xmrig | eb80f59ece9ac0337fed018a835f106e0e1c653aa27fea38fcf7b294c0f3eb82

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 13:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a58db5f95835424a3f00ac8b70754140N.exe
Size

1.6MB
MD5

a58db5f95835424a3f00ac8b70754140
SHA1

a126e2fd5619d1c445bad15d7dc12e8d3bab4e98
SHA256

eb80f59ece9ac0337fed018a835f106e0e1c653aa27fea38fcf7b294c0f3eb82
SHA512

d0f8d91378db1290d907eea0245db896720c9e23c1dab88c38ddff12e0756fda270d4b978098c0b76024b8624774d66bc2d93d2fddbb2802830ddf2397287071
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkipBh8tGxHIBWGlTqTmo6OZXbPbPIMUQzdXMKA9L8:Lz071uv4BPMkiFGlvETbzWB8

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 25 IoCs

miner

resource	yara_rule
behavioral1/memory/532-13-0x000000013FF10000-0x0000000140302000-memory.dmp	xmrig
behavioral1/memory/3024-832-0x000000013FEF0000-0x00000001402E2000-memory.dmp	xmrig
behavioral1/memory/1908-1066-0x000000013F0A0000-0x000000013F492000-memory.dmp	xmrig
behavioral1/memory/2944-1047-0x000000013F9A0000-0x000000013FD92000-memory.dmp	xmrig
behavioral1/memory/3028-719-0x000000013F180000-0x000000013F572000-memory.dmp	xmrig
behavioral1/memory/2900-346-0x000000013FDD0000-0x00000001401C2000-memory.dmp	xmrig
behavioral1/memory/2836-85-0x000000013F600000-0x000000013F9F2000-memory.dmp	xmrig
behavioral1/memory/2764-84-0x000000013FB30000-0x000000013FF22000-memory.dmp	xmrig
behavioral1/memory/2872-83-0x000000013FAB0000-0x000000013FEA2000-memory.dmp	xmrig
behavioral1/memory/2732-82-0x000000013FA10000-0x000000013FE02000-memory.dmp	xmrig
behavioral1/memory/2852-63-0x000000013FAF0000-0x000000013FEE2000-memory.dmp	xmrig
behavioral1/memory/2424-61-0x000000013F930000-0x000000013FD22000-memory.dmp	xmrig
behavioral1/memory/860-51-0x000000013FD70000-0x0000000140162000-memory.dmp	xmrig
behavioral1/memory/532-5106-0x000000013FF10000-0x0000000140302000-memory.dmp	xmrig
behavioral1/memory/2424-5110-0x000000013F930000-0x000000013FD22000-memory.dmp	xmrig
behavioral1/memory/2764-5109-0x000000013FB30000-0x000000013FF22000-memory.dmp	xmrig
behavioral1/memory/2732-5108-0x000000013FA10000-0x000000013FE02000-memory.dmp	xmrig
behavioral1/memory/2836-5107-0x000000013F600000-0x000000013F9F2000-memory.dmp	xmrig
behavioral1/memory/860-5111-0x000000013FD70000-0x0000000140162000-memory.dmp	xmrig
behavioral1/memory/3028-5114-0x000000013F180000-0x000000013F572000-memory.dmp	xmrig
behavioral1/memory/3024-5121-0x000000013FEF0000-0x00000001402E2000-memory.dmp	xmrig
behavioral1/memory/1908-5118-0x000000013F0A0000-0x000000013F492000-memory.dmp	xmrig
behavioral1/memory/2872-5124-0x000000013FAB0000-0x000000013FEA2000-memory.dmp	xmrig
behavioral1/memory/2944-5116-0x000000013F9A0000-0x000000013FD92000-memory.dmp	xmrig
behavioral1/memory/2852-5113-0x000000013FAF0000-0x000000013FEE2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1684	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
532	JKUClxN.exe
860	mmUmrci.exe
2424	GDQprtL.exe
2852	oGMZpDh.exe
2836	weyAXBj.exe
2732	DpjGjqm.exe
2872	KfTnIPh.exe
2764	JUGLtYO.exe
3028	slugfzq.exe
3024	aIyfcbC.exe
2944	oPDUhYr.exe
1908	WGXwirg.exe
2668	FZvMbkL.exe
2700	UQFplDm.exe
2164	yRxjPXS.exe
1216	CPILgZI.exe
1196	ZiHFOPD.exe
1944	zqlGErv.exe
2004	kpFlcxb.exe
2060	wXtxtSp.exe
2972	KpKZYrd.exe
2640	MYanYvd.exe
2532	hPhpOHH.exe
2352	OfCXXuU.exe
908	UxdoBJU.exe
1132	KXZzbDW.exe
3048	INcbBFO.exe
1048	xWsgpmp.exe
1316	SVKoows.exe
1756	xewFxpz.exe
1916	qeOHTmy.exe
1872	qKiFCRV.exe
2196	XBZRgzY.exe
1732	uMpWBKH.exe
632	IYImosE.exe
556	IWYhNLk.exe
3036	eULpIyE.exe
2452	qCQVOVn.exe
2256	zHCLlrU.exe
2072	unmheiw.exe
2080	sOvkMpR.exe
1284	mNBURbS.exe
1920	tDJrdsj.exe
1936	OSiwMBN.exe
1760	OIOzulF.exe
1712	syjDgdq.exe
2396	sFwLivw.exe
1584	SFoNdCS.exe
1124	RsYtGXn.exe
2528	JGfFwLf.exe
2788	xsfSZKZ.exe
1832	qLVArmT.exe
2708	nFJtBNj.exe
2828	cbERNnA.exe
2932	lsJAEDu.exe
2384	QgUcPhp.exe
1664	kNYFMgi.exe
2328	byNZeSN.exe
1676	mQVMfVf.exe
2688	fsDRyJR.exe
1516	IxHimCF.exe
2904	xEcREmw.exe
2168	WgERfcu.exe
3004	NRpuvvB.exe

Loads dropped DLL 64 IoCs

pid	Process
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe
2900	a58db5f95835424a3f00ac8b70754140N.exe

UPX packed file 62 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2900-0-0x000000013FDD0000-0x00000001401C2000-memory.dmp	upx
behavioral1/files/0x000a000000012283-5.dat	upx
behavioral1/memory/532-13-0x000000013FF10000-0x0000000140302000-memory.dmp	upx
behavioral1/files/0x00080000000173c2-18.dat	upx
behavioral1/files/0x0007000000004e74-19.dat	upx
behavioral1/files/0x00070000000174af-31.dat	upx
behavioral1/files/0x00090000000173de-30.dat	upx
behavioral1/files/0x0005000000019361-52.dat	upx
behavioral1/files/0x0009000000016ddf-104.dat	upx
behavioral1/files/0x000500000001942e-119.dat	upx
behavioral1/files/0x00050000000194ba-156.dat	upx
behavioral1/files/0x00050000000195a6-171.dat	upx
behavioral1/memory/3024-832-0x000000013FEF0000-0x00000001402E2000-memory.dmp	upx
behavioral1/memory/1908-1066-0x000000013F0A0000-0x000000013F492000-memory.dmp	upx
behavioral1/memory/2944-1047-0x000000013F9A0000-0x000000013FD92000-memory.dmp	upx
behavioral1/memory/3028-719-0x000000013F180000-0x000000013F572000-memory.dmp	upx
behavioral1/memory/2900-346-0x000000013FDD0000-0x00000001401C2000-memory.dmp	upx
behavioral1/files/0x0005000000019621-197.dat	upx
behavioral1/files/0x000500000001961e-186.dat	upx
behavioral1/files/0x0005000000019620-192.dat	upx
behavioral1/files/0x000500000001961c-182.dat	upx
behavioral1/files/0x00050000000195e5-176.dat	upx
behavioral1/files/0x0005000000019524-166.dat	upx
behavioral1/files/0x000500000001951c-161.dat	upx
behavioral1/files/0x00050000000194a4-151.dat	upx
behavioral1/files/0x0005000000019468-144.dat	upx
behavioral1/files/0x000500000001944e-134.dat	upx
behavioral1/files/0x0005000000019462-139.dat	upx
behavioral1/files/0x0005000000019444-129.dat	upx
behavioral1/files/0x0005000000019439-124.dat	upx
behavioral1/files/0x000500000001941f-114.dat	upx
behavioral1/files/0x00050000000193ee-109.dat	upx
behavioral1/files/0x00050000000193d5-101.dat	upx
behavioral1/memory/1908-95-0x000000013F0A0000-0x000000013F492000-memory.dmp	upx
behavioral1/memory/2944-93-0x000000013F9A0000-0x000000013FD92000-memory.dmp	upx
behavioral1/files/0x000500000001934d-91.dat	upx
behavioral1/memory/3024-90-0x000000013FEF0000-0x00000001402E2000-memory.dmp	upx
behavioral1/files/0x00080000000175ed-89.dat	upx
behavioral1/memory/3028-88-0x000000013F180000-0x000000013F572000-memory.dmp	upx
behavioral1/files/0x00070000000174f5-86.dat	upx
behavioral1/memory/2836-85-0x000000013F600000-0x000000013F9F2000-memory.dmp	upx
behavioral1/memory/2764-84-0x000000013FB30000-0x000000013FF22000-memory.dmp	upx
behavioral1/memory/2872-83-0x000000013FAB0000-0x000000013FEA2000-memory.dmp	upx
behavioral1/memory/2732-82-0x000000013FA10000-0x000000013FE02000-memory.dmp	upx
behavioral1/files/0x0008000000018660-72.dat	upx
behavioral1/files/0x000700000001756a-71.dat	upx
behavioral1/memory/2852-63-0x000000013FAF0000-0x000000013FEE2000-memory.dmp	upx
behavioral1/memory/2424-61-0x000000013F930000-0x000000013FD22000-memory.dmp	upx
behavioral1/files/0x000500000001936c-55.dat	upx
behavioral1/memory/860-51-0x000000013FD70000-0x0000000140162000-memory.dmp	upx
behavioral1/memory/532-5106-0x000000013FF10000-0x0000000140302000-memory.dmp	upx
behavioral1/memory/2424-5110-0x000000013F930000-0x000000013FD22000-memory.dmp	upx
behavioral1/memory/2764-5109-0x000000013FB30000-0x000000013FF22000-memory.dmp	upx
behavioral1/memory/2732-5108-0x000000013FA10000-0x000000013FE02000-memory.dmp	upx
behavioral1/memory/2836-5107-0x000000013F600000-0x000000013F9F2000-memory.dmp	upx
behavioral1/memory/860-5111-0x000000013FD70000-0x0000000140162000-memory.dmp	upx
behavioral1/memory/3028-5114-0x000000013F180000-0x000000013F572000-memory.dmp	upx
behavioral1/memory/3024-5121-0x000000013FEF0000-0x00000001402E2000-memory.dmp	upx
behavioral1/memory/1908-5118-0x000000013F0A0000-0x000000013F492000-memory.dmp	upx
behavioral1/memory/2872-5124-0x000000013FAB0000-0x000000013FEA2000-memory.dmp	upx
behavioral1/memory/2944-5116-0x000000013F9A0000-0x000000013FD92000-memory.dmp	upx
behavioral1/memory/2852-5113-0x000000013FAF0000-0x000000013FEE2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\AelUnhf.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\JpCCSXU.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\oAMWJLV.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\InWvoTl.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\xeKaCNR.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\fdYjQWL.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\oAWOpca.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\ZpsVbQP.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\jqhYnjq.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\wXigPUX.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\mObZwJs.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\sMdiosV.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\QLFPXVa.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\lESTazU.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\BhZIIAg.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\PpVBywW.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\edNtKoZ.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\jNbSqvx.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\zhnyEDB.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\JPRkWld.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\FaszIwk.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\JuaPTeH.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\GitOIhO.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\GzkzZOY.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\uVrqmoB.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\kwpqjiF.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\XANVzUe.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\zFBPJee.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\hInqLqa.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\ANSRncJ.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\OlFsnbr.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\rTaQfhW.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\hfKyueU.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\yzBKZSJ.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\sPhwBAa.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\uaNVHOM.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\UdDsrAt.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\uHHQCZm.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\xddDOoO.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\elIOLGw.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\FyPfvZd.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\gsslvmN.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\qdbkYfp.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\oxKsGFZ.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\fOMInXa.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\YRQnMcl.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\cRwIBwT.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\dJsHhxb.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\DEkbSze.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\JUopznI.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\gEsubuL.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\JRDjQmD.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\BgrPjoK.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\OVVQUOJ.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\LWepITF.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\iTjTztN.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\RnGWgnp.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\JCQHSVm.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\SCqLAKd.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\YgsIBUt.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\QLLXhDq.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\sXSzcRp.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\ZWpCTOn.exe	a58db5f95835424a3f00ac8b70754140N.exe
File created	C:\Windows\System\pHAxLKK.exe	a58db5f95835424a3f00ac8b70754140N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1684	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2900	a58db5f95835424a3f00ac8b70754140N.exe
Token: SeLockMemoryPrivilege	2900	a58db5f95835424a3f00ac8b70754140N.exe
Token: SeDebugPrivilege	1684	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 1684	2900	a58db5f95835424a3f00ac8b70754140N.exe	31
PID 2900 wrote to memory of 1684	2900	a58db5f95835424a3f00ac8b70754140N.exe	31
PID 2900 wrote to memory of 1684	2900	a58db5f95835424a3f00ac8b70754140N.exe	31
PID 2900 wrote to memory of 532	2900	a58db5f95835424a3f00ac8b70754140N.exe	32
PID 2900 wrote to memory of 532	2900	a58db5f95835424a3f00ac8b70754140N.exe	32
PID 2900 wrote to memory of 532	2900	a58db5f95835424a3f00ac8b70754140N.exe	32
PID 2900 wrote to memory of 860	2900	a58db5f95835424a3f00ac8b70754140N.exe	33
PID 2900 wrote to memory of 860	2900	a58db5f95835424a3f00ac8b70754140N.exe	33
PID 2900 wrote to memory of 860	2900	a58db5f95835424a3f00ac8b70754140N.exe	33
PID 2900 wrote to memory of 2424	2900	a58db5f95835424a3f00ac8b70754140N.exe	34
PID 2900 wrote to memory of 2424	2900	a58db5f95835424a3f00ac8b70754140N.exe	34
PID 2900 wrote to memory of 2424	2900	a58db5f95835424a3f00ac8b70754140N.exe	34
PID 2900 wrote to memory of 2852	2900	a58db5f95835424a3f00ac8b70754140N.exe	35
PID 2900 wrote to memory of 2852	2900	a58db5f95835424a3f00ac8b70754140N.exe	35
PID 2900 wrote to memory of 2852	2900	a58db5f95835424a3f00ac8b70754140N.exe	35
PID 2900 wrote to memory of 2836	2900	a58db5f95835424a3f00ac8b70754140N.exe	36
PID 2900 wrote to memory of 2836	2900	a58db5f95835424a3f00ac8b70754140N.exe	36
PID 2900 wrote to memory of 2836	2900	a58db5f95835424a3f00ac8b70754140N.exe	36
PID 2900 wrote to memory of 3028	2900	a58db5f95835424a3f00ac8b70754140N.exe	37
PID 2900 wrote to memory of 3028	2900	a58db5f95835424a3f00ac8b70754140N.exe	37
PID 2900 wrote to memory of 3028	2900	a58db5f95835424a3f00ac8b70754140N.exe	37
PID 2900 wrote to memory of 2732	2900	a58db5f95835424a3f00ac8b70754140N.exe	38
PID 2900 wrote to memory of 2732	2900	a58db5f95835424a3f00ac8b70754140N.exe	38
PID 2900 wrote to memory of 2732	2900	a58db5f95835424a3f00ac8b70754140N.exe	38
PID 2900 wrote to memory of 3024	2900	a58db5f95835424a3f00ac8b70754140N.exe	39
PID 2900 wrote to memory of 3024	2900	a58db5f95835424a3f00ac8b70754140N.exe	39
PID 2900 wrote to memory of 3024	2900	a58db5f95835424a3f00ac8b70754140N.exe	39
PID 2900 wrote to memory of 2872	2900	a58db5f95835424a3f00ac8b70754140N.exe	40
PID 2900 wrote to memory of 2872	2900	a58db5f95835424a3f00ac8b70754140N.exe	40
PID 2900 wrote to memory of 2872	2900	a58db5f95835424a3f00ac8b70754140N.exe	40
PID 2900 wrote to memory of 2944	2900	a58db5f95835424a3f00ac8b70754140N.exe	41
PID 2900 wrote to memory of 2944	2900	a58db5f95835424a3f00ac8b70754140N.exe	41
PID 2900 wrote to memory of 2944	2900	a58db5f95835424a3f00ac8b70754140N.exe	41
PID 2900 wrote to memory of 2764	2900	a58db5f95835424a3f00ac8b70754140N.exe	42
PID 2900 wrote to memory of 2764	2900	a58db5f95835424a3f00ac8b70754140N.exe	42
PID 2900 wrote to memory of 2764	2900	a58db5f95835424a3f00ac8b70754140N.exe	42
PID 2900 wrote to memory of 1908	2900	a58db5f95835424a3f00ac8b70754140N.exe	43
PID 2900 wrote to memory of 1908	2900	a58db5f95835424a3f00ac8b70754140N.exe	43
PID 2900 wrote to memory of 1908	2900	a58db5f95835424a3f00ac8b70754140N.exe	43
PID 2900 wrote to memory of 2668	2900	a58db5f95835424a3f00ac8b70754140N.exe	44
PID 2900 wrote to memory of 2668	2900	a58db5f95835424a3f00ac8b70754140N.exe	44
PID 2900 wrote to memory of 2668	2900	a58db5f95835424a3f00ac8b70754140N.exe	44
PID 2900 wrote to memory of 2700	2900	a58db5f95835424a3f00ac8b70754140N.exe	45
PID 2900 wrote to memory of 2700	2900	a58db5f95835424a3f00ac8b70754140N.exe	45
PID 2900 wrote to memory of 2700	2900	a58db5f95835424a3f00ac8b70754140N.exe	45
PID 2900 wrote to memory of 2164	2900	a58db5f95835424a3f00ac8b70754140N.exe	46
PID 2900 wrote to memory of 2164	2900	a58db5f95835424a3f00ac8b70754140N.exe	46
PID 2900 wrote to memory of 2164	2900	a58db5f95835424a3f00ac8b70754140N.exe	46
PID 2900 wrote to memory of 1216	2900	a58db5f95835424a3f00ac8b70754140N.exe	47
PID 2900 wrote to memory of 1216	2900	a58db5f95835424a3f00ac8b70754140N.exe	47
PID 2900 wrote to memory of 1216	2900	a58db5f95835424a3f00ac8b70754140N.exe	47
PID 2900 wrote to memory of 1196	2900	a58db5f95835424a3f00ac8b70754140N.exe	48
PID 2900 wrote to memory of 1196	2900	a58db5f95835424a3f00ac8b70754140N.exe	48
PID 2900 wrote to memory of 1196	2900	a58db5f95835424a3f00ac8b70754140N.exe	48
PID 2900 wrote to memory of 1944	2900	a58db5f95835424a3f00ac8b70754140N.exe	49
PID 2900 wrote to memory of 1944	2900	a58db5f95835424a3f00ac8b70754140N.exe	49
PID 2900 wrote to memory of 1944	2900	a58db5f95835424a3f00ac8b70754140N.exe	49
PID 2900 wrote to memory of 2004	2900	a58db5f95835424a3f00ac8b70754140N.exe	50
PID 2900 wrote to memory of 2004	2900	a58db5f95835424a3f00ac8b70754140N.exe	50
PID 2900 wrote to memory of 2004	2900	a58db5f95835424a3f00ac8b70754140N.exe	50
PID 2900 wrote to memory of 2060	2900	a58db5f95835424a3f00ac8b70754140N.exe	51
PID 2900 wrote to memory of 2060	2900	a58db5f95835424a3f00ac8b70754140N.exe	51
PID 2900 wrote to memory of 2060	2900	a58db5f95835424a3f00ac8b70754140N.exe	51
PID 2900 wrote to memory of 2972	2900	a58db5f95835424a3f00ac8b70754140N.exe	52

C:\Users\Admin\AppData\Local\Temp\a58db5f95835424a3f00ac8b70754140N.exe
"C:\Users\Admin\AppData\Local\Temp\a58db5f95835424a3f00ac8b70754140N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1684
- C:\Windows\System\JKUClxN.exe
  C:\Windows\System\JKUClxN.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\mmUmrci.exe
  C:\Windows\System\mmUmrci.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\GDQprtL.exe
  C:\Windows\System\GDQprtL.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\oGMZpDh.exe
  C:\Windows\System\oGMZpDh.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\weyAXBj.exe
  C:\Windows\System\weyAXBj.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\slugfzq.exe
  C:\Windows\System\slugfzq.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\DpjGjqm.exe
  C:\Windows\System\DpjGjqm.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\aIyfcbC.exe
  C:\Windows\System\aIyfcbC.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\KfTnIPh.exe
  C:\Windows\System\KfTnIPh.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\oPDUhYr.exe
  C:\Windows\System\oPDUhYr.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\JUGLtYO.exe
  C:\Windows\System\JUGLtYO.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\WGXwirg.exe
  C:\Windows\System\WGXwirg.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\FZvMbkL.exe
  C:\Windows\System\FZvMbkL.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\UQFplDm.exe
  C:\Windows\System\UQFplDm.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\yRxjPXS.exe
  C:\Windows\System\yRxjPXS.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\CPILgZI.exe
  C:\Windows\System\CPILgZI.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\ZiHFOPD.exe
  C:\Windows\System\ZiHFOPD.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\zqlGErv.exe
  C:\Windows\System\zqlGErv.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\kpFlcxb.exe
  C:\Windows\System\kpFlcxb.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\wXtxtSp.exe
  C:\Windows\System\wXtxtSp.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\KpKZYrd.exe
  C:\Windows\System\KpKZYrd.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\MYanYvd.exe
  C:\Windows\System\MYanYvd.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\hPhpOHH.exe
  C:\Windows\System\hPhpOHH.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\OfCXXuU.exe
  C:\Windows\System\OfCXXuU.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\UxdoBJU.exe
  C:\Windows\System\UxdoBJU.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\KXZzbDW.exe
  C:\Windows\System\KXZzbDW.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\INcbBFO.exe
  C:\Windows\System\INcbBFO.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\xWsgpmp.exe
  C:\Windows\System\xWsgpmp.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\SVKoows.exe
  C:\Windows\System\SVKoows.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\xewFxpz.exe
  C:\Windows\System\xewFxpz.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\qeOHTmy.exe
  C:\Windows\System\qeOHTmy.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\qKiFCRV.exe
  C:\Windows\System\qKiFCRV.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\XBZRgzY.exe
  C:\Windows\System\XBZRgzY.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\uMpWBKH.exe
  C:\Windows\System\uMpWBKH.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\IYImosE.exe
  C:\Windows\System\IYImosE.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\IWYhNLk.exe
  C:\Windows\System\IWYhNLk.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\eULpIyE.exe
  C:\Windows\System\eULpIyE.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\qCQVOVn.exe
  C:\Windows\System\qCQVOVn.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\zHCLlrU.exe
  C:\Windows\System\zHCLlrU.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\unmheiw.exe
  C:\Windows\System\unmheiw.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\sOvkMpR.exe
  C:\Windows\System\sOvkMpR.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\mNBURbS.exe
  C:\Windows\System\mNBURbS.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\tDJrdsj.exe
  C:\Windows\System\tDJrdsj.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\OSiwMBN.exe
  C:\Windows\System\OSiwMBN.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\OIOzulF.exe
  C:\Windows\System\OIOzulF.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\syjDgdq.exe
  C:\Windows\System\syjDgdq.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\sFwLivw.exe
  C:\Windows\System\sFwLivw.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\SFoNdCS.exe
  C:\Windows\System\SFoNdCS.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\RsYtGXn.exe
  C:\Windows\System\RsYtGXn.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\JGfFwLf.exe
  C:\Windows\System\JGfFwLf.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\xsfSZKZ.exe
  C:\Windows\System\xsfSZKZ.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\qLVArmT.exe
  C:\Windows\System\qLVArmT.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\nFJtBNj.exe
  C:\Windows\System\nFJtBNj.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\cbERNnA.exe
  C:\Windows\System\cbERNnA.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\lsJAEDu.exe
  C:\Windows\System\lsJAEDu.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\QgUcPhp.exe
  C:\Windows\System\QgUcPhp.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\kNYFMgi.exe
  C:\Windows\System\kNYFMgi.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\byNZeSN.exe
  C:\Windows\System\byNZeSN.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\mQVMfVf.exe
  C:\Windows\System\mQVMfVf.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\fsDRyJR.exe
  C:\Windows\System\fsDRyJR.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\IxHimCF.exe
  C:\Windows\System\IxHimCF.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\xEcREmw.exe
  C:\Windows\System\xEcREmw.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\WgERfcu.exe
  C:\Windows\System\WgERfcu.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\NRpuvvB.exe
  C:\Windows\System\NRpuvvB.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\FfeQbuq.exe
  C:\Windows\System\FfeQbuq.exe
  2⤵
  PID:1300
- C:\Windows\System\HTyeToE.exe
  C:\Windows\System\HTyeToE.exe
  2⤵
  PID:2324
- C:\Windows\System\KpIeLGu.exe
  C:\Windows\System\KpIeLGu.exe
  2⤵
  PID:1052
- C:\Windows\System\Alritpn.exe
  C:\Windows\System\Alritpn.exe
  2⤵
  PID:2792
- C:\Windows\System\vOehGqY.exe
  C:\Windows\System\vOehGqY.exe
  2⤵
  PID:1288
- C:\Windows\System\QwGvBkh.exe
  C:\Windows\System\QwGvBkh.exe
  2⤵
  PID:1148
- C:\Windows\System\zjPvfAi.exe
  C:\Windows\System\zjPvfAi.exe
  2⤵
  PID:1348
- C:\Windows\System\StMoruo.exe
  C:\Windows\System\StMoruo.exe
  2⤵
  PID:924
- C:\Windows\System\fQniDWm.exe
  C:\Windows\System\fQniDWm.exe
  2⤵
  PID:2128
- C:\Windows\System\PzJRbKy.exe
  C:\Windows\System\PzJRbKy.exe
  2⤵
  PID:264
- C:\Windows\System\phvCAjM.exe
  C:\Windows\System\phvCAjM.exe
  2⤵
  PID:300
- C:\Windows\System\BZkQlwi.exe
  C:\Windows\System\BZkQlwi.exe
  2⤵
  PID:2260
- C:\Windows\System\vkuhEte.exe
  C:\Windows\System\vkuhEte.exe
  2⤵
  PID:1956
- C:\Windows\System\FdmLAKs.exe
  C:\Windows\System\FdmLAKs.exe
  2⤵
  PID:576
- C:\Windows\System\BlcOPag.exe
  C:\Windows\System\BlcOPag.exe
  2⤵
  PID:2084
- C:\Windows\System\fgNTpwS.exe
  C:\Windows\System\fgNTpwS.exe
  2⤵
  PID:2100
- C:\Windows\System\uXepRmB.exe
  C:\Windows\System\uXepRmB.exe
  2⤵
  PID:1700
- C:\Windows\System\GFIpGMP.exe
  C:\Windows\System\GFIpGMP.exe
  2⤵
  PID:1620
- C:\Windows\System\ZPwNcJB.exe
  C:\Windows\System\ZPwNcJB.exe
  2⤵
  PID:2728
- C:\Windows\System\jsSWBZS.exe
  C:\Windows\System\jsSWBZS.exe
  2⤵
  PID:2656
- C:\Windows\System\PHWlEvT.exe
  C:\Windows\System\PHWlEvT.exe
  2⤵
  PID:2768
- C:\Windows\System\aHfPcSa.exe
  C:\Windows\System\aHfPcSa.exe
  2⤵
  PID:2472
- C:\Windows\System\zSqVUEe.exe
  C:\Windows\System\zSqVUEe.exe
  2⤵
  PID:1192
- C:\Windows\System\zWxMpln.exe
  C:\Windows\System\zWxMpln.exe
  2⤵
  PID:2312
- C:\Windows\System\wDGiHcb.exe
  C:\Windows\System\wDGiHcb.exe
  2⤵
  PID:1988
- C:\Windows\System\cCVJYfo.exe
  C:\Windows\System\cCVJYfo.exe
  2⤵
  PID:844
- C:\Windows\System\rhzHHdS.exe
  C:\Windows\System\rhzHHdS.exe
  2⤵
  PID:1388
- C:\Windows\System\ahfHoWi.exe
  C:\Windows\System\ahfHoWi.exe
  2⤵
  PID:980
- C:\Windows\System\qlvuACp.exe
  C:\Windows\System\qlvuACp.exe
  2⤵
  PID:2380
- C:\Windows\System\IYGyfbf.exe
  C:\Windows\System\IYGyfbf.exe
  2⤵
  PID:1544
- C:\Windows\System\aVqgUTu.exe
  C:\Windows\System\aVqgUTu.exe
  2⤵
  PID:2464
- C:\Windows\System\gMQZwjs.exe
  C:\Windows\System\gMQZwjs.exe
  2⤵
  PID:1764
- C:\Windows\System\LcjsPuV.exe
  C:\Windows\System\LcjsPuV.exe
  2⤵
  PID:1816
- C:\Windows\System\pHAxLKK.exe
  C:\Windows\System\pHAxLKK.exe
  2⤵
  PID:1752
- C:\Windows\System\eBwibBg.exe
  C:\Windows\System\eBwibBg.exe
  2⤵
  PID:2288
- C:\Windows\System\hsZbLRO.exe
  C:\Windows\System\hsZbLRO.exe
  2⤵
  PID:1728
- C:\Windows\System\BhZIIAg.exe
  C:\Windows\System\BhZIIAg.exe
  2⤵
  PID:2848
- C:\Windows\System\SmsFCIT.exe
  C:\Windows\System\SmsFCIT.exe
  2⤵
  PID:1792
- C:\Windows\System\ixnswtP.exe
  C:\Windows\System\ixnswtP.exe
  2⤵
  PID:1512
- C:\Windows\System\YSkVkYK.exe
  C:\Windows\System\YSkVkYK.exe
  2⤵
  PID:2796
- C:\Windows\System\senGzVk.exe
  C:\Windows\System\senGzVk.exe
  2⤵
  PID:1208
- C:\Windows\System\pSNyYaZ.exe
  C:\Windows\System\pSNyYaZ.exe
  2⤵
  PID:2928
- C:\Windows\System\BwInBEs.exe
  C:\Windows\System\BwInBEs.exe
  2⤵
  PID:304
- C:\Windows\System\YBoxHHK.exe
  C:\Windows\System\YBoxHHK.exe
  2⤵
  PID:2496
- C:\Windows\System\hxKcGmN.exe
  C:\Windows\System\hxKcGmN.exe
  2⤵
  PID:700
- C:\Windows\System\bMRNDob.exe
  C:\Windows\System\bMRNDob.exe
  2⤵
  PID:2056
- C:\Windows\System\EaKlHYe.exe
  C:\Windows\System\EaKlHYe.exe
  2⤵
  PID:2336
- C:\Windows\System\qToWrWo.exe
  C:\Windows\System\qToWrWo.exe
  2⤵
  PID:2572
- C:\Windows\System\bzqvPkB.exe
  C:\Windows\System\bzqvPkB.exe
  2⤵
  PID:1228
- C:\Windows\System\irsQdbE.exe
  C:\Windows\System\irsQdbE.exe
  2⤵
  PID:2540
- C:\Windows\System\EpnZcOJ.exe
  C:\Windows\System\EpnZcOJ.exe
  2⤵
  PID:584
- C:\Windows\System\OulSFAX.exe
  C:\Windows\System\OulSFAX.exe
  2⤵
  PID:3076
- C:\Windows\System\AAfbeTA.exe
  C:\Windows\System\AAfbeTA.exe
  2⤵
  PID:3100
- C:\Windows\System\GQgIjIS.exe
  C:\Windows\System\GQgIjIS.exe
  2⤵
  PID:3116
- C:\Windows\System\SXwwCwr.exe
  C:\Windows\System\SXwwCwr.exe
  2⤵
  PID:3136
- C:\Windows\System\HyPcLdd.exe
  C:\Windows\System\HyPcLdd.exe
  2⤵
  PID:3160
- C:\Windows\System\SfOviPH.exe
  C:\Windows\System\SfOviPH.exe
  2⤵
  PID:3180
- C:\Windows\System\UGQRkvj.exe
  C:\Windows\System\UGQRkvj.exe
  2⤵
  PID:3196
- C:\Windows\System\JEqFWnr.exe
  C:\Windows\System\JEqFWnr.exe
  2⤵
  PID:3220
- C:\Windows\System\fzTsUqs.exe
  C:\Windows\System\fzTsUqs.exe
  2⤵
  PID:3240
- C:\Windows\System\uNhIYnb.exe
  C:\Windows\System\uNhIYnb.exe
  2⤵
  PID:3260
- C:\Windows\System\ziTuOgC.exe
  C:\Windows\System\ziTuOgC.exe
  2⤵
  PID:3280
- C:\Windows\System\TlXRWrV.exe
  C:\Windows\System\TlXRWrV.exe
  2⤵
  PID:3300
- C:\Windows\System\OoVnxyw.exe
  C:\Windows\System\OoVnxyw.exe
  2⤵
  PID:3320
- C:\Windows\System\OYzqkzc.exe
  C:\Windows\System\OYzqkzc.exe
  2⤵
  PID:3340
- C:\Windows\System\DhqPVrU.exe
  C:\Windows\System\DhqPVrU.exe
  2⤵
  PID:3360
- C:\Windows\System\fNUhoHz.exe
  C:\Windows\System\fNUhoHz.exe
  2⤵
  PID:3380
- C:\Windows\System\mAkmNVx.exe
  C:\Windows\System\mAkmNVx.exe
  2⤵
  PID:3400
- C:\Windows\System\HYKdWSP.exe
  C:\Windows\System\HYKdWSP.exe
  2⤵
  PID:3420
- C:\Windows\System\afhBbBq.exe
  C:\Windows\System\afhBbBq.exe
  2⤵
  PID:3440
- C:\Windows\System\otCdCvs.exe
  C:\Windows\System\otCdCvs.exe
  2⤵
  PID:3460
- C:\Windows\System\lfjfUow.exe
  C:\Windows\System\lfjfUow.exe
  2⤵
  PID:3480
- C:\Windows\System\SYZUtLn.exe
  C:\Windows\System\SYZUtLn.exe
  2⤵
  PID:3500
- C:\Windows\System\trXQPDx.exe
  C:\Windows\System\trXQPDx.exe
  2⤵
  PID:3516
- C:\Windows\System\NvYSphc.exe
  C:\Windows\System\NvYSphc.exe
  2⤵
  PID:3536
- C:\Windows\System\SHDloux.exe
  C:\Windows\System\SHDloux.exe
  2⤵
  PID:3560
- C:\Windows\System\RvWpqmc.exe
  C:\Windows\System\RvWpqmc.exe
  2⤵
  PID:3580
- C:\Windows\System\fOtBTRX.exe
  C:\Windows\System\fOtBTRX.exe
  2⤵
  PID:3600
- C:\Windows\System\ZoxWNuX.exe
  C:\Windows\System\ZoxWNuX.exe
  2⤵
  PID:3620
- C:\Windows\System\nXnZrFv.exe
  C:\Windows\System\nXnZrFv.exe
  2⤵
  PID:3640
- C:\Windows\System\ZXElkds.exe
  C:\Windows\System\ZXElkds.exe
  2⤵
  PID:3660
- C:\Windows\System\wRtnCUB.exe
  C:\Windows\System\wRtnCUB.exe
  2⤵
  PID:3676
- C:\Windows\System\tTneCUO.exe
  C:\Windows\System\tTneCUO.exe
  2⤵
  PID:3696
- C:\Windows\System\MNCKVpP.exe
  C:\Windows\System\MNCKVpP.exe
  2⤵
  PID:3716
- C:\Windows\System\bWuoyjT.exe
  C:\Windows\System\bWuoyjT.exe
  2⤵
  PID:3740
- C:\Windows\System\tJDckyL.exe
  C:\Windows\System\tJDckyL.exe
  2⤵
  PID:3756
- C:\Windows\System\SwLmefN.exe
  C:\Windows\System\SwLmefN.exe
  2⤵
  PID:3780
- C:\Windows\System\QLtwwQM.exe
  C:\Windows\System\QLtwwQM.exe
  2⤵
  PID:3796
- C:\Windows\System\NQhUVnS.exe
  C:\Windows\System\NQhUVnS.exe
  2⤵
  PID:3816
- C:\Windows\System\ZmqanCZ.exe
  C:\Windows\System\ZmqanCZ.exe
  2⤵
  PID:3836
- C:\Windows\System\tuXBbdB.exe
  C:\Windows\System\tuXBbdB.exe
  2⤵
  PID:3856
- C:\Windows\System\ZIEPOzj.exe
  C:\Windows\System\ZIEPOzj.exe
  2⤵
  PID:3876
- C:\Windows\System\Fngfpnc.exe
  C:\Windows\System\Fngfpnc.exe
  2⤵
  PID:3896
- C:\Windows\System\diHPJWo.exe
  C:\Windows\System\diHPJWo.exe
  2⤵
  PID:3916
- C:\Windows\System\UogWdJN.exe
  C:\Windows\System\UogWdJN.exe
  2⤵
  PID:3936
- C:\Windows\System\xwpTjAq.exe
  C:\Windows\System\xwpTjAq.exe
  2⤵
  PID:3952
- C:\Windows\System\aubQCGr.exe
  C:\Windows\System\aubQCGr.exe
  2⤵
  PID:3976
- C:\Windows\System\jwwJskg.exe
  C:\Windows\System\jwwJskg.exe
  2⤵
  PID:4000
- C:\Windows\System\AelUnhf.exe
  C:\Windows\System\AelUnhf.exe
  2⤵
  PID:4020
- C:\Windows\System\bgKihvQ.exe
  C:\Windows\System\bgKihvQ.exe
  2⤵
  PID:4040
- C:\Windows\System\MAzUtKT.exe
  C:\Windows\System\MAzUtKT.exe
  2⤵
  PID:4060
- C:\Windows\System\VumeGwQ.exe
  C:\Windows\System\VumeGwQ.exe
  2⤵
  PID:4080
- C:\Windows\System\NmnNXNf.exe
  C:\Windows\System\NmnNXNf.exe
  2⤵
  PID:1784
- C:\Windows\System\JnzXXGA.exe
  C:\Windows\System\JnzXXGA.exe
  2⤵
  PID:1532
- C:\Windows\System\ZSfRGuj.exe
  C:\Windows\System\ZSfRGuj.exe
  2⤵
  PID:1324
- C:\Windows\System\nrOjIBi.exe
  C:\Windows\System\nrOjIBi.exe
  2⤵
  PID:3040
- C:\Windows\System\kmEoaEM.exe
  C:\Windows\System\kmEoaEM.exe
  2⤵
  PID:2692
- C:\Windows\System\PWtGChL.exe
  C:\Windows\System\PWtGChL.exe
  2⤵
  PID:2908
- C:\Windows\System\hTfXAqE.exe
  C:\Windows\System\hTfXAqE.exe
  2⤵
  PID:3084
- C:\Windows\System\kcdblMw.exe
  C:\Windows\System\kcdblMw.exe
  2⤵
  PID:3124
- C:\Windows\System\RDTHbTx.exe
  C:\Windows\System\RDTHbTx.exe
  2⤵
  PID:3112
- C:\Windows\System\CKguxdQ.exe
  C:\Windows\System\CKguxdQ.exe
  2⤵
  PID:3176
- C:\Windows\System\OVLdQql.exe
  C:\Windows\System\OVLdQql.exe
  2⤵
  PID:3212
- C:\Windows\System\GaNRvOw.exe
  C:\Windows\System\GaNRvOw.exe
  2⤵
  PID:3192
- C:\Windows\System\ijeNogv.exe
  C:\Windows\System\ijeNogv.exe
  2⤵
  PID:3288
- C:\Windows\System\QgsxHmp.exe
  C:\Windows\System\QgsxHmp.exe
  2⤵
  PID:3308
- C:\Windows\System\sTKXMkn.exe
  C:\Windows\System\sTKXMkn.exe
  2⤵
  PID:3336
- C:\Windows\System\uPnSsPL.exe
  C:\Windows\System\uPnSsPL.exe
  2⤵
  PID:3376
- C:\Windows\System\UZCtofp.exe
  C:\Windows\System\UZCtofp.exe
  2⤵
  PID:3388
- C:\Windows\System\GtgDxPY.exe
  C:\Windows\System\GtgDxPY.exe
  2⤵
  PID:3396
- C:\Windows\System\GTDgjQE.exe
  C:\Windows\System\GTDgjQE.exe
  2⤵
  PID:3436
- C:\Windows\System\lfTPvsL.exe
  C:\Windows\System\lfTPvsL.exe
  2⤵
  PID:3496
- C:\Windows\System\jKQgjYh.exe
  C:\Windows\System\jKQgjYh.exe
  2⤵
  PID:3568
- C:\Windows\System\pBRomoX.exe
  C:\Windows\System\pBRomoX.exe
  2⤵
  PID:3552
- C:\Windows\System\UdOXIoD.exe
  C:\Windows\System\UdOXIoD.exe
  2⤵
  PID:3616
- C:\Windows\System\ubFIQsB.exe
  C:\Windows\System\ubFIQsB.exe
  2⤵
  PID:3684
- C:\Windows\System\dGJRFQS.exe
  C:\Windows\System\dGJRFQS.exe
  2⤵
  PID:3596
- C:\Windows\System\vlVOJlh.exe
  C:\Windows\System\vlVOJlh.exe
  2⤵
  PID:3728
- C:\Windows\System\tQHMAuD.exe
  C:\Windows\System\tQHMAuD.exe
  2⤵
  PID:3708
- C:\Windows\System\gkimwlw.exe
  C:\Windows\System\gkimwlw.exe
  2⤵
  PID:3776
- C:\Windows\System\jNOCzCD.exe
  C:\Windows\System\jNOCzCD.exe
  2⤵
  PID:3748
- C:\Windows\System\ZqTbZyP.exe
  C:\Windows\System\ZqTbZyP.exe
  2⤵
  PID:3788
- C:\Windows\System\CIvugYu.exe
  C:\Windows\System\CIvugYu.exe
  2⤵
  PID:3828
- C:\Windows\System\lYvcNwG.exe
  C:\Windows\System\lYvcNwG.exe
  2⤵
  PID:3864
- C:\Windows\System\WlvaxHq.exe
  C:\Windows\System\WlvaxHq.exe
  2⤵
  PID:3932
- C:\Windows\System\ruSsSRi.exe
  C:\Windows\System\ruSsSRi.exe
  2⤵
  PID:3968
- C:\Windows\System\OUFToQJ.exe
  C:\Windows\System\OUFToQJ.exe
  2⤵
  PID:3984
- C:\Windows\System\zhnyEDB.exe
  C:\Windows\System\zhnyEDB.exe
  2⤵
  PID:3996
- C:\Windows\System\IGipcyz.exe
  C:\Windows\System\IGipcyz.exe
  2⤵
  PID:4028
- C:\Windows\System\cEuKTdM.exe
  C:\Windows\System\cEuKTdM.exe
  2⤵
  PID:2444
- C:\Windows\System\eYvjPBg.exe
  C:\Windows\System\eYvjPBg.exe
  2⤵
  PID:4076
- C:\Windows\System\DemHNWW.exe
  C:\Windows\System\DemHNWW.exe
  2⤵
  PID:2316
- C:\Windows\System\YGmKIHC.exe
  C:\Windows\System\YGmKIHC.exe
  2⤵
  PID:832
- C:\Windows\System\zLZSWuf.exe
  C:\Windows\System\zLZSWuf.exe
  2⤵
  PID:1240
- C:\Windows\System\yDQleqk.exe
  C:\Windows\System\yDQleqk.exe
  2⤵
  PID:2756
- C:\Windows\System\OzCPIqW.exe
  C:\Windows\System\OzCPIqW.exe
  2⤵
  PID:3096
- C:\Windows\System\pvoKuSu.exe
  C:\Windows\System\pvoKuSu.exe
  2⤵
  PID:2952
- C:\Windows\System\CtsbMal.exe
  C:\Windows\System\CtsbMal.exe
  2⤵
  PID:3204
- C:\Windows\System\fvjVNei.exe
  C:\Windows\System\fvjVNei.exe
  2⤵
  PID:3216
- C:\Windows\System\uGVAcnu.exe
  C:\Windows\System\uGVAcnu.exe
  2⤵
  PID:3256
- C:\Windows\System\oFtKACt.exe
  C:\Windows\System\oFtKACt.exe
  2⤵
  PID:1552
- C:\Windows\System\NpGhYFN.exe
  C:\Windows\System\NpGhYFN.exe
  2⤵
  PID:3352
- C:\Windows\System\IMMtWEm.exe
  C:\Windows\System\IMMtWEm.exe
  2⤵
  PID:1768
- C:\Windows\System\mwHZAEY.exe
  C:\Windows\System\mwHZAEY.exe
  2⤵
  PID:3452
- C:\Windows\System\PwrlxIr.exe
  C:\Windows\System\PwrlxIr.exe
  2⤵
  PID:2036
- C:\Windows\System\aSIHHKc.exe
  C:\Windows\System\aSIHHKc.exe
  2⤵
  PID:2776
- C:\Windows\System\FGOBHTm.exe
  C:\Windows\System\FGOBHTm.exe
  2⤵
  PID:2220
- C:\Windows\System\brqZCaS.exe
  C:\Windows\System\brqZCaS.exe
  2⤵
  PID:3588
- C:\Windows\System\naJQVAq.exe
  C:\Windows\System\naJQVAq.exe
  2⤵
  PID:3652
- C:\Windows\System\KRczIZX.exe
  C:\Windows\System\KRczIZX.exe
  2⤵
  PID:3672
- C:\Windows\System\FAqIEPS.exe
  C:\Windows\System\FAqIEPS.exe
  2⤵
  PID:3852
- C:\Windows\System\FyIPeGg.exe
  C:\Windows\System\FyIPeGg.exe
  2⤵
  PID:316
- C:\Windows\System\OZWIZcI.exe
  C:\Windows\System\OZWIZcI.exe
  2⤵
  PID:3884
- C:\Windows\System\TrhNqvn.exe
  C:\Windows\System\TrhNqvn.exe
  2⤵
  PID:3892
- C:\Windows\System\vonjkSU.exe
  C:\Windows\System\vonjkSU.exe
  2⤵
  PID:4008
- C:\Windows\System\hRLnZWF.exe
  C:\Windows\System\hRLnZWF.exe
  2⤵
  PID:2028
- C:\Windows\System\ruVWOCz.exe
  C:\Windows\System\ruVWOCz.exe
  2⤵
  PID:4068
- C:\Windows\System\VRbHMiD.exe
  C:\Windows\System\VRbHMiD.exe
  2⤵
  PID:4052
- C:\Windows\System\NtNwosb.exe
  C:\Windows\System\NtNwosb.exe
  2⤵
  PID:680
- C:\Windows\System\gasJKju.exe
  C:\Windows\System\gasJKju.exe
  2⤵
  PID:2460
- C:\Windows\System\Xxkgxre.exe
  C:\Windows\System\Xxkgxre.exe
  2⤵
  PID:1724
- C:\Windows\System\UXxbkhh.exe
  C:\Windows\System\UXxbkhh.exe
  2⤵
  PID:1588
- C:\Windows\System\oWMwXBt.exe
  C:\Windows\System\oWMwXBt.exe
  2⤵
  PID:3152
- C:\Windows\System\DUAarGt.exe
  C:\Windows\System\DUAarGt.exe
  2⤵
  PID:3276
- C:\Windows\System\wmeBgWV.exe
  C:\Windows\System\wmeBgWV.exe
  2⤵
  PID:1964
- C:\Windows\System\eKQbKbn.exe
  C:\Windows\System\eKQbKbn.exe
  2⤵
  PID:3296
- C:\Windows\System\rOPjIyF.exe
  C:\Windows\System\rOPjIyF.exe
  2⤵
  PID:3408
- C:\Windows\System\CKKEklK.exe
  C:\Windows\System\CKKEklK.exe
  2⤵
  PID:3456
- C:\Windows\System\UfHQGmg.exe
  C:\Windows\System\UfHQGmg.exe
  2⤵
  PID:3492
- C:\Windows\System\DGqwwSv.exe
  C:\Windows\System\DGqwwSv.exe
  2⤵
  PID:3556
- C:\Windows\System\UhaFQgV.exe
  C:\Windows\System\UhaFQgV.exe
  2⤵
  PID:3656
- C:\Windows\System\QOJFmyS.exe
  C:\Windows\System\QOJFmyS.exe
  2⤵
  PID:3724
- C:\Windows\System\kJGFajD.exe
  C:\Windows\System\kJGFajD.exe
  2⤵
  PID:3824
- C:\Windows\System\UVRwJYS.exe
  C:\Windows\System\UVRwJYS.exe
  2⤵
  PID:4012
- C:\Windows\System\cHvOQJz.exe
  C:\Windows\System\cHvOQJz.exe
  2⤵
  PID:2992
- C:\Windows\System\mJHPRvq.exe
  C:\Windows\System\mJHPRvq.exe
  2⤵
  PID:4072
- C:\Windows\System\RlvmCFG.exe
  C:\Windows\System\RlvmCFG.exe
  2⤵
  PID:1672
- C:\Windows\System\cbrMbvT.exe
  C:\Windows\System\cbrMbvT.exe
  2⤵
  PID:2192
- C:\Windows\System\hmMhekT.exe
  C:\Windows\System\hmMhekT.exe
  2⤵
  PID:3132
- C:\Windows\System\vUWZZgB.exe
  C:\Windows\System\vUWZZgB.exe
  2⤵
  PID:2936
- C:\Windows\System\idJBzyC.exe
  C:\Windows\System\idJBzyC.exe
  2⤵
  PID:2968
- C:\Windows\System\waGrnrk.exe
  C:\Windows\System\waGrnrk.exe
  2⤵
  PID:2696
- C:\Windows\System\eiBaJmG.exe
  C:\Windows\System\eiBaJmG.exe
  2⤵
  PID:2176
- C:\Windows\System\ncyclqy.exe
  C:\Windows\System\ncyclqy.exe
  2⤵
  PID:3636
- C:\Windows\System\DnLaUdK.exe
  C:\Windows\System\DnLaUdK.exe
  2⤵
  PID:3844
- C:\Windows\System\yXukoUX.exe
  C:\Windows\System\yXukoUX.exe
  2⤵
  PID:3948
- C:\Windows\System\lkZqTWO.exe
  C:\Windows\System\lkZqTWO.exe
  2⤵
  PID:1932
- C:\Windows\System\eAnzacA.exe
  C:\Windows\System\eAnzacA.exe
  2⤵
  PID:3232
- C:\Windows\System\PFiPbBc.exe
  C:\Windows\System\PFiPbBc.exe
  2⤵
  PID:3236
- C:\Windows\System\mbukyFz.exe
  C:\Windows\System\mbukyFz.exe
  2⤵
  PID:1688
- C:\Windows\System\gmhuyXn.exe
  C:\Windows\System\gmhuyXn.exe
  2⤵
  PID:428
- C:\Windows\System\ANfJbfx.exe
  C:\Windows\System\ANfJbfx.exe
  2⤵
  PID:856
- C:\Windows\System\nGJGYWR.exe
  C:\Windows\System\nGJGYWR.exe
  2⤵
  PID:2448
- C:\Windows\System\sAmbFag.exe
  C:\Windows\System\sAmbFag.exe
  2⤵
  PID:3052
- C:\Windows\System\TNNHxgn.exe
  C:\Windows\System\TNNHxgn.exe
  2⤵
  PID:3332
- C:\Windows\System\ANnSzkG.exe
  C:\Windows\System\ANnSzkG.exe
  2⤵
  PID:3372
- C:\Windows\System\rrYCepa.exe
  C:\Windows\System\rrYCepa.exe
  2⤵
  PID:3668
- C:\Windows\System\jcclQdN.exe
  C:\Windows\System\jcclQdN.exe
  2⤵
  PID:2604
- C:\Windows\System\whrFpYA.exe
  C:\Windows\System\whrFpYA.exe
  2⤵
  PID:2652
- C:\Windows\System\MVwpTIh.exe
  C:\Windows\System\MVwpTIh.exe
  2⤵
  PID:668
- C:\Windows\System\dpVQros.exe
  C:\Windows\System\dpVQros.exe
  2⤵
  PID:1020
- C:\Windows\System\rYtsfRX.exe
  C:\Windows\System\rYtsfRX.exe
  2⤵
  PID:1572
- C:\Windows\System\bUNxyjj.exe
  C:\Windows\System\bUNxyjj.exe
  2⤵
  PID:2856
- C:\Windows\System\wqqprlA.exe
  C:\Windows\System\wqqprlA.exe
  2⤵
  PID:1636
- C:\Windows\System\exrqhrS.exe
  C:\Windows\System\exrqhrS.exe
  2⤵
  PID:4116
- C:\Windows\System\VnrBKuM.exe
  C:\Windows\System\VnrBKuM.exe
  2⤵
  PID:4140
- C:\Windows\System\oTVDvyL.exe
  C:\Windows\System\oTVDvyL.exe
  2⤵
  PID:4156
- C:\Windows\System\mmSWmpD.exe
  C:\Windows\System\mmSWmpD.exe
  2⤵
  PID:4172
- C:\Windows\System\VTfLVKH.exe
  C:\Windows\System\VTfLVKH.exe
  2⤵
  PID:4192
- C:\Windows\System\sfqDZan.exe
  C:\Windows\System\sfqDZan.exe
  2⤵
  PID:4208
- C:\Windows\System\wmtuUWm.exe
  C:\Windows\System\wmtuUWm.exe
  2⤵
  PID:4224
- C:\Windows\System\HWcuPLw.exe
  C:\Windows\System\HWcuPLw.exe
  2⤵
  PID:4244
- C:\Windows\System\JDkntZf.exe
  C:\Windows\System\JDkntZf.exe
  2⤵
  PID:4260
- C:\Windows\System\ysnmrsG.exe
  C:\Windows\System\ysnmrsG.exe
  2⤵
  PID:4276
- C:\Windows\System\PkPZumC.exe
  C:\Windows\System\PkPZumC.exe
  2⤵
  PID:4292
- C:\Windows\System\blBElbP.exe
  C:\Windows\System\blBElbP.exe
  2⤵
  PID:4308
- C:\Windows\System\IWkrwyo.exe
  C:\Windows\System\IWkrwyo.exe
  2⤵
  PID:4324
- C:\Windows\System\NWuPXTj.exe
  C:\Windows\System\NWuPXTj.exe
  2⤵
  PID:4340
- C:\Windows\System\ShPrghg.exe
  C:\Windows\System\ShPrghg.exe
  2⤵
  PID:4356
- C:\Windows\System\PfOXQIb.exe
  C:\Windows\System\PfOXQIb.exe
  2⤵
  PID:4372
- C:\Windows\System\adCYkcw.exe
  C:\Windows\System\adCYkcw.exe
  2⤵
  PID:4388
- C:\Windows\System\hwPubyK.exe
  C:\Windows\System\hwPubyK.exe
  2⤵
  PID:4404
- C:\Windows\System\NrtmmwM.exe
  C:\Windows\System\NrtmmwM.exe
  2⤵
  PID:4420
- C:\Windows\System\CuWqxXB.exe
  C:\Windows\System\CuWqxXB.exe
  2⤵
  PID:4436
- C:\Windows\System\KWhOCFz.exe
  C:\Windows\System\KWhOCFz.exe
  2⤵
  PID:4452
- C:\Windows\System\vDvsmOn.exe
  C:\Windows\System\vDvsmOn.exe
  2⤵
  PID:4468
- C:\Windows\System\vOmfAjJ.exe
  C:\Windows\System\vOmfAjJ.exe
  2⤵
  PID:4484
- C:\Windows\System\PimgRks.exe
  C:\Windows\System\PimgRks.exe
  2⤵
  PID:4500
- C:\Windows\System\ltovHjp.exe
  C:\Windows\System\ltovHjp.exe
  2⤵
  PID:4516
- C:\Windows\System\tnBzsgZ.exe
  C:\Windows\System\tnBzsgZ.exe
  2⤵
  PID:4532
- C:\Windows\System\qCFZEip.exe
  C:\Windows\System\qCFZEip.exe
  2⤵
  PID:4548
- C:\Windows\System\ZDohSyz.exe
  C:\Windows\System\ZDohSyz.exe
  2⤵
  PID:4564
- C:\Windows\System\VPABCHj.exe
  C:\Windows\System\VPABCHj.exe
  2⤵
  PID:4580
- C:\Windows\System\wKCvBDq.exe
  C:\Windows\System\wKCvBDq.exe
  2⤵
  PID:4596
- C:\Windows\System\bDCxGDO.exe
  C:\Windows\System\bDCxGDO.exe
  2⤵
  PID:4612
- C:\Windows\System\jYhUfjh.exe
  C:\Windows\System\jYhUfjh.exe
  2⤵
  PID:4628
- C:\Windows\System\ixURXEC.exe
  C:\Windows\System\ixURXEC.exe
  2⤵
  PID:4644
- C:\Windows\System\mvGCCom.exe
  C:\Windows\System\mvGCCom.exe
  2⤵
  PID:4660
- C:\Windows\System\LNpgFwu.exe
  C:\Windows\System\LNpgFwu.exe
  2⤵
  PID:4676
- C:\Windows\System\OAzdoin.exe
  C:\Windows\System\OAzdoin.exe
  2⤵
  PID:4692
- C:\Windows\System\zRyhiUi.exe
  C:\Windows\System\zRyhiUi.exe
  2⤵
  PID:4708
- C:\Windows\System\pbGAkfI.exe
  C:\Windows\System\pbGAkfI.exe
  2⤵
  PID:4724
- C:\Windows\System\FlTZNbI.exe
  C:\Windows\System\FlTZNbI.exe
  2⤵
  PID:4740
- C:\Windows\System\OHhbxqW.exe
  C:\Windows\System\OHhbxqW.exe
  2⤵
  PID:4760
- C:\Windows\System\kozRJls.exe
  C:\Windows\System\kozRJls.exe
  2⤵
  PID:4776
- C:\Windows\System\cJDTPQa.exe
  C:\Windows\System\cJDTPQa.exe
  2⤵
  PID:4792
- C:\Windows\System\AoSAVry.exe
  C:\Windows\System\AoSAVry.exe
  2⤵
  PID:4808
- C:\Windows\System\fOMInXa.exe
  C:\Windows\System\fOMInXa.exe
  2⤵
  PID:4824
- C:\Windows\System\aKKjOXf.exe
  C:\Windows\System\aKKjOXf.exe
  2⤵
  PID:4840
- C:\Windows\System\gYGkPfv.exe
  C:\Windows\System\gYGkPfv.exe
  2⤵
  PID:4856
- C:\Windows\System\bxnIlnG.exe
  C:\Windows\System\bxnIlnG.exe
  2⤵
  PID:4872
- C:\Windows\System\FgixPVy.exe
  C:\Windows\System\FgixPVy.exe
  2⤵
  PID:4888
- C:\Windows\System\BrBtBnA.exe
  C:\Windows\System\BrBtBnA.exe
  2⤵
  PID:4996
- C:\Windows\System\UVHdHMH.exe
  C:\Windows\System\UVHdHMH.exe
  2⤵
  PID:5012
- C:\Windows\System\QcSBjXe.exe
  C:\Windows\System\QcSBjXe.exe
  2⤵
  PID:5032
- C:\Windows\System\xZbbfNz.exe
  C:\Windows\System\xZbbfNz.exe
  2⤵
  PID:5056
- C:\Windows\System\JfctdeZ.exe
  C:\Windows\System\JfctdeZ.exe
  2⤵
  PID:5072
- C:\Windows\System\JnWoPLh.exe
  C:\Windows\System\JnWoPLh.exe
  2⤵
  PID:5088
- C:\Windows\System\cYHCwpM.exe
  C:\Windows\System\cYHCwpM.exe
  2⤵
  PID:5104
- C:\Windows\System\HjyZUHO.exe
  C:\Windows\System\HjyZUHO.exe
  2⤵
  PID:1084
- C:\Windows\System\doWbAQm.exe
  C:\Windows\System\doWbAQm.exe
  2⤵
  PID:4220
- C:\Windows\System\ueUKXsm.exe
  C:\Windows\System\ueUKXsm.exe
  2⤵
  PID:4288
- C:\Windows\System\rPENWEl.exe
  C:\Windows\System\rPENWEl.exe
  2⤵
  PID:1820
- C:\Windows\System\JtyKAGb.exe
  C:\Windows\System\JtyKAGb.exe
  2⤵
  PID:2548
- C:\Windows\System\oEiQNIZ.exe
  C:\Windows\System\oEiQNIZ.exe
  2⤵
  PID:3972
- C:\Windows\System\hyhlagC.exe
  C:\Windows\System\hyhlagC.exe
  2⤵
  PID:1372
- C:\Windows\System\eTYGAAz.exe
  C:\Windows\System\eTYGAAz.exe
  2⤵
  PID:4100
- C:\Windows\System\UehilhY.exe
  C:\Windows\System\UehilhY.exe
  2⤵
  PID:4188
- C:\Windows\System\TRzziUc.exe
  C:\Windows\System\TRzziUc.exe
  2⤵
  PID:4380
- C:\Windows\System\VjNDiGR.exe
  C:\Windows\System\VjNDiGR.exe
  2⤵
  PID:4444
- C:\Windows\System\qyslvtE.exe
  C:\Windows\System\qyslvtE.exe
  2⤵
  PID:4508
- C:\Windows\System\mKcqWpb.exe
  C:\Windows\System\mKcqWpb.exe
  2⤵
  PID:4572
- C:\Windows\System\fwdIqbC.exe
  C:\Windows\System\fwdIqbC.exe
  2⤵
  PID:4636
- C:\Windows\System\MzjjmLm.exe
  C:\Windows\System\MzjjmLm.exe
  2⤵
  PID:4700
- C:\Windows\System\SDgRqFp.exe
  C:\Windows\System\SDgRqFp.exe
  2⤵
  PID:4768
- C:\Windows\System\gNtUHZS.exe
  C:\Windows\System\gNtUHZS.exe
  2⤵
  PID:4832
- C:\Windows\System\nnKNJTt.exe
  C:\Windows\System\nnKNJTt.exe
  2⤵
  PID:4896
- C:\Windows\System\OLXiXrf.exe
  C:\Windows\System\OLXiXrf.exe
  2⤵
  PID:4916
- C:\Windows\System\SnTFgVG.exe
  C:\Windows\System\SnTFgVG.exe
  2⤵
  PID:4932
- C:\Windows\System\QBrHSTl.exe
  C:\Windows\System\QBrHSTl.exe
  2⤵
  PID:1940
- C:\Windows\System\BXPTZjW.exe
  C:\Windows\System\BXPTZjW.exe
  2⤵
  PID:4944
- C:\Windows\System\gIqCfxv.exe
  C:\Windows\System\gIqCfxv.exe
  2⤵
  PID:4960
- C:\Windows\System\kKDKqYD.exe
  C:\Windows\System\kKDKqYD.exe
  2⤵
  PID:4972
- C:\Windows\System\fgtEXoq.exe
  C:\Windows\System\fgtEXoq.exe
  2⤵
  PID:4988
- C:\Windows\System\HDeFefq.exe
  C:\Windows\System\HDeFefq.exe
  2⤵
  PID:3316
- C:\Windows\System\tIJCXgD.exe
  C:\Windows\System\tIJCXgD.exe
  2⤵
  PID:4132
- C:\Windows\System\oMEOnsN.exe
  C:\Windows\System\oMEOnsN.exe
  2⤵
  PID:4200
- C:\Windows\System\jTpBPnu.exe
  C:\Windows\System\jTpBPnu.exe
  2⤵
  PID:4240
- C:\Windows\System\QMaKFZn.exe
  C:\Windows\System\QMaKFZn.exe
  2⤵
  PID:4304
- C:\Windows\System\ListIJC.exe
  C:\Windows\System\ListIJC.exe
  2⤵
  PID:4396
- C:\Windows\System\BnocCsE.exe
  C:\Windows\System\BnocCsE.exe
  2⤵
  PID:4460
- C:\Windows\System\xguXWEu.exe
  C:\Windows\System\xguXWEu.exe
  2⤵
  PID:4524
- C:\Windows\System\TDxpfVu.exe
  C:\Windows\System\TDxpfVu.exe
  2⤵
  PID:4588
- C:\Windows\System\MKjlEhB.exe
  C:\Windows\System\MKjlEhB.exe
  2⤵
  PID:4900
- C:\Windows\System\vtJUAou.exe
  C:\Windows\System\vtJUAou.exe
  2⤵
  PID:4688
- C:\Windows\System\wyXcVvK.exe
  C:\Windows\System\wyXcVvK.exe
  2⤵
  PID:5020
- C:\Windows\System\WhKEYvB.exe
  C:\Windows\System\WhKEYvB.exe
  2⤵
  PID:4816
- C:\Windows\System\buJeRNR.exe
  C:\Windows\System\buJeRNR.exe
  2⤵
  PID:4852
- C:\Windows\System\GuyflWl.exe
  C:\Windows\System\GuyflWl.exe
  2⤵
  PID:5008
- C:\Windows\System\INAXDRZ.exe
  C:\Windows\System\INAXDRZ.exe
  2⤵
  PID:5064
- C:\Windows\System\pgaaMLm.exe
  C:\Windows\System\pgaaMLm.exe
  2⤵
  PID:5084
- C:\Windows\System\wVwrIkF.exe
  C:\Windows\System\wVwrIkF.exe
  2⤵
  PID:5116
- C:\Windows\System\gHmaxfJ.exe
  C:\Windows\System\gHmaxfJ.exe
  2⤵
  PID:4256
- C:\Windows\System\OgYxQgL.exe
  C:\Windows\System\OgYxQgL.exe
  2⤵
  PID:1452
- C:\Windows\System\UtBvwrY.exe
  C:\Windows\System\UtBvwrY.exe
  2⤵
  PID:824
- C:\Windows\System\sPtVNVR.exe
  C:\Windows\System\sPtVNVR.exe
  2⤵
  PID:4112
- C:\Windows\System\WAnvuJB.exe
  C:\Windows\System\WAnvuJB.exe
  2⤵
  PID:4416
- C:\Windows\System\udHNdFL.exe
  C:\Windows\System\udHNdFL.exe
  2⤵
  PID:4540
- C:\Windows\System\XVNWeRi.exe
  C:\Windows\System\XVNWeRi.exe
  2⤵
  PID:2996
- C:\Windows\System\gpRwsML.exe
  C:\Windows\System\gpRwsML.exe
  2⤵
  PID:4980
- C:\Windows\System\gttKYhG.exe
  C:\Windows\System\gttKYhG.exe
  2⤵
  PID:4124
- C:\Windows\System\qgmyTCF.exe
  C:\Windows\System\qgmyTCF.exe
  2⤵
  PID:4272
- C:\Windows\System\RNhvCID.exe
  C:\Windows\System\RNhvCID.exe
  2⤵
  PID:4428
- C:\Windows\System\gjWFtcj.exe
  C:\Windows\System\gjWFtcj.exe
  2⤵
  PID:4556
- C:\Windows\System\JsOvDUE.exe
  C:\Windows\System\JsOvDUE.exe
  2⤵
  PID:4656
- C:\Windows\System\djbgHPF.exe
  C:\Windows\System\djbgHPF.exe
  2⤵
  PID:5080
- C:\Windows\System\oleqDer.exe
  C:\Windows\System\oleqDer.exe
  2⤵
  PID:2632
- C:\Windows\System\lPYQmHW.exe
  C:\Windows\System\lPYQmHW.exe
  2⤵
  PID:3092
- C:\Windows\System\JgvYgkK.exe
  C:\Windows\System\JgvYgkK.exe
  2⤵
  PID:2096
- C:\Windows\System\CywbpLc.exe
  C:\Windows\System\CywbpLc.exe
  2⤵
  PID:4624
- C:\Windows\System\bJImpYw.exe
  C:\Windows\System\bJImpYw.exe
  2⤵
  PID:4216
- C:\Windows\System\cuQOZGW.exe
  C:\Windows\System\cuQOZGW.exe
  2⤵
  PID:4152
- C:\Windows\System\csNSKWg.exe
  C:\Windows\System\csNSKWg.exe
  2⤵
  PID:4668
- C:\Windows\System\AwfDifo.exe
  C:\Windows\System\AwfDifo.exe
  2⤵
  PID:4804
- C:\Windows\System\UXCHJJU.exe
  C:\Windows\System\UXCHJJU.exe
  2⤵
  PID:4336
- C:\Windows\System\hxsFnCi.exe
  C:\Windows\System\hxsFnCi.exe
  2⤵
  PID:4820
- C:\Windows\System\UckRwIm.exe
  C:\Windows\System\UckRwIm.exe
  2⤵
  PID:5048
- C:\Windows\System\uqNQqSw.exe
  C:\Windows\System\uqNQqSw.exe
  2⤵
  PID:2636
- C:\Windows\System\PcsKiAY.exe
  C:\Windows\System\PcsKiAY.exe
  2⤵
  PID:2012
- C:\Windows\System\ozPqgZO.exe
  C:\Windows\System\ozPqgZO.exe
  2⤵
  PID:4756
- C:\Windows\System\tbbFJgG.exe
  C:\Windows\System\tbbFJgG.exe
  2⤵
  PID:2684
- C:\Windows\System\KAoPsdY.exe
  C:\Windows\System\KAoPsdY.exe
  2⤵
  PID:4136
- C:\Windows\System\JMJXnDm.exe
  C:\Windows\System\JMJXnDm.exe
  2⤵
  PID:4952
- C:\Windows\System\QQsDUFx.exe
  C:\Windows\System\QQsDUFx.exe
  2⤵
  PID:4384
- C:\Windows\System\KbCnLdG.exe
  C:\Windows\System\KbCnLdG.exe
  2⤵
  PID:4620
- C:\Windows\System\RaUbXFL.exe
  C:\Windows\System\RaUbXFL.exe
  2⤵
  PID:1540
- C:\Windows\System\IxzGlMg.exe
  C:\Windows\System\IxzGlMg.exe
  2⤵
  PID:4672
- C:\Windows\System\debMuxd.exe
  C:\Windows\System\debMuxd.exe
  2⤵
  PID:5136
- C:\Windows\System\QJYmZnb.exe
  C:\Windows\System\QJYmZnb.exe
  2⤵
  PID:5152
- C:\Windows\System\vLsqTNy.exe
  C:\Windows\System\vLsqTNy.exe
  2⤵
  PID:5168
- C:\Windows\System\wivnMlb.exe
  C:\Windows\System\wivnMlb.exe
  2⤵
  PID:5184
- C:\Windows\System\KrfdxJT.exe
  C:\Windows\System\KrfdxJT.exe
  2⤵
  PID:5200
- C:\Windows\System\emuFRqm.exe
  C:\Windows\System\emuFRqm.exe
  2⤵
  PID:5220
- C:\Windows\System\pGJIpKa.exe
  C:\Windows\System\pGJIpKa.exe
  2⤵
  PID:5236
- C:\Windows\System\pJiOEkA.exe
  C:\Windows\System\pJiOEkA.exe
  2⤵
  PID:5256
- C:\Windows\System\JhNCgUQ.exe
  C:\Windows\System\JhNCgUQ.exe
  2⤵
  PID:5276
- C:\Windows\System\KeEHtGc.exe
  C:\Windows\System\KeEHtGc.exe
  2⤵
  PID:5292
- C:\Windows\System\gkhOtVx.exe
  C:\Windows\System\gkhOtVx.exe
  2⤵
  PID:5308
- C:\Windows\System\dtATnrE.exe
  C:\Windows\System\dtATnrE.exe
  2⤵
  PID:5324
- C:\Windows\System\ICuVxaD.exe
  C:\Windows\System\ICuVxaD.exe
  2⤵
  PID:5340
- C:\Windows\System\koilUxT.exe
  C:\Windows\System\koilUxT.exe
  2⤵
  PID:5356
- C:\Windows\System\zNxmdTK.exe
  C:\Windows\System\zNxmdTK.exe
  2⤵
  PID:5380
- C:\Windows\System\eygYhuh.exe
  C:\Windows\System\eygYhuh.exe
  2⤵
  PID:5396
- C:\Windows\System\NoPGCgC.exe
  C:\Windows\System\NoPGCgC.exe
  2⤵
  PID:5416
- C:\Windows\System\vuXMeEd.exe
  C:\Windows\System\vuXMeEd.exe
  2⤵
  PID:5432
- C:\Windows\System\dFVKDgi.exe
  C:\Windows\System\dFVKDgi.exe
  2⤵
  PID:5448
- C:\Windows\System\fkksWMk.exe
  C:\Windows\System\fkksWMk.exe
  2⤵
  PID:5468
- C:\Windows\System\veCRpMc.exe
  C:\Windows\System\veCRpMc.exe
  2⤵
  PID:5488
- C:\Windows\System\hwNyDjo.exe
  C:\Windows\System\hwNyDjo.exe
  2⤵
  PID:5504
- C:\Windows\System\rxGpDXg.exe
  C:\Windows\System\rxGpDXg.exe
  2⤵
  PID:5520
- C:\Windows\System\ezdZDLW.exe
  C:\Windows\System\ezdZDLW.exe
  2⤵
  PID:5540
- C:\Windows\System\zkelJIF.exe
  C:\Windows\System\zkelJIF.exe
  2⤵
  PID:5556
- C:\Windows\System\BygMCHr.exe
  C:\Windows\System\BygMCHr.exe
  2⤵
  PID:5572
- C:\Windows\System\mRVmHIR.exe
  C:\Windows\System\mRVmHIR.exe
  2⤵
  PID:5592
- C:\Windows\System\CjavoWC.exe
  C:\Windows\System\CjavoWC.exe
  2⤵
  PID:5608
- C:\Windows\System\ZhDSZPu.exe
  C:\Windows\System\ZhDSZPu.exe
  2⤵
  PID:5624
- C:\Windows\System\HsJUlEt.exe
  C:\Windows\System\HsJUlEt.exe
  2⤵
  PID:5644
- C:\Windows\System\NxyYqVS.exe
  C:\Windows\System\NxyYqVS.exe
  2⤵
  PID:5664
- C:\Windows\System\dIiaAxZ.exe
  C:\Windows\System\dIiaAxZ.exe
  2⤵
  PID:5680
- C:\Windows\System\MmOtBTT.exe
  C:\Windows\System\MmOtBTT.exe
  2⤵
  PID:5696
- C:\Windows\System\xNrToCQ.exe
  C:\Windows\System\xNrToCQ.exe
  2⤵
  PID:5720
- C:\Windows\System\knDDZxQ.exe
  C:\Windows\System\knDDZxQ.exe
  2⤵
  PID:5744
- C:\Windows\System\NqZOHDh.exe
  C:\Windows\System\NqZOHDh.exe
  2⤵
  PID:5760
- C:\Windows\System\AKMgjwz.exe
  C:\Windows\System\AKMgjwz.exe
  2⤵
  PID:5780
- C:\Windows\System\FlbhTkn.exe
  C:\Windows\System\FlbhTkn.exe
  2⤵
  PID:5808
- C:\Windows\System\AYYKVlv.exe
  C:\Windows\System\AYYKVlv.exe
  2⤵
  PID:5840
- C:\Windows\System\XSIwjUh.exe
  C:\Windows\System\XSIwjUh.exe
  2⤵
  PID:5868
- C:\Windows\System\ihYLnZY.exe
  C:\Windows\System\ihYLnZY.exe
  2⤵
  PID:5884
- C:\Windows\System\bEiyUrU.exe
  C:\Windows\System\bEiyUrU.exe
  2⤵
  PID:5908
- C:\Windows\System\HQzMDzF.exe
  C:\Windows\System\HQzMDzF.exe
  2⤵
  PID:5940
- C:\Windows\System\xaVkUTs.exe
  C:\Windows\System\xaVkUTs.exe
  2⤵
  PID:5956
- C:\Windows\System\SraOfgz.exe
  C:\Windows\System\SraOfgz.exe
  2⤵
  PID:6016
- C:\Windows\System\okaPhWe.exe
  C:\Windows\System\okaPhWe.exe
  2⤵
  PID:6032
- C:\Windows\System\GBKhorP.exe
  C:\Windows\System\GBKhorP.exe
  2⤵
  PID:6048
- C:\Windows\System\pQcdyuF.exe
  C:\Windows\System\pQcdyuF.exe
  2⤵
  PID:6064
- C:\Windows\System\ZoxnWOI.exe
  C:\Windows\System\ZoxnWOI.exe
  2⤵
  PID:6080
- C:\Windows\System\QNVRwaH.exe
  C:\Windows\System\QNVRwaH.exe
  2⤵
  PID:6096
- C:\Windows\System\yJPeekJ.exe
  C:\Windows\System\yJPeekJ.exe
  2⤵
  PID:6112
- C:\Windows\System\gacMWGi.exe
  C:\Windows\System\gacMWGi.exe
  2⤵
  PID:6128
- C:\Windows\System\nJJCtbQ.exe
  C:\Windows\System\nJJCtbQ.exe
  2⤵
  PID:5144
- C:\Windows\System\LAfOJVw.exe
  C:\Windows\System\LAfOJVw.exe
  2⤵
  PID:4864
- C:\Windows\System\XoNYSZj.exe
  C:\Windows\System\XoNYSZj.exe
  2⤵
  PID:5208
- C:\Windows\System\tKjGbXq.exe
  C:\Windows\System\tKjGbXq.exe
  2⤵
  PID:5252
- C:\Windows\System\NzAbuzm.exe
  C:\Windows\System\NzAbuzm.exe
  2⤵
  PID:5320
- C:\Windows\System\XYCDqTb.exe
  C:\Windows\System\XYCDqTb.exe
  2⤵
  PID:5392
- C:\Windows\System\NCEEKns.exe
  C:\Windows\System\NCEEKns.exe
  2⤵
  PID:5496
- C:\Windows\System\cFnMfnQ.exe
  C:\Windows\System\cFnMfnQ.exe
  2⤵
  PID:5536
- C:\Windows\System\zentjIs.exe
  C:\Windows\System\zentjIs.exe
  2⤵
  PID:5604
- C:\Windows\System\DAfKTLM.exe
  C:\Windows\System\DAfKTLM.exe
  2⤵
  PID:5672
- C:\Windows\System\RQAjOvF.exe
  C:\Windows\System\RQAjOvF.exe
  2⤵
  PID:5052
- C:\Windows\System\IoBLlXw.exe
  C:\Windows\System\IoBLlXw.exe
  2⤵
  PID:5192
- C:\Windows\System\QRdACkh.exe
  C:\Windows\System\QRdACkh.exe
  2⤵
  PID:5264
- C:\Windows\System\CEchjLn.exe
  C:\Windows\System\CEchjLn.exe
  2⤵
  PID:5304
- C:\Windows\System\wluUvJG.exe
  C:\Windows\System\wluUvJG.exe
  2⤵
  PID:5368
- C:\Windows\System\aRSurFq.exe
  C:\Windows\System\aRSurFq.exe
  2⤵
  PID:5704
- C:\Windows\System\xtARBNq.exe
  C:\Windows\System\xtARBNq.exe
  2⤵
  PID:5444
- C:\Windows\System\NErKqYo.exe
  C:\Windows\System\NErKqYo.exe
  2⤵
  PID:5548
- C:\Windows\System\BgobqMd.exe
  C:\Windows\System\BgobqMd.exe
  2⤵
  PID:4968
- C:\Windows\System\eZGOMLH.exe
  C:\Windows\System\eZGOMLH.exe
  2⤵
  PID:5228
- C:\Windows\System\zRrJfQJ.exe
  C:\Windows\System\zRrJfQJ.exe
  2⤵
  PID:5580
- C:\Windows\System\DCKivLs.exe
  C:\Windows\System\DCKivLs.exe
  2⤵
  PID:5652
- C:\Windows\System\ODNPzWR.exe
  C:\Windows\System\ODNPzWR.exe
  2⤵
  PID:5716
- C:\Windows\System\RBNppYb.exe
  C:\Windows\System\RBNppYb.exe
  2⤵
  PID:5616
- C:\Windows\System\XkwBEfp.exe
  C:\Windows\System\XkwBEfp.exe
  2⤵
  PID:5736
- C:\Windows\System\CAjcJca.exe
  C:\Windows\System\CAjcJca.exe
  2⤵
  PID:5816
- C:\Windows\System\LcRhiVh.exe
  C:\Windows\System\LcRhiVh.exe
  2⤵
  PID:5848
- C:\Windows\System\MiHQzZG.exe
  C:\Windows\System\MiHQzZG.exe
  2⤵
  PID:5856
- C:\Windows\System\IxxMHgy.exe
  C:\Windows\System\IxxMHgy.exe
  2⤵
  PID:5824
- C:\Windows\System\RmLNMgh.exe
  C:\Windows\System\RmLNMgh.exe
  2⤵
  PID:5836
- C:\Windows\System\SxPBAem.exe
  C:\Windows\System\SxPBAem.exe
  2⤵
  PID:5880
- C:\Windows\System\oAWOpca.exe
  C:\Windows\System\oAWOpca.exe
  2⤵
  PID:5948
- C:\Windows\System\FvpzwTZ.exe
  C:\Windows\System\FvpzwTZ.exe
  2⤵
  PID:5976
- C:\Windows\System\gtfFqnz.exe
  C:\Windows\System\gtfFqnz.exe
  2⤵
  PID:5984
- C:\Windows\System\ZZOdZBt.exe
  C:\Windows\System\ZZOdZBt.exe
  2⤵
  PID:6000
- C:\Windows\System\rzEtwBx.exe
  C:\Windows\System\rzEtwBx.exe
  2⤵
  PID:6012
- C:\Windows\System\BCikNkK.exe
  C:\Windows\System\BCikNkK.exe
  2⤵
  PID:6088
- C:\Windows\System\rMuqxQo.exe
  C:\Windows\System\rMuqxQo.exe
  2⤵
  PID:4492
- C:\Windows\System\XANVzUe.exe
  C:\Windows\System\XANVzUe.exe
  2⤵
  PID:6040
- C:\Windows\System\occckLr.exe
  C:\Windows\System\occckLr.exe
  2⤵
  PID:6076
- C:\Windows\System\yRTMCtS.exe
  C:\Windows\System\yRTMCtS.exe
  2⤵
  PID:6104
- C:\Windows\System\zZvrVOG.exe
  C:\Windows\System\zZvrVOG.exe
  2⤵
  PID:5456
- C:\Windows\System\AQUUmtP.exe
  C:\Windows\System\AQUUmtP.exe
  2⤵
  PID:5176
- C:\Windows\System\pXeohqY.exe
  C:\Windows\System\pXeohqY.exe
  2⤵
  PID:4788
- C:\Windows\System\SglWpft.exe
  C:\Windows\System\SglWpft.exe
  2⤵
  PID:5600
- C:\Windows\System\NjYZEeR.exe
  C:\Windows\System\NjYZEeR.exe
  2⤵
  PID:5568
- C:\Windows\System\gUjdFGW.exe
  C:\Windows\System\gUjdFGW.exe
  2⤵
  PID:5408
- C:\Windows\System\zWsrgtc.exe
  C:\Windows\System\zWsrgtc.exe
  2⤵
  PID:5160
- C:\Windows\System\PIXtPGB.exe
  C:\Windows\System\PIXtPGB.exe
  2⤵
  PID:5364
- C:\Windows\System\MdcQSII.exe
  C:\Windows\System\MdcQSII.exe
  2⤵
  PID:4880
- C:\Windows\System\vBnAITX.exe
  C:\Windows\System\vBnAITX.exe
  2⤵
  PID:5660
- C:\Windows\System\lwEcHLG.exe
  C:\Windows\System\lwEcHLG.exe
  2⤵
  PID:5772
- C:\Windows\System\RvhENMK.exe
  C:\Windows\System\RvhENMK.exe
  2⤵
  PID:5388
- C:\Windows\System\QMKaedr.exe
  C:\Windows\System\QMKaedr.exe
  2⤵
  PID:5832
- C:\Windows\System\SlyjnTN.exe
  C:\Windows\System\SlyjnTN.exe
  2⤵
  PID:5952
- C:\Windows\System\UOPmhNd.exe
  C:\Windows\System\UOPmhNd.exe
  2⤵
  PID:5180
- C:\Windows\System\zQNyJhL.exe
  C:\Windows\System\zQNyJhL.exe
  2⤵
  PID:5164
- C:\Windows\System\BHUDaBD.exe
  C:\Windows\System\BHUDaBD.exe
  2⤵
  PID:5196
- C:\Windows\System\qJVRuvp.exe
  C:\Windows\System\qJVRuvp.exe
  2⤵
  PID:5996
- C:\Windows\System\mdhqAbZ.exe
  C:\Windows\System\mdhqAbZ.exe
  2⤵
  PID:5828
- C:\Windows\System\voQVnDf.exe
  C:\Windows\System\voQVnDf.exe
  2⤵
  PID:5352
- C:\Windows\System\fHdhtVo.exe
  C:\Windows\System\fHdhtVo.exe
  2⤵
  PID:6108
- C:\Windows\System\GcORvDw.exe
  C:\Windows\System\GcORvDw.exe
  2⤵
  PID:5756
- C:\Windows\System\vMiontU.exe
  C:\Windows\System\vMiontU.exe
  2⤵
  PID:5864
- C:\Windows\System\BmqJJYN.exe
  C:\Windows\System\BmqJJYN.exe
  2⤵
  PID:5288
- C:\Windows\System\EnILZEH.exe
  C:\Windows\System\EnILZEH.exe
  2⤵
  PID:5284
- C:\Windows\System\XHdrcsR.exe
  C:\Windows\System\XHdrcsR.exe
  2⤵
  PID:5132
- C:\Windows\System\DUGcvBL.exe
  C:\Windows\System\DUGcvBL.exe
  2⤵
  PID:5992
- C:\Windows\System\IebcnCb.exe
  C:\Windows\System\IebcnCb.exe
  2⤵
  PID:5768
- C:\Windows\System\lWCHylD.exe
  C:\Windows\System\lWCHylD.exe
  2⤵
  PID:5712
- C:\Windows\System\iTQavBN.exe
  C:\Windows\System\iTQavBN.exe
  2⤵
  PID:5804
- C:\Windows\System\Fualvkw.exe
  C:\Windows\System\Fualvkw.exe
  2⤵
  PID:6156
- C:\Windows\System\OyTRrVR.exe
  C:\Windows\System\OyTRrVR.exe
  2⤵
  PID:6176
- C:\Windows\System\OPewuFr.exe
  C:\Windows\System\OPewuFr.exe
  2⤵
  PID:6192
- C:\Windows\System\sPcwjBR.exe
  C:\Windows\System\sPcwjBR.exe
  2⤵
  PID:6208
- C:\Windows\System\ocBGTue.exe
  C:\Windows\System\ocBGTue.exe
  2⤵
  PID:6224
- C:\Windows\System\ByiFGgq.exe
  C:\Windows\System\ByiFGgq.exe
  2⤵
  PID:6244
- C:\Windows\System\bVNmKXe.exe
  C:\Windows\System\bVNmKXe.exe
  2⤵
  PID:6260
- C:\Windows\System\PtmWaHG.exe
  C:\Windows\System\PtmWaHG.exe
  2⤵
  PID:6276
- C:\Windows\System\dOgQlau.exe
  C:\Windows\System\dOgQlau.exe
  2⤵
  PID:6296
- C:\Windows\System\ErGgiNs.exe
  C:\Windows\System\ErGgiNs.exe
  2⤵
  PID:6312
- C:\Windows\System\FRbyLSy.exe
  C:\Windows\System\FRbyLSy.exe
  2⤵
  PID:6328
- C:\Windows\System\BjvUUpK.exe
  C:\Windows\System\BjvUUpK.exe
  2⤵
  PID:6344
- C:\Windows\System\idHhOKm.exe
  C:\Windows\System\idHhOKm.exe
  2⤵
  PID:6364
- C:\Windows\System\jkPATJH.exe
  C:\Windows\System\jkPATJH.exe
  2⤵
  PID:6468
- C:\Windows\System\kjlIFDG.exe
  C:\Windows\System\kjlIFDG.exe
  2⤵
  PID:6484
- C:\Windows\System\bWLcgpx.exe
  C:\Windows\System\bWLcgpx.exe
  2⤵
  PID:6504
- C:\Windows\System\zFBPJee.exe
  C:\Windows\System\zFBPJee.exe
  2⤵
  PID:6520
- C:\Windows\System\OrzkdgO.exe
  C:\Windows\System\OrzkdgO.exe
  2⤵
  PID:6536
- C:\Windows\System\ROyjdoJ.exe
  C:\Windows\System\ROyjdoJ.exe
  2⤵
  PID:6556
- C:\Windows\System\jgyGQWW.exe
  C:\Windows\System\jgyGQWW.exe
  2⤵
  PID:6572
- C:\Windows\System\dTSHKnJ.exe
  C:\Windows\System\dTSHKnJ.exe
  2⤵
  PID:6588
- C:\Windows\System\ZNyOHSr.exe
  C:\Windows\System\ZNyOHSr.exe
  2⤵
  PID:6604
- C:\Windows\System\qmDxniU.exe
  C:\Windows\System\qmDxniU.exe
  2⤵
  PID:6620
- C:\Windows\System\dgHosVX.exe
  C:\Windows\System\dgHosVX.exe
  2⤵
  PID:6636
- C:\Windows\System\XsvdzlI.exe
  C:\Windows\System\XsvdzlI.exe
  2⤵
  PID:6652
- C:\Windows\System\TMJrAVi.exe
  C:\Windows\System\TMJrAVi.exe
  2⤵
  PID:6668
- C:\Windows\System\uubnIcy.exe
  C:\Windows\System\uubnIcy.exe
  2⤵
  PID:6684
- C:\Windows\System\TXbfucc.exe
  C:\Windows\System\TXbfucc.exe
  2⤵
  PID:6700
- C:\Windows\System\PoXiOOv.exe
  C:\Windows\System\PoXiOOv.exe
  2⤵
  PID:6716
- C:\Windows\System\NPNjhyj.exe
  C:\Windows\System\NPNjhyj.exe
  2⤵
  PID:6732
- C:\Windows\System\BicjFED.exe
  C:\Windows\System\BicjFED.exe
  2⤵
  PID:6748
- C:\Windows\System\wCAVuST.exe
  C:\Windows\System\wCAVuST.exe
  2⤵
  PID:6764
- C:\Windows\System\wQVZYcB.exe
  C:\Windows\System\wQVZYcB.exe
  2⤵
  PID:6780
- C:\Windows\System\rTnbmZV.exe
  C:\Windows\System\rTnbmZV.exe
  2⤵
  PID:6796
- C:\Windows\System\ZwQFgdM.exe
  C:\Windows\System\ZwQFgdM.exe
  2⤵
  PID:6816
- C:\Windows\System\nLHrwMv.exe
  C:\Windows\System\nLHrwMv.exe
  2⤵
  PID:6832
- C:\Windows\System\pPUYruK.exe
  C:\Windows\System\pPUYruK.exe
  2⤵
  PID:6848
- C:\Windows\System\RtEStQg.exe
  C:\Windows\System\RtEStQg.exe
  2⤵
  PID:6864
- C:\Windows\System\AetdCKW.exe
  C:\Windows\System\AetdCKW.exe
  2⤵
  PID:6880
- C:\Windows\System\NooLUsR.exe
  C:\Windows\System\NooLUsR.exe
  2⤵
  PID:6900
- C:\Windows\System\kJdjogE.exe
  C:\Windows\System\kJdjogE.exe
  2⤵
  PID:6916
- C:\Windows\System\GLLhBkG.exe
  C:\Windows\System\GLLhBkG.exe
  2⤵
  PID:6932
- C:\Windows\System\pHXWImz.exe
  C:\Windows\System\pHXWImz.exe
  2⤵
  PID:6948
- C:\Windows\System\wDPMBPO.exe
  C:\Windows\System\wDPMBPO.exe
  2⤵
  PID:6964
- C:\Windows\System\fAVOLNy.exe
  C:\Windows\System\fAVOLNy.exe
  2⤵
  PID:6980
- C:\Windows\System\yswlKwY.exe
  C:\Windows\System\yswlKwY.exe
  2⤵
  PID:6996
- C:\Windows\System\RuGUZzN.exe
  C:\Windows\System\RuGUZzN.exe
  2⤵
  PID:7012
- C:\Windows\System\UhPGWJx.exe
  C:\Windows\System\UhPGWJx.exe
  2⤵
  PID:7028
- C:\Windows\System\ZuAUVkf.exe
  C:\Windows\System\ZuAUVkf.exe
  2⤵
  PID:7044
- C:\Windows\System\AaMcNAd.exe
  C:\Windows\System\AaMcNAd.exe
  2⤵
  PID:7060
- C:\Windows\System\vZUSadN.exe
  C:\Windows\System\vZUSadN.exe
  2⤵
  PID:7076
- C:\Windows\System\GhgTQud.exe
  C:\Windows\System\GhgTQud.exe
  2⤵
  PID:7092
- C:\Windows\System\vqbeIfM.exe
  C:\Windows\System\vqbeIfM.exe
  2⤵
  PID:7108
- C:\Windows\System\PACqjFi.exe
  C:\Windows\System\PACqjFi.exe
  2⤵
  PID:7124
- C:\Windows\System\ODVczzk.exe
  C:\Windows\System\ODVczzk.exe
  2⤵
  PID:7140
- C:\Windows\System\sjklPCf.exe
  C:\Windows\System\sjklPCf.exe
  2⤵
  PID:7156
- C:\Windows\System\bBeBfhj.exe
  C:\Windows\System\bBeBfhj.exe
  2⤵
  PID:5916
- C:\Windows\System\DBwiSfk.exe
  C:\Windows\System\DBwiSfk.exe
  2⤵
  PID:5316
- C:\Windows\System\adwnGUr.exe
  C:\Windows\System\adwnGUr.exe
  2⤵
  PID:6152
- C:\Windows\System\rTaQfhW.exe
  C:\Windows\System\rTaQfhW.exe
  2⤵
  PID:6220
- C:\Windows\System\JwelkSK.exe
  C:\Windows\System\JwelkSK.exe
  2⤵
  PID:6292
- C:\Windows\System\EFFipmB.exe
  C:\Windows\System\EFFipmB.exe
  2⤵
  PID:6272
- C:\Windows\System\rdvQnbF.exe
  C:\Windows\System\rdvQnbF.exe
  2⤵
  PID:5480
- C:\Windows\System\BaSjAdT.exe
  C:\Windows\System\BaSjAdT.exe
  2⤵
  PID:5936
- C:\Windows\System\MqpyKfQ.exe
  C:\Windows\System\MqpyKfQ.exe
  2⤵
  PID:6164
- C:\Windows\System\YaXQqep.exe
  C:\Windows\System\YaXQqep.exe
  2⤵
  PID:6236
- C:\Windows\System\eaUrNNf.exe
  C:\Windows\System\eaUrNNf.exe
  2⤵
  PID:5732
- C:\Windows\System\qHCYpWY.exe
  C:\Windows\System\qHCYpWY.exe
  2⤵
  PID:6352
- C:\Windows\System\oZEbioU.exe
  C:\Windows\System\oZEbioU.exe
  2⤵
  PID:5532
- C:\Windows\System\vPaaxdT.exe
  C:\Windows\System\vPaaxdT.exe
  2⤵
  PID:6336
- C:\Windows\System\YzjNCOo.exe
  C:\Windows\System\YzjNCOo.exe
  2⤵
  PID:6388
- C:\Windows\System\fkhgheD.exe
  C:\Windows\System\fkhgheD.exe
  2⤵
  PID:6408
- C:\Windows\System\jzNHUEG.exe
  C:\Windows\System\jzNHUEG.exe
  2⤵
  PID:6024
- C:\Windows\System\nfwJslE.exe
  C:\Windows\System\nfwJslE.exe
  2⤵
  PID:6432
- C:\Windows\System\yYuHnKE.exe
  C:\Windows\System\yYuHnKE.exe
  2⤵
  PID:6448
- C:\Windows\System\dcHDHCD.exe
  C:\Windows\System\dcHDHCD.exe
  2⤵
  PID:6480
- C:\Windows\System\FDcuWwH.exe
  C:\Windows\System\FDcuWwH.exe
  2⤵
  PID:6616
- C:\Windows\System\NCtAizW.exe
  C:\Windows\System\NCtAizW.exe
  2⤵
  PID:6740
- C:\Windows\System\VSMzSOM.exe
  C:\Windows\System\VSMzSOM.exe
  2⤵
  PID:6776
- C:\Windows\System\xYsqBiW.exe
  C:\Windows\System\xYsqBiW.exe
  2⤵
  PID:6596
- C:\Windows\System\CwDtium.exe
  C:\Windows\System\CwDtium.exe
  2⤵
  PID:6500
- C:\Windows\System\ogPBMju.exe
  C:\Windows\System\ogPBMju.exe
  2⤵
  PID:6660
- C:\Windows\System\aIbPVhN.exe
  C:\Windows\System\aIbPVhN.exe
  2⤵
  PID:6756
- C:\Windows\System\eNrRUby.exe
  C:\Windows\System\eNrRUby.exe
  2⤵
  PID:6496
- C:\Windows\System\aCyLXdP.exe
  C:\Windows\System\aCyLXdP.exe
  2⤵
  PID:6844
- C:\Windows\System\QxNjgop.exe
  C:\Windows\System\QxNjgop.exe
  2⤵
  PID:6856
- C:\Windows\System\nUEfMsF.exe
  C:\Windows\System\nUEfMsF.exe
  2⤵
  PID:6896
- C:\Windows\System\VChjMNc.exe
  C:\Windows\System\VChjMNc.exe
  2⤵
  PID:6944
- C:\Windows\System\kaSkBgk.exe
  C:\Windows\System\kaSkBgk.exe
  2⤵
  PID:6956
- C:\Windows\System\tPxCDqE.exe
  C:\Windows\System\tPxCDqE.exe
  2⤵
  PID:7004
- C:\Windows\System\wRHSOyC.exe
  C:\Windows\System\wRHSOyC.exe
  2⤵
  PID:7036
- C:\Windows\System\BKIiIJG.exe
  C:\Windows\System\BKIiIJG.exe
  2⤵
  PID:7100
- C:\Windows\System\euMNufE.exe
  C:\Windows\System\euMNufE.exe
  2⤵
  PID:7164
- C:\Windows\System\GjjDYUd.exe
  C:\Windows\System\GjjDYUd.exe
  2⤵
  PID:6184
- C:\Windows\System\reoSHbp.exe
  C:\Windows\System\reoSHbp.exe
  2⤵
  PID:5128
- C:\Windows\System\EDVwVIq.exe
  C:\Windows\System\EDVwVIq.exe
  2⤵
  PID:7024
- C:\Windows\System\OUxSjbz.exe
  C:\Windows\System\OUxSjbz.exe
  2⤵
  PID:6168
- C:\Windows\System\LKjkbBK.exe
  C:\Windows\System\LKjkbBK.exe
  2⤵
  PID:5244
- C:\Windows\System\IGngrlW.exe
  C:\Windows\System\IGngrlW.exe
  2⤵
  PID:7120
- C:\Windows\System\FoHkbet.exe
  C:\Windows\System\FoHkbet.exe
  2⤵
  PID:6216
- C:\Windows\System\lgqiUCX.exe
  C:\Windows\System\lgqiUCX.exe
  2⤵
  PID:6320
- C:\Windows\System\CxZTEWI.exe
  C:\Windows\System\CxZTEWI.exe
  2⤵
  PID:7148
- C:\Windows\System\jKTvlQZ.exe
  C:\Windows\System\jKTvlQZ.exe
  2⤵
  PID:6308
- C:\Windows\System\MvRFmTd.exe
  C:\Windows\System\MvRFmTd.exe
  2⤵
  PID:6400
- C:\Windows\System\iXpUwxk.exe
  C:\Windows\System\iXpUwxk.exe
  2⤵
  PID:6460
- C:\Windows\System\kzATIMx.exe
  C:\Windows\System\kzATIMx.exe
  2⤵
  PID:6476
- C:\Windows\System\PpVBywW.exe
  C:\Windows\System\PpVBywW.exe
  2⤵
  PID:6612
- C:\Windows\System\SeDyrng.exe
  C:\Windows\System\SeDyrng.exe
  2⤵
  PID:6696
- C:\Windows\System\wgPymDg.exe
  C:\Windows\System\wgPymDg.exe
  2⤵
  PID:6840
- C:\Windows\System\wUiLHsr.exe
  C:\Windows\System\wUiLHsr.exe
  2⤵
  PID:6976
- C:\Windows\System\hZksrLC.exe
  C:\Windows\System\hZksrLC.exe
  2⤵
  PID:7136
- C:\Windows\System\eBvGhEr.exe
  C:\Windows\System\eBvGhEr.exe
  2⤵
  PID:7052
- C:\Windows\System\XIkaCoJ.exe
  C:\Windows\System\XIkaCoJ.exe
  2⤵
  PID:7084
- C:\Windows\System\cFEMvLS.exe
  C:\Windows\System\cFEMvLS.exe
  2⤵
  PID:6252
- C:\Windows\System\PqjmRHD.exe
  C:\Windows\System\PqjmRHD.exe
  2⤵
  PID:6724
- C:\Windows\System\RfoQVId.exe
  C:\Windows\System\RfoQVId.exe
  2⤵
  PID:6824
- C:\Windows\System\wVNnKuR.exe
  C:\Windows\System\wVNnKuR.exe
  2⤵
  PID:7008
- C:\Windows\System\sjnkgYC.exe
  C:\Windows\System\sjnkgYC.exe
  2⤵
  PID:6680
- C:\Windows\System\BPuNXZz.exe
  C:\Windows\System\BPuNXZz.exe
  2⤵
  PID:6580
- C:\Windows\System\DZggyDO.exe
  C:\Windows\System\DZggyDO.exe
  2⤵
  PID:6912
- C:\Windows\System\gEsubuL.exe
  C:\Windows\System\gEsubuL.exe
  2⤵
  PID:6444
- C:\Windows\System\UInSNxq.exe
  C:\Windows\System\UInSNxq.exe
  2⤵
  PID:7172
- C:\Windows\System\dDToWUP.exe
  C:\Windows\System\dDToWUP.exe
  2⤵
  PID:7188
- C:\Windows\System\mQUPIyJ.exe
  C:\Windows\System\mQUPIyJ.exe
  2⤵
  PID:7204
- C:\Windows\System\eEvALmQ.exe
  C:\Windows\System\eEvALmQ.exe
  2⤵
  PID:7220
- C:\Windows\System\CaqbJbT.exe
  C:\Windows\System\CaqbJbT.exe
  2⤵
  PID:7236
- C:\Windows\System\FGFYSvO.exe
  C:\Windows\System\FGFYSvO.exe
  2⤵
  PID:7252
- C:\Windows\System\FhmBRiq.exe
  C:\Windows\System\FhmBRiq.exe
  2⤵
  PID:7268
- C:\Windows\System\VNiHdGo.exe
  C:\Windows\System\VNiHdGo.exe
  2⤵
  PID:7284
- C:\Windows\System\CDAIixI.exe
  C:\Windows\System\CDAIixI.exe
  2⤵
  PID:7300
- C:\Windows\System\pEthYar.exe
  C:\Windows\System\pEthYar.exe
  2⤵
  PID:7316
- C:\Windows\System\wRHWVSa.exe
  C:\Windows\System\wRHWVSa.exe
  2⤵
  PID:7332
- C:\Windows\System\ITpuAkw.exe
  C:\Windows\System\ITpuAkw.exe
  2⤵
  PID:7348
- C:\Windows\System\ffkGEcZ.exe
  C:\Windows\System\ffkGEcZ.exe
  2⤵
  PID:7364
- C:\Windows\System\hNqPkYI.exe
  C:\Windows\System\hNqPkYI.exe
  2⤵
  PID:7380
- C:\Windows\System\QjvSgxx.exe
  C:\Windows\System\QjvSgxx.exe
  2⤵
  PID:7396
- C:\Windows\System\mfcqNfT.exe
  C:\Windows\System\mfcqNfT.exe
  2⤵
  PID:7412
- C:\Windows\System\FETYVXu.exe
  C:\Windows\System\FETYVXu.exe
  2⤵
  PID:7428
- C:\Windows\System\loPAbbT.exe
  C:\Windows\System\loPAbbT.exe
  2⤵
  PID:7444
- C:\Windows\System\gxYhhtW.exe
  C:\Windows\System\gxYhhtW.exe
  2⤵
  PID:7460
- C:\Windows\System\FyqJzZu.exe
  C:\Windows\System\FyqJzZu.exe
  2⤵
  PID:7476
- C:\Windows\System\wUrbZTV.exe
  C:\Windows\System\wUrbZTV.exe
  2⤵
  PID:7492
- C:\Windows\System\hpHcgcD.exe
  C:\Windows\System\hpHcgcD.exe
  2⤵
  PID:7508
- C:\Windows\System\IYbTerg.exe
  C:\Windows\System\IYbTerg.exe
  2⤵
  PID:7524
- C:\Windows\System\fafDOiz.exe
  C:\Windows\System\fafDOiz.exe
  2⤵
  PID:7540
- C:\Windows\System\yWHoUtU.exe
  C:\Windows\System\yWHoUtU.exe
  2⤵
  PID:7556
- C:\Windows\System\tcbHMHu.exe
  C:\Windows\System\tcbHMHu.exe
  2⤵
  PID:7576
- C:\Windows\System\pQhvJbh.exe
  C:\Windows\System\pQhvJbh.exe
  2⤵
  PID:7592
- C:\Windows\System\KZPeSdQ.exe
  C:\Windows\System\KZPeSdQ.exe
  2⤵
  PID:7612
- C:\Windows\System\wDXVXgf.exe
  C:\Windows\System\wDXVXgf.exe
  2⤵
  PID:7628
- C:\Windows\System\XrtbDlh.exe
  C:\Windows\System\XrtbDlh.exe
  2⤵
  PID:7644
- C:\Windows\System\bQXLXmm.exe
  C:\Windows\System\bQXLXmm.exe
  2⤵
  PID:7660
- C:\Windows\System\ugELnbg.exe
  C:\Windows\System\ugELnbg.exe
  2⤵
  PID:7676
- C:\Windows\System\KkGWuGi.exe
  C:\Windows\System\KkGWuGi.exe
  2⤵
  PID:7692
- C:\Windows\System\dEgBsGO.exe
  C:\Windows\System\dEgBsGO.exe
  2⤵
  PID:7712
- C:\Windows\System\CCKYAVn.exe
  C:\Windows\System\CCKYAVn.exe
  2⤵
  PID:7728
- C:\Windows\System\lFFDHjf.exe
  C:\Windows\System\lFFDHjf.exe
  2⤵
  PID:7744
- C:\Windows\System\JWaqmwb.exe
  C:\Windows\System\JWaqmwb.exe
  2⤵
  PID:7760
- C:\Windows\System\orvzbZN.exe
  C:\Windows\System\orvzbZN.exe
  2⤵
  PID:7776
- C:\Windows\System\Nopckgs.exe
  C:\Windows\System\Nopckgs.exe
  2⤵
  PID:7872
- C:\Windows\System\lfEraLS.exe
  C:\Windows\System\lfEraLS.exe
  2⤵
  PID:7900
- C:\Windows\System\DCBUeVe.exe
  C:\Windows\System\DCBUeVe.exe
  2⤵
  PID:7916
- C:\Windows\System\VkVLlqw.exe
  C:\Windows\System\VkVLlqw.exe
  2⤵
  PID:7936
- C:\Windows\System\zWrrvoD.exe
  C:\Windows\System\zWrrvoD.exe
  2⤵
  PID:7952
- C:\Windows\System\gLhmqQi.exe
  C:\Windows\System\gLhmqQi.exe
  2⤵
  PID:7968
- C:\Windows\System\lYUYTVA.exe
  C:\Windows\System\lYUYTVA.exe
  2⤵
  PID:7984
- C:\Windows\System\lUWkqmW.exe
  C:\Windows\System\lUWkqmW.exe
  2⤵
  PID:8000
- C:\Windows\System\ktsXVcd.exe
  C:\Windows\System\ktsXVcd.exe
  2⤵
  PID:8016
- C:\Windows\System\CxPRcfF.exe
  C:\Windows\System\CxPRcfF.exe
  2⤵
  PID:8032
- C:\Windows\System\etpTiQT.exe
  C:\Windows\System\etpTiQT.exe
  2⤵
  PID:8048
- C:\Windows\System\HVlkQYB.exe
  C:\Windows\System\HVlkQYB.exe
  2⤵
  PID:8064
- C:\Windows\System\PGgrAqs.exe
  C:\Windows\System\PGgrAqs.exe
  2⤵
  PID:8080
- C:\Windows\System\BmtYSHl.exe
  C:\Windows\System\BmtYSHl.exe
  2⤵
  PID:8108
- C:\Windows\System\hunFTSj.exe
  C:\Windows\System\hunFTSj.exe
  2⤵
  PID:8124
- C:\Windows\System\xGuHCTp.exe
  C:\Windows\System\xGuHCTp.exe
  2⤵
  PID:8144
- C:\Windows\System\jbadgjp.exe
  C:\Windows\System\jbadgjp.exe
  2⤵
  PID:8160
- C:\Windows\System\idWQpVY.exe
  C:\Windows\System\idWQpVY.exe
  2⤵
  PID:8176
- C:\Windows\System\MmEuaxq.exe
  C:\Windows\System\MmEuaxq.exe
  2⤵
  PID:7180
- C:\Windows\System\oaBRFRu.exe
  C:\Windows\System\oaBRFRu.exe
  2⤵
  PID:6632
- C:\Windows\System\AuganqG.exe
  C:\Windows\System\AuganqG.exe
  2⤵
  PID:7244
- C:\Windows\System\IJovKMx.exe
  C:\Windows\System\IJovKMx.exe
  2⤵
  PID:6456
- C:\Windows\System\zdiizxP.exe
  C:\Windows\System\zdiizxP.exe
  2⤵
  PID:6200
- C:\Windows\System\zNQAIdE.exe
  C:\Windows\System\zNQAIdE.exe
  2⤵
  PID:6380
- C:\Windows\System\kSKDaMH.exe
  C:\Windows\System\kSKDaMH.exe
  2⤵
  PID:7308
- C:\Windows\System\LQNDqwn.exe
  C:\Windows\System\LQNDqwn.exe
  2⤵
  PID:6788
- C:\Windows\System\dVuMiPX.exe
  C:\Windows\System\dVuMiPX.exe
  2⤵
  PID:6860
- C:\Windows\System\DjodVCD.exe
  C:\Windows\System\DjodVCD.exe
  2⤵
  PID:7312
- C:\Windows\System\FTSIPyz.exe
  C:\Windows\System\FTSIPyz.exe
  2⤵
  PID:7228
- C:\Windows\System\PGQoDlp.exe
  C:\Windows\System\PGQoDlp.exe
  2⤵
  PID:6232
- C:\Windows\System\GHphWJe.exe
  C:\Windows\System\GHphWJe.exe
  2⤵
  PID:7340
- C:\Windows\System\yvDyGXu.exe
  C:\Windows\System\yvDyGXu.exe
  2⤵
  PID:7404
- C:\Windows\System\DbaOeNx.exe
  C:\Windows\System\DbaOeNx.exe
  2⤵
  PID:7292
- C:\Windows\System\TUWhUCF.exe
  C:\Windows\System\TUWhUCF.exe
  2⤵
  PID:7472
- C:\Windows\System\UeefDol.exe
  C:\Windows\System\UeefDol.exe
  2⤵
  PID:7328
- C:\Windows\System\UxsgKzk.exe
  C:\Windows\System\UxsgKzk.exe
  2⤵
  PID:7484
- C:\Windows\System\yzCuSBz.exe
  C:\Windows\System\yzCuSBz.exe
  2⤵
  PID:7532
- C:\Windows\System\LKOzTMb.exe
  C:\Windows\System\LKOzTMb.exe
  2⤵
  PID:7516
- C:\Windows\System\haBrzEU.exe
  C:\Windows\System\haBrzEU.exe
  2⤵
  PID:7564
- C:\Windows\System\pxZuwdP.exe
  C:\Windows\System\pxZuwdP.exe
  2⤵
  PID:7604
- C:\Windows\System\vBnxCSk.exe
  C:\Windows\System\vBnxCSk.exe
  2⤵
  PID:7640
- C:\Windows\System\GCCRzAk.exe
  C:\Windows\System\GCCRzAk.exe
  2⤵
  PID:7784
- C:\Windows\System\vyKZTkc.exe
  C:\Windows\System\vyKZTkc.exe
  2⤵
  PID:7788
- C:\Windows\System\qCzhaur.exe
  C:\Windows\System\qCzhaur.exe
  2⤵
  PID:7772
- C:\Windows\System\bEVAYEf.exe
  C:\Windows\System\bEVAYEf.exe
  2⤵
  PID:7808
- C:\Windows\System\TaQbmNU.exe
  C:\Windows\System\TaQbmNU.exe
  2⤵
  PID:7828
- C:\Windows\System\RAXvDHp.exe
  C:\Windows\System\RAXvDHp.exe
  2⤵
  PID:7844
- C:\Windows\System\tuUwcRG.exe
  C:\Windows\System\tuUwcRG.exe
  2⤵
  PID:7860
- C:\Windows\System\awVxahy.exe
  C:\Windows\System\awVxahy.exe
  2⤵
  PID:7888
- C:\Windows\System\tfHFVEo.exe
  C:\Windows\System\tfHFVEo.exe
  2⤵
  PID:7924
- C:\Windows\System\gFcNiDx.exe
  C:\Windows\System\gFcNiDx.exe
  2⤵
  PID:7964
- C:\Windows\System\FsCCrGj.exe
  C:\Windows\System\FsCCrGj.exe
  2⤵
  PID:8028
- C:\Windows\System\MPUecVC.exe
  C:\Windows\System\MPUecVC.exe
  2⤵
  PID:8100
- C:\Windows\System\eFkOmFD.exe
  C:\Windows\System\eFkOmFD.exe
  2⤵
  PID:8008
- C:\Windows\System\uVLfTVK.exe
  C:\Windows\System\uVLfTVK.exe
  2⤵
  PID:8136
- C:\Windows\System\UbXdbdT.exe
  C:\Windows\System\UbXdbdT.exe
  2⤵
  PID:7912
- C:\Windows\System\rwfSqVZ.exe
  C:\Windows\System\rwfSqVZ.exe
  2⤵
  PID:8012
- C:\Windows\System\qEsmAww.exe
  C:\Windows\System\qEsmAww.exe
  2⤵
  PID:8156
- C:\Windows\System\yFMtgJu.exe
  C:\Windows\System\yFMtgJu.exe
  2⤵
  PID:6464
- C:\Windows\System\vSlcFuf.exe
  C:\Windows\System\vSlcFuf.exe
  2⤵
  PID:6528
- C:\Windows\System\rHocRUm.exe
  C:\Windows\System\rHocRUm.exe
  2⤵
  PID:6148
- C:\Windows\System\ImOLLCF.exe
  C:\Windows\System\ImOLLCF.exe
  2⤵
  PID:7372
- C:\Windows\System\RhtukBS.exe
  C:\Windows\System\RhtukBS.exe
  2⤵
  PID:7360
- C:\Windows\System\lloqYmY.exe
  C:\Windows\System\lloqYmY.exe
  2⤵
  PID:7200
- C:\Windows\System\HkoEygI.exe
  C:\Windows\System\HkoEygI.exe
  2⤵
  PID:6544
- C:\Windows\System\mwBYwIS.exe
  C:\Windows\System\mwBYwIS.exe
  2⤵
  PID:7488
- C:\Windows\System\uLrCyHJ.exe
  C:\Windows\System\uLrCyHJ.exe
  2⤵
  PID:7216
- C:\Windows\System\bEWFbpP.exe
  C:\Windows\System\bEWFbpP.exe
  2⤵
  PID:6664
- C:\Windows\System\lsQwOYq.exe
  C:\Windows\System\lsQwOYq.exe
  2⤵
  PID:7420
- C:\Windows\System\zXoceRI.exe
  C:\Windows\System\zXoceRI.exe
  2⤵
  PID:7552
- C:\Windows\System\pfuBRBZ.exe
  C:\Windows\System\pfuBRBZ.exe
  2⤵
  PID:7624
- C:\Windows\System\bKxnRfG.exe
  C:\Windows\System\bKxnRfG.exe
  2⤵
  PID:7688
- C:\Windows\System\GeFOnpe.exe
  C:\Windows\System\GeFOnpe.exe
  2⤵
  PID:7652
- C:\Windows\System\jhEGvyX.exe
  C:\Windows\System\jhEGvyX.exe
  2⤵
  PID:7740
- C:\Windows\System\ozaxdLk.exe
  C:\Windows\System\ozaxdLk.exe
  2⤵
  PID:7824
- C:\Windows\System\ZRIPFlZ.exe
  C:\Windows\System\ZRIPFlZ.exe
  2⤵
  PID:7896
- C:\Windows\System\AfaRBpD.exe
  C:\Windows\System\AfaRBpD.exe
  2⤵
  PID:8092
- C:\Windows\System\OQsdLrM.exe
  C:\Windows\System\OQsdLrM.exe
  2⤵
  PID:7804
- C:\Windows\System\CROWMFH.exe
  C:\Windows\System\CROWMFH.exe
  2⤵
  PID:7840
- C:\Windows\System\FvcIeWr.exe
  C:\Windows\System\FvcIeWr.exe
  2⤵
  PID:8120
- C:\Windows\System\tkbhWYr.exe
  C:\Windows\System\tkbhWYr.exe
  2⤵
  PID:7980
- C:\Windows\System\Eevflfc.exe
  C:\Windows\System\Eevflfc.exe
  2⤵
  PID:7960
- C:\Windows\System\rvpeCaA.exe
  C:\Windows\System\rvpeCaA.exe
  2⤵
  PID:7456
- C:\Windows\System\zSBVMNl.exe
  C:\Windows\System\zSBVMNl.exe
  2⤵
  PID:8072
- C:\Windows\System\OXpHjyD.exe
  C:\Windows\System\OXpHjyD.exe
  2⤵
  PID:7068
- C:\Windows\System\EKUBfRo.exe
  C:\Windows\System\EKUBfRo.exe
  2⤵
  PID:8188
- C:\Windows\System\smQwTyk.exe
  C:\Windows\System\smQwTyk.exe
  2⤵
  PID:7440
- C:\Windows\System\FvTdDBk.exe
  C:\Windows\System\FvTdDBk.exe
  2⤵
  PID:7212
- C:\Windows\System\LywvEvU.exe
  C:\Windows\System\LywvEvU.exe
  2⤵
  PID:7684
- C:\Windows\System\YiREtTs.exe
  C:\Windows\System\YiREtTs.exe
  2⤵
  PID:7856
- C:\Windows\System\enirAQi.exe
  C:\Windows\System\enirAQi.exe
  2⤵
  PID:6648
- C:\Windows\System\anwiEWV.exe
  C:\Windows\System\anwiEWV.exe
  2⤵
  PID:7884
- C:\Windows\System\YGdvPRw.exe
  C:\Windows\System\YGdvPRw.exe
  2⤵
  PID:7452
- C:\Windows\System\cNKbpMs.exe
  C:\Windows\System\cNKbpMs.exe
  2⤵
  PID:7700
- C:\Windows\System\LjLTSAN.exe
  C:\Windows\System\LjLTSAN.exe
  2⤵
  PID:7752
- C:\Windows\System\iuCrAFA.exe
  C:\Windows\System\iuCrAFA.exe
  2⤵
  PID:8208
- C:\Windows\System\ipQgOsp.exe
  C:\Windows\System\ipQgOsp.exe
  2⤵
  PID:8224
- C:\Windows\System\mZIimsH.exe
  C:\Windows\System\mZIimsH.exe
  2⤵
  PID:8240
- C:\Windows\System\lmMsvSR.exe
  C:\Windows\System\lmMsvSR.exe
  2⤵
  PID:8256
- C:\Windows\System\iVOboGW.exe
  C:\Windows\System\iVOboGW.exe
  2⤵
  PID:8272
- C:\Windows\System\PixgNHO.exe
  C:\Windows\System\PixgNHO.exe
  2⤵
  PID:8288
- C:\Windows\System\iSwWjno.exe
  C:\Windows\System\iSwWjno.exe
  2⤵
  PID:8304
- C:\Windows\System\cIUEFsP.exe
  C:\Windows\System\cIUEFsP.exe
  2⤵
  PID:8320
- C:\Windows\System\JCoAxmo.exe
  C:\Windows\System\JCoAxmo.exe
  2⤵
  PID:8336
- C:\Windows\System\UqCjwRr.exe
  C:\Windows\System\UqCjwRr.exe
  2⤵
  PID:8352
- C:\Windows\System\YkuEMpi.exe
  C:\Windows\System\YkuEMpi.exe
  2⤵
  PID:8368
- C:\Windows\System\MRWszBY.exe
  C:\Windows\System\MRWszBY.exe
  2⤵
  PID:8384
- C:\Windows\System\kTFaNZH.exe
  C:\Windows\System\kTFaNZH.exe
  2⤵
  PID:8400
- C:\Windows\System\FYTmsZX.exe
  C:\Windows\System\FYTmsZX.exe
  2⤵
  PID:8416
- C:\Windows\System\qnLqyMl.exe
  C:\Windows\System\qnLqyMl.exe
  2⤵
  PID:8436
- C:\Windows\System\ggtDJJC.exe
  C:\Windows\System\ggtDJJC.exe
  2⤵
  PID:8452
- C:\Windows\System\REMKBKL.exe
  C:\Windows\System\REMKBKL.exe
  2⤵
  PID:8468
- C:\Windows\System\cLVXmRJ.exe
  C:\Windows\System\cLVXmRJ.exe
  2⤵
  PID:8484
- C:\Windows\System\xrtssLq.exe
  C:\Windows\System\xrtssLq.exe
  2⤵
  PID:8500
- C:\Windows\System\hddwOzx.exe
  C:\Windows\System\hddwOzx.exe
  2⤵
  PID:8516
- C:\Windows\System\zrAiKOk.exe
  C:\Windows\System\zrAiKOk.exe
  2⤵
  PID:8532
- C:\Windows\System\WsXgYHe.exe
  C:\Windows\System\WsXgYHe.exe
  2⤵
  PID:8548
- C:\Windows\System\CrCNUYl.exe
  C:\Windows\System\CrCNUYl.exe
  2⤵
  PID:8564
- C:\Windows\System\WmytKzp.exe
  C:\Windows\System\WmytKzp.exe
  2⤵
  PID:8580
- C:\Windows\System\PJSdZIp.exe
  C:\Windows\System\PJSdZIp.exe
  2⤵
  PID:8596
- C:\Windows\System\MwVShYY.exe
  C:\Windows\System\MwVShYY.exe
  2⤵
  PID:8612
- C:\Windows\System\cQAVZCm.exe
  C:\Windows\System\cQAVZCm.exe
  2⤵
  PID:8628
- C:\Windows\System\XjmCrTU.exe
  C:\Windows\System\XjmCrTU.exe
  2⤵
  PID:8648
- C:\Windows\System\jjcLKEA.exe
  C:\Windows\System\jjcLKEA.exe
  2⤵
  PID:8664
- C:\Windows\System\TtDTULw.exe
  C:\Windows\System\TtDTULw.exe
  2⤵
  PID:8680
- C:\Windows\System\OHstHAO.exe
  C:\Windows\System\OHstHAO.exe
  2⤵
  PID:8696
- C:\Windows\System\DmGGiza.exe
  C:\Windows\System\DmGGiza.exe
  2⤵
  PID:8712
- C:\Windows\System\hYRjayK.exe
  C:\Windows\System\hYRjayK.exe
  2⤵
  PID:8728
- C:\Windows\System\kyJQEmk.exe
  C:\Windows\System\kyJQEmk.exe
  2⤵
  PID:8744
- C:\Windows\System\oBcmGKW.exe
  C:\Windows\System\oBcmGKW.exe
  2⤵
  PID:8760
- C:\Windows\System\xGBpose.exe
  C:\Windows\System\xGBpose.exe
  2⤵
  PID:8776
- C:\Windows\System\UwdAVwr.exe
  C:\Windows\System\UwdAVwr.exe
  2⤵
  PID:8792
- C:\Windows\System\CItfqYl.exe
  C:\Windows\System\CItfqYl.exe
  2⤵
  PID:8808
- C:\Windows\System\WckVLqN.exe
  C:\Windows\System\WckVLqN.exe
  2⤵
  PID:8824
- C:\Windows\System\XgTCjuv.exe
  C:\Windows\System\XgTCjuv.exe
  2⤵
  PID:8840
- C:\Windows\System\JRlDdrF.exe
  C:\Windows\System\JRlDdrF.exe
  2⤵
  PID:8856
- C:\Windows\System\ifaNsov.exe
  C:\Windows\System\ifaNsov.exe
  2⤵
  PID:8872
- C:\Windows\System\mBggCWy.exe
  C:\Windows\System\mBggCWy.exe
  2⤵
  PID:8892
- C:\Windows\System\dfxOdZb.exe
  C:\Windows\System\dfxOdZb.exe
  2⤵
  PID:8908
- C:\Windows\System\YkqOany.exe
  C:\Windows\System\YkqOany.exe
  2⤵
  PID:8924
- C:\Windows\System\ICEKBSQ.exe
  C:\Windows\System\ICEKBSQ.exe
  2⤵
  PID:8940
- C:\Windows\System\qonHDGL.exe
  C:\Windows\System\qonHDGL.exe
  2⤵
  PID:8956
- C:\Windows\System\CWYQnGc.exe
  C:\Windows\System\CWYQnGc.exe
  2⤵
  PID:8976
- C:\Windows\System\kFYOsQT.exe
  C:\Windows\System\kFYOsQT.exe
  2⤵
  PID:8992
- C:\Windows\System\ctjRAbC.exe
  C:\Windows\System\ctjRAbC.exe
  2⤵
  PID:9008
- C:\Windows\System\vmmRoLU.exe
  C:\Windows\System\vmmRoLU.exe
  2⤵
  PID:9024
- C:\Windows\System\eyHktOx.exe
  C:\Windows\System\eyHktOx.exe
  2⤵
  PID:9040
- C:\Windows\System\YUUFWSd.exe
  C:\Windows\System\YUUFWSd.exe
  2⤵
  PID:9056
- C:\Windows\System\cAmhoZe.exe
  C:\Windows\System\cAmhoZe.exe
  2⤵
  PID:9076
- C:\Windows\System\owAdJah.exe
  C:\Windows\System\owAdJah.exe
  2⤵
  PID:9092
- C:\Windows\System\XjcyGBt.exe
  C:\Windows\System\XjcyGBt.exe
  2⤵
  PID:9108
- C:\Windows\System\PLyBkTa.exe
  C:\Windows\System\PLyBkTa.exe
  2⤵
  PID:9124
- C:\Windows\System\jZYurbt.exe
  C:\Windows\System\jZYurbt.exe
  2⤵
  PID:9144
- C:\Windows\System\CvctUnq.exe
  C:\Windows\System\CvctUnq.exe
  2⤵
  PID:9160
- C:\Windows\System\mqXBkQw.exe
  C:\Windows\System\mqXBkQw.exe
  2⤵
  PID:9176
- C:\Windows\System\WdCcTGG.exe
  C:\Windows\System\WdCcTGG.exe
  2⤵
  PID:9192
- C:\Windows\System\mncsxzv.exe
  C:\Windows\System\mncsxzv.exe
  2⤵
  PID:9212
- C:\Windows\System\AhpURde.exe
  C:\Windows\System\AhpURde.exe
  2⤵
  PID:7620
- C:\Windows\System\SGbJKZZ.exe
  C:\Windows\System\SGbJKZZ.exe
  2⤵
  PID:6712
- C:\Windows\System\XlxNjHt.exe
  C:\Windows\System\XlxNjHt.exe
  2⤵
  PID:8236
- C:\Windows\System\vpQWpkl.exe
  C:\Windows\System\vpQWpkl.exe
  2⤵
  PID:7996
- C:\Windows\System\ABdTkfh.exe
  C:\Windows\System\ABdTkfh.exe
  2⤵
  PID:8300
- C:\Windows\System\uzzznPo.exe
  C:\Windows\System\uzzznPo.exe
  2⤵
  PID:8076
- C:\Windows\System\JpvWhmw.exe
  C:\Windows\System\JpvWhmw.exe
  2⤵
  PID:7724
- C:\Windows\System\UHdQakn.exe
  C:\Windows\System\UHdQakn.exe
  2⤵
  PID:8252
- C:\Windows\System\ovWwpuc.exe
  C:\Windows\System\ovWwpuc.exe
  2⤵
  PID:6804
- C:\Windows\System\otSOrGn.exe
  C:\Windows\System\otSOrGn.exe
  2⤵
  PID:8216
- C:\Windows\System\QEAkYho.exe
  C:\Windows\System\QEAkYho.exe
  2⤵
  PID:8408
- C:\Windows\System\LusaVkO.exe
  C:\Windows\System\LusaVkO.exe
  2⤵
  PID:8476
- C:\Windows\System\sNRUgkJ.exe
  C:\Windows\System\sNRUgkJ.exe
  2⤵
  PID:8540
- C:\Windows\System\hVzWEQi.exe
  C:\Windows\System\hVzWEQi.exe
  2⤵
  PID:8392
- C:\Windows\System\wIzTsWx.exe
  C:\Windows\System\wIzTsWx.exe
  2⤵
  PID:8460
- C:\Windows\System\UBmyHaG.exe
  C:\Windows\System\UBmyHaG.exe
  2⤵
  PID:8524
- C:\Windows\System\sWDzIHp.exe
  C:\Windows\System\sWDzIHp.exe
  2⤵
  PID:8544
- C:\Windows\System\sDmHrQf.exe
  C:\Windows\System\sDmHrQf.exe
  2⤵
  PID:8572
- C:\Windows\System\kneWANP.exe
  C:\Windows\System\kneWANP.exe
  2⤵
  PID:8576
- C:\Windows\System\ZNVJKqc.exe
  C:\Windows\System\ZNVJKqc.exe
  2⤵
  PID:8636
- C:\Windows\System\nmyWjHV.exe
  C:\Windows\System\nmyWjHV.exe
  2⤵
  PID:8672
- C:\Windows\System\mqrifjX.exe
  C:\Windows\System\mqrifjX.exe
  2⤵
  PID:8720
- C:\Windows\System\GVoasHT.exe
  C:\Windows\System\GVoasHT.exe
  2⤵
  PID:8708
- C:\Windows\System\QeLcSAs.exe
  C:\Windows\System\QeLcSAs.exe
  2⤵
  PID:8820
- C:\Windows\System\hptKruZ.exe
  C:\Windows\System\hptKruZ.exe
  2⤵
  PID:8884
- C:\Windows\System\ziADleV.exe
  C:\Windows\System\ziADleV.exe
  2⤵
  PID:8920
- C:\Windows\System\PDJcAyk.exe
  C:\Windows\System\PDJcAyk.exe
  2⤵
  PID:8868
- C:\Windows\System\DWPhnpk.exe
  C:\Windows\System\DWPhnpk.exe
  2⤵
  PID:8984
- C:\Windows\System\jzNguMk.exe
  C:\Windows\System\jzNguMk.exe
  2⤵
  PID:8832
- C:\Windows\System\PzFREVi.exe
  C:\Windows\System\PzFREVi.exe
  2⤵
  PID:9048
- C:\Windows\System\gAOTzXT.exe
  C:\Windows\System\gAOTzXT.exe
  2⤵
  PID:9088
- C:\Windows\System\DsfDphg.exe
  C:\Windows\System\DsfDphg.exe
  2⤵
  PID:8904
- C:\Windows\System\kWLhGtd.exe
  C:\Windows\System\kWLhGtd.exe
  2⤵
  PID:9156
- C:\Windows\System\LzGOoOS.exe
  C:\Windows\System\LzGOoOS.exe
  2⤵
  PID:9004
- C:\Windows\System\hVXrLZK.exe
  C:\Windows\System\hVXrLZK.exe
  2⤵
  PID:9064
- C:\Windows\System\NwhMWho.exe
  C:\Windows\System\NwhMWho.exe
  2⤵
  PID:8972
- C:\Windows\System\YpvfEpS.exe
  C:\Windows\System\YpvfEpS.exe
  2⤵
  PID:6172
- C:\Windows\System\cVIzcpa.exe
  C:\Windows\System\cVIzcpa.exe
  2⤵
  PID:9140
- C:\Windows\System\KTDjStk.exe
  C:\Windows\System\KTDjStk.exe
  2⤵
  PID:7276
- C:\Windows\System\yyHILvq.exe
  C:\Windows\System\yyHILvq.exe
  2⤵
  PID:7264
- C:\Windows\System\wGtnmOw.exe
  C:\Windows\System\wGtnmOw.exe
  2⤵
  PID:7820
- C:\Windows\System\ftLXpRJ.exe
  C:\Windows\System\ftLXpRJ.exe
  2⤵
  PID:8280
- C:\Windows\System\iWCSPGO.exe
  C:\Windows\System\iWCSPGO.exe
  2⤵
  PID:8512
- C:\Windows\System\PuRXyMZ.exe
  C:\Windows\System\PuRXyMZ.exe
  2⤵
  PID:8556
- C:\Windows\System\nseBEzx.exe
  C:\Windows\System\nseBEzx.exe
  2⤵
  PID:8644
- C:\Windows\System\WcMQbyx.exe
  C:\Windows\System\WcMQbyx.exe
  2⤵
  PID:8316
- C:\Windows\System\ZqTSCiT.exe
  C:\Windows\System\ZqTSCiT.exe
  2⤵
  PID:7880
- C:\Windows\System\kxvdiXc.exe
  C:\Windows\System\kxvdiXc.exe
  2⤵
  PID:8444
- C:\Windows\System\etXPrcv.exe
  C:\Windows\System\etXPrcv.exe
  2⤵
  PID:8800
- C:\Windows\System\rqYaDLi.exe
  C:\Windows\System\rqYaDLi.exe
  2⤵
  PID:8588
- C:\Windows\System\DNEzwda.exe
  C:\Windows\System\DNEzwda.exe
  2⤵
  PID:8676
- C:\Windows\System\qgyNNKG.exe
  C:\Windows\System\qgyNNKG.exe
  2⤵
  PID:9032
- C:\Windows\System\fMYoqjp.exe
  C:\Windows\System\fMYoqjp.exe
  2⤵
  PID:8864
- C:\Windows\System\BGNZVGI.exe
  C:\Windows\System\BGNZVGI.exe
  2⤵
  PID:9016
- C:\Windows\System\WWZRwvC.exe
  C:\Windows\System\WWZRwvC.exe
  2⤵
  PID:9204
- C:\Windows\System\iOFqnYA.exe
  C:\Windows\System\iOFqnYA.exe
  2⤵
  PID:9188
- C:\Windows\System\TLxzORF.exe
  C:\Windows\System\TLxzORF.exe
  2⤵
  PID:7720
- C:\Windows\System\jyjlccg.exe
  C:\Windows\System\jyjlccg.exe
  2⤵
  PID:9068
- C:\Windows\System\oIlquxr.exe
  C:\Windows\System\oIlquxr.exe
  2⤵
  PID:9100
- C:\Windows\System\MTeahYL.exe
  C:\Windows\System\MTeahYL.exe
  2⤵
  PID:8360
- C:\Windows\System\ikxfvRI.exe
  C:\Windows\System\ikxfvRI.exe
  2⤵
  PID:8752
- C:\Windows\System\yeAJGzN.exe
  C:\Windows\System\yeAJGzN.exe
  2⤵
  PID:8608
- C:\Windows\System\RXzNlfV.exe
  C:\Windows\System\RXzNlfV.exe
  2⤵
  PID:8788
- C:\Windows\System\YRQnMcl.exe
  C:\Windows\System\YRQnMcl.exe
  2⤵
  PID:7588
- C:\Windows\System\giAXmWu.exe
  C:\Windows\System\giAXmWu.exe
  2⤵
  PID:8220
- C:\Windows\System\Csqrdmi.exe
  C:\Windows\System\Csqrdmi.exe
  2⤵
  PID:8772
- C:\Windows\System\WCFhRUR.exe
  C:\Windows\System\WCFhRUR.exe
  2⤵
  PID:8364
- C:\Windows\System\yUPglym.exe
  C:\Windows\System\yUPglym.exe
  2⤵
  PID:8948
- C:\Windows\System\XVVhuys.exe
  C:\Windows\System\XVVhuys.exe
  2⤵
  PID:9224
- C:\Windows\System\LtiUGnh.exe
  C:\Windows\System\LtiUGnh.exe
  2⤵
  PID:9240
- C:\Windows\System\ibqZSEL.exe
  C:\Windows\System\ibqZSEL.exe
  2⤵
  PID:9276
- C:\Windows\System\ZdNzdQc.exe
  C:\Windows\System\ZdNzdQc.exe
  2⤵
  PID:9300
- C:\Windows\System\GmJPRfy.exe
  C:\Windows\System\GmJPRfy.exe
  2⤵
  PID:9316
- C:\Windows\System\bhDHFVw.exe
  C:\Windows\System\bhDHFVw.exe
  2⤵
  PID:9332
- C:\Windows\System\TvtOJIr.exe
  C:\Windows\System\TvtOJIr.exe
  2⤵
  PID:9348
- C:\Windows\System\DNkRSQH.exe
  C:\Windows\System\DNkRSQH.exe
  2⤵
  PID:9364
- C:\Windows\System\edLbdrY.exe
  C:\Windows\System\edLbdrY.exe
  2⤵
  PID:9380
- C:\Windows\System\yrwJjHE.exe
  C:\Windows\System\yrwJjHE.exe
  2⤵
  PID:9396
- C:\Windows\System\WPSVWvq.exe
  C:\Windows\System\WPSVWvq.exe
  2⤵
  PID:9416
- C:\Windows\System\tvlrSCP.exe
  C:\Windows\System\tvlrSCP.exe
  2⤵
  PID:9432
- C:\Windows\System\KRLnIAr.exe
  C:\Windows\System\KRLnIAr.exe
  2⤵
  PID:9448
- C:\Windows\System\OsGvUUV.exe
  C:\Windows\System\OsGvUUV.exe
  2⤵
  PID:9464
- C:\Windows\System\rTIMZoF.exe
  C:\Windows\System\rTIMZoF.exe
  2⤵
  PID:9480
- C:\Windows\System\HKGrpnQ.exe
  C:\Windows\System\HKGrpnQ.exe
  2⤵
  PID:9496
- C:\Windows\System\DBJhqUo.exe
  C:\Windows\System\DBJhqUo.exe
  2⤵
  PID:9512
- C:\Windows\System\OQatSWg.exe
  C:\Windows\System\OQatSWg.exe
  2⤵
  PID:9528
- C:\Windows\System\LLbveyC.exe
  C:\Windows\System\LLbveyC.exe
  2⤵
  PID:9544
- C:\Windows\System\GdMSKBZ.exe
  C:\Windows\System\GdMSKBZ.exe
  2⤵
  PID:9560
- C:\Windows\System\gdMhVXF.exe
  C:\Windows\System\gdMhVXF.exe
  2⤵
  PID:9584
- C:\Windows\System\WphqDXC.exe
  C:\Windows\System\WphqDXC.exe
  2⤵
  PID:9600
- C:\Windows\System\uWGItgj.exe
  C:\Windows\System\uWGItgj.exe
  2⤵
  PID:9616
- C:\Windows\System\nMvlJqk.exe
  C:\Windows\System\nMvlJqk.exe
  2⤵
  PID:9632
- C:\Windows\System\ANKQOEm.exe
  C:\Windows\System\ANKQOEm.exe
  2⤵
  PID:9648
- C:\Windows\System\SAkWCRB.exe
  C:\Windows\System\SAkWCRB.exe
  2⤵
  PID:9664
- C:\Windows\System\DTyijXx.exe
  C:\Windows\System\DTyijXx.exe
  2⤵
  PID:9684
- C:\Windows\System\fMUlvqL.exe
  C:\Windows\System\fMUlvqL.exe
  2⤵
  PID:9704
- C:\Windows\System\StPfCla.exe
  C:\Windows\System\StPfCla.exe
  2⤵
  PID:9724
- C:\Windows\System\kiluxuX.exe
  C:\Windows\System\kiluxuX.exe
  2⤵
  PID:9740
- C:\Windows\System\ROlYBsR.exe
  C:\Windows\System\ROlYBsR.exe
  2⤵
  PID:9756
- C:\Windows\System\Fhbcvhy.exe
  C:\Windows\System\Fhbcvhy.exe
  2⤵
  PID:9776
- C:\Windows\System\yREpZmY.exe
  C:\Windows\System\yREpZmY.exe
  2⤵
  PID:9792
- C:\Windows\System\qKofFlB.exe
  C:\Windows\System\qKofFlB.exe
  2⤵
  PID:9808
- C:\Windows\System\ddPjfLx.exe
  C:\Windows\System\ddPjfLx.exe
  2⤵
  PID:9824
- C:\Windows\System\zMOAOZZ.exe
  C:\Windows\System\zMOAOZZ.exe
  2⤵
  PID:9844
- C:\Windows\System\GBmkSRa.exe
  C:\Windows\System\GBmkSRa.exe
  2⤵
  PID:9860
- C:\Windows\System\IttFygc.exe
  C:\Windows\System\IttFygc.exe
  2⤵
  PID:9876
- C:\Windows\System\zAHHmwi.exe
  C:\Windows\System\zAHHmwi.exe
  2⤵
  PID:9892
- C:\Windows\System\uhqKadI.exe
  C:\Windows\System\uhqKadI.exe
  2⤵
  PID:9908
- C:\Windows\System\NRXWuFI.exe
  C:\Windows\System\NRXWuFI.exe
  2⤵
  PID:9928
- C:\Windows\System\WufxvvK.exe
  C:\Windows\System\WufxvvK.exe
  2⤵
  PID:9944
- C:\Windows\System\rjahziZ.exe
  C:\Windows\System\rjahziZ.exe
  2⤵
  PID:9960
- C:\Windows\System\YWnuMaT.exe
  C:\Windows\System\YWnuMaT.exe
  2⤵
  PID:9976
- C:\Windows\System\mvQeqlD.exe
  C:\Windows\System\mvQeqlD.exe
  2⤵
  PID:9992
- C:\Windows\System\eOXEyxk.exe
  C:\Windows\System\eOXEyxk.exe
  2⤵
  PID:10008
- C:\Windows\System\eNMKxyT.exe
  C:\Windows\System\eNMKxyT.exe
  2⤵
  PID:10028
- C:\Windows\System\lvnJGKj.exe
  C:\Windows\System\lvnJGKj.exe
  2⤵
  PID:10044
- C:\Windows\System\FycithW.exe
  C:\Windows\System\FycithW.exe
  2⤵
  PID:10060
- C:\Windows\System\HaArfUu.exe
  C:\Windows\System\HaArfUu.exe
  2⤵
  PID:10080
- C:\Windows\System\KvZyKfv.exe
  C:\Windows\System\KvZyKfv.exe
  2⤵
  PID:10096
- C:\Windows\System\baslwSM.exe
  C:\Windows\System\baslwSM.exe
  2⤵
  PID:10172
- C:\Windows\System\ZYaTQwc.exe
  C:\Windows\System\ZYaTQwc.exe
  2⤵
  PID:10188
- C:\Windows\System\INZXytX.exe
  C:\Windows\System\INZXytX.exe
  2⤵
  PID:10204
- C:\Windows\System\VSSeyOr.exe
  C:\Windows\System\VSSeyOr.exe
  2⤵
  PID:10220
- C:\Windows\System\cdjWPHG.exe
  C:\Windows\System\cdjWPHG.exe
  2⤵
  PID:10236
- C:\Windows\System\AjsgoLD.exe
  C:\Windows\System\AjsgoLD.exe
  2⤵
  PID:8448
- C:\Windows\System\JTajVJk.exe
  C:\Windows\System\JTajVJk.exe
  2⤵
  PID:7608
- C:\Windows\System\JEXiHRs.exe
  C:\Windows\System\JEXiHRs.exe
  2⤵
  PID:9200
- C:\Windows\System\pEdlxdV.exe
  C:\Windows\System\pEdlxdV.exe
  2⤵
  PID:9220
- C:\Windows\System\DkowZul.exe
  C:\Windows\System\DkowZul.exe
  2⤵
  PID:9260
- C:\Windows\System\otQZIpP.exe
  C:\Windows\System\otQZIpP.exe
  2⤵
  PID:8348
- C:\Windows\System\aMuMLgL.exe
  C:\Windows\System\aMuMLgL.exe
  2⤵
  PID:9328
- C:\Windows\System\qPViEEY.exe
  C:\Windows\System\qPViEEY.exe
  2⤵
  PID:9392
- C:\Windows\System\DAbbDjc.exe
  C:\Windows\System\DAbbDjc.exe
  2⤵
  PID:9472
- C:\Windows\System\zkKrCSh.exe
  C:\Windows\System\zkKrCSh.exe
  2⤵
  PID:9488
- C:\Windows\System\oZzobay.exe
  C:\Windows\System\oZzobay.exe
  2⤵
  PID:9552
- C:\Windows\System\lXGfZQr.exe
  C:\Windows\System\lXGfZQr.exe
  2⤵
  PID:9456
- C:\Windows\System\UiVVyPL.exe
  C:\Windows\System\UiVVyPL.exe
  2⤵
  PID:9376
- C:\Windows\System\rQTYCxF.exe
  C:\Windows\System\rQTYCxF.exe
  2⤵
  PID:9444
- C:\Windows\System\aYnaTSk.exe
  C:\Windows\System\aYnaTSk.exe
  2⤵
  PID:9536
- C:\Windows\System\pTbIfGI.exe
  C:\Windows\System\pTbIfGI.exe
  2⤵
  PID:9580
- C:\Windows\System\VwfvRsI.exe
  C:\Windows\System\VwfvRsI.exe
  2⤵
  PID:9640
- C:\Windows\System\apGzbpX.exe
  C:\Windows\System\apGzbpX.exe
  2⤵
  PID:9672
- C:\Windows\System\hCJCsuJ.exe
  C:\Windows\System\hCJCsuJ.exe
  2⤵
  PID:9752
- C:\Windows\System\nqdHUys.exe
  C:\Windows\System\nqdHUys.exe
  2⤵
  PID:9592
- C:\Windows\System\HGMhVJP.exe
  C:\Windows\System\HGMhVJP.exe
  2⤵
  PID:9836
- C:\Windows\System\mlcDhxz.exe
  C:\Windows\System\mlcDhxz.exe
  2⤵
  PID:9772
- C:\Windows\System\tAnUHei.exe
  C:\Windows\System\tAnUHei.exe
  2⤵
  PID:9700
- C:\Windows\System\rnPhIKR.exe
  C:\Windows\System\rnPhIKR.exe
  2⤵
  PID:9656
- C:\Windows\System\QijEkGE.exe
  C:\Windows\System\QijEkGE.exe
  2⤵
  PID:9820
- C:\Windows\System\mgpProz.exe
  C:\Windows\System\mgpProz.exe
  2⤵
  PID:10000
- C:\Windows\System\SzMDkOK.exe
  C:\Windows\System\SzMDkOK.exe
  2⤵
  PID:10056
- C:\Windows\System\XBlawEM.exe
  C:\Windows\System\XBlawEM.exe
  2⤵
  PID:10092
- C:\Windows\System\PukLPPC.exe
  C:\Windows\System\PukLPPC.exe
  2⤵
  PID:10104
- C:\Windows\System\iXwYxoP.exe
  C:\Windows\System\iXwYxoP.exe
  2⤵
  PID:9856
- C:\Windows\System\UfajYoQ.exe
  C:\Windows\System\UfajYoQ.exe
  2⤵
  PID:9956
- C:\Windows\System\qNJZfJZ.exe
  C:\Windows\System\qNJZfJZ.exe
  2⤵
  PID:9916
- C:\Windows\System\qWVnKuN.exe
  C:\Windows\System\qWVnKuN.exe
  2⤵
  PID:9972
- C:\Windows\System\ypYVmdg.exe
  C:\Windows\System\ypYVmdg.exe
  2⤵
  PID:10120
- C:\Windows\System\sCluncl.exe
  C:\Windows\System\sCluncl.exe
  2⤵
  PID:10136
- C:\Windows\System\vehevFd.exe
  C:\Windows\System\vehevFd.exe
  2⤵
  PID:10232
- C:\Windows\System\TSrHQZH.exe
  C:\Windows\System\TSrHQZH.exe
  2⤵
  PID:10168
- C:\Windows\System\HVqPOjh.exe
  C:\Windows\System\HVqPOjh.exe
  2⤵
  PID:10152
- C:\Windows\System\FEgsUKr.exe
  C:\Windows\System\FEgsUKr.exe
  2⤵
  PID:10216
- C:\Windows\System\qJIQETk.exe
  C:\Windows\System\qJIQETk.exe
  2⤵
  PID:8496
- C:\Windows\System\GXXnunS.exe
  C:\Windows\System\GXXnunS.exe
  2⤵
  PID:8704
- C:\Windows\System\kPZagLe.exe
  C:\Windows\System\kPZagLe.exe
  2⤵
  PID:9256
- C:\Windows\System\iayWfyb.exe
  C:\Windows\System\iayWfyb.exe
  2⤵
  PID:9428
- C:\Windows\System\vvdRrOc.exe
  C:\Windows\System\vvdRrOc.exe
  2⤵
  PID:9268
- C:\Windows\System\jZYXEza.exe
  C:\Windows\System\jZYXEza.exe
  2⤵
  PID:9508
- C:\Windows\System\PwZeTpb.exe
  C:\Windows\System\PwZeTpb.exe
  2⤵
  PID:9408
- C:\Windows\System\wTxGQpx.exe
  C:\Windows\System\wTxGQpx.exe
  2⤵
  PID:9868
- C:\Windows\System\XfGRffz.exe
  C:\Windows\System\XfGRffz.exe
  2⤵
  PID:9736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CPILgZI.exe

Filesize
1.6MB

MD5
3f60c4dbffeae7c80d31257a462e553d

SHA1
27742c7d21e62b6fc828222ce35a2280d7257577

SHA256
b8422a66e41fa6daf9a6bb6e04a70cc91c7eab7aced5b41331a081c84b1f41aa

SHA512
b09b87f4fc7f5b442d1a06bd8200518c745a860add7ebed499b7537addaded4f1056a561b8d647aab3161f33cdcf139fc9290ff2b158ec6eb631b91226d25679

Download Submit
C:\Windows\system\DpjGjqm.exe

Filesize
1.6MB

MD5
caf32d25e8f5edd30eeac9be28b866b8

SHA1
166e8afc0b9cbf8c8975fb75df747c7542149b96

SHA256
86bbc4561b552af50df730590b03271949ba650541682e99410235175efa75df

SHA512
2fdf6259561218e8a2df3dfcbb424b6021fd9b121e55bb5a544b0a987be05757cb434ab930552529ad2ba14fb36478e4f8dae5b45c13f53c5524dcd9c4cfcb53

Download Submit
C:\Windows\system\FZvMbkL.exe

Filesize
1.6MB

MD5
df83d8f8ff28e427cdab0a9c716395b3

SHA1
5b1b8c680887ee990ac8bf300812299405d94049

SHA256
9a0bd512ed3ffe99a07b3b7f4c5508ef6125a4b8153c0cd811bbd14c73bcb570

SHA512
352d2a3946930bd1fdb6313f6ad7afa4fb3cf3778c7578607c59fb41b226573a4d7c9ec4900331556d8372da553ce7286f5d653bb984b82b72dd5f33b5a849e8

Download Submit
C:\Windows\system\GDQprtL.exe

Filesize
1.6MB

MD5
10774c418dbb9b09a14e67f8a67fa951

SHA1
d7b034093c45d53de9e77870dcc1a2b4d48b7578

SHA256
1017aea7efb2dbcc9f00a0d4ec8c4b45b65f636d4c1e29a82e88036d089533ba

SHA512
9bedd4b1f9451152678dd080a829d4a5221022ec95ebff375f43b6cc544b63474a2b4888f6105fed468eaac85852aaa1b6850a6ab8b40f6e5d75201a5ae0f22f

Download Submit
C:\Windows\system\INcbBFO.exe

Filesize
1.6MB

MD5
a1241cee560c231491496a17213fe33b

SHA1
109759a2814da72931248d0e66e4f3298d851d12

SHA256
3faea5ea2ec935e1820b3fe641ba9701703bab3c817831becde2a0c3a340afff

SHA512
8da685df0081266d812e94bf119e62ac9c2355a4518c31762b4b7737d70601c0b46c8ed1f0391b3b5df472b3e9a7a5b53878125126e1cb5ba60e25deaa1c3d9f

Download Submit
C:\Windows\system\JKUClxN.exe

Filesize
1.6MB

MD5
a1ce3e71f0c716df33c2b42a3c8df42d

SHA1
a97b7ee12fcaa68e68a8d0561385b74262729212

SHA256
36be502d69234ed2215668513664b43a51fddfb06b05d1c86a7380b974326ed9

SHA512
1ab4cf21342357e84883ec7fddd30bd8e7be7bf6ce67af20908f931aae6e7e25ab35c7421c66b8812e71dc516192271c0c5c8a7387600f6bee40f8f791e1a800

Download Submit
C:\Windows\system\KXZzbDW.exe

Filesize
1.6MB

MD5
60e8a28d0dc1bdc5ab2e68a7baf69dde

SHA1
232773ded1c2520345928acd7145c5ab9615be79

SHA256
2bf78070d8a354e5bdc59a002f2f6384d7e9f6930f3fb37b7ab97f5698ac4774

SHA512
abc0883fba72067f358b5f161393806225fed20ae2e70c10a9a26a04b3e0ecacde357e4a31a3696e8a41a20dc4f00a81ffbc07d280c77f4061ea0cd2ac83991f

Download Submit
C:\Windows\system\KfTnIPh.exe

Filesize
1.6MB

MD5
642eebdfa2a91ff827599fd0bfc599cb

SHA1
e07e2ba06500663acdeaa47605f380e1737f5d05

SHA256
710f48bd03572aee174489044ccb43dc372fdb52076e54e19fab8addc2c32d72

SHA512
afb1e4061c2530ac8ce188bdb7f35ed73448411dce369552d445225b1974b163823a279560702c93aa13700527e5531409d2642955ba05d1f2c6972a2c66f992

Download Submit
C:\Windows\system\KpKZYrd.exe

Filesize
1.6MB

MD5
10721d5805ec7e26fd940a61e97366b5

SHA1
29ab5b9c1f94a55b87208e698ddfad5e53a7f357

SHA256
3463367c2e8c6146e94756a4927f25a0de242fbdd596dc81b37c062ade5a2724

SHA512
b3087975feb01eaebded068af39a385024082a1f228831189c582bac424b5533d17f1dd041387bdeeca4e6de5e881caa51ead294c8227907f89c65d96abcb1f8

Download Submit
C:\Windows\system\MYanYvd.exe

Filesize
1.6MB

MD5
4f2ea01759640c9b66faf36080caa14d

SHA1
8629deea81a8d764d4782dc818b9d2bf96618e89

SHA256
d8f22e6520c11bff657f8faf66aa9cf5dca0efe031b0eb5c4e522baaf976010c

SHA512
9e99d8eb04cfec15b9823191d3b2f2204f79dbf0736afa22e2d558d59f2828a7135b7fb7f2b47bdf669a0abedb6d7e8b47eb1295f078a9bf57671708ef2841fd

Download Submit
C:\Windows\system\OfCXXuU.exe

Filesize
1.6MB

MD5
71e60b9d1e14bf4a0039760dc0362155

SHA1
553d62615ee6c253296db2c3ebbaabddf7d497cd

SHA256
5ef7fabe2db36e4c3a3947267860329f091a4d18a1d58b900b86a5bcb4d574dd

SHA512
cc21f3c9a34951666defb76b4cb6ade605df9ec5f1414c9f2898dcbe4f0a3d8c1596a63654b587717cb629ec4a58250dd23dbae71e7dcb2dd69e992086a1954c

Download Submit
C:\Windows\system\SVKoows.exe

Filesize
1.6MB

MD5
082627749e37e4785a87b48eb0065772

SHA1
2297ee500e5d42fe581e82c0387d63ca020c9a3b

SHA256
5d16f2066c29d9db940b389d0d949e2dfa352f5fd6d133d141f2f863dedddc40

SHA512
0590360cd85889a4fd18b953b92bfed26a01c7e45e8c712881bcd1f9f3be1b380d698caca2db13bb47802a1cf587729e9f23de4c9491be067af9fdefea08a46d

Download Submit
C:\Windows\system\UQFplDm.exe

Filesize
1.6MB

MD5
ad461e8d07b3ac338bcb21932441155c

SHA1
11147fa4d545ded310f140d50ec620eb16ed3bc9

SHA256
f879fe5a92e791e8bd83092ba93eff79221377866b8ebd10b8a4c467effd6eaa

SHA512
e647451d9099f7092da4959b659e87be1be1301c81225c25eb795ae01661becdaa9e39b6967e0cc8d7845a8edbfaf75650465aa4917688129a175f1388c67848

Download Submit
C:\Windows\system\UxdoBJU.exe

Filesize
1.6MB

MD5
8d4c09e91eebe89266c539eb7adb0c6e

SHA1
48712dbc608414e7071466d470656164b8bdf0e6

SHA256
cddae1638dfe98fc3a149ad2f28b0de746885a4c63b5a72616e9de5ecee15e02

SHA512
00416331f409d392565dd641e736545d08d65f5e28d44de12b8a4bdd9d865f204871e9f5cee672a6c87575521d033e4dc4ae0de3f1b1c7871e085b12c27fd271

Download Submit
C:\Windows\system\ZiHFOPD.exe

Filesize
1.6MB

MD5
31750348b4f96bb7d8d34b2be199c69c

SHA1
fcac3013eaf7133523d469e6ff5af43ec57a655b

SHA256
62e8affbfeffcee237639adc2713317c1b48f8beed7613915dca183a08fc65be

SHA512
6a7bb86ca3c990d0eea1b5d927b7be68ce5ff73123b89fa440428852bbe7b8a7ff4603d87bb62849af294dfc71c7d518060a79aee8d4de8b210f5c06c30d5437

Download Submit
C:\Windows\system\aIyfcbC.exe

Filesize
1.6MB

MD5
19e31f6e9e3b2f53189d230bc267c4f8

SHA1
df2dcd3084d610d7b3c1937b45bfbfde89274dc2

SHA256
95b2a25af788e42f193be42c18f90c80a9dfc8a19dd3aede01913adb6bc8b07f

SHA512
f9d88754d612feaf894d46a5e79dffcbc153aac3337fc3de955a29e0a6c79d328c0fb5a7613e7e299bbc43196e4078d8919621ffa0463d0f2dc8542984c7ec62

Download Submit
C:\Windows\system\hPhpOHH.exe

Filesize
1.6MB

MD5
763a88808af785f34439bf613be12af6

SHA1
c9fdb64523002d4b61ad9024933ce8659a63292a

SHA256
e20771035acf8062c7e0bcbf54733d2a15bcbe6d45c35324bcbabbc54d5233e5

SHA512
9a30ba9b76ead43ad97e129918888e64eb13c5bc7cff2d7663ad86a1d039c36458da035b5e2dc2f51573cf999f86feb44b322deb634fa7d9dde34b6dad826b46

Download Submit
C:\Windows\system\kpFlcxb.exe

Filesize
1.6MB

MD5
f3209fa51c02232258ca19fe29847af1

SHA1
c285fc411f4795e7d77e23408147cdd45275258a

SHA256
42160651e8f23cd1dc3a7b793179c908740b3ae9d8400c275c64f947f663fa9e

SHA512
b32d5e398593ffc0b43bfc149b03344e0ff35f7ab53c83cd4bad710cb8f3f56a2064156a19f570c6bfb2a731b647dc7b950e3d2f64cc5cd72378e1891d5ee6c3

Download Submit
C:\Windows\system\mmUmrci.exe

Filesize
1.6MB

MD5
5eccf67b7bed70fb0d904e3aabba1122

SHA1
a347d872c2fff689129620b8492f0d967c49752d

SHA256
cef281711001c446a5d2091e49bc5f347a89585b0e731e821160cb847f8ed00e

SHA512
7eaf460176de360d585a75e55e9b98f6354c9aa6440e521ba017909f791741459d0af3770e81ef93de63bb726e4ad1078e61a4666896ec809dacf619eb5f4dcc

Download Submit
C:\Windows\system\oGMZpDh.exe

Filesize
1.6MB

MD5
e7469d224f88c79ad0d7f7839657c15c

SHA1
3b89c15fb5d968943da1b0c48efd053a50677685

SHA256
b7502ecec7d3ea61fd5a73c3b7d93f1019d23b0d2f02979a862c752091a2c80f

SHA512
66060cefa0ef7259839e1fe0ad7c1705d93b08e169c7d4dd8272cdb5b2d8ce10575cc829395fd3c6f14e7fc2b2d841cf58e552fc610fc4c4fd96b4707ad6aa11

Download Submit
C:\Windows\system\oPDUhYr.exe

Filesize
1.6MB

MD5
14245328ad0fb63dad820191377d6045

SHA1
3cf82f9f13592307506262948b0aa1d7ce09a311

SHA256
cb989a5856000880727881a0e7df9fa20237e93492b448f39a2a8fb51afe1b6d

SHA512
b8a8d618fe95d07b442424baa37e0a652c15e0a3f48f4a0724bba9c2b3c337c10b25ecb2cb28c5ac68b53a586b480abc9276dfebcd691f42a6039ddc0bd705ad

Download Submit
C:\Windows\system\qKiFCRV.exe

Filesize
1.6MB

MD5
8eb5236792a550abcebeb8ffba113cf1

SHA1
e217b4e7a7c7b42471bab9be8e63485352b588e0

SHA256
f5d919a9fba28997a0b6b0803d74f257994c4b6cff2927c9c5b3bf9df5824823

SHA512
1c7bbdb3ce71e73767ebfa77bb1c9a9ba8ed47a2076860205bcd415f94b9ca4436ca67ed04bea7ae2dfa849fccd83595929bd88f600bbfdd0c806c534a0bbbe9

Download Submit
C:\Windows\system\qeOHTmy.exe

Filesize
1.6MB

MD5
adc28bec03d6d7df7446f4422067bf13

SHA1
606317cf845c87de10511a7d92ffdea887d5d25d

SHA256
22c0fd7cc2f44f24778d8a2a7fc3d56cee400b554c1f090a993027e574be0371

SHA512
b3535bb1360bb6a467711825f5e6de4e1f26c35ec5983c994e3ad45858bf8e02fe1de47a133501052542cf5dc0062654295e88716ca51f2f66c4706e2ed7d4d5

Download Submit
C:\Windows\system\slugfzq.exe

Filesize
1.6MB

MD5
a73540bf99ca7ef09be7e15a62e7e987

SHA1
fedc4d96d10a25fc20670833eadc750146aa29f9

SHA256
e7ffe308403489c153341d064fe73b9653540e7bcc06a7fb07118d0907f9b1a8

SHA512
125eae7a329ddfc52be66fb9af736ac5456e6c5a3f8c72f2930ab7c33f633d665d3d7bb81cf3db1ea86fa6112c9ecd96095cdcb37d1dbaf0d5718cf34838531a

Download Submit
C:\Windows\system\wXtxtSp.exe

Filesize
1.6MB

MD5
21570ee5ad7cba1116b125bfdc6726f7

SHA1
242dbe9b3518e5bb4223a650c7e20d04556d8a93

SHA256
85806add9c003c811c57c20ab72cdd9971f49dacd85a69e90004af23e3a1b366

SHA512
c67611c4ff0d58e9d1eea225cc0fe52f48f0c9befdde5ee9c91812b9d8195ba2d5c825e07cb8996a3d5944798dcbdd257e84ba9d93842d00e5e5e9e81ab95267

Download Submit
C:\Windows\system\xWsgpmp.exe

Filesize
1.6MB

MD5
b6904b0642fbd01b803863104236f7a7

SHA1
97b109fde29503ff40a67484272000feb32f4251

SHA256
d661573d1af58ddbaf26f4688b0e064181eb4e7302d6d8ff4544ec2be124b27c

SHA512
fc53374d370962c5a6bbca8dc6875923b6603f622c205b8e36f1a60501b5da68b9ca816eb1be3f1f323c25bb567d74b079e5e475f8b8a4275c56f19f467e97c3

Download Submit
C:\Windows\system\xewFxpz.exe

Filesize
1.6MB

MD5
55d0049dfed63a143160d5195271d1aa

SHA1
26e575c185ba16c044b5099ce3a471a01010bc63

SHA256
4fb87e4592d4f73668fb78766e73f8a491cfc7a7483a5aad3b62155b23705ff3

SHA512
a41f7f4fcf6f12c7bfddba1ebf1ec092f8a3991487613aeee378113f77678122afebf29b2485c331fd2e32db35062a283f2b0e15ac9b72f490c33fd0c316fd90

Download Submit
C:\Windows\system\yRxjPXS.exe

Filesize
1.6MB

MD5
5290a93a656ddf55717007a12ca60055

SHA1
87f0b6edbf0d509e6cd672273d2188477c65b092

SHA256
67b368326ca94326134d07d6ef713d00d4e38e2710cbdf6100e149471076c310

SHA512
ea22382b160423ba3f9b52560f6e14c8db3bb878d1b7ec74abf590687c7328b57c8701353acc722e40aacc16f6ddd5560be1e2f04b12747ce00bafd2127ccde0

Download Submit
C:\Windows\system\zqlGErv.exe

Filesize
1.6MB

MD5
30f937901e08022bf47566251f85716b

SHA1
01954ed52b160a3c317aa8991f1c7d85576fbb74

SHA256
4fbfb2e69126778d69ba1a3d115c8c4f75d1eb16ad2f8f1618aa7d95ce1bef99

SHA512
1f99e560756060c6ff85eb27da2d5aacd96ddeef717eb8555555e11c575bf40e9745986f261dc04d9cf86ea135c32d273607b6cc35d1ad032fcae1617df9cf9e

Download Submit
\Windows\system\JUGLtYO.exe

Filesize
1.6MB

MD5
edc47c447073d30dfd9442669c0f8ed5

SHA1
358e7180266f042cde05912f7eba0ac460697398

SHA256
60de3e0d67412dcd54dae47ca3900bad0f480610b0a7898dabf571bad5024ae9

SHA512
b2a3bbca195cf04400c8420759f476d2ae1e898c648ae925d4c2bb4d2de26739fe2c7b5c489713f6f48299aea132fedb3069b1765cd57ac2931738c712c0ceaa

Download Submit
\Windows\system\WGXwirg.exe

Filesize
1.6MB

MD5
7ccb940840eb5e4a914ba53997194eff

SHA1
d3c3ebdc3d1e65b623b2c74e10f0b7b6bdd79c36

SHA256
917bee2b4b1f70eb2fd13d29a888136cc6636005260efc6172d441c600afadc4

SHA512
89517ad45cd9dcce142441eab2d032c4a39bd1aa42927b444df6e8695f72477364ff1aa91d06f5baf73ed24ef6919f75a7a126e83ddb15e2341c1999eb001f9a

Download Submit
\Windows\system\weyAXBj.exe

Filesize
1.6MB

MD5
1560ef89daf275197f982951daddf298

SHA1
02424b2fbaa78f317b07f469ca4777da66620e9f

SHA256
f775ad892e56103866e5aa8f16fe13e2824a8233b63b16f8207cd854e308fa8c

SHA512
c5c523c56d9d3103d3ff9bc110c8d19ce7a665cec98e12409216ff32ed64d35e70b1ef433f1a8295f3111c06435227414c8dba4a248e2bec797feacbd89ec1e3

Download Submit
memory/532-5106-0x000000013FF10000-0x0000000140302000-memory.dmp

Filesize
3.9MB

Download
memory/532-13-0x000000013FF10000-0x0000000140302000-memory.dmp

Filesize
3.9MB

Download
memory/860-51-0x000000013FD70000-0x0000000140162000-memory.dmp

Filesize
3.9MB

Download
memory/860-5111-0x000000013FD70000-0x0000000140162000-memory.dmp

Filesize
3.9MB

Download
memory/1684-74-0x000007FEF5DB0000-0x000007FEF674D000-memory.dmp

Filesize
9.6MB

Download
memory/1684-15-0x000007FEF606E000-0x000007FEF606F000-memory.dmp

Filesize
4KB

Download
memory/1684-26-0x0000000001DF0000-0x0000000001DF8000-memory.dmp

Filesize
32KB

Download
memory/1684-20-0x000000001B830000-0x000000001BB12000-memory.dmp

Filesize
2.9MB

Download
memory/1684-59-0x000007FEF5DB0000-0x000007FEF674D000-memory.dmp

Filesize
9.6MB

Download
memory/1684-44-0x000007FEF5DB0000-0x000007FEF674D000-memory.dmp

Filesize
9.6MB

Download
memory/1684-147-0x000007FEF5DB0000-0x000007FEF674D000-memory.dmp

Filesize
9.6MB

Download
memory/1684-14-0x0000000002C60000-0x0000000002CE0000-memory.dmp

Filesize
512KB

Download
memory/1908-95-0x000000013F0A0000-0x000000013F492000-memory.dmp

Filesize
3.9MB

Download
memory/1908-5118-0x000000013F0A0000-0x000000013F492000-memory.dmp

Filesize
3.9MB

Download
memory/1908-1066-0x000000013F0A0000-0x000000013F492000-memory.dmp

Filesize
3.9MB

Download
memory/2424-5110-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/2424-61-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/2732-82-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/2732-5108-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/2764-84-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/2764-5109-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/2836-85-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/2836-5107-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/2852-63-0x000000013FAF0000-0x000000013FEE2000-memory.dmp

Filesize
3.9MB

Download
memory/2852-5113-0x000000013FAF0000-0x000000013FEE2000-memory.dmp

Filesize
3.9MB

Download
memory/2872-83-0x000000013FAB0000-0x000000013FEA2000-memory.dmp

Filesize
3.9MB

Download
memory/2872-5124-0x000000013FAB0000-0x000000013FEA2000-memory.dmp

Filesize
3.9MB

Download
memory/2900-67-0x00000000036C0000-0x0000000003AB2000-memory.dmp

Filesize
3.9MB

Download
memory/2900-81-0x00000000036C0000-0x0000000003AB2000-memory.dmp

Filesize
3.9MB

Download
memory/2900-66-0x00000000036C0000-0x0000000003AB2000-memory.dmp

Filesize
3.9MB

Download
memory/2900-65-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/2900-64-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/2900-68-0x000000013F9A0000-0x000000013FD92000-memory.dmp

Filesize
3.9MB

Download
memory/2900-62-0x00000000036C0000-0x0000000003AB2000-memory.dmp

Filesize
3.9MB

Download
memory/2900-69-0x000000013F0A0000-0x000000013F492000-memory.dmp

Filesize
3.9MB

Download
memory/2900-60-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/2900-78-0x0000000003160000-0x0000000003552000-memory.dmp

Filesize
3.9MB

Download
memory/2900-80-0x00000000036C0000-0x0000000003AB2000-memory.dmp

Filesize
3.9MB

Download
memory/2900-0-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/2900-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2900-8-0x0000000003160000-0x0000000003552000-memory.dmp

Filesize
3.9MB

Download
memory/2900-346-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/2944-93-0x000000013F9A0000-0x000000013FD92000-memory.dmp

Filesize
3.9MB

Download
memory/2944-1047-0x000000013F9A0000-0x000000013FD92000-memory.dmp

Filesize
3.9MB

Download
memory/2944-5116-0x000000013F9A0000-0x000000013FD92000-memory.dmp

Filesize
3.9MB

Download
memory/3024-5121-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/3024-832-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/3024-90-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/3028-719-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/3028-5114-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/3028-88-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download