xmrig | 260add1272da35b5caf03a1d3e5922b02f8e49995b05a4c4384f3eaf53784973

Analysis

max time kernel
119s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 10:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

868bb5aca7ba4a443008ba25a47183f0N.exe
Size

2.0MB
MD5

868bb5aca7ba4a443008ba25a47183f0
SHA1

3a7765e11c2d85a4cce7248f773da237911a5243
SHA256

260add1272da35b5caf03a1d3e5922b02f8e49995b05a4c4384f3eaf53784973
SHA512

84e9e12e77c3420ab704bcd2e1ea472930090628b179f03dc6016c6f8b282b9933d758b62dec5fb4ed0506b3f33cd965b99000ffc64fee88d9bb6d56db6ad767
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYRLZcyZ204oVTUG7kieEHcYT0wA:Lz071uv4BPMkibTIA5JnJ1VZKR5p+2

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 25 IoCs

miner

resource	yara_rule
behavioral1/memory/2788-26-0x000000013FF30000-0x0000000140322000-memory.dmp	xmrig
behavioral1/memory/2880-20-0x000000013F490000-0x000000013F882000-memory.dmp	xmrig
behavioral1/memory/2844-14-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	xmrig
behavioral1/memory/2896-53-0x000000013F130000-0x000000013F522000-memory.dmp	xmrig
behavioral1/memory/1960-75-0x000000013F840000-0x000000013FC32000-memory.dmp	xmrig
behavioral1/memory/700-275-0x000000013FCF0000-0x00000001400E2000-memory.dmp	xmrig
behavioral1/memory/2152-90-0x000000013F630000-0x000000013FA22000-memory.dmp	xmrig
behavioral1/memory/2896-87-0x0000000003460000-0x0000000003852000-memory.dmp	xmrig
behavioral1/memory/2736-86-0x000000013F510000-0x000000013F902000-memory.dmp	xmrig
behavioral1/memory/2004-84-0x000000013F560000-0x000000013F952000-memory.dmp	xmrig
behavioral1/memory/2896-58-0x000000013F840000-0x000000013FC32000-memory.dmp	xmrig
behavioral1/memory/2880-57-0x000000013F490000-0x000000013F882000-memory.dmp	xmrig
behavioral1/memory/2844-56-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	xmrig
behavioral1/memory/2880-6366-0x000000013F490000-0x000000013F882000-memory.dmp	xmrig
behavioral1/memory/988-6607-0x000000013F070000-0x000000013F462000-memory.dmp	xmrig
behavioral1/memory/2736-6606-0x000000013F510000-0x000000013F902000-memory.dmp	xmrig
behavioral1/memory/1960-6623-0x000000013F840000-0x000000013FC32000-memory.dmp	xmrig
behavioral1/memory/2828-6625-0x000000013F370000-0x000000013F762000-memory.dmp	xmrig
behavioral1/memory/2152-6629-0x000000013F630000-0x000000013FA22000-memory.dmp	xmrig
behavioral1/memory/2564-6678-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	xmrig
behavioral1/memory/2788-6738-0x000000013FF30000-0x0000000140322000-memory.dmp	xmrig
behavioral1/memory/2004-6683-0x000000013F560000-0x000000013F952000-memory.dmp	xmrig
behavioral1/memory/2844-6686-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	xmrig
behavioral1/memory/1504-6685-0x000000013F6A0000-0x000000013FA92000-memory.dmp	xmrig
behavioral1/memory/700-6684-0x000000013FCF0000-0x00000001400E2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1936	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2844	tiZEGkJ.exe
2880	xGUZgEe.exe
2788	AyEUylP.exe
2736	kPOcqZX.exe
700	FOLBclZ.exe
1504	AIolGbV.exe
988	DEUHPgP.exe
1960	ZxQvPSf.exe
2004	yDsZrpl.exe
2564	kGrjRjk.exe
2152	fxELRjO.exe
2828	LaBuDoB.exe
2832	iqgObNf.exe
2944	PsbXCSC.exe
1372	PCdQpnj.exe
1740	vyJmKCb.exe
2444	HodqzUJ.exe
3056	EWCZJzl.exe
2140	fnHNdmc.exe
2488	QYdfdUI.exe
2192	WBRTipi.exe
1992	TcNQlEn.exe
2384	RyzXWXU.exe
624	JpXhsGM.exe
684	WycMCQt.exe
2484	JHbZglM.exe
1660	iwjVAeI.exe
2376	MiZQyYb.exe
2136	DhGpZNe.exe
932	HJFhsbH.exe
2036	nfFTYyK.exe
2188	LBekIBp.exe
2552	kNqMOOk.exe
2492	TyQzxhI.exe
316	cmdcLVd.exe
1396	oIqkDfd.exe
2932	XTVumUd.exe
2000	axlSBqw.exe
468	KGYucCw.exe
816	edBSKwx.exe
1572	SAfUtDC.exe
764	Cziosek.exe
680	FktzRVz.exe
2356	QRfqBHm.exe
796	HrdeWxg.exe
2092	WDEUjPa.exe
2664	iKiFBFu.exe
2496	ZqxGBfK.exe
1756	NijFNoP.exe
1708	WPIcdFS.exe
2740	xMEFhHB.exe
800	tOYCEsr.exe
2076	bDAPMsQ.exe
1096	LeOwKgc.exe
2948	gDQeLXA.exe
2160	TfmmMDK.exe
1328	dmdUVZc.exe
2244	zYhDSLI.exe
948	raDRDbl.exe
2508	CEGHREu.exe
2644	mZwNKJa.exe
2540	tKvtlbe.exe
2824	EJWVJgT.exe
2392	dQujMOq.exe

Loads dropped DLL 64 IoCs

pid	Process
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe
2896	868bb5aca7ba4a443008ba25a47183f0N.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2896-0-0x000000013F130000-0x000000013F522000-memory.dmp	upx
behavioral1/files/0x000a00000001202b-5.dat	upx
behavioral1/files/0x0008000000015686-7.dat	upx
behavioral1/files/0x0008000000015690-17.dat	upx
behavioral1/memory/2788-26-0x000000013FF30000-0x0000000140322000-memory.dmp	upx
behavioral1/memory/2880-20-0x000000013F490000-0x000000013F882000-memory.dmp	upx
behavioral1/memory/2844-14-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	upx
behavioral1/memory/2736-32-0x000000013F510000-0x000000013F902000-memory.dmp	upx
behavioral1/files/0x0008000000015cce-52.dat	upx
behavioral1/memory/2896-53-0x000000013F130000-0x000000013F522000-memory.dmp	upx
behavioral1/memory/988-54-0x000000013F070000-0x000000013F462000-memory.dmp	upx
behavioral1/files/0x0006000000015fa5-69.dat	upx
behavioral1/memory/1960-75-0x000000013F840000-0x000000013FC32000-memory.dmp	upx
behavioral1/files/0x0008000000015ce7-55.dat	upx
behavioral1/files/0x0007000000015df0-73.dat	upx
behavioral1/files/0x0006000000016140-93.dat	upx
behavioral1/files/0x0006000000016398-103.dat	upx
behavioral1/files/0x0006000000016688-124.dat	upx
behavioral1/files/0x0006000000016d4b-159.dat	upx
behavioral1/files/0x0006000000016c88-187.dat	upx
behavioral1/files/0x000600000001688f-164.dat	upx
behavioral1/files/0x0006000000016caa-192.dat	upx
behavioral1/files/0x0006000000016dbd-189.dat	upx
behavioral1/files/0x0006000000016d76-178.dat	upx
behavioral1/files/0x0006000000016d92-176.dat	upx
behavioral1/files/0x0006000000016d6e-172.dat	upx
behavioral1/files/0x0006000000016d72-169.dat	upx
behavioral1/files/0x0006000000016d67-161.dat	upx
behavioral1/files/0x0006000000016d21-152.dat	upx
behavioral1/files/0x0031000000014fa6-130.dat	upx
behavioral1/files/0x0006000000016dcf-194.dat	upx
behavioral1/files/0x00060000000164dd-113.dat	upx
behavioral1/files/0x0006000000016da7-183.dat	upx
behavioral1/files/0x00060000000162e3-110.dat	upx
behavioral1/memory/700-275-0x000000013FCF0000-0x00000001400E2000-memory.dmp	upx
behavioral1/files/0x0006000000016cef-149.dat	upx
behavioral1/files/0x0006000000016c9f-142.dat	upx
behavioral1/files/0x0006000000016b85-135.dat	upx
behavioral1/files/0x000600000001660d-117.dat	upx
behavioral1/memory/2828-91-0x000000013F370000-0x000000013F762000-memory.dmp	upx
behavioral1/memory/2152-90-0x000000013F630000-0x000000013FA22000-memory.dmp	upx
behavioral1/files/0x00060000000160d9-89.dat	upx
behavioral1/files/0x0006000000015f4d-88.dat	upx
behavioral1/memory/2736-86-0x000000013F510000-0x000000013F902000-memory.dmp	upx
behavioral1/memory/2004-84-0x000000013F560000-0x000000013F952000-memory.dmp	upx
behavioral1/memory/2564-82-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	upx
behavioral1/memory/2880-57-0x000000013F490000-0x000000013F882000-memory.dmp	upx
behavioral1/memory/2844-56-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	upx
behavioral1/memory/700-42-0x000000013FCF0000-0x00000001400E2000-memory.dmp	upx
behavioral1/memory/1504-50-0x000000013F6A0000-0x000000013FA92000-memory.dmp	upx
behavioral1/files/0x0008000000015cdb-49.dat	upx
behavioral1/files/0x000c00000000549e-37.dat	upx
behavioral1/files/0x00070000000156b7-30.dat	upx
behavioral1/memory/2880-6366-0x000000013F490000-0x000000013F882000-memory.dmp	upx
behavioral1/memory/988-6607-0x000000013F070000-0x000000013F462000-memory.dmp	upx
behavioral1/memory/2736-6606-0x000000013F510000-0x000000013F902000-memory.dmp	upx
behavioral1/memory/1960-6623-0x000000013F840000-0x000000013FC32000-memory.dmp	upx
behavioral1/memory/2828-6625-0x000000013F370000-0x000000013F762000-memory.dmp	upx
behavioral1/memory/2152-6629-0x000000013F630000-0x000000013FA22000-memory.dmp	upx
behavioral1/memory/2564-6678-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	upx
behavioral1/memory/2788-6738-0x000000013FF30000-0x0000000140322000-memory.dmp	upx
behavioral1/memory/2004-6683-0x000000013F560000-0x000000013F952000-memory.dmp	upx
behavioral1/memory/2844-6686-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	upx
behavioral1/memory/1504-6685-0x000000013F6A0000-0x000000013FA92000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\GfJqCNt.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\AwmPFmE.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\izKFHHb.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\dsLEmLD.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\bWJbAuV.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\DamYgln.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\JTIhDhD.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\CceFqql.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\NMTCwqC.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\nSmMJSi.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\trxPEIt.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\KuSftGJ.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\InJkpHN.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\BqSbJeT.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\upnjsvO.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\XUripPU.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\ZnPtBrg.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\ZoTqoHA.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\LlVlfXA.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\tdefDTc.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\TqbmndG.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\pPnNxLG.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\HBDMHYZ.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\HyIjcbl.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\yZplRbe.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\iGCLrgZ.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\JtssxSu.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\UNwwxsC.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\palZgVR.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\FORjMHO.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\ibfpddS.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\YSwDUUu.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\iHGYxuI.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\KiuRvgU.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\acFJGwa.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\eLiZpLY.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\KMghUzt.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\DawnloK.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\XlHBZHJ.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\jybNxsn.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\uefbmlv.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\OptlWIp.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\zULSIZP.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\xEAThDm.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\DKfDnad.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\HuSGXMG.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\eNbjKVP.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\ezQaOes.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\MfpsQGS.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\kckrDhp.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\ZdEujli.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\ovIvbzG.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\YFLjjfd.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\izLQmAm.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\PtgNppD.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\xmxdniP.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\dZOTDxz.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\PsyhaUx.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\jIuiVvX.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\KMZMPCJ.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\aXDsapH.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\yvllWHR.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\GghtkCQ.exe	868bb5aca7ba4a443008ba25a47183f0N.exe
File created	C:\Windows\System\UhYMXbT.exe	868bb5aca7ba4a443008ba25a47183f0N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1936	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2896	868bb5aca7ba4a443008ba25a47183f0N.exe
Token: SeLockMemoryPrivilege	2896	868bb5aca7ba4a443008ba25a47183f0N.exe
Token: SeDebugPrivilege	1936	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 1936	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	31
PID 2896 wrote to memory of 1936	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	31
PID 2896 wrote to memory of 1936	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	31
PID 2896 wrote to memory of 2844	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	32
PID 2896 wrote to memory of 2844	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	32
PID 2896 wrote to memory of 2844	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	32
PID 2896 wrote to memory of 2880	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	33
PID 2896 wrote to memory of 2880	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	33
PID 2896 wrote to memory of 2880	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	33
PID 2896 wrote to memory of 2788	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	34
PID 2896 wrote to memory of 2788	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	34
PID 2896 wrote to memory of 2788	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	34
PID 2896 wrote to memory of 2736	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	35
PID 2896 wrote to memory of 2736	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	35
PID 2896 wrote to memory of 2736	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	35
PID 2896 wrote to memory of 700	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	36
PID 2896 wrote to memory of 700	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	36
PID 2896 wrote to memory of 700	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	36
PID 2896 wrote to memory of 988	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	37
PID 2896 wrote to memory of 988	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	37
PID 2896 wrote to memory of 988	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	37
PID 2896 wrote to memory of 1504	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	38
PID 2896 wrote to memory of 1504	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	38
PID 2896 wrote to memory of 1504	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	38
PID 2896 wrote to memory of 1960	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	39
PID 2896 wrote to memory of 1960	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	39
PID 2896 wrote to memory of 1960	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	39
PID 2896 wrote to memory of 2004	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	40
PID 2896 wrote to memory of 2004	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	40
PID 2896 wrote to memory of 2004	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	40
PID 2896 wrote to memory of 2152	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	41
PID 2896 wrote to memory of 2152	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	41
PID 2896 wrote to memory of 2152	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	41
PID 2896 wrote to memory of 2564	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	42
PID 2896 wrote to memory of 2564	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	42
PID 2896 wrote to memory of 2564	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	42
PID 2896 wrote to memory of 2828	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	43
PID 2896 wrote to memory of 2828	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	43
PID 2896 wrote to memory of 2828	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	43
PID 2896 wrote to memory of 2832	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	44
PID 2896 wrote to memory of 2832	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	44
PID 2896 wrote to memory of 2832	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	44
PID 2896 wrote to memory of 1372	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	45
PID 2896 wrote to memory of 1372	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	45
PID 2896 wrote to memory of 1372	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	45
PID 2896 wrote to memory of 2944	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	46
PID 2896 wrote to memory of 2944	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	46
PID 2896 wrote to memory of 2944	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	46
PID 2896 wrote to memory of 1740	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	47
PID 2896 wrote to memory of 1740	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	47
PID 2896 wrote to memory of 1740	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	47
PID 2896 wrote to memory of 2444	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	48
PID 2896 wrote to memory of 2444	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	48
PID 2896 wrote to memory of 2444	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	48
PID 2896 wrote to memory of 2140	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	49
PID 2896 wrote to memory of 2140	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	49
PID 2896 wrote to memory of 2140	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	49
PID 2896 wrote to memory of 3056	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	50
PID 2896 wrote to memory of 3056	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	50
PID 2896 wrote to memory of 3056	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	50
PID 2896 wrote to memory of 624	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	51
PID 2896 wrote to memory of 624	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	51
PID 2896 wrote to memory of 624	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	51
PID 2896 wrote to memory of 2488	2896	868bb5aca7ba4a443008ba25a47183f0N.exe	52

C:\Users\Admin\AppData\Local\Temp\868bb5aca7ba4a443008ba25a47183f0N.exe
"C:\Users\Admin\AppData\Local\Temp\868bb5aca7ba4a443008ba25a47183f0N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1936
- C:\Windows\System\tiZEGkJ.exe
  C:\Windows\System\tiZEGkJ.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\xGUZgEe.exe
  C:\Windows\System\xGUZgEe.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\AyEUylP.exe
  C:\Windows\System\AyEUylP.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\kPOcqZX.exe
  C:\Windows\System\kPOcqZX.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\FOLBclZ.exe
  C:\Windows\System\FOLBclZ.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\DEUHPgP.exe
  C:\Windows\System\DEUHPgP.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\AIolGbV.exe
  C:\Windows\System\AIolGbV.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\ZxQvPSf.exe
  C:\Windows\System\ZxQvPSf.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\yDsZrpl.exe
  C:\Windows\System\yDsZrpl.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\fxELRjO.exe
  C:\Windows\System\fxELRjO.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\kGrjRjk.exe
  C:\Windows\System\kGrjRjk.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\LaBuDoB.exe
  C:\Windows\System\LaBuDoB.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\iqgObNf.exe
  C:\Windows\System\iqgObNf.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\PCdQpnj.exe
  C:\Windows\System\PCdQpnj.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\PsbXCSC.exe
  C:\Windows\System\PsbXCSC.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\vyJmKCb.exe
  C:\Windows\System\vyJmKCb.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\HodqzUJ.exe
  C:\Windows\System\HodqzUJ.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\fnHNdmc.exe
  C:\Windows\System\fnHNdmc.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\EWCZJzl.exe
  C:\Windows\System\EWCZJzl.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\JpXhsGM.exe
  C:\Windows\System\JpXhsGM.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\QYdfdUI.exe
  C:\Windows\System\QYdfdUI.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\MiZQyYb.exe
  C:\Windows\System\MiZQyYb.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\WBRTipi.exe
  C:\Windows\System\WBRTipi.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\DhGpZNe.exe
  C:\Windows\System\DhGpZNe.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\TcNQlEn.exe
  C:\Windows\System\TcNQlEn.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\LBekIBp.exe
  C:\Windows\System\LBekIBp.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\RyzXWXU.exe
  C:\Windows\System\RyzXWXU.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\TyQzxhI.exe
  C:\Windows\System\TyQzxhI.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\WycMCQt.exe
  C:\Windows\System\WycMCQt.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\oIqkDfd.exe
  C:\Windows\System\oIqkDfd.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\JHbZglM.exe
  C:\Windows\System\JHbZglM.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\axlSBqw.exe
  C:\Windows\System\axlSBqw.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\iwjVAeI.exe
  C:\Windows\System\iwjVAeI.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\Cziosek.exe
  C:\Windows\System\Cziosek.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\HJFhsbH.exe
  C:\Windows\System\HJFhsbH.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\FktzRVz.exe
  C:\Windows\System\FktzRVz.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\nfFTYyK.exe
  C:\Windows\System\nfFTYyK.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\QRfqBHm.exe
  C:\Windows\System\QRfqBHm.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\kNqMOOk.exe
  C:\Windows\System\kNqMOOk.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\HrdeWxg.exe
  C:\Windows\System\HrdeWxg.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\cmdcLVd.exe
  C:\Windows\System\cmdcLVd.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\WDEUjPa.exe
  C:\Windows\System\WDEUjPa.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\XTVumUd.exe
  C:\Windows\System\XTVumUd.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\ZqxGBfK.exe
  C:\Windows\System\ZqxGBfK.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\KGYucCw.exe
  C:\Windows\System\KGYucCw.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\NijFNoP.exe
  C:\Windows\System\NijFNoP.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\edBSKwx.exe
  C:\Windows\System\edBSKwx.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\WPIcdFS.exe
  C:\Windows\System\WPIcdFS.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\SAfUtDC.exe
  C:\Windows\System\SAfUtDC.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\xMEFhHB.exe
  C:\Windows\System\xMEFhHB.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\iKiFBFu.exe
  C:\Windows\System\iKiFBFu.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\tOYCEsr.exe
  C:\Windows\System\tOYCEsr.exe
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\System\bDAPMsQ.exe
  C:\Windows\System\bDAPMsQ.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\LeOwKgc.exe
  C:\Windows\System\LeOwKgc.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\gDQeLXA.exe
  C:\Windows\System\gDQeLXA.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\TfmmMDK.exe
  C:\Windows\System\TfmmMDK.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\dmdUVZc.exe
  C:\Windows\System\dmdUVZc.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\CEGHREu.exe
  C:\Windows\System\CEGHREu.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\zYhDSLI.exe
  C:\Windows\System\zYhDSLI.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\mZwNKJa.exe
  C:\Windows\System\mZwNKJa.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\raDRDbl.exe
  C:\Windows\System\raDRDbl.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\EJWVJgT.exe
  C:\Windows\System\EJWVJgT.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\tKvtlbe.exe
  C:\Windows\System\tKvtlbe.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\dQujMOq.exe
  C:\Windows\System\dQujMOq.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\brPxJTk.exe
  C:\Windows\System\brPxJTk.exe
  2⤵
  PID:1804
- C:\Windows\System\ueZaqHR.exe
  C:\Windows\System\ueZaqHR.exe
  2⤵
  PID:1752
- C:\Windows\System\yxfClrL.exe
  C:\Windows\System\yxfClrL.exe
  2⤵
  PID:2396
- C:\Windows\System\rDnBLok.exe
  C:\Windows\System\rDnBLok.exe
  2⤵
  PID:2156
- C:\Windows\System\gUiLIkD.exe
  C:\Windows\System\gUiLIkD.exe
  2⤵
  PID:1772
- C:\Windows\System\HkGvLsq.exe
  C:\Windows\System\HkGvLsq.exe
  2⤵
  PID:2280
- C:\Windows\System\Eqlmbqs.exe
  C:\Windows\System\Eqlmbqs.exe
  2⤵
  PID:1912
- C:\Windows\System\LEaLNhD.exe
  C:\Windows\System\LEaLNhD.exe
  2⤵
  PID:2616
- C:\Windows\System\DASuDfE.exe
  C:\Windows\System\DASuDfE.exe
  2⤵
  PID:1644
- C:\Windows\System\eDqeYnL.exe
  C:\Windows\System\eDqeYnL.exe
  2⤵
  PID:912
- C:\Windows\System\ItrPEKC.exe
  C:\Windows\System\ItrPEKC.exe
  2⤵
  PID:916
- C:\Windows\System\cvodprr.exe
  C:\Windows\System\cvodprr.exe
  2⤵
  PID:1780
- C:\Windows\System\yDCVPlN.exe
  C:\Windows\System\yDCVPlN.exe
  2⤵
  PID:1728
- C:\Windows\System\geGDSdR.exe
  C:\Windows\System\geGDSdR.exe
  2⤵
  PID:2528
- C:\Windows\System\QJpWXOQ.exe
  C:\Windows\System\QJpWXOQ.exe
  2⤵
  PID:2220
- C:\Windows\System\Jzyiuha.exe
  C:\Windows\System\Jzyiuha.exe
  2⤵
  PID:2776
- C:\Windows\System\XADSteS.exe
  C:\Windows\System\XADSteS.exe
  2⤵
  PID:2752
- C:\Windows\System\IZjrqxH.exe
  C:\Windows\System\IZjrqxH.exe
  2⤵
  PID:1736
- C:\Windows\System\pLBOAns.exe
  C:\Windows\System\pLBOAns.exe
  2⤵
  PID:2344
- C:\Windows\System\sWtwTiK.exe
  C:\Windows\System\sWtwTiK.exe
  2⤵
  PID:2592
- C:\Windows\System\OQGYmtB.exe
  C:\Windows\System\OQGYmtB.exe
  2⤵
  PID:2388
- C:\Windows\System\SdPMDIQ.exe
  C:\Windows\System\SdPMDIQ.exe
  2⤵
  PID:476
- C:\Windows\System\hjjNIAt.exe
  C:\Windows\System\hjjNIAt.exe
  2⤵
  PID:572
- C:\Windows\System\CLLlabm.exe
  C:\Windows\System\CLLlabm.exe
  2⤵
  PID:2100
- C:\Windows\System\aBravGG.exe
  C:\Windows\System\aBravGG.exe
  2⤵
  PID:2936
- C:\Windows\System\vjjYzRv.exe
  C:\Windows\System\vjjYzRv.exe
  2⤵
  PID:2704
- C:\Windows\System\qBRcdXs.exe
  C:\Windows\System\qBRcdXs.exe
  2⤵
  PID:832
- C:\Windows\System\TPJfoQO.exe
  C:\Windows\System\TPJfoQO.exe
  2⤵
  PID:2008
- C:\Windows\System\ZWJfxDg.exe
  C:\Windows\System\ZWJfxDg.exe
  2⤵
  PID:324
- C:\Windows\System\gnIAWFq.exe
  C:\Windows\System\gnIAWFq.exe
  2⤵
  PID:2256
- C:\Windows\System\jmBdWbp.exe
  C:\Windows\System\jmBdWbp.exe
  2⤵
  PID:2688
- C:\Windows\System\DcoVQwX.exe
  C:\Windows\System\DcoVQwX.exe
  2⤵
  PID:2348
- C:\Windows\System\lsbzdKx.exe
  C:\Windows\System\lsbzdKx.exe
  2⤵
  PID:2568
- C:\Windows\System\dyKcBvS.exe
  C:\Windows\System\dyKcBvS.exe
  2⤵
  PID:3016
- C:\Windows\System\UQvaDtz.exe
  C:\Windows\System\UQvaDtz.exe
  2⤵
  PID:2360
- C:\Windows\System\yXjWkpH.exe
  C:\Windows\System\yXjWkpH.exe
  2⤵
  PID:1724
- C:\Windows\System\PrxpZca.exe
  C:\Windows\System\PrxpZca.exe
  2⤵
  PID:2476
- C:\Windows\System\KRzDETf.exe
  C:\Windows\System\KRzDETf.exe
  2⤵
  PID:760
- C:\Windows\System\YlmVvkg.exe
  C:\Windows\System\YlmVvkg.exe
  2⤵
  PID:1048
- C:\Windows\System\QuSkoVb.exe
  C:\Windows\System\QuSkoVb.exe
  2⤵
  PID:1516
- C:\Windows\System\kMeFcxq.exe
  C:\Windows\System\kMeFcxq.exe
  2⤵
  PID:2676
- C:\Windows\System\BPjYIqM.exe
  C:\Windows\System\BPjYIqM.exe
  2⤵
  PID:400
- C:\Windows\System\TNNrPjp.exe
  C:\Windows\System\TNNrPjp.exe
  2⤵
  PID:2404
- C:\Windows\System\CRBdTtt.exe
  C:\Windows\System\CRBdTtt.exe
  2⤵
  PID:2748
- C:\Windows\System\AjmwXrG.exe
  C:\Windows\System\AjmwXrG.exe
  2⤵
  PID:2652
- C:\Windows\System\OfUZDgK.exe
  C:\Windows\System\OfUZDgK.exe
  2⤵
  PID:2920
- C:\Windows\System\AdOwOYb.exe
  C:\Windows\System\AdOwOYb.exe
  2⤵
  PID:1308
- C:\Windows\System\YmSkfgD.exe
  C:\Windows\System\YmSkfgD.exe
  2⤵
  PID:3096
- C:\Windows\System\bbbOfuO.exe
  C:\Windows\System\bbbOfuO.exe
  2⤵
  PID:3112
- C:\Windows\System\lHeKmPg.exe
  C:\Windows\System\lHeKmPg.exe
  2⤵
  PID:3128
- C:\Windows\System\pLUIMNJ.exe
  C:\Windows\System\pLUIMNJ.exe
  2⤵
  PID:3144
- C:\Windows\System\NZkrqJY.exe
  C:\Windows\System\NZkrqJY.exe
  2⤵
  PID:3160
- C:\Windows\System\VdyFbpP.exe
  C:\Windows\System\VdyFbpP.exe
  2⤵
  PID:3188
- C:\Windows\System\TAKNFIE.exe
  C:\Windows\System\TAKNFIE.exe
  2⤵
  PID:3220
- C:\Windows\System\XShcugk.exe
  C:\Windows\System\XShcugk.exe
  2⤵
  PID:3236
- C:\Windows\System\QVCEBHb.exe
  C:\Windows\System\QVCEBHb.exe
  2⤵
  PID:3252
- C:\Windows\System\IMIejJk.exe
  C:\Windows\System\IMIejJk.exe
  2⤵
  PID:3268
- C:\Windows\System\GQVkFkP.exe
  C:\Windows\System\GQVkFkP.exe
  2⤵
  PID:3284
- C:\Windows\System\FxNuXfd.exe
  C:\Windows\System\FxNuXfd.exe
  2⤵
  PID:3300
- C:\Windows\System\yvllWHR.exe
  C:\Windows\System\yvllWHR.exe
  2⤵
  PID:3316
- C:\Windows\System\BynXVkc.exe
  C:\Windows\System\BynXVkc.exe
  2⤵
  PID:3332
- C:\Windows\System\IOIRcwS.exe
  C:\Windows\System\IOIRcwS.exe
  2⤵
  PID:3348
- C:\Windows\System\VxjfVGK.exe
  C:\Windows\System\VxjfVGK.exe
  2⤵
  PID:3364
- C:\Windows\System\WNZiBfT.exe
  C:\Windows\System\WNZiBfT.exe
  2⤵
  PID:3380
- C:\Windows\System\EPlpoHg.exe
  C:\Windows\System\EPlpoHg.exe
  2⤵
  PID:3396
- C:\Windows\System\Iudirtf.exe
  C:\Windows\System\Iudirtf.exe
  2⤵
  PID:3616
- C:\Windows\System\alYdvnw.exe
  C:\Windows\System\alYdvnw.exe
  2⤵
  PID:3636
- C:\Windows\System\xpTBUkk.exe
  C:\Windows\System\xpTBUkk.exe
  2⤵
  PID:3652
- C:\Windows\System\IfoSDlM.exe
  C:\Windows\System\IfoSDlM.exe
  2⤵
  PID:3668
- C:\Windows\System\GAEOxdK.exe
  C:\Windows\System\GAEOxdK.exe
  2⤵
  PID:3684
- C:\Windows\System\nHKzeaN.exe
  C:\Windows\System\nHKzeaN.exe
  2⤵
  PID:3700
- C:\Windows\System\ysCnvOS.exe
  C:\Windows\System\ysCnvOS.exe
  2⤵
  PID:3716
- C:\Windows\System\OHnfNFS.exe
  C:\Windows\System\OHnfNFS.exe
  2⤵
  PID:3732
- C:\Windows\System\liWWvJn.exe
  C:\Windows\System\liWWvJn.exe
  2⤵
  PID:3748
- C:\Windows\System\ddopvAQ.exe
  C:\Windows\System\ddopvAQ.exe
  2⤵
  PID:3768
- C:\Windows\System\sbQgsbE.exe
  C:\Windows\System\sbQgsbE.exe
  2⤵
  PID:3788
- C:\Windows\System\GojSifD.exe
  C:\Windows\System\GojSifD.exe
  2⤵
  PID:3804
- C:\Windows\System\aknOUbS.exe
  C:\Windows\System\aknOUbS.exe
  2⤵
  PID:3820
- C:\Windows\System\cBXqxGN.exe
  C:\Windows\System\cBXqxGN.exe
  2⤵
  PID:3836
- C:\Windows\System\PhMnaqZ.exe
  C:\Windows\System\PhMnaqZ.exe
  2⤵
  PID:3852
- C:\Windows\System\CCNXpdx.exe
  C:\Windows\System\CCNXpdx.exe
  2⤵
  PID:3868
- C:\Windows\System\uFFfqCX.exe
  C:\Windows\System\uFFfqCX.exe
  2⤵
  PID:3888
- C:\Windows\System\XcTPHgX.exe
  C:\Windows\System\XcTPHgX.exe
  2⤵
  PID:3904
- C:\Windows\System\atELLHe.exe
  C:\Windows\System\atELLHe.exe
  2⤵
  PID:3920
- C:\Windows\System\BhwafQG.exe
  C:\Windows\System\BhwafQG.exe
  2⤵
  PID:3936
- C:\Windows\System\zrdTpUr.exe
  C:\Windows\System\zrdTpUr.exe
  2⤵
  PID:3952
- C:\Windows\System\fggWYUa.exe
  C:\Windows\System\fggWYUa.exe
  2⤵
  PID:4036
- C:\Windows\System\pmCmOAz.exe
  C:\Windows\System\pmCmOAz.exe
  2⤵
  PID:4052
- C:\Windows\System\ZAqYRFD.exe
  C:\Windows\System\ZAqYRFD.exe
  2⤵
  PID:4068
- C:\Windows\System\UKPitke.exe
  C:\Windows\System\UKPitke.exe
  2⤵
  PID:4084
- C:\Windows\System\QxbYgSI.exe
  C:\Windows\System\QxbYgSI.exe
  2⤵
  PID:1408
- C:\Windows\System\WiRrVIy.exe
  C:\Windows\System\WiRrVIy.exe
  2⤵
  PID:1968
- C:\Windows\System\SGQwudH.exe
  C:\Windows\System\SGQwudH.exe
  2⤵
  PID:1108
- C:\Windows\System\AhCQlzf.exe
  C:\Windows\System\AhCQlzf.exe
  2⤵
  PID:1956
- C:\Windows\System\REcYoqg.exe
  C:\Windows\System\REcYoqg.exe
  2⤵
  PID:3208
- C:\Windows\System\VccqqMC.exe
  C:\Windows\System\VccqqMC.exe
  2⤵
  PID:3092
- C:\Windows\System\cbXdviJ.exe
  C:\Windows\System\cbXdviJ.exe
  2⤵
  PID:3156
- C:\Windows\System\KvNLmKA.exe
  C:\Windows\System\KvNLmKA.exe
  2⤵
  PID:3212
- C:\Windows\System\PovQVLE.exe
  C:\Windows\System\PovQVLE.exe
  2⤵
  PID:3280
- C:\Windows\System\StKEMNm.exe
  C:\Windows\System\StKEMNm.exe
  2⤵
  PID:3372
- C:\Windows\System\vYzxeQR.exe
  C:\Windows\System\vYzxeQR.exe
  2⤵
  PID:3440
- C:\Windows\System\HYokcNb.exe
  C:\Windows\System\HYokcNb.exe
  2⤵
  PID:1040
- C:\Windows\System\qbjimyT.exe
  C:\Windows\System\qbjimyT.exe
  2⤵
  PID:3452
- C:\Windows\System\uyiUhoD.exe
  C:\Windows\System\uyiUhoD.exe
  2⤵
  PID:3464
- C:\Windows\System\XtcSmxB.exe
  C:\Windows\System\XtcSmxB.exe
  2⤵
  PID:3484
- C:\Windows\System\CrMtEUT.exe
  C:\Windows\System\CrMtEUT.exe
  2⤵
  PID:3496
- C:\Windows\System\dngWkkJ.exe
  C:\Windows\System\dngWkkJ.exe
  2⤵
  PID:3504
- C:\Windows\System\iSJUznb.exe
  C:\Windows\System\iSJUznb.exe
  2⤵
  PID:3392
- C:\Windows\System\TkKDCmQ.exe
  C:\Windows\System\TkKDCmQ.exe
  2⤵
  PID:1444
- C:\Windows\System\LfFXGhM.exe
  C:\Windows\System\LfFXGhM.exe
  2⤵
  PID:3048
- C:\Windows\System\uIWBOYK.exe
  C:\Windows\System\uIWBOYK.exe
  2⤵
  PID:3052
- C:\Windows\System\niiyVcA.exe
  C:\Windows\System\niiyVcA.exe
  2⤵
  PID:2836
- C:\Windows\System\HoDYxls.exe
  C:\Windows\System\HoDYxls.exe
  2⤵
  PID:1280
- C:\Windows\System\xqHhBqH.exe
  C:\Windows\System\xqHhBqH.exe
  2⤵
  PID:876
- C:\Windows\System\hYJkOoo.exe
  C:\Windows\System\hYJkOoo.exe
  2⤵
  PID:1876
- C:\Windows\System\ZUMnBCk.exe
  C:\Windows\System\ZUMnBCk.exe
  2⤵
  PID:3108
- C:\Windows\System\lQacKsz.exe
  C:\Windows\System\lQacKsz.exe
  2⤵
  PID:3176
- C:\Windows\System\OKyGaEO.exe
  C:\Windows\System\OKyGaEO.exe
  2⤵
  PID:3232
- C:\Windows\System\AkjZmPy.exe
  C:\Windows\System\AkjZmPy.exe
  2⤵
  PID:3296
- C:\Windows\System\mdoUhpj.exe
  C:\Windows\System\mdoUhpj.exe
  2⤵
  PID:1044
- C:\Windows\System\OYvcymD.exe
  C:\Windows\System\OYvcymD.exe
  2⤵
  PID:2588
- C:\Windows\System\sNmTFar.exe
  C:\Windows\System\sNmTFar.exe
  2⤵
  PID:3544
- C:\Windows\System\XsLyrFX.exe
  C:\Windows\System\XsLyrFX.exe
  2⤵
  PID:1652
- C:\Windows\System\NsakTxF.exe
  C:\Windows\System\NsakTxF.exe
  2⤵
  PID:3000
- C:\Windows\System\QPZrPHP.exe
  C:\Windows\System\QPZrPHP.exe
  2⤵
  PID:1980
- C:\Windows\System\YRGVxQL.exe
  C:\Windows\System\YRGVxQL.exe
  2⤵
  PID:2524
- C:\Windows\System\UGUYeFE.exe
  C:\Windows\System\UGUYeFE.exe
  2⤵
  PID:2728
- C:\Windows\System\pLLoIPp.exe
  C:\Windows\System\pLLoIPp.exe
  2⤵
  PID:3564
- C:\Windows\System\MVbdNsj.exe
  C:\Windows\System\MVbdNsj.exe
  2⤵
  PID:3580
- C:\Windows\System\jKqzrFl.exe
  C:\Windows\System\jKqzrFl.exe
  2⤵
  PID:3648
- C:\Windows\System\HZTicaI.exe
  C:\Windows\System\HZTicaI.exe
  2⤵
  PID:3712
- C:\Windows\System\najaXQq.exe
  C:\Windows\System\najaXQq.exe
  2⤵
  PID:3780
- C:\Windows\System\xyLvmhR.exe
  C:\Windows\System\xyLvmhR.exe
  2⤵
  PID:3844
- C:\Windows\System\FByhHvd.exe
  C:\Windows\System\FByhHvd.exe
  2⤵
  PID:3884
- C:\Windows\System\tLmbBuZ.exe
  C:\Windows\System\tLmbBuZ.exe
  2⤵
  PID:3948
- C:\Windows\System\nxheHip.exe
  C:\Windows\System\nxheHip.exe
  2⤵
  PID:3960
- C:\Windows\System\lphQfMW.exe
  C:\Windows\System\lphQfMW.exe
  2⤵
  PID:3760
- C:\Windows\System\utlgsCg.exe
  C:\Windows\System\utlgsCg.exe
  2⤵
  PID:3896
- C:\Windows\System\fFAxhNm.exe
  C:\Windows\System\fFAxhNm.exe
  2⤵
  PID:3964
- C:\Windows\System\EKIukIy.exe
  C:\Windows\System\EKIukIy.exe
  2⤵
  PID:3980
- C:\Windows\System\QGOwwku.exe
  C:\Windows\System\QGOwwku.exe
  2⤵
  PID:904
- C:\Windows\System\uVHdEyg.exe
  C:\Windows\System\uVHdEyg.exe
  2⤵
  PID:2084
- C:\Windows\System\GXmxhmn.exe
  C:\Windows\System\GXmxhmn.exe
  2⤵
  PID:3088
- C:\Windows\System\jPFCWaY.exe
  C:\Windows\System\jPFCWaY.exe
  2⤵
  PID:3204
- C:\Windows\System\gHvKutu.exe
  C:\Windows\System\gHvKutu.exe
  2⤵
  PID:2040
- C:\Windows\System\WYNQheC.exe
  C:\Windows\System\WYNQheC.exe
  2⤵
  PID:3124
- C:\Windows\System\CtCrRVT.exe
  C:\Windows\System\CtCrRVT.exe
  2⤵
  PID:3248
- C:\Windows\System\DaSxwVh.exe
  C:\Windows\System\DaSxwVh.exe
  2⤵
  PID:1788
- C:\Windows\System\WqZyvrE.exe
  C:\Windows\System\WqZyvrE.exe
  2⤵
  PID:3416
- C:\Windows\System\PsbGoxN.exe
  C:\Windows\System\PsbGoxN.exe
  2⤵
  PID:1952
- C:\Windows\System\UsSgwsF.exe
  C:\Windows\System\UsSgwsF.exe
  2⤵
  PID:2640
- C:\Windows\System\iOnBVsj.exe
  C:\Windows\System\iOnBVsj.exe
  2⤵
  PID:900
- C:\Windows\System\mSpJtIP.exe
  C:\Windows\System\mSpJtIP.exe
  2⤵
  PID:2516
- C:\Windows\System\yFdtuao.exe
  C:\Windows\System\yFdtuao.exe
  2⤵
  PID:1012
- C:\Windows\System\zdKUdvs.exe
  C:\Windows\System\zdKUdvs.exe
  2⤵
  PID:3180
- C:\Windows\System\lRuGCVU.exe
  C:\Windows\System\lRuGCVU.exe
  2⤵
  PID:3228
- C:\Windows\System\ADuTvRq.exe
  C:\Windows\System\ADuTvRq.exe
  2⤵
  PID:3540
- C:\Windows\System\XmgYqTh.exe
  C:\Windows\System\XmgYqTh.exe
  2⤵
  PID:2680
- C:\Windows\System\ZRGTMGR.exe
  C:\Windows\System\ZRGTMGR.exe
  2⤵
  PID:3744
- C:\Windows\System\AguQXvu.exe
  C:\Windows\System\AguQXvu.exe
  2⤵
  PID:3624
- C:\Windows\System\WwbjiXD.exe
  C:\Windows\System\WwbjiXD.exe
  2⤵
  PID:3828
- C:\Windows\System\PoRfaEu.exe
  C:\Windows\System\PoRfaEu.exe
  2⤵
  PID:1760
- C:\Windows\System\GxNIePU.exe
  C:\Windows\System\GxNIePU.exe
  2⤵
  PID:3328
- C:\Windows\System\JRciKKb.exe
  C:\Windows\System\JRciKKb.exe
  2⤵
  PID:2992
- C:\Windows\System\thnPubF.exe
  C:\Windows\System\thnPubF.exe
  2⤵
  PID:3864
- C:\Windows\System\fxMhmfU.exe
  C:\Windows\System\fxMhmfU.exe
  2⤵
  PID:4064
- C:\Windows\System\QAsGmsD.exe
  C:\Windows\System\QAsGmsD.exe
  2⤵
  PID:4076
- C:\Windows\System\FnTBdBC.exe
  C:\Windows\System\FnTBdBC.exe
  2⤵
  PID:4008
- C:\Windows\System\BMKapWN.exe
  C:\Windows\System\BMKapWN.exe
  2⤵
  PID:4020
- C:\Windows\System\jFoozgl.exe
  C:\Windows\System\jFoozgl.exe
  2⤵
  PID:3692
- C:\Windows\System\MBsuTEp.exe
  C:\Windows\System\MBsuTEp.exe
  2⤵
  PID:580
- C:\Windows\System\yuQGcZG.exe
  C:\Windows\System\yuQGcZG.exe
  2⤵
  PID:3264
- C:\Windows\System\jaskDIb.exe
  C:\Windows\System\jaskDIb.exe
  2⤵
  PID:4108
- C:\Windows\System\TRKWGeL.exe
  C:\Windows\System\TRKWGeL.exe
  2⤵
  PID:4124
- C:\Windows\System\eBbaYtM.exe
  C:\Windows\System\eBbaYtM.exe
  2⤵
  PID:4140
- C:\Windows\System\fbzydkO.exe
  C:\Windows\System\fbzydkO.exe
  2⤵
  PID:4160
- C:\Windows\System\roImxVM.exe
  C:\Windows\System\roImxVM.exe
  2⤵
  PID:4180
- C:\Windows\System\XLCVwnz.exe
  C:\Windows\System\XLCVwnz.exe
  2⤵
  PID:4196
- C:\Windows\System\XubLISX.exe
  C:\Windows\System\XubLISX.exe
  2⤵
  PID:4220
- C:\Windows\System\UVtTFsV.exe
  C:\Windows\System\UVtTFsV.exe
  2⤵
  PID:4236
- C:\Windows\System\mfnBcpu.exe
  C:\Windows\System\mfnBcpu.exe
  2⤵
  PID:4252
- C:\Windows\System\YheLzlf.exe
  C:\Windows\System\YheLzlf.exe
  2⤵
  PID:4268
- C:\Windows\System\lJNSjhy.exe
  C:\Windows\System\lJNSjhy.exe
  2⤵
  PID:4284
- C:\Windows\System\RdsRQyE.exe
  C:\Windows\System\RdsRQyE.exe
  2⤵
  PID:4300
- C:\Windows\System\joGFCLv.exe
  C:\Windows\System\joGFCLv.exe
  2⤵
  PID:4316
- C:\Windows\System\ualLQvk.exe
  C:\Windows\System\ualLQvk.exe
  2⤵
  PID:4332
- C:\Windows\System\XaHQqZi.exe
  C:\Windows\System\XaHQqZi.exe
  2⤵
  PID:4348
- C:\Windows\System\ukGvhMY.exe
  C:\Windows\System\ukGvhMY.exe
  2⤵
  PID:4364
- C:\Windows\System\FsOUHIj.exe
  C:\Windows\System\FsOUHIj.exe
  2⤵
  PID:4380
- C:\Windows\System\qzIwWaT.exe
  C:\Windows\System\qzIwWaT.exe
  2⤵
  PID:4400
- C:\Windows\System\PqsZgdc.exe
  C:\Windows\System\PqsZgdc.exe
  2⤵
  PID:4416
- C:\Windows\System\ESmLWtG.exe
  C:\Windows\System\ESmLWtG.exe
  2⤵
  PID:4432
- C:\Windows\System\kFmAaxY.exe
  C:\Windows\System\kFmAaxY.exe
  2⤵
  PID:4448
- C:\Windows\System\PcqevkQ.exe
  C:\Windows\System\PcqevkQ.exe
  2⤵
  PID:4464
- C:\Windows\System\gTFNJXI.exe
  C:\Windows\System\gTFNJXI.exe
  2⤵
  PID:4484
- C:\Windows\System\DqItIKm.exe
  C:\Windows\System\DqItIKm.exe
  2⤵
  PID:4500
- C:\Windows\System\TdsZrrj.exe
  C:\Windows\System\TdsZrrj.exe
  2⤵
  PID:4516
- C:\Windows\System\PSkEHFi.exe
  C:\Windows\System\PSkEHFi.exe
  2⤵
  PID:4536
- C:\Windows\System\PeXXpne.exe
  C:\Windows\System\PeXXpne.exe
  2⤵
  PID:4552
- C:\Windows\System\gCFurNF.exe
  C:\Windows\System\gCFurNF.exe
  2⤵
  PID:4568
- C:\Windows\System\XOPEvcI.exe
  C:\Windows\System\XOPEvcI.exe
  2⤵
  PID:4584
- C:\Windows\System\gIugpyo.exe
  C:\Windows\System\gIugpyo.exe
  2⤵
  PID:4600
- C:\Windows\System\CuVWiVk.exe
  C:\Windows\System\CuVWiVk.exe
  2⤵
  PID:4616
- C:\Windows\System\znXYyJy.exe
  C:\Windows\System\znXYyJy.exe
  2⤵
  PID:4632
- C:\Windows\System\qxfIhrs.exe
  C:\Windows\System\qxfIhrs.exe
  2⤵
  PID:4648
- C:\Windows\System\FgdTgGx.exe
  C:\Windows\System\FgdTgGx.exe
  2⤵
  PID:4664
- C:\Windows\System\kTkkdQw.exe
  C:\Windows\System\kTkkdQw.exe
  2⤵
  PID:4680
- C:\Windows\System\oCgeYlY.exe
  C:\Windows\System\oCgeYlY.exe
  2⤵
  PID:4696
- C:\Windows\System\lalmApu.exe
  C:\Windows\System\lalmApu.exe
  2⤵
  PID:4724
- C:\Windows\System\OFzzTdm.exe
  C:\Windows\System\OFzzTdm.exe
  2⤵
  PID:4764
- C:\Windows\System\uHwkHsu.exe
  C:\Windows\System\uHwkHsu.exe
  2⤵
  PID:4784
- C:\Windows\System\XnFmWPZ.exe
  C:\Windows\System\XnFmWPZ.exe
  2⤵
  PID:4800
- C:\Windows\System\XQowjQB.exe
  C:\Windows\System\XQowjQB.exe
  2⤵
  PID:4816
- C:\Windows\System\vLGhoCc.exe
  C:\Windows\System\vLGhoCc.exe
  2⤵
  PID:4832
- C:\Windows\System\sGMEuym.exe
  C:\Windows\System\sGMEuym.exe
  2⤵
  PID:4848
- C:\Windows\System\bumpIeU.exe
  C:\Windows\System\bumpIeU.exe
  2⤵
  PID:4864
- C:\Windows\System\DKQDanE.exe
  C:\Windows\System\DKQDanE.exe
  2⤵
  PID:4880
- C:\Windows\System\JRiKDqP.exe
  C:\Windows\System\JRiKDqP.exe
  2⤵
  PID:4896
- C:\Windows\System\EKvzSnw.exe
  C:\Windows\System\EKvzSnw.exe
  2⤵
  PID:4912
- C:\Windows\System\iavtdmY.exe
  C:\Windows\System\iavtdmY.exe
  2⤵
  PID:4928
- C:\Windows\System\jJRvLIJ.exe
  C:\Windows\System\jJRvLIJ.exe
  2⤵
  PID:4944
- C:\Windows\System\xZeTkmV.exe
  C:\Windows\System\xZeTkmV.exe
  2⤵
  PID:4960
- C:\Windows\System\lcdegDE.exe
  C:\Windows\System\lcdegDE.exe
  2⤵
  PID:4976
- C:\Windows\System\wdLIrAp.exe
  C:\Windows\System\wdLIrAp.exe
  2⤵
  PID:4992
- C:\Windows\System\ysLdGBX.exe
  C:\Windows\System\ysLdGBX.exe
  2⤵
  PID:5008
- C:\Windows\System\SBsodYJ.exe
  C:\Windows\System\SBsodYJ.exe
  2⤵
  PID:5024
- C:\Windows\System\Wmdphmc.exe
  C:\Windows\System\Wmdphmc.exe
  2⤵
  PID:5040
- C:\Windows\System\TUrUJHW.exe
  C:\Windows\System\TUrUJHW.exe
  2⤵
  PID:5056
- C:\Windows\System\QnymZVA.exe
  C:\Windows\System\QnymZVA.exe
  2⤵
  PID:5072
- C:\Windows\System\vxEewBU.exe
  C:\Windows\System\vxEewBU.exe
  2⤵
  PID:5088
- C:\Windows\System\dEBinYu.exe
  C:\Windows\System\dEBinYu.exe
  2⤵
  PID:5104
- C:\Windows\System\NgzocVa.exe
  C:\Windows\System\NgzocVa.exe
  2⤵
  PID:2660
- C:\Windows\System\bqUiVIs.exe
  C:\Windows\System\bqUiVIs.exe
  2⤵
  PID:2924
- C:\Windows\System\BPewFzg.exe
  C:\Windows\System\BPewFzg.exe
  2⤵
  PID:3424
- C:\Windows\System\HMzEajC.exe
  C:\Windows\System\HMzEajC.exe
  2⤵
  PID:1512
- C:\Windows\System\kpIcWpQ.exe
  C:\Windows\System\kpIcWpQ.exe
  2⤵
  PID:3876
- C:\Windows\System\wZDvclt.exe
  C:\Windows\System\wZDvclt.exe
  2⤵
  PID:1496
- C:\Windows\System\JOfgLQd.exe
  C:\Windows\System\JOfgLQd.exe
  2⤵
  PID:4000
- C:\Windows\System\qNveLqn.exe
  C:\Windows\System\qNveLqn.exe
  2⤵
  PID:3140
- C:\Windows\System\ZAoXZWn.exe
  C:\Windows\System\ZAoXZWn.exe
  2⤵
  PID:4152
- C:\Windows\System\BPwDVWb.exe
  C:\Windows\System\BPwDVWb.exe
  2⤵
  PID:4228
- C:\Windows\System\qXIDmXG.exe
  C:\Windows\System\qXIDmXG.exe
  2⤵
  PID:2804
- C:\Windows\System\ixgbdSf.exe
  C:\Windows\System\ixgbdSf.exe
  2⤵
  PID:3708
- C:\Windows\System\iAWXODt.exe
  C:\Windows\System\iAWXODt.exe
  2⤵
  PID:3944
- C:\Windows\System\EcDwoOO.exe
  C:\Windows\System\EcDwoOO.exe
  2⤵
  PID:3988
- C:\Windows\System\ZYmDijV.exe
  C:\Windows\System\ZYmDijV.exe
  2⤵
  PID:2800
- C:\Windows\System\kdHDGlc.exe
  C:\Windows\System\kdHDGlc.exe
  2⤵
  PID:3084
- C:\Windows\System\lVuwepw.exe
  C:\Windows\System\lVuwepw.exe
  2⤵
  PID:3408
- C:\Windows\System\rNtSkZB.exe
  C:\Windows\System\rNtSkZB.exe
  2⤵
  PID:3516
- C:\Windows\System\iEKZSjx.exe
  C:\Windows\System\iEKZSjx.exe
  2⤵
  PID:4264
- C:\Windows\System\YuNjNlI.exe
  C:\Windows\System\YuNjNlI.exe
  2⤵
  PID:4328
- C:\Windows\System\MyreNvy.exe
  C:\Windows\System\MyreNvy.exe
  2⤵
  PID:4392
- C:\Windows\System\iWQzaRm.exe
  C:\Windows\System\iWQzaRm.exe
  2⤵
  PID:4456
- C:\Windows\System\MvaLEoA.exe
  C:\Windows\System\MvaLEoA.exe
  2⤵
  PID:4524
- C:\Windows\System\INZZciG.exe
  C:\Windows\System\INZZciG.exe
  2⤵
  PID:4564
- C:\Windows\System\JJoLUVP.exe
  C:\Windows\System\JJoLUVP.exe
  2⤵
  PID:4628
- C:\Windows\System\qdEsdbT.exe
  C:\Windows\System\qdEsdbT.exe
  2⤵
  PID:4692
- C:\Windows\System\EJLCFSe.exe
  C:\Windows\System\EJLCFSe.exe
  2⤵
  PID:4744
- C:\Windows\System\fcEJcHR.exe
  C:\Windows\System\fcEJcHR.exe
  2⤵
  PID:4736
- C:\Windows\System\vYRlVrE.exe
  C:\Windows\System\vYRlVrE.exe
  2⤵
  PID:4044
- C:\Windows\System\TOUZkol.exe
  C:\Windows\System\TOUZkol.exe
  2⤵
  PID:3660
- C:\Windows\System\jdficQI.exe
  C:\Windows\System\jdficQI.exe
  2⤵
  PID:4132
- C:\Windows\System\njgrPxC.exe
  C:\Windows\System\njgrPxC.exe
  2⤵
  PID:4176
- C:\Windows\System\HvQPlSF.exe
  C:\Windows\System\HvQPlSF.exe
  2⤵
  PID:4216
- C:\Windows\System\khyMEkI.exe
  C:\Windows\System\khyMEkI.exe
  2⤵
  PID:4276
- C:\Windows\System\DkQpdMB.exe
  C:\Windows\System\DkQpdMB.exe
  2⤵
  PID:4408
- C:\Windows\System\LkNdWPe.exe
  C:\Windows\System\LkNdWPe.exe
  2⤵
  PID:4828
- C:\Windows\System\tbPyxaR.exe
  C:\Windows\System\tbPyxaR.exe
  2⤵
  PID:4548
- C:\Windows\System\qgqppdi.exe
  C:\Windows\System\qgqppdi.exe
  2⤵
  PID:4608
- C:\Windows\System\wCWlOGI.exe
  C:\Windows\System\wCWlOGI.exe
  2⤵
  PID:1452
- C:\Windows\System\tmLOPSm.exe
  C:\Windows\System\tmLOPSm.exe
  2⤵
  PID:4676
- C:\Windows\System\qJtIdaf.exe
  C:\Windows\System\qJtIdaf.exe
  2⤵
  PID:4860
- C:\Windows\System\dIAxzqT.exe
  C:\Windows\System\dIAxzqT.exe
  2⤵
  PID:4924
- C:\Windows\System\AeEwAal.exe
  C:\Windows\System\AeEwAal.exe
  2⤵
  PID:2060
- C:\Windows\System\nqIzvFi.exe
  C:\Windows\System\nqIzvFi.exe
  2⤵
  PID:4172
- C:\Windows\System\HePAOGw.exe
  C:\Windows\System\HePAOGw.exe
  2⤵
  PID:4376
- C:\Windows\System\qGFbhPH.exe
  C:\Windows\System\qGFbhPH.exe
  2⤵
  PID:4512
- C:\Windows\System\dIQHJIx.exe
  C:\Windows\System\dIQHJIx.exe
  2⤵
  PID:1340
- C:\Windows\System\HXmdpHl.exe
  C:\Windows\System\HXmdpHl.exe
  2⤵
  PID:3432
- C:\Windows\System\eWjzFHJ.exe
  C:\Windows\System\eWjzFHJ.exe
  2⤵
  PID:1596
- C:\Windows\System\vJrrgsH.exe
  C:\Windows\System\vJrrgsH.exe
  2⤵
  PID:5048
- C:\Windows\System\FVIxSdS.exe
  C:\Windows\System\FVIxSdS.exe
  2⤵
  PID:4772
- C:\Windows\System\JkOPWic.exe
  C:\Windows\System\JkOPWic.exe
  2⤵
  PID:4812
- C:\Windows\System\zJAztIC.exe
  C:\Windows\System\zJAztIC.exe
  2⤵
  PID:4876
- C:\Windows\System\vDHhaah.exe
  C:\Windows\System\vDHhaah.exe
  2⤵
  PID:4972
- C:\Windows\System\rzsWjLw.exe
  C:\Windows\System\rzsWjLw.exe
  2⤵
  PID:5032
- C:\Windows\System\IesoyQG.exe
  C:\Windows\System\IesoyQG.exe
  2⤵
  PID:4028
- C:\Windows\System\BTKJCQh.exe
  C:\Windows\System\BTKJCQh.exe
  2⤵
  PID:5068
- C:\Windows\System\aDoqofN.exe
  C:\Windows\System\aDoqofN.exe
  2⤵
  PID:2020
- C:\Windows\System\ZUFnLzA.exe
  C:\Windows\System\ZUFnLzA.exe
  2⤵
  PID:2184
- C:\Windows\System\IMwBFzt.exe
  C:\Windows\System\IMwBFzt.exe
  2⤵
  PID:2032
- C:\Windows\System\UKmdExv.exe
  C:\Windows\System\UKmdExv.exe
  2⤵
  PID:4148
- C:\Windows\System\YmOrTFQ.exe
  C:\Windows\System\YmOrTFQ.exe
  2⤵
  PID:3724
- C:\Windows\System\FbFGDoC.exe
  C:\Windows\System\FbFGDoC.exe
  2⤵
  PID:4192
- C:\Windows\System\JvCFlDv.exe
  C:\Windows\System\JvCFlDv.exe
  2⤵
  PID:3476
- C:\Windows\System\WmEoisq.exe
  C:\Windows\System\WmEoisq.exe
  2⤵
  PID:2612
- C:\Windows\System\zznaODt.exe
  C:\Windows\System\zznaODt.exe
  2⤵
  PID:3244
- C:\Windows\System\dZOTDxz.exe
  C:\Windows\System\dZOTDxz.exe
  2⤵
  PID:4360
- C:\Windows\System\YEgEQoC.exe
  C:\Windows\System\YEgEQoC.exe
  2⤵
  PID:4492
- C:\Windows\System\RiQxtpf.exe
  C:\Windows\System\RiQxtpf.exe
  2⤵
  PID:4596
- C:\Windows\System\LdOrDkw.exe
  C:\Windows\System\LdOrDkw.exe
  2⤵
  PID:4424
- C:\Windows\System\fRoWCrl.exe
  C:\Windows\System\fRoWCrl.exe
  2⤵
  PID:592
- C:\Windows\System\kckrDhp.exe
  C:\Windows\System\kckrDhp.exe
  2⤵
  PID:4660
- C:\Windows\System\MCeiYqd.exe
  C:\Windows\System\MCeiYqd.exe
  2⤵
  PID:4016
- C:\Windows\System\nURsLTz.exe
  C:\Windows\System\nURsLTz.exe
  2⤵
  PID:1060
- C:\Windows\System\CZbePaC.exe
  C:\Windows\System\CZbePaC.exe
  2⤵
  PID:4824
- C:\Windows\System\xEDgFJS.exe
  C:\Windows\System\xEDgFJS.exe
  2⤵
  PID:4672
- C:\Windows\System\rnSOoGS.exe
  C:\Windows\System\rnSOoGS.exe
  2⤵
  PID:1928
- C:\Windows\System\osFMwZK.exe
  C:\Windows\System\osFMwZK.exe
  2⤵
  PID:5020
- C:\Windows\System\RJDTupp.exe
  C:\Windows\System\RJDTupp.exe
  2⤵
  PID:4208
- C:\Windows\System\HnFbdlp.exe
  C:\Windows\System\HnFbdlp.exe
  2⤵
  PID:2636
- C:\Windows\System\POaRjsh.exe
  C:\Windows\System\POaRjsh.exe
  2⤵
  PID:3556
- C:\Windows\System\KekfjUG.exe
  C:\Windows\System\KekfjUG.exe
  2⤵
  PID:5036
- C:\Windows\System\vzuErty.exe
  C:\Windows\System\vzuErty.exe
  2⤵
  PID:4444
- C:\Windows\System\beqgKvm.exe
  C:\Windows\System\beqgKvm.exe
  2⤵
  PID:4888
- C:\Windows\System\wrQQpDl.exe
  C:\Windows\System\wrQQpDl.exe
  2⤵
  PID:3992
- C:\Windows\System\VRBQlUm.exe
  C:\Windows\System\VRBQlUm.exe
  2⤵
  PID:1996
- C:\Windows\System\RXoeYDo.exe
  C:\Windows\System\RXoeYDo.exe
  2⤵
  PID:4716
- C:\Windows\System\ECCZgYK.exe
  C:\Windows\System\ECCZgYK.exe
  2⤵
  PID:5004
- C:\Windows\System\LhUqpVF.exe
  C:\Windows\System\LhUqpVF.exe
  2⤵
  PID:3492
- C:\Windows\System\kfzOBhk.exe
  C:\Windows\System\kfzOBhk.exe
  2⤵
  PID:1664
- C:\Windows\System\GAbofWp.exe
  C:\Windows\System\GAbofWp.exe
  2⤵
  PID:3448
- C:\Windows\System\fzlDzGZ.exe
  C:\Windows\System\fzlDzGZ.exe
  2⤵
  PID:3680
- C:\Windows\System\alZUjec.exe
  C:\Windows\System\alZUjec.exe
  2⤵
  PID:4292
- C:\Windows\System\PnJPrXO.exe
  C:\Windows\System\PnJPrXO.exe
  2⤵
  PID:4796
- C:\Windows\System\XCJgWHa.exe
  C:\Windows\System\XCJgWHa.exe
  2⤵
  PID:4644
- C:\Windows\System\DLFyKDA.exe
  C:\Windows\System\DLFyKDA.exe
  2⤵
  PID:4480
- C:\Windows\System\udRiDag.exe
  C:\Windows\System\udRiDag.exe
  2⤵
  PID:2816
- C:\Windows\System\UIggVBy.exe
  C:\Windows\System\UIggVBy.exe
  2⤵
  PID:1608
- C:\Windows\System\bRtYMRy.exe
  C:\Windows\System\bRtYMRy.exe
  2⤵
  PID:3308
- C:\Windows\System\EOvdGLt.exe
  C:\Windows\System\EOvdGLt.exe
  2⤵
  PID:584
- C:\Windows\System\axrTwcC.exe
  C:\Windows\System\axrTwcC.exe
  2⤵
  PID:3388
- C:\Windows\System\PYbogiB.exe
  C:\Windows\System\PYbogiB.exe
  2⤵
  PID:4324
- C:\Windows\System\VfvmlXZ.exe
  C:\Windows\System\VfvmlXZ.exe
  2⤵
  PID:1332
- C:\Windows\System\SkGUhsf.exe
  C:\Windows\System\SkGUhsf.exe
  2⤵
  PID:2972
- C:\Windows\System\hVhQWyP.exe
  C:\Windows\System\hVhQWyP.exe
  2⤵
  PID:4100
- C:\Windows\System\kVGskcL.exe
  C:\Windows\System\kVGskcL.exe
  2⤵
  PID:3324
- C:\Windows\System\mMGqFid.exe
  C:\Windows\System\mMGqFid.exe
  2⤵
  PID:3572
- C:\Windows\System\NKqbGid.exe
  C:\Windows\System\NKqbGid.exe
  2⤵
  PID:3968
- C:\Windows\System\uPChbqh.exe
  C:\Windows\System\uPChbqh.exe
  2⤵
  PID:4844
- C:\Windows\System\ihIYCSl.exe
  C:\Windows\System\ihIYCSl.exe
  2⤵
  PID:1684
- C:\Windows\System\jlbRTDF.exe
  C:\Windows\System\jlbRTDF.exe
  2⤵
  PID:2712
- C:\Windows\System\dOQtdyD.exe
  C:\Windows\System\dOQtdyD.exe
  2⤵
  PID:4560
- C:\Windows\System\WgGHSjF.exe
  C:\Windows\System\WgGHSjF.exe
  2⤵
  PID:4116
- C:\Windows\System\mDfkLhZ.exe
  C:\Windows\System\mDfkLhZ.exe
  2⤵
  PID:5136
- C:\Windows\System\vGQtljZ.exe
  C:\Windows\System\vGQtljZ.exe
  2⤵
  PID:5156
- C:\Windows\System\YeoJpnZ.exe
  C:\Windows\System\YeoJpnZ.exe
  2⤵
  PID:5172
- C:\Windows\System\rjNiSGC.exe
  C:\Windows\System\rjNiSGC.exe
  2⤵
  PID:5188
- C:\Windows\System\YmWYkmw.exe
  C:\Windows\System\YmWYkmw.exe
  2⤵
  PID:5204
- C:\Windows\System\jnfcjIw.exe
  C:\Windows\System\jnfcjIw.exe
  2⤵
  PID:5220
- C:\Windows\System\GjTqtKZ.exe
  C:\Windows\System\GjTqtKZ.exe
  2⤵
  PID:5236
- C:\Windows\System\DlKMoHM.exe
  C:\Windows\System\DlKMoHM.exe
  2⤵
  PID:5260
- C:\Windows\System\RwAWmWJ.exe
  C:\Windows\System\RwAWmWJ.exe
  2⤵
  PID:5276
- C:\Windows\System\yqTsZoy.exe
  C:\Windows\System\yqTsZoy.exe
  2⤵
  PID:5292
- C:\Windows\System\uTUxDDu.exe
  C:\Windows\System\uTUxDDu.exe
  2⤵
  PID:5308
- C:\Windows\System\tKICFEn.exe
  C:\Windows\System\tKICFEn.exe
  2⤵
  PID:5324
- C:\Windows\System\BlFNIQw.exe
  C:\Windows\System\BlFNIQw.exe
  2⤵
  PID:5340
- C:\Windows\System\nUlRUgO.exe
  C:\Windows\System\nUlRUgO.exe
  2⤵
  PID:5360
- C:\Windows\System\EUXAdwm.exe
  C:\Windows\System\EUXAdwm.exe
  2⤵
  PID:5376
- C:\Windows\System\wFQiEZx.exe
  C:\Windows\System\wFQiEZx.exe
  2⤵
  PID:5392
- C:\Windows\System\DHptFSZ.exe
  C:\Windows\System\DHptFSZ.exe
  2⤵
  PID:5408
- C:\Windows\System\iYLijxm.exe
  C:\Windows\System\iYLijxm.exe
  2⤵
  PID:5424
- C:\Windows\System\OVLdUEq.exe
  C:\Windows\System\OVLdUEq.exe
  2⤵
  PID:5440
- C:\Windows\System\SOQuyFh.exe
  C:\Windows\System\SOQuyFh.exe
  2⤵
  PID:5456
- C:\Windows\System\aBiZuKS.exe
  C:\Windows\System\aBiZuKS.exe
  2⤵
  PID:5472
- C:\Windows\System\tzGfZqj.exe
  C:\Windows\System\tzGfZqj.exe
  2⤵
  PID:5488
- C:\Windows\System\mRBeRQV.exe
  C:\Windows\System\mRBeRQV.exe
  2⤵
  PID:5504
- C:\Windows\System\PEKOeay.exe
  C:\Windows\System\PEKOeay.exe
  2⤵
  PID:5520
- C:\Windows\System\ggtAuBe.exe
  C:\Windows\System\ggtAuBe.exe
  2⤵
  PID:5536
- C:\Windows\System\LHonrbS.exe
  C:\Windows\System\LHonrbS.exe
  2⤵
  PID:5552
- C:\Windows\System\ugovMLm.exe
  C:\Windows\System\ugovMLm.exe
  2⤵
  PID:5568
- C:\Windows\System\XzDljyO.exe
  C:\Windows\System\XzDljyO.exe
  2⤵
  PID:5584
- C:\Windows\System\MeCWDqV.exe
  C:\Windows\System\MeCWDqV.exe
  2⤵
  PID:5600
- C:\Windows\System\oksbScw.exe
  C:\Windows\System\oksbScw.exe
  2⤵
  PID:5616
- C:\Windows\System\ZojLKKH.exe
  C:\Windows\System\ZojLKKH.exe
  2⤵
  PID:5632
- C:\Windows\System\JMsgzBG.exe
  C:\Windows\System\JMsgzBG.exe
  2⤵
  PID:5648
- C:\Windows\System\NxjjOjF.exe
  C:\Windows\System\NxjjOjF.exe
  2⤵
  PID:5664
- C:\Windows\System\ZTvFPGP.exe
  C:\Windows\System\ZTvFPGP.exe
  2⤵
  PID:5680
- C:\Windows\System\eahfXsB.exe
  C:\Windows\System\eahfXsB.exe
  2⤵
  PID:5696
- C:\Windows\System\HuSGXMG.exe
  C:\Windows\System\HuSGXMG.exe
  2⤵
  PID:5712
- C:\Windows\System\YMoiGpB.exe
  C:\Windows\System\YMoiGpB.exe
  2⤵
  PID:5728
- C:\Windows\System\BEHkliJ.exe
  C:\Windows\System\BEHkliJ.exe
  2⤵
  PID:5744
- C:\Windows\System\YebRpiF.exe
  C:\Windows\System\YebRpiF.exe
  2⤵
  PID:5760
- C:\Windows\System\WuyNtbG.exe
  C:\Windows\System\WuyNtbG.exe
  2⤵
  PID:5776
- C:\Windows\System\kzBFmsj.exe
  C:\Windows\System\kzBFmsj.exe
  2⤵
  PID:5792
- C:\Windows\System\GjJfoRE.exe
  C:\Windows\System\GjJfoRE.exe
  2⤵
  PID:5808
- C:\Windows\System\lWNHAPO.exe
  C:\Windows\System\lWNHAPO.exe
  2⤵
  PID:5824
- C:\Windows\System\kNmLftX.exe
  C:\Windows\System\kNmLftX.exe
  2⤵
  PID:5840
- C:\Windows\System\ZohCWGU.exe
  C:\Windows\System\ZohCWGU.exe
  2⤵
  PID:5856
- C:\Windows\System\DPklRnF.exe
  C:\Windows\System\DPklRnF.exe
  2⤵
  PID:5872
- C:\Windows\System\NJypqyU.exe
  C:\Windows\System\NJypqyU.exe
  2⤵
  PID:5888
- C:\Windows\System\XkArYJw.exe
  C:\Windows\System\XkArYJw.exe
  2⤵
  PID:5904
- C:\Windows\System\zYKXciC.exe
  C:\Windows\System\zYKXciC.exe
  2⤵
  PID:5920
- C:\Windows\System\VLIdmcz.exe
  C:\Windows\System\VLIdmcz.exe
  2⤵
  PID:5936
- C:\Windows\System\fVcvEnj.exe
  C:\Windows\System\fVcvEnj.exe
  2⤵
  PID:5952
- C:\Windows\System\KOAwxHB.exe
  C:\Windows\System\KOAwxHB.exe
  2⤵
  PID:5968
- C:\Windows\System\pYmRyNg.exe
  C:\Windows\System\pYmRyNg.exe
  2⤵
  PID:5984
- C:\Windows\System\OiNYFMk.exe
  C:\Windows\System\OiNYFMk.exe
  2⤵
  PID:6000
- C:\Windows\System\RZJyFvO.exe
  C:\Windows\System\RZJyFvO.exe
  2⤵
  PID:6016
- C:\Windows\System\ayqlhFT.exe
  C:\Windows\System\ayqlhFT.exe
  2⤵
  PID:6032
- C:\Windows\System\DkFyZSd.exe
  C:\Windows\System\DkFyZSd.exe
  2⤵
  PID:6048
- C:\Windows\System\iSSyVlF.exe
  C:\Windows\System\iSSyVlF.exe
  2⤵
  PID:6064
- C:\Windows\System\NmixphJ.exe
  C:\Windows\System\NmixphJ.exe
  2⤵
  PID:6080
- C:\Windows\System\HjJFEOc.exe
  C:\Windows\System\HjJFEOc.exe
  2⤵
  PID:6096
- C:\Windows\System\CZGjbCX.exe
  C:\Windows\System\CZGjbCX.exe
  2⤵
  PID:6112
- C:\Windows\System\oExWbCr.exe
  C:\Windows\System\oExWbCr.exe
  2⤵
  PID:6128
- C:\Windows\System\vICNOda.exe
  C:\Windows\System\vICNOda.exe
  2⤵
  PID:4984
- C:\Windows\System\wKQcCBe.exe
  C:\Windows\System\wKQcCBe.exe
  2⤵
  PID:4580
- C:\Windows\System\kDmIUiJ.exe
  C:\Windows\System\kDmIUiJ.exe
  2⤵
  PID:5064
- C:\Windows\System\NMLzXfM.exe
  C:\Windows\System\NMLzXfM.exe
  2⤵
  PID:4808
- C:\Windows\System\QtYsbbh.exe
  C:\Windows\System\QtYsbbh.exe
  2⤵
  PID:2176
- C:\Windows\System\CgybEVB.exe
  C:\Windows\System\CgybEVB.exe
  2⤵
  PID:4344
- C:\Windows\System\COkhZxY.exe
  C:\Windows\System\COkhZxY.exe
  2⤵
  PID:4940
- C:\Windows\System\euZqxJT.exe
  C:\Windows\System\euZqxJT.exe
  2⤵
  PID:5184
- C:\Windows\System\TSmbFEK.exe
  C:\Windows\System\TSmbFEK.exe
  2⤵
  PID:5228
- C:\Windows\System\ncBhykA.exe
  C:\Windows\System\ncBhykA.exe
  2⤵
  PID:5212
- C:\Windows\System\YItiCRr.exe
  C:\Windows\System\YItiCRr.exe
  2⤵
  PID:5284
- C:\Windows\System\kuRCdZJ.exe
  C:\Windows\System\kuRCdZJ.exe
  2⤵
  PID:5304
- C:\Windows\System\KCrkgVr.exe
  C:\Windows\System\KCrkgVr.exe
  2⤵
  PID:5368
- C:\Windows\System\EBbuHAo.exe
  C:\Windows\System\EBbuHAo.exe
  2⤵
  PID:5288
- C:\Windows\System\vNiBcFo.exe
  C:\Windows\System\vNiBcFo.exe
  2⤵
  PID:5388
- C:\Windows\System\bXqJWRd.exe
  C:\Windows\System\bXqJWRd.exe
  2⤵
  PID:5432
- C:\Windows\System\qEIDRBL.exe
  C:\Windows\System\qEIDRBL.exe
  2⤵
  PID:5452
- C:\Windows\System\cwqqclJ.exe
  C:\Windows\System\cwqqclJ.exe
  2⤵
  PID:5528
- C:\Windows\System\ixsUECO.exe
  C:\Windows\System\ixsUECO.exe
  2⤵
  PID:5516
- C:\Windows\System\cQkcDIN.exe
  C:\Windows\System\cQkcDIN.exe
  2⤵
  PID:5592
- C:\Windows\System\pmsIEfH.exe
  C:\Windows\System\pmsIEfH.exe
  2⤵
  PID:5656
- C:\Windows\System\msRXDah.exe
  C:\Windows\System\msRXDah.exe
  2⤵
  PID:5724
- C:\Windows\System\fOYQgXd.exe
  C:\Windows\System\fOYQgXd.exe
  2⤵
  PID:5756
- C:\Windows\System\pArEiWs.exe
  C:\Windows\System\pArEiWs.exe
  2⤵
  PID:5820
- C:\Windows\System\jReyXHD.exe
  C:\Windows\System\jReyXHD.exe
  2⤵
  PID:5884
- C:\Windows\System\ErdQHIo.exe
  C:\Windows\System\ErdQHIo.exe
  2⤵
  PID:5948
- C:\Windows\System\YbSdGEr.exe
  C:\Windows\System\YbSdGEr.exe
  2⤵
  PID:5608
- C:\Windows\System\yBgWqjW.exe
  C:\Windows\System\yBgWqjW.exe
  2⤵
  PID:5832
- C:\Windows\System\gsAcSbS.exe
  C:\Windows\System\gsAcSbS.exe
  2⤵
  PID:5580
- C:\Windows\System\CfIbnqo.exe
  C:\Windows\System\CfIbnqo.exe
  2⤵
  PID:5644
- C:\Windows\System\JEcxBOJ.exe
  C:\Windows\System\JEcxBOJ.exe
  2⤵
  PID:5708
- C:\Windows\System\XPgecQZ.exe
  C:\Windows\System\XPgecQZ.exe
  2⤵
  PID:5960
- C:\Windows\System\yrFfPDI.exe
  C:\Windows\System\yrFfPDI.exe
  2⤵
  PID:5868
- C:\Windows\System\puVsGwP.exe
  C:\Windows\System\puVsGwP.exe
  2⤵
  PID:6028
- C:\Windows\System\yuDzHra.exe
  C:\Windows\System\yuDzHra.exe
  2⤵
  PID:6076
- C:\Windows\System\wmvIzRw.exe
  C:\Windows\System\wmvIzRw.exe
  2⤵
  PID:6140
- C:\Windows\System\eIJzbTT.exe
  C:\Windows\System\eIJzbTT.exe
  2⤵
  PID:4496
- C:\Windows\System\OgHMudK.exe
  C:\Windows\System\OgHMudK.exe
  2⤵
  PID:6136
- C:\Windows\System\xwgifOV.exe
  C:\Windows\System\xwgifOV.exe
  2⤵
  PID:5196
- C:\Windows\System\cBpezKh.exe
  C:\Windows\System\cBpezKh.exe
  2⤵
  PID:6124
- C:\Windows\System\fkQcssp.exe
  C:\Windows\System\fkQcssp.exe
  2⤵
  PID:5116
- C:\Windows\System\GfmnEzA.exe
  C:\Windows\System\GfmnEzA.exe
  2⤵
  PID:5180
- C:\Windows\System\obYHtYR.exe
  C:\Windows\System\obYHtYR.exe
  2⤵
  PID:5300
- C:\Windows\System\mDFpkXP.exe
  C:\Windows\System\mDFpkXP.exe
  2⤵
  PID:5416
- C:\Windows\System\LhrAdDz.exe
  C:\Windows\System\LhrAdDz.exe
  2⤵
  PID:5316
- C:\Windows\System\VvDJXgH.exe
  C:\Windows\System\VvDJXgH.exe
  2⤵
  PID:5400
- C:\Windows\System\Ijrncim.exe
  C:\Windows\System\Ijrncim.exe
  2⤵
  PID:5720
- C:\Windows\System\dSPfpYG.exe
  C:\Windows\System\dSPfpYG.exe
  2⤵
  PID:5256
- C:\Windows\System\LysnfpG.exe
  C:\Windows\System\LysnfpG.exe
  2⤵
  PID:5692
- C:\Windows\System\NEFqAqk.exe
  C:\Windows\System\NEFqAqk.exe
  2⤵
  PID:5772
- C:\Windows\System\WolCFso.exe
  C:\Windows\System\WolCFso.exe
  2⤵
  PID:5704
- C:\Windows\System\HBZTfup.exe
  C:\Windows\System\HBZTfup.exe
  2⤵
  PID:6024
- C:\Windows\System\KkGbxlG.exe
  C:\Windows\System\KkGbxlG.exe
  2⤵
  PID:5800
- C:\Windows\System\pmYMrzG.exe
  C:\Windows\System\pmYMrzG.exe
  2⤵
  PID:5944
- C:\Windows\System\gBgXgnj.exe
  C:\Windows\System\gBgXgnj.exe
  2⤵
  PID:5928
- C:\Windows\System\CsKsuGq.exe
  C:\Windows\System\CsKsuGq.exe
  2⤵
  PID:6108
- C:\Windows\System\PocLWbL.exe
  C:\Windows\System\PocLWbL.exe
  2⤵
  PID:1028
- C:\Windows\System\DHmcwOS.exe
  C:\Windows\System\DHmcwOS.exe
  2⤵
  PID:4372
- C:\Windows\System\kGIEMpx.exe
  C:\Windows\System\kGIEMpx.exe
  2⤵
  PID:1252
- C:\Windows\System\zFRgLuh.exe
  C:\Windows\System\zFRgLuh.exe
  2⤵
  PID:5332
- C:\Windows\System\FfUxGKJ.exe
  C:\Windows\System\FfUxGKJ.exe
  2⤵
  PID:5544
- C:\Windows\System\EigNfLB.exe
  C:\Windows\System\EigNfLB.exe
  2⤵
  PID:5836
- C:\Windows\System\tyRnXeB.exe
  C:\Windows\System\tyRnXeB.exe
  2⤵
  PID:5144
- C:\Windows\System\ANgjDuj.exe
  C:\Windows\System\ANgjDuj.exe
  2⤵
  PID:5752
- C:\Windows\System\jVBcpQs.exe
  C:\Windows\System\jVBcpQs.exe
  2⤵
  PID:6088
- C:\Windows\System\ihfLNGD.exe
  C:\Windows\System\ihfLNGD.exe
  2⤵
  PID:5272
- C:\Windows\System\xCSIpEb.exe
  C:\Windows\System\xCSIpEb.exe
  2⤵
  PID:5448
- C:\Windows\System\dijvTOL.exe
  C:\Windows\System\dijvTOL.exe
  2⤵
  PID:5880
- C:\Windows\System\ZxluNGm.exe
  C:\Windows\System\ZxluNGm.exe
  2⤵
  PID:5932
- C:\Windows\System\AvwlHFl.exe
  C:\Windows\System\AvwlHFl.exe
  2⤵
  PID:5896
- C:\Windows\System\yWoQRfA.exe
  C:\Windows\System\yWoQRfA.exe
  2⤵
  PID:5384
- C:\Windows\System\NEwIrjw.exe
  C:\Windows\System\NEwIrjw.exe
  2⤵
  PID:6156
- C:\Windows\System\zMVYKzq.exe
  C:\Windows\System\zMVYKzq.exe
  2⤵
  PID:6172
- C:\Windows\System\sHKPewo.exe
  C:\Windows\System\sHKPewo.exe
  2⤵
  PID:6192
- C:\Windows\System\BvKGjho.exe
  C:\Windows\System\BvKGjho.exe
  2⤵
  PID:6208
- C:\Windows\System\jWYiFDA.exe
  C:\Windows\System\jWYiFDA.exe
  2⤵
  PID:6224
- C:\Windows\System\HmMocDc.exe
  C:\Windows\System\HmMocDc.exe
  2⤵
  PID:6240
- C:\Windows\System\buXCCEw.exe
  C:\Windows\System\buXCCEw.exe
  2⤵
  PID:6264
- C:\Windows\System\iFJnIpY.exe
  C:\Windows\System\iFJnIpY.exe
  2⤵
  PID:6284
- C:\Windows\System\XOPDISd.exe
  C:\Windows\System\XOPDISd.exe
  2⤵
  PID:6300
- C:\Windows\System\EeRpDPu.exe
  C:\Windows\System\EeRpDPu.exe
  2⤵
  PID:6316
- C:\Windows\System\wsmPgXC.exe
  C:\Windows\System\wsmPgXC.exe
  2⤵
  PID:6332
- C:\Windows\System\UBGbhyF.exe
  C:\Windows\System\UBGbhyF.exe
  2⤵
  PID:6348
- C:\Windows\System\bhaOFdV.exe
  C:\Windows\System\bhaOFdV.exe
  2⤵
  PID:6368
- C:\Windows\System\moUcXkM.exe
  C:\Windows\System\moUcXkM.exe
  2⤵
  PID:6384
- C:\Windows\System\wxdviUD.exe
  C:\Windows\System\wxdviUD.exe
  2⤵
  PID:6400
- C:\Windows\System\JbpNZOE.exe
  C:\Windows\System\JbpNZOE.exe
  2⤵
  PID:6416
- C:\Windows\System\ULNxTey.exe
  C:\Windows\System\ULNxTey.exe
  2⤵
  PID:6432
- C:\Windows\System\nbPBSbn.exe
  C:\Windows\System\nbPBSbn.exe
  2⤵
  PID:6448
- C:\Windows\System\ubFEwse.exe
  C:\Windows\System\ubFEwse.exe
  2⤵
  PID:6464
- C:\Windows\System\PUPAPLq.exe
  C:\Windows\System\PUPAPLq.exe
  2⤵
  PID:6480
- C:\Windows\System\FBmTMOS.exe
  C:\Windows\System\FBmTMOS.exe
  2⤵
  PID:6588
- C:\Windows\System\fFVfjKy.exe
  C:\Windows\System\fFVfjKy.exe
  2⤵
  PID:6648
- C:\Windows\System\lldRpcg.exe
  C:\Windows\System\lldRpcg.exe
  2⤵
  PID:6668
- C:\Windows\System\wyIKfty.exe
  C:\Windows\System\wyIKfty.exe
  2⤵
  PID:6684
- C:\Windows\System\cLRxnUc.exe
  C:\Windows\System\cLRxnUc.exe
  2⤵
  PID:6700
- C:\Windows\System\yhAOqtS.exe
  C:\Windows\System\yhAOqtS.exe
  2⤵
  PID:6716
- C:\Windows\System\qFXdZOE.exe
  C:\Windows\System\qFXdZOE.exe
  2⤵
  PID:6732
- C:\Windows\System\THfydLp.exe
  C:\Windows\System\THfydLp.exe
  2⤵
  PID:6772
- C:\Windows\System\sHpIRjZ.exe
  C:\Windows\System\sHpIRjZ.exe
  2⤵
  PID:6792
- C:\Windows\System\QFwFFpS.exe
  C:\Windows\System\QFwFFpS.exe
  2⤵
  PID:6832
- C:\Windows\System\PdYVNTr.exe
  C:\Windows\System\PdYVNTr.exe
  2⤵
  PID:6864
- C:\Windows\System\bsjMTlh.exe
  C:\Windows\System\bsjMTlh.exe
  2⤵
  PID:6884
- C:\Windows\System\WHkDKqv.exe
  C:\Windows\System\WHkDKqv.exe
  2⤵
  PID:6904
- C:\Windows\System\QpRjgwU.exe
  C:\Windows\System\QpRjgwU.exe
  2⤵
  PID:6924
- C:\Windows\System\DloiSWC.exe
  C:\Windows\System\DloiSWC.exe
  2⤵
  PID:6944
- C:\Windows\System\rVfxMYc.exe
  C:\Windows\System\rVfxMYc.exe
  2⤵
  PID:6960
- C:\Windows\System\gbAPbrS.exe
  C:\Windows\System\gbAPbrS.exe
  2⤵
  PID:6976
- C:\Windows\System\GFfnxRA.exe
  C:\Windows\System\GFfnxRA.exe
  2⤵
  PID:7000
- C:\Windows\System\JQdbVFy.exe
  C:\Windows\System\JQdbVFy.exe
  2⤵
  PID:7016
- C:\Windows\System\gFHRJOR.exe
  C:\Windows\System\gFHRJOR.exe
  2⤵
  PID:7032
- C:\Windows\System\STyzHFx.exe
  C:\Windows\System\STyzHFx.exe
  2⤵
  PID:7048
- C:\Windows\System\gWVJRyK.exe
  C:\Windows\System\gWVJRyK.exe
  2⤵
  PID:7064
- C:\Windows\System\UIIaAyB.exe
  C:\Windows\System\UIIaAyB.exe
  2⤵
  PID:7084
- C:\Windows\System\HRgkurJ.exe
  C:\Windows\System\HRgkurJ.exe
  2⤵
  PID:7104
- C:\Windows\System\DQNjbbK.exe
  C:\Windows\System\DQNjbbK.exe
  2⤵
  PID:7124
- C:\Windows\System\nYmUupN.exe
  C:\Windows\System\nYmUupN.exe
  2⤵
  PID:7140
- C:\Windows\System\oRsYmrx.exe
  C:\Windows\System\oRsYmrx.exe
  2⤵
  PID:7156
- C:\Windows\System\knHzVLe.exe
  C:\Windows\System\knHzVLe.exe
  2⤵
  PID:5788
- C:\Windows\System\JFoRlZJ.exe
  C:\Windows\System\JFoRlZJ.exe
  2⤵
  PID:6104
- C:\Windows\System\NaLEUXj.exe
  C:\Windows\System\NaLEUXj.exe
  2⤵
  PID:6180
- C:\Windows\System\NpHdWWi.exe
  C:\Windows\System\NpHdWWi.exe
  2⤵
  PID:6220
- C:\Windows\System\VuHSrtL.exe
  C:\Windows\System\VuHSrtL.exe
  2⤵
  PID:6364
- C:\Windows\System\JhKDNyx.exe
  C:\Windows\System\JhKDNyx.exe
  2⤵
  PID:6472
- C:\Windows\System\XotinSl.exe
  C:\Windows\System\XotinSl.exe
  2⤵
  PID:6456
- C:\Windows\System\swotHQc.exe
  C:\Windows\System\swotHQc.exe
  2⤵
  PID:6492
- C:\Windows\System\APaNxQX.exe
  C:\Windows\System\APaNxQX.exe
  2⤵
  PID:6516
- C:\Windows\System\jlLHZWM.exe
  C:\Windows\System\jlLHZWM.exe
  2⤵
  PID:6532
- C:\Windows\System\HcTzwNn.exe
  C:\Windows\System\HcTzwNn.exe
  2⤵
  PID:6596
- C:\Windows\System\tQxDrdZ.exe
  C:\Windows\System\tQxDrdZ.exe
  2⤵
  PID:6560
- C:\Windows\System\RsWrUDP.exe
  C:\Windows\System\RsWrUDP.exe
  2⤵
  PID:6576
- C:\Windows\System\yBCYvzn.exe
  C:\Windows\System\yBCYvzn.exe
  2⤵
  PID:6604
- C:\Windows\System\XJNIxjP.exe
  C:\Windows\System\XJNIxjP.exe
  2⤵
  PID:6620
- C:\Windows\System\dxNiAtM.exe
  C:\Windows\System\dxNiAtM.exe
  2⤵
  PID:6636
- C:\Windows\System\eLiZpLY.exe
  C:\Windows\System\eLiZpLY.exe
  2⤵
  PID:6660
- C:\Windows\System\LYuBLqz.exe
  C:\Windows\System\LYuBLqz.exe
  2⤵
  PID:6676
- C:\Windows\System\akotdGU.exe
  C:\Windows\System\akotdGU.exe
  2⤵
  PID:6708
- C:\Windows\System\dDaXyGg.exe
  C:\Windows\System\dDaXyGg.exe
  2⤵
  PID:6752
- C:\Windows\System\dgfGZqW.exe
  C:\Windows\System\dgfGZqW.exe
  2⤵
  PID:6768
- C:\Windows\System\YzJwvlI.exe
  C:\Windows\System\YzJwvlI.exe
  2⤵
  PID:6800
- C:\Windows\System\ZvLxkqJ.exe
  C:\Windows\System\ZvLxkqJ.exe
  2⤵
  PID:6812
- C:\Windows\System\JaOCPkt.exe
  C:\Windows\System\JaOCPkt.exe
  2⤵
  PID:6840
- C:\Windows\System\LvmKTEw.exe
  C:\Windows\System\LvmKTEw.exe
  2⤵
  PID:6856
- C:\Windows\System\yWoqwXL.exe
  C:\Windows\System\yWoqwXL.exe
  2⤵
  PID:6892
- C:\Windows\System\IXbPdNb.exe
  C:\Windows\System\IXbPdNb.exe
  2⤵
  PID:6912
- C:\Windows\System\CkNyDtW.exe
  C:\Windows\System\CkNyDtW.exe
  2⤵
  PID:6940
- C:\Windows\System\VkphzfX.exe
  C:\Windows\System\VkphzfX.exe
  2⤵
  PID:6988
- C:\Windows\System\fCGPjJY.exe
  C:\Windows\System\fCGPjJY.exe
  2⤵
  PID:6992
- C:\Windows\System\DeZumMJ.exe
  C:\Windows\System\DeZumMJ.exe
  2⤵
  PID:7040
- C:\Windows\System\qlSzxHz.exe
  C:\Windows\System\qlSzxHz.exe
  2⤵
  PID:7072
- C:\Windows\System\jFTsikz.exe
  C:\Windows\System\jFTsikz.exe
  2⤵
  PID:7092
- C:\Windows\System\zVLZaXL.exe
  C:\Windows\System\zVLZaXL.exe
  2⤵
  PID:7120
- C:\Windows\System\iYRjPgl.exe
  C:\Windows\System\iYRjPgl.exe
  2⤵
  PID:7148
- C:\Windows\System\xnQKnTU.exe
  C:\Windows\System\xnQKnTU.exe
  2⤵
  PID:6040
- C:\Windows\System\xssQZOD.exe
  C:\Windows\System\xssQZOD.exe
  2⤵
  PID:5148
- C:\Windows\System\SFGFSHW.exe
  C:\Windows\System\SFGFSHW.exe
  2⤵
  PID:5816
- C:\Windows\System\ovIvbzG.exe
  C:\Windows\System\ovIvbzG.exe
  2⤵
  PID:6296
- C:\Windows\System\aOPrbxr.exe
  C:\Windows\System\aOPrbxr.exe
  2⤵
  PID:6308
- C:\Windows\System\kmfdXja.exe
  C:\Windows\System\kmfdXja.exe
  2⤵
  PID:6396
- C:\Windows\System\pvObEJd.exe
  C:\Windows\System\pvObEJd.exe
  2⤵
  PID:6572
- C:\Windows\System\KqCdqLL.exe
  C:\Windows\System\KqCdqLL.exe
  2⤵
  PID:6644
- C:\Windows\System\INkZarF.exe
  C:\Windows\System\INkZarF.exe
  2⤵
  PID:6556
- C:\Windows\System\XqaZUUK.exe
  C:\Windows\System\XqaZUUK.exe
  2⤵
  PID:6664
- C:\Windows\System\WowWTwf.exe
  C:\Windows\System\WowWTwf.exe
  2⤵
  PID:6724
- C:\Windows\System\WkhAbFx.exe
  C:\Windows\System\WkhAbFx.exe
  2⤵
  PID:6852
- C:\Windows\System\YweiOOD.exe
  C:\Windows\System\YweiOOD.exe
  2⤵
  PID:7008
- C:\Windows\System\ydknOeZ.exe
  C:\Windows\System\ydknOeZ.exe
  2⤵
  PID:5500
- C:\Windows\System\jZjlOzj.exe
  C:\Windows\System\jZjlOzj.exe
  2⤵
  PID:7112
- C:\Windows\System\lluGZHh.exe
  C:\Windows\System\lluGZHh.exe
  2⤵
  PID:6544
- C:\Windows\System\Wbkvrck.exe
  C:\Windows\System\Wbkvrck.exe
  2⤵
  PID:6524
- C:\Windows\System\hJSGdhC.exe
  C:\Windows\System\hJSGdhC.exe
  2⤵
  PID:6504
- C:\Windows\System\LYMoxeB.exe
  C:\Windows\System\LYMoxeB.exe
  2⤵
  PID:6740
- C:\Windows\System\bWJbAuV.exe
  C:\Windows\System\bWJbAuV.exe
  2⤵
  PID:6528
- C:\Windows\System\xvCkgyr.exe
  C:\Windows\System\xvCkgyr.exe
  2⤵
  PID:6780
- C:\Windows\System\pBRlNAb.exe
  C:\Windows\System\pBRlNAb.exe
  2⤵
  PID:6788
- C:\Windows\System\qPxUpzT.exe
  C:\Windows\System\qPxUpzT.exe
  2⤵
  PID:7132
- C:\Windows\System\MYDTcuB.exe
  C:\Windows\System\MYDTcuB.exe
  2⤵
  PID:6920
- C:\Windows\System\BhxjScF.exe
  C:\Windows\System\BhxjScF.exe
  2⤵
  PID:6204
- C:\Windows\System\YOmSMOQ.exe
  C:\Windows\System\YOmSMOQ.exe
  2⤵
  PID:6984
- C:\Windows\System\jnaQyPr.exe
  C:\Windows\System\jnaQyPr.exe
  2⤵
  PID:6292
- C:\Windows\System\hJBPeNg.exe
  C:\Windows\System\hJBPeNg.exe
  2⤵
  PID:6252
- C:\Windows\System\pCtALQC.exe
  C:\Windows\System\pCtALQC.exe
  2⤵
  PID:6280
- C:\Windows\System\KpJdwrd.exe
  C:\Windows\System\KpJdwrd.exe
  2⤵
  PID:6344
- C:\Windows\System\HAitwgv.exe
  C:\Windows\System\HAitwgv.exe
  2⤵
  PID:6380
- C:\Windows\System\OSHQjUs.exe
  C:\Windows\System\OSHQjUs.exe
  2⤵
  PID:6424
- C:\Windows\System\ZITTbsa.exe
  C:\Windows\System\ZITTbsa.exe
  2⤵
  PID:6616
- C:\Windows\System\FByXslf.exe
  C:\Windows\System\FByXslf.exe
  2⤵
  PID:6540
- C:\Windows\System\kZNweQx.exe
  C:\Windows\System\kZNweQx.exe
  2⤵
  PID:6600
- C:\Windows\System\WGLprpN.exe
  C:\Windows\System\WGLprpN.exe
  2⤵
  PID:5216
- C:\Windows\System\fITlAuR.exe
  C:\Windows\System\fITlAuR.exe
  2⤵
  PID:7184
- C:\Windows\System\QcKdzJy.exe
  C:\Windows\System\QcKdzJy.exe
  2⤵
  PID:7200
- C:\Windows\System\lQqoIIt.exe
  C:\Windows\System\lQqoIIt.exe
  2⤵
  PID:7216
- C:\Windows\System\WWqqBxh.exe
  C:\Windows\System\WWqqBxh.exe
  2⤵
  PID:7232
- C:\Windows\System\KQVCUvW.exe
  C:\Windows\System\KQVCUvW.exe
  2⤵
  PID:7248
- C:\Windows\System\twduTjJ.exe
  C:\Windows\System\twduTjJ.exe
  2⤵
  PID:7264
- C:\Windows\System\YpXrTDu.exe
  C:\Windows\System\YpXrTDu.exe
  2⤵
  PID:7280
- C:\Windows\System\WqTxBvo.exe
  C:\Windows\System\WqTxBvo.exe
  2⤵
  PID:7296
- C:\Windows\System\peXulWt.exe
  C:\Windows\System\peXulWt.exe
  2⤵
  PID:7312
- C:\Windows\System\MAKmzKI.exe
  C:\Windows\System\MAKmzKI.exe
  2⤵
  PID:7328
- C:\Windows\System\ovVCjiA.exe
  C:\Windows\System\ovVCjiA.exe
  2⤵
  PID:7344
- C:\Windows\System\pTfVYDE.exe
  C:\Windows\System\pTfVYDE.exe
  2⤵
  PID:7360
- C:\Windows\System\McjRhkw.exe
  C:\Windows\System\McjRhkw.exe
  2⤵
  PID:7376
- C:\Windows\System\FwglAnv.exe
  C:\Windows\System\FwglAnv.exe
  2⤵
  PID:7392
- C:\Windows\System\xgQHVVv.exe
  C:\Windows\System\xgQHVVv.exe
  2⤵
  PID:7408
- C:\Windows\System\oIUpfdi.exe
  C:\Windows\System\oIUpfdi.exe
  2⤵
  PID:7424
- C:\Windows\System\CdBNsdx.exe
  C:\Windows\System\CdBNsdx.exe
  2⤵
  PID:7440
- C:\Windows\System\hQFfQRZ.exe
  C:\Windows\System\hQFfQRZ.exe
  2⤵
  PID:7456
- C:\Windows\System\IKFcZaA.exe
  C:\Windows\System\IKFcZaA.exe
  2⤵
  PID:7472
- C:\Windows\System\kzhxZsz.exe
  C:\Windows\System\kzhxZsz.exe
  2⤵
  PID:7488
- C:\Windows\System\NBRGFom.exe
  C:\Windows\System\NBRGFom.exe
  2⤵
  PID:7504
- C:\Windows\System\RKErCtz.exe
  C:\Windows\System\RKErCtz.exe
  2⤵
  PID:7520
- C:\Windows\System\kHstQcw.exe
  C:\Windows\System\kHstQcw.exe
  2⤵
  PID:7536
- C:\Windows\System\VlRenPq.exe
  C:\Windows\System\VlRenPq.exe
  2⤵
  PID:7552
- C:\Windows\System\TPWvOuO.exe
  C:\Windows\System\TPWvOuO.exe
  2⤵
  PID:7568
- C:\Windows\System\jcARBQa.exe
  C:\Windows\System\jcARBQa.exe
  2⤵
  PID:7584
- C:\Windows\System\RWpZahF.exe
  C:\Windows\System\RWpZahF.exe
  2⤵
  PID:7600
- C:\Windows\System\MAqmhpW.exe
  C:\Windows\System\MAqmhpW.exe
  2⤵
  PID:7616
- C:\Windows\System\NMRsOVq.exe
  C:\Windows\System\NMRsOVq.exe
  2⤵
  PID:7632
- C:\Windows\System\HqdfMLm.exe
  C:\Windows\System\HqdfMLm.exe
  2⤵
  PID:7648
- C:\Windows\System\HFbECOa.exe
  C:\Windows\System\HFbECOa.exe
  2⤵
  PID:7664
- C:\Windows\System\tdewfja.exe
  C:\Windows\System\tdewfja.exe
  2⤵
  PID:7680
- C:\Windows\System\bBkEfcz.exe
  C:\Windows\System\bBkEfcz.exe
  2⤵
  PID:7696
- C:\Windows\System\puElCPO.exe
  C:\Windows\System\puElCPO.exe
  2⤵
  PID:7712
- C:\Windows\System\BRPNlaM.exe
  C:\Windows\System\BRPNlaM.exe
  2⤵
  PID:7728
- C:\Windows\System\wBhPrLW.exe
  C:\Windows\System\wBhPrLW.exe
  2⤵
  PID:7744
- C:\Windows\System\rFPKPaz.exe
  C:\Windows\System\rFPKPaz.exe
  2⤵
  PID:7760
- C:\Windows\System\KrGExKt.exe
  C:\Windows\System\KrGExKt.exe
  2⤵
  PID:7776
- C:\Windows\System\QSuezLZ.exe
  C:\Windows\System\QSuezLZ.exe
  2⤵
  PID:7792
- C:\Windows\System\SDAlEJg.exe
  C:\Windows\System\SDAlEJg.exe
  2⤵
  PID:7808
- C:\Windows\System\ICfbZRR.exe
  C:\Windows\System\ICfbZRR.exe
  2⤵
  PID:7824
- C:\Windows\System\HXQEwud.exe
  C:\Windows\System\HXQEwud.exe
  2⤵
  PID:7840
- C:\Windows\System\wFWBvVR.exe
  C:\Windows\System\wFWBvVR.exe
  2⤵
  PID:7856
- C:\Windows\System\lLUEDEU.exe
  C:\Windows\System\lLUEDEU.exe
  2⤵
  PID:7872
- C:\Windows\System\hCehfdG.exe
  C:\Windows\System\hCehfdG.exe
  2⤵
  PID:7888
- C:\Windows\System\yItriTl.exe
  C:\Windows\System\yItriTl.exe
  2⤵
  PID:7904
- C:\Windows\System\vOGuDXk.exe
  C:\Windows\System\vOGuDXk.exe
  2⤵
  PID:7920
- C:\Windows\System\twZNraK.exe
  C:\Windows\System\twZNraK.exe
  2⤵
  PID:7936
- C:\Windows\System\nxrBMLl.exe
  C:\Windows\System\nxrBMLl.exe
  2⤵
  PID:7952
- C:\Windows\System\TlRXIFl.exe
  C:\Windows\System\TlRXIFl.exe
  2⤵
  PID:7968
- C:\Windows\System\OqcwlKT.exe
  C:\Windows\System\OqcwlKT.exe
  2⤵
  PID:7988
- C:\Windows\System\bFUZhMR.exe
  C:\Windows\System\bFUZhMR.exe
  2⤵
  PID:8004
- C:\Windows\System\COUnElB.exe
  C:\Windows\System\COUnElB.exe
  2⤵
  PID:8044
- C:\Windows\System\kRNwICA.exe
  C:\Windows\System\kRNwICA.exe
  2⤵
  PID:8072
- C:\Windows\System\pfNnFkJ.exe
  C:\Windows\System\pfNnFkJ.exe
  2⤵
  PID:8088
- C:\Windows\System\QqhwheT.exe
  C:\Windows\System\QqhwheT.exe
  2⤵
  PID:8104
- C:\Windows\System\uZifwpu.exe
  C:\Windows\System\uZifwpu.exe
  2⤵
  PID:8120
- C:\Windows\System\AUdwXUk.exe
  C:\Windows\System\AUdwXUk.exe
  2⤵
  PID:8136
- C:\Windows\System\ASQkEEy.exe
  C:\Windows\System\ASQkEEy.exe
  2⤵
  PID:8152
- C:\Windows\System\OheAHyv.exe
  C:\Windows\System\OheAHyv.exe
  2⤵
  PID:8168
- C:\Windows\System\KrdbLNz.exe
  C:\Windows\System\KrdbLNz.exe
  2⤵
  PID:8188
- C:\Windows\System\LTJQSFp.exe
  C:\Windows\System\LTJQSFp.exe
  2⤵
  PID:6276
- C:\Windows\System\gqyaSdK.exe
  C:\Windows\System\gqyaSdK.exe
  2⤵
  PID:6412
- C:\Windows\System\GhEJuKm.exe
  C:\Windows\System\GhEJuKm.exe
  2⤵
  PID:6824
- C:\Windows\System\SiaYrdc.exe
  C:\Windows\System\SiaYrdc.exe
  2⤵
  PID:7224
- C:\Windows\System\NuoqkIM.exe
  C:\Windows\System\NuoqkIM.exe
  2⤵
  PID:7260
- C:\Windows\System\DamYgln.exe
  C:\Windows\System\DamYgln.exe
  2⤵
  PID:7320
- C:\Windows\System\kPEwqfx.exe
  C:\Windows\System\kPEwqfx.exe
  2⤵
  PID:7384
- C:\Windows\System\jMnpYUc.exe
  C:\Windows\System\jMnpYUc.exe
  2⤵
  PID:6936
- C:\Windows\System\TLZUcjh.exe
  C:\Windows\System\TLZUcjh.exe
  2⤵
  PID:6568
- C:\Windows\System\HNGblhC.exe
  C:\Windows\System\HNGblhC.exe
  2⤵
  PID:7208
- C:\Windows\System\jDkyDyZ.exe
  C:\Windows\System\jDkyDyZ.exe
  2⤵
  PID:7272
- C:\Windows\System\UpIjoTA.exe
  C:\Windows\System\UpIjoTA.exe
  2⤵
  PID:7308
- C:\Windows\System\jexCJjA.exe
  C:\Windows\System\jexCJjA.exe
  2⤵
  PID:7400
- C:\Windows\System\cUsjlSH.exe
  C:\Windows\System\cUsjlSH.exe
  2⤵
  PID:7432
- C:\Windows\System\zRLtFzW.exe
  C:\Windows\System\zRLtFzW.exe
  2⤵
  PID:7448
- C:\Windows\System\ECawvjo.exe
  C:\Windows\System\ECawvjo.exe
  2⤵
  PID:7560
- C:\Windows\System\ISdIElS.exe
  C:\Windows\System\ISdIElS.exe
  2⤵
  PID:7592
- C:\Windows\System\QmKcSAm.exe
  C:\Windows\System\QmKcSAm.exe
  2⤵
  PID:7656
- C:\Windows\System\cizeByf.exe
  C:\Windows\System\cizeByf.exe
  2⤵
  PID:7420
- C:\Windows\System\GjFgnzj.exe
  C:\Windows\System\GjFgnzj.exe
  2⤵
  PID:7548
- C:\Windows\System\THCiNJd.exe
  C:\Windows\System\THCiNJd.exe
  2⤵
  PID:7608
- C:\Windows\System\NASuwVv.exe
  C:\Windows\System\NASuwVv.exe
  2⤵
  PID:7672
- C:\Windows\System\PdqiWYw.exe
  C:\Windows\System\PdqiWYw.exe
  2⤵
  PID:7708
- C:\Windows\System\tfjVSHn.exe
  C:\Windows\System\tfjVSHn.exe
  2⤵
  PID:7752
- C:\Windows\System\QnbUCzt.exe
  C:\Windows\System\QnbUCzt.exe
  2⤵
  PID:7640
- C:\Windows\System\fyppgpr.exe
  C:\Windows\System\fyppgpr.exe
  2⤵
  PID:7788
- C:\Windows\System\FMbfLcX.exe
  C:\Windows\System\FMbfLcX.exe
  2⤵
  PID:7980
- C:\Windows\System\IgjyUFq.exe
  C:\Windows\System\IgjyUFq.exe
  2⤵
  PID:7836
- C:\Windows\System\QLXHfXl.exe
  C:\Windows\System\QLXHfXl.exe
  2⤵
  PID:7916
- C:\Windows\System\pVfMzzW.exe
  C:\Windows\System\pVfMzzW.exe
  2⤵
  PID:7820
- C:\Windows\System\yKbnjvA.exe
  C:\Windows\System\yKbnjvA.exe
  2⤵
  PID:7880
- C:\Windows\System\fRQZHZc.exe
  C:\Windows\System\fRQZHZc.exe
  2⤵
  PID:8012
- C:\Windows\System\LUOuRoc.exe
  C:\Windows\System\LUOuRoc.exe
  2⤵
  PID:8028
- C:\Windows\System\amgdKVb.exe
  C:\Windows\System\amgdKVb.exe
  2⤵
  PID:8052
- C:\Windows\System\MgOsxCH.exe
  C:\Windows\System\MgOsxCH.exe
  2⤵
  PID:8064
- C:\Windows\System\bTKlILp.exe
  C:\Windows\System\bTKlILp.exe
  2⤵
  PID:8096
- C:\Windows\System\HCzrhVX.exe
  C:\Windows\System\HCzrhVX.exe
  2⤵
  PID:4688
- C:\Windows\System\cWZvcgp.exe
  C:\Windows\System\cWZvcgp.exe
  2⤵
  PID:7352
- C:\Windows\System\RfcpCWj.exe
  C:\Windows\System\RfcpCWj.exe
  2⤵
  PID:6828
- C:\Windows\System\XiwArsA.exe
  C:\Windows\System\XiwArsA.exe
  2⤵
  PID:7368
- C:\Windows\System\ArSLuFC.exe
  C:\Windows\System\ArSLuFC.exe
  2⤵
  PID:7464
- C:\Windows\System\QFqfHda.exe
  C:\Windows\System\QFqfHda.exe
  2⤵
  PID:7024
- C:\Windows\System\jTeAJqz.exe
  C:\Windows\System\jTeAJqz.exe
  2⤵
  PID:7516
- C:\Windows\System\XvhncNZ.exe
  C:\Windows\System\XvhncNZ.exe
  2⤵
  PID:7704
- C:\Windows\System\QiVStdS.exe
  C:\Windows\System\QiVStdS.exe
  2⤵
  PID:7180
- C:\Windows\System\nclWpUh.exe
  C:\Windows\System\nclWpUh.exe
  2⤵
  PID:7976
- C:\Windows\System\lAtqqdB.exe
  C:\Windows\System\lAtqqdB.exe
  2⤵
  PID:7996
- C:\Windows\System\WCvdLUR.exe
  C:\Windows\System\WCvdLUR.exe
  2⤵
  PID:8020
- C:\Windows\System\OaxYptz.exe
  C:\Windows\System\OaxYptz.exe
  2⤵
  PID:8132
- C:\Windows\System\oQzFHTE.exe
  C:\Windows\System\oQzFHTE.exe
  2⤵
  PID:7932
- C:\Windows\System\PmDpkoc.exe
  C:\Windows\System\PmDpkoc.exe
  2⤵
  PID:7544
- C:\Windows\System\VqpexJe.exe
  C:\Windows\System\VqpexJe.exe
  2⤵
  PID:7768
- C:\Windows\System\OKwLrkY.exe
  C:\Windows\System\OKwLrkY.exe
  2⤵
  PID:7852
- C:\Windows\System\BkvLGJg.exe
  C:\Windows\System\BkvLGJg.exe
  2⤵
  PID:8040
- C:\Windows\System\exWSeOQ.exe
  C:\Windows\System\exWSeOQ.exe
  2⤵
  PID:8180
- C:\Windows\System\ZkWcwZe.exe
  C:\Windows\System\ZkWcwZe.exe
  2⤵
  PID:8148
- C:\Windows\System\HbcNQfL.exe
  C:\Windows\System\HbcNQfL.exe
  2⤵
  PID:6784
- C:\Windows\System\kUjbWhf.exe
  C:\Windows\System\kUjbWhf.exe
  2⤵
  PID:7372
- C:\Windows\System\ocYCjDi.exe
  C:\Windows\System\ocYCjDi.exe
  2⤵
  PID:7176
- C:\Windows\System\dfneOjr.exe
  C:\Windows\System\dfneOjr.exe
  2⤵
  PID:8080
- C:\Windows\System\kYaRddv.exe
  C:\Windows\System\kYaRddv.exe
  2⤵
  PID:7784
- C:\Windows\System\IGSMKtw.exe
  C:\Windows\System\IGSMKtw.exe
  2⤵
  PID:7928
- C:\Windows\System\FvWYpcl.exe
  C:\Windows\System\FvWYpcl.exe
  2⤵
  PID:6816
- C:\Windows\System\wrlceVP.exe
  C:\Windows\System\wrlceVP.exe
  2⤵
  PID:7484
- C:\Windows\System\dUVUFHm.exe
  C:\Windows\System\dUVUFHm.exe
  2⤵
  PID:8200
- C:\Windows\System\lzdGWZS.exe
  C:\Windows\System\lzdGWZS.exe
  2⤵
  PID:8216
- C:\Windows\System\fsTLcOS.exe
  C:\Windows\System\fsTLcOS.exe
  2⤵
  PID:8232
- C:\Windows\System\noqTuNW.exe
  C:\Windows\System\noqTuNW.exe
  2⤵
  PID:8248
- C:\Windows\System\MtIZlyT.exe
  C:\Windows\System\MtIZlyT.exe
  2⤵
  PID:8268
- C:\Windows\System\TqprVYr.exe
  C:\Windows\System\TqprVYr.exe
  2⤵
  PID:8284
- C:\Windows\System\tqrWdpz.exe
  C:\Windows\System\tqrWdpz.exe
  2⤵
  PID:8300
- C:\Windows\System\aZvvrfx.exe
  C:\Windows\System\aZvvrfx.exe
  2⤵
  PID:8316
- C:\Windows\System\NgqjGnc.exe
  C:\Windows\System\NgqjGnc.exe
  2⤵
  PID:8332
- C:\Windows\System\nmHlSDu.exe
  C:\Windows\System\nmHlSDu.exe
  2⤵
  PID:8348
- C:\Windows\System\QBiSVTa.exe
  C:\Windows\System\QBiSVTa.exe
  2⤵
  PID:8364
- C:\Windows\System\PLCfYth.exe
  C:\Windows\System\PLCfYth.exe
  2⤵
  PID:8380
- C:\Windows\System\LNdfSrJ.exe
  C:\Windows\System\LNdfSrJ.exe
  2⤵
  PID:8396
- C:\Windows\System\PATTUjw.exe
  C:\Windows\System\PATTUjw.exe
  2⤵
  PID:8412
- C:\Windows\System\ztPhaJq.exe
  C:\Windows\System\ztPhaJq.exe
  2⤵
  PID:8428
- C:\Windows\System\WDgdIeE.exe
  C:\Windows\System\WDgdIeE.exe
  2⤵
  PID:8444
- C:\Windows\System\FHrGxTr.exe
  C:\Windows\System\FHrGxTr.exe
  2⤵
  PID:8464
- C:\Windows\System\LVmquBW.exe
  C:\Windows\System\LVmquBW.exe
  2⤵
  PID:8484
- C:\Windows\System\GUlkFel.exe
  C:\Windows\System\GUlkFel.exe
  2⤵
  PID:8500
- C:\Windows\System\NOYziWL.exe
  C:\Windows\System\NOYziWL.exe
  2⤵
  PID:8520
- C:\Windows\System\jGaSJIS.exe
  C:\Windows\System\jGaSJIS.exe
  2⤵
  PID:8540
- C:\Windows\System\hpQrfcA.exe
  C:\Windows\System\hpQrfcA.exe
  2⤵
  PID:8556
- C:\Windows\System\ZKETwUA.exe
  C:\Windows\System\ZKETwUA.exe
  2⤵
  PID:8572
- C:\Windows\System\WNAcuTT.exe
  C:\Windows\System\WNAcuTT.exe
  2⤵
  PID:8588
- C:\Windows\System\TCCKXaZ.exe
  C:\Windows\System\TCCKXaZ.exe
  2⤵
  PID:8608
- C:\Windows\System\GFYSvJP.exe
  C:\Windows\System\GFYSvJP.exe
  2⤵
  PID:8624
- C:\Windows\System\qFGKLnU.exe
  C:\Windows\System\qFGKLnU.exe
  2⤵
  PID:8640
- C:\Windows\System\zfsRfWZ.exe
  C:\Windows\System\zfsRfWZ.exe
  2⤵
  PID:8660
- C:\Windows\System\rfQWJFN.exe
  C:\Windows\System\rfQWJFN.exe
  2⤵
  PID:8676
- C:\Windows\System\pvZDZGZ.exe
  C:\Windows\System\pvZDZGZ.exe
  2⤵
  PID:8692
- C:\Windows\System\WvFVnmB.exe
  C:\Windows\System\WvFVnmB.exe
  2⤵
  PID:8708
- C:\Windows\System\xrdDsNn.exe
  C:\Windows\System\xrdDsNn.exe
  2⤵
  PID:8724
- C:\Windows\System\vTEwqCP.exe
  C:\Windows\System\vTEwqCP.exe
  2⤵
  PID:8740
- C:\Windows\System\OcukRaT.exe
  C:\Windows\System\OcukRaT.exe
  2⤵
  PID:8756
- C:\Windows\System\DgohLbX.exe
  C:\Windows\System\DgohLbX.exe
  2⤵
  PID:8772
- C:\Windows\System\WQblaCu.exe
  C:\Windows\System\WQblaCu.exe
  2⤵
  PID:8788
- C:\Windows\System\mjUrjOY.exe
  C:\Windows\System\mjUrjOY.exe
  2⤵
  PID:8808
- C:\Windows\System\OJyETvl.exe
  C:\Windows\System\OJyETvl.exe
  2⤵
  PID:8824
- C:\Windows\System\iwnvVjW.exe
  C:\Windows\System\iwnvVjW.exe
  2⤵
  PID:8848
- C:\Windows\System\VPPICNi.exe
  C:\Windows\System\VPPICNi.exe
  2⤵
  PID:8864
- C:\Windows\System\dSTJMkW.exe
  C:\Windows\System\dSTJMkW.exe
  2⤵
  PID:8956
- C:\Windows\System\lMBGiGs.exe
  C:\Windows\System\lMBGiGs.exe
  2⤵
  PID:8972
- C:\Windows\System\VXRkUfG.exe
  C:\Windows\System\VXRkUfG.exe
  2⤵
  PID:8988
- C:\Windows\System\tObaklr.exe
  C:\Windows\System\tObaklr.exe
  2⤵
  PID:9004
- C:\Windows\System\DJRCuKO.exe
  C:\Windows\System\DJRCuKO.exe
  2⤵
  PID:9020
- C:\Windows\System\OOsGNPg.exe
  C:\Windows\System\OOsGNPg.exe
  2⤵
  PID:9036
- C:\Windows\System\jcbLqzQ.exe
  C:\Windows\System\jcbLqzQ.exe
  2⤵
  PID:9052
- C:\Windows\System\UOFPNtP.exe
  C:\Windows\System\UOFPNtP.exe
  2⤵
  PID:9072
- C:\Windows\System\CGMERAP.exe
  C:\Windows\System\CGMERAP.exe
  2⤵
  PID:9088
- C:\Windows\System\qLuzLqI.exe
  C:\Windows\System\qLuzLqI.exe
  2⤵
  PID:9104
- C:\Windows\System\vsguZJB.exe
  C:\Windows\System\vsguZJB.exe
  2⤵
  PID:9120
- C:\Windows\System\aZTXfoy.exe
  C:\Windows\System\aZTXfoy.exe
  2⤵
  PID:9136
- C:\Windows\System\KLcIgSr.exe
  C:\Windows\System\KLcIgSr.exe
  2⤵
  PID:9156
- C:\Windows\System\zgPGstE.exe
  C:\Windows\System\zgPGstE.exe
  2⤵
  PID:9172
- C:\Windows\System\vLUqBoY.exe
  C:\Windows\System\vLUqBoY.exe
  2⤵
  PID:9188
- C:\Windows\System\wnRKQnj.exe
  C:\Windows\System\wnRKQnj.exe
  2⤵
  PID:9204
- C:\Windows\System\ZTwuusY.exe
  C:\Windows\System\ZTwuusY.exe
  2⤵
  PID:8196
- C:\Windows\System\wBDOngR.exe
  C:\Windows\System\wBDOngR.exe
  2⤵
  PID:7256
- C:\Windows\System\WThuweV.exe
  C:\Windows\System\WThuweV.exe
  2⤵
  PID:7804
- C:\Windows\System\cYHRiqD.exe
  C:\Windows\System\cYHRiqD.exe
  2⤵
  PID:7740
- C:\Windows\System\tIuXLEr.exe
  C:\Windows\System\tIuXLEr.exe
  2⤵
  PID:8160
- C:\Windows\System\IOIjdCk.exe
  C:\Windows\System\IOIjdCk.exe
  2⤵
  PID:7960
- C:\Windows\System\PXtHLXR.exe
  C:\Windows\System\PXtHLXR.exe
  2⤵
  PID:6744
- C:\Windows\System\rTHXZoD.exe
  C:\Windows\System\rTHXZoD.exe
  2⤵
  PID:6148
- C:\Windows\System\HHAMBRE.exe
  C:\Windows\System\HHAMBRE.exe
  2⤵
  PID:8240
- C:\Windows\System\QdeoAjn.exe
  C:\Windows\System\QdeoAjn.exe
  2⤵
  PID:8264
- C:\Windows\System\tQgfydr.exe
  C:\Windows\System\tQgfydr.exe
  2⤵
  PID:8324
- C:\Windows\System\ckCBbQi.exe
  C:\Windows\System\ckCBbQi.exe
  2⤵
  PID:8388
- C:\Windows\System\kVeJkTV.exe
  C:\Windows\System\kVeJkTV.exe
  2⤵
  PID:8456
- C:\Windows\System\bcEiHfW.exe
  C:\Windows\System\bcEiHfW.exe
  2⤵
  PID:8528
- C:\Windows\System\toWMZos.exe
  C:\Windows\System\toWMZos.exe
  2⤵
  PID:8568
- C:\Windows\System\WXJimdz.exe
  C:\Windows\System\WXJimdz.exe
  2⤵
  PID:8632
- C:\Windows\System\CsuUVpI.exe
  C:\Windows\System\CsuUVpI.exe
  2⤵
  PID:8700
- C:\Windows\System\JTLhvHW.exe
  C:\Windows\System\JTLhvHW.exe
  2⤵
  PID:8764
- C:\Windows\System\DgGLWiE.exe
  C:\Windows\System\DgGLWiE.exe
  2⤵
  PID:8832
- C:\Windows\System\VgYaFYU.exe
  C:\Windows\System\VgYaFYU.exe
  2⤵
  PID:8844
- C:\Windows\System\YMgOemF.exe
  C:\Windows\System\YMgOemF.exe
  2⤵
  PID:8372
- C:\Windows\System\lDPHwYA.exe
  C:\Windows\System\lDPHwYA.exe
  2⤵
  PID:8404
- C:\Windows\System\fgugZbU.exe
  C:\Windows\System\fgugZbU.exe
  2⤵
  PID:8480
- C:\Windows\System\kKYrUnh.exe
  C:\Windows\System\kKYrUnh.exe
  2⤵
  PID:8552
- C:\Windows\System\SXcgAvC.exe
  C:\Windows\System\SXcgAvC.exe
  2⤵
  PID:8516
- C:\Windows\System\okjCVJR.exe
  C:\Windows\System\okjCVJR.exe
  2⤵
  PID:8616
- C:\Windows\System\ojUQWoS.exe
  C:\Windows\System\ojUQWoS.exe
  2⤵
  PID:8688
- C:\Windows\System\rRgtPFp.exe
  C:\Windows\System\rRgtPFp.exe
  2⤵
  PID:8752
- C:\Windows\System\cpvIIpH.exe
  C:\Windows\System\cpvIIpH.exe
  2⤵
  PID:8820
- C:\Windows\System\hcxcTUv.exe
  C:\Windows\System\hcxcTUv.exe
  2⤵
  PID:8876
- C:\Windows\System\qpSrLBi.exe
  C:\Windows\System\qpSrLBi.exe
  2⤵
  PID:8912
- C:\Windows\System\EczylDU.exe
  C:\Windows\System\EczylDU.exe
  2⤵
  PID:8936
- C:\Windows\System\YUJOCVr.exe
  C:\Windows\System\YUJOCVr.exe
  2⤵
  PID:8892
- C:\Windows\System\bMNJeDH.exe
  C:\Windows\System\bMNJeDH.exe
  2⤵
  PID:8900
- C:\Windows\System\oCcLCCl.exe
  C:\Windows\System\oCcLCCl.exe
  2⤵
  PID:8924
- C:\Windows\System\NiZvTvl.exe
  C:\Windows\System\NiZvTvl.exe
  2⤵
  PID:8944
- C:\Windows\System\STnAOJI.exe
  C:\Windows\System\STnAOJI.exe
  2⤵
  PID:9060
- C:\Windows\System\ILjGFdq.exe
  C:\Windows\System\ILjGFdq.exe
  2⤵
  PID:9068
- C:\Windows\System\mnLGhFw.exe
  C:\Windows\System\mnLGhFw.exe
  2⤵
  PID:9100
- C:\Windows\System\xWonYaF.exe
  C:\Windows\System\xWonYaF.exe
  2⤵
  PID:9196
- C:\Windows\System\VypCRsd.exe
  C:\Windows\System\VypCRsd.exe
  2⤵
  PID:9116
- C:\Windows\System\vCulLpQ.exe
  C:\Windows\System\vCulLpQ.exe
  2⤵
  PID:9180
- C:\Windows\System\YEYzEXM.exe
  C:\Windows\System\YEYzEXM.exe
  2⤵
  PID:7468
- C:\Windows\System\krdRxfR.exe
  C:\Windows\System\krdRxfR.exe
  2⤵
  PID:8184
- C:\Windows\System\KZTQMqY.exe
  C:\Windows\System\KZTQMqY.exe
  2⤵
  PID:8212
- C:\Windows\System\PTwNseG.exe
  C:\Windows\System\PTwNseG.exe
  2⤵
  PID:8536
- C:\Windows\System\GPaQlws.exe
  C:\Windows\System\GPaQlws.exe
  2⤵
  PID:8668
- C:\Windows\System\zxwKoIE.exe
  C:\Windows\System\zxwKoIE.exe
  2⤵
  PID:8872
- C:\Windows\System\OwvSUvD.exe
  C:\Windows\System\OwvSUvD.exe
  2⤵
  PID:8580
- C:\Windows\System\LjdiEti.exe
  C:\Windows\System\LjdiEti.exe
  2⤵
  PID:7304
- C:\Windows\System\oQuWLum.exe
  C:\Windows\System\oQuWLum.exe
  2⤵
  PID:8060
- C:\Windows\System\uMBiSuv.exe
  C:\Windows\System\uMBiSuv.exe
  2⤵
  PID:8260
- C:\Windows\System\aEaEBqT.exe
  C:\Windows\System\aEaEBqT.exe
  2⤵
  PID:8496
- C:\Windows\System\AyTRtGw.exe
  C:\Windows\System\AyTRtGw.exe
  2⤵
  PID:8732
- C:\Windows\System\YaREHJe.exe
  C:\Windows\System\YaREHJe.exe
  2⤵
  PID:8376
- C:\Windows\System\ufqeXWe.exe
  C:\Windows\System\ufqeXWe.exe
  2⤵
  PID:8620
- C:\Windows\System\UxMAqLt.exe
  C:\Windows\System\UxMAqLt.exe
  2⤵
  PID:8856
- C:\Windows\System\JLDqKLb.exe
  C:\Windows\System\JLDqKLb.exe
  2⤵
  PID:7944
- C:\Windows\System\gQOFkJP.exe
  C:\Windows\System\gQOFkJP.exe
  2⤵
  PID:8896
- C:\Windows\System\qPgPvwX.exe
  C:\Windows\System\qPgPvwX.exe
  2⤵
  PID:8920
- C:\Windows\System\YlzCtyl.exe
  C:\Windows\System\YlzCtyl.exe
  2⤵
  PID:9064
- C:\Windows\System\MuOpnOm.exe
  C:\Windows\System\MuOpnOm.exe
  2⤵
  PID:9168
- C:\Windows\System\csKukPn.exe
  C:\Windows\System\csKukPn.exe
  2⤵
  PID:9032
- C:\Windows\System\NanDHAv.exe
  C:\Windows\System\NanDHAv.exe
  2⤵
  PID:9112
- C:\Windows\System\CbPnxmT.exe
  C:\Windows\System\CbPnxmT.exe
  2⤵
  PID:8164
- C:\Windows\System\efhuLmb.exe
  C:\Windows\System\efhuLmb.exe
  2⤵
  PID:8420
- C:\Windows\System\sGgvoUU.exe
  C:\Windows\System\sGgvoUU.exe
  2⤵
  PID:8340
- C:\Windows\System\KExnXph.exe
  C:\Windows\System\KExnXph.exe
  2⤵
  PID:8508
- C:\Windows\System\DJpHbha.exe
  C:\Windows\System\DJpHbha.exe
  2⤵
  PID:8656
- C:\Windows\System\WHiFpYe.exe
  C:\Windows\System\WHiFpYe.exe
  2⤵
  PID:8492
- C:\Windows\System\YaVaTnD.exe
  C:\Windows\System\YaVaTnD.exe
  2⤵
  PID:8736
- C:\Windows\System\rUTsqIM.exe
  C:\Windows\System\rUTsqIM.exe
  2⤵
  PID:8784
- C:\Windows\System\bkYwDbR.exe
  C:\Windows\System\bkYwDbR.exe
  2⤵
  PID:8880
- C:\Windows\System\vwuvegA.exe
  C:\Windows\System\vwuvegA.exe
  2⤵
  PID:8980
- C:\Windows\System\gcTFyGz.exe
  C:\Windows\System\gcTFyGz.exe
  2⤵
  PID:9080
- C:\Windows\System\LiaXchH.exe
  C:\Windows\System\LiaXchH.exe
  2⤵
  PID:9152
- C:\Windows\System\sxyHWyo.exe
  C:\Windows\System\sxyHWyo.exe
  2⤵
  PID:8208
- C:\Windows\System\qiMFOGC.exe
  C:\Windows\System\qiMFOGC.exe
  2⤵
  PID:8312
- C:\Windows\System\MANxmPO.exe
  C:\Windows\System\MANxmPO.exe
  2⤵
  PID:8256
- C:\Windows\System\PeJqQSx.exe
  C:\Windows\System\PeJqQSx.exe
  2⤵
  PID:8804
- C:\Windows\System\OfCqJDf.exe
  C:\Windows\System\OfCqJDf.exe
  2⤵
  PID:8228
- C:\Windows\System\fJQGblO.exe
  C:\Windows\System\fJQGblO.exe
  2⤵
  PID:8800
- C:\Windows\System\GfJqCNt.exe
  C:\Windows\System\GfJqCNt.exe
  2⤵
  PID:7404
- C:\Windows\System\xTWhHMN.exe
  C:\Windows\System\xTWhHMN.exe
  2⤵
  PID:8928
- C:\Windows\System\OgILdHq.exe
  C:\Windows\System\OgILdHq.exe
  2⤵
  PID:8476
- C:\Windows\System\KJiGZCZ.exe
  C:\Windows\System\KJiGZCZ.exe
  2⤵
  PID:9096
- C:\Windows\System\KuSftGJ.exe
  C:\Windows\System\KuSftGJ.exe
  2⤵
  PID:9228
- C:\Windows\System\DlJjbma.exe
  C:\Windows\System\DlJjbma.exe
  2⤵
  PID:9244
- C:\Windows\System\HdiWPev.exe
  C:\Windows\System\HdiWPev.exe
  2⤵
  PID:9260
- C:\Windows\System\OMfwsAJ.exe
  C:\Windows\System\OMfwsAJ.exe
  2⤵
  PID:9276
- C:\Windows\System\oLaalxA.exe
  C:\Windows\System\oLaalxA.exe
  2⤵
  PID:9292
- C:\Windows\System\lakDJxO.exe
  C:\Windows\System\lakDJxO.exe
  2⤵
  PID:9308
- C:\Windows\System\uefbmlv.exe
  C:\Windows\System\uefbmlv.exe
  2⤵
  PID:9324
- C:\Windows\System\TSbllZg.exe
  C:\Windows\System\TSbllZg.exe
  2⤵
  PID:9340
- C:\Windows\System\WLEzgTV.exe
  C:\Windows\System\WLEzgTV.exe
  2⤵
  PID:9356
- C:\Windows\System\nczRwdN.exe
  C:\Windows\System\nczRwdN.exe
  2⤵
  PID:9372
- C:\Windows\System\RElzVBz.exe
  C:\Windows\System\RElzVBz.exe
  2⤵
  PID:9388
- C:\Windows\System\dkfybJb.exe
  C:\Windows\System\dkfybJb.exe
  2⤵
  PID:9404
- C:\Windows\System\HHYVDfj.exe
  C:\Windows\System\HHYVDfj.exe
  2⤵
  PID:9420
- C:\Windows\System\TuCZdMM.exe
  C:\Windows\System\TuCZdMM.exe
  2⤵
  PID:9436
- C:\Windows\System\iwMKSIo.exe
  C:\Windows\System\iwMKSIo.exe
  2⤵
  PID:9452
- C:\Windows\System\SOxUxRZ.exe
  C:\Windows\System\SOxUxRZ.exe
  2⤵
  PID:9468
- C:\Windows\System\ddVDThJ.exe
  C:\Windows\System\ddVDThJ.exe
  2⤵
  PID:9484
- C:\Windows\System\xypJXyY.exe
  C:\Windows\System\xypJXyY.exe
  2⤵
  PID:9500
- C:\Windows\System\rOLLZDs.exe
  C:\Windows\System\rOLLZDs.exe
  2⤵
  PID:9520
- C:\Windows\System\tZhPIkB.exe
  C:\Windows\System\tZhPIkB.exe
  2⤵
  PID:9536
- C:\Windows\System\WdCDEOl.exe
  C:\Windows\System\WdCDEOl.exe
  2⤵
  PID:9552
- C:\Windows\System\FdXJRkW.exe
  C:\Windows\System\FdXJRkW.exe
  2⤵
  PID:9568
- C:\Windows\System\TckrIlJ.exe
  C:\Windows\System\TckrIlJ.exe
  2⤵
  PID:9584
- C:\Windows\System\rUVuemy.exe
  C:\Windows\System\rUVuemy.exe
  2⤵
  PID:9600
- C:\Windows\System\FgllLOP.exe
  C:\Windows\System\FgllLOP.exe
  2⤵
  PID:9616
- C:\Windows\System\noMapmO.exe
  C:\Windows\System\noMapmO.exe
  2⤵
  PID:9636
- C:\Windows\System\ZsjbJXj.exe
  C:\Windows\System\ZsjbJXj.exe
  2⤵
  PID:9652
- C:\Windows\System\mcckubc.exe
  C:\Windows\System\mcckubc.exe
  2⤵
  PID:9668
- C:\Windows\System\liuesTZ.exe
  C:\Windows\System\liuesTZ.exe
  2⤵
  PID:9684
- C:\Windows\System\nQHpUcd.exe
  C:\Windows\System\nQHpUcd.exe
  2⤵
  PID:9700
- C:\Windows\System\vJGjghv.exe
  C:\Windows\System\vJGjghv.exe
  2⤵
  PID:9716
- C:\Windows\System\FobtfHL.exe
  C:\Windows\System\FobtfHL.exe
  2⤵
  PID:9732
- C:\Windows\System\BvLZqwt.exe
  C:\Windows\System\BvLZqwt.exe
  2⤵
  PID:9748
- C:\Windows\System\GFBjMxI.exe
  C:\Windows\System\GFBjMxI.exe
  2⤵
  PID:9764
- C:\Windows\System\ijfXIrK.exe
  C:\Windows\System\ijfXIrK.exe
  2⤵
  PID:9780
- C:\Windows\System\avCajTz.exe
  C:\Windows\System\avCajTz.exe
  2⤵
  PID:9796
- C:\Windows\System\PEjubDB.exe
  C:\Windows\System\PEjubDB.exe
  2⤵
  PID:9812
- C:\Windows\System\hbmGDQW.exe
  C:\Windows\System\hbmGDQW.exe
  2⤵
  PID:9828
- C:\Windows\System\fMMapCU.exe
  C:\Windows\System\fMMapCU.exe
  2⤵
  PID:9844
- C:\Windows\System\QvuwHrX.exe
  C:\Windows\System\QvuwHrX.exe
  2⤵
  PID:9860
- C:\Windows\System\ffByVXQ.exe
  C:\Windows\System\ffByVXQ.exe
  2⤵
  PID:9876
- C:\Windows\System\fWPIZDw.exe
  C:\Windows\System\fWPIZDw.exe
  2⤵
  PID:9892
- C:\Windows\System\KUqjZER.exe
  C:\Windows\System\KUqjZER.exe
  2⤵
  PID:9908
- C:\Windows\System\oBZrabR.exe
  C:\Windows\System\oBZrabR.exe
  2⤵
  PID:9928
- C:\Windows\System\URRSMwY.exe
  C:\Windows\System\URRSMwY.exe
  2⤵
  PID:9944
- C:\Windows\System\vOyJdNU.exe
  C:\Windows\System\vOyJdNU.exe
  2⤵
  PID:9960
- C:\Windows\System\mGdteSG.exe
  C:\Windows\System\mGdteSG.exe
  2⤵
  PID:9976
- C:\Windows\System\AkRfymW.exe
  C:\Windows\System\AkRfymW.exe
  2⤵
  PID:9992
- C:\Windows\System\EnJlgfn.exe
  C:\Windows\System\EnJlgfn.exe
  2⤵
  PID:10008
- C:\Windows\System\EmWKzkd.exe
  C:\Windows\System\EmWKzkd.exe
  2⤵
  PID:10024
- C:\Windows\System\mojDZnr.exe
  C:\Windows\System\mojDZnr.exe
  2⤵
  PID:10044
- C:\Windows\System\YXXgyok.exe
  C:\Windows\System\YXXgyok.exe
  2⤵
  PID:10060
- C:\Windows\System\ZhokKSY.exe
  C:\Windows\System\ZhokKSY.exe
  2⤵
  PID:10076
- C:\Windows\System\SbysHCX.exe
  C:\Windows\System\SbysHCX.exe
  2⤵
  PID:10092
- C:\Windows\System\uSMvIQL.exe
  C:\Windows\System\uSMvIQL.exe
  2⤵
  PID:10108
- C:\Windows\System\rWwnnPp.exe
  C:\Windows\System\rWwnnPp.exe
  2⤵
  PID:10124
- C:\Windows\System\rrpKYfn.exe
  C:\Windows\System\rrpKYfn.exe
  2⤵
  PID:10140
- C:\Windows\System\BlUQolj.exe
  C:\Windows\System\BlUQolj.exe
  2⤵
  PID:10156
- C:\Windows\System\BZTbnBA.exe
  C:\Windows\System\BZTbnBA.exe
  2⤵
  PID:10172
- C:\Windows\System\zAwNVaS.exe
  C:\Windows\System\zAwNVaS.exe
  2⤵
  PID:10188
- C:\Windows\System\jXOrNaD.exe
  C:\Windows\System\jXOrNaD.exe
  2⤵
  PID:10204
- C:\Windows\System\dARoWIs.exe
  C:\Windows\System\dARoWIs.exe
  2⤵
  PID:10220
- C:\Windows\System\FdfdvvP.exe
  C:\Windows\System\FdfdvvP.exe
  2⤵
  PID:10236
- C:\Windows\System\vRNRDMx.exe
  C:\Windows\System\vRNRDMx.exe
  2⤵
  PID:9256
- C:\Windows\System\gGaKaNL.exe
  C:\Windows\System\gGaKaNL.exe
  2⤵
  PID:9348
- C:\Windows\System\QhNhWdy.exe
  C:\Windows\System\QhNhWdy.exe
  2⤵
  PID:9416
- C:\Windows\System\iGArETy.exe
  C:\Windows\System\iGArETy.exe
  2⤵
  PID:9132
- C:\Windows\System\dEJwRdp.exe
  C:\Windows\System\dEJwRdp.exe
  2⤵
  PID:9544
- C:\Windows\System\tjZFXIq.exe
  C:\Windows\System\tjZFXIq.exe
  2⤵
  PID:9400
- C:\Windows\System\xaAlkFk.exe
  C:\Windows\System\xaAlkFk.exe
  2⤵
  PID:9272
- C:\Windows\System\dDtkkEU.exe
  C:\Windows\System\dDtkkEU.exe
  2⤵
  PID:9368
- C:\Windows\System\hnpZwzL.exe
  C:\Windows\System\hnpZwzL.exe
  2⤵
  PID:9576
- C:\Windows\System\pMzHFhD.exe
  C:\Windows\System\pMzHFhD.exe
  2⤵
  PID:9560
- C:\Windows\System\YMGhJKe.exe
  C:\Windows\System\YMGhJKe.exe
  2⤵
  PID:9492
- C:\Windows\System\xLkXuOh.exe
  C:\Windows\System\xLkXuOh.exe
  2⤵
  PID:9532
- C:\Windows\System\TBlYEMn.exe
  C:\Windows\System\TBlYEMn.exe
  2⤵
  PID:9676
- C:\Windows\System\vlDRsvw.exe
  C:\Windows\System\vlDRsvw.exe
  2⤵
  PID:9740
- C:\Windows\System\kSvDXGJ.exe
  C:\Windows\System\kSvDXGJ.exe
  2⤵
  PID:9804
- C:\Windows\System\gmnXxus.exe
  C:\Windows\System\gmnXxus.exe
  2⤵
  PID:9868
- C:\Windows\System\AMICLyy.exe
  C:\Windows\System\AMICLyy.exe
  2⤵
  PID:9936
- C:\Windows\System\eaHTStI.exe
  C:\Windows\System\eaHTStI.exe
  2⤵
  PID:9972
- C:\Windows\System\XmZMlVT.exe
  C:\Windows\System\XmZMlVT.exe
  2⤵
  PID:10000
- C:\Windows\System\cOBkKOO.exe
  C:\Windows\System\cOBkKOO.exe
  2⤵
  PID:9692
- C:\Windows\System\kFdbcky.exe
  C:\Windows\System\kFdbcky.exe
  2⤵
  PID:9696
- C:\Windows\System\ZyGxbzd.exe
  C:\Windows\System\ZyGxbzd.exe
  2⤵
  PID:9820
- C:\Windows\System\iFdNqxU.exe
  C:\Windows\System\iFdNqxU.exe
  2⤵
  PID:9884
- C:\Windows\System\mHPDbSe.exe
  C:\Windows\System\mHPDbSe.exe
  2⤵
  PID:9924
- C:\Windows\System\urDOxHP.exe
  C:\Windows\System\urDOxHP.exe
  2⤵
  PID:9988
- C:\Windows\System\vFkayMl.exe
  C:\Windows\System\vFkayMl.exe
  2⤵
  PID:10072
- C:\Windows\System\bPVbZKM.exe
  C:\Windows\System\bPVbZKM.exe
  2⤵
  PID:10164
- C:\Windows\System\QWQsjAd.exe
  C:\Windows\System\QWQsjAd.exe
  2⤵
  PID:10136
- C:\Windows\System\eVgQKfe.exe
  C:\Windows\System\eVgQKfe.exe
  2⤵
  PID:9288
- C:\Windows\System\SIsXNIt.exe
  C:\Windows\System\SIsXNIt.exe
  2⤵
  PID:10088
- C:\Windows\System\CTCTEWK.exe
  C:\Windows\System\CTCTEWK.exe
  2⤵
  PID:10120
- C:\Windows\System\NNQUmOg.exe
  C:\Windows\System\NNQUmOg.exe
  2⤵
  PID:10212
- C:\Windows\System\VyWnqPw.exe
  C:\Windows\System\VyWnqPw.exe
  2⤵
  PID:9380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AIolGbV.exe

Filesize
2.0MB

MD5
17dda08be041d2c26cede26d9c2d31ca

SHA1
b389e445560f1a92e0b2ce1ee8b52c85a648827a

SHA256
52bcc47f4deb53979a4549c54b8136ce797247c7d8d5b6a027c45f73da876bfe

SHA512
43214b539cb44371cf64c1d4d78a527c726f5c3364d5b8978e6c29708cd883dd316e38e2e8252af856e9175987594ba2c04e8af7080442c6758f0a01911dd5fa

Download Submit
C:\Windows\system\AyEUylP.exe

Filesize
2.0MB

MD5
4687e006064809c1e8e40991cce3ca2c

SHA1
3fb2e4277057aa97603ec099ed914815fc9b6b9f

SHA256
a13ff6608deea0a8a7380d8283ee81f8c528ff435ec0f3afbe077a015db15625

SHA512
c179d037d34d4f12509601974702cf8373492d68deed4d9eebfbf782f241f44dbcc99cc0745f4705d30d2bfafc64c4c87fa50c72082996bd93de0861b7e0435c

Download Submit
C:\Windows\system\DEUHPgP.exe

Filesize
2.0MB

MD5
0ce71a3bf3b51fa6b28279c240deba70

SHA1
7a478c7a61dc009a07bdfe72eac32a45079525fc

SHA256
65bcb17b66d1c65d79d9fb83f6780edd0aba17c637b9f98e207e71fc61d2a24c

SHA512
0ba2cfb984f4dbd13e018e6077028da20159ef1a19f25b3f787042fa5da1a9b189529ae476fc7f802e04b436aec4382cbe0b77265c6732a92332247deb89ed32

Download Submit
C:\Windows\system\DhGpZNe.exe

Filesize
2.0MB

MD5
17a6f6a4962b736422a0b5d49c1ec84e

SHA1
43d87681b6d411c1988117dee5121d86951fe52e

SHA256
e0da7b870558c6923e82e8accf375ce7d02a9f73ecb8adb56d9ec8b48c61faf8

SHA512
8cd520bd16d5cbd190db5055ed984483951dba59e210630beb63dc0747f296defc8609df1671cc134fbdf43b44e9acc2e7303392ced42a04a1a214751f753957

Download Submit
C:\Windows\system\EWCZJzl.exe

Filesize
2.0MB

MD5
524240a95d8b57d543cdf6e9877821be

SHA1
35a9ab9a4ebe4bd8a0d409981c129b1547673167

SHA256
b110ccfbc49d71eab18986e234d0bc6c6c78493cbaf2874c85ca29b8c9d86ccf

SHA512
dedebd515ccb002d87a5ccbe96bb23739726d12622d3d0adf2ae8153d08f4955f9a099f4d9132425724283eaa70c74a254d8b2e386f85c85e8aa67f9a1c40c38

Download Submit
C:\Windows\system\FOLBclZ.exe

Filesize
2.0MB

MD5
8bdad69453384981c8f07fbdb80f6e4b

SHA1
f74db73a567c5c7e14619c8c54911b43bf21c715

SHA256
d1d21173ccbdf3008fe73426127e3a764aee5b0cc41ffc0fdc97af90daf3e0d1

SHA512
2b218a387e09ba353026b0d0fafd2e3ad33206237b710c09eabaf5bbb4c5d30ef189cc3b85d3a4184ccacfeab8ef6a3cf092ea47cf1c49534b32cf71c3d97ee7

Download Submit
C:\Windows\system\HodqzUJ.exe

Filesize
2.0MB

MD5
1000e8b304850df38924a4c7be0a5d5d

SHA1
bb172e72c6c8cfbbd91568743cec79faf92a3727

SHA256
9bb57d6c93efbffb4bf2d2068ec9926cd65855655d4f946ff2911a46bde67e80

SHA512
81b512a5cf67707a3a5c6271bd86e43bc6a4f59c35a6fb06fb89bab86fa4215d7c68fd90d637fa966b0e16fc5051fd1012cbb08dfd408a30bc89c31f2230c86c

Download Submit
C:\Windows\system\JHbZglM.exe

Filesize
2.0MB

MD5
6f1e9b852801bd660e3d95cedee98b5a

SHA1
cf5643b2a941cd0c0458bb16a3fbbf1643079824

SHA256
c140be2af8b838ad897e2c7be5732adb9c0f604201aded047866bf53f318c357

SHA512
7a0abb613be2feb0f678fd7e734398c671982c15ddc8f4c2b74aa73e6e69c0afec120bbd8358916d3a97ab2bc1c1494bee8463422388c91cdce09d321d32ec62

Download Submit
C:\Windows\system\JpXhsGM.exe

Filesize
2.0MB

MD5
5ed561047fdd8541de6c0e9ee63fc79f

SHA1
f80a35c47806b460002fb86dcd2090dfe6f4fec9

SHA256
f331ec164049d8479b8cb9c33f478aaed430d9040d96908d0335350b4d401dc7

SHA512
c7a14daf9f3d26deb9c9919b042774da21c69c3b15db008d5898693e11fa5818d4aee23ff0ca52b4f7f4796545c4f49d5a5a6cee095b0626d6a83981aefef7a9

Download Submit
C:\Windows\system\LaBuDoB.exe

Filesize
2.0MB

MD5
637dd3743aefab4686c72eac883d7d9e

SHA1
16fc390dcdaae88615cc2f3e131d5e49f7a2002b

SHA256
b1ccdfa03ad9c1910b518cf6b2750c5c670937f74c98a35bf67fe9ffbfb5fdad

SHA512
aaca539f9923b3c416e9d10582d8e421d830e1c8ef4a44f71805650846c086042ddb9cd74f48176c4e5fedbfcada401963591bc83cab469c3b8e90a28f084b3c

Download Submit
C:\Windows\system\MiZQyYb.exe

Filesize
2.0MB

MD5
6e67806a7120a989db8bb9bb7f9cdd0b

SHA1
43d3de01b88eaa68bb3bbabbfb2470a6bae0a6dd

SHA256
ddf6473ab8796d6c99fdeb37485213a61610bbc0dce8e555643dd3b67332e8df

SHA512
03d668b2126ff1d9bf366dc398545984c94de197a35e018ad33e874ffcd224604d9b7ad229e263e3a7fe97a237cf0a913ae5ab71d9c1ca0646c57005491885c9

Download Submit
C:\Windows\system\PCdQpnj.exe

Filesize
2.0MB

MD5
5e89ddb73ec0c275c01a1505f4f8e025

SHA1
58025f8557115c760ec6b0fed89b463abacb80bd

SHA256
24f1648e08512319bf4685d3a63ce7b5e46691db5643c23908deaa6c87947842

SHA512
cce069e0e2021b480c2877a718ca8e404e538669bd0b2245b86fb67f46283c300b0d0584f88aee352109fcc1632545cdd90188cf985da21fc8446cd7e8587e77

Download Submit
C:\Windows\system\PsbXCSC.exe

Filesize
2.0MB

MD5
9a52425907b66efa625bd5261cde0f6c

SHA1
17ee6787a5c1e916aa49a4d29eacddfc9f10e3bf

SHA256
7bbafb46b172929db2b0f4cf5df0ca910973958d9279379ff2c922e9afa05670

SHA512
5c1df794239b9954923cab66994838f88aec7a7a5a381aac7637ee3028429c906b2199fcc67994c13b26c808cae38365f95decd5227845ced0df6f14edced563

Download Submit
C:\Windows\system\QYdfdUI.exe

Filesize
2.0MB

MD5
4b316014a349d36cf6f4770ddc95cbe2

SHA1
aec2883c2357c28cbeaf5b861397ea0e52fa5049

SHA256
d16b4d8504764e8e416645e4877949a8a82737ce7aa5d1b91fe6a4885d22ad2f

SHA512
3e0009692c2317c041035714298be9c304701603242ed5ca28ac83f98c3915255a229bff65521e25c47c1684358b331937063b0502e1fc270f8adba0e90c2922

Download Submit
C:\Windows\system\RyzXWXU.exe

Filesize
2.0MB

MD5
0f6a792d1533c254d80b2ceaeba1ebe0

SHA1
e19b99b9c92ece459f272e6e22b577d0b5aa1e64

SHA256
c0dfc53a0f34717bd694c692ebb3c491178a8e27a8e5ca6cdfb13f1c4b10b556

SHA512
7fcecba09cd693b22dea1325e1cfd78048d9044b3efa5e452751ceb8a95523da47ab3a681492e3a5a29b118b4bc158d4f2a28e6d278b0954baa8729d3ce28907

Download Submit
C:\Windows\system\TcNQlEn.exe

Filesize
2.0MB

MD5
2258d9686496fa3b91cfc02b4fc4e7fb

SHA1
53df8f9266225434ec04589794225280821fe793

SHA256
e5f487594c12015ec0004c9d159b548b54c37f6770f241c05c4a649f9dbbe40e

SHA512
fc3a1e6453b86c107f3f939d33f3a7d02d23b4e7f925a861f34503e81f28500d62010228fb0994c00a1621d6e190e7b47ac9e05226d003b27637b5d1803f90d3

Download Submit
C:\Windows\system\WBRTipi.exe

Filesize
2.0MB

MD5
e651cc878e98ab92462b413c8c4a237e

SHA1
7e5b2feedf03c97fc2c3c24af0c9ecc78032ce9a

SHA256
677384eaea4db9e23a46ebbe5da1a71a990a4609e3a6a4fea2a965250c4eb211

SHA512
a5c9b886e96e9b09dd16edca76114d37b2085c818e9ded84eee56484b40c8207de98fc41074f177053214b3f387b7eb41d48eb7cda973429f28812d054959074

Download Submit
C:\Windows\system\WycMCQt.exe

Filesize
2.0MB

MD5
24f0be91b89105478defa28a89e0ae92

SHA1
4eac6fbf65f9ba5cb032d3cc512daa5f81fc4fe0

SHA256
269a3f573334a01200b6b5a9c8f248728ec806bfee4e9533066ec49f3c13d990

SHA512
529ffd7713d79a7c1159b08545d9a40fc4c67b2255ab86ece8d18904de1452e7d47c54f1c997d3b41152652988c6fcc5dbf3dbc94d5251f208be31f7ce4dfd68

Download Submit
C:\Windows\system\fnHNdmc.exe

Filesize
2.0MB

MD5
7127c89fccd9bc58ef84a328c03c0bf0

SHA1
e3d0033c38374e15bd20b83392d8c320381e207c

SHA256
d5ae189fd8a6e490a5bb38a2d9cf855a4679e495a5cb5f1d5f3caa7725f94d58

SHA512
c37042a7f7e2b5ee0c1488724b7660a9606a7f094b60a749b294cf7112c3b482c1b143d712214811143e6c6912959fd6b00f6b3c4e58498373046b34a7aeb109

Download Submit
C:\Windows\system\fxELRjO.exe

Filesize
2.0MB

MD5
d5294ffbb7a5d5b66ea389eb293500ab

SHA1
ebbe16e8c608df23f1e1d275f9cf70341b05ffc4

SHA256
182bc229787bd106fdba6dfbfd72f8cd5861c3f1bc1e31c2a477e3c2091dbceb

SHA512
3a3dfb4e70ded7be38a837bce55b98c4cb3d16a62fdaf89c0973a1d199d3106c107ea63229fe6acd2595678c67159778cce3978637cf02f0d15f2b5c0e8cb3e4

Download Submit
C:\Windows\system\iwjVAeI.exe

Filesize
2.0MB

MD5
f7815cdc9f7c0a744bcefd26096209e4

SHA1
c14ba4b948055f09a118cb8bdd19deeba0c60822

SHA256
7baec177240714f0bf3f41e4fabf8d84574acb9ca84d0ac07b544ada5464c198

SHA512
b7b19fc18127763e67381d574a8607c70b2b82328ac5323b130d11f0fce8b8ceae6ac362c491d98b90109bdd4e9819265e745644f46219ff00c6f237024f3dca

Download Submit
C:\Windows\system\kPOcqZX.exe

Filesize
2.0MB

MD5
d1b0bb9e005796d7bc4e8f0c8b54eaf1

SHA1
6576968fe1ea3178651dc9a6651127fcaeccdba9

SHA256
f8f2ac91f132c11010927ecb440e6a66139c1fd0fd2802d4b93af9686664bf2c

SHA512
78f81bde799fb8bbf8824d00a4a640df1cea7f4655442b4fcc2ff2dc7409eef4e8ded83af75843e25d0e62d80bfacba5a27ed03b5a9629a1cc7c8dc71d9b7f3b

Download Submit
C:\Windows\system\tiZEGkJ.exe

Filesize
2.0MB

MD5
23cba36df4c1e140a03cc84dd574fee5

SHA1
a863e3fb283b6152b639fafa27b274b16aae1826

SHA256
fbc6eb6bce98c3d756aca20301b7864b96d92da6a8286980513257eb544c89d3

SHA512
7a64c31a8312b45afc14f410ab74eda90ad64c679f224e138b80f891ecec25f8f3b0f5dc1dca40458d29427f59fbc2d3cb53d8ce8712772802558d232957c4ff

Download Submit
C:\Windows\system\vyJmKCb.exe

Filesize
2.0MB

MD5
03c9265ef77bc9cb7e71b684c2ce45bf

SHA1
eb994471c43985158b11a0a5f56b7b40c48ee26b

SHA256
c46db3564b200f86bd2981c5a68b3440dc2896938b5b8b10044b553f78eca832

SHA512
9cb5379c50d2da58b69bb85934fe920cbc2e7cf1544e233d76cd5a2963acec9fb671ddefbe7193ce3ccde38caad8c0ee75c317d81dca1af2e7e71752e5ec8f02

Download Submit
C:\Windows\system\yDsZrpl.exe

Filesize
2.0MB

MD5
24c5a694f39f7af3d56fc6fd3dc6570c

SHA1
8041d37bb3499cb327d8c28cefdc835a4dda5da7

SHA256
d57ecfa4b35d4a5f48abbcf662bd4c889722044e64555140c16b670d8798096b

SHA512
b03997ba1c4baf127242858c2239fb39305352d37fac29cf96c5b804590998320d3a5562105750aa4f12da28be880f66fbf9fe82298f74a08c68e47806fb79c0

Download Submit
\Windows\system\Cziosek.exe

Filesize
2.0MB

MD5
c03818872176c05108ee70b1d5b2576f

SHA1
f7d308802f68bede53835952ec0d588c29b049e0

SHA256
41c3b76a0e5a1fe402a3eaa597b42aadd19f376810727535afb2c75519f4b5c1

SHA512
a7f6cb54919a49f69127f1ca49d28c53ba3ac3876ee6f9aed43af55bdad3af6913850952491a1ba94ef26545ec71e310bc530dc8b3ea73ee6bee75a59ac9d916

Download Submit
\Windows\system\HJFhsbH.exe

Filesize
2.0MB

MD5
0b31980f98985952b416ab38ee1d806b

SHA1
f51a8ec461e7ea8a1bc2b8e770cb4b14698ac406

SHA256
54e556459c119b006553b48c9d6c79e2901738e7db492fcfaebcb95a96835c04

SHA512
817200ae9ea4b695e6630f2c0cdb680d80ba9f559a1de6b8a96845ade6e4c21c718496853b66c3b88487775ca3cc0cca54d366f0ea4803cf0a4d2586b1908100

Download Submit
\Windows\system\LBekIBp.exe

Filesize
2.0MB

MD5
40ca9a2f6d7e380523fc3c3fb64867a7

SHA1
af2429843025b3207b2e7742e07f38197267fa8e

SHA256
35ad304a2e919e399ba72b1e9e28fa9d55dab24447ad84aff1c9b73dca9385a4

SHA512
a66d2d996e7e79e7db2990b85c5a491f467a99400d7a95ba348ef6cf1459c7a3bc7a1865b8acca0a72b3e16f17192927070fc1214156b27f9f3eb516702714af

Download Submit
\Windows\system\TyQzxhI.exe

Filesize
2.0MB

MD5
4f5a2363d0060a625e4afbc81422fdbc

SHA1
eb68e94533005797411ef88facadf611c6741d6b

SHA256
013d36778f9eff4e4722fa7e3ea52fac2f8d5ade02457d9945b7c05823d25ab7

SHA512
77b4e520ce3be62bfd79673aa09015b489deed3312a8de17336bc24c26d2dc07dcd27a3b0c8856eb812a128d237e14a1af8906004c8517ee83de7fb1aa4ddd72

Download Submit
\Windows\system\ZxQvPSf.exe

Filesize
2.0MB

MD5
cc4f52372633a8c0a4dd2380d6de2223

SHA1
f000dbd6a3dc5ca08db62ae7498128418da0d803

SHA256
d1e6b071bdb5a0f3f007c0c30cb6350379d14a1fca9e6f59450fe63f18aef0cd

SHA512
7be6873c8a8697a69d953746fa0833a4cf064552bce26e464630dfdc391f69d31591aa32cef7564267f5a8850f90566c004cdff638f0510ff805ee2576ff833e

Download Submit
\Windows\system\axlSBqw.exe

Filesize
2.0MB

MD5
bd94d32c8f00651f1196cd5f8402fdc5

SHA1
89827db8d3563c3984c0aadcb64b1831a6f76c42

SHA256
ae1450d85f095f0b26392c18634d4d2b0ac5c332b7e9e9d4486288337a005362

SHA512
dbdfc5d16e7d0433fb78c39695adda47ece831f060751e23621151a91f67bdcf77613f085f6604dcc326ef976076842f513acc02810d26c495566bf0ac541d23

Download Submit
\Windows\system\iqgObNf.exe

Filesize
2.0MB

MD5
f1b24803d4b19cd683d409318c877891

SHA1
44b8a27adf08f5b73d41791e75174a96adafea06

SHA256
79e383441df62eddcb959758cad8c80e4669f7e057b1353e7446f09a8dd5f35d

SHA512
e3aca8a43f22cde3621120d83252af0dbf135b5f52b5fc15f9cabeab320fba239e69f9874adc7d22d05447d4fef23e5033d26423e4d93ad7b335592c0760f4d6

Download Submit
\Windows\system\kGrjRjk.exe

Filesize
2.0MB

MD5
9b90f7360a3b12adbd11f8d8e11d4b80

SHA1
a3b61fcd3b13a45c2baaac83b55d61f4ad49037d

SHA256
3d19285d79ab388d505d268f5ff3ccbafb24bb5386adf131b294969915246174

SHA512
353320c4e566713866f28619ffda42be2f24967d8530746fd16b831301ecf9b7812c1eb18651385fe0525e5923046d8d5b17865266c5e1cb4910d014c1b3f2d3

Download Submit
\Windows\system\oIqkDfd.exe

Filesize
2.0MB

MD5
e6fc035d7564f156135e86a11c87d94d

SHA1
6384cdc6c9ba0dd200ef600907bfbca5213b63da

SHA256
831ab640f315cad1ff193b9d54982c0c7608e7d0eae28429f5011c0fe6dd5aad

SHA512
2eca82c6ee9c2cfa3504cae0c50202e282e10283780ff485289260ac6309fbf04ecf8eb9f7c1be4a5489299ffd21eaea3dd5ac971d922ff26f45f7d77f0afb65

Download Submit
\Windows\system\xGUZgEe.exe

Filesize
2.0MB

MD5
9d0f748011dec125a6b925cf08ddc07b

SHA1
1953f0c1b71802c880b233434bf529de92a5fb8a

SHA256
52f601b4da3d51faa6377e2b8d921a2585750f3adb99940d2771a5899469952b

SHA512
aab7687f215e688d01f97cf6b245e4876b975cf459f0916900cccd24bd7fda0ab18a5bd62a92bbb5b3453e34e8bf8dce604f9100eff7916c792d73850494a295

Download Submit
memory/700-275-0x000000013FCF0000-0x00000001400E2000-memory.dmp

Filesize
3.9MB

Download
memory/700-6684-0x000000013FCF0000-0x00000001400E2000-memory.dmp

Filesize
3.9MB

Download
memory/700-42-0x000000013FCF0000-0x00000001400E2000-memory.dmp

Filesize
3.9MB

Download
memory/988-6607-0x000000013F070000-0x000000013F462000-memory.dmp

Filesize
3.9MB

Download
memory/988-54-0x000000013F070000-0x000000013F462000-memory.dmp

Filesize
3.9MB

Download
memory/1504-6685-0x000000013F6A0000-0x000000013FA92000-memory.dmp

Filesize
3.9MB

Download
memory/1504-50-0x000000013F6A0000-0x000000013FA92000-memory.dmp

Filesize
3.9MB

Download
memory/1936-111-0x0000000002290000-0x0000000002298000-memory.dmp

Filesize
32KB

Download
memory/1936-274-0x0000000002C70000-0x0000000002CF0000-memory.dmp

Filesize
512KB

Download
memory/1936-33-0x0000000002C70000-0x0000000002CF0000-memory.dmp

Filesize
512KB

Download
memory/1936-85-0x000000001B6A0000-0x000000001B982000-memory.dmp

Filesize
2.9MB

Download
memory/1960-75-0x000000013F840000-0x000000013FC32000-memory.dmp

Filesize
3.9MB

Download
memory/1960-6623-0x000000013F840000-0x000000013FC32000-memory.dmp

Filesize
3.9MB

Download
memory/2004-6683-0x000000013F560000-0x000000013F952000-memory.dmp

Filesize
3.9MB

Download
memory/2004-84-0x000000013F560000-0x000000013F952000-memory.dmp

Filesize
3.9MB

Download
memory/2152-90-0x000000013F630000-0x000000013FA22000-memory.dmp

Filesize
3.9MB

Download
memory/2152-6629-0x000000013F630000-0x000000013FA22000-memory.dmp

Filesize
3.9MB

Download
memory/2564-82-0x000000013F5C0000-0x000000013F9B2000-memory.dmp

Filesize
3.9MB

Download
memory/2564-6678-0x000000013F5C0000-0x000000013F9B2000-memory.dmp

Filesize
3.9MB

Download
memory/2736-6606-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/2736-32-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/2736-86-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/2788-6738-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2788-26-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2828-91-0x000000013F370000-0x000000013F762000-memory.dmp

Filesize
3.9MB

Download
memory/2828-6625-0x000000013F370000-0x000000013F762000-memory.dmp

Filesize
3.9MB

Download
memory/2844-6686-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2844-56-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2844-14-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2880-6366-0x000000013F490000-0x000000013F882000-memory.dmp

Filesize
3.9MB

Download
memory/2880-20-0x000000013F490000-0x000000013F882000-memory.dmp

Filesize
3.9MB

Download
memory/2880-57-0x000000013F490000-0x000000013F882000-memory.dmp

Filesize
3.9MB

Download
memory/2896-48-0x0000000003460000-0x0000000003852000-memory.dmp

Filesize
3.9MB

Download
memory/2896-83-0x000000013F5C0000-0x000000013F9B2000-memory.dmp

Filesize
3.9MB

Download
memory/2896-16-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2896-21-0x00000000030B0000-0x00000000034A2000-memory.dmp

Filesize
3.9MB

Download
memory/2896-31-0x00000000030B0000-0x00000000034A2000-memory.dmp

Filesize
3.9MB

Download
memory/2896-87-0x0000000003460000-0x0000000003852000-memory.dmp

Filesize
3.9MB

Download
memory/2896-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2896-58-0x000000013F840000-0x000000013FC32000-memory.dmp

Filesize
3.9MB

Download
memory/2896-38-0x000000013FCF0000-0x00000001400E2000-memory.dmp

Filesize
3.9MB

Download
memory/2896-79-0x000000013F630000-0x000000013FA22000-memory.dmp

Filesize
3.9MB

Download
memory/2896-0-0x000000013F130000-0x000000013F522000-memory.dmp

Filesize
3.9MB

Download
memory/2896-53-0x000000013F130000-0x000000013F522000-memory.dmp

Filesize
3.9MB

Download
memory/2896-8007-0x0000000003460000-0x0000000003852000-memory.dmp

Filesize
3.9MB

Download