xmrig | 8be01400d036a192492f91c592361d39f361b0d378b9536e78885e8d9f538475

Analysis

max time kernel
118s
max time network
117s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 10:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ca499fa89c83987f222dfcb136695f30N.exe
Size

1.3MB
MD5

ca499fa89c83987f222dfcb136695f30
SHA1

14160dbc01d84ab54ab9b50e9b1f33e7b63055d8
SHA256

8be01400d036a192492f91c592361d39f361b0d378b9536e78885e8d9f538475
SHA512

6999ea075c682c6307a71b5fc0984a3172a9d7afc75750bee39ea5a235ed7d79c757588f3c2fd80835c9f38892270d63a82afbb94bf9b9a726c9d96f7be9795c
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t46xjZQ3okg:Lz071uv4BPMkFfdk2aVD7

Score

10^/10

xmrig execution miner persistence privilege_escalation upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 18 IoCs

miner

resource	yara_rule
behavioral1/memory/2380-21-0x000000013FF60000-0x0000000140352000-memory.dmp	xmrig
behavioral1/memory/2116-17-0x000000013FEF0000-0x00000001402E2000-memory.dmp	xmrig
behavioral1/memory/2896-52-0x000000013F960000-0x000000013FD52000-memory.dmp	xmrig
behavioral1/memory/2716-58-0x000000013FDD0000-0x00000001401C2000-memory.dmp	xmrig
behavioral1/memory/2908-82-0x000000013F080000-0x000000013F472000-memory.dmp	xmrig
behavioral1/memory/2916-483-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	xmrig
behavioral1/memory/2296-491-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	xmrig
behavioral1/memory/1572-490-0x000000013FDF0000-0x00000001401E2000-memory.dmp	xmrig
behavioral1/memory/2612-487-0x000000013F560000-0x000000013F952000-memory.dmp	xmrig
behavioral1/memory/2892-486-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	xmrig
behavioral1/memory/2908-4065-0x000000013F080000-0x000000013F472000-memory.dmp	xmrig
behavioral1/memory/2296-4076-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	xmrig
behavioral1/memory/2116-4075-0x000000013FEF0000-0x00000001402E2000-memory.dmp	xmrig
behavioral1/memory/2892-4077-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	xmrig
behavioral1/memory/2896-4069-0x000000013F960000-0x000000013FD52000-memory.dmp	xmrig
behavioral1/memory/2916-4096-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	xmrig
behavioral1/memory/2716-4113-0x000000013FDD0000-0x00000001401C2000-memory.dmp	xmrig
behavioral1/memory/2380-4117-0x000000013FF60000-0x0000000140352000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2516	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2116	BavvNMx.exe
2380	SMEWvQB.exe
2896	sGzocew.exe
2716	kHVJCqc.exe
2908	QHDjfkz.exe
2916	rNVHcbm.exe
2892	JtfZRyg.exe
2612	mpxLihR.exe
1572	sQSPPmA.exe
2296	ijuEjfS.exe
300	tMTGmdd.exe
1896	fAdKYgL.exe
2656	JiNmQEe.exe
2640	BQOpHyC.exe
2508	wwYIApZ.exe
2344	qIkpdRT.exe
1568	qYOJHxC.exe
2848	iWwcvcW.exe
2420	pnJhQKi.exe
1688	ddkscaN.exe
2696	BaLwsTU.exe
1500	vZhzbuY.exe
2540	PAUgAII.exe
936	jqcONnZ.exe
264	kYcEDSX.exe
492	mrbJGPT.exe
1416	xeGACiM.exe
444	JNfuhWc.exe
1516	yzhoutd.exe
1304	DYSYpjF.exe
2020	SMgXXrB.exe
1964	jWmdOYC.exe
1444	IafiGEi.exe
752	pxaNwYM.exe
1436	faPmXVC.exe
748	gQlHTgB.exe
744	YOZtuNq.exe
2372	hEmbskO.exe
1528	LSqwcUd.exe
1952	KKOTLcQ.exe
2384	QjDrfyZ.exe
2216	SPkwubt.exe
2472	IcJqwYg.exe
2432	yvefkvZ.exe
1004	DnOiFZn.exe
1664	PPoPuIA.exe
1656	JBijLte.exe
2496	KwybnUV.exe
2340	LSoZDyO.exe
1492	kzvWXgs.exe
1496	KjqwiCt.exe
2412	jmrushx.exe
992	KvjZlnB.exe
2548	dWNyFJu.exe
2700	rtvFOGI.exe
2164	CJDZbZQ.exe
2784	OFCPIAr.exe
2188	PsuSnDK.exe
2552	RkRNJjD.exe
1640	DrTRtzl.exe
2912	VhjQohg.exe
2772	wfmiEuJ.exe
2608	XPUssZp.exe
1956	pvGPxAR.exe

Loads dropped DLL 64 IoCs

pid	Process
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe
1856	ca499fa89c83987f222dfcb136695f30N.exe

UPX packed file 51 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1856-1-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	upx
behavioral1/files/0x000c00000001227f-6.dat	upx
behavioral1/files/0x00080000000170f2-7.dat	upx
behavioral1/files/0x0008000000017292-23.dat	upx
behavioral1/memory/2380-21-0x000000013FF60000-0x0000000140352000-memory.dmp	upx
behavioral1/memory/2116-17-0x000000013FEF0000-0x00000001402E2000-memory.dmp	upx
behavioral1/files/0x001c000000005591-33.dat	upx
behavioral1/files/0x0007000000018716-38.dat	upx
behavioral1/files/0x0009000000018b7d-47.dat	upx
behavioral1/memory/2896-52-0x000000013F960000-0x000000013FD52000-memory.dmp	upx
behavioral1/memory/2716-58-0x000000013FDD0000-0x00000001401C2000-memory.dmp	upx
behavioral1/files/0x0005000000019419-57.dat	upx
behavioral1/memory/2908-82-0x000000013F080000-0x000000013F472000-memory.dmp	upx
behavioral1/files/0x00050000000195c9-122.dat	upx
behavioral1/files/0x000600000001940f-100.dat	upx
behavioral1/files/0x000500000001961a-173.dat	upx
behavioral1/files/0x000500000001961c-177.dat	upx
behavioral1/memory/2916-483-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	upx
behavioral1/memory/2296-491-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	upx
behavioral1/memory/1572-490-0x000000013FDF0000-0x00000001401E2000-memory.dmp	upx
behavioral1/memory/2612-487-0x000000013F560000-0x000000013F952000-memory.dmp	upx
behavioral1/memory/2892-486-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	upx
behavioral1/files/0x0005000000019618-168.dat	upx
behavioral1/files/0x0005000000019615-161.dat	upx
behavioral1/files/0x0005000000019616-164.dat	upx
behavioral1/files/0x0005000000019614-156.dat	upx
behavioral1/files/0x0005000000019612-150.dat	upx
behavioral1/files/0x0005000000019610-146.dat	upx
behavioral1/files/0x000500000001960e-140.dat	upx
behavioral1/files/0x000500000001960a-131.dat	upx
behavioral1/files/0x000500000001960c-135.dat	upx
behavioral1/files/0x0005000000019557-119.dat	upx
behavioral1/files/0x0005000000019526-117.dat	upx
behavioral1/files/0x0009000000016dd3-113.dat	upx
behavioral1/files/0x00050000000194e0-105.dat	upx
behavioral1/files/0x00050000000194cc-103.dat	upx
behavioral1/files/0x0005000000019553-96.dat	upx
behavioral1/files/0x0005000000019503-95.dat	upx
behavioral1/files/0x00050000000194f3-76.dat	upx
behavioral1/files/0x0005000000019571-109.dat	upx
behavioral1/files/0x0006000000018718-43.dat	upx
behavioral1/files/0x00050000000194e9-80.dat	upx
behavioral1/files/0x00050000000194d4-79.dat	upx
behavioral1/memory/2908-4065-0x000000013F080000-0x000000013F472000-memory.dmp	upx
behavioral1/memory/2296-4076-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	upx
behavioral1/memory/2116-4075-0x000000013FEF0000-0x00000001402E2000-memory.dmp	upx
behavioral1/memory/2892-4077-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	upx
behavioral1/memory/2896-4069-0x000000013F960000-0x000000013FD52000-memory.dmp	upx
behavioral1/memory/2916-4096-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	upx
behavioral1/memory/2716-4113-0x000000013FDD0000-0x00000001401C2000-memory.dmp	upx
behavioral1/memory/2380-4117-0x000000013FF60000-0x0000000140352000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\XgAmXbY.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\bkepZEj.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\APbRsJb.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\SPmnnKy.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\xlRmXMo.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\wrcaXAK.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\QAWkptt.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\RegSzBQ.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\IdgtQzz.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\xCclWdh.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\kZmlKcN.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\EQUmfGj.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\rCuzCPb.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\iabmesb.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\ffpnECj.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\HrCwOgH.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\gZXrCCe.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\hBlwjbB.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\SOFftxT.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\WasNiIk.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\yzXjvDX.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\PcXTFfV.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\tEEoFqb.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\cImKXew.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\RDiyvPQ.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\JGLiYVE.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\dFkDLky.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\KunGqxa.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\umkYCGK.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\OsvLkJY.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\oPwzniX.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\vXZGZxf.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\DhGUMXm.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\cplJfBl.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\HrMnShL.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\AUxzqdy.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\RnpAYpa.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\TsiueUZ.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\kQctkfd.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\KpTAdzj.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\jWmdOYC.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\pjtAEZp.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\IArLshc.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\MULRtfr.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\hbzRWQo.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\liaXUXH.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\GRpVbaB.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\VTVPDXT.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\wfmiEuJ.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\AClEVXr.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\KGYpYOR.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\ruFfpTd.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\rYQiLQY.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\GWWMhrn.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\LgAJThc.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\PPoPuIA.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\AOWOUdj.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\hBdUBYW.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\cTMUXhZ.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\zWThIih.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\KYQwtaX.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\bTDdWWB.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\IGKTqfG.exe	ca499fa89c83987f222dfcb136695f30N.exe
File created	C:\Windows\System\sjQTXRQ.exe	ca499fa89c83987f222dfcb136695f30N.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2516	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1856	ca499fa89c83987f222dfcb136695f30N.exe
Token: SeLockMemoryPrivilege	1856	ca499fa89c83987f222dfcb136695f30N.exe
Token: SeDebugPrivilege	2516	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 2516	1856	ca499fa89c83987f222dfcb136695f30N.exe	31
PID 1856 wrote to memory of 2516	1856	ca499fa89c83987f222dfcb136695f30N.exe	31
PID 1856 wrote to memory of 2516	1856	ca499fa89c83987f222dfcb136695f30N.exe	31
PID 1856 wrote to memory of 2116	1856	ca499fa89c83987f222dfcb136695f30N.exe	32
PID 1856 wrote to memory of 2116	1856	ca499fa89c83987f222dfcb136695f30N.exe	32
PID 1856 wrote to memory of 2116	1856	ca499fa89c83987f222dfcb136695f30N.exe	32
PID 1856 wrote to memory of 2380	1856	ca499fa89c83987f222dfcb136695f30N.exe	33
PID 1856 wrote to memory of 2380	1856	ca499fa89c83987f222dfcb136695f30N.exe	33
PID 1856 wrote to memory of 2380	1856	ca499fa89c83987f222dfcb136695f30N.exe	33
PID 1856 wrote to memory of 2896	1856	ca499fa89c83987f222dfcb136695f30N.exe	34
PID 1856 wrote to memory of 2896	1856	ca499fa89c83987f222dfcb136695f30N.exe	34
PID 1856 wrote to memory of 2896	1856	ca499fa89c83987f222dfcb136695f30N.exe	34
PID 1856 wrote to memory of 2716	1856	ca499fa89c83987f222dfcb136695f30N.exe	35
PID 1856 wrote to memory of 2716	1856	ca499fa89c83987f222dfcb136695f30N.exe	35
PID 1856 wrote to memory of 2716	1856	ca499fa89c83987f222dfcb136695f30N.exe	35
PID 1856 wrote to memory of 2908	1856	ca499fa89c83987f222dfcb136695f30N.exe	36
PID 1856 wrote to memory of 2908	1856	ca499fa89c83987f222dfcb136695f30N.exe	36
PID 1856 wrote to memory of 2908	1856	ca499fa89c83987f222dfcb136695f30N.exe	36
PID 1856 wrote to memory of 2916	1856	ca499fa89c83987f222dfcb136695f30N.exe	37
PID 1856 wrote to memory of 2916	1856	ca499fa89c83987f222dfcb136695f30N.exe	37
PID 1856 wrote to memory of 2916	1856	ca499fa89c83987f222dfcb136695f30N.exe	37
PID 1856 wrote to memory of 2892	1856	ca499fa89c83987f222dfcb136695f30N.exe	38
PID 1856 wrote to memory of 2892	1856	ca499fa89c83987f222dfcb136695f30N.exe	38
PID 1856 wrote to memory of 2892	1856	ca499fa89c83987f222dfcb136695f30N.exe	38
PID 1856 wrote to memory of 2656	1856	ca499fa89c83987f222dfcb136695f30N.exe	39
PID 1856 wrote to memory of 2656	1856	ca499fa89c83987f222dfcb136695f30N.exe	39
PID 1856 wrote to memory of 2656	1856	ca499fa89c83987f222dfcb136695f30N.exe	39
PID 1856 wrote to memory of 2612	1856	ca499fa89c83987f222dfcb136695f30N.exe	40
PID 1856 wrote to memory of 2612	1856	ca499fa89c83987f222dfcb136695f30N.exe	40
PID 1856 wrote to memory of 2612	1856	ca499fa89c83987f222dfcb136695f30N.exe	40
PID 1856 wrote to memory of 2640	1856	ca499fa89c83987f222dfcb136695f30N.exe	41
PID 1856 wrote to memory of 2640	1856	ca499fa89c83987f222dfcb136695f30N.exe	41
PID 1856 wrote to memory of 2640	1856	ca499fa89c83987f222dfcb136695f30N.exe	41
PID 1856 wrote to memory of 1572	1856	ca499fa89c83987f222dfcb136695f30N.exe	42
PID 1856 wrote to memory of 1572	1856	ca499fa89c83987f222dfcb136695f30N.exe	42
PID 1856 wrote to memory of 1572	1856	ca499fa89c83987f222dfcb136695f30N.exe	42
PID 1856 wrote to memory of 2508	1856	ca499fa89c83987f222dfcb136695f30N.exe	43
PID 1856 wrote to memory of 2508	1856	ca499fa89c83987f222dfcb136695f30N.exe	43
PID 1856 wrote to memory of 2508	1856	ca499fa89c83987f222dfcb136695f30N.exe	43
PID 1856 wrote to memory of 2296	1856	ca499fa89c83987f222dfcb136695f30N.exe	44
PID 1856 wrote to memory of 2296	1856	ca499fa89c83987f222dfcb136695f30N.exe	44
PID 1856 wrote to memory of 2296	1856	ca499fa89c83987f222dfcb136695f30N.exe	44
PID 1856 wrote to memory of 1568	1856	ca499fa89c83987f222dfcb136695f30N.exe	45
PID 1856 wrote to memory of 1568	1856	ca499fa89c83987f222dfcb136695f30N.exe	45
PID 1856 wrote to memory of 1568	1856	ca499fa89c83987f222dfcb136695f30N.exe	45
PID 1856 wrote to memory of 300	1856	ca499fa89c83987f222dfcb136695f30N.exe	46
PID 1856 wrote to memory of 300	1856	ca499fa89c83987f222dfcb136695f30N.exe	46
PID 1856 wrote to memory of 300	1856	ca499fa89c83987f222dfcb136695f30N.exe	46
PID 1856 wrote to memory of 2848	1856	ca499fa89c83987f222dfcb136695f30N.exe	47
PID 1856 wrote to memory of 2848	1856	ca499fa89c83987f222dfcb136695f30N.exe	47
PID 1856 wrote to memory of 2848	1856	ca499fa89c83987f222dfcb136695f30N.exe	47
PID 1856 wrote to memory of 1896	1856	ca499fa89c83987f222dfcb136695f30N.exe	48
PID 1856 wrote to memory of 1896	1856	ca499fa89c83987f222dfcb136695f30N.exe	48
PID 1856 wrote to memory of 1896	1856	ca499fa89c83987f222dfcb136695f30N.exe	48
PID 1856 wrote to memory of 2420	1856	ca499fa89c83987f222dfcb136695f30N.exe	49
PID 1856 wrote to memory of 2420	1856	ca499fa89c83987f222dfcb136695f30N.exe	49
PID 1856 wrote to memory of 2420	1856	ca499fa89c83987f222dfcb136695f30N.exe	49
PID 1856 wrote to memory of 2344	1856	ca499fa89c83987f222dfcb136695f30N.exe	50
PID 1856 wrote to memory of 2344	1856	ca499fa89c83987f222dfcb136695f30N.exe	50
PID 1856 wrote to memory of 2344	1856	ca499fa89c83987f222dfcb136695f30N.exe	50
PID 1856 wrote to memory of 2696	1856	ca499fa89c83987f222dfcb136695f30N.exe	51
PID 1856 wrote to memory of 2696	1856	ca499fa89c83987f222dfcb136695f30N.exe	51
PID 1856 wrote to memory of 2696	1856	ca499fa89c83987f222dfcb136695f30N.exe	51
PID 1856 wrote to memory of 1688	1856	ca499fa89c83987f222dfcb136695f30N.exe	52

C:\Users\Admin\AppData\Local\Temp\ca499fa89c83987f222dfcb136695f30N.exe
"C:\Users\Admin\AppData\Local\Temp\ca499fa89c83987f222dfcb136695f30N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2516
- C:\Windows\System\BavvNMx.exe
  C:\Windows\System\BavvNMx.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\SMEWvQB.exe
  C:\Windows\System\SMEWvQB.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\sGzocew.exe
  C:\Windows\System\sGzocew.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\kHVJCqc.exe
  C:\Windows\System\kHVJCqc.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\QHDjfkz.exe
  C:\Windows\System\QHDjfkz.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\rNVHcbm.exe
  C:\Windows\System\rNVHcbm.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\JtfZRyg.exe
  C:\Windows\System\JtfZRyg.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\JiNmQEe.exe
  C:\Windows\System\JiNmQEe.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\mpxLihR.exe
  C:\Windows\System\mpxLihR.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\BQOpHyC.exe
  C:\Windows\System\BQOpHyC.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\sQSPPmA.exe
  C:\Windows\System\sQSPPmA.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\wwYIApZ.exe
  C:\Windows\System\wwYIApZ.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\ijuEjfS.exe
  C:\Windows\System\ijuEjfS.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\qYOJHxC.exe
  C:\Windows\System\qYOJHxC.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\tMTGmdd.exe
  C:\Windows\System\tMTGmdd.exe
  2⤵
  - Executes dropped EXE
  PID:300
- C:\Windows\System\iWwcvcW.exe
  C:\Windows\System\iWwcvcW.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\fAdKYgL.exe
  C:\Windows\System\fAdKYgL.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\pnJhQKi.exe
  C:\Windows\System\pnJhQKi.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\qIkpdRT.exe
  C:\Windows\System\qIkpdRT.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\BaLwsTU.exe
  C:\Windows\System\BaLwsTU.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\ddkscaN.exe
  C:\Windows\System\ddkscaN.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\vZhzbuY.exe
  C:\Windows\System\vZhzbuY.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\PAUgAII.exe
  C:\Windows\System\PAUgAII.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\jqcONnZ.exe
  C:\Windows\System\jqcONnZ.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\kYcEDSX.exe
  C:\Windows\System\kYcEDSX.exe
  2⤵
  - Executes dropped EXE
  PID:264
- C:\Windows\System\mrbJGPT.exe
  C:\Windows\System\mrbJGPT.exe
  2⤵
  - Executes dropped EXE
  PID:492
- C:\Windows\System\xeGACiM.exe
  C:\Windows\System\xeGACiM.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\JNfuhWc.exe
  C:\Windows\System\JNfuhWc.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\yzhoutd.exe
  C:\Windows\System\yzhoutd.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\SMgXXrB.exe
  C:\Windows\System\SMgXXrB.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\DYSYpjF.exe
  C:\Windows\System\DYSYpjF.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\jWmdOYC.exe
  C:\Windows\System\jWmdOYC.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\IafiGEi.exe
  C:\Windows\System\IafiGEi.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\faPmXVC.exe
  C:\Windows\System\faPmXVC.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\pxaNwYM.exe
  C:\Windows\System\pxaNwYM.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\gQlHTgB.exe
  C:\Windows\System\gQlHTgB.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\YOZtuNq.exe
  C:\Windows\System\YOZtuNq.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\hEmbskO.exe
  C:\Windows\System\hEmbskO.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\LSqwcUd.exe
  C:\Windows\System\LSqwcUd.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\KKOTLcQ.exe
  C:\Windows\System\KKOTLcQ.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\QjDrfyZ.exe
  C:\Windows\System\QjDrfyZ.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\SPkwubt.exe
  C:\Windows\System\SPkwubt.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\IcJqwYg.exe
  C:\Windows\System\IcJqwYg.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\yvefkvZ.exe
  C:\Windows\System\yvefkvZ.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\DnOiFZn.exe
  C:\Windows\System\DnOiFZn.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\PPoPuIA.exe
  C:\Windows\System\PPoPuIA.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\JBijLte.exe
  C:\Windows\System\JBijLte.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\KwybnUV.exe
  C:\Windows\System\KwybnUV.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\LSoZDyO.exe
  C:\Windows\System\LSoZDyO.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\kzvWXgs.exe
  C:\Windows\System\kzvWXgs.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\KjqwiCt.exe
  C:\Windows\System\KjqwiCt.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\jmrushx.exe
  C:\Windows\System\jmrushx.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\KvjZlnB.exe
  C:\Windows\System\KvjZlnB.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\dWNyFJu.exe
  C:\Windows\System\dWNyFJu.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\rtvFOGI.exe
  C:\Windows\System\rtvFOGI.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\CJDZbZQ.exe
  C:\Windows\System\CJDZbZQ.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\OFCPIAr.exe
  C:\Windows\System\OFCPIAr.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\PsuSnDK.exe
  C:\Windows\System\PsuSnDK.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\RkRNJjD.exe
  C:\Windows\System\RkRNJjD.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\DrTRtzl.exe
  C:\Windows\System\DrTRtzl.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\VhjQohg.exe
  C:\Windows\System\VhjQohg.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\wfmiEuJ.exe
  C:\Windows\System\wfmiEuJ.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\XPUssZp.exe
  C:\Windows\System\XPUssZp.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\pvGPxAR.exe
  C:\Windows\System\pvGPxAR.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\GGiFDMI.exe
  C:\Windows\System\GGiFDMI.exe
  2⤵
  PID:1820
- C:\Windows\System\tNoWnOG.exe
  C:\Windows\System\tNoWnOG.exe
  2⤵
  PID:2952
- C:\Windows\System\fyqLYcL.exe
  C:\Windows\System\fyqLYcL.exe
  2⤵
  PID:1484
- C:\Windows\System\HGYoOzD.exe
  C:\Windows\System\HGYoOzD.exe
  2⤵
  PID:556
- C:\Windows\System\jpUZPrN.exe
  C:\Windows\System\jpUZPrN.exe
  2⤵
  PID:1840
- C:\Windows\System\CbNOdZb.exe
  C:\Windows\System\CbNOdZb.exe
  2⤵
  PID:1224
- C:\Windows\System\TmPBzea.exe
  C:\Windows\System\TmPBzea.exe
  2⤵
  PID:844
- C:\Windows\System\BGKrfaD.exe
  C:\Windows\System\BGKrfaD.exe
  2⤵
  PID:1540
- C:\Windows\System\yfUzxPz.exe
  C:\Windows\System\yfUzxPz.exe
  2⤵
  PID:2488
- C:\Windows\System\BjRQVWl.exe
  C:\Windows\System\BjRQVWl.exe
  2⤵
  PID:1244
- C:\Windows\System\YgTHkre.exe
  C:\Windows\System\YgTHkre.exe
  2⤵
  PID:1252
- C:\Windows\System\uuVlkFS.exe
  C:\Windows\System\uuVlkFS.exe
  2⤵
  PID:1520
- C:\Windows\System\kMEJblh.exe
  C:\Windows\System\kMEJblh.exe
  2⤵
  PID:564
- C:\Windows\System\HPFRoww.exe
  C:\Windows\System\HPFRoww.exe
  2⤵
  PID:2268
- C:\Windows\System\xlRmXMo.exe
  C:\Windows\System\xlRmXMo.exe
  2⤵
  PID:996
- C:\Windows\System\kfuDprj.exe
  C:\Windows\System\kfuDprj.exe
  2⤵
  PID:3068
- C:\Windows\System\zWThIih.exe
  C:\Windows\System\zWThIih.exe
  2⤵
  PID:2792
- C:\Windows\System\SeQKUSc.exe
  C:\Windows\System\SeQKUSc.exe
  2⤵
  PID:2504
- C:\Windows\System\RdTOovF.exe
  C:\Windows\System\RdTOovF.exe
  2⤵
  PID:600
- C:\Windows\System\qQHJUVM.exe
  C:\Windows\System\qQHJUVM.exe
  2⤵
  PID:2316
- C:\Windows\System\pQNWbzr.exe
  C:\Windows\System\pQNWbzr.exe
  2⤵
  PID:1160
- C:\Windows\System\NRibiKr.exe
  C:\Windows\System\NRibiKr.exe
  2⤵
  PID:1544
- C:\Windows\System\CAxmOWB.exe
  C:\Windows\System\CAxmOWB.exe
  2⤵
  PID:2352
- C:\Windows\System\eVwMoYb.exe
  C:\Windows\System\eVwMoYb.exe
  2⤵
  PID:2940
- C:\Windows\System\xBrFBmR.exe
  C:\Windows\System\xBrFBmR.exe
  2⤵
  PID:2928
- C:\Windows\System\gFtqyqY.exe
  C:\Windows\System\gFtqyqY.exe
  2⤵
  PID:2632
- C:\Windows\System\fJmWFyj.exe
  C:\Windows\System\fJmWFyj.exe
  2⤵
  PID:2120
- C:\Windows\System\oSCdYZV.exe
  C:\Windows\System\oSCdYZV.exe
  2⤵
  PID:2736
- C:\Windows\System\eqFuHJw.exe
  C:\Windows\System\eqFuHJw.exe
  2⤵
  PID:2964
- C:\Windows\System\npREKFK.exe
  C:\Windows\System\npREKFK.exe
  2⤵
  PID:1156
- C:\Windows\System\KaQQMAb.exe
  C:\Windows\System\KaQQMAb.exe
  2⤵
  PID:1084
- C:\Windows\System\zsBcLNG.exe
  C:\Windows\System\zsBcLNG.exe
  2⤵
  PID:2820
- C:\Windows\System\OvgPmWo.exe
  C:\Windows\System\OvgPmWo.exe
  2⤵
  PID:392
- C:\Windows\System\IJemmtb.exe
  C:\Windows\System\IJemmtb.exe
  2⤵
  PID:2060
- C:\Windows\System\iwvdAVL.exe
  C:\Windows\System\iwvdAVL.exe
  2⤵
  PID:2620
- C:\Windows\System\tElIqDH.exe
  C:\Windows\System\tElIqDH.exe
  2⤵
  PID:2036
- C:\Windows\System\aliZfWC.exe
  C:\Windows\System\aliZfWC.exe
  2⤵
  PID:768
- C:\Windows\System\FbIhbwx.exe
  C:\Windows\System\FbIhbwx.exe
  2⤵
  PID:3064
- C:\Windows\System\AKyCnfQ.exe
  C:\Windows\System\AKyCnfQ.exe
  2⤵
  PID:2248
- C:\Windows\System\QlScQQV.exe
  C:\Windows\System\QlScQQV.exe
  2⤵
  PID:1712
- C:\Windows\System\XAdnWbg.exe
  C:\Windows\System\XAdnWbg.exe
  2⤵
  PID:880
- C:\Windows\System\eJwCZjS.exe
  C:\Windows\System\eJwCZjS.exe
  2⤵
  PID:856
- C:\Windows\System\jcOnXOS.exe
  C:\Windows\System\jcOnXOS.exe
  2⤵
  PID:2108
- C:\Windows\System\kYDOEIE.exe
  C:\Windows\System\kYDOEIE.exe
  2⤵
  PID:2520
- C:\Windows\System\yyGMdaW.exe
  C:\Windows\System\yyGMdaW.exe
  2⤵
  PID:1604
- C:\Windows\System\HFGELXm.exe
  C:\Windows\System\HFGELXm.exe
  2⤵
  PID:2836
- C:\Windows\System\ljGKKqo.exe
  C:\Windows\System\ljGKKqo.exe
  2⤵
  PID:2208
- C:\Windows\System\RFtZGZD.exe
  C:\Windows\System\RFtZGZD.exe
  2⤵
  PID:2028
- C:\Windows\System\MdArtuP.exe
  C:\Windows\System\MdArtuP.exe
  2⤵
  PID:2728
- C:\Windows\System\fQwgOfC.exe
  C:\Windows\System\fQwgOfC.exe
  2⤵
  PID:2804
- C:\Windows\System\LFoHLPT.exe
  C:\Windows\System\LFoHLPT.exe
  2⤵
  PID:1212
- C:\Windows\System\ppgaWoT.exe
  C:\Windows\System\ppgaWoT.exe
  2⤵
  PID:1140
- C:\Windows\System\qTNVJJt.exe
  C:\Windows\System\qTNVJJt.exe
  2⤵
  PID:2128
- C:\Windows\System\YKPiSvP.exe
  C:\Windows\System\YKPiSvP.exe
  2⤵
  PID:684
- C:\Windows\System\wUwwQgG.exe
  C:\Windows\System\wUwwQgG.exe
  2⤵
  PID:1512
- C:\Windows\System\ShmbNUS.exe
  C:\Windows\System\ShmbNUS.exe
  2⤵
  PID:2800
- C:\Windows\System\iMNNmVK.exe
  C:\Windows\System\iMNNmVK.exe
  2⤵
  PID:2532
- C:\Windows\System\eGtZTvF.exe
  C:\Windows\System\eGtZTvF.exe
  2⤵
  PID:2796
- C:\Windows\System\EnahWcQ.exe
  C:\Windows\System\EnahWcQ.exe
  2⤵
  PID:2732
- C:\Windows\System\lacxVqn.exe
  C:\Windows\System\lacxVqn.exe
  2⤵
  PID:2768
- C:\Windows\System\vxivvgT.exe
  C:\Windows\System\vxivvgT.exe
  2⤵
  PID:2920
- C:\Windows\System\YbFtcgj.exe
  C:\Windows\System\YbFtcgj.exe
  2⤵
  PID:2544
- C:\Windows\System\riDodEN.exe
  C:\Windows\System\riDodEN.exe
  2⤵
  PID:2824
- C:\Windows\System\UWhoUCr.exe
  C:\Windows\System\UWhoUCr.exe
  2⤵
  PID:2996
- C:\Windows\System\xFwedEJ.exe
  C:\Windows\System\xFwedEJ.exe
  2⤵
  PID:2304
- C:\Windows\System\QKaeBqv.exe
  C:\Windows\System\QKaeBqv.exe
  2⤵
  PID:892
- C:\Windows\System\beNuHrS.exe
  C:\Windows\System\beNuHrS.exe
  2⤵
  PID:2160
- C:\Windows\System\VWthqAI.exe
  C:\Windows\System\VWthqAI.exe
  2⤵
  PID:324
- C:\Windows\System\eslTJku.exe
  C:\Windows\System\eslTJku.exe
  2⤵
  PID:2708
- C:\Windows\System\GjpACDk.exe
  C:\Windows\System\GjpACDk.exe
  2⤵
  PID:1592
- C:\Windows\System\bJLFidF.exe
  C:\Windows\System\bJLFidF.exe
  2⤵
  PID:2868
- C:\Windows\System\qORAwac.exe
  C:\Windows\System\qORAwac.exe
  2⤵
  PID:328
- C:\Windows\System\MftdkJb.exe
  C:\Windows\System\MftdkJb.exe
  2⤵
  PID:2192
- C:\Windows\System\tNqIVrQ.exe
  C:\Windows\System\tNqIVrQ.exe
  2⤵
  PID:2124
- C:\Windows\System\bwxrsSq.exe
  C:\Windows\System\bwxrsSq.exe
  2⤵
  PID:2012
- C:\Windows\System\XOehxWx.exe
  C:\Windows\System\XOehxWx.exe
  2⤵
  PID:2500
- C:\Windows\System\uZmXOEa.exe
  C:\Windows\System\uZmXOEa.exe
  2⤵
  PID:1276
- C:\Windows\System\OTIvlnb.exe
  C:\Windows\System\OTIvlnb.exe
  2⤵
  PID:1392
- C:\Windows\System\iLrAQvI.exe
  C:\Windows\System\iLrAQvI.exe
  2⤵
  PID:3016
- C:\Windows\System\jBFPVcc.exe
  C:\Windows\System\jBFPVcc.exe
  2⤵
  PID:1660
- C:\Windows\System\lOtWQgo.exe
  C:\Windows\System\lOtWQgo.exe
  2⤵
  PID:1284
- C:\Windows\System\zowACwu.exe
  C:\Windows\System\zowACwu.exe
  2⤵
  PID:1988
- C:\Windows\System\UlrNZGL.exe
  C:\Windows\System\UlrNZGL.exe
  2⤵
  PID:904
- C:\Windows\System\NwadAmN.exe
  C:\Windows\System\NwadAmN.exe
  2⤵
  PID:1824
- C:\Windows\System\VroBQdQ.exe
  C:\Windows\System\VroBQdQ.exe
  2⤵
  PID:2244
- C:\Windows\System\JKNeJee.exe
  C:\Windows\System\JKNeJee.exe
  2⤵
  PID:2884
- C:\Windows\System\eBejDEw.exe
  C:\Windows\System\eBejDEw.exe
  2⤵
  PID:1692
- C:\Windows\System\QTZiFes.exe
  C:\Windows\System\QTZiFes.exe
  2⤵
  PID:1396
- C:\Windows\System\QPRcHjE.exe
  C:\Windows\System\QPRcHjE.exe
  2⤵
  PID:1064
- C:\Windows\System\vSZwzrl.exe
  C:\Windows\System\vSZwzrl.exe
  2⤵
  PID:2276
- C:\Windows\System\yTIorUx.exe
  C:\Windows\System\yTIorUx.exe
  2⤵
  PID:1580
- C:\Windows\System\FAvSbAD.exe
  C:\Windows\System\FAvSbAD.exe
  2⤵
  PID:572
- C:\Windows\System\iUqWOrf.exe
  C:\Windows\System\iUqWOrf.exe
  2⤵
  PID:984
- C:\Windows\System\HUQEimQ.exe
  C:\Windows\System\HUQEimQ.exe
  2⤵
  PID:1100
- C:\Windows\System\zCZXcsh.exe
  C:\Windows\System\zCZXcsh.exe
  2⤵
  PID:2880
- C:\Windows\System\mjeAbbK.exe
  C:\Windows\System\mjeAbbK.exe
  2⤵
  PID:1384
- C:\Windows\System\iKnzyoU.exe
  C:\Windows\System\iKnzyoU.exe
  2⤵
  PID:2648
- C:\Windows\System\hTrbjYn.exe
  C:\Windows\System\hTrbjYn.exe
  2⤵
  PID:3080
- C:\Windows\System\cKdcNzZ.exe
  C:\Windows\System\cKdcNzZ.exe
  2⤵
  PID:3096
- C:\Windows\System\IFstwCC.exe
  C:\Windows\System\IFstwCC.exe
  2⤵
  PID:3112
- C:\Windows\System\NPghWfo.exe
  C:\Windows\System\NPghWfo.exe
  2⤵
  PID:3168
- C:\Windows\System\eQVzKUA.exe
  C:\Windows\System\eQVzKUA.exe
  2⤵
  PID:3184
- C:\Windows\System\LQeeVuo.exe
  C:\Windows\System\LQeeVuo.exe
  2⤵
  PID:3200
- C:\Windows\System\ffTdorx.exe
  C:\Windows\System\ffTdorx.exe
  2⤵
  PID:3216
- C:\Windows\System\dqKWtFw.exe
  C:\Windows\System\dqKWtFw.exe
  2⤵
  PID:3232
- C:\Windows\System\GfJUqyL.exe
  C:\Windows\System\GfJUqyL.exe
  2⤵
  PID:3248
- C:\Windows\System\bnpeoCk.exe
  C:\Windows\System\bnpeoCk.exe
  2⤵
  PID:3264
- C:\Windows\System\QvzrVMj.exe
  C:\Windows\System\QvzrVMj.exe
  2⤵
  PID:3280
- C:\Windows\System\mUczygD.exe
  C:\Windows\System\mUczygD.exe
  2⤵
  PID:3296
- C:\Windows\System\dognsxu.exe
  C:\Windows\System\dognsxu.exe
  2⤵
  PID:3312
- C:\Windows\System\AClEVXr.exe
  C:\Windows\System\AClEVXr.exe
  2⤵
  PID:3328
- C:\Windows\System\QOgLTXB.exe
  C:\Windows\System\QOgLTXB.exe
  2⤵
  PID:3344
- C:\Windows\System\ztDsndB.exe
  C:\Windows\System\ztDsndB.exe
  2⤵
  PID:3360
- C:\Windows\System\mgbOYAn.exe
  C:\Windows\System\mgbOYAn.exe
  2⤵
  PID:3376
- C:\Windows\System\VziJvdY.exe
  C:\Windows\System\VziJvdY.exe
  2⤵
  PID:3392
- C:\Windows\System\xGVlFnu.exe
  C:\Windows\System\xGVlFnu.exe
  2⤵
  PID:3408
- C:\Windows\System\uWRSwgz.exe
  C:\Windows\System\uWRSwgz.exe
  2⤵
  PID:3424
- C:\Windows\System\tYUQzNh.exe
  C:\Windows\System\tYUQzNh.exe
  2⤵
  PID:3440
- C:\Windows\System\PMojBOR.exe
  C:\Windows\System\PMojBOR.exe
  2⤵
  PID:3456
- C:\Windows\System\XputdhX.exe
  C:\Windows\System\XputdhX.exe
  2⤵
  PID:3472
- C:\Windows\System\QlTyoxy.exe
  C:\Windows\System\QlTyoxy.exe
  2⤵
  PID:3488
- C:\Windows\System\FbeGeJr.exe
  C:\Windows\System\FbeGeJr.exe
  2⤵
  PID:3504
- C:\Windows\System\mZAtgjz.exe
  C:\Windows\System\mZAtgjz.exe
  2⤵
  PID:3520
- C:\Windows\System\pjtAEZp.exe
  C:\Windows\System\pjtAEZp.exe
  2⤵
  PID:3536
- C:\Windows\System\NCiGZVV.exe
  C:\Windows\System\NCiGZVV.exe
  2⤵
  PID:3552
- C:\Windows\System\ncEuMlu.exe
  C:\Windows\System\ncEuMlu.exe
  2⤵
  PID:3568
- C:\Windows\System\dmeyjiP.exe
  C:\Windows\System\dmeyjiP.exe
  2⤵
  PID:3584
- C:\Windows\System\IArLshc.exe
  C:\Windows\System\IArLshc.exe
  2⤵
  PID:3600
- C:\Windows\System\CslhMsL.exe
  C:\Windows\System\CslhMsL.exe
  2⤵
  PID:3616
- C:\Windows\System\HeZzJjH.exe
  C:\Windows\System\HeZzJjH.exe
  2⤵
  PID:3632
- C:\Windows\System\uuGWPok.exe
  C:\Windows\System\uuGWPok.exe
  2⤵
  PID:3648
- C:\Windows\System\lZasGpV.exe
  C:\Windows\System\lZasGpV.exe
  2⤵
  PID:3664
- C:\Windows\System\VKsmtzq.exe
  C:\Windows\System\VKsmtzq.exe
  2⤵
  PID:3680
- C:\Windows\System\NhMlXRO.exe
  C:\Windows\System\NhMlXRO.exe
  2⤵
  PID:3696
- C:\Windows\System\pmGDtrq.exe
  C:\Windows\System\pmGDtrq.exe
  2⤵
  PID:3712
- C:\Windows\System\yaJtODz.exe
  C:\Windows\System\yaJtODz.exe
  2⤵
  PID:3728
- C:\Windows\System\NwmFnuM.exe
  C:\Windows\System\NwmFnuM.exe
  2⤵
  PID:3744
- C:\Windows\System\FPvZvry.exe
  C:\Windows\System\FPvZvry.exe
  2⤵
  PID:3760
- C:\Windows\System\DLdgWWu.exe
  C:\Windows\System\DLdgWWu.exe
  2⤵
  PID:3776
- C:\Windows\System\GfSDFxZ.exe
  C:\Windows\System\GfSDFxZ.exe
  2⤵
  PID:3792
- C:\Windows\System\sNimaCD.exe
  C:\Windows\System\sNimaCD.exe
  2⤵
  PID:3808
- C:\Windows\System\TBhgiST.exe
  C:\Windows\System\TBhgiST.exe
  2⤵
  PID:3824
- C:\Windows\System\ybXlxth.exe
  C:\Windows\System\ybXlxth.exe
  2⤵
  PID:3840
- C:\Windows\System\WaGnDnL.exe
  C:\Windows\System\WaGnDnL.exe
  2⤵
  PID:3856
- C:\Windows\System\mbueNJM.exe
  C:\Windows\System\mbueNJM.exe
  2⤵
  PID:3872
- C:\Windows\System\kbZmDci.exe
  C:\Windows\System\kbZmDci.exe
  2⤵
  PID:3888
- C:\Windows\System\gVUkIUA.exe
  C:\Windows\System\gVUkIUA.exe
  2⤵
  PID:3904
- C:\Windows\System\GKpbgOb.exe
  C:\Windows\System\GKpbgOb.exe
  2⤵
  PID:3920
- C:\Windows\System\BegAQVY.exe
  C:\Windows\System\BegAQVY.exe
  2⤵
  PID:3936
- C:\Windows\System\PNgzNmv.exe
  C:\Windows\System\PNgzNmv.exe
  2⤵
  PID:3952
- C:\Windows\System\soCLNGg.exe
  C:\Windows\System\soCLNGg.exe
  2⤵
  PID:3968
- C:\Windows\System\jdfNNVZ.exe
  C:\Windows\System\jdfNNVZ.exe
  2⤵
  PID:3984
- C:\Windows\System\hiTGZLM.exe
  C:\Windows\System\hiTGZLM.exe
  2⤵
  PID:4000
- C:\Windows\System\GfmnTeE.exe
  C:\Windows\System\GfmnTeE.exe
  2⤵
  PID:4016
- C:\Windows\System\tFyTOMS.exe
  C:\Windows\System\tFyTOMS.exe
  2⤵
  PID:4032
- C:\Windows\System\VIYSrLi.exe
  C:\Windows\System\VIYSrLi.exe
  2⤵
  PID:4048
- C:\Windows\System\GusNvPg.exe
  C:\Windows\System\GusNvPg.exe
  2⤵
  PID:4064
- C:\Windows\System\VAuuyYI.exe
  C:\Windows\System\VAuuyYI.exe
  2⤵
  PID:4080
- C:\Windows\System\qHmBzJR.exe
  C:\Windows\System\qHmBzJR.exe
  2⤵
  PID:1980
- C:\Windows\System\mxcJxkZ.exe
  C:\Windows\System\mxcJxkZ.exe
  2⤵
  PID:2644
- C:\Windows\System\gbOGmZU.exe
  C:\Windows\System\gbOGmZU.exe
  2⤵
  PID:1752
- C:\Windows\System\uVsACIe.exe
  C:\Windows\System\uVsACIe.exe
  2⤵
  PID:624
- C:\Windows\System\psoMZmH.exe
  C:\Windows\System\psoMZmH.exe
  2⤵
  PID:3124
- C:\Windows\System\UIecCca.exe
  C:\Windows\System\UIecCca.exe
  2⤵
  PID:3164
- C:\Windows\System\sIfqzju.exe
  C:\Windows\System\sIfqzju.exe
  2⤵
  PID:3192
- C:\Windows\System\GyqDyja.exe
  C:\Windows\System\GyqDyja.exe
  2⤵
  PID:3240
- C:\Windows\System\gTsawFl.exe
  C:\Windows\System\gTsawFl.exe
  2⤵
  PID:3256
- C:\Windows\System\REGDKPE.exe
  C:\Windows\System\REGDKPE.exe
  2⤵
  PID:3288
- C:\Windows\System\gbuIIyq.exe
  C:\Windows\System\gbuIIyq.exe
  2⤵
  PID:3320
- C:\Windows\System\itbCROa.exe
  C:\Windows\System\itbCROa.exe
  2⤵
  PID:3352
- C:\Windows\System\zedVzvt.exe
  C:\Windows\System\zedVzvt.exe
  2⤵
  PID:3384
- C:\Windows\System\ZjmGFXf.exe
  C:\Windows\System\ZjmGFXf.exe
  2⤵
  PID:3416
- C:\Windows\System\XuiWBMT.exe
  C:\Windows\System\XuiWBMT.exe
  2⤵
  PID:3448
- C:\Windows\System\JpaNJEv.exe
  C:\Windows\System\JpaNJEv.exe
  2⤵
  PID:3480
- C:\Windows\System\oTbIFDH.exe
  C:\Windows\System\oTbIFDH.exe
  2⤵
  PID:3512
- C:\Windows\System\ebNlrSC.exe
  C:\Windows\System\ebNlrSC.exe
  2⤵
  PID:3560
- C:\Windows\System\djtXBIf.exe
  C:\Windows\System\djtXBIf.exe
  2⤵
  PID:3576
- C:\Windows\System\JcCEUzb.exe
  C:\Windows\System\JcCEUzb.exe
  2⤵
  PID:3640
- C:\Windows\System\GVqNKht.exe
  C:\Windows\System\GVqNKht.exe
  2⤵
  PID:3672
- C:\Windows\System\XNdvDxm.exe
  C:\Windows\System\XNdvDxm.exe
  2⤵
  PID:3720
- C:\Windows\System\qhtXYtl.exe
  C:\Windows\System\qhtXYtl.exe
  2⤵
  PID:3704
- C:\Windows\System\FAYxpyU.exe
  C:\Windows\System\FAYxpyU.exe
  2⤵
  PID:3784
- C:\Windows\System\ZaLHzjh.exe
  C:\Windows\System\ZaLHzjh.exe
  2⤵
  PID:3800
- C:\Windows\System\DhGUMXm.exe
  C:\Windows\System\DhGUMXm.exe
  2⤵
  PID:3848
- C:\Windows\System\UbUNmNW.exe
  C:\Windows\System\UbUNmNW.exe
  2⤵
  PID:3864
- C:\Windows\System\EfvTnkg.exe
  C:\Windows\System\EfvTnkg.exe
  2⤵
  PID:3896
- C:\Windows\System\RjzLxsC.exe
  C:\Windows\System\RjzLxsC.exe
  2⤵
  PID:3928
- C:\Windows\System\cNxBwvV.exe
  C:\Windows\System\cNxBwvV.exe
  2⤵
  PID:3960
- C:\Windows\System\raqnJcO.exe
  C:\Windows\System\raqnJcO.exe
  2⤵
  PID:4008
- C:\Windows\System\ITymAGS.exe
  C:\Windows\System\ITymAGS.exe
  2⤵
  PID:2664
- C:\Windows\System\BJcnMIl.exe
  C:\Windows\System\BJcnMIl.exe
  2⤵
  PID:4044
- C:\Windows\System\oFdWXiN.exe
  C:\Windows\System\oFdWXiN.exe
  2⤵
  PID:4060
- C:\Windows\System\FulPyzC.exe
  C:\Windows\System\FulPyzC.exe
  2⤵
  PID:4092
- C:\Windows\System\eCBlzOZ.exe
  C:\Windows\System\eCBlzOZ.exe
  2⤵
  PID:1020
- C:\Windows\System\aeYruGp.exe
  C:\Windows\System\aeYruGp.exe
  2⤵
  PID:3136
- C:\Windows\System\bJlXXxQ.exe
  C:\Windows\System\bJlXXxQ.exe
  2⤵
  PID:2676
- C:\Windows\System\kTPyHjV.exe
  C:\Windows\System\kTPyHjV.exe
  2⤵
  PID:3180
- C:\Windows\System\OYaEZeO.exe
  C:\Windows\System\OYaEZeO.exe
  2⤵
  PID:1632
- C:\Windows\System\dwUTzCE.exe
  C:\Windows\System\dwUTzCE.exe
  2⤵
  PID:2000
- C:\Windows\System\TuWfbiK.exe
  C:\Windows\System\TuWfbiK.exe
  2⤵
  PID:3276
- C:\Windows\System\vnuwDPW.exe
  C:\Windows\System\vnuwDPW.exe
  2⤵
  PID:3340
- C:\Windows\System\BRWewvj.exe
  C:\Windows\System\BRWewvj.exe
  2⤵
  PID:3388
- C:\Windows\System\TNllDkw.exe
  C:\Windows\System\TNllDkw.exe
  2⤵
  PID:4104
- C:\Windows\System\TyFculu.exe
  C:\Windows\System\TyFculu.exe
  2⤵
  PID:4120
- C:\Windows\System\SlTVltf.exe
  C:\Windows\System\SlTVltf.exe
  2⤵
  PID:4136
- C:\Windows\System\TdanjYZ.exe
  C:\Windows\System\TdanjYZ.exe
  2⤵
  PID:4152
- C:\Windows\System\XpbRLXY.exe
  C:\Windows\System\XpbRLXY.exe
  2⤵
  PID:4168
- C:\Windows\System\xjbwDbl.exe
  C:\Windows\System\xjbwDbl.exe
  2⤵
  PID:4184
- C:\Windows\System\YeeVlmS.exe
  C:\Windows\System\YeeVlmS.exe
  2⤵
  PID:4200
- C:\Windows\System\ZQXpytq.exe
  C:\Windows\System\ZQXpytq.exe
  2⤵
  PID:4216
- C:\Windows\System\gAHYFqb.exe
  C:\Windows\System\gAHYFqb.exe
  2⤵
  PID:4232
- C:\Windows\System\pKWsNiq.exe
  C:\Windows\System\pKWsNiq.exe
  2⤵
  PID:4276
- C:\Windows\System\xlFXVXz.exe
  C:\Windows\System\xlFXVXz.exe
  2⤵
  PID:4300
- C:\Windows\System\nCCbsNl.exe
  C:\Windows\System\nCCbsNl.exe
  2⤵
  PID:4316
- C:\Windows\System\RtwtbvR.exe
  C:\Windows\System\RtwtbvR.exe
  2⤵
  PID:4332
- C:\Windows\System\ViPcCXc.exe
  C:\Windows\System\ViPcCXc.exe
  2⤵
  PID:4348
- C:\Windows\System\Eofzvjl.exe
  C:\Windows\System\Eofzvjl.exe
  2⤵
  PID:4368
- C:\Windows\System\hvciBKf.exe
  C:\Windows\System\hvciBKf.exe
  2⤵
  PID:4384
- C:\Windows\System\AjKTACv.exe
  C:\Windows\System\AjKTACv.exe
  2⤵
  PID:4400
- C:\Windows\System\iBHFfBa.exe
  C:\Windows\System\iBHFfBa.exe
  2⤵
  PID:4420
- C:\Windows\System\LMwSiIt.exe
  C:\Windows\System\LMwSiIt.exe
  2⤵
  PID:4436
- C:\Windows\System\cKQLTxh.exe
  C:\Windows\System\cKQLTxh.exe
  2⤵
  PID:4452
- C:\Windows\System\niVhWlO.exe
  C:\Windows\System\niVhWlO.exe
  2⤵
  PID:4468
- C:\Windows\System\mKGSwtP.exe
  C:\Windows\System\mKGSwtP.exe
  2⤵
  PID:4488
- C:\Windows\System\kdnoviW.exe
  C:\Windows\System\kdnoviW.exe
  2⤵
  PID:4516
- C:\Windows\System\TDWWgut.exe
  C:\Windows\System\TDWWgut.exe
  2⤵
  PID:4600
- C:\Windows\System\fJRNnAL.exe
  C:\Windows\System\fJRNnAL.exe
  2⤵
  PID:4616
- C:\Windows\System\PJTxJjj.exe
  C:\Windows\System\PJTxJjj.exe
  2⤵
  PID:4632
- C:\Windows\System\vygsuEf.exe
  C:\Windows\System\vygsuEf.exe
  2⤵
  PID:4652
- C:\Windows\System\EqpaVOc.exe
  C:\Windows\System\EqpaVOc.exe
  2⤵
  PID:4668
- C:\Windows\System\TwSQDfb.exe
  C:\Windows\System\TwSQDfb.exe
  2⤵
  PID:4684
- C:\Windows\System\UmyeqNa.exe
  C:\Windows\System\UmyeqNa.exe
  2⤵
  PID:4700
- C:\Windows\System\ucpdPqY.exe
  C:\Windows\System\ucpdPqY.exe
  2⤵
  PID:4716
- C:\Windows\System\SCPOqfl.exe
  C:\Windows\System\SCPOqfl.exe
  2⤵
  PID:4732
- C:\Windows\System\jJGNEGS.exe
  C:\Windows\System\jJGNEGS.exe
  2⤵
  PID:4748
- C:\Windows\System\RQdYWyd.exe
  C:\Windows\System\RQdYWyd.exe
  2⤵
  PID:4764
- C:\Windows\System\LgWZrCH.exe
  C:\Windows\System\LgWZrCH.exe
  2⤵
  PID:4780
- C:\Windows\System\APyOqxl.exe
  C:\Windows\System\APyOqxl.exe
  2⤵
  PID:4800
- C:\Windows\System\LRknAzM.exe
  C:\Windows\System\LRknAzM.exe
  2⤵
  PID:4820
- C:\Windows\System\VkjNonZ.exe
  C:\Windows\System\VkjNonZ.exe
  2⤵
  PID:4836
- C:\Windows\System\YTbZMrT.exe
  C:\Windows\System\YTbZMrT.exe
  2⤵
  PID:4852
- C:\Windows\System\QwXgdfy.exe
  C:\Windows\System\QwXgdfy.exe
  2⤵
  PID:4868
- C:\Windows\System\cajtqDo.exe
  C:\Windows\System\cajtqDo.exe
  2⤵
  PID:4884
- C:\Windows\System\UFYTqfc.exe
  C:\Windows\System\UFYTqfc.exe
  2⤵
  PID:4904
- C:\Windows\System\GbbVnsN.exe
  C:\Windows\System\GbbVnsN.exe
  2⤵
  PID:4920
- C:\Windows\System\qVEESXh.exe
  C:\Windows\System\qVEESXh.exe
  2⤵
  PID:4936
- C:\Windows\System\dVJfdYb.exe
  C:\Windows\System\dVJfdYb.exe
  2⤵
  PID:4952
- C:\Windows\System\sAQAIkR.exe
  C:\Windows\System\sAQAIkR.exe
  2⤵
  PID:4968
- C:\Windows\System\qnIPsQo.exe
  C:\Windows\System\qnIPsQo.exe
  2⤵
  PID:4988
- C:\Windows\System\TAqUtph.exe
  C:\Windows\System\TAqUtph.exe
  2⤵
  PID:5004
- C:\Windows\System\AczcICw.exe
  C:\Windows\System\AczcICw.exe
  2⤵
  PID:5028
- C:\Windows\System\keltUOS.exe
  C:\Windows\System\keltUOS.exe
  2⤵
  PID:5044
- C:\Windows\System\dFkDLky.exe
  C:\Windows\System\dFkDLky.exe
  2⤵
  PID:5060
- C:\Windows\System\nkHYxXM.exe
  C:\Windows\System\nkHYxXM.exe
  2⤵
  PID:5076
- C:\Windows\System\kUtbeCU.exe
  C:\Windows\System\kUtbeCU.exe
  2⤵
  PID:3468
- C:\Windows\System\EbMRYNx.exe
  C:\Windows\System\EbMRYNx.exe
  2⤵
  PID:3372
- C:\Windows\System\KFFQFCX.exe
  C:\Windows\System\KFFQFCX.exe
  2⤵
  PID:3628
- C:\Windows\System\RFibsnD.exe
  C:\Windows\System\RFibsnD.exe
  2⤵
  PID:3736
- C:\Windows\System\OlrkXCh.exe
  C:\Windows\System\OlrkXCh.exe
  2⤵
  PID:3884
- C:\Windows\System\LiwwfZQ.exe
  C:\Windows\System\LiwwfZQ.exe
  2⤵
  PID:3996
- C:\Windows\System\rUsafms.exe
  C:\Windows\System\rUsafms.exe
  2⤵
  PID:3176
- C:\Windows\System\FpfSSXP.exe
  C:\Windows\System\FpfSSXP.exe
  2⤵
  PID:3272
- C:\Windows\System\nYdHaYK.exe
  C:\Windows\System\nYdHaYK.exe
  2⤵
  PID:4144
- C:\Windows\System\YVAWKnA.exe
  C:\Windows\System\YVAWKnA.exe
  2⤵
  PID:4212
- C:\Windows\System\gHZyqfF.exe
  C:\Windows\System\gHZyqfF.exe
  2⤵
  PID:4252
- C:\Windows\System\FGCXyGj.exe
  C:\Windows\System\FGCXyGj.exe
  2⤵
  PID:4268
- C:\Windows\System\ToaDhkK.exe
  C:\Windows\System\ToaDhkK.exe
  2⤵
  PID:3500
- C:\Windows\System\WSvsDcM.exe
  C:\Windows\System\WSvsDcM.exe
  2⤵
  PID:3976
- C:\Windows\System\tQapRpK.exe
  C:\Windows\System\tQapRpK.exe
  2⤵
  PID:3436
- C:\Windows\System\AOWOUdj.exe
  C:\Windows\System\AOWOUdj.exe
  2⤵
  PID:3644
- C:\Windows\System\zYGfZxY.exe
  C:\Windows\System\zYGfZxY.exe
  2⤵
  PID:4196
- C:\Windows\System\ofWqeeH.exe
  C:\Windows\System\ofWqeeH.exe
  2⤵
  PID:4288
- C:\Windows\System\tKhqWfM.exe
  C:\Windows\System\tKhqWfM.exe
  2⤵
  PID:3228
- C:\Windows\System\GKKkfUx.exe
  C:\Windows\System\GKKkfUx.exe
  2⤵
  PID:4324
- C:\Windows\System\nzGEcju.exe
  C:\Windows\System\nzGEcju.exe
  2⤵
  PID:3912
- C:\Windows\System\DifghWC.exe
  C:\Windows\System\DifghWC.exe
  2⤵
  PID:3768
- C:\Windows\System\pffklvR.exe
  C:\Windows\System\pffklvR.exe
  2⤵
  PID:3132
- C:\Windows\System\qkXugcw.exe
  C:\Windows\System\qkXugcw.exe
  2⤵
  PID:3980
- C:\Windows\System\kTiqhAn.exe
  C:\Windows\System\kTiqhAn.exe
  2⤵
  PID:4460
- C:\Windows\System\AHvQCWD.exe
  C:\Windows\System\AHvQCWD.exe
  2⤵
  PID:4380
- C:\Windows\System\BmvGZWw.exe
  C:\Windows\System\BmvGZWw.exe
  2⤵
  PID:4444
- C:\Windows\System\gQcWtgB.exe
  C:\Windows\System\gQcWtgB.exe
  2⤵
  PID:4508
- C:\Windows\System\rsLvkEa.exe
  C:\Windows\System\rsLvkEa.exe
  2⤵
  PID:4524
- C:\Windows\System\qAmurHY.exe
  C:\Windows\System\qAmurHY.exe
  2⤵
  PID:4556
- C:\Windows\System\rRoTjjN.exe
  C:\Windows\System\rRoTjjN.exe
  2⤵
  PID:4660
- C:\Windows\System\GqQTftr.exe
  C:\Windows\System\GqQTftr.exe
  2⤵
  PID:4724
- C:\Windows\System\qrsIGwg.exe
  C:\Windows\System\qrsIGwg.exe
  2⤵
  PID:4592
- C:\Windows\System\anSUWNJ.exe
  C:\Windows\System\anSUWNJ.exe
  2⤵
  PID:4648
- C:\Windows\System\SdADgmV.exe
  C:\Windows\System\SdADgmV.exe
  2⤵
  PID:4792
- C:\Windows\System\cIKVvJC.exe
  C:\Windows\System\cIKVvJC.exe
  2⤵
  PID:4832
- C:\Windows\System\FWHfePn.exe
  C:\Windows\System\FWHfePn.exe
  2⤵
  PID:4900
- C:\Windows\System\wrcaXAK.exe
  C:\Windows\System\wrcaXAK.exe
  2⤵
  PID:4964
- C:\Windows\System\mvdzffX.exe
  C:\Windows\System\mvdzffX.exe
  2⤵
  PID:4612
- C:\Windows\System\EEITFpv.exe
  C:\Windows\System\EEITFpv.exe
  2⤵
  PID:4680
- C:\Windows\System\AbegyoC.exe
  C:\Windows\System\AbegyoC.exe
  2⤵
  PID:4744
- C:\Windows\System\DLCJwkL.exe
  C:\Windows\System\DLCJwkL.exe
  2⤵
  PID:4844
- C:\Windows\System\agMkbfA.exe
  C:\Windows\System\agMkbfA.exe
  2⤵
  PID:4912
- C:\Windows\System\yXzyKnq.exe
  C:\Windows\System\yXzyKnq.exe
  2⤵
  PID:4976
- C:\Windows\System\bfwNgiN.exe
  C:\Windows\System\bfwNgiN.exe
  2⤵
  PID:5016
- C:\Windows\System\ToaJjBk.exe
  C:\Windows\System\ToaJjBk.exe
  2⤵
  PID:5084
- C:\Windows\System\jZrRvJl.exe
  C:\Windows\System\jZrRvJl.exe
  2⤵
  PID:5072
- C:\Windows\System\MPBeMjs.exe
  C:\Windows\System\MPBeMjs.exe
  2⤵
  PID:5112
- C:\Windows\System\AJcNACy.exe
  C:\Windows\System\AJcNACy.exe
  2⤵
  PID:2748
- C:\Windows\System\FwvVESA.exe
  C:\Windows\System\FwvVESA.exe
  2⤵
  PID:3580
- C:\Windows\System\KEgpbqh.exe
  C:\Windows\System\KEgpbqh.exe
  2⤵
  PID:3932
- C:\Windows\System\ATBDBkd.exe
  C:\Windows\System\ATBDBkd.exe
  2⤵
  PID:2284
- C:\Windows\System\yDZmAWb.exe
  C:\Windows\System\yDZmAWb.exe
  2⤵
  PID:3820
- C:\Windows\System\WzSyUIL.exe
  C:\Windows\System\WzSyUIL.exe
  2⤵
  PID:4260
- C:\Windows\System\CNxXbwZ.exe
  C:\Windows\System\CNxXbwZ.exe
  2⤵
  PID:4128
- C:\Windows\System\GoaeUQe.exe
  C:\Windows\System\GoaeUQe.exe
  2⤵
  PID:3324
- C:\Windows\System\qmLdDxl.exe
  C:\Windows\System\qmLdDxl.exe
  2⤵
  PID:4344
- C:\Windows\System\NbvQzBU.exe
  C:\Windows\System\NbvQzBU.exe
  2⤵
  PID:2776
- C:\Windows\System\OZUkPcr.exe
  C:\Windows\System\OZUkPcr.exe
  2⤵
  PID:3292
- C:\Windows\System\OvGuyIs.exe
  C:\Windows\System\OvGuyIs.exe
  2⤵
  PID:3212
- C:\Windows\System\DdNPYCh.exe
  C:\Windows\System\DdNPYCh.exe
  2⤵
  PID:4028
- C:\Windows\System\jffjrTc.exe
  C:\Windows\System\jffjrTc.exe
  2⤵
  PID:4480
- C:\Windows\System\MUHRAZC.exe
  C:\Windows\System\MUHRAZC.exe
  2⤵
  PID:4392
- C:\Windows\System\UDrhhHG.exe
  C:\Windows\System\UDrhhHG.exe
  2⤵
  PID:4504
- C:\Windows\System\UOpxkvF.exe
  C:\Windows\System\UOpxkvF.exe
  2⤵
  PID:4628
- C:\Windows\System\oYhdjtD.exe
  C:\Windows\System\oYhdjtD.exe
  2⤵
  PID:4644
- C:\Windows\System\teLfcUA.exe
  C:\Windows\System\teLfcUA.exe
  2⤵
  PID:4576
- C:\Windows\System\FwYaWRR.exe
  C:\Windows\System\FwYaWRR.exe
  2⤵
  PID:5000
- C:\Windows\System\uUnmisd.exe
  C:\Windows\System\uUnmisd.exe
  2⤵
  PID:4432
- C:\Windows\System\pZKDkQd.exe
  C:\Windows\System\pZKDkQd.exe
  2⤵
  PID:3660
- C:\Windows\System\KNeLNlZ.exe
  C:\Windows\System\KNeLNlZ.exe
  2⤵
  PID:4788
- C:\Windows\System\KLUTkMN.exe
  C:\Windows\System\KLUTkMN.exe
  2⤵
  PID:5024
- C:\Windows\System\jdhIFlO.exe
  C:\Windows\System\jdhIFlO.exe
  2⤵
  PID:5108
- C:\Windows\System\xnoOPlB.exe
  C:\Windows\System\xnoOPlB.exe
  2⤵
  PID:5092
- C:\Windows\System\zdrOhfO.exe
  C:\Windows\System\zdrOhfO.exe
  2⤵
  PID:4880
- C:\Windows\System\pLXySae.exe
  C:\Windows\System\pLXySae.exe
  2⤵
  PID:3104
- C:\Windows\System\HaFuFtH.exe
  C:\Windows\System\HaFuFtH.exe
  2⤵
  PID:1880
- C:\Windows\System\XgAmXbY.exe
  C:\Windows\System\XgAmXbY.exe
  2⤵
  PID:3548
- C:\Windows\System\jrNuULs.exe
  C:\Windows\System\jrNuULs.exe
  2⤵
  PID:4192
- C:\Windows\System\QtMOZHv.exe
  C:\Windows\System\QtMOZHv.exe
  2⤵
  PID:4116
- C:\Windows\System\xtnEKug.exe
  C:\Windows\System\xtnEKug.exe
  2⤵
  PID:4428
- C:\Windows\System\nTGYeJP.exe
  C:\Windows\System\nTGYeJP.exe
  2⤵
  PID:4892
- C:\Windows\System\wUfmPDM.exe
  C:\Windows\System\wUfmPDM.exe
  2⤵
  PID:4484
- C:\Windows\System\cTrlOYu.exe
  C:\Windows\System\cTrlOYu.exe
  2⤵
  PID:4340
- C:\Windows\System\feSFehM.exe
  C:\Windows\System\feSFehM.exe
  2⤵
  PID:4948
- C:\Windows\System\yZvCSqH.exe
  C:\Windows\System\yZvCSqH.exe
  2⤵
  PID:4740
- C:\Windows\System\VJGMzIu.exe
  C:\Windows\System\VJGMzIu.exe
  2⤵
  PID:5104
- C:\Windows\System\SgnjHKM.exe
  C:\Windows\System\SgnjHKM.exe
  2⤵
  PID:5088
- C:\Windows\System\BTnVvgC.exe
  C:\Windows\System\BTnVvgC.exe
  2⤵
  PID:4012
- C:\Windows\System\DgJlDeA.exe
  C:\Windows\System\DgJlDeA.exe
  2⤵
  PID:5124
- C:\Windows\System\orWogtn.exe
  C:\Windows\System\orWogtn.exe
  2⤵
  PID:5140
- C:\Windows\System\cTMGHcq.exe
  C:\Windows\System\cTMGHcq.exe
  2⤵
  PID:5156
- C:\Windows\System\ORZcyhh.exe
  C:\Windows\System\ORZcyhh.exe
  2⤵
  PID:5172
- C:\Windows\System\rksmONS.exe
  C:\Windows\System\rksmONS.exe
  2⤵
  PID:5188
- C:\Windows\System\EmqdODY.exe
  C:\Windows\System\EmqdODY.exe
  2⤵
  PID:5204
- C:\Windows\System\uDgmHhe.exe
  C:\Windows\System\uDgmHhe.exe
  2⤵
  PID:5228
- C:\Windows\System\kdhmSPX.exe
  C:\Windows\System\kdhmSPX.exe
  2⤵
  PID:5248
- C:\Windows\System\jgPafWx.exe
  C:\Windows\System\jgPafWx.exe
  2⤵
  PID:5264
- C:\Windows\System\brgCUmx.exe
  C:\Windows\System\brgCUmx.exe
  2⤵
  PID:5280
- C:\Windows\System\ipjkpqn.exe
  C:\Windows\System\ipjkpqn.exe
  2⤵
  PID:5304
- C:\Windows\System\DeBNQXW.exe
  C:\Windows\System\DeBNQXW.exe
  2⤵
  PID:5320
- C:\Windows\System\bTDdWWB.exe
  C:\Windows\System\bTDdWWB.exe
  2⤵
  PID:5336
- C:\Windows\System\aEPqGIK.exe
  C:\Windows\System\aEPqGIK.exe
  2⤵
  PID:5352
- C:\Windows\System\enOHcMr.exe
  C:\Windows\System\enOHcMr.exe
  2⤵
  PID:5368
- C:\Windows\System\QLmzZKH.exe
  C:\Windows\System\QLmzZKH.exe
  2⤵
  PID:5384
- C:\Windows\System\KzoZQpQ.exe
  C:\Windows\System\KzoZQpQ.exe
  2⤵
  PID:5400
- C:\Windows\System\LFhxaeJ.exe
  C:\Windows\System\LFhxaeJ.exe
  2⤵
  PID:5416
- C:\Windows\System\eAtDHEL.exe
  C:\Windows\System\eAtDHEL.exe
  2⤵
  PID:5432
- C:\Windows\System\nAzOJYk.exe
  C:\Windows\System\nAzOJYk.exe
  2⤵
  PID:5448
- C:\Windows\System\MRrZwcs.exe
  C:\Windows\System\MRrZwcs.exe
  2⤵
  PID:5468
- C:\Windows\System\IWpqROn.exe
  C:\Windows\System\IWpqROn.exe
  2⤵
  PID:5484
- C:\Windows\System\jpkUhEA.exe
  C:\Windows\System\jpkUhEA.exe
  2⤵
  PID:5524
- C:\Windows\System\LrMpYNa.exe
  C:\Windows\System\LrMpYNa.exe
  2⤵
  PID:5540
- C:\Windows\System\MULRtfr.exe
  C:\Windows\System\MULRtfr.exe
  2⤵
  PID:5556
- C:\Windows\System\GrfdGkT.exe
  C:\Windows\System\GrfdGkT.exe
  2⤵
  PID:5572
- C:\Windows\System\LOQkLMa.exe
  C:\Windows\System\LOQkLMa.exe
  2⤵
  PID:5588
- C:\Windows\System\QfQLRzw.exe
  C:\Windows\System\QfQLRzw.exe
  2⤵
  PID:5608
- C:\Windows\System\jOYYHKa.exe
  C:\Windows\System\jOYYHKa.exe
  2⤵
  PID:5624
- C:\Windows\System\qOxveiQ.exe
  C:\Windows\System\qOxveiQ.exe
  2⤵
  PID:5640
- C:\Windows\System\nVwiqgF.exe
  C:\Windows\System\nVwiqgF.exe
  2⤵
  PID:5656
- C:\Windows\System\yFzyhNh.exe
  C:\Windows\System\yFzyhNh.exe
  2⤵
  PID:5676
- C:\Windows\System\mxQtPFR.exe
  C:\Windows\System\mxQtPFR.exe
  2⤵
  PID:5692
- C:\Windows\System\UcCTVSn.exe
  C:\Windows\System\UcCTVSn.exe
  2⤵
  PID:5708
- C:\Windows\System\dTLBhoD.exe
  C:\Windows\System\dTLBhoD.exe
  2⤵
  PID:5724
- C:\Windows\System\nyvuITy.exe
  C:\Windows\System\nyvuITy.exe
  2⤵
  PID:5744
- C:\Windows\System\nXENoRn.exe
  C:\Windows\System\nXENoRn.exe
  2⤵
  PID:5760
- C:\Windows\System\mnUveNg.exe
  C:\Windows\System\mnUveNg.exe
  2⤵
  PID:5776
- C:\Windows\System\fzeRibi.exe
  C:\Windows\System\fzeRibi.exe
  2⤵
  PID:5848
- C:\Windows\System\aVIOpMW.exe
  C:\Windows\System\aVIOpMW.exe
  2⤵
  PID:5872
- C:\Windows\System\NRyyUHR.exe
  C:\Windows\System\NRyyUHR.exe
  2⤵
  PID:5888
- C:\Windows\System\vQolGaL.exe
  C:\Windows\System\vQolGaL.exe
  2⤵
  PID:5908
- C:\Windows\System\QnDGfJV.exe
  C:\Windows\System\QnDGfJV.exe
  2⤵
  PID:5924
- C:\Windows\System\KSlMbbP.exe
  C:\Windows\System\KSlMbbP.exe
  2⤵
  PID:5940
- C:\Windows\System\RmnSVUL.exe
  C:\Windows\System\RmnSVUL.exe
  2⤵
  PID:5956
- C:\Windows\System\lepQeCa.exe
  C:\Windows\System\lepQeCa.exe
  2⤵
  PID:5972
- C:\Windows\System\dbPeKMM.exe
  C:\Windows\System\dbPeKMM.exe
  2⤵
  PID:5988
- C:\Windows\System\mYFlIqT.exe
  C:\Windows\System\mYFlIqT.exe
  2⤵
  PID:6008
- C:\Windows\System\qmIOuxx.exe
  C:\Windows\System\qmIOuxx.exe
  2⤵
  PID:6024
- C:\Windows\System\UBEdpPv.exe
  C:\Windows\System\UBEdpPv.exe
  2⤵
  PID:6040
- C:\Windows\System\pvFxBcF.exe
  C:\Windows\System\pvFxBcF.exe
  2⤵
  PID:6056
- C:\Windows\System\DbRhIgD.exe
  C:\Windows\System\DbRhIgD.exe
  2⤵
  PID:6072
- C:\Windows\System\KkQHVpA.exe
  C:\Windows\System\KkQHVpA.exe
  2⤵
  PID:1628
- C:\Windows\System\GixvJjK.exe
  C:\Windows\System\GixvJjK.exe
  2⤵
  PID:5012
- C:\Windows\System\hSfmLnw.exe
  C:\Windows\System\hSfmLnw.exe
  2⤵
  PID:5136
- C:\Windows\System\xrIksXW.exe
  C:\Windows\System\xrIksXW.exe
  2⤵
  PID:5068
- C:\Windows\System\ziqzpSz.exe
  C:\Windows\System\ziqzpSz.exe
  2⤵
  PID:5224
- C:\Windows\System\dksljLB.exe
  C:\Windows\System\dksljLB.exe
  2⤵
  PID:5244
- C:\Windows\System\GbQBXXv.exe
  C:\Windows\System\GbQBXXv.exe
  2⤵
  PID:5296
- C:\Windows\System\zEMLJpG.exe
  C:\Windows\System\zEMLJpG.exe
  2⤵
  PID:5360
- C:\Windows\System\ABtHzFV.exe
  C:\Windows\System\ABtHzFV.exe
  2⤵
  PID:5424
- C:\Windows\System\NOearKH.exe
  C:\Windows\System\NOearKH.exe
  2⤵
  PID:5460
- C:\Windows\System\dJaHPsZ.exe
  C:\Windows\System\dJaHPsZ.exe
  2⤵
  PID:5408
- C:\Windows\System\gIDjtAL.exe
  C:\Windows\System\gIDjtAL.exe
  2⤵
  PID:5480
- C:\Windows\System\mIAOTZh.exe
  C:\Windows\System\mIAOTZh.exe
  2⤵
  PID:5520
- C:\Windows\System\WFMluAs.exe
  C:\Windows\System\WFMluAs.exe
  2⤵
  PID:5648
- C:\Windows\System\zztLjty.exe
  C:\Windows\System\zztLjty.exe
  2⤵
  PID:5584
- C:\Windows\System\NtQVOjH.exe
  C:\Windows\System\NtQVOjH.exe
  2⤵
  PID:5716
- C:\Windows\System\Tipkzyu.exe
  C:\Windows\System\Tipkzyu.exe
  2⤵
  PID:5564
- C:\Windows\System\MPpjQJq.exe
  C:\Windows\System\MPpjQJq.exe
  2⤵
  PID:5752
- C:\Windows\System\JaTPcZC.exe
  C:\Windows\System\JaTPcZC.exe
  2⤵
  PID:5704
- C:\Windows\System\XxWuyOT.exe
  C:\Windows\System\XxWuyOT.exe
  2⤵
  PID:5824
- C:\Windows\System\TlpJBQd.exe
  C:\Windows\System\TlpJBQd.exe
  2⤵
  PID:5880
- C:\Windows\System\ZKLXleS.exe
  C:\Windows\System\ZKLXleS.exe
  2⤵
  PID:5884
- C:\Windows\System\MKFEUIL.exe
  C:\Windows\System\MKFEUIL.exe
  2⤵
  PID:5952
- C:\Windows\System\VXVMols.exe
  C:\Windows\System\VXVMols.exe
  2⤵
  PID:6020
- C:\Windows\System\ldyGVOK.exe
  C:\Windows\System\ldyGVOK.exe
  2⤵
  PID:5904
- C:\Windows\System\RYfJEeU.exe
  C:\Windows\System\RYfJEeU.exe
  2⤵
  PID:5968
- C:\Windows\System\qwbBUCd.exe
  C:\Windows\System\qwbBUCd.exe
  2⤵
  PID:3752
- C:\Windows\System\dNltEvU.exe
  C:\Windows\System\dNltEvU.exe
  2⤵
  PID:3692
- C:\Windows\System\hbzRWQo.exe
  C:\Windows\System\hbzRWQo.exe
  2⤵
  PID:4944
- C:\Windows\System\vnCuKin.exe
  C:\Windows\System\vnCuKin.exe
  2⤵
  PID:4760
- C:\Windows\System\XcEIbCL.exe
  C:\Windows\System\XcEIbCL.exe
  2⤵
  PID:5216
- C:\Windows\System\UCzAVUd.exe
  C:\Windows\System\UCzAVUd.exe
  2⤵
  PID:5896
- C:\Windows\System\GjHnJaV.exe
  C:\Windows\System\GjHnJaV.exe
  2⤵
  PID:5344
- C:\Windows\System\pqkcBNI.exe
  C:\Windows\System\pqkcBNI.exe
  2⤵
  PID:5548
- C:\Windows\System\PYdQzFa.exe
  C:\Windows\System\PYdQzFa.exe
  2⤵
  PID:5668
- C:\Windows\System\saGgIQW.exe
  C:\Windows\System\saGgIQW.exe
  2⤵
  PID:5672
- C:\Windows\System\PHYHtpM.exe
  C:\Windows\System\PHYHtpM.exe
  2⤵
  PID:5792
- C:\Windows\System\ksybsae.exe
  C:\Windows\System\ksybsae.exe
  2⤵
  PID:5800
- C:\Windows\System\vEMdwlv.exe
  C:\Windows\System\vEMdwlv.exe
  2⤵
  PID:4228
- C:\Windows\System\awAlfKd.exe
  C:\Windows\System\awAlfKd.exe
  2⤵
  PID:5812
- C:\Windows\System\aLswivn.exe
  C:\Windows\System\aLswivn.exe
  2⤵
  PID:6052
- C:\Windows\System\bkeOjJe.exe
  C:\Windows\System\bkeOjJe.exe
  2⤵
  PID:6064
- C:\Windows\System\PfxCDkB.exe
  C:\Windows\System\PfxCDkB.exe
  2⤵
  PID:6120
- C:\Windows\System\FNjRTti.exe
  C:\Windows\System\FNjRTti.exe
  2⤵
  PID:6140
- C:\Windows\System\XjpLOiB.exe
  C:\Windows\System\XjpLOiB.exe
  2⤵
  PID:4696
- C:\Windows\System\dhUtwFF.exe
  C:\Windows\System\dhUtwFF.exe
  2⤵
  PID:4808
- C:\Windows\System\tmBJzCA.exe
  C:\Windows\System\tmBJzCA.exe
  2⤵
  PID:4416
- C:\Windows\System\OmzGBah.exe
  C:\Windows\System\OmzGBah.exe
  2⤵
  PID:5168
- C:\Windows\System\ukpIEeg.exe
  C:\Windows\System\ukpIEeg.exe
  2⤵
  PID:5288
- C:\Windows\System\lJNqvCa.exe
  C:\Windows\System\lJNqvCa.exe
  2⤵
  PID:5392
- C:\Windows\System\YctnivC.exe
  C:\Windows\System\YctnivC.exe
  2⤵
  PID:5492
- C:\Windows\System\jSySLBh.exe
  C:\Windows\System\jSySLBh.exe
  2⤵
  PID:4284
- C:\Windows\System\lFVfoOD.exe
  C:\Windows\System\lFVfoOD.exe
  2⤵
  PID:4356
- C:\Windows\System\iAJJhEa.exe
  C:\Windows\System\iAJJhEa.exe
  2⤵
  PID:5440
- C:\Windows\System\YlIGhuU.exe
  C:\Windows\System\YlIGhuU.exe
  2⤵
  PID:5756
- C:\Windows\System\KszoiMo.exe
  C:\Windows\System\KszoiMo.exe
  2⤵
  PID:5516
- C:\Windows\System\jkTzaaG.exe
  C:\Windows\System\jkTzaaG.exe
  2⤵
  PID:5836
- C:\Windows\System\hWlWkVi.exe
  C:\Windows\System\hWlWkVi.exe
  2⤵
  PID:5736
- C:\Windows\System\OtOkUYE.exe
  C:\Windows\System\OtOkUYE.exe
  2⤵
  PID:5808
- C:\Windows\System\yNTQXDK.exe
  C:\Windows\System\yNTQXDK.exe
  2⤵
  PID:2456
- C:\Windows\System\vEuqsWw.exe
  C:\Windows\System\vEuqsWw.exe
  2⤵
  PID:6088
- C:\Windows\System\rvMjdCe.exe
  C:\Windows\System\rvMjdCe.exe
  2⤵
  PID:6068
- C:\Windows\System\KnIwmju.exe
  C:\Windows\System\KnIwmju.exe
  2⤵
  PID:6112
- C:\Windows\System\QQWVpwC.exe
  C:\Windows\System\QQWVpwC.exe
  2⤵
  PID:6132
- C:\Windows\System\jufmObq.exe
  C:\Windows\System\jufmObq.exe
  2⤵
  PID:5132
- C:\Windows\System\QYjpUIC.exe
  C:\Windows\System\QYjpUIC.exe
  2⤵
  PID:5816
- C:\Windows\System\pcEfJYG.exe
  C:\Windows\System\pcEfJYG.exe
  2⤵
  PID:5376
- C:\Windows\System\zbhySQZ.exe
  C:\Windows\System\zbhySQZ.exe
  2⤵
  PID:5860
- C:\Windows\System\GaUTKJu.exe
  C:\Windows\System\GaUTKJu.exe
  2⤵
  PID:5784
- C:\Windows\System\YBFmMrf.exe
  C:\Windows\System\YBFmMrf.exe
  2⤵
  PID:5632
- C:\Windows\System\jYbXCag.exe
  C:\Windows\System\jYbXCag.exe
  2⤵
  PID:6084
- C:\Windows\System\MWzRTaO.exe
  C:\Windows\System\MWzRTaO.exe
  2⤵
  PID:4712
- C:\Windows\System\EnrLoPZ.exe
  C:\Windows\System\EnrLoPZ.exe
  2⤵
  PID:4776
- C:\Windows\System\KvswtTO.exe
  C:\Windows\System\KvswtTO.exe
  2⤵
  PID:5732
- C:\Windows\System\ywsmzOA.exe
  C:\Windows\System\ywsmzOA.exe
  2⤵
  PID:5920
- C:\Windows\System\RTDAPUI.exe
  C:\Windows\System\RTDAPUI.exe
  2⤵
  PID:6128
- C:\Windows\System\RIEgZMN.exe
  C:\Windows\System\RIEgZMN.exe
  2⤵
  PID:6032
- C:\Windows\System\pVRolqG.exe
  C:\Windows\System\pVRolqG.exe
  2⤵
  PID:5532
- C:\Windows\System\SWgZpQV.exe
  C:\Windows\System\SWgZpQV.exe
  2⤵
  PID:5984
- C:\Windows\System\ZtwEkzU.exe
  C:\Windows\System\ZtwEkzU.exe
  2⤵
  PID:3612
- C:\Windows\System\FOttLXf.exe
  C:\Windows\System\FOttLXf.exe
  2⤵
  PID:5768
- C:\Windows\System\NHwmvRr.exe
  C:\Windows\System\NHwmvRr.exe
  2⤵
  PID:6148
- C:\Windows\System\ZSlGVoL.exe
  C:\Windows\System\ZSlGVoL.exe
  2⤵
  PID:6164
- C:\Windows\System\VLexakF.exe
  C:\Windows\System\VLexakF.exe
  2⤵
  PID:6180
- C:\Windows\System\LFZVlZz.exe
  C:\Windows\System\LFZVlZz.exe
  2⤵
  PID:6196
- C:\Windows\System\CDyvauw.exe
  C:\Windows\System\CDyvauw.exe
  2⤵
  PID:6212
- C:\Windows\System\xGwtSdh.exe
  C:\Windows\System\xGwtSdh.exe
  2⤵
  PID:6228
- C:\Windows\System\jiCDDFZ.exe
  C:\Windows\System\jiCDDFZ.exe
  2⤵
  PID:6244
- C:\Windows\System\kcUSILj.exe
  C:\Windows\System\kcUSILj.exe
  2⤵
  PID:6264
- C:\Windows\System\MMsazNS.exe
  C:\Windows\System\MMsazNS.exe
  2⤵
  PID:6288
- C:\Windows\System\sOLvQDM.exe
  C:\Windows\System\sOLvQDM.exe
  2⤵
  PID:6304
- C:\Windows\System\hkzJbzf.exe
  C:\Windows\System\hkzJbzf.exe
  2⤵
  PID:6320
- C:\Windows\System\oDwqfQS.exe
  C:\Windows\System\oDwqfQS.exe
  2⤵
  PID:6336
- C:\Windows\System\JPOoGli.exe
  C:\Windows\System\JPOoGli.exe
  2⤵
  PID:6352
- C:\Windows\System\LsomRCy.exe
  C:\Windows\System\LsomRCy.exe
  2⤵
  PID:6372
- C:\Windows\System\EjUybtm.exe
  C:\Windows\System\EjUybtm.exe
  2⤵
  PID:6388
- C:\Windows\System\iDKcKYL.exe
  C:\Windows\System\iDKcKYL.exe
  2⤵
  PID:6436
- C:\Windows\System\ljQGDZU.exe
  C:\Windows\System\ljQGDZU.exe
  2⤵
  PID:6452
- C:\Windows\System\iReXtFg.exe
  C:\Windows\System\iReXtFg.exe
  2⤵
  PID:6468
- C:\Windows\System\nzYeECs.exe
  C:\Windows\System\nzYeECs.exe
  2⤵
  PID:6484
- C:\Windows\System\fWzAnIA.exe
  C:\Windows\System\fWzAnIA.exe
  2⤵
  PID:6504
- C:\Windows\System\sWAnjnj.exe
  C:\Windows\System\sWAnjnj.exe
  2⤵
  PID:6520
- C:\Windows\System\jCNfKvK.exe
  C:\Windows\System\jCNfKvK.exe
  2⤵
  PID:6536
- C:\Windows\System\MTVgAyl.exe
  C:\Windows\System\MTVgAyl.exe
  2⤵
  PID:6552
- C:\Windows\System\jGInFvV.exe
  C:\Windows\System\jGInFvV.exe
  2⤵
  PID:6568
- C:\Windows\System\vdQHGGn.exe
  C:\Windows\System\vdQHGGn.exe
  2⤵
  PID:6584
- C:\Windows\System\xzpPBPq.exe
  C:\Windows\System\xzpPBPq.exe
  2⤵
  PID:6600
- C:\Windows\System\xbuHBZo.exe
  C:\Windows\System\xbuHBZo.exe
  2⤵
  PID:6616
- C:\Windows\System\lNXhboF.exe
  C:\Windows\System\lNXhboF.exe
  2⤵
  PID:6632
- C:\Windows\System\bUEmvzj.exe
  C:\Windows\System\bUEmvzj.exe
  2⤵
  PID:6648
- C:\Windows\System\ktcBCqd.exe
  C:\Windows\System\ktcBCqd.exe
  2⤵
  PID:6664
- C:\Windows\System\SqTmczk.exe
  C:\Windows\System\SqTmczk.exe
  2⤵
  PID:6680
- C:\Windows\System\TKlzwzl.exe
  C:\Windows\System\TKlzwzl.exe
  2⤵
  PID:6696
- C:\Windows\System\gXTtBUj.exe
  C:\Windows\System\gXTtBUj.exe
  2⤵
  PID:6712
- C:\Windows\System\HAGkrWI.exe
  C:\Windows\System\HAGkrWI.exe
  2⤵
  PID:6728
- C:\Windows\System\CMkYNdV.exe
  C:\Windows\System\CMkYNdV.exe
  2⤵
  PID:6744
- C:\Windows\System\eFRVxIf.exe
  C:\Windows\System\eFRVxIf.exe
  2⤵
  PID:6760
- C:\Windows\System\gNhYYZL.exe
  C:\Windows\System\gNhYYZL.exe
  2⤵
  PID:6776
- C:\Windows\System\gfxbSZD.exe
  C:\Windows\System\gfxbSZD.exe
  2⤵
  PID:6792
- C:\Windows\System\qurHzbt.exe
  C:\Windows\System\qurHzbt.exe
  2⤵
  PID:6808
- C:\Windows\System\gFHSTFW.exe
  C:\Windows\System\gFHSTFW.exe
  2⤵
  PID:6824
- C:\Windows\System\kCLkZyx.exe
  C:\Windows\System\kCLkZyx.exe
  2⤵
  PID:6844
- C:\Windows\System\xkTJmDp.exe
  C:\Windows\System\xkTJmDp.exe
  2⤵
  PID:6864
- C:\Windows\System\trtujPt.exe
  C:\Windows\System\trtujPt.exe
  2⤵
  PID:6880
- C:\Windows\System\YtFIvJS.exe
  C:\Windows\System\YtFIvJS.exe
  2⤵
  PID:6896
- C:\Windows\System\kyQnBpF.exe
  C:\Windows\System\kyQnBpF.exe
  2⤵
  PID:6916
- C:\Windows\System\OfRgJoX.exe
  C:\Windows\System\OfRgJoX.exe
  2⤵
  PID:6932
- C:\Windows\System\AFkaHKI.exe
  C:\Windows\System\AFkaHKI.exe
  2⤵
  PID:6988
- C:\Windows\System\jJaUbhJ.exe
  C:\Windows\System\jJaUbhJ.exe
  2⤵
  PID:7004
- C:\Windows\System\HGWLJfC.exe
  C:\Windows\System\HGWLJfC.exe
  2⤵
  PID:7020
- C:\Windows\System\nHoMSMJ.exe
  C:\Windows\System\nHoMSMJ.exe
  2⤵
  PID:7036
- C:\Windows\System\XhYDwAS.exe
  C:\Windows\System\XhYDwAS.exe
  2⤵
  PID:7052
- C:\Windows\System\OIorJmY.exe
  C:\Windows\System\OIorJmY.exe
  2⤵
  PID:7068
- C:\Windows\System\NkUqCCi.exe
  C:\Windows\System\NkUqCCi.exe
  2⤵
  PID:7084
- C:\Windows\System\NATBfUH.exe
  C:\Windows\System\NATBfUH.exe
  2⤵
  PID:7100
- C:\Windows\System\EXfAfdR.exe
  C:\Windows\System\EXfAfdR.exe
  2⤵
  PID:7116
- C:\Windows\System\SzZdJSh.exe
  C:\Windows\System\SzZdJSh.exe
  2⤵
  PID:7132
- C:\Windows\System\KciLlwJ.exe
  C:\Windows\System\KciLlwJ.exe
  2⤵
  PID:7148
- C:\Windows\System\ZFqbrnD.exe
  C:\Windows\System\ZFqbrnD.exe
  2⤵
  PID:7164
- C:\Windows\System\UgRnpjH.exe
  C:\Windows\System\UgRnpjH.exe
  2⤵
  PID:6192
- C:\Windows\System\tXBShCo.exe
  C:\Windows\System\tXBShCo.exe
  2⤵
  PID:6260
- C:\Windows\System\jehiUUJ.exe
  C:\Windows\System\jehiUUJ.exe
  2⤵
  PID:6332
- C:\Windows\System\uEgbhAw.exe
  C:\Windows\System\uEgbhAw.exe
  2⤵
  PID:6396
- C:\Windows\System\gpVCglk.exe
  C:\Windows\System\gpVCglk.exe
  2⤵
  PID:6404
- C:\Windows\System\RIUZrMt.exe
  C:\Windows\System\RIUZrMt.exe
  2⤵
  PID:6416
- C:\Windows\System\eDVypzA.exe
  C:\Windows\System\eDVypzA.exe
  2⤵
  PID:5932
- C:\Windows\System\ncOMRPS.exe
  C:\Windows\System\ncOMRPS.exe
  2⤵
  PID:6432
- C:\Windows\System\NqhyeCP.exe
  C:\Windows\System\NqhyeCP.exe
  2⤵
  PID:5444
- C:\Windows\System\MIlVsft.exe
  C:\Windows\System\MIlVsft.exe
  2⤵
  PID:6096
- C:\Windows\System\slHGnps.exe
  C:\Windows\System\slHGnps.exe
  2⤵
  PID:6528
- C:\Windows\System\HqISeTT.exe
  C:\Windows\System\HqISeTT.exe
  2⤵
  PID:6240
- C:\Windows\System\eKEfDCB.exe
  C:\Windows\System\eKEfDCB.exe
  2⤵
  PID:6512
- C:\Windows\System\idtJzTa.exe
  C:\Windows\System\idtJzTa.exe
  2⤵
  PID:5580
- C:\Windows\System\wriTRrW.exe
  C:\Windows\System\wriTRrW.exe
  2⤵
  PID:6176
- C:\Windows\System\tuaiAYr.exe
  C:\Windows\System\tuaiAYr.exe
  2⤵
  PID:6276
- C:\Windows\System\XaEUTMz.exe
  C:\Windows\System\XaEUTMz.exe
  2⤵
  PID:6656
- C:\Windows\System\XyxkpSw.exe
  C:\Windows\System\XyxkpSw.exe
  2⤵
  PID:6348
- C:\Windows\System\mVROuUS.exe
  C:\Windows\System\mVROuUS.exe
  2⤵
  PID:6692
- C:\Windows\System\MgtcRMA.exe
  C:\Windows\System\MgtcRMA.exe
  2⤵
  PID:6444
- C:\Windows\System\hUjtDYu.exe
  C:\Windows\System\hUjtDYu.exe
  2⤵
  PID:6724
- C:\Windows\System\xpwzkJa.exe
  C:\Windows\System\xpwzkJa.exe
  2⤵
  PID:6576
- C:\Windows\System\qyJNLTT.exe
  C:\Windows\System\qyJNLTT.exe
  2⤵
  PID:6784
- C:\Windows\System\TfGxaJQ.exe
  C:\Windows\System\TfGxaJQ.exe
  2⤵
  PID:6840
- C:\Windows\System\AupWwAH.exe
  C:\Windows\System\AupWwAH.exe
  2⤵
  PID:6860
- C:\Windows\System\yhrjvGY.exe
  C:\Windows\System\yhrjvGY.exe
  2⤵
  PID:6740
- C:\Windows\System\elBiPEo.exe
  C:\Windows\System\elBiPEo.exe
  2⤵
  PID:6836
- C:\Windows\System\vIwleEx.exe
  C:\Windows\System\vIwleEx.exe
  2⤵
  PID:6928
- C:\Windows\System\TXYzXYk.exe
  C:\Windows\System\TXYzXYk.exe
  2⤵
  PID:6908
- C:\Windows\System\WqGowLp.exe
  C:\Windows\System\WqGowLp.exe
  2⤵
  PID:6876
- C:\Windows\System\wVTwcFT.exe
  C:\Windows\System\wVTwcFT.exe
  2⤵
  PID:6952
- C:\Windows\System\ZdsQwmU.exe
  C:\Windows\System\ZdsQwmU.exe
  2⤵
  PID:6984
- C:\Windows\System\LbMggMH.exe
  C:\Windows\System\LbMggMH.exe
  2⤵
  PID:7048
- C:\Windows\System\KaPICJo.exe
  C:\Windows\System\KaPICJo.exe
  2⤵
  PID:7140
- C:\Windows\System\EMUFuEv.exe
  C:\Windows\System\EMUFuEv.exe
  2⤵
  PID:6300
- C:\Windows\System\wTYxjHp.exe
  C:\Windows\System\wTYxjHp.exe
  2⤵
  PID:5512
- C:\Windows\System\pKdLJpR.exe
  C:\Windows\System\pKdLJpR.exe
  2⤵
  PID:6996
- C:\Windows\System\yKAMUfM.exe
  C:\Windows\System\yKAMUfM.exe
  2⤵
  PID:4292
- C:\Windows\System\vBfRWsn.exe
  C:\Windows\System\vBfRWsn.exe
  2⤵
  PID:7032
- C:\Windows\System\ZVHTgFr.exe
  C:\Windows\System\ZVHTgFr.exe
  2⤵
  PID:6364
- C:\Windows\System\rgxZAtm.exe
  C:\Windows\System\rgxZAtm.exe
  2⤵
  PID:7124
- C:\Windows\System\CEeMNOG.exe
  C:\Windows\System\CEeMNOG.exe
  2⤵
  PID:7160
- C:\Windows\System\rlUmMSR.exe
  C:\Windows\System\rlUmMSR.exe
  2⤵
  PID:6660
- C:\Windows\System\IVEFxeU.exe
  C:\Windows\System\IVEFxeU.exe
  2⤵
  PID:5796
- C:\Windows\System\qrHEnbp.exe
  C:\Windows\System\qrHEnbp.exe
  2⤵
  PID:6476
- C:\Windows\System\qGhYgvs.exe
  C:\Windows\System\qGhYgvs.exe
  2⤵
  PID:6720
- C:\Windows\System\kFRcoAz.exe
  C:\Windows\System\kFRcoAz.exe
  2⤵
  PID:6272
- C:\Windows\System\XBQUcuj.exe
  C:\Windows\System\XBQUcuj.exe
  2⤵
  PID:6560
- C:\Windows\System\yHpiacd.exe
  C:\Windows\System\yHpiacd.exe
  2⤵
  PID:6756
- C:\Windows\System\SrAWhyU.exe
  C:\Windows\System\SrAWhyU.exe
  2⤵
  PID:6544
- C:\Windows\System\jCyuBkm.exe
  C:\Windows\System\jCyuBkm.exe
  2⤵
  PID:6676
- C:\Windows\System\DqKVtfv.exe
  C:\Windows\System\DqKVtfv.exe
  2⤵
  PID:6904
- C:\Windows\System\pmzTsGO.exe
  C:\Windows\System\pmzTsGO.exe
  2⤵
  PID:6944
- C:\Windows\System\tZndMmc.exe
  C:\Windows\System\tZndMmc.exe
  2⤵
  PID:6772
- C:\Windows\System\eExCwQc.exe
  C:\Windows\System\eExCwQc.exe
  2⤵
  PID:7044
- C:\Windows\System\DVLXIUF.exe
  C:\Windows\System\DVLXIUF.exe
  2⤵
  PID:6160
- C:\Windows\System\yAmafLT.exe
  C:\Windows\System\yAmafLT.exe
  2⤵
  PID:7060
- C:\Windows\System\RfgYOcF.exe
  C:\Windows\System\RfgYOcF.exe
  2⤵
  PID:6492
- C:\Windows\System\INrkTNm.exe
  C:\Windows\System\INrkTNm.exe
  2⤵
  PID:6592
- C:\Windows\System\PfYcjHl.exe
  C:\Windows\System\PfYcjHl.exe
  2⤵
  PID:6548
- C:\Windows\System\gFwApSk.exe
  C:\Windows\System\gFwApSk.exe
  2⤵
  PID:6608
- C:\Windows\System\ewRWGQD.exe
  C:\Windows\System\ewRWGQD.exe
  2⤵
  PID:6344
- C:\Windows\System\jweeTYv.exe
  C:\Windows\System\jweeTYv.exe
  2⤵
  PID:5332
- C:\Windows\System\OnObjwE.exe
  C:\Windows\System\OnObjwE.exe
  2⤵
  PID:6804
- C:\Windows\System\WDyJEiS.exe
  C:\Windows\System\WDyJEiS.exe
  2⤵
  PID:6832
- C:\Windows\System\ISLtnZD.exe
  C:\Windows\System\ISLtnZD.exe
  2⤵
  PID:6964
- C:\Windows\System\vOsrHRJ.exe
  C:\Windows\System\vOsrHRJ.exe
  2⤵
  PID:5180
- C:\Windows\System\uOpaQiR.exe
  C:\Windows\System\uOpaQiR.exe
  2⤵
  PID:5964
- C:\Windows\System\stnmvIT.exe
  C:\Windows\System\stnmvIT.exe
  2⤵
  PID:6236
- C:\Windows\System\XPTjsME.exe
  C:\Windows\System\XPTjsME.exe
  2⤵
  PID:6172
- C:\Windows\System\TqPOpKL.exe
  C:\Windows\System\TqPOpKL.exe
  2⤵
  PID:6892
- C:\Windows\System\YAONuOR.exe
  C:\Windows\System\YAONuOR.exe
  2⤵
  PID:6496
- C:\Windows\System\DjnyCIz.exe
  C:\Windows\System\DjnyCIz.exe
  2⤵
  PID:6612
- C:\Windows\System\dwPyUqu.exe
  C:\Windows\System\dwPyUqu.exe
  2⤵
  PID:6428
- C:\Windows\System\tZvfdTU.exe
  C:\Windows\System\tZvfdTU.exe
  2⤵
  PID:6252
- C:\Windows\System\VdtAQWx.exe
  C:\Windows\System\VdtAQWx.exe
  2⤵
  PID:7112
- C:\Windows\System\MNEUKeU.exe
  C:\Windows\System\MNEUKeU.exe
  2⤵
  PID:7184
- C:\Windows\System\xUNTiPC.exe
  C:\Windows\System\xUNTiPC.exe
  2⤵
  PID:7200
- C:\Windows\System\MLNwZui.exe
  C:\Windows\System\MLNwZui.exe
  2⤵
  PID:7216
- C:\Windows\System\ckJBwpA.exe
  C:\Windows\System\ckJBwpA.exe
  2⤵
  PID:7232
- C:\Windows\System\PMsOabE.exe
  C:\Windows\System\PMsOabE.exe
  2⤵
  PID:7252
- C:\Windows\System\DqHqSxx.exe
  C:\Windows\System\DqHqSxx.exe
  2⤵
  PID:7268
- C:\Windows\System\slnymaI.exe
  C:\Windows\System\slnymaI.exe
  2⤵
  PID:7284
- C:\Windows\System\xzznXjG.exe
  C:\Windows\System\xzznXjG.exe
  2⤵
  PID:7300
- C:\Windows\System\pcDEtoh.exe
  C:\Windows\System\pcDEtoh.exe
  2⤵
  PID:7316
- C:\Windows\System\qlZdNyj.exe
  C:\Windows\System\qlZdNyj.exe
  2⤵
  PID:7332
- C:\Windows\System\vaHAxCp.exe
  C:\Windows\System\vaHAxCp.exe
  2⤵
  PID:7348
- C:\Windows\System\mAlmIxp.exe
  C:\Windows\System\mAlmIxp.exe
  2⤵
  PID:7364
- C:\Windows\System\MGcIYWz.exe
  C:\Windows\System\MGcIYWz.exe
  2⤵
  PID:7384
- C:\Windows\System\mnXGBJD.exe
  C:\Windows\System\mnXGBJD.exe
  2⤵
  PID:7400
- C:\Windows\System\HrCwOgH.exe
  C:\Windows\System\HrCwOgH.exe
  2⤵
  PID:7416
- C:\Windows\System\HRfUFhL.exe
  C:\Windows\System\HRfUFhL.exe
  2⤵
  PID:7432
- C:\Windows\System\BSXnsXe.exe
  C:\Windows\System\BSXnsXe.exe
  2⤵
  PID:7448
- C:\Windows\System\LMcBrnB.exe
  C:\Windows\System\LMcBrnB.exe
  2⤵
  PID:7464
- C:\Windows\System\RVfSDZv.exe
  C:\Windows\System\RVfSDZv.exe
  2⤵
  PID:7480
- C:\Windows\System\vQGTSJr.exe
  C:\Windows\System\vQGTSJr.exe
  2⤵
  PID:7496
- C:\Windows\System\HMNvarc.exe
  C:\Windows\System\HMNvarc.exe
  2⤵
  PID:7512
- C:\Windows\System\ELMPrTZ.exe
  C:\Windows\System\ELMPrTZ.exe
  2⤵
  PID:7532
- C:\Windows\System\jmLPhWH.exe
  C:\Windows\System\jmLPhWH.exe
  2⤵
  PID:7548
- C:\Windows\System\UVVTDuY.exe
  C:\Windows\System\UVVTDuY.exe
  2⤵
  PID:7568
- C:\Windows\System\NRkllBC.exe
  C:\Windows\System\NRkllBC.exe
  2⤵
  PID:7584
- C:\Windows\System\UYpMBLn.exe
  C:\Windows\System\UYpMBLn.exe
  2⤵
  PID:7600
- C:\Windows\System\CGTRtmW.exe
  C:\Windows\System\CGTRtmW.exe
  2⤵
  PID:7616
- C:\Windows\System\NjPyFvT.exe
  C:\Windows\System\NjPyFvT.exe
  2⤵
  PID:7632
- C:\Windows\System\GCMsKow.exe
  C:\Windows\System\GCMsKow.exe
  2⤵
  PID:7648
- C:\Windows\System\vrwPLXc.exe
  C:\Windows\System\vrwPLXc.exe
  2⤵
  PID:7664
- C:\Windows\System\puSDHas.exe
  C:\Windows\System\puSDHas.exe
  2⤵
  PID:7680
- C:\Windows\System\wmTjykx.exe
  C:\Windows\System\wmTjykx.exe
  2⤵
  PID:7696
- C:\Windows\System\fcFpYRY.exe
  C:\Windows\System\fcFpYRY.exe
  2⤵
  PID:7712
- C:\Windows\System\fGTZRMm.exe
  C:\Windows\System\fGTZRMm.exe
  2⤵
  PID:7728
- C:\Windows\System\UopUVQY.exe
  C:\Windows\System\UopUVQY.exe
  2⤵
  PID:7744
- C:\Windows\System\Hroauhj.exe
  C:\Windows\System\Hroauhj.exe
  2⤵
  PID:7760
- C:\Windows\System\RpRNWXT.exe
  C:\Windows\System\RpRNWXT.exe
  2⤵
  PID:7776
- C:\Windows\System\fDxIpsF.exe
  C:\Windows\System\fDxIpsF.exe
  2⤵
  PID:7792
- C:\Windows\System\stojZGA.exe
  C:\Windows\System\stojZGA.exe
  2⤵
  PID:7808
- C:\Windows\System\gFNTBbh.exe
  C:\Windows\System\gFNTBbh.exe
  2⤵
  PID:7824
- C:\Windows\System\uWbRPfu.exe
  C:\Windows\System\uWbRPfu.exe
  2⤵
  PID:7840
- C:\Windows\System\kfkkWrF.exe
  C:\Windows\System\kfkkWrF.exe
  2⤵
  PID:7856
- C:\Windows\System\ZFGmayC.exe
  C:\Windows\System\ZFGmayC.exe
  2⤵
  PID:7872
- C:\Windows\System\hsGlCXb.exe
  C:\Windows\System\hsGlCXb.exe
  2⤵
  PID:7888
- C:\Windows\System\yBcQtvV.exe
  C:\Windows\System\yBcQtvV.exe
  2⤵
  PID:7904
- C:\Windows\System\VldVtgx.exe
  C:\Windows\System\VldVtgx.exe
  2⤵
  PID:7920
- C:\Windows\System\ifhRQTb.exe
  C:\Windows\System\ifhRQTb.exe
  2⤵
  PID:7936
- C:\Windows\System\liaXUXH.exe
  C:\Windows\System\liaXUXH.exe
  2⤵
  PID:7952
- C:\Windows\System\VtuUBIe.exe
  C:\Windows\System\VtuUBIe.exe
  2⤵
  PID:7968
- C:\Windows\System\RiEtnlu.exe
  C:\Windows\System\RiEtnlu.exe
  2⤵
  PID:7984
- C:\Windows\System\gQDiYtI.exe
  C:\Windows\System\gQDiYtI.exe
  2⤵
  PID:8000
- C:\Windows\System\RzCpohO.exe
  C:\Windows\System\RzCpohO.exe
  2⤵
  PID:8016
- C:\Windows\System\NybiLxz.exe
  C:\Windows\System\NybiLxz.exe
  2⤵
  PID:8032
- C:\Windows\System\MJyVvys.exe
  C:\Windows\System\MJyVvys.exe
  2⤵
  PID:8048
- C:\Windows\System\pCfmqSu.exe
  C:\Windows\System\pCfmqSu.exe
  2⤵
  PID:8064
- C:\Windows\System\SMCuIWu.exe
  C:\Windows\System\SMCuIWu.exe
  2⤵
  PID:8080
- C:\Windows\System\EUjabAi.exe
  C:\Windows\System\EUjabAi.exe
  2⤵
  PID:8156
- C:\Windows\System\fDYgggY.exe
  C:\Windows\System\fDYgggY.exe
  2⤵
  PID:7372
- C:\Windows\System\oxXrHCq.exe
  C:\Windows\System\oxXrHCq.exe
  2⤵
  PID:7440
- C:\Windows\System\PyFtHYu.exe
  C:\Windows\System\PyFtHYu.exe
  2⤵
  PID:7504
- C:\Windows\System\XFMlPlv.exe
  C:\Windows\System\XFMlPlv.exe
  2⤵
  PID:7544
- C:\Windows\System\CbNMDfa.exe
  C:\Windows\System\CbNMDfa.exe
  2⤵
  PID:7396
- C:\Windows\System\gXHSeOO.exe
  C:\Windows\System\gXHSeOO.exe
  2⤵
  PID:7488
- C:\Windows\System\bYrqMrl.exe
  C:\Windows\System\bYrqMrl.exe
  2⤵
  PID:7564
- C:\Windows\System\XYghOyD.exe
  C:\Windows\System\XYghOyD.exe
  2⤵
  PID:7768
- C:\Windows\System\HIwftfA.exe
  C:\Windows\System\HIwftfA.exe
  2⤵
  PID:7804
- C:\Windows\System\cdpeHCN.exe
  C:\Windows\System\cdpeHCN.exe
  2⤵
  PID:7868
- C:\Windows\System\onWmNuq.exe
  C:\Windows\System\onWmNuq.exe
  2⤵
  PID:7900
- C:\Windows\System\JlAqejC.exe
  C:\Windows\System\JlAqejC.exe
  2⤵
  PID:7848
- C:\Windows\System\jAnlFex.exe
  C:\Windows\System\jAnlFex.exe
  2⤵
  PID:7724
- C:\Windows\System\oaMFqQa.exe
  C:\Windows\System\oaMFqQa.exe
  2⤵
  PID:7788
- C:\Windows\System\FhybLcG.exe
  C:\Windows\System\FhybLcG.exe
  2⤵
  PID:8024
- C:\Windows\System\ionlxmP.exe
  C:\Windows\System\ionlxmP.exe
  2⤵
  PID:8060
- C:\Windows\System\YCZKXTo.exe
  C:\Windows\System\YCZKXTo.exe
  2⤵
  PID:7944
- C:\Windows\System\kBvACHn.exe
  C:\Windows\System\kBvACHn.exe
  2⤵
  PID:7884
- C:\Windows\System\YlTpOYv.exe
  C:\Windows\System\YlTpOYv.exe
  2⤵
  PID:8044
- C:\Windows\System\FIoGBbk.exe
  C:\Windows\System\FIoGBbk.exe
  2⤵
  PID:8008
- C:\Windows\System\mFpqSZo.exe
  C:\Windows\System\mFpqSZo.exe
  2⤵
  PID:8104
- C:\Windows\System\tqtARFP.exe
  C:\Windows\System\tqtARFP.exe
  2⤵
  PID:8128
- C:\Windows\System\rWYcmlg.exe
  C:\Windows\System\rWYcmlg.exe
  2⤵
  PID:8136
- C:\Windows\System\AwMjfgH.exe
  C:\Windows\System\AwMjfgH.exe
  2⤵
  PID:8176
- C:\Windows\System\GztvHeG.exe
  C:\Windows\System\GztvHeG.exe
  2⤵
  PID:7380
- C:\Windows\System\Wtxwtrd.exe
  C:\Windows\System\Wtxwtrd.exe
  2⤵
  PID:7192
- C:\Windows\System\XNfBIwr.exe
  C:\Windows\System\XNfBIwr.exe
  2⤵
  PID:6820
- C:\Windows\System\azZNZxB.exe
  C:\Windows\System\azZNZxB.exe
  2⤵
  PID:7208
- C:\Windows\System\BkxTnGS.exe
  C:\Windows\System\BkxTnGS.exe
  2⤵
  PID:5260
- C:\Windows\System\MqxTUrp.exe
  C:\Windows\System\MqxTUrp.exe
  2⤵
  PID:7228
- C:\Windows\System\kHARRiW.exe
  C:\Windows\System\kHARRiW.exe
  2⤵
  PID:7340
- C:\Windows\System\hEsbryG.exe
  C:\Windows\System\hEsbryG.exe
  2⤵
  PID:7476
- C:\Windows\System\bIjGtaI.exe
  C:\Windows\System\bIjGtaI.exe
  2⤵
  PID:7264
- C:\Windows\System\lXxCyaI.exe
  C:\Windows\System\lXxCyaI.exe
  2⤵
  PID:7328
- C:\Windows\System\uXGaCVc.exe
  C:\Windows\System\uXGaCVc.exe
  2⤵
  PID:7520
- C:\Windows\System\vRrqAHg.exe
  C:\Windows\System\vRrqAHg.exe
  2⤵
  PID:7644
- C:\Windows\System\ECTjqxm.exe
  C:\Windows\System\ECTjqxm.exe
  2⤵
  PID:7672
- C:\Windows\System\Fkfiaao.exe
  C:\Windows\System\Fkfiaao.exe
  2⤵
  PID:7688
- C:\Windows\System\EzMWFQJ.exe
  C:\Windows\System\EzMWFQJ.exe
  2⤵
  PID:7996
- C:\Windows\System\AgMiQxm.exe
  C:\Windows\System\AgMiQxm.exe
  2⤵
  PID:7692
- C:\Windows\System\iuDArSq.exe
  C:\Windows\System\iuDArSq.exe
  2⤵
  PID:7896
- C:\Windows\System\ETBkwNs.exe
  C:\Windows\System\ETBkwNs.exe
  2⤵
  PID:8056
- C:\Windows\System\oPTWsrr.exe
  C:\Windows\System\oPTWsrr.exe
  2⤵
  PID:7852
- C:\Windows\System\eUgDmmJ.exe
  C:\Windows\System\eUgDmmJ.exe
  2⤵
  PID:7948
- C:\Windows\System\hgjYOEI.exe
  C:\Windows\System\hgjYOEI.exe
  2⤵
  PID:8120
- C:\Windows\System\wIdzxIH.exe
  C:\Windows\System\wIdzxIH.exe
  2⤵
  PID:8144
- C:\Windows\System\lUBtSBn.exe
  C:\Windows\System\lUBtSBn.exe
  2⤵
  PID:7292
- C:\Windows\System\TmwjlaG.exe
  C:\Windows\System\TmwjlaG.exe
  2⤵
  PID:8164
- C:\Windows\System\WDgusHr.exe
  C:\Windows\System\WDgusHr.exe
  2⤵
  PID:7460
- C:\Windows\System\NOceVqX.exe
  C:\Windows\System\NOceVqX.exe
  2⤵
  PID:7576
- C:\Windows\System\pswGZOB.exe
  C:\Windows\System\pswGZOB.exe
  2⤵
  PID:7308
- C:\Windows\System\lMsdcmx.exe
  C:\Windows\System\lMsdcmx.exe
  2⤵
  PID:7492
- C:\Windows\System\VKATTFM.exe
  C:\Windows\System\VKATTFM.exe
  2⤵
  PID:7752
- C:\Windows\System\FLWFmlG.exe
  C:\Windows\System\FLWFmlG.exe
  2⤵
  PID:7660
- C:\Windows\System\oRdbEGb.exe
  C:\Windows\System\oRdbEGb.exe
  2⤵
  PID:7412
- C:\Windows\System\yWpwzUO.exe
  C:\Windows\System\yWpwzUO.exe
  2⤵
  PID:7932
- C:\Windows\System\ZLPnBGy.exe
  C:\Windows\System\ZLPnBGy.exe
  2⤵
  PID:7248
- C:\Windows\System\NLZXiQs.exe
  C:\Windows\System\NLZXiQs.exe
  2⤵
  PID:8152
- C:\Windows\System\WVhusJI.exe
  C:\Windows\System\WVhusJI.exe
  2⤵
  PID:7784
- C:\Windows\System\PUjhZPB.exe
  C:\Windows\System\PUjhZPB.exe
  2⤵
  PID:7456
- C:\Windows\System\gAiFukd.exe
  C:\Windows\System\gAiFukd.exe
  2⤵
  PID:6980
- C:\Windows\System\JRNfhrI.exe
  C:\Windows\System\JRNfhrI.exe
  2⤵
  PID:7524
- C:\Windows\System\CyGifLS.exe
  C:\Windows\System\CyGifLS.exe
  2⤵
  PID:8180
- C:\Windows\System\EGEOGvH.exe
  C:\Windows\System\EGEOGvH.exe
  2⤵
  PID:7816
- C:\Windows\System\CGlwRDO.exe
  C:\Windows\System\CGlwRDO.exe
  2⤵
  PID:7176
- C:\Windows\System\NInIjcU.exe
  C:\Windows\System\NInIjcU.exe
  2⤵
  PID:7708
- C:\Windows\System\Ilgjlas.exe
  C:\Windows\System\Ilgjlas.exe
  2⤵
  PID:8208
- C:\Windows\System\FdtCLWB.exe
  C:\Windows\System\FdtCLWB.exe
  2⤵
  PID:8224
- C:\Windows\System\SdxOkux.exe
  C:\Windows\System\SdxOkux.exe
  2⤵
  PID:8240
- C:\Windows\System\NaqBQwQ.exe
  C:\Windows\System\NaqBQwQ.exe
  2⤵
  PID:8256
- C:\Windows\System\CbvpSeA.exe
  C:\Windows\System\CbvpSeA.exe
  2⤵
  PID:8272
- C:\Windows\System\imSnhol.exe
  C:\Windows\System\imSnhol.exe
  2⤵
  PID:8292
- C:\Windows\System\PeOVNWm.exe
  C:\Windows\System\PeOVNWm.exe
  2⤵
  PID:8308
- C:\Windows\System\cYSFHIv.exe
  C:\Windows\System\cYSFHIv.exe
  2⤵
  PID:8328
- C:\Windows\System\DAjKhOZ.exe
  C:\Windows\System\DAjKhOZ.exe
  2⤵
  PID:8344
- C:\Windows\System\BTGZOGt.exe
  C:\Windows\System\BTGZOGt.exe
  2⤵
  PID:8360
- C:\Windows\System\auTsudF.exe
  C:\Windows\System\auTsudF.exe
  2⤵
  PID:8376
- C:\Windows\System\rARaaOW.exe
  C:\Windows\System\rARaaOW.exe
  2⤵
  PID:8392
- C:\Windows\System\OgSIBPC.exe
  C:\Windows\System\OgSIBPC.exe
  2⤵
  PID:8408
- C:\Windows\System\vHpxLqU.exe
  C:\Windows\System\vHpxLqU.exe
  2⤵
  PID:8424
- C:\Windows\System\hMNxdXD.exe
  C:\Windows\System\hMNxdXD.exe
  2⤵
  PID:8440
- C:\Windows\System\eDHxhOf.exe
  C:\Windows\System\eDHxhOf.exe
  2⤵
  PID:8456
- C:\Windows\System\PtkndTa.exe
  C:\Windows\System\PtkndTa.exe
  2⤵
  PID:8472
- C:\Windows\System\lHiqxsW.exe
  C:\Windows\System\lHiqxsW.exe
  2⤵
  PID:8488
- C:\Windows\System\iWkKobx.exe
  C:\Windows\System\iWkKobx.exe
  2⤵
  PID:8504
- C:\Windows\System\eTbDZUg.exe
  C:\Windows\System\eTbDZUg.exe
  2⤵
  PID:8520
- C:\Windows\System\zTaQcOk.exe
  C:\Windows\System\zTaQcOk.exe
  2⤵
  PID:8536
- C:\Windows\System\DWeklvk.exe
  C:\Windows\System\DWeklvk.exe
  2⤵
  PID:8552
- C:\Windows\System\IwVdSdF.exe
  C:\Windows\System\IwVdSdF.exe
  2⤵
  PID:8568
- C:\Windows\System\jUTHozT.exe
  C:\Windows\System\jUTHozT.exe
  2⤵
  PID:8584
- C:\Windows\System\CLDFnyF.exe
  C:\Windows\System\CLDFnyF.exe
  2⤵
  PID:8600
- C:\Windows\System\Hnwaszz.exe
  C:\Windows\System\Hnwaszz.exe
  2⤵
  PID:8616
- C:\Windows\System\XYUsona.exe
  C:\Windows\System\XYUsona.exe
  2⤵
  PID:8632
- C:\Windows\System\fvaenvw.exe
  C:\Windows\System\fvaenvw.exe
  2⤵
  PID:8648
- C:\Windows\System\oEgDksE.exe
  C:\Windows\System\oEgDksE.exe
  2⤵
  PID:8664
- C:\Windows\System\tmpyuOx.exe
  C:\Windows\System\tmpyuOx.exe
  2⤵
  PID:8680
- C:\Windows\System\gZXrCCe.exe
  C:\Windows\System\gZXrCCe.exe
  2⤵
  PID:8696
- C:\Windows\System\ckoUtvR.exe
  C:\Windows\System\ckoUtvR.exe
  2⤵
  PID:8712
- C:\Windows\System\WhgCfPf.exe
  C:\Windows\System\WhgCfPf.exe
  2⤵
  PID:8728
- C:\Windows\System\eWtbraA.exe
  C:\Windows\System\eWtbraA.exe
  2⤵
  PID:8744
- C:\Windows\System\RULEgAn.exe
  C:\Windows\System\RULEgAn.exe
  2⤵
  PID:8760
- C:\Windows\System\ognLWGq.exe
  C:\Windows\System\ognLWGq.exe
  2⤵
  PID:8776
- C:\Windows\System\EwORjZk.exe
  C:\Windows\System\EwORjZk.exe
  2⤵
  PID:8792
- C:\Windows\System\AxgweOP.exe
  C:\Windows\System\AxgweOP.exe
  2⤵
  PID:8808
- C:\Windows\System\ztnyIHP.exe
  C:\Windows\System\ztnyIHP.exe
  2⤵
  PID:8824
- C:\Windows\System\MxfttEU.exe
  C:\Windows\System\MxfttEU.exe
  2⤵
  PID:8840
- C:\Windows\System\cplJfBl.exe
  C:\Windows\System\cplJfBl.exe
  2⤵
  PID:8856
- C:\Windows\System\ddGvypd.exe
  C:\Windows\System\ddGvypd.exe
  2⤵
  PID:8872
- C:\Windows\System\TULnuSb.exe
  C:\Windows\System\TULnuSb.exe
  2⤵
  PID:8900
- C:\Windows\System\SyVSJxL.exe
  C:\Windows\System\SyVSJxL.exe
  2⤵
  PID:8920
- C:\Windows\System\uKOkZYN.exe
  C:\Windows\System\uKOkZYN.exe
  2⤵
  PID:8936
- C:\Windows\System\MVTOoPF.exe
  C:\Windows\System\MVTOoPF.exe
  2⤵
  PID:8952
- C:\Windows\System\SVrbZXv.exe
  C:\Windows\System\SVrbZXv.exe
  2⤵
  PID:8968
- C:\Windows\System\cGgHnHD.exe
  C:\Windows\System\cGgHnHD.exe
  2⤵
  PID:8984
- C:\Windows\System\ETFxjdB.exe
  C:\Windows\System\ETFxjdB.exe
  2⤵
  PID:9000
- C:\Windows\System\NAUEKYe.exe
  C:\Windows\System\NAUEKYe.exe
  2⤵
  PID:9016
- C:\Windows\System\xwTyaoz.exe
  C:\Windows\System\xwTyaoz.exe
  2⤵
  PID:9032
- C:\Windows\System\TxGjTjC.exe
  C:\Windows\System\TxGjTjC.exe
  2⤵
  PID:9048
- C:\Windows\System\GzGvqSP.exe
  C:\Windows\System\GzGvqSP.exe
  2⤵
  PID:9064
- C:\Windows\System\nGhOrmi.exe
  C:\Windows\System\nGhOrmi.exe
  2⤵
  PID:9080
- C:\Windows\System\XNAMWHP.exe
  C:\Windows\System\XNAMWHP.exe
  2⤵
  PID:9096
- C:\Windows\System\yjIYPgT.exe
  C:\Windows\System\yjIYPgT.exe
  2⤵
  PID:9112
- C:\Windows\System\CEvmxVM.exe
  C:\Windows\System\CEvmxVM.exe
  2⤵
  PID:9128
- C:\Windows\System\GHmbwJE.exe
  C:\Windows\System\GHmbwJE.exe
  2⤵
  PID:9144
- C:\Windows\System\zCQqekE.exe
  C:\Windows\System\zCQqekE.exe
  2⤵
  PID:9160
- C:\Windows\System\DQVkBTI.exe
  C:\Windows\System\DQVkBTI.exe
  2⤵
  PID:9176
- C:\Windows\System\uLSrgKt.exe
  C:\Windows\System\uLSrgKt.exe
  2⤵
  PID:9200
- C:\Windows\System\MMFPfnA.exe
  C:\Windows\System\MMFPfnA.exe
  2⤵
  PID:7224
- C:\Windows\System\mmpiCiE.exe
  C:\Windows\System\mmpiCiE.exe
  2⤵
  PID:8028
- C:\Windows\System\TWECRcw.exe
  C:\Windows\System\TWECRcw.exe
  2⤵
  PID:8116
- C:\Windows\System\iJxwGsa.exe
  C:\Windows\System\iJxwGsa.exe
  2⤵
  PID:8232
- C:\Windows\System\dbkeszU.exe
  C:\Windows\System\dbkeszU.exe
  2⤵
  PID:8216
- C:\Windows\System\UsORrvb.exe
  C:\Windows\System\UsORrvb.exe
  2⤵
  PID:8284
- C:\Windows\System\YjYKdNU.exe
  C:\Windows\System\YjYKdNU.exe
  2⤵
  PID:8324
- C:\Windows\System\YpnpHGj.exe
  C:\Windows\System\YpnpHGj.exe
  2⤵
  PID:8388
- C:\Windows\System\kcgqmId.exe
  C:\Windows\System\kcgqmId.exe
  2⤵
  PID:8304
- C:\Windows\System\xVjPIgh.exe
  C:\Windows\System\xVjPIgh.exe
  2⤵
  PID:8400
- C:\Windows\System\QKwodgc.exe
  C:\Windows\System\QKwodgc.exe
  2⤵
  PID:8432
- C:\Windows\System\EDusmam.exe
  C:\Windows\System\EDusmam.exe
  2⤵
  PID:8592
- C:\Windows\System\fiAHqRa.exe
  C:\Windows\System\fiAHqRa.exe
  2⤵
  PID:8528
- C:\Windows\System\qcNlNyn.exe
  C:\Windows\System\qcNlNyn.exe
  2⤵
  PID:8612
- C:\Windows\System\oREKrjD.exe
  C:\Windows\System\oREKrjD.exe
  2⤵
  PID:8548
- C:\Windows\System\kOgZKvQ.exe
  C:\Windows\System\kOgZKvQ.exe
  2⤵
  PID:8448
- C:\Windows\System\cqAvXos.exe
  C:\Windows\System\cqAvXos.exe
  2⤵
  PID:8516
- C:\Windows\System\wZfjijH.exe
  C:\Windows\System\wZfjijH.exe
  2⤵
  PID:8740
- C:\Windows\System\LCpKJaz.exe
  C:\Windows\System\LCpKJaz.exe
  2⤵
  PID:8772
- C:\Windows\System\ciRXLFC.exe
  C:\Windows\System\ciRXLFC.exe
  2⤵
  PID:8864
- C:\Windows\System\rcXcSIV.exe
  C:\Windows\System\rcXcSIV.exe
  2⤵
  PID:8868
- C:\Windows\System\KrEzlLF.exe
  C:\Windows\System\KrEzlLF.exe
  2⤵
  PID:8628
- C:\Windows\System\xJdRVcC.exe
  C:\Windows\System\xJdRVcC.exe
  2⤵
  PID:8692
- C:\Windows\System\kTFJJds.exe
  C:\Windows\System\kTFJJds.exe
  2⤵
  PID:8720
- C:\Windows\System\tkMOAcf.exe
  C:\Windows\System\tkMOAcf.exe
  2⤵
  PID:8884
- C:\Windows\System\MPYJaEh.exe
  C:\Windows\System\MPYJaEh.exe
  2⤵
  PID:8896
- C:\Windows\System\UTLHyUU.exe
  C:\Windows\System\UTLHyUU.exe
  2⤵
  PID:8928
- C:\Windows\System\avXIlHL.exe
  C:\Windows\System\avXIlHL.exe
  2⤵
  PID:8948
- C:\Windows\System\WNDdzRH.exe
  C:\Windows\System\WNDdzRH.exe
  2⤵
  PID:8996
- C:\Windows\System\RgoxYSu.exe
  C:\Windows\System\RgoxYSu.exe
  2⤵
  PID:9044
- C:\Windows\System\cmSQrHg.exe
  C:\Windows\System\cmSQrHg.exe
  2⤵
  PID:9072
- C:\Windows\System\klYSyEQ.exe
  C:\Windows\System\klYSyEQ.exe
  2⤵
  PID:9140
- C:\Windows\System\hcUeMeH.exe
  C:\Windows\System\hcUeMeH.exe
  2⤵
  PID:9208
- C:\Windows\System\IUqePct.exe
  C:\Windows\System\IUqePct.exe
  2⤵
  PID:8264
- C:\Windows\System\wQwHuRF.exe
  C:\Windows\System\wQwHuRF.exe
  2⤵
  PID:8112
- C:\Windows\System\glNYZFu.exe
  C:\Windows\System\glNYZFu.exe
  2⤵
  PID:8368
- C:\Windows\System\TsiueUZ.exe
  C:\Windows\System\TsiueUZ.exe
  2⤵
  PID:8280
- C:\Windows\System\OCRRIJz.exe
  C:\Windows\System\OCRRIJz.exe
  2⤵
  PID:8560
- C:\Windows\System\cafouZY.exe
  C:\Windows\System\cafouZY.exe
  2⤵
  PID:8512
- C:\Windows\System\tgiFOUe.exe
  C:\Windows\System\tgiFOUe.exe
  2⤵
  PID:8704
- C:\Windows\System\xEOrBsv.exe
  C:\Windows\System\xEOrBsv.exe
  2⤵
  PID:8852
- C:\Windows\System\yZmvKDd.exe
  C:\Windows\System\yZmvKDd.exe
  2⤵
  PID:8688
- C:\Windows\System\IfyjYFS.exe
  C:\Windows\System\IfyjYFS.exe
  2⤵
  PID:8784
- C:\Windows\System\aRfrafI.exe
  C:\Windows\System\aRfrafI.exe
  2⤵
  PID:8944
- C:\Windows\System\bPoKmAa.exe
  C:\Windows\System\bPoKmAa.exe
  2⤵
  PID:8736
- C:\Windows\System\BQHENxl.exe
  C:\Windows\System\BQHENxl.exe
  2⤵
  PID:8576
- C:\Windows\System\pFkDWSJ.exe
  C:\Windows\System\pFkDWSJ.exe
  2⤵
  PID:8880
- C:\Windows\System\rQoDzlh.exe
  C:\Windows\System\rQoDzlh.exe
  2⤵
  PID:8724
- C:\Windows\System\ZACWxRb.exe
  C:\Windows\System\ZACWxRb.exe
  2⤵
  PID:8596
- C:\Windows\System\kMRWzfH.exe
  C:\Windows\System\kMRWzfH.exe
  2⤵
  PID:9136
- C:\Windows\System\figZvyq.exe
  C:\Windows\System\figZvyq.exe
  2⤵
  PID:7864
- C:\Windows\System\cWkGdbu.exe
  C:\Windows\System\cWkGdbu.exe
  2⤵
  PID:8788
- C:\Windows\System\oWniVLT.exe
  C:\Windows\System\oWniVLT.exe
  2⤵
  PID:8752
- C:\Windows\System\hJoxkdF.exe
  C:\Windows\System\hJoxkdF.exe
  2⤵
  PID:9192
- C:\Windows\System\bkJEFIC.exe
  C:\Windows\System\bkJEFIC.exe
  2⤵
  PID:9184
- C:\Windows\System\gZPEani.exe
  C:\Windows\System\gZPEani.exe
  2⤵
  PID:8484
- C:\Windows\System\LGTAeVF.exe
  C:\Windows\System\LGTAeVF.exe
  2⤵
  PID:8608
- C:\Windows\System\cchfwDd.exe
  C:\Windows\System\cchfwDd.exe
  2⤵
  PID:8384
- C:\Windows\System\HpACuXJ.exe
  C:\Windows\System\HpACuXJ.exe
  2⤵
  PID:8848
- C:\Windows\System\zQskNRq.exe
  C:\Windows\System\zQskNRq.exe
  2⤵
  PID:9220
- C:\Windows\System\wMQofmM.exe
  C:\Windows\System\wMQofmM.exe
  2⤵
  PID:9236
- C:\Windows\System\nHqoRGT.exe
  C:\Windows\System\nHqoRGT.exe
  2⤵
  PID:9252
- C:\Windows\System\jSBrAzt.exe
  C:\Windows\System\jSBrAzt.exe
  2⤵
  PID:9272
- C:\Windows\System\WsbNrOb.exe
  C:\Windows\System\WsbNrOb.exe
  2⤵
  PID:9300
- C:\Windows\System\MKoZCAv.exe
  C:\Windows\System\MKoZCAv.exe
  2⤵
  PID:9324
- C:\Windows\System\RHDDXls.exe
  C:\Windows\System\RHDDXls.exe
  2⤵
  PID:9340
- C:\Windows\System\MMnpZaE.exe
  C:\Windows\System\MMnpZaE.exe
  2⤵
  PID:9380
- C:\Windows\System\ckuDfFa.exe
  C:\Windows\System\ckuDfFa.exe
  2⤵
  PID:9396
- C:\Windows\System\IyPttnk.exe
  C:\Windows\System\IyPttnk.exe
  2⤵
  PID:9412
- C:\Windows\System\hJUMsRR.exe
  C:\Windows\System\hJUMsRR.exe
  2⤵
  PID:9496
- C:\Windows\System\GRpVbaB.exe
  C:\Windows\System\GRpVbaB.exe
  2⤵
  PID:9512
- C:\Windows\System\HjlZZIw.exe
  C:\Windows\System\HjlZZIw.exe
  2⤵
  PID:9528
- C:\Windows\System\riUthaF.exe
  C:\Windows\System\riUthaF.exe
  2⤵
  PID:9544
- C:\Windows\System\tyMbErq.exe
  C:\Windows\System\tyMbErq.exe
  2⤵
  PID:9560
- C:\Windows\System\MwQJxms.exe
  C:\Windows\System\MwQJxms.exe
  2⤵
  PID:9576
- C:\Windows\System\LbNxqhj.exe
  C:\Windows\System\LbNxqhj.exe
  2⤵
  PID:9596
- C:\Windows\System\gvlDqfz.exe
  C:\Windows\System\gvlDqfz.exe
  2⤵
  PID:9620
- C:\Windows\System\KCcRuAx.exe
  C:\Windows\System\KCcRuAx.exe
  2⤵
  PID:9636
- C:\Windows\System\vnvRTgV.exe
  C:\Windows\System\vnvRTgV.exe
  2⤵
  PID:9652
- C:\Windows\System\hPuKItW.exe
  C:\Windows\System\hPuKItW.exe
  2⤵
  PID:9668
- C:\Windows\System\ulZJSnA.exe
  C:\Windows\System\ulZJSnA.exe
  2⤵
  PID:9684
- C:\Windows\System\CHtDEXE.exe
  C:\Windows\System\CHtDEXE.exe
  2⤵
  PID:9704
- C:\Windows\System\tLsMsUO.exe
  C:\Windows\System\tLsMsUO.exe
  2⤵
  PID:9720
- C:\Windows\System\wAYCezH.exe
  C:\Windows\System\wAYCezH.exe
  2⤵
  PID:9736
- C:\Windows\System\XbTmjUl.exe
  C:\Windows\System\XbTmjUl.exe
  2⤵
  PID:9752
- C:\Windows\System\mkaNvpk.exe
  C:\Windows\System\mkaNvpk.exe
  2⤵
  PID:9768
- C:\Windows\System\FtiBoTh.exe
  C:\Windows\System\FtiBoTh.exe
  2⤵
  PID:9784
- C:\Windows\System\sLdOIFa.exe
  C:\Windows\System\sLdOIFa.exe
  2⤵
  PID:9800
- C:\Windows\System\IKxsNpq.exe
  C:\Windows\System\IKxsNpq.exe
  2⤵
  PID:9816
- C:\Windows\System\JsDPquN.exe
  C:\Windows\System\JsDPquN.exe
  2⤵
  PID:9832
- C:\Windows\System\tCQPGjY.exe
  C:\Windows\System\tCQPGjY.exe
  2⤵
  PID:9856
- C:\Windows\System\dlyuURr.exe
  C:\Windows\System\dlyuURr.exe
  2⤵
  PID:9872
- C:\Windows\System\PZgHqaw.exe
  C:\Windows\System\PZgHqaw.exe
  2⤵
  PID:9888
- C:\Windows\System\fPefROA.exe
  C:\Windows\System\fPefROA.exe
  2⤵
  PID:9904
- C:\Windows\System\oSecmLp.exe
  C:\Windows\System\oSecmLp.exe
  2⤵
  PID:9948
- C:\Windows\System\IOmGydI.exe
  C:\Windows\System\IOmGydI.exe
  2⤵
  PID:9964
- C:\Windows\System\xyziIlA.exe
  C:\Windows\System\xyziIlA.exe
  2⤵
  PID:9992
- C:\Windows\System\asJwAvl.exe
  C:\Windows\System\asJwAvl.exe
  2⤵
  PID:10008
- C:\Windows\System\rwNOSSl.exe
  C:\Windows\System\rwNOSSl.exe
  2⤵
  PID:10024
- C:\Windows\System\UypROJH.exe
  C:\Windows\System\UypROJH.exe
  2⤵
  PID:10040
- C:\Windows\System\fcqMNKw.exe
  C:\Windows\System\fcqMNKw.exe
  2⤵
  PID:10056
- C:\Windows\System\TYrLrIC.exe
  C:\Windows\System\TYrLrIC.exe
  2⤵
  PID:10080
- C:\Windows\System\GVdeasY.exe
  C:\Windows\System\GVdeasY.exe
  2⤵
  PID:10100
- C:\Windows\System\hLmOsVD.exe
  C:\Windows\System\hLmOsVD.exe
  2⤵
  PID:10116
- C:\Windows\System\CYAHnRf.exe
  C:\Windows\System\CYAHnRf.exe
  2⤵
  PID:10132
- C:\Windows\System\XnQacbk.exe
  C:\Windows\System\XnQacbk.exe
  2⤵
  PID:10148
- C:\Windows\System\AsadFHk.exe
  C:\Windows\System\AsadFHk.exe
  2⤵
  PID:10164
- C:\Windows\System\uGrfYoY.exe
  C:\Windows\System\uGrfYoY.exe
  2⤵
  PID:10184
- C:\Windows\System\mLMfieI.exe
  C:\Windows\System\mLMfieI.exe
  2⤵
  PID:10200
- C:\Windows\System\LDRJpKS.exe
  C:\Windows\System\LDRJpKS.exe
  2⤵
  PID:10216
- C:\Windows\System\PSafGPv.exe
  C:\Windows\System\PSafGPv.exe
  2⤵
  PID:10232
- C:\Windows\System\BpvfSAI.exe
  C:\Windows\System\BpvfSAI.exe
  2⤵
  PID:8800
- C:\Windows\System\myfadxI.exe
  C:\Windows\System\myfadxI.exe
  2⤵
  PID:9012
- C:\Windows\System\RVyglGE.exe
  C:\Windows\System\RVyglGE.exe
  2⤵
  PID:9280
- C:\Windows\System\ruFfpTd.exe
  C:\Windows\System\ruFfpTd.exe
  2⤵
  PID:9296
- C:\Windows\System\TsArQln.exe
  C:\Windows\System\TsArQln.exe
  2⤵
  PID:9388
- C:\Windows\System\pelzEsm.exe
  C:\Windows\System\pelzEsm.exe
  2⤵
  PID:9432
- C:\Windows\System\qValUzF.exe
  C:\Windows\System\qValUzF.exe
  2⤵
  PID:8676
- C:\Windows\System\VETELpM.exe
  C:\Windows\System\VETELpM.exe
  2⤵
  PID:8656
- C:\Windows\System\nnSCAWY.exe
  C:\Windows\System\nnSCAWY.exe
  2⤵
  PID:9260
- C:\Windows\System\ZpeXGGw.exe
  C:\Windows\System\ZpeXGGw.exe
  2⤵
  PID:9404
- C:\Windows\System\rVFpmIR.exe
  C:\Windows\System\rVFpmIR.exe
  2⤵
  PID:8836
- C:\Windows\System\lMBhHqb.exe
  C:\Windows\System\lMBhHqb.exe
  2⤵
  PID:9472
- C:\Windows\System\bnENmQo.exe
  C:\Windows\System\bnENmQo.exe
  2⤵
  PID:9268
- C:\Windows\System\EDRXWPu.exe
  C:\Windows\System\EDRXWPu.exe
  2⤵
  PID:9348
- C:\Windows\System\HICOuVt.exe
  C:\Windows\System\HICOuVt.exe
  2⤵
  PID:9372
- C:\Windows\System\SVkAsDO.exe
  C:\Windows\System\SVkAsDO.exe
  2⤵
  PID:9488
- C:\Windows\System\aQinsAc.exe
  C:\Windows\System\aQinsAc.exe
  2⤵
  PID:9508
- C:\Windows\System\cssYXoS.exe
  C:\Windows\System\cssYXoS.exe
  2⤵
  PID:9568
- C:\Windows\System\iWFGYDR.exe
  C:\Windows\System\iWFGYDR.exe
  2⤵
  PID:9552
- C:\Windows\System\eaXMURT.exe
  C:\Windows\System\eaXMURT.exe
  2⤵
  PID:9616
- C:\Windows\System\PbCBxeE.exe
  C:\Windows\System\PbCBxeE.exe
  2⤵
  PID:9680
- C:\Windows\System\svZCCHF.exe
  C:\Windows\System\svZCCHF.exe
  2⤵
  PID:9660
- C:\Windows\System\arvsIIR.exe
  C:\Windows\System\arvsIIR.exe
  2⤵
  PID:9744
- C:\Windows\System\NVRvdjX.exe
  C:\Windows\System\NVRvdjX.exe
  2⤵
  PID:9780
- C:\Windows\System\JFUWaIV.exe
  C:\Windows\System\JFUWaIV.exe
  2⤵
  PID:9844
- C:\Windows\System\KvNteZQ.exe
  C:\Windows\System\KvNteZQ.exe
  2⤵
  PID:9728
- C:\Windows\System\QxsBMZX.exe
  C:\Windows\System\QxsBMZX.exe
  2⤵
  PID:9764
- C:\Windows\System\NVAJUxH.exe
  C:\Windows\System\NVAJUxH.exe
  2⤵
  PID:9824
- C:\Windows\System\gtTYfwq.exe
  C:\Windows\System\gtTYfwq.exe
  2⤵
  PID:9916
- C:\Windows\System\eGxqGFm.exe
  C:\Windows\System\eGxqGFm.exe
  2⤵
  PID:9924
- C:\Windows\System\eLQrRbl.exe
  C:\Windows\System\eLQrRbl.exe
  2⤵
  PID:9940
- C:\Windows\System\kqtqQsI.exe
  C:\Windows\System\kqtqQsI.exe
  2⤵
  PID:8356
- C:\Windows\System\WheRllv.exe
  C:\Windows\System\WheRllv.exe
  2⤵
  PID:9976
- C:\Windows\System\jkarOLj.exe
  C:\Windows\System\jkarOLj.exe
  2⤵
  PID:10048
- C:\Windows\System\FimefOS.exe
  C:\Windows\System\FimefOS.exe
  2⤵
  PID:10096
- C:\Windows\System\mxwKhEo.exe
  C:\Windows\System\mxwKhEo.exe
  2⤵
  PID:10076
- C:\Windows\System\aljMohK.exe
  C:\Windows\System\aljMohK.exe
  2⤵
  PID:10196
- C:\Windows\System\hvnJoQD.exe
  C:\Windows\System\hvnJoQD.exe
  2⤵
  PID:8204
- C:\Windows\System\zsUHQwr.exe
  C:\Windows\System\zsUHQwr.exe
  2⤵
  PID:9420
- C:\Windows\System\geKksya.exe
  C:\Windows\System\geKksya.exe
  2⤵
  PID:8992
- C:\Windows\System\ROCoZjk.exe
  C:\Windows\System\ROCoZjk.exe
  2⤵
  PID:9228
- C:\Windows\System\wnuDNNX.exe
  C:\Windows\System\wnuDNNX.exe
  2⤵
  PID:9408
- C:\Windows\System\pWQEFQj.exe
  C:\Windows\System\pWQEFQj.exe
  2⤵
  PID:10072
- C:\Windows\System\HcqUwEb.exe
  C:\Windows\System\HcqUwEb.exe
  2⤵
  PID:9436
- C:\Windows\System\pIPKzBk.exe
  C:\Windows\System\pIPKzBk.exe
  2⤵
  PID:9448
- C:\Windows\System\mqlbhXi.exe
  C:\Windows\System\mqlbhXi.exe
  2⤵
  PID:10108
- C:\Windows\System\haAqpUx.exe
  C:\Windows\System\haAqpUx.exe
  2⤵
  PID:10180
- C:\Windows\System\lEYnWKE.exe
  C:\Windows\System\lEYnWKE.exe
  2⤵
  PID:9592
- C:\Windows\System\BeVzdYy.exe
  C:\Windows\System\BeVzdYy.exe
  2⤵
  PID:9632
- C:\Windows\System\yvUfeJx.exe
  C:\Windows\System\yvUfeJx.exe
  2⤵
  PID:10172
- C:\Windows\System\imulBpj.exe
  C:\Windows\System\imulBpj.exe
  2⤵
  PID:9880
- C:\Windows\System\HXAtvEI.exe
  C:\Windows\System\HXAtvEI.exe
  2⤵
  PID:8248
- C:\Windows\System\XkRMQqp.exe
  C:\Windows\System\XkRMQqp.exe
  2⤵
  PID:9628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BQOpHyC.exe

Filesize
1.3MB

MD5
5e01c5ea8e50de3515cac441a1ffc451

SHA1
64bfa1fc892dccae4cb0d2513467d4349ce090cf

SHA256
f717b62be590e77168e7ac754a7fe84cbaf562d21ab9bd8e36d634ad0df49e48

SHA512
d2b74ca12bff9872748dd580f5cfcbda0e98a5d5779fb9ed1b287f72c8474c1761f98a142b3e4578e49788cc446b8b920a57e1db412d3b2b9c48be86588ca843

Download Submit
C:\Windows\system\BavvNMx.exe

Filesize
1.3MB

MD5
5c8b58567701f06e1a027cc28fc99e09

SHA1
3656d803d93f75b55d7b911c53c2af089d567446

SHA256
49d81ed2cc7e5c2ef9efe65aae248c2bfec0e585f82ff8c9ae52dba2a89d04b6

SHA512
a936d0df5a66694ddcab169fbd2861b3bd6f933788ef6c0ac831e91051e78245c4c6e61647b2bfe0c7d7023b387b241d800ec0e9d514c4609ad8d4256fb7ee59

Download Submit
C:\Windows\system\DYSYpjF.exe

Filesize
1.3MB

MD5
6aeea06acdd839ea6bf19b7a8a317135

SHA1
ccff24910c40a7c18f59eb9395e55cd1dabdcfb1

SHA256
e14275b70a506a4f8117252c9de625216a24979d98530d8ec99e310bd9fdb7de

SHA512
16e1815bfd0998db7a4b5877788d5a8ad986700e0053523af358b00611ad4be45db742cd60d85a92b0acf8b3d9ee33a2c9030caf27d9b1bad8f0e679a05cbcdd

Download Submit
C:\Windows\system\JNfuhWc.exe

Filesize
1.3MB

MD5
cc895c7cd4fd361c2b3d0e9b7e0c5759

SHA1
102cd3d7024ab2d79a8389ffb4f7fe54c940e8bd

SHA256
e554137b3bf0bdb2ccee67e97ac5c75eae5dc6169e77b966cdb0a8705bbdc447

SHA512
410ca54178263ff36e2120dc7ef48af1451c985487012dbcf7898c8bf0b11bb0feb0ba39b34613512c6e2a42e2f77b3556bfab766e00daa80944379a5d9455c8

Download Submit
C:\Windows\system\JiNmQEe.exe

Filesize
1.3MB

MD5
f4a3f4b03634546c8ef0e88b9e21cf15

SHA1
c49173d892417fd7046ae265680146295765da8b

SHA256
e49daad4024fb35beb72eff486b4f40aa377449650d6aa885ca8b1553e4bdcf5

SHA512
ccf18f6c28291dc40e3badfa7f9179560c06e590282d0fba1de96d6b8ebd90fa95b9df2939b894faf8de6c4494f4a7d5e5a6451b7f0f51e15df6496d8e6c3387

Download Submit
C:\Windows\system\JtfZRyg.exe

Filesize
1.3MB

MD5
310d43b3cca4bcce416e1efc983cb737

SHA1
84d98ab723857126b9d35c03bd756431fc4cb20c

SHA256
fc160666987dd0d959c099bc66f178714ea6656c6c603e6301bd606b71bc6a2c

SHA512
fda36ac01d2e7b93e08bfefa91382067ac35d100a0ddbb99024100bcab81b6de95da4e158491c837d3baf49342636c56f1c8a858ca3ec1a3bf538ced469ed4a5

Download Submit
C:\Windows\system\PAUgAII.exe

Filesize
1.3MB

MD5
2c2acb2ef494d47c61174dd3e9c8833e

SHA1
6597c65fbd6d1f8c1cdd845bdc5c558eabaddfb1

SHA256
fbac29122e0edad70b763d9b9cf31bcb59ac62af36bb3c688b7763283f563c02

SHA512
8d398f735d3fd1ea293b0ef67cf1cbe15f5273eb1680aebbf72e6702a875a2b28a024c5e970b1ce1e982ead189c0332d1c8270132daf3f957e7f48d186f13eba

Download Submit
C:\Windows\system\QHDjfkz.exe

Filesize
1.3MB

MD5
2f55fe668c01cf2974c7392d0449add8

SHA1
b33a90188e0e8f898e97a4eca6e05caead63f811

SHA256
5a34d0d7bc17ac83fe446d29048119c9c25bc8f682b4b717fdc19d24a92ad6cc

SHA512
f52f2a427b04938560a1d899120e1b87d7163c0e4df8e657945ae36e453287b6f9c58be69967f71618056c9cb3ec87eaf87838732b2f9a96b103363a41bdc405

Download Submit
C:\Windows\system\ddkscaN.exe

Filesize
1.3MB

MD5
f2c3cf1e6235d341d48a297ce129bb8c

SHA1
aed72ef9e367d94f910faa2062f0314bb3d669eb

SHA256
52a333a32a3167c9bf765620a98993b44058669fb24d24ce1b344100f450e52a

SHA512
5deb7f7877d945b4453e6bac3029e3ac71acbf477b31409e7cce62a96caede57b17918f79f06ebab63dc0b2914a9486c26de67d98f57a4ead87165ed495161fd

Download Submit
C:\Windows\system\fAdKYgL.exe

Filesize
1.3MB

MD5
3ab6cf7f241677bc32539aa1a0193cee

SHA1
d7903b319e52c0a5d1e0736dda47035d2df69eff

SHA256
73c035f102936c65c3c726e31db6a9dfbacd8457518c8a3d9cb1f98ebe388748

SHA512
cb9f52e582b8391c20331aa091018ad6d9dfcad241afcad7e5e47787d351c14cca52f0d8bcc455770009cc1f2c4c59ef83b32a3e34a0c891a89452d5957486d9

Download Submit
C:\Windows\system\iWwcvcW.exe

Filesize
1.3MB

MD5
5a6fbae9c8522d67dce65da118ab9c26

SHA1
4e1a3274e1ff495b966dede8e7783119c2a9b36c

SHA256
930e1961fd87c4f32b314788b20a9de89d1521be29db4845e63a34f7c8752af0

SHA512
5ec1532a80586e53283b4919dc7dfbcb07ef2116943af73126c69e6c8c1cabd6cd98986a833d72de84f85e90b706f5ba0b23e2097e8e3599bcdf6ee19ae20593

Download Submit
C:\Windows\system\ijuEjfS.exe

Filesize
1.3MB

MD5
e6acf738e62dfbdb9c545f7cafd430c4

SHA1
2177ced9ff24b4a1bcd34acdc3477c6164e93e53

SHA256
986649b08ebff39883aee08d4ab4f3fdb785c4ebc24560b04de8c85b8edb7584

SHA512
9dee3d5779c02516933a856546dca65c48177817d4ee130cc80bd5d28b074d18c36d2c449afb1837e1d10982aa45bd94ace63571a72b5063961d25ce4e49fbd8

Download Submit
C:\Windows\system\jqcONnZ.exe

Filesize
1.3MB

MD5
86b361f01b1c1254accd7695eb4bb892

SHA1
03441dbdb049797863712762f60bf4b10f1bdc85

SHA256
9dc92ee5882e6193068f2b1faefcc62e0ca9e4d2167562d6ecb9773fe6f37b1b

SHA512
b5ed1c09d352aaf2d28d0300d15eadea5f7ab8a4b6080165f0c27cab9726c6428df383ecdb714c05d799c17d413269697e3572d255e9117d1d8d0eabd7dadfa0

Download Submit
C:\Windows\system\kHVJCqc.exe

Filesize
1.3MB

MD5
7866f5ef49bf5297a5c3432f318c1384

SHA1
2e0f00ad6dd0b31b3a7bbf33b21d69af5d1b76a4

SHA256
d05645f10926a9d23a7a4397153022c46a014218f420e4af47a03d550a861425

SHA512
36049dc844ea9d70151f8d934b8ff3bacda6706e4ea2e9a28cc30b37cf46dac14b0e8b6f05df88ad38a9582c0fd053b12d3d5270410df1d346be398489a32d3c

Download Submit
C:\Windows\system\kYcEDSX.exe

Filesize
1.3MB

MD5
a30c4a798d76f35ce0a5945cd12112bd

SHA1
3a3622b3c08411ed740660bdbab67e55371536fe

SHA256
0a4a16165e9d7c0262d26dd8fe65d229beb1d8dacfcf1061a7b37340b1edd422

SHA512
81c765078f08038e3f6e55f443ca3e6fdd7a65259506bf8ad4258acc5daf57fe0f522a0d99b3b747b80a33f22fb13798863b4c1a44ca6eeebe4da4aa3b806658

Download Submit
C:\Windows\system\mrbJGPT.exe

Filesize
1.3MB

MD5
2d0c21052c42a45aff3b23120bc314f3

SHA1
35aa60b496be35fb007bc4d906fde654bb246276

SHA256
01ff6e902c59b012801859ddcf1c3fd19ef7cc4f976a43c907058d7c4a99ff11

SHA512
91f6327dcc4c16a18626dea83cb726b68ae2ed25b5bea76e329a59b627a1eeba73a4aeb5f537cb10b25ea6bd55476b9ccba35e426deb5a02924e7aee8c28b0d6

Download Submit
C:\Windows\system\pnJhQKi.exe

Filesize
1.3MB

MD5
0ae5b3e68e05de69256eaddaf106152e

SHA1
e07d0318bd610d7797552444079b370406bd41c7

SHA256
32a600a5fd01848097465f06e13062bd161e93e50740de03b9319461a3ba5bc8

SHA512
a28a1cfc11a6cfe621c40622037c7d3181d2002534b22c75731cc2a4762e0c400e272055e2a83c982290bd79a69e33aff1f7ae89c192143e888ac572fe838567

Download Submit
C:\Windows\system\qIkpdRT.exe

Filesize
1.3MB

MD5
f06d1ceb21efffb68dc56acccb3e92ea

SHA1
6fabbead42603268107f536b31507077ef0059fa

SHA256
e6177d94f64a48c85aa0ca0706a518451ba8dcb949d545b411775f56e28675eb

SHA512
aa4969f32e8cb9d0dd375b38ac18e5b0cbc0f4f12576201cf01482354daeab5277732facc9cd25ebad75a66fbe9d6d4b327635ebe16e7ff5eb8030599a05e3ee

Download Submit
C:\Windows\system\rNVHcbm.exe

Filesize
1.3MB

MD5
964bcd2a50c894683ce6ff139a61c7c1

SHA1
2371c8b7135101e2f4561569670c2a6c5d465da3

SHA256
7c56973c0a6f383a83e46b547adf2a28c2c446d0de97edf1fd7f4b29e71e4f8c

SHA512
9b38a027ae274f823d35092d97c5795809cabf25ab24b4400706157d39934e2f311e384f326c5c868155e27354d0684f98de4b6823ea0972911f079c21665471

Download Submit
C:\Windows\system\sQSPPmA.exe

Filesize
1.3MB

MD5
4e9b3400978e261aeca86afc5b65b0e2

SHA1
3610f284dee3728b1b72f271a44eefa267ea6f9b

SHA256
1fb7eb46f08e8ade0336a8f89d5b8eb6bcad65183cd157960214328df1728564

SHA512
5e780922c134cb93e855cf09491663d2845b7ffdd49e500ada33d41c3fb3032b4a1913e00a303b70de0d208cfc0eef3bab537976f57ded76e58952241f2ce132

Download Submit
C:\Windows\system\tMTGmdd.exe

Filesize
1.3MB

MD5
0b2d63c97fc297d7c283fbc0b4ef9825

SHA1
ebf6c648bb6cf5089c3b71c7fe2b445c6c6b80a2

SHA256
2ce32c0fb1a2e1300405c386bd7ba82224bf88d1d6e879aaa934f443d2f88934

SHA512
2d711eadf8ca797d874561112a506e0a533893b7550529e1e7abb569eccae21860d84db071cbd197d6695cbc47f9d4faa4fb52cba8e5df2c16912206d09922db

Download Submit
C:\Windows\system\vZhzbuY.exe

Filesize
1.3MB

MD5
1444ece76ea91b0b9a6ed632abba4dbf

SHA1
564ffffe3fee4291fbf03683137d022abc88af7a

SHA256
172ea71b2b72d9c6dd22df04f3ddb7555bf28038789f6a0d19e903d5325b483d

SHA512
e5eb554a4fc586a4a643c36b58cb34c0a14a03f6bd569a06fdb7cbf2d0da4af01f3348deab68d9c3dfd39b8febda58f41af075bfb661e90cc81a28fa892ee977

Download Submit
C:\Windows\system\wwYIApZ.exe

Filesize
1.3MB

MD5
1715480ffc5e9f918829560955851560

SHA1
bce5da113e63a07a21addc31326efe67b112234c

SHA256
82f31673a06047ff7485691a18f97b641e03c4efc1569231c8364fe240383dd9

SHA512
3f73f0e2a5079170dc241e2762d14d2772dde31fea75abe90f589ab3d6b4126e859655ee4ef53d78a328e77866da2b72e9e7dfbba8af3389500514a7fafda46a

Download Submit
C:\Windows\system\xeGACiM.exe

Filesize
1.3MB

MD5
a885b2ff04f34b4a69b7c0eea9844716

SHA1
597aad5994acf84e90cab49a99ab01160b379d29

SHA256
38bc4775daf89a222db61a9f7e011c6b36ebd8d2ab0ee4480a97a42a97c06c69

SHA512
a4eb9957f18cbb9b298e032e5463634c873f717e64dbd15404f5c67afc20482faaaa4ce19b433b3e8796295a53c99254da8933986dff927e5e8514c5a1991384

Download Submit
C:\Windows\system\yzhoutd.exe

Filesize
1.3MB

MD5
9a983a451f927cba64e24dcbc34f3439

SHA1
d876a741b563170c9156e1be1ad819edec83b9e0

SHA256
f36c26b5e4da765dc013cc46ca5447ddd7c7084f470f79750fd37bc8a11fb5c4

SHA512
7db242fe3b7232b92943995f47a8982779a82123d3f14cbee8393583ea504e71a87793063eddfaf4ca95a71ffd105f5035f77844147882c416b15d4ed9ab7bf4

Download Submit
\Windows\system\BaLwsTU.exe

Filesize
1.3MB

MD5
9b510311d77987495f25a53c61d7160b

SHA1
bca870b73fe38e06a1237d1501dda57a852d311b

SHA256
cd6ea36653b545ae4597352b8d0a84e8ed4923836759a7bb72eeb51ddf4d2fdc

SHA512
10bbfc8dec96b060e6722731c9111a101d543f4ecb2df58d22035075d83abec3c0de64e7fe3113b67103787d6f65c24f43450357e413c314d6a665eb35c2828a

Download Submit
\Windows\system\SMEWvQB.exe

Filesize
1.3MB

MD5
9dbea3b895f7539547bdb3d2b9a4b5f3

SHA1
f4b6ad2a4d1d3573e0d9c183da97e9f278246276

SHA256
97bff90b614fb7eb53b36fe2737320d20045e0e600277e1a8b0e5280b10b7966

SHA512
78aae23b001ed72df94de2bd2b358badec86994887db9d2cee22f65cfc882e72e22cfb7469d6feaab8a27c77e19ccda963530d2d1edfd12877473ae9ae0965cf

Download Submit
\Windows\system\SMgXXrB.exe

Filesize
1.3MB

MD5
c043159eac9518538494f401198470a4

SHA1
5a32d5128f6f51b3f7836efbafa1f835858c209c

SHA256
3cd2de21cf6e67fd4e1a929e4dd38fd44605a00f1510bee1cc87b0839ba530a6

SHA512
b7ae58da7cbf4b032fb327fa770c92e3b9443392f5fc7c6faa0890586d78836c9cfc86c6a46af7a9c87f78afa56a7b6f120ff2d435413ed17a8b99423b23198e

Download Submit
\Windows\system\jWmdOYC.exe

Filesize
1.3MB

MD5
ba3006c818afdeb8d2f55644629a98bd

SHA1
a78277ebc9e864fa958b5cae7a8594bb720bce43

SHA256
1da3eb9556cb3f0702c31380367f52c0a5c31e620b44653b5f30a8aa022b0daa

SHA512
63af74a2752187d92fa5318a75daaed5b08bf8886223de6ccf195412b324d9953d90a7d64afd433b64a161614a65220dc9ee220c2f7ea8a33588c0878fb5936d

Download Submit
\Windows\system\mpxLihR.exe

Filesize
1.3MB

MD5
4a4cec880712dd46668ac5cb78a3f2fc

SHA1
5b2147dbd58202f9f0d764cdd89461571dc1c7ee

SHA256
c8aaadd471120dbf8ef13a488990fee3c893aedaf980bb0ec54e24303b7a8d0d

SHA512
524ef42e77f466fe3fab2002ff81c5aa4c3eb5472cd020ab83919eb19cc97c4943663b3c08507d5ec64f358932d580e64bd1a9d215a381d9836ab31e8da28737

Download Submit
\Windows\system\qYOJHxC.exe

Filesize
1.3MB

MD5
d73ed66254c6016d650c44a583a93901

SHA1
8c54e36698166faa30b21b1c230767af0fc9d252

SHA256
75c01393db3e2ecf4e4f4fb23c3da868394414f7066ca0da98c93809367ecce5

SHA512
e7978e2102aa20840bbcb491224f7a67c937078247d13c1331748ba1bacb9b058f7faef59edc65cf66edacf7a64bdd9e19cb55c57db538edcbcb4c04a55d11a0

Download Submit
\Windows\system\sGzocew.exe

Filesize
1.3MB

MD5
ccf94ec90bf6be4d2f3ba90dbe51bfaa

SHA1
5b99f2a664cd5a18a54bbae66b3145cf040c3096

SHA256
cf4685ba2834a37a5b31800e366893721278058537fdb4e8cb9dc679826de874

SHA512
7913daab22cdb2f86d953b80f70879d41b56478525ec432dbc909217468bec68aa6f4edbf7d405bb9823560647328a9f5fd9684b94bf2bd6492d3960306370d9

Download Submit
memory/1572-490-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download
memory/1856-489-0x0000000003550000-0x0000000003942000-memory.dmp

Filesize
3.9MB

Download
memory/1856-1-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/1856-492-0x000000013F960000-0x000000013FD52000-memory.dmp

Filesize
3.9MB

Download
memory/1856-0-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/1856-488-0x0000000003550000-0x0000000003942000-memory.dmp

Filesize
3.9MB

Download
memory/1856-94-0x0000000003550000-0x0000000003942000-memory.dmp

Filesize
3.9MB

Download
memory/1856-19-0x000000013FF60000-0x0000000140352000-memory.dmp

Filesize
3.9MB

Download
memory/1856-75-0x0000000003550000-0x0000000003942000-memory.dmp

Filesize
3.9MB

Download
memory/1856-493-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download
memory/1856-494-0x0000000003550000-0x0000000003942000-memory.dmp

Filesize
3.9MB

Download
memory/1856-495-0x000000013F8D0000-0x000000013FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/1856-496-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download
memory/1856-497-0x000000013FD70000-0x0000000140162000-memory.dmp

Filesize
3.9MB

Download
memory/1856-11-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/1856-484-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/1856-54-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/2116-4075-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/2116-17-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/2296-491-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2296-4076-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2380-21-0x000000013FF60000-0x0000000140352000-memory.dmp

Filesize
3.9MB

Download
memory/2380-4117-0x000000013FF60000-0x0000000140352000-memory.dmp

Filesize
3.9MB

Download
memory/2516-25-0x0000000002850000-0x0000000002858000-memory.dmp

Filesize
32KB

Download
memory/2516-24-0x000000001B6A0000-0x000000001B982000-memory.dmp

Filesize
2.9MB

Download
memory/2516-51-0x000007FEF6160000-0x000007FEF6AFD000-memory.dmp

Filesize
9.6MB

Download
memory/2516-49-0x000007FEF6160000-0x000007FEF6AFD000-memory.dmp

Filesize
9.6MB

Download
memory/2516-20-0x0000000002930000-0x00000000029B0000-memory.dmp

Filesize
512KB

Download
memory/2516-22-0x000007FEF641E000-0x000007FEF641F000-memory.dmp

Filesize
4KB

Download
memory/2516-188-0x000007FEF6160000-0x000007FEF6AFD000-memory.dmp

Filesize
9.6MB

Download
memory/2612-487-0x000000013F560000-0x000000013F952000-memory.dmp

Filesize
3.9MB

Download
memory/2716-58-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/2716-4113-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/2892-486-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2892-4077-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2896-4069-0x000000013F960000-0x000000013FD52000-memory.dmp

Filesize
3.9MB

Download
memory/2896-52-0x000000013F960000-0x000000013FD52000-memory.dmp

Filesize
3.9MB

Download
memory/2908-4065-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/2908-82-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/2916-483-0x000000013F0E0000-0x000000013F4D2000-memory.dmp

Filesize
3.9MB

Download
memory/2916-4096-0x000000013F0E0000-0x000000013F4D2000-memory.dmp

Filesize
3.9MB

Download