xmrig | 1ae6fc5b30bd8221d27ab926c03f06640b61c2121b37ba1f2e48e67645b58ef7

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 10:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

82565d151c9d7d3cf7ba70cbd1383b70N.exe
Size

1.3MB
MD5

82565d151c9d7d3cf7ba70cbd1383b70
SHA1

fd037a096ca07333426d1d37bbcea32f7323b63b
SHA256

1ae6fc5b30bd8221d27ab926c03f06640b61c2121b37ba1f2e48e67645b58ef7
SHA512

c976b74797acf2b73333519e15618a416d87c977028ae2e21d44147af5d93dfcb9aecf04832e870facf14d8199697bbe8282d168d74d229dd0fece0c60a8b591
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkF0/hSF:Lz071uv4BPMkHC0I6Gz3N1p+5Q

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 24 IoCs

miner

resource	yara_rule
behavioral1/memory/2456-209-0x000000013FF70000-0x0000000140362000-memory.dmp	xmrig
behavioral1/memory/2884-208-0x000000013F110000-0x000000013F502000-memory.dmp	xmrig
behavioral1/memory/2896-207-0x000000013F880000-0x000000013FC72000-memory.dmp	xmrig
behavioral1/memory/2344-205-0x000000013F160000-0x000000013F552000-memory.dmp	xmrig
behavioral1/memory/3016-203-0x000000013F580000-0x000000013F972000-memory.dmp	xmrig
behavioral1/memory/2652-201-0x000000013F9D0000-0x000000013FDC2000-memory.dmp	xmrig
behavioral1/memory/3004-200-0x000000013F2E0000-0x000000013F6D2000-memory.dmp	xmrig
behavioral1/memory/2680-198-0x0000000002F50000-0x0000000003342000-memory.dmp	xmrig
behavioral1/memory/2596-197-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	xmrig
behavioral1/memory/2812-195-0x000000013FA10000-0x000000013FE02000-memory.dmp	xmrig
behavioral1/memory/2820-15-0x000000013F060000-0x000000013F452000-memory.dmp	xmrig
behavioral1/memory/2736-14-0x000000013F130000-0x000000013F522000-memory.dmp	xmrig
behavioral1/memory/3016-6782-0x000000013F580000-0x000000013F972000-memory.dmp	xmrig
behavioral1/memory/2596-6783-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	xmrig
behavioral1/memory/3004-6784-0x000000013F2E0000-0x000000013F6D2000-memory.dmp	xmrig
behavioral1/memory/2884-6787-0x000000013F110000-0x000000013F502000-memory.dmp	xmrig
behavioral1/memory/2456-6805-0x000000013FF70000-0x0000000140362000-memory.dmp	xmrig
behavioral1/memory/2812-6794-0x000000013FA10000-0x000000013FE02000-memory.dmp	xmrig
behavioral1/memory/2736-6793-0x000000013F130000-0x000000013F522000-memory.dmp	xmrig
behavioral1/memory/2876-6792-0x000000013F830000-0x000000013FC22000-memory.dmp	xmrig
behavioral1/memory/2896-6791-0x000000013F880000-0x000000013FC72000-memory.dmp	xmrig
behavioral1/memory/2344-6790-0x000000013F160000-0x000000013F552000-memory.dmp	xmrig
behavioral1/memory/2820-6788-0x000000013F060000-0x000000013F452000-memory.dmp	xmrig
behavioral1/memory/2680-7417-0x000000013F610000-0x000000013FA02000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2784	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2736	intBaJL.exe
2820	yXFBUML.exe
2876	NLBryHG.exe
2812	BCbFfPD.exe
2596	vJCYDdE.exe
3004	QQtVlOs.exe
2652	iGAgcaI.exe
3016	yTBBYNw.exe
2344	FGQxpTI.exe
2896	JtMoiKp.exe
2884	bpMXpTr.exe
2456	hClQgtk.exe
2132	bQRKGKW.exe
1796	vOxEPSk.exe
1900	nuUiosB.exe
1908	hlMAkOO.exe
2412	dJWGnBp.exe
1704	LIPtlvw.exe
1304	cUyQyrn.exe
1932	YUbSTcP.exe
1992	xsnlnnh.exe
300	hSnAKAc.exe
348	fdpEMIr.exe
2168	zoWaWAi.exe
2952	sLLuiAL.exe
1472	eNAoHvv.exe
1224	yRZLQhY.exe
2480	HYazNij.exe
784	quhkBwS.exe
1356	WdvvmFd.exe
1784	LOsgVSa.exe
1164	GPzeAvg.exe
1640	xZRHZMo.exe
1960	vIuJdPt.exe
2236	IAZegFB.exe
1484	EOjDyfm.exe
288	rhlmhDm.exe
408	ZVJCTNN.exe
2452	TfmsXga.exe
1612	RxISRIU.exe
1500	DmqLEXZ.exe
316	ZSlryDn.exe
804	eMuNViJ.exe
2980	cvLGHeR.exe
2732	VfuXPrF.exe
2116	IQmGUdM.exe
1656	cRycYcQ.exe
2908	OWjXdiD.exe
1596	zNLaqkU.exe
652	LUMqONG.exe
2584	JYlGhVv.exe
2776	mEufJCb.exe
1120	tXOzzNh.exe
2880	KwkenEn.exe
572	bglSITS.exe
2004	lIWBGmZ.exe
1168	eyvHnmu.exe
496	cVfIeJS.exe
1952	DWPUiWd.exe
280	LBXSlcl.exe
2420	oYjHHqD.exe
2856	KwTPGxA.exe
2080	PeeIPCQ.exe
1296	uahnGiv.exe

Loads dropped DLL 64 IoCs

pid	Process
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe

UPX packed file 61 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2680-0-0x000000013F610000-0x000000013FA02000-memory.dmp	upx
behavioral1/files/0x0008000000016de1-7.dat	upx
behavioral1/files/0x0008000000016de9-18.dat	upx
behavioral1/files/0x0008000000017491-34.dat	upx
behavioral1/files/0x0007000000004e74-33.dat	upx
behavioral1/files/0x000c000000018671-45.dat	upx
behavioral1/files/0x0005000000019260-55.dat	upx
behavioral1/files/0x000500000001927c-62.dat	upx
behavioral1/files/0x0005000000019279-68.dat	upx
behavioral1/files/0x000500000001934a-76.dat	upx
behavioral1/files/0x00050000000193aa-87.dat	upx
behavioral1/files/0x0005000000019449-106.dat	upx
behavioral1/files/0x00050000000194f0-131.dat	upx
behavioral1/files/0x000500000001961a-171.dat	upx
behavioral1/files/0x0005000000019617-163.dat	upx
behavioral1/files/0x000500000001948a-113.dat	upx
behavioral1/files/0x000500000001943b-103.dat	upx
behavioral1/memory/2456-209-0x000000013FF70000-0x0000000140362000-memory.dmp	upx
behavioral1/memory/2884-208-0x000000013F110000-0x000000013F502000-memory.dmp	upx
behavioral1/memory/2896-207-0x000000013F880000-0x000000013FC72000-memory.dmp	upx
behavioral1/memory/2344-205-0x000000013F160000-0x000000013F552000-memory.dmp	upx
behavioral1/memory/3016-203-0x000000013F580000-0x000000013F972000-memory.dmp	upx
behavioral1/memory/2652-201-0x000000013F9D0000-0x000000013FDC2000-memory.dmp	upx
behavioral1/memory/3004-200-0x000000013F2E0000-0x000000013F6D2000-memory.dmp	upx
behavioral1/memory/2596-197-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	upx
behavioral1/memory/2812-195-0x000000013FA10000-0x000000013FE02000-memory.dmp	upx
behavioral1/files/0x000500000001961b-174.dat	upx
behavioral1/files/0x0005000000019619-166.dat	upx
behavioral1/files/0x00050000000195a1-159.dat	upx
behavioral1/files/0x00050000000195e6-158.dat	upx
behavioral1/files/0x000500000001957d-151.dat	upx
behavioral1/files/0x0005000000019506-144.dat	upx
behavioral1/files/0x00050000000194fa-136.dat	upx
behavioral1/files/0x00050000000194e5-126.dat	upx
behavioral1/files/0x00050000000194a1-118.dat	upx
behavioral1/files/0x00050000000194b1-117.dat	upx
behavioral1/files/0x0005000000019571-150.dat	upx
behavioral1/files/0x0005000000019504-142.dat	upx
behavioral1/files/0x00050000000194c1-123.dat	upx
behavioral1/files/0x00050000000193ae-93.dat	upx
behavioral1/files/0x00050000000193bc-97.dat	upx
behavioral1/files/0x0005000000019398-82.dat	upx
behavioral1/files/0x0005000000019330-72.dat	upx
behavioral1/files/0x000600000001925c-51.dat	upx
behavioral1/files/0x00070000000174ca-38.dat	upx
behavioral1/memory/2876-27-0x000000013F830000-0x000000013FC22000-memory.dmp	upx
behavioral1/memory/2820-15-0x000000013F060000-0x000000013F452000-memory.dmp	upx
behavioral1/memory/2736-14-0x000000013F130000-0x000000013F522000-memory.dmp	upx
behavioral1/files/0x0007000000012117-11.dat	upx
behavioral1/memory/3016-6782-0x000000013F580000-0x000000013F972000-memory.dmp	upx
behavioral1/memory/2596-6783-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	upx
behavioral1/memory/3004-6784-0x000000013F2E0000-0x000000013F6D2000-memory.dmp	upx
behavioral1/memory/2884-6787-0x000000013F110000-0x000000013F502000-memory.dmp	upx
behavioral1/memory/2456-6805-0x000000013FF70000-0x0000000140362000-memory.dmp	upx
behavioral1/memory/2812-6794-0x000000013FA10000-0x000000013FE02000-memory.dmp	upx
behavioral1/memory/2736-6793-0x000000013F130000-0x000000013F522000-memory.dmp	upx
behavioral1/memory/2876-6792-0x000000013F830000-0x000000013FC22000-memory.dmp	upx
behavioral1/memory/2896-6791-0x000000013F880000-0x000000013FC72000-memory.dmp	upx
behavioral1/memory/2344-6790-0x000000013F160000-0x000000013F552000-memory.dmp	upx
behavioral1/memory/2820-6788-0x000000013F060000-0x000000013F452000-memory.dmp	upx
behavioral1/memory/2680-7417-0x000000013F610000-0x000000013FA02000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\SKpNmBP.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\zFTzMIM.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\uaRwNis.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\XYRbOZf.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\fNdBqIl.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\RSQthOh.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\KNbmYgS.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\plaQwEN.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\NTRwRrM.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\ZCVjKne.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\pDhPInZ.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\tTIFiid.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\PaJTZaq.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\fPSdSPi.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\nvmANna.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\CsXtcKx.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\ESWFGTM.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\mETbrmu.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\jGRUWtw.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\DwRZxMr.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\ebttLdz.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\xGKCkWO.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\ikBIyuv.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\pyFNoLl.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\aTROeWn.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\szqjdpH.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\jKnHjoz.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\yBiyoUc.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\txgWbkf.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\rkehHpH.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\nPOvqpy.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\bwrDFGw.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\Twzqpsf.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\asgNWhJ.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\lOoaiKi.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\RvCZiLC.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\OcmvGbW.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\CsebktW.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\PVAJWSy.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\vikaIkY.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\pKmiDpU.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\XOHxkQB.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\GlBFhOx.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\XgjbEAy.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\tgYZTmk.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\yipNQXi.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\AwSflJW.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\ORXrGAE.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\gHPvavu.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\NTTarEz.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\Arrkixt.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\dUosKFY.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\xsYRDkl.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\fYjLcyr.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\VwUKfOb.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\TVBSCnw.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\OdItFCG.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\jkEfZiu.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\dKYZVdB.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\sIrZgXU.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\ifUfFsN.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\CgyEriw.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\UWHChxO.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe
File created	C:\Windows\System\mDbnwKC.exe	82565d151c9d7d3cf7ba70cbd1383b70N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2784	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe
Token: SeDebugPrivilege	2784	powershell.exe
Token: SeLockMemoryPrivilege	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 2784	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	31
PID 2680 wrote to memory of 2784	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	31
PID 2680 wrote to memory of 2784	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	31
PID 2680 wrote to memory of 2820	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	32
PID 2680 wrote to memory of 2820	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	32
PID 2680 wrote to memory of 2820	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	32
PID 2680 wrote to memory of 2736	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	33
PID 2680 wrote to memory of 2736	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	33
PID 2680 wrote to memory of 2736	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	33
PID 2680 wrote to memory of 2876	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	34
PID 2680 wrote to memory of 2876	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	34
PID 2680 wrote to memory of 2876	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	34
PID 2680 wrote to memory of 2812	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	35
PID 2680 wrote to memory of 2812	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	35
PID 2680 wrote to memory of 2812	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	35
PID 2680 wrote to memory of 2596	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	36
PID 2680 wrote to memory of 2596	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	36
PID 2680 wrote to memory of 2596	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	36
PID 2680 wrote to memory of 2652	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	37
PID 2680 wrote to memory of 2652	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	37
PID 2680 wrote to memory of 2652	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	37
PID 2680 wrote to memory of 3004	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	38
PID 2680 wrote to memory of 3004	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	38
PID 2680 wrote to memory of 3004	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	38
PID 2680 wrote to memory of 3016	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	39
PID 2680 wrote to memory of 3016	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	39
PID 2680 wrote to memory of 3016	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	39
PID 2680 wrote to memory of 2344	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	40
PID 2680 wrote to memory of 2344	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	40
PID 2680 wrote to memory of 2344	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	40
PID 2680 wrote to memory of 2884	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	41
PID 2680 wrote to memory of 2884	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	41
PID 2680 wrote to memory of 2884	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	41
PID 2680 wrote to memory of 2896	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	42
PID 2680 wrote to memory of 2896	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	42
PID 2680 wrote to memory of 2896	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	42
PID 2680 wrote to memory of 2456	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	43
PID 2680 wrote to memory of 2456	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	43
PID 2680 wrote to memory of 2456	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	43
PID 2680 wrote to memory of 2132	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	44
PID 2680 wrote to memory of 2132	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	44
PID 2680 wrote to memory of 2132	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	44
PID 2680 wrote to memory of 1796	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	45
PID 2680 wrote to memory of 1796	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	45
PID 2680 wrote to memory of 1796	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	45
PID 2680 wrote to memory of 1900	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	46
PID 2680 wrote to memory of 1900	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	46
PID 2680 wrote to memory of 1900	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	46
PID 2680 wrote to memory of 1908	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	47
PID 2680 wrote to memory of 1908	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	47
PID 2680 wrote to memory of 1908	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	47
PID 2680 wrote to memory of 2412	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	48
PID 2680 wrote to memory of 2412	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	48
PID 2680 wrote to memory of 2412	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	48
PID 2680 wrote to memory of 1704	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	49
PID 2680 wrote to memory of 1704	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	49
PID 2680 wrote to memory of 1704	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	49
PID 2680 wrote to memory of 1304	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	50
PID 2680 wrote to memory of 1304	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	50
PID 2680 wrote to memory of 1304	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	50
PID 2680 wrote to memory of 1932	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	51
PID 2680 wrote to memory of 1932	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	51
PID 2680 wrote to memory of 1932	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	51
PID 2680 wrote to memory of 1992	2680	82565d151c9d7d3cf7ba70cbd1383b70N.exe	52

C:\Users\Admin\AppData\Local\Temp\82565d151c9d7d3cf7ba70cbd1383b70N.exe
"C:\Users\Admin\AppData\Local\Temp\82565d151c9d7d3cf7ba70cbd1383b70N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2784
- C:\Windows\System\yXFBUML.exe
  C:\Windows\System\yXFBUML.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\intBaJL.exe
  C:\Windows\System\intBaJL.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\NLBryHG.exe
  C:\Windows\System\NLBryHG.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\BCbFfPD.exe
  C:\Windows\System\BCbFfPD.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\vJCYDdE.exe
  C:\Windows\System\vJCYDdE.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\iGAgcaI.exe
  C:\Windows\System\iGAgcaI.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\QQtVlOs.exe
  C:\Windows\System\QQtVlOs.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\yTBBYNw.exe
  C:\Windows\System\yTBBYNw.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\FGQxpTI.exe
  C:\Windows\System\FGQxpTI.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\bpMXpTr.exe
  C:\Windows\System\bpMXpTr.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\JtMoiKp.exe
  C:\Windows\System\JtMoiKp.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\hClQgtk.exe
  C:\Windows\System\hClQgtk.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\bQRKGKW.exe
  C:\Windows\System\bQRKGKW.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\vOxEPSk.exe
  C:\Windows\System\vOxEPSk.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\nuUiosB.exe
  C:\Windows\System\nuUiosB.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\hlMAkOO.exe
  C:\Windows\System\hlMAkOO.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\dJWGnBp.exe
  C:\Windows\System\dJWGnBp.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\LIPtlvw.exe
  C:\Windows\System\LIPtlvw.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\cUyQyrn.exe
  C:\Windows\System\cUyQyrn.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\YUbSTcP.exe
  C:\Windows\System\YUbSTcP.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\xsnlnnh.exe
  C:\Windows\System\xsnlnnh.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\GPzeAvg.exe
  C:\Windows\System\GPzeAvg.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\hSnAKAc.exe
  C:\Windows\System\hSnAKAc.exe
  2⤵
  - Executes dropped EXE
  PID:300
- C:\Windows\System\xZRHZMo.exe
  C:\Windows\System\xZRHZMo.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\fdpEMIr.exe
  C:\Windows\System\fdpEMIr.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\vIuJdPt.exe
  C:\Windows\System\vIuJdPt.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\zoWaWAi.exe
  C:\Windows\System\zoWaWAi.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\IAZegFB.exe
  C:\Windows\System\IAZegFB.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\sLLuiAL.exe
  C:\Windows\System\sLLuiAL.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\EOjDyfm.exe
  C:\Windows\System\EOjDyfm.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\eNAoHvv.exe
  C:\Windows\System\eNAoHvv.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\rhlmhDm.exe
  C:\Windows\System\rhlmhDm.exe
  2⤵
  - Executes dropped EXE
  PID:288
- C:\Windows\System\yRZLQhY.exe
  C:\Windows\System\yRZLQhY.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\ZVJCTNN.exe
  C:\Windows\System\ZVJCTNN.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\HYazNij.exe
  C:\Windows\System\HYazNij.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\TfmsXga.exe
  C:\Windows\System\TfmsXga.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\quhkBwS.exe
  C:\Windows\System\quhkBwS.exe
  2⤵
  - Executes dropped EXE
  PID:784
- C:\Windows\System\RxISRIU.exe
  C:\Windows\System\RxISRIU.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\WdvvmFd.exe
  C:\Windows\System\WdvvmFd.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\DmqLEXZ.exe
  C:\Windows\System\DmqLEXZ.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\LOsgVSa.exe
  C:\Windows\System\LOsgVSa.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\ZSlryDn.exe
  C:\Windows\System\ZSlryDn.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\eMuNViJ.exe
  C:\Windows\System\eMuNViJ.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\IQmGUdM.exe
  C:\Windows\System\IQmGUdM.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\cvLGHeR.exe
  C:\Windows\System\cvLGHeR.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\cRycYcQ.exe
  C:\Windows\System\cRycYcQ.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\VfuXPrF.exe
  C:\Windows\System\VfuXPrF.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\OWjXdiD.exe
  C:\Windows\System\OWjXdiD.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\zNLaqkU.exe
  C:\Windows\System\zNLaqkU.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\JYlGhVv.exe
  C:\Windows\System\JYlGhVv.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\LUMqONG.exe
  C:\Windows\System\LUMqONG.exe
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\System\tXOzzNh.exe
  C:\Windows\System\tXOzzNh.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\mEufJCb.exe
  C:\Windows\System\mEufJCb.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\bglSITS.exe
  C:\Windows\System\bglSITS.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\KwkenEn.exe
  C:\Windows\System\KwkenEn.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\cVfIeJS.exe
  C:\Windows\System\cVfIeJS.exe
  2⤵
  - Executes dropped EXE
  PID:496
- C:\Windows\System\lIWBGmZ.exe
  C:\Windows\System\lIWBGmZ.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\DWPUiWd.exe
  C:\Windows\System\DWPUiWd.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\eyvHnmu.exe
  C:\Windows\System\eyvHnmu.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\LBXSlcl.exe
  C:\Windows\System\LBXSlcl.exe
  2⤵
  - Executes dropped EXE
  PID:280
- C:\Windows\System\oYjHHqD.exe
  C:\Windows\System\oYjHHqD.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\PeeIPCQ.exe
  C:\Windows\System\PeeIPCQ.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\KwTPGxA.exe
  C:\Windows\System\KwTPGxA.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\uahnGiv.exe
  C:\Windows\System\uahnGiv.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\LfhFHfC.exe
  C:\Windows\System\LfhFHfC.exe
  2⤵
  PID:668
- C:\Windows\System\HohclnN.exe
  C:\Windows\System\HohclnN.exe
  2⤵
  PID:1744
- C:\Windows\System\diekhXD.exe
  C:\Windows\System\diekhXD.exe
  2⤵
  PID:2276
- C:\Windows\System\KwKwTDZ.exe
  C:\Windows\System\KwKwTDZ.exe
  2⤵
  PID:684
- C:\Windows\System\TfaTkEa.exe
  C:\Windows\System\TfaTkEa.exe
  2⤵
  PID:2288
- C:\Windows\System\tJdtRLo.exe
  C:\Windows\System\tJdtRLo.exe
  2⤵
  PID:2556
- C:\Windows\System\kqqpKtI.exe
  C:\Windows\System\kqqpKtI.exe
  2⤵
  PID:1848
- C:\Windows\System\wDVXUBf.exe
  C:\Windows\System\wDVXUBf.exe
  2⤵
  PID:1336
- C:\Windows\System\LMaYDMt.exe
  C:\Windows\System\LMaYDMt.exe
  2⤵
  PID:848
- C:\Windows\System\FYfgnDC.exe
  C:\Windows\System\FYfgnDC.exe
  2⤵
  PID:2044
- C:\Windows\System\GLGNdmT.exe
  C:\Windows\System\GLGNdmT.exe
  2⤵
  PID:2436
- C:\Windows\System\PrHnCVf.exe
  C:\Windows\System\PrHnCVf.exe
  2⤵
  PID:2580
- C:\Windows\System\UMJExsP.exe
  C:\Windows\System\UMJExsP.exe
  2⤵
  PID:1332
- C:\Windows\System\aSBDNVU.exe
  C:\Windows\System\aSBDNVU.exe
  2⤵
  PID:2372
- C:\Windows\System\KwaLJqW.exe
  C:\Windows\System\KwaLJqW.exe
  2⤵
  PID:1788
- C:\Windows\System\CKnkBck.exe
  C:\Windows\System\CKnkBck.exe
  2⤵
  PID:2500
- C:\Windows\System\IbHInSB.exe
  C:\Windows\System\IbHInSB.exe
  2⤵
  PID:748
- C:\Windows\System\gIMZqsS.exe
  C:\Windows\System\gIMZqsS.exe
  2⤵
  PID:2112
- C:\Windows\System\brRiCct.exe
  C:\Windows\System\brRiCct.exe
  2⤵
  PID:1716
- C:\Windows\System\tBrLKVM.exe
  C:\Windows\System\tBrLKVM.exe
  2⤵
  PID:1492
- C:\Windows\System\grieeUl.exe
  C:\Windows\System\grieeUl.exe
  2⤵
  PID:2696
- C:\Windows\System\nsncmbF.exe
  C:\Windows\System\nsncmbF.exe
  2⤵
  PID:2864
- C:\Windows\System\IXPGRiO.exe
  C:\Windows\System\IXPGRiO.exe
  2⤵
  PID:2496
- C:\Windows\System\HbdfZvm.exe
  C:\Windows\System\HbdfZvm.exe
  2⤵
  PID:3044
- C:\Windows\System\sOftrRO.exe
  C:\Windows\System\sOftrRO.exe
  2⤵
  PID:2592
- C:\Windows\System\CGTwHvR.exe
  C:\Windows\System\CGTwHvR.exe
  2⤵
  PID:2760
- C:\Windows\System\ayCxkXI.exe
  C:\Windows\System\ayCxkXI.exe
  2⤵
  PID:892
- C:\Windows\System\VbjbzYi.exe
  C:\Windows\System\VbjbzYi.exe
  2⤵
  PID:1904
- C:\Windows\System\OREWYpA.exe
  C:\Windows\System\OREWYpA.exe
  2⤵
  PID:1940
- C:\Windows\System\ipdQWlc.exe
  C:\Windows\System\ipdQWlc.exe
  2⤵
  PID:1548
- C:\Windows\System\TpYKBMM.exe
  C:\Windows\System\TpYKBMM.exe
  2⤵
  PID:3008
- C:\Windows\System\UDwuMzS.exe
  C:\Windows\System\UDwuMzS.exe
  2⤵
  PID:2624
- C:\Windows\System\kLPMrHb.exe
  C:\Windows\System\kLPMrHb.exe
  2⤵
  PID:272
- C:\Windows\System\AZybprc.exe
  C:\Windows\System\AZybprc.exe
  2⤵
  PID:1312
- C:\Windows\System\ClNqUxN.exe
  C:\Windows\System\ClNqUxN.exe
  2⤵
  PID:772
- C:\Windows\System\mOAfbfI.exe
  C:\Windows\System\mOAfbfI.exe
  2⤵
  PID:2460
- C:\Windows\System\LEGXgun.exe
  C:\Windows\System\LEGXgun.exe
  2⤵
  PID:2148
- C:\Windows\System\POsjtYz.exe
  C:\Windows\System\POsjtYz.exe
  2⤵
  PID:2200
- C:\Windows\System\yvpZNpC.exe
  C:\Windows\System\yvpZNpC.exe
  2⤵
  PID:544
- C:\Windows\System\bQNmZfV.exe
  C:\Windows\System\bQNmZfV.exe
  2⤵
  PID:1248
- C:\Windows\System\dQzSEYZ.exe
  C:\Windows\System\dQzSEYZ.exe
  2⤵
  PID:1664
- C:\Windows\System\dtBTmhh.exe
  C:\Windows\System\dtBTmhh.exe
  2⤵
  PID:2388
- C:\Windows\System\xHhpRXq.exe
  C:\Windows\System\xHhpRXq.exe
  2⤵
  PID:1320
- C:\Windows\System\WhFcXqN.exe
  C:\Windows\System\WhFcXqN.exe
  2⤵
  PID:1056
- C:\Windows\System\kGLCRQo.exe
  C:\Windows\System\kGLCRQo.exe
  2⤵
  PID:2768
- C:\Windows\System\fxmerzC.exe
  C:\Windows\System\fxmerzC.exe
  2⤵
  PID:1732
- C:\Windows\System\ajuZsVc.exe
  C:\Windows\System\ajuZsVc.exe
  2⤵
  PID:1948
- C:\Windows\System\UxkmYhf.exe
  C:\Windows\System\UxkmYhf.exe
  2⤵
  PID:1504
- C:\Windows\System\oBLsGIw.exe
  C:\Windows\System\oBLsGIw.exe
  2⤵
  PID:2224
- C:\Windows\System\ESOXvSF.exe
  C:\Windows\System\ESOXvSF.exe
  2⤵
  PID:888
- C:\Windows\System\ouHMrSR.exe
  C:\Windows\System\ouHMrSR.exe
  2⤵
  PID:2944
- C:\Windows\System\taQNtgB.exe
  C:\Windows\System\taQNtgB.exe
  2⤵
  PID:1700
- C:\Windows\System\TgTTaFy.exe
  C:\Windows\System\TgTTaFy.exe
  2⤵
  PID:2444
- C:\Windows\System\KvHolKm.exe
  C:\Windows\System\KvHolKm.exe
  2⤵
  PID:2264
- C:\Windows\System\lxZGvbq.exe
  C:\Windows\System\lxZGvbq.exe
  2⤵
  PID:1116
- C:\Windows\System\WbLGVUk.exe
  C:\Windows\System\WbLGVUk.exe
  2⤵
  PID:2684
- C:\Windows\System\CIgdDkW.exe
  C:\Windows\System\CIgdDkW.exe
  2⤵
  PID:2208
- C:\Windows\System\AyiDNQj.exe
  C:\Windows\System\AyiDNQj.exe
  2⤵
  PID:1584
- C:\Windows\System\ugxNMLW.exe
  C:\Windows\System\ugxNMLW.exe
  2⤵
  PID:3056
- C:\Windows\System\IEteFsU.exe
  C:\Windows\System\IEteFsU.exe
  2⤵
  PID:2744
- C:\Windows\System\ZSvsJjJ.exe
  C:\Windows\System\ZSvsJjJ.exe
  2⤵
  PID:1996
- C:\Windows\System\mRdIQQU.exe
  C:\Windows\System\mRdIQQU.exe
  2⤵
  PID:1392
- C:\Windows\System\pKmiDpU.exe
  C:\Windows\System\pKmiDpU.exe
  2⤵
  PID:2960
- C:\Windows\System\ANpWnUi.exe
  C:\Windows\System\ANpWnUi.exe
  2⤵
  PID:2712
- C:\Windows\System\LDtStws.exe
  C:\Windows\System\LDtStws.exe
  2⤵
  PID:1032
- C:\Windows\System\ZXxSAUh.exe
  C:\Windows\System\ZXxSAUh.exe
  2⤵
  PID:2216
- C:\Windows\System\HOVVNal.exe
  C:\Windows\System\HOVVNal.exe
  2⤵
  PID:2328
- C:\Windows\System\AtzHCZy.exe
  C:\Windows\System\AtzHCZy.exe
  2⤵
  PID:484
- C:\Windows\System\SSZyJAV.exe
  C:\Windows\System\SSZyJAV.exe
  2⤵
  PID:2612
- C:\Windows\System\ZEAORWi.exe
  C:\Windows\System\ZEAORWi.exe
  2⤵
  PID:2840
- C:\Windows\System\IAcFlhX.exe
  C:\Windows\System\IAcFlhX.exe
  2⤵
  PID:2012
- C:\Windows\System\gFgQRFH.exe
  C:\Windows\System\gFgQRFH.exe
  2⤵
  PID:2844
- C:\Windows\System\QqCdSzJ.exe
  C:\Windows\System\QqCdSzJ.exe
  2⤵
  PID:2312
- C:\Windows\System\JZNPVib.exe
  C:\Windows\System\JZNPVib.exe
  2⤵
  PID:2860
- C:\Windows\System\yDbcztW.exe
  C:\Windows\System\yDbcztW.exe
  2⤵
  PID:2248
- C:\Windows\System\svTrOba.exe
  C:\Windows\System\svTrOba.exe
  2⤵
  PID:2448
- C:\Windows\System\jaMwQSu.exe
  C:\Windows\System\jaMwQSu.exe
  2⤵
  PID:2676
- C:\Windows\System\hBFqyMI.exe
  C:\Windows\System\hBFqyMI.exe
  2⤵
  PID:964
- C:\Windows\System\pyFNoLl.exe
  C:\Windows\System\pyFNoLl.exe
  2⤵
  PID:928
- C:\Windows\System\uRCeyae.exe
  C:\Windows\System\uRCeyae.exe
  2⤵
  PID:2656
- C:\Windows\System\ntWGGBQ.exe
  C:\Windows\System\ntWGGBQ.exe
  2⤵
  PID:2832
- C:\Windows\System\TNlgccA.exe
  C:\Windows\System\TNlgccA.exe
  2⤵
  PID:2888
- C:\Windows\System\DsHJDco.exe
  C:\Windows\System\DsHJDco.exe
  2⤵
  PID:1812
- C:\Windows\System\DeYNPvs.exe
  C:\Windows\System\DeYNPvs.exe
  2⤵
  PID:2932
- C:\Windows\System\OkVRdZW.exe
  C:\Windows\System\OkVRdZW.exe
  2⤵
  PID:2484
- C:\Windows\System\dRAKWcM.exe
  C:\Windows\System\dRAKWcM.exe
  2⤵
  PID:2604
- C:\Windows\System\cBEwquz.exe
  C:\Windows\System\cBEwquz.exe
  2⤵
  PID:2632
- C:\Windows\System\MTNNYaJ.exe
  C:\Windows\System\MTNNYaJ.exe
  2⤵
  PID:2976
- C:\Windows\System\QnZEJLA.exe
  C:\Windows\System\QnZEJLA.exe
  2⤵
  PID:900
- C:\Windows\System\cyjyFqa.exe
  C:\Windows\System\cyjyFqa.exe
  2⤵
  PID:604
- C:\Windows\System\ftZzXCA.exe
  C:\Windows\System\ftZzXCA.exe
  2⤵
  PID:3088
- C:\Windows\System\mydFEFr.exe
  C:\Windows\System\mydFEFr.exe
  2⤵
  PID:3104
- C:\Windows\System\RWAEOau.exe
  C:\Windows\System\RWAEOau.exe
  2⤵
  PID:3120
- C:\Windows\System\FkVakgC.exe
  C:\Windows\System\FkVakgC.exe
  2⤵
  PID:3136
- C:\Windows\System\IVZxVvU.exe
  C:\Windows\System\IVZxVvU.exe
  2⤵
  PID:3156
- C:\Windows\System\roKZTmH.exe
  C:\Windows\System\roKZTmH.exe
  2⤵
  PID:3176
- C:\Windows\System\LNidfPw.exe
  C:\Windows\System\LNidfPw.exe
  2⤵
  PID:3196
- C:\Windows\System\VOpeQAQ.exe
  C:\Windows\System\VOpeQAQ.exe
  2⤵
  PID:3212
- C:\Windows\System\ohAYUVr.exe
  C:\Windows\System\ohAYUVr.exe
  2⤵
  PID:3228
- C:\Windows\System\uQsHUoZ.exe
  C:\Windows\System\uQsHUoZ.exe
  2⤵
  PID:3244
- C:\Windows\System\vVGtXnM.exe
  C:\Windows\System\vVGtXnM.exe
  2⤵
  PID:3260
- C:\Windows\System\srFZwVx.exe
  C:\Windows\System\srFZwVx.exe
  2⤵
  PID:3276
- C:\Windows\System\SBfIlin.exe
  C:\Windows\System\SBfIlin.exe
  2⤵
  PID:3292
- C:\Windows\System\ShQxlfp.exe
  C:\Windows\System\ShQxlfp.exe
  2⤵
  PID:3308
- C:\Windows\System\qVjAVwH.exe
  C:\Windows\System\qVjAVwH.exe
  2⤵
  PID:3328
- C:\Windows\System\unlZKqY.exe
  C:\Windows\System\unlZKqY.exe
  2⤵
  PID:3344
- C:\Windows\System\pwUImAz.exe
  C:\Windows\System\pwUImAz.exe
  2⤵
  PID:3360
- C:\Windows\System\DFpmMkW.exe
  C:\Windows\System\DFpmMkW.exe
  2⤵
  PID:3376
- C:\Windows\System\SGqzwWX.exe
  C:\Windows\System\SGqzwWX.exe
  2⤵
  PID:3392
- C:\Windows\System\mIXMNob.exe
  C:\Windows\System\mIXMNob.exe
  2⤵
  PID:3408
- C:\Windows\System\PjsHycw.exe
  C:\Windows\System\PjsHycw.exe
  2⤵
  PID:3424
- C:\Windows\System\NoYzHxt.exe
  C:\Windows\System\NoYzHxt.exe
  2⤵
  PID:3440
- C:\Windows\System\xgkiLaW.exe
  C:\Windows\System\xgkiLaW.exe
  2⤵
  PID:3460
- C:\Windows\System\uuCYByk.exe
  C:\Windows\System\uuCYByk.exe
  2⤵
  PID:3476
- C:\Windows\System\opxlTyF.exe
  C:\Windows\System\opxlTyF.exe
  2⤵
  PID:3492
- C:\Windows\System\AJIsxOA.exe
  C:\Windows\System\AJIsxOA.exe
  2⤵
  PID:3508
- C:\Windows\System\mKLFbYF.exe
  C:\Windows\System\mKLFbYF.exe
  2⤵
  PID:3524
- C:\Windows\System\uyXbkyN.exe
  C:\Windows\System\uyXbkyN.exe
  2⤵
  PID:3540
- C:\Windows\System\UGuHBEB.exe
  C:\Windows\System\UGuHBEB.exe
  2⤵
  PID:3556
- C:\Windows\System\xVSWRaE.exe
  C:\Windows\System\xVSWRaE.exe
  2⤵
  PID:3576
- C:\Windows\System\bxvyVLd.exe
  C:\Windows\System\bxvyVLd.exe
  2⤵
  PID:3592
- C:\Windows\System\XyfwldW.exe
  C:\Windows\System\XyfwldW.exe
  2⤵
  PID:3608
- C:\Windows\System\YYZbsUg.exe
  C:\Windows\System\YYZbsUg.exe
  2⤵
  PID:3624
- C:\Windows\System\pfgiodW.exe
  C:\Windows\System\pfgiodW.exe
  2⤵
  PID:3644
- C:\Windows\System\DNvrXYI.exe
  C:\Windows\System\DNvrXYI.exe
  2⤵
  PID:3660
- C:\Windows\System\ETiUHAP.exe
  C:\Windows\System\ETiUHAP.exe
  2⤵
  PID:3676
- C:\Windows\System\MMadKyA.exe
  C:\Windows\System\MMadKyA.exe
  2⤵
  PID:3692
- C:\Windows\System\YvdccJN.exe
  C:\Windows\System\YvdccJN.exe
  2⤵
  PID:3708
- C:\Windows\System\AfzMBqV.exe
  C:\Windows\System\AfzMBqV.exe
  2⤵
  PID:3728
- C:\Windows\System\dXYmvdx.exe
  C:\Windows\System\dXYmvdx.exe
  2⤵
  PID:3744
- C:\Windows\System\vssQRRI.exe
  C:\Windows\System\vssQRRI.exe
  2⤵
  PID:3760
- C:\Windows\System\JlFKeVH.exe
  C:\Windows\System\JlFKeVH.exe
  2⤵
  PID:3776
- C:\Windows\System\WjPLWqJ.exe
  C:\Windows\System\WjPLWqJ.exe
  2⤵
  PID:3792
- C:\Windows\System\ROcIuqc.exe
  C:\Windows\System\ROcIuqc.exe
  2⤵
  PID:3808
- C:\Windows\System\QGLmfTO.exe
  C:\Windows\System\QGLmfTO.exe
  2⤵
  PID:3828
- C:\Windows\System\awWMugU.exe
  C:\Windows\System\awWMugU.exe
  2⤵
  PID:3844
- C:\Windows\System\GjuRZHJ.exe
  C:\Windows\System\GjuRZHJ.exe
  2⤵
  PID:3860
- C:\Windows\System\MHCpnVl.exe
  C:\Windows\System\MHCpnVl.exe
  2⤵
  PID:3876
- C:\Windows\System\PMjuucy.exe
  C:\Windows\System\PMjuucy.exe
  2⤵
  PID:3892
- C:\Windows\System\CqDQIOk.exe
  C:\Windows\System\CqDQIOk.exe
  2⤵
  PID:3908
- C:\Windows\System\cpPPXwq.exe
  C:\Windows\System\cpPPXwq.exe
  2⤵
  PID:3924
- C:\Windows\System\VhrmsaL.exe
  C:\Windows\System\VhrmsaL.exe
  2⤵
  PID:3940
- C:\Windows\System\oftPaxU.exe
  C:\Windows\System\oftPaxU.exe
  2⤵
  PID:3960
- C:\Windows\System\oanHUvi.exe
  C:\Windows\System\oanHUvi.exe
  2⤵
  PID:3976
- C:\Windows\System\KmeAiyq.exe
  C:\Windows\System\KmeAiyq.exe
  2⤵
  PID:3992
- C:\Windows\System\gfpuysY.exe
  C:\Windows\System\gfpuysY.exe
  2⤵
  PID:4008
- C:\Windows\System\yWIMEEl.exe
  C:\Windows\System\yWIMEEl.exe
  2⤵
  PID:4024
- C:\Windows\System\lfHAyPX.exe
  C:\Windows\System\lfHAyPX.exe
  2⤵
  PID:4040
- C:\Windows\System\GeODImI.exe
  C:\Windows\System\GeODImI.exe
  2⤵
  PID:4056
- C:\Windows\System\SZmtILn.exe
  C:\Windows\System\SZmtILn.exe
  2⤵
  PID:4076
- C:\Windows\System\LJbXpEA.exe
  C:\Windows\System\LJbXpEA.exe
  2⤵
  PID:4092
- C:\Windows\System\Thkrgsl.exe
  C:\Windows\System\Thkrgsl.exe
  2⤵
  PID:868
- C:\Windows\System\ZPxLoTd.exe
  C:\Windows\System\ZPxLoTd.exe
  2⤵
  PID:2136
- C:\Windows\System\UPiufxE.exe
  C:\Windows\System\UPiufxE.exe
  2⤵
  PID:528
- C:\Windows\System\ymLkRtU.exe
  C:\Windows\System\ymLkRtU.exe
  2⤵
  PID:3132
- C:\Windows\System\nJpAcoz.exe
  C:\Windows\System\nJpAcoz.exe
  2⤵
  PID:2872
- C:\Windows\System\vHXRQaB.exe
  C:\Windows\System\vHXRQaB.exe
  2⤵
  PID:2636
- C:\Windows\System\fKShMpf.exe
  C:\Windows\System\fKShMpf.exe
  2⤵
  PID:3268
- C:\Windows\System\tYwBfHs.exe
  C:\Windows\System\tYwBfHs.exe
  2⤵
  PID:3336
- C:\Windows\System\kCjTfFp.exe
  C:\Windows\System\kCjTfFp.exe
  2⤵
  PID:3400
- C:\Windows\System\iSSHjcB.exe
  C:\Windows\System\iSSHjcB.exe
  2⤵
  PID:3468
- C:\Windows\System\dRUXLlF.exe
  C:\Windows\System\dRUXLlF.exe
  2⤵
  PID:3532
- C:\Windows\System\TRfEYgX.exe
  C:\Windows\System\TRfEYgX.exe
  2⤵
  PID:3572
- C:\Windows\System\Svguwbt.exe
  C:\Windows\System\Svguwbt.exe
  2⤵
  PID:3636
- C:\Windows\System\AiuRCPb.exe
  C:\Windows\System\AiuRCPb.exe
  2⤵
  PID:3700
- C:\Windows\System\iXIPcRv.exe
  C:\Windows\System\iXIPcRv.exe
  2⤵
  PID:3768
- C:\Windows\System\mvDPMJb.exe
  C:\Windows\System\mvDPMJb.exe
  2⤵
  PID:3836
- C:\Windows\System\oTlmWeD.exe
  C:\Windows\System\oTlmWeD.exe
  2⤵
  PID:3900
- C:\Windows\System\oPkIwJU.exe
  C:\Windows\System\oPkIwJU.exe
  2⤵
  PID:3968
- C:\Windows\System\iekaCTl.exe
  C:\Windows\System\iekaCTl.exe
  2⤵
  PID:4032
- C:\Windows\System\kSiVqQO.exe
  C:\Windows\System\kSiVqQO.exe
  2⤵
  PID:4072
- C:\Windows\System\BwdkXot.exe
  C:\Windows\System\BwdkXot.exe
  2⤵
  PID:2928
- C:\Windows\System\WtEIrvU.exe
  C:\Windows\System\WtEIrvU.exe
  2⤵
  PID:2164
- C:\Windows\System\uvVmFmk.exe
  C:\Windows\System\uvVmFmk.exe
  2⤵
  PID:1008
- C:\Windows\System\QCGyXNC.exe
  C:\Windows\System\QCGyXNC.exe
  2⤵
  PID:2740
- C:\Windows\System\fiLjTUP.exe
  C:\Windows\System\fiLjTUP.exe
  2⤵
  PID:3324
- C:\Windows\System\SoLNbSk.exe
  C:\Windows\System\SoLNbSk.exe
  2⤵
  PID:3152
- C:\Windows\System\SDFDfWI.exe
  C:\Windows\System\SDFDfWI.exe
  2⤵
  PID:3184
- C:\Windows\System\GDyhcqe.exe
  C:\Windows\System\GDyhcqe.exe
  2⤵
  PID:3484
- C:\Windows\System\AXBHoFH.exe
  C:\Windows\System\AXBHoFH.exe
  2⤵
  PID:3548
- C:\Windows\System\HhiewTi.exe
  C:\Windows\System\HhiewTi.exe
  2⤵
  PID:3616
- C:\Windows\System\Ccommsz.exe
  C:\Windows\System\Ccommsz.exe
  2⤵
  PID:3684
- C:\Windows\System\bqVxlOr.exe
  C:\Windows\System\bqVxlOr.exe
  2⤵
  PID:3784
- C:\Windows\System\bGZwRUp.exe
  C:\Windows\System\bGZwRUp.exe
  2⤵
  PID:3824
- C:\Windows\System\HpArSnI.exe
  C:\Windows\System\HpArSnI.exe
  2⤵
  PID:3888
- C:\Windows\System\QtgYayj.exe
  C:\Windows\System\QtgYayj.exe
  2⤵
  PID:4016
- C:\Windows\System\EuxXhAL.exe
  C:\Windows\System\EuxXhAL.exe
  2⤵
  PID:4088
- C:\Windows\System\qxMTptI.exe
  C:\Windows\System\qxMTptI.exe
  2⤵
  PID:3128
- C:\Windows\System\YFWtdkj.exe
  C:\Windows\System\YFWtdkj.exe
  2⤵
  PID:3952
- C:\Windows\System\vtLIAKl.exe
  C:\Windows\System\vtLIAKl.exe
  2⤵
  PID:3192
- C:\Windows\System\DNzNbRr.exe
  C:\Windows\System\DNzNbRr.exe
  2⤵
  PID:3256
- C:\Windows\System\Kegxymu.exe
  C:\Windows\System\Kegxymu.exe
  2⤵
  PID:3456
- C:\Windows\System\JmeqHrZ.exe
  C:\Windows\System\JmeqHrZ.exe
  2⤵
  PID:3720
- C:\Windows\System\sJntqaj.exe
  C:\Windows\System\sJntqaj.exe
  2⤵
  PID:3916
- C:\Windows\System\moNZZIA.exe
  C:\Windows\System\moNZZIA.exe
  2⤵
  PID:3432
- C:\Windows\System\XVYLpue.exe
  C:\Windows\System\XVYLpue.exe
  2⤵
  PID:3236
- C:\Windows\System\RGrDEdy.exe
  C:\Windows\System\RGrDEdy.exe
  2⤵
  PID:3500
- C:\Windows\System\wxtOypF.exe
  C:\Windows\System\wxtOypF.exe
  2⤵
  PID:3740
- C:\Windows\System\UbXUrbw.exe
  C:\Windows\System\UbXUrbw.exe
  2⤵
  PID:4004
- C:\Windows\System\LJnCavO.exe
  C:\Windows\System\LJnCavO.exe
  2⤵
  PID:2644
- C:\Windows\System\YUgvxhn.exe
  C:\Windows\System\YUgvxhn.exe
  2⤵
  PID:2728
- C:\Windows\System\YLSFZQo.exe
  C:\Windows\System\YLSFZQo.exe
  2⤵
  PID:3652
- C:\Windows\System\LQvDwOv.exe
  C:\Windows\System\LQvDwOv.exe
  2⤵
  PID:1720
- C:\Windows\System\ASwdtXB.exe
  C:\Windows\System\ASwdtXB.exe
  2⤵
  PID:3856
- C:\Windows\System\HGQpuJv.exe
  C:\Windows\System\HGQpuJv.exe
  2⤵
  PID:3936
- C:\Windows\System\UQmjhBp.exe
  C:\Windows\System\UQmjhBp.exe
  2⤵
  PID:1884
- C:\Windows\System\foayZwh.exe
  C:\Windows\System\foayZwh.exe
  2⤵
  PID:3420
- C:\Windows\System\fkkipcr.exe
  C:\Windows\System\fkkipcr.exe
  2⤵
  PID:3588
- C:\Windows\System\hwPgtJL.exe
  C:\Windows\System\hwPgtJL.exe
  2⤵
  PID:4052
- C:\Windows\System\nPUzErx.exe
  C:\Windows\System\nPUzErx.exe
  2⤵
  PID:1268
- C:\Windows\System\PKVxhcH.exe
  C:\Windows\System\PKVxhcH.exe
  2⤵
  PID:3252
- C:\Windows\System\GzCsPtp.exe
  C:\Windows\System\GzCsPtp.exe
  2⤵
  PID:3956
- C:\Windows\System\RabLXyw.exe
  C:\Windows\System\RabLXyw.exe
  2⤵
  PID:4000
- C:\Windows\System\UpFxoEg.exe
  C:\Windows\System\UpFxoEg.exe
  2⤵
  PID:3656
- C:\Windows\System\SyOPOHD.exe
  C:\Windows\System\SyOPOHD.exe
  2⤵
  PID:3116
- C:\Windows\System\zUpegyr.exe
  C:\Windows\System\zUpegyr.exe
  2⤵
  PID:3240
- C:\Windows\System\unuyOUS.exe
  C:\Windows\System\unuyOUS.exe
  2⤵
  PID:3932
- C:\Windows\System\eyURNov.exe
  C:\Windows\System\eyURNov.exe
  2⤵
  PID:4108
- C:\Windows\System\nEsnUny.exe
  C:\Windows\System\nEsnUny.exe
  2⤵
  PID:4124
- C:\Windows\System\ALyjGUd.exe
  C:\Windows\System\ALyjGUd.exe
  2⤵
  PID:4140
- C:\Windows\System\yjykCSq.exe
  C:\Windows\System\yjykCSq.exe
  2⤵
  PID:4156
- C:\Windows\System\WckQnIK.exe
  C:\Windows\System\WckQnIK.exe
  2⤵
  PID:4172
- C:\Windows\System\qDTJHBi.exe
  C:\Windows\System\qDTJHBi.exe
  2⤵
  PID:4188
- C:\Windows\System\vCICeQw.exe
  C:\Windows\System\vCICeQw.exe
  2⤵
  PID:4204
- C:\Windows\System\OHjlErR.exe
  C:\Windows\System\OHjlErR.exe
  2⤵
  PID:4220
- C:\Windows\System\TqRTOhz.exe
  C:\Windows\System\TqRTOhz.exe
  2⤵
  PID:4236
- C:\Windows\System\AoUrAOY.exe
  C:\Windows\System\AoUrAOY.exe
  2⤵
  PID:4252
- C:\Windows\System\yByPFfA.exe
  C:\Windows\System\yByPFfA.exe
  2⤵
  PID:4268
- C:\Windows\System\ceswyfS.exe
  C:\Windows\System\ceswyfS.exe
  2⤵
  PID:4284
- C:\Windows\System\sfzeTiD.exe
  C:\Windows\System\sfzeTiD.exe
  2⤵
  PID:4300
- C:\Windows\System\Dkkjcxi.exe
  C:\Windows\System\Dkkjcxi.exe
  2⤵
  PID:4320
- C:\Windows\System\PSatDJR.exe
  C:\Windows\System\PSatDJR.exe
  2⤵
  PID:4336
- C:\Windows\System\GzqnSwI.exe
  C:\Windows\System\GzqnSwI.exe
  2⤵
  PID:4352
- C:\Windows\System\zmyOXcK.exe
  C:\Windows\System\zmyOXcK.exe
  2⤵
  PID:4368
- C:\Windows\System\FqrRPpW.exe
  C:\Windows\System\FqrRPpW.exe
  2⤵
  PID:4384
- C:\Windows\System\IXEoImI.exe
  C:\Windows\System\IXEoImI.exe
  2⤵
  PID:4400
- C:\Windows\System\kkZvfEF.exe
  C:\Windows\System\kkZvfEF.exe
  2⤵
  PID:4416
- C:\Windows\System\ZmxeGKT.exe
  C:\Windows\System\ZmxeGKT.exe
  2⤵
  PID:4432
- C:\Windows\System\ptuhFjD.exe
  C:\Windows\System\ptuhFjD.exe
  2⤵
  PID:4448
- C:\Windows\System\UVximyz.exe
  C:\Windows\System\UVximyz.exe
  2⤵
  PID:4468
- C:\Windows\System\vHnFtDQ.exe
  C:\Windows\System\vHnFtDQ.exe
  2⤵
  PID:4484
- C:\Windows\System\dKYZVdB.exe
  C:\Windows\System\dKYZVdB.exe
  2⤵
  PID:4500
- C:\Windows\System\BpCEZBk.exe
  C:\Windows\System\BpCEZBk.exe
  2⤵
  PID:4516
- C:\Windows\System\oJfHEVx.exe
  C:\Windows\System\oJfHEVx.exe
  2⤵
  PID:4532
- C:\Windows\System\adpGOdw.exe
  C:\Windows\System\adpGOdw.exe
  2⤵
  PID:4548
- C:\Windows\System\SyeCpzI.exe
  C:\Windows\System\SyeCpzI.exe
  2⤵
  PID:4564
- C:\Windows\System\jHODfmA.exe
  C:\Windows\System\jHODfmA.exe
  2⤵
  PID:4580
- C:\Windows\System\bgOJNCb.exe
  C:\Windows\System\bgOJNCb.exe
  2⤵
  PID:4596
- C:\Windows\System\kMlVYlm.exe
  C:\Windows\System\kMlVYlm.exe
  2⤵
  PID:4612
- C:\Windows\System\zgcyaLR.exe
  C:\Windows\System\zgcyaLR.exe
  2⤵
  PID:4628
- C:\Windows\System\zRLNuJb.exe
  C:\Windows\System\zRLNuJb.exe
  2⤵
  PID:4644
- C:\Windows\System\nDVUUis.exe
  C:\Windows\System\nDVUUis.exe
  2⤵
  PID:4660
- C:\Windows\System\XQYeXUE.exe
  C:\Windows\System\XQYeXUE.exe
  2⤵
  PID:4676
- C:\Windows\System\ZyquMCq.exe
  C:\Windows\System\ZyquMCq.exe
  2⤵
  PID:4692
- C:\Windows\System\KahBWCB.exe
  C:\Windows\System\KahBWCB.exe
  2⤵
  PID:4708
- C:\Windows\System\XmOcfjg.exe
  C:\Windows\System\XmOcfjg.exe
  2⤵
  PID:4724
- C:\Windows\System\XBqJcAJ.exe
  C:\Windows\System\XBqJcAJ.exe
  2⤵
  PID:4740
- C:\Windows\System\FAUelKR.exe
  C:\Windows\System\FAUelKR.exe
  2⤵
  PID:4756
- C:\Windows\System\OJmJJyW.exe
  C:\Windows\System\OJmJJyW.exe
  2⤵
  PID:4772
- C:\Windows\System\VVskilZ.exe
  C:\Windows\System\VVskilZ.exe
  2⤵
  PID:4788
- C:\Windows\System\SqAFdbA.exe
  C:\Windows\System\SqAFdbA.exe
  2⤵
  PID:4804
- C:\Windows\System\gmzqsEx.exe
  C:\Windows\System\gmzqsEx.exe
  2⤵
  PID:4820
- C:\Windows\System\ZsROQAc.exe
  C:\Windows\System\ZsROQAc.exe
  2⤵
  PID:4836
- C:\Windows\System\dbTjruZ.exe
  C:\Windows\System\dbTjruZ.exe
  2⤵
  PID:4852
- C:\Windows\System\etvRTFd.exe
  C:\Windows\System\etvRTFd.exe
  2⤵
  PID:4868
- C:\Windows\System\HcGwDHE.exe
  C:\Windows\System\HcGwDHE.exe
  2⤵
  PID:4884
- C:\Windows\System\xMtijcC.exe
  C:\Windows\System\xMtijcC.exe
  2⤵
  PID:4900
- C:\Windows\System\PhTynBB.exe
  C:\Windows\System\PhTynBB.exe
  2⤵
  PID:4916
- C:\Windows\System\IEZuVGF.exe
  C:\Windows\System\IEZuVGF.exe
  2⤵
  PID:4932
- C:\Windows\System\gSalAGm.exe
  C:\Windows\System\gSalAGm.exe
  2⤵
  PID:4948
- C:\Windows\System\qFRiXNm.exe
  C:\Windows\System\qFRiXNm.exe
  2⤵
  PID:4964
- C:\Windows\System\BwUcnEh.exe
  C:\Windows\System\BwUcnEh.exe
  2⤵
  PID:4980
- C:\Windows\System\YUNUOBM.exe
  C:\Windows\System\YUNUOBM.exe
  2⤵
  PID:4996
- C:\Windows\System\kZSCmLu.exe
  C:\Windows\System\kZSCmLu.exe
  2⤵
  PID:5012
- C:\Windows\System\ecEhGHt.exe
  C:\Windows\System\ecEhGHt.exe
  2⤵
  PID:5028
- C:\Windows\System\cmfoWpC.exe
  C:\Windows\System\cmfoWpC.exe
  2⤵
  PID:5048
- C:\Windows\System\ZTHinqY.exe
  C:\Windows\System\ZTHinqY.exe
  2⤵
  PID:5064
- C:\Windows\System\ytldPCh.exe
  C:\Windows\System\ytldPCh.exe
  2⤵
  PID:5080
- C:\Windows\System\SZjIlHF.exe
  C:\Windows\System\SZjIlHF.exe
  2⤵
  PID:5096
- C:\Windows\System\WBetgIF.exe
  C:\Windows\System\WBetgIF.exe
  2⤵
  PID:5112
- C:\Windows\System\jCoimnl.exe
  C:\Windows\System\jCoimnl.exe
  2⤵
  PID:4116
- C:\Windows\System\XHaPAKQ.exe
  C:\Windows\System\XHaPAKQ.exe
  2⤵
  PID:4180
- C:\Windows\System\PIgNvRc.exe
  C:\Windows\System\PIgNvRc.exe
  2⤵
  PID:4216
- C:\Windows\System\Fdknyqn.exe
  C:\Windows\System\Fdknyqn.exe
  2⤵
  PID:4280
- C:\Windows\System\cojWUCf.exe
  C:\Windows\System\cojWUCf.exe
  2⤵
  PID:4344
- C:\Windows\System\dhULXAR.exe
  C:\Windows\System\dhULXAR.exe
  2⤵
  PID:4408
- C:\Windows\System\TWQGNJc.exe
  C:\Windows\System\TWQGNJc.exe
  2⤵
  PID:3756
- C:\Windows\System\lbXZump.exe
  C:\Windows\System\lbXZump.exe
  2⤵
  PID:4100
- C:\Windows\System\BoiAbTc.exe
  C:\Windows\System\BoiAbTc.exe
  2⤵
  PID:4424
- C:\Windows\System\WwOOlFy.exe
  C:\Windows\System\WwOOlFy.exe
  2⤵
  PID:3584
- C:\Windows\System\MYssAsS.exe
  C:\Windows\System\MYssAsS.exe
  2⤵
  PID:4104
- C:\Windows\System\pWwsZhG.exe
  C:\Windows\System\pWwsZhG.exe
  2⤵
  PID:1604
- C:\Windows\System\iXeaBDX.exe
  C:\Windows\System\iXeaBDX.exe
  2⤵
  PID:4328
- C:\Windows\System\arwmcNz.exe
  C:\Windows\System\arwmcNz.exe
  2⤵
  PID:3948
- C:\Windows\System\TNqULnh.exe
  C:\Windows\System\TNqULnh.exe
  2⤵
  PID:3716
- C:\Windows\System\AUODwXl.exe
  C:\Windows\System\AUODwXl.exe
  2⤵
  PID:4168
- C:\Windows\System\QsSItEL.exe
  C:\Windows\System\QsSItEL.exe
  2⤵
  PID:4232
- C:\Windows\System\LEngHot.exe
  C:\Windows\System\LEngHot.exe
  2⤵
  PID:4296
- C:\Windows\System\QDLTQFf.exe
  C:\Windows\System\QDLTQFf.exe
  2⤵
  PID:4396
- C:\Windows\System\KqfsERG.exe
  C:\Windows\System\KqfsERG.exe
  2⤵
  PID:4496
- C:\Windows\System\EKpZGVo.exe
  C:\Windows\System\EKpZGVo.exe
  2⤵
  PID:4492
- C:\Windows\System\xcFVKIW.exe
  C:\Windows\System\xcFVKIW.exe
  2⤵
  PID:4528
- C:\Windows\System\SYfFaTX.exe
  C:\Windows\System\SYfFaTX.exe
  2⤵
  PID:4592
- C:\Windows\System\vanzehv.exe
  C:\Windows\System\vanzehv.exe
  2⤵
  PID:4656
- C:\Windows\System\ZJzNIuM.exe
  C:\Windows\System\ZJzNIuM.exe
  2⤵
  PID:4720
- C:\Windows\System\BryZrUk.exe
  C:\Windows\System\BryZrUk.exe
  2⤵
  PID:4604
- C:\Windows\System\TOpFWAv.exe
  C:\Windows\System\TOpFWAv.exe
  2⤵
  PID:4668
- C:\Windows\System\AqqzGXi.exe
  C:\Windows\System\AqqzGXi.exe
  2⤵
  PID:4732
- C:\Windows\System\soqELnQ.exe
  C:\Windows\System\soqELnQ.exe
  2⤵
  PID:4796
- C:\Windows\System\CrYrOsQ.exe
  C:\Windows\System\CrYrOsQ.exe
  2⤵
  PID:4860
- C:\Windows\System\DaTKMjw.exe
  C:\Windows\System\DaTKMjw.exe
  2⤵
  PID:4924
- C:\Windows\System\BbLxxEe.exe
  C:\Windows\System\BbLxxEe.exe
  2⤵
  PID:4988
- C:\Windows\System\twQnZBb.exe
  C:\Windows\System\twQnZBb.exe
  2⤵
  PID:4812
- C:\Windows\System\JCenifs.exe
  C:\Windows\System\JCenifs.exe
  2⤵
  PID:4880
- C:\Windows\System\bChuvAw.exe
  C:\Windows\System\bChuvAw.exe
  2⤵
  PID:4944
- C:\Windows\System\RxMXBls.exe
  C:\Windows\System\RxMXBls.exe
  2⤵
  PID:5036
- C:\Windows\System\DjppVcu.exe
  C:\Windows\System\DjppVcu.exe
  2⤵
  PID:4784
- C:\Windows\System\AsecxPT.exe
  C:\Windows\System\AsecxPT.exe
  2⤵
  PID:4912
- C:\Windows\System\xucqkpK.exe
  C:\Windows\System\xucqkpK.exe
  2⤵
  PID:5008
- C:\Windows\System\NgfyFXz.exe
  C:\Windows\System\NgfyFXz.exe
  2⤵
  PID:5108
- C:\Windows\System\EvrAOzo.exe
  C:\Windows\System\EvrAOzo.exe
  2⤵
  PID:4316
- C:\Windows\System\MtUvwmB.exe
  C:\Windows\System\MtUvwmB.exe
  2⤵
  PID:4360
- C:\Windows\System\loeQZsg.exe
  C:\Windows\System\loeQZsg.exe
  2⤵
  PID:4068
- C:\Windows\System\XMKJpWW.exe
  C:\Windows\System\XMKJpWW.exe
  2⤵
  PID:4200
- C:\Windows\System\JMbCjJY.exe
  C:\Windows\System\JMbCjJY.exe
  2⤵
  PID:4480
- C:\Windows\System\kkSSMOs.exe
  C:\Windows\System\kkSSMOs.exe
  2⤵
  PID:4688
- C:\Windows\System\BRDNkrw.exe
  C:\Windows\System\BRDNkrw.exe
  2⤵
  PID:4764
- C:\Windows\System\BLCuAZZ.exe
  C:\Windows\System\BLCuAZZ.exe
  2⤵
  PID:5020
- C:\Windows\System\QFHIHCi.exe
  C:\Windows\System\QFHIHCi.exe
  2⤵
  PID:5044
- C:\Windows\System\EnBOOtV.exe
  C:\Windows\System\EnBOOtV.exe
  2⤵
  PID:3304
- C:\Windows\System\BzrQemB.exe
  C:\Windows\System\BzrQemB.exe
  2⤵
  PID:3736
- C:\Windows\System\lTndHld.exe
  C:\Windows\System\lTndHld.exe
  2⤵
  PID:4636
- C:\Windows\System\QZhNVqh.exe
  C:\Windows\System\QZhNVqh.exe
  2⤵
  PID:4212
- C:\Windows\System\QYPbVgT.exe
  C:\Windows\System\QYPbVgT.exe
  2⤵
  PID:4152
- C:\Windows\System\itgifkS.exe
  C:\Windows\System\itgifkS.exe
  2⤵
  PID:4624
- C:\Windows\System\ZqzspMs.exe
  C:\Windows\System\ZqzspMs.exe
  2⤵
  PID:4380
- C:\Windows\System\AdRcRWT.exe
  C:\Windows\System\AdRcRWT.exe
  2⤵
  PID:700
- C:\Windows\System\XEDEcBK.exe
  C:\Windows\System\XEDEcBK.exe
  2⤵
  PID:4136
- C:\Windows\System\bLzzzGB.exe
  C:\Windows\System\bLzzzGB.exe
  2⤵
  PID:4456
- C:\Windows\System\GmIMQGj.exe
  C:\Windows\System\GmIMQGj.exe
  2⤵
  PID:4652
- C:\Windows\System\vzCYbua.exe
  C:\Windows\System\vzCYbua.exe
  2⤵
  PID:4828
- C:\Windows\System\MkbifSN.exe
  C:\Windows\System\MkbifSN.exe
  2⤵
  PID:5060
- C:\Windows\System\hZtpDCb.exe
  C:\Windows\System\hZtpDCb.exe
  2⤵
  PID:3372
- C:\Windows\System\bDHmQBV.exe
  C:\Windows\System\bDHmQBV.exe
  2⤵
  PID:4364
- C:\Windows\System\MxMDIAw.exe
  C:\Windows\System\MxMDIAw.exe
  2⤵
  PID:4892
- C:\Windows\System\JZGTKMl.exe
  C:\Windows\System\JZGTKMl.exe
  2⤵
  PID:1688
- C:\Windows\System\QSvGyPU.exe
  C:\Windows\System\QSvGyPU.exe
  2⤵
  PID:4148
- C:\Windows\System\WLzPINk.exe
  C:\Windows\System\WLzPINk.exe
  2⤵
  PID:3384
- C:\Windows\System\AKkziJi.exe
  C:\Windows\System\AKkziJi.exe
  2⤵
  PID:4576
- C:\Windows\System\zmYAyyn.exe
  C:\Windows\System\zmYAyyn.exe
  2⤵
  PID:3668
- C:\Windows\System\xYNHWiJ.exe
  C:\Windows\System\xYNHWiJ.exe
  2⤵
  PID:4956
- C:\Windows\System\AmCqmci.exe
  C:\Windows\System\AmCqmci.exe
  2⤵
  PID:4896
- C:\Windows\System\sIVcZBT.exe
  C:\Windows\System\sIVcZBT.exe
  2⤵
  PID:4292
- C:\Windows\System\QAuoMxC.exe
  C:\Windows\System\QAuoMxC.exe
  2⤵
  PID:4752
- C:\Windows\System\xZQIQeN.exe
  C:\Windows\System\xZQIQeN.exe
  2⤵
  PID:5132
- C:\Windows\System\mfIeDsX.exe
  C:\Windows\System\mfIeDsX.exe
  2⤵
  PID:5148
- C:\Windows\System\utCmRbN.exe
  C:\Windows\System\utCmRbN.exe
  2⤵
  PID:5164
- C:\Windows\System\cOOuzVh.exe
  C:\Windows\System\cOOuzVh.exe
  2⤵
  PID:5180
- C:\Windows\System\cVBtgfi.exe
  C:\Windows\System\cVBtgfi.exe
  2⤵
  PID:5196
- C:\Windows\System\ADlkJiS.exe
  C:\Windows\System\ADlkJiS.exe
  2⤵
  PID:5212
- C:\Windows\System\eACxSWJ.exe
  C:\Windows\System\eACxSWJ.exe
  2⤵
  PID:5228
- C:\Windows\System\lAzFwQI.exe
  C:\Windows\System\lAzFwQI.exe
  2⤵
  PID:5244
- C:\Windows\System\FaiYBAh.exe
  C:\Windows\System\FaiYBAh.exe
  2⤵
  PID:5260
- C:\Windows\System\kxXtxeP.exe
  C:\Windows\System\kxXtxeP.exe
  2⤵
  PID:5276
- C:\Windows\System\LZAJZxA.exe
  C:\Windows\System\LZAJZxA.exe
  2⤵
  PID:5292
- C:\Windows\System\ROHGlXQ.exe
  C:\Windows\System\ROHGlXQ.exe
  2⤵
  PID:5308
- C:\Windows\System\cOlJVRH.exe
  C:\Windows\System\cOlJVRH.exe
  2⤵
  PID:5324
- C:\Windows\System\gkPPKHR.exe
  C:\Windows\System\gkPPKHR.exe
  2⤵
  PID:5340
- C:\Windows\System\aTROeWn.exe
  C:\Windows\System\aTROeWn.exe
  2⤵
  PID:5356
- C:\Windows\System\vVrBVHf.exe
  C:\Windows\System\vVrBVHf.exe
  2⤵
  PID:5372
- C:\Windows\System\sIrZgXU.exe
  C:\Windows\System\sIrZgXU.exe
  2⤵
  PID:5388
- C:\Windows\System\YAKATXS.exe
  C:\Windows\System\YAKATXS.exe
  2⤵
  PID:5404
- C:\Windows\System\nYTNBEM.exe
  C:\Windows\System\nYTNBEM.exe
  2⤵
  PID:5420
- C:\Windows\System\mItsiHY.exe
  C:\Windows\System\mItsiHY.exe
  2⤵
  PID:5436
- C:\Windows\System\GKllquz.exe
  C:\Windows\System\GKllquz.exe
  2⤵
  PID:5452
- C:\Windows\System\FhaMNdC.exe
  C:\Windows\System\FhaMNdC.exe
  2⤵
  PID:5468
- C:\Windows\System\PPQCAHf.exe
  C:\Windows\System\PPQCAHf.exe
  2⤵
  PID:5484
- C:\Windows\System\AxcHjjM.exe
  C:\Windows\System\AxcHjjM.exe
  2⤵
  PID:5500
- C:\Windows\System\CBuWwYT.exe
  C:\Windows\System\CBuWwYT.exe
  2⤵
  PID:5516
- C:\Windows\System\OWLpUty.exe
  C:\Windows\System\OWLpUty.exe
  2⤵
  PID:5532
- C:\Windows\System\iNFfMvG.exe
  C:\Windows\System\iNFfMvG.exe
  2⤵
  PID:5548
- C:\Windows\System\jJjuxNP.exe
  C:\Windows\System\jJjuxNP.exe
  2⤵
  PID:5564
- C:\Windows\System\BTEoPNX.exe
  C:\Windows\System\BTEoPNX.exe
  2⤵
  PID:5580
- C:\Windows\System\eQgSXXv.exe
  C:\Windows\System\eQgSXXv.exe
  2⤵
  PID:5596
- C:\Windows\System\hVhIbYl.exe
  C:\Windows\System\hVhIbYl.exe
  2⤵
  PID:5612
- C:\Windows\System\xIIZLyC.exe
  C:\Windows\System\xIIZLyC.exe
  2⤵
  PID:5628
- C:\Windows\System\xMhpxKU.exe
  C:\Windows\System\xMhpxKU.exe
  2⤵
  PID:5644
- C:\Windows\System\lHEzmcP.exe
  C:\Windows\System\lHEzmcP.exe
  2⤵
  PID:5660
- C:\Windows\System\izxGUmM.exe
  C:\Windows\System\izxGUmM.exe
  2⤵
  PID:5676
- C:\Windows\System\chumuFm.exe
  C:\Windows\System\chumuFm.exe
  2⤵
  PID:5692
- C:\Windows\System\udrwyXX.exe
  C:\Windows\System\udrwyXX.exe
  2⤵
  PID:5708
- C:\Windows\System\YNxkJbj.exe
  C:\Windows\System\YNxkJbj.exe
  2⤵
  PID:5724
- C:\Windows\System\ehADelS.exe
  C:\Windows\System\ehADelS.exe
  2⤵
  PID:5740
- C:\Windows\System\fLmaIrD.exe
  C:\Windows\System\fLmaIrD.exe
  2⤵
  PID:5760
- C:\Windows\System\nKLZFHW.exe
  C:\Windows\System\nKLZFHW.exe
  2⤵
  PID:5776
- C:\Windows\System\jSQoyPz.exe
  C:\Windows\System\jSQoyPz.exe
  2⤵
  PID:5792
- C:\Windows\System\NboyoSx.exe
  C:\Windows\System\NboyoSx.exe
  2⤵
  PID:5808
- C:\Windows\System\UaNmAUy.exe
  C:\Windows\System\UaNmAUy.exe
  2⤵
  PID:5824
- C:\Windows\System\lVhLVlh.exe
  C:\Windows\System\lVhLVlh.exe
  2⤵
  PID:5840
- C:\Windows\System\XFtYzQd.exe
  C:\Windows\System\XFtYzQd.exe
  2⤵
  PID:5856
- C:\Windows\System\HRdxWWC.exe
  C:\Windows\System\HRdxWWC.exe
  2⤵
  PID:5872
- C:\Windows\System\JaQgGcC.exe
  C:\Windows\System\JaQgGcC.exe
  2⤵
  PID:5888
- C:\Windows\System\eQxskES.exe
  C:\Windows\System\eQxskES.exe
  2⤵
  PID:5904
- C:\Windows\System\pkjCXgj.exe
  C:\Windows\System\pkjCXgj.exe
  2⤵
  PID:5924
- C:\Windows\System\wzEUuFF.exe
  C:\Windows\System\wzEUuFF.exe
  2⤵
  PID:5940
- C:\Windows\System\GvCEuvs.exe
  C:\Windows\System\GvCEuvs.exe
  2⤵
  PID:5956
- C:\Windows\System\VgwOiVA.exe
  C:\Windows\System\VgwOiVA.exe
  2⤵
  PID:5972
- C:\Windows\System\eryOUyS.exe
  C:\Windows\System\eryOUyS.exe
  2⤵
  PID:5988
- C:\Windows\System\NIcxoCt.exe
  C:\Windows\System\NIcxoCt.exe
  2⤵
  PID:6004
- C:\Windows\System\uBJWlic.exe
  C:\Windows\System\uBJWlic.exe
  2⤵
  PID:6020
- C:\Windows\System\ENmVhEx.exe
  C:\Windows\System\ENmVhEx.exe
  2⤵
  PID:6036
- C:\Windows\System\QUHdMTN.exe
  C:\Windows\System\QUHdMTN.exe
  2⤵
  PID:6052
- C:\Windows\System\CTQSRUK.exe
  C:\Windows\System\CTQSRUK.exe
  2⤵
  PID:6068
- C:\Windows\System\afalGJl.exe
  C:\Windows\System\afalGJl.exe
  2⤵
  PID:6084
- C:\Windows\System\iqYxIhl.exe
  C:\Windows\System\iqYxIhl.exe
  2⤵
  PID:6100
- C:\Windows\System\mKQeamp.exe
  C:\Windows\System\mKQeamp.exe
  2⤵
  PID:6116
- C:\Windows\System\YUygYRA.exe
  C:\Windows\System\YUygYRA.exe
  2⤵
  PID:6136
- C:\Windows\System\cpOgUIQ.exe
  C:\Windows\System\cpOgUIQ.exe
  2⤵
  PID:5156
- C:\Windows\System\hxqPBfd.exe
  C:\Windows\System\hxqPBfd.exe
  2⤵
  PID:5220
- C:\Windows\System\acFpoRL.exe
  C:\Windows\System\acFpoRL.exe
  2⤵
  PID:4376
- C:\Windows\System\EpKlVGI.exe
  C:\Windows\System\EpKlVGI.exe
  2⤵
  PID:5144
- C:\Windows\System\GRMOozb.exe
  C:\Windows\System\GRMOozb.exe
  2⤵
  PID:3988
- C:\Windows\System\xBVTLor.exe
  C:\Windows\System\xBVTLor.exe
  2⤵
  PID:3388
- C:\Windows\System\CfHMyYA.exe
  C:\Windows\System\CfHMyYA.exe
  2⤵
  PID:5208
- C:\Windows\System\UbESWSb.exe
  C:\Windows\System\UbESWSb.exe
  2⤵
  PID:5268
- C:\Windows\System\VZqVIsF.exe
  C:\Windows\System\VZqVIsF.exe
  2⤵
  PID:5332
- C:\Windows\System\AHMoKTI.exe
  C:\Windows\System\AHMoKTI.exe
  2⤵
  PID:5320
- C:\Windows\System\HfoaBBD.exe
  C:\Windows\System\HfoaBBD.exe
  2⤵
  PID:5384
- C:\Windows\System\jCncpNF.exe
  C:\Windows\System\jCncpNF.exe
  2⤵
  PID:5416
- C:\Windows\System\Ncmvdop.exe
  C:\Windows\System\Ncmvdop.exe
  2⤵
  PID:5432
- C:\Windows\System\lgYaqoS.exe
  C:\Windows\System\lgYaqoS.exe
  2⤵
  PID:5448
- C:\Windows\System\roTeCIo.exe
  C:\Windows\System\roTeCIo.exe
  2⤵
  PID:5480
- C:\Windows\System\cNIjfcS.exe
  C:\Windows\System\cNIjfcS.exe
  2⤵
  PID:5544
- C:\Windows\System\EtKiApo.exe
  C:\Windows\System\EtKiApo.exe
  2⤵
  PID:5556
- C:\Windows\System\KMsHlVR.exe
  C:\Windows\System\KMsHlVR.exe
  2⤵
  PID:5608
- C:\Windows\System\MMTVCdN.exe
  C:\Windows\System\MMTVCdN.exe
  2⤵
  PID:5592
- C:\Windows\System\FRSxDdZ.exe
  C:\Windows\System\FRSxDdZ.exe
  2⤵
  PID:5652
- C:\Windows\System\OVOKEjK.exe
  C:\Windows\System\OVOKEjK.exe
  2⤵
  PID:5624
- C:\Windows\System\WhJJbzR.exe
  C:\Windows\System\WhJJbzR.exe
  2⤵
  PID:5736
- C:\Windows\System\jIRVdeD.exe
  C:\Windows\System\jIRVdeD.exe
  2⤵
  PID:5772
- C:\Windows\System\YdEOWeC.exe
  C:\Windows\System\YdEOWeC.exe
  2⤵
  PID:5784
- C:\Windows\System\qGNFUmV.exe
  C:\Windows\System\qGNFUmV.exe
  2⤵
  PID:5864
- C:\Windows\System\bZCxRbW.exe
  C:\Windows\System\bZCxRbW.exe
  2⤵
  PID:5848
- C:\Windows\System\PPYNRjM.exe
  C:\Windows\System\PPYNRjM.exe
  2⤵
  PID:5816
- C:\Windows\System\sgcYKVy.exe
  C:\Windows\System\sgcYKVy.exe
  2⤵
  PID:5912
- C:\Windows\System\eptyGFp.exe
  C:\Windows\System\eptyGFp.exe
  2⤵
  PID:5964
- C:\Windows\System\YipixqG.exe
  C:\Windows\System\YipixqG.exe
  2⤵
  PID:6028
- C:\Windows\System\BhLiFuo.exe
  C:\Windows\System\BhLiFuo.exe
  2⤵
  PID:6092
- C:\Windows\System\HDEFJra.exe
  C:\Windows\System\HDEFJra.exe
  2⤵
  PID:6132
- C:\Windows\System\EIXDjhM.exe
  C:\Windows\System\EIXDjhM.exe
  2⤵
  PID:6048
- C:\Windows\System\ojrWOvl.exe
  C:\Windows\System\ojrWOvl.exe
  2⤵
  PID:6076
- C:\Windows\System\feAeFkL.exe
  C:\Windows\System\feAeFkL.exe
  2⤵
  PID:5204
- C:\Windows\System\JgmECXC.exe
  C:\Windows\System\JgmECXC.exe
  2⤵
  PID:5288
- C:\Windows\System\pFUPWaQ.exe
  C:\Windows\System\pFUPWaQ.exe
  2⤵
  PID:6112
- C:\Windows\System\zBQsSBh.exe
  C:\Windows\System\zBQsSBh.exe
  2⤵
  PID:5300
- C:\Windows\System\lMyRTcZ.exe
  C:\Windows\System\lMyRTcZ.exe
  2⤵
  PID:5004
- C:\Windows\System\FcWjvlN.exe
  C:\Windows\System\FcWjvlN.exe
  2⤵
  PID:4524
- C:\Windows\System\AWLZXcX.exe
  C:\Windows\System\AWLZXcX.exe
  2⤵
  PID:5524
- C:\Windows\System\QAvgIkj.exe
  C:\Windows\System\QAvgIkj.exe
  2⤵
  PID:5528
- C:\Windows\System\mrFvLml.exe
  C:\Windows\System\mrFvLml.exe
  2⤵
  PID:3112
- C:\Windows\System\duWLQWX.exe
  C:\Windows\System\duWLQWX.exe
  2⤵
  PID:5716
- C:\Windows\System\kXZtKGp.exe
  C:\Windows\System\kXZtKGp.exe
  2⤵
  PID:5896
- C:\Windows\System\BJWYlvE.exe
  C:\Windows\System\BJWYlvE.exe
  2⤵
  PID:5720
- C:\Windows\System\wSSRlvS.exe
  C:\Windows\System\wSSRlvS.exe
  2⤵
  PID:5932
- C:\Windows\System\vAjXdjn.exe
  C:\Windows\System\vAjXdjn.exe
  2⤵
  PID:5952
- C:\Windows\System\AgDLlKv.exe
  C:\Windows\System\AgDLlKv.exe
  2⤵
  PID:5984
- C:\Windows\System\LzaECOk.exe
  C:\Windows\System\LzaECOk.exe
  2⤵
  PID:6016
- C:\Windows\System\jHLExBt.exe
  C:\Windows\System\jHLExBt.exe
  2⤵
  PID:5748
- C:\Windows\System\TytHSQR.exe
  C:\Windows\System\TytHSQR.exe
  2⤵
  PID:5980
- C:\Windows\System\dSxezTG.exe
  C:\Windows\System\dSxezTG.exe
  2⤵
  PID:5128
- C:\Windows\System\RnEFoDs.exe
  C:\Windows\System\RnEFoDs.exe
  2⤵
  PID:5732
- C:\Windows\System\IZsgETX.exe
  C:\Windows\System\IZsgETX.exe
  2⤵
  PID:5884
- C:\Windows\System\zKlzWSi.exe
  C:\Windows\System\zKlzWSi.exe
  2⤵
  PID:6044
- C:\Windows\System\MrgYcPj.exe
  C:\Windows\System\MrgYcPj.exe
  2⤵
  PID:5140
- C:\Windows\System\yODuYxb.exe
  C:\Windows\System\yODuYxb.exe
  2⤵
  PID:5700
- C:\Windows\System\htQSGNU.exe
  C:\Windows\System\htQSGNU.exe
  2⤵
  PID:6108
- C:\Windows\System\KwOgkny.exe
  C:\Windows\System\KwOgkny.exe
  2⤵
  PID:6128
- C:\Windows\System\tjYyJyV.exe
  C:\Windows\System\tjYyJyV.exe
  2⤵
  PID:5188
- C:\Windows\System\MTEktBg.exe
  C:\Windows\System\MTEktBg.exe
  2⤵
  PID:5428
- C:\Windows\System\agttOLA.exe
  C:\Windows\System\agttOLA.exe
  2⤵
  PID:6000
- C:\Windows\System\XPAtqal.exe
  C:\Windows\System\XPAtqal.exe
  2⤵
  PID:5920
- C:\Windows\System\OQsefzu.exe
  C:\Windows\System\OQsefzu.exe
  2⤵
  PID:5272
- C:\Windows\System\jeYMlBL.exe
  C:\Windows\System\jeYMlBL.exe
  2⤵
  PID:6156
- C:\Windows\System\iRMMmUL.exe
  C:\Windows\System\iRMMmUL.exe
  2⤵
  PID:6172
- C:\Windows\System\ofJOBhZ.exe
  C:\Windows\System\ofJOBhZ.exe
  2⤵
  PID:6188
- C:\Windows\System\Yjxooaw.exe
  C:\Windows\System\Yjxooaw.exe
  2⤵
  PID:6204
- C:\Windows\System\iZDdIXG.exe
  C:\Windows\System\iZDdIXG.exe
  2⤵
  PID:6220
- C:\Windows\System\RVwqPBT.exe
  C:\Windows\System\RVwqPBT.exe
  2⤵
  PID:6236
- C:\Windows\System\zDXxgbj.exe
  C:\Windows\System\zDXxgbj.exe
  2⤵
  PID:6252
- C:\Windows\System\XIhvdfv.exe
  C:\Windows\System\XIhvdfv.exe
  2⤵
  PID:6268
- C:\Windows\System\NZdXMaw.exe
  C:\Windows\System\NZdXMaw.exe
  2⤵
  PID:6284
- C:\Windows\System\tgfYvlq.exe
  C:\Windows\System\tgfYvlq.exe
  2⤵
  PID:6300
- C:\Windows\System\qQsyRlT.exe
  C:\Windows\System\qQsyRlT.exe
  2⤵
  PID:6316
- C:\Windows\System\NNmpfyp.exe
  C:\Windows\System\NNmpfyp.exe
  2⤵
  PID:6332
- C:\Windows\System\jZcYWVo.exe
  C:\Windows\System\jZcYWVo.exe
  2⤵
  PID:6348
- C:\Windows\System\seaDyFQ.exe
  C:\Windows\System\seaDyFQ.exe
  2⤵
  PID:6364
- C:\Windows\System\tXAxtYP.exe
  C:\Windows\System\tXAxtYP.exe
  2⤵
  PID:6380
- C:\Windows\System\eTGDKPO.exe
  C:\Windows\System\eTGDKPO.exe
  2⤵
  PID:6396
- C:\Windows\System\CJFcvnM.exe
  C:\Windows\System\CJFcvnM.exe
  2⤵
  PID:6412
- C:\Windows\System\xZeQOgH.exe
  C:\Windows\System\xZeQOgH.exe
  2⤵
  PID:6428
- C:\Windows\System\BFFzNyE.exe
  C:\Windows\System\BFFzNyE.exe
  2⤵
  PID:6444
- C:\Windows\System\KWUBwZQ.exe
  C:\Windows\System\KWUBwZQ.exe
  2⤵
  PID:6460
- C:\Windows\System\KXJSRdH.exe
  C:\Windows\System\KXJSRdH.exe
  2⤵
  PID:6496
- C:\Windows\System\cwnUVym.exe
  C:\Windows\System\cwnUVym.exe
  2⤵
  PID:6512
- C:\Windows\System\lzfDJPh.exe
  C:\Windows\System\lzfDJPh.exe
  2⤵
  PID:6532
- C:\Windows\System\RwOaMlP.exe
  C:\Windows\System\RwOaMlP.exe
  2⤵
  PID:6548
- C:\Windows\System\CzVCqxj.exe
  C:\Windows\System\CzVCqxj.exe
  2⤵
  PID:6564
- C:\Windows\System\JsuVEuR.exe
  C:\Windows\System\JsuVEuR.exe
  2⤵
  PID:6580
- C:\Windows\System\vljbRYP.exe
  C:\Windows\System\vljbRYP.exe
  2⤵
  PID:6600
- C:\Windows\System\VNMKazf.exe
  C:\Windows\System\VNMKazf.exe
  2⤵
  PID:6616
- C:\Windows\System\oWAJNKp.exe
  C:\Windows\System\oWAJNKp.exe
  2⤵
  PID:6632
- C:\Windows\System\ZgOfvxK.exe
  C:\Windows\System\ZgOfvxK.exe
  2⤵
  PID:6648
- C:\Windows\System\pRteyTW.exe
  C:\Windows\System\pRteyTW.exe
  2⤵
  PID:6664
- C:\Windows\System\hWVHiYb.exe
  C:\Windows\System\hWVHiYb.exe
  2⤵
  PID:6684
- C:\Windows\System\luggWUX.exe
  C:\Windows\System\luggWUX.exe
  2⤵
  PID:6700
- C:\Windows\System\ycFtyBK.exe
  C:\Windows\System\ycFtyBK.exe
  2⤵
  PID:6716
- C:\Windows\System\WTHhwHp.exe
  C:\Windows\System\WTHhwHp.exe
  2⤵
  PID:6732
- C:\Windows\System\taiddEM.exe
  C:\Windows\System\taiddEM.exe
  2⤵
  PID:6748
- C:\Windows\System\wZOZZVK.exe
  C:\Windows\System\wZOZZVK.exe
  2⤵
  PID:6768
- C:\Windows\System\oprVkCt.exe
  C:\Windows\System\oprVkCt.exe
  2⤵
  PID:6784
- C:\Windows\System\PzhPFnb.exe
  C:\Windows\System\PzhPFnb.exe
  2⤵
  PID:6808
- C:\Windows\System\LmXHqZX.exe
  C:\Windows\System\LmXHqZX.exe
  2⤵
  PID:6980
- C:\Windows\System\mfOtIlq.exe
  C:\Windows\System\mfOtIlq.exe
  2⤵
  PID:7000
- C:\Windows\System\xdNbinF.exe
  C:\Windows\System\xdNbinF.exe
  2⤵
  PID:7016
- C:\Windows\System\PXPpflW.exe
  C:\Windows\System\PXPpflW.exe
  2⤵
  PID:7040
- C:\Windows\System\wkJVlZm.exe
  C:\Windows\System\wkJVlZm.exe
  2⤵
  PID:7056
- C:\Windows\System\pItCffV.exe
  C:\Windows\System\pItCffV.exe
  2⤵
  PID:7084
- C:\Windows\System\CwCOfiJ.exe
  C:\Windows\System\CwCOfiJ.exe
  2⤵
  PID:7104
- C:\Windows\System\DAtJqxg.exe
  C:\Windows\System\DAtJqxg.exe
  2⤵
  PID:7120
- C:\Windows\System\uAKdskF.exe
  C:\Windows\System\uAKdskF.exe
  2⤵
  PID:7136
- C:\Windows\System\TXeKTAY.exe
  C:\Windows\System\TXeKTAY.exe
  2⤵
  PID:7152
- C:\Windows\System\NlcuByX.exe
  C:\Windows\System\NlcuByX.exe
  2⤵
  PID:5620
- C:\Windows\System\bCGMmCq.exe
  C:\Windows\System\bCGMmCq.exe
  2⤵
  PID:6312
- C:\Windows\System\TIOtGfw.exe
  C:\Windows\System\TIOtGfw.exe
  2⤵
  PID:6404
- C:\Windows\System\BxBYsOb.exe
  C:\Windows\System\BxBYsOb.exe
  2⤵
  PID:6660
- C:\Windows\System\LECRFDK.exe
  C:\Windows\System\LECRFDK.exe
  2⤵
  PID:6832
- C:\Windows\System\wUEeuXC.exe
  C:\Windows\System\wUEeuXC.exe
  2⤵
  PID:7012
- C:\Windows\System\NCWQGgY.exe
  C:\Windows\System\NCWQGgY.exe
  2⤵
  PID:7064
- C:\Windows\System\qlkTPJS.exe
  C:\Windows\System\qlkTPJS.exe
  2⤵
  PID:6996
- C:\Windows\System\XRSBDar.exe
  C:\Windows\System\XRSBDar.exe
  2⤵
  PID:7096
- C:\Windows\System\dwYVuxU.exe
  C:\Windows\System\dwYVuxU.exe
  2⤵
  PID:6212
- C:\Windows\System\hnccmJI.exe
  C:\Windows\System\hnccmJI.exe
  2⤵
  PID:6276
- C:\Windows\System\ChFXIry.exe
  C:\Windows\System\ChFXIry.exe
  2⤵
  PID:6328
- C:\Windows\System\oQpqqwN.exe
  C:\Windows\System\oQpqqwN.exe
  2⤵
  PID:6200
- C:\Windows\System\TPTDCVs.exe
  C:\Windows\System\TPTDCVs.exe
  2⤵
  PID:6228
- C:\Windows\System\rJRAbey.exe
  C:\Windows\System\rJRAbey.exe
  2⤵
  PID:6472
- C:\Windows\System\fYNMypR.exe
  C:\Windows\System\fYNMypR.exe
  2⤵
  PID:2868
- C:\Windows\System\rdrzesR.exe
  C:\Windows\System\rdrzesR.exe
  2⤵
  PID:6476
- C:\Windows\System\LzXfdrG.exe
  C:\Windows\System\LzXfdrG.exe
  2⤵
  PID:6480
- C:\Windows\System\jtSOhzM.exe
  C:\Windows\System\jtSOhzM.exe
  2⤵
  PID:6492
- C:\Windows\System\bIpkkYd.exe
  C:\Windows\System\bIpkkYd.exe
  2⤵
  PID:6528
- C:\Windows\System\DpUiJqL.exe
  C:\Windows\System\DpUiJqL.exe
  2⤵
  PID:6592
- C:\Windows\System\BdXTkGz.exe
  C:\Windows\System\BdXTkGz.exe
  2⤵
  PID:6576
- C:\Windows\System\jlSsOOK.exe
  C:\Windows\System\jlSsOOK.exe
  2⤵
  PID:6572
- C:\Windows\System\RNiwZES.exe
  C:\Windows\System\RNiwZES.exe
  2⤵
  PID:6540
- C:\Windows\System\EevKbiw.exe
  C:\Windows\System\EevKbiw.exe
  2⤵
  PID:6708
- C:\Windows\System\nshWIoq.exe
  C:\Windows\System\nshWIoq.exe
  2⤵
  PID:6744
- C:\Windows\System\dmfbUXA.exe
  C:\Windows\System\dmfbUXA.exe
  2⤵
  PID:6724
- C:\Windows\System\FKhbzfc.exe
  C:\Windows\System\FKhbzfc.exe
  2⤵
  PID:6816
- C:\Windows\System\cxITGWR.exe
  C:\Windows\System\cxITGWR.exe
  2⤵
  PID:6764
- C:\Windows\System\vUyMtif.exe
  C:\Windows\System\vUyMtif.exe
  2⤵
  PID:6216
- C:\Windows\System\DqoahYB.exe
  C:\Windows\System\DqoahYB.exe
  2⤵
  PID:6964
- C:\Windows\System\hQlYYFM.exe
  C:\Windows\System\hQlYYFM.exe
  2⤵
  PID:6948
- C:\Windows\System\hRdbtUF.exe
  C:\Windows\System\hRdbtUF.exe
  2⤵
  PID:7076
- C:\Windows\System\TSjIbaD.exe
  C:\Windows\System\TSjIbaD.exe
  2⤵
  PID:6988
- C:\Windows\System\zCscGFl.exe
  C:\Windows\System\zCscGFl.exe
  2⤵
  PID:6148
- C:\Windows\System\CpjDaxH.exe
  C:\Windows\System\CpjDaxH.exe
  2⤵
  PID:7164
- C:\Windows\System\WygbCmd.exe
  C:\Windows\System\WygbCmd.exe
  2⤵
  PID:5832
- C:\Windows\System\XtCYSBG.exe
  C:\Windows\System\XtCYSBG.exe
  2⤵
  PID:5492
- C:\Windows\System\zsBCdwe.exe
  C:\Windows\System\zsBCdwe.exe
  2⤵
  PID:5256
- C:\Windows\System\TezKUYB.exe
  C:\Windows\System\TezKUYB.exe
  2⤵
  PID:6344
- C:\Windows\System\zwVqaTF.exe
  C:\Windows\System\zwVqaTF.exe
  2⤵
  PID:2204
- C:\Windows\System\IfotomC.exe
  C:\Windows\System\IfotomC.exe
  2⤵
  PID:6524
- C:\Windows\System\ANYOIvs.exe
  C:\Windows\System\ANYOIvs.exe
  2⤵
  PID:7184
- C:\Windows\System\wFAxaWv.exe
  C:\Windows\System\wFAxaWv.exe
  2⤵
  PID:7200
- C:\Windows\System\IdLUuYe.exe
  C:\Windows\System\IdLUuYe.exe
  2⤵
  PID:7216
- C:\Windows\System\fiqchVS.exe
  C:\Windows\System\fiqchVS.exe
  2⤵
  PID:7232
- C:\Windows\System\cxmNCuj.exe
  C:\Windows\System\cxmNCuj.exe
  2⤵
  PID:7248
- C:\Windows\System\YktBTwC.exe
  C:\Windows\System\YktBTwC.exe
  2⤵
  PID:7264
- C:\Windows\System\sOyFqhw.exe
  C:\Windows\System\sOyFqhw.exe
  2⤵
  PID:7280
- C:\Windows\System\iLfYeAl.exe
  C:\Windows\System\iLfYeAl.exe
  2⤵
  PID:7296
- C:\Windows\System\CSWzZYs.exe
  C:\Windows\System\CSWzZYs.exe
  2⤵
  PID:7312
- C:\Windows\System\dEhLRvn.exe
  C:\Windows\System\dEhLRvn.exe
  2⤵
  PID:7328
- C:\Windows\System\tIPLeeG.exe
  C:\Windows\System\tIPLeeG.exe
  2⤵
  PID:7344
- C:\Windows\System\mieRyLg.exe
  C:\Windows\System\mieRyLg.exe
  2⤵
  PID:7360
- C:\Windows\System\oHGzdul.exe
  C:\Windows\System\oHGzdul.exe
  2⤵
  PID:7376
- C:\Windows\System\HgoOvha.exe
  C:\Windows\System\HgoOvha.exe
  2⤵
  PID:7392
- C:\Windows\System\rmZkzWN.exe
  C:\Windows\System\rmZkzWN.exe
  2⤵
  PID:7408
- C:\Windows\System\rafHHsh.exe
  C:\Windows\System\rafHHsh.exe
  2⤵
  PID:7424
- C:\Windows\System\kxnWvej.exe
  C:\Windows\System\kxnWvej.exe
  2⤵
  PID:8104
- C:\Windows\System\gTxFkEu.exe
  C:\Windows\System\gTxFkEu.exe
  2⤵
  PID:8120
- C:\Windows\System\yIGtBNJ.exe
  C:\Windows\System\yIGtBNJ.exe
  2⤵
  PID:8136
- C:\Windows\System\ObxwCtk.exe
  C:\Windows\System\ObxwCtk.exe
  2⤵
  PID:8152
- C:\Windows\System\KqPBatd.exe
  C:\Windows\System\KqPBatd.exe
  2⤵
  PID:8168
- C:\Windows\System\UdJfFZU.exe
  C:\Windows\System\UdJfFZU.exe
  2⤵
  PID:8184
- C:\Windows\System\MbWZHGw.exe
  C:\Windows\System\MbWZHGw.exe
  2⤵
  PID:6244
- C:\Windows\System\qsFRCow.exe
  C:\Windows\System\qsFRCow.exe
  2⤵
  PID:6680
- C:\Windows\System\yugVfyk.exe
  C:\Windows\System\yugVfyk.exe
  2⤵
  PID:7192
- C:\Windows\System\pvXLtjx.exe
  C:\Windows\System\pvXLtjx.exe
  2⤵
  PID:6264
- C:\Windows\System\ItGJZLj.exe
  C:\Windows\System\ItGJZLj.exe
  2⤵
  PID:7092
- C:\Windows\System\uuYJlnZ.exe
  C:\Windows\System\uuYJlnZ.exe
  2⤵
  PID:6972
- C:\Windows\System\EXzjVBW.exe
  C:\Windows\System\EXzjVBW.exe
  2⤵
  PID:7224
- C:\Windows\System\MxcOflK.exe
  C:\Windows\System\MxcOflK.exe
  2⤵
  PID:6676
- C:\Windows\System\pZOshcE.exe
  C:\Windows\System\pZOshcE.exe
  2⤵
  PID:6436
- C:\Windows\System\ZxZsxzg.exe
  C:\Windows\System\ZxZsxzg.exe
  2⤵
  PID:6456
- C:\Windows\System\AHZfxxr.exe
  C:\Windows\System\AHZfxxr.exe
  2⤵
  PID:6672
- C:\Windows\System\cJXLlbH.exe
  C:\Windows\System\cJXLlbH.exe
  2⤵
  PID:6956
- C:\Windows\System\QKMVSVL.exe
  C:\Windows\System\QKMVSVL.exe
  2⤵
  PID:7132
- C:\Windows\System\rVfdACb.exe
  C:\Windows\System\rVfdACb.exe
  2⤵
  PID:6356
- C:\Windows\System\FvOHLsX.exe
  C:\Windows\System\FvOHLsX.exe
  2⤵
  PID:7208
- C:\Windows\System\VolrWlZ.exe
  C:\Windows\System\VolrWlZ.exe
  2⤵
  PID:7288
- C:\Windows\System\DEDQtiL.exe
  C:\Windows\System\DEDQtiL.exe
  2⤵
  PID:7240
- C:\Windows\System\nMBNpNN.exe
  C:\Windows\System\nMBNpNN.exe
  2⤵
  PID:7244
- C:\Windows\System\tzYYtik.exe
  C:\Windows\System\tzYYtik.exe
  2⤵
  PID:7440
- C:\Windows\System\cXhQdqX.exe
  C:\Windows\System\cXhQdqX.exe
  2⤵
  PID:7456
- C:\Windows\System\PeYuyfp.exe
  C:\Windows\System\PeYuyfp.exe
  2⤵
  PID:7468
- C:\Windows\System\gYwzmOe.exe
  C:\Windows\System\gYwzmOe.exe
  2⤵
  PID:7488
- C:\Windows\System\evXgXgr.exe
  C:\Windows\System\evXgXgr.exe
  2⤵
  PID:7508
- C:\Windows\System\LbtLyGg.exe
  C:\Windows\System\LbtLyGg.exe
  2⤵
  PID:7520
- C:\Windows\System\zCbBRmB.exe
  C:\Windows\System\zCbBRmB.exe
  2⤵
  PID:6692
- C:\Windows\System\yBhNgun.exe
  C:\Windows\System\yBhNgun.exe
  2⤵
  PID:7368
- C:\Windows\System\heNqycH.exe
  C:\Windows\System\heNqycH.exe
  2⤵
  PID:7356
- C:\Windows\System\jfEuqQB.exe
  C:\Windows\System\jfEuqQB.exe
  2⤵
  PID:7416
- C:\Windows\System\tulpDXP.exe
  C:\Windows\System\tulpDXP.exe
  2⤵
  PID:7560
- C:\Windows\System\hgofkVP.exe
  C:\Windows\System\hgofkVP.exe
  2⤵
  PID:7584
- C:\Windows\System\KChXUqt.exe
  C:\Windows\System\KChXUqt.exe
  2⤵
  PID:7608
- C:\Windows\System\ZRzCSqt.exe
  C:\Windows\System\ZRzCSqt.exe
  2⤵
  PID:7644
- C:\Windows\System\aYquGjV.exe
  C:\Windows\System\aYquGjV.exe
  2⤵
  PID:7700
- C:\Windows\System\zkovxOs.exe
  C:\Windows\System\zkovxOs.exe
  2⤵
  PID:7740
- C:\Windows\System\wFMnimF.exe
  C:\Windows\System\wFMnimF.exe
  2⤵
  PID:7788
- C:\Windows\System\yPeZRfX.exe
  C:\Windows\System\yPeZRfX.exe
  2⤵
  PID:7868
- C:\Windows\System\jeAYjSa.exe
  C:\Windows\System\jeAYjSa.exe
  2⤵
  PID:7992
- C:\Windows\System\ZmKdGJz.exe
  C:\Windows\System\ZmKdGJz.exe
  2⤵
  PID:8040
- C:\Windows\System\PWrUmGr.exe
  C:\Windows\System\PWrUmGr.exe
  2⤵
  PID:7612
- C:\Windows\System\CblIpSD.exe
  C:\Windows\System\CblIpSD.exe
  2⤵
  PID:7668
- C:\Windows\System\ZgpHhqE.exe
  C:\Windows\System\ZgpHhqE.exe
  2⤵
  PID:7772
- C:\Windows\System\oHxWjLl.exe
  C:\Windows\System\oHxWjLl.exe
  2⤵
  PID:7928
- C:\Windows\System\IAOjAcA.exe
  C:\Windows\System\IAOjAcA.exe
  2⤵
  PID:7988
- C:\Windows\System\sHkRWpn.exe
  C:\Windows\System\sHkRWpn.exe
  2⤵
  PID:8024
- C:\Windows\System\hjwLkSm.exe
  C:\Windows\System\hjwLkSm.exe
  2⤵
  PID:7616
- C:\Windows\System\JORimAU.exe
  C:\Windows\System\JORimAU.exe
  2⤵
  PID:7744
- C:\Windows\System\mrKSGId.exe
  C:\Windows\System\mrKSGId.exe
  2⤵
  PID:7804
- C:\Windows\System\BfwxkwG.exe
  C:\Windows\System\BfwxkwG.exe
  2⤵
  PID:7820
- C:\Windows\System\rMZybdy.exe
  C:\Windows\System\rMZybdy.exe
  2⤵
  PID:8084
- C:\Windows\System\LhBCJXe.exe
  C:\Windows\System\LhBCJXe.exe
  2⤵
  PID:7852
- C:\Windows\System\alHScGv.exe
  C:\Windows\System\alHScGv.exe
  2⤵
  PID:7888
- C:\Windows\System\OPZJPum.exe
  C:\Windows\System\OPZJPum.exe
  2⤵
  PID:7944
- C:\Windows\System\scmzzHA.exe
  C:\Windows\System\scmzzHA.exe
  2⤵
  PID:7964
- C:\Windows\System\kgPqZkV.exe
  C:\Windows\System\kgPqZkV.exe
  2⤵
  PID:7984
- C:\Windows\System\EmAGQmY.exe
  C:\Windows\System\EmAGQmY.exe
  2⤵
  PID:8044
- C:\Windows\System\tOdxPZT.exe
  C:\Windows\System\tOdxPZT.exe
  2⤵
  PID:8064
- C:\Windows\System\ubWWquE.exe
  C:\Windows\System\ubWWquE.exe
  2⤵
  PID:8128
- C:\Windows\System\VyLTjPO.exe
  C:\Windows\System\VyLTjPO.exe
  2⤵
  PID:8100
- C:\Windows\System\ZNSTOFn.exe
  C:\Windows\System\ZNSTOFn.exe
  2⤵
  PID:6424
- C:\Windows\System\kiGEqbJ.exe
  C:\Windows\System\kiGEqbJ.exe
  2⤵
  PID:6484
- C:\Windows\System\dSQbPLN.exe
  C:\Windows\System\dSQbPLN.exe
  2⤵
  PID:8164
- C:\Windows\System\ClGwzrn.exe
  C:\Windows\System\ClGwzrn.exe
  2⤵
  PID:6824
- C:\Windows\System\QWkkBGS.exe
  C:\Windows\System\QWkkBGS.exe
  2⤵
  PID:7112
- C:\Windows\System\IMzjbWZ.exe
  C:\Windows\System\IMzjbWZ.exe
  2⤵
  PID:7276
- C:\Windows\System\LIRJjnA.exe
  C:\Windows\System\LIRJjnA.exe
  2⤵
  PID:6776
- C:\Windows\System\LHMbzyb.exe
  C:\Windows\System\LHMbzyb.exe
  2⤵
  PID:7452
- C:\Windows\System\MTvdOKE.exe
  C:\Windows\System\MTvdOKE.exe
  2⤵
  PID:7496
- C:\Windows\System\JdHfxVK.exe
  C:\Windows\System\JdHfxVK.exe
  2⤵
  PID:7336
- C:\Windows\System\cMKXSeI.exe
  C:\Windows\System\cMKXSeI.exe
  2⤵
  PID:7388
- C:\Windows\System\cLlxRbo.exe
  C:\Windows\System\cLlxRbo.exe
  2⤵
  PID:7628
- C:\Windows\System\pmDMZxp.exe
  C:\Windows\System\pmDMZxp.exe
  2⤵
  PID:7324
- C:\Windows\System\cjzDylM.exe
  C:\Windows\System\cjzDylM.exe
  2⤵
  PID:7844
- C:\Windows\System\Lxevyrl.exe
  C:\Windows\System\Lxevyrl.exe
  2⤵
  PID:7024
- C:\Windows\System\EgCKssk.exe
  C:\Windows\System\EgCKssk.exe
  2⤵
  PID:7672
- C:\Windows\System\fOTvKrR.exe
  C:\Windows\System\fOTvKrR.exe
  2⤵
  PID:7680
- C:\Windows\System\WKDDEEk.exe
  C:\Windows\System\WKDDEEk.exe
  2⤵
  PID:7528
- C:\Windows\System\GtzYTJi.exe
  C:\Windows\System\GtzYTJi.exe
  2⤵
  PID:7656
- C:\Windows\System\ncwEgIR.exe
  C:\Windows\System\ncwEgIR.exe
  2⤵
  PID:7836
- C:\Windows\System\KzFKvax.exe
  C:\Windows\System\KzFKvax.exe
  2⤵
  PID:7504
- C:\Windows\System\NeoUHZW.exe
  C:\Windows\System\NeoUHZW.exe
  2⤵
  PID:7900
- C:\Windows\System\sQFRJWg.exe
  C:\Windows\System\sQFRJWg.exe
  2⤵
  PID:7404
- C:\Windows\System\qiJvRPo.exe
  C:\Windows\System\qiJvRPo.exe
  2⤵
  PID:7596
- C:\Windows\System\oMnsvCO.exe
  C:\Windows\System\oMnsvCO.exe
  2⤵
  PID:7604
- C:\Windows\System\JeJApCA.exe
  C:\Windows\System\JeJApCA.exe
  2⤵
  PID:7708
- C:\Windows\System\KtGHcnj.exe
  C:\Windows\System\KtGHcnj.exe
  2⤵
  PID:7736
- C:\Windows\System\XSeLCNQ.exe
  C:\Windows\System\XSeLCNQ.exe
  2⤵
  PID:7692
- C:\Windows\System\CHPGQCQ.exe
  C:\Windows\System\CHPGQCQ.exe
  2⤵
  PID:7556
- C:\Windows\System\iysCkIU.exe
  C:\Windows\System\iysCkIU.exe
  2⤵
  PID:7564
- C:\Windows\System\OTBRNra.exe
  C:\Windows\System\OTBRNra.exe
  2⤵
  PID:7756
- C:\Windows\System\HsISAlU.exe
  C:\Windows\System\HsISAlU.exe
  2⤵
  PID:7800
- C:\Windows\System\iyYObUQ.exe
  C:\Windows\System\iyYObUQ.exe
  2⤵
  PID:8096
- C:\Windows\System\tTYdgtw.exe
  C:\Windows\System\tTYdgtw.exe
  2⤵
  PID:8056
- C:\Windows\System\tIJWnLf.exe
  C:\Windows\System\tIJWnLf.exe
  2⤵
  PID:8180
- C:\Windows\System\HVkPwpR.exe
  C:\Windows\System\HVkPwpR.exe
  2⤵
  PID:7228
- C:\Windows\System\jllnzyS.exe
  C:\Windows\System\jllnzyS.exe
  2⤵
  PID:7876
- C:\Windows\System\YTtfgbf.exe
  C:\Windows\System\YTtfgbf.exe
  2⤵
  PID:8160
- C:\Windows\System\PHwuKHt.exe
  C:\Windows\System\PHwuKHt.exe
  2⤵
  PID:8080
- C:\Windows\System\VMIxHVS.exe
  C:\Windows\System\VMIxHVS.exe
  2⤵
  PID:6612
- C:\Windows\System\URaQEFQ.exe
  C:\Windows\System\URaQEFQ.exe
  2⤵
  PID:7576
- C:\Windows\System\DpmPGaW.exe
  C:\Windows\System\DpmPGaW.exe
  2⤵
  PID:5380
- C:\Windows\System\lbIrTdM.exe
  C:\Windows\System\lbIrTdM.exe
  2⤵
  PID:7432
- C:\Windows\System\vsrETOz.exe
  C:\Windows\System\vsrETOz.exe
  2⤵
  PID:8020
- C:\Windows\System\xZFNAAh.exe
  C:\Windows\System\xZFNAAh.exe
  2⤵
  PID:7832
- C:\Windows\System\DmJFjPj.exe
  C:\Windows\System\DmJFjPj.exe
  2⤵
  PID:7908
- C:\Windows\System\XLidDHb.exe
  C:\Windows\System\XLidDHb.exe
  2⤵
  PID:7704
- C:\Windows\System\lAJBmdG.exe
  C:\Windows\System\lAJBmdG.exe
  2⤵
  PID:7780
- C:\Windows\System\znwhDns.exe
  C:\Windows\System\znwhDns.exe
  2⤵
  PID:6976
- C:\Windows\System\YtSqxJP.exe
  C:\Windows\System\YtSqxJP.exe
  2⤵
  PID:7980
- C:\Windows\System\FncALUw.exe
  C:\Windows\System\FncALUw.exe
  2⤵
  PID:7320
- C:\Windows\System\TGpptFV.exe
  C:\Windows\System\TGpptFV.exe
  2⤵
  PID:6644
- C:\Windows\System\VtFiSmL.exe
  C:\Windows\System\VtFiSmL.exe
  2⤵
  PID:7464
- C:\Windows\System\JLPcpUE.exe
  C:\Windows\System\JLPcpUE.exe
  2⤵
  PID:8016
- C:\Windows\System\ydpPzsy.exe
  C:\Windows\System\ydpPzsy.exe
  2⤵
  PID:7848
- C:\Windows\System\DEXbLXY.exe
  C:\Windows\System\DEXbLXY.exe
  2⤵
  PID:6508
- C:\Windows\System\PAVylRR.exe
  C:\Windows\System\PAVylRR.exe
  2⤵
  PID:7540
- C:\Windows\System\UxiPYCN.exe
  C:\Windows\System\UxiPYCN.exe
  2⤵
  PID:7840
- C:\Windows\System\xGgaRTT.exe
  C:\Windows\System\xGgaRTT.exe
  2⤵
  PID:7340
- C:\Windows\System\PKOpPLA.exe
  C:\Windows\System\PKOpPLA.exe
  2⤵
  PID:7720
- C:\Windows\System\NLufHGE.exe
  C:\Windows\System\NLufHGE.exe
  2⤵
  PID:7728
- C:\Windows\System\GvueCse.exe
  C:\Windows\System\GvueCse.exe
  2⤵
  PID:7884
- C:\Windows\System\ZnBsTAi.exe
  C:\Windows\System\ZnBsTAi.exe
  2⤵
  PID:7732
- C:\Windows\System\hodiLNo.exe
  C:\Windows\System\hodiLNo.exe
  2⤵
  PID:7696
- C:\Windows\System\hBFBgFO.exe
  C:\Windows\System\hBFBgFO.exe
  2⤵
  PID:7480
- C:\Windows\System\VkIcjDQ.exe
  C:\Windows\System\VkIcjDQ.exe
  2⤵
  PID:7196
- C:\Windows\System\aFCnalz.exe
  C:\Windows\System\aFCnalz.exe
  2⤵
  PID:7752
- C:\Windows\System\vPIUTDt.exe
  C:\Windows\System\vPIUTDt.exe
  2⤵
  PID:7948
- C:\Windows\System\UzwhsOX.exe
  C:\Windows\System\UzwhsOX.exe
  2⤵
  PID:7784
- C:\Windows\System\qBxhxvI.exe
  C:\Windows\System\qBxhxvI.exe
  2⤵
  PID:8008
- C:\Windows\System\dJtNhGL.exe
  C:\Windows\System\dJtNhGL.exe
  2⤵
  PID:8208
- C:\Windows\System\PYhFLjs.exe
  C:\Windows\System\PYhFLjs.exe
  2⤵
  PID:8224
- C:\Windows\System\LRUhbHy.exe
  C:\Windows\System\LRUhbHy.exe
  2⤵
  PID:8240
- C:\Windows\System\OOTAsZP.exe
  C:\Windows\System\OOTAsZP.exe
  2⤵
  PID:8256
- C:\Windows\System\eQdsvFm.exe
  C:\Windows\System\eQdsvFm.exe
  2⤵
  PID:8272
- C:\Windows\System\CsiGQqR.exe
  C:\Windows\System\CsiGQqR.exe
  2⤵
  PID:8288
- C:\Windows\System\YiyUAhl.exe
  C:\Windows\System\YiyUAhl.exe
  2⤵
  PID:8304
- C:\Windows\System\rHlEaoy.exe
  C:\Windows\System\rHlEaoy.exe
  2⤵
  PID:8320
- C:\Windows\System\ZAsgQoF.exe
  C:\Windows\System\ZAsgQoF.exe
  2⤵
  PID:8336
- C:\Windows\System\FINKPZx.exe
  C:\Windows\System\FINKPZx.exe
  2⤵
  PID:8352
- C:\Windows\System\PRePGbV.exe
  C:\Windows\System\PRePGbV.exe
  2⤵
  PID:8368
- C:\Windows\System\MqPklbf.exe
  C:\Windows\System\MqPklbf.exe
  2⤵
  PID:8384
- C:\Windows\System\aBIlXcz.exe
  C:\Windows\System\aBIlXcz.exe
  2⤵
  PID:8400
- C:\Windows\System\faDfCUK.exe
  C:\Windows\System\faDfCUK.exe
  2⤵
  PID:8416
- C:\Windows\System\gxkXfXg.exe
  C:\Windows\System\gxkXfXg.exe
  2⤵
  PID:8432
- C:\Windows\System\DueAslo.exe
  C:\Windows\System\DueAslo.exe
  2⤵
  PID:8448
- C:\Windows\System\NrvCwzs.exe
  C:\Windows\System\NrvCwzs.exe
  2⤵
  PID:8464
- C:\Windows\System\GDRTGUV.exe
  C:\Windows\System\GDRTGUV.exe
  2⤵
  PID:8480
- C:\Windows\System\PtAMOUz.exe
  C:\Windows\System\PtAMOUz.exe
  2⤵
  PID:8496
- C:\Windows\System\LgLZuzI.exe
  C:\Windows\System\LgLZuzI.exe
  2⤵
  PID:8512
- C:\Windows\System\CeIYOjz.exe
  C:\Windows\System\CeIYOjz.exe
  2⤵
  PID:8528
- C:\Windows\System\GUNIswR.exe
  C:\Windows\System\GUNIswR.exe
  2⤵
  PID:8544
- C:\Windows\System\ZdyPhAW.exe
  C:\Windows\System\ZdyPhAW.exe
  2⤵
  PID:8560
- C:\Windows\System\wTeLmtJ.exe
  C:\Windows\System\wTeLmtJ.exe
  2⤵
  PID:8576
- C:\Windows\System\JnwKzVG.exe
  C:\Windows\System\JnwKzVG.exe
  2⤵
  PID:8592
- C:\Windows\System\WRGSZvL.exe
  C:\Windows\System\WRGSZvL.exe
  2⤵
  PID:8608
- C:\Windows\System\jCFWeZZ.exe
  C:\Windows\System\jCFWeZZ.exe
  2⤵
  PID:8624
- C:\Windows\System\rLkpQxa.exe
  C:\Windows\System\rLkpQxa.exe
  2⤵
  PID:8640
- C:\Windows\System\vcgSgqT.exe
  C:\Windows\System\vcgSgqT.exe
  2⤵
  PID:8656
- C:\Windows\System\NBYsbfX.exe
  C:\Windows\System\NBYsbfX.exe
  2⤵
  PID:8672
- C:\Windows\System\iZNuOXF.exe
  C:\Windows\System\iZNuOXF.exe
  2⤵
  PID:8688
- C:\Windows\System\tTGWyXm.exe
  C:\Windows\System\tTGWyXm.exe
  2⤵
  PID:8704
- C:\Windows\System\zqLXLsw.exe
  C:\Windows\System\zqLXLsw.exe
  2⤵
  PID:8720
- C:\Windows\System\JSjimxx.exe
  C:\Windows\System\JSjimxx.exe
  2⤵
  PID:8736
- C:\Windows\System\BDJtYNi.exe
  C:\Windows\System\BDJtYNi.exe
  2⤵
  PID:8752
- C:\Windows\System\verSxzE.exe
  C:\Windows\System\verSxzE.exe
  2⤵
  PID:8768
- C:\Windows\System\uuyWMYv.exe
  C:\Windows\System\uuyWMYv.exe
  2⤵
  PID:8784
- C:\Windows\System\cYeHriW.exe
  C:\Windows\System\cYeHriW.exe
  2⤵
  PID:8800
- C:\Windows\System\dOmsBKz.exe
  C:\Windows\System\dOmsBKz.exe
  2⤵
  PID:8816
- C:\Windows\System\XGNYVQw.exe
  C:\Windows\System\XGNYVQw.exe
  2⤵
  PID:8832
- C:\Windows\System\BmYbTRo.exe
  C:\Windows\System\BmYbTRo.exe
  2⤵
  PID:8848
- C:\Windows\System\lADLhag.exe
  C:\Windows\System\lADLhag.exe
  2⤵
  PID:8864
- C:\Windows\System\LmwXjLW.exe
  C:\Windows\System\LmwXjLW.exe
  2⤵
  PID:8880
- C:\Windows\System\QPZXZrm.exe
  C:\Windows\System\QPZXZrm.exe
  2⤵
  PID:8896
- C:\Windows\System\qYfpxyP.exe
  C:\Windows\System\qYfpxyP.exe
  2⤵
  PID:8912
- C:\Windows\System\paWxycG.exe
  C:\Windows\System\paWxycG.exe
  2⤵
  PID:8928
- C:\Windows\System\XuHVibP.exe
  C:\Windows\System\XuHVibP.exe
  2⤵
  PID:8944
- C:\Windows\System\ahxFSTq.exe
  C:\Windows\System\ahxFSTq.exe
  2⤵
  PID:8960
- C:\Windows\System\RiflNIK.exe
  C:\Windows\System\RiflNIK.exe
  2⤵
  PID:8976
- C:\Windows\System\NioWVSj.exe
  C:\Windows\System\NioWVSj.exe
  2⤵
  PID:8992
- C:\Windows\System\MrQmUOS.exe
  C:\Windows\System\MrQmUOS.exe
  2⤵
  PID:9008
- C:\Windows\System\JLBubEj.exe
  C:\Windows\System\JLBubEj.exe
  2⤵
  PID:9024
- C:\Windows\System\UBJMzrr.exe
  C:\Windows\System\UBJMzrr.exe
  2⤵
  PID:9040
- C:\Windows\System\iUOUmIH.exe
  C:\Windows\System\iUOUmIH.exe
  2⤵
  PID:9056
- C:\Windows\System\ppyDPtt.exe
  C:\Windows\System\ppyDPtt.exe
  2⤵
  PID:9072
- C:\Windows\System\JchDizp.exe
  C:\Windows\System\JchDizp.exe
  2⤵
  PID:9088
- C:\Windows\System\FrUXOjY.exe
  C:\Windows\System\FrUXOjY.exe
  2⤵
  PID:9104
- C:\Windows\System\fYbLMGQ.exe
  C:\Windows\System\fYbLMGQ.exe
  2⤵
  PID:9120
- C:\Windows\System\OJqUUbA.exe
  C:\Windows\System\OJqUUbA.exe
  2⤵
  PID:9136
- C:\Windows\System\RBQFeOW.exe
  C:\Windows\System\RBQFeOW.exe
  2⤵
  PID:9152
- C:\Windows\System\RqDepCW.exe
  C:\Windows\System\RqDepCW.exe
  2⤵
  PID:9168
- C:\Windows\System\HZzZpAj.exe
  C:\Windows\System\HZzZpAj.exe
  2⤵
  PID:9184
- C:\Windows\System\eOLxTzO.exe
  C:\Windows\System\eOLxTzO.exe
  2⤵
  PID:9200
- C:\Windows\System\acJeHfY.exe
  C:\Windows\System\acJeHfY.exe
  2⤵
  PID:8076
- C:\Windows\System\gyTqOGy.exe
  C:\Windows\System\gyTqOGy.exe
  2⤵
  PID:8248
- C:\Windows\System\UCexXQu.exe
  C:\Windows\System\UCexXQu.exe
  2⤵
  PID:8312
- C:\Windows\System\eFdnrWM.exe
  C:\Windows\System\eFdnrWM.exe
  2⤵
  PID:6280
- C:\Windows\System\SjdRcvu.exe
  C:\Windows\System\SjdRcvu.exe
  2⤵
  PID:8376
- C:\Windows\System\qOzgoQO.exe
  C:\Windows\System\qOzgoQO.exe
  2⤵
  PID:6292
- C:\Windows\System\oMmfpaR.exe
  C:\Windows\System\oMmfpaR.exe
  2⤵
  PID:8296
- C:\Windows\System\ZfMbHED.exe
  C:\Windows\System\ZfMbHED.exe
  2⤵
  PID:8236
- C:\Windows\System\nAufWvK.exe
  C:\Windows\System\nAufWvK.exe
  2⤵
  PID:8300
- C:\Windows\System\zvfQpXQ.exe
  C:\Windows\System\zvfQpXQ.exe
  2⤵
  PID:8360
- C:\Windows\System\XWktryA.exe
  C:\Windows\System\XWktryA.exe
  2⤵
  PID:8440
- C:\Windows\System\XPyTzkp.exe
  C:\Windows\System\XPyTzkp.exe
  2⤵
  PID:1560
- C:\Windows\System\WJBmoki.exe
  C:\Windows\System\WJBmoki.exe
  2⤵
  PID:8492
- C:\Windows\System\gMNkMIg.exe
  C:\Windows\System\gMNkMIg.exe
  2⤵
  PID:8556
- C:\Windows\System\IEmXmNu.exe
  C:\Windows\System\IEmXmNu.exe
  2⤵
  PID:8540
- C:\Windows\System\VwefXwk.exe
  C:\Windows\System\VwefXwk.exe
  2⤵
  PID:8600
- C:\Windows\System\oXznBov.exe
  C:\Windows\System\oXznBov.exe
  2⤵
  PID:8664
- C:\Windows\System\GxDENWL.exe
  C:\Windows\System\GxDENWL.exe
  2⤵
  PID:8700
- C:\Windows\System\hxnlOln.exe
  C:\Windows\System\hxnlOln.exe
  2⤵
  PID:8616
- C:\Windows\System\miegEwg.exe
  C:\Windows\System\miegEwg.exe
  2⤵
  PID:8828
- C:\Windows\System\sSqDqmg.exe
  C:\Windows\System\sSqDqmg.exe
  2⤵
  PID:8888
- C:\Windows\System\AwcPUTs.exe
  C:\Windows\System\AwcPUTs.exe
  2⤵
  PID:8952
- C:\Windows\System\RFZJsKS.exe
  C:\Windows\System\RFZJsKS.exe
  2⤵
  PID:8984
- C:\Windows\System\GkECXtC.exe
  C:\Windows\System\GkECXtC.exe
  2⤵
  PID:8648
- C:\Windows\System\cynWkab.exe
  C:\Windows\System\cynWkab.exe
  2⤵
  PID:9080
- C:\Windows\System\wPgfYKQ.exe
  C:\Windows\System\wPgfYKQ.exe
  2⤵
  PID:8680
- C:\Windows\System\cckNZkH.exe
  C:\Windows\System\cckNZkH.exe
  2⤵
  PID:9144
- C:\Windows\System\PxyXLXU.exe
  C:\Windows\System\PxyXLXU.exe
  2⤵
  PID:8812
- C:\Windows\System\NrSOJeH.exe
  C:\Windows\System\NrSOJeH.exe
  2⤵
  PID:8908
- C:\Windows\System\bmLcJxt.exe
  C:\Windows\System\bmLcJxt.exe
  2⤵
  PID:9096
- C:\Windows\System\gIeVIPQ.exe
  C:\Windows\System\gIeVIPQ.exe
  2⤵
  PID:9128
- C:\Windows\System\YqIcVXU.exe
  C:\Windows\System\YqIcVXU.exe
  2⤵
  PID:8776
- C:\Windows\System\YYeUUfq.exe
  C:\Windows\System\YYeUUfq.exe
  2⤵
  PID:8904
- C:\Windows\System\MRHoKfm.exe
  C:\Windows\System\MRHoKfm.exe
  2⤵
  PID:9212
- C:\Windows\System\jtiJIXp.exe
  C:\Windows\System\jtiJIXp.exe
  2⤵
  PID:8344
- C:\Windows\System\OuxLzPw.exe
  C:\Windows\System\OuxLzPw.exe
  2⤵
  PID:8268
- C:\Windows\System\sLJKfld.exe
  C:\Windows\System\sLJKfld.exe
  2⤵
  PID:8428
- C:\Windows\System\Zbseluv.exe
  C:\Windows\System\Zbseluv.exe
  2⤵
  PID:9068
- C:\Windows\System\LYCSVOQ.exe
  C:\Windows\System\LYCSVOQ.exe
  2⤵
  PID:8632
- C:\Windows\System\ohBeOLX.exe
  C:\Windows\System\ohBeOLX.exe
  2⤵
  PID:8760
- C:\Windows\System\oQYPbpf.exe
  C:\Windows\System\oQYPbpf.exe
  2⤵
  PID:7960
- C:\Windows\System\PNkjFME.exe
  C:\Windows\System\PNkjFME.exe
  2⤵
  PID:8316
- C:\Windows\System\nchfEOT.exe
  C:\Windows\System\nchfEOT.exe
  2⤵
  PID:8412
- C:\Windows\System\nARuyRg.exe
  C:\Windows\System\nARuyRg.exe
  2⤵
  PID:9052
- C:\Windows\System\FVxdnKh.exe
  C:\Windows\System\FVxdnKh.exe
  2⤵
  PID:8572
- C:\Windows\System\hzxEIvP.exe
  C:\Windows\System\hzxEIvP.exe
  2⤵
  PID:8796
- C:\Windows\System\rGYBaAK.exe
  C:\Windows\System\rGYBaAK.exe
  2⤵
  PID:8584
- C:\Windows\System\rkNSekE.exe
  C:\Windows\System\rkNSekE.exe
  2⤵
  PID:8744
- C:\Windows\System\dRGhTuy.exe
  C:\Windows\System\dRGhTuy.exe
  2⤵
  PID:8872
- C:\Windows\System\kGtAtNI.exe
  C:\Windows\System\kGtAtNI.exe
  2⤵
  PID:8748
- C:\Windows\System\kAdcIdI.exe
  C:\Windows\System\kAdcIdI.exe
  2⤵
  PID:9160
- C:\Windows\System\VWETBMq.exe
  C:\Windows\System\VWETBMq.exe
  2⤵
  PID:9192
- C:\Windows\System\vpAWYUA.exe
  C:\Windows\System\vpAWYUA.exe
  2⤵
  PID:8536
- C:\Windows\System\WmedRiE.exe
  C:\Windows\System\WmedRiE.exe
  2⤵
  PID:8204
- C:\Windows\System\tNnwXOh.exe
  C:\Windows\System\tNnwXOh.exe
  2⤵
  PID:8568
- C:\Windows\System\XdiWmgj.exe
  C:\Windows\System\XdiWmgj.exe
  2⤵
  PID:8844
- C:\Windows\System\iEAtiii.exe
  C:\Windows\System\iEAtiii.exe
  2⤵
  PID:9032
- C:\Windows\System\gDJOYcU.exe
  C:\Windows\System\gDJOYcU.exe
  2⤵
  PID:8220
- C:\Windows\System\EBMjUoA.exe
  C:\Windows\System\EBMjUoA.exe
  2⤵
  PID:8472
- C:\Windows\System\rwcLGeJ.exe
  C:\Windows\System\rwcLGeJ.exe
  2⤵
  PID:8200
- C:\Windows\System\xLMyrNX.exe
  C:\Windows\System\xLMyrNX.exe
  2⤵
  PID:8216
- C:\Windows\System\eAfPgHj.exe
  C:\Windows\System\eAfPgHj.exe
  2⤵
  PID:8924
- C:\Windows\System\rmwDZSn.exe
  C:\Windows\System\rmwDZSn.exe
  2⤵
  PID:8972
- C:\Windows\System\jWmcqSm.exe
  C:\Windows\System\jWmcqSm.exe
  2⤵
  PID:9004
- C:\Windows\System\QQdVBzV.exe
  C:\Windows\System\QQdVBzV.exe
  2⤵
  PID:8876
- C:\Windows\System\POyUUMP.exe
  C:\Windows\System\POyUUMP.exe
  2⤵
  PID:9228
- C:\Windows\System\vTeTEdM.exe
  C:\Windows\System\vTeTEdM.exe
  2⤵
  PID:9244
- C:\Windows\System\xGXtQvV.exe
  C:\Windows\System\xGXtQvV.exe
  2⤵
  PID:9260
- C:\Windows\System\HAMHOiZ.exe
  C:\Windows\System\HAMHOiZ.exe
  2⤵
  PID:9276
- C:\Windows\System\ACYuteS.exe
  C:\Windows\System\ACYuteS.exe
  2⤵
  PID:9292
- C:\Windows\System\ugWNAbF.exe
  C:\Windows\System\ugWNAbF.exe
  2⤵
  PID:9308
- C:\Windows\System\lnisvLB.exe
  C:\Windows\System\lnisvLB.exe
  2⤵
  PID:9324
- C:\Windows\System\muqYuWL.exe
  C:\Windows\System\muqYuWL.exe
  2⤵
  PID:9340
- C:\Windows\System\JtDKEIe.exe
  C:\Windows\System\JtDKEIe.exe
  2⤵
  PID:9356
- C:\Windows\System\oyZDOSj.exe
  C:\Windows\System\oyZDOSj.exe
  2⤵
  PID:9372
- C:\Windows\System\qJcdTnA.exe
  C:\Windows\System\qJcdTnA.exe
  2⤵
  PID:9388
- C:\Windows\System\ARTkiWP.exe
  C:\Windows\System\ARTkiWP.exe
  2⤵
  PID:9408
- C:\Windows\System\ZoxzJnr.exe
  C:\Windows\System\ZoxzJnr.exe
  2⤵
  PID:9424
- C:\Windows\System\cdbcdIl.exe
  C:\Windows\System\cdbcdIl.exe
  2⤵
  PID:9440
- C:\Windows\System\Atbhflh.exe
  C:\Windows\System\Atbhflh.exe
  2⤵
  PID:9456
- C:\Windows\System\npwcLHL.exe
  C:\Windows\System\npwcLHL.exe
  2⤵
  PID:9472
- C:\Windows\System\ToUbUaK.exe
  C:\Windows\System\ToUbUaK.exe
  2⤵
  PID:9488
- C:\Windows\System\WstffJK.exe
  C:\Windows\System\WstffJK.exe
  2⤵
  PID:9504
- C:\Windows\System\xSkNQVo.exe
  C:\Windows\System\xSkNQVo.exe
  2⤵
  PID:9520
- C:\Windows\System\akixcza.exe
  C:\Windows\System\akixcza.exe
  2⤵
  PID:9536
- C:\Windows\System\VEYFWOS.exe
  C:\Windows\System\VEYFWOS.exe
  2⤵
  PID:9552
- C:\Windows\System\EWbrHdt.exe
  C:\Windows\System\EWbrHdt.exe
  2⤵
  PID:9568
- C:\Windows\System\NNJAMqz.exe
  C:\Windows\System\NNJAMqz.exe
  2⤵
  PID:9584
- C:\Windows\System\SSrUOeu.exe
  C:\Windows\System\SSrUOeu.exe
  2⤵
  PID:9600
- C:\Windows\System\YyiUKTm.exe
  C:\Windows\System\YyiUKTm.exe
  2⤵
  PID:9616
- C:\Windows\System\HEoWtVI.exe
  C:\Windows\System\HEoWtVI.exe
  2⤵
  PID:9632
- C:\Windows\System\kcNkmTX.exe
  C:\Windows\System\kcNkmTX.exe
  2⤵
  PID:9648
- C:\Windows\System\oWFoVUA.exe
  C:\Windows\System\oWFoVUA.exe
  2⤵
  PID:9664
- C:\Windows\System\VNctpYw.exe
  C:\Windows\System\VNctpYw.exe
  2⤵
  PID:9680
- C:\Windows\System\CDhXDxQ.exe
  C:\Windows\System\CDhXDxQ.exe
  2⤵
  PID:9704
- C:\Windows\System\PqGUQyp.exe
  C:\Windows\System\PqGUQyp.exe
  2⤵
  PID:9720
- C:\Windows\System\JfyZCLo.exe
  C:\Windows\System\JfyZCLo.exe
  2⤵
  PID:9736
- C:\Windows\System\evkOsEf.exe
  C:\Windows\System\evkOsEf.exe
  2⤵
  PID:9752
- C:\Windows\System\IGPbvmP.exe
  C:\Windows\System\IGPbvmP.exe
  2⤵
  PID:9768
- C:\Windows\System\jAOlPPA.exe
  C:\Windows\System\jAOlPPA.exe
  2⤵
  PID:9784
- C:\Windows\System\ErlSCeR.exe
  C:\Windows\System\ErlSCeR.exe
  2⤵
  PID:9800
- C:\Windows\System\Sxwmuck.exe
  C:\Windows\System\Sxwmuck.exe
  2⤵
  PID:9816
- C:\Windows\System\VMiKZVF.exe
  C:\Windows\System\VMiKZVF.exe
  2⤵
  PID:9832
- C:\Windows\System\YRcbEko.exe
  C:\Windows\System\YRcbEko.exe
  2⤵
  PID:9848
- C:\Windows\System\IDObBdS.exe
  C:\Windows\System\IDObBdS.exe
  2⤵
  PID:9864
- C:\Windows\System\qLgadpU.exe
  C:\Windows\System\qLgadpU.exe
  2⤵
  PID:9880
- C:\Windows\System\TvbiYev.exe
  C:\Windows\System\TvbiYev.exe
  2⤵
  PID:9896
- C:\Windows\System\CKbOuRM.exe
  C:\Windows\System\CKbOuRM.exe
  2⤵
  PID:9912
- C:\Windows\System\NKbokMG.exe
  C:\Windows\System\NKbokMG.exe
  2⤵
  PID:9928
- C:\Windows\System\fQrxTUw.exe
  C:\Windows\System\fQrxTUw.exe
  2⤵
  PID:9944
- C:\Windows\System\qlrqTOs.exe
  C:\Windows\System\qlrqTOs.exe
  2⤵
  PID:9960
- C:\Windows\System\JfBGqIh.exe
  C:\Windows\System\JfBGqIh.exe
  2⤵
  PID:9976
- C:\Windows\System\vLejQVC.exe
  C:\Windows\System\vLejQVC.exe
  2⤵
  PID:9992
- C:\Windows\System\HOADXYq.exe
  C:\Windows\System\HOADXYq.exe
  2⤵
  PID:10008
- C:\Windows\System\DlURjTB.exe
  C:\Windows\System\DlURjTB.exe
  2⤵
  PID:10024
- C:\Windows\System\GMeYgEB.exe
  C:\Windows\System\GMeYgEB.exe
  2⤵
  PID:10040
- C:\Windows\System\ZqVvvCD.exe
  C:\Windows\System\ZqVvvCD.exe
  2⤵
  PID:10056
- C:\Windows\System\pZtcXZX.exe
  C:\Windows\System\pZtcXZX.exe
  2⤵
  PID:10072
- C:\Windows\System\ZOBgbmu.exe
  C:\Windows\System\ZOBgbmu.exe
  2⤵
  PID:10088
- C:\Windows\System\PXNPSDe.exe
  C:\Windows\System\PXNPSDe.exe
  2⤵
  PID:10104
- C:\Windows\System\ZVRXWof.exe
  C:\Windows\System\ZVRXWof.exe
  2⤵
  PID:10120
- C:\Windows\System\LWTeDPv.exe
  C:\Windows\System\LWTeDPv.exe
  2⤵
  PID:10136
- C:\Windows\System\aYMCBJV.exe
  C:\Windows\System\aYMCBJV.exe
  2⤵
  PID:10152
- C:\Windows\System\kCkDKnK.exe
  C:\Windows\System\kCkDKnK.exe
  2⤵
  PID:10168
- C:\Windows\System\qoiQqPP.exe
  C:\Windows\System\qoiQqPP.exe
  2⤵
  PID:10184
- C:\Windows\System\ZcyAWMY.exe
  C:\Windows\System\ZcyAWMY.exe
  2⤵
  PID:10200
- C:\Windows\System\IndlnTX.exe
  C:\Windows\System\IndlnTX.exe
  2⤵
  PID:10216
- C:\Windows\System\tEXCCmA.exe
  C:\Windows\System\tEXCCmA.exe
  2⤵
  PID:10232
- C:\Windows\System\gaIvQfj.exe
  C:\Windows\System\gaIvQfj.exe
  2⤵
  PID:8732
- C:\Windows\System\nqpapsY.exe
  C:\Windows\System\nqpapsY.exe
  2⤵
  PID:8968
- C:\Windows\System\FctxJdg.exe
  C:\Windows\System\FctxJdg.exe
  2⤵
  PID:8392
- C:\Windows\System\gWTvMWp.exe
  C:\Windows\System\gWTvMWp.exe
  2⤵
  PID:9336
- C:\Windows\System\scwuzXq.exe
  C:\Windows\System\scwuzXq.exe
  2⤵
  PID:9224
- C:\Windows\System\MbgjqUk.exe
  C:\Windows\System\MbgjqUk.exe
  2⤵
  PID:9432
- C:\Windows\System\YEHvpnY.exe
  C:\Windows\System\YEHvpnY.exe
  2⤵
  PID:9496
- C:\Windows\System\egiYKuN.exe
  C:\Windows\System\egiYKuN.exe
  2⤵
  PID:9560
- C:\Windows\System\CTmsust.exe
  C:\Windows\System\CTmsust.exe
  2⤵
  PID:9348
- C:\Windows\System\IvgcGOz.exe
  C:\Windows\System\IvgcGOz.exe
  2⤵
  PID:9352
- C:\Windows\System\jLWLmig.exe
  C:\Windows\System\jLWLmig.exe
  2⤵
  PID:9416
- C:\Windows\System\WrCPIvL.exe
  C:\Windows\System\WrCPIvL.exe
  2⤵
  PID:9484
- C:\Windows\System\bwrDFGw.exe
  C:\Windows\System\bwrDFGw.exe
  2⤵
  PID:9576
- C:\Windows\System\oxkjGle.exe
  C:\Windows\System\oxkjGle.exe
  2⤵
  PID:9608
- C:\Windows\System\UqsFpdP.exe
  C:\Windows\System\UqsFpdP.exe
  2⤵
  PID:9628
- C:\Windows\System\lnTGXtw.exe
  C:\Windows\System\lnTGXtw.exe
  2⤵
  PID:9640
- C:\Windows\System\zerHwlk.exe
  C:\Windows\System\zerHwlk.exe
  2⤵
  PID:8764
- C:\Windows\System\sRWXZEf.exe
  C:\Windows\System\sRWXZEf.exe
  2⤵
  PID:9764
- C:\Windows\System\piSjEJS.exe
  C:\Windows\System\piSjEJS.exe
  2⤵
  PID:9828
- C:\Windows\System\smsXzEH.exe
  C:\Windows\System\smsXzEH.exe
  2⤵
  PID:9892
- C:\Windows\System\gNoQwps.exe
  C:\Windows\System\gNoQwps.exe
  2⤵
  PID:9904
- C:\Windows\System\DunVIBJ.exe
  C:\Windows\System\DunVIBJ.exe
  2⤵
  PID:9924
- C:\Windows\System\DbtWTpX.exe
  C:\Windows\System\DbtWTpX.exe
  2⤵
  PID:9984
- C:\Windows\System\CXhoint.exe
  C:\Windows\System\CXhoint.exe
  2⤵
  PID:9840
- C:\Windows\System\boORIvO.exe
  C:\Windows\System\boORIvO.exe
  2⤵
  PID:10020
- C:\Windows\System\HhwTjPz.exe
  C:\Windows\System\HhwTjPz.exe
  2⤵
  PID:10084
- C:\Windows\System\phDiSKS.exe
  C:\Windows\System\phDiSKS.exe
  2⤵
  PID:10116
- C:\Windows\System\FbdCztR.exe
  C:\Windows\System\FbdCztR.exe
  2⤵
  PID:10000
- C:\Windows\System\iNFyftE.exe
  C:\Windows\System\iNFyftE.exe
  2⤵
  PID:10148
- C:\Windows\System\hGZoeHY.exe
  C:\Windows\System\hGZoeHY.exe
  2⤵
  PID:10068
- C:\Windows\System\lKFVogz.exe
  C:\Windows\System\lKFVogz.exe
  2⤵
  PID:10208
- C:\Windows\System\NmyOgGL.exe
  C:\Windows\System\NmyOgGL.exe
  2⤵
  PID:9936
- C:\Windows\System\cYcUtOu.exe
  C:\Windows\System\cYcUtOu.exe
  2⤵
  PID:10192
- C:\Windows\System\fZupQrj.exe
  C:\Windows\System\fZupQrj.exe
  2⤵
  PID:10224
- C:\Windows\System\ylMEyQV.exe
  C:\Windows\System\ylMEyQV.exe
  2⤵
  PID:9368
- C:\Windows\System\AaYciAI.exe
  C:\Windows\System\AaYciAI.exe
  2⤵
  PID:9220
- C:\Windows\System\VzBDkTR.exe
  C:\Windows\System\VzBDkTR.exe
  2⤵
  PID:9452
- C:\Windows\System\ZhQIwmK.exe
  C:\Windows\System\ZhQIwmK.exe
  2⤵
  PID:9644
- C:\Windows\System\fMYDbpZ.exe
  C:\Windows\System\fMYDbpZ.exe
  2⤵
  PID:9860
- C:\Windows\System\LDKmacO.exe
  C:\Windows\System\LDKmacO.exe
  2⤵
  PID:9812
- C:\Windows\System\xljLTVe.exe
  C:\Windows\System\xljLTVe.exe
  2⤵
  PID:9544
- C:\Windows\System\gxOfrIf.exe
  C:\Windows\System\gxOfrIf.exe
  2⤵
  PID:9396
- C:\Windows\System\xfDwIOx.exe
  C:\Windows\System\xfDwIOx.exe
  2⤵
  PID:9320
- C:\Windows\System\yTKCJeY.exe
  C:\Windows\System\yTKCJeY.exe
  2⤵
  PID:9744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BCbFfPD.exe

Filesize
1.3MB

MD5
cc81525a7e2ed1998c2b3c252bba2a10

SHA1
b754aa043adf7f487cbf98763884c9f4505b69f3

SHA256
a7cfa0e13bfe41a8379ef0dea8c9d619206dcfae3caed081c65991428ec54f76

SHA512
3d92c4a28de460fe3ec615ceaa2dbecf524941e9bd76c70647b509b658f1a25125223c94d131dea34c8299c321c33d085efe37e3ea0a029f207e931fc7117e09

Download Submit
C:\Windows\system\FGQxpTI.exe

Filesize
1.3MB

MD5
fcac04c02e58f4dbd84058cba3f96d21

SHA1
38f108f8a3f81935647e1313fe94f4f6e027acd2

SHA256
d9d866152454d74b633b3c25d30bb04862f2ab2f32275bb6eac76d404c21acbe

SHA512
07ad941a5d4e9c30e7ba4ec6fe4a2a15ecda9c72a38856a4263fdb38918facadfdaab96948aecf3dda8984815ec546b64aa0951f7f915441e5999eeab35c5ada

Download Submit
C:\Windows\system\JtMoiKp.exe

Filesize
1.3MB

MD5
b7cde61eb04f53c27f5fc459b66f87b3

SHA1
93e1783ceaeaf831e06c0f6880e75e50bdd98161

SHA256
f2f9a1e1205b15036547f5c715f7c318b85046304f9095baaaca9d174bb04e15

SHA512
949d6074ee58c5f5eb064a059ffe533f342d4a391a147a7f80ea4ceb05e9b1342a8d9291342d107453d2ec381898ab15db88528d4f276358f46275c31cbc986b

Download Submit
C:\Windows\system\LIPtlvw.exe

Filesize
1.3MB

MD5
7cc8b938a6567cf0cfade35b5a132cfd

SHA1
0c65c8e0144473ff86b0c1495e730308dfe598ad

SHA256
3b378436eda9a75c19b2babf6e0ade72c026757996eaf341c07d275191570f3d

SHA512
afc989acca75e4fd88b7565278561f0319c7c4d1a5a024eeb40066402569d798f3b1471d94a125e601d8dd369f1b4e24d28b3c715a7e6481b25e3a464bcb5d22

Download Submit
C:\Windows\system\QQtVlOs.exe

Filesize
1.3MB

MD5
d2bcfeca41722246f7c7cc70a76e32a7

SHA1
33670135f3569df183a5ae7aa305379263754087

SHA256
da0cd07f9cf0599dac496a5faf7e9c0df9ac22862662625cf503d2d4392726b2

SHA512
43b34388d075270bdebff4487328a653544197da39e501910a5cbdee55e1b96b5838e136ade24f90b98a3999339810b9c650453b009a1054bf8ad987f8a2b613

Download Submit
C:\Windows\system\YUbSTcP.exe

Filesize
1.3MB

MD5
f0cffce41924e64ce5e7aea2e6ec89e8

SHA1
f11e12739974e3da5403698f063c5897fdc3c7d2

SHA256
6de7d4c232096c36a80b660b99335965d23bb95e68846ef24e535d1346f2f9a6

SHA512
c8ed9c6601f6ae33b37ecfe6a2da5af279827a2d4717eac4efe00d1d2596ae686e96c9a7bd810793a3fd95d1d7fd0128e7b31072611ccbe28f812c19ebf528e8

Download Submit
C:\Windows\system\bQRKGKW.exe

Filesize
1.3MB

MD5
e9868efc568b3f6cb0e2557fee834f33

SHA1
dd954426da057ac1bfee45e6972498f754c84004

SHA256
15cb6a1648071fc4abb722eacc6d5187f030504ce94a8532f3a64af06d904b2f

SHA512
ee879b59a9cab8a08988471185d3b835f289bbe68dd28ab2c84e6c381835c216c9cd16e35d32d23628e583d0259fbef982c015e8448148a0bf42730c78afcba3

Download Submit
C:\Windows\system\bpMXpTr.exe

Filesize
1.3MB

MD5
218a8c136ba31cd739bac0d3656c07de

SHA1
582631ff45bbe0b73ce89cdf43ddcdba45c88cff

SHA256
c88da3f402e3e67e3634e145d41b7703e365bd28126b1996e0bbcadd6b68f311

SHA512
b4b3a51b881b44f7d9100b302540cdd782135c3f75b6f13e8b779b9fe81226547ef9479324df047f65fe48864cc7404e08cbda3b4d49d977f9031678f18cb6de

Download Submit
C:\Windows\system\cUyQyrn.exe

Filesize
1.3MB

MD5
6ddabc95b9517463c61049783a2fcb7d

SHA1
0135210b3fa38e74c6258ca44a96e7625ff3447b

SHA256
7acf04ab5038e21e6fea5a02cae56162cd72f6f218afb2fc8b9931447c53c550

SHA512
c62cc664691150b72a87d9e54c5d6bcb2906a8910a5e4974978641fe430d8a7a57c877aad894e1011746fd6d0110a3bacc2a37db160d54d718c4371b695e0baa

Download Submit
C:\Windows\system\dJWGnBp.exe

Filesize
1.3MB

MD5
e9e89e99ff1cc0c06cd9446a1bed0768

SHA1
7d7810bced469c514ffcc0679c43243982a66ab5

SHA256
56f5c388ef3a7c1e8a0ed28faa110b786c1ef9e6cf2ed48194fb991f0beef490

SHA512
0367fe362167fe1857abc542f567f5c77ee5eb0b5696ab89a2eedc8a7d47335d01dc5a424e45d07ec41a48474b9995abff0d01aca9366a12905b1722132aed04

Download Submit
C:\Windows\system\eNAoHvv.exe

Filesize
1.3MB

MD5
778dad4748f4da00e135b20a5c02d2ad

SHA1
35a57e9efbbbe72ac77fa0b07e4287a12113ae47

SHA256
78134395c50bb01bd03f48f6217d9b9375dc3f8a47ec8cec08c5b509632b0ac3

SHA512
55202a142b250ba86e0580c7f700d2b4fa4992d2897e10f43e6bc7f57e2679f46bbcf04740cf6fc397ab233b91556f9d2e8428417d8e6d2fde3570f06653c9a8

Download Submit
C:\Windows\system\hClQgtk.exe

Filesize
1.3MB

MD5
54405bc44874ef2cd96d280deb8a0feb

SHA1
219f30c26016c456ba55d69d54adbe3f19ab93d3

SHA256
f46a0958a3341f539b168283019b47693f133cdb78279503ac6188c598fc996f

SHA512
1821c7dbae3c38779cb16e51275550c07d8295c049a702e8f0f975bdc110d3aaeb13e45cfe954b9b045db6bd3338e9dd1bfc043761142042e54787195275d884

Download Submit
C:\Windows\system\hSnAKAc.exe

Filesize
1.3MB

MD5
c952551e9bbdbaf55154070ac37ed535

SHA1
b0d907195a37930a9e767befe8f5744478c8760c

SHA256
9d2a263ee4bdadfeaf9fb7baacde015f4ef90de17fc977a1499a614581947bcc

SHA512
bc9072779f8874393bab1b3ab0ce0593d95ef7887a9c34001d4aa0375c09601cc5256db7510c524866ca9ecb56af3dd8afd1b5e92b1a031f42f42e255af9b90a

Download Submit
C:\Windows\system\hlMAkOO.exe

Filesize
1.3MB

MD5
9f0c85ab3c37396fb5ec0afbe47ffd48

SHA1
bd1b1d4de8ee7ea65edd2781c6c47a1ee7223a95

SHA256
f75a092ddeb69372ada74364518413401eb85b1354b381bbbe8a8427e3978fdd

SHA512
f7b8152977044b1d5a8df5fbf5403af3149ae18dbac0004450d1bbfcb60aac426c643a068fa16dbd0ca1bc5c9cff3e9f458dc226aceb4e6c9406400a9d43e260

Download Submit
C:\Windows\system\nuUiosB.exe

Filesize
1.3MB

MD5
e9eb1748c2dbc335baa001439247fca6

SHA1
f64680daf26bb3bb40b4c995e6a00d415bf555d7

SHA256
0bd9e4c60c8f646d5e29b9fc59bed56466066e7cc6fad6623c51d77268cdd024

SHA512
43c573354110602ac6a7381f59435ad7bb255d97d4a307656df31a976609fa058f620e6ed42a389d1509dfc23bd2920e8e7eef14315f16ddadf3b2284af03613

Download Submit
C:\Windows\system\sLLuiAL.exe

Filesize
1.3MB

MD5
f049cfee50add65ac43daf10ba216580

SHA1
2048158b62da3478cb7055bad04f6568aa324f26

SHA256
68687e023838ee7e9f2c4ae6625815a2b30c980660820978da96b16975b85541

SHA512
d725f8f7f9f57ba010f1a7ca25d6b0df4b2214f5e4d164a8244aaaa6f72c8c34b25f43a210f224762209300cc1143ea901d641296d1eea969282d738e6576139

Download Submit
C:\Windows\system\vOxEPSk.exe

Filesize
1.3MB

MD5
62dd707f43b1e32e441db76697a31db4

SHA1
01e8772fc80d4ae78539d3819888c8d0de700873

SHA256
2b4e9263fa579cbb08eb1bd5af696e9bfa5b51719bcf4a15db6f0b0b02b737b7

SHA512
b53028782c7ee4b18bd01e924160427c546b0b64f2edd9f1e479a83ddfaefff7173ae9b364e4fc362f55cc676cf0da1f994aa1cb945336d3a4418dc37aaddad5

Download Submit
C:\Windows\system\xsnlnnh.exe

Filesize
1.3MB

MD5
81efc9b73a0e4f9e26ef167111b92043

SHA1
3fff30915233e69c7e6deedad7b6f4d32ad0e56d

SHA256
9b0ce4fa1b5b70051d803d4e78eebdc9eed1fb358f2ba21d88b872d2032c9be0

SHA512
ea865253af79ad8d48b3a7c35207e54612e5d9893837008974508fb7505e776db674307312ddf81bc1f685d7e1eb924ba0c2aff2cb0822f85664c27fb8f7bebc

Download Submit
C:\Windows\system\yTBBYNw.exe

Filesize
1.3MB

MD5
724ba54db78006f03e4ff871c97cee5e

SHA1
7f4a7f19510508acb99b0b89c9654491863481a5

SHA256
0259671ee82b35f2f10b327787a3daef74c3419efab1cad9e0873b18efe03ea4

SHA512
86d3c47014b3d7060fbb43f2a3e21c807c3ab322b44b634c0bbfdc8010381919e46182f3b014c9c0dfa20231d709d71b7716c06060ffde35df8e62882e430633

Download Submit
C:\Windows\system\yXFBUML.exe

Filesize
1.3MB

MD5
0959414f185fc94ee2d19bce240ee77b

SHA1
13757101922646975403130aa764c5352e79bd97

SHA256
4f3a0e2921ce21519195a4ac3d3f996c75063e55a1e255f4ffd3347ae948e802

SHA512
c79ad53b8ec58657aa99b53abcb2dadad26070e5dca81c5c90ca6f432d72b1e54332eb51bfeb4fe4a5175416378e78fb3259946c102465a6d29ea573f5dd76a7

Download Submit
C:\Windows\system\zoWaWAi.exe

Filesize
1.3MB

MD5
d6905c6fb56fe7973f741920b31a5398

SHA1
b5d98a3b5c74765faa33c2e5f9b7a5984b94d77a

SHA256
6ed24e4a5935a25aaf7ba6c54d667d59ca8d4a92ec11a6eafcfc2161c5b3af47

SHA512
1d2aedf0b0ec0b3df184ece51866299c8676853c196ff0949e3d868c729e268816a7a951552bcf15061dcae358c5be9dccde9fe7ff69911a35b1e105d69ce7c9

Download Submit
\Windows\system\EOjDyfm.exe

Filesize
1.3MB

MD5
f8906321199885df1ba4afb59ab5448b

SHA1
f2975f045c77b8efb5a70853a9fdb6add3331276

SHA256
c83e16fadd6c2ba2ec7d9f14abdad94b22952dbe5acb979a3ad65b58de714e15

SHA512
db6c0d317aec4094b35fb74630b141b44cabd36d7e47b4a8e06f007f242e85f7c04113167dd512f780fb06d66b19e5b80f1d229a275fdf8c60dfc3c617543319

Download Submit
\Windows\system\GPzeAvg.exe

Filesize
1.3MB

MD5
d0023726eb38ef5b1f5fc9d4b5d6a2a3

SHA1
98ede322d40091562b7505de94a21cd81ab89141

SHA256
ada27d4caa569dfada11b35d2288ea55592879ac734dd2a6a117ff1661e7954f

SHA512
c3d47fb1a71b334fafa0b230b2cae115bf5b673e277e512118782c638eba8045d3ff841b0811c8a3331228d55b85c584fb43b1d47ec751ab98e8787c9f3f3c62

Download Submit
\Windows\system\HYazNij.exe

Filesize
1.3MB

MD5
ea3faee21ad2ebdcc68233d1ca5933c0

SHA1
3d0aec447429ba8459fe019f9f9260a1197296cd

SHA256
a825478f2ad2813696ba34b68c81204e0d9b2455e2230e5761a2bc216d37b473

SHA512
c8f228ad0ba686832439ea8d92edad4765b77a4f6e5b4ff2b62114a12dbc4157e24ee20afc7054c57dffdf7de0c8596567aa12f9565cd48078559e5089e29747

Download Submit
\Windows\system\IAZegFB.exe

Filesize
1.3MB

MD5
d6a7f233ce8f6ca7b63d7e45a9a81277

SHA1
34849e014397935abd399b6a8bfd0b23992bfcf6

SHA256
2d9f1a01827de290a473a06e32277344a23b48cf1b39dc36d59d9f19b6443d02

SHA512
7e8a72034882c34dfa1c10308b9aa5ef8ae6091907ac191dccce1f8d445166b148fee335f78ca233e345174846a004e97d1879cc2071d69d0ae585d953d8799a

Download Submit
\Windows\system\NLBryHG.exe

Filesize
1.3MB

MD5
b4e6fa2efe1ac8d1f3d3266154453135

SHA1
9ff3bb7a3a3af19aaa9f126b2ae5544a721f8b7f

SHA256
509be7fae8d8014330f71831b5c75f4ea50cf729a5262a33660d0d98e19b59fd

SHA512
031eae957365364fed0ac0ca2fe68a7decec417a8acb1949a049f77bb6a4dcc735945065fb8f3fda1feb348ebd1b7b7a26b278b9174e30992c1ee07e1818f8dd

Download Submit
\Windows\system\TfmsXga.exe

Filesize
1.3MB

MD5
fa7f2f8e09b936661c93e285045957a6

SHA1
10854bc54ae078414822d4c272a78edb9b06fcf1

SHA256
4a546e3f24c58b42bfce6219870443f03b5ca4b3c20c99eb044dd5a13f003c31

SHA512
02dd0fd5ed2282a6251bee55f0a475b437fac10dd9e50714a45b10bb30524266f6ca3a327348eeb71743320a3565b4434724eadafb6e3a6c9402270e566ffdfa

Download Submit
\Windows\system\ZVJCTNN.exe

Filesize
1.3MB

MD5
4d341ab9298c4b0b11ea11a2dda171c6

SHA1
9200e378e55a5614affff65b7a4cccfbec3c5b6a

SHA256
deb7dbb7f1145af05c3d8e0c611d45d7a147506d462ad5219801cd84286dd8d5

SHA512
48a8204489e8423315bd07b288fc32bc6fc1e51cfc64e5075a01de5357062ff93762f211be5a87f309675afb7713778243d4b615382568dbc9df6d29d3876826

Download Submit
\Windows\system\fdpEMIr.exe

Filesize
1.3MB

MD5
a74158366aca45cf520830a3a05734a8

SHA1
56f875a4c13823b98b3694bf612b0656ebe2963f

SHA256
e2b458c17ef3d734d502f7e7a451d435894ca8423034e36b8250fa9e34af82f9

SHA512
c16c34add57d9ad9a6ff44d40ef0298b42be1b5c8234ab7423f2d8bcb3a514c1a884994edbfe73ad3ee84ca5576ab7ce01c961523f94e132b7ab1966887a220a

Download Submit
\Windows\system\iGAgcaI.exe

Filesize
1.3MB

MD5
9753632febab28dc9ad3578821a6f7f3

SHA1
beb1e61d7214f7ecc509cbee72f84999254e3f11

SHA256
8983cb90a8ae4c2dff656bda054316dde2c121a09d4115e14d8c9f26b821dfca

SHA512
21e98ce0fadd9eaa862dead5c59d9446b10c83f9889fb23e9c93cc9a06688419ff738ae7186f1ed75e999844985dcf5f286f0823349500fa97d03594552272af

Download Submit
\Windows\system\intBaJL.exe

Filesize
1.3MB

MD5
f842417a3ef572ac00124f2d067708d5

SHA1
f21bfae14e7984e733bc898f277f6d7b7223b80a

SHA256
3836f861c835054a3b4a6fb9c90f7e0c30cd73a660e20ec5801901eeacb192fa

SHA512
8d02ca608ee4376bd6270987a93b74685ba4d952c5eeb99927de48971c8b09b1956d85531da8a376cfabfb40900a65ce345f48af6dddca89c6bf9c2159ac6b6c

Download Submit
\Windows\system\rhlmhDm.exe

Filesize
1.3MB

MD5
ab316d14c2e53e296f9544419c57c170

SHA1
94a1bbc928633feb028e382ecae4b05221549819

SHA256
a12f95859247cb0d26ae3c53690288b10274b2f28312c573be46d898d6a5c0e9

SHA512
2049cd1599856318c4e896153bb1bf3497195fb914beb32883b8bbdb1a67d12afa8addee9e26dbac2b531dc8fa28dad85526630bfe208290fb9e2cf26b7611b7

Download Submit
\Windows\system\vIuJdPt.exe

Filesize
1.3MB

MD5
f40d3eaf641b866f7fcf27e789f360f6

SHA1
49e52c08df53bb5042a914fa5527bccd3557e2d2

SHA256
447437e21810cbb939db3eef31802169baeb48450d8839c5f41b251566dcd09e

SHA512
d6a0cc06b5c973d6de8954a8c018cf211f688f341fc52f1d094b18f6061ff17aa3da0c9ad02c008f033b42c4d46b1e0aebde02a5d91757d2e812871a701fb6d8

Download Submit
\Windows\system\vJCYDdE.exe

Filesize
1.3MB

MD5
dd045aaed8f7835c6791210dba18f7d6

SHA1
cc716d1d92655c445215504856af84d52e22053c

SHA256
1828c29eb7c16d4dec5e32d0463ec3e0e606e021a843f8de110be19a608ff190

SHA512
54b813bfa74d93bdbd58d0f600ce2026d5fe8588c3a0278b1ee88ecc099d2989e66234b1561e3c4362b4435ddb1d8dc0662c72742b15f48ed3c1ec61dab3c1c7

Download Submit
\Windows\system\xZRHZMo.exe

Filesize
1.3MB

MD5
ed9ebc086c1215e48dbf28d54b69f75f

SHA1
a5904155c21ba9f0dca95cdf5a50b7a98ed8869d

SHA256
6f68054311bc16a770068bc065ae63e44f6cf52074bd1a649ead8433ff99f946

SHA512
ee7cff338de3057060bc0bd73e298c0b38b8a7bc01fc4f248ec951aa91d716adbbcbd4af77fd82af7e727032642f22f2a357b1c9b4bf3057e12b13d24bccd579

Download Submit
\Windows\system\yRZLQhY.exe

Filesize
1.3MB

MD5
6da49676b35858d241bf0c720016828d

SHA1
11521a0c491907b80d583fa0146728553baea230

SHA256
0a5d34c624eaf7684808e62b867253d4f653cf6702fe2599a7cd4459f54f383a

SHA512
99f04c8de749c3f4e8f8a46bc7c4464d3bd613b168f2aa7f5273258b679576a96cac315712663cca20632089d86a52f693b752dd68681ae4d4a2047d2494c26b

Download Submit
memory/2344-205-0x000000013F160000-0x000000013F552000-memory.dmp

Filesize
3.9MB

Download
memory/2344-6790-0x000000013F160000-0x000000013F552000-memory.dmp

Filesize
3.9MB

Download
memory/2456-209-0x000000013FF70000-0x0000000140362000-memory.dmp

Filesize
3.9MB

Download
memory/2456-6805-0x000000013FF70000-0x0000000140362000-memory.dmp

Filesize
3.9MB

Download
memory/2596-197-0x000000013FBB0000-0x000000013FFA2000-memory.dmp

Filesize
3.9MB

Download
memory/2596-6783-0x000000013FBB0000-0x000000013FFA2000-memory.dmp

Filesize
3.9MB

Download
memory/2652-201-0x000000013F9D0000-0x000000013FDC2000-memory.dmp

Filesize
3.9MB

Download
memory/2680-199-0x0000000002F50000-0x0000000003342000-memory.dmp

Filesize
3.9MB

Download
memory/2680-202-0x0000000002F50000-0x0000000003342000-memory.dmp

Filesize
3.9MB

Download
memory/2680-7417-0x000000013F610000-0x000000013FA02000-memory.dmp

Filesize
3.9MB

Download
memory/2680-196-0x000000013FBB0000-0x000000013FFA2000-memory.dmp

Filesize
3.9MB

Download
memory/2680-198-0x0000000002F50000-0x0000000003342000-memory.dmp

Filesize
3.9MB

Download
memory/2680-1-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/2680-211-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/2680-206-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download
memory/2680-24-0x0000000002F50000-0x0000000003342000-memory.dmp

Filesize
3.9MB

Download
memory/2680-0-0x000000013F610000-0x000000013FA02000-memory.dmp

Filesize
3.9MB

Download
memory/2680-16-0x000000013F130000-0x000000013F522000-memory.dmp

Filesize
3.9MB

Download
memory/2680-6-0x000000013F060000-0x000000013F452000-memory.dmp

Filesize
3.9MB

Download
memory/2680-204-0x000000013F160000-0x000000013F552000-memory.dmp

Filesize
3.9MB

Download
memory/2736-14-0x000000013F130000-0x000000013F522000-memory.dmp

Filesize
3.9MB

Download
memory/2736-6793-0x000000013F130000-0x000000013F522000-memory.dmp

Filesize
3.9MB

Download
memory/2784-28-0x0000000002D00000-0x0000000002D80000-memory.dmp

Filesize
512KB

Download
memory/2784-29-0x000007FEF5A6E000-0x000007FEF5A6F000-memory.dmp

Filesize
4KB

Download
memory/2784-194-0x000007FEF57B0000-0x000007FEF614D000-memory.dmp

Filesize
9.6MB

Download
memory/2784-134-0x000000001B7F0000-0x000000001BAD2000-memory.dmp

Filesize
2.9MB

Download
memory/2784-212-0x0000000002340000-0x0000000002348000-memory.dmp

Filesize
32KB

Download
memory/2784-241-0x000007FEF57B0000-0x000007FEF614D000-memory.dmp

Filesize
9.6MB

Download
memory/2784-210-0x000007FEF57B0000-0x000007FEF614D000-memory.dmp

Filesize
9.6MB

Download
memory/2812-195-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/2812-6794-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/2820-6788-0x000000013F060000-0x000000013F452000-memory.dmp

Filesize
3.9MB

Download
memory/2820-15-0x000000013F060000-0x000000013F452000-memory.dmp

Filesize
3.9MB

Download
memory/2876-6792-0x000000013F830000-0x000000013FC22000-memory.dmp

Filesize
3.9MB

Download
memory/2876-27-0x000000013F830000-0x000000013FC22000-memory.dmp

Filesize
3.9MB

Download
memory/2884-6787-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download
memory/2884-208-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download
memory/2896-207-0x000000013F880000-0x000000013FC72000-memory.dmp

Filesize
3.9MB

Download
memory/2896-6791-0x000000013F880000-0x000000013FC72000-memory.dmp

Filesize
3.9MB

Download
memory/3004-6784-0x000000013F2E0000-0x000000013F6D2000-memory.dmp

Filesize
3.9MB

Download
memory/3004-200-0x000000013F2E0000-0x000000013F6D2000-memory.dmp

Filesize
3.9MB

Download
memory/3016-6782-0x000000013F580000-0x000000013F972000-memory.dmp

Filesize
3.9MB

Download
memory/3016-203-0x000000013F580000-0x000000013F972000-memory.dmp

Filesize
3.9MB

Download