-memory.dmp	xmrig
behavioral1/memory/2736-5386-0x000000013F3D0000-0x000000013F7C6000-memory.dmp	xmrig
behavioral1/memory/2728-5583-0x000000013F850000-0x000000013FC46000-memory.dmp	xmrig
behavioral1/memory/1924-9038-0x000000013F040000-0x000000013F436000-memory.dmp	xmrig
behavioral1/memory/2588-9080-0x000000013F490000-0x000000013F886000-memory.dmp	xmrig
behavioral1/memory/2388-9125-0x000000013F040000-0x000000013F436000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
536	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2748	lIFqKoq.exe
1264	EfOvhjm.exe
2736	JQDXPrT.exe
2904	yMiCXXI.exe
2464	GuIVgFF.exe
2776	vRZQnzs.exe
2628	KMtRZrR.exe
2728	agUJESL.exe
2476	IKcdwGL.exe
1060	EJujHyB.exe
2588	MQjnRgL.exe
1924	sJdtPbA.exe
2648	VFvjEzv.exe
1320	eYQXkcG.exe
1932	ayaojmx.exe
2908	dOiVJpL.exe
1332	YlHfXAi.exe
1552	IjDiTOo.exe
1840	PpVTrST.exe
388	iHDczCx.exe
2788	pUqnOdt.exe
564	CrXGDJA.exe
2144	tGBJWZG.exe
2152	bUQFjrU.exe
2148	qFveDwD.exe
2440	iZodoDF.exe
2216	ZtLYCON.exe
2200	NVPQiuW.exe
1356	YyGdUUy.exe
2084	Fuinjcg.exe
1604	zOuJPAE.exe
912	hSCjKGC.exe
1984	ClIlLCx.exe
2364	PQxOUky.exe
1744	zqyCcdq.exe
1708	bvEjuSY.exe
1532	ReJhQFn.exe
1544	eiQZxBO.exe
1540	RrYXXKr.exe
356	WFkxjPz.exe
2504	WNGxpCW.exe
2252	auuiPqH.exe
2056	DVFhIga.exe
2088	GhxHHVH.exe
844	jlOnoyp.exe
1336	dqhbZkQ.exe
1000	yHmOylV.exe
2344	ujVeHhR.exe
2532	ijeRkgr.exe
1528	OEOzcfz.exe
2168	yiMoHFW.exe
2368	MastvoF.exe
344	HUdxsfC.exe
1672	ejPbExN.exe
1072	bTeDsVr.exe
1028	nPKSgwY.exe
880	DogaGSH.exe
2312	ChiRcIO.exe
2104	qAZDman.exe
1564	RRnCMCy.exe
1592	QoUBnXQ.exe
2792	xrxWzdl.exe
2876	XDITqRf.exe
2584	RyQRanE.exe

Loads dropped DLL 64 IoCs

pid	Process
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe

UPX packed file 56 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2388-1-0x000000013FD60000-0x0000000140156000-memory.dmp	upx
behavioral1/files/0x00070000000120fe-3.dat	upx
behavioral1/files/0x0008000000018b2b-6.dat	upx
behavioral1/memory/2388-9-0x0000000002630000-0x0000000002A26000-memory.dmp	upx
behavioral1/memory/1264-14-0x000000013FD90000-0x0000000140186000-memory.dmp	upx
behavioral1/memory/2748-13-0x000000013F1B0000-0x000000013F5A6000-memory.dmp	upx
behavioral1/files/0x0008000000018b5c-8.dat	upx
behavioral1/files/0x0007000000018bec-27.dat	upx
behavioral1/files/0x0006000000019234-40.dat	upx
behavioral1/files/0x0006000000019221-37.dat	upx
behavioral1/files/0x0037000000018715-26.dat	upx
behavioral1/files/0x0006000000019217-36.dat	upx
behavioral1/memory/2776-50-0x000000013FBE0000-0x000000013FFD6000-memory.dmp	upx
behavioral1/files/0x000800000001923a-61.dat	upx
behavioral1/memory/2728-60-0x000000013F850000-0x000000013FC46000-memory.dmp	upx
behavioral1/memory/2464-59-0x000000013F340000-0x000000013F736000-memory.dmp	upx
behavioral1/memory/2628-57-0x000000013F620000-0x000000013FA16000-memory.dmp	upx
behavioral1/memory/2904-46-0x000000013F6C0000-0x000000013FAB6000-memory.dmp	upx
behavioral1/memory/2476-69-0x000000013F2E0000-0x000000013F6D6000-memory.dmp	upx
behavioral1/memory/1060-76-0x000000013F400000-0x000000013F7F6000-memory.dmp	upx
behavioral1/memory/2588-82-0x000000013F490000-0x000000013F886000-memory.dmp	upx
behavioral1/files/0x0005000000019f7e-96.dat	upx
behavioral1/files/0x000500000001a092-112.dat	upx
behavioral1/files/0x000500000001a48c-154.dat	upx
behavioral1/memory/1264-529-0x000000013FD90000-0x0000000140186000-memory.dmp	upx
behavioral1/files/0x000500000001a4a3-168.dat	upx
behavioral1/files/0x000500000001a49d-164.dat	upx
behavioral1/files/0x000500000001a48e-160.dat	upx
behavioral1/files/0x000500000001a481-152.dat	upx
behavioral1/files/0x000500000001a47f-148.dat	upx
behavioral1/files/0x000500000001a463-144.dat	upx
behavioral1/files/0x000500000001a421-140.dat	upx
behavioral1/files/0x000500000001a41b-136.dat	upx
behavioral1/files/0x000500000001a417-132.dat	upx
behavioral1/files/0x000500000001a410-128.dat	upx
behavioral1/files/0x000500000001a40f-124.dat	upx
behavioral1/files/0x000500000001a34d-120.dat	upx
behavioral1/files/0x000500000001a2fb-116.dat	upx
behavioral1/files/0x000500000001a072-108.dat	upx
behavioral1/files/0x000500000001a069-104.dat	upx
behavioral1/files/0x0005000000019f9a-100.dat	upx
behavioral1/files/0x0005000000019db1-92.dat	upx
behavioral1/memory/1924-89-0x000000013F040000-0x000000013F436000-memory.dmp	upx
behavioral1/memory/2748-87-0x000000013F1B0000-0x000000013F5A6000-memory.dmp	upx
behavioral1/files/0x0005000000019d9d-85.dat	upx
behavioral1/files/0x0006000000019ce4-79.dat	upx
behavioral1/memory/2388-74-0x000000013FD60000-0x0000000140156000-memory.dmp	upx
behavioral1/files/0x0007000000004e74-73.dat	upx
behavioral1/memory/2736-33-0x000000013F3D0000-0x000000013F7C6000-memory.dmp	upx
behavioral1/memory/1264-5298-0x000000013FD90000-0x0000000140186000-memory.dmp	upx
behavioral1/memory/2476-5292-0x000000013F2E0000-0x000000013F6D6000-memory.dmp	upx
behavioral1/memory/2904-5390-0x000000013F6C0000-0x000000013FAB6000-memory.dmp	upx
behavioral1/memory/2736-5386-0x000000013F3D0000-0x000000013F7C6000-memory.dmp	upx
behavioral1/memory/2728-5583-0x000000013F850000-0x000000013FC46000-memory.dmp	upx
behavioral1/memory/1924-9038-0x000000013F040000-0x000000013F436000-memory.dmp	upx
behavioral1/memory/2588-9080-0x000000013F490000-0x000000013F886000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\iHDczCx.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\lICvGPe.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\VxYxlmU.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\xIDOByz.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\YMOSQRd.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\RunIyUc.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\DhEtoSv.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\vqjwoKg.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\doBZuBK.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\yEkTOjJ.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\oxWotsL.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\ZjtFFCE.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\WNiwAPb.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\OmkitRi.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\ObADyLo.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\OBvpNro.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\lldRorQ.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\WdjCgiS.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\wzypimK.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\ngZBsEc.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\joKvpUg.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\QicsGZj.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\zymrcJi.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\fcYmYut.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\sywikGz.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\kTuWbsz.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\INJwHNa.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\syvrgBs.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\xKPpwyR.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\VmfOqam.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\CrEekIA.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\jRhdAlx.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\fKsWMEL.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\dgZsxZb.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\njyEGKY.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\irRbnOg.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\bNdzaGI.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\jFFAQMv.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\wLRgIvA.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\PJIcoEO.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\wCUAHsi.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\WFUQcOF.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\ieyUeEr.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\mnHifRX.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\wwPIvnd.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\ZzCihYd.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\FxqWEQJ.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\gOKHVHE.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\vBafTYe.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\FLKOzCo.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\yOEdpFh.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\vaARTVN.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\hDJiTTW.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\hxZxyQs.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\TxaGwho.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\dNevxif.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\QahVRwA.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\qdKIeiu.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\BxTpnkY.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\RGHnSnZ.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\CRCMuMw.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\HsoPnHT.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\qrNNxEZ.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
File created	C:\Windows\System\isfCpXM.exe	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
536	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
Token: SeLockMemoryPrivilege	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
Token: SeDebugPrivilege	536	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 536	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	31
PID 2388 wrote to memory of 536	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	31
PID 2388 wrote to memory of 536	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	31
PID 2388 wrote to memory of 1264	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	32
PID 2388 wrote to memory of 1264	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	32
PID 2388 wrote to memory of 1264	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	32
PID 2388 wrote to memory of 2748	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	33
PID 2388 wrote to memory of 2748	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	33
PID 2388 wrote to memory of 2748	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	33
PID 2388 wrote to memory of 2736	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	34
PID 2388 wrote to memory of 2736	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	34
PID 2388 wrote to memory of 2736	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	34
PID 2388 wrote to memory of 2904	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	35
PID 2388 wrote to memory of 2904	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	35
PID 2388 wrote to memory of 2904	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	35
PID 2388 wrote to memory of 2464	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	36
PID 2388 wrote to memory of 2464	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	36
PID 2388 wrote to memory of 2464	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	36
PID 2388 wrote to memory of 2776	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	37
PID 2388 wrote to memory of 2776	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	37
PID 2388 wrote to memory of 2776	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	37
PID 2388 wrote to memory of 2628	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	38
PID 2388 wrote to memory of 2628	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	38
PID 2388 wrote to memory of 2628	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	38
PID 2388 wrote to memory of 2728	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	39
PID 2388 wrote to memory of 2728	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	39
PID 2388 wrote to memory of 2728	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	39
PID 2388 wrote to memory of 2476	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	40
PID 2388 wrote to memory of 2476	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	40
PID 2388 wrote to memory of 2476	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	40
PID 2388 wrote to memory of 1060	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	41
PID 2388 wrote to memory of 1060	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	41
PID 2388 wrote to memory of 1060	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	41
PID 2388 wrote to memory of 2588	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	42
PID 2388 wrote to memory of 2588	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	42
PID 2388 wrote to memory of 2588	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	42
PID 2388 wrote to memory of 1924	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	43
PID 2388 wrote to memory of 1924	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	43
PID 2388 wrote to memory of 1924	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	43
PID 2388 wrote to memory of 2648	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	44
PID 2388 wrote to memory of 2648	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	44
PID 2388 wrote to memory of 2648	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	44
PID 2388 wrote to memory of 1320	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	45
PID 2388 wrote to memory of 1320	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	45
PID 2388 wrote to memory of 1320	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	45
PID 2388 wrote to memory of 1932	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	46
PID 2388 wrote to memory of 1932	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	46
PID 2388 wrote to memory of 1932	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	46
PID 2388 wrote to memory of 2908	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	47
PID 2388 wrote to memory of 2908	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	47
PID 2388 wrote to memory of 2908	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	47
PID 2388 wrote to memory of 1332	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	48
PID 2388 wrote to memory of 1332	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	48
PID 2388 wrote to memory of 1332	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	48
PID 2388 wrote to memory of 1552	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	49
PID 2388 wrote to memory of 1552	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	49
PID 2388 wrote to memory of 1552	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	49
PID 2388 wrote to memory of 1840	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	50
PID 2388 wrote to memory of 1840	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	50
PID 2388 wrote to memory of 1840	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	50
PID 2388 wrote to memory of 388	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	51
PID 2388 wrote to memory of 388	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	51
PID 2388 wrote to memory of 388	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	51
PID 2388 wrote to memory of 2788	2388	8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe	52

C:\Users\Admin\AppData\Local\Temp\8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe
"C:\Users\Admin\AppData\Local\Temp\8aab8b8134b2343f8af7f80149e4f05b26c9ff92971d0c62eacb068ba812ee00.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:536
- C:\Windows\System\EfOvhjm.exe
  C:\Windows\System\EfOvhjm.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\lIFqKoq.exe
  C:\Windows\System\lIFqKoq.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\JQDXPrT.exe
  C:\Windows\System\JQDXPrT.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\yMiCXXI.exe
  C:\Windows\System\yMiCXXI.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\GuIVgFF.exe
  C:\Windows\System\GuIVgFF.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\vRZQnzs.exe
  C:\Windows\System\vRZQnzs.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\KMtRZrR.exe
  C:\Windows\System\KMtRZrR.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\agUJESL.exe
  C:\Windows\System\agUJESL.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\IKcdwGL.exe
  C:\Windows\System\IKcdwGL.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\EJujHyB.exe
  C:\Windows\System\EJujHyB.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\MQjnRgL.exe
  C:\Windows\System\MQjnRgL.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\sJdtPbA.exe
  C:\Windows\System\sJdtPbA.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\VFvjEzv.exe
  C:\Windows\System\VFvjEzv.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\eYQXkcG.exe
  C:\Windows\System\eYQXkcG.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\ayaojmx.exe
  C:\Windows\System\ayaojmx.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\dOiVJpL.exe
  C:\Windows\System\dOiVJpL.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\YlHfXAi.exe
  C:\Windows\System\YlHfXAi.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\IjDiTOo.exe
  C:\Windows\System\IjDiTOo.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\PpVTrST.exe
  C:\Windows\System\PpVTrST.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\iHDczCx.exe
  C:\Windows\System\iHDczCx.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\pUqnOdt.exe
  C:\Windows\System\pUqnOdt.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\CrXGDJA.exe
  C:\Windows\System\CrXGDJA.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\tGBJWZG.exe
  C:\Windows\System\tGBJWZG.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\bUQFjrU.exe
  C:\Windows\System\bUQFjrU.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\qFveDwD.exe
  C:\Windows\System\qFveDwD.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\iZodoDF.exe
  C:\Windows\System\iZodoDF.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\ZtLYCON.exe
  C:\Windows\System\ZtLYCON.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\NVPQiuW.exe
  C:\Windows\System\NVPQiuW.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\YyGdUUy.exe
  C:\Windows\System\YyGdUUy.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\Fuinjcg.exe
  C:\Windows\System\Fuinjcg.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\zOuJPAE.exe
  C:\Windows\System\zOuJPAE.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\hSCjKGC.exe
  C:\Windows\System\hSCjKGC.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\ClIlLCx.exe
  C:\Windows\System\ClIlLCx.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\PQxOUky.exe
  C:\Windows\System\PQxOUky.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\zqyCcdq.exe
  C:\Windows\System\zqyCcdq.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\bvEjuSY.exe
  C:\Windows\System\bvEjuSY.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\ReJhQFn.exe
  C:\Windows\System\ReJhQFn.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\eiQZxBO.exe
  C:\Windows\System\eiQZxBO.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\RrYXXKr.exe
  C:\Windows\System\RrYXXKr.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\WFkxjPz.exe
  C:\Windows\System\WFkxjPz.exe
  2⤵
  - Executes dropped EXE
  PID:356
- C:\Windows\System\WNGxpCW.exe
  C:\Windows\System\WNGxpCW.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\auuiPqH.exe
  C:\Windows\System\auuiPqH.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\DVFhIga.exe
  C:\Windows\System\DVFhIga.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\GhxHHVH.exe
  C:\Windows\System\GhxHHVH.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\jlOnoyp.exe
  C:\Windows\System\jlOnoyp.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\dqhbZkQ.exe
  C:\Windows\System\dqhbZkQ.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\yHmOylV.exe
  C:\Windows\System\yHmOylV.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\ujVeHhR.exe
  C:\Windows\System\ujVeHhR.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\ijeRkgr.exe
  C:\Windows\System\ijeRkgr.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\OEOzcfz.exe
  C:\Windows\System\OEOzcfz.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\yiMoHFW.exe
  C:\Windows\System\yiMoHFW.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\MastvoF.exe
  C:\Windows\System\MastvoF.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\HUdxsfC.exe
  C:\Windows\System\HUdxsfC.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\ejPbExN.exe
  C:\Windows\System\ejPbExN.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\bTeDsVr.exe
  C:\Windows\System\bTeDsVr.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\nPKSgwY.exe
  C:\Windows\System\nPKSgwY.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\DogaGSH.exe
  C:\Windows\System\DogaGSH.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\ChiRcIO.exe
  C:\Windows\System\ChiRcIO.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\qAZDman.exe
  C:\Windows\System\qAZDman.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\RRnCMCy.exe
  C:\Windows\System\RRnCMCy.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\QoUBnXQ.exe
  C:\Windows\System\QoUBnXQ.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\xrxWzdl.exe
  C:\Windows\System\xrxWzdl.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\XDITqRf.exe
  C:\Windows\System\XDITqRf.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\RyQRanE.exe
  C:\Windows\System\RyQRanE.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\YsaRspV.exe
  C:\Windows\System\YsaRspV.exe
  2⤵
  PID:2752
- C:\Windows\System\RYPIARu.exe
  C:\Windows\System\RYPIARu.exe
  2⤵
  PID:2872
- C:\Windows\System\ZpXzLZo.exe
  C:\Windows\System\ZpXzLZo.exe
  2⤵
  PID:2380
- C:\Windows\System\JpqYlaW.exe
  C:\Windows\System\JpqYlaW.exe
  2⤵
  PID:2756
- C:\Windows\System\yaUehKZ.exe
  C:\Windows\System\yaUehKZ.exe
  2⤵
  PID:2680
- C:\Windows\System\LGKQKnT.exe
  C:\Windows\System\LGKQKnT.exe
  2⤵
  PID:2636
- C:\Windows\System\nxdXwVu.exe
  C:\Windows\System\nxdXwVu.exe
  2⤵
  PID:2932
- C:\Windows\System\cJnlGKG.exe
  C:\Windows\System\cJnlGKG.exe
  2⤵
  PID:1800
- C:\Windows\System\xtdDrfp.exe
  C:\Windows\System\xtdDrfp.exe
  2⤵
  PID:448
- C:\Windows\System\NNeBNBP.exe
  C:\Windows\System\NNeBNBP.exe
  2⤵
  PID:1252
- C:\Windows\System\wywgZZS.exe
  C:\Windows\System\wywgZZS.exe
  2⤵
  PID:2968
- C:\Windows\System\DtwpFjn.exe
  C:\Windows\System\DtwpFjn.exe
  2⤵
  PID:2428
- C:\Windows\System\XebUbGI.exe
  C:\Windows\System\XebUbGI.exe
  2⤵
  PID:2596
- C:\Windows\System\OhHOinV.exe
  C:\Windows\System\OhHOinV.exe
  2⤵
  PID:2480
- C:\Windows\System\dyQwzeu.exe
  C:\Windows\System\dyQwzeu.exe
  2⤵
  PID:696
- C:\Windows\System\gVUFEbB.exe
  C:\Windows\System\gVUFEbB.exe
  2⤵
  PID:1760
- C:\Windows\System\zrbbinw.exe
  C:\Windows\System\zrbbinw.exe
  2⤵
  PID:2196
- C:\Windows\System\qlxjRmR.exe
  C:\Windows\System\qlxjRmR.exe
  2⤵
  PID:2232
- C:\Windows\System\WNiwAPb.exe
  C:\Windows\System\WNiwAPb.exe
  2⤵
  PID:1904
- C:\Windows\System\xziCQJY.exe
  C:\Windows\System\xziCQJY.exe
  2⤵
  PID:1804
- C:\Windows\System\NFkWJjZ.exe
  C:\Windows\System\NFkWJjZ.exe
  2⤵
  PID:1616
- C:\Windows\System\lhMsqTK.exe
  C:\Windows\System\lhMsqTK.exe
  2⤵
  PID:1360
- C:\Windows\System\oefjnGD.exe
  C:\Windows\System\oefjnGD.exe
  2⤵
  PID:1820
- C:\Windows\System\eimRoqB.exe
  C:\Windows\System\eimRoqB.exe
  2⤵
  PID:1684
- C:\Windows\System\beALMEc.exe
  C:\Windows\System\beALMEc.exe
  2⤵
  PID:2032
- C:\Windows\System\YcgHmGu.exe
  C:\Windows\System\YcgHmGu.exe
  2⤵
  PID:2028
- C:\Windows\System\fBPmKZK.exe
  C:\Windows\System\fBPmKZK.exe
  2⤵
  PID:1288
- C:\Windows\System\zDMjGBx.exe
  C:\Windows\System\zDMjGBx.exe
  2⤵
  PID:1484
- C:\Windows\System\nsBBqtk.exe
  C:\Windows\System\nsBBqtk.exe
  2⤵
  PID:2288
- C:\Windows\System\Navunuo.exe
  C:\Windows\System\Navunuo.exe
  2⤵
  PID:2040
- C:\Windows\System\JIVzdaj.exe
  C:\Windows\System\JIVzdaj.exe
  2⤵
  PID:1700
- C:\Windows\System\IpWJvAi.exe
  C:\Windows\System\IpWJvAi.exe
  2⤵
  PID:2988
- C:\Windows\System\QvXSeNk.exe
  C:\Windows\System\QvXSeNk.exe
  2⤵
  PID:1740
- C:\Windows\System\zNInXQO.exe
  C:\Windows\System\zNInXQO.exe
  2⤵
  PID:2284
- C:\Windows\System\HctqJBT.exe
  C:\Windows\System\HctqJBT.exe
  2⤵
  PID:1588
- C:\Windows\System\sEDbQCO.exe
  C:\Windows\System\sEDbQCO.exe
  2⤵
  PID:2068
- C:\Windows\System\OVswXSe.exe
  C:\Windows\System\OVswXSe.exe
  2⤵
  PID:2764
- C:\Windows\System\hfXoDeF.exe
  C:\Windows\System\hfXoDeF.exe
  2⤵
  PID:2768
- C:\Windows\System\RnFujou.exe
  C:\Windows\System\RnFujou.exe
  2⤵
  PID:752
- C:\Windows\System\vTfNNVn.exe
  C:\Windows\System\vTfNNVn.exe
  2⤵
  PID:2656
- C:\Windows\System\oeQUBeK.exe
  C:\Windows\System\oeQUBeK.exe
  2⤵
  PID:828
- C:\Windows\System\MhoiLiU.exe
  C:\Windows\System\MhoiLiU.exe
  2⤵
  PID:492
- C:\Windows\System\JyjRuNs.exe
  C:\Windows\System\JyjRuNs.exe
  2⤵
  PID:1324
- C:\Windows\System\FEezGJQ.exe
  C:\Windows\System\FEezGJQ.exe
  2⤵
  PID:952
- C:\Windows\System\sreownH.exe
  C:\Windows\System\sreownH.exe
  2⤵
  PID:264
- C:\Windows\System\uNGLIzx.exe
  C:\Windows\System\uNGLIzx.exe
  2⤵
  PID:476
- C:\Windows\System\bEoFHay.exe
  C:\Windows\System\bEoFHay.exe
  2⤵
  PID:1352
- C:\Windows\System\jRVUwvr.exe
  C:\Windows\System\jRVUwvr.exe
  2⤵
  PID:340
- C:\Windows\System\rSKELFC.exe
  C:\Windows\System\rSKELFC.exe
  2⤵
  PID:600
- C:\Windows\System\LcAvzEh.exe
  C:\Windows\System\LcAvzEh.exe
  2⤵
  PID:1960
- C:\Windows\System\JTQdiUL.exe
  C:\Windows\System\JTQdiUL.exe
  2⤵
  PID:3084
- C:\Windows\System\CeNCTEI.exe
  C:\Windows\System\CeNCTEI.exe
  2⤵
  PID:3100
- C:\Windows\System\fUmWOVG.exe
  C:\Windows\System\fUmWOVG.exe
  2⤵
  PID:3116
- C:\Windows\System\ndDBPAr.exe
  C:\Windows\System\ndDBPAr.exe
  2⤵
  PID:3132
- C:\Windows\System\ktZRqli.exe
  C:\Windows\System\ktZRqli.exe
  2⤵
  PID:3148
- C:\Windows\System\picaKAG.exe
  C:\Windows\System\picaKAG.exe
  2⤵
  PID:3164
- C:\Windows\System\IrrEIJa.exe
  C:\Windows\System\IrrEIJa.exe
  2⤵
  PID:3180
- C:\Windows\System\ersxJjt.exe
  C:\Windows\System\ersxJjt.exe
  2⤵
  PID:3196
- C:\Windows\System\pDsnNKr.exe
  C:\Windows\System\pDsnNKr.exe
  2⤵
  PID:3212
- C:\Windows\System\giRqpdv.exe
  C:\Windows\System\giRqpdv.exe
  2⤵
  PID:3228
- C:\Windows\System\fnzGuyX.exe
  C:\Windows\System\fnzGuyX.exe
  2⤵
  PID:3244
- C:\Windows\System\xIDOByz.exe
  C:\Windows\System\xIDOByz.exe
  2⤵
  PID:3260
- C:\Windows\System\npCEfwO.exe
  C:\Windows\System\npCEfwO.exe
  2⤵
  PID:3276
- C:\Windows\System\aBqtNCP.exe
  C:\Windows\System\aBqtNCP.exe
  2⤵
  PID:3292
- C:\Windows\System\CSIcLNa.exe
  C:\Windows\System\CSIcLNa.exe
  2⤵
  PID:3308
- C:\Windows\System\RfuJcnD.exe
  C:\Windows\System\RfuJcnD.exe
  2⤵
  PID:3324
- C:\Windows\System\RAOHFbf.exe
  C:\Windows\System\RAOHFbf.exe
  2⤵
  PID:3340
- C:\Windows\System\pDcomfN.exe
  C:\Windows\System\pDcomfN.exe
  2⤵
  PID:3356
- C:\Windows\System\slFjnnz.exe
  C:\Windows\System\slFjnnz.exe
  2⤵
  PID:3372
- C:\Windows\System\kwAqoiW.exe
  C:\Windows\System\kwAqoiW.exe
  2⤵
  PID:3388
- C:\Windows\System\UnEKuGv.exe
  C:\Windows\System\UnEKuGv.exe
  2⤵
  PID:3404
- C:\Windows\System\UbvZhPz.exe
  C:\Windows\System\UbvZhPz.exe
  2⤵
  PID:3420
- C:\Windows\System\sUfjFzG.exe
  C:\Windows\System\sUfjFzG.exe
  2⤵
  PID:3436
- C:\Windows\System\lDqehRT.exe
  C:\Windows\System\lDqehRT.exe
  2⤵
  PID:3452
- C:\Windows\System\kKIalKW.exe
  C:\Windows\System\kKIalKW.exe
  2⤵
  PID:3468
- C:\Windows\System\QWGZayK.exe
  C:\Windows\System\QWGZayK.exe
  2⤵
  PID:3484
- C:\Windows\System\VAXiDhX.exe
  C:\Windows\System\VAXiDhX.exe
  2⤵
  PID:3500
- C:\Windows\System\sbhnrQU.exe
  C:\Windows\System\sbhnrQU.exe
  2⤵
  PID:3516
- C:\Windows\System\JYlVDFi.exe
  C:\Windows\System\JYlVDFi.exe
  2⤵
  PID:3532
- C:\Windows\System\fTRVfNP.exe
  C:\Windows\System\fTRVfNP.exe
  2⤵
  PID:3548
- C:\Windows\System\aDmZBlQ.exe
  C:\Windows\System\aDmZBlQ.exe
  2⤵
  PID:3568
- C:\Windows\System\OVbbgCI.exe
  C:\Windows\System\OVbbgCI.exe
  2⤵
  PID:3584
- C:\Windows\System\BfbNfxy.exe
  C:\Windows\System\BfbNfxy.exe
  2⤵
  PID:3600
- C:\Windows\System\FIOaYKo.exe
  C:\Windows\System\FIOaYKo.exe
  2⤵
  PID:3616
- C:\Windows\System\fMTJVFM.exe
  C:\Windows\System\fMTJVFM.exe
  2⤵
  PID:3632
- C:\Windows\System\sgTgtQA.exe
  C:\Windows\System\sgTgtQA.exe
  2⤵
  PID:3648
- C:\Windows\System\xqjiCeo.exe
  C:\Windows\System\xqjiCeo.exe
  2⤵
  PID:3664
- C:\Windows\System\gnAselX.exe
  C:\Windows\System\gnAselX.exe
  2⤵
  PID:3680
- C:\Windows\System\xYQysCV.exe
  C:\Windows\System\xYQysCV.exe
  2⤵
  PID:3696
- C:\Windows\System\SloMuxQ.exe
  C:\Windows\System\SloMuxQ.exe
  2⤵
  PID:3712
- C:\Windows\System\kfvXfaS.exe
  C:\Windows\System\kfvXfaS.exe
  2⤵
  PID:3728
- C:\Windows\System\bWHbRqk.exe
  C:\Windows\System\bWHbRqk.exe
  2⤵
  PID:3744
- C:\Windows\System\xEFyFTh.exe
  C:\Windows\System\xEFyFTh.exe
  2⤵
  PID:3760
- C:\Windows\System\puqumCf.exe
  C:\Windows\System\puqumCf.exe
  2⤵
  PID:3776
- C:\Windows\System\znaPNyL.exe
  C:\Windows\System\znaPNyL.exe
  2⤵
  PID:3792
- C:\Windows\System\DsiLRIP.exe
  C:\Windows\System\DsiLRIP.exe
  2⤵
  PID:3808
- C:\Windows\System\FKtMDKh.exe
  C:\Windows\System\FKtMDKh.exe
  2⤵
  PID:3824
- C:\Windows\System\WJqwzgV.exe
  C:\Windows\System\WJqwzgV.exe
  2⤵
  PID:3840
- C:\Windows\System\TgNxDBX.exe
  C:\Windows\System\TgNxDBX.exe
  2⤵
  PID:3856
- C:\Windows\System\DawBxZp.exe
  C:\Windows\System\DawBxZp.exe
  2⤵
  PID:3872
- C:\Windows\System\mrmewXf.exe
  C:\Windows\System\mrmewXf.exe
  2⤵
  PID:3888
- C:\Windows\System\BtlZBWE.exe
  C:\Windows\System\BtlZBWE.exe
  2⤵
  PID:3904
- C:\Windows\System\DTJrzQh.exe
  C:\Windows\System\DTJrzQh.exe
  2⤵
  PID:3920
- C:\Windows\System\AXaBNoN.exe
  C:\Windows\System\AXaBNoN.exe
  2⤵
  PID:3936
- C:\Windows\System\aoXEpZV.exe
  C:\Windows\System\aoXEpZV.exe
  2⤵
  PID:3952
- C:\Windows\System\mHvNZWj.exe
  C:\Windows\System\mHvNZWj.exe
  2⤵
  PID:3968
- C:\Windows\System\epCYBPo.exe
  C:\Windows\System\epCYBPo.exe
  2⤵
  PID:3984
- C:\Windows\System\mnYBhbJ.exe
  C:\Windows\System\mnYBhbJ.exe
  2⤵
  PID:4000
- C:\Windows\System\tLqSUIX.exe
  C:\Windows\System\tLqSUIX.exe
  2⤵
  PID:4020
- C:\Windows\System\ICZgPXG.exe
  C:\Windows\System\ICZgPXG.exe
  2⤵
  PID:4036
- C:\Windows\System\aiDhyui.exe
  C:\Windows\System\aiDhyui.exe
  2⤵
  PID:4052
- C:\Windows\System\fXNtOpD.exe
  C:\Windows\System\fXNtOpD.exe
  2⤵
  PID:4068
- C:\Windows\System\hKYtZEJ.exe
  C:\Windows\System\hKYtZEJ.exe
  2⤵
  PID:4084
- C:\Windows\System\rCCLuXK.exe
  C:\Windows\System\rCCLuXK.exe
  2⤵
  PID:1780
- C:\Windows\System\zPJVRBn.exe
  C:\Windows\System\zPJVRBn.exe
  2⤵
  PID:616
- C:\Windows\System\IgdRfPv.exe
  C:\Windows\System\IgdRfPv.exe
  2⤵
  PID:1976
- C:\Windows\System\zmKDkrn.exe
  C:\Windows\System\zmKDkrn.exe
  2⤵
  PID:2408
- C:\Windows\System\dkZIKap.exe
  C:\Windows\System\dkZIKap.exe
  2⤵
  PID:1284
- C:\Windows\System\pseZbtV.exe
  C:\Windows\System\pseZbtV.exe
  2⤵
  PID:2608
- C:\Windows\System\SYKZRah.exe
  C:\Windows\System\SYKZRah.exe
  2⤵
  PID:2868
- C:\Windows\System\abEoaLq.exe
  C:\Windows\System\abEoaLq.exe
  2⤵
  PID:892
- C:\Windows\System\trWAzeH.exe
  C:\Windows\System\trWAzeH.exe
  2⤵
  PID:1936
- C:\Windows\System\UZGCwra.exe
  C:\Windows\System\UZGCwra.exe
  2⤵
  PID:1468
- C:\Windows\System\MHdrlpw.exe
  C:\Windows\System\MHdrlpw.exe
  2⤵
  PID:1696
- C:\Windows\System\AAGqZaB.exe
  C:\Windows\System\AAGqZaB.exe
  2⤵
  PID:2696
- C:\Windows\System\KrfnydA.exe
  C:\Windows\System\KrfnydA.exe
  2⤵
  PID:3188
- C:\Windows\System\MAiDvxC.exe
  C:\Windows\System\MAiDvxC.exe
  2⤵
  PID:2012
- C:\Windows\System\GjMxqNU.exe
  C:\Windows\System\GjMxqNU.exe
  2⤵
  PID:3112
- C:\Windows\System\kZBxwUu.exe
  C:\Windows\System\kZBxwUu.exe
  2⤵
  PID:3220
- C:\Windows\System\kEVWByz.exe
  C:\Windows\System\kEVWByz.exe
  2⤵
  PID:3284
- C:\Windows\System\kNGyclo.exe
  C:\Windows\System\kNGyclo.exe
  2⤵
  PID:3348
- C:\Windows\System\eOsNzcX.exe
  C:\Windows\System\eOsNzcX.exe
  2⤵
  PID:3176
- C:\Windows\System\KiNbeov.exe
  C:\Windows\System\KiNbeov.exe
  2⤵
  PID:3204
- C:\Windows\System\zaBRWDt.exe
  C:\Windows\System\zaBRWDt.exe
  2⤵
  PID:3412
- C:\Windows\System\DWgLSON.exe
  C:\Windows\System\DWgLSON.exe
  2⤵
  PID:3476
- C:\Windows\System\IJKJVpi.exe
  C:\Windows\System\IJKJVpi.exe
  2⤵
  PID:3428
- C:\Windows\System\HQXIGNT.exe
  C:\Windows\System\HQXIGNT.exe
  2⤵
  PID:3300
- C:\Windows\System\XAOrRpl.exe
  C:\Windows\System\XAOrRpl.exe
  2⤵
  PID:3512
- C:\Windows\System\PBJDCIS.exe
  C:\Windows\System\PBJDCIS.exe
  2⤵
  PID:3576
- C:\Windows\System\NLZQKHB.exe
  C:\Windows\System\NLZQKHB.exe
  2⤵
  PID:3640
- C:\Windows\System\NGgPcNQ.exe
  C:\Windows\System\NGgPcNQ.exe
  2⤵
  PID:3492
- C:\Windows\System\mSpJkYb.exe
  C:\Windows\System\mSpJkYb.exe
  2⤵
  PID:3524
- C:\Windows\System\jaDIqyP.exe
  C:\Windows\System\jaDIqyP.exe
  2⤵
  PID:3704
- C:\Windows\System\xgPZksq.exe
  C:\Windows\System\xgPZksq.exe
  2⤵
  PID:3768
- C:\Windows\System\TnDITFX.exe
  C:\Windows\System\TnDITFX.exe
  2⤵
  PID:3832
- C:\Windows\System\FJZfNTp.exe
  C:\Windows\System\FJZfNTp.exe
  2⤵
  PID:3628
- C:\Windows\System\TFfdbku.exe
  C:\Windows\System\TFfdbku.exe
  2⤵
  PID:3900
- C:\Windows\System\jqFfoCb.exe
  C:\Windows\System\jqFfoCb.exe
  2⤵
  PID:3660
- C:\Windows\System\dCxkXfo.exe
  C:\Windows\System\dCxkXfo.exe
  2⤵
  PID:3756
- C:\Windows\System\tbIGQbK.exe
  C:\Windows\System\tbIGQbK.exe
  2⤵
  PID:3960
- C:\Windows\System\bTJCdxZ.exe
  C:\Windows\System\bTJCdxZ.exe
  2⤵
  PID:3820
- C:\Windows\System\ceCDqkM.exe
  C:\Windows\System\ceCDqkM.exe
  2⤵
  PID:4032
- C:\Windows\System\XiiCfXH.exe
  C:\Windows\System\XiiCfXH.exe
  2⤵
  PID:2544
- C:\Windows\System\yJshCEB.exe
  C:\Windows\System\yJshCEB.exe
  2⤵
  PID:3944
- C:\Windows\System\VpIIszz.exe
  C:\Windows\System\VpIIszz.exe
  2⤵
  PID:3880
- C:\Windows\System\YNQdnqH.exe
  C:\Windows\System\YNQdnqH.exe
  2⤵
  PID:4016
- C:\Windows\System\uzIepdL.exe
  C:\Windows\System\uzIepdL.exe
  2⤵
  PID:1668
- C:\Windows\System\HDTkcUy.exe
  C:\Windows\System\HDTkcUy.exe
  2⤵
  PID:2160
- C:\Windows\System\TmxsxNP.exe
  C:\Windows\System\TmxsxNP.exe
  2⤵
  PID:3160
- C:\Windows\System\MRKcEHb.exe
  C:\Windows\System\MRKcEHb.exe
  2⤵
  PID:4080
- C:\Windows\System\WFUQcOF.exe
  C:\Windows\System\WFUQcOF.exe
  2⤵
  PID:3252
- C:\Windows\System\pUVxVVq.exe
  C:\Windows\System\pUVxVVq.exe
  2⤵
  PID:3268
- C:\Windows\System\ZrtAeKx.exe
  C:\Windows\System\ZrtAeKx.exe
  2⤵
  PID:2340
- C:\Windows\System\CtnRJjP.exe
  C:\Windows\System\CtnRJjP.exe
  2⤵
  PID:908
- C:\Windows\System\JcxlptG.exe
  C:\Windows\System\JcxlptG.exe
  2⤵
  PID:2836
- C:\Windows\System\ifdTqVA.exe
  C:\Windows\System\ifdTqVA.exe
  2⤵
  PID:3400
- C:\Windows\System\jUKlxzR.exe
  C:\Windows\System\jUKlxzR.exe
  2⤵
  PID:3612
- C:\Windows\System\jOpVxUV.exe
  C:\Windows\System\jOpVxUV.exe
  2⤵
  PID:3740
- C:\Windows\System\DupugDh.exe
  C:\Windows\System\DupugDh.exe
  2⤵
  PID:3624
- C:\Windows\System\eHdIAPs.exe
  C:\Windows\System\eHdIAPs.exe
  2⤵
  PID:3208
- C:\Windows\System\iPUPRta.exe
  C:\Windows\System\iPUPRta.exe
  2⤵
  PID:3332
- C:\Windows\System\YWRISMy.exe
  C:\Windows\System\YWRISMy.exe
  2⤵
  PID:3816
- C:\Windows\System\JBPXlmR.exe
  C:\Windows\System\JBPXlmR.exe
  2⤵
  PID:3980
- C:\Windows\System\WjZURXH.exe
  C:\Windows\System\WjZURXH.exe
  2⤵
  PID:4100
- C:\Windows\System\CgBfVBX.exe
  C:\Windows\System\CgBfVBX.exe
  2⤵
  PID:4116
- C:\Windows\System\rWhDGMC.exe
  C:\Windows\System\rWhDGMC.exe
  2⤵
  PID:4132
- C:\Windows\System\NugDvJc.exe
  C:\Windows\System\NugDvJc.exe
  2⤵
  PID:4148
- C:\Windows\System\KCIvLyg.exe
  C:\Windows\System\KCIvLyg.exe
  2⤵
  PID:4164
- C:\Windows\System\UliplSs.exe
  C:\Windows\System\UliplSs.exe
  2⤵
  PID:4184
- C:\Windows\System\keHFqkn.exe
  C:\Windows\System\keHFqkn.exe
  2⤵
  PID:4200
- C:\Windows\System\aknnoWT.exe
  C:\Windows\System\aknnoWT.exe
  2⤵
  PID:4216
- C:\Windows\System\UwNknyT.exe
  C:\Windows\System\UwNknyT.exe
  2⤵
  PID:4232
- C:\Windows\System\DPluEqB.exe
  C:\Windows\System\DPluEqB.exe
  2⤵
  PID:4248
- C:\Windows\System\akwHdcv.exe
  C:\Windows\System\akwHdcv.exe
  2⤵
  PID:4264
- C:\Windows\System\xsbprDV.exe
  C:\Windows\System\xsbprDV.exe
  2⤵
  PID:4280
- C:\Windows\System\jKkrruf.exe
  C:\Windows\System\jKkrruf.exe
  2⤵
  PID:4296
- C:\Windows\System\yuJlMcq.exe
  C:\Windows\System\yuJlMcq.exe
  2⤵
  PID:4312
- C:\Windows\System\logWRZl.exe
  C:\Windows\System\logWRZl.exe
  2⤵
  PID:4328
- C:\Windows\System\BxyiKWE.exe
  C:\Windows\System\BxyiKWE.exe
  2⤵
  PID:4344
- C:\Windows\System\IGCNmHR.exe
  C:\Windows\System\IGCNmHR.exe
  2⤵
  PID:4360
- C:\Windows\System\bEYrLeV.exe
  C:\Windows\System\bEYrLeV.exe
  2⤵
  PID:4376
- C:\Windows\System\ZPqULGm.exe
  C:\Windows\System\ZPqULGm.exe
  2⤵
  PID:4392
- C:\Windows\System\wkngEhW.exe
  C:\Windows\System\wkngEhW.exe
  2⤵
  PID:4408
- C:\Windows\System\xRcSvNx.exe
  C:\Windows\System\xRcSvNx.exe
  2⤵
  PID:4424
- C:\Windows\System\GdOJHQj.exe
  C:\Windows\System\GdOJHQj.exe
  2⤵
  PID:4440
- C:\Windows\System\QVaDmjK.exe
  C:\Windows\System\QVaDmjK.exe
  2⤵
  PID:4456
- C:\Windows\System\HWuzqaF.exe
  C:\Windows\System\HWuzqaF.exe
  2⤵
  PID:4472
- C:\Windows\System\ypwWSXw.exe
  C:\Windows\System\ypwWSXw.exe
  2⤵
  PID:4488
- C:\Windows\System\HxjqfsO.exe
  C:\Windows\System\HxjqfsO.exe
  2⤵
  PID:4504
- C:\Windows\System\IZtxyvH.exe
  C:\Windows\System\IZtxyvH.exe
  2⤵
  PID:4548
- C:\Windows\System\sxyGHuZ.exe
  C:\Windows\System\sxyGHuZ.exe
  2⤵
  PID:4628
- C:\Windows\System\RYOsqqp.exe
  C:\Windows\System\RYOsqqp.exe
  2⤵
  PID:4648
- C:\Windows\System\syRfxmL.exe
  C:\Windows\System\syRfxmL.exe
  2⤵
  PID:4664
- C:\Windows\System\zNvYtfA.exe
  C:\Windows\System\zNvYtfA.exe
  2⤵
  PID:4680
- C:\Windows\System\NyYgadz.exe
  C:\Windows\System\NyYgadz.exe
  2⤵
  PID:4696
- C:\Windows\System\VVbBzDz.exe
  C:\Windows\System\VVbBzDz.exe
  2⤵
  PID:4712
- C:\Windows\System\hlYpNWX.exe
  C:\Windows\System\hlYpNWX.exe
  2⤵
  PID:4728
- C:\Windows\System\tzeUerX.exe
  C:\Windows\System\tzeUerX.exe
  2⤵
  PID:4744
- C:\Windows\System\dfyxIwO.exe
  C:\Windows\System\dfyxIwO.exe
  2⤵
  PID:4760
- C:\Windows\System\ESrCecd.exe
  C:\Windows\System\ESrCecd.exe
  2⤵
  PID:4776
- C:\Windows\System\AZQpEvZ.exe
  C:\Windows\System\AZQpEvZ.exe
  2⤵
  PID:4792
- C:\Windows\System\dwKCSxf.exe
  C:\Windows\System\dwKCSxf.exe
  2⤵
  PID:4808
- C:\Windows\System\dHYORbb.exe
  C:\Windows\System\dHYORbb.exe
  2⤵
  PID:4824
- C:\Windows\System\PnAuZdo.exe
  C:\Windows\System\PnAuZdo.exe
  2⤵
  PID:4840
- C:\Windows\System\ykNEjKz.exe
  C:\Windows\System\ykNEjKz.exe
  2⤵
  PID:4856
- C:\Windows\System\UnZhKYr.exe
  C:\Windows\System\UnZhKYr.exe
  2⤵
  PID:4872
- C:\Windows\System\jVqIBbg.exe
  C:\Windows\System\jVqIBbg.exe
  2⤵
  PID:4888
- C:\Windows\System\CPxmEYY.exe
  C:\Windows\System\CPxmEYY.exe
  2⤵
  PID:4904
- C:\Windows\System\ktJgXkP.exe
  C:\Windows\System\ktJgXkP.exe
  2⤵
  PID:4920
- C:\Windows\System\GhcBbVC.exe
  C:\Windows\System\GhcBbVC.exe
  2⤵
  PID:4936
- C:\Windows\System\StUCLjw.exe
  C:\Windows\System\StUCLjw.exe
  2⤵
  PID:4952
- C:\Windows\System\pELDeOO.exe
  C:\Windows\System\pELDeOO.exe
  2⤵
  PID:4968
- C:\Windows\System\UmaoYza.exe
  C:\Windows\System\UmaoYza.exe
  2⤵
  PID:4984
- C:\Windows\System\NJSxUgV.exe
  C:\Windows\System\NJSxUgV.exe
  2⤵
  PID:5000
- C:\Windows\System\YMOSQRd.exe
  C:\Windows\System\YMOSQRd.exe
  2⤵
  PID:5016
- C:\Windows\System\GKAlEyM.exe
  C:\Windows\System\GKAlEyM.exe
  2⤵
  PID:5032
- C:\Windows\System\XMFPrfV.exe
  C:\Windows\System\XMFPrfV.exe
  2⤵
  PID:5048
- C:\Windows\System\HAtHMve.exe
  C:\Windows\System\HAtHMve.exe
  2⤵
  PID:5064
- C:\Windows\System\gnEbMwz.exe
  C:\Windows\System\gnEbMwz.exe
  2⤵
  PID:5080
- C:\Windows\System\YPrnCGb.exe
  C:\Windows\System\YPrnCGb.exe
  2⤵
  PID:5096
- C:\Windows\System\nqesTls.exe
  C:\Windows\System\nqesTls.exe
  2⤵
  PID:5112
- C:\Windows\System\WzVUPAH.exe
  C:\Windows\System\WzVUPAH.exe
  2⤵
  PID:4048
- C:\Windows\System\AlgdevI.exe
  C:\Windows\System\AlgdevI.exe
  2⤵
  PID:3096
- C:\Windows\System\NSvHYUg.exe
  C:\Windows\System\NSvHYUg.exe
  2⤵
  PID:3496
- C:\Windows\System\JQrJmQP.exe
  C:\Windows\System\JQrJmQP.exe
  2⤵
  PID:3464
- C:\Windows\System\XLwVjjj.exe
  C:\Windows\System\XLwVjjj.exe
  2⤵
  PID:3564
- C:\Windows\System\QPnbUhF.exe
  C:\Windows\System\QPnbUhF.exe
  2⤵
  PID:3752
- C:\Windows\System\mEcwKhl.exe
  C:\Windows\System\mEcwKhl.exe
  2⤵
  PID:3896
- C:\Windows\System\wrUbKOY.exe
  C:\Windows\System\wrUbKOY.exe
  2⤵
  PID:4008
- C:\Windows\System\FtZoeMW.exe
  C:\Windows\System\FtZoeMW.exe
  2⤵
  PID:4156
- C:\Windows\System\pGynMSw.exe
  C:\Windows\System\pGynMSw.exe
  2⤵
  PID:4224
- C:\Windows\System\MteOxKU.exe
  C:\Windows\System\MteOxKU.exe
  2⤵
  PID:4288
- C:\Windows\System\pKLZvvk.exe
  C:\Windows\System\pKLZvvk.exe
  2⤵
  PID:4352
- C:\Windows\System\lwPXMgf.exe
  C:\Windows\System\lwPXMgf.exe
  2⤵
  PID:4416
- C:\Windows\System\lkQDRpQ.exe
  C:\Windows\System\lkQDRpQ.exe
  2⤵
  PID:4480
- C:\Windows\System\xYgygti.exe
  C:\Windows\System\xYgygti.exe
  2⤵
  PID:4524
- C:\Windows\System\bPitzzw.exe
  C:\Windows\System\bPitzzw.exe
  2⤵
  PID:4540
- C:\Windows\System\uPbBuiv.exe
  C:\Windows\System\uPbBuiv.exe
  2⤵
  PID:2220
- C:\Windows\System\axUEiOx.exe
  C:\Windows\System\axUEiOx.exe
  2⤵
  PID:4092
- C:\Windows\System\AoutDnN.exe
  C:\Windows\System\AoutDnN.exe
  2⤵
  PID:2300
- C:\Windows\System\zpsvKaZ.exe
  C:\Windows\System\zpsvKaZ.exe
  2⤵
  PID:2672
- C:\Windows\System\QnIunfX.exe
  C:\Windows\System\QnIunfX.exe
  2⤵
  PID:3976
- C:\Windows\System\dISxAjK.exe
  C:\Windows\System\dISxAjK.exe
  2⤵
  PID:4144
- C:\Windows\System\nWuNIMD.exe
  C:\Windows\System\nWuNIMD.exe
  2⤵
  PID:4212
- C:\Windows\System\OAoddVh.exe
  C:\Windows\System\OAoddVh.exe
  2⤵
  PID:4276
- C:\Windows\System\TywLCTP.exe
  C:\Windows\System\TywLCTP.exe
  2⤵
  PID:4340
- C:\Windows\System\JIAsoNu.exe
  C:\Windows\System\JIAsoNu.exe
  2⤵
  PID:4404
- C:\Windows\System\KjnKSxt.exe
  C:\Windows\System\KjnKSxt.exe
  2⤵
  PID:4468
- C:\Windows\System\wgmjgwA.exe
  C:\Windows\System\wgmjgwA.exe
  2⤵
  PID:3656
- C:\Windows\System\nYDQRcA.exe
  C:\Windows\System\nYDQRcA.exe
  2⤵
  PID:4608
- C:\Windows\System\vojrnll.exe
  C:\Windows\System\vojrnll.exe
  2⤵
  PID:3320
- C:\Windows\System\nFdZGmD.exe
  C:\Windows\System\nFdZGmD.exe
  2⤵
  PID:4624
- C:\Windows\System\PFLPSJI.exe
  C:\Windows\System\PFLPSJI.exe
  2⤵
  PID:4672
- C:\Windows\System\GcJMoVW.exe
  C:\Windows\System\GcJMoVW.exe
  2⤵
  PID:4704
- C:\Windows\System\iWLzSiz.exe
  C:\Windows\System\iWLzSiz.exe
  2⤵
  PID:4768
- C:\Windows\System\GSXwRQA.exe
  C:\Windows\System\GSXwRQA.exe
  2⤵
  PID:4720
- C:\Windows\System\pWCUtty.exe
  C:\Windows\System\pWCUtty.exe
  2⤵
  PID:4832
- C:\Windows\System\vrnCDWc.exe
  C:\Windows\System\vrnCDWc.exe
  2⤵
  PID:4752
- C:\Windows\System\vIZVZuA.exe
  C:\Windows\System\vIZVZuA.exe
  2⤵
  PID:4852
- C:\Windows\System\ipnuaAG.exe
  C:\Windows\System\ipnuaAG.exe
  2⤵
  PID:4820
- C:\Windows\System\BAiLatw.exe
  C:\Windows\System\BAiLatw.exe
  2⤵
  PID:4928
- C:\Windows\System\ttQTCzm.exe
  C:\Windows\System\ttQTCzm.exe
  2⤵
  PID:4960
- C:\Windows\System\EYYgFKK.exe
  C:\Windows\System\EYYgFKK.exe
  2⤵
  PID:5024
- C:\Windows\System\iLlFUem.exe
  C:\Windows\System\iLlFUem.exe
  2⤵
  PID:5012
- C:\Windows\System\IrBQijC.exe
  C:\Windows\System\IrBQijC.exe
  2⤵
  PID:5008
- C:\Windows\System\RfFzbWL.exe
  C:\Windows\System\RfFzbWL.exe
  2⤵
  PID:5040
- C:\Windows\System\tifbVKs.exe
  C:\Windows\System\tifbVKs.exe
  2⤵
  PID:5104
- C:\Windows\System\iohXxhX.exe
  C:\Windows\System\iohXxhX.exe
  2⤵
  PID:5108
- C:\Windows\System\CavMMho.exe
  C:\Windows\System\CavMMho.exe
  2⤵
  PID:3676
- C:\Windows\System\nkvngNQ.exe
  C:\Windows\System\nkvngNQ.exe
  2⤵
  PID:3192
- C:\Windows\System\kwBAzRu.exe
  C:\Windows\System\kwBAzRu.exe
  2⤵
  PID:3788
- C:\Windows\System\RwxiDBJ.exe
  C:\Windows\System\RwxiDBJ.exe
  2⤵
  PID:3692
- C:\Windows\System\rbxEvLt.exe
  C:\Windows\System\rbxEvLt.exe
  2⤵
  PID:4196
- C:\Windows\System\gqZqMCO.exe
  C:\Windows\System\gqZqMCO.exe
  2⤵
  PID:4320
- C:\Windows\System\upoZdSC.exe
  C:\Windows\System\upoZdSC.exe
  2⤵
  PID:4532
- C:\Windows\System\xqEESmN.exe
  C:\Windows\System\xqEESmN.exe
  2⤵
  PID:4536
- C:\Windows\System\WylIqTW.exe
  C:\Windows\System\WylIqTW.exe
  2⤵
  PID:4028
- C:\Windows\System\VPfiGxJ.exe
  C:\Windows\System\VPfiGxJ.exe
  2⤵
  PID:3080
- C:\Windows\System\rMaZLiO.exe
  C:\Windows\System\rMaZLiO.exe
  2⤵
  PID:4112
- C:\Windows\System\CCAFfhp.exe
  C:\Windows\System\CCAFfhp.exe
  2⤵
  PID:4272
- C:\Windows\System\khZBUuk.exe
  C:\Windows\System\khZBUuk.exe
  2⤵
  PID:2780
- C:\Windows\System\NUAKSGR.exe
  C:\Windows\System\NUAKSGR.exe
  2⤵
  PID:2856
- C:\Windows\System\RpLssju.exe
  C:\Windows\System\RpLssju.exe
  2⤵
  PID:4616
- C:\Windows\System\znnMJGC.exe
  C:\Windows\System\znnMJGC.exe
  2⤵
  PID:4620
- C:\Windows\System\UAnVnZU.exe
  C:\Windows\System\UAnVnZU.exe
  2⤵
  PID:4868
- C:\Windows\System\gXsDyNE.exe
  C:\Windows\System\gXsDyNE.exe
  2⤵
  PID:4804
- C:\Windows\System\ONSefiM.exe
  C:\Windows\System\ONSefiM.exe
  2⤵
  PID:4848
- C:\Windows\System\YcutNWN.exe
  C:\Windows\System\YcutNWN.exe
  2⤵
  PID:4976
- C:\Windows\System\YvaDxnx.exe
  C:\Windows\System\YvaDxnx.exe
  2⤵
  PID:4996
- C:\Windows\System\rXhXHlV.exe
  C:\Windows\System\rXhXHlV.exe
  2⤵
  PID:3804
- C:\Windows\System\WCccgIw.exe
  C:\Windows\System\WCccgIw.exe
  2⤵
  PID:5076
- C:\Windows\System\EiRPzBv.exe
  C:\Windows\System\EiRPzBv.exe
  2⤵
  PID:3932
- C:\Windows\System\KvaMfqF.exe
  C:\Windows\System\KvaMfqF.exe
  2⤵
  PID:4192
- C:\Windows\System\yaSYYIw.exe
  C:\Windows\System\yaSYYIw.exe
  2⤵
  PID:2432
- C:\Windows\System\HMDdTFf.exe
  C:\Windows\System\HMDdTFf.exe
  2⤵
  PID:3316
- C:\Windows\System\ZjUJYOH.exe
  C:\Windows\System\ZjUJYOH.exe
  2⤵
  PID:4140
- C:\Windows\System\wmQguim.exe
  C:\Windows\System\wmQguim.exe
  2⤵
  PID:4372
- C:\Windows\System\XnVaxzr.exe
  C:\Windows\System\XnVaxzr.exe
  2⤵
  PID:3364
- C:\Windows\System\SOhqzOI.exe
  C:\Windows\System\SOhqzOI.exe
  2⤵
  PID:2632
- C:\Windows\System\KBAOkPY.exe
  C:\Windows\System\KBAOkPY.exe
  2⤵
  PID:4880
- C:\Windows\System\AjBaOhU.exe
  C:\Windows\System\AjBaOhU.exe
  2⤵
  PID:4644
- C:\Windows\System\VtVncRJ.exe
  C:\Windows\System\VtVncRJ.exe
  2⤵
  PID:5136
- C:\Windows\System\rmUwdwp.exe
  C:\Windows\System\rmUwdwp.exe
  2⤵
  PID:5152
- C:\Windows\System\UEVPYAd.exe
  C:\Windows\System\UEVPYAd.exe
  2⤵
  PID:5168
- C:\Windows\System\nTmdIBK.exe
  C:\Windows\System\nTmdIBK.exe
  2⤵
  PID:5184
- C:\Windows\System\DqDQlzY.exe
  C:\Windows\System\DqDQlzY.exe
  2⤵
  PID:5200
- C:\Windows\System\ohVJDVe.exe
  C:\Windows\System\ohVJDVe.exe
  2⤵
  PID:5216
- C:\Windows\System\USVjjfh.exe
  C:\Windows\System\USVjjfh.exe
  2⤵
  PID:5232
- C:\Windows\System\DVyRTmt.exe
  C:\Windows\System\DVyRTmt.exe
  2⤵
  PID:5248
- C:\Windows\System\xkqBCQW.exe
  C:\Windows\System\xkqBCQW.exe
  2⤵
  PID:5264
- C:\Windows\System\DFHSeoz.exe
  C:\Windows\System\DFHSeoz.exe
  2⤵
  PID:5284
- C:\Windows\System\eFSWPRH.exe
  C:\Windows\System\eFSWPRH.exe
  2⤵
  PID:5300
- C:\Windows\System\cOetuQg.exe
  C:\Windows\System\cOetuQg.exe
  2⤵
  PID:5316
- C:\Windows\System\MFheXBL.exe
  C:\Windows\System\MFheXBL.exe
  2⤵
  PID:5332
- C:\Windows\System\KBYyqUX.exe
  C:\Windows\System\KBYyqUX.exe
  2⤵
  PID:5348
- C:\Windows\System\JZsBkvP.exe
  C:\Windows\System\JZsBkvP.exe
  2⤵
  PID:5364
- C:\Windows\System\tGapYZJ.exe
  C:\Windows\System\tGapYZJ.exe
  2⤵
  PID:5380
- C:\Windows\System\TZAGDhw.exe
  C:\Windows\System\TZAGDhw.exe
  2⤵
  PID:5396
- C:\Windows\System\Vcmglgo.exe
  C:\Windows\System\Vcmglgo.exe
  2⤵
  PID:5412
- C:\Windows\System\HnrAVuc.exe
  C:\Windows\System\HnrAVuc.exe
  2⤵
  PID:5428
- C:\Windows\System\BwPTipb.exe
  C:\Windows\System\BwPTipb.exe
  2⤵
  PID:5444
- C:\Windows\System\EflJBnL.exe
  C:\Windows\System\EflJBnL.exe
  2⤵
  PID:5460
- C:\Windows\System\BVylVEX.exe
  C:\Windows\System\BVylVEX.exe
  2⤵
  PID:5476
- C:\Windows\System\AZBqoIu.exe
  C:\Windows\System\AZBqoIu.exe
  2⤵
  PID:5492
- C:\Windows\System\ucLnmut.exe
  C:\Windows\System\ucLnmut.exe
  2⤵
  PID:5508
- C:\Windows\System\IlihGQU.exe
  C:\Windows\System\IlihGQU.exe
  2⤵
  PID:5524
- C:\Windows\System\xGHBAaZ.exe
  C:\Windows\System\xGHBAaZ.exe
  2⤵
  PID:5540
- C:\Windows\System\SivgkJW.exe
  C:\Windows\System\SivgkJW.exe
  2⤵
  PID:5556
- C:\Windows\System\zgefKTB.exe
  C:\Windows\System\zgefKTB.exe
  2⤵
  PID:5572
- C:\Windows\System\VmmlIiS.exe
  C:\Windows\System\VmmlIiS.exe
  2⤵
  PID:5588
- C:\Windows\System\osudlnG.exe
  C:\Windows\System\osudlnG.exe
  2⤵
  PID:5604
- C:\Windows\System\epdBBQh.exe
  C:\Windows\System\epdBBQh.exe
  2⤵
  PID:5620
- C:\Windows\System\PpMOEPW.exe
  C:\Windows\System\PpMOEPW.exe
  2⤵
  PID:5636
- C:\Windows\System\SvGBKLH.exe
  C:\Windows\System\SvGBKLH.exe
  2⤵
  PID:5652
- C:\Windows\System\yMtRbms.exe
  C:\Windows\System\yMtRbms.exe
  2⤵
  PID:5668
- C:\Windows\System\rYeqPbc.exe
  C:\Windows\System\rYeqPbc.exe
  2⤵
  PID:5684
- C:\Windows\System\lhGARNx.exe
  C:\Windows\System\lhGARNx.exe
  2⤵
  PID:5700
- C:\Windows\System\BfxxHuW.exe
  C:\Windows\System\BfxxHuW.exe
  2⤵
  PID:5716
- C:\Windows\System\gczklWf.exe
  C:\Windows\System\gczklWf.exe
  2⤵
  PID:5732
- C:\Windows\System\utkTCgF.exe
  C:\Windows\System\utkTCgF.exe
  2⤵
  PID:5748
- C:\Windows\System\hnrznuG.exe
  C:\Windows\System\hnrznuG.exe
  2⤵
  PID:5764
- C:\Windows\System\DUfagLv.exe
  C:\Windows\System\DUfagLv.exe
  2⤵
  PID:5780
- C:\Windows\System\sBsxFCK.exe
  C:\Windows\System\sBsxFCK.exe
  2⤵
  PID:5796
- C:\Windows\System\WpLlsjA.exe
  C:\Windows\System\WpLlsjA.exe
  2⤵
  PID:5812
- C:\Windows\System\ontLzYM.exe
  C:\Windows\System\ontLzYM.exe
  2⤵
  PID:5828
- C:\Windows\System\cZSHPEY.exe
  C:\Windows\System\cZSHPEY.exe
  2⤵
  PID:5844
- C:\Windows\System\uaqlZCA.exe
  C:\Windows\System\uaqlZCA.exe
  2⤵
  PID:5860
- C:\Windows\System\EPxzfBK.exe
  C:\Windows\System\EPxzfBK.exe
  2⤵
  PID:5876
- C:\Windows\System\rrvkrMw.exe
  C:\Windows\System\rrvkrMw.exe
  2⤵
  PID:5892
- C:\Windows\System\leoKCrr.exe
  C:\Windows\System\leoKCrr.exe
  2⤵
  PID:5908
- C:\Windows\System\hJyZgAs.exe
  C:\Windows\System\hJyZgAs.exe
  2⤵
  PID:5924
- C:\Windows\System\GosaPdd.exe
  C:\Windows\System\GosaPdd.exe
  2⤵
  PID:5940
- C:\Windows\System\BhNRgvp.exe
  C:\Windows\System\BhNRgvp.exe
  2⤵
  PID:5956
- C:\Windows\System\pJwLGBP.exe
  C:\Windows\System\pJwLGBP.exe
  2⤵
  PID:5972
- C:\Windows\System\oFxstUw.exe
  C:\Windows\System\oFxstUw.exe
  2⤵
  PID:5988
- C:\Windows\System\KJYvaJQ.exe
  C:\Windows\System\KJYvaJQ.exe
  2⤵
  PID:6004
- C:\Windows\System\dTezPde.exe
  C:\Windows\System\dTezPde.exe
  2⤵
  PID:6020
- C:\Windows\System\DqGoXFx.exe
  C:\Windows\System\DqGoXFx.exe
  2⤵
  PID:6036
- C:\Windows\System\yqdsOyD.exe
  C:\Windows\System\yqdsOyD.exe
  2⤵
  PID:6052
- C:\Windows\System\hXuvkXv.exe
  C:\Windows\System\hXuvkXv.exe
  2⤵
  PID:6068
- C:\Windows\System\rtJzagm.exe
  C:\Windows\System\rtJzagm.exe
  2⤵
  PID:6084
- C:\Windows\System\jXZzlsu.exe
  C:\Windows\System\jXZzlsu.exe
  2⤵
  PID:6100
- C:\Windows\System\WjKKyby.exe
  C:\Windows\System\WjKKyby.exe
  2⤵
  PID:6116
- C:\Windows\System\hTXEDbb.exe
  C:\Windows\System\hTXEDbb.exe
  2⤵
  PID:6132
- C:\Windows\System\xEjMDfg.exe
  C:\Windows\System\xEjMDfg.exe
  2⤵
  PID:4932
- C:\Windows\System\KFEwbtd.exe
  C:\Windows\System\KFEwbtd.exe
  2⤵
  PID:2644
- C:\Windows\System\iBdewQU.exe
  C:\Windows\System\iBdewQU.exe
  2⤵
  PID:5092
- C:\Windows\System\oTvVLKP.exe
  C:\Windows\System\oTvVLKP.exe
  2⤵
  PID:4256
- C:\Windows\System\TQRaogN.exe
  C:\Windows\System\TQRaogN.exe
  2⤵
  PID:4520
- C:\Windows\System\wljgJny.exe
  C:\Windows\System\wljgJny.exe
  2⤵
  PID:1628
- C:\Windows\System\WFdvLXI.exe
  C:\Windows\System\WFdvLXI.exe
  2⤵
  PID:3020
- C:\Windows\System\NrBzkhu.exe
  C:\Windows\System\NrBzkhu.exe
  2⤵
  PID:2660
- C:\Windows\System\BGrqYCx.exe
  C:\Windows\System\BGrqYCx.exe
  2⤵
  PID:5132
- C:\Windows\System\pQVgPin.exe
  C:\Windows\System\pQVgPin.exe
  2⤵
  PID:5160
- C:\Windows\System\eOYKYtQ.exe
  C:\Windows\System\eOYKYtQ.exe
  2⤵
  PID:5176
- C:\Windows\System\hpWFYeX.exe
  C:\Windows\System\hpWFYeX.exe
  2⤵
  PID:5224
- C:\Windows\System\TCCbmhN.exe
  C:\Windows\System\TCCbmhN.exe
  2⤵
  PID:5256
- C:\Windows\System\RuyJMLm.exe
  C:\Windows\System\RuyJMLm.exe
  2⤵
  PID:5292
- C:\Windows\System\MdphFEs.exe
  C:\Windows\System\MdphFEs.exe
  2⤵
  PID:5312
- C:\Windows\System\MxpPmvG.exe
  C:\Windows\System\MxpPmvG.exe
  2⤵
  PID:5344
- C:\Windows\System\RnHQpLX.exe
  C:\Windows\System\RnHQpLX.exe
  2⤵
  PID:5388
- C:\Windows\System\MJYlAhY.exe
  C:\Windows\System\MJYlAhY.exe
  2⤵
  PID:5408
- C:\Windows\System\hjzsrRG.exe
  C:\Windows\System\hjzsrRG.exe
  2⤵
  PID:5440
- C:\Windows\System\KfsoKZf.exe
  C:\Windows\System\KfsoKZf.exe
  2⤵
  PID:5472
- C:\Windows\System\sWcrEFz.exe
  C:\Windows\System\sWcrEFz.exe
  2⤵
  PID:5504
- C:\Windows\System\eetOFff.exe
  C:\Windows\System\eetOFff.exe
  2⤵
  PID:5548
- C:\Windows\System\ONvEymN.exe
  C:\Windows\System\ONvEymN.exe
  2⤵
  PID:5580
- C:\Windows\System\GeBmhzG.exe
  C:\Windows\System\GeBmhzG.exe
  2⤵
  PID:5612
- C:\Windows\System\MMSlCKG.exe
  C:\Windows\System\MMSlCKG.exe
  2⤵
  PID:5644
- C:\Windows\System\Okpbzho.exe
  C:\Windows\System\Okpbzho.exe
  2⤵
  PID:5676
- C:\Windows\System\aQdrnpV.exe
  C:\Windows\System\aQdrnpV.exe
  2⤵
  PID:5708
- C:\Windows\System\GESatsr.exe
  C:\Windows\System\GESatsr.exe
  2⤵
  PID:5740
- C:\Windows\System\hgQeOpa.exe
  C:\Windows\System\hgQeOpa.exe
  2⤵
  PID:5760
- C:\Windows\System\DuRhLoq.exe
  C:\Windows\System\DuRhLoq.exe
  2⤵
  PID:5788
- C:\Windows\System\KwJdzQX.exe
  C:\Windows\System\KwJdzQX.exe
  2⤵
  PID:5820
- C:\Windows\System\bzPuHKs.exe
  C:\Windows\System\bzPuHKs.exe
  2⤵
  PID:5852
- C:\Windows\System\ywiZzQc.exe
  C:\Windows\System\ywiZzQc.exe
  2⤵
  PID:5884
- C:\Windows\System\XsNCqRE.exe
  C:\Windows\System\XsNCqRE.exe
  2⤵
  PID:5916
- C:\Windows\System\WhgYTlC.exe
  C:\Windows\System\WhgYTlC.exe
  2⤵
  PID:5948
- C:\Windows\System\UGqJYld.exe
  C:\Windows\System\UGqJYld.exe
  2⤵
  PID:5980
- C:\Windows\System\KAnozpv.exe
  C:\Windows\System\KAnozpv.exe
  2⤵
  PID:5276
- C:\Windows\System\WJehptB.exe
  C:\Windows\System\WJehptB.exe
  2⤵
  PID:6028
- C:\Windows\System\OVnndXe.exe
  C:\Windows\System\OVnndXe.exe
  2⤵
  PID:6048
- C:\Windows\System\kwxLpuR.exe
  C:\Windows\System\kwxLpuR.exe
  2⤵
  PID:6080
- C:\Windows\System\JRWLMfK.exe
  C:\Windows\System\JRWLMfK.exe
  2⤵
  PID:6112
- C:\Windows\System\lAjSglb.exe
  C:\Windows\System\lAjSglb.exe
  2⤵
  PID:4800
- C:\Windows\System\qzQcTNP.exe
  C:\Windows\System\qzQcTNP.exe
  2⤵
  PID:3508
- C:\Windows\System\pWqEKzm.exe
  C:\Windows\System\pWqEKzm.exe
  2⤵
  PID:4452
- C:\Windows\System\DxtxrIT.exe
  C:\Windows\System\DxtxrIT.exe
  2⤵
  PID:4336
- C:\Windows\System\YiaRAgL.exe
  C:\Windows\System\YiaRAgL.exe
  2⤵
  PID:5128
- C:\Windows\System\WpZmvDb.exe
  C:\Windows\System\WpZmvDb.exe
  2⤵
  PID:5196
- C:\Windows\System\tYNIBCF.exe
  C:\Windows\System\tYNIBCF.exe
  2⤵
  PID:5228
- C:\Windows\System\fTVVeSE.exe
  C:\Windows\System\fTVVeSE.exe
  2⤵
  PID:5296
- C:\Windows\System\prEQvxH.exe
  C:\Windows\System\prEQvxH.exe
  2⤵
  PID:5372
- C:\Windows\System\eGcRTQw.exe
  C:\Windows\System\eGcRTQw.exe
  2⤵
  PID:5468
- C:\Windows\System\jjLYXAW.exe
  C:\Windows\System\jjLYXAW.exe
  2⤵
  PID:5500
- C:\Windows\System\yWsmNwI.exe
  C:\Windows\System\yWsmNwI.exe
  2⤵
  PID:5564
- C:\Windows\System\HjBtsVo.exe
  C:\Windows\System\HjBtsVo.exe
  2⤵
  PID:5628
- C:\Windows\System\QGyrKxz.exe
  C:\Windows\System\QGyrKxz.exe
  2⤵
  PID:5692
- C:\Windows\System\dciZZui.exe
  C:\Windows\System\dciZZui.exe
  2⤵
  PID:5756
- C:\Windows\System\mkkHOav.exe
  C:\Windows\System\mkkHOav.exe
  2⤵
  PID:5792
- C:\Windows\System\vYuwPLs.exe
  C:\Windows\System\vYuwPLs.exe
  2⤵
  PID:5868
- C:\Windows\System\GxmBUPH.exe
  C:\Windows\System\GxmBUPH.exe
  2⤵
  PID:2424
- C:\Windows\System\BKFdadG.exe
  C:\Windows\System\BKFdadG.exe
  2⤵
  PID:5968
- C:\Windows\System\JGKxjww.exe
  C:\Windows\System\JGKxjww.exe
  2⤵
  PID:2972
- C:\Windows\System\HUXygwD.exe
  C:\Windows\System\HUXygwD.exe
  2⤵
  PID:6160
- C:\Windows\System\ybngDgq.exe
  C:\Windows\System\ybngDgq.exe
  2⤵
  PID:6176
- C:\Windows\System\JtQblad.exe
  C:\Windows\System\JtQblad.exe
  2⤵
  PID:6192
- C:\Windows\System\QCiUYrv.exe
  C:\Windows\System\QCiUYrv.exe
  2⤵
  PID:6208
- C:\Windows\System\TUzZXiP.exe
  C:\Windows\System\TUzZXiP.exe
  2⤵
  PID:6224
- C:\Windows\System\aQZOFXs.exe
  C:\Windows\System\aQZOFXs.exe
  2⤵
  PID:6240
- C:\Windows\System\PJmCbQb.exe
  C:\Windows\System\PJmCbQb.exe
  2⤵
  PID:6256
- C:\Windows\System\tHkEJQW.exe
  C:\Windows\System\tHkEJQW.exe
  2⤵
  PID:6272
- C:\Windows\System\yuuplZk.exe
  C:\Windows\System\yuuplZk.exe
  2⤵
  PID:6288
- C:\Windows\System\LAZmYms.exe
  C:\Windows\System\LAZmYms.exe
  2⤵
  PID:6304
- C:\Windows\System\kAYwkSw.exe
  C:\Windows\System\kAYwkSw.exe
  2⤵
  PID:6320
- C:\Windows\System\fopFsBF.exe
  C:\Windows\System\fopFsBF.exe
  2⤵
  PID:6336
- C:\Windows\System\gnnJOhT.exe
  C:\Windows\System\gnnJOhT.exe
  2⤵
  PID:6352
- C:\Windows\System\CkLzBtw.exe
  C:\Windows\System\CkLzBtw.exe
  2⤵
  PID:6368
- C:\Windows\System\okREnkp.exe
  C:\Windows\System\okREnkp.exe
  2⤵
  PID:6384
- C:\Windows\System\CgStyjd.exe
  C:\Windows\System\CgStyjd.exe
  2⤵
  PID:6400
- C:\Windows\System\wTJSMFl.exe
  C:\Windows\System\wTJSMFl.exe
  2⤵
  PID:6416
- C:\Windows\System\WICMmdf.exe
  C:\Windows\System\WICMmdf.exe
  2⤵
  PID:6432
- C:\Windows\System\MzFKjmC.exe
  C:\Windows\System\MzFKjmC.exe
  2⤵
  PID:6448
- C:\Windows\System\VFOmiQt.exe
  C:\Windows\System\VFOmiQt.exe
  2⤵
  PID:6464
- C:\Windows\System\jbIjihN.exe
  C:\Windows\System\jbIjihN.exe
  2⤵
  PID:6480
- C:\Windows\System\CKaBggg.exe
  C:\Windows\System\CKaBggg.exe
  2⤵
  PID:6496
- C:\Windows\System\UhJPcdz.exe
  C:\Windows\System\UhJPcdz.exe
  2⤵
  PID:6512
- C:\Windows\System\yFVefmY.exe
  C:\Windows\System\yFVefmY.exe
  2⤵
  PID:6528
- C:\Windows\System\BbgdVeb.exe
  C:\Windows\System\BbgdVeb.exe
  2⤵
  PID:6544
- C:\Windows\System\yQgEhhR.exe
  C:\Windows\System\yQgEhhR.exe
  2⤵
  PID:6560
- C:\Windows\System\CoDlFAi.exe
  C:\Windows\System\CoDlFAi.exe
  2⤵
  PID:6580
- C:\Windows\System\DxrkZoP.exe
  C:\Windows\System\DxrkZoP.exe
  2⤵
  PID:6596
- C:\Windows\System\gCbJefN.exe
  C:\Windows\System\gCbJefN.exe
  2⤵
  PID:6612
- C:\Windows\System\pHIikXF.exe
  C:\Windows\System\pHIikXF.exe
  2⤵
  PID:6628
- C:\Windows\System\dwkYzAj.exe
  C:\Windows\System\dwkYzAj.exe
  2⤵
  PID:6644
- C:\Windows\System\KGpcYqB.exe
  C:\Windows\System\KGpcYqB.exe
  2⤵
  PID:6660
- C:\Windows\System\uDaLOBP.exe
  C:\Windows\System\uDaLOBP.exe
  2⤵
  PID:6676
- C:\Windows\System\HflWOev.exe
  C:\Windows\System\HflWOev.exe
  2⤵
  PID:6692
- C:\Windows\System\dNevxif.exe
  C:\Windows\System\dNevxif.exe
  2⤵
  PID:6708
- C:\Windows\System\RoLSmMG.exe
  C:\Windows\System\RoLSmMG.exe
  2⤵
  PID:6724
- C:\Windows\System\fUfTXsP.exe
  C:\Windows\System\fUfTXsP.exe
  2⤵
  PID:6740
- C:\Windows\System\KmMxOwU.exe
  C:\Windows\System\KmMxOwU.exe
  2⤵
  PID:6756
- C:\Windows\System\gPHkqMk.exe
  C:\Windows\System\gPHkqMk.exe
  2⤵
  PID:6772
- C:\Windows\System\yvpDnNn.exe
  C:\Windows\System\yvpDnNn.exe
  2⤵
  PID:6788
- C:\Windows\System\cIWzmCl.exe
  C:\Windows\System\cIWzmCl.exe
  2⤵
  PID:6804
- C:\Windows\System\jiftrsA.exe
  C:\Windows\System\jiftrsA.exe
  2⤵
  PID:6820
- C:\Windows\System\HghVaJl.exe
  C:\Windows\System\HghVaJl.exe
  2⤵
  PID:6836
- C:\Windows\System\jbURXjT.exe
  C:\Windows\System\jbURXjT.exe
  2⤵
  PID:6852
- C:\Windows\System\OmkitRi.exe
  C:\Windows\System\OmkitRi.exe
  2⤵
  PID:6868
- C:\Windows\System\kxCcryc.exe
  C:\Windows\System\kxCcryc.exe
  2⤵
  PID:6884
- C:\Windows\System\uqOrNTF.exe
  C:\Windows\System\uqOrNTF.exe
  2⤵
  PID:6900
- C:\Windows\System\JpymTvP.exe
  C:\Windows\System\JpymTvP.exe
  2⤵
  PID:6916
- C:\Windows\System\JQzRLPK.exe
  C:\Windows\System\JQzRLPK.exe
  2⤵
  PID:6932
- C:\Windows\System\JWdbaMB.exe
  C:\Windows\System\JWdbaMB.exe
  2⤵
  PID:6948
- C:\Windows\System\AOMmFSB.exe
  C:\Windows\System\AOMmFSB.exe
  2⤵
  PID:6964
- C:\Windows\System\HHlTomQ.exe
  C:\Windows\System\HHlTomQ.exe
  2⤵
  PID:6980
- C:\Windows\System\sncWJEK.exe
  C:\Windows\System\sncWJEK.exe
  2⤵
  PID:6996
- C:\Windows\System\UTonanQ.exe
  C:\Windows\System\UTonanQ.exe
  2⤵
  PID:7012
- C:\Windows\System\rJqBbgO.exe
  C:\Windows\System\rJqBbgO.exe
  2⤵
  PID:7028
- C:\Windows\System\OhvDzJN.exe
  C:\Windows\System\OhvDzJN.exe
  2⤵
  PID:7044
- C:\Windows\System\nexxNPe.exe
  C:\Windows\System\nexxNPe.exe
  2⤵
  PID:7060
- C:\Windows\System\sqfqaGD.exe
  C:\Windows\System\sqfqaGD.exe
  2⤵
  PID:7076
- C:\Windows\System\mVVAaHI.exe
  C:\Windows\System\mVVAaHI.exe
  2⤵
  PID:7092
- C:\Windows\System\ApIxtew.exe
  C:\Windows\System\ApIxtew.exe
  2⤵
  PID:7108
- C:\Windows\System\qVPgEtt.exe
  C:\Windows\System\qVPgEtt.exe
  2⤵
  PID:7124
- C:\Windows\System\zIMTSSX.exe
  C:\Windows\System\zIMTSSX.exe
  2⤵
  PID:7140
- C:\Windows\System\woffcrn.exe
  C:\Windows\System\woffcrn.exe
  2⤵
  PID:7156
- C:\Windows\System\mlMPtQA.exe
  C:\Windows\System\mlMPtQA.exe
  2⤵
  PID:6044
- C:\Windows\System\ZtXDGKP.exe
  C:\Windows\System\ZtXDGKP.exe
  2⤵
  PID:6096
- C:\Windows\System\pZRDAeg.exe
  C:\Windows\System\pZRDAeg.exe
  2⤵
  PID:4912
- C:\Windows\System\lIDQbUw.exe
  C:\Windows\System\lIDQbUw.exe
  2⤵
  PID:4400
- C:\Windows\System\AQgWMGs.exe
  C:\Windows\System\AQgWMGs.exe
  2⤵
  PID:5144
- C:\Windows\System\XJGGJno.exe
  C:\Windows\System\XJGGJno.exe
  2⤵
  PID:5260
- C:\Windows\System\ffmItEB.exe
  C:\Windows\System\ffmItEB.exe
  2⤵
  PID:5404
- C:\Windows\System\gNZTXXp.exe
  C:\Windows\System\gNZTXXp.exe
  2⤵
  PID:5516
- C:\Windows\System\XVkEngh.exe
  C:\Windows\System\XVkEngh.exe
  2⤵
  PID:5632
- C:\Windows\System\pHfUslq.exe
  C:\Windows\System\pHfUslq.exe
  2⤵
  PID:2548
- C:\Windows\System\oitALle.exe
  C:\Windows\System\oitALle.exe
  2⤵
  PID:5900
- C:\Windows\System\zjFaoxa.exe
  C:\Windows\System\zjFaoxa.exe
  2⤵
  PID:6000
- C:\Windows\System\fnWdzGq.exe
  C:\Windows\System\fnWdzGq.exe
  2⤵
  PID:6168
- C:\Windows\System\DhaPRUA.exe
  C:\Windows\System\DhaPRUA.exe
  2⤵
  PID:6200
- C:\Windows\System\YKUWdUZ.exe
  C:\Windows\System\YKUWdUZ.exe
  2⤵
  PID:6232
- C:\Windows\System\xNpXqTh.exe
  C:\Windows\System\xNpXqTh.exe
  2⤵
  PID:6264
- C:\Windows\System\IGrKjdv.exe
  C:\Windows\System\IGrKjdv.exe
  2⤵
  PID:6312
- C:\Windows\System\YNCtXdw.exe
  C:\Windows\System\YNCtXdw.exe
  2⤵
  PID:6348
- C:\Windows\System\aFoKjGD.exe
  C:\Windows\System\aFoKjGD.exe
  2⤵
  PID:6408
- C:\Windows\System\xdqknja.exe
  C:\Windows\System\xdqknja.exe
  2⤵
  PID:6328
- C:\Windows\System\afHBioP.exe
  C:\Windows\System\afHBioP.exe
  2⤵
  PID:6392
- C:\Windows\System\KJsIAit.exe
  C:\Windows\System\KJsIAit.exe
  2⤵
  PID:6444
- C:\Windows\System\kxXUcqT.exe
  C:\Windows\System\kxXUcqT.exe
  2⤵
  PID:6476
- C:\Windows\System\CaGqbli.exe
  C:\Windows\System\CaGqbli.exe
  2⤵
  PID:6508
- C:\Windows\System\QEqFLQk.exe
  C:\Windows\System\QEqFLQk.exe
  2⤵
  PID:6572
- C:\Windows\System\ZokBsvL.exe
  C:\Windows\System\ZokBsvL.exe
  2⤵
  PID:6520
- C:\Windows\System\ZVxHFJe.exe
  C:\Windows\System\ZVxHFJe.exe
  2⤵
  PID:6556
- C:\Windows\System\LiYdwcG.exe
  C:\Windows\System\LiYdwcG.exe
  2⤵
  PID:6624
- C:\Windows\System\jPSVuJJ.exe
  C:\Windows\System\jPSVuJJ.exe
  2⤵
  PID:6656
- C:\Windows\System\kamSBZp.exe
  C:\Windows\System\kamSBZp.exe
  2⤵
  PID:1480
- C:\Windows\System\AHKrVzZ.exe
  C:\Windows\System\AHKrVzZ.exe
  2⤵
  PID:1704
- C:\Windows\System\EHbFCBp.exe
  C:\Windows\System\EHbFCBp.exe
  2⤵
  PID:6720
- C:\Windows\System\zfHWyVW.exe
  C:\Windows\System\zfHWyVW.exe
  2⤵
  PID:6752
- C:\Windows\System\SMauIBT.exe
  C:\Windows\System\SMauIBT.exe
  2⤵
  PID:6780
- C:\Windows\System\TtkGqYM.exe
  C:\Windows\System\TtkGqYM.exe
  2⤵
  PID:6816
- C:\Windows\System\xhELyJp.exe
  C:\Windows\System\xhELyJp.exe
  2⤵
  PID:6848
- C:\Windows\System\eVxQbCk.exe
  C:\Windows\System\eVxQbCk.exe
  2⤵
  PID:2884
- C:\Windows\System\HnSTJTF.exe
  C:\Windows\System\HnSTJTF.exe
  2⤵
  PID:6908
- C:\Windows\System\wYjjfwG.exe
  C:\Windows\System\wYjjfwG.exe
  2⤵
  PID:6928
- C:\Windows\System\zDATyLO.exe
  C:\Windows\System\zDATyLO.exe
  2⤵
  PID:6960
- C:\Windows\System\pIKFjeZ.exe
  C:\Windows\System\pIKFjeZ.exe
  2⤵
  PID:6992
- C:\Windows\System\DXArjGd.exe
  C:\Windows\System\DXArjGd.exe
  2⤵
  PID:7024
- C:\Windows\System\CYwvWyb.exe
  C:\Windows\System\CYwvWyb.exe
  2⤵
  PID:7036
- C:\Windows\System\EIfoXAV.exe
  C:\Windows\System\EIfoXAV.exe
  2⤵
  PID:7072
- C:\Windows\System\ReDIyCr.exe
  C:\Windows\System\ReDIyCr.exe
  2⤵
  PID:7116
- C:\Windows\System\fnRRvEC.exe
  C:\Windows\System\fnRRvEC.exe
  2⤵
  PID:7100
- C:\Windows\System\MMCSveV.exe
  C:\Windows\System\MMCSveV.exe
  2⤵
  PID:7164
- C:\Windows\System\fgaBKAm.exe
  C:\Windows\System\fgaBKAm.exe
  2⤵
  PID:6128
- C:\Windows\System\ifSjhEe.exe
  C:\Windows\System\ifSjhEe.exe
  2⤵
  PID:4772
- C:\Windows\System\rzfHWkp.exe
  C:\Windows\System\rzfHWkp.exe
  2⤵
  PID:5340
- C:\Windows\System\PPQPmhB.exe
  C:\Windows\System\PPQPmhB.exe
  2⤵
  PID:5596
- C:\Windows\System\bwQmRBt.exe
  C:\Windows\System\bwQmRBt.exe
  2⤵
  PID:5728
- C:\Windows\System\ZnAXCZY.exe
  C:\Windows\System\ZnAXCZY.exe
  2⤵
  PID:5964
- C:\Windows\System\GlojwMH.exe
  C:\Windows\System\GlojwMH.exe
  2⤵
  PID:2004
- C:\Windows\System\aZeffwo.exe
  C:\Windows\System\aZeffwo.exe
  2⤵
  PID:6216
- C:\Windows\System\qlNxBgE.exe
  C:\Windows\System\qlNxBgE.exe
  2⤵
  PID:900
- C:\Windows\System\xmyvSTP.exe
  C:\Windows\System\xmyvSTP.exe
  2⤵
  PID:6280
- C:\Windows\System\PpuiVvY.exe
  C:\Windows\System\PpuiVvY.exe
  2⤵
  PID:6344
- C:\Windows\System\KYspiIu.exe
  C:\Windows\System\KYspiIu.exe
  2⤵
  PID:2976
- C:\Windows\System\TZbRLeW.exe
  C:\Windows\System\TZbRLeW.exe
  2⤵
  PID:6440
- C:\Windows\System\yzaZGIm.exe
  C:\Windows\System\yzaZGIm.exe
  2⤵
  PID:6364
- C:\Windows\System\sNMTeQE.exe
  C:\Windows\System\sNMTeQE.exe
  2⤵
  PID:672
- C:\Windows\System\FstvWDL.exe
  C:\Windows\System\FstvWDL.exe
  2⤵
  PID:6608
- C:\Windows\System\tkawwiy.exe
  C:\Windows\System\tkawwiy.exe
  2⤵
  PID:6552
- C:\Windows\System\iUddwNr.exe
  C:\Windows\System\iUddwNr.exe
  2⤵
  PID:7176
- C:\Windows\System\XKqxsrj.exe
  C:\Windows\System\XKqxsrj.exe
  2⤵
  PID:7192
- C:\Windows\System\nySBPVR.exe
  C:\Windows\System\nySBPVR.exe
  2⤵
  PID:7208
- C:\Windows\System\HfsWnoP.exe
  C:\Windows\System\HfsWnoP.exe
  2⤵
  PID:7224
- C:\Windows\System\mzcRvAo.exe
  C:\Windows\System\mzcRvAo.exe
  2⤵
  PID:7240
- C:\Windows\System\KihSPQS.exe
  C:\Windows\System\KihSPQS.exe
  2⤵
  PID:7256
- C:\Windows\System\ZwunhIF.exe
  C:\Windows\System\ZwunhIF.exe
  2⤵
  PID:7272
- C:\Windows\System\lAogBPq.exe
  C:\Windows\System\lAogBPq.exe
  2⤵
  PID:7288
- C:\Windows\System\XZrtONP.exe
  C:\Windows\System\XZrtONP.exe
  2⤵
  PID:7304
- C:\Windows\System\JYSQyQo.exe
  C:\Windows\System\JYSQyQo.exe
  2⤵
  PID:7320
- C:\Windows\System\nmimeFy.exe
  C:\Windows\System\nmimeFy.exe
  2⤵
  PID:7336
- C:\Windows\System\opcDynR.exe
  C:\Windows\System\opcDynR.exe
  2⤵
  PID:7352
- C:\Windows\System\MShQpuu.exe
  C:\Windows\System\MShQpuu.exe
  2⤵
  PID:7368
- C:\Windows\System\RRdwSwA.exe
  C:\Windows\System\RRdwSwA.exe
  2⤵
  PID:7384
- C:\Windows\System\iFwncBC.exe
  C:\Windows\System\iFwncBC.exe
  2⤵
  PID:7400
- C:\Windows\System\SVxlPWo.exe
  C:\Windows\System\SVxlPWo.exe
  2⤵
  PID:7416
- C:\Windows\System\puQeaYj.exe
  C:\Windows\System\puQeaYj.exe
  2⤵
  PID:7432
- C:\Windows\System\xMttFIE.exe
  C:\Windows\System\xMttFIE.exe
  2⤵
  PID:7448
- C:\Windows\System\uEtkeIa.exe
  C:\Windows\System\uEtkeIa.exe
  2⤵
  PID:7464
- C:\Windows\System\nzeqbPm.exe
  C:\Windows\System\nzeqbPm.exe
  2⤵
  PID:7480
- C:\Windows\System\RKjlkaN.exe
  C:\Windows\System\RKjlkaN.exe
  2⤵
  PID:7496
- C:\Windows\System\AoAZkUL.exe
  C:\Windows\System\AoAZkUL.exe
  2⤵
  PID:7512
- C:\Windows\System\HWKcDTh.exe
  C:\Windows\System\HWKcDTh.exe
  2⤵
  PID:7528
- C:\Windows\System\GarEvOT.exe
  C:\Windows\System\GarEvOT.exe
  2⤵
  PID:7544
- C:\Windows\System\QFgLtOe.exe
  C:\Windows\System\QFgLtOe.exe
  2⤵
  PID:7564
- C:\Windows\System\Oxbjijj.exe
  C:\Windows\System\Oxbjijj.exe
  2⤵
  PID:7588
- C:\Windows\System\HFmlJdi.exe
  C:\Windows\System\HFmlJdi.exe
  2⤵
  PID:7616
- C:\Windows\System\WpezDyy.exe
  C:\Windows\System\WpezDyy.exe
  2⤵
  PID:7648
- C:\Windows\System\BxYIzVO.exe
  C:\Windows\System\BxYIzVO.exe
  2⤵
  PID:7736
- C:\Windows\System\AFpHGBn.exe
  C:\Windows\System\AFpHGBn.exe
  2⤵
  PID:7796
- C:\Windows\System\dXiuNWd.exe
  C:\Windows\System\dXiuNWd.exe
  2⤵
  PID:7920
- C:\Windows\System\JQGjuyp.exe
  C:\Windows\System\JQGjuyp.exe
  2⤵
  PID:7936
- C:\Windows\System\OLkMyse.exe
  C:\Windows\System\OLkMyse.exe
  2⤵
  PID:7952
- C:\Windows\System\DCfDFoX.exe
  C:\Windows\System\DCfDFoX.exe
  2⤵
  PID:7968
- C:\Windows\System\nZcOjnL.exe
  C:\Windows\System\nZcOjnL.exe
  2⤵
  PID:7984
- C:\Windows\System\ZsQUWyo.exe
  C:\Windows\System\ZsQUWyo.exe
  2⤵
  PID:8000
- C:\Windows\System\YaaEMrm.exe
  C:\Windows\System\YaaEMrm.exe
  2⤵
  PID:8016
- C:\Windows\System\ylaDIfw.exe
  C:\Windows\System\ylaDIfw.exe
  2⤵
  PID:8032
- C:\Windows\System\WKEPJQd.exe
  C:\Windows\System\WKEPJQd.exe
  2⤵
  PID:8056
- C:\Windows\System\KRpheXh.exe
  C:\Windows\System\KRpheXh.exe
  2⤵
  PID:8076
- C:\Windows\System\zszfNLm.exe
  C:\Windows\System\zszfNLm.exe
  2⤵
  PID:8092
- C:\Windows\System\cHYAjwB.exe
  C:\Windows\System\cHYAjwB.exe
  2⤵
  PID:8108
- C:\Windows\System\VmwIeIk.exe
  C:\Windows\System\VmwIeIk.exe
  2⤵
  PID:8124
- C:\Windows\System\RtLxsBV.exe
  C:\Windows\System\RtLxsBV.exe
  2⤵
  PID:8140
- C:\Windows\System\VCFBMbD.exe
  C:\Windows\System\VCFBMbD.exe
  2⤵
  PID:8156
- C:\Windows\System\mXGYSZJ.exe
  C:\Windows\System\mXGYSZJ.exe
  2⤵
  PID:8172
- C:\Windows\System\dPRBhcm.exe
  C:\Windows\System\dPRBhcm.exe
  2⤵
  PID:8188
- C:\Windows\System\gWmzTNu.exe
  C:\Windows\System\gWmzTNu.exe
  2⤵
  PID:6076
- C:\Windows\System\DVfztpf.exe
  C:\Windows\System\DVfztpf.exe
  2⤵
  PID:6684
- C:\Windows\System\HOduEAt.exe
  C:\Windows\System\HOduEAt.exe
  2⤵
  PID:1520
- C:\Windows\System\UmoukPf.exe
  C:\Windows\System\UmoukPf.exe
  2⤵
  PID:6892
- C:\Windows\System\kPjkQCx.exe
  C:\Windows\System\kPjkQCx.exe
  2⤵
  PID:7020
- C:\Windows\System\sxwQmug.exe
  C:\Windows\System\sxwQmug.exe
  2⤵
  PID:6016
- C:\Windows\System\QCMcpgW.exe
  C:\Windows\System\QCMcpgW.exe
  2⤵
  PID:1812
- C:\Windows\System\OkToAYl.exe
  C:\Windows\System\OkToAYl.exe
  2⤵
  PID:2928
- C:\Windows\System\wgsWcVs.exe
  C:\Windows\System\wgsWcVs.exe
  2⤵
  PID:6504
- C:\Windows\System\vzeMOus.exe
  C:\Windows\System\vzeMOus.exe
  2⤵
  PID:7188
- C:\Windows\System\JlWQxyb.exe
  C:\Windows\System\JlWQxyb.exe
  2⤵
  PID:7252
- C:\Windows\System\AVWzTzz.exe
  C:\Windows\System\AVWzTzz.exe
  2⤵
  PID:7344
- C:\Windows\System\SyGzjIZ.exe
  C:\Windows\System\SyGzjIZ.exe
  2⤵
  PID:7408
- C:\Windows\System\eSriztf.exe
  C:\Windows\System\eSriztf.exe
  2⤵
  PID:7632
- C:\Windows\System\JbJiubd.exe
  C:\Windows\System\JbJiubd.exe
  2⤵
  PID:3044
- C:\Windows\System\kYQBxjv.exe
  C:\Windows\System\kYQBxjv.exe
  2⤵
  PID:7748
- C:\Windows\System\SbJNgxL.exe
  C:\Windows\System\SbJNgxL.exe
  2⤵
  PID:7764
- C:\Windows\System\plbmoar.exe
  C:\Windows\System\plbmoar.exe
  2⤵
  PID:7780
- C:\Windows\System\LJakMfL.exe
  C:\Windows\System\LJakMfL.exe
  2⤵
  PID:7928
- C:\Windows\System\MWAujIb.exe
  C:\Windows\System\MWAujIb.exe
  2⤵
  PID:7992
- C:\Windows\System\PMDmTLe.exe
  C:\Windows\System\PMDmTLe.exe
  2⤵
  PID:8236
- C:\Windows\System\QahVRwA.exe
  C:\Windows\System\QahVRwA.exe
  2⤵
  PID:8264
- C:\Windows\System\RscSDvz.exe
  C:\Windows\System\RscSDvz.exe
  2⤵
  PID:8280
- C:\Windows\System\MswPzLh.exe
  C:\Windows\System\MswPzLh.exe
  2⤵
  PID:8296
- C:\Windows\System\BJzEovI.exe
  C:\Windows\System\BJzEovI.exe
  2⤵
  PID:8312
- C:\Windows\System\rofpLfK.exe
  C:\Windows\System\rofpLfK.exe
  2⤵
  PID:8344
- C:\Windows\System\WSvmYOW.exe
  C:\Windows\System\WSvmYOW.exe
  2⤵
  PID:8360
- C:\Windows\System\KsaLTyZ.exe
  C:\Windows\System\KsaLTyZ.exe
  2⤵
  PID:8376
- C:\Windows\System\GBhtQLn.exe
  C:\Windows\System\GBhtQLn.exe
  2⤵
  PID:8392
- C:\Windows\System\TytviRf.exe
  C:\Windows\System\TytviRf.exe
  2⤵
  PID:8408
- C:\Windows\System\CUMcTRx.exe
  C:\Windows\System\CUMcTRx.exe
  2⤵
  PID:8424
- C:\Windows\System\SJZVGhY.exe
  C:\Windows\System\SJZVGhY.exe
  2⤵
  PID:8440
- C:\Windows\System\tXwrJVM.exe
  C:\Windows\System\tXwrJVM.exe
  2⤵
  PID:8456
- C:\Windows\System\RIsLeMt.exe
  C:\Windows\System\RIsLeMt.exe
  2⤵
  PID:8472
- C:\Windows\System\vEOweVn.exe
  C:\Windows\System\vEOweVn.exe
  2⤵
  PID:8488
- C:\Windows\System\BvfSOnP.exe
  C:\Windows\System\BvfSOnP.exe
  2⤵
  PID:8504
- C:\Windows\System\DznDpCi.exe
  C:\Windows\System\DznDpCi.exe
  2⤵
  PID:8520
- C:\Windows\System\kusLaSc.exe
  C:\Windows\System\kusLaSc.exe
  2⤵
  PID:8536
- C:\Windows\System\VfEWdnb.exe
  C:\Windows\System\VfEWdnb.exe
  2⤵
  PID:8556
- C:\Windows\System\QDYKiTT.exe
  C:\Windows\System\QDYKiTT.exe
  2⤵
  PID:8572
- C:\Windows\System\mMcKcLb.exe
  C:\Windows\System\mMcKcLb.exe
  2⤵
  PID:8596
- C:\Windows\System\koRVPxe.exe
  C:\Windows\System\koRVPxe.exe
  2⤵
  PID:8612
- C:\Windows\System\tUTeHlj.exe
  C:\Windows\System\tUTeHlj.exe
  2⤵
  PID:8628
- C:\Windows\System\tzkvXWs.exe
  C:\Windows\System\tzkvXWs.exe
  2⤵
  PID:8644
- C:\Windows\System\BZLacPm.exe
  C:\Windows\System\BZLacPm.exe
  2⤵
  PID:8668
- C:\Windows\System\PMnoLTc.exe
  C:\Windows\System\PMnoLTc.exe
  2⤵
  PID:8684
- C:\Windows\System\SiUnUUo.exe
  C:\Windows\System\SiUnUUo.exe
  2⤵
  PID:8732
- C:\Windows\System\jUgfILx.exe
  C:\Windows\System\jUgfILx.exe
  2⤵
  PID:8784
- C:\Windows\System\BxwvPMX.exe
  C:\Windows\System\BxwvPMX.exe
  2⤵
  PID:8804
- C:\Windows\System\JFKVfnT.exe
  C:\Windows\System\JFKVfnT.exe
  2⤵
  PID:8840
- C:\Windows\System\KlfZpps.exe
  C:\Windows\System\KlfZpps.exe
  2⤵
  PID:8872
- C:\Windows\System\doHpprh.exe
  C:\Windows\System\doHpprh.exe
  2⤵
  PID:8912
- C:\Windows\System\TRbThKU.exe
  C:\Windows\System\TRbThKU.exe
  2⤵
  PID:8964
- C:\Windows\System\LsBxjml.exe
  C:\Windows\System\LsBxjml.exe
  2⤵
  PID:9020
- C:\Windows\System\DNlDRDa.exe
  C:\Windows\System\DNlDRDa.exe
  2⤵
  PID:9080
- C:\Windows\System\KqDIlOD.exe
  C:\Windows\System\KqDIlOD.exe
  2⤵
  PID:9144
- C:\Windows\System\PumLMgL.exe
  C:\Windows\System\PumLMgL.exe
  2⤵
  PID:9288
- C:\Windows\System\EKhZQJk.exe
  C:\Windows\System\EKhZQJk.exe
  2⤵
  PID:9328
- C:\Windows\System\aDmPNxm.exe
  C:\Windows\System\aDmPNxm.exe
  2⤵
  PID:9344
- C:\Windows\System\MOsxnLE.exe
  C:\Windows\System\MOsxnLE.exe
  2⤵
  PID:9364
- C:\Windows\System\ErqgrVS.exe
  C:\Windows\System\ErqgrVS.exe
  2⤵
  PID:9388
- C:\Windows\System\eahXUfM.exe
  C:\Windows\System\eahXUfM.exe
  2⤵
  PID:9404
- C:\Windows\System\UdfeeRR.exe
  C:\Windows\System\UdfeeRR.exe
  2⤵
  PID:9424
- C:\Windows\System\UvNmXKr.exe
  C:\Windows\System\UvNmXKr.exe
  2⤵
  PID:9440
- C:\Windows\System\jehhmjg.exe
  C:\Windows\System\jehhmjg.exe
  2⤵
  PID:9456
- C:\Windows\System\yZUIpvi.exe
  C:\Windows\System\yZUIpvi.exe
  2⤵
  PID:9472
- C:\Windows\System\EaCrhfo.exe
  C:\Windows\System\EaCrhfo.exe
  2⤵
  PID:9488
- C:\Windows\System\YLDuaCz.exe
  C:\Windows\System\YLDuaCz.exe
  2⤵
  PID:9504
- C:\Windows\System\KXjfGKZ.exe
  C:\Windows\System\KXjfGKZ.exe
  2⤵
  PID:9520
- C:\Windows\System\IzPLVSU.exe
  C:\Windows\System\IzPLVSU.exe
  2⤵
  PID:9536
- C:\Windows\System\AmMFitn.exe
  C:\Windows\System\AmMFitn.exe
  2⤵
  PID:9552
- C:\Windows\System\TrlDAXt.exe
  C:\Windows\System\TrlDAXt.exe
  2⤵
  PID:9568
- C:\Windows\System\ZRHJYDK.exe
  C:\Windows\System\ZRHJYDK.exe
  2⤵
  PID:9584
- C:\Windows\System\gitrnND.exe
  C:\Windows\System\gitrnND.exe
  2⤵
  PID:10216
- C:\Windows\System\wCXhvIR.exe
  C:\Windows\System\wCXhvIR.exe
  2⤵
  PID:6972
- C:\Windows\System\pJrBWeu.exe
  C:\Windows\System\pJrBWeu.exe
  2⤵
  PID:7088
- C:\Windows\System\GggbWUj.exe
  C:\Windows\System\GggbWUj.exe
  2⤵
  PID:6140
- C:\Windows\System\blVNGFV.exe
  C:\Windows\System\blVNGFV.exe
  2⤵
  PID:2184
- C:\Windows\System\lgeEykE.exe
  C:\Windows\System\lgeEykE.exe
  2⤵
  PID:6424
- C:\Windows\System\BZlsEmf.exe
  C:\Windows\System\BZlsEmf.exe
  2⤵
  PID:7296
- C:\Windows\System\qhIiaxe.exe
  C:\Windows\System\qhIiaxe.exe
  2⤵
  PID:7428
- C:\Windows\System\vMJDCcq.exe
  C:\Windows\System\vMJDCcq.exe
  2⤵
  PID:7708
- C:\Windows\System\EzlFglc.exe
  C:\Windows\System\EzlFglc.exe
  2⤵
  PID:7792
- C:\Windows\System\EIyrzIA.exe
  C:\Windows\System\EIyrzIA.exe
  2⤵
  PID:7824
- C:\Windows\System\PEgfNYN.exe
  C:\Windows\System\PEgfNYN.exe
  2⤵
  PID:7840
- C:\Windows\System\LqmUieM.exe
  C:\Windows\System\LqmUieM.exe
  2⤵
  PID:7872
- C:\Windows\System\yucCEml.exe
  C:\Windows\System\yucCEml.exe
  2⤵
  PID:6796
- C:\Windows\System\gKUNlwW.exe
  C:\Windows\System\gKUNlwW.exe
  2⤵
  PID:8044
- C:\Windows\System\MdykxcJ.exe
  C:\Windows\System\MdykxcJ.exe
  2⤵
  PID:8120
- C:\Windows\System\CSWlolc.exe
  C:\Windows\System\CSWlolc.exe
  2⤵
  PID:6460
- C:\Windows\System\IdiKcKM.exe
  C:\Windows\System\IdiKcKM.exe
  2⤵
  PID:7148
- C:\Windows\System\fiDUcDl.exe
  C:\Windows\System\fiDUcDl.exe
  2⤵
  PID:6524
- C:\Windows\System\mthopaV.exe
  C:\Windows\System\mthopaV.exe
  2⤵
  PID:7624
- C:\Windows\System\ielZGij.exe
  C:\Windows\System\ielZGij.exe
  2⤵
  PID:7772
- C:\Windows\System\yGHxGSR.exe
  C:\Windows\System\yGHxGSR.exe
  2⤵
  PID:8232
- C:\Windows\System\LhBkYXp.exe
  C:\Windows\System\LhBkYXp.exe
  2⤵
  PID:8256
- C:\Windows\System\IAAAIBv.exe
  C:\Windows\System\IAAAIBv.exe
  2⤵
  PID:8324
- C:\Windows\System\weViGAp.exe
  C:\Windows\System\weViGAp.exe
  2⤵
  PID:8340
- C:\Windows\System\aMxvXpb.exe
  C:\Windows\System\aMxvXpb.exe
  2⤵
  PID:8432
- C:\Windows\System\ysljTCK.exe
  C:\Windows\System\ysljTCK.exe
  2⤵
  PID:8496
- C:\Windows\System\bTfBmPW.exe
  C:\Windows\System\bTfBmPW.exe
  2⤵
  PID:8564
- C:\Windows\System\FWUDniO.exe
  C:\Windows\System\FWUDniO.exe
  2⤵
  PID:8636
- C:\Windows\System\hMULDKe.exe
  C:\Windows\System\hMULDKe.exe
  2⤵
  PID:8728
- C:\Windows\System\FwYuXJO.exe
  C:\Windows\System\FwYuXJO.exe
  2⤵
  PID:8752
- C:\Windows\System\htRorBw.exe
  C:\Windows\System\htRorBw.exe
  2⤵
  PID:8768
- C:\Windows\System\bvPvLoU.exe
  C:\Windows\System\bvPvLoU.exe
  2⤵
  PID:8812
- C:\Windows\System\szSwLCD.exe
  C:\Windows\System\szSwLCD.exe
  2⤵
  PID:8832
- C:\Windows\System\ZURhmfw.exe
  C:\Windows\System\ZURhmfw.exe
  2⤵
  PID:8888
- C:\Windows\System\VNajNfj.exe
  C:\Windows\System\VNajNfj.exe
  2⤵
  PID:8904
- C:\Windows\System\vUVyTou.exe
  C:\Windows\System\vUVyTou.exe
  2⤵
  PID:7996
- C:\Windows\System\oqvTPhm.exe
  C:\Windows\System\oqvTPhm.exe
  2⤵
  PID:8996
- C:\Windows\System\eVEdaPR.exe
  C:\Windows\System\eVEdaPR.exe
  2⤵
  PID:9012
- C:\Windows\System\pPwglWj.exe
  C:\Windows\System\pPwglWj.exe
  2⤵
  PID:9096
- C:\Windows\System\PGoixgf.exe
  C:\Windows\System\PGoixgf.exe
  2⤵
  PID:9112
- C:\Windows\System\JYhZJUw.exe
  C:\Windows\System\JYhZJUw.exe
  2⤵
  PID:9128
- C:\Windows\System\bOPghDo.exe
  C:\Windows\System\bOPghDo.exe
  2⤵
  PID:9296
- C:\Windows\System\CqHXfhT.exe
  C:\Windows\System\CqHXfhT.exe
  2⤵
  PID:9312
- C:\Windows\System\LyupSUz.exe
  C:\Windows\System\LyupSUz.exe
  2⤵
  PID:2468
- C:\Windows\System\UvArKVq.exe
  C:\Windows\System\UvArKVq.exe
  2⤵
  PID:2044
- C:\Windows\System\vFQjAyq.exe
  C:\Windows\System\vFQjAyq.exe
  2⤵
  PID:9464
- C:\Windows\System\gZsdTJr.exe
  C:\Windows\System\gZsdTJr.exe
  2⤵
  PID:9528
- C:\Windows\System\BPmzUER.exe
  C:\Windows\System\BPmzUER.exe
  2⤵
  PID:8024
- C:\Windows\System\JMjHLhG.exe
  C:\Windows\System\JMjHLhG.exe
  2⤵
  PID:8352
- C:\Windows\System\ZApSKXB.exe
  C:\Windows\System\ZApSKXB.exe
  2⤵
  PID:8580
- C:\Windows\System\EuqpdTi.exe
  C:\Windows\System\EuqpdTi.exe
  2⤵
  PID:9544
- C:\Windows\System\IbvXMyd.exe
  C:\Windows\System\IbvXMyd.exe
  2⤵
  PID:8072
- C:\Windows\System\CeIcnDA.exe
  C:\Windows\System\CeIcnDA.exe
  2⤵
  PID:8136
- C:\Windows\System\vgsIMdx.exe
  C:\Windows\System\vgsIMdx.exe
  2⤵
  PID:6956
- C:\Windows\System\xgOGNpn.exe
  C:\Windows\System\xgOGNpn.exe
  2⤵
  PID:7004
- C:\Windows\System\dbJjeVT.exe
  C:\Windows\System\dbJjeVT.exe
  2⤵
  PID:2224
- C:\Windows\System\RmUVNcM.exe
  C:\Windows\System\RmUVNcM.exe
  2⤵
  PID:7380
- C:\Windows\System\zvLBWix.exe
  C:\Windows\System\zvLBWix.exe
  2⤵
  PID:7760
- C:\Windows\System\JvOkHIl.exe
  C:\Windows\System\JvOkHIl.exe
  2⤵
  PID:8208
- C:\Windows\System\GFDcElZ.exe
  C:\Windows\System\GFDcElZ.exe
  2⤵
  PID:8224
- C:\Windows\System\EAFlVGH.exe
  C:\Windows\System\EAFlVGH.exe
  2⤵
  PID:8308
- C:\Windows\System\yDuYnsK.exe
  C:\Windows\System\yDuYnsK.exe
  2⤵
  PID:8448
- C:\Windows\System\WJKxliv.exe
  C:\Windows\System\WJKxliv.exe
  2⤵
  PID:8516
- C:\Windows\System\wbBbhMV.exe
  C:\Windows\System\wbBbhMV.exe
  2⤵
  PID:8588
- C:\Windows\System\wDjrZwj.exe
  C:\Windows\System\wDjrZwj.exe
  2⤵
  PID:8656
- C:\Windows\System\BThnBij.exe
  C:\Windows\System\BThnBij.exe
  2⤵
  PID:8696
- C:\Windows\System\fHwRQXi.exe
  C:\Windows\System\fHwRQXi.exe
  2⤵
  PID:8712
- C:\Windows\System\KdGCNPK.exe
  C:\Windows\System\KdGCNPK.exe
  2⤵
  PID:8792
- C:\Windows\System\QHneoUV.exe
  C:\Windows\System\QHneoUV.exe
  2⤵
  PID:8852
- C:\Windows\System\yjgtiTX.exe
  C:\Windows\System\yjgtiTX.exe
  2⤵
  PID:8868
- C:\Windows\System\xdvihWP.exe
  C:\Windows\System\xdvihWP.exe
  2⤵
  PID:8928
- C:\Windows\System\RWDclbq.exe
  C:\Windows\System\RWDclbq.exe
  2⤵
  PID:8944
- C:\Windows\System\SLyAHWZ.exe
  C:\Windows\System\SLyAHWZ.exe
  2⤵
  PID:8960
- C:\Windows\System\TNUQtVv.exe
  C:\Windows\System\TNUQtVv.exe
  2⤵
  PID:9040
- C:\Windows\System\wKcvXxI.exe
  C:\Windows\System\wKcvXxI.exe
  2⤵
  PID:9060
- C:\Windows\System\EvgEbAB.exe
  C:\Windows\System\EvgEbAB.exe
  2⤵
  PID:9076
- C:\Windows\System\iePBexa.exe
  C:\Windows\System\iePBexa.exe
  2⤵
  PID:9168
- C:\Windows\System\uYORWYy.exe
  C:\Windows\System\uYORWYy.exe
  2⤵
  PID:9184
- C:\Windows\System\XwePqOE.exe
  C:\Windows\System\XwePqOE.exe
  2⤵
  PID:9200
- C:\Windows\System\gyWkDAv.exe
  C:\Windows\System\gyWkDAv.exe
  2⤵
  PID:9220
- C:\Windows\System\bYwvAtX.exe
  C:\Windows\System\bYwvAtX.exe
  2⤵
  PID:9236
- C:\Windows\System\AijIfFA.exe
  C:\Windows\System\AijIfFA.exe
  2⤵
  PID:9252
- C:\Windows\System\OpehlEg.exe
  C:\Windows\System\OpehlEg.exe
  2⤵
  PID:9268
- C:\Windows\System\WzSYCCI.exe
  C:\Windows\System\WzSYCCI.exe
  2⤵
  PID:9284
- C:\Windows\System\VaWAScH.exe
  C:\Windows\System\VaWAScH.exe
  2⤵
  PID:9380
- C:\Windows\System\omumkoe.exe
  C:\Windows\System\omumkoe.exe
  2⤵
  PID:9448
- C:\Windows\System\KEFmBSY.exe
  C:\Windows\System\KEFmBSY.exe
  2⤵
  PID:9512
- C:\Windows\System\OZKyEQD.exe
  C:\Windows\System\OZKyEQD.exe
  2⤵
  PID:9580
- C:\Windows\System\yEiQfgj.exe
  C:\Windows\System\yEiQfgj.exe
  2⤵
  PID:2372
- C:\Windows\System\nvXwGtP.exe
  C:\Windows\System\nvXwGtP.exe
  2⤵
  PID:9432
- C:\Windows\System\pjtQHun.exe
  C:\Windows\System\pjtQHun.exe
  2⤵
  PID:9612
- C:\Windows\System\XbJZoER.exe
  C:\Windows\System\XbJZoER.exe
  2⤵
  PID:9628
- C:\Windows\System\lbxLnVW.exe
  C:\Windows\System\lbxLnVW.exe
  2⤵
  PID:9644
- C:\Windows\System\gflDYhV.exe
  C:\Windows\System\gflDYhV.exe
  2⤵
  PID:9660
- C:\Windows\System\bUvdKUf.exe
  C:\Windows\System\bUvdKUf.exe
  2⤵
  PID:9676
- C:\Windows\System\VoMAApN.exe
  C:\Windows\System\VoMAApN.exe
  2⤵
  PID:9692
- C:\Windows\System\NOfqSGQ.exe
  C:\Windows\System\NOfqSGQ.exe
  2⤵
  PID:9708
- C:\Windows\System\NsvDGBv.exe
  C:\Windows\System\NsvDGBv.exe
  2⤵
  PID:9724
- C:\Windows\System\nyHeJlD.exe
  C:\Windows\System\nyHeJlD.exe
  2⤵
  PID:9740
- C:\Windows\System\ssoNZcj.exe
  C:\Windows\System\ssoNZcj.exe
  2⤵
  PID:9756
- C:\Windows\System\xlmzTuW.exe
  C:\Windows\System\xlmzTuW.exe
  2⤵
  PID:9772
- C:\Windows\System\CnqRLuC.exe
  C:\Windows\System\CnqRLuC.exe
  2⤵
  PID:9788
- C:\Windows\System\clfMlZK.exe
  C:\Windows\System\clfMlZK.exe
  2⤵
  PID:9804
- C:\Windows\System\wyuWYVR.exe
  C:\Windows\System\wyuWYVR.exe
  2⤵
  PID:9820
- C:\Windows\System\uARnfSd.exe
  C:\Windows\System\uARnfSd.exe
  2⤵
  PID:9836
- C:\Windows\System\oSDnVoO.exe
  C:\Windows\System\oSDnVoO.exe
  2⤵
  PID:1144
- C:\Windows\System\WkCNVPa.exe
  C:\Windows\System\WkCNVPa.exe
  2⤵
  PID:4740
- C:\Windows\System\QBmGAZa.exe
  C:\Windows\System\QBmGAZa.exe
  2⤵
  PID:9852
- C:\Windows\System\gRweknk.exe
  C:\Windows\System\gRweknk.exe
  2⤵
  PID:9868
- C:\Windows\System\dCHQiuc.exe
  C:\Windows\System\dCHQiuc.exe
  2⤵
  PID:9872
- C:\Windows\System\AnVuyrh.exe
  C:\Windows\System\AnVuyrh.exe
  2⤵
  PID:9888
- C:\Windows\System\FCkspng.exe
  C:\Windows\System\FCkspng.exe
  2⤵
  PID:9904
- C:\Windows\System\wGRxoLa.exe
  C:\Windows\System\wGRxoLa.exe
  2⤵
  PID:9916
- C:\Windows\System\ZOamJLp.exe
  C:\Windows\System\ZOamJLp.exe
  2⤵
  PID:9936
- C:\Windows\System\UFRXjEL.exe
  C:\Windows\System\UFRXjEL.exe
  2⤵
  PID:9960
- C:\Windows\System\nksVHLq.exe
  C:\Windows\System\nksVHLq.exe
  2⤵
  PID:9968
- C:\Windows\System\LtBqGFJ.exe
  C:\Windows\System\LtBqGFJ.exe
  2⤵
  PID:9996
- C:\Windows\System\zxRMwoa.exe
  C:\Windows\System\zxRMwoa.exe
  2⤵
  PID:10012
- C:\Windows\System\HpCLiBZ.exe
  C:\Windows\System\HpCLiBZ.exe
  2⤵
  PID:10028
- C:\Windows\System\vcOfZtb.exe
  C:\Windows\System\vcOfZtb.exe
  2⤵
  PID:10224
- C:\Windows\System\QLYhEsH.exe
  C:\Windows\System\QLYhEsH.exe
  2⤵
  PID:6864
- C:\Windows\System\iSnfzmd.exe
  C:\Windows\System\iSnfzmd.exe
  2⤵
  PID:7136
- C:\Windows\System\GQnaTdi.exe
  C:\Windows\System\GQnaTdi.exe
  2⤵
  PID:6380
- C:\Windows\System\khGiCCO.exe
  C:\Windows\System\khGiCCO.exe
  2⤵
  PID:10056
- C:\Windows\System\jZpxNoU.exe
  C:\Windows\System\jZpxNoU.exe
  2⤵
  PID:10072
- C:\Windows\System\tIRKVEG.exe
  C:\Windows\System\tIRKVEG.exe
  2⤵
  PID:10080
- C:\Windows\System\RsuIvxR.exe
  C:\Windows\System\RsuIvxR.exe
  2⤵
  PID:10096
- C:\Windows\System\EwxGsVY.exe
  C:\Windows\System\EwxGsVY.exe
  2⤵
  PID:10112
- C:\Windows\System\GFdaWvu.exe
  C:\Windows\System\GFdaWvu.exe
  2⤵
  PID:10128
- C:\Windows\System\oYLAqGD.exe
  C:\Windows\System\oYLAqGD.exe
  2⤵
  PID:10144
- C:\Windows\System\dyShatc.exe
  C:\Windows\System\dyShatc.exe
  2⤵
  PID:10160
- C:\Windows\System\tuBgzMo.exe
  C:\Windows\System\tuBgzMo.exe
  2⤵
  PID:10176
- C:\Windows\System\fpAcWeR.exe
  C:\Windows\System\fpAcWeR.exe
  2⤵
  PID:7364
- C:\Windows\System\ZWSQjnU.exe
  C:\Windows\System\ZWSQjnU.exe
  2⤵
  PID:2172
- C:\Windows\System\UMeuRHT.exe
  C:\Windows\System\UMeuRHT.exe
  2⤵
  PID:9384
- C:\Windows\System\JLdMIeF.exe
  C:\Windows\System\JLdMIeF.exe
  2⤵
  PID:7084
- C:\Windows\System\trVhpmR.exe
  C:\Windows\System\trVhpmR.exe
  2⤵
  PID:9980
- C:\Windows\System\hhyNIGj.exe
  C:\Windows\System\hhyNIGj.exe
  2⤵
  PID:6668
- C:\Windows\System\XYZkQnE.exe
  C:\Windows\System\XYZkQnE.exe
  2⤵
  PID:7232
- C:\Windows\System\qlISyUi.exe
  C:\Windows\System\qlISyUi.exe
  2⤵
  PID:10196
- C:\Windows\System\WYbkNVp.exe
  C:\Windows\System\WYbkNVp.exe
  2⤵
  PID:7460
- C:\Windows\System\gTTfmXf.exe
  C:\Windows\System\gTTfmXf.exe
  2⤵
  PID:7520
- C:\Windows\System\EeNiokF.exe
  C:\Windows\System\EeNiokF.exe
  2⤵
  PID:7560
- C:\Windows\System\ilyvSUx.exe
  C:\Windows\System\ilyvSUx.exe
  2⤵
  PID:7604
- C:\Windows\System\cgvCCbR.exe
  C:\Windows\System\cgvCCbR.exe
  2⤵
  PID:7660
- C:\Windows\System\QwsFTQZ.exe
  C:\Windows\System\QwsFTQZ.exe
  2⤵
  PID:7676
- C:\Windows\System\DDSAAYf.exe
  C:\Windows\System\DDSAAYf.exe
  2⤵
  PID:7692
- C:\Windows\System\gRVgBFV.exe
  C:\Windows\System\gRVgBFV.exe
  2⤵
  PID:5840
- C:\Windows\System\HgNQffT.exe
  C:\Windows\System\HgNQffT.exe
  2⤵
  PID:2604
- C:\Windows\System\PYeNUEo.exe
  C:\Windows\System\PYeNUEo.exe
  2⤵
  PID:7848
- C:\Windows\System\DHtKCoL.exe
  C:\Windows\System\DHtKCoL.exe
  2⤵
  PID:7860
- C:\Windows\System\fMLdXCD.exe
  C:\Windows\System\fMLdXCD.exe
  2⤵
  PID:7724
- C:\Windows\System\HCibNxW.exe
  C:\Windows\System\HCibNxW.exe
  2⤵
  PID:7884
- C:\Windows\System\fBFEFST.exe
  C:\Windows\System\fBFEFST.exe
  2⤵
  PID:7904
- C:\Windows\System\QwFGvFj.exe
  C:\Windows\System\QwFGvFj.exe
  2⤵
  PID:7944
- C:\Windows\System\ihVkjwH.exe
  C:\Windows\System\ihVkjwH.exe
  2⤵
  PID:3000
- C:\Windows\System\TCBXnal.exe
  C:\Windows\System\TCBXnal.exe
  2⤵
  PID:6704
- C:\Windows\System\YeJmsgH.exe
  C:\Windows\System\YeJmsgH.exe
  2⤵
  PID:6736
- C:\Windows\System\wGEmrHB.exe
  C:\Windows\System\wGEmrHB.exe
  2⤵
  PID:6812
- C:\Windows\System\KzqxOpH.exe
  C:\Windows\System\KzqxOpH.exe
  2⤵
  PID:8184
- C:\Windows\System\TiCTtsx.exe
  C:\Windows\System\TiCTtsx.exe
  2⤵
  PID:7732
- C:\Windows\System\cGFAQov.exe
  C:\Windows\System\cGFAQov.exe
  2⤵
  PID:8332
- C:\Windows\System\JjCmfOg.exe
  C:\Windows\System\JjCmfOg.exe
  2⤵
  PID:8052
- C:\Windows\System\dViSyKh.exe
  C:\Windows\System\dViSyKh.exe
  2⤵
  PID:8088
- C:\Windows\System\dLqLxDR.exe
  C:\Windows\System\dLqLxDR.exe
  2⤵
  PID:7316
- C:\Windows\System\zyTqwLm.exe
  C:\Windows\System\zyTqwLm.exe
  2⤵
  PID:8320
- C:\Windows\System\BJSbhRq.exe
  C:\Windows\System\BJSbhRq.exe
  2⤵
  PID:8532
- C:\Windows\System\QggGZWc.exe
  C:\Windows\System\QggGZWc.exe
  2⤵
  PID:8748
- C:\Windows\System\XQbKtni.exe
  C:\Windows\System\XQbKtni.exe
  2⤵
  PID:8884
- C:\Windows\System\TRDtHOO.exe
  C:\Windows\System\TRDtHOO.exe
  2⤵
  PID:9008
- C:\Windows\System\fyWFxvS.exe
  C:\Windows\System\fyWFxvS.exe
  2⤵
  PID:9136
- C:\Windows\System\iljolok.exe
  C:\Windows\System\iljolok.exe
  2⤵
  PID:9400
- C:\Windows\System\bhzkUZs.exe
  C:\Windows\System\bhzkUZs.exe
  2⤵
  PID:8764
- C:\Windows\System\kDNmsXP.exe
  C:\Windows\System\kDNmsXP.exe
  2⤵
  PID:8988
- C:\Windows\System\jInbXVF.exe
  C:\Windows\System\jInbXVF.exe
  2⤵
  PID:9124
- C:\Windows\System\PNuRjTk.exe
  C:\Windows\System\PNuRjTk.exe
  2⤵
  PID:8828
- C:\Windows\System\eQGxlMv.exe
  C:\Windows\System\eQGxlMv.exe
  2⤵
  PID:9496
- C:\Windows\System\punaaof.exe
  C:\Windows\System\punaaof.exe
  2⤵
  PID:8384
- C:\Windows\System\eQVyDYD.exe
  C:\Windows\System\eQVyDYD.exe
  2⤵
  PID:8272
- C:\Windows\System\HGmBiPz.exe
  C:\Windows\System\HGmBiPz.exe
  2⤵
  PID:8168
- C:\Windows\System\KTPrhYA.exe
  C:\Windows\System\KTPrhYA.exe
  2⤵
  PID:2268
- C:\Windows\System\lDTWPZY.exe
  C:\Windows\System\lDTWPZY.exe
  2⤵
  PID:7248
- C:\Windows\System\HteXAMN.exe
  C:\Windows\System\HteXAMN.exe
  2⤵
  PID:8216
- C:\Windows\System\wwvyMwQ.exe
  C:\Windows\System\wwvyMwQ.exe
  2⤵
  PID:8548
- C:\Windows\System\kpLnqSD.exe
  C:\Windows\System\kpLnqSD.exe
  2⤵
  PID:8720
- C:\Windows\System\wAbBFyY.exe
  C:\Windows\System\wAbBFyY.exe
  2⤵
  PID:8864
- C:\Windows\System\nJbOqpO.exe
  C:\Windows\System\nJbOqpO.exe
  2⤵
  PID:9036
- C:\Windows\System\MRLaDCK.exe
  C:\Windows\System\MRLaDCK.exe
  2⤵
  PID:9180
- C:\Windows\System\JRSwefw.exe
  C:\Windows\System\JRSwefw.exe
  2⤵
  PID:9248
- C:\Windows\System\hBqBbuf.exe
  C:\Windows\System\hBqBbuf.exe
  2⤵
  PID:8484
- C:\Windows\System\chZLmAK.exe
  C:\Windows\System\chZLmAK.exe
  2⤵
  PID:9160
- C:\Windows\System\aylFdKp.exe
  C:\Windows\System\aylFdKp.exe
  2⤵
  PID:8260
- C:\Windows\System\kLRLuJk.exe
  C:\Windows\System\kLRLuJk.exe
  2⤵
  PID:8276
- C:\Windows\System\TsxxsPg.exe
  C:\Windows\System\TsxxsPg.exe
  2⤵
  PID:8956
- C:\Windows\System\kqWampn.exe
  C:\Windows\System\kqWampn.exe
  2⤵
  PID:9196
- C:\Windows\System\BzlQgTq.exe
  C:\Windows\System\BzlQgTq.exe
  2⤵
  PID:9656
- C:\Windows\System\MGaxWgy.exe
  C:\Windows\System\MGaxWgy.exe
  2⤵
  PID:8624
- C:\Windows\System\RNpwzqF.exe
  C:\Windows\System\RNpwzqF.exe
  2⤵
  PID:9372
- C:\Windows\System\dlOdOlY.exe
  C:\Windows\System\dlOdOlY.exe
  2⤵
  PID:1488
- C:\Windows\System\FTrsluq.exe
  C:\Windows\System\FTrsluq.exe
  2⤵
  PID:9688
- C:\Windows\System\hAGnmoa.exe
  C:\Windows\System\hAGnmoa.exe
  2⤵
  PID:2212
- C:\Windows\System\bPEdRoi.exe
  C:\Windows\System\bPEdRoi.exe
  2⤵
  PID:9668
- C:\Windows\System\CWNKYRv.exe
  C:\Windows\System\CWNKYRv.exe
  2⤵
  PID:9748
- C:\Windows\System\pvqdFeW.exe
  C:\Windows\System\pvqdFeW.exe
  2⤵
  PID:9752
- C:\Windows\System\ZSWmZSS.exe
  C:\Windows\System\ZSWmZSS.exe
  2⤵
  PID:9816
- C:\Windows\System\Yuhixos.exe
  C:\Windows\System\Yuhixos.exe
  2⤵
  PID:9596
- C:\Windows\System\JxphMfE.exe
  C:\Windows\System\JxphMfE.exe
  2⤵
  PID:9900
- C:\Windows\System\WSmybwJ.exe
  C:\Windows\System\WSmybwJ.exe
  2⤵
  PID:9964
- C:\Windows\System\ZtpPQrI.exe
  C:\Windows\System\ZtpPQrI.exe
  2⤵
  PID:10044
- C:\Windows\System\bxhAIXA.exe
  C:\Windows\System\bxhAIXA.exe
  2⤵
  PID:9800
- C:\Windows\System\mxPtmzN.exe
  C:\Windows\System\mxPtmzN.exe
  2⤵
  PID:9796
- C:\Windows\System\PLeHiiK.exe
  C:\Windows\System\PLeHiiK.exe
  2⤵
  PID:9864
- C:\Windows\System\AWxjJyR.exe
  C:\Windows\System\AWxjJyR.exe
  2⤵
  PID:9920
- C:\Windows\System\IGQVSGt.exe
  C:\Windows\System\IGQVSGt.exe
  2⤵
  PID:9992
- C:\Windows\System\jsRfoSw.exe
  C:\Windows\System\jsRfoSw.exe
  2⤵
  PID:10236
- C:\Windows\System\UdZIfcC.exe
  C:\Windows\System\UdZIfcC.exe
  2⤵
  PID:6252
- C:\Windows\System\GwMgDJq.exe
  C:\Windows\System\GwMgDJq.exe
  2⤵
  PID:10104
- C:\Windows\System\TiXQGnI.exe
  C:\Windows\System\TiXQGnI.exe
  2⤵
  PID:10108
- C:\Windows\System\QurtVmU.exe
  C:\Windows\System\QurtVmU.exe
  2⤵
  PID:10120
- C:\Windows\System\OXvgtYa.exe
  C:\Windows\System\OXvgtYa.exe
  2⤵
  PID:10172
- C:\Windows\System\hLKKRnt.exe
  C:\Windows\System\hLKKRnt.exe
  2⤵
  PID:2492
- C:\Windows\System\VRLXHCO.exe
  C:\Windows\System\VRLXHCO.exe
  2⤵
  PID:5836
- C:\Windows\System\ZfiDFPE.exe
  C:\Windows\System\ZfiDFPE.exe
  2⤵
  PID:7264
- C:\Windows\System\GVUdJzj.exe
  C:\Windows\System\GVUdJzj.exe
  2⤵
  PID:7492
- C:\Windows\System\uXbJChN.exe
  C:\Windows\System\uXbJChN.exe
  2⤵
  PID:7672
- C:\Windows\System\pbrwubF.exe
  C:\Windows\System\pbrwubF.exe
  2⤵
  PID:7612
- C:\Windows\System\RVTwhGV.exe
  C:\Windows\System\RVTwhGV.exe
  2⤵
  PID:10212
- C:\Windows\System\kDShrDD.exe
  C:\Windows\System\kDShrDD.exe
  2⤵
  PID:7820
- C:\Windows\System\sLJyvil.exe
  C:\Windows\System\sLJyvil.exe
  2⤵
  PID:7836
- C:\Windows\System\KlZhTPX.exe
  C:\Windows\System\KlZhTPX.exe
  2⤵
  PID:1652
- C:\Windows\System\GsZTrFt.exe
  C:\Windows\System\GsZTrFt.exe
  2⤵
  PID:7900
- C:\Windows\System\TguCukG.exe
  C:\Windows\System\TguCukG.exe
  2⤵
  PID:8012
- C:\Windows\System\eKjPBrL.exe
  C:\Windows\System\eKjPBrL.exe
  2⤵
  PID:7912
- C:\Windows\System\jCfXeYw.exe
  C:\Windows\System\jCfXeYw.exe
  2⤵
  PID:7892
- C:\Windows\System\NBpyhBN.exe
  C:\Windows\System\NBpyhBN.exe
  2⤵
  PID:8252
- C:\Windows\System\JtOQBaz.exe
  C:\Windows\System\JtOQBaz.exe
  2⤵
  PID:8464
- C:\Windows\System\abfSNci.exe
  C:\Windows\System\abfSNci.exe
  2⤵
  PID:6860
- C:\Windows\System\IkgSJwi.exe
  C:\Windows\System\IkgSJwi.exe
  2⤵
  PID:8744
- C:\Windows\System\FzEbmoP.exe
  C:\Windows\System\FzEbmoP.exe
  2⤵
  PID:9004
- C:\Windows\System\dpYdefo.exe
  C:\Windows\System\dpYdefo.exe
  2⤵
  PID:9108
- C:\Windows\System\QDYfoMw.exe
  C:\Windows\System\QDYfoMw.exe
  2⤵
  PID:8900
- C:\Windows\System\kwQqPVL.exe
  C:\Windows\System\kwQqPVL.exe
  2⤵
  PID:8760
- C:\Windows\System\JswDXSs.exe
  C:\Windows\System\JswDXSs.exe
  2⤵
  PID:8064
- C:\Windows\System\kxqSfhg.exe
  C:\Windows\System\kxqSfhg.exe
  2⤵
  PID:9564
- C:\Windows\System\NkssGjJ.exe
  C:\Windows\System\NkssGjJ.exe
  2⤵
  PID:6940
- C:\Windows\System\QFomxsx.exe
  C:\Windows\System\QFomxsx.exe
  2⤵
  PID:8860
- C:\Windows\System\XvPYPds.exe
  C:\Windows\System\XvPYPds.exe
  2⤵
  PID:8204
- C:\Windows\System\waQwRBg.exe
  C:\Windows\System\waQwRBg.exe
  2⤵
  PID:9624
- C:\Windows\System\dXQigsf.exe
  C:\Windows\System\dXQigsf.exe
  2⤵
  PID:8952
- C:\Windows\System\tQojYQU.exe
  C:\Windows\System\tQojYQU.exe
  2⤵
  PID:2452
- C:\Windows\System\ZrYEFHT.exe
  C:\Windows\System\ZrYEFHT.exe
  2⤵
  PID:9416
- C:\Windows\System\YByzTRX.exe
  C:\Windows\System\YByzTRX.exe
  2⤵
  PID:9188
- C:\Windows\System\uffHImV.exe
  C:\Windows\System\uffHImV.exe
  2⤵
  PID:8512
- C:\Windows\System\rvhzLoo.exe
  C:\Windows\System\rvhzLoo.exe
  2⤵
  PID:9600
- C:\Windows\System\OFhVHIY.exe
  C:\Windows\System\OFhVHIY.exe
  2⤵
  PID:9228
- C:\Windows\System\UIBrmrh.exe
  C:\Windows\System\UIBrmrh.exe
  2⤵
  PID:9932
- C:\Windows\System\faQiJxH.exe
  C:\Windows\System\faQiJxH.exe
  2⤵
  PID:9812
- C:\Windows\System\kWnSHlg.exe
  C:\Windows\System\kWnSHlg.exe
  2⤵
  PID:9720
- C:\Windows\System\JyMAyQK.exe
  C:\Windows\System\JyMAyQK.exe
  2⤵
  PID:10040
- C:\Windows\System\XNEdMRt.exe
  C:\Windows\System\XNEdMRt.exe
  2⤵
  PID:9948
- C:\Windows\System\VdviXCG.exe
  C:\Windows\System\VdviXCG.exe
  2⤵
  PID:9884
- C:\Windows\System\OQrmyXR.exe
  C:\Windows\System\OQrmyXR.exe
  2⤵
  PID:10084
- C:\Windows\System\JFBAsoM.exe
  C:\Windows\System\JFBAsoM.exe
  2⤵
  PID:10188
- C:\Windows\System\AJSAbOF.exe
  C:\Windows\System\AJSAbOF.exe
  2⤵
  PID:10048
- C:\Windows\System\SZNbaBP.exe
  C:\Windows\System\SZNbaBP.exe
  2⤵
  PID:7360
- C:\Windows\System\jvWxWaj.exe
  C:\Windows\System\jvWxWaj.exe
  2⤵
  PID:6568
- C:\Windows\System\fmHibQb.exe
  C:\Windows\System\fmHibQb.exe
  2⤵
  PID:7668
- C:\Windows\System\IFnOvjP.exe
  C:\Windows\System\IFnOvjP.exe
  2⤵
  PID:7812
- C:\Windows\System\jieIrLi.exe
  C:\Windows\System\jieIrLi.exe
  2⤵
  PID:7688
- C:\Windows\System\tSmjLcd.exe
  C:\Windows\System\tSmjLcd.exe
  2⤵
  PID:7856
- C:\Windows\System\ocVbhuB.exe
  C:\Windows\System\ocVbhuB.exe
  2⤵
  PID:8248
- C:\Windows\System\xauUZFH.exe
  C:\Windows\System\xauUZFH.exe
  2⤵
  PID:6248
- C:\Windows\System\wqZtVqn.exe
  C:\Windows\System\wqZtVqn.exe
  2⤵
  PID:8404
- C:\Windows\System\OVSETbt.exe
  C:\Windows\System\OVSETbt.exe
  2⤵
  PID:9324
- C:\Windows\System\BTbPnIo.exe
  C:\Windows\System\BTbPnIo.exe
  2⤵
  PID:9436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CrXGDJA.exe

Filesize
3.8MB

MD5
387a2f91e45eeb0426ed3619a32fbd7b

SHA1
8eb53f3d4860e123154a929a740b8df9b26f9161

SHA256
0a060d81b3cd55e4e20f0bfbf6c074a3e5e75c39bff27e103097b0d37e4e5d08

SHA512
62e528d76a81bd43f4aa9141fad49eda67436452888d1c5e7716b2510a3536a78c8cd3624aa62f1c2a5a74b44a9fc7b6598fc6bd337af5f8e6b2554cbb900883

Download Submit
C:\Windows\system\EJujHyB.exe

Filesize
3.8MB

MD5
6ed642d432f2dae403d3014b8bd46d14

SHA1
dfe38f09736593b037b07109bff6f7752a3ac5d9

SHA256
90e4ba1f1f89b9a80634529bfc52db49fab52a2d7c23d40760edd942d2d9183e

SHA512
66670e37bb1ddde721e7f3313db611414fadcb4aae55ef0ed23fb597b640f6fdf81863d67ea5c39756f5c74ce26e0ef80cc107dfe7f5611a71b2b43d39cf38d5

Download Submit
C:\Windows\system\Fuinjcg.exe

Filesize
3.8MB

MD5
3e5bdc5e100e4d10e73b0f43a6b7ac19

SHA1
3787c67cb9abd35b1da67aff910d817f8cda507c

SHA256
4f62e4b97e0b87ab283ca4c22c79056605666d78803e4bb06fbcc37e5fd6bd67

SHA512
719618bf54eb12977f354010ad9d1c4d3beddc633835dbb93c2450d06d854130eec944f1f2883dd8e1c136cdf5bf66e265b2eb7b4f1a34a14212a7c003df2ee0

Download Submit
C:\Windows\system\IjDiTOo.exe

Filesize
3.8MB

MD5
7d927b3ad5672161d172b48c95310d1f

SHA1
2b9e6c68c819355f559fb2d4ba45406d01c10522

SHA256
2d95b20962b0ee7c420fae0f7b736d6b421f3ac03fa51b8c081186b75a89a62f

SHA512
43047e0b58f091b1dbae5d61d9268318b3427e5dbf02831b0a4fe6bf11f34c0d3c0b123c5013a16e229700fc493c9e63697966019b95eee4de63098fcffa8242

Download Submit
C:\Windows\system\JQDXPrT.exe

Filesize
3.8MB

MD5
f7623a0efd4bd5dc0527e6207b87bcd7

SHA1
914866f137a816d443f83b1255332351ea0c77d7

SHA256
8aeffd056bf371b4f670f2e293a4a54880d38d042e4618372c0d16f2f92d78c2

SHA512
03decd66cb53a855c7e4d17a4b36a20878712879f75b615825e4afa37e84cc9b4f02f084a2d1b027c7e5b3d3a3f86d7a475220140e295c3a06950a018a9d2c29

Download Submit
C:\Windows\system\MQjnRgL.exe

Filesize
3.8MB

MD5
2748abf2aafe1e0dd94e280f62a02adc

SHA1
eee0bedb58d1d5c0d1063e642b777c3cbcea45a0

SHA256
c895c85185aa16aa5d83b282be10272860215fa6c66827d96ff948a559cd08c5

SHA512
fc0a18888bcfd4cae06b2408d38102494fd9874cae5ba1ba3b8b60d8dd8ecbef336bd6953f39c068dd40042942291d2633fdcab94dc9e962961f1232c9a519fe

Download Submit
C:\Windows\system\NVPQiuW.exe

Filesize
3.8MB

MD5
68961f288dc167319db0e8afbb8f1866

SHA1
0cd71072d7244460c4880318893ca46df441f535

SHA256
1a8255005cd0a15e05a5d83f652bc9c0ac0834a01d909540bf36142998eb70ab

SHA512
e0ec0a2c454013bcd11f0df2839cbbbf8fe7ceac496c16ea5d1db9c8138462f35b0611b47346391aa6af2b425510fc54cf67f59116fd01a82159524b67a38671

Download Submit
C:\Windows\system\PpVTrST.exe

Filesize
3.8MB

MD5
b3420a5a4324d7128e9b4c3fc490b747

SHA1
3614daabd12f5b6ad514c90c5d34f75591c00cc8

SHA256
ceb821e88b798d45a4f1fa157c7b2fe271820f8adacc3985b0da9e52f5ced7ad

SHA512
923256070187b9e22d748f410e441608fa1ccee64de49180d48da4b69e8e18e26de202ef07af8616b73bd42eb1cdd570362e80449c92caad6d8c7ab3b4ab6674

Download Submit
C:\Windows\system\VFvjEzv.exe

Filesize
3.8MB

MD5
b193cf235cf69d2a4ba723a1eee03f99

SHA1
93ede917d3cd082453e1e8d5333c54d4265be266

SHA256
13e42d5c0741f3be4919a0ab7d33ae25ed772b76c269868d098651dd5d9e502e

SHA512
1da1383ea75104994aeebcd3be06c877fdfd4076c936dc1f6f8b713e5f90e8b65d0fb3e379f8c0bd413995d7655ebb460562d4c0aee42da2b93b2cb186b1939d

Download Submit
C:\Windows\system\YlHfXAi.exe

Filesize
3.8MB

MD5
89e87b04b993863e9d814d007e95fc7a

SHA1
cca93e0453ab1765276f050f16ea8dfde6ff7313

SHA256
e10df88e3d927840db63cd14a307efcc81dfc224385c108afd04d78e903d47a8

SHA512
e04f00fdbe07936d8ac19cd0d8286a83c788a5bd7af22351bc3b6878ee0baaae25aa67ac33a1dea5f5b6f13ea14c8a1af49fc9af17634a590b38ab917c0e7409

Download Submit
C:\Windows\system\ZtLYCON.exe

Filesize
3.8MB

MD5
c7dc6ca2cfce1ab792805f5636d96598

SHA1
bcff09139f9f7beaa9b8027479502391bb0cc1e2

SHA256
84305e362284bbe9ad3b38149d0998e1d454dfb0122f06757b1ecf44c4271252

SHA512
9a8c14f123a7d729b5b579638d7e1914b63222f2149b8eb0dfd38743ed9d7e84470b1a7df3d6ef19b979e599be673a7a1049be1c8fc432b26f1211fbe87ec6fe

Download Submit
C:\Windows\system\ayaojmx.exe

Filesize
3.8MB

MD5
3e4a2100fa0b77f098908f4148519cf9

SHA1
d379e7d5ec29c183bc159befa90bec4b2a19aee8

SHA256
11f3f4f690506397b119b5ae8ca7115d84f2341c437c23c15b18ae94d5d380e6

SHA512
38110881edd544eb55a3206d78e8ba5b629c9cc1b97b5e7967ff2e53da5b29664a03a5bd0fe631e2bdc4e0167e113910e352e80a8d845e149bb367e93107d289

Download Submit
C:\Windows\system\bUQFjrU.exe

Filesize
3.8MB

MD5
30ec80b06294ec649308c79cd084e462

SHA1
7c9f7458584279d05ea15cede40f2a9238df899b

SHA256
0b782fa59ffb4b5d734fa8fe94e06eb44020103e34bac52424fd5e4755c96758

SHA512
92c0b838cf1bd7ae36bdf993e44b53c12277a4e3375ef283bf16539f5d1bf57d23578a11bf554cc8c70aa7408ff3ebe54daf8cd281f5ddbb08648bb75161ffaf

Download Submit
C:\Windows\system\dOiVJpL.exe

Filesize
3.8MB

MD5
ab183fb95a6337a5b01b74fd42d9c0cf

SHA1
56c2115096b79c42ef721b66be93fa63271ed407

SHA256
ec6d91bac4cd244abfc8ff838f406596ba432a3c02f6fb0d7c612a6a43683284

SHA512
729fe8d3447c0b4e7cd37b4dd19a5a5ebb0cee119c81bfd2820b3711cd9ce1bb48b9b7ca734f04bb7f350969a556881f8bd6ad3177c23f57477a374eecbafaeb

Download Submit
C:\Windows\system\eYQXkcG.exe

Filesize
3.8MB

MD5
5ca258da15ea5fa3accaab1fd10e95c6

SHA1
729753f8e379404382f211a2172f50df26ac5acb

SHA256
966a3707d9a272a8b58102f5cd92107480955e0dec7bf7d12196fd71eb2817d6

SHA512
ccd1caf09089cd6da8123b08f43863b7a26ff3a4e0014b84c7ba5d99d9cd5fdbaa50386de83d9e6db3d68de01c14ef87c54058a5c726443cbe306edfa33f87b6

Download Submit
C:\Windows\system\hSCjKGC.exe

Filesize
3.8MB

MD5
ab537a38aaaae17f579f54fe6fc1bb59

SHA1
558402b7c1a412bc8a6934ec66aac07e1bdbaab2

SHA256
109fbf8e9e8fd1163403192bd3e2632cd0b93085b63f161e2980f6ad6bc5f909

SHA512
a89487e1c6ea7ffe29ebd914e36b1654979a1ca54baf8529ce0b5d11b0c5f3616902749eda453f58f312a7a31eab785139d85ec2d3b6e5be3c50d5c0b82370f8

Download Submit
C:\Windows\system\iHDczCx.exe

Filesize
3.8MB

MD5
a5107288a03c9eaa699fb7110f8a9315

SHA1
6d06730486945a911423ef66724c05eacd6dd616

SHA256
61c83c8d61a4c3fae452f08bb730f13fcfbc87d5ff20b6f090cc4275f8d3a314

SHA512
77a46ed4fb3ba8eec759cfb95957b574ff9f116aec7319e3c8727e594dfbf8d0c2e3a07e1cb40e92d78e3513b18fd6a5cb22ed9a06dd334ff34e7a555c1bfa57

Download Submit
C:\Windows\system\iZodoDF.exe

Filesize
3.8MB

MD5
3028d114779db3f54808a5af35dcc5db

SHA1
64a67c96b1aa1b26ecc576530da2e16f8e1dc511

SHA256
9f188be9d5af678b7528800a94d426718c871df1931623d9ba7d782a0110d7af

SHA512
edd3262d1f89996f9fe3bedd582f46d8e0200618fb903345f3463d922f18868be1d3ffb03eb3e69bf6829effb52fa63dcd6e793fa9493b38764cdc7c7d4e775d

Download Submit
C:\Windows\system\pUqnOdt.exe

Filesize
3.8MB

MD5
1c791262f4bdb5a89c38f2dbc1b4df8e

SHA1
87b6630e52d2eceb4b8924db8678b2aeaf74ed11

SHA256
69bcb6f27ddb17f4f6fd61054e74b1fd5da271f49402cc0f363fd471fac72ac1

SHA512
7ac9a6c887c44ad4d0ee0e427ad9b59209ebb5c53052b647bb82cc611884c844f781cba6b949bc44244334505871e89102a0a42119d966cdc738daaa0d55dc07

Download Submit
C:\Windows\system\qFveDwD.exe

Filesize
3.8MB

MD5
272e0fe5772883fb33ee87ac88c46ed1

SHA1
1b2d1d0df6b4b12ab3150c4063ab9b60a15fd712

SHA256
effae288f7d6665f390231c30d079cfaea14aa960a7909c44ab70b8047553d1d

SHA512
6a6aad69b0eb8484933bf9a1230ba596d8d86e46fede1888e6d77f132a0808978051b32d7baa62872c67717b4b85782f12ec90e3fd5300568ecc66c867435fb1

Download Submit
C:\Windows\system\sJdtPbA.exe

Filesize
3.8MB

MD5
f44bf1589f37bb52ff5acf683201d2cd

SHA1
b2f6834cc67bc06531dc3254ac4f81aa17ca6cdf

SHA256
51a5cf4e6b5fabac34b77b1370276d5f34f9484c8d84f382a6decdd75fc9353a

SHA512
e5218fb5258f535a384a13f2c6fa0c3dc032945c38e3d8a2affb2148f6f96a9ce9b407412771e5c948daa1e1545d1ae30062cc1d5c3e67928a46efad7aa465b9

Download Submit
C:\Windows\system\sSjlBZy.exe

Filesize
18B

MD5
12d764af0242c5e9d5789b2b47191cab

SHA1
27c955d8895a3dd74067d2c8c2ddd4db89461025

SHA256
22fad68840942c3468f5bd85214408fef29e825f9fa4402f948647dd9bfcfbbf

SHA512
345f6542208a71772d6f12acd8a7a946bff3a5b0364922fdfdbb97f70b74edd2676762bb63e6f4b3817ce1c84a3d722837cfba2c47e6d30027d13c7c41912d58

Download Submit
C:\Windows\system\tGBJWZG.exe

Filesize
3.8MB

MD5
5c814b120c94ea32f64a69da5c3f8205

SHA1
988fedb42b30e39f74d8b5690cf55c4ec003ba82

SHA256
1f69ff2060e85d54066a4b28b22acca0067a91abdf9020da98e118e040290d9b

SHA512
599a13d9fb8eec5b2a91481c4bf29c3aed441226e2c30634335ad5b6ca429ff80cf5775209152b63c7778c1b7ca1534132926c80db09c053d2c2ae7670f3e772

Download Submit
C:\Windows\system\vRZQnzs.exe

Filesize
3.8MB

MD5
35ba5407f5f90f50756b764bea3d9ce6

SHA1
49aab8c65b10d8d2e0f9fafce5442ef881019f55

SHA256
177a6c4e7f66bc6454b9b4b20b6f75402a6c6ffba654fee6dc2398adb1851b19

SHA512
ea99eb88b823ec231a2956e434e40384cc9f7a6dc3ae44e68872dc667456021c701ccdc81f2a9ba989434a87ea909a9163613ecd910cc27ab44641d13dffcc6d

Download Submit
C:\Windows\system\yMiCXXI.exe

Filesize
3.8MB

MD5
bfb5176bae58d5f27d1997f68d5daf54

SHA1
7b7433c5d4d1514e42fa17e312f38c95f8031c2e

SHA256
210423c0dfc1878af72506192c35c6c685b34bc3b8cda16d011b016246eff368

SHA512
df59a2937e92ff394991dec3195e74114b771ff3bf9e684142839004e2952e87387b3c50eacdc1246117e2341025231a81b9a798e90fc0291f1c34d01280db99

Download Submit
C:\Windows\system\zOuJPAE.exe

Filesize
3.8MB

MD5
70ccb2f5c55ebe2fa596ccc921738070

SHA1
ce463412b27d00dbfc9295425996f2d0d826a526

SHA256
c43d57169c4536489a49927dc390b0991aa9c5e6ac7b9e85cbd7bd9139c4f459

SHA512
342ee10db408d08f79f7327f24737e5a427db8bb1fac00ee16845fa08dfe0d14ea4bac4470976b11450850288638d32dfeaa9282252c1831f2c8e4d3eda38496

Download Submit
\Windows\system\EfOvhjm.exe

Filesize
3.8MB

MD5
b23935deba8792e52456ffc66f91ee3a

SHA1
2bbc273e0fd3ebc4058fd291510ab0a871d6e803

SHA256
6df103fa5170e5facfc67abb008656fe395e93d348ef044baefcad50dd7d1f56

SHA512
ac25e8ca8f091add740a68e338b72a668acfb35d8b5550c832daa423824189fa959ea87db5df75c3cc962d07b952ad12e8b9b8a308dc9af8b09de188916943be

Download Submit
\Windows\system\GuIVgFF.exe

Filesize
3.8MB

MD5
4261d6457d3246b83680cccdb7ae7d54

SHA1
bc978b4f47593bf0daea87aa1ecb7346fe741592

SHA256
80fe1ecdcf2f7452442a64667dbb88e03e7320f9bd585ca4256dae31513a8f43

SHA512
1fd93e4e1ba4db274e34da3b9fa1c06ae4acb87c227a20b9be996bacc2956f65a2e7f6171a07dea04a86527c5be8839010f5accdacfb7861315efe08fe95731b

Download Submit
\Windows\system\IKcdwGL.exe

Filesize
3.8MB

MD5
b49495889d3efcd1f1f675736116b91a

SHA1
04c5f562e153807af462b7dce187ccd8264ef088

SHA256
43d4bf34e952c92487f80d1df84a0ed7f64bfe9a47a984762f03f5f24dbd2e13

SHA512
35f57832a1a0461ac27d4414836aecf8c4a62d53a1195b29a6c1b5b49bc393c3ef65b2ff598bbe1a304c81fb96db9e951d38ac61f5447c174584fd400707ad95

Download Submit
\Windows\system\KMtRZrR.exe

Filesize
3.8MB

MD5
d2b77eaf858a332ddf42a9ca566f4163

SHA1
28a63ee832c9eaaf6a4ab95f0984bb4368c69b40

SHA256
edff9b7a3755b7a60ccbc4191bb80f2e7106ef79d94f728d159e9b6c87190ab2

SHA512
d7b2b99aaa15d6413c8c3ab0def24c798ab22722c9e1d9446b3e2303bf44ef3dc05803a99860288c6ec611ee9eb6fd767759559c670574dd8d7213f630b54c5f

Download Submit
\Windows\system\YyGdUUy.exe

Filesize
3.8MB

MD5
9e5df845761ca3bd68c1d658ad9f5cff

SHA1
9ff7a82e4c57cba3e62b9e5ab20d6e3ad23e060c

SHA256
acaa34a503d9d5c726f703b02f3326018d8b7caac452b54c5da555b62e0be900

SHA512
5e2bf37d5ac48b2aa0e532610e56c7479be6fd7895814323301c8e1a5c550eee4fdf5953ba6d94b66ccdbc184aeabda3181b3e84a5f792ddc91d258258c86852

Download Submit
\Windows\system\agUJESL.exe

Filesize
3.8MB

MD5
b7c8aa7d70837c01805dfd8a9022bb9a

SHA1
b50716e4044c76eeeffb07fde1635a1ea6f18e0a

SHA256
8a3403ae2201d810054e067d9cf566b1a2b4ce370c9f0435c2b46f564e9bc12e

SHA512
18c479696d3d2e0242b1c02fb5ebac5a7dcce2b9ec184de6f9f8c5584f4002124503017e67b89105d5b7a1e2d52e3147f4d308a3b98a8ec531cbd204db74f00e

Download Submit
\Windows\system\lIFqKoq.exe

Filesize
3.8MB

MD5
8dc246ce13e03b02d7165fcd7050986b

SHA1
26dc530794f2a07698cf4f5d61db36e108cf4322

SHA256
db6c63c92d3c9107cd9157a72068f824b8db249527d77f947164d8f49876ba3a

SHA512
0a9db785ac8463afcf28301a8cadb45e2e5cb2ec97b19dda8f702e74b54aa4d2cb2014c76fbcd8434a3abe3d522e2e3a06734dbe74a23825abda56ece34f2fae

Download Submit
memory/536-63-0x000000001B6D0000-0x000000001B9B2000-memory.dmp

Filesize
2.9MB

Download
memory/536-64-0x0000000001DA0000-0x0000000001DA8000-memory.dmp

Filesize
32KB

Download
memory/1060-76-0x000000013F400000-0x000000013F7F6000-memory.dmp

Filesize
4.0MB

Download
memory/1264-529-0x000000013FD90000-0x0000000140186000-memory.dmp

Filesize
4.0MB

Download
memory/1264-5298-0x000000013FD90000-0x0000000140186000-memory.dmp

Filesize
4.0MB

Download
memory/1264-14-0x000000013FD90000-0x0000000140186000-memory.dmp

Filesize
4.0MB

Download
memory/1924-89-0x000000013F040000-0x000000013F436000-memory.dmp

Filesize
4.0MB

Download
memory/1924-9038-0x000000013F040000-0x000000013F436000-memory.dmp

Filesize
4.0MB

Download
memory/2388-1-0x000000013FD60000-0x0000000140156000-memory.dmp

Filesize
4.0MB

Download
memory/2388-74-0x000000013FD60000-0x0000000140156000-memory.dmp

Filesize
4.0MB

Download
memory/2388-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2388-58-0x000000013F6C0000-0x000000013FAB6000-memory.dmp

Filesize
4.0MB

Download
memory/2388-81-0x000000013F1B0000-0x000000013F5A6000-memory.dmp

Filesize
4.0MB

Download
memory/2388-62-0x000000013F2E0000-0x000000013F6D6000-memory.dmp

Filesize
4.0MB

Download
memory/2388-9-0x0000000002630000-0x0000000002A26000-memory.dmp

Filesize
4.0MB

Download
memory/2388-48-0x000000013F340000-0x000000013F736000-memory.dmp

Filesize
4.0MB

Download
memory/2388-55-0x000000013F620000-0x000000013FA16000-memory.dmp

Filesize
4.0MB

Download
memory/2388-18-0x000000013F3D0000-0x000000013F7C6000-memory.dmp

Filesize
4.0MB

Download
memory/2388-10-0x000000013F1B0000-0x000000013F5A6000-memory.dmp

Filesize
4.0MB

Download
memory/2388-9125-0x000000013F040000-0x000000013F436000-memory.dmp

Filesize
4.0MB

Download
memory/2388-88-0x000000013F040000-0x000000013F436000-memory.dmp

Filesize
4.0MB

Download
memory/2388-75-0x0000000002630000-0x0000000002A26000-memory.dmp

Filesize
4.0MB

Download
memory/2388-836-0x0000000003910000-0x0000000003D06000-memory.dmp

Filesize
4.0MB

Download
memory/2464-59-0x000000013F340000-0x000000013F736000-memory.dmp

Filesize
4.0MB

Download
memory/2476-5292-0x000000013F2E0000-0x000000013F6D6000-memory.dmp

Filesize
4.0MB

Download
memory/2476-69-0x000000013F2E0000-0x000000013F6D6000-memory.dmp

Filesize
4.0MB

Download
memory/2588-82-0x000000013F490000-0x000000013F886000-memory.dmp

Filesize
4.0MB

Download
memory/2588-9080-0x000000013F490000-0x000000013F886000-memory.dmp

Filesize
4.0MB

Download
memory/2628-57-0x000000013F620000-0x000000013FA16000-memory.dmp

Filesize
4.0MB

Download
memory/2728-60-0x000000013F850000-0x000000013FC46000-memory.dmp

Filesize
4.0MB

Download
memory/2728-5583-0x000000013F850000-0x000000013FC46000-memory.dmp

Filesize
4.0MB

Download
memory/2736-5386-0x000000013F3D0000-0x000000013F7C6000-memory.dmp

Filesize
4.0MB

Download
memory/2736-33-0x000000013F3D0000-0x000000013F7C6000-memory.dmp

Filesize
4.0MB

Download
memory/2748-87-0x000000013F1B0000-0x000000013F5A6000-memory.dmp

Filesize
4.0MB

Download
memory/2748-13-0x000000013F1B0000-0x000000013F5A6000-memory.dmp

Filesize
4.0MB

Download
memory/2776-50-0x000000013FBE0000-0x000000013FFD6000-memory.dmp

Filesize
4.0MB

Download
memory/2904-5390-0x000000013F6C0000-0x000000013FAB6000-memory.dmp

Filesize
4.0MB

Download
memory/2904-46-0x000000013F6C0000-0x000000013FAB6000-memory.dmp

Filesize
4.0MB

Download