xmrig | 42a37d2af7a425dfb74466a4eecf775eb9a50b62ea4fd9d49fdf596dce126f02

Analysis

max time kernel
120s
max time network
117s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 05:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c9cde38e24d9107e769ae658c08deaf0N.exe
Size

2.0MB
MD5

c9cde38e24d9107e769ae658c08deaf0
SHA1

257a20c3240ad2e6026c360786573a2883ab511f
SHA256

42a37d2af7a425dfb74466a4eecf775eb9a50b62ea4fd9d49fdf596dce126f02
SHA512

47a5f5db089cb6cbef38ca8bd948b7d75a708482622a4fafb7c5dcc93bde076cf644b604ee85d7a18c04b57b88e4d23e4ac021d4ced1f9082ebc7ee3ad99d62b
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7fI+7RrTFl6hvVjL:Lz071uv4BPMkyW10/w16BvZX71Fq8+V

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 21 IoCs

miner

resource	yara_rule
behavioral1/memory/1868-34-0x000000013F8B0000-0x000000013FCA2000-memory.dmp	xmrig
behavioral1/memory/2792-139-0x000000013F350000-0x000000013F742000-memory.dmp	xmrig
behavioral1/memory/2216-108-0x000000013F950000-0x000000013FD42000-memory.dmp	xmrig
behavioral1/memory/2680-90-0x000000013F3A0000-0x000000013F792000-memory.dmp	xmrig
behavioral1/memory/2640-132-0x000000013F580000-0x000000013F972000-memory.dmp	xmrig
behavioral1/memory/2724-130-0x000000013F3A0000-0x000000013F792000-memory.dmp	xmrig
behavioral1/memory/2828-129-0x000000013FE20000-0x0000000140212000-memory.dmp	xmrig
behavioral1/memory/2744-119-0x000000013F610000-0x000000013FA02000-memory.dmp	xmrig
behavioral1/memory/2836-118-0x000000013F100000-0x000000013F4F2000-memory.dmp	xmrig
behavioral1/memory/1868-4530-0x000000013F8B0000-0x000000013FCA2000-memory.dmp	xmrig
behavioral1/memory/2836-4531-0x000000013F100000-0x000000013F4F2000-memory.dmp	xmrig
behavioral1/memory/2216-4548-0x000000013F950000-0x000000013FD42000-memory.dmp	xmrig
behavioral1/memory/2708-4556-0x000000013FF60000-0x0000000140352000-memory.dmp	xmrig
behavioral1/memory/2724-4581-0x000000013F3A0000-0x000000013F792000-memory.dmp	xmrig
behavioral1/memory/2640-4551-0x000000013F580000-0x000000013F972000-memory.dmp	xmrig
behavioral1/memory/2608-4579-0x000000013F4A0000-0x000000013F892000-memory.dmp	xmrig
behavioral1/memory/2828-4578-0x000000013FE20000-0x0000000140212000-memory.dmp	xmrig
behavioral1/memory/2680-4604-0x000000013F3A0000-0x000000013F792000-memory.dmp	xmrig
behavioral1/memory/2792-4532-0x000000013F350000-0x000000013F742000-memory.dmp	xmrig
behavioral1/memory/3032-4685-0x000000013FF40000-0x0000000140332000-memory.dmp	xmrig
behavioral1/memory/2744-4675-0x000000013F610000-0x000000013FA02000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2056	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1868	TlPeuko.exe
2680	rFTvELF.exe
2216	nDdAkyw.exe
2836	koqVuAd.exe
2792	DQWsAbs.exe
2744	HdtBNzD.exe
2828	eEFHGIK.exe
2724	OxpvBEO.exe
2640	ptQCCXj.exe
2608	XxFrQKN.exe
2708	twdTEJc.exe
3032	sGJxEWH.exe
2204	NGtxWop.exe
2016	HWXQwJj.exe
1836	wBkyAfy.exe
1092	vnwDxYR.exe
1680	ZuFHAlb.exe
1592	BPJrUZw.exe
2332	oneNlGW.exe
328	RiXYiPZ.exe
1716	wZSLWeF.exe
1564	RgagOqz.exe
1424	DFnJlFq.exe
896	WmqvtBp.exe
1996	wHtJFrb.exe
2648	jEItGFt.exe
2464	ybVkWMW.exe
2028	axyyCQm.exe
2568	GXbUtji.exe
1640	DMDxxLv.exe
2168	GvZVOjR.exe
1612	QxacDgq.exe
1652	jcFMOiL.exe
1648	KRiisWw.exe
1672	gawxDbx.exe
908	donOzXN.exe
1632	xoHHQvg.exe
2192	ORcOQlG.exe
2184	LRsKPmT.exe
1260	MTAvrEG.exe
1784	UwIgcyd.exe
1292	PQYrwhp.exe
1688	zvcUPkR.exe
2092	VrCrKPy.exe
1976	CnsaeCX.exe
2964	JzkWBAC.exe
2388	NbqWFxE.exe
1032	UcpvyfS.exe
1912	qYXSaQu.exe
2424	wLMWYSC.exe
1560	mdTsGAe.exe
2852	LAmFzPx.exe
2816	DdkqFUb.exe
3048	GiqzsWl.exe
2652	MIEqGwI.exe
664	SglHCOs.exe
1800	jqRmiox.exe
1044	CfBVpuc.exe
2864	bqpNzbY.exe
1360	EjxXGpK.exe
1732	rPTFjRA.exe
1136	YpFYoVB.exe
1380	FINngli.exe
1780	pEeBMpt.exe

Loads dropped DLL 64 IoCs

pid	Process
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe
2316	c9cde38e24d9107e769ae658c08deaf0N.exe

UPX packed file 58 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2316-0-0x000000013F8C0000-0x000000013FCB2000-memory.dmp	upx
behavioral1/files/0x000c00000001227f-5.dat	upx
behavioral1/files/0x0007000000016859-33.dat	upx
behavioral1/files/0x000700000001638b-15.dat	upx
behavioral1/files/0x0007000000016b6b-28.dat	upx
behavioral1/files/0x000800000001667f-20.dat	upx
behavioral1/memory/1868-34-0x000000013F8B0000-0x000000013FCA2000-memory.dmp	upx
behavioral1/files/0x0008000000016c5e-32.dat	upx
behavioral1/files/0x0006000000016dc8-51.dat	upx
behavioral1/files/0x0008000000016c77-49.dat	upx
behavioral1/files/0x0006000000016ddf-65.dat	upx
behavioral1/files/0x0006000000017131-73.dat	upx
behavioral1/memory/2792-139-0x000000013F350000-0x000000013F742000-memory.dmp	upx
behavioral1/files/0x0005000000018718-100.dat	upx
behavioral1/files/0x0006000000018bc7-154.dat	upx
behavioral1/files/0x0006000000018c44-170.dat	upx
behavioral1/files/0x0006000000018c16-163.dat	upx
behavioral1/files/0x0006000000018c3b-166.dat	upx
behavioral1/files/0x0006000000018bf2-151.dat	upx
behavioral1/files/0x00090000000160a8-157.dat	upx
behavioral1/files/0x0005000000018728-144.dat	upx
behavioral1/files/0x0005000000018716-142.dat	upx
behavioral1/files/0x0006000000018bbc-120.dat	upx
behavioral1/memory/2216-108-0x000000013F950000-0x000000013FD42000-memory.dmp	upx
behavioral1/files/0x0006000000018ba5-106.dat	upx
behavioral1/files/0x0006000000018b7d-104.dat	upx
behavioral1/files/0x00060000000175e4-92.dat	upx
behavioral1/memory/2680-90-0x000000013F3A0000-0x000000013F792000-memory.dmp	upx
behavioral1/files/0x0006000000018be0-147.dat	upx
behavioral1/memory/3032-138-0x000000013FF40000-0x0000000140332000-memory.dmp	upx
behavioral1/memory/2708-136-0x000000013FF60000-0x0000000140352000-memory.dmp	upx
behavioral1/memory/2608-134-0x000000013F4A0000-0x000000013F892000-memory.dmp	upx
behavioral1/memory/2640-132-0x000000013F580000-0x000000013F972000-memory.dmp	upx
behavioral1/memory/2724-130-0x000000013F3A0000-0x000000013F792000-memory.dmp	upx
behavioral1/memory/2828-129-0x000000013FE20000-0x0000000140212000-memory.dmp	upx
behavioral1/files/0x0006000000018bc1-127.dat	upx
behavioral1/memory/2744-119-0x000000013F610000-0x000000013FA02000-memory.dmp	upx
behavioral1/memory/2836-118-0x000000013F100000-0x000000013F4F2000-memory.dmp	upx
behavioral1/files/0x0006000000018bb8-114.dat	upx
behavioral1/files/0x00060000000175d2-113.dat	upx
behavioral1/files/0x0006000000017292-77.dat	upx
behavioral1/files/0x00060000000170f2-69.dat	upx
behavioral1/files/0x0006000000016dda-61.dat	upx
behavioral1/files/0x0006000000016dd3-57.dat	upx
behavioral1/files/0x001c000000005591-19.dat	upx
behavioral1/memory/2316-3775-0x0000000002FB0000-0x00000000033A2000-memory.dmp	upx
behavioral1/memory/1868-4530-0x000000013F8B0000-0x000000013FCA2000-memory.dmp	upx
behavioral1/memory/2836-4531-0x000000013F100000-0x000000013F4F2000-memory.dmp	upx
behavioral1/memory/2216-4548-0x000000013F950000-0x000000013FD42000-memory.dmp	upx
behavioral1/memory/2708-4556-0x000000013FF60000-0x0000000140352000-memory.dmp	upx
behavioral1/memory/2724-4581-0x000000013F3A0000-0x000000013F792000-memory.dmp	upx
behavioral1/memory/2640-4551-0x000000013F580000-0x000000013F972000-memory.dmp	upx
behavioral1/memory/2608-4579-0x000000013F4A0000-0x000000013F892000-memory.dmp	upx
behavioral1/memory/2828-4578-0x000000013FE20000-0x0000000140212000-memory.dmp	upx
behavioral1/memory/2680-4604-0x000000013F3A0000-0x000000013F792000-memory.dmp	upx
behavioral1/memory/2792-4532-0x000000013F350000-0x000000013F742000-memory.dmp	upx
behavioral1/memory/3032-4685-0x000000013FF40000-0x0000000140332000-memory.dmp	upx
behavioral1/memory/2744-4675-0x000000013F610000-0x000000013FA02000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\xxFVkUH.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\rPiZXCQ.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\rQOOqST.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\wxMtgiO.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\UzIQYQh.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\MXdCPeT.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\Lqaehic.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\SEJeYHQ.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\bmZuoJG.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\OYfyYBf.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\Savlqbk.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\SnxXKOT.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\KtinMDr.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\AVlUaZq.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\FYTPmvj.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\PKcHUXv.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\BzbPUUO.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\IhuSqhN.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\txuFtfW.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\ZMFoGie.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\UTTVCAG.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\aaCPTIQ.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\tzDmWKu.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\EMICpcy.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\hdjzPvg.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\WmqvtBp.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\YbatvXz.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\DQlemqT.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\cQljnHH.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\kdkamXT.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\CWqgmQS.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\SDMQdiA.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\EsDFFOW.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\SZnjOti.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\sByPWYK.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\hxRHjsi.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\ugLLpYX.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\wMIvTWF.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\acnOPKN.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\weEJsXV.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\aTYQxfW.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\KUQhIAX.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\eInVoqN.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\cJxVfsa.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\HdtBNzD.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\ozjNisl.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\HFUDDGm.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\OJCAZEM.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\kIYgUVz.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\DUVvoia.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\zISQerK.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\FFlgNjG.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\qFaIPCy.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\GOCszZt.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\noGHOVR.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\sGJxEWH.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\aqkNELA.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\DlZBwje.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\xMiOkYi.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\Czsxfyu.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\KffrcYr.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\GSjBxuX.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\NiqNNjG.exe	c9cde38e24d9107e769ae658c08deaf0N.exe
File created	C:\Windows\System\ZvWzLYo.exe	c9cde38e24d9107e769ae658c08deaf0N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2056	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2316	c9cde38e24d9107e769ae658c08deaf0N.exe
Token: SeLockMemoryPrivilege	2316	c9cde38e24d9107e769ae658c08deaf0N.exe
Token: SeDebugPrivilege	2056	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2056	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	31
PID 2316 wrote to memory of 2056	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	31
PID 2316 wrote to memory of 2056	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	31
PID 2316 wrote to memory of 1868	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	32
PID 2316 wrote to memory of 1868	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	32
PID 2316 wrote to memory of 1868	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	32
PID 2316 wrote to memory of 2680	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	33
PID 2316 wrote to memory of 2680	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	33
PID 2316 wrote to memory of 2680	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	33
PID 2316 wrote to memory of 2216	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	34
PID 2316 wrote to memory of 2216	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	34
PID 2316 wrote to memory of 2216	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	34
PID 2316 wrote to memory of 2792	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	35
PID 2316 wrote to memory of 2792	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	35
PID 2316 wrote to memory of 2792	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	35
PID 2316 wrote to memory of 2836	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	36
PID 2316 wrote to memory of 2836	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	36
PID 2316 wrote to memory of 2836	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	36
PID 2316 wrote to memory of 2744	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	37
PID 2316 wrote to memory of 2744	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	37
PID 2316 wrote to memory of 2744	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	37
PID 2316 wrote to memory of 2828	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	38
PID 2316 wrote to memory of 2828	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	38
PID 2316 wrote to memory of 2828	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	38
PID 2316 wrote to memory of 2724	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	39
PID 2316 wrote to memory of 2724	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	39
PID 2316 wrote to memory of 2724	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	39
PID 2316 wrote to memory of 2640	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	40
PID 2316 wrote to memory of 2640	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	40
PID 2316 wrote to memory of 2640	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	40
PID 2316 wrote to memory of 2608	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	41
PID 2316 wrote to memory of 2608	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	41
PID 2316 wrote to memory of 2608	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	41
PID 2316 wrote to memory of 2708	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	42
PID 2316 wrote to memory of 2708	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	42
PID 2316 wrote to memory of 2708	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	42
PID 2316 wrote to memory of 3032	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	43
PID 2316 wrote to memory of 3032	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	43
PID 2316 wrote to memory of 3032	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	43
PID 2316 wrote to memory of 2204	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	44
PID 2316 wrote to memory of 2204	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	44
PID 2316 wrote to memory of 2204	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	44
PID 2316 wrote to memory of 2016	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	45
PID 2316 wrote to memory of 2016	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	45
PID 2316 wrote to memory of 2016	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	45
PID 2316 wrote to memory of 1836	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	46
PID 2316 wrote to memory of 1836	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	46
PID 2316 wrote to memory of 1836	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	46
PID 2316 wrote to memory of 2332	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	47
PID 2316 wrote to memory of 2332	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	47
PID 2316 wrote to memory of 2332	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	47
PID 2316 wrote to memory of 1092	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	48
PID 2316 wrote to memory of 1092	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	48
PID 2316 wrote to memory of 1092	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	48
PID 2316 wrote to memory of 1564	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	49
PID 2316 wrote to memory of 1564	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	49
PID 2316 wrote to memory of 1564	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	49
PID 2316 wrote to memory of 1680	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	50
PID 2316 wrote to memory of 1680	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	50
PID 2316 wrote to memory of 1680	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	50
PID 2316 wrote to memory of 1424	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	51
PID 2316 wrote to memory of 1424	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	51
PID 2316 wrote to memory of 1424	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	51
PID 2316 wrote to memory of 1592	2316	c9cde38e24d9107e769ae658c08deaf0N.exe	52

C:\Users\Admin\AppData\Local\Temp\c9cde38e24d9107e769ae658c08deaf0N.exe
"C:\Users\Admin\AppData\Local\Temp\c9cde38e24d9107e769ae658c08deaf0N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2056
- C:\Windows\System\TlPeuko.exe
  C:\Windows\System\TlPeuko.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\rFTvELF.exe
  C:\Windows\System\rFTvELF.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\nDdAkyw.exe
  C:\Windows\System\nDdAkyw.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\DQWsAbs.exe
  C:\Windows\System\DQWsAbs.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\koqVuAd.exe
  C:\Windows\System\koqVuAd.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\HdtBNzD.exe
  C:\Windows\System\HdtBNzD.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\eEFHGIK.exe
  C:\Windows\System\eEFHGIK.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\OxpvBEO.exe
  C:\Windows\System\OxpvBEO.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\ptQCCXj.exe
  C:\Windows\System\ptQCCXj.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\XxFrQKN.exe
  C:\Windows\System\XxFrQKN.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\twdTEJc.exe
  C:\Windows\System\twdTEJc.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\sGJxEWH.exe
  C:\Windows\System\sGJxEWH.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\NGtxWop.exe
  C:\Windows\System\NGtxWop.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\HWXQwJj.exe
  C:\Windows\System\HWXQwJj.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\wBkyAfy.exe
  C:\Windows\System\wBkyAfy.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\oneNlGW.exe
  C:\Windows\System\oneNlGW.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\vnwDxYR.exe
  C:\Windows\System\vnwDxYR.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\RgagOqz.exe
  C:\Windows\System\RgagOqz.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\ZuFHAlb.exe
  C:\Windows\System\ZuFHAlb.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\DFnJlFq.exe
  C:\Windows\System\DFnJlFq.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\BPJrUZw.exe
  C:\Windows\System\BPJrUZw.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\wHtJFrb.exe
  C:\Windows\System\wHtJFrb.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\RiXYiPZ.exe
  C:\Windows\System\RiXYiPZ.exe
  2⤵
  - Executes dropped EXE
  PID:328
- C:\Windows\System\jEItGFt.exe
  C:\Windows\System\jEItGFt.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\wZSLWeF.exe
  C:\Windows\System\wZSLWeF.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\ybVkWMW.exe
  C:\Windows\System\ybVkWMW.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\WmqvtBp.exe
  C:\Windows\System\WmqvtBp.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\GXbUtji.exe
  C:\Windows\System\GXbUtji.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\axyyCQm.exe
  C:\Windows\System\axyyCQm.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\DMDxxLv.exe
  C:\Windows\System\DMDxxLv.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\GvZVOjR.exe
  C:\Windows\System\GvZVOjR.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\QxacDgq.exe
  C:\Windows\System\QxacDgq.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\jcFMOiL.exe
  C:\Windows\System\jcFMOiL.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\KRiisWw.exe
  C:\Windows\System\KRiisWw.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\gawxDbx.exe
  C:\Windows\System\gawxDbx.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\xoHHQvg.exe
  C:\Windows\System\xoHHQvg.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\donOzXN.exe
  C:\Windows\System\donOzXN.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\LRsKPmT.exe
  C:\Windows\System\LRsKPmT.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\ORcOQlG.exe
  C:\Windows\System\ORcOQlG.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\UwIgcyd.exe
  C:\Windows\System\UwIgcyd.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\MTAvrEG.exe
  C:\Windows\System\MTAvrEG.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\PQYrwhp.exe
  C:\Windows\System\PQYrwhp.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\zvcUPkR.exe
  C:\Windows\System\zvcUPkR.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\VrCrKPy.exe
  C:\Windows\System\VrCrKPy.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\CnsaeCX.exe
  C:\Windows\System\CnsaeCX.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\JzkWBAC.exe
  C:\Windows\System\JzkWBAC.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\NbqWFxE.exe
  C:\Windows\System\NbqWFxE.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\UcpvyfS.exe
  C:\Windows\System\UcpvyfS.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\qYXSaQu.exe
  C:\Windows\System\qYXSaQu.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\mdTsGAe.exe
  C:\Windows\System\mdTsGAe.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\wLMWYSC.exe
  C:\Windows\System\wLMWYSC.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\LAmFzPx.exe
  C:\Windows\System\LAmFzPx.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\DdkqFUb.exe
  C:\Windows\System\DdkqFUb.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\GiqzsWl.exe
  C:\Windows\System\GiqzsWl.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\MIEqGwI.exe
  C:\Windows\System\MIEqGwI.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\SglHCOs.exe
  C:\Windows\System\SglHCOs.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\jqRmiox.exe
  C:\Windows\System\jqRmiox.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\CfBVpuc.exe
  C:\Windows\System\CfBVpuc.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\bqpNzbY.exe
  C:\Windows\System\bqpNzbY.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\EjxXGpK.exe
  C:\Windows\System\EjxXGpK.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\rPTFjRA.exe
  C:\Windows\System\rPTFjRA.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\YpFYoVB.exe
  C:\Windows\System\YpFYoVB.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\FINngli.exe
  C:\Windows\System\FINngli.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\pEeBMpt.exe
  C:\Windows\System\pEeBMpt.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\oobMyPr.exe
  C:\Windows\System\oobMyPr.exe
  2⤵
  PID:2468
- C:\Windows\System\BjHpdzI.exe
  C:\Windows\System\BjHpdzI.exe
  2⤵
  PID:1900
- C:\Windows\System\MXdCPeT.exe
  C:\Windows\System\MXdCPeT.exe
  2⤵
  PID:2996
- C:\Windows\System\bqowLKZ.exe
  C:\Windows\System\bqowLKZ.exe
  2⤵
  PID:928
- C:\Windows\System\FGJZZss.exe
  C:\Windows\System\FGJZZss.exe
  2⤵
  PID:2732
- C:\Windows\System\fijHXvM.exe
  C:\Windows\System\fijHXvM.exe
  2⤵
  PID:764
- C:\Windows\System\jaEWlMT.exe
  C:\Windows\System\jaEWlMT.exe
  2⤵
  PID:1008
- C:\Windows\System\bgLLkhq.exe
  C:\Windows\System\bgLLkhq.exe
  2⤵
  PID:2200
- C:\Windows\System\tsERUtb.exe
  C:\Windows\System\tsERUtb.exe
  2⤵
  PID:2948
- C:\Windows\System\HaeCnfq.exe
  C:\Windows\System\HaeCnfq.exe
  2⤵
  PID:1028
- C:\Windows\System\nsmLQoF.exe
  C:\Windows\System\nsmLQoF.exe
  2⤵
  PID:2396
- C:\Windows\System\uBSTJpB.exe
  C:\Windows\System\uBSTJpB.exe
  2⤵
  PID:2260
- C:\Windows\System\mecXxeN.exe
  C:\Windows\System\mecXxeN.exe
  2⤵
  PID:2972
- C:\Windows\System\RXldyCA.exe
  C:\Windows\System\RXldyCA.exe
  2⤵
  PID:2716
- C:\Windows\System\xRqPIXK.exe
  C:\Windows\System\xRqPIXK.exe
  2⤵
  PID:2848
- C:\Windows\System\sorZjXG.exe
  C:\Windows\System\sorZjXG.exe
  2⤵
  PID:2824
- C:\Windows\System\iMIJBnn.exe
  C:\Windows\System\iMIJBnn.exe
  2⤵
  PID:2660
- C:\Windows\System\UyYaCiD.exe
  C:\Windows\System\UyYaCiD.exe
  2⤵
  PID:2644
- C:\Windows\System\oXePILO.exe
  C:\Windows\System\oXePILO.exe
  2⤵
  PID:1264
- C:\Windows\System\zIfCzJQ.exe
  C:\Windows\System\zIfCzJQ.exe
  2⤵
  PID:2012
- C:\Windows\System\tGKGxkP.exe
  C:\Windows\System\tGKGxkP.exe
  2⤵
  PID:1980
- C:\Windows\System\OYfyYBf.exe
  C:\Windows\System\OYfyYBf.exe
  2⤵
  PID:2240
- C:\Windows\System\ckgXvAZ.exe
  C:\Windows\System\ckgXvAZ.exe
  2⤵
  PID:2912
- C:\Windows\System\AmMVfGT.exe
  C:\Windows\System\AmMVfGT.exe
  2⤵
  PID:1272
- C:\Windows\System\qTTuQAN.exe
  C:\Windows\System\qTTuQAN.exe
  2⤵
  PID:3020
- C:\Windows\System\UoqAxih.exe
  C:\Windows\System\UoqAxih.exe
  2⤵
  PID:1016
- C:\Windows\System\RGiMooY.exe
  C:\Windows\System\RGiMooY.exe
  2⤵
  PID:884
- C:\Windows\System\rmSnjOY.exe
  C:\Windows\System\rmSnjOY.exe
  2⤵
  PID:1668
- C:\Windows\System\TdXlPhf.exe
  C:\Windows\System\TdXlPhf.exe
  2⤵
  PID:1968
- C:\Windows\System\UotsucI.exe
  C:\Windows\System\UotsucI.exe
  2⤵
  PID:1616
- C:\Windows\System\EGvLqKf.exe
  C:\Windows\System\EGvLqKf.exe
  2⤵
  PID:3068
- C:\Windows\System\QAogHwX.exe
  C:\Windows\System\QAogHwX.exe
  2⤵
  PID:1552
- C:\Windows\System\mCUbASt.exe
  C:\Windows\System\mCUbASt.exe
  2⤵
  PID:2384
- C:\Windows\System\rAlzRDP.exe
  C:\Windows\System\rAlzRDP.exe
  2⤵
  PID:2176
- C:\Windows\System\LOIaelh.exe
  C:\Windows\System\LOIaelh.exe
  2⤵
  PID:2592
- C:\Windows\System\Savlqbk.exe
  C:\Windows\System\Savlqbk.exe
  2⤵
  PID:2780
- C:\Windows\System\KEQToTz.exe
  C:\Windows\System\KEQToTz.exe
  2⤵
  PID:1884
- C:\Windows\System\YuJCbSD.exe
  C:\Windows\System\YuJCbSD.exe
  2⤵
  PID:2768
- C:\Windows\System\uoLtozI.exe
  C:\Windows\System\uoLtozI.exe
  2⤵
  PID:2984
- C:\Windows\System\fQNnbIO.exe
  C:\Windows\System\fQNnbIO.exe
  2⤵
  PID:1572
- C:\Windows\System\EHdCxkr.exe
  C:\Windows\System\EHdCxkr.exe
  2⤵
  PID:2064
- C:\Windows\System\ETmSMNw.exe
  C:\Windows\System\ETmSMNw.exe
  2⤵
  PID:2164
- C:\Windows\System\dmBJdNA.exe
  C:\Windows\System\dmBJdNA.exe
  2⤵
  PID:356
- C:\Windows\System\SsDxLtp.exe
  C:\Windows\System\SsDxLtp.exe
  2⤵
  PID:900
- C:\Windows\System\hEmTBoM.exe
  C:\Windows\System\hEmTBoM.exe
  2⤵
  PID:2420
- C:\Windows\System\qdxMoPU.exe
  C:\Windows\System\qdxMoPU.exe
  2⤵
  PID:2804
- C:\Windows\System\IuyajSf.exe
  C:\Windows\System\IuyajSf.exe
  2⤵
  PID:2844
- C:\Windows\System\pPHoubg.exe
  C:\Windows\System\pPHoubg.exe
  2⤵
  PID:2740
- C:\Windows\System\SUepZCn.exe
  C:\Windows\System\SUepZCn.exe
  2⤵
  PID:772
- C:\Windows\System\nPNyetR.exe
  C:\Windows\System\nPNyetR.exe
  2⤵
  PID:2488
- C:\Windows\System\ioTFcBI.exe
  C:\Windows\System\ioTFcBI.exe
  2⤵
  PID:2704
- C:\Windows\System\RSMtvcK.exe
  C:\Windows\System\RSMtvcK.exe
  2⤵
  PID:332
- C:\Windows\System\rzeDsLR.exe
  C:\Windows\System\rzeDsLR.exe
  2⤵
  PID:864
- C:\Windows\System\lZuiVBI.exe
  C:\Windows\System\lZuiVBI.exe
  2⤵
  PID:2224
- C:\Windows\System\KiwJcap.exe
  C:\Windows\System\KiwJcap.exe
  2⤵
  PID:2584
- C:\Windows\System\ZXoXfMy.exe
  C:\Windows\System\ZXoXfMy.exe
  2⤵
  PID:2180
- C:\Windows\System\RBCpdQV.exe
  C:\Windows\System\RBCpdQV.exe
  2⤵
  PID:2712
- C:\Windows\System\kyTexXe.exe
  C:\Windows\System\kyTexXe.exe
  2⤵
  PID:2976
- C:\Windows\System\LNSPwhV.exe
  C:\Windows\System\LNSPwhV.exe
  2⤵
  PID:1332
- C:\Windows\System\csPCVaw.exe
  C:\Windows\System\csPCVaw.exe
  2⤵
  PID:2156
- C:\Windows\System\rPPKgHx.exe
  C:\Windows\System\rPPKgHx.exe
  2⤵
  PID:2980
- C:\Windows\System\YbXmxMr.exe
  C:\Windows\System\YbXmxMr.exe
  2⤵
  PID:2484
- C:\Windows\System\hpQGqxj.exe
  C:\Windows\System\hpQGqxj.exe
  2⤵
  PID:2884
- C:\Windows\System\dJdKFQo.exe
  C:\Windows\System\dJdKFQo.exe
  2⤵
  PID:1256
- C:\Windows\System\AivpaXg.exe
  C:\Windows\System\AivpaXg.exe
  2⤵
  PID:1308
- C:\Windows\System\AbFUqiC.exe
  C:\Windows\System\AbFUqiC.exe
  2⤵
  PID:2256
- C:\Windows\System\SDEJSZr.exe
  C:\Windows\System\SDEJSZr.exe
  2⤵
  PID:528
- C:\Windows\System\ifmcTCV.exe
  C:\Windows\System\ifmcTCV.exe
  2⤵
  PID:2756
- C:\Windows\System\mAnfIPQ.exe
  C:\Windows\System\mAnfIPQ.exe
  2⤵
  PID:1336
- C:\Windows\System\CLmsiHf.exe
  C:\Windows\System\CLmsiHf.exe
  2⤵
  PID:1576
- C:\Windows\System\CSgpCQC.exe
  C:\Windows\System\CSgpCQC.exe
  2⤵
  PID:2992
- C:\Windows\System\lgnJmoL.exe
  C:\Windows\System\lgnJmoL.exe
  2⤵
  PID:1512
- C:\Windows\System\Qllmezl.exe
  C:\Windows\System\Qllmezl.exe
  2⤵
  PID:2080
- C:\Windows\System\gLVzFGP.exe
  C:\Windows\System\gLVzFGP.exe
  2⤵
  PID:3136
- C:\Windows\System\iQlJbBW.exe
  C:\Windows\System\iQlJbBW.exe
  2⤵
  PID:3152
- C:\Windows\System\nvftjll.exe
  C:\Windows\System\nvftjll.exe
  2⤵
  PID:3168
- C:\Windows\System\PfNunmi.exe
  C:\Windows\System\PfNunmi.exe
  2⤵
  PID:3184
- C:\Windows\System\uSyeecP.exe
  C:\Windows\System\uSyeecP.exe
  2⤵
  PID:3200
- C:\Windows\System\JHHZkgE.exe
  C:\Windows\System\JHHZkgE.exe
  2⤵
  PID:3216
- C:\Windows\System\qVpIbOT.exe
  C:\Windows\System\qVpIbOT.exe
  2⤵
  PID:3232
- C:\Windows\System\RIdCmiS.exe
  C:\Windows\System\RIdCmiS.exe
  2⤵
  PID:3248
- C:\Windows\System\gwJCCdm.exe
  C:\Windows\System\gwJCCdm.exe
  2⤵
  PID:3264
- C:\Windows\System\MpVEDEE.exe
  C:\Windows\System\MpVEDEE.exe
  2⤵
  PID:3280
- C:\Windows\System\JNLYBrs.exe
  C:\Windows\System\JNLYBrs.exe
  2⤵
  PID:3296
- C:\Windows\System\lDNYNxj.exe
  C:\Windows\System\lDNYNxj.exe
  2⤵
  PID:3312
- C:\Windows\System\bfmYHZo.exe
  C:\Windows\System\bfmYHZo.exe
  2⤵
  PID:3328
- C:\Windows\System\yrlfpAP.exe
  C:\Windows\System\yrlfpAP.exe
  2⤵
  PID:3344
- C:\Windows\System\iGioQFh.exe
  C:\Windows\System\iGioQFh.exe
  2⤵
  PID:3360
- C:\Windows\System\koEFtai.exe
  C:\Windows\System\koEFtai.exe
  2⤵
  PID:3376
- C:\Windows\System\qBkKnCF.exe
  C:\Windows\System\qBkKnCF.exe
  2⤵
  PID:3392
- C:\Windows\System\urRTDiH.exe
  C:\Windows\System\urRTDiH.exe
  2⤵
  PID:3408
- C:\Windows\System\zkESeqr.exe
  C:\Windows\System\zkESeqr.exe
  2⤵
  PID:3424
- C:\Windows\System\BlnEMdR.exe
  C:\Windows\System\BlnEMdR.exe
  2⤵
  PID:3440
- C:\Windows\System\PTouLSb.exe
  C:\Windows\System\PTouLSb.exe
  2⤵
  PID:3456
- C:\Windows\System\KSxsCeM.exe
  C:\Windows\System\KSxsCeM.exe
  2⤵
  PID:3472
- C:\Windows\System\EMMixiY.exe
  C:\Windows\System\EMMixiY.exe
  2⤵
  PID:3488
- C:\Windows\System\UziuIqZ.exe
  C:\Windows\System\UziuIqZ.exe
  2⤵
  PID:3504
- C:\Windows\System\FXuphEC.exe
  C:\Windows\System\FXuphEC.exe
  2⤵
  PID:3520
- C:\Windows\System\YjZwktc.exe
  C:\Windows\System\YjZwktc.exe
  2⤵
  PID:3536
- C:\Windows\System\vKvCdnT.exe
  C:\Windows\System\vKvCdnT.exe
  2⤵
  PID:3552
- C:\Windows\System\AxmSkxM.exe
  C:\Windows\System\AxmSkxM.exe
  2⤵
  PID:3568
- C:\Windows\System\JdSZBiV.exe
  C:\Windows\System\JdSZBiV.exe
  2⤵
  PID:3584
- C:\Windows\System\ZpfHKqE.exe
  C:\Windows\System\ZpfHKqE.exe
  2⤵
  PID:3600
- C:\Windows\System\kIYgUVz.exe
  C:\Windows\System\kIYgUVz.exe
  2⤵
  PID:3616
- C:\Windows\System\OCBzopu.exe
  C:\Windows\System\OCBzopu.exe
  2⤵
  PID:3632
- C:\Windows\System\Fnagkkz.exe
  C:\Windows\System\Fnagkkz.exe
  2⤵
  PID:3648
- C:\Windows\System\NoBUSyP.exe
  C:\Windows\System\NoBUSyP.exe
  2⤵
  PID:3664
- C:\Windows\System\zjxzRbC.exe
  C:\Windows\System\zjxzRbC.exe
  2⤵
  PID:3680
- C:\Windows\System\tpGBHyU.exe
  C:\Windows\System\tpGBHyU.exe
  2⤵
  PID:3696
- C:\Windows\System\jCfJJXo.exe
  C:\Windows\System\jCfJJXo.exe
  2⤵
  PID:3712
- C:\Windows\System\RXWRKLU.exe
  C:\Windows\System\RXWRKLU.exe
  2⤵
  PID:3728
- C:\Windows\System\Pfivwmb.exe
  C:\Windows\System\Pfivwmb.exe
  2⤵
  PID:3744
- C:\Windows\System\KkswxqF.exe
  C:\Windows\System\KkswxqF.exe
  2⤵
  PID:3760
- C:\Windows\System\BucANlB.exe
  C:\Windows\System\BucANlB.exe
  2⤵
  PID:3776
- C:\Windows\System\UylJbrj.exe
  C:\Windows\System\UylJbrj.exe
  2⤵
  PID:3792
- C:\Windows\System\RXiQdZd.exe
  C:\Windows\System\RXiQdZd.exe
  2⤵
  PID:3808
- C:\Windows\System\UayBKgC.exe
  C:\Windows\System\UayBKgC.exe
  2⤵
  PID:3824
- C:\Windows\System\XYTuzoF.exe
  C:\Windows\System\XYTuzoF.exe
  2⤵
  PID:3840
- C:\Windows\System\crRJqZU.exe
  C:\Windows\System\crRJqZU.exe
  2⤵
  PID:3856
- C:\Windows\System\auuIHQY.exe
  C:\Windows\System\auuIHQY.exe
  2⤵
  PID:3872
- C:\Windows\System\nQojyBQ.exe
  C:\Windows\System\nQojyBQ.exe
  2⤵
  PID:3892
- C:\Windows\System\fSqhpGj.exe
  C:\Windows\System\fSqhpGj.exe
  2⤵
  PID:3908
- C:\Windows\System\MsmXFGm.exe
  C:\Windows\System\MsmXFGm.exe
  2⤵
  PID:3924
- C:\Windows\System\vjtZYlU.exe
  C:\Windows\System\vjtZYlU.exe
  2⤵
  PID:3940
- C:\Windows\System\EMuQBIL.exe
  C:\Windows\System\EMuQBIL.exe
  2⤵
  PID:3956
- C:\Windows\System\DLmMngX.exe
  C:\Windows\System\DLmMngX.exe
  2⤵
  PID:3972
- C:\Windows\System\QNoNSum.exe
  C:\Windows\System\QNoNSum.exe
  2⤵
  PID:3988
- C:\Windows\System\abyAdBb.exe
  C:\Windows\System\abyAdBb.exe
  2⤵
  PID:4004
- C:\Windows\System\MCIqwfP.exe
  C:\Windows\System\MCIqwfP.exe
  2⤵
  PID:4020
- C:\Windows\System\dSFiOkV.exe
  C:\Windows\System\dSFiOkV.exe
  2⤵
  PID:4036
- C:\Windows\System\JtgyTvW.exe
  C:\Windows\System\JtgyTvW.exe
  2⤵
  PID:4052
- C:\Windows\System\AaszFrC.exe
  C:\Windows\System\AaszFrC.exe
  2⤵
  PID:4068
- C:\Windows\System\AnzbpZA.exe
  C:\Windows\System\AnzbpZA.exe
  2⤵
  PID:4084
- C:\Windows\System\BeJRLQJ.exe
  C:\Windows\System\BeJRLQJ.exe
  2⤵
  PID:964
- C:\Windows\System\FxxbMVf.exe
  C:\Windows\System\FxxbMVf.exe
  2⤵
  PID:2148
- C:\Windows\System\EYxgPmA.exe
  C:\Windows\System\EYxgPmA.exe
  2⤵
  PID:840
- C:\Windows\System\yNBQCCZ.exe
  C:\Windows\System\yNBQCCZ.exe
  2⤵
  PID:1304
- C:\Windows\System\bJaxCAs.exe
  C:\Windows\System\bJaxCAs.exe
  2⤵
  PID:1240
- C:\Windows\System\bGCNFwz.exe
  C:\Windows\System\bGCNFwz.exe
  2⤵
  PID:2696
- C:\Windows\System\vAcqWmf.exe
  C:\Windows\System\vAcqWmf.exe
  2⤵
  PID:2668
- C:\Windows\System\yNcPoYv.exe
  C:\Windows\System\yNcPoYv.exe
  2⤵
  PID:3056
- C:\Windows\System\WYkfceM.exe
  C:\Windows\System\WYkfceM.exe
  2⤵
  PID:3092
- C:\Windows\System\IMZeGKk.exe
  C:\Windows\System\IMZeGKk.exe
  2⤵
  PID:3104
- C:\Windows\System\UEWEnxs.exe
  C:\Windows\System\UEWEnxs.exe
  2⤵
  PID:3120
- C:\Windows\System\uvRzsJc.exe
  C:\Windows\System\uvRzsJc.exe
  2⤵
  PID:808
- C:\Windows\System\onwgxyG.exe
  C:\Windows\System\onwgxyG.exe
  2⤵
  PID:984
- C:\Windows\System\KUSsmXT.exe
  C:\Windows\System\KUSsmXT.exe
  2⤵
  PID:3028
- C:\Windows\System\zQXBpEK.exe
  C:\Windows\System\zQXBpEK.exe
  2⤵
  PID:3148
- C:\Windows\System\fYOLdxP.exe
  C:\Windows\System\fYOLdxP.exe
  2⤵
  PID:3196
- C:\Windows\System\zMFNwEA.exe
  C:\Windows\System\zMFNwEA.exe
  2⤵
  PID:3224
- C:\Windows\System\cqyWUiI.exe
  C:\Windows\System\cqyWUiI.exe
  2⤵
  PID:3260
- C:\Windows\System\ZNHwMfn.exe
  C:\Windows\System\ZNHwMfn.exe
  2⤵
  PID:3276
- C:\Windows\System\ZslgSdq.exe
  C:\Windows\System\ZslgSdq.exe
  2⤵
  PID:3308
- C:\Windows\System\SAlCEoc.exe
  C:\Windows\System\SAlCEoc.exe
  2⤵
  PID:3356
- C:\Windows\System\PcBMpye.exe
  C:\Windows\System\PcBMpye.exe
  2⤵
  PID:3368
- C:\Windows\System\ygCAjnQ.exe
  C:\Windows\System\ygCAjnQ.exe
  2⤵
  PID:3420
- C:\Windows\System\EOEmgnu.exe
  C:\Windows\System\EOEmgnu.exe
  2⤵
  PID:3452
- C:\Windows\System\qtKvFIk.exe
  C:\Windows\System\qtKvFIk.exe
  2⤵
  PID:3480
- C:\Windows\System\LSLBEDi.exe
  C:\Windows\System\LSLBEDi.exe
  2⤵
  PID:3512
- C:\Windows\System\SUyNGTd.exe
  C:\Windows\System\SUyNGTd.exe
  2⤵
  PID:3532
- C:\Windows\System\tqZhQrn.exe
  C:\Windows\System\tqZhQrn.exe
  2⤵
  PID:3560
- C:\Windows\System\cPtVhyJ.exe
  C:\Windows\System\cPtVhyJ.exe
  2⤵
  PID:3592
- C:\Windows\System\uhpQxQU.exe
  C:\Windows\System\uhpQxQU.exe
  2⤵
  PID:3640
- C:\Windows\System\CYjrBEX.exe
  C:\Windows\System\CYjrBEX.exe
  2⤵
  PID:3672
- C:\Windows\System\zybObam.exe
  C:\Windows\System\zybObam.exe
  2⤵
  PID:3688
- C:\Windows\System\FwjcMzy.exe
  C:\Windows\System\FwjcMzy.exe
  2⤵
  PID:3788
- C:\Windows\System\fVoRECK.exe
  C:\Windows\System\fVoRECK.exe
  2⤵
  PID:3980
- C:\Windows\System\VlxWxMU.exe
  C:\Windows\System\VlxWxMU.exe
  2⤵
  PID:4044
- C:\Windows\System\cHhRxGH.exe
  C:\Windows\System\cHhRxGH.exe
  2⤵
  PID:2620
- C:\Windows\System\VfMLfBO.exe
  C:\Windows\System\VfMLfBO.exe
  2⤵
  PID:2440
- C:\Windows\System\qoDohhr.exe
  C:\Windows\System\qoDohhr.exe
  2⤵
  PID:3096
- C:\Windows\System\XtOkhKx.exe
  C:\Windows\System\XtOkhKx.exe
  2⤵
  PID:3160
- C:\Windows\System\fLItQOV.exe
  C:\Windows\System\fLItQOV.exe
  2⤵
  PID:3240
- C:\Windows\System\SFpFbsr.exe
  C:\Windows\System\SFpFbsr.exe
  2⤵
  PID:3384
- C:\Windows\System\WwuHXJD.exe
  C:\Windows\System\WwuHXJD.exe
  2⤵
  PID:3832
- C:\Windows\System\OQQYVva.exe
  C:\Windows\System\OQQYVva.exe
  2⤵
  PID:3900
- C:\Windows\System\NOzyZBu.exe
  C:\Windows\System\NOzyZBu.exe
  2⤵
  PID:3964
- C:\Windows\System\Vdepkwh.exe
  C:\Windows\System\Vdepkwh.exe
  2⤵
  PID:4028
- C:\Windows\System\opZsxAR.exe
  C:\Windows\System\opZsxAR.exe
  2⤵
  PID:2220
- C:\Windows\System\QGpbrMu.exe
  C:\Windows\System\QGpbrMu.exe
  2⤵
  PID:3164
- C:\Windows\System\jVgNnrU.exe
  C:\Windows\System\jVgNnrU.exe
  2⤵
  PID:3272
- C:\Windows\System\RsUwyZX.exe
  C:\Windows\System\RsUwyZX.exe
  2⤵
  PID:3416
- C:\Windows\System\tXTcWZa.exe
  C:\Windows\System\tXTcWZa.exe
  2⤵
  PID:3544
- C:\Windows\System\gOJjPrG.exe
  C:\Windows\System\gOJjPrG.exe
  2⤵
  PID:3660
- C:\Windows\System\PNFuUWM.exe
  C:\Windows\System\PNFuUWM.exe
  2⤵
  PID:3752
- C:\Windows\System\viohfoE.exe
  C:\Windows\System\viohfoE.exe
  2⤵
  PID:3800
- C:\Windows\System\jvcFRGc.exe
  C:\Windows\System\jvcFRGc.exe
  2⤵
  PID:4016
- C:\Windows\System\KMDrZMv.exe
  C:\Windows\System\KMDrZMv.exe
  2⤵
  PID:3500
- C:\Windows\System\dFPZEIo.exe
  C:\Windows\System\dFPZEIo.exe
  2⤵
  PID:3128
- C:\Windows\System\VONtmVJ.exe
  C:\Windows\System\VONtmVJ.exe
  2⤵
  PID:3708
- C:\Windows\System\HkscyPs.exe
  C:\Windows\System\HkscyPs.exe
  2⤵
  PID:3864
- C:\Windows\System\gylMEKC.exe
  C:\Windows\System\gylMEKC.exe
  2⤵
  PID:3432
- C:\Windows\System\eYNSIsx.exe
  C:\Windows\System\eYNSIsx.exe
  2⤵
  PID:4076
- C:\Windows\System\XHrkxMh.exe
  C:\Windows\System\XHrkxMh.exe
  2⤵
  PID:3816
- C:\Windows\System\RPvdInG.exe
  C:\Windows\System\RPvdInG.exe
  2⤵
  PID:3888
- C:\Windows\System\xMiOkYi.exe
  C:\Windows\System\xMiOkYi.exe
  2⤵
  PID:2796
- C:\Windows\System\MGAouNc.exe
  C:\Windows\System\MGAouNc.exe
  2⤵
  PID:1372
- C:\Windows\System\aDLGANk.exe
  C:\Windows\System\aDLGANk.exe
  2⤵
  PID:1704
- C:\Windows\System\SShNurp.exe
  C:\Windows\System\SShNurp.exe
  2⤵
  PID:3084
- C:\Windows\System\MpllDLm.exe
  C:\Windows\System\MpllDLm.exe
  2⤵
  PID:2604
- C:\Windows\System\UUxdHJH.exe
  C:\Windows\System\UUxdHJH.exe
  2⤵
  PID:3772
- C:\Windows\System\SAltSZG.exe
  C:\Windows\System\SAltSZG.exe
  2⤵
  PID:2728
- C:\Windows\System\ErRaivl.exe
  C:\Windows\System\ErRaivl.exe
  2⤵
  PID:4000
- C:\Windows\System\STKjmzD.exe
  C:\Windows\System\STKjmzD.exe
  2⤵
  PID:2160
- C:\Windows\System\GjSmtWz.exe
  C:\Windows\System\GjSmtWz.exe
  2⤵
  PID:1580
- C:\Windows\System\lZlMicw.exe
  C:\Windows\System\lZlMicw.exe
  2⤵
  PID:4100
- C:\Windows\System\DnHiJAK.exe
  C:\Windows\System\DnHiJAK.exe
  2⤵
  PID:4116
- C:\Windows\System\fnQduqp.exe
  C:\Windows\System\fnQduqp.exe
  2⤵
  PID:4132
- C:\Windows\System\aoazsyY.exe
  C:\Windows\System\aoazsyY.exe
  2⤵
  PID:4148
- C:\Windows\System\SbITOCf.exe
  C:\Windows\System\SbITOCf.exe
  2⤵
  PID:4164
- C:\Windows\System\UTFVTZy.exe
  C:\Windows\System\UTFVTZy.exe
  2⤵
  PID:4184
- C:\Windows\System\kXLOCbm.exe
  C:\Windows\System\kXLOCbm.exe
  2⤵
  PID:4200
- C:\Windows\System\euBTHon.exe
  C:\Windows\System\euBTHon.exe
  2⤵
  PID:4216
- C:\Windows\System\CYMRRtm.exe
  C:\Windows\System\CYMRRtm.exe
  2⤵
  PID:4232
- C:\Windows\System\YDPZcIi.exe
  C:\Windows\System\YDPZcIi.exe
  2⤵
  PID:4248
- C:\Windows\System\GZeRPrZ.exe
  C:\Windows\System\GZeRPrZ.exe
  2⤵
  PID:4264
- C:\Windows\System\NSPGEFg.exe
  C:\Windows\System\NSPGEFg.exe
  2⤵
  PID:4284
- C:\Windows\System\riYbsmT.exe
  C:\Windows\System\riYbsmT.exe
  2⤵
  PID:4300
- C:\Windows\System\iqsTfBa.exe
  C:\Windows\System\iqsTfBa.exe
  2⤵
  PID:4316
- C:\Windows\System\gnJisgk.exe
  C:\Windows\System\gnJisgk.exe
  2⤵
  PID:4332
- C:\Windows\System\wMMVsgI.exe
  C:\Windows\System\wMMVsgI.exe
  2⤵
  PID:4348
- C:\Windows\System\UlRhJze.exe
  C:\Windows\System\UlRhJze.exe
  2⤵
  PID:4364
- C:\Windows\System\LsBOHwH.exe
  C:\Windows\System\LsBOHwH.exe
  2⤵
  PID:4380
- C:\Windows\System\lxSubqG.exe
  C:\Windows\System\lxSubqG.exe
  2⤵
  PID:4396
- C:\Windows\System\NowPuYA.exe
  C:\Windows\System\NowPuYA.exe
  2⤵
  PID:4412
- C:\Windows\System\UQqTAkA.exe
  C:\Windows\System\UQqTAkA.exe
  2⤵
  PID:4428
- C:\Windows\System\kfvRhJs.exe
  C:\Windows\System\kfvRhJs.exe
  2⤵
  PID:4444
- C:\Windows\System\FdkMSuu.exe
  C:\Windows\System\FdkMSuu.exe
  2⤵
  PID:4460
- C:\Windows\System\vsikqOY.exe
  C:\Windows\System\vsikqOY.exe
  2⤵
  PID:4476
- C:\Windows\System\YsgvEVY.exe
  C:\Windows\System\YsgvEVY.exe
  2⤵
  PID:4492
- C:\Windows\System\pEkzzem.exe
  C:\Windows\System\pEkzzem.exe
  2⤵
  PID:4508
- C:\Windows\System\gmIOtOt.exe
  C:\Windows\System\gmIOtOt.exe
  2⤵
  PID:4524
- C:\Windows\System\VbueenS.exe
  C:\Windows\System\VbueenS.exe
  2⤵
  PID:4540
- C:\Windows\System\ZYkbQZu.exe
  C:\Windows\System\ZYkbQZu.exe
  2⤵
  PID:4556
- C:\Windows\System\UEUukqS.exe
  C:\Windows\System\UEUukqS.exe
  2⤵
  PID:4572
- C:\Windows\System\uqIdKxy.exe
  C:\Windows\System\uqIdKxy.exe
  2⤵
  PID:4588
- C:\Windows\System\daJmkEe.exe
  C:\Windows\System\daJmkEe.exe
  2⤵
  PID:4608
- C:\Windows\System\prmmVRv.exe
  C:\Windows\System\prmmVRv.exe
  2⤵
  PID:4624
- C:\Windows\System\qOWKIPY.exe
  C:\Windows\System\qOWKIPY.exe
  2⤵
  PID:4640
- C:\Windows\System\KRTnyXB.exe
  C:\Windows\System\KRTnyXB.exe
  2⤵
  PID:4656
- C:\Windows\System\fKGNfSp.exe
  C:\Windows\System\fKGNfSp.exe
  2⤵
  PID:4672
- C:\Windows\System\hNGHxdq.exe
  C:\Windows\System\hNGHxdq.exe
  2⤵
  PID:4688
- C:\Windows\System\xVUHmfE.exe
  C:\Windows\System\xVUHmfE.exe
  2⤵
  PID:4704
- C:\Windows\System\jcTqbeV.exe
  C:\Windows\System\jcTqbeV.exe
  2⤵
  PID:4720
- C:\Windows\System\mtJCbZS.exe
  C:\Windows\System\mtJCbZS.exe
  2⤵
  PID:4736
- C:\Windows\System\aMNruJM.exe
  C:\Windows\System\aMNruJM.exe
  2⤵
  PID:4752
- C:\Windows\System\thoWGJZ.exe
  C:\Windows\System\thoWGJZ.exe
  2⤵
  PID:4768
- C:\Windows\System\rXrTVZk.exe
  C:\Windows\System\rXrTVZk.exe
  2⤵
  PID:4784
- C:\Windows\System\vQXovsf.exe
  C:\Windows\System\vQXovsf.exe
  2⤵
  PID:4800
- C:\Windows\System\ZkMvhhC.exe
  C:\Windows\System\ZkMvhhC.exe
  2⤵
  PID:4816
- C:\Windows\System\ODLMzwh.exe
  C:\Windows\System\ODLMzwh.exe
  2⤵
  PID:4832
- C:\Windows\System\wZiBPTE.exe
  C:\Windows\System\wZiBPTE.exe
  2⤵
  PID:4848
- C:\Windows\System\MXRTbya.exe
  C:\Windows\System\MXRTbya.exe
  2⤵
  PID:4864
- C:\Windows\System\OkjWOad.exe
  C:\Windows\System\OkjWOad.exe
  2⤵
  PID:4880
- C:\Windows\System\VKYqUkT.exe
  C:\Windows\System\VKYqUkT.exe
  2⤵
  PID:4896
- C:\Windows\System\sNDavMZ.exe
  C:\Windows\System\sNDavMZ.exe
  2⤵
  PID:4912
- C:\Windows\System\wddmoeU.exe
  C:\Windows\System\wddmoeU.exe
  2⤵
  PID:4932
- C:\Windows\System\JAvZEfE.exe
  C:\Windows\System\JAvZEfE.exe
  2⤵
  PID:4948
- C:\Windows\System\TFMRIOi.exe
  C:\Windows\System\TFMRIOi.exe
  2⤵
  PID:4964
- C:\Windows\System\WUUZQuc.exe
  C:\Windows\System\WUUZQuc.exe
  2⤵
  PID:4980
- C:\Windows\System\RDAnKsA.exe
  C:\Windows\System\RDAnKsA.exe
  2⤵
  PID:5008
- C:\Windows\System\qfzuHXq.exe
  C:\Windows\System\qfzuHXq.exe
  2⤵
  PID:5024
- C:\Windows\System\ruVXiqb.exe
  C:\Windows\System\ruVXiqb.exe
  2⤵
  PID:5040
- C:\Windows\System\VDXMmLX.exe
  C:\Windows\System\VDXMmLX.exe
  2⤵
  PID:5056
- C:\Windows\System\EpCeGdo.exe
  C:\Windows\System\EpCeGdo.exe
  2⤵
  PID:5072
- C:\Windows\System\TfCeZQz.exe
  C:\Windows\System\TfCeZQz.exe
  2⤵
  PID:5092
- C:\Windows\System\vqDEToj.exe
  C:\Windows\System\vqDEToj.exe
  2⤵
  PID:5108
- C:\Windows\System\VJHgQoB.exe
  C:\Windows\System\VJHgQoB.exe
  2⤵
  PID:2628
- C:\Windows\System\vndGYWc.exe
  C:\Windows\System\vndGYWc.exe
  2⤵
  PID:3288
- C:\Windows\System\HcHMZMh.exe
  C:\Windows\System\HcHMZMh.exe
  2⤵
  PID:3736
- C:\Windows\System\IJpyhrG.exe
  C:\Windows\System\IJpyhrG.exe
  2⤵
  PID:3016
- C:\Windows\System\MexEMpm.exe
  C:\Windows\System\MexEMpm.exe
  2⤵
  PID:3116
- C:\Windows\System\uwzzADa.exe
  C:\Windows\System\uwzzADa.exe
  2⤵
  PID:4156
- C:\Windows\System\dXrcbwb.exe
  C:\Windows\System\dXrcbwb.exe
  2⤵
  PID:3804
- C:\Windows\System\wfSDgBt.exe
  C:\Windows\System\wfSDgBt.exe
  2⤵
  PID:3320
- C:\Windows\System\osEPcyw.exe
  C:\Windows\System\osEPcyw.exe
  2⤵
  PID:3848
- C:\Windows\System\aQryVuj.exe
  C:\Windows\System\aQryVuj.exe
  2⤵
  PID:3076
- C:\Windows\System\wHPtwWi.exe
  C:\Windows\System\wHPtwWi.exe
  2⤵
  PID:2940
- C:\Windows\System\Ibtzxab.exe
  C:\Windows\System\Ibtzxab.exe
  2⤵
  PID:4260
- C:\Windows\System\DSSgRyX.exe
  C:\Windows\System\DSSgRyX.exe
  2⤵
  PID:4328
- C:\Windows\System\MLkrTpw.exe
  C:\Windows\System\MLkrTpw.exe
  2⤵
  PID:2688
- C:\Windows\System\hWByLWH.exe
  C:\Windows\System\hWByLWH.exe
  2⤵
  PID:4172
- C:\Windows\System\GIhjXje.exe
  C:\Windows\System\GIhjXje.exe
  2⤵
  PID:4212
- C:\Windows\System\hRHguiC.exe
  C:\Windows\System\hRHguiC.exe
  2⤵
  PID:4276
- C:\Windows\System\CSOaiEy.exe
  C:\Windows\System\CSOaiEy.exe
  2⤵
  PID:3936
- C:\Windows\System\xgkuKSU.exe
  C:\Windows\System\xgkuKSU.exe
  2⤵
  PID:4392
- C:\Windows\System\fNvyoGl.exe
  C:\Windows\System\fNvyoGl.exe
  2⤵
  PID:4452
- C:\Windows\System\dXIFnIj.exe
  C:\Windows\System\dXIFnIj.exe
  2⤵
  PID:4548
- C:\Windows\System\IUiFRWe.exe
  C:\Windows\System\IUiFRWe.exe
  2⤵
  PID:4520
- C:\Windows\System\GiSGpQX.exe
  C:\Windows\System\GiSGpQX.exe
  2⤵
  PID:2112
- C:\Windows\System\UKWgFKE.exe
  C:\Windows\System\UKWgFKE.exe
  2⤵
  PID:4680
- C:\Windows\System\DJQUAMD.exe
  C:\Windows\System\DJQUAMD.exe
  2⤵
  PID:4744
- C:\Windows\System\JGPgrAq.exe
  C:\Windows\System\JGPgrAq.exe
  2⤵
  PID:4776
- C:\Windows\System\aoVpFvp.exe
  C:\Windows\System\aoVpFvp.exe
  2⤵
  PID:4792
- C:\Windows\System\ZZwYwPQ.exe
  C:\Windows\System\ZZwYwPQ.exe
  2⤵
  PID:4840
- C:\Windows\System\wwyPwzb.exe
  C:\Windows\System\wwyPwzb.exe
  2⤵
  PID:4536
- C:\Windows\System\NCiKBOw.exe
  C:\Windows\System\NCiKBOw.exe
  2⤵
  PID:4600
- C:\Windows\System\qCHBxst.exe
  C:\Windows\System\qCHBxst.exe
  2⤵
  PID:4668
- C:\Windows\System\kFytmDW.exe
  C:\Windows\System\kFytmDW.exe
  2⤵
  PID:4732
- C:\Windows\System\IhdNYZB.exe
  C:\Windows\System\IhdNYZB.exe
  2⤵
  PID:4908
- C:\Windows\System\JtjGTtL.exe
  C:\Windows\System\JtjGTtL.exe
  2⤵
  PID:4892
- C:\Windows\System\ioUBxGe.exe
  C:\Windows\System\ioUBxGe.exe
  2⤵
  PID:4920
- C:\Windows\System\JEKEeCr.exe
  C:\Windows\System\JEKEeCr.exe
  2⤵
  PID:4960
- C:\Windows\System\zXRSlic.exe
  C:\Windows\System\zXRSlic.exe
  2⤵
  PID:5080
- C:\Windows\System\sBxCeHO.exe
  C:\Windows\System\sBxCeHO.exe
  2⤵
  PID:5116
- C:\Windows\System\DtMaCsW.exe
  C:\Windows\System\DtMaCsW.exe
  2⤵
  PID:3740
- C:\Windows\System\zxcpSNz.exe
  C:\Windows\System\zxcpSNz.exe
  2⤵
  PID:4196
- C:\Windows\System\ZglALWz.exe
  C:\Windows\System\ZglALWz.exe
  2⤵
  PID:3656
- C:\Windows\System\viLdyCQ.exe
  C:\Windows\System\viLdyCQ.exe
  2⤵
  PID:4112
- C:\Windows\System\leCtfLA.exe
  C:\Windows\System\leCtfLA.exe
  2⤵
  PID:4272
- C:\Windows\System\MCNIICr.exe
  C:\Windows\System\MCNIICr.exe
  2⤵
  PID:5064
- C:\Windows\System\DwHFraH.exe
  C:\Windows\System\DwHFraH.exe
  2⤵
  PID:2928
- C:\Windows\System\iDEVnnk.exe
  C:\Windows\System\iDEVnnk.exe
  2⤵
  PID:3580
- C:\Windows\System\jtaTycT.exe
  C:\Windows\System\jtaTycT.exe
  2⤵
  PID:1768
- C:\Windows\System\fYdNlNv.exe
  C:\Windows\System\fYdNlNv.exe
  2⤵
  PID:3948
- C:\Windows\System\hMlveEv.exe
  C:\Windows\System\hMlveEv.exe
  2⤵
  PID:4312
- C:\Windows\System\oluWdPM.exe
  C:\Windows\System\oluWdPM.exe
  2⤵
  PID:4376
- C:\Windows\System\XUGbjYb.exe
  C:\Windows\System\XUGbjYb.exe
  2⤵
  PID:4488
- C:\Windows\System\lmwIfWZ.exe
  C:\Windows\System\lmwIfWZ.exe
  2⤵
  PID:4712
- C:\Windows\System\ICmZkKI.exe
  C:\Windows\System\ICmZkKI.exe
  2⤵
  PID:4824
- C:\Windows\System\xhOqtgW.exe
  C:\Windows\System\xhOqtgW.exe
  2⤵
  PID:4876
- C:\Windows\System\JlyrVov.exe
  C:\Windows\System\JlyrVov.exe
  2⤵
  PID:4976
- C:\Windows\System\ZpbXDEe.exe
  C:\Windows\System\ZpbXDEe.exe
  2⤵
  PID:4532
- C:\Windows\System\hfnbFEf.exe
  C:\Windows\System\hfnbFEf.exe
  2⤵
  PID:4728
- C:\Windows\System\fbynddc.exe
  C:\Windows\System\fbynddc.exe
  2⤵
  PID:4956
- C:\Windows\System\WKWKGWB.exe
  C:\Windows\System\WKWKGWB.exe
  2⤵
  PID:4440
- C:\Windows\System\rRaMMZO.exe
  C:\Windows\System\rRaMMZO.exe
  2⤵
  PID:4620
- C:\Windows\System\fxwwlRU.exe
  C:\Windows\System\fxwwlRU.exe
  2⤵
  PID:3704
- C:\Windows\System\fBviJqi.exe
  C:\Windows\System\fBviJqi.exe
  2⤵
  PID:1972
- C:\Windows\System\BHqtImJ.exe
  C:\Windows\System\BHqtImJ.exe
  2⤵
  PID:5124
- C:\Windows\System\TZOovDk.exe
  C:\Windows\System\TZOovDk.exe
  2⤵
  PID:5140
- C:\Windows\System\nOpJyLu.exe
  C:\Windows\System\nOpJyLu.exe
  2⤵
  PID:5156
- C:\Windows\System\OaHsXsl.exe
  C:\Windows\System\OaHsXsl.exe
  2⤵
  PID:5172
- C:\Windows\System\EuNLSsV.exe
  C:\Windows\System\EuNLSsV.exe
  2⤵
  PID:5188
- C:\Windows\System\VacGKaU.exe
  C:\Windows\System\VacGKaU.exe
  2⤵
  PID:5208
- C:\Windows\System\iigVJDD.exe
  C:\Windows\System\iigVJDD.exe
  2⤵
  PID:5224
- C:\Windows\System\tGYvaci.exe
  C:\Windows\System\tGYvaci.exe
  2⤵
  PID:5240
- C:\Windows\System\yQYGsZD.exe
  C:\Windows\System\yQYGsZD.exe
  2⤵
  PID:5256
- C:\Windows\System\YDeMoEc.exe
  C:\Windows\System\YDeMoEc.exe
  2⤵
  PID:5276
- C:\Windows\System\wcYjEeJ.exe
  C:\Windows\System\wcYjEeJ.exe
  2⤵
  PID:5292
- C:\Windows\System\HvWuKyr.exe
  C:\Windows\System\HvWuKyr.exe
  2⤵
  PID:5308
- C:\Windows\System\StmtAQs.exe
  C:\Windows\System\StmtAQs.exe
  2⤵
  PID:5324
- C:\Windows\System\vpSREiG.exe
  C:\Windows\System\vpSREiG.exe
  2⤵
  PID:5340
- C:\Windows\System\SwNlHAe.exe
  C:\Windows\System\SwNlHAe.exe
  2⤵
  PID:5360
- C:\Windows\System\DzilMCa.exe
  C:\Windows\System\DzilMCa.exe
  2⤵
  PID:5376
- C:\Windows\System\sywClwi.exe
  C:\Windows\System\sywClwi.exe
  2⤵
  PID:5392
- C:\Windows\System\DkkcmDy.exe
  C:\Windows\System\DkkcmDy.exe
  2⤵
  PID:5408
- C:\Windows\System\GJClesq.exe
  C:\Windows\System\GJClesq.exe
  2⤵
  PID:5424
- C:\Windows\System\YFGMzGI.exe
  C:\Windows\System\YFGMzGI.exe
  2⤵
  PID:5444
- C:\Windows\System\VtnSTWv.exe
  C:\Windows\System\VtnSTWv.exe
  2⤵
  PID:5460
- C:\Windows\System\ZshhFZu.exe
  C:\Windows\System\ZshhFZu.exe
  2⤵
  PID:5476
- C:\Windows\System\KFJxKNQ.exe
  C:\Windows\System\KFJxKNQ.exe
  2⤵
  PID:5492
- C:\Windows\System\TMtaVdj.exe
  C:\Windows\System\TMtaVdj.exe
  2⤵
  PID:5508
- C:\Windows\System\kEbvSDX.exe
  C:\Windows\System\kEbvSDX.exe
  2⤵
  PID:5524
- C:\Windows\System\xlItbIA.exe
  C:\Windows\System\xlItbIA.exe
  2⤵
  PID:5540
- C:\Windows\System\EzsUsPm.exe
  C:\Windows\System\EzsUsPm.exe
  2⤵
  PID:5556
- C:\Windows\System\LWGBssZ.exe
  C:\Windows\System\LWGBssZ.exe
  2⤵
  PID:5584
- C:\Windows\System\LyyvrWQ.exe
  C:\Windows\System\LyyvrWQ.exe
  2⤵
  PID:5600
- C:\Windows\System\thVtagE.exe
  C:\Windows\System\thVtagE.exe
  2⤵
  PID:5636
- C:\Windows\System\tzJaavU.exe
  C:\Windows\System\tzJaavU.exe
  2⤵
  PID:5652
- C:\Windows\System\YTHKNZX.exe
  C:\Windows\System\YTHKNZX.exe
  2⤵
  PID:5668
- C:\Windows\System\scTxFJp.exe
  C:\Windows\System\scTxFJp.exe
  2⤵
  PID:5684
- C:\Windows\System\YKyOglu.exe
  C:\Windows\System\YKyOglu.exe
  2⤵
  PID:5732
- C:\Windows\System\NbnuaiH.exe
  C:\Windows\System\NbnuaiH.exe
  2⤵
  PID:5752
- C:\Windows\System\uNkeZhg.exe
  C:\Windows\System\uNkeZhg.exe
  2⤵
  PID:5768
- C:\Windows\System\bjmFiwz.exe
  C:\Windows\System\bjmFiwz.exe
  2⤵
  PID:5784
- C:\Windows\System\LQKtWSw.exe
  C:\Windows\System\LQKtWSw.exe
  2⤵
  PID:5800
- C:\Windows\System\xRZkAkL.exe
  C:\Windows\System\xRZkAkL.exe
  2⤵
  PID:5816
- C:\Windows\System\ofgQfpt.exe
  C:\Windows\System\ofgQfpt.exe
  2⤵
  PID:5832
- C:\Windows\System\aTYQxfW.exe
  C:\Windows\System\aTYQxfW.exe
  2⤵
  PID:5856
- C:\Windows\System\jFHkZJu.exe
  C:\Windows\System\jFHkZJu.exe
  2⤵
  PID:5872
- C:\Windows\System\qPoKlKK.exe
  C:\Windows\System\qPoKlKK.exe
  2⤵
  PID:5888
- C:\Windows\System\cjEuYtr.exe
  C:\Windows\System\cjEuYtr.exe
  2⤵
  PID:5904
- C:\Windows\System\oHjfehJ.exe
  C:\Windows\System\oHjfehJ.exe
  2⤵
  PID:5920
- C:\Windows\System\zCDCDYb.exe
  C:\Windows\System\zCDCDYb.exe
  2⤵
  PID:5944
- C:\Windows\System\IahQoJt.exe
  C:\Windows\System\IahQoJt.exe
  2⤵
  PID:5960
- C:\Windows\System\HAOGsKn.exe
  C:\Windows\System\HAOGsKn.exe
  2⤵
  PID:5976
- C:\Windows\System\jsSslWF.exe
  C:\Windows\System\jsSslWF.exe
  2⤵
  PID:5992
- C:\Windows\System\IeFAaMp.exe
  C:\Windows\System\IeFAaMp.exe
  2⤵
  PID:6008
- C:\Windows\System\dBTICEI.exe
  C:\Windows\System\dBTICEI.exe
  2⤵
  PID:6024
- C:\Windows\System\pMpfemS.exe
  C:\Windows\System\pMpfemS.exe
  2⤵
  PID:6040
- C:\Windows\System\eLRneCb.exe
  C:\Windows\System\eLRneCb.exe
  2⤵
  PID:6056
- C:\Windows\System\RNpGWBh.exe
  C:\Windows\System\RNpGWBh.exe
  2⤵
  PID:6076
- C:\Windows\System\KqcmkGT.exe
  C:\Windows\System\KqcmkGT.exe
  2⤵
  PID:6104
- C:\Windows\System\REPhwrl.exe
  C:\Windows\System\REPhwrl.exe
  2⤵
  PID:6124
- C:\Windows\System\ugLLpYX.exe
  C:\Windows\System\ugLLpYX.exe
  2⤵
  PID:6140
- C:\Windows\System\RgUixwm.exe
  C:\Windows\System\RgUixwm.exe
  2⤵
  PID:3612
- C:\Windows\System\kxZNLwt.exe
  C:\Windows\System\kxZNLwt.exe
  2⤵
  PID:4240
- C:\Windows\System\ixexfVw.exe
  C:\Windows\System\ixexfVw.exe
  2⤵
  PID:1896
- C:\Windows\System\dfFOzJX.exe
  C:\Windows\System\dfFOzJX.exe
  2⤵
  PID:3996
- C:\Windows\System\OSiwyNr.exe
  C:\Windows\System\OSiwyNr.exe
  2⤵
  PID:4764
- C:\Windows\System\ncSaaBi.exe
  C:\Windows\System\ncSaaBi.exe
  2⤵
  PID:4700
- C:\Windows\System\KMwSNHf.exe
  C:\Windows\System\KMwSNHf.exe
  2⤵
  PID:4192
- C:\Windows\System\IUEeOLC.exe
  C:\Windows\System\IUEeOLC.exe
  2⤵
  PID:5100
- C:\Windows\System\MscGtta.exe
  C:\Windows\System\MscGtta.exe
  2⤵
  PID:4344
- C:\Windows\System\TVfxFKM.exe
  C:\Windows\System\TVfxFKM.exe
  2⤵
  PID:4632
- C:\Windows\System\BGqwFJS.exe
  C:\Windows\System\BGqwFJS.exe
  2⤵
  PID:5288
- C:\Windows\System\kaDjrkP.exe
  C:\Windows\System\kaDjrkP.exe
  2⤵
  PID:5168
- C:\Windows\System\kKiucSY.exe
  C:\Windows\System\kKiucSY.exe
  2⤵
  PID:5516
- C:\Windows\System\hfhMdQt.exe
  C:\Windows\System\hfhMdQt.exe
  2⤵
  PID:1956
- C:\Windows\System\GYtehWk.exe
  C:\Windows\System\GYtehWk.exe
  2⤵
  PID:5404
- C:\Windows\System\btnCXts.exe
  C:\Windows\System\btnCXts.exe
  2⤵
  PID:5472
- C:\Windows\System\egLCDCv.exe
  C:\Windows\System\egLCDCv.exe
  2⤵
  PID:5776
- C:\Windows\System\OipGoyf.exe
  C:\Windows\System\OipGoyf.exe
  2⤵
  PID:5632
- C:\Windows\System\CvsLWVT.exe
  C:\Windows\System\CvsLWVT.exe
  2⤵
  PID:5936
- C:\Windows\System\eJqJJOx.exe
  C:\Windows\System\eJqJJOx.exe
  2⤵
  PID:6004
- C:\Windows\System\kacfrFv.exe
  C:\Windows\System\kacfrFv.exe
  2⤵
  PID:6096
- C:\Windows\System\aaCPTIQ.exe
  C:\Windows\System\aaCPTIQ.exe
  2⤵
  PID:5248
- C:\Windows\System\gJwWiPu.exe
  C:\Windows\System\gJwWiPu.exe
  2⤵
  PID:3304
- C:\Windows\System\YbJEXqe.exe
  C:\Windows\System\YbJEXqe.exe
  2⤵
  PID:3080
- C:\Windows\System\efZgNuO.exe
  C:\Windows\System\efZgNuO.exe
  2⤵
  PID:5352
- C:\Windows\System\dYFCbcE.exe
  C:\Windows\System\dYFCbcE.exe
  2⤵
  PID:4516
- C:\Windows\System\UQMoIPy.exe
  C:\Windows\System\UQMoIPy.exe
  2⤵
  PID:5132
- C:\Windows\System\olGHmzw.exe
  C:\Windows\System\olGHmzw.exe
  2⤵
  PID:4584
- C:\Windows\System\uCjVXEB.exe
  C:\Windows\System\uCjVXEB.exe
  2⤵
  PID:5456
- C:\Windows\System\sEHnQlN.exe
  C:\Windows\System\sEHnQlN.exe
  2⤵
  PID:5236
- C:\Windows\System\glMDuQh.exe
  C:\Windows\System\glMDuQh.exe
  2⤵
  PID:5548
- C:\Windows\System\UWPlKcq.exe
  C:\Windows\System\UWPlKcq.exe
  2⤵
  PID:5436
- C:\Windows\System\XaQLtyM.exe
  C:\Windows\System\XaQLtyM.exe
  2⤵
  PID:536
- C:\Windows\System\IYVQtKH.exe
  C:\Windows\System\IYVQtKH.exe
  2⤵
  PID:5568
- C:\Windows\System\XlPkHcr.exe
  C:\Windows\System\XlPkHcr.exe
  2⤵
  PID:5608
- C:\Windows\System\DrfYWaM.exe
  C:\Windows\System\DrfYWaM.exe
  2⤵
  PID:2472
- C:\Windows\System\PwdWgOf.exe
  C:\Windows\System\PwdWgOf.exe
  2⤵
  PID:5440
- C:\Windows\System\DazbnEe.exe
  C:\Windows\System\DazbnEe.exe
  2⤵
  PID:2404
- C:\Windows\System\OzMGGcR.exe
  C:\Windows\System\OzMGGcR.exe
  2⤵
  PID:5848
- C:\Windows\System\IjGPJph.exe
  C:\Windows\System\IjGPJph.exe
  2⤵
  PID:5912
- C:\Windows\System\uQJFILu.exe
  C:\Windows\System\uQJFILu.exe
  2⤵
  PID:5692
- C:\Windows\System\BUVBbDS.exe
  C:\Windows\System\BUVBbDS.exe
  2⤵
  PID:5952
- C:\Windows\System\EauNqoZ.exe
  C:\Windows\System\EauNqoZ.exe
  2⤵
  PID:5724
- C:\Windows\System\jFQoxTO.exe
  C:\Windows\System\jFQoxTO.exe
  2⤵
  PID:5828
- C:\Windows\System\cvTDbao.exe
  C:\Windows\System\cvTDbao.exe
  2⤵
  PID:5900
- C:\Windows\System\tcHzqgD.exe
  C:\Windows\System\tcHzqgD.exe
  2⤵
  PID:5932
- C:\Windows\System\zULxYzC.exe
  C:\Windows\System\zULxYzC.exe
  2⤵
  PID:5232
- C:\Windows\System\CQyqgkr.exe
  C:\Windows\System\CQyqgkr.exe
  2⤵
  PID:6088
- C:\Windows\System\PnLVUcy.exe
  C:\Windows\System\PnLVUcy.exe
  2⤵
  PID:5152
- C:\Windows\System\NpSIAqo.exe
  C:\Windows\System\NpSIAqo.exe
  2⤵
  PID:5200
- C:\Windows\System\bZDEqnN.exe
  C:\Windows\System\bZDEqnN.exe
  2⤵
  PID:1588
- C:\Windows\System\CuBANQE.exe
  C:\Windows\System\CuBANQE.exe
  2⤵
  PID:5536
- C:\Windows\System\sMFwbmp.exe
  C:\Windows\System\sMFwbmp.exe
  2⤵
  PID:5576
- C:\Windows\System\fsRaMaU.exe
  C:\Windows\System\fsRaMaU.exe
  2⤵
  PID:5748
- C:\Windows\System\IzQfOdx.exe
  C:\Windows\System\IzQfOdx.exe
  2⤵
  PID:5840
- C:\Windows\System\gfkXYjz.exe
  C:\Windows\System\gfkXYjz.exe
  2⤵
  PID:4256
- C:\Windows\System\XUbUmfD.exe
  C:\Windows\System\XUbUmfD.exe
  2⤵
  PID:4972
- C:\Windows\System\EhucMOT.exe
  C:\Windows\System\EhucMOT.exe
  2⤵
  PID:5184
- C:\Windows\System\AMfqagU.exe
  C:\Windows\System\AMfqagU.exe
  2⤵
  PID:6092
- C:\Windows\System\FwtPdZG.exe
  C:\Windows\System\FwtPdZG.exe
  2⤵
  PID:5300
- C:\Windows\System\YyxfrZv.exe
  C:\Windows\System\YyxfrZv.exe
  2⤵
  PID:4760
- C:\Windows\System\orLNgxz.exe
  C:\Windows\System\orLNgxz.exe
  2⤵
  PID:5036
- C:\Windows\System\gFZcbrD.exe
  C:\Windows\System\gFZcbrD.exe
  2⤵
  PID:5272
- C:\Windows\System\RbtYpbO.exe
  C:\Windows\System\RbtYpbO.exe
  2⤵
  PID:5032
- C:\Windows\System\tpTrWfG.exe
  C:\Windows\System\tpTrWfG.exe
  2⤵
  PID:792
- C:\Windows\System\RxAuSjO.exe
  C:\Windows\System\RxAuSjO.exe
  2⤵
  PID:5988
- C:\Windows\System\SvtdIQR.exe
  C:\Windows\System\SvtdIQR.exe
  2⤵
  PID:6052
- C:\Windows\System\mbwRtFr.exe
  C:\Windows\System\mbwRtFr.exe
  2⤵
  PID:5760
- C:\Windows\System\EmvNthL.exe
  C:\Windows\System\EmvNthL.exe
  2⤵
  PID:5020
- C:\Windows\System\sIDSLII.exe
  C:\Windows\System\sIDSLII.exe
  2⤵
  PID:6068
- C:\Windows\System\wRdePpO.exe
  C:\Windows\System\wRdePpO.exe
  2⤵
  PID:6020
- C:\Windows\System\ARfAeaE.exe
  C:\Windows\System\ARfAeaE.exe
  2⤵
  PID:6120
- C:\Windows\System\KNbuneU.exe
  C:\Windows\System\KNbuneU.exe
  2⤵
  PID:5180
- C:\Windows\System\rbxEWVZ.exe
  C:\Windows\System\rbxEWVZ.exe
  2⤵
  PID:5104
- C:\Windows\System\qnEhydn.exe
  C:\Windows\System\qnEhydn.exe
  2⤵
  PID:5368
- C:\Windows\System\IRhButv.exe
  C:\Windows\System\IRhButv.exe
  2⤵
  PID:4420
- C:\Windows\System\vYItrDv.exe
  C:\Windows\System\vYItrDv.exe
  2⤵
  PID:4208
- C:\Windows\System\NVAopfC.exe
  C:\Windows\System\NVAopfC.exe
  2⤵
  PID:5884
- C:\Windows\System\DfWNFdY.exe
  C:\Windows\System\DfWNFdY.exe
  2⤵
  PID:5796
- C:\Windows\System\OndsFfY.exe
  C:\Windows\System\OndsFfY.exe
  2⤵
  PID:5532
- C:\Windows\System\JyLVNvS.exe
  C:\Windows\System\JyLVNvS.exe
  2⤵
  PID:3852
- C:\Windows\System\cjZCGTI.exe
  C:\Windows\System\cjZCGTI.exe
  2⤵
  PID:4360
- C:\Windows\System\ZncCFig.exe
  C:\Windows\System\ZncCFig.exe
  2⤵
  PID:6148
- C:\Windows\System\OTNYvlf.exe
  C:\Windows\System\OTNYvlf.exe
  2⤵
  PID:6164
- C:\Windows\System\RiCcIyC.exe
  C:\Windows\System\RiCcIyC.exe
  2⤵
  PID:6184
- C:\Windows\System\TxpLbnr.exe
  C:\Windows\System\TxpLbnr.exe
  2⤵
  PID:6200
- C:\Windows\System\VOCihlk.exe
  C:\Windows\System\VOCihlk.exe
  2⤵
  PID:6216
- C:\Windows\System\JQwQTqa.exe
  C:\Windows\System\JQwQTqa.exe
  2⤵
  PID:6232
- C:\Windows\System\xswFqrW.exe
  C:\Windows\System\xswFqrW.exe
  2⤵
  PID:6248
- C:\Windows\System\EhEDBXA.exe
  C:\Windows\System\EhEDBXA.exe
  2⤵
  PID:6264
- C:\Windows\System\lEVOUaw.exe
  C:\Windows\System\lEVOUaw.exe
  2⤵
  PID:6280
- C:\Windows\System\eYBmyAE.exe
  C:\Windows\System\eYBmyAE.exe
  2⤵
  PID:6328
- C:\Windows\System\fzWInIS.exe
  C:\Windows\System\fzWInIS.exe
  2⤵
  PID:6344
- C:\Windows\System\jUsSRzX.exe
  C:\Windows\System\jUsSRzX.exe
  2⤵
  PID:6364
- C:\Windows\System\NSEIwAS.exe
  C:\Windows\System\NSEIwAS.exe
  2⤵
  PID:6384
- C:\Windows\System\hJhamUG.exe
  C:\Windows\System\hJhamUG.exe
  2⤵
  PID:6404
- C:\Windows\System\jqXTGyR.exe
  C:\Windows\System\jqXTGyR.exe
  2⤵
  PID:6420
- C:\Windows\System\sMqrmWe.exe
  C:\Windows\System\sMqrmWe.exe
  2⤵
  PID:6440
- C:\Windows\System\zeKdiqF.exe
  C:\Windows\System\zeKdiqF.exe
  2⤵
  PID:6456
- C:\Windows\System\LKBlTCX.exe
  C:\Windows\System\LKBlTCX.exe
  2⤵
  PID:6472
- C:\Windows\System\lhyuMlf.exe
  C:\Windows\System\lhyuMlf.exe
  2⤵
  PID:6488
- C:\Windows\System\eSmGDBs.exe
  C:\Windows\System\eSmGDBs.exe
  2⤵
  PID:6504
- C:\Windows\System\vpZWgFt.exe
  C:\Windows\System\vpZWgFt.exe
  2⤵
  PID:6520
- C:\Windows\System\YTjqjXl.exe
  C:\Windows\System\YTjqjXl.exe
  2⤵
  PID:6536
- C:\Windows\System\wbSNHfm.exe
  C:\Windows\System\wbSNHfm.exe
  2⤵
  PID:6556
- C:\Windows\System\BHHVMZM.exe
  C:\Windows\System\BHHVMZM.exe
  2⤵
  PID:6572
- C:\Windows\System\nXjRLBq.exe
  C:\Windows\System\nXjRLBq.exe
  2⤵
  PID:6588
- C:\Windows\System\eJLzMHb.exe
  C:\Windows\System\eJLzMHb.exe
  2⤵
  PID:6604
- C:\Windows\System\pkPUZHV.exe
  C:\Windows\System\pkPUZHV.exe
  2⤵
  PID:6620
- C:\Windows\System\VcIEHSC.exe
  C:\Windows\System\VcIEHSC.exe
  2⤵
  PID:6636
- C:\Windows\System\qzuiTSt.exe
  C:\Windows\System\qzuiTSt.exe
  2⤵
  PID:6652
- C:\Windows\System\HbfXanQ.exe
  C:\Windows\System\HbfXanQ.exe
  2⤵
  PID:6668
- C:\Windows\System\FVuTROZ.exe
  C:\Windows\System\FVuTROZ.exe
  2⤵
  PID:6684
- C:\Windows\System\xxFVkUH.exe
  C:\Windows\System\xxFVkUH.exe
  2⤵
  PID:6700
- C:\Windows\System\fgPsvAs.exe
  C:\Windows\System\fgPsvAs.exe
  2⤵
  PID:6716
- C:\Windows\System\UompmzW.exe
  C:\Windows\System\UompmzW.exe
  2⤵
  PID:6732
- C:\Windows\System\ZtKxJpV.exe
  C:\Windows\System\ZtKxJpV.exe
  2⤵
  PID:6748
- C:\Windows\System\Crnszer.exe
  C:\Windows\System\Crnszer.exe
  2⤵
  PID:6764
- C:\Windows\System\JRqvhOA.exe
  C:\Windows\System\JRqvhOA.exe
  2⤵
  PID:6780
- C:\Windows\System\efNbPCp.exe
  C:\Windows\System\efNbPCp.exe
  2⤵
  PID:6796
- C:\Windows\System\XnAGZrp.exe
  C:\Windows\System\XnAGZrp.exe
  2⤵
  PID:6812
- C:\Windows\System\GcxFaQA.exe
  C:\Windows\System\GcxFaQA.exe
  2⤵
  PID:6828
- C:\Windows\System\jgyndRn.exe
  C:\Windows\System\jgyndRn.exe
  2⤵
  PID:6844
- C:\Windows\System\fFMfCFa.exe
  C:\Windows\System\fFMfCFa.exe
  2⤵
  PID:6860
- C:\Windows\System\GyukeJD.exe
  C:\Windows\System\GyukeJD.exe
  2⤵
  PID:6876
- C:\Windows\System\MVNZvaG.exe
  C:\Windows\System\MVNZvaG.exe
  2⤵
  PID:6892
- C:\Windows\System\SNWrATb.exe
  C:\Windows\System\SNWrATb.exe
  2⤵
  PID:6912
- C:\Windows\System\smGfIoa.exe
  C:\Windows\System\smGfIoa.exe
  2⤵
  PID:6932
- C:\Windows\System\TOQuDcb.exe
  C:\Windows\System\TOQuDcb.exe
  2⤵
  PID:6948
- C:\Windows\System\KYnbKQQ.exe
  C:\Windows\System\KYnbKQQ.exe
  2⤵
  PID:6964
- C:\Windows\System\PmJSVJt.exe
  C:\Windows\System\PmJSVJt.exe
  2⤵
  PID:6980
- C:\Windows\System\jeMgUBB.exe
  C:\Windows\System\jeMgUBB.exe
  2⤵
  PID:6996
- C:\Windows\System\yBgJWuE.exe
  C:\Windows\System\yBgJWuE.exe
  2⤵
  PID:7020
- C:\Windows\System\hgGvTai.exe
  C:\Windows\System\hgGvTai.exe
  2⤵
  PID:7036
- C:\Windows\System\txuFtfW.exe
  C:\Windows\System\txuFtfW.exe
  2⤵
  PID:7052
- C:\Windows\System\JPNciwe.exe
  C:\Windows\System\JPNciwe.exe
  2⤵
  PID:7068
- C:\Windows\System\hSdXMOP.exe
  C:\Windows\System\hSdXMOP.exe
  2⤵
  PID:7084
- C:\Windows\System\ybrPQuY.exe
  C:\Windows\System\ybrPQuY.exe
  2⤵
  PID:7100
- C:\Windows\System\XRcQuLR.exe
  C:\Windows\System\XRcQuLR.exe
  2⤵
  PID:7116
- C:\Windows\System\aLgQmjN.exe
  C:\Windows\System\aLgQmjN.exe
  2⤵
  PID:7132
- C:\Windows\System\lgHjjov.exe
  C:\Windows\System\lgHjjov.exe
  2⤵
  PID:7152
- C:\Windows\System\iPtRbFc.exe
  C:\Windows\System\iPtRbFc.exe
  2⤵
  PID:6136
- C:\Windows\System\LGvrCUe.exe
  C:\Windows\System\LGvrCUe.exe
  2⤵
  PID:6116
- C:\Windows\System\VegXzMR.exe
  C:\Windows\System\VegXzMR.exe
  2⤵
  PID:5720
- C:\Windows\System\FgFiime.exe
  C:\Windows\System\FgFiime.exe
  2⤵
  PID:5704
- C:\Windows\System\UqatMsr.exe
  C:\Windows\System\UqatMsr.exe
  2⤵
  PID:6048
- C:\Windows\System\CYaTreB.exe
  C:\Windows\System\CYaTreB.exe
  2⤵
  PID:6192
- C:\Windows\System\AtFPuhE.exe
  C:\Windows\System\AtFPuhE.exe
  2⤵
  PID:6276
- C:\Windows\System\JITFefv.exe
  C:\Windows\System\JITFefv.exe
  2⤵
  PID:6288
- C:\Windows\System\JQjZpoe.exe
  C:\Windows\System\JQjZpoe.exe
  2⤵
  PID:6304
- C:\Windows\System\AdYuccR.exe
  C:\Windows\System\AdYuccR.exe
  2⤵
  PID:6340
- C:\Windows\System\wehlTIS.exe
  C:\Windows\System\wehlTIS.exe
  2⤵
  PID:6416
- C:\Windows\System\thFzPfq.exe
  C:\Windows\System\thFzPfq.exe
  2⤵
  PID:6512
- C:\Windows\System\miTvcUS.exe
  C:\Windows\System\miTvcUS.exe
  2⤵
  PID:6580
- C:\Windows\System\HtDhSoP.exe
  C:\Windows\System\HtDhSoP.exe
  2⤵
  PID:6392
- C:\Windows\System\PulWrOJ.exe
  C:\Windows\System\PulWrOJ.exe
  2⤵
  PID:6532
- C:\Windows\System\bexyEgJ.exe
  C:\Windows\System\bexyEgJ.exe
  2⤵
  PID:6324
- C:\Windows\System\YMXrNvo.exe
  C:\Windows\System\YMXrNvo.exe
  2⤵
  PID:6436
- C:\Windows\System\dBPVIAd.exe
  C:\Windows\System\dBPVIAd.exe
  2⤵
  PID:6648
- C:\Windows\System\fBdLUSy.exe
  C:\Windows\System\fBdLUSy.exe
  2⤵
  PID:6708
- C:\Windows\System\XUbBqdp.exe
  C:\Windows\System\XUbBqdp.exe
  2⤵
  PID:6744
- C:\Windows\System\qKziRDH.exe
  C:\Windows\System\qKziRDH.exe
  2⤵
  PID:6776
- C:\Windows\System\xvczUyU.exe
  C:\Windows\System\xvczUyU.exe
  2⤵
  PID:6840
- C:\Windows\System\BYyecHY.exe
  C:\Windows\System\BYyecHY.exe
  2⤵
  PID:6904
- C:\Windows\System\yVjCJsW.exe
  C:\Windows\System\yVjCJsW.exe
  2⤵
  PID:6972
- C:\Windows\System\mTQqXMx.exe
  C:\Windows\System\mTQqXMx.exe
  2⤵
  PID:7016
- C:\Windows\System\IuiNPBr.exe
  C:\Windows\System\IuiNPBr.exe
  2⤵
  PID:6756
- C:\Windows\System\OrGiEgh.exe
  C:\Windows\System\OrGiEgh.exe
  2⤵
  PID:7008
- C:\Windows\System\UmBvuGi.exe
  C:\Windows\System\UmBvuGi.exe
  2⤵
  PID:7048
- C:\Windows\System\fRhcisU.exe
  C:\Windows\System\fRhcisU.exe
  2⤵
  PID:5016
- C:\Windows\System\HdeiONX.exe
  C:\Windows\System\HdeiONX.exe
  2⤵
  PID:6888
- C:\Windows\System\IQlNsrS.exe
  C:\Windows\System\IQlNsrS.exe
  2⤵
  PID:6992
- C:\Windows\System\AYkAoFF.exe
  C:\Windows\System\AYkAoFF.exe
  2⤵
  PID:7064
- C:\Windows\System\bZiXbwC.exe
  C:\Windows\System\bZiXbwC.exe
  2⤵
  PID:6212
- C:\Windows\System\rQOOqST.exe
  C:\Windows\System\rQOOqST.exe
  2⤵
  PID:6228
- C:\Windows\System\hONBXOZ.exe
  C:\Windows\System\hONBXOZ.exe
  2⤵
  PID:6224
- C:\Windows\System\rnbHSaU.exe
  C:\Windows\System\rnbHSaU.exe
  2⤵
  PID:6272
- C:\Windows\System\PEkZhVd.exe
  C:\Windows\System\PEkZhVd.exe
  2⤵
  PID:6160
- C:\Windows\System\wbiCuPi.exe
  C:\Windows\System\wbiCuPi.exe
  2⤵
  PID:6336
- C:\Windows\System\oJYRkjF.exe
  C:\Windows\System\oJYRkjF.exe
  2⤵
  PID:6544
- C:\Windows\System\UFoafgT.exe
  C:\Windows\System\UFoafgT.exe
  2⤵
  PID:6644
- C:\Windows\System\jDgZJJh.exe
  C:\Windows\System\jDgZJJh.exe
  2⤵
  PID:6528
- C:\Windows\System\oyETmfy.exe
  C:\Windows\System\oyETmfy.exe
  2⤵
  PID:6680
- C:\Windows\System\RjbtYgv.exe
  C:\Windows\System\RjbtYgv.exe
  2⤵
  PID:6900
- C:\Windows\System\siqpgjT.exe
  C:\Windows\System\siqpgjT.exe
  2⤵
  PID:6960
- C:\Windows\System\vihhGTP.exe
  C:\Windows\System\vihhGTP.exe
  2⤵
  PID:7112
- C:\Windows\System\vlIFUwh.exe
  C:\Windows\System\vlIFUwh.exe
  2⤵
  PID:6740
- C:\Windows\System\MHvibFJ.exe
  C:\Windows\System\MHvibFJ.exe
  2⤵
  PID:6612
- C:\Windows\System\YQGQBqV.exe
  C:\Windows\System\YQGQBqV.exe
  2⤵
  PID:6600
- C:\Windows\System\xkpbVKa.exe
  C:\Windows\System\xkpbVKa.exe
  2⤵
  PID:6808
- C:\Windows\System\ozjNisl.exe
  C:\Windows\System\ozjNisl.exe
  2⤵
  PID:6944
- C:\Windows\System\wyxHKYi.exe
  C:\Windows\System\wyxHKYi.exe
  2⤵
  PID:6884
- C:\Windows\System\eMTSSEj.exe
  C:\Windows\System\eMTSSEj.exe
  2⤵
  PID:7148
- C:\Windows\System\ChGAgBg.exe
  C:\Windows\System\ChGAgBg.exe
  2⤵
  PID:6244
- C:\Windows\System\ChDBAtu.exe
  C:\Windows\System\ChDBAtu.exe
  2⤵
  PID:6312
- C:\Windows\System\bHkCgKN.exe
  C:\Windows\System\bHkCgKN.exe
  2⤵
  PID:6320
- C:\Windows\System\WiVcTTU.exe
  C:\Windows\System\WiVcTTU.exe
  2⤵
  PID:6676
- C:\Windows\System\kBjaejn.exe
  C:\Windows\System\kBjaejn.exe
  2⤵
  PID:6628
- C:\Windows\System\pXDghnh.exe
  C:\Windows\System\pXDghnh.exe
  2⤵
  PID:6496
- C:\Windows\System\kOtZtFY.exe
  C:\Windows\System\kOtZtFY.exe
  2⤵
  PID:6956
- C:\Windows\System\ZHxyEsN.exe
  C:\Windows\System\ZHxyEsN.exe
  2⤵
  PID:6316
- C:\Windows\System\seRajvU.exe
  C:\Windows\System\seRajvU.exe
  2⤵
  PID:6596
- C:\Windows\System\OXaINMC.exe
  C:\Windows\System\OXaINMC.exe
  2⤵
  PID:7144
- C:\Windows\System\cwyqLmV.exe
  C:\Windows\System\cwyqLmV.exe
  2⤵
  PID:5696
- C:\Windows\System\WvCaJmy.exe
  C:\Windows\System\WvCaJmy.exe
  2⤵
  PID:7140
- C:\Windows\System\MKFMdiF.exe
  C:\Windows\System\MKFMdiF.exe
  2⤵
  PID:6432
- C:\Windows\System\qXVJsAX.exe
  C:\Windows\System\qXVJsAX.exe
  2⤵
  PID:6824
- C:\Windows\System\OiWEfYi.exe
  C:\Windows\System\OiWEfYi.exe
  2⤵
  PID:6400
- C:\Windows\System\LzUNqDN.exe
  C:\Windows\System\LzUNqDN.exe
  2⤵
  PID:7080
- C:\Windows\System\cRrfYHT.exe
  C:\Windows\System\cRrfYHT.exe
  2⤵
  PID:7164
- C:\Windows\System\rVmRIkV.exe
  C:\Windows\System\rVmRIkV.exe
  2⤵
  PID:6940
- C:\Windows\System\KpAJbNH.exe
  C:\Windows\System\KpAJbNH.exe
  2⤵
  PID:7012
- C:\Windows\System\RVhCoRO.exe
  C:\Windows\System\RVhCoRO.exe
  2⤵
  PID:6920
- C:\Windows\System\YMWsbhd.exe
  C:\Windows\System\YMWsbhd.exe
  2⤵
  PID:7184
- C:\Windows\System\vzOWGjv.exe
  C:\Windows\System\vzOWGjv.exe
  2⤵
  PID:7200
- C:\Windows\System\AVlUaZq.exe
  C:\Windows\System\AVlUaZq.exe
  2⤵
  PID:7216
- C:\Windows\System\PXBbPWy.exe
  C:\Windows\System\PXBbPWy.exe
  2⤵
  PID:7232
- C:\Windows\System\XkyiMtz.exe
  C:\Windows\System\XkyiMtz.exe
  2⤵
  PID:7248
- C:\Windows\System\eqMysxN.exe
  C:\Windows\System\eqMysxN.exe
  2⤵
  PID:7264
- C:\Windows\System\sGINqZJ.exe
  C:\Windows\System\sGINqZJ.exe
  2⤵
  PID:7280
- C:\Windows\System\CcrpxdS.exe
  C:\Windows\System\CcrpxdS.exe
  2⤵
  PID:7296
- C:\Windows\System\BFUqJWu.exe
  C:\Windows\System\BFUqJWu.exe
  2⤵
  PID:7312
- C:\Windows\System\AHDhUeG.exe
  C:\Windows\System\AHDhUeG.exe
  2⤵
  PID:7332
- C:\Windows\System\iGTTlwq.exe
  C:\Windows\System\iGTTlwq.exe
  2⤵
  PID:7348
- C:\Windows\System\IStcBOG.exe
  C:\Windows\System\IStcBOG.exe
  2⤵
  PID:7364
- C:\Windows\System\nDoVJRz.exe
  C:\Windows\System\nDoVJRz.exe
  2⤵
  PID:7380
- C:\Windows\System\QkjjFmn.exe
  C:\Windows\System\QkjjFmn.exe
  2⤵
  PID:7396
- C:\Windows\System\vRwyDUc.exe
  C:\Windows\System\vRwyDUc.exe
  2⤵
  PID:7412
- C:\Windows\System\KUQhIAX.exe
  C:\Windows\System\KUQhIAX.exe
  2⤵
  PID:7432
- C:\Windows\System\YQwHpGT.exe
  C:\Windows\System\YQwHpGT.exe
  2⤵
  PID:7448
- C:\Windows\System\naPIjfb.exe
  C:\Windows\System\naPIjfb.exe
  2⤵
  PID:7464
- C:\Windows\System\NALRFgZ.exe
  C:\Windows\System\NALRFgZ.exe
  2⤵
  PID:7484
- C:\Windows\System\tmujMTf.exe
  C:\Windows\System\tmujMTf.exe
  2⤵
  PID:7500
- C:\Windows\System\ZpTfFja.exe
  C:\Windows\System\ZpTfFja.exe
  2⤵
  PID:7516
- C:\Windows\System\EXredHp.exe
  C:\Windows\System\EXredHp.exe
  2⤵
  PID:7532
- C:\Windows\System\paLLuUn.exe
  C:\Windows\System\paLLuUn.exe
  2⤵
  PID:7548
- C:\Windows\System\ffpUwrj.exe
  C:\Windows\System\ffpUwrj.exe
  2⤵
  PID:7564
- C:\Windows\System\WeKTOjm.exe
  C:\Windows\System\WeKTOjm.exe
  2⤵
  PID:7580
- C:\Windows\System\wxBGrCf.exe
  C:\Windows\System\wxBGrCf.exe
  2⤵
  PID:7596
- C:\Windows\System\gtCZjip.exe
  C:\Windows\System\gtCZjip.exe
  2⤵
  PID:7612
- C:\Windows\System\zmOkido.exe
  C:\Windows\System\zmOkido.exe
  2⤵
  PID:7628
- C:\Windows\System\oZXCIwZ.exe
  C:\Windows\System\oZXCIwZ.exe
  2⤵
  PID:7644
- C:\Windows\System\rTPFtlp.exe
  C:\Windows\System\rTPFtlp.exe
  2⤵
  PID:7660
- C:\Windows\System\bAaCjcH.exe
  C:\Windows\System\bAaCjcH.exe
  2⤵
  PID:7684
- C:\Windows\System\zPmemQL.exe
  C:\Windows\System\zPmemQL.exe
  2⤵
  PID:7704
- C:\Windows\System\AjGbGHc.exe
  C:\Windows\System\AjGbGHc.exe
  2⤵
  PID:7720
- C:\Windows\System\GxXHHsN.exe
  C:\Windows\System\GxXHHsN.exe
  2⤵
  PID:7736
- C:\Windows\System\BsslsIB.exe
  C:\Windows\System\BsslsIB.exe
  2⤵
  PID:7752
- C:\Windows\System\yquqpJq.exe
  C:\Windows\System\yquqpJq.exe
  2⤵
  PID:7768
- C:\Windows\System\EiQEHCl.exe
  C:\Windows\System\EiQEHCl.exe
  2⤵
  PID:7784
- C:\Windows\System\JvTQtmI.exe
  C:\Windows\System\JvTQtmI.exe
  2⤵
  PID:7804
- C:\Windows\System\wZvhCiy.exe
  C:\Windows\System\wZvhCiy.exe
  2⤵
  PID:7820
- C:\Windows\System\wanMBXB.exe
  C:\Windows\System\wanMBXB.exe
  2⤵
  PID:7836
- C:\Windows\System\TvXHOxq.exe
  C:\Windows\System\TvXHOxq.exe
  2⤵
  PID:7856
- C:\Windows\System\wotnZpl.exe
  C:\Windows\System\wotnZpl.exe
  2⤵
  PID:7872
- C:\Windows\System\uTONHGe.exe
  C:\Windows\System\uTONHGe.exe
  2⤵
  PID:7888
- C:\Windows\System\SatchTs.exe
  C:\Windows\System\SatchTs.exe
  2⤵
  PID:7904
- C:\Windows\System\JONsyCn.exe
  C:\Windows\System\JONsyCn.exe
  2⤵
  PID:7920
- C:\Windows\System\ttwezoD.exe
  C:\Windows\System\ttwezoD.exe
  2⤵
  PID:7936
- C:\Windows\System\vjMcxIA.exe
  C:\Windows\System\vjMcxIA.exe
  2⤵
  PID:7952
- C:\Windows\System\yuWoqmO.exe
  C:\Windows\System\yuWoqmO.exe
  2⤵
  PID:7968
- C:\Windows\System\QHSuwaG.exe
  C:\Windows\System\QHSuwaG.exe
  2⤵
  PID:7984
- C:\Windows\System\gcsDSiL.exe
  C:\Windows\System\gcsDSiL.exe
  2⤵
  PID:8000
- C:\Windows\System\DFnErIz.exe
  C:\Windows\System\DFnErIz.exe
  2⤵
  PID:8016
- C:\Windows\System\nRDyoMb.exe
  C:\Windows\System\nRDyoMb.exe
  2⤵
  PID:8036
- C:\Windows\System\KUQtvwP.exe
  C:\Windows\System\KUQtvwP.exe
  2⤵
  PID:8052
- C:\Windows\System\iGyWnYQ.exe
  C:\Windows\System\iGyWnYQ.exe
  2⤵
  PID:8068
- C:\Windows\System\prFUJtH.exe
  C:\Windows\System\prFUJtH.exe
  2⤵
  PID:8084
- C:\Windows\System\jRBgUFn.exe
  C:\Windows\System\jRBgUFn.exe
  2⤵
  PID:8100
- C:\Windows\System\sFKNWZb.exe
  C:\Windows\System\sFKNWZb.exe
  2⤵
  PID:8116
- C:\Windows\System\pCCzbRq.exe
  C:\Windows\System\pCCzbRq.exe
  2⤵
  PID:8132
- C:\Windows\System\AFZLnaf.exe
  C:\Windows\System\AFZLnaf.exe
  2⤵
  PID:8148
- C:\Windows\System\FWOthIB.exe
  C:\Windows\System\FWOthIB.exe
  2⤵
  PID:8164
- C:\Windows\System\TlchZha.exe
  C:\Windows\System\TlchZha.exe
  2⤵
  PID:8184
- C:\Windows\System\GTwNdii.exe
  C:\Windows\System\GTwNdii.exe
  2⤵
  PID:7192
- C:\Windows\System\jDwToef.exe
  C:\Windows\System\jDwToef.exe
  2⤵
  PID:7228
- C:\Windows\System\fAXqVTH.exe
  C:\Windows\System\fAXqVTH.exe
  2⤵
  PID:7292
- C:\Windows\System\AVUNwvw.exe
  C:\Windows\System\AVUNwvw.exe
  2⤵
  PID:6568
- C:\Windows\System\Fwpqszk.exe
  C:\Windows\System\Fwpqszk.exe
  2⤵
  PID:6872
- C:\Windows\System\MUTRDln.exe
  C:\Windows\System\MUTRDln.exe
  2⤵
  PID:7388
- C:\Windows\System\yBSdGjv.exe
  C:\Windows\System\yBSdGjv.exe
  2⤵
  PID:7180
- C:\Windows\System\zSOyFmZ.exe
  C:\Windows\System\zSOyFmZ.exe
  2⤵
  PID:7408
- C:\Windows\System\esaYmwo.exe
  C:\Windows\System\esaYmwo.exe
  2⤵
  PID:7208
- C:\Windows\System\zwMAFoj.exe
  C:\Windows\System\zwMAFoj.exe
  2⤵
  PID:7344
- C:\Windows\System\AxiKMXO.exe
  C:\Windows\System\AxiKMXO.exe
  2⤵
  PID:7440
- C:\Windows\System\IqzqnIU.exe
  C:\Windows\System\IqzqnIU.exe
  2⤵
  PID:7496
- C:\Windows\System\WTOMGjp.exe
  C:\Windows\System\WTOMGjp.exe
  2⤵
  PID:7556
- C:\Windows\System\erzwOMe.exe
  C:\Windows\System\erzwOMe.exe
  2⤵
  PID:7620
- C:\Windows\System\fUGgnCW.exe
  C:\Windows\System\fUGgnCW.exe
  2⤵
  PID:7692
- C:\Windows\System\wahTjDk.exe
  C:\Windows\System\wahTjDk.exe
  2⤵
  PID:7764
- C:\Windows\System\kbtwRIG.exe
  C:\Windows\System\kbtwRIG.exe
  2⤵
  PID:7832
- C:\Windows\System\Lceyfux.exe
  C:\Windows\System\Lceyfux.exe
  2⤵
  PID:7576
- C:\Windows\System\dBVQnNt.exe
  C:\Windows\System\dBVQnNt.exe
  2⤵
  PID:7928
- C:\Windows\System\mKqPzzu.exe
  C:\Windows\System\mKqPzzu.exe
  2⤵
  PID:7964
- C:\Windows\System\iplKJpl.exe
  C:\Windows\System\iplKJpl.exe
  2⤵
  PID:7996
- C:\Windows\System\RpihFfp.exe
  C:\Windows\System\RpihFfp.exe
  2⤵
  PID:7540
- C:\Windows\System\DGFEFPb.exe
  C:\Windows\System\DGFEFPb.exe
  2⤵
  PID:7852
- C:\Windows\System\mkmBeym.exe
  C:\Windows\System\mkmBeym.exe
  2⤵
  PID:7668
- C:\Windows\System\TaaSTQb.exe
  C:\Windows\System\TaaSTQb.exe
  2⤵
  PID:8008
- C:\Windows\System\KyyFVVO.exe
  C:\Windows\System\KyyFVVO.exe
  2⤵
  PID:7744
- C:\Windows\System\dkacBCj.exe
  C:\Windows\System\dkacBCj.exe
  2⤵
  PID:7848
- C:\Windows\System\efhEIWi.exe
  C:\Windows\System\efhEIWi.exe
  2⤵
  PID:7980
- C:\Windows\System\UkFhhjU.exe
  C:\Windows\System\UkFhhjU.exe
  2⤵
  PID:7948
- C:\Windows\System\BiAqjOj.exe
  C:\Windows\System\BiAqjOj.exe
  2⤵
  PID:8048
- C:\Windows\System\ECPYlfQ.exe
  C:\Windows\System\ECPYlfQ.exe
  2⤵
  PID:8128
- C:\Windows\System\tNmuDLr.exe
  C:\Windows\System\tNmuDLr.exe
  2⤵
  PID:8076
- C:\Windows\System\yjnajWs.exe
  C:\Windows\System\yjnajWs.exe
  2⤵
  PID:6856
- C:\Windows\System\micNHVb.exe
  C:\Windows\System\micNHVb.exe
  2⤵
  PID:6452
- C:\Windows\System\dAFezNm.exe
  C:\Windows\System\dAFezNm.exe
  2⤵
  PID:7360
- C:\Windows\System\DUjrbzs.exe
  C:\Windows\System\DUjrbzs.exe
  2⤵
  PID:7340
- C:\Windows\System\Uclyurn.exe
  C:\Windows\System\Uclyurn.exe
  2⤵
  PID:7456
- C:\Windows\System\mGqScXz.exe
  C:\Windows\System\mGqScXz.exe
  2⤵
  PID:7328
- C:\Windows\System\OnZpquM.exe
  C:\Windows\System\OnZpquM.exe
  2⤵
  PID:7524
- C:\Windows\System\TMvfYOA.exe
  C:\Windows\System\TMvfYOA.exe
  2⤵
  PID:7592
- C:\Windows\System\MNluSPS.exe
  C:\Windows\System\MNluSPS.exe
  2⤵
  PID:7728
- C:\Windows\System\LNfMuUw.exe
  C:\Windows\System\LNfMuUw.exe
  2⤵
  PID:7792
- C:\Windows\System\gmMwXhQ.exe
  C:\Windows\System\gmMwXhQ.exe
  2⤵
  PID:7812
- C:\Windows\System\XTLICme.exe
  C:\Windows\System\XTLICme.exe
  2⤵
  PID:7608
- C:\Windows\System\wTLQhLT.exe
  C:\Windows\System\wTLQhLT.exe
  2⤵
  PID:7816
- C:\Windows\System\xRltDrW.exe
  C:\Windows\System\xRltDrW.exe
  2⤵
  PID:8124
- C:\Windows\System\LZlADkt.exe
  C:\Windows\System\LZlADkt.exe
  2⤵
  PID:8044
- C:\Windows\System\wMEIadz.exe
  C:\Windows\System\wMEIadz.exe
  2⤵
  PID:7480
- C:\Windows\System\CWzIVZU.exe
  C:\Windows\System\CWzIVZU.exe
  2⤵
  PID:8080
- C:\Windows\System\lOXuUiU.exe
  C:\Windows\System\lOXuUiU.exe
  2⤵
  PID:7716
- C:\Windows\System\IsLjOhe.exe
  C:\Windows\System\IsLjOhe.exe
  2⤵
  PID:8172
- C:\Windows\System\JhHgBEA.exe
  C:\Windows\System\JhHgBEA.exe
  2⤵
  PID:7324
- C:\Windows\System\qUWJAXa.exe
  C:\Windows\System\qUWJAXa.exe
  2⤵
  PID:7240
- C:\Windows\System\ohUJNNp.exe
  C:\Windows\System\ohUJNNp.exe
  2⤵
  PID:7244
- C:\Windows\System\pQjYGEG.exe
  C:\Windows\System\pQjYGEG.exe
  2⤵
  PID:7732
- C:\Windows\System\uUqLwKx.exe
  C:\Windows\System\uUqLwKx.exe
  2⤵
  PID:7656
- C:\Windows\System\vlMyYWh.exe
  C:\Windows\System\vlMyYWh.exe
  2⤵
  PID:8060
- C:\Windows\System\VUntVko.exe
  C:\Windows\System\VUntVko.exe
  2⤵
  PID:7544
- C:\Windows\System\iqAJHga.exe
  C:\Windows\System\iqAJHga.exe
  2⤵
  PID:7960
- C:\Windows\System\UNCglvF.exe
  C:\Windows\System\UNCglvF.exe
  2⤵
  PID:8112
- C:\Windows\System\SJEAICe.exe
  C:\Windows\System\SJEAICe.exe
  2⤵
  PID:7444
- C:\Windows\System\jOTDmXQ.exe
  C:\Windows\System\jOTDmXQ.exe
  2⤵
  PID:7424
- C:\Windows\System\MCLXQuh.exe
  C:\Windows\System\MCLXQuh.exe
  2⤵
  PID:7828
- C:\Windows\System\xJJfPds.exe
  C:\Windows\System\xJJfPds.exe
  2⤵
  PID:7884
- C:\Windows\System\eSoTUOf.exe
  C:\Windows\System\eSoTUOf.exe
  2⤵
  PID:7472
- C:\Windows\System\HssFHkm.exe
  C:\Windows\System\HssFHkm.exe
  2⤵
  PID:7712
- C:\Windows\System\ZSiCmKD.exe
  C:\Windows\System\ZSiCmKD.exe
  2⤵
  PID:7944
- C:\Windows\System\aKjvshT.exe
  C:\Windows\System\aKjvshT.exe
  2⤵
  PID:8200
- C:\Windows\System\mEDpHQj.exe
  C:\Windows\System\mEDpHQj.exe
  2⤵
  PID:8216
- C:\Windows\System\eQGzFPH.exe
  C:\Windows\System\eQGzFPH.exe
  2⤵
  PID:8232
- C:\Windows\System\eAmtQnL.exe
  C:\Windows\System\eAmtQnL.exe
  2⤵
  PID:8248
- C:\Windows\System\GmFxIBe.exe
  C:\Windows\System\GmFxIBe.exe
  2⤵
  PID:8264
- C:\Windows\System\XvfAOKv.exe
  C:\Windows\System\XvfAOKv.exe
  2⤵
  PID:8280
- C:\Windows\System\Olzmesj.exe
  C:\Windows\System\Olzmesj.exe
  2⤵
  PID:8296
- C:\Windows\System\VIhkMRD.exe
  C:\Windows\System\VIhkMRD.exe
  2⤵
  PID:8312
- C:\Windows\System\UxMkppC.exe
  C:\Windows\System\UxMkppC.exe
  2⤵
  PID:8328
- C:\Windows\System\zuisAKj.exe
  C:\Windows\System\zuisAKj.exe
  2⤵
  PID:8344
- C:\Windows\System\TBZuaeq.exe
  C:\Windows\System\TBZuaeq.exe
  2⤵
  PID:8360
- C:\Windows\System\vMRLswr.exe
  C:\Windows\System\vMRLswr.exe
  2⤵
  PID:8376
- C:\Windows\System\kkGMBFY.exe
  C:\Windows\System\kkGMBFY.exe
  2⤵
  PID:8392
- C:\Windows\System\xeZvlcF.exe
  C:\Windows\System\xeZvlcF.exe
  2⤵
  PID:8408
- C:\Windows\System\fiABAxF.exe
  C:\Windows\System\fiABAxF.exe
  2⤵
  PID:8424
- C:\Windows\System\zJbTXWu.exe
  C:\Windows\System\zJbTXWu.exe
  2⤵
  PID:8440
- C:\Windows\System\asTjwqY.exe
  C:\Windows\System\asTjwqY.exe
  2⤵
  PID:8456
- C:\Windows\System\QCGMQgx.exe
  C:\Windows\System\QCGMQgx.exe
  2⤵
  PID:8472
- C:\Windows\System\yrHekcW.exe
  C:\Windows\System\yrHekcW.exe
  2⤵
  PID:8488
- C:\Windows\System\CTGvwaQ.exe
  C:\Windows\System\CTGvwaQ.exe
  2⤵
  PID:8504
- C:\Windows\System\WqsnEDQ.exe
  C:\Windows\System\WqsnEDQ.exe
  2⤵
  PID:8520
- C:\Windows\System\aqkNELA.exe
  C:\Windows\System\aqkNELA.exe
  2⤵
  PID:8536
- C:\Windows\System\JVNaFrU.exe
  C:\Windows\System\JVNaFrU.exe
  2⤵
  PID:8552
- C:\Windows\System\CIbfLCJ.exe
  C:\Windows\System\CIbfLCJ.exe
  2⤵
  PID:8568
- C:\Windows\System\bCSsaPK.exe
  C:\Windows\System\bCSsaPK.exe
  2⤵
  PID:8584
- C:\Windows\System\vdtUoFc.exe
  C:\Windows\System\vdtUoFc.exe
  2⤵
  PID:8600
- C:\Windows\System\aXRZdMQ.exe
  C:\Windows\System\aXRZdMQ.exe
  2⤵
  PID:8616
- C:\Windows\System\ufKMrfA.exe
  C:\Windows\System\ufKMrfA.exe
  2⤵
  PID:8632
- C:\Windows\System\kYmtEvg.exe
  C:\Windows\System\kYmtEvg.exe
  2⤵
  PID:8648
- C:\Windows\System\qEkhENv.exe
  C:\Windows\System\qEkhENv.exe
  2⤵
  PID:8664
- C:\Windows\System\geKFUPJ.exe
  C:\Windows\System\geKFUPJ.exe
  2⤵
  PID:8680
- C:\Windows\System\GPbBRSC.exe
  C:\Windows\System\GPbBRSC.exe
  2⤵
  PID:8696
- C:\Windows\System\vGaIzKL.exe
  C:\Windows\System\vGaIzKL.exe
  2⤵
  PID:8712
- C:\Windows\System\kkLxeun.exe
  C:\Windows\System\kkLxeun.exe
  2⤵
  PID:8728
- C:\Windows\System\dsLJqpW.exe
  C:\Windows\System\dsLJqpW.exe
  2⤵
  PID:8744
- C:\Windows\System\GAypGlX.exe
  C:\Windows\System\GAypGlX.exe
  2⤵
  PID:8760
- C:\Windows\System\WebCTfS.exe
  C:\Windows\System\WebCTfS.exe
  2⤵
  PID:8776
- C:\Windows\System\EMNklql.exe
  C:\Windows\System\EMNklql.exe
  2⤵
  PID:8792
- C:\Windows\System\RbmOzWu.exe
  C:\Windows\System\RbmOzWu.exe
  2⤵
  PID:8808
- C:\Windows\System\msdHBAE.exe
  C:\Windows\System\msdHBAE.exe
  2⤵
  PID:8824
- C:\Windows\System\HTFflOK.exe
  C:\Windows\System\HTFflOK.exe
  2⤵
  PID:8840
- C:\Windows\System\jCAKzOw.exe
  C:\Windows\System\jCAKzOw.exe
  2⤵
  PID:8856
- C:\Windows\System\JTzzWHq.exe
  C:\Windows\System\JTzzWHq.exe
  2⤵
  PID:8876
- C:\Windows\System\GIWtAoe.exe
  C:\Windows\System\GIWtAoe.exe
  2⤵
  PID:8892
- C:\Windows\System\lyXwnkW.exe
  C:\Windows\System\lyXwnkW.exe
  2⤵
  PID:8908
- C:\Windows\System\jHYkORd.exe
  C:\Windows\System\jHYkORd.exe
  2⤵
  PID:8924
- C:\Windows\System\KvDbnFz.exe
  C:\Windows\System\KvDbnFz.exe
  2⤵
  PID:8940
- C:\Windows\System\yZsRnEE.exe
  C:\Windows\System\yZsRnEE.exe
  2⤵
  PID:8956
- C:\Windows\System\YwawqIm.exe
  C:\Windows\System\YwawqIm.exe
  2⤵
  PID:8972
- C:\Windows\System\IODrvIr.exe
  C:\Windows\System\IODrvIr.exe
  2⤵
  PID:8988
- C:\Windows\System\xdyrpOw.exe
  C:\Windows\System\xdyrpOw.exe
  2⤵
  PID:9004
- C:\Windows\System\lfxMMGQ.exe
  C:\Windows\System\lfxMMGQ.exe
  2⤵
  PID:9020
- C:\Windows\System\KTFZaNA.exe
  C:\Windows\System\KTFZaNA.exe
  2⤵
  PID:9036
- C:\Windows\System\FdRfxLP.exe
  C:\Windows\System\FdRfxLP.exe
  2⤵
  PID:9052
- C:\Windows\System\MAyGZpS.exe
  C:\Windows\System\MAyGZpS.exe
  2⤵
  PID:9068
- C:\Windows\System\YJDKYIz.exe
  C:\Windows\System\YJDKYIz.exe
  2⤵
  PID:9084
- C:\Windows\System\WlAslvP.exe
  C:\Windows\System\WlAslvP.exe
  2⤵
  PID:9100
- C:\Windows\System\PuSVVAx.exe
  C:\Windows\System\PuSVVAx.exe
  2⤵
  PID:9116
- C:\Windows\System\DHnpUil.exe
  C:\Windows\System\DHnpUil.exe
  2⤵
  PID:9132
- C:\Windows\System\JvFDqUB.exe
  C:\Windows\System\JvFDqUB.exe
  2⤵
  PID:9148
- C:\Windows\System\qPjpexf.exe
  C:\Windows\System\qPjpexf.exe
  2⤵
  PID:9164
- C:\Windows\System\PuGebUE.exe
  C:\Windows\System\PuGebUE.exe
  2⤵
  PID:9180
- C:\Windows\System\TogeLGf.exe
  C:\Windows\System\TogeLGf.exe
  2⤵
  PID:9196
- C:\Windows\System\VnQBsmw.exe
  C:\Windows\System\VnQBsmw.exe
  2⤵
  PID:9212
- C:\Windows\System\UEZkLJn.exe
  C:\Windows\System\UEZkLJn.exe
  2⤵
  PID:8196
- C:\Windows\System\yNyjDNn.exe
  C:\Windows\System\yNyjDNn.exe
  2⤵
  PID:7776
- C:\Windows\System\ZFYDhkw.exe
  C:\Windows\System\ZFYDhkw.exe
  2⤵
  PID:8256
- C:\Windows\System\LjoOyWk.exe
  C:\Windows\System\LjoOyWk.exe
  2⤵
  PID:8288
- C:\Windows\System\IAVALYN.exe
  C:\Windows\System\IAVALYN.exe
  2⤵
  PID:8336
- C:\Windows\System\myauJPO.exe
  C:\Windows\System\myauJPO.exe
  2⤵
  PID:8324
- C:\Windows\System\kFvwnlN.exe
  C:\Windows\System\kFvwnlN.exe
  2⤵
  PID:8400
- C:\Windows\System\tqMtmMv.exe
  C:\Windows\System\tqMtmMv.exe
  2⤵
  PID:8388
- C:\Windows\System\JvzYycs.exe
  C:\Windows\System\JvzYycs.exe
  2⤵
  PID:8496
- C:\Windows\System\TzqWwBa.exe
  C:\Windows\System\TzqWwBa.exe
  2⤵
  PID:8416
- C:\Windows\System\lLeycHS.exe
  C:\Windows\System\lLeycHS.exe
  2⤵
  PID:8592
- C:\Windows\System\gLBrVCU.exe
  C:\Windows\System\gLBrVCU.exe
  2⤵
  PID:8484
- C:\Windows\System\HFciYEe.exe
  C:\Windows\System\HFciYEe.exe
  2⤵
  PID:8512
- C:\Windows\System\ktPsfnY.exe
  C:\Windows\System\ktPsfnY.exe
  2⤵
  PID:8628
- C:\Windows\System\CWqgmQS.exe
  C:\Windows\System\CWqgmQS.exe
  2⤵
  PID:8660
- C:\Windows\System\lPoFZPS.exe
  C:\Windows\System\lPoFZPS.exe
  2⤵
  PID:8724
- C:\Windows\System\HLhysre.exe
  C:\Windows\System\HLhysre.exe
  2⤵
  PID:8788
- C:\Windows\System\JdkFzbA.exe
  C:\Windows\System\JdkFzbA.exe
  2⤵
  PID:8672
- C:\Windows\System\tezBBPS.exe
  C:\Windows\System\tezBBPS.exe
  2⤵
  PID:8608
- C:\Windows\System\exlTgfM.exe
  C:\Windows\System\exlTgfM.exe
  2⤵
  PID:8820
- C:\Windows\System\pursPMc.exe
  C:\Windows\System\pursPMc.exe
  2⤵
  PID:8836
- C:\Windows\System\XjPJsOa.exe
  C:\Windows\System\XjPJsOa.exe
  2⤵
  PID:8804
- C:\Windows\System\MWoLGib.exe
  C:\Windows\System\MWoLGib.exe
  2⤵
  PID:8888
- C:\Windows\System\iGMebCJ.exe
  C:\Windows\System\iGMebCJ.exe
  2⤵
  PID:8904
- C:\Windows\System\FwARmzC.exe
  C:\Windows\System\FwARmzC.exe
  2⤵
  PID:8952
- C:\Windows\System\hRgHgfW.exe
  C:\Windows\System\hRgHgfW.exe
  2⤵
  PID:9016
- C:\Windows\System\hUsSPlt.exe
  C:\Windows\System\hUsSPlt.exe
  2⤵
  PID:9028
- C:\Windows\System\BQDHEWA.exe
  C:\Windows\System\BQDHEWA.exe
  2⤵
  PID:9048
- C:\Windows\System\fpZRmDm.exe
  C:\Windows\System\fpZRmDm.exe
  2⤵
  PID:9064
- C:\Windows\System\YmrtpXW.exe
  C:\Windows\System\YmrtpXW.exe
  2⤵
  PID:9144
- C:\Windows\System\clEgTdV.exe
  C:\Windows\System\clEgTdV.exe
  2⤵
  PID:9128
- C:\Windows\System\ulptwAt.exe
  C:\Windows\System\ulptwAt.exe
  2⤵
  PID:9156
- C:\Windows\System\UIaHVDS.exe
  C:\Windows\System\UIaHVDS.exe
  2⤵
  PID:9208
- C:\Windows\System\EnSgTVZ.exe
  C:\Windows\System\EnSgTVZ.exe
  2⤵
  PID:8272
- C:\Windows\System\YvmCshw.exe
  C:\Windows\System\YvmCshw.exe
  2⤵
  PID:8024
- C:\Windows\System\YyhrVnK.exe
  C:\Windows\System\YyhrVnK.exe
  2⤵
  PID:8224
- C:\Windows\System\sWfZPci.exe
  C:\Windows\System\sWfZPci.exe
  2⤵
  PID:8372
- C:\Windows\System\ZUvZAYY.exe
  C:\Windows\System\ZUvZAYY.exe
  2⤵
  PID:8532
- C:\Windows\System\fQaYGVh.exe
  C:\Windows\System\fQaYGVh.exe
  2⤵
  PID:8548
- C:\Windows\System\sxiCVvD.exe
  C:\Windows\System\sxiCVvD.exe
  2⤵
  PID:8624
- C:\Windows\System\cIyfLQC.exe
  C:\Windows\System\cIyfLQC.exe
  2⤵
  PID:8580
- C:\Windows\System\xfSGJCC.exe
  C:\Windows\System\xfSGJCC.exe
  2⤵
  PID:8740
- C:\Windows\System\dBeSYiq.exe
  C:\Windows\System\dBeSYiq.exe
  2⤵
  PID:8704
- C:\Windows\System\BhWMwmf.exe
  C:\Windows\System\BhWMwmf.exe
  2⤵
  PID:8800
- C:\Windows\System\WGXrZDT.exe
  C:\Windows\System\WGXrZDT.exe
  2⤵
  PID:8920
- C:\Windows\System\upHyabG.exe
  C:\Windows\System\upHyabG.exe
  2⤵
  PID:8948
- C:\Windows\System\LjQEsFL.exe
  C:\Windows\System\LjQEsFL.exe
  2⤵
  PID:8968
- C:\Windows\System\nxKzVYU.exe
  C:\Windows\System\nxKzVYU.exe
  2⤵
  PID:8228
- C:\Windows\System\DfHNNfY.exe
  C:\Windows\System\DfHNNfY.exe
  2⤵
  PID:8464
- C:\Windows\System\wzhUUZr.exe
  C:\Windows\System\wzhUUZr.exe
  2⤵
  PID:1524
- C:\Windows\System\QOufxJi.exe
  C:\Windows\System\QOufxJi.exe
  2⤵
  PID:8768
- C:\Windows\System\ageFkif.exe
  C:\Windows\System\ageFkif.exe
  2⤵
  PID:9044
- C:\Windows\System\slvOVox.exe
  C:\Windows\System\slvOVox.exe
  2⤵
  PID:8368
- C:\Windows\System\MGvGpHZ.exe
  C:\Windows\System\MGvGpHZ.exe
  2⤵
  PID:8292
- C:\Windows\System\KrFjiez.exe
  C:\Windows\System\KrFjiez.exe
  2⤵
  PID:8720
- C:\Windows\System\OvCTyQu.exe
  C:\Windows\System\OvCTyQu.exe
  2⤵
  PID:8212
- C:\Windows\System\krQyrmd.exe
  C:\Windows\System\krQyrmd.exe
  2⤵
  PID:9112
- C:\Windows\System\StgmUiO.exe
  C:\Windows\System\StgmUiO.exe
  2⤵
  PID:9096
- C:\Windows\System\QdVYZEn.exe
  C:\Windows\System\QdVYZEn.exe
  2⤵
  PID:8736
- C:\Windows\System\zwJIuUB.exe
  C:\Windows\System\zwJIuUB.exe
  2⤵
  PID:9192
- C:\Windows\System\mkEWuCM.exe
  C:\Windows\System\mkEWuCM.exe
  2⤵
  PID:8612
- C:\Windows\System\puDvZhR.exe
  C:\Windows\System\puDvZhR.exe
  2⤵
  PID:8884
- C:\Windows\System\xaQfMZD.exe
  C:\Windows\System\xaQfMZD.exe
  2⤵
  PID:9172
- C:\Windows\System\RODEHqw.exe
  C:\Windows\System\RODEHqw.exe
  2⤵
  PID:8576
- C:\Windows\System\wThdlYm.exe
  C:\Windows\System\wThdlYm.exe
  2⤵
  PID:9220
- C:\Windows\System\iyVKtPb.exe
  C:\Windows\System\iyVKtPb.exe
  2⤵
  PID:9236
- C:\Windows\System\xCcIIUs.exe
  C:\Windows\System\xCcIIUs.exe
  2⤵
  PID:9252
- C:\Windows\System\ZUkMKnd.exe
  C:\Windows\System\ZUkMKnd.exe
  2⤵
  PID:9268
- C:\Windows\System\dOsesrK.exe
  C:\Windows\System\dOsesrK.exe
  2⤵
  PID:9284
- C:\Windows\System\VOLdfWZ.exe
  C:\Windows\System\VOLdfWZ.exe
  2⤵
  PID:9300
- C:\Windows\System\NojJGmR.exe
  C:\Windows\System\NojJGmR.exe
  2⤵
  PID:9316
- C:\Windows\System\IGYCgEJ.exe
  C:\Windows\System\IGYCgEJ.exe
  2⤵
  PID:9332
- C:\Windows\System\nvFdeKG.exe
  C:\Windows\System\nvFdeKG.exe
  2⤵
  PID:9348
- C:\Windows\System\ffWddoM.exe
  C:\Windows\System\ffWddoM.exe
  2⤵
  PID:9364
- C:\Windows\System\VaEISnL.exe
  C:\Windows\System\VaEISnL.exe
  2⤵
  PID:9384
- C:\Windows\System\aowFcFp.exe
  C:\Windows\System\aowFcFp.exe
  2⤵
  PID:9400
- C:\Windows\System\RgFLFoe.exe
  C:\Windows\System\RgFLFoe.exe
  2⤵
  PID:9416
- C:\Windows\System\HNLiRBr.exe
  C:\Windows\System\HNLiRBr.exe
  2⤵
  PID:9432
- C:\Windows\System\oxsTdsC.exe
  C:\Windows\System\oxsTdsC.exe
  2⤵
  PID:9448
- C:\Windows\System\NgZrMeP.exe
  C:\Windows\System\NgZrMeP.exe
  2⤵
  PID:9464
- C:\Windows\System\VXVSbkN.exe
  C:\Windows\System\VXVSbkN.exe
  2⤵
  PID:9480
- C:\Windows\System\dfinYHU.exe
  C:\Windows\System\dfinYHU.exe
  2⤵
  PID:9496
- C:\Windows\System\cpgiLCT.exe
  C:\Windows\System\cpgiLCT.exe
  2⤵
  PID:9512
- C:\Windows\System\UrPqavN.exe
  C:\Windows\System\UrPqavN.exe
  2⤵
  PID:9528
- C:\Windows\System\XZaSuuT.exe
  C:\Windows\System\XZaSuuT.exe
  2⤵
  PID:9544
- C:\Windows\System\NwFHXaE.exe
  C:\Windows\System\NwFHXaE.exe
  2⤵
  PID:9560
- C:\Windows\System\WvDjgZx.exe
  C:\Windows\System\WvDjgZx.exe
  2⤵
  PID:9576
- C:\Windows\System\RrVJrKb.exe
  C:\Windows\System\RrVJrKb.exe
  2⤵
  PID:9592
- C:\Windows\System\ckljmNy.exe
  C:\Windows\System\ckljmNy.exe
  2⤵
  PID:9608
- C:\Windows\System\GgYKFai.exe
  C:\Windows\System\GgYKFai.exe
  2⤵
  PID:9624
- C:\Windows\System\BSRcwcT.exe
  C:\Windows\System\BSRcwcT.exe
  2⤵
  PID:9640
- C:\Windows\System\BFXbUDE.exe
  C:\Windows\System\BFXbUDE.exe
  2⤵
  PID:9656
- C:\Windows\System\NVJksEu.exe
  C:\Windows\System\NVJksEu.exe
  2⤵
  PID:9672
- C:\Windows\System\TINuEXm.exe
  C:\Windows\System\TINuEXm.exe
  2⤵
  PID:9688
- C:\Windows\System\kTumeMM.exe
  C:\Windows\System\kTumeMM.exe
  2⤵
  PID:9704
- C:\Windows\System\hCUfETy.exe
  C:\Windows\System\hCUfETy.exe
  2⤵
  PID:9720
- C:\Windows\System\PLZPPHq.exe
  C:\Windows\System\PLZPPHq.exe
  2⤵
  PID:9736
- C:\Windows\System\DJdSFdN.exe
  C:\Windows\System\DJdSFdN.exe
  2⤵
  PID:9752
- C:\Windows\System\tafslQn.exe
  C:\Windows\System\tafslQn.exe
  2⤵
  PID:9768
- C:\Windows\System\WkaGfvJ.exe
  C:\Windows\System\WkaGfvJ.exe
  2⤵
  PID:9784
- C:\Windows\System\pUSLBWY.exe
  C:\Windows\System\pUSLBWY.exe
  2⤵
  PID:9800
- C:\Windows\System\zoXniUn.exe
  C:\Windows\System\zoXniUn.exe
  2⤵
  PID:9816
- C:\Windows\System\PUORFke.exe
  C:\Windows\System\PUORFke.exe
  2⤵
  PID:9832
- C:\Windows\System\VtYFyzQ.exe
  C:\Windows\System\VtYFyzQ.exe
  2⤵
  PID:9848
- C:\Windows\System\LagxlJK.exe
  C:\Windows\System\LagxlJK.exe
  2⤵
  PID:9864
- C:\Windows\System\amEXwVT.exe
  C:\Windows\System\amEXwVT.exe
  2⤵
  PID:9880
- C:\Windows\System\kdkamXT.exe
  C:\Windows\System\kdkamXT.exe
  2⤵
  PID:9896
- C:\Windows\System\iWkwzHc.exe
  C:\Windows\System\iWkwzHc.exe
  2⤵
  PID:9912
- C:\Windows\System\BseyEfW.exe
  C:\Windows\System\BseyEfW.exe
  2⤵
  PID:9932
- C:\Windows\System\azwZpIX.exe
  C:\Windows\System\azwZpIX.exe
  2⤵
  PID:9948
- C:\Windows\System\nVgtWle.exe
  C:\Windows\System\nVgtWle.exe
  2⤵
  PID:9964
- C:\Windows\System\TzLBApS.exe
  C:\Windows\System\TzLBApS.exe
  2⤵
  PID:9980
- C:\Windows\System\HrDgYhT.exe
  C:\Windows\System\HrDgYhT.exe
  2⤵
  PID:10000
- C:\Windows\System\QufZNgo.exe
  C:\Windows\System\QufZNgo.exe
  2⤵
  PID:10016
- C:\Windows\System\YQBVrqx.exe
  C:\Windows\System\YQBVrqx.exe
  2⤵
  PID:10032
- C:\Windows\System\sUQAMBu.exe
  C:\Windows\System\sUQAMBu.exe
  2⤵
  PID:10048
- C:\Windows\System\yhizOwR.exe
  C:\Windows\System\yhizOwR.exe
  2⤵
  PID:10064
- C:\Windows\System\FfsHbdX.exe
  C:\Windows\System\FfsHbdX.exe
  2⤵
  PID:10080
- C:\Windows\System\vpEDhPi.exe
  C:\Windows\System\vpEDhPi.exe
  2⤵
  PID:10096
- C:\Windows\System\DbRcFpg.exe
  C:\Windows\System\DbRcFpg.exe
  2⤵
  PID:10112
- C:\Windows\System\gwaxIAw.exe
  C:\Windows\System\gwaxIAw.exe
  2⤵
  PID:10128
- C:\Windows\System\RfeKAqy.exe
  C:\Windows\System\RfeKAqy.exe
  2⤵
  PID:10144
- C:\Windows\System\iMhpSZg.exe
  C:\Windows\System\iMhpSZg.exe
  2⤵
  PID:10160
- C:\Windows\System\FuIrKjJ.exe
  C:\Windows\System\FuIrKjJ.exe
  2⤵
  PID:10176
- C:\Windows\System\qnKeoLs.exe
  C:\Windows\System\qnKeoLs.exe
  2⤵
  PID:10192
- C:\Windows\System\tSGCqBD.exe
  C:\Windows\System\tSGCqBD.exe
  2⤵
  PID:10208
- C:\Windows\System\ykNDmQg.exe
  C:\Windows\System\ykNDmQg.exe
  2⤵
  PID:10224
- C:\Windows\System\gwtDQLu.exe
  C:\Windows\System\gwtDQLu.exe
  2⤵
  PID:9228
- C:\Windows\System\VOHJzhm.exe
  C:\Windows\System\VOHJzhm.exe
  2⤵
  PID:9264
- C:\Windows\System\QFnMQhs.exe
  C:\Windows\System\QFnMQhs.exe
  2⤵
  PID:9140
- C:\Windows\System\DYfTiSJ.exe
  C:\Windows\System\DYfTiSJ.exe
  2⤵
  PID:9276
- C:\Windows\System\UMKBCjK.exe
  C:\Windows\System\UMKBCjK.exe
  2⤵
  PID:9360
- C:\Windows\System\qOEQuTN.exe
  C:\Windows\System\qOEQuTN.exe
  2⤵
  PID:9344
- C:\Windows\System\eeWGpEQ.exe
  C:\Windows\System\eeWGpEQ.exe
  2⤵
  PID:9408
- C:\Windows\System\ddbzOnn.exe
  C:\Windows\System\ddbzOnn.exe
  2⤵
  PID:9440
- C:\Windows\System\jVTKXkQ.exe
  C:\Windows\System\jVTKXkQ.exe
  2⤵
  PID:9492
- C:\Windows\System\WPcMJWJ.exe
  C:\Windows\System\WPcMJWJ.exe
  2⤵
  PID:9556
- C:\Windows\System\tqqzftP.exe
  C:\Windows\System\tqqzftP.exe
  2⤵
  PID:9472
- C:\Windows\System\dVJkHNz.exe
  C:\Windows\System\dVJkHNz.exe
  2⤵
  PID:9604
- C:\Windows\System\lVSUPgu.exe
  C:\Windows\System\lVSUPgu.exe
  2⤵
  PID:9568
- C:\Windows\System\KqHPzdw.exe
  C:\Windows\System\KqHPzdw.exe
  2⤵
  PID:9648
- C:\Windows\System\gqRKFhT.exe
  C:\Windows\System\gqRKFhT.exe
  2⤵
  PID:9636
- C:\Windows\System\ujLWVZA.exe
  C:\Windows\System\ujLWVZA.exe
  2⤵
  PID:9712
- C:\Windows\System\ZQndbdK.exe
  C:\Windows\System\ZQndbdK.exe
  2⤵
  PID:9716
- C:\Windows\System\sbgkBTX.exe
  C:\Windows\System\sbgkBTX.exe
  2⤵
  PID:9748
- C:\Windows\System\occXaAX.exe
  C:\Windows\System\occXaAX.exe
  2⤵
  PID:9812
- C:\Windows\System\JpQAXGM.exe
  C:\Windows\System\JpQAXGM.exe
  2⤵
  PID:9876
- C:\Windows\System\qaaNvue.exe
  C:\Windows\System\qaaNvue.exe
  2⤵
  PID:9924
- C:\Windows\System\IGxeYEf.exe
  C:\Windows\System\IGxeYEf.exe
  2⤵
  PID:9824
- C:\Windows\System\UhkyCGi.exe
  C:\Windows\System\UhkyCGi.exe
  2⤵
  PID:9760
- C:\Windows\System\bNOTjRd.exe
  C:\Windows\System\bNOTjRd.exe
  2⤵
  PID:9888
- C:\Windows\System\fzTDFYQ.exe
  C:\Windows\System\fzTDFYQ.exe
  2⤵
  PID:9976
- C:\Windows\System\lIlUxeS.exe
  C:\Windows\System\lIlUxeS.exe
  2⤵
  PID:10044
- C:\Windows\System\vytMflY.exe
  C:\Windows\System\vytMflY.exe
  2⤵
  PID:10108
- C:\Windows\System\hBUYXWc.exe
  C:\Windows\System\hBUYXWc.exe
  2⤵
  PID:10172
- C:\Windows\System\rgAQovQ.exe
  C:\Windows\System\rgAQovQ.exe
  2⤵
  PID:10028
- C:\Windows\System\iYMScil.exe
  C:\Windows\System\iYMScil.exe
  2⤵
  PID:10204
- C:\Windows\System\HXZCSGV.exe
  C:\Windows\System\HXZCSGV.exe
  2⤵
  PID:10124
- C:\Windows\System\LgcxfMk.exe
  C:\Windows\System\LgcxfMk.exe
  2⤵
  PID:9296
- C:\Windows\System\EhjCByh.exe
  C:\Windows\System\EhjCByh.exe
  2⤵
  PID:10120
- C:\Windows\System\OTaJcCy.exe
  C:\Windows\System\OTaJcCy.exe
  2⤵
  PID:10220
- C:\Windows\System\hugDgSH.exe
  C:\Windows\System\hugDgSH.exe
  2⤵
  PID:9356
- C:\Windows\System\zCOYBGW.exe
  C:\Windows\System\zCOYBGW.exe
  2⤵
  PID:9372
- C:\Windows\System\mXhbAyo.exe
  C:\Windows\System\mXhbAyo.exe
  2⤵
  PID:9488
- C:\Windows\System\lJqNrUU.exe
  C:\Windows\System\lJqNrUU.exe
  2⤵
  PID:9540
- C:\Windows\System\CtJjbcS.exe
  C:\Windows\System\CtJjbcS.exe
  2⤵
  PID:9424
- C:\Windows\System\LXGyioZ.exe
  C:\Windows\System\LXGyioZ.exe
  2⤵
  PID:9600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BPJrUZw.exe

Filesize
2.0MB

MD5
d83fbd644dac2dab28a005bebd76963a

SHA1
8a9808bbbab9a740f50cfd0e91230a9f7a07c490

SHA256
6e3e67f33f72284874d935e5d3059548739650691a42889789f178b88a14a076

SHA512
71309f662bf38e449350f30cc500454202dc4d65779afb3de3c799d544eabe393d3e34f20c97c003cf08bda1cd7d7ae602937735ad298fb7fb34e5e2c04aabbb

Download Submit
C:\Windows\system\DFnJlFq.exe

Filesize
2.0MB

MD5
bf92db41116f2e84f6ba1cf4eee9c882

SHA1
bfd04cb45c503449ff2e7c6396b8f24272b2a2b6

SHA256
6c21e4994c4f3ab89877d255d5a79bd7b2bda529a9c486129ef07a95ccb35048

SHA512
db78f5cf63d5ff20604dc8201d6830f826c39dba995d7d01ac3eb8aea591d73c2acbf1f5ad0b9d2659b511b829296e82983a6d77515e5ca425e8364baa6d9024

Download Submit
C:\Windows\system\DMDxxLv.exe

Filesize
2.0MB

MD5
286bfe75c2b9c898841e31a3907dceda

SHA1
f48e347c9daee35a698f90014c9b986f73e638c9

SHA256
2d594c74c4309b01905f7faaa47e014ffe49e4eb8c35c00d78cd63a11fd21032

SHA512
87310c6d112335c82b1146faf12f35082eb0e15f47f025bda84bed4c8e24b948f43c11fba765d8073cde7d35932668f92bbae0245a55d5d42170e43305fab445

Download Submit
C:\Windows\system\EObLMyc.exe

Filesize
8B

MD5
89b49edfc15b320118dccc63dce276c0

SHA1
d6a182f9e8a009d8ebfef26a1c685fcf2b4f152a

SHA256
b80b4d5110187afa9e6d1cf3e2b0f3429a153e9d0c88c32cabdb6359e19204f1

SHA512
7177d9a15db58801e4f8b1c7970b405645f764452ade86d38cac06f6967fac62b12ef486104093e1892a28c57d2dd25b2fe393363d54d8f0cf2bd6688982c9c6

Download Submit
C:\Windows\system\GvZVOjR.exe

Filesize
2.0MB

MD5
3236c742f026ca68fd5d543f4766a26d

SHA1
84f3e4e053902bf4c534f3b3458e8111b9299dfb

SHA256
879e03c02a4cb75b16aebf623a1115e5c876fc528a3f8e82cab0455577be775c

SHA512
e5f432dd1020a613a9a7c6d852553650037ace122e863510f067f508abe2ad54d90e6b12ce1fca1a7433974f4931c98d3864e0c8d3899d4682b3b570756c63d6

Download Submit
C:\Windows\system\HWXQwJj.exe

Filesize
2.0MB

MD5
6ee9811975b0ccbdd903383fae3c2f9b

SHA1
cf59bfa93fe2722d9496ba7817254cc4f6e7f081

SHA256
5ee0b04d16ae2b814dbb5f0ead868839b3c24a9d04827237582051287cb66087

SHA512
bb6008fc07cd3b63c015189160e521e8278e3d27df8619298ee8c8218302285bc65204aac82f55d38db131f0b6954f77bdb920f447345a26cb88060990d1a2c1

Download Submit
C:\Windows\system\NGtxWop.exe

Filesize
2.0MB

MD5
db22f8e4f89eab14471b0e0a793d51ba

SHA1
4f557b61cf82c635c227049e9088610834f02304

SHA256
a03a618f9c4876737c4b2307047131e0d0b493abff839974f17087168b11aedd

SHA512
499616bba83cdb2755d8c3e4b1f5f48a2bd4e1e8f9ab5284d1a61648dedfe8d059532ee37a8be38908e5a3cafe466033c8fe470a5f92d7bdc7eeafe5de398edb

Download Submit
C:\Windows\system\OxpvBEO.exe

Filesize
2.0MB

MD5
dee5bfbd39f529f10e3096d69fab40de

SHA1
4fb3cce89ad1da3206796c1d35e69fe1a2aa79de

SHA256
a5d633c79df89ef99385700f9622e1bcbe8964bbaaadceb2ee478b262f3b7106

SHA512
a2ca4d172c493da0a104bbeaffe781d07fcb6cc5f28f07f33ef2dc9f09d1e62415cf8e9892922c204f149ba8692d43f146e05d9d4a9e5021419475237ba1e111

Download Submit
C:\Windows\system\QxacDgq.exe

Filesize
2.0MB

MD5
5ccfc422bb610cc50cb0744856cf3fb0

SHA1
f2818f3344a4f04abc09c8de85b299e4b85b0ee9

SHA256
f00cd419002bead7c610b8a2c8224eb2f324bc2a96728df12e2380cc787c16b0

SHA512
cc4d5080398422bce6baea9f7c972d96fc3112b4c26ce2f776f549e54077fbf0ee93e789fd499d2b8b9c43f8193fa11a7d984c0d668d8f37a33641e27bcb54f4

Download Submit
C:\Windows\system\RgagOqz.exe

Filesize
2.0MB

MD5
bc185af38cf2b5408f627b496b5ae315

SHA1
5dc77f46f05822cd6419b6477811f8806225c32e

SHA256
7bb2dfc1a1c113c227ca0564a4f4d821b0da99fd6df8b811ab1652d7d1dbbc1e

SHA512
704a5f78a52af42da221a30219c2dd71df9c87fe649cf3e9f8ef88fe91b2cbed82ef6612995104d61cbe2b68074f276219d91015c309a8fb7fb378332ee16c11

Download Submit
C:\Windows\system\RiXYiPZ.exe

Filesize
2.0MB

MD5
aa05fbe8196e176895990228ee809722

SHA1
8933d41d360e4ff30fed464cd05c8ab6cfcbfa25

SHA256
7139fe59716426f2f0c2c4f029653851102924ea46ecacabb6aa6bf913742cf7

SHA512
7ee2cf61efc3669438b341f384919f30baa577c36579561470f8f1162c8f38993d8e6db45e7584dce235788aaad0d596f059dcf7346014ac9451e0cb65d5e5ba

Download Submit
C:\Windows\system\TlPeuko.exe

Filesize
2.0MB

MD5
5902b7cc0c81d63be1ef82f6f44cfa4b

SHA1
289870cedcbf2d8a4b912ec28e6bfb6fda82220f

SHA256
8e8beb228fde5a545024ca42b403edd899b7310059b33df5a803d68be69170d6

SHA512
ad1cbb50925f9bc9c6b82b41b70d538dfa798d77995cfbd21746d5e654d6d212815ca5094897e9f5907d3822ce03fd6595be9c04b8b40b8508f792cd71347daf

Download Submit
C:\Windows\system\WmqvtBp.exe

Filesize
2.0MB

MD5
15d68f888fd818139cf9a3932cb745d1

SHA1
e573e3f1ba125ba516bbde04fe51062259e9845a

SHA256
f33c3be0e0245f8fd896fcc59c271b0cab684ea51633c8853181f3249672276e

SHA512
7ab7d3dceba384e7dc5411310ad1baabf127116c8eef7d80500f0294a223dc7d5f00d30a7235b4bb891faefbc7c073ef2e646bcb808aff8c035dbf8024d43004

Download Submit
C:\Windows\system\XxFrQKN.exe

Filesize
2.0MB

MD5
4ecb9b05ea87473177bf5d97bfd9b2c4

SHA1
dd6bd868aa51450aa625534bdc6a02a892bbcea9

SHA256
10fc28a7144be2babb002e7a57e18ccc3954a373c64feca99a61324bf19096f8

SHA512
c916c93130cec0c72b32cd96e44e4953835033e8cb9cb2c89629a5c0209f140c63929c8f720c1f8b8199aa8e72e16dde2525b95d464062978103b4983791e169

Download Submit
C:\Windows\system\ZuFHAlb.exe

Filesize
2.0MB

MD5
671e142d856c43687b181d2604e0768a

SHA1
71dcb2aa6cd43ed0129f51bf98c2950643060362

SHA256
ee686f393e6557a06a5c752abb3ffbe81b09906e1e2dafc9e3d05f901484f7a7

SHA512
6ce26e911cbe0a939cf2c7c7e1dc13a0bdcfffe48298d9d761857f454959a9c05e663127f4d0de330d95ecccf94206c9d283cebbe80b987d5959ae1d91f85c30

Download Submit
C:\Windows\system\axyyCQm.exe

Filesize
2.0MB

MD5
3686401bec4b14f7ae131c63bcb9992b

SHA1
27b0c759fc0965185742d25ba34d001a34625dc2

SHA256
3abebc9446601f53331802e578687aab93fde920bc2ee070693767fae6a977c8

SHA512
e1d90df1a0a567f608e740f187113e1cc67e63b21258b1865b71f9af1e3ca7065cd39a2a7fa44d2003eb7c6233808cd4fffa8e1000c2cca5ce4105583e44c69c

Download Submit
C:\Windows\system\koqVuAd.exe

Filesize
2.0MB

MD5
34e85d456a63a92641ee8932a37c15ab

SHA1
9c770e8be9a25e5c224a59a425e428e74142d3b2

SHA256
89098178c8e648e75e1abed01887c7a1c8cf7c2e0dcd7417441f62c33403af7f

SHA512
b5bee3b839ccf2d687f6dbdcce7623a795ea7ffa9508824b4a9e3a945fc412b499860bc6cc379a9e5efdc7a4fd1c2e1c648733fd4109a512fab7a455af3b68fe

Download Submit
C:\Windows\system\nDdAkyw.exe

Filesize
2.0MB

MD5
c48bf952bff7e83d8af8a61521dc6db4

SHA1
4f58e94e51fbca1fbe5df7ec7a27a526c4a0ea2f

SHA256
a4ec3137b91a816066affe4c648a96348b6451a6a8c2a3ee31f4d0b7ca92d617

SHA512
fd51554862fd7446c61f440288cdbdfd34243c630105262272a1f74a1c25f4ba3dd4b9ee97d54df302f468faf02d955fbac4255c46517ee74c1d4a41938c1158

Download Submit
C:\Windows\system\oneNlGW.exe

Filesize
2.0MB

MD5
a2f5e025a2adc928224b8431da0fcb38

SHA1
84b50b5e8930b9eeb75609a19ec461fb77ca3a44

SHA256
4790c4fdcbc595372b9880a775ae7a9224b819c0f78294f0247ef860cc151c69

SHA512
afe706bb6ce7f120ef24d5c2f5551f4bbcd28db3f0c055ee174d9bb864b11ae78f2bf3a11bbdd343a2f77e961cf904ded70fc9e4a6f4cca3ac1b7d4b4a03951c

Download Submit
C:\Windows\system\rFTvELF.exe

Filesize
2.0MB

MD5
c0898e264c5097a94630e123a01b7807

SHA1
8f09d6f102a1de89c792c2308533067abaf0fd62

SHA256
dae79eec325a8677852c6c5781c5b5f44485bcd804f46c3755488ebd005c3491

SHA512
195b890a82fc47ab39116329240927e4ccef1b87f1766079ec5f346dcd0a5ceade6c5eda989c01bd72979eaa290b26a1c837812aa1bb86c26fc76a38d4292c7c

Download Submit
C:\Windows\system\sGJxEWH.exe

Filesize
2.0MB

MD5
daf8447a76511c9949101d3620942154

SHA1
b563413f4619929a6cb957f21a4993c26b57e384

SHA256
eee045d23df1b21933a519d7ef944527c1126ab3e5ceb7e1d3a120971f22fcd6

SHA512
486c755adbd918a39cde92dfaae75fbe77a0fedb4b5810bdc9f1246f63a8158cef45ee6a5d725ff831253e5dc54cd67f43bc5cf6e127dffb1f7d2c119f1e7b07

Download Submit
C:\Windows\system\twdTEJc.exe

Filesize
2.0MB

MD5
f70f4241c0768b5e6303b6119662c022

SHA1
ea2f76085e6c3fc396cabc6c84a7991fd7b591d2

SHA256
e794900b0a01b979a09182d1c7122dd59a8ce187cc47896db9f7df3d45dd61a6

SHA512
c9f503887e318a0ec97e9aee0c71004be88ccad0b726387009b59f7f3e41847ffbe024f95d9c0eef4ac6138404be03a9308b6da37a50aac5e009426e6b4ac821

Download Submit
C:\Windows\system\vnwDxYR.exe

Filesize
2.0MB

MD5
f5430fcb43afd4eba3a61be5252ff389

SHA1
a98c92ee00ae6f0e854072a099d4086e3a20643e

SHA256
54542b14ed16c691d06a80ec4bcded567573b2a7b764f6b5cb4ee40848b82808

SHA512
3272d7c475d8910fc5001b423d1aeca0fb8435c27389ba10e466baa4dd11adee1e5afa27c0d973a594ae4907508653cf4ce7e4f371161bc5ef462e8e9d1527ad

Download Submit
C:\Windows\system\wBkyAfy.exe

Filesize
2.0MB

MD5
910603deed2ce215adc13a981024b462

SHA1
e1ec471b5b68f830e05a0aee8eb586126d717ae7

SHA256
52faec23bde3425112cbfaf75df4675356df3af04345a77568c88cabe5f75738

SHA512
56b64296d1f26406d12918d2e0323dc4185c797dd626b9eff6f5a69dce86e44fb0800d0f263a2cf81636a53f51998c6ad0bfdd004f777d7486c445332718ae28

Download Submit
C:\Windows\system\wZSLWeF.exe

Filesize
2.0MB

MD5
d4e9a13997ed6cffec187be1e68d9134

SHA1
48962482c78a89d646a68414baa7ea54ce7840c3

SHA256
54d27113afa88a2c774110106413204f4908874badf0f733cfa7212fbb6a2b5d

SHA512
72d67082b5a09790521ba4fedcc7127a4a64f650f95bd78477354d887a775cc5a4d49f1b48883a2ee5eb5c2550cebd58d2235577ce89a6b007eb24e4d9bc3910

Download Submit
C:\Windows\system\ybVkWMW.exe

Filesize
2.0MB

MD5
bc41672e6926434a203d940d92e220a2

SHA1
2a176b52e467c6be0f9d095524b58c319e47b136

SHA256
5f56ab6ed896174a53f163528e2908012cdae11ad1dc5d5d220c0e92b0207291

SHA512
bab3b1bdb0de086ceccc1def14ff9f1525c166eeb3176bb77ba959463e904dfc11703d297a4d1329add0404188b3b573bcd6b5a98b2508ff996c51368400a7bc

Download Submit
\Windows\system\DQWsAbs.exe

Filesize
2.0MB

MD5
50e24e39411eb5bd7c9f7bc2fc7845fd

SHA1
2f6b8ff759b19548024221ebdea6f76017a802c7

SHA256
1210910a6dbfa220266a45324fa683162fa7f80e9f11537061b455ba1dd5c29e

SHA512
bcb0302ecae9a444d4b20a396777b518d48737ee0368618f6667efd866a1b4069ce56d1d761dcddccd01b6e7ec564e58fde3f135475a84b045602f784131903f

Download Submit
\Windows\system\GXbUtji.exe

Filesize
2.0MB

MD5
528c6ed535807e4757b1935e7f1587df

SHA1
ab59cef923de91ac73c201b5937ba73d1806b714

SHA256
404bf4d6dc0dcb494a23d8c0e426eb54660e8ce7c2d2ecd951db45e3548c1cae

SHA512
8e180172cca40d11ced739464b4cecba295de5e2218f8db333b1eecd919503df801fc3f7823e37da3dc0b20ab041893813609c141d7533a303ea53d4ec5163bf

Download Submit
\Windows\system\HdtBNzD.exe

Filesize
2.0MB

MD5
bf39b498ac660d9cce7a2a6fcc3336ca

SHA1
2946ae9d877f63aa239e2be3ac81535c2bc140b8

SHA256
baf3efc1d4d53fa0708dcb40676784db31901607ae8a1ec26e73fb7014bc136f

SHA512
9c650a9f0a0ce7e09ff0832b8db415d954bb11cd599cbcf49701ee00a56913d1f3d740d5c4837aa4605f1853c0d95b45ff0661a53774eba9d75c1d704e768f1a

Download Submit
\Windows\system\eEFHGIK.exe

Filesize
2.0MB

MD5
443576ef06b243be8cd3919a6bb715cc

SHA1
7d96b9bb667ca0482b77d8bfaf5f3bd28ebdfa1d

SHA256
df7edce41d3ba0cd9d873dbdfa52f681bae77a059aa7243ae323c6d3c873d5da

SHA512
563818d3c61c3414a4f4f7059a442ccbf2ccdfb506c7c92879269bff38fb47da569b568a61293bb3ed48d729b547e6be545d620f44fd6caa8bfd7ad5265c197d

Download Submit
\Windows\system\jEItGFt.exe

Filesize
2.0MB

MD5
6228c22bc34465242d09e0b70e28ab0e

SHA1
cf2c707c21c5be58bf609f7f26a5043b87418ccc

SHA256
a89cfe774aab95cef58d8b21c12708c1a7a94ccc6978ca9f08d25026ca4fdeb4

SHA512
7eb281c63e972c8df6ec76eacb28d110b572072708565be1524ce1d3139d9fa99227c3771669502ee59f5c02c7bb8d3d21f10c644d61937c6db0110fa2ef61eb

Download Submit
\Windows\system\ptQCCXj.exe

Filesize
2.0MB

MD5
91e5fc4633582b456c32e0f41ba65055

SHA1
3ffe1a9d14bb010b5df0eaac80c3fac9a8765bef

SHA256
8881eeb6e135c10aa587663b312d3c0b26f628490cbe9b6b97d929c081a3f753

SHA512
e0f0d8ca15d494b2192e19099208bbcaa19d54e909f0d5bc329281d5978885c1132c66caf23297b4f31603fb60e9b5b3c3fdb30fc50603f86853638b1bbbe333

Download Submit
\Windows\system\wHtJFrb.exe

Filesize
2.0MB

MD5
50c1c013ebf907df597154f81b2c2bd5

SHA1
e13177e49bc4be011543f27ca315672f38f78292

SHA256
08e431fffcaf19b1d76beec01b71708eaf883596925476701e839f82a65ccb07

SHA512
8062162572c8843f6b8ef2e3df2a146cd6068bd83c07dd8ed63eb2832bbfaac4b1b700e83010e03015e5bc18d116406ef58527f9e4dc06d0db4a80eda4ef3ffa

Download Submit
memory/1868-4530-0x000000013F8B0000-0x000000013FCA2000-memory.dmp

Filesize
3.9MB

Download
memory/1868-34-0x000000013F8B0000-0x000000013FCA2000-memory.dmp

Filesize
3.9MB

Download
memory/2056-99-0x000007FEF5080000-0x000007FEF5A1D000-memory.dmp

Filesize
9.6MB

Download
memory/2056-193-0x000007FEF5080000-0x000007FEF5A1D000-memory.dmp

Filesize
9.6MB

Download
memory/2056-41-0x000000001B600000-0x000000001B8E2000-memory.dmp

Filesize
2.9MB

Download
memory/2056-35-0x000007FEF533E000-0x000007FEF533F000-memory.dmp

Filesize
4KB

Download
memory/2056-78-0x000007FEF5080000-0x000007FEF5A1D000-memory.dmp

Filesize
9.6MB

Download
memory/2056-123-0x000007FEF5080000-0x000007FEF5A1D000-memory.dmp

Filesize
9.6MB

Download
memory/2056-42-0x00000000020F0000-0x00000000020F8000-memory.dmp

Filesize
32KB

Download
memory/2216-4548-0x000000013F950000-0x000000013FD42000-memory.dmp

Filesize
3.9MB

Download
memory/2216-108-0x000000013F950000-0x000000013FD42000-memory.dmp

Filesize
3.9MB

Download
memory/2316-135-0x000000013FF60000-0x0000000140352000-memory.dmp

Filesize
3.9MB

Download
memory/2316-115-0x000000013F350000-0x000000013F742000-memory.dmp

Filesize
3.9MB

Download
memory/2316-8381-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/2316-128-0x000000013F3A0000-0x000000013F792000-memory.dmp

Filesize
3.9MB

Download
memory/2316-131-0x0000000003320000-0x0000000003712000-memory.dmp

Filesize
3.9MB

Download
memory/2316-8107-0x000000013FF60000-0x0000000140352000-memory.dmp

Filesize
3.9MB

Download
memory/2316-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2316-117-0x0000000002FB0000-0x00000000033A2000-memory.dmp

Filesize
3.9MB

Download
memory/2316-116-0x000000013F100000-0x000000013F4F2000-memory.dmp

Filesize
3.9MB

Download
memory/2316-3775-0x0000000002FB0000-0x00000000033A2000-memory.dmp

Filesize
3.9MB

Download
memory/2316-27-0x0000000002FB0000-0x00000000033A2000-memory.dmp

Filesize
3.9MB

Download
memory/2316-133-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/2316-0-0x000000013F8C0000-0x000000013FCB2000-memory.dmp

Filesize
3.9MB

Download
memory/2316-105-0x0000000002FB0000-0x00000000033A2000-memory.dmp

Filesize
3.9MB

Download
memory/2316-137-0x000000013FF40000-0x0000000140332000-memory.dmp

Filesize
3.9MB

Download
memory/2608-134-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/2608-4579-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/2640-4551-0x000000013F580000-0x000000013F972000-memory.dmp

Filesize
3.9MB

Download
memory/2640-132-0x000000013F580000-0x000000013F972000-memory.dmp

Filesize
3.9MB

Download
memory/2680-90-0x000000013F3A0000-0x000000013F792000-memory.dmp

Filesize
3.9MB

Download
memory/2680-4604-0x000000013F3A0000-0x000000013F792000-memory.dmp

Filesize
3.9MB

Download
memory/2708-136-0x000000013FF60000-0x0000000140352000-memory.dmp

Filesize
3.9MB

Download
memory/2708-4556-0x000000013FF60000-0x0000000140352000-memory.dmp

Filesize
3.9MB

Download
memory/2724-130-0x000000013F3A0000-0x000000013F792000-memory.dmp

Filesize
3.9MB

Download
memory/2724-4581-0x000000013F3A0000-0x000000013F792000-memory.dmp

Filesize
3.9MB

Download
memory/2744-4675-0x000000013F610000-0x000000013FA02000-memory.dmp

Filesize
3.9MB

Download
memory/2744-119-0x000000013F610000-0x000000013FA02000-memory.dmp

Filesize
3.9MB

Download
memory/2792-139-0x000000013F350000-0x000000013F742000-memory.dmp

Filesize
3.9MB

Download
memory/2792-4532-0x000000013F350000-0x000000013F742000-memory.dmp

Filesize
3.9MB

Download
memory/2828-4578-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/2828-129-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/2836-4531-0x000000013F100000-0x000000013F4F2000-memory.dmp

Filesize
3.9MB

Download
memory/2836-118-0x000000013F100000-0x000000013F4F2000-memory.dmp

Filesize
3.9MB

Download
memory/3032-138-0x000000013FF40000-0x0000000140332000-memory.dmp

Filesize
3.9MB

Download
memory/3032-4685-0x000000013FF40000-0x0000000140332000-memory.dmp

Filesize
3.9MB

Download