xmrig | 0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce

Analysis

max time kernel
150s
max time network
144s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 18:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
Size

1.8MB
MD5

aefbcb4da46707859ea9ed001139bcd7
SHA1

31a4b9898cdde46da4d7dfcc0e1a0fa8a2975048
SHA256

0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce
SHA512

c30a89bd6bc34e8748c8243376e59feb3c934ac25d6d289934c45e810d88e6303820699b3307ad1d5b1ba83650a4505ad1e7c8b9e40709eab37edfd25699c62c
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pPg8d7:NABj

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 17 IoCs

miner

resource	yara_rule
behavioral1/memory/2404-26-0x000000013FE10000-0x0000000140202000-memory.dmp	xmrig
behavioral1/memory/2168-65-0x000000013F840000-0x000000013FC32000-memory.dmp	xmrig
behavioral1/memory/2836-70-0x000000013FFC0000-0x00000001403B2000-memory.dmp	xmrig
behavioral1/memory/1860-63-0x000000013FD90000-0x0000000140182000-memory.dmp	xmrig
behavioral1/memory/2612-60-0x000000013FF00000-0x00000001402F2000-memory.dmp	xmrig
behavioral1/memory/2504-59-0x000000013F450000-0x000000013F842000-memory.dmp	xmrig
behavioral1/memory/2576-54-0x000000013F780000-0x000000013FB72000-memory.dmp	xmrig
behavioral1/memory/2108-35-0x000000013FC90000-0x0000000140082000-memory.dmp	xmrig
behavioral1/memory/1728-105-0x000000013FCB0000-0x00000001400A2000-memory.dmp	xmrig
behavioral1/memory/1860-4773-0x000000013FD90000-0x0000000140182000-memory.dmp	xmrig
behavioral1/memory/2504-4775-0x000000013F450000-0x000000013F842000-memory.dmp	xmrig
behavioral1/memory/2612-4781-0x000000013FF00000-0x00000001402F2000-memory.dmp	xmrig
behavioral1/memory/2404-4789-0x000000013FE10000-0x0000000140202000-memory.dmp	xmrig
behavioral1/memory/2168-4831-0x000000013F840000-0x000000013FC32000-memory.dmp	xmrig
behavioral1/memory/2156-4823-0x000000013FA30000-0x000000013FE22000-memory.dmp	xmrig
behavioral1/memory/1728-4836-0x000000013FCB0000-0x00000001400A2000-memory.dmp	xmrig
behavioral1/memory/2836-4797-0x000000013FFC0000-0x00000001403B2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
316	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2404	Gnmmipt.exe
2108	OYSXYhU.exe
1860	XfPeNaS.exe
2576	HeXnDsd.exe
2168	yokkqls.exe
2504	ksYDNqn.exe
2612	fGBoJXh.exe
2836	cohUfVh.exe
2156	iFxyMXa.exe
1728	qoQkHug.exe
2072	gkAexSr.exe
812	PZnzFeV.exe
2508	DNBlhaC.exe
320	ZZsjTXm.exe
1868	jJPDCbz.exe
1648	tIrkhmE.exe
1500	jxCiroj.exe
1164	dzLvasp.exe
2904	XwBhRHS.exe
2484	xMNXQjD.exe
1636	VfjBYZL.exe
236	cVPYpuC.exe
1608	rzLjGxZ.exe
1976	nWSZYaM.exe
2060	OZHLmLG.exe
2988	rSjmUsb.exe
568	QMRCuTK.exe
2980	rdcEHzm.exe
1036	ALkgGJI.exe
1764	AzgfFXh.exe
2068	mAYasBB.exe
1696	rPZbsmj.exe
820	AyGYJkM.exe
3020	kmyJqTK.exe
1136	teJkzyD.exe
2940	rTVMNum.exe
1760	fQzgwko.exe
3092	MSwlosp.exe
3136	EhSiFAi.exe
2668	hvwvick.exe
3172	yWGMcqw.exe
3208	tULQfEQ.exe
684	NqbqwFy.exe
3248	StSWjiU.exe
3280	ayRURye.exe
3320	pCBwEmh.exe
592	AIjsKuW.exe
3360	qbLhjet.exe
3396	mRXrLRs.exe
2008	QHxMsIy.exe
3436	ZBWvaeW.exe
3468	iPeynPN.exe
3500	XrfRltK.exe
2020	NjTeRKH.exe
3548	IuIEnvf.exe
3580	nhOqIAM.exe
3616	xxiphpy.exe
3652	tgFcEfI.exe
3688	qOAUBev.exe
604	aFeFsbA.exe
1332	HlayCRP.exe
3720	hddZGjb.exe
3752	haIaeka.exe
3784	dZKktnq.exe

Loads dropped DLL 64 IoCs

pid	Process
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe

UPX packed file 59 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2572-0-0x000000013FD80000-0x0000000140172000-memory.dmp	upx
behavioral1/files/0x0008000000016de9-7.dat	upx
behavioral1/files/0x0007000000012115-3.dat	upx
behavioral1/files/0x0008000000017487-16.dat	upx
behavioral1/files/0x000a000000018671-23.dat	upx
behavioral1/files/0x000500000001927c-36.dat	upx
behavioral1/memory/2404-26-0x000000013FE10000-0x0000000140202000-memory.dmp	upx
behavioral1/files/0x000600000001867d-29.dat	upx
behavioral1/files/0x0008000000016ec4-27.dat	upx
behavioral1/files/0x00070000000174ca-20.dat	upx
behavioral1/files/0x00050000000194a1-111.dat	upx
behavioral1/files/0x0005000000019617-162.dat	upx
behavioral1/files/0x000500000001961d-168.dat	upx
behavioral1/files/0x0005000000019623-178.dat	upx
behavioral1/files/0x0005000000019330-39.dat	upx
behavioral1/memory/2168-65-0x000000013F840000-0x000000013FC32000-memory.dmp	upx
behavioral1/files/0x000500000001948a-95.dat	upx
behavioral1/files/0x000500000001943b-89.dat	upx
behavioral1/memory/2156-84-0x000000013FA30000-0x000000013FE22000-memory.dmp	upx
behavioral1/files/0x00050000000193ae-82.dat	upx
behavioral1/files/0x000500000001934a-78.dat	upx
behavioral1/files/0x0007000000004e74-75.dat	upx
behavioral1/files/0x00070000000186e4-71.dat	upx
behavioral1/memory/2836-70-0x000000013FFC0000-0x00000001403B2000-memory.dmp	upx
behavioral1/memory/1860-63-0x000000013FD90000-0x0000000140182000-memory.dmp	upx
behavioral1/memory/2612-60-0x000000013FF00000-0x00000001402F2000-memory.dmp	upx
behavioral1/memory/2504-59-0x000000013F450000-0x000000013F842000-memory.dmp	upx
behavioral1/memory/2576-54-0x000000013F780000-0x000000013FB72000-memory.dmp	upx
behavioral1/memory/2108-35-0x000000013FC90000-0x0000000140082000-memory.dmp	upx
behavioral1/files/0x0005000000019637-186.dat	upx
behavioral1/files/0x0005000000019621-180.dat	upx
behavioral1/files/0x000500000001961f-171.dat	upx
behavioral1/files/0x000500000001961b-165.dat	upx
behavioral1/files/0x0005000000019619-149.dat	upx
behavioral1/files/0x00050000000195e6-139.dat	upx
behavioral1/files/0x000500000001957d-133.dat	upx
behavioral1/files/0x0005000000019506-127.dat	upx
behavioral1/files/0x00050000000194fa-121.dat	upx
behavioral1/files/0x00050000000194e5-115.dat	upx
behavioral1/files/0x00060000000193aa-107.dat	upx
behavioral1/memory/1728-105-0x000000013FCB0000-0x00000001400A2000-memory.dmp	upx
behavioral1/files/0x00050000000194b1-103.dat	upx
behavioral1/files/0x0005000000019625-185.dat	upx
behavioral1/files/0x000500000001961a-163.dat	upx
behavioral1/files/0x00050000000195a1-161.dat	upx
behavioral1/files/0x0005000000019571-160.dat	upx
behavioral1/files/0x0005000000019504-159.dat	upx
behavioral1/files/0x00050000000194f0-158.dat	upx
behavioral1/files/0x00050000000194c1-157.dat	upx
behavioral1/files/0x0005000000019449-110.dat	upx
behavioral1/files/0x00050000000193bc-109.dat	upx
behavioral1/memory/1860-4773-0x000000013FD90000-0x0000000140182000-memory.dmp	upx
behavioral1/memory/2504-4775-0x000000013F450000-0x000000013F842000-memory.dmp	upx
behavioral1/memory/2612-4781-0x000000013FF00000-0x00000001402F2000-memory.dmp	upx
behavioral1/memory/2404-4789-0x000000013FE10000-0x0000000140202000-memory.dmp	upx
behavioral1/memory/2168-4831-0x000000013F840000-0x000000013FC32000-memory.dmp	upx
behavioral1/memory/2156-4823-0x000000013FA30000-0x000000013FE22000-memory.dmp	upx
behavioral1/memory/1728-4836-0x000000013FCB0000-0x00000001400A2000-memory.dmp	upx
behavioral1/memory/2836-4797-0x000000013FFC0000-0x00000001403B2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\SxokCYQ.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\gENjgHB.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\RpBzCpj.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\wgHfMfS.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\lNmMCCf.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\DGQEotS.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\UJYrQeu.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\FjmQgIb.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\THmDfwz.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\EINTeEt.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\ciKaqPA.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\MdxmqcP.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\JnSZqiG.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\lMLSCyV.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\jxuUnmW.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\bPYOjFW.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\nnkoFkC.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\JGpQvoA.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\ZkKxoRq.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\HCyEHCF.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\xFDnzUi.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\SEmTFOS.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\RdEkalk.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\KtQcWiH.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\eyDHHjr.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\NdiLqNA.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\RcrvLWF.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\HLvfjkr.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\MYdytDc.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\srOdrst.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\SdUkzXO.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\gkbZSfv.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\gYTwDHd.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\smlLeId.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\BKnRlQD.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\rSbPjhw.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\qOAUBev.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\zJxafiZ.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\XRLXBjy.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\ycYOKYA.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\kNeWKIz.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\jVlpnzM.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\dJonLJh.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\jeWISVm.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\FHyAOsN.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\yifFHGi.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\sNrlWvn.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\EHHakKb.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\uXjTclY.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\omXGFEB.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\gjLjheY.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\zqdeXwR.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\tULQfEQ.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\gnXSqGH.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\eqAKkWo.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\yhwBkFB.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\gJUXvnv.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\OqazzJq.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\jfsYxgp.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\xSOsCKe.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\WYMUXPa.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\cXAwFZF.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\ouQvEXO.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
File created	C:\Windows\System\VbMZodC.exe	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
316	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
Token: SeLockMemoryPrivilege	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
Token: SeDebugPrivilege	316	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 316	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	31
PID 2572 wrote to memory of 316	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	31
PID 2572 wrote to memory of 316	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	31
PID 2572 wrote to memory of 2108	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	32
PID 2572 wrote to memory of 2108	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	32
PID 2572 wrote to memory of 2108	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	32
PID 2572 wrote to memory of 2404	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	33
PID 2572 wrote to memory of 2404	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	33
PID 2572 wrote to memory of 2404	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	33
PID 2572 wrote to memory of 1860	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	34
PID 2572 wrote to memory of 1860	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	34
PID 2572 wrote to memory of 1860	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	34
PID 2572 wrote to memory of 2168	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	35
PID 2572 wrote to memory of 2168	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	35
PID 2572 wrote to memory of 2168	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	35
PID 2572 wrote to memory of 2576	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	36
PID 2572 wrote to memory of 2576	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	36
PID 2572 wrote to memory of 2576	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	36
PID 2572 wrote to memory of 2836	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	37
PID 2572 wrote to memory of 2836	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	37
PID 2572 wrote to memory of 2836	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	37
PID 2572 wrote to memory of 2504	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	38
PID 2572 wrote to memory of 2504	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	38
PID 2572 wrote to memory of 2504	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	38
PID 2572 wrote to memory of 2156	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	39
PID 2572 wrote to memory of 2156	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	39
PID 2572 wrote to memory of 2156	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	39
PID 2572 wrote to memory of 2612	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	40
PID 2572 wrote to memory of 2612	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	40
PID 2572 wrote to memory of 2612	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	40
PID 2572 wrote to memory of 2940	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	41
PID 2572 wrote to memory of 2940	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	41
PID 2572 wrote to memory of 2940	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	41
PID 2572 wrote to memory of 1728	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	42
PID 2572 wrote to memory of 1728	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	42
PID 2572 wrote to memory of 1728	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	42
PID 2572 wrote to memory of 2668	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	43
PID 2572 wrote to memory of 2668	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	43
PID 2572 wrote to memory of 2668	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	43
PID 2572 wrote to memory of 2072	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	44
PID 2572 wrote to memory of 2072	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	44
PID 2572 wrote to memory of 2072	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	44
PID 2572 wrote to memory of 684	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	45
PID 2572 wrote to memory of 684	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	45
PID 2572 wrote to memory of 684	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	45
PID 2572 wrote to memory of 812	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	46
PID 2572 wrote to memory of 812	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	46
PID 2572 wrote to memory of 812	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	46
PID 2572 wrote to memory of 592	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	47
PID 2572 wrote to memory of 592	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	47
PID 2572 wrote to memory of 592	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	47
PID 2572 wrote to memory of 2508	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	48
PID 2572 wrote to memory of 2508	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	48
PID 2572 wrote to memory of 2508	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	48
PID 2572 wrote to memory of 2008	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	49
PID 2572 wrote to memory of 2008	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	49
PID 2572 wrote to memory of 2008	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	49
PID 2572 wrote to memory of 320	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	50
PID 2572 wrote to memory of 320	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	50
PID 2572 wrote to memory of 320	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	50
PID 2572 wrote to memory of 2020	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	51
PID 2572 wrote to memory of 2020	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	51
PID 2572 wrote to memory of 2020	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	51
PID 2572 wrote to memory of 1868	2572	0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe	52

C:\Users\Admin\AppData\Local\Temp\0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe
"C:\Users\Admin\AppData\Local\Temp\0f182a248427d200b9adcaeffe18bea7ea959d66c24702c4a0bbf8a40eb2d3ce.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:316
- C:\Windows\System\OYSXYhU.exe
  C:\Windows\System\OYSXYhU.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\Gnmmipt.exe
  C:\Windows\System\Gnmmipt.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\XfPeNaS.exe
  C:\Windows\System\XfPeNaS.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\yokkqls.exe
  C:\Windows\System\yokkqls.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\HeXnDsd.exe
  C:\Windows\System\HeXnDsd.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\cohUfVh.exe
  C:\Windows\System\cohUfVh.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\ksYDNqn.exe
  C:\Windows\System\ksYDNqn.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\iFxyMXa.exe
  C:\Windows\System\iFxyMXa.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\fGBoJXh.exe
  C:\Windows\System\fGBoJXh.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\rTVMNum.exe
  C:\Windows\System\rTVMNum.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\qoQkHug.exe
  C:\Windows\System\qoQkHug.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\hvwvick.exe
  C:\Windows\System\hvwvick.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\gkAexSr.exe
  C:\Windows\System\gkAexSr.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\NqbqwFy.exe
  C:\Windows\System\NqbqwFy.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\PZnzFeV.exe
  C:\Windows\System\PZnzFeV.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\AIjsKuW.exe
  C:\Windows\System\AIjsKuW.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\DNBlhaC.exe
  C:\Windows\System\DNBlhaC.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\QHxMsIy.exe
  C:\Windows\System\QHxMsIy.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\ZZsjTXm.exe
  C:\Windows\System\ZZsjTXm.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\NjTeRKH.exe
  C:\Windows\System\NjTeRKH.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\jJPDCbz.exe
  C:\Windows\System\jJPDCbz.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\aFeFsbA.exe
  C:\Windows\System\aFeFsbA.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\tIrkhmE.exe
  C:\Windows\System\tIrkhmE.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\HlayCRP.exe
  C:\Windows\System\HlayCRP.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\jxCiroj.exe
  C:\Windows\System\jxCiroj.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\xCwWSAb.exe
  C:\Windows\System\xCwWSAb.exe
  2⤵
  PID:1272
- C:\Windows\System\dzLvasp.exe
  C:\Windows\System\dzLvasp.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\BGEVWtB.exe
  C:\Windows\System\BGEVWtB.exe
  2⤵
  PID:1512
- C:\Windows\System\XwBhRHS.exe
  C:\Windows\System\XwBhRHS.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\LKuTTth.exe
  C:\Windows\System\LKuTTth.exe
  2⤵
  PID:2700
- C:\Windows\System\xMNXQjD.exe
  C:\Windows\System\xMNXQjD.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\LwCJuNm.exe
  C:\Windows\System\LwCJuNm.exe
  2⤵
  PID:408
- C:\Windows\System\VfjBYZL.exe
  C:\Windows\System\VfjBYZL.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\vpzzEXe.exe
  C:\Windows\System\vpzzEXe.exe
  2⤵
  PID:768
- C:\Windows\System\cVPYpuC.exe
  C:\Windows\System\cVPYpuC.exe
  2⤵
  - Executes dropped EXE
  PID:236
- C:\Windows\System\zqnlcdi.exe
  C:\Windows\System\zqnlcdi.exe
  2⤵
  PID:1756
- C:\Windows\System\rzLjGxZ.exe
  C:\Windows\System\rzLjGxZ.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\fqCoCjs.exe
  C:\Windows\System\fqCoCjs.exe
  2⤵
  PID:772
- C:\Windows\System\nWSZYaM.exe
  C:\Windows\System\nWSZYaM.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\qhlzkrD.exe
  C:\Windows\System\qhlzkrD.exe
  2⤵
  PID:1020
- C:\Windows\System\OZHLmLG.exe
  C:\Windows\System\OZHLmLG.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\xgImONp.exe
  C:\Windows\System\xgImONp.exe
  2⤵
  PID:2440
- C:\Windows\System\rSjmUsb.exe
  C:\Windows\System\rSjmUsb.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\WtiNkzO.exe
  C:\Windows\System\WtiNkzO.exe
  2⤵
  PID:2996
- C:\Windows\System\QMRCuTK.exe
  C:\Windows\System\QMRCuTK.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\JTSLwGt.exe
  C:\Windows\System\JTSLwGt.exe
  2⤵
  PID:1844
- C:\Windows\System\rdcEHzm.exe
  C:\Windows\System\rdcEHzm.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\RhUXFNi.exe
  C:\Windows\System\RhUXFNi.exe
  2⤵
  PID:3048
- C:\Windows\System\ALkgGJI.exe
  C:\Windows\System\ALkgGJI.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\nUlDBhU.exe
  C:\Windows\System\nUlDBhU.exe
  2⤵
  PID:1936
- C:\Windows\System\AzgfFXh.exe
  C:\Windows\System\AzgfFXh.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\WGLKxZN.exe
  C:\Windows\System\WGLKxZN.exe
  2⤵
  PID:1792
- C:\Windows\System\mAYasBB.exe
  C:\Windows\System\mAYasBB.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\WagPsYv.exe
  C:\Windows\System\WagPsYv.exe
  2⤵
  PID:1564
- C:\Windows\System\rPZbsmj.exe
  C:\Windows\System\rPZbsmj.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\FgGZMDF.exe
  C:\Windows\System\FgGZMDF.exe
  2⤵
  PID:2752
- C:\Windows\System\AyGYJkM.exe
  C:\Windows\System\AyGYJkM.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\xZPteQr.exe
  C:\Windows\System\xZPteQr.exe
  2⤵
  PID:2840
- C:\Windows\System\kmyJqTK.exe
  C:\Windows\System\kmyJqTK.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\NnPalyi.exe
  C:\Windows\System\NnPalyi.exe
  2⤵
  PID:1504
- C:\Windows\System\teJkzyD.exe
  C:\Windows\System\teJkzyD.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\fPpCwhX.exe
  C:\Windows\System\fPpCwhX.exe
  2⤵
  PID:1768
- C:\Windows\System\fQzgwko.exe
  C:\Windows\System\fQzgwko.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\DQUFcFC.exe
  C:\Windows\System\DQUFcFC.exe
  2⤵
  PID:3076
- C:\Windows\System\MSwlosp.exe
  C:\Windows\System\MSwlosp.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\VWMhoqT.exe
  C:\Windows\System\VWMhoqT.exe
  2⤵
  PID:3112
- C:\Windows\System\EhSiFAi.exe
  C:\Windows\System\EhSiFAi.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\VJNKNrA.exe
  C:\Windows\System\VJNKNrA.exe
  2⤵
  PID:3152
- C:\Windows\System\yWGMcqw.exe
  C:\Windows\System\yWGMcqw.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\dgWoMIo.exe
  C:\Windows\System\dgWoMIo.exe
  2⤵
  PID:3188
- C:\Windows\System\tULQfEQ.exe
  C:\Windows\System\tULQfEQ.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\UOnXrye.exe
  C:\Windows\System\UOnXrye.exe
  2⤵
  PID:3224
- C:\Windows\System\StSWjiU.exe
  C:\Windows\System\StSWjiU.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\sFUPViA.exe
  C:\Windows\System\sFUPViA.exe
  2⤵
  PID:3264
- C:\Windows\System\ayRURye.exe
  C:\Windows\System\ayRURye.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\bPFohpa.exe
  C:\Windows\System\bPFohpa.exe
  2⤵
  PID:3300
- C:\Windows\System\pCBwEmh.exe
  C:\Windows\System\pCBwEmh.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\atGQmze.exe
  C:\Windows\System\atGQmze.exe
  2⤵
  PID:3336
- C:\Windows\System\qbLhjet.exe
  C:\Windows\System\qbLhjet.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\TeGTqek.exe
  C:\Windows\System\TeGTqek.exe
  2⤵
  PID:3376
- C:\Windows\System\mRXrLRs.exe
  C:\Windows\System\mRXrLRs.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System\gJPJEgF.exe
  C:\Windows\System\gJPJEgF.exe
  2⤵
  PID:3412
- C:\Windows\System\ZBWvaeW.exe
  C:\Windows\System\ZBWvaeW.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\AHNenKd.exe
  C:\Windows\System\AHNenKd.exe
  2⤵
  PID:3452
- C:\Windows\System\iPeynPN.exe
  C:\Windows\System\iPeynPN.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\kqLBLCI.exe
  C:\Windows\System\kqLBLCI.exe
  2⤵
  PID:3484
- C:\Windows\System\XrfRltK.exe
  C:\Windows\System\XrfRltK.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\LyVBmCk.exe
  C:\Windows\System\LyVBmCk.exe
  2⤵
  PID:3524
- C:\Windows\System\IuIEnvf.exe
  C:\Windows\System\IuIEnvf.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\QNpghIe.exe
  C:\Windows\System\QNpghIe.exe
  2⤵
  PID:3564
- C:\Windows\System\nhOqIAM.exe
  C:\Windows\System\nhOqIAM.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\qlCqCPQ.exe
  C:\Windows\System\qlCqCPQ.exe
  2⤵
  PID:3596
- C:\Windows\System\xxiphpy.exe
  C:\Windows\System\xxiphpy.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\GzyaozT.exe
  C:\Windows\System\GzyaozT.exe
  2⤵
  PID:3632
- C:\Windows\System\tgFcEfI.exe
  C:\Windows\System\tgFcEfI.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\ehNCiyl.exe
  C:\Windows\System\ehNCiyl.exe
  2⤵
  PID:3668
- C:\Windows\System\qOAUBev.exe
  C:\Windows\System\qOAUBev.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\HNknUjo.exe
  C:\Windows\System\HNknUjo.exe
  2⤵
  PID:3704
- C:\Windows\System\hddZGjb.exe
  C:\Windows\System\hddZGjb.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\vDSFgId.exe
  C:\Windows\System\vDSFgId.exe
  2⤵
  PID:3736
- C:\Windows\System\haIaeka.exe
  C:\Windows\System\haIaeka.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\rGFFcQz.exe
  C:\Windows\System\rGFFcQz.exe
  2⤵
  PID:3768
- C:\Windows\System\dZKktnq.exe
  C:\Windows\System\dZKktnq.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\RobSBxH.exe
  C:\Windows\System\RobSBxH.exe
  2⤵
  PID:3804
- C:\Windows\System\vrRECZy.exe
  C:\Windows\System\vrRECZy.exe
  2⤵
  PID:3820
- C:\Windows\System\YaIViKk.exe
  C:\Windows\System\YaIViKk.exe
  2⤵
  PID:3840
- C:\Windows\System\ljCOfRf.exe
  C:\Windows\System\ljCOfRf.exe
  2⤵
  PID:3856
- C:\Windows\System\nUfpFIN.exe
  C:\Windows\System\nUfpFIN.exe
  2⤵
  PID:3872
- C:\Windows\System\WfNeTmF.exe
  C:\Windows\System\WfNeTmF.exe
  2⤵
  PID:3888
- C:\Windows\System\sdFRFYO.exe
  C:\Windows\System\sdFRFYO.exe
  2⤵
  PID:3904
- C:\Windows\System\PkGfpEp.exe
  C:\Windows\System\PkGfpEp.exe
  2⤵
  PID:3920
- C:\Windows\System\vrkCRpT.exe
  C:\Windows\System\vrkCRpT.exe
  2⤵
  PID:3936
- C:\Windows\System\HEouJNd.exe
  C:\Windows\System\HEouJNd.exe
  2⤵
  PID:3952
- C:\Windows\System\oznBvno.exe
  C:\Windows\System\oznBvno.exe
  2⤵
  PID:3972
- C:\Windows\System\pkVViQB.exe
  C:\Windows\System\pkVViQB.exe
  2⤵
  PID:3988
- C:\Windows\System\AmwesnH.exe
  C:\Windows\System\AmwesnH.exe
  2⤵
  PID:4004
- C:\Windows\System\ASNNRSy.exe
  C:\Windows\System\ASNNRSy.exe
  2⤵
  PID:4020
- C:\Windows\System\oYknUxb.exe
  C:\Windows\System\oYknUxb.exe
  2⤵
  PID:4036
- C:\Windows\System\PAhOUwC.exe
  C:\Windows\System\PAhOUwC.exe
  2⤵
  PID:4052
- C:\Windows\System\xKsyCfe.exe
  C:\Windows\System\xKsyCfe.exe
  2⤵
  PID:4068
- C:\Windows\System\HuIVQoh.exe
  C:\Windows\System\HuIVQoh.exe
  2⤵
  PID:4084
- C:\Windows\System\SXpzYAB.exe
  C:\Windows\System\SXpzYAB.exe
  2⤵
  PID:2076
- C:\Windows\System\FYyoAnw.exe
  C:\Windows\System\FYyoAnw.exe
  2⤵
  PID:1592
- C:\Windows\System\rwlrFjL.exe
  C:\Windows\System\rwlrFjL.exe
  2⤵
  PID:2240
- C:\Windows\System\IVSpqTj.exe
  C:\Windows\System\IVSpqTj.exe
  2⤵
  PID:600
- C:\Windows\System\cnxILfZ.exe
  C:\Windows\System\cnxILfZ.exe
  2⤵
  PID:2380
- C:\Windows\System\ngCKwJf.exe
  C:\Windows\System\ngCKwJf.exe
  2⤵
  PID:3104
- C:\Windows\System\ZIgWJbL.exe
  C:\Windows\System\ZIgWJbL.exe
  2⤵
  PID:3184
- C:\Windows\System\VuPRuLF.exe
  C:\Windows\System\VuPRuLF.exe
  2⤵
  PID:3260
- C:\Windows\System\tMgXCgK.exe
  C:\Windows\System\tMgXCgK.exe
  2⤵
  PID:3328
- C:\Windows\System\qXAGAjf.exe
  C:\Windows\System\qXAGAjf.exe
  2⤵
  PID:3408
- C:\Windows\System\xmGuWAq.exe
  C:\Windows\System\xmGuWAq.exe
  2⤵
  PID:3480
- C:\Windows\System\TtYXYyv.exe
  C:\Windows\System\TtYXYyv.exe
  2⤵
  PID:3512
- C:\Windows\System\yFEiYbC.exe
  C:\Windows\System\yFEiYbC.exe
  2⤵
  PID:3592
- C:\Windows\System\YxmyHdL.exe
  C:\Windows\System\YxmyHdL.exe
  2⤵
  PID:1720
- C:\Windows\System\czAwhzy.exe
  C:\Windows\System\czAwhzy.exe
  2⤵
  PID:1292
- C:\Windows\System\BpcFLUE.exe
  C:\Windows\System\BpcFLUE.exe
  2⤵
  PID:3800
- C:\Windows\System\OutCMfm.exe
  C:\Windows\System\OutCMfm.exe
  2⤵
  PID:3900
- C:\Windows\System\XHlsEnE.exe
  C:\Windows\System\XHlsEnE.exe
  2⤵
  PID:3964
- C:\Windows\System\NkbjoNj.exe
  C:\Windows\System\NkbjoNj.exe
  2⤵
  PID:4028
- C:\Windows\System\XblRrHg.exe
  C:\Windows\System\XblRrHg.exe
  2⤵
  PID:4092
- C:\Windows\System\LKFVOQc.exe
  C:\Windows\System\LKFVOQc.exe
  2⤵
  PID:648
- C:\Windows\System\BSbZaAr.exe
  C:\Windows\System\BSbZaAr.exe
  2⤵
  PID:3180
- C:\Windows\System\MnfnGSH.exe
  C:\Windows\System\MnfnGSH.exe
  2⤵
  PID:3476
- C:\Windows\System\piiOeDQ.exe
  C:\Windows\System\piiOeDQ.exe
  2⤵
  PID:3660
- C:\Windows\System\WzEJsox.exe
  C:\Windows\System\WzEJsox.exe
  2⤵
  PID:3732
- C:\Windows\System\bYuLRdj.exe
  C:\Windows\System\bYuLRdj.exe
  2⤵
  PID:1028
- C:\Windows\System\KvYvPcK.exe
  C:\Windows\System\KvYvPcK.exe
  2⤵
  PID:2924
- C:\Windows\System\zNoVRMl.exe
  C:\Windows\System\zNoVRMl.exe
  2⤵
  PID:2212
- C:\Windows\System\CURXrIr.exe
  C:\Windows\System\CURXrIr.exe
  2⤵
  PID:1956
- C:\Windows\System\wWoIPLf.exe
  C:\Windows\System\wWoIPLf.exe
  2⤵
  PID:3832
- C:\Windows\System\Ammgnxx.exe
  C:\Windows\System\Ammgnxx.exe
  2⤵
  PID:4000
- C:\Windows\System\UlacVmK.exe
  C:\Windows\System\UlacVmK.exe
  2⤵
  PID:2868
- C:\Windows\System\knAiUkS.exe
  C:\Windows\System\knAiUkS.exe
  2⤵
  PID:4100
- C:\Windows\System\jDUxZdU.exe
  C:\Windows\System\jDUxZdU.exe
  2⤵
  PID:4116
- C:\Windows\System\qxRyBoT.exe
  C:\Windows\System\qxRyBoT.exe
  2⤵
  PID:4132
- C:\Windows\System\ZmbMGUa.exe
  C:\Windows\System\ZmbMGUa.exe
  2⤵
  PID:4148
- C:\Windows\System\tWCXGhP.exe
  C:\Windows\System\tWCXGhP.exe
  2⤵
  PID:4164
- C:\Windows\System\JkhjcVD.exe
  C:\Windows\System\JkhjcVD.exe
  2⤵
  PID:4180
- C:\Windows\System\npSOnks.exe
  C:\Windows\System\npSOnks.exe
  2⤵
  PID:4196
- C:\Windows\System\UntdoaG.exe
  C:\Windows\System\UntdoaG.exe
  2⤵
  PID:4212
- C:\Windows\System\UZnsorv.exe
  C:\Windows\System\UZnsorv.exe
  2⤵
  PID:4228
- C:\Windows\System\QAKbPBY.exe
  C:\Windows\System\QAKbPBY.exe
  2⤵
  PID:4244
- C:\Windows\System\uRpitTD.exe
  C:\Windows\System\uRpitTD.exe
  2⤵
  PID:4260
- C:\Windows\System\MRvQilP.exe
  C:\Windows\System\MRvQilP.exe
  2⤵
  PID:4276
- C:\Windows\System\okVVIsF.exe
  C:\Windows\System\okVVIsF.exe
  2⤵
  PID:4296
- C:\Windows\System\rQtZEQP.exe
  C:\Windows\System\rQtZEQP.exe
  2⤵
  PID:4312
- C:\Windows\System\BKnRlQD.exe
  C:\Windows\System\BKnRlQD.exe
  2⤵
  PID:4328
- C:\Windows\System\gprqJus.exe
  C:\Windows\System\gprqJus.exe
  2⤵
  PID:4344
- C:\Windows\System\VDHJRPs.exe
  C:\Windows\System\VDHJRPs.exe
  2⤵
  PID:4444
- C:\Windows\System\pYnCNzE.exe
  C:\Windows\System\pYnCNzE.exe
  2⤵
  PID:4460
- C:\Windows\System\ewlfzUs.exe
  C:\Windows\System\ewlfzUs.exe
  2⤵
  PID:4476
- C:\Windows\System\pVcZDKU.exe
  C:\Windows\System\pVcZDKU.exe
  2⤵
  PID:4492
- C:\Windows\System\XQFFrYO.exe
  C:\Windows\System\XQFFrYO.exe
  2⤵
  PID:4508
- C:\Windows\System\ZUZLtZz.exe
  C:\Windows\System\ZUZLtZz.exe
  2⤵
  PID:4524
- C:\Windows\System\vQLNwuo.exe
  C:\Windows\System\vQLNwuo.exe
  2⤵
  PID:4540
- C:\Windows\System\ByNfBhF.exe
  C:\Windows\System\ByNfBhF.exe
  2⤵
  PID:4556
- C:\Windows\System\TfrQEmE.exe
  C:\Windows\System\TfrQEmE.exe
  2⤵
  PID:4572
- C:\Windows\System\nxRjfaK.exe
  C:\Windows\System\nxRjfaK.exe
  2⤵
  PID:4592
- C:\Windows\System\ujuxJbb.exe
  C:\Windows\System\ujuxJbb.exe
  2⤵
  PID:4608
- C:\Windows\System\ETgwucY.exe
  C:\Windows\System\ETgwucY.exe
  2⤵
  PID:4624
- C:\Windows\System\pnkiBhJ.exe
  C:\Windows\System\pnkiBhJ.exe
  2⤵
  PID:4640
- C:\Windows\System\LhaUJiF.exe
  C:\Windows\System\LhaUJiF.exe
  2⤵
  PID:4656
- C:\Windows\System\LIdfEYk.exe
  C:\Windows\System\LIdfEYk.exe
  2⤵
  PID:4672
- C:\Windows\System\hLPxpOR.exe
  C:\Windows\System\hLPxpOR.exe
  2⤵
  PID:4688
- C:\Windows\System\SZFmXhD.exe
  C:\Windows\System\SZFmXhD.exe
  2⤵
  PID:4708
- C:\Windows\System\TFanxdG.exe
  C:\Windows\System\TFanxdG.exe
  2⤵
  PID:4724
- C:\Windows\System\RGwBygr.exe
  C:\Windows\System\RGwBygr.exe
  2⤵
  PID:4740
- C:\Windows\System\QcpCAZj.exe
  C:\Windows\System\QcpCAZj.exe
  2⤵
  PID:4756
- C:\Windows\System\tlaIwdf.exe
  C:\Windows\System\tlaIwdf.exe
  2⤵
  PID:4772
- C:\Windows\System\vlQbpBe.exe
  C:\Windows\System\vlQbpBe.exe
  2⤵
  PID:4788
- C:\Windows\System\JIOSlSg.exe
  C:\Windows\System\JIOSlSg.exe
  2⤵
  PID:4808
- C:\Windows\System\qPSICAf.exe
  C:\Windows\System\qPSICAf.exe
  2⤵
  PID:4824
- C:\Windows\System\YdPmXoB.exe
  C:\Windows\System\YdPmXoB.exe
  2⤵
  PID:4840
- C:\Windows\System\igMqHHl.exe
  C:\Windows\System\igMqHHl.exe
  2⤵
  PID:4856
- C:\Windows\System\kNgsVYn.exe
  C:\Windows\System\kNgsVYn.exe
  2⤵
  PID:4872
- C:\Windows\System\xjlRkTz.exe
  C:\Windows\System\xjlRkTz.exe
  2⤵
  PID:4888
- C:\Windows\System\yUOqwsH.exe
  C:\Windows\System\yUOqwsH.exe
  2⤵
  PID:4908
- C:\Windows\System\AjSewdl.exe
  C:\Windows\System\AjSewdl.exe
  2⤵
  PID:4924
- C:\Windows\System\NCvqHMr.exe
  C:\Windows\System\NCvqHMr.exe
  2⤵
  PID:4940
- C:\Windows\System\nryHUBM.exe
  C:\Windows\System\nryHUBM.exe
  2⤵
  PID:4956
- C:\Windows\System\ZndqXWM.exe
  C:\Windows\System\ZndqXWM.exe
  2⤵
  PID:4972
- C:\Windows\System\aPgQWyC.exe
  C:\Windows\System\aPgQWyC.exe
  2⤵
  PID:4992
- C:\Windows\System\rjVlKsn.exe
  C:\Windows\System\rjVlKsn.exe
  2⤵
  PID:5008
- C:\Windows\System\rHnKZhE.exe
  C:\Windows\System\rHnKZhE.exe
  2⤵
  PID:5024
- C:\Windows\System\cvtMHgV.exe
  C:\Windows\System\cvtMHgV.exe
  2⤵
  PID:5040
- C:\Windows\System\UbMHXWo.exe
  C:\Windows\System\UbMHXWo.exe
  2⤵
  PID:5056
- C:\Windows\System\qkPapYT.exe
  C:\Windows\System\qkPapYT.exe
  2⤵
  PID:5076
- C:\Windows\System\bougjIv.exe
  C:\Windows\System\bougjIv.exe
  2⤵
  PID:5092
- C:\Windows\System\eDMWDeR.exe
  C:\Windows\System\eDMWDeR.exe
  2⤵
  PID:5108
- C:\Windows\System\WbNvIxs.exe
  C:\Windows\System\WbNvIxs.exe
  2⤵
  PID:2592
- C:\Windows\System\wJALROJ.exe
  C:\Windows\System\wJALROJ.exe
  2⤵
  PID:2936
- C:\Windows\System\iRUhZCo.exe
  C:\Windows\System\iRUhZCo.exe
  2⤵
  PID:2920
- C:\Windows\System\XMcWRaY.exe
  C:\Windows\System\XMcWRaY.exe
  2⤵
  PID:2368
- C:\Windows\System\GqJgjoH.exe
  C:\Windows\System\GqJgjoH.exe
  2⤵
  PID:2260
- C:\Windows\System\PxDTqFf.exe
  C:\Windows\System\PxDTqFf.exe
  2⤵
  PID:3864
- C:\Windows\System\FBKugcf.exe
  C:\Windows\System\FBKugcf.exe
  2⤵
  PID:3728
- C:\Windows\System\SZpVRib.exe
  C:\Windows\System\SZpVRib.exe
  2⤵
  PID:4188
- C:\Windows\System\IHUkOTx.exe
  C:\Windows\System\IHUkOTx.exe
  2⤵
  PID:4224
- C:\Windows\System\VJIIQYE.exe
  C:\Windows\System\VJIIQYE.exe
  2⤵
  PID:4292
- C:\Windows\System\aCqIiJb.exe
  C:\Windows\System\aCqIiJb.exe
  2⤵
  PID:4356
- C:\Windows\System\QGEXluF.exe
  C:\Windows\System\QGEXluF.exe
  2⤵
  PID:4372
- C:\Windows\System\ICCFqLA.exe
  C:\Windows\System\ICCFqLA.exe
  2⤵
  PID:4388
- C:\Windows\System\SgiKvIf.exe
  C:\Windows\System\SgiKvIf.exe
  2⤵
  PID:2340
- C:\Windows\System\BEbpwFk.exe
  C:\Windows\System\BEbpwFk.exe
  2⤵
  PID:4416
- C:\Windows\System\Hjiljxr.exe
  C:\Windows\System\Hjiljxr.exe
  2⤵
  PID:4432
- C:\Windows\System\FmVpUne.exe
  C:\Windows\System\FmVpUne.exe
  2⤵
  PID:2164
- C:\Windows\System\NMlBNBH.exe
  C:\Windows\System\NMlBNBH.exe
  2⤵
  PID:2880
- C:\Windows\System\NWeCOap.exe
  C:\Windows\System\NWeCOap.exe
  2⤵
  PID:3068
- C:\Windows\System\gjSORLB.exe
  C:\Windows\System\gjSORLB.exe
  2⤵
  PID:2308
- C:\Windows\System\EJuBIoO.exe
  C:\Windows\System\EJuBIoO.exe
  2⤵
  PID:3120
- C:\Windows\System\sbWxVoA.exe
  C:\Windows\System\sbWxVoA.exe
  2⤵
  PID:2736
- C:\Windows\System\cFpjZbc.exe
  C:\Windows\System\cFpjZbc.exe
  2⤵
  PID:5132
- C:\Windows\System\XTwgwqN.exe
  C:\Windows\System\XTwgwqN.exe
  2⤵
  PID:5152
- C:\Windows\System\bzzCzaZ.exe
  C:\Windows\System\bzzCzaZ.exe
  2⤵
  PID:5168
- C:\Windows\System\aFzgDvM.exe
  C:\Windows\System\aFzgDvM.exe
  2⤵
  PID:5188
- C:\Windows\System\uXStXaE.exe
  C:\Windows\System\uXStXaE.exe
  2⤵
  PID:5204
- C:\Windows\System\dAKPnkU.exe
  C:\Windows\System\dAKPnkU.exe
  2⤵
  PID:5220
- C:\Windows\System\cREOXMT.exe
  C:\Windows\System\cREOXMT.exe
  2⤵
  PID:5236
- C:\Windows\System\IogVjFe.exe
  C:\Windows\System\IogVjFe.exe
  2⤵
  PID:5252
- C:\Windows\System\fVjqrkX.exe
  C:\Windows\System\fVjqrkX.exe
  2⤵
  PID:5268
- C:\Windows\System\DliXxup.exe
  C:\Windows\System\DliXxup.exe
  2⤵
  PID:5284
- C:\Windows\System\QNPZUhb.exe
  C:\Windows\System\QNPZUhb.exe
  2⤵
  PID:5300
- C:\Windows\System\gyEisDS.exe
  C:\Windows\System\gyEisDS.exe
  2⤵
  PID:5320
- C:\Windows\System\FfxrDCW.exe
  C:\Windows\System\FfxrDCW.exe
  2⤵
  PID:5336
- C:\Windows\System\GbxDsEq.exe
  C:\Windows\System\GbxDsEq.exe
  2⤵
  PID:5352
- C:\Windows\System\WgcwrKh.exe
  C:\Windows\System\WgcwrKh.exe
  2⤵
  PID:5368
- C:\Windows\System\vlMAWrq.exe
  C:\Windows\System\vlMAWrq.exe
  2⤵
  PID:5384
- C:\Windows\System\nxjKLbP.exe
  C:\Windows\System\nxjKLbP.exe
  2⤵
  PID:5400
- C:\Windows\System\POoUYLW.exe
  C:\Windows\System\POoUYLW.exe
  2⤵
  PID:5416
- C:\Windows\System\zRDThXN.exe
  C:\Windows\System\zRDThXN.exe
  2⤵
  PID:5444
- C:\Windows\System\qGECEMd.exe
  C:\Windows\System\qGECEMd.exe
  2⤵
  PID:5460
- C:\Windows\System\DtcYqMQ.exe
  C:\Windows\System\DtcYqMQ.exe
  2⤵
  PID:5476
- C:\Windows\System\hrsfCdb.exe
  C:\Windows\System\hrsfCdb.exe
  2⤵
  PID:5492
- C:\Windows\System\SIsJswr.exe
  C:\Windows\System\SIsJswr.exe
  2⤵
  PID:5524
- C:\Windows\System\DvrfBea.exe
  C:\Windows\System\DvrfBea.exe
  2⤵
  PID:5540
- C:\Windows\System\XaCYbBw.exe
  C:\Windows\System\XaCYbBw.exe
  2⤵
  PID:5556
- C:\Windows\System\cJotwIF.exe
  C:\Windows\System\cJotwIF.exe
  2⤵
  PID:5572
- C:\Windows\System\EILCtVI.exe
  C:\Windows\System\EILCtVI.exe
  2⤵
  PID:5588
- C:\Windows\System\esSpRAL.exe
  C:\Windows\System\esSpRAL.exe
  2⤵
  PID:5604
- C:\Windows\System\RkhvERj.exe
  C:\Windows\System\RkhvERj.exe
  2⤵
  PID:5620
- C:\Windows\System\yDZcmBb.exe
  C:\Windows\System\yDZcmBb.exe
  2⤵
  PID:5636
- C:\Windows\System\LmHVMAJ.exe
  C:\Windows\System\LmHVMAJ.exe
  2⤵
  PID:5656
- C:\Windows\System\csNLFPk.exe
  C:\Windows\System\csNLFPk.exe
  2⤵
  PID:5672
- C:\Windows\System\NBBnrRe.exe
  C:\Windows\System\NBBnrRe.exe
  2⤵
  PID:5688
- C:\Windows\System\bLgtKJg.exe
  C:\Windows\System\bLgtKJg.exe
  2⤵
  PID:5704
- C:\Windows\System\naBxHyG.exe
  C:\Windows\System\naBxHyG.exe
  2⤵
  PID:5720
- C:\Windows\System\ovzkBbp.exe
  C:\Windows\System\ovzkBbp.exe
  2⤵
  PID:5736
- C:\Windows\System\hGEgaVc.exe
  C:\Windows\System\hGEgaVc.exe
  2⤵
  PID:5752
- C:\Windows\System\AiGpFYE.exe
  C:\Windows\System\AiGpFYE.exe
  2⤵
  PID:5768
- C:\Windows\System\qJBfhHL.exe
  C:\Windows\System\qJBfhHL.exe
  2⤵
  PID:5784
- C:\Windows\System\qXmKAfb.exe
  C:\Windows\System\qXmKAfb.exe
  2⤵
  PID:5800
- C:\Windows\System\IEGwCwt.exe
  C:\Windows\System\IEGwCwt.exe
  2⤵
  PID:5816
- C:\Windows\System\HrureFW.exe
  C:\Windows\System\HrureFW.exe
  2⤵
  PID:5832
- C:\Windows\System\XBKHujR.exe
  C:\Windows\System\XBKHujR.exe
  2⤵
  PID:5848
- C:\Windows\System\CoBNZbU.exe
  C:\Windows\System\CoBNZbU.exe
  2⤵
  PID:5868
- C:\Windows\System\yhTkCpd.exe
  C:\Windows\System\yhTkCpd.exe
  2⤵
  PID:5884
- C:\Windows\System\kpzgJqR.exe
  C:\Windows\System\kpzgJqR.exe
  2⤵
  PID:5900
- C:\Windows\System\XQnfpcB.exe
  C:\Windows\System\XQnfpcB.exe
  2⤵
  PID:5916
- C:\Windows\System\nHhGaud.exe
  C:\Windows\System\nHhGaud.exe
  2⤵
  PID:5932
- C:\Windows\System\hlCDZFO.exe
  C:\Windows\System\hlCDZFO.exe
  2⤵
  PID:5948
- C:\Windows\System\ydWIvtg.exe
  C:\Windows\System\ydWIvtg.exe
  2⤵
  PID:5964
- C:\Windows\System\rvrXuyf.exe
  C:\Windows\System\rvrXuyf.exe
  2⤵
  PID:5980
- C:\Windows\System\MzEMCzU.exe
  C:\Windows\System\MzEMCzU.exe
  2⤵
  PID:6000
- C:\Windows\System\ilXfRXM.exe
  C:\Windows\System\ilXfRXM.exe
  2⤵
  PID:6016
- C:\Windows\System\OcKECyT.exe
  C:\Windows\System\OcKECyT.exe
  2⤵
  PID:6032
- C:\Windows\System\stcwqMR.exe
  C:\Windows\System\stcwqMR.exe
  2⤵
  PID:6048
- C:\Windows\System\LHIPLMA.exe
  C:\Windows\System\LHIPLMA.exe
  2⤵
  PID:6064
- C:\Windows\System\BDBuanY.exe
  C:\Windows\System\BDBuanY.exe
  2⤵
  PID:6080
- C:\Windows\System\ghrWikv.exe
  C:\Windows\System\ghrWikv.exe
  2⤵
  PID:6096
- C:\Windows\System\rokTMLB.exe
  C:\Windows\System\rokTMLB.exe
  2⤵
  PID:6124
- C:\Windows\System\HFufdGy.exe
  C:\Windows\System\HFufdGy.exe
  2⤵
  PID:6140
- C:\Windows\System\YLWoRdI.exe
  C:\Windows\System\YLWoRdI.exe
  2⤵
  PID:4500
- C:\Windows\System\QzfdUCA.exe
  C:\Windows\System\QzfdUCA.exe
  2⤵
  PID:4564
- C:\Windows\System\BXvOCLs.exe
  C:\Windows\System\BXvOCLs.exe
  2⤵
  PID:2884
- C:\Windows\System\fXvkQNu.exe
  C:\Windows\System\fXvkQNu.exe
  2⤵
  PID:4668
- C:\Windows\System\weIuCXQ.exe
  C:\Windows\System\weIuCXQ.exe
  2⤵
  PID:4732
- C:\Windows\System\TOUUGiX.exe
  C:\Windows\System\TOUUGiX.exe
  2⤵
  PID:4796
- C:\Windows\System\GWmHYSi.exe
  C:\Windows\System\GWmHYSi.exe
  2⤵
  PID:4836
- C:\Windows\System\tTKWVJQ.exe
  C:\Windows\System\tTKWVJQ.exe
  2⤵
  PID:4900
- C:\Windows\System\ZwaoPEc.exe
  C:\Windows\System\ZwaoPEc.exe
  2⤵
  PID:5248
- C:\Windows\System\zSrbpzx.exe
  C:\Windows\System\zSrbpzx.exe
  2⤵
  PID:1256
- C:\Windows\System\uzgPWnq.exe
  C:\Windows\System\uzgPWnq.exe
  2⤵
  PID:1280
- C:\Windows\System\STYgisF.exe
  C:\Windows\System\STYgisF.exe
  2⤵
  PID:3240
- C:\Windows\System\AhujPGo.exe
  C:\Windows\System\AhujPGo.exe
  2⤵
  PID:2676
- C:\Windows\System\RWYeyXe.exe
  C:\Windows\System\RWYeyXe.exe
  2⤵
  PID:3352
- C:\Windows\System\llETUxN.exe
  C:\Windows\System\llETUxN.exe
  2⤵
  PID:1480
- C:\Windows\System\hdPRQxz.exe
  C:\Windows\System\hdPRQxz.exe
  2⤵
  PID:3464
- C:\Windows\System\kbubHOJ.exe
  C:\Windows\System\kbubHOJ.exe
  2⤵
  PID:3312
- C:\Windows\System\TxqGUON.exe
  C:\Windows\System\TxqGUON.exe
  2⤵
  PID:916
- C:\Windows\System\RRqSkCJ.exe
  C:\Windows\System\RRqSkCJ.exe
  2⤵
  PID:3780
- C:\Windows\System\oJyunCd.exe
  C:\Windows\System\oJyunCd.exe
  2⤵
  PID:3852
- C:\Windows\System\VhblPAg.exe
  C:\Windows\System\VhblPAg.exe
  2⤵
  PID:3948
- C:\Windows\System\ZWCHaqu.exe
  C:\Windows\System\ZWCHaqu.exe
  2⤵
  PID:5568
- C:\Windows\System\lxMWCjF.exe
  C:\Windows\System\lxMWCjF.exe
  2⤵
  PID:5992
- C:\Windows\System\vCoBZSb.exe
  C:\Windows\System\vCoBZSb.exe
  2⤵
  PID:4764
- C:\Windows\System\LuxWXJS.exe
  C:\Windows\System\LuxWXJS.exe
  2⤵
  PID:5280
- C:\Windows\System\RzWHmRp.exe
  C:\Windows\System\RzWHmRp.exe
  2⤵
  PID:4044
- C:\Windows\System\FnMSpiq.exe
  C:\Windows\System\FnMSpiq.exe
  2⤵
  PID:3896
- C:\Windows\System\qxrTUXZ.exe
  C:\Windows\System\qxrTUXZ.exe
  2⤵
  PID:4352
- C:\Windows\System\DNLrSEP.exe
  C:\Windows\System\DNLrSEP.exe
  2⤵
  PID:5432
- C:\Windows\System\tUQAhiG.exe
  C:\Windows\System\tUQAhiG.exe
  2⤵
  PID:3716
- C:\Windows\System\nfYWbzf.exe
  C:\Windows\System\nfYWbzf.exe
  2⤵
  PID:992
- C:\Windows\System\UBdXCiV.exe
  C:\Windows\System\UBdXCiV.exe
  2⤵
  PID:3404
- C:\Windows\System\mcLKDow.exe
  C:\Windows\System\mcLKDow.exe
  2⤵
  PID:4752
- C:\Windows\System\uwVdWRl.exe
  C:\Windows\System\uwVdWRl.exe
  2⤵
  PID:4820
- C:\Windows\System\WvoVwrc.exe
  C:\Windows\System\WvoVwrc.exe
  2⤵
  PID:4884
- C:\Windows\System\ZOScuXi.exe
  C:\Windows\System\ZOScuXi.exe
  2⤵
  PID:4952
- C:\Windows\System\vtkFvMq.exe
  C:\Windows\System\vtkFvMq.exe
  2⤵
  PID:5016
- C:\Windows\System\WtdZcSH.exe
  C:\Windows\System\WtdZcSH.exe
  2⤵
  PID:5084
- C:\Windows\System\BkhtBDu.exe
  C:\Windows\System\BkhtBDu.exe
  2⤵
  PID:1356
- C:\Windows\System\tnHWFsF.exe
  C:\Windows\System\tnHWFsF.exe
  2⤵
  PID:5292
- C:\Windows\System\tAAaIRN.exe
  C:\Windows\System\tAAaIRN.exe
  2⤵
  PID:5360
- C:\Windows\System\QaMAyGP.exe
  C:\Windows\System\QaMAyGP.exe
  2⤵
  PID:5424
- C:\Windows\System\wnzVqfq.exe
  C:\Windows\System\wnzVqfq.exe
  2⤵
  PID:5468
- C:\Windows\System\UWrtCAs.exe
  C:\Windows\System\UWrtCAs.exe
  2⤵
  PID:5508
- C:\Windows\System\ywTeCsx.exe
  C:\Windows\System\ywTeCsx.exe
  2⤵
  PID:3460
- C:\Windows\System\ymTYtBE.exe
  C:\Windows\System\ymTYtBE.exe
  2⤵
  PID:3308
- C:\Windows\System\yVvbcCM.exe
  C:\Windows\System\yVvbcCM.exe
  2⤵
  PID:5548
- C:\Windows\System\ncGJukk.exe
  C:\Windows\System\ncGJukk.exe
  2⤵
  PID:5616
- C:\Windows\System\kkRTiKG.exe
  C:\Windows\System\kkRTiKG.exe
  2⤵
  PID:5680
- C:\Windows\System\wDHkaaj.exe
  C:\Windows\System\wDHkaaj.exe
  2⤵
  PID:5744
- C:\Windows\System\LzBJofG.exe
  C:\Windows\System\LzBJofG.exe
  2⤵
  PID:5808
- C:\Windows\System\FNjCpMJ.exe
  C:\Windows\System\FNjCpMJ.exe
  2⤵
  PID:5876
- C:\Windows\System\AXuJYdI.exe
  C:\Windows\System\AXuJYdI.exe
  2⤵
  PID:5940
- C:\Windows\System\XtFScgS.exe
  C:\Windows\System\XtFScgS.exe
  2⤵
  PID:3604
- C:\Windows\System\ECxDrGt.exe
  C:\Windows\System\ECxDrGt.exe
  2⤵
  PID:6072
- C:\Windows\System\nugipKq.exe
  C:\Windows\System\nugipKq.exe
  2⤵
  PID:6112
- C:\Windows\System\GTgXseq.exe
  C:\Windows\System\GTgXseq.exe
  2⤵
  PID:4472
- C:\Windows\System\QmlMFdG.exe
  C:\Windows\System\QmlMFdG.exe
  2⤵
  PID:4804
- C:\Windows\System\SRWuQHD.exe
  C:\Windows\System\SRWuQHD.exe
  2⤵
  PID:4964
- C:\Windows\System\cEFcKJV.exe
  C:\Windows\System\cEFcKJV.exe
  2⤵
  PID:5032
- C:\Windows\System\OXUqKUf.exe
  C:\Windows\System\OXUqKUf.exe
  2⤵
  PID:5072
- C:\Windows\System\atOvAtc.exe
  C:\Windows\System\atOvAtc.exe
  2⤵
  PID:2216
- C:\Windows\System\nAEVIsB.exe
  C:\Windows\System\nAEVIsB.exe
  2⤵
  PID:4128
- C:\Windows\System\ZCbLMKH.exe
  C:\Windows\System\ZCbLMKH.exe
  2⤵
  PID:4288
- C:\Windows\System\cjSHccL.exe
  C:\Windows\System\cjSHccL.exe
  2⤵
  PID:2512
- C:\Windows\System\vUVjhzt.exe
  C:\Windows\System\vUVjhzt.exe
  2⤵
  PID:2828
- C:\Windows\System\tGMuylI.exe
  C:\Windows\System\tGMuylI.exe
  2⤵
  PID:5140
- C:\Windows\System\BOzQbgg.exe
  C:\Windows\System\BOzQbgg.exe
  2⤵
  PID:484
- C:\Windows\System\jpATRWh.exe
  C:\Windows\System\jpATRWh.exe
  2⤵
  PID:1248
- C:\Windows\System\dYvkszp.exe
  C:\Windows\System\dYvkszp.exe
  2⤵
  PID:5380
- C:\Windows\System\nIjnZsA.exe
  C:\Windows\System\nIjnZsA.exe
  2⤵
  PID:3700
- C:\Windows\System\ILyPZqK.exe
  C:\Windows\System\ILyPZqK.exe
  2⤵
  PID:3608
- C:\Windows\System\FQpIqcW.exe
  C:\Windows\System\FQpIqcW.exe
  2⤵
  PID:4648
- C:\Windows\System\RgVhUpt.exe
  C:\Windows\System\RgVhUpt.exe
  2⤵
  PID:4484
- C:\Windows\System\sqEjfkT.exe
  C:\Windows\System\sqEjfkT.exe
  2⤵
  PID:4236
- C:\Windows\System\jJLMcVw.exe
  C:\Windows\System\jJLMcVw.exe
  2⤵
  PID:2232
- C:\Windows\System\pCZWIrT.exe
  C:\Windows\System\pCZWIrT.exe
  2⤵
  PID:4452
- C:\Windows\System\NnYtuCQ.exe
  C:\Windows\System\NnYtuCQ.exe
  2⤵
  PID:4620
- C:\Windows\System\NnfRDaY.exe
  C:\Windows\System\NnfRDaY.exe
  2⤵
  PID:4488
- C:\Windows\System\GCySOHP.exe
  C:\Windows\System\GCySOHP.exe
  2⤵
  PID:4272
- C:\Windows\System\hRlyvLw.exe
  C:\Windows\System\hRlyvLw.exe
  2⤵
  PID:4144
- C:\Windows\System\AfZbvzH.exe
  C:\Windows\System\AfZbvzH.exe
  2⤵
  PID:2760
- C:\Windows\System\HuZaJpv.exe
  C:\Windows\System\HuZaJpv.exe
  2⤵
  PID:2136
- C:\Windows\System\vgjjEHo.exe
  C:\Windows\System\vgjjEHo.exe
  2⤵
  PID:3108
- C:\Windows\System\WxwjdPE.exe
  C:\Windows\System\WxwjdPE.exe
  2⤵
  PID:3816
- C:\Windows\System\ZdieTvu.exe
  C:\Windows\System\ZdieTvu.exe
  2⤵
  PID:3984
- C:\Windows\System\kDTqyjy.exe
  C:\Windows\System\kDTqyjy.exe
  2⤵
  PID:5536
- C:\Windows\System\YUFvCYi.exe
  C:\Windows\System\YUFvCYi.exe
  2⤵
  PID:5628
- C:\Windows\System\ERwHEKo.exe
  C:\Windows\System\ERwHEKo.exe
  2⤵
  PID:5696
- C:\Windows\System\tgJGPcW.exe
  C:\Windows\System\tgJGPcW.exe
  2⤵
  PID:5764
- C:\Windows\System\IUsUXsE.exe
  C:\Windows\System\IUsUXsE.exe
  2⤵
  PID:5828
- C:\Windows\System\HmJYgpk.exe
  C:\Windows\System\HmJYgpk.exe
  2⤵
  PID:5960
- C:\Windows\System\YRcTvrO.exe
  C:\Windows\System\YRcTvrO.exe
  2⤵
  PID:6056
- C:\Windows\System\AuPXRFX.exe
  C:\Windows\System\AuPXRFX.exe
  2⤵
  PID:6136
- C:\Windows\System\AlsmBbX.exe
  C:\Windows\System\AlsmBbX.exe
  2⤵
  PID:4536
- C:\Windows\System\qDZkqwS.exe
  C:\Windows\System\qDZkqwS.exe
  2⤵
  PID:2732
- C:\Windows\System\VnrkFdK.exe
  C:\Windows\System\VnrkFdK.exe
  2⤵
  PID:5312
- C:\Windows\System\hBRgwEK.exe
  C:\Windows\System\hBRgwEK.exe
  2⤵
  PID:1912
- C:\Windows\System\EUCYrcS.exe
  C:\Windows\System\EUCYrcS.exe
  2⤵
  PID:3164
- C:\Windows\System\jDVSvEl.exe
  C:\Windows\System\jDVSvEl.exe
  2⤵
  PID:5452
- C:\Windows\System\IGQNBbR.exe
  C:\Windows\System\IGQNBbR.exe
  2⤵
  PID:3032
- C:\Windows\System\SvxlivQ.exe
  C:\Windows\System\SvxlivQ.exe
  2⤵
  PID:5488
- C:\Windows\System\ptguJFq.exe
  C:\Windows\System\ptguJFq.exe
  2⤵
  PID:1960
- C:\Windows\System\WRrVsRt.exe
  C:\Windows\System\WRrVsRt.exe
  2⤵
  PID:3272
- C:\Windows\System\quKohPi.exe
  C:\Windows\System\quKohPi.exe
  2⤵
  PID:2584
- C:\Windows\System\HjmRIwn.exe
  C:\Windows\System\HjmRIwn.exe
  2⤵
  PID:2328
- C:\Windows\System\tniJnuW.exe
  C:\Windows\System\tniJnuW.exe
  2⤵
  PID:788
- C:\Windows\System\HMvhcBd.exe
  C:\Windows\System\HMvhcBd.exe
  2⤵
  PID:2748
- C:\Windows\System\vWEuIuI.exe
  C:\Windows\System\vWEuIuI.exe
  2⤵
  PID:5232
- C:\Windows\System\iortnCG.exe
  C:\Windows\System\iortnCG.exe
  2⤵
  PID:2776
- C:\Windows\System\mtdHume.exe
  C:\Windows\System\mtdHume.exe
  2⤵
  PID:2792
- C:\Windows\System\PCcoxnw.exe
  C:\Windows\System\PCcoxnw.exe
  2⤵
  PID:2796
- C:\Windows\System\vehXtrg.exe
  C:\Windows\System\vehXtrg.exe
  2⤵
  PID:3576
- C:\Windows\System\pGjTZFh.exe
  C:\Windows\System\pGjTZFh.exe
  2⤵
  PID:2588
- C:\Windows\System\EuYwEuJ.exe
  C:\Windows\System\EuYwEuJ.exe
  2⤵
  PID:5052
- C:\Windows\System\ZpTFcTE.exe
  C:\Windows\System\ZpTFcTE.exe
  2⤵
  PID:5392
- C:\Windows\System\TrUelMZ.exe
  C:\Windows\System\TrUelMZ.exe
  2⤵
  PID:5504
- C:\Windows\System\azupZlp.exe
  C:\Windows\System\azupZlp.exe
  2⤵
  PID:3384
- C:\Windows\System\KQxiOPI.exe
  C:\Windows\System\KQxiOPI.exe
  2⤵
  PID:5712
- C:\Windows\System\ayNjmTT.exe
  C:\Windows\System\ayNjmTT.exe
  2⤵
  PID:5972
- C:\Windows\System\RcrvLWF.exe
  C:\Windows\System\RcrvLWF.exe
  2⤵
  PID:4604
- C:\Windows\System\FdQVlkV.exe
  C:\Windows\System\FdQVlkV.exe
  2⤵
  PID:4284
- C:\Windows\System\dfRSDiV.exe
  C:\Windows\System\dfRSDiV.exe
  2⤵
  PID:2976
- C:\Windows\System\kZEFlgW.exe
  C:\Windows\System\kZEFlgW.exe
  2⤵
  PID:5780
- C:\Windows\System\pAgvENA.exe
  C:\Windows\System\pAgvENA.exe
  2⤵
  PID:5520
- C:\Windows\System\CxgsGep.exe
  C:\Windows\System\CxgsGep.exe
  2⤵
  PID:5436
- C:\Windows\System\VEMoruN.exe
  C:\Windows\System\VEMoruN.exe
  2⤵
  PID:6012
- C:\Windows\System\LNZMIFD.exe
  C:\Windows\System\LNZMIFD.exe
  2⤵
  PID:4468
- C:\Windows\System\mtDCfZv.exe
  C:\Windows\System\mtDCfZv.exe
  2⤵
  PID:2608
- C:\Windows\System\TPQDDnN.exe
  C:\Windows\System\TPQDDnN.exe
  2⤵
  PID:5176
- C:\Windows\System\CSrYTyH.exe
  C:\Windows\System\CSrYTyH.exe
  2⤵
  PID:1044
- C:\Windows\System\UMGrCXv.exe
  C:\Windows\System\UMGrCXv.exe
  2⤵
  PID:2652
- C:\Windows\System\yMtLCEO.exe
  C:\Windows\System\yMtLCEO.exe
  2⤵
  PID:3944
- C:\Windows\System\heIESKc.exe
  C:\Windows\System\heIESKc.exe
  2⤵
  PID:4852
- C:\Windows\System\iwjAWSv.exe
  C:\Windows\System\iwjAWSv.exe
  2⤵
  PID:5180
- C:\Windows\System\KnyuyeK.exe
  C:\Windows\System\KnyuyeK.exe
  2⤵
  PID:5216
- C:\Windows\System\zjrodEz.exe
  C:\Windows\System\zjrodEz.exe
  2⤵
  PID:5164
- C:\Windows\System\KYLlBeP.exe
  C:\Windows\System\KYLlBeP.exe
  2⤵
  PID:4720
- C:\Windows\System\JntcWNf.exe
  C:\Windows\System\JntcWNf.exe
  2⤵
  PID:5376
- C:\Windows\System\JLsMKvP.exe
  C:\Windows\System\JLsMKvP.exe
  2⤵
  PID:4108
- C:\Windows\System\KkxfvvJ.exe
  C:\Windows\System\KkxfvvJ.exe
  2⤵
  PID:4340
- C:\Windows\System\yanEmpr.exe
  C:\Windows\System\yanEmpr.exe
  2⤵
  PID:1644
- C:\Windows\System\uNJcjhD.exe
  C:\Windows\System\uNJcjhD.exe
  2⤵
  PID:3392
- C:\Windows\System\nMiCyMW.exe
  C:\Windows\System\nMiCyMW.exe
  2⤵
  PID:1812
- C:\Windows\System\PLqCGxo.exe
  C:\Windows\System\PLqCGxo.exe
  2⤵
  PID:3040
- C:\Windows\System\XfrKGrk.exe
  C:\Windows\System\XfrKGrk.exe
  2⤵
  PID:3744
- C:\Windows\System\FgIpZHA.exe
  C:\Windows\System\FgIpZHA.exe
  2⤵
  PID:1584
- C:\Windows\System\UCSxtlk.exe
  C:\Windows\System\UCSxtlk.exe
  2⤵
  PID:3516
- C:\Windows\System\jHePQOa.exe
  C:\Windows\System\jHePQOa.exe
  2⤵
  PID:4680
- C:\Windows\System\zLBFjQf.exe
  C:\Windows\System\zLBFjQf.exe
  2⤵
  PID:3764
- C:\Windows\System\dVcFRZP.exe
  C:\Windows\System\dVcFRZP.exe
  2⤵
  PID:4208
- C:\Windows\System\kOOSuWA.exe
  C:\Windows\System\kOOSuWA.exe
  2⤵
  PID:4060
- C:\Windows\System\YUqJdcH.exe
  C:\Windows\System\YUqJdcH.exe
  2⤵
  PID:1980
- C:\Windows\System\UKFqPay.exe
  C:\Windows\System\UKFqPay.exe
  2⤵
  PID:6024
- C:\Windows\System\KyRxLkN.exe
  C:\Windows\System\KyRxLkN.exe
  2⤵
  PID:2412
- C:\Windows\System\ZKKFmsM.exe
  C:\Windows\System\ZKKFmsM.exe
  2⤵
  PID:1096
- C:\Windows\System\zDSKpxq.exe
  C:\Windows\System\zDSKpxq.exe
  2⤵
  PID:4412
- C:\Windows\System\FXZGdVA.exe
  C:\Windows\System\FXZGdVA.exe
  2⤵
  PID:3084
- C:\Windows\System\CavjSXL.exe
  C:\Windows\System\CavjSXL.exe
  2⤵
  PID:5160
- C:\Windows\System\UqFrncJ.exe
  C:\Windows\System\UqFrncJ.exe
  2⤵
  PID:2320
- C:\Windows\System\aiOPgOQ.exe
  C:\Windows\System\aiOPgOQ.exe
  2⤵
  PID:1704
- C:\Windows\System\IEKAXSt.exe
  C:\Windows\System\IEKAXSt.exe
  2⤵
  PID:5048
- C:\Windows\System\KXppiJu.exe
  C:\Windows\System\KXppiJu.exe
  2⤵
  PID:6108
- C:\Windows\System\zDjsIus.exe
  C:\Windows\System\zDjsIus.exe
  2⤵
  PID:5648
- C:\Windows\System\dwpnZwP.exe
  C:\Windows\System\dwpnZwP.exe
  2⤵
  PID:5068
- C:\Windows\System\wsHNQyN.exe
  C:\Windows\System\wsHNQyN.exe
  2⤵
  PID:2772
- C:\Windows\System\edZumIL.exe
  C:\Windows\System\edZumIL.exe
  2⤵
  PID:1100
- C:\Windows\System\GIjPTlj.exe
  C:\Windows\System\GIjPTlj.exe
  2⤵
  PID:5004
- C:\Windows\System\cGnKpCY.exe
  C:\Windows\System\cGnKpCY.exe
  2⤵
  PID:4256
- C:\Windows\System\mCVwzgf.exe
  C:\Windows\System\mCVwzgf.exe
  2⤵
  PID:5440
- C:\Windows\System\HcpDDFe.exe
  C:\Windows\System\HcpDDFe.exe
  2⤵
  PID:3132
- C:\Windows\System\kVidugj.exe
  C:\Windows\System\kVidugj.exe
  2⤵
  PID:2024
- C:\Windows\System\rhSckEJ.exe
  C:\Windows\System\rhSckEJ.exe
  2⤵
  PID:2912
- C:\Windows\System\wJVuNoF.exe
  C:\Windows\System\wJVuNoF.exe
  2⤵
  PID:3544
- C:\Windows\System\QoDkfja.exe
  C:\Windows\System\QoDkfja.exe
  2⤵
  PID:1604
- C:\Windows\System\UoikdOW.exe
  C:\Windows\System\UoikdOW.exe
  2⤵
  PID:5228
- C:\Windows\System\AjsTJym.exe
  C:\Windows\System\AjsTJym.exe
  2⤵
  PID:2768
- C:\Windows\System\cCEvGml.exe
  C:\Windows\System\cCEvGml.exe
  2⤵
  PID:2656
- C:\Windows\System\sXQtvvv.exe
  C:\Windows\System\sXQtvvv.exe
  2⤵
  PID:3520
- C:\Windows\System\SFZRioF.exe
  C:\Windows\System\SFZRioF.exe
  2⤵
  PID:560
- C:\Windows\System\yHOFPOx.exe
  C:\Windows\System\yHOFPOx.exe
  2⤵
  PID:3372
- C:\Windows\System\ndesuLY.exe
  C:\Windows\System\ndesuLY.exe
  2⤵
  PID:4268
- C:\Windows\System\eJMCelr.exe
  C:\Windows\System\eJMCelr.exe
  2⤵
  PID:2660
- C:\Windows\System\MYXdEUL.exe
  C:\Windows\System\MYXdEUL.exe
  2⤵
  PID:5600
- C:\Windows\System\VUILmLQ.exe
  C:\Windows\System\VUILmLQ.exe
  2⤵
  PID:5760
- C:\Windows\System\mWYNvxS.exe
  C:\Windows\System\mWYNvxS.exe
  2⤵
  PID:2724
- C:\Windows\System\HlVYcdx.exe
  C:\Windows\System\HlVYcdx.exe
  2⤵
  PID:5796
- C:\Windows\System\FxOqwwE.exe
  C:\Windows\System\FxOqwwE.exe
  2⤵
  PID:5924
- C:\Windows\System\FCAHHMo.exe
  C:\Windows\System\FCAHHMo.exe
  2⤵
  PID:5824
- C:\Windows\System\wYVNAlE.exe
  C:\Windows\System\wYVNAlE.exe
  2⤵
  PID:6088
- C:\Windows\System\krOKmOF.exe
  C:\Windows\System\krOKmOF.exe
  2⤵
  PID:1448
- C:\Windows\System\IkgcaTq.exe
  C:\Windows\System\IkgcaTq.exe
  2⤵
  PID:5308
- C:\Windows\System\Sjcwxns.exe
  C:\Windows\System\Sjcwxns.exe
  2⤵
  PID:5484
- C:\Windows\System\NqLljLA.exe
  C:\Windows\System\NqLljLA.exe
  2⤵
  PID:1284
- C:\Windows\System\VvxsCGp.exe
  C:\Windows\System\VvxsCGp.exe
  2⤵
  PID:2316
- C:\Windows\System\JijrsYH.exe
  C:\Windows\System\JijrsYH.exe
  2⤵
  PID:4324
- C:\Windows\System\RJuANBZ.exe
  C:\Windows\System\RJuANBZ.exe
  2⤵
  PID:5124
- C:\Windows\System\ZucMDZD.exe
  C:\Windows\System\ZucMDZD.exe
  2⤵
  PID:3204
- C:\Windows\System\ioWxeGf.exe
  C:\Windows\System\ioWxeGf.exe
  2⤵
  PID:2312
- C:\Windows\System\UJffVhO.exe
  C:\Windows\System\UJffVhO.exe
  2⤵
  PID:6120
- C:\Windows\System\WRXUTla.exe
  C:\Windows\System\WRXUTla.exe
  2⤵
  PID:4220
- C:\Windows\System\nhSLrWA.exe
  C:\Windows\System\nhSLrWA.exe
  2⤵
  PID:1660
- C:\Windows\System\mAzDitG.exe
  C:\Windows\System\mAzDitG.exe
  2⤵
  PID:4520
- C:\Windows\System\hToQLWI.exe
  C:\Windows\System\hToQLWI.exe
  2⤵
  PID:5652
- C:\Windows\System\KbROLWW.exe
  C:\Windows\System\KbROLWW.exe
  2⤵
  PID:2960
- C:\Windows\System\dhUHeOa.exe
  C:\Windows\System\dhUHeOa.exe
  2⤵
  PID:2640
- C:\Windows\System\kNeWKIz.exe
  C:\Windows\System\kNeWKIz.exe
  2⤵
  PID:3196
- C:\Windows\System\HLvfjkr.exe
  C:\Windows\System\HLvfjkr.exe
  2⤵
  PID:6092
- C:\Windows\System\DcryRZB.exe
  C:\Windows\System\DcryRZB.exe
  2⤵
  PID:3348
- C:\Windows\System\nPnYQCb.exe
  C:\Windows\System\nPnYQCb.exe
  2⤵
  PID:2220
- C:\Windows\System\PQAhCYb.exe
  C:\Windows\System\PQAhCYb.exe
  2⤵
  PID:3236
- C:\Windows\System\CTMbdoN.exe
  C:\Windows\System\CTMbdoN.exe
  2⤵
  PID:5396
- C:\Windows\System\omQdlEX.exe
  C:\Windows\System\omQdlEX.exe
  2⤵
  PID:3220
- C:\Windows\System\SZeEIXJ.exe
  C:\Windows\System\SZeEIXJ.exe
  2⤵
  PID:2620
- C:\Windows\System\IutFUIU.exe
  C:\Windows\System\IutFUIU.exe
  2⤵
  PID:5104
- C:\Windows\System\UmYHjCl.exe
  C:\Windows\System\UmYHjCl.exe
  2⤵
  PID:2968
- C:\Windows\System\VqPnZsD.exe
  C:\Windows\System\VqPnZsD.exe
  2⤵
  PID:2604
- C:\Windows\System\LpxZrzM.exe
  C:\Windows\System\LpxZrzM.exe
  2⤵
  PID:4664
- C:\Windows\System\EEvYhwU.exe
  C:\Windows\System\EEvYhwU.exe
  2⤵
  PID:1048
- C:\Windows\System\RheKBII.exe
  C:\Windows\System\RheKBII.exe
  2⤵
  PID:2152
- C:\Windows\System\SJdPtWy.exe
  C:\Windows\System\SJdPtWy.exe
  2⤵
  PID:5000
- C:\Windows\System\bcFFEuv.exe
  C:\Windows\System\bcFFEuv.exe
  2⤵
  PID:4552
- C:\Windows\System\KjAfPRI.exe
  C:\Windows\System\KjAfPRI.exe
  2⤵
  PID:4948
- C:\Windows\System\lOeMtAj.exe
  C:\Windows\System\lOeMtAj.exe
  2⤵
  PID:5956
- C:\Windows\System\BfkaqxL.exe
  C:\Windows\System\BfkaqxL.exe
  2⤵
  PID:960
- C:\Windows\System\CEYfwbv.exe
  C:\Windows\System\CEYfwbv.exe
  2⤵
  PID:6104
- C:\Windows\System\wvQsEld.exe
  C:\Windows\System\wvQsEld.exe
  2⤵
  PID:3776
- C:\Windows\System\pmIVwVs.exe
  C:\Windows\System\pmIVwVs.exe
  2⤵
  PID:4016
- C:\Windows\System\hnCkyxI.exe
  C:\Windows\System\hnCkyxI.exe
  2⤵
  PID:2712
- C:\Windows\System\sgdVZGX.exe
  C:\Windows\System\sgdVZGX.exe
  2⤵
  PID:2560
- C:\Windows\System\lVhPKIN.exe
  C:\Windows\System\lVhPKIN.exe
  2⤵
  PID:5908
- C:\Windows\System\tAYXtsX.exe
  C:\Windows\System\tAYXtsX.exe
  2⤵
  PID:2420
- C:\Windows\System\taOUpOn.exe
  C:\Windows\System\taOUpOn.exe
  2⤵
  PID:1856
- C:\Windows\System\ZtompoN.exe
  C:\Windows\System\ZtompoN.exe
  2⤵
  PID:2812
- C:\Windows\System\rbxgwCI.exe
  C:\Windows\System\rbxgwCI.exe
  2⤵
  PID:6160
- C:\Windows\System\eNHFPrm.exe
  C:\Windows\System\eNHFPrm.exe
  2⤵
  PID:6180
- C:\Windows\System\jYFdlVZ.exe
  C:\Windows\System\jYFdlVZ.exe
  2⤵
  PID:6196
- C:\Windows\System\EtxkCUd.exe
  C:\Windows\System\EtxkCUd.exe
  2⤵
  PID:6212
- C:\Windows\System\zTfkAJe.exe
  C:\Windows\System\zTfkAJe.exe
  2⤵
  PID:6232
- C:\Windows\System\sPRfvfm.exe
  C:\Windows\System\sPRfvfm.exe
  2⤵
  PID:6248
- C:\Windows\System\zoGvAKN.exe
  C:\Windows\System\zoGvAKN.exe
  2⤵
  PID:6264
- C:\Windows\System\UbehMnH.exe
  C:\Windows\System\UbehMnH.exe
  2⤵
  PID:6284
- C:\Windows\System\bhAVLUg.exe
  C:\Windows\System\bhAVLUg.exe
  2⤵
  PID:6300
- C:\Windows\System\ZkKxoRq.exe
  C:\Windows\System\ZkKxoRq.exe
  2⤵
  PID:6316
- C:\Windows\System\EkoCGkj.exe
  C:\Windows\System\EkoCGkj.exe
  2⤵
  PID:6336
- C:\Windows\System\NOFTqTY.exe
  C:\Windows\System\NOFTqTY.exe
  2⤵
  PID:6352
- C:\Windows\System\LKeGRZz.exe
  C:\Windows\System\LKeGRZz.exe
  2⤵
  PID:6368
- C:\Windows\System\WWNNgnx.exe
  C:\Windows\System\WWNNgnx.exe
  2⤵
  PID:6388
- C:\Windows\System\LYgPAZE.exe
  C:\Windows\System\LYgPAZE.exe
  2⤵
  PID:6404
- C:\Windows\System\evUnTGy.exe
  C:\Windows\System\evUnTGy.exe
  2⤵
  PID:6420
- C:\Windows\System\xYFUKOc.exe
  C:\Windows\System\xYFUKOc.exe
  2⤵
  PID:6440
- C:\Windows\System\UsvjWFn.exe
  C:\Windows\System\UsvjWFn.exe
  2⤵
  PID:6540
- C:\Windows\System\IBpdTXP.exe
  C:\Windows\System\IBpdTXP.exe
  2⤵
  PID:6556
- C:\Windows\System\nWoXlIG.exe
  C:\Windows\System\nWoXlIG.exe
  2⤵
  PID:6572
- C:\Windows\System\JRyZxWz.exe
  C:\Windows\System\JRyZxWz.exe
  2⤵
  PID:6588
- C:\Windows\System\dNTChMT.exe
  C:\Windows\System\dNTChMT.exe
  2⤵
  PID:6604
- C:\Windows\System\jkHPLSl.exe
  C:\Windows\System\jkHPLSl.exe
  2⤵
  PID:6624
- C:\Windows\System\UjTJROd.exe
  C:\Windows\System\UjTJROd.exe
  2⤵
  PID:6640
- C:\Windows\System\NlVGWal.exe
  C:\Windows\System\NlVGWal.exe
  2⤵
  PID:6656
- C:\Windows\System\XOfTmyL.exe
  C:\Windows\System\XOfTmyL.exe
  2⤵
  PID:6672
- C:\Windows\System\bGvjltv.exe
  C:\Windows\System\bGvjltv.exe
  2⤵
  PID:6688
- C:\Windows\System\YyGgEtX.exe
  C:\Windows\System\YyGgEtX.exe
  2⤵
  PID:6704
- C:\Windows\System\kTHxaHH.exe
  C:\Windows\System\kTHxaHH.exe
  2⤵
  PID:6724
- C:\Windows\System\aXIyFQg.exe
  C:\Windows\System\aXIyFQg.exe
  2⤵
  PID:6740
- C:\Windows\System\XCVgtkB.exe
  C:\Windows\System\XCVgtkB.exe
  2⤵
  PID:6756
- C:\Windows\System\QjyQPuj.exe
  C:\Windows\System\QjyQPuj.exe
  2⤵
  PID:6772
- C:\Windows\System\rPRJYQX.exe
  C:\Windows\System\rPRJYQX.exe
  2⤵
  PID:6788
- C:\Windows\System\WTeYwqx.exe
  C:\Windows\System\WTeYwqx.exe
  2⤵
  PID:6804
- C:\Windows\System\qQSABIS.exe
  C:\Windows\System\qQSABIS.exe
  2⤵
  PID:6820
- C:\Windows\System\mfIfxMu.exe
  C:\Windows\System\mfIfxMu.exe
  2⤵
  PID:6836
- C:\Windows\System\VVpVkBH.exe
  C:\Windows\System\VVpVkBH.exe
  2⤵
  PID:6852
- C:\Windows\System\fjkLdzf.exe
  C:\Windows\System\fjkLdzf.exe
  2⤵
  PID:6872
- C:\Windows\System\UsJGEdL.exe
  C:\Windows\System\UsJGEdL.exe
  2⤵
  PID:6888
- C:\Windows\System\KNzHDRd.exe
  C:\Windows\System\KNzHDRd.exe
  2⤵
  PID:6904
- C:\Windows\System\oAZEVwh.exe
  C:\Windows\System\oAZEVwh.exe
  2⤵
  PID:6920
- C:\Windows\System\tPUElwO.exe
  C:\Windows\System\tPUElwO.exe
  2⤵
  PID:6936
- C:\Windows\System\IyfNzlK.exe
  C:\Windows\System\IyfNzlK.exe
  2⤵
  PID:6952
- C:\Windows\System\HhWLMDv.exe
  C:\Windows\System\HhWLMDv.exe
  2⤵
  PID:7004
- C:\Windows\System\wyDtnYH.exe
  C:\Windows\System\wyDtnYH.exe
  2⤵
  PID:7020
- C:\Windows\System\UvbjOBt.exe
  C:\Windows\System\UvbjOBt.exe
  2⤵
  PID:7036
- C:\Windows\System\HHHahJH.exe
  C:\Windows\System\HHHahJH.exe
  2⤵
  PID:7052
- C:\Windows\System\hxmuSva.exe
  C:\Windows\System\hxmuSva.exe
  2⤵
  PID:7068
- C:\Windows\System\JIeRMTq.exe
  C:\Windows\System\JIeRMTq.exe
  2⤵
  PID:7084
- C:\Windows\System\nsULPSR.exe
  C:\Windows\System\nsULPSR.exe
  2⤵
  PID:7100
- C:\Windows\System\ltweiyY.exe
  C:\Windows\System\ltweiyY.exe
  2⤵
  PID:7116
- C:\Windows\System\XzvxPEC.exe
  C:\Windows\System\XzvxPEC.exe
  2⤵
  PID:7132
- C:\Windows\System\UqUkcoq.exe
  C:\Windows\System\UqUkcoq.exe
  2⤵
  PID:7148
- C:\Windows\System\qIbTdff.exe
  C:\Windows\System\qIbTdff.exe
  2⤵
  PID:7164
- C:\Windows\System\kwhdbci.exe
  C:\Windows\System\kwhdbci.exe
  2⤵
  PID:6176
- C:\Windows\System\pRCQqPU.exe
  C:\Windows\System\pRCQqPU.exe
  2⤵
  PID:6244
- C:\Windows\System\FDAJTwT.exe
  C:\Windows\System\FDAJTwT.exe
  2⤵
  PID:6280
- C:\Windows\System\kYTzHBI.exe
  C:\Windows\System\kYTzHBI.exe
  2⤵
  PID:2744
- C:\Windows\System\BnYOBBr.exe
  C:\Windows\System\BnYOBBr.exe
  2⤵
  PID:6224
- C:\Windows\System\ucURqTd.exe
  C:\Windows\System\ucURqTd.exe
  2⤵
  PID:6432
- C:\Windows\System\mkYoaxE.exe
  C:\Windows\System\mkYoaxE.exe
  2⤵
  PID:6332
- C:\Windows\System\BpetcSu.exe
  C:\Windows\System\BpetcSu.exe
  2⤵
  PID:6292
- C:\Windows\System\eNQqFPO.exe
  C:\Windows\System\eNQqFPO.exe
  2⤵
  PID:6384
- C:\Windows\System\faYZjny.exe
  C:\Windows\System\faYZjny.exe
  2⤵
  PID:6348
- C:\Windows\System\AiOeCfI.exe
  C:\Windows\System\AiOeCfI.exe
  2⤵
  PID:6464
- C:\Windows\System\LsjZwQp.exe
  C:\Windows\System\LsjZwQp.exe
  2⤵
  PID:6484
- C:\Windows\System\DmQzIVs.exe
  C:\Windows\System\DmQzIVs.exe
  2⤵
  PID:6500
- C:\Windows\System\SdRtzcB.exe
  C:\Windows\System\SdRtzcB.exe
  2⤵
  PID:6524
- C:\Windows\System\AYVZoMX.exe
  C:\Windows\System\AYVZoMX.exe
  2⤵
  PID:6564
- C:\Windows\System\XkdHSAK.exe
  C:\Windows\System\XkdHSAK.exe
  2⤵
  PID:6600
- C:\Windows\System\rvWDGnh.exe
  C:\Windows\System\rvWDGnh.exe
  2⤵
  PID:6668
- C:\Windows\System\HOQicvR.exe
  C:\Windows\System\HOQicvR.exe
  2⤵
  PID:6712
- C:\Windows\System\OxZyAgr.exe
  C:\Windows\System\OxZyAgr.exe
  2⤵
  PID:6580
- C:\Windows\System\WVuxOcv.exe
  C:\Windows\System\WVuxOcv.exe
  2⤵
  PID:6620
- C:\Windows\System\maPpwQA.exe
  C:\Windows\System\maPpwQA.exe
  2⤵
  PID:6684
- C:\Windows\System\pKuDxfd.exe
  C:\Windows\System\pKuDxfd.exe
  2⤵
  PID:6800
- C:\Windows\System\KVuWrCk.exe
  C:\Windows\System\KVuWrCk.exe
  2⤵
  PID:6864
- C:\Windows\System\vawwZaa.exe
  C:\Windows\System\vawwZaa.exe
  2⤵
  PID:6720
- C:\Windows\System\ifLTOIw.exe
  C:\Windows\System\ifLTOIw.exe
  2⤵
  PID:6960
- C:\Windows\System\vaVXgWU.exe
  C:\Windows\System\vaVXgWU.exe
  2⤵
  PID:6784
- C:\Windows\System\KdOKKKx.exe
  C:\Windows\System\KdOKKKx.exe
  2⤵
  PID:6848
- C:\Windows\System\FivEQTb.exe
  C:\Windows\System\FivEQTb.exe
  2⤵
  PID:6916
- C:\Windows\System\DGuptQU.exe
  C:\Windows\System\DGuptQU.exe
  2⤵
  PID:6968
- C:\Windows\System\ELOAGFC.exe
  C:\Windows\System\ELOAGFC.exe
  2⤵
  PID:6992
- C:\Windows\System\PKKAfgp.exe
  C:\Windows\System\PKKAfgp.exe
  2⤵
  PID:7032
- C:\Windows\System\anbOaNv.exe
  C:\Windows\System\anbOaNv.exe
  2⤵
  PID:7096
- C:\Windows\System\ihdeQTn.exe
  C:\Windows\System\ihdeQTn.exe
  2⤵
  PID:7160
- C:\Windows\System\JoULcUB.exe
  C:\Windows\System\JoULcUB.exe
  2⤵
  PID:2636
- C:\Windows\System\IJJuIAg.exe
  C:\Windows\System\IJJuIAg.exe
  2⤵
  PID:6256
- C:\Windows\System\fGRbQRI.exe
  C:\Windows\System\fGRbQRI.exe
  2⤵
  PID:6436
- C:\Windows\System\BBCNGwf.exe
  C:\Windows\System\BBCNGwf.exe
  2⤵
  PID:6448
- C:\Windows\System\glHklLg.exe
  C:\Windows\System\glHklLg.exe
  2⤵
  PID:6508
- C:\Windows\System\XiTStMo.exe
  C:\Windows\System\XiTStMo.exe
  2⤵
  PID:6568
- C:\Windows\System\TPyfDuo.exe
  C:\Windows\System\TPyfDuo.exe
  2⤵
  PID:6612
- C:\Windows\System\GijhTrs.exe
  C:\Windows\System\GijhTrs.exe
  2⤵
  PID:6796
- C:\Windows\System\sOyCVgF.exe
  C:\Windows\System\sOyCVgF.exe
  2⤵
  PID:6716
- C:\Windows\System\PvoZHyv.exe
  C:\Windows\System\PvoZHyv.exe
  2⤵
  PID:7080
- C:\Windows\System\VynMdAC.exe
  C:\Windows\System\VynMdAC.exe
  2⤵
  PID:6988
- C:\Windows\System\yqcUpmE.exe
  C:\Windows\System\yqcUpmE.exe
  2⤵
  PID:2432
- C:\Windows\System\cwrGgzS.exe
  C:\Windows\System\cwrGgzS.exe
  2⤵
  PID:7012
- C:\Windows\System\ekPcDrs.exe
  C:\Windows\System\ekPcDrs.exe
  2⤵
  PID:5408
- C:\Windows\System\icSYmFi.exe
  C:\Windows\System\icSYmFi.exe
  2⤵
  PID:6192
- C:\Windows\System\QDHKifc.exe
  C:\Windows\System\QDHKifc.exe
  2⤵
  PID:6512
- C:\Windows\System\hoLJzjO.exe
  C:\Windows\System\hoLJzjO.exe
  2⤵
  PID:6652
- C:\Windows\System\RGOhlrp.exe
  C:\Windows\System\RGOhlrp.exe
  2⤵
  PID:6900
- C:\Windows\System\bPkCUdY.exe
  C:\Windows\System\bPkCUdY.exe
  2⤵
  PID:6460
- C:\Windows\System\UvKLEtU.exe
  C:\Windows\System\UvKLEtU.exe
  2⤵
  PID:6768
- C:\Windows\System\GltqHsa.exe
  C:\Windows\System\GltqHsa.exe
  2⤵
  PID:6844
- C:\Windows\System\WJVFqNi.exe
  C:\Windows\System\WJVFqNi.exe
  2⤵
  PID:7128
- C:\Windows\System\LhCVyLj.exe
  C:\Windows\System\LhCVyLj.exe
  2⤵
  PID:6520
- C:\Windows\System\rzpglrg.exe
  C:\Windows\System\rzpglrg.exe
  2⤵
  PID:6172
- C:\Windows\System\rTvZaiN.exe
  C:\Windows\System\rTvZaiN.exe
  2⤵
  PID:6492
- C:\Windows\System\KuVZxJn.exe
  C:\Windows\System\KuVZxJn.exe
  2⤵
  PID:6700
- C:\Windows\System\GxMFswP.exe
  C:\Windows\System\GxMFswP.exe
  2⤵
  PID:6456
- C:\Windows\System\EOsfFdU.exe
  C:\Windows\System\EOsfFdU.exe
  2⤵
  PID:6980
- C:\Windows\System\hmdQSLR.exe
  C:\Windows\System\hmdQSLR.exe
  2⤵
  PID:6680
- C:\Windows\System\XdXlkUw.exe
  C:\Windows\System\XdXlkUw.exe
  2⤵
  PID:6380
- C:\Windows\System\KWtIHRb.exe
  C:\Windows\System\KWtIHRb.exe
  2⤵
  PID:6156
- C:\Windows\System\aUIkFxS.exe
  C:\Windows\System\aUIkFxS.exe
  2⤵
  PID:6416
- C:\Windows\System\qggnCbz.exe
  C:\Windows\System\qggnCbz.exe
  2⤵
  PID:7184
- C:\Windows\System\meQQIub.exe
  C:\Windows\System\meQQIub.exe
  2⤵
  PID:7200
- C:\Windows\System\Btlhnrh.exe
  C:\Windows\System\Btlhnrh.exe
  2⤵
  PID:7216
- C:\Windows\System\VwDXxQM.exe
  C:\Windows\System\VwDXxQM.exe
  2⤵
  PID:7232
- C:\Windows\System\VGnFqNg.exe
  C:\Windows\System\VGnFqNg.exe
  2⤵
  PID:7256
- C:\Windows\System\gFZpJwT.exe
  C:\Windows\System\gFZpJwT.exe
  2⤵
  PID:7272
- C:\Windows\System\MYdytDc.exe
  C:\Windows\System\MYdytDc.exe
  2⤵
  PID:7288
- C:\Windows\System\ejVwZZu.exe
  C:\Windows\System\ejVwZZu.exe
  2⤵
  PID:7304
- C:\Windows\System\BjtTkdl.exe
  C:\Windows\System\BjtTkdl.exe
  2⤵
  PID:7320
- C:\Windows\System\YyHfLTE.exe
  C:\Windows\System\YyHfLTE.exe
  2⤵
  PID:7336
- C:\Windows\System\UbVuoOB.exe
  C:\Windows\System\UbVuoOB.exe
  2⤵
  PID:7352
- C:\Windows\System\TAskAwR.exe
  C:\Windows\System\TAskAwR.exe
  2⤵
  PID:7368
- C:\Windows\System\JDLbQCe.exe
  C:\Windows\System\JDLbQCe.exe
  2⤵
  PID:7384
- C:\Windows\System\jwmiEws.exe
  C:\Windows\System\jwmiEws.exe
  2⤵
  PID:7400
- C:\Windows\System\bKxSIkM.exe
  C:\Windows\System\bKxSIkM.exe
  2⤵
  PID:7420
- C:\Windows\System\RWJPEZl.exe
  C:\Windows\System\RWJPEZl.exe
  2⤵
  PID:7436
- C:\Windows\System\ptTJlfB.exe
  C:\Windows\System\ptTJlfB.exe
  2⤵
  PID:7452
- C:\Windows\System\hpnuAKt.exe
  C:\Windows\System\hpnuAKt.exe
  2⤵
  PID:7468
- C:\Windows\System\kaZdzIa.exe
  C:\Windows\System\kaZdzIa.exe
  2⤵
  PID:7484
- C:\Windows\System\YuzaTkb.exe
  C:\Windows\System\YuzaTkb.exe
  2⤵
  PID:7500
- C:\Windows\System\GxmaVQy.exe
  C:\Windows\System\GxmaVQy.exe
  2⤵
  PID:7516
- C:\Windows\System\TQxSmvl.exe
  C:\Windows\System\TQxSmvl.exe
  2⤵
  PID:7532
- C:\Windows\System\YmQREId.exe
  C:\Windows\System\YmQREId.exe
  2⤵
  PID:7548
- C:\Windows\System\rkkEDpd.exe
  C:\Windows\System\rkkEDpd.exe
  2⤵
  PID:7564
- C:\Windows\System\fGPNLUB.exe
  C:\Windows\System\fGPNLUB.exe
  2⤵
  PID:7580
- C:\Windows\System\XjDiseV.exe
  C:\Windows\System\XjDiseV.exe
  2⤵
  PID:7596
- C:\Windows\System\XnNlxeT.exe
  C:\Windows\System\XnNlxeT.exe
  2⤵
  PID:7612
- C:\Windows\System\dfAvxZM.exe
  C:\Windows\System\dfAvxZM.exe
  2⤵
  PID:7628
- C:\Windows\System\SovKzjO.exe
  C:\Windows\System\SovKzjO.exe
  2⤵
  PID:7644
- C:\Windows\System\PWTOpKf.exe
  C:\Windows\System\PWTOpKf.exe
  2⤵
  PID:7660
- C:\Windows\System\yuHtdRu.exe
  C:\Windows\System\yuHtdRu.exe
  2⤵
  PID:7676
- C:\Windows\System\SoyppQd.exe
  C:\Windows\System\SoyppQd.exe
  2⤵
  PID:7692
- C:\Windows\System\rnZjJFA.exe
  C:\Windows\System\rnZjJFA.exe
  2⤵
  PID:7708
- C:\Windows\System\CFCsLmp.exe
  C:\Windows\System\CFCsLmp.exe
  2⤵
  PID:7724
- C:\Windows\System\ZxWLxdR.exe
  C:\Windows\System\ZxWLxdR.exe
  2⤵
  PID:7740
- C:\Windows\System\apBpuLy.exe
  C:\Windows\System\apBpuLy.exe
  2⤵
  PID:7756
- C:\Windows\System\qfjdtWZ.exe
  C:\Windows\System\qfjdtWZ.exe
  2⤵
  PID:7772
- C:\Windows\System\UfJQxTN.exe
  C:\Windows\System\UfJQxTN.exe
  2⤵
  PID:7792
- C:\Windows\System\ckpSaCn.exe
  C:\Windows\System\ckpSaCn.exe
  2⤵
  PID:7812
- C:\Windows\System\KyvBMEN.exe
  C:\Windows\System\KyvBMEN.exe
  2⤵
  PID:7828
- C:\Windows\System\cWvTAqi.exe
  C:\Windows\System\cWvTAqi.exe
  2⤵
  PID:7844
- C:\Windows\System\HAwGAMe.exe
  C:\Windows\System\HAwGAMe.exe
  2⤵
  PID:7860
- C:\Windows\System\tbTJial.exe
  C:\Windows\System\tbTJial.exe
  2⤵
  PID:7876
- C:\Windows\System\FoKhamw.exe
  C:\Windows\System\FoKhamw.exe
  2⤵
  PID:7892
- C:\Windows\System\UAsCqDz.exe
  C:\Windows\System\UAsCqDz.exe
  2⤵
  PID:7908
- C:\Windows\System\GSvjsOm.exe
  C:\Windows\System\GSvjsOm.exe
  2⤵
  PID:7924
- C:\Windows\System\VKZMwTz.exe
  C:\Windows\System\VKZMwTz.exe
  2⤵
  PID:7940
- C:\Windows\System\kBvycZT.exe
  C:\Windows\System\kBvycZT.exe
  2⤵
  PID:7956
- C:\Windows\System\wQFRuDV.exe
  C:\Windows\System\wQFRuDV.exe
  2⤵
  PID:7972
- C:\Windows\System\mpcvjyB.exe
  C:\Windows\System\mpcvjyB.exe
  2⤵
  PID:7988
- C:\Windows\System\mJxxnPX.exe
  C:\Windows\System\mJxxnPX.exe
  2⤵
  PID:8004
- C:\Windows\System\bRKLpNx.exe
  C:\Windows\System\bRKLpNx.exe
  2⤵
  PID:8020
- C:\Windows\System\GnSaCax.exe
  C:\Windows\System\GnSaCax.exe
  2⤵
  PID:8036
- C:\Windows\System\hvJhkMh.exe
  C:\Windows\System\hvJhkMh.exe
  2⤵
  PID:8052
- C:\Windows\System\aQGlUlc.exe
  C:\Windows\System\aQGlUlc.exe
  2⤵
  PID:8068
- C:\Windows\System\RmFuwmd.exe
  C:\Windows\System\RmFuwmd.exe
  2⤵
  PID:8084
- C:\Windows\System\ZRtTkwP.exe
  C:\Windows\System\ZRtTkwP.exe
  2⤵
  PID:8100
- C:\Windows\System\TEUSHWm.exe
  C:\Windows\System\TEUSHWm.exe
  2⤵
  PID:8116
- C:\Windows\System\PWsGKMG.exe
  C:\Windows\System\PWsGKMG.exe
  2⤵
  PID:8132
- C:\Windows\System\ycYOKYA.exe
  C:\Windows\System\ycYOKYA.exe
  2⤵
  PID:8148
- C:\Windows\System\wMhsggW.exe
  C:\Windows\System\wMhsggW.exe
  2⤵
  PID:8164
- C:\Windows\System\QWwNHmf.exe
  C:\Windows\System\QWwNHmf.exe
  2⤵
  PID:8180
- C:\Windows\System\qSAgnjF.exe
  C:\Windows\System\qSAgnjF.exe
  2⤵
  PID:6376
- C:\Windows\System\pqWPGHb.exe
  C:\Windows\System\pqWPGHb.exe
  2⤵
  PID:6360
- C:\Windows\System\gzAhEpR.exe
  C:\Windows\System\gzAhEpR.exe
  2⤵
  PID:7180
- C:\Windows\System\SJJuWju.exe
  C:\Windows\System\SJJuWju.exe
  2⤵
  PID:7248
- C:\Windows\System\jtJQOKb.exe
  C:\Windows\System\jtJQOKb.exe
  2⤵
  PID:7312
- C:\Windows\System\RPyGoyF.exe
  C:\Windows\System\RPyGoyF.exe
  2⤵
  PID:7196
- C:\Windows\System\lXUiqVg.exe
  C:\Windows\System\lXUiqVg.exe
  2⤵
  PID:7432
- C:\Windows\System\QWpiUjO.exe
  C:\Windows\System\QWpiUjO.exe
  2⤵
  PID:7524
- C:\Windows\System\nXUkzIl.exe
  C:\Windows\System\nXUkzIl.exe
  2⤵
  PID:7560
- C:\Windows\System\HAsDQIr.exe
  C:\Windows\System\HAsDQIr.exe
  2⤵
  PID:7300
- C:\Windows\System\jyyXiiX.exe
  C:\Windows\System\jyyXiiX.exe
  2⤵
  PID:7044
- C:\Windows\System\LMlupyu.exe
  C:\Windows\System\LMlupyu.exe
  2⤵
  PID:6664
- C:\Windows\System\osGuplV.exe
  C:\Windows\System\osGuplV.exe
  2⤵
  PID:7224
- C:\Windows\System\GnJnzKR.exe
  C:\Windows\System\GnJnzKR.exe
  2⤵
  PID:7684
- C:\Windows\System\RBzAkQP.exe
  C:\Windows\System\RBzAkQP.exe
  2⤵
  PID:7408
- C:\Windows\System\nkaHAmG.exe
  C:\Windows\System\nkaHAmG.exe
  2⤵
  PID:7620
- C:\Windows\System\mtenOnY.exe
  C:\Windows\System\mtenOnY.exe
  2⤵
  PID:7688
- C:\Windows\System\NcynWYW.exe
  C:\Windows\System\NcynWYW.exe
  2⤵
  PID:7752
- C:\Windows\System\MqvBIBP.exe
  C:\Windows\System\MqvBIBP.exe
  2⤵
  PID:7416
- C:\Windows\System\PWlUAwp.exe
  C:\Windows\System\PWlUAwp.exe
  2⤵
  PID:7508
- C:\Windows\System\YrOJoAI.exe
  C:\Windows\System\YrOJoAI.exe
  2⤵
  PID:7572
- C:\Windows\System\tbHNDrh.exe
  C:\Windows\System\tbHNDrh.exe
  2⤵
  PID:7888
- C:\Windows\System\WLxacnH.exe
  C:\Windows\System\WLxacnH.exe
  2⤵
  PID:7672
- C:\Windows\System\ZdSKjKz.exe
  C:\Windows\System\ZdSKjKz.exe
  2⤵
  PID:7736
- C:\Windows\System\kgUIRqb.exe
  C:\Windows\System\kgUIRqb.exe
  2⤵
  PID:7800
- C:\Windows\System\pxkIMiP.exe
  C:\Windows\System\pxkIMiP.exe
  2⤵
  PID:7836
- C:\Windows\System\eHSScut.exe
  C:\Windows\System\eHSScut.exe
  2⤵
  PID:7872
- C:\Windows\System\DFJYzUb.exe
  C:\Windows\System\DFJYzUb.exe
  2⤵
  PID:7936
- C:\Windows\System\fPhzuas.exe
  C:\Windows\System\fPhzuas.exe
  2⤵
  PID:8028
- C:\Windows\System\jaHofdX.exe
  C:\Windows\System\jaHofdX.exe
  2⤵
  PID:8092
- C:\Windows\System\iDuUrqe.exe
  C:\Windows\System\iDuUrqe.exe
  2⤵
  PID:8156
- C:\Windows\System\hWMZTSa.exe
  C:\Windows\System\hWMZTSa.exe
  2⤵
  PID:7984
- C:\Windows\System\SuoRRbT.exe
  C:\Windows\System\SuoRRbT.exe
  2⤵
  PID:7280
- C:\Windows\System\YjhFKGI.exe
  C:\Windows\System\YjhFKGI.exe
  2⤵
  PID:8076
- C:\Windows\System\wzqVXxd.exe
  C:\Windows\System\wzqVXxd.exe
  2⤵
  PID:7980
- C:\Windows\System\VbLUxTp.exe
  C:\Windows\System\VbLUxTp.exe
  2⤵
  PID:7920
- C:\Windows\System\EPGLSuj.exe
  C:\Windows\System\EPGLSuj.exe
  2⤵
  PID:8108
- C:\Windows\System\wSMyXAc.exe
  C:\Windows\System\wSMyXAc.exe
  2⤵
  PID:8172
- C:\Windows\System\qQZdVGb.exe
  C:\Windows\System\qQZdVGb.exe
  2⤵
  PID:7212
- C:\Windows\System\DDrVbAL.exe
  C:\Windows\System\DDrVbAL.exe
  2⤵
  PID:7392
- C:\Windows\System\ouAUUyt.exe
  C:\Windows\System\ouAUUyt.exe
  2⤵
  PID:7556
- C:\Windows\System\cRSxlqd.exe
  C:\Windows\System\cRSxlqd.exe
  2⤵
  PID:6296
- C:\Windows\System\LfdOxLp.exe
  C:\Windows\System\LfdOxLp.exe
  2⤵
  PID:7652
- C:\Windows\System\uaYKvEn.exe
  C:\Windows\System\uaYKvEn.exe
  2⤵
  PID:6752
- C:\Windows\System\HVhhCqL.exe
  C:\Windows\System\HVhhCqL.exe
  2⤵
  PID:7640
- C:\Windows\System\MUxNFab.exe
  C:\Windows\System\MUxNFab.exe
  2⤵
  PID:7868
- C:\Windows\System\lHAqsct.exe
  C:\Windows\System\lHAqsct.exe
  2⤵
  PID:8128
- C:\Windows\System\HzzyqmE.exe
  C:\Windows\System\HzzyqmE.exe
  2⤵
  PID:7588
- C:\Windows\System\AWYWAfP.exe
  C:\Windows\System\AWYWAfP.exe
  2⤵
  PID:2872
- C:\Windows\System\rKqqiZS.exe
  C:\Windows\System\rKqqiZS.exe
  2⤵
  PID:7264
- C:\Windows\System\eiiHBnr.exe
  C:\Windows\System\eiiHBnr.exe
  2⤵
  PID:7748
- C:\Windows\System\WBrEzTu.exe
  C:\Windows\System\WBrEzTu.exe
  2⤵
  PID:7732
- C:\Windows\System\mzqryLa.exe
  C:\Windows\System\mzqryLa.exe
  2⤵
  PID:5148
- C:\Windows\System\uQPZtbM.exe
  C:\Windows\System\uQPZtbM.exe
  2⤵
  PID:8048
- C:\Windows\System\YVaRJhp.exe
  C:\Windows\System\YVaRJhp.exe
  2⤵
  PID:6152
- C:\Windows\System\GQIpZrF.exe
  C:\Windows\System\GQIpZrF.exe
  2⤵
  PID:7380
- C:\Windows\System\chifoKX.exe
  C:\Windows\System\chifoKX.exe
  2⤵
  PID:8124
- C:\Windows\System\clBxfmX.exe
  C:\Windows\System\clBxfmX.exe
  2⤵
  PID:7948
- C:\Windows\System\mJMmzCY.exe
  C:\Windows\System\mJMmzCY.exe
  2⤵
  PID:7852
- C:\Windows\System\nbRRnms.exe
  C:\Windows\System\nbRRnms.exe
  2⤵
  PID:6912
- C:\Windows\System\OyWoChp.exe
  C:\Windows\System\OyWoChp.exe
  2⤵
  PID:7544
- C:\Windows\System\sjZAQJN.exe
  C:\Windows\System\sjZAQJN.exe
  2⤵
  PID:7932
- C:\Windows\System\FZfsyNv.exe
  C:\Windows\System\FZfsyNv.exe
  2⤵
  PID:7476
- C:\Windows\System\jTweLse.exe
  C:\Windows\System\jTweLse.exe
  2⤵
  PID:7480
- C:\Windows\System\ZXXpgPR.exe
  C:\Windows\System\ZXXpgPR.exe
  2⤵
  PID:2692
- C:\Windows\System\OQyGSKx.exe
  C:\Windows\System\OQyGSKx.exe
  2⤵
  PID:7448
- C:\Windows\System\JssQTvF.exe
  C:\Windows\System\JssQTvF.exe
  2⤵
  PID:7376
- C:\Windows\System\aVfdSIU.exe
  C:\Windows\System\aVfdSIU.exe
  2⤵
  PID:7144
- C:\Windows\System\vhoWUdV.exe
  C:\Windows\System\vhoWUdV.exe
  2⤵
  PID:7820
- C:\Windows\System\kaqnrzM.exe
  C:\Windows\System\kaqnrzM.exe
  2⤵
  PID:7284
- C:\Windows\System\EALqKpw.exe
  C:\Windows\System\EALqKpw.exe
  2⤵
  PID:8196
- C:\Windows\System\pGPHrUL.exe
  C:\Windows\System\pGPHrUL.exe
  2⤵
  PID:8212
- C:\Windows\System\BkblXHs.exe
  C:\Windows\System\BkblXHs.exe
  2⤵
  PID:8228
- C:\Windows\System\mwiBGds.exe
  C:\Windows\System\mwiBGds.exe
  2⤵
  PID:8244
- C:\Windows\System\QCshOjA.exe
  C:\Windows\System\QCshOjA.exe
  2⤵
  PID:8260
- C:\Windows\System\riwrkXu.exe
  C:\Windows\System\riwrkXu.exe
  2⤵
  PID:8276
- C:\Windows\System\Fterkdv.exe
  C:\Windows\System\Fterkdv.exe
  2⤵
  PID:8292
- C:\Windows\System\gnusivz.exe
  C:\Windows\System\gnusivz.exe
  2⤵
  PID:8308
- C:\Windows\System\zeSCEoV.exe
  C:\Windows\System\zeSCEoV.exe
  2⤵
  PID:8328
- C:\Windows\System\VDpQrhd.exe
  C:\Windows\System\VDpQrhd.exe
  2⤵
  PID:8344
- C:\Windows\System\AZbSnFP.exe
  C:\Windows\System\AZbSnFP.exe
  2⤵
  PID:8360
- C:\Windows\System\GMaPHcU.exe
  C:\Windows\System\GMaPHcU.exe
  2⤵
  PID:8376
- C:\Windows\System\yQbwNKo.exe
  C:\Windows\System\yQbwNKo.exe
  2⤵
  PID:8392
- C:\Windows\System\xFMUfKY.exe
  C:\Windows\System\xFMUfKY.exe
  2⤵
  PID:8412
- C:\Windows\System\tOiCMmg.exe
  C:\Windows\System\tOiCMmg.exe
  2⤵
  PID:8428
- C:\Windows\System\yFNvZpm.exe
  C:\Windows\System\yFNvZpm.exe
  2⤵
  PID:8444
- C:\Windows\System\mVqFqTm.exe
  C:\Windows\System\mVqFqTm.exe
  2⤵
  PID:8460
- C:\Windows\System\xWefBSF.exe
  C:\Windows\System\xWefBSF.exe
  2⤵
  PID:8476
- C:\Windows\System\hnpBcGk.exe
  C:\Windows\System\hnpBcGk.exe
  2⤵
  PID:8492
- C:\Windows\System\epDVoRN.exe
  C:\Windows\System\epDVoRN.exe
  2⤵
  PID:8508
- C:\Windows\System\ZVBMiTz.exe
  C:\Windows\System\ZVBMiTz.exe
  2⤵
  PID:8524
- C:\Windows\System\sRYRwyV.exe
  C:\Windows\System\sRYRwyV.exe
  2⤵
  PID:8540
- C:\Windows\System\kLtEPAt.exe
  C:\Windows\System\kLtEPAt.exe
  2⤵
  PID:8556
- C:\Windows\System\hZeeuAw.exe
  C:\Windows\System\hZeeuAw.exe
  2⤵
  PID:8572
- C:\Windows\System\YigVPyP.exe
  C:\Windows\System\YigVPyP.exe
  2⤵
  PID:8588
- C:\Windows\System\UonFMvG.exe
  C:\Windows\System\UonFMvG.exe
  2⤵
  PID:8604
- C:\Windows\System\dPWsvpX.exe
  C:\Windows\System\dPWsvpX.exe
  2⤵
  PID:8620
- C:\Windows\System\kYiYySg.exe
  C:\Windows\System\kYiYySg.exe
  2⤵
  PID:8636
- C:\Windows\System\JIZSvwd.exe
  C:\Windows\System\JIZSvwd.exe
  2⤵
  PID:8652
- C:\Windows\System\yKZXQeg.exe
  C:\Windows\System\yKZXQeg.exe
  2⤵
  PID:8668
- C:\Windows\System\twkAaIi.exe
  C:\Windows\System\twkAaIi.exe
  2⤵
  PID:8684
- C:\Windows\System\sYkepJg.exe
  C:\Windows\System\sYkepJg.exe
  2⤵
  PID:8700
- C:\Windows\System\HwKWFzi.exe
  C:\Windows\System\HwKWFzi.exe
  2⤵
  PID:8716
- C:\Windows\System\nHKCWxO.exe
  C:\Windows\System\nHKCWxO.exe
  2⤵
  PID:8732
- C:\Windows\System\MlsDiRB.exe
  C:\Windows\System\MlsDiRB.exe
  2⤵
  PID:8748
- C:\Windows\System\kanOpxz.exe
  C:\Windows\System\kanOpxz.exe
  2⤵
  PID:8764
- C:\Windows\System\WeXzwXf.exe
  C:\Windows\System\WeXzwXf.exe
  2⤵
  PID:8780
- C:\Windows\System\VhlgjIT.exe
  C:\Windows\System\VhlgjIT.exe
  2⤵
  PID:8796
- C:\Windows\System\PxeulWX.exe
  C:\Windows\System\PxeulWX.exe
  2⤵
  PID:8812
- C:\Windows\System\XNkHKhp.exe
  C:\Windows\System\XNkHKhp.exe
  2⤵
  PID:8828
- C:\Windows\System\EJXSOfL.exe
  C:\Windows\System\EJXSOfL.exe
  2⤵
  PID:8844
- C:\Windows\System\KvsBTbT.exe
  C:\Windows\System\KvsBTbT.exe
  2⤵
  PID:8860
- C:\Windows\System\WykWRzJ.exe
  C:\Windows\System\WykWRzJ.exe
  2⤵
  PID:8876
- C:\Windows\System\DyTTDmu.exe
  C:\Windows\System\DyTTDmu.exe
  2⤵
  PID:8892
- C:\Windows\System\XIVHvSP.exe
  C:\Windows\System\XIVHvSP.exe
  2⤵
  PID:8908
- C:\Windows\System\CWOjsoj.exe
  C:\Windows\System\CWOjsoj.exe
  2⤵
  PID:8928
- C:\Windows\System\EElxgXC.exe
  C:\Windows\System\EElxgXC.exe
  2⤵
  PID:8944
- C:\Windows\System\JQAaCEy.exe
  C:\Windows\System\JQAaCEy.exe
  2⤵
  PID:8960
- C:\Windows\System\UaRdUVe.exe
  C:\Windows\System\UaRdUVe.exe
  2⤵
  PID:8976
- C:\Windows\System\lchSLMW.exe
  C:\Windows\System\lchSLMW.exe
  2⤵
  PID:8992
- C:\Windows\System\mOjzRml.exe
  C:\Windows\System\mOjzRml.exe
  2⤵
  PID:9008
- C:\Windows\System\FOHEBfi.exe
  C:\Windows\System\FOHEBfi.exe
  2⤵
  PID:9032
- C:\Windows\System\zxDgwXw.exe
  C:\Windows\System\zxDgwXw.exe
  2⤵
  PID:9056
- C:\Windows\System\fkmrdxp.exe
  C:\Windows\System\fkmrdxp.exe
  2⤵
  PID:9072
- C:\Windows\System\iBeJzHA.exe
  C:\Windows\System\iBeJzHA.exe
  2⤵
  PID:9088
- C:\Windows\System\tUrDkqC.exe
  C:\Windows\System\tUrDkqC.exe
  2⤵
  PID:9104
- C:\Windows\System\rdokgMw.exe
  C:\Windows\System\rdokgMw.exe
  2⤵
  PID:9120
- C:\Windows\System\zrKUOLa.exe
  C:\Windows\System\zrKUOLa.exe
  2⤵
  PID:9136
- C:\Windows\System\FEbViKs.exe
  C:\Windows\System\FEbViKs.exe
  2⤵
  PID:9152
- C:\Windows\System\MWBGSOX.exe
  C:\Windows\System\MWBGSOX.exe
  2⤵
  PID:9168
- C:\Windows\System\ZBhGwEw.exe
  C:\Windows\System\ZBhGwEw.exe
  2⤵
  PID:9184
- C:\Windows\System\eyhvofU.exe
  C:\Windows\System\eyhvofU.exe
  2⤵
  PID:9200
- C:\Windows\System\lLewWis.exe
  C:\Windows\System\lLewWis.exe
  2⤵
  PID:6636
- C:\Windows\System\KXjWpbN.exe
  C:\Windows\System\KXjWpbN.exe
  2⤵
  PID:8256
- C:\Windows\System\PYuPNGF.exe
  C:\Windows\System\PYuPNGF.exe
  2⤵
  PID:8320
- C:\Windows\System\kmwpRWA.exe
  C:\Windows\System\kmwpRWA.exe
  2⤵
  PID:8140
- C:\Windows\System\vKgzlut.exe
  C:\Windows\System\vKgzlut.exe
  2⤵
  PID:7332
- C:\Windows\System\mrTAFSq.exe
  C:\Windows\System\mrTAFSq.exe
  2⤵
  PID:8424
- C:\Windows\System\lfixLiz.exe
  C:\Windows\System\lfixLiz.exe
  2⤵
  PID:8336
- C:\Windows\System\qKnWllh.exe
  C:\Windows\System\qKnWllh.exe
  2⤵
  PID:8144
- C:\Windows\System\HQgzEiw.exe
  C:\Windows\System\HQgzEiw.exe
  2⤵
  PID:8204
- C:\Windows\System\vtMPcIJ.exe
  C:\Windows\System\vtMPcIJ.exe
  2⤵
  PID:8268
- C:\Windows\System\vVMgHhk.exe
  C:\Windows\System\vVMgHhk.exe
  2⤵
  PID:8340
- C:\Windows\System\FsKdKkQ.exe
  C:\Windows\System\FsKdKkQ.exe
  2⤵
  PID:8408
- C:\Windows\System\yyZDZaN.exe
  C:\Windows\System\yyZDZaN.exe
  2⤵
  PID:8488
- C:\Windows\System\ZYhosiO.exe
  C:\Windows\System\ZYhosiO.exe
  2⤵
  PID:8552
- C:\Windows\System\jewpTXU.exe
  C:\Windows\System\jewpTXU.exe
  2⤵
  PID:8536
- C:\Windows\System\rofCzyG.exe
  C:\Windows\System\rofCzyG.exe
  2⤵
  PID:8532
- C:\Windows\System\sUkCBCU.exe
  C:\Windows\System\sUkCBCU.exe
  2⤵
  PID:7244
- C:\Windows\System\HYaStOx.exe
  C:\Windows\System\HYaStOx.exe
  2⤵
  PID:8712
- C:\Windows\System\pxSBxAR.exe
  C:\Windows\System\pxSBxAR.exe
  2⤵
  PID:8772
- C:\Windows\System\aaNPWLk.exe
  C:\Windows\System\aaNPWLk.exe
  2⤵
  PID:8840
- C:\Windows\System\IPGYEtb.exe
  C:\Windows\System\IPGYEtb.exe
  2⤵
  PID:8868
- C:\Windows\System\HEkGZpA.exe
  C:\Windows\System\HEkGZpA.exe
  2⤵
  PID:8904
- C:\Windows\System\MpIBqgU.exe
  C:\Windows\System\MpIBqgU.exe
  2⤵
  PID:8788
- C:\Windows\System\HePkDvI.exe
  C:\Windows\System\HePkDvI.exe
  2⤵
  PID:8940
- C:\Windows\System\jZLWnan.exe
  C:\Windows\System\jZLWnan.exe
  2⤵
  PID:8856
- C:\Windows\System\SeOvXjE.exe
  C:\Windows\System\SeOvXjE.exe
  2⤵
  PID:8916
- C:\Windows\System\bfYXmHB.exe
  C:\Windows\System\bfYXmHB.exe
  2⤵
  PID:8888
- C:\Windows\System\NapshxD.exe
  C:\Windows\System\NapshxD.exe
  2⤵
  PID:8984
- C:\Windows\System\wKMoeCx.exe
  C:\Windows\System\wKMoeCx.exe
  2⤵
  PID:9016
- C:\Windows\System\hNHoWPs.exe
  C:\Windows\System\hNHoWPs.exe
  2⤵
  PID:9048
- C:\Windows\System\BOYQZSD.exe
  C:\Windows\System\BOYQZSD.exe
  2⤵
  PID:9084
- C:\Windows\System\omwcIti.exe
  C:\Windows\System\omwcIti.exe
  2⤵
  PID:9148
- C:\Windows\System\vEJQuPZ.exe
  C:\Windows\System\vEJQuPZ.exe
  2⤵
  PID:9212
- C:\Windows\System\tvNBidr.exe
  C:\Windows\System\tvNBidr.exe
  2⤵
  PID:8456
- C:\Windows\System\VnmXQNJ.exe
  C:\Windows\System\VnmXQNJ.exe
  2⤵
  PID:8300
- C:\Windows\System\lqFYIPJ.exe
  C:\Windows\System\lqFYIPJ.exe
  2⤵
  PID:8484
- C:\Windows\System\gVhlvkA.exe
  C:\Windows\System\gVhlvkA.exe
  2⤵
  PID:9096
- C:\Windows\System\xfHHZdR.exe
  C:\Windows\System\xfHHZdR.exe
  2⤵
  PID:9160
- C:\Windows\System\tdCeguT.exe
  C:\Windows\System\tdCeguT.exe
  2⤵
  PID:8224
- C:\Windows\System\wyuVRmF.exe
  C:\Windows\System\wyuVRmF.exe
  2⤵
  PID:8388
- C:\Windows\System\dQuHQcf.exe
  C:\Windows\System\dQuHQcf.exe
  2⤵
  PID:8236
- C:\Windows\System\RbsXwHW.exe
  C:\Windows\System\RbsXwHW.exe
  2⤵
  PID:8520
- C:\Windows\System\ZjYuvCa.exe
  C:\Windows\System\ZjYuvCa.exe
  2⤵
  PID:8568
- C:\Windows\System\OKdgoxX.exe
  C:\Windows\System\OKdgoxX.exe
  2⤵
  PID:8628
- C:\Windows\System\gosckCW.exe
  C:\Windows\System\gosckCW.exe
  2⤵
  PID:8660
- C:\Windows\System\VirbYgP.exe
  C:\Windows\System\VirbYgP.exe
  2⤵
  PID:8852
- C:\Windows\System\xbUhSkS.exe
  C:\Windows\System\xbUhSkS.exe
  2⤵
  PID:9080
- C:\Windows\System\lEpZzAi.exe
  C:\Windows\System\lEpZzAi.exe
  2⤵
  PID:7176
- C:\Windows\System\ggTMiNO.exe
  C:\Windows\System\ggTMiNO.exe
  2⤵
  PID:9028
- C:\Windows\System\nGqhgBH.exe
  C:\Windows\System\nGqhgBH.exe
  2⤵
  PID:9000
- C:\Windows\System\ROqteaz.exe
  C:\Windows\System\ROqteaz.exe
  2⤵
  PID:9068
- C:\Windows\System\RkFKXFz.exe
  C:\Windows\System\RkFKXFz.exe
  2⤵
  PID:9192
- C:\Windows\System\ARBBEVG.exe
  C:\Windows\System\ARBBEVG.exe
  2⤵
  PID:8356
- C:\Windows\System\cHPDzKl.exe
  C:\Windows\System\cHPDzKl.exe
  2⤵
  PID:8564
- C:\Windows\System\oDbzPuC.exe
  C:\Windows\System\oDbzPuC.exe
  2⤵
  PID:8324
- C:\Windows\System\rxDzRgA.exe
  C:\Windows\System\rxDzRgA.exe
  2⤵
  PID:8584
- C:\Windows\System\MzSTTqs.exe
  C:\Windows\System\MzSTTqs.exe
  2⤵
  PID:8632
- C:\Windows\System\WZNlSuF.exe
  C:\Windows\System\WZNlSuF.exe
  2⤵
  PID:8316
- C:\Windows\System\fEQYFIG.exe
  C:\Windows\System\fEQYFIG.exe
  2⤵
  PID:9040
- C:\Windows\System\ZjbZIkP.exe
  C:\Windows\System\ZjbZIkP.exe
  2⤵
  PID:8664
- C:\Windows\System\TbUunFe.exe
  C:\Windows\System\TbUunFe.exe
  2⤵
  PID:8836
- C:\Windows\System\teDJqAd.exe
  C:\Windows\System\teDJqAd.exe
  2⤵
  PID:8708
- C:\Windows\System\mseJLsm.exe
  C:\Windows\System\mseJLsm.exe
  2⤵
  PID:8972
- C:\Windows\System\FlAijKa.exe
  C:\Windows\System\FlAijKa.exe
  2⤵
  PID:9064
- C:\Windows\System\wRKzAQc.exe
  C:\Windows\System\wRKzAQc.exe
  2⤵
  PID:8808
- C:\Windows\System\khgzoza.exe
  C:\Windows\System\khgzoza.exe
  2⤵
  PID:8824
- C:\Windows\System\hvHkoJq.exe
  C:\Windows\System\hvHkoJq.exe
  2⤵
  PID:7704
- C:\Windows\System\BYgGztt.exe
  C:\Windows\System\BYgGztt.exe
  2⤵
  PID:9132
- C:\Windows\System\gVkAEDK.exe
  C:\Windows\System\gVkAEDK.exe
  2⤵
  PID:9208
- C:\Windows\System\Myezbhc.exe
  C:\Windows\System\Myezbhc.exe
  2⤵
  PID:8616
- C:\Windows\System\RNBDCRx.exe
  C:\Windows\System\RNBDCRx.exe
  2⤵
  PID:9232
- C:\Windows\System\czjrYVP.exe
  C:\Windows\System\czjrYVP.exe
  2⤵
  PID:9248
- C:\Windows\System\nfhUXwT.exe
  C:\Windows\System\nfhUXwT.exe
  2⤵
  PID:9264
- C:\Windows\System\JcmwzHo.exe
  C:\Windows\System\JcmwzHo.exe
  2⤵
  PID:9280
- C:\Windows\System\hZJSSLD.exe
  C:\Windows\System\hZJSSLD.exe
  2⤵
  PID:9300
- C:\Windows\System\aJSSwtU.exe
  C:\Windows\System\aJSSwtU.exe
  2⤵
  PID:9316
- C:\Windows\System\IwompnJ.exe
  C:\Windows\System\IwompnJ.exe
  2⤵
  PID:9332
- C:\Windows\System\ZnqBJAZ.exe
  C:\Windows\System\ZnqBJAZ.exe
  2⤵
  PID:9348
- C:\Windows\System\YalxfbW.exe
  C:\Windows\System\YalxfbW.exe
  2⤵
  PID:9364
- C:\Windows\System\IZUulxG.exe
  C:\Windows\System\IZUulxG.exe
  2⤵
  PID:9384
- C:\Windows\System\ZqtHYSx.exe
  C:\Windows\System\ZqtHYSx.exe
  2⤵
  PID:9400
- C:\Windows\System\XIQYHaH.exe
  C:\Windows\System\XIQYHaH.exe
  2⤵
  PID:9416
- C:\Windows\System\IBlFuuU.exe
  C:\Windows\System\IBlFuuU.exe
  2⤵
  PID:9432
- C:\Windows\System\WhKcDCE.exe
  C:\Windows\System\WhKcDCE.exe
  2⤵
  PID:9448
- C:\Windows\System\wswhJYx.exe
  C:\Windows\System\wswhJYx.exe
  2⤵
  PID:9464
- C:\Windows\System\HGUeNGA.exe
  C:\Windows\System\HGUeNGA.exe
  2⤵
  PID:9480
- C:\Windows\System\yJUrvTj.exe
  C:\Windows\System\yJUrvTj.exe
  2⤵
  PID:9496
- C:\Windows\System\fxbsLHn.exe
  C:\Windows\System\fxbsLHn.exe
  2⤵
  PID:9512
- C:\Windows\System\YvTEDeR.exe
  C:\Windows\System\YvTEDeR.exe
  2⤵
  PID:9528
- C:\Windows\System\rQHhVAW.exe
  C:\Windows\System\rQHhVAW.exe
  2⤵
  PID:9544
- C:\Windows\System\sEcGJVw.exe
  C:\Windows\System\sEcGJVw.exe
  2⤵
  PID:9560
- C:\Windows\System\QWlrRoo.exe
  C:\Windows\System\QWlrRoo.exe
  2⤵
  PID:9576
- C:\Windows\System\zxrHLem.exe
  C:\Windows\System\zxrHLem.exe
  2⤵
  PID:9692
- C:\Windows\System\gtmbaJt.exe
  C:\Windows\System\gtmbaJt.exe
  2⤵
  PID:9712
- C:\Windows\System\uqLZcIg.exe
  C:\Windows\System\uqLZcIg.exe
  2⤵
  PID:9728
- C:\Windows\System\VjzaKAm.exe
  C:\Windows\System\VjzaKAm.exe
  2⤵
  PID:9748
- C:\Windows\System\HDZhOkN.exe
  C:\Windows\System\HDZhOkN.exe
  2⤵
  PID:9764
- C:\Windows\System\JrrtXsp.exe
  C:\Windows\System\JrrtXsp.exe
  2⤵
  PID:9780
- C:\Windows\System\CqUErcV.exe
  C:\Windows\System\CqUErcV.exe
  2⤵
  PID:9796
- C:\Windows\System\EUOZJbF.exe
  C:\Windows\System\EUOZJbF.exe
  2⤵
  PID:9816
- C:\Windows\System\cDaNlla.exe
  C:\Windows\System\cDaNlla.exe
  2⤵
  PID:9832
- C:\Windows\System\wvtUVGk.exe
  C:\Windows\System\wvtUVGk.exe
  2⤵
  PID:9848
- C:\Windows\System\DOdLOUu.exe
  C:\Windows\System\DOdLOUu.exe
  2⤵
  PID:9864
- C:\Windows\System\yXQvFMm.exe
  C:\Windows\System\yXQvFMm.exe
  2⤵
  PID:9880
- C:\Windows\System\gOgQvbs.exe
  C:\Windows\System\gOgQvbs.exe
  2⤵
  PID:9896
- C:\Windows\System\vTxxUAx.exe
  C:\Windows\System\vTxxUAx.exe
  2⤵
  PID:9912
- C:\Windows\System\XDLOsHi.exe
  C:\Windows\System\XDLOsHi.exe
  2⤵
  PID:9932
- C:\Windows\System\YxgzQFP.exe
  C:\Windows\System\YxgzQFP.exe
  2⤵
  PID:9948
- C:\Windows\System\uPVJMQy.exe
  C:\Windows\System\uPVJMQy.exe
  2⤵
  PID:9964
- C:\Windows\System\AZawszk.exe
  C:\Windows\System\AZawszk.exe
  2⤵
  PID:9980
- C:\Windows\System\OYoxjSg.exe
  C:\Windows\System\OYoxjSg.exe
  2⤵
  PID:9996
- C:\Windows\System\wMOwQLM.exe
  C:\Windows\System\wMOwQLM.exe
  2⤵
  PID:10012
- C:\Windows\System\yjrmgIT.exe
  C:\Windows\System\yjrmgIT.exe
  2⤵
  PID:10028
- C:\Windows\System\FJRtIta.exe
  C:\Windows\System\FJRtIta.exe
  2⤵
  PID:10044
- C:\Windows\System\UiOVXdx.exe
  C:\Windows\System\UiOVXdx.exe
  2⤵
  PID:10060
- C:\Windows\System\jKcvMMR.exe
  C:\Windows\System\jKcvMMR.exe
  2⤵
  PID:10076
- C:\Windows\System\hBIZsPl.exe
  C:\Windows\System\hBIZsPl.exe
  2⤵
  PID:10096
- C:\Windows\System\cTmtlph.exe
  C:\Windows\System\cTmtlph.exe
  2⤵
  PID:10112
- C:\Windows\System\wCchHpH.exe
  C:\Windows\System\wCchHpH.exe
  2⤵
  PID:10128
- C:\Windows\System\CkChatu.exe
  C:\Windows\System\CkChatu.exe
  2⤵
  PID:10144
- C:\Windows\System\TAvhbaZ.exe
  C:\Windows\System\TAvhbaZ.exe
  2⤵
  PID:10160
- C:\Windows\System\XTIFFJL.exe
  C:\Windows\System\XTIFFJL.exe
  2⤵
  PID:10176
- C:\Windows\System\ZLTAKsZ.exe
  C:\Windows\System\ZLTAKsZ.exe
  2⤵
  PID:10192
- C:\Windows\System\oxTSrSE.exe
  C:\Windows\System\oxTSrSE.exe
  2⤵
  PID:10208
- C:\Windows\System\qbNGdTe.exe
  C:\Windows\System\qbNGdTe.exe
  2⤵
  PID:10224
- C:\Windows\System\SJfxlaw.exe
  C:\Windows\System\SJfxlaw.exe
  2⤵
  PID:9224
- C:\Windows\System\dwAnDDy.exe
  C:\Windows\System\dwAnDDy.exe
  2⤵
  PID:8400
- C:\Windows\System\ANIkoHY.exe
  C:\Windows\System\ANIkoHY.exe
  2⤵
  PID:9296
- C:\Windows\System\teRJCvw.exe
  C:\Windows\System\teRJCvw.exe
  2⤵
  PID:9356
- C:\Windows\System\yQaaQJI.exe
  C:\Windows\System\yQaaQJI.exe
  2⤵
  PID:9424
- C:\Windows\System\wFGRnNA.exe
  C:\Windows\System\wFGRnNA.exe
  2⤵
  PID:9376
- C:\Windows\System\vhqQwtL.exe
  C:\Windows\System\vhqQwtL.exe
  2⤵
  PID:8468
- C:\Windows\System\qhiPNwJ.exe
  C:\Windows\System\qhiPNwJ.exe
  2⤵
  PID:9272
- C:\Windows\System\ETQaIFb.exe
  C:\Windows\System\ETQaIFb.exe
  2⤵
  PID:9412
- C:\Windows\System\hgpnHSR.exe
  C:\Windows\System\hgpnHSR.exe
  2⤵
  PID:9488
- C:\Windows\System\WtbzcsE.exe
  C:\Windows\System\WtbzcsE.exe
  2⤵
  PID:9508
- C:\Windows\System\hJUtOoO.exe
  C:\Windows\System\hJUtOoO.exe
  2⤵
  PID:9504
- C:\Windows\System\KgVnTqf.exe
  C:\Windows\System\KgVnTqf.exe
  2⤵
  PID:9520
- C:\Windows\System\ovwJFSr.exe
  C:\Windows\System\ovwJFSr.exe
  2⤵
  PID:9588
- C:\Windows\System\NhAArzx.exe
  C:\Windows\System\NhAArzx.exe
  2⤵
  PID:9600
- C:\Windows\System\xzbIiOc.exe
  C:\Windows\System\xzbIiOc.exe
  2⤵
  PID:2032
- C:\Windows\System\guKdZUY.exe
  C:\Windows\System\guKdZUY.exe
  2⤵
  PID:9624
- C:\Windows\System\tcXutJc.exe
  C:\Windows\System\tcXutJc.exe
  2⤵
  PID:9632
- C:\Windows\System\RzABsoV.exe
  C:\Windows\System\RzABsoV.exe
  2⤵
  PID:9648
- C:\Windows\System\PusLADO.exe
  C:\Windows\System\PusLADO.exe
  2⤵
  PID:9664
- C:\Windows\System\vVbUuNT.exe
  C:\Windows\System\vVbUuNT.exe
  2⤵
  PID:9680
- C:\Windows\System\eAuhwZF.exe
  C:\Windows\System\eAuhwZF.exe
  2⤵
  PID:9604
- C:\Windows\System\yDusrNc.exe
  C:\Windows\System\yDusrNc.exe
  2⤵
  PID:9736
- C:\Windows\System\DOXpJhK.exe
  C:\Windows\System\DOXpJhK.exe
  2⤵
  PID:9776
- C:\Windows\System\QQGHYYk.exe
  C:\Windows\System\QQGHYYk.exe
  2⤵
  PID:9824
- C:\Windows\System\QvxkmZd.exe
  C:\Windows\System\QvxkmZd.exe
  2⤵
  PID:9760
- C:\Windows\System\OMvLxCQ.exe
  C:\Windows\System\OMvLxCQ.exe
  2⤵
  PID:9856
- C:\Windows\System\ezWiXTV.exe
  C:\Windows\System\ezWiXTV.exe
  2⤵
  PID:9888
- C:\Windows\System\fDcKBkP.exe
  C:\Windows\System\fDcKBkP.exe
  2⤵
  PID:9928
- C:\Windows\System\SwtYIlz.exe
  C:\Windows\System\SwtYIlz.exe
  2⤵
  PID:9992
- C:\Windows\System\MCMflct.exe
  C:\Windows\System\MCMflct.exe
  2⤵
  PID:10052
- C:\Windows\System\xSOsCKe.exe
  C:\Windows\System\xSOsCKe.exe
  2⤵
  PID:10092
- C:\Windows\System\AMPXdYv.exe
  C:\Windows\System\AMPXdYv.exe
  2⤵
  PID:10156
- C:\Windows\System\lSnYBEA.exe
  C:\Windows\System\lSnYBEA.exe
  2⤵
  PID:10004
- C:\Windows\System\mVfzWlg.exe
  C:\Windows\System\mVfzWlg.exe
  2⤵
  PID:10040
- C:\Windows\System\VyTxdGV.exe
  C:\Windows\System\VyTxdGV.exe
  2⤵
  PID:9976
- C:\Windows\System\dtBLbmt.exe
  C:\Windows\System\dtBLbmt.exe
  2⤵
  PID:10108
- C:\Windows\System\QHhxtch.exe
  C:\Windows\System\QHhxtch.exe
  2⤵
  PID:10168
- C:\Windows\System\iZRXvoR.exe
  C:\Windows\System\iZRXvoR.exe
  2⤵
  PID:9288
- C:\Windows\System\ftEiVhS.exe
  C:\Windows\System\ftEiVhS.exe
  2⤵
  PID:9276
- C:\Windows\System\caeVglb.exe
  C:\Windows\System\caeVglb.exe
  2⤵
  PID:9312
- C:\Windows\System\NcBPNpQ.exe
  C:\Windows\System\NcBPNpQ.exe
  2⤵
  PID:9328
- C:\Windows\System\gOvDyBq.exe
  C:\Windows\System\gOvDyBq.exe
  2⤵
  PID:9244
- C:\Windows\System\YAxZmLZ.exe
  C:\Windows\System\YAxZmLZ.exe
  2⤵
  PID:9596
- C:\Windows\System\cfPiRUj.exe
  C:\Windows\System\cfPiRUj.exe
  2⤵
  PID:9440
- C:\Windows\System\bTeapBG.exe
  C:\Windows\System\bTeapBG.exe
  2⤵
  PID:9644
- C:\Windows\System\oHerMlE.exe
  C:\Windows\System\oHerMlE.exe
  2⤵
  PID:2388
- C:\Windows\System\bzrfaZg.exe
  C:\Windows\System\bzrfaZg.exe
  2⤵
  PID:9656
- C:\Windows\System\hWLJcnB.exe
  C:\Windows\System\hWLJcnB.exe
  2⤵
  PID:9804
- C:\Windows\System\qmIHlmR.exe
  C:\Windows\System\qmIHlmR.exe
  2⤵
  PID:9740
- C:\Windows\System\bsndKJM.exe
  C:\Windows\System\bsndKJM.exe
  2⤵
  PID:9876
- C:\Windows\System\dpOxBMB.exe
  C:\Windows\System\dpOxBMB.exe
  2⤵
  PID:10084
- C:\Windows\System\voYQeUc.exe
  C:\Windows\System\voYQeUc.exe
  2⤵
  PID:9792
- C:\Windows\System\UYNpYBA.exe
  C:\Windows\System\UYNpYBA.exe
  2⤵
  PID:10068
- C:\Windows\System\rUFQAwk.exe
  C:\Windows\System\rUFQAwk.exe
  2⤵
  PID:9920
- C:\Windows\System\KVzoeQn.exe
  C:\Windows\System\KVzoeQn.exe
  2⤵
  PID:9536
- C:\Windows\System\ypMtmqd.exe
  C:\Windows\System\ypMtmqd.exe
  2⤵
  PID:10104
- C:\Windows\System\UuFBFjW.exe
  C:\Windows\System\UuFBFjW.exe
  2⤵
  PID:10152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DNBlhaC.exe

Filesize
1.8MB

MD5
65e4bd5916a6bc37b002a1a5129a0d56

SHA1
32439bcc64521ee1fe663c48b4953b400436d58a

SHA256
bb561cff1adfe6c5de1a7d307c5642d8038f375d32eb4c27fd37f49da3874aa3

SHA512
12caf9c5cfca017a5f0a172e7c79ef395281e54b6270513eda44f45ebe0e3e080068bf9c76834a6c66be14ff20581917ff53fa5be439f3c8b2d1450e4bfc372c

Download Submit
C:\Windows\system\PZnzFeV.exe

Filesize
1.8MB

MD5
afbdd513f16223cabdcc08ef558205d4

SHA1
b6675d4f9c7c7c792de188e4daa383dd5f06add0

SHA256
4cd450bf036e3094ac25800198895ccf355ebaf52f291ad779f5e99797853c60

SHA512
d885f17366b25c1540d468ae49547523afedb6f390561312dbf6b0a815b7ca3f8a308389eac9c1018fe43b799346fd5c60448b3b38b901d0b8293c8260fdef27

Download Submit
C:\Windows\system\VfjBYZL.exe

Filesize
1.8MB

MD5
f011c3c272b2650a83226057d9d6d058

SHA1
253822c2794ea237801faedbf4b6dfe5c4209300

SHA256
3c5c0de1134f596d74986b7f8ec5c836126140543ac61b087038b30a66e3372e

SHA512
390c1364e448f8ee223f2fae8e257ba14ada29656e2d70c9fc8f66a11e2ca13a7160dc59f095d61e8a10ec70ed6753488a8742ef222e8d9bc4f3eba4cdfb6d95

Download Submit
C:\Windows\system\XfPeNaS.exe

Filesize
1.8MB

MD5
37cedf65a8de3c1037db1a409480e60b

SHA1
437039f46efe9eab7751c0944668eb57efb798b3

SHA256
9b825b4637349508771412bcd178bcc47889bc52eba8ecfb497086bc6ed3449b

SHA512
d2a8a57b44f9ffab96dd8e19fb32ff45afc8a3264620d27359c0b2a4c3ce5b47264b8399972cb4a49c04371178a637354c89c4845dbde8cc7641766a1fa97b9b

Download Submit
C:\Windows\system\XwBhRHS.exe

Filesize
1.8MB

MD5
db452dd503f8d9ee4a1fdd3c7c01009b

SHA1
6964e47adf226ba492de78159fdb0b04c1ed71d7

SHA256
196be52b6591608bfd5e46b9ad520a2f85b4bbf3c8189e2d5378ef7a0ff9138d

SHA512
796054ccb2ab776d747e75fc170462888520fde23f16841a5fc29905cae7d78f860eeed8f73b39d368472f8dfbe94c6166a619d6cae980c3597ab91553ddeed9

Download Submit
C:\Windows\system\ZZsjTXm.exe

Filesize
1.8MB

MD5
9d957b2bc55e0f91746b90ba7c6d3e83

SHA1
9c0653be10251eb3772a832ffd108972c88a43aa

SHA256
cdf544015b72f4a4ad6fc6fc3d649cb4d7dc1b612f20ffcde5e17b5b70f1d00a

SHA512
883fcf3e139ab6ba0ab9f96eee38be324457b84341fd6160b0cf1326cc6ba062112b14a3b618f25e5f7a60caa01c38a8855be2322299622c53a199b5d21ed493

Download Submit
C:\Windows\system\dzLvasp.exe

Filesize
1.8MB

MD5
43e646b21b07651ae96231350aa00bb4

SHA1
6b817c886ec408229d0e48d20c92022c1b3f6150

SHA256
63bd4e3c05a521165361489cf1124eb8fc8f7c13d06f826dc85f10d1da91a907

SHA512
ab8ae03ab4ac6931a4f0722d180a63d07613212dc0ecc77d1c921ab957243f1825a421121502d40df3429790c19bee7bc7b48cf05ba1d44af5fcce7a220f2c96

Download Submit
C:\Windows\system\gkAexSr.exe

Filesize
1.8MB

MD5
71a774e728cead1d7e12136a6e961997

SHA1
e7c5d43ed038808512957397dcd28dcbb5faac02

SHA256
3a5239a013c5e3c71dc57cb8e5ebd1634aa90b5bc4dc3114104ea9286b874f2f

SHA512
3d9f9c9736f7b386cf7c0e1ff6920ec48bfc2c6b114405efda4ef397f2394dc529cc7b82f51f61696499d3e47075a51f09aa3ff3100d1f7e07796b1c79927e98

Download Submit
C:\Windows\system\iFxyMXa.exe

Filesize
1.8MB

MD5
9552f326fec80c99b2e8b98dc227edf3

SHA1
a9aea98d46961460c975379dfc851a33f6d1b0dc

SHA256
bd923772315d6e1a27efcae65fced16246ee276aeb59ab50206d4383546097e6

SHA512
37bb589dddccaf50cf4a1259bb01989726f6e6f280eaa6bd07bbc1a0b173ed1c29a3ee0c5a68c088ab87a71645f800d2ff1fb0eb40269d35a0773f32d59220e6

Download Submit
C:\Windows\system\jJPDCbz.exe

Filesize
1.8MB

MD5
dc29a2102f29434e43dddd69d5151a6e

SHA1
9f7e6cbb29a36a5535a5304f2f468ecf39e9ae64

SHA256
c74a5a8b9737396e508e572e9d0cd707edad34755a3e628b0a12b8ab774dfe6a

SHA512
dc739e4c585a7f8293d0a53f6a015acf2f9b5297b23691c15155b01841f22f5629c4989c78f8f2132f40b325e005321bbb211ff8e9b992d703031d6a7df3bd97

Download Submit
C:\Windows\system\jxCiroj.exe

Filesize
1.8MB

MD5
2cb087ae616eb3c1333ba3323167bca3

SHA1
bafaaa935b4391a2226092a8953a8594c619d147

SHA256
115edf770fd652cee0d351771b4a13f054f5eeba8b90a4b04b58bc31a7e867b0

SHA512
e6647943a745e20a2cfb14a6683dae922674db76f0748f6827353d6d39f6635237637e52ec001b584422ed42f107fe979e58e1bf49b5635fb7043304dfbdc711

Download Submit
C:\Windows\system\nWSZYaM.exe

Filesize
1.8MB

MD5
e06d272166b23da514139c44ac931685

SHA1
827383a9d3338af12b1a031fa0e0b285eabec543

SHA256
c9237e0e4bee5f53a669d23b214ff36cdecd59736eff6a1c0890aa3dba87aa8c

SHA512
aa922b8d64fe5012b916de3af1f3a7cf19fbcfdaaa14d1c9c376a38953623617a8cfd53b25c15380177f02b61bfec82ed89483e21ff94fa54e0cc190c02596ee

Download Submit
C:\Windows\system\qoQkHug.exe

Filesize
1.8MB

MD5
6f2f9713454903bef522d247c153c386

SHA1
f342c4f9a3fe3adb32a4ac10443247061ef93a75

SHA256
ff97395e2d6e686a60b484be09ddea509f0d403d769aacda177b1edd4232cce6

SHA512
0035ca39dc0aa129e62a3771c329af5e1d6992adf6835b796b09d35dae4229a4ab27bf82e0672401125493068b65436c303f735777967c8ef1b7cc09c23d17d8

Download Submit
C:\Windows\system\rzLjGxZ.exe

Filesize
1.8MB

MD5
0feaa2369d52d401ca1b89091b6d2e60

SHA1
54178f7c122e46cd229006abfcc4dda8b991ffc2

SHA256
09a37549c656549341438ee8b8ac20b945e426ce7a50dd40233493e00ca4e4f1

SHA512
33b28e4f335467f027e921bb0eb5140da0b5ff4002b678d785bdb942351e08a1f5fa6b861bcbf1214aa0d591a3bfd4cab9393a5b55089dade94927e24f600235

Download Submit
C:\Windows\system\tIrkhmE.exe

Filesize
1.8MB

MD5
dcd858e22bb0c73268fb390daa86c7e9

SHA1
f2c5d57806b7bc697528450cd970a3b8e4721c76

SHA256
f3ab25baed336a49e5220c2e47ebcee6244334afb563db0cf7a5c8765c24ff79

SHA512
04aae54e59d14c7d6d7c13fed78d0f4c700ea99101acbb4099bb0ebd7bbea628a108c6fc2a8d4974faf9437df052833b532da05ba4e3bccbf04afc554e616a91

Download Submit
C:\Windows\system\xMNXQjD.exe

Filesize
1.8MB

MD5
69f0fb3db2b6b58a26aaa8de1920485c

SHA1
130e0da5af5eb07f5d1068eebe71ec269d0733f4

SHA256
65b800f15ab32c1fced1ee7c16b72e4ff2865e6e4599e3ec6a406dfa7a1e15a1

SHA512
d7e6bfd821f6d20fa8a5da392bbd83e029174085a89766fda8a6bebd8570e8a6396d99d303ba4c7b69d0b60b2b90a83c19b3bc9ca2e41a39c96a9f1836b07c50

Download Submit
\Windows\system\AIjsKuW.exe

Filesize
1.8MB

MD5
47d3444a7d12f9e21ace173cfd99d01e

SHA1
0197c8c819d0dee51cc9bb6332ee909bdbde92cd

SHA256
13dacecc1ba02f3d51e841a8344c39644b84000f76f87f43f3665ab83619bf0f

SHA512
e7ac5ced8089145152a8f958f93b3c0af802e3a261c113d745da9c692b7a3fd84f7c83d12f70e15278e2a72ff6294df236d2278a7e81f24d824ec4a00fc299cf

Download Submit
\Windows\system\BGEVWtB.exe

Filesize
1.8MB

MD5
4b0492bb1076707748cfde806a1796ab

SHA1
46bb5dfe6f1699c79e44e7f0d25e94b4193bba1d

SHA256
80ab225cf7f2b0213df8d7c7dc0707f90ea479108bfb4a8a1b62b06b851b8619

SHA512
79bf5b401784e86939b6348ec4b2e90817b04fc3fa9b73dddc1cbe52fb4f856a63b7e64eae209d8a78188b92c615667353c2a6a5bdd7a278fe10f2d32b895147

Download Submit
\Windows\system\Gnmmipt.exe

Filesize
1.8MB

MD5
386b72d5ae55dec89a9894ff489240a9

SHA1
f08ae8b3a52b052cf223dbe3ea14c864e04036ed

SHA256
e190e85f37743e93454aa15d468f946bfb59c88abaeaefe2fa05a8e3dfd7d70a

SHA512
8d7bc35550a8f321d0caf559afe85f44cee9768c239c60eecef22fe7cee8a260c9d6fc77c2cf58f8151baaffb8b669bbf87c9b9437d04a68fe37ef002c30d5bf

Download Submit
\Windows\system\HeXnDsd.exe

Filesize
1.8MB

MD5
41e1f5302f2c8f2034422ccd4b313f62

SHA1
d982322fcfa0145e5a983e2d6d580f0170d95754

SHA256
1f762a0c74e614aa2095c423d255e54fda93c71580a6b185f8a8e15cafc6b66e

SHA512
5d360c54f6390eb4dbdfee03d3faa6cdf0fc875bd21a40a3c3aa6238c85ea6614aae6eb2960ae668c5c08425d8a34394b33c295306b325a8d5078a4360fe1ccc

Download Submit
\Windows\system\HlayCRP.exe

Filesize
1.8MB

MD5
ed5651c1e58bddb87b04eacb985809dd

SHA1
6f5abdb0a648550b16041d63763b29cb56e469b3

SHA256
1625cf958b16912bcea29bb44bae2b84ec48ff974d7d2e8009733b6e66179432

SHA512
7b6a485d242c7141a6ca36d5b5ef650e025882d8886242d71de135db5e4a6310a9745792079b504ad02c4a067ce2fbc3f7bd685cd6fadffee9940395519cc11e

Download Submit
\Windows\system\LKuTTth.exe

Filesize
1.8MB

MD5
3b2b4961e1a138d059f92f6ca01e498c

SHA1
513739647ed0b3e31af970f360bb944fa1162994

SHA256
da15b065c58d4851c0e50efc25417ec0c32c9ae9194cc7ceff0305e4f8901051

SHA512
ce7a1b89122fd13c22f27638735c9f65ffd1b65a8db3c94e45074ad5f42c714a5a1bf2e4f68532f9f628503e344ff24e707a050c899e3cc3d57aaa9b941e23dc

Download Submit
\Windows\system\LwCJuNm.exe

Filesize
1.8MB

MD5
5164b180c08a2fb107e4e4e4c1b154f4

SHA1
18c0cd5b55988f6a4ca9969bd5c4e8f737c0e9f3

SHA256
18d2d2dda047441302dd383a2af90a8b53aab54c978494f9cde5345b0deff31f

SHA512
2c68292fc3ff438183fd07d615d46a7a7ae9a61f5751824b7421246eda83ad23c9e96bbead0b06d32f5a0e5e61fed9ebb2a65ccd3093f54f0a9328238116e8d6

Download Submit
\Windows\system\NjTeRKH.exe

Filesize
1.8MB

MD5
c11aa86234804c7ee77aeae0e8138b4b

SHA1
bd7672728b332032af5b5c2dd85f0cd2886d695e

SHA256
9a06ef1c4209636a14ef0d96bce94bb00d10c0da95350aaacaf4f71c3c970ea1

SHA512
2e7d51213fa7f7a27307cb1484bf0329f9c74cf1ee3424c99eadd2189ae77fd07aef783c527a0625b9e99a85f9d32fd63a546763ebc625038c5ff8936d3d51aa

Download Submit
\Windows\system\NqbqwFy.exe

Filesize
1.8MB

MD5
c1e711a72f83eb958843b60c324d4916

SHA1
d148505b90ad0a1528f86d6c1cdf0788e3ba832b

SHA256
94d7a52f8a4779bec8aff1a13775b3a519f325f4ab8d7432cd5220da7b04941b

SHA512
a9a4b179635947102c938974d5f59642a81198d5e29ec934d1b2a18bbec147420cfc767d85842730640b2d9a5eb2628446c7978872aecfbe14739661748f6c63

Download Submit
\Windows\system\OYSXYhU.exe

Filesize
1.8MB

MD5
fe61b97e38ac5220c9d57da2e9101df3

SHA1
ca6dbfbc4d4632a59cef6176e7bd22f343f10668

SHA256
5741f26a440465272cd318ffc2cdfb282fb6c663172a930a06f7d56aaa0b0db0

SHA512
f900a34e1b20c09f9b414534b440af8106a2ab1d5d09e5010b5cb0a504833f6d9b26da66760f4f7638771d2ef63a9e17af16ba4c88bcedadbef08f4cf73370b9

Download Submit
\Windows\system\QHxMsIy.exe

Filesize
1.8MB

MD5
969cb6ff0a8158e49f32c23457252149

SHA1
38b34d934ae017fed9fabfdea91292fc0e4afc72

SHA256
ebe026aaa014da1c65b1259dbfbfe780992ef06e08852e712f21afb2802e4e3f

SHA512
5ffce1bb74d83c14020f0b872815bc27cd0f59a4cfcca88d02618927e98328c2d9c4f7fe6d58fdd92dc15863bb836a3a43e395d10312425112344dda99b1ea3b

Download Submit
\Windows\system\aFeFsbA.exe

Filesize
1.8MB

MD5
46e34bb253c67f2f71fab82c54691c96

SHA1
315e61dbd319aada377a275dacbb606a83abcb10

SHA256
ee1874d8a447967226b98feda0065b798527cd1b0a426d5b0c63df655cec9074

SHA512
a490a08d58fb5145e8c7e94995d8d6d7b5e1353b36df0380ab5960249a90fa047d2e3eeefa683615384ddb5f4c084c7c31d482f50fd67507faaf4954e49e1145

Download Submit
\Windows\system\cVPYpuC.exe

Filesize
1.8MB

MD5
ef86e65c22a4c46230d0a4c8f9789be9

SHA1
d9833dd0360f8c71b37af36595de3bfb69fc5830

SHA256
a66961bd3e7b5addfff9176b89a49ed70543b04e93caffc013cf38d281ee8be6

SHA512
45eeb207eaba8b3c0c4b39f8f77db277f750504b665ce59591e99611a9e39661c04f963b5f004fac45da0a8cf7c062fc61bcaa30bd18cc65ac8824fbd31d29ed

Download Submit
\Windows\system\cohUfVh.exe

Filesize
1.8MB

MD5
131d172ff6ab73e966e6a4d21216dbcc

SHA1
3f05cec938e593f31cb78dc960626b13c1d48b4b

SHA256
668787e64ef74670bbac3f5af0433196c169e9eb291b1ae4129c7706e09c25f4

SHA512
ca34eaeea6ce19fab00722573f25ca4b2fe987344895a66b09f2a4d3f72ad6c18b4440490a83070881a24235a07fa6d4887f53bbb59c7d5eaca25e6c904918c2

Download Submit
\Windows\system\fGBoJXh.exe

Filesize
1.8MB

MD5
c4003f22fe307a22a58e0de0fd8f38e2

SHA1
340d9e3bf97555cb814274b909211cfe96e07b8e

SHA256
87d75222029405bac6cb2dacc687fda33e864906a8609acb6424babd3c422ca3

SHA512
634a29b7fb963dd3ee33c54d5ec753350672fb83d597836badb1cbf91e61d4c88eae1b9203eecd57c34b253a7b0042e3b1d1c91d291fc05a2a363426a74e644c

Download Submit
\Windows\system\fqCoCjs.exe

Filesize
1.8MB

MD5
78d6d807df91c02c2b94731a74595de6

SHA1
9c1fda2a1ce50b8dc4a13579c9d02065e2132cfd

SHA256
27db8cabce9ba24a9a50799292e857b0763f27e6cda5548ffd8e94fb6b77e1b3

SHA512
aebe0dfa3860c47072e53307232e893c4847cffbb0f67eb7bbc916beae018b32fd3f4c50d3219bc02fb1ca439bfa2b84a18dc6fa87ba73493871150ec0602bcf

Download Submit
\Windows\system\hvwvick.exe

Filesize
1.8MB

MD5
c53b63281f5df57835f3f5b994322620

SHA1
a4b4a6e5f8d304ac56d1aeef7f933301d4bd3ed5

SHA256
2faaefd1f3c4a7f497d9dca0ebfffb946ecdb0cb41f4db48d7467a14a5a11e42

SHA512
25aa9c1407a06999900936bf8e81d41de82fc2f31f420942d3bf37cd88264dc0c7e647b5df9933e9488d7a868e1784ad0aaddb00cd6cd09ae5d8bc669240ef78

Download Submit
\Windows\system\ksYDNqn.exe

Filesize
1.8MB

MD5
f4e6ea323135bbea1c019f56706fabfe

SHA1
d46e5e37f4f1f12f366464f226f97dfd2ea8b78c

SHA256
7ffa2097f2b147d6f9e3720f98296804750c811416f95793c422da1e8e0542f7

SHA512
d9b42b1664ce3355658d6eb78ecd66924c0ba705c7a2d746a44310ede8587e61b8a72c4fbbff598f1b821740d6bfefe8a2d74d25d510404c4042bfc844347c81

Download Submit
\Windows\system\qhlzkrD.exe

Filesize
1.8MB

MD5
e07be6681ad4f767082a9fc91308701b

SHA1
cef9891b8aa0ad9d055144d4f793980ca75a9f55

SHA256
b9af9f7cf8eaf97d061c4055a4e4f86bb77976c1d4b58fefa0128fbb42f11043

SHA512
d3b0f066265a6d199b165ccfd8df56430c95f30ac29f921a13e13eeb4af2031326e5bd09278ff047fd8c7cd457e7210848fc1f511672633c1c374f570fecd9ae

Download Submit
\Windows\system\rTVMNum.exe

Filesize
1.8MB

MD5
69272d24cede1960a2a6cdd07d460614

SHA1
e4c917e81875198ce3bfa5e472104e84c98ef17b

SHA256
0dff0c4d2f4727b48ac978214fce770628cc699e8f736dff4f44f135fa111734

SHA512
8be8078cda52535c9945748b37b0e040bc229e192cf126ec6641a468f776f6a3ceb9cceff79ef8cc04cc6fe13f56f159a163425b5e4c7e0e460ae8e8fee7323e

Download Submit
\Windows\system\vpzzEXe.exe

Filesize
1.8MB

MD5
895a1a1dde1a4d4c469a387e68566d9b

SHA1
d498343e99941845526080787da426271cd36b36

SHA256
c94941a40244a26d4470218c517e2bb62779c7c005fa4926532fe235a2b8b137

SHA512
4e607aaa202a70f1b7b63bff004d6e389428884d8c909e804b181c013b288770f2cd34287cffb3c05fb53983d75b9788de3492ca7eef9ab771f13e34174277fb

Download Submit
\Windows\system\xCwWSAb.exe

Filesize
1.8MB

MD5
76f1ece57819ca11eaa564d78445f8c5

SHA1
c7668fc9891c76adcda888ca7a315f3b7ec58fac

SHA256
0ef7fece3af620b4c45b0f27a41aeaa843a1d6a8be5c1906142f9e99198353e1

SHA512
d26bbfaf534fe4334ea228e006264bf68a13be3bad7b72baa3882ab4f1d768ccccd1c0323d088baf735cb396e5ef7b373f2f91f92b1fc36b2fe2b562e0bed125

Download Submit
\Windows\system\yokkqls.exe

Filesize
1.8MB

MD5
24542db8c7cbb35423265e72b8a2152c

SHA1
69211c213f0f8a39b0e0c1061bca8cc035491f93

SHA256
0c24f5a616e35748536ddc9f63acf47d2302ca2ba7fe3de24507b3a64ecf1939

SHA512
b1cf89257e8019eb9e883ec6872a9101f2c8dde50b71dc37050be9bbaa4ed06ed293d5ba164b96f7724227579850062738c6df19369bc03e33d9282261aeb8a6

Download Submit
\Windows\system\zqnlcdi.exe

Filesize
1.8MB

MD5
398124033279dad812cbfbd44541681c

SHA1
76eccaa7d84cd3ab235ba5c6db63eb8e50aa5124

SHA256
971f08b7d967d4198650f13ebdb8d139ca51500b495f58250b9dbfd91beb13db

SHA512
2f1e9ee8c437f93c412916e293f2b1c877b0b85cfeb437ccf798059f079e280dbe7d88a3ac1810104a05d9145e8fe7b1225c8dc02d40a2fccb63f305d36f3c12

Download Submit
memory/316-155-0x000000001B750000-0x000000001BA32000-memory.dmp

Filesize
2.9MB

Download
memory/316-1126-0x0000000001D80000-0x0000000001D88000-memory.dmp

Filesize
32KB

Download
memory/1728-105-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/1728-4836-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/1860-63-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/1860-4773-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2108-35-0x000000013FC90000-0x0000000140082000-memory.dmp

Filesize
3.9MB

Download
memory/2156-4823-0x000000013FA30000-0x000000013FE22000-memory.dmp

Filesize
3.9MB

Download
memory/2156-84-0x000000013FA30000-0x000000013FE22000-memory.dmp

Filesize
3.9MB

Download
memory/2168-4831-0x000000013F840000-0x000000013FC32000-memory.dmp

Filesize
3.9MB

Download
memory/2168-65-0x000000013F840000-0x000000013FC32000-memory.dmp

Filesize
3.9MB

Download
memory/2404-26-0x000000013FE10000-0x0000000140202000-memory.dmp

Filesize
3.9MB

Download
memory/2404-4789-0x000000013FE10000-0x0000000140202000-memory.dmp

Filesize
3.9MB

Download
memory/2504-4775-0x000000013F450000-0x000000013F842000-memory.dmp

Filesize
3.9MB

Download
memory/2504-59-0x000000013F450000-0x000000013F842000-memory.dmp

Filesize
3.9MB

Download
memory/2572-51-0x0000000002DC0000-0x00000000031B2000-memory.dmp

Filesize
3.9MB

Download
memory/2572-1-0x0000000000180000-0x0000000000190000-memory.dmp

Filesize
64KB

Download
memory/2572-164-0x000000013F130000-0x000000013F522000-memory.dmp

Filesize
3.9MB

Download
memory/2572-55-0x000000013F450000-0x000000013F842000-memory.dmp

Filesize
3.9MB

Download
memory/2572-56-0x0000000002DC0000-0x00000000031B2000-memory.dmp

Filesize
3.9MB

Download
memory/2572-156-0x00000000035E0000-0x00000000039D2000-memory.dmp

Filesize
3.9MB

Download
memory/2572-58-0x0000000002DC0000-0x00000000031B2000-memory.dmp

Filesize
3.9MB

Download
memory/2572-112-0x000000013F500000-0x000000013F8F2000-memory.dmp

Filesize
3.9MB

Download
memory/2572-48-0x000000013F840000-0x000000013FC32000-memory.dmp

Filesize
3.9MB

Download
memory/2572-14124-0x00000000035E0000-0x00000000039D2000-memory.dmp

Filesize
3.9MB

Download
memory/2572-6-0x0000000002DC0000-0x00000000031B2000-memory.dmp

Filesize
3.9MB

Download
memory/2572-62-0x000000013F780000-0x000000013FB72000-memory.dmp

Filesize
3.9MB

Download
memory/2572-61-0x0000000002DC0000-0x00000000031B2000-memory.dmp

Filesize
3.9MB

Download
memory/2572-44-0x0000000002DC0000-0x00000000031B2000-memory.dmp

Filesize
3.9MB

Download
memory/2572-14528-0x000000013F130000-0x000000013F522000-memory.dmp

Filesize
3.9MB

Download
memory/2572-64-0x0000000002DC0000-0x00000000031B2000-memory.dmp

Filesize
3.9MB

Download
memory/2572-14447-0x00000000035E0000-0x00000000039D2000-memory.dmp

Filesize
3.9MB

Download
memory/2572-0-0x000000013FD80000-0x0000000140172000-memory.dmp

Filesize
3.9MB

Download
memory/2576-54-0x000000013F780000-0x000000013FB72000-memory.dmp

Filesize
3.9MB

Download
memory/2612-60-0x000000013FF00000-0x00000001402F2000-memory.dmp

Filesize
3.9MB

Download
memory/2612-4781-0x000000013FF00000-0x00000001402F2000-memory.dmp

Filesize
3.9MB

Download
memory/2836-4797-0x000000013FFC0000-0x00000001403B2000-memory.dmp

Filesize
3.9MB

Download
memory/2836-70-0x000000013FFC0000-0x00000001403B2000-memory.dmp

Filesize
3.9MB

Download