xmrig | 7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424

Analysis

max time kernel
150s
max time network
156s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25/07/2024, 23:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
Size

1.6MB
MD5

3c7daa3bfb864b22365ae7743c3787c9
SHA1

55a5e13812291d078bcfceb53557f90d73693254
SHA256

7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424
SHA512

851c05b700654f5e21b77f4840906b79d07a27a6bd30f03211ccdebbb38ee8a0d9d0e75918d65f1a957a07157755867b589316c8572f4de29120058952e9473b
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYlZ3pBjqlx7TovQmVV4dThen9zq:Lz071uv4BPMkibTIA5lCx7kvRWa4pb

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 20 IoCs

miner

resource	yara_rule
behavioral1/memory/2748-42-0x000000013F460000-0x000000013F852000-memory.dmp	xmrig
behavioral1/memory/3040-38-0x000000013FC10000-0x0000000140002000-memory.dmp	xmrig
behavioral1/memory/2756-32-0x000000013FDA0000-0x0000000140192000-memory.dmp	xmrig
behavioral1/memory/2200-18-0x000000013FBA0000-0x000000013FF92000-memory.dmp	xmrig
behavioral1/memory/2384-23-0x000000013F3D0000-0x000000013F7C2000-memory.dmp	xmrig
behavioral1/memory/2716-76-0x000000013FD00000-0x00000001400F2000-memory.dmp	xmrig
behavioral1/memory/2480-72-0x0000000003480000-0x0000000003872000-memory.dmp	xmrig
behavioral1/memory/2836-71-0x000000013F990000-0x000000013FD82000-memory.dmp	xmrig
behavioral1/memory/2200-3891-0x000000013FBA0000-0x000000013FF92000-memory.dmp	xmrig
behavioral1/memory/2384-3906-0x000000013F3D0000-0x000000013F7C2000-memory.dmp	xmrig
behavioral1/memory/1388-3920-0x000000013FF00000-0x00000001402F2000-memory.dmp	xmrig
behavioral1/memory/2716-3921-0x000000013FD00000-0x00000001400F2000-memory.dmp	xmrig
behavioral1/memory/2836-3927-0x000000013F990000-0x000000013FD82000-memory.dmp	xmrig
behavioral1/memory/3040-3929-0x000000013FC10000-0x0000000140002000-memory.dmp	xmrig
behavioral1/memory/2748-3917-0x000000013F460000-0x000000013F852000-memory.dmp	xmrig
behavioral1/memory/2756-3987-0x000000013FDA0000-0x0000000140192000-memory.dmp	xmrig
behavioral1/memory/2480-5034-0x000000013F9A0000-0x000000013FD92000-memory.dmp	xmrig
behavioral1/memory/2584-5167-0x000000013F620000-0x000000013FA12000-memory.dmp	xmrig
behavioral1/memory/2740-5170-0x000000013FBE0000-0x000000013FFD2000-memory.dmp	xmrig
behavioral1/memory/2568-5540-0x000000013F820000-0x000000013FC12000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
632	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2200	rcFWEnj.exe
2384	VytqERh.exe
3040	ngVqCGE.exe
2748	YPzmOwX.exe
2756	OTnYQrd.exe
2836	oYgYJOx.exe
1388	lJWLvpK.exe
2716	LAiDOFA.exe
2584	yICTDIo.exe
2740	fHRLjdZ.exe
2568	OGqmDYC.exe
2260	isEPiaX.exe
2616	uqJDSRC.exe
1792	WhSjVmb.exe
2376	rzaAdzI.exe
1680	RaDMoBl.exe
1316	WVLShEF.exe
2636	palUjxg.exe
1156	JuNPTTw.exe
2980	SzFlQxw.exe
1964	EuXGzPt.exe
2148	dnypPPi.exe
2400	nXcFAEa.exe
2344	cgHeUGh.exe
2644	WWznCGA.exe
1980	yUuAJQE.exe
1724	flCcrjY.exe
2908	xzuqOJa.exe
1280	GDViBdl.exe
1592	NMbTYNY.exe
1804	FEXRdvV.exe
1704	SkcljgK.exe
1552	UeGFzlx.exe
1736	KZngSQw.exe
680	YefrilE.exe
1372	yiInviM.exe
912	Ybjbxjn.exe
872	ocGdShx.exe
2392	xmbXqXf.exe
1776	uhFOUOQ.exe
1508	maKSYpR.exe
1032	YlWQABw.exe
1556	pFhvWrY.exe
2196	ujLlYyr.exe
2040	jlMbSFS.exe
1264	kJEemTB.exe
2060	imttRYf.exe
2224	HlQcwsm.exe
304	XcfJlpY.exe
2396	gSRHuYC.exe
324	BDCcJvj.exe
3000	wVrtsZh.exe
1744	TywopAP.exe
1732	gABMXbY.exe
3004	hxLyljq.exe
2096	meYOEVL.exe
2220	ydJiKVj.exe
1580	mjFvTHH.exe
1576	bxtAoaR.exe
3028	xQctOgR.exe
2760	Lylywyz.exe
2172	dZOBpcz.exe
2252	pYCZiTk.exe
2560	DoyGCSh.exe

Loads dropped DLL 64 IoCs

pid	Process
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe

UPX packed file 56 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2480-0-0x000000013F9A0000-0x000000013FD92000-memory.dmp	upx
behavioral1/files/0x000a0000000122db-6.dat	upx
behavioral1/files/0x000700000001705e-11.dat	upx
behavioral1/files/0x0007000000016ebe-8.dat	upx
behavioral1/files/0x00050000000194d1-50.dat	upx
behavioral1/files/0x0007000000004e74-61.dat	upx
behavioral1/memory/2748-42-0x000000013F460000-0x000000013F852000-memory.dmp	upx
behavioral1/files/0x0008000000017462-40.dat	upx
behavioral1/memory/3040-38-0x000000013FC10000-0x0000000140002000-memory.dmp	upx
behavioral1/memory/2756-32-0x000000013FDA0000-0x0000000140192000-memory.dmp	upx
behavioral1/files/0x00070000000173e1-28.dat	upx
behavioral1/files/0x00070000000173e4-27.dat	upx
behavioral1/memory/2200-18-0x000000013FBA0000-0x000000013FF92000-memory.dmp	upx
behavioral1/memory/2384-23-0x000000013F3D0000-0x000000013F7C2000-memory.dmp	upx
behavioral1/files/0x0005000000019a54-103.dat	upx
behavioral1/files/0x0009000000016db3-115.dat	upx
behavioral1/files/0x000500000001a055-151.dat	upx
behavioral1/files/0x000500000001a310-163.dat	upx
behavioral1/files/0x000500000001a2df-159.dat	upx
behavioral1/files/0x000500000001a08c-155.dat	upx
behavioral1/files/0x000500000001a04b-147.dat	upx
behavioral1/files/0x0005000000019f50-143.dat	upx
behavioral1/files/0x0005000000019f39-139.dat	upx
behavioral1/files/0x0005000000019d6d-135.dat	upx
behavioral1/files/0x0005000000019c9f-131.dat	upx
behavioral1/files/0x0005000000019c68-127.dat	upx
behavioral1/files/0x0005000000019c66-123.dat	upx
behavioral1/files/0x0005000000019c4d-119.dat	upx
behavioral1/files/0x0005000000019af1-112.dat	upx
behavioral1/files/0x0005000000019aef-107.dat	upx
behavioral1/files/0x000500000001979c-99.dat	upx
behavioral1/files/0x000500000001962c-92.dat	upx
behavioral1/files/0x000500000001962d-95.dat	upx
behavioral1/memory/2568-88-0x000000013F820000-0x000000013FC12000-memory.dmp	upx
behavioral1/memory/2740-87-0x000000013FBE0000-0x000000013FFD2000-memory.dmp	upx
behavioral1/files/0x0005000000019622-81.dat	upx
behavioral1/files/0x000600000001951e-80.dat	upx
behavioral1/files/0x00060000000191c6-79.dat	upx
behavioral1/files/0x00080000000173ec-78.dat	upx
behavioral1/memory/2716-76-0x000000013FD00000-0x00000001400F2000-memory.dmp	upx
behavioral1/memory/2836-71-0x000000013F990000-0x000000013FD82000-memory.dmp	upx
behavioral1/memory/1388-60-0x000000013FF00000-0x00000001402F2000-memory.dmp	upx
behavioral1/memory/2584-86-0x000000013F620000-0x000000013FA12000-memory.dmp	upx
behavioral1/files/0x0005000000019624-84.dat	upx
behavioral1/memory/2200-3891-0x000000013FBA0000-0x000000013FF92000-memory.dmp	upx
behavioral1/memory/2384-3906-0x000000013F3D0000-0x000000013F7C2000-memory.dmp	upx
behavioral1/memory/1388-3920-0x000000013FF00000-0x00000001402F2000-memory.dmp	upx
behavioral1/memory/2716-3921-0x000000013FD00000-0x00000001400F2000-memory.dmp	upx
behavioral1/memory/2836-3927-0x000000013F990000-0x000000013FD82000-memory.dmp	upx
behavioral1/memory/3040-3929-0x000000013FC10000-0x0000000140002000-memory.dmp	upx
behavioral1/memory/2748-3917-0x000000013F460000-0x000000013F852000-memory.dmp	upx
behavioral1/memory/2756-3987-0x000000013FDA0000-0x0000000140192000-memory.dmp	upx
behavioral1/memory/2480-5034-0x000000013F9A0000-0x000000013FD92000-memory.dmp	upx
behavioral1/memory/2584-5167-0x000000013F620000-0x000000013FA12000-memory.dmp	upx
behavioral1/memory/2740-5170-0x000000013FBE0000-0x000000013FFD2000-memory.dmp	upx
behavioral1/memory/2568-5540-0x000000013F820000-0x000000013FC12000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\rLRLJVG.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\daAmlrb.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\kwllKns.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\flCcrjY.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\OgouzCW.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\sXBAtAt.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\oycbahX.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\dooQbuI.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\BhrfJno.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\mgqxNPl.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\BYxmuDU.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\HkVQaxB.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\YTZzGpI.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\bMTJEOS.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\bskiHkE.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\pYVScSM.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\PxHbBhN.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\AcwfqUj.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\oKRrVrl.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\NTVYUzt.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\PVkIaQA.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\WGtGzBo.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\fedhvVh.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\QrIznYw.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\ZDNiwAr.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\cUOtHni.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\AmoHOPd.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\hmHeIOX.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\GPbidNa.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\kxUTiar.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\XIPsBBI.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\GVdyKfk.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\VHeVlTZ.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\lxoqclf.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\vcHPDKl.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\bkTgWFp.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\NoLycfD.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\TdTclSx.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\amOGJaC.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\WBmMPqC.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\VJzhCXN.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\kYaUamm.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\pjsUxyQ.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\erVCyyU.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\VwLkKCa.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\UybliCl.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\ymPTMaH.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\MKMZITG.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\IYvOxwi.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\oIqkUfX.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\axFCCYf.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\GRcHshT.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\qRmeSeb.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\JjwaeDY.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\gSyuQxZ.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\JUEKORR.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\ZYCHtJD.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\NjTDMCW.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\ndYwzMX.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\qGOJMIA.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\bkeqQLF.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\tscLQLJ.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\lhwpymT.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
File created	C:\Windows\System\IlepiAX.exe	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
632	powershell.exe
632	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
Token: SeLockMemoryPrivilege	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
Token: SeDebugPrivilege	632	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 632	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	32
PID 2480 wrote to memory of 632	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	32
PID 2480 wrote to memory of 632	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	32
PID 2480 wrote to memory of 2200	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	33
PID 2480 wrote to memory of 2200	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	33
PID 2480 wrote to memory of 2200	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	33
PID 2480 wrote to memory of 3040	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	34
PID 2480 wrote to memory of 3040	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	34
PID 2480 wrote to memory of 3040	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	34
PID 2480 wrote to memory of 2384	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	35
PID 2480 wrote to memory of 2384	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	35
PID 2480 wrote to memory of 2384	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	35
PID 2480 wrote to memory of 2756	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	36
PID 2480 wrote to memory of 2756	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	36
PID 2480 wrote to memory of 2756	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	36
PID 2480 wrote to memory of 2748	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	37
PID 2480 wrote to memory of 2748	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	37
PID 2480 wrote to memory of 2748	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	37
PID 2480 wrote to memory of 2584	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	38
PID 2480 wrote to memory of 2584	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	38
PID 2480 wrote to memory of 2584	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	38
PID 2480 wrote to memory of 2836	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	39
PID 2480 wrote to memory of 2836	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	39
PID 2480 wrote to memory of 2836	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	39
PID 2480 wrote to memory of 2740	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	40
PID 2480 wrote to memory of 2740	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	40
PID 2480 wrote to memory of 2740	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	40
PID 2480 wrote to memory of 1388	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	41
PID 2480 wrote to memory of 1388	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	41
PID 2480 wrote to memory of 1388	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	41
PID 2480 wrote to memory of 2568	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	42
PID 2480 wrote to memory of 2568	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	42
PID 2480 wrote to memory of 2568	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	42
PID 2480 wrote to memory of 2716	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	43
PID 2480 wrote to memory of 2716	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	43
PID 2480 wrote to memory of 2716	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	43
PID 2480 wrote to memory of 2260	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	44
PID 2480 wrote to memory of 2260	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	44
PID 2480 wrote to memory of 2260	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	44
PID 2480 wrote to memory of 2616	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	45
PID 2480 wrote to memory of 2616	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	45
PID 2480 wrote to memory of 2616	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	45
PID 2480 wrote to memory of 1792	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	46
PID 2480 wrote to memory of 1792	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	46
PID 2480 wrote to memory of 1792	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	46
PID 2480 wrote to memory of 2376	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	47
PID 2480 wrote to memory of 2376	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	47
PID 2480 wrote to memory of 2376	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	47
PID 2480 wrote to memory of 1680	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	48
PID 2480 wrote to memory of 1680	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	48
PID 2480 wrote to memory of 1680	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	48
PID 2480 wrote to memory of 1316	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	49
PID 2480 wrote to memory of 1316	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	49
PID 2480 wrote to memory of 1316	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	49
PID 2480 wrote to memory of 2636	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	50
PID 2480 wrote to memory of 2636	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	50
PID 2480 wrote to memory of 2636	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	50
PID 2480 wrote to memory of 1156	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	51
PID 2480 wrote to memory of 1156	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	51
PID 2480 wrote to memory of 1156	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	51
PID 2480 wrote to memory of 2980	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	52
PID 2480 wrote to memory of 2980	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	52
PID 2480 wrote to memory of 2980	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	52
PID 2480 wrote to memory of 1964	2480	7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe	53

C:\Users\Admin\AppData\Local\Temp\7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe
"C:\Users\Admin\AppData\Local\Temp\7a600c345d067464a9237758bd7aee2611c66b3c8b123edc9860ca2832513424.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:632
- C:\Windows\System\rcFWEnj.exe
  C:\Windows\System\rcFWEnj.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\ngVqCGE.exe
  C:\Windows\System\ngVqCGE.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\VytqERh.exe
  C:\Windows\System\VytqERh.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\OTnYQrd.exe
  C:\Windows\System\OTnYQrd.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\YPzmOwX.exe
  C:\Windows\System\YPzmOwX.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\yICTDIo.exe
  C:\Windows\System\yICTDIo.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\oYgYJOx.exe
  C:\Windows\System\oYgYJOx.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\fHRLjdZ.exe
  C:\Windows\System\fHRLjdZ.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\lJWLvpK.exe
  C:\Windows\System\lJWLvpK.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\OGqmDYC.exe
  C:\Windows\System\OGqmDYC.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\LAiDOFA.exe
  C:\Windows\System\LAiDOFA.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\isEPiaX.exe
  C:\Windows\System\isEPiaX.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\uqJDSRC.exe
  C:\Windows\System\uqJDSRC.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\WhSjVmb.exe
  C:\Windows\System\WhSjVmb.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\rzaAdzI.exe
  C:\Windows\System\rzaAdzI.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\RaDMoBl.exe
  C:\Windows\System\RaDMoBl.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\WVLShEF.exe
  C:\Windows\System\WVLShEF.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\palUjxg.exe
  C:\Windows\System\palUjxg.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\JuNPTTw.exe
  C:\Windows\System\JuNPTTw.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\SzFlQxw.exe
  C:\Windows\System\SzFlQxw.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\EuXGzPt.exe
  C:\Windows\System\EuXGzPt.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\dnypPPi.exe
  C:\Windows\System\dnypPPi.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\nXcFAEa.exe
  C:\Windows\System\nXcFAEa.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\cgHeUGh.exe
  C:\Windows\System\cgHeUGh.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\WWznCGA.exe
  C:\Windows\System\WWznCGA.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\yUuAJQE.exe
  C:\Windows\System\yUuAJQE.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\flCcrjY.exe
  C:\Windows\System\flCcrjY.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\xzuqOJa.exe
  C:\Windows\System\xzuqOJa.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\GDViBdl.exe
  C:\Windows\System\GDViBdl.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\NMbTYNY.exe
  C:\Windows\System\NMbTYNY.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\FEXRdvV.exe
  C:\Windows\System\FEXRdvV.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\SkcljgK.exe
  C:\Windows\System\SkcljgK.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\UeGFzlx.exe
  C:\Windows\System\UeGFzlx.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\KZngSQw.exe
  C:\Windows\System\KZngSQw.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\YefrilE.exe
  C:\Windows\System\YefrilE.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\yiInviM.exe
  C:\Windows\System\yiInviM.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\Ybjbxjn.exe
  C:\Windows\System\Ybjbxjn.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\ocGdShx.exe
  C:\Windows\System\ocGdShx.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\xmbXqXf.exe
  C:\Windows\System\xmbXqXf.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\uhFOUOQ.exe
  C:\Windows\System\uhFOUOQ.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\maKSYpR.exe
  C:\Windows\System\maKSYpR.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\YlWQABw.exe
  C:\Windows\System\YlWQABw.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\pFhvWrY.exe
  C:\Windows\System\pFhvWrY.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\ujLlYyr.exe
  C:\Windows\System\ujLlYyr.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\jlMbSFS.exe
  C:\Windows\System\jlMbSFS.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\kJEemTB.exe
  C:\Windows\System\kJEemTB.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\imttRYf.exe
  C:\Windows\System\imttRYf.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\HlQcwsm.exe
  C:\Windows\System\HlQcwsm.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\XcfJlpY.exe
  C:\Windows\System\XcfJlpY.exe
  2⤵
  - Executes dropped EXE
  PID:304
- C:\Windows\System\gSRHuYC.exe
  C:\Windows\System\gSRHuYC.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\BDCcJvj.exe
  C:\Windows\System\BDCcJvj.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\wVrtsZh.exe
  C:\Windows\System\wVrtsZh.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\TywopAP.exe
  C:\Windows\System\TywopAP.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\gABMXbY.exe
  C:\Windows\System\gABMXbY.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\hxLyljq.exe
  C:\Windows\System\hxLyljq.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\meYOEVL.exe
  C:\Windows\System\meYOEVL.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\ydJiKVj.exe
  C:\Windows\System\ydJiKVj.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\mjFvTHH.exe
  C:\Windows\System\mjFvTHH.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\bxtAoaR.exe
  C:\Windows\System\bxtAoaR.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\xQctOgR.exe
  C:\Windows\System\xQctOgR.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\Lylywyz.exe
  C:\Windows\System\Lylywyz.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\dZOBpcz.exe
  C:\Windows\System\dZOBpcz.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\pYCZiTk.exe
  C:\Windows\System\pYCZiTk.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\DoyGCSh.exe
  C:\Windows\System\DoyGCSh.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\LzElLbK.exe
  C:\Windows\System\LzElLbK.exe
  2⤵
  PID:1252
- C:\Windows\System\jVJLoCO.exe
  C:\Windows\System\jVJLoCO.exe
  2⤵
  PID:2592
- C:\Windows\System\QfpgzqW.exe
  C:\Windows\System\QfpgzqW.exe
  2⤵
  PID:2608
- C:\Windows\System\chjvjOv.exe
  C:\Windows\System\chjvjOv.exe
  2⤵
  PID:2036
- C:\Windows\System\YdujvIM.exe
  C:\Windows\System\YdujvIM.exe
  2⤵
  PID:1624
- C:\Windows\System\VoOADip.exe
  C:\Windows\System\VoOADip.exe
  2⤵
  PID:1620
- C:\Windows\System\cbiqGDY.exe
  C:\Windows\System\cbiqGDY.exe
  2⤵
  PID:1816
- C:\Windows\System\HVLlryU.exe
  C:\Windows\System\HVLlryU.exe
  2⤵
  PID:3016
- C:\Windows\System\XjcysOp.exe
  C:\Windows\System\XjcysOp.exe
  2⤵
  PID:2832
- C:\Windows\System\LhOUNnR.exe
  C:\Windows\System\LhOUNnR.exe
  2⤵
  PID:2076
- C:\Windows\System\PsSGlUa.exe
  C:\Windows\System\PsSGlUa.exe
  2⤵
  PID:2184
- C:\Windows\System\MOFriRw.exe
  C:\Windows\System\MOFriRw.exe
  2⤵
  PID:2900
- C:\Windows\System\xpTkWxv.exe
  C:\Windows\System\xpTkWxv.exe
  2⤵
  PID:1368
- C:\Windows\System\yDIjFpj.exe
  C:\Windows\System\yDIjFpj.exe
  2⤵
  PID:1860
- C:\Windows\System\DqMVMrG.exe
  C:\Windows\System\DqMVMrG.exe
  2⤵
  PID:752
- C:\Windows\System\vdtSeUG.exe
  C:\Windows\System\vdtSeUG.exe
  2⤵
  PID:1796
- C:\Windows\System\VhjzvIM.exe
  C:\Windows\System\VhjzvIM.exe
  2⤵
  PID:2008
- C:\Windows\System\HJCdGyM.exe
  C:\Windows\System\HJCdGyM.exe
  2⤵
  PID:1336
- C:\Windows\System\Qncxlwq.exe
  C:\Windows\System\Qncxlwq.exe
  2⤵
  PID:2416
- C:\Windows\System\SrhTwjA.exe
  C:\Windows\System\SrhTwjA.exe
  2⤵
  PID:2916
- C:\Windows\System\FMxZvrM.exe
  C:\Windows\System\FMxZvrM.exe
  2⤵
  PID:2052
- C:\Windows\System\YrIpZGH.exe
  C:\Windows\System\YrIpZGH.exe
  2⤵
  PID:2440
- C:\Windows\System\ITweovH.exe
  C:\Windows\System\ITweovH.exe
  2⤵
  PID:2768
- C:\Windows\System\yPZblML.exe
  C:\Windows\System\yPZblML.exe
  2⤵
  PID:3020
- C:\Windows\System\IuvEeoA.exe
  C:\Windows\System\IuvEeoA.exe
  2⤵
  PID:904
- C:\Windows\System\eJDpFFj.exe
  C:\Windows\System\eJDpFFj.exe
  2⤵
  PID:900
- C:\Windows\System\inDTvsd.exe
  C:\Windows\System\inDTvsd.exe
  2⤵
  PID:2028
- C:\Windows\System\YODBdxM.exe
  C:\Windows\System\YODBdxM.exe
  2⤵
  PID:2164
- C:\Windows\System\sUzSNeo.exe
  C:\Windows\System\sUzSNeo.exe
  2⤵
  PID:1044
- C:\Windows\System\OgouzCW.exe
  C:\Windows\System\OgouzCW.exe
  2⤵
  PID:2212
- C:\Windows\System\cgzfXPj.exe
  C:\Windows\System\cgzfXPj.exe
  2⤵
  PID:2552
- C:\Windows\System\hLzIdwl.exe
  C:\Windows\System\hLzIdwl.exe
  2⤵
  PID:2964
- C:\Windows\System\hwiFhpO.exe
  C:\Windows\System\hwiFhpO.exe
  2⤵
  PID:2976
- C:\Windows\System\tGuUjAR.exe
  C:\Windows\System\tGuUjAR.exe
  2⤵
  PID:1476
- C:\Windows\System\xcvbNHV.exe
  C:\Windows\System\xcvbNHV.exe
  2⤵
  PID:2284
- C:\Windows\System\lbukJiN.exe
  C:\Windows\System\lbukJiN.exe
  2⤵
  PID:3084
- C:\Windows\System\tvHhkSm.exe
  C:\Windows\System\tvHhkSm.exe
  2⤵
  PID:3100
- C:\Windows\System\FjIQRDt.exe
  C:\Windows\System\FjIQRDt.exe
  2⤵
  PID:3116
- C:\Windows\System\husBTGQ.exe
  C:\Windows\System\husBTGQ.exe
  2⤵
  PID:3132
- C:\Windows\System\IYlLMQv.exe
  C:\Windows\System\IYlLMQv.exe
  2⤵
  PID:3148
- C:\Windows\System\vBXwVMB.exe
  C:\Windows\System\vBXwVMB.exe
  2⤵
  PID:3164
- C:\Windows\System\hKLCHvR.exe
  C:\Windows\System\hKLCHvR.exe
  2⤵
  PID:3180
- C:\Windows\System\xPxHmYg.exe
  C:\Windows\System\xPxHmYg.exe
  2⤵
  PID:3196
- C:\Windows\System\obMhcGR.exe
  C:\Windows\System\obMhcGR.exe
  2⤵
  PID:3212
- C:\Windows\System\xphHtia.exe
  C:\Windows\System\xphHtia.exe
  2⤵
  PID:3228
- C:\Windows\System\ftaWWoa.exe
  C:\Windows\System\ftaWWoa.exe
  2⤵
  PID:3244
- C:\Windows\System\AMdLrIH.exe
  C:\Windows\System\AMdLrIH.exe
  2⤵
  PID:3260
- C:\Windows\System\CLTPoGW.exe
  C:\Windows\System\CLTPoGW.exe
  2⤵
  PID:3276
- C:\Windows\System\oUuTpWm.exe
  C:\Windows\System\oUuTpWm.exe
  2⤵
  PID:3292
- C:\Windows\System\xBMCEXy.exe
  C:\Windows\System\xBMCEXy.exe
  2⤵
  PID:3308
- C:\Windows\System\ToUVexN.exe
  C:\Windows\System\ToUVexN.exe
  2⤵
  PID:3324
- C:\Windows\System\cEpNyAJ.exe
  C:\Windows\System\cEpNyAJ.exe
  2⤵
  PID:3340
- C:\Windows\System\BjvErsc.exe
  C:\Windows\System\BjvErsc.exe
  2⤵
  PID:3356
- C:\Windows\System\VYVpnHE.exe
  C:\Windows\System\VYVpnHE.exe
  2⤵
  PID:3372
- C:\Windows\System\GmEwZHJ.exe
  C:\Windows\System\GmEwZHJ.exe
  2⤵
  PID:3388
- C:\Windows\System\XhNRNAl.exe
  C:\Windows\System\XhNRNAl.exe
  2⤵
  PID:3404
- C:\Windows\System\kKBjuDQ.exe
  C:\Windows\System\kKBjuDQ.exe
  2⤵
  PID:3420
- C:\Windows\System\yOodhAz.exe
  C:\Windows\System\yOodhAz.exe
  2⤵
  PID:3436
- C:\Windows\System\DyDkbnJ.exe
  C:\Windows\System\DyDkbnJ.exe
  2⤵
  PID:3452
- C:\Windows\System\gBdjynt.exe
  C:\Windows\System\gBdjynt.exe
  2⤵
  PID:3468
- C:\Windows\System\YjalARS.exe
  C:\Windows\System\YjalARS.exe
  2⤵
  PID:3484
- C:\Windows\System\xyDnFbi.exe
  C:\Windows\System\xyDnFbi.exe
  2⤵
  PID:3500
- C:\Windows\System\CXxdWwR.exe
  C:\Windows\System\CXxdWwR.exe
  2⤵
  PID:3516
- C:\Windows\System\nxBqyCm.exe
  C:\Windows\System\nxBqyCm.exe
  2⤵
  PID:3532
- C:\Windows\System\elOjMHD.exe
  C:\Windows\System\elOjMHD.exe
  2⤵
  PID:3548
- C:\Windows\System\MvbTmEj.exe
  C:\Windows\System\MvbTmEj.exe
  2⤵
  PID:3564
- C:\Windows\System\klQQaOH.exe
  C:\Windows\System\klQQaOH.exe
  2⤵
  PID:3580
- C:\Windows\System\QVOVEOz.exe
  C:\Windows\System\QVOVEOz.exe
  2⤵
  PID:3596
- C:\Windows\System\qcfybTJ.exe
  C:\Windows\System\qcfybTJ.exe
  2⤵
  PID:3612
- C:\Windows\System\jCPdEZI.exe
  C:\Windows\System\jCPdEZI.exe
  2⤵
  PID:3628
- C:\Windows\System\jIjggwS.exe
  C:\Windows\System\jIjggwS.exe
  2⤵
  PID:3644
- C:\Windows\System\gACFOZG.exe
  C:\Windows\System\gACFOZG.exe
  2⤵
  PID:3660
- C:\Windows\System\jMJgRHW.exe
  C:\Windows\System\jMJgRHW.exe
  2⤵
  PID:3676
- C:\Windows\System\RUsjKVo.exe
  C:\Windows\System\RUsjKVo.exe
  2⤵
  PID:3692
- C:\Windows\System\LRcjPwH.exe
  C:\Windows\System\LRcjPwH.exe
  2⤵
  PID:3708
- C:\Windows\System\GKvaXzY.exe
  C:\Windows\System\GKvaXzY.exe
  2⤵
  PID:3724
- C:\Windows\System\GyisJUc.exe
  C:\Windows\System\GyisJUc.exe
  2⤵
  PID:3740
- C:\Windows\System\dnWbWMF.exe
  C:\Windows\System\dnWbWMF.exe
  2⤵
  PID:3756
- C:\Windows\System\lEmZdbW.exe
  C:\Windows\System\lEmZdbW.exe
  2⤵
  PID:3772
- C:\Windows\System\bFSKzKg.exe
  C:\Windows\System\bFSKzKg.exe
  2⤵
  PID:3788
- C:\Windows\System\EYQDWZt.exe
  C:\Windows\System\EYQDWZt.exe
  2⤵
  PID:3804
- C:\Windows\System\CEIuwuA.exe
  C:\Windows\System\CEIuwuA.exe
  2⤵
  PID:3820
- C:\Windows\System\loBpmUI.exe
  C:\Windows\System\loBpmUI.exe
  2⤵
  PID:3836
- C:\Windows\System\IuVyYai.exe
  C:\Windows\System\IuVyYai.exe
  2⤵
  PID:3852
- C:\Windows\System\wqahznn.exe
  C:\Windows\System\wqahznn.exe
  2⤵
  PID:3868
- C:\Windows\System\yqabZGf.exe
  C:\Windows\System\yqabZGf.exe
  2⤵
  PID:3884
- C:\Windows\System\QGpzRCi.exe
  C:\Windows\System\QGpzRCi.exe
  2⤵
  PID:3900
- C:\Windows\System\lPphdll.exe
  C:\Windows\System\lPphdll.exe
  2⤵
  PID:3916
- C:\Windows\System\mtbGvcv.exe
  C:\Windows\System\mtbGvcv.exe
  2⤵
  PID:3932
- C:\Windows\System\zWrIAit.exe
  C:\Windows\System\zWrIAit.exe
  2⤵
  PID:3948
- C:\Windows\System\WejrPrb.exe
  C:\Windows\System\WejrPrb.exe
  2⤵
  PID:3964
- C:\Windows\System\jkoTpmp.exe
  C:\Windows\System\jkoTpmp.exe
  2⤵
  PID:3980
- C:\Windows\System\XJfYNPQ.exe
  C:\Windows\System\XJfYNPQ.exe
  2⤵
  PID:3996
- C:\Windows\System\eqxRnDx.exe
  C:\Windows\System\eqxRnDx.exe
  2⤵
  PID:4012
- C:\Windows\System\HDbtedT.exe
  C:\Windows\System\HDbtedT.exe
  2⤵
  PID:4028
- C:\Windows\System\GSLZavs.exe
  C:\Windows\System\GSLZavs.exe
  2⤵
  PID:4044
- C:\Windows\System\qCvekBm.exe
  C:\Windows\System\qCvekBm.exe
  2⤵
  PID:4060
- C:\Windows\System\NoDvIAj.exe
  C:\Windows\System\NoDvIAj.exe
  2⤵
  PID:4076
- C:\Windows\System\keAhmte.exe
  C:\Windows\System\keAhmte.exe
  2⤵
  PID:4092
- C:\Windows\System\XWIMkmw.exe
  C:\Windows\System\XWIMkmw.exe
  2⤵
  PID:1112
- C:\Windows\System\jgCgtUF.exe
  C:\Windows\System\jgCgtUF.exe
  2⤵
  PID:2904
- C:\Windows\System\BxKjwbP.exe
  C:\Windows\System\BxKjwbP.exe
  2⤵
  PID:2412
- C:\Windows\System\MIuXFdb.exe
  C:\Windows\System\MIuXFdb.exe
  2⤵
  PID:664
- C:\Windows\System\gXAKHEW.exe
  C:\Windows\System\gXAKHEW.exe
  2⤵
  PID:892
- C:\Windows\System\DQVCQDn.exe
  C:\Windows\System\DQVCQDn.exe
  2⤵
  PID:1644
- C:\Windows\System\kfuOesx.exe
  C:\Windows\System\kfuOesx.exe
  2⤵
  PID:1852
- C:\Windows\System\WKcUmYQ.exe
  C:\Windows\System\WKcUmYQ.exe
  2⤵
  PID:2088
- C:\Windows\System\ygqkZUV.exe
  C:\Windows\System\ygqkZUV.exe
  2⤵
  PID:1940
- C:\Windows\System\ZGsNQOD.exe
  C:\Windows\System\ZGsNQOD.exe
  2⤵
  PID:2988
- C:\Windows\System\KDIZrVp.exe
  C:\Windows\System\KDIZrVp.exe
  2⤵
  PID:1052
- C:\Windows\System\YCOlCwm.exe
  C:\Windows\System\YCOlCwm.exe
  2⤵
  PID:2544
- C:\Windows\System\GxlHXkZ.exe
  C:\Windows\System\GxlHXkZ.exe
  2⤵
  PID:2704
- C:\Windows\System\EhtaHjW.exe
  C:\Windows\System\EhtaHjW.exe
  2⤵
  PID:320
- C:\Windows\System\nsGWmAn.exe
  C:\Windows\System\nsGWmAn.exe
  2⤵
  PID:3080
- C:\Windows\System\iiYEfuL.exe
  C:\Windows\System\iiYEfuL.exe
  2⤵
  PID:3112
- C:\Windows\System\MenRyvm.exe
  C:\Windows\System\MenRyvm.exe
  2⤵
  PID:3124
- C:\Windows\System\xwNpITZ.exe
  C:\Windows\System\xwNpITZ.exe
  2⤵
  PID:3160
- C:\Windows\System\cWSFtDz.exe
  C:\Windows\System\cWSFtDz.exe
  2⤵
  PID:3192
- C:\Windows\System\lKENfVh.exe
  C:\Windows\System\lKENfVh.exe
  2⤵
  PID:3224
- C:\Windows\System\FGATtiX.exe
  C:\Windows\System\FGATtiX.exe
  2⤵
  PID:3272
- C:\Windows\System\BWKcAAv.exe
  C:\Windows\System\BWKcAAv.exe
  2⤵
  PID:3288
- C:\Windows\System\kxcUGPg.exe
  C:\Windows\System\kxcUGPg.exe
  2⤵
  PID:3336
- C:\Windows\System\fLPREeJ.exe
  C:\Windows\System\fLPREeJ.exe
  2⤵
  PID:3364
- C:\Windows\System\GsKRvua.exe
  C:\Windows\System\GsKRvua.exe
  2⤵
  PID:2556
- C:\Windows\System\BBiRTzC.exe
  C:\Windows\System\BBiRTzC.exe
  2⤵
  PID:3412
- C:\Windows\System\gpwmhTj.exe
  C:\Windows\System\gpwmhTj.exe
  2⤵
  PID:3460
- C:\Windows\System\WtjBsuU.exe
  C:\Windows\System\WtjBsuU.exe
  2⤵
  PID:3480
- C:\Windows\System\cDLMkQE.exe
  C:\Windows\System\cDLMkQE.exe
  2⤵
  PID:3508
- C:\Windows\System\wyZFSLh.exe
  C:\Windows\System\wyZFSLh.exe
  2⤵
  PID:3556
- C:\Windows\System\iWbwaEt.exe
  C:\Windows\System\iWbwaEt.exe
  2⤵
  PID:3572
- C:\Windows\System\ZMApzcA.exe
  C:\Windows\System\ZMApzcA.exe
  2⤵
  PID:3604
- C:\Windows\System\sjeHxuA.exe
  C:\Windows\System\sjeHxuA.exe
  2⤵
  PID:3636
- C:\Windows\System\ILPvyAK.exe
  C:\Windows\System\ILPvyAK.exe
  2⤵
  PID:3684
- C:\Windows\System\pDnyKkO.exe
  C:\Windows\System\pDnyKkO.exe
  2⤵
  PID:3700
- C:\Windows\System\WfBSHZC.exe
  C:\Windows\System\WfBSHZC.exe
  2⤵
  PID:3732
- C:\Windows\System\ujXDpyh.exe
  C:\Windows\System\ujXDpyh.exe
  2⤵
  PID:3764
- C:\Windows\System\LMbKsNh.exe
  C:\Windows\System\LMbKsNh.exe
  2⤵
  PID:3796
- C:\Windows\System\tLUgTNa.exe
  C:\Windows\System\tLUgTNa.exe
  2⤵
  PID:3828
- C:\Windows\System\tPgSAsx.exe
  C:\Windows\System\tPgSAsx.exe
  2⤵
  PID:3860
- C:\Windows\System\LNWtpnF.exe
  C:\Windows\System\LNWtpnF.exe
  2⤵
  PID:3892
- C:\Windows\System\wOEEKxA.exe
  C:\Windows\System\wOEEKxA.exe
  2⤵
  PID:3924
- C:\Windows\System\TGUeIwF.exe
  C:\Windows\System\TGUeIwF.exe
  2⤵
  PID:2572
- C:\Windows\System\ndEEvAY.exe
  C:\Windows\System\ndEEvAY.exe
  2⤵
  PID:3960
- C:\Windows\System\XRdTzXS.exe
  C:\Windows\System\XRdTzXS.exe
  2⤵
  PID:3992
- C:\Windows\System\dxlzzDZ.exe
  C:\Windows\System\dxlzzDZ.exe
  2⤵
  PID:4024
- C:\Windows\System\PrZOFkh.exe
  C:\Windows\System\PrZOFkh.exe
  2⤵
  PID:4056
- C:\Windows\System\KmAyOiP.exe
  C:\Windows\System\KmAyOiP.exe
  2⤵
  PID:4088
- C:\Windows\System\xTIYuOX.exe
  C:\Windows\System\xTIYuOX.exe
  2⤵
  PID:880
- C:\Windows\System\QaVbKke.exe
  C:\Windows\System\QaVbKke.exe
  2⤵
  PID:2676
- C:\Windows\System\IAMGhSR.exe
  C:\Windows\System\IAMGhSR.exe
  2⤵
  PID:2892
- C:\Windows\System\nzJkTdM.exe
  C:\Windows\System\nzJkTdM.exe
  2⤵
  PID:1000
- C:\Windows\System\GwrxFAX.exe
  C:\Windows\System\GwrxFAX.exe
  2⤵
  PID:1548
- C:\Windows\System\eOUydgH.exe
  C:\Windows\System\eOUydgH.exe
  2⤵
  PID:2308
- C:\Windows\System\CghVSdo.exe
  C:\Windows\System\CghVSdo.exe
  2⤵
  PID:2548
- C:\Windows\System\bWEJpJF.exe
  C:\Windows\System\bWEJpJF.exe
  2⤵
  PID:3144
- C:\Windows\System\sNttrTs.exe
  C:\Windows\System\sNttrTs.exe
  2⤵
  PID:3204
- C:\Windows\System\TjGPXmE.exe
  C:\Windows\System\TjGPXmE.exe
  2⤵
  PID:3220
- C:\Windows\System\InGrgpD.exe
  C:\Windows\System\InGrgpD.exe
  2⤵
  PID:3284
- C:\Windows\System\QwQuWfF.exe
  C:\Windows\System\QwQuWfF.exe
  2⤵
  PID:3348
- C:\Windows\System\rDpnioY.exe
  C:\Windows\System\rDpnioY.exe
  2⤵
  PID:3384
- C:\Windows\System\pCgWVmU.exe
  C:\Windows\System\pCgWVmU.exe
  2⤵
  PID:2948
- C:\Windows\System\JfTTESY.exe
  C:\Windows\System\JfTTESY.exe
  2⤵
  PID:3528
- C:\Windows\System\MhcZLAn.exe
  C:\Windows\System\MhcZLAn.exe
  2⤵
  PID:3592
- C:\Windows\System\YwWkgzt.exe
  C:\Windows\System\YwWkgzt.exe
  2⤵
  PID:3688
- C:\Windows\System\alSqCwc.exe
  C:\Windows\System\alSqCwc.exe
  2⤵
  PID:3748
- C:\Windows\System\wJVFVOY.exe
  C:\Windows\System\wJVFVOY.exe
  2⤵
  PID:3816
- C:\Windows\System\eRwNdtg.exe
  C:\Windows\System\eRwNdtg.exe
  2⤵
  PID:3864
- C:\Windows\System\ImgqRLZ.exe
  C:\Windows\System\ImgqRLZ.exe
  2⤵
  PID:3944
- C:\Windows\System\yteErsb.exe
  C:\Windows\System\yteErsb.exe
  2⤵
  PID:4004
- C:\Windows\System\sNnQsAW.exe
  C:\Windows\System\sNnQsAW.exe
  2⤵
  PID:4108
- C:\Windows\System\wCZwonI.exe
  C:\Windows\System\wCZwonI.exe
  2⤵
  PID:4124
- C:\Windows\System\aZdzQBH.exe
  C:\Windows\System\aZdzQBH.exe
  2⤵
  PID:4140
- C:\Windows\System\FbgVVRE.exe
  C:\Windows\System\FbgVVRE.exe
  2⤵
  PID:4156
- C:\Windows\System\oHqoyfq.exe
  C:\Windows\System\oHqoyfq.exe
  2⤵
  PID:4172
- C:\Windows\System\LaOSryf.exe
  C:\Windows\System\LaOSryf.exe
  2⤵
  PID:4188
- C:\Windows\System\znVtRwB.exe
  C:\Windows\System\znVtRwB.exe
  2⤵
  PID:4204
- C:\Windows\System\gaYUadd.exe
  C:\Windows\System\gaYUadd.exe
  2⤵
  PID:4220
- C:\Windows\System\KgZJiLP.exe
  C:\Windows\System\KgZJiLP.exe
  2⤵
  PID:4236
- C:\Windows\System\SIeMndq.exe
  C:\Windows\System\SIeMndq.exe
  2⤵
  PID:4252
- C:\Windows\System\TSxlmDF.exe
  C:\Windows\System\TSxlmDF.exe
  2⤵
  PID:4268
- C:\Windows\System\tBFTJMS.exe
  C:\Windows\System\tBFTJMS.exe
  2⤵
  PID:4284
- C:\Windows\System\bLydwwQ.exe
  C:\Windows\System\bLydwwQ.exe
  2⤵
  PID:4300
- C:\Windows\System\cJlVizf.exe
  C:\Windows\System\cJlVizf.exe
  2⤵
  PID:4316
- C:\Windows\System\cidFIeV.exe
  C:\Windows\System\cidFIeV.exe
  2⤵
  PID:4332
- C:\Windows\System\NJGFrnN.exe
  C:\Windows\System\NJGFrnN.exe
  2⤵
  PID:4348
- C:\Windows\System\PGzBlax.exe
  C:\Windows\System\PGzBlax.exe
  2⤵
  PID:4364
- C:\Windows\System\RdWwwbV.exe
  C:\Windows\System\RdWwwbV.exe
  2⤵
  PID:4380
- C:\Windows\System\DGrblWO.exe
  C:\Windows\System\DGrblWO.exe
  2⤵
  PID:4396
- C:\Windows\System\QLncpPa.exe
  C:\Windows\System\QLncpPa.exe
  2⤵
  PID:4412
- C:\Windows\System\PfpsbHy.exe
  C:\Windows\System\PfpsbHy.exe
  2⤵
  PID:4428
- C:\Windows\System\RuNQCsC.exe
  C:\Windows\System\RuNQCsC.exe
  2⤵
  PID:4444
- C:\Windows\System\rauvyom.exe
  C:\Windows\System\rauvyom.exe
  2⤵
  PID:4460
- C:\Windows\System\lFELpMO.exe
  C:\Windows\System\lFELpMO.exe
  2⤵
  PID:4476
- C:\Windows\System\eVGTNEO.exe
  C:\Windows\System\eVGTNEO.exe
  2⤵
  PID:4492
- C:\Windows\System\ATTXTld.exe
  C:\Windows\System\ATTXTld.exe
  2⤵
  PID:4508
- C:\Windows\System\bwSRYUY.exe
  C:\Windows\System\bwSRYUY.exe
  2⤵
  PID:4524
- C:\Windows\System\YqopBEf.exe
  C:\Windows\System\YqopBEf.exe
  2⤵
  PID:4540
- C:\Windows\System\ZXXyxIl.exe
  C:\Windows\System\ZXXyxIl.exe
  2⤵
  PID:4556
- C:\Windows\System\LdqYnzk.exe
  C:\Windows\System\LdqYnzk.exe
  2⤵
  PID:4572
- C:\Windows\System\lrKeDSs.exe
  C:\Windows\System\lrKeDSs.exe
  2⤵
  PID:4588
- C:\Windows\System\yaYfALe.exe
  C:\Windows\System\yaYfALe.exe
  2⤵
  PID:4604
- C:\Windows\System\tMOjKsR.exe
  C:\Windows\System\tMOjKsR.exe
  2⤵
  PID:4620
- C:\Windows\System\oBuacCr.exe
  C:\Windows\System\oBuacCr.exe
  2⤵
  PID:4636
- C:\Windows\System\vDsIorM.exe
  C:\Windows\System\vDsIorM.exe
  2⤵
  PID:4652
- C:\Windows\System\fQIDnJd.exe
  C:\Windows\System\fQIDnJd.exe
  2⤵
  PID:4668
- C:\Windows\System\IwKZboU.exe
  C:\Windows\System\IwKZboU.exe
  2⤵
  PID:4684
- C:\Windows\System\cEDbWOk.exe
  C:\Windows\System\cEDbWOk.exe
  2⤵
  PID:4700
- C:\Windows\System\xWeFbiH.exe
  C:\Windows\System\xWeFbiH.exe
  2⤵
  PID:4716
- C:\Windows\System\KhqDIlW.exe
  C:\Windows\System\KhqDIlW.exe
  2⤵
  PID:4732
- C:\Windows\System\RTcXJNu.exe
  C:\Windows\System\RTcXJNu.exe
  2⤵
  PID:4748
- C:\Windows\System\BMhddnp.exe
  C:\Windows\System\BMhddnp.exe
  2⤵
  PID:4764
- C:\Windows\System\uTQhpSh.exe
  C:\Windows\System\uTQhpSh.exe
  2⤵
  PID:4780
- C:\Windows\System\gSyuQxZ.exe
  C:\Windows\System\gSyuQxZ.exe
  2⤵
  PID:4796
- C:\Windows\System\sQXwOsZ.exe
  C:\Windows\System\sQXwOsZ.exe
  2⤵
  PID:4812
- C:\Windows\System\lTOEmiz.exe
  C:\Windows\System\lTOEmiz.exe
  2⤵
  PID:4828
- C:\Windows\System\npCXHOd.exe
  C:\Windows\System\npCXHOd.exe
  2⤵
  PID:4844
- C:\Windows\System\taZTwVh.exe
  C:\Windows\System\taZTwVh.exe
  2⤵
  PID:4860
- C:\Windows\System\FKcvPqf.exe
  C:\Windows\System\FKcvPqf.exe
  2⤵
  PID:4876
- C:\Windows\System\ZKUVPWr.exe
  C:\Windows\System\ZKUVPWr.exe
  2⤵
  PID:4892
- C:\Windows\System\pUXDZil.exe
  C:\Windows\System\pUXDZil.exe
  2⤵
  PID:4908
- C:\Windows\System\ciKwpjM.exe
  C:\Windows\System\ciKwpjM.exe
  2⤵
  PID:4924
- C:\Windows\System\mWENnoX.exe
  C:\Windows\System\mWENnoX.exe
  2⤵
  PID:4940
- C:\Windows\System\dcgzgem.exe
  C:\Windows\System\dcgzgem.exe
  2⤵
  PID:4956
- C:\Windows\System\aYWbNQU.exe
  C:\Windows\System\aYWbNQU.exe
  2⤵
  PID:4972
- C:\Windows\System\AcxpzrY.exe
  C:\Windows\System\AcxpzrY.exe
  2⤵
  PID:4988
- C:\Windows\System\wnAoHqy.exe
  C:\Windows\System\wnAoHqy.exe
  2⤵
  PID:5004
- C:\Windows\System\ppdHPTl.exe
  C:\Windows\System\ppdHPTl.exe
  2⤵
  PID:5020
- C:\Windows\System\gUwLVpg.exe
  C:\Windows\System\gUwLVpg.exe
  2⤵
  PID:5036
- C:\Windows\System\evppCbP.exe
  C:\Windows\System\evppCbP.exe
  2⤵
  PID:5052
- C:\Windows\System\aInrGfa.exe
  C:\Windows\System\aInrGfa.exe
  2⤵
  PID:5068
- C:\Windows\System\rpZyBdD.exe
  C:\Windows\System\rpZyBdD.exe
  2⤵
  PID:5084
- C:\Windows\System\WnqgyUA.exe
  C:\Windows\System\WnqgyUA.exe
  2⤵
  PID:5100
- C:\Windows\System\dUYpUwN.exe
  C:\Windows\System\dUYpUwN.exe
  2⤵
  PID:5116
- C:\Windows\System\doCwluT.exe
  C:\Windows\System\doCwluT.exe
  2⤵
  PID:4040
- C:\Windows\System\bnBdudE.exe
  C:\Windows\System\bnBdudE.exe
  2⤵
  PID:2152
- C:\Windows\System\hQTVsks.exe
  C:\Windows\System\hQTVsks.exe
  2⤵
  PID:852
- C:\Windows\System\zFgmRih.exe
  C:\Windows\System\zFgmRih.exe
  2⤵
  PID:1500
- C:\Windows\System\EqIPyeC.exe
  C:\Windows\System\EqIPyeC.exe
  2⤵
  PID:2712
- C:\Windows\System\mgjHgge.exe
  C:\Windows\System\mgjHgge.exe
  2⤵
  PID:3188
- C:\Windows\System\RmLkmCx.exe
  C:\Windows\System\RmLkmCx.exe
  2⤵
  PID:3252
- C:\Windows\System\WBTVCcl.exe
  C:\Windows\System\WBTVCcl.exe
  2⤵
  PID:3400
- C:\Windows\System\LFDNqlY.exe
  C:\Windows\System\LFDNqlY.exe
  2⤵
  PID:3540
- C:\Windows\System\fvKSxLI.exe
  C:\Windows\System\fvKSxLI.exe
  2⤵
  PID:3576
- C:\Windows\System\BBLwwIH.exe
  C:\Windows\System\BBLwwIH.exe
  2⤵
  PID:3716
- C:\Windows\System\GznMIUT.exe
  C:\Windows\System\GznMIUT.exe
  2⤵
  PID:3784
- C:\Windows\System\NjHVwxv.exe
  C:\Windows\System\NjHVwxv.exe
  2⤵
  PID:4104
- C:\Windows\System\eGqlCSc.exe
  C:\Windows\System\eGqlCSc.exe
  2⤵
  PID:4120
- C:\Windows\System\owQOaOD.exe
  C:\Windows\System\owQOaOD.exe
  2⤵
  PID:4152
- C:\Windows\System\UybliCl.exe
  C:\Windows\System\UybliCl.exe
  2⤵
  PID:4200
- C:\Windows\System\kqMgcei.exe
  C:\Windows\System\kqMgcei.exe
  2⤵
  PID:4228
- C:\Windows\System\XAvwcHd.exe
  C:\Windows\System\XAvwcHd.exe
  2⤵
  PID:4260
- C:\Windows\System\vHEJYKw.exe
  C:\Windows\System\vHEJYKw.exe
  2⤵
  PID:4296
- C:\Windows\System\wWXPzqS.exe
  C:\Windows\System\wWXPzqS.exe
  2⤵
  PID:4324
- C:\Windows\System\MYGBOkr.exe
  C:\Windows\System\MYGBOkr.exe
  2⤵
  PID:4356
- C:\Windows\System\QVgDGTp.exe
  C:\Windows\System\QVgDGTp.exe
  2⤵
  PID:4388
- C:\Windows\System\CRosLEP.exe
  C:\Windows\System\CRosLEP.exe
  2⤵
  PID:4408
- C:\Windows\System\pzTEhGl.exe
  C:\Windows\System\pzTEhGl.exe
  2⤵
  PID:4440
- C:\Windows\System\ylqjMtk.exe
  C:\Windows\System\ylqjMtk.exe
  2⤵
  PID:4484
- C:\Windows\System\nDvUrZa.exe
  C:\Windows\System\nDvUrZa.exe
  2⤵
  PID:4516
- C:\Windows\System\FoWOoOG.exe
  C:\Windows\System\FoWOoOG.exe
  2⤵
  PID:4548
- C:\Windows\System\cPoVCak.exe
  C:\Windows\System\cPoVCak.exe
  2⤵
  PID:4564
- C:\Windows\System\lNIiBJb.exe
  C:\Windows\System\lNIiBJb.exe
  2⤵
  PID:4596
- C:\Windows\System\wOIFkms.exe
  C:\Windows\System\wOIFkms.exe
  2⤵
  PID:2720
- C:\Windows\System\qkgPcNL.exe
  C:\Windows\System\qkgPcNL.exe
  2⤵
  PID:4648
- C:\Windows\System\cvuhxrh.exe
  C:\Windows\System\cvuhxrh.exe
  2⤵
  PID:4676
- C:\Windows\System\bpzLxug.exe
  C:\Windows\System\bpzLxug.exe
  2⤵
  PID:2192
- C:\Windows\System\cwGYrnl.exe
  C:\Windows\System\cwGYrnl.exe
  2⤵
  PID:4724
- C:\Windows\System\qsGjADq.exe
  C:\Windows\System\qsGjADq.exe
  2⤵
  PID:4756
- C:\Windows\System\bqezPzy.exe
  C:\Windows\System\bqezPzy.exe
  2⤵
  PID:4788
- C:\Windows\System\UdtPfJJ.exe
  C:\Windows\System\UdtPfJJ.exe
  2⤵
  PID:4836
- C:\Windows\System\oOpSmoG.exe
  C:\Windows\System\oOpSmoG.exe
  2⤵
  PID:4840
- C:\Windows\System\zEJiNgt.exe
  C:\Windows\System\zEJiNgt.exe
  2⤵
  PID:4872
- C:\Windows\System\irnGfMC.exe
  C:\Windows\System\irnGfMC.exe
  2⤵
  PID:4888
- C:\Windows\System\AYhWxNS.exe
  C:\Windows\System\AYhWxNS.exe
  2⤵
  PID:4920
- C:\Windows\System\hftGEWn.exe
  C:\Windows\System\hftGEWn.exe
  2⤵
  PID:4968
- C:\Windows\System\OKpWyTi.exe
  C:\Windows\System\OKpWyTi.exe
  2⤵
  PID:4984
- C:\Windows\System\iyZYREY.exe
  C:\Windows\System\iyZYREY.exe
  2⤵
  PID:5032
- C:\Windows\System\DfWRdZX.exe
  C:\Windows\System\DfWRdZX.exe
  2⤵
  PID:5048
- C:\Windows\System\aNncnvt.exe
  C:\Windows\System\aNncnvt.exe
  2⤵
  PID:5080
- C:\Windows\System\qrpudmT.exe
  C:\Windows\System\qrpudmT.exe
  2⤵
  PID:5112
- C:\Windows\System\gFCvNKe.exe
  C:\Windows\System\gFCvNKe.exe
  2⤵
  PID:964
- C:\Windows\System\iKaqEeS.exe
  C:\Windows\System\iKaqEeS.exe
  2⤵
  PID:3076
- C:\Windows\System\UbGmUGx.exe
  C:\Windows\System\UbGmUGx.exe
  2⤵
  PID:3172
- C:\Windows\System\xnQkhQo.exe
  C:\Windows\System\xnQkhQo.exe
  2⤵
  PID:1960
- C:\Windows\System\rVVmejU.exe
  C:\Windows\System\rVVmejU.exe
  2⤵
  PID:3464
- C:\Windows\System\EIxOmPl.exe
  C:\Windows\System\EIxOmPl.exe
  2⤵
  PID:2968
- C:\Windows\System\hfZgCVg.exe
  C:\Windows\System\hfZgCVg.exe
  2⤵
  PID:3928
- C:\Windows\System\KxIFPbY.exe
  C:\Windows\System\KxIFPbY.exe
  2⤵
  PID:4116
- C:\Windows\System\KpalRde.exe
  C:\Windows\System\KpalRde.exe
  2⤵
  PID:4212
- C:\Windows\System\DjbDdtQ.exe
  C:\Windows\System\DjbDdtQ.exe
  2⤵
  PID:4216
- C:\Windows\System\jxJmiMi.exe
  C:\Windows\System\jxJmiMi.exe
  2⤵
  PID:4276
- C:\Windows\System\MjGCwzp.exe
  C:\Windows\System\MjGCwzp.exe
  2⤵
  PID:4308
- C:\Windows\System\DutZFxW.exe
  C:\Windows\System\DutZFxW.exe
  2⤵
  PID:544
- C:\Windows\System\vmCJNfP.exe
  C:\Windows\System\vmCJNfP.exe
  2⤵
  PID:1292
- C:\Windows\System\nzbTbWI.exe
  C:\Windows\System\nzbTbWI.exe
  2⤵
  PID:4468
- C:\Windows\System\JcPIrkf.exe
  C:\Windows\System\JcPIrkf.exe
  2⤵
  PID:4488
- C:\Windows\System\yaOqJqZ.exe
  C:\Windows\System\yaOqJqZ.exe
  2⤵
  PID:4568
- C:\Windows\System\rzAVSvY.exe
  C:\Windows\System\rzAVSvY.exe
  2⤵
  PID:4552
- C:\Windows\System\coGvnhI.exe
  C:\Windows\System\coGvnhI.exe
  2⤵
  PID:2536
- C:\Windows\System\AKFIpXO.exe
  C:\Windows\System\AKFIpXO.exe
  2⤵
  PID:4632
- C:\Windows\System\BPdddWa.exe
  C:\Windows\System\BPdddWa.exe
  2⤵
  PID:4660
- C:\Windows\System\wIvteZA.exe
  C:\Windows\System\wIvteZA.exe
  2⤵
  PID:4744
- C:\Windows\System\EiLonCj.exe
  C:\Windows\System\EiLonCj.exe
  2⤵
  PID:2956
- C:\Windows\System\gKDKmbl.exe
  C:\Windows\System\gKDKmbl.exe
  2⤵
  PID:2092
- C:\Windows\System\YHumbLw.exe
  C:\Windows\System\YHumbLw.exe
  2⤵
  PID:2432
- C:\Windows\System\EePupON.exe
  C:\Windows\System\EePupON.exe
  2⤵
  PID:1100
- C:\Windows\System\SKUZbEO.exe
  C:\Windows\System\SKUZbEO.exe
  2⤵
  PID:1080
- C:\Windows\System\PbhLzxu.exe
  C:\Windows\System\PbhLzxu.exe
  2⤵
  PID:4904
- C:\Windows\System\ZCTubqF.exe
  C:\Windows\System\ZCTubqF.exe
  2⤵
  PID:5000
- C:\Windows\System\ipXtZok.exe
  C:\Windows\System\ipXtZok.exe
  2⤵
  PID:4964
- C:\Windows\System\yCuJPtW.exe
  C:\Windows\System\yCuJPtW.exe
  2⤵
  PID:5016
- C:\Windows\System\RShUzrV.exe
  C:\Windows\System\RShUzrV.exe
  2⤵
  PID:1492
- C:\Windows\System\miklzxC.exe
  C:\Windows\System\miklzxC.exe
  2⤵
  PID:756
- C:\Windows\System\JYnhGmf.exe
  C:\Windows\System\JYnhGmf.exe
  2⤵
  PID:5428
- C:\Windows\System\DDquGqJ.exe
  C:\Windows\System\DDquGqJ.exe
  2⤵
  PID:5460
- C:\Windows\System\yzuuYUI.exe
  C:\Windows\System\yzuuYUI.exe
  2⤵
  PID:5476
- C:\Windows\System\VqQNLzm.exe
  C:\Windows\System\VqQNLzm.exe
  2⤵
  PID:5496
- C:\Windows\System\VTgKWpa.exe
  C:\Windows\System\VTgKWpa.exe
  2⤵
  PID:5512
- C:\Windows\System\ZHbWzfn.exe
  C:\Windows\System\ZHbWzfn.exe
  2⤵
  PID:5528
- C:\Windows\System\Olvvytd.exe
  C:\Windows\System\Olvvytd.exe
  2⤵
  PID:5544
- C:\Windows\System\BLmSbNH.exe
  C:\Windows\System\BLmSbNH.exe
  2⤵
  PID:5560
- C:\Windows\System\wpgtRuC.exe
  C:\Windows\System\wpgtRuC.exe
  2⤵
  PID:5576
- C:\Windows\System\IEuiuDY.exe
  C:\Windows\System\IEuiuDY.exe
  2⤵
  PID:5592
- C:\Windows\System\qWmXtcy.exe
  C:\Windows\System\qWmXtcy.exe
  2⤵
  PID:5608
- C:\Windows\System\CopqiLh.exe
  C:\Windows\System\CopqiLh.exe
  2⤵
  PID:5640
- C:\Windows\System\kqdRfmK.exe
  C:\Windows\System\kqdRfmK.exe
  2⤵
  PID:5656
- C:\Windows\System\neiWbqy.exe
  C:\Windows\System\neiWbqy.exe
  2⤵
  PID:5672
- C:\Windows\System\XBQxgaK.exe
  C:\Windows\System\XBQxgaK.exe
  2⤵
  PID:5688
- C:\Windows\System\duUFHey.exe
  C:\Windows\System\duUFHey.exe
  2⤵
  PID:5704
- C:\Windows\System\ZHpBbCf.exe
  C:\Windows\System\ZHpBbCf.exe
  2⤵
  PID:5720
- C:\Windows\System\JzwXZmI.exe
  C:\Windows\System\JzwXZmI.exe
  2⤵
  PID:5736
- C:\Windows\System\IHZFFpt.exe
  C:\Windows\System\IHZFFpt.exe
  2⤵
  PID:5752
- C:\Windows\System\gpnlCAH.exe
  C:\Windows\System\gpnlCAH.exe
  2⤵
  PID:5768
- C:\Windows\System\YQHhcvf.exe
  C:\Windows\System\YQHhcvf.exe
  2⤵
  PID:5784
- C:\Windows\System\wrccXCO.exe
  C:\Windows\System\wrccXCO.exe
  2⤵
  PID:5800
- C:\Windows\System\jaOszIL.exe
  C:\Windows\System\jaOszIL.exe
  2⤵
  PID:5816
- C:\Windows\System\NkYVWcb.exe
  C:\Windows\System\NkYVWcb.exe
  2⤵
  PID:5836
- C:\Windows\System\cWwiLLH.exe
  C:\Windows\System\cWwiLLH.exe
  2⤵
  PID:5880
- C:\Windows\System\uPWcpcW.exe
  C:\Windows\System\uPWcpcW.exe
  2⤵
  PID:5896
- C:\Windows\System\ojZTrpg.exe
  C:\Windows\System\ojZTrpg.exe
  2⤵
  PID:5912
- C:\Windows\System\abyeuys.exe
  C:\Windows\System\abyeuys.exe
  2⤵
  PID:5928
- C:\Windows\System\yhkPNAr.exe
  C:\Windows\System\yhkPNAr.exe
  2⤵
  PID:5944
- C:\Windows\System\XvUARYx.exe
  C:\Windows\System\XvUARYx.exe
  2⤵
  PID:5960
- C:\Windows\System\llpLett.exe
  C:\Windows\System\llpLett.exe
  2⤵
  PID:5976
- C:\Windows\System\GKmKuIl.exe
  C:\Windows\System\GKmKuIl.exe
  2⤵
  PID:5992
- C:\Windows\System\kBacHtt.exe
  C:\Windows\System\kBacHtt.exe
  2⤵
  PID:6008
- C:\Windows\System\kAeIVQw.exe
  C:\Windows\System\kAeIVQw.exe
  2⤵
  PID:6024
- C:\Windows\System\YjqphgB.exe
  C:\Windows\System\YjqphgB.exe
  2⤵
  PID:6040
- C:\Windows\System\GROPeGA.exe
  C:\Windows\System\GROPeGA.exe
  2⤵
  PID:6056
- C:\Windows\System\wpznTma.exe
  C:\Windows\System\wpznTma.exe
  2⤵
  PID:6072
- C:\Windows\System\owFwGpd.exe
  C:\Windows\System\owFwGpd.exe
  2⤵
  PID:6088
- C:\Windows\System\XoNolEU.exe
  C:\Windows\System\XoNolEU.exe
  2⤵
  PID:6104
- C:\Windows\System\OJrnNYH.exe
  C:\Windows\System\OJrnNYH.exe
  2⤵
  PID:6120
- C:\Windows\System\XvFEiXa.exe
  C:\Windows\System\XvFEiXa.exe
  2⤵
  PID:6136
- C:\Windows\System\WuDDtXA.exe
  C:\Windows\System\WuDDtXA.exe
  2⤵
  PID:4712
- C:\Windows\System\yNExPtw.exe
  C:\Windows\System\yNExPtw.exe
  2⤵
  PID:5028
- C:\Windows\System\CVYXvZa.exe
  C:\Windows\System\CVYXvZa.exe
  2⤵
  PID:4792
- C:\Windows\System\fCBCFVm.exe
  C:\Windows\System\fCBCFVm.exe
  2⤵
  PID:4900
- C:\Windows\System\qARsWsP.exe
  C:\Windows\System\qARsWsP.exe
  2⤵
  PID:4036
- C:\Windows\System\NFWVCne.exe
  C:\Windows\System\NFWVCne.exe
  2⤵
  PID:2640
- C:\Windows\System\HbITYgz.exe
  C:\Windows\System\HbITYgz.exe
  2⤵
  PID:3316
- C:\Windows\System\uTPUNmG.exe
  C:\Windows\System\uTPUNmG.exe
  2⤵
  PID:1320
- C:\Windows\System\GBprfoM.exe
  C:\Windows\System\GBprfoM.exe
  2⤵
  PID:3624
- C:\Windows\System\aGsebiX.exe
  C:\Windows\System\aGsebiX.exe
  2⤵
  PID:4148
- C:\Windows\System\lygqEUP.exe
  C:\Windows\System\lygqEUP.exe
  2⤵
  PID:4292
- C:\Windows\System\zshDoFD.exe
  C:\Windows\System\zshDoFD.exe
  2⤵
  PID:4312
- C:\Windows\System\pWMEfRi.exe
  C:\Windows\System\pWMEfRi.exe
  2⤵
  PID:4420
- C:\Windows\System\UrdQhvF.exe
  C:\Windows\System\UrdQhvF.exe
  2⤵
  PID:2372
- C:\Windows\System\gbdTNjZ.exe
  C:\Windows\System\gbdTNjZ.exe
  2⤵
  PID:4628
- C:\Windows\System\zkpVHSq.exe
  C:\Windows\System\zkpVHSq.exe
  2⤵
  PID:1468
- C:\Windows\System\JSNqALp.exe
  C:\Windows\System\JSNqALp.exe
  2⤵
  PID:5124
- C:\Windows\System\nUESSDg.exe
  C:\Windows\System\nUESSDg.exe
  2⤵
  PID:5140
- C:\Windows\System\hFyZVLe.exe
  C:\Windows\System\hFyZVLe.exe
  2⤵
  PID:5156
- C:\Windows\System\fycsTWI.exe
  C:\Windows\System\fycsTWI.exe
  2⤵
  PID:5172
- C:\Windows\System\KwfxFtj.exe
  C:\Windows\System\KwfxFtj.exe
  2⤵
  PID:5188
- C:\Windows\System\TJwwsUH.exe
  C:\Windows\System\TJwwsUH.exe
  2⤵
  PID:5204
- C:\Windows\System\zdRMxRS.exe
  C:\Windows\System\zdRMxRS.exe
  2⤵
  PID:5220
- C:\Windows\System\PGYnHoE.exe
  C:\Windows\System\PGYnHoE.exe
  2⤵
  PID:5236
- C:\Windows\System\sfDFgvl.exe
  C:\Windows\System\sfDFgvl.exe
  2⤵
  PID:5252
- C:\Windows\System\dsLbZFf.exe
  C:\Windows\System\dsLbZFf.exe
  2⤵
  PID:5268
- C:\Windows\System\nOcQCjG.exe
  C:\Windows\System\nOcQCjG.exe
  2⤵
  PID:5288
- C:\Windows\System\VVRjHPT.exe
  C:\Windows\System\VVRjHPT.exe
  2⤵
  PID:5304
- C:\Windows\System\SspchDT.exe
  C:\Windows\System\SspchDT.exe
  2⤵
  PID:5320
- C:\Windows\System\ASdzVWz.exe
  C:\Windows\System\ASdzVWz.exe
  2⤵
  PID:5340
- C:\Windows\System\byJSRYO.exe
  C:\Windows\System\byJSRYO.exe
  2⤵
  PID:5356
- C:\Windows\System\bKVQmpA.exe
  C:\Windows\System\bKVQmpA.exe
  2⤵
  PID:5376
- C:\Windows\System\aRHtYUt.exe
  C:\Windows\System\aRHtYUt.exe
  2⤵
  PID:5392
- C:\Windows\System\OQbnXrF.exe
  C:\Windows\System\OQbnXrF.exe
  2⤵
  PID:5408
- C:\Windows\System\RhVtOvf.exe
  C:\Windows\System\RhVtOvf.exe
  2⤵
  PID:1788
- C:\Windows\System\OeugNsU.exe
  C:\Windows\System\OeugNsU.exe
  2⤵
  PID:5504
- C:\Windows\System\aoYWSCi.exe
  C:\Windows\System\aoYWSCi.exe
  2⤵
  PID:5540
- C:\Windows\System\KjNpfDe.exe
  C:\Windows\System\KjNpfDe.exe
  2⤵
  PID:5600
- C:\Windows\System\JViOfDp.exe
  C:\Windows\System\JViOfDp.exe
  2⤵
  PID:5444
- C:\Windows\System\lRysEdP.exe
  C:\Windows\System\lRysEdP.exe
  2⤵
  PID:5484
- C:\Windows\System\Tntgvgy.exe
  C:\Windows\System\Tntgvgy.exe
  2⤵
  PID:5524
- C:\Windows\System\NoLycfD.exe
  C:\Windows\System\NoLycfD.exe
  2⤵
  PID:5588
- C:\Windows\System\PEBwBwl.exe
  C:\Windows\System\PEBwBwl.exe
  2⤵
  PID:5628
- C:\Windows\System\DNiPaJk.exe
  C:\Windows\System\DNiPaJk.exe
  2⤵
  PID:2724
- C:\Windows\System\GuTbqmY.exe
  C:\Windows\System\GuTbqmY.exe
  2⤵
  PID:388
- C:\Windows\System\sAJzwHV.exe
  C:\Windows\System\sAJzwHV.exe
  2⤵
  PID:5664
- C:\Windows\System\UspkHAv.exe
  C:\Windows\System\UspkHAv.exe
  2⤵
  PID:5728
- C:\Windows\System\Nkhslkw.exe
  C:\Windows\System\Nkhslkw.exe
  2⤵
  PID:5792
- C:\Windows\System\IPJUyVo.exe
  C:\Windows\System\IPJUyVo.exe
  2⤵
  PID:5832
- C:\Windows\System\OWBjdjh.exe
  C:\Windows\System\OWBjdjh.exe
  2⤵
  PID:1256
- C:\Windows\System\eNWnZyn.exe
  C:\Windows\System\eNWnZyn.exe
  2⤵
  PID:2352
- C:\Windows\System\gNTsdzy.exe
  C:\Windows\System\gNTsdzy.exe
  2⤵
  PID:5892
- C:\Windows\System\yqhLTqm.exe
  C:\Windows\System\yqhLTqm.exe
  2⤵
  PID:5984
- C:\Windows\System\KkvaKzn.exe
  C:\Windows\System\KkvaKzn.exe
  2⤵
  PID:6048
- C:\Windows\System\DGcipCu.exe
  C:\Windows\System\DGcipCu.exe
  2⤵
  PID:6112
- C:\Windows\System\XWNvySp.exe
  C:\Windows\System\XWNvySp.exe
  2⤵
  PID:4052
- C:\Windows\System\OXwJAcC.exe
  C:\Windows\System\OXwJAcC.exe
  2⤵
  PID:3396
- C:\Windows\System\aWfuvUl.exe
  C:\Windows\System\aWfuvUl.exe
  2⤵
  PID:4244
- C:\Windows\System\PZskZfx.exe
  C:\Windows\System\PZskZfx.exe
  2⤵
  PID:4644
- C:\Windows\System\TYMLAHI.exe
  C:\Windows\System\TYMLAHI.exe
  2⤵
  PID:5148
- C:\Windows\System\rEOwqZU.exe
  C:\Windows\System\rEOwqZU.exe
  2⤵
  PID:5216
- C:\Windows\System\BDoJtYU.exe
  C:\Windows\System\BDoJtYU.exe
  2⤵
  PID:5276
- C:\Windows\System\DbluaLV.exe
  C:\Windows\System\DbluaLV.exe
  2⤵
  PID:5316
- C:\Windows\System\ooRmWsQ.exe
  C:\Windows\System\ooRmWsQ.exe
  2⤵
  PID:5396
- C:\Windows\System\PMbFSSd.exe
  C:\Windows\System\PMbFSSd.exe
  2⤵
  PID:5424
- C:\Windows\System\keavExB.exe
  C:\Windows\System\keavExB.exe
  2⤵
  PID:2996
- C:\Windows\System\ZhpLcAN.exe
  C:\Windows\System\ZhpLcAN.exe
  2⤵
  PID:5696
- C:\Windows\System\bhUfWbO.exe
  C:\Windows\System\bhUfWbO.exe
  2⤵
  PID:5824
- C:\Windows\System\sHfIaOU.exe
  C:\Windows\System\sHfIaOU.exe
  2⤵
  PID:5924
- C:\Windows\System\mPPIxVW.exe
  C:\Windows\System\mPPIxVW.exe
  2⤵
  PID:6084
- C:\Windows\System\KbKbQXQ.exe
  C:\Windows\System\KbKbQXQ.exe
  2⤵
  PID:6176
- C:\Windows\System\aoFcDYf.exe
  C:\Windows\System\aoFcDYf.exe
  2⤵
  PID:6208
- C:\Windows\System\ssjputJ.exe
  C:\Windows\System\ssjputJ.exe
  2⤵
  PID:6268
- C:\Windows\System\nxHfeuG.exe
  C:\Windows\System\nxHfeuG.exe
  2⤵
  PID:6352
- C:\Windows\System\iSFUJJx.exe
  C:\Windows\System\iSFUJJx.exe
  2⤵
  PID:6420
- C:\Windows\System\xTkVvWl.exe
  C:\Windows\System\xTkVvWl.exe
  2⤵
  PID:6436
- C:\Windows\System\NsxYMBA.exe
  C:\Windows\System\NsxYMBA.exe
  2⤵
  PID:6452
- C:\Windows\System\yASlLmV.exe
  C:\Windows\System\yASlLmV.exe
  2⤵
  PID:6472
- C:\Windows\System\UCcrEow.exe
  C:\Windows\System\UCcrEow.exe
  2⤵
  PID:6488
- C:\Windows\System\yuiWMUD.exe
  C:\Windows\System\yuiWMUD.exe
  2⤵
  PID:6560
- C:\Windows\System\ObYdRto.exe
  C:\Windows\System\ObYdRto.exe
  2⤵
  PID:6576
- C:\Windows\System\SPOsLlE.exe
  C:\Windows\System\SPOsLlE.exe
  2⤵
  PID:6592
- C:\Windows\System\ZtSKmrg.exe
  C:\Windows\System\ZtSKmrg.exe
  2⤵
  PID:6608
- C:\Windows\System\uSFWPyx.exe
  C:\Windows\System\uSFWPyx.exe
  2⤵
  PID:6628
- C:\Windows\System\CZpsENu.exe
  C:\Windows\System\CZpsENu.exe
  2⤵
  PID:6644
- C:\Windows\System\igOBjzW.exe
  C:\Windows\System\igOBjzW.exe
  2⤵
  PID:6660
- C:\Windows\System\IyWjduo.exe
  C:\Windows\System\IyWjduo.exe
  2⤵
  PID:6680
- C:\Windows\System\HdPPMdm.exe
  C:\Windows\System\HdPPMdm.exe
  2⤵
  PID:6696
- C:\Windows\System\ijSrhTq.exe
  C:\Windows\System\ijSrhTq.exe
  2⤵
  PID:6712
- C:\Windows\System\rpJHrgn.exe
  C:\Windows\System\rpJHrgn.exe
  2⤵
  PID:6728
- C:\Windows\System\SnechOT.exe
  C:\Windows\System\SnechOT.exe
  2⤵
  PID:6748
- C:\Windows\System\wWvMuif.exe
  C:\Windows\System\wWvMuif.exe
  2⤵
  PID:6764
- C:\Windows\System\ivANggB.exe
  C:\Windows\System\ivANggB.exe
  2⤵
  PID:6780
- C:\Windows\System\rzZtwJK.exe
  C:\Windows\System\rzZtwJK.exe
  2⤵
  PID:6796
- C:\Windows\System\dgZblfk.exe
  C:\Windows\System\dgZblfk.exe
  2⤵
  PID:6812
- C:\Windows\System\XvMKyzO.exe
  C:\Windows\System\XvMKyzO.exe
  2⤵
  PID:6828
- C:\Windows\System\RHGyBcr.exe
  C:\Windows\System\RHGyBcr.exe
  2⤵
  PID:6844
- C:\Windows\System\dLLPant.exe
  C:\Windows\System\dLLPant.exe
  2⤵
  PID:6860
- C:\Windows\System\lrzNBFd.exe
  C:\Windows\System\lrzNBFd.exe
  2⤵
  PID:6876
- C:\Windows\System\HsXjhvE.exe
  C:\Windows\System\HsXjhvE.exe
  2⤵
  PID:6892
- C:\Windows\System\klqyTKB.exe
  C:\Windows\System\klqyTKB.exe
  2⤵
  PID:6908
- C:\Windows\System\BuxblpR.exe
  C:\Windows\System\BuxblpR.exe
  2⤵
  PID:6924
- C:\Windows\System\shAuPMr.exe
  C:\Windows\System\shAuPMr.exe
  2⤵
  PID:6944
- C:\Windows\System\aAVSIqy.exe
  C:\Windows\System\aAVSIqy.exe
  2⤵
  PID:6960
- C:\Windows\System\ugXvgJZ.exe
  C:\Windows\System\ugXvgJZ.exe
  2⤵
  PID:6976
- C:\Windows\System\uEWYoNP.exe
  C:\Windows\System\uEWYoNP.exe
  2⤵
  PID:6992
- C:\Windows\System\qghFOrG.exe
  C:\Windows\System\qghFOrG.exe
  2⤵
  PID:7008
- C:\Windows\System\IdMUyQb.exe
  C:\Windows\System\IdMUyQb.exe
  2⤵
  PID:7024
- C:\Windows\System\gAGwRCJ.exe
  C:\Windows\System\gAGwRCJ.exe
  2⤵
  PID:7040
- C:\Windows\System\GYbUsJI.exe
  C:\Windows\System\GYbUsJI.exe
  2⤵
  PID:7056
- C:\Windows\System\taTidJx.exe
  C:\Windows\System\taTidJx.exe
  2⤵
  PID:7072
- C:\Windows\System\PXkAZDm.exe
  C:\Windows\System\PXkAZDm.exe
  2⤵
  PID:7088
- C:\Windows\System\vgjGZsr.exe
  C:\Windows\System\vgjGZsr.exe
  2⤵
  PID:7104
- C:\Windows\System\XdSzZOc.exe
  C:\Windows\System\XdSzZOc.exe
  2⤵
  PID:7120
- C:\Windows\System\rnbVntv.exe
  C:\Windows\System\rnbVntv.exe
  2⤵
  PID:7136
- C:\Windows\System\xweoDzK.exe
  C:\Windows\System\xweoDzK.exe
  2⤵
  PID:7152
- C:\Windows\System\JFSWXhy.exe
  C:\Windows\System\JFSWXhy.exe
  2⤵
  PID:5296
- C:\Windows\System\kUYuRPC.exe
  C:\Windows\System\kUYuRPC.exe
  2⤵
  PID:5244
- C:\Windows\System\HgFRJxl.exe
  C:\Windows\System\HgFRJxl.exe
  2⤵
  PID:5620
- C:\Windows\System\jbRbgDs.exe
  C:\Windows\System\jbRbgDs.exe
  2⤵
  PID:5956
- C:\Windows\System\IFwnyoF.exe
  C:\Windows\System\IFwnyoF.exe
  2⤵
  PID:6284
- C:\Windows\System\LABuGZi.exe
  C:\Windows\System\LABuGZi.exe
  2⤵
  PID:5748
- C:\Windows\System\hvdYLHJ.exe
  C:\Windows\System\hvdYLHJ.exe
  2⤵
  PID:6432
- C:\Windows\System\GmuMTcw.exe
  C:\Windows\System\GmuMTcw.exe
  2⤵
  PID:5180
- C:\Windows\System\YmroIuZ.exe
  C:\Windows\System\YmroIuZ.exe
  2⤵
  PID:5536
- C:\Windows\System\BapclOA.exe
  C:\Windows\System\BapclOA.exe
  2⤵
  PID:5648
- C:\Windows\System\GASYVPS.exe
  C:\Windows\System\GASYVPS.exe
  2⤵
  PID:2624
- C:\Windows\System\jijWGTq.exe
  C:\Windows\System\jijWGTq.exe
  2⤵
  PID:5776
- C:\Windows\System\setRHnb.exe
  C:\Windows\System\setRHnb.exe
  2⤵
  PID:5844
- C:\Windows\System\FBhRGFZ.exe
  C:\Windows\System\FBhRGFZ.exe
  2⤵
  PID:5864
- C:\Windows\System\KFEEUWh.exe
  C:\Windows\System\KFEEUWh.exe
  2⤵
  PID:5908
- C:\Windows\System\CqbHRux.exe
  C:\Windows\System\CqbHRux.exe
  2⤵
  PID:6000
- C:\Windows\System\GReMXxg.exe
  C:\Windows\System\GReMXxg.exe
  2⤵
  PID:6068
- C:\Windows\System\IuqlTtN.exe
  C:\Windows\System\IuqlTtN.exe
  2⤵
  PID:6132
- C:\Windows\System\JtEnhSe.exe
  C:\Windows\System\JtEnhSe.exe
  2⤵
  PID:4996
- C:\Windows\System\kttiVZM.exe
  C:\Windows\System\kttiVZM.exe
  2⤵
  PID:1300
- C:\Windows\System\sjTBQNV.exe
  C:\Windows\System\sjTBQNV.exe
  2⤵
  PID:316
- C:\Windows\System\LHdUCXr.exe
  C:\Windows\System\LHdUCXr.exe
  2⤵
  PID:1472
- C:\Windows\System\kCRIGhe.exe
  C:\Windows\System\kCRIGhe.exe
  2⤵
  PID:5164
- C:\Windows\System\rVXOjDh.exe
  C:\Windows\System\rVXOjDh.exe
  2⤵
  PID:5228
- C:\Windows\System\opWXaJb.exe
  C:\Windows\System\opWXaJb.exe
  2⤵
  PID:5300
- C:\Windows\System\MBkjRPF.exe
  C:\Windows\System\MBkjRPF.exe
  2⤵
  PID:5380
- C:\Windows\System\bIwXRBl.exe
  C:\Windows\System\bIwXRBl.exe
  2⤵
  PID:5472
- C:\Windows\System\bJExkdE.exe
  C:\Windows\System\bJExkdE.exe
  2⤵
  PID:5456
- C:\Windows\System\jUIOEqP.exe
  C:\Windows\System\jUIOEqP.exe
  2⤵
  PID:2576
- C:\Windows\System\lMhOtRS.exe
  C:\Windows\System\lMhOtRS.exe
  2⤵
  PID:5760
- C:\Windows\System\PuVhSpF.exe
  C:\Windows\System\PuVhSpF.exe
  2⤵
  PID:5888
- C:\Windows\System\AsuFXWZ.exe
  C:\Windows\System\AsuFXWZ.exe
  2⤵
  PID:3896
- C:\Windows\System\AlqmdKD.exe
  C:\Windows\System\AlqmdKD.exe
  2⤵
  PID:6204
- C:\Windows\System\TAlomgo.exe
  C:\Windows\System\TAlomgo.exe
  2⤵
  PID:6292
- C:\Windows\System\nxLaZwc.exe
  C:\Windows\System\nxLaZwc.exe
  2⤵
  PID:6308
- C:\Windows\System\AsxYTon.exe
  C:\Windows\System\AsxYTon.exe
  2⤵
  PID:6332
- C:\Windows\System\NJrKdGa.exe
  C:\Windows\System\NJrKdGa.exe
  2⤵
  PID:6348
- C:\Windows\System\nYfTrrp.exe
  C:\Windows\System\nYfTrrp.exe
  2⤵
  PID:6464
- C:\Windows\System\LoWjLTf.exe
  C:\Windows\System\LoWjLTf.exe
  2⤵
  PID:6164
- C:\Windows\System\aBJIdNs.exe
  C:\Windows\System\aBJIdNs.exe
  2⤵
  PID:6224
- C:\Windows\System\hFfflJF.exe
  C:\Windows\System\hFfflJF.exe
  2⤵
  PID:6364
- C:\Windows\System\vNvoJHQ.exe
  C:\Windows\System\vNvoJHQ.exe
  2⤵
  PID:6392
- C:\Windows\System\xUoGGYz.exe
  C:\Windows\System\xUoGGYz.exe
  2⤵
  PID:6156
- C:\Windows\System\UitdpbA.exe
  C:\Windows\System\UitdpbA.exe
  2⤵
  PID:6240
- C:\Windows\System\JNQVNWt.exe
  C:\Windows\System\JNQVNWt.exe
  2⤵
  PID:6256
- C:\Windows\System\rZULfTE.exe
  C:\Windows\System\rZULfTE.exe
  2⤵
  PID:6384
- C:\Windows\System\nanQzeS.exe
  C:\Windows\System\nanQzeS.exe
  2⤵
  PID:6552
- C:\Windows\System\LFUFWSG.exe
  C:\Windows\System\LFUFWSG.exe
  2⤵
  PID:6588
- C:\Windows\System\RshtgIF.exe
  C:\Windows\System\RshtgIF.exe
  2⤵
  PID:6636
- C:\Windows\System\SFDGjWh.exe
  C:\Windows\System\SFDGjWh.exe
  2⤵
  PID:6688
- C:\Windows\System\etqxFdq.exe
  C:\Windows\System\etqxFdq.exe
  2⤵
  PID:6708
- C:\Windows\System\cLyEreG.exe
  C:\Windows\System\cLyEreG.exe
  2⤵
  PID:6744
- C:\Windows\System\upszvkz.exe
  C:\Windows\System\upszvkz.exe
  2⤵
  PID:6776
- C:\Windows\System\ZrFcoAt.exe
  C:\Windows\System\ZrFcoAt.exe
  2⤵
  PID:6820
- C:\Windows\System\PVkIaQA.exe
  C:\Windows\System\PVkIaQA.exe
  2⤵
  PID:6852
- C:\Windows\System\xIHlzbk.exe
  C:\Windows\System\xIHlzbk.exe
  2⤵
  PID:6884
- C:\Windows\System\gAZBKGf.exe
  C:\Windows\System\gAZBKGf.exe
  2⤵
  PID:1864
- C:\Windows\System\RMmHbei.exe
  C:\Windows\System\RMmHbei.exe
  2⤵
  PID:6936
- C:\Windows\System\GTsssTZ.exe
  C:\Windows\System\GTsssTZ.exe
  2⤵
  PID:6988
- C:\Windows\System\mGhhVdj.exe
  C:\Windows\System\mGhhVdj.exe
  2⤵
  PID:7032
- C:\Windows\System\XWTpEmu.exe
  C:\Windows\System\XWTpEmu.exe
  2⤵
  PID:7052
- C:\Windows\System\rWePdNF.exe
  C:\Windows\System\rWePdNF.exe
  2⤵
  PID:7084
- C:\Windows\System\GSHQpiP.exe
  C:\Windows\System\GSHQpiP.exe
  2⤵
  PID:7100
- C:\Windows\System\pBZsWXR.exe
  C:\Windows\System\pBZsWXR.exe
  2⤵
  PID:7148
- C:\Windows\System\vOQNcFM.exe
  C:\Windows\System\vOQNcFM.exe
  2⤵
  PID:5352
- C:\Windows\System\XwWMbmF.exe
  C:\Windows\System\XwWMbmF.exe
  2⤵
  PID:6188
- C:\Windows\System\upmjide.exe
  C:\Windows\System\upmjide.exe
  2⤵
  PID:5440
- C:\Windows\System\UtTdBRQ.exe
  C:\Windows\System\UtTdBRQ.exe
  2⤵
  PID:5360
- C:\Windows\System\IJyTwmP.exe
  C:\Windows\System\IJyTwmP.exe
  2⤵
  PID:5716
- C:\Windows\System\PlPOCaS.exe
  C:\Windows\System\PlPOCaS.exe
  2⤵
  PID:5852
- C:\Windows\System\kMRRIGC.exe
  C:\Windows\System\kMRRIGC.exe
  2⤵
  PID:5940
- C:\Windows\System\zXQrXpP.exe
  C:\Windows\System\zXQrXpP.exe
  2⤵
  PID:6064
- C:\Windows\System\QrIznYw.exe
  C:\Windows\System\QrIznYw.exe
  2⤵
  PID:1700
- C:\Windows\System\BKwUYnR.exe
  C:\Windows\System\BKwUYnR.exe
  2⤵
  PID:5132
- C:\Windows\System\wMEukQM.exe
  C:\Windows\System\wMEukQM.exe
  2⤵
  PID:5260
- C:\Windows\System\HNboIJU.exe
  C:\Windows\System\HNboIJU.exe
  2⤵
  PID:5372
- C:\Windows\System\rECPmah.exe
  C:\Windows\System\rECPmah.exe
  2⤵
  PID:6304
- C:\Windows\System\liAGpty.exe
  C:\Windows\System\liAGpty.exe
  2⤵
  PID:5868
- C:\Windows\System\kulTMCV.exe
  C:\Windows\System\kulTMCV.exe
  2⤵
  PID:6344
- C:\Windows\System\bimHAKr.exe
  C:\Windows\System\bimHAKr.exe
  2⤵
  PID:6148
- C:\Windows\System\mOUjWBa.exe
  C:\Windows\System\mOUjWBa.exe
  2⤵
  PID:6264
- C:\Windows\System\zKLfgnV.exe
  C:\Windows\System\zKLfgnV.exe
  2⤵
  PID:6252
- C:\Windows\System\bVfmLuD.exe
  C:\Windows\System\bVfmLuD.exe
  2⤵
  PID:6360
- C:\Windows\System\qjbxqsy.exe
  C:\Windows\System\qjbxqsy.exe
  2⤵
  PID:6572
- C:\Windows\System\hiMyFMu.exe
  C:\Windows\System\hiMyFMu.exe
  2⤵
  PID:6668
- C:\Windows\System\KncZXpC.exe
  C:\Windows\System\KncZXpC.exe
  2⤵
  PID:6652
- C:\Windows\System\fLPqazA.exe
  C:\Windows\System\fLPqazA.exe
  2⤵
  PID:6760
- C:\Windows\System\bNqDUdM.exe
  C:\Windows\System\bNqDUdM.exe
  2⤵
  PID:6808
- C:\Windows\System\idrGVKR.exe
  C:\Windows\System\idrGVKR.exe
  2⤵
  PID:6788
- C:\Windows\System\coxedeS.exe
  C:\Windows\System\coxedeS.exe
  2⤵
  PID:6900
- C:\Windows\System\ZQjbquE.exe
  C:\Windows\System\ZQjbquE.exe
  2⤵
  PID:6932
- C:\Windows\System\xtwdUQV.exe
  C:\Windows\System\xtwdUQV.exe
  2⤵
  PID:6968
- C:\Windows\System\KOjsixC.exe
  C:\Windows\System\KOjsixC.exe
  2⤵
  PID:7068
- C:\Windows\System\XBfDRAu.exe
  C:\Windows\System\XBfDRAu.exe
  2⤵
  PID:7116
- C:\Windows\System\iDpCByz.exe
  C:\Windows\System\iDpCByz.exe
  2⤵
  PID:7048
- C:\Windows\System\eQjnRaC.exe
  C:\Windows\System\eQjnRaC.exe
  2⤵
  PID:7164
- C:\Windows\System\ZjnJuYm.exe
  C:\Windows\System\ZjnJuYm.exe
  2⤵
  PID:5184
- C:\Windows\System\EtLVIdn.exe
  C:\Windows\System\EtLVIdn.exe
  2⤵
  PID:5808
- C:\Windows\System\aEdsmKS.exe
  C:\Windows\System\aEdsmKS.exe
  2⤵
  PID:5680
- C:\Windows\System\uYUfOiN.exe
  C:\Windows\System\uYUfOiN.exe
  2⤵
  PID:5968
- C:\Windows\System\pqaGYTv.exe
  C:\Windows\System\pqaGYTv.exe
  2⤵
  PID:6128
- C:\Windows\System\vSFLYWy.exe
  C:\Windows\System\vSFLYWy.exe
  2⤵
  PID:4376
- C:\Windows\System\wCMjYzc.exe
  C:\Windows\System\wCMjYzc.exe
  2⤵
  PID:5452
- C:\Windows\System\fvTnVdM.exe
  C:\Windows\System\fvTnVdM.exe
  2⤵
  PID:5764
- C:\Windows\System\rZmUKnD.exe
  C:\Windows\System\rZmUKnD.exe
  2⤵
  PID:6280
- C:\Windows\System\ArXlNTa.exe
  C:\Windows\System\ArXlNTa.exe
  2⤵
  PID:6300
- C:\Windows\System\xHcSzpl.exe
  C:\Windows\System\xHcSzpl.exe
  2⤵
  PID:6220
- C:\Windows\System\GokNjqz.exe
  C:\Windows\System\GokNjqz.exe
  2⤵
  PID:6248
- C:\Windows\System\aknxMjj.exe
  C:\Windows\System\aknxMjj.exe
  2⤵
  PID:7160
- C:\Windows\System\tutmMMw.exe
  C:\Windows\System\tutmMMw.exe
  2⤵
  PID:5196
- C:\Windows\System\ViqwQKc.exe
  C:\Windows\System\ViqwQKc.exe
  2⤵
  PID:6984
- C:\Windows\System\rspnAqG.exe
  C:\Windows\System\rspnAqG.exe
  2⤵
  PID:6920
- C:\Windows\System\dGnlDaU.exe
  C:\Windows\System\dGnlDaU.exe
  2⤵
  PID:6840
- C:\Windows\System\spgDrSh.exe
  C:\Windows\System\spgDrSh.exe
  2⤵
  PID:6036
- C:\Windows\System\cTVtskg.exe
  C:\Windows\System\cTVtskg.exe
  2⤵
  PID:5336
- C:\Windows\System\LfhNVMp.exe
  C:\Windows\System\LfhNVMp.exe
  2⤵
  PID:4692
- C:\Windows\System\EbTpiim.exe
  C:\Windows\System\EbTpiim.exe
  2⤵
  PID:6408
- C:\Windows\System\UpYpusV.exe
  C:\Windows\System\UpYpusV.exe
  2⤵
  PID:6484
- C:\Windows\System\JONsaLh.exe
  C:\Windows\System\JONsaLh.exe
  2⤵
  PID:6640
- C:\Windows\System\RuqGprD.exe
  C:\Windows\System\RuqGprD.exe
  2⤵
  PID:7188
- C:\Windows\System\cIcCUEk.exe
  C:\Windows\System\cIcCUEk.exe
  2⤵
  PID:7652
- C:\Windows\System\hoAYdts.exe
  C:\Windows\System\hoAYdts.exe
  2⤵
  PID:7672
- C:\Windows\System\ZrWtktI.exe
  C:\Windows\System\ZrWtktI.exe
  2⤵
  PID:7688
- C:\Windows\System\bWpwQOc.exe
  C:\Windows\System\bWpwQOc.exe
  2⤵
  PID:7720
- C:\Windows\System\BUtuOmJ.exe
  C:\Windows\System\BUtuOmJ.exe
  2⤵
  PID:7756
- C:\Windows\System\zdbyzyA.exe
  C:\Windows\System\zdbyzyA.exe
  2⤵
  PID:7772
- C:\Windows\System\hOotmnX.exe
  C:\Windows\System\hOotmnX.exe
  2⤵
  PID:7788
- C:\Windows\System\ktBczgh.exe
  C:\Windows\System\ktBczgh.exe
  2⤵
  PID:8064
- C:\Windows\System\cqVzill.exe
  C:\Windows\System\cqVzill.exe
  2⤵
  PID:8080
- C:\Windows\System\vlTrkQf.exe
  C:\Windows\System\vlTrkQf.exe
  2⤵
  PID:8100
- C:\Windows\System\AZINsmF.exe
  C:\Windows\System\AZINsmF.exe
  2⤵
  PID:8116
- C:\Windows\System\PHYRRej.exe
  C:\Windows\System\PHYRRej.exe
  2⤵
  PID:8136
- C:\Windows\System\FxXUMaK.exe
  C:\Windows\System\FxXUMaK.exe
  2⤵
  PID:8156
- C:\Windows\System\vAlNDEv.exe
  C:\Windows\System\vAlNDEv.exe
  2⤵
  PID:8172
- C:\Windows\System\wnKcpHu.exe
  C:\Windows\System\wnKcpHu.exe
  2⤵
  PID:8188
- C:\Windows\System\YieXkcg.exe
  C:\Windows\System\YieXkcg.exe
  2⤵
  PID:6232
- C:\Windows\System\ITSWTXd.exe
  C:\Windows\System\ITSWTXd.exe
  2⤵
  PID:3024
- C:\Windows\System\HfFWeHl.exe
  C:\Windows\System\HfFWeHl.exe
  2⤵
  PID:6704
- C:\Windows\System\hGFncRl.exe
  C:\Windows\System\hGFncRl.exe
  2⤵
  PID:7184
- C:\Windows\System\rEVreVf.exe
  C:\Windows\System\rEVreVf.exe
  2⤵
  PID:7696
- C:\Windows\System\eUEexQr.exe
  C:\Windows\System\eUEexQr.exe
  2⤵
  PID:7712
- C:\Windows\System\waKPpjm.exe
  C:\Windows\System\waKPpjm.exe
  2⤵
  PID:7768
- C:\Windows\System\vIhAOtJ.exe
  C:\Windows\System\vIhAOtJ.exe
  2⤵
  PID:7808
- C:\Windows\System\ARRPgmS.exe
  C:\Windows\System\ARRPgmS.exe
  2⤵
  PID:6972
- C:\Windows\System\StCyddF.exe
  C:\Windows\System\StCyddF.exe
  2⤵
  PID:5876
- C:\Windows\System\oKGTEMc.exe
  C:\Windows\System\oKGTEMc.exe
  2⤵
  PID:7532
- C:\Windows\System\wJddrKC.exe
  C:\Windows\System\wJddrKC.exe
  2⤵
  PID:7556
- C:\Windows\System\qVHnSSs.exe
  C:\Windows\System\qVHnSSs.exe
  2⤵
  PID:7580
- C:\Windows\System\nGskuVb.exe
  C:\Windows\System\nGskuVb.exe
  2⤵
  PID:7884
- C:\Windows\System\IujFerP.exe
  C:\Windows\System\IujFerP.exe
  2⤵
  PID:7900
- C:\Windows\System\vxipOcJ.exe
  C:\Windows\System\vxipOcJ.exe
  2⤵
  PID:7920
- C:\Windows\System\jIFrbbE.exe
  C:\Windows\System\jIFrbbE.exe
  2⤵
  PID:7932
- C:\Windows\System\zsktlsB.exe
  C:\Windows\System\zsktlsB.exe
  2⤵
  PID:7948
- C:\Windows\System\ZmUApBG.exe
  C:\Windows\System\ZmUApBG.exe
  2⤵
  PID:7964
- C:\Windows\System\WfnONBt.exe
  C:\Windows\System\WfnONBt.exe
  2⤵
  PID:7984
- C:\Windows\System\QZbqiav.exe
  C:\Windows\System\QZbqiav.exe
  2⤵
  PID:8004
- C:\Windows\System\GcwzgfR.exe
  C:\Windows\System\GcwzgfR.exe
  2⤵
  PID:8020
- C:\Windows\System\cTmcVFg.exe
  C:\Windows\System\cTmcVFg.exe
  2⤵
  PID:8036
- C:\Windows\System\rVowXVl.exe
  C:\Windows\System\rVowXVl.exe
  2⤵
  PID:8052
- C:\Windows\System\rcRsEzq.exe
  C:\Windows\System\rcRsEzq.exe
  2⤵
  PID:6340
- C:\Windows\System\iMZrRfk.exe
  C:\Windows\System\iMZrRfk.exe
  2⤵
  PID:8128
- C:\Windows\System\jWafAsu.exe
  C:\Windows\System\jWafAsu.exe
  2⤵
  PID:6940
- C:\Windows\System\gtSOBxX.exe
  C:\Windows\System\gtSOBxX.exe
  2⤵
  PID:6320
- C:\Windows\System\kBqgjDT.exe
  C:\Windows\System\kBqgjDT.exe
  2⤵
  PID:6328
- C:\Windows\System\HBQgyfA.exe
  C:\Windows\System\HBQgyfA.exe
  2⤵
  PID:7228
- C:\Windows\System\WbLClXd.exe
  C:\Windows\System\WbLClXd.exe
  2⤵
  PID:7244
- C:\Windows\System\bJdIXiB.exe
  C:\Windows\System\bJdIXiB.exe
  2⤵
  PID:6720
- C:\Windows\System\TTxvzaK.exe
  C:\Windows\System\TTxvzaK.exe
  2⤵
  PID:7316
- C:\Windows\System\MMyIZyn.exe
  C:\Windows\System\MMyIZyn.exe
  2⤵
  PID:7412
- C:\Windows\System\ailUBix.exe
  C:\Windows\System\ailUBix.exe
  2⤵
  PID:7440
- C:\Windows\System\otYFiiJ.exe
  C:\Windows\System\otYFiiJ.exe
  2⤵
  PID:7548
- C:\Windows\System\qsVLRox.exe
  C:\Windows\System\qsVLRox.exe
  2⤵
  PID:7636
- C:\Windows\System\IoAYWCN.exe
  C:\Windows\System\IoAYWCN.exe
  2⤵
  PID:8148
- C:\Windows\System\qCtpjSD.exe
  C:\Windows\System\qCtpjSD.exe
  2⤵
  PID:7180
- C:\Windows\System\guCtYgi.exe
  C:\Windows\System\guCtYgi.exe
  2⤵
  PID:7264
- C:\Windows\System\heeoTWd.exe
  C:\Windows\System\heeoTWd.exe
  2⤵
  PID:7280
- C:\Windows\System\sHusLYN.exe
  C:\Windows\System\sHusLYN.exe
  2⤵
  PID:7300
- C:\Windows\System\nBOqXRI.exe
  C:\Windows\System\nBOqXRI.exe
  2⤵
  PID:7336
- C:\Windows\System\cPbTEyk.exe
  C:\Windows\System\cPbTEyk.exe
  2⤵
  PID:7360
- C:\Windows\System\rgmXfed.exe
  C:\Windows\System\rgmXfed.exe
  2⤵
  PID:7380
- C:\Windows\System\TtwsMLF.exe
  C:\Windows\System\TtwsMLF.exe
  2⤵
  PID:6020
- C:\Windows\System\ehvhFhE.exe
  C:\Windows\System\ehvhFhE.exe
  2⤵
  PID:7408
- C:\Windows\System\MQompxD.exe
  C:\Windows\System\MQompxD.exe
  2⤵
  PID:7456
- C:\Windows\System\MKVuLAJ.exe
  C:\Windows\System\MKVuLAJ.exe
  2⤵
  PID:7476
- C:\Windows\System\rVPDjuf.exe
  C:\Windows\System\rVPDjuf.exe
  2⤵
  PID:7172
- C:\Windows\System\fyQueOz.exe
  C:\Windows\System\fyQueOz.exe
  2⤵
  PID:4856
- C:\Windows\System\UZgmxXg.exe
  C:\Windows\System\UZgmxXg.exe
  2⤵
  PID:7616
- C:\Windows\System\ZTHgOFO.exe
  C:\Windows\System\ZTHgOFO.exe
  2⤵
  PID:7680
- C:\Windows\System\TDxYHdw.exe
  C:\Windows\System\TDxYHdw.exe
  2⤵
  PID:7612
- C:\Windows\System\FHIpWqu.exe
  C:\Windows\System\FHIpWqu.exe
  2⤵
  PID:7732
- C:\Windows\System\qesoqBD.exe
  C:\Windows\System\qesoqBD.exe
  2⤵
  PID:7844
- C:\Windows\System\GcgPYZs.exe
  C:\Windows\System\GcgPYZs.exe
  2⤵
  PID:7744
- C:\Windows\System\cEDUeav.exe
  C:\Windows\System\cEDUeav.exe
  2⤵
  PID:7896
- C:\Windows\System\tTOwFkq.exe
  C:\Windows\System\tTOwFkq.exe
  2⤵
  PID:7960
- C:\Windows\System\uLZXbXL.exe
  C:\Windows\System\uLZXbXL.exe
  2⤵
  PID:8032
- C:\Windows\System\ymPTMaH.exe
  C:\Windows\System\ymPTMaH.exe
  2⤵
  PID:6904
- C:\Windows\System\TdJPYmp.exe
  C:\Windows\System\TdJPYmp.exe
  2⤵
  PID:7628
- C:\Windows\System\VyvMyOb.exe
  C:\Windows\System\VyvMyOb.exe
  2⤵
  PID:7784
- C:\Windows\System\VmpYYbf.exe
  C:\Windows\System\VmpYYbf.exe
  2⤵
  PID:7828
- C:\Windows\System\AcsGufX.exe
  C:\Windows\System\AcsGufX.exe
  2⤵
  PID:7880
- C:\Windows\System\vaDgUGN.exe
  C:\Windows\System\vaDgUGN.exe
  2⤵
  PID:7764
- C:\Windows\System\ZUwOXdy.exe
  C:\Windows\System\ZUwOXdy.exe
  2⤵
  PID:8012
- C:\Windows\System\uDPwOvY.exe
  C:\Windows\System\uDPwOvY.exe
  2⤵
  PID:7908
- C:\Windows\System\dcRMnwt.exe
  C:\Windows\System\dcRMnwt.exe
  2⤵
  PID:7296
- C:\Windows\System\fQcHndR.exe
  C:\Windows\System\fQcHndR.exe
  2⤵
  PID:7584
- C:\Windows\System\ydhkKpQ.exe
  C:\Windows\System\ydhkKpQ.exe
  2⤵
  PID:7204
- C:\Windows\System\vemSAqV.exe
  C:\Windows\System\vemSAqV.exe
  2⤵
  PID:7276
- C:\Windows\System\wXcmSuj.exe
  C:\Windows\System\wXcmSuj.exe
  2⤵
  PID:7324
- C:\Windows\System\dbhdaWv.exe
  C:\Windows\System\dbhdaWv.exe
  2⤵
  PID:8144
- C:\Windows\System\pjPsvck.exe
  C:\Windows\System\pjPsvck.exe
  2⤵
  PID:7372
- C:\Windows\System\MfQkngP.exe
  C:\Windows\System\MfQkngP.exe
  2⤵
  PID:7404
- C:\Windows\System\rwVdJnd.exe
  C:\Windows\System\rwVdJnd.exe
  2⤵
  PID:7464
- C:\Windows\System\ivSNhhA.exe
  C:\Windows\System\ivSNhhA.exe
  2⤵
  PID:7332
- C:\Windows\System\FDvVRpf.exe
  C:\Windows\System\FDvVRpf.exe
  2⤵
  PID:7444
- C:\Windows\System\xHYdcfP.exe
  C:\Windows\System\xHYdcfP.exe
  2⤵
  PID:7496
- C:\Windows\System\ZNArqKS.exe
  C:\Windows\System\ZNArqKS.exe
  2⤵
  PID:7352
- C:\Windows\System\spGgLKO.exe
  C:\Windows\System\spGgLKO.exe
  2⤵
  PID:7484
- C:\Windows\System\LWBWAKf.exe
  C:\Windows\System\LWBWAKf.exe
  2⤵
  PID:7516
- C:\Windows\System\rdrhRQJ.exe
  C:\Windows\System\rdrhRQJ.exe
  2⤵
  PID:8108
- C:\Windows\System\USISIHd.exe
  C:\Windows\System\USISIHd.exe
  2⤵
  PID:7540
- C:\Windows\System\jwzAFbY.exe
  C:\Windows\System\jwzAFbY.exe
  2⤵
  PID:7624
- C:\Windows\System\gdBpzCl.exe
  C:\Windows\System\gdBpzCl.exe
  2⤵
  PID:7956
- C:\Windows\System\wgBzxnf.exe
  C:\Windows\System\wgBzxnf.exe
  2⤵
  PID:7592
- C:\Windows\System\yCmtfNs.exe
  C:\Windows\System\yCmtfNs.exe
  2⤵
  PID:7608
- C:\Windows\System\pYqotiD.exe
  C:\Windows\System\pYqotiD.exe
  2⤵
  PID:7648
- C:\Windows\System\PAMTQpN.exe
  C:\Windows\System\PAMTQpN.exe
  2⤵
  PID:7736
- C:\Windows\System\ZYIkdMJ.exe
  C:\Windows\System\ZYIkdMJ.exe
  2⤵
  PID:8048
- C:\Windows\System\FyOawuF.exe
  C:\Windows\System\FyOawuF.exe
  2⤵
  PID:7016
- C:\Windows\System\JcPIfep.exe
  C:\Windows\System\JcPIfep.exe
  2⤵
  PID:8028
- C:\Windows\System\kCVZgHS.exe
  C:\Windows\System\kCVZgHS.exe
  2⤵
  PID:7864
- C:\Windows\System\eIbfvPe.exe
  C:\Windows\System\eIbfvPe.exe
  2⤵
  PID:6184
- C:\Windows\System\vrDBWTm.exe
  C:\Windows\System\vrDBWTm.exe
  2⤵
  PID:7928
- C:\Windows\System\AeBZxZO.exe
  C:\Windows\System\AeBZxZO.exe
  2⤵
  PID:7528
- C:\Windows\System\JaKcDAY.exe
  C:\Windows\System\JaKcDAY.exe
  2⤵
  PID:7836
- C:\Windows\System\qJAQHwP.exe
  C:\Windows\System\qJAQHwP.exe
  2⤵
  PID:7240
- C:\Windows\System\yMIrhQY.exe
  C:\Windows\System\yMIrhQY.exe
  2⤵
  PID:7504
- C:\Windows\System\TogbcsT.exe
  C:\Windows\System\TogbcsT.exe
  2⤵
  PID:6756
- C:\Windows\System\xYGsHsc.exe
  C:\Windows\System\xYGsHsc.exe
  2⤵
  PID:8096
- C:\Windows\System\NiUcXhV.exe
  C:\Windows\System\NiUcXhV.exe
  2⤵
  PID:7552
- C:\Windows\System\njgtHzx.exe
  C:\Windows\System\njgtHzx.exe
  2⤵
  PID:7620
- C:\Windows\System\XawyEbw.exe
  C:\Windows\System\XawyEbw.exe
  2⤵
  PID:7816
- C:\Windows\System\XmmmeSE.exe
  C:\Windows\System\XmmmeSE.exe
  2⤵
  PID:6956
- C:\Windows\System\YPaqRqW.exe
  C:\Windows\System\YPaqRqW.exe
  2⤵
  PID:7868
- C:\Windows\System\MeRTXKx.exe
  C:\Windows\System\MeRTXKx.exe
  2⤵
  PID:7304
- C:\Windows\System\KofaFSY.exe
  C:\Windows\System\KofaFSY.exe
  2⤵
  PID:7308
- C:\Windows\System\bEKNGyQ.exe
  C:\Windows\System\bEKNGyQ.exe
  2⤵
  PID:7480
- C:\Windows\System\QyZyryd.exe
  C:\Windows\System\QyZyryd.exe
  2⤵
  PID:7748
- C:\Windows\System\TxIuIBY.exe
  C:\Windows\System\TxIuIBY.exe
  2⤵
  PID:7288
- C:\Windows\System\ZOnzPIs.exe
  C:\Windows\System\ZOnzPIs.exe
  2⤵
  PID:7644
- C:\Windows\System\RXqmnyy.exe
  C:\Windows\System\RXqmnyy.exe
  2⤵
  PID:7452
- C:\Windows\System\myeHIbD.exe
  C:\Windows\System\myeHIbD.exe
  2⤵
  PID:8180
- C:\Windows\System\zgWufHb.exe
  C:\Windows\System\zgWufHb.exe
  2⤵
  PID:6412
- C:\Windows\System\jOHMcfb.exe
  C:\Windows\System\jOHMcfb.exe
  2⤵
  PID:8200
- C:\Windows\System\XgpfmYF.exe
  C:\Windows\System\XgpfmYF.exe
  2⤵
  PID:8216
- C:\Windows\System\MfutBbT.exe
  C:\Windows\System\MfutBbT.exe
  2⤵
  PID:8232
- C:\Windows\System\kBPeiQl.exe
  C:\Windows\System\kBPeiQl.exe
  2⤵
  PID:8248
- C:\Windows\System\TVoiSjn.exe
  C:\Windows\System\TVoiSjn.exe
  2⤵
  PID:8264
- C:\Windows\System\PBrPIjF.exe
  C:\Windows\System\PBrPIjF.exe
  2⤵
  PID:8284
- C:\Windows\System\WYrlHgS.exe
  C:\Windows\System\WYrlHgS.exe
  2⤵
  PID:8300
- C:\Windows\System\nRjGTtr.exe
  C:\Windows\System\nRjGTtr.exe
  2⤵
  PID:8316
- C:\Windows\System\efarfrM.exe
  C:\Windows\System\efarfrM.exe
  2⤵
  PID:8332
- C:\Windows\System\TGJThyl.exe
  C:\Windows\System\TGJThyl.exe
  2⤵
  PID:8352
- C:\Windows\System\HtDWLac.exe
  C:\Windows\System\HtDWLac.exe
  2⤵
  PID:8372
- C:\Windows\System\zcypOGM.exe
  C:\Windows\System\zcypOGM.exe
  2⤵
  PID:8388
- C:\Windows\System\MDIGaNm.exe
  C:\Windows\System\MDIGaNm.exe
  2⤵
  PID:8412
- C:\Windows\System\BqeLvuz.exe
  C:\Windows\System\BqeLvuz.exe
  2⤵
  PID:8464
- C:\Windows\System\SnlpleV.exe
  C:\Windows\System\SnlpleV.exe
  2⤵
  PID:8480
- C:\Windows\System\okXnXtk.exe
  C:\Windows\System\okXnXtk.exe
  2⤵
  PID:8528
- C:\Windows\System\BsXdsoI.exe
  C:\Windows\System\BsXdsoI.exe
  2⤵
  PID:8544
- C:\Windows\System\DfwFVjQ.exe
  C:\Windows\System\DfwFVjQ.exe
  2⤵
  PID:8560
- C:\Windows\System\IVpqRil.exe
  C:\Windows\System\IVpqRil.exe
  2⤵
  PID:8576
- C:\Windows\System\MrIJhAD.exe
  C:\Windows\System\MrIJhAD.exe
  2⤵
  PID:8592
- C:\Windows\System\fAwvfMP.exe
  C:\Windows\System\fAwvfMP.exe
  2⤵
  PID:8608
- C:\Windows\System\IULLSXU.exe
  C:\Windows\System\IULLSXU.exe
  2⤵
  PID:8624
- C:\Windows\System\QnKGplq.exe
  C:\Windows\System\QnKGplq.exe
  2⤵
  PID:8644
- C:\Windows\System\NQJGXyz.exe
  C:\Windows\System\NQJGXyz.exe
  2⤵
  PID:8660
- C:\Windows\System\bBDjYDJ.exe
  C:\Windows\System\bBDjYDJ.exe
  2⤵
  PID:8676
- C:\Windows\System\CXaViNQ.exe
  C:\Windows\System\CXaViNQ.exe
  2⤵
  PID:8692
- C:\Windows\System\DyMMxWR.exe
  C:\Windows\System\DyMMxWR.exe
  2⤵
  PID:8708
- C:\Windows\System\zRfjjmz.exe
  C:\Windows\System\zRfjjmz.exe
  2⤵
  PID:8724
- C:\Windows\System\voTWFdi.exe
  C:\Windows\System\voTWFdi.exe
  2⤵
  PID:8740
- C:\Windows\System\CyjTuFQ.exe
  C:\Windows\System\CyjTuFQ.exe
  2⤵
  PID:8756
- C:\Windows\System\SlbgmIq.exe
  C:\Windows\System\SlbgmIq.exe
  2⤵
  PID:8772
- C:\Windows\System\SsnKBuW.exe
  C:\Windows\System\SsnKBuW.exe
  2⤵
  PID:8788
- C:\Windows\System\yvUXEKT.exe
  C:\Windows\System\yvUXEKT.exe
  2⤵
  PID:8804
- C:\Windows\System\jNctdEv.exe
  C:\Windows\System\jNctdEv.exe
  2⤵
  PID:8820
- C:\Windows\System\uPodJkW.exe
  C:\Windows\System\uPodJkW.exe
  2⤵
  PID:8836
- C:\Windows\System\BHkqIEE.exe
  C:\Windows\System\BHkqIEE.exe
  2⤵
  PID:8852
- C:\Windows\System\suUlSdc.exe
  C:\Windows\System\suUlSdc.exe
  2⤵
  PID:8868
- C:\Windows\System\gWsIkpU.exe
  C:\Windows\System\gWsIkpU.exe
  2⤵
  PID:8884
- C:\Windows\System\ZTuxCMK.exe
  C:\Windows\System\ZTuxCMK.exe
  2⤵
  PID:8900
- C:\Windows\System\uYUCccn.exe
  C:\Windows\System\uYUCccn.exe
  2⤵
  PID:8916
- C:\Windows\System\NXBlgnu.exe
  C:\Windows\System\NXBlgnu.exe
  2⤵
  PID:8932
- C:\Windows\System\GXDjsRR.exe
  C:\Windows\System\GXDjsRR.exe
  2⤵
  PID:8948
- C:\Windows\System\jUcMVnf.exe
  C:\Windows\System\jUcMVnf.exe
  2⤵
  PID:8964
- C:\Windows\System\NcNkmxw.exe
  C:\Windows\System\NcNkmxw.exe
  2⤵
  PID:8980
- C:\Windows\System\ETNlVha.exe
  C:\Windows\System\ETNlVha.exe
  2⤵
  PID:8996
- C:\Windows\System\GuYqxov.exe
  C:\Windows\System\GuYqxov.exe
  2⤵
  PID:9016
- C:\Windows\System\IAUiUXT.exe
  C:\Windows\System\IAUiUXT.exe
  2⤵
  PID:9032
- C:\Windows\System\ktWsxDu.exe
  C:\Windows\System\ktWsxDu.exe
  2⤵
  PID:9048
- C:\Windows\System\EVmAEly.exe
  C:\Windows\System\EVmAEly.exe
  2⤵
  PID:9064
- C:\Windows\System\YBrWsbT.exe
  C:\Windows\System\YBrWsbT.exe
  2⤵
  PID:9080
- C:\Windows\System\LshFtcz.exe
  C:\Windows\System\LshFtcz.exe
  2⤵
  PID:9096
- C:\Windows\System\XWVmwBM.exe
  C:\Windows\System\XWVmwBM.exe
  2⤵
  PID:9112
- C:\Windows\System\kcDsrnl.exe
  C:\Windows\System\kcDsrnl.exe
  2⤵
  PID:9128
- C:\Windows\System\kEdEfyw.exe
  C:\Windows\System\kEdEfyw.exe
  2⤵
  PID:9144
- C:\Windows\System\rdpkrKG.exe
  C:\Windows\System\rdpkrKG.exe
  2⤵
  PID:9160
- C:\Windows\System\jwSgXkF.exe
  C:\Windows\System\jwSgXkF.exe
  2⤵
  PID:9176
- C:\Windows\System\PIEEWMH.exe
  C:\Windows\System\PIEEWMH.exe
  2⤵
  PID:9192
- C:\Windows\System\nFusfXj.exe
  C:\Windows\System\nFusfXj.exe
  2⤵
  PID:9208
- C:\Windows\System\RGcTAOr.exe
  C:\Windows\System\RGcTAOr.exe
  2⤵
  PID:7812
- C:\Windows\System\cOsFBLG.exe
  C:\Windows\System\cOsFBLG.exe
  2⤵
  PID:7392
- C:\Windows\System\edivgnb.exe
  C:\Windows\System\edivgnb.exe
  2⤵
  PID:7704
- C:\Windows\System\xeSPihV.exe
  C:\Windows\System\xeSPihV.exe
  2⤵
  PID:7400
- C:\Windows\System\nCMrjXr.exe
  C:\Windows\System\nCMrjXr.exe
  2⤵
  PID:7200
- C:\Windows\System\zCwKAst.exe
  C:\Windows\System\zCwKAst.exe
  2⤵
  PID:8244
- C:\Windows\System\YGzGHEH.exe
  C:\Windows\System\YGzGHEH.exe
  2⤵
  PID:8280
- C:\Windows\System\voyFPWr.exe
  C:\Windows\System\voyFPWr.exe
  2⤵
  PID:8340
- C:\Windows\System\XcrfzDn.exe
  C:\Windows\System\XcrfzDn.exe
  2⤵
  PID:8348
- C:\Windows\System\YdHlGms.exe
  C:\Windows\System\YdHlGms.exe
  2⤵
  PID:8324
- C:\Windows\System\FsCLExO.exe
  C:\Windows\System\FsCLExO.exe
  2⤵
  PID:8380
- C:\Windows\System\PMGvzkU.exe
  C:\Windows\System\PMGvzkU.exe
  2⤵
  PID:8404
- C:\Windows\System\KsZuADY.exe
  C:\Windows\System\KsZuADY.exe
  2⤵
  PID:8420
- C:\Windows\System\JuqiYKj.exe
  C:\Windows\System\JuqiYKj.exe
  2⤵
  PID:8436
- C:\Windows\System\mJJZpQP.exe
  C:\Windows\System\mJJZpQP.exe
  2⤵
  PID:8452
- C:\Windows\System\YBshmhp.exe
  C:\Windows\System\YBshmhp.exe
  2⤵
  PID:8476
- C:\Windows\System\TOWVFPN.exe
  C:\Windows\System\TOWVFPN.exe
  2⤵
  PID:8504
- C:\Windows\System\hTtLKqj.exe
  C:\Windows\System\hTtLKqj.exe
  2⤵
  PID:8524
- C:\Windows\System\tSeImCS.exe
  C:\Windows\System\tSeImCS.exe
  2⤵
  PID:8588
- C:\Windows\System\WZhRuJb.exe
  C:\Windows\System\WZhRuJb.exe
  2⤵
  PID:8600
- C:\Windows\System\IRvxApg.exe
  C:\Windows\System\IRvxApg.exe
  2⤵
  PID:8540
- C:\Windows\System\kxUTiar.exe
  C:\Windows\System\kxUTiar.exe
  2⤵
  PID:8568
- C:\Windows\System\MKMZITG.exe
  C:\Windows\System\MKMZITG.exe
  2⤵
  PID:8720
- C:\Windows\System\IbApQGW.exe
  C:\Windows\System\IbApQGW.exe
  2⤵
  PID:8672
- C:\Windows\System\uFfcNNG.exe
  C:\Windows\System\uFfcNNG.exe
  2⤵
  PID:8812
- C:\Windows\System\iNIQVyM.exe
  C:\Windows\System\iNIQVyM.exe
  2⤵
  PID:8844
- C:\Windows\System\ITfJyqh.exe
  C:\Windows\System\ITfJyqh.exe
  2⤵
  PID:8880
- C:\Windows\System\ACQUTEZ.exe
  C:\Windows\System\ACQUTEZ.exe
  2⤵
  PID:8940
- C:\Windows\System\anlovgL.exe
  C:\Windows\System\anlovgL.exe
  2⤵
  PID:9004
- C:\Windows\System\IoEgwQW.exe
  C:\Windows\System\IoEgwQW.exe
  2⤵
  PID:2232
- C:\Windows\System\kHdSWcS.exe
  C:\Windows\System\kHdSWcS.exe
  2⤵
  PID:9072
- C:\Windows\System\xKNsIRQ.exe
  C:\Windows\System\xKNsIRQ.exe
  2⤵
  PID:8800
- C:\Windows\System\XpjQaeH.exe
  C:\Windows\System\XpjQaeH.exe
  2⤵
  PID:9108
- C:\Windows\System\AcLWpSJ.exe
  C:\Windows\System\AcLWpSJ.exe
  2⤵
  PID:8832
- C:\Windows\System\CrRnxQZ.exe
  C:\Windows\System\CrRnxQZ.exe
  2⤵
  PID:8896
- C:\Windows\System\ifNVXPN.exe
  C:\Windows\System\ifNVXPN.exe
  2⤵
  PID:8992
- C:\Windows\System\JkTmkUe.exe
  C:\Windows\System\JkTmkUe.exe
  2⤵
  PID:7376
- C:\Windows\System\cicdYgI.exe
  C:\Windows\System\cicdYgI.exe
  2⤵
  PID:9028
- C:\Windows\System\poIgrgz.exe
  C:\Windows\System\poIgrgz.exe
  2⤵
  PID:9092
- C:\Windows\System\lYXpleo.exe
  C:\Windows\System\lYXpleo.exe
  2⤵
  PID:9156
- C:\Windows\System\uDxEBfA.exe
  C:\Windows\System\uDxEBfA.exe
  2⤵
  PID:7912
- C:\Windows\System\HaBHHbK.exe
  C:\Windows\System\HaBHHbK.exe
  2⤵
  PID:8240
- C:\Windows\System\mHiWcGw.exe
  C:\Windows\System\mHiWcGw.exe
  2⤵
  PID:8292
- C:\Windows\System\yxHnyED.exe
  C:\Windows\System\yxHnyED.exe
  2⤵
  PID:8072
- C:\Windows\System\UQoCcos.exe
  C:\Windows\System\UQoCcos.exe
  2⤵
  PID:8312
- C:\Windows\System\QysDfol.exe
  C:\Windows\System\QysDfol.exe
  2⤵
  PID:8260
- C:\Windows\System\SLBYfWv.exe
  C:\Windows\System\SLBYfWv.exe
  2⤵
  PID:8432
- C:\Windows\System\KgKBNDy.exe
  C:\Windows\System\KgKBNDy.exe
  2⤵
  PID:8448
- C:\Windows\System\FxHeatg.exe
  C:\Windows\System\FxHeatg.exe
  2⤵
  PID:8640
- C:\Windows\System\XhAmzDU.exe
  C:\Windows\System\XhAmzDU.exe
  2⤵
  PID:8572
- C:\Windows\System\KJAELqJ.exe
  C:\Windows\System\KJAELqJ.exe
  2⤵
  PID:8752
- C:\Windows\System\nbldynx.exe
  C:\Windows\System\nbldynx.exe
  2⤵
  PID:8688
- C:\Windows\System\UVwkOiR.exe
  C:\Windows\System\UVwkOiR.exe
  2⤵
  PID:8784
- C:\Windows\System\GyNjLpl.exe
  C:\Windows\System\GyNjLpl.exe
  2⤵
  PID:9104
- C:\Windows\System\GayLUZM.exe
  C:\Windows\System\GayLUZM.exe
  2⤵
  PID:8632
- C:\Windows\System\KkNYuOY.exe
  C:\Windows\System\KkNYuOY.exe
  2⤵
  PID:8956
- C:\Windows\System\uaMTHmh.exe
  C:\Windows\System\uaMTHmh.exe
  2⤵
  PID:8704
- C:\Windows\System\vgnSyPt.exe
  C:\Windows\System\vgnSyPt.exe
  2⤵
  PID:8512
- C:\Windows\System\BlyCKYQ.exe
  C:\Windows\System\BlyCKYQ.exe
  2⤵
  PID:8864
- C:\Windows\System\DmxAsoN.exe
  C:\Windows\System\DmxAsoN.exe
  2⤵
  PID:8196
- C:\Windows\System\JRUqyPs.exe
  C:\Windows\System\JRUqyPs.exe
  2⤵
  PID:8500
- C:\Windows\System\viaXWtp.exe
  C:\Windows\System\viaXWtp.exe
  2⤵
  PID:3056
- C:\Windows\System\dgMxdke.exe
  C:\Windows\System\dgMxdke.exe
  2⤵
  PID:8520
- C:\Windows\System\WZVbVRf.exe
  C:\Windows\System\WZVbVRf.exe
  2⤵
  PID:9124
- C:\Windows\System\bhlmYct.exe
  C:\Windows\System\bhlmYct.exe
  2⤵
  PID:8960
- C:\Windows\System\omXEvWa.exe
  C:\Windows\System\omXEvWa.exe
  2⤵
  PID:8296
- C:\Windows\System\DuiOSHw.exe
  C:\Windows\System\DuiOSHw.exe
  2⤵
  PID:8444
- C:\Windows\System\WhgKtjw.exe
  C:\Windows\System\WhgKtjw.exe
  2⤵
  PID:8912
- C:\Windows\System\LEezMTG.exe
  C:\Windows\System\LEezMTG.exe
  2⤵
  PID:8224
- C:\Windows\System\YssTjzX.exe
  C:\Windows\System\YssTjzX.exe
  2⤵
  PID:8764
- C:\Windows\System\iHqxuTC.exe
  C:\Windows\System\iHqxuTC.exe
  2⤵
  PID:9188
- C:\Windows\System\fyPDiEW.exe
  C:\Windows\System\fyPDiEW.exe
  2⤵
  PID:2744
- C:\Windows\System\vitvUWY.exe
  C:\Windows\System\vitvUWY.exe
  2⤵
  PID:8212
- C:\Windows\System\AcDTTeq.exe
  C:\Windows\System\AcDTTeq.exe
  2⤵
  PID:9228
- C:\Windows\System\rXsnmLP.exe
  C:\Windows\System\rXsnmLP.exe
  2⤵
  PID:9244
- C:\Windows\System\TDrZBYE.exe
  C:\Windows\System\TDrZBYE.exe
  2⤵
  PID:9260
- C:\Windows\System\pWDKPNM.exe
  C:\Windows\System\pWDKPNM.exe
  2⤵
  PID:9280
- C:\Windows\System\QePRpGf.exe
  C:\Windows\System\QePRpGf.exe
  2⤵
  PID:9296
- C:\Windows\System\bjyBOfC.exe
  C:\Windows\System\bjyBOfC.exe
  2⤵
  PID:9312
- C:\Windows\System\gruzjyr.exe
  C:\Windows\System\gruzjyr.exe
  2⤵
  PID:9332
- C:\Windows\System\fjUTGnz.exe
  C:\Windows\System\fjUTGnz.exe
  2⤵
  PID:9348
- C:\Windows\System\zpHBkrQ.exe
  C:\Windows\System\zpHBkrQ.exe
  2⤵
  PID:9364
- C:\Windows\System\NgQxSDn.exe
  C:\Windows\System\NgQxSDn.exe
  2⤵
  PID:9388
- C:\Windows\System\YMPKdoM.exe
  C:\Windows\System\YMPKdoM.exe
  2⤵
  PID:9408
- C:\Windows\System\SypVtst.exe
  C:\Windows\System\SypVtst.exe
  2⤵
  PID:9424
- C:\Windows\System\mvSBEhi.exe
  C:\Windows\System\mvSBEhi.exe
  2⤵
  PID:9596
- C:\Windows\System\srTDkTl.exe
  C:\Windows\System\srTDkTl.exe
  2⤵
  PID:9612
- C:\Windows\System\PWHglSq.exe
  C:\Windows\System\PWHglSq.exe
  2⤵
  PID:9628
- C:\Windows\System\xJfrAju.exe
  C:\Windows\System\xJfrAju.exe
  2⤵
  PID:9644
- C:\Windows\System\DyDqSwE.exe
  C:\Windows\System\DyDqSwE.exe
  2⤵
  PID:9660
- C:\Windows\System\oFCLmhO.exe
  C:\Windows\System\oFCLmhO.exe
  2⤵
  PID:9680
- C:\Windows\System\NAEWYAR.exe
  C:\Windows\System\NAEWYAR.exe
  2⤵
  PID:9696
- C:\Windows\System\cMoeXrC.exe
  C:\Windows\System\cMoeXrC.exe
  2⤵
  PID:9712
- C:\Windows\System\sddgUUg.exe
  C:\Windows\System\sddgUUg.exe
  2⤵
  PID:9728
- C:\Windows\System\zpFLLEz.exe
  C:\Windows\System\zpFLLEz.exe
  2⤵
  PID:9744
- C:\Windows\System\UDJTXRR.exe
  C:\Windows\System\UDJTXRR.exe
  2⤵
  PID:9764
- C:\Windows\System\AdzZqOe.exe
  C:\Windows\System\AdzZqOe.exe
  2⤵
  PID:9780
- C:\Windows\System\AZaVADq.exe
  C:\Windows\System\AZaVADq.exe
  2⤵
  PID:9796
- C:\Windows\System\ksDkuAB.exe
  C:\Windows\System\ksDkuAB.exe
  2⤵
  PID:9812
- C:\Windows\System\cMUZncy.exe
  C:\Windows\System\cMUZncy.exe
  2⤵
  PID:9828
- C:\Windows\System\OhrEnJA.exe
  C:\Windows\System\OhrEnJA.exe
  2⤵
  PID:9848
- C:\Windows\System\EJTpncG.exe
  C:\Windows\System\EJTpncG.exe
  2⤵
  PID:9868
- C:\Windows\System\CBVWpMO.exe
  C:\Windows\System\CBVWpMO.exe
  2⤵
  PID:9884
- C:\Windows\System\WhTMyNL.exe
  C:\Windows\System\WhTMyNL.exe
  2⤵
  PID:9900
- C:\Windows\System\TXpYANj.exe
  C:\Windows\System\TXpYANj.exe
  2⤵
  PID:9916
- C:\Windows\System\xIHjivv.exe
  C:\Windows\System\xIHjivv.exe
  2⤵
  PID:9932
- C:\Windows\System\HnIPTTi.exe
  C:\Windows\System\HnIPTTi.exe
  2⤵
  PID:9948
- C:\Windows\System\FJvMfhS.exe
  C:\Windows\System\FJvMfhS.exe
  2⤵
  PID:9964
- C:\Windows\System\PbOeXqh.exe
  C:\Windows\System\PbOeXqh.exe
  2⤵
  PID:9980
- C:\Windows\System\QaSmNrv.exe
  C:\Windows\System\QaSmNrv.exe
  2⤵
  PID:9996
- C:\Windows\System\LgvxWxV.exe
  C:\Windows\System\LgvxWxV.exe
  2⤵
  PID:10016
- C:\Windows\System\CztPwuF.exe
  C:\Windows\System\CztPwuF.exe
  2⤵
  PID:10112
- C:\Windows\System\EyjaTed.exe
  C:\Windows\System\EyjaTed.exe
  2⤵
  PID:10136
- C:\Windows\System\IwXkNSG.exe
  C:\Windows\System\IwXkNSG.exe
  2⤵
  PID:10152
- C:\Windows\System\EDUrqPq.exe
  C:\Windows\System\EDUrqPq.exe
  2⤵
  PID:10172
- C:\Windows\System\SdwLiMJ.exe
  C:\Windows\System\SdwLiMJ.exe
  2⤵
  PID:10188
- C:\Windows\System\XVkSqDl.exe
  C:\Windows\System\XVkSqDl.exe
  2⤵
  PID:10204
- C:\Windows\System\yYfYdFM.exe
  C:\Windows\System\yYfYdFM.exe
  2⤵
  PID:10220
- C:\Windows\System\AxEcXen.exe
  C:\Windows\System\AxEcXen.exe
  2⤵
  PID:10236
- C:\Windows\System\zGGVtar.exe
  C:\Windows\System\zGGVtar.exe
  2⤵
  PID:8472
- C:\Windows\System\CMxHTXQ.exe
  C:\Windows\System\CMxHTXQ.exe
  2⤵
  PID:9256
- C:\Windows\System\uUpqqCr.exe
  C:\Windows\System\uUpqqCr.exe
  2⤵
  PID:7256
- C:\Windows\System\BsdPGVF.exe
  C:\Windows\System\BsdPGVF.exe
  2⤵
  PID:9200
- C:\Windows\System\qRQhlNl.exe
  C:\Windows\System\qRQhlNl.exe
  2⤵
  PID:8796
- C:\Windows\System\ugnXisp.exe
  C:\Windows\System\ugnXisp.exe
  2⤵
  PID:9240
- C:\Windows\System\nyYPgtZ.exe
  C:\Windows\System\nyYPgtZ.exe
  2⤵
  PID:9304
- C:\Windows\System\hpZzPXm.exe
  C:\Windows\System\hpZzPXm.exe
  2⤵
  PID:9372
- C:\Windows\System\wABOpQi.exe
  C:\Windows\System\wABOpQi.exe
  2⤵
  PID:9376
- C:\Windows\System\qSQGHNU.exe
  C:\Windows\System\qSQGHNU.exe
  2⤵
  PID:9384
- C:\Windows\System\sRjjuxb.exe
  C:\Windows\System\sRjjuxb.exe
  2⤵
  PID:9356
- C:\Windows\System\eSOBprn.exe
  C:\Windows\System\eSOBprn.exe
  2⤵
  PID:9400
- C:\Windows\System\kJQyzTH.exe
  C:\Windows\System\kJQyzTH.exe
  2⤵
  PID:9444
- C:\Windows\System\uwUPmYz.exe
  C:\Windows\System\uwUPmYz.exe
  2⤵
  PID:9460
- C:\Windows\System\GnLmGJJ.exe
  C:\Windows\System\GnLmGJJ.exe
  2⤵
  PID:9476
- C:\Windows\System\dduCDUK.exe
  C:\Windows\System\dduCDUK.exe
  2⤵
  PID:9488
- C:\Windows\System\OWBpRfw.exe
  C:\Windows\System\OWBpRfw.exe
  2⤵
  PID:9508
- C:\Windows\System\lNxkBvU.exe
  C:\Windows\System\lNxkBvU.exe
  2⤵
  PID:9520
- C:\Windows\System\itvtsSh.exe
  C:\Windows\System\itvtsSh.exe
  2⤵
  PID:9540
- C:\Windows\System\bDegSLu.exe
  C:\Windows\System\bDegSLu.exe
  2⤵
  PID:9556
- C:\Windows\System\BbCYunf.exe
  C:\Windows\System\BbCYunf.exe
  2⤵
  PID:9572
- C:\Windows\System\OfdOHxd.exe
  C:\Windows\System\OfdOHxd.exe
  2⤵
  PID:9584
- C:\Windows\System\QULtccQ.exe
  C:\Windows\System\QULtccQ.exe
  2⤵
  PID:9652
- C:\Windows\System\eqdPilu.exe
  C:\Windows\System\eqdPilu.exe
  2⤵
  PID:9720
- C:\Windows\System\LHhBOTs.exe
  C:\Windows\System\LHhBOTs.exe
  2⤵
  PID:9756
- C:\Windows\System\hoEBClw.exe
  C:\Windows\System\hoEBClw.exe
  2⤵
  PID:9824
- C:\Windows\System\zBarKEn.exe
  C:\Windows\System\zBarKEn.exe
  2⤵
  PID:9668
- C:\Windows\System\ttCeQAD.exe
  C:\Windows\System\ttCeQAD.exe
  2⤵
  PID:9676
- C:\Windows\System\jYbYSoW.exe
  C:\Windows\System\jYbYSoW.exe
  2⤵
  PID:9864
- C:\Windows\System\PlokzlF.exe
  C:\Windows\System\PlokzlF.exe
  2⤵
  PID:9956
- C:\Windows\System\ApvcSql.exe
  C:\Windows\System\ApvcSql.exe
  2⤵
  PID:9928
- C:\Windows\System\CiEuWuz.exe
  C:\Windows\System\CiEuWuz.exe
  2⤵
  PID:9992
- C:\Windows\System\yHOTquA.exe
  C:\Windows\System\yHOTquA.exe
  2⤵
  PID:9880
- C:\Windows\System\eKFYGqD.exe
  C:\Windows\System\eKFYGqD.exe
  2⤵
  PID:9220
- C:\Windows\System\AmrwkrW.exe
  C:\Windows\System\AmrwkrW.exe
  2⤵
  PID:9320
- C:\Windows\System\LFBIvwA.exe
  C:\Windows\System\LFBIvwA.exe
  2⤵
  PID:9436
- C:\Windows\System\XgiefyR.exe
  C:\Windows\System\XgiefyR.exe
  2⤵
  PID:9416
- C:\Windows\System\gFTTcLw.exe
  C:\Windows\System\gFTTcLw.exe
  2⤵
  PID:9448
- C:\Windows\System\tfrBcba.exe
  C:\Windows\System\tfrBcba.exe
  2⤵
  PID:9532
- C:\Windows\System\blMqbCZ.exe
  C:\Windows\System\blMqbCZ.exe
  2⤵
  PID:9544
- C:\Windows\System\SHlxjvV.exe
  C:\Windows\System\SHlxjvV.exe
  2⤵
  PID:9620
- C:\Windows\System\uWVFUsI.exe
  C:\Windows\System\uWVFUsI.exe
  2⤵
  PID:9692
- C:\Windows\System\nluboYV.exe
  C:\Windows\System\nluboYV.exe
  2⤵
  PID:9608
- C:\Windows\System\RrsdMtb.exe
  C:\Windows\System\RrsdMtb.exe
  2⤵
  PID:9740
- C:\Windows\System\uuhyrAj.exe
  C:\Windows\System\uuhyrAj.exe
  2⤵
  PID:9924
- C:\Windows\System\vhshjyU.exe
  C:\Windows\System\vhshjyU.exe
  2⤵
  PID:10180
- C:\Windows\System\wwMfecQ.exe
  C:\Windows\System\wwMfecQ.exe
  2⤵
  PID:10032
- C:\Windows\System\nWxuPnq.exe
  C:\Windows\System\nWxuPnq.exe
  2⤵
  PID:10036
- C:\Windows\System\rVysUUf.exe
  C:\Windows\System\rVysUUf.exe
  2⤵
  PID:7520
- C:\Windows\System\JUCOqSN.exe
  C:\Windows\System\JUCOqSN.exe
  2⤵
  PID:10200
- C:\Windows\System\ZQpPuPx.exe
  C:\Windows\System\ZQpPuPx.exe
  2⤵
  PID:10168
- C:\Windows\System\vlyvLYO.exe
  C:\Windows\System\vlyvLYO.exe
  2⤵
  PID:9252
- C:\Windows\System\ayZGAZK.exe
  C:\Windows\System\ayZGAZK.exe
  2⤵
  PID:8736
- C:\Windows\System\wlgCTwo.exe
  C:\Windows\System\wlgCTwo.exe
  2⤵
  PID:9288
- C:\Windows\System\clKvaJB.exe
  C:\Windows\System\clKvaJB.exe
  2⤵
  PID:9420
- C:\Windows\System\iGrPYWu.exe
  C:\Windows\System\iGrPYWu.exe
  2⤵
  PID:9484
- C:\Windows\System\AILpjRD.exe
  C:\Windows\System\AILpjRD.exe
  2⤵
  PID:9456
- C:\Windows\System\wsOIaur.exe
  C:\Windows\System\wsOIaur.exe
  2⤵
  PID:9580
- C:\Windows\System\sRNNoaT.exe
  C:\Windows\System\sRNNoaT.exe
  2⤵
  PID:9708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\EuXGzPt.exe

Filesize
1.6MB

MD5
134ce8c7961f6c1c2b3492317e288fd7

SHA1
ef9e3952002e186e46855932445796de8b73180a

SHA256
1464fbc5dae1e57e97d4e9b9a04df74db6ca2f483b71b32a2fa0c0247ad678d3

SHA512
be3ed171f48086308e6cc83938bf3a42b1aa9ce23971da74f72d4efcf6b0e1bae234fab2cf0091503e5dbc150d0d061949edd12b5359e0756f079a33105352c1

Download Submit
C:\Windows\system\FEXRdvV.exe

Filesize
1.6MB

MD5
310c0e5614cb895f2e2a05dec2edd7e8

SHA1
bf2a63709cf4a25daceb9d5b1585874bb7d2e136

SHA256
8ff18ca805e1da0ec084c2689f56e87afa99471ae3137ef9882a8e9b594c463b

SHA512
109ab749cdeac257338977feadc68c6471d99e977366a386fd14f5008bd9492bc0764c49c65617120b9331283f904e7cebd8a375760057b3a3b1c53ff3c47712

Download Submit
C:\Windows\system\GDViBdl.exe

Filesize
1.6MB

MD5
bd0d2dc3d7a0fa810c30bb357134da58

SHA1
c531a945fdb754bb8256a97309247b9bf3af33e3

SHA256
1a323a44cf9cb72850a424273789afdc2b5a2ffa4ce2c7b6f1171feedef12f18

SHA512
2011058f2d1b012e0b0c0beb5af18a5f7eccc8da143b56e9534185c36e1083dab9e81eb67869f568b3512abadbc491071350a5e140d7b07226e578088b6fb2eb

Download Submit
C:\Windows\system\JuNPTTw.exe

Filesize
1.6MB

MD5
f35cbb96e5df2ef5fe3ce0332a5f3f73

SHA1
8ce46a406388c725ee19c2a85dacc0e5f09a34bc

SHA256
117000ee1595fc7ee9c4094eff7a5430c42b82f6f0d344008a6179251bbb0b67

SHA512
b7bb343b557e57372308c6e87fb0e072cd121ad42106b1e8278efee4523ffab472e2ebf63e6c0c5cfd7b3de01f5ca0b8fe61fce818ad5706c2976f16a5b5f34d

Download Submit
C:\Windows\system\NMbTYNY.exe

Filesize
1.6MB

MD5
ac2dea9abe88b8dc1b6c1a9605970b5f

SHA1
bd41d89f4a936c4a9fb358bfa5e8278354ea8971

SHA256
49acfd4e9d312be962b76503f948aae9eefad4878e512e2f2b561ba5f15abe5c

SHA512
66c064c5b98a57e6f6235ba5c3c333d1b7ae503d806efcf2dc743110745a0ae8af0e4c904f146fcc2a00a5ea11c8e4ca5306c252335b3192d174c3847988aaac

Download Submit
C:\Windows\system\OGqmDYC.exe

Filesize
1.6MB

MD5
eee0af01d17ee82c8c2924c8c9de7eb3

SHA1
22206fe4632b18be670a1c59ed7363f877585b8d

SHA256
9d1dc3d1fa9e8dcfd64d9f05d0ec4c6a1c014203acdfd83be1cc2523183087a9

SHA512
50332a4e2bca640a82b9e58386e4b97a83c05d7ea7e8a0ecc38d75a11ddc96eb18ccfa0fc4a2bce1fe889532fb852d4e496e13f494eab70de426e1a10fd11f53

Download Submit
C:\Windows\system\OTnYQrd.exe

Filesize
1.6MB

MD5
8734e94df4068d6cd00fff703dd595db

SHA1
0781f79ac5e22ee9be2f6414bdedb661a4097f6f

SHA256
f1738c81090c0aef8fb29c9c3063429df613f27c2b92e7cf33425d339f32538f

SHA512
e78f78b76d5498b6ed021879e0694c1417dc08a2d48f95ff36be8d84c40e6f10e427a82036331356ba183e026b637a40f4cae4e8bb6bdf8f381f472b385d89b2

Download Submit
C:\Windows\system\RaDMoBl.exe

Filesize
1.6MB

MD5
d0cebfe3950ad49adec475c7e6af69f5

SHA1
d2e5b6cf916720e09d3afb64ccd174efa74ff9af

SHA256
2aff645d6f23d39d7a322acf5b1ef154cea56ddaef14ea6025fc054b17ce6b98

SHA512
b1f4af96bcfe606e40019b20797718e0c283c9c66d872ec19bfc56c36117010d3fc99db34bc5e28defd5081464fb1b9d79ed4f920d48af1f0b16d805ec61bb3f

Download Submit
C:\Windows\system\SkcljgK.exe

Filesize
1.6MB

MD5
ca83cf40a85e31c8b8adf964bfb68932

SHA1
e32f1f35bfb90ffe1a920923bef9243b997ce949

SHA256
439192860c4cc319d81db3df2f0dadbbf6f1137cd3739cd90c8de3bd76e55339

SHA512
39a074a0e2028b8d91063f9488150eaeed186a056847772db37e697446f9cbc74afa269482463da9887d6c1030a769bce48c995bd934072e44765e94618e3f54

Download Submit
C:\Windows\system\SzFlQxw.exe

Filesize
1.6MB

MD5
cb1837177d85fd7d222c3c9355a12933

SHA1
81092a860eeff29db5e8ccee2f77d13ca7f2f198

SHA256
5aeab1aff1ba01db8b5705e0ed7a9973dd67d2dbfe8e5fdafd17f08ab833874d

SHA512
df7338504e02d8f22a04d61a705f473a2539958d84989b40d81905e935e53706ca19da827f3e3ea19d5e994761ad85cb241a55ca6f2a73c56a6bbe4e88a87647

Download Submit
C:\Windows\system\WVLShEF.exe

Filesize
1.6MB

MD5
2790cb2457514ffdf688fa4ff1794a16

SHA1
f0d5d93b1d4986704f245956dd05ef31431b60fc

SHA256
a9882946da7ddaf618c1bef95464f37976c01b50dab47f662d48c3c31296978b

SHA512
eadfd02dbd4445ae5aed67be06901310bf57871e8d1000621b943e965e650bf5f765800829a15a39810cea9b40e60208b9bdf1a1ee526e6934b158469f95eb8e

Download Submit
C:\Windows\system\WWznCGA.exe

Filesize
1.6MB

MD5
9ac70c56883f1d4570dc5f37053164e6

SHA1
53d32a9f1b0c175c34189679d894f8a3251e1f5a

SHA256
77280441cd941fbe0c3c459bb40aa081d3f2bf77519f9641c3b511c8bd27f653

SHA512
a1ab422f5eaff5f845c7215e8a7da3af62cbb983e300615cf9feb7a4ab2984f7f60832fbcb22e12a7d4885500f3e400e78f90a50aed57d87f69b96b1379a80cd

Download Submit
C:\Windows\system\WhSjVmb.exe

Filesize
1.6MB

MD5
004925e4a47b61587ebdad1154e3224f

SHA1
87e696b587a88aef843415e46dfb1c53bcf3d01c

SHA256
bce16ae6a9e33e152154f9e91d58f9b4663e96c8efcf8865653896353d161fb8

SHA512
ffa60a80596aa20d6e007947627653e05f5ca4d94603ec6f3332b41ef5ca0a0f226f8782f7f23be3461aafd1098a95e0e7c7e20475077d9bcbde551b5daf34e1

Download Submit
C:\Windows\system\YPzmOwX.exe

Filesize
1.6MB

MD5
9378612cd76fa9e09cc68832385e3a04

SHA1
9ab3999d0ee067ae807bdfd40b7c0f10e444bcad

SHA256
a0ba8bc239d95c36ca9eb512e13758c65493b7b12384516672f7b54a8beeb6dc

SHA512
3596016a5c793f9fc32c54b06823fc444ecd448d0aba0f9217dbde5c6edd81d8e65673e43b4a8bda97e0172763f19471c6690defedb7c5288f0b51db5997d568

Download Submit
C:\Windows\system\cgHeUGh.exe

Filesize
1.6MB

MD5
e8d55adb410d081848491d3b20f47e00

SHA1
0eb686c6065ab9425de6d912bcd95cfd170d1bfc

SHA256
e9030aa14303f44e432bacf466ed305efa5db911f692579a79c0d10fae1a30c8

SHA512
56c1499f5ebcc89ac480b551494a1a38d624c2e99a55a7cd87f51e319440dd885fbf57e82f73b64b8a46615f0c784c544e8781088c12dff782d0bf304b8750a7

Download Submit
C:\Windows\system\dnypPPi.exe

Filesize
1.6MB

MD5
ae2cdd42f633ef25cded19cf09e17862

SHA1
0d9566b6372754348023b89b66a4f7ab0777da40

SHA256
047dc38143fbb4c2de568adabc55c8fc75c462071e4fb693c87cb1634fa3b251

SHA512
49d1e8fa0e5bd12c3783c29292d210a8c9f92ceb4fc1a237349c4393335a52bf98c00548821608194604714e2edd032da43be75235bc1dbbfa0466d3b60793a3

Download Submit
C:\Windows\system\fHRLjdZ.exe

Filesize
1.6MB

MD5
ed793253c26a898106a587e540e39778

SHA1
a475f0fde1664f0d6819cc7451a2ff84dbe637cd

SHA256
74f519e4d34d8ac9c2cb416395e659f119ce0eee3099fa246f65ce21751d2da3

SHA512
410145dd51a6a6e34bea4f69f20903529608602b2a559b1b0ae4a2bd79092c0a522a26d9078510ea43db09f966c31f5fcc75f461a612f26f4184b67de4d034a3

Download Submit
C:\Windows\system\flCcrjY.exe

Filesize
1.6MB

MD5
c140c94867281c219ed9ebc793744a8d

SHA1
7252187dff57828526ba3448209f565013ecacd4

SHA256
d3ab177aa08ca5ad4da119c23c6260c79ee1bd0c223c3a9f10a5f09ae301dc64

SHA512
b1161706e89158d4972e5bb5a037574c0942eacf543c8f49b276ec191716cce5e619fd760a717b67a6567c159bd2b0bfc069d171dcce20e75a9df4f00658a9e0

Download Submit
C:\Windows\system\isEPiaX.exe

Filesize
1.6MB

MD5
2badf26051cf0dc64231358be635a862

SHA1
9000fee49481a0e21cd978209960bcdb9058f3c7

SHA256
330e2ab20d2c048b07f941924e9a6ff5b126aa3e98ad2f244666c1084240673b

SHA512
d77c1ff54ec288ab2c40f6c2461e9e0c1e3fec1e4160c68ce25ff7d21a16bd1a5adbd5c4f79597ad40024d887ad9f85705fe8bc2b9ca2d93794ac1c780616901

Download Submit
C:\Windows\system\nXcFAEa.exe

Filesize
1.6MB

MD5
d90ae1b2bd672d4985cec266cd8b5cc3

SHA1
969a46aae5ade734587a779be043ca3901f812a3

SHA256
18676c95aad7bfe0959519e7e0d7d681182a22d236b8da54dcfd435dfe63f486

SHA512
dfd84742f96120301073c9b7df7d246c1f2253ca73935b30fccf60a7ed09b0fa1fe6c6b9896b24ad2f2007fc65da801f2ec757cd3587c37d1d599c8f2530732c

Download Submit
C:\Windows\system\oYgYJOx.exe

Filesize
1.6MB

MD5
0cf0b93d2f93329c7769dd38524d5a90

SHA1
c325312478011ce022ef6b5b453aac4e3c70c0af

SHA256
0e21e08bd5aed0e20c7ad15ece92fd1c283656deda87b27e37d647163e8b1161

SHA512
30cf7d24b7f73db430ef54387e87e91fb7895f36f83ebfb936ab9f68b8d320daf9a3d07a66d092f4a986f427135c36d4f5f156a61166b0a0c36936e7171432bb

Download Submit
C:\Windows\system\palUjxg.exe

Filesize
1.6MB

MD5
352c3ee6bf10befa88e0ca22179e094d

SHA1
4446d9fe0192d4be86b7faab463a7bd1afd365c4

SHA256
241fd643d07f59e0ad64fc3cd722b15410a7e11502b7334597db1c81aa103228

SHA512
78effbb5ccf58698be2c66671514fdc2e37520c68cfd48b0f2015e84c94e701887ca94d1bafd19cc4f414d77cba643ade26b091cd7e7c5fdd2e60a3371bb82ff

Download Submit
C:\Windows\system\rcFWEnj.exe

Filesize
1.6MB

MD5
fbcda56e40b62258fe3ba297d4c140bb

SHA1
1b3cf070ad8b8a5148a9e21156ca3220854ebc88

SHA256
29aa41f8ce9eb18a0504e2c33432832ba5596b4fb3ef95655ae2f0223a3576c7

SHA512
222e9be166511d38a9ebd7ee6ddd0e0b97d1e582d80f4887fdb0cdef6fdb4e84f30516ead5ffe0837847d7ca6e21b2c756291489fe031c51b9402519a0ff8976

Download Submit
C:\Windows\system\rzaAdzI.exe

Filesize
1.6MB

MD5
312253554acba43fc40c86193ad44a6e

SHA1
2bc39752acd78ad3f307ae7e28a8cebf45551443

SHA256
e21207f36bc998565cc3c0ff0f31b6f5b051fb8337c962c7e5f55641b5555c5b

SHA512
154f51779726a8a734201f434a5edbfb59f5eb804e1dacb5f13449ca873b3a256261bd1420ccb76dc9d512f79a1c97fdc408bf1d0e23b93664c5f360b9f59105

Download Submit
C:\Windows\system\uqJDSRC.exe

Filesize
1.6MB

MD5
400cf272b79ad11cafc53874fdee12bb

SHA1
1b9ea01ce57a091f6f848b07a8c2590057edd513

SHA256
79cb58be5c79000e16d788e838d7c80a8859b91319b31f1ae7ec5d6c39df51fb

SHA512
6ab9c22992483a25a0e402727819ea93256379f372a180797722ba12521141e03041c2949089d2f455b38f957d7627efa3606fefb87172bfcb8e3cde3cb1f111

Download Submit
C:\Windows\system\xzuqOJa.exe

Filesize
1.6MB

MD5
9fc90a3d874cb5160becbaafdf4d3004

SHA1
ac715bcc9fa032085fc52885e99a4a06f2460b59

SHA256
4ecf327f7508f90b0e95c74ac73ba9004cf87fe6ed2839c2bf049af107f4ae1a

SHA512
b7e284073584a2338f52c4ccb4496e7ec1602866704660abcd584200b092c2716aa2114f9cb4a075f20ca3d0dbe2463656f27127c23fa4a94981be78593181fe

Download Submit
C:\Windows\system\yICTDIo.exe

Filesize
1.6MB

MD5
cb6832a47983223565ead17e52afadaf

SHA1
4612b5fd8660889b9c77a25e40b1a4c6e9280c6f

SHA256
312da10d5faf6077df2b1b18db918ddd1e9a01db74e60db0ac882eb3e82e0709

SHA512
e7fb76be3c6f20bf8ede9d23c3f5de233017d0ad04d63ca3909e8a063bbfb2b5137fc316a00717d0cd3b7fea23b087016fcd2e5233155afa5dd1ae2e74f4b1e2

Download Submit
C:\Windows\system\yUuAJQE.exe

Filesize
1.6MB

MD5
cc80b319e8309f6752a3a3ef1791ff00

SHA1
1b896c463233daff8ffe9b456c6662097bec4bcc

SHA256
34ed06d3b7e5b80829b96a4e16a48b33621edcb00e2a4033c027868f147dbcd6

SHA512
82ae46349c903e9f323bff1a4ac7e3953e2be259312e5ad5ee51563bd3c0b47f7e5f49ec4ade8175a1e07fb138b00b4edee8e65d399b459afb5bdb64f349817a

Download Submit
\Windows\system\LAiDOFA.exe

Filesize
1.6MB

MD5
b8af1b47df932bbb92fb7eec541c228c

SHA1
3530c06c299848c89bbf1f14fac8df95433bbca1

SHA256
4025ef8de3d03632ec5a07bc594c0015d05c761eac5c9c043b8698ef62c5c094

SHA512
651bae8f9ff71c89141360335259573e1006ad14c278bde329bd7349fb180826d2563216a5b06c401779362a3d896f9c42e091bb6cb835c3b8ec30f2e10bd1b3

Download Submit
\Windows\system\VytqERh.exe

Filesize
1.6MB

MD5
eb7ea2cd317847429fab0f67fe9edd63

SHA1
56071967a43d6005b8358ba714faf2df96944f92

SHA256
dbd46335ae61b8d24d0cb647b75831e86866182adf15b925ae95c9fb0928ae79

SHA512
60316b95f5139767c80d75b808866c73fa2e0b7a79a0c679702f2ae2e9611637764bdacd02341dcd599f1490f0101ba49119023edc4b47857fb03220dcbabb39

Download Submit
\Windows\system\lJWLvpK.exe

Filesize
1.6MB

MD5
5e043c1775f1c03a2fc577950cbde956

SHA1
3b4863579bbb1601cb3b8f9d0f996658b2d98819

SHA256
9573120946cc1e77d5b6b984ee6317643738635fca9571526a3ab2d03f14e7ab

SHA512
b3f2037658926e3a342c4eb57d8d2c1a85ad4ce6f2327568afec3786d63c3f52f40e8e6efda71e8861892d190870a12619c96301916ee89a38a54e42eded439f

Download Submit
\Windows\system\ngVqCGE.exe

Filesize
1.6MB

MD5
623658c34571b3963f9c48c9c307f06e

SHA1
140b135750a1ae1016e383e1a260e3c8a8d0d862

SHA256
4a8133c499a6592d486f4ad6f05ac49cdfe9bcf17587bb7f31127a1d56d5e9b1

SHA512
46c528dedc94954d010e81f7bdb1ddba16c246f597bedb64451353431bb10f49dd86f5f5fa1c8536c7eed4d598dee81f99793df4b1e6ae4303321235c551df38

Download Submit
memory/632-1038-0x0000000002790000-0x0000000002798000-memory.dmp

Filesize
32KB

Download
memory/632-165-0x000000001B6B0000-0x000000001B992000-memory.dmp

Filesize
2.9MB

Download
memory/1388-60-0x000000013FF00000-0x00000001402F2000-memory.dmp

Filesize
3.9MB

Download
memory/1388-3920-0x000000013FF00000-0x00000001402F2000-memory.dmp

Filesize
3.9MB

Download
memory/2200-18-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download
memory/2200-3891-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download
memory/2384-23-0x000000013F3D0000-0x000000013F7C2000-memory.dmp

Filesize
3.9MB

Download
memory/2384-3906-0x000000013F3D0000-0x000000013F7C2000-memory.dmp

Filesize
3.9MB

Download
memory/2480-72-0x0000000003480000-0x0000000003872000-memory.dmp

Filesize
3.9MB

Download
memory/2480-70-0x0000000003480000-0x0000000003872000-memory.dmp

Filesize
3.9MB

Download
memory/2480-0-0x000000013F9A0000-0x000000013FD92000-memory.dmp

Filesize
3.9MB

Download
memory/2480-31-0x000000013F460000-0x000000013F852000-memory.dmp

Filesize
3.9MB

Download
memory/2480-8289-0x0000000003480000-0x0000000003872000-memory.dmp

Filesize
3.9MB

Download
memory/2480-37-0x0000000003060000-0x0000000003452000-memory.dmp

Filesize
3.9MB

Download
memory/2480-77-0x0000000003480000-0x0000000003872000-memory.dmp

Filesize
3.9MB

Download
memory/2480-74-0x0000000003480000-0x0000000003872000-memory.dmp

Filesize
3.9MB

Download
memory/2480-75-0x0000000003480000-0x0000000003872000-memory.dmp

Filesize
3.9MB

Download
memory/2480-5034-0x000000013F9A0000-0x000000013FD92000-memory.dmp

Filesize
3.9MB

Download
memory/2480-8391-0x0000000003480000-0x0000000003872000-memory.dmp

Filesize
3.9MB

Download
memory/2480-69-0x0000000003480000-0x0000000003872000-memory.dmp

Filesize
3.9MB

Download
memory/2480-8153-0x0000000003480000-0x0000000003872000-memory.dmp

Filesize
3.9MB

Download
memory/2480-1-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/2480-58-0x000000013FF00000-0x00000001402F2000-memory.dmp

Filesize
3.9MB

Download
memory/2480-12-0x0000000003060000-0x0000000003452000-memory.dmp

Filesize
3.9MB

Download
memory/2480-41-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2568-88-0x000000013F820000-0x000000013FC12000-memory.dmp

Filesize
3.9MB

Download
memory/2568-5540-0x000000013F820000-0x000000013FC12000-memory.dmp

Filesize
3.9MB

Download
memory/2584-5167-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/2584-86-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/2716-76-0x000000013FD00000-0x00000001400F2000-memory.dmp

Filesize
3.9MB

Download
memory/2716-3921-0x000000013FD00000-0x00000001400F2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-5170-0x000000013FBE0000-0x000000013FFD2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-87-0x000000013FBE0000-0x000000013FFD2000-memory.dmp

Filesize
3.9MB

Download
memory/2748-3917-0x000000013F460000-0x000000013F852000-memory.dmp

Filesize
3.9MB

Download
memory/2748-42-0x000000013F460000-0x000000013F852000-memory.dmp

Filesize
3.9MB

Download
memory/2756-3987-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2756-32-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2836-3927-0x000000013F990000-0x000000013FD82000-memory.dmp

Filesize
3.9MB

Download
memory/2836-71-0x000000013F990000-0x000000013FD82000-memory.dmp

Filesize
3.9MB

Download
memory/3040-3929-0x000000013FC10000-0x0000000140002000-memory.dmp

Filesize
3.9MB

Download
memory/3040-38-0x000000013FC10000-0x0000000140002000-memory.dmp

Filesize
3.9MB

Download