xmrig | eb8fec182248d976453d60d71ec78f9c5082c5e419611184b7bb62f603907cf5

Analysis

max time kernel
119s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 21:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

133f5f83cedc22d37fb5a33013a02c60N.exe
Size

2.2MB
MD5

133f5f83cedc22d37fb5a33013a02c60
SHA1

02c2fe8a97794fde2a57918d786f38ef72691aad
SHA256

eb8fec182248d976453d60d71ec78f9c5082c5e419611184b7bb62f603907cf5
SHA512

8334ad90e8d6e729ce4c5a910c75e75facb23e2a17666bdd3dabccce32480f5f1e0e77495354fede5c50b5b821a99785c0ba90c5ed2913cf14d393062efe04a7
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrUIP:NABO

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 17 IoCs

miner

resource	yara_rule
behavioral1/memory/2888-12-0x000000013F630000-0x000000013FA22000-memory.dmp	xmrig
behavioral1/memory/2112-47-0x000000013F270000-0x000000013F662000-memory.dmp	xmrig
behavioral1/memory/484-125-0x000000013F920000-0x000000013FD12000-memory.dmp	xmrig
behavioral1/memory/2716-124-0x000000013F630000-0x000000013FA22000-memory.dmp	xmrig
behavioral1/memory/2596-120-0x000000013F380000-0x000000013F772000-memory.dmp	xmrig
behavioral1/memory/2992-19-0x000000013FEF0000-0x00000001402E2000-memory.dmp	xmrig
behavioral1/memory/2992-3974-0x000000013FEF0000-0x00000001402E2000-memory.dmp	xmrig
behavioral1/memory/2888-3969-0x000000013F630000-0x000000013FA22000-memory.dmp	xmrig
behavioral1/memory/2872-4007-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	xmrig
behavioral1/memory/2852-4001-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	xmrig
behavioral1/memory/484-4010-0x000000013F920000-0x000000013FD12000-memory.dmp	xmrig
behavioral1/memory/2596-4041-0x000000013F380000-0x000000013F772000-memory.dmp	xmrig
behavioral1/memory/2716-4071-0x000000013F630000-0x000000013FA22000-memory.dmp	xmrig
behavioral1/memory/2424-4093-0x000000013FD90000-0x0000000140182000-memory.dmp	xmrig
behavioral1/memory/2724-4710-0x000000013F740000-0x000000013FB32000-memory.dmp	xmrig
behavioral1/memory/2424-4819-0x000000013FD90000-0x0000000140182000-memory.dmp	xmrig
behavioral1/memory/2736-5391-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2416	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2888	LVOjbAW.exe
2992	WXDjEih.exe
2424	FEIIOrA.exe
2724	ZoacEps.exe
2872	SxCZfhR.exe
2736	pKqKBps.exe
2852	qFcyIeD.exe
2596	KSzpvrv.exe
2716	bNOqhtd.exe
484	pXOZVUi.exe
2840	QnNxOjG.exe
2632	szfpCXu.exe
1044	xtuUpJR.exe
1720	YrkOsGF.exe
2032	SArULhZ.exe
2616	jzHnbcR.exe
2900	EJntnHu.exe
2476	HwDuWMW.exe
2844	ejLidbB.exe
372	LdqhJfm.exe
2548	Cftvspr.exe
2372	ZHoMQGu.exe
1284	UrXPLoS.exe
2656	UXqjrKf.exe
3032	Routneb.exe
2944	qPLNzCx.exe
2456	SELtDwS.exe
316	lgCqIvl.exe
2968	ZfFKEps.exe
704	TsFgMJZ.exe
856	uOWKbaT.exe
1532	VxsWfbA.exe
1196	ftfqDuT.exe
932	XJNJTlx.exe
1216	YFFzdLG.exe
1488	keXCBWo.exe
1376	XOhuWLR.exe
2464	glAlNKg.exe
2000	fGSMeaq.exe
1312	UgMSmfD.exe
2364	gmiLwhE.exe
2200	WELvjKQ.exe
2848	HlDOuLy.exe
1672	qfogFQO.exe
1708	mRPPOCC.exe
2188	BrErFiV.exe
2360	IwBlips.exe
2408	pJHVJRa.exe
1588	NiUrmqR.exe
1804	gPDgKuH.exe
2196	pRSHHGu.exe
2804	QbITTUU.exe
2816	DQBnrRW.exe
2608	NLIaouo.exe
2320	jxkWFJl.exe
2028	mEzULak.exe
1088	QjiXrKq.exe
2912	jPvoSkO.exe
2940	gHSlewu.exe
2692	ebAzenP.exe
2064	qwbodVY.exe
616	DMHuYiy.exe
1884	SqFyMoz.exe
1856	FqtKfAS.exe

Loads dropped DLL 64 IoCs

pid	Process
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe
2112	133f5f83cedc22d37fb5a33013a02c60N.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2112-0-0x000000013F270000-0x000000013F662000-memory.dmp	upx
behavioral1/files/0x0007000000012118-6.dat	upx
behavioral1/files/0x000700000001871e-15.dat	upx
behavioral1/memory/2888-12-0x000000013F630000-0x000000013FA22000-memory.dmp	upx
behavioral1/files/0x000600000001872e-31.dat	upx
behavioral1/memory/2872-33-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	upx
behavioral1/files/0x0006000000018780-43.dat	upx
behavioral1/memory/2852-45-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	upx
behavioral1/memory/2112-47-0x000000013F270000-0x000000013F662000-memory.dmp	upx
behavioral1/memory/2112-48-0x000000013FD00000-0x00000001400F2000-memory.dmp	upx
behavioral1/files/0x0008000000018b00-46.dat	upx
behavioral1/memory/2736-38-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	upx
behavioral1/files/0x0006000000018736-36.dat	upx
behavioral1/memory/2724-27-0x000000013F740000-0x000000013FB32000-memory.dmp	upx
behavioral1/memory/2424-21-0x000000013FD90000-0x0000000140182000-memory.dmp	upx
behavioral1/files/0x00050000000194b9-54.dat	upx
behavioral1/files/0x000500000001960b-145.dat	upx
behavioral1/files/0x0005000000019623-189.dat	upx
behavioral1/files/0x0005000000019669-185.dat	upx
behavioral1/files/0x0005000000019625-175.dat	upx
behavioral1/files/0x0005000000019613-165.dat	upx
behavioral1/files/0x000500000001960f-155.dat	upx
behavioral1/files/0x000500000001961f-151.dat	upx
behavioral1/files/0x000f0000000054a8-143.dat	upx
behavioral1/files/0x000500000001961b-139.dat	upx
behavioral1/files/0x0005000000019617-128.dat	upx
behavioral1/files/0x0005000000019611-107.dat	upx
behavioral1/files/0x00050000000196b1-193.dat	upx
behavioral1/files/0x0005000000019627-181.dat	upx
behavioral1/files/0x0005000000019568-64.dat	upx
behavioral1/files/0x0005000000019624-169.dat	upx
behavioral1/files/0x0005000000019621-159.dat	upx
behavioral1/files/0x000500000001961d-149.dat	upx
behavioral1/files/0x0005000000019619-135.dat	upx
behavioral1/memory/484-125-0x000000013F920000-0x000000013FD12000-memory.dmp	upx
behavioral1/memory/2716-124-0x000000013F630000-0x000000013FA22000-memory.dmp	upx
behavioral1/files/0x0005000000019615-121.dat	upx
behavioral1/memory/2596-120-0x000000013F380000-0x000000013F772000-memory.dmp	upx
behavioral1/files/0x000500000001960d-95.dat	upx
behavioral1/files/0x00060000000195c7-85.dat	upx
behavioral1/files/0x00090000000175cc-76.dat	upx
behavioral1/files/0x00050000000194e7-75.dat	upx
behavioral1/files/0x0008000000018b83-63.dat	upx
behavioral1/files/0x00070000000186f3-20.dat	upx
behavioral1/memory/2992-19-0x000000013FEF0000-0x00000001402E2000-memory.dmp	upx
behavioral1/files/0x00060000000186f7-16.dat	upx
behavioral1/memory/2992-3974-0x000000013FEF0000-0x00000001402E2000-memory.dmp	upx
behavioral1/memory/2888-3969-0x000000013F630000-0x000000013FA22000-memory.dmp	upx
behavioral1/memory/2872-4007-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	upx
behavioral1/memory/2852-4001-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	upx
behavioral1/memory/484-4010-0x000000013F920000-0x000000013FD12000-memory.dmp	upx
behavioral1/memory/2596-4041-0x000000013F380000-0x000000013F772000-memory.dmp	upx
behavioral1/memory/2716-4071-0x000000013F630000-0x000000013FA22000-memory.dmp	upx
behavioral1/memory/2424-4093-0x000000013FD90000-0x0000000140182000-memory.dmp	upx
behavioral1/memory/2724-4710-0x000000013F740000-0x000000013FB32000-memory.dmp	upx
behavioral1/memory/2424-4819-0x000000013FD90000-0x0000000140182000-memory.dmp	upx
behavioral1/memory/2736-5391-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\RhKHjzz.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\HbAtIht.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\NkFdMui.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\WELvjKQ.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\VcmLtQq.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\mAzfNre.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\XMrvXKZ.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\KVjvDOP.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\cPalrpa.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\SDUbTLd.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\xtVKEoZ.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\EyofGIe.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\dERApCd.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\hDuFpVM.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\hNESnUZ.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\OXWPLVV.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\BOVnWoB.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\EPPkqSj.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\oeVtuYm.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\ZFIYdTa.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\MTMSKeB.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\cewMAIw.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\kTicmIW.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\lqeBVAH.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\LjEuBdA.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\ljelSYW.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\jPvoSkO.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\SAWpudn.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\AmWkfMZ.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\TfFIMiX.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\exnObZz.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\ybFGHTG.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\qxFlumi.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\eKjPsIm.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\ikrWlTM.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\aeACSqj.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\umgYjjs.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\qhsFelX.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\FtzmJPO.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\aKpuTjZ.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\pXSxSQj.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\WantLLv.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\UQIZivG.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\bpIHban.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\NRfoSdR.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\oZwNlHo.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\CKaHruq.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\pHTsPUN.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\VBFYKKF.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\shQTMda.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\UrwZPci.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\QgUJYRG.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\WkjBalB.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\CKGzRts.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\AxAWiHo.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\DruaDOL.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\FXSbPjh.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\BXOLWHX.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\hWpAkJp.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\PwTdkIu.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\TaFDlCY.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\huwtXQv.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\oBVTrPE.exe	133f5f83cedc22d37fb5a33013a02c60N.exe
File created	C:\Windows\System\PpLmQyw.exe	133f5f83cedc22d37fb5a33013a02c60N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2416	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2112	133f5f83cedc22d37fb5a33013a02c60N.exe
Token: SeLockMemoryPrivilege	2112	133f5f83cedc22d37fb5a33013a02c60N.exe
Token: SeDebugPrivilege	2416	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2416	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	31
PID 2112 wrote to memory of 2416	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	31
PID 2112 wrote to memory of 2416	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	31
PID 2112 wrote to memory of 2888	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	32
PID 2112 wrote to memory of 2888	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	32
PID 2112 wrote to memory of 2888	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	32
PID 2112 wrote to memory of 2424	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	33
PID 2112 wrote to memory of 2424	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	33
PID 2112 wrote to memory of 2424	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	33
PID 2112 wrote to memory of 2992	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	34
PID 2112 wrote to memory of 2992	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	34
PID 2112 wrote to memory of 2992	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	34
PID 2112 wrote to memory of 2724	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	35
PID 2112 wrote to memory of 2724	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	35
PID 2112 wrote to memory of 2724	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	35
PID 2112 wrote to memory of 2872	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	36
PID 2112 wrote to memory of 2872	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	36
PID 2112 wrote to memory of 2872	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	36
PID 2112 wrote to memory of 2736	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	37
PID 2112 wrote to memory of 2736	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	37
PID 2112 wrote to memory of 2736	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	37
PID 2112 wrote to memory of 2852	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	38
PID 2112 wrote to memory of 2852	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	38
PID 2112 wrote to memory of 2852	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	38
PID 2112 wrote to memory of 2632	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	39
PID 2112 wrote to memory of 2632	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	39
PID 2112 wrote to memory of 2632	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	39
PID 2112 wrote to memory of 2596	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	40
PID 2112 wrote to memory of 2596	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	40
PID 2112 wrote to memory of 2596	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	40
PID 2112 wrote to memory of 2616	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	41
PID 2112 wrote to memory of 2616	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	41
PID 2112 wrote to memory of 2616	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	41
PID 2112 wrote to memory of 2716	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	42
PID 2112 wrote to memory of 2716	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	42
PID 2112 wrote to memory of 2716	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	42
PID 2112 wrote to memory of 2476	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	43
PID 2112 wrote to memory of 2476	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	43
PID 2112 wrote to memory of 2476	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	43
PID 2112 wrote to memory of 484	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	44
PID 2112 wrote to memory of 484	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	44
PID 2112 wrote to memory of 484	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	44
PID 2112 wrote to memory of 2844	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	45
PID 2112 wrote to memory of 2844	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	45
PID 2112 wrote to memory of 2844	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	45
PID 2112 wrote to memory of 2840	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	46
PID 2112 wrote to memory of 2840	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	46
PID 2112 wrote to memory of 2840	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	46
PID 2112 wrote to memory of 372	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	47
PID 2112 wrote to memory of 372	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	47
PID 2112 wrote to memory of 372	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	47
PID 2112 wrote to memory of 1044	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	48
PID 2112 wrote to memory of 1044	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	48
PID 2112 wrote to memory of 1044	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	48
PID 2112 wrote to memory of 2372	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	49
PID 2112 wrote to memory of 2372	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	49
PID 2112 wrote to memory of 2372	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	49
PID 2112 wrote to memory of 1720	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	50
PID 2112 wrote to memory of 1720	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	50
PID 2112 wrote to memory of 1720	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	50
PID 2112 wrote to memory of 2656	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	51
PID 2112 wrote to memory of 2656	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	51
PID 2112 wrote to memory of 2656	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	51
PID 2112 wrote to memory of 2032	2112	133f5f83cedc22d37fb5a33013a02c60N.exe	52

C:\Users\Admin\AppData\Local\Temp\133f5f83cedc22d37fb5a33013a02c60N.exe
"C:\Users\Admin\AppData\Local\Temp\133f5f83cedc22d37fb5a33013a02c60N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2416
- C:\Windows\System\LVOjbAW.exe
  C:\Windows\System\LVOjbAW.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\FEIIOrA.exe
  C:\Windows\System\FEIIOrA.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\WXDjEih.exe
  C:\Windows\System\WXDjEih.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\ZoacEps.exe
  C:\Windows\System\ZoacEps.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\SxCZfhR.exe
  C:\Windows\System\SxCZfhR.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\pKqKBps.exe
  C:\Windows\System\pKqKBps.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\qFcyIeD.exe
  C:\Windows\System\qFcyIeD.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\szfpCXu.exe
  C:\Windows\System\szfpCXu.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\KSzpvrv.exe
  C:\Windows\System\KSzpvrv.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\jzHnbcR.exe
  C:\Windows\System\jzHnbcR.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\bNOqhtd.exe
  C:\Windows\System\bNOqhtd.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\HwDuWMW.exe
  C:\Windows\System\HwDuWMW.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\pXOZVUi.exe
  C:\Windows\System\pXOZVUi.exe
  2⤵
  - Executes dropped EXE
  PID:484
- C:\Windows\System\ejLidbB.exe
  C:\Windows\System\ejLidbB.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\QnNxOjG.exe
  C:\Windows\System\QnNxOjG.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\LdqhJfm.exe
  C:\Windows\System\LdqhJfm.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\xtuUpJR.exe
  C:\Windows\System\xtuUpJR.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\ZHoMQGu.exe
  C:\Windows\System\ZHoMQGu.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\YrkOsGF.exe
  C:\Windows\System\YrkOsGF.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\UXqjrKf.exe
  C:\Windows\System\UXqjrKf.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\SArULhZ.exe
  C:\Windows\System\SArULhZ.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\qPLNzCx.exe
  C:\Windows\System\qPLNzCx.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\EJntnHu.exe
  C:\Windows\System\EJntnHu.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\SELtDwS.exe
  C:\Windows\System\SELtDwS.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\Cftvspr.exe
  C:\Windows\System\Cftvspr.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\ZfFKEps.exe
  C:\Windows\System\ZfFKEps.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\UrXPLoS.exe
  C:\Windows\System\UrXPLoS.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\TsFgMJZ.exe
  C:\Windows\System\TsFgMJZ.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\Routneb.exe
  C:\Windows\System\Routneb.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\ftfqDuT.exe
  C:\Windows\System\ftfqDuT.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\lgCqIvl.exe
  C:\Windows\System\lgCqIvl.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\YFFzdLG.exe
  C:\Windows\System\YFFzdLG.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\uOWKbaT.exe
  C:\Windows\System\uOWKbaT.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\keXCBWo.exe
  C:\Windows\System\keXCBWo.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\VxsWfbA.exe
  C:\Windows\System\VxsWfbA.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\XOhuWLR.exe
  C:\Windows\System\XOhuWLR.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\XJNJTlx.exe
  C:\Windows\System\XJNJTlx.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\glAlNKg.exe
  C:\Windows\System\glAlNKg.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\fGSMeaq.exe
  C:\Windows\System\fGSMeaq.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\UgMSmfD.exe
  C:\Windows\System\UgMSmfD.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\gmiLwhE.exe
  C:\Windows\System\gmiLwhE.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\WELvjKQ.exe
  C:\Windows\System\WELvjKQ.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\HlDOuLy.exe
  C:\Windows\System\HlDOuLy.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\qfogFQO.exe
  C:\Windows\System\qfogFQO.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\mRPPOCC.exe
  C:\Windows\System\mRPPOCC.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\BrErFiV.exe
  C:\Windows\System\BrErFiV.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\IwBlips.exe
  C:\Windows\System\IwBlips.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\pJHVJRa.exe
  C:\Windows\System\pJHVJRa.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\NiUrmqR.exe
  C:\Windows\System\NiUrmqR.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\gPDgKuH.exe
  C:\Windows\System\gPDgKuH.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\pRSHHGu.exe
  C:\Windows\System\pRSHHGu.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\QbITTUU.exe
  C:\Windows\System\QbITTUU.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\DQBnrRW.exe
  C:\Windows\System\DQBnrRW.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\NLIaouo.exe
  C:\Windows\System\NLIaouo.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\jxkWFJl.exe
  C:\Windows\System\jxkWFJl.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\mEzULak.exe
  C:\Windows\System\mEzULak.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\QjiXrKq.exe
  C:\Windows\System\QjiXrKq.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\jPvoSkO.exe
  C:\Windows\System\jPvoSkO.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\gHSlewu.exe
  C:\Windows\System\gHSlewu.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\ebAzenP.exe
  C:\Windows\System\ebAzenP.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\qwbodVY.exe
  C:\Windows\System\qwbodVY.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\DMHuYiy.exe
  C:\Windows\System\DMHuYiy.exe
  2⤵
  - Executes dropped EXE
  PID:616
- C:\Windows\System\SqFyMoz.exe
  C:\Windows\System\SqFyMoz.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\FqtKfAS.exe
  C:\Windows\System\FqtKfAS.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\LVzENrX.exe
  C:\Windows\System\LVzENrX.exe
  2⤵
  PID:2672
- C:\Windows\System\tyLgkwX.exe
  C:\Windows\System\tyLgkwX.exe
  2⤵
  PID:1636
- C:\Windows\System\nGikdky.exe
  C:\Windows\System\nGikdky.exe
  2⤵
  PID:536
- C:\Windows\System\VuqTqrm.exe
  C:\Windows\System\VuqTqrm.exe
  2⤵
  PID:2012
- C:\Windows\System\ZbAPrIm.exe
  C:\Windows\System\ZbAPrIm.exe
  2⤵
  PID:1644
- C:\Windows\System\KmIwrCr.exe
  C:\Windows\System\KmIwrCr.exe
  2⤵
  PID:2024
- C:\Windows\System\LUkEQEd.exe
  C:\Windows\System\LUkEQEd.exe
  2⤵
  PID:2132
- C:\Windows\System\snCNRMp.exe
  C:\Windows\System\snCNRMp.exe
  2⤵
  PID:2576
- C:\Windows\System\XZACnKe.exe
  C:\Windows\System\XZACnKe.exe
  2⤵
  PID:1040
- C:\Windows\System\MlJAtrf.exe
  C:\Windows\System\MlJAtrf.exe
  2⤵
  PID:1652
- C:\Windows\System\FaPuvQh.exe
  C:\Windows\System\FaPuvQh.exe
  2⤵
  PID:3000
- C:\Windows\System\gPfMllV.exe
  C:\Windows\System\gPfMllV.exe
  2⤵
  PID:1736
- C:\Windows\System\oioVdrJ.exe
  C:\Windows\System\oioVdrJ.exe
  2⤵
  PID:1572
- C:\Windows\System\rFskccu.exe
  C:\Windows\System\rFskccu.exe
  2⤵
  PID:1524
- C:\Windows\System\dikSxUE.exe
  C:\Windows\System\dikSxUE.exe
  2⤵
  PID:2356
- C:\Windows\System\RRRmKfl.exe
  C:\Windows\System\RRRmKfl.exe
  2⤵
  PID:888
- C:\Windows\System\VEVFmzH.exe
  C:\Windows\System\VEVFmzH.exe
  2⤵
  PID:2564
- C:\Windows\System\ogUeDSI.exe
  C:\Windows\System\ogUeDSI.exe
  2⤵
  PID:2728
- C:\Windows\System\yzaeBXX.exe
  C:\Windows\System\yzaeBXX.exe
  2⤵
  PID:1592
- C:\Windows\System\dTeobKE.exe
  C:\Windows\System\dTeobKE.exe
  2⤵
  PID:2492
- C:\Windows\System\PgIzIAd.exe
  C:\Windows\System\PgIzIAd.exe
  2⤵
  PID:2080
- C:\Windows\System\KzHnJLZ.exe
  C:\Windows\System\KzHnJLZ.exe
  2⤵
  PID:1740
- C:\Windows\System\Kcvgfum.exe
  C:\Windows\System\Kcvgfum.exe
  2⤵
  PID:2096
- C:\Windows\System\nsfKnqE.exe
  C:\Windows\System\nsfKnqE.exe
  2⤵
  PID:468
- C:\Windows\System\xBDmPJo.exe
  C:\Windows\System\xBDmPJo.exe
  2⤵
  PID:2784
- C:\Windows\System\mtwOwtv.exe
  C:\Windows\System\mtwOwtv.exe
  2⤵
  PID:308
- C:\Windows\System\iBaZHgq.exe
  C:\Windows\System\iBaZHgq.exe
  2⤵
  PID:2960
- C:\Windows\System\RyRnbVG.exe
  C:\Windows\System\RyRnbVG.exe
  2⤵
  PID:2648
- C:\Windows\System\LhlugdO.exe
  C:\Windows\System\LhlugdO.exe
  2⤵
  PID:2868
- C:\Windows\System\ZcwBOvp.exe
  C:\Windows\System\ZcwBOvp.exe
  2⤵
  PID:2008
- C:\Windows\System\ObUyukE.exe
  C:\Windows\System\ObUyukE.exe
  2⤵
  PID:2924
- C:\Windows\System\XAsMNHk.exe
  C:\Windows\System\XAsMNHk.exe
  2⤵
  PID:2956
- C:\Windows\System\gGOZRmw.exe
  C:\Windows\System\gGOZRmw.exe
  2⤵
  PID:496
- C:\Windows\System\somfPEI.exe
  C:\Windows\System\somfPEI.exe
  2⤵
  PID:2544
- C:\Windows\System\GizfcUK.exe
  C:\Windows\System\GizfcUK.exe
  2⤵
  PID:1556
- C:\Windows\System\FdIMwau.exe
  C:\Windows\System\FdIMwau.exe
  2⤵
  PID:2236
- C:\Windows\System\gGtBThp.exe
  C:\Windows\System\gGtBThp.exe
  2⤵
  PID:2100
- C:\Windows\System\vWJmPNX.exe
  C:\Windows\System\vWJmPNX.exe
  2⤵
  PID:2776
- C:\Windows\System\tnTqvPe.exe
  C:\Windows\System\tnTqvPe.exe
  2⤵
  PID:1860
- C:\Windows\System\nqjGpff.exe
  C:\Windows\System\nqjGpff.exe
  2⤵
  PID:2180
- C:\Windows\System\yzxGlcx.exe
  C:\Windows\System\yzxGlcx.exe
  2⤵
  PID:3048
- C:\Windows\System\ZaXzUlO.exe
  C:\Windows\System\ZaXzUlO.exe
  2⤵
  PID:1980
- C:\Windows\System\PBGUayh.exe
  C:\Windows\System\PBGUayh.exe
  2⤵
  PID:1072
- C:\Windows\System\ospKJnj.exe
  C:\Windows\System\ospKJnj.exe
  2⤵
  PID:1800
- C:\Windows\System\IJRvHbK.exe
  C:\Windows\System\IJRvHbK.exe
  2⤵
  PID:764
- C:\Windows\System\OXHBVGH.exe
  C:\Windows\System\OXHBVGH.exe
  2⤵
  PID:2824
- C:\Windows\System\PInsFje.exe
  C:\Windows\System\PInsFje.exe
  2⤵
  PID:1172
- C:\Windows\System\QtAXMJg.exe
  C:\Windows\System\QtAXMJg.exe
  2⤵
  PID:1916
- C:\Windows\System\nmCLzqS.exe
  C:\Windows\System\nmCLzqS.exe
  2⤵
  PID:1096
- C:\Windows\System\vtfBiYX.exe
  C:\Windows\System\vtfBiYX.exe
  2⤵
  PID:1892
- C:\Windows\System\ebcbkBF.exe
  C:\Windows\System\ebcbkBF.exe
  2⤵
  PID:2604
- C:\Windows\System\ULPPmFZ.exe
  C:\Windows\System\ULPPmFZ.exe
  2⤵
  PID:1584
- C:\Windows\System\mvYbWIY.exe
  C:\Windows\System\mvYbWIY.exe
  2⤵
  PID:2284
- C:\Windows\System\NzTDppg.exe
  C:\Windows\System\NzTDppg.exe
  2⤵
  PID:568
- C:\Windows\System\KCxyXnP.exe
  C:\Windows\System\KCxyXnP.exe
  2⤵
  PID:2300
- C:\Windows\System\bdPdIaP.exe
  C:\Windows\System\bdPdIaP.exe
  2⤵
  PID:1076
- C:\Windows\System\jsofAZN.exe
  C:\Windows\System\jsofAZN.exe
  2⤵
  PID:2740
- C:\Windows\System\JlkuVht.exe
  C:\Windows\System\JlkuVht.exe
  2⤵
  PID:2264
- C:\Windows\System\PwTdkIu.exe
  C:\Windows\System\PwTdkIu.exe
  2⤵
  PID:1600
- C:\Windows\System\NggPLzC.exe
  C:\Windows\System\NggPLzC.exe
  2⤵
  PID:1560
- C:\Windows\System\bzKVWmU.exe
  C:\Windows\System\bzKVWmU.exe
  2⤵
  PID:2928
- C:\Windows\System\ORNOFfz.exe
  C:\Windows\System\ORNOFfz.exe
  2⤵
  PID:3064
- C:\Windows\System\SNeyKSC.exe
  C:\Windows\System\SNeyKSC.exe
  2⤵
  PID:2704
- C:\Windows\System\yIuIzLn.exe
  C:\Windows\System\yIuIzLn.exe
  2⤵
  PID:1544
- C:\Windows\System\ImqeHcs.exe
  C:\Windows\System\ImqeHcs.exe
  2⤵
  PID:2136
- C:\Windows\System\IeGhjYw.exe
  C:\Windows\System\IeGhjYw.exe
  2⤵
  PID:1364
- C:\Windows\System\zwdZofV.exe
  C:\Windows\System\zwdZofV.exe
  2⤵
  PID:3024
- C:\Windows\System\tOnkcwj.exe
  C:\Windows\System\tOnkcwj.exe
  2⤵
  PID:3080
- C:\Windows\System\nWpOtZB.exe
  C:\Windows\System\nWpOtZB.exe
  2⤵
  PID:3096
- C:\Windows\System\bIjPdSz.exe
  C:\Windows\System\bIjPdSz.exe
  2⤵
  PID:3112
- C:\Windows\System\FjOrjVz.exe
  C:\Windows\System\FjOrjVz.exe
  2⤵
  PID:3128
- C:\Windows\System\GapdoLW.exe
  C:\Windows\System\GapdoLW.exe
  2⤵
  PID:3144
- C:\Windows\System\ZMQpaMp.exe
  C:\Windows\System\ZMQpaMp.exe
  2⤵
  PID:3160
- C:\Windows\System\EmiKErc.exe
  C:\Windows\System\EmiKErc.exe
  2⤵
  PID:3176
- C:\Windows\System\eSYVRzT.exe
  C:\Windows\System\eSYVRzT.exe
  2⤵
  PID:3192
- C:\Windows\System\OulrLns.exe
  C:\Windows\System\OulrLns.exe
  2⤵
  PID:3208
- C:\Windows\System\SmCRxLG.exe
  C:\Windows\System\SmCRxLG.exe
  2⤵
  PID:3224
- C:\Windows\System\aIYzOIq.exe
  C:\Windows\System\aIYzOIq.exe
  2⤵
  PID:3240
- C:\Windows\System\vGVQUrK.exe
  C:\Windows\System\vGVQUrK.exe
  2⤵
  PID:3256
- C:\Windows\System\CEsevwH.exe
  C:\Windows\System\CEsevwH.exe
  2⤵
  PID:3272
- C:\Windows\System\OwiHrUF.exe
  C:\Windows\System\OwiHrUF.exe
  2⤵
  PID:3288
- C:\Windows\System\JcMHbHh.exe
  C:\Windows\System\JcMHbHh.exe
  2⤵
  PID:3304
- C:\Windows\System\jHVaSMk.exe
  C:\Windows\System\jHVaSMk.exe
  2⤵
  PID:3320
- C:\Windows\System\sjgHhwo.exe
  C:\Windows\System\sjgHhwo.exe
  2⤵
  PID:3336
- C:\Windows\System\HSVlmgj.exe
  C:\Windows\System\HSVlmgj.exe
  2⤵
  PID:3352
- C:\Windows\System\wYVXKrd.exe
  C:\Windows\System\wYVXKrd.exe
  2⤵
  PID:3368
- C:\Windows\System\SnVFWwy.exe
  C:\Windows\System\SnVFWwy.exe
  2⤵
  PID:3384
- C:\Windows\System\xaHvQxE.exe
  C:\Windows\System\xaHvQxE.exe
  2⤵
  PID:3400
- C:\Windows\System\dkKzevZ.exe
  C:\Windows\System\dkKzevZ.exe
  2⤵
  PID:3416
- C:\Windows\System\ibIpGOk.exe
  C:\Windows\System\ibIpGOk.exe
  2⤵
  PID:3432
- C:\Windows\System\DupybpB.exe
  C:\Windows\System\DupybpB.exe
  2⤵
  PID:3448
- C:\Windows\System\kSerNFj.exe
  C:\Windows\System\kSerNFj.exe
  2⤵
  PID:3464
- C:\Windows\System\XiRXrJX.exe
  C:\Windows\System\XiRXrJX.exe
  2⤵
  PID:3480
- C:\Windows\System\BrvVIYU.exe
  C:\Windows\System\BrvVIYU.exe
  2⤵
  PID:3496
- C:\Windows\System\BJgFrzI.exe
  C:\Windows\System\BJgFrzI.exe
  2⤵
  PID:3512
- C:\Windows\System\qpDUTuM.exe
  C:\Windows\System\qpDUTuM.exe
  2⤵
  PID:3528
- C:\Windows\System\bHEmbJB.exe
  C:\Windows\System\bHEmbJB.exe
  2⤵
  PID:3544
- C:\Windows\System\viBPTnz.exe
  C:\Windows\System\viBPTnz.exe
  2⤵
  PID:3560
- C:\Windows\System\elDrDWO.exe
  C:\Windows\System\elDrDWO.exe
  2⤵
  PID:3576
- C:\Windows\System\thIPRgo.exe
  C:\Windows\System\thIPRgo.exe
  2⤵
  PID:3592
- C:\Windows\System\gFItjSf.exe
  C:\Windows\System\gFItjSf.exe
  2⤵
  PID:3608
- C:\Windows\System\qAXkVOC.exe
  C:\Windows\System\qAXkVOC.exe
  2⤵
  PID:3624
- C:\Windows\System\UBmCMkm.exe
  C:\Windows\System\UBmCMkm.exe
  2⤵
  PID:3640
- C:\Windows\System\ZiGOCjh.exe
  C:\Windows\System\ZiGOCjh.exe
  2⤵
  PID:3656
- C:\Windows\System\lEyeGRi.exe
  C:\Windows\System\lEyeGRi.exe
  2⤵
  PID:3672
- C:\Windows\System\aSCKCJG.exe
  C:\Windows\System\aSCKCJG.exe
  2⤵
  PID:3688
- C:\Windows\System\dolZnuq.exe
  C:\Windows\System\dolZnuq.exe
  2⤵
  PID:3704
- C:\Windows\System\HNVexdB.exe
  C:\Windows\System\HNVexdB.exe
  2⤵
  PID:3720
- C:\Windows\System\uPDHIZN.exe
  C:\Windows\System\uPDHIZN.exe
  2⤵
  PID:3736
- C:\Windows\System\pcjZVBa.exe
  C:\Windows\System\pcjZVBa.exe
  2⤵
  PID:3752
- C:\Windows\System\YYwZHUk.exe
  C:\Windows\System\YYwZHUk.exe
  2⤵
  PID:3768
- C:\Windows\System\TrRSUWt.exe
  C:\Windows\System\TrRSUWt.exe
  2⤵
  PID:3784
- C:\Windows\System\yWSVvkd.exe
  C:\Windows\System\yWSVvkd.exe
  2⤵
  PID:3800
- C:\Windows\System\wHrezjg.exe
  C:\Windows\System\wHrezjg.exe
  2⤵
  PID:3816
- C:\Windows\System\PIrDjND.exe
  C:\Windows\System\PIrDjND.exe
  2⤵
  PID:3832
- C:\Windows\System\mkQJskF.exe
  C:\Windows\System\mkQJskF.exe
  2⤵
  PID:3848
- C:\Windows\System\fhEbXMh.exe
  C:\Windows\System\fhEbXMh.exe
  2⤵
  PID:3864
- C:\Windows\System\BEwdxKs.exe
  C:\Windows\System\BEwdxKs.exe
  2⤵
  PID:3880
- C:\Windows\System\iYEHLIB.exe
  C:\Windows\System\iYEHLIB.exe
  2⤵
  PID:3896
- C:\Windows\System\cZfBNLU.exe
  C:\Windows\System\cZfBNLU.exe
  2⤵
  PID:3912
- C:\Windows\System\MhQtBnU.exe
  C:\Windows\System\MhQtBnU.exe
  2⤵
  PID:3928
- C:\Windows\System\TOCXZqp.exe
  C:\Windows\System\TOCXZqp.exe
  2⤵
  PID:3944
- C:\Windows\System\hQkAMJP.exe
  C:\Windows\System\hQkAMJP.exe
  2⤵
  PID:3960
- C:\Windows\System\lCzUqWh.exe
  C:\Windows\System\lCzUqWh.exe
  2⤵
  PID:3976
- C:\Windows\System\jVtOBxW.exe
  C:\Windows\System\jVtOBxW.exe
  2⤵
  PID:3992
- C:\Windows\System\qeBPIab.exe
  C:\Windows\System\qeBPIab.exe
  2⤵
  PID:4008
- C:\Windows\System\TcBHzGF.exe
  C:\Windows\System\TcBHzGF.exe
  2⤵
  PID:4024
- C:\Windows\System\WdjrTTH.exe
  C:\Windows\System\WdjrTTH.exe
  2⤵
  PID:4040
- C:\Windows\System\JDrqYQR.exe
  C:\Windows\System\JDrqYQR.exe
  2⤵
  PID:4056
- C:\Windows\System\bYlgjqo.exe
  C:\Windows\System\bYlgjqo.exe
  2⤵
  PID:4072
- C:\Windows\System\uAkJLfe.exe
  C:\Windows\System\uAkJLfe.exe
  2⤵
  PID:4088
- C:\Windows\System\zOvKJHx.exe
  C:\Windows\System\zOvKJHx.exe
  2⤵
  PID:376
- C:\Windows\System\JFXTNyL.exe
  C:\Windows\System\JFXTNyL.exe
  2⤵
  PID:2376
- C:\Windows\System\JqJICZy.exe
  C:\Windows\System\JqJICZy.exe
  2⤵
  PID:2204
- C:\Windows\System\lffIucN.exe
  C:\Windows\System\lffIucN.exe
  2⤵
  PID:1232
- C:\Windows\System\DnZBJtQ.exe
  C:\Windows\System\DnZBJtQ.exe
  2⤵
  PID:1104
- C:\Windows\System\xvKiAJE.exe
  C:\Windows\System\xvKiAJE.exe
  2⤵
  PID:872
- C:\Windows\System\kJPfVTP.exe
  C:\Windows\System\kJPfVTP.exe
  2⤵
  PID:3092
- C:\Windows\System\WVhwsLL.exe
  C:\Windows\System\WVhwsLL.exe
  2⤵
  PID:3140
- C:\Windows\System\BSlAsFM.exe
  C:\Windows\System\BSlAsFM.exe
  2⤵
  PID:3156
- C:\Windows\System\DuhYPLi.exe
  C:\Windows\System\DuhYPLi.exe
  2⤵
  PID:3188
- C:\Windows\System\ljpUDCb.exe
  C:\Windows\System\ljpUDCb.exe
  2⤵
  PID:3220
- C:\Windows\System\fylHtZg.exe
  C:\Windows\System\fylHtZg.exe
  2⤵
  PID:3252
- C:\Windows\System\CSjCSRP.exe
  C:\Windows\System\CSjCSRP.exe
  2⤵
  PID:3284
- C:\Windows\System\wgOQeob.exe
  C:\Windows\System\wgOQeob.exe
  2⤵
  PID:3332
- C:\Windows\System\bGIEwJI.exe
  C:\Windows\System\bGIEwJI.exe
  2⤵
  PID:3364
- C:\Windows\System\jZjFlCT.exe
  C:\Windows\System\jZjFlCT.exe
  2⤵
  PID:3440
- C:\Windows\System\pEYszJZ.exe
  C:\Windows\System\pEYszJZ.exe
  2⤵
  PID:3444
- C:\Windows\System\SrXeCgT.exe
  C:\Windows\System\SrXeCgT.exe
  2⤵
  PID:3472
- C:\Windows\System\HtBIlZy.exe
  C:\Windows\System\HtBIlZy.exe
  2⤵
  PID:3508
- C:\Windows\System\jDlHIkm.exe
  C:\Windows\System\jDlHIkm.exe
  2⤵
  PID:2920
- C:\Windows\System\xjjsvQT.exe
  C:\Windows\System\xjjsvQT.exe
  2⤵
  PID:3588
- C:\Windows\System\NIDNcUj.exe
  C:\Windows\System\NIDNcUj.exe
  2⤵
  PID:3060
- C:\Windows\System\lrfckHM.exe
  C:\Windows\System\lrfckHM.exe
  2⤵
  PID:3604
- C:\Windows\System\mhQntml.exe
  C:\Windows\System\mhQntml.exe
  2⤵
  PID:3652
- C:\Windows\System\ppauOjg.exe
  C:\Windows\System\ppauOjg.exe
  2⤵
  PID:3668
- C:\Windows\System\XloHWle.exe
  C:\Windows\System\XloHWle.exe
  2⤵
  PID:3716
- C:\Windows\System\VCAIRTu.exe
  C:\Windows\System\VCAIRTu.exe
  2⤵
  PID:3732
- C:\Windows\System\oxqZYMz.exe
  C:\Windows\System\oxqZYMz.exe
  2⤵
  PID:3776
- C:\Windows\System\EiSoWTP.exe
  C:\Windows\System\EiSoWTP.exe
  2⤵
  PID:3812
- C:\Windows\System\XJHFDSi.exe
  C:\Windows\System\XJHFDSi.exe
  2⤵
  PID:3824
- C:\Windows\System\wiVCHDH.exe
  C:\Windows\System\wiVCHDH.exe
  2⤵
  PID:3860
- C:\Windows\System\FjivIUA.exe
  C:\Windows\System\FjivIUA.exe
  2⤵
  PID:3892
- C:\Windows\System\NRfoSdR.exe
  C:\Windows\System\NRfoSdR.exe
  2⤵
  PID:3936
- C:\Windows\System\yKoxZsU.exe
  C:\Windows\System\yKoxZsU.exe
  2⤵
  PID:3972
- C:\Windows\System\wKYThSC.exe
  C:\Windows\System\wKYThSC.exe
  2⤵
  PID:4000
- C:\Windows\System\gHcAQKC.exe
  C:\Windows\System\gHcAQKC.exe
  2⤵
  PID:4036
- C:\Windows\System\OhRVnFs.exe
  C:\Windows\System\OhRVnFs.exe
  2⤵
  PID:4068
- C:\Windows\System\FCpPRwQ.exe
  C:\Windows\System\FCpPRwQ.exe
  2⤵
  PID:4080
- C:\Windows\System\fhOVlho.exe
  C:\Windows\System\fhOVlho.exe
  2⤵
  PID:2752
- C:\Windows\System\nmcSVTS.exe
  C:\Windows\System\nmcSVTS.exe
  2⤵
  PID:2696
- C:\Windows\System\vrCcomG.exe
  C:\Windows\System\vrCcomG.exe
  2⤵
  PID:1188
- C:\Windows\System\SfmavIV.exe
  C:\Windows\System\SfmavIV.exe
  2⤵
  PID:3172
- C:\Windows\System\hOWDkfl.exe
  C:\Windows\System\hOWDkfl.exe
  2⤵
  PID:3232
- C:\Windows\System\aUKzYzW.exe
  C:\Windows\System\aUKzYzW.exe
  2⤵
  PID:3236
- C:\Windows\System\AAiQpgE.exe
  C:\Windows\System\AAiQpgE.exe
  2⤵
  PID:3004
- C:\Windows\System\PPJAyEj.exe
  C:\Windows\System\PPJAyEj.exe
  2⤵
  PID:3492
- C:\Windows\System\BaPDADR.exe
  C:\Windows\System\BaPDADR.exe
  2⤵
  PID:3268
- C:\Windows\System\LLdqKJz.exe
  C:\Windows\System\LLdqKJz.exe
  2⤵
  PID:3312
- C:\Windows\System\ZFIYdTa.exe
  C:\Windows\System\ZFIYdTa.exe
  2⤵
  PID:3616
- C:\Windows\System\khvPtQo.exe
  C:\Windows\System\khvPtQo.exe
  2⤵
  PID:3680
- C:\Windows\System\mCbxhBd.exe
  C:\Windows\System\mCbxhBd.exe
  2⤵
  PID:3396
- C:\Windows\System\XuBajLf.exe
  C:\Windows\System\XuBajLf.exe
  2⤵
  PID:3792
- C:\Windows\System\PMwyoQL.exe
  C:\Windows\System\PMwyoQL.exe
  2⤵
  PID:3920
- C:\Windows\System\VHbYAjY.exe
  C:\Windows\System\VHbYAjY.exe
  2⤵
  PID:3540
- C:\Windows\System\gVTQnPA.exe
  C:\Windows\System\gVTQnPA.exe
  2⤵
  PID:3648
- C:\Windows\System\OKRzILz.exe
  C:\Windows\System\OKRzILz.exe
  2⤵
  PID:3840
- C:\Windows\System\KsQDFjE.exe
  C:\Windows\System\KsQDFjE.exe
  2⤵
  PID:3780
- C:\Windows\System\XtJeprm.exe
  C:\Windows\System\XtJeprm.exe
  2⤵
  PID:2444
- C:\Windows\System\zDjeegc.exe
  C:\Windows\System\zDjeegc.exe
  2⤵
  PID:3984
- C:\Windows\System\lkaCztJ.exe
  C:\Windows\System\lkaCztJ.exe
  2⤵
  PID:4004
- C:\Windows\System\CQglxwk.exe
  C:\Windows\System\CQglxwk.exe
  2⤵
  PID:1140
- C:\Windows\System\QVKXICC.exe
  C:\Windows\System\QVKXICC.exe
  2⤵
  PID:1320
- C:\Windows\System\kCYskUt.exe
  C:\Windows\System\kCYskUt.exe
  2⤵
  PID:2700
- C:\Windows\System\ZbMlAnV.exe
  C:\Windows\System\ZbMlAnV.exe
  2⤵
  PID:3520
- C:\Windows\System\euVGwlq.exe
  C:\Windows\System\euVGwlq.exe
  2⤵
  PID:3744
- C:\Windows\System\pFgVdDG.exe
  C:\Windows\System\pFgVdDG.exe
  2⤵
  PID:3460
- C:\Windows\System\tYgiWGC.exe
  C:\Windows\System\tYgiWGC.exe
  2⤵
  PID:3856
- C:\Windows\System\WcCOrur.exe
  C:\Windows\System\WcCOrur.exe
  2⤵
  PID:3376
- C:\Windows\System\sDccLRV.exe
  C:\Windows\System\sDccLRV.exe
  2⤵
  PID:1812
- C:\Windows\System\ynCxpEo.exe
  C:\Windows\System\ynCxpEo.exe
  2⤵
  PID:3536
- C:\Windows\System\KDZXOoc.exe
  C:\Windows\System\KDZXOoc.exe
  2⤵
  PID:3796
- C:\Windows\System\ReavFgF.exe
  C:\Windows\System\ReavFgF.exe
  2⤵
  PID:1480
- C:\Windows\System\GuLGRtn.exe
  C:\Windows\System\GuLGRtn.exe
  2⤵
  PID:4064
- C:\Windows\System\HgDbjMT.exe
  C:\Windows\System\HgDbjMT.exe
  2⤵
  PID:2524
- C:\Windows\System\yHlmDTw.exe
  C:\Windows\System\yHlmDTw.exe
  2⤵
  PID:3456
- C:\Windows\System\fPTZKmv.exe
  C:\Windows\System\fPTZKmv.exe
  2⤵
  PID:2932
- C:\Windows\System\hGemqrt.exe
  C:\Windows\System\hGemqrt.exe
  2⤵
  PID:3028
- C:\Windows\System\LlPuNaZ.exe
  C:\Windows\System\LlPuNaZ.exe
  2⤵
  PID:3344
- C:\Windows\System\LfZoDfJ.exe
  C:\Windows\System\LfZoDfJ.exe
  2⤵
  PID:824
- C:\Windows\System\yGGwdVc.exe
  C:\Windows\System\yGGwdVc.exe
  2⤵
  PID:2712
- C:\Windows\System\aSvKXhB.exe
  C:\Windows\System\aSvKXhB.exe
  2⤵
  PID:2332
- C:\Windows\System\RDVcSdl.exe
  C:\Windows\System\RDVcSdl.exe
  2⤵
  PID:4032
- C:\Windows\System\rrMLwWS.exe
  C:\Windows\System\rrMLwWS.exe
  2⤵
  PID:2580
- C:\Windows\System\wgvGZDu.exe
  C:\Windows\System\wgvGZDu.exe
  2⤵
  PID:956
- C:\Windows\System\obEgOPL.exe
  C:\Windows\System\obEgOPL.exe
  2⤵
  PID:2636
- C:\Windows\System\oczdhgo.exe
  C:\Windows\System\oczdhgo.exe
  2⤵
  PID:3488
- C:\Windows\System\nlXWchR.exe
  C:\Windows\System\nlXWchR.exe
  2⤵
  PID:3300
- C:\Windows\System\NjjYQgA.exe
  C:\Windows\System\NjjYQgA.exe
  2⤵
  PID:4048
- C:\Windows\System\XawVPEi.exe
  C:\Windows\System\XawVPEi.exe
  2⤵
  PID:2796
- C:\Windows\System\qHzbufn.exe
  C:\Windows\System\qHzbufn.exe
  2⤵
  PID:3124
- C:\Windows\System\DuDjJEp.exe
  C:\Windows\System\DuDjJEp.exe
  2⤵
  PID:1268
- C:\Windows\System\tBnXrVK.exe
  C:\Windows\System\tBnXrVK.exe
  2⤵
  PID:4108
- C:\Windows\System\QkZkmAb.exe
  C:\Windows\System\QkZkmAb.exe
  2⤵
  PID:4124
- C:\Windows\System\dDKFDFX.exe
  C:\Windows\System\dDKFDFX.exe
  2⤵
  PID:4140
- C:\Windows\System\dFUdVHu.exe
  C:\Windows\System\dFUdVHu.exe
  2⤵
  PID:4156
- C:\Windows\System\bHeLZah.exe
  C:\Windows\System\bHeLZah.exe
  2⤵
  PID:4172
- C:\Windows\System\TiIPFwT.exe
  C:\Windows\System\TiIPFwT.exe
  2⤵
  PID:4188
- C:\Windows\System\Rugokai.exe
  C:\Windows\System\Rugokai.exe
  2⤵
  PID:4204
- C:\Windows\System\ChftFhF.exe
  C:\Windows\System\ChftFhF.exe
  2⤵
  PID:4220
- C:\Windows\System\BqwfLoS.exe
  C:\Windows\System\BqwfLoS.exe
  2⤵
  PID:4236
- C:\Windows\System\CeZguWm.exe
  C:\Windows\System\CeZguWm.exe
  2⤵
  PID:4252
- C:\Windows\System\jkyuMnV.exe
  C:\Windows\System\jkyuMnV.exe
  2⤵
  PID:4268
- C:\Windows\System\TaFDlCY.exe
  C:\Windows\System\TaFDlCY.exe
  2⤵
  PID:4284
- C:\Windows\System\YboywwL.exe
  C:\Windows\System\YboywwL.exe
  2⤵
  PID:4300
- C:\Windows\System\DuFTudf.exe
  C:\Windows\System\DuFTudf.exe
  2⤵
  PID:4316
- C:\Windows\System\iPsljvw.exe
  C:\Windows\System\iPsljvw.exe
  2⤵
  PID:4332
- C:\Windows\System\ikrWlTM.exe
  C:\Windows\System\ikrWlTM.exe
  2⤵
  PID:4348
- C:\Windows\System\FOLvERx.exe
  C:\Windows\System\FOLvERx.exe
  2⤵
  PID:4364
- C:\Windows\System\NTTKkaN.exe
  C:\Windows\System\NTTKkaN.exe
  2⤵
  PID:4380
- C:\Windows\System\VsNlYgF.exe
  C:\Windows\System\VsNlYgF.exe
  2⤵
  PID:4396
- C:\Windows\System\QJEzHgz.exe
  C:\Windows\System\QJEzHgz.exe
  2⤵
  PID:4412
- C:\Windows\System\atoEraV.exe
  C:\Windows\System\atoEraV.exe
  2⤵
  PID:4428
- C:\Windows\System\QDhZVkH.exe
  C:\Windows\System\QDhZVkH.exe
  2⤵
  PID:4444
- C:\Windows\System\oofqAeh.exe
  C:\Windows\System\oofqAeh.exe
  2⤵
  PID:4460
- C:\Windows\System\BQMHDQR.exe
  C:\Windows\System\BQMHDQR.exe
  2⤵
  PID:4476
- C:\Windows\System\WFgfaul.exe
  C:\Windows\System\WFgfaul.exe
  2⤵
  PID:4492
- C:\Windows\System\OcEGIul.exe
  C:\Windows\System\OcEGIul.exe
  2⤵
  PID:4508
- C:\Windows\System\cOzsqWP.exe
  C:\Windows\System\cOzsqWP.exe
  2⤵
  PID:4524
- C:\Windows\System\LvlEJuJ.exe
  C:\Windows\System\LvlEJuJ.exe
  2⤵
  PID:4540
- C:\Windows\System\jrLxRpx.exe
  C:\Windows\System\jrLxRpx.exe
  2⤵
  PID:4556
- C:\Windows\System\QPXYfjY.exe
  C:\Windows\System\QPXYfjY.exe
  2⤵
  PID:4572
- C:\Windows\System\lYIeWjY.exe
  C:\Windows\System\lYIeWjY.exe
  2⤵
  PID:4588
- C:\Windows\System\tajPgFd.exe
  C:\Windows\System\tajPgFd.exe
  2⤵
  PID:4604
- C:\Windows\System\dIBvhzQ.exe
  C:\Windows\System\dIBvhzQ.exe
  2⤵
  PID:4640
- C:\Windows\System\wiGKHOs.exe
  C:\Windows\System\wiGKHOs.exe
  2⤵
  PID:4668
- C:\Windows\System\UvruLbE.exe
  C:\Windows\System\UvruLbE.exe
  2⤵
  PID:4688
- C:\Windows\System\AKsnqSh.exe
  C:\Windows\System\AKsnqSh.exe
  2⤵
  PID:4704
- C:\Windows\System\qhsFelX.exe
  C:\Windows\System\qhsFelX.exe
  2⤵
  PID:4720
- C:\Windows\System\WXZXPSE.exe
  C:\Windows\System\WXZXPSE.exe
  2⤵
  PID:4744
- C:\Windows\System\xhCGuOg.exe
  C:\Windows\System\xhCGuOg.exe
  2⤵
  PID:4760
- C:\Windows\System\msWaJuh.exe
  C:\Windows\System\msWaJuh.exe
  2⤵
  PID:4780
- C:\Windows\System\LpzyofF.exe
  C:\Windows\System\LpzyofF.exe
  2⤵
  PID:4796
- C:\Windows\System\juADKBg.exe
  C:\Windows\System\juADKBg.exe
  2⤵
  PID:4812
- C:\Windows\System\AsAJNhn.exe
  C:\Windows\System\AsAJNhn.exe
  2⤵
  PID:4828
- C:\Windows\System\kkLYBdv.exe
  C:\Windows\System\kkLYBdv.exe
  2⤵
  PID:4844
- C:\Windows\System\bRMlDKO.exe
  C:\Windows\System\bRMlDKO.exe
  2⤵
  PID:4860
- C:\Windows\System\HnwOUrv.exe
  C:\Windows\System\HnwOUrv.exe
  2⤵
  PID:4876
- C:\Windows\System\HsWqvuP.exe
  C:\Windows\System\HsWqvuP.exe
  2⤵
  PID:4892
- C:\Windows\System\zMDmibR.exe
  C:\Windows\System\zMDmibR.exe
  2⤵
  PID:4908
- C:\Windows\System\poHYuBN.exe
  C:\Windows\System\poHYuBN.exe
  2⤵
  PID:4924
- C:\Windows\System\TllWPpt.exe
  C:\Windows\System\TllWPpt.exe
  2⤵
  PID:4940
- C:\Windows\System\MDDVLvb.exe
  C:\Windows\System\MDDVLvb.exe
  2⤵
  PID:4956
- C:\Windows\System\qDxwCGx.exe
  C:\Windows\System\qDxwCGx.exe
  2⤵
  PID:4972
- C:\Windows\System\VxweSka.exe
  C:\Windows\System\VxweSka.exe
  2⤵
  PID:4992
- C:\Windows\System\cEHuzrK.exe
  C:\Windows\System\cEHuzrK.exe
  2⤵
  PID:5008
- C:\Windows\System\CljZgKV.exe
  C:\Windows\System\CljZgKV.exe
  2⤵
  PID:5024
- C:\Windows\System\ERgAeqP.exe
  C:\Windows\System\ERgAeqP.exe
  2⤵
  PID:5040
- C:\Windows\System\LZMYFAS.exe
  C:\Windows\System\LZMYFAS.exe
  2⤵
  PID:5056
- C:\Windows\System\SNBrOUJ.exe
  C:\Windows\System\SNBrOUJ.exe
  2⤵
  PID:5072
- C:\Windows\System\rJdGVeK.exe
  C:\Windows\System\rJdGVeK.exe
  2⤵
  PID:5092
- C:\Windows\System\BbPxBQx.exe
  C:\Windows\System\BbPxBQx.exe
  2⤵
  PID:5108
- C:\Windows\System\jvTgouF.exe
  C:\Windows\System\jvTgouF.exe
  2⤵
  PID:1184
- C:\Windows\System\ZvsLGTD.exe
  C:\Windows\System\ZvsLGTD.exe
  2⤵
  PID:4148
- C:\Windows\System\EvnHAsS.exe
  C:\Windows\System\EvnHAsS.exe
  2⤵
  PID:1080
- C:\Windows\System\GbQRwIo.exe
  C:\Windows\System\GbQRwIo.exe
  2⤵
  PID:4180
- C:\Windows\System\DGFWKwi.exe
  C:\Windows\System\DGFWKwi.exe
  2⤵
  PID:4132
- C:\Windows\System\ouZMcVu.exe
  C:\Windows\System\ouZMcVu.exe
  2⤵
  PID:1060
- C:\Windows\System\TmirtQw.exe
  C:\Windows\System\TmirtQw.exe
  2⤵
  PID:2908
- C:\Windows\System\hqcoAQX.exe
  C:\Windows\System\hqcoAQX.exe
  2⤵
  PID:4168
- C:\Windows\System\oSJCPWb.exe
  C:\Windows\System\oSJCPWb.exe
  2⤵
  PID:4280
- C:\Windows\System\dLfrzaF.exe
  C:\Windows\System\dLfrzaF.exe
  2⤵
  PID:4296
- C:\Windows\System\CtQrIEX.exe
  C:\Windows\System\CtQrIEX.exe
  2⤵
  PID:4328
- C:\Windows\System\hwvnguR.exe
  C:\Windows\System\hwvnguR.exe
  2⤵
  PID:4376
- C:\Windows\System\ApmoRgL.exe
  C:\Windows\System\ApmoRgL.exe
  2⤵
  PID:4420
- C:\Windows\System\RukHdtq.exe
  C:\Windows\System\RukHdtq.exe
  2⤵
  PID:4456
- C:\Windows\System\ZrNbCof.exe
  C:\Windows\System\ZrNbCof.exe
  2⤵
  PID:4472
- C:\Windows\System\zyddmAu.exe
  C:\Windows\System\zyddmAu.exe
  2⤵
  PID:4532
- C:\Windows\System\bebPsZm.exe
  C:\Windows\System\bebPsZm.exe
  2⤵
  PID:4488
- C:\Windows\System\atXoDzR.exe
  C:\Windows\System\atXoDzR.exe
  2⤵
  PID:2812
- C:\Windows\System\xtjLsfs.exe
  C:\Windows\System\xtjLsfs.exe
  2⤵
  PID:4584
- C:\Windows\System\srKPmGD.exe
  C:\Windows\System\srKPmGD.exe
  2⤵
  PID:1896
- C:\Windows\System\lHWJXKv.exe
  C:\Windows\System\lHWJXKv.exe
  2⤵
  PID:3216
- C:\Windows\System\thtjvxE.exe
  C:\Windows\System\thtjvxE.exe
  2⤵
  PID:4552
- C:\Windows\System\cOQDeiz.exe
  C:\Windows\System\cOQDeiz.exe
  2⤵
  PID:4624
- C:\Windows\System\DyIrIBr.exe
  C:\Windows\System\DyIrIBr.exe
  2⤵
  PID:2936
- C:\Windows\System\kxvqYPh.exe
  C:\Windows\System\kxvqYPh.exe
  2⤵
  PID:2020
- C:\Windows\System\pitYUfE.exe
  C:\Windows\System\pitYUfE.exe
  2⤵
  PID:4700
- C:\Windows\System\LOfEdjw.exe
  C:\Windows\System\LOfEdjw.exe
  2⤵
  PID:900
- C:\Windows\System\oyTuxYS.exe
  C:\Windows\System\oyTuxYS.exe
  2⤵
  PID:612
- C:\Windows\System\dZmhsGs.exe
  C:\Windows\System\dZmhsGs.exe
  2⤵
  PID:4772
- C:\Windows\System\kghFhNZ.exe
  C:\Windows\System\kghFhNZ.exe
  2⤵
  PID:4840
- C:\Windows\System\olybQIb.exe
  C:\Windows\System\olybQIb.exe
  2⤵
  PID:4820
- C:\Windows\System\CwzolRj.exe
  C:\Windows\System\CwzolRj.exe
  2⤵
  PID:4868
- C:\Windows\System\bHErcAp.exe
  C:\Windows\System\bHErcAp.exe
  2⤵
  PID:4900
- C:\Windows\System\zKQqIyo.exe
  C:\Windows\System\zKQqIyo.exe
  2⤵
  PID:4888
- C:\Windows\System\LigdMLo.exe
  C:\Windows\System\LigdMLo.exe
  2⤵
  PID:4964
- C:\Windows\System\NhCVMdO.exe
  C:\Windows\System\NhCVMdO.exe
  2⤵
  PID:5068
- C:\Windows\System\xZXFYLA.exe
  C:\Windows\System\xZXFYLA.exe
  2⤵
  PID:2644
- C:\Windows\System\ujborQx.exe
  C:\Windows\System\ujborQx.exe
  2⤵
  PID:2964
- C:\Windows\System\Niefxzd.exe
  C:\Windows\System\Niefxzd.exe
  2⤵
  PID:4264
- C:\Windows\System\ItfOytv.exe
  C:\Windows\System\ItfOytv.exe
  2⤵
  PID:4980
- C:\Windows\System\rBzwZaC.exe
  C:\Windows\System\rBzwZaC.exe
  2⤵
  PID:5048
- C:\Windows\System\EVPStBm.exe
  C:\Windows\System\EVPStBm.exe
  2⤵
  PID:5088
- C:\Windows\System\EDUmlhU.exe
  C:\Windows\System\EDUmlhU.exe
  2⤵
  PID:4212
- C:\Windows\System\cLScMBZ.exe
  C:\Windows\System\cLScMBZ.exe
  2⤵
  PID:4216
- C:\Windows\System\OnmATeX.exe
  C:\Windows\System\OnmATeX.exe
  2⤵
  PID:4440
- C:\Windows\System\eLPNySl.exe
  C:\Windows\System\eLPNySl.exe
  2⤵
  PID:4340
- C:\Windows\System\DuAGxmL.exe
  C:\Windows\System\DuAGxmL.exe
  2⤵
  PID:4484
- C:\Windows\System\wnxstfJ.exe
  C:\Windows\System\wnxstfJ.exe
  2⤵
  PID:4408
- C:\Windows\System\YQdjyTU.exe
  C:\Windows\System\YQdjyTU.exe
  2⤵
  PID:3008
- C:\Windows\System\CwXwPxe.exe
  C:\Windows\System\CwXwPxe.exe
  2⤵
  PID:4628
- C:\Windows\System\ZwMZgAV.exe
  C:\Windows\System\ZwMZgAV.exe
  2⤵
  PID:4808
- C:\Windows\System\KNHEpZO.exe
  C:\Windows\System\KNHEpZO.exe
  2⤵
  PID:4392
- C:\Windows\System\XDBEQnk.exe
  C:\Windows\System\XDBEQnk.exe
  2⤵
  PID:4580
- C:\Windows\System\VKdRptr.exe
  C:\Windows\System\VKdRptr.exe
  2⤵
  PID:4652
- C:\Windows\System\RFhqsWm.exe
  C:\Windows\System\RFhqsWm.exe
  2⤵
  PID:4788
- C:\Windows\System\MVaYXxa.exe
  C:\Windows\System\MVaYXxa.exe
  2⤵
  PID:4568
- C:\Windows\System\CvbghIY.exe
  C:\Windows\System\CvbghIY.exe
  2⤵
  PID:4936
- C:\Windows\System\YraIKwb.exe
  C:\Windows\System\YraIKwb.exe
  2⤵
  PID:5000
- C:\Windows\System\mWpZjIL.exe
  C:\Windows\System\mWpZjIL.exe
  2⤵
  PID:5036
- C:\Windows\System\qsiafsU.exe
  C:\Windows\System\qsiafsU.exe
  2⤵
  PID:4952
- C:\Windows\System\ojiLZoX.exe
  C:\Windows\System\ojiLZoX.exe
  2⤵
  PID:5080
- C:\Windows\System\cqJnclO.exe
  C:\Windows\System\cqJnclO.exe
  2⤵
  PID:4244
- C:\Windows\System\rjolAvD.exe
  C:\Windows\System\rjolAvD.exe
  2⤵
  PID:4372
- C:\Windows\System\xaCyDzr.exe
  C:\Windows\System\xaCyDzr.exe
  2⤵
  PID:4600
- C:\Windows\System\ROurBWk.exe
  C:\Windows\System\ROurBWk.exe
  2⤵
  PID:4152
- C:\Windows\System\pFiWBNV.exe
  C:\Windows\System\pFiWBNV.exe
  2⤵
  PID:4656
- C:\Windows\System\dqjGnrH.exe
  C:\Windows\System\dqjGnrH.exe
  2⤵
  PID:4792
- C:\Windows\System\escoenX.exe
  C:\Windows\System\escoenX.exe
  2⤵
  PID:3184
- C:\Windows\System\OXWPLVV.exe
  C:\Windows\System\OXWPLVV.exe
  2⤵
  PID:1564
- C:\Windows\System\EyofGIe.exe
  C:\Windows\System\EyofGIe.exe
  2⤵
  PID:4740
- C:\Windows\System\vxgPnlm.exe
  C:\Windows\System\vxgPnlm.exe
  2⤵
  PID:4824
- C:\Windows\System\tGHDIWx.exe
  C:\Windows\System\tGHDIWx.exe
  2⤵
  PID:5064
- C:\Windows\System\QDBZvuk.exe
  C:\Windows\System\QDBZvuk.exe
  2⤵
  PID:4468
- C:\Windows\System\xhIFtaz.exe
  C:\Windows\System\xhIFtaz.exe
  2⤵
  PID:1936
- C:\Windows\System\OTQVJnO.exe
  C:\Windows\System\OTQVJnO.exe
  2⤵
  PID:4636
- C:\Windows\System\SxKAKGZ.exe
  C:\Windows\System\SxKAKGZ.exe
  2⤵
  PID:4916
- C:\Windows\System\niCGqTL.exe
  C:\Windows\System\niCGqTL.exe
  2⤵
  PID:1756
- C:\Windows\System\XJQpegx.exe
  C:\Windows\System\XJQpegx.exe
  2⤵
  PID:5020
- C:\Windows\System\ZDuCzzV.exe
  C:\Windows\System\ZDuCzzV.exe
  2⤵
  PID:4564
- C:\Windows\System\pkVTtPL.exe
  C:\Windows\System\pkVTtPL.exe
  2⤵
  PID:4200
- C:\Windows\System\CbnyOQA.exe
  C:\Windows\System\CbnyOQA.exe
  2⤵
  PID:2504
- C:\Windows\System\dtHqkMn.exe
  C:\Windows\System\dtHqkMn.exe
  2⤵
  PID:5136
- C:\Windows\System\XVOiNMP.exe
  C:\Windows\System\XVOiNMP.exe
  2⤵
  PID:5152
- C:\Windows\System\cWDCGUm.exe
  C:\Windows\System\cWDCGUm.exe
  2⤵
  PID:5172
- C:\Windows\System\jabBKVO.exe
  C:\Windows\System\jabBKVO.exe
  2⤵
  PID:5188
- C:\Windows\System\UmScMYN.exe
  C:\Windows\System\UmScMYN.exe
  2⤵
  PID:5204
- C:\Windows\System\gQZTeve.exe
  C:\Windows\System\gQZTeve.exe
  2⤵
  PID:5220
- C:\Windows\System\BttqRiF.exe
  C:\Windows\System\BttqRiF.exe
  2⤵
  PID:5236
- C:\Windows\System\NROsPxH.exe
  C:\Windows\System\NROsPxH.exe
  2⤵
  PID:5276
- C:\Windows\System\XdaQDRJ.exe
  C:\Windows\System\XdaQDRJ.exe
  2⤵
  PID:5292
- C:\Windows\System\pebnieW.exe
  C:\Windows\System\pebnieW.exe
  2⤵
  PID:5308
- C:\Windows\System\NCpjdMr.exe
  C:\Windows\System\NCpjdMr.exe
  2⤵
  PID:5324
- C:\Windows\System\aRNtJOO.exe
  C:\Windows\System\aRNtJOO.exe
  2⤵
  PID:5340
- C:\Windows\System\tyGQTMe.exe
  C:\Windows\System\tyGQTMe.exe
  2⤵
  PID:5360
- C:\Windows\System\FRnaZoH.exe
  C:\Windows\System\FRnaZoH.exe
  2⤵
  PID:5376
- C:\Windows\System\RnVcpUA.exe
  C:\Windows\System\RnVcpUA.exe
  2⤵
  PID:5396
- C:\Windows\System\lJSZMnX.exe
  C:\Windows\System\lJSZMnX.exe
  2⤵
  PID:5412
- C:\Windows\System\seXSADX.exe
  C:\Windows\System\seXSADX.exe
  2⤵
  PID:5428
- C:\Windows\System\AOAUnQb.exe
  C:\Windows\System\AOAUnQb.exe
  2⤵
  PID:5444
- C:\Windows\System\qBOFQrz.exe
  C:\Windows\System\qBOFQrz.exe
  2⤵
  PID:5464
- C:\Windows\System\HzaVBqL.exe
  C:\Windows\System\HzaVBqL.exe
  2⤵
  PID:5480
- C:\Windows\System\Kawkgax.exe
  C:\Windows\System\Kawkgax.exe
  2⤵
  PID:5496
- C:\Windows\System\gWweTNP.exe
  C:\Windows\System\gWweTNP.exe
  2⤵
  PID:5512
- C:\Windows\System\DOPcqpT.exe
  C:\Windows\System\DOPcqpT.exe
  2⤵
  PID:5532
- C:\Windows\System\bUfDxgU.exe
  C:\Windows\System\bUfDxgU.exe
  2⤵
  PID:5548
- C:\Windows\System\GAfnfLU.exe
  C:\Windows\System\GAfnfLU.exe
  2⤵
  PID:5564
- C:\Windows\System\JYCHpEq.exe
  C:\Windows\System\JYCHpEq.exe
  2⤵
  PID:5580
- C:\Windows\System\nAcPpqF.exe
  C:\Windows\System\nAcPpqF.exe
  2⤵
  PID:5600
- C:\Windows\System\SFzHqkC.exe
  C:\Windows\System\SFzHqkC.exe
  2⤵
  PID:5616
- C:\Windows\System\YHPzcjh.exe
  C:\Windows\System\YHPzcjh.exe
  2⤵
  PID:5632
- C:\Windows\System\HsLGnwD.exe
  C:\Windows\System\HsLGnwD.exe
  2⤵
  PID:5648
- C:\Windows\System\MxPzeWk.exe
  C:\Windows\System\MxPzeWk.exe
  2⤵
  PID:5668
- C:\Windows\System\BZPseuR.exe
  C:\Windows\System\BZPseuR.exe
  2⤵
  PID:5684
- C:\Windows\System\OXHXxVq.exe
  C:\Windows\System\OXHXxVq.exe
  2⤵
  PID:5700
- C:\Windows\System\nJPfTHc.exe
  C:\Windows\System\nJPfTHc.exe
  2⤵
  PID:5716
- C:\Windows\System\qfdzOaz.exe
  C:\Windows\System\qfdzOaz.exe
  2⤵
  PID:5736
- C:\Windows\System\jpNaagT.exe
  C:\Windows\System\jpNaagT.exe
  2⤵
  PID:5752
- C:\Windows\System\xKNAkQP.exe
  C:\Windows\System\xKNAkQP.exe
  2⤵
  PID:5768
- C:\Windows\System\fYlVEcY.exe
  C:\Windows\System\fYlVEcY.exe
  2⤵
  PID:5784
- C:\Windows\System\yeiDBxV.exe
  C:\Windows\System\yeiDBxV.exe
  2⤵
  PID:5800
- C:\Windows\System\TnuSIsz.exe
  C:\Windows\System\TnuSIsz.exe
  2⤵
  PID:5816
- C:\Windows\System\wrLPMbY.exe
  C:\Windows\System\wrLPMbY.exe
  2⤵
  PID:5832
- C:\Windows\System\WaXlXrU.exe
  C:\Windows\System\WaXlXrU.exe
  2⤵
  PID:5848
- C:\Windows\System\lEfGTdp.exe
  C:\Windows\System\lEfGTdp.exe
  2⤵
  PID:5864
- C:\Windows\System\NqvnMTH.exe
  C:\Windows\System\NqvnMTH.exe
  2⤵
  PID:5884
- C:\Windows\System\hJOeeqJ.exe
  C:\Windows\System\hJOeeqJ.exe
  2⤵
  PID:5904
- C:\Windows\System\kNGiqrh.exe
  C:\Windows\System\kNGiqrh.exe
  2⤵
  PID:5920
- C:\Windows\System\dBOcaLT.exe
  C:\Windows\System\dBOcaLT.exe
  2⤵
  PID:5940
- C:\Windows\System\tsiTDRx.exe
  C:\Windows\System\tsiTDRx.exe
  2⤵
  PID:5956
- C:\Windows\System\mHjeSVj.exe
  C:\Windows\System\mHjeSVj.exe
  2⤵
  PID:5976
- C:\Windows\System\KfTpuKD.exe
  C:\Windows\System\KfTpuKD.exe
  2⤵
  PID:5992
- C:\Windows\System\TClJXMe.exe
  C:\Windows\System\TClJXMe.exe
  2⤵
  PID:6012
- C:\Windows\System\udICEmx.exe
  C:\Windows\System\udICEmx.exe
  2⤵
  PID:6028
- C:\Windows\System\ewUZOHl.exe
  C:\Windows\System\ewUZOHl.exe
  2⤵
  PID:6044
- C:\Windows\System\cxEQoED.exe
  C:\Windows\System\cxEQoED.exe
  2⤵
  PID:6068
- C:\Windows\System\bcbtpYW.exe
  C:\Windows\System\bcbtpYW.exe
  2⤵
  PID:6116
- C:\Windows\System\swxsHiP.exe
  C:\Windows\System\swxsHiP.exe
  2⤵
  PID:6136
- C:\Windows\System\OQglGpF.exe
  C:\Windows\System\OQglGpF.exe
  2⤵
  PID:5164
- C:\Windows\System\WrEPfvj.exe
  C:\Windows\System\WrEPfvj.exe
  2⤵
  PID:5144
- C:\Windows\System\TdAuPxN.exe
  C:\Windows\System\TdAuPxN.exe
  2⤵
  PID:5216
- C:\Windows\System\IGQWbUk.exe
  C:\Windows\System\IGQWbUk.exe
  2⤵
  PID:5248
- C:\Windows\System\pOAXgop.exe
  C:\Windows\System\pOAXgop.exe
  2⤵
  PID:5268
- C:\Windows\System\lfaKXtq.exe
  C:\Windows\System\lfaKXtq.exe
  2⤵
  PID:5320
- C:\Windows\System\edVUkSl.exe
  C:\Windows\System\edVUkSl.exe
  2⤵
  PID:4776
- C:\Windows\System\obaaIPw.exe
  C:\Windows\System\obaaIPw.exe
  2⤵
  PID:5420
- C:\Windows\System\NOJiLjF.exe
  C:\Windows\System\NOJiLjF.exe
  2⤵
  PID:5460
- C:\Windows\System\sEtnJlA.exe
  C:\Windows\System\sEtnJlA.exe
  2⤵
  PID:5528
- C:\Windows\System\YTKKBol.exe
  C:\Windows\System\YTKKBol.exe
  2⤵
  PID:5588
- C:\Windows\System\JFWSjHh.exe
  C:\Windows\System\JFWSjHh.exe
  2⤵
  PID:5660
- C:\Windows\System\epoMiAI.exe
  C:\Windows\System\epoMiAI.exe
  2⤵
  PID:5724
- C:\Windows\System\BgQoaKt.exe
  C:\Windows\System\BgQoaKt.exe
  2⤵
  PID:5796
- C:\Windows\System\KnixDxy.exe
  C:\Windows\System\KnixDxy.exe
  2⤵
  PID:5928
- C:\Windows\System\ZSVOzMj.exe
  C:\Windows\System\ZSVOzMj.exe
  2⤵
  PID:5332
- C:\Windows\System\jJCKhma.exe
  C:\Windows\System\jJCKhma.exe
  2⤵
  PID:5404
- C:\Windows\System\udrlldR.exe
  C:\Windows\System\udrlldR.exe
  2⤵
  PID:5900
- C:\Windows\System\HedOduc.exe
  C:\Windows\System\HedOduc.exe
  2⤵
  PID:5968
- C:\Windows\System\QCTKNAN.exe
  C:\Windows\System\QCTKNAN.exe
  2⤵
  PID:6008
- C:\Windows\System\dLLfGwS.exe
  C:\Windows\System\dLLfGwS.exe
  2⤵
  PID:5472
- C:\Windows\System\TeWolTP.exe
  C:\Windows\System\TeWolTP.exe
  2⤵
  PID:5540
- C:\Windows\System\qlbvXMP.exe
  C:\Windows\System\qlbvXMP.exe
  2⤵
  PID:5608
- C:\Windows\System\nejioHH.exe
  C:\Windows\System\nejioHH.exe
  2⤵
  PID:5676
- C:\Windows\System\ZDhLTPL.exe
  C:\Windows\System\ZDhLTPL.exe
  2⤵
  PID:5744
- C:\Windows\System\QVojIZb.exe
  C:\Windows\System\QVojIZb.exe
  2⤵
  PID:5780
- C:\Windows\System\TFBvXkJ.exe
  C:\Windows\System\TFBvXkJ.exe
  2⤵
  PID:5844
- C:\Windows\System\ZlkutwD.exe
  C:\Windows\System\ZlkutwD.exe
  2⤵
  PID:5912
- C:\Windows\System\SAWpudn.exe
  C:\Windows\System\SAWpudn.exe
  2⤵
  PID:5984
- C:\Windows\System\jujJnKw.exe
  C:\Windows\System\jujJnKw.exe
  2⤵
  PID:6052
- C:\Windows\System\RufaoOp.exe
  C:\Windows\System\RufaoOp.exe
  2⤵
  PID:6064
- C:\Windows\System\OWnhejE.exe
  C:\Windows\System\OWnhejE.exe
  2⤵
  PID:6092
- C:\Windows\System\iXWWXje.exe
  C:\Windows\System\iXWWXje.exe
  2⤵
  PID:6104
- C:\Windows\System\erMHNwe.exe
  C:\Windows\System\erMHNwe.exe
  2⤵
  PID:5132
- C:\Windows\System\DJcIWSp.exe
  C:\Windows\System\DJcIWSp.exe
  2⤵
  PID:6124
- C:\Windows\System\bMykcls.exe
  C:\Windows\System\bMykcls.exe
  2⤵
  PID:4548
- C:\Windows\System\JdzdGRi.exe
  C:\Windows\System\JdzdGRi.exe
  2⤵
  PID:876
- C:\Windows\System\EKLjFmr.exe
  C:\Windows\System\EKLjFmr.exe
  2⤵
  PID:5424
- C:\Windows\System\rxhqgdC.exe
  C:\Windows\System\rxhqgdC.exe
  2⤵
  PID:5656
- C:\Windows\System\dYpOflU.exe
  C:\Windows\System\dYpOflU.exe
  2⤵
  PID:5492
- C:\Windows\System\PuSUyvS.exe
  C:\Windows\System\PuSUyvS.exe
  2⤵
  PID:5316
- C:\Windows\System\LCiEfum.exe
  C:\Windows\System\LCiEfum.exe
  2⤵
  PID:5304
- C:\Windows\System\zVlsHFg.exe
  C:\Windows\System\zVlsHFg.exe
  2⤵
  PID:5628
- C:\Windows\System\cZfmvzB.exe
  C:\Windows\System\cZfmvzB.exe
  2⤵
  PID:5368
- C:\Windows\System\BcgORlh.exe
  C:\Windows\System\BcgORlh.exe
  2⤵
  PID:5936
- C:\Windows\System\rLDlsoT.exe
  C:\Windows\System\rLDlsoT.exe
  2⤵
  PID:5508
- C:\Windows\System\jSPSwKz.exe
  C:\Windows\System\jSPSwKz.exe
  2⤵
  PID:5776
- C:\Windows\System\DqJAklI.exe
  C:\Windows\System\DqJAklI.exe
  2⤵
  PID:5712
- C:\Windows\System\KbNYteW.exe
  C:\Windows\System\KbNYteW.exe
  2⤵
  PID:6024
- C:\Windows\System\dYdBgWq.exe
  C:\Windows\System\dYdBgWq.exe
  2⤵
  PID:5160
- C:\Windows\System\aIKTXkm.exe
  C:\Windows\System\aIKTXkm.exe
  2⤵
  PID:5232
- C:\Windows\System\rlCCNAc.exe
  C:\Windows\System\rlCCNAc.exe
  2⤵
  PID:4664
- C:\Windows\System\QMTYmYW.exe
  C:\Windows\System\QMTYmYW.exe
  2⤵
  PID:5212
- C:\Windows\System\LYOIcVn.exe
  C:\Windows\System\LYOIcVn.exe
  2⤵
  PID:5384
- C:\Windows\System\MKbdLLN.exe
  C:\Windows\System\MKbdLLN.exe
  2⤵
  PID:5824
- C:\Windows\System\cEiSPiR.exe
  C:\Windows\System\cEiSPiR.exe
  2⤵
  PID:6004
- C:\Windows\System\kmhhTZx.exe
  C:\Windows\System\kmhhTZx.exe
  2⤵
  PID:5708
- C:\Windows\System\FAHvzJs.exe
  C:\Windows\System\FAHvzJs.exe
  2⤵
  PID:5408
- C:\Windows\System\WBFLIZm.exe
  C:\Windows\System\WBFLIZm.exe
  2⤵
  PID:5948
- C:\Windows\System\oMZiEpd.exe
  C:\Windows\System\oMZiEpd.exe
  2⤵
  PID:5228
- C:\Windows\System\fuYwyiK.exe
  C:\Windows\System\fuYwyiK.exe
  2⤵
  PID:5732
- C:\Windows\System\qWPzkjF.exe
  C:\Windows\System\qWPzkjF.exe
  2⤵
  PID:5892
- C:\Windows\System\EqvfnPi.exe
  C:\Windows\System\EqvfnPi.exe
  2⤵
  PID:6000
- C:\Windows\System\WSVuNwv.exe
  C:\Windows\System\WSVuNwv.exe
  2⤵
  PID:5504
- C:\Windows\System\YntqyDX.exe
  C:\Windows\System\YntqyDX.exe
  2⤵
  PID:6084
- C:\Windows\System\YOwdXgu.exe
  C:\Windows\System\YOwdXgu.exe
  2⤵
  PID:6156
- C:\Windows\System\yTbujCJ.exe
  C:\Windows\System\yTbujCJ.exe
  2⤵
  PID:6248
- C:\Windows\System\ZYUsScs.exe
  C:\Windows\System\ZYUsScs.exe
  2⤵
  PID:6280
- C:\Windows\System\huwtXQv.exe
  C:\Windows\System\huwtXQv.exe
  2⤵
  PID:6304
- C:\Windows\System\HIHQKqU.exe
  C:\Windows\System\HIHQKqU.exe
  2⤵
  PID:6320
- C:\Windows\System\bxFxxhC.exe
  C:\Windows\System\bxFxxhC.exe
  2⤵
  PID:6336
- C:\Windows\System\emaFkKK.exe
  C:\Windows\System\emaFkKK.exe
  2⤵
  PID:6352
- C:\Windows\System\anIIeJz.exe
  C:\Windows\System\anIIeJz.exe
  2⤵
  PID:6368
- C:\Windows\System\EuENNbn.exe
  C:\Windows\System\EuENNbn.exe
  2⤵
  PID:6388
- C:\Windows\System\mvnzQKI.exe
  C:\Windows\System\mvnzQKI.exe
  2⤵
  PID:6404
- C:\Windows\System\ZpXEQEk.exe
  C:\Windows\System\ZpXEQEk.exe
  2⤵
  PID:6420
- C:\Windows\System\rjSBhtK.exe
  C:\Windows\System\rjSBhtK.exe
  2⤵
  PID:6436
- C:\Windows\System\LbFkBAv.exe
  C:\Windows\System\LbFkBAv.exe
  2⤵
  PID:6452
- C:\Windows\System\HQngPEV.exe
  C:\Windows\System\HQngPEV.exe
  2⤵
  PID:6468
- C:\Windows\System\gnUXoUh.exe
  C:\Windows\System\gnUXoUh.exe
  2⤵
  PID:6484
- C:\Windows\System\zxAiZyn.exe
  C:\Windows\System\zxAiZyn.exe
  2⤵
  PID:6500
- C:\Windows\System\becKkYH.exe
  C:\Windows\System\becKkYH.exe
  2⤵
  PID:6532
- C:\Windows\System\eOWicjp.exe
  C:\Windows\System\eOWicjp.exe
  2⤵
  PID:6548
- C:\Windows\System\DYvlQgs.exe
  C:\Windows\System\DYvlQgs.exe
  2⤵
  PID:6564
- C:\Windows\System\FrApmoc.exe
  C:\Windows\System\FrApmoc.exe
  2⤵
  PID:6580
- C:\Windows\System\WvjXcYj.exe
  C:\Windows\System\WvjXcYj.exe
  2⤵
  PID:6596
- C:\Windows\System\SpRKehp.exe
  C:\Windows\System\SpRKehp.exe
  2⤵
  PID:6612
- C:\Windows\System\YxdDeoe.exe
  C:\Windows\System\YxdDeoe.exe
  2⤵
  PID:6628
- C:\Windows\System\ENUqiGj.exe
  C:\Windows\System\ENUqiGj.exe
  2⤵
  PID:6644
- C:\Windows\System\vjUhRba.exe
  C:\Windows\System\vjUhRba.exe
  2⤵
  PID:6660
- C:\Windows\System\yGGyNbu.exe
  C:\Windows\System\yGGyNbu.exe
  2⤵
  PID:6676
- C:\Windows\System\JAkRcoP.exe
  C:\Windows\System\JAkRcoP.exe
  2⤵
  PID:6692
- C:\Windows\System\JFEVGVP.exe
  C:\Windows\System\JFEVGVP.exe
  2⤵
  PID:6708
- C:\Windows\System\InBDjeW.exe
  C:\Windows\System\InBDjeW.exe
  2⤵
  PID:6728
- C:\Windows\System\igbjvjp.exe
  C:\Windows\System\igbjvjp.exe
  2⤵
  PID:6752
- C:\Windows\System\IizTwHu.exe
  C:\Windows\System\IizTwHu.exe
  2⤵
  PID:6768
- C:\Windows\System\WWauuiF.exe
  C:\Windows\System\WWauuiF.exe
  2⤵
  PID:6788
- C:\Windows\System\zuTCnlw.exe
  C:\Windows\System\zuTCnlw.exe
  2⤵
  PID:6804
- C:\Windows\System\srHbFgl.exe
  C:\Windows\System\srHbFgl.exe
  2⤵
  PID:6820
- C:\Windows\System\ucPWBIz.exe
  C:\Windows\System\ucPWBIz.exe
  2⤵
  PID:6836
- C:\Windows\System\JaLemQN.exe
  C:\Windows\System\JaLemQN.exe
  2⤵
  PID:6852
- C:\Windows\System\femBmaP.exe
  C:\Windows\System\femBmaP.exe
  2⤵
  PID:6868
- C:\Windows\System\hRLdTVC.exe
  C:\Windows\System\hRLdTVC.exe
  2⤵
  PID:6884
- C:\Windows\System\jOnitlh.exe
  C:\Windows\System\jOnitlh.exe
  2⤵
  PID:6908
- C:\Windows\System\dJPmyoC.exe
  C:\Windows\System\dJPmyoC.exe
  2⤵
  PID:6924
- C:\Windows\System\HhFhbWT.exe
  C:\Windows\System\HhFhbWT.exe
  2⤵
  PID:6940
- C:\Windows\System\BYbDrTK.exe
  C:\Windows\System\BYbDrTK.exe
  2⤵
  PID:6956
- C:\Windows\System\fJLQAVY.exe
  C:\Windows\System\fJLQAVY.exe
  2⤵
  PID:6972
- C:\Windows\System\MykgeyW.exe
  C:\Windows\System\MykgeyW.exe
  2⤵
  PID:6988
- C:\Windows\System\MDbHucq.exe
  C:\Windows\System\MDbHucq.exe
  2⤵
  PID:7004
- C:\Windows\System\eQUssvT.exe
  C:\Windows\System\eQUssvT.exe
  2⤵
  PID:7036
- C:\Windows\System\SkAcarb.exe
  C:\Windows\System\SkAcarb.exe
  2⤵
  PID:7052
- C:\Windows\System\ZoWmFOb.exe
  C:\Windows\System\ZoWmFOb.exe
  2⤵
  PID:7072
- C:\Windows\System\HMjBaOH.exe
  C:\Windows\System\HMjBaOH.exe
  2⤵
  PID:7088
- C:\Windows\System\XRCSFGP.exe
  C:\Windows\System\XRCSFGP.exe
  2⤵
  PID:7104
- C:\Windows\System\ztTiyME.exe
  C:\Windows\System\ztTiyME.exe
  2⤵
  PID:7120
- C:\Windows\System\vcsWTrN.exe
  C:\Windows\System\vcsWTrN.exe
  2⤵
  PID:7136
- C:\Windows\System\zHVIcSJ.exe
  C:\Windows\System\zHVIcSJ.exe
  2⤵
  PID:7152
- C:\Windows\System\NuDdolS.exe
  C:\Windows\System\NuDdolS.exe
  2⤵
  PID:5456
- C:\Windows\System\rXCBffe.exe
  C:\Windows\System\rXCBffe.exe
  2⤵
  PID:6060
- C:\Windows\System\MCmkPuL.exe
  C:\Windows\System\MCmkPuL.exe
  2⤵
  PID:6164
- C:\Windows\System\UKPdiGQ.exe
  C:\Windows\System\UKPdiGQ.exe
  2⤵
  PID:6184
- C:\Windows\System\FQnnnrF.exe
  C:\Windows\System\FQnnnrF.exe
  2⤵
  PID:6208
- C:\Windows\System\CzosHqJ.exe
  C:\Windows\System\CzosHqJ.exe
  2⤵
  PID:6224
- C:\Windows\System\EtbRAep.exe
  C:\Windows\System\EtbRAep.exe
  2⤵
  PID:6236
- C:\Windows\System\xbEXPID.exe
  C:\Windows\System\xbEXPID.exe
  2⤵
  PID:6260
- C:\Windows\System\plTMfeb.exe
  C:\Windows\System\plTMfeb.exe
  2⤵
  PID:5952
- C:\Windows\System\kAKgkFq.exe
  C:\Windows\System\kAKgkFq.exe
  2⤵
  PID:6348
- C:\Windows\System\PrNVhoG.exe
  C:\Windows\System\PrNVhoG.exe
  2⤵
  PID:6380
- C:\Windows\System\KvAKLtP.exe
  C:\Windows\System\KvAKLtP.exe
  2⤵
  PID:6572
- C:\Windows\System\OhcHmel.exe
  C:\Windows\System\OhcHmel.exe
  2⤵
  PID:6964
- C:\Windows\System\MybzNKx.exe
  C:\Windows\System\MybzNKx.exe
  2⤵
  PID:6876
- C:\Windows\System\xYYaXpc.exe
  C:\Windows\System\xYYaXpc.exe
  2⤵
  PID:6980
- C:\Windows\System\CezDIez.exe
  C:\Windows\System\CezDIez.exe
  2⤵
  PID:6948
- C:\Windows\System\zUuqyZl.exe
  C:\Windows\System\zUuqyZl.exe
  2⤵
  PID:7020
- C:\Windows\System\iQWbhqq.exe
  C:\Windows\System\iQWbhqq.exe
  2⤵
  PID:7080
- C:\Windows\System\BhrjLJR.exe
  C:\Windows\System\BhrjLJR.exe
  2⤵
  PID:6232
- C:\Windows\System\cfjqOZA.exe
  C:\Windows\System\cfjqOZA.exe
  2⤵
  PID:6292
- C:\Windows\System\BpeTtQo.exe
  C:\Windows\System\BpeTtQo.exe
  2⤵
  PID:6312
- C:\Windows\System\WZfkvTb.exe
  C:\Windows\System\WZfkvTb.exe
  2⤵
  PID:6332
- C:\Windows\System\XYkUVOd.exe
  C:\Windows\System\XYkUVOd.exe
  2⤵
  PID:6460
- C:\Windows\System\WoglHwe.exe
  C:\Windows\System\WoglHwe.exe
  2⤵
  PID:6360
- C:\Windows\System\WwUSXXK.exe
  C:\Windows\System\WwUSXXK.exe
  2⤵
  PID:6592
- C:\Windows\System\vCLAqsW.exe
  C:\Windows\System\vCLAqsW.exe
  2⤵
  PID:1868
- C:\Windows\System\ISsftQl.exe
  C:\Windows\System\ISsftQl.exe
  2⤵
  PID:6576
- C:\Windows\System\uywElVn.exe
  C:\Windows\System\uywElVn.exe
  2⤵
  PID:6688
- C:\Windows\System\CvOQCuz.exe
  C:\Windows\System\CvOQCuz.exe
  2⤵
  PID:6672
- C:\Windows\System\fqpKDbC.exe
  C:\Windows\System\fqpKDbC.exe
  2⤵
  PID:6720
- C:\Windows\System\vJlbApI.exe
  C:\Windows\System\vJlbApI.exe
  2⤵
  PID:6764
- C:\Windows\System\ylmESFf.exe
  C:\Windows\System\ylmESFf.exe
  2⤵
  PID:6700
- C:\Windows\System\SksYyek.exe
  C:\Windows\System\SksYyek.exe
  2⤵
  PID:6896
- C:\Windows\System\wozHFWm.exe
  C:\Windows\System\wozHFWm.exe
  2⤵
  PID:6932
- C:\Windows\System\EbmLfPM.exe
  C:\Windows\System\EbmLfPM.exe
  2⤵
  PID:6516
- C:\Windows\System\BvsbYdH.exe
  C:\Windows\System\BvsbYdH.exe
  2⤵
  PID:6784
- C:\Windows\System\aLVbGxE.exe
  C:\Windows\System\aLVbGxE.exe
  2⤵
  PID:6776
- C:\Windows\System\aomSDTv.exe
  C:\Windows\System\aomSDTv.exe
  2⤵
  PID:6080
- C:\Windows\System\zMaFKaR.exe
  C:\Windows\System\zMaFKaR.exe
  2⤵
  PID:7112
- C:\Windows\System\FRYayIA.exe
  C:\Windows\System\FRYayIA.exe
  2⤵
  PID:7128
- C:\Windows\System\OhjBDtf.exe
  C:\Windows\System\OhjBDtf.exe
  2⤵
  PID:6240
- C:\Windows\System\JYQNczu.exe
  C:\Windows\System\JYQNczu.exe
  2⤵
  PID:5572
- C:\Windows\System\EXNrxcz.exe
  C:\Windows\System\EXNrxcz.exe
  2⤵
  PID:7132
- C:\Windows\System\iaZpGLw.exe
  C:\Windows\System\iaZpGLw.exe
  2⤵
  PID:6328
- C:\Windows\System\OxffYlF.exe
  C:\Windows\System\OxffYlF.exe
  2⤵
  PID:6508
- C:\Windows\System\dFjKpiK.exe
  C:\Windows\System\dFjKpiK.exe
  2⤵
  PID:6520
- C:\Windows\System\AabzXjv.exe
  C:\Windows\System\AabzXjv.exe
  2⤵
  PID:6364
- C:\Windows\System\aRTRehz.exe
  C:\Windows\System\aRTRehz.exe
  2⤵
  PID:6416
- C:\Windows\System\rOJjfKP.exe
  C:\Windows\System\rOJjfKP.exe
  2⤵
  PID:6640
- C:\Windows\System\NnZvAOs.exe
  C:\Windows\System\NnZvAOs.exe
  2⤵
  PID:6604
- C:\Windows\System\MtyadQS.exe
  C:\Windows\System\MtyadQS.exe
  2⤵
  PID:6444
- C:\Windows\System\izMWRPN.exe
  C:\Windows\System\izMWRPN.exe
  2⤵
  PID:6996
- C:\Windows\System\kwQTGkf.exe
  C:\Windows\System\kwQTGkf.exe
  2⤵
  PID:6588
- C:\Windows\System\qSSvHhL.exe
  C:\Windows\System\qSSvHhL.exe
  2⤵
  PID:6736
- C:\Windows\System\mtIqZLd.exe
  C:\Windows\System\mtIqZLd.exe
  2⤵
  PID:7048
- C:\Windows\System\GUdrIhx.exe
  C:\Windows\System\GUdrIhx.exe
  2⤵
  PID:7024
- C:\Windows\System\BwdulJR.exe
  C:\Windows\System\BwdulJR.exe
  2⤵
  PID:7060
- C:\Windows\System\slgNxph.exe
  C:\Windows\System\slgNxph.exe
  2⤵
  PID:7144
- C:\Windows\System\lhuuFKk.exe
  C:\Windows\System\lhuuFKk.exe
  2⤵
  PID:6200
- C:\Windows\System\gIeYhDy.exe
  C:\Windows\System\gIeYhDy.exe
  2⤵
  PID:6524
- C:\Windows\System\KCVXbHg.exe
  C:\Windows\System\KCVXbHg.exe
  2⤵
  PID:6492
- C:\Windows\System\gimjSyh.exe
  C:\Windows\System\gimjSyh.exe
  2⤵
  PID:6400
- C:\Windows\System\pYpMZfC.exe
  C:\Windows\System\pYpMZfC.exe
  2⤵
  PID:6192
- C:\Windows\System\oXtqMxw.exe
  C:\Windows\System\oXtqMxw.exe
  2⤵
  PID:6668
- C:\Windows\System\HwDSjeU.exe
  C:\Windows\System\HwDSjeU.exe
  2⤵
  PID:6748
- C:\Windows\System\VcmLtQq.exe
  C:\Windows\System\VcmLtQq.exe
  2⤵
  PID:7148
- C:\Windows\System\UScquvF.exe
  C:\Windows\System\UScquvF.exe
  2⤵
  PID:6152
- C:\Windows\System\mAzfNre.exe
  C:\Windows\System\mAzfNre.exe
  2⤵
  PID:6212
- C:\Windows\System\WkjBalB.exe
  C:\Windows\System\WkjBalB.exe
  2⤵
  PID:6428
- C:\Windows\System\SPpHRWt.exe
  C:\Windows\System\SPpHRWt.exe
  2⤵
  PID:6556
- C:\Windows\System\AofjDzG.exe
  C:\Windows\System\AofjDzG.exe
  2⤵
  PID:6296
- C:\Windows\System\JdvlSjp.exe
  C:\Windows\System\JdvlSjp.exe
  2⤵
  PID:7172
- C:\Windows\System\dUfBLuW.exe
  C:\Windows\System\dUfBLuW.exe
  2⤵
  PID:7188
- C:\Windows\System\hsSSQcD.exe
  C:\Windows\System\hsSSQcD.exe
  2⤵
  PID:7204
- C:\Windows\System\EsiFbrg.exe
  C:\Windows\System\EsiFbrg.exe
  2⤵
  PID:7220
- C:\Windows\System\PTBnFaq.exe
  C:\Windows\System\PTBnFaq.exe
  2⤵
  PID:7236
- C:\Windows\System\PvoGkMC.exe
  C:\Windows\System\PvoGkMC.exe
  2⤵
  PID:7252
- C:\Windows\System\YkPsXEy.exe
  C:\Windows\System\YkPsXEy.exe
  2⤵
  PID:7268
- C:\Windows\System\kJguEHD.exe
  C:\Windows\System\kJguEHD.exe
  2⤵
  PID:7284
- C:\Windows\System\SQxkOIh.exe
  C:\Windows\System\SQxkOIh.exe
  2⤵
  PID:7300
- C:\Windows\System\CFKqVCy.exe
  C:\Windows\System\CFKqVCy.exe
  2⤵
  PID:7316
- C:\Windows\System\xwedffw.exe
  C:\Windows\System\xwedffw.exe
  2⤵
  PID:7332
- C:\Windows\System\lLXUgIP.exe
  C:\Windows\System\lLXUgIP.exe
  2⤵
  PID:7348
- C:\Windows\System\yqOXxkU.exe
  C:\Windows\System\yqOXxkU.exe
  2⤵
  PID:7364
- C:\Windows\System\APYkakH.exe
  C:\Windows\System\APYkakH.exe
  2⤵
  PID:7380
- C:\Windows\System\HeoyGNu.exe
  C:\Windows\System\HeoyGNu.exe
  2⤵
  PID:7396
- C:\Windows\System\bPeMmgb.exe
  C:\Windows\System\bPeMmgb.exe
  2⤵
  PID:7412
- C:\Windows\System\HJJHUDR.exe
  C:\Windows\System\HJJHUDR.exe
  2⤵
  PID:7428
- C:\Windows\System\UONExrE.exe
  C:\Windows\System\UONExrE.exe
  2⤵
  PID:7444
- C:\Windows\System\QICYxkJ.exe
  C:\Windows\System\QICYxkJ.exe
  2⤵
  PID:7460
- C:\Windows\System\fQjakce.exe
  C:\Windows\System\fQjakce.exe
  2⤵
  PID:7476
- C:\Windows\System\BBlJXio.exe
  C:\Windows\System\BBlJXio.exe
  2⤵
  PID:7492
- C:\Windows\System\HBITfYA.exe
  C:\Windows\System\HBITfYA.exe
  2⤵
  PID:7508
- C:\Windows\System\wpZMIdl.exe
  C:\Windows\System\wpZMIdl.exe
  2⤵
  PID:7524
- C:\Windows\System\taeVeLi.exe
  C:\Windows\System\taeVeLi.exe
  2⤵
  PID:7540
- C:\Windows\System\TDseTbz.exe
  C:\Windows\System\TDseTbz.exe
  2⤵
  PID:7556
- C:\Windows\System\ceymfUV.exe
  C:\Windows\System\ceymfUV.exe
  2⤵
  PID:7572
- C:\Windows\System\ogJXujx.exe
  C:\Windows\System\ogJXujx.exe
  2⤵
  PID:7588
- C:\Windows\System\ZVJtYCs.exe
  C:\Windows\System\ZVJtYCs.exe
  2⤵
  PID:7604
- C:\Windows\System\yRYtQBi.exe
  C:\Windows\System\yRYtQBi.exe
  2⤵
  PID:7620
- C:\Windows\System\nZiFfuB.exe
  C:\Windows\System\nZiFfuB.exe
  2⤵
  PID:7636
- C:\Windows\System\EcGcdgP.exe
  C:\Windows\System\EcGcdgP.exe
  2⤵
  PID:7652
- C:\Windows\System\ZyYsXbJ.exe
  C:\Windows\System\ZyYsXbJ.exe
  2⤵
  PID:7668
- C:\Windows\System\gTKnItO.exe
  C:\Windows\System\gTKnItO.exe
  2⤵
  PID:7684
- C:\Windows\System\hljeoLo.exe
  C:\Windows\System\hljeoLo.exe
  2⤵
  PID:7700
- C:\Windows\System\CyAiAcg.exe
  C:\Windows\System\CyAiAcg.exe
  2⤵
  PID:7716
- C:\Windows\System\vgGevYl.exe
  C:\Windows\System\vgGevYl.exe
  2⤵
  PID:7732
- C:\Windows\System\sJUgqta.exe
  C:\Windows\System\sJUgqta.exe
  2⤵
  PID:7748
- C:\Windows\System\qQiZyJu.exe
  C:\Windows\System\qQiZyJu.exe
  2⤵
  PID:7764
- C:\Windows\System\WOYYNXJ.exe
  C:\Windows\System\WOYYNXJ.exe
  2⤵
  PID:7780
- C:\Windows\System\HRYYxTn.exe
  C:\Windows\System\HRYYxTn.exe
  2⤵
  PID:7796
- C:\Windows\System\DuSfVyU.exe
  C:\Windows\System\DuSfVyU.exe
  2⤵
  PID:7812
- C:\Windows\System\vTcVxjP.exe
  C:\Windows\System\vTcVxjP.exe
  2⤵
  PID:7828
- C:\Windows\System\yvHXJDl.exe
  C:\Windows\System\yvHXJDl.exe
  2⤵
  PID:7844
- C:\Windows\System\YSQwEWr.exe
  C:\Windows\System\YSQwEWr.exe
  2⤵
  PID:7860
- C:\Windows\System\czsPEMZ.exe
  C:\Windows\System\czsPEMZ.exe
  2⤵
  PID:7876
- C:\Windows\System\xcmBMbh.exe
  C:\Windows\System\xcmBMbh.exe
  2⤵
  PID:7892
- C:\Windows\System\avuLeMr.exe
  C:\Windows\System\avuLeMr.exe
  2⤵
  PID:7908
- C:\Windows\System\rgsfhSN.exe
  C:\Windows\System\rgsfhSN.exe
  2⤵
  PID:7924
- C:\Windows\System\VqdgweA.exe
  C:\Windows\System\VqdgweA.exe
  2⤵
  PID:7940
- C:\Windows\System\HcvkADF.exe
  C:\Windows\System\HcvkADF.exe
  2⤵
  PID:7956
- C:\Windows\System\VILhZMp.exe
  C:\Windows\System\VILhZMp.exe
  2⤵
  PID:7972
- C:\Windows\System\GLvorYG.exe
  C:\Windows\System\GLvorYG.exe
  2⤵
  PID:7988
- C:\Windows\System\cCIeSAv.exe
  C:\Windows\System\cCIeSAv.exe
  2⤵
  PID:8004
- C:\Windows\System\qESlveG.exe
  C:\Windows\System\qESlveG.exe
  2⤵
  PID:8020
- C:\Windows\System\xLLmNgm.exe
  C:\Windows\System\xLLmNgm.exe
  2⤵
  PID:8036
- C:\Windows\System\qqXyQbt.exe
  C:\Windows\System\qqXyQbt.exe
  2⤵
  PID:8052
- C:\Windows\System\tIjxjbO.exe
  C:\Windows\System\tIjxjbO.exe
  2⤵
  PID:8068
- C:\Windows\System\DBgOfxI.exe
  C:\Windows\System\DBgOfxI.exe
  2⤵
  PID:8084
- C:\Windows\System\psalovA.exe
  C:\Windows\System\psalovA.exe
  2⤵
  PID:8100
- C:\Windows\System\OfxtMug.exe
  C:\Windows\System\OfxtMug.exe
  2⤵
  PID:8116
- C:\Windows\System\mMLlxcO.exe
  C:\Windows\System\mMLlxcO.exe
  2⤵
  PID:8132
- C:\Windows\System\LkNkMIh.exe
  C:\Windows\System\LkNkMIh.exe
  2⤵
  PID:8148
- C:\Windows\System\WLkESta.exe
  C:\Windows\System\WLkESta.exe
  2⤵
  PID:8164
- C:\Windows\System\OFUkXYZ.exe
  C:\Windows\System\OFUkXYZ.exe
  2⤵
  PID:8180
- C:\Windows\System\eXntPVD.exe
  C:\Windows\System\eXntPVD.exe
  2⤵
  PID:6412
- C:\Windows\System\jZYyhXE.exe
  C:\Windows\System\jZYyhXE.exe
  2⤵
  PID:6624
- C:\Windows\System\ZSWDhDj.exe
  C:\Windows\System\ZSWDhDj.exe
  2⤵
  PID:7180
- C:\Windows\System\VlyLMAv.exe
  C:\Windows\System\VlyLMAv.exe
  2⤵
  PID:7196
- C:\Windows\System\jqNsrZk.exe
  C:\Windows\System\jqNsrZk.exe
  2⤵
  PID:7260
- C:\Windows\System\hblbmta.exe
  C:\Windows\System\hblbmta.exe
  2⤵
  PID:7324
- C:\Windows\System\Vkennvf.exe
  C:\Windows\System\Vkennvf.exe
  2⤵
  PID:7360
- C:\Windows\System\qlZfPhb.exe
  C:\Windows\System\qlZfPhb.exe
  2⤵
  PID:7420
- C:\Windows\System\MztbykL.exe
  C:\Windows\System\MztbykL.exe
  2⤵
  PID:7280
- C:\Windows\System\rQDeNQp.exe
  C:\Windows\System\rQDeNQp.exe
  2⤵
  PID:7372
- C:\Windows\System\QfnTWBI.exe
  C:\Windows\System\QfnTWBI.exe
  2⤵
  PID:7456
- C:\Windows\System\qWlWESh.exe
  C:\Windows\System\qWlWESh.exe
  2⤵
  PID:7436
- C:\Windows\System\gbinkoJ.exe
  C:\Windows\System\gbinkoJ.exe
  2⤵
  PID:7440
- C:\Windows\System\JZAediX.exe
  C:\Windows\System\JZAediX.exe
  2⤵
  PID:7520
- C:\Windows\System\GkgKMlZ.exe
  C:\Windows\System\GkgKMlZ.exe
  2⤵
  PID:7552
- C:\Windows\System\RRgrcvr.exe
  C:\Windows\System\RRgrcvr.exe
  2⤵
  PID:7584
- C:\Windows\System\wTVbIFl.exe
  C:\Windows\System\wTVbIFl.exe
  2⤵
  PID:7648
- C:\Windows\System\mXaiAIS.exe
  C:\Windows\System\mXaiAIS.exe
  2⤵
  PID:7600
- C:\Windows\System\lgasWFJ.exe
  C:\Windows\System\lgasWFJ.exe
  2⤵
  PID:7740
- C:\Windows\System\vDfvKEA.exe
  C:\Windows\System\vDfvKEA.exe
  2⤵
  PID:7804
- C:\Windows\System\yGJFiTc.exe
  C:\Windows\System\yGJFiTc.exe
  2⤵
  PID:7664
- C:\Windows\System\NEAsTVB.exe
  C:\Windows\System\NEAsTVB.exe
  2⤵
  PID:7868
- C:\Windows\System\bQzQNGg.exe
  C:\Windows\System\bQzQNGg.exe
  2⤵
  PID:7932
- C:\Windows\System\exLqiiD.exe
  C:\Windows\System\exLqiiD.exe
  2⤵
  PID:7996
- C:\Windows\System\CyvOkNA.exe
  C:\Windows\System\CyvOkNA.exe
  2⤵
  PID:8032
- C:\Windows\System\GiZwlvx.exe
  C:\Windows\System\GiZwlvx.exe
  2⤵
  PID:7820
- C:\Windows\System\qcUzPmG.exe
  C:\Windows\System\qcUzPmG.exe
  2⤵
  PID:8156
- C:\Windows\System\PwnZrNw.exe
  C:\Windows\System\PwnZrNw.exe
  2⤵
  PID:7228
- C:\Windows\System\ivFydxX.exe
  C:\Windows\System\ivFydxX.exe
  2⤵
  PID:7232
- C:\Windows\System\FwtNapP.exe
  C:\Windows\System\FwtNapP.exe
  2⤵
  PID:7248
- C:\Windows\System\QUsMOEM.exe
  C:\Windows\System\QUsMOEM.exe
  2⤵
  PID:7788
- C:\Windows\System\pqWziAf.exe
  C:\Windows\System\pqWziAf.exe
  2⤵
  PID:8076
- C:\Windows\System\oiympcY.exe
  C:\Windows\System\oiympcY.exe
  2⤵
  PID:7856
- C:\Windows\System\fjwGGGO.exe
  C:\Windows\System\fjwGGGO.exe
  2⤵
  PID:7308
- C:\Windows\System\hKdXCxM.exe
  C:\Windows\System\hKdXCxM.exe
  2⤵
  PID:7852
- C:\Windows\System\bJYXQnE.exe
  C:\Windows\System\bJYXQnE.exe
  2⤵
  PID:7920
- C:\Windows\System\eXGmUTv.exe
  C:\Windows\System\eXGmUTv.exe
  2⤵
  PID:8048
- C:\Windows\System\DYSNrfC.exe
  C:\Windows\System\DYSNrfC.exe
  2⤵
  PID:6448
- C:\Windows\System\DbQLLiY.exe
  C:\Windows\System\DbQLLiY.exe
  2⤵
  PID:7980
- C:\Windows\System\wGUcswx.exe
  C:\Windows\System\wGUcswx.exe
  2⤵
  PID:8016
- C:\Windows\System\hLHnbyc.exe
  C:\Windows\System\hLHnbyc.exe
  2⤵
  PID:7344
- C:\Windows\System\HSCvvNO.exe
  C:\Windows\System\HSCvvNO.exe
  2⤵
  PID:7580
- C:\Windows\System\GNhymZw.exe
  C:\Windows\System\GNhymZw.exe
  2⤵
  PID:7744
- C:\Windows\System\FvHnxLn.exe
  C:\Windows\System\FvHnxLn.exe
  2⤵
  PID:7708
- C:\Windows\System\pGLXpeY.exe
  C:\Windows\System\pGLXpeY.exe
  2⤵
  PID:7900
- C:\Windows\System\WlvgdVz.exe
  C:\Windows\System\WlvgdVz.exe
  2⤵
  PID:8028
- C:\Windows\System\QlRSPym.exe
  C:\Windows\System\QlRSPym.exe
  2⤵
  PID:7756
- C:\Windows\System\LVIktEI.exe
  C:\Windows\System\LVIktEI.exe
  2⤵
  PID:7952
- C:\Windows\System\Vgknsxr.exe
  C:\Windows\System\Vgknsxr.exe
  2⤵
  PID:6880
- C:\Windows\System\IOYFLSL.exe
  C:\Windows\System\IOYFLSL.exe
  2⤵
  PID:8092
- C:\Windows\System\VBbhigX.exe
  C:\Windows\System\VBbhigX.exe
  2⤵
  PID:7356
- C:\Windows\System\RuSnRUc.exe
  C:\Windows\System\RuSnRUc.exe
  2⤵
  PID:7840
- C:\Windows\System\DiTFruW.exe
  C:\Windows\System\DiTFruW.exe
  2⤵
  PID:7500
- C:\Windows\System\bPSxLYz.exe
  C:\Windows\System\bPSxLYz.exe
  2⤵
  PID:7660
- C:\Windows\System\kEOzPnr.exe
  C:\Windows\System\kEOzPnr.exe
  2⤵
  PID:7836
- C:\Windows\System\DbMjcDz.exe
  C:\Windows\System\DbMjcDz.exe
  2⤵
  PID:7392
- C:\Windows\System\pJEaxAx.exe
  C:\Windows\System\pJEaxAx.exe
  2⤵
  PID:8044
- C:\Windows\System\qtwZPkf.exe
  C:\Windows\System\qtwZPkf.exe
  2⤵
  PID:8112
- C:\Windows\System\JLCSDmj.exe
  C:\Windows\System\JLCSDmj.exe
  2⤵
  PID:6288
- C:\Windows\System\wtMCxbC.exe
  C:\Windows\System\wtMCxbC.exe
  2⤵
  PID:7516
- C:\Windows\System\yOAKyuk.exe
  C:\Windows\System\yOAKyuk.exe
  2⤵
  PID:7968
- C:\Windows\System\OZltNfs.exe
  C:\Windows\System\OZltNfs.exe
  2⤵
  PID:7884
- C:\Windows\System\kMRvDOe.exe
  C:\Windows\System\kMRvDOe.exe
  2⤵
  PID:7536
- C:\Windows\System\ghEVkfj.exe
  C:\Windows\System\ghEVkfj.exe
  2⤵
  PID:7116
- C:\Windows\System\FOraoOt.exe
  C:\Windows\System\FOraoOt.exe
  2⤵
  PID:7696
- C:\Windows\System\dxcicof.exe
  C:\Windows\System\dxcicof.exe
  2⤵
  PID:7644
- C:\Windows\System\kczwHrg.exe
  C:\Windows\System\kczwHrg.exe
  2⤵
  PID:8128
- C:\Windows\System\gbMnlAS.exe
  C:\Windows\System\gbMnlAS.exe
  2⤵
  PID:8208
- C:\Windows\System\mfOwXEb.exe
  C:\Windows\System\mfOwXEb.exe
  2⤵
  PID:8224
- C:\Windows\System\ULtRytv.exe
  C:\Windows\System\ULtRytv.exe
  2⤵
  PID:8240
- C:\Windows\System\nsvbUeo.exe
  C:\Windows\System\nsvbUeo.exe
  2⤵
  PID:8256
- C:\Windows\System\zrdXiAu.exe
  C:\Windows\System\zrdXiAu.exe
  2⤵
  PID:8272
- C:\Windows\System\OibTuUK.exe
  C:\Windows\System\OibTuUK.exe
  2⤵
  PID:8288
- C:\Windows\System\FGjhmGa.exe
  C:\Windows\System\FGjhmGa.exe
  2⤵
  PID:8304
- C:\Windows\System\OsrtaTu.exe
  C:\Windows\System\OsrtaTu.exe
  2⤵
  PID:8320
- C:\Windows\System\vaiCvGE.exe
  C:\Windows\System\vaiCvGE.exe
  2⤵
  PID:8336
- C:\Windows\System\wcpbpkd.exe
  C:\Windows\System\wcpbpkd.exe
  2⤵
  PID:8352
- C:\Windows\System\zllrwjb.exe
  C:\Windows\System\zllrwjb.exe
  2⤵
  PID:8368
- C:\Windows\System\OSGrSct.exe
  C:\Windows\System\OSGrSct.exe
  2⤵
  PID:8384
- C:\Windows\System\jhGiAyd.exe
  C:\Windows\System\jhGiAyd.exe
  2⤵
  PID:8400
- C:\Windows\System\zxzZAmY.exe
  C:\Windows\System\zxzZAmY.exe
  2⤵
  PID:8416
- C:\Windows\System\DigLEKx.exe
  C:\Windows\System\DigLEKx.exe
  2⤵
  PID:8432
- C:\Windows\System\lDRcjjE.exe
  C:\Windows\System\lDRcjjE.exe
  2⤵
  PID:8448
- C:\Windows\System\AWlBrNB.exe
  C:\Windows\System\AWlBrNB.exe
  2⤵
  PID:8464
- C:\Windows\System\HmmZCZb.exe
  C:\Windows\System\HmmZCZb.exe
  2⤵
  PID:8480
- C:\Windows\System\xXrPbYv.exe
  C:\Windows\System\xXrPbYv.exe
  2⤵
  PID:8496
- C:\Windows\System\ygTKptE.exe
  C:\Windows\System\ygTKptE.exe
  2⤵
  PID:8512
- C:\Windows\System\NLlPvxR.exe
  C:\Windows\System\NLlPvxR.exe
  2⤵
  PID:8528
- C:\Windows\System\RmRsTZc.exe
  C:\Windows\System\RmRsTZc.exe
  2⤵
  PID:8544
- C:\Windows\System\XpDtxyD.exe
  C:\Windows\System\XpDtxyD.exe
  2⤵
  PID:8560
- C:\Windows\System\XiyHxBR.exe
  C:\Windows\System\XiyHxBR.exe
  2⤵
  PID:8576
- C:\Windows\System\aUTHKuR.exe
  C:\Windows\System\aUTHKuR.exe
  2⤵
  PID:8592
- C:\Windows\System\WflPjRm.exe
  C:\Windows\System\WflPjRm.exe
  2⤵
  PID:8608
- C:\Windows\System\VImDRfh.exe
  C:\Windows\System\VImDRfh.exe
  2⤵
  PID:8624
- C:\Windows\System\MuAtpbs.exe
  C:\Windows\System\MuAtpbs.exe
  2⤵
  PID:8640
- C:\Windows\System\AxAWiHo.exe
  C:\Windows\System\AxAWiHo.exe
  2⤵
  PID:8656
- C:\Windows\System\hdweNCf.exe
  C:\Windows\System\hdweNCf.exe
  2⤵
  PID:8672
- C:\Windows\System\dIomFpP.exe
  C:\Windows\System\dIomFpP.exe
  2⤵
  PID:8688
- C:\Windows\System\YUJcRnv.exe
  C:\Windows\System\YUJcRnv.exe
  2⤵
  PID:8704
- C:\Windows\System\EDZiQlT.exe
  C:\Windows\System\EDZiQlT.exe
  2⤵
  PID:8720
- C:\Windows\System\mcJYyrm.exe
  C:\Windows\System\mcJYyrm.exe
  2⤵
  PID:8736
- C:\Windows\System\UABSXkz.exe
  C:\Windows\System\UABSXkz.exe
  2⤵
  PID:8752
- C:\Windows\System\WNaIJcb.exe
  C:\Windows\System\WNaIJcb.exe
  2⤵
  PID:8768
- C:\Windows\System\NVlUstB.exe
  C:\Windows\System\NVlUstB.exe
  2⤵
  PID:8784
- C:\Windows\System\gZqUcxh.exe
  C:\Windows\System\gZqUcxh.exe
  2⤵
  PID:8800
- C:\Windows\System\ZXhwXbm.exe
  C:\Windows\System\ZXhwXbm.exe
  2⤵
  PID:8816
- C:\Windows\System\KZUqxfy.exe
  C:\Windows\System\KZUqxfy.exe
  2⤵
  PID:8832
- C:\Windows\System\QlNcCbU.exe
  C:\Windows\System\QlNcCbU.exe
  2⤵
  PID:8848
- C:\Windows\System\BcbbKBU.exe
  C:\Windows\System\BcbbKBU.exe
  2⤵
  PID:8864
- C:\Windows\System\lTOxGaI.exe
  C:\Windows\System\lTOxGaI.exe
  2⤵
  PID:8880
- C:\Windows\System\Oruqgny.exe
  C:\Windows\System\Oruqgny.exe
  2⤵
  PID:8896
- C:\Windows\System\KZRwjEZ.exe
  C:\Windows\System\KZRwjEZ.exe
  2⤵
  PID:8912
- C:\Windows\System\euJsLjT.exe
  C:\Windows\System\euJsLjT.exe
  2⤵
  PID:8928
- C:\Windows\System\VXGaoib.exe
  C:\Windows\System\VXGaoib.exe
  2⤵
  PID:8944
- C:\Windows\System\YJipIMi.exe
  C:\Windows\System\YJipIMi.exe
  2⤵
  PID:8960
- C:\Windows\System\EhUgOnh.exe
  C:\Windows\System\EhUgOnh.exe
  2⤵
  PID:8980
- C:\Windows\System\WhyzqMb.exe
  C:\Windows\System\WhyzqMb.exe
  2⤵
  PID:8996
- C:\Windows\System\RXvCORN.exe
  C:\Windows\System\RXvCORN.exe
  2⤵
  PID:9012
- C:\Windows\System\cznJVax.exe
  C:\Windows\System\cznJVax.exe
  2⤵
  PID:9028
- C:\Windows\System\aCWcyxG.exe
  C:\Windows\System\aCWcyxG.exe
  2⤵
  PID:9044
- C:\Windows\System\hvmgyfL.exe
  C:\Windows\System\hvmgyfL.exe
  2⤵
  PID:9060
- C:\Windows\System\krdUVnc.exe
  C:\Windows\System\krdUVnc.exe
  2⤵
  PID:9076
- C:\Windows\System\swDoMJZ.exe
  C:\Windows\System\swDoMJZ.exe
  2⤵
  PID:9092
- C:\Windows\System\AbpYiIx.exe
  C:\Windows\System\AbpYiIx.exe
  2⤵
  PID:9108
- C:\Windows\System\tEBqRls.exe
  C:\Windows\System\tEBqRls.exe
  2⤵
  PID:9124
- C:\Windows\System\aXDnlQg.exe
  C:\Windows\System\aXDnlQg.exe
  2⤵
  PID:9140
- C:\Windows\System\jyJzmuu.exe
  C:\Windows\System\jyJzmuu.exe
  2⤵
  PID:9156
- C:\Windows\System\hjERyBi.exe
  C:\Windows\System\hjERyBi.exe
  2⤵
  PID:9172
- C:\Windows\System\YeoZnRc.exe
  C:\Windows\System\YeoZnRc.exe
  2⤵
  PID:9188
- C:\Windows\System\Wzhqryh.exe
  C:\Windows\System\Wzhqryh.exe
  2⤵
  PID:9204
- C:\Windows\System\eMgQHjU.exe
  C:\Windows\System\eMgQHjU.exe
  2⤵
  PID:7296
- C:\Windows\System\jSkgkjU.exe
  C:\Windows\System\jSkgkjU.exe
  2⤵
  PID:8204
- C:\Windows\System\wbnMkHF.exe
  C:\Windows\System\wbnMkHF.exe
  2⤵
  PID:8252
- C:\Windows\System\oPbVSvT.exe
  C:\Windows\System\oPbVSvT.exe
  2⤵
  PID:8280
- C:\Windows\System\jsusfbF.exe
  C:\Windows\System\jsusfbF.exe
  2⤵
  PID:8232
- C:\Windows\System\jsGmjHD.exe
  C:\Windows\System\jsGmjHD.exe
  2⤵
  PID:8328
- C:\Windows\System\RvXZZGU.exe
  C:\Windows\System\RvXZZGU.exe
  2⤵
  PID:8380
- C:\Windows\System\tXAYpRl.exe
  C:\Windows\System\tXAYpRl.exe
  2⤵
  PID:8444
- C:\Windows\System\fMLuHpL.exe
  C:\Windows\System\fMLuHpL.exe
  2⤵
  PID:8504
- C:\Windows\System\HGYkFJb.exe
  C:\Windows\System\HGYkFJb.exe
  2⤵
  PID:8536
- C:\Windows\System\svJGbdb.exe
  C:\Windows\System\svJGbdb.exe
  2⤵
  PID:8424
- C:\Windows\System\bktBenH.exe
  C:\Windows\System\bktBenH.exe
  2⤵
  PID:8568
- C:\Windows\System\sVKCymY.exe
  C:\Windows\System\sVKCymY.exe
  2⤵
  PID:8492
- C:\Windows\System\UkkwAuR.exe
  C:\Windows\System\UkkwAuR.exe
  2⤵
  PID:8632
- C:\Windows\System\vAiQGNb.exe
  C:\Windows\System\vAiQGNb.exe
  2⤵
  PID:8584
- C:\Windows\System\GAZYtku.exe
  C:\Windows\System\GAZYtku.exe
  2⤵
  PID:8668
- C:\Windows\System\ElNbemN.exe
  C:\Windows\System\ElNbemN.exe
  2⤵
  PID:8648
- C:\Windows\System\SNuAcOz.exe
  C:\Windows\System\SNuAcOz.exe
  2⤵
  PID:8712
- C:\Windows\System\XRDlvgj.exe
  C:\Windows\System\XRDlvgj.exe
  2⤵
  PID:8760
- C:\Windows\System\tOrrxSd.exe
  C:\Windows\System\tOrrxSd.exe
  2⤵
  PID:8744
- C:\Windows\System\jhGtAfD.exe
  C:\Windows\System\jhGtAfD.exe
  2⤵
  PID:8824
- C:\Windows\System\MkrcRoK.exe
  C:\Windows\System\MkrcRoK.exe
  2⤵
  PID:8780
- C:\Windows\System\aiNTSXZ.exe
  C:\Windows\System\aiNTSXZ.exe
  2⤵
  PID:8892
- C:\Windows\System\fTWCdWD.exe
  C:\Windows\System\fTWCdWD.exe
  2⤵
  PID:8844
- C:\Windows\System\QyFlllG.exe
  C:\Windows\System\QyFlllG.exe
  2⤵
  PID:8924
- C:\Windows\System\ydlWYFx.exe
  C:\Windows\System\ydlWYFx.exe
  2⤵
  PID:8988
- C:\Windows\System\lhmfKKX.exe
  C:\Windows\System\lhmfKKX.exe
  2⤵
  PID:8968
- C:\Windows\System\hIJeaHT.exe
  C:\Windows\System\hIJeaHT.exe
  2⤵
  PID:9084
- C:\Windows\System\BQbYBYl.exe
  C:\Windows\System\BQbYBYl.exe
  2⤵
  PID:9088
- C:\Windows\System\PbLwKCz.exe
  C:\Windows\System\PbLwKCz.exe
  2⤵
  PID:9116
- C:\Windows\System\jxBIgrt.exe
  C:\Windows\System\jxBIgrt.exe
  2⤵
  PID:9148
- C:\Windows\System\GsVWWae.exe
  C:\Windows\System\GsVWWae.exe
  2⤵
  PID:9164
- C:\Windows\System\uSGgZGT.exe
  C:\Windows\System\uSGgZGT.exe
  2⤵
  PID:9212
- C:\Windows\System\eONGPtK.exe
  C:\Windows\System\eONGPtK.exe
  2⤵
  PID:8300
- C:\Windows\System\SvIiyie.exe
  C:\Windows\System\SvIiyie.exe
  2⤵
  PID:8364
- C:\Windows\System\DZSAzog.exe
  C:\Windows\System\DZSAzog.exe
  2⤵
  PID:9196
- C:\Windows\System\mgGPlEj.exe
  C:\Windows\System\mgGPlEj.exe
  2⤵
  PID:8792
- C:\Windows\System\RQZfVHP.exe
  C:\Windows\System\RQZfVHP.exe
  2⤵
  PID:8716
- C:\Windows\System\EXbSxyl.exe
  C:\Windows\System\EXbSxyl.exe
  2⤵
  PID:8396
- C:\Windows\System\rXkhIOU.exe
  C:\Windows\System\rXkhIOU.exe
  2⤵
  PID:8888
- C:\Windows\System\kJmBxqV.exe
  C:\Windows\System\kJmBxqV.exe
  2⤵
  PID:8872
- C:\Windows\System\XsAzaBk.exe
  C:\Windows\System\XsAzaBk.exe
  2⤵
  PID:9200
- C:\Windows\System\xYLKsQT.exe
  C:\Windows\System\xYLKsQT.exe
  2⤵
  PID:8140
- C:\Windows\System\FdbYRtb.exe
  C:\Windows\System\FdbYRtb.exe
  2⤵
  PID:8520
- C:\Windows\System\yihbsCl.exe
  C:\Windows\System\yihbsCl.exe
  2⤵
  PID:8360
- C:\Windows\System\ArtYPsc.exe
  C:\Windows\System\ArtYPsc.exe
  2⤵
  PID:8332
- C:\Windows\System\FtzmJPO.exe
  C:\Windows\System\FtzmJPO.exe
  2⤵
  PID:9040
- C:\Windows\System\ICrXpma.exe
  C:\Windows\System\ICrXpma.exe
  2⤵
  PID:9136
- C:\Windows\System\ngOcHdl.exe
  C:\Windows\System\ngOcHdl.exe
  2⤵
  PID:9056
- C:\Windows\System\IZTaBhv.exe
  C:\Windows\System\IZTaBhv.exe
  2⤵
  PID:8236
- C:\Windows\System\frNciYi.exe
  C:\Windows\System\frNciYi.exe
  2⤵
  PID:8540
- C:\Windows\System\ETWhoAv.exe
  C:\Windows\System\ETWhoAv.exe
  2⤵
  PID:8248
- C:\Windows\System\FGDJxPm.exe
  C:\Windows\System\FGDJxPm.exe
  2⤵
  PID:8920
- C:\Windows\System\pMIMMLE.exe
  C:\Windows\System\pMIMMLE.exe
  2⤵
  PID:8840
- C:\Windows\System\eCXJilK.exe
  C:\Windows\System\eCXJilK.exe
  2⤵
  PID:8796
- C:\Windows\System\OYazhnj.exe
  C:\Windows\System\OYazhnj.exe
  2⤵
  PID:8808
- C:\Windows\System\KkjIrRB.exe
  C:\Windows\System\KkjIrRB.exe
  2⤵
  PID:7424
- C:\Windows\System\NeEMpTf.exe
  C:\Windows\System\NeEMpTf.exe
  2⤵
  PID:8552
- C:\Windows\System\sYxSpUm.exe
  C:\Windows\System\sYxSpUm.exe
  2⤵
  PID:8440
- C:\Windows\System\HlIXsAo.exe
  C:\Windows\System\HlIXsAo.exe
  2⤵
  PID:9184
- C:\Windows\System\bcqVJdn.exe
  C:\Windows\System\bcqVJdn.exe
  2⤵
  PID:8664
- C:\Windows\System\loxFSEg.exe
  C:\Windows\System\loxFSEg.exe
  2⤵
  PID:8748
- C:\Windows\System\hLfueHe.exe
  C:\Windows\System\hLfueHe.exe
  2⤵
  PID:9228
- C:\Windows\System\XUpJkwp.exe
  C:\Windows\System\XUpJkwp.exe
  2⤵
  PID:9244
- C:\Windows\System\TOocrIB.exe
  C:\Windows\System\TOocrIB.exe
  2⤵
  PID:9260
- C:\Windows\System\wZyXjJP.exe
  C:\Windows\System\wZyXjJP.exe
  2⤵
  PID:9276
- C:\Windows\System\RlMPGwJ.exe
  C:\Windows\System\RlMPGwJ.exe
  2⤵
  PID:9296
- C:\Windows\System\aUDPhwY.exe
  C:\Windows\System\aUDPhwY.exe
  2⤵
  PID:9312
- C:\Windows\System\fZboZHz.exe
  C:\Windows\System\fZboZHz.exe
  2⤵
  PID:9328
- C:\Windows\System\WYLOhbz.exe
  C:\Windows\System\WYLOhbz.exe
  2⤵
  PID:9344
- C:\Windows\System\ebOYDGH.exe
  C:\Windows\System\ebOYDGH.exe
  2⤵
  PID:9360
- C:\Windows\System\YDdXUYj.exe
  C:\Windows\System\YDdXUYj.exe
  2⤵
  PID:9376
- C:\Windows\System\fPoKahF.exe
  C:\Windows\System\fPoKahF.exe
  2⤵
  PID:9392
- C:\Windows\System\DPJkbjR.exe
  C:\Windows\System\DPJkbjR.exe
  2⤵
  PID:9408
- C:\Windows\System\TIoFGPS.exe
  C:\Windows\System\TIoFGPS.exe
  2⤵
  PID:9424
- C:\Windows\System\PRvozKf.exe
  C:\Windows\System\PRvozKf.exe
  2⤵
  PID:9440
- C:\Windows\System\SUwqpmg.exe
  C:\Windows\System\SUwqpmg.exe
  2⤵
  PID:9456
- C:\Windows\System\EaLCmOn.exe
  C:\Windows\System\EaLCmOn.exe
  2⤵
  PID:9472
- C:\Windows\System\sLktgGL.exe
  C:\Windows\System\sLktgGL.exe
  2⤵
  PID:9488
- C:\Windows\System\RVTcYyh.exe
  C:\Windows\System\RVTcYyh.exe
  2⤵
  PID:9504
- C:\Windows\System\SJheaVo.exe
  C:\Windows\System\SJheaVo.exe
  2⤵
  PID:9520
- C:\Windows\System\tKdCnVp.exe
  C:\Windows\System\tKdCnVp.exe
  2⤵
  PID:9536
- C:\Windows\System\GOcIiDZ.exe
  C:\Windows\System\GOcIiDZ.exe
  2⤵
  PID:9552
- C:\Windows\System\rbGBvTP.exe
  C:\Windows\System\rbGBvTP.exe
  2⤵
  PID:9568
- C:\Windows\System\IWKqWra.exe
  C:\Windows\System\IWKqWra.exe
  2⤵
  PID:9584
- C:\Windows\System\ubsIAog.exe
  C:\Windows\System\ubsIAog.exe
  2⤵
  PID:9600
- C:\Windows\System\YjCIDIW.exe
  C:\Windows\System\YjCIDIW.exe
  2⤵
  PID:9616
- C:\Windows\System\eXlHzrQ.exe
  C:\Windows\System\eXlHzrQ.exe
  2⤵
  PID:9632
- C:\Windows\System\UiLsxqR.exe
  C:\Windows\System\UiLsxqR.exe
  2⤵
  PID:9652
- C:\Windows\System\wauDxki.exe
  C:\Windows\System\wauDxki.exe
  2⤵
  PID:9668
- C:\Windows\System\aHHHWQi.exe
  C:\Windows\System\aHHHWQi.exe
  2⤵
  PID:9684
- C:\Windows\System\XMrvXKZ.exe
  C:\Windows\System\XMrvXKZ.exe
  2⤵
  PID:9700
- C:\Windows\System\kCvJfMl.exe
  C:\Windows\System\kCvJfMl.exe
  2⤵
  PID:9716
- C:\Windows\System\dfZKsFD.exe
  C:\Windows\System\dfZKsFD.exe
  2⤵
  PID:9732
- C:\Windows\System\aqfDGSA.exe
  C:\Windows\System\aqfDGSA.exe
  2⤵
  PID:9748
- C:\Windows\System\VeGVHyD.exe
  C:\Windows\System\VeGVHyD.exe
  2⤵
  PID:9764
- C:\Windows\System\XiTQiVm.exe
  C:\Windows\System\XiTQiVm.exe
  2⤵
  PID:9780
- C:\Windows\System\JZuspQd.exe
  C:\Windows\System\JZuspQd.exe
  2⤵
  PID:9796
- C:\Windows\System\BdjLSfF.exe
  C:\Windows\System\BdjLSfF.exe
  2⤵
  PID:9812
- C:\Windows\System\LudVVuN.exe
  C:\Windows\System\LudVVuN.exe
  2⤵
  PID:9828
- C:\Windows\System\jkwHxDG.exe
  C:\Windows\System\jkwHxDG.exe
  2⤵
  PID:9844
- C:\Windows\System\HwyGfdH.exe
  C:\Windows\System\HwyGfdH.exe
  2⤵
  PID:9860
- C:\Windows\System\xKDDsei.exe
  C:\Windows\System\xKDDsei.exe
  2⤵
  PID:9876
- C:\Windows\System\UGLimGd.exe
  C:\Windows\System\UGLimGd.exe
  2⤵
  PID:9892
- C:\Windows\System\WbtvOtD.exe
  C:\Windows\System\WbtvOtD.exe
  2⤵
  PID:9908
- C:\Windows\System\UbCbISp.exe
  C:\Windows\System\UbCbISp.exe
  2⤵
  PID:9924
- C:\Windows\System\jTGRcEI.exe
  C:\Windows\System\jTGRcEI.exe
  2⤵
  PID:9940
- C:\Windows\System\KgCocaR.exe
  C:\Windows\System\KgCocaR.exe
  2⤵
  PID:9956
- C:\Windows\System\DqueDvF.exe
  C:\Windows\System\DqueDvF.exe
  2⤵
  PID:9972
- C:\Windows\System\qIuoPpO.exe
  C:\Windows\System\qIuoPpO.exe
  2⤵
  PID:9988
- C:\Windows\System\EVMqmaS.exe
  C:\Windows\System\EVMqmaS.exe
  2⤵
  PID:10004
- C:\Windows\System\rgxjQnW.exe
  C:\Windows\System\rgxjQnW.exe
  2⤵
  PID:10020
- C:\Windows\System\ZCGGnWF.exe
  C:\Windows\System\ZCGGnWF.exe
  2⤵
  PID:10036
- C:\Windows\System\mShzYut.exe
  C:\Windows\System\mShzYut.exe
  2⤵
  PID:10052
- C:\Windows\System\sYkdnXk.exe
  C:\Windows\System\sYkdnXk.exe
  2⤵
  PID:10068
- C:\Windows\System\MTMSKeB.exe
  C:\Windows\System\MTMSKeB.exe
  2⤵
  PID:10084
- C:\Windows\System\ItgXRDk.exe
  C:\Windows\System\ItgXRDk.exe
  2⤵
  PID:10100
- C:\Windows\System\eIRcAJg.exe
  C:\Windows\System\eIRcAJg.exe
  2⤵
  PID:10116
- C:\Windows\System\QlCSZaB.exe
  C:\Windows\System\QlCSZaB.exe
  2⤵
  PID:10132
- C:\Windows\System\XjDSJQg.exe
  C:\Windows\System\XjDSJQg.exe
  2⤵
  PID:10148
- C:\Windows\System\kjcBeGU.exe
  C:\Windows\System\kjcBeGU.exe
  2⤵
  PID:10164
- C:\Windows\System\PZBqsEG.exe
  C:\Windows\System\PZBqsEG.exe
  2⤵
  PID:10180
- C:\Windows\System\BGKaSsL.exe
  C:\Windows\System\BGKaSsL.exe
  2⤵
  PID:10196
- C:\Windows\System\tMntnil.exe
  C:\Windows\System\tMntnil.exe
  2⤵
  PID:10212
- C:\Windows\System\cnqFPCk.exe
  C:\Windows\System\cnqFPCk.exe
  2⤵
  PID:10228
- C:\Windows\System\JsVJyos.exe
  C:\Windows\System\JsVJyos.exe
  2⤵
  PID:9224
- C:\Windows\System\ngVoMUR.exe
  C:\Windows\System\ngVoMUR.exe
  2⤵
  PID:9072
- C:\Windows\System\eLWBGoX.exe
  C:\Windows\System\eLWBGoX.exe
  2⤵
  PID:9236
- C:\Windows\System\sTVcBqp.exe
  C:\Windows\System\sTVcBqp.exe
  2⤵
  PID:9104
- C:\Windows\System\CofoVNT.exe
  C:\Windows\System\CofoVNT.exe
  2⤵
  PID:9272
- C:\Windows\System\WeFqRkL.exe
  C:\Windows\System\WeFqRkL.exe
  2⤵
  PID:9324
- C:\Windows\System\sSNabfN.exe
  C:\Windows\System\sSNabfN.exe
  2⤵
  PID:9368
- C:\Windows\System\RHapGlw.exe
  C:\Windows\System\RHapGlw.exe
  2⤵
  PID:9384
- C:\Windows\System\cewMAIw.exe
  C:\Windows\System\cewMAIw.exe
  2⤵
  PID:9400
- C:\Windows\System\AtKKYxi.exe
  C:\Windows\System\AtKKYxi.exe
  2⤵
  PID:9436
- C:\Windows\System\fladxMW.exe
  C:\Windows\System\fladxMW.exe
  2⤵
  PID:9480
- C:\Windows\System\qEhDxde.exe
  C:\Windows\System\qEhDxde.exe
  2⤵
  PID:9528
- C:\Windows\System\AZUNHDA.exe
  C:\Windows\System\AZUNHDA.exe
  2⤵
  PID:9468
- C:\Windows\System\dtogOlg.exe
  C:\Windows\System\dtogOlg.exe
  2⤵
  PID:9580
- C:\Windows\System\sajdLbn.exe
  C:\Windows\System\sajdLbn.exe
  2⤵
  PID:9648
- C:\Windows\System\pAAIINU.exe
  C:\Windows\System\pAAIINU.exe
  2⤵
  PID:9680
- C:\Windows\System\XWGbZjQ.exe
  C:\Windows\System\XWGbZjQ.exe
  2⤵
  PID:9692
- C:\Windows\System\aPcwdfm.exe
  C:\Windows\System\aPcwdfm.exe
  2⤵
  PID:9712
- C:\Windows\System\ogpkXir.exe
  C:\Windows\System\ogpkXir.exe
  2⤵
  PID:9740
- C:\Windows\System\fEhlDlq.exe
  C:\Windows\System\fEhlDlq.exe
  2⤵
  PID:9772
- C:\Windows\System\dqlBqPQ.exe
  C:\Windows\System\dqlBqPQ.exe
  2⤵
  PID:9808
- C:\Windows\System\pRljdna.exe
  C:\Windows\System\pRljdna.exe
  2⤵
  PID:9824
- C:\Windows\System\yQiFoKx.exe
  C:\Windows\System\yQiFoKx.exe
  2⤵
  PID:9872
- C:\Windows\System\HQBkfSm.exe
  C:\Windows\System\HQBkfSm.exe
  2⤵
  PID:9932
- C:\Windows\System\EtOgwFJ.exe
  C:\Windows\System\EtOgwFJ.exe
  2⤵
  PID:9964
- C:\Windows\System\zQmvYYn.exe
  C:\Windows\System\zQmvYYn.exe
  2⤵
  PID:9952
- C:\Windows\System\EOcPysN.exe
  C:\Windows\System\EOcPysN.exe
  2⤵
  PID:9980
- C:\Windows\System\DEqCPHW.exe
  C:\Windows\System\DEqCPHW.exe
  2⤵
  PID:10064
- C:\Windows\System\TfENptv.exe
  C:\Windows\System\TfENptv.exe
  2⤵
  PID:10124
- C:\Windows\System\XuIffOI.exe
  C:\Windows\System\XuIffOI.exe
  2⤵
  PID:10076
- C:\Windows\System\WqDpbYn.exe
  C:\Windows\System\WqDpbYn.exe
  2⤵
  PID:10108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\Cftvspr.exe

Filesize
2.2MB

MD5
c13fb1c6d7e5f25cdc339ccffc2c9dee

SHA1
96e9f8f2b4521a48fee0ab7d42d5329f08ecb71c

SHA256
55fab2888c1c6faebbe1d0195a36dbdc4de530b91d7a11cf1b2893444ce30b54

SHA512
0be8d830e2beafcdc28ee2df357bc851bad09532e7020d91293493560d955c50a5fc82b42a47e10792b7f6f034a53f3c976ca70f1fef6c24201e6cbb122deb69

Download Submit
C:\Windows\system\EJntnHu.exe

Filesize
2.2MB

MD5
b5d82bb77fa5a99a77cf89c01d48fd8d

SHA1
6c630550d78fc79f59dea8d4a4448ad325bbc79f

SHA256
94b008769975d70bab1458cac6d01556a88afbfafd223783afff3d056767f007

SHA512
4e71e1baf847705583168818cc367b4cf3f3a9ffc7b3d76d9e3b5e8f320a0ddf22c894d9e75f392c232d7e3a2a1badde8e6c8aefd02bd997ea036c872a928b22

Download Submit
C:\Windows\system\FEIIOrA.exe

Filesize
2.2MB

MD5
a6465df1445a72ed6757754364c6963f

SHA1
d7448f1c07fb402ba860a86ba4d4858d876589bf

SHA256
4cad3b9e5a5d684c57352a113bf606f90b485962e8196ecbc1460e4b7a7ce5e3

SHA512
350e42674dd84319ed05345ef1b576afa7888123e0dd74bd7a77d4379f91e073ff23987e868f6c2ba34f4076d1ea163d2f20d432d8f24ba4bb12fa08a8fe98f1

Download Submit
C:\Windows\system\KSzpvrv.exe

Filesize
2.2MB

MD5
08e526a8a2209f50d4682e3cad506454

SHA1
05f5bb0e69833b1d13da8c0f22eba209a9d1045c

SHA256
c5cbf028c9f5ba1b534909dd92960760471d8aba35c70d29a616c3642ecc04fb

SHA512
e9c4cbd43f06e85c5a3926399117a979cf3e51641bfed3343ad0cc7b37506dd6c9032fd56887cac1afcc839ab8bfcd8d545d0fe6d30ce7a9cb5d06f8b4f35b6c

Download Submit
C:\Windows\system\LVOjbAW.exe

Filesize
2.2MB

MD5
6b150786e7ad5e3c198dd91b5f89d9f7

SHA1
2f5e9fc7f7a4793cb4a15f596162fe47b57309f2

SHA256
756594857231f123ee76d3f370d3fc9d19b95f8ba65b2306087cea368089e916

SHA512
fa42d68567a6efdb59ff5602b122296b81254edb5d428df8c7bac5f64b2991daf198206ab444bf7877aba3d357fc2ffafd97e32a7fb0548ae2ffb3320ca4feba

Download Submit
C:\Windows\system\LdqhJfm.exe

Filesize
2.2MB

MD5
bc21e82950368edf4c93ec49c81570bf

SHA1
5bf118ad94a0c4a57148d871f2db3ba28e2a60bb

SHA256
9b73b84eb4a5be726b5d16ea762a320537e6506199ae21d7e96a34c22f82efb7

SHA512
957a68899024e352b1c653a75592c644efa8c99c536915e833fddf0342351838f77d66128f672337aeba98d59ace55712de911e7767ff88ceda739135c738f95

Download Submit
C:\Windows\system\QnNxOjG.exe

Filesize
2.2MB

MD5
cac32b356b4fcf039fd105258967d7d0

SHA1
6d7e74e3fd470583007151513abcca2c1164ea4c

SHA256
a68384b2e4b1e22481e923ebbebe56f55577359a5db1f944b60813b223fa2a98

SHA512
0ca6c7cfda163070ec11fe2e4304c72b09f9d95703d88774330ea68738ed94051e6119cec9be64fe8061fec4eeeba8c8de4cb0c85f5cdd63d79411ddd75727b6

Download Submit
C:\Windows\system\Routneb.exe

Filesize
2.2MB

MD5
f9be40d166acd82161cdfff316b0cae4

SHA1
42d996128a4a534d85cf644e1f1f06d8f709138f

SHA256
974e559eccabd9d555dce1990ed534fd11fdfdd828e861c873d0e7bab7d735b0

SHA512
111b4cf8edb28387b90ddc046b90d6b0f728d07d3cdd4bc1ccfa335ad1daf7cad5f517543099c8d4dc6f9fbf6a5eb6e389fb9d0fd6d791153b4befa9ef5a8a16

Download Submit
C:\Windows\system\SArULhZ.exe

Filesize
2.2MB

MD5
f63885f37af0c3847bb32bfd1bd81d58

SHA1
ec47db2079a51eb21575f18ef4bc4d73a81f4cf2

SHA256
f50cd7fe3d6a947f27ead751746ae0aa8fe3bd4eb8dd46d500ae5518d3f8131d

SHA512
9892ef06b780bd59b8316d4089e0a135df0350456584588586610b7966c8279f4912d30897b9a3d84d83d6963b1a8b5e54912c12ed38932f937b85ad3f8daa2c

Download Submit
C:\Windows\system\SxCZfhR.exe

Filesize
2.2MB

MD5
edc7a1ef7b4017777a2dbea47b4b0695

SHA1
813565ee8d3b8399fec13ad4e308607e578e4d00

SHA256
76548801e1c82a9d582a57fb5858819ee98aa819826a70ac0ab2a63f141aaf76

SHA512
830c5ab87a1f98b9f21d49e621c476c271f5b5632fda44472a139398796cdfe74a04fb997d6fb9b2adc9151c0c82f89ad666696b3cb80841fe137db5ffa3abad

Download Submit
C:\Windows\system\TsFgMJZ.exe

Filesize
2.2MB

MD5
5b1b56bd479bd80f4ca0bf151f191dee

SHA1
9c7114f590de2b4b750efaefd03a1046d9187158

SHA256
9e51fa6f65b3888f001d9826f4ce1d3326a820a9e1ead8316152d7d39cca9fac

SHA512
a23aef2504a2419c0925e91b1f558df2ef45e5667c9b3d01df3e1aea36623e5bc82cf0052017af6b462eaa834a26721081b5487765a495f3a7f43989a77191fe

Download Submit
C:\Windows\system\UXqjrKf.exe

Filesize
2.2MB

MD5
bd799d90f05384876a780e1f853c9c43

SHA1
6e4c3103092da3812d0f5ce1efdd36f0f2ba095e

SHA256
af8b9905d55abb48c10fd6e57313eb22961ddf832d5fcd84b194a7a2c104ae64

SHA512
c5b5be65c07be78938c715a58068d0b4a1c2ec94099956c39709ba17e1a26b1d30011cacd5c30f0ed4f3a3a1bfc3ad9dfb3b5467f9ca5cd49e5b71579c96c370

Download Submit
C:\Windows\system\UrXPLoS.exe

Filesize
2.2MB

MD5
4c41b7d42bbb814fbbd4770f8bdba81d

SHA1
04c85e0458dc26ca7ef8399dc3569e3374e31926

SHA256
060b715555549d2c10ab56fa712e85a359fd6086a61280aff786f609f85094d9

SHA512
1fed8a04c389b505ac28b5c05febf24f86709b4ae427039ca107784dd2212fdd6e711572aba7a4945523f1dcda8c19a036a2af2623dfdf97853512bf9b59bd44

Download Submit
C:\Windows\system\WXDjEih.exe

Filesize
2.2MB

MD5
38882c124a9d69429815362cd58c5db8

SHA1
ee06bc8f5f7de8fa1765eab8a60c16e2bc51ec53

SHA256
f0795b58aa2db172d33062adf9af4db27ec78581242d3f56967058f303c7e51f

SHA512
470788a79cbd1a3f3d7f1f391dfb0cad10fa42b83979d7aa9c6b2d7c10951830c2e362bcd44accc97e3c9f6c781127bf64a8d470329ed1d6455fa74ef035b213

Download Submit
C:\Windows\system\YrkOsGF.exe

Filesize
2.2MB

MD5
346d11806be241e9c3a24a8e76f9dc4a

SHA1
9b6983205ed8679ff6ead2f287c3b6a5c44d2766

SHA256
40cf7f67736fe3dadb47fe62d0bf9b6149097fa40a685549e6b606536b02af55

SHA512
f6e1a0929aec912e7922b44b28411325763fc5d671fa12df4a3a95ac6bcd7f7164fbd70f3a115b66c55788cf6450530b22be9bbc82c40c8c587f865ec19e09da

Download Submit
C:\Windows\system\ZHoMQGu.exe

Filesize
2.2MB

MD5
116a42638a13b94f42eec8a8fe0d5023

SHA1
dd73d386ca6abb1fa756d4f104bbad3e33070f17

SHA256
94b8028982af2a44defcdc87d61897de7d0146435481f0d8eb5ef0915f72979d

SHA512
4ff9e4b125b409410f8e0d4cefee808827e56a3454daf09ea0d965a7b4806cd878a906ba13e4bd29ce48d83e451fab039a5710ec1d24b0fa846967eef746c8b0

Download Submit
C:\Windows\system\ZoacEps.exe

Filesize
2.2MB

MD5
cbb425b2373cf9ba9ad5ed89e3149637

SHA1
53c4726d31a40b92c1ac18e9f25cf0fc92122181

SHA256
42c289c20d7eedff820eae4dd4bf8c9f394fa1ea8f1f360c6cf5f01f55724496

SHA512
601b616ee17666ad4bcea4a420da51929d6fbbcd5a91f5dbb455060e13451a6b45acd2f4a61fd75c056867390703114cdb81135451bc113ae6ae413ab342650d

Download Submit
C:\Windows\system\bNOqhtd.exe

Filesize
2.2MB

MD5
6e0c33c249e8249a4a1ec10c78228d53

SHA1
b8b9b096ca8364d0237c68baf92600e59dca4908

SHA256
5e67d221bb4045020dd641c27f0992ff71b871aa2b402f5d79699a9d790bea37

SHA512
f4ea40cf6efe18b11a2bec1a6727595ba29d4ab14afac01196221e90b0689b753b90e7d5727e89d24fcbbcb0cd79cc0b16733f78b2a6a16f2fb4cb34a2f4ba19

Download Submit
C:\Windows\system\ejLidbB.exe

Filesize
2.2MB

MD5
649cc35dfb4f8a27eb1a84a2afca3921

SHA1
b11ab6ce9a616e68edad99aa8ddb9f43d6cb9be7

SHA256
1a8e236298aa87ccad628807e607d7022003ece2c503ca1894b78206b54f30c9

SHA512
0b1712d30f37a4d594a3ba64068f36f02e7d175d40be80ebaae57be5f8031f029f3f981ad9dc07a90d9ea09b999f38ca074b0184756224b883270fd4a4bde0ce

Download Submit
C:\Windows\system\lgCqIvl.exe

Filesize
2.2MB

MD5
61ee736a50eb468b29d9b0e65e270ea5

SHA1
c5292f574e804d1c6ac47f87d303a88ed8ebdff8

SHA256
a3d1bc683980e03b649182f702ee51e48d60faf9520a0340a2e0e62b4c1e07a5

SHA512
e5573467dec21753db493f546964fe7b4ecf86f20601cc771ab47a79b4a41cfbff8aec4e251653259d8eab32c45383d14cd521601e279aff5406a7c3c16c71ed

Download Submit
C:\Windows\system\pKqKBps.exe

Filesize
2.2MB

MD5
18cf229310c748815f3877274439c2a4

SHA1
1803b30f6bb585c5e12c5262c3d1846002e47f03

SHA256
6f13896a3975636b09914495e5cbc4877aac8321096d85b1b0fdb7c89e600a2b

SHA512
bbfbcb3383dda50af9898b0c4a7e6c1f55db6a6b81f8d01e915bd6e99d9793c054408fb3d88237b3c99681e58a89ba02a159b4d6a262a31c97251a137c7a1fa4

Download Submit
C:\Windows\system\pXOZVUi.exe

Filesize
2.2MB

MD5
c2e3e1162de3d8cfd90c99dc32d15f3f

SHA1
ac369d3d81cc69454046deafb80c70c004ae885a

SHA256
a66d35fdc5fd77bb2f08b2c668ac3d8ccf6047d5650439e6493c48deb9f12f73

SHA512
3cab1205694e4f18859617acd9d99ad0e3772267f97cb01c704b0bab2937905fe34f31e3b39ea5536fd2bfa157a9d3ae045b1e8e42b12dbe3ccf3a0f011cee1d

Download Submit
C:\Windows\system\qFcyIeD.exe

Filesize
2.2MB

MD5
f86ea96b2e1e5abf5248031f2095f3da

SHA1
31a804fd9c6ea179e61390dc4e8c3858de41dde2

SHA256
8c2019c6972fbf2fbb08f9f14a69d0b39c4114e3527e5dbeb03ca2e5b8c61228

SHA512
4979538e76dcf30fd1f2697bbb9866df885bebcf507e917eb16f82f9c21b8a2b98be01d3dc8d14cb09611e95a33a6cc6e50296e51d4d41742dfea000b6bb424f

Download Submit
C:\Windows\system\uOWKbaT.exe

Filesize
2.2MB

MD5
6d73174ba12c15ca67de1195979e908c

SHA1
d5310d016d890d8599f5ac2957987ab702d59709

SHA256
126a975a9caa94fc7d25e34ed50cf6efa2b4e262d74f5b76514d5e7744a2eaa0

SHA512
013a7e101bdead6f84d46d1451eb13b66fed941cd63b4e225ef05f11872a8b2f523ae42191e79dd442042ec2db6a8604c1461e846b771d615adda8779ddfccad

Download Submit
C:\Windows\system\xtuUpJR.exe

Filesize
2.2MB

MD5
b78f760fcdbfdc73a06d5f32296739c0

SHA1
e9b96221696bac15495ea3f386896ce3863cec3f

SHA256
66914d808b230dc2280e8f17d95137c44a1d89936049162354033190f6817dc8

SHA512
51b0675b74caf10c5125a739ee108efd20c028c664321a3191e1a94328540ca99220b1ab1318d2503d2532159a24c91a4cfa51b2b3a1c7d4c46d56e7918b1735

Download Submit
\Windows\system\HwDuWMW.exe

Filesize
2.2MB

MD5
e50db6491578f4c273bf1fe26854b00d

SHA1
bfcd452cd37e7d9fb685b3e0720b511c08d21c0e

SHA256
bc84c75dae62ad4ed6b72cb39e7cbe8d92a2e831a59c656420e8ada785c7dfe5

SHA512
43fb389fb87e0d7add756fe24b01394db2cd44c43680d33b99377cb525bd838d0e87b3b97c2fea4a8d55f5afc0fd33d4987544892ae4254c7ed37937746f71c5

Download Submit
\Windows\system\SELtDwS.exe

Filesize
2.2MB

MD5
ddc2cb84eb14495bafd7f100acfd4b6f

SHA1
3aaff61f61eae3efd3159a60f654145ae220aeac

SHA256
4e279510cb71308cc0d810adedb22b87a1488cfcf13603034554c0d7ed9f1e12

SHA512
9a2ec813140225d77f956dc6687be4d5b63c5dad03f77c75a7dc0171250e6bb7b5a44dc5dc21540e158898e0747cd61cf7a17138c3de65c23018b92c39a1bfa7

Download Submit
\Windows\system\YFFzdLG.exe

Filesize
2.2MB

MD5
3ce1070ca6775a763f6935e0edbe9905

SHA1
671a99999d3c3fb3fa2577ab8b452ee122add02e

SHA256
42138948441f5b90d5d95604430fa52c4e672aa89218526334ad814796f255da

SHA512
7b3cbac40cbc164282f2833034ec986b53e307611eca8937993c6332efc2d54550b044c298a67016d1e917881d5b6ada67e1edea3eae7ec99f61f41c96b04b2f

Download Submit
\Windows\system\ZfFKEps.exe

Filesize
2.2MB

MD5
ae412b323285491da90eaf790cdfff62

SHA1
cdcbd69fd31453c7ee28ba1f13171aea63d5eea5

SHA256
9ddf6748d0eb6cd7e3a8b8731e5ed7ba857d31ac0b8168135c4f8877800079c7

SHA512
1a916822c4531a05213bab22daaf15af5f697f2bacb8c86782c2f4c209a9ab304c9c98e3f48789e5c465ed767dd2769213127956110dc2295f9dc43474759553

Download Submit
\Windows\system\ftfqDuT.exe

Filesize
2.2MB

MD5
03d60fb2ba804840457b82250fd70039

SHA1
fbadcfd25e8b28cc25cddc63b8dbd2d2534de22e

SHA256
3164b0f3d0bfac3731b7d1eff4aae3d584de97cd62d0d91142a8bc6e2b45ebb4

SHA512
0d781923181cfeb48d6876e1eb204740b5ee656d488fed7141cd194ed2931a9857421ae7897401a7d6101df363abbc1fe86db4b099cdf5b6ef1516821eb239dd

Download Submit
\Windows\system\jzHnbcR.exe

Filesize
2.2MB

MD5
26bd51aa0b20ccb5aa7c47eefb1a2352

SHA1
7bea17d75ccc762c8ef3a710b8dd831070382ec7

SHA256
c61606a22f3cbe8080b1a099a24c9c0699735386761a392574c2e45462dbbdd3

SHA512
5440de6537905b66cfb3da016a7c07663308569f46e8c54036bc3bb1bcf43b25f56b57e9cbeeb5b5a5db3f401255782a30eb1e9daf6613b8a8a3a91c470bbe49

Download Submit
\Windows\system\qPLNzCx.exe

Filesize
2.2MB

MD5
4dd1e929be6172091d00a10d07b28e66

SHA1
00a3f4213be600bfb3682c01f704cf4e8bf0743e

SHA256
cac0a4613b17996b32bdd08df6b53b0d4a58843ba288130dce139be008274d52

SHA512
095547b1184716072c3177b09757b5848d278fa463e4f0f191809552db42e4d2ee9d57b86602849bf140198b62e48f1747a99d9c71390361c3c1e246b3537f96

Download Submit
\Windows\system\szfpCXu.exe

Filesize
2.2MB

MD5
8c04d9e6a6f19f1ab2ff5e1300a191bb

SHA1
f01725670c5e5e0d7a94679b77913e75e9894573

SHA256
cb8b134bc27aeb6d7a6f9d97f1177f9f2c522a4610b61406377ca51096090422

SHA512
481b381617296b2280f6de833faffa68d0cd9ff07e357ae4bf78a9c738a882f87ab064e699408808392eae83e6f09df5caba585c15d8d198b2a44f2aa4809122

Download Submit
memory/484-4010-0x000000013F920000-0x000000013FD12000-memory.dmp

Filesize
3.9MB

Download
memory/484-125-0x000000013F920000-0x000000013FD12000-memory.dmp

Filesize
3.9MB

Download
memory/2112-18-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/2112-0-0x000000013F270000-0x000000013F662000-memory.dmp

Filesize
3.9MB

Download
memory/2112-126-0x000000013F9E0000-0x000000013FDD2000-memory.dmp

Filesize
3.9MB

Download
memory/2112-1-0x0000000000100000-0x0000000000110000-memory.dmp

Filesize
64KB

Download
memory/2112-8-0x0000000002B90000-0x0000000002F82000-memory.dmp

Filesize
3.9MB

Download
memory/2112-32-0x0000000002FA0000-0x0000000003392000-memory.dmp

Filesize
3.9MB

Download
memory/2112-109-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2112-37-0x0000000002FA0000-0x0000000003392000-memory.dmp

Filesize
3.9MB

Download
memory/2112-47-0x000000013F270000-0x000000013F662000-memory.dmp

Filesize
3.9MB

Download
memory/2112-44-0x000000013FAC0000-0x000000013FEB2000-memory.dmp

Filesize
3.9MB

Download
memory/2112-110-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/2112-111-0x00000000033C0000-0x00000000037B2000-memory.dmp

Filesize
3.9MB

Download
memory/2112-26-0x000000013F740000-0x000000013FB32000-memory.dmp

Filesize
3.9MB

Download
memory/2112-123-0x000000013F920000-0x000000013FD12000-memory.dmp

Filesize
3.9MB

Download
memory/2112-122-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/2112-48-0x000000013FD00000-0x00000001400F2000-memory.dmp

Filesize
3.9MB

Download
memory/2112-118-0x000000013F7B0000-0x000000013FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/2112-119-0x00000000033C0000-0x00000000037B2000-memory.dmp

Filesize
3.9MB

Download
memory/2416-101-0x0000000001D90000-0x0000000001D98000-memory.dmp

Filesize
32KB

Download
memory/2416-99-0x000000001B8A0000-0x000000001BB82000-memory.dmp

Filesize
2.9MB

Download
memory/2424-4819-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2424-4093-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2424-21-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2596-120-0x000000013F380000-0x000000013F772000-memory.dmp

Filesize
3.9MB

Download
memory/2596-4041-0x000000013F380000-0x000000013F772000-memory.dmp

Filesize
3.9MB

Download
memory/2716-124-0x000000013F630000-0x000000013FA22000-memory.dmp

Filesize
3.9MB

Download
memory/2716-4071-0x000000013F630000-0x000000013FA22000-memory.dmp

Filesize
3.9MB

Download
memory/2724-4710-0x000000013F740000-0x000000013FB32000-memory.dmp

Filesize
3.9MB

Download
memory/2724-27-0x000000013F740000-0x000000013FB32000-memory.dmp

Filesize
3.9MB

Download
memory/2736-38-0x000000013F0E0000-0x000000013F4D2000-memory.dmp

Filesize
3.9MB

Download
memory/2736-5391-0x000000013F0E0000-0x000000013F4D2000-memory.dmp

Filesize
3.9MB

Download
memory/2852-45-0x000000013FAC0000-0x000000013FEB2000-memory.dmp

Filesize
3.9MB

Download
memory/2852-4001-0x000000013FAC0000-0x000000013FEB2000-memory.dmp

Filesize
3.9MB

Download
memory/2872-33-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2872-4007-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2888-12-0x000000013F630000-0x000000013FA22000-memory.dmp

Filesize
3.9MB

Download
memory/2888-3969-0x000000013F630000-0x000000013FA22000-memory.dmp

Filesize
3.9MB

Download
memory/2992-3974-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/2992-19-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download