xmrig | 3d780dd00b899b7a8be0791693ac931bec2ae7b602d43286b433eee85a28744b

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 13:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

be95207a5f09ea47552a66b97964f130N.exe
Size

1.8MB
MD5

be95207a5f09ea47552a66b97964f130
SHA1

ddb97b725c768ecd1faeb7574de963d804716a16
SHA256

3d780dd00b899b7a8be0791693ac931bec2ae7b602d43286b433eee85a28744b
SHA512

bef284ffaf23306cb2510754aac62598d286691e3ae5013e0b42ddc2eca57fec80c094bcbdd42f728779c316d6f241dd556a35aaa2a9c09b6fb99d85a8ef9e30
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHqRi:NABB

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 23 IoCs

miner

resource	yara_rule
behavioral1/memory/2332-27-0x000000013F7F0000-0x000000013FBE2000-memory.dmp	xmrig
behavioral1/memory/2720-229-0x000000013FD70000-0x0000000140162000-memory.dmp	xmrig
behavioral1/memory/2864-253-0x000000013FE70000-0x0000000140262000-memory.dmp	xmrig
behavioral1/memory/2716-249-0x000000013F270000-0x000000013F662000-memory.dmp	xmrig
behavioral1/memory/2612-247-0x000000013FE10000-0x0000000140202000-memory.dmp	xmrig
behavioral1/memory/2648-245-0x000000013FE20000-0x0000000140212000-memory.dmp	xmrig
behavioral1/memory/1748-243-0x000000013F6A0000-0x000000013FA92000-memory.dmp	xmrig
behavioral1/memory/2788-241-0x000000013FB40000-0x000000013FF32000-memory.dmp	xmrig
behavioral1/memory/2712-233-0x000000013F080000-0x000000013F472000-memory.dmp	xmrig
behavioral1/memory/2852-231-0x000000013F710000-0x000000013FB02000-memory.dmp	xmrig
behavioral1/memory/1876-13-0x000000013F330000-0x000000013F722000-memory.dmp	xmrig
behavioral1/memory/2648-3922-0x000000013FE20000-0x0000000140212000-memory.dmp	xmrig
behavioral1/memory/2788-4178-0x000000013FB40000-0x000000013FF32000-memory.dmp	xmrig
behavioral1/memory/2332-4180-0x000000013F7F0000-0x000000013FBE2000-memory.dmp	xmrig
behavioral1/memory/1876-4179-0x000000013F330000-0x000000013F722000-memory.dmp	xmrig
behavioral1/memory/2720-4181-0x000000013FD70000-0x0000000140162000-memory.dmp	xmrig
behavioral1/memory/2712-4183-0x000000013F080000-0x000000013F472000-memory.dmp	xmrig
behavioral1/memory/2612-4190-0x000000013FE10000-0x0000000140202000-memory.dmp	xmrig
behavioral1/memory/2276-4192-0x000000013FFC0000-0x00000001403B2000-memory.dmp	xmrig
behavioral1/memory/1748-4189-0x000000013F6A0000-0x000000013FA92000-memory.dmp	xmrig
behavioral1/memory/2716-4193-0x000000013F270000-0x000000013F662000-memory.dmp	xmrig
behavioral1/memory/2864-4270-0x000000013FE70000-0x0000000140262000-memory.dmp	xmrig
behavioral1/memory/2852-4273-0x000000013F710000-0x000000013FB02000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2392	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1876	KuqfFWu.exe
2276	vCdJQYl.exe
2332	ViwDYiS.exe
2864	JLRzndX.exe
2720	YIgllKt.exe
2852	HQbONej.exe
2712	hHfTOqw.exe
2788	jIyGsgr.exe
1748	faqpWgk.exe
2648	VIEaUJf.exe
2612	LofLPlp.exe
2716	gDIUowX.exe
2368	dKJNRsO.exe
2232	gltPNzZ.exe
540	ToIocJa.exe
1740	POLSfHM.exe
2840	PPwdbSD.exe
264	VnvkIVC.exe
1096	XnqGHYS.exe
2096	aypLHTP.exe
2356	QCvgVJK.exe
2836	BDzAZSJ.exe
2020	Xwpcghc.exe
1508	ISqZYxo.exe
2792	jNNzStS.exe
2956	mRlFxYP.exe
2972	raDcbzD.exe
3028	IBwGDPp.exe
704	ncxyqSu.exe
1196	qJtKDSr.exe
2500	SaWIQVz.exe
1216	nZuqbbr.exe
1808	FMiAiZL.exe
856	MgQWEAT.exe
1188	sdjsavh.exe
1532	yhVtkRw.exe
844	fqnzuMU.exe
2448	pOsRSVx.exe
3064	pnBKmVA.exe
1628	olRESPh.exe
2084	hWSMLUV.exe
496	IgyyrVm.exe
1140	rmESkSa.exe
948	RTHcSSF.exe
3000	DsDHbQp.exe
1572	HKarmFD.exe
1524	XqCEveL.exe
376	awMJrma.exe
2188	mOHRbRV.exe
1804	WXdKtjh.exe
1732	swgKtgo.exe
2620	kCTgJgX.exe
2592	hpkOnLb.exe
2640	enQjJSd.exe
1880	IyOTDhM.exe
1616	nKNMpXx.exe
672	XMibjin.exe
2036	HjeYWJh.exe
1088	FqjpQTJ.exe
468	QUDsLvO.exe
2504	eJnfTUz.exe
308	YtVuRZH.exe
2988	OdcCRuc.exe
640	vskffGK.exe

Loads dropped DLL 64 IoCs

pid	Process
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe
2412	be95207a5f09ea47552a66b97964f130N.exe

UPX packed file 58 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2412-1-0x000000013FEA0000-0x0000000140292000-memory.dmp	upx
behavioral1/files/0x0007000000012118-6.dat	upx
behavioral1/memory/2332-27-0x000000013F7F0000-0x000000013FBE2000-memory.dmp	upx
behavioral1/files/0x000f0000000054a8-39.dat	upx
behavioral1/files/0x0007000000018736-43.dat	upx
behavioral1/files/0x0008000000018b83-58.dat	upx
behavioral1/files/0x00050000000194b9-63.dat	upx
behavioral1/files/0x00050000000195c7-83.dat	upx
behavioral1/files/0x000500000001960d-94.dat	upx
behavioral1/files/0x0005000000019611-104.dat	upx
behavioral1/files/0x0005000000019615-114.dat	upx
behavioral1/files/0x0005000000019619-124.dat	upx
behavioral1/files/0x0005000000019627-174.dat	upx
behavioral1/files/0x00050000000196b1-171.dat	upx
behavioral1/memory/2720-229-0x000000013FD70000-0x0000000140162000-memory.dmp	upx
behavioral1/memory/2864-253-0x000000013FE70000-0x0000000140262000-memory.dmp	upx
behavioral1/memory/2716-249-0x000000013F270000-0x000000013F662000-memory.dmp	upx
behavioral1/memory/2612-247-0x000000013FE10000-0x0000000140202000-memory.dmp	upx
behavioral1/memory/2648-245-0x000000013FE20000-0x0000000140212000-memory.dmp	upx
behavioral1/memory/1748-243-0x000000013F6A0000-0x000000013FA92000-memory.dmp	upx
behavioral1/memory/2788-241-0x000000013FB40000-0x000000013FF32000-memory.dmp	upx
behavioral1/memory/2712-233-0x000000013F080000-0x000000013F472000-memory.dmp	upx
behavioral1/memory/2852-231-0x000000013F710000-0x000000013FB02000-memory.dmp	upx
behavioral1/files/0x0005000000019624-164.dat	upx
behavioral1/files/0x00050000000196b3-175.dat	upx
behavioral1/files/0x0005000000019621-142.dat	upx
behavioral1/files/0x0005000000019669-167.dat	upx
behavioral1/files/0x0005000000019625-159.dat	upx
behavioral1/files/0x0005000000019623-148.dat	upx
behavioral1/files/0x000500000001961d-134.dat	upx
behavioral1/files/0x000500000001961f-138.dat	upx
behavioral1/files/0x000500000001961b-127.dat	upx
behavioral1/files/0x0005000000019617-117.dat	upx
behavioral1/files/0x0005000000019613-107.dat	upx
behavioral1/files/0x000500000001960f-97.dat	upx
behavioral1/files/0x000500000001960b-88.dat	upx
behavioral1/files/0x000500000001958d-78.dat	upx
behavioral1/files/0x0005000000019568-73.dat	upx
behavioral1/files/0x00050000000194e7-68.dat	upx
behavioral1/files/0x0008000000018b00-54.dat	upx
behavioral1/files/0x0006000000018780-49.dat	upx
behavioral1/files/0x000600000001872e-34.dat	upx
behavioral1/memory/2276-25-0x000000013FFC0000-0x00000001403B2000-memory.dmp	upx
behavioral1/files/0x00060000000186f7-21.dat	upx
behavioral1/files/0x00070000000186f3-20.dat	upx
behavioral1/memory/1876-13-0x000000013F330000-0x000000013F722000-memory.dmp	upx
behavioral1/memory/2648-3922-0x000000013FE20000-0x0000000140212000-memory.dmp	upx
behavioral1/memory/2788-4178-0x000000013FB40000-0x000000013FF32000-memory.dmp	upx
behavioral1/memory/2332-4180-0x000000013F7F0000-0x000000013FBE2000-memory.dmp	upx
behavioral1/memory/1876-4179-0x000000013F330000-0x000000013F722000-memory.dmp	upx
behavioral1/memory/2720-4181-0x000000013FD70000-0x0000000140162000-memory.dmp	upx
behavioral1/memory/2712-4183-0x000000013F080000-0x000000013F472000-memory.dmp	upx
behavioral1/memory/2612-4190-0x000000013FE10000-0x0000000140202000-memory.dmp	upx
behavioral1/memory/2276-4192-0x000000013FFC0000-0x00000001403B2000-memory.dmp	upx
behavioral1/memory/1748-4189-0x000000013F6A0000-0x000000013FA92000-memory.dmp	upx
behavioral1/memory/2716-4193-0x000000013F270000-0x000000013F662000-memory.dmp	upx
behavioral1/memory/2864-4270-0x000000013FE70000-0x0000000140262000-memory.dmp	upx
behavioral1/memory/2852-4273-0x000000013F710000-0x000000013FB02000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\HteaHFb.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\EedUSFl.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\tAJeyMu.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\wMBqWUD.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\ArokGEp.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\AIgmWqq.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\SBmOPqE.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\UByYXdz.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\oQJjmsZ.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\xEgaBnv.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\XuLNTwZ.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\AcdAJse.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\GCjMQZe.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\mTHzubD.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\XkzLMUK.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\QRYlUXV.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\gJUGbPe.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\nHpHbdn.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\eJnfTUz.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\QwyIcYM.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\utTFGff.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\XLqPrtl.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\jkXhGwn.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\VJjwgWq.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\ZxfQOAL.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\yTCozRt.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\KeoRBim.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\VQPZJzN.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\dJWPSUw.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\pEwReGI.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\SOAmWFg.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\mMLEAtk.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\QjhrrdD.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\JoqPjpd.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\ezNgXpD.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\LwLbEey.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\voDACaY.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\CeRxAAG.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\WgsDrvl.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\vTUorUv.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\axxRvvu.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\xBdmYRo.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\kECpzYb.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\UGHxGco.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\LfMKfnH.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\zkJXIEG.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\dfmkMQz.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\iaWmqaL.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\aLQCNxK.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\tyrchQt.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\rjHEefT.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\dBxnmAM.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\Wdlhegt.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\DLxGrxD.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\iceWhBZ.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\FcfOAlS.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\hlehXFg.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\csDKkQH.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\YvFkMhB.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\fKdeIhJ.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\nILymUu.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\llMqdYk.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\HQbONej.exe	be95207a5f09ea47552a66b97964f130N.exe
File created	C:\Windows\System\XnqGHYS.exe	be95207a5f09ea47552a66b97964f130N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2392	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2412	be95207a5f09ea47552a66b97964f130N.exe
Token: SeDebugPrivilege	2392	powershell.exe
Token: SeLockMemoryPrivilege	2412	be95207a5f09ea47552a66b97964f130N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2392	2412	be95207a5f09ea47552a66b97964f130N.exe	31
PID 2412 wrote to memory of 2392	2412	be95207a5f09ea47552a66b97964f130N.exe	31
PID 2412 wrote to memory of 2392	2412	be95207a5f09ea47552a66b97964f130N.exe	31
PID 2412 wrote to memory of 1876	2412	be95207a5f09ea47552a66b97964f130N.exe	32
PID 2412 wrote to memory of 1876	2412	be95207a5f09ea47552a66b97964f130N.exe	32
PID 2412 wrote to memory of 1876	2412	be95207a5f09ea47552a66b97964f130N.exe	32
PID 2412 wrote to memory of 2276	2412	be95207a5f09ea47552a66b97964f130N.exe	33
PID 2412 wrote to memory of 2276	2412	be95207a5f09ea47552a66b97964f130N.exe	33
PID 2412 wrote to memory of 2276	2412	be95207a5f09ea47552a66b97964f130N.exe	33
PID 2412 wrote to memory of 2332	2412	be95207a5f09ea47552a66b97964f130N.exe	34
PID 2412 wrote to memory of 2332	2412	be95207a5f09ea47552a66b97964f130N.exe	34
PID 2412 wrote to memory of 2332	2412	be95207a5f09ea47552a66b97964f130N.exe	34
PID 2412 wrote to memory of 2864	2412	be95207a5f09ea47552a66b97964f130N.exe	35
PID 2412 wrote to memory of 2864	2412	be95207a5f09ea47552a66b97964f130N.exe	35
PID 2412 wrote to memory of 2864	2412	be95207a5f09ea47552a66b97964f130N.exe	35
PID 2412 wrote to memory of 2720	2412	be95207a5f09ea47552a66b97964f130N.exe	36
PID 2412 wrote to memory of 2720	2412	be95207a5f09ea47552a66b97964f130N.exe	36
PID 2412 wrote to memory of 2720	2412	be95207a5f09ea47552a66b97964f130N.exe	36
PID 2412 wrote to memory of 2852	2412	be95207a5f09ea47552a66b97964f130N.exe	37
PID 2412 wrote to memory of 2852	2412	be95207a5f09ea47552a66b97964f130N.exe	37
PID 2412 wrote to memory of 2852	2412	be95207a5f09ea47552a66b97964f130N.exe	37
PID 2412 wrote to memory of 2712	2412	be95207a5f09ea47552a66b97964f130N.exe	38
PID 2412 wrote to memory of 2712	2412	be95207a5f09ea47552a66b97964f130N.exe	38
PID 2412 wrote to memory of 2712	2412	be95207a5f09ea47552a66b97964f130N.exe	38
PID 2412 wrote to memory of 2788	2412	be95207a5f09ea47552a66b97964f130N.exe	39
PID 2412 wrote to memory of 2788	2412	be95207a5f09ea47552a66b97964f130N.exe	39
PID 2412 wrote to memory of 2788	2412	be95207a5f09ea47552a66b97964f130N.exe	39
PID 2412 wrote to memory of 1748	2412	be95207a5f09ea47552a66b97964f130N.exe	40
PID 2412 wrote to memory of 1748	2412	be95207a5f09ea47552a66b97964f130N.exe	40
PID 2412 wrote to memory of 1748	2412	be95207a5f09ea47552a66b97964f130N.exe	40
PID 2412 wrote to memory of 2648	2412	be95207a5f09ea47552a66b97964f130N.exe	41
PID 2412 wrote to memory of 2648	2412	be95207a5f09ea47552a66b97964f130N.exe	41
PID 2412 wrote to memory of 2648	2412	be95207a5f09ea47552a66b97964f130N.exe	41
PID 2412 wrote to memory of 2612	2412	be95207a5f09ea47552a66b97964f130N.exe	42
PID 2412 wrote to memory of 2612	2412	be95207a5f09ea47552a66b97964f130N.exe	42
PID 2412 wrote to memory of 2612	2412	be95207a5f09ea47552a66b97964f130N.exe	42
PID 2412 wrote to memory of 2716	2412	be95207a5f09ea47552a66b97964f130N.exe	43
PID 2412 wrote to memory of 2716	2412	be95207a5f09ea47552a66b97964f130N.exe	43
PID 2412 wrote to memory of 2716	2412	be95207a5f09ea47552a66b97964f130N.exe	43
PID 2412 wrote to memory of 2368	2412	be95207a5f09ea47552a66b97964f130N.exe	44
PID 2412 wrote to memory of 2368	2412	be95207a5f09ea47552a66b97964f130N.exe	44
PID 2412 wrote to memory of 2368	2412	be95207a5f09ea47552a66b97964f130N.exe	44
PID 2412 wrote to memory of 2232	2412	be95207a5f09ea47552a66b97964f130N.exe	45
PID 2412 wrote to memory of 2232	2412	be95207a5f09ea47552a66b97964f130N.exe	45
PID 2412 wrote to memory of 2232	2412	be95207a5f09ea47552a66b97964f130N.exe	45
PID 2412 wrote to memory of 540	2412	be95207a5f09ea47552a66b97964f130N.exe	46
PID 2412 wrote to memory of 540	2412	be95207a5f09ea47552a66b97964f130N.exe	46
PID 2412 wrote to memory of 540	2412	be95207a5f09ea47552a66b97964f130N.exe	46
PID 2412 wrote to memory of 1740	2412	be95207a5f09ea47552a66b97964f130N.exe	47
PID 2412 wrote to memory of 1740	2412	be95207a5f09ea47552a66b97964f130N.exe	47
PID 2412 wrote to memory of 1740	2412	be95207a5f09ea47552a66b97964f130N.exe	47
PID 2412 wrote to memory of 2840	2412	be95207a5f09ea47552a66b97964f130N.exe	48
PID 2412 wrote to memory of 2840	2412	be95207a5f09ea47552a66b97964f130N.exe	48
PID 2412 wrote to memory of 2840	2412	be95207a5f09ea47552a66b97964f130N.exe	48
PID 2412 wrote to memory of 264	2412	be95207a5f09ea47552a66b97964f130N.exe	49
PID 2412 wrote to memory of 264	2412	be95207a5f09ea47552a66b97964f130N.exe	49
PID 2412 wrote to memory of 264	2412	be95207a5f09ea47552a66b97964f130N.exe	49
PID 2412 wrote to memory of 1096	2412	be95207a5f09ea47552a66b97964f130N.exe	50
PID 2412 wrote to memory of 1096	2412	be95207a5f09ea47552a66b97964f130N.exe	50
PID 2412 wrote to memory of 1096	2412	be95207a5f09ea47552a66b97964f130N.exe	50
PID 2412 wrote to memory of 2096	2412	be95207a5f09ea47552a66b97964f130N.exe	51
PID 2412 wrote to memory of 2096	2412	be95207a5f09ea47552a66b97964f130N.exe	51
PID 2412 wrote to memory of 2096	2412	be95207a5f09ea47552a66b97964f130N.exe	51
PID 2412 wrote to memory of 2356	2412	be95207a5f09ea47552a66b97964f130N.exe	52

C:\Users\Admin\AppData\Local\Temp\be95207a5f09ea47552a66b97964f130N.exe
"C:\Users\Admin\AppData\Local\Temp\be95207a5f09ea47552a66b97964f130N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2392
- C:\Windows\System\KuqfFWu.exe
  C:\Windows\System\KuqfFWu.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\vCdJQYl.exe
  C:\Windows\System\vCdJQYl.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\ViwDYiS.exe
  C:\Windows\System\ViwDYiS.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\JLRzndX.exe
  C:\Windows\System\JLRzndX.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\YIgllKt.exe
  C:\Windows\System\YIgllKt.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\HQbONej.exe
  C:\Windows\System\HQbONej.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\hHfTOqw.exe
  C:\Windows\System\hHfTOqw.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\jIyGsgr.exe
  C:\Windows\System\jIyGsgr.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\faqpWgk.exe
  C:\Windows\System\faqpWgk.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\VIEaUJf.exe
  C:\Windows\System\VIEaUJf.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\LofLPlp.exe
  C:\Windows\System\LofLPlp.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\gDIUowX.exe
  C:\Windows\System\gDIUowX.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\dKJNRsO.exe
  C:\Windows\System\dKJNRsO.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\gltPNzZ.exe
  C:\Windows\System\gltPNzZ.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\ToIocJa.exe
  C:\Windows\System\ToIocJa.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\POLSfHM.exe
  C:\Windows\System\POLSfHM.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\PPwdbSD.exe
  C:\Windows\System\PPwdbSD.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\VnvkIVC.exe
  C:\Windows\System\VnvkIVC.exe
  2⤵
  - Executes dropped EXE
  PID:264
- C:\Windows\System\XnqGHYS.exe
  C:\Windows\System\XnqGHYS.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\aypLHTP.exe
  C:\Windows\System\aypLHTP.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\QCvgVJK.exe
  C:\Windows\System\QCvgVJK.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\BDzAZSJ.exe
  C:\Windows\System\BDzAZSJ.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\Xwpcghc.exe
  C:\Windows\System\Xwpcghc.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\ISqZYxo.exe
  C:\Windows\System\ISqZYxo.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\jNNzStS.exe
  C:\Windows\System\jNNzStS.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\raDcbzD.exe
  C:\Windows\System\raDcbzD.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\mRlFxYP.exe
  C:\Windows\System\mRlFxYP.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\ncxyqSu.exe
  C:\Windows\System\ncxyqSu.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\IBwGDPp.exe
  C:\Windows\System\IBwGDPp.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\SaWIQVz.exe
  C:\Windows\System\SaWIQVz.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\qJtKDSr.exe
  C:\Windows\System\qJtKDSr.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\FMiAiZL.exe
  C:\Windows\System\FMiAiZL.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\nZuqbbr.exe
  C:\Windows\System\nZuqbbr.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\MgQWEAT.exe
  C:\Windows\System\MgQWEAT.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\sdjsavh.exe
  C:\Windows\System\sdjsavh.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\yhVtkRw.exe
  C:\Windows\System\yhVtkRw.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\fqnzuMU.exe
  C:\Windows\System\fqnzuMU.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\RTHcSSF.exe
  C:\Windows\System\RTHcSSF.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\pOsRSVx.exe
  C:\Windows\System\pOsRSVx.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\DsDHbQp.exe
  C:\Windows\System\DsDHbQp.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\pnBKmVA.exe
  C:\Windows\System\pnBKmVA.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\HKarmFD.exe
  C:\Windows\System\HKarmFD.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\olRESPh.exe
  C:\Windows\System\olRESPh.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\XqCEveL.exe
  C:\Windows\System\XqCEveL.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\hWSMLUV.exe
  C:\Windows\System\hWSMLUV.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\awMJrma.exe
  C:\Windows\System\awMJrma.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\IgyyrVm.exe
  C:\Windows\System\IgyyrVm.exe
  2⤵
  - Executes dropped EXE
  PID:496
- C:\Windows\System\mOHRbRV.exe
  C:\Windows\System\mOHRbRV.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\rmESkSa.exe
  C:\Windows\System\rmESkSa.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\swgKtgo.exe
  C:\Windows\System\swgKtgo.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\WXdKtjh.exe
  C:\Windows\System\WXdKtjh.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\kCTgJgX.exe
  C:\Windows\System\kCTgJgX.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\hpkOnLb.exe
  C:\Windows\System\hpkOnLb.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\enQjJSd.exe
  C:\Windows\System\enQjJSd.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\IyOTDhM.exe
  C:\Windows\System\IyOTDhM.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\nKNMpXx.exe
  C:\Windows\System\nKNMpXx.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\XMibjin.exe
  C:\Windows\System\XMibjin.exe
  2⤵
  - Executes dropped EXE
  PID:672
- C:\Windows\System\HjeYWJh.exe
  C:\Windows\System\HjeYWJh.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\FqjpQTJ.exe
  C:\Windows\System\FqjpQTJ.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\QUDsLvO.exe
  C:\Windows\System\QUDsLvO.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\eJnfTUz.exe
  C:\Windows\System\eJnfTUz.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\YtVuRZH.exe
  C:\Windows\System\YtVuRZH.exe
  2⤵
  - Executes dropped EXE
  PID:308
- C:\Windows\System\OdcCRuc.exe
  C:\Windows\System\OdcCRuc.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\vskffGK.exe
  C:\Windows\System\vskffGK.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\fusWInR.exe
  C:\Windows\System\fusWInR.exe
  2⤵
  PID:1656
- C:\Windows\System\LJYAABU.exe
  C:\Windows\System\LJYAABU.exe
  2⤵
  PID:2892
- C:\Windows\System\zDPyDXr.exe
  C:\Windows\System\zDPyDXr.exe
  2⤵
  PID:3008
- C:\Windows\System\nGggMlD.exe
  C:\Windows\System\nGggMlD.exe
  2⤵
  PID:2928
- C:\Windows\System\DjPuqGZ.exe
  C:\Windows\System\DjPuqGZ.exe
  2⤵
  PID:2172
- C:\Windows\System\OFVyJDw.exe
  C:\Windows\System\OFVyJDw.exe
  2⤵
  PID:2628
- C:\Windows\System\mnmuPaL.exe
  C:\Windows\System\mnmuPaL.exe
  2⤵
  PID:1652
- C:\Windows\System\oTiINCl.exe
  C:\Windows\System\oTiINCl.exe
  2⤵
  PID:1720
- C:\Windows\System\cBPVVeD.exe
  C:\Windows\System\cBPVVeD.exe
  2⤵
  PID:2200
- C:\Windows\System\MofOTCA.exe
  C:\Windows\System\MofOTCA.exe
  2⤵
  PID:1284
- C:\Windows\System\sUrpljT.exe
  C:\Windows\System\sUrpljT.exe
  2⤵
  PID:2324
- C:\Windows\System\uSObJHv.exe
  C:\Windows\System\uSObJHv.exe
  2⤵
  PID:2360
- C:\Windows\System\vTUorUv.exe
  C:\Windows\System\vTUorUv.exe
  2⤵
  PID:2508
- C:\Windows\System\azOPctN.exe
  C:\Windows\System\azOPctN.exe
  2⤵
  PID:1536
- C:\Windows\System\jtAXyrA.exe
  C:\Windows\System\jtAXyrA.exe
  2⤵
  PID:552
- C:\Windows\System\hChldEm.exe
  C:\Windows\System\hChldEm.exe
  2⤵
  PID:1744
- C:\Windows\System\VLdJqQk.exe
  C:\Windows\System\VLdJqQk.exe
  2⤵
  PID:1928
- C:\Windows\System\cfMAuQS.exe
  C:\Windows\System\cfMAuQS.exe
  2⤵
  PID:1136
- C:\Windows\System\GMydeRx.exe
  C:\Windows\System\GMydeRx.exe
  2⤵
  PID:2868
- C:\Windows\System\QPCbTaO.exe
  C:\Windows\System\QPCbTaO.exe
  2⤵
  PID:2688
- C:\Windows\System\nxLGLhx.exe
  C:\Windows\System\nxLGLhx.exe
  2⤵
  PID:2672
- C:\Windows\System\BUdpVAU.exe
  C:\Windows\System\BUdpVAU.exe
  2⤵
  PID:2204
- C:\Windows\System\fgfPSCy.exe
  C:\Windows\System\fgfPSCy.exe
  2⤵
  PID:2828
- C:\Windows\System\BhIhIgS.exe
  C:\Windows\System\BhIhIgS.exe
  2⤵
  PID:1320
- C:\Windows\System\idueSNE.exe
  C:\Windows\System\idueSNE.exe
  2⤵
  PID:2932
- C:\Windows\System\TrBgxqa.exe
  C:\Windows\System\TrBgxqa.exe
  2⤵
  PID:1232
- C:\Windows\System\MvQCukf.exe
  C:\Windows\System\MvQCukf.exe
  2⤵
  PID:1504
- C:\Windows\System\PFoIQqw.exe
  C:\Windows\System\PFoIQqw.exe
  2⤵
  PID:2960
- C:\Windows\System\ujgYjIW.exe
  C:\Windows\System\ujgYjIW.exe
  2⤵
  PID:316
- C:\Windows\System\mCTbfAn.exe
  C:\Windows\System\mCTbfAn.exe
  2⤵
  PID:2336
- C:\Windows\System\nNAnthm.exe
  C:\Windows\System\nNAnthm.exe
  2⤵
  PID:2476
- C:\Windows\System\uHxhFOY.exe
  C:\Windows\System\uHxhFOY.exe
  2⤵
  PID:324
- C:\Windows\System\ILEmEPc.exe
  C:\Windows\System\ILEmEPc.exe
  2⤵
  PID:1896
- C:\Windows\System\dmsuKqx.exe
  C:\Windows\System\dmsuKqx.exe
  2⤵
  PID:2964
- C:\Windows\System\UmRdwQM.exe
  C:\Windows\System\UmRdwQM.exe
  2⤵
  PID:596
- C:\Windows\System\palzEIC.exe
  C:\Windows\System\palzEIC.exe
  2⤵
  PID:1600
- C:\Windows\System\CbLMLGF.exe
  C:\Windows\System\CbLMLGF.exe
  2⤵
  PID:1716
- C:\Windows\System\gWmQsHE.exe
  C:\Windows\System\gWmQsHE.exe
  2⤵
  PID:1456
- C:\Windows\System\BStbXFc.exe
  C:\Windows\System\BStbXFc.exe
  2⤵
  PID:1712
- C:\Windows\System\WexnDWz.exe
  C:\Windows\System\WexnDWz.exe
  2⤵
  PID:1900
- C:\Windows\System\pyoRgAE.exe
  C:\Windows\System\pyoRgAE.exe
  2⤵
  PID:2184
- C:\Windows\System\lfVPmsS.exe
  C:\Windows\System\lfVPmsS.exe
  2⤵
  PID:2180
- C:\Windows\System\pCJOkPk.exe
  C:\Windows\System\pCJOkPk.exe
  2⤵
  PID:1592
- C:\Windows\System\cdzeMeL.exe
  C:\Windows\System\cdzeMeL.exe
  2⤵
  PID:2816
- C:\Windows\System\EefNgIY.exe
  C:\Windows\System\EefNgIY.exe
  2⤵
  PID:1960
- C:\Windows\System\nGTIRsy.exe
  C:\Windows\System\nGTIRsy.exe
  2⤵
  PID:1624
- C:\Windows\System\oubWTrZ.exe
  C:\Windows\System\oubWTrZ.exe
  2⤵
  PID:2596
- C:\Windows\System\cepsNsD.exe
  C:\Windows\System\cepsNsD.exe
  2⤵
  PID:2016
- C:\Windows\System\KturZrl.exe
  C:\Windows\System\KturZrl.exe
  2⤵
  PID:2912
- C:\Windows\System\FzexmGq.exe
  C:\Windows\System\FzexmGq.exe
  2⤵
  PID:2272
- C:\Windows\System\nyjXHEn.exe
  C:\Windows\System\nyjXHEn.exe
  2⤵
  PID:872
- C:\Windows\System\eRZNSex.exe
  C:\Windows\System\eRZNSex.exe
  2⤵
  PID:2408
- C:\Windows\System\cNUYVBQ.exe
  C:\Windows\System\cNUYVBQ.exe
  2⤵
  PID:1156
- C:\Windows\System\eyaBmHm.exe
  C:\Windows\System\eyaBmHm.exe
  2⤵
  PID:2280
- C:\Windows\System\CfAoMTW.exe
  C:\Windows\System\CfAoMTW.exe
  2⤵
  PID:2660
- C:\Windows\System\htJGkqX.exe
  C:\Windows\System\htJGkqX.exe
  2⤵
  PID:2012
- C:\Windows\System\pkbhGSy.exe
  C:\Windows\System\pkbhGSy.exe
  2⤵
  PID:1476
- C:\Windows\System\CWoHJeN.exe
  C:\Windows\System\CWoHJeN.exe
  2⤵
  PID:3036
- C:\Windows\System\ulLKqea.exe
  C:\Windows\System\ulLKqea.exe
  2⤵
  PID:1388
- C:\Windows\System\LBQxQpt.exe
  C:\Windows\System\LBQxQpt.exe
  2⤵
  PID:3048
- C:\Windows\System\OeNraaH.exe
  C:\Windows\System\OeNraaH.exe
  2⤵
  PID:1856
- C:\Windows\System\UVZXoFK.exe
  C:\Windows\System\UVZXoFK.exe
  2⤵
  PID:764
- C:\Windows\System\PYUctkq.exe
  C:\Windows\System\PYUctkq.exe
  2⤵
  PID:2728
- C:\Windows\System\XsbXatl.exe
  C:\Windows\System\XsbXatl.exe
  2⤵
  PID:1968
- C:\Windows\System\hPHeuuM.exe
  C:\Windows\System\hPHeuuM.exe
  2⤵
  PID:1936
- C:\Windows\System\GvCOqni.exe
  C:\Windows\System\GvCOqni.exe
  2⤵
  PID:1068
- C:\Windows\System\zrnRvRK.exe
  C:\Windows\System\zrnRvRK.exe
  2⤵
  PID:2284
- C:\Windows\System\XlpOVLu.exe
  C:\Windows\System\XlpOVLu.exe
  2⤵
  PID:2744
- C:\Windows\System\qVKXwGk.exe
  C:\Windows\System\qVKXwGk.exe
  2⤵
  PID:2424
- C:\Windows\System\qmRXRGY.exe
  C:\Windows\System\qmRXRGY.exe
  2⤵
  PID:1296
- C:\Windows\System\gHeAMDS.exe
  C:\Windows\System\gHeAMDS.exe
  2⤵
  PID:2168
- C:\Windows\System\kAeOYER.exe
  C:\Windows\System\kAeOYER.exe
  2⤵
  PID:1776
- C:\Windows\System\LgpnbGe.exe
  C:\Windows\System\LgpnbGe.exe
  2⤵
  PID:1056
- C:\Windows\System\WjSyPDE.exe
  C:\Windows\System\WjSyPDE.exe
  2⤵
  PID:2824
- C:\Windows\System\snTbriw.exe
  C:\Windows\System\snTbriw.exe
  2⤵
  PID:2300
- C:\Windows\System\hueNJUD.exe
  C:\Windows\System\hueNJUD.exe
  2⤵
  PID:2800
- C:\Windows\System\IOevaJi.exe
  C:\Windows\System\IOevaJi.exe
  2⤵
  PID:2900
- C:\Windows\System\eegFGwt.exe
  C:\Windows\System\eegFGwt.exe
  2⤵
  PID:1084
- C:\Windows\System\zNOkogy.exe
  C:\Windows\System\zNOkogy.exe
  2⤵
  PID:2916
- C:\Windows\System\CLPgLZp.exe
  C:\Windows\System\CLPgLZp.exe
  2⤵
  PID:2600
- C:\Windows\System\cfAfhMN.exe
  C:\Windows\System\cfAfhMN.exe
  2⤵
  PID:1184
- C:\Windows\System\rVwwNHo.exe
  C:\Windows\System\rVwwNHo.exe
  2⤵
  PID:2736
- C:\Windows\System\ZzKwLGr.exe
  C:\Windows\System\ZzKwLGr.exe
  2⤵
  PID:340
- C:\Windows\System\WohFqXe.exe
  C:\Windows\System\WohFqXe.exe
  2⤵
  PID:3076
- C:\Windows\System\ACPwSqP.exe
  C:\Windows\System\ACPwSqP.exe
  2⤵
  PID:3092
- C:\Windows\System\qFcEscT.exe
  C:\Windows\System\qFcEscT.exe
  2⤵
  PID:3108
- C:\Windows\System\vlYHfFU.exe
  C:\Windows\System\vlYHfFU.exe
  2⤵
  PID:3124
- C:\Windows\System\hrGRggn.exe
  C:\Windows\System\hrGRggn.exe
  2⤵
  PID:3140
- C:\Windows\System\vpRHATv.exe
  C:\Windows\System\vpRHATv.exe
  2⤵
  PID:3156
- C:\Windows\System\aYXeNaP.exe
  C:\Windows\System\aYXeNaP.exe
  2⤵
  PID:3172
- C:\Windows\System\JnDLEZd.exe
  C:\Windows\System\JnDLEZd.exe
  2⤵
  PID:3188
- C:\Windows\System\FaMzVFb.exe
  C:\Windows\System\FaMzVFb.exe
  2⤵
  PID:3204
- C:\Windows\System\ifBkxCm.exe
  C:\Windows\System\ifBkxCm.exe
  2⤵
  PID:3220
- C:\Windows\System\MSyziVG.exe
  C:\Windows\System\MSyziVG.exe
  2⤵
  PID:3236
- C:\Windows\System\ZWKRTWO.exe
  C:\Windows\System\ZWKRTWO.exe
  2⤵
  PID:3252
- C:\Windows\System\yUgUlwT.exe
  C:\Windows\System\yUgUlwT.exe
  2⤵
  PID:3268
- C:\Windows\System\nmkXQNs.exe
  C:\Windows\System\nmkXQNs.exe
  2⤵
  PID:3284
- C:\Windows\System\FjJqyQO.exe
  C:\Windows\System\FjJqyQO.exe
  2⤵
  PID:3300
- C:\Windows\System\uVrBPKy.exe
  C:\Windows\System\uVrBPKy.exe
  2⤵
  PID:3320
- C:\Windows\System\lsbyqqU.exe
  C:\Windows\System\lsbyqqU.exe
  2⤵
  PID:3336
- C:\Windows\System\oGGdGxN.exe
  C:\Windows\System\oGGdGxN.exe
  2⤵
  PID:3356
- C:\Windows\System\dlfHYKy.exe
  C:\Windows\System\dlfHYKy.exe
  2⤵
  PID:3372
- C:\Windows\System\CekMecj.exe
  C:\Windows\System\CekMecj.exe
  2⤵
  PID:3388
- C:\Windows\System\wDLvotG.exe
  C:\Windows\System\wDLvotG.exe
  2⤵
  PID:3404
- C:\Windows\System\iaWmqaL.exe
  C:\Windows\System\iaWmqaL.exe
  2⤵
  PID:3420
- C:\Windows\System\XbpfTYS.exe
  C:\Windows\System\XbpfTYS.exe
  2⤵
  PID:3436
- C:\Windows\System\oSWobMu.exe
  C:\Windows\System\oSWobMu.exe
  2⤵
  PID:3452
- C:\Windows\System\eVSSghD.exe
  C:\Windows\System\eVSSghD.exe
  2⤵
  PID:3468
- C:\Windows\System\rBfCCFi.exe
  C:\Windows\System\rBfCCFi.exe
  2⤵
  PID:3484
- C:\Windows\System\NSRoylL.exe
  C:\Windows\System\NSRoylL.exe
  2⤵
  PID:3500
- C:\Windows\System\deaoqXd.exe
  C:\Windows\System\deaoqXd.exe
  2⤵
  PID:3516
- C:\Windows\System\QpUfUkU.exe
  C:\Windows\System\QpUfUkU.exe
  2⤵
  PID:3532
- C:\Windows\System\BzOWBaE.exe
  C:\Windows\System\BzOWBaE.exe
  2⤵
  PID:3548
- C:\Windows\System\BNJqUms.exe
  C:\Windows\System\BNJqUms.exe
  2⤵
  PID:3564
- C:\Windows\System\bUFbSBc.exe
  C:\Windows\System\bUFbSBc.exe
  2⤵
  PID:3580
- C:\Windows\System\xFdbSui.exe
  C:\Windows\System\xFdbSui.exe
  2⤵
  PID:3596
- C:\Windows\System\tQsuJgb.exe
  C:\Windows\System\tQsuJgb.exe
  2⤵
  PID:3612
- C:\Windows\System\oCHxDLe.exe
  C:\Windows\System\oCHxDLe.exe
  2⤵
  PID:3628
- C:\Windows\System\hMATJos.exe
  C:\Windows\System\hMATJos.exe
  2⤵
  PID:3644
- C:\Windows\System\TOdgvef.exe
  C:\Windows\System\TOdgvef.exe
  2⤵
  PID:3660
- C:\Windows\System\odNMtCY.exe
  C:\Windows\System\odNMtCY.exe
  2⤵
  PID:3676
- C:\Windows\System\JAuGRgj.exe
  C:\Windows\System\JAuGRgj.exe
  2⤵
  PID:3748
- C:\Windows\System\fOSyIRV.exe
  C:\Windows\System\fOSyIRV.exe
  2⤵
  PID:3764
- C:\Windows\System\LCkLRBQ.exe
  C:\Windows\System\LCkLRBQ.exe
  2⤵
  PID:3780
- C:\Windows\System\ItEBjgW.exe
  C:\Windows\System\ItEBjgW.exe
  2⤵
  PID:3796
- C:\Windows\System\IpEGSwi.exe
  C:\Windows\System\IpEGSwi.exe
  2⤵
  PID:3812
- C:\Windows\System\OPCjYpQ.exe
  C:\Windows\System\OPCjYpQ.exe
  2⤵
  PID:3828
- C:\Windows\System\LbaaDlp.exe
  C:\Windows\System\LbaaDlp.exe
  2⤵
  PID:3844
- C:\Windows\System\xEwdYUu.exe
  C:\Windows\System\xEwdYUu.exe
  2⤵
  PID:3860
- C:\Windows\System\rPpzQex.exe
  C:\Windows\System\rPpzQex.exe
  2⤵
  PID:3876
- C:\Windows\System\jePDMEL.exe
  C:\Windows\System\jePDMEL.exe
  2⤵
  PID:3896
- C:\Windows\System\HpciGRG.exe
  C:\Windows\System\HpciGRG.exe
  2⤵
  PID:3912
- C:\Windows\System\sxBXrEE.exe
  C:\Windows\System\sxBXrEE.exe
  2⤵
  PID:3928
- C:\Windows\System\PXvqXIh.exe
  C:\Windows\System\PXvqXIh.exe
  2⤵
  PID:3944
- C:\Windows\System\vDATjwR.exe
  C:\Windows\System\vDATjwR.exe
  2⤵
  PID:3960
- C:\Windows\System\UMCjLTU.exe
  C:\Windows\System\UMCjLTU.exe
  2⤵
  PID:3976
- C:\Windows\System\SMKPNdq.exe
  C:\Windows\System\SMKPNdq.exe
  2⤵
  PID:3992
- C:\Windows\System\kMJREVd.exe
  C:\Windows\System\kMJREVd.exe
  2⤵
  PID:4008
- C:\Windows\System\rZcNrtW.exe
  C:\Windows\System\rZcNrtW.exe
  2⤵
  PID:4024
- C:\Windows\System\ZKgLYEz.exe
  C:\Windows\System\ZKgLYEz.exe
  2⤵
  PID:4040
- C:\Windows\System\IIVKGuy.exe
  C:\Windows\System\IIVKGuy.exe
  2⤵
  PID:4056
- C:\Windows\System\axxRvvu.exe
  C:\Windows\System\axxRvvu.exe
  2⤵
  PID:4072
- C:\Windows\System\ZjKyVnz.exe
  C:\Windows\System\ZjKyVnz.exe
  2⤵
  PID:4088
- C:\Windows\System\zoaTHnv.exe
  C:\Windows\System\zoaTHnv.exe
  2⤵
  PID:2752
- C:\Windows\System\hVwrqGd.exe
  C:\Windows\System\hVwrqGd.exe
  2⤵
  PID:1992
- C:\Windows\System\gClwuHE.exe
  C:\Windows\System\gClwuHE.exe
  2⤵
  PID:1644
- C:\Windows\System\GgaGtry.exe
  C:\Windows\System\GgaGtry.exe
  2⤵
  PID:3100
- C:\Windows\System\aDhgwjO.exe
  C:\Windows\System\aDhgwjO.exe
  2⤵
  PID:3116
- C:\Windows\System\pOwRSEn.exe
  C:\Windows\System\pOwRSEn.exe
  2⤵
  PID:3164
- C:\Windows\System\hbesjzF.exe
  C:\Windows\System\hbesjzF.exe
  2⤵
  PID:3196
- C:\Windows\System\trPATfr.exe
  C:\Windows\System\trPATfr.exe
  2⤵
  PID:3232
- C:\Windows\System\MgYoWoG.exe
  C:\Windows\System\MgYoWoG.exe
  2⤵
  PID:3264
- C:\Windows\System\lWPtavB.exe
  C:\Windows\System\lWPtavB.exe
  2⤵
  PID:3296
- C:\Windows\System\dXehNOK.exe
  C:\Windows\System\dXehNOK.exe
  2⤵
  PID:3308
- C:\Windows\System\wurcHGx.exe
  C:\Windows\System\wurcHGx.exe
  2⤵
  PID:3384
- C:\Windows\System\PfvgtWy.exe
  C:\Windows\System\PfvgtWy.exe
  2⤵
  PID:396
- C:\Windows\System\yVJJYsP.exe
  C:\Windows\System\yVJJYsP.exe
  2⤵
  PID:3524
- C:\Windows\System\rDzdExO.exe
  C:\Windows\System\rDzdExO.exe
  2⤵
  PID:3540
- C:\Windows\System\bQxpEfe.exe
  C:\Windows\System\bQxpEfe.exe
  2⤵
  PID:3572
- C:\Windows\System\BMgsiSd.exe
  C:\Windows\System\BMgsiSd.exe
  2⤵
  PID:3608
- C:\Windows\System\XhTzzjV.exe
  C:\Windows\System\XhTzzjV.exe
  2⤵
  PID:3668
- C:\Windows\System\oXyKDXx.exe
  C:\Windows\System\oXyKDXx.exe
  2⤵
  PID:3788
- C:\Windows\System\XHVpntm.exe
  C:\Windows\System\XHVpntm.exe
  2⤵
  PID:3852
- C:\Windows\System\yegKcfl.exe
  C:\Windows\System\yegKcfl.exe
  2⤵
  PID:3892
- C:\Windows\System\qTFVxBW.exe
  C:\Windows\System\qTFVxBW.exe
  2⤵
  PID:3952
- C:\Windows\System\rluqcvd.exe
  C:\Windows\System\rluqcvd.exe
  2⤵
  PID:4016
- C:\Windows\System\UvWxtaX.exe
  C:\Windows\System\UvWxtaX.exe
  2⤵
  PID:4080
- C:\Windows\System\ouByOEz.exe
  C:\Windows\System\ouByOEz.exe
  2⤵
  PID:2656
- C:\Windows\System\oKGhvmj.exe
  C:\Windows\System\oKGhvmj.exe
  2⤵
  PID:3184
- C:\Windows\System\QSoScId.exe
  C:\Windows\System\QSoScId.exe
  2⤵
  PID:3216
- C:\Windows\System\zNKpbWd.exe
  C:\Windows\System\zNKpbWd.exe
  2⤵
  PID:3348
- C:\Windows\System\oWAUOuL.exe
  C:\Windows\System\oWAUOuL.exe
  2⤵
  PID:3380
- C:\Windows\System\tOAnxna.exe
  C:\Windows\System\tOAnxna.exe
  2⤵
  PID:4108
- C:\Windows\System\FicTzFn.exe
  C:\Windows\System\FicTzFn.exe
  2⤵
  PID:4124
- C:\Windows\System\jdzrVqZ.exe
  C:\Windows\System\jdzrVqZ.exe
  2⤵
  PID:4140
- C:\Windows\System\wTGFwIz.exe
  C:\Windows\System\wTGFwIz.exe
  2⤵
  PID:4156
- C:\Windows\System\eDQOMYS.exe
  C:\Windows\System\eDQOMYS.exe
  2⤵
  PID:4228
- C:\Windows\System\MZIoLyL.exe
  C:\Windows\System\MZIoLyL.exe
  2⤵
  PID:4244
- C:\Windows\System\CFTTGLe.exe
  C:\Windows\System\CFTTGLe.exe
  2⤵
  PID:4260
- C:\Windows\System\dpvzepA.exe
  C:\Windows\System\dpvzepA.exe
  2⤵
  PID:4276
- C:\Windows\System\dBxnmAM.exe
  C:\Windows\System\dBxnmAM.exe
  2⤵
  PID:4292
- C:\Windows\System\jaRiTJD.exe
  C:\Windows\System\jaRiTJD.exe
  2⤵
  PID:4308
- C:\Windows\System\RqyDwzv.exe
  C:\Windows\System\RqyDwzv.exe
  2⤵
  PID:4324
- C:\Windows\System\ndRNvPR.exe
  C:\Windows\System\ndRNvPR.exe
  2⤵
  PID:4340
- C:\Windows\System\hiKJCkv.exe
  C:\Windows\System\hiKJCkv.exe
  2⤵
  PID:4356
- C:\Windows\System\WQhwGWn.exe
  C:\Windows\System\WQhwGWn.exe
  2⤵
  PID:4384
- C:\Windows\System\KrpfMta.exe
  C:\Windows\System\KrpfMta.exe
  2⤵
  PID:4400
- C:\Windows\System\UMKXZIP.exe
  C:\Windows\System\UMKXZIP.exe
  2⤵
  PID:4424
- C:\Windows\System\BfGkQaa.exe
  C:\Windows\System\BfGkQaa.exe
  2⤵
  PID:4440
- C:\Windows\System\lGUnbpJ.exe
  C:\Windows\System\lGUnbpJ.exe
  2⤵
  PID:4456
- C:\Windows\System\JbfEuYy.exe
  C:\Windows\System\JbfEuYy.exe
  2⤵
  PID:4472
- C:\Windows\System\NIaxBaL.exe
  C:\Windows\System\NIaxBaL.exe
  2⤵
  PID:4488
- C:\Windows\System\ptMRlld.exe
  C:\Windows\System\ptMRlld.exe
  2⤵
  PID:4508
- C:\Windows\System\kWwZzlD.exe
  C:\Windows\System\kWwZzlD.exe
  2⤵
  PID:4524
- C:\Windows\System\awjJTjq.exe
  C:\Windows\System\awjJTjq.exe
  2⤵
  PID:4556
- C:\Windows\System\FeKblkG.exe
  C:\Windows\System\FeKblkG.exe
  2⤵
  PID:4572
- C:\Windows\System\lYRPvCX.exe
  C:\Windows\System\lYRPvCX.exe
  2⤵
  PID:4588
- C:\Windows\System\eWbrpBG.exe
  C:\Windows\System\eWbrpBG.exe
  2⤵
  PID:4604
- C:\Windows\System\DFlsBLE.exe
  C:\Windows\System\DFlsBLE.exe
  2⤵
  PID:4628
- C:\Windows\System\KyCYkns.exe
  C:\Windows\System\KyCYkns.exe
  2⤵
  PID:4644
- C:\Windows\System\zoVkJDi.exe
  C:\Windows\System\zoVkJDi.exe
  2⤵
  PID:4660
- C:\Windows\System\wsFUjEJ.exe
  C:\Windows\System\wsFUjEJ.exe
  2⤵
  PID:4680
- C:\Windows\System\hBQmUlL.exe
  C:\Windows\System\hBQmUlL.exe
  2⤵
  PID:4696
- C:\Windows\System\zHtEPab.exe
  C:\Windows\System\zHtEPab.exe
  2⤵
  PID:4712
- C:\Windows\System\UZQEUoR.exe
  C:\Windows\System\UZQEUoR.exe
  2⤵
  PID:4732
- C:\Windows\System\gyYyPEj.exe
  C:\Windows\System\gyYyPEj.exe
  2⤵
  PID:4748
- C:\Windows\System\gdEeRGp.exe
  C:\Windows\System\gdEeRGp.exe
  2⤵
  PID:4764
- C:\Windows\System\aboVoST.exe
  C:\Windows\System\aboVoST.exe
  2⤵
  PID:4780
- C:\Windows\System\uyMEaPm.exe
  C:\Windows\System\uyMEaPm.exe
  2⤵
  PID:4796
- C:\Windows\System\lSCDwHz.exe
  C:\Windows\System\lSCDwHz.exe
  2⤵
  PID:4812
- C:\Windows\System\fgyUDKQ.exe
  C:\Windows\System\fgyUDKQ.exe
  2⤵
  PID:4828
- C:\Windows\System\ztQZRhC.exe
  C:\Windows\System\ztQZRhC.exe
  2⤵
  PID:4844
- C:\Windows\System\dNUyUSN.exe
  C:\Windows\System\dNUyUSN.exe
  2⤵
  PID:4868
- C:\Windows\System\kKiqYVY.exe
  C:\Windows\System\kKiqYVY.exe
  2⤵
  PID:4908
- C:\Windows\System\TKUzuwp.exe
  C:\Windows\System\TKUzuwp.exe
  2⤵
  PID:4924
- C:\Windows\System\OLqzVZH.exe
  C:\Windows\System\OLqzVZH.exe
  2⤵
  PID:4940
- C:\Windows\System\UACdIDQ.exe
  C:\Windows\System\UACdIDQ.exe
  2⤵
  PID:4956
- C:\Windows\System\SUErDCb.exe
  C:\Windows\System\SUErDCb.exe
  2⤵
  PID:4980
- C:\Windows\System\zYOADEY.exe
  C:\Windows\System\zYOADEY.exe
  2⤵
  PID:4996
- C:\Windows\System\vFgnwaS.exe
  C:\Windows\System\vFgnwaS.exe
  2⤵
  PID:5012
- C:\Windows\System\BfChLDX.exe
  C:\Windows\System\BfChLDX.exe
  2⤵
  PID:5028
- C:\Windows\System\bEeEZQl.exe
  C:\Windows\System\bEeEZQl.exe
  2⤵
  PID:5048
- C:\Windows\System\EmvbkBq.exe
  C:\Windows\System\EmvbkBq.exe
  2⤵
  PID:5064
- C:\Windows\System\UrjbQAE.exe
  C:\Windows\System\UrjbQAE.exe
  2⤵
  PID:5092
- C:\Windows\System\TlfHBmu.exe
  C:\Windows\System\TlfHBmu.exe
  2⤵
  PID:5108
- C:\Windows\System\XJaxdXJ.exe
  C:\Windows\System\XJaxdXJ.exe
  2⤵
  PID:3756
- C:\Windows\System\MQLJMpp.exe
  C:\Windows\System\MQLJMpp.exe
  2⤵
  PID:3656
- C:\Windows\System\AVqBdOf.exe
  C:\Windows\System\AVqBdOf.exe
  2⤵
  PID:3696
- C:\Windows\System\nAZFuJW.exe
  C:\Windows\System\nAZFuJW.exe
  2⤵
  PID:3712
- C:\Windows\System\lGzcUDg.exe
  C:\Windows\System\lGzcUDg.exe
  2⤵
  PID:3732
- C:\Windows\System\CRCdrrC.exe
  C:\Windows\System\CRCdrrC.exe
  2⤵
  PID:3772
- C:\Windows\System\AEbRFoS.exe
  C:\Windows\System\AEbRFoS.exe
  2⤵
  PID:3836
- C:\Windows\System\LLMRbZf.exe
  C:\Windows\System\LLMRbZf.exe
  2⤵
  PID:3904
- C:\Windows\System\APbhXBW.exe
  C:\Windows\System\APbhXBW.exe
  2⤵
  PID:3968
- C:\Windows\System\tTGaFAH.exe
  C:\Windows\System\tTGaFAH.exe
  2⤵
  PID:4036
- C:\Windows\System\FLzboSL.exe
  C:\Windows\System\FLzboSL.exe
  2⤵
  PID:2760
- C:\Windows\System\NmVbNtU.exe
  C:\Windows\System\NmVbNtU.exe
  2⤵
  PID:3132
- C:\Windows\System\ZKKvvzE.exe
  C:\Windows\System\ZKKvvzE.exe
  2⤵
  PID:3260
- C:\Windows\System\vuGkHLt.exe
  C:\Windows\System\vuGkHLt.exe
  2⤵
  PID:3416
- C:\Windows\System\zzoDiRs.exe
  C:\Windows\System\zzoDiRs.exe
  2⤵
  PID:3576
- C:\Windows\System\RfcJuUi.exe
  C:\Windows\System\RfcJuUi.exe
  2⤵
  PID:3984
- C:\Windows\System\KoLZHTQ.exe
  C:\Windows\System\KoLZHTQ.exe
  2⤵
  PID:3212
- C:\Windows\System\tZhHgib.exe
  C:\Windows\System\tZhHgib.exe
  2⤵
  PID:4120
- C:\Windows\System\njWdUPO.exe
  C:\Windows\System\njWdUPO.exe
  2⤵
  PID:4240
- C:\Windows\System\ZdlwsJb.exe
  C:\Windows\System\ZdlwsJb.exe
  2⤵
  PID:4304
- C:\Windows\System\sXypCyQ.exe
  C:\Windows\System\sXypCyQ.exe
  2⤵
  PID:4368
- C:\Windows\System\fByxPqF.exe
  C:\Windows\System\fByxPqF.exe
  2⤵
  PID:4380
- C:\Windows\System\XopRcIU.exe
  C:\Windows\System\XopRcIU.exe
  2⤵
  PID:3460
- C:\Windows\System\mgoAbYa.exe
  C:\Windows\System\mgoAbYa.exe
  2⤵
  PID:3492
- C:\Windows\System\PzrtYKt.exe
  C:\Windows\System\PzrtYKt.exe
  2⤵
  PID:3560
- C:\Windows\System\EKlfAVN.exe
  C:\Windows\System\EKlfAVN.exe
  2⤵
  PID:4172
- C:\Windows\System\jzOFLtW.exe
  C:\Windows\System\jzOFLtW.exe
  2⤵
  PID:4188
- C:\Windows\System\WAZCqaZ.exe
  C:\Windows\System\WAZCqaZ.exe
  2⤵
  PID:4204
- C:\Windows\System\gwSJUxt.exe
  C:\Windows\System\gwSJUxt.exe
  2⤵
  PID:4220
- C:\Windows\System\KEqCEOM.exe
  C:\Windows\System\KEqCEOM.exe
  2⤵
  PID:4288
- C:\Windows\System\fMBswPY.exe
  C:\Windows\System\fMBswPY.exe
  2⤵
  PID:4392
- C:\Windows\System\aEhWYQM.exe
  C:\Windows\System\aEhWYQM.exe
  2⤵
  PID:4580
- C:\Windows\System\UoyOcFT.exe
  C:\Windows\System\UoyOcFT.exe
  2⤵
  PID:4420
- C:\Windows\System\RsQPOfT.exe
  C:\Windows\System\RsQPOfT.exe
  2⤵
  PID:4484
- C:\Windows\System\DXFKXLm.exe
  C:\Windows\System\DXFKXLm.exe
  2⤵
  PID:4568
- C:\Windows\System\OihzxYL.exe
  C:\Windows\System\OihzxYL.exe
  2⤵
  PID:4640
- C:\Windows\System\NlWVJxP.exe
  C:\Windows\System\NlWVJxP.exe
  2⤵
  PID:4652
- C:\Windows\System\hTYarZE.exe
  C:\Windows\System\hTYarZE.exe
  2⤵
  PID:4692
- C:\Windows\System\nHvghve.exe
  C:\Windows\System\nHvghve.exe
  2⤵
  PID:4676
- C:\Windows\System\Vprbgbi.exe
  C:\Windows\System\Vprbgbi.exe
  2⤵
  PID:4760
- C:\Windows\System\IfUnCLn.exe
  C:\Windows\System\IfUnCLn.exe
  2⤵
  PID:4824
- C:\Windows\System\SzxrWGS.exe
  C:\Windows\System\SzxrWGS.exe
  2⤵
  PID:4772
- C:\Windows\System\VBbWkzf.exe
  C:\Windows\System\VBbWkzf.exe
  2⤵
  PID:4836
- C:\Windows\System\CwDmfWL.exe
  C:\Windows\System\CwDmfWL.exe
  2⤵
  PID:4864
- C:\Windows\System\TvhRibT.exe
  C:\Windows\System\TvhRibT.exe
  2⤵
  PID:4948
- C:\Windows\System\YIwIhmo.exe
  C:\Windows\System\YIwIhmo.exe
  2⤵
  PID:4892
- C:\Windows\System\NIzbSVB.exe
  C:\Windows\System\NIzbSVB.exe
  2⤵
  PID:4932
- C:\Windows\System\plNXGbY.exe
  C:\Windows\System\plNXGbY.exe
  2⤵
  PID:4972
- C:\Windows\System\xQaivUP.exe
  C:\Windows\System\xQaivUP.exe
  2⤵
  PID:5036
- C:\Windows\System\fzrZfAg.exe
  C:\Windows\System\fzrZfAg.exe
  2⤵
  PID:5024
- C:\Windows\System\BRNHJfy.exe
  C:\Windows\System\BRNHJfy.exe
  2⤵
  PID:5076
- C:\Windows\System\cqJfqNl.exe
  C:\Windows\System\cqJfqNl.exe
  2⤵
  PID:5116
- C:\Windows\System\RxQysBT.exe
  C:\Windows\System\RxQysBT.exe
  2⤵
  PID:3720
- C:\Windows\System\bhYIMUL.exe
  C:\Windows\System\bhYIMUL.exe
  2⤵
  PID:3808
- C:\Windows\System\rFxNxri.exe
  C:\Windows\System\rFxNxri.exe
  2⤵
  PID:3180
- C:\Windows\System\EusKQwb.exe
  C:\Windows\System\EusKQwb.exe
  2⤵
  PID:3592
- C:\Windows\System\yNHIiwK.exe
  C:\Windows\System\yNHIiwK.exe
  2⤵
  PID:4236
- C:\Windows\System\hYCkEDE.exe
  C:\Windows\System\hYCkEDE.exe
  2⤵
  PID:3400
- C:\Windows\System\wYXomJp.exe
  C:\Windows\System\wYXomJp.exe
  2⤵
  PID:4004
- C:\Windows\System\krzRArY.exe
  C:\Windows\System\krzRArY.exe
  2⤵
  PID:3496
- C:\Windows\System\MCIxNpx.exe
  C:\Windows\System\MCIxNpx.exe
  2⤵
  PID:3888
- C:\Windows\System\dRbeTPm.exe
  C:\Windows\System\dRbeTPm.exe
  2⤵
  PID:4300
- C:\Windows\System\dAXGboG.exe
  C:\Windows\System\dAXGboG.exe
  2⤵
  PID:3476
- C:\Windows\System\lBeCLZw.exe
  C:\Windows\System\lBeCLZw.exe
  2⤵
  PID:4212
- C:\Windows\System\gWnEoDE.exe
  C:\Windows\System\gWnEoDE.exe
  2⤵
  PID:3088
- C:\Windows\System\ozdFixZ.exe
  C:\Windows\System\ozdFixZ.exe
  2⤵
  PID:4408
- C:\Windows\System\DtDdIwa.exe
  C:\Windows\System\DtDdIwa.exe
  2⤵
  PID:4520
- C:\Windows\System\HDktciT.exe
  C:\Windows\System\HDktciT.exe
  2⤵
  PID:4624
- C:\Windows\System\eTbjCuj.exe
  C:\Windows\System\eTbjCuj.exe
  2⤵
  PID:4792
- C:\Windows\System\jfDGRGR.exe
  C:\Windows\System\jfDGRGR.exe
  2⤵
  PID:4916
- C:\Windows\System\bAtzdJI.exe
  C:\Windows\System\bAtzdJI.exe
  2⤵
  PID:4904
- C:\Windows\System\UYoziqv.exe
  C:\Windows\System\UYoziqv.exe
  2⤵
  PID:1812
- C:\Windows\System\fXbfnGI.exe
  C:\Windows\System\fXbfnGI.exe
  2⤵
  PID:3692
- C:\Windows\System\NqHPrjn.exe
  C:\Windows\System\NqHPrjn.exe
  2⤵
  PID:4152
- C:\Windows\System\OhdctoD.exe
  C:\Windows\System\OhdctoD.exe
  2⤵
  PID:2748
- C:\Windows\System\llNHyoV.exe
  C:\Windows\System\llNHyoV.exe
  2⤵
  PID:1632
- C:\Windows\System\ynSkOsZ.exe
  C:\Windows\System\ynSkOsZ.exe
  2⤵
  PID:4316
- C:\Windows\System\HPPnHDd.exe
  C:\Windows\System\HPPnHDd.exe
  2⤵
  PID:5044
- C:\Windows\System\KmjZdqH.exe
  C:\Windows\System\KmjZdqH.exe
  2⤵
  PID:4688
- C:\Windows\System\QQeknHN.exe
  C:\Windows\System\QQeknHN.exe
  2⤵
  PID:4880
- C:\Windows\System\wdteRIX.exe
  C:\Windows\System\wdteRIX.exe
  2⤵
  PID:4988
- C:\Windows\System\mnLeSdm.exe
  C:\Windows\System\mnLeSdm.exe
  2⤵
  PID:5084
- C:\Windows\System\ZwBUCsk.exe
  C:\Windows\System\ZwBUCsk.exe
  2⤵
  PID:4708
- C:\Windows\System\bQmcTuI.exe
  C:\Windows\System\bQmcTuI.exe
  2⤵
  PID:4856
- C:\Windows\System\dMFFMtR.exe
  C:\Windows\System\dMFFMtR.exe
  2⤵
  PID:3528
- C:\Windows\System\lQJohCv.exe
  C:\Windows\System\lQJohCv.exe
  2⤵
  PID:4052
- C:\Windows\System\GxuSHaf.exe
  C:\Windows\System\GxuSHaf.exe
  2⤵
  PID:2980
- C:\Windows\System\JCJIOzd.exe
  C:\Windows\System\JCJIOzd.exe
  2⤵
  PID:4436
- C:\Windows\System\fhaTDtS.exe
  C:\Windows\System\fhaTDtS.exe
  2⤵
  PID:4672
- C:\Windows\System\uTsGOev.exe
  C:\Windows\System\uTsGOev.exe
  2⤵
  PID:4884
- C:\Windows\System\qaAIJZy.exe
  C:\Windows\System\qaAIJZy.exe
  2⤵
  PID:2264
- C:\Windows\System\yDMHCyu.exe
  C:\Windows\System\yDMHCyu.exe
  2⤵
  PID:4464
- C:\Windows\System\cqzhQwB.exe
  C:\Windows\System\cqzhQwB.exe
  2⤵
  PID:4968
- C:\Windows\System\MNbmEvq.exe
  C:\Windows\System\MNbmEvq.exe
  2⤵
  PID:3804
- C:\Windows\System\AHxHUcO.exe
  C:\Windows\System\AHxHUcO.exe
  2⤵
  PID:2908
- C:\Windows\System\dvRhXeA.exe
  C:\Windows\System\dvRhXeA.exe
  2⤵
  PID:4540
- C:\Windows\System\zcpiBSN.exe
  C:\Windows\System\zcpiBSN.exe
  2⤵
  PID:4480
- C:\Windows\System\arMoTrn.exe
  C:\Windows\System\arMoTrn.exe
  2⤵
  PID:2348
- C:\Windows\System\blHDlQC.exe
  C:\Windows\System\blHDlQC.exe
  2⤵
  PID:3872
- C:\Windows\System\tGAaHMm.exe
  C:\Windows\System\tGAaHMm.exe
  2⤵
  PID:3652
- C:\Windows\System\yBCthfY.exe
  C:\Windows\System\yBCthfY.exe
  2⤵
  PID:4548
- C:\Windows\System\IVVuEVP.exe
  C:\Windows\System\IVVuEVP.exe
  2⤵
  PID:4252
- C:\Windows\System\YnfBwYP.exe
  C:\Windows\System\YnfBwYP.exe
  2⤵
  PID:4348
- C:\Windows\System\gPuwnSG.exe
  C:\Windows\System\gPuwnSG.exe
  2⤵
  PID:4272
- C:\Windows\System\SkIxXjn.exe
  C:\Windows\System\SkIxXjn.exe
  2⤵
  PID:4184
- C:\Windows\System\fcJzNzn.exe
  C:\Windows\System\fcJzNzn.exe
  2⤵
  PID:4500
- C:\Windows\System\RfohxPo.exe
  C:\Windows\System\RfohxPo.exe
  2⤵
  PID:4620
- C:\Windows\System\gmxMHtm.exe
  C:\Windows\System\gmxMHtm.exe
  2⤵
  PID:5004
- C:\Windows\System\bIgVRVI.exe
  C:\Windows\System\bIgVRVI.exe
  2⤵
  PID:4612
- C:\Windows\System\xvzsjKi.exe
  C:\Windows\System\xvzsjKi.exe
  2⤵
  PID:1852
- C:\Windows\System\yJhERBt.exe
  C:\Windows\System\yJhERBt.exe
  2⤵
  PID:3728
- C:\Windows\System\FgkohCZ.exe
  C:\Windows\System\FgkohCZ.exe
  2⤵
  PID:5124
- C:\Windows\System\AhvouOJ.exe
  C:\Windows\System\AhvouOJ.exe
  2⤵
  PID:5140
- C:\Windows\System\WAXaYsO.exe
  C:\Windows\System\WAXaYsO.exe
  2⤵
  PID:5156
- C:\Windows\System\wFAXguO.exe
  C:\Windows\System\wFAXguO.exe
  2⤵
  PID:5172
- C:\Windows\System\SKVXiQE.exe
  C:\Windows\System\SKVXiQE.exe
  2⤵
  PID:5188
- C:\Windows\System\jJYrEgP.exe
  C:\Windows\System\jJYrEgP.exe
  2⤵
  PID:5204
- C:\Windows\System\YUdGqay.exe
  C:\Windows\System\YUdGqay.exe
  2⤵
  PID:5220
- C:\Windows\System\DpHTuZL.exe
  C:\Windows\System\DpHTuZL.exe
  2⤵
  PID:5236
- C:\Windows\System\hxIRHZS.exe
  C:\Windows\System\hxIRHZS.exe
  2⤵
  PID:5252
- C:\Windows\System\uItFtyw.exe
  C:\Windows\System\uItFtyw.exe
  2⤵
  PID:5268
- C:\Windows\System\zPtPqCy.exe
  C:\Windows\System\zPtPqCy.exe
  2⤵
  PID:5284
- C:\Windows\System\uYEqMCw.exe
  C:\Windows\System\uYEqMCw.exe
  2⤵
  PID:5300
- C:\Windows\System\RBYZTLc.exe
  C:\Windows\System\RBYZTLc.exe
  2⤵
  PID:5316
- C:\Windows\System\fdfkwpV.exe
  C:\Windows\System\fdfkwpV.exe
  2⤵
  PID:5332
- C:\Windows\System\vYRLdrH.exe
  C:\Windows\System\vYRLdrH.exe
  2⤵
  PID:5348
- C:\Windows\System\BsbMMkV.exe
  C:\Windows\System\BsbMMkV.exe
  2⤵
  PID:5368
- C:\Windows\System\wXjOzKl.exe
  C:\Windows\System\wXjOzKl.exe
  2⤵
  PID:5384
- C:\Windows\System\xugKUwp.exe
  C:\Windows\System\xugKUwp.exe
  2⤵
  PID:5400
- C:\Windows\System\zVEktZI.exe
  C:\Windows\System\zVEktZI.exe
  2⤵
  PID:5464
- C:\Windows\System\YFdmbUo.exe
  C:\Windows\System\YFdmbUo.exe
  2⤵
  PID:5480
- C:\Windows\System\dYoEDwn.exe
  C:\Windows\System\dYoEDwn.exe
  2⤵
  PID:5496
- C:\Windows\System\XlwEfjO.exe
  C:\Windows\System\XlwEfjO.exe
  2⤵
  PID:5512
- C:\Windows\System\kefBRfB.exe
  C:\Windows\System\kefBRfB.exe
  2⤵
  PID:5528
- C:\Windows\System\BPEFfmk.exe
  C:\Windows\System\BPEFfmk.exe
  2⤵
  PID:5588
- C:\Windows\System\Bujaoyf.exe
  C:\Windows\System\Bujaoyf.exe
  2⤵
  PID:5616
- C:\Windows\System\NmzRcNS.exe
  C:\Windows\System\NmzRcNS.exe
  2⤵
  PID:5636
- C:\Windows\System\VForvml.exe
  C:\Windows\System\VForvml.exe
  2⤵
  PID:5656
- C:\Windows\System\EMguixs.exe
  C:\Windows\System\EMguixs.exe
  2⤵
  PID:5704
- C:\Windows\System\tSvakHD.exe
  C:\Windows\System\tSvakHD.exe
  2⤵
  PID:5728
- C:\Windows\System\tBonMLa.exe
  C:\Windows\System\tBonMLa.exe
  2⤵
  PID:5760
- C:\Windows\System\FZfDDiy.exe
  C:\Windows\System\FZfDDiy.exe
  2⤵
  PID:5940
- C:\Windows\System\HMmqEgc.exe
  C:\Windows\System\HMmqEgc.exe
  2⤵
  PID:5996
- C:\Windows\System\sZaeXtU.exe
  C:\Windows\System\sZaeXtU.exe
  2⤵
  PID:6068
- C:\Windows\System\IqgOPWx.exe
  C:\Windows\System\IqgOPWx.exe
  2⤵
  PID:6136
- C:\Windows\System\HrmNGpX.exe
  C:\Windows\System\HrmNGpX.exe
  2⤵
  PID:5164
- C:\Windows\System\FXdRnnX.exe
  C:\Windows\System\FXdRnnX.exe
  2⤵
  PID:5200
- C:\Windows\System\VJvEfow.exe
  C:\Windows\System\VJvEfow.exe
  2⤵
  PID:5264
- C:\Windows\System\XiSDFrv.exe
  C:\Windows\System\XiSDFrv.exe
  2⤵
  PID:5244
- C:\Windows\System\YMVZqiC.exe
  C:\Windows\System\YMVZqiC.exe
  2⤵
  PID:4636
- C:\Windows\System\UdeCTQL.exe
  C:\Windows\System\UdeCTQL.exe
  2⤵
  PID:3744
- C:\Windows\System\lKsylJI.exe
  C:\Windows\System\lKsylJI.exe
  2⤵
  PID:3292
- C:\Windows\System\WlVcgKw.exe
  C:\Windows\System\WlVcgKw.exe
  2⤵
  PID:4808
- C:\Windows\System\vosdZgq.exe
  C:\Windows\System\vosdZgq.exe
  2⤵
  PID:5248
- C:\Windows\System\nyAlqYR.exe
  C:\Windows\System\nyAlqYR.exe
  2⤵
  PID:5292
- C:\Windows\System\RprdKGg.exe
  C:\Windows\System\RprdKGg.exe
  2⤵
  PID:5328
- C:\Windows\System\hRFrypx.exe
  C:\Windows\System\hRFrypx.exe
  2⤵
  PID:5396
- C:\Windows\System\DjxQoWM.exe
  C:\Windows\System\DjxQoWM.exe
  2⤵
  PID:5408
- C:\Windows\System\QYZhpOr.exe
  C:\Windows\System\QYZhpOr.exe
  2⤵
  PID:5420
- C:\Windows\System\gCfyJWj.exe
  C:\Windows\System\gCfyJWj.exe
  2⤵
  PID:5440
- C:\Windows\System\pvsnwLB.exe
  C:\Windows\System\pvsnwLB.exe
  2⤵
  PID:5456
- C:\Windows\System\ikpNVUw.exe
  C:\Windows\System\ikpNVUw.exe
  2⤵
  PID:5492
- C:\Windows\System\EUiJdgm.exe
  C:\Windows\System\EUiJdgm.exe
  2⤵
  PID:5536
- C:\Windows\System\MZkZrjP.exe
  C:\Windows\System\MZkZrjP.exe
  2⤵
  PID:5568
- C:\Windows\System\gFNHYgq.exe
  C:\Windows\System\gFNHYgq.exe
  2⤵
  PID:5584
- C:\Windows\System\XEMTMwz.exe
  C:\Windows\System\XEMTMwz.exe
  2⤵
  PID:5632
- C:\Windows\System\IBkMIeK.exe
  C:\Windows\System\IBkMIeK.exe
  2⤵
  PID:5876
- C:\Windows\System\gGHCAoe.exe
  C:\Windows\System\gGHCAoe.exe
  2⤵
  PID:5892
- C:\Windows\System\QoYPYXp.exe
  C:\Windows\System\QoYPYXp.exe
  2⤵
  PID:2108
- C:\Windows\System\KkmXlNG.exe
  C:\Windows\System\KkmXlNG.exe
  2⤵
  PID:5972
- C:\Windows\System\eaTrwZY.exe
  C:\Windows\System\eaTrwZY.exe
  2⤵
  PID:5992
- C:\Windows\System\IiBhHJv.exe
  C:\Windows\System\IiBhHJv.exe
  2⤵
  PID:6020
- C:\Windows\System\YupvOix.exe
  C:\Windows\System\YupvOix.exe
  2⤵
  PID:6044
- C:\Windows\System\DvzZYUY.exe
  C:\Windows\System\DvzZYUY.exe
  2⤵
  PID:6032
- C:\Windows\System\bsQhaND.exe
  C:\Windows\System\bsQhaND.exe
  2⤵
  PID:6076
- C:\Windows\System\WQhmOLa.exe
  C:\Windows\System\WQhmOLa.exe
  2⤵
  PID:6100
- C:\Windows\System\akpGEkG.exe
  C:\Windows\System\akpGEkG.exe
  2⤵
  PID:2212
- C:\Windows\System\EkAXawy.exe
  C:\Windows\System\EkAXawy.exe
  2⤵
  PID:5212
- C:\Windows\System\UCexydu.exe
  C:\Windows\System\UCexydu.exe
  2⤵
  PID:5280
- C:\Windows\System\oBObzgw.exe
  C:\Windows\System\oBObzgw.exe
  2⤵
  PID:3624
- C:\Windows\System\Slyqjlu.exe
  C:\Windows\System\Slyqjlu.exe
  2⤵
  PID:5344
- C:\Windows\System\mJAquGA.exe
  C:\Windows\System\mJAquGA.exe
  2⤵
  PID:5432
- C:\Windows\System\nAmNAPS.exe
  C:\Windows\System\nAmNAPS.exe
  2⤵
  PID:5148
- C:\Windows\System\DguWuwV.exe
  C:\Windows\System\DguWuwV.exe
  2⤵
  PID:5380
- C:\Windows\System\wlUaygT.exe
  C:\Windows\System\wlUaygT.exe
  2⤵
  PID:5540
- C:\Windows\System\DxlWeCn.exe
  C:\Windows\System\DxlWeCn.exe
  2⤵
  PID:5548
- C:\Windows\System\ZIXBcmg.exe
  C:\Windows\System\ZIXBcmg.exe
  2⤵
  PID:1588
- C:\Windows\System\ZqNEmAq.exe
  C:\Windows\System\ZqNEmAq.exe
  2⤵
  PID:5976
- C:\Windows\System\OwFtaXh.exe
  C:\Windows\System\OwFtaXh.exe
  2⤵
  PID:5884
- C:\Windows\System\TZNZCCr.exe
  C:\Windows\System\TZNZCCr.exe
  2⤵
  PID:5664
- C:\Windows\System\lHKiWcH.exe
  C:\Windows\System\lHKiWcH.exe
  2⤵
  PID:6012
- C:\Windows\System\lpmbHKm.exe
  C:\Windows\System\lpmbHKm.exe
  2⤵
  PID:6092
- C:\Windows\System\lEhIipY.exe
  C:\Windows\System\lEhIipY.exe
  2⤵
  PID:5680
- C:\Windows\System\RijnWHo.exe
  C:\Windows\System\RijnWHo.exe
  2⤵
  PID:5740
- C:\Windows\System\hmGhiLm.exe
  C:\Windows\System\hmGhiLm.exe
  2⤵
  PID:5768
- C:\Windows\System\QwAXvyl.exe
  C:\Windows\System\QwAXvyl.exe
  2⤵
  PID:5780
- C:\Windows\System\lQYywcu.exe
  C:\Windows\System\lQYywcu.exe
  2⤵
  PID:5808
- C:\Windows\System\adhRQDJ.exe
  C:\Windows\System\adhRQDJ.exe
  2⤵
  PID:5824
- C:\Windows\System\HFaPZId.exe
  C:\Windows\System\HFaPZId.exe
  2⤵
  PID:5860
- C:\Windows\System\wlfstpX.exe
  C:\Windows\System\wlfstpX.exe
  2⤵
  PID:5608
- C:\Windows\System\rLPbPHh.exe
  C:\Windows\System\rLPbPHh.exe
  2⤵
  PID:6108
- C:\Windows\System\FKdLkep.exe
  C:\Windows\System\FKdLkep.exe
  2⤵
  PID:4544
- C:\Windows\System\HPeOJVc.exe
  C:\Windows\System\HPeOJVc.exe
  2⤵
  PID:5724
- C:\Windows\System\bmYRIvH.exe
  C:\Windows\System\bmYRIvH.exe
  2⤵
  PID:5904
- C:\Windows\System\ZnZglVD.exe
  C:\Windows\System\ZnZglVD.exe
  2⤵
  PID:6040
- C:\Windows\System\XvYtqDq.exe
  C:\Windows\System\XvYtqDq.exe
  2⤵
  PID:4200
- C:\Windows\System\vYxzpPD.exe
  C:\Windows\System\vYxzpPD.exe
  2⤵
  PID:5828
- C:\Windows\System\mfFtOav.exe
  C:\Windows\System\mfFtOav.exe
  2⤵
  PID:2196
- C:\Windows\System\kooKPdd.exe
  C:\Windows\System\kooKPdd.exe
  2⤵
  PID:6132
- C:\Windows\System\nrdEKVy.exe
  C:\Windows\System\nrdEKVy.exe
  2⤵
  PID:5132
- C:\Windows\System\WKnHPMV.exe
  C:\Windows\System\WKnHPMV.exe
  2⤵
  PID:5196
- C:\Windows\System\epgQFal.exe
  C:\Windows\System\epgQFal.exe
  2⤵
  PID:5596
- C:\Windows\System\HpWHdkg.exe
  C:\Windows\System\HpWHdkg.exe
  2⤵
  PID:6088
- C:\Windows\System\NpoUyzB.exe
  C:\Windows\System\NpoUyzB.exe
  2⤵
  PID:5692
- C:\Windows\System\RfTpMjl.exe
  C:\Windows\System\RfTpMjl.exe
  2⤵
  PID:5816
- C:\Windows\System\WVRpbWH.exe
  C:\Windows\System\WVRpbWH.exe
  2⤵
  PID:5872
- C:\Windows\System\MkgZdiV.exe
  C:\Windows\System\MkgZdiV.exe
  2⤵
  PID:3884
- C:\Windows\System\TDEwRGA.exe
  C:\Windows\System\TDEwRGA.exe
  2⤵
  PID:5428
- C:\Windows\System\paSDmtp.exe
  C:\Windows\System\paSDmtp.exe
  2⤵
  PID:6052
- C:\Windows\System\TFSeQPp.exe
  C:\Windows\System\TFSeQPp.exe
  2⤵
  PID:4432
- C:\Windows\System\TxKykpV.exe
  C:\Windows\System\TxKykpV.exe
  2⤵
  PID:5392
- C:\Windows\System\DRvvPkr.exe
  C:\Windows\System\DRvvPkr.exe
  2⤵
  PID:5668
- C:\Windows\System\IkQvPVe.exe
  C:\Windows\System\IkQvPVe.exe
  2⤵
  PID:5756
- C:\Windows\System\tqzFvBC.exe
  C:\Windows\System\tqzFvBC.exe
  2⤵
  PID:5820
- C:\Windows\System\zYgqEYr.exe
  C:\Windows\System\zYgqEYr.exe
  2⤵
  PID:6156
- C:\Windows\System\qgpFMyc.exe
  C:\Windows\System\qgpFMyc.exe
  2⤵
  PID:6172
- C:\Windows\System\STMBpaX.exe
  C:\Windows\System\STMBpaX.exe
  2⤵
  PID:6192
- C:\Windows\System\FPgADYu.exe
  C:\Windows\System\FPgADYu.exe
  2⤵
  PID:6208
- C:\Windows\System\viGSmjT.exe
  C:\Windows\System\viGSmjT.exe
  2⤵
  PID:6224
- C:\Windows\System\sglmnCu.exe
  C:\Windows\System\sglmnCu.exe
  2⤵
  PID:6240
- C:\Windows\System\TmQElwr.exe
  C:\Windows\System\TmQElwr.exe
  2⤵
  PID:6256
- C:\Windows\System\FJnONoC.exe
  C:\Windows\System\FJnONoC.exe
  2⤵
  PID:6272
- C:\Windows\System\ZvsJfwp.exe
  C:\Windows\System\ZvsJfwp.exe
  2⤵
  PID:6288
- C:\Windows\System\lnXrubX.exe
  C:\Windows\System\lnXrubX.exe
  2⤵
  PID:6340
- C:\Windows\System\cePOXON.exe
  C:\Windows\System\cePOXON.exe
  2⤵
  PID:6360
- C:\Windows\System\kVkyBFn.exe
  C:\Windows\System\kVkyBFn.exe
  2⤵
  PID:6380
- C:\Windows\System\uRorXqb.exe
  C:\Windows\System\uRorXqb.exe
  2⤵
  PID:6396
- C:\Windows\System\aAqLtln.exe
  C:\Windows\System\aAqLtln.exe
  2⤵
  PID:6412
- C:\Windows\System\ztDSHqI.exe
  C:\Windows\System\ztDSHqI.exe
  2⤵
  PID:6432
- C:\Windows\System\wchyfmk.exe
  C:\Windows\System\wchyfmk.exe
  2⤵
  PID:6448
- C:\Windows\System\nuigGvJ.exe
  C:\Windows\System\nuigGvJ.exe
  2⤵
  PID:6464
- C:\Windows\System\GvokKps.exe
  C:\Windows\System\GvokKps.exe
  2⤵
  PID:6480
- C:\Windows\System\mfJEoev.exe
  C:\Windows\System\mfJEoev.exe
  2⤵
  PID:6500
- C:\Windows\System\wWfbZpn.exe
  C:\Windows\System\wWfbZpn.exe
  2⤵
  PID:6516
- C:\Windows\System\eSaPYRV.exe
  C:\Windows\System\eSaPYRV.exe
  2⤵
  PID:6532
- C:\Windows\System\FmqkiRP.exe
  C:\Windows\System\FmqkiRP.exe
  2⤵
  PID:6552
- C:\Windows\System\uBBWILQ.exe
  C:\Windows\System\uBBWILQ.exe
  2⤵
  PID:6568
- C:\Windows\System\TduETax.exe
  C:\Windows\System\TduETax.exe
  2⤵
  PID:6584
- C:\Windows\System\aNnrMsV.exe
  C:\Windows\System\aNnrMsV.exe
  2⤵
  PID:6600
- C:\Windows\System\ChFZnPa.exe
  C:\Windows\System\ChFZnPa.exe
  2⤵
  PID:6616
- C:\Windows\System\VwFbIRg.exe
  C:\Windows\System\VwFbIRg.exe
  2⤵
  PID:6632
- C:\Windows\System\FmHOKJO.exe
  C:\Windows\System\FmHOKJO.exe
  2⤵
  PID:6648
- C:\Windows\System\roRTQdV.exe
  C:\Windows\System\roRTQdV.exe
  2⤵
  PID:6664
- C:\Windows\System\PlvZSLE.exe
  C:\Windows\System\PlvZSLE.exe
  2⤵
  PID:6684
- C:\Windows\System\gcGQsKn.exe
  C:\Windows\System\gcGQsKn.exe
  2⤵
  PID:6700
- C:\Windows\System\KTjDhUw.exe
  C:\Windows\System\KTjDhUw.exe
  2⤵
  PID:6920
- C:\Windows\System\QVjOIIW.exe
  C:\Windows\System\QVjOIIW.exe
  2⤵
  PID:6936
- C:\Windows\System\SRBFntP.exe
  C:\Windows\System\SRBFntP.exe
  2⤵
  PID:6952
- C:\Windows\System\MbpGbBZ.exe
  C:\Windows\System\MbpGbBZ.exe
  2⤵
  PID:6968
- C:\Windows\System\hzEFoJN.exe
  C:\Windows\System\hzEFoJN.exe
  2⤵
  PID:6984
- C:\Windows\System\oDCujeZ.exe
  C:\Windows\System\oDCujeZ.exe
  2⤵
  PID:7000
- C:\Windows\System\aNKPbOw.exe
  C:\Windows\System\aNKPbOw.exe
  2⤵
  PID:7016
- C:\Windows\System\ThJoBrF.exe
  C:\Windows\System\ThJoBrF.exe
  2⤵
  PID:7032
- C:\Windows\System\IwKqxXz.exe
  C:\Windows\System\IwKqxXz.exe
  2⤵
  PID:7048
- C:\Windows\System\LbHxqXS.exe
  C:\Windows\System\LbHxqXS.exe
  2⤵
  PID:7064
- C:\Windows\System\PyiHxLD.exe
  C:\Windows\System\PyiHxLD.exe
  2⤵
  PID:7080
- C:\Windows\System\EXeoDrF.exe
  C:\Windows\System\EXeoDrF.exe
  2⤵
  PID:6028
- C:\Windows\System\sYxIEUe.exe
  C:\Windows\System\sYxIEUe.exe
  2⤵
  PID:6128
- C:\Windows\System\tbzHJiY.exe
  C:\Windows\System\tbzHJiY.exe
  2⤵
  PID:6236
- C:\Windows\System\TGYopPH.exe
  C:\Windows\System\TGYopPH.exe
  2⤵
  PID:4728
- C:\Windows\System\HTwvPfV.exe
  C:\Windows\System\HTwvPfV.exe
  2⤵
  PID:5968
- C:\Windows\System\wmyZlxv.exe
  C:\Windows\System\wmyZlxv.exe
  2⤵
  PID:6188
- C:\Windows\System\SqTdYQK.exe
  C:\Windows\System\SqTdYQK.exe
  2⤵
  PID:5168
- C:\Windows\System\hZDWAqQ.exe
  C:\Windows\System\hZDWAqQ.exe
  2⤵
  PID:5576
- C:\Windows\System\QqwYmlQ.exe
  C:\Windows\System\QqwYmlQ.exe
  2⤵
  PID:5672
- C:\Windows\System\ebZXHRl.exe
  C:\Windows\System\ebZXHRl.exe
  2⤵
  PID:6248
- C:\Windows\System\sEbolLS.exe
  C:\Windows\System\sEbolLS.exe
  2⤵
  PID:5772
- C:\Windows\System\faAVmUQ.exe
  C:\Windows\System\faAVmUQ.exe
  2⤵
  PID:5604
- C:\Windows\System\VQLIxDe.exe
  C:\Windows\System\VQLIxDe.exe
  2⤵
  PID:6312
- C:\Windows\System\oewfNNe.exe
  C:\Windows\System\oewfNNe.exe
  2⤵
  PID:6720
- C:\Windows\System\SdLRUQA.exe
  C:\Windows\System\SdLRUQA.exe
  2⤵
  PID:6740
- C:\Windows\System\SoUHCdY.exe
  C:\Windows\System\SoUHCdY.exe
  2⤵
  PID:6756
- C:\Windows\System\jnDbpxR.exe
  C:\Windows\System\jnDbpxR.exe
  2⤵
  PID:6776
- C:\Windows\System\goyarBJ.exe
  C:\Windows\System\goyarBJ.exe
  2⤵
  PID:6792
- C:\Windows\System\yltzpTZ.exe
  C:\Windows\System\yltzpTZ.exe
  2⤵
  PID:6808
- C:\Windows\System\MtKExRd.exe
  C:\Windows\System\MtKExRd.exe
  2⤵
  PID:6824
- C:\Windows\System\uSUcytj.exe
  C:\Windows\System\uSUcytj.exe
  2⤵
  PID:6840
- C:\Windows\System\HrpxzLS.exe
  C:\Windows\System\HrpxzLS.exe
  2⤵
  PID:6856
- C:\Windows\System\fcHidHY.exe
  C:\Windows\System\fcHidHY.exe
  2⤵
  PID:6872
- C:\Windows\System\QGuZUMS.exe
  C:\Windows\System\QGuZUMS.exe
  2⤵
  PID:6888
- C:\Windows\System\ZnoHYLr.exe
  C:\Windows\System\ZnoHYLr.exe
  2⤵
  PID:6904
- C:\Windows\System\SfkOtdb.exe
  C:\Windows\System\SfkOtdb.exe
  2⤵
  PID:6624
- C:\Windows\System\bzNrTFF.exe
  C:\Windows\System\bzNrTFF.exe
  2⤵
  PID:6656
- C:\Windows\System\GtYDJSm.exe
  C:\Windows\System\GtYDJSm.exe
  2⤵
  PID:6948
- C:\Windows\System\hKlnvPW.exe
  C:\Windows\System\hKlnvPW.exe
  2⤵
  PID:6976
- C:\Windows\System\vMgMRqe.exe
  C:\Windows\System\vMgMRqe.exe
  2⤵
  PID:7160
- C:\Windows\System\dsQmDiH.exe
  C:\Windows\System\dsQmDiH.exe
  2⤵
  PID:7152
- C:\Windows\System\fcgKFWu.exe
  C:\Windows\System\fcgKFWu.exe
  2⤵
  PID:5648
- C:\Windows\System\fKayFaO.exe
  C:\Windows\System\fKayFaO.exe
  2⤵
  PID:6064
- C:\Windows\System\zbrmhqN.exe
  C:\Windows\System\zbrmhqN.exe
  2⤵
  PID:2764
- C:\Windows\System\iQlkvws.exe
  C:\Windows\System\iQlkvws.exe
  2⤵
  PID:6152
- C:\Windows\System\nFynhgF.exe
  C:\Windows\System\nFynhgF.exe
  2⤵
  PID:5364
- C:\Windows\System\uBWSCUq.exe
  C:\Windows\System\uBWSCUq.exe
  2⤵
  PID:6200
- C:\Windows\System\LNPvrFV.exe
  C:\Windows\System\LNPvrFV.exe
  2⤵
  PID:6280
- C:\Windows\System\Pfzyxjm.exe
  C:\Windows\System\Pfzyxjm.exe
  2⤵
  PID:6328
- C:\Windows\System\GYNwGSU.exe
  C:\Windows\System\GYNwGSU.exe
  2⤵
  PID:6372
- C:\Windows\System\YFjBIdf.exe
  C:\Windows\System\YFjBIdf.exe
  2⤵
  PID:5476
- C:\Windows\System\gicCEaP.exe
  C:\Windows\System\gicCEaP.exe
  2⤵
  PID:6440
- C:\Windows\System\fwJhpkR.exe
  C:\Windows\System\fwJhpkR.exe
  2⤵
  PID:6508
- C:\Windows\System\SnCDlPy.exe
  C:\Windows\System\SnCDlPy.exe
  2⤵
  PID:6548
- C:\Windows\System\vCrnoDP.exe
  C:\Windows\System\vCrnoDP.exe
  2⤵
  PID:6388
- C:\Windows\System\nxEUsaU.exe
  C:\Windows\System\nxEUsaU.exe
  2⤵
  PID:6456
- C:\Windows\System\voSfcop.exe
  C:\Windows\System\voSfcop.exe
  2⤵
  PID:6496
- C:\Windows\System\RwBDwof.exe
  C:\Windows\System\RwBDwof.exe
  2⤵
  PID:6564
- C:\Windows\System\vqQCLaI.exe
  C:\Windows\System\vqQCLaI.exe
  2⤵
  PID:6612
- C:\Windows\System\kIUtUzg.exe
  C:\Windows\System\kIUtUzg.exe
  2⤵
  PID:6672
- C:\Windows\System\UoDWoUS.exe
  C:\Windows\System\UoDWoUS.exe
  2⤵
  PID:6676
- C:\Windows\System\tDjjmXY.exe
  C:\Windows\System\tDjjmXY.exe
  2⤵
  PID:6788
- C:\Windows\System\qPzlojx.exe
  C:\Windows\System\qPzlojx.exe
  2⤵
  PID:6852
- C:\Windows\System\wGaXrZV.exe
  C:\Windows\System\wGaXrZV.exe
  2⤵
  PID:6692
- C:\Windows\System\yEsDYGl.exe
  C:\Windows\System\yEsDYGl.exe
  2⤵
  PID:6960
- C:\Windows\System\OTkTKDg.exe
  C:\Windows\System\OTkTKDg.exe
  2⤵
  PID:7056
- C:\Windows\System\LCucrVr.exe
  C:\Windows\System\LCucrVr.exe
  2⤵
  PID:7060
- C:\Windows\System\ZNIjGIM.exe
  C:\Windows\System\ZNIjGIM.exe
  2⤵
  PID:7112
- C:\Windows\System\pHyoagR.exe
  C:\Windows\System\pHyoagR.exe
  2⤵
  PID:7140
- C:\Windows\System\iysbIkA.exe
  C:\Windows\System\iysbIkA.exe
  2⤵
  PID:5856
- C:\Windows\System\LAYpKSP.exe
  C:\Windows\System\LAYpKSP.exe
  2⤵
  PID:6232
- C:\Windows\System\IcHztTs.exe
  C:\Windows\System\IcHztTs.exe
  2⤵
  PID:6268
- C:\Windows\System\DNbOCXF.exe
  C:\Windows\System\DNbOCXF.exe
  2⤵
  PID:6216
- C:\Windows\System\UVTKAkE.exe
  C:\Windows\System\UVTKAkE.exe
  2⤵
  PID:6320
- C:\Windows\System\CXAjFMK.exe
  C:\Windows\System\CXAjFMK.exe
  2⤵
  PID:6544
- C:\Windows\System\VlSWmVP.exe
  C:\Windows\System\VlSWmVP.exe
  2⤵
  PID:6420
- C:\Windows\System\reEzIGN.exe
  C:\Windows\System\reEzIGN.exe
  2⤵
  PID:6560
- C:\Windows\System\YViliyn.exe
  C:\Windows\System\YViliyn.exe
  2⤵
  PID:6752
- C:\Windows\System\mcjXjbw.exe
  C:\Windows\System\mcjXjbw.exe
  2⤵
  PID:6488
- C:\Windows\System\EFcAnen.exe
  C:\Windows\System\EFcAnen.exe
  2⤵
  PID:6472
- C:\Windows\System\USiNaYm.exe
  C:\Windows\System\USiNaYm.exe
  2⤵
  PID:6716
- C:\Windows\System\HdGYnMD.exe
  C:\Windows\System\HdGYnMD.exe
  2⤵
  PID:6596
- C:\Windows\System\Xumhksu.exe
  C:\Windows\System\Xumhksu.exe
  2⤵
  PID:6944
- C:\Windows\System\lpeSrcS.exe
  C:\Windows\System\lpeSrcS.exe
  2⤵
  PID:6764
- C:\Windows\System\WgXrnpH.exe
  C:\Windows\System\WgXrnpH.exe
  2⤵
  PID:6736
- C:\Windows\System\iMjbkbD.exe
  C:\Windows\System\iMjbkbD.exe
  2⤵
  PID:6804
- C:\Windows\System\cXQzdno.exe
  C:\Windows\System\cXQzdno.exe
  2⤵
  PID:6296
- C:\Windows\System\bHBhFGC.exe
  C:\Windows\System\bHBhFGC.exe
  2⤵
  PID:6408
- C:\Windows\System\iaClQCl.exe
  C:\Windows\System\iaClQCl.exe
  2⤵
  PID:6644
- C:\Windows\System\AIoJFVy.exe
  C:\Windows\System\AIoJFVy.exe
  2⤵
  PID:6476
- C:\Windows\System\XxBJYMs.exe
  C:\Windows\System\XxBJYMs.exe
  2⤵
  PID:2608
- C:\Windows\System\wSNGXTi.exe
  C:\Windows\System\wSNGXTi.exe
  2⤵
  PID:5412
- C:\Windows\System\ayiFRMm.exe
  C:\Windows\System\ayiFRMm.exe
  2⤵
  PID:6324
- C:\Windows\System\eobqass.exe
  C:\Windows\System\eobqass.exe
  2⤵
  PID:7076
- C:\Windows\System\rTxBzhy.exe
  C:\Windows\System\rTxBzhy.exe
  2⤵
  PID:6932
- C:\Windows\System\ykejifa.exe
  C:\Windows\System\ykejifa.exe
  2⤵
  PID:6896
- C:\Windows\System\XPqFrqy.exe
  C:\Windows\System\XPqFrqy.exe
  2⤵
  PID:7012
- C:\Windows\System\ywXRhDl.exe
  C:\Windows\System\ywXRhDl.exe
  2⤵
  PID:7100
- C:\Windows\System\inymCfM.exe
  C:\Windows\System\inymCfM.exe
  2⤵
  PID:4756
- C:\Windows\System\OlkIILL.exe
  C:\Windows\System\OlkIILL.exe
  2⤵
  PID:7040
- C:\Windows\System\ohqtLOi.exe
  C:\Windows\System\ohqtLOi.exe
  2⤵
  PID:6540
- C:\Windows\System\RWJWeVC.exe
  C:\Windows\System\RWJWeVC.exe
  2⤵
  PID:6768
- C:\Windows\System\CoeqPHL.exe
  C:\Windows\System\CoeqPHL.exe
  2⤵
  PID:5964
- C:\Windows\System\XswDMcL.exe
  C:\Windows\System\XswDMcL.exe
  2⤵
  PID:6492
- C:\Windows\System\xvILoJs.exe
  C:\Windows\System\xvILoJs.exe
  2⤵
  PID:6996
- C:\Windows\System\HoBdQOE.exe
  C:\Windows\System\HoBdQOE.exe
  2⤵
  PID:5488
- C:\Windows\System\PjUsiYm.exe
  C:\Windows\System\PjUsiYm.exe
  2⤵
  PID:7180
- C:\Windows\System\BfPmlkE.exe
  C:\Windows\System\BfPmlkE.exe
  2⤵
  PID:7196
- C:\Windows\System\KgJvKMJ.exe
  C:\Windows\System\KgJvKMJ.exe
  2⤵
  PID:7212
- C:\Windows\System\kDFxcSk.exe
  C:\Windows\System\kDFxcSk.exe
  2⤵
  PID:7228
- C:\Windows\System\BoRemuX.exe
  C:\Windows\System\BoRemuX.exe
  2⤵
  PID:7248
- C:\Windows\System\PyGGLtz.exe
  C:\Windows\System\PyGGLtz.exe
  2⤵
  PID:7264
- C:\Windows\System\CCxXJnZ.exe
  C:\Windows\System\CCxXJnZ.exe
  2⤵
  PID:7280
- C:\Windows\System\Wwivrsb.exe
  C:\Windows\System\Wwivrsb.exe
  2⤵
  PID:7296
- C:\Windows\System\QwyIcYM.exe
  C:\Windows\System\QwyIcYM.exe
  2⤵
  PID:7312
- C:\Windows\System\igaBAIe.exe
  C:\Windows\System\igaBAIe.exe
  2⤵
  PID:7328
- C:\Windows\System\WmxxWFg.exe
  C:\Windows\System\WmxxWFg.exe
  2⤵
  PID:7344
- C:\Windows\System\bdQMHQl.exe
  C:\Windows\System\bdQMHQl.exe
  2⤵
  PID:7360
- C:\Windows\System\cFSMWzV.exe
  C:\Windows\System\cFSMWzV.exe
  2⤵
  PID:7376
- C:\Windows\System\FvQmcxj.exe
  C:\Windows\System\FvQmcxj.exe
  2⤵
  PID:7392
- C:\Windows\System\XWKrEAX.exe
  C:\Windows\System\XWKrEAX.exe
  2⤵
  PID:7412
- C:\Windows\System\zthVfet.exe
  C:\Windows\System\zthVfet.exe
  2⤵
  PID:7428
- C:\Windows\System\JoiOcqj.exe
  C:\Windows\System\JoiOcqj.exe
  2⤵
  PID:7444
- C:\Windows\System\mdZXCSl.exe
  C:\Windows\System\mdZXCSl.exe
  2⤵
  PID:7464
- C:\Windows\System\fevIYXq.exe
  C:\Windows\System\fevIYXq.exe
  2⤵
  PID:7484
- C:\Windows\System\clyyhlB.exe
  C:\Windows\System\clyyhlB.exe
  2⤵
  PID:7500
- C:\Windows\System\HKLmpGB.exe
  C:\Windows\System\HKLmpGB.exe
  2⤵
  PID:7516
- C:\Windows\System\gyrmAsH.exe
  C:\Windows\System\gyrmAsH.exe
  2⤵
  PID:7532
- C:\Windows\System\bKqcMKn.exe
  C:\Windows\System\bKqcMKn.exe
  2⤵
  PID:7548
- C:\Windows\System\dMzwGWH.exe
  C:\Windows\System\dMzwGWH.exe
  2⤵
  PID:7564
- C:\Windows\System\wYZkPQm.exe
  C:\Windows\System\wYZkPQm.exe
  2⤵
  PID:7580
- C:\Windows\System\BtgFCEg.exe
  C:\Windows\System\BtgFCEg.exe
  2⤵
  PID:7596
- C:\Windows\System\DHEzAPR.exe
  C:\Windows\System\DHEzAPR.exe
  2⤵
  PID:7612
- C:\Windows\System\InUEhEY.exe
  C:\Windows\System\InUEhEY.exe
  2⤵
  PID:7628
- C:\Windows\System\BJvJPdY.exe
  C:\Windows\System\BJvJPdY.exe
  2⤵
  PID:7704
- C:\Windows\System\WJtFHRM.exe
  C:\Windows\System\WJtFHRM.exe
  2⤵
  PID:7720
- C:\Windows\System\KuDqwfz.exe
  C:\Windows\System\KuDqwfz.exe
  2⤵
  PID:7736
- C:\Windows\System\tKopFma.exe
  C:\Windows\System\tKopFma.exe
  2⤵
  PID:7752
- C:\Windows\System\YkkAdDP.exe
  C:\Windows\System\YkkAdDP.exe
  2⤵
  PID:7772
- C:\Windows\System\QtcgVDm.exe
  C:\Windows\System\QtcgVDm.exe
  2⤵
  PID:7788
- C:\Windows\System\SKCMTkb.exe
  C:\Windows\System\SKCMTkb.exe
  2⤵
  PID:7828
- C:\Windows\System\iuiImvI.exe
  C:\Windows\System\iuiImvI.exe
  2⤵
  PID:7844
- C:\Windows\System\jQKfDfK.exe
  C:\Windows\System\jQKfDfK.exe
  2⤵
  PID:7860
- C:\Windows\System\tdZwjWS.exe
  C:\Windows\System\tdZwjWS.exe
  2⤵
  PID:7968
- C:\Windows\System\NMSPhwA.exe
  C:\Windows\System\NMSPhwA.exe
  2⤵
  PID:8052
- C:\Windows\System\EkBeXWY.exe
  C:\Windows\System\EkBeXWY.exe
  2⤵
  PID:8068
- C:\Windows\System\bzTNppt.exe
  C:\Windows\System\bzTNppt.exe
  2⤵
  PID:8084
- C:\Windows\System\LkLtIRG.exe
  C:\Windows\System\LkLtIRG.exe
  2⤵
  PID:8100
- C:\Windows\System\sVAglKp.exe
  C:\Windows\System\sVAglKp.exe
  2⤵
  PID:8116
- C:\Windows\System\evIKOVa.exe
  C:\Windows\System\evIKOVa.exe
  2⤵
  PID:8136
- C:\Windows\System\DBZCxkZ.exe
  C:\Windows\System\DBZCxkZ.exe
  2⤵
  PID:8152
- C:\Windows\System\zVhaIDF.exe
  C:\Windows\System\zVhaIDF.exe
  2⤵
  PID:8168
- C:\Windows\System\ygNQVdM.exe
  C:\Windows\System\ygNQVdM.exe
  2⤵
  PID:8188
- C:\Windows\System\tXdaYNO.exe
  C:\Windows\System\tXdaYNO.exe
  2⤵
  PID:2604
- C:\Windows\System\UPyoVBF.exe
  C:\Windows\System\UPyoVBF.exe
  2⤵
  PID:7220
- C:\Windows\System\MSVawGl.exe
  C:\Windows\System\MSVawGl.exe
  2⤵
  PID:7260
- C:\Windows\System\jXhNdMq.exe
  C:\Windows\System\jXhNdMq.exe
  2⤵
  PID:7356
- C:\Windows\System\lNbaSmP.exe
  C:\Windows\System\lNbaSmP.exe
  2⤵
  PID:7368
- C:\Windows\System\MDBWMqP.exe
  C:\Windows\System\MDBWMqP.exe
  2⤵
  PID:1552
- C:\Windows\System\CGAGBOW.exe
  C:\Windows\System\CGAGBOW.exe
  2⤵
  PID:7452
- C:\Windows\System\KsSoLhD.exe
  C:\Windows\System\KsSoLhD.exe
  2⤵
  PID:6732
- C:\Windows\System\DrUhPiM.exe
  C:\Windows\System\DrUhPiM.exe
  2⤵
  PID:7028
- C:\Windows\System\zdPPPFt.exe
  C:\Windows\System\zdPPPFt.exe
  2⤵
  PID:6864
- C:\Windows\System\VTVioRY.exe
  C:\Windows\System\VTVioRY.exe
  2⤵
  PID:7208
- C:\Windows\System\OgtJzZo.exe
  C:\Windows\System\OgtJzZo.exe
  2⤵
  PID:7272
- C:\Windows\System\CHpGyae.exe
  C:\Windows\System\CHpGyae.exe
  2⤵
  PID:7308
- C:\Windows\System\ONHUbrG.exe
  C:\Windows\System\ONHUbrG.exe
  2⤵
  PID:7404
- C:\Windows\System\LdWAKAj.exe
  C:\Windows\System\LdWAKAj.exe
  2⤵
  PID:7480
- C:\Windows\System\neBHuru.exe
  C:\Windows\System\neBHuru.exe
  2⤵
  PID:7588
- C:\Windows\System\fGXkpaL.exe
  C:\Windows\System\fGXkpaL.exe
  2⤵
  PID:7624
- C:\Windows\System\dYTcepc.exe
  C:\Windows\System\dYTcepc.exe
  2⤵
  PID:7512
- C:\Windows\System\Oimeyai.exe
  C:\Windows\System\Oimeyai.exe
  2⤵
  PID:7576
- C:\Windows\System\QxDHAUP.exe
  C:\Windows\System\QxDHAUP.exe
  2⤵
  PID:7656
- C:\Windows\System\PZaRyCL.exe
  C:\Windows\System\PZaRyCL.exe
  2⤵
  PID:7672
- C:\Windows\System\WhlOzRW.exe
  C:\Windows\System\WhlOzRW.exe
  2⤵
  PID:7692
- C:\Windows\System\RtYjZtJ.exe
  C:\Windows\System\RtYjZtJ.exe
  2⤵
  PID:7732
- C:\Windows\System\ZIenboW.exe
  C:\Windows\System\ZIenboW.exe
  2⤵
  PID:7712
- C:\Windows\System\MybTWLX.exe
  C:\Windows\System\MybTWLX.exe
  2⤵
  PID:7780
- C:\Windows\System\pPwUnpp.exe
  C:\Windows\System\pPwUnpp.exe
  2⤵
  PID:7804
- C:\Windows\System\kJXTKKD.exe
  C:\Windows\System\kJXTKKD.exe
  2⤵
  PID:7872
- C:\Windows\System\JZsyFBM.exe
  C:\Windows\System\JZsyFBM.exe
  2⤵
  PID:7808
- C:\Windows\System\CkYigTw.exe
  C:\Windows\System\CkYigTw.exe
  2⤵
  PID:7876
- C:\Windows\System\EONgNhk.exe
  C:\Windows\System\EONgNhk.exe
  2⤵
  PID:7892
- C:\Windows\System\odvxbfH.exe
  C:\Windows\System\odvxbfH.exe
  2⤵
  PID:7904
- C:\Windows\System\aKlmZtX.exe
  C:\Windows\System\aKlmZtX.exe
  2⤵
  PID:7928
- C:\Windows\System\HteaHFb.exe
  C:\Windows\System\HteaHFb.exe
  2⤵
  PID:7944
- C:\Windows\System\hmGoRtg.exe
  C:\Windows\System\hmGoRtg.exe
  2⤵
  PID:7964
- C:\Windows\System\exfkKVn.exe
  C:\Windows\System\exfkKVn.exe
  2⤵
  PID:7988
- C:\Windows\System\DbNOPcv.exe
  C:\Windows\System\DbNOPcv.exe
  2⤵
  PID:7644
- C:\Windows\System\oLCrCrO.exe
  C:\Windows\System\oLCrCrO.exe
  2⤵
  PID:8064
- C:\Windows\System\DTjiPJb.exe
  C:\Windows\System\DTjiPJb.exe
  2⤵
  PID:8040
- C:\Windows\System\hWLGsjp.exe
  C:\Windows\System\hWLGsjp.exe
  2⤵
  PID:8164
- C:\Windows\System\zzPEiaC.exe
  C:\Windows\System\zzPEiaC.exe
  2⤵
  PID:8180
- C:\Windows\System\EbKWfSs.exe
  C:\Windows\System\EbKWfSs.exe
  2⤵
  PID:8112
- C:\Windows\System\KIemNOB.exe
  C:\Windows\System\KIemNOB.exe
  2⤵
  PID:8076
- C:\Windows\System\zURWzRy.exe
  C:\Windows\System\zURWzRy.exe
  2⤵
  PID:7420
- C:\Windows\System\hoAYNWg.exe
  C:\Windows\System\hoAYNWg.exe
  2⤵
  PID:7108
- C:\Windows\System\fpbXNXp.exe
  C:\Windows\System\fpbXNXp.exe
  2⤵
  PID:7320
- C:\Windows\System\jtmGSuW.exe
  C:\Windows\System\jtmGSuW.exe
  2⤵
  PID:7460
- C:\Windows\System\OmaAhvh.exe
  C:\Windows\System\OmaAhvh.exe
  2⤵
  PID:6712
- C:\Windows\System\sCkGHFD.exe
  C:\Windows\System\sCkGHFD.exe
  2⤵
  PID:7436
- C:\Windows\System\QlxLOVz.exe
  C:\Windows\System\QlxLOVz.exe
  2⤵
  PID:7620
- C:\Windows\System\MCnrFNw.exe
  C:\Windows\System\MCnrFNw.exe
  2⤵
  PID:7524
- C:\Windows\System\jjCZRpb.exe
  C:\Windows\System\jjCZRpb.exe
  2⤵
  PID:7664
- C:\Windows\System\HrHopUl.exe
  C:\Windows\System\HrHopUl.exe
  2⤵
  PID:7744
- C:\Windows\System\RqAsKvh.exe
  C:\Windows\System\RqAsKvh.exe
  2⤵
  PID:7852
- C:\Windows\System\EvRSkwW.exe
  C:\Windows\System\EvRSkwW.exe
  2⤵
  PID:7920
- C:\Windows\System\fFotLRG.exe
  C:\Windows\System\fFotLRG.exe
  2⤵
  PID:8008
- C:\Windows\System\NiemJBB.exe
  C:\Windows\System\NiemJBB.exe
  2⤵
  PID:7652
- C:\Windows\System\tKcvERw.exe
  C:\Windows\System\tKcvERw.exe
  2⤵
  PID:7764
- C:\Windows\System\wYueiCc.exe
  C:\Windows\System\wYueiCc.exe
  2⤵
  PID:7856
- C:\Windows\System\xHRPCtA.exe
  C:\Windows\System\xHRPCtA.exe
  2⤵
  PID:8028
- C:\Windows\System\RSYythz.exe
  C:\Windows\System\RSYythz.exe
  2⤵
  PID:7952
- C:\Windows\System\HSLXOxl.exe
  C:\Windows\System\HSLXOxl.exe
  2⤵
  PID:7556
- C:\Windows\System\UWXoyqU.exe
  C:\Windows\System\UWXoyqU.exe
  2⤵
  PID:8012
- C:\Windows\System\gnqwbOR.exe
  C:\Windows\System\gnqwbOR.exe
  2⤵
  PID:8148
- C:\Windows\System\ViRvrwR.exe
  C:\Windows\System\ViRvrwR.exe
  2⤵
  PID:7120
- C:\Windows\System\BchsNyw.exe
  C:\Windows\System\BchsNyw.exe
  2⤵
  PID:7640
- C:\Windows\System\bihJihx.exe
  C:\Windows\System\bihJihx.exe
  2⤵
  PID:6708
- C:\Windows\System\SFkRTiz.exe
  C:\Windows\System\SFkRTiz.exe
  2⤵
  PID:7908
- C:\Windows\System\aBGLzeb.exe
  C:\Windows\System\aBGLzeb.exe
  2⤵
  PID:7440
- C:\Windows\System\eqYstTK.exe
  C:\Windows\System\eqYstTK.exe
  2⤵
  PID:7244
- C:\Windows\System\MFVOPXq.exe
  C:\Windows\System\MFVOPXq.exe
  2⤵
  PID:7324
- C:\Windows\System\wZYDqHm.exe
  C:\Windows\System\wZYDqHm.exe
  2⤵
  PID:8020
- C:\Windows\System\MMKSnaV.exe
  C:\Windows\System\MMKSnaV.exe
  2⤵
  PID:7188
- C:\Windows\System\zydInWA.exe
  C:\Windows\System\zydInWA.exe
  2⤵
  PID:8144
- C:\Windows\System\ayFZjKC.exe
  C:\Windows\System\ayFZjKC.exe
  2⤵
  PID:7256
- C:\Windows\System\vDFDBEz.exe
  C:\Windows\System\vDFDBEz.exe
  2⤵
  PID:7684
- C:\Windows\System\pQCDxbK.exe
  C:\Windows\System\pQCDxbK.exe
  2⤵
  PID:7496
- C:\Windows\System\vamviuT.exe
  C:\Windows\System\vamviuT.exe
  2⤵
  PID:7960
- C:\Windows\System\xEgaBnv.exe
  C:\Windows\System\xEgaBnv.exe
  2⤵
  PID:7924
- C:\Windows\System\ZbyOMes.exe
  C:\Windows\System\ZbyOMes.exe
  2⤵
  PID:7796
- C:\Windows\System\RPxfOfv.exe
  C:\Windows\System\RPxfOfv.exe
  2⤵
  PID:7840
- C:\Windows\System\vPUmHPl.exe
  C:\Windows\System\vPUmHPl.exe
  2⤵
  PID:7192
- C:\Windows\System\faABCUt.exe
  C:\Windows\System\faABCUt.exe
  2⤵
  PID:8256
- C:\Windows\System\XUCJJVa.exe
  C:\Windows\System\XUCJJVa.exe
  2⤵
  PID:8272
- C:\Windows\System\DCjRpeI.exe
  C:\Windows\System\DCjRpeI.exe
  2⤵
  PID:8288
- C:\Windows\System\DpdGXpW.exe
  C:\Windows\System\DpdGXpW.exe
  2⤵
  PID:8308
- C:\Windows\System\mlYhINy.exe
  C:\Windows\System\mlYhINy.exe
  2⤵
  PID:8324
- C:\Windows\System\zvcuefP.exe
  C:\Windows\System\zvcuefP.exe
  2⤵
  PID:8340
- C:\Windows\System\yBIEKRJ.exe
  C:\Windows\System\yBIEKRJ.exe
  2⤵
  PID:8356
- C:\Windows\System\arcuKKm.exe
  C:\Windows\System\arcuKKm.exe
  2⤵
  PID:8372
- C:\Windows\System\GLAuJEK.exe
  C:\Windows\System\GLAuJEK.exe
  2⤵
  PID:8388
- C:\Windows\System\NJZpcie.exe
  C:\Windows\System\NJZpcie.exe
  2⤵
  PID:8404
- C:\Windows\System\SRhpbfM.exe
  C:\Windows\System\SRhpbfM.exe
  2⤵
  PID:8420
- C:\Windows\System\JQCCkpv.exe
  C:\Windows\System\JQCCkpv.exe
  2⤵
  PID:8444
- C:\Windows\System\DWVkpXG.exe
  C:\Windows\System\DWVkpXG.exe
  2⤵
  PID:8464
- C:\Windows\System\kvTClTj.exe
  C:\Windows\System\kvTClTj.exe
  2⤵
  PID:8480
- C:\Windows\System\VgNZoLZ.exe
  C:\Windows\System\VgNZoLZ.exe
  2⤵
  PID:8496
- C:\Windows\System\bkuXgcq.exe
  C:\Windows\System\bkuXgcq.exe
  2⤵
  PID:8512
- C:\Windows\System\uRwQOGw.exe
  C:\Windows\System\uRwQOGw.exe
  2⤵
  PID:8528
- C:\Windows\System\XbtSvlg.exe
  C:\Windows\System\XbtSvlg.exe
  2⤵
  PID:8548
- C:\Windows\System\IyZXdzL.exe
  C:\Windows\System\IyZXdzL.exe
  2⤵
  PID:8564
- C:\Windows\System\hjpdvfr.exe
  C:\Windows\System\hjpdvfr.exe
  2⤵
  PID:8580
- C:\Windows\System\GvwGPdY.exe
  C:\Windows\System\GvwGPdY.exe
  2⤵
  PID:8596
- C:\Windows\System\jTxcbTz.exe
  C:\Windows\System\jTxcbTz.exe
  2⤵
  PID:8612
- C:\Windows\System\HCBdJmg.exe
  C:\Windows\System\HCBdJmg.exe
  2⤵
  PID:8628
- C:\Windows\System\tlduhDv.exe
  C:\Windows\System\tlduhDv.exe
  2⤵
  PID:8644
- C:\Windows\System\uUyJPyA.exe
  C:\Windows\System\uUyJPyA.exe
  2⤵
  PID:8660
- C:\Windows\System\FVZbsir.exe
  C:\Windows\System\FVZbsir.exe
  2⤵
  PID:8676
- C:\Windows\System\RiSqxTY.exe
  C:\Windows\System\RiSqxTY.exe
  2⤵
  PID:8692
- C:\Windows\System\LAPLYUp.exe
  C:\Windows\System\LAPLYUp.exe
  2⤵
  PID:8708
- C:\Windows\System\MABBTDC.exe
  C:\Windows\System\MABBTDC.exe
  2⤵
  PID:8724
- C:\Windows\System\yYJdePy.exe
  C:\Windows\System\yYJdePy.exe
  2⤵
  PID:8756
- C:\Windows\System\RkgaDDQ.exe
  C:\Windows\System\RkgaDDQ.exe
  2⤵
  PID:8772
- C:\Windows\System\rsXBsEq.exe
  C:\Windows\System\rsXBsEq.exe
  2⤵
  PID:8788
- C:\Windows\System\RRrnkCd.exe
  C:\Windows\System\RRrnkCd.exe
  2⤵
  PID:8804
- C:\Windows\System\RIbeaYG.exe
  C:\Windows\System\RIbeaYG.exe
  2⤵
  PID:8824
- C:\Windows\System\gFeQlAa.exe
  C:\Windows\System\gFeQlAa.exe
  2⤵
  PID:8840
- C:\Windows\System\CsMyEBC.exe
  C:\Windows\System\CsMyEBC.exe
  2⤵
  PID:8856
- C:\Windows\System\QwFhPis.exe
  C:\Windows\System\QwFhPis.exe
  2⤵
  PID:8872
- C:\Windows\System\yDlAaDa.exe
  C:\Windows\System\yDlAaDa.exe
  2⤵
  PID:8888
- C:\Windows\System\YOZAGTj.exe
  C:\Windows\System\YOZAGTj.exe
  2⤵
  PID:8912
- C:\Windows\System\gSYLnlO.exe
  C:\Windows\System\gSYLnlO.exe
  2⤵
  PID:9004
- C:\Windows\System\DTfQdgP.exe
  C:\Windows\System\DTfQdgP.exe
  2⤵
  PID:9064
- C:\Windows\System\xYCVRzB.exe
  C:\Windows\System\xYCVRzB.exe
  2⤵
  PID:9084
- C:\Windows\System\eIumlPN.exe
  C:\Windows\System\eIumlPN.exe
  2⤵
  PID:9108
- C:\Windows\System\dKkOWQk.exe
  C:\Windows\System\dKkOWQk.exe
  2⤵
  PID:9128
- C:\Windows\System\dekNEMZ.exe
  C:\Windows\System\dekNEMZ.exe
  2⤵
  PID:9144
- C:\Windows\System\nGWbMrJ.exe
  C:\Windows\System\nGWbMrJ.exe
  2⤵
  PID:9160
- C:\Windows\System\SOAmWFg.exe
  C:\Windows\System\SOAmWFg.exe
  2⤵
  PID:9176
- C:\Windows\System\pcNpKzg.exe
  C:\Windows\System\pcNpKzg.exe
  2⤵
  PID:9196
- C:\Windows\System\yJWEBzp.exe
  C:\Windows\System\yJWEBzp.exe
  2⤵
  PID:9212
- C:\Windows\System\EvARKau.exe
  C:\Windows\System\EvARKau.exe
  2⤵
  PID:7800
- C:\Windows\System\VoyehPk.exe
  C:\Windows\System\VoyehPk.exe
  2⤵
  PID:8044
- C:\Windows\System\UfoDMmp.exe
  C:\Windows\System\UfoDMmp.exe
  2⤵
  PID:7884
- C:\Windows\System\nmuGvVo.exe
  C:\Windows\System\nmuGvVo.exe
  2⤵
  PID:7276
- C:\Windows\System\iobxrDC.exe
  C:\Windows\System\iobxrDC.exe
  2⤵
  PID:8212
- C:\Windows\System\YHSIFTK.exe
  C:\Windows\System\YHSIFTK.exe
  2⤵
  PID:8024
- C:\Windows\System\arHmDfK.exe
  C:\Windows\System\arHmDfK.exe
  2⤵
  PID:8232
- C:\Windows\System\mxdlapj.exe
  C:\Windows\System\mxdlapj.exe
  2⤵
  PID:8268
- C:\Windows\System\ByOXgsR.exe
  C:\Windows\System\ByOXgsR.exe
  2⤵
  PID:8472
- C:\Windows\System\uUpuDjE.exe
  C:\Windows\System\uUpuDjE.exe
  2⤵
  PID:8540
- C:\Windows\System\OkKXMBD.exe
  C:\Windows\System\OkKXMBD.exe
  2⤵
  PID:8604
- C:\Windows\System\QyGMQFT.exe
  C:\Windows\System\QyGMQFT.exe
  2⤵
  PID:8668
- C:\Windows\System\YJAeUHJ.exe
  C:\Windows\System\YJAeUHJ.exe
  2⤵
  PID:8704
- C:\Windows\System\lCaPibi.exe
  C:\Windows\System\lCaPibi.exe
  2⤵
  PID:8744
- C:\Windows\System\RTmAKhV.exe
  C:\Windows\System\RTmAKhV.exe
  2⤵
  PID:8780
- C:\Windows\System\LBgUIyO.exe
  C:\Windows\System\LBgUIyO.exe
  2⤵
  PID:8852
- C:\Windows\System\iUWUtEB.exe
  C:\Windows\System\iUWUtEB.exe
  2⤵
  PID:8316
- C:\Windows\System\HQUlBGa.exe
  C:\Windows\System\HQUlBGa.exe
  2⤵
  PID:8412
- C:\Windows\System\rMLtHPp.exe
  C:\Windows\System\rMLtHPp.exe
  2⤵
  PID:8560
- C:\Windows\System\CgMsgtR.exe
  C:\Windows\System\CgMsgtR.exe
  2⤵
  PID:8768
- C:\Windows\System\HnLWXox.exe
  C:\Windows\System\HnLWXox.exe
  2⤵
  PID:8832
- C:\Windows\System\vMKfanS.exe
  C:\Windows\System\vMKfanS.exe
  2⤵
  PID:8896
- C:\Windows\System\jnuszWL.exe
  C:\Windows\System\jnuszWL.exe
  2⤵
  PID:8380
- C:\Windows\System\BjeJuaz.exe
  C:\Windows\System\BjeJuaz.exe
  2⤵
  PID:8652
- C:\Windows\System\ZLGHktP.exe
  C:\Windows\System\ZLGHktP.exe
  2⤵
  PID:8588
- C:\Windows\System\sZoKMYQ.exe
  C:\Windows\System\sZoKMYQ.exe
  2⤵
  PID:8936
- C:\Windows\System\yYacsFT.exe
  C:\Windows\System\yYacsFT.exe
  2⤵
  PID:8944
- C:\Windows\System\SFIkmNG.exe
  C:\Windows\System\SFIkmNG.exe
  2⤵
  PID:8960
- C:\Windows\System\VnCwKqr.exe
  C:\Windows\System\VnCwKqr.exe
  2⤵
  PID:8976
- C:\Windows\System\meIsIJe.exe
  C:\Windows\System\meIsIJe.exe
  2⤵
  PID:8996
- C:\Windows\System\SVrMLjz.exe
  C:\Windows\System\SVrMLjz.exe
  2⤵
  PID:9032
- C:\Windows\System\AFEBBZk.exe
  C:\Windows\System\AFEBBZk.exe
  2⤵
  PID:9024
- C:\Windows\System\aEHSdCL.exe
  C:\Windows\System\aEHSdCL.exe
  2⤵
  PID:9060
- C:\Windows\System\WxEVGRg.exe
  C:\Windows\System\WxEVGRg.exe
  2⤵
  PID:9080
- C:\Windows\System\zPmqXhs.exe
  C:\Windows\System\zPmqXhs.exe
  2⤵
  PID:5600
- C:\Windows\System\ptwuHtC.exe
  C:\Windows\System\ptwuHtC.exe
  2⤵
  PID:9120
- C:\Windows\System\qFUrenV.exe
  C:\Windows\System\qFUrenV.exe
  2⤵
  PID:9104
- C:\Windows\System\lYTstDE.exe
  C:\Windows\System\lYTstDE.exe
  2⤵
  PID:9172
- C:\Windows\System\epRbwoo.exe
  C:\Windows\System\epRbwoo.exe
  2⤵
  PID:7748
- C:\Windows\System\qxHGolb.exe
  C:\Windows\System\qxHGolb.exe
  2⤵
  PID:8224
- C:\Windows\System\yVaMbMe.exe
  C:\Windows\System\yVaMbMe.exe
  2⤵
  PID:9152
- C:\Windows\System\yAzqofw.exe
  C:\Windows\System\yAzqofw.exe
  2⤵
  PID:9184
- C:\Windows\System\EDKlugl.exe
  C:\Windows\System\EDKlugl.exe
  2⤵
  PID:8004
- C:\Windows\System\sutBsNB.exe
  C:\Windows\System\sutBsNB.exe
  2⤵
  PID:8396
- C:\Windows\System\juHcapS.exe
  C:\Windows\System\juHcapS.exe
  2⤵
  PID:8572
- C:\Windows\System\xBdmYRo.exe
  C:\Windows\System\xBdmYRo.exe
  2⤵
  PID:8432
- C:\Windows\System\hhMDcUD.exe
  C:\Windows\System\hhMDcUD.exe
  2⤵
  PID:8700
- C:\Windows\System\oAmxixH.exe
  C:\Windows\System\oAmxixH.exe
  2⤵
  PID:8816
- C:\Windows\System\KAdfsYj.exe
  C:\Windows\System\KAdfsYj.exe
  2⤵
  PID:8740
- C:\Windows\System\WHjzFtI.exe
  C:\Windows\System\WHjzFtI.exe
  2⤵
  PID:8720
- C:\Windows\System\nyiySDH.exe
  C:\Windows\System\nyiySDH.exe
  2⤵
  PID:9056
- C:\Windows\System\QktcnZc.exe
  C:\Windows\System\QktcnZc.exe
  2⤵
  PID:8716
- C:\Windows\System\iYIdoTf.exe
  C:\Windows\System\iYIdoTf.exe
  2⤵
  PID:8672
- C:\Windows\System\zEJqkFD.exe
  C:\Windows\System\zEJqkFD.exe
  2⤵
  PID:8364
- C:\Windows\System\jiPcmJa.exe
  C:\Windows\System\jiPcmJa.exe
  2⤵
  PID:8400
- C:\Windows\System\GNGJkiG.exe
  C:\Windows\System\GNGJkiG.exe
  2⤵
  PID:8280
- C:\Windows\System\FzkOhRH.exe
  C:\Windows\System\FzkOhRH.exe
  2⤵
  PID:8520
- C:\Windows\System\AfGgITL.exe
  C:\Windows\System\AfGgITL.exe
  2⤵
  PID:8620
- C:\Windows\System\MqAjROs.exe
  C:\Windows\System\MqAjROs.exe
  2⤵
  PID:9156
- C:\Windows\System\BYxDALQ.exe
  C:\Windows\System\BYxDALQ.exe
  2⤵
  PID:9208
- C:\Windows\System\CiLJxPd.exe
  C:\Windows\System\CiLJxPd.exe
  2⤵
  PID:7204
- C:\Windows\System\fAkNyFS.exe
  C:\Windows\System\fAkNyFS.exe
  2⤵
  PID:8920
- C:\Windows\System\sLqVJBL.exe
  C:\Windows\System\sLqVJBL.exe
  2⤵
  PID:8956
- C:\Windows\System\ORpEoIF.exe
  C:\Windows\System\ORpEoIF.exe
  2⤵
  PID:9036
- C:\Windows\System\pzYDbHY.exe
  C:\Windows\System\pzYDbHY.exe
  2⤵
  PID:8132
- C:\Windows\System\SwLzFHJ.exe
  C:\Windows\System\SwLzFHJ.exe
  2⤵
  PID:8368
- C:\Windows\System\qdaUVEs.exe
  C:\Windows\System\qdaUVEs.exe
  2⤵
  PID:9140
- C:\Windows\System\oODVYUr.exe
  C:\Windows\System\oODVYUr.exe
  2⤵
  PID:8636
- C:\Windows\System\aoMqrCq.exe
  C:\Windows\System\aoMqrCq.exe
  2⤵
  PID:8488
- C:\Windows\System\xMKebEJ.exe
  C:\Windows\System\xMKebEJ.exe
  2⤵
  PID:8524
- C:\Windows\System\MTcsVMm.exe
  C:\Windows\System\MTcsVMm.exe
  2⤵
  PID:8352
- C:\Windows\System\aMwfxXo.exe
  C:\Windows\System\aMwfxXo.exe
  2⤵
  PID:8248
- C:\Windows\System\lLKwzcl.exe
  C:\Windows\System\lLKwzcl.exe
  2⤵
  PID:9052
- C:\Windows\System\LwLbEey.exe
  C:\Windows\System\LwLbEey.exe
  2⤵
  PID:9000
- C:\Windows\System\dMEsiig.exe
  C:\Windows\System\dMEsiig.exe
  2⤵
  PID:8252
- C:\Windows\System\xbjRPjM.exe
  C:\Windows\System\xbjRPjM.exe
  2⤵
  PID:9224
- C:\Windows\System\EQFwwrC.exe
  C:\Windows\System\EQFwwrC.exe
  2⤵
  PID:9244
- C:\Windows\System\dJaabcb.exe
  C:\Windows\System\dJaabcb.exe
  2⤵
  PID:9260
- C:\Windows\System\OtXRabX.exe
  C:\Windows\System\OtXRabX.exe
  2⤵
  PID:9280
- C:\Windows\System\IcFNOvT.exe
  C:\Windows\System\IcFNOvT.exe
  2⤵
  PID:9300
- C:\Windows\System\QzWvJId.exe
  C:\Windows\System\QzWvJId.exe
  2⤵
  PID:9316
- C:\Windows\System\MCYShpw.exe
  C:\Windows\System\MCYShpw.exe
  2⤵
  PID:9332
- C:\Windows\System\FVupSgA.exe
  C:\Windows\System\FVupSgA.exe
  2⤵
  PID:9352
- C:\Windows\System\RtfCkSP.exe
  C:\Windows\System\RtfCkSP.exe
  2⤵
  PID:9368
- C:\Windows\System\gfrbbbj.exe
  C:\Windows\System\gfrbbbj.exe
  2⤵
  PID:9384
- C:\Windows\System\fmcLeSK.exe
  C:\Windows\System\fmcLeSK.exe
  2⤵
  PID:9400
- C:\Windows\System\HGPWtba.exe
  C:\Windows\System\HGPWtba.exe
  2⤵
  PID:9424
- C:\Windows\System\OJOSObE.exe
  C:\Windows\System\OJOSObE.exe
  2⤵
  PID:9440
- C:\Windows\System\wgosMiv.exe
  C:\Windows\System\wgosMiv.exe
  2⤵
  PID:9456
- C:\Windows\System\LGNgdAA.exe
  C:\Windows\System\LGNgdAA.exe
  2⤵
  PID:9472
- C:\Windows\System\IQBzaYq.exe
  C:\Windows\System\IQBzaYq.exe
  2⤵
  PID:9496
- C:\Windows\System\HKvfQQY.exe
  C:\Windows\System\HKvfQQY.exe
  2⤵
  PID:9552
- C:\Windows\System\rjHEefT.exe
  C:\Windows\System\rjHEefT.exe
  2⤵
  PID:9568
- C:\Windows\System\mVkaNoA.exe
  C:\Windows\System\mVkaNoA.exe
  2⤵
  PID:9592
- C:\Windows\System\pZLgmwz.exe
  C:\Windows\System\pZLgmwz.exe
  2⤵
  PID:9608
- C:\Windows\System\vmSIHcp.exe
  C:\Windows\System\vmSIHcp.exe
  2⤵
  PID:9624
- C:\Windows\System\oYNLojD.exe
  C:\Windows\System\oYNLojD.exe
  2⤵
  PID:9640
- C:\Windows\System\tgcZmmB.exe
  C:\Windows\System\tgcZmmB.exe
  2⤵
  PID:9656
- C:\Windows\System\KjATuaB.exe
  C:\Windows\System\KjATuaB.exe
  2⤵
  PID:9672
- C:\Windows\System\WOFZVWH.exe
  C:\Windows\System\WOFZVWH.exe
  2⤵
  PID:9688
- C:\Windows\System\GLmcbJL.exe
  C:\Windows\System\GLmcbJL.exe
  2⤵
  PID:9704
- C:\Windows\System\PchkbtK.exe
  C:\Windows\System\PchkbtK.exe
  2⤵
  PID:9724
- C:\Windows\System\SwsLcNc.exe
  C:\Windows\System\SwsLcNc.exe
  2⤵
  PID:9740
- C:\Windows\System\jCvcgym.exe
  C:\Windows\System\jCvcgym.exe
  2⤵
  PID:9756
- C:\Windows\System\GvfADnf.exe
  C:\Windows\System\GvfADnf.exe
  2⤵
  PID:9780
- C:\Windows\System\NPpMKRB.exe
  C:\Windows\System\NPpMKRB.exe
  2⤵
  PID:9796
- C:\Windows\System\SvTNwfC.exe
  C:\Windows\System\SvTNwfC.exe
  2⤵
  PID:9812
- C:\Windows\System\zKIAyrl.exe
  C:\Windows\System\zKIAyrl.exe
  2⤵
  PID:9828
- C:\Windows\System\ORKNZef.exe
  C:\Windows\System\ORKNZef.exe
  2⤵
  PID:9844
- C:\Windows\System\oBSFCEu.exe
  C:\Windows\System\oBSFCEu.exe
  2⤵
  PID:9860
- C:\Windows\System\mQqcVdG.exe
  C:\Windows\System\mQqcVdG.exe
  2⤵
  PID:9928
- C:\Windows\System\LHGQzzw.exe
  C:\Windows\System\LHGQzzw.exe
  2⤵
  PID:9944
- C:\Windows\System\GyLcMMa.exe
  C:\Windows\System\GyLcMMa.exe
  2⤵
  PID:9960
- C:\Windows\System\ieyzIiO.exe
  C:\Windows\System\ieyzIiO.exe
  2⤵
  PID:9980
- C:\Windows\System\OpXrzmV.exe
  C:\Windows\System\OpXrzmV.exe
  2⤵
  PID:9996
- C:\Windows\System\efIWfYW.exe
  C:\Windows\System\efIWfYW.exe
  2⤵
  PID:10012
- C:\Windows\System\cXWgCqb.exe
  C:\Windows\System\cXWgCqb.exe
  2⤵
  PID:10028
- C:\Windows\System\gZtnUkO.exe
  C:\Windows\System\gZtnUkO.exe
  2⤵
  PID:10052
- C:\Windows\System\EvegvKM.exe
  C:\Windows\System\EvegvKM.exe
  2⤵
  PID:10068
- C:\Windows\System\DhXPKyV.exe
  C:\Windows\System\DhXPKyV.exe
  2⤵
  PID:10084
- C:\Windows\System\IBmgaov.exe
  C:\Windows\System\IBmgaov.exe
  2⤵
  PID:10104
- C:\Windows\System\sukznnB.exe
  C:\Windows\System\sukznnB.exe
  2⤵
  PID:10120
- C:\Windows\System\BzlRnaT.exe
  C:\Windows\System\BzlRnaT.exe
  2⤵
  PID:10136
- C:\Windows\System\YgXIBad.exe
  C:\Windows\System\YgXIBad.exe
  2⤵
  PID:10152
- C:\Windows\System\zKvfVqx.exe
  C:\Windows\System\zKvfVqx.exe
  2⤵
  PID:10168
- C:\Windows\System\PdobDnB.exe
  C:\Windows\System\PdobDnB.exe
  2⤵
  PID:10188
- C:\Windows\System\NQPBlEX.exe
  C:\Windows\System\NQPBlEX.exe
  2⤵
  PID:10204
- C:\Windows\System\YKGamkO.exe
  C:\Windows\System\YKGamkO.exe
  2⤵
  PID:10228
- C:\Windows\System\wygBQds.exe
  C:\Windows\System\wygBQds.exe
  2⤵
  PID:9168
- C:\Windows\System\MLjmtpe.exe
  C:\Windows\System\MLjmtpe.exe
  2⤵
  PID:9232
- C:\Windows\System\mcqvSMs.exe
  C:\Windows\System\mcqvSMs.exe
  2⤵
  PID:9308
- C:\Windows\System\qcLhePV.exe
  C:\Windows\System\qcLhePV.exe
  2⤵
  PID:8684
- C:\Windows\System\ixrbWca.exe
  C:\Windows\System\ixrbWca.exe
  2⤵
  PID:9420
- C:\Windows\System\AUqnXaW.exe
  C:\Windows\System\AUqnXaW.exe
  2⤵
  PID:9452
- C:\Windows\System\exdCgOl.exe
  C:\Windows\System\exdCgOl.exe
  2⤵
  PID:8492
- C:\Windows\System\cDJqGkF.exe
  C:\Windows\System\cDJqGkF.exe
  2⤵
  PID:8208
- C:\Windows\System\EvDALRT.exe
  C:\Windows\System\EvDALRT.exe
  2⤵
  PID:8932
- C:\Windows\System\qaTZkwg.exe
  C:\Windows\System\qaTZkwg.exe
  2⤵
  PID:9484
- C:\Windows\System\uAAOPyA.exe
  C:\Windows\System\uAAOPyA.exe
  2⤵
  PID:9072
- C:\Windows\System\yiNaclA.exe
  C:\Windows\System\yiNaclA.exe
  2⤵
  PID:9256
- C:\Windows\System\VPbDKOv.exe
  C:\Windows\System\VPbDKOv.exe
  2⤵
  PID:9324
- C:\Windows\System\sazpmWK.exe
  C:\Windows\System\sazpmWK.exe
  2⤵
  PID:9392
- C:\Windows\System\juRujqP.exe
  C:\Windows\System\juRujqP.exe
  2⤵
  PID:9464
- C:\Windows\System\JEZnDqt.exe
  C:\Windows\System\JEZnDqt.exe
  2⤵
  PID:9508
- C:\Windows\System\mkOBTNv.exe
  C:\Windows\System\mkOBTNv.exe
  2⤵
  PID:9528
- C:\Windows\System\iaDBzvm.exe
  C:\Windows\System\iaDBzvm.exe
  2⤵
  PID:9564
- C:\Windows\System\JGsrBPA.exe
  C:\Windows\System\JGsrBPA.exe
  2⤵
  PID:9604
- C:\Windows\System\jtDkVbu.exe
  C:\Windows\System\jtDkVbu.exe
  2⤵
  PID:9588
- C:\Windows\System\qkpiVJO.exe
  C:\Windows\System\qkpiVJO.exe
  2⤵
  PID:9664
- C:\Windows\System\uiqylNb.exe
  C:\Windows\System\uiqylNb.exe
  2⤵
  PID:9732
- C:\Windows\System\yjdAYoL.exe
  C:\Windows\System\yjdAYoL.exe
  2⤵
  PID:9680
- C:\Windows\System\DuIVOmt.exe
  C:\Windows\System\DuIVOmt.exe
  2⤵
  PID:9776
- C:\Windows\System\fESViHE.exe
  C:\Windows\System\fESViHE.exe
  2⤵
  PID:9716
- C:\Windows\System\rzAcFjx.exe
  C:\Windows\System\rzAcFjx.exe
  2⤵
  PID:9620
- C:\Windows\System\rSxwgye.exe
  C:\Windows\System\rSxwgye.exe
  2⤵
  PID:9820
- C:\Windows\System\XuLNTwZ.exe
  C:\Windows\System\XuLNTwZ.exe
  2⤵
  PID:9868
- C:\Windows\System\vLqKiwr.exe
  C:\Windows\System\vLqKiwr.exe
  2⤵
  PID:9880
- C:\Windows\System\SkkMTcl.exe
  C:\Windows\System\SkkMTcl.exe
  2⤵
  PID:8968
- C:\Windows\System\isMAPdo.exe
  C:\Windows\System\isMAPdo.exe
  2⤵
  PID:10092
- C:\Windows\System\DTWxBxp.exe
  C:\Windows\System\DTWxBxp.exe
  2⤵
  PID:8820
- C:\Windows\System\CSDjEZy.exe
  C:\Windows\System\CSDjEZy.exe
  2⤵
  PID:9940
- C:\Windows\System\qFXOSeK.exe
  C:\Windows\System\qFXOSeK.exe
  2⤵
  PID:10008
- C:\Windows\System\nMGPNSz.exe
  C:\Windows\System\nMGPNSz.exe
  2⤵
  PID:9296
- C:\Windows\System\DhqgHnq.exe
  C:\Windows\System\DhqgHnq.exe
  2⤵
  PID:9432
- C:\Windows\System\jaCnwCy.exe
  C:\Windows\System\jaCnwCy.exe
  2⤵
  PID:9252
- C:\Windows\System\wDHjVIC.exe
  C:\Windows\System\wDHjVIC.exe
  2⤵
  PID:9028
- C:\Windows\System\VOgzpoW.exe
  C:\Windows\System\VOgzpoW.exe
  2⤵
  PID:9584
- C:\Windows\System\uwhRvat.exe
  C:\Windows\System\uwhRvat.exe
  2⤵
  PID:9752
- C:\Windows\System\ltAosGG.exe
  C:\Windows\System\ltAosGG.exe
  2⤵
  PID:9852
- C:\Windows\System\YfeTkmd.exe
  C:\Windows\System\YfeTkmd.exe
  2⤵
  PID:9896
- C:\Windows\System\tDuzwce.exe
  C:\Windows\System\tDuzwce.exe
  2⤵
  PID:9876
- C:\Windows\System\aIkyqms.exe
  C:\Windows\System\aIkyqms.exe
  2⤵
  PID:10096
- C:\Windows\System\lFHLfeV.exe
  C:\Windows\System\lFHLfeV.exe
  2⤵
  PID:9916
- C:\Windows\System\fjXUhkW.exe
  C:\Windows\System\fjXUhkW.exe
  2⤵
  PID:10164
- C:\Windows\System\yGoBmCr.exe
  C:\Windows\System\yGoBmCr.exe
  2⤵
  PID:10020
- C:\Windows\System\TbBFkYC.exe
  C:\Windows\System\TbBFkYC.exe
  2⤵
  PID:9340
- C:\Windows\System\VbmkMpg.exe
  C:\Windows\System\VbmkMpg.exe
  2⤵
  PID:8264
- C:\Windows\System\jNjxOtU.exe
  C:\Windows\System\jNjxOtU.exe
  2⤵
  PID:9364
- C:\Windows\System\KsxWjdS.exe
  C:\Windows\System\KsxWjdS.exe
  2⤵
  PID:8904
- C:\Windows\System\HccAhoO.exe
  C:\Windows\System\HccAhoO.exe
  2⤵
  PID:10212
- C:\Windows\System\iSlAanT.exe
  C:\Windows\System\iSlAanT.exe
  2⤵
  PID:10116
- C:\Windows\System\xBqwRIP.exe
  C:\Windows\System\xBqwRIP.exe
  2⤵
  PID:9600
- C:\Windows\System\hPqrgDU.exe
  C:\Windows\System\hPqrgDU.exe
  2⤵
  PID:9544
- C:\Windows\System\FdKyLVB.exe
  C:\Windows\System\FdKyLVB.exe
  2⤵
  PID:10080
- C:\Windows\System\SasEMnK.exe
  C:\Windows\System\SasEMnK.exe
  2⤵
  PID:9808
- C:\Windows\System\EiccAQD.exe
  C:\Windows\System\EiccAQD.exe
  2⤵
  PID:9836
- C:\Windows\System\CpRhghP.exe
  C:\Windows\System\CpRhghP.exe
  2⤵
  PID:9892
- C:\Windows\System\CAckTeY.exe
  C:\Windows\System\CAckTeY.exe
  2⤵
  PID:10128
- C:\Windows\System\xTxYEUx.exe
  C:\Windows\System\xTxYEUx.exe
  2⤵
  PID:8884
- C:\Windows\System\zJUkWor.exe
  C:\Windows\System\zJUkWor.exe
  2⤵
  PID:1000
- C:\Windows\System\iQIlery.exe
  C:\Windows\System\iQIlery.exe
  2⤵
  PID:10148
- C:\Windows\System\vsWmHmO.exe
  C:\Windows\System\vsWmHmO.exe
  2⤵
  PID:9632
- C:\Windows\System\vHIHjHS.exe
  C:\Windows\System\vHIHjHS.exe
  2⤵
  PID:10040
- C:\Windows\System\notGQtL.exe
  C:\Windows\System\notGQtL.exe
  2⤵
  PID:9636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BDzAZSJ.exe

Filesize
1.8MB

MD5
dfaf4a0fabbf2d7c5239e306224e7f11

SHA1
f204bc4b4987364c4d66e5bd6a7dac09c4e844b8

SHA256
9396eba57d1644a506c5961689989ee622732bcd60a3d8d643c9917ae781ca94

SHA512
9264592fa7bdf869fd47c30243f816eaa273c355bb77f3ae5d306f3432878ac0bed6c97020113dcde3c8890d52c75809b193c9b1ca14d0a157a75a079f2263d6

Download Submit
C:\Windows\system\HQbONej.exe

Filesize
1.8MB

MD5
115e481d5c92f4e895a99ebf1268c6a5

SHA1
c955e3253b115f8482129ecb251fa4436eeb9589

SHA256
c9a36131922fad1d10c7c124c738543e3f2bab9652d064d141518f3905846109

SHA512
5c2b870facf773d58b89e07405d7d575d287f741036f20624b8c9d7d7d3a08bbe70cf81d3c19fb663610b8dd4db1637c44a418e51f483b15e2295e66c0dab105

Download Submit
C:\Windows\system\IBwGDPp.exe

Filesize
1.8MB

MD5
e2f6260de827417e8a61ddedcdd29651

SHA1
da2b1db7fcd2e520264200c906174c7626860116

SHA256
453dbe089cfbe5c7aa2111633c1a491e702feb3f02d0f054fee7f1ab6f30a19e

SHA512
1f5303cb8429fd74d7bb5fd8338338dd6a4868c6a3f0ceb117913ab7af35ab1dd1c4f37f34f0aa2de8b526d70c98cf551768bcf381ffbb4a7af145e3367c59b6

Download Submit
C:\Windows\system\ISqZYxo.exe

Filesize
1.8MB

MD5
9cc945497db10ea27ca01fbf90ecdad0

SHA1
080fbb48b29d5fb0d9781bd71ec409c3cd7514a8

SHA256
577ec6a65e71fdb20847b57d60c61de924a8bcb852b0fe68d8a9e9d01db92c58

SHA512
7b4b60ae44ed5c3727e5613321710a4ffe61b1e9740befedb69a80d167f443891986c2f96f6485a1b92a65fb30d934ec98f790b8e004cb9ef5dc2282a379392c

Download Submit
C:\Windows\system\JLRzndX.exe

Filesize
1.8MB

MD5
4ca5b5b9e6fd58167b2f7dcb030c003e

SHA1
89243f6d501c2de9755f26ae77ce384d898f5ec0

SHA256
05e3c2c4d9595733ddee89dcccfaea6da9bba48b6874bc0fd077391cd69d29c0

SHA512
e53c9526017f1e464d90592bd2906a9077bea7965aedb813795c6d413f3eee360ef43a398373ad41ab4857837a2c9980bafdd6f8d308833d2314051c9ef1eb95

Download Submit
C:\Windows\system\KuqfFWu.exe

Filesize
1.8MB

MD5
07d828968c73cefe581637d8c4ea8e42

SHA1
8a306d981047eb74dc8906416d43618c4155e02c

SHA256
45dc14a9fc8a74d184dfa8f2ccae4d9bf93d18935d030b5d2f6470d98f87433a

SHA512
68821b56392b69b437c362d1e6bbfcfcd5d3c97f7cbb595a8ffe36e95754e7e30ad19c4a43aeb25a3061204d8b95ef06cfa78e5b6750d9f6caa258e8a04c0122

Download Submit
C:\Windows\system\LofLPlp.exe

Filesize
1.8MB

MD5
7f9085ca296bd4de349608cb84689544

SHA1
95e45cbfd4fdcb63fc73bc0b8e7ec4a28f0c6927

SHA256
5f5f7a1b663a3bf84a4572f1141f9c3fb38e4a4be4c29f5b1bf8e85cbd1b9c4a

SHA512
dd796cb5fac12c99e2d2252c559ebabfad60c78da061fc937288b6292831f5dd5e36660797bfb4bf997a1296c8a4cc7d9bcce6abdc75dd192686e14891861df2

Download Submit
C:\Windows\system\POLSfHM.exe

Filesize
1.8MB

MD5
553cb0e2bf4343b74ac1ef5b85c582ed

SHA1
d712c31befdca68500ea085669ba795d06cc549e

SHA256
c4719ba7f19a0f376002159bec9225ff1c2ec48ac43056313044ba3191601080

SHA512
a5f1c1b9b9784aa1db562bdff03afa912824a37d4e72572b8a3c8dfd06b10c9c68cdfc61b3acfbf2204f20067accae2db75137229ee23c732c2d1da39a3a1c4e

Download Submit
C:\Windows\system\PPwdbSD.exe

Filesize
1.8MB

MD5
7025ad836ed04567f8437ffa224ca972

SHA1
92750fb08a6b9fd04b0b50be433880c96e388f50

SHA256
46d2c467475889c3edae42802ee1ca377c59c7f06542542649ccdaa7110fa5f1

SHA512
bd855593e497c3098f2a0b7b8b63699422883a4c3d13621441809eddb8cdafa78c8e2af64b589f4d462364b6bf7aa667af8134fa9c7ee6fb548a7f194e53cd13

Download Submit
C:\Windows\system\QCvgVJK.exe

Filesize
1.8MB

MD5
ca5bfca04b79a4c0fc83c4043d6cada3

SHA1
9d0d2211c242c4c42ad4fc6f35f199a2baa1f9a5

SHA256
f9faa1dc955db689d9bbb88d7e4217b8e7872ef4bd3ebfc0e7724ff167f66b06

SHA512
02543354da749e72a6e5cef0e164bf37a2dfb4b106a160c62d67a64edf699c0024347aaabdaccf1aed382e97cf3025f3fc8f90c80d49e07e6370c6303f30440c

Download Submit
C:\Windows\system\SaWIQVz.exe

Filesize
1.8MB

MD5
428583c8af2a9d8da3b91e10977d257c

SHA1
67212df40d0745aae296f0fc2e672d46ea624a18

SHA256
151f80518e13cce87f3b4e8e828dba1a278fa02097097f670ef85bf50d9bd3a7

SHA512
d323f55c6e52b8096420abe1468cdb2b77f377cb7422d19795588589ccd8af6bfb6be0d6322d23be6a6ce8c0ac05b90db93c89a5521e955429a4421912dfb72b

Download Submit
C:\Windows\system\ToIocJa.exe

Filesize
1.8MB

MD5
a5d270337d6d75bf8500d463c97d9703

SHA1
439c88fde3cf42f78f51d66b1b8d94ad2022a6a0

SHA256
68519636bc90063ebec22c920cc4addcac60c3d1b1b04e317e11f6753453d0e8

SHA512
358401c7fb9df5c6b964ffc8b647079644732d0972aeb852776c1f5a14f7524d30bc55a2ea3ef52924cd556483013c73aca3f1a81381f1f3c1f2f087cca029e1

Download Submit
C:\Windows\system\VIEaUJf.exe

Filesize
1.8MB

MD5
20c353738ef15a00d0fff51641b8e29f

SHA1
4c1ecd7d02f4353fa6e3143305162c249aa378d1

SHA256
f6d4700e0381bffbb9f2994384bf1b122302c087ec118b5883b57038ff77432b

SHA512
3284065b284418e3d23646060d7eae0cf1d1b5c71fd010f21f9aabba1aa3fbff9f36dcd09961d29f9c373f6b054dd9a3e0f71c13baa94b3300f18f11013e8ffd

Download Submit
C:\Windows\system\ViwDYiS.exe

Filesize
1.8MB

MD5
7547690d970a9a02cbcd1b736d754c99

SHA1
bf157bcd7ea5baea66fa12f0ca745fcc1813dc91

SHA256
1fbbc92879574976460ca8f73a57ef9abade5277d3cc3534f4c6c31d9d6b6c35

SHA512
7e563eb0a805e414a3404ca599c05bbf9ca95dc2627b7dbfdb3214a984c4ea3895aa4e203268bc5ad4dcf8f543d3b788658e5a1a66a989afca1c8d552a867d90

Download Submit
C:\Windows\system\VnvkIVC.exe

Filesize
1.8MB

MD5
0729c78d3986af0c654b49dd06056ddf

SHA1
db2592a971ec4e9c69e131ae91b000bf450afc9c

SHA256
644fd6fcefa1d56767f427d17d09d7d2ec3894f21dfb4b886a2f7446b73a41f1

SHA512
c242d543d9155c4378327443d63ad8f590530c0ee3e59ba9254fc4a93a19ebdadaf757b5ca9e58b39bd57679c686667b88392384fb87ff03d34bed85a81ee2b1

Download Submit
C:\Windows\system\XnqGHYS.exe

Filesize
1.8MB

MD5
af85dc46f90d1bd93c922f614f23c11f

SHA1
5eae78432df23da94682df78c84016a2b22ed57c

SHA256
950004ede9f93cbb6042d77142ebcdbd9915c7fb5cc6256312153dec1e351f84

SHA512
072799c65ff629e935834473c4e19ce3dabbe525306446b793b1b7818a76adcec390e0acfe420d76ded0cab4acdd7fb8ff61097228b7c2d4b85587ab3cf02185

Download Submit
C:\Windows\system\Xwpcghc.exe

Filesize
1.8MB

MD5
949bf2276f9d36e455934045bbc5c8fd

SHA1
5d7b47d7c3c0f3f325578e742df22ee215c2b5dd

SHA256
0db0aa6b4d170c803a0fa53134dfe966883a808e3d95b72a5c3494badefaf0fe

SHA512
28a49a7c8a71519c5717e1d6c21f065ba825a2e5e8ca4378d863e54d3ddf4a2168a43173b67b87a6a2b2142ab61a367963d812126f7ba2838e2890d11c49ce64

Download Submit
C:\Windows\system\YIgllKt.exe

Filesize
1.8MB

MD5
fa9e3d148b2b992c8a3f38ab083a9d3c

SHA1
69759e54cad69d79ea990ec975a64ebd8e0dd4c0

SHA256
5c7b7d189e5a8a1c294c055fc0918028b9e73d68acd675b19ab1fe538ff2b5c0

SHA512
464f0d3640d68ad4bfd259eea2c97e8834991a94eec9fb985719b11c61273c79e672e186109153005befbcffe3a838edff96ead28fc0e662927e3961161358c4

Download Submit
C:\Windows\system\aypLHTP.exe

Filesize
1.8MB

MD5
6e294343d823be89aba42a8c3700d64a

SHA1
f247ea7ad994b55f667742d051f023d320c10e9f

SHA256
bdbb66461c374b1854a569609e5b18cf9f7c9a7eb02f85d164b4b72270baaa5f

SHA512
e50dee95257f688221a474fab50157708b8f1ca937ed156fc6603114508194a657f725045485b700fd7b0c40d9917b3ee5419f5ebb2fff22073717b350113657

Download Submit
C:\Windows\system\dKJNRsO.exe

Filesize
1.8MB

MD5
798ae0e75d8ed3ac67aeee41953c4c6f

SHA1
8851db18dd8066d55e7cc1706f60c764dd5880aa

SHA256
d2a730d03d6fc4d13ec2526d24723fb8e2aeec7c898985e182196d86373c9de7

SHA512
5909f0411c3223443ce4a769f25f2f4a5207aab4d1b260e9be952df636df9c76c905bf4fcb2a2173a63c19b2cee493685f6332023b19d560513d88a682ad2ca4

Download Submit
C:\Windows\system\faqpWgk.exe

Filesize
1.8MB

MD5
91f5d6566d03a167eb73f3d4ee3ec4db

SHA1
0050c3afe63acf8c58780efe474338519e6048d3

SHA256
b2bb18ee792e09f8a3d9330fae8f499cf899543f5d97b92431da29298df286d5

SHA512
135aff4fe0d7d42ec065ec3965593c99860f314e308ea569c99f1e83be792389c6b30a693792948d2dfaad8c0a99259f602fe8c7ce9209729b609563b5002aee

Download Submit
C:\Windows\system\gDIUowX.exe

Filesize
1.8MB

MD5
8087e5e90e94db62f2c45a0a9149c8a0

SHA1
74b75ee95510a5cfe722231f586b87e204464b23

SHA256
c71f42b19daab73ba19ee4d4accf1037158e317894764e1366f6df5e12ba43b9

SHA512
441dae30d514709d1cc85857df89334cfda2625dc4e72f919d163c76c4b25b37258fd728b90921e69b4f4d1de9f9cec33073ade71d5f7e6a4559ad0ceeb56737

Download Submit
C:\Windows\system\gltPNzZ.exe

Filesize
1.8MB

MD5
3c6930068ed8ebc68e0884797e60344c

SHA1
21cae915e51c236559b86f09dbcb4ec113dd7a6f

SHA256
0532ec98e327c21a20f47a1801decd7a436b2eab67421e99707c5ec7a3d13ced

SHA512
bc7b9f79e99899bfd85762d831c832feb003e952a4d74badee57253967898c46e4913effcaa60321fff052904c291a4d85fcf3ff4afb30adb60b8f9d2252ef19

Download Submit
C:\Windows\system\hHfTOqw.exe

Filesize
1.8MB

MD5
2cd9a524fe6ba158d988a52be65e6a63

SHA1
43666b919b5d3d2be4912454ae3f94e7888c5361

SHA256
ed150003b72c97955f8d4c5fb3fe5be157e43d5e22a830b9c3ea764039593bbf

SHA512
574b47dbd64dd43b7f0942f009212ed8c1076264fa9b3fde3fda7f429f44c311ceac629c239fc04e9be6e1707982c1ac28cf84ea75a5661c6d431dd085116add

Download Submit
C:\Windows\system\jIyGsgr.exe

Filesize
1.8MB

MD5
a5c004a441ddb3fae56a217636b2f4d0

SHA1
a3e00f2fc04ef99ca81852d09b3be9a60b4a76b7

SHA256
f8c19d8e5f498e247ebb2ffaa463c3b9b14b638b3c420c6ee2c204362ed52000

SHA512
4ec536586aa86071ceab75f90ebea40c1b5d4ff8abc1633ec1c93e9a6a293cddbe52174fd093b3a76b9048cf0da6a36ac0c5d4466d3ad88d9a231704c6c1f08c

Download Submit
C:\Windows\system\jNNzStS.exe

Filesize
1.8MB

MD5
683eef31a670c520cb33ca14a02c9b0d

SHA1
98e7b211106dbc9a81369748225b8a79f70cf762

SHA256
d2c9cdd7e53a9659ef2cf609cfe7743761d863dd412c0610171fbf26224830ff

SHA512
a2eda2a814ece4d494e56e68ddd8626f6d8acb3cc37993ab0f8b8239994af7d7d983fb37c6a77eddc7a46a404c1e7a828a7d0542f60dccefd6a0accb5ed0fa01

Download Submit
C:\Windows\system\mRlFxYP.exe

Filesize
1.8MB

MD5
98cc823cc035c3e8e1af4f8b135a6510

SHA1
87e4759e7b1da127e6acd6e1817027459d0c8bc0

SHA256
fbda03e5e8cc146b978daae6df15fde7eb27a5832a2f304ab4a9a13c806e4571

SHA512
f683b1a5278b02746d4deea011b02de1224814e80a789a92ad75cd48ba8a3b9b0c0e73bfe1c01cf5b606ffc6330ab47ca0ab0985043da39fd0d6777ed3656e29

Download Submit
C:\Windows\system\ncxyqSu.exe

Filesize
1.8MB

MD5
603e5cacdd17ce15c4fbe6aa1761b384

SHA1
73415d23b11010bba1cf1984a6d7b6ac1ab6bbb3

SHA256
01727ce424a47150670842fbba6adba0c351a38f1b700f23e5a8eca2ced87637

SHA512
86082e2552b68a7162413b7d509c356f42e64f8a913a4353d3730009a7c45476885d8d7e15e5e1719dc0b5565edb18be46c7de1d582f548160bf284659f24591

Download Submit
C:\Windows\system\qJtKDSr.exe

Filesize
1.8MB

MD5
296bfc4eb65f5f3aabcf5f7115c4bc59

SHA1
471a9d64035b2beeabe53dd685649e3ffb9809ea

SHA256
aa2e2b5c38459ca1968a10aa52dd8b64f3876a63b11e5ee741de8aba870d0f81

SHA512
aa4c98f6d6c4e51132fe54bef7a1348fad1cca830a873bc2e45068a10d501e6cf01fd4701dd4aaa8ecabf683f23e4eca7fb5a4d5bdc2cf672cdbbb0a1df27c7a

Download Submit
C:\Windows\system\vCdJQYl.exe

Filesize
1.8MB

MD5
734705130b04ad8281ff895386e68225

SHA1
dccaad1ce0c84b1d48cda6e80c22ae327fe4d0dc

SHA256
d6a1d61eabdce712150679ea1ca521f9955368b3bb09404935a1a774f8f639b4

SHA512
267311d23021536d578607276a3942222e9efdbba69b7062edef5a9e43be444716a234a134130b1f7e12bed37853e30aa1558666fc32d7f3205345dfa42c588e

Download Submit
\Windows\system\FMiAiZL.exe

Filesize
1.8MB

MD5
eee4c59af13cdf921dbce2779bf0d0f9

SHA1
a29e015dd051435755f7799d68b4884994bbe6ab

SHA256
fe37f237e3aa16b4ef096cfd75e6048ca8c403fb5d4bb4e03affcb1a91afad24

SHA512
cd1934fd76d17550844f622bdc673e4ada389d70f52a489a47ccd1496c43262be77e5480cd7b31855da99e1eb9e60f56c0e8c16e4d4a49630bec3669e6133349

Download Submit
\Windows\system\nZuqbbr.exe

Filesize
1.8MB

MD5
22e634cd65a1cab9c179613913ac6d18

SHA1
a6935db13459af42653e3048b57235b80f1b0233

SHA256
ec6a420b89353d48cf6f4324ca4765512afa35c0c71e24e222169b159ffc13ab

SHA512
928dfd5a2ec26e818bafca69e41d984495e29555eeeeaef1ec5b9e11de0071c5693ba489f4d07e9744eac5174954626888fa89c35b79e65dd139cff1645529f8

Download Submit
\Windows\system\raDcbzD.exe

Filesize
1.8MB

MD5
6028568763f98074773210780648d5b8

SHA1
b520ae988d72d99bb2df44c307d2eb3e4369d544

SHA256
f9da8c941e5bd6489f9fff4f06355a51ab5e91f788862922410aeff77c99a3e5

SHA512
6b1b5d5bd379984141f1aff9cf9232f81b82a86450f3604de1c569a755bd0a10093b32067ab3677ecc80d2ecc27e068d8631ad23a111da2e8ca7ca635aaf5072

Download Submit
memory/1748-243-0x000000013F6A0000-0x000000013FA92000-memory.dmp

Filesize
3.9MB

Download
memory/1748-4189-0x000000013F6A0000-0x000000013FA92000-memory.dmp

Filesize
3.9MB

Download
memory/1876-13-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download
memory/1876-4179-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download
memory/2276-4192-0x000000013FFC0000-0x00000001403B2000-memory.dmp

Filesize
3.9MB

Download
memory/2276-25-0x000000013FFC0000-0x00000001403B2000-memory.dmp

Filesize
3.9MB

Download
memory/2332-4180-0x000000013F7F0000-0x000000013FBE2000-memory.dmp

Filesize
3.9MB

Download
memory/2332-27-0x000000013F7F0000-0x000000013FBE2000-memory.dmp

Filesize
3.9MB

Download
memory/2392-33-0x000007FEF571E000-0x000007FEF571F000-memory.dmp

Filesize
4KB

Download
memory/2392-222-0x000007FEF5460000-0x000007FEF5DFD000-memory.dmp

Filesize
9.6MB

Download
memory/2392-135-0x000000001B500000-0x000000001B7E2000-memory.dmp

Filesize
2.9MB

Download
memory/2392-145-0x00000000022B0000-0x00000000022B8000-memory.dmp

Filesize
32KB

Download
memory/2392-280-0x000007FEF5460000-0x000007FEF5DFD000-memory.dmp

Filesize
9.6MB

Download
memory/2392-23-0x00000000029B0000-0x0000000002A30000-memory.dmp

Filesize
512KB

Download
memory/2392-28-0x00000000029B0000-0x0000000002A30000-memory.dmp

Filesize
512KB

Download
memory/2412-0-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2412-240-0x0000000002FF0000-0x00000000033E2000-memory.dmp

Filesize
3.9MB

Download
memory/2412-232-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/2412-246-0x0000000002FF0000-0x00000000033E2000-memory.dmp

Filesize
3.9MB

Download
memory/2412-8-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download
memory/2412-242-0x000000013F6A0000-0x000000013FA92000-memory.dmp

Filesize
3.9MB

Download
memory/2412-248-0x000000013F270000-0x000000013F662000-memory.dmp

Filesize
3.9MB

Download
memory/2412-228-0x0000000002FF0000-0x00000000033E2000-memory.dmp

Filesize
3.9MB

Download
memory/2412-250-0x0000000002FF0000-0x00000000033E2000-memory.dmp

Filesize
3.9MB

Download
memory/2412-31-0x0000000002FF0000-0x00000000033E2000-memory.dmp

Filesize
3.9MB

Download
memory/2412-1-0x000000013FEA0000-0x0000000140292000-memory.dmp

Filesize
3.9MB

Download
memory/2412-244-0x0000000002FF0000-0x00000000033E2000-memory.dmp

Filesize
3.9MB

Download
memory/2412-22-0x000000013F7F0000-0x000000013FBE2000-memory.dmp

Filesize
3.9MB

Download
memory/2612-4190-0x000000013FE10000-0x0000000140202000-memory.dmp

Filesize
3.9MB

Download
memory/2612-247-0x000000013FE10000-0x0000000140202000-memory.dmp

Filesize
3.9MB

Download
memory/2648-3922-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/2648-245-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/2712-233-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/2712-4183-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/2716-249-0x000000013F270000-0x000000013F662000-memory.dmp

Filesize
3.9MB

Download
memory/2716-4193-0x000000013F270000-0x000000013F662000-memory.dmp

Filesize
3.9MB

Download
memory/2720-229-0x000000013FD70000-0x0000000140162000-memory.dmp

Filesize
3.9MB

Download
memory/2720-4181-0x000000013FD70000-0x0000000140162000-memory.dmp

Filesize
3.9MB

Download
memory/2788-4178-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download
memory/2788-241-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download
memory/2852-231-0x000000013F710000-0x000000013FB02000-memory.dmp

Filesize
3.9MB

Download
memory/2852-4273-0x000000013F710000-0x000000013FB02000-memory.dmp

Filesize
3.9MB

Download
memory/2864-253-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download
memory/2864-4270-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download