xmrig | 9a973acadcedb870808cd6357a99853107e26d70d4a65fd388ecde2de3e1ed0d

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 08:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e9f2c1bf066ba691b543a85501ac0a50N.exe
Size

1.6MB
MD5

e9f2c1bf066ba691b543a85501ac0a50
SHA1

f9a23bab941d81aa4dfb6fbbd6706cc9690dcd6f
SHA256

9a973acadcedb870808cd6357a99853107e26d70d4a65fd388ecde2de3e1ed0d
SHA512

17beda123841920328ccf0fb22c6615d83003034e313d1c5b6e61253ed75ed164f0bbe718ec94815545553d86ad844adabdf4faed319f3044553878f23621933
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYKpGncHBN/VPwLENt:Lz071uv4BPMkibTIA5CJzn

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 18 IoCs

miner

resource	yara_rule
behavioral1/memory/2904-252-0x000000013FBE0000-0x000000013FFD2000-memory.dmp	xmrig
behavioral1/memory/2184-501-0x000000013FE90000-0x0000000140282000-memory.dmp	xmrig
behavioral1/memory/2648-781-0x000000013F200000-0x000000013F5F2000-memory.dmp	xmrig
behavioral1/memory/3052-578-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	xmrig
behavioral1/memory/2268-250-0x000000013F330000-0x000000013F722000-memory.dmp	xmrig
behavioral1/memory/2492-97-0x000000013FDA0000-0x0000000140192000-memory.dmp	xmrig
behavioral1/memory/2668-96-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	xmrig
behavioral1/memory/2636-95-0x000000013FEA0000-0x0000000140292000-memory.dmp	xmrig
behavioral1/memory/2216-94-0x000000013F220000-0x000000013F612000-memory.dmp	xmrig
behavioral1/memory/2236-88-0x000000013F1B0000-0x000000013F5A2000-memory.dmp	xmrig
behavioral1/memory/2900-84-0x000000013FD00000-0x00000001400F2000-memory.dmp	xmrig
behavioral1/memory/3052-6843-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	xmrig
behavioral1/memory/2236-6854-0x000000013F1B0000-0x000000013F5A2000-memory.dmp	xmrig
behavioral1/memory/2904-6857-0x000000013FBE0000-0x000000013FFD2000-memory.dmp	xmrig
behavioral1/memory/2668-6892-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	xmrig
behavioral1/memory/2636-6888-0x000000013FEA0000-0x0000000140292000-memory.dmp	xmrig
behavioral1/memory/2184-6882-0x000000013FE90000-0x0000000140282000-memory.dmp	xmrig
behavioral1/memory/2648-6885-0x000000013F200000-0x000000013F5F2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2208	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2236	VHYtkzG.exe
2216	GpIOzKf.exe
2492	pDKzJyk.exe
2268	EnXHAXp.exe
2904	EHUCdPX.exe
2184	nOOXyKQ.exe
3052	VeGQpWf.exe
2648	VOwAKFo.exe
2636	hQrYxJE.exe
2668	yQbFTMm.exe
2688	wAUiALn.exe
2776	GxObewV.exe
2632	QySyoSV.exe
2124	ESqlHtt.exe
3004	LCpuohx.exe
2992	terGqyf.exe
2856	LjPifbY.exe
1536	QUuCMdQ.exe
2600	qXIgatR.exe
1532	AqceTPl.exe
1692	RZoQQqX.exe
1656	VkUuxZN.exe
2076	PecbDHR.exe
2084	baeUUfK.exe
2052	jAkelUA.exe
2056	RclfBmK.exe
632	fmWZicX.exe
1624	AtjuVYj.exe
1812	ibsAQIy.exe
1148	DRUJYsl.exe
1560	GeDmVVC.exe
2140	XelPylW.exe
780	bHMlpOp.exe
268	KkrymiL.exe
1296	GnWkxFP.exe
900	FiKyizT.exe
2156	zyBNxmN.exe
1316	yWOCZvo.exe
2696	ElGyYCe.exe
560	yPrURgj.exe
1748	gQuTdGE.exe
1780	fbmEsyB.exe
1616	ruqSNGj.exe
2228	HpjaQDS.exe
2396	JstgWhW.exe
2892	WqtBsGy.exe
2980	dMbeXdL.exe
2956	luugyRG.exe
1172	npEwumj.exe
2932	gXlGURp.exe
1356	jOVqbtx.exe
2188	dqlNGga.exe
2132	urVRGLo.exe
2192	xfuuqam.exe
1276	mfCTfke.exe
1556	YFDbfxv.exe
1516	MHXUfOW.exe
1732	peRMgCC.exe
2496	EFVZHoJ.exe
2452	AkMRKdQ.exe
2844	JzUFpIU.exe
3096	jusCdEZ.exe
3132	nTvyAuF.exe
3168	pRhMatV.exe

Loads dropped DLL 64 IoCs

pid	Process
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
2900	e9f2c1bf066ba691b543a85501ac0a50N.exe

UPX packed file 60 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2900-0-0x000000013FD00000-0x00000001400F2000-memory.dmp	upx
behavioral1/files/0x000700000001211b-3.dat	upx
behavioral1/files/0x0006000000019315-17.dat	upx
behavioral1/files/0x000700000001925d-10.dat	upx
behavioral1/memory/2184-41-0x000000013FE90000-0x0000000140282000-memory.dmp	upx
behavioral1/files/0x0008000000019361-44.dat	upx
behavioral1/files/0x0007000000004e74-48.dat	upx
behavioral1/files/0x00060000000195a6-53.dat	upx
behavioral1/files/0x0005000000019620-67.dat	upx
behavioral1/files/0x00050000000195e5-56.dat	upx
behavioral1/files/0x000500000001967e-134.dat	upx
behavioral1/files/0x0005000000019994-146.dat	upx
behavioral1/memory/2904-252-0x000000013FBE0000-0x000000013FFD2000-memory.dmp	upx
behavioral1/memory/2184-501-0x000000013FE90000-0x0000000140282000-memory.dmp	upx
behavioral1/memory/2648-781-0x000000013F200000-0x000000013F5F2000-memory.dmp	upx
behavioral1/memory/3052-578-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	upx
behavioral1/files/0x0005000000019dd0-185.dat	upx
behavioral1/files/0x0005000000019d5f-176.dat	upx
behavioral1/memory/2268-250-0x000000013F330000-0x000000013F722000-memory.dmp	upx
behavioral1/files/0x0005000000019c6b-170.dat	upx
behavioral1/files/0x0005000000019c51-161.dat	upx
behavioral1/files/0x00050000000196bf-140.dat	upx
behavioral1/files/0x0005000000019fb7-190.dat	upx
behavioral1/files/0x0005000000019dc6-183.dat	upx
behavioral1/files/0x0005000000019d3c-174.dat	upx
behavioral1/files/0x0005000000019c53-165.dat	upx
behavioral1/files/0x0005000000019c50-155.dat	upx
behavioral1/files/0x0005000000019702-145.dat	upx
behavioral1/files/0x000500000001963a-131.dat	upx
behavioral1/files/0x0005000000019628-121.dat	upx
behavioral1/files/0x000500000001962a-125.dat	upx
behavioral1/files/0x0005000000019626-115.dat	upx
behavioral1/files/0x0005000000019624-111.dat	upx
behavioral1/files/0x0005000000019621-101.dat	upx
behavioral1/files/0x000500000001961e-99.dat	upx
behavioral1/memory/2492-97-0x000000013FDA0000-0x0000000140192000-memory.dmp	upx
behavioral1/memory/2668-96-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	upx
behavioral1/memory/2636-95-0x000000013FEA0000-0x0000000140292000-memory.dmp	upx
behavioral1/memory/2216-94-0x000000013F220000-0x000000013F612000-memory.dmp	upx
behavioral1/memory/2236-88-0x000000013F1B0000-0x000000013F5A2000-memory.dmp	upx
behavioral1/files/0x000500000001961c-86.dat	upx
behavioral1/memory/2900-84-0x000000013FD00000-0x00000001400F2000-memory.dmp	upx
behavioral1/files/0x0005000000019622-105.dat	upx
behavioral1/memory/2648-62-0x000000013F200000-0x000000013F5F2000-memory.dmp	upx
behavioral1/memory/3052-47-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	upx
behavioral1/files/0x000600000001934d-40.dat	upx
behavioral1/memory/2904-39-0x000000013FBE0000-0x000000013FFD2000-memory.dmp	upx
behavioral1/memory/2268-38-0x000000013F330000-0x000000013F722000-memory.dmp	upx
behavioral1/memory/2492-31-0x000000013FDA0000-0x0000000140192000-memory.dmp	upx
behavioral1/memory/2216-29-0x000000013F220000-0x000000013F612000-memory.dmp	upx
behavioral1/files/0x000600000001926b-26.dat	upx
behavioral1/memory/2236-24-0x000000013F1B0000-0x000000013F5A2000-memory.dmp	upx
behavioral1/files/0x0009000000019259-21.dat	upx
behavioral1/memory/3052-6843-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	upx
behavioral1/memory/2236-6854-0x000000013F1B0000-0x000000013F5A2000-memory.dmp	upx
behavioral1/memory/2904-6857-0x000000013FBE0000-0x000000013FFD2000-memory.dmp	upx
behavioral1/memory/2668-6892-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	upx
behavioral1/memory/2636-6888-0x000000013FEA0000-0x0000000140292000-memory.dmp	upx
behavioral1/memory/2184-6882-0x000000013FE90000-0x0000000140282000-memory.dmp	upx
behavioral1/memory/2648-6885-0x000000013F200000-0x000000013F5F2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\wLAEVrW.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\faDLxsN.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\gGTJFzc.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\ULgemRo.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\ImXtlTe.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\ggoLfpb.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\znuQscB.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\VFahujw.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\icWvsOB.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\KbWYjdI.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\vxZJmZQ.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\czoGuWH.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\WPIYwNE.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\YrTtYyJ.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\WRqUstW.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\SpDnKzB.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\FcisPDN.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\mVWbzTP.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\VySSCAO.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\RpJptfm.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\rcGVzVL.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\TWGwmUL.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\lVknEif.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\ISBPIoq.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\GwTjxiA.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\PXGhbNo.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\xdVDlsC.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\kfSVbxX.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\zwwZwPy.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\nASITKW.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\QJEFEAM.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\kXVnDrp.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\mEayIVS.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\xYMiaIG.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\MlUowep.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\yfsTfvF.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\zhdpBKA.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\uRdMNyb.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\CIFTTZM.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\lcngOVq.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\zQcDMWr.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\PBYbJYI.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\BxBTGdb.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\WtdZnwu.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\YeyPdLW.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\KKoDWGH.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\zaUxNst.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\jPjxHyz.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\udDUYHJ.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\AGsWHxe.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\VQBRYau.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\nXZEMIL.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\QsWWATD.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\hejNPBU.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\QjPAgmh.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\NYEChIA.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\dLBShwD.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\AnUqnWw.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\vBNllwx.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\ZCMglHc.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\TJVPVnk.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\SelnOpD.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\ITrvTcs.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe
File created	C:\Windows\System\bOwxLZn.exe	e9f2c1bf066ba691b543a85501ac0a50N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2208	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
Token: SeLockMemoryPrivilege	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe
Token: SeDebugPrivilege	2208	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 2208	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	31
PID 2900 wrote to memory of 2208	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	31
PID 2900 wrote to memory of 2208	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	31
PID 2900 wrote to memory of 2236	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	32
PID 2900 wrote to memory of 2236	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	32
PID 2900 wrote to memory of 2236	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	32
PID 2900 wrote to memory of 2216	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	33
PID 2900 wrote to memory of 2216	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	33
PID 2900 wrote to memory of 2216	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	33
PID 2900 wrote to memory of 2268	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	34
PID 2900 wrote to memory of 2268	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	34
PID 2900 wrote to memory of 2268	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	34
PID 2900 wrote to memory of 2492	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	35
PID 2900 wrote to memory of 2492	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	35
PID 2900 wrote to memory of 2492	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	35
PID 2900 wrote to memory of 2904	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	36
PID 2900 wrote to memory of 2904	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	36
PID 2900 wrote to memory of 2904	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	36
PID 2900 wrote to memory of 2184	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	37
PID 2900 wrote to memory of 2184	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	37
PID 2900 wrote to memory of 2184	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	37
PID 2900 wrote to memory of 3052	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	38
PID 2900 wrote to memory of 3052	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	38
PID 2900 wrote to memory of 3052	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	38
PID 2900 wrote to memory of 2648	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	39
PID 2900 wrote to memory of 2648	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	39
PID 2900 wrote to memory of 2648	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	39
PID 2900 wrote to memory of 2636	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	40
PID 2900 wrote to memory of 2636	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	40
PID 2900 wrote to memory of 2636	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	40
PID 2900 wrote to memory of 2776	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	41
PID 2900 wrote to memory of 2776	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	41
PID 2900 wrote to memory of 2776	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	41
PID 2900 wrote to memory of 2668	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	42
PID 2900 wrote to memory of 2668	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	42
PID 2900 wrote to memory of 2668	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	42
PID 2900 wrote to memory of 2632	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	43
PID 2900 wrote to memory of 2632	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	43
PID 2900 wrote to memory of 2632	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	43
PID 2900 wrote to memory of 2688	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	44
PID 2900 wrote to memory of 2688	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	44
PID 2900 wrote to memory of 2688	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	44
PID 2900 wrote to memory of 2124	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	45
PID 2900 wrote to memory of 2124	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	45
PID 2900 wrote to memory of 2124	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	45
PID 2900 wrote to memory of 3004	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	46
PID 2900 wrote to memory of 3004	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	46
PID 2900 wrote to memory of 3004	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	46
PID 2900 wrote to memory of 2992	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	47
PID 2900 wrote to memory of 2992	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	47
PID 2900 wrote to memory of 2992	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	47
PID 2900 wrote to memory of 2856	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	48
PID 2900 wrote to memory of 2856	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	48
PID 2900 wrote to memory of 2856	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	48
PID 2900 wrote to memory of 1536	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	49
PID 2900 wrote to memory of 1536	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	49
PID 2900 wrote to memory of 1536	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	49
PID 2900 wrote to memory of 2600	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	50
PID 2900 wrote to memory of 2600	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	50
PID 2900 wrote to memory of 2600	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	50
PID 2900 wrote to memory of 1532	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	51
PID 2900 wrote to memory of 1532	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	51
PID 2900 wrote to memory of 1532	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	51
PID 2900 wrote to memory of 1692	2900	e9f2c1bf066ba691b543a85501ac0a50N.exe	52

C:\Users\Admin\AppData\Local\Temp\e9f2c1bf066ba691b543a85501ac0a50N.exe
"C:\Users\Admin\AppData\Local\Temp\e9f2c1bf066ba691b543a85501ac0a50N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2208
- C:\Windows\System\VHYtkzG.exe
  C:\Windows\System\VHYtkzG.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\GpIOzKf.exe
  C:\Windows\System\GpIOzKf.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\EnXHAXp.exe
  C:\Windows\System\EnXHAXp.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\pDKzJyk.exe
  C:\Windows\System\pDKzJyk.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\EHUCdPX.exe
  C:\Windows\System\EHUCdPX.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\nOOXyKQ.exe
  C:\Windows\System\nOOXyKQ.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\VeGQpWf.exe
  C:\Windows\System\VeGQpWf.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\VOwAKFo.exe
  C:\Windows\System\VOwAKFo.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\hQrYxJE.exe
  C:\Windows\System\hQrYxJE.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\GxObewV.exe
  C:\Windows\System\GxObewV.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\yQbFTMm.exe
  C:\Windows\System\yQbFTMm.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\QySyoSV.exe
  C:\Windows\System\QySyoSV.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\wAUiALn.exe
  C:\Windows\System\wAUiALn.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\ESqlHtt.exe
  C:\Windows\System\ESqlHtt.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\LCpuohx.exe
  C:\Windows\System\LCpuohx.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\terGqyf.exe
  C:\Windows\System\terGqyf.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\LjPifbY.exe
  C:\Windows\System\LjPifbY.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\QUuCMdQ.exe
  C:\Windows\System\QUuCMdQ.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\qXIgatR.exe
  C:\Windows\System\qXIgatR.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\AqceTPl.exe
  C:\Windows\System\AqceTPl.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\RZoQQqX.exe
  C:\Windows\System\RZoQQqX.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\VkUuxZN.exe
  C:\Windows\System\VkUuxZN.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\PecbDHR.exe
  C:\Windows\System\PecbDHR.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\baeUUfK.exe
  C:\Windows\System\baeUUfK.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\jAkelUA.exe
  C:\Windows\System\jAkelUA.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\RclfBmK.exe
  C:\Windows\System\RclfBmK.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\fmWZicX.exe
  C:\Windows\System\fmWZicX.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\AtjuVYj.exe
  C:\Windows\System\AtjuVYj.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\ibsAQIy.exe
  C:\Windows\System\ibsAQIy.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\KkrymiL.exe
  C:\Windows\System\KkrymiL.exe
  2⤵
  - Executes dropped EXE
  PID:268
- C:\Windows\System\DRUJYsl.exe
  C:\Windows\System\DRUJYsl.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\FiKyizT.exe
  C:\Windows\System\FiKyizT.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\GeDmVVC.exe
  C:\Windows\System\GeDmVVC.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\yPrURgj.exe
  C:\Windows\System\yPrURgj.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\XelPylW.exe
  C:\Windows\System\XelPylW.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\fbmEsyB.exe
  C:\Windows\System\fbmEsyB.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\bHMlpOp.exe
  C:\Windows\System\bHMlpOp.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\JstgWhW.exe
  C:\Windows\System\JstgWhW.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\GnWkxFP.exe
  C:\Windows\System\GnWkxFP.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\npEwumj.exe
  C:\Windows\System\npEwumj.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\zyBNxmN.exe
  C:\Windows\System\zyBNxmN.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\dqlNGga.exe
  C:\Windows\System\dqlNGga.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\yWOCZvo.exe
  C:\Windows\System\yWOCZvo.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\mfCTfke.exe
  C:\Windows\System\mfCTfke.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\ElGyYCe.exe
  C:\Windows\System\ElGyYCe.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\peRMgCC.exe
  C:\Windows\System\peRMgCC.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\gQuTdGE.exe
  C:\Windows\System\gQuTdGE.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\AkMRKdQ.exe
  C:\Windows\System\AkMRKdQ.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\ruqSNGj.exe
  C:\Windows\System\ruqSNGj.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\SoYxhxA.exe
  C:\Windows\System\SoYxhxA.exe
  2⤵
  PID:1612
- C:\Windows\System\HpjaQDS.exe
  C:\Windows\System\HpjaQDS.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\qKZKnNC.exe
  C:\Windows\System\qKZKnNC.exe
  2⤵
  PID:2176
- C:\Windows\System\WqtBsGy.exe
  C:\Windows\System\WqtBsGy.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\daGhSQD.exe
  C:\Windows\System\daGhSQD.exe
  2⤵
  PID:2748
- C:\Windows\System\dMbeXdL.exe
  C:\Windows\System\dMbeXdL.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\lZRKrjx.exe
  C:\Windows\System\lZRKrjx.exe
  2⤵
  PID:1636
- C:\Windows\System\luugyRG.exe
  C:\Windows\System\luugyRG.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\mFViFvs.exe
  C:\Windows\System\mFViFvs.exe
  2⤵
  PID:2212
- C:\Windows\System\gXlGURp.exe
  C:\Windows\System\gXlGURp.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\oILAZFc.exe
  C:\Windows\System\oILAZFc.exe
  2⤵
  PID:2664
- C:\Windows\System\jOVqbtx.exe
  C:\Windows\System\jOVqbtx.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\oxwIXJm.exe
  C:\Windows\System\oxwIXJm.exe
  2⤵
  PID:1028
- C:\Windows\System\urVRGLo.exe
  C:\Windows\System\urVRGLo.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\WtdZnwu.exe
  C:\Windows\System\WtdZnwu.exe
  2⤵
  PID:1628
- C:\Windows\System\xfuuqam.exe
  C:\Windows\System\xfuuqam.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\VFahujw.exe
  C:\Windows\System\VFahujw.exe
  2⤵
  PID:1784
- C:\Windows\System\YFDbfxv.exe
  C:\Windows\System\YFDbfxv.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\XoDecxh.exe
  C:\Windows\System\XoDecxh.exe
  2⤵
  PID:1500
- C:\Windows\System\MHXUfOW.exe
  C:\Windows\System\MHXUfOW.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\uAPWuPx.exe
  C:\Windows\System\uAPWuPx.exe
  2⤵
  PID:2372
- C:\Windows\System\EFVZHoJ.exe
  C:\Windows\System\EFVZHoJ.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\ItePbEs.exe
  C:\Windows\System\ItePbEs.exe
  2⤵
  PID:1976
- C:\Windows\System\JzUFpIU.exe
  C:\Windows\System\JzUFpIU.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\gBKdrrK.exe
  C:\Windows\System\gBKdrrK.exe
  2⤵
  PID:3080
- C:\Windows\System\jusCdEZ.exe
  C:\Windows\System\jusCdEZ.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\pUcIDwO.exe
  C:\Windows\System\pUcIDwO.exe
  2⤵
  PID:3112
- C:\Windows\System\nTvyAuF.exe
  C:\Windows\System\nTvyAuF.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\OttPAxE.exe
  C:\Windows\System\OttPAxE.exe
  2⤵
  PID:3148
- C:\Windows\System\pRhMatV.exe
  C:\Windows\System\pRhMatV.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\WKDBbQT.exe
  C:\Windows\System\WKDBbQT.exe
  2⤵
  PID:3184
- C:\Windows\System\DxCyEDF.exe
  C:\Windows\System\DxCyEDF.exe
  2⤵
  PID:3200
- C:\Windows\System\MqwyoeX.exe
  C:\Windows\System\MqwyoeX.exe
  2⤵
  PID:3216
- C:\Windows\System\FFPnHZC.exe
  C:\Windows\System\FFPnHZC.exe
  2⤵
  PID:3244
- C:\Windows\System\wOoqMNt.exe
  C:\Windows\System\wOoqMNt.exe
  2⤵
  PID:3260
- C:\Windows\System\oEffpbm.exe
  C:\Windows\System\oEffpbm.exe
  2⤵
  PID:3276
- C:\Windows\System\KgVEker.exe
  C:\Windows\System\KgVEker.exe
  2⤵
  PID:3292
- C:\Windows\System\zkpMOoq.exe
  C:\Windows\System\zkpMOoq.exe
  2⤵
  PID:3308
- C:\Windows\System\lRVcVWo.exe
  C:\Windows\System\lRVcVWo.exe
  2⤵
  PID:3324
- C:\Windows\System\zHyKuFG.exe
  C:\Windows\System\zHyKuFG.exe
  2⤵
  PID:3348
- C:\Windows\System\YmIPGFK.exe
  C:\Windows\System\YmIPGFK.exe
  2⤵
  PID:3368
- C:\Windows\System\pSRJlZd.exe
  C:\Windows\System\pSRJlZd.exe
  2⤵
  PID:3388
- C:\Windows\System\oXKcYou.exe
  C:\Windows\System\oXKcYou.exe
  2⤵
  PID:3404
- C:\Windows\System\VaAhPXe.exe
  C:\Windows\System\VaAhPXe.exe
  2⤵
  PID:3420
- C:\Windows\System\LuAbgHc.exe
  C:\Windows\System\LuAbgHc.exe
  2⤵
  PID:3440
- C:\Windows\System\HbhHiyi.exe
  C:\Windows\System\HbhHiyi.exe
  2⤵
  PID:3460
- C:\Windows\System\QOyYbrf.exe
  C:\Windows\System\QOyYbrf.exe
  2⤵
  PID:3476
- C:\Windows\System\WJsogIT.exe
  C:\Windows\System\WJsogIT.exe
  2⤵
  PID:3492
- C:\Windows\System\vLUwTGW.exe
  C:\Windows\System\vLUwTGW.exe
  2⤵
  PID:3512
- C:\Windows\System\tUZXspJ.exe
  C:\Windows\System\tUZXspJ.exe
  2⤵
  PID:3532
- C:\Windows\System\hebHktW.exe
  C:\Windows\System\hebHktW.exe
  2⤵
  PID:3548
- C:\Windows\System\bdhjrzK.exe
  C:\Windows\System\bdhjrzK.exe
  2⤵
  PID:3568
- C:\Windows\System\MlJWnRn.exe
  C:\Windows\System\MlJWnRn.exe
  2⤵
  PID:3584
- C:\Windows\System\gbjPjer.exe
  C:\Windows\System\gbjPjer.exe
  2⤵
  PID:3600
- C:\Windows\System\Lfxkqqk.exe
  C:\Windows\System\Lfxkqqk.exe
  2⤵
  PID:3620
- C:\Windows\System\GajUFkH.exe
  C:\Windows\System\GajUFkH.exe
  2⤵
  PID:3640
- C:\Windows\System\vVYOTaC.exe
  C:\Windows\System\vVYOTaC.exe
  2⤵
  PID:3656
- C:\Windows\System\uuBaLae.exe
  C:\Windows\System\uuBaLae.exe
  2⤵
  PID:3680
- C:\Windows\System\QPonlwe.exe
  C:\Windows\System\QPonlwe.exe
  2⤵
  PID:3696
- C:\Windows\System\togKGFt.exe
  C:\Windows\System\togKGFt.exe
  2⤵
  PID:3716
- C:\Windows\System\dnhrAMv.exe
  C:\Windows\System\dnhrAMv.exe
  2⤵
  PID:3732
- C:\Windows\System\GCiRVTD.exe
  C:\Windows\System\GCiRVTD.exe
  2⤵
  PID:3748
- C:\Windows\System\MGvaBjK.exe
  C:\Windows\System\MGvaBjK.exe
  2⤵
  PID:3764
- C:\Windows\System\qMfGgOp.exe
  C:\Windows\System\qMfGgOp.exe
  2⤵
  PID:3780
- C:\Windows\System\rJymrLE.exe
  C:\Windows\System\rJymrLE.exe
  2⤵
  PID:3800
- C:\Windows\System\rmKungR.exe
  C:\Windows\System\rmKungR.exe
  2⤵
  PID:3816
- C:\Windows\System\eysGhvW.exe
  C:\Windows\System\eysGhvW.exe
  2⤵
  PID:3840
- C:\Windows\System\hkaGarI.exe
  C:\Windows\System\hkaGarI.exe
  2⤵
  PID:3864
- C:\Windows\System\bxifDaN.exe
  C:\Windows\System\bxifDaN.exe
  2⤵
  PID:3880
- C:\Windows\System\nXRVdwF.exe
  C:\Windows\System\nXRVdwF.exe
  2⤵
  PID:3896
- C:\Windows\System\ZtAnHvX.exe
  C:\Windows\System\ZtAnHvX.exe
  2⤵
  PID:3912
- C:\Windows\System\DttqHFR.exe
  C:\Windows\System\DttqHFR.exe
  2⤵
  PID:3928
- C:\Windows\System\UyZQqNS.exe
  C:\Windows\System\UyZQqNS.exe
  2⤵
  PID:3948
- C:\Windows\System\ZBJZTwd.exe
  C:\Windows\System\ZBJZTwd.exe
  2⤵
  PID:3964
- C:\Windows\System\DYzDwAZ.exe
  C:\Windows\System\DYzDwAZ.exe
  2⤵
  PID:3980
- C:\Windows\System\LdFTdQS.exe
  C:\Windows\System\LdFTdQS.exe
  2⤵
  PID:4004
- C:\Windows\System\kVuXIJN.exe
  C:\Windows\System\kVuXIJN.exe
  2⤵
  PID:4020
- C:\Windows\System\zEBCdlU.exe
  C:\Windows\System\zEBCdlU.exe
  2⤵
  PID:4036
- C:\Windows\System\VXDXUAo.exe
  C:\Windows\System\VXDXUAo.exe
  2⤵
  PID:4056
- C:\Windows\System\KhqzqaH.exe
  C:\Windows\System\KhqzqaH.exe
  2⤵
  PID:4072
- C:\Windows\System\AtnSTHA.exe
  C:\Windows\System\AtnSTHA.exe
  2⤵
  PID:2936
- C:\Windows\System\EnTgzSf.exe
  C:\Windows\System\EnTgzSf.exe
  2⤵
  PID:296
- C:\Windows\System\OyKZigG.exe
  C:\Windows\System\OyKZigG.exe
  2⤵
  PID:1396
- C:\Windows\System\vPioqnu.exe
  C:\Windows\System\vPioqnu.exe
  2⤵
  PID:876
- C:\Windows\System\QPawEDV.exe
  C:\Windows\System\QPawEDV.exe
  2⤵
  PID:3076
- C:\Windows\System\wRvWYTU.exe
  C:\Windows\System\wRvWYTU.exe
  2⤵
  PID:3144
- C:\Windows\System\CErTFha.exe
  C:\Windows\System\CErTFha.exe
  2⤵
  PID:3256
- C:\Windows\System\mUHxEMf.exe
  C:\Windows\System\mUHxEMf.exe
  2⤵
  PID:3320
- C:\Windows\System\pCuIfEU.exe
  C:\Windows\System\pCuIfEU.exe
  2⤵
  PID:3396
- C:\Windows\System\HMYFLKG.exe
  C:\Windows\System\HMYFLKG.exe
  2⤵
  PID:3432
- C:\Windows\System\lFnuJLU.exe
  C:\Windows\System\lFnuJLU.exe
  2⤵
  PID:3500
- C:\Windows\System\ZBKrYzS.exe
  C:\Windows\System\ZBKrYzS.exe
  2⤵
  PID:3608
- C:\Windows\System\ELKrMsf.exe
  C:\Windows\System\ELKrMsf.exe
  2⤵
  PID:2296
- C:\Windows\System\Hbvewrs.exe
  C:\Windows\System\Hbvewrs.exe
  2⤵
  PID:3652
- C:\Windows\System\SDLgykU.exe
  C:\Windows\System\SDLgykU.exe
  2⤵
  PID:3756
- C:\Windows\System\KiWuUsW.exe
  C:\Windows\System\KiWuUsW.exe
  2⤵
  PID:1596
- C:\Windows\System\SDekMpY.exe
  C:\Windows\System\SDekMpY.exe
  2⤵
  PID:2480
- C:\Windows\System\OmSjpoZ.exe
  C:\Windows\System\OmSjpoZ.exe
  2⤵
  PID:3208
- C:\Windows\System\gtZKnrE.exe
  C:\Windows\System\gtZKnrE.exe
  2⤵
  PID:3472
- C:\Windows\System\tYlXjCT.exe
  C:\Windows\System\tYlXjCT.exe
  2⤵
  PID:1452
- C:\Windows\System\EKBVnLc.exe
  C:\Windows\System\EKBVnLc.exe
  2⤵
  PID:484
- C:\Windows\System\joIIHRm.exe
  C:\Windows\System\joIIHRm.exe
  2⤵
  PID:4108
- C:\Windows\System\yRnBkOH.exe
  C:\Windows\System\yRnBkOH.exe
  2⤵
  PID:4128
- C:\Windows\System\lwWytfQ.exe
  C:\Windows\System\lwWytfQ.exe
  2⤵
  PID:4152
- C:\Windows\System\CFSVYXv.exe
  C:\Windows\System\CFSVYXv.exe
  2⤵
  PID:4172
- C:\Windows\System\NuTakLw.exe
  C:\Windows\System\NuTakLw.exe
  2⤵
  PID:4188
- C:\Windows\System\VnLNTpW.exe
  C:\Windows\System\VnLNTpW.exe
  2⤵
  PID:4208
- C:\Windows\System\zivMjLk.exe
  C:\Windows\System\zivMjLk.exe
  2⤵
  PID:4224
- C:\Windows\System\dHiXlJh.exe
  C:\Windows\System\dHiXlJh.exe
  2⤵
  PID:4244
- C:\Windows\System\BjkrzQC.exe
  C:\Windows\System\BjkrzQC.exe
  2⤵
  PID:4260
- C:\Windows\System\zjycQOk.exe
  C:\Windows\System\zjycQOk.exe
  2⤵
  PID:4280
- C:\Windows\System\rWfUegj.exe
  C:\Windows\System\rWfUegj.exe
  2⤵
  PID:4424
- C:\Windows\System\fHxtZai.exe
  C:\Windows\System\fHxtZai.exe
  2⤵
  PID:4444
- C:\Windows\System\KuplqPh.exe
  C:\Windows\System\KuplqPh.exe
  2⤵
  PID:4460
- C:\Windows\System\BLYdLIW.exe
  C:\Windows\System\BLYdLIW.exe
  2⤵
  PID:4476
- C:\Windows\System\BbxpSzt.exe
  C:\Windows\System\BbxpSzt.exe
  2⤵
  PID:4500
- C:\Windows\System\nfvkPJv.exe
  C:\Windows\System\nfvkPJv.exe
  2⤵
  PID:4516
- C:\Windows\System\qYFmmHT.exe
  C:\Windows\System\qYFmmHT.exe
  2⤵
  PID:4532
- C:\Windows\System\eyykigH.exe
  C:\Windows\System\eyykigH.exe
  2⤵
  PID:4552
- C:\Windows\System\VdHJLBg.exe
  C:\Windows\System\VdHJLBg.exe
  2⤵
  PID:4584
- C:\Windows\System\jjuzAGc.exe
  C:\Windows\System\jjuzAGc.exe
  2⤵
  PID:4600
- C:\Windows\System\xKvnBLp.exe
  C:\Windows\System\xKvnBLp.exe
  2⤵
  PID:4620
- C:\Windows\System\kwdRiJx.exe
  C:\Windows\System\kwdRiJx.exe
  2⤵
  PID:4644
- C:\Windows\System\sTjokrm.exe
  C:\Windows\System\sTjokrm.exe
  2⤵
  PID:4664
- C:\Windows\System\VtDJrVQ.exe
  C:\Windows\System\VtDJrVQ.exe
  2⤵
  PID:4680
- C:\Windows\System\EHjjHQf.exe
  C:\Windows\System\EHjjHQf.exe
  2⤵
  PID:4700
- C:\Windows\System\rBYsfGW.exe
  C:\Windows\System\rBYsfGW.exe
  2⤵
  PID:4716
- C:\Windows\System\zHGJxnO.exe
  C:\Windows\System\zHGJxnO.exe
  2⤵
  PID:4744
- C:\Windows\System\eyogend.exe
  C:\Windows\System\eyogend.exe
  2⤵
  PID:4764
- C:\Windows\System\BXUHMYk.exe
  C:\Windows\System\BXUHMYk.exe
  2⤵
  PID:4780
- C:\Windows\System\GEQZGVN.exe
  C:\Windows\System\GEQZGVN.exe
  2⤵
  PID:4796
- C:\Windows\System\qymRUNz.exe
  C:\Windows\System\qymRUNz.exe
  2⤵
  PID:4824
- C:\Windows\System\FupwPXy.exe
  C:\Windows\System\FupwPXy.exe
  2⤵
  PID:4840
- C:\Windows\System\SUsDRLD.exe
  C:\Windows\System\SUsDRLD.exe
  2⤵
  PID:4864
- C:\Windows\System\npGEwxk.exe
  C:\Windows\System\npGEwxk.exe
  2⤵
  PID:4880
- C:\Windows\System\HHeLJkZ.exe
  C:\Windows\System\HHeLJkZ.exe
  2⤵
  PID:4904
- C:\Windows\System\JmtsJKS.exe
  C:\Windows\System\JmtsJKS.exe
  2⤵
  PID:4924
- C:\Windows\System\gXGIymb.exe
  C:\Windows\System\gXGIymb.exe
  2⤵
  PID:4940
- C:\Windows\System\SRcaZTK.exe
  C:\Windows\System\SRcaZTK.exe
  2⤵
  PID:4964
- C:\Windows\System\CdsyHOt.exe
  C:\Windows\System\CdsyHOt.exe
  2⤵
  PID:4984
- C:\Windows\System\AjFcEAr.exe
  C:\Windows\System\AjFcEAr.exe
  2⤵
  PID:5000
- C:\Windows\System\xrfSbLU.exe
  C:\Windows\System\xrfSbLU.exe
  2⤵
  PID:5020
- C:\Windows\System\yORpmaI.exe
  C:\Windows\System\yORpmaI.exe
  2⤵
  PID:5044
- C:\Windows\System\LpvvNpL.exe
  C:\Windows\System\LpvvNpL.exe
  2⤵
  PID:5064
- C:\Windows\System\hNfkDYp.exe
  C:\Windows\System\hNfkDYp.exe
  2⤵
  PID:5080
- C:\Windows\System\qhOysyo.exe
  C:\Windows\System\qhOysyo.exe
  2⤵
  PID:5104
- C:\Windows\System\WKCvCvu.exe
  C:\Windows\System\WKCvCvu.exe
  2⤵
  PID:2772
- C:\Windows\System\orQpthk.exe
  C:\Windows\System\orQpthk.exe
  2⤵
  PID:3520
- C:\Windows\System\vtvCZgx.exe
  C:\Windows\System\vtvCZgx.exe
  2⤵
  PID:3448
- C:\Windows\System\VcqifCN.exe
  C:\Windows\System\VcqifCN.exe
  2⤵
  PID:3332
- C:\Windows\System\mrsnQou.exe
  C:\Windows\System\mrsnQou.exe
  2⤵
  PID:3300
- C:\Windows\System\QIvsyEj.exe
  C:\Windows\System\QIvsyEj.exe
  2⤵
  PID:3192
- C:\Windows\System\RqCkBrZ.exe
  C:\Windows\System\RqCkBrZ.exe
  2⤵
  PID:3092
- C:\Windows\System\lelRumA.exe
  C:\Windows\System\lelRumA.exe
  2⤵
  PID:2436
- C:\Windows\System\bYEKdiE.exe
  C:\Windows\System\bYEKdiE.exe
  2⤵
  PID:684
- C:\Windows\System\WgoZcKc.exe
  C:\Windows\System\WgoZcKc.exe
  2⤵
  PID:768
- C:\Windows\System\KChLjcF.exe
  C:\Windows\System\KChLjcF.exe
  2⤵
  PID:2424
- C:\Windows\System\OCnHPsb.exe
  C:\Windows\System\OCnHPsb.exe
  2⤵
  PID:848
- C:\Windows\System\UrPVdTu.exe
  C:\Windows\System\UrPVdTu.exe
  2⤵
  PID:2784
- C:\Windows\System\PVQFPgT.exe
  C:\Windows\System\PVQFPgT.exe
  2⤵
  PID:4196
- C:\Windows\System\PILvBqO.exe
  C:\Windows\System\PILvBqO.exe
  2⤵
  PID:4232
- C:\Windows\System\tbspggm.exe
  C:\Windows\System\tbspggm.exe
  2⤵
  PID:4272
- C:\Windows\System\tOEpxpL.exe
  C:\Windows\System\tOEpxpL.exe
  2⤵
  PID:1984
- C:\Windows\System\BcQJFPJ.exe
  C:\Windows\System\BcQJFPJ.exe
  2⤵
  PID:804
- C:\Windows\System\CyiybVB.exe
  C:\Windows\System\CyiybVB.exe
  2⤵
  PID:2508
- C:\Windows\System\QuBAjut.exe
  C:\Windows\System\QuBAjut.exe
  2⤵
  PID:2136
- C:\Windows\System\mNYfnFU.exe
  C:\Windows\System\mNYfnFU.exe
  2⤵
  PID:2556
- C:\Windows\System\vvEtHtB.exe
  C:\Windows\System\vvEtHtB.exe
  2⤵
  PID:3044
- C:\Windows\System\KDjjzmt.exe
  C:\Windows\System\KDjjzmt.exe
  2⤵
  PID:1588
- C:\Windows\System\rSBosUY.exe
  C:\Windows\System\rSBosUY.exe
  2⤵
  PID:2752
- C:\Windows\System\LVSdYqA.exe
  C:\Windows\System\LVSdYqA.exe
  2⤵
  PID:1956
- C:\Windows\System\vyybwxQ.exe
  C:\Windows\System\vyybwxQ.exe
  2⤵
  PID:2408
- C:\Windows\System\IPWfIvt.exe
  C:\Windows\System\IPWfIvt.exe
  2⤵
  PID:3232
- C:\Windows\System\jhUbWnS.exe
  C:\Windows\System\jhUbWnS.exe
  2⤵
  PID:3384
- C:\Windows\System\MDKRHPD.exe
  C:\Windows\System\MDKRHPD.exe
  2⤵
  PID:2260
- C:\Windows\System\dqbfKDq.exe
  C:\Windows\System\dqbfKDq.exe
  2⤵
  PID:2928
- C:\Windows\System\BrGnEBQ.exe
  C:\Windows\System\BrGnEBQ.exe
  2⤵
  PID:3564
- C:\Windows\System\FkATlzP.exe
  C:\Windows\System\FkATlzP.exe
  2⤵
  PID:3636
- C:\Windows\System\BngmIju.exe
  C:\Windows\System\BngmIju.exe
  2⤵
  PID:3708
- C:\Windows\System\GBuZaJG.exe
  C:\Windows\System\GBuZaJG.exe
  2⤵
  PID:4000
- C:\Windows\System\yEOVWuH.exe
  C:\Windows\System\yEOVWuH.exe
  2⤵
  PID:1796
- C:\Windows\System\hIpjBIf.exe
  C:\Windows\System\hIpjBIf.exe
  2⤵
  PID:3316
- C:\Windows\System\HNPtbhT.exe
  C:\Windows\System\HNPtbhT.exe
  2⤵
  PID:3508
- C:\Windows\System\xJQaYHR.exe
  C:\Windows\System\xJQaYHR.exe
  2⤵
  PID:3648
- C:\Windows\System\WanqSUf.exe
  C:\Windows\System\WanqSUf.exe
  2⤵
  PID:3836
- C:\Windows\System\SmhOEXy.exe
  C:\Windows\System\SmhOEXy.exe
  2⤵
  PID:3904
- C:\Windows\System\gkmDSOn.exe
  C:\Windows\System\gkmDSOn.exe
  2⤵
  PID:3940
- C:\Windows\System\OVFOLbR.exe
  C:\Windows\System\OVFOLbR.exe
  2⤵
  PID:3740
- C:\Windows\System\OmuzRnk.exe
  C:\Windows\System\OmuzRnk.exe
  2⤵
  PID:3956
- C:\Windows\System\odJbUhl.exe
  C:\Windows\System\odJbUhl.exe
  2⤵
  PID:3888
- C:\Windows\System\NbSgDTk.exe
  C:\Windows\System\NbSgDTk.exe
  2⤵
  PID:3808
- C:\Windows\System\whDQpfz.exe
  C:\Windows\System\whDQpfz.exe
  2⤵
  PID:4084
- C:\Windows\System\sklgNZp.exe
  C:\Windows\System\sklgNZp.exe
  2⤵
  PID:3692
- C:\Windows\System\aJHxJZO.exe
  C:\Windows\System\aJHxJZO.exe
  2⤵
  PID:4140
- C:\Windows\System\UoezprA.exe
  C:\Windows\System\UoezprA.exe
  2⤵
  PID:4184
- C:\Windows\System\lwOtnJY.exe
  C:\Windows\System\lwOtnJY.exe
  2⤵
  PID:3744
- C:\Windows\System\INtwwpb.exe
  C:\Windows\System\INtwwpb.exe
  2⤵
  PID:4296
- C:\Windows\System\lvZAoKE.exe
  C:\Windows\System\lvZAoKE.exe
  2⤵
  PID:4320
- C:\Windows\System\oJjTthp.exe
  C:\Windows\System\oJjTthp.exe
  2⤵
  PID:4336
- C:\Windows\System\DjRHLcc.exe
  C:\Windows\System\DjRHLcc.exe
  2⤵
  PID:4364
- C:\Windows\System\xfRtIMs.exe
  C:\Windows\System\xfRtIMs.exe
  2⤵
  PID:4388
- C:\Windows\System\ulaJbWv.exe
  C:\Windows\System\ulaJbWv.exe
  2⤵
  PID:2316
- C:\Windows\System\aUIsNCr.exe
  C:\Windows\System\aUIsNCr.exe
  2⤵
  PID:4472
- C:\Windows\System\YVnWeNB.exe
  C:\Windows\System\YVnWeNB.exe
  2⤵
  PID:4544
- C:\Windows\System\hLapGUN.exe
  C:\Windows\System\hLapGUN.exe
  2⤵
  PID:4496
- C:\Windows\System\PoSdYKw.exe
  C:\Windows\System\PoSdYKw.exe
  2⤵
  PID:4568
- C:\Windows\System\zYmZFCe.exe
  C:\Windows\System\zYmZFCe.exe
  2⤵
  PID:4596
- C:\Windows\System\NUPWHtW.exe
  C:\Windows\System\NUPWHtW.exe
  2⤵
  PID:4636
- C:\Windows\System\pesOsEX.exe
  C:\Windows\System\pesOsEX.exe
  2⤵
  PID:4652
- C:\Windows\System\XQiJJbX.exe
  C:\Windows\System\XQiJJbX.exe
  2⤵
  PID:4708
- C:\Windows\System\qQhAlre.exe
  C:\Windows\System\qQhAlre.exe
  2⤵
  PID:4732
- C:\Windows\System\gjKYliY.exe
  C:\Windows\System\gjKYliY.exe
  2⤵
  PID:4756
- C:\Windows\System\nNpPxUR.exe
  C:\Windows\System\nNpPxUR.exe
  2⤵
  PID:4772
- C:\Windows\System\esedpdn.exe
  C:\Windows\System\esedpdn.exe
  2⤵
  PID:4808
- C:\Windows\System\JaEqniX.exe
  C:\Windows\System\JaEqniX.exe
  2⤵
  PID:4820
- C:\Windows\System\mpFimIR.exe
  C:\Windows\System\mpFimIR.exe
  2⤵
  PID:4852
- C:\Windows\System\XviNPML.exe
  C:\Windows\System\XviNPML.exe
  2⤵
  PID:4888
- C:\Windows\System\NYEChIA.exe
  C:\Windows\System\NYEChIA.exe
  2⤵
  PID:4920
- C:\Windows\System\BVrSAJt.exe
  C:\Windows\System\BVrSAJt.exe
  2⤵
  PID:4952
- C:\Windows\System\NnqMhvL.exe
  C:\Windows\System\NnqMhvL.exe
  2⤵
  PID:5032
- C:\Windows\System\ewZpEAP.exe
  C:\Windows\System\ewZpEAP.exe
  2⤵
  PID:4976
- C:\Windows\System\qEZXCFK.exe
  C:\Windows\System\qEZXCFK.exe
  2⤵
  PID:5072
- C:\Windows\System\tYenRnK.exe
  C:\Windows\System\tYenRnK.exe
  2⤵
  PID:3560
- C:\Windows\System\ECEWUJM.exe
  C:\Windows\System\ECEWUJM.exe
  2⤵
  PID:3524
- C:\Windows\System\KmIbCFW.exe
  C:\Windows\System\KmIbCFW.exe
  2⤵
  PID:2704
- C:\Windows\System\EpOjvXE.exe
  C:\Windows\System\EpOjvXE.exe
  2⤵
  PID:3224
- C:\Windows\System\KZpupcq.exe
  C:\Windows\System\KZpupcq.exe
  2⤵
  PID:3012
- C:\Windows\System\MdWXEnR.exe
  C:\Windows\System\MdWXEnR.exe
  2⤵
  PID:2364
- C:\Windows\System\ZMZVuDe.exe
  C:\Windows\System\ZMZVuDe.exe
  2⤵
  PID:4116
- C:\Windows\System\tCeLNfR.exe
  C:\Windows\System\tCeLNfR.exe
  2⤵
  PID:3020
- C:\Windows\System\tteryyT.exe
  C:\Windows\System\tteryyT.exe
  2⤵
  PID:2096
- C:\Windows\System\pUIbwjF.exe
  C:\Windows\System\pUIbwjF.exe
  2⤵
  PID:4168
- C:\Windows\System\hqFmKYu.exe
  C:\Windows\System\hqFmKYu.exe
  2⤵
  PID:1672
- C:\Windows\System\VujbFPu.exe
  C:\Windows\System\VujbFPu.exe
  2⤵
  PID:3228
- C:\Windows\System\FqCBHDj.exe
  C:\Windows\System\FqCBHDj.exe
  2⤵
  PID:3528
- C:\Windows\System\imVfdOB.exe
  C:\Windows\System\imVfdOB.exe
  2⤵
  PID:1704
- C:\Windows\System\cUEduBp.exe
  C:\Windows\System\cUEduBp.exe
  2⤵
  PID:880
- C:\Windows\System\CpKuEhC.exe
  C:\Windows\System\CpKuEhC.exe
  2⤵
  PID:2764
- C:\Windows\System\fApwtSE.exe
  C:\Windows\System\fApwtSE.exe
  2⤵
  PID:2104
- C:\Windows\System\zXtyVHu.exe
  C:\Windows\System\zXtyVHu.exe
  2⤵
  PID:3340
- C:\Windows\System\OIiCAeD.exe
  C:\Windows\System\OIiCAeD.exe
  2⤵
  PID:3628
- C:\Windows\System\nPPzURb.exe
  C:\Windows\System\nPPzURb.exe
  2⤵
  PID:3824
- C:\Windows\System\mAhTwOu.exe
  C:\Windows\System\mAhTwOu.exe
  2⤵
  PID:3944
- C:\Windows\System\lTWuqpt.exe
  C:\Windows\System\lTWuqpt.exe
  2⤵
  PID:3872
- C:\Windows\System\bDbSOSC.exe
  C:\Windows\System\bDbSOSC.exe
  2⤵
  PID:3976
- C:\Windows\System\ZxKzqli.exe
  C:\Windows\System\ZxKzqli.exe
  2⤵
  PID:3992
- C:\Windows\System\PUrwtnx.exe
  C:\Windows\System\PUrwtnx.exe
  2⤵
  PID:3812
- C:\Windows\System\qLDBole.exe
  C:\Windows\System\qLDBole.exe
  2⤵
  PID:4088
- C:\Windows\System\UtFRUso.exe
  C:\Windows\System\UtFRUso.exe
  2⤵
  PID:3612
- C:\Windows\System\qKHJUst.exe
  C:\Windows\System\qKHJUst.exe
  2⤵
  PID:4180
- C:\Windows\System\AaeBsbS.exe
  C:\Windows\System\AaeBsbS.exe
  2⤵
  PID:4328
- C:\Windows\System\fMCevxe.exe
  C:\Windows\System\fMCevxe.exe
  2⤵
  PID:4312
- C:\Windows\System\EBzLaVb.exe
  C:\Windows\System\EBzLaVb.exe
  2⤵
  PID:4356
- C:\Windows\System\QKOzsXU.exe
  C:\Windows\System\QKOzsXU.exe
  2⤵
  PID:4400
- C:\Windows\System\ZynYrLO.exe
  C:\Windows\System\ZynYrLO.exe
  2⤵
  PID:4508
- C:\Windows\System\dZSFQUj.exe
  C:\Windows\System\dZSFQUj.exe
  2⤵
  PID:4528
- C:\Windows\System\ZBWkoCx.exe
  C:\Windows\System\ZBWkoCx.exe
  2⤵
  PID:4688
- C:\Windows\System\CeYsmFV.exe
  C:\Windows\System\CeYsmFV.exe
  2⤵
  PID:4656
- C:\Windows\System\leNJLKq.exe
  C:\Windows\System\leNJLKq.exe
  2⤵
  PID:4728
- C:\Windows\System\veyOuEv.exe
  C:\Windows\System\veyOuEv.exe
  2⤵
  PID:2848
- C:\Windows\System\HLiKRKT.exe
  C:\Windows\System\HLiKRKT.exe
  2⤵
  PID:4916
- C:\Windows\System\QgYUStm.exe
  C:\Windows\System\QgYUStm.exe
  2⤵
  PID:4960
- C:\Windows\System\AZkrnzl.exe
  C:\Windows\System\AZkrnzl.exe
  2⤵
  PID:4972
- C:\Windows\System\AFFnXgK.exe
  C:\Windows\System\AFFnXgK.exe
  2⤵
  PID:3196
- C:\Windows\System\LQITvpv.exe
  C:\Windows\System\LQITvpv.exe
  2⤵
  PID:3468
- C:\Windows\System\HIVfHrA.exe
  C:\Windows\System\HIVfHrA.exe
  2⤵
  PID:2368
- C:\Windows\System\jisREpb.exe
  C:\Windows\System\jisREpb.exe
  2⤵
  PID:2180
- C:\Windows\System\UVZbOjL.exe
  C:\Windows\System\UVZbOjL.exe
  2⤵
  PID:2420
- C:\Windows\System\ntEaEcr.exe
  C:\Windows\System\ntEaEcr.exe
  2⤵
  PID:4268
- C:\Windows\System\TkSongf.exe
  C:\Windows\System\TkSongf.exe
  2⤵
  PID:1948
- C:\Windows\System\hbbuUYd.exe
  C:\Windows\System\hbbuUYd.exe
  2⤵
  PID:2824
- C:\Windows\System\sYbQPxh.exe
  C:\Windows\System\sYbQPxh.exe
  2⤵
  PID:1968
- C:\Windows\System\vmAKyCT.exe
  C:\Windows\System\vmAKyCT.exe
  2⤵
  PID:2984
- C:\Windows\System\mOwVTyT.exe
  C:\Windows\System\mOwVTyT.exe
  2⤵
  PID:2332
- C:\Windows\System\LVskOqt.exe
  C:\Windows\System\LVskOqt.exe
  2⤵
  PID:3668
- C:\Windows\System\DDcDhVx.exe
  C:\Windows\System\DDcDhVx.exe
  2⤵
  PID:2344
- C:\Windows\System\kmZKTxQ.exe
  C:\Windows\System\kmZKTxQ.exe
  2⤵
  PID:2068
- C:\Windows\System\gPIXlkQ.exe
  C:\Windows\System\gPIXlkQ.exe
  2⤵
  PID:2884
- C:\Windows\System\iBYtfZO.exe
  C:\Windows\System\iBYtfZO.exe
  2⤵
  PID:2324
- C:\Windows\System\pphLZkQ.exe
  C:\Windows\System\pphLZkQ.exe
  2⤵
  PID:316
- C:\Windows\System\UwFzqMe.exe
  C:\Windows\System\UwFzqMe.exe
  2⤵
  PID:4068
- C:\Windows\System\lnQoVtR.exe
  C:\Windows\System\lnQoVtR.exe
  2⤵
  PID:2616
- C:\Windows\System\MQbEJoB.exe
  C:\Windows\System\MQbEJoB.exe
  2⤵
  PID:3860
- C:\Windows\System\LSXsrio.exe
  C:\Windows\System\LSXsrio.exe
  2⤵
  PID:3288
- C:\Windows\System\JYfvkwV.exe
  C:\Windows\System\JYfvkwV.exe
  2⤵
  PID:3580
- C:\Windows\System\WswaHOo.exe
  C:\Windows\System\WswaHOo.exe
  2⤵
  PID:4012
- C:\Windows\System\YRNyBaY.exe
  C:\Windows\System\YRNyBaY.exe
  2⤵
  PID:4048
- C:\Windows\System\idpXMxc.exe
  C:\Windows\System\idpXMxc.exe
  2⤵
  PID:2112
- C:\Windows\System\sjpsUDj.exe
  C:\Windows\System\sjpsUDj.exe
  2⤵
  PID:4136
- C:\Windows\System\VmADroY.exe
  C:\Windows\System\VmADroY.exe
  2⤵
  PID:4220
- C:\Windows\System\BmTHwaQ.exe
  C:\Windows\System\BmTHwaQ.exe
  2⤵
  PID:4252
- C:\Windows\System\SVHXkAz.exe
  C:\Windows\System\SVHXkAz.exe
  2⤵
  PID:4348
- C:\Windows\System\NBZQIwa.exe
  C:\Windows\System\NBZQIwa.exe
  2⤵
  PID:4360
- C:\Windows\System\zEqUvYU.exe
  C:\Windows\System\zEqUvYU.exe
  2⤵
  PID:4432
- C:\Windows\System\ehbHiRv.exe
  C:\Windows\System\ehbHiRv.exe
  2⤵
  PID:4608
- C:\Windows\System\wXNwgNq.exe
  C:\Windows\System\wXNwgNq.exe
  2⤵
  PID:4484
- C:\Windows\System\CVqrucY.exe
  C:\Windows\System\CVqrucY.exe
  2⤵
  PID:2736
- C:\Windows\System\FqosiYO.exe
  C:\Windows\System\FqosiYO.exe
  2⤵
  PID:4580
- C:\Windows\System\QobrVAp.exe
  C:\Windows\System\QobrVAp.exe
  2⤵
  PID:4760
- C:\Windows\System\TyLFPYn.exe
  C:\Windows\System\TyLFPYn.exe
  2⤵
  PID:4856
- C:\Windows\System\QDnzXPo.exe
  C:\Windows\System\QDnzXPo.exe
  2⤵
  PID:4872
- C:\Windows\System\pwywZPV.exe
  C:\Windows\System\pwywZPV.exe
  2⤵
  PID:4980
- C:\Windows\System\BNkPNXu.exe
  C:\Windows\System\BNkPNXu.exe
  2⤵
  PID:5012
- C:\Windows\System\qrRHfzR.exe
  C:\Windows\System\qrRHfzR.exe
  2⤵
  PID:2912
- C:\Windows\System\uNdLgRI.exe
  C:\Windows\System\uNdLgRI.exe
  2⤵
  PID:5096
- C:\Windows\System\kelAMCQ.exe
  C:\Windows\System\kelAMCQ.exe
  2⤵
  PID:1600
- C:\Windows\System\DIzqDSB.exe
  C:\Windows\System\DIzqDSB.exe
  2⤵
  PID:2340
- C:\Windows\System\jOlEbft.exe
  C:\Windows\System\jOlEbft.exe
  2⤵
  PID:1520
- C:\Windows\System\XsmFWDW.exe
  C:\Windows\System\XsmFWDW.exe
  2⤵
  PID:2580
- C:\Windows\System\FBFrSap.exe
  C:\Windows\System\FBFrSap.exe
  2⤵
  PID:4292
- C:\Windows\System\OQjwbgB.exe
  C:\Windows\System\OQjwbgB.exe
  2⤵
  PID:4456
- C:\Windows\System\zgEoCjm.exe
  C:\Windows\System\zgEoCjm.exe
  2⤵
  PID:1540
- C:\Windows\System\oUaWHqC.exe
  C:\Windows\System\oUaWHqC.exe
  2⤵
  PID:1868
- C:\Windows\System\dmwmEnl.exe
  C:\Windows\System\dmwmEnl.exe
  2⤵
  PID:2624
- C:\Windows\System\FKTxlYk.exe
  C:\Windows\System\FKTxlYk.exe
  2⤵
  PID:4092
- C:\Windows\System\insrTNE.exe
  C:\Windows\System\insrTNE.exe
  2⤵
  PID:4372
- C:\Windows\System\OWKKVXX.exe
  C:\Windows\System\OWKKVXX.exe
  2⤵
  PID:2796
- C:\Windows\System\oxsyyIK.exe
  C:\Windows\System\oxsyyIK.exe
  2⤵
  PID:4812
- C:\Windows\System\wJTKvEj.exe
  C:\Windows\System\wJTKvEj.exe
  2⤵
  PID:4304
- C:\Windows\System\PsmBFdj.exe
  C:\Windows\System\PsmBFdj.exe
  2⤵
  PID:2968
- C:\Windows\System\UPeaxww.exe
  C:\Windows\System\UPeaxww.exe
  2⤵
  PID:2292
- C:\Windows\System\UAyQwXm.exe
  C:\Windows\System\UAyQwXm.exe
  2⤵
  PID:5040
- C:\Windows\System\IGiVDUo.exe
  C:\Windows\System\IGiVDUo.exe
  2⤵
  PID:3344
- C:\Windows\System\MhOQqUw.exe
  C:\Windows\System\MhOQqUw.exe
  2⤵
  PID:4612
- C:\Windows\System\feVBMEj.exe
  C:\Windows\System\feVBMEj.exe
  2⤵
  PID:2860
- C:\Windows\System\VrkQfwi.exe
  C:\Windows\System\VrkQfwi.exe
  2⤵
  PID:2880
- C:\Windows\System\OBFQVLq.exe
  C:\Windows\System\OBFQVLq.exe
  2⤵
  PID:1716
- C:\Windows\System\BxPRWQM.exe
  C:\Windows\System\BxPRWQM.exe
  2⤵
  PID:3792
- C:\Windows\System\spzmfss.exe
  C:\Windows\System\spzmfss.exe
  2⤵
  PID:772
- C:\Windows\System\KiUadPK.exe
  C:\Windows\System\KiUadPK.exe
  2⤵
  PID:2988
- C:\Windows\System\QdzZGQL.exe
  C:\Windows\System\QdzZGQL.exe
  2⤵
  PID:3140
- C:\Windows\System\nFMFGCu.exe
  C:\Windows\System\nFMFGCu.exe
  2⤵
  PID:4236
- C:\Windows\System\FmgljMA.exe
  C:\Windows\System\FmgljMA.exe
  2⤵
  PID:2608
- C:\Windows\System\SBdJlne.exe
  C:\Windows\System\SBdJlne.exe
  2⤵
  PID:4308
- C:\Windows\System\nOrQcoO.exe
  C:\Windows\System\nOrQcoO.exe
  2⤵
  PID:2716
- C:\Windows\System\rLatiRE.exe
  C:\Windows\System\rLatiRE.exe
  2⤵
  PID:716
- C:\Windows\System\AzLjxqB.exe
  C:\Windows\System\AzLjxqB.exe
  2⤵
  PID:2196
- C:\Windows\System\QtjCxsN.exe
  C:\Windows\System\QtjCxsN.exe
  2⤵
  PID:3156
- C:\Windows\System\JQSPSdA.exe
  C:\Windows\System\JQSPSdA.exe
  2⤵
  PID:1808
- C:\Windows\System\hgtPSzc.exe
  C:\Windows\System\hgtPSzc.exe
  2⤵
  PID:1932
- C:\Windows\System\BibFQab.exe
  C:\Windows\System\BibFQab.exe
  2⤵
  PID:3164
- C:\Windows\System\PwsgIIk.exe
  C:\Windows\System\PwsgIIk.exe
  2⤵
  PID:588
- C:\Windows\System\uQMNcHe.exe
  C:\Windows\System\uQMNcHe.exe
  2⤵
  PID:4804
- C:\Windows\System\NSbEOIq.exe
  C:\Windows\System\NSbEOIq.exe
  2⤵
  PID:4628
- C:\Windows\System\MQTfRtw.exe
  C:\Windows\System\MQTfRtw.exe
  2⤵
  PID:5100
- C:\Windows\System\fBnfGvk.exe
  C:\Windows\System\fBnfGvk.exe
  2⤵
  PID:5092
- C:\Windows\System\DRdKiTF.exe
  C:\Windows\System\DRdKiTF.exe
  2⤵
  PID:3376
- C:\Windows\System\nVQaGrr.exe
  C:\Windows\System\nVQaGrr.exe
  2⤵
  PID:1756
- C:\Windows\System\SiqIywi.exe
  C:\Windows\System\SiqIywi.exe
  2⤵
  PID:4204
- C:\Windows\System\PyFhSgm.exe
  C:\Windows\System\PyFhSgm.exe
  2⤵
  PID:3024
- C:\Windows\System\HKjOWvf.exe
  C:\Windows\System\HKjOWvf.exe
  2⤵
  PID:1760
- C:\Windows\System\kSgjTmc.exe
  C:\Windows\System\kSgjTmc.exe
  2⤵
  PID:5136
- C:\Windows\System\FVGmrKW.exe
  C:\Windows\System\FVGmrKW.exe
  2⤵
  PID:5152
- C:\Windows\System\cYRXTft.exe
  C:\Windows\System\cYRXTft.exe
  2⤵
  PID:5168
- C:\Windows\System\PJTrOEu.exe
  C:\Windows\System\PJTrOEu.exe
  2⤵
  PID:5184
- C:\Windows\System\OtJLcMS.exe
  C:\Windows\System\OtJLcMS.exe
  2⤵
  PID:5200
- C:\Windows\System\Nrbxtmq.exe
  C:\Windows\System\Nrbxtmq.exe
  2⤵
  PID:5216
- C:\Windows\System\ixDZilq.exe
  C:\Windows\System\ixDZilq.exe
  2⤵
  PID:5232
- C:\Windows\System\KtUFbjh.exe
  C:\Windows\System\KtUFbjh.exe
  2⤵
  PID:5256
- C:\Windows\System\QwUMKTe.exe
  C:\Windows\System\QwUMKTe.exe
  2⤵
  PID:5272
- C:\Windows\System\zwGJPCL.exe
  C:\Windows\System\zwGJPCL.exe
  2⤵
  PID:5288
- C:\Windows\System\ITdtQHA.exe
  C:\Windows\System\ITdtQHA.exe
  2⤵
  PID:5304
- C:\Windows\System\kdDNeVO.exe
  C:\Windows\System\kdDNeVO.exe
  2⤵
  PID:5320
- C:\Windows\System\PatnOtf.exe
  C:\Windows\System\PatnOtf.exe
  2⤵
  PID:5336
- C:\Windows\System\kJoEWBL.exe
  C:\Windows\System\kJoEWBL.exe
  2⤵
  PID:5352
- C:\Windows\System\lkbNUug.exe
  C:\Windows\System\lkbNUug.exe
  2⤵
  PID:5368
- C:\Windows\System\qCicpOa.exe
  C:\Windows\System\qCicpOa.exe
  2⤵
  PID:5388
- C:\Windows\System\SZeUfLI.exe
  C:\Windows\System\SZeUfLI.exe
  2⤵
  PID:5404
- C:\Windows\System\ENpoBNr.exe
  C:\Windows\System\ENpoBNr.exe
  2⤵
  PID:5420
- C:\Windows\System\XwIuxYD.exe
  C:\Windows\System\XwIuxYD.exe
  2⤵
  PID:5436
- C:\Windows\System\ldQhktI.exe
  C:\Windows\System\ldQhktI.exe
  2⤵
  PID:5452
- C:\Windows\System\UUcfwrb.exe
  C:\Windows\System\UUcfwrb.exe
  2⤵
  PID:5468
- C:\Windows\System\FPjLkAI.exe
  C:\Windows\System\FPjLkAI.exe
  2⤵
  PID:5488
- C:\Windows\System\mTyioUj.exe
  C:\Windows\System\mTyioUj.exe
  2⤵
  PID:5504
- C:\Windows\System\LvLNWjK.exe
  C:\Windows\System\LvLNWjK.exe
  2⤵
  PID:5520
- C:\Windows\System\RLyqjeu.exe
  C:\Windows\System\RLyqjeu.exe
  2⤵
  PID:5536
- C:\Windows\System\raSgnHq.exe
  C:\Windows\System\raSgnHq.exe
  2⤵
  PID:5552
- C:\Windows\System\azJklpH.exe
  C:\Windows\System\azJklpH.exe
  2⤵
  PID:5568
- C:\Windows\System\vdqgwOt.exe
  C:\Windows\System\vdqgwOt.exe
  2⤵
  PID:5584
- C:\Windows\System\bzclQnT.exe
  C:\Windows\System\bzclQnT.exe
  2⤵
  PID:5600
- C:\Windows\System\pladnZO.exe
  C:\Windows\System\pladnZO.exe
  2⤵
  PID:5616
- C:\Windows\System\tOjPPav.exe
  C:\Windows\System\tOjPPav.exe
  2⤵
  PID:5632
- C:\Windows\System\BQcQVYp.exe
  C:\Windows\System\BQcQVYp.exe
  2⤵
  PID:5648
- C:\Windows\System\yAvdpiq.exe
  C:\Windows\System\yAvdpiq.exe
  2⤵
  PID:5664
- C:\Windows\System\qpzpitg.exe
  C:\Windows\System\qpzpitg.exe
  2⤵
  PID:5680
- C:\Windows\System\tmTZfTQ.exe
  C:\Windows\System\tmTZfTQ.exe
  2⤵
  PID:5696
- C:\Windows\System\jwRxSPq.exe
  C:\Windows\System\jwRxSPq.exe
  2⤵
  PID:5712
- C:\Windows\System\PnNcmfe.exe
  C:\Windows\System\PnNcmfe.exe
  2⤵
  PID:5728
- C:\Windows\System\sQCeSKX.exe
  C:\Windows\System\sQCeSKX.exe
  2⤵
  PID:5744
- C:\Windows\System\ydGqqIX.exe
  C:\Windows\System\ydGqqIX.exe
  2⤵
  PID:5764
- C:\Windows\System\AOyekBZ.exe
  C:\Windows\System\AOyekBZ.exe
  2⤵
  PID:5780
- C:\Windows\System\MjbnHJy.exe
  C:\Windows\System\MjbnHJy.exe
  2⤵
  PID:5796
- C:\Windows\System\TWxeEBW.exe
  C:\Windows\System\TWxeEBW.exe
  2⤵
  PID:5812
- C:\Windows\System\gRDmnNT.exe
  C:\Windows\System\gRDmnNT.exe
  2⤵
  PID:5828
- C:\Windows\System\KbnUywT.exe
  C:\Windows\System\KbnUywT.exe
  2⤵
  PID:5844
- C:\Windows\System\cpdofQL.exe
  C:\Windows\System\cpdofQL.exe
  2⤵
  PID:5888
- C:\Windows\System\skGrOIp.exe
  C:\Windows\System\skGrOIp.exe
  2⤵
  PID:5904
- C:\Windows\System\PZlSWRl.exe
  C:\Windows\System\PZlSWRl.exe
  2⤵
  PID:5920
- C:\Windows\System\HdbPUqR.exe
  C:\Windows\System\HdbPUqR.exe
  2⤵
  PID:5936
- C:\Windows\System\rcGVzVL.exe
  C:\Windows\System\rcGVzVL.exe
  2⤵
  PID:5952
- C:\Windows\System\bsulAMI.exe
  C:\Windows\System\bsulAMI.exe
  2⤵
  PID:5968
- C:\Windows\System\okRJgHd.exe
  C:\Windows\System\okRJgHd.exe
  2⤵
  PID:5984
- C:\Windows\System\LZxxJlf.exe
  C:\Windows\System\LZxxJlf.exe
  2⤵
  PID:6000
- C:\Windows\System\dMuJwGg.exe
  C:\Windows\System\dMuJwGg.exe
  2⤵
  PID:6020
- C:\Windows\System\fFKPTju.exe
  C:\Windows\System\fFKPTju.exe
  2⤵
  PID:6036
- C:\Windows\System\mLFsizF.exe
  C:\Windows\System\mLFsizF.exe
  2⤵
  PID:6052
- C:\Windows\System\xQMuBzE.exe
  C:\Windows\System\xQMuBzE.exe
  2⤵
  PID:6068
- C:\Windows\System\ZiOfyYX.exe
  C:\Windows\System\ZiOfyYX.exe
  2⤵
  PID:6084
- C:\Windows\System\KCmHhVK.exe
  C:\Windows\System\KCmHhVK.exe
  2⤵
  PID:6100
- C:\Windows\System\royATIB.exe
  C:\Windows\System\royATIB.exe
  2⤵
  PID:6116
- C:\Windows\System\HlFPUbs.exe
  C:\Windows\System\HlFPUbs.exe
  2⤵
  PID:6136
- C:\Windows\System\ucpoRSk.exe
  C:\Windows\System\ucpoRSk.exe
  2⤵
  PID:5088
- C:\Windows\System\vCrQHgW.exe
  C:\Windows\System\vCrQHgW.exe
  2⤵
  PID:2008
- C:\Windows\System\EmjmBer.exe
  C:\Windows\System\EmjmBer.exe
  2⤵
  PID:5148
- C:\Windows\System\HPpkTVc.exe
  C:\Windows\System\HPpkTVc.exe
  2⤵
  PID:5164
- C:\Windows\System\LloKwbT.exe
  C:\Windows\System\LloKwbT.exe
  2⤵
  PID:5160
- C:\Windows\System\UfCGGMr.exe
  C:\Windows\System\UfCGGMr.exe
  2⤵
  PID:5212
- C:\Windows\System\uaKZUcp.exe
  C:\Windows\System\uaKZUcp.exe
  2⤵
  PID:1876
- C:\Windows\System\bmJOCXo.exe
  C:\Windows\System\bmJOCXo.exe
  2⤵
  PID:4956
- C:\Windows\System\YeSxRCT.exe
  C:\Windows\System\YeSxRCT.exe
  2⤵
  PID:5316
- C:\Windows\System\SQfyAIp.exe
  C:\Windows\System\SQfyAIp.exe
  2⤵
  PID:5380
- C:\Windows\System\JvqBFjw.exe
  C:\Windows\System\JvqBFjw.exe
  2⤵
  PID:5448
- C:\Windows\System\kuMrEWI.exe
  C:\Windows\System\kuMrEWI.exe
  2⤵
  PID:5512
- C:\Windows\System\cDoXjVd.exe
  C:\Windows\System\cDoXjVd.exe
  2⤵
  PID:5576
- C:\Windows\System\FvPLAiF.exe
  C:\Windows\System\FvPLAiF.exe
  2⤵
  PID:5640
- C:\Windows\System\dgCoiAj.exe
  C:\Windows\System\dgCoiAj.exe
  2⤵
  PID:5296
- C:\Windows\System\EIohVPQ.exe
  C:\Windows\System\EIohVPQ.exe
  2⤵
  PID:5360
- C:\Windows\System\CSrvhgN.exe
  C:\Windows\System\CSrvhgN.exe
  2⤵
  PID:5428
- C:\Windows\System\CxXUTfK.exe
  C:\Windows\System\CxXUTfK.exe
  2⤵
  PID:5496
- C:\Windows\System\KzehaZi.exe
  C:\Windows\System\KzehaZi.exe
  2⤵
  PID:5560
- C:\Windows\System\yPEJOkr.exe
  C:\Windows\System\yPEJOkr.exe
  2⤵
  PID:5628
- C:\Windows\System\KdlEWLW.exe
  C:\Windows\System\KdlEWLW.exe
  2⤵
  PID:5688
- C:\Windows\System\pGkbetr.exe
  C:\Windows\System\pGkbetr.exe
  2⤵
  PID:5752
- C:\Windows\System\dDZBepg.exe
  C:\Windows\System\dDZBepg.exe
  2⤵
  PID:5792
- C:\Windows\System\bNyvshS.exe
  C:\Windows\System\bNyvshS.exe
  2⤵
  PID:5384
- C:\Windows\System\nfHbeyy.exe
  C:\Windows\System\nfHbeyy.exe
  2⤵
  PID:5864
- C:\Windows\System\DYFVBFP.exe
  C:\Windows\System\DYFVBFP.exe
  2⤵
  PID:5840
- C:\Windows\System\jTErJFd.exe
  C:\Windows\System\jTErJFd.exe
  2⤵
  PID:5672
- C:\Windows\System\IGGTZMN.exe
  C:\Windows\System\IGGTZMN.exe
  2⤵
  PID:5912
- C:\Windows\System\YYCriIS.exe
  C:\Windows\System\YYCriIS.exe
  2⤵
  PID:5976
- C:\Windows\System\IqObvmw.exe
  C:\Windows\System\IqObvmw.exe
  2⤵
  PID:6012
- C:\Windows\System\CsNLHdK.exe
  C:\Windows\System\CsNLHdK.exe
  2⤵
  PID:6080
- C:\Windows\System\NFObiHa.exe
  C:\Windows\System\NFObiHa.exe
  2⤵
  PID:2488
- C:\Windows\System\sKNMFYI.exe
  C:\Windows\System\sKNMFYI.exe
  2⤵
  PID:5132
- C:\Windows\System\gmQjHcQ.exe
  C:\Windows\System\gmQjHcQ.exe
  2⤵
  PID:5776
- C:\Windows\System\TBcczkl.exe
  C:\Windows\System\TBcczkl.exe
  2⤵
  PID:5896
- C:\Windows\System\FLbQuSJ.exe
  C:\Windows\System\FLbQuSJ.exe
  2⤵
  PID:6028
- C:\Windows\System\dyPjwHC.exe
  C:\Windows\System\dyPjwHC.exe
  2⤵
  PID:6096
- C:\Windows\System\yPjNTrt.exe
  C:\Windows\System\yPjNTrt.exe
  2⤵
  PID:5180
- C:\Windows\System\FUUnfho.exe
  C:\Windows\System\FUUnfho.exe
  2⤵
  PID:5248
- C:\Windows\System\vYJHjSD.exe
  C:\Windows\System\vYJHjSD.exe
  2⤵
  PID:5484
- C:\Windows\System\FqrkIkG.exe
  C:\Windows\System\FqrkIkG.exe
  2⤵
  PID:5960
- C:\Windows\System\FrIefMi.exe
  C:\Windows\System\FrIefMi.exe
  2⤵
  PID:6128
- C:\Windows\System\DkiYTjP.exe
  C:\Windows\System\DkiYTjP.exe
  2⤵
  PID:3452
- C:\Windows\System\XSiRMht.exe
  C:\Windows\System\XSiRMht.exe
  2⤵
  PID:5596
- C:\Windows\System\OkgkLFD.exe
  C:\Windows\System\OkgkLFD.exe
  2⤵
  PID:5592
- C:\Windows\System\JLLwCoC.exe
  C:\Windows\System\JLLwCoC.exe
  2⤵
  PID:5548
- C:\Windows\System\xTFjOGc.exe
  C:\Windows\System\xTFjOGc.exe
  2⤵
  PID:5532
- C:\Windows\System\dzdyMHy.exe
  C:\Windows\System\dzdyMHy.exe
  2⤵
  PID:5268
- C:\Windows\System\QuHwEky.exe
  C:\Windows\System\QuHwEky.exe
  2⤵
  PID:5656
- C:\Windows\System\QRlVXdS.exe
  C:\Windows\System\QRlVXdS.exe
  2⤵
  PID:5872
- C:\Windows\System\LOOOlMH.exe
  C:\Windows\System\LOOOlMH.exe
  2⤵
  PID:5948
- C:\Windows\System\SVbzZHZ.exe
  C:\Windows\System\SVbzZHZ.exe
  2⤵
  PID:6044
- C:\Windows\System\PHPNjBB.exe
  C:\Windows\System\PHPNjBB.exe
  2⤵
  PID:5228
- C:\Windows\System\aRJIEMF.exe
  C:\Windows\System\aRJIEMF.exe
  2⤵
  PID:6112
- C:\Windows\System\YbGxPlj.exe
  C:\Windows\System\YbGxPlj.exe
  2⤵
  PID:5836
- C:\Windows\System\qnCrOhh.exe
  C:\Windows\System\qnCrOhh.exe
  2⤵
  PID:5224
- C:\Windows\System\PFDMqfb.exe
  C:\Windows\System\PFDMqfb.exe
  2⤵
  PID:5328
- C:\Windows\System\tFvkpIU.exe
  C:\Windows\System\tFvkpIU.exe
  2⤵
  PID:5480
- C:\Windows\System\OAMTqqE.exe
  C:\Windows\System\OAMTqqE.exe
  2⤵
  PID:6132
- C:\Windows\System\PXGhbNo.exe
  C:\Windows\System\PXGhbNo.exe
  2⤵
  PID:5264
- C:\Windows\System\CwiKVxN.exe
  C:\Windows\System\CwiKVxN.exe
  2⤵
  PID:5396
- C:\Windows\System\vXsNiyn.exe
  C:\Windows\System\vXsNiyn.exe
  2⤵
  PID:2304
- C:\Windows\System\bLshFnz.exe
  C:\Windows\System\bLshFnz.exe
  2⤵
  PID:5852
- C:\Windows\System\sWGzCqX.exe
  C:\Windows\System\sWGzCqX.exe
  2⤵
  PID:5808
- C:\Windows\System\soFcMYG.exe
  C:\Windows\System\soFcMYG.exe
  2⤵
  PID:5804
- C:\Windows\System\JUKoTcj.exe
  C:\Windows\System\JUKoTcj.exe
  2⤵
  PID:5856
- C:\Windows\System\iULeOzU.exe
  C:\Windows\System\iULeOzU.exe
  2⤵
  PID:6148
- C:\Windows\System\TNfyOCj.exe
  C:\Windows\System\TNfyOCj.exe
  2⤵
  PID:6164
- C:\Windows\System\TfaUMxC.exe
  C:\Windows\System\TfaUMxC.exe
  2⤵
  PID:6180
- C:\Windows\System\WFVeuXG.exe
  C:\Windows\System\WFVeuXG.exe
  2⤵
  PID:6196
- C:\Windows\System\rAfQmTB.exe
  C:\Windows\System\rAfQmTB.exe
  2⤵
  PID:6212
- C:\Windows\System\PGMgpqt.exe
  C:\Windows\System\PGMgpqt.exe
  2⤵
  PID:6228
- C:\Windows\System\yyWUeWe.exe
  C:\Windows\System\yyWUeWe.exe
  2⤵
  PID:6244
- C:\Windows\System\AfEWqiI.exe
  C:\Windows\System\AfEWqiI.exe
  2⤵
  PID:6260
- C:\Windows\System\FsydGQC.exe
  C:\Windows\System\FsydGQC.exe
  2⤵
  PID:6276
- C:\Windows\System\Zqofavm.exe
  C:\Windows\System\Zqofavm.exe
  2⤵
  PID:6292
- C:\Windows\System\xNSFics.exe
  C:\Windows\System\xNSFics.exe
  2⤵
  PID:6308
- C:\Windows\System\jaejqMc.exe
  C:\Windows\System\jaejqMc.exe
  2⤵
  PID:6324
- C:\Windows\System\dUyYZbb.exe
  C:\Windows\System\dUyYZbb.exe
  2⤵
  PID:6340
- C:\Windows\System\FBShzcc.exe
  C:\Windows\System\FBShzcc.exe
  2⤵
  PID:6356
- C:\Windows\System\DvIQpdt.exe
  C:\Windows\System\DvIQpdt.exe
  2⤵
  PID:6372
- C:\Windows\System\TGnngVg.exe
  C:\Windows\System\TGnngVg.exe
  2⤵
  PID:6388
- C:\Windows\System\rLiAPHM.exe
  C:\Windows\System\rLiAPHM.exe
  2⤵
  PID:6404
- C:\Windows\System\MZFsbLG.exe
  C:\Windows\System\MZFsbLG.exe
  2⤵
  PID:6420
- C:\Windows\System\zXlPbno.exe
  C:\Windows\System\zXlPbno.exe
  2⤵
  PID:6436
- C:\Windows\System\xDKDMuV.exe
  C:\Windows\System\xDKDMuV.exe
  2⤵
  PID:6452
- C:\Windows\System\FGXZUIm.exe
  C:\Windows\System\FGXZUIm.exe
  2⤵
  PID:6468
- C:\Windows\System\HXtsfpc.exe
  C:\Windows\System\HXtsfpc.exe
  2⤵
  PID:6484
- C:\Windows\System\xOmMteD.exe
  C:\Windows\System\xOmMteD.exe
  2⤵
  PID:6500
- C:\Windows\System\abgqMqd.exe
  C:\Windows\System\abgqMqd.exe
  2⤵
  PID:6516
- C:\Windows\System\BRgQdzr.exe
  C:\Windows\System\BRgQdzr.exe
  2⤵
  PID:6532
- C:\Windows\System\GGBiOnV.exe
  C:\Windows\System\GGBiOnV.exe
  2⤵
  PID:6548
- C:\Windows\System\PnrvAqh.exe
  C:\Windows\System\PnrvAqh.exe
  2⤵
  PID:6564
- C:\Windows\System\kpaQIaP.exe
  C:\Windows\System\kpaQIaP.exe
  2⤵
  PID:6580
- C:\Windows\System\pUhjtmv.exe
  C:\Windows\System\pUhjtmv.exe
  2⤵
  PID:6596
- C:\Windows\System\EYwMjFP.exe
  C:\Windows\System\EYwMjFP.exe
  2⤵
  PID:6612
- C:\Windows\System\nmpgbSX.exe
  C:\Windows\System\nmpgbSX.exe
  2⤵
  PID:6628
- C:\Windows\System\kBQoGqe.exe
  C:\Windows\System\kBQoGqe.exe
  2⤵
  PID:6644
- C:\Windows\System\yGDQNRK.exe
  C:\Windows\System\yGDQNRK.exe
  2⤵
  PID:6664
- C:\Windows\System\cfPlVCD.exe
  C:\Windows\System\cfPlVCD.exe
  2⤵
  PID:6680
- C:\Windows\System\tvPttoE.exe
  C:\Windows\System\tvPttoE.exe
  2⤵
  PID:6696
- C:\Windows\System\qJGyuQJ.exe
  C:\Windows\System\qJGyuQJ.exe
  2⤵
  PID:6712
- C:\Windows\System\LaIvnSl.exe
  C:\Windows\System\LaIvnSl.exe
  2⤵
  PID:6728
- C:\Windows\System\njbpkEo.exe
  C:\Windows\System\njbpkEo.exe
  2⤵
  PID:6744
- C:\Windows\System\KIemJzb.exe
  C:\Windows\System\KIemJzb.exe
  2⤵
  PID:6760
- C:\Windows\System\LBUSKuJ.exe
  C:\Windows\System\LBUSKuJ.exe
  2⤵
  PID:6776
- C:\Windows\System\eeDMYDO.exe
  C:\Windows\System\eeDMYDO.exe
  2⤵
  PID:6792
- C:\Windows\System\xPtSYQP.exe
  C:\Windows\System\xPtSYQP.exe
  2⤵
  PID:6808
- C:\Windows\System\uGPQOhg.exe
  C:\Windows\System\uGPQOhg.exe
  2⤵
  PID:6828
- C:\Windows\System\aAhWIZo.exe
  C:\Windows\System\aAhWIZo.exe
  2⤵
  PID:6844
- C:\Windows\System\kGAOhoQ.exe
  C:\Windows\System\kGAOhoQ.exe
  2⤵
  PID:6860
- C:\Windows\System\wBUPaHM.exe
  C:\Windows\System\wBUPaHM.exe
  2⤵
  PID:6876
- C:\Windows\System\bCQujya.exe
  C:\Windows\System\bCQujya.exe
  2⤵
  PID:6892
- C:\Windows\System\IQOlKRi.exe
  C:\Windows\System\IQOlKRi.exe
  2⤵
  PID:6908
- C:\Windows\System\tuJdrrl.exe
  C:\Windows\System\tuJdrrl.exe
  2⤵
  PID:6924
- C:\Windows\System\HYnYnlP.exe
  C:\Windows\System\HYnYnlP.exe
  2⤵
  PID:6940
- C:\Windows\System\hgvTOxv.exe
  C:\Windows\System\hgvTOxv.exe
  2⤵
  PID:6956
- C:\Windows\System\emzpMuQ.exe
  C:\Windows\System\emzpMuQ.exe
  2⤵
  PID:6972
- C:\Windows\System\ZmDtURC.exe
  C:\Windows\System\ZmDtURC.exe
  2⤵
  PID:6988
- C:\Windows\System\NZUDiRL.exe
  C:\Windows\System\NZUDiRL.exe
  2⤵
  PID:7004
- C:\Windows\System\cFrItvS.exe
  C:\Windows\System\cFrItvS.exe
  2⤵
  PID:7020
- C:\Windows\System\ojRlmBi.exe
  C:\Windows\System\ojRlmBi.exe
  2⤵
  PID:7036
- C:\Windows\System\mrVetik.exe
  C:\Windows\System\mrVetik.exe
  2⤵
  PID:7052
- C:\Windows\System\eTlVlRF.exe
  C:\Windows\System\eTlVlRF.exe
  2⤵
  PID:7068
- C:\Windows\System\vsQvDJe.exe
  C:\Windows\System\vsQvDJe.exe
  2⤵
  PID:7084
- C:\Windows\System\OcZYrep.exe
  C:\Windows\System\OcZYrep.exe
  2⤵
  PID:7104
- C:\Windows\System\VlGwXID.exe
  C:\Windows\System\VlGwXID.exe
  2⤵
  PID:7120
- C:\Windows\System\tekeaye.exe
  C:\Windows\System\tekeaye.exe
  2⤵
  PID:7136
- C:\Windows\System\MLxMRvp.exe
  C:\Windows\System\MLxMRvp.exe
  2⤵
  PID:7156
- C:\Windows\System\TtOSdhH.exe
  C:\Windows\System\TtOSdhH.exe
  2⤵
  PID:5928
- C:\Windows\System\FsVCNxl.exe
  C:\Windows\System\FsVCNxl.exe
  2⤵
  PID:5464
- C:\Windows\System\tiEGcxH.exe
  C:\Windows\System\tiEGcxH.exe
  2⤵
  PID:5964
- C:\Windows\System\DqGSCqZ.exe
  C:\Windows\System\DqGSCqZ.exe
  2⤵
  PID:6176
- C:\Windows\System\KbBsXhW.exe
  C:\Windows\System\KbBsXhW.exe
  2⤵
  PID:6240
- C:\Windows\System\XOXYoBw.exe
  C:\Windows\System\XOXYoBw.exe
  2⤵
  PID:6304
- C:\Windows\System\jwsujBK.exe
  C:\Windows\System\jwsujBK.exe
  2⤵
  PID:6368
- C:\Windows\System\pjmcxMO.exe
  C:\Windows\System\pjmcxMO.exe
  2⤵
  PID:6460
- C:\Windows\System\mLrVOVf.exe
  C:\Windows\System\mLrVOVf.exe
  2⤵
  PID:6524
- C:\Windows\System\ezRbNCH.exe
  C:\Windows\System\ezRbNCH.exe
  2⤵
  PID:6588
- C:\Windows\System\JbzUFXk.exe
  C:\Windows\System\JbzUFXk.exe
  2⤵
  PID:6652
- C:\Windows\System\DUGLMiT.exe
  C:\Windows\System\DUGLMiT.exe
  2⤵
  PID:6688
- C:\Windows\System\nBigQEY.exe
  C:\Windows\System\nBigQEY.exe
  2⤵
  PID:6756
- C:\Windows\System\TlaVxQm.exe
  C:\Windows\System\TlaVxQm.exe
  2⤵
  PID:6288
- C:\Windows\System\KAuIcup.exe
  C:\Windows\System\KAuIcup.exe
  2⤵
  PID:6640
- C:\Windows\System\XrNqRke.exe
  C:\Windows\System\XrNqRke.exe
  2⤵
  PID:5740
- C:\Windows\System\emcRTYW.exe
  C:\Windows\System\emcRTYW.exe
  2⤵
  PID:6884
- C:\Windows\System\dmgTqmS.exe
  C:\Windows\System\dmgTqmS.exe
  2⤵
  PID:6160
- C:\Windows\System\MSfMVlX.exe
  C:\Windows\System\MSfMVlX.exe
  2⤵
  PID:6224
- C:\Windows\System\MXYFzDR.exe
  C:\Windows\System\MXYFzDR.exe
  2⤵
  PID:6772
- C:\Windows\System\fQknDlA.exe
  C:\Windows\System\fQknDlA.exe
  2⤵
  PID:6316
- C:\Windows\System\QdgWnYO.exe
  C:\Windows\System\QdgWnYO.exe
  2⤵
  PID:6380
- C:\Windows\System\yraMshe.exe
  C:\Windows\System\yraMshe.exe
  2⤵
  PID:6448
- C:\Windows\System\aoQaMRd.exe
  C:\Windows\System\aoQaMRd.exe
  2⤵
  PID:6512
- C:\Windows\System\thBdHYy.exe
  C:\Windows\System\thBdHYy.exe
  2⤵
  PID:6576
- C:\Windows\System\wOlMjdc.exe
  C:\Windows\System\wOlMjdc.exe
  2⤵
  PID:6740
- C:\Windows\System\fqDeGMT.exe
  C:\Windows\System\fqDeGMT.exe
  2⤵
  PID:6840
- C:\Windows\System\nkOWJtz.exe
  C:\Windows\System\nkOWJtz.exe
  2⤵
  PID:6968
- C:\Windows\System\LIJZCto.exe
  C:\Windows\System\LIJZCto.exe
  2⤵
  PID:6952
- C:\Windows\System\qhxAQmK.exe
  C:\Windows\System\qhxAQmK.exe
  2⤵
  PID:7016
- C:\Windows\System\sIvxCCn.exe
  C:\Windows\System\sIvxCCn.exe
  2⤵
  PID:7048
- C:\Windows\System\YVBlePA.exe
  C:\Windows\System\YVBlePA.exe
  2⤵
  PID:7116
- C:\Windows\System\lrlsQFw.exe
  C:\Windows\System\lrlsQFw.exe
  2⤵
  PID:5208
- C:\Windows\System\NKcwyPi.exe
  C:\Windows\System\NKcwyPi.exe
  2⤵
  PID:7092
- C:\Windows\System\xySbQUm.exe
  C:\Windows\System\xySbQUm.exe
  2⤵
  PID:6272
- C:\Windows\System\SRyygCb.exe
  C:\Windows\System\SRyygCb.exe
  2⤵
  PID:6432
- C:\Windows\System\nHdURLB.exe
  C:\Windows\System\nHdURLB.exe
  2⤵
  PID:7164
- C:\Windows\System\TYMvPkR.exe
  C:\Windows\System\TYMvPkR.exe
  2⤵
  PID:6208
- C:\Windows\System\gsDOmzB.exe
  C:\Windows\System\gsDOmzB.exe
  2⤵
  PID:6560
- C:\Windows\System\hDYMEIi.exe
  C:\Windows\System\hDYMEIi.exe
  2⤵
  PID:6492
- C:\Windows\System\WxKYnxr.exe
  C:\Windows\System\WxKYnxr.exe
  2⤵
  PID:6724
- C:\Windows\System\FCiYGTq.exe
  C:\Windows\System\FCiYGTq.exe
  2⤵
  PID:6820
- C:\Windows\System\eDxrxNK.exe
  C:\Windows\System\eDxrxNK.exe
  2⤵
  PID:5544
- C:\Windows\System\ZDPzbep.exe
  C:\Windows\System\ZDPzbep.exe
  2⤵
  PID:6192
- C:\Windows\System\ddiurds.exe
  C:\Windows\System\ddiurds.exe
  2⤵
  PID:6800
- C:\Windows\System\qVhpNUl.exe
  C:\Windows\System\qVhpNUl.exe
  2⤵
  PID:6476
- C:\Windows\System\YpVIGyr.exe
  C:\Windows\System\YpVIGyr.exe
  2⤵
  PID:6412
- C:\Windows\System\orokxCU.exe
  C:\Windows\System\orokxCU.exe
  2⤵
  PID:6932
- C:\Windows\System\tFxFBaW.exe
  C:\Windows\System\tFxFBaW.exe
  2⤵
  PID:6936
- C:\Windows\System\HIejICy.exe
  C:\Windows\System\HIejICy.exe
  2⤵
  PID:6948
- C:\Windows\System\bHWfJaz.exe
  C:\Windows\System\bHWfJaz.exe
  2⤵
  PID:7144
- C:\Windows\System\CrQxDJQ.exe
  C:\Windows\System\CrQxDJQ.exe
  2⤵
  PID:6428
- C:\Windows\System\ajRKdfo.exe
  C:\Windows\System\ajRKdfo.exe
  2⤵
  PID:6980
- C:\Windows\System\CtUDpDe.exe
  C:\Windows\System\CtUDpDe.exe
  2⤵
  PID:7128
- C:\Windows\System\ZskbYBF.exe
  C:\Windows\System\ZskbYBF.exe
  2⤵
  PID:5884
- C:\Windows\System\kOXJJRw.exe
  C:\Windows\System\kOXJJRw.exe
  2⤵
  PID:6624
- C:\Windows\System\wUtkeKj.exe
  C:\Windows\System\wUtkeKj.exe
  2⤵
  PID:6804
- C:\Windows\System\XJfoHuD.exe
  C:\Windows\System\XJfoHuD.exe
  2⤵
  PID:6856
- C:\Windows\System\VaXtVzA.exe
  C:\Windows\System\VaXtVzA.exe
  2⤵
  PID:6672
- C:\Windows\System\lKYAaCK.exe
  C:\Windows\System\lKYAaCK.exe
  2⤵
  PID:6996
- C:\Windows\System\oJKzZAZ.exe
  C:\Windows\System\oJKzZAZ.exe
  2⤵
  PID:7064
- C:\Windows\System\NQvIDHZ.exe
  C:\Windows\System\NQvIDHZ.exe
  2⤵
  PID:6788
- C:\Windows\System\brhNkyQ.exe
  C:\Windows\System\brhNkyQ.exe
  2⤵
  PID:7152
- C:\Windows\System\DvoOWZz.exe
  C:\Windows\System\DvoOWZz.exe
  2⤵
  PID:7176
- C:\Windows\System\azgomav.exe
  C:\Windows\System\azgomav.exe
  2⤵
  PID:7192
- C:\Windows\System\cPghzTx.exe
  C:\Windows\System\cPghzTx.exe
  2⤵
  PID:7208
- C:\Windows\System\GzleMHx.exe
  C:\Windows\System\GzleMHx.exe
  2⤵
  PID:7224
- C:\Windows\System\MIHqnPX.exe
  C:\Windows\System\MIHqnPX.exe
  2⤵
  PID:7240
- C:\Windows\System\dhUPElj.exe
  C:\Windows\System\dhUPElj.exe
  2⤵
  PID:7256
- C:\Windows\System\pMXdDQI.exe
  C:\Windows\System\pMXdDQI.exe
  2⤵
  PID:7272
- C:\Windows\System\VrPmzse.exe
  C:\Windows\System\VrPmzse.exe
  2⤵
  PID:7292
- C:\Windows\System\YAauTgX.exe
  C:\Windows\System\YAauTgX.exe
  2⤵
  PID:7308
- C:\Windows\System\ByLvBvy.exe
  C:\Windows\System\ByLvBvy.exe
  2⤵
  PID:7324
- C:\Windows\System\zYAEzQc.exe
  C:\Windows\System\zYAEzQc.exe
  2⤵
  PID:7340
- C:\Windows\System\nISGwlN.exe
  C:\Windows\System\nISGwlN.exe
  2⤵
  PID:7356
- C:\Windows\System\Fmfzoxy.exe
  C:\Windows\System\Fmfzoxy.exe
  2⤵
  PID:7372
- C:\Windows\System\mNRirzu.exe
  C:\Windows\System\mNRirzu.exe
  2⤵
  PID:7388
- C:\Windows\System\UCNXqIi.exe
  C:\Windows\System\UCNXqIi.exe
  2⤵
  PID:7404
- C:\Windows\System\wlkGvgZ.exe
  C:\Windows\System\wlkGvgZ.exe
  2⤵
  PID:7420
- C:\Windows\System\WUGtXlR.exe
  C:\Windows\System\WUGtXlR.exe
  2⤵
  PID:7436
- C:\Windows\System\tIcugnU.exe
  C:\Windows\System\tIcugnU.exe
  2⤵
  PID:7452
- C:\Windows\System\sLUMUpT.exe
  C:\Windows\System\sLUMUpT.exe
  2⤵
  PID:7468
- C:\Windows\System\sUIZkMp.exe
  C:\Windows\System\sUIZkMp.exe
  2⤵
  PID:7484
- C:\Windows\System\iJrfCIa.exe
  C:\Windows\System\iJrfCIa.exe
  2⤵
  PID:7500
- C:\Windows\System\MBKujvl.exe
  C:\Windows\System\MBKujvl.exe
  2⤵
  PID:7516
- C:\Windows\System\ORNlGzj.exe
  C:\Windows\System\ORNlGzj.exe
  2⤵
  PID:7532
- C:\Windows\System\HKlzQtj.exe
  C:\Windows\System\HKlzQtj.exe
  2⤵
  PID:7548
- C:\Windows\System\JbBWUaO.exe
  C:\Windows\System\JbBWUaO.exe
  2⤵
  PID:7568
- C:\Windows\System\BsYgLxs.exe
  C:\Windows\System\BsYgLxs.exe
  2⤵
  PID:7584
- C:\Windows\System\HkMQEmh.exe
  C:\Windows\System\HkMQEmh.exe
  2⤵
  PID:7600
- C:\Windows\System\XRhvsrH.exe
  C:\Windows\System\XRhvsrH.exe
  2⤵
  PID:7616
- C:\Windows\System\jLrJUce.exe
  C:\Windows\System\jLrJUce.exe
  2⤵
  PID:7632
- C:\Windows\System\JUUrwqz.exe
  C:\Windows\System\JUUrwqz.exe
  2⤵
  PID:7648
- C:\Windows\System\WOZarkK.exe
  C:\Windows\System\WOZarkK.exe
  2⤵
  PID:7664
- C:\Windows\System\wDZxAsb.exe
  C:\Windows\System\wDZxAsb.exe
  2⤵
  PID:7680
- C:\Windows\System\ZFUYhyO.exe
  C:\Windows\System\ZFUYhyO.exe
  2⤵
  PID:7696
- C:\Windows\System\GywDobC.exe
  C:\Windows\System\GywDobC.exe
  2⤵
  PID:7712
- C:\Windows\System\QDWmRqy.exe
  C:\Windows\System\QDWmRqy.exe
  2⤵
  PID:7728
- C:\Windows\System\hmxrEUi.exe
  C:\Windows\System\hmxrEUi.exe
  2⤵
  PID:7744
- C:\Windows\System\jOyqjjl.exe
  C:\Windows\System\jOyqjjl.exe
  2⤵
  PID:7764
- C:\Windows\System\wBsjAoo.exe
  C:\Windows\System\wBsjAoo.exe
  2⤵
  PID:7780
- C:\Windows\System\fOgZxdR.exe
  C:\Windows\System\fOgZxdR.exe
  2⤵
  PID:7800
- C:\Windows\System\tusuMWp.exe
  C:\Windows\System\tusuMWp.exe
  2⤵
  PID:7816
- C:\Windows\System\XCpAfMO.exe
  C:\Windows\System\XCpAfMO.exe
  2⤵
  PID:7832
- C:\Windows\System\VLBekLC.exe
  C:\Windows\System\VLBekLC.exe
  2⤵
  PID:7848
- C:\Windows\System\YQvDwug.exe
  C:\Windows\System\YQvDwug.exe
  2⤵
  PID:7864
- C:\Windows\System\OkQOfTz.exe
  C:\Windows\System\OkQOfTz.exe
  2⤵
  PID:7880
- C:\Windows\System\mSiFbPd.exe
  C:\Windows\System\mSiFbPd.exe
  2⤵
  PID:7896
- C:\Windows\System\PrLOWqc.exe
  C:\Windows\System\PrLOWqc.exe
  2⤵
  PID:7912
- C:\Windows\System\jIaiaHs.exe
  C:\Windows\System\jIaiaHs.exe
  2⤵
  PID:7928
- C:\Windows\System\QUUIMqt.exe
  C:\Windows\System\QUUIMqt.exe
  2⤵
  PID:7944
- C:\Windows\System\QYNkZlg.exe
  C:\Windows\System\QYNkZlg.exe
  2⤵
  PID:7960
- C:\Windows\System\iAFQeWZ.exe
  C:\Windows\System\iAFQeWZ.exe
  2⤵
  PID:7976
- C:\Windows\System\eIpsXtf.exe
  C:\Windows\System\eIpsXtf.exe
  2⤵
  PID:7992
- C:\Windows\System\KrUGYRs.exe
  C:\Windows\System\KrUGYRs.exe
  2⤵
  PID:8008
- C:\Windows\System\dwGibSd.exe
  C:\Windows\System\dwGibSd.exe
  2⤵
  PID:8024
- C:\Windows\System\MUjFTBG.exe
  C:\Windows\System\MUjFTBG.exe
  2⤵
  PID:8040
- C:\Windows\System\xMpqWzY.exe
  C:\Windows\System\xMpqWzY.exe
  2⤵
  PID:8056
- C:\Windows\System\mRZCZle.exe
  C:\Windows\System\mRZCZle.exe
  2⤵
  PID:8072
- C:\Windows\System\LDOzZYX.exe
  C:\Windows\System\LDOzZYX.exe
  2⤵
  PID:8088
- C:\Windows\System\EyvyQcY.exe
  C:\Windows\System\EyvyQcY.exe
  2⤵
  PID:8104
- C:\Windows\System\pIrobyu.exe
  C:\Windows\System\pIrobyu.exe
  2⤵
  PID:8120
- C:\Windows\System\uClTAXd.exe
  C:\Windows\System\uClTAXd.exe
  2⤵
  PID:8136
- C:\Windows\System\ErScBHG.exe
  C:\Windows\System\ErScBHG.exe
  2⤵
  PID:8152
- C:\Windows\System\BzfYTAK.exe
  C:\Windows\System\BzfYTAK.exe
  2⤵
  PID:8168
- C:\Windows\System\crxRCwk.exe
  C:\Windows\System\crxRCwk.exe
  2⤵
  PID:8184
- C:\Windows\System\qznGhSq.exe
  C:\Windows\System\qznGhSq.exe
  2⤵
  PID:7172
- C:\Windows\System\lbExXxy.exe
  C:\Windows\System\lbExXxy.exe
  2⤵
  PID:6872
- C:\Windows\System\qsIgaiW.exe
  C:\Windows\System\qsIgaiW.exe
  2⤵
  PID:6336
- C:\Windows\System\oLxjAGF.exe
  C:\Windows\System\oLxjAGF.exe
  2⤵
  PID:6572
- C:\Windows\System\xlGEsOt.exe
  C:\Windows\System\xlGEsOt.exe
  2⤵
  PID:6768
- C:\Windows\System\OQqmfFp.exe
  C:\Windows\System\OQqmfFp.exe
  2⤵
  PID:7204
- C:\Windows\System\vjGbGLn.exe
  C:\Windows\System\vjGbGLn.exe
  2⤵
  PID:7248
- C:\Windows\System\GrCvHyl.exe
  C:\Windows\System\GrCvHyl.exe
  2⤵
  PID:7300
- C:\Windows\System\OJPKaza.exe
  C:\Windows\System\OJPKaza.exe
  2⤵
  PID:7336
- C:\Windows\System\FxVwPHv.exe
  C:\Windows\System\FxVwPHv.exe
  2⤵
  PID:7396
- C:\Windows\System\FARoLpf.exe
  C:\Windows\System\FARoLpf.exe
  2⤵
  PID:7348
- C:\Windows\System\BXqZcOp.exe
  C:\Windows\System\BXqZcOp.exe
  2⤵
  PID:7428
- C:\Windows\System\gNRSoBT.exe
  C:\Windows\System\gNRSoBT.exe
  2⤵
  PID:7464
- C:\Windows\System\EuWHsQQ.exe
  C:\Windows\System\EuWHsQQ.exe
  2⤵
  PID:7476
- C:\Windows\System\TEcqjze.exe
  C:\Windows\System\TEcqjze.exe
  2⤵
  PID:7512
- C:\Windows\System\czoGuWH.exe
  C:\Windows\System\czoGuWH.exe
  2⤵
  PID:7540
- C:\Windows\System\bVoAdWR.exe
  C:\Windows\System\bVoAdWR.exe
  2⤵
  PID:5244
- C:\Windows\System\zFeJYRJ.exe
  C:\Windows\System\zFeJYRJ.exe
  2⤵
  PID:7624
- C:\Windows\System\hIdSRRF.exe
  C:\Windows\System\hIdSRRF.exe
  2⤵
  PID:7656
- C:\Windows\System\fWRNExI.exe
  C:\Windows\System\fWRNExI.exe
  2⤵
  PID:7660
- C:\Windows\System\GBkHTKZ.exe
  C:\Windows\System\GBkHTKZ.exe
  2⤵
  PID:7644
- C:\Windows\System\FpZTLUv.exe
  C:\Windows\System\FpZTLUv.exe
  2⤵
  PID:2460
- C:\Windows\System\XTMtiWk.exe
  C:\Windows\System\XTMtiWk.exe
  2⤵
  PID:7740
- C:\Windows\System\CgpMtFi.exe
  C:\Windows\System\CgpMtFi.exe
  2⤵
  PID:7772
- C:\Windows\System\IKNmaxw.exe
  C:\Windows\System\IKNmaxw.exe
  2⤵
  PID:7724
- C:\Windows\System\OebfsNb.exe
  C:\Windows\System\OebfsNb.exe
  2⤵
  PID:7860
- C:\Windows\System\WqNKrLA.exe
  C:\Windows\System\WqNKrLA.exe
  2⤵
  PID:7828
- C:\Windows\System\TNJOUAC.exe
  C:\Windows\System\TNJOUAC.exe
  2⤵
  PID:7908
- C:\Windows\System\uljqeEJ.exe
  C:\Windows\System\uljqeEJ.exe
  2⤵
  PID:7924
- C:\Windows\System\wpBKujU.exe
  C:\Windows\System\wpBKujU.exe
  2⤵
  PID:7956
- C:\Windows\System\ALzjTJP.exe
  C:\Windows\System\ALzjTJP.exe
  2⤵
  PID:7968
- C:\Windows\System\UosekMM.exe
  C:\Windows\System\UosekMM.exe
  2⤵
  PID:8048
- C:\Windows\System\BcMEUyf.exe
  C:\Windows\System\BcMEUyf.exe
  2⤵
  PID:8064
- C:\Windows\System\MpbjhDq.exe
  C:\Windows\System\MpbjhDq.exe
  2⤵
  PID:8084
- C:\Windows\System\gIABziX.exe
  C:\Windows\System\gIABziX.exe
  2⤵
  PID:8112
- C:\Windows\System\hHtzvgO.exe
  C:\Windows\System\hHtzvgO.exe
  2⤵
  PID:8176
- C:\Windows\System\QNTnAnZ.exe
  C:\Windows\System\QNTnAnZ.exe
  2⤵
  PID:7188
- C:\Windows\System\VFgNoVH.exe
  C:\Windows\System\VFgNoVH.exe
  2⤵
  PID:6284
- C:\Windows\System\fPuwMTw.exe
  C:\Windows\System\fPuwMTw.exe
  2⤵
  PID:6736
- C:\Windows\System\tNTUvvg.exe
  C:\Windows\System\tNTUvvg.exe
  2⤵
  PID:7236
- C:\Windows\System\AjLlQOx.exe
  C:\Windows\System\AjLlQOx.exe
  2⤵
  PID:7220
- C:\Windows\System\XtSJntR.exe
  C:\Windows\System\XtSJntR.exe
  2⤵
  PID:7416
- C:\Windows\System\wjCLrWP.exe
  C:\Windows\System\wjCLrWP.exe
  2⤵
  PID:7368
- C:\Windows\System\sINpwaj.exe
  C:\Windows\System\sINpwaj.exe
  2⤵
  PID:7508
- C:\Windows\System\sVCutQu.exe
  C:\Windows\System\sVCutQu.exe
  2⤵
  PID:7612
- C:\Windows\System\jvBKywt.exe
  C:\Windows\System\jvBKywt.exe
  2⤵
  PID:7492
- C:\Windows\System\gBgYSeP.exe
  C:\Windows\System\gBgYSeP.exe
  2⤵
  PID:7692
- C:\Windows\System\KHbwPQg.exe
  C:\Windows\System\KHbwPQg.exe
  2⤵
  PID:7872
- C:\Windows\System\VYwmJWe.exe
  C:\Windows\System\VYwmJWe.exe
  2⤵
  PID:7940
- C:\Windows\System\DIIhZVJ.exe
  C:\Windows\System\DIIhZVJ.exe
  2⤵
  PID:8004
- C:\Windows\System\tNfmRvM.exe
  C:\Windows\System\tNfmRvM.exe
  2⤵
  PID:7216
- C:\Windows\System\SqFYNsA.exe
  C:\Windows\System\SqFYNsA.exe
  2⤵
  PID:7280
- C:\Windows\System\DDjvcxC.exe
  C:\Windows\System\DDjvcxC.exe
  2⤵
  PID:7608
- C:\Windows\System\YYaSOrt.exe
  C:\Windows\System\YYaSOrt.exe
  2⤵
  PID:7640
- C:\Windows\System\BNAVlae.exe
  C:\Windows\System\BNAVlae.exe
  2⤵
  PID:8020
- C:\Windows\System\TABywxo.exe
  C:\Windows\System\TABywxo.exe
  2⤵
  PID:8096
- C:\Windows\System\sslHpJn.exe
  C:\Windows\System\sslHpJn.exe
  2⤵
  PID:7460
- C:\Windows\System\MQuSaKH.exe
  C:\Windows\System\MQuSaKH.exe
  2⤵
  PID:7952
- C:\Windows\System\FviccVJ.exe
  C:\Windows\System\FviccVJ.exe
  2⤵
  PID:7808
- C:\Windows\System\vChkSKQ.exe
  C:\Windows\System\vChkSKQ.exe
  2⤵
  PID:7904
- C:\Windows\System\SOvmNSP.exe
  C:\Windows\System\SOvmNSP.exe
  2⤵
  PID:7044
- C:\Windows\System\EBVzyzu.exe
  C:\Windows\System\EBVzyzu.exe
  2⤵
  PID:7580
- C:\Windows\System\YtwvSOZ.exe
  C:\Windows\System\YtwvSOZ.exe
  2⤵
  PID:7364
- C:\Windows\System\CTRjfTo.exe
  C:\Windows\System\CTRjfTo.exe
  2⤵
  PID:7412
- C:\Windows\System\xVXTtyD.exe
  C:\Windows\System\xVXTtyD.exe
  2⤵
  PID:7788
- C:\Windows\System\FnmZJvC.exe
  C:\Windows\System\FnmZJvC.exe
  2⤵
  PID:8148
- C:\Windows\System\GfFkcbR.exe
  C:\Windows\System\GfFkcbR.exe
  2⤵
  PID:7876
- C:\Windows\System\RufoXUJ.exe
  C:\Windows\System\RufoXUJ.exe
  2⤵
  PID:6508
- C:\Windows\System\nHqDRvi.exe
  C:\Windows\System\nHqDRvi.exe
  2⤵
  PID:8016
- C:\Windows\System\ImXtlTe.exe
  C:\Windows\System\ImXtlTe.exe
  2⤵
  PID:8160
- C:\Windows\System\nCQUcjM.exe
  C:\Windows\System\nCQUcjM.exe
  2⤵
  PID:8196
- C:\Windows\System\tdFLDNt.exe
  C:\Windows\System\tdFLDNt.exe
  2⤵
  PID:8212
- C:\Windows\System\RRAgPCm.exe
  C:\Windows\System\RRAgPCm.exe
  2⤵
  PID:8228
- C:\Windows\System\xiAIXXs.exe
  C:\Windows\System\xiAIXXs.exe
  2⤵
  PID:8244
- C:\Windows\System\FzdpzUF.exe
  C:\Windows\System\FzdpzUF.exe
  2⤵
  PID:8260
- C:\Windows\System\vIcpMQB.exe
  C:\Windows\System\vIcpMQB.exe
  2⤵
  PID:8276
- C:\Windows\System\jaPGpnq.exe
  C:\Windows\System\jaPGpnq.exe
  2⤵
  PID:8292
- C:\Windows\System\IELmmPB.exe
  C:\Windows\System\IELmmPB.exe
  2⤵
  PID:8308
- C:\Windows\System\XEqyzaL.exe
  C:\Windows\System\XEqyzaL.exe
  2⤵
  PID:8324
- C:\Windows\System\vFbmkxH.exe
  C:\Windows\System\vFbmkxH.exe
  2⤵
  PID:8340
- C:\Windows\System\ySBMpYU.exe
  C:\Windows\System\ySBMpYU.exe
  2⤵
  PID:8356
- C:\Windows\System\zudDTCj.exe
  C:\Windows\System\zudDTCj.exe
  2⤵
  PID:8372
- C:\Windows\System\hvIOYcK.exe
  C:\Windows\System\hvIOYcK.exe
  2⤵
  PID:8388
- C:\Windows\System\rjkBnoo.exe
  C:\Windows\System\rjkBnoo.exe
  2⤵
  PID:8408
- C:\Windows\System\qXgCXir.exe
  C:\Windows\System\qXgCXir.exe
  2⤵
  PID:8424
- C:\Windows\System\IwoCbZk.exe
  C:\Windows\System\IwoCbZk.exe
  2⤵
  PID:8440
- C:\Windows\System\tEhdzgc.exe
  C:\Windows\System\tEhdzgc.exe
  2⤵
  PID:8460
- C:\Windows\System\NsZZKgL.exe
  C:\Windows\System\NsZZKgL.exe
  2⤵
  PID:8476
- C:\Windows\System\tYvLvFJ.exe
  C:\Windows\System\tYvLvFJ.exe
  2⤵
  PID:8492
- C:\Windows\System\jmjgGmD.exe
  C:\Windows\System\jmjgGmD.exe
  2⤵
  PID:8508
- C:\Windows\System\PSbsZER.exe
  C:\Windows\System\PSbsZER.exe
  2⤵
  PID:8524
- C:\Windows\System\UEDDGKi.exe
  C:\Windows\System\UEDDGKi.exe
  2⤵
  PID:8540
- C:\Windows\System\rVIJVAw.exe
  C:\Windows\System\rVIJVAw.exe
  2⤵
  PID:8556
- C:\Windows\System\yAxPKZh.exe
  C:\Windows\System\yAxPKZh.exe
  2⤵
  PID:8572
- C:\Windows\System\DntkOnJ.exe
  C:\Windows\System\DntkOnJ.exe
  2⤵
  PID:8588
- C:\Windows\System\BBmPorI.exe
  C:\Windows\System\BBmPorI.exe
  2⤵
  PID:8604
- C:\Windows\System\GXIicEa.exe
  C:\Windows\System\GXIicEa.exe
  2⤵
  PID:8620
- C:\Windows\System\xtisdyz.exe
  C:\Windows\System\xtisdyz.exe
  2⤵
  PID:8636
- C:\Windows\System\LYuqlFk.exe
  C:\Windows\System\LYuqlFk.exe
  2⤵
  PID:8652
- C:\Windows\System\OAvcQuO.exe
  C:\Windows\System\OAvcQuO.exe
  2⤵
  PID:8668
- C:\Windows\System\dppNZHV.exe
  C:\Windows\System\dppNZHV.exe
  2⤵
  PID:8684
- C:\Windows\System\TSTAryo.exe
  C:\Windows\System\TSTAryo.exe
  2⤵
  PID:8700
- C:\Windows\System\MecBlAS.exe
  C:\Windows\System\MecBlAS.exe
  2⤵
  PID:8716
- C:\Windows\System\mHSEVMY.exe
  C:\Windows\System\mHSEVMY.exe
  2⤵
  PID:8732
- C:\Windows\System\yyHDPlN.exe
  C:\Windows\System\yyHDPlN.exe
  2⤵
  PID:8748
- C:\Windows\System\WhDjDht.exe
  C:\Windows\System\WhDjDht.exe
  2⤵
  PID:8768
- C:\Windows\System\VmdvUYB.exe
  C:\Windows\System\VmdvUYB.exe
  2⤵
  PID:8784
- C:\Windows\System\pGtLrzl.exe
  C:\Windows\System\pGtLrzl.exe
  2⤵
  PID:8800
- C:\Windows\System\JKNqgHD.exe
  C:\Windows\System\JKNqgHD.exe
  2⤵
  PID:8816
- C:\Windows\System\tWLbXlR.exe
  C:\Windows\System\tWLbXlR.exe
  2⤵
  PID:8836
- C:\Windows\System\XiwLaYD.exe
  C:\Windows\System\XiwLaYD.exe
  2⤵
  PID:8852
- C:\Windows\System\HncmBry.exe
  C:\Windows\System\HncmBry.exe
  2⤵
  PID:8868
- C:\Windows\System\jruUlan.exe
  C:\Windows\System\jruUlan.exe
  2⤵
  PID:8884
- C:\Windows\System\gJYbVgI.exe
  C:\Windows\System\gJYbVgI.exe
  2⤵
  PID:8900
- C:\Windows\System\TxqvLMS.exe
  C:\Windows\System\TxqvLMS.exe
  2⤵
  PID:8916
- C:\Windows\System\OqSjtwU.exe
  C:\Windows\System\OqSjtwU.exe
  2⤵
  PID:8932
- C:\Windows\System\PvlUcoj.exe
  C:\Windows\System\PvlUcoj.exe
  2⤵
  PID:8948
- C:\Windows\System\DVAdbDK.exe
  C:\Windows\System\DVAdbDK.exe
  2⤵
  PID:8964
- C:\Windows\System\MHZugZf.exe
  C:\Windows\System\MHZugZf.exe
  2⤵
  PID:8980
- C:\Windows\System\rDxgLpu.exe
  C:\Windows\System\rDxgLpu.exe
  2⤵
  PID:8996
- C:\Windows\System\aOZUoNj.exe
  C:\Windows\System\aOZUoNj.exe
  2⤵
  PID:9016
- C:\Windows\System\ACkifjK.exe
  C:\Windows\System\ACkifjK.exe
  2⤵
  PID:9032
- C:\Windows\System\DmTZPXZ.exe
  C:\Windows\System\DmTZPXZ.exe
  2⤵
  PID:9048
- C:\Windows\System\umsPLqu.exe
  C:\Windows\System\umsPLqu.exe
  2⤵
  PID:9064
- C:\Windows\System\tKsrKWD.exe
  C:\Windows\System\tKsrKWD.exe
  2⤵
  PID:9080
- C:\Windows\System\baKWaxO.exe
  C:\Windows\System\baKWaxO.exe
  2⤵
  PID:9096
- C:\Windows\System\GDQSeKe.exe
  C:\Windows\System\GDQSeKe.exe
  2⤵
  PID:9112
- C:\Windows\System\mSCGkQv.exe
  C:\Windows\System\mSCGkQv.exe
  2⤵
  PID:9128
- C:\Windows\System\ttQyIuA.exe
  C:\Windows\System\ttQyIuA.exe
  2⤵
  PID:9144
- C:\Windows\System\EHJvITJ.exe
  C:\Windows\System\EHJvITJ.exe
  2⤵
  PID:9160
- C:\Windows\System\LwULJUv.exe
  C:\Windows\System\LwULJUv.exe
  2⤵
  PID:9176
- C:\Windows\System\qPjsVGs.exe
  C:\Windows\System\qPjsVGs.exe
  2⤵
  PID:9196
- C:\Windows\System\zVKfSvt.exe
  C:\Windows\System\zVKfSvt.exe
  2⤵
  PID:9212
- C:\Windows\System\DytjWAn.exe
  C:\Windows\System\DytjWAn.exe
  2⤵
  PID:8220
- C:\Windows\System\asWObea.exe
  C:\Windows\System\asWObea.exe
  2⤵
  PID:8180
- C:\Windows\System\HYYTwHe.exe
  C:\Windows\System\HYYTwHe.exe
  2⤵
  PID:8240
- C:\Windows\System\QXsmLeZ.exe
  C:\Windows\System\QXsmLeZ.exe
  2⤵
  PID:8268
- C:\Windows\System\fAvozOj.exe
  C:\Windows\System\fAvozOj.exe
  2⤵
  PID:8316
- C:\Windows\System\xAyUCLi.exe
  C:\Windows\System\xAyUCLi.exe
  2⤵
  PID:8348
- C:\Windows\System\SLlbySh.exe
  C:\Windows\System\SLlbySh.exe
  2⤵
  PID:8352
- C:\Windows\System\FPibSvj.exe
  C:\Windows\System\FPibSvj.exe
  2⤵
  PID:8380
- C:\Windows\System\EQRImif.exe
  C:\Windows\System\EQRImif.exe
  2⤵
  PID:8452
- C:\Windows\System\tMYMETO.exe
  C:\Windows\System\tMYMETO.exe
  2⤵
  PID:8516
- C:\Windows\System\EemgmfH.exe
  C:\Windows\System\EemgmfH.exe
  2⤵
  PID:8548
- C:\Windows\System\eiLPlGH.exe
  C:\Windows\System\eiLPlGH.exe
  2⤵
  PID:8644
- C:\Windows\System\JzdtGyb.exe
  C:\Windows\System\JzdtGyb.exe
  2⤵
  PID:8680
- C:\Windows\System\WnkRZbq.exe
  C:\Windows\System\WnkRZbq.exe
  2⤵
  PID:8432
- C:\Windows\System\HbMYRbg.exe
  C:\Windows\System\HbMYRbg.exe
  2⤵
  PID:8500
- C:\Windows\System\hhQOjkC.exe
  C:\Windows\System\hhQOjkC.exe
  2⤵
  PID:8568
- C:\Windows\System\gMMVWaU.exe
  C:\Windows\System\gMMVWaU.exe
  2⤵
  PID:8632
- C:\Windows\System\iyZCgUO.exe
  C:\Windows\System\iyZCgUO.exe
  2⤵
  PID:8696
- C:\Windows\System\jPQPHtB.exe
  C:\Windows\System\jPQPHtB.exe
  2⤵
  PID:8776
- C:\Windows\System\gFTwHaF.exe
  C:\Windows\System\gFTwHaF.exe
  2⤵
  PID:8848
- C:\Windows\System\ORwzHxs.exe
  C:\Windows\System\ORwzHxs.exe
  2⤵
  PID:8908
- C:\Windows\System\psPcRGp.exe
  C:\Windows\System\psPcRGp.exe
  2⤵
  PID:8792
- C:\Windows\System\lcngOVq.exe
  C:\Windows\System\lcngOVq.exe
  2⤵
  PID:8860
- C:\Windows\System\rOFmUNg.exe
  C:\Windows\System\rOFmUNg.exe
  2⤵
  PID:8924
- C:\Windows\System\UuLvZlj.exe
  C:\Windows\System\UuLvZlj.exe
  2⤵
  PID:8976
- C:\Windows\System\gLfhmOA.exe
  C:\Windows\System\gLfhmOA.exe
  2⤵
  PID:9004
- C:\Windows\System\pGgwCzN.exe
  C:\Windows\System\pGgwCzN.exe
  2⤵
  PID:9028
- C:\Windows\System\dkqLlat.exe
  C:\Windows\System\dkqLlat.exe
  2⤵
  PID:9072
- C:\Windows\System\dlYaODy.exe
  C:\Windows\System\dlYaODy.exe
  2⤵
  PID:9088
- C:\Windows\System\WSajFIA.exe
  C:\Windows\System\WSajFIA.exe
  2⤵
  PID:9136
- C:\Windows\System\LkZULtx.exe
  C:\Windows\System\LkZULtx.exe
  2⤵
  PID:9204
- C:\Windows\System\BVPjXqG.exe
  C:\Windows\System\BVPjXqG.exe
  2⤵
  PID:8208
- C:\Windows\System\DNYVVwJ.exe
  C:\Windows\System\DNYVVwJ.exe
  2⤵
  PID:9124
- C:\Windows\System\RFekmQF.exe
  C:\Windows\System\RFekmQF.exe
  2⤵
  PID:8396
- C:\Windows\System\BuQxUXW.exe
  C:\Windows\System\BuQxUXW.exe
  2⤵
  PID:8612
- C:\Windows\System\uPtVgYI.exe
  C:\Windows\System\uPtVgYI.exe
  2⤵
  PID:8404
- C:\Windows\System\AMQuYCe.exe
  C:\Windows\System\AMQuYCe.exe
  2⤵
  PID:9184
- C:\Windows\System\WyNiVjW.exe
  C:\Windows\System\WyNiVjW.exe
  2⤵
  PID:7720
- C:\Windows\System\evmHoLD.exe
  C:\Windows\System\evmHoLD.exe
  2⤵
  PID:8332
- C:\Windows\System\kQukvIR.exe
  C:\Windows\System\kQukvIR.exe
  2⤵
  PID:8552
- C:\Windows\System\ATiGXiw.exe
  C:\Windows\System\ATiGXiw.exe
  2⤵
  PID:8564
- C:\Windows\System\NwIzAcx.exe
  C:\Windows\System\NwIzAcx.exe
  2⤵
  PID:8844
- C:\Windows\System\YqQGQDK.exe
  C:\Windows\System\YqQGQDK.exe
  2⤵
  PID:8892
- C:\Windows\System\hHZdwqk.exe
  C:\Windows\System\hHZdwqk.exe
  2⤵
  PID:8600
- C:\Windows\System\UOvyPgY.exe
  C:\Windows\System\UOvyPgY.exe
  2⤵
  PID:8876
- C:\Windows\System\LKIbkxx.exe
  C:\Windows\System\LKIbkxx.exe
  2⤵
  PID:8896
- C:\Windows\System\KlmacLQ.exe
  C:\Windows\System\KlmacLQ.exe
  2⤵
  PID:8928
- C:\Windows\System\dPeHJeZ.exe
  C:\Windows\System\dPeHJeZ.exe
  2⤵
  PID:9040
- C:\Windows\System\otUjzYi.exe
  C:\Windows\System\otUjzYi.exe
  2⤵
  PID:8252
- C:\Windows\System\WRqUstW.exe
  C:\Windows\System\WRqUstW.exe
  2⤵
  PID:9192
- C:\Windows\System\CbkKeQt.exe
  C:\Windows\System\CbkKeQt.exe
  2⤵
  PID:9104
- C:\Windows\System\YiEJNWb.exe
  C:\Windows\System\YiEJNWb.exe
  2⤵
  PID:8764
- C:\Windows\System\GLDUdte.exe
  C:\Windows\System\GLDUdte.exe
  2⤵
  PID:8832
- C:\Windows\System\RTilJxx.exe
  C:\Windows\System\RTilJxx.exe
  2⤵
  PID:8972
- C:\Windows\System\tUBFruA.exe
  C:\Windows\System\tUBFruA.exe
  2⤵
  PID:8744
- C:\Windows\System\KjBIPRY.exe
  C:\Windows\System\KjBIPRY.exe
  2⤵
  PID:8320
- C:\Windows\System\AUEPZSl.exe
  C:\Windows\System\AUEPZSl.exe
  2⤵
  PID:8808
- C:\Windows\System\OEImKxA.exe
  C:\Windows\System\OEImKxA.exe
  2⤵
  PID:8676
- C:\Windows\System\FaKSSMj.exe
  C:\Windows\System\FaKSSMj.exe
  2⤵
  PID:8300
- C:\Windows\System\NPbRpqN.exe
  C:\Windows\System\NPbRpqN.exe
  2⤵
  PID:8472
- C:\Windows\System\ZTvFoFM.exe
  C:\Windows\System\ZTvFoFM.exe
  2⤵
  PID:9228
- C:\Windows\System\ovxlENh.exe
  C:\Windows\System\ovxlENh.exe
  2⤵
  PID:9248
- C:\Windows\System\gOFXCRz.exe
  C:\Windows\System\gOFXCRz.exe
  2⤵
  PID:9264
- C:\Windows\System\iTFswZJ.exe
  C:\Windows\System\iTFswZJ.exe
  2⤵
  PID:9280
- C:\Windows\System\eIRoKKI.exe
  C:\Windows\System\eIRoKKI.exe
  2⤵
  PID:9296
- C:\Windows\System\UPTxfCS.exe
  C:\Windows\System\UPTxfCS.exe
  2⤵
  PID:9312
- C:\Windows\System\LiqlyLg.exe
  C:\Windows\System\LiqlyLg.exe
  2⤵
  PID:9328
- C:\Windows\System\QfknqlI.exe
  C:\Windows\System\QfknqlI.exe
  2⤵
  PID:9344
- C:\Windows\System\MpVGZqL.exe
  C:\Windows\System\MpVGZqL.exe
  2⤵
  PID:9360
- C:\Windows\System\jMRHsKL.exe
  C:\Windows\System\jMRHsKL.exe
  2⤵
  PID:9376
- C:\Windows\System\yZzBnNJ.exe
  C:\Windows\System\yZzBnNJ.exe
  2⤵
  PID:9392
- C:\Windows\System\OQLKMtS.exe
  C:\Windows\System\OQLKMtS.exe
  2⤵
  PID:9412
- C:\Windows\System\oilZhhM.exe
  C:\Windows\System\oilZhhM.exe
  2⤵
  PID:9428
- C:\Windows\System\zcuOhmH.exe
  C:\Windows\System\zcuOhmH.exe
  2⤵
  PID:9444
- C:\Windows\System\zgkqJHy.exe
  C:\Windows\System\zgkqJHy.exe
  2⤵
  PID:9460
- C:\Windows\System\HfMKaEW.exe
  C:\Windows\System\HfMKaEW.exe
  2⤵
  PID:9476
- C:\Windows\System\vIMZdoI.exe
  C:\Windows\System\vIMZdoI.exe
  2⤵
  PID:9492
- C:\Windows\System\QyOaNSW.exe
  C:\Windows\System\QyOaNSW.exe
  2⤵
  PID:9512
- C:\Windows\System\MQvGRHw.exe
  C:\Windows\System\MQvGRHw.exe
  2⤵
  PID:9528
- C:\Windows\System\PnLkUNL.exe
  C:\Windows\System\PnLkUNL.exe
  2⤵
  PID:9544
- C:\Windows\System\dDLfrzn.exe
  C:\Windows\System\dDLfrzn.exe
  2⤵
  PID:9560
- C:\Windows\System\FkaxCia.exe
  C:\Windows\System\FkaxCia.exe
  2⤵
  PID:9576
- C:\Windows\System\nzMulZh.exe
  C:\Windows\System\nzMulZh.exe
  2⤵
  PID:9592
- C:\Windows\System\jkkzFCR.exe
  C:\Windows\System\jkkzFCR.exe
  2⤵
  PID:9612
- C:\Windows\System\UkwXSmT.exe
  C:\Windows\System\UkwXSmT.exe
  2⤵
  PID:9628
- C:\Windows\System\HEcfQEh.exe
  C:\Windows\System\HEcfQEh.exe
  2⤵
  PID:9644
- C:\Windows\System\bXZoWvF.exe
  C:\Windows\System\bXZoWvF.exe
  2⤵
  PID:9660
- C:\Windows\System\lGqEcFz.exe
  C:\Windows\System\lGqEcFz.exe
  2⤵
  PID:9676
- C:\Windows\System\XKaqLEY.exe
  C:\Windows\System\XKaqLEY.exe
  2⤵
  PID:9692
- C:\Windows\System\knhIbHp.exe
  C:\Windows\System\knhIbHp.exe
  2⤵
  PID:9708
- C:\Windows\System\bYCTcyw.exe
  C:\Windows\System\bYCTcyw.exe
  2⤵
  PID:9724
- C:\Windows\System\DHiguhA.exe
  C:\Windows\System\DHiguhA.exe
  2⤵
  PID:9740
- C:\Windows\System\MBaxMev.exe
  C:\Windows\System\MBaxMev.exe
  2⤵
  PID:9756
- C:\Windows\System\GafWnTo.exe
  C:\Windows\System\GafWnTo.exe
  2⤵
  PID:9772
- C:\Windows\System\NeaHpXb.exe
  C:\Windows\System\NeaHpXb.exe
  2⤵
  PID:9788
- C:\Windows\System\LBgrBPR.exe
  C:\Windows\System\LBgrBPR.exe
  2⤵
  PID:9804
- C:\Windows\System\KTzmaup.exe
  C:\Windows\System\KTzmaup.exe
  2⤵
  PID:9820
- C:\Windows\System\kTTgkdC.exe
  C:\Windows\System\kTTgkdC.exe
  2⤵
  PID:9836
- C:\Windows\System\PBGToop.exe
  C:\Windows\System\PBGToop.exe
  2⤵
  PID:9852
- C:\Windows\System\yPlJkYL.exe
  C:\Windows\System\yPlJkYL.exe
  2⤵
  PID:9868
- C:\Windows\System\sXEnNSh.exe
  C:\Windows\System\sXEnNSh.exe
  2⤵
  PID:9884
- C:\Windows\System\MdPwXeW.exe
  C:\Windows\System\MdPwXeW.exe
  2⤵
  PID:9900
- C:\Windows\System\IxluYfY.exe
  C:\Windows\System\IxluYfY.exe
  2⤵
  PID:9916
- C:\Windows\System\CFkkTAY.exe
  C:\Windows\System\CFkkTAY.exe
  2⤵
  PID:9932
- C:\Windows\System\LOuxBjn.exe
  C:\Windows\System\LOuxBjn.exe
  2⤵
  PID:9948
- C:\Windows\System\qOnZtCo.exe
  C:\Windows\System\qOnZtCo.exe
  2⤵
  PID:9964
- C:\Windows\System\nacsLnL.exe
  C:\Windows\System\nacsLnL.exe
  2⤵
  PID:9980
- C:\Windows\System\AeSNZnp.exe
  C:\Windows\System\AeSNZnp.exe
  2⤵
  PID:9996
- C:\Windows\System\WUKSJXa.exe
  C:\Windows\System\WUKSJXa.exe
  2⤵
  PID:10012
- C:\Windows\System\HeqLkrT.exe
  C:\Windows\System\HeqLkrT.exe
  2⤵
  PID:10028
- C:\Windows\System\MFnjWnc.exe
  C:\Windows\System\MFnjWnc.exe
  2⤵
  PID:10044
- C:\Windows\System\zPLPiNQ.exe
  C:\Windows\System\zPLPiNQ.exe
  2⤵
  PID:10060
- C:\Windows\System\hrpMiBx.exe
  C:\Windows\System\hrpMiBx.exe
  2⤵
  PID:10076
- C:\Windows\System\TOyzUFC.exe
  C:\Windows\System\TOyzUFC.exe
  2⤵
  PID:10092
- C:\Windows\System\TDreSEx.exe
  C:\Windows\System\TDreSEx.exe
  2⤵
  PID:10108
- C:\Windows\System\LcssMKj.exe
  C:\Windows\System\LcssMKj.exe
  2⤵
  PID:10124
- C:\Windows\System\DNtCcZD.exe
  C:\Windows\System\DNtCcZD.exe
  2⤵
  PID:10140
- C:\Windows\System\cWewePV.exe
  C:\Windows\System\cWewePV.exe
  2⤵
  PID:10156
- C:\Windows\System\ScbryPR.exe
  C:\Windows\System\ScbryPR.exe
  2⤵
  PID:10172
- C:\Windows\System\RbtelSr.exe
  C:\Windows\System\RbtelSr.exe
  2⤵
  PID:10188
- C:\Windows\System\xpUvqLf.exe
  C:\Windows\System\xpUvqLf.exe
  2⤵
  PID:10204
- C:\Windows\System\pGPwnFM.exe
  C:\Windows\System\pGPwnFM.exe
  2⤵
  PID:10220
- C:\Windows\System\HZmDElF.exe
  C:\Windows\System\HZmDElF.exe
  2⤵
  PID:10236
- C:\Windows\System\yIXPIia.exe
  C:\Windows\System\yIXPIia.exe
  2⤵
  PID:7824
- C:\Windows\System\FTFwgqG.exe
  C:\Windows\System\FTFwgqG.exe
  2⤵
  PID:8484
- C:\Windows\System\HILuObb.exe
  C:\Windows\System\HILuObb.exe
  2⤵
  PID:9244
- C:\Windows\System\DvQyxcx.exe
  C:\Windows\System\DvQyxcx.exe
  2⤵
  PID:9092
- C:\Windows\System\QBADiAf.exe
  C:\Windows\System\QBADiAf.exe
  2⤵
  PID:9220
- C:\Windows\System\adOIMsR.exe
  C:\Windows\System\adOIMsR.exe
  2⤵
  PID:9320
- C:\Windows\System\gyIVfRA.exe
  C:\Windows\System\gyIVfRA.exe
  2⤵
  PID:9308
- C:\Windows\System\fxswoRA.exe
  C:\Windows\System\fxswoRA.exe
  2⤵
  PID:9372
- C:\Windows\System\UavDTlv.exe
  C:\Windows\System\UavDTlv.exe
  2⤵
  PID:9436
- C:\Windows\System\MnfFyRh.exe
  C:\Windows\System\MnfFyRh.exe
  2⤵
  PID:9500
- C:\Windows\System\tZeVYxI.exe
  C:\Windows\System\tZeVYxI.exe
  2⤵
  PID:9260
- C:\Windows\System\OgbWarQ.exe
  C:\Windows\System\OgbWarQ.exe
  2⤵
  PID:9356
- C:\Windows\System\NaISmBj.exe
  C:\Windows\System\NaISmBj.exe
  2⤵
  PID:9456
- C:\Windows\System\azySrsI.exe
  C:\Windows\System\azySrsI.exe
  2⤵
  PID:9584
- C:\Windows\System\aoTicDN.exe
  C:\Windows\System\aoTicDN.exe
  2⤵
  PID:9524
- C:\Windows\System\yJZWlJG.exe
  C:\Windows\System\yJZWlJG.exe
  2⤵
  PID:9688
- C:\Windows\System\UrOUvnQ.exe
  C:\Windows\System\UrOUvnQ.exe
  2⤵
  PID:9656
- C:\Windows\System\GJyGZLT.exe
  C:\Windows\System\GJyGZLT.exe
  2⤵
  PID:9752
- C:\Windows\System\aaVfMqC.exe
  C:\Windows\System\aaVfMqC.exe
  2⤵
  PID:9844
- C:\Windows\System\eMercLf.exe
  C:\Windows\System\eMercLf.exe
  2⤵
  PID:9880
- C:\Windows\System\MZaKeDR.exe
  C:\Windows\System\MZaKeDR.exe
  2⤵
  PID:9944
- C:\Windows\System\awiwbkP.exe
  C:\Windows\System\awiwbkP.exe
  2⤵
  PID:10008
- C:\Windows\System\LpONdyf.exe
  C:\Windows\System\LpONdyf.exe
  2⤵
  PID:10104
- C:\Windows\System\yzCmjbe.exe
  C:\Windows\System\yzCmjbe.exe
  2⤵
  PID:10196
- C:\Windows\System\GJrmKvY.exe
  C:\Windows\System\GJrmKvY.exe
  2⤵
  PID:10232
- C:\Windows\System\AgkdZyT.exe
  C:\Windows\System\AgkdZyT.exe
  2⤵
  PID:8988
- C:\Windows\System\SCHaWGc.exe
  C:\Windows\System\SCHaWGc.exe
  2⤵
  PID:9368
- C:\Windows\System\RNgbMts.exe
  C:\Windows\System\RNgbMts.exe
  2⤵
  PID:9764
- C:\Windows\System\yaSfcLi.exe
  C:\Windows\System\yaSfcLi.exe
  2⤵
  PID:9352
- C:\Windows\System\TXDIIzU.exe
  C:\Windows\System\TXDIIzU.exe
  2⤵
  PID:9588
- C:\Windows\System\HLiokDg.exe
  C:\Windows\System\HLiokDg.exe
  2⤵
  PID:9796
- C:\Windows\System\cJQjmuZ.exe
  C:\Windows\System\cJQjmuZ.exe
  2⤵
  PID:9600
- C:\Windows\System\vVHTdXW.exe
  C:\Windows\System\vVHTdXW.exe
  2⤵
  PID:9636
- C:\Windows\System\htLdKYl.exe
  C:\Windows\System\htLdKYl.exe
  2⤵
  PID:9504
- C:\Windows\System\SAyFVzD.exe
  C:\Windows\System\SAyFVzD.exe
  2⤵
  PID:9784
- C:\Windows\System\MWYteqt.exe
  C:\Windows\System\MWYteqt.exe
  2⤵
  PID:9800
- C:\Windows\System\NeZMoqS.exe
  C:\Windows\System\NeZMoqS.exe
  2⤵
  PID:9892
- C:\Windows\System\DOLZGoy.exe
  C:\Windows\System\DOLZGoy.exe
  2⤵
  PID:9956
- C:\Windows\System\hyMVXJx.exe
  C:\Windows\System\hyMVXJx.exe
  2⤵
  PID:10020
- C:\Windows\System\nUEbRnq.exe
  C:\Windows\System\nUEbRnq.exe
  2⤵
  PID:10088
- C:\Windows\System\XIqVvUp.exe
  C:\Windows\System\XIqVvUp.exe
  2⤵
  PID:10152
- C:\Windows\System\DnTYkgS.exe
  C:\Windows\System\DnTYkgS.exe
  2⤵
  PID:10216
- C:\Windows\System\ymKZNFz.exe
  C:\Windows\System\ymKZNFz.exe
  2⤵
  PID:7556
- C:\Windows\System\jWqxDkN.exe
  C:\Windows\System\jWqxDkN.exe
  2⤵
  PID:8536
- C:\Windows\System\fiVUcFe.exe
  C:\Windows\System\fiVUcFe.exe
  2⤵
  PID:9748
- C:\Windows\System\OgIvWgd.exe
  C:\Windows\System\OgIvWgd.exe
  2⤵
  PID:9940
- C:\Windows\System\NYWfgyK.exe
  C:\Windows\System\NYWfgyK.exe
  2⤵
  PID:10100
- C:\Windows\System\YOjSDkK.exe
  C:\Windows\System\YOjSDkK.exe
  2⤵
  PID:10228
- C:\Windows\System\UrZhEfx.exe
  C:\Windows\System\UrZhEfx.exe
  2⤵
  PID:9384
- C:\Windows\System\LNIYzcG.exe
  C:\Windows\System\LNIYzcG.exe
  2⤵
  PID:9736
- C:\Windows\System\rzndCYc.exe
  C:\Windows\System\rzndCYc.exe
  2⤵
  PID:9540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AqceTPl.exe

Filesize
1.6MB

MD5
a6ef8022035d2c82d8fe99afe5b85e44

SHA1
4d6383e9fcc235760a8f674ef5e83c39274c0278

SHA256
e98d6cc0351ff775e3bfa995b7fa46674afe5dbc6fec5a2b14657d900d133db2

SHA512
a1f7f78616313b3c945a4187faa33d1f8a969cc7f2ff98fee10c408ffce122819c274865fbaa4d6c29be97094debe6ed850df842dd0b632914027d7ce292dbe9

Download Submit
C:\Windows\system\AtjuVYj.exe

Filesize
1.6MB

MD5
98519107757bd6c03397f604c2962af0

SHA1
be18e929d52c77d2a17405954b5b0ed863aaf1d2

SHA256
106e4322558a2b600e67216ceb3a0d3361138bf374c4a91b99a3fb35e5a06b72

SHA512
a3d5c98f8a2f277d042b156407079d5462b8c229fa9472ac882b37086c7efcbacd6937cb2bca04288f90943ecc62e35c16d6ee985ddc4213a5a4988f39085e8e

Download Submit
C:\Windows\system\DRUJYsl.exe

Filesize
1.6MB

MD5
59975d503e88e5f776748d75998709a6

SHA1
af5959472589ae0c4801a8c58483b09611e13fb4

SHA256
c8b5bf58ecd5a5f3cb7f45f52776181ca2f1e2b13489fb1a21e5000662633d67

SHA512
22d69a919baa84c720e7af4539cc9081463b00b286bca77c80867e42a380fc77879b2edd1a271b9582c395c830ca73c613342a1cfc885e77e8f7851e28127398

Download Submit
C:\Windows\system\ESqlHtt.exe

Filesize
1.6MB

MD5
c2541d3e6d9d4fe28b446be44784bd5c

SHA1
350a1ac59e0e8666545bb6f9ca9987e5ef500572

SHA256
de34c155c0d6137e4bc8b0a2be7306a560c02fe266ba58ce3e2483e32d390f65

SHA512
1d49da8031ad3224d6e3b1b051049aae377ee4e2626165bbbeb236e27c38b1b9a88540f794d1ab8be45899a51f826459c721823d07e87c409eb9a6764ea3c24a

Download Submit
C:\Windows\system\GeDmVVC.exe

Filesize
1.6MB

MD5
b2b5a8593d973f4b7e7426c68deff0b0

SHA1
4f36dd5818f0e56a555d5c6ace530a038832a618

SHA256
5a6a73a4ed2fd20bed4fbd98eeb66aa7616a9718afb02e6a2868d70d78a45509

SHA512
6b0cfc54fb12e5ad00f560c3d00b2faf9b738d5703020ef2df0aeb17cdc96ca902aaf8e275ad582c3c67d5f671901881be351cd2712cc7d4faadc100ae8bdbd7

Download Submit
C:\Windows\system\GpIOzKf.exe

Filesize
1.6MB

MD5
6b119d5017cd8144bcee1287ff78fbef

SHA1
04e4a76156f4ec98cbee31f617f0781a5ef428c5

SHA256
89bf85fad3e5f40a44c72e50b81d59f49dca726f455d3a10664d7288155fa6a8

SHA512
e929e2799a21a1cff44e5620cb52717a6eb7ffcf5ea08f358de84f09a15434b234dc427a2a0a7e8e35fba0c4b88540d219270a3ca4b750993244593f4f2ace37

Download Submit
C:\Windows\system\LCpuohx.exe

Filesize
1.6MB

MD5
2b115fef3c8b414927ec699b66fa9a66

SHA1
738a99093d9644404706c11d3ed7f7b226385b08

SHA256
d8d781060fe50e969bfc08a391bd2c8d4d75732c17d655d67e101f730df15d55

SHA512
39bfc26291229c504ae5b84ca02bb0c35269a81702b3d8d5df312e8ce77a072b14154cc0394ce350cf52c357d6382d9d26a68bfb76e2022d379a454efe52c353

Download Submit
C:\Windows\system\LjPifbY.exe

Filesize
1.6MB

MD5
dadd7da674fe6674ec140930fe5dd095

SHA1
97c316fa84828ebaebd04c30d363d9a117121f29

SHA256
eaa9f49964833abe1a8a39302e8dd85202cb09bec960f7cf4806c9ae167a4e95

SHA512
e6c0b4da0a55e7cb9e4362bc72e308ece325968db45a0c21520eaa90682c5bf260f7cb937f656f6ffdb6e425e740c2733cda2dff83384ccf8edc327b90013c61

Download Submit
C:\Windows\system\PecbDHR.exe

Filesize
1.6MB

MD5
e8b5438a6a5324fa8af069ce6891aaa7

SHA1
2ff3b44bf6fa1bcff4d735a5ce9505ece6bb4894

SHA256
002934b6a903c9fb5bbdc98a3daf61bccafbd44592be53c1d8ae55312047d3ae

SHA512
834a449d1d34b257b885dd7252a502e0cb2e70818cc9080d4c4e9ddebca7ee827746c6d9b588b3986972f208a215ca508330c3109ed10b5dcfda1335ee99bcdb

Download Submit
C:\Windows\system\QUuCMdQ.exe

Filesize
1.6MB

MD5
f5386e472ead180c173174f82a55708f

SHA1
ca6f5e9ed4bf6f15b7aeecefbbc56b16088bbaaf

SHA256
309346cb8e2b41dfe5543efbb545d85d82e3606fb853d6d2eb44a17e1793280d

SHA512
ec8b8ae323b8a233e0577ac43312fd5a398e99083124deb1d98f1fa4f0a3dbc2663ddfc76508159d729975d1ca838f73f7476a110785cb5db6b73f100dc7d261

Download Submit
C:\Windows\system\QySyoSV.exe

Filesize
1.6MB

MD5
dd7c2895a061d6863cadc447fb6092eb

SHA1
7e0bc2a51e5db61951a7de6fdabbbd759259ef2b

SHA256
55d8f8f337b584a812493cb74949cd598d0e8495451f612c342380e6f6e5a48e

SHA512
fe1329a2ff9a54b05089e0e524d6f31b1a41013152ef05f47ccb4efc25faadd57104cd006af3178a4da8d76c3f70eba4c6301d05d817cf59ff6c243eeced068b

Download Submit
C:\Windows\system\RZoQQqX.exe

Filesize
1.6MB

MD5
8507fe6b607ecfe067a2a00df6cfdd36

SHA1
3818ca8a2130a6bc5dfe5c6be0991fa93fb62cb9

SHA256
c4b89895d54560e8e85433829221ff43d0b2643f484bfa25ce0303e0e38887d6

SHA512
1bcb98c82c0c31c1b4c805fa4f8a939aa823c9ad4cbf95e18097f0171c92eac573a8c25ca9cb1f3507401be10532f9ff15c18c4a3daf3415d43430383e10f221

Download Submit
C:\Windows\system\RclfBmK.exe

Filesize
1.6MB

MD5
a6d76ff086530fdeaacb730e857a040e

SHA1
f7bb71cc82abadbf6c225652606bd8c8a13572ff

SHA256
93f18830388ec25b91367f7f8713b60753ef7dceb5a4b9eb02fc294950e37206

SHA512
e932d2895941bba7a3372d97a679a5c985dd17cd6538573ffc508894efeb7f1b55ab6fb0c155f6a7c3b00cbddd5a53c08e8c7c6a3beb96e20e9d7c602aa556bc

Download Submit
C:\Windows\system\VeGQpWf.exe

Filesize
1.6MB

MD5
64c657ca8cb01db766a71c5998b71364

SHA1
f300b91264652f241e6a242aa3922fb294884ed8

SHA256
44f2a0af4a37f5cea8fd3ecfc1c9217293b421c2964f47e8de722a1aedc3f68a

SHA512
f346bc259c731bcf571ddf83266d632020063c415c40e877a51ee769d65ba1572721247af1c57a5fd4267fa6869d11ded2947061c6bdfab5a9d93fb8f118e767

Download Submit
C:\Windows\system\VkUuxZN.exe

Filesize
1.6MB

MD5
fa12dc0426cafe91b50e179a61280b19

SHA1
4d635d8818dfdc1b5c6239948cc62ea7c66b7378

SHA256
53d7c837583eb97c071a0c0e425795ee62edae1f69f2975e3abe866b2a974552

SHA512
fef1f8c7ccfe90682b027a6ce1dc2847115dc08b93916929519854ffef3b47457f46114dcf800a99650e5eeb57f1bec4d9a027752f6baa3d739f1119191d27cc

Download Submit
C:\Windows\system\eCGqeeY.exe

Filesize
8B

MD5
70d32c5686563edbb854aed29ea9d85c

SHA1
bd541445a50c65f1a6670fe5c95bea5d00e91b07

SHA256
7838364f90f7a979e688eff5ec314b7556d64c92bdfbd76fb1ec9602cec23e30

SHA512
23991ce500626bded4e2dc15b31393a89cfbbdda0d797292f12ec97001984de33a442b02e485bb8bd2704c63b7c242ef2cf2fc4fd62f7f428d253fd4da79e7f5

Download Submit
C:\Windows\system\fmWZicX.exe

Filesize
1.6MB

MD5
11daa90bb2a0d1c9847c78f2064314e9

SHA1
04528b94163d0779ac5ae27aafc5614779e8b94e

SHA256
a58e624dad53262302df1c2af1d39d1dfc24b3a7775d8fb2211a3c1c12ebabb8

SHA512
944409ca179d62372f812d0e9e37f01f5ebe6439a26c3fdff60f0ee3af6e3c86bfd798671a9783d930eb140298051aa96080e8f357e0464d1b1f0870245f3ca9

Download Submit
C:\Windows\system\ibsAQIy.exe

Filesize
1.6MB

MD5
09a84f1713b10b15e86231be3b4bb77d

SHA1
841cbc3d0dbfe1cd9695b245fa22e1d86fac3b71

SHA256
d927c839934fcd1e695fa6cc9f36591ec8aaf3c758b71a858de880691c724d4f

SHA512
5bd81fb1bcf97c05635682a2783ebd08bc0458cd55f1543623eb8abbbd9cbe3374af023a1861316daf0c3cc9dfad62af8d1075f334ba09d99b02222797a9ab14

Download Submit
C:\Windows\system\jAkelUA.exe

Filesize
1.6MB

MD5
679a3a5f805511f840dde405b36abfd2

SHA1
00f6788cc21c0242b5c5bb2f1a3241613b028ec3

SHA256
f5c484b18a3ac67b8307afd6c67ed685ae8ac7bb5d9edab8b4ffaa0ed639a1d2

SHA512
0ab6db91676679c6b7a58c0d2454965234a6848cfdda7134abe455cb2dffa894eb614c7f088bf35a7c7f64676b11c11fffaa9028d193bdea283a4fbe534027bb

Download Submit
C:\Windows\system\nOOXyKQ.exe

Filesize
1.6MB

MD5
80fab7737e0a48bf8c1a99b6b5953c21

SHA1
1f59552665e32f0d922d0d17ceb8ac2d2632d90e

SHA256
4a53600174ff29754654cdd10bb3a8a4add7bf27ae315988daf2824450f8ab93

SHA512
16bfe6c420c5135352a6d0d7305dd02733d7321c368be9cc5a5e78b5546420c8534fe53f6140b80361162582dc95fd686597f156b0f5e3c6d90b3d579a9dfca7

Download Submit
C:\Windows\system\nPUfJbV.exe

Filesize
18B

MD5
69712a8f9ef9a2cbe4907aa446157abb

SHA1
2b5c964a1748c4a6a2f7493dad88bc47a2d4511c

SHA256
b9cc1ff1554bd2f25357d0be7df90fe8a89296de72a2afbc4a6860c87a817497

SHA512
e050468b7108288e0fa907c0304cf8e8a182bd9da2b253d0061963594f6238ca0b6aa0d55af3b2e2ca64630286776467c06ed51b0e331ea22edb14321931191f

Download Submit
C:\Windows\system\pDKzJyk.exe

Filesize
1.6MB

MD5
a30f89d316d93028d93f0dde5087f39f

SHA1
14c1e62dc8c20dadba33656cb05bc5e3bdeea9d9

SHA256
626c65f8388b7860a6ca3a624461df517375fcfac5fc92e530155e5a20410742

SHA512
93930981fc0b32d7fef970deefb8c4a3676d07a9301c883e7b2614d562e2479eb7f02b9c56e57f5150fe19a3be4a779e094053d125dac5454bb99a205a424f9c

Download Submit
C:\Windows\system\qXIgatR.exe

Filesize
1.6MB

MD5
2d015ef40c966a2762e545fec9997e71

SHA1
e84806fa5e92855266d502ac0d445c542aba39a1

SHA256
87875fe5c3df904a988e7f245e6da7dace77960b9e9febc2622054604ad43c6a

SHA512
6631ec47ad621c19cc81d9f05fee9fa8cbfb485d66a47f0a58e6d68d4580284c7e97828ddb4366577b4728bcd4813cfed7d910191c5dd4bc3476749f59dfee15

Download Submit
C:\Windows\system\terGqyf.exe

Filesize
1.6MB

MD5
5916beab4cbc4eb8d4a62f200391aa5d

SHA1
77315e01fbb5390fc64af41baad6595a2fd33d9e

SHA256
fc825b4e344718f6e82763aa1b56e9ec887469be485167ccfd9bd35b7c6ce2ca

SHA512
d472dce766cf8be7dbea63ee9c53b593f92f77d9a68075e0f8a4def87979299ba6636ec2c5fb778de194ac75e397519fdb582b3a5549b07e95e2a576d9456acd

Download Submit
C:\Windows\system\yQbFTMm.exe

Filesize
1.6MB

MD5
9886062a46ab3cd6ccb881ee4b12997c

SHA1
eb2ea6a1200b284e0c15ebb64e51b1cd3e4afcbc

SHA256
520ab247950f966c55ee1ff453bc5bf37e3d20552219cff16967f4f90c06c9cc

SHA512
9049331972128f1d85093ed924f650800d4aa2acd471eaff8a3087b51ab3f2267a4fc8bf705c7d74168666ac82329247fd830d1984e7b415324dddded8d835d1

Download Submit
\Windows\system\EHUCdPX.exe

Filesize
1.6MB

MD5
ada4fb2eca21e06e46c92ee41d313576

SHA1
598cb971b9820f3c5ab7826d11af00185baaf01f

SHA256
904ecf464a818d820e214dbbe0814624589be8aa74bd07a70618af8fcd47995b

SHA512
7934194ee8d942a724e3f94c643c45a505179715503f1581f13c34582ec44880a27f2bb291ca6a9b7623bf6749c823c55d215f5f13fe98326d33ab76d8966e9b

Download Submit
\Windows\system\EnXHAXp.exe

Filesize
1.6MB

MD5
fe82e29f141a3bbb8aa392a626bd4e4c

SHA1
0f85020d53d65964af4cf4cd7fe05bb4157175e4

SHA256
9dfddd6888ed69c573f203189c23f8e0baf458bcbbd0e7b55e54a87d434dab01

SHA512
9d3391214048285462a3ae56d9d3c249c76c2803397eb6a295b88769b9c2e49a70eadf503a89f38db73b4d053b36f7d3cc1081544e8fd5fa2db8eb1b69cf6602

Download Submit
\Windows\system\FiKyizT.exe

Filesize
1.6MB

MD5
cb3b7e493c9de1ff4b3d33ab79d5a378

SHA1
68978307931a18c496f81c6ced5da47856b19a9b

SHA256
fed2d9414c15f67031c66871193764016747060a894e76531db3096f55f5d315

SHA512
89b876f3a40006200802cad0f0240cd2b9c49818ad588cb6ca5879456477a0cde7f5ccd7bc46c1afe91d6017a004cac4adb1b78ab81c2800187c8cfbd738549d

Download Submit
\Windows\system\GxObewV.exe

Filesize
1.6MB

MD5
9eac849da1118c9b826bd57926b8a8af

SHA1
dedcb0e68701a710663980b5bcf78a87e24c14e0

SHA256
5e8aeaa74d0297e0f906b85f34e69c98010842748c9b828831726424c01b96c3

SHA512
f67a862d29708802bd74787ac2a47c94fde9e18ebc1e31956cb7f20a45200a7b76df25b665ec5eac6f72d7e2034f8bfd7f85ecc6ebb92453ef3d3416e4671044

Download Submit
\Windows\system\KkrymiL.exe

Filesize
1.6MB

MD5
8353c200c42df2b1ff63e63e4afbe9f2

SHA1
370553fb93469412b1cf6b7a9c3347201c0cfbfc

SHA256
24a22bf0be1261713abbb81a3d7800e96e6ceba71360c7782350245481cce426

SHA512
ce2bc13659e5df8f90e4bc9037553e1fe752693bc57c8425da4c0561f3dd218c67e568f8066135fe0c49f4770971351208443edef80635eeb867966ba255a590

Download Submit
\Windows\system\VHYtkzG.exe

Filesize
1.6MB

MD5
a332397b8f7d5f808d6f89702ef43c00

SHA1
013b82306200356ab4b052ecf1a0b69ef288b3c6

SHA256
f04c7eb821ad4e4f7b14d3fdccb064e988ae53139054cd5a64446daa23c5ab3b

SHA512
8c00bd5086f5230c0adb891affc897413cff2073d6391c54afdbdb75269c46126538130b6018d8eeb5067907dcdf32365b8dcf616331d663ca3615f287f66880

Download Submit
\Windows\system\VOwAKFo.exe

Filesize
1.6MB

MD5
4698fed51cbb9adca749b44cc8cc1a96

SHA1
e301b5aada805b89e19cb2656ed388bda7d53431

SHA256
fb851ac140d9e69369a9244c43bb64b3594f477ed34bc135b2f17ba214248673

SHA512
54e0d0daa6b17eac23d4badf90940808da0269ac65c06c23b6f01e345b0d29d1bbe94350798c2436780f59d35b4287c07379a341827c7a0680c67113ff3f4639

Download Submit
\Windows\system\baeUUfK.exe

Filesize
1.6MB

MD5
e55652b540b506454e1ddf3263c3d0ad

SHA1
7667e0ae8069805104dbd4c762377dd9e628bb14

SHA256
9c8c40300d411706222bbc28dc63c2f0e94bb6bd26f0e6d64b419fa3db43a152

SHA512
69d2468b4fe0c74f71430afc4fcf9272c1fe8cdfb38539144035add91a2f88aec4944dd7bb2fd95061be26f71fc6a06a36829a0dca493666986eb35e93d5cda3

Download Submit
\Windows\system\hQrYxJE.exe

Filesize
1.6MB

MD5
d987b2e296cec438749004aca4d0a69c

SHA1
c6e8334cc74ca33126dce7dacbf6ae4d086be1f4

SHA256
b746ec13597c89696879b3cfe6094cb1608c972e02ed4c7520caa57186b42f2b

SHA512
4235e45a8f23f96dc9de9cb1dd97eae89543b9640db44e64d27bf99ddfd9d07a8f2f15d577e7e29c981629a7b6585b7401f4a47978d7c3dd2c3547d3c9a41cde

Download Submit
\Windows\system\wAUiALn.exe

Filesize
1.6MB

MD5
39f38db70959fb13c5564b1148ed7a4e

SHA1
9408bf75b84dadda42488c5094096ac1b4af9200

SHA256
d0a7059bec7b88e77adf6991a1c46219a0217ac87463ec521b7157425b2ed282

SHA512
4a7f758eea1de8a6d4c6bbf89fbf7f85d5752531c464a07fb543abee115afb27b47d2826f50a748be82a3864633a507f6774757120d71aeea52d49f16613e957

Download Submit
memory/2184-6882-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/2184-41-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/2184-501-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/2208-93-0x0000000002950000-0x0000000002958000-memory.dmp

Filesize
32KB

Download
memory/2208-89-0x000000001B650000-0x000000001B932000-memory.dmp

Filesize
2.9MB

Download
memory/2216-94-0x000000013F220000-0x000000013F612000-memory.dmp

Filesize
3.9MB

Download
memory/2216-29-0x000000013F220000-0x000000013F612000-memory.dmp

Filesize
3.9MB

Download
memory/2236-88-0x000000013F1B0000-0x000000013F5A2000-memory.dmp

Filesize
3.9MB

Download
memory/2236-24-0x000000013F1B0000-0x000000013F5A2000-memory.dmp

Filesize
3.9MB

Download
memory/2236-6854-0x000000013F1B0000-0x000000013F5A2000-memory.dmp

Filesize
3.9MB

Download
memory/2268-250-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download
memory/2268-38-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download
memory/2492-97-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2492-31-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2636-95-0x000000013FEA0000-0x0000000140292000-memory.dmp

Filesize
3.9MB

Download
memory/2636-6888-0x000000013FEA0000-0x0000000140292000-memory.dmp

Filesize
3.9MB

Download
memory/2648-6885-0x000000013F200000-0x000000013F5F2000-memory.dmp

Filesize
3.9MB

Download
memory/2648-62-0x000000013F200000-0x000000013F5F2000-memory.dmp

Filesize
3.9MB

Download
memory/2648-781-0x000000013F200000-0x000000013F5F2000-memory.dmp

Filesize
3.9MB

Download
memory/2668-6892-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/2668-96-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/2900-27-0x0000000002CB0000-0x00000000030A2000-memory.dmp

Filesize
3.9MB

Download
memory/2900-16-0x000000013F1B0000-0x000000013F5A2000-memory.dmp

Filesize
3.9MB

Download
memory/2900-84-0x000000013FD00000-0x00000001400F2000-memory.dmp

Filesize
3.9MB

Download
memory/2900-30-0x000000013F220000-0x000000013F612000-memory.dmp

Filesize
3.9MB

Download
memory/2900-46-0x0000000002CB0000-0x00000000030A2000-memory.dmp

Filesize
3.9MB

Download
memory/2900-28-0x0000000002CB0000-0x00000000030A2000-memory.dmp

Filesize
3.9MB

Download
memory/2900-82-0x000000013F6B0000-0x000000013FAA2000-memory.dmp

Filesize
3.9MB

Download
memory/2900-0-0x000000013FD00000-0x00000001400F2000-memory.dmp

Filesize
3.9MB

Download
memory/2900-25-0x0000000002CB0000-0x00000000030A2000-memory.dmp

Filesize
3.9MB

Download
memory/2900-81-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/2900-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2900-83-0x0000000002CB0000-0x00000000030A2000-memory.dmp

Filesize
3.9MB

Download
memory/2900-865-0x0000000002CB0000-0x00000000030A2000-memory.dmp

Filesize
3.9MB

Download
memory/2900-51-0x000000013F200000-0x000000013F5F2000-memory.dmp

Filesize
3.9MB

Download
memory/2900-63-0x0000000002CB0000-0x00000000030A2000-memory.dmp

Filesize
3.9MB

Download
memory/2904-6857-0x000000013FBE0000-0x000000013FFD2000-memory.dmp

Filesize
3.9MB

Download
memory/2904-252-0x000000013FBE0000-0x000000013FFD2000-memory.dmp

Filesize
3.9MB

Download
memory/2904-39-0x000000013FBE0000-0x000000013FFD2000-memory.dmp

Filesize
3.9MB

Download
memory/3052-6843-0x000000013F9C0000-0x000000013FDB2000-memory.dmp

Filesize
3.9MB

Download
memory/3052-47-0x000000013F9C0000-0x000000013FDB2000-memory.dmp

Filesize
3.9MB

Download
memory/3052-578-0x000000013F9C0000-0x000000013FDB2000-memory.dmp

Filesize
3.9MB

Download