xmrig | 025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0

Analysis

max time kernel
150s
max time network
144s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
03-07-2024 16:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
Size

1.1MB
MD5

08275f5b4266a89dc9bd3587cddee170
SHA1

bbb4c691ff0dfa4e3afb914297125f6f49cdce3a
SHA256

025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0
SHA512

8b7938fc08930c2041515d9c418b34dea619e51d78e24e1e6e0325a40ef5d0169f33aac21b144c90052e0b7056952106961d8805af40d523d08803c4f61e6678
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYGiYFYS+P6:Lz071uv4BPMkibTIA5G1YA

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 21 IoCs

miner

resource	yara_rule
behavioral1/memory/1916-2-0x000000013F8A0000-0x000000013FC92000-memory.dmp	xmrig
behavioral1/memory/1684-13-0x000000013F990000-0x000000013FD82000-memory.dmp	xmrig
behavioral1/memory/2680-105-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	xmrig
behavioral1/memory/3024-95-0x000000013F610000-0x000000013FA02000-memory.dmp	xmrig
behavioral1/memory/2504-94-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	xmrig
behavioral1/memory/2752-90-0x000000013FF10000-0x0000000140302000-memory.dmp	xmrig
behavioral1/memory/3020-89-0x000000013F620000-0x000000013FA12000-memory.dmp	xmrig
behavioral1/memory/2924-87-0x000000013FFD0000-0x00000001403C2000-memory.dmp	xmrig
behavioral1/memory/2516-83-0x000000013FE70000-0x0000000140262000-memory.dmp	xmrig
behavioral1/memory/2712-82-0x000000013F0A0000-0x000000013F492000-memory.dmp	xmrig
behavioral1/memory/2640-73-0x000000013FE50000-0x0000000140242000-memory.dmp	xmrig
behavioral1/memory/2700-72-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	xmrig
behavioral1/memory/2712-5397-0x000000013F0A0000-0x000000013F492000-memory.dmp	xmrig
behavioral1/memory/2516-5399-0x000000013FE70000-0x0000000140262000-memory.dmp	xmrig
behavioral1/memory/2640-5391-0x000000013FE50000-0x0000000140242000-memory.dmp	xmrig
behavioral1/memory/2504-5405-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	xmrig
behavioral1/memory/2924-5403-0x000000013FFD0000-0x00000001403C2000-memory.dmp	xmrig
behavioral1/memory/2752-5402-0x000000013FF10000-0x0000000140302000-memory.dmp	xmrig
behavioral1/memory/3024-5407-0x000000013F610000-0x000000013FA02000-memory.dmp	xmrig
behavioral1/memory/2680-5414-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	xmrig
behavioral1/memory/1916-5469-0x000000013F8A0000-0x000000013FC92000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1264	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1684	OyOyHSx.exe
3020	FqidVPf.exe
2700	oPuOHOD.exe
2640	FRfgwCa.exe
2752	FhvBgdH.exe
2712	UAwXquF.exe
2516	BpsmyLn.exe
2504	jvyqYJE.exe
2924	KyASqeL.exe
3024	nOxYzWl.exe
2680	XrrXYAH.exe
2604	RXdAcZg.exe
2556	VkIHgXX.exe
620	qbWvhba.exe
1612	eEvXIxR.exe
1696	rSfJNKj.exe
2292	qJifsty.exe
912	ZwbhfZW.exe
1556	mMVBZKj.exe
2532	QDaNIsQ.exe
2288	WgQfJuX.exe
1924	xGEoecz.exe
572	fWzYqlO.exe
2864	DgmJKrs.exe
852	DwfNRxq.exe
1248	txOlztI.exe
2304	fjrOxta.exe
836	MZukope.exe
2284	pqHwNQk.exe
788	SXwHDTh.exe
2232	QvQlUxo.exe
1468	krqsLVA.exe
1900	dtTvAka.exe
688	JIesoef.exe
2344	oCKahiW.exe
1352	YYbrgHT.exe
1856	HqPHDbb.exe
3040	aoxWZiA.exe
3048	MUvWUva.exe
764	XjEgJBB.exe
2872	mlwpVoe.exe
2072	upiIpXe.exe
1044	ZBnXHFM.exe
1144	BkKArhz.exe
2388	WUblGdX.exe
1132	JdryZbC.exe
2040	QybTFmZ.exe
2964	DTduWhP.exe
2972	YIHmyUo.exe
1708	brQCqSo.exe
1712	fysEnAa.exe
2424	QtcQzTt.exe
2036	uhbGPJP.exe
2572	BsCTHwI.exe
1580	UYfhPZK.exe
1688	GvikjWx.exe
2968	GVwvMqV.exe
2432	flxmPRO.exe
1976	FIQlbYH.exe
2740	AVfONjQ.exe
2596	rRdEmoL.exe
2808	mjxxkKg.exe
2580	NLiRQKZ.exe
2524	cSIWcAF.exe

Loads dropped DLL 64 IoCs

pid	Process
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe

UPX packed file 56 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1916-2-0x000000013F8A0000-0x000000013FC92000-memory.dmp	upx
behavioral1/files/0x000c0000000132ef-3.dat	upx
behavioral1/files/0x00130000000054a8-21.dat	upx
behavioral1/files/0x001c000000015c98-20.dat	upx
behavioral1/memory/1684-13-0x000000013F990000-0x000000013FD82000-memory.dmp	upx
behavioral1/files/0x0008000000015ccb-39.dat	upx
behavioral1/files/0x0007000000015cd8-32.dat	upx
behavioral1/files/0x00060000000175d2-96.dat	upx
behavioral1/files/0x00050000000186d7-62.dat	upx
behavioral1/files/0x0006000000019018-119.dat	upx
behavioral1/files/0x000500000001935f-197.dat	upx
behavioral1/files/0x000500000001924d-175.dat	upx
behavioral1/files/0x000500000001959f-187.dat	upx
behavioral1/files/0x001b000000015ca0-181.dat	upx
behavioral1/files/0x000500000001941e-180.dat	upx
behavioral1/files/0x0005000000019412-172.dat	upx
behavioral1/files/0x00050000000193f5-165.dat	upx
behavioral1/files/0x00050000000193af-156.dat	upx
behavioral1/files/0x0005000000019383-148.dat	upx
behavioral1/files/0x00050000000195e7-195.dat	upx
behavioral1/files/0x0005000000019514-194.dat	upx
behavioral1/files/0x000500000001922a-126.dat	upx
behavioral1/files/0x00050000000193f9-170.dat	upx
behavioral1/files/0x00050000000193c8-162.dat	upx
behavioral1/files/0x0005000000019391-155.dat	upx
behavioral1/files/0x0005000000019370-146.dat	upx
behavioral1/files/0x000500000001925c-138.dat	upx
behavioral1/files/0x0005000000019241-130.dat	upx
behavioral1/files/0x0005000000018762-116.dat	upx
behavioral1/files/0x0005000000018716-106.dat	upx
behavioral1/memory/2680-105-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	upx
behavioral1/files/0x0031000000018655-99.dat	upx
behavioral1/files/0x0005000000018760-110.dat	upx
behavioral1/files/0x0009000000018654-56.dat	upx
behavioral1/files/0x00060000000175cc-55.dat	upx
behavioral1/memory/3024-95-0x000000013F610000-0x000000013FA02000-memory.dmp	upx
behavioral1/memory/2504-94-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	upx
behavioral1/memory/2752-90-0x000000013FF10000-0x0000000140302000-memory.dmp	upx
behavioral1/memory/3020-89-0x000000013F620000-0x000000013FA12000-memory.dmp	upx
behavioral1/memory/2924-87-0x000000013FFD0000-0x00000001403C2000-memory.dmp	upx
behavioral1/memory/2516-83-0x000000013FE70000-0x0000000140262000-memory.dmp	upx
behavioral1/memory/2712-82-0x000000013F0A0000-0x000000013F492000-memory.dmp	upx
behavioral1/files/0x0007000000015cea-80.dat	upx
behavioral1/files/0x00050000000186e9-75.dat	upx
behavioral1/files/0x0005000000018670-74.dat	upx
behavioral1/memory/2640-73-0x000000013FE50000-0x0000000140242000-memory.dmp	upx
behavioral1/memory/2700-72-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	upx
behavioral1/memory/2712-5397-0x000000013F0A0000-0x000000013F492000-memory.dmp	upx
behavioral1/memory/2516-5399-0x000000013FE70000-0x0000000140262000-memory.dmp	upx
behavioral1/memory/2640-5391-0x000000013FE50000-0x0000000140242000-memory.dmp	upx
behavioral1/memory/2504-5405-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	upx
behavioral1/memory/2924-5403-0x000000013FFD0000-0x00000001403C2000-memory.dmp	upx
behavioral1/memory/2752-5402-0x000000013FF10000-0x0000000140302000-memory.dmp	upx
behavioral1/memory/3024-5407-0x000000013F610000-0x000000013FA02000-memory.dmp	upx
behavioral1/memory/2680-5414-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	upx
behavioral1/memory/1916-5469-0x000000013F8A0000-0x000000013FC92000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\HvEwQDq.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\gTtlTDt.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\QYvPDQh.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\jjPwBGx.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\XhSjFTv.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\rJwvqFR.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\lQrpTAt.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\PajDbOT.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\ztvfPgZ.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\iZrgCrJ.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\rCrDqps.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\mJdWkUW.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\tATqyZS.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\LCQSQep.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\gQYEyqb.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\gFHCFCh.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\twgVZzN.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\dxUIjip.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\LLtUIXS.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\MvXkyKD.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\apQQLUt.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\bZTUPzA.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\aarqyNK.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\VpktMvK.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\ifmvWnR.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\hpMAfUW.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\BqVzKpt.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\pcQYlgi.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\PuTBAUT.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\MBSKcus.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\tbnjQXH.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\EzBTDBA.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\CsivzgY.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\uTgJYOt.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\kwtAeyf.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\qmxLHsv.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\cjAKGfW.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\TzkqkEj.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\CkpJSKp.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\MpCxUIY.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\JqtVWez.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\vnHNJEQ.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\nBcEXGJ.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\GMJjqSG.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\kyosjpO.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\IsUubpu.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\VLcoNgP.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\QYCOjbt.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\GDIMRBD.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\qIOEFSM.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\aKCjebK.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\otjMSbk.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\YQqyhhF.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\yxdjxLE.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\YqlQeDn.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\eVPptpk.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\NVoMFXF.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\tLtQOoA.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\rSfJNKj.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\PssQgMR.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\JebvhlI.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\PkrPnZf.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\WXJLaPe.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
File created	C:\Windows\System\CwxIfRl.exe	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1264	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
Token: SeLockMemoryPrivilege	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
Token: SeDebugPrivilege	1264	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 1264	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	29
PID 1916 wrote to memory of 1264	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	29
PID 1916 wrote to memory of 1264	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	29
PID 1916 wrote to memory of 1684	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	30
PID 1916 wrote to memory of 1684	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	30
PID 1916 wrote to memory of 1684	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	30
PID 1916 wrote to memory of 3020	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	31
PID 1916 wrote to memory of 3020	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	31
PID 1916 wrote to memory of 3020	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	31
PID 1916 wrote to memory of 2700	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	32
PID 1916 wrote to memory of 2700	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	32
PID 1916 wrote to memory of 2700	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	32
PID 1916 wrote to memory of 2752	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	33
PID 1916 wrote to memory of 2752	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	33
PID 1916 wrote to memory of 2752	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	33
PID 1916 wrote to memory of 2640	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	34
PID 1916 wrote to memory of 2640	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	34
PID 1916 wrote to memory of 2640	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	34
PID 1916 wrote to memory of 3024	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	35
PID 1916 wrote to memory of 3024	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	35
PID 1916 wrote to memory of 3024	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	35
PID 1916 wrote to memory of 2712	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	36
PID 1916 wrote to memory of 2712	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	36
PID 1916 wrote to memory of 2712	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	36
PID 1916 wrote to memory of 2680	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	37
PID 1916 wrote to memory of 2680	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	37
PID 1916 wrote to memory of 2680	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	37
PID 1916 wrote to memory of 2516	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	38
PID 1916 wrote to memory of 2516	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	38
PID 1916 wrote to memory of 2516	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	38
PID 1916 wrote to memory of 2604	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	39
PID 1916 wrote to memory of 2604	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	39
PID 1916 wrote to memory of 2604	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	39
PID 1916 wrote to memory of 2504	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	40
PID 1916 wrote to memory of 2504	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	40
PID 1916 wrote to memory of 2504	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	40
PID 1916 wrote to memory of 2556	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	41
PID 1916 wrote to memory of 2556	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	41
PID 1916 wrote to memory of 2556	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	41
PID 1916 wrote to memory of 2924	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	42
PID 1916 wrote to memory of 2924	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	42
PID 1916 wrote to memory of 2924	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	42
PID 1916 wrote to memory of 620	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	43
PID 1916 wrote to memory of 620	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	43
PID 1916 wrote to memory of 620	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	43
PID 1916 wrote to memory of 1612	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	44
PID 1916 wrote to memory of 1612	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	44
PID 1916 wrote to memory of 1612	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	44
PID 1916 wrote to memory of 1696	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	45
PID 1916 wrote to memory of 1696	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	45
PID 1916 wrote to memory of 1696	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	45
PID 1916 wrote to memory of 2292	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	46
PID 1916 wrote to memory of 2292	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	46
PID 1916 wrote to memory of 2292	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	46
PID 1916 wrote to memory of 912	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	47
PID 1916 wrote to memory of 912	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	47
PID 1916 wrote to memory of 912	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	47
PID 1916 wrote to memory of 1556	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	48
PID 1916 wrote to memory of 1556	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	48
PID 1916 wrote to memory of 1556	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	48
PID 1916 wrote to memory of 852	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	49
PID 1916 wrote to memory of 852	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	49
PID 1916 wrote to memory of 852	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	49
PID 1916 wrote to memory of 2532	1916	025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe	50

C:\Users\Admin\AppData\Local\Temp\025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe
"C:\Users\Admin\AppData\Local\Temp\025fc51a38c42951a828da55a74ba4d8bc850b4296e7a3a4c0fb58ad4cc9dfd0.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1264
- C:\Windows\System\OyOyHSx.exe
  C:\Windows\System\OyOyHSx.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\FqidVPf.exe
  C:\Windows\System\FqidVPf.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\oPuOHOD.exe
  C:\Windows\System\oPuOHOD.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\FhvBgdH.exe
  C:\Windows\System\FhvBgdH.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\FRfgwCa.exe
  C:\Windows\System\FRfgwCa.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\nOxYzWl.exe
  C:\Windows\System\nOxYzWl.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\UAwXquF.exe
  C:\Windows\System\UAwXquF.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\XrrXYAH.exe
  C:\Windows\System\XrrXYAH.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\BpsmyLn.exe
  C:\Windows\System\BpsmyLn.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\RXdAcZg.exe
  C:\Windows\System\RXdAcZg.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\jvyqYJE.exe
  C:\Windows\System\jvyqYJE.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\VkIHgXX.exe
  C:\Windows\System\VkIHgXX.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\KyASqeL.exe
  C:\Windows\System\KyASqeL.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\qbWvhba.exe
  C:\Windows\System\qbWvhba.exe
  2⤵
  - Executes dropped EXE
  PID:620
- C:\Windows\System\eEvXIxR.exe
  C:\Windows\System\eEvXIxR.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\rSfJNKj.exe
  C:\Windows\System\rSfJNKj.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\qJifsty.exe
  C:\Windows\System\qJifsty.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\ZwbhfZW.exe
  C:\Windows\System\ZwbhfZW.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\mMVBZKj.exe
  C:\Windows\System\mMVBZKj.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\DwfNRxq.exe
  C:\Windows\System\DwfNRxq.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\QDaNIsQ.exe
  C:\Windows\System\QDaNIsQ.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\pqHwNQk.exe
  C:\Windows\System\pqHwNQk.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\WgQfJuX.exe
  C:\Windows\System\WgQfJuX.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\SXwHDTh.exe
  C:\Windows\System\SXwHDTh.exe
  2⤵
  - Executes dropped EXE
  PID:788
- C:\Windows\System\xGEoecz.exe
  C:\Windows\System\xGEoecz.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\QvQlUxo.exe
  C:\Windows\System\QvQlUxo.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\fWzYqlO.exe
  C:\Windows\System\fWzYqlO.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\krqsLVA.exe
  C:\Windows\System\krqsLVA.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\DgmJKrs.exe
  C:\Windows\System\DgmJKrs.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\dtTvAka.exe
  C:\Windows\System\dtTvAka.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\txOlztI.exe
  C:\Windows\System\txOlztI.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\JIesoef.exe
  C:\Windows\System\JIesoef.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\fjrOxta.exe
  C:\Windows\System\fjrOxta.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\oCKahiW.exe
  C:\Windows\System\oCKahiW.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\MZukope.exe
  C:\Windows\System\MZukope.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\YYbrgHT.exe
  C:\Windows\System\YYbrgHT.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\HqPHDbb.exe
  C:\Windows\System\HqPHDbb.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\aoxWZiA.exe
  C:\Windows\System\aoxWZiA.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\MUvWUva.exe
  C:\Windows\System\MUvWUva.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\XjEgJBB.exe
  C:\Windows\System\XjEgJBB.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\mlwpVoe.exe
  C:\Windows\System\mlwpVoe.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\upiIpXe.exe
  C:\Windows\System\upiIpXe.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\ZBnXHFM.exe
  C:\Windows\System\ZBnXHFM.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\BkKArhz.exe
  C:\Windows\System\BkKArhz.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\WUblGdX.exe
  C:\Windows\System\WUblGdX.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\JdryZbC.exe
  C:\Windows\System\JdryZbC.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\QybTFmZ.exe
  C:\Windows\System\QybTFmZ.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\DTduWhP.exe
  C:\Windows\System\DTduWhP.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\YIHmyUo.exe
  C:\Windows\System\YIHmyUo.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\brQCqSo.exe
  C:\Windows\System\brQCqSo.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\fysEnAa.exe
  C:\Windows\System\fysEnAa.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\QtcQzTt.exe
  C:\Windows\System\QtcQzTt.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\uhbGPJP.exe
  C:\Windows\System\uhbGPJP.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\BsCTHwI.exe
  C:\Windows\System\BsCTHwI.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\UYfhPZK.exe
  C:\Windows\System\UYfhPZK.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\GvikjWx.exe
  C:\Windows\System\GvikjWx.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\GVwvMqV.exe
  C:\Windows\System\GVwvMqV.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\flxmPRO.exe
  C:\Windows\System\flxmPRO.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\FIQlbYH.exe
  C:\Windows\System\FIQlbYH.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\AVfONjQ.exe
  C:\Windows\System\AVfONjQ.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\rRdEmoL.exe
  C:\Windows\System\rRdEmoL.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\mjxxkKg.exe
  C:\Windows\System\mjxxkKg.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\NLiRQKZ.exe
  C:\Windows\System\NLiRQKZ.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\cSIWcAF.exe
  C:\Windows\System\cSIWcAF.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\yIuvjBi.exe
  C:\Windows\System\yIuvjBi.exe
  2⤵
  PID:3004
- C:\Windows\System\jeCoNOM.exe
  C:\Windows\System\jeCoNOM.exe
  2⤵
  PID:1496
- C:\Windows\System\BamTtEM.exe
  C:\Windows\System\BamTtEM.exe
  2⤵
  PID:2300
- C:\Windows\System\ifhGnRq.exe
  C:\Windows\System\ifhGnRq.exe
  2⤵
  PID:2488
- C:\Windows\System\yCBGdRd.exe
  C:\Windows\System\yCBGdRd.exe
  2⤵
  PID:1912
- C:\Windows\System\YtNKpWW.exe
  C:\Windows\System\YtNKpWW.exe
  2⤵
  PID:1964
- C:\Windows\System\CzixxLp.exe
  C:\Windows\System\CzixxLp.exe
  2⤵
  PID:2152
- C:\Windows\System\uSqcIxX.exe
  C:\Windows\System\uSqcIxX.exe
  2⤵
  PID:2724
- C:\Windows\System\SbnRHDE.exe
  C:\Windows\System\SbnRHDE.exe
  2⤵
  PID:2544
- C:\Windows\System\cgYqfmO.exe
  C:\Windows\System\cgYqfmO.exe
  2⤵
  PID:1736
- C:\Windows\System\IFWMRoy.exe
  C:\Windows\System\IFWMRoy.exe
  2⤵
  PID:2296
- C:\Windows\System\HbwWHya.exe
  C:\Windows\System\HbwWHya.exe
  2⤵
  PID:2720
- C:\Windows\System\CVgRFNK.exe
  C:\Windows\System\CVgRFNK.exe
  2⤵
  PID:2500
- C:\Windows\System\bcHTDlC.exe
  C:\Windows\System\bcHTDlC.exe
  2⤵
  PID:2932
- C:\Windows\System\wtlKtGr.exe
  C:\Windows\System\wtlKtGr.exe
  2⤵
  PID:2552
- C:\Windows\System\FlUlzaW.exe
  C:\Windows\System\FlUlzaW.exe
  2⤵
  PID:2560
- C:\Windows\System\CAIhGFn.exe
  C:\Windows\System\CAIhGFn.exe
  2⤵
  PID:2804
- C:\Windows\System\plXijdW.exe
  C:\Windows\System\plXijdW.exe
  2⤵
  PID:2728
- C:\Windows\System\oyYahIh.exe
  C:\Windows\System\oyYahIh.exe
  2⤵
  PID:2332
- C:\Windows\System\mcMvkoc.exe
  C:\Windows\System\mcMvkoc.exe
  2⤵
  PID:2244
- C:\Windows\System\CwbFFkR.exe
  C:\Windows\System\CwbFFkR.exe
  2⤵
  PID:2368
- C:\Windows\System\qdlgpOF.exe
  C:\Windows\System\qdlgpOF.exe
  2⤵
  PID:1280
- C:\Windows\System\tFYYbhN.exe
  C:\Windows\System\tFYYbhN.exe
  2⤵
  PID:1080
- C:\Windows\System\YjvrMKw.exe
  C:\Windows\System\YjvrMKw.exe
  2⤵
  PID:2688
- C:\Windows\System\YODSmaN.exe
  C:\Windows\System\YODSmaN.exe
  2⤵
  PID:1276
- C:\Windows\System\aStXWpq.exe
  C:\Windows\System\aStXWpq.exe
  2⤵
  PID:1972
- C:\Windows\System\kehFtcD.exe
  C:\Windows\System\kehFtcD.exe
  2⤵
  PID:3068
- C:\Windows\System\zoBtduc.exe
  C:\Windows\System\zoBtduc.exe
  2⤵
  PID:2960
- C:\Windows\System\akSGzge.exe
  C:\Windows\System\akSGzge.exe
  2⤵
  PID:2884
- C:\Windows\System\ErIuoTn.exe
  C:\Windows\System\ErIuoTn.exe
  2⤵
  PID:1632
- C:\Windows\System\DaDGDfK.exe
  C:\Windows\System\DaDGDfK.exe
  2⤵
  PID:2584
- C:\Windows\System\EYpGSWk.exe
  C:\Windows\System\EYpGSWk.exe
  2⤵
  PID:3060
- C:\Windows\System\MteULAa.exe
  C:\Windows\System\MteULAa.exe
  2⤵
  PID:2628
- C:\Windows\System\cWRDNqH.exe
  C:\Windows\System\cWRDNqH.exe
  2⤵
  PID:1704
- C:\Windows\System\QgOUNpM.exe
  C:\Windows\System\QgOUNpM.exe
  2⤵
  PID:2520
- C:\Windows\System\LivfqIx.exe
  C:\Windows\System\LivfqIx.exe
  2⤵
  PID:876
- C:\Windows\System\saNKSig.exe
  C:\Windows\System\saNKSig.exe
  2⤵
  PID:1516
- C:\Windows\System\MxjmtnI.exe
  C:\Windows\System\MxjmtnI.exe
  2⤵
  PID:2160
- C:\Windows\System\uFgXnDT.exe
  C:\Windows\System\uFgXnDT.exe
  2⤵
  PID:2732
- C:\Windows\System\NLWgBcF.exe
  C:\Windows\System\NLWgBcF.exe
  2⤵
  PID:1680
- C:\Windows\System\PQYAeOY.exe
  C:\Windows\System\PQYAeOY.exe
  2⤵
  PID:2468
- C:\Windows\System\RpjjnUi.exe
  C:\Windows\System\RpjjnUi.exe
  2⤵
  PID:1948
- C:\Windows\System\sgAiekg.exe
  C:\Windows\System\sgAiekg.exe
  2⤵
  PID:1812
- C:\Windows\System\fAynLmb.exe
  C:\Windows\System\fAynLmb.exe
  2⤵
  PID:1980
- C:\Windows\System\YnOPtCW.exe
  C:\Windows\System\YnOPtCW.exe
  2⤵
  PID:808
- C:\Windows\System\CbpuvvT.exe
  C:\Windows\System\CbpuvvT.exe
  2⤵
  PID:2812
- C:\Windows\System\QiDYZom.exe
  C:\Windows\System\QiDYZom.exe
  2⤵
  PID:1740
- C:\Windows\System\qBDbFVY.exe
  C:\Windows\System\qBDbFVY.exe
  2⤵
  PID:2684
- C:\Windows\System\BucGSUA.exe
  C:\Windows\System\BucGSUA.exe
  2⤵
  PID:2744
- C:\Windows\System\uxDGmPo.exe
  C:\Windows\System\uxDGmPo.exe
  2⤵
  PID:2004
- C:\Windows\System\AwGIyHw.exe
  C:\Windows\System\AwGIyHw.exe
  2⤵
  PID:2260
- C:\Windows\System\NVoMFXF.exe
  C:\Windows\System\NVoMFXF.exe
  2⤵
  PID:612
- C:\Windows\System\YgcWRYW.exe
  C:\Windows\System\YgcWRYW.exe
  2⤵
  PID:1844
- C:\Windows\System\bzawleo.exe
  C:\Windows\System\bzawleo.exe
  2⤵
  PID:348
- C:\Windows\System\mnwhmjw.exe
  C:\Windows\System\mnwhmjw.exe
  2⤵
  PID:1820
- C:\Windows\System\fIMKoyF.exe
  C:\Windows\System\fIMKoyF.exe
  2⤵
  PID:2076
- C:\Windows\System\MBSKcus.exe
  C:\Windows\System\MBSKcus.exe
  2⤵
  PID:2588
- C:\Windows\System\VXbBXxj.exe
  C:\Windows\System\VXbBXxj.exe
  2⤵
  PID:1788
- C:\Windows\System\mKqgMZv.exe
  C:\Windows\System\mKqgMZv.exe
  2⤵
  PID:596
- C:\Windows\System\yrRfEOJ.exe
  C:\Windows\System\yrRfEOJ.exe
  2⤵
  PID:616
- C:\Windows\System\QSxomCN.exe
  C:\Windows\System\QSxomCN.exe
  2⤵
  PID:1716
- C:\Windows\System\oXCcZoa.exe
  C:\Windows\System\oXCcZoa.exe
  2⤵
  PID:2876
- C:\Windows\System\gUIEzIj.exe
  C:\Windows\System\gUIEzIj.exe
  2⤵
  PID:2156
- C:\Windows\System\UUFVnsc.exe
  C:\Windows\System\UUFVnsc.exe
  2⤵
  PID:1700
- C:\Windows\System\RODCkYR.exe
  C:\Windows\System\RODCkYR.exe
  2⤵
  PID:2356
- C:\Windows\System\aTfIQmh.exe
  C:\Windows\System\aTfIQmh.exe
  2⤵
  PID:108
- C:\Windows\System\ThpyRWB.exe
  C:\Windows\System\ThpyRWB.exe
  2⤵
  PID:2220
- C:\Windows\System\WkKjbOk.exe
  C:\Windows\System\WkKjbOk.exe
  2⤵
  PID:2956
- C:\Windows\System\rAQmBLM.exe
  C:\Windows\System\rAQmBLM.exe
  2⤵
  PID:2652
- C:\Windows\System\MGJXfoZ.exe
  C:\Windows\System\MGJXfoZ.exe
  2⤵
  PID:2736
- C:\Windows\System\fNHyxZv.exe
  C:\Windows\System\fNHyxZv.exe
  2⤵
  PID:1920
- C:\Windows\System\fevfHJA.exe
  C:\Windows\System\fevfHJA.exe
  2⤵
  PID:2920
- C:\Windows\System\PnzJlXD.exe
  C:\Windows\System\PnzJlXD.exe
  2⤵
  PID:2412
- C:\Windows\System\oamyzXF.exe
  C:\Windows\System\oamyzXF.exe
  2⤵
  PID:1148
- C:\Windows\System\bXAoBGA.exe
  C:\Windows\System\bXAoBGA.exe
  2⤵
  PID:2796
- C:\Windows\System\dcMEYCi.exe
  C:\Windows\System\dcMEYCi.exe
  2⤵
  PID:2084
- C:\Windows\System\vNOusfx.exe
  C:\Windows\System\vNOusfx.exe
  2⤵
  PID:2268
- C:\Windows\System\gDJwBik.exe
  C:\Windows\System\gDJwBik.exe
  2⤵
  PID:2824
- C:\Windows\System\JUMVIgL.exe
  C:\Windows\System\JUMVIgL.exe
  2⤵
  PID:236
- C:\Windows\System\omGDUJy.exe
  C:\Windows\System\omGDUJy.exe
  2⤵
  PID:1416
- C:\Windows\System\hiHPGiT.exe
  C:\Windows\System\hiHPGiT.exe
  2⤵
  PID:1476
- C:\Windows\System\qzRFHri.exe
  C:\Windows\System\qzRFHri.exe
  2⤵
  PID:1324
- C:\Windows\System\ztZKxFn.exe
  C:\Windows\System\ztZKxFn.exe
  2⤵
  PID:1320
- C:\Windows\System\EEWEpsY.exe
  C:\Windows\System\EEWEpsY.exe
  2⤵
  PID:708
- C:\Windows\System\ROWShKW.exe
  C:\Windows\System\ROWShKW.exe
  2⤵
  PID:1124
- C:\Windows\System\VvnMmFF.exe
  C:\Windows\System\VvnMmFF.exe
  2⤵
  PID:1628
- C:\Windows\System\rVdhLWE.exe
  C:\Windows\System\rVdhLWE.exe
  2⤵
  PID:3028
- C:\Windows\System\fEVMAro.exe
  C:\Windows\System\fEVMAro.exe
  2⤵
  PID:892
- C:\Windows\System\lQKVLpK.exe
  C:\Windows\System\lQKVLpK.exe
  2⤵
  PID:2656
- C:\Windows\System\BaovqkQ.exe
  C:\Windows\System\BaovqkQ.exe
  2⤵
  PID:2788
- C:\Windows\System\GeUNLkK.exe
  C:\Windows\System\GeUNLkK.exe
  2⤵
  PID:2492
- C:\Windows\System\ZuAbRHG.exe
  C:\Windows\System\ZuAbRHG.exe
  2⤵
  PID:2280
- C:\Windows\System\hBlFDnc.exe
  C:\Windows\System\hBlFDnc.exe
  2⤵
  PID:1512
- C:\Windows\System\xsAeSLD.exe
  C:\Windows\System\xsAeSLD.exe
  2⤵
  PID:2168
- C:\Windows\System\MeznAhH.exe
  C:\Windows\System\MeznAhH.exe
  2⤵
  PID:1756
- C:\Windows\System\okbZPKK.exe
  C:\Windows\System\okbZPKK.exe
  2⤵
  PID:2564
- C:\Windows\System\tidWLIg.exe
  C:\Windows\System\tidWLIg.exe
  2⤵
  PID:1860
- C:\Windows\System\CraSjIA.exe
  C:\Windows\System\CraSjIA.exe
  2⤵
  PID:1544
- C:\Windows\System\kvbdFvd.exe
  C:\Windows\System\kvbdFvd.exe
  2⤵
  PID:2600
- C:\Windows\System\NOmRJJy.exe
  C:\Windows\System\NOmRJJy.exe
  2⤵
  PID:2372
- C:\Windows\System\jmWXYPx.exe
  C:\Windows\System\jmWXYPx.exe
  2⤵
  PID:3080
- C:\Windows\System\ayhiXNa.exe
  C:\Windows\System\ayhiXNa.exe
  2⤵
  PID:3096
- C:\Windows\System\XNeRoHO.exe
  C:\Windows\System\XNeRoHO.exe
  2⤵
  PID:3112
- C:\Windows\System\snCRLdq.exe
  C:\Windows\System\snCRLdq.exe
  2⤵
  PID:3128
- C:\Windows\System\XasQNBc.exe
  C:\Windows\System\XasQNBc.exe
  2⤵
  PID:3144
- C:\Windows\System\JduYLXS.exe
  C:\Windows\System\JduYLXS.exe
  2⤵
  PID:3164
- C:\Windows\System\PNDPAdQ.exe
  C:\Windows\System\PNDPAdQ.exe
  2⤵
  PID:3180
- C:\Windows\System\YvyRNEJ.exe
  C:\Windows\System\YvyRNEJ.exe
  2⤵
  PID:3200
- C:\Windows\System\crXybVR.exe
  C:\Windows\System\crXybVR.exe
  2⤵
  PID:3216
- C:\Windows\System\OELriXu.exe
  C:\Windows\System\OELriXu.exe
  2⤵
  PID:3232
- C:\Windows\System\aNYxPht.exe
  C:\Windows\System\aNYxPht.exe
  2⤵
  PID:3248
- C:\Windows\System\dcmiIbK.exe
  C:\Windows\System\dcmiIbK.exe
  2⤵
  PID:3264
- C:\Windows\System\irZqshb.exe
  C:\Windows\System\irZqshb.exe
  2⤵
  PID:3280
- C:\Windows\System\mzZfpSU.exe
  C:\Windows\System\mzZfpSU.exe
  2⤵
  PID:3296
- C:\Windows\System\tLaallC.exe
  C:\Windows\System\tLaallC.exe
  2⤵
  PID:3312
- C:\Windows\System\AMnCYLg.exe
  C:\Windows\System\AMnCYLg.exe
  2⤵
  PID:3328
- C:\Windows\System\QwJtbee.exe
  C:\Windows\System\QwJtbee.exe
  2⤵
  PID:3344
- C:\Windows\System\FkayVpj.exe
  C:\Windows\System\FkayVpj.exe
  2⤵
  PID:3360
- C:\Windows\System\IAsCSyt.exe
  C:\Windows\System\IAsCSyt.exe
  2⤵
  PID:3376
- C:\Windows\System\QFpizZM.exe
  C:\Windows\System\QFpizZM.exe
  2⤵
  PID:3392
- C:\Windows\System\NBhgKDO.exe
  C:\Windows\System\NBhgKDO.exe
  2⤵
  PID:3408
- C:\Windows\System\pdEJlbD.exe
  C:\Windows\System\pdEJlbD.exe
  2⤵
  PID:3424
- C:\Windows\System\RsDwDNf.exe
  C:\Windows\System\RsDwDNf.exe
  2⤵
  PID:3472
- C:\Windows\System\EnMkFOB.exe
  C:\Windows\System\EnMkFOB.exe
  2⤵
  PID:3488
- C:\Windows\System\JHmaxbv.exe
  C:\Windows\System\JHmaxbv.exe
  2⤵
  PID:3504
- C:\Windows\System\VZDrwiv.exe
  C:\Windows\System\VZDrwiv.exe
  2⤵
  PID:3520
- C:\Windows\System\WDPvLfK.exe
  C:\Windows\System\WDPvLfK.exe
  2⤵
  PID:3536
- C:\Windows\System\drQydjg.exe
  C:\Windows\System\drQydjg.exe
  2⤵
  PID:3552
- C:\Windows\System\fVgaLgO.exe
  C:\Windows\System\fVgaLgO.exe
  2⤵
  PID:3568
- C:\Windows\System\esDieie.exe
  C:\Windows\System\esDieie.exe
  2⤵
  PID:3588
- C:\Windows\System\jtWuBtf.exe
  C:\Windows\System\jtWuBtf.exe
  2⤵
  PID:3604
- C:\Windows\System\mzkgIMv.exe
  C:\Windows\System\mzkgIMv.exe
  2⤵
  PID:3620
- C:\Windows\System\GWecFDD.exe
  C:\Windows\System\GWecFDD.exe
  2⤵
  PID:3636
- C:\Windows\System\PKJNfeK.exe
  C:\Windows\System\PKJNfeK.exe
  2⤵
  PID:3652
- C:\Windows\System\MyFbDEz.exe
  C:\Windows\System\MyFbDEz.exe
  2⤵
  PID:3668
- C:\Windows\System\RuqjFfg.exe
  C:\Windows\System\RuqjFfg.exe
  2⤵
  PID:3684
- C:\Windows\System\zyXsMYY.exe
  C:\Windows\System\zyXsMYY.exe
  2⤵
  PID:3704
- C:\Windows\System\RlSMRiX.exe
  C:\Windows\System\RlSMRiX.exe
  2⤵
  PID:3720
- C:\Windows\System\zCwGhbe.exe
  C:\Windows\System\zCwGhbe.exe
  2⤵
  PID:3736
- C:\Windows\System\hQvueiF.exe
  C:\Windows\System\hQvueiF.exe
  2⤵
  PID:3760
- C:\Windows\System\dNCcWzw.exe
  C:\Windows\System\dNCcWzw.exe
  2⤵
  PID:3780
- C:\Windows\System\IlbcVRk.exe
  C:\Windows\System\IlbcVRk.exe
  2⤵
  PID:3796
- C:\Windows\System\ZamQxyR.exe
  C:\Windows\System\ZamQxyR.exe
  2⤵
  PID:3812
- C:\Windows\System\FDzncGJ.exe
  C:\Windows\System\FDzncGJ.exe
  2⤵
  PID:3828
- C:\Windows\System\jWicSeJ.exe
  C:\Windows\System\jWicSeJ.exe
  2⤵
  PID:3844
- C:\Windows\System\cdiBCES.exe
  C:\Windows\System\cdiBCES.exe
  2⤵
  PID:3860
- C:\Windows\System\yYlGzEm.exe
  C:\Windows\System\yYlGzEm.exe
  2⤵
  PID:3880
- C:\Windows\System\ZqIcWIK.exe
  C:\Windows\System\ZqIcWIK.exe
  2⤵
  PID:3896
- C:\Windows\System\BIPltHA.exe
  C:\Windows\System\BIPltHA.exe
  2⤵
  PID:3912
- C:\Windows\System\oLtLkwK.exe
  C:\Windows\System\oLtLkwK.exe
  2⤵
  PID:3928
- C:\Windows\System\goGlTbS.exe
  C:\Windows\System\goGlTbS.exe
  2⤵
  PID:3944
- C:\Windows\System\jNwXvrb.exe
  C:\Windows\System\jNwXvrb.exe
  2⤵
  PID:3964
- C:\Windows\System\OwxHiMA.exe
  C:\Windows\System\OwxHiMA.exe
  2⤵
  PID:3980
- C:\Windows\System\xnGQGmP.exe
  C:\Windows\System\xnGQGmP.exe
  2⤵
  PID:3996
- C:\Windows\System\yXGKwIg.exe
  C:\Windows\System\yXGKwIg.exe
  2⤵
  PID:4012
- C:\Windows\System\vIrzOOj.exe
  C:\Windows\System\vIrzOOj.exe
  2⤵
  PID:4028
- C:\Windows\System\lmlypee.exe
  C:\Windows\System\lmlypee.exe
  2⤵
  PID:4044
- C:\Windows\System\qwVIhEh.exe
  C:\Windows\System\qwVIhEh.exe
  2⤵
  PID:4064
- C:\Windows\System\wZUYCJh.exe
  C:\Windows\System\wZUYCJh.exe
  2⤵
  PID:4080
- C:\Windows\System\OVDGqsz.exe
  C:\Windows\System\OVDGqsz.exe
  2⤵
  PID:1076
- C:\Windows\System\xVwjoAk.exe
  C:\Windows\System\xVwjoAk.exe
  2⤵
  PID:568
- C:\Windows\System\ARljJka.exe
  C:\Windows\System\ARljJka.exe
  2⤵
  PID:2748
- C:\Windows\System\vLLgocG.exe
  C:\Windows\System\vLLgocG.exe
  2⤵
  PID:2236
- C:\Windows\System\qIOEFSM.exe
  C:\Windows\System\qIOEFSM.exe
  2⤵
  PID:1592
- C:\Windows\System\GSUFlby.exe
  C:\Windows\System\GSUFlby.exe
  2⤵
  PID:2400
- C:\Windows\System\fVDBJjm.exe
  C:\Windows\System\fVDBJjm.exe
  2⤵
  PID:3152
- C:\Windows\System\jbAZKAj.exe
  C:\Windows\System\jbAZKAj.exe
  2⤵
  PID:3196
- C:\Windows\System\VLcoNgP.exe
  C:\Windows\System\VLcoNgP.exe
  2⤵
  PID:3260
- C:\Windows\System\LCjzlZK.exe
  C:\Windows\System\LCjzlZK.exe
  2⤵
  PID:3324
- C:\Windows\System\PajDbOT.exe
  C:\Windows\System\PajDbOT.exe
  2⤵
  PID:3388
- C:\Windows\System\YuMSkBA.exe
  C:\Windows\System\YuMSkBA.exe
  2⤵
  PID:2248
- C:\Windows\System\ooVDjvN.exe
  C:\Windows\System\ooVDjvN.exe
  2⤵
  PID:3340
- C:\Windows\System\EbeTNLY.exe
  C:\Windows\System\EbeTNLY.exe
  2⤵
  PID:3404
- C:\Windows\System\OLhSSUX.exe
  C:\Windows\System\OLhSSUX.exe
  2⤵
  PID:2376
- C:\Windows\System\ISQKegm.exe
  C:\Windows\System\ISQKegm.exe
  2⤵
  PID:2184
- C:\Windows\System\uTgHBfX.exe
  C:\Windows\System\uTgHBfX.exe
  2⤵
  PID:3304
- C:\Windows\System\ZLatzSw.exe
  C:\Windows\System\ZLatzSw.exe
  2⤵
  PID:3212
- C:\Windows\System\rpAGQlo.exe
  C:\Windows\System\rpAGQlo.exe
  2⤵
  PID:3140
- C:\Windows\System\XiFmfCR.exe
  C:\Windows\System\XiFmfCR.exe
  2⤵
  PID:2416
- C:\Windows\System\nlztoIN.exe
  C:\Windows\System\nlztoIN.exe
  2⤵
  PID:584
- C:\Windows\System\sxfVXiJ.exe
  C:\Windows\System\sxfVXiJ.exe
  2⤵
  PID:3468
- C:\Windows\System\psWLONU.exe
  C:\Windows\System\psWLONU.exe
  2⤵
  PID:3516
- C:\Windows\System\NQNJrxz.exe
  C:\Windows\System\NQNJrxz.exe
  2⤵
  PID:3580
- C:\Windows\System\fuvESGE.exe
  C:\Windows\System\fuvESGE.exe
  2⤵
  PID:3560
- C:\Windows\System\lKoGlUZ.exe
  C:\Windows\System\lKoGlUZ.exe
  2⤵
  PID:3596
- C:\Windows\System\CsivzgY.exe
  C:\Windows\System\CsivzgY.exe
  2⤵
  PID:3644
- C:\Windows\System\xDGeCkr.exe
  C:\Windows\System\xDGeCkr.exe
  2⤵
  PID:3712
- C:\Windows\System\tWvZyHu.exe
  C:\Windows\System\tWvZyHu.exe
  2⤵
  PID:3692
- C:\Windows\System\MAqBLHt.exe
  C:\Windows\System\MAqBLHt.exe
  2⤵
  PID:3664
- C:\Windows\System\dCIarJZ.exe
  C:\Windows\System\dCIarJZ.exe
  2⤵
  PID:3772
- C:\Windows\System\sZxSTLI.exe
  C:\Windows\System\sZxSTLI.exe
  2⤵
  PID:3840
- C:\Windows\System\TXNceQH.exe
  C:\Windows\System\TXNceQH.exe
  2⤵
  PID:3788
- C:\Windows\System\BwltiQd.exe
  C:\Windows\System\BwltiQd.exe
  2⤵
  PID:3852
- C:\Windows\System\oGlpzwP.exe
  C:\Windows\System\oGlpzwP.exe
  2⤵
  PID:3952
- C:\Windows\System\ICQonwU.exe
  C:\Windows\System\ICQonwU.exe
  2⤵
  PID:3988
- C:\Windows\System\sdFxvZB.exe
  C:\Windows\System\sdFxvZB.exe
  2⤵
  PID:4052
- C:\Windows\System\aRlLfye.exe
  C:\Windows\System\aRlLfye.exe
  2⤵
  PID:1732
- C:\Windows\System\JoWeMZN.exe
  C:\Windows\System\JoWeMZN.exe
  2⤵
  PID:3092
- C:\Windows\System\IKPcNQN.exe
  C:\Windows\System\IKPcNQN.exe
  2⤵
  PID:3228
- C:\Windows\System\wCLlrMR.exe
  C:\Windows\System\wCLlrMR.exe
  2⤵
  PID:2008
- C:\Windows\System\qnObEqU.exe
  C:\Windows\System\qnObEqU.exe
  2⤵
  PID:3452
- C:\Windows\System\LccsmHu.exe
  C:\Windows\System\LccsmHu.exe
  2⤵
  PID:3876
- C:\Windows\System\cpHmvrU.exe
  C:\Windows\System\cpHmvrU.exe
  2⤵
  PID:3936
- C:\Windows\System\tbnjQXH.exe
  C:\Windows\System\tbnjQXH.exe
  2⤵
  PID:4004
- C:\Windows\System\suVAPur.exe
  C:\Windows\System\suVAPur.exe
  2⤵
  PID:4072
- C:\Windows\System\jRdLCUy.exe
  C:\Windows\System\jRdLCUy.exe
  2⤵
  PID:2024
- C:\Windows\System\AHxrGUB.exe
  C:\Windows\System\AHxrGUB.exe
  2⤵
  PID:3512
- C:\Windows\System\aMppHqA.exe
  C:\Windows\System\aMppHqA.exe
  2⤵
  PID:3648
- C:\Windows\System\MpCxUIY.exe
  C:\Windows\System\MpCxUIY.exe
  2⤵
  PID:3192
- C:\Windows\System\MIAPcMv.exe
  C:\Windows\System\MIAPcMv.exe
  2⤵
  PID:3368
- C:\Windows\System\DHSRVyw.exe
  C:\Windows\System\DHSRVyw.exe
  2⤵
  PID:3104
- C:\Windows\System\JCtIZxO.exe
  C:\Windows\System\JCtIZxO.exe
  2⤵
  PID:3576
- C:\Windows\System\mfrKnjd.exe
  C:\Windows\System\mfrKnjd.exe
  2⤵
  PID:1436
- C:\Windows\System\javCnkS.exe
  C:\Windows\System\javCnkS.exe
  2⤵
  PID:1484
- C:\Windows\System\tZjIVAy.exe
  C:\Windows\System\tZjIVAy.exe
  2⤵
  PID:3356
- C:\Windows\System\kbKTNOX.exe
  C:\Windows\System\kbKTNOX.exe
  2⤵
  PID:3856
- C:\Windows\System\KfTIRwd.exe
  C:\Windows\System\KfTIRwd.exe
  2⤵
  PID:4024
- C:\Windows\System\XYJXGWC.exe
  C:\Windows\System\XYJXGWC.exe
  2⤵
  PID:3172
- C:\Windows\System\GBGJYSS.exe
  C:\Windows\System\GBGJYSS.exe
  2⤵
  PID:3808
- C:\Windows\System\fwCoJpW.exe
  C:\Windows\System\fwCoJpW.exe
  2⤵
  PID:3976
- C:\Windows\System\vsAUDOw.exe
  C:\Windows\System\vsAUDOw.exe
  2⤵
  PID:3528
- C:\Windows\System\uqCPtNw.exe
  C:\Windows\System\uqCPtNw.exe
  2⤵
  PID:3804
- C:\Windows\System\LugQuFa.exe
  C:\Windows\System\LugQuFa.exe
  2⤵
  PID:4088
- C:\Windows\System\YzKhNNA.exe
  C:\Windows\System\YzKhNNA.exe
  2⤵
  PID:3176
- C:\Windows\System\QrXEKNS.exe
  C:\Windows\System\QrXEKNS.exe
  2⤵
  PID:804
- C:\Windows\System\oPGxhQv.exe
  C:\Windows\System\oPGxhQv.exe
  2⤵
  PID:2852
- C:\Windows\System\CkJdiMo.exe
  C:\Windows\System\CkJdiMo.exe
  2⤵
  PID:3632
- C:\Windows\System\qOyOiJV.exe
  C:\Windows\System\qOyOiJV.exe
  2⤵
  PID:3768
- C:\Windows\System\SYFmJhI.exe
  C:\Windows\System\SYFmJhI.exe
  2⤵
  PID:3680
- C:\Windows\System\HPljAKc.exe
  C:\Windows\System\HPljAKc.exe
  2⤵
  PID:3728
- C:\Windows\System\qMSyFey.exe
  C:\Windows\System\qMSyFey.exe
  2⤵
  PID:3320
- C:\Windows\System\OUcFKav.exe
  C:\Windows\System\OUcFKav.exe
  2⤵
  PID:3628
- C:\Windows\System\FdTJlVy.exe
  C:\Windows\System\FdTJlVy.exe
  2⤵
  PID:3600
- C:\Windows\System\aHCPanc.exe
  C:\Windows\System\aHCPanc.exe
  2⤵
  PID:3960
- C:\Windows\System\RUcmoEV.exe
  C:\Windows\System\RUcmoEV.exe
  2⤵
  PID:3244
- C:\Windows\System\TgJgWuj.exe
  C:\Windows\System\TgJgWuj.exe
  2⤵
  PID:3820
- C:\Windows\System\KsTWqHj.exe
  C:\Windows\System\KsTWqHj.exe
  2⤵
  PID:3124
- C:\Windows\System\cJzuMte.exe
  C:\Windows\System\cJzuMte.exe
  2⤵
  PID:3972
- C:\Windows\System\hCNyVzd.exe
  C:\Windows\System\hCNyVzd.exe
  2⤵
  PID:4104
- C:\Windows\System\crUNyHx.exe
  C:\Windows\System\crUNyHx.exe
  2⤵
  PID:4124
- C:\Windows\System\sBMIQoT.exe
  C:\Windows\System\sBMIQoT.exe
  2⤵
  PID:4140
- C:\Windows\System\JpevdCd.exe
  C:\Windows\System\JpevdCd.exe
  2⤵
  PID:4156
- C:\Windows\System\baVDgVj.exe
  C:\Windows\System\baVDgVj.exe
  2⤵
  PID:4172
- C:\Windows\System\ZNbfdhx.exe
  C:\Windows\System\ZNbfdhx.exe
  2⤵
  PID:4188
- C:\Windows\System\uvLCbll.exe
  C:\Windows\System\uvLCbll.exe
  2⤵
  PID:4204
- C:\Windows\System\pmnjLNa.exe
  C:\Windows\System\pmnjLNa.exe
  2⤵
  PID:4224
- C:\Windows\System\hCuZZBA.exe
  C:\Windows\System\hCuZZBA.exe
  2⤵
  PID:4240
- C:\Windows\System\rcUvgWk.exe
  C:\Windows\System\rcUvgWk.exe
  2⤵
  PID:4256
- C:\Windows\System\cLTrZDH.exe
  C:\Windows\System\cLTrZDH.exe
  2⤵
  PID:4272
- C:\Windows\System\QYvPDQh.exe
  C:\Windows\System\QYvPDQh.exe
  2⤵
  PID:4288
- C:\Windows\System\BfbGvGo.exe
  C:\Windows\System\BfbGvGo.exe
  2⤵
  PID:4304
- C:\Windows\System\dTmpVYS.exe
  C:\Windows\System\dTmpVYS.exe
  2⤵
  PID:4324
- C:\Windows\System\tSkeJBb.exe
  C:\Windows\System\tSkeJBb.exe
  2⤵
  PID:4340
- C:\Windows\System\YVVccFq.exe
  C:\Windows\System\YVVccFq.exe
  2⤵
  PID:4356
- C:\Windows\System\wSQoKHQ.exe
  C:\Windows\System\wSQoKHQ.exe
  2⤵
  PID:4376
- C:\Windows\System\KDNvjYz.exe
  C:\Windows\System\KDNvjYz.exe
  2⤵
  PID:4392
- C:\Windows\System\hBDPmVK.exe
  C:\Windows\System\hBDPmVK.exe
  2⤵
  PID:4408
- C:\Windows\System\qUtCkYp.exe
  C:\Windows\System\qUtCkYp.exe
  2⤵
  PID:4424
- C:\Windows\System\VXhYhta.exe
  C:\Windows\System\VXhYhta.exe
  2⤵
  PID:4440
- C:\Windows\System\yeDYqkt.exe
  C:\Windows\System\yeDYqkt.exe
  2⤵
  PID:4456
- C:\Windows\System\ntbItoK.exe
  C:\Windows\System\ntbItoK.exe
  2⤵
  PID:4472
- C:\Windows\System\vtWqGAn.exe
  C:\Windows\System\vtWqGAn.exe
  2⤵
  PID:4488
- C:\Windows\System\egtUAUu.exe
  C:\Windows\System\egtUAUu.exe
  2⤵
  PID:4508
- C:\Windows\System\sUjNcXi.exe
  C:\Windows\System\sUjNcXi.exe
  2⤵
  PID:4524
- C:\Windows\System\oDHlxQV.exe
  C:\Windows\System\oDHlxQV.exe
  2⤵
  PID:4540
- C:\Windows\System\iYEliUd.exe
  C:\Windows\System\iYEliUd.exe
  2⤵
  PID:4556
- C:\Windows\System\KhHztJe.exe
  C:\Windows\System\KhHztJe.exe
  2⤵
  PID:4572
- C:\Windows\System\oYIIdAe.exe
  C:\Windows\System\oYIIdAe.exe
  2⤵
  PID:4588
- C:\Windows\System\lHxlsgy.exe
  C:\Windows\System\lHxlsgy.exe
  2⤵
  PID:4604
- C:\Windows\System\tMnqcYT.exe
  C:\Windows\System\tMnqcYT.exe
  2⤵
  PID:4620
- C:\Windows\System\iiwtMQD.exe
  C:\Windows\System\iiwtMQD.exe
  2⤵
  PID:4636
- C:\Windows\System\oDmoGFU.exe
  C:\Windows\System\oDmoGFU.exe
  2⤵
  PID:4652
- C:\Windows\System\UrJNvmq.exe
  C:\Windows\System\UrJNvmq.exe
  2⤵
  PID:4672
- C:\Windows\System\pPRahCH.exe
  C:\Windows\System\pPRahCH.exe
  2⤵
  PID:4688
- C:\Windows\System\hgGNVrb.exe
  C:\Windows\System\hgGNVrb.exe
  2⤵
  PID:4704
- C:\Windows\System\NlPgRHl.exe
  C:\Windows\System\NlPgRHl.exe
  2⤵
  PID:4720
- C:\Windows\System\sHEFwRT.exe
  C:\Windows\System\sHEFwRT.exe
  2⤵
  PID:4736
- C:\Windows\System\IkFkPcA.exe
  C:\Windows\System\IkFkPcA.exe
  2⤵
  PID:4752
- C:\Windows\System\YokzcmT.exe
  C:\Windows\System\YokzcmT.exe
  2⤵
  PID:4768
- C:\Windows\System\XOeBPHf.exe
  C:\Windows\System\XOeBPHf.exe
  2⤵
  PID:4784
- C:\Windows\System\dpjSmZM.exe
  C:\Windows\System\dpjSmZM.exe
  2⤵
  PID:4800
- C:\Windows\System\BmzLMdQ.exe
  C:\Windows\System\BmzLMdQ.exe
  2⤵
  PID:4816
- C:\Windows\System\fzAJjnY.exe
  C:\Windows\System\fzAJjnY.exe
  2⤵
  PID:4832
- C:\Windows\System\zvdMwkb.exe
  C:\Windows\System\zvdMwkb.exe
  2⤵
  PID:4848
- C:\Windows\System\xPJkEyO.exe
  C:\Windows\System\xPJkEyO.exe
  2⤵
  PID:4868
- C:\Windows\System\VDztfHy.exe
  C:\Windows\System\VDztfHy.exe
  2⤵
  PID:4884
- C:\Windows\System\VGpsbNJ.exe
  C:\Windows\System\VGpsbNJ.exe
  2⤵
  PID:4900
- C:\Windows\System\MCCyLYm.exe
  C:\Windows\System\MCCyLYm.exe
  2⤵
  PID:4916
- C:\Windows\System\GDHcRCG.exe
  C:\Windows\System\GDHcRCG.exe
  2⤵
  PID:4932
- C:\Windows\System\BxZRFaJ.exe
  C:\Windows\System\BxZRFaJ.exe
  2⤵
  PID:4948
- C:\Windows\System\SKlfcSS.exe
  C:\Windows\System\SKlfcSS.exe
  2⤵
  PID:4964
- C:\Windows\System\hRucEUA.exe
  C:\Windows\System\hRucEUA.exe
  2⤵
  PID:4980
- C:\Windows\System\gRQXAqh.exe
  C:\Windows\System\gRQXAqh.exe
  2⤵
  PID:5000
- C:\Windows\System\SLoSduV.exe
  C:\Windows\System\SLoSduV.exe
  2⤵
  PID:5016
- C:\Windows\System\UvYKBUb.exe
  C:\Windows\System\UvYKBUb.exe
  2⤵
  PID:5032
- C:\Windows\System\ZqbEnDc.exe
  C:\Windows\System\ZqbEnDc.exe
  2⤵
  PID:5048
- C:\Windows\System\jXEzPtg.exe
  C:\Windows\System\jXEzPtg.exe
  2⤵
  PID:5064
- C:\Windows\System\ddXNEKJ.exe
  C:\Windows\System\ddXNEKJ.exe
  2⤵
  PID:5084
- C:\Windows\System\QWBAHVp.exe
  C:\Windows\System\QWBAHVp.exe
  2⤵
  PID:5100
- C:\Windows\System\WuaNHCX.exe
  C:\Windows\System\WuaNHCX.exe
  2⤵
  PID:5116
- C:\Windows\System\JSbiJir.exe
  C:\Windows\System\JSbiJir.exe
  2⤵
  PID:3420
- C:\Windows\System\GZtlGHo.exe
  C:\Windows\System\GZtlGHo.exe
  2⤵
  PID:4116
- C:\Windows\System\xQyCarP.exe
  C:\Windows\System\xQyCarP.exe
  2⤵
  PID:4148
- C:\Windows\System\LzBZGBa.exe
  C:\Windows\System\LzBZGBa.exe
  2⤵
  PID:4216
- C:\Windows\System\OXJSJnP.exe
  C:\Windows\System\OXJSJnP.exe
  2⤵
  PID:4136
- C:\Windows\System\QpeNyJy.exe
  C:\Windows\System\QpeNyJy.exe
  2⤵
  PID:4252
- C:\Windows\System\bHYykPK.exe
  C:\Windows\System\bHYykPK.exe
  2⤵
  PID:4316
- C:\Windows\System\SHDNkvS.exe
  C:\Windows\System\SHDNkvS.exe
  2⤵
  PID:4384
- C:\Windows\System\VpFdCzQ.exe
  C:\Windows\System\VpFdCzQ.exe
  2⤵
  PID:4268
- C:\Windows\System\MvXkyKD.exe
  C:\Windows\System\MvXkyKD.exe
  2⤵
  PID:4332
- C:\Windows\System\cHvIppr.exe
  C:\Windows\System\cHvIppr.exe
  2⤵
  PID:4132
- C:\Windows\System\QPTohgA.exe
  C:\Windows\System\QPTohgA.exe
  2⤵
  PID:4452
- C:\Windows\System\ziiQnKf.exe
  C:\Windows\System\ziiQnKf.exe
  2⤵
  PID:4520
- C:\Windows\System\rkhsvaJ.exe
  C:\Windows\System\rkhsvaJ.exe
  2⤵
  PID:4584
- C:\Windows\System\HMqHgqQ.exe
  C:\Windows\System\HMqHgqQ.exe
  2⤵
  PID:4680
- C:\Windows\System\sflJNiI.exe
  C:\Windows\System\sflJNiI.exe
  2⤵
  PID:4716
- C:\Windows\System\axwlJlG.exe
  C:\Windows\System\axwlJlG.exe
  2⤵
  PID:4468
- C:\Windows\System\rbmqqNB.exe
  C:\Windows\System\rbmqqNB.exe
  2⤵
  PID:4400
- C:\Windows\System\QVDexEa.exe
  C:\Windows\System\QVDexEa.exe
  2⤵
  PID:4748
- C:\Windows\System\SnmRrfj.exe
  C:\Windows\System\SnmRrfj.exe
  2⤵
  PID:4812
- C:\Windows\System\VpYKgLO.exe
  C:\Windows\System\VpYKgLO.exe
  2⤵
  PID:4600
- C:\Windows\System\BnYFrou.exe
  C:\Windows\System\BnYFrou.exe
  2⤵
  PID:4696
- C:\Windows\System\ohBFWAI.exe
  C:\Windows\System\ohBFWAI.exe
  2⤵
  PID:4760
- C:\Windows\System\vtVIHvb.exe
  C:\Windows\System\vtVIHvb.exe
  2⤵
  PID:4764
- C:\Windows\System\VxXrmQy.exe
  C:\Windows\System\VxXrmQy.exe
  2⤵
  PID:4912
- C:\Windows\System\gdiyZEq.exe
  C:\Windows\System\gdiyZEq.exe
  2⤵
  PID:4856
- C:\Windows\System\URjQhIk.exe
  C:\Windows\System\URjQhIk.exe
  2⤵
  PID:4896
- C:\Windows\System\pGcGrKH.exe
  C:\Windows\System\pGcGrKH.exe
  2⤵
  PID:4992
- C:\Windows\System\NejTgPg.exe
  C:\Windows\System\NejTgPg.exe
  2⤵
  PID:5096
- C:\Windows\System\HYqDyyM.exe
  C:\Windows\System\HYqDyyM.exe
  2⤵
  PID:2000
- C:\Windows\System\uKyBlNh.exe
  C:\Windows\System\uKyBlNh.exe
  2⤵
  PID:5056
- C:\Windows\System\SXcpimn.exe
  C:\Windows\System\SXcpimn.exe
  2⤵
  PID:4976
- C:\Windows\System\apQQLUt.exe
  C:\Windows\System\apQQLUt.exe
  2⤵
  PID:4368
- C:\Windows\System\KiVBbMN.exe
  C:\Windows\System\KiVBbMN.exe
  2⤵
  PID:4972
- C:\Windows\System\ckzuIQw.exe
  C:\Windows\System\ckzuIQw.exe
  2⤵
  PID:5008
- C:\Windows\System\wJRQzmo.exe
  C:\Windows\System\wJRQzmo.exe
  2⤵
  PID:5072
- C:\Windows\System\EwMqPRK.exe
  C:\Windows\System\EwMqPRK.exe
  2⤵
  PID:4180
- C:\Windows\System\SsYTVHE.exe
  C:\Windows\System\SsYTVHE.exe
  2⤵
  PID:4280
- C:\Windows\System\gFHCFCh.exe
  C:\Windows\System\gFHCFCh.exe
  2⤵
  PID:4420
- C:\Windows\System\fDdkidt.exe
  C:\Windows\System\fDdkidt.exe
  2⤵
  PID:4712
- C:\Windows\System\sHPRNKZ.exe
  C:\Windows\System\sHPRNKZ.exe
  2⤵
  PID:4432
- C:\Windows\System\YYUSJyA.exe
  C:\Windows\System\YYUSJyA.exe
  2⤵
  PID:4808
- C:\Windows\System\rjBSgZz.exe
  C:\Windows\System\rjBSgZz.exe
  2⤵
  PID:4828
- C:\Windows\System\mVgxzXL.exe
  C:\Windows\System\mVgxzXL.exe
  2⤵
  PID:4956
- C:\Windows\System\XeWnAOl.exe
  C:\Windows\System\XeWnAOl.exe
  2⤵
  PID:4892
- C:\Windows\System\pxPxJST.exe
  C:\Windows\System\pxPxJST.exe
  2⤵
  PID:4728
- C:\Windows\System\yKsPyin.exe
  C:\Windows\System\yKsPyin.exe
  2⤵
  PID:5092
- C:\Windows\System\dMEwsIS.exe
  C:\Windows\System\dMEwsIS.exe
  2⤵
  PID:4484
- C:\Windows\System\lqchsot.exe
  C:\Windows\System\lqchsot.exe
  2⤵
  PID:4960
- C:\Windows\System\TOlrZCq.exe
  C:\Windows\System\TOlrZCq.exe
  2⤵
  PID:4212
- C:\Windows\System\SUCQUeK.exe
  C:\Windows\System\SUCQUeK.exe
  2⤵
  PID:4372
- C:\Windows\System\JVoglqE.exe
  C:\Windows\System\JVoglqE.exe
  2⤵
  PID:5024
- C:\Windows\System\LWWEBsJ.exe
  C:\Windows\System\LWWEBsJ.exe
  2⤵
  PID:4364
- C:\Windows\System\bFunwGa.exe
  C:\Windows\System\bFunwGa.exe
  2⤵
  PID:4500
- C:\Windows\System\oUnXsrf.exe
  C:\Windows\System\oUnXsrf.exe
  2⤵
  PID:4264
- C:\Windows\System\vgSdQLR.exe
  C:\Windows\System\vgSdQLR.exe
  2⤵
  PID:4628
- C:\Windows\System\DsRXGOn.exe
  C:\Windows\System\DsRXGOn.exe
  2⤵
  PID:4564
- C:\Windows\System\gWmcTnX.exe
  C:\Windows\System\gWmcTnX.exe
  2⤵
  PID:4200
- C:\Windows\System\OluSavr.exe
  C:\Windows\System\OluSavr.exe
  2⤵
  PID:5076
- C:\Windows\System\oAfgyHd.exe
  C:\Windows\System\oAfgyHd.exe
  2⤵
  PID:4880
- C:\Windows\System\gTABmHB.exe
  C:\Windows\System\gTABmHB.exe
  2⤵
  PID:5044
- C:\Windows\System\qsioJMK.exe
  C:\Windows\System\qsioJMK.exe
  2⤵
  PID:4168
- C:\Windows\System\IthLity.exe
  C:\Windows\System\IthLity.exe
  2⤵
  PID:5108
- C:\Windows\System\PLKVVqa.exe
  C:\Windows\System\PLKVVqa.exe
  2⤵
  PID:4296
- C:\Windows\System\NwUwkEe.exe
  C:\Windows\System\NwUwkEe.exe
  2⤵
  PID:4568
- C:\Windows\System\XMznCKX.exe
  C:\Windows\System\XMznCKX.exe
  2⤵
  PID:5132
- C:\Windows\System\kNjCsPe.exe
  C:\Windows\System\kNjCsPe.exe
  2⤵
  PID:5152
- C:\Windows\System\DxFudZc.exe
  C:\Windows\System\DxFudZc.exe
  2⤵
  PID:5168
- C:\Windows\System\DujMrOf.exe
  C:\Windows\System\DujMrOf.exe
  2⤵
  PID:5184
- C:\Windows\System\ARTFWcC.exe
  C:\Windows\System\ARTFWcC.exe
  2⤵
  PID:5200
- C:\Windows\System\toUagsd.exe
  C:\Windows\System\toUagsd.exe
  2⤵
  PID:5216
- C:\Windows\System\KdraTqG.exe
  C:\Windows\System\KdraTqG.exe
  2⤵
  PID:5232
- C:\Windows\System\JXSCELI.exe
  C:\Windows\System\JXSCELI.exe
  2⤵
  PID:5252
- C:\Windows\System\mLoLaLW.exe
  C:\Windows\System\mLoLaLW.exe
  2⤵
  PID:5268
- C:\Windows\System\SjJHpKo.exe
  C:\Windows\System\SjJHpKo.exe
  2⤵
  PID:5284
- C:\Windows\System\GfQDluE.exe
  C:\Windows\System\GfQDluE.exe
  2⤵
  PID:5300
- C:\Windows\System\owNhlFB.exe
  C:\Windows\System\owNhlFB.exe
  2⤵
  PID:5332
- C:\Windows\System\vVeLyPi.exe
  C:\Windows\System\vVeLyPi.exe
  2⤵
  PID:5348
- C:\Windows\System\blfusMt.exe
  C:\Windows\System\blfusMt.exe
  2⤵
  PID:5364
- C:\Windows\System\qWFUmwI.exe
  C:\Windows\System\qWFUmwI.exe
  2⤵
  PID:5380
- C:\Windows\System\UxuFdJI.exe
  C:\Windows\System\UxuFdJI.exe
  2⤵
  PID:5396
- C:\Windows\System\oUPjkWe.exe
  C:\Windows\System\oUPjkWe.exe
  2⤵
  PID:5412
- C:\Windows\System\rjyjVtO.exe
  C:\Windows\System\rjyjVtO.exe
  2⤵
  PID:5428
- C:\Windows\System\oJdXlAu.exe
  C:\Windows\System\oJdXlAu.exe
  2⤵
  PID:5444
- C:\Windows\System\wnKArhX.exe
  C:\Windows\System\wnKArhX.exe
  2⤵
  PID:5460
- C:\Windows\System\OHspZOE.exe
  C:\Windows\System\OHspZOE.exe
  2⤵
  PID:5476
- C:\Windows\System\YfKMySt.exe
  C:\Windows\System\YfKMySt.exe
  2⤵
  PID:5496
- C:\Windows\System\bvfXhbj.exe
  C:\Windows\System\bvfXhbj.exe
  2⤵
  PID:5512
- C:\Windows\System\ECFrJbx.exe
  C:\Windows\System\ECFrJbx.exe
  2⤵
  PID:5532
- C:\Windows\System\LrnOupY.exe
  C:\Windows\System\LrnOupY.exe
  2⤵
  PID:5548
- C:\Windows\System\lkiETCx.exe
  C:\Windows\System\lkiETCx.exe
  2⤵
  PID:5564
- C:\Windows\System\nZwhGeQ.exe
  C:\Windows\System\nZwhGeQ.exe
  2⤵
  PID:5580
- C:\Windows\System\iAjxfLu.exe
  C:\Windows\System\iAjxfLu.exe
  2⤵
  PID:5596
- C:\Windows\System\odXEtMb.exe
  C:\Windows\System\odXEtMb.exe
  2⤵
  PID:5612
- C:\Windows\System\SDupVxQ.exe
  C:\Windows\System\SDupVxQ.exe
  2⤵
  PID:5628
- C:\Windows\System\PeQCQtD.exe
  C:\Windows\System\PeQCQtD.exe
  2⤵
  PID:5644
- C:\Windows\System\twgVZzN.exe
  C:\Windows\System\twgVZzN.exe
  2⤵
  PID:5664
- C:\Windows\System\HnvUbtm.exe
  C:\Windows\System\HnvUbtm.exe
  2⤵
  PID:5680
- C:\Windows\System\RoysswO.exe
  C:\Windows\System\RoysswO.exe
  2⤵
  PID:5700
- C:\Windows\System\AZGrTig.exe
  C:\Windows\System\AZGrTig.exe
  2⤵
  PID:5716
- C:\Windows\System\ufsGYNc.exe
  C:\Windows\System\ufsGYNc.exe
  2⤵
  PID:5732
- C:\Windows\System\htxSQrZ.exe
  C:\Windows\System\htxSQrZ.exe
  2⤵
  PID:5748
- C:\Windows\System\RiDBgkU.exe
  C:\Windows\System\RiDBgkU.exe
  2⤵
  PID:5764
- C:\Windows\System\BgLjkMo.exe
  C:\Windows\System\BgLjkMo.exe
  2⤵
  PID:5780
- C:\Windows\System\oYFyIWG.exe
  C:\Windows\System\oYFyIWG.exe
  2⤵
  PID:5800
- C:\Windows\System\YfOsLfO.exe
  C:\Windows\System\YfOsLfO.exe
  2⤵
  PID:5816
- C:\Windows\System\ZwKNZxt.exe
  C:\Windows\System\ZwKNZxt.exe
  2⤵
  PID:5832
- C:\Windows\System\vFMefxn.exe
  C:\Windows\System\vFMefxn.exe
  2⤵
  PID:5848
- C:\Windows\System\oZpPOPo.exe
  C:\Windows\System\oZpPOPo.exe
  2⤵
  PID:5864
- C:\Windows\System\mABVCXW.exe
  C:\Windows\System\mABVCXW.exe
  2⤵
  PID:5880
- C:\Windows\System\qJuDnUe.exe
  C:\Windows\System\qJuDnUe.exe
  2⤵
  PID:5896
- C:\Windows\System\XcEHepn.exe
  C:\Windows\System\XcEHepn.exe
  2⤵
  PID:5912
- C:\Windows\System\yGdYIMn.exe
  C:\Windows\System\yGdYIMn.exe
  2⤵
  PID:5928
- C:\Windows\System\wsmYIBU.exe
  C:\Windows\System\wsmYIBU.exe
  2⤵
  PID:5944
- C:\Windows\System\ztvfPgZ.exe
  C:\Windows\System\ztvfPgZ.exe
  2⤵
  PID:5960
- C:\Windows\System\zQlQhWa.exe
  C:\Windows\System\zQlQhWa.exe
  2⤵
  PID:5976
- C:\Windows\System\HsCMynu.exe
  C:\Windows\System\HsCMynu.exe
  2⤵
  PID:5996
- C:\Windows\System\uhueCeg.exe
  C:\Windows\System\uhueCeg.exe
  2⤵
  PID:6012
- C:\Windows\System\OHEBIuJ.exe
  C:\Windows\System\OHEBIuJ.exe
  2⤵
  PID:6028
- C:\Windows\System\dxWOwLg.exe
  C:\Windows\System\dxWOwLg.exe
  2⤵
  PID:6048
- C:\Windows\System\eTooEgJ.exe
  C:\Windows\System\eTooEgJ.exe
  2⤵
  PID:6064
- C:\Windows\System\xkVhGbM.exe
  C:\Windows\System\xkVhGbM.exe
  2⤵
  PID:6080
- C:\Windows\System\vmFxIbd.exe
  C:\Windows\System\vmFxIbd.exe
  2⤵
  PID:6096
- C:\Windows\System\JXOVUZL.exe
  C:\Windows\System\JXOVUZL.exe
  2⤵
  PID:6112
- C:\Windows\System\HBIHDRQ.exe
  C:\Windows\System\HBIHDRQ.exe
  2⤵
  PID:6128
- C:\Windows\System\wvgZRBT.exe
  C:\Windows\System\wvgZRBT.exe
  2⤵
  PID:5112
- C:\Windows\System\JwvYrQi.exe
  C:\Windows\System\JwvYrQi.exe
  2⤵
  PID:5192
- C:\Windows\System\srmycrq.exe
  C:\Windows\System\srmycrq.exe
  2⤵
  PID:992
- C:\Windows\System\yfMDCgq.exe
  C:\Windows\System\yfMDCgq.exe
  2⤵
  PID:5228
- C:\Windows\System\XqWiPhB.exe
  C:\Windows\System\XqWiPhB.exe
  2⤵
  PID:5028
- C:\Windows\System\KlclnAs.exe
  C:\Windows\System\KlclnAs.exe
  2⤵
  PID:5148
- C:\Windows\System\gaYBPcm.exe
  C:\Windows\System\gaYBPcm.exe
  2⤵
  PID:5212
- C:\Windows\System\XIEOjGU.exe
  C:\Windows\System\XIEOjGU.exe
  2⤵
  PID:5276
- C:\Windows\System\eaPXxhr.exe
  C:\Windows\System\eaPXxhr.exe
  2⤵
  PID:5324
- C:\Windows\System\gqzcaDg.exe
  C:\Windows\System\gqzcaDg.exe
  2⤵
  PID:5312
- C:\Windows\System\dMLPkZf.exe
  C:\Windows\System\dMLPkZf.exe
  2⤵
  PID:5372
- C:\Windows\System\CqtVZOE.exe
  C:\Windows\System\CqtVZOE.exe
  2⤵
  PID:5408
- C:\Windows\System\DJgHHWb.exe
  C:\Windows\System\DJgHHWb.exe
  2⤵
  PID:5484
- C:\Windows\System\MNmJXcb.exe
  C:\Windows\System\MNmJXcb.exe
  2⤵
  PID:5504
- C:\Windows\System\VXLPcBk.exe
  C:\Windows\System\VXLPcBk.exe
  2⤵
  PID:5572
- C:\Windows\System\tcNFYBp.exe
  C:\Windows\System\tcNFYBp.exe
  2⤵
  PID:5636
- C:\Windows\System\AmlfoOY.exe
  C:\Windows\System\AmlfoOY.exe
  2⤵
  PID:5676
- C:\Windows\System\nLSizVx.exe
  C:\Windows\System\nLSizVx.exe
  2⤵
  PID:5528
- C:\Windows\System\cfcncHa.exe
  C:\Windows\System\cfcncHa.exe
  2⤵
  PID:5592
- C:\Windows\System\kJiLkjX.exe
  C:\Windows\System\kJiLkjX.exe
  2⤵
  PID:5812
- C:\Windows\System\ZvhBwHV.exe
  C:\Windows\System\ZvhBwHV.exe
  2⤵
  PID:5744
- C:\Windows\System\BXRILDM.exe
  C:\Windows\System\BXRILDM.exe
  2⤵
  PID:5840
- C:\Windows\System\mfLALMK.exe
  C:\Windows\System\mfLALMK.exe
  2⤵
  PID:5688
- C:\Windows\System\xMTJDgT.exe
  C:\Windows\System\xMTJDgT.exe
  2⤵
  PID:5696
- C:\Windows\System\YPXjzeW.exe
  C:\Windows\System\YPXjzeW.exe
  2⤵
  PID:5908
- C:\Windows\System\VeVAhDr.exe
  C:\Windows\System\VeVAhDr.exe
  2⤵
  PID:5936
- C:\Windows\System\afCuwLF.exe
  C:\Windows\System\afCuwLF.exe
  2⤵
  PID:5520
- C:\Windows\System\JHhpgsF.exe
  C:\Windows\System\JHhpgsF.exe
  2⤵
  PID:5824
- C:\Windows\System\iYoFHWf.exe
  C:\Windows\System\iYoFHWf.exe
  2⤵
  PID:5888
- C:\Windows\System\CawnmUL.exe
  C:\Windows\System\CawnmUL.exe
  2⤵
  PID:6040
- C:\Windows\System\XoJNMKF.exe
  C:\Windows\System\XoJNMKF.exe
  2⤵
  PID:6108
- C:\Windows\System\RgbqcPW.exe
  C:\Windows\System\RgbqcPW.exe
  2⤵
  PID:5952
- C:\Windows\System\znVFyYi.exe
  C:\Windows\System\znVFyYi.exe
  2⤵
  PID:5296
- C:\Windows\System\AdlXEny.exe
  C:\Windows\System\AdlXEny.exe
  2⤵
  PID:6056
- C:\Windows\System\HLRWnkh.exe
  C:\Windows\System\HLRWnkh.exe
  2⤵
  PID:6092
- C:\Windows\System\BvTjjdx.exe
  C:\Windows\System\BvTjjdx.exe
  2⤵
  PID:5160
- C:\Windows\System\meKWwvo.exe
  C:\Windows\System\meKWwvo.exe
  2⤵
  PID:5308
- C:\Windows\System\tEFBGaL.exe
  C:\Windows\System\tEFBGaL.exe
  2⤵
  PID:5988
- C:\Windows\System\mlpbbVc.exe
  C:\Windows\System\mlpbbVc.exe
  2⤵
  PID:5124
- C:\Windows\System\gQsFqVt.exe
  C:\Windows\System\gQsFqVt.exe
  2⤵
  PID:5248
- C:\Windows\System\NmEzLlO.exe
  C:\Windows\System\NmEzLlO.exe
  2⤵
  PID:5404
- C:\Windows\System\WUReqdj.exe
  C:\Windows\System\WUReqdj.exe
  2⤵
  PID:5544
- C:\Windows\System\GLOGjQQ.exe
  C:\Windows\System\GLOGjQQ.exe
  2⤵
  PID:5756
- C:\Windows\System\iOdVLsM.exe
  C:\Windows\System\iOdVLsM.exe
  2⤵
  PID:5588
- C:\Windows\System\OZhRLGW.exe
  C:\Windows\System\OZhRLGW.exe
  2⤵
  PID:5760
- C:\Windows\System\mUsjnla.exe
  C:\Windows\System\mUsjnla.exe
  2⤵
  PID:5992
- C:\Windows\System\oJityGP.exe
  C:\Windows\System\oJityGP.exe
  2⤵
  PID:6060
- C:\Windows\System\IKFjXeF.exe
  C:\Windows\System\IKFjXeF.exe
  2⤵
  PID:5140
- C:\Windows\System\Akdmxla.exe
  C:\Windows\System\Akdmxla.exe
  2⤵
  PID:5452
- C:\Windows\System\WJHMMpE.exe
  C:\Windows\System\WJHMMpE.exe
  2⤵
  PID:5776
- C:\Windows\System\kXnuVrq.exe
  C:\Windows\System\kXnuVrq.exe
  2⤵
  PID:5856
- C:\Windows\System\MeNNaYC.exe
  C:\Windows\System\MeNNaYC.exe
  2⤵
  PID:6036
- C:\Windows\System\kxgVFMd.exe
  C:\Windows\System\kxgVFMd.exe
  2⤵
  PID:5924
- C:\Windows\System\ChhqPzq.exe
  C:\Windows\System\ChhqPzq.exe
  2⤵
  PID:5440
- C:\Windows\System\yccJMNI.exe
  C:\Windows\System\yccJMNI.exe
  2⤵
  PID:5624
- C:\Windows\System\ncGXkyU.exe
  C:\Windows\System\ncGXkyU.exe
  2⤵
  PID:5468
- C:\Windows\System\rSzmoDa.exe
  C:\Windows\System\rSzmoDa.exe
  2⤵
  PID:5492
- C:\Windows\System\OiSAjZX.exe
  C:\Windows\System\OiSAjZX.exe
  2⤵
  PID:5972
- C:\Windows\System\BRiHmUJ.exe
  C:\Windows\System\BRiHmUJ.exe
  2⤵
  PID:5872
- C:\Windows\System\DLxKoBD.exe
  C:\Windows\System\DLxKoBD.exe
  2⤵
  PID:5604
- C:\Windows\System\awwuqFT.exe
  C:\Windows\System\awwuqFT.exe
  2⤵
  PID:5920
- C:\Windows\System\mxTIHjw.exe
  C:\Windows\System\mxTIHjw.exe
  2⤵
  PID:6088
- C:\Windows\System\PHaBqWs.exe
  C:\Windows\System\PHaBqWs.exe
  2⤵
  PID:5376
- C:\Windows\System\TLRsMXI.exe
  C:\Windows\System\TLRsMXI.exe
  2⤵
  PID:5244
- C:\Windows\System\zrzEwBM.exe
  C:\Windows\System\zrzEwBM.exe
  2⤵
  PID:5904
- C:\Windows\System\nJiTfNf.exe
  C:\Windows\System\nJiTfNf.exe
  2⤵
  PID:5292
- C:\Windows\System\gxryrQd.exe
  C:\Windows\System\gxryrQd.exe
  2⤵
  PID:6004
- C:\Windows\System\VLGAcTu.exe
  C:\Windows\System\VLGAcTu.exe
  2⤵
  PID:6156
- C:\Windows\System\KqobYZM.exe
  C:\Windows\System\KqobYZM.exe
  2⤵
  PID:6172
- C:\Windows\System\AYlLIqI.exe
  C:\Windows\System\AYlLIqI.exe
  2⤵
  PID:6188
- C:\Windows\System\ndIOMeI.exe
  C:\Windows\System\ndIOMeI.exe
  2⤵
  PID:6204
- C:\Windows\System\OxWHYCD.exe
  C:\Windows\System\OxWHYCD.exe
  2⤵
  PID:6220
- C:\Windows\System\kcaCLcI.exe
  C:\Windows\System\kcaCLcI.exe
  2⤵
  PID:6236
- C:\Windows\System\EtQAYhr.exe
  C:\Windows\System\EtQAYhr.exe
  2⤵
  PID:6252
- C:\Windows\System\QfrnKVP.exe
  C:\Windows\System\QfrnKVP.exe
  2⤵
  PID:6268
- C:\Windows\System\ISOpabM.exe
  C:\Windows\System\ISOpabM.exe
  2⤵
  PID:6284
- C:\Windows\System\natOSoT.exe
  C:\Windows\System\natOSoT.exe
  2⤵
  PID:6300
- C:\Windows\System\IyoTtnJ.exe
  C:\Windows\System\IyoTtnJ.exe
  2⤵
  PID:6316
- C:\Windows\System\xMMAHAY.exe
  C:\Windows\System\xMMAHAY.exe
  2⤵
  PID:6336
- C:\Windows\System\BbgNpCw.exe
  C:\Windows\System\BbgNpCw.exe
  2⤵
  PID:6352
- C:\Windows\System\TMqZlMB.exe
  C:\Windows\System\TMqZlMB.exe
  2⤵
  PID:6368
- C:\Windows\System\cRsVpRe.exe
  C:\Windows\System\cRsVpRe.exe
  2⤵
  PID:6384
- C:\Windows\System\EDQqnXu.exe
  C:\Windows\System\EDQqnXu.exe
  2⤵
  PID:6400
- C:\Windows\System\YWgamDC.exe
  C:\Windows\System\YWgamDC.exe
  2⤵
  PID:6416
- C:\Windows\System\lpatClX.exe
  C:\Windows\System\lpatClX.exe
  2⤵
  PID:6432
- C:\Windows\System\KPBxBKU.exe
  C:\Windows\System\KPBxBKU.exe
  2⤵
  PID:6448
- C:\Windows\System\uxDWUKi.exe
  C:\Windows\System\uxDWUKi.exe
  2⤵
  PID:6464
- C:\Windows\System\GLZyAkt.exe
  C:\Windows\System\GLZyAkt.exe
  2⤵
  PID:6480
- C:\Windows\System\DsTnYts.exe
  C:\Windows\System\DsTnYts.exe
  2⤵
  PID:6496
- C:\Windows\System\gWTaEzZ.exe
  C:\Windows\System\gWTaEzZ.exe
  2⤵
  PID:6512
- C:\Windows\System\cSAtgRR.exe
  C:\Windows\System\cSAtgRR.exe
  2⤵
  PID:6528
- C:\Windows\System\qZcMLsZ.exe
  C:\Windows\System\qZcMLsZ.exe
  2⤵
  PID:6544
- C:\Windows\System\QQEAeUB.exe
  C:\Windows\System\QQEAeUB.exe
  2⤵
  PID:6560
- C:\Windows\System\xHjGGGM.exe
  C:\Windows\System\xHjGGGM.exe
  2⤵
  PID:6576
- C:\Windows\System\bUFDVwD.exe
  C:\Windows\System\bUFDVwD.exe
  2⤵
  PID:6592
- C:\Windows\System\MmULiwo.exe
  C:\Windows\System\MmULiwo.exe
  2⤵
  PID:6740
- C:\Windows\System\SlKBzrZ.exe
  C:\Windows\System\SlKBzrZ.exe
  2⤵
  PID:6768
- C:\Windows\System\azSnGLB.exe
  C:\Windows\System\azSnGLB.exe
  2⤵
  PID:6812
- C:\Windows\System\OmxlMcU.exe
  C:\Windows\System\OmxlMcU.exe
  2⤵
  PID:6836
- C:\Windows\System\WfcrkhB.exe
  C:\Windows\System\WfcrkhB.exe
  2⤵
  PID:6864
- C:\Windows\System\NPVbfRx.exe
  C:\Windows\System\NPVbfRx.exe
  2⤵
  PID:6888
- C:\Windows\System\PpsllEC.exe
  C:\Windows\System\PpsllEC.exe
  2⤵
  PID:6916
- C:\Windows\System\dCfcmak.exe
  C:\Windows\System\dCfcmak.exe
  2⤵
  PID:6932
- C:\Windows\System\lMjEFdv.exe
  C:\Windows\System\lMjEFdv.exe
  2⤵
  PID:7072
- C:\Windows\System\icZUQqj.exe
  C:\Windows\System\icZUQqj.exe
  2⤵
  PID:7088
- C:\Windows\System\tLhJfcD.exe
  C:\Windows\System\tLhJfcD.exe
  2⤵
  PID:7104
- C:\Windows\System\iIgwckL.exe
  C:\Windows\System\iIgwckL.exe
  2⤵
  PID:7128
- C:\Windows\System\kQPqldW.exe
  C:\Windows\System\kQPqldW.exe
  2⤵
  PID:7144
- C:\Windows\System\clwSolJ.exe
  C:\Windows\System\clwSolJ.exe
  2⤵
  PID:7160
- C:\Windows\System\uiFBSCc.exe
  C:\Windows\System\uiFBSCc.exe
  2⤵
  PID:6228
- C:\Windows\System\TWylcqQ.exe
  C:\Windows\System\TWylcqQ.exe
  2⤵
  PID:6008
- C:\Windows\System\LvIfYdB.exe
  C:\Windows\System\LvIfYdB.exe
  2⤵
  PID:6200
- C:\Windows\System\LwnVEjl.exe
  C:\Windows\System\LwnVEjl.exe
  2⤵
  PID:6324
- C:\Windows\System\cmdbYsH.exe
  C:\Windows\System\cmdbYsH.exe
  2⤵
  PID:5540
- C:\Windows\System\wYXMghD.exe
  C:\Windows\System\wYXMghD.exe
  2⤵
  PID:6184
- C:\Windows\System\HrmHcmZ.exe
  C:\Windows\System\HrmHcmZ.exe
  2⤵
  PID:5508
- C:\Windows\System\gwpyTRr.exe
  C:\Windows\System\gwpyTRr.exe
  2⤵
  PID:6312
- C:\Windows\System\NUScEum.exe
  C:\Windows\System\NUScEum.exe
  2⤵
  PID:6424
- C:\Windows\System\aFNkPDa.exe
  C:\Windows\System\aFNkPDa.exe
  2⤵
  PID:6440
- C:\Windows\System\NDBSoCZ.exe
  C:\Windows\System\NDBSoCZ.exe
  2⤵
  PID:6588
- C:\Windows\System\UjbZgsg.exe
  C:\Windows\System\UjbZgsg.exe
  2⤵
  PID:6680
- C:\Windows\System\zaPtVRq.exe
  C:\Windows\System\zaPtVRq.exe
  2⤵
  PID:6696
- C:\Windows\System\FvrzQJx.exe
  C:\Windows\System\FvrzQJx.exe
  2⤵
  PID:6724
- C:\Windows\System\xTtPgkN.exe
  C:\Windows\System\xTtPgkN.exe
  2⤵
  PID:6948
- C:\Windows\System\BfGjvDI.exe
  C:\Windows\System\BfGjvDI.exe
  2⤵
  PID:6968
- C:\Windows\System\tPybkQm.exe
  C:\Windows\System\tPybkQm.exe
  2⤵
  PID:7012
- C:\Windows\System\aPJmXZd.exe
  C:\Windows\System\aPJmXZd.exe
  2⤵
  PID:6988
- C:\Windows\System\ZTZoGOX.exe
  C:\Windows\System\ZTZoGOX.exe
  2⤵
  PID:7016
- C:\Windows\System\YEZsfvp.exe
  C:\Windows\System\YEZsfvp.exe
  2⤵
  PID:6984
- C:\Windows\System\qpNPzpY.exe
  C:\Windows\System\qpNPzpY.exe
  2⤵
  PID:7056
- C:\Windows\System\qmERhje.exe
  C:\Windows\System\qmERhje.exe
  2⤵
  PID:7048
- C:\Windows\System\MjFbcIJ.exe
  C:\Windows\System\MjFbcIJ.exe
  2⤵
  PID:7100
- C:\Windows\System\MZvtzCW.exe
  C:\Windows\System\MZvtzCW.exe
  2⤵
  PID:7124
- C:\Windows\System\ItPCFQZ.exe
  C:\Windows\System\ItPCFQZ.exe
  2⤵
  PID:6124
- C:\Windows\System\qsexprK.exe
  C:\Windows\System\qsexprK.exe
  2⤵
  PID:1940
- C:\Windows\System\wZogNHE.exe
  C:\Windows\System\wZogNHE.exe
  2⤵
  PID:6296
- C:\Windows\System\IiCfIih.exe
  C:\Windows\System\IiCfIih.exe
  2⤵
  PID:5360
- C:\Windows\System\xAflcdi.exe
  C:\Windows\System\xAflcdi.exe
  2⤵
  PID:6216
- C:\Windows\System\psMohqN.exe
  C:\Windows\System\psMohqN.exe
  2⤵
  PID:6364
- C:\Windows\System\LvIuZvA.exe
  C:\Windows\System\LvIuZvA.exe
  2⤵
  PID:6308
- C:\Windows\System\aGuJZwg.exe
  C:\Windows\System\aGuJZwg.exe
  2⤵
  PID:6392
- C:\Windows\System\wyVApiA.exe
  C:\Windows\System\wyVApiA.exe
  2⤵
  PID:6472
- C:\Windows\System\edMAsdJ.exe
  C:\Windows\System\edMAsdJ.exe
  2⤵
  PID:6524
- C:\Windows\System\cRgRfzQ.exe
  C:\Windows\System\cRgRfzQ.exe
  2⤵
  PID:6488
- C:\Windows\System\fvqFxhS.exe
  C:\Windows\System\fvqFxhS.exe
  2⤵
  PID:6460
- C:\Windows\System\PMfUzsD.exe
  C:\Windows\System\PMfUzsD.exe
  2⤵
  PID:6572
- C:\Windows\System\MKgZYnJ.exe
  C:\Windows\System\MKgZYnJ.exe
  2⤵
  PID:6708
- C:\Windows\System\WzdLXGs.exe
  C:\Windows\System\WzdLXGs.exe
  2⤵
  PID:968
- C:\Windows\System\saEqgcq.exe
  C:\Windows\System\saEqgcq.exe
  2⤵
  PID:6900
- C:\Windows\System\yYEpdRf.exe
  C:\Windows\System\yYEpdRf.exe
  2⤵
  PID:6848
- C:\Windows\System\LRNaMEb.exe
  C:\Windows\System\LRNaMEb.exe
  2⤵
  PID:6736
- C:\Windows\System\nybXmkF.exe
  C:\Windows\System\nybXmkF.exe
  2⤵
  PID:6764
- C:\Windows\System\veygAHC.exe
  C:\Windows\System\veygAHC.exe
  2⤵
  PID:6796
- C:\Windows\System\vCCmVpY.exe
  C:\Windows\System\vCCmVpY.exe
  2⤵
  PID:6896
- C:\Windows\System\tcmjaGs.exe
  C:\Windows\System\tcmjaGs.exe
  2⤵
  PID:6844
- C:\Windows\System\FcotknW.exe
  C:\Windows\System\FcotknW.exe
  2⤵
  PID:6828
- C:\Windows\System\BidfxbV.exe
  C:\Windows\System\BidfxbV.exe
  2⤵
  PID:6728
- C:\Windows\System\zmhgzpb.exe
  C:\Windows\System\zmhgzpb.exe
  2⤵
  PID:7000
- C:\Windows\System\VcffaNE.exe
  C:\Windows\System\VcffaNE.exe
  2⤵
  PID:7040
- C:\Windows\System\VYhfVqk.exe
  C:\Windows\System\VYhfVqk.exe
  2⤵
  PID:7080
- C:\Windows\System\DIJufIA.exe
  C:\Windows\System\DIJufIA.exe
  2⤵
  PID:7096
- C:\Windows\System\KrJUfeY.exe
  C:\Windows\System\KrJUfeY.exe
  2⤵
  PID:7156
- C:\Windows\System\NRuNykS.exe
  C:\Windows\System\NRuNykS.exe
  2⤵
  PID:6168
- C:\Windows\System\AHzlEAA.exe
  C:\Windows\System\AHzlEAA.exe
  2⤵
  PID:6396
- C:\Windows\System\bTDxGMQ.exe
  C:\Windows\System\bTDxGMQ.exe
  2⤵
  PID:6556
- C:\Windows\System\VqEVBin.exe
  C:\Windows\System\VqEVBin.exe
  2⤵
  PID:6276
- C:\Windows\System\tzuLENM.exe
  C:\Windows\System\tzuLENM.exe
  2⤵
  PID:6504
- C:\Windows\System\ZPfDVXT.exe
  C:\Windows\System\ZPfDVXT.exe
  2⤵
  PID:6568
- C:\Windows\System\dTwkVVM.exe
  C:\Windows\System\dTwkVVM.exe
  2⤵
  PID:6540
- C:\Windows\System\MDLBfVa.exe
  C:\Windows\System\MDLBfVa.exe
  2⤵
  PID:6784
- C:\Windows\System\pdOWZZM.exe
  C:\Windows\System\pdOWZZM.exe
  2⤵
  PID:6808
- C:\Windows\System\gLvJmsZ.exe
  C:\Windows\System\gLvJmsZ.exe
  2⤵
  PID:6672
- C:\Windows\System\BcXOWlt.exe
  C:\Windows\System\BcXOWlt.exe
  2⤵
  PID:7028
- C:\Windows\System\lPbyaTx.exe
  C:\Windows\System\lPbyaTx.exe
  2⤵
  PID:6924
- C:\Windows\System\vYpbJMc.exe
  C:\Windows\System\vYpbJMc.exe
  2⤵
  PID:7120
- C:\Windows\System\eCQjuJK.exe
  C:\Windows\System\eCQjuJK.exe
  2⤵
  PID:6520
- C:\Windows\System\PJfGSvk.exe
  C:\Windows\System\PJfGSvk.exe
  2⤵
  PID:6884
- C:\Windows\System\vfqETea.exe
  C:\Windows\System\vfqETea.exe
  2⤵
  PID:7116
- C:\Windows\System\UISzxnX.exe
  C:\Windows\System\UISzxnX.exe
  2⤵
  PID:6940
- C:\Windows\System\oBJHgCA.exe
  C:\Windows\System\oBJHgCA.exe
  2⤵
  PID:6800
- C:\Windows\System\uiHGRGr.exe
  C:\Windows\System\uiHGRGr.exe
  2⤵
  PID:6860
- C:\Windows\System\zBDmTxX.exe
  C:\Windows\System\zBDmTxX.exe
  2⤵
  PID:6380
- C:\Windows\System\nbcoBkU.exe
  C:\Windows\System\nbcoBkU.exe
  2⤵
  PID:6760
- C:\Windows\System\LUxJNOQ.exe
  C:\Windows\System\LUxJNOQ.exe
  2⤵
  PID:6260
- C:\Windows\System\DVFNTzm.exe
  C:\Windows\System\DVFNTzm.exe
  2⤵
  PID:6600
- C:\Windows\System\NDJAaFc.exe
  C:\Windows\System\NDJAaFc.exe
  2⤵
  PID:7184
- C:\Windows\System\EwnDIDm.exe
  C:\Windows\System\EwnDIDm.exe
  2⤵
  PID:7200
- C:\Windows\System\wMiJDeH.exe
  C:\Windows\System\wMiJDeH.exe
  2⤵
  PID:7216
- C:\Windows\System\YQpwZqP.exe
  C:\Windows\System\YQpwZqP.exe
  2⤵
  PID:7232
- C:\Windows\System\zQhdKWq.exe
  C:\Windows\System\zQhdKWq.exe
  2⤵
  PID:7248
- C:\Windows\System\XsGInfP.exe
  C:\Windows\System\XsGInfP.exe
  2⤵
  PID:7264
- C:\Windows\System\OlyNOec.exe
  C:\Windows\System\OlyNOec.exe
  2⤵
  PID:7280
- C:\Windows\System\BVNKZzD.exe
  C:\Windows\System\BVNKZzD.exe
  2⤵
  PID:7296
- C:\Windows\System\qvFFifV.exe
  C:\Windows\System\qvFFifV.exe
  2⤵
  PID:7312
- C:\Windows\System\AKkontB.exe
  C:\Windows\System\AKkontB.exe
  2⤵
  PID:7328
- C:\Windows\System\pQIrLBx.exe
  C:\Windows\System\pQIrLBx.exe
  2⤵
  PID:7344
- C:\Windows\System\dHKqMrO.exe
  C:\Windows\System\dHKqMrO.exe
  2⤵
  PID:7360
- C:\Windows\System\kcsQALO.exe
  C:\Windows\System\kcsQALO.exe
  2⤵
  PID:7376
- C:\Windows\System\TbzRkex.exe
  C:\Windows\System\TbzRkex.exe
  2⤵
  PID:7392
- C:\Windows\System\iLyQsVU.exe
  C:\Windows\System\iLyQsVU.exe
  2⤵
  PID:7416
- C:\Windows\System\VpktMvK.exe
  C:\Windows\System\VpktMvK.exe
  2⤵
  PID:7432
- C:\Windows\System\PssQgMR.exe
  C:\Windows\System\PssQgMR.exe
  2⤵
  PID:7448
- C:\Windows\System\eHcDxfx.exe
  C:\Windows\System\eHcDxfx.exe
  2⤵
  PID:7464
- C:\Windows\System\UcSaMOM.exe
  C:\Windows\System\UcSaMOM.exe
  2⤵
  PID:7480
- C:\Windows\System\ZsvbisE.exe
  C:\Windows\System\ZsvbisE.exe
  2⤵
  PID:7496
- C:\Windows\System\eIXCiBC.exe
  C:\Windows\System\eIXCiBC.exe
  2⤵
  PID:7512
- C:\Windows\System\xXtdlMF.exe
  C:\Windows\System\xXtdlMF.exe
  2⤵
  PID:7528
- C:\Windows\System\CVwoSlz.exe
  C:\Windows\System\CVwoSlz.exe
  2⤵
  PID:7548
- C:\Windows\System\zHDPhoU.exe
  C:\Windows\System\zHDPhoU.exe
  2⤵
  PID:7564
- C:\Windows\System\evJOLpI.exe
  C:\Windows\System\evJOLpI.exe
  2⤵
  PID:7580
- C:\Windows\System\nzLLtkd.exe
  C:\Windows\System\nzLLtkd.exe
  2⤵
  PID:7596
- C:\Windows\System\ZdTerYb.exe
  C:\Windows\System\ZdTerYb.exe
  2⤵
  PID:7612
- C:\Windows\System\GlKerno.exe
  C:\Windows\System\GlKerno.exe
  2⤵
  PID:7628
- C:\Windows\System\GFAJiJP.exe
  C:\Windows\System\GFAJiJP.exe
  2⤵
  PID:7644
- C:\Windows\System\AkRPcbr.exe
  C:\Windows\System\AkRPcbr.exe
  2⤵
  PID:7660
- C:\Windows\System\yKxohxX.exe
  C:\Windows\System\yKxohxX.exe
  2⤵
  PID:7676
- C:\Windows\System\MgzPbcB.exe
  C:\Windows\System\MgzPbcB.exe
  2⤵
  PID:7692
- C:\Windows\System\wzwfStG.exe
  C:\Windows\System\wzwfStG.exe
  2⤵
  PID:7712
- C:\Windows\System\KIFQcls.exe
  C:\Windows\System\KIFQcls.exe
  2⤵
  PID:7728
- C:\Windows\System\JfTkEBq.exe
  C:\Windows\System\JfTkEBq.exe
  2⤵
  PID:7744
- C:\Windows\System\FDLVKmH.exe
  C:\Windows\System\FDLVKmH.exe
  2⤵
  PID:7760
- C:\Windows\System\lkguhBU.exe
  C:\Windows\System\lkguhBU.exe
  2⤵
  PID:7776
- C:\Windows\System\glfVFsy.exe
  C:\Windows\System\glfVFsy.exe
  2⤵
  PID:7792
- C:\Windows\System\yzFkdMm.exe
  C:\Windows\System\yzFkdMm.exe
  2⤵
  PID:7808
- C:\Windows\System\hgOFPYU.exe
  C:\Windows\System\hgOFPYU.exe
  2⤵
  PID:7824
- C:\Windows\System\DuLzbMf.exe
  C:\Windows\System\DuLzbMf.exe
  2⤵
  PID:7840
- C:\Windows\System\yevkkeW.exe
  C:\Windows\System\yevkkeW.exe
  2⤵
  PID:7856
- C:\Windows\System\nBcEXGJ.exe
  C:\Windows\System\nBcEXGJ.exe
  2⤵
  PID:7916
- C:\Windows\System\biOmrPJ.exe
  C:\Windows\System\biOmrPJ.exe
  2⤵
  PID:7932
- C:\Windows\System\PJPxmZe.exe
  C:\Windows\System\PJPxmZe.exe
  2⤵
  PID:7948
- C:\Windows\System\OhgAlsA.exe
  C:\Windows\System\OhgAlsA.exe
  2⤵
  PID:7964
- C:\Windows\System\MtLpLle.exe
  C:\Windows\System\MtLpLle.exe
  2⤵
  PID:7980
- C:\Windows\System\sGylRTN.exe
  C:\Windows\System\sGylRTN.exe
  2⤵
  PID:8096
- C:\Windows\System\xTTyTqB.exe
  C:\Windows\System\xTTyTqB.exe
  2⤵
  PID:8136
- C:\Windows\System\HABYIDn.exe
  C:\Windows\System\HABYIDn.exe
  2⤵
  PID:7356
- C:\Windows\System\JqtVWez.exe
  C:\Windows\System\JqtVWez.exe
  2⤵
  PID:7400
- C:\Windows\System\FxeydRA.exe
  C:\Windows\System\FxeydRA.exe
  2⤵
  PID:7404
- C:\Windows\System\oelDoxf.exe
  C:\Windows\System\oelDoxf.exe
  2⤵
  PID:7272
- C:\Windows\System\kyBPJtB.exe
  C:\Windows\System\kyBPJtB.exe
  2⤵
  PID:7240
- C:\Windows\System\UboKNhi.exe
  C:\Windows\System\UboKNhi.exe
  2⤵
  PID:7488
- C:\Windows\System\ovmQbdU.exe
  C:\Windows\System\ovmQbdU.exe
  2⤵
  PID:7444
- C:\Windows\System\AJhWxSx.exe
  C:\Windows\System\AJhWxSx.exe
  2⤵
  PID:7524
- C:\Windows\System\STSMjjI.exe
  C:\Windows\System\STSMjjI.exe
  2⤵
  PID:7592
- C:\Windows\System\VLzBMBL.exe
  C:\Windows\System\VLzBMBL.exe
  2⤵
  PID:7620
- C:\Windows\System\UDtKBLm.exe
  C:\Windows\System\UDtKBLm.exe
  2⤵
  PID:7604
- C:\Windows\System\kwtAeyf.exe
  C:\Windows\System\kwtAeyf.exe
  2⤵
  PID:7688
- C:\Windows\System\ydxrdbH.exe
  C:\Windows\System\ydxrdbH.exe
  2⤵
  PID:7724
- C:\Windows\System\kkxHjzZ.exe
  C:\Windows\System\kkxHjzZ.exe
  2⤵
  PID:7672
- C:\Windows\System\qjZPqVx.exe
  C:\Windows\System\qjZPqVx.exe
  2⤵
  PID:7736
- C:\Windows\System\wUakCTi.exe
  C:\Windows\System\wUakCTi.exe
  2⤵
  PID:7784
- C:\Windows\System\GQorVOa.exe
  C:\Windows\System\GQorVOa.exe
  2⤵
  PID:7816
- C:\Windows\System\ZeKkRrO.exe
  C:\Windows\System\ZeKkRrO.exe
  2⤵
  PID:7804
- C:\Windows\System\CUVcYqc.exe
  C:\Windows\System\CUVcYqc.exe
  2⤵
  PID:7864
- C:\Windows\System\YnsjIEU.exe
  C:\Windows\System\YnsjIEU.exe
  2⤵
  PID:7892
- C:\Windows\System\YhtEyUw.exe
  C:\Windows\System\YhtEyUw.exe
  2⤵
  PID:7912
- C:\Windows\System\yqfZTvQ.exe
  C:\Windows\System\yqfZTvQ.exe
  2⤵
  PID:7872
- C:\Windows\System\EPDOprY.exe
  C:\Windows\System\EPDOprY.exe
  2⤵
  PID:7956
- C:\Windows\System\QdXBbYu.exe
  C:\Windows\System\QdXBbYu.exe
  2⤵
  PID:7976
- C:\Windows\System\ywtrCFW.exe
  C:\Windows\System\ywtrCFW.exe
  2⤵
  PID:8000
- C:\Windows\System\mxIhSjW.exe
  C:\Windows\System\mxIhSjW.exe
  2⤵
  PID:8028
- C:\Windows\System\SzFTJRd.exe
  C:\Windows\System\SzFTJRd.exe
  2⤵
  PID:8036
- C:\Windows\System\uvetraU.exe
  C:\Windows\System\uvetraU.exe
  2⤵
  PID:8052
- C:\Windows\System\YQVabLH.exe
  C:\Windows\System\YQVabLH.exe
  2⤵
  PID:7868
- C:\Windows\System\qQgxtbq.exe
  C:\Windows\System\qQgxtbq.exe
  2⤵
  PID:8084
- C:\Windows\System\HdRxrSE.exe
  C:\Windows\System\HdRxrSE.exe
  2⤵
  PID:8108
- C:\Windows\System\fIEQLaV.exe
  C:\Windows\System\fIEQLaV.exe
  2⤵
  PID:8124
- C:\Windows\System\laJPugr.exe
  C:\Windows\System\laJPugr.exe
  2⤵
  PID:8148
- C:\Windows\System\tmxTNYJ.exe
  C:\Windows\System\tmxTNYJ.exe
  2⤵
  PID:8164
- C:\Windows\System\qJodzAJ.exe
  C:\Windows\System\qJodzAJ.exe
  2⤵
  PID:8180
- C:\Windows\System\UNhWUWZ.exe
  C:\Windows\System\UNhWUWZ.exe
  2⤵
  PID:5392
- C:\Windows\System\cWBnhXe.exe
  C:\Windows\System\cWBnhXe.exe
  2⤵
  PID:5876
- C:\Windows\System\jAQPhAU.exe
  C:\Windows\System\jAQPhAU.exe
  2⤵
  PID:7176
- C:\Windows\System\FXHGzGR.exe
  C:\Windows\System\FXHGzGR.exe
  2⤵
  PID:6852
- C:\Windows\System\fUttPlG.exe
  C:\Windows\System\fUttPlG.exe
  2⤵
  PID:7212
- C:\Windows\System\NfjcoqE.exe
  C:\Windows\System\NfjcoqE.exe
  2⤵
  PID:7288
- C:\Windows\System\RUAOjpj.exe
  C:\Windows\System\RUAOjpj.exe
  2⤵
  PID:7352
- C:\Windows\System\bfgVEXT.exe
  C:\Windows\System\bfgVEXT.exe
  2⤵
  PID:7428
- C:\Windows\System\APXAwKy.exe
  C:\Windows\System\APXAwKy.exe
  2⤵
  PID:7588
- C:\Windows\System\IhjCyib.exe
  C:\Windows\System\IhjCyib.exe
  2⤵
  PID:7720
- C:\Windows\System\MaPgxuD.exe
  C:\Windows\System\MaPgxuD.exe
  2⤵
  PID:7440
- C:\Windows\System\iPaTtDD.exe
  C:\Windows\System\iPaTtDD.exe
  2⤵
  PID:7768
- C:\Windows\System\FBgiSFt.exe
  C:\Windows\System\FBgiSFt.exe
  2⤵
  PID:7900
- C:\Windows\System\VrQCTIr.exe
  C:\Windows\System\VrQCTIr.exe
  2⤵
  PID:7940
- C:\Windows\System\pvIBARy.exe
  C:\Windows\System\pvIBARy.exe
  2⤵
  PID:8004
- C:\Windows\System\Bywvkts.exe
  C:\Windows\System\Bywvkts.exe
  2⤵
  PID:1424
- C:\Windows\System\xtHEAmP.exe
  C:\Windows\System\xtHEAmP.exe
  2⤵
  PID:7880
- C:\Windows\System\vfVfEan.exe
  C:\Windows\System\vfVfEan.exe
  2⤵
  PID:8016
- C:\Windows\System\aKCjebK.exe
  C:\Windows\System\aKCjebK.exe
  2⤵
  PID:7752
- C:\Windows\System\sgpdRXc.exe
  C:\Windows\System\sgpdRXc.exe
  2⤵
  PID:7876
- C:\Windows\System\hDWDeEL.exe
  C:\Windows\System\hDWDeEL.exe
  2⤵
  PID:8064
- C:\Windows\System\rxsOcjR.exe
  C:\Windows\System\rxsOcjR.exe
  2⤵
  PID:8176
- C:\Windows\System\fWDkJiN.exe
  C:\Windows\System\fWDkJiN.exe
  2⤵
  PID:7388
- C:\Windows\System\voRqNfw.exe
  C:\Windows\System\voRqNfw.exe
  2⤵
  PID:6956
- C:\Windows\System\PmHRAxz.exe
  C:\Windows\System\PmHRAxz.exe
  2⤵
  PID:7424
- C:\Windows\System\tIjHVhJ.exe
  C:\Windows\System\tIjHVhJ.exe
  2⤵
  PID:7928
- C:\Windows\System\ORgnNbL.exe
  C:\Windows\System\ORgnNbL.exe
  2⤵
  PID:7800
- C:\Windows\System\BWNkgkD.exe
  C:\Windows\System\BWNkgkD.exe
  2⤵
  PID:7668
- C:\Windows\System\bvGOVBd.exe
  C:\Windows\System\bvGOVBd.exe
  2⤵
  PID:8204
- C:\Windows\System\cJUFQVU.exe
  C:\Windows\System\cJUFQVU.exe
  2⤵
  PID:8316
- C:\Windows\System\waZPezN.exe
  C:\Windows\System\waZPezN.exe
  2⤵
  PID:8344
- C:\Windows\System\YJNSRel.exe
  C:\Windows\System\YJNSRel.exe
  2⤵
  PID:8480
- C:\Windows\System\FpzkHfE.exe
  C:\Windows\System\FpzkHfE.exe
  2⤵
  PID:8496
- C:\Windows\System\aBQBElK.exe
  C:\Windows\System\aBQBElK.exe
  2⤵
  PID:8516
- C:\Windows\System\EnkUOig.exe
  C:\Windows\System\EnkUOig.exe
  2⤵
  PID:8532
- C:\Windows\System\ulCUPzI.exe
  C:\Windows\System\ulCUPzI.exe
  2⤵
  PID:8548
- C:\Windows\System\RTWemBt.exe
  C:\Windows\System\RTWemBt.exe
  2⤵
  PID:8564
- C:\Windows\System\fkaOjjs.exe
  C:\Windows\System\fkaOjjs.exe
  2⤵
  PID:8580
- C:\Windows\System\IaHUPfm.exe
  C:\Windows\System\IaHUPfm.exe
  2⤵
  PID:8596
- C:\Windows\System\NyvtWKL.exe
  C:\Windows\System\NyvtWKL.exe
  2⤵
  PID:8612
- C:\Windows\System\cmDZTLB.exe
  C:\Windows\System\cmDZTLB.exe
  2⤵
  PID:8632
- C:\Windows\System\pUALJQN.exe
  C:\Windows\System\pUALJQN.exe
  2⤵
  PID:8648
- C:\Windows\System\vnCNxpd.exe
  C:\Windows\System\vnCNxpd.exe
  2⤵
  PID:8664
- C:\Windows\System\vqLeQBf.exe
  C:\Windows\System\vqLeQBf.exe
  2⤵
  PID:8680
- C:\Windows\System\wWJJZfN.exe
  C:\Windows\System\wWJJZfN.exe
  2⤵
  PID:8696
- C:\Windows\System\beNOTJf.exe
  C:\Windows\System\beNOTJf.exe
  2⤵
  PID:8716
- C:\Windows\System\yMQpeyI.exe
  C:\Windows\System\yMQpeyI.exe
  2⤵
  PID:8732
- C:\Windows\System\fHgPlGT.exe
  C:\Windows\System\fHgPlGT.exe
  2⤵
  PID:8748
- C:\Windows\System\wBHVgrV.exe
  C:\Windows\System\wBHVgrV.exe
  2⤵
  PID:8764
- C:\Windows\System\WbPuEbG.exe
  C:\Windows\System\WbPuEbG.exe
  2⤵
  PID:8780
- C:\Windows\System\uSccgoh.exe
  C:\Windows\System\uSccgoh.exe
  2⤵
  PID:8796
- C:\Windows\System\vurPZFO.exe
  C:\Windows\System\vurPZFO.exe
  2⤵
  PID:8812
- C:\Windows\System\Skbuwos.exe
  C:\Windows\System\Skbuwos.exe
  2⤵
  PID:8828
- C:\Windows\System\CBiFjFZ.exe
  C:\Windows\System\CBiFjFZ.exe
  2⤵
  PID:8852
- C:\Windows\System\FbWFEZS.exe
  C:\Windows\System\FbWFEZS.exe
  2⤵
  PID:8868
- C:\Windows\System\RuobzfB.exe
  C:\Windows\System\RuobzfB.exe
  2⤵
  PID:8884
- C:\Windows\System\UwjvomQ.exe
  C:\Windows\System\UwjvomQ.exe
  2⤵
  PID:8900
- C:\Windows\System\rVqeUAu.exe
  C:\Windows\System\rVqeUAu.exe
  2⤵
  PID:8916
- C:\Windows\System\SbWkuyW.exe
  C:\Windows\System\SbWkuyW.exe
  2⤵
  PID:8932
- C:\Windows\System\WtfPKgh.exe
  C:\Windows\System\WtfPKgh.exe
  2⤵
  PID:8948
- C:\Windows\System\jNtDVeV.exe
  C:\Windows\System\jNtDVeV.exe
  2⤵
  PID:8968
- C:\Windows\System\QrOONDL.exe
  C:\Windows\System\QrOONDL.exe
  2⤵
  PID:8984
- C:\Windows\System\kgOduEZ.exe
  C:\Windows\System\kgOduEZ.exe
  2⤵
  PID:9000
- C:\Windows\System\nYCaahZ.exe
  C:\Windows\System\nYCaahZ.exe
  2⤵
  PID:9016
- C:\Windows\System\JBrjLOj.exe
  C:\Windows\System\JBrjLOj.exe
  2⤵
  PID:9032
- C:\Windows\System\lVLzXnn.exe
  C:\Windows\System\lVLzXnn.exe
  2⤵
  PID:9048
- C:\Windows\System\nZQFrXC.exe
  C:\Windows\System\nZQFrXC.exe
  2⤵
  PID:9064
- C:\Windows\System\kvAOZrn.exe
  C:\Windows\System\kvAOZrn.exe
  2⤵
  PID:9080
- C:\Windows\System\VYzpSHH.exe
  C:\Windows\System\VYzpSHH.exe
  2⤵
  PID:9096
- C:\Windows\System\ChzlogZ.exe
  C:\Windows\System\ChzlogZ.exe
  2⤵
  PID:9112
- C:\Windows\System\OvvYRQu.exe
  C:\Windows\System\OvvYRQu.exe
  2⤵
  PID:9128
- C:\Windows\System\UTyNdYh.exe
  C:\Windows\System\UTyNdYh.exe
  2⤵
  PID:9144
- C:\Windows\System\atrHHDH.exe
  C:\Windows\System\atrHHDH.exe
  2⤵
  PID:9160
- C:\Windows\System\oCrnAvU.exe
  C:\Windows\System\oCrnAvU.exe
  2⤵
  PID:9176
- C:\Windows\System\WAlnfgC.exe
  C:\Windows\System\WAlnfgC.exe
  2⤵
  PID:9192
- C:\Windows\System\tCDWeMp.exe
  C:\Windows\System\tCDWeMp.exe
  2⤵
  PID:9208
- C:\Windows\System\QbSisjj.exe
  C:\Windows\System\QbSisjj.exe
  2⤵
  PID:6536
- C:\Windows\System\oBvXsPb.exe
  C:\Windows\System\oBvXsPb.exe
  2⤵
  PID:7276
- C:\Windows\System\rMqmGDL.exe
  C:\Windows\System\rMqmGDL.exe
  2⤵
  PID:8080
- C:\Windows\System\jYJAPea.exe
  C:\Windows\System\jYJAPea.exe
  2⤵
  PID:7988
- C:\Windows\System\RIuhhbQ.exe
  C:\Windows\System\RIuhhbQ.exe
  2⤵
  PID:8144
- C:\Windows\System\IOxstyp.exe
  C:\Windows\System\IOxstyp.exe
  2⤵
  PID:7656
- C:\Windows\System\pDHDpmY.exe
  C:\Windows\System\pDHDpmY.exe
  2⤵
  PID:7836
- C:\Windows\System\BNWryob.exe
  C:\Windows\System\BNWryob.exe
  2⤵
  PID:7504
- C:\Windows\System\cQghBDa.exe
  C:\Windows\System\cQghBDa.exe
  2⤵
  PID:7224
- C:\Windows\System\XjtIxWR.exe
  C:\Windows\System\XjtIxWR.exe
  2⤵
  PID:6412
- C:\Windows\System\MJMjmUZ.exe
  C:\Windows\System\MJMjmUZ.exe
  2⤵
  PID:8156
- C:\Windows\System\fwoGYkG.exe
  C:\Windows\System\fwoGYkG.exe
  2⤵
  PID:8224
- C:\Windows\System\GyXkAFy.exe
  C:\Windows\System\GyXkAFy.exe
  2⤵
  PID:8244
- C:\Windows\System\gTRrAUW.exe
  C:\Windows\System\gTRrAUW.exe
  2⤵
  PID:8260
- C:\Windows\System\PsoFBiW.exe
  C:\Windows\System\PsoFBiW.exe
  2⤵
  PID:8276
- C:\Windows\System\uLzJCvU.exe
  C:\Windows\System\uLzJCvU.exe
  2⤵
  PID:8300
- C:\Windows\System\OBSXvaA.exe
  C:\Windows\System\OBSXvaA.exe
  2⤵
  PID:8308
- C:\Windows\System\RxzqljU.exe
  C:\Windows\System\RxzqljU.exe
  2⤵
  PID:8336
- C:\Windows\System\PfwaQig.exe
  C:\Windows\System\PfwaQig.exe
  2⤵
  PID:8312
- C:\Windows\System\yEpyuLL.exe
  C:\Windows\System\yEpyuLL.exe
  2⤵
  PID:8380
- C:\Windows\System\CRBwuPn.exe
  C:\Windows\System\CRBwuPn.exe
  2⤵
  PID:8384
- C:\Windows\System\KFxYLrK.exe
  C:\Windows\System\KFxYLrK.exe
  2⤵
  PID:8396
- C:\Windows\System\sWITIDE.exe
  C:\Windows\System\sWITIDE.exe
  2⤵
  PID:8416
- C:\Windows\System\WghhKHr.exe
  C:\Windows\System\WghhKHr.exe
  2⤵
  PID:8432
- C:\Windows\System\Hjtnizw.exe
  C:\Windows\System\Hjtnizw.exe
  2⤵
  PID:8448
- C:\Windows\System\YoLrPjm.exe
  C:\Windows\System\YoLrPjm.exe
  2⤵
  PID:8524
- C:\Windows\System\zuJpFfu.exe
  C:\Windows\System\zuJpFfu.exe
  2⤵
  PID:8660
- C:\Windows\System\gAFIBRK.exe
  C:\Windows\System\gAFIBRK.exe
  2⤵
  PID:8708
- C:\Windows\System\nzxqoYw.exe
  C:\Windows\System\nzxqoYw.exe
  2⤵
  PID:8776
- C:\Windows\System\KbpwkFo.exe
  C:\Windows\System\KbpwkFo.exe
  2⤵
  PID:8844
- C:\Windows\System\qoibtDG.exe
  C:\Windows\System\qoibtDG.exe
  2⤵
  PID:8892
- C:\Windows\System\FqrLFYC.exe
  C:\Windows\System\FqrLFYC.exe
  2⤵
  PID:8728
- C:\Windows\System\dEeRkHE.exe
  C:\Windows\System\dEeRkHE.exe
  2⤵
  PID:8956
- C:\Windows\System\PfaoCpj.exe
  C:\Windows\System\PfaoCpj.exe
  2⤵
  PID:8964
- C:\Windows\System\VvsMuoD.exe
  C:\Windows\System\VvsMuoD.exe
  2⤵
  PID:8996
- C:\Windows\System\PdbHCuQ.exe
  C:\Windows\System\PdbHCuQ.exe
  2⤵
  PID:8928
- C:\Windows\System\cdGiRWz.exe
  C:\Windows\System\cdGiRWz.exe
  2⤵
  PID:9088
- C:\Windows\System\mGeWJFY.exe
  C:\Windows\System\mGeWJFY.exe
  2⤵
  PID:9152
- C:\Windows\System\hpBXfRM.exe
  C:\Windows\System\hpBXfRM.exe
  2⤵
  PID:9104
- C:\Windows\System\cZpGcZk.exe
  C:\Windows\System\cZpGcZk.exe
  2⤵
  PID:9168
- C:\Windows\System\WnKZcGZ.exe
  C:\Windows\System\WnKZcGZ.exe
  2⤵
  PID:8172
- C:\Windows\System\tkMvAif.exe
  C:\Windows\System\tkMvAif.exe
  2⤵
  PID:8068
- C:\Windows\System\VquSIFi.exe
  C:\Windows\System\VquSIFi.exe
  2⤵
  PID:8132
- C:\Windows\System\YnnrPqD.exe
  C:\Windows\System\YnnrPqD.exe
  2⤵
  PID:8060
- C:\Windows\System\xrxDevW.exe
  C:\Windows\System\xrxDevW.exe
  2⤵
  PID:9184
- C:\Windows\System\fyxKVTo.exe
  C:\Windows\System\fyxKVTo.exe
  2⤵
  PID:7996
- C:\Windows\System\JFtwMhn.exe
  C:\Windows\System\JFtwMhn.exe
  2⤵
  PID:8228
- C:\Windows\System\uSsOnZL.exe
  C:\Windows\System\uSsOnZL.exe
  2⤵
  PID:7944
- C:\Windows\System\xfJeKlo.exe
  C:\Windows\System\xfJeKlo.exe
  2⤵
  PID:8340
- C:\Windows\System\WuXwYCm.exe
  C:\Windows\System\WuXwYCm.exe
  2⤵
  PID:8400
- C:\Windows\System\oHhhaeO.exe
  C:\Windows\System\oHhhaeO.exe
  2⤵
  PID:8428
- C:\Windows\System\TSvoqTL.exe
  C:\Windows\System\TSvoqTL.exe
  2⤵
  PID:8296
- C:\Windows\System\FzNvcIn.exe
  C:\Windows\System\FzNvcIn.exe
  2⤵
  PID:8268
- C:\Windows\System\rViFpLo.exe
  C:\Windows\System\rViFpLo.exe
  2⤵
  PID:8304
- C:\Windows\System\HuUARHn.exe
  C:\Windows\System\HuUARHn.exe
  2⤵
  PID:8468
- C:\Windows\System\MEYcGuZ.exe
  C:\Windows\System\MEYcGuZ.exe
  2⤵
  PID:8508
- C:\Windows\System\wCXXvYc.exe
  C:\Windows\System\wCXXvYc.exe
  2⤵
  PID:8572
- C:\Windows\System\mnkuhff.exe
  C:\Windows\System\mnkuhff.exe
  2⤵
  PID:8604
- C:\Windows\System\srcofZJ.exe
  C:\Windows\System\srcofZJ.exe
  2⤵
  PID:8560
- C:\Windows\System\PLosslV.exe
  C:\Windows\System\PLosslV.exe
  2⤵
  PID:8588
- C:\Windows\System\XpfSrpu.exe
  C:\Windows\System\XpfSrpu.exe
  2⤵
  PID:8692
- C:\Windows\System\FwCdAqJ.exe
  C:\Windows\System\FwCdAqJ.exe
  2⤵
  PID:8744
- C:\Windows\System\alorZjK.exe
  C:\Windows\System\alorZjK.exe
  2⤵
  PID:8808
- C:\Windows\System\WeSlPpY.exe
  C:\Windows\System\WeSlPpY.exe
  2⤵
  PID:8724
- C:\Windows\System\QqiJOrm.exe
  C:\Windows\System\QqiJOrm.exe
  2⤵
  PID:8896
- C:\Windows\System\JxiTyzy.exe
  C:\Windows\System\JxiTyzy.exe
  2⤵
  PID:8196
- C:\Windows\System\udDGwts.exe
  C:\Windows\System\udDGwts.exe
  2⤵
  PID:8820
- C:\Windows\System\RdjKHTS.exe
  C:\Windows\System\RdjKHTS.exe
  2⤵
  PID:6980
- C:\Windows\System\QWJmmIU.exe
  C:\Windows\System\QWJmmIU.exe
  2⤵
  PID:8456
- C:\Windows\System\jZMmuGr.exe
  C:\Windows\System\jZMmuGr.exe
  2⤵
  PID:7708
- C:\Windows\System\IDtiYGl.exe
  C:\Windows\System\IDtiYGl.exe
  2⤵
  PID:8160
- C:\Windows\System\qmxLHsv.exe
  C:\Windows\System\qmxLHsv.exe
  2⤵
  PID:9060
- C:\Windows\System\wRTNzNl.exe
  C:\Windows\System\wRTNzNl.exe
  2⤵
  PID:8992
- C:\Windows\System\tYqSjVH.exe
  C:\Windows\System\tYqSjVH.exe
  2⤵
  PID:1540
- C:\Windows\System\HcIjTyZ.exe
  C:\Windows\System\HcIjTyZ.exe
  2⤵
  PID:9008
- C:\Windows\System\ZfzOQBl.exe
  C:\Windows\System\ZfzOQBl.exe
  2⤵
  PID:8908
- C:\Windows\System\FVvWwSw.exe
  C:\Windows\System\FVvWwSw.exe
  2⤵
  PID:8092
- C:\Windows\System\hbtEzHO.exe
  C:\Windows\System\hbtEzHO.exe
  2⤵
  PID:8540
- C:\Windows\System\PtomquP.exe
  C:\Windows\System\PtomquP.exe
  2⤵
  PID:8640
- C:\Windows\System\dgPnfla.exe
  C:\Windows\System\dgPnfla.exe
  2⤵
  PID:8628
- C:\Windows\System\KzRNIPo.exe
  C:\Windows\System\KzRNIPo.exe
  2⤵
  PID:8556
- C:\Windows\System\QYCOjbt.exe
  C:\Windows\System\QYCOjbt.exe
  2⤵
  PID:7196
- C:\Windows\System\jEQXxYL.exe
  C:\Windows\System\jEQXxYL.exe
  2⤵
  PID:8880
- C:\Windows\System\MVslRxQ.exe
  C:\Windows\System\MVslRxQ.exe
  2⤵
  PID:8372
- C:\Windows\System\ttvAzzM.exe
  C:\Windows\System\ttvAzzM.exe
  2⤵
  PID:9140
- C:\Windows\System\SJUkQIv.exe
  C:\Windows\System\SJUkQIv.exe
  2⤵
  PID:8280
- C:\Windows\System\TUAMyJq.exe
  C:\Windows\System\TUAMyJq.exe
  2⤵
  PID:8240
- C:\Windows\System\DwKAkJX.exe
  C:\Windows\System\DwKAkJX.exe
  2⤵
  PID:8944
- C:\Windows\System\nyyqtPI.exe
  C:\Windows\System\nyyqtPI.exe
  2⤵
  PID:8492
- C:\Windows\System\UiTEUMy.exe
  C:\Windows\System\UiTEUMy.exe
  2⤵
  PID:8544
- C:\Windows\System\kuRDWyp.exe
  C:\Windows\System\kuRDWyp.exe
  2⤵
  PID:8672
- C:\Windows\System\YcHnssj.exe
  C:\Windows\System\YcHnssj.exe
  2⤵
  PID:8444
- C:\Windows\System\VjOzLWO.exe
  C:\Windows\System\VjOzLWO.exe
  2⤵
  PID:8376
- C:\Windows\System\AvtnDUL.exe
  C:\Windows\System\AvtnDUL.exe
  2⤵
  PID:9108
- C:\Windows\System\RJbkbSe.exe
  C:\Windows\System\RJbkbSe.exe
  2⤵
  PID:8824
- C:\Windows\System\EiRtZKE.exe
  C:\Windows\System\EiRtZKE.exe
  2⤵
  PID:8656
- C:\Windows\System\kHVStxq.exe
  C:\Windows\System\kHVStxq.exe
  2⤵
  PID:8860
- C:\Windows\System\XyXzXyF.exe
  C:\Windows\System\XyXzXyF.exe
  2⤵
  PID:9228
- C:\Windows\System\AKCcFlB.exe
  C:\Windows\System\AKCcFlB.exe
  2⤵
  PID:9244
- C:\Windows\System\mxfJpEg.exe
  C:\Windows\System\mxfJpEg.exe
  2⤵
  PID:9260
- C:\Windows\System\aYVjoWT.exe
  C:\Windows\System\aYVjoWT.exe
  2⤵
  PID:9276
- C:\Windows\System\vdPTxlW.exe
  C:\Windows\System\vdPTxlW.exe
  2⤵
  PID:9292
- C:\Windows\System\yeSCLEe.exe
  C:\Windows\System\yeSCLEe.exe
  2⤵
  PID:9308
- C:\Windows\System\aUyiiUO.exe
  C:\Windows\System\aUyiiUO.exe
  2⤵
  PID:9332
- C:\Windows\System\LrXZgfb.exe
  C:\Windows\System\LrXZgfb.exe
  2⤵
  PID:9352
- C:\Windows\System\MiJZfPW.exe
  C:\Windows\System\MiJZfPW.exe
  2⤵
  PID:9372
- C:\Windows\System\SZdZAfP.exe
  C:\Windows\System\SZdZAfP.exe
  2⤵
  PID:9388
- C:\Windows\System\OPiPPuw.exe
  C:\Windows\System\OPiPPuw.exe
  2⤵
  PID:9404
- C:\Windows\System\FpbEBwz.exe
  C:\Windows\System\FpbEBwz.exe
  2⤵
  PID:9420
- C:\Windows\System\gsWVtIP.exe
  C:\Windows\System\gsWVtIP.exe
  2⤵
  PID:9436
- C:\Windows\System\LmPvLhY.exe
  C:\Windows\System\LmPvLhY.exe
  2⤵
  PID:9452
- C:\Windows\System\LIrnUUF.exe
  C:\Windows\System\LIrnUUF.exe
  2⤵
  PID:9468
- C:\Windows\System\bZTUPzA.exe
  C:\Windows\System\bZTUPzA.exe
  2⤵
  PID:9484
- C:\Windows\System\zMkvtim.exe
  C:\Windows\System\zMkvtim.exe
  2⤵
  PID:9500
- C:\Windows\System\pTnvxTe.exe
  C:\Windows\System\pTnvxTe.exe
  2⤵
  PID:9516
- C:\Windows\System\KndFjOb.exe
  C:\Windows\System\KndFjOb.exe
  2⤵
  PID:9532
- C:\Windows\System\pojHRCp.exe
  C:\Windows\System\pojHRCp.exe
  2⤵
  PID:9548
- C:\Windows\System\CFoVDJZ.exe
  C:\Windows\System\CFoVDJZ.exe
  2⤵
  PID:9564
- C:\Windows\System\GQEhIvW.exe
  C:\Windows\System\GQEhIvW.exe
  2⤵
  PID:9580
- C:\Windows\System\NmyYVIr.exe
  C:\Windows\System\NmyYVIr.exe
  2⤵
  PID:9596
- C:\Windows\System\YYRPwEC.exe
  C:\Windows\System\YYRPwEC.exe
  2⤵
  PID:9612
- C:\Windows\System\ZegTznw.exe
  C:\Windows\System\ZegTznw.exe
  2⤵
  PID:9628
- C:\Windows\System\TTTFcaJ.exe
  C:\Windows\System\TTTFcaJ.exe
  2⤵
  PID:9644
- C:\Windows\System\SsOiMnX.exe
  C:\Windows\System\SsOiMnX.exe
  2⤵
  PID:9660
- C:\Windows\System\XsnREwb.exe
  C:\Windows\System\XsnREwb.exe
  2⤵
  PID:9700
- C:\Windows\System\XGaFQoS.exe
  C:\Windows\System\XGaFQoS.exe
  2⤵
  PID:9716
- C:\Windows\System\SMGaVWZ.exe
  C:\Windows\System\SMGaVWZ.exe
  2⤵
  PID:9740
- C:\Windows\System\DDArOLX.exe
  C:\Windows\System\DDArOLX.exe
  2⤵
  PID:9756
- C:\Windows\System\dxUIjip.exe
  C:\Windows\System\dxUIjip.exe
  2⤵
  PID:9772
- C:\Windows\System\eAFblkL.exe
  C:\Windows\System\eAFblkL.exe
  2⤵
  PID:9796
- C:\Windows\System\TfXjhdk.exe
  C:\Windows\System\TfXjhdk.exe
  2⤵
  PID:9812
- C:\Windows\System\qQgCktR.exe
  C:\Windows\System\qQgCktR.exe
  2⤵
  PID:9828
- C:\Windows\System\GOBLhjZ.exe
  C:\Windows\System\GOBLhjZ.exe
  2⤵
  PID:9844
- C:\Windows\System\iwkqOrJ.exe
  C:\Windows\System\iwkqOrJ.exe
  2⤵
  PID:9860
- C:\Windows\System\JpKApLz.exe
  C:\Windows\System\JpKApLz.exe
  2⤵
  PID:9888
- C:\Windows\System\JAXwyKb.exe
  C:\Windows\System\JAXwyKb.exe
  2⤵
  PID:9904
- C:\Windows\System\CkVuPNt.exe
  C:\Windows\System\CkVuPNt.exe
  2⤵
  PID:9920
- C:\Windows\System\nzcvTxw.exe
  C:\Windows\System\nzcvTxw.exe
  2⤵
  PID:9936
- C:\Windows\System\GDatuuC.exe
  C:\Windows\System\GDatuuC.exe
  2⤵
  PID:9952
- C:\Windows\System\WAPCNzn.exe
  C:\Windows\System\WAPCNzn.exe
  2⤵
  PID:9972
- C:\Windows\System\bbHNmAX.exe
  C:\Windows\System\bbHNmAX.exe
  2⤵
  PID:9992
- C:\Windows\System\unLwsUX.exe
  C:\Windows\System\unLwsUX.exe
  2⤵
  PID:10008
- C:\Windows\System\PtJPofy.exe
  C:\Windows\System\PtJPofy.exe
  2⤵
  PID:10028
- C:\Windows\System\hONyjiw.exe
  C:\Windows\System\hONyjiw.exe
  2⤵
  PID:10048
- C:\Windows\System\cxOWDhU.exe
  C:\Windows\System\cxOWDhU.exe
  2⤵
  PID:10064
- C:\Windows\System\LSBuSrx.exe
  C:\Windows\System\LSBuSrx.exe
  2⤵
  PID:10080
- C:\Windows\System\NabeSpJ.exe
  C:\Windows\System\NabeSpJ.exe
  2⤵
  PID:10096
- C:\Windows\System\slMjckI.exe
  C:\Windows\System\slMjckI.exe
  2⤵
  PID:10116
- C:\Windows\System\MTijRHb.exe
  C:\Windows\System\MTijRHb.exe
  2⤵
  PID:10132
- C:\Windows\System\saprlbR.exe
  C:\Windows\System\saprlbR.exe
  2⤵
  PID:10148
- C:\Windows\System\pEImGEq.exe
  C:\Windows\System\pEImGEq.exe
  2⤵
  PID:10168
- C:\Windows\System\QYlhGqX.exe
  C:\Windows\System\QYlhGqX.exe
  2⤵
  PID:10184
- C:\Windows\System\IntbwaH.exe
  C:\Windows\System\IntbwaH.exe
  2⤵
  PID:10200
- C:\Windows\System\KDbcLmY.exe
  C:\Windows\System\KDbcLmY.exe
  2⤵
  PID:10220
- C:\Windows\System\yXHvzgx.exe
  C:\Windows\System\yXHvzgx.exe
  2⤵
  PID:10236
- C:\Windows\System\GDiJIwa.exe
  C:\Windows\System\GDiJIwa.exe
  2⤵
  PID:9124
- C:\Windows\System\DBJPTtu.exe
  C:\Windows\System\DBJPTtu.exe
  2⤵
  PID:9748
- C:\Windows\System\TsGAwxx.exe
  C:\Windows\System\TsGAwxx.exe
  2⤵
  PID:9780
- C:\Windows\System\CfTUZaD.exe
  C:\Windows\System\CfTUZaD.exe
  2⤵
  PID:9680
- C:\Windows\System\UTKZgyj.exe
  C:\Windows\System\UTKZgyj.exe
  2⤵
  PID:9696
- C:\Windows\System\TLrgyJR.exe
  C:\Windows\System\TLrgyJR.exe
  2⤵
  PID:9736
- C:\Windows\System\ZIMtUfJ.exe
  C:\Windows\System\ZIMtUfJ.exe
  2⤵
  PID:9808
- C:\Windows\System\hWWWHQI.exe
  C:\Windows\System\hWWWHQI.exe
  2⤵
  PID:9872
- C:\Windows\System\cjqMdil.exe
  C:\Windows\System\cjqMdil.exe
  2⤵
  PID:9912
- C:\Windows\System\wCcTXza.exe
  C:\Windows\System\wCcTXza.exe
  2⤵
  PID:10016
- C:\Windows\System\IlTZBEY.exe
  C:\Windows\System\IlTZBEY.exe
  2⤵
  PID:10092
- C:\Windows\System\DyXFlvS.exe
  C:\Windows\System\DyXFlvS.exe
  2⤵
  PID:10192
- C:\Windows\System\FJIYfKI.exe
  C:\Windows\System\FJIYfKI.exe
  2⤵
  PID:8424
- C:\Windows\System\pDmLOjw.exe
  C:\Windows\System\pDmLOjw.exe
  2⤵
  PID:9240
- C:\Windows\System\tLSuzlo.exe
  C:\Windows\System\tLSuzlo.exe
  2⤵
  PID:9304
- C:\Windows\System\ApCWLhj.exe
  C:\Windows\System\ApCWLhj.exe
  2⤵
  PID:9400
- C:\Windows\System\fGhGFiK.exe
  C:\Windows\System\fGhGFiK.exe
  2⤵
  PID:9608
- C:\Windows\System\VOiYhqN.exe
  C:\Windows\System\VOiYhqN.exe
  2⤵
  PID:10000
- C:\Windows\System\vPtRkQC.exe
  C:\Windows\System\vPtRkQC.exe
  2⤵
  PID:10072
- C:\Windows\System\EFKdISu.exe
  C:\Windows\System\EFKdISu.exe
  2⤵
  PID:10140
- C:\Windows\System\iuQhIqm.exe
  C:\Windows\System\iuQhIqm.exe
  2⤵
  PID:10180
- C:\Windows\System\vwqLefA.exe
  C:\Windows\System\vwqLefA.exe
  2⤵
  PID:9968
- C:\Windows\System\gdpJvyt.exe
  C:\Windows\System\gdpJvyt.exe
  2⤵
  PID:10212
- C:\Windows\System\bznTYbT.exe
  C:\Windows\System\bznTYbT.exe
  2⤵
  PID:9344
- C:\Windows\System\MyqVpRV.exe
  C:\Windows\System\MyqVpRV.exe
  2⤵
  PID:9480
- C:\Windows\System\rfySwBt.exe
  C:\Windows\System\rfySwBt.exe
  2⤵
  PID:9412
- C:\Windows\System\GWpCzGu.exe
  C:\Windows\System\GWpCzGu.exe
  2⤵
  PID:9856
- C:\Windows\System\LOUXZYc.exe
  C:\Windows\System\LOUXZYc.exe
  2⤵
  PID:9572
- C:\Windows\System\kpuStQd.exe
  C:\Windows\System\kpuStQd.exe
  2⤵
  PID:9604
- C:\Windows\System\NXaVcuk.exe
  C:\Windows\System\NXaVcuk.exe
  2⤵
  PID:9668
- C:\Windows\System\PlkvGPA.exe
  C:\Windows\System\PlkvGPA.exe
  2⤵
  PID:9732
- C:\Windows\System\oIkcfdl.exe
  C:\Windows\System\oIkcfdl.exe
  2⤵
  PID:9988
- C:\Windows\System\nZxQJRL.exe
  C:\Windows\System\nZxQJRL.exe
  2⤵
  PID:8324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BpsmyLn.exe

Filesize
1.1MB

MD5
ceb5e04f11d1bd071b9b4b453df706a4

SHA1
b637f8267803df034bb09ac78ec0369806fad92d

SHA256
2e2399f3292778e3e3c1344c30d0d1064d416b7ed96d8e5c2230ddd389c25ca8

SHA512
446f5f5aa0dfcf90a9aaf409ef6c13ba0de3b61735acde640deac255f6d0a1946fb05a711fc86e26f906f91fad13ca3bbd1129873a9cef4de42f87fe683d9ace

Download Submit
C:\Windows\system\DgmJKrs.exe

Filesize
1.1MB

MD5
b4927459a996a343036e570a387d1a0d

SHA1
2a4b74abeabda8b45ba34d65b7451901f45033c0

SHA256
3b292f6bc7fb743e3a3083b7c82dcbb639fdea2188a5882e1d2668e295fc5db3

SHA512
61d2da50caab1327b0f619c1b17c7e0f8400b8a66853e5a8e3c8a5acfa832c3de3297ef0ec12882ab5b5e2e743cd92815c59cd65119e76006a0d5becde8f51a9

Download Submit
C:\Windows\system\DwfNRxq.exe

Filesize
1.1MB

MD5
6b9e01fd0a02ce188242355568a55d30

SHA1
fc1512f14b9e56c3136ec415bd49a837c38f7cc4

SHA256
fee6754b8205e40ac93fa31f7f266491cd31803b517b13936b162660ae448a29

SHA512
a8c172a59ebbfab4bac386b17b45c535080cce3b752ed97775574694ef591438410959e4455ced1a173eef7abb221b69a4a4462ba2897d88e10620db08ed3783

Download Submit
C:\Windows\system\FRfgwCa.exe

Filesize
1.1MB

MD5
72bc70e3df079ed123b626ed35a54b41

SHA1
daca557f813541bf1f380550051f6f2e882099f0

SHA256
f0fbaa2787cf5e6d24ca8fd2505439965d9bf21fe481c8334764eed8150c6a71

SHA512
7d708415f943d28a0306da87309fdbcf636f66dbd8de51a0e8a01c68448e347a6cf9a1b7381a0703e60a4916c588bea2c6357d5d9519e74b107db4471dd9f96d

Download Submit
C:\Windows\system\FhvBgdH.exe

Filesize
1.1MB

MD5
805e05ff88095639d90750237bbf93af

SHA1
b4b1fe83bf75b35c679bd93a9aec4a66663a35e3

SHA256
fe719e0a6351fe717dc4c7a5a9957467127918f832a86a85dded2cc384e482f4

SHA512
1b2bef0c673577e4d430af61fe513b8fbdb531b199aeefcf230bdd9e8b633efd51c328f0f065be572ea4432d88b75a32abb33df2eb00e1a20aa6d10f852e97bd

Download Submit
C:\Windows\system\FqidVPf.exe

Filesize
1.1MB

MD5
a1add9e6cfb3ff1e4b7c1463a063a541

SHA1
abfa3de02ab429277868c2595db783c9af161f26

SHA256
470a8ebf4c12815b81a3b16e86b565fea0ca099008a6c9ed4ee52d9d83828ecf

SHA512
255fe69c0ff4429a5aec4c86795c339f23f967f6cf3102aa7e85b3b037d60e3700c3aa5f2daf1f32b068340c0af479748533d278903d43649e138e8a0df53654

Download Submit
C:\Windows\system\KyASqeL.exe

Filesize
1.1MB

MD5
ca729629f977a1286376774b3c575db0

SHA1
5872f79fc091cb3ed1073042e10a3d257856d923

SHA256
c63057bc58bbe21aa0e7cd36919578f8b690a3b9f990c681613f35e3420f4d0c

SHA512
909df4bd0e088c30d9969174b39272daa432f9e707f2e113dfd75c768f1047b77eca52cbb084b54ec1fab6ca99768ab64310e0a9561624450e2993ca80abbb6f

Download Submit
C:\Windows\system\MZukope.exe

Filesize
1.1MB

MD5
911edf6de1c68620a3332f3da35ac10b

SHA1
7898069270e4067dfae5b50413c3a6073e2d98ba

SHA256
3b3dbe769b50e2355407c8a22f8ad4a5337606e4c0913146e2f267cfdc9dc893

SHA512
5b428c1315611a71aeabf2d071bffbe2bb2e832ca24a9ecbd6350fc34788aa5fa5830a7da0f6ae44d31889b9823b1dc2cedd0d55e776b4dd09a3805dfa65b7be

Download Submit
C:\Windows\system\QDaNIsQ.exe

Filesize
1.1MB

MD5
64f6a051db4d4afc47963e9084deabdc

SHA1
1d0a93a3f4faff0c5cc431a5c8f9de6b171df9b4

SHA256
72a3f99642271804af35b1786e498f7ab1e4a7a34b0d25c7acfcbe254bccb818

SHA512
3f582af71e23e20bc592203271d9751b0e7794fe17a8fc213fef7f4953a7039af133feec601e6c083dbf3f1795505fd323a15c419eb7fee2173e6db8cbd7f11e

Download Submit
C:\Windows\system\RXdAcZg.exe

Filesize
1.1MB

MD5
f4a1e9b19baf0a2982ee52921f5fa993

SHA1
7954f0e5cda934213b4642a96dff9f3643b649ad

SHA256
8b603d6ca1472d077cffe1d5670ed11c916f2bced26e92887e23312e6190e89c

SHA512
7116d45a4767913d85fa31e5d9828109ec3fd59a1973b047da1005c88b1e817450765b77b9ee909540bc5276bf815f1ebd26167f35687ca4dd2f0f50c2154c38

Download Submit
C:\Windows\system\UAwXquF.exe

Filesize
1.1MB

MD5
4f388288ad03e0f9b261ca137af5e7c1

SHA1
7fe28ac9863bea2f3cf4c10cf94bcf0f3f6f26f8

SHA256
d26fc780033484610a78e222641c9f5ec157412070e95f7af6f8b712eeef09b8

SHA512
3e75ae3e5af07f666da983126f17d95e12d6378699afb495e7e04d3db016226a572545b778b8d98b0c740eb1265d678585a362beec7d9f7e54c2c3e8f201a90e

Download Submit
C:\Windows\system\WgQfJuX.exe

Filesize
1.1MB

MD5
781e5a4c8a2c966b247a4ba1d6e0fd49

SHA1
13adf762843ad1642dafc8cebf33468f2043b3e4

SHA256
1c524df5f102a5528899536cfd909fa95f5bc69618d6bab0db6475958695e713

SHA512
1eda38f4da328bccd1110c23166401b905f933a6007e068cd73b97a79dc8f1daa76ba4607a35b5b2687256d2e4ffe69e37655f0aeb9979bf36c05d9dd00c0b75

Download Submit
C:\Windows\system\XrrXYAH.exe

Filesize
1.1MB

MD5
472cb6c6d1aede808dccef156b637e5d

SHA1
342cd54fc46eca71c6fd11fd3524c39600e33385

SHA256
95b01d99f1cb42c6b7cc7c55733a7adef55d9013f61d0df814ac2d06f46f3f8a

SHA512
f7bff29fab64a759e014eda952865c999722614818f35e2e54dd9406959570e4c9fac3f75a4d01bb25301c940aeed7768c760dab0271995322a4594913bc1944

Download Submit
C:\Windows\system\ZwbhfZW.exe

Filesize
1.1MB

MD5
bf9950d19cd6c777056e9a487ceecf95

SHA1
3fc62b3854d7cbbc63a809d8700d00a9968f67d3

SHA256
bfc56a8e7b091b7b696757e435424c911b7a161165d013d062f19c56c7fb356e

SHA512
b3ca051e1c986d1ea00074795f27ae1cdb1b720276820a0589b1ad812c562a96a416e8db598858e5ae19fa76c6db15c14f0f7105e4b7ea8d779006d0bf07a636

Download Submit
C:\Windows\system\eEvXIxR.exe

Filesize
1.1MB

MD5
0d800d5c02f95f47b9032a478603fee6

SHA1
4495a1fdaa23f8d8c39bad84f1cd3d7502aebd19

SHA256
7acb939097398c56d524ca48b7b36a4a693dc544488d28d373b1d61f83b40184

SHA512
21edf97aef94189ca1d45ab8724599ea83656743975a4384e5bd59f05c8d2410f50923118b69a3cc1d22353ffc1543ddf8d89df09a4bb91612c3d47fcc250816

Download Submit
C:\Windows\system\fWzYqlO.exe

Filesize
1.1MB

MD5
dc9d72c1672d7bfc389f5ec283b8c246

SHA1
a65b253e730588a535cc03f6a9411aa8333ce0a7

SHA256
069e742156a00b154f835dd84660e1088a5addcb50f30d565c967664cfea5494

SHA512
67929ccf4d597500bf0c936ee930c8191495b6fc70f32f63fc05a6ef118df140006ddb6528a5e0bfd14eb482cb1ea884b50912643cbb90dd8c04df8e07baece7

Download Submit
C:\Windows\system\fjrOxta.exe

Filesize
1.1MB

MD5
e72cf0936e2d8331b2d78f9400199cc4

SHA1
7293e60591d6d443721bf3e8fadbb07ab5e45f5e

SHA256
5d569028886daaab2737c47e7ce16b36278f8b52b471dc4693db6e2267e98fe2

SHA512
d7e234ef027efd6f35e1513241d0d060f1990f2372d356fed25d571db0699c1fe01ee0fe411e80c091f3cbb2c101c220b574e3e36a9ca632763e987a85a67a00

Download Submit
C:\Windows\system\iauWKMN.exe

Filesize
8B

MD5
1760839b55220a7273e7d4b611c74c68

SHA1
103d0fb94267a08347d76b7f783580d0e8e0b885

SHA256
a315866ff3a2e83d464225dee35eee1c9c3c5c8cf80f428c1a2be919ef8e5308

SHA512
9aa273824c918fff1a8f949f96ecc4186c5d9dc2c78485b69fef096e69f14e16fa261d1ef4a0562a7adc2a0ac88d7b17e54cee7522a0b1b90a0eaf65b0fe5524

Download Submit
C:\Windows\system\jvyqYJE.exe

Filesize
1.1MB

MD5
9840ba40d25548f9a4df024ebfadd8f8

SHA1
1d4beec78b1e71c952acfe99bf486714e15cb3f5

SHA256
f732d43b4c221d73776dd593e608302a6bb4181e1feca3bd0eed18cf48b9ec48

SHA512
7b04f58062637da64ca3d5cd55734fc5cbe1f22d5bef1d68696f946eca3821515537fe6c9277a0aa18a62139e68800fda39a100508764bde7eac3e2506c10685

Download Submit
C:\Windows\system\mMVBZKj.exe

Filesize
1.1MB

MD5
9c61b20c532a941faa6b13b6a72ce9bb

SHA1
ff4f4672e3b415aed1e979ff7475ca2d32875329

SHA256
54cd518756972e4b7064402fe82e391218f44c88f5e2a21533ce9f12fb904801

SHA512
48f75d4106a055bef05fdb95e51f45dc78bb0ab4a0af1da42befd1f9807eb651ee5c8e54469cfe82fcaf0e83dc6cbb8e708591f840ce7c58b73e821decf4c526

Download Submit
C:\Windows\system\nOxYzWl.exe

Filesize
1.1MB

MD5
68f0092008e3eec4f79dedd21d882b98

SHA1
bd1131c2f038d81608a316d932680f6feca66c94

SHA256
33d4de34748a1fa09eb06d5bd6f8f48830f9d9908b52b179ae1bb9f5becbc9b5

SHA512
ee5a8a6cc87b84e9c34eb8a24984e0ee92c88710c6056aee31ff69e91f206b30235dad62ac96d75af7d80005a46210d5d2b61fe043474ef4f1dc6f23d45a2f9d

Download Submit
C:\Windows\system\pqHwNQk.exe

Filesize
1.1MB

MD5
aa81a84d80afc7d942f51376482be7df

SHA1
7b40f88b513c349f8c3f9ecc112d81324f776db9

SHA256
ecce4d9d9488bdf11c84c574e56de03b28e0f5a6d032dac7ec5fb32b793cff2a

SHA512
a774a606124ccfe991d8572018ea641123fa66133fdad8df8105b991849ac0d0a8535fd071bb56eaa28bf814d98c7f22a85296b738a7bb5c378e210abb2dfb0f

Download Submit
C:\Windows\system\qJifsty.exe

Filesize
1.1MB

MD5
e636e5eeafae7e888c94140de2c421a1

SHA1
2421eafcf68c7d76746e3d468a8cf5d5275be97b

SHA256
75223689cd2c8cd1884215b46bd0678534c8262bea3e6896922c1e5d8e769eee

SHA512
e6993ef3d01672e2e178beee96c321bea6827f52a0f06a4a073500ed7561680715f8910900edeed8e06b2d1f67dd00418089dd57193bf2420393188aaaac4bda

Download Submit
C:\Windows\system\qbWvhba.exe

Filesize
1.1MB

MD5
66b1b9d390766602da88a769e85ace56

SHA1
d1669f97d94f528f11ed28d4e1959afbb43ef5c7

SHA256
ebdf4ba736561fe49cbf05592fd3dae29ff69c0bc439385a4563ca5fbd9cefec

SHA512
f045d5e9fea110b07af5d4a5b487521d29278555fd144cc0d207b0b2a05c450f37c64aebdd722514c9bf781aa4bd356e91ef54c9a26d07a174ab89bd27c52c4d

Download Submit
C:\Windows\system\rSfJNKj.exe

Filesize
1.1MB

MD5
e9c3492f8911642e55243a427914bc4f

SHA1
018c88eada962d77f12cd8365597eff0824eb485

SHA256
6d0f402a2df372408155b340df08823bd7c5efce18a4c63ca535984e02844179

SHA512
19b2830feed2c99d266ba656c72dc0476206e1f786ae66527e0b4752a7a3100a1db13405a4cd426c50b6ad0b388d987ddd2aca38a8132682dcfc2e3bab37ebd4

Download Submit
C:\Windows\system\txOlztI.exe

Filesize
1.1MB

MD5
f9222153327b9dcd0e3809972f13e859

SHA1
8c0196f9d4a65c23070e2b1e83d58ac5bdfb3639

SHA256
65698c02934dcfbdea60713baa8db661c7e75450f16e6f4c6562064707b528fb

SHA512
3078316e31e35c5ccd9792385477b525b4913117845b1e1071a957a139da280c80a5209f0602ddf8f46ddba605fc5c34e9296f29facfaf712a90b6f514b191c2

Download Submit
C:\Windows\system\xGEoecz.exe

Filesize
1.1MB

MD5
2c2ac455e646387ae969dd9d679fff63

SHA1
ea00a4880a92d0327508836f65bd7d076b7a5f63

SHA256
805bc839ff5afcebd51d3aa7161e4502b2fdab6053a4bbc1a6b7b815bf6a3f7c

SHA512
6f7120e435ca0ef3681d866f45e5be74b1f3630d32d4a2f392457d9ce5b43cc5b81b6c8becdbe8c47ab446294561cb2e05373fbcc788c76e440827920e2cff8f

Download Submit
\Windows\system\JIesoef.exe

Filesize
1.1MB

MD5
f293f2e885268abac680134690f1208e

SHA1
9e1cd82eecd0f64d1f5729e04f85e61f4616510b

SHA256
caf0d0e62faa5aaa94638a820b8abb2711220bab64e300a324ba11ebd5d96f81

SHA512
39dbe63f8e1b121d18be76003a6e7b90e0bc705126677877ed54a4f7e71a932cceeae2024033202a3fc2cb19105bb7ca2ed9b2fd235022f297f0119578212227

Download Submit
\Windows\system\OyOyHSx.exe

Filesize
1.1MB

MD5
21588fd6cd3030700cf19bac9cad4f86

SHA1
f8bfa91c88ec58ead8114176d61a9f29a5ca01d3

SHA256
b7861302462a07dfa51689d8bbec884d349358f589102cdb8aa7e094ab8a33b2

SHA512
f29bc0f4a7f9da5a3f7ad78f8fb3b8a63a3f1cc1b5182746cad90b06b6a09fef2f0cd071b50898e47cc3d267bd03afcc1176f6ca37cefc887db4e8bdd413e545

Download Submit
\Windows\system\QvQlUxo.exe

Filesize
1.1MB

MD5
4c60cb346fd785c7ecefbbba5c0a8e1e

SHA1
305460809364ef04f9c7a7b6e201b0678c2a2b16

SHA256
088961918ad9171b1dc92ec8ff5102ad3f022d75fb5611598a48b0f5ecd15009

SHA512
264b3387515572a7e24c16376c253e5371c65f30a4be7cf8e64f36e613a3bfee4084fb3ac85abefc8fc0d79393419bbe419bbeeb3c09ac0c13f557d455e03c14

Download Submit
\Windows\system\SXwHDTh.exe

Filesize
1.1MB

MD5
e48c5cdc254bf42a76130951742083d9

SHA1
cc1dd329235d3a77818426a714e9d0be41b2a9a5

SHA256
ab1a40d23b98be2889f4453137576ca5b54a7765c03dad2a53a60462753b94a1

SHA512
8db6b552553bdc5397f4f006dbaea366271d95477461864fa23575a593c5ca031a7520234fb9388bc602e575dda8bce4e4ba89206f122908328807cb2d84cd22

Download Submit
\Windows\system\VkIHgXX.exe

Filesize
1.1MB

MD5
6724d66b3bd4f35f72cb2657ebc0cf74

SHA1
d0d52af85298a6ecb5fa991cf74857d1373c0692

SHA256
c4c54ed059bded61347389e7098196a11b6c43367ea01fdeb64c8c3c8247851b

SHA512
95005d9f0116b451cb172a218f9836d4eb264de481e3c8e0d6435f368d5e6babd7d298d0981468e87cab05bc91478c9a9d62d2e8e4cbfcb72e2f59552aca4a99

Download Submit
\Windows\system\dtTvAka.exe

Filesize
1.1MB

MD5
2d5ec159d597b448c75ffa7769801e1d

SHA1
3b58f39ca35aea2509a2976d2eaa8c9567d1c575

SHA256
5435250dec251e4fce2a834a8efed60faae53d46a1f779bf86d104e9a5e37110

SHA512
979a8fc5aea8636bbb48d91b32b27013ae92cae6ab7f43c540c01b3fbaaa9e8516a4e507bfa75605cfc31b293f31da52c85d7cf04ecd5c05f0e2ed606938e365

Download Submit
\Windows\system\krqsLVA.exe

Filesize
1.1MB

MD5
5059a94210e301c91fb82a90859100e0

SHA1
93e4f1decc2498ee10f538ba64eb5aa2d1b41845

SHA256
35921fa6654563c2b61da105d44d475e83997b7e192845be64710e2ac9b5a7de

SHA512
dc06d804103fab59089a80353df244df88aab7cd918a2c2b71c7a314d5972e7959332c85f0982b7e492fd5aa27b3339fc35946a5fe529ce22e56d108032bf937

Download Submit
\Windows\system\oCKahiW.exe

Filesize
1.1MB

MD5
22561f0889bce541be0c878e274ad03f

SHA1
f546ca7aa3f34b00990d8a94a19e5a5111918bc7

SHA256
7da0af304197404933f960f4379e8c2fec7cf418ad53304bbb7711112f5760a8

SHA512
effbc068685b546388d97334431a9d65af73802f9fdf09f9f3c8b490e7a9be92fbe7184c26d9592920b82054a3cc6d00964ee25e59fb767b2b4f257b22d2147c

Download Submit
\Windows\system\oPuOHOD.exe

Filesize
1.1MB

MD5
dbce4a2284e8ce9a0ab4aa5fa14714fe

SHA1
49de0dbaef7db9399461ab62105baffdfe10bb91

SHA256
03b3a5e9945a02c0cfa9833d8555ac4165f32afa477e615be69fd264de733995

SHA512
251eca97eb19a7da2c5e6c53336e88c48ef803cc2a8b96a8229bb6fe9c1209e4fd3b22815a6dbfb0d213fd03362cd41dc86fc0e6e857cf5210b3df7058116f57

Download Submit
memory/1264-36-0x0000000001F00000-0x0000000001F08000-memory.dmp

Filesize
32KB

Download
memory/1264-42-0x000007FEF4A10000-0x000007FEF53AD000-memory.dmp

Filesize
9.6MB

Download
memory/1264-33-0x000007FEF4A10000-0x000007FEF53AD000-memory.dmp

Filesize
9.6MB

Download
memory/1264-22-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

Filesize
2.9MB

Download
memory/1264-196-0x000007FEF4A10000-0x000007FEF53AD000-memory.dmp

Filesize
9.6MB

Download
memory/1264-14-0x0000000002D00000-0x0000000002D80000-memory.dmp

Filesize
512KB

Download
memory/1264-16-0x000007FEF4CCE000-0x000007FEF4CCF000-memory.dmp

Filesize
4KB

Download
memory/1264-88-0x000007FEF4A10000-0x000007FEF53AD000-memory.dmp

Filesize
9.6MB

Download
memory/1684-13-0x000000013F990000-0x000000013FD82000-memory.dmp

Filesize
3.9MB

Download
memory/1916-8311-0x0000000003330000-0x0000000003722000-memory.dmp

Filesize
3.9MB

Download
memory/1916-84-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/1916-71-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/1916-93-0x000000013FFE0000-0x00000001403D2000-memory.dmp

Filesize
3.9MB

Download
memory/1916-92-0x000000013F0A0000-0x000000013F492000-memory.dmp

Filesize
3.9MB

Download
memory/1916-8081-0x0000000003330000-0x0000000003722000-memory.dmp

Filesize
3.9MB

Download
memory/1916-5469-0x000000013F8A0000-0x000000013FC92000-memory.dmp

Filesize
3.9MB

Download
memory/1916-19-0x0000000003330000-0x0000000003722000-memory.dmp

Filesize
3.9MB

Download
memory/1916-2-0x000000013F8A0000-0x000000013FC92000-memory.dmp

Filesize
3.9MB

Download
memory/1916-86-0x000000013FFD0000-0x00000001403C2000-memory.dmp

Filesize
3.9MB

Download
memory/1916-85-0x000000013FF00000-0x00000001402F2000-memory.dmp

Filesize
3.9MB

Download
memory/1916-53-0x000000013FF10000-0x0000000140302000-memory.dmp

Filesize
3.9MB

Download
memory/1916-38-0x0000000003330000-0x0000000003722000-memory.dmp

Filesize
3.9MB

Download
memory/1916-8-0x0000000002E10000-0x0000000003202000-memory.dmp

Filesize
3.9MB

Download
memory/1916-81-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download
memory/1916-8288-0x0000000003330000-0x0000000003722000-memory.dmp

Filesize
3.9MB

Download
memory/1916-79-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/1916-78-0x0000000003330000-0x0000000003722000-memory.dmp

Filesize
3.9MB

Download
memory/1916-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2504-5405-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2504-94-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2516-5399-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download
memory/2516-83-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download
memory/2640-73-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/2640-5391-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/2680-105-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/2680-5414-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/2700-72-0x000000013F9E0000-0x000000013FDD2000-memory.dmp

Filesize
3.9MB

Download
memory/2712-5397-0x000000013F0A0000-0x000000013F492000-memory.dmp

Filesize
3.9MB

Download
memory/2712-82-0x000000013F0A0000-0x000000013F492000-memory.dmp

Filesize
3.9MB

Download
memory/2752-5402-0x000000013FF10000-0x0000000140302000-memory.dmp

Filesize
3.9MB

Download
memory/2752-90-0x000000013FF10000-0x0000000140302000-memory.dmp

Filesize
3.9MB

Download
memory/2924-5403-0x000000013FFD0000-0x00000001403C2000-memory.dmp

Filesize
3.9MB

Download
memory/2924-87-0x000000013FFD0000-0x00000001403C2000-memory.dmp

Filesize
3.9MB

Download
memory/3020-89-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/3024-5407-0x000000013F610000-0x000000013FA02000-memory.dmp

Filesize
3.9MB

Download
memory/3024-95-0x000000013F610000-0x000000013FA02000-memory.dmp

Filesize
3.9MB

Download