xmrig | 6cc1b5ddf74fd989f1baa8de54853a4fd9f6fbfd20783163bdd77da0015f82fc

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 00:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d87aa15ba08159ed07e228e5d61dc00N.exe
Size

1.8MB
MD5

1d87aa15ba08159ed07e228e5d61dc00
SHA1

1146859ccadf47be8a22e9929b93796d6eb0cb3a
SHA256

6cc1b5ddf74fd989f1baa8de54853a4fd9f6fbfd20783163bdd77da0015f82fc
SHA512

8e8058a18f763ea086da2ca453c6cc1b9cebd7e1818dd0c46852d9996449e51a852903d8434a9cc825712756ff1735c72f47e4e1f68879465ea6fa1f66751a4d
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNI/TQ9f27dvapbkeyHdbKbTK:Lz071uv4BPMkFfdk2a2yKmkfHb/ETG

Score

10^/10

xmrig execution miner persistence privilege_escalation upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 13 IoCs

miner

resource	yara_rule
behavioral1/memory/2764-177-0x000000013FE10000-0x0000000140202000-memory.dmp	xmrig
behavioral1/memory/2172-180-0x000000013F510000-0x000000013F902000-memory.dmp	xmrig
behavioral1/memory/2156-54-0x000000013FD40000-0x0000000140132000-memory.dmp	xmrig
behavioral1/memory/2744-184-0x000000013F940000-0x000000013FD32000-memory.dmp	xmrig
behavioral1/memory/2132-175-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	xmrig
behavioral1/memory/2824-173-0x000000013FE90000-0x0000000140282000-memory.dmp	xmrig
behavioral1/memory/2960-25-0x000000013FDA0000-0x0000000140192000-memory.dmp	xmrig
behavioral1/memory/2172-4966-0x000000013F510000-0x000000013F902000-memory.dmp	xmrig
behavioral1/memory/2156-4996-0x000000013FD40000-0x0000000140132000-memory.dmp	xmrig
behavioral1/memory/2960-5078-0x000000013FDA0000-0x0000000140192000-memory.dmp	xmrig
behavioral1/memory/2132-5240-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	xmrig
behavioral1/memory/468-5764-0x000000013F7C0000-0x000000013FBB2000-memory.dmp	xmrig
behavioral1/memory/2744-6694-0x000000013F940000-0x000000013FD32000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1908	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2960	PCvcfjK.exe
2156	IzAmDNd.exe
2824	BmWkOui.exe
2132	khWZvnp.exe
2764	WcVFZKw.exe
2172	axPplhn.exe
2744	axabDwq.exe
2728	lsRSFBi.exe
2880	CXjRhhx.exe
2796	oTarkHB.exe
2572	AZvBJKI.exe
3016	tqBnTIW.exe
2700	EpitSYn.exe
2288	obsVAke.exe
1404	aMATBTP.exe
1616	GmNOTTK.exe
2440	MIXVmWb.exe
2608	TdMWpyu.exe
2000	aLleWDY.exe
956	RLFOcMs.exe
1976	xvetzIl.exe
1432	LuZzGDA.exe
2088	PDruAin.exe
2820	gTLCHfW.exe
2568	piaJMvJ.exe
2540	ztPbqUx.exe
2712	AIeHQyv.exe
2204	MqOfLko.exe
580	MAjJvZc.exe
2036	rqNfhlB.exe
2292	Hcajdiu.exe
356	QmaBtTn.exe
1548	LISNNcg.exe
2844	PoibYKZ.exe
2412	mHxaaww.exe
1892	jNAtECH.exe
1564	XILPuyL.exe
2384	DgnhMno.exe
848	YYLSbAK.exe
2308	ClidcCR.exe
1992	mXhahcV.exe
896	FkyYcUK.exe
1428	uwfFiMH.exe
1988	dhVxwph.exe
2120	LHsVZKs.exe
1644	SjbYfWm.exe
2464	CqASQMl.exe
2888	iSTDeFR.exe
2768	OKefVDq.exe
2648	trvfTCJ.exe
2832	WPtylkY.exe
2616	KzLMUSK.exe
1728	eMMdvnq.exe
1444	cNFaxDK.exe
1624	IhYbkou.exe
316	wkiGlBD.exe
696	JuPDUfn.exe
1396	tgObnQO.exe
868	IHlXWRM.exe
1960	fZoQROa.exe
704	nxAljfJ.exe
844	AlkaDkd.exe
3000	FINrjFS.exe
2908	IUHXQQT.exe

Loads dropped DLL 64 IoCs

pid	Process
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe
468	1d87aa15ba08159ed07e228e5d61dc00N.exe

UPX packed file 52 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/468-0-0x000000013F7C0000-0x000000013FBB2000-memory.dmp	upx
behavioral1/files/0x00080000000120ff-6.dat	upx
behavioral1/files/0x000800000001746a-9.dat	upx
behavioral1/files/0x0005000000019f50-78.dat	upx
behavioral1/files/0x000500000001a423-153.dat	upx
behavioral1/memory/2764-177-0x000000013FE10000-0x0000000140202000-memory.dmp	upx
behavioral1/memory/2172-180-0x000000013F510000-0x000000013F902000-memory.dmp	upx
behavioral1/files/0x000500000001a486-129.dat	upx
behavioral1/files/0x000500000001a475-122.dat	upx
behavioral1/files/0x000500000001a452-111.dat	upx
behavioral1/files/0x000500000001a425-104.dat	upx
behavioral1/files/0x000500000001a41b-98.dat	upx
behavioral1/files/0x000600000001a310-92.dat	upx
behavioral1/files/0x000500000001a08c-86.dat	upx
behavioral1/files/0x000500000001a04b-67.dat	upx
behavioral1/files/0x0005000000019f39-61.dat	upx
behavioral1/memory/2156-54-0x000000013FD40000-0x0000000140132000-memory.dmp	upx
behavioral1/files/0x0005000000019c9f-53.dat	upx
behavioral1/files/0x0005000000019c66-46.dat	upx
behavioral1/memory/2744-184-0x000000013F940000-0x000000013FD32000-memory.dmp	upx
behavioral1/memory/2132-175-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	upx
behavioral1/memory/2824-173-0x000000013FE90000-0x0000000140282000-memory.dmp	upx
behavioral1/files/0x0005000000019af1-162.dat	upx
behavioral1/files/0x000500000001a4a8-159.dat	upx
behavioral1/files/0x000500000001a4a4-158.dat	upx
behavioral1/files/0x000500000001a498-157.dat	upx
behavioral1/files/0x000500000001a481-156.dat	upx
behavioral1/files/0x000500000001a473-155.dat	upx
behavioral1/files/0x000500000001a426-154.dat	upx
behavioral1/files/0x000500000001a419-152.dat	upx
behavioral1/files/0x0007000000004e74-151.dat	upx
behavioral1/files/0x000500000001a055-150.dat	upx
behavioral1/files/0x0008000000018c0c-110.dat	upx
behavioral1/files/0x0005000000019d6d-77.dat	upx
behavioral1/files/0x0005000000019c68-76.dat	upx
behavioral1/files/0x0005000000019c4d-75.dat	upx
behavioral1/files/0x0005000000019aef-74.dat	upx
behavioral1/files/0x0008000000018784-33.dat	upx
behavioral1/files/0x000e000000018660-32.dat	upx
behavioral1/files/0x0006000000018679-58.dat	upx
behavioral1/files/0x00080000000174a8-45.dat	upx
behavioral1/files/0x000500000001a4a2-136.dat	upx
behavioral1/memory/2960-25-0x000000013FDA0000-0x0000000140192000-memory.dmp	upx
behavioral1/files/0x0008000000017462-14.dat	upx
behavioral1/files/0x000500000001a4a6-143.dat	upx
behavioral1/files/0x000500000001a4a9-191.dat	upx
behavioral1/memory/2172-4966-0x000000013F510000-0x000000013F902000-memory.dmp	upx
behavioral1/memory/2156-4996-0x000000013FD40000-0x0000000140132000-memory.dmp	upx
behavioral1/memory/2960-5078-0x000000013FDA0000-0x0000000140192000-memory.dmp	upx
behavioral1/memory/2132-5240-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	upx
behavioral1/memory/468-5764-0x000000013F7C0000-0x000000013FBB2000-memory.dmp	upx
behavioral1/memory/2744-6694-0x000000013F940000-0x000000013FD32000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\siSFaeW.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\zyUtPIW.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\qctVbqw.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\GMwzQJw.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\aweGKaj.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\PIEnmTa.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\fJbNAbB.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\lpfAguE.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\ltrgAJa.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\erWtXbi.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\fEYdxcT.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\bQRMdvg.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\PAYYlFl.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\GJxFluJ.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\PWhlcCh.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\DAlbBXZ.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\LIePsJR.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\gMWSUTW.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\PtBvrmV.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\mXhahcV.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\warJqgO.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\AnmkUha.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\FRQgKvD.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\cAQxEHg.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\TosCdww.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\dYPjwIW.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\PXtIpLo.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\IQHqBjx.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\EOXfpuQ.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\OSSRISX.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\ANAcJZL.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\YTdGann.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\iNIktML.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\miJPiVk.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\XHDcLTE.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\lagYLhl.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\aBCbOcP.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\yVgNIRJ.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\FtLlgIL.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\SlAmYOP.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\xSMjqRK.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\pGWfbcg.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\vJRuAnu.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\dybqNHS.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\jGhbciy.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\dwgffhq.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\aZWcJnS.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\ApYzCtU.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\vZbWhsN.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\htXoavi.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\tpPnDcs.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\gcxItRg.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\RkkRkfM.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\mDWOPOd.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\TpDMHbh.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\lREhSuf.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\VMpVGxO.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\RSjNUvT.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\BOxsBFO.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\JQjJnKQ.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\iKJhkaC.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\uUWFyLk.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\zRkEhAc.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe
File created	C:\Windows\System\UeTulLe.exe	1d87aa15ba08159ed07e228e5d61dc00N.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1908	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	468	1d87aa15ba08159ed07e228e5d61dc00N.exe
Token: SeLockMemoryPrivilege	468	1d87aa15ba08159ed07e228e5d61dc00N.exe
Token: SeDebugPrivilege	1908	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 468 wrote to memory of 1908	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	32
PID 468 wrote to memory of 1908	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	32
PID 468 wrote to memory of 1908	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	32
PID 468 wrote to memory of 2960	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	33
PID 468 wrote to memory of 2960	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	33
PID 468 wrote to memory of 2960	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	33
PID 468 wrote to memory of 2156	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	34
PID 468 wrote to memory of 2156	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	34
PID 468 wrote to memory of 2156	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	34
PID 468 wrote to memory of 2824	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	35
PID 468 wrote to memory of 2824	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	35
PID 468 wrote to memory of 2824	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	35
PID 468 wrote to memory of 2172	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	36
PID 468 wrote to memory of 2172	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	36
PID 468 wrote to memory of 2172	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	36
PID 468 wrote to memory of 2132	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	37
PID 468 wrote to memory of 2132	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	37
PID 468 wrote to memory of 2132	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	37
PID 468 wrote to memory of 2744	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	38
PID 468 wrote to memory of 2744	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	38
PID 468 wrote to memory of 2744	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	38
PID 468 wrote to memory of 2764	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	39
PID 468 wrote to memory of 2764	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	39
PID 468 wrote to memory of 2764	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	39
PID 468 wrote to memory of 2700	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	40
PID 468 wrote to memory of 2700	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	40
PID 468 wrote to memory of 2700	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	40
PID 468 wrote to memory of 2728	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	41
PID 468 wrote to memory of 2728	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	41
PID 468 wrote to memory of 2728	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	41
PID 468 wrote to memory of 2820	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	42
PID 468 wrote to memory of 2820	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	42
PID 468 wrote to memory of 2820	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	42
PID 468 wrote to memory of 2880	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	43
PID 468 wrote to memory of 2880	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	43
PID 468 wrote to memory of 2880	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	43
PID 468 wrote to memory of 2568	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	44
PID 468 wrote to memory of 2568	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	44
PID 468 wrote to memory of 2568	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	44
PID 468 wrote to memory of 2796	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	45
PID 468 wrote to memory of 2796	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	45
PID 468 wrote to memory of 2796	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	45
PID 468 wrote to memory of 2540	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	46
PID 468 wrote to memory of 2540	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	46
PID 468 wrote to memory of 2540	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	46
PID 468 wrote to memory of 2572	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	47
PID 468 wrote to memory of 2572	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	47
PID 468 wrote to memory of 2572	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	47
PID 468 wrote to memory of 2712	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	48
PID 468 wrote to memory of 2712	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	48
PID 468 wrote to memory of 2712	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	48
PID 468 wrote to memory of 3016	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	49
PID 468 wrote to memory of 3016	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	49
PID 468 wrote to memory of 3016	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	49
PID 468 wrote to memory of 2204	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	50
PID 468 wrote to memory of 2204	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	50
PID 468 wrote to memory of 2204	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	50
PID 468 wrote to memory of 2288	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	51
PID 468 wrote to memory of 2288	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	51
PID 468 wrote to memory of 2288	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	51
PID 468 wrote to memory of 580	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	52
PID 468 wrote to memory of 580	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	52
PID 468 wrote to memory of 580	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	52
PID 468 wrote to memory of 1404	468	1d87aa15ba08159ed07e228e5d61dc00N.exe	53

C:\Users\Admin\AppData\Local\Temp\1d87aa15ba08159ed07e228e5d61dc00N.exe
"C:\Users\Admin\AppData\Local\Temp\1d87aa15ba08159ed07e228e5d61dc00N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1908
- C:\Windows\System\PCvcfjK.exe
  C:\Windows\System\PCvcfjK.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\IzAmDNd.exe
  C:\Windows\System\IzAmDNd.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\BmWkOui.exe
  C:\Windows\System\BmWkOui.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\axPplhn.exe
  C:\Windows\System\axPplhn.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\khWZvnp.exe
  C:\Windows\System\khWZvnp.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\axabDwq.exe
  C:\Windows\System\axabDwq.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\WcVFZKw.exe
  C:\Windows\System\WcVFZKw.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\EpitSYn.exe
  C:\Windows\System\EpitSYn.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\lsRSFBi.exe
  C:\Windows\System\lsRSFBi.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\gTLCHfW.exe
  C:\Windows\System\gTLCHfW.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\CXjRhhx.exe
  C:\Windows\System\CXjRhhx.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\piaJMvJ.exe
  C:\Windows\System\piaJMvJ.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\oTarkHB.exe
  C:\Windows\System\oTarkHB.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\ztPbqUx.exe
  C:\Windows\System\ztPbqUx.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\AZvBJKI.exe
  C:\Windows\System\AZvBJKI.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\AIeHQyv.exe
  C:\Windows\System\AIeHQyv.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\tqBnTIW.exe
  C:\Windows\System\tqBnTIW.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\MqOfLko.exe
  C:\Windows\System\MqOfLko.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\obsVAke.exe
  C:\Windows\System\obsVAke.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\MAjJvZc.exe
  C:\Windows\System\MAjJvZc.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\aMATBTP.exe
  C:\Windows\System\aMATBTP.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\rqNfhlB.exe
  C:\Windows\System\rqNfhlB.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\GmNOTTK.exe
  C:\Windows\System\GmNOTTK.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\Hcajdiu.exe
  C:\Windows\System\Hcajdiu.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\MIXVmWb.exe
  C:\Windows\System\MIXVmWb.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\QmaBtTn.exe
  C:\Windows\System\QmaBtTn.exe
  2⤵
  - Executes dropped EXE
  PID:356
- C:\Windows\System\TdMWpyu.exe
  C:\Windows\System\TdMWpyu.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\LISNNcg.exe
  C:\Windows\System\LISNNcg.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\aLleWDY.exe
  C:\Windows\System\aLleWDY.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\PoibYKZ.exe
  C:\Windows\System\PoibYKZ.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\RLFOcMs.exe
  C:\Windows\System\RLFOcMs.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\mHxaaww.exe
  C:\Windows\System\mHxaaww.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\xvetzIl.exe
  C:\Windows\System\xvetzIl.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\jNAtECH.exe
  C:\Windows\System\jNAtECH.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\LuZzGDA.exe
  C:\Windows\System\LuZzGDA.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\XILPuyL.exe
  C:\Windows\System\XILPuyL.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\PDruAin.exe
  C:\Windows\System\PDruAin.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\YYLSbAK.exe
  C:\Windows\System\YYLSbAK.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\DgnhMno.exe
  C:\Windows\System\DgnhMno.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\mXhahcV.exe
  C:\Windows\System\mXhahcV.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\ClidcCR.exe
  C:\Windows\System\ClidcCR.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\FkyYcUK.exe
  C:\Windows\System\FkyYcUK.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\uwfFiMH.exe
  C:\Windows\System\uwfFiMH.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\dhVxwph.exe
  C:\Windows\System\dhVxwph.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\LHsVZKs.exe
  C:\Windows\System\LHsVZKs.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\SjbYfWm.exe
  C:\Windows\System\SjbYfWm.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\CqASQMl.exe
  C:\Windows\System\CqASQMl.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\iSTDeFR.exe
  C:\Windows\System\iSTDeFR.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\OKefVDq.exe
  C:\Windows\System\OKefVDq.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\trvfTCJ.exe
  C:\Windows\System\trvfTCJ.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\WPtylkY.exe
  C:\Windows\System\WPtylkY.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\KzLMUSK.exe
  C:\Windows\System\KzLMUSK.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\eMMdvnq.exe
  C:\Windows\System\eMMdvnq.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\cNFaxDK.exe
  C:\Windows\System\cNFaxDK.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\IhYbkou.exe
  C:\Windows\System\IhYbkou.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\wkiGlBD.exe
  C:\Windows\System\wkiGlBD.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\JuPDUfn.exe
  C:\Windows\System\JuPDUfn.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\tgObnQO.exe
  C:\Windows\System\tgObnQO.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\IHlXWRM.exe
  C:\Windows\System\IHlXWRM.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\fZoQROa.exe
  C:\Windows\System\fZoQROa.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\AlkaDkd.exe
  C:\Windows\System\AlkaDkd.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\nxAljfJ.exe
  C:\Windows\System\nxAljfJ.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\FINrjFS.exe
  C:\Windows\System\FINrjFS.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\IUHXQQT.exe
  C:\Windows\System\IUHXQQT.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\SEsDGXI.exe
  C:\Windows\System\SEsDGXI.exe
  2⤵
  PID:2604
- C:\Windows\System\lpfAguE.exe
  C:\Windows\System\lpfAguE.exe
  2⤵
  PID:272
- C:\Windows\System\UxrpSFG.exe
  C:\Windows\System\UxrpSFG.exe
  2⤵
  PID:536
- C:\Windows\System\MSNDimW.exe
  C:\Windows\System\MSNDimW.exe
  2⤵
  PID:1956
- C:\Windows\System\tpPnDcs.exe
  C:\Windows\System\tpPnDcs.exe
  2⤵
  PID:2524
- C:\Windows\System\yWriwtZ.exe
  C:\Windows\System\yWriwtZ.exe
  2⤵
  PID:1904
- C:\Windows\System\GDhyJSa.exe
  C:\Windows\System\GDhyJSa.exe
  2⤵
  PID:2272
- C:\Windows\System\atMpfQk.exe
  C:\Windows\System\atMpfQk.exe
  2⤵
  PID:548
- C:\Windows\System\byavPRT.exe
  C:\Windows\System\byavPRT.exe
  2⤵
  PID:1700
- C:\Windows\System\bQdLfLm.exe
  C:\Windows\System\bQdLfLm.exe
  2⤵
  PID:2904
- C:\Windows\System\NRZJXRX.exe
  C:\Windows\System\NRZJXRX.exe
  2⤵
  PID:2588
- C:\Windows\System\LCStCnb.exe
  C:\Windows\System\LCStCnb.exe
  2⤵
  PID:1848
- C:\Windows\System\xVxgfuN.exe
  C:\Windows\System\xVxgfuN.exe
  2⤵
  PID:1656
- C:\Windows\System\oprkRzW.exe
  C:\Windows\System\oprkRzW.exe
  2⤵
  PID:608
- C:\Windows\System\gBWiajf.exe
  C:\Windows\System\gBWiajf.exe
  2⤵
  PID:1556
- C:\Windows\System\UcrpkWQ.exe
  C:\Windows\System\UcrpkWQ.exe
  2⤵
  PID:2148
- C:\Windows\System\UsUoqzY.exe
  C:\Windows\System\UsUoqzY.exe
  2⤵
  PID:2152
- C:\Windows\System\srNxJaf.exe
  C:\Windows\System\srNxJaf.exe
  2⤵
  PID:1536
- C:\Windows\System\GLXkwmY.exe
  C:\Windows\System\GLXkwmY.exe
  2⤵
  PID:2348
- C:\Windows\System\IXWHPGw.exe
  C:\Windows\System\IXWHPGw.exe
  2⤵
  PID:1516
- C:\Windows\System\qukJRMh.exe
  C:\Windows\System\qukJRMh.exe
  2⤵
  PID:2192
- C:\Windows\System\aMyJTRf.exe
  C:\Windows\System\aMyJTRf.exe
  2⤵
  PID:1588
- C:\Windows\System\utGfpTt.exe
  C:\Windows\System\utGfpTt.exe
  2⤵
  PID:1424
- C:\Windows\System\hCcAvXX.exe
  C:\Windows\System\hCcAvXX.exe
  2⤵
  PID:1496
- C:\Windows\System\TDAGFBE.exe
  C:\Windows\System\TDAGFBE.exe
  2⤵
  PID:2316
- C:\Windows\System\FfkRrgQ.exe
  C:\Windows\System\FfkRrgQ.exe
  2⤵
  PID:860
- C:\Windows\System\UjiApVW.exe
  C:\Windows\System\UjiApVW.exe
  2⤵
  PID:1232
- C:\Windows\System\bqChorf.exe
  C:\Windows\System\bqChorf.exe
  2⤵
  PID:2584
- C:\Windows\System\QsEkKPE.exe
  C:\Windows\System\QsEkKPE.exe
  2⤵
  PID:1648
- C:\Windows\System\ltrgAJa.exe
  C:\Windows\System\ltrgAJa.exe
  2⤵
  PID:2432
- C:\Windows\System\dHjyxUj.exe
  C:\Windows\System\dHjyxUj.exe
  2⤵
  PID:1528
- C:\Windows\System\BNMkZwA.exe
  C:\Windows\System\BNMkZwA.exe
  2⤵
  PID:2992
- C:\Windows\System\uMTfgnx.exe
  C:\Windows\System\uMTfgnx.exe
  2⤵
  PID:2652
- C:\Windows\System\qCNXErE.exe
  C:\Windows\System\qCNXErE.exe
  2⤵
  PID:2736
- C:\Windows\System\JNYPHWe.exe
  C:\Windows\System\JNYPHWe.exe
  2⤵
  PID:2792
- C:\Windows\System\fDBctDv.exe
  C:\Windows\System\fDBctDv.exe
  2⤵
  PID:1540
- C:\Windows\System\yBTCZuy.exe
  C:\Windows\System\yBTCZuy.exe
  2⤵
  PID:1844
- C:\Windows\System\iYBAnMu.exe
  C:\Windows\System\iYBAnMu.exe
  2⤵
  PID:1464
- C:\Windows\System\OnpXhti.exe
  C:\Windows\System\OnpXhti.exe
  2⤵
  PID:2816
- C:\Windows\System\CmVOiFc.exe
  C:\Windows\System\CmVOiFc.exe
  2⤵
  PID:2848
- C:\Windows\System\YPhAqax.exe
  C:\Windows\System\YPhAqax.exe
  2⤵
  PID:1744
- C:\Windows\System\BnfgeaO.exe
  C:\Windows\System\BnfgeaO.exe
  2⤵
  PID:2988
- C:\Windows\System\LHwwKCh.exe
  C:\Windows\System\LHwwKCh.exe
  2⤵
  PID:564
- C:\Windows\System\TaXqGWr.exe
  C:\Windows\System\TaXqGWr.exe
  2⤵
  PID:1156
- C:\Windows\System\KxpyRNe.exe
  C:\Windows\System\KxpyRNe.exe
  2⤵
  PID:352
- C:\Windows\System\uYnOTvS.exe
  C:\Windows\System\uYnOTvS.exe
  2⤵
  PID:2560
- C:\Windows\System\wRvjUZp.exe
  C:\Windows\System\wRvjUZp.exe
  2⤵
  PID:1932
- C:\Windows\System\rMeHzcX.exe
  C:\Windows\System\rMeHzcX.exe
  2⤵
  PID:2852
- C:\Windows\System\LbCkTGm.exe
  C:\Windows\System\LbCkTGm.exe
  2⤵
  PID:1524
- C:\Windows\System\JfIFJZq.exe
  C:\Windows\System\JfIFJZq.exe
  2⤵
  PID:2776
- C:\Windows\System\WfmtMeI.exe
  C:\Windows\System\WfmtMeI.exe
  2⤵
  PID:2336
- C:\Windows\System\nFmJKff.exe
  C:\Windows\System\nFmJKff.exe
  2⤵
  PID:2160
- C:\Windows\System\TEXyoHE.exe
  C:\Windows\System\TEXyoHE.exe
  2⤵
  PID:2164
- C:\Windows\System\JdyrJeG.exe
  C:\Windows\System\JdyrJeG.exe
  2⤵
  PID:2516
- C:\Windows\System\ZFSxidw.exe
  C:\Windows\System\ZFSxidw.exe
  2⤵
  PID:2720
- C:\Windows\System\NahDiff.exe
  C:\Windows\System\NahDiff.exe
  2⤵
  PID:1596
- C:\Windows\System\ceGVYMg.exe
  C:\Windows\System\ceGVYMg.exe
  2⤵
  PID:2580
- C:\Windows\System\zjYtrAD.exe
  C:\Windows\System\zjYtrAD.exe
  2⤵
  PID:1068
- C:\Windows\System\WyPPoOQ.exe
  C:\Windows\System\WyPPoOQ.exe
  2⤵
  PID:3036
- C:\Windows\System\mTLcMrg.exe
  C:\Windows\System\mTLcMrg.exe
  2⤵
  PID:2688
- C:\Windows\System\YWJkLEj.exe
  C:\Windows\System\YWJkLEj.exe
  2⤵
  PID:2404
- C:\Windows\System\tDLnozW.exe
  C:\Windows\System\tDLnozW.exe
  2⤵
  PID:1924
- C:\Windows\System\bCKGbRC.exe
  C:\Windows\System\bCKGbRC.exe
  2⤵
  PID:816
- C:\Windows\System\wfCTunM.exe
  C:\Windows\System\wfCTunM.exe
  2⤵
  PID:2872
- C:\Windows\System\pjJsCat.exe
  C:\Windows\System\pjJsCat.exe
  2⤵
  PID:2628
- C:\Windows\System\TyJKVwP.exe
  C:\Windows\System\TyJKVwP.exe
  2⤵
  PID:2428
- C:\Windows\System\xfHaPca.exe
  C:\Windows\System\xfHaPca.exe
  2⤵
  PID:2444
- C:\Windows\System\aQnigqb.exe
  C:\Windows\System\aQnigqb.exe
  2⤵
  PID:1968
- C:\Windows\System\YJepunf.exe
  C:\Windows\System\YJepunf.exe
  2⤵
  PID:1476
- C:\Windows\System\RxxrqxD.exe
  C:\Windows\System\RxxrqxD.exe
  2⤵
  PID:2332
- C:\Windows\System\ZKidbFr.exe
  C:\Windows\System\ZKidbFr.exe
  2⤵
  PID:800
- C:\Windows\System\AkSRzte.exe
  C:\Windows\System\AkSRzte.exe
  2⤵
  PID:1964
- C:\Windows\System\ZpsfKDP.exe
  C:\Windows\System\ZpsfKDP.exe
  2⤵
  PID:1676
- C:\Windows\System\MkRpvHS.exe
  C:\Windows\System\MkRpvHS.exe
  2⤵
  PID:3080
- C:\Windows\System\HSxewrq.exe
  C:\Windows\System\HSxewrq.exe
  2⤵
  PID:3096
- C:\Windows\System\VcOrIqY.exe
  C:\Windows\System\VcOrIqY.exe
  2⤵
  PID:3112
- C:\Windows\System\XiENaRJ.exe
  C:\Windows\System\XiENaRJ.exe
  2⤵
  PID:3128
- C:\Windows\System\tPtLhxu.exe
  C:\Windows\System\tPtLhxu.exe
  2⤵
  PID:3144
- C:\Windows\System\wSwWcDE.exe
  C:\Windows\System\wSwWcDE.exe
  2⤵
  PID:3160
- C:\Windows\System\WvyDHfO.exe
  C:\Windows\System\WvyDHfO.exe
  2⤵
  PID:3176
- C:\Windows\System\nMJfDJk.exe
  C:\Windows\System\nMJfDJk.exe
  2⤵
  PID:3196
- C:\Windows\System\LDbIeCL.exe
  C:\Windows\System\LDbIeCL.exe
  2⤵
  PID:3212
- C:\Windows\System\VSxMbMq.exe
  C:\Windows\System\VSxMbMq.exe
  2⤵
  PID:3228
- C:\Windows\System\MoybUvP.exe
  C:\Windows\System\MoybUvP.exe
  2⤵
  PID:3244
- C:\Windows\System\RAqnsXP.exe
  C:\Windows\System\RAqnsXP.exe
  2⤵
  PID:3260
- C:\Windows\System\NjfkKvp.exe
  C:\Windows\System\NjfkKvp.exe
  2⤵
  PID:3276
- C:\Windows\System\SOKJwmf.exe
  C:\Windows\System\SOKJwmf.exe
  2⤵
  PID:3292
- C:\Windows\System\QsRGxyV.exe
  C:\Windows\System\QsRGxyV.exe
  2⤵
  PID:3312
- C:\Windows\System\WTpduLZ.exe
  C:\Windows\System\WTpduLZ.exe
  2⤵
  PID:3328
- C:\Windows\System\zzixtvV.exe
  C:\Windows\System\zzixtvV.exe
  2⤵
  PID:3344
- C:\Windows\System\nfnvwgl.exe
  C:\Windows\System\nfnvwgl.exe
  2⤵
  PID:3360
- C:\Windows\System\hhjTMaF.exe
  C:\Windows\System\hhjTMaF.exe
  2⤵
  PID:3376
- C:\Windows\System\aUmniPk.exe
  C:\Windows\System\aUmniPk.exe
  2⤵
  PID:3392
- C:\Windows\System\vkAayPu.exe
  C:\Windows\System\vkAayPu.exe
  2⤵
  PID:3408
- C:\Windows\System\lRVQwjY.exe
  C:\Windows\System\lRVQwjY.exe
  2⤵
  PID:3424
- C:\Windows\System\uiGiJxR.exe
  C:\Windows\System\uiGiJxR.exe
  2⤵
  PID:3444
- C:\Windows\System\jdleDWr.exe
  C:\Windows\System\jdleDWr.exe
  2⤵
  PID:3460
- C:\Windows\System\zrINhKS.exe
  C:\Windows\System\zrINhKS.exe
  2⤵
  PID:3476
- C:\Windows\System\ozFIvSZ.exe
  C:\Windows\System\ozFIvSZ.exe
  2⤵
  PID:3640
- C:\Windows\System\rIYyurB.exe
  C:\Windows\System\rIYyurB.exe
  2⤵
  PID:3656
- C:\Windows\System\pWOnaDy.exe
  C:\Windows\System\pWOnaDy.exe
  2⤵
  PID:3672
- C:\Windows\System\SBkcRYi.exe
  C:\Windows\System\SBkcRYi.exe
  2⤵
  PID:3688
- C:\Windows\System\NjUTgmK.exe
  C:\Windows\System\NjUTgmK.exe
  2⤵
  PID:3704
- C:\Windows\System\INTqXfM.exe
  C:\Windows\System\INTqXfM.exe
  2⤵
  PID:3720
- C:\Windows\System\GaJVayM.exe
  C:\Windows\System\GaJVayM.exe
  2⤵
  PID:3736
- C:\Windows\System\rFTsIZf.exe
  C:\Windows\System\rFTsIZf.exe
  2⤵
  PID:3752
- C:\Windows\System\VWTWZGk.exe
  C:\Windows\System\VWTWZGk.exe
  2⤵
  PID:3768
- C:\Windows\System\dkydVuz.exe
  C:\Windows\System\dkydVuz.exe
  2⤵
  PID:3788
- C:\Windows\System\nNpcItc.exe
  C:\Windows\System\nNpcItc.exe
  2⤵
  PID:3804
- C:\Windows\System\rWWiAOp.exe
  C:\Windows\System\rWWiAOp.exe
  2⤵
  PID:3820
- C:\Windows\System\xBGiOFw.exe
  C:\Windows\System\xBGiOFw.exe
  2⤵
  PID:3836
- C:\Windows\System\BRxjlUN.exe
  C:\Windows\System\BRxjlUN.exe
  2⤵
  PID:3852
- C:\Windows\System\EVTaPPo.exe
  C:\Windows\System\EVTaPPo.exe
  2⤵
  PID:3868
- C:\Windows\System\iHrUmlw.exe
  C:\Windows\System\iHrUmlw.exe
  2⤵
  PID:3888
- C:\Windows\System\QxRdAxl.exe
  C:\Windows\System\QxRdAxl.exe
  2⤵
  PID:3904
- C:\Windows\System\hgqIeEj.exe
  C:\Windows\System\hgqIeEj.exe
  2⤵
  PID:3920
- C:\Windows\System\jLAGFoX.exe
  C:\Windows\System\jLAGFoX.exe
  2⤵
  PID:3944
- C:\Windows\System\KCkBPMp.exe
  C:\Windows\System\KCkBPMp.exe
  2⤵
  PID:3960
- C:\Windows\System\MzhYCdN.exe
  C:\Windows\System\MzhYCdN.exe
  2⤵
  PID:3980
- C:\Windows\System\jfLUYOH.exe
  C:\Windows\System\jfLUYOH.exe
  2⤵
  PID:3996
- C:\Windows\System\KPOCOoX.exe
  C:\Windows\System\KPOCOoX.exe
  2⤵
  PID:4012
- C:\Windows\System\GclvWNl.exe
  C:\Windows\System\GclvWNl.exe
  2⤵
  PID:4028
- C:\Windows\System\FAnYgYE.exe
  C:\Windows\System\FAnYgYE.exe
  2⤵
  PID:4044
- C:\Windows\System\FSynRzB.exe
  C:\Windows\System\FSynRzB.exe
  2⤵
  PID:4060
- C:\Windows\System\eeYfzFC.exe
  C:\Windows\System\eeYfzFC.exe
  2⤵
  PID:4076
- C:\Windows\System\qbPWPvh.exe
  C:\Windows\System\qbPWPvh.exe
  2⤵
  PID:2644
- C:\Windows\System\RjZcRfJ.exe
  C:\Windows\System\RjZcRfJ.exe
  2⤵
  PID:3124
- C:\Windows\System\SGXQDHJ.exe
  C:\Windows\System\SGXQDHJ.exe
  2⤵
  PID:628
- C:\Windows\System\oPjWMws.exe
  C:\Windows\System\oPjWMws.exe
  2⤵
  PID:2984
- C:\Windows\System\bKinxHE.exe
  C:\Windows\System\bKinxHE.exe
  2⤵
  PID:3256
- C:\Windows\System\nAWKzRj.exe
  C:\Windows\System\nAWKzRj.exe
  2⤵
  PID:3288
- C:\Windows\System\fEGsUZm.exe
  C:\Windows\System\fEGsUZm.exe
  2⤵
  PID:3324
- C:\Windows\System\pQIIlWn.exe
  C:\Windows\System\pQIIlWn.exe
  2⤵
  PID:3456
- C:\Windows\System\jUsKmwv.exe
  C:\Windows\System\jUsKmwv.exe
  2⤵
  PID:3496
- C:\Windows\System\nqDyybL.exe
  C:\Windows\System\nqDyybL.exe
  2⤵
  PID:2168
- C:\Windows\System\VWZVATg.exe
  C:\Windows\System\VWZVATg.exe
  2⤵
  PID:3024
- C:\Windows\System\SVKJjwF.exe
  C:\Windows\System\SVKJjwF.exe
  2⤵
  PID:3512
- C:\Windows\System\TghPWMj.exe
  C:\Windows\System\TghPWMj.exe
  2⤵
  PID:3156
- C:\Windows\System\Zqnmktl.exe
  C:\Windows\System\Zqnmktl.exe
  2⤵
  PID:3528
- C:\Windows\System\XDrgNQo.exe
  C:\Windows\System\XDrgNQo.exe
  2⤵
  PID:3544
- C:\Windows\System\jLJSFCy.exe
  C:\Windows\System\jLJSFCy.exe
  2⤵
  PID:3564
- C:\Windows\System\dJbgnaA.exe
  C:\Windows\System\dJbgnaA.exe
  2⤵
  PID:3388
- C:\Windows\System\DIIohXp.exe
  C:\Windows\System\DIIohXp.exe
  2⤵
  PID:3420
- C:\Windows\System\keoRTFV.exe
  C:\Windows\System\keoRTFV.exe
  2⤵
  PID:3592
- C:\Windows\System\mYikNmn.exe
  C:\Windows\System\mYikNmn.exe
  2⤵
  PID:3172
- C:\Windows\System\rWrbkqj.exe
  C:\Windows\System\rWrbkqj.exe
  2⤵
  PID:3208
- C:\Windows\System\qkZsKoN.exe
  C:\Windows\System\qkZsKoN.exe
  2⤵
  PID:3304
- C:\Windows\System\fyKtmng.exe
  C:\Windows\System\fyKtmng.exe
  2⤵
  PID:3368
- C:\Windows\System\xUWivve.exe
  C:\Windows\System\xUWivve.exe
  2⤵
  PID:2216
- C:\Windows\System\XLROOdB.exe
  C:\Windows\System\XLROOdB.exe
  2⤵
  PID:1196
- C:\Windows\System\isYWBIj.exe
  C:\Windows\System\isYWBIj.exe
  2⤵
  PID:3240
- C:\Windows\System\hxgviiY.exe
  C:\Windows\System\hxgviiY.exe
  2⤵
  PID:3336
- C:\Windows\System\QxgHwZH.exe
  C:\Windows\System\QxgHwZH.exe
  2⤵
  PID:3004
- C:\Windows\System\DqBdqrP.exe
  C:\Windows\System\DqBdqrP.exe
  2⤵
  PID:2672
- C:\Windows\System\vLaxihK.exe
  C:\Windows\System\vLaxihK.exe
  2⤵
  PID:2804
- C:\Windows\System\IRcumoJ.exe
  C:\Windows\System\IRcumoJ.exe
  2⤵
  PID:1668
- C:\Windows\System\rXvJulp.exe
  C:\Windows\System\rXvJulp.exe
  2⤵
  PID:2784
- C:\Windows\System\MsHTWUh.exe
  C:\Windows\System\MsHTWUh.exe
  2⤵
  PID:3136
- C:\Windows\System\UjXJZRE.exe
  C:\Windows\System\UjXJZRE.exe
  2⤵
  PID:3432
- C:\Windows\System\UzWYkQP.exe
  C:\Windows\System\UzWYkQP.exe
  2⤵
  PID:3472
- C:\Windows\System\owrgsAI.exe
  C:\Windows\System\owrgsAI.exe
  2⤵
  PID:3796
- C:\Windows\System\yjeitZY.exe
  C:\Windows\System\yjeitZY.exe
  2⤵
  PID:3696
- C:\Windows\System\xoVdrzc.exe
  C:\Windows\System\xoVdrzc.exe
  2⤵
  PID:3936
- C:\Windows\System\CiHLFqi.exe
  C:\Windows\System\CiHLFqi.exe
  2⤵
  PID:4108
- C:\Windows\System\zbvsfVu.exe
  C:\Windows\System\zbvsfVu.exe
  2⤵
  PID:4124
- C:\Windows\System\bvnKXSj.exe
  C:\Windows\System\bvnKXSj.exe
  2⤵
  PID:4140
- C:\Windows\System\IQzFodx.exe
  C:\Windows\System\IQzFodx.exe
  2⤵
  PID:4156
- C:\Windows\System\fWsTXyl.exe
  C:\Windows\System\fWsTXyl.exe
  2⤵
  PID:4172
- C:\Windows\System\zvukcFJ.exe
  C:\Windows\System\zvukcFJ.exe
  2⤵
  PID:4188
- C:\Windows\System\nOaAZdY.exe
  C:\Windows\System\nOaAZdY.exe
  2⤵
  PID:4204
- C:\Windows\System\ojRtLDQ.exe
  C:\Windows\System\ojRtLDQ.exe
  2⤵
  PID:4224
- C:\Windows\System\uEdTTOu.exe
  C:\Windows\System\uEdTTOu.exe
  2⤵
  PID:4240
- C:\Windows\System\qpDJSig.exe
  C:\Windows\System\qpDJSig.exe
  2⤵
  PID:4256
- C:\Windows\System\LJDEbNe.exe
  C:\Windows\System\LJDEbNe.exe
  2⤵
  PID:4292
- C:\Windows\System\GBKHBEu.exe
  C:\Windows\System\GBKHBEu.exe
  2⤵
  PID:4308
- C:\Windows\System\BpeXRcA.exe
  C:\Windows\System\BpeXRcA.exe
  2⤵
  PID:4324
- C:\Windows\System\VkZKAUg.exe
  C:\Windows\System\VkZKAUg.exe
  2⤵
  PID:4340
- C:\Windows\System\NRgbLuX.exe
  C:\Windows\System\NRgbLuX.exe
  2⤵
  PID:4356
- C:\Windows\System\gjWdGpO.exe
  C:\Windows\System\gjWdGpO.exe
  2⤵
  PID:4372
- C:\Windows\System\WFbiDXa.exe
  C:\Windows\System\WFbiDXa.exe
  2⤵
  PID:4400
- C:\Windows\System\jJsLmfO.exe
  C:\Windows\System\jJsLmfO.exe
  2⤵
  PID:4416
- C:\Windows\System\qwamjiW.exe
  C:\Windows\System\qwamjiW.exe
  2⤵
  PID:4432
- C:\Windows\System\sdByEpd.exe
  C:\Windows\System\sdByEpd.exe
  2⤵
  PID:4448
- C:\Windows\System\DQQepKo.exe
  C:\Windows\System\DQQepKo.exe
  2⤵
  PID:4464
- C:\Windows\System\wpvwNTJ.exe
  C:\Windows\System\wpvwNTJ.exe
  2⤵
  PID:4480
- C:\Windows\System\rZApxUU.exe
  C:\Windows\System\rZApxUU.exe
  2⤵
  PID:4496
- C:\Windows\System\Othotvk.exe
  C:\Windows\System\Othotvk.exe
  2⤵
  PID:4512
- C:\Windows\System\nTdkQHV.exe
  C:\Windows\System\nTdkQHV.exe
  2⤵
  PID:4528
- C:\Windows\System\FseRevy.exe
  C:\Windows\System\FseRevy.exe
  2⤵
  PID:4548
- C:\Windows\System\fjgUrZT.exe
  C:\Windows\System\fjgUrZT.exe
  2⤵
  PID:4564
- C:\Windows\System\aogwIVC.exe
  C:\Windows\System\aogwIVC.exe
  2⤵
  PID:4580
- C:\Windows\System\hwTcfMT.exe
  C:\Windows\System\hwTcfMT.exe
  2⤵
  PID:4596
- C:\Windows\System\TUVHYay.exe
  C:\Windows\System\TUVHYay.exe
  2⤵
  PID:4612
- C:\Windows\System\YmZlJkE.exe
  C:\Windows\System\YmZlJkE.exe
  2⤵
  PID:4628
- C:\Windows\System\ztPzWSR.exe
  C:\Windows\System\ztPzWSR.exe
  2⤵
  PID:4644
- C:\Windows\System\MsygaUM.exe
  C:\Windows\System\MsygaUM.exe
  2⤵
  PID:4660
- C:\Windows\System\XaxuQzv.exe
  C:\Windows\System\XaxuQzv.exe
  2⤵
  PID:4680
- C:\Windows\System\VlQsASW.exe
  C:\Windows\System\VlQsASW.exe
  2⤵
  PID:4696
- C:\Windows\System\aMphngd.exe
  C:\Windows\System\aMphngd.exe
  2⤵
  PID:4712
- C:\Windows\System\XroewXn.exe
  C:\Windows\System\XroewXn.exe
  2⤵
  PID:4728
- C:\Windows\System\rOtBWpd.exe
  C:\Windows\System\rOtBWpd.exe
  2⤵
  PID:4744
- C:\Windows\System\zCOmZHx.exe
  C:\Windows\System\zCOmZHx.exe
  2⤵
  PID:4760
- C:\Windows\System\GFZLtxx.exe
  C:\Windows\System\GFZLtxx.exe
  2⤵
  PID:4776
- C:\Windows\System\oTlqDBS.exe
  C:\Windows\System\oTlqDBS.exe
  2⤵
  PID:4792
- C:\Windows\System\ZSxkTrA.exe
  C:\Windows\System\ZSxkTrA.exe
  2⤵
  PID:4808
- C:\Windows\System\Blefzjc.exe
  C:\Windows\System\Blefzjc.exe
  2⤵
  PID:4824
- C:\Windows\System\eMklvhL.exe
  C:\Windows\System\eMklvhL.exe
  2⤵
  PID:4844
- C:\Windows\System\REcHpJc.exe
  C:\Windows\System\REcHpJc.exe
  2⤵
  PID:4860
- C:\Windows\System\QWnoxKV.exe
  C:\Windows\System\QWnoxKV.exe
  2⤵
  PID:4876
- C:\Windows\System\JciSwgM.exe
  C:\Windows\System\JciSwgM.exe
  2⤵
  PID:4892
- C:\Windows\System\AVoIkhx.exe
  C:\Windows\System\AVoIkhx.exe
  2⤵
  PID:4916
- C:\Windows\System\yVLKmzw.exe
  C:\Windows\System\yVLKmzw.exe
  2⤵
  PID:4932
- C:\Windows\System\uUepWkK.exe
  C:\Windows\System\uUepWkK.exe
  2⤵
  PID:4948
- C:\Windows\System\icUqoyI.exe
  C:\Windows\System\icUqoyI.exe
  2⤵
  PID:4964
- C:\Windows\System\FOlAXFK.exe
  C:\Windows\System\FOlAXFK.exe
  2⤵
  PID:4980
- C:\Windows\System\AFqtvLr.exe
  C:\Windows\System\AFqtvLr.exe
  2⤵
  PID:4996
- C:\Windows\System\CHrGYxZ.exe
  C:\Windows\System\CHrGYxZ.exe
  2⤵
  PID:5012
- C:\Windows\System\RxkFzAS.exe
  C:\Windows\System\RxkFzAS.exe
  2⤵
  PID:5028
- C:\Windows\System\VuwQUHn.exe
  C:\Windows\System\VuwQUHn.exe
  2⤵
  PID:5044
- C:\Windows\System\yeugGQc.exe
  C:\Windows\System\yeugGQc.exe
  2⤵
  PID:5064
- C:\Windows\System\VBSPNoD.exe
  C:\Windows\System\VBSPNoD.exe
  2⤵
  PID:5080
- C:\Windows\System\pwmGboj.exe
  C:\Windows\System\pwmGboj.exe
  2⤵
  PID:5096
- C:\Windows\System\fHewDCm.exe
  C:\Windows\System\fHewDCm.exe
  2⤵
  PID:5112
- C:\Windows\System\EmBaCwR.exe
  C:\Windows\System\EmBaCwR.exe
  2⤵
  PID:4068
- C:\Windows\System\IoycfRr.exe
  C:\Windows\System\IoycfRr.exe
  2⤵
  PID:680
- C:\Windows\System\WqmMkqr.exe
  C:\Windows\System\WqmMkqr.exe
  2⤵
  PID:2284
- C:\Windows\System\EIDWCdY.exe
  C:\Windows\System\EIDWCdY.exe
  2⤵
  PID:3088
- C:\Windows\System\dZsimkm.exe
  C:\Windows\System\dZsimkm.exe
  2⤵
  PID:3648
- C:\Windows\System\WyDYgom.exe
  C:\Windows\System\WyDYgom.exe
  2⤵
  PID:3832
- C:\Windows\System\bSTLMAQ.exe
  C:\Windows\System\bSTLMAQ.exe
  2⤵
  PID:3596
- C:\Windows\System\yKfluUD.exe
  C:\Windows\System\yKfluUD.exe
  2⤵
  PID:3616
- C:\Windows\System\szMjXKO.exe
  C:\Windows\System\szMjXKO.exe
  2⤵
  PID:3400
- C:\Windows\System\YJHBofd.exe
  C:\Windows\System\YJHBofd.exe
  2⤵
  PID:3928
- C:\Windows\System\ACbwyKC.exe
  C:\Windows\System\ACbwyKC.exe
  2⤵
  PID:4212
- C:\Windows\System\uEKMJto.exe
  C:\Windows\System\uEKMJto.exe
  2⤵
  PID:3972
- C:\Windows\System\TIZGCZo.exe
  C:\Windows\System\TIZGCZo.exe
  2⤵
  PID:4004
- C:\Windows\System\XRwSUYA.exe
  C:\Windows\System\XRwSUYA.exe
  2⤵
  PID:2864
- C:\Windows\System\zZsdEre.exe
  C:\Windows\System\zZsdEre.exe
  2⤵
  PID:3372
- C:\Windows\System\PHqGeia.exe
  C:\Windows\System\PHqGeia.exe
  2⤵
  PID:3668
- C:\Windows\System\uxiIeuA.exe
  C:\Windows\System\uxiIeuA.exe
  2⤵
  PID:4116
- C:\Windows\System\xEHVXAf.exe
  C:\Windows\System\xEHVXAf.exe
  2⤵
  PID:4168
- C:\Windows\System\GDoaLsW.exe
  C:\Windows\System\GDoaLsW.exe
  2⤵
  PID:3744
- C:\Windows\System\NYyNVbJ.exe
  C:\Windows\System\NYyNVbJ.exe
  2⤵
  PID:3812
- C:\Windows\System\HCUZWWP.exe
  C:\Windows\System\HCUZWWP.exe
  2⤵
  PID:3876
- C:\Windows\System\aajUiOu.exe
  C:\Windows\System\aajUiOu.exe
  2⤵
  PID:3916
- C:\Windows\System\eEZNMOu.exe
  C:\Windows\System\eEZNMOu.exe
  2⤵
  PID:4020
- C:\Windows\System\TQpKzsf.exe
  C:\Windows\System\TQpKzsf.exe
  2⤵
  PID:4084
- C:\Windows\System\sbTLyXd.exe
  C:\Windows\System\sbTLyXd.exe
  2⤵
  PID:3220
- C:\Windows\System\WUQlOYC.exe
  C:\Windows\System\WUQlOYC.exe
  2⤵
  PID:3320
- C:\Windows\System\eVtQEjb.exe
  C:\Windows\System\eVtQEjb.exe
  2⤵
  PID:2124
- C:\Windows\System\FOPddAK.exe
  C:\Windows\System\FOPddAK.exe
  2⤵
  PID:3540
- C:\Windows\System\RBZLwhX.exe
  C:\Windows\System\RBZLwhX.exe
  2⤵
  PID:3588
- C:\Windows\System\GOfUBHy.exe
  C:\Windows\System\GOfUBHy.exe
  2⤵
  PID:3624
- C:\Windows\System\MktQBLw.exe
  C:\Windows\System\MktQBLw.exe
  2⤵
  PID:2812
- C:\Windows\System\jevBGSC.exe
  C:\Windows\System\jevBGSC.exe
  2⤵
  PID:1948
- C:\Windows\System\SxJUEeK.exe
  C:\Windows\System\SxJUEeK.exe
  2⤵
  PID:3468
- C:\Windows\System\JrMCRaT.exe
  C:\Windows\System\JrMCRaT.exe
  2⤵
  PID:4136
- C:\Windows\System\PAzHYxm.exe
  C:\Windows\System\PAzHYxm.exe
  2⤵
  PID:4232
- C:\Windows\System\dMrtGhH.exe
  C:\Windows\System\dMrtGhH.exe
  2⤵
  PID:4276
- C:\Windows\System\JWTKJNJ.exe
  C:\Windows\System\JWTKJNJ.exe
  2⤵
  PID:4316
- C:\Windows\System\LzEpeRk.exe
  C:\Windows\System\LzEpeRk.exe
  2⤵
  PID:4336
- C:\Windows\System\zXIbwvs.exe
  C:\Windows\System\zXIbwvs.exe
  2⤵
  PID:4380
- C:\Windows\System\YnzGKFm.exe
  C:\Windows\System\YnzGKFm.exe
  2⤵
  PID:4396
- C:\Windows\System\bDRnrQy.exe
  C:\Windows\System\bDRnrQy.exe
  2⤵
  PID:4412
- C:\Windows\System\AAInuhh.exe
  C:\Windows\System\AAInuhh.exe
  2⤵
  PID:4476
- C:\Windows\System\VkLMPXL.exe
  C:\Windows\System\VkLMPXL.exe
  2⤵
  PID:4544
- C:\Windows\System\sHQIddl.exe
  C:\Windows\System\sHQIddl.exe
  2⤵
  PID:4608
- C:\Windows\System\FwDrzJf.exe
  C:\Windows\System\FwDrzJf.exe
  2⤵
  PID:4704
- C:\Windows\System\YtnBZyK.exe
  C:\Windows\System\YtnBZyK.exe
  2⤵
  PID:4524
- C:\Windows\System\NJBpAWE.exe
  C:\Windows\System\NJBpAWE.exe
  2⤵
  PID:4488
- C:\Windows\System\ZQFfSbN.exe
  C:\Windows\System\ZQFfSbN.exe
  2⤵
  PID:4560
- C:\Windows\System\bMzNgFg.exe
  C:\Windows\System\bMzNgFg.exe
  2⤵
  PID:4624
- C:\Windows\System\KgmFnVu.exe
  C:\Windows\System\KgmFnVu.exe
  2⤵
  PID:4692
- C:\Windows\System\oOPlcCp.exe
  C:\Windows\System\oOPlcCp.exe
  2⤵
  PID:4756
- C:\Windows\System\AmZMHzl.exe
  C:\Windows\System\AmZMHzl.exe
  2⤵
  PID:4820
- C:\Windows\System\ohdAkRq.exe
  C:\Windows\System\ohdAkRq.exe
  2⤵
  PID:4884
- C:\Windows\System\WjLDYOa.exe
  C:\Windows\System\WjLDYOa.exe
  2⤵
  PID:4908
- C:\Windows\System\DqnIAqZ.exe
  C:\Windows\System\DqnIAqZ.exe
  2⤵
  PID:4832
- C:\Windows\System\kywFXJY.exe
  C:\Windows\System\kywFXJY.exe
  2⤵
  PID:4944
- C:\Windows\System\gsXWYVq.exe
  C:\Windows\System\gsXWYVq.exe
  2⤵
  PID:5008
- C:\Windows\System\QjyoOpl.exe
  C:\Windows\System\QjyoOpl.exe
  2⤵
  PID:5072
- C:\Windows\System\cmZJDqS.exe
  C:\Windows\System\cmZJDqS.exe
  2⤵
  PID:4924
- C:\Windows\System\tMtfeKZ.exe
  C:\Windows\System\tMtfeKZ.exe
  2⤵
  PID:3500
- C:\Windows\System\wEgULUC.exe
  C:\Windows\System\wEgULUC.exe
  2⤵
  PID:2576
- C:\Windows\System\lvwqwwC.exe
  C:\Windows\System\lvwqwwC.exe
  2⤵
  PID:4072
- C:\Windows\System\ZKNSCTj.exe
  C:\Windows\System\ZKNSCTj.exe
  2⤵
  PID:3700
- C:\Windows\System\pwaITzA.exe
  C:\Windows\System\pwaITzA.exe
  2⤵
  PID:3712
- C:\Windows\System\iFrtAxo.exe
  C:\Windows\System\iFrtAxo.exe
  2⤵
  PID:4960
- C:\Windows\System\MFFqXhN.exe
  C:\Windows\System\MFFqXhN.exe
  2⤵
  PID:5052
- C:\Windows\System\AEtGHIH.exe
  C:\Windows\System\AEtGHIH.exe
  2⤵
  PID:5092
- C:\Windows\System\pvojpJp.exe
  C:\Windows\System\pvojpJp.exe
  2⤵
  PID:1108
- C:\Windows\System\vugvstE.exe
  C:\Windows\System\vugvstE.exe
  2⤵
  PID:2680
- C:\Windows\System\KVehAVI.exe
  C:\Windows\System\KVehAVI.exe
  2⤵
  PID:4252
- C:\Windows\System\jvnlutD.exe
  C:\Windows\System\jvnlutD.exe
  2⤵
  PID:3652
- C:\Windows\System\HBcslaL.exe
  C:\Windows\System\HBcslaL.exe
  2⤵
  PID:3884
- C:\Windows\System\LveAKDo.exe
  C:\Windows\System\LveAKDo.exe
  2⤵
  PID:3604
- C:\Windows\System\gcxItRg.exe
  C:\Windows\System\gcxItRg.exe
  2⤵
  PID:2748
- C:\Windows\System\btaValY.exe
  C:\Windows\System\btaValY.exe
  2⤵
  PID:3620
- C:\Windows\System\lHZbnop.exe
  C:\Windows\System\lHZbnop.exe
  2⤵
  PID:4264
- C:\Windows\System\kiqkmWA.exe
  C:\Windows\System\kiqkmWA.exe
  2⤵
  PID:4388
- C:\Windows\System\JDUcWoQ.exe
  C:\Windows\System\JDUcWoQ.exe
  2⤵
  PID:4392
- C:\Windows\System\KeOXSQl.exe
  C:\Windows\System\KeOXSQl.exe
  2⤵
  PID:3844
- C:\Windows\System\AHTbAfx.exe
  C:\Windows\System\AHTbAfx.exe
  2⤵
  PID:4688
- C:\Windows\System\BXcMGCE.exe
  C:\Windows\System\BXcMGCE.exe
  2⤵
  PID:3992
- C:\Windows\System\sytOUfB.exe
  C:\Windows\System\sytOUfB.exe
  2⤵
  PID:3192
- C:\Windows\System\sQrRfTq.exe
  C:\Windows\System\sQrRfTq.exe
  2⤵
  PID:2100
- C:\Windows\System\wUlFrdT.exe
  C:\Windows\System\wUlFrdT.exe
  2⤵
  PID:3440
- C:\Windows\System\XIOPjcn.exe
  C:\Windows\System\XIOPjcn.exe
  2⤵
  PID:4348
- C:\Windows\System\GXAQKnG.exe
  C:\Windows\System\GXAQKnG.exe
  2⤵
  PID:4508
- C:\Windows\System\mhlWKCN.exe
  C:\Windows\System\mhlWKCN.exe
  2⤵
  PID:4428
- C:\Windows\System\tRCXsSE.exe
  C:\Windows\System\tRCXsSE.exe
  2⤵
  PID:4620
- C:\Windows\System\beVpmCT.exe
  C:\Windows\System\beVpmCT.exe
  2⤵
  PID:4668
- C:\Windows\System\wkWntyt.exe
  C:\Windows\System\wkWntyt.exe
  2⤵
  PID:4856
- C:\Windows\System\eIKauMy.exe
  C:\Windows\System\eIKauMy.exe
  2⤵
  PID:5040
- C:\Windows\System\JBKmNZc.exe
  C:\Windows\System\JBKmNZc.exe
  2⤵
  PID:5004
- C:\Windows\System\SouoSuI.exe
  C:\Windows\System\SouoSuI.exe
  2⤵
  PID:3976
- C:\Windows\System\ZDOOInj.exe
  C:\Windows\System\ZDOOInj.exe
  2⤵
  PID:4992
- C:\Windows\System\svPeBIL.exe
  C:\Windows\System\svPeBIL.exe
  2⤵
  PID:4184
- C:\Windows\System\rhYJxyY.exe
  C:\Windows\System\rhYJxyY.exe
  2⤵
  PID:3252
- C:\Windows\System\otKtgqF.exe
  C:\Windows\System\otKtgqF.exe
  2⤵
  PID:4576
- C:\Windows\System\KfsQsmi.exe
  C:\Windows\System\KfsQsmi.exe
  2⤵
  PID:3988
- C:\Windows\System\IKXOHAM.exe
  C:\Windows\System\IKXOHAM.exe
  2⤵
  PID:4368
- C:\Windows\System\IfZyUda.exe
  C:\Windows\System\IfZyUda.exe
  2⤵
  PID:4868
- C:\Windows\System\BtkGCWZ.exe
  C:\Windows\System\BtkGCWZ.exe
  2⤵
  PID:4036
- C:\Windows\System\Yveocch.exe
  C:\Windows\System\Yveocch.exe
  2⤵
  PID:4520
- C:\Windows\System\JGAEJoc.exe
  C:\Windows\System\JGAEJoc.exe
  2⤵
  PID:5132
- C:\Windows\System\tmmqCdS.exe
  C:\Windows\System\tmmqCdS.exe
  2⤵
  PID:5148
- C:\Windows\System\guArrFr.exe
  C:\Windows\System\guArrFr.exe
  2⤵
  PID:5168
- C:\Windows\System\ZoJXUsL.exe
  C:\Windows\System\ZoJXUsL.exe
  2⤵
  PID:5184
- C:\Windows\System\dRqWKcW.exe
  C:\Windows\System\dRqWKcW.exe
  2⤵
  PID:5200
- C:\Windows\System\INblsrr.exe
  C:\Windows\System\INblsrr.exe
  2⤵
  PID:5216
- C:\Windows\System\hSaFEML.exe
  C:\Windows\System\hSaFEML.exe
  2⤵
  PID:5236
- C:\Windows\System\NfwbLOl.exe
  C:\Windows\System\NfwbLOl.exe
  2⤵
  PID:5252
- C:\Windows\System\wLRAjUm.exe
  C:\Windows\System\wLRAjUm.exe
  2⤵
  PID:5268
- C:\Windows\System\HaqLsUp.exe
  C:\Windows\System\HaqLsUp.exe
  2⤵
  PID:5284
- C:\Windows\System\rIBEJHM.exe
  C:\Windows\System\rIBEJHM.exe
  2⤵
  PID:5300
- C:\Windows\System\soxpqYJ.exe
  C:\Windows\System\soxpqYJ.exe
  2⤵
  PID:5316
- C:\Windows\System\xyEsciA.exe
  C:\Windows\System\xyEsciA.exe
  2⤵
  PID:5332
- C:\Windows\System\mlRAwCC.exe
  C:\Windows\System\mlRAwCC.exe
  2⤵
  PID:5348
- C:\Windows\System\iCbBfyM.exe
  C:\Windows\System\iCbBfyM.exe
  2⤵
  PID:5368
- C:\Windows\System\iVIOtlq.exe
  C:\Windows\System\iVIOtlq.exe
  2⤵
  PID:5384
- C:\Windows\System\FJTkaNd.exe
  C:\Windows\System\FJTkaNd.exe
  2⤵
  PID:5400
- C:\Windows\System\XMnQpRM.exe
  C:\Windows\System\XMnQpRM.exe
  2⤵
  PID:5420
- C:\Windows\System\SiqMEQH.exe
  C:\Windows\System\SiqMEQH.exe
  2⤵
  PID:5436
- C:\Windows\System\tfLoBPr.exe
  C:\Windows\System\tfLoBPr.exe
  2⤵
  PID:5452
- C:\Windows\System\dPwCUZS.exe
  C:\Windows\System\dPwCUZS.exe
  2⤵
  PID:5468
- C:\Windows\System\SlAmYOP.exe
  C:\Windows\System\SlAmYOP.exe
  2⤵
  PID:5484
- C:\Windows\System\lEnXqTy.exe
  C:\Windows\System\lEnXqTy.exe
  2⤵
  PID:5500
- C:\Windows\System\SQBtuFB.exe
  C:\Windows\System\SQBtuFB.exe
  2⤵
  PID:5516
- C:\Windows\System\xKNFyNF.exe
  C:\Windows\System\xKNFyNF.exe
  2⤵
  PID:5532
- C:\Windows\System\ICzDVWf.exe
  C:\Windows\System\ICzDVWf.exe
  2⤵
  PID:5548
- C:\Windows\System\lezfiHc.exe
  C:\Windows\System\lezfiHc.exe
  2⤵
  PID:5568
- C:\Windows\System\XnNzxZO.exe
  C:\Windows\System\XnNzxZO.exe
  2⤵
  PID:5584
- C:\Windows\System\DZThGDY.exe
  C:\Windows\System\DZThGDY.exe
  2⤵
  PID:5600
- C:\Windows\System\HBEcohC.exe
  C:\Windows\System\HBEcohC.exe
  2⤵
  PID:5616
- C:\Windows\System\RPKDgld.exe
  C:\Windows\System\RPKDgld.exe
  2⤵
  PID:5632
- C:\Windows\System\lLHubGl.exe
  C:\Windows\System\lLHubGl.exe
  2⤵
  PID:5648
- C:\Windows\System\CcMeCZh.exe
  C:\Windows\System\CcMeCZh.exe
  2⤵
  PID:5668
- C:\Windows\System\NOBAWMO.exe
  C:\Windows\System\NOBAWMO.exe
  2⤵
  PID:5684
- C:\Windows\System\flbNdyO.exe
  C:\Windows\System\flbNdyO.exe
  2⤵
  PID:5700
- C:\Windows\System\hcHxXhd.exe
  C:\Windows\System\hcHxXhd.exe
  2⤵
  PID:5716
- C:\Windows\System\jPdtiIY.exe
  C:\Windows\System\jPdtiIY.exe
  2⤵
  PID:5732
- C:\Windows\System\JqHKUlS.exe
  C:\Windows\System\JqHKUlS.exe
  2⤵
  PID:5748
- C:\Windows\System\YoTAJff.exe
  C:\Windows\System\YoTAJff.exe
  2⤵
  PID:5768
- C:\Windows\System\AIaCjgO.exe
  C:\Windows\System\AIaCjgO.exe
  2⤵
  PID:5784
- C:\Windows\System\ZIMcKQy.exe
  C:\Windows\System\ZIMcKQy.exe
  2⤵
  PID:5824
- C:\Windows\System\ojdbEou.exe
  C:\Windows\System\ojdbEou.exe
  2⤵
  PID:5840
- C:\Windows\System\WxddGiY.exe
  C:\Windows\System\WxddGiY.exe
  2⤵
  PID:5856
- C:\Windows\System\sscMapp.exe
  C:\Windows\System\sscMapp.exe
  2⤵
  PID:5872
- C:\Windows\System\IkdhjDS.exe
  C:\Windows\System\IkdhjDS.exe
  2⤵
  PID:5888
- C:\Windows\System\FDqFsFv.exe
  C:\Windows\System\FDqFsFv.exe
  2⤵
  PID:5908
- C:\Windows\System\XUBfhlB.exe
  C:\Windows\System\XUBfhlB.exe
  2⤵
  PID:5924
- C:\Windows\System\LaglOVL.exe
  C:\Windows\System\LaglOVL.exe
  2⤵
  PID:5940
- C:\Windows\System\ZKhJLgK.exe
  C:\Windows\System\ZKhJLgK.exe
  2⤵
  PID:5956
- C:\Windows\System\IiMXejA.exe
  C:\Windows\System\IiMXejA.exe
  2⤵
  PID:5972
- C:\Windows\System\ITSfKeB.exe
  C:\Windows\System\ITSfKeB.exe
  2⤵
  PID:5988
- C:\Windows\System\ttZshGb.exe
  C:\Windows\System\ttZshGb.exe
  2⤵
  PID:6004
- C:\Windows\System\AeRhEpX.exe
  C:\Windows\System\AeRhEpX.exe
  2⤵
  PID:6020
- C:\Windows\System\boFTsUe.exe
  C:\Windows\System\boFTsUe.exe
  2⤵
  PID:6040
- C:\Windows\System\UEsEWzH.exe
  C:\Windows\System\UEsEWzH.exe
  2⤵
  PID:6056
- C:\Windows\System\BEoBWxk.exe
  C:\Windows\System\BEoBWxk.exe
  2⤵
  PID:6072
- C:\Windows\System\sCdqOjV.exe
  C:\Windows\System\sCdqOjV.exe
  2⤵
  PID:6088
- C:\Windows\System\rycTlpV.exe
  C:\Windows\System\rycTlpV.exe
  2⤵
  PID:6104
- C:\Windows\System\MgmpEqV.exe
  C:\Windows\System\MgmpEqV.exe
  2⤵
  PID:6120
- C:\Windows\System\zrBrxRg.exe
  C:\Windows\System\zrBrxRg.exe
  2⤵
  PID:6136
- C:\Windows\System\qLKgery.exe
  C:\Windows\System\qLKgery.exe
  2⤵
  PID:3784
- C:\Windows\System\tpmnvSF.exe
  C:\Windows\System\tpmnvSF.exe
  2⤵
  PID:5180
- C:\Windows\System\RpiJxCT.exe
  C:\Windows\System\RpiJxCT.exe
  2⤵
  PID:5244
- C:\Windows\System\vLaXdEA.exe
  C:\Windows\System\vLaXdEA.exe
  2⤵
  PID:5312
- C:\Windows\System\uCWMnTz.exe
  C:\Windows\System\uCWMnTz.exe
  2⤵
  PID:5344
- C:\Windows\System\SfeHYnM.exe
  C:\Windows\System\SfeHYnM.exe
  2⤵
  PID:5444
- C:\Windows\System\ftmYmEv.exe
  C:\Windows\System\ftmYmEv.exe
  2⤵
  PID:5508
- C:\Windows\System\EAxdPyP.exe
  C:\Windows\System\EAxdPyP.exe
  2⤵
  PID:5576
- C:\Windows\System\WdrNEiR.exe
  C:\Windows\System\WdrNEiR.exe
  2⤵
  PID:5644
- C:\Windows\System\dxIiYKA.exe
  C:\Windows\System\dxIiYKA.exe
  2⤵
  PID:5712
- C:\Windows\System\BpyezzJ.exe
  C:\Windows\System\BpyezzJ.exe
  2⤵
  PID:4956
- C:\Windows\System\vIYZYjN.exe
  C:\Windows\System\vIYZYjN.exe
  2⤵
  PID:3612
- C:\Windows\System\vOKqsim.exe
  C:\Windows\System\vOKqsim.exe
  2⤵
  PID:3416
- C:\Windows\System\NRMWCsA.exe
  C:\Windows\System\NRMWCsA.exe
  2⤵
  PID:4052
- C:\Windows\System\VjxLXOV.exe
  C:\Windows\System\VjxLXOV.exe
  2⤵
  PID:4300
- C:\Windows\System\tFcPztG.exe
  C:\Windows\System\tFcPztG.exe
  2⤵
  PID:4556
- C:\Windows\System\Yyyfsjm.exe
  C:\Windows\System\Yyyfsjm.exe
  2⤵
  PID:3584
- C:\Windows\System\RUkRufQ.exe
  C:\Windows\System\RUkRufQ.exe
  2⤵
  PID:4676
- C:\Windows\System\skOYcTL.exe
  C:\Windows\System\skOYcTL.exe
  2⤵
  PID:4800
- C:\Windows\System\pqHBjCI.exe
  C:\Windows\System\pqHBjCI.exe
  2⤵
  PID:3536
- C:\Windows\System\idnCVDU.exe
  C:\Windows\System\idnCVDU.exe
  2⤵
  PID:3300
- C:\Windows\System\RSjNUvT.exe
  C:\Windows\System\RSjNUvT.exe
  2⤵
  PID:5128
- C:\Windows\System\ZDEWsUP.exe
  C:\Windows\System\ZDEWsUP.exe
  2⤵
  PID:5192
- C:\Windows\System\CJkRWJs.exe
  C:\Windows\System\CJkRWJs.exe
  2⤵
  PID:5232
- C:\Windows\System\AXXSzJG.exe
  C:\Windows\System\AXXSzJG.exe
  2⤵
  PID:5296
- C:\Windows\System\RVuFtDi.exe
  C:\Windows\System\RVuFtDi.exe
  2⤵
  PID:5364
- C:\Windows\System\GwHfKKx.exe
  C:\Windows\System\GwHfKKx.exe
  2⤵
  PID:5432
- C:\Windows\System\tzUHEfB.exe
  C:\Windows\System\tzUHEfB.exe
  2⤵
  PID:5496
- C:\Windows\System\FumXgza.exe
  C:\Windows\System\FumXgza.exe
  2⤵
  PID:5560
- C:\Windows\System\RZcAkRG.exe
  C:\Windows\System\RZcAkRG.exe
  2⤵
  PID:5624
- C:\Windows\System\eDaSUSk.exe
  C:\Windows\System\eDaSUSk.exe
  2⤵
  PID:5660
- C:\Windows\System\GfCZILB.exe
  C:\Windows\System\GfCZILB.exe
  2⤵
  PID:5724
- C:\Windows\System\EqQbRfJ.exe
  C:\Windows\System\EqQbRfJ.exe
  2⤵
  PID:5764
- C:\Windows\System\OSbmmrY.exe
  C:\Windows\System\OSbmmrY.exe
  2⤵
  PID:5804
- C:\Windows\System\HhUMlYY.exe
  C:\Windows\System\HhUMlYY.exe
  2⤵
  PID:5852
- C:\Windows\System\ozLvGdA.exe
  C:\Windows\System\ozLvGdA.exe
  2⤵
  PID:5916
- C:\Windows\System\xfesocF.exe
  C:\Windows\System\xfesocF.exe
  2⤵
  PID:5984
- C:\Windows\System\OTjnZwQ.exe
  C:\Windows\System\OTjnZwQ.exe
  2⤵
  PID:6052
- C:\Windows\System\dPeuMZV.exe
  C:\Windows\System\dPeuMZV.exe
  2⤵
  PID:6112
- C:\Windows\System\INKksxV.exe
  C:\Windows\System\INKksxV.exe
  2⤵
  PID:5212
- C:\Windows\System\hVemmRr.exe
  C:\Windows\System\hVemmRr.exe
  2⤵
  PID:5836
- C:\Windows\System\PcLZZiJ.exe
  C:\Windows\System\PcLZZiJ.exe
  2⤵
  PID:5356
- C:\Windows\System\IEReknt.exe
  C:\Windows\System\IEReknt.exe
  2⤵
  PID:3568
- C:\Windows\System\GBDQMiT.exe
  C:\Windows\System\GBDQMiT.exe
  2⤵
  PID:5692
- C:\Windows\System\oUfyPLq.exe
  C:\Windows\System\oUfyPLq.exe
  2⤵
  PID:4840
- C:\Windows\System\HIzEeri.exe
  C:\Windows\System\HIzEeri.exe
  2⤵
  PID:5164
- C:\Windows\System\EhJxBLy.exe
  C:\Windows\System\EhJxBLy.exe
  2⤵
  PID:5428
- C:\Windows\System\bAAJCeI.exe
  C:\Windows\System\bAAJCeI.exe
  2⤵
  PID:4280
- C:\Windows\System\hjRAzpr.exe
  C:\Windows\System\hjRAzpr.exe
  2⤵
  PID:6000
- C:\Windows\System\HRvaJaO.exe
  C:\Windows\System\HRvaJaO.exe
  2⤵
  PID:6028
- C:\Windows\System\yxclNZe.exe
  C:\Windows\System\yxclNZe.exe
  2⤵
  PID:5544
- C:\Windows\System\nZiOxsx.exe
  C:\Windows\System\nZiOxsx.exe
  2⤵
  PID:5108
- C:\Windows\System\wtayIeS.exe
  C:\Windows\System\wtayIeS.exe
  2⤵
  PID:4444
- C:\Windows\System\GJyWyTu.exe
  C:\Windows\System\GJyWyTu.exe
  2⤵
  PID:1764
- C:\Windows\System\OgNpdKB.exe
  C:\Windows\System\OgNpdKB.exe
  2⤵
  PID:5228
- C:\Windows\System\VEsvWZY.exe
  C:\Windows\System\VEsvWZY.exe
  2⤵
  PID:5492
- C:\Windows\System\vQyrWUw.exe
  C:\Windows\System\vQyrWUw.exe
  2⤵
  PID:3780
- C:\Windows\System\XiaAnvu.exe
  C:\Windows\System\XiaAnvu.exe
  2⤵
  PID:5396
- C:\Windows\System\kNWFvzS.exe
  C:\Windows\System\kNWFvzS.exe
  2⤵
  PID:5920
- C:\Windows\System\STRYwcW.exe
  C:\Windows\System\STRYwcW.exe
  2⤵
  PID:5776
- C:\Windows\System\EDQkhSV.exe
  C:\Windows\System\EDQkhSV.exe
  2⤵
  PID:6036
- C:\Windows\System\rAybvrB.exe
  C:\Windows\System\rAybvrB.exe
  2⤵
  PID:6032
- C:\Windows\System\aXICLEJ.exe
  C:\Windows\System\aXICLEJ.exe
  2⤵
  PID:6068
- C:\Windows\System\IFCQTnx.exe
  C:\Windows\System\IFCQTnx.exe
  2⤵
  PID:5416
- C:\Windows\System\GywCoQC.exe
  C:\Windows\System\GywCoQC.exe
  2⤵
  PID:4740
- C:\Windows\System\DCuJlsB.exe
  C:\Windows\System\DCuJlsB.exe
  2⤵
  PID:4976
- C:\Windows\System\YqcBFVU.exe
  C:\Windows\System\YqcBFVU.exe
  2⤵
  PID:4592
- C:\Windows\System\cdJWOJv.exe
  C:\Windows\System\cdJWOJv.exe
  2⤵
  PID:5676
- C:\Windows\System\XjAWUil.exe
  C:\Windows\System\XjAWUil.exe
  2⤵
  PID:5740
- C:\Windows\System\ztWHEpt.exe
  C:\Windows\System\ztWHEpt.exe
  2⤵
  PID:5104
- C:\Windows\System\EeHdUwt.exe
  C:\Windows\System\EeHdUwt.exe
  2⤵
  PID:5896
- C:\Windows\System\UeTulLe.exe
  C:\Windows\System\UeTulLe.exe
  2⤵
  PID:5476
- C:\Windows\System\hwMUZNu.exe
  C:\Windows\System\hwMUZNu.exe
  2⤵
  PID:4912
- C:\Windows\System\URIDOSv.exe
  C:\Windows\System\URIDOSv.exe
  2⤵
  PID:6096
- C:\Windows\System\FuqVcsG.exe
  C:\Windows\System\FuqVcsG.exe
  2⤵
  PID:5464
- C:\Windows\System\zUeLxll.exe
  C:\Windows\System\zUeLxll.exe
  2⤵
  PID:3716
- C:\Windows\System\lmnyuPV.exe
  C:\Windows\System\lmnyuPV.exe
  2⤵
  PID:5292
- C:\Windows\System\vpbvjPJ.exe
  C:\Windows\System\vpbvjPJ.exe
  2⤵
  PID:1664
- C:\Windows\System\kegVUWT.exe
  C:\Windows\System\kegVUWT.exe
  2⤵
  PID:5608
- C:\Windows\System\ijsbuuD.exe
  C:\Windows\System\ijsbuuD.exe
  2⤵
  PID:3860
- C:\Windows\System\gcIjXdi.exe
  C:\Windows\System\gcIjXdi.exe
  2⤵
  PID:6160
- C:\Windows\System\eNyJPoa.exe
  C:\Windows\System\eNyJPoa.exe
  2⤵
  PID:6176
- C:\Windows\System\erWtXbi.exe
  C:\Windows\System\erWtXbi.exe
  2⤵
  PID:6192
- C:\Windows\System\VutFAPu.exe
  C:\Windows\System\VutFAPu.exe
  2⤵
  PID:6208
- C:\Windows\System\rvkaNBB.exe
  C:\Windows\System\rvkaNBB.exe
  2⤵
  PID:6224
- C:\Windows\System\mVvgBxo.exe
  C:\Windows\System\mVvgBxo.exe
  2⤵
  PID:6240
- C:\Windows\System\iDIAflh.exe
  C:\Windows\System\iDIAflh.exe
  2⤵
  PID:6256
- C:\Windows\System\ToJBxOk.exe
  C:\Windows\System\ToJBxOk.exe
  2⤵
  PID:6272
- C:\Windows\System\MCczDvP.exe
  C:\Windows\System\MCczDvP.exe
  2⤵
  PID:6288
- C:\Windows\System\ddmECZS.exe
  C:\Windows\System\ddmECZS.exe
  2⤵
  PID:6304
- C:\Windows\System\fCDiEvS.exe
  C:\Windows\System\fCDiEvS.exe
  2⤵
  PID:6320
- C:\Windows\System\RuCSODd.exe
  C:\Windows\System\RuCSODd.exe
  2⤵
  PID:6336
- C:\Windows\System\VXwyATS.exe
  C:\Windows\System\VXwyATS.exe
  2⤵
  PID:6352
- C:\Windows\System\LBioFvH.exe
  C:\Windows\System\LBioFvH.exe
  2⤵
  PID:6368
- C:\Windows\System\ZfIJBKN.exe
  C:\Windows\System\ZfIJBKN.exe
  2⤵
  PID:6384
- C:\Windows\System\ZXTdFxr.exe
  C:\Windows\System\ZXTdFxr.exe
  2⤵
  PID:6400
- C:\Windows\System\HRfuDFC.exe
  C:\Windows\System\HRfuDFC.exe
  2⤵
  PID:6416
- C:\Windows\System\QbQbkZW.exe
  C:\Windows\System\QbQbkZW.exe
  2⤵
  PID:6432
- C:\Windows\System\QVicwLm.exe
  C:\Windows\System\QVicwLm.exe
  2⤵
  PID:6448
- C:\Windows\System\uzFMRdT.exe
  C:\Windows\System\uzFMRdT.exe
  2⤵
  PID:6464
- C:\Windows\System\srotTCQ.exe
  C:\Windows\System\srotTCQ.exe
  2⤵
  PID:6480
- C:\Windows\System\uGWcJjY.exe
  C:\Windows\System\uGWcJjY.exe
  2⤵
  PID:6496
- C:\Windows\System\gltjSKJ.exe
  C:\Windows\System\gltjSKJ.exe
  2⤵
  PID:6512
- C:\Windows\System\AfKOefI.exe
  C:\Windows\System\AfKOefI.exe
  2⤵
  PID:6528
- C:\Windows\System\phZbNaQ.exe
  C:\Windows\System\phZbNaQ.exe
  2⤵
  PID:6544
- C:\Windows\System\ruqQCJf.exe
  C:\Windows\System\ruqQCJf.exe
  2⤵
  PID:6560
- C:\Windows\System\IZImqKV.exe
  C:\Windows\System\IZImqKV.exe
  2⤵
  PID:6576
- C:\Windows\System\NRnSpgO.exe
  C:\Windows\System\NRnSpgO.exe
  2⤵
  PID:6592
- C:\Windows\System\SNWPCNp.exe
  C:\Windows\System\SNWPCNp.exe
  2⤵
  PID:6608
- C:\Windows\System\TvaYFGJ.exe
  C:\Windows\System\TvaYFGJ.exe
  2⤵
  PID:6624
- C:\Windows\System\odXGoGM.exe
  C:\Windows\System\odXGoGM.exe
  2⤵
  PID:6640
- C:\Windows\System\RgBUnGi.exe
  C:\Windows\System\RgBUnGi.exe
  2⤵
  PID:6656
- C:\Windows\System\sxDrqXV.exe
  C:\Windows\System\sxDrqXV.exe
  2⤵
  PID:6672
- C:\Windows\System\KWNKGUb.exe
  C:\Windows\System\KWNKGUb.exe
  2⤵
  PID:6688
- C:\Windows\System\KDgtioK.exe
  C:\Windows\System\KDgtioK.exe
  2⤵
  PID:6704
- C:\Windows\System\InbUoYz.exe
  C:\Windows\System\InbUoYz.exe
  2⤵
  PID:6720
- C:\Windows\System\qlPZcLd.exe
  C:\Windows\System\qlPZcLd.exe
  2⤵
  PID:6736
- C:\Windows\System\TlMioWf.exe
  C:\Windows\System\TlMioWf.exe
  2⤵
  PID:6752
- C:\Windows\System\WEjbtEw.exe
  C:\Windows\System\WEjbtEw.exe
  2⤵
  PID:6768
- C:\Windows\System\iPccyEf.exe
  C:\Windows\System\iPccyEf.exe
  2⤵
  PID:6784
- C:\Windows\System\QgDqPkx.exe
  C:\Windows\System\QgDqPkx.exe
  2⤵
  PID:6800
- C:\Windows\System\oDiSNQq.exe
  C:\Windows\System\oDiSNQq.exe
  2⤵
  PID:6816
- C:\Windows\System\RPQVGyy.exe
  C:\Windows\System\RPQVGyy.exe
  2⤵
  PID:6832
- C:\Windows\System\yZszmcx.exe
  C:\Windows\System\yZszmcx.exe
  2⤵
  PID:6848
- C:\Windows\System\vhMoNJF.exe
  C:\Windows\System\vhMoNJF.exe
  2⤵
  PID:6864
- C:\Windows\System\aSkGHVv.exe
  C:\Windows\System\aSkGHVv.exe
  2⤵
  PID:6880
- C:\Windows\System\xoFHGjb.exe
  C:\Windows\System\xoFHGjb.exe
  2⤵
  PID:6896
- C:\Windows\System\lEPkHsA.exe
  C:\Windows\System\lEPkHsA.exe
  2⤵
  PID:6912
- C:\Windows\System\ragBqaS.exe
  C:\Windows\System\ragBqaS.exe
  2⤵
  PID:6928
- C:\Windows\System\MGMeHvS.exe
  C:\Windows\System\MGMeHvS.exe
  2⤵
  PID:6944
- C:\Windows\System\ncjAPTb.exe
  C:\Windows\System\ncjAPTb.exe
  2⤵
  PID:6960
- C:\Windows\System\yvfRPra.exe
  C:\Windows\System\yvfRPra.exe
  2⤵
  PID:6976
- C:\Windows\System\zFiqVst.exe
  C:\Windows\System\zFiqVst.exe
  2⤵
  PID:6992
- C:\Windows\System\MtrBdSQ.exe
  C:\Windows\System\MtrBdSQ.exe
  2⤵
  PID:7008
- C:\Windows\System\yPnWOeD.exe
  C:\Windows\System\yPnWOeD.exe
  2⤵
  PID:7024
- C:\Windows\System\jpNNnrc.exe
  C:\Windows\System\jpNNnrc.exe
  2⤵
  PID:7040
- C:\Windows\System\tavKiBa.exe
  C:\Windows\System\tavKiBa.exe
  2⤵
  PID:7056
- C:\Windows\System\tjeYtjG.exe
  C:\Windows\System\tjeYtjG.exe
  2⤵
  PID:7072
- C:\Windows\System\MPniqJp.exe
  C:\Windows\System\MPniqJp.exe
  2⤵
  PID:7088
- C:\Windows\System\JXvtRAm.exe
  C:\Windows\System\JXvtRAm.exe
  2⤵
  PID:7104
- C:\Windows\System\vHVwazr.exe
  C:\Windows\System\vHVwazr.exe
  2⤵
  PID:7120
- C:\Windows\System\gSmVNxJ.exe
  C:\Windows\System\gSmVNxJ.exe
  2⤵
  PID:7136
- C:\Windows\System\YbNYBXl.exe
  C:\Windows\System\YbNYBXl.exe
  2⤵
  PID:7152
- C:\Windows\System\GnZJGWt.exe
  C:\Windows\System\GnZJGWt.exe
  2⤵
  PID:5024
- C:\Windows\System\CyIyyAC.exe
  C:\Windows\System\CyIyyAC.exe
  2⤵
  PID:6168
- C:\Windows\System\IOJCvqR.exe
  C:\Windows\System\IOJCvqR.exe
  2⤵
  PID:6232
- C:\Windows\System\HMSAzWb.exe
  C:\Windows\System\HMSAzWb.exe
  2⤵
  PID:5708
- C:\Windows\System\neVggCY.exe
  C:\Windows\System\neVggCY.exe
  2⤵
  PID:6332
- C:\Windows\System\TBuQgZp.exe
  C:\Windows\System\TBuQgZp.exe
  2⤵
  PID:6396
- C:\Windows\System\caNSQOl.exe
  C:\Windows\System\caNSQOl.exe
  2⤵
  PID:5744
- C:\Windows\System\pvAGKQH.exe
  C:\Windows\System\pvAGKQH.exe
  2⤵
  PID:5936
- C:\Windows\System\DAvXlWz.exe
  C:\Windows\System\DAvXlWz.exe
  2⤵
  PID:6488
- C:\Windows\System\ekPUalh.exe
  C:\Windows\System\ekPUalh.exe
  2⤵
  PID:5904
- C:\Windows\System\DzNAiZq.exe
  C:\Windows\System\DzNAiZq.exe
  2⤵
  PID:6184
- C:\Windows\System\jRYOcPO.exe
  C:\Windows\System\jRYOcPO.exe
  2⤵
  PID:6248
- C:\Windows\System\LgjtHPG.exe
  C:\Windows\System\LgjtHPG.exe
  2⤵
  PID:6312
- C:\Windows\System\Yiqzxfd.exe
  C:\Windows\System\Yiqzxfd.exe
  2⤵
  PID:6348
- C:\Windows\System\gPUZAcn.exe
  C:\Windows\System\gPUZAcn.exe
  2⤵
  PID:6440
- C:\Windows\System\hCkUeLm.exe
  C:\Windows\System\hCkUeLm.exe
  2⤵
  PID:6552
- C:\Windows\System\gkhModw.exe
  C:\Windows\System\gkhModw.exe
  2⤵
  PID:6508
- C:\Windows\System\boAUALQ.exe
  C:\Windows\System\boAUALQ.exe
  2⤵
  PID:6572
- C:\Windows\System\LzbNyxl.exe
  C:\Windows\System\LzbNyxl.exe
  2⤵
  PID:6604
- C:\Windows\System\xuiplkX.exe
  C:\Windows\System\xuiplkX.exe
  2⤵
  PID:6668
- C:\Windows\System\ZTaWAVH.exe
  C:\Windows\System\ZTaWAVH.exe
  2⤵
  PID:6732
- C:\Windows\System\CXXYfXB.exe
  C:\Windows\System\CXXYfXB.exe
  2⤵
  PID:6792
- C:\Windows\System\bCVKbSL.exe
  C:\Windows\System\bCVKbSL.exe
  2⤵
  PID:6648
- C:\Windows\System\phxEcwp.exe
  C:\Windows\System\phxEcwp.exe
  2⤵
  PID:6712
- C:\Windows\System\fjCidlV.exe
  C:\Windows\System\fjCidlV.exe
  2⤵
  PID:6780
- C:\Windows\System\ydnLExV.exe
  C:\Windows\System\ydnLExV.exe
  2⤵
  PID:6844
- C:\Windows\System\ZCUUWBL.exe
  C:\Windows\System\ZCUUWBL.exe
  2⤵
  PID:6828
- C:\Windows\System\jLvIJVP.exe
  C:\Windows\System\jLvIJVP.exe
  2⤵
  PID:6940
- C:\Windows\System\RPxIRkx.exe
  C:\Windows\System\RPxIRkx.exe
  2⤵
  PID:6892
- C:\Windows\System\kyXWrXa.exe
  C:\Windows\System\kyXWrXa.exe
  2⤵
  PID:6776
- C:\Windows\System\aaeqyTW.exe
  C:\Windows\System\aaeqyTW.exe
  2⤵
  PID:6860
- C:\Windows\System\dwgffhq.exe
  C:\Windows\System\dwgffhq.exe
  2⤵
  PID:7160
- C:\Windows\System\siSFaeW.exe
  C:\Windows\System\siSFaeW.exe
  2⤵
  PID:6204
- C:\Windows\System\xXVjMrs.exe
  C:\Windows\System\xXVjMrs.exe
  2⤵
  PID:2932
- C:\Windows\System\cqCvvDs.exe
  C:\Windows\System\cqCvvDs.exe
  2⤵
  PID:6492
- C:\Windows\System\lSYLdbE.exe
  C:\Windows\System\lSYLdbE.exe
  2⤵
  PID:6328
- C:\Windows\System\qgHduVu.exe
  C:\Windows\System\qgHduVu.exe
  2⤵
  PID:6504
- C:\Windows\System\wexHxrq.exe
  C:\Windows\System\wexHxrq.exe
  2⤵
  PID:6700
- C:\Windows\System\UussXAa.exe
  C:\Windows\System\UussXAa.exe
  2⤵
  PID:7048
- C:\Windows\System\vHHhLvJ.exe
  C:\Windows\System\vHHhLvJ.exe
  2⤵
  PID:6876
- C:\Windows\System\acAbjNt.exe
  C:\Windows\System\acAbjNt.exe
  2⤵
  PID:7004
- C:\Windows\System\rEyZARv.exe
  C:\Windows\System\rEyZARv.exe
  2⤵
  PID:6200
- C:\Windows\System\bLwjvWC.exe
  C:\Windows\System\bLwjvWC.exe
  2⤵
  PID:6476
- C:\Windows\System\pLTqCUW.exe
  C:\Windows\System\pLTqCUW.exe
  2⤵
  PID:6316
- C:\Windows\System\LDaOTZk.exe
  C:\Windows\System\LDaOTZk.exe
  2⤵
  PID:6904
- C:\Windows\System\mYgrrum.exe
  C:\Windows\System\mYgrrum.exe
  2⤵
  PID:6048
- C:\Windows\System\NGLGsVw.exe
  C:\Windows\System\NGLGsVw.exe
  2⤵
  PID:7020
- C:\Windows\System\GJswsXc.exe
  C:\Windows\System\GJswsXc.exe
  2⤵
  PID:7112
- C:\Windows\System\ZQJKggq.exe
  C:\Windows\System\ZQJKggq.exe
  2⤵
  PID:5884
- C:\Windows\System\KIHPbdq.exe
  C:\Windows\System\KIHPbdq.exe
  2⤵
  PID:6268
- C:\Windows\System\ldxkwgP.exe
  C:\Windows\System\ldxkwgP.exe
  2⤵
  PID:2756
- C:\Windows\System\KPHYaEp.exe
  C:\Windows\System\KPHYaEp.exe
  2⤵
  PID:6456
- C:\Windows\System\inrRUzm.exe
  C:\Windows\System\inrRUzm.exe
  2⤵
  PID:6796
- C:\Windows\System\HVtMlYk.exe
  C:\Windows\System\HVtMlYk.exe
  2⤵
  PID:6812
- C:\Windows\System\cBMNUWC.exe
  C:\Windows\System\cBMNUWC.exe
  2⤵
  PID:7064
- C:\Windows\System\SXFkQcV.exe
  C:\Windows\System\SXFkQcV.exe
  2⤵
  PID:7084
- C:\Windows\System\OJLlIuF.exe
  C:\Windows\System\OJLlIuF.exe
  2⤵
  PID:5208
- C:\Windows\System\fnIBrKk.exe
  C:\Windows\System\fnIBrKk.exe
  2⤵
  PID:7172
- C:\Windows\System\ztvmbRq.exe
  C:\Windows\System\ztvmbRq.exe
  2⤵
  PID:7188
- C:\Windows\System\vKoCWVf.exe
  C:\Windows\System\vKoCWVf.exe
  2⤵
  PID:7204
- C:\Windows\System\ptWHpoj.exe
  C:\Windows\System\ptWHpoj.exe
  2⤵
  PID:7220
- C:\Windows\System\laXwomc.exe
  C:\Windows\System\laXwomc.exe
  2⤵
  PID:7236
- C:\Windows\System\QYmGJqY.exe
  C:\Windows\System\QYmGJqY.exe
  2⤵
  PID:7252
- C:\Windows\System\jHCzhpY.exe
  C:\Windows\System\jHCzhpY.exe
  2⤵
  PID:7268
- C:\Windows\System\mLjREdr.exe
  C:\Windows\System\mLjREdr.exe
  2⤵
  PID:7284
- C:\Windows\System\mzGqwUL.exe
  C:\Windows\System\mzGqwUL.exe
  2⤵
  PID:7300
- C:\Windows\System\dugTQiB.exe
  C:\Windows\System\dugTQiB.exe
  2⤵
  PID:7316
- C:\Windows\System\LxPVtvG.exe
  C:\Windows\System\LxPVtvG.exe
  2⤵
  PID:7332
- C:\Windows\System\uscvxKM.exe
  C:\Windows\System\uscvxKM.exe
  2⤵
  PID:7348
- C:\Windows\System\vZQdAZQ.exe
  C:\Windows\System\vZQdAZQ.exe
  2⤵
  PID:7364
- C:\Windows\System\NPOJkan.exe
  C:\Windows\System\NPOJkan.exe
  2⤵
  PID:7380
- C:\Windows\System\FdlYNLK.exe
  C:\Windows\System\FdlYNLK.exe
  2⤵
  PID:7396
- C:\Windows\System\PqWIXtU.exe
  C:\Windows\System\PqWIXtU.exe
  2⤵
  PID:7412
- C:\Windows\System\eBpRIFY.exe
  C:\Windows\System\eBpRIFY.exe
  2⤵
  PID:7428
- C:\Windows\System\ndTPSdT.exe
  C:\Windows\System\ndTPSdT.exe
  2⤵
  PID:7444
- C:\Windows\System\PleFtPl.exe
  C:\Windows\System\PleFtPl.exe
  2⤵
  PID:7460
- C:\Windows\System\TpCNUFr.exe
  C:\Windows\System\TpCNUFr.exe
  2⤵
  PID:7476
- C:\Windows\System\WdQnYee.exe
  C:\Windows\System\WdQnYee.exe
  2⤵
  PID:7492
- C:\Windows\System\EhvkoMN.exe
  C:\Windows\System\EhvkoMN.exe
  2⤵
  PID:7512
- C:\Windows\System\uArnqmx.exe
  C:\Windows\System\uArnqmx.exe
  2⤵
  PID:7540
- C:\Windows\System\RvUdwRL.exe
  C:\Windows\System\RvUdwRL.exe
  2⤵
  PID:7556
- C:\Windows\System\BaQvSvf.exe
  C:\Windows\System\BaQvSvf.exe
  2⤵
  PID:7576
- C:\Windows\System\fNVrDCd.exe
  C:\Windows\System\fNVrDCd.exe
  2⤵
  PID:7592
- C:\Windows\System\ikWpvJy.exe
  C:\Windows\System\ikWpvJy.exe
  2⤵
  PID:7608
- C:\Windows\System\aBCbOcP.exe
  C:\Windows\System\aBCbOcP.exe
  2⤵
  PID:7624
- C:\Windows\System\sdOtqki.exe
  C:\Windows\System\sdOtqki.exe
  2⤵
  PID:7640
- C:\Windows\System\rrNXTwU.exe
  C:\Windows\System\rrNXTwU.exe
  2⤵
  PID:7656
- C:\Windows\System\cstNmCm.exe
  C:\Windows\System\cstNmCm.exe
  2⤵
  PID:7672
- C:\Windows\System\hLXLHSE.exe
  C:\Windows\System\hLXLHSE.exe
  2⤵
  PID:7688
- C:\Windows\System\VUAIWlj.exe
  C:\Windows\System\VUAIWlj.exe
  2⤵
  PID:7704
- C:\Windows\System\cRAzKRT.exe
  C:\Windows\System\cRAzKRT.exe
  2⤵
  PID:7720
- C:\Windows\System\tDasKSx.exe
  C:\Windows\System\tDasKSx.exe
  2⤵
  PID:7736
- C:\Windows\System\DZemJpp.exe
  C:\Windows\System\DZemJpp.exe
  2⤵
  PID:7752
- C:\Windows\System\GRvTJnJ.exe
  C:\Windows\System\GRvTJnJ.exe
  2⤵
  PID:7768
- C:\Windows\System\onWWZci.exe
  C:\Windows\System\onWWZci.exe
  2⤵
  PID:7784
- C:\Windows\System\deToBeS.exe
  C:\Windows\System\deToBeS.exe
  2⤵
  PID:7800
- C:\Windows\System\OJUpjoh.exe
  C:\Windows\System\OJUpjoh.exe
  2⤵
  PID:7824
- C:\Windows\System\HnwjOgH.exe
  C:\Windows\System\HnwjOgH.exe
  2⤵
  PID:7840
- C:\Windows\System\HqGYrDy.exe
  C:\Windows\System\HqGYrDy.exe
  2⤵
  PID:7856
- C:\Windows\System\HmpbCYp.exe
  C:\Windows\System\HmpbCYp.exe
  2⤵
  PID:7872
- C:\Windows\System\OgxvQnW.exe
  C:\Windows\System\OgxvQnW.exe
  2⤵
  PID:7888
- C:\Windows\System\CZYKkia.exe
  C:\Windows\System\CZYKkia.exe
  2⤵
  PID:7904
- C:\Windows\System\hYQdYuQ.exe
  C:\Windows\System\hYQdYuQ.exe
  2⤵
  PID:7920
- C:\Windows\System\SNWAOrq.exe
  C:\Windows\System\SNWAOrq.exe
  2⤵
  PID:7936
- C:\Windows\System\paltJmp.exe
  C:\Windows\System\paltJmp.exe
  2⤵
  PID:7952
- C:\Windows\System\PufgwgS.exe
  C:\Windows\System\PufgwgS.exe
  2⤵
  PID:7968
- C:\Windows\System\LOVpdFr.exe
  C:\Windows\System\LOVpdFr.exe
  2⤵
  PID:7984
- C:\Windows\System\dzDWhJI.exe
  C:\Windows\System\dzDWhJI.exe
  2⤵
  PID:8000
- C:\Windows\System\ZgyVsLc.exe
  C:\Windows\System\ZgyVsLc.exe
  2⤵
  PID:8016
- C:\Windows\System\wAlrLGT.exe
  C:\Windows\System\wAlrLGT.exe
  2⤵
  PID:8032
- C:\Windows\System\vrSgLps.exe
  C:\Windows\System\vrSgLps.exe
  2⤵
  PID:8048
- C:\Windows\System\tZzhWIr.exe
  C:\Windows\System\tZzhWIr.exe
  2⤵
  PID:8064
- C:\Windows\System\xBcdPDH.exe
  C:\Windows\System\xBcdPDH.exe
  2⤵
  PID:8080
- C:\Windows\System\zdBqcRL.exe
  C:\Windows\System\zdBqcRL.exe
  2⤵
  PID:8096
- C:\Windows\System\tDsSFFZ.exe
  C:\Windows\System\tDsSFFZ.exe
  2⤵
  PID:8112
- C:\Windows\System\sTzfHEO.exe
  C:\Windows\System\sTzfHEO.exe
  2⤵
  PID:8128
- C:\Windows\System\IfacMXT.exe
  C:\Windows\System\IfacMXT.exe
  2⤵
  PID:8144
- C:\Windows\System\nNlIKkK.exe
  C:\Windows\System\nNlIKkK.exe
  2⤵
  PID:8160
- C:\Windows\System\TGnHMCH.exe
  C:\Windows\System\TGnHMCH.exe
  2⤵
  PID:8176
- C:\Windows\System\wyhRVXU.exe
  C:\Windows\System\wyhRVXU.exe
  2⤵
  PID:6936
- C:\Windows\System\VmusqZI.exe
  C:\Windows\System\VmusqZI.exe
  2⤵
  PID:6988
- C:\Windows\System\TkoYfVu.exe
  C:\Windows\System\TkoYfVu.exe
  2⤵
  PID:6284
- C:\Windows\System\jyvrxhW.exe
  C:\Windows\System\jyvrxhW.exe
  2⤵
  PID:7184
- C:\Windows\System\WWKHUko.exe
  C:\Windows\System\WWKHUko.exe
  2⤵
  PID:6952
- C:\Windows\System\ersBxix.exe
  C:\Windows\System\ersBxix.exe
  2⤵
  PID:7312
- C:\Windows\System\aFjCvIX.exe
  C:\Windows\System\aFjCvIX.exe
  2⤵
  PID:6300
- C:\Windows\System\FMOdiCN.exe
  C:\Windows\System\FMOdiCN.exe
  2⤵
  PID:6632
- C:\Windows\System\HbEGKIz.exe
  C:\Windows\System\HbEGKIz.exe
  2⤵
  PID:6264
- C:\Windows\System\KIhczvP.exe
  C:\Windows\System\KIhczvP.exe
  2⤵
  PID:6856
- C:\Windows\System\PnPmGKY.exe
  C:\Windows\System\PnPmGKY.exe
  2⤵
  PID:7200
- C:\Windows\System\GpBbMnF.exe
  C:\Windows\System\GpBbMnF.exe
  2⤵
  PID:7296
- C:\Windows\System\oYUVctN.exe
  C:\Windows\System\oYUVctN.exe
  2⤵
  PID:1828
- C:\Windows\System\rKyPByM.exe
  C:\Windows\System\rKyPByM.exe
  2⤵
  PID:7372
- C:\Windows\System\SebMZkN.exe
  C:\Windows\System\SebMZkN.exe
  2⤵
  PID:7424
- C:\Windows\System\xiZzidJ.exe
  C:\Windows\System\xiZzidJ.exe
  2⤵
  PID:7392
- C:\Windows\System\XzWDLsV.exe
  C:\Windows\System\XzWDLsV.exe
  2⤵
  PID:7484
- C:\Windows\System\uEdmeXQ.exe
  C:\Windows\System\uEdmeXQ.exe
  2⤵
  PID:7440
- C:\Windows\System\vdGmjuL.exe
  C:\Windows\System\vdGmjuL.exe
  2⤵
  PID:7508
- C:\Windows\System\IKHnyHQ.exe
  C:\Windows\System\IKHnyHQ.exe
  2⤵
  PID:7552
- C:\Windows\System\uyoKESq.exe
  C:\Windows\System\uyoKESq.exe
  2⤵
  PID:7616
- C:\Windows\System\teXsJkG.exe
  C:\Windows\System\teXsJkG.exe
  2⤵
  PID:7684
- C:\Windows\System\YWAJxDC.exe
  C:\Windows\System\YWAJxDC.exe
  2⤵
  PID:7808
- C:\Windows\System\BxXSiXe.exe
  C:\Windows\System\BxXSiXe.exe
  2⤵
  PID:7748
- C:\Windows\System\WKoOaxH.exe
  C:\Windows\System\WKoOaxH.exe
  2⤵
  PID:7568
- C:\Windows\System\TPnUukV.exe
  C:\Windows\System\TPnUukV.exe
  2⤵
  PID:7600
- C:\Windows\System\ZizePnb.exe
  C:\Windows\System\ZizePnb.exe
  2⤵
  PID:7668
- C:\Windows\System\SXmZQkl.exe
  C:\Windows\System\SXmZQkl.exe
  2⤵
  PID:7732
- C:\Windows\System\OjaDXxI.exe
  C:\Windows\System\OjaDXxI.exe
  2⤵
  PID:7796
- C:\Windows\System\YGIpoLE.exe
  C:\Windows\System\YGIpoLE.exe
  2⤵
  PID:7880
- C:\Windows\System\FZesOjo.exe
  C:\Windows\System\FZesOjo.exe
  2⤵
  PID:7912
- C:\Windows\System\ChxfsBg.exe
  C:\Windows\System\ChxfsBg.exe
  2⤵
  PID:7976
- C:\Windows\System\oDrjXeQ.exe
  C:\Windows\System\oDrjXeQ.exe
  2⤵
  PID:8040
- C:\Windows\System\UBdHNWf.exe
  C:\Windows\System\UBdHNWf.exe
  2⤵
  PID:8104
- C:\Windows\System\pmsxJyB.exe
  C:\Windows\System\pmsxJyB.exe
  2⤵
  PID:8168
- C:\Windows\System\kgrPWzP.exe
  C:\Windows\System\kgrPWzP.exe
  2⤵
  PID:7148
- C:\Windows\System\gvrugaJ.exe
  C:\Windows\System\gvrugaJ.exe
  2⤵
  PID:7248
- C:\Windows\System\riZgMXl.exe
  C:\Windows\System\riZgMXl.exe
  2⤵
  PID:8024
- C:\Windows\System\nJlqtHA.exe
  C:\Windows\System\nJlqtHA.exe
  2⤵
  PID:7260
- C:\Windows\System\ytbMxIV.exe
  C:\Windows\System\ytbMxIV.exe
  2⤵
  PID:8156
- C:\Windows\System\lXlKTEy.exe
  C:\Windows\System\lXlKTEy.exe
  2⤵
  PID:7244
- C:\Windows\System\npaSJWC.exe
  C:\Windows\System\npaSJWC.exe
  2⤵
  PID:7344
- C:\Windows\System\XnXHsKe.exe
  C:\Windows\System\XnXHsKe.exe
  2⤵
  PID:7960
- C:\Windows\System\vZZRqJE.exe
  C:\Windows\System\vZZRqJE.exe
  2⤵
  PID:7964
- C:\Windows\System\RrnxkVR.exe
  C:\Windows\System\RrnxkVR.exe
  2⤵
  PID:8120
- C:\Windows\System\UfKgybe.exe
  C:\Windows\System\UfKgybe.exe
  2⤵
  PID:6748
- C:\Windows\System\XkPsEpF.exe
  C:\Windows\System\XkPsEpF.exe
  2⤵
  PID:7468
- C:\Windows\System\NkEvHGp.exe
  C:\Windows\System\NkEvHGp.exe
  2⤵
  PID:7408
- C:\Windows\System\TykWoNY.exe
  C:\Windows\System\TykWoNY.exe
  2⤵
  PID:7652
- C:\Windows\System\MtvYeuc.exe
  C:\Windows\System\MtvYeuc.exe
  2⤵
  PID:7528
- C:\Windows\System\RMDXMDa.exe
  C:\Windows\System\RMDXMDa.exe
  2⤵
  PID:7700
- C:\Windows\System\twBePGN.exe
  C:\Windows\System\twBePGN.exe
  2⤵
  PID:7884
- C:\Windows\System\oRIwYxB.exe
  C:\Windows\System\oRIwYxB.exe
  2⤵
  PID:7776
- C:\Windows\System\hftpgiU.exe
  C:\Windows\System\hftpgiU.exe
  2⤵
  PID:8076
- C:\Windows\System\eezKwGy.exe
  C:\Windows\System\eezKwGy.exe
  2⤵
  PID:6888
- C:\Windows\System\lSeNULu.exe
  C:\Windows\System\lSeNULu.exe
  2⤵
  PID:7780
- C:\Windows\System\ZwLasiO.exe
  C:\Windows\System\ZwLasiO.exe
  2⤵
  PID:7636
- C:\Windows\System\cocnYmm.exe
  C:\Windows\System\cocnYmm.exe
  2⤵
  PID:7212
- C:\Windows\System\GJxFluJ.exe
  C:\Windows\System\GJxFluJ.exe
  2⤵
  PID:7916
- C:\Windows\System\eNHIeMA.exe
  C:\Windows\System\eNHIeMA.exe
  2⤵
  PID:8012
- C:\Windows\System\apwgqEl.exe
  C:\Windows\System\apwgqEl.exe
  2⤵
  PID:6744
- C:\Windows\System\jioIbBM.exe
  C:\Windows\System\jioIbBM.exe
  2⤵
  PID:8188
- C:\Windows\System\yjmKNky.exe
  C:\Windows\System\yjmKNky.exe
  2⤵
  PID:7524
- C:\Windows\System\vlxvyEe.exe
  C:\Windows\System\vlxvyEe.exe
  2⤵
  PID:7820
- C:\Windows\System\rINqOsk.exe
  C:\Windows\System\rINqOsk.exe
  2⤵
  PID:6556
- C:\Windows\System\zAiFJSO.exe
  C:\Windows\System\zAiFJSO.exe
  2⤵
  PID:7864
- C:\Windows\System\QLDILZE.exe
  C:\Windows\System\QLDILZE.exe
  2⤵
  PID:7680
- C:\Windows\System\weBdGhH.exe
  C:\Windows\System\weBdGhH.exe
  2⤵
  PID:7848
- C:\Windows\System\AjFavmf.exe
  C:\Windows\System\AjFavmf.exe
  2⤵
  PID:8088
- C:\Windows\System\QTZDscs.exe
  C:\Windows\System\QTZDscs.exe
  2⤵
  PID:7196
- C:\Windows\System\LmKWIBF.exe
  C:\Windows\System\LmKWIBF.exe
  2⤵
  PID:6392
- C:\Windows\System\dQLqxGt.exe
  C:\Windows\System\dQLqxGt.exe
  2⤵
  PID:8060
- C:\Windows\System\kyiKBtM.exe
  C:\Windows\System\kyiKBtM.exe
  2⤵
  PID:7928
- C:\Windows\System\dvTMQUW.exe
  C:\Windows\System\dvTMQUW.exe
  2⤵
  PID:7896
- C:\Windows\System\xybGYcq.exe
  C:\Windows\System\xybGYcq.exe
  2⤵
  PID:7452
- C:\Windows\System\aoZEDRh.exe
  C:\Windows\System\aoZEDRh.exe
  2⤵
  PID:7932
- C:\Windows\System\bciaJpy.exe
  C:\Windows\System\bciaJpy.exe
  2⤵
  PID:7812
- C:\Windows\System\mXKuIAc.exe
  C:\Windows\System\mXKuIAc.exe
  2⤵
  PID:7308
- C:\Windows\System\mwjIZmN.exe
  C:\Windows\System\mwjIZmN.exe
  2⤵
  PID:8204
- C:\Windows\System\tKfqRrN.exe
  C:\Windows\System\tKfqRrN.exe
  2⤵
  PID:8224
- C:\Windows\System\rkJNJGx.exe
  C:\Windows\System\rkJNJGx.exe
  2⤵
  PID:8244
- C:\Windows\System\FIZHnFC.exe
  C:\Windows\System\FIZHnFC.exe
  2⤵
  PID:8260
- C:\Windows\System\xUCHkgn.exe
  C:\Windows\System\xUCHkgn.exe
  2⤵
  PID:8280
- C:\Windows\System\DRiPhqi.exe
  C:\Windows\System\DRiPhqi.exe
  2⤵
  PID:8296
- C:\Windows\System\RADJFwC.exe
  C:\Windows\System\RADJFwC.exe
  2⤵
  PID:8312
- C:\Windows\System\gtYfpkA.exe
  C:\Windows\System\gtYfpkA.exe
  2⤵
  PID:8328
- C:\Windows\System\mMfMDgo.exe
  C:\Windows\System\mMfMDgo.exe
  2⤵
  PID:8344
- C:\Windows\System\purudpl.exe
  C:\Windows\System\purudpl.exe
  2⤵
  PID:8360
- C:\Windows\System\jCIdBCD.exe
  C:\Windows\System\jCIdBCD.exe
  2⤵
  PID:8376
- C:\Windows\System\oMvZpWp.exe
  C:\Windows\System\oMvZpWp.exe
  2⤵
  PID:8392
- C:\Windows\System\iOhBzZj.exe
  C:\Windows\System\iOhBzZj.exe
  2⤵
  PID:8408
- C:\Windows\System\lsWvwMq.exe
  C:\Windows\System\lsWvwMq.exe
  2⤵
  PID:8424
- C:\Windows\System\KHnTowR.exe
  C:\Windows\System\KHnTowR.exe
  2⤵
  PID:8440
- C:\Windows\System\wHdGVjG.exe
  C:\Windows\System\wHdGVjG.exe
  2⤵
  PID:8460
- C:\Windows\System\qBvxHOi.exe
  C:\Windows\System\qBvxHOi.exe
  2⤵
  PID:8480
- C:\Windows\System\FgywTcH.exe
  C:\Windows\System\FgywTcH.exe
  2⤵
  PID:8496
- C:\Windows\System\ecHYMIu.exe
  C:\Windows\System\ecHYMIu.exe
  2⤵
  PID:8520
- C:\Windows\System\OUTRedY.exe
  C:\Windows\System\OUTRedY.exe
  2⤵
  PID:8536
- C:\Windows\System\vXWrKUs.exe
  C:\Windows\System\vXWrKUs.exe
  2⤵
  PID:8552
- C:\Windows\System\yFRDhmp.exe
  C:\Windows\System\yFRDhmp.exe
  2⤵
  PID:8568
- C:\Windows\System\GNsfQWz.exe
  C:\Windows\System\GNsfQWz.exe
  2⤵
  PID:8584
- C:\Windows\System\FKTbYWm.exe
  C:\Windows\System\FKTbYWm.exe
  2⤵
  PID:8600
- C:\Windows\System\gCrAyaB.exe
  C:\Windows\System\gCrAyaB.exe
  2⤵
  PID:8616
- C:\Windows\System\sUoIbvW.exe
  C:\Windows\System\sUoIbvW.exe
  2⤵
  PID:8632
- C:\Windows\System\wLOvgLC.exe
  C:\Windows\System\wLOvgLC.exe
  2⤵
  PID:8652
- C:\Windows\System\QOBiBDC.exe
  C:\Windows\System\QOBiBDC.exe
  2⤵
  PID:8668
- C:\Windows\System\xSMjqRK.exe
  C:\Windows\System\xSMjqRK.exe
  2⤵
  PID:8684
- C:\Windows\System\WeqGurQ.exe
  C:\Windows\System\WeqGurQ.exe
  2⤵
  PID:8700
- C:\Windows\System\TOpyMxz.exe
  C:\Windows\System\TOpyMxz.exe
  2⤵
  PID:8716
- C:\Windows\System\nhOinPn.exe
  C:\Windows\System\nhOinPn.exe
  2⤵
  PID:8732
- C:\Windows\System\oRzIOmS.exe
  C:\Windows\System\oRzIOmS.exe
  2⤵
  PID:8748
- C:\Windows\System\dwmMnWY.exe
  C:\Windows\System\dwmMnWY.exe
  2⤵
  PID:8764
- C:\Windows\System\aHIJGHa.exe
  C:\Windows\System\aHIJGHa.exe
  2⤵
  PID:8780
- C:\Windows\System\fBxCDpG.exe
  C:\Windows\System\fBxCDpG.exe
  2⤵
  PID:8796
- C:\Windows\System\ApqiAnW.exe
  C:\Windows\System\ApqiAnW.exe
  2⤵
  PID:8812
- C:\Windows\System\VGrQEnT.exe
  C:\Windows\System\VGrQEnT.exe
  2⤵
  PID:8828
- C:\Windows\System\zodUOlM.exe
  C:\Windows\System\zodUOlM.exe
  2⤵
  PID:8852
- C:\Windows\System\zGrYQrC.exe
  C:\Windows\System\zGrYQrC.exe
  2⤵
  PID:8896
- C:\Windows\System\oUJzjUw.exe
  C:\Windows\System\oUJzjUw.exe
  2⤵
  PID:8912
- C:\Windows\System\vpyQiVj.exe
  C:\Windows\System\vpyQiVj.exe
  2⤵
  PID:8928
- C:\Windows\System\nSvomVJ.exe
  C:\Windows\System\nSvomVJ.exe
  2⤵
  PID:8944
- C:\Windows\System\zPELaYj.exe
  C:\Windows\System\zPELaYj.exe
  2⤵
  PID:8960
- C:\Windows\System\BVIsZsA.exe
  C:\Windows\System\BVIsZsA.exe
  2⤵
  PID:8980
- C:\Windows\System\sNHmeEH.exe
  C:\Windows\System\sNHmeEH.exe
  2⤵
  PID:8996
- C:\Windows\System\AcFLymb.exe
  C:\Windows\System\AcFLymb.exe
  2⤵
  PID:9012
- C:\Windows\System\UMsIOEm.exe
  C:\Windows\System\UMsIOEm.exe
  2⤵
  PID:9028
- C:\Windows\System\hOHmFaJ.exe
  C:\Windows\System\hOHmFaJ.exe
  2⤵
  PID:9044
- C:\Windows\System\ORhZGaI.exe
  C:\Windows\System\ORhZGaI.exe
  2⤵
  PID:9060
- C:\Windows\System\MhPAnCV.exe
  C:\Windows\System\MhPAnCV.exe
  2⤵
  PID:9144
- C:\Windows\System\QbnszHO.exe
  C:\Windows\System\QbnszHO.exe
  2⤵
  PID:9164
- C:\Windows\System\jGQfHhf.exe
  C:\Windows\System\jGQfHhf.exe
  2⤵
  PID:9180
- C:\Windows\System\TVWzHzg.exe
  C:\Windows\System\TVWzHzg.exe
  2⤵
  PID:9196
- C:\Windows\System\ehcoojN.exe
  C:\Windows\System\ehcoojN.exe
  2⤵
  PID:9212
- C:\Windows\System\UTwyfoT.exe
  C:\Windows\System\UTwyfoT.exe
  2⤵
  PID:7536
- C:\Windows\System\EPbEOWF.exe
  C:\Windows\System\EPbEOWF.exe
  2⤵
  PID:8216
- C:\Windows\System\pOBCyNM.exe
  C:\Windows\System\pOBCyNM.exe
  2⤵
  PID:8212
- C:\Windows\System\krKZVOI.exe
  C:\Windows\System\krKZVOI.exe
  2⤵
  PID:8292
- C:\Windows\System\QTvrnZL.exe
  C:\Windows\System\QTvrnZL.exe
  2⤵
  PID:8356
- C:\Windows\System\SFuqVkU.exe
  C:\Windows\System\SFuqVkU.exe
  2⤵
  PID:8336
- C:\Windows\System\nVglGgD.exe
  C:\Windows\System\nVglGgD.exe
  2⤵
  PID:1492
- C:\Windows\System\DhlmYEx.exe
  C:\Windows\System\DhlmYEx.exe
  2⤵
  PID:8448
- C:\Windows\System\uetOLcJ.exe
  C:\Windows\System\uetOLcJ.exe
  2⤵
  PID:8400
- C:\Windows\System\gnbPBbr.exe
  C:\Windows\System\gnbPBbr.exe
  2⤵
  PID:8432
- C:\Windows\System\NTTYCkD.exe
  C:\Windows\System\NTTYCkD.exe
  2⤵
  PID:8468
- C:\Windows\System\kYyoydK.exe
  C:\Windows\System\kYyoydK.exe
  2⤵
  PID:8528
- C:\Windows\System\MYqZaJD.exe
  C:\Windows\System\MYqZaJD.exe
  2⤵
  PID:8592
- C:\Windows\System\OrIdmfT.exe
  C:\Windows\System\OrIdmfT.exe
  2⤵
  PID:8660
- C:\Windows\System\bckvwed.exe
  C:\Windows\System\bckvwed.exe
  2⤵
  PID:8724
- C:\Windows\System\kHmGjZh.exe
  C:\Windows\System\kHmGjZh.exe
  2⤵
  PID:8788
- C:\Windows\System\AvznhRc.exe
  C:\Windows\System\AvznhRc.exe
  2⤵
  PID:8872
- C:\Windows\System\EHkSKxt.exe
  C:\Windows\System\EHkSKxt.exe
  2⤵
  PID:8892
- C:\Windows\System\YMksmLf.exe
  C:\Windows\System\YMksmLf.exe
  2⤵
  PID:8920
- C:\Windows\System\dyrZFEf.exe
  C:\Windows\System\dyrZFEf.exe
  2⤵
  PID:8956
- C:\Windows\System\laDUezU.exe
  C:\Windows\System\laDUezU.exe
  2⤵
  PID:9056
- C:\Windows\System\NddgUQb.exe
  C:\Windows\System\NddgUQb.exe
  2⤵
  PID:8544
- C:\Windows\System\XQEpwog.exe
  C:\Windows\System\XQEpwog.exe
  2⤵
  PID:8744
- C:\Windows\System\BwRpnOM.exe
  C:\Windows\System\BwRpnOM.exe
  2⤵
  PID:9068
- C:\Windows\System\KuJYmoU.exe
  C:\Windows\System\KuJYmoU.exe
  2⤵
  PID:8576
- C:\Windows\System\zyUtPIW.exe
  C:\Windows\System\zyUtPIW.exe
  2⤵
  PID:8676
- C:\Windows\System\UAAznYU.exe
  C:\Windows\System\UAAznYU.exe
  2⤵
  PID:8772
- C:\Windows\System\alPSEmN.exe
  C:\Windows\System\alPSEmN.exe
  2⤵
  PID:8836
- C:\Windows\System\zwyhsUz.exe
  C:\Windows\System\zwyhsUz.exe
  2⤵
  PID:8936
- C:\Windows\System\HwvsEoL.exe
  C:\Windows\System\HwvsEoL.exe
  2⤵
  PID:9004
- C:\Windows\System\eWFbQDK.exe
  C:\Windows\System\eWFbQDK.exe
  2⤵
  PID:8808
- C:\Windows\System\brtdiFB.exe
  C:\Windows\System\brtdiFB.exe
  2⤵
  PID:9084
- C:\Windows\System\QmsFSGk.exe
  C:\Windows\System\QmsFSGk.exe
  2⤵
  PID:9100
- C:\Windows\System\kViDeEE.exe
  C:\Windows\System\kViDeEE.exe
  2⤵
  PID:9116
- C:\Windows\System\KYKDuyy.exe
  C:\Windows\System\KYKDuyy.exe
  2⤵
  PID:9132
- C:\Windows\System\wTZAuTb.exe
  C:\Windows\System\wTZAuTb.exe
  2⤵
  PID:9156
- C:\Windows\System\tFFveTl.exe
  C:\Windows\System\tFFveTl.exe
  2⤵
  PID:9176
- C:\Windows\System\QYgbvtr.exe
  C:\Windows\System\QYgbvtr.exe
  2⤵
  PID:8072
- C:\Windows\System\WfyDhfj.exe
  C:\Windows\System\WfyDhfj.exe
  2⤵
  PID:8288
- C:\Windows\System\kRcNmLc.exe
  C:\Windows\System\kRcNmLc.exe
  2⤵
  PID:8564
- C:\Windows\System\snQwMNA.exe
  C:\Windows\System\snQwMNA.exe
  2⤵
  PID:9076
- C:\Windows\System\JWPuyrF.exe
  C:\Windows\System\JWPuyrF.exe
  2⤵
  PID:9096
- C:\Windows\System\dKMfJRG.exe
  C:\Windows\System\dKMfJRG.exe
  2⤵
  PID:9152
- C:\Windows\System\OGvvrPZ.exe
  C:\Windows\System\OGvvrPZ.exe
  2⤵
  PID:7232
- C:\Windows\System\uaktrbW.exe
  C:\Windows\System\uaktrbW.exe
  2⤵
  PID:8324
- C:\Windows\System\xpnWvtD.exe
  C:\Windows\System\xpnWvtD.exe
  2⤵
  PID:8240
- C:\Windows\System\iOYqcmy.exe
  C:\Windows\System\iOYqcmy.exe
  2⤵
  PID:8868
- C:\Windows\System\pIrCNLe.exe
  C:\Windows\System\pIrCNLe.exe
  2⤵
  PID:8276
- C:\Windows\System\HQTcIIH.exe
  C:\Windows\System\HQTcIIH.exe
  2⤵
  PID:8756
- C:\Windows\System\NkYKUyc.exe
  C:\Windows\System\NkYKUyc.exe
  2⤵
  PID:8760
- C:\Windows\System\kpAlmiP.exe
  C:\Windows\System\kpAlmiP.exe
  2⤵
  PID:9024
- C:\Windows\System\mblhjqG.exe
  C:\Windows\System\mblhjqG.exe
  2⤵
  PID:8712
- C:\Windows\System\KspCSYc.exe
  C:\Windows\System\KspCSYc.exe
  2⤵
  PID:9204
- C:\Windows\System\jItbFwH.exe
  C:\Windows\System\jItbFwH.exe
  2⤵
  PID:8908
- C:\Windows\System\hRnYuEr.exe
  C:\Windows\System\hRnYuEr.exe
  2⤵
  PID:8848
- C:\Windows\System\BXrQAQj.exe
  C:\Windows\System\BXrQAQj.exe
  2⤵
  PID:9080
- C:\Windows\System\edTUFER.exe
  C:\Windows\System\edTUFER.exe
  2⤵
  PID:9136
- C:\Windows\System\QiQtbvG.exe
  C:\Windows\System\QiQtbvG.exe
  2⤵
  PID:8628
- C:\Windows\System\QppCLqd.exe
  C:\Windows\System\QppCLqd.exe
  2⤵
  PID:8516
- C:\Windows\System\uNbmzwy.exe
  C:\Windows\System\uNbmzwy.exe
  2⤵
  PID:8560
- C:\Windows\System\icIdVfZ.exe
  C:\Windows\System\icIdVfZ.exe
  2⤵
  PID:8644
- C:\Windows\System\QUUKWjP.exe
  C:\Windows\System\QUUKWjP.exe
  2⤵
  PID:8864
- C:\Windows\System\cAeJHyD.exe
  C:\Windows\System\cAeJHyD.exe
  2⤵
  PID:8976
- C:\Windows\System\HsEIGLi.exe
  C:\Windows\System\HsEIGLi.exe
  2⤵
  PID:8308
- C:\Windows\System\imOFCxf.exe
  C:\Windows\System\imOFCxf.exe
  2⤵
  PID:8272
- C:\Windows\System\kSgpKlk.exe
  C:\Windows\System\kSgpKlk.exe
  2⤵
  PID:8352
- C:\Windows\System\MUMDYiZ.exe
  C:\Windows\System\MUMDYiZ.exe
  2⤵
  PID:8512
- C:\Windows\System\cAktXdS.exe
  C:\Windows\System\cAktXdS.exe
  2⤵
  PID:8940
- C:\Windows\System\HAzfbgf.exe
  C:\Windows\System\HAzfbgf.exe
  2⤵
  PID:8696
- C:\Windows\System\kmfWCVg.exe
  C:\Windows\System\kmfWCVg.exe
  2⤵
  PID:7264
- C:\Windows\System\mllnpoF.exe
  C:\Windows\System\mllnpoF.exe
  2⤵
  PID:8952
- C:\Windows\System\uDgzJPD.exe
  C:\Windows\System\uDgzJPD.exe
  2⤵
  PID:9228
- C:\Windows\System\URHeGkj.exe
  C:\Windows\System\URHeGkj.exe
  2⤵
  PID:9244
- C:\Windows\System\THEwoPQ.exe
  C:\Windows\System\THEwoPQ.exe
  2⤵
  PID:9260
- C:\Windows\System\JdbwZRY.exe
  C:\Windows\System\JdbwZRY.exe
  2⤵
  PID:9276
- C:\Windows\System\zjTzIZD.exe
  C:\Windows\System\zjTzIZD.exe
  2⤵
  PID:9292
- C:\Windows\System\WifCepH.exe
  C:\Windows\System\WifCepH.exe
  2⤵
  PID:9308
- C:\Windows\System\osMyzHE.exe
  C:\Windows\System\osMyzHE.exe
  2⤵
  PID:9324
- C:\Windows\System\BusHyzc.exe
  C:\Windows\System\BusHyzc.exe
  2⤵
  PID:9340
- C:\Windows\System\eAOtjBa.exe
  C:\Windows\System\eAOtjBa.exe
  2⤵
  PID:9356
- C:\Windows\System\vpYDYnU.exe
  C:\Windows\System\vpYDYnU.exe
  2⤵
  PID:9372
- C:\Windows\System\ZfdmoIV.exe
  C:\Windows\System\ZfdmoIV.exe
  2⤵
  PID:9388
- C:\Windows\System\PXtIpLo.exe
  C:\Windows\System\PXtIpLo.exe
  2⤵
  PID:9404
- C:\Windows\System\SFIIcnL.exe
  C:\Windows\System\SFIIcnL.exe
  2⤵
  PID:9420
- C:\Windows\System\CRAdlzO.exe
  C:\Windows\System\CRAdlzO.exe
  2⤵
  PID:9436
- C:\Windows\System\dAoPHsV.exe
  C:\Windows\System\dAoPHsV.exe
  2⤵
  PID:9452
- C:\Windows\System\iEJnMFO.exe
  C:\Windows\System\iEJnMFO.exe
  2⤵
  PID:9468
- C:\Windows\System\wukpofa.exe
  C:\Windows\System\wukpofa.exe
  2⤵
  PID:9484
- C:\Windows\System\ltfeHXP.exe
  C:\Windows\System\ltfeHXP.exe
  2⤵
  PID:9500
- C:\Windows\System\zNGKsoJ.exe
  C:\Windows\System\zNGKsoJ.exe
  2⤵
  PID:9516
- C:\Windows\System\ilTdVmY.exe
  C:\Windows\System\ilTdVmY.exe
  2⤵
  PID:9532
- C:\Windows\System\btRQgxU.exe
  C:\Windows\System\btRQgxU.exe
  2⤵
  PID:9548
- C:\Windows\System\wxFsoha.exe
  C:\Windows\System\wxFsoha.exe
  2⤵
  PID:9564
- C:\Windows\System\EfeSNkD.exe
  C:\Windows\System\EfeSNkD.exe
  2⤵
  PID:9580
- C:\Windows\System\kWsDGot.exe
  C:\Windows\System\kWsDGot.exe
  2⤵
  PID:9596
- C:\Windows\System\BHkidLJ.exe
  C:\Windows\System\BHkidLJ.exe
  2⤵
  PID:9612
- C:\Windows\System\MILYxsS.exe
  C:\Windows\System\MILYxsS.exe
  2⤵
  PID:9628
- C:\Windows\System\ssJtOdH.exe
  C:\Windows\System\ssJtOdH.exe
  2⤵
  PID:9644
- C:\Windows\System\XelPDno.exe
  C:\Windows\System\XelPDno.exe
  2⤵
  PID:9660
- C:\Windows\System\SVDWCId.exe
  C:\Windows\System\SVDWCId.exe
  2⤵
  PID:9676
- C:\Windows\System\JkhTymK.exe
  C:\Windows\System\JkhTymK.exe
  2⤵
  PID:9692
- C:\Windows\System\RpuLTbJ.exe
  C:\Windows\System\RpuLTbJ.exe
  2⤵
  PID:9708
- C:\Windows\System\XfIMvUQ.exe
  C:\Windows\System\XfIMvUQ.exe
  2⤵
  PID:9724
- C:\Windows\System\JSMVxtD.exe
  C:\Windows\System\JSMVxtD.exe
  2⤵
  PID:9740
- C:\Windows\System\vbJuxcS.exe
  C:\Windows\System\vbJuxcS.exe
  2⤵
  PID:9756
- C:\Windows\System\pVICXTQ.exe
  C:\Windows\System\pVICXTQ.exe
  2⤵
  PID:9820
- C:\Windows\System\EoigVzq.exe
  C:\Windows\System\EoigVzq.exe
  2⤵
  PID:9928
- C:\Windows\System\jZxCMrc.exe
  C:\Windows\System\jZxCMrc.exe
  2⤵
  PID:9944
- C:\Windows\System\wcIrkQN.exe
  C:\Windows\System\wcIrkQN.exe
  2⤵
  PID:9968
- C:\Windows\System\MsTBmMQ.exe
  C:\Windows\System\MsTBmMQ.exe
  2⤵
  PID:10064
- C:\Windows\System\VOjEdNy.exe
  C:\Windows\System\VOjEdNy.exe
  2⤵
  PID:10088
- C:\Windows\System\jVpSJRm.exe
  C:\Windows\System\jVpSJRm.exe
  2⤵
  PID:10104
- C:\Windows\System\IOWfbbG.exe
  C:\Windows\System\IOWfbbG.exe
  2⤵
  PID:10120
- C:\Windows\System\iQXbePf.exe
  C:\Windows\System\iQXbePf.exe
  2⤵
  PID:10136
- C:\Windows\System\BPlUPet.exe
  C:\Windows\System\BPlUPet.exe
  2⤵
  PID:10152
- C:\Windows\System\zzdnvPX.exe
  C:\Windows\System\zzdnvPX.exe
  2⤵
  PID:10168
- C:\Windows\System\YRKuIIP.exe
  C:\Windows\System\YRKuIIP.exe
  2⤵
  PID:10184
- C:\Windows\System\ueRfthu.exe
  C:\Windows\System\ueRfthu.exe
  2⤵
  PID:10200
- C:\Windows\System\fcRetOE.exe
  C:\Windows\System\fcRetOE.exe
  2⤵
  PID:10216
- C:\Windows\System\CUugkBS.exe
  C:\Windows\System\CUugkBS.exe
  2⤵
  PID:10232
- C:\Windows\System\mShUwVY.exe
  C:\Windows\System\mShUwVY.exe
  2⤵
  PID:8804
- C:\Windows\System\qvvBPga.exe
  C:\Windows\System\qvvBPga.exe
  2⤵
  PID:8648
- C:\Windows\System\KnRwqmc.exe
  C:\Windows\System\KnRwqmc.exe
  2⤵
  PID:9240
- C:\Windows\System\CpqAnsU.exe
  C:\Windows\System\CpqAnsU.exe
  2⤵
  PID:9268
- C:\Windows\System\DOKRyCi.exe
  C:\Windows\System\DOKRyCi.exe
  2⤵
  PID:9332
- C:\Windows\System\ONfGpmA.exe
  C:\Windows\System\ONfGpmA.exe
  2⤵
  PID:9320
- C:\Windows\System\uhYzEiF.exe
  C:\Windows\System\uhYzEiF.exe
  2⤵
  PID:9352
- C:\Windows\System\cUlpSDl.exe
  C:\Windows\System\cUlpSDl.exe
  2⤵
  PID:9384
- C:\Windows\System\yInrIvQ.exe
  C:\Windows\System\yInrIvQ.exe
  2⤵
  PID:9444
- C:\Windows\System\smhHjMR.exe
  C:\Windows\System\smhHjMR.exe
  2⤵
  PID:9508
- C:\Windows\System\LIrHUvV.exe
  C:\Windows\System\LIrHUvV.exe
  2⤵
  PID:9572
- C:\Windows\System\bNmQSps.exe
  C:\Windows\System\bNmQSps.exe
  2⤵
  PID:9620
- C:\Windows\System\dybqNHS.exe
  C:\Windows\System\dybqNHS.exe
  2⤵
  PID:9684
- C:\Windows\System\IXvOLjf.exe
  C:\Windows\System\IXvOLjf.exe
  2⤵
  PID:9720
- C:\Windows\System\aZkwEhj.exe
  C:\Windows\System\aZkwEhj.exe
  2⤵
  PID:9752
- C:\Windows\System\RyoffgY.exe
  C:\Windows\System\RyoffgY.exe
  2⤵
  PID:9672
- C:\Windows\System\fsLSgVF.exe
  C:\Windows\System\fsLSgVF.exe
  2⤵
  PID:9736
- C:\Windows\System\pENvwWE.exe
  C:\Windows\System\pENvwWE.exe
  2⤵
  PID:9776
- C:\Windows\System\EAgehIU.exe
  C:\Windows\System\EAgehIU.exe
  2⤵
  PID:9792
- C:\Windows\System\vpVyIGl.exe
  C:\Windows\System\vpVyIGl.exe
  2⤵
  PID:9812
- C:\Windows\System\olNhgkR.exe
  C:\Windows\System\olNhgkR.exe
  2⤵
  PID:9872
- C:\Windows\System\zVoAoQW.exe
  C:\Windows\System\zVoAoQW.exe
  2⤵
  PID:9840
- C:\Windows\System\pAuXkhY.exe
  C:\Windows\System\pAuXkhY.exe
  2⤵
  PID:9856
- C:\Windows\System\kuDaQAi.exe
  C:\Windows\System\kuDaQAi.exe
  2⤵
  PID:9888
- C:\Windows\System\fWhOXuZ.exe
  C:\Windows\System\fWhOXuZ.exe
  2⤵
  PID:9940
- C:\Windows\System\acXcjuP.exe
  C:\Windows\System\acXcjuP.exe
  2⤵
  PID:9952
- C:\Windows\System\Cvkehjs.exe
  C:\Windows\System\Cvkehjs.exe
  2⤵
  PID:10248
- C:\Windows\System\cbEQqzY.exe
  C:\Windows\System\cbEQqzY.exe
  2⤵
  PID:10264
- C:\Windows\System\aZWcJnS.exe
  C:\Windows\System\aZWcJnS.exe
  2⤵
  PID:10284
- C:\Windows\System\HldKDFP.exe
  C:\Windows\System\HldKDFP.exe
  2⤵
  PID:10300
- C:\Windows\System\PeQVjIV.exe
  C:\Windows\System\PeQVjIV.exe
  2⤵
  PID:10316
- C:\Windows\System\XevQHwq.exe
  C:\Windows\System\XevQHwq.exe
  2⤵
  PID:10340
- C:\Windows\System\GXUEvTf.exe
  C:\Windows\System\GXUEvTf.exe
  2⤵
  PID:10356
- C:\Windows\System\jENyaxu.exe
  C:\Windows\System\jENyaxu.exe
  2⤵
  PID:10372
- C:\Windows\System\sQNodDS.exe
  C:\Windows\System\sQNodDS.exe
  2⤵
  PID:10392
- C:\Windows\System\ywJCoCA.exe
  C:\Windows\System\ywJCoCA.exe
  2⤵
  PID:10408
- C:\Windows\System\lfZYdhf.exe
  C:\Windows\System\lfZYdhf.exe
  2⤵
  PID:10424
- C:\Windows\System\HZAHVus.exe
  C:\Windows\System\HZAHVus.exe
  2⤵
  PID:10444
- C:\Windows\System\DhBrMis.exe
  C:\Windows\System\DhBrMis.exe
  2⤵
  PID:10460
- C:\Windows\System\hITRCQj.exe
  C:\Windows\System\hITRCQj.exe
  2⤵
  PID:10480
- C:\Windows\System\XqBzbGt.exe
  C:\Windows\System\XqBzbGt.exe
  2⤵
  PID:10504
- C:\Windows\System\YZRZlFk.exe
  C:\Windows\System\YZRZlFk.exe
  2⤵
  PID:10520
- C:\Windows\System\DIIqmTF.exe
  C:\Windows\System\DIIqmTF.exe
  2⤵
  PID:10540
- C:\Windows\System\djEErPj.exe
  C:\Windows\System\djEErPj.exe
  2⤵
  PID:10556
- C:\Windows\System\FUuxOMa.exe
  C:\Windows\System\FUuxOMa.exe
  2⤵
  PID:10652
- C:\Windows\System\blnXklv.exe
  C:\Windows\System\blnXklv.exe
  2⤵
  PID:10680
- C:\Windows\System\qixqKpo.exe
  C:\Windows\System\qixqKpo.exe
  2⤵
  PID:10696
- C:\Windows\System\SXUkevq.exe
  C:\Windows\System\SXUkevq.exe
  2⤵
  PID:10712
- C:\Windows\System\PbEYRAZ.exe
  C:\Windows\System\PbEYRAZ.exe
  2⤵
  PID:10728
- C:\Windows\System\hVCIGxp.exe
  C:\Windows\System\hVCIGxp.exe
  2⤵
  PID:10744
- C:\Windows\System\zYJnOQC.exe
  C:\Windows\System\zYJnOQC.exe
  2⤵
  PID:10764
- C:\Windows\System\CPNZpVl.exe
  C:\Windows\System\CPNZpVl.exe
  2⤵
  PID:10780
- C:\Windows\System\ZUEvXoG.exe
  C:\Windows\System\ZUEvXoG.exe
  2⤵
  PID:10796
- C:\Windows\System\lbyNQwG.exe
  C:\Windows\System\lbyNQwG.exe
  2⤵
  PID:10812
- C:\Windows\System\SRhudqG.exe
  C:\Windows\System\SRhudqG.exe
  2⤵
  PID:10828
- C:\Windows\System\JLgBEKm.exe
  C:\Windows\System\JLgBEKm.exe
  2⤵
  PID:10856
- C:\Windows\System\PioXGLd.exe
  C:\Windows\System\PioXGLd.exe
  2⤵
  PID:10880
- C:\Windows\System\vGsuSrM.exe
  C:\Windows\System\vGsuSrM.exe
  2⤵
  PID:10896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AZvBJKI.exe

Filesize
1.8MB

MD5
7e878f1af0d65c18566bad08721cac07

SHA1
bf28a2e492cc9cade36a413742f0d9bdd83e10e7

SHA256
19c9c55ca05e5021d3b52a75f171ebb872977fb17daa39cf573786274838cc73

SHA512
f8ea1ed1e4bcd7c414dee1648cacc597e61011484f7ec8a7e1728e6badaff32f3a52b60e182b2681deb554ad2dddc28fd23afe2080e5e3a5eda70733bfc6fb11

Download Submit
C:\Windows\system\BmWkOui.exe

Filesize
1.8MB

MD5
4bb0dcd150e2b82b8264aa0b31903e98

SHA1
712173bea7db0e3df2d44b1e642a21f55aa615d6

SHA256
7b2d78bfb70f75e1133b58b76c35cf9474be2cbf5560d43ced92be0ce35f1411

SHA512
7c8170eec752fe53002c0e244a2a9619f505760e7c43d208b5d8e090a4048246613385f3d1a8ca703e543bcc11ae06f1486b55109e97fa7f76e36be664737ec1

Download Submit
C:\Windows\system\CXjRhhx.exe

Filesize
1.8MB

MD5
1302b71903c060175a29fbc8a18f31ca

SHA1
6e7ba9492563a47806a2481d87c383842dc75ae5

SHA256
25bb2e677be3d5e854c2708d636a39da875939f8740d16dbcbc8ddd370e5a350

SHA512
2a177b38e1118a2262bec653657802b2b821b59dff53e90fbf435abb3f73584e00d0b72e2437c435782777a1ada80d8d7e42c12fd78545bfbca49cfddb4fcb29

Download Submit
C:\Windows\system\EpitSYn.exe

Filesize
1.8MB

MD5
871f0c53d6eb96fe6fd629e84624c624

SHA1
79da7f1952976c7bc51836c01093e7a2c69094d2

SHA256
c55ed2a5f4a810ee12e70e6745e51622f0d46bf14dc8b7cb95dacef2b6fcfb3a

SHA512
7b866df1fb16450d2679c826d2572e4f7845b400400f3044c2b5d73bbbdcbcb2a729278d2d8eee1d5852459bf232dff476ecafc0432a5e0802fb6a8fc078b3bf

Download Submit
C:\Windows\system\GmNOTTK.exe

Filesize
1.8MB

MD5
a3e3c4d47bf87a84b137f60756c31ad1

SHA1
1a449aa3db66680ffa3e66f29cae56cf2580537c

SHA256
729d15e0e6059ac36ee1b84852bcf9784b3775c907279c47ba459ea58a07fcd6

SHA512
30f3456376177259b5de244e55fa792da74dd63302065d8923df5eab344fa59d4d451094423f590f1e9487aa3a6279e1a4adea6e456ebc800da06dab3626bddf

Download Submit
C:\Windows\system\IzAmDNd.exe

Filesize
1.8MB

MD5
852f63b6b7f795a0229eb0c8d8631d14

SHA1
226d67e11de82c8b6f3efb791b26196871726cb6

SHA256
f5d18a19804f7a3421c998f2908d42f1d978db299f351815b44b108e38e1fdd0

SHA512
b15eed3b35390ea9627bbda4e5c6ca4693870e51f3f6372048db326560012546d67836f7a3e2ade80190e8fce5ed130d275b69ca5d1d9773d047bb81cb434238

Download Submit
C:\Windows\system\LuZzGDA.exe

Filesize
1.8MB

MD5
a71d0e953a76e647bdfae112a5c12c27

SHA1
0d419a4b537b18745f0dda26d476a7a3cbdbd32c

SHA256
3a4bcb6e1de892fbe2a9e6703f15b439d416b12009acabb097dcb668cad4e771

SHA512
52a0b4c1685508d80b95a86bdf796c1f953a95da8d4ac422231c3b758042a6f272b955d861a22b229dd065ed3ddc68d7d5e55b5396912b8c7f8d3aa15214c7df

Download Submit
C:\Windows\system\MIXVmWb.exe

Filesize
1.8MB

MD5
e62d7c4ba8dac02263deb700a75492c6

SHA1
a3916377ed540c014d154fe8fdbab0c2b291cfff

SHA256
eea0b1decd64df41aa9f2c2d8104b4df4d3ef91df73136ea49e414c23ea8a39d

SHA512
f2e7b32e497cb860ed4148a715106399cbb35e01f105996f1aab032a0839d92057b3482e9cf33ceddc1efdee7ff88beefb0e58cde69697042fe499d8786b58a3

Download Submit
C:\Windows\system\PCvcfjK.exe

Filesize
1.8MB

MD5
b6b348511e1f4473bc0111755f486a52

SHA1
ae49258b2eb2927b791072dbd4e89da87a20cb87

SHA256
b0bbcce62dc606965539c25a2fe2fd338b976f4c1e1159bb869760f62fe87584

SHA512
be54abb3462d3200c49a98a6177b4086af773cbe1edc0ce06e50dabfeefade02241a55c2d0daf52b933dc6ca379478e9aad4755504f5f3fa73248f721823f1eb

Download Submit
C:\Windows\system\PDruAin.exe

Filesize
1.8MB

MD5
93419cdbc5824a452c6400472f3114b7

SHA1
c3bb06bf83c0da205861234eae856807dd617e8d

SHA256
c64124e391b241f948214237ee4da82a84b687633b2d5551d67396b4f47030e6

SHA512
7e5088dc038554a600c03a10fbf45dd24cea7e0963134fe7684cf3c8886cbada3d5ae935d4ad71241b76cd606f18c681aeb89bf536b8db73bdf5fe698119fcce

Download Submit
C:\Windows\system\RLFOcMs.exe

Filesize
1.8MB

MD5
2ce37ef78b81f301c71a913df668dd73

SHA1
1dae9d711c56afc9da4228e7f20fcd129edf40d5

SHA256
12d620d3c4a7d737da5ae523e06563bd1d4edbf2080e3f868c67d4e4b77aadb3

SHA512
5a11878e7ea81efdd613859dd9fc03eea037322cfc1785c6e7c28aa18f69d5a3c7dd2c4a8d8dd7a955c0f3e0308068aad35da18f093783db232f85f7a38a05aa

Download Submit
C:\Windows\system\TdMWpyu.exe

Filesize
1.8MB

MD5
ad2af4128965a3b21c562aa041578538

SHA1
cab11c9ddf0feef0b39a485d9be49ed6b9a7e4cc

SHA256
90aa6a903daee9ff9289d3444a1d29e6065db47c8c6b2e3297bccfaf4d25ba68

SHA512
4da60293ac1b9fe04370aa7ddbf30cb5c8b3767b043f01488354b3beb8857f420eb866c22929dbafabaeb5b522ac8bd63f88a3aff0879b166156c0b385e7f0e4

Download Submit
C:\Windows\system\WcVFZKw.exe

Filesize
1.8MB

MD5
7bb040ac451fc3ad3648a135c232f1b9

SHA1
d17e826ddcf033865c1e36a23ddcf84015018a35

SHA256
39eda920557cfc11f59e619d80d3d7f4933b8140a56124adb9306b2dd40bd459

SHA512
80f966670673a5e5f76770e6cfab5d301a988a26baa41c1cc218aa768ed009dc639c1a6b823e422fc00aab7ab10d9ba3aa84fe88d4d671f24deee2e8db9d7979

Download Submit
C:\Windows\system\aLleWDY.exe

Filesize
1.8MB

MD5
3dcc41ab6968becf11820e10fb6c3aa9

SHA1
9abbe01ed4e7c0ec571846f86701d937a45e3aa7

SHA256
1f9f8203493a0832ea0b21fdc2f7dd6ef82fe6e9104795cda5abc0603bc6af37

SHA512
f8136421dacb34bc3ad9dea089220c137e991444396c97d998ac4daf9ee5af951d449916f3cedcdd3e5daa9b61e4848e0d0640758ed34b708fa2fc4167c3f38a

Download Submit
C:\Windows\system\aMATBTP.exe

Filesize
1.8MB

MD5
7f7688b7e4de34f7b2d984aae5573d41

SHA1
50bd4dd1d06885c840e5ae2d2fea83740ba1c6dc

SHA256
c1f8ddc35fe70c66f1635675c4a885041c7558ae1f4df53f66fbba1399f12669

SHA512
a192ea3b407146d4884a0e37b95bd6a6b29c64287797810cebb259067f0a2289bcb8fb08b4276f970d040282dd5a410981d101a2a006556aaa9a6e7d45125f5b

Download Submit
C:\Windows\system\axPplhn.exe

Filesize
1.8MB

MD5
98e316918a3376ab6f0d0977ffc73554

SHA1
8dacd33b9bed1e5433e23160e5c5c611681460e9

SHA256
625a94a6e7f8f693b0dbd57208cec1544d16b613b01dc2ac565aed498ee2df24

SHA512
b7a2fab3da557b2c800ebc381fe9e96a28dec3b9ae2983f6deacdc3dd417c81babcf182d765f6ab8e2e3f8844349ff28c5aecac188e591a1adddf9f07746c54e

Download Submit
C:\Windows\system\axabDwq.exe

Filesize
1.8MB

MD5
ed40c8509e2a35d84cca43e087b2c2a2

SHA1
15a036c4c4f155c34ed9c9ea20f667c360bc041b

SHA256
b8b3acb5d0ea73d31e7567c45f313963577bbba233ab4eb1afab93855bea10fe

SHA512
9b1902a0ea6dff187b5becbcfa274d9260def135c21ef7081011598c5557563209996bc4331a6b7166a96938f14b6ce9cc58567833806e87adbcb3dea44a8c5c

Download Submit
C:\Windows\system\gTLCHfW.exe

Filesize
1.8MB

MD5
88067ddd6945383869b24159553c09bb

SHA1
edd7419b42f1f75a914a82211deff0bc3d55f3b8

SHA256
cc301f23e87588448993a6b1f56020351d6f66491ae3908c529ebcf4acbcfaa7

SHA512
a959bfd98d62ea6b8ce12ee5cac35d21d6ef593ccea4cb5912f5203c14be91bdf130f715c334ecd80e8aa939c8adfd9283604ce056dd91756d4cdee0592822e4

Download Submit
C:\Windows\system\khWZvnp.exe

Filesize
1.8MB

MD5
49021f507816745c44fc0d028719e61f

SHA1
e0ce68bd35280231bb02d0ef000515e21e58e0af

SHA256
17570b51a0bb1cca022e97824ed6b0b1c7c2b213cda130e647f1f424dca0c059

SHA512
d3f1b34368d0a3c1f45111e70374d7914e48ec7604c28e1e14ac7cbd9bd529da406e87e5521c9a240c696d020e22008ee6c84de4d4e34a464369597bc243423f

Download Submit
C:\Windows\system\lsRSFBi.exe

Filesize
1.8MB

MD5
9252528d15cc3064923766f5a292c1b9

SHA1
c16fae590b334af646d5d27f3d465687a58b0e2d

SHA256
33cea4db197fc6014fa70d6d2f3e0a52ebdb2187300a1ec2093c89fdf29baac0

SHA512
cdbc380101af0ecc5b854a4659ebb6ba0665db06750ed96cad3b5473e3bc533f471f996f4133bf01031bbc2d8d4bfca8f90bacfec11c855ca071c8c2cc28bb00

Download Submit
C:\Windows\system\oTarkHB.exe

Filesize
1.8MB

MD5
bca98c9b8e62ea0e5269ac1e5d5e17e2

SHA1
7f1067ec3a1c0e1114cbf19775ca70dcf96f3bcf

SHA256
7b3d3e155e006670d1bfe27fc860e70df86a7da12355a63ccb8304eac27a879e

SHA512
43d721090c1d3a9cac740b9415c0cd66ac395aa5c577a6c0929420f9a4e316258f1e6c271605cd56851188cf5da91bc08690cfc81ab1355dd2ff5e2541be676f

Download Submit
C:\Windows\system\obsVAke.exe

Filesize
1.8MB

MD5
1352d91cf44d5bb564ab919311c1e566

SHA1
d879c42f350b917a5e5336b7c00fdb1ac88371ac

SHA256
9050840eceda00528783297c9cb00e2bb9934aa816fe5f96fe35dae66a6fa92c

SHA512
23e37bf06ae967e81bcf8dea3acff31221573ef809929a740f0853535c1d130205a11861afdc86e70ae1db71f3521f3c2528be4d04fa6e4b9cc56144c1b505a9

Download Submit
C:\Windows\system\tqBnTIW.exe

Filesize
1.8MB

MD5
cadc392c6425aba013023377b6e1ed77

SHA1
8d0f82ebc51023694128545fc08665837594c8ea

SHA256
a814c5ce4798bd19e2daa5e877cdf4777f10a42a534035a806f4b5252e0c587f

SHA512
a512fae0dfc189e2a515c2a66bc7c96fcea7a629293e9e432b1d09427b5af1b0bc6b519b3f773526d57116580bc245f4554c25de8e20ee9c8009cdeda2daa568

Download Submit
C:\Windows\system\xvetzIl.exe

Filesize
1.8MB

MD5
e08e41784b4aee62ffcfb6dec4e2f99a

SHA1
91717f2760453062e81fc389fa226db8cd4c4193

SHA256
b625b21ac7a8b3d9b9ce69b8bf5714f65c8daf7c2c779642325d036ed3a17f7f

SHA512
c622744cbb14873ee15f2cc601ca0ec38fac8cf9f3343301a0a6e5ddafd06192b6f8c1360cea6b44c8c4a2af881c2d332b4cacab26dfaf047afc8863985a3efc

Download Submit
\Windows\system\AIeHQyv.exe

Filesize
1.8MB

MD5
582dd319ed00b2ca74468b31ccfb899a

SHA1
1ee73dcb9a796328acec60826c85bdd9a0492390

SHA256
333f81b313d1702e5366c23f11a0845e8538164bc83a830ba7eccfb2d8df43df

SHA512
bf4488308ebaf1ad012f2d93fcc73a949a79c3c8287505359b41c4bb03d87fb1ba706ba191eb23fdadb18521bba55151ce91e7bc15b313cfd113bcfc574312f2

Download Submit
\Windows\system\Hcajdiu.exe

Filesize
1.8MB

MD5
589ab377c02314d3a085155e7c0ac88e

SHA1
11a52cd238e1a4cf3557b0ed66c84de14fdf26a0

SHA256
50bda13b2ea0473aaca4aaedf83bcd607c821ae429d49d644c6e9f58198714dc

SHA512
5c7bbd2069f22e004a1c53b536a0e03a30aa8c2e3afe425d886f0814f2e573aa77708c4e3fba5c8ed7902b7273d2615f437715f8f6f0d0325882b64a6d88a904

Download Submit
\Windows\system\LISNNcg.exe

Filesize
1.8MB

MD5
c782e15cf6aaa4870e3e9ff3479b6665

SHA1
41e273cfd1e13e62345afbbe46455d1a84f9b64b

SHA256
5e7a0a899b4b4e8a8472cb5b7cb46440dca49ceea927cf7674841a97b3dcfc9d

SHA512
7fba3ae89efbfea16756814d769efd59e0e7e6c816f99b51da52f9c703ec766a333c506b3b344ab9efe206b7b86b360eb7c88a7d89637fc0bad1a407d7aca558

Download Submit
\Windows\system\MAjJvZc.exe

Filesize
1.8MB

MD5
63f5113c2f6d7bd2b84228bd37298fb7

SHA1
8994bbdd7f8bb65d8cda97a855d46763db491351

SHA256
cdad754570cce588ffce02e878890290fbb2c66a2aa4257538339dce0a1d0b4d

SHA512
23c7e363b61cd1bb620819ff29b3283f71aa4657e059afac607bbe8ce7c9dd204d0cee391b414baffa0b684bf8d15d39d2ea08593706e15266fdb86036251827

Download Submit
\Windows\system\MqOfLko.exe

Filesize
1.8MB

MD5
de80591777a7fb483201bab635569d70

SHA1
3bf94f3bc84b228e72ee296b7d52f99a3b518283

SHA256
6314fff8ec104472b976fe1ecd5f07d9551daa93bf65914c2945c070bad97762

SHA512
8ec240774f8b3208144b70a23bc7a8cb391bf382a820837a2f82f398520662d4c63ef4fcdbdbcfa32bb3fe8106cca8af307bbd3e329667206973493a465550ca

Download Submit
\Windows\system\PoibYKZ.exe

Filesize
1.8MB

MD5
48d4a1c2d8c8d9dfc55f404c77a9335d

SHA1
2d781767e17e180cf9c202dd5f0832d2230261f5

SHA256
fa77ef130d2d6a37208eabf6f8b4218ad8d38c17b6f1f24316fa4ba1088b31d1

SHA512
8a0972a1448d4818339be5f2cab14e5dc298de6e0085e378043381c55fd9dbc0883165b704b64260361aafe9d674b1ae249ded0486703946180a4ff6c0eab2b1

Download Submit
\Windows\system\QmaBtTn.exe

Filesize
1.8MB

MD5
a38d3fc548ac226794ca17df234dbb06

SHA1
203441bcf2f553f9cd3778f116071f9e3266dbc8

SHA256
eecb420545bcffbc037d9b14dd1a230865768b931c8ba39c9c1dab6c282edb79

SHA512
aafe7c1b3f9f52976ce07b61f196379fef7d0a42334742336643c09d28503aae2018a358019c468e30f275baf43333708ce322c4e6fc92c80e27d49ccd22c9d3

Download Submit
\Windows\system\XILPuyL.exe

Filesize
1.8MB

MD5
d221ae70be2ce196e894a05a27ed8f12

SHA1
f7ab078261b83e0b29ae165e4716fe24caf408a4

SHA256
17d97498bc5d5e06d5a6ffd78f2b1d7a0f3466f5718109ba8cf41b3c6f5c8445

SHA512
59049f79b9ff0ddfea81494c2d674dffbde56acb6788eae06d390c81e8b0601595821ea4f14e71803b299000023b4368c1911a09d2f200b2c3ad596924930269

Download Submit
\Windows\system\YYLSbAK.exe

Filesize
1.8MB

MD5
352b577cd2f4104c1f56202cf0ef1f34

SHA1
34578a574be89362dc5b02bd82a2e73f31231a00

SHA256
e8977a0d8beb0cfef0e4cf24f509095b337bfbb30356911b7243aeaf46d639cb

SHA512
ff01232ea929170f0dd3b450a20ad79cd259e490ddc1858cbd8c5e66e400100828d8ef559dc5f72bcc52b9dd3cc421ceff02df0e5c1798bd240cb1e510c0929c

Download Submit
\Windows\system\jNAtECH.exe

Filesize
1.8MB

MD5
4ed999bc12d5f134a6f6192f51882dd0

SHA1
d41de403c83ecac8267206ac54d0a8a952d9d492

SHA256
277e1d7a0f95b7d9e5a09d82879b1be05cca55fac1b900cf3aff13b743558741

SHA512
dd5bbe70f394fa2a7213a9f6882539c0cea63b8728c2ebd34accdbd663384ea82d72490b96c8d716ed9f2eda8538908e9c3eca785a82c68888e7632500b93712

Download Submit
\Windows\system\mHxaaww.exe

Filesize
1.8MB

MD5
828ba76fcb967663eb7088594ec33931

SHA1
bcaf562464702af59282e353345ce5b3691bddb3

SHA256
98e08d14f0a9bb446453630e2846b0517f241ba85a1512ae4b060fbd18a15ad1

SHA512
3b1408b724e553e61ffb49122db0968be0bd4f34e788938971a87767eb48024f236c141141d584899e74af8533f91c0ea8e07263f3b1af7c64e4aa180e05774a

Download Submit
\Windows\system\piaJMvJ.exe

Filesize
1.8MB

MD5
34d7cbd6123887c5b4a35ba1ecf7aed0

SHA1
f9246aa7bbe5116b1ee529d16ba36dc6df005543

SHA256
dbbce6ecaffc2a02fddba6550a2f72e762eb25604697b01f615f7be792016fe8

SHA512
3d820ba6aa3ac68ca7e837a8a5fa72b28618fba61be38ca8b50e2f88b06d920e60e0c933330e2b57afe38d30b63496c6e5d9f967bf5f12f80e1164daf46a1ce3

Download Submit
\Windows\system\rqNfhlB.exe

Filesize
1.8MB

MD5
8aa603d438c5f10351c7f8e5c24f4a91

SHA1
fc673350e41ed128f2c5f2268f286fb229db658d

SHA256
d47143871f698709dfe928022eda04bbca1898d8becc5b2cb984e0598c67d347

SHA512
f5ca243c7278b32666f2fd68193ddbf66c10e97580dc88320193ff4a02e7c699208d67e3ce7f9e966835a94f5c393dbf6b7948b697fa21629252e8d80b6855f0

Download Submit
\Windows\system\ztPbqUx.exe

Filesize
1.8MB

MD5
8fc7507ec64016409f271c9142b06ce3

SHA1
8b86adcea6c604e0479e39971582b32a43b76f23

SHA256
1c8b29ea1e0e6b280fd64707e79e84470e46ef45e3fc95b22905b0efe2056343

SHA512
ee448a3c5c931310521acc8ac2b7d2596963878503c44cfc194631c2aa8341634c3df4bd21e243e7bd09f88e028a4bff28c7e0ffea64433caefae49bc411a98e

Download Submit
memory/468-185-0x000000013FC40000-0x0000000140032000-memory.dmp

Filesize
3.9MB

Download
memory/468-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/468-179-0x0000000002E80000-0x0000000003272000-memory.dmp

Filesize
3.9MB

Download
memory/468-186-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/468-188-0x0000000002E80000-0x0000000003272000-memory.dmp

Filesize
3.9MB

Download
memory/468-182-0x0000000002E80000-0x0000000003272000-memory.dmp

Filesize
3.9MB

Download
memory/468-5764-0x000000013F7C0000-0x000000013FBB2000-memory.dmp

Filesize
3.9MB

Download
memory/468-178-0x0000000002E80000-0x0000000003272000-memory.dmp

Filesize
3.9MB

Download
memory/468-139-0x0000000002E80000-0x0000000003272000-memory.dmp

Filesize
3.9MB

Download
memory/468-147-0x000000013FE10000-0x0000000140202000-memory.dmp

Filesize
3.9MB

Download
memory/468-0-0x000000013F7C0000-0x000000013FBB2000-memory.dmp

Filesize
3.9MB

Download
memory/468-125-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/468-181-0x0000000002E80000-0x0000000003272000-memory.dmp

Filesize
3.9MB

Download
memory/468-189-0x0000000002E80000-0x0000000003272000-memory.dmp

Filesize
3.9MB

Download
memory/468-190-0x0000000002E80000-0x0000000003272000-memory.dmp

Filesize
3.9MB

Download
memory/468-187-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/468-183-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/468-38-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/1908-160-0x000000001B660000-0x000000001B942000-memory.dmp

Filesize
2.9MB

Download
memory/1908-161-0x0000000001F50000-0x0000000001F58000-memory.dmp

Filesize
32KB

Download
memory/2132-175-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/2132-5240-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/2156-4996-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/2156-54-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/2172-4966-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/2172-180-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/2744-184-0x000000013F940000-0x000000013FD32000-memory.dmp

Filesize
3.9MB

Download
memory/2744-6694-0x000000013F940000-0x000000013FD32000-memory.dmp

Filesize
3.9MB

Download
memory/2764-177-0x000000013FE10000-0x0000000140202000-memory.dmp

Filesize
3.9MB

Download
memory/2824-173-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/2960-25-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2960-5078-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download