xmrig | 727bac2d852985885875eace1c6ab6ca027fcc161323913ef03d077e924e086b

Analysis

max time kernel
115s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 17:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ac16a09437fcc8ee9079d79a0e103a0N.exe
Size

1.7MB
MD5

1ac16a09437fcc8ee9079d79a0e103a0
SHA1

df221f5b08322022d4f50a976e88c635d31f7225
SHA256

727bac2d852985885875eace1c6ab6ca027fcc161323913ef03d077e924e086b
SHA512

5d8bdb70ac702c0fdb4e46ee2775e8f5da981d6dd4b3490fa6c11dc0656b1c07e931661450377e64e786dfc525beed304afa964c4487f2c57d73b4e8fff221b1
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYlZ3pBjqlx7TovQmVV4dThen9z6:Lz071uv4BPMkibTIA5lCx7kvRWa4pfY6

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 30 IoCs

miner

resource	yara_rule
behavioral1/memory/2296-9-0x000000013F720000-0x000000013FB12000-memory.dmp	xmrig
behavioral1/memory/2848-20-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	xmrig
behavioral1/memory/2868-29-0x000000013F100000-0x000000013F4F2000-memory.dmp	xmrig
behavioral1/memory/2956-45-0x000000013F0A0000-0x000000013F492000-memory.dmp	xmrig
behavioral1/memory/2956-82-0x000000013F0A0000-0x000000013F492000-memory.dmp	xmrig
behavioral1/memory/2808-97-0x000000013FF80000-0x0000000140372000-memory.dmp	xmrig
behavioral1/memory/1972-426-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	xmrig
behavioral1/memory/1972-284-0x000000013F560000-0x000000013F952000-memory.dmp	xmrig
behavioral1/memory/3044-106-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	xmrig
behavioral1/memory/2056-104-0x000000013F540000-0x000000013F932000-memory.dmp	xmrig
behavioral1/memory/2356-96-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	xmrig
behavioral1/memory/2736-89-0x000000013F620000-0x000000013FA12000-memory.dmp	xmrig
behavioral1/memory/2392-81-0x000000013F160000-0x000000013F552000-memory.dmp	xmrig
behavioral1/memory/2924-74-0x000000013F480000-0x000000013F872000-memory.dmp	xmrig
behavioral1/memory/1660-73-0x000000013F080000-0x000000013F472000-memory.dmp	xmrig
behavioral1/memory/2296-56-0x000000013F720000-0x000000013FB12000-memory.dmp	xmrig
behavioral1/memory/1972-47-0x000000013F560000-0x000000013F952000-memory.dmp	xmrig
behavioral1/memory/2924-37-0x000000013F480000-0x000000013F872000-memory.dmp	xmrig
behavioral1/memory/2296-2006-0x000000013F720000-0x000000013FB12000-memory.dmp	xmrig
behavioral1/memory/2924-2009-0x000000013F480000-0x000000013F872000-memory.dmp	xmrig
behavioral1/memory/2056-2010-0x000000013F540000-0x000000013F932000-memory.dmp	xmrig
behavioral1/memory/2808-2012-0x000000013FF80000-0x0000000140372000-memory.dmp	xmrig
behavioral1/memory/2356-2015-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	xmrig
behavioral1/memory/3044-2017-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	xmrig
behavioral1/memory/2848-2016-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	xmrig
behavioral1/memory/2956-2007-0x000000013F0A0000-0x000000013F492000-memory.dmp	xmrig
behavioral1/memory/2868-2008-0x000000013F100000-0x000000013F4F2000-memory.dmp	xmrig
behavioral1/memory/1660-2011-0x000000013F080000-0x000000013F472000-memory.dmp	xmrig
behavioral1/memory/2736-2013-0x000000013F620000-0x000000013FA12000-memory.dmp	xmrig
behavioral1/memory/2392-2014-0x000000013F160000-0x000000013F552000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2732	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2296	RdphxVs.exe
2848	COVBLaA.exe
2868	YNoKvfL.exe
2924	WAHyhgI.exe
2956	psjShbR.exe
2808	WzWSJMR.exe
2056	mvZGTdM.exe
1660	MRexMEa.exe
2392	UAxydNG.exe
2736	SvMlHcC.exe
2356	UCOLxmK.exe
3044	rkOfLkE.exe
2172	ttuMTRG.exe
2900	rHfumnM.exe
2740	BtWZGMC.exe
2212	RWujOrL.exe
2700	WWneeXF.exe
1028	MBiZmZy.exe
1404	FPCqwTA.exe
2216	ORBzlqe.exe
2012	wIKJAqC.exe
2560	NNibHBX.exe
2500	SgIBzML.exe
2272	MkWJpRG.exe
1148	zTCDUBO.exe
1480	CjcFMJc.exe
1996	lVIPMVg.exe
2496	oeWsZhn.exe
1696	KAEoWNi.exe
1636	KRmLRTS.exe
2952	GFSzUdi.exe
2084	wLfMaRQ.exe
1528	EgTKgUX.exe
2492	IGUwGGq.exe
1408	wKDmLpb.exe
2024	tHLSVeL.exe
2840	YootobX.exe
1156	eAvXnbh.exe
1944	srOOwFv.exe
1744	yfBJNlz.exe
1164	nnaBJmp.exe
2160	FhbMYAD.exe
324	gSPtPyQ.exe
2344	iKisCpR.exe
1308	JaFYYQq.exe
1724	heEtWYr.exe
2120	NuBltEA.exe
2100	UcAimae.exe
1596	rrHKXzE.exe
2552	YLdtPGC.exe
2872	NianfsY.exe
2772	swXTjmh.exe
2780	SFxFXSg.exe
2660	HYdfMuc.exe
2656	QnyIZJJ.exe
2744	YjlqJPB.exe
2052	tClQbya.exe
2688	LSbmtNk.exe
1060	kemUCMh.exe
2972	mFcvMSo.exe
2892	rLQlWlU.exe
3064	FefyhqX.exe
2340	ZcWiBbU.exe
1616	fKqHeQP.exe

Loads dropped DLL 64 IoCs

pid	Process
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1972-0-0x000000013F560000-0x000000013F952000-memory.dmp	upx
behavioral1/files/0x000c000000012251-3.dat	upx
behavioral1/memory/2296-9-0x000000013F720000-0x000000013FB12000-memory.dmp	upx
behavioral1/files/0x0007000000018b54-10.dat	upx
behavioral1/files/0x0006000000018b58-23.dat	upx
behavioral1/memory/2848-20-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	upx
behavioral1/memory/2868-29-0x000000013F100000-0x000000013F4F2000-memory.dmp	upx
behavioral1/files/0x001700000000558f-35.dat	upx
behavioral1/memory/2956-45-0x000000013F0A0000-0x000000013F492000-memory.dmp	upx
behavioral1/files/0x000f000000018afc-41.dat	upx
behavioral1/files/0x0009000000018b64-55.dat	upx
behavioral1/memory/2056-63-0x000000013F540000-0x000000013F932000-memory.dmp	upx
behavioral1/memory/2956-82-0x000000013F0A0000-0x000000013F492000-memory.dmp	upx
behavioral1/files/0x0005000000018fc7-85.dat	upx
behavioral1/memory/2808-97-0x000000013FF80000-0x0000000140372000-memory.dmp	upx
behavioral1/files/0x000500000001901a-119.dat	upx
behavioral1/files/0x000400000001919b-154.dat	upx
behavioral1/files/0x00040000000191ed-185.dat	upx
behavioral1/files/0x0004000000019206-195.dat	upx
behavioral1/memory/1972-284-0x000000013F560000-0x000000013F952000-memory.dmp	upx
behavioral1/files/0x00040000000192d3-205.dat	upx
behavioral1/files/0x00040000000192ad-200.dat	upx
behavioral1/files/0x00040000000191f7-190.dat	upx
behavioral1/files/0x00040000000191d2-175.dat	upx
behavioral1/files/0x00040000000191da-180.dat	upx
behavioral1/files/0x00040000000191c8-170.dat	upx
behavioral1/files/0x00040000000191bb-164.dat	upx
behavioral1/files/0x00040000000191b3-159.dat	upx
behavioral1/files/0x000400000001915a-149.dat	upx
behavioral1/files/0x0005000000019074-144.dat	upx
behavioral1/files/0x000500000001904d-139.dat	upx
behavioral1/files/0x0005000000019044-134.dat	upx
behavioral1/files/0x000500000001903d-129.dat	upx
behavioral1/files/0x0005000000019028-124.dat	upx
behavioral1/files/0x0005000000018ffa-114.dat	upx
behavioral1/memory/3044-106-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	upx
behavioral1/memory/2056-104-0x000000013F540000-0x000000013F932000-memory.dmp	upx
behavioral1/files/0x0005000000018fe2-109.dat	upx
behavioral1/files/0x0005000000018fcd-100.dat	upx
behavioral1/memory/2356-96-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	upx
behavioral1/memory/2736-89-0x000000013F620000-0x000000013FA12000-memory.dmp	upx
behavioral1/files/0x0005000000018fca-92.dat	upx
behavioral1/memory/2392-81-0x000000013F160000-0x000000013F552000-memory.dmp	upx
behavioral1/files/0x0005000000018fc4-78.dat	upx
behavioral1/memory/2924-74-0x000000013F480000-0x000000013F872000-memory.dmp	upx
behavioral1/memory/1660-73-0x000000013F080000-0x000000013F472000-memory.dmp	upx
behavioral1/files/0x0005000000018fc2-69.dat	upx
behavioral1/files/0x0006000000018b6e-59.dat	upx
behavioral1/memory/2296-56-0x000000013F720000-0x000000013FB12000-memory.dmp	upx
behavioral1/memory/1972-52-0x000000013FF80000-0x0000000140372000-memory.dmp	upx
behavioral1/memory/1972-47-0x000000013F560000-0x000000013F952000-memory.dmp	upx
behavioral1/memory/2924-37-0x000000013F480000-0x000000013F872000-memory.dmp	upx
behavioral1/memory/2296-2006-0x000000013F720000-0x000000013FB12000-memory.dmp	upx
behavioral1/memory/2924-2009-0x000000013F480000-0x000000013F872000-memory.dmp	upx
behavioral1/memory/2056-2010-0x000000013F540000-0x000000013F932000-memory.dmp	upx
behavioral1/memory/2808-2012-0x000000013FF80000-0x0000000140372000-memory.dmp	upx
behavioral1/memory/2356-2015-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	upx
behavioral1/memory/3044-2017-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	upx
behavioral1/memory/2848-2016-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	upx
behavioral1/memory/2956-2007-0x000000013F0A0000-0x000000013F492000-memory.dmp	upx
behavioral1/memory/2868-2008-0x000000013F100000-0x000000013F4F2000-memory.dmp	upx
behavioral1/memory/1660-2011-0x000000013F080000-0x000000013F472000-memory.dmp	upx
behavioral1/memory/2736-2013-0x000000013F620000-0x000000013FA12000-memory.dmp	upx
behavioral1/memory/2392-2014-0x000000013F160000-0x000000013F552000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\AHNPoxT.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\ZVegXOd.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\MuNrYBw.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\PIWcFzM.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\VEhYGGN.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\nFlxgHZ.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\andSSMs.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\FraKPyf.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\OXPkPTN.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\qiKUyNa.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\KoJwmKs.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\FDZcYZH.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\zAeyFxX.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\KLpjJxy.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\RUPFkRk.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\JsKfldl.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\bqpKMaW.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\IOsXprO.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\LUDdhSa.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\mspTlBR.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\LQFSPif.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\EgTKgUX.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\ETVgzMb.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\foXhyFz.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\laOEHlC.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\zESQymz.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\GeYJGqQ.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\TbDKpvv.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\UNYVjBc.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\hlZDnuO.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\iWLipWz.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\YMacRjW.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\nQQdzRA.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\krbIXnF.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\GPCWKzr.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\DPYkOiz.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\eQWaUUo.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\iUWbqIT.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\hSqtEwE.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\YNoKvfL.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\FBuxHiY.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\HjsasJU.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\LKhOztt.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\GccsASH.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\tXvTddD.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\KkCtLRW.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\cNXgevz.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\pTVegrK.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\ODcvHEG.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\mAvEvNd.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\CQpoFfS.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\ftTXuLW.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\bHpBbLf.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\sYIXaht.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\MigkLdK.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\GTYciIU.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\jMVtLGP.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\GjdMpJY.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\AsyRjrB.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\brdQkjW.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\nfkpRlr.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\pLdMNTJ.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\ZbTXCLW.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\AhdCGps.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2732	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
Token: SeLockMemoryPrivilege	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe
Token: SeDebugPrivilege	2732	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2732	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	30
PID 1972 wrote to memory of 2732	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	30
PID 1972 wrote to memory of 2732	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	30
PID 1972 wrote to memory of 2296	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	31
PID 1972 wrote to memory of 2296	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	31
PID 1972 wrote to memory of 2296	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	31
PID 1972 wrote to memory of 2848	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	32
PID 1972 wrote to memory of 2848	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	32
PID 1972 wrote to memory of 2848	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	32
PID 1972 wrote to memory of 2868	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	33
PID 1972 wrote to memory of 2868	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	33
PID 1972 wrote to memory of 2868	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	33
PID 1972 wrote to memory of 2924	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	34
PID 1972 wrote to memory of 2924	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	34
PID 1972 wrote to memory of 2924	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	34
PID 1972 wrote to memory of 2956	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	35
PID 1972 wrote to memory of 2956	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	35
PID 1972 wrote to memory of 2956	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	35
PID 1972 wrote to memory of 2808	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	36
PID 1972 wrote to memory of 2808	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	36
PID 1972 wrote to memory of 2808	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	36
PID 1972 wrote to memory of 2056	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	37
PID 1972 wrote to memory of 2056	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	37
PID 1972 wrote to memory of 2056	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	37
PID 1972 wrote to memory of 1660	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	38
PID 1972 wrote to memory of 1660	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	38
PID 1972 wrote to memory of 1660	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	38
PID 1972 wrote to memory of 2392	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	39
PID 1972 wrote to memory of 2392	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	39
PID 1972 wrote to memory of 2392	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	39
PID 1972 wrote to memory of 2736	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	40
PID 1972 wrote to memory of 2736	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	40
PID 1972 wrote to memory of 2736	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	40
PID 1972 wrote to memory of 2356	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	41
PID 1972 wrote to memory of 2356	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	41
PID 1972 wrote to memory of 2356	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	41
PID 1972 wrote to memory of 3044	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	42
PID 1972 wrote to memory of 3044	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	42
PID 1972 wrote to memory of 3044	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	42
PID 1972 wrote to memory of 2172	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	43
PID 1972 wrote to memory of 2172	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	43
PID 1972 wrote to memory of 2172	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	43
PID 1972 wrote to memory of 2900	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	44
PID 1972 wrote to memory of 2900	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	44
PID 1972 wrote to memory of 2900	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	44
PID 1972 wrote to memory of 2740	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	45
PID 1972 wrote to memory of 2740	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	45
PID 1972 wrote to memory of 2740	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	45
PID 1972 wrote to memory of 2212	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	46
PID 1972 wrote to memory of 2212	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	46
PID 1972 wrote to memory of 2212	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	46
PID 1972 wrote to memory of 2700	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	47
PID 1972 wrote to memory of 2700	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	47
PID 1972 wrote to memory of 2700	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	47
PID 1972 wrote to memory of 1028	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	48
PID 1972 wrote to memory of 1028	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	48
PID 1972 wrote to memory of 1028	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	48
PID 1972 wrote to memory of 1404	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	49
PID 1972 wrote to memory of 1404	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	49
PID 1972 wrote to memory of 1404	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	49
PID 1972 wrote to memory of 2216	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	50
PID 1972 wrote to memory of 2216	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	50
PID 1972 wrote to memory of 2216	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	50
PID 1972 wrote to memory of 2012	1972	1ac16a09437fcc8ee9079d79a0e103a0N.exe	51

C:\Users\Admin\AppData\Local\Temp\1ac16a09437fcc8ee9079d79a0e103a0N.exe
"C:\Users\Admin\AppData\Local\Temp\1ac16a09437fcc8ee9079d79a0e103a0N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2732
- C:\Windows\System\RdphxVs.exe
  C:\Windows\System\RdphxVs.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\COVBLaA.exe
  C:\Windows\System\COVBLaA.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\YNoKvfL.exe
  C:\Windows\System\YNoKvfL.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\WAHyhgI.exe
  C:\Windows\System\WAHyhgI.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\psjShbR.exe
  C:\Windows\System\psjShbR.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\WzWSJMR.exe
  C:\Windows\System\WzWSJMR.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\mvZGTdM.exe
  C:\Windows\System\mvZGTdM.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\MRexMEa.exe
  C:\Windows\System\MRexMEa.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\UAxydNG.exe
  C:\Windows\System\UAxydNG.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\SvMlHcC.exe
  C:\Windows\System\SvMlHcC.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\UCOLxmK.exe
  C:\Windows\System\UCOLxmK.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\rkOfLkE.exe
  C:\Windows\System\rkOfLkE.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\ttuMTRG.exe
  C:\Windows\System\ttuMTRG.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\rHfumnM.exe
  C:\Windows\System\rHfumnM.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\BtWZGMC.exe
  C:\Windows\System\BtWZGMC.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\RWujOrL.exe
  C:\Windows\System\RWujOrL.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\WWneeXF.exe
  C:\Windows\System\WWneeXF.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\MBiZmZy.exe
  C:\Windows\System\MBiZmZy.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\FPCqwTA.exe
  C:\Windows\System\FPCqwTA.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\ORBzlqe.exe
  C:\Windows\System\ORBzlqe.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\wIKJAqC.exe
  C:\Windows\System\wIKJAqC.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\NNibHBX.exe
  C:\Windows\System\NNibHBX.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\SgIBzML.exe
  C:\Windows\System\SgIBzML.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\MkWJpRG.exe
  C:\Windows\System\MkWJpRG.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\zTCDUBO.exe
  C:\Windows\System\zTCDUBO.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\CjcFMJc.exe
  C:\Windows\System\CjcFMJc.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\lVIPMVg.exe
  C:\Windows\System\lVIPMVg.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\oeWsZhn.exe
  C:\Windows\System\oeWsZhn.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\KAEoWNi.exe
  C:\Windows\System\KAEoWNi.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\KRmLRTS.exe
  C:\Windows\System\KRmLRTS.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\GFSzUdi.exe
  C:\Windows\System\GFSzUdi.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\wLfMaRQ.exe
  C:\Windows\System\wLfMaRQ.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\EgTKgUX.exe
  C:\Windows\System\EgTKgUX.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\IGUwGGq.exe
  C:\Windows\System\IGUwGGq.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\wKDmLpb.exe
  C:\Windows\System\wKDmLpb.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\tHLSVeL.exe
  C:\Windows\System\tHLSVeL.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\YootobX.exe
  C:\Windows\System\YootobX.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\eAvXnbh.exe
  C:\Windows\System\eAvXnbh.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\srOOwFv.exe
  C:\Windows\System\srOOwFv.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\yfBJNlz.exe
  C:\Windows\System\yfBJNlz.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\nnaBJmp.exe
  C:\Windows\System\nnaBJmp.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\FhbMYAD.exe
  C:\Windows\System\FhbMYAD.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\gSPtPyQ.exe
  C:\Windows\System\gSPtPyQ.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\iKisCpR.exe
  C:\Windows\System\iKisCpR.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\JaFYYQq.exe
  C:\Windows\System\JaFYYQq.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\heEtWYr.exe
  C:\Windows\System\heEtWYr.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\NuBltEA.exe
  C:\Windows\System\NuBltEA.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\UcAimae.exe
  C:\Windows\System\UcAimae.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\rrHKXzE.exe
  C:\Windows\System\rrHKXzE.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\YLdtPGC.exe
  C:\Windows\System\YLdtPGC.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\NianfsY.exe
  C:\Windows\System\NianfsY.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\swXTjmh.exe
  C:\Windows\System\swXTjmh.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\SFxFXSg.exe
  C:\Windows\System\SFxFXSg.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\HYdfMuc.exe
  C:\Windows\System\HYdfMuc.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\QnyIZJJ.exe
  C:\Windows\System\QnyIZJJ.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\YjlqJPB.exe
  C:\Windows\System\YjlqJPB.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\tClQbya.exe
  C:\Windows\System\tClQbya.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\LSbmtNk.exe
  C:\Windows\System\LSbmtNk.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\kemUCMh.exe
  C:\Windows\System\kemUCMh.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\mFcvMSo.exe
  C:\Windows\System\mFcvMSo.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\rLQlWlU.exe
  C:\Windows\System\rLQlWlU.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\FefyhqX.exe
  C:\Windows\System\FefyhqX.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\ZcWiBbU.exe
  C:\Windows\System\ZcWiBbU.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\fKqHeQP.exe
  C:\Windows\System\fKqHeQP.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\kEZihar.exe
  C:\Windows\System\kEZihar.exe
  2⤵
  PID:2184
- C:\Windows\System\LiDlvdA.exe
  C:\Windows\System\LiDlvdA.exe
  2⤵
  PID:2096
- C:\Windows\System\iXrQIHp.exe
  C:\Windows\System\iXrQIHp.exe
  2⤵
  PID:2508
- C:\Windows\System\JHGBxMC.exe
  C:\Windows\System\JHGBxMC.exe
  2⤵
  PID:1896
- C:\Windows\System\DydOMRl.exe
  C:\Windows\System\DydOMRl.exe
  2⤵
  PID:920
- C:\Windows\System\gOcrmPP.exe
  C:\Windows\System\gOcrmPP.exe
  2⤵
  PID:2188
- C:\Windows\System\evrAuba.exe
  C:\Windows\System\evrAuba.exe
  2⤵
  PID:2308
- C:\Windows\System\TbDKpvv.exe
  C:\Windows\System\TbDKpvv.exe
  2⤵
  PID:2464
- C:\Windows\System\ALggPMq.exe
  C:\Windows\System\ALggPMq.exe
  2⤵
  PID:1036
- C:\Windows\System\ZNwZtoC.exe
  C:\Windows\System\ZNwZtoC.exe
  2⤵
  PID:1524
- C:\Windows\System\JdXIevh.exe
  C:\Windows\System\JdXIevh.exe
  2⤵
  PID:540
- C:\Windows\System\tBawaiR.exe
  C:\Windows\System\tBawaiR.exe
  2⤵
  PID:1080
- C:\Windows\System\qbFeMuf.exe
  C:\Windows\System\qbFeMuf.exe
  2⤵
  PID:2200
- C:\Windows\System\VQzcQWz.exe
  C:\Windows\System\VQzcQWz.exe
  2⤵
  PID:2252
- C:\Windows\System\UWSKcyI.exe
  C:\Windows\System\UWSKcyI.exe
  2⤵
  PID:472
- C:\Windows\System\lrUxBwg.exe
  C:\Windows\System\lrUxBwg.exe
  2⤵
  PID:2264
- C:\Windows\System\DjUDwpa.exe
  C:\Windows\System\DjUDwpa.exe
  2⤵
  PID:692
- C:\Windows\System\zWOFZAY.exe
  C:\Windows\System\zWOFZAY.exe
  2⤵
  PID:2724
- C:\Windows\System\cjYMTJj.exe
  C:\Windows\System\cjYMTJj.exe
  2⤵
  PID:1800
- C:\Windows\System\VFndplT.exe
  C:\Windows\System\VFndplT.exe
  2⤵
  PID:2784
- C:\Windows\System\reITIOM.exe
  C:\Windows\System\reITIOM.exe
  2⤵
  PID:2180
- C:\Windows\System\ImWVXUD.exe
  C:\Windows\System\ImWVXUD.exe
  2⤵
  PID:2248
- C:\Windows\System\lYhoVjc.exe
  C:\Windows\System\lYhoVjc.exe
  2⤵
  PID:3004
- C:\Windows\System\aukVKDG.exe
  C:\Windows\System\aukVKDG.exe
  2⤵
  PID:2844
- C:\Windows\System\vZXDZCJ.exe
  C:\Windows\System\vZXDZCJ.exe
  2⤵
  PID:2384
- C:\Windows\System\JDetXiU.exe
  C:\Windows\System\JDetXiU.exe
  2⤵
  PID:2580
- C:\Windows\System\iyUgBaL.exe
  C:\Windows\System\iyUgBaL.exe
  2⤵
  PID:2460
- C:\Windows\System\VPQGYAu.exe
  C:\Windows\System\VPQGYAu.exe
  2⤵
  PID:1032
- C:\Windows\System\lDaVmCB.exe
  C:\Windows\System\lDaVmCB.exe
  2⤵
  PID:1604
- C:\Windows\System\Hgkrbkc.exe
  C:\Windows\System\Hgkrbkc.exe
  2⤵
  PID:1004
- C:\Windows\System\MkndoQy.exe
  C:\Windows\System\MkndoQy.exe
  2⤵
  PID:2912
- C:\Windows\System\iUVwfNO.exe
  C:\Windows\System\iUVwfNO.exe
  2⤵
  PID:1436
- C:\Windows\System\ZOneLdo.exe
  C:\Windows\System\ZOneLdo.exe
  2⤵
  PID:1108
- C:\Windows\System\oOnZeKM.exe
  C:\Windows\System\oOnZeKM.exe
  2⤵
  PID:2544
- C:\Windows\System\RjnYMuc.exe
  C:\Windows\System\RjnYMuc.exe
  2⤵
  PID:1776
- C:\Windows\System\mJycjtO.exe
  C:\Windows\System\mJycjtO.exe
  2⤵
  PID:2192
- C:\Windows\System\zzpvUcE.exe
  C:\Windows\System\zzpvUcE.exe
  2⤵
  PID:2416
- C:\Windows\System\eBCrvRp.exe
  C:\Windows\System\eBCrvRp.exe
  2⤵
  PID:1620
- C:\Windows\System\krbIXnF.exe
  C:\Windows\System\krbIXnF.exe
  2⤵
  PID:2068
- C:\Windows\System\YgLPGgr.exe
  C:\Windows\System\YgLPGgr.exe
  2⤵
  PID:864
- C:\Windows\System\TmfRMbx.exe
  C:\Windows\System\TmfRMbx.exe
  2⤵
  PID:3020
- C:\Windows\System\VdyJJvM.exe
  C:\Windows\System\VdyJJvM.exe
  2⤵
  PID:2664
- C:\Windows\System\PuPHaib.exe
  C:\Windows\System\PuPHaib.exe
  2⤵
  PID:2996
- C:\Windows\System\kpsKXFh.exe
  C:\Windows\System\kpsKXFh.exe
  2⤵
  PID:2764
- C:\Windows\System\IEOudvp.exe
  C:\Windows\System\IEOudvp.exe
  2⤵
  PID:1652
- C:\Windows\System\nLzwlpZ.exe
  C:\Windows\System\nLzwlpZ.exe
  2⤵
  PID:2880
- C:\Windows\System\TlJBOZL.exe
  C:\Windows\System\TlJBOZL.exe
  2⤵
  PID:1160
- C:\Windows\System\BzGyTqc.exe
  C:\Windows\System\BzGyTqc.exe
  2⤵
  PID:2988
- C:\Windows\System\mHgeAZO.exe
  C:\Windows\System\mHgeAZO.exe
  2⤵
  PID:2804
- C:\Windows\System\abSRuhW.exe
  C:\Windows\System\abSRuhW.exe
  2⤵
  PID:2816
- C:\Windows\System\DSximGB.exe
  C:\Windows\System\DSximGB.exe
  2⤵
  PID:808
- C:\Windows\System\VadMqNU.exe
  C:\Windows\System\VadMqNU.exe
  2⤵
  PID:1192
- C:\Windows\System\XQihUpu.exe
  C:\Windows\System\XQihUpu.exe
  2⤵
  PID:2236
- C:\Windows\System\JkFIjJl.exe
  C:\Windows\System\JkFIjJl.exe
  2⤵
  PID:2452
- C:\Windows\System\DLhkYKx.exe
  C:\Windows\System\DLhkYKx.exe
  2⤵
  PID:1152
- C:\Windows\System\RZIDtRf.exe
  C:\Windows\System\RZIDtRf.exe
  2⤵
  PID:1788
- C:\Windows\System\gUUVJEs.exe
  C:\Windows\System\gUUVJEs.exe
  2⤵
  PID:584
- C:\Windows\System\fHxUlEg.exe
  C:\Windows\System\fHxUlEg.exe
  2⤵
  PID:872
- C:\Windows\System\mgRmMzw.exe
  C:\Windows\System\mgRmMzw.exe
  2⤵
  PID:2480
- C:\Windows\System\WTUujnS.exe
  C:\Windows\System\WTUujnS.exe
  2⤵
  PID:624
- C:\Windows\System\NxCaOLC.exe
  C:\Windows\System\NxCaOLC.exe
  2⤵
  PID:1760
- C:\Windows\System\iXUjQps.exe
  C:\Windows\System\iXUjQps.exe
  2⤵
  PID:2668
- C:\Windows\System\IGHDdlF.exe
  C:\Windows\System\IGHDdlF.exe
  2⤵
  PID:2276
- C:\Windows\System\uloZdKZ.exe
  C:\Windows\System\uloZdKZ.exe
  2⤵
  PID:2156
- C:\Windows\System\SJJpanp.exe
  C:\Windows\System\SJJpanp.exe
  2⤵
  PID:2584
- C:\Windows\System\KxAynJJ.exe
  C:\Windows\System\KxAynJJ.exe
  2⤵
  PID:1320
- C:\Windows\System\OLgeBUY.exe
  C:\Windows\System\OLgeBUY.exe
  2⤵
  PID:2488
- C:\Windows\System\LYdDLHW.exe
  C:\Windows\System\LYdDLHW.exe
  2⤵
  PID:2616
- C:\Windows\System\rzliJQj.exe
  C:\Windows\System\rzliJQj.exe
  2⤵
  PID:1488
- C:\Windows\System\hBjOukw.exe
  C:\Windows\System\hBjOukw.exe
  2⤵
  PID:2312
- C:\Windows\System\OUebeTP.exe
  C:\Windows\System\OUebeTP.exe
  2⤵
  PID:2716
- C:\Windows\System\MvOjzie.exe
  C:\Windows\System\MvOjzie.exe
  2⤵
  PID:632
- C:\Windows\System\Nacibrx.exe
  C:\Windows\System\Nacibrx.exe
  2⤵
  PID:2144
- C:\Windows\System\mCGdzCL.exe
  C:\Windows\System\mCGdzCL.exe
  2⤵
  PID:1812
- C:\Windows\System\ZznMzmC.exe
  C:\Windows\System\ZznMzmC.exe
  2⤵
  PID:1260
- C:\Windows\System\atyyTyY.exe
  C:\Windows\System\atyyTyY.exe
  2⤵
  PID:1000
- C:\Windows\System\YNLEwdc.exe
  C:\Windows\System\YNLEwdc.exe
  2⤵
  PID:2568
- C:\Windows\System\XhkpAtB.exe
  C:\Windows\System\XhkpAtB.exe
  2⤵
  PID:2944
- C:\Windows\System\csWeUPV.exe
  C:\Windows\System\csWeUPV.exe
  2⤵
  PID:1684
- C:\Windows\System\IkVPkHS.exe
  C:\Windows\System\IkVPkHS.exe
  2⤵
  PID:2712
- C:\Windows\System\QmSDQmx.exe
  C:\Windows\System\QmSDQmx.exe
  2⤵
  PID:2444
- C:\Windows\System\RZpYDvI.exe
  C:\Windows\System\RZpYDvI.exe
  2⤵
  PID:1572
- C:\Windows\System\gKYHpHa.exe
  C:\Windows\System\gKYHpHa.exe
  2⤵
  PID:1568
- C:\Windows\System\DKRoTfL.exe
  C:\Windows\System\DKRoTfL.exe
  2⤵
  PID:328
- C:\Windows\System\pTVegrK.exe
  C:\Windows\System\pTVegrK.exe
  2⤵
  PID:2504
- C:\Windows\System\kEilprS.exe
  C:\Windows\System\kEilprS.exe
  2⤵
  PID:1084
- C:\Windows\System\gAeBxFc.exe
  C:\Windows\System\gAeBxFc.exe
  2⤵
  PID:2788
- C:\Windows\System\ZcpWCiu.exe
  C:\Windows\System\ZcpWCiu.exe
  2⤵
  PID:2860
- C:\Windows\System\OQVKQKP.exe
  C:\Windows\System\OQVKQKP.exe
  2⤵
  PID:2300
- C:\Windows\System\BOMURQA.exe
  C:\Windows\System\BOMURQA.exe
  2⤵
  PID:2920
- C:\Windows\System\VWDEWMC.exe
  C:\Windows\System\VWDEWMC.exe
  2⤵
  PID:2532
- C:\Windows\System\lViqQHw.exe
  C:\Windows\System\lViqQHw.exe
  2⤵
  PID:2000
- C:\Windows\System\SFFOBsB.exe
  C:\Windows\System\SFFOBsB.exe
  2⤵
  PID:1012
- C:\Windows\System\EVztOYQ.exe
  C:\Windows\System\EVztOYQ.exe
  2⤵
  PID:1704
- C:\Windows\System\RpUtzFo.exe
  C:\Windows\System\RpUtzFo.exe
  2⤵
  PID:2692
- C:\Windows\System\KQDwgpV.exe
  C:\Windows\System\KQDwgpV.exe
  2⤵
  PID:2728
- C:\Windows\System\hhEMfcS.exe
  C:\Windows\System\hhEMfcS.exe
  2⤵
  PID:2748
- C:\Windows\System\BkaVajo.exe
  C:\Windows\System\BkaVajo.exe
  2⤵
  PID:2360
- C:\Windows\System\snNmZgl.exe
  C:\Windows\System\snNmZgl.exe
  2⤵
  PID:756
- C:\Windows\System\OQZNscP.exe
  C:\Windows\System\OQZNscP.exe
  2⤵
  PID:700
- C:\Windows\System\oVoegNS.exe
  C:\Windows\System\oVoegNS.exe
  2⤵
  PID:2060
- C:\Windows\System\RHJdZTP.exe
  C:\Windows\System\RHJdZTP.exe
  2⤵
  PID:2984
- C:\Windows\System\YtYtgNJ.exe
  C:\Windows\System\YtYtgNJ.exe
  2⤵
  PID:2448
- C:\Windows\System\ksUkXJQ.exe
  C:\Windows\System\ksUkXJQ.exe
  2⤵
  PID:2232
- C:\Windows\System\AuOXIjI.exe
  C:\Windows\System\AuOXIjI.exe
  2⤵
  PID:1564
- C:\Windows\System\WjgzcTl.exe
  C:\Windows\System\WjgzcTl.exe
  2⤵
  PID:2980
- C:\Windows\System\LqrikLE.exe
  C:\Windows\System\LqrikLE.exe
  2⤵
  PID:3076
- C:\Windows\System\FtjucnA.exe
  C:\Windows\System\FtjucnA.exe
  2⤵
  PID:3092
- C:\Windows\System\CdVwtuN.exe
  C:\Windows\System\CdVwtuN.exe
  2⤵
  PID:3108
- C:\Windows\System\ttWGuKm.exe
  C:\Windows\System\ttWGuKm.exe
  2⤵
  PID:3124
- C:\Windows\System\YGxgdux.exe
  C:\Windows\System\YGxgdux.exe
  2⤵
  PID:3140
- C:\Windows\System\cNFfcru.exe
  C:\Windows\System\cNFfcru.exe
  2⤵
  PID:3156
- C:\Windows\System\MVehDtD.exe
  C:\Windows\System\MVehDtD.exe
  2⤵
  PID:3248
- C:\Windows\System\nCqgBVM.exe
  C:\Windows\System\nCqgBVM.exe
  2⤵
  PID:3276
- C:\Windows\System\GpLlXxO.exe
  C:\Windows\System\GpLlXxO.exe
  2⤵
  PID:3292
- C:\Windows\System\VKorXGN.exe
  C:\Windows\System\VKorXGN.exe
  2⤵
  PID:3308
- C:\Windows\System\VuOZSBx.exe
  C:\Windows\System\VuOZSBx.exe
  2⤵
  PID:3324
- C:\Windows\System\agdbbuZ.exe
  C:\Windows\System\agdbbuZ.exe
  2⤵
  PID:3340
- C:\Windows\System\aIcfEdY.exe
  C:\Windows\System\aIcfEdY.exe
  2⤵
  PID:3356
- C:\Windows\System\vmfTJJG.exe
  C:\Windows\System\vmfTJJG.exe
  2⤵
  PID:3376
- C:\Windows\System\oQlBIqh.exe
  C:\Windows\System\oQlBIqh.exe
  2⤵
  PID:3392
- C:\Windows\System\ULaydJg.exe
  C:\Windows\System\ULaydJg.exe
  2⤵
  PID:3408
- C:\Windows\System\GlXVHsX.exe
  C:\Windows\System\GlXVHsX.exe
  2⤵
  PID:3424
- C:\Windows\System\fGJPsLo.exe
  C:\Windows\System\fGJPsLo.exe
  2⤵
  PID:3440
- C:\Windows\System\lHjDxGM.exe
  C:\Windows\System\lHjDxGM.exe
  2⤵
  PID:3456
- C:\Windows\System\yAaWZzs.exe
  C:\Windows\System\yAaWZzs.exe
  2⤵
  PID:3500
- C:\Windows\System\rdhOumg.exe
  C:\Windows\System\rdhOumg.exe
  2⤵
  PID:3524
- C:\Windows\System\nnJAsiI.exe
  C:\Windows\System\nnJAsiI.exe
  2⤵
  PID:3544
- C:\Windows\System\ZrCSdeZ.exe
  C:\Windows\System\ZrCSdeZ.exe
  2⤵
  PID:3564
- C:\Windows\System\STwjWaf.exe
  C:\Windows\System\STwjWaf.exe
  2⤵
  PID:3580
- C:\Windows\System\bbrYOKz.exe
  C:\Windows\System\bbrYOKz.exe
  2⤵
  PID:3604
- C:\Windows\System\daNimlh.exe
  C:\Windows\System\daNimlh.exe
  2⤵
  PID:3620
- C:\Windows\System\tPTyfkV.exe
  C:\Windows\System\tPTyfkV.exe
  2⤵
  PID:3640
- C:\Windows\System\CKKEjdr.exe
  C:\Windows\System\CKKEjdr.exe
  2⤵
  PID:3656
- C:\Windows\System\ZGWhHfH.exe
  C:\Windows\System\ZGWhHfH.exe
  2⤵
  PID:3676
- C:\Windows\System\DXIZUrF.exe
  C:\Windows\System\DXIZUrF.exe
  2⤵
  PID:3724
- C:\Windows\System\EHsZPYH.exe
  C:\Windows\System\EHsZPYH.exe
  2⤵
  PID:3740
- C:\Windows\System\pabJNYN.exe
  C:\Windows\System\pabJNYN.exe
  2⤵
  PID:3756
- C:\Windows\System\KkCtLRW.exe
  C:\Windows\System\KkCtLRW.exe
  2⤵
  PID:3772
- C:\Windows\System\YhvXiGG.exe
  C:\Windows\System\YhvXiGG.exe
  2⤵
  PID:3788
- C:\Windows\System\wBYachv.exe
  C:\Windows\System\wBYachv.exe
  2⤵
  PID:3804
- C:\Windows\System\hQSfaTp.exe
  C:\Windows\System\hQSfaTp.exe
  2⤵
  PID:3820
- C:\Windows\System\jXrHBeU.exe
  C:\Windows\System\jXrHBeU.exe
  2⤵
  PID:3836
- C:\Windows\System\gXQlLnA.exe
  C:\Windows\System\gXQlLnA.exe
  2⤵
  PID:3868
- C:\Windows\System\wrAoBaz.exe
  C:\Windows\System\wrAoBaz.exe
  2⤵
  PID:3884
- C:\Windows\System\wIucCPX.exe
  C:\Windows\System\wIucCPX.exe
  2⤵
  PID:3900
- C:\Windows\System\bxICWzt.exe
  C:\Windows\System\bxICWzt.exe
  2⤵
  PID:3920
- C:\Windows\System\VEYeGkt.exe
  C:\Windows\System\VEYeGkt.exe
  2⤵
  PID:3936
- C:\Windows\System\YSdMfOG.exe
  C:\Windows\System\YSdMfOG.exe
  2⤵
  PID:3952
- C:\Windows\System\qTunMkf.exe
  C:\Windows\System\qTunMkf.exe
  2⤵
  PID:3968
- C:\Windows\System\iOIcGPC.exe
  C:\Windows\System\iOIcGPC.exe
  2⤵
  PID:3988
- C:\Windows\System\OMVqaqb.exe
  C:\Windows\System\OMVqaqb.exe
  2⤵
  PID:4004
- C:\Windows\System\FkzbolT.exe
  C:\Windows\System\FkzbolT.exe
  2⤵
  PID:4020
- C:\Windows\System\LbXcqrp.exe
  C:\Windows\System\LbXcqrp.exe
  2⤵
  PID:4036
- C:\Windows\System\JJQJPQa.exe
  C:\Windows\System\JJQJPQa.exe
  2⤵
  PID:4056
- C:\Windows\System\thFBuMp.exe
  C:\Windows\System\thFBuMp.exe
  2⤵
  PID:4072
- C:\Windows\System\gPgbEcC.exe
  C:\Windows\System\gPgbEcC.exe
  2⤵
  PID:4088
- C:\Windows\System\FbrtwwP.exe
  C:\Windows\System\FbrtwwP.exe
  2⤵
  PID:1372
- C:\Windows\System\OqmrTKN.exe
  C:\Windows\System\OqmrTKN.exe
  2⤵
  PID:3184
- C:\Windows\System\PIWcFzM.exe
  C:\Windows\System\PIWcFzM.exe
  2⤵
  PID:3132
- C:\Windows\System\RVpsRnU.exe
  C:\Windows\System\RVpsRnU.exe
  2⤵
  PID:3216
- C:\Windows\System\BKDOBhQ.exe
  C:\Windows\System\BKDOBhQ.exe
  2⤵
  PID:3264
- C:\Windows\System\EuaEJHa.exe
  C:\Windows\System\EuaEJHa.exe
  2⤵
  PID:3304
- C:\Windows\System\FxCPWWs.exe
  C:\Windows\System\FxCPWWs.exe
  2⤵
  PID:3336
- C:\Windows\System\CHawnEw.exe
  C:\Windows\System\CHawnEw.exe
  2⤵
  PID:3432
- C:\Windows\System\MGEGRnE.exe
  C:\Windows\System\MGEGRnE.exe
  2⤵
  PID:3480
- C:\Windows\System\vwOvbfE.exe
  C:\Windows\System\vwOvbfE.exe
  2⤵
  PID:3244
- C:\Windows\System\hUTaAal.exe
  C:\Windows\System\hUTaAal.exe
  2⤵
  PID:3348
- C:\Windows\System\PLcPiqB.exe
  C:\Windows\System\PLcPiqB.exe
  2⤵
  PID:3416
- C:\Windows\System\KZIBEUr.exe
  C:\Windows\System\KZIBEUr.exe
  2⤵
  PID:3616
- C:\Windows\System\pNUNTgx.exe
  C:\Windows\System\pNUNTgx.exe
  2⤵
  PID:3684
- C:\Windows\System\mZWkIkJ.exe
  C:\Windows\System\mZWkIkJ.exe
  2⤵
  PID:3708
- C:\Windows\System\UlLKFHi.exe
  C:\Windows\System\UlLKFHi.exe
  2⤵
  PID:3512
- C:\Windows\System\DMSlxFV.exe
  C:\Windows\System\DMSlxFV.exe
  2⤵
  PID:3588
- C:\Windows\System\pDbARdG.exe
  C:\Windows\System\pDbARdG.exe
  2⤵
  PID:3556
- C:\Windows\System\NCwndKJ.exe
  C:\Windows\System\NCwndKJ.exe
  2⤵
  PID:3632
- C:\Windows\System\KzsNzZK.exe
  C:\Windows\System\KzsNzZK.exe
  2⤵
  PID:3664
- C:\Windows\System\UEUwrOm.exe
  C:\Windows\System\UEUwrOm.exe
  2⤵
  PID:3752
- C:\Windows\System\HnHMZRo.exe
  C:\Windows\System\HnHMZRo.exe
  2⤵
  PID:3848
- C:\Windows\System\gqLQpTF.exe
  C:\Windows\System\gqLQpTF.exe
  2⤵
  PID:3964
- C:\Windows\System\pLVCnOE.exe
  C:\Windows\System\pLVCnOE.exe
  2⤵
  PID:4064
- C:\Windows\System\yyCcZbo.exe
  C:\Windows\System\yyCcZbo.exe
  2⤵
  PID:2456
- C:\Windows\System\QapLSwy.exe
  C:\Windows\System\QapLSwy.exe
  2⤵
  PID:3088
- C:\Windows\System\rqYUNBK.exe
  C:\Windows\System\rqYUNBK.exe
  2⤵
  PID:3120
- C:\Windows\System\OkGrRbx.exe
  C:\Windows\System\OkGrRbx.exe
  2⤵
  PID:3916
- C:\Windows\System\TfJgUmJ.exe
  C:\Windows\System\TfJgUmJ.exe
  2⤵
  PID:1580
- C:\Windows\System\rmvcpuU.exe
  C:\Windows\System\rmvcpuU.exe
  2⤵
  PID:4080
- C:\Windows\System\uamTvSM.exe
  C:\Windows\System\uamTvSM.exe
  2⤵
  PID:3116
- C:\Windows\System\qMrsUqX.exe
  C:\Windows\System\qMrsUqX.exe
  2⤵
  PID:3180
- C:\Windows\System\DmwjzEe.exe
  C:\Windows\System\DmwjzEe.exe
  2⤵
  PID:4084
- C:\Windows\System\SRYgZCC.exe
  C:\Windows\System\SRYgZCC.exe
  2⤵
  PID:3368
- C:\Windows\System\xIIuKGQ.exe
  C:\Windows\System\xIIuKGQ.exe
  2⤵
  PID:960
- C:\Windows\System\WtUxuZk.exe
  C:\Windows\System\WtUxuZk.exe
  2⤵
  PID:3492
- C:\Windows\System\JsKfldl.exe
  C:\Windows\System\JsKfldl.exe
  2⤵
  PID:3496
- C:\Windows\System\PKReOiz.exe
  C:\Windows\System\PKReOiz.exe
  2⤵
  PID:3212
- C:\Windows\System\npuMDmv.exe
  C:\Windows\System\npuMDmv.exe
  2⤵
  PID:3404
- C:\Windows\System\UiBTsRT.exe
  C:\Windows\System\UiBTsRT.exe
  2⤵
  PID:3572
- C:\Windows\System\aAuMlVW.exe
  C:\Windows\System\aAuMlVW.exe
  2⤵
  PID:3648
- C:\Windows\System\wSGYahR.exe
  C:\Windows\System\wSGYahR.exe
  2⤵
  PID:3700
- C:\Windows\System\vyJiwhh.exe
  C:\Windows\System\vyJiwhh.exe
  2⤵
  PID:2228
- C:\Windows\System\AhdCGps.exe
  C:\Windows\System\AhdCGps.exe
  2⤵
  PID:3652
- C:\Windows\System\xdTtugL.exe
  C:\Windows\System\xdTtugL.exe
  2⤵
  PID:3628
- C:\Windows\System\tgjSfdw.exe
  C:\Windows\System\tgjSfdw.exe
  2⤵
  PID:3812
- C:\Windows\System\MSsXmVn.exe
  C:\Windows\System\MSsXmVn.exe
  2⤵
  PID:3668
- C:\Windows\System\KNIgwTi.exe
  C:\Windows\System\KNIgwTi.exe
  2⤵
  PID:2220
- C:\Windows\System\GTYciIU.exe
  C:\Windows\System\GTYciIU.exe
  2⤵
  PID:3828
- C:\Windows\System\KLpjJxy.exe
  C:\Windows\System\KLpjJxy.exe
  2⤵
  PID:3800
- C:\Windows\System\VKlcNIn.exe
  C:\Windows\System\VKlcNIn.exe
  2⤵
  PID:4012
- C:\Windows\System\EYbUYSg.exe
  C:\Windows\System\EYbUYSg.exe
  2⤵
  PID:2800
- C:\Windows\System\kWOUApU.exe
  C:\Windows\System\kWOUApU.exe
  2⤵
  PID:2372
- C:\Windows\System\OSxpvou.exe
  C:\Windows\System\OSxpvou.exe
  2⤵
  PID:2620
- C:\Windows\System\aQQTzwH.exe
  C:\Windows\System\aQQTzwH.exe
  2⤵
  PID:3084
- C:\Windows\System\URPSSFB.exe
  C:\Windows\System\URPSSFB.exe
  2⤵
  PID:3172
- C:\Windows\System\tXvTddD.exe
  C:\Windows\System\tXvTddD.exe
  2⤵
  PID:3164
- C:\Windows\System\oMmigHj.exe
  C:\Windows\System\oMmigHj.exe
  2⤵
  PID:3448
- C:\Windows\System\FcnLJzR.exe
  C:\Windows\System\FcnLJzR.exe
  2⤵
  PID:3300
- C:\Windows\System\XNXtKcj.exe
  C:\Windows\System\XNXtKcj.exe
  2⤵
  PID:3844
- C:\Windows\System\TgOJfPy.exe
  C:\Windows\System\TgOJfPy.exe
  2⤵
  PID:3852
- C:\Windows\System\fAkCuYb.exe
  C:\Windows\System\fAkCuYb.exe
  2⤵
  PID:4028
- C:\Windows\System\ddVGOxA.exe
  C:\Windows\System\ddVGOxA.exe
  2⤵
  PID:3100
- C:\Windows\System\ETVgzMb.exe
  C:\Windows\System\ETVgzMb.exe
  2⤵
  PID:3696
- C:\Windows\System\piULnPA.exe
  C:\Windows\System\piULnPA.exe
  2⤵
  PID:3352
- C:\Windows\System\vtBYYFo.exe
  C:\Windows\System\vtBYYFo.exe
  2⤵
  PID:3388
- C:\Windows\System\meNplvA.exe
  C:\Windows\System\meNplvA.exe
  2⤵
  PID:3600
- C:\Windows\System\VXLmQNs.exe
  C:\Windows\System\VXLmQNs.exe
  2⤵
  PID:3980
- C:\Windows\System\WaSbUcg.exe
  C:\Windows\System\WaSbUcg.exe
  2⤵
  PID:2904
- C:\Windows\System\WpxSZXV.exe
  C:\Windows\System\WpxSZXV.exe
  2⤵
  PID:948
- C:\Windows\System\dePoxjK.exe
  C:\Windows\System\dePoxjK.exe
  2⤵
  PID:2376
- C:\Windows\System\uIXDOQL.exe
  C:\Windows\System\uIXDOQL.exe
  2⤵
  PID:4128
- C:\Windows\System\qTxpHOQ.exe
  C:\Windows\System\qTxpHOQ.exe
  2⤵
  PID:4144
- C:\Windows\System\aYtcTri.exe
  C:\Windows\System\aYtcTri.exe
  2⤵
  PID:4160
- C:\Windows\System\oqFfcMv.exe
  C:\Windows\System\oqFfcMv.exe
  2⤵
  PID:4224
- C:\Windows\System\XBkdxMY.exe
  C:\Windows\System\XBkdxMY.exe
  2⤵
  PID:4244
- C:\Windows\System\mKzALLl.exe
  C:\Windows\System\mKzALLl.exe
  2⤵
  PID:4260
- C:\Windows\System\BDVMRHH.exe
  C:\Windows\System\BDVMRHH.exe
  2⤵
  PID:4276
- C:\Windows\System\SvCcFxx.exe
  C:\Windows\System\SvCcFxx.exe
  2⤵
  PID:4292
- C:\Windows\System\JNYghNr.exe
  C:\Windows\System\JNYghNr.exe
  2⤵
  PID:4316
- C:\Windows\System\oJvLVnQ.exe
  C:\Windows\System\oJvLVnQ.exe
  2⤵
  PID:4332
- C:\Windows\System\VKtbDzt.exe
  C:\Windows\System\VKtbDzt.exe
  2⤵
  PID:4348
- C:\Windows\System\YylbRlA.exe
  C:\Windows\System\YylbRlA.exe
  2⤵
  PID:4364
- C:\Windows\System\MPYsZgo.exe
  C:\Windows\System\MPYsZgo.exe
  2⤵
  PID:4384
- C:\Windows\System\QhmUMgF.exe
  C:\Windows\System\QhmUMgF.exe
  2⤵
  PID:4420
- C:\Windows\System\BMOXuHO.exe
  C:\Windows\System\BMOXuHO.exe
  2⤵
  PID:4436
- C:\Windows\System\nUvnhyv.exe
  C:\Windows\System\nUvnhyv.exe
  2⤵
  PID:4456
- C:\Windows\System\eQWaUUo.exe
  C:\Windows\System\eQWaUUo.exe
  2⤵
  PID:4472
- C:\Windows\System\nkrndkN.exe
  C:\Windows\System\nkrndkN.exe
  2⤵
  PID:4488
- C:\Windows\System\uhBRprO.exe
  C:\Windows\System\uhBRprO.exe
  2⤵
  PID:4508
- C:\Windows\System\UmfVsnG.exe
  C:\Windows\System\UmfVsnG.exe
  2⤵
  PID:4524
- C:\Windows\System\gGvrwrY.exe
  C:\Windows\System\gGvrwrY.exe
  2⤵
  PID:4540
- C:\Windows\System\nhrifNX.exe
  C:\Windows\System\nhrifNX.exe
  2⤵
  PID:4556
- C:\Windows\System\iKfLnKU.exe
  C:\Windows\System\iKfLnKU.exe
  2⤵
  PID:4572
- C:\Windows\System\uboxrEO.exe
  C:\Windows\System\uboxrEO.exe
  2⤵
  PID:4588
- C:\Windows\System\RYKJyrG.exe
  C:\Windows\System\RYKJyrG.exe
  2⤵
  PID:4604
- C:\Windows\System\HCzePgi.exe
  C:\Windows\System\HCzePgi.exe
  2⤵
  PID:4624
- C:\Windows\System\NibDpNL.exe
  C:\Windows\System\NibDpNL.exe
  2⤵
  PID:4640
- C:\Windows\System\drVNEAp.exe
  C:\Windows\System\drVNEAp.exe
  2⤵
  PID:4656
- C:\Windows\System\sJzfMmh.exe
  C:\Windows\System\sJzfMmh.exe
  2⤵
  PID:4680
- C:\Windows\System\AcjYQEQ.exe
  C:\Windows\System\AcjYQEQ.exe
  2⤵
  PID:4696
- C:\Windows\System\YoqAqSw.exe
  C:\Windows\System\YoqAqSw.exe
  2⤵
  PID:4712
- C:\Windows\System\ctHLNPH.exe
  C:\Windows\System\ctHLNPH.exe
  2⤵
  PID:4728
- C:\Windows\System\pQpshkm.exe
  C:\Windows\System\pQpshkm.exe
  2⤵
  PID:4756
- C:\Windows\System\fzztxLy.exe
  C:\Windows\System\fzztxLy.exe
  2⤵
  PID:4772
- C:\Windows\System\HevmfXO.exe
  C:\Windows\System\HevmfXO.exe
  2⤵
  PID:4880
- C:\Windows\System\pMsQsUd.exe
  C:\Windows\System\pMsQsUd.exe
  2⤵
  PID:4896
- C:\Windows\System\foXhyFz.exe
  C:\Windows\System\foXhyFz.exe
  2⤵
  PID:4912
- C:\Windows\System\WbKZTVa.exe
  C:\Windows\System\WbKZTVa.exe
  2⤵
  PID:4928
- C:\Windows\System\NEfjDTW.exe
  C:\Windows\System\NEfjDTW.exe
  2⤵
  PID:4980
- C:\Windows\System\JBGoEPu.exe
  C:\Windows\System\JBGoEPu.exe
  2⤵
  PID:5000
- C:\Windows\System\xwyKoBR.exe
  C:\Windows\System\xwyKoBR.exe
  2⤵
  PID:5028
- C:\Windows\System\HETLzQF.exe
  C:\Windows\System\HETLzQF.exe
  2⤵
  PID:5044
- C:\Windows\System\AFrRJTX.exe
  C:\Windows\System\AFrRJTX.exe
  2⤵
  PID:5060
- C:\Windows\System\BviujSH.exe
  C:\Windows\System\BviujSH.exe
  2⤵
  PID:5076
- C:\Windows\System\XuKylgX.exe
  C:\Windows\System\XuKylgX.exe
  2⤵
  PID:5092
- C:\Windows\System\urYcRMN.exe
  C:\Windows\System\urYcRMN.exe
  2⤵
  PID:5116
- C:\Windows\System\LHicQaW.exe
  C:\Windows\System\LHicQaW.exe
  2⤵
  PID:3892
- C:\Windows\System\PAQlWDb.exe
  C:\Windows\System\PAQlWDb.exe
  2⤵
  PID:3332
- C:\Windows\System\mjHFJiC.exe
  C:\Windows\System\mjHFJiC.exe
  2⤵
  PID:2776
- C:\Windows\System\jZdhUMB.exe
  C:\Windows\System\jZdhUMB.exe
  2⤵
  PID:2812
- C:\Windows\System\FkRdBLi.exe
  C:\Windows\System\FkRdBLi.exe
  2⤵
  PID:4152
- C:\Windows\System\xvYwslY.exe
  C:\Windows\System\xvYwslY.exe
  2⤵
  PID:2760
- C:\Windows\System\NznCeNs.exe
  C:\Windows\System\NznCeNs.exe
  2⤵
  PID:4208
- C:\Windows\System\odTtQko.exe
  C:\Windows\System\odTtQko.exe
  2⤵
  PID:4220
- C:\Windows\System\DBLvSSs.exe
  C:\Windows\System\DBLvSSs.exe
  2⤵
  PID:4252
- C:\Windows\System\kXhknBW.exe
  C:\Windows\System\kXhknBW.exe
  2⤵
  PID:4360
- C:\Windows\System\mLFmViA.exe
  C:\Windows\System\mLFmViA.exe
  2⤵
  PID:4404
- C:\Windows\System\hyJcflo.exe
  C:\Windows\System\hyJcflo.exe
  2⤵
  PID:4396
- C:\Windows\System\nIcOssj.exe
  C:\Windows\System\nIcOssj.exe
  2⤵
  PID:4372
- C:\Windows\System\fgCpJLl.exe
  C:\Windows\System\fgCpJLl.exe
  2⤵
  PID:4480
- C:\Windows\System\UdeHlXL.exe
  C:\Windows\System\UdeHlXL.exe
  2⤵
  PID:4552
- C:\Windows\System\AScoeMC.exe
  C:\Windows\System\AScoeMC.exe
  2⤵
  PID:4612
- C:\Windows\System\CaTQRoI.exe
  C:\Windows\System\CaTQRoI.exe
  2⤵
  PID:4496
- C:\Windows\System\AhcTKzk.exe
  C:\Windows\System\AhcTKzk.exe
  2⤵
  PID:4536
- C:\Windows\System\QLGJUBq.exe
  C:\Windows\System\QLGJUBq.exe
  2⤵
  PID:4632
- C:\Windows\System\ochpete.exe
  C:\Windows\System\ochpete.exe
  2⤵
  PID:4672
- C:\Windows\System\kFMDwmi.exe
  C:\Windows\System\kFMDwmi.exe
  2⤵
  PID:4692
- C:\Windows\System\JMuFwwy.exe
  C:\Windows\System\JMuFwwy.exe
  2⤵
  PID:4740
- C:\Windows\System\eZsWqOf.exe
  C:\Windows\System\eZsWqOf.exe
  2⤵
  PID:4748
- C:\Windows\System\ZuRCFOs.exe
  C:\Windows\System\ZuRCFOs.exe
  2⤵
  PID:4804
- C:\Windows\System\ysoDujR.exe
  C:\Windows\System\ysoDujR.exe
  2⤵
  PID:4808
- C:\Windows\System\XCmKfoz.exe
  C:\Windows\System\XCmKfoz.exe
  2⤵
  PID:4852
- C:\Windows\System\HfwjEnB.exe
  C:\Windows\System\HfwjEnB.exe
  2⤵
  PID:4872
- C:\Windows\System\gGsHjlo.exe
  C:\Windows\System\gGsHjlo.exe
  2⤵
  PID:4904
- C:\Windows\System\eGjIvNH.exe
  C:\Windows\System\eGjIvNH.exe
  2⤵
  PID:4944
- C:\Windows\System\EVQswJs.exe
  C:\Windows\System\EVQswJs.exe
  2⤵
  PID:4972
- C:\Windows\System\pMzBsWg.exe
  C:\Windows\System\pMzBsWg.exe
  2⤵
  PID:5008
- C:\Windows\System\dyNwqwI.exe
  C:\Windows\System\dyNwqwI.exe
  2⤵
  PID:5056
- C:\Windows\System\twImDFu.exe
  C:\Windows\System\twImDFu.exe
  2⤵
  PID:4992
- C:\Windows\System\SnoQzpg.exe
  C:\Windows\System\SnoQzpg.exe
  2⤵
  PID:5068
- C:\Windows\System\xLerAXN.exe
  C:\Windows\System\xLerAXN.exe
  2⤵
  PID:1952
- C:\Windows\System\isJxOnc.exe
  C:\Windows\System\isJxOnc.exe
  2⤵
  PID:3816
- C:\Windows\System\vWnOqwZ.exe
  C:\Windows\System\vWnOqwZ.exe
  2⤵
  PID:3540
- C:\Windows\System\jMVtLGP.exe
  C:\Windows\System\jMVtLGP.exe
  2⤵
  PID:4116
- C:\Windows\System\WRRNxad.exe
  C:\Windows\System\WRRNxad.exe
  2⤵
  PID:4288
- C:\Windows\System\JzHcCkl.exe
  C:\Windows\System\JzHcCkl.exe
  2⤵
  PID:4256
- C:\Windows\System\OlsSoWS.exe
  C:\Windows\System\OlsSoWS.exe
  2⤵
  PID:4300
- C:\Windows\System\JJnNdCM.exe
  C:\Windows\System\JJnNdCM.exe
  2⤵
  PID:4312
- C:\Windows\System\hPXvUVi.exe
  C:\Windows\System\hPXvUVi.exe
  2⤵
  PID:4428
- C:\Windows\System\CHSMEgG.exe
  C:\Windows\System\CHSMEgG.exe
  2⤵
  PID:4724
- C:\Windows\System\DwSsHnX.exe
  C:\Windows\System\DwSsHnX.exe
  2⤵
  PID:4820
- C:\Windows\System\yTCzCva.exe
  C:\Windows\System\yTCzCva.exe
  2⤵
  PID:4832
- C:\Windows\System\tHuugLR.exe
  C:\Windows\System\tHuugLR.exe
  2⤵
  PID:4856
- C:\Windows\System\CAeFqBA.exe
  C:\Windows\System\CAeFqBA.exe
  2⤵
  PID:4452
- C:\Windows\System\mBZeOIN.exe
  C:\Windows\System\mBZeOIN.exe
  2⤵
  PID:4744
- C:\Windows\System\VqhtpGa.exe
  C:\Windows\System\VqhtpGa.exe
  2⤵
  PID:4920
- C:\Windows\System\TdDcVXm.exe
  C:\Windows\System\TdDcVXm.exe
  2⤵
  PID:924
- C:\Windows\System\aropjtC.exe
  C:\Windows\System\aropjtC.exe
  2⤵
  PID:4908
- C:\Windows\System\JkEaiUq.exe
  C:\Windows\System\JkEaiUq.exe
  2⤵
  PID:2680
- C:\Windows\System\kFWCkAq.exe
  C:\Windows\System\kFWCkAq.exe
  2⤵
  PID:5100
- C:\Windows\System\WgdDwkE.exe
  C:\Windows\System\WgdDwkE.exe
  2⤵
  PID:4136
- C:\Windows\System\WpTJvPJ.exe
  C:\Windows\System\WpTJvPJ.exe
  2⤵
  PID:3960
- C:\Windows\System\fnBoWJk.exe
  C:\Windows\System\fnBoWJk.exe
  2⤵
  PID:3748
- C:\Windows\System\dQBDjoE.exe
  C:\Windows\System\dQBDjoE.exe
  2⤵
  PID:4108
- C:\Windows\System\ayOlTUl.exe
  C:\Windows\System\ayOlTUl.exe
  2⤵
  PID:4216
- C:\Windows\System\LqXEujt.exe
  C:\Windows\System\LqXEujt.exe
  2⤵
  PID:4412
- C:\Windows\System\SrKxQIK.exe
  C:\Windows\System\SrKxQIK.exe
  2⤵
  PID:4268
- C:\Windows\System\pcZRFdD.exe
  C:\Windows\System\pcZRFdD.exe
  2⤵
  PID:4308
- C:\Windows\System\qBbKDOE.exe
  C:\Windows\System\qBbKDOE.exe
  2⤵
  PID:4448
- C:\Windows\System\yPlAKIv.exe
  C:\Windows\System\yPlAKIv.exe
  2⤵
  PID:4464
- C:\Windows\System\GjdMpJY.exe
  C:\Windows\System\GjdMpJY.exe
  2⤵
  PID:4532
- C:\Windows\System\olWRHBt.exe
  C:\Windows\System\olWRHBt.exe
  2⤵
  PID:4840
- C:\Windows\System\GsmYvQH.exe
  C:\Windows\System\GsmYvQH.exe
  2⤵
  PID:4844
- C:\Windows\System\FvHCYLG.exe
  C:\Windows\System\FvHCYLG.exe
  2⤵
  PID:5040
- C:\Windows\System\HlRTihh.exe
  C:\Windows\System\HlRTihh.exe
  2⤵
  PID:4960
- C:\Windows\System\ztLxnJj.exe
  C:\Windows\System\ztLxnJj.exe
  2⤵
  PID:4976
- C:\Windows\System\Tfnljip.exe
  C:\Windows\System\Tfnljip.exe
  2⤵
  PID:4708
- C:\Windows\System\SknVYmO.exe
  C:\Windows\System\SknVYmO.exe
  2⤵
  PID:3768
- C:\Windows\System\chEAhhO.exe
  C:\Windows\System\chEAhhO.exe
  2⤵
  PID:4952
- C:\Windows\System\vuSRKMD.exe
  C:\Windows\System\vuSRKMD.exe
  2⤵
  PID:4104
- C:\Windows\System\JejrLwD.exe
  C:\Windows\System\JejrLwD.exe
  2⤵
  PID:3436
- C:\Windows\System\EbmyhJr.exe
  C:\Windows\System\EbmyhJr.exe
  2⤵
  PID:4664
- C:\Windows\System\LNETUez.exe
  C:\Windows\System\LNETUez.exe
  2⤵
  PID:4324
- C:\Windows\System\lYVOMAT.exe
  C:\Windows\System\lYVOMAT.exe
  2⤵
  PID:4504
- C:\Windows\System\LJpBUDU.exe
  C:\Windows\System\LJpBUDU.exe
  2⤵
  PID:4948
- C:\Windows\System\ZpFxkxz.exe
  C:\Windows\System\ZpFxkxz.exe
  2⤵
  PID:5104
- C:\Windows\System\PrEOdev.exe
  C:\Windows\System\PrEOdev.exe
  2⤵
  PID:1460
- C:\Windows\System\iByjBKU.exe
  C:\Windows\System\iByjBKU.exe
  2⤵
  PID:4304
- C:\Windows\System\PCgECLe.exe
  C:\Windows\System\PCgECLe.exe
  2⤵
  PID:4416
- C:\Windows\System\SznEKKm.exe
  C:\Windows\System\SznEKKm.exe
  2⤵
  PID:4784
- C:\Windows\System\yvAAIJR.exe
  C:\Windows\System\yvAAIJR.exe
  2⤵
  PID:4600
- C:\Windows\System\DpdXkJh.exe
  C:\Windows\System\DpdXkJh.exe
  2⤵
  PID:4184
- C:\Windows\System\wVIdxuo.exe
  C:\Windows\System\wVIdxuo.exe
  2⤵
  PID:4824
- C:\Windows\System\JleYMvE.exe
  C:\Windows\System\JleYMvE.exe
  2⤵
  PID:5124
- C:\Windows\System\gMmaXFU.exe
  C:\Windows\System\gMmaXFU.exe
  2⤵
  PID:5140
- C:\Windows\System\qaLPPLB.exe
  C:\Windows\System\qaLPPLB.exe
  2⤵
  PID:5156
- C:\Windows\System\OJOxfXj.exe
  C:\Windows\System\OJOxfXj.exe
  2⤵
  PID:5172
- C:\Windows\System\FBuxHiY.exe
  C:\Windows\System\FBuxHiY.exe
  2⤵
  PID:5188
- C:\Windows\System\BTGHQuf.exe
  C:\Windows\System\BTGHQuf.exe
  2⤵
  PID:5204
- C:\Windows\System\ZsjhojM.exe
  C:\Windows\System\ZsjhojM.exe
  2⤵
  PID:5224
- C:\Windows\System\WKMsNvf.exe
  C:\Windows\System\WKMsNvf.exe
  2⤵
  PID:5240
- C:\Windows\System\zSQgXQw.exe
  C:\Windows\System\zSQgXQw.exe
  2⤵
  PID:5256
- C:\Windows\System\XfYFnBR.exe
  C:\Windows\System\XfYFnBR.exe
  2⤵
  PID:5272
- C:\Windows\System\RXdgKTs.exe
  C:\Windows\System\RXdgKTs.exe
  2⤵
  PID:5288
- C:\Windows\System\qqBoQAe.exe
  C:\Windows\System\qqBoQAe.exe
  2⤵
  PID:5304
- C:\Windows\System\mZoMuNv.exe
  C:\Windows\System\mZoMuNv.exe
  2⤵
  PID:5320
- C:\Windows\System\QHhUhUG.exe
  C:\Windows\System\QHhUhUG.exe
  2⤵
  PID:5340
- C:\Windows\System\USSyVGg.exe
  C:\Windows\System\USSyVGg.exe
  2⤵
  PID:5356
- C:\Windows\System\UNYVjBc.exe
  C:\Windows\System\UNYVjBc.exe
  2⤵
  PID:5376
- C:\Windows\System\soGTgZA.exe
  C:\Windows\System\soGTgZA.exe
  2⤵
  PID:5400
- C:\Windows\System\ZndhVHE.exe
  C:\Windows\System\ZndhVHE.exe
  2⤵
  PID:5416
- C:\Windows\System\wBezlqD.exe
  C:\Windows\System\wBezlqD.exe
  2⤵
  PID:5432
- C:\Windows\System\QquAqwz.exe
  C:\Windows\System\QquAqwz.exe
  2⤵
  PID:5448
- C:\Windows\System\CAibTiU.exe
  C:\Windows\System\CAibTiU.exe
  2⤵
  PID:5468
- C:\Windows\System\IHXgbpV.exe
  C:\Windows\System\IHXgbpV.exe
  2⤵
  PID:5484
- C:\Windows\System\BRYuffD.exe
  C:\Windows\System\BRYuffD.exe
  2⤵
  PID:5500
- C:\Windows\System\CdhcGDg.exe
  C:\Windows\System\CdhcGDg.exe
  2⤵
  PID:5520
- C:\Windows\System\JGIbQvo.exe
  C:\Windows\System\JGIbQvo.exe
  2⤵
  PID:5536
- C:\Windows\System\mVvJhHH.exe
  C:\Windows\System\mVvJhHH.exe
  2⤵
  PID:5552
- C:\Windows\System\lskBTtb.exe
  C:\Windows\System\lskBTtb.exe
  2⤵
  PID:5572
- C:\Windows\System\zKQJREz.exe
  C:\Windows\System\zKQJREz.exe
  2⤵
  PID:5596
- C:\Windows\System\iIanjXg.exe
  C:\Windows\System\iIanjXg.exe
  2⤵
  PID:5612
- C:\Windows\System\nrDEGsA.exe
  C:\Windows\System\nrDEGsA.exe
  2⤵
  PID:5632
- C:\Windows\System\NuLYnab.exe
  C:\Windows\System\NuLYnab.exe
  2⤵
  PID:5648
- C:\Windows\System\UNQzwWl.exe
  C:\Windows\System\UNQzwWl.exe
  2⤵
  PID:5664
- C:\Windows\System\rVimriJ.exe
  C:\Windows\System\rVimriJ.exe
  2⤵
  PID:5684
- C:\Windows\System\SUClRlM.exe
  C:\Windows\System\SUClRlM.exe
  2⤵
  PID:5700
- C:\Windows\System\oVYtwBJ.exe
  C:\Windows\System\oVYtwBJ.exe
  2⤵
  PID:5760
- C:\Windows\System\gTWnhpO.exe
  C:\Windows\System\gTWnhpO.exe
  2⤵
  PID:5780
- C:\Windows\System\olrbeNc.exe
  C:\Windows\System\olrbeNc.exe
  2⤵
  PID:5796
- C:\Windows\System\AHNPoxT.exe
  C:\Windows\System\AHNPoxT.exe
  2⤵
  PID:5812
- C:\Windows\System\AoqsqZA.exe
  C:\Windows\System\AoqsqZA.exe
  2⤵
  PID:5852
- C:\Windows\System\pGrADLp.exe
  C:\Windows\System\pGrADLp.exe
  2⤵
  PID:5868
- C:\Windows\System\IyNEjJB.exe
  C:\Windows\System\IyNEjJB.exe
  2⤵
  PID:5884
- C:\Windows\System\jOzfNlm.exe
  C:\Windows\System\jOzfNlm.exe
  2⤵
  PID:5904
- C:\Windows\System\gIrERXS.exe
  C:\Windows\System\gIrERXS.exe
  2⤵
  PID:5920
- C:\Windows\System\YMMzRDs.exe
  C:\Windows\System\YMMzRDs.exe
  2⤵
  PID:5940
- C:\Windows\System\qiKUyNa.exe
  C:\Windows\System\qiKUyNa.exe
  2⤵
  PID:5956
- C:\Windows\System\HTVSiXZ.exe
  C:\Windows\System\HTVSiXZ.exe
  2⤵
  PID:5972
- C:\Windows\System\qWWudVu.exe
  C:\Windows\System\qWWudVu.exe
  2⤵
  PID:5992
- C:\Windows\System\BLMTOSo.exe
  C:\Windows\System\BLMTOSo.exe
  2⤵
  PID:6008
- C:\Windows\System\bqpKMaW.exe
  C:\Windows\System\bqpKMaW.exe
  2⤵
  PID:6024
- C:\Windows\System\HpABsVM.exe
  C:\Windows\System\HpABsVM.exe
  2⤵
  PID:6064
- C:\Windows\System\mqbAqui.exe
  C:\Windows\System\mqbAqui.exe
  2⤵
  PID:6080
- C:\Windows\System\KrcplQy.exe
  C:\Windows\System\KrcplQy.exe
  2⤵
  PID:6096
- C:\Windows\System\fyJvViA.exe
  C:\Windows\System\fyJvViA.exe
  2⤵
  PID:6112
- C:\Windows\System\bHpBbLf.exe
  C:\Windows\System\bHpBbLf.exe
  2⤵
  PID:6132
- C:\Windows\System\FITDbbt.exe
  C:\Windows\System\FITDbbt.exe
  2⤵
  PID:3912
- C:\Windows\System\uqliMTo.exe
  C:\Windows\System\uqliMTo.exe
  2⤵
  PID:4516
- C:\Windows\System\ynQeWHy.exe
  C:\Windows\System\ynQeWHy.exe
  2⤵
  PID:4344
- C:\Windows\System\KWLZomA.exe
  C:\Windows\System\KWLZomA.exe
  2⤵
  PID:4584
- C:\Windows\System\lGhPNsT.exe
  C:\Windows\System\lGhPNsT.exe
  2⤵
  PID:5180
- C:\Windows\System\IwdbMqD.exe
  C:\Windows\System\IwdbMqD.exe
  2⤵
  PID:5220
- C:\Windows\System\fztqMrG.exe
  C:\Windows\System\fztqMrG.exe
  2⤵
  PID:5312
- C:\Windows\System\IOsXprO.exe
  C:\Windows\System\IOsXprO.exe
  2⤵
  PID:5384
- C:\Windows\System\HVLVHLp.exe
  C:\Windows\System\HVLVHLp.exe
  2⤵
  PID:5424
- C:\Windows\System\fbGptWP.exe
  C:\Windows\System\fbGptWP.exe
  2⤵
  PID:5464
- C:\Windows\System\DbpDORM.exe
  C:\Windows\System\DbpDORM.exe
  2⤵
  PID:5532
- C:\Windows\System\hgKxAvs.exe
  C:\Windows\System\hgKxAvs.exe
  2⤵
  PID:5368
- C:\Windows\System\WEZFRNA.exe
  C:\Windows\System\WEZFRNA.exe
  2⤵
  PID:5336
- C:\Windows\System\INuwFVi.exe
  C:\Windows\System\INuwFVi.exe
  2⤵
  PID:5412
- C:\Windows\System\RoZVICd.exe
  C:\Windows\System\RoZVICd.exe
  2⤵
  PID:5300
- C:\Windows\System\laOEHlC.exe
  C:\Windows\System\laOEHlC.exe
  2⤵
  PID:5508
- C:\Windows\System\FJLiryF.exe
  C:\Windows\System\FJLiryF.exe
  2⤵
  PID:5604
- C:\Windows\System\TpdywwJ.exe
  C:\Windows\System\TpdywwJ.exe
  2⤵
  PID:5628
- C:\Windows\System\LxttbSN.exe
  C:\Windows\System\LxttbSN.exe
  2⤵
  PID:5680
- C:\Windows\System\qWzlLNO.exe
  C:\Windows\System\qWzlLNO.exe
  2⤵
  PID:5696
- C:\Windows\System\rIHZDMP.exe
  C:\Windows\System\rIHZDMP.exe
  2⤵
  PID:5728
- C:\Windows\System\EseFAho.exe
  C:\Windows\System\EseFAho.exe
  2⤵
  PID:5736
- C:\Windows\System\RbbKKvo.exe
  C:\Windows\System\RbbKKvo.exe
  2⤵
  PID:5832
- C:\Windows\System\ZGrhZcy.exe
  C:\Windows\System\ZGrhZcy.exe
  2⤵
  PID:5844
- C:\Windows\System\uiOsXDW.exe
  C:\Windows\System\uiOsXDW.exe
  2⤵
  PID:5916
- C:\Windows\System\ViHDuOC.exe
  C:\Windows\System\ViHDuOC.exe
  2⤵
  PID:5984
- C:\Windows\System\ykshKLz.exe
  C:\Windows\System\ykshKLz.exe
  2⤵
  PID:5860
- C:\Windows\System\okogyWz.exe
  C:\Windows\System\okogyWz.exe
  2⤵
  PID:6000
- C:\Windows\System\SlunGmu.exe
  C:\Windows\System\SlunGmu.exe
  2⤵
  PID:5864
- C:\Windows\System\HjsasJU.exe
  C:\Windows\System\HjsasJU.exe
  2⤵
  PID:5936
- C:\Windows\System\QrzZAcI.exe
  C:\Windows\System\QrzZAcI.exe
  2⤵
  PID:6076
- C:\Windows\System\yQISMZV.exe
  C:\Windows\System\yQISMZV.exe
  2⤵
  PID:6044
- C:\Windows\System\CyOlocC.exe
  C:\Windows\System\CyOlocC.exe
  2⤵
  PID:6040
- C:\Windows\System\OkFkhGF.exe
  C:\Windows\System\OkFkhGF.exe
  2⤵
  PID:6140
- C:\Windows\System\VEhYGGN.exe
  C:\Windows\System\VEhYGGN.exe
  2⤵
  PID:5088
- C:\Windows\System\AQQnQDC.exe
  C:\Windows\System\AQQnQDC.exe
  2⤵
  PID:5212
- C:\Windows\System\dwTnCHz.exe
  C:\Windows\System\dwTnCHz.exe
  2⤵
  PID:6120
- C:\Windows\System\lZsOgqg.exe
  C:\Windows\System\lZsOgqg.exe
  2⤵
  PID:6128
- C:\Windows\System\xOIXMjo.exe
  C:\Windows\System\xOIXMjo.exe
  2⤵
  PID:5396
- C:\Windows\System\hnpRwQt.exe
  C:\Windows\System\hnpRwQt.exe
  2⤵
  PID:5568
- C:\Windows\System\ExCKKYd.exe
  C:\Windows\System\ExCKKYd.exe
  2⤵
  PID:5544
- C:\Windows\System\PHcQhPQ.exe
  C:\Windows\System\PHcQhPQ.exe
  2⤵
  PID:5268
- C:\Windows\System\hlZDnuO.exe
  C:\Windows\System\hlZDnuO.exe
  2⤵
  PID:5440
- C:\Windows\System\whOCgSg.exe
  C:\Windows\System\whOCgSg.exe
  2⤵
  PID:5672
- C:\Windows\System\fTUgPkY.exe
  C:\Windows\System\fTUgPkY.exe
  2⤵
  PID:5712
- C:\Windows\System\lnLacrT.exe
  C:\Windows\System\lnLacrT.exe
  2⤵
  PID:5768
- C:\Windows\System\HyYQYLl.exe
  C:\Windows\System\HyYQYLl.exe
  2⤵
  PID:5620
- C:\Windows\System\dshbSYE.exe
  C:\Windows\System\dshbSYE.exe
  2⤵
  PID:5880
- C:\Windows\System\QDqHCuJ.exe
  C:\Windows\System\QDqHCuJ.exe
  2⤵
  PID:6032
- C:\Windows\System\voVNxSM.exe
  C:\Windows\System\voVNxSM.exe
  2⤵
  PID:5952
- C:\Windows\System\fdPNofg.exe
  C:\Windows\System\fdPNofg.exe
  2⤵
  PID:6060
- C:\Windows\System\xETLlmt.exe
  C:\Windows\System\xETLlmt.exe
  2⤵
  PID:4548
- C:\Windows\System\QkxYQfO.exe
  C:\Windows\System\QkxYQfO.exe
  2⤵
  PID:5892
- C:\Windows\System\rABaaHO.exe
  C:\Windows\System\rABaaHO.exe
  2⤵
  PID:5280
- C:\Windows\System\TzCxSWo.exe
  C:\Windows\System\TzCxSWo.exe
  2⤵
  PID:5836
- C:\Windows\System\IiSwTUd.exe
  C:\Windows\System\IiSwTUd.exe
  2⤵
  PID:5348
- C:\Windows\System\TyqPHnz.exe
  C:\Windows\System\TyqPHnz.exe
  2⤵
  PID:5528
- C:\Windows\System\NdqKDpl.exe
  C:\Windows\System\NdqKDpl.exe
  2⤵
  PID:5824
- C:\Windows\System\JMCesWx.exe
  C:\Windows\System\JMCesWx.exe
  2⤵
  PID:5352
- C:\Windows\System\kYKqrOb.exe
  C:\Windows\System\kYKqrOb.exe
  2⤵
  PID:5460
- C:\Windows\System\UbSFFXI.exe
  C:\Windows\System\UbSFFXI.exe
  2⤵
  PID:6056
- C:\Windows\System\sYIXaht.exe
  C:\Windows\System\sYIXaht.exe
  2⤵
  PID:6108
- C:\Windows\System\KFIFnBk.exe
  C:\Windows\System\KFIFnBk.exe
  2⤵
  PID:5720
- C:\Windows\System\CeOqzjF.exe
  C:\Windows\System\CeOqzjF.exe
  2⤵
  PID:5928
- C:\Windows\System\DPYkOiz.exe
  C:\Windows\System\DPYkOiz.exe
  2⤵
  PID:5752
- C:\Windows\System\wsSdmpn.exe
  C:\Windows\System\wsSdmpn.exe
  2⤵
  PID:5932
- C:\Windows\System\SECMbrF.exe
  C:\Windows\System\SECMbrF.exe
  2⤵
  PID:5236
- C:\Windows\System\bdNfamN.exe
  C:\Windows\System\bdNfamN.exe
  2⤵
  PID:5912
- C:\Windows\System\ychYbZQ.exe
  C:\Windows\System\ychYbZQ.exe
  2⤵
  PID:5564
- C:\Windows\System\GdQGGbt.exe
  C:\Windows\System\GdQGGbt.exe
  2⤵
  PID:5200
- C:\Windows\System\gPchULc.exe
  C:\Windows\System\gPchULc.exe
  2⤵
  PID:6152
- C:\Windows\System\lLVJXrv.exe
  C:\Windows\System\lLVJXrv.exe
  2⤵
  PID:6168
- C:\Windows\System\UoPPCSh.exe
  C:\Windows\System\UoPPCSh.exe
  2⤵
  PID:6184
- C:\Windows\System\MigkLdK.exe
  C:\Windows\System\MigkLdK.exe
  2⤵
  PID:6200
- C:\Windows\System\mEeJTHR.exe
  C:\Windows\System\mEeJTHR.exe
  2⤵
  PID:6216
- C:\Windows\System\rSpMoKE.exe
  C:\Windows\System\rSpMoKE.exe
  2⤵
  PID:6232
- C:\Windows\System\lKreFmn.exe
  C:\Windows\System\lKreFmn.exe
  2⤵
  PID:6248
- C:\Windows\System\LxFnsDS.exe
  C:\Windows\System\LxFnsDS.exe
  2⤵
  PID:6264
- C:\Windows\System\gxQnrRO.exe
  C:\Windows\System\gxQnrRO.exe
  2⤵
  PID:6280
- C:\Windows\System\EZGAcgs.exe
  C:\Windows\System\EZGAcgs.exe
  2⤵
  PID:6304
- C:\Windows\System\CmrLVyn.exe
  C:\Windows\System\CmrLVyn.exe
  2⤵
  PID:6320
- C:\Windows\System\nybxoPF.exe
  C:\Windows\System\nybxoPF.exe
  2⤵
  PID:6336
- C:\Windows\System\pGNhchi.exe
  C:\Windows\System\pGNhchi.exe
  2⤵
  PID:6352
- C:\Windows\System\zMNtuDP.exe
  C:\Windows\System\zMNtuDP.exe
  2⤵
  PID:6372
- C:\Windows\System\NHudBEQ.exe
  C:\Windows\System\NHudBEQ.exe
  2⤵
  PID:6388
- C:\Windows\System\QtZeLoj.exe
  C:\Windows\System\QtZeLoj.exe
  2⤵
  PID:6404
- C:\Windows\System\AKPtAzD.exe
  C:\Windows\System\AKPtAzD.exe
  2⤵
  PID:6424
- C:\Windows\System\ZVegXOd.exe
  C:\Windows\System\ZVegXOd.exe
  2⤵
  PID:6456
- C:\Windows\System\iesJZZM.exe
  C:\Windows\System\iesJZZM.exe
  2⤵
  PID:6472
- C:\Windows\System\GQLDMHz.exe
  C:\Windows\System\GQLDMHz.exe
  2⤵
  PID:6488
- C:\Windows\System\kTIELCb.exe
  C:\Windows\System\kTIELCb.exe
  2⤵
  PID:6504
- C:\Windows\System\KYCoqGW.exe
  C:\Windows\System\KYCoqGW.exe
  2⤵
  PID:6524
- C:\Windows\System\kziVtFf.exe
  C:\Windows\System\kziVtFf.exe
  2⤵
  PID:6540
- C:\Windows\System\pHdwxiO.exe
  C:\Windows\System\pHdwxiO.exe
  2⤵
  PID:6560
- C:\Windows\System\HMggKRn.exe
  C:\Windows\System\HMggKRn.exe
  2⤵
  PID:6580
- C:\Windows\System\LKhOztt.exe
  C:\Windows\System\LKhOztt.exe
  2⤵
  PID:6596
- C:\Windows\System\YniosSx.exe
  C:\Windows\System\YniosSx.exe
  2⤵
  PID:6612
- C:\Windows\System\mhWuJEd.exe
  C:\Windows\System\mhWuJEd.exe
  2⤵
  PID:6628
- C:\Windows\System\ckwtfOO.exe
  C:\Windows\System\ckwtfOO.exe
  2⤵
  PID:6648
- C:\Windows\System\jqnWHwh.exe
  C:\Windows\System\jqnWHwh.exe
  2⤵
  PID:6664
- C:\Windows\System\doTwfMi.exe
  C:\Windows\System\doTwfMi.exe
  2⤵
  PID:6680
- C:\Windows\System\YMDjMxC.exe
  C:\Windows\System\YMDjMxC.exe
  2⤵
  PID:6696
- C:\Windows\System\gWrOSyM.exe
  C:\Windows\System\gWrOSyM.exe
  2⤵
  PID:6712
- C:\Windows\System\uUFfTus.exe
  C:\Windows\System\uUFfTus.exe
  2⤵
  PID:6728
- C:\Windows\System\kgPdpok.exe
  C:\Windows\System\kgPdpok.exe
  2⤵
  PID:6748
- C:\Windows\System\YDMYnPB.exe
  C:\Windows\System\YDMYnPB.exe
  2⤵
  PID:6764
- C:\Windows\System\iUWbqIT.exe
  C:\Windows\System\iUWbqIT.exe
  2⤵
  PID:6792
- C:\Windows\System\yJgQecQ.exe
  C:\Windows\System\yJgQecQ.exe
  2⤵
  PID:6836
- C:\Windows\System\SChmLjB.exe
  C:\Windows\System\SChmLjB.exe
  2⤵
  PID:6852
- C:\Windows\System\qaEFVBF.exe
  C:\Windows\System\qaEFVBF.exe
  2⤵
  PID:6868
- C:\Windows\System\HXJLYnN.exe
  C:\Windows\System\HXJLYnN.exe
  2⤵
  PID:6888
- C:\Windows\System\iyuiFHP.exe
  C:\Windows\System\iyuiFHP.exe
  2⤵
  PID:6904
- C:\Windows\System\COBeTpz.exe
  C:\Windows\System\COBeTpz.exe
  2⤵
  PID:6932
- C:\Windows\System\VnDDIZx.exe
  C:\Windows\System\VnDDIZx.exe
  2⤵
  PID:6952
- C:\Windows\System\LGgtMaw.exe
  C:\Windows\System\LGgtMaw.exe
  2⤵
  PID:6976
- C:\Windows\System\JJWegwI.exe
  C:\Windows\System\JJWegwI.exe
  2⤵
  PID:6992
- C:\Windows\System\QdETNzk.exe
  C:\Windows\System\QdETNzk.exe
  2⤵
  PID:7008
- C:\Windows\System\DKsdjMV.exe
  C:\Windows\System\DKsdjMV.exe
  2⤵
  PID:7024
- C:\Windows\System\QVWQnyZ.exe
  C:\Windows\System\QVWQnyZ.exe
  2⤵
  PID:7040
- C:\Windows\System\AfsQeVX.exe
  C:\Windows\System\AfsQeVX.exe
  2⤵
  PID:7064
- C:\Windows\System\CKWQFiA.exe
  C:\Windows\System\CKWQFiA.exe
  2⤵
  PID:7080
- C:\Windows\System\GrsjNHd.exe
  C:\Windows\System\GrsjNHd.exe
  2⤵
  PID:7104
- C:\Windows\System\kYunXUi.exe
  C:\Windows\System\kYunXUi.exe
  2⤵
  PID:7124
- C:\Windows\System\GhvIREP.exe
  C:\Windows\System\GhvIREP.exe
  2⤵
  PID:7140
- C:\Windows\System\apchsDg.exe
  C:\Windows\System\apchsDg.exe
  2⤵
  PID:7156
- C:\Windows\System\AsyRjrB.exe
  C:\Windows\System\AsyRjrB.exe
  2⤵
  PID:6180
- C:\Windows\System\ISPeKjP.exe
  C:\Windows\System\ISPeKjP.exe
  2⤵
  PID:6072
- C:\Windows\System\tuMplTh.exe
  C:\Windows\System\tuMplTh.exe
  2⤵
  PID:5136
- C:\Windows\System\SlglAbW.exe
  C:\Windows\System\SlglAbW.exe
  2⤵
  PID:6272
- C:\Windows\System\WbPqePg.exe
  C:\Windows\System\WbPqePg.exe
  2⤵
  PID:6192
- C:\Windows\System\PAXRUTN.exe
  C:\Windows\System\PAXRUTN.exe
  2⤵
  PID:5744
- C:\Windows\System\NHKKVEy.exe
  C:\Windows\System\NHKKVEy.exe
  2⤵
  PID:5332
- C:\Windows\System\MThXHSE.exe
  C:\Windows\System\MThXHSE.exe
  2⤵
  PID:6300
- C:\Windows\System\GxVZrwP.exe
  C:\Windows\System\GxVZrwP.exe
  2⤵
  PID:6312
- C:\Windows\System\QSLSOiA.exe
  C:\Windows\System\QSLSOiA.exe
  2⤵
  PID:6416
- C:\Windows\System\KtvkfzJ.exe
  C:\Windows\System\KtvkfzJ.exe
  2⤵
  PID:6396
- C:\Windows\System\PqyeAqq.exe
  C:\Windows\System\PqyeAqq.exe
  2⤵
  PID:6436
- C:\Windows\System\eKKxyGK.exe
  C:\Windows\System\eKKxyGK.exe
  2⤵
  PID:6464
- C:\Windows\System\PACMMbn.exe
  C:\Windows\System\PACMMbn.exe
  2⤵
  PID:6576
- C:\Windows\System\SoPwgrZ.exe
  C:\Windows\System\SoPwgrZ.exe
  2⤵
  PID:6452
- C:\Windows\System\raKNKSA.exe
  C:\Windows\System\raKNKSA.exe
  2⤵
  PID:6604
- C:\Windows\System\LUDdhSa.exe
  C:\Windows\System\LUDdhSa.exe
  2⤵
  PID:6556
- C:\Windows\System\zbjELXZ.exe
  C:\Windows\System\zbjELXZ.exe
  2⤵
  PID:6676
- C:\Windows\System\nifVKSY.exe
  C:\Windows\System\nifVKSY.exe
  2⤵
  PID:6736
- C:\Windows\System\YOlEHzC.exe
  C:\Windows\System\YOlEHzC.exe
  2⤵
  PID:6688
- C:\Windows\System\ePNHydQ.exe
  C:\Windows\System\ePNHydQ.exe
  2⤵
  PID:6780
- C:\Windows\System\RUPFkRk.exe
  C:\Windows\System\RUPFkRk.exe
  2⤵
  PID:6756
- C:\Windows\System\KoJwmKs.exe
  C:\Windows\System\KoJwmKs.exe
  2⤵
  PID:6844
- C:\Windows\System\amFLRAD.exe
  C:\Windows\System\amFLRAD.exe
  2⤵
  PID:6876
- C:\Windows\System\RZETesC.exe
  C:\Windows\System\RZETesC.exe
  2⤵
  PID:6924
- C:\Windows\System\ObTPkPG.exe
  C:\Windows\System\ObTPkPG.exe
  2⤵
  PID:6948
- C:\Windows\System\FOKlXsK.exe
  C:\Windows\System\FOKlXsK.exe
  2⤵
  PID:6820
- C:\Windows\System\AlcyGtI.exe
  C:\Windows\System\AlcyGtI.exe
  2⤵
  PID:6940
- C:\Windows\System\KjQCjKX.exe
  C:\Windows\System\KjQCjKX.exe
  2⤵
  PID:6828
- C:\Windows\System\pFzrMTI.exe
  C:\Windows\System\pFzrMTI.exe
  2⤵
  PID:7004
- C:\Windows\System\VUOjyDi.exe
  C:\Windows\System\VUOjyDi.exe
  2⤵
  PID:7072
- C:\Windows\System\pCPFuLn.exe
  C:\Windows\System\pCPFuLn.exe
  2⤵
  PID:7148
- C:\Windows\System\znFyhVI.exe
  C:\Windows\System\znFyhVI.exe
  2⤵
  PID:7020
- C:\Windows\System\NFamqsV.exe
  C:\Windows\System\NFamqsV.exe
  2⤵
  PID:7096
- C:\Windows\System\PkzIgcn.exe
  C:\Windows\System\PkzIgcn.exe
  2⤵
  PID:6160
- C:\Windows\System\MuNrYBw.exe
  C:\Windows\System\MuNrYBw.exe
  2⤵
  PID:6520
- C:\Windows\System\GvMOQZE.exe
  C:\Windows\System\GvMOQZE.exe
  2⤵
  PID:5660
- C:\Windows\System\EwyzYbs.exe
  C:\Windows\System\EwyzYbs.exe
  2⤵
  PID:6016
- C:\Windows\System\IERxBGx.exe
  C:\Windows\System\IERxBGx.exe
  2⤵
  PID:6660
- C:\Windows\System\ESDOtQX.exe
  C:\Windows\System\ESDOtQX.exe
  2⤵
  PID:6348
- C:\Windows\System\ZysoyVA.exe
  C:\Windows\System\ZysoyVA.exe
  2⤵
  PID:6804
- C:\Windows\System\WqvqLBm.exe
  C:\Windows\System\WqvqLBm.exe
  2⤵
  PID:7112
- C:\Windows\System\XOFEwbq.exe
  C:\Windows\System\XOFEwbq.exe
  2⤵
  PID:7088
- C:\Windows\System\aGQzvAL.exe
  C:\Windows\System\aGQzvAL.exe
  2⤵
  PID:6972
- C:\Windows\System\aXtmwHp.exe
  C:\Windows\System\aXtmwHp.exe
  2⤵
  PID:7052
- C:\Windows\System\biNAhOx.exe
  C:\Windows\System\biNAhOx.exe
  2⤵
  PID:6296
- C:\Windows\System\nFlxgHZ.exe
  C:\Windows\System\nFlxgHZ.exe
  2⤵
  PID:6812
- C:\Windows\System\NiCSpZa.exe
  C:\Windows\System\NiCSpZa.exe
  2⤵
  PID:6832
- C:\Windows\System\yVnkPJo.exe
  C:\Windows\System\yVnkPJo.exe
  2⤵
  PID:6228
- C:\Windows\System\yxDZhjf.exe
  C:\Windows\System\yxDZhjf.exe
  2⤵
  PID:7016
- C:\Windows\System\mFPmqww.exe
  C:\Windows\System\mFPmqww.exe
  2⤵
  PID:6176
- C:\Windows\System\hbTdXQe.exe
  C:\Windows\System\hbTdXQe.exe
  2⤵
  PID:6288
- C:\Windows\System\frNANvm.exe
  C:\Windows\System\frNANvm.exe
  2⤵
  PID:6104
- C:\Windows\System\uzQKvHo.exe
  C:\Windows\System\uzQKvHo.exe
  2⤵
  PID:7056
- C:\Windows\System\yZXCjkM.exe
  C:\Windows\System\yZXCjkM.exe
  2⤵
  PID:6512
- C:\Windows\System\HPckEul.exe
  C:\Windows\System\HPckEul.exe
  2⤵
  PID:5876
- C:\Windows\System\KsCckWN.exe
  C:\Windows\System\KsCckWN.exe
  2⤵
  PID:7032
- C:\Windows\System\AErZRCN.exe
  C:\Windows\System\AErZRCN.exe
  2⤵
  PID:6240
- C:\Windows\System\kgaiSAQ.exe
  C:\Windows\System\kgaiSAQ.exe
  2⤵
  PID:6960
- C:\Windows\System\iIgauOB.exe
  C:\Windows\System\iIgauOB.exe
  2⤵
  PID:6744
- C:\Windows\System\yvDvhks.exe
  C:\Windows\System\yvDvhks.exe
  2⤵
  PID:7164
- C:\Windows\System\WYUAyHz.exe
  C:\Windows\System\WYUAyHz.exe
  2⤵
  PID:7180
- C:\Windows\System\GyDimEj.exe
  C:\Windows\System\GyDimEj.exe
  2⤵
  PID:7196
- C:\Windows\System\vhMSivD.exe
  C:\Windows\System\vhMSivD.exe
  2⤵
  PID:7212
- C:\Windows\System\KATPXnK.exe
  C:\Windows\System\KATPXnK.exe
  2⤵
  PID:7308
- C:\Windows\System\KIHByJs.exe
  C:\Windows\System\KIHByJs.exe
  2⤵
  PID:7328
- C:\Windows\System\ngPeYNN.exe
  C:\Windows\System\ngPeYNN.exe
  2⤵
  PID:7344
- C:\Windows\System\LCySeVW.exe
  C:\Windows\System\LCySeVW.exe
  2⤵
  PID:7360
- C:\Windows\System\jfBpzQc.exe
  C:\Windows\System\jfBpzQc.exe
  2⤵
  PID:7380
- C:\Windows\System\KQKLpNd.exe
  C:\Windows\System\KQKLpNd.exe
  2⤵
  PID:7420
- C:\Windows\System\tsllbvc.exe
  C:\Windows\System\tsllbvc.exe
  2⤵
  PID:7452
- C:\Windows\System\FDZcYZH.exe
  C:\Windows\System\FDZcYZH.exe
  2⤵
  PID:7468
- C:\Windows\System\AZKpXfl.exe
  C:\Windows\System\AZKpXfl.exe
  2⤵
  PID:7488
- C:\Windows\System\YZrVVMw.exe
  C:\Windows\System\YZrVVMw.exe
  2⤵
  PID:7504
- C:\Windows\System\njhOVCL.exe
  C:\Windows\System\njhOVCL.exe
  2⤵
  PID:7520
- C:\Windows\System\oDIUmXY.exe
  C:\Windows\System\oDIUmXY.exe
  2⤵
  PID:7536
- C:\Windows\System\brdQkjW.exe
  C:\Windows\System\brdQkjW.exe
  2⤵
  PID:7612
- C:\Windows\System\mspTlBR.exe
  C:\Windows\System\mspTlBR.exe
  2⤵
  PID:7696
- C:\Windows\System\EcPwIpG.exe
  C:\Windows\System\EcPwIpG.exe
  2⤵
  PID:7836
- C:\Windows\System\mGampiz.exe
  C:\Windows\System\mGampiz.exe
  2⤵
  PID:7852
- C:\Windows\System\xSINTXz.exe
  C:\Windows\System\xSINTXz.exe
  2⤵
  PID:7868
- C:\Windows\System\OicqFwT.exe
  C:\Windows\System\OicqFwT.exe
  2⤵
  PID:7952
- C:\Windows\System\RnVxqkP.exe
  C:\Windows\System\RnVxqkP.exe
  2⤵
  PID:7968
- C:\Windows\System\RpKVxpt.exe
  C:\Windows\System\RpKVxpt.exe
  2⤵
  PID:7984
- C:\Windows\System\yNEOmHS.exe
  C:\Windows\System\yNEOmHS.exe
  2⤵
  PID:8004
- C:\Windows\System\mscCHFn.exe
  C:\Windows\System\mscCHFn.exe
  2⤵
  PID:8020
- C:\Windows\System\GccsASH.exe
  C:\Windows\System\GccsASH.exe
  2⤵
  PID:8036
- C:\Windows\System\vDdDLKJ.exe
  C:\Windows\System\vDdDLKJ.exe
  2⤵
  PID:8056
- C:\Windows\System\QEREtFK.exe
  C:\Windows\System\QEREtFK.exe
  2⤵
  PID:8072
- C:\Windows\System\UoRPKub.exe
  C:\Windows\System\UoRPKub.exe
  2⤵
  PID:8120
- C:\Windows\System\EcXAMhG.exe
  C:\Windows\System\EcXAMhG.exe
  2⤵
  PID:8136
- C:\Windows\System\zHcwPFY.exe
  C:\Windows\System\zHcwPFY.exe
  2⤵
  PID:8152
- C:\Windows\System\uEJjfZN.exe
  C:\Windows\System\uEJjfZN.exe
  2⤵
  PID:8168
- C:\Windows\System\HWkatEe.exe
  C:\Windows\System\HWkatEe.exe
  2⤵
  PID:8184
- C:\Windows\System\GGVPZtD.exe
  C:\Windows\System\GGVPZtD.exe
  2⤵
  PID:6412
- C:\Windows\System\TGVcswJ.exe
  C:\Windows\System\TGVcswJ.exe
  2⤵
  PID:7432
- C:\Windows\System\kGPIZpv.exe
  C:\Windows\System\kGPIZpv.exe
  2⤵
  PID:7920
- C:\Windows\System\vHgGvrW.exe
  C:\Windows\System\vHgGvrW.exe
  2⤵
  PID:8000
- C:\Windows\System\zESQymz.exe
  C:\Windows\System\zESQymz.exe
  2⤵
  PID:8160
- C:\Windows\System\eFuusKQ.exe
  C:\Windows\System\eFuusKQ.exe
  2⤵
  PID:6708
- C:\Windows\System\RFeowuR.exe
  C:\Windows\System\RFeowuR.exe
  2⤵
  PID:7604
- C:\Windows\System\hLjhoFr.exe
  C:\Windows\System\hLjhoFr.exe
  2⤵
  PID:7584
- C:\Windows\System\XxikqGh.exe
  C:\Windows\System\XxikqGh.exe
  2⤵
  PID:7608
- C:\Windows\System\bFoKxjL.exe
  C:\Windows\System\bFoKxjL.exe
  2⤵
  PID:7640
- C:\Windows\System\ofUqBKr.exe
  C:\Windows\System\ofUqBKr.exe
  2⤵
  PID:7624
- C:\Windows\System\AYXFpGG.exe
  C:\Windows\System\AYXFpGG.exe
  2⤵
  PID:7684
- C:\Windows\System\DFNmnQL.exe
  C:\Windows\System\DFNmnQL.exe
  2⤵
  PID:6532
- C:\Windows\System\iWLipWz.exe
  C:\Windows\System\iWLipWz.exe
  2⤵
  PID:6548
- C:\Windows\System\ipibGJI.exe
  C:\Windows\System\ipibGJI.exe
  2⤵
  PID:7060
- C:\Windows\System\frnZoiX.exe
  C:\Windows\System\frnZoiX.exe
  2⤵
  PID:6316
- C:\Windows\System\xztfBTH.exe
  C:\Windows\System\xztfBTH.exe
  2⤵
  PID:7172
- C:\Windows\System\bfwUFpl.exe
  C:\Windows\System\bfwUFpl.exe
  2⤵
  PID:7320
- C:\Windows\System\XbFPIaL.exe
  C:\Windows\System\XbFPIaL.exe
  2⤵
  PID:7388
- C:\Windows\System\UJaQgqA.exe
  C:\Windows\System\UJaQgqA.exe
  2⤵
  PID:7256
- C:\Windows\System\WRxxxdl.exe
  C:\Windows\System\WRxxxdl.exe
  2⤵
  PID:7376
- C:\Windows\System\KDzQeJx.exe
  C:\Windows\System\KDzQeJx.exe
  2⤵
  PID:8048
- C:\Windows\System\QQJSnVt.exe
  C:\Windows\System\QQJSnVt.exe
  2⤵
  PID:2876
- C:\Windows\System\aqGvPYF.exe
  C:\Windows\System\aqGvPYF.exe
  2⤵
  PID:7824
- C:\Windows\System\dtIKaZF.exe
  C:\Windows\System\dtIKaZF.exe
  2⤵
  PID:7716
- C:\Windows\System\uioXlYJ.exe
  C:\Windows\System\uioXlYJ.exe
  2⤵
  PID:7760
- C:\Windows\System\acyrcyd.exe
  C:\Windows\System\acyrcyd.exe
  2⤵
  PID:8104
- C:\Windows\System\kIksqoP.exe
  C:\Windows\System\kIksqoP.exe
  2⤵
  PID:7784
- C:\Windows\System\vjdyIun.exe
  C:\Windows\System\vjdyIun.exe
  2⤵
  PID:8144
- C:\Windows\System\EeIrvDD.exe
  C:\Windows\System\EeIrvDD.exe
  2⤵
  PID:8108
- C:\Windows\System\uAHtCZW.exe
  C:\Windows\System\uAHtCZW.exe
  2⤵
  PID:8116
- C:\Windows\System\dTpFFfc.exe
  C:\Windows\System\dTpFFfc.exe
  2⤵
  PID:8180
- C:\Windows\System\PDtbcsA.exe
  C:\Windows\System\PDtbcsA.exe
  2⤵
  PID:7964
- C:\Windows\System\kZgGxqZ.exe
  C:\Windows\System\kZgGxqZ.exe
  2⤵
  PID:7188
- C:\Windows\System\JGGNzzU.exe
  C:\Windows\System\JGGNzzU.exe
  2⤵
  PID:7652
- C:\Windows\System\HrASZxn.exe
  C:\Windows\System\HrASZxn.exe
  2⤵
  PID:8128
- C:\Windows\System\hGiltSn.exe
  C:\Windows\System\hGiltSn.exe
  2⤵
  PID:7848
- C:\Windows\System\BqDIXcf.exe
  C:\Windows\System\BqDIXcf.exe
  2⤵
  PID:7656
- C:\Windows\System\MZvGWQP.exe
  C:\Windows\System\MZvGWQP.exe
  2⤵
  PID:7544
- C:\Windows\System\COAwhoe.exe
  C:\Windows\System\COAwhoe.exe
  2⤵
  PID:7372
- C:\Windows\System\uVzgQfH.exe
  C:\Windows\System\uVzgQfH.exe
  2⤵
  PID:7116
- C:\Windows\System\WMbknQU.exe
  C:\Windows\System\WMbknQU.exe
  2⤵
  PID:7276
- C:\Windows\System\XHhgDzE.exe
  C:\Windows\System\XHhgDzE.exe
  2⤵
  PID:7440
- C:\Windows\System\stsbORF.exe
  C:\Windows\System\stsbORF.exe
  2⤵
  PID:7516
- C:\Windows\System\nfkpRlr.exe
  C:\Windows\System\nfkpRlr.exe
  2⤵
  PID:7888
- C:\Windows\System\CrgvgCy.exe
  C:\Windows\System\CrgvgCy.exe
  2⤵
  PID:7912
- C:\Windows\System\MhlpOwU.exe
  C:\Windows\System\MhlpOwU.exe
  2⤵
  PID:944
- C:\Windows\System\GzXmubI.exe
  C:\Windows\System\GzXmubI.exe
  2⤵
  PID:1368
- C:\Windows\System\rEyjTrM.exe
  C:\Windows\System\rEyjTrM.exe
  2⤵
  PID:7944
- C:\Windows\System\IMOddAe.exe
  C:\Windows\System\IMOddAe.exe
  2⤵
  PID:7712
- C:\Windows\System\xbroQwR.exe
  C:\Windows\System\xbroQwR.exe
  2⤵
  PID:8044
- C:\Windows\System\ZGRjNQj.exe
  C:\Windows\System\ZGRjNQj.exe
  2⤵
  PID:7904
- C:\Windows\System\rCHmvIR.exe
  C:\Windows\System\rCHmvIR.exe
  2⤵
  PID:8016
- C:\Windows\System\andSSMs.exe
  C:\Windows\System\andSSMs.exe
  2⤵
  PID:7736
- C:\Windows\System\JZowHkC.exe
  C:\Windows\System\JZowHkC.exe
  2⤵
  PID:8096
- C:\Windows\System\hDzDyoC.exe
  C:\Windows\System\hDzDyoC.exe
  2⤵
  PID:1388
- C:\Windows\System\cLGYTvW.exe
  C:\Windows\System\cLGYTvW.exe
  2⤵
  PID:8028
- C:\Windows\System\IAtBqgO.exe
  C:\Windows\System\IAtBqgO.exe
  2⤵
  PID:7556
- C:\Windows\System\BihufbG.exe
  C:\Windows\System\BihufbG.exe
  2⤵
  PID:7636
- C:\Windows\System\WPWpVIW.exe
  C:\Windows\System\WPWpVIW.exe
  2⤵
  PID:1736
- C:\Windows\System\DvQNfph.exe
  C:\Windows\System\DvQNfph.exe
  2⤵
  PID:6568
- C:\Windows\System\jQSdMbA.exe
  C:\Windows\System\jQSdMbA.exe
  2⤵
  PID:7408
- C:\Windows\System\qpDVZzW.exe
  C:\Windows\System\qpDVZzW.exe
  2⤵
  PID:7316
- C:\Windows\System\XfMBJTA.exe
  C:\Windows\System\XfMBJTA.exe
  2⤵
  PID:7660
- C:\Windows\System\kgbzVQU.exe
  C:\Windows\System\kgbzVQU.exe
  2⤵
  PID:7400
- C:\Windows\System\XXPkIUK.exe
  C:\Windows\System\XXPkIUK.exe
  2⤵
  PID:6816
- C:\Windows\System\moAmRyj.exe
  C:\Windows\System\moAmRyj.exe
  2⤵
  PID:7220
- C:\Windows\System\cfnIuul.exe
  C:\Windows\System\cfnIuul.exe
  2⤵
  PID:7592
- C:\Windows\System\DRKyOrW.exe
  C:\Windows\System\DRKyOrW.exe
  2⤵
  PID:4212
- C:\Windows\System\ZnyObbJ.exe
  C:\Windows\System\ZnyObbJ.exe
  2⤵
  PID:7280
- C:\Windows\System\sJlUChJ.exe
  C:\Windows\System\sJlUChJ.exe
  2⤵
  PID:7412
- C:\Windows\System\gNSqMhK.exe
  C:\Windows\System\gNSqMhK.exe
  2⤵
  PID:7916
- C:\Windows\System\fYpjAae.exe
  C:\Windows\System\fYpjAae.exe
  2⤵
  PID:7292
- C:\Windows\System\JhGJnRp.exe
  C:\Windows\System\JhGJnRp.exe
  2⤵
  PID:7252
- C:\Windows\System\YLKzTEC.exe
  C:\Windows\System\YLKzTEC.exe
  2⤵
  PID:7708
- C:\Windows\System\Fbshwnl.exe
  C:\Windows\System\Fbshwnl.exe
  2⤵
  PID:7908
- C:\Windows\System\LtHHPwG.exe
  C:\Windows\System\LtHHPwG.exe
  2⤵
  PID:8064
- C:\Windows\System\XSEUfZE.exe
  C:\Windows\System\XSEUfZE.exe
  2⤵
  PID:7792
- C:\Windows\System\zEdFJzS.exe
  C:\Windows\System\zEdFJzS.exe
  2⤵
  PID:7752
- C:\Windows\System\UnUeqfK.exe
  C:\Windows\System\UnUeqfK.exe
  2⤵
  PID:8080
- C:\Windows\System\ZcbBuBd.exe
  C:\Windows\System\ZcbBuBd.exe
  2⤵
  PID:7812
- C:\Windows\System\YhuAOBS.exe
  C:\Windows\System\YhuAOBS.exe
  2⤵
  PID:7748
- C:\Windows\System\lPZepZj.exe
  C:\Windows\System\lPZepZj.exe
  2⤵
  PID:7820
- C:\Windows\System\LyxSRAo.exe
  C:\Windows\System\LyxSRAo.exe
  2⤵
  PID:7960
- C:\Windows\System\emAWNpD.exe
  C:\Windows\System\emAWNpD.exe
  2⤵
  PID:6468
- C:\Windows\System\pLdMNTJ.exe
  C:\Windows\System\pLdMNTJ.exe
  2⤵
  PID:7208
- C:\Windows\System\waBLzxe.exe
  C:\Windows\System\waBLzxe.exe
  2⤵
  PID:7448
- C:\Windows\System\ftTXuLW.exe
  C:\Windows\System\ftTXuLW.exe
  2⤵
  PID:7340
- C:\Windows\System\GzKiIGC.exe
  C:\Windows\System\GzKiIGC.exe
  2⤵
  PID:7932
- C:\Windows\System\kuJwzdD.exe
  C:\Windows\System\kuJwzdD.exe
  2⤵
  PID:7268
- C:\Windows\System\nIlTkmy.exe
  C:\Windows\System\nIlTkmy.exe
  2⤵
  PID:7876
- C:\Windows\System\HdDBIio.exe
  C:\Windows\System\HdDBIio.exe
  2⤵
  PID:7924
- C:\Windows\System\CygIwMR.exe
  C:\Windows\System\CygIwMR.exe
  2⤵
  PID:1492
- C:\Windows\System\oDMVTdS.exe
  C:\Windows\System\oDMVTdS.exe
  2⤵
  PID:6776
- C:\Windows\System\KKrRlQW.exe
  C:\Windows\System\KKrRlQW.exe
  2⤵
  PID:8084
- C:\Windows\System\NBsynYT.exe
  C:\Windows\System\NBsynYT.exe
  2⤵
  PID:7204
- C:\Windows\System\vWqRNWy.exe
  C:\Windows\System\vWqRNWy.exe
  2⤵
  PID:7464
- C:\Windows\System\pTcblnJ.exe
  C:\Windows\System\pTcblnJ.exe
  2⤵
  PID:8012
- C:\Windows\System\ODcvHEG.exe
  C:\Windows\System\ODcvHEG.exe
  2⤵
  PID:7676
- C:\Windows\System\BXOlxZa.exe
  C:\Windows\System\BXOlxZa.exe
  2⤵
  PID:8148
- C:\Windows\System\HOpWMPX.exe
  C:\Windows\System\HOpWMPX.exe
  2⤵
  PID:7844
- C:\Windows\System\hSqtEwE.exe
  C:\Windows\System\hSqtEwE.exe
  2⤵
  PID:7976
- C:\Windows\System\RXaCmXM.exe
  C:\Windows\System\RXaCmXM.exe
  2⤵
  PID:6292
- C:\Windows\System\gAdedQQ.exe
  C:\Windows\System\gAdedQQ.exe
  2⤵
  PID:7588
- C:\Windows\System\pULrdwy.exe
  C:\Windows\System\pULrdwy.exe
  2⤵
  PID:7648
- C:\Windows\System\ObZmQmg.exe
  C:\Windows\System\ObZmQmg.exe
  2⤵
  PID:7600
- C:\Windows\System\MlzsLHk.exe
  C:\Windows\System\MlzsLHk.exe
  2⤵
  PID:7884
- C:\Windows\System\EqBnoRq.exe
  C:\Windows\System\EqBnoRq.exe
  2⤵
  PID:7728
- C:\Windows\System\DIUzKSx.exe
  C:\Windows\System\DIUzKSx.exe
  2⤵
  PID:7740
- C:\Windows\System\SjbGFdx.exe
  C:\Windows\System\SjbGFdx.exe
  2⤵
  PID:8212
- C:\Windows\System\MtFtfDp.exe
  C:\Windows\System\MtFtfDp.exe
  2⤵
  PID:8228
- C:\Windows\System\ItPxuKn.exe
  C:\Windows\System\ItPxuKn.exe
  2⤵
  PID:8244
- C:\Windows\System\zzwXmXf.exe
  C:\Windows\System\zzwXmXf.exe
  2⤵
  PID:8260
- C:\Windows\System\FraKPyf.exe
  C:\Windows\System\FraKPyf.exe
  2⤵
  PID:8276
- C:\Windows\System\DjVzUrX.exe
  C:\Windows\System\DjVzUrX.exe
  2⤵
  PID:8292
- C:\Windows\System\rsqtPwy.exe
  C:\Windows\System\rsqtPwy.exe
  2⤵
  PID:8308
- C:\Windows\System\cuSSCHh.exe
  C:\Windows\System\cuSSCHh.exe
  2⤵
  PID:8344
- C:\Windows\System\mAvEvNd.exe
  C:\Windows\System\mAvEvNd.exe
  2⤵
  PID:8484
- C:\Windows\System\bGUsaIt.exe
  C:\Windows\System\bGUsaIt.exe
  2⤵
  PID:8500
- C:\Windows\System\ppCAJfq.exe
  C:\Windows\System\ppCAJfq.exe
  2⤵
  PID:8516
- C:\Windows\System\PBqwpal.exe
  C:\Windows\System\PBqwpal.exe
  2⤵
  PID:8532
- C:\Windows\System\QrXNrYm.exe
  C:\Windows\System\QrXNrYm.exe
  2⤵
  PID:8552
- C:\Windows\System\EfPnRKf.exe
  C:\Windows\System\EfPnRKf.exe
  2⤵
  PID:8568
- C:\Windows\System\fGxWyhQ.exe
  C:\Windows\System\fGxWyhQ.exe
  2⤵
  PID:8584
- C:\Windows\System\iIWszgi.exe
  C:\Windows\System\iIWszgi.exe
  2⤵
  PID:8600
- C:\Windows\System\yJuPguB.exe
  C:\Windows\System\yJuPguB.exe
  2⤵
  PID:8616
- C:\Windows\System\xAaShcF.exe
  C:\Windows\System\xAaShcF.exe
  2⤵
  PID:8632
- C:\Windows\System\AmbYRui.exe
  C:\Windows\System\AmbYRui.exe
  2⤵
  PID:8648
- C:\Windows\System\kYTfPom.exe
  C:\Windows\System\kYTfPom.exe
  2⤵
  PID:8664
- C:\Windows\System\MxCjlHV.exe
  C:\Windows\System\MxCjlHV.exe
  2⤵
  PID:8680
- C:\Windows\System\atzwpsT.exe
  C:\Windows\System\atzwpsT.exe
  2⤵
  PID:8696
- C:\Windows\System\FvfxjPH.exe
  C:\Windows\System\FvfxjPH.exe
  2⤵
  PID:8712
- C:\Windows\System\zQaKDLI.exe
  C:\Windows\System\zQaKDLI.exe
  2⤵
  PID:8728
- C:\Windows\System\qMxxKSP.exe
  C:\Windows\System\qMxxKSP.exe
  2⤵
  PID:8744
- C:\Windows\System\SKYCRAL.exe
  C:\Windows\System\SKYCRAL.exe
  2⤵
  PID:8760
- C:\Windows\System\RWwAQdK.exe
  C:\Windows\System\RWwAQdK.exe
  2⤵
  PID:8776
- C:\Windows\System\ZHDuFUI.exe
  C:\Windows\System\ZHDuFUI.exe
  2⤵
  PID:8792
- C:\Windows\System\LOkmGPT.exe
  C:\Windows\System\LOkmGPT.exe
  2⤵
  PID:8808
- C:\Windows\System\JWbdNof.exe
  C:\Windows\System\JWbdNof.exe
  2⤵
  PID:8824
- C:\Windows\System\LPewRjD.exe
  C:\Windows\System\LPewRjD.exe
  2⤵
  PID:8844
- C:\Windows\System\jTQmVDI.exe
  C:\Windows\System\jTQmVDI.exe
  2⤵
  PID:8860
- C:\Windows\System\iltLYNx.exe
  C:\Windows\System\iltLYNx.exe
  2⤵
  PID:8876
- C:\Windows\System\jgTNnEi.exe
  C:\Windows\System\jgTNnEi.exe
  2⤵
  PID:8892
- C:\Windows\System\LjPLAFa.exe
  C:\Windows\System\LjPLAFa.exe
  2⤵
  PID:8908
- C:\Windows\System\mRsnLDY.exe
  C:\Windows\System\mRsnLDY.exe
  2⤵
  PID:8924
- C:\Windows\System\aBCitMn.exe
  C:\Windows\System\aBCitMn.exe
  2⤵
  PID:8940
- C:\Windows\System\tbsOpIQ.exe
  C:\Windows\System\tbsOpIQ.exe
  2⤵
  PID:8956
- C:\Windows\System\BQFGDVy.exe
  C:\Windows\System\BQFGDVy.exe
  2⤵
  PID:8972
- C:\Windows\System\hJLMvUd.exe
  C:\Windows\System\hJLMvUd.exe
  2⤵
  PID:8992
- C:\Windows\System\NmDDcOm.exe
  C:\Windows\System\NmDDcOm.exe
  2⤵
  PID:9016
- C:\Windows\System\xtJmxAG.exe
  C:\Windows\System\xtJmxAG.exe
  2⤵
  PID:9032
- C:\Windows\System\ifrQAXc.exe
  C:\Windows\System\ifrQAXc.exe
  2⤵
  PID:9048
- C:\Windows\System\sZQzGJw.exe
  C:\Windows\System\sZQzGJw.exe
  2⤵
  PID:9064
- C:\Windows\System\WfOzPBk.exe
  C:\Windows\System\WfOzPBk.exe
  2⤵
  PID:9080
- C:\Windows\System\KPnbMAH.exe
  C:\Windows\System\KPnbMAH.exe
  2⤵
  PID:9096
- C:\Windows\System\mThQveD.exe
  C:\Windows\System\mThQveD.exe
  2⤵
  PID:9112
- C:\Windows\System\wDgtxQR.exe
  C:\Windows\System\wDgtxQR.exe
  2⤵
  PID:9128
- C:\Windows\System\pzSnXNp.exe
  C:\Windows\System\pzSnXNp.exe
  2⤵
  PID:9144
- C:\Windows\System\NmgPmLY.exe
  C:\Windows\System\NmgPmLY.exe
  2⤵
  PID:9160
- C:\Windows\System\XSiPZyu.exe
  C:\Windows\System\XSiPZyu.exe
  2⤵
  PID:9176
- C:\Windows\System\LQpvBJc.exe
  C:\Windows\System\LQpvBJc.exe
  2⤵
  PID:9192
- C:\Windows\System\BGKPjYw.exe
  C:\Windows\System\BGKPjYw.exe
  2⤵
  PID:9208
- C:\Windows\System\lgRKiTQ.exe
  C:\Windows\System\lgRKiTQ.exe
  2⤵
  PID:5592
- C:\Windows\System\BUorOcf.exe
  C:\Windows\System\BUorOcf.exe
  2⤵
  PID:8288
- C:\Windows\System\ATqSIHG.exe
  C:\Windows\System\ATqSIHG.exe
  2⤵
  PID:8356
- C:\Windows\System\TksndJG.exe
  C:\Windows\System\TksndJG.exe
  2⤵
  PID:8320
- C:\Windows\System\NfqzZtg.exe
  C:\Windows\System\NfqzZtg.exe
  2⤵
  PID:8332
- C:\Windows\System\XlMsJpy.exe
  C:\Windows\System\XlMsJpy.exe
  2⤵
  PID:8396
- C:\Windows\System\yyXuWSm.exe
  C:\Windows\System\yyXuWSm.exe
  2⤵
  PID:2332
- C:\Windows\System\OuXdqTa.exe
  C:\Windows\System\OuXdqTa.exe
  2⤵
  PID:8236
- C:\Windows\System\rKzfDNF.exe
  C:\Windows\System\rKzfDNF.exe
  2⤵
  PID:1964
- C:\Windows\System\PxLdkdd.exe
  C:\Windows\System\PxLdkdd.exe
  2⤵
  PID:8436
- C:\Windows\System\uCIDIOO.exe
  C:\Windows\System\uCIDIOO.exe
  2⤵
  PID:8376
- C:\Windows\System\seFsKSt.exe
  C:\Windows\System\seFsKSt.exe
  2⤵
  PID:8412
- C:\Windows\System\gViuhZo.exe
  C:\Windows\System\gViuhZo.exe
  2⤵
  PID:8452
- C:\Windows\System\gJqUJfD.exe
  C:\Windows\System\gJqUJfD.exe
  2⤵
  PID:8440
- C:\Windows\System\dxAfYIG.exe
  C:\Windows\System\dxAfYIG.exe
  2⤵
  PID:8508
- C:\Windows\System\qvUtHWi.exe
  C:\Windows\System\qvUtHWi.exe
  2⤵
  PID:8548
- C:\Windows\System\WLNWkfS.exe
  C:\Windows\System\WLNWkfS.exe
  2⤵
  PID:8492
- C:\Windows\System\QKkupKs.exe
  C:\Windows\System\QKkupKs.exe
  2⤵
  PID:8528
- C:\Windows\System\ZPacfqE.exe
  C:\Windows\System\ZPacfqE.exe
  2⤵
  PID:8672
- C:\Windows\System\jksdwSZ.exe
  C:\Windows\System\jksdwSZ.exe
  2⤵
  PID:8692
- C:\Windows\System\xQhWLvG.exe
  C:\Windows\System\xQhWLvG.exe
  2⤵
  PID:8800
- C:\Windows\System\TLLNTPy.exe
  C:\Windows\System\TLLNTPy.exe
  2⤵
  PID:8832
- C:\Windows\System\kXodvFB.exe
  C:\Windows\System\kXodvFB.exe
  2⤵
  PID:8756
- C:\Windows\System\kzEzSUE.exe
  C:\Windows\System\kzEzSUE.exe
  2⤵
  PID:8820
- C:\Windows\System\AwgBKqV.exe
  C:\Windows\System\AwgBKqV.exe
  2⤵
  PID:8872
- C:\Windows\System\cbAsgpd.exe
  C:\Windows\System\cbAsgpd.exe
  2⤵
  PID:8904
- C:\Windows\System\RBYSCmu.exe
  C:\Windows\System\RBYSCmu.exe
  2⤵
  PID:8920
- C:\Windows\System\ikJRYSr.exe
  C:\Windows\System\ikJRYSr.exe
  2⤵
  PID:8444
- C:\Windows\System\csRxHsb.exe
  C:\Windows\System\csRxHsb.exe
  2⤵
  PID:9000
- C:\Windows\System\jlRjVXp.exe
  C:\Windows\System\jlRjVXp.exe
  2⤵
  PID:9040
- C:\Windows\System\BMWHuRs.exe
  C:\Windows\System\BMWHuRs.exe
  2⤵
  PID:9104
- C:\Windows\System\ckCYcuw.exe
  C:\Windows\System\ckCYcuw.exe
  2⤵
  PID:9136
- C:\Windows\System\oxdrQHo.exe
  C:\Windows\System\oxdrQHo.exe
  2⤵
  PID:9172
- C:\Windows\System\mdwvZXX.exe
  C:\Windows\System\mdwvZXX.exe
  2⤵
  PID:9056
- C:\Windows\System\aXuBuaV.exe
  C:\Windows\System\aXuBuaV.exe
  2⤵
  PID:9092
- C:\Windows\System\AQyxJCh.exe
  C:\Windows\System\AQyxJCh.exe
  2⤵
  PID:9152
- C:\Windows\System\wZsHmuo.exe
  C:\Windows\System\wZsHmuo.exe
  2⤵
  PID:8268
- C:\Windows\System\rDVGrHj.exe
  C:\Windows\System\rDVGrHj.exe
  2⤵
  PID:7396
- C:\Windows\System\cpDxdqm.exe
  C:\Windows\System\cpDxdqm.exe
  2⤵
  PID:8256
- C:\Windows\System\dQDtfLq.exe
  C:\Windows\System\dQDtfLq.exe
  2⤵
  PID:8592
- C:\Windows\System\lQaPWsn.exe
  C:\Windows\System\lQaPWsn.exe
  2⤵
  PID:8708
- C:\Windows\System\fskNkGQ.exe
  C:\Windows\System\fskNkGQ.exe
  2⤵
  PID:8804
- C:\Windows\System\WSDbwJF.exe
  C:\Windows\System\WSDbwJF.exe
  2⤵
  PID:8816
- C:\Windows\System\SIbqBuX.exe
  C:\Windows\System\SIbqBuX.exe
  2⤵
  PID:8964
- C:\Windows\System\bVPAFUM.exe
  C:\Windows\System\bVPAFUM.exe
  2⤵
  PID:8984
- C:\Windows\System\zJGZqcb.exe
  C:\Windows\System\zJGZqcb.exe
  2⤵
  PID:8220
- C:\Windows\System\JpARnDc.exe
  C:\Windows\System\JpARnDc.exe
  2⤵
  PID:8644
- C:\Windows\System\rZBapjR.exe
  C:\Windows\System\rZBapjR.exe
  2⤵
  PID:8612
- C:\Windows\System\PSKttkF.exe
  C:\Windows\System\PSKttkF.exe
  2⤵
  PID:8868
- C:\Windows\System\Orxrfpn.exe
  C:\Windows\System\Orxrfpn.exe
  2⤵
  PID:3928
- C:\Windows\System\QoftKWZ.exe
  C:\Windows\System\QoftKWZ.exe
  2⤵
  PID:9024
- C:\Windows\System\XonvjuX.exe
  C:\Windows\System\XonvjuX.exe
  2⤵
  PID:9168
- C:\Windows\System\ROCjAXh.exe
  C:\Windows\System\ROCjAXh.exe
  2⤵
  PID:8424
- C:\Windows\System\LshNuIj.exe
  C:\Windows\System\LshNuIj.exe
  2⤵
  PID:8304
- C:\Windows\System\YakbXVm.exe
  C:\Windows\System\YakbXVm.exe
  2⤵
  PID:8388
- C:\Windows\System\IegxUlz.exe
  C:\Windows\System\IegxUlz.exe
  2⤵
  PID:8480
- C:\Windows\System\TJXuLDJ.exe
  C:\Windows\System\TJXuLDJ.exe
  2⤵
  PID:8660
- C:\Windows\System\xGdyhGt.exe
  C:\Windows\System\xGdyhGt.exe
  2⤵
  PID:9204
- C:\Windows\System\jFdvkUR.exe
  C:\Windows\System\jFdvkUR.exe
  2⤵
  PID:8704
- C:\Windows\System\EqWNHJd.exe
  C:\Windows\System\EqWNHJd.exe
  2⤵
  PID:8316
- C:\Windows\System\PalDwci.exe
  C:\Windows\System\PalDwci.exe
  2⤵
  PID:8624
- C:\Windows\System\HyrpetF.exe
  C:\Windows\System\HyrpetF.exe
  2⤵
  PID:9188
- C:\Windows\System\iBPlpBf.exe
  C:\Windows\System\iBPlpBf.exe
  2⤵
  PID:8360
- C:\Windows\System\peHdXYF.exe
  C:\Windows\System\peHdXYF.exe
  2⤵
  PID:9076
- C:\Windows\System\tYUQJDA.exe
  C:\Windows\System\tYUQJDA.exe
  2⤵
  PID:8580
- C:\Windows\System\mKmmVSv.exe
  C:\Windows\System\mKmmVSv.exe
  2⤵
  PID:8476
- C:\Windows\System\dIbPiGU.exe
  C:\Windows\System\dIbPiGU.exe
  2⤵
  PID:7808
- C:\Windows\System\yKccVYY.exe
  C:\Windows\System\yKccVYY.exe
  2⤵
  PID:8456
- C:\Windows\System\BcqnEnW.exe
  C:\Windows\System\BcqnEnW.exe
  2⤵
  PID:8372
- C:\Windows\System\ZdWngDF.exe
  C:\Windows\System\ZdWngDF.exe
  2⤵
  PID:8900
- C:\Windows\System\MkkaaFj.exe
  C:\Windows\System\MkkaaFj.exe
  2⤵
  PID:8752
- C:\Windows\System\VrqfKzn.exe
  C:\Windows\System\VrqfKzn.exe
  2⤵
  PID:8468
- C:\Windows\System\PuifuVK.exe
  C:\Windows\System\PuifuVK.exe
  2⤵
  PID:9008
- C:\Windows\System\FZKhaXH.exe
  C:\Windows\System\FZKhaXH.exe
  2⤵
  PID:9088
- C:\Windows\System\aNBFxGO.exe
  C:\Windows\System\aNBFxGO.exe
  2⤵
  PID:8544
- C:\Windows\System\rnxjHLF.exe
  C:\Windows\System\rnxjHLF.exe
  2⤵
  PID:8472
- C:\Windows\System\kbgaJPy.exe
  C:\Windows\System\kbgaJPy.exe
  2⤵
  PID:9228
- C:\Windows\System\JZzIpwQ.exe
  C:\Windows\System\JZzIpwQ.exe
  2⤵
  PID:9244
- C:\Windows\System\ZbTXCLW.exe
  C:\Windows\System\ZbTXCLW.exe
  2⤵
  PID:9260
- C:\Windows\System\LIaewqU.exe
  C:\Windows\System\LIaewqU.exe
  2⤵
  PID:9276
- C:\Windows\System\SlIagol.exe
  C:\Windows\System\SlIagol.exe
  2⤵
  PID:9292
- C:\Windows\System\CCDVGos.exe
  C:\Windows\System\CCDVGos.exe
  2⤵
  PID:9308
- C:\Windows\System\iVawZYd.exe
  C:\Windows\System\iVawZYd.exe
  2⤵
  PID:9324
- C:\Windows\System\aMjbkBP.exe
  C:\Windows\System\aMjbkBP.exe
  2⤵
  PID:9340
- C:\Windows\System\TLKyRtu.exe
  C:\Windows\System\TLKyRtu.exe
  2⤵
  PID:9356
- C:\Windows\System\zAeyFxX.exe
  C:\Windows\System\zAeyFxX.exe
  2⤵
  PID:9372
- C:\Windows\System\zPiVEyC.exe
  C:\Windows\System\zPiVEyC.exe
  2⤵
  PID:9388
- C:\Windows\System\HMboqHJ.exe
  C:\Windows\System\HMboqHJ.exe
  2⤵
  PID:9404
- C:\Windows\System\ZUrLTHL.exe
  C:\Windows\System\ZUrLTHL.exe
  2⤵
  PID:9420
- C:\Windows\System\BJURkxw.exe
  C:\Windows\System\BJURkxw.exe
  2⤵
  PID:9436
- C:\Windows\System\DYvBlLV.exe
  C:\Windows\System\DYvBlLV.exe
  2⤵
  PID:9456
- C:\Windows\System\UbDLULV.exe
  C:\Windows\System\UbDLULV.exe
  2⤵
  PID:9472
- C:\Windows\System\TAtOCfY.exe
  C:\Windows\System\TAtOCfY.exe
  2⤵
  PID:9488
- C:\Windows\System\PfNjEZR.exe
  C:\Windows\System\PfNjEZR.exe
  2⤵
  PID:9504
- C:\Windows\System\EPPDggT.exe
  C:\Windows\System\EPPDggT.exe
  2⤵
  PID:9520
- C:\Windows\System\QJyrJPw.exe
  C:\Windows\System\QJyrJPw.exe
  2⤵
  PID:9536
- C:\Windows\System\jAOZzfW.exe
  C:\Windows\System\jAOZzfW.exe
  2⤵
  PID:9552
- C:\Windows\System\CQpoFfS.exe
  C:\Windows\System\CQpoFfS.exe
  2⤵
  PID:9568
- C:\Windows\System\xrgNblo.exe
  C:\Windows\System\xrgNblo.exe
  2⤵
  PID:9584
- C:\Windows\System\AbWxDfn.exe
  C:\Windows\System\AbWxDfn.exe
  2⤵
  PID:9600
- C:\Windows\System\KgZekbM.exe
  C:\Windows\System\KgZekbM.exe
  2⤵
  PID:9616
- C:\Windows\System\PGMVqWk.exe
  C:\Windows\System\PGMVqWk.exe
  2⤵
  PID:9632
- C:\Windows\System\qiOohqd.exe
  C:\Windows\System\qiOohqd.exe
  2⤵
  PID:9648
- C:\Windows\System\zwmhyjx.exe
  C:\Windows\System\zwmhyjx.exe
  2⤵
  PID:9664
- C:\Windows\System\WKtwfmV.exe
  C:\Windows\System\WKtwfmV.exe
  2⤵
  PID:9680
- C:\Windows\System\YWbQNob.exe
  C:\Windows\System\YWbQNob.exe
  2⤵
  PID:9696
- C:\Windows\System\FBauluM.exe
  C:\Windows\System\FBauluM.exe
  2⤵
  PID:9712
- C:\Windows\System\ERhJRJy.exe
  C:\Windows\System\ERhJRJy.exe
  2⤵
  PID:9728
- C:\Windows\System\aPWNyHC.exe
  C:\Windows\System\aPWNyHC.exe
  2⤵
  PID:9744
- C:\Windows\System\BHiCzcE.exe
  C:\Windows\System\BHiCzcE.exe
  2⤵
  PID:9760
- C:\Windows\System\BvqvTgY.exe
  C:\Windows\System\BvqvTgY.exe
  2⤵
  PID:9776
- C:\Windows\System\vrWlTML.exe
  C:\Windows\System\vrWlTML.exe
  2⤵
  PID:9792
- C:\Windows\System\bcCxdmX.exe
  C:\Windows\System\bcCxdmX.exe
  2⤵
  PID:9808
- C:\Windows\System\HfmPEMn.exe
  C:\Windows\System\HfmPEMn.exe
  2⤵
  PID:9824
- C:\Windows\System\ntnZPfE.exe
  C:\Windows\System\ntnZPfE.exe
  2⤵
  PID:9840
- C:\Windows\System\yphTRzl.exe
  C:\Windows\System\yphTRzl.exe
  2⤵
  PID:9856
- C:\Windows\System\YjEuhVq.exe
  C:\Windows\System\YjEuhVq.exe
  2⤵
  PID:9876
- C:\Windows\System\FBOrcaW.exe
  C:\Windows\System\FBOrcaW.exe
  2⤵
  PID:9896
- C:\Windows\System\uenXAiJ.exe
  C:\Windows\System\uenXAiJ.exe
  2⤵
  PID:9912
- C:\Windows\System\ZdjAXPl.exe
  C:\Windows\System\ZdjAXPl.exe
  2⤵
  PID:9928
- C:\Windows\System\GPCWKzr.exe
  C:\Windows\System\GPCWKzr.exe
  2⤵
  PID:9944
- C:\Windows\System\jbdBzxG.exe
  C:\Windows\System\jbdBzxG.exe
  2⤵
  PID:9960
- C:\Windows\System\YMacRjW.exe
  C:\Windows\System\YMacRjW.exe
  2⤵
  PID:9976
- C:\Windows\System\YoxrKja.exe
  C:\Windows\System\YoxrKja.exe
  2⤵
  PID:9992
- C:\Windows\System\iPjZkRC.exe
  C:\Windows\System\iPjZkRC.exe
  2⤵
  PID:10008
- C:\Windows\System\weymXKt.exe
  C:\Windows\System\weymXKt.exe
  2⤵
  PID:10024
- C:\Windows\System\CmoTlya.exe
  C:\Windows\System\CmoTlya.exe
  2⤵
  PID:10040
- C:\Windows\System\AfStRXN.exe
  C:\Windows\System\AfStRXN.exe
  2⤵
  PID:10056
- C:\Windows\System\nLCvMYs.exe
  C:\Windows\System\nLCvMYs.exe
  2⤵
  PID:10072
- C:\Windows\System\atuwOfp.exe
  C:\Windows\System\atuwOfp.exe
  2⤵
  PID:10088
- C:\Windows\System\FfArBok.exe
  C:\Windows\System\FfArBok.exe
  2⤵
  PID:10104
- C:\Windows\System\TfIuZDH.exe
  C:\Windows\System\TfIuZDH.exe
  2⤵
  PID:10120
- C:\Windows\System\cNXgevz.exe
  C:\Windows\System\cNXgevz.exe
  2⤵
  PID:10136
- C:\Windows\System\vwKtqyE.exe
  C:\Windows\System\vwKtqyE.exe
  2⤵
  PID:10152
- C:\Windows\System\AZdhiOA.exe
  C:\Windows\System\AZdhiOA.exe
  2⤵
  PID:10168
- C:\Windows\System\FJWXDTr.exe
  C:\Windows\System\FJWXDTr.exe
  2⤵
  PID:10188
- C:\Windows\System\RhTzJVg.exe
  C:\Windows\System\RhTzJVg.exe
  2⤵
  PID:10204
- C:\Windows\System\bhZTZhT.exe
  C:\Windows\System\bhZTZhT.exe
  2⤵
  PID:10220
- C:\Windows\System\MGmxTQR.exe
  C:\Windows\System\MGmxTQR.exe
  2⤵
  PID:10236
- C:\Windows\System\wEcXzKe.exe
  C:\Windows\System\wEcXzKe.exe
  2⤵
  PID:8448
- C:\Windows\System\HqagSbP.exe
  C:\Windows\System\HqagSbP.exe
  2⤵
  PID:9252
- C:\Windows\System\INzTATN.exe
  C:\Windows\System\INzTATN.exe
  2⤵
  PID:9300
- C:\Windows\System\WXAskCH.exe
  C:\Windows\System\WXAskCH.exe
  2⤵
  PID:8596
- C:\Windows\System\IWxWflt.exe
  C:\Windows\System\IWxWflt.exe
  2⤵
  PID:9316
- C:\Windows\System\FPdeIaZ.exe
  C:\Windows\System\FPdeIaZ.exe
  2⤵
  PID:9380
- C:\Windows\System\bSHqUJH.exe
  C:\Windows\System\bSHqUJH.exe
  2⤵
  PID:9432
- C:\Windows\System\nsruFAZ.exe
  C:\Windows\System\nsruFAZ.exe
  2⤵
  PID:9496
- C:\Windows\System\GuZxYZh.exe
  C:\Windows\System\GuZxYZh.exe
  2⤵
  PID:9512
- C:\Windows\System\hbUkZqd.exe
  C:\Windows\System\hbUkZqd.exe
  2⤵
  PID:9560
- C:\Windows\System\YwcvPrB.exe
  C:\Windows\System\YwcvPrB.exe
  2⤵
  PID:9576
- C:\Windows\System\nreOxHX.exe
  C:\Windows\System\nreOxHX.exe
  2⤵
  PID:9608
- C:\Windows\System\uCiSEJY.exe
  C:\Windows\System\uCiSEJY.exe
  2⤵
  PID:9656
- C:\Windows\System\kieBEuO.exe
  C:\Windows\System\kieBEuO.exe
  2⤵
  PID:9676
- C:\Windows\System\xMEHqzS.exe
  C:\Windows\System\xMEHqzS.exe
  2⤵
  PID:9720
- C:\Windows\System\QPGvbge.exe
  C:\Windows\System\QPGvbge.exe
  2⤵
  PID:9788
- C:\Windows\System\nQQdzRA.exe
  C:\Windows\System\nQQdzRA.exe
  2⤵
  PID:9800
- C:\Windows\System\VStCSKf.exe
  C:\Windows\System\VStCSKf.exe
  2⤵
  PID:9852
- C:\Windows\System\OAvuXkC.exe
  C:\Windows\System\OAvuXkC.exe
  2⤵
  PID:9872
- C:\Windows\System\hyHXBPv.exe
  C:\Windows\System\hyHXBPv.exe
  2⤵
  PID:9920
- C:\Windows\System\HGrgLoY.exe
  C:\Windows\System\HGrgLoY.exe
  2⤵
  PID:9984
- C:\Windows\System\fzZcZws.exe
  C:\Windows\System\fzZcZws.exe
  2⤵
  PID:9968
- C:\Windows\System\SMiWHtX.exe
  C:\Windows\System\SMiWHtX.exe
  2⤵
  PID:10048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BtWZGMC.exe

Filesize
1.7MB

MD5
14aedea9833446cc01d476ba8c2dd29b

SHA1
451f15cb48364a4d687e82908924fb17a7404fea

SHA256
c713cd0b5bb6226fa8995531f620e6ba4d2a4ae6a0d503d30eb631e29c4bf4db

SHA512
59f6e5451829cb4f10dcfe78586e9e9f2b6521a3a54c26cf3f6a49135471592e7a0b966f3af225a5f6da5a9e5d6d96099f97f69ae4826417aaf041d259138c59

Download Submit
C:\Windows\system\CjcFMJc.exe

Filesize
1.7MB

MD5
5c2fd4def0d6ef3d4ce4d11bde20bd8c

SHA1
87e4d58967667177216554c00a616b4e1818a391

SHA256
965cd3660483f8dcf3ab8d20ee728db152dc98e413d37043ca17d582d8d84adb

SHA512
f65896e5636deddd7820a4abfa3648b078fb9983fa068a299949e9a584cf64d745641957a598903c578d8f75b625fa05a336b562d20286edb2f71a99124c3980

Download Submit
C:\Windows\system\FPCqwTA.exe

Filesize
1.7MB

MD5
762103496867acc67988d372a50c59f0

SHA1
b62dcd026a149049b5ef569eed4efa58d04ac142

SHA256
8ff7ffa43bbf5823f824dd8d3697c91d0e7148fb523aaa6e93005ad3ff007602

SHA512
e6c5f96dc617e5bfef771e01bebb8cac39cbd61298f61737e8b02b7daad4a5261b40bb2b8b329b2e04e93637113c26d193bb095aaab944a07cb6dfa53a5e08f4

Download Submit
C:\Windows\system\GFSzUdi.exe

Filesize
1.7MB

MD5
2da5abff8eb6b982b6bf665f1ede3a09

SHA1
1f6b8758534fb10617e9c86223775eeb0d9dd1d3

SHA256
19f372cb8f8d7fc7865903c9ec024ec358c57e382995fc62de4f6ae366ce7aba

SHA512
19e95ed466a1ddeb2ffa7770e64d39214558c2c1c181f1bf7ec594edc83abdf5b54ec74d731e8eca6b8578189ba0b0fad280019bc62efa3b98886937c9a24ab8

Download Submit
C:\Windows\system\KAEoWNi.exe

Filesize
1.7MB

MD5
2ee6e2949cde0a1918c3139800196ae4

SHA1
3daf73a40f9b5db79cf4c504eb523eb3d069054f

SHA256
8bec7edd9064bd173adb6767a77a87a5b6898ca3b00e4f58f2ab0fdb40aa8cfb

SHA512
3ad4f21c36db8ecb9324fad72111274ced862dc65db9d22c7cc5549058c34b2ae4dc7cbf3b3a31d4d891fedb57ba0d0a185750985371c7499a53bf3d290c1900

Download Submit
C:\Windows\system\KRmLRTS.exe

Filesize
1.7MB

MD5
8dabd65de55440dd9e87f631a8f47361

SHA1
c77c9b873a50fd1e6d9be4343a5d62df3d5c52ec

SHA256
0671cb23cd9705f3220addb30065035da93e538c0b6e706aab757e358ebcd50d

SHA512
c62649b0d5c8ce885483ef9f82b8cbbf7f40e71d125b6862afc7edc15e4f2a37494a5ffb8d5a0ea8ffda3b3e55426e01352ae9d94a923eb2bae530a4df5b66c9

Download Submit
C:\Windows\system\MBiZmZy.exe

Filesize
1.7MB

MD5
05eebe66a1bb47169caec84e3270125d

SHA1
b24d8036ecd590c400edbee4a9989eb56d0a123a

SHA256
8d0a3b6ba9cf4ebc9a877900e1f6c5598017d2f5269dc57ab24419ad39dfc172

SHA512
b69ab509a76dc2793623dc07c143df49d73ba651bdd5c7e7eb3dc904132911de8742ced273744463586bcf520f88b212ae01e7e40ec93f6272e1a6ecad3218d6

Download Submit
C:\Windows\system\MRexMEa.exe

Filesize
1.7MB

MD5
26b6fb3fc9264859fd8adafba1a50210

SHA1
ff3fa3ca07fa81b93d142fc6357a84e4da114c5e

SHA256
e69cda45828f08681b85d4dc0025ce55cf9c43e370a864c71aace133c882344e

SHA512
84fcafe589e3f5e0cfc7ad25b08724d02a99a90d452894069ebd89966fab1bf9bdaaa38393b121d0d4f3f6e5bbfea752eab2e1f8b86b10a2bd261ef86e350eb9

Download Submit
C:\Windows\system\MkWJpRG.exe

Filesize
1.7MB

MD5
1dcef82324b717e9aa0a0681fe34bda5

SHA1
090ea0eb8e5b52fb9c93fb10c08fc70efcd10678

SHA256
59bee380bbf0190aa7f0ea41ca7e676387354884d6dbd0eb9f23aaac596967fc

SHA512
d6433ffb902faaab863b72ef43e0a0caba6e07a9f03b373be18690718a50ca3c8d35fd69821ea18e46cfd3be90d0470dd6b96166ff7d66a32e77552dfb386069

Download Submit
C:\Windows\system\NNibHBX.exe

Filesize
1.7MB

MD5
4cc3ffef38b447b700c34b8587206df2

SHA1
bb79195f53a4274d0100274d4c90b6026a10caed

SHA256
75af2c10a062f67e9e87805e8b65109385225e0921891cc774d57c7a2e6e503c

SHA512
0c71000c4903ffc4931cecf2dbbf4301fa105e48ceeb4e8a3108443935eade04f802799a124dd1492732ebb6fc8104efe15e3a92e85a755075e1dc414c4454f5

Download Submit
C:\Windows\system\ORBzlqe.exe

Filesize
1.7MB

MD5
224761efefba2b18504dcccd94f089c5

SHA1
44a08077e9a90acf5fc16adf23c3eef82166381e

SHA256
83a182f2cb5cbf96ef46085221a1b4fd0096fa26038ead9912d4fe3aa0aa376f

SHA512
a8a86dc9b69e45ae1ee0bd42c270d5ea54e9b5e2a8f75beccaf15f59d1e5a2bdb55c9c05a13f60b9b5defe5c6f0431aff4b09b9b0f68bc7afeac451c31c015e2

Download Submit
C:\Windows\system\RWujOrL.exe

Filesize
1.7MB

MD5
96864e453273dc1d159e7b2b8a24de2d

SHA1
aa9afee6e7876be4fd396400165054718fea81db

SHA256
a573941220b7dcae1ee56e061a9021de825bede3dde1c71e7c530bb6ac63c570

SHA512
3497fe4a97c17b6bf9b1977bd1d6a09a72f2120490e5cfc3e43f207729f7e8e6347cc242c462010e91a3ca27856c94bf2e7d4eeb28bb96db35c42141913b619a

Download Submit
C:\Windows\system\SgIBzML.exe

Filesize
1.7MB

MD5
24c5274d836070ee16eca20a1d62aa5c

SHA1
a905ff96b83cbe128f7efb087e9b82ee1160e166

SHA256
2e60bc633c8a2241d9128ff0acb9f91ef669c426601e8e7e7b7553936b81f104

SHA512
5389755f0ec36bc21be3c9bc6ea6b913a8e4eacd89b2e4d5e61ad215da4d7185e7aea20491b9e2c2f7a44dfb91028bc7241e977b138f466764cbed1c47fc02f4

Download Submit
C:\Windows\system\SvMlHcC.exe

Filesize
1.7MB

MD5
9eb5b63baef2003ec9c18ae4be24486c

SHA1
756bd6321cd6a27dd5dbd5dbfca0f5c5592eed23

SHA256
a5208e268ca848424cbed4894e9c6e85aa2ea1a9de55180ef70a5db9182f322f

SHA512
190df0043dc59f04daa67f4fab8dba6f4c96da7f55ee85e10c1235bc48ecff4b64201ff66152a28a9cc38d5948067f91bbd868631338654c5e53ccaa5b314e34

Download Submit
C:\Windows\system\UAxydNG.exe

Filesize
1.7MB

MD5
b4d09691e2b02006139b11f0cb081512

SHA1
d08ca6b29e57191cdd9a3ab38096080949542c19

SHA256
f7a3676f2404da0a82d9489a7d398cc140eeca4bbbac0dbad299a72527d689dd

SHA512
6b2a70d27b04990227c42bc2ee9dc963e557fd019a4ebdf2e08a2a42db83783dba4c7a4e598785331582356bc32e6a73496d8964b63547182039e8b29a317ede

Download Submit
C:\Windows\system\UCOLxmK.exe

Filesize
1.7MB

MD5
1b6a4fa7d82972d471f4ef7b93a81453

SHA1
80a1ed07605e2bf66bceb940a887532e3057b9b7

SHA256
352d9934bee1b19c0fc3356aa3a8bb4ba5aa59d7a93478fe6d96166d4a93cee9

SHA512
3c1eb25c3df03e01d869ca029656c8ddea33b95c5321514a6d49ab77767e06426fdb82b37dacbbbcb4bdb46d52fe4aa6aca5b950beb97d162a5ccafec87a0bc6

Download Submit
C:\Windows\system\WAHyhgI.exe

Filesize
1.7MB

MD5
3c56741b35080918f9fd37229b744932

SHA1
37356c465d946be3f83a7f419068ae9172e20763

SHA256
896e8bd4de9503b0c131d9657d84189eb3915293062f00ffba458fa86871c141

SHA512
947b30bcd34dacea6163867113cf7abbfb9febffb19bd0247c1f16a123764262cb3fa86c5d120a6e94c98abc60ff24ebff8cbd0b88f4b81cedd7e95483e2f0e5

Download Submit
C:\Windows\system\WWneeXF.exe

Filesize
1.7MB

MD5
2385596d2c67a980695c763bf26085fb

SHA1
4dacb4e2ad42957b4dc627b96655c036f01fff0d

SHA256
ff2c7018cf951d918ae7e36a074f0bf196f19b12ca6b93160a4e4b3881ec797c

SHA512
2ede7e2e75c1b41296de1e39f82095977a8aa76225ba511e933af5c25b6cc84a21aced1048761b347b6704dc5f3bcf277e870b4e486f7051f6b57b5befc58f43

Download Submit
C:\Windows\system\WzWSJMR.exe

Filesize
1.7MB

MD5
c5955087c0f9dbad571728bf1d20f35e

SHA1
82328f733cb1b99be727d86e237648f5d150b9b3

SHA256
5c3f82a0e60a965ff97a56cdc3e5db54210195c43c6a18f666a85c2a4b3e741e

SHA512
0ff5f5738fb797c4e946fa7a52a118c3b67aa98c45bb4a281d2f3f801d68f67feccf3c54a137917b3f5ad1e6aa22c005383e5db3677710aa7ea459bc8d7e3621

Download Submit
C:\Windows\system\lVIPMVg.exe

Filesize
1.7MB

MD5
f2472c74827147f63b0c1a0f044c3c04

SHA1
654b19ed506d41b7d143034de33532996efe3e8c

SHA256
0ce86116e9e89bfaaea2f5e43b7b9038fe32ebf9651af128a5f861a9fc085a3c

SHA512
31b76c368d95e19dac820403e6e63947579cd5c6d8abe3fa92107cc9bef59d42ed6893752a37aa589f2dadd50a86e04ca4cdc059b3217d625ce723867ceb5bde

Download Submit
C:\Windows\system\mvZGTdM.exe

Filesize
1.7MB

MD5
ac3609d39dc3c90648f36eb00bf1c540

SHA1
c390135dc3d4aaaa9d88cf5771feec14e737ee2c

SHA256
29e58465970c894f515ff6994b38741135a3b62a9e4fc5a511db2347522efe62

SHA512
9078dcc98b0f67a44843fda5eb3ce0801a125789edce92edf15e86232b96f0faf1b3b165efad0735d9b860c20871520eb4c044c6a223b6c3fb2f02c971ce846b

Download Submit
C:\Windows\system\oeWsZhn.exe

Filesize
1.7MB

MD5
4a8d99be184d79434d84c13c1e79f11f

SHA1
909e15934e4ada1f097c3fa8580439a45d96a27f

SHA256
6027e404f5494f0edcf2fa991d55389dbc977d7fbb209f5146ce7779b5062bf0

SHA512
53876c1e0e805b5ee0481ec0ddc9b0323f465df33816b851427cd461a5c7dcdafdf06c34713396114e751d6a33f026e4edc9b54936ff9ffff4e73a4fe0bc81cb

Download Submit
C:\Windows\system\psjShbR.exe

Filesize
1.7MB

MD5
d1af36a1f4ab19396191545393c42c3b

SHA1
37b0dd8b3ff11eb5c4ac45d82e27b68f74703bff

SHA256
f24b31b65da819a0d36f84848a81453cb1aec38b222b6c9e1725e330ba23b339

SHA512
0cc396dde0dc8209ec34922c8de5007ca5d6161b3d540fa9ad7621139680e9cb46102222650d614d78dbdc6d52fde3f080d247472e1b77c38dbc4ba0893b1b51

Download Submit
C:\Windows\system\rHfumnM.exe

Filesize
1.7MB

MD5
f43ad47c2e3d6608140d5f7bcb645988

SHA1
19a632129e50dd9d4f634bdc2d74c98ff9207e51

SHA256
66e4b837d75774c659bcc0847616a9e47886442b281b1a57f84108bd1a96780b

SHA512
c69e9a53b5f3f0e223ab40253958589d19333ce05d2563c0b85d1eee7932e720585b07d37c4c4f4aa8fbc23d2a698ecf50b87bcff18beb404de4e81afc0f7512

Download Submit
C:\Windows\system\rkOfLkE.exe

Filesize
1.7MB

MD5
4d4b3b7618792948d66d6ac10cd2ef2f

SHA1
248519c63b2531a41e468bfbcc1226b99aaf24cd

SHA256
3c400ad80dfcae7148113a2deea6d01978321f82970344029fe8a5277c290156

SHA512
73ebc84a9043ec7804b72726091e31cf38f8b1202ac8e6e56b2aefd15d7db53e0f18608b96e6284da1eacca18db31345629de7f0c1864b989dab7449645d86a7

Download Submit
C:\Windows\system\ttuMTRG.exe

Filesize
1.7MB

MD5
1debb36b5ab83572adcf608bf7c9101c

SHA1
87e08db01cca0cd09a3062451cdd30e645fd8c65

SHA256
db6a789624be28f176f307d0b46d43ed46f27f144f9b1cdbc7618d37b6286c77

SHA512
240b0f6aa87d27cdf59d8207a89875865c6cc1fe9c5dd47b0522fa8ab9d08348c47356415caf4585be83f7cbd4cfb85126d63ad150248148a4653024ca8bf595

Download Submit
C:\Windows\system\wIKJAqC.exe

Filesize
1.7MB

MD5
710660fddd1226268cfdf443689176eb

SHA1
0da340a96396fa52ae284a9e843b788ce795d623

SHA256
39d46841b0ea33b0d8678280dc43c18945d24231db51973827759dc60ceccc7c

SHA512
11b99dbee0883caabb4dc874bea1b19d13a67fcfabdbc8d7cc252faaa6890181738f788d57b787a6a0286cc8168f7377a1d3fa8f6fd96a914eb4f37cb3010983

Download Submit
C:\Windows\system\wLfMaRQ.exe

Filesize
1.7MB

MD5
a76c1a4bd39d292d618d233c03d14f30

SHA1
a84c32822814e1c0e85b5f1bd8320a1fb6dd787f

SHA256
0d8f8f81ed1c5797d95fe69bf259ba8022a11e748a955b780596a2f9666cad66

SHA512
0155b824e2fb224e36885b14ea6b79d4041647d471a6f1f0c18025159a505f1bf0982e98aa399747f15a2b80da8117ca00028cd28ade6b78cc1f3ac3681fb3c4

Download Submit
C:\Windows\system\zTCDUBO.exe

Filesize
1.7MB

MD5
8ba92a9873aa013d0ab40778e0a652fd

SHA1
063c245e77de1d06309cf3ce50477a53e3e69b8d

SHA256
a5f42ee2da4214737703f8ab48444b4a44e7d93f4e752aa1b9b13ba565fd5f67

SHA512
f1999f72557eccf5abf85fcdd412ec379ebedd0ed54d15e7cd28ab8aadda5d0456ca5eebceebefabfa1f3a9764a5f47f48b3fba1d3bbe792f0e0d4b389496662

Download Submit
\Windows\system\COVBLaA.exe

Filesize
1.7MB

MD5
2e46a2f1520f77374886fa4b25126274

SHA1
dd80cd32064acca4a4581d66d9d4e664fa6f89f7

SHA256
dac15fe32e99343adce6c75457efc6a6c23292ce9ba37a99e3c3ee85784075b6

SHA512
f19d73e7368dc90d3b29653bcfbb88ea49f1ada18d53e6fd4817794e4b7546064ed07cd7134a10f0d4ea4ab81bf4787b41f010b312711732b579cae420743b8d

Download Submit
\Windows\system\RdphxVs.exe

Filesize
1.7MB

MD5
b2df2e1e2245bdecd88884f502fd6431

SHA1
0946867555e862b1cb76eec057f0d74eb149dccb

SHA256
d64bc44557c1aa240b4335e59b3e7d6e924a1668e048c93e673740b5c697ed24

SHA512
4d0e548acf67262a6a6412e6ebe9e51f472cce8dc772a7c2418abad0aeca3603f73a12c1ca71c9f56d6ecb644fdc530e3b1d3dd34aa440f491b1970abd68e4b3

Download Submit
\Windows\system\YNoKvfL.exe

Filesize
1.7MB

MD5
a89732e720d89e19b19b8687facb04ef

SHA1
66bc01db67a0b55f817fcb977a4d64b9e09f47b8

SHA256
e980e50fec1ed6c2de73659ca78dd62d3c6c2b706d3826253e5eff3a15da9ef3

SHA512
d8bf54c1032861973d965a02677cb5ebb48e69c7fe8b34b26bd304c84660443e42986c18fbdebecee44b45462267d1b3e9ecaca221023e97908433484471e261

Download Submit
memory/1660-73-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/1660-2011-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/1972-72-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/1972-31-0x000000013F100000-0x000000013F4F2000-memory.dmp

Filesize
3.9MB

Download
memory/1972-284-0x000000013F560000-0x000000013F952000-memory.dmp

Filesize
3.9MB

Download
memory/1972-361-0x0000000002FA0000-0x0000000003392000-memory.dmp

Filesize
3.9MB

Download
memory/1972-62-0x0000000002FA0000-0x0000000003392000-memory.dmp

Filesize
3.9MB

Download
memory/1972-426-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/1972-167-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/1972-103-0x0000000002FA0000-0x0000000003392000-memory.dmp

Filesize
3.9MB

Download
memory/1972-1-0x00000000003F0000-0x0000000000400000-memory.dmp

Filesize
64KB

Download
memory/1972-7-0x0000000002A70000-0x0000000002E62000-memory.dmp

Filesize
3.9MB

Download
memory/1972-0-0x000000013F560000-0x000000013F952000-memory.dmp

Filesize
3.9MB

Download
memory/1972-80-0x000000013F160000-0x000000013F552000-memory.dmp

Filesize
3.9MB

Download
memory/1972-48-0x0000000002A70000-0x0000000002E62000-memory.dmp

Filesize
3.9MB

Download
memory/1972-43-0x000000013F0A0000-0x000000013F492000-memory.dmp

Filesize
3.9MB

Download
memory/1972-95-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/1972-88-0x0000000002FA0000-0x0000000003392000-memory.dmp

Filesize
3.9MB

Download
memory/1972-288-0x0000000002FA0000-0x0000000003392000-memory.dmp

Filesize
3.9MB

Download
memory/1972-52-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/1972-36-0x0000000002FA0000-0x0000000003392000-memory.dmp

Filesize
3.9MB

Download
memory/1972-105-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/1972-19-0x0000000002A70000-0x0000000002E62000-memory.dmp

Filesize
3.9MB

Download
memory/1972-47-0x000000013F560000-0x000000013F952000-memory.dmp

Filesize
3.9MB

Download
memory/2056-104-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/2056-2010-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/2056-63-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/2296-2006-0x000000013F720000-0x000000013FB12000-memory.dmp

Filesize
3.9MB

Download
memory/2296-9-0x000000013F720000-0x000000013FB12000-memory.dmp

Filesize
3.9MB

Download
memory/2296-56-0x000000013F720000-0x000000013FB12000-memory.dmp

Filesize
3.9MB

Download
memory/2356-96-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/2356-2015-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/2392-81-0x000000013F160000-0x000000013F552000-memory.dmp

Filesize
3.9MB

Download
memory/2392-2014-0x000000013F160000-0x000000013F552000-memory.dmp

Filesize
3.9MB

Download
memory/2732-30-0x000007FEF6080000-0x000007FEF6A1D000-memory.dmp

Filesize
9.6MB

Download
memory/2732-54-0x0000000002050000-0x0000000002058000-memory.dmp

Filesize
32KB

Download
memory/2732-22-0x000007FEF633E000-0x000007FEF633F000-memory.dmp

Filesize
4KB

Download
memory/2732-61-0x000007FEF6080000-0x000007FEF6A1D000-memory.dmp

Filesize
9.6MB

Download
memory/2732-60-0x0000000002970000-0x00000000029F0000-memory.dmp

Filesize
512KB

Download
memory/2732-21-0x0000000002970000-0x00000000029F0000-memory.dmp

Filesize
512KB

Download
memory/2732-46-0x000000001B280000-0x000000001B562000-memory.dmp

Filesize
2.9MB

Download
memory/2732-28-0x000007FEF6080000-0x000007FEF6A1D000-memory.dmp

Filesize
9.6MB

Download
memory/2732-501-0x000007FEF6080000-0x000007FEF6A1D000-memory.dmp

Filesize
9.6MB

Download
memory/2732-49-0x000007FEF6080000-0x000007FEF6A1D000-memory.dmp

Filesize
9.6MB

Download
memory/2736-2013-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/2736-89-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/2808-2012-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/2808-97-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/2848-20-0x000000013F8D0000-0x000000013FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/2848-2016-0x000000013F8D0000-0x000000013FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/2868-29-0x000000013F100000-0x000000013F4F2000-memory.dmp

Filesize
3.9MB

Download
memory/2868-2008-0x000000013F100000-0x000000013F4F2000-memory.dmp

Filesize
3.9MB

Download
memory/2924-2009-0x000000013F480000-0x000000013F872000-memory.dmp

Filesize
3.9MB

Download
memory/2924-37-0x000000013F480000-0x000000013F872000-memory.dmp

Filesize
3.9MB

Download
memory/2924-74-0x000000013F480000-0x000000013F872000-memory.dmp

Filesize
3.9MB

Download
memory/2956-45-0x000000013F0A0000-0x000000013F492000-memory.dmp

Filesize
3.9MB

Download
memory/2956-82-0x000000013F0A0000-0x000000013F492000-memory.dmp

Filesize
3.9MB

Download
memory/2956-2007-0x000000013F0A0000-0x000000013F492000-memory.dmp

Filesize
3.9MB

Download
memory/3044-106-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/3044-2017-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download