xmrig | 70d7054786b234d0e6f3bc839554b300f6435d912904cd41a236aaa1b8c57524

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 08:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae30d22b09ac7a88b211f8e793eabc80N.exe
Size

1.7MB
MD5

ae30d22b09ac7a88b211f8e793eabc80
SHA1

effe34b0529c5c9b026aea177ff8ce323eea17da
SHA256

70d7054786b234d0e6f3bc839554b300f6435d912904cd41a236aaa1b8c57524
SHA512

336465e4a9eb87e30475c1f7541cb285b75ce52074ee5b2011217e4f91635a29fd71d564b65e7a121bcb1a67d4b071510b39a2bd8ca15936b68af3a2ccbad231
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWY1s38kQu12bPxvyuzaBgJ9pcFt1:Lz071uv4BPMkibTIA5I4TNrpDGK/0

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 23 IoCs

miner

resource	yara_rule
behavioral1/memory/2820-9-0x000000013FCB0000-0x00000001400A2000-memory.dmp	xmrig
behavioral1/memory/1732-142-0x000000013F990000-0x000000013FD82000-memory.dmp	xmrig
behavioral1/memory/2584-140-0x000000013F660000-0x000000013FA52000-memory.dmp	xmrig
behavioral1/memory/2904-138-0x000000013F670000-0x000000013FA62000-memory.dmp	xmrig
behavioral1/memory/2892-136-0x000000013FE30000-0x0000000140222000-memory.dmp	xmrig
behavioral1/memory/2840-134-0x000000013F850000-0x000000013FC42000-memory.dmp	xmrig
behavioral1/memory/2456-132-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	xmrig
behavioral1/memory/2608-130-0x000000013FC10000-0x0000000140002000-memory.dmp	xmrig
behavioral1/memory/2668-128-0x000000013FD30000-0x0000000140122000-memory.dmp	xmrig
behavioral1/memory/2540-126-0x000000013FB70000-0x000000013FF62000-memory.dmp	xmrig
behavioral1/memory/2128-1265-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	xmrig
behavioral1/memory/2608-4775-0x000000013FC10000-0x0000000140002000-memory.dmp	xmrig
behavioral1/memory/2584-5023-0x000000013F660000-0x000000013FA52000-memory.dmp	xmrig
behavioral1/memory/2736-5028-0x000000013F480000-0x000000013F872000-memory.dmp	xmrig
behavioral1/memory/2820-5027-0x000000013FCB0000-0x00000001400A2000-memory.dmp	xmrig
behavioral1/memory/2892-5026-0x000000013FE30000-0x0000000140222000-memory.dmp	xmrig
behavioral1/memory/2456-5025-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	xmrig
behavioral1/memory/2796-5093-0x000000013F050000-0x000000013F442000-memory.dmp	xmrig
behavioral1/memory/2840-5091-0x000000013F850000-0x000000013FC42000-memory.dmp	xmrig
behavioral1/memory/2904-5144-0x000000013F670000-0x000000013FA62000-memory.dmp	xmrig
behavioral1/memory/2540-5162-0x000000013FB70000-0x000000013FF62000-memory.dmp	xmrig
behavioral1/memory/1732-5081-0x000000013F990000-0x000000013FD82000-memory.dmp	xmrig
behavioral1/memory/2668-5032-0x000000013FD30000-0x0000000140122000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2756	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2820	TsSXbBP.exe
2796	cvneRgH.exe
2736	zeyIPVy.exe
2540	mozMYrZ.exe
2668	OxmzKkm.exe
2608	zlOIUMx.exe
2456	Ezogpcq.exe
2840	iIRizdb.exe
2892	CWQwLPy.exe
2904	rxsdVMr.exe
2584	aqSKPOZ.exe
1732	tDYhXIh.exe
1612	RJTTuSC.exe
1584	gFKDVsm.exe
1248	LBkDswF.exe
1320	YSUELfj.exe
484	xuAbeBe.exe
356	pZJpxYR.exe
308	BFvqKPu.exe
2524	TOrqrgl.exe
2976	TjzONDy.exe
1924	jUMVHah.exe
2164	ilRBJpa.exe
1800	xyHBrCz.exe
2020	UCJbLVM.exe
676	wFOQkhO.exe
1768	vVlSQlP.exe
872	LkJXaKp.exe
2496	XEYihov.exe
960	EijgNLM.exe
2056	eBGzKdA.exe
1572	STIRtVC.exe
2984	cYgjpBL.exe
2332	mWtgbAr.exe
1736	mbBetEk.exe
2424	QHkCugl.exe
1672	eYGcnQM.exe
1168	rHZoBfz.exe
2288	NtNmWnn.exe
1344	QpqmDGf.exe
1980	VVnhFgg.exe
2076	oRZqmPV.exe
2112	ivSjujp.exe
2088	QxpgGgX.exe
2392	PShsEyy.exe
2480	EKeDUTH.exe
1648	EdDfyJW.exe
1632	YvUcRTO.exe
1780	vvQgbpg.exe
1400	JsdUdxa.exe
2632	DjopBoK.exe
2292	HsvhRZI.exe
2252	fRWiMvD.exe
1600	nYEZnpd.exe
1712	pRmbrYj.exe
2792	aeaNcMx.exe
2772	cnJjogM.exe
2948	cXgvDIy.exe
1624	qAztYNB.exe
2204	GmDgfWr.exe
1992	AIYNxjL.exe
2616	rKfoxLN.exe
1044	IvzIfCz.exe
1908	ejrAleU.exe

Loads dropped DLL 64 IoCs

pid	Process
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
2128	ae30d22b09ac7a88b211f8e793eabc80N.exe

UPX packed file 58 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2128-0-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	upx
behavioral1/files/0x000c00000001227f-5.dat	upx
behavioral1/memory/2820-9-0x000000013FCB0000-0x00000001400A2000-memory.dmp	upx
behavioral1/files/0x00080000000162d1-18.dat	upx
behavioral1/memory/2736-27-0x000000013F480000-0x000000013F872000-memory.dmp	upx
behavioral1/files/0x001c000000005591-23.dat	upx
behavioral1/files/0x00080000000164b0-33.dat	upx
behavioral1/files/0x0007000000016618-38.dat	upx
behavioral1/files/0x0009000000016b6b-48.dat	upx
behavioral1/files/0x0007000000016d82-52.dat	upx
behavioral1/files/0x0006000000016dbf-67.dat	upx
behavioral1/files/0x0006000000016dd3-77.dat	upx
behavioral1/files/0x0006000000016dda-82.dat	upx
behavioral1/files/0x00060000000170f2-93.dat	upx
behavioral1/files/0x000f000000015f16-97.dat	upx
behavioral1/files/0x0006000000017131-102.dat	upx
behavioral1/files/0x00060000000175d2-112.dat	upx
behavioral1/files/0x0005000000018716-122.dat	upx
behavioral1/memory/1732-142-0x000000013F990000-0x000000013FD82000-memory.dmp	upx
behavioral1/files/0x0005000000018718-148.dat	upx
behavioral1/files/0x0006000000018b7d-157.dat	upx
behavioral1/files/0x0006000000018bb8-166.dat	upx
behavioral1/files/0x0005000000018728-154.dat	upx
behavioral1/files/0x0006000000018bf2-188.dat	upx
behavioral1/files/0x0006000000018be0-184.dat	upx
behavioral1/files/0x0006000000018bc7-180.dat	upx
behavioral1/files/0x0006000000018bbc-170.dat	upx
behavioral1/files/0x0006000000018bc1-175.dat	upx
behavioral1/files/0x0006000000018ba5-164.dat	upx
behavioral1/memory/2584-140-0x000000013F660000-0x000000013FA52000-memory.dmp	upx
behavioral1/memory/2904-138-0x000000013F670000-0x000000013FA62000-memory.dmp	upx
behavioral1/memory/2892-136-0x000000013FE30000-0x0000000140222000-memory.dmp	upx
behavioral1/memory/2840-134-0x000000013F850000-0x000000013FC42000-memory.dmp	upx
behavioral1/memory/2456-132-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	upx
behavioral1/memory/2608-130-0x000000013FC10000-0x0000000140002000-memory.dmp	upx
behavioral1/memory/2668-128-0x000000013FD30000-0x0000000140122000-memory.dmp	upx
behavioral1/memory/2540-126-0x000000013FB70000-0x000000013FF62000-memory.dmp	upx
behavioral1/files/0x00060000000175e4-117.dat	upx
behavioral1/files/0x0006000000017292-107.dat	upx
behavioral1/files/0x0006000000016ddf-87.dat	upx
behavioral1/files/0x0006000000016dc8-72.dat	upx
behavioral1/files/0x0006000000016db1-62.dat	upx
behavioral1/files/0x0006000000016d96-57.dat	upx
behavioral1/files/0x000700000001667f-42.dat	upx
behavioral1/memory/2796-19-0x000000013F050000-0x000000013F442000-memory.dmp	upx
behavioral1/memory/2128-1265-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	upx
behavioral1/memory/2608-4775-0x000000013FC10000-0x0000000140002000-memory.dmp	upx
behavioral1/memory/2584-5023-0x000000013F660000-0x000000013FA52000-memory.dmp	upx
behavioral1/memory/2736-5028-0x000000013F480000-0x000000013F872000-memory.dmp	upx
behavioral1/memory/2820-5027-0x000000013FCB0000-0x00000001400A2000-memory.dmp	upx
behavioral1/memory/2892-5026-0x000000013FE30000-0x0000000140222000-memory.dmp	upx
behavioral1/memory/2456-5025-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	upx
behavioral1/memory/2796-5093-0x000000013F050000-0x000000013F442000-memory.dmp	upx
behavioral1/memory/2840-5091-0x000000013F850000-0x000000013FC42000-memory.dmp	upx
behavioral1/memory/2904-5144-0x000000013F670000-0x000000013FA62000-memory.dmp	upx
behavioral1/memory/2540-5162-0x000000013FB70000-0x000000013FF62000-memory.dmp	upx
behavioral1/memory/1732-5081-0x000000013F990000-0x000000013FD82000-memory.dmp	upx
behavioral1/memory/2668-5032-0x000000013FD30000-0x0000000140122000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\QpojLGC.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\mbMSeYQ.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\fOMiCWk.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\zqgaxSe.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\AjlodWD.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\JHcrseB.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\uYsFhPX.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\wyZCFzy.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\bxUCYGa.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\lHVKwTC.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\VXVpUIc.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\IrSRzOh.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\nWVvgqK.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\bVfNJnJ.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\blbaNIj.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\wpgtneF.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\vYDIWpB.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\GcbHRMS.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\YiXlrUz.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\kkhwzSK.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\KNjGVlt.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\WAwwMJR.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\vwnrHpl.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\tMBgOMj.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\pmRcCCI.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\NkuPrmV.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\WIKDhas.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\lxjmlAF.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\WiejzDa.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\hWzqVcg.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\ERJMfCJ.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\PShsEyy.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\MjVDjeW.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\LqRfdXJ.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\ZDpGPjx.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\RrCpptO.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\JdtQTiC.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\TXepBVr.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\fjOYVhG.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\yMhQtaM.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\eCpaBtv.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\bxjmAjj.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\tlkRSPS.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\QhqQTtU.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\neNIFyW.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\rBkjaQx.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\SLsPEgN.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\aHLzSpy.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\llKOvrr.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\FSyEqcJ.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\zFjToWi.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\MkwXTry.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\cTCxpYp.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\CeDqceM.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\bZtXJOB.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\pUFxqwA.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\OXsZyaF.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\raeizvD.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\IvcnHVd.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\YCfrtGh.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\jNkdYOP.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\nLCSlWK.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\knzxCJh.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe
File created	C:\Windows\System\GRcBpco.exe	ae30d22b09ac7a88b211f8e793eabc80N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2756	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
Token: SeLockMemoryPrivilege	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe
Token: SeDebugPrivilege	2756	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2756	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	31
PID 2128 wrote to memory of 2756	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	31
PID 2128 wrote to memory of 2756	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	31
PID 2128 wrote to memory of 2820	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	32
PID 2128 wrote to memory of 2820	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	32
PID 2128 wrote to memory of 2820	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	32
PID 2128 wrote to memory of 2796	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	33
PID 2128 wrote to memory of 2796	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	33
PID 2128 wrote to memory of 2796	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	33
PID 2128 wrote to memory of 2736	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	34
PID 2128 wrote to memory of 2736	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	34
PID 2128 wrote to memory of 2736	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	34
PID 2128 wrote to memory of 2540	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	35
PID 2128 wrote to memory of 2540	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	35
PID 2128 wrote to memory of 2540	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	35
PID 2128 wrote to memory of 2668	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	36
PID 2128 wrote to memory of 2668	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	36
PID 2128 wrote to memory of 2668	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	36
PID 2128 wrote to memory of 2608	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	37
PID 2128 wrote to memory of 2608	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	37
PID 2128 wrote to memory of 2608	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	37
PID 2128 wrote to memory of 2456	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	38
PID 2128 wrote to memory of 2456	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	38
PID 2128 wrote to memory of 2456	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	38
PID 2128 wrote to memory of 2840	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	39
PID 2128 wrote to memory of 2840	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	39
PID 2128 wrote to memory of 2840	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	39
PID 2128 wrote to memory of 2892	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	40
PID 2128 wrote to memory of 2892	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	40
PID 2128 wrote to memory of 2892	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	40
PID 2128 wrote to memory of 2904	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	41
PID 2128 wrote to memory of 2904	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	41
PID 2128 wrote to memory of 2904	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	41
PID 2128 wrote to memory of 2584	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	42
PID 2128 wrote to memory of 2584	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	42
PID 2128 wrote to memory of 2584	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	42
PID 2128 wrote to memory of 1732	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	43
PID 2128 wrote to memory of 1732	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	43
PID 2128 wrote to memory of 1732	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	43
PID 2128 wrote to memory of 1612	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	44
PID 2128 wrote to memory of 1612	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	44
PID 2128 wrote to memory of 1612	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	44
PID 2128 wrote to memory of 1584	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	45
PID 2128 wrote to memory of 1584	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	45
PID 2128 wrote to memory of 1584	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	45
PID 2128 wrote to memory of 1248	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	46
PID 2128 wrote to memory of 1248	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	46
PID 2128 wrote to memory of 1248	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	46
PID 2128 wrote to memory of 1320	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	47
PID 2128 wrote to memory of 1320	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	47
PID 2128 wrote to memory of 1320	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	47
PID 2128 wrote to memory of 484	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	48
PID 2128 wrote to memory of 484	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	48
PID 2128 wrote to memory of 484	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	48
PID 2128 wrote to memory of 356	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	49
PID 2128 wrote to memory of 356	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	49
PID 2128 wrote to memory of 356	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	49
PID 2128 wrote to memory of 308	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	50
PID 2128 wrote to memory of 308	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	50
PID 2128 wrote to memory of 308	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	50
PID 2128 wrote to memory of 2524	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	51
PID 2128 wrote to memory of 2524	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	51
PID 2128 wrote to memory of 2524	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	51
PID 2128 wrote to memory of 2976	2128	ae30d22b09ac7a88b211f8e793eabc80N.exe	52

C:\Users\Admin\AppData\Local\Temp\ae30d22b09ac7a88b211f8e793eabc80N.exe
"C:\Users\Admin\AppData\Local\Temp\ae30d22b09ac7a88b211f8e793eabc80N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2756
- C:\Windows\System\TsSXbBP.exe
  C:\Windows\System\TsSXbBP.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\cvneRgH.exe
  C:\Windows\System\cvneRgH.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\zeyIPVy.exe
  C:\Windows\System\zeyIPVy.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\mozMYrZ.exe
  C:\Windows\System\mozMYrZ.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\OxmzKkm.exe
  C:\Windows\System\OxmzKkm.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\zlOIUMx.exe
  C:\Windows\System\zlOIUMx.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\Ezogpcq.exe
  C:\Windows\System\Ezogpcq.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\iIRizdb.exe
  C:\Windows\System\iIRizdb.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\CWQwLPy.exe
  C:\Windows\System\CWQwLPy.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\rxsdVMr.exe
  C:\Windows\System\rxsdVMr.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\aqSKPOZ.exe
  C:\Windows\System\aqSKPOZ.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\tDYhXIh.exe
  C:\Windows\System\tDYhXIh.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\RJTTuSC.exe
  C:\Windows\System\RJTTuSC.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\gFKDVsm.exe
  C:\Windows\System\gFKDVsm.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\LBkDswF.exe
  C:\Windows\System\LBkDswF.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\YSUELfj.exe
  C:\Windows\System\YSUELfj.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\xuAbeBe.exe
  C:\Windows\System\xuAbeBe.exe
  2⤵
  - Executes dropped EXE
  PID:484
- C:\Windows\System\pZJpxYR.exe
  C:\Windows\System\pZJpxYR.exe
  2⤵
  - Executes dropped EXE
  PID:356
- C:\Windows\System\BFvqKPu.exe
  C:\Windows\System\BFvqKPu.exe
  2⤵
  - Executes dropped EXE
  PID:308
- C:\Windows\System\TOrqrgl.exe
  C:\Windows\System\TOrqrgl.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\TjzONDy.exe
  C:\Windows\System\TjzONDy.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\jUMVHah.exe
  C:\Windows\System\jUMVHah.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\ilRBJpa.exe
  C:\Windows\System\ilRBJpa.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\xyHBrCz.exe
  C:\Windows\System\xyHBrCz.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\UCJbLVM.exe
  C:\Windows\System\UCJbLVM.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\wFOQkhO.exe
  C:\Windows\System\wFOQkhO.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System\vVlSQlP.exe
  C:\Windows\System\vVlSQlP.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\XEYihov.exe
  C:\Windows\System\XEYihov.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\LkJXaKp.exe
  C:\Windows\System\LkJXaKp.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\EijgNLM.exe
  C:\Windows\System\EijgNLM.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\eBGzKdA.exe
  C:\Windows\System\eBGzKdA.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\STIRtVC.exe
  C:\Windows\System\STIRtVC.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\cYgjpBL.exe
  C:\Windows\System\cYgjpBL.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\mWtgbAr.exe
  C:\Windows\System\mWtgbAr.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\mbBetEk.exe
  C:\Windows\System\mbBetEk.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\QHkCugl.exe
  C:\Windows\System\QHkCugl.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\eYGcnQM.exe
  C:\Windows\System\eYGcnQM.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\rHZoBfz.exe
  C:\Windows\System\rHZoBfz.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\NtNmWnn.exe
  C:\Windows\System\NtNmWnn.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\QpqmDGf.exe
  C:\Windows\System\QpqmDGf.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\VVnhFgg.exe
  C:\Windows\System\VVnhFgg.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\oRZqmPV.exe
  C:\Windows\System\oRZqmPV.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\ivSjujp.exe
  C:\Windows\System\ivSjujp.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\QxpgGgX.exe
  C:\Windows\System\QxpgGgX.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\PShsEyy.exe
  C:\Windows\System\PShsEyy.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\EKeDUTH.exe
  C:\Windows\System\EKeDUTH.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\EdDfyJW.exe
  C:\Windows\System\EdDfyJW.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\YvUcRTO.exe
  C:\Windows\System\YvUcRTO.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\vvQgbpg.exe
  C:\Windows\System\vvQgbpg.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\JsdUdxa.exe
  C:\Windows\System\JsdUdxa.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\DjopBoK.exe
  C:\Windows\System\DjopBoK.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\HsvhRZI.exe
  C:\Windows\System\HsvhRZI.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\fRWiMvD.exe
  C:\Windows\System\fRWiMvD.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\nYEZnpd.exe
  C:\Windows\System\nYEZnpd.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\pRmbrYj.exe
  C:\Windows\System\pRmbrYj.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\aeaNcMx.exe
  C:\Windows\System\aeaNcMx.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\cnJjogM.exe
  C:\Windows\System\cnJjogM.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\cXgvDIy.exe
  C:\Windows\System\cXgvDIy.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\qAztYNB.exe
  C:\Windows\System\qAztYNB.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\GmDgfWr.exe
  C:\Windows\System\GmDgfWr.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\AIYNxjL.exe
  C:\Windows\System\AIYNxjL.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\rKfoxLN.exe
  C:\Windows\System\rKfoxLN.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\IvzIfCz.exe
  C:\Windows\System\IvzIfCz.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\ejrAleU.exe
  C:\Windows\System\ejrAleU.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\XlSWmif.exe
  C:\Windows\System\XlSWmif.exe
  2⤵
  PID:2868
- C:\Windows\System\auXnBPj.exe
  C:\Windows\System\auXnBPj.exe
  2⤵
  PID:2140
- C:\Windows\System\rxLpNSi.exe
  C:\Windows\System\rxLpNSi.exe
  2⤵
  PID:2024
- C:\Windows\System\RfaaKoO.exe
  C:\Windows\System\RfaaKoO.exe
  2⤵
  PID:2908
- C:\Windows\System\vCQsGJh.exe
  C:\Windows\System\vCQsGJh.exe
  2⤵
  PID:1996
- C:\Windows\System\gWQSpDJ.exe
  C:\Windows\System\gWQSpDJ.exe
  2⤵
  PID:1952
- C:\Windows\System\LYhsoZH.exe
  C:\Windows\System\LYhsoZH.exe
  2⤵
  PID:2064
- C:\Windows\System\OLNABvt.exe
  C:\Windows\System\OLNABvt.exe
  2⤵
  PID:1052
- C:\Windows\System\MveIjib.exe
  C:\Windows\System\MveIjib.exe
  2⤵
  PID:788
- C:\Windows\System\RzWXcWc.exe
  C:\Windows\System\RzWXcWc.exe
  2⤵
  PID:1664
- C:\Windows\System\MzKHiOc.exe
  C:\Windows\System\MzKHiOc.exe
  2⤵
  PID:1484
- C:\Windows\System\AvJMvnB.exe
  C:\Windows\System\AvJMvnB.exe
  2⤵
  PID:3060
- C:\Windows\System\jPrmqJH.exe
  C:\Windows\System\jPrmqJH.exe
  2⤵
  PID:2440
- C:\Windows\System\CKriKUO.exe
  C:\Windows\System\CKriKUO.exe
  2⤵
  PID:1812
- C:\Windows\System\yxMydWN.exe
  C:\Windows\System\yxMydWN.exe
  2⤵
  PID:560
- C:\Windows\System\MBZUXba.exe
  C:\Windows\System\MBZUXba.exe
  2⤵
  PID:2464
- C:\Windows\System\gdZdsrH.exe
  C:\Windows\System\gdZdsrH.exe
  2⤵
  PID:3068
- C:\Windows\System\WlPUyCi.exe
  C:\Windows\System\WlPUyCi.exe
  2⤵
  PID:2004
- C:\Windows\System\OLrSmKJ.exe
  C:\Windows\System\OLrSmKJ.exe
  2⤵
  PID:3028
- C:\Windows\System\zeptXsx.exe
  C:\Windows\System\zeptXsx.exe
  2⤵
  PID:2340
- C:\Windows\System\vgGHcCF.exe
  C:\Windows\System\vgGHcCF.exe
  2⤵
  PID:2344
- C:\Windows\System\rkKqUWu.exe
  C:\Windows\System\rkKqUWu.exe
  2⤵
  PID:2636
- C:\Windows\System\AFvlwcx.exe
  C:\Windows\System\AFvlwcx.exe
  2⤵
  PID:948
- C:\Windows\System\ZagBNYz.exe
  C:\Windows\System\ZagBNYz.exe
  2⤵
  PID:580
- C:\Windows\System\KvEHrSX.exe
  C:\Windows\System\KvEHrSX.exe
  2⤵
  PID:2148
- C:\Windows\System\zcNtsgG.exe
  C:\Windows\System\zcNtsgG.exe
  2⤵
  PID:1040
- C:\Windows\System\NMzxYxw.exe
  C:\Windows\System\NMzxYxw.exe
  2⤵
  PID:3020
- C:\Windows\System\hkDlehR.exe
  C:\Windows\System\hkDlehR.exe
  2⤵
  PID:2688
- C:\Windows\System\JjOYOAc.exe
  C:\Windows\System\JjOYOAc.exe
  2⤵
  PID:752
- C:\Windows\System\CjeCDyW.exe
  C:\Windows\System\CjeCDyW.exe
  2⤵
  PID:2972
- C:\Windows\System\crnhukt.exe
  C:\Windows\System\crnhukt.exe
  2⤵
  PID:1792
- C:\Windows\System\NmBiMnN.exe
  C:\Windows\System\NmBiMnN.exe
  2⤵
  PID:2104
- C:\Windows\System\MgsONGD.exe
  C:\Windows\System\MgsONGD.exe
  2⤵
  PID:3036
- C:\Windows\System\lltHOYf.exe
  C:\Windows\System\lltHOYf.exe
  2⤵
  PID:864
- C:\Windows\System\OSSQVuh.exe
  C:\Windows\System\OSSQVuh.exe
  2⤵
  PID:1860
- C:\Windows\System\bKmgdRj.exe
  C:\Windows\System\bKmgdRj.exe
  2⤵
  PID:900
- C:\Windows\System\OPGYrMK.exe
  C:\Windows\System\OPGYrMK.exe
  2⤵
  PID:1332
- C:\Windows\System\UbyewKO.exe
  C:\Windows\System\UbyewKO.exe
  2⤵
  PID:1716
- C:\Windows\System\SKwbTvS.exe
  C:\Windows\System\SKwbTvS.exe
  2⤵
  PID:2276
- C:\Windows\System\BwGRDNN.exe
  C:\Windows\System\BwGRDNN.exe
  2⤵
  PID:1852
- C:\Windows\System\KApaExb.exe
  C:\Windows\System\KApaExb.exe
  2⤵
  PID:2956
- C:\Windows\System\pZwatJZ.exe
  C:\Windows\System\pZwatJZ.exe
  2⤵
  PID:2504
- C:\Windows\System\HKYHJGS.exe
  C:\Windows\System\HKYHJGS.exe
  2⤵
  PID:2588
- C:\Windows\System\xOEVFlN.exe
  C:\Windows\System\xOEVFlN.exe
  2⤵
  PID:2576
- C:\Windows\System\GwBFiPI.exe
  C:\Windows\System\GwBFiPI.exe
  2⤵
  PID:2924
- C:\Windows\System\QkdMYuh.exe
  C:\Windows\System\QkdMYuh.exe
  2⤵
  PID:1532
- C:\Windows\System\goaicMm.exe
  C:\Windows\System\goaicMm.exe
  2⤵
  PID:1172
- C:\Windows\System\AAbbJOE.exe
  C:\Windows\System\AAbbJOE.exe
  2⤵
  PID:688
- C:\Windows\System\CmoRjvE.exe
  C:\Windows\System\CmoRjvE.exe
  2⤵
  PID:592
- C:\Windows\System\YwyPbNh.exe
  C:\Windows\System\YwyPbNh.exe
  2⤵
  PID:856
- C:\Windows\System\BOAKwka.exe
  C:\Windows\System\BOAKwka.exe
  2⤵
  PID:1744
- C:\Windows\System\HjswSGQ.exe
  C:\Windows\System\HjswSGQ.exe
  2⤵
  PID:1760
- C:\Windows\System\yZihgux.exe
  C:\Windows\System\yZihgux.exe
  2⤵
  PID:964
- C:\Windows\System\XvNyNyu.exe
  C:\Windows\System\XvNyNyu.exe
  2⤵
  PID:2920
- C:\Windows\System\jiVFNuA.exe
  C:\Windows\System\jiVFNuA.exe
  2⤵
  PID:808
- C:\Windows\System\XyvysTh.exe
  C:\Windows\System\XyvysTh.exe
  2⤵
  PID:2944
- C:\Windows\System\dNlczHZ.exe
  C:\Windows\System\dNlczHZ.exe
  2⤵
  PID:564
- C:\Windows\System\XgmGral.exe
  C:\Windows\System\XgmGral.exe
  2⤵
  PID:3000
- C:\Windows\System\flPHhBB.exe
  C:\Windows\System\flPHhBB.exe
  2⤵
  PID:1260
- C:\Windows\System\vnzcTSk.exe
  C:\Windows\System\vnzcTSk.exe
  2⤵
  PID:2568
- C:\Windows\System\rDNujqj.exe
  C:\Windows\System\rDNujqj.exe
  2⤵
  PID:2012
- C:\Windows\System\rkrBSXR.exe
  C:\Windows\System\rkrBSXR.exe
  2⤵
  PID:888
- C:\Windows\System\PkOVpyU.exe
  C:\Windows\System\PkOVpyU.exe
  2⤵
  PID:2648
- C:\Windows\System\gUiXBna.exe
  C:\Windows\System\gUiXBna.exe
  2⤵
  PID:2712
- C:\Windows\System\MkwXTry.exe
  C:\Windows\System\MkwXTry.exe
  2⤵
  PID:992
- C:\Windows\System\mtzOOsQ.exe
  C:\Windows\System\mtzOOsQ.exe
  2⤵
  PID:1140
- C:\Windows\System\QYUDZNQ.exe
  C:\Windows\System\QYUDZNQ.exe
  2⤵
  PID:836
- C:\Windows\System\MFqkbqT.exe
  C:\Windows\System\MFqkbqT.exe
  2⤵
  PID:2960
- C:\Windows\System\PzjWSNq.exe
  C:\Windows\System\PzjWSNq.exe
  2⤵
  PID:2428
- C:\Windows\System\RKXUhuc.exe
  C:\Windows\System\RKXUhuc.exe
  2⤵
  PID:1728
- C:\Windows\System\eCgDgLk.exe
  C:\Windows\System\eCgDgLk.exe
  2⤵
  PID:3012
- C:\Windows\System\NfRQnIU.exe
  C:\Windows\System\NfRQnIU.exe
  2⤵
  PID:1772
- C:\Windows\System\PbhLYVc.exe
  C:\Windows\System\PbhLYVc.exe
  2⤵
  PID:2752
- C:\Windows\System\ZYLHfPP.exe
  C:\Windows\System\ZYLHfPP.exe
  2⤵
  PID:1324
- C:\Windows\System\nYhuaoc.exe
  C:\Windows\System\nYhuaoc.exe
  2⤵
  PID:2744
- C:\Windows\System\fSgiRqB.exe
  C:\Windows\System\fSgiRqB.exe
  2⤵
  PID:2732
- C:\Windows\System\YCfrtGh.exe
  C:\Windows\System\YCfrtGh.exe
  2⤵
  PID:1740
- C:\Windows\System\RNKoGJa.exe
  C:\Windows\System\RNKoGJa.exe
  2⤵
  PID:840
- C:\Windows\System\RGiNMoR.exe
  C:\Windows\System\RGiNMoR.exe
  2⤵
  PID:1972
- C:\Windows\System\bchaTkr.exe
  C:\Windows\System\bchaTkr.exe
  2⤵
  PID:3040
- C:\Windows\System\QyoZFxA.exe
  C:\Windows\System\QyoZFxA.exe
  2⤵
  PID:3052
- C:\Windows\System\mBEhubR.exe
  C:\Windows\System\mBEhubR.exe
  2⤵
  PID:1616
- C:\Windows\System\tOrAIyO.exe
  C:\Windows\System\tOrAIyO.exe
  2⤵
  PID:2996
- C:\Windows\System\LIQHBBF.exe
  C:\Windows\System\LIQHBBF.exe
  2⤵
  PID:1724
- C:\Windows\System\pSkVQEe.exe
  C:\Windows\System\pSkVQEe.exe
  2⤵
  PID:2452
- C:\Windows\System\HKhrYnj.exe
  C:\Windows\System\HKhrYnj.exe
  2⤵
  PID:2220
- C:\Windows\System\orsIhkA.exe
  C:\Windows\System\orsIhkA.exe
  2⤵
  PID:3044
- C:\Windows\System\QChqXtw.exe
  C:\Windows\System\QChqXtw.exe
  2⤵
  PID:1048
- C:\Windows\System\ZPsRBLy.exe
  C:\Windows\System\ZPsRBLy.exe
  2⤵
  PID:2436
- C:\Windows\System\gEJqsRf.exe
  C:\Windows\System\gEJqsRf.exe
  2⤵
  PID:1056
- C:\Windows\System\hHIyJwz.exe
  C:\Windows\System\hHIyJwz.exe
  2⤵
  PID:2044
- C:\Windows\System\ZJDPRHf.exe
  C:\Windows\System\ZJDPRHf.exe
  2⤵
  PID:1156
- C:\Windows\System\hOLuBNo.exe
  C:\Windows\System\hOLuBNo.exe
  2⤵
  PID:1100
- C:\Windows\System\tKHEnkv.exe
  C:\Windows\System\tKHEnkv.exe
  2⤵
  PID:3076
- C:\Windows\System\jTRPSjC.exe
  C:\Windows\System\jTRPSjC.exe
  2⤵
  PID:3092
- C:\Windows\System\OVNQAwG.exe
  C:\Windows\System\OVNQAwG.exe
  2⤵
  PID:3120
- C:\Windows\System\RVRHYvm.exe
  C:\Windows\System\RVRHYvm.exe
  2⤵
  PID:3136
- C:\Windows\System\mARCdTK.exe
  C:\Windows\System\mARCdTK.exe
  2⤵
  PID:3152
- C:\Windows\System\lGSLTWP.exe
  C:\Windows\System\lGSLTWP.exe
  2⤵
  PID:3168
- C:\Windows\System\vmGuXLw.exe
  C:\Windows\System\vmGuXLw.exe
  2⤵
  PID:3184
- C:\Windows\System\dTOoErO.exe
  C:\Windows\System\dTOoErO.exe
  2⤵
  PID:3200
- C:\Windows\System\tKscJei.exe
  C:\Windows\System\tKscJei.exe
  2⤵
  PID:3216
- C:\Windows\System\YecMzPV.exe
  C:\Windows\System\YecMzPV.exe
  2⤵
  PID:3232
- C:\Windows\System\yvWtcXy.exe
  C:\Windows\System\yvWtcXy.exe
  2⤵
  PID:3248
- C:\Windows\System\bZtXJOB.exe
  C:\Windows\System\bZtXJOB.exe
  2⤵
  PID:3264
- C:\Windows\System\ZAAEJpH.exe
  C:\Windows\System\ZAAEJpH.exe
  2⤵
  PID:3280
- C:\Windows\System\OtdQBDG.exe
  C:\Windows\System\OtdQBDG.exe
  2⤵
  PID:3296
- C:\Windows\System\GBYhzWT.exe
  C:\Windows\System\GBYhzWT.exe
  2⤵
  PID:3312
- C:\Windows\System\gDJWERX.exe
  C:\Windows\System\gDJWERX.exe
  2⤵
  PID:3412
- C:\Windows\System\VlNHTtn.exe
  C:\Windows\System\VlNHTtn.exe
  2⤵
  PID:3460
- C:\Windows\System\oMnMRqm.exe
  C:\Windows\System\oMnMRqm.exe
  2⤵
  PID:3512
- C:\Windows\System\KNFTiGr.exe
  C:\Windows\System\KNFTiGr.exe
  2⤵
  PID:3528
- C:\Windows\System\KCRhxJx.exe
  C:\Windows\System\KCRhxJx.exe
  2⤵
  PID:3548
- C:\Windows\System\pkzsbfs.exe
  C:\Windows\System\pkzsbfs.exe
  2⤵
  PID:3572
- C:\Windows\System\qgrocBU.exe
  C:\Windows\System\qgrocBU.exe
  2⤵
  PID:3588
- C:\Windows\System\QEteiOU.exe
  C:\Windows\System\QEteiOU.exe
  2⤵
  PID:3612
- C:\Windows\System\cguqgqV.exe
  C:\Windows\System\cguqgqV.exe
  2⤵
  PID:3632
- C:\Windows\System\AkrjqSm.exe
  C:\Windows\System\AkrjqSm.exe
  2⤵
  PID:3648
- C:\Windows\System\MtDtuQd.exe
  C:\Windows\System\MtDtuQd.exe
  2⤵
  PID:3668
- C:\Windows\System\LTDfNAD.exe
  C:\Windows\System\LTDfNAD.exe
  2⤵
  PID:3692
- C:\Windows\System\uBiAVSJ.exe
  C:\Windows\System\uBiAVSJ.exe
  2⤵
  PID:3708
- C:\Windows\System\janGMKB.exe
  C:\Windows\System\janGMKB.exe
  2⤵
  PID:3732
- C:\Windows\System\LeSmqKC.exe
  C:\Windows\System\LeSmqKC.exe
  2⤵
  PID:3748
- C:\Windows\System\VKQUepr.exe
  C:\Windows\System\VKQUepr.exe
  2⤵
  PID:3772
- C:\Windows\System\VbmBpoM.exe
  C:\Windows\System\VbmBpoM.exe
  2⤵
  PID:3788
- C:\Windows\System\csRgGUR.exe
  C:\Windows\System\csRgGUR.exe
  2⤵
  PID:3812
- C:\Windows\System\qXMOdlx.exe
  C:\Windows\System\qXMOdlx.exe
  2⤵
  PID:3828
- C:\Windows\System\FdYsxmq.exe
  C:\Windows\System\FdYsxmq.exe
  2⤵
  PID:3852
- C:\Windows\System\VlkAngO.exe
  C:\Windows\System\VlkAngO.exe
  2⤵
  PID:3868
- C:\Windows\System\ZUzmrgD.exe
  C:\Windows\System\ZUzmrgD.exe
  2⤵
  PID:3884
- C:\Windows\System\RMwbIuL.exe
  C:\Windows\System\RMwbIuL.exe
  2⤵
  PID:3900
- C:\Windows\System\QholKHE.exe
  C:\Windows\System\QholKHE.exe
  2⤵
  PID:3916
- C:\Windows\System\pZYNzKM.exe
  C:\Windows\System\pZYNzKM.exe
  2⤵
  PID:3936
- C:\Windows\System\rvUFser.exe
  C:\Windows\System\rvUFser.exe
  2⤵
  PID:3976
- C:\Windows\System\yLZKspc.exe
  C:\Windows\System\yLZKspc.exe
  2⤵
  PID:3992
- C:\Windows\System\XmBhWTe.exe
  C:\Windows\System\XmBhWTe.exe
  2⤵
  PID:4008
- C:\Windows\System\qlWpVEA.exe
  C:\Windows\System\qlWpVEA.exe
  2⤵
  PID:4024
- C:\Windows\System\Zxljvik.exe
  C:\Windows\System\Zxljvik.exe
  2⤵
  PID:4040
- C:\Windows\System\ChchWUq.exe
  C:\Windows\System\ChchWUq.exe
  2⤵
  PID:4068
- C:\Windows\System\fSpQPaE.exe
  C:\Windows\System\fSpQPaE.exe
  2⤵
  PID:4084
- C:\Windows\System\jEuFGqS.exe
  C:\Windows\System\jEuFGqS.exe
  2⤵
  PID:3004
- C:\Windows\System\YvzlcVp.exe
  C:\Windows\System\YvzlcVp.exe
  2⤵
  PID:828
- C:\Windows\System\iWWiiWd.exe
  C:\Windows\System\iWWiiWd.exe
  2⤵
  PID:3116
- C:\Windows\System\cTCxpYp.exe
  C:\Windows\System\cTCxpYp.exe
  2⤵
  PID:3084
- C:\Windows\System\EVgtdLk.exe
  C:\Windows\System\EVgtdLk.exe
  2⤵
  PID:3144
- C:\Windows\System\ENkegue.exe
  C:\Windows\System\ENkegue.exe
  2⤵
  PID:3176
- C:\Windows\System\DcqXyBw.exe
  C:\Windows\System\DcqXyBw.exe
  2⤵
  PID:3196
- C:\Windows\System\EUYdqCN.exe
  C:\Windows\System\EUYdqCN.exe
  2⤵
  PID:3240
- C:\Windows\System\yzBRsUF.exe
  C:\Windows\System\yzBRsUF.exe
  2⤵
  PID:3260
- C:\Windows\System\hunGyLz.exe
  C:\Windows\System\hunGyLz.exe
  2⤵
  PID:3304
- C:\Windows\System\svaWaEX.exe
  C:\Windows\System\svaWaEX.exe
  2⤵
  PID:2260
- C:\Windows\System\JXiUOja.exe
  C:\Windows\System\JXiUOja.exe
  2⤵
  PID:3320
- C:\Windows\System\FUyPSMA.exe
  C:\Windows\System\FUyPSMA.exe
  2⤵
  PID:3420
- C:\Windows\System\QrYxmRu.exe
  C:\Windows\System\QrYxmRu.exe
  2⤵
  PID:3344
- C:\Windows\System\YOxsCUv.exe
  C:\Windows\System\YOxsCUv.exe
  2⤵
  PID:3436
- C:\Windows\System\oRZwbAA.exe
  C:\Windows\System\oRZwbAA.exe
  2⤵
  PID:3356
- C:\Windows\System\ddvayQK.exe
  C:\Windows\System\ddvayQK.exe
  2⤵
  PID:3372
- C:\Windows\System\RbRRKbF.exe
  C:\Windows\System\RbRRKbF.exe
  2⤵
  PID:3384
- C:\Windows\System\PthbHOX.exe
  C:\Windows\System\PthbHOX.exe
  2⤵
  PID:2244
- C:\Windows\System\uItjkmJ.exe
  C:\Windows\System\uItjkmJ.exe
  2⤵
  PID:3424
- C:\Windows\System\rZTzhol.exe
  C:\Windows\System\rZTzhol.exe
  2⤵
  PID:3468
- C:\Windows\System\WMRnkXO.exe
  C:\Windows\System\WMRnkXO.exe
  2⤵
  PID:3496
- C:\Windows\System\PFSfpZb.exe
  C:\Windows\System\PFSfpZb.exe
  2⤵
  PID:3492
- C:\Windows\System\XVLicgM.exe
  C:\Windows\System\XVLicgM.exe
  2⤵
  PID:3524
- C:\Windows\System\LuOahDv.exe
  C:\Windows\System\LuOahDv.exe
  2⤵
  PID:2384
- C:\Windows\System\kGoUtJl.exe
  C:\Windows\System\kGoUtJl.exe
  2⤵
  PID:3564
- C:\Windows\System\qMRYWjD.exe
  C:\Windows\System\qMRYWjD.exe
  2⤵
  PID:3584
- C:\Windows\System\MTBrdHc.exe
  C:\Windows\System\MTBrdHc.exe
  2⤵
  PID:3608
- C:\Windows\System\pYbWYLc.exe
  C:\Windows\System\pYbWYLc.exe
  2⤵
  PID:3640
- C:\Windows\System\AAafCDu.exe
  C:\Windows\System\AAafCDu.exe
  2⤵
  PID:3664
- C:\Windows\System\IoCqxLi.exe
  C:\Windows\System\IoCqxLi.exe
  2⤵
  PID:3680
- C:\Windows\System\srlrYoN.exe
  C:\Windows\System\srlrYoN.exe
  2⤵
  PID:3724
- C:\Windows\System\dFwVnRk.exe
  C:\Windows\System\dFwVnRk.exe
  2⤵
  PID:2828
- C:\Windows\System\boSGJjw.exe
  C:\Windows\System\boSGJjw.exe
  2⤵
  PID:1976
- C:\Windows\System\obStUkS.exe
  C:\Windows\System\obStUkS.exe
  2⤵
  PID:3804
- C:\Windows\System\ySDUgxk.exe
  C:\Windows\System\ySDUgxk.exe
  2⤵
  PID:3824
- C:\Windows\System\nsgsOEh.exe
  C:\Windows\System\nsgsOEh.exe
  2⤵
  PID:3860
- C:\Windows\System\ZMMuKzG.exe
  C:\Windows\System\ZMMuKzG.exe
  2⤵
  PID:3876
- C:\Windows\System\VOKsMJT.exe
  C:\Windows\System\VOKsMJT.exe
  2⤵
  PID:3908
- C:\Windows\System\pHxfUDw.exe
  C:\Windows\System\pHxfUDw.exe
  2⤵
  PID:3956
- C:\Windows\System\wsKQAdy.exe
  C:\Windows\System\wsKQAdy.exe
  2⤵
  PID:3932
- C:\Windows\System\xTfiKCW.exe
  C:\Windows\System\xTfiKCW.exe
  2⤵
  PID:4020
- C:\Windows\System\LfSNdeh.exe
  C:\Windows\System\LfSNdeh.exe
  2⤵
  PID:4048
- C:\Windows\System\JXAeWEO.exe
  C:\Windows\System\JXAeWEO.exe
  2⤵
  PID:4080
- C:\Windows\System\IQNLtKe.exe
  C:\Windows\System\IQNLtKe.exe
  2⤵
  PID:3024
- C:\Windows\System\vwTbSBH.exe
  C:\Windows\System\vwTbSBH.exe
  2⤵
  PID:1492
- C:\Windows\System\lnlqbSt.exe
  C:\Windows\System\lnlqbSt.exe
  2⤵
  PID:3288
- C:\Windows\System\jXTizEi.exe
  C:\Windows\System\jXTizEi.exe
  2⤵
  PID:3340
- C:\Windows\System\dmyFssy.exe
  C:\Windows\System\dmyFssy.exe
  2⤵
  PID:3392
- C:\Windows\System\mnMaYRc.exe
  C:\Windows\System\mnMaYRc.exe
  2⤵
  PID:2208
- C:\Windows\System\WwKecYV.exe
  C:\Windows\System\WwKecYV.exe
  2⤵
  PID:916
- C:\Windows\System\JnqJSnH.exe
  C:\Windows\System\JnqJSnH.exe
  2⤵
  PID:2168
- C:\Windows\System\rEKUBhl.exe
  C:\Windows\System\rEKUBhl.exe
  2⤵
  PID:3484
- C:\Windows\System\OnjAtZQ.exe
  C:\Windows\System\OnjAtZQ.exe
  2⤵
  PID:1440
- C:\Windows\System\QDoENJn.exe
  C:\Windows\System\QDoENJn.exe
  2⤵
  PID:3596
- C:\Windows\System\UTQhgpF.exe
  C:\Windows\System\UTQhgpF.exe
  2⤵
  PID:3768
- C:\Windows\System\CTiqpeM.exe
  C:\Windows\System\CTiqpeM.exe
  2⤵
  PID:3948
- C:\Windows\System\mPXhpJi.exe
  C:\Windows\System\mPXhpJi.exe
  2⤵
  PID:4016
- C:\Windows\System\nhXriTx.exe
  C:\Windows\System\nhXriTx.exe
  2⤵
  PID:3544
- C:\Windows\System\nxELWnJ.exe
  C:\Windows\System\nxELWnJ.exe
  2⤵
  PID:3684
- C:\Windows\System\mdwekAA.exe
  C:\Windows\System\mdwekAA.exe
  2⤵
  PID:3844
- C:\Windows\System\XrxlIbW.exe
  C:\Windows\System\XrxlIbW.exe
  2⤵
  PID:3928
- C:\Windows\System\jSTKmnC.exe
  C:\Windows\System\jSTKmnC.exe
  2⤵
  PID:2748
- C:\Windows\System\vsccLZU.exe
  C:\Windows\System\vsccLZU.exe
  2⤵
  PID:3108
- C:\Windows\System\lqmIfTf.exe
  C:\Windows\System\lqmIfTf.exe
  2⤵
  PID:3128
- C:\Windows\System\EPCFxSk.exe
  C:\Windows\System\EPCFxSk.exe
  2⤵
  PID:3192
- C:\Windows\System\jLzzDoR.exe
  C:\Windows\System\jLzzDoR.exe
  2⤵
  PID:3628
- C:\Windows\System\gyphbad.exe
  C:\Windows\System\gyphbad.exe
  2⤵
  PID:3332
- C:\Windows\System\hXCMvuY.exe
  C:\Windows\System\hXCMvuY.exe
  2⤵
  PID:3488
- C:\Windows\System\dmNQyvA.exe
  C:\Windows\System\dmNQyvA.exe
  2⤵
  PID:1956
- C:\Windows\System\wzZXkeV.exe
  C:\Windows\System\wzZXkeV.exe
  2⤵
  PID:3988
- C:\Windows\System\CufBuus.exe
  C:\Windows\System\CufBuus.exe
  2⤵
  PID:3716
- C:\Windows\System\WFfJtSJ.exe
  C:\Windows\System\WFfJtSJ.exe
  2⤵
  PID:3784
- C:\Windows\System\CAKRzkz.exe
  C:\Windows\System\CAKRzkz.exe
  2⤵
  PID:3740
- C:\Windows\System\lBWDAsh.exe
  C:\Windows\System\lBWDAsh.exe
  2⤵
  PID:3100
- C:\Windows\System\obakyfX.exe
  C:\Windows\System\obakyfX.exe
  2⤵
  PID:2160
- C:\Windows\System\BUeAqKK.exe
  C:\Windows\System\BUeAqKK.exe
  2⤵
  PID:3660
- C:\Windows\System\zrSFYLr.exe
  C:\Windows\System\zrSFYLr.exe
  2⤵
  PID:3348
- C:\Windows\System\qpxfMHp.exe
  C:\Windows\System\qpxfMHp.exe
  2⤵
  PID:2372
- C:\Windows\System\dblgopp.exe
  C:\Windows\System\dblgopp.exe
  2⤵
  PID:3780
- C:\Windows\System\ShXunVV.exe
  C:\Windows\System\ShXunVV.exe
  2⤵
  PID:2008
- C:\Windows\System\ZqptkWa.exe
  C:\Windows\System\ZqptkWa.exe
  2⤵
  PID:3880
- C:\Windows\System\PpzWcyb.exe
  C:\Windows\System\PpzWcyb.exe
  2⤵
  PID:3764
- C:\Windows\System\xYZLFOF.exe
  C:\Windows\System\xYZLFOF.exe
  2⤵
  PID:4060
- C:\Windows\System\lTUbpqA.exe
  C:\Windows\System\lTUbpqA.exe
  2⤵
  PID:2804
- C:\Windows\System\pnclByf.exe
  C:\Windows\System\pnclByf.exe
  2⤵
  PID:3380
- C:\Windows\System\vdKQgVE.exe
  C:\Windows\System\vdKQgVE.exe
  2⤵
  PID:3848
- C:\Windows\System\sKhxXSN.exe
  C:\Windows\System\sKhxXSN.exe
  2⤵
  PID:4064
- C:\Windows\System\raZVfGG.exe
  C:\Windows\System\raZVfGG.exe
  2⤵
  PID:3704
- C:\Windows\System\zJxUIdU.exe
  C:\Windows\System\zJxUIdU.exe
  2⤵
  PID:2888
- C:\Windows\System\xXEfADZ.exe
  C:\Windows\System\xXEfADZ.exe
  2⤵
  PID:3840
- C:\Windows\System\CmAFDJk.exe
  C:\Windows\System\CmAFDJk.exe
  2⤵
  PID:2120
- C:\Windows\System\XhalThy.exe
  C:\Windows\System\XhalThy.exe
  2⤵
  PID:1748
- C:\Windows\System\ZXpDvLn.exe
  C:\Windows\System\ZXpDvLn.exe
  2⤵
  PID:4100
- C:\Windows\System\EomxCcJ.exe
  C:\Windows\System\EomxCcJ.exe
  2⤵
  PID:4120
- C:\Windows\System\PeQyHhd.exe
  C:\Windows\System\PeQyHhd.exe
  2⤵
  PID:4144
- C:\Windows\System\UYzQekj.exe
  C:\Windows\System\UYzQekj.exe
  2⤵
  PID:4164
- C:\Windows\System\lYmnlaZ.exe
  C:\Windows\System\lYmnlaZ.exe
  2⤵
  PID:4180
- C:\Windows\System\FkileKx.exe
  C:\Windows\System\FkileKx.exe
  2⤵
  PID:4196
- C:\Windows\System\KsFrSeH.exe
  C:\Windows\System\KsFrSeH.exe
  2⤵
  PID:4216
- C:\Windows\System\cpZPFGk.exe
  C:\Windows\System\cpZPFGk.exe
  2⤵
  PID:4232
- C:\Windows\System\rFUxXZM.exe
  C:\Windows\System\rFUxXZM.exe
  2⤵
  PID:4268
- C:\Windows\System\zNVwdzc.exe
  C:\Windows\System\zNVwdzc.exe
  2⤵
  PID:4284
- C:\Windows\System\LtCzBwX.exe
  C:\Windows\System\LtCzBwX.exe
  2⤵
  PID:4300
- C:\Windows\System\zgdXxDy.exe
  C:\Windows\System\zgdXxDy.exe
  2⤵
  PID:4320
- C:\Windows\System\PthQMrq.exe
  C:\Windows\System\PthQMrq.exe
  2⤵
  PID:4336
- C:\Windows\System\SGiwTMx.exe
  C:\Windows\System\SGiwTMx.exe
  2⤵
  PID:4352
- C:\Windows\System\GMYSQhL.exe
  C:\Windows\System\GMYSQhL.exe
  2⤵
  PID:4372
- C:\Windows\System\XsGKchZ.exe
  C:\Windows\System\XsGKchZ.exe
  2⤵
  PID:4388
- C:\Windows\System\sRcmwae.exe
  C:\Windows\System\sRcmwae.exe
  2⤵
  PID:4404
- C:\Windows\System\alLoJou.exe
  C:\Windows\System\alLoJou.exe
  2⤵
  PID:4424
- C:\Windows\System\GafMjQF.exe
  C:\Windows\System\GafMjQF.exe
  2⤵
  PID:4440
- C:\Windows\System\EaaGLSe.exe
  C:\Windows\System\EaaGLSe.exe
  2⤵
  PID:4456
- C:\Windows\System\VzAwNOH.exe
  C:\Windows\System\VzAwNOH.exe
  2⤵
  PID:4476
- C:\Windows\System\mgnJOAd.exe
  C:\Windows\System\mgnJOAd.exe
  2⤵
  PID:4492
- C:\Windows\System\LYTEDTS.exe
  C:\Windows\System\LYTEDTS.exe
  2⤵
  PID:4508
- C:\Windows\System\FVpLeyn.exe
  C:\Windows\System\FVpLeyn.exe
  2⤵
  PID:4524
- C:\Windows\System\CfSWrBS.exe
  C:\Windows\System\CfSWrBS.exe
  2⤵
  PID:4540
- C:\Windows\System\FzgRqLq.exe
  C:\Windows\System\FzgRqLq.exe
  2⤵
  PID:4560
- C:\Windows\System\hbuEZjR.exe
  C:\Windows\System\hbuEZjR.exe
  2⤵
  PID:4576
- C:\Windows\System\KYrPvjO.exe
  C:\Windows\System\KYrPvjO.exe
  2⤵
  PID:4592
- C:\Windows\System\lBHQNJp.exe
  C:\Windows\System\lBHQNJp.exe
  2⤵
  PID:4608
- C:\Windows\System\UWXMLhg.exe
  C:\Windows\System\UWXMLhg.exe
  2⤵
  PID:4632
- C:\Windows\System\xlfymyV.exe
  C:\Windows\System\xlfymyV.exe
  2⤵
  PID:4740
- C:\Windows\System\XbcHBLQ.exe
  C:\Windows\System\XbcHBLQ.exe
  2⤵
  PID:4764
- C:\Windows\System\TFxbSTO.exe
  C:\Windows\System\TFxbSTO.exe
  2⤵
  PID:4796
- C:\Windows\System\PwRLoTL.exe
  C:\Windows\System\PwRLoTL.exe
  2⤵
  PID:4812
- C:\Windows\System\EVnQepO.exe
  C:\Windows\System\EVnQepO.exe
  2⤵
  PID:4828
- C:\Windows\System\qRwtEzz.exe
  C:\Windows\System\qRwtEzz.exe
  2⤵
  PID:4844
- C:\Windows\System\lgKcVHz.exe
  C:\Windows\System\lgKcVHz.exe
  2⤵
  PID:4876
- C:\Windows\System\UzaPuDU.exe
  C:\Windows\System\UzaPuDU.exe
  2⤵
  PID:4900
- C:\Windows\System\vqByNqm.exe
  C:\Windows\System\vqByNqm.exe
  2⤵
  PID:4924
- C:\Windows\System\zvuqQgf.exe
  C:\Windows\System\zvuqQgf.exe
  2⤵
  PID:4944
- C:\Windows\System\VKlshLs.exe
  C:\Windows\System\VKlshLs.exe
  2⤵
  PID:4968
- C:\Windows\System\TZPIvhy.exe
  C:\Windows\System\TZPIvhy.exe
  2⤵
  PID:4984
- C:\Windows\System\ALbRMLv.exe
  C:\Windows\System\ALbRMLv.exe
  2⤵
  PID:5008
- C:\Windows\System\cbYnyaP.exe
  C:\Windows\System\cbYnyaP.exe
  2⤵
  PID:5024
- C:\Windows\System\VQGfzUy.exe
  C:\Windows\System\VQGfzUy.exe
  2⤵
  PID:5040
- C:\Windows\System\GxHDihS.exe
  C:\Windows\System\GxHDihS.exe
  2⤵
  PID:5060
- C:\Windows\System\rIVcGiA.exe
  C:\Windows\System\rIVcGiA.exe
  2⤵
  PID:5080
- C:\Windows\System\WtogUIk.exe
  C:\Windows\System\WtogUIk.exe
  2⤵
  PID:5104
- C:\Windows\System\wjQyuGd.exe
  C:\Windows\System\wjQyuGd.exe
  2⤵
  PID:2684
- C:\Windows\System\uxCOLcZ.exe
  C:\Windows\System\uxCOLcZ.exe
  2⤵
  PID:4140
- C:\Windows\System\eLanXrW.exe
  C:\Windows\System\eLanXrW.exe
  2⤵
  PID:4188
- C:\Windows\System\eEjkJgu.exe
  C:\Windows\System\eEjkJgu.exe
  2⤵
  PID:4132
- C:\Windows\System\qIiUwFu.exe
  C:\Windows\System\qIiUwFu.exe
  2⤵
  PID:4280
- C:\Windows\System\zIiNTlD.exe
  C:\Windows\System\zIiNTlD.exe
  2⤵
  PID:4208
- C:\Windows\System\ifJIbxD.exe
  C:\Windows\System\ifJIbxD.exe
  2⤵
  PID:4244
- C:\Windows\System\gceanba.exe
  C:\Windows\System\gceanba.exe
  2⤵
  PID:4292
- C:\Windows\System\qXfwiPe.exe
  C:\Windows\System\qXfwiPe.exe
  2⤵
  PID:4400
- C:\Windows\System\aNlHfPD.exe
  C:\Windows\System\aNlHfPD.exe
  2⤵
  PID:4452
- C:\Windows\System\tdeYFoh.exe
  C:\Windows\System\tdeYFoh.exe
  2⤵
  PID:4556
- C:\Windows\System\GqEZuKq.exe
  C:\Windows\System\GqEZuKq.exe
  2⤵
  PID:4296
- C:\Windows\System\SWALpNy.exe
  C:\Windows\System\SWALpNy.exe
  2⤵
  PID:4308
- C:\Windows\System\wxllcrT.exe
  C:\Windows\System\wxllcrT.exe
  2⤵
  PID:4516
- C:\Windows\System\WKnlCNJ.exe
  C:\Windows\System\WKnlCNJ.exe
  2⤵
  PID:4628
- C:\Windows\System\iozrszn.exe
  C:\Windows\System\iozrszn.exe
  2⤵
  PID:4648
- C:\Windows\System\xTThBFi.exe
  C:\Windows\System\xTThBFi.exe
  2⤵
  PID:4656
- C:\Windows\System\rPWVkTF.exe
  C:\Windows\System\rPWVkTF.exe
  2⤵
  PID:4696
- C:\Windows\System\KopbhXO.exe
  C:\Windows\System\KopbhXO.exe
  2⤵
  PID:4720
- C:\Windows\System\SSiNuRj.exe
  C:\Windows\System\SSiNuRj.exe
  2⤵
  PID:4712
- C:\Windows\System\AruQYpO.exe
  C:\Windows\System\AruQYpO.exe
  2⤵
  PID:4752
- C:\Windows\System\zmoEjtY.exe
  C:\Windows\System\zmoEjtY.exe
  2⤵
  PID:4820
- C:\Windows\System\sxaSJlv.exe
  C:\Windows\System\sxaSJlv.exe
  2⤵
  PID:4788
- C:\Windows\System\mUPcrgc.exe
  C:\Windows\System\mUPcrgc.exe
  2⤵
  PID:4868
- C:\Windows\System\sNoxgtJ.exe
  C:\Windows\System\sNoxgtJ.exe
  2⤵
  PID:4884
- C:\Windows\System\UAbyvPf.exe
  C:\Windows\System\UAbyvPf.exe
  2⤵
  PID:4908
- C:\Windows\System\iAVHoxG.exe
  C:\Windows\System\iAVHoxG.exe
  2⤵
  PID:4932
- C:\Windows\System\grzoHia.exe
  C:\Windows\System\grzoHia.exe
  2⤵
  PID:4964
- C:\Windows\System\ewcSlcB.exe
  C:\Windows\System\ewcSlcB.exe
  2⤵
  PID:4992
- C:\Windows\System\urMCsmR.exe
  C:\Windows\System\urMCsmR.exe
  2⤵
  PID:5016
- C:\Windows\System\KULHbZW.exe
  C:\Windows\System\KULHbZW.exe
  2⤵
  PID:5096
- C:\Windows\System\WncneZx.exe
  C:\Windows\System\WncneZx.exe
  2⤵
  PID:5116
- C:\Windows\System\ljoxnYX.exe
  C:\Windows\System\ljoxnYX.exe
  2⤵
  PID:4348
- C:\Windows\System\Kqxikwl.exe
  C:\Windows\System\Kqxikwl.exe
  2⤵
  PID:4256
- C:\Windows\System\NHOhuzo.exe
  C:\Windows\System\NHOhuzo.exe
  2⤵
  PID:4260
- C:\Windows\System\eVJMjPY.exe
  C:\Windows\System\eVJMjPY.exe
  2⤵
  PID:4464
- C:\Windows\System\AVbllnx.exe
  C:\Windows\System\AVbllnx.exe
  2⤵
  PID:4536
- C:\Windows\System\HlpjaDl.exe
  C:\Windows\System\HlpjaDl.exe
  2⤵
  PID:4472
- C:\Windows\System\XxJUBov.exe
  C:\Windows\System\XxJUBov.exe
  2⤵
  PID:4584
- C:\Windows\System\kkGiaQV.exe
  C:\Windows\System\kkGiaQV.exe
  2⤵
  PID:4588
- C:\Windows\System\tzEZfvq.exe
  C:\Windows\System\tzEZfvq.exe
  2⤵
  PID:4672
- C:\Windows\System\eWbkPqO.exe
  C:\Windows\System\eWbkPqO.exe
  2⤵
  PID:4704
- C:\Windows\System\rNRiwxM.exe
  C:\Windows\System\rNRiwxM.exe
  2⤵
  PID:4732
- C:\Windows\System\gSLKmnN.exe
  C:\Windows\System\gSLKmnN.exe
  2⤵
  PID:4804
- C:\Windows\System\xlQDYNb.exe
  C:\Windows\System\xlQDYNb.exe
  2⤵
  PID:4872
- C:\Windows\System\qlNTWkU.exe
  C:\Windows\System\qlNTWkU.exe
  2⤵
  PID:4980
- C:\Windows\System\CBFyLMz.exe
  C:\Windows\System\CBFyLMz.exe
  2⤵
  PID:4960
- C:\Windows\System\RbaaOnf.exe
  C:\Windows\System\RbaaOnf.exe
  2⤵
  PID:4996
- C:\Windows\System\yLZLIwX.exe
  C:\Windows\System\yLZLIwX.exe
  2⤵
  PID:5048
- C:\Windows\System\Zpnyiie.exe
  C:\Windows\System\Zpnyiie.exe
  2⤵
  PID:5088
- C:\Windows\System\qfhqXYN.exe
  C:\Windows\System\qfhqXYN.exe
  2⤵
  PID:4112
- C:\Windows\System\xIzyehI.exe
  C:\Windows\System\xIzyehI.exe
  2⤵
  PID:4204
- C:\Windows\System\ikzfLQB.exe
  C:\Windows\System\ikzfLQB.exe
  2⤵
  PID:4264
- C:\Windows\System\OlONUVq.exe
  C:\Windows\System\OlONUVq.exe
  2⤵
  PID:4364
- C:\Windows\System\QJoMYwF.exe
  C:\Windows\System\QJoMYwF.exe
  2⤵
  PID:4332
- C:\Windows\System\NADrDSq.exe
  C:\Windows\System\NADrDSq.exe
  2⤵
  PID:4484
- C:\Windows\System\jnAVIQV.exe
  C:\Windows\System\jnAVIQV.exe
  2⤵
  PID:4624
- C:\Windows\System\JoxGbam.exe
  C:\Windows\System\JoxGbam.exe
  2⤵
  PID:4668
- C:\Windows\System\LiYEtki.exe
  C:\Windows\System\LiYEtki.exe
  2⤵
  PID:4760
- C:\Windows\System\FpAKghv.exe
  C:\Windows\System\FpAKghv.exe
  2⤵
  PID:4864
- C:\Windows\System\QzwIBNh.exe
  C:\Windows\System\QzwIBNh.exe
  2⤵
  PID:5056
- C:\Windows\System\MAmfaJM.exe
  C:\Windows\System\MAmfaJM.exe
  2⤵
  PID:4572
- C:\Windows\System\DBJWDqs.exe
  C:\Windows\System\DBJWDqs.exe
  2⤵
  PID:4616
- C:\Windows\System\EBXbtdd.exe
  C:\Windows\System\EBXbtdd.exe
  2⤵
  PID:5052
- C:\Windows\System\YXGAeQB.exe
  C:\Windows\System\YXGAeQB.exe
  2⤵
  PID:4936
- C:\Windows\System\ZYRkyXu.exe
  C:\Windows\System\ZYRkyXu.exe
  2⤵
  PID:4784
- C:\Windows\System\gpBuxhK.exe
  C:\Windows\System\gpBuxhK.exe
  2⤵
  PID:4136
- C:\Windows\System\hUeKrCk.exe
  C:\Windows\System\hUeKrCk.exe
  2⤵
  PID:4952
- C:\Windows\System\TPpmDgj.exe
  C:\Windows\System\TPpmDgj.exe
  2⤵
  PID:4228
- C:\Windows\System\JIbacpD.exe
  C:\Windows\System\JIbacpD.exe
  2⤵
  PID:4316
- C:\Windows\System\ivArhyi.exe
  C:\Windows\System\ivArhyi.exe
  2⤵
  PID:5124
- C:\Windows\System\XCpfQNI.exe
  C:\Windows\System\XCpfQNI.exe
  2⤵
  PID:5144
- C:\Windows\System\qOKgvNj.exe
  C:\Windows\System\qOKgvNj.exe
  2⤵
  PID:5160
- C:\Windows\System\AIYqjYE.exe
  C:\Windows\System\AIYqjYE.exe
  2⤵
  PID:5176
- C:\Windows\System\HKUldKY.exe
  C:\Windows\System\HKUldKY.exe
  2⤵
  PID:5192
- C:\Windows\System\HWiCZRM.exe
  C:\Windows\System\HWiCZRM.exe
  2⤵
  PID:5212
- C:\Windows\System\GRcBpco.exe
  C:\Windows\System\GRcBpco.exe
  2⤵
  PID:5228
- C:\Windows\System\IpzyKgc.exe
  C:\Windows\System\IpzyKgc.exe
  2⤵
  PID:5244
- C:\Windows\System\ImpmlTY.exe
  C:\Windows\System\ImpmlTY.exe
  2⤵
  PID:5296
- C:\Windows\System\SNZIngQ.exe
  C:\Windows\System\SNZIngQ.exe
  2⤵
  PID:5312
- C:\Windows\System\MjVDjeW.exe
  C:\Windows\System\MjVDjeW.exe
  2⤵
  PID:5328
- C:\Windows\System\lHiyypH.exe
  C:\Windows\System\lHiyypH.exe
  2⤵
  PID:5344
- C:\Windows\System\aHLzSpy.exe
  C:\Windows\System\aHLzSpy.exe
  2⤵
  PID:5360
- C:\Windows\System\rBkjaQx.exe
  C:\Windows\System\rBkjaQx.exe
  2⤵
  PID:5376
- C:\Windows\System\HcVINgW.exe
  C:\Windows\System\HcVINgW.exe
  2⤵
  PID:5392
- C:\Windows\System\WknvSEq.exe
  C:\Windows\System\WknvSEq.exe
  2⤵
  PID:5408
- C:\Windows\System\dvPDgCN.exe
  C:\Windows\System\dvPDgCN.exe
  2⤵
  PID:5424
- C:\Windows\System\oNbRAjO.exe
  C:\Windows\System\oNbRAjO.exe
  2⤵
  PID:5440
- C:\Windows\System\UmfmesP.exe
  C:\Windows\System\UmfmesP.exe
  2⤵
  PID:5456
- C:\Windows\System\PHdxRlz.exe
  C:\Windows\System\PHdxRlz.exe
  2⤵
  PID:5472
- C:\Windows\System\hextmGM.exe
  C:\Windows\System\hextmGM.exe
  2⤵
  PID:5488
- C:\Windows\System\RjOdRXd.exe
  C:\Windows\System\RjOdRXd.exe
  2⤵
  PID:5504
- C:\Windows\System\ZxpuBlo.exe
  C:\Windows\System\ZxpuBlo.exe
  2⤵
  PID:5520
- C:\Windows\System\WrYvnNo.exe
  C:\Windows\System\WrYvnNo.exe
  2⤵
  PID:5536
- C:\Windows\System\oRapmbe.exe
  C:\Windows\System\oRapmbe.exe
  2⤵
  PID:5552
- C:\Windows\System\yQowudk.exe
  C:\Windows\System\yQowudk.exe
  2⤵
  PID:5572
- C:\Windows\System\oBbiexG.exe
  C:\Windows\System\oBbiexG.exe
  2⤵
  PID:5588
- C:\Windows\System\AIvqQmV.exe
  C:\Windows\System\AIvqQmV.exe
  2⤵
  PID:5604
- C:\Windows\System\OuVFXLS.exe
  C:\Windows\System\OuVFXLS.exe
  2⤵
  PID:5716
- C:\Windows\System\uNIjMhD.exe
  C:\Windows\System\uNIjMhD.exe
  2⤵
  PID:5732
- C:\Windows\System\LevATEP.exe
  C:\Windows\System\LevATEP.exe
  2⤵
  PID:5748
- C:\Windows\System\NhVAZbI.exe
  C:\Windows\System\NhVAZbI.exe
  2⤵
  PID:5768
- C:\Windows\System\vPqlUod.exe
  C:\Windows\System\vPqlUod.exe
  2⤵
  PID:5788
- C:\Windows\System\klIrgBv.exe
  C:\Windows\System\klIrgBv.exe
  2⤵
  PID:5804
- C:\Windows\System\ayvSPrk.exe
  C:\Windows\System\ayvSPrk.exe
  2⤵
  PID:5824
- C:\Windows\System\UCuliIr.exe
  C:\Windows\System\UCuliIr.exe
  2⤵
  PID:5840
- C:\Windows\System\uZeHGvs.exe
  C:\Windows\System\uZeHGvs.exe
  2⤵
  PID:5856
- C:\Windows\System\VcsFuZm.exe
  C:\Windows\System\VcsFuZm.exe
  2⤵
  PID:5872
- C:\Windows\System\ybkUlwR.exe
  C:\Windows\System\ybkUlwR.exe
  2⤵
  PID:5892
- C:\Windows\System\QSYGIGz.exe
  C:\Windows\System\QSYGIGz.exe
  2⤵
  PID:5908
- C:\Windows\System\GAfsErX.exe
  C:\Windows\System\GAfsErX.exe
  2⤵
  PID:5924
- C:\Windows\System\bWhFATe.exe
  C:\Windows\System\bWhFATe.exe
  2⤵
  PID:5940
- C:\Windows\System\MxNsGfW.exe
  C:\Windows\System\MxNsGfW.exe
  2⤵
  PID:5956
- C:\Windows\System\WDsKUmH.exe
  C:\Windows\System\WDsKUmH.exe
  2⤵
  PID:5972
- C:\Windows\System\MsAsDcn.exe
  C:\Windows\System\MsAsDcn.exe
  2⤵
  PID:5996
- C:\Windows\System\rLpBRRf.exe
  C:\Windows\System\rLpBRRf.exe
  2⤵
  PID:6012
- C:\Windows\System\IyrxQFf.exe
  C:\Windows\System\IyrxQFf.exe
  2⤵
  PID:6052
- C:\Windows\System\thBnlkU.exe
  C:\Windows\System\thBnlkU.exe
  2⤵
  PID:6068
- C:\Windows\System\gNnzQcS.exe
  C:\Windows\System\gNnzQcS.exe
  2⤵
  PID:6084
- C:\Windows\System\UgmLxhR.exe
  C:\Windows\System\UgmLxhR.exe
  2⤵
  PID:6100
- C:\Windows\System\InsCEog.exe
  C:\Windows\System\InsCEog.exe
  2⤵
  PID:6116
- C:\Windows\System\ObfVoxq.exe
  C:\Windows\System\ObfVoxq.exe
  2⤵
  PID:6132
- C:\Windows\System\LGfmUZk.exe
  C:\Windows\System\LGfmUZk.exe
  2⤵
  PID:4436
- C:\Windows\System\UHwGTFw.exe
  C:\Windows\System\UHwGTFw.exe
  2⤵
  PID:4748
- C:\Windows\System\zbIMyGk.exe
  C:\Windows\System\zbIMyGk.exe
  2⤵
  PID:4156
- C:\Windows\System\rlXWdCJ.exe
  C:\Windows\System\rlXWdCJ.exe
  2⤵
  PID:5152
- C:\Windows\System\bRQABZJ.exe
  C:\Windows\System\bRQABZJ.exe
  2⤵
  PID:5264
- C:\Windows\System\SzgmBbe.exe
  C:\Windows\System\SzgmBbe.exe
  2⤵
  PID:5272
- C:\Windows\System\uTwbJAi.exe
  C:\Windows\System\uTwbJAi.exe
  2⤵
  PID:5240
- C:\Windows\System\TMNqSll.exe
  C:\Windows\System\TMNqSll.exe
  2⤵
  PID:5324
- C:\Windows\System\CVyUNTi.exe
  C:\Windows\System\CVyUNTi.exe
  2⤵
  PID:5384
- C:\Windows\System\jYZmOVF.exe
  C:\Windows\System\jYZmOVF.exe
  2⤵
  PID:5452
- C:\Windows\System\JNKLYPX.exe
  C:\Windows\System\JNKLYPX.exe
  2⤵
  PID:5036
- C:\Windows\System\jfuTFhO.exe
  C:\Windows\System\jfuTFhO.exe
  2⤵
  PID:5204
- C:\Windows\System\haqqUMr.exe
  C:\Windows\System\haqqUMr.exe
  2⤵
  PID:5512
- C:\Windows\System\XCCYMay.exe
  C:\Windows\System\XCCYMay.exe
  2⤵
  PID:5516
- C:\Windows\System\RCodRDN.exe
  C:\Windows\System\RCodRDN.exe
  2⤵
  PID:5404
- C:\Windows\System\AIPvQvS.exe
  C:\Windows\System\AIPvQvS.exe
  2⤵
  PID:5468
- C:\Windows\System\CWHGUkL.exe
  C:\Windows\System\CWHGUkL.exe
  2⤵
  PID:5532
- C:\Windows\System\jasgFuE.exe
  C:\Windows\System\jasgFuE.exe
  2⤵
  PID:5568
- C:\Windows\System\nmKOnYF.exe
  C:\Windows\System\nmKOnYF.exe
  2⤵
  PID:5600
- C:\Windows\System\NYTbUkd.exe
  C:\Windows\System\NYTbUkd.exe
  2⤵
  PID:5620
- C:\Windows\System\NRXcADg.exe
  C:\Windows\System\NRXcADg.exe
  2⤵
  PID:5640
- C:\Windows\System\udFYBuB.exe
  C:\Windows\System\udFYBuB.exe
  2⤵
  PID:5656
- C:\Windows\System\lzOHaMI.exe
  C:\Windows\System\lzOHaMI.exe
  2⤵
  PID:5672
- C:\Windows\System\BSRNptm.exe
  C:\Windows\System\BSRNptm.exe
  2⤵
  PID:5688
- C:\Windows\System\flDWhDS.exe
  C:\Windows\System\flDWhDS.exe
  2⤵
  PID:5704
- C:\Windows\System\qUtKUUt.exe
  C:\Windows\System\qUtKUUt.exe
  2⤵
  PID:5740
- C:\Windows\System\rbhHVfq.exe
  C:\Windows\System\rbhHVfq.exe
  2⤵
  PID:5780
- C:\Windows\System\hHkMEGg.exe
  C:\Windows\System\hHkMEGg.exe
  2⤵
  PID:5816
- C:\Windows\System\oocZQyd.exe
  C:\Windows\System\oocZQyd.exe
  2⤵
  PID:5848
- C:\Windows\System\YYJxnVF.exe
  C:\Windows\System\YYJxnVF.exe
  2⤵
  PID:5916
- C:\Windows\System\GPKBkwL.exe
  C:\Windows\System\GPKBkwL.exe
  2⤵
  PID:5836
- C:\Windows\System\VeztwJF.exe
  C:\Windows\System\VeztwJF.exe
  2⤵
  PID:6004
- C:\Windows\System\BuzXnLK.exe
  C:\Windows\System\BuzXnLK.exe
  2⤵
  PID:5900
- C:\Windows\System\LoILITJ.exe
  C:\Windows\System\LoILITJ.exe
  2⤵
  PID:5984
- C:\Windows\System\VRImfGu.exe
  C:\Windows\System\VRImfGu.exe
  2⤵
  PID:5948
- C:\Windows\System\LNGXhXb.exe
  C:\Windows\System\LNGXhXb.exe
  2⤵
  PID:6020
- C:\Windows\System\pmRcCCI.exe
  C:\Windows\System\pmRcCCI.exe
  2⤵
  PID:6044
- C:\Windows\System\TfewdBL.exe
  C:\Windows\System\TfewdBL.exe
  2⤵
  PID:6108
- C:\Windows\System\SnLkecC.exe
  C:\Windows\System\SnLkecC.exe
  2⤵
  PID:5188
- C:\Windows\System\lesvoWX.exe
  C:\Windows\System\lesvoWX.exe
  2⤵
  PID:6060
- C:\Windows\System\ejDJTTE.exe
  C:\Windows\System\ejDJTTE.exe
  2⤵
  PID:6124
- C:\Windows\System\xRDEGGs.exe
  C:\Windows\System\xRDEGGs.exe
  2⤵
  PID:5256
- C:\Windows\System\cwAzrlt.exe
  C:\Windows\System\cwAzrlt.exe
  2⤵
  PID:5352
- C:\Windows\System\zSaUbXD.exe
  C:\Windows\System\zSaUbXD.exe
  2⤵
  PID:5236
- C:\Windows\System\NkuPrmV.exe
  C:\Windows\System\NkuPrmV.exe
  2⤵
  PID:5500
- C:\Windows\System\wlIgxbs.exe
  C:\Windows\System\wlIgxbs.exe
  2⤵
  PID:5628
- C:\Windows\System\CWlMndf.exe
  C:\Windows\System\CWlMndf.exe
  2⤵
  PID:5416
- C:\Windows\System\WKQaRkW.exe
  C:\Windows\System\WKQaRkW.exe
  2⤵
  PID:4176
- C:\Windows\System\JLUjydL.exe
  C:\Windows\System\JLUjydL.exe
  2⤵
  PID:5168
- C:\Windows\System\UHMSyVU.exe
  C:\Windows\System\UHMSyVU.exe
  2⤵
  PID:5132
- C:\Windows\System\nzhdFkC.exe
  C:\Windows\System\nzhdFkC.exe
  2⤵
  PID:5340
- C:\Windows\System\jldwJZK.exe
  C:\Windows\System\jldwJZK.exe
  2⤵
  PID:5616
- C:\Windows\System\NUNiikc.exe
  C:\Windows\System\NUNiikc.exe
  2⤵
  PID:5684
- C:\Windows\System\ZGyymDt.exe
  C:\Windows\System\ZGyymDt.exe
  2⤵
  PID:5724
- C:\Windows\System\lTAeqFX.exe
  C:\Windows\System\lTAeqFX.exe
  2⤵
  PID:5784
- C:\Windows\System\VxZDkpp.exe
  C:\Windows\System\VxZDkpp.exe
  2⤵
  PID:5904
- C:\Windows\System\zfpJFwI.exe
  C:\Windows\System\zfpJFwI.exe
  2⤵
  PID:5920
- C:\Windows\System\cVWQNnv.exe
  C:\Windows\System\cVWQNnv.exe
  2⤵
  PID:5636
- C:\Windows\System\arEdbrZ.exe
  C:\Windows\System\arEdbrZ.exe
  2⤵
  PID:4548
- C:\Windows\System\pkAVgHm.exe
  C:\Windows\System\pkAVgHm.exe
  2⤵
  PID:5072
- C:\Windows\System\rthDgvA.exe
  C:\Windows\System\rthDgvA.exe
  2⤵
  PID:5988
- C:\Windows\System\PSeKJon.exe
  C:\Windows\System\PSeKJon.exe
  2⤵
  PID:5224
- C:\Windows\System\gwiFpdZ.exe
  C:\Windows\System\gwiFpdZ.exe
  2⤵
  PID:5448
- C:\Windows\System\FSgSduB.exe
  C:\Windows\System\FSgSduB.exe
  2⤵
  PID:5560
- C:\Windows\System\zxEnfOK.exe
  C:\Windows\System\zxEnfOK.exe
  2⤵
  PID:5544
- C:\Windows\System\qFULWcn.exe
  C:\Windows\System\qFULWcn.exe
  2⤵
  PID:5140
- C:\Windows\System\EmZktjy.exe
  C:\Windows\System\EmZktjy.exe
  2⤵
  PID:5712
- C:\Windows\System\WHJPCWZ.exe
  C:\Windows\System\WHJPCWZ.exe
  2⤵
  PID:5700
- C:\Windows\System\tqqgvSM.exe
  C:\Windows\System\tqqgvSM.exe
  2⤵
  PID:5820
- C:\Windows\System\ZnqnTtm.exe
  C:\Windows\System\ZnqnTtm.exe
  2⤵
  PID:5936
- C:\Windows\System\TPZDOuF.exe
  C:\Windows\System\TPZDOuF.exe
  2⤵
  PID:6096
- C:\Windows\System\XEMBSEm.exe
  C:\Windows\System\XEMBSEm.exe
  2⤵
  PID:6036
- C:\Windows\System\VsEYdxW.exe
  C:\Windows\System\VsEYdxW.exe
  2⤵
  PID:6080
- C:\Windows\System\rYPPebu.exe
  C:\Windows\System\rYPPebu.exe
  2⤵
  PID:5292
- C:\Windows\System\AVcQQqy.exe
  C:\Windows\System\AVcQQqy.exe
  2⤵
  PID:5156
- C:\Windows\System\xYOXXNV.exe
  C:\Windows\System\xYOXXNV.exe
  2⤵
  PID:5596
- C:\Windows\System\WGZXMdy.exe
  C:\Windows\System\WGZXMdy.exe
  2⤵
  PID:6076
- C:\Windows\System\YZFImQH.exe
  C:\Windows\System\YZFImQH.exe
  2⤵
  PID:5776
- C:\Windows\System\CievweR.exe
  C:\Windows\System\CievweR.exe
  2⤵
  PID:5680
- C:\Windows\System\zcNhpUm.exe
  C:\Windows\System\zcNhpUm.exe
  2⤵
  PID:5336
- C:\Windows\System\FPkKmOu.exe
  C:\Windows\System\FPkKmOu.exe
  2⤵
  PID:5280
- C:\Windows\System\eiCrhNB.exe
  C:\Windows\System\eiCrhNB.exe
  2⤵
  PID:5932
- C:\Windows\System\plWmVNH.exe
  C:\Windows\System\plWmVNH.exe
  2⤵
  PID:6008
- C:\Windows\System\noZyMhF.exe
  C:\Windows\System\noZyMhF.exe
  2⤵
  PID:4808
- C:\Windows\System\xtBDNuT.exe
  C:\Windows\System\xtBDNuT.exe
  2⤵
  PID:6160
- C:\Windows\System\jmzPWIC.exe
  C:\Windows\System\jmzPWIC.exe
  2⤵
  PID:6176
- C:\Windows\System\MjzbFdD.exe
  C:\Windows\System\MjzbFdD.exe
  2⤵
  PID:6192
- C:\Windows\System\EaUpxHH.exe
  C:\Windows\System\EaUpxHH.exe
  2⤵
  PID:6208
- C:\Windows\System\IFtZTli.exe
  C:\Windows\System\IFtZTli.exe
  2⤵
  PID:6224
- C:\Windows\System\ITfrxUe.exe
  C:\Windows\System\ITfrxUe.exe
  2⤵
  PID:6240
- C:\Windows\System\spzeIDF.exe
  C:\Windows\System\spzeIDF.exe
  2⤵
  PID:6260
- C:\Windows\System\RsKZVda.exe
  C:\Windows\System\RsKZVda.exe
  2⤵
  PID:6276
- C:\Windows\System\CaIUdzi.exe
  C:\Windows\System\CaIUdzi.exe
  2⤵
  PID:6292
- C:\Windows\System\HZoDNgv.exe
  C:\Windows\System\HZoDNgv.exe
  2⤵
  PID:6308
- C:\Windows\System\DAZsvfQ.exe
  C:\Windows\System\DAZsvfQ.exe
  2⤵
  PID:6324
- C:\Windows\System\Ntgafoc.exe
  C:\Windows\System\Ntgafoc.exe
  2⤵
  PID:6348
- C:\Windows\System\hYDErMY.exe
  C:\Windows\System\hYDErMY.exe
  2⤵
  PID:6364
- C:\Windows\System\VMBnQQu.exe
  C:\Windows\System\VMBnQQu.exe
  2⤵
  PID:6380
- C:\Windows\System\mjwZsnw.exe
  C:\Windows\System\mjwZsnw.exe
  2⤵
  PID:6396
- C:\Windows\System\EEVuqyN.exe
  C:\Windows\System\EEVuqyN.exe
  2⤵
  PID:6412
- C:\Windows\System\UjTEvsY.exe
  C:\Windows\System\UjTEvsY.exe
  2⤵
  PID:6428
- C:\Windows\System\cYNXGlJ.exe
  C:\Windows\System\cYNXGlJ.exe
  2⤵
  PID:6444
- C:\Windows\System\OBNObCo.exe
  C:\Windows\System\OBNObCo.exe
  2⤵
  PID:6468
- C:\Windows\System\hDRBAle.exe
  C:\Windows\System\hDRBAle.exe
  2⤵
  PID:6484
- C:\Windows\System\InCvGvN.exe
  C:\Windows\System\InCvGvN.exe
  2⤵
  PID:6500
- C:\Windows\System\iFxBLMv.exe
  C:\Windows\System\iFxBLMv.exe
  2⤵
  PID:6516
- C:\Windows\System\JpbljvS.exe
  C:\Windows\System\JpbljvS.exe
  2⤵
  PID:6532
- C:\Windows\System\auBcbfm.exe
  C:\Windows\System\auBcbfm.exe
  2⤵
  PID:6548
- C:\Windows\System\dyymXGH.exe
  C:\Windows\System\dyymXGH.exe
  2⤵
  PID:6564
- C:\Windows\System\xWmrxld.exe
  C:\Windows\System\xWmrxld.exe
  2⤵
  PID:6588
- C:\Windows\System\oaKuclU.exe
  C:\Windows\System\oaKuclU.exe
  2⤵
  PID:6604
- C:\Windows\System\uPCMgCP.exe
  C:\Windows\System\uPCMgCP.exe
  2⤵
  PID:6620
- C:\Windows\System\kognlLp.exe
  C:\Windows\System\kognlLp.exe
  2⤵
  PID:6636
- C:\Windows\System\eZPcDnV.exe
  C:\Windows\System\eZPcDnV.exe
  2⤵
  PID:6652
- C:\Windows\System\dBTkfdz.exe
  C:\Windows\System\dBTkfdz.exe
  2⤵
  PID:6668
- C:\Windows\System\vPAdAIA.exe
  C:\Windows\System\vPAdAIA.exe
  2⤵
  PID:6688
- C:\Windows\System\GQqWxAn.exe
  C:\Windows\System\GQqWxAn.exe
  2⤵
  PID:6708
- C:\Windows\System\tJNvqPX.exe
  C:\Windows\System\tJNvqPX.exe
  2⤵
  PID:6724
- C:\Windows\System\wBzpWFR.exe
  C:\Windows\System\wBzpWFR.exe
  2⤵
  PID:6740
- C:\Windows\System\gPexUuU.exe
  C:\Windows\System\gPexUuU.exe
  2⤵
  PID:6756
- C:\Windows\System\GwgVuQG.exe
  C:\Windows\System\GwgVuQG.exe
  2⤵
  PID:6772
- C:\Windows\System\bVfNJnJ.exe
  C:\Windows\System\bVfNJnJ.exe
  2⤵
  PID:6788
- C:\Windows\System\ZJqpZIO.exe
  C:\Windows\System\ZJqpZIO.exe
  2⤵
  PID:6804
- C:\Windows\System\NkipyuY.exe
  C:\Windows\System\NkipyuY.exe
  2⤵
  PID:6820
- C:\Windows\System\IIDtBbE.exe
  C:\Windows\System\IIDtBbE.exe
  2⤵
  PID:6836
- C:\Windows\System\UDkMRPx.exe
  C:\Windows\System\UDkMRPx.exe
  2⤵
  PID:6852
- C:\Windows\System\adByKBn.exe
  C:\Windows\System\adByKBn.exe
  2⤵
  PID:6868
- C:\Windows\System\GVtgyuB.exe
  C:\Windows\System\GVtgyuB.exe
  2⤵
  PID:6888
- C:\Windows\System\AmHQrwc.exe
  C:\Windows\System\AmHQrwc.exe
  2⤵
  PID:6904
- C:\Windows\System\fwsxykD.exe
  C:\Windows\System\fwsxykD.exe
  2⤵
  PID:6920
- C:\Windows\System\pnASHcA.exe
  C:\Windows\System\pnASHcA.exe
  2⤵
  PID:6936
- C:\Windows\System\igtoazi.exe
  C:\Windows\System\igtoazi.exe
  2⤵
  PID:6952
- C:\Windows\System\uTBZups.exe
  C:\Windows\System\uTBZups.exe
  2⤵
  PID:6972
- C:\Windows\System\YRysYbn.exe
  C:\Windows\System\YRysYbn.exe
  2⤵
  PID:6988
- C:\Windows\System\fTZVnzS.exe
  C:\Windows\System\fTZVnzS.exe
  2⤵
  PID:7004
- C:\Windows\System\KQCyjJQ.exe
  C:\Windows\System\KQCyjJQ.exe
  2⤵
  PID:7020
- C:\Windows\System\lMsMuLp.exe
  C:\Windows\System\lMsMuLp.exe
  2⤵
  PID:7036
- C:\Windows\System\KsNJSGG.exe
  C:\Windows\System\KsNJSGG.exe
  2⤵
  PID:7052
- C:\Windows\System\jisDLet.exe
  C:\Windows\System\jisDLet.exe
  2⤵
  PID:7068
- C:\Windows\System\lGkSRtf.exe
  C:\Windows\System\lGkSRtf.exe
  2⤵
  PID:7084
- C:\Windows\System\KCeBkAm.exe
  C:\Windows\System\KCeBkAm.exe
  2⤵
  PID:7100
- C:\Windows\System\RSegjuY.exe
  C:\Windows\System\RSegjuY.exe
  2⤵
  PID:7116
- C:\Windows\System\iCnuLfH.exe
  C:\Windows\System\iCnuLfH.exe
  2⤵
  PID:7132
- C:\Windows\System\UFLofqY.exe
  C:\Windows\System\UFLofqY.exe
  2⤵
  PID:7148
- C:\Windows\System\JPDtDBl.exe
  C:\Windows\System\JPDtDBl.exe
  2⤵
  PID:7164
- C:\Windows\System\wnfoGaU.exe
  C:\Windows\System\wnfoGaU.exe
  2⤵
  PID:6216
- C:\Windows\System\rDMZshj.exe
  C:\Windows\System\rDMZshj.exe
  2⤵
  PID:6256
- C:\Windows\System\hGgNqCN.exe
  C:\Windows\System\hGgNqCN.exe
  2⤵
  PID:6200
- C:\Windows\System\QKWbiCa.exe
  C:\Windows\System\QKWbiCa.exe
  2⤵
  PID:6288
- C:\Windows\System\tyHGSWS.exe
  C:\Windows\System\tyHGSWS.exe
  2⤵
  PID:6236
- C:\Windows\System\DgQhaEF.exe
  C:\Windows\System\DgQhaEF.exe
  2⤵
  PID:6304
- C:\Windows\System\dmfhBXp.exe
  C:\Windows\System\dmfhBXp.exe
  2⤵
  PID:6360
- C:\Windows\System\SzsnzjR.exe
  C:\Windows\System\SzsnzjR.exe
  2⤵
  PID:6392
- C:\Windows\System\oesYEtx.exe
  C:\Windows\System\oesYEtx.exe
  2⤵
  PID:6376
- C:\Windows\System\WIKDhas.exe
  C:\Windows\System\WIKDhas.exe
  2⤵
  PID:6464
- C:\Windows\System\VLLxQww.exe
  C:\Windows\System\VLLxQww.exe
  2⤵
  PID:6524
- C:\Windows\System\eAkICLI.exe
  C:\Windows\System\eAkICLI.exe
  2⤵
  PID:6560
- C:\Windows\System\UMpdNPR.exe
  C:\Windows\System\UMpdNPR.exe
  2⤵
  PID:6480
- C:\Windows\System\WFPNmYw.exe
  C:\Windows\System\WFPNmYw.exe
  2⤵
  PID:6600
- C:\Windows\System\EsFYHIF.exe
  C:\Windows\System\EsFYHIF.exe
  2⤵
  PID:6644
- C:\Windows\System\XwEPVhJ.exe
  C:\Windows\System\XwEPVhJ.exe
  2⤵
  PID:6684
- C:\Windows\System\hEfwkom.exe
  C:\Windows\System\hEfwkom.exe
  2⤵
  PID:6764
- C:\Windows\System\bjObnIO.exe
  C:\Windows\System\bjObnIO.exe
  2⤵
  PID:6716
- C:\Windows\System\HGppZFL.exe
  C:\Windows\System\HGppZFL.exe
  2⤵
  PID:6864
- C:\Windows\System\OcVCIwd.exe
  C:\Windows\System\OcVCIwd.exe
  2⤵
  PID:6780
- C:\Windows\System\OrJlfZz.exe
  C:\Windows\System\OrJlfZz.exe
  2⤵
  PID:6900
- C:\Windows\System\lIguVhP.exe
  C:\Windows\System\lIguVhP.exe
  2⤵
  PID:6848
- C:\Windows\System\TVpgalz.exe
  C:\Windows\System\TVpgalz.exe
  2⤵
  PID:7000
- C:\Windows\System\KUOMvbu.exe
  C:\Windows\System\KUOMvbu.exe
  2⤵
  PID:7064
- C:\Windows\System\mlvsmBX.exe
  C:\Windows\System\mlvsmBX.exe
  2⤵
  PID:6944
- C:\Windows\System\OcAGZUP.exe
  C:\Windows\System\OcAGZUP.exe
  2⤵
  PID:6876
- C:\Windows\System\tQWOiHs.exe
  C:\Windows\System\tQWOiHs.exe
  2⤵
  PID:7080
- C:\Windows\System\QAerrsO.exe
  C:\Windows\System\QAerrsO.exe
  2⤵
  PID:7128
- C:\Windows\System\vyJKTrW.exe
  C:\Windows\System\vyJKTrW.exe
  2⤵
  PID:6284
- C:\Windows\System\SaziijL.exe
  C:\Windows\System\SaziijL.exe
  2⤵
  PID:6336
- C:\Windows\System\JHcrseB.exe
  C:\Windows\System\JHcrseB.exe
  2⤵
  PID:5992
- C:\Windows\System\JzaRnOg.exe
  C:\Windows\System\JzaRnOg.exe
  2⤵
  PID:6320
- C:\Windows\System\nbSbcXK.exe
  C:\Windows\System\nbSbcXK.exe
  2⤵
  PID:6556
- C:\Windows\System\DqIPIlA.exe
  C:\Windows\System\DqIPIlA.exe
  2⤵
  PID:7140
- C:\Windows\System\XmEFGmC.exe
  C:\Windows\System\XmEFGmC.exe
  2⤵
  PID:7108
- C:\Windows\System\WJDCIJA.exe
  C:\Windows\System\WJDCIJA.exe
  2⤵
  PID:6372
- C:\Windows\System\BCFHhXt.exe
  C:\Windows\System\BCFHhXt.exe
  2⤵
  PID:6632
- C:\Windows\System\GvpeSDR.exe
  C:\Windows\System\GvpeSDR.exe
  2⤵
  PID:6984
- C:\Windows\System\sFrRQxe.exe
  C:\Windows\System\sFrRQxe.exe
  2⤵
  PID:6884
- C:\Windows\System\mrQBmIL.exe
  C:\Windows\System\mrQBmIL.exe
  2⤵
  PID:7016
- C:\Windows\System\QMAzqdp.exe
  C:\Windows\System\QMAzqdp.exe
  2⤵
  PID:6912
- C:\Windows\System\VZOUCan.exe
  C:\Windows\System\VZOUCan.exe
  2⤵
  PID:6252
- C:\Windows\System\dKpsiFt.exe
  C:\Windows\System\dKpsiFt.exe
  2⤵
  PID:6340
- C:\Windows\System\kkhwzSK.exe
  C:\Windows\System\kkhwzSK.exe
  2⤵
  PID:6156
- C:\Windows\System\gJcWTaz.exe
  C:\Windows\System\gJcWTaz.exe
  2⤵
  PID:6664
- C:\Windows\System\XPLjkDH.exe
  C:\Windows\System\XPLjkDH.exe
  2⤵
  PID:6796
- C:\Windows\System\bFeOhXX.exe
  C:\Windows\System\bFeOhXX.exe
  2⤵
  PID:6616
- C:\Windows\System\thTTrpZ.exe
  C:\Windows\System\thTTrpZ.exe
  2⤵
  PID:7032
- C:\Windows\System\uKLAHTC.exe
  C:\Windows\System\uKLAHTC.exe
  2⤵
  PID:6784
- C:\Windows\System\GWxAkCu.exe
  C:\Windows\System\GWxAkCu.exe
  2⤵
  PID:6832
- C:\Windows\System\uHGkkUx.exe
  C:\Windows\System\uHGkkUx.exe
  2⤵
  PID:6980
- C:\Windows\System\BVKnhCK.exe
  C:\Windows\System\BVKnhCK.exe
  2⤵
  PID:6300
- C:\Windows\System\gGLbfJC.exe
  C:\Windows\System\gGLbfJC.exe
  2⤵
  PID:6460
- C:\Windows\System\lnWzJls.exe
  C:\Windows\System\lnWzJls.exe
  2⤵
  PID:6544
- C:\Windows\System\vctvtNv.exe
  C:\Windows\System\vctvtNv.exe
  2⤵
  PID:6576
- C:\Windows\System\dTpnDNQ.exe
  C:\Windows\System\dTpnDNQ.exe
  2⤵
  PID:6704
- C:\Windows\System\bYfpHcb.exe
  C:\Windows\System\bYfpHcb.exe
  2⤵
  PID:7076
- C:\Windows\System\rCKCQlo.exe
  C:\Windows\System\rCKCQlo.exe
  2⤵
  PID:6700
- C:\Windows\System\UbbQJNl.exe
  C:\Windows\System\UbbQJNl.exe
  2⤵
  PID:6680
- C:\Windows\System\ViocBuQ.exe
  C:\Windows\System\ViocBuQ.exe
  2⤵
  PID:7184
- C:\Windows\System\bUIOmEE.exe
  C:\Windows\System\bUIOmEE.exe
  2⤵
  PID:7200
- C:\Windows\System\kCUXvaS.exe
  C:\Windows\System\kCUXvaS.exe
  2⤵
  PID:7216
- C:\Windows\System\klosBYT.exe
  C:\Windows\System\klosBYT.exe
  2⤵
  PID:7232
- C:\Windows\System\eIAbqfP.exe
  C:\Windows\System\eIAbqfP.exe
  2⤵
  PID:7252
- C:\Windows\System\gvsdMuw.exe
  C:\Windows\System\gvsdMuw.exe
  2⤵
  PID:7268
- C:\Windows\System\NWDLjho.exe
  C:\Windows\System\NWDLjho.exe
  2⤵
  PID:7284
- C:\Windows\System\HrxvHSV.exe
  C:\Windows\System\HrxvHSV.exe
  2⤵
  PID:7300
- C:\Windows\System\BiuUPxM.exe
  C:\Windows\System\BiuUPxM.exe
  2⤵
  PID:7316
- C:\Windows\System\fQQrIht.exe
  C:\Windows\System\fQQrIht.exe
  2⤵
  PID:7332
- C:\Windows\System\kgEwrBP.exe
  C:\Windows\System\kgEwrBP.exe
  2⤵
  PID:7348
- C:\Windows\System\pCtfhNa.exe
  C:\Windows\System\pCtfhNa.exe
  2⤵
  PID:7364
- C:\Windows\System\oAhkGFM.exe
  C:\Windows\System\oAhkGFM.exe
  2⤵
  PID:7380
- C:\Windows\System\XhZSjQt.exe
  C:\Windows\System\XhZSjQt.exe
  2⤵
  PID:7396
- C:\Windows\System\sVjcFWn.exe
  C:\Windows\System\sVjcFWn.exe
  2⤵
  PID:7412
- C:\Windows\System\OpJXRcI.exe
  C:\Windows\System\OpJXRcI.exe
  2⤵
  PID:7428
- C:\Windows\System\lmHFcld.exe
  C:\Windows\System\lmHFcld.exe
  2⤵
  PID:7444
- C:\Windows\System\RlkGACa.exe
  C:\Windows\System\RlkGACa.exe
  2⤵
  PID:7460
- C:\Windows\System\oOdDzPE.exe
  C:\Windows\System\oOdDzPE.exe
  2⤵
  PID:7476
- C:\Windows\System\erpPQLE.exe
  C:\Windows\System\erpPQLE.exe
  2⤵
  PID:7492
- C:\Windows\System\ACLmVzu.exe
  C:\Windows\System\ACLmVzu.exe
  2⤵
  PID:7508
- C:\Windows\System\fZsuxij.exe
  C:\Windows\System\fZsuxij.exe
  2⤵
  PID:7524
- C:\Windows\System\JlRcdVX.exe
  C:\Windows\System\JlRcdVX.exe
  2⤵
  PID:7624
- C:\Windows\System\RqUyrch.exe
  C:\Windows\System\RqUyrch.exe
  2⤵
  PID:7640
- C:\Windows\System\TNvMSvs.exe
  C:\Windows\System\TNvMSvs.exe
  2⤵
  PID:7656
- C:\Windows\System\ENYOFtx.exe
  C:\Windows\System\ENYOFtx.exe
  2⤵
  PID:7672
- C:\Windows\System\LeWcTCt.exe
  C:\Windows\System\LeWcTCt.exe
  2⤵
  PID:7688
- C:\Windows\System\cEpcAgN.exe
  C:\Windows\System\cEpcAgN.exe
  2⤵
  PID:7708
- C:\Windows\System\MAxNbML.exe
  C:\Windows\System\MAxNbML.exe
  2⤵
  PID:7736
- C:\Windows\System\VKFQBcJ.exe
  C:\Windows\System\VKFQBcJ.exe
  2⤵
  PID:7752
- C:\Windows\System\wFyLRaE.exe
  C:\Windows\System\wFyLRaE.exe
  2⤵
  PID:7768
- C:\Windows\System\xwQEjPO.exe
  C:\Windows\System\xwQEjPO.exe
  2⤵
  PID:7784
- C:\Windows\System\COVAcUX.exe
  C:\Windows\System\COVAcUX.exe
  2⤵
  PID:7800
- C:\Windows\System\lgCcYhC.exe
  C:\Windows\System\lgCcYhC.exe
  2⤵
  PID:7820
- C:\Windows\System\RSgvIsn.exe
  C:\Windows\System\RSgvIsn.exe
  2⤵
  PID:7836
- C:\Windows\System\iTlEJsu.exe
  C:\Windows\System\iTlEJsu.exe
  2⤵
  PID:7852
- C:\Windows\System\aHpXLsJ.exe
  C:\Windows\System\aHpXLsJ.exe
  2⤵
  PID:7868
- C:\Windows\System\KapfWCe.exe
  C:\Windows\System\KapfWCe.exe
  2⤵
  PID:7888
- C:\Windows\System\KAJxgFw.exe
  C:\Windows\System\KAJxgFw.exe
  2⤵
  PID:7904
- C:\Windows\System\IYpVvxX.exe
  C:\Windows\System\IYpVvxX.exe
  2⤵
  PID:7920
- C:\Windows\System\wZkUoVy.exe
  C:\Windows\System\wZkUoVy.exe
  2⤵
  PID:7936
- C:\Windows\System\RVDyCHC.exe
  C:\Windows\System\RVDyCHC.exe
  2⤵
  PID:7952
- C:\Windows\System\iCjDbvH.exe
  C:\Windows\System\iCjDbvH.exe
  2⤵
  PID:7968
- C:\Windows\System\Irrplal.exe
  C:\Windows\System\Irrplal.exe
  2⤵
  PID:7984
- C:\Windows\System\rMxfcBj.exe
  C:\Windows\System\rMxfcBj.exe
  2⤵
  PID:8000
- C:\Windows\System\RLNeDuW.exe
  C:\Windows\System\RLNeDuW.exe
  2⤵
  PID:8020
- C:\Windows\System\dQMmhzD.exe
  C:\Windows\System\dQMmhzD.exe
  2⤵
  PID:8036
- C:\Windows\System\bzqPFsW.exe
  C:\Windows\System\bzqPFsW.exe
  2⤵
  PID:8052
- C:\Windows\System\PQOPtfN.exe
  C:\Windows\System\PQOPtfN.exe
  2⤵
  PID:8068
- C:\Windows\System\KFxDXZw.exe
  C:\Windows\System\KFxDXZw.exe
  2⤵
  PID:8084
- C:\Windows\System\mshdKvE.exe
  C:\Windows\System\mshdKvE.exe
  2⤵
  PID:8104
- C:\Windows\System\moeyADz.exe
  C:\Windows\System\moeyADz.exe
  2⤵
  PID:8144
- C:\Windows\System\rHgNVfC.exe
  C:\Windows\System\rHgNVfC.exe
  2⤵
  PID:8160
- C:\Windows\System\MRlNkIx.exe
  C:\Windows\System\MRlNkIx.exe
  2⤵
  PID:8176
- C:\Windows\System\QbTNvjH.exe
  C:\Windows\System\QbTNvjH.exe
  2⤵
  PID:7176
- C:\Windows\System\YYmLRJd.exe
  C:\Windows\System\YYmLRJd.exe
  2⤵
  PID:7208
- C:\Windows\System\zqgaxSe.exe
  C:\Windows\System\zqgaxSe.exe
  2⤵
  PID:7276
- C:\Windows\System\VMPuxYO.exe
  C:\Windows\System\VMPuxYO.exe
  2⤵
  PID:6800
- C:\Windows\System\OkxTfBQ.exe
  C:\Windows\System\OkxTfBQ.exe
  2⤵
  PID:7012
- C:\Windows\System\EsXOXzh.exe
  C:\Windows\System\EsXOXzh.exe
  2⤵
  PID:6968
- C:\Windows\System\egJpWfu.exe
  C:\Windows\System\egJpWfu.exe
  2⤵
  PID:6512
- C:\Windows\System\bhhVREu.exe
  C:\Windows\System\bhhVREu.exe
  2⤵
  PID:7372
- C:\Windows\System\rwNoEVG.exe
  C:\Windows\System\rwNoEVG.exe
  2⤵
  PID:7292
- C:\Windows\System\NjYtMdn.exe
  C:\Windows\System\NjYtMdn.exe
  2⤵
  PID:7296
- C:\Windows\System\WiNQixs.exe
  C:\Windows\System\WiNQixs.exe
  2⤵
  PID:7356
- C:\Windows\System\pJDocqc.exe
  C:\Windows\System\pJDocqc.exe
  2⤵
  PID:7468
- C:\Windows\System\NrRkcAn.exe
  C:\Windows\System\NrRkcAn.exe
  2⤵
  PID:7536
- C:\Windows\System\vNSdwXw.exe
  C:\Windows\System\vNSdwXw.exe
  2⤵
  PID:7388
- C:\Windows\System\LoqFLig.exe
  C:\Windows\System\LoqFLig.exe
  2⤵
  PID:7516
- C:\Windows\System\iAhIKXm.exe
  C:\Windows\System\iAhIKXm.exe
  2⤵
  PID:7548
- C:\Windows\System\NUnpIiM.exe
  C:\Windows\System\NUnpIiM.exe
  2⤵
  PID:7560
- C:\Windows\System\PJgYrAp.exe
  C:\Windows\System\PJgYrAp.exe
  2⤵
  PID:7580
- C:\Windows\System\wyrDaiH.exe
  C:\Windows\System\wyrDaiH.exe
  2⤵
  PID:7592
- C:\Windows\System\qQyMQXV.exe
  C:\Windows\System\qQyMQXV.exe
  2⤵
  PID:7608
- C:\Windows\System\MRMUUcA.exe
  C:\Windows\System\MRMUUcA.exe
  2⤵
  PID:7648
- C:\Windows\System\QDLKXJT.exe
  C:\Windows\System\QDLKXJT.exe
  2⤵
  PID:7664
- C:\Windows\System\DKEfknu.exe
  C:\Windows\System\DKEfknu.exe
  2⤵
  PID:7748
- C:\Windows\System\lRNOiuH.exe
  C:\Windows\System\lRNOiuH.exe
  2⤵
  PID:7844
- C:\Windows\System\aJKTMWt.exe
  C:\Windows\System\aJKTMWt.exe
  2⤵
  PID:7880
- C:\Windows\System\clcxKTl.exe
  C:\Windows\System\clcxKTl.exe
  2⤵
  PID:7960
- C:\Windows\System\Pgifacn.exe
  C:\Windows\System\Pgifacn.exe
  2⤵
  PID:7944
- C:\Windows\System\PtkHuVr.exe
  C:\Windows\System\PtkHuVr.exe
  2⤵
  PID:8060
- C:\Windows\System\RriKbgj.exe
  C:\Windows\System\RriKbgj.exe
  2⤵
  PID:8096
- C:\Windows\System\SPtTVbU.exe
  C:\Windows\System\SPtTVbU.exe
  2⤵
  PID:8044
- C:\Windows\System\vXPgxlb.exe
  C:\Windows\System\vXPgxlb.exe
  2⤵
  PID:8128
- C:\Windows\System\BOMNnGh.exe
  C:\Windows\System\BOMNnGh.exe
  2⤵
  PID:8156
- C:\Windows\System\zlGdybU.exe
  C:\Windows\System\zlGdybU.exe
  2⤵
  PID:7248
- C:\Windows\System\RJYDEDe.exe
  C:\Windows\System\RJYDEDe.exe
  2⤵
  PID:6812
- C:\Windows\System\GvUsofA.exe
  C:\Windows\System\GvUsofA.exe
  2⤵
  PID:8172
- C:\Windows\System\rYMvXmu.exe
  C:\Windows\System\rYMvXmu.exe
  2⤵
  PID:6960
- C:\Windows\System\XVYeVOX.exe
  C:\Windows\System\XVYeVOX.exe
  2⤵
  PID:7228
- C:\Windows\System\HmhtiRG.exe
  C:\Windows\System\HmhtiRG.exe
  2⤵
  PID:7500
- C:\Windows\System\HWBlxEz.exe
  C:\Windows\System\HWBlxEz.exe
  2⤵
  PID:7588
- C:\Windows\System\eiKoBJM.exe
  C:\Windows\System\eiKoBJM.exe
  2⤵
  PID:7404
- C:\Windows\System\zgqaNoE.exe
  C:\Windows\System\zgqaNoE.exe
  2⤵
  PID:7456
- C:\Windows\System\KmIlfrs.exe
  C:\Windows\System\KmIlfrs.exe
  2⤵
  PID:7600
- C:\Windows\System\PkMDyTx.exe
  C:\Windows\System\PkMDyTx.exe
  2⤵
  PID:7632
- C:\Windows\System\QQoFvDm.exe
  C:\Windows\System\QQoFvDm.exe
  2⤵
  PID:7616
- C:\Windows\System\gPdWfCs.exe
  C:\Windows\System\gPdWfCs.exe
  2⤵
  PID:7896
- C:\Windows\System\OQmGXkz.exe
  C:\Windows\System\OQmGXkz.exe
  2⤵
  PID:7900
- C:\Windows\System\XqSMODr.exe
  C:\Windows\System\XqSMODr.exe
  2⤵
  PID:7440
- C:\Windows\System\otIYlyu.exe
  C:\Windows\System\otIYlyu.exe
  2⤵
  PID:7992
- C:\Windows\System\ZdNuWmY.exe
  C:\Windows\System\ZdNuWmY.exe
  2⤵
  PID:7776
- C:\Windows\System\SUZHiJF.exe
  C:\Windows\System\SUZHiJF.exe
  2⤵
  PID:7948
- C:\Windows\System\ppUDojS.exe
  C:\Windows\System\ppUDojS.exe
  2⤵
  PID:8132
- C:\Windows\System\qOSIKgI.exe
  C:\Windows\System\qOSIKgI.exe
  2⤵
  PID:8048
- C:\Windows\System\hRZOBVa.exe
  C:\Windows\System\hRZOBVa.exe
  2⤵
  PID:7544
- C:\Windows\System\CNGfHNN.exe
  C:\Windows\System\CNGfHNN.exe
  2⤵
  PID:7224
- C:\Windows\System\EIJJeJv.exe
  C:\Windows\System\EIJJeJv.exe
  2⤵
  PID:7192
- C:\Windows\System\ArxuxoV.exe
  C:\Windows\System\ArxuxoV.exe
  2⤵
  PID:7716
- C:\Windows\System\ylgTbxb.exe
  C:\Windows\System\ylgTbxb.exe
  2⤵
  PID:7684
- C:\Windows\System\FSMovoO.exe
  C:\Windows\System\FSMovoO.exe
  2⤵
  PID:7744
- C:\Windows\System\QNbcEKa.exe
  C:\Windows\System\QNbcEKa.exe
  2⤵
  PID:7932
- C:\Windows\System\cIAfSER.exe
  C:\Windows\System\cIAfSER.exe
  2⤵
  PID:7928
- C:\Windows\System\khGRSpP.exe
  C:\Windows\System\khGRSpP.exe
  2⤵
  PID:8028
- C:\Windows\System\wsSLrBo.exe
  C:\Windows\System\wsSLrBo.exe
  2⤵
  PID:7048
- C:\Windows\System\OeYjBMC.exe
  C:\Windows\System\OeYjBMC.exe
  2⤵
  PID:7436
- C:\Windows\System\BvwKWLv.exe
  C:\Windows\System\BvwKWLv.exe
  2⤵
  PID:8188
- C:\Windows\System\DSDQxdA.exe
  C:\Windows\System\DSDQxdA.exe
  2⤵
  PID:7916
- C:\Windows\System\VUGilqY.exe
  C:\Windows\System\VUGilqY.exe
  2⤵
  PID:7488
- C:\Windows\System\kchmWfL.exe
  C:\Windows\System\kchmWfL.exe
  2⤵
  PID:7584
- C:\Windows\System\mhwsmuh.exe
  C:\Windows\System\mhwsmuh.exe
  2⤵
  PID:7568
- C:\Windows\System\yFNYiIC.exe
  C:\Windows\System\yFNYiIC.exe
  2⤵
  PID:8076
- C:\Windows\System\yoYGiKg.exe
  C:\Windows\System\yoYGiKg.exe
  2⤵
  PID:8208
- C:\Windows\System\svFzIuB.exe
  C:\Windows\System\svFzIuB.exe
  2⤵
  PID:8224
- C:\Windows\System\uJSWjSW.exe
  C:\Windows\System\uJSWjSW.exe
  2⤵
  PID:8240
- C:\Windows\System\AdWdTdw.exe
  C:\Windows\System\AdWdTdw.exe
  2⤵
  PID:8256
- C:\Windows\System\OMfCpKw.exe
  C:\Windows\System\OMfCpKw.exe
  2⤵
  PID:8272
- C:\Windows\System\JemtgaV.exe
  C:\Windows\System\JemtgaV.exe
  2⤵
  PID:8288
- C:\Windows\System\cIpclog.exe
  C:\Windows\System\cIpclog.exe
  2⤵
  PID:8304
- C:\Windows\System\lbhTBUK.exe
  C:\Windows\System\lbhTBUK.exe
  2⤵
  PID:8320
- C:\Windows\System\IOiTYgz.exe
  C:\Windows\System\IOiTYgz.exe
  2⤵
  PID:8336
- C:\Windows\System\BKJJssG.exe
  C:\Windows\System\BKJJssG.exe
  2⤵
  PID:8352
- C:\Windows\System\PlJcJrK.exe
  C:\Windows\System\PlJcJrK.exe
  2⤵
  PID:8368
- C:\Windows\System\skShDWY.exe
  C:\Windows\System\skShDWY.exe
  2⤵
  PID:8384
- C:\Windows\System\yOYMmRI.exe
  C:\Windows\System\yOYMmRI.exe
  2⤵
  PID:8400
- C:\Windows\System\rTbSwNI.exe
  C:\Windows\System\rTbSwNI.exe
  2⤵
  PID:8416
- C:\Windows\System\OCPnIin.exe
  C:\Windows\System\OCPnIin.exe
  2⤵
  PID:8432
- C:\Windows\System\eZzdupe.exe
  C:\Windows\System\eZzdupe.exe
  2⤵
  PID:8448
- C:\Windows\System\hzkqdPL.exe
  C:\Windows\System\hzkqdPL.exe
  2⤵
  PID:8464
- C:\Windows\System\nCUiFaw.exe
  C:\Windows\System\nCUiFaw.exe
  2⤵
  PID:8480
- C:\Windows\System\xopXnBH.exe
  C:\Windows\System\xopXnBH.exe
  2⤵
  PID:8496
- C:\Windows\System\VHSOFuf.exe
  C:\Windows\System\VHSOFuf.exe
  2⤵
  PID:8512
- C:\Windows\System\eGZLxid.exe
  C:\Windows\System\eGZLxid.exe
  2⤵
  PID:8528
- C:\Windows\System\UytbiiX.exe
  C:\Windows\System\UytbiiX.exe
  2⤵
  PID:8544
- C:\Windows\System\JStGnlo.exe
  C:\Windows\System\JStGnlo.exe
  2⤵
  PID:8560
- C:\Windows\System\YxcOJzm.exe
  C:\Windows\System\YxcOJzm.exe
  2⤵
  PID:8576
- C:\Windows\System\pydBLmu.exe
  C:\Windows\System\pydBLmu.exe
  2⤵
  PID:8592
- C:\Windows\System\ilVmiCL.exe
  C:\Windows\System\ilVmiCL.exe
  2⤵
  PID:8608
- C:\Windows\System\ZycVZYV.exe
  C:\Windows\System\ZycVZYV.exe
  2⤵
  PID:8624
- C:\Windows\System\bTZAtRZ.exe
  C:\Windows\System\bTZAtRZ.exe
  2⤵
  PID:8640
- C:\Windows\System\hNZTnGH.exe
  C:\Windows\System\hNZTnGH.exe
  2⤵
  PID:8656
- C:\Windows\System\EEFVftL.exe
  C:\Windows\System\EEFVftL.exe
  2⤵
  PID:8672
- C:\Windows\System\buKqbyL.exe
  C:\Windows\System\buKqbyL.exe
  2⤵
  PID:8688
- C:\Windows\System\yzdhdoA.exe
  C:\Windows\System\yzdhdoA.exe
  2⤵
  PID:8704
- C:\Windows\System\RgMUGwH.exe
  C:\Windows\System\RgMUGwH.exe
  2⤵
  PID:8720
- C:\Windows\System\bueDCND.exe
  C:\Windows\System\bueDCND.exe
  2⤵
  PID:8736
- C:\Windows\System\GzrKKIy.exe
  C:\Windows\System\GzrKKIy.exe
  2⤵
  PID:8752
- C:\Windows\System\aighfxc.exe
  C:\Windows\System\aighfxc.exe
  2⤵
  PID:8768
- C:\Windows\System\YzONmEx.exe
  C:\Windows\System\YzONmEx.exe
  2⤵
  PID:8784
- C:\Windows\System\KPTqcvJ.exe
  C:\Windows\System\KPTqcvJ.exe
  2⤵
  PID:8800
- C:\Windows\System\nCANdVC.exe
  C:\Windows\System\nCANdVC.exe
  2⤵
  PID:8876
- C:\Windows\System\hrthLnw.exe
  C:\Windows\System\hrthLnw.exe
  2⤵
  PID:8892
- C:\Windows\System\NITBxfO.exe
  C:\Windows\System\NITBxfO.exe
  2⤵
  PID:8956
- C:\Windows\System\NzkMkCs.exe
  C:\Windows\System\NzkMkCs.exe
  2⤵
  PID:8976
- C:\Windows\System\djGPIJl.exe
  C:\Windows\System\djGPIJl.exe
  2⤵
  PID:8996
- C:\Windows\System\eEWaHzH.exe
  C:\Windows\System\eEWaHzH.exe
  2⤵
  PID:9012
- C:\Windows\System\UBqhXQN.exe
  C:\Windows\System\UBqhXQN.exe
  2⤵
  PID:9132
- C:\Windows\System\dKQfezQ.exe
  C:\Windows\System\dKQfezQ.exe
  2⤵
  PID:8316
- C:\Windows\System\gtXJBss.exe
  C:\Windows\System\gtXJBss.exe
  2⤵
  PID:8380
- C:\Windows\System\ybWqfNr.exe
  C:\Windows\System\ybWqfNr.exe
  2⤵
  PID:8444
- C:\Windows\System\LoBxhjY.exe
  C:\Windows\System\LoBxhjY.exe
  2⤵
  PID:8328
- C:\Windows\System\OBytJCv.exe
  C:\Windows\System\OBytJCv.exe
  2⤵
  PID:8300
- C:\Windows\System\JSJsQRK.exe
  C:\Windows\System\JSJsQRK.exe
  2⤵
  PID:7848
- C:\Windows\System\wHJArXX.exe
  C:\Windows\System\wHJArXX.exe
  2⤵
  PID:8396
- C:\Windows\System\TrQhPzO.exe
  C:\Windows\System\TrQhPzO.exe
  2⤵
  PID:8488
- C:\Windows\System\zJLOonQ.exe
  C:\Windows\System\zJLOonQ.exe
  2⤵
  PID:8236
- C:\Windows\System\mMYRALB.exe
  C:\Windows\System\mMYRALB.exe
  2⤵
  PID:8540
- C:\Windows\System\RTnJttw.exe
  C:\Windows\System\RTnJttw.exe
  2⤵
  PID:8552
- C:\Windows\System\gvddPVS.exe
  C:\Windows\System\gvddPVS.exe
  2⤵
  PID:8588
- C:\Windows\System\JogQgWG.exe
  C:\Windows\System\JogQgWG.exe
  2⤵
  PID:8584
- C:\Windows\System\cWqlIsq.exe
  C:\Windows\System\cWqlIsq.exe
  2⤵
  PID:8616
- C:\Windows\System\GwNvSqM.exe
  C:\Windows\System\GwNvSqM.exe
  2⤵
  PID:8684
- C:\Windows\System\EdhDMXj.exe
  C:\Windows\System\EdhDMXj.exe
  2⤵
  PID:8716
- C:\Windows\System\XJywPvK.exe
  C:\Windows\System\XJywPvK.exe
  2⤵
  PID:8748
- C:\Windows\System\QPmhthT.exe
  C:\Windows\System\QPmhthT.exe
  2⤵
  PID:8780
- C:\Windows\System\IpcuVZV.exe
  C:\Windows\System\IpcuVZV.exe
  2⤵
  PID:8860
- C:\Windows\System\QBdXtUp.exe
  C:\Windows\System\QBdXtUp.exe
  2⤵
  PID:8844
- C:\Windows\System\KQYDEQK.exe
  C:\Windows\System\KQYDEQK.exe
  2⤵
  PID:8864
- C:\Windows\System\TqaVmKk.exe
  C:\Windows\System\TqaVmKk.exe
  2⤵
  PID:8912
- C:\Windows\System\uDYtYNa.exe
  C:\Windows\System\uDYtYNa.exe
  2⤵
  PID:8932
- C:\Windows\System\cHXNhuF.exe
  C:\Windows\System\cHXNhuF.exe
  2⤵
  PID:8992
- C:\Windows\System\kqmLHuM.exe
  C:\Windows\System\kqmLHuM.exe
  2⤵
  PID:8940
- C:\Windows\System\ImAogfn.exe
  C:\Windows\System\ImAogfn.exe
  2⤵
  PID:9032
- C:\Windows\System\zEtLnxy.exe
  C:\Windows\System\zEtLnxy.exe
  2⤵
  PID:9060
- C:\Windows\System\QLzWQgr.exe
  C:\Windows\System\QLzWQgr.exe
  2⤵
  PID:9072
- C:\Windows\System\UiblabS.exe
  C:\Windows\System\UiblabS.exe
  2⤵
  PID:9128
- C:\Windows\System\XtFRBxH.exe
  C:\Windows\System\XtFRBxH.exe
  2⤵
  PID:9108
- C:\Windows\System\FBSVWPz.exe
  C:\Windows\System\FBSVWPz.exe
  2⤵
  PID:9096
- C:\Windows\System\DtSTHae.exe
  C:\Windows\System\DtSTHae.exe
  2⤵
  PID:9152
- C:\Windows\System\ADybkaq.exe
  C:\Windows\System\ADybkaq.exe
  2⤵
  PID:8964
- C:\Windows\System\qCAeWwS.exe
  C:\Windows\System\qCAeWwS.exe
  2⤵
  PID:9144
- C:\Windows\System\zSqDJUl.exe
  C:\Windows\System\zSqDJUl.exe
  2⤵
  PID:9168
- C:\Windows\System\hLJwAAk.exe
  C:\Windows\System\hLJwAAk.exe
  2⤵
  PID:9192
- C:\Windows\System\LhStPEJ.exe
  C:\Windows\System\LhStPEJ.exe
  2⤵
  PID:9204
- C:\Windows\System\gIgJQnc.exe
  C:\Windows\System\gIgJQnc.exe
  2⤵
  PID:6860
- C:\Windows\System\hTwUFms.exe
  C:\Windows\System\hTwUFms.exe
  2⤵
  PID:8252
- C:\Windows\System\dOYDPKd.exe
  C:\Windows\System\dOYDPKd.exe
  2⤵
  PID:8312
- C:\Windows\System\nFrDBiQ.exe
  C:\Windows\System\nFrDBiQ.exe
  2⤵
  PID:8200
- C:\Windows\System\oaNJuYY.exe
  C:\Windows\System\oaNJuYY.exe
  2⤵
  PID:8364
- C:\Windows\System\yqUrbUA.exe
  C:\Windows\System\yqUrbUA.exe
  2⤵
  PID:7552
- C:\Windows\System\jesUlvJ.exe
  C:\Windows\System\jesUlvJ.exe
  2⤵
  PID:8520
- C:\Windows\System\VmtiXIb.exe
  C:\Windows\System\VmtiXIb.exe
  2⤵
  PID:6748
- C:\Windows\System\HPsGnIj.exe
  C:\Windows\System\HPsGnIj.exe
  2⤵
  PID:8760
- C:\Windows\System\uMFareR.exe
  C:\Windows\System\uMFareR.exe
  2⤵
  PID:8824
- C:\Windows\System\ujoWoVD.exe
  C:\Windows\System\ujoWoVD.exe
  2⤵
  PID:8428
- C:\Windows\System\ZmKDTue.exe
  C:\Windows\System\ZmKDTue.exe
  2⤵
  PID:8572
- C:\Windows\System\DpVptfb.exe
  C:\Windows\System\DpVptfb.exe
  2⤵
  PID:8604
- C:\Windows\System\QSSCYIC.exe
  C:\Windows\System\QSSCYIC.exe
  2⤵
  PID:8668
- C:\Windows\System\GvvvJFv.exe
  C:\Windows\System\GvvvJFv.exe
  2⤵
  PID:8712
- C:\Windows\System\AMFNNZy.exe
  C:\Windows\System\AMFNNZy.exe
  2⤵
  PID:9044
- C:\Windows\System\djvyvdE.exe
  C:\Windows\System\djvyvdE.exe
  2⤵
  PID:9056
- C:\Windows\System\uNfKDjb.exe
  C:\Windows\System\uNfKDjb.exe
  2⤵
  PID:9092
- C:\Windows\System\KNpMnMO.exe
  C:\Windows\System\KNpMnMO.exe
  2⤵
  PID:9020
- C:\Windows\System\vhRvHKL.exe
  C:\Windows\System\vhRvHKL.exe
  2⤵
  PID:9160
- C:\Windows\System\DmGUmgB.exe
  C:\Windows\System\DmGUmgB.exe
  2⤵
  PID:8972
- C:\Windows\System\UstFLmh.exe
  C:\Windows\System\UstFLmh.exe
  2⤵
  PID:8220
- C:\Windows\System\SZXlDHv.exe
  C:\Windows\System\SZXlDHv.exe
  2⤵
  PID:8460
- C:\Windows\System\YmhHUVp.exe
  C:\Windows\System\YmhHUVp.exe
  2⤵
  PID:8888
- C:\Windows\System\sOHOMWB.exe
  C:\Windows\System\sOHOMWB.exe
  2⤵
  PID:9148
- C:\Windows\System\zNJqLDL.exe
  C:\Windows\System\zNJqLDL.exe
  2⤵
  PID:8652
- C:\Windows\System\PNgZILS.exe
  C:\Windows\System\PNgZILS.exe
  2⤵
  PID:8284
- C:\Windows\System\HLvZvJP.exe
  C:\Windows\System\HLvZvJP.exe
  2⤵
  PID:8536
- C:\Windows\System\SaaSOxF.exe
  C:\Windows\System\SaaSOxF.exe
  2⤵
  PID:8696
- C:\Windows\System\nCTWLHl.exe
  C:\Windows\System\nCTWLHl.exe
  2⤵
  PID:8600
- C:\Windows\System\KmolYSX.exe
  C:\Windows\System\KmolYSX.exe
  2⤵
  PID:8924
- C:\Windows\System\BdktbWj.exe
  C:\Windows\System\BdktbWj.exe
  2⤵
  PID:8848
- C:\Windows\System\OyIyvwc.exe
  C:\Windows\System\OyIyvwc.exe
  2⤵
  PID:9040
- C:\Windows\System\yYLvyFq.exe
  C:\Windows\System\yYLvyFq.exe
  2⤵
  PID:8264
- C:\Windows\System\maxZWfW.exe
  C:\Windows\System\maxZWfW.exe
  2⤵
  PID:8412
- C:\Windows\System\SRclgKt.exe
  C:\Windows\System\SRclgKt.exe
  2⤵
  PID:8348
- C:\Windows\System\BrCoEnZ.exe
  C:\Windows\System\BrCoEnZ.exe
  2⤵
  PID:8832
- C:\Windows\System\oscfeIK.exe
  C:\Windows\System\oscfeIK.exe
  2⤵
  PID:8812
- C:\Windows\System\zHBQkXX.exe
  C:\Windows\System\zHBQkXX.exe
  2⤵
  PID:8116
- C:\Windows\System\dnHsyoe.exe
  C:\Windows\System\dnHsyoe.exe
  2⤵
  PID:9208
- C:\Windows\System\aprlHMS.exe
  C:\Windows\System\aprlHMS.exe
  2⤵
  PID:8944
- C:\Windows\System\SHEBxIo.exe
  C:\Windows\System\SHEBxIo.exe
  2⤵
  PID:9120
- C:\Windows\System\DUdjBZl.exe
  C:\Windows\System\DUdjBZl.exe
  2⤵
  PID:9184
- C:\Windows\System\NbmuFsL.exe
  C:\Windows\System\NbmuFsL.exe
  2⤵
  PID:8828
- C:\Windows\System\jsOlDMa.exe
  C:\Windows\System\jsOlDMa.exe
  2⤵
  PID:9232
- C:\Windows\System\FazJaAe.exe
  C:\Windows\System\FazJaAe.exe
  2⤵
  PID:9248
- C:\Windows\System\UtGFCIP.exe
  C:\Windows\System\UtGFCIP.exe
  2⤵
  PID:9264
- C:\Windows\System\JPgbrbk.exe
  C:\Windows\System\JPgbrbk.exe
  2⤵
  PID:9280
- C:\Windows\System\jLDdJhr.exe
  C:\Windows\System\jLDdJhr.exe
  2⤵
  PID:9296
- C:\Windows\System\QHpggBr.exe
  C:\Windows\System\QHpggBr.exe
  2⤵
  PID:9312
- C:\Windows\System\CdxsEHi.exe
  C:\Windows\System\CdxsEHi.exe
  2⤵
  PID:9328
- C:\Windows\System\ZfCniDl.exe
  C:\Windows\System\ZfCniDl.exe
  2⤵
  PID:9344
- C:\Windows\System\ZBUnahS.exe
  C:\Windows\System\ZBUnahS.exe
  2⤵
  PID:9360
- C:\Windows\System\QcYkqho.exe
  C:\Windows\System\QcYkqho.exe
  2⤵
  PID:9376
- C:\Windows\System\DUPHRJA.exe
  C:\Windows\System\DUPHRJA.exe
  2⤵
  PID:9392
- C:\Windows\System\PwyHUCj.exe
  C:\Windows\System\PwyHUCj.exe
  2⤵
  PID:9408
- C:\Windows\System\OmETpMe.exe
  C:\Windows\System\OmETpMe.exe
  2⤵
  PID:9424
- C:\Windows\System\mNnAPoS.exe
  C:\Windows\System\mNnAPoS.exe
  2⤵
  PID:9440
- C:\Windows\System\AGFFfLd.exe
  C:\Windows\System\AGFFfLd.exe
  2⤵
  PID:9456
- C:\Windows\System\zAGVwRq.exe
  C:\Windows\System\zAGVwRq.exe
  2⤵
  PID:9472
- C:\Windows\System\ygEQKng.exe
  C:\Windows\System\ygEQKng.exe
  2⤵
  PID:9488
- C:\Windows\System\uPFvoea.exe
  C:\Windows\System\uPFvoea.exe
  2⤵
  PID:9504
- C:\Windows\System\kQGiLGO.exe
  C:\Windows\System\kQGiLGO.exe
  2⤵
  PID:9524
- C:\Windows\System\oypSRvL.exe
  C:\Windows\System\oypSRvL.exe
  2⤵
  PID:9540
- C:\Windows\System\mwIcxDj.exe
  C:\Windows\System\mwIcxDj.exe
  2⤵
  PID:9556
- C:\Windows\System\uRbRAet.exe
  C:\Windows\System\uRbRAet.exe
  2⤵
  PID:9572
- C:\Windows\System\kgYuryd.exe
  C:\Windows\System\kgYuryd.exe
  2⤵
  PID:9588
- C:\Windows\System\MHxpGRT.exe
  C:\Windows\System\MHxpGRT.exe
  2⤵
  PID:9604
- C:\Windows\System\DIiavcY.exe
  C:\Windows\System\DIiavcY.exe
  2⤵
  PID:9620
- C:\Windows\System\vcVFKgv.exe
  C:\Windows\System\vcVFKgv.exe
  2⤵
  PID:9636
- C:\Windows\System\najbMWq.exe
  C:\Windows\System\najbMWq.exe
  2⤵
  PID:9652
- C:\Windows\System\SUatmqa.exe
  C:\Windows\System\SUatmqa.exe
  2⤵
  PID:9668
- C:\Windows\System\cwzgfDz.exe
  C:\Windows\System\cwzgfDz.exe
  2⤵
  PID:9684
- C:\Windows\System\LKjYgEJ.exe
  C:\Windows\System\LKjYgEJ.exe
  2⤵
  PID:9700
- C:\Windows\System\XQZQtBA.exe
  C:\Windows\System\XQZQtBA.exe
  2⤵
  PID:9716
- C:\Windows\System\gIyubRU.exe
  C:\Windows\System\gIyubRU.exe
  2⤵
  PID:9732
- C:\Windows\System\EPSfKwr.exe
  C:\Windows\System\EPSfKwr.exe
  2⤵
  PID:9748
- C:\Windows\System\kZTAliR.exe
  C:\Windows\System\kZTAliR.exe
  2⤵
  PID:9764
- C:\Windows\System\ZBOkCcU.exe
  C:\Windows\System\ZBOkCcU.exe
  2⤵
  PID:9780
- C:\Windows\System\ZwOPMaS.exe
  C:\Windows\System\ZwOPMaS.exe
  2⤵
  PID:9796
- C:\Windows\System\aYkSURB.exe
  C:\Windows\System\aYkSURB.exe
  2⤵
  PID:9812
- C:\Windows\System\vfkHWSq.exe
  C:\Windows\System\vfkHWSq.exe
  2⤵
  PID:9828
- C:\Windows\System\YelirVu.exe
  C:\Windows\System\YelirVu.exe
  2⤵
  PID:9848
- C:\Windows\System\coLBPbu.exe
  C:\Windows\System\coLBPbu.exe
  2⤵
  PID:9864
- C:\Windows\System\MxCXJrk.exe
  C:\Windows\System\MxCXJrk.exe
  2⤵
  PID:9880
- C:\Windows\System\fxQnUnD.exe
  C:\Windows\System\fxQnUnD.exe
  2⤵
  PID:9896
- C:\Windows\System\CifSbWS.exe
  C:\Windows\System\CifSbWS.exe
  2⤵
  PID:9912
- C:\Windows\System\UMOZnIF.exe
  C:\Windows\System\UMOZnIF.exe
  2⤵
  PID:9928
- C:\Windows\System\qFsXFRH.exe
  C:\Windows\System\qFsXFRH.exe
  2⤵
  PID:9944
- C:\Windows\System\kAFwtkR.exe
  C:\Windows\System\kAFwtkR.exe
  2⤵
  PID:9960
- C:\Windows\System\WjZFrXS.exe
  C:\Windows\System\WjZFrXS.exe
  2⤵
  PID:9976
- C:\Windows\System\IXGDyxb.exe
  C:\Windows\System\IXGDyxb.exe
  2⤵
  PID:9996
- C:\Windows\System\VhOpSuJ.exe
  C:\Windows\System\VhOpSuJ.exe
  2⤵
  PID:10012
- C:\Windows\System\VlvsGcd.exe
  C:\Windows\System\VlvsGcd.exe
  2⤵
  PID:10028
- C:\Windows\System\ERbukMZ.exe
  C:\Windows\System\ERbukMZ.exe
  2⤵
  PID:10044
- C:\Windows\System\cLAAEXG.exe
  C:\Windows\System\cLAAEXG.exe
  2⤵
  PID:10060
- C:\Windows\System\lyvmTJI.exe
  C:\Windows\System\lyvmTJI.exe
  2⤵
  PID:10076
- C:\Windows\System\NvUCoDZ.exe
  C:\Windows\System\NvUCoDZ.exe
  2⤵
  PID:10092
- C:\Windows\System\ybVMcid.exe
  C:\Windows\System\ybVMcid.exe
  2⤵
  PID:10108
- C:\Windows\System\DiLSIrW.exe
  C:\Windows\System\DiLSIrW.exe
  2⤵
  PID:10124
- C:\Windows\System\NUGdzGB.exe
  C:\Windows\System\NUGdzGB.exe
  2⤵
  PID:10140
- C:\Windows\System\euwOfcG.exe
  C:\Windows\System\euwOfcG.exe
  2⤵
  PID:10156
- C:\Windows\System\kffhCjV.exe
  C:\Windows\System\kffhCjV.exe
  2⤵
  PID:10176
- C:\Windows\System\KtjrDiN.exe
  C:\Windows\System\KtjrDiN.exe
  2⤵
  PID:10192
- C:\Windows\System\OIguPZk.exe
  C:\Windows\System\OIguPZk.exe
  2⤵
  PID:10208
- C:\Windows\System\vZZrrqc.exe
  C:\Windows\System\vZZrrqc.exe
  2⤵
  PID:10224
- C:\Windows\System\KauDIaX.exe
  C:\Windows\System\KauDIaX.exe
  2⤵
  PID:9240
- C:\Windows\System\KBOOAEN.exe
  C:\Windows\System\KBOOAEN.exe
  2⤵
  PID:9272
- C:\Windows\System\GHoBQbz.exe
  C:\Windows\System\GHoBQbz.exe
  2⤵
  PID:9308
- C:\Windows\System\RrZlaBg.exe
  C:\Windows\System\RrZlaBg.exe
  2⤵
  PID:9224
- C:\Windows\System\miXAKfX.exe
  C:\Windows\System\miXAKfX.exe
  2⤵
  PID:9292
- C:\Windows\System\UoBhgWx.exe
  C:\Windows\System\UoBhgWx.exe
  2⤵
  PID:9372
- C:\Windows\System\qDadZhI.exe
  C:\Windows\System\qDadZhI.exe
  2⤵
  PID:9432
- C:\Windows\System\TeOvOdg.exe
  C:\Windows\System\TeOvOdg.exe
  2⤵
  PID:9464
- C:\Windows\System\dQBKdHa.exe
  C:\Windows\System\dQBKdHa.exe
  2⤵
  PID:9500
- C:\Windows\System\wsyPKLz.exe
  C:\Windows\System\wsyPKLz.exe
  2⤵
  PID:9356
- C:\Windows\System\qWORbMZ.exe
  C:\Windows\System\qWORbMZ.exe
  2⤵
  PID:9448
- C:\Windows\System\IhHaFjf.exe
  C:\Windows\System\IhHaFjf.exe
  2⤵
  PID:9420
- C:\Windows\System\MBqNDlk.exe
  C:\Windows\System\MBqNDlk.exe
  2⤵
  PID:9484
- C:\Windows\System\uUSFEVX.exe
  C:\Windows\System\uUSFEVX.exe
  2⤵
  PID:9520
- C:\Windows\System\PAHqySP.exe
  C:\Windows\System\PAHqySP.exe
  2⤵
  PID:9612
- C:\Windows\System\oHqyCZh.exe
  C:\Windows\System\oHqyCZh.exe
  2⤵
  PID:9644
- C:\Windows\System\aVOadlG.exe
  C:\Windows\System\aVOadlG.exe
  2⤵
  PID:9648
- C:\Windows\System\BdBYpKP.exe
  C:\Windows\System\BdBYpKP.exe
  2⤵
  PID:9708
- C:\Windows\System\MJRxSKm.exe
  C:\Windows\System\MJRxSKm.exe
  2⤵
  PID:9756
- C:\Windows\System\UYzvMdh.exe
  C:\Windows\System\UYzvMdh.exe
  2⤵
  PID:9792
- C:\Windows\System\llKOvrr.exe
  C:\Windows\System\llKOvrr.exe
  2⤵
  PID:9824
- C:\Windows\System\WwGqhOw.exe
  C:\Windows\System\WwGqhOw.exe
  2⤵
  PID:9840
- C:\Windows\System\qoacrpk.exe
  C:\Windows\System\qoacrpk.exe
  2⤵
  PID:9860
- C:\Windows\System\nBQlJqW.exe
  C:\Windows\System\nBQlJqW.exe
  2⤵
  PID:9924
- C:\Windows\System\AZSBOZc.exe
  C:\Windows\System\AZSBOZc.exe
  2⤵
  PID:9952
- C:\Windows\System\NODonxT.exe
  C:\Windows\System\NODonxT.exe
  2⤵
  PID:9908
- C:\Windows\System\YYADgXj.exe
  C:\Windows\System\YYADgXj.exe
  2⤵
  PID:9968
- C:\Windows\System\uqpshNQ.exe
  C:\Windows\System\uqpshNQ.exe
  2⤵
  PID:10052
- C:\Windows\System\iutEoQN.exe
  C:\Windows\System\iutEoQN.exe
  2⤵
  PID:10072
- C:\Windows\System\iNlAIQR.exe
  C:\Windows\System\iNlAIQR.exe
  2⤵
  PID:10116
- C:\Windows\System\gxaEDPY.exe
  C:\Windows\System\gxaEDPY.exe
  2⤵
  PID:10100
- C:\Windows\System\IHnNXKQ.exe
  C:\Windows\System\IHnNXKQ.exe
  2⤵
  PID:10152
- C:\Windows\System\RbwBYUj.exe
  C:\Windows\System\RbwBYUj.exe
  2⤵
  PID:10188
- C:\Windows\System\iyumUej.exe
  C:\Windows\System\iyumUej.exe
  2⤵
  PID:10168
- C:\Windows\System\Fbkkihb.exe
  C:\Windows\System\Fbkkihb.exe
  2⤵
  PID:9164
- C:\Windows\System\LAvOiqX.exe
  C:\Windows\System\LAvOiqX.exe
  2⤵
  PID:9304
- C:\Windows\System\HgIabdz.exe
  C:\Windows\System\HgIabdz.exe
  2⤵
  PID:9256
- C:\Windows\System\ijZnJDY.exe
  C:\Windows\System\ijZnJDY.exe
  2⤵
  PID:9436
- C:\Windows\System\WtbXzKP.exe
  C:\Windows\System\WtbXzKP.exe
  2⤵
  PID:9468
- C:\Windows\System\oirHMIZ.exe
  C:\Windows\System\oirHMIZ.exe
  2⤵
  PID:9388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BFvqKPu.exe

Filesize
1.7MB

MD5
e0684ca2d569ea2fc67c5f4bd4472633

SHA1
ddd9c7c182c6e7ef5fd92e22dce143d6dd3ca1bf

SHA256
012bd1d31361463f23b2a53e5b4ab08f3a8841767b376b514382a4e1e2598489

SHA512
a129df3eecc99cad0e939b271554fc7a949272b3d2457c3cba62e261591328bb119be61a6181c7ba69dd86f571009cd90d7856f22ead918fa6a53b77ba262309

Download Submit
C:\Windows\system\CWQwLPy.exe

Filesize
1.7MB

MD5
47c16851263af512f7b8c13542de56d8

SHA1
b19ecc4a3581170529afbce8030eae8e0fa31de9

SHA256
5359a84ca58a46a105bba17a7105ff8c18e42c990728781c58a039b366dc59d3

SHA512
8a97ae127da6f7f5a26e94c5b57efad7d82732abe2f4d48bc0ec8664aa364a8593711cac23bd9383fd80f8f80485bcc7f49f7e6e49633bb2e27e078ebff01ace

Download Submit
C:\Windows\system\EijgNLM.exe

Filesize
1.7MB

MD5
8510f6c303e956b64fd03c3ac391d605

SHA1
607e03b07255fcb9d7f347ae7a3cea1d56cd3a94

SHA256
8381df03cf824fd94bd6116095ae699bf981faf959b73f6e1296c7e99fcdf8d7

SHA512
ffc09e75250f4994d2bfead94529948ed8bcd5f35ddf2edac34a493cbd6ef6cabc676891e51aea8d7a9621c6169c040896f48abca79af8bd213f1866129aeff1

Download Submit
C:\Windows\system\Ezogpcq.exe

Filesize
1.7MB

MD5
91b738cd10b89bda7aafa92dad14c394

SHA1
78def3ac11eb69d80638c7bd6b0761e2b5f6262a

SHA256
d8805be28360e68c0556925d98f109fedf44db4dec17c4f687c59131ba61dbe1

SHA512
22ba78d9b674719f07fddec1797db49f4f50c47398b05ce8e539bf1d5bfb5bdccc2ec5bafdb011db47dc5647b0ee2b6a3dde3f2098f107363a5feb292ac685d7

Download Submit
C:\Windows\system\LBkDswF.exe

Filesize
1.7MB

MD5
63e1be6b7a83394d0261cf5edaf32fbd

SHA1
15798e5c62ced62459bfbcde63cc38f62b951357

SHA256
c5292e92a58abda47f2b023ce491ebd1fd0f0baeef4618df8a5c116e5a29e377

SHA512
6438d627acd8ba0e9ea168262f707ca0904464c19ab491022c120cea10f6c7e6f5e9c1e572055550d9537fbd967b8fc5602e162922178a98720b5601870a762b

Download Submit
C:\Windows\system\LkJXaKp.exe

Filesize
1.7MB

MD5
b0714b02be2d2dd221a1f1ae7823edba

SHA1
671437b852f0fe801e71a1502a8c36e75bb159c5

SHA256
87f183c3333a344f670eb713fa88338a739f7a749438a4e3d584af171c8e9bde

SHA512
9ddf0325a8c6dc3c67c3818744e644d3152844f4368b9bb121b6ea0de87db3b9043eb66909eadf281157a5254b1862660c0b7ce204c2568acea30720398e2f38

Download Submit
C:\Windows\system\OxmzKkm.exe

Filesize
1.7MB

MD5
3fad83a306191210aa13423e74726009

SHA1
f72807f5d6675ec2da4443b7b1b0240c5d060174

SHA256
cd91e875bd533c99c4b82f32452cfc76f1ad7d39ee8670210f783bc03f498e34

SHA512
25ac6fd26b547dcd197b70d8220f32e5c7cff161ffaa4167f2979810a9a62fad2bb0c6b9f4e44c45eb1b3f42a856c87971f4b4f58764976554773f42c66d3877

Download Submit
C:\Windows\system\RJTTuSC.exe

Filesize
1.7MB

MD5
f937bf8341ecc12bbf0be1d2ecfc067a

SHA1
bb499bbb8d1a156969d8157f0249f6dcca4cc765

SHA256
c23f51bf654028660e1100482e77988da8a646e921bc974be89b4be2967f5ca7

SHA512
2afecf3119af41e136821002d958be137ff2e4b35a4870ec4d1fc4354a33df53f4f2e1cdc322a3a4d2ced4d33659a7363788abc9faf402ed23deb17ef1a727a9

Download Submit
C:\Windows\system\STIRtVC.exe

Filesize
1.7MB

MD5
60cc65ed044055ecaab2821250b6a8bc

SHA1
a2d1b5cb0c92549420dea0f9591dc60926634f0b

SHA256
15d7ec7febc5ff033024f1adbd836d0b400fb8c0596d8b63c82633716af00369

SHA512
c5118a95a4ec3e007a20877da7d03264932ee7270dea3cd04daa8e5c00a09ec3cd2e37dde44da381c68b3a061d636ef499f77234fbf031439f0d17fe166bee1d

Download Submit
C:\Windows\system\TOrqrgl.exe

Filesize
1.7MB

MD5
93aaea106661c0c90eda1ce769af92cc

SHA1
93f418be771af88a3370a0e87e6ba8c24e9589de

SHA256
3bd39d052ade5c91b90262140fd0f400892a912217460e784a1541a9b95ea3dd

SHA512
1b36e80890f2f63202b75dc328d0247647a03d2c7942b3e8ad6218269bacf7db1e546da6eb2d1f6e66b7aa0f3280b42a85ff001e753f26c2c3867be2290c37ea

Download Submit
C:\Windows\system\TjzONDy.exe

Filesize
1.7MB

MD5
3964bfeaba47c9b90ae580c8bd4901cc

SHA1
972eaaa5f6eefde8c076255599d469a636ce51e1

SHA256
3f3796e1418e6c6c6685634ecc01b33b2e1fd7ce79285ede10a98289b6a86e3f

SHA512
85a733813582e12dee31d35d9769cd79d904ecd8b395f3c74301054a1fe0535c6751c6d21ac646f14868706826530a9bbe59943ded94ae81ca0cd6ab25ea2c2e

Download Submit
C:\Windows\system\TsSXbBP.exe

Filesize
1.7MB

MD5
cd97c2f2c4ca6c9e59a3f85f4b3d9b53

SHA1
784740fa09691b9382dd9b8f4bd935b7604487bf

SHA256
b49ee2563a9f06f97faca45fe87d3c8357f93ce7d0380bff8a055c61bc0087a6

SHA512
f469ef2ff7d7cffba74f8cb2c2f634e1caa5641a767422fdb785af48f66690c19f83805885f5d5c5dde420258a7324f9b45b98d6c425f112e9481481c4e15500

Download Submit
C:\Windows\system\UCJbLVM.exe

Filesize
1.7MB

MD5
fa13ba1306453e6887c47b5109f94dc2

SHA1
ea095f2bc7993cbe451e66429346e233b621af5f

SHA256
ee5894d3858ce0d190de3f5e881051a1f3d1150082cbe253a6fee85e05f13e07

SHA512
9c5d09a63195b18e5814beb8c70f5f45269ff83ad548d1ffc65c81ac9db760ebb74553ae7090d2d60a170d2492a80c87fe9200cf1936dd1694ee213fc52c2749

Download Submit
C:\Windows\system\YSUELfj.exe

Filesize
1.7MB

MD5
5ac5e292d126b5b4ab8073661413b391

SHA1
2d38132a1a2aede6d9850f2e8d5a0ab27080750b

SHA256
af0474f1cfbe011df18cd2e52b7c4746dfaef4ee8cc33796f76e103c4cc28da7

SHA512
7aea312559c1c1d0be11f895b1f74a11f8b41047e7afadde8f727b17de6f9e01d6a6e33755301fbd291895c4925af9fd82bf93ff38f5bce59566e7a7c3aab6a0

Download Submit
C:\Windows\system\aqSKPOZ.exe

Filesize
1.7MB

MD5
e0018777e6f62403de14eecf72eaf085

SHA1
c2e1e6405f36b404af44e6001811ca7d643f5f4e

SHA256
07db8f785668294d0644e81689ef0003bce6762a9898c173cc15cba5a9140e91

SHA512
7c3f916b276e1284c9564123147b5d6daa6a8c7f64177506e07b9ec08546dd96be04c7b518cf9ef617cb35235dc80857addf057f31b1056ec1047eb2c059e754

Download Submit
C:\Windows\system\cvneRgH.exe

Filesize
1.7MB

MD5
68844df5cba8a2240415ce226ae80db0

SHA1
d04d32fdd2c9fcc625018b60970721ff915ab82f

SHA256
df8387e3c3e6f040bc38a503afeedac0185dfa40fb483adfedb560990a2b5317

SHA512
cd954c1d90d186f074ab9de436cff89079305d0bc76f5ae476fcfb5b31473253494529d8969bdcaeefcb956045d5bf0a60115840ad2260d3e6a5b43556d82ced

Download Submit
C:\Windows\system\eBGzKdA.exe

Filesize
1.7MB

MD5
63073a64ebfa1d18ee394e637f0128fb

SHA1
2972b27340c47b2edd60b93451103f57c37a3080

SHA256
0b3a79ae4378f4e69e5e87e4afcddb815d18cdbb3f33bf26460f687165e7b63b

SHA512
39ab8e2826966ca42ae17d51154e7b93adecb657cb762e0362be2d22375143f26227ea4672192d0355a57fea4f5c8369dddc14135062ecaa59de507db3d601b9

Download Submit
C:\Windows\system\gFKDVsm.exe

Filesize
1.7MB

MD5
5fb8e934248642be3c9f7f7d205d798c

SHA1
1f6f0f8816842da1133f1ca8bfcf67df23a710f9

SHA256
30d9b9157a1d2d6f99f45645fac44f0c94d17700cec64bd6404727a924c67f79

SHA512
b71ef5f32ee40e96822723ff412bf47048f0cb797652b4a26565978107cec26c0ddbe9a0f5ae3e3b64466529a3836acb69c94ab2d6cd178871307ee0275318a7

Download Submit
C:\Windows\system\iIRizdb.exe

Filesize
1.7MB

MD5
b00df61fe8b5be8b8d003721695d707a

SHA1
28035a27a94a0b2a0d076e66402876b3b5fbde46

SHA256
33e94a6e642f7d56dd940f383d6459c680355d9c729b4e8fc3ee9fe8d83cf8da

SHA512
12e25611f3c5f4462a2170ab676b903576ebd4852c40cd7bf8333d4d69780b0bba5b6406997ec49287795e21b42e1fc124fa2f4cfe6b7f9cbe1cd1f985c31d4c

Download Submit
C:\Windows\system\ilRBJpa.exe

Filesize
1.7MB

MD5
b406f92e3a4688d10a2b73bca16c2ced

SHA1
15993c4a5be995913a8fb796b1160e01bf3e804c

SHA256
4644aa41bfc0c929c64ed029888e948841050a312e5a1153d2c4cf15a62d323f

SHA512
8c9ce7d0c6c9daf5afd758fab5afaef822ec0b251141263dbeade969aa86941e69d273ddfac81b3fc5c506096390fed135b6ca41f9b7214f4366b8530c4c8cf4

Download Submit
C:\Windows\system\jUMVHah.exe

Filesize
1.7MB

MD5
3fd45444572cb01c0b1e528fa8f0c911

SHA1
c41f822d10cf3f757b447ebbf47d7d0eca3fb166

SHA256
0aff79dc25314a5ed66c53db05c0ef1fd79db6856236edfbada80d11a2564267

SHA512
0fe71e8aeb5cd57010194492427df71ed392377c78ca8a4513cc1b75f2bf5fc967d94d4bd82b388303d15e65cc257fe22aa207d109399bf47380b147530765c1

Download Submit
C:\Windows\system\mozMYrZ.exe

Filesize
1.7MB

MD5
ab3cb1d008324d36641018f6647d2378

SHA1
76400a1ed1ec62c55fa2a0f134b4e79e69c251fc

SHA256
3a02222f9b0558fea82986bb69cfc8ad2b3647c2d4d45182aff79ce9efa80ce2

SHA512
4e8cd3d6b6078b5181492b9e39b7e207a0d14bf26d17107c85815b371aed5eaee2117d0c5f427d438ac536d43bca546788bd7b01548e9f5e87f3723f61997b78

Download Submit
C:\Windows\system\pZJpxYR.exe

Filesize
1.7MB

MD5
631254e5af43dbcd8f92d4340a15316f

SHA1
f503f04ac4800ae87931045c96b1ee5ef3316925

SHA256
603e26b7047629e2b5e8643604d0c7774475e28e95f5e2fe5c8d161c7e80bd21

SHA512
ebed622e9348b88363f6df7a147ef357125846297c6d1fcc813a5b8c4263e2cac86cc2a807d4a00c07eace689a068d9bb4598eef7478323753d024f749082191

Download Submit
C:\Windows\system\rxsdVMr.exe

Filesize
1.7MB

MD5
6142c40225b37b3726e95be0f81ebced

SHA1
27eb5809b51caa3fe817a8114ff2f37d4a93a63f

SHA256
3b35a3cd8dfa4c3807d4cb754de38f8a9de65f74119e6166c6f939f947d13400

SHA512
6bd663e96d1105c6e0fbcef81a958e59f2857d386c28228b2f5f341c32d3faf1828732b59364a2c9ff7553d652e73264c099ff64e09a866fd702ae0b903c2226

Download Submit
C:\Windows\system\tDYhXIh.exe

Filesize
1.7MB

MD5
a4f09a1a2c59bbef8e6376efbd4fc9a8

SHA1
030fc0a18f65b3811bf02ac13000bc972c55f693

SHA256
b869f1d1ac100d46a49366586248fa44e70b5bb7c1094f5813988c5bd633b4eb

SHA512
28cf424588ecea95d9c92454e9ae6a34fb58ece2caa3d9474a342ef8a74b278e37fca54cf692aeb79d6f1b487b2146d300edc47e6a2a90f03cc35c7a81868fa2

Download Submit
C:\Windows\system\wFOQkhO.exe

Filesize
1.7MB

MD5
08af400b4bced53fb5bfef51f6a4a447

SHA1
84b12ddd9c30bca7eb57b61b4d6afc124c5f09f3

SHA256
52675934f54e10a2407307f51752358fef6d18b0749ad2808a9f63183ca180b2

SHA512
9313219a398a9ac80b4557f0551907f63d6d200050aebf147e270a2852f009cfbf222ccaf8962aea5774a2e467e2c7fc6822c2b88b86e9857e028059091c5025

Download Submit
C:\Windows\system\xuAbeBe.exe

Filesize
1.7MB

MD5
bc0259baedd9f256775160e810110051

SHA1
761963bd52965f0ba400f92917b451d98f4e8da4

SHA256
ea5a4f1175387a118bff6978f83f32cede151bd8e082f3559046001214d31eab

SHA512
4ec749f457e651537cdf64a3fe85460b3580469da67a279139f95aedd95c6db9639cd730d165011707ee97fb07a8435121eb4849e4d8198597f18c93b80f4108

Download Submit
C:\Windows\system\xyHBrCz.exe

Filesize
1.7MB

MD5
2e7b3c11f8edb08c60f08f75523d11a7

SHA1
6653ea6b4782b2ebd4409ff466595b3bc5516cc8

SHA256
ccf48e519e9b47e8a6f319ff29133b058e9d2bec189be9b6c4ad2d7d81127845

SHA512
a507134192460ee3f9258d1f319606586206390f7b849b71ffdba4efc4f5110769baaeff71f20a33a75cb940313ee07fed826d71b10fe90939cb089d2bdd0956

Download Submit
C:\Windows\system\zeyIPVy.exe

Filesize
1.7MB

MD5
3a1ae10842d5fa98cad6054015043559

SHA1
d1370bd350293f918da17364fdda9607dc7542e2

SHA256
735e3f01e53a52cfa0d8954b31f2ee85f22b2edca9eeeb10ad648c44656f33da

SHA512
1c3dfe8a9f8e4fcff8b6f990ca5761e563e829204466eaa2ccbd8521c9a7f7fdd90eaa0e8404195991311d736c1767ac93c7a8c770485fa016f9d7bab5050bb2

Download Submit
C:\Windows\system\zlOIUMx.exe

Filesize
1.7MB

MD5
51acd485c16389b04dc21b5c08874d06

SHA1
9493294348c69fdd322c5590a33a57fad13c45ac

SHA256
a911a0eb4cc67d7de56d1e8737559b4bd7d625d005bfc59621795da7b5a5f3c5

SHA512
e60e5ea16f5aa1673a0a02eb70e61aca730249195583b145c94476184436ccaa817fc93798c05159fd42112fce332581402e1f219a6339012d732a5067fda210

Download Submit
\Windows\system\XEYihov.exe

Filesize
1.7MB

MD5
b0a9b696f588665c1eeca72346ea093e

SHA1
4d07d2b1613dee37ff74a34f9cdb9009f49a67f8

SHA256
4181fa7e352c9fc0a449554aaf7a094e63d6222a859c929b6348d6d8453cb021

SHA512
049ebd544c41cca76f846d68c8e86b3a137879a648582a7ee8c52b3966451c236b271ab46f6f9ceddd7f588c6098556668355e76ee9ecf6956fc5de667c24665

Download Submit
\Windows\system\vVlSQlP.exe

Filesize
1.7MB

MD5
774ff0a0e3b7c2cb47887ca2329ce889

SHA1
91967bef29faaf187cbc837eaa33019fef8850d2

SHA256
3249c37f4c4e2c7803893b72a2a4196c51ff7dc247dddcad075fa57bc9b3046b

SHA512
84868126816665452c8ae8fad044bdef6617ca2d6839249f65b14b2d3f4f5e0ab02fd1afe7434d3ccd6712a7ba9b52ceccbd0f7d3618c88decee0ab623215853

Download Submit
memory/1732-142-0x000000013F990000-0x000000013FD82000-memory.dmp

Filesize
3.9MB

Download
memory/1732-5081-0x000000013F990000-0x000000013FD82000-memory.dmp

Filesize
3.9MB

Download
memory/2128-17-0x0000000003010000-0x0000000003402000-memory.dmp

Filesize
3.9MB

Download
memory/2128-1265-0x000000013F0E0000-0x000000013F4D2000-memory.dmp

Filesize
3.9MB

Download
memory/2128-0-0x000000013F0E0000-0x000000013F4D2000-memory.dmp

Filesize
3.9MB

Download
memory/2128-8-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2128-141-0x000000013F990000-0x000000013FD82000-memory.dmp

Filesize
3.9MB

Download
memory/2128-127-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/2128-139-0x000000013F660000-0x000000013FA52000-memory.dmp

Filesize
3.9MB

Download
memory/2128-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2128-137-0x000000013F670000-0x000000013FA62000-memory.dmp

Filesize
3.9MB

Download
memory/2128-129-0x000000013FC10000-0x0000000140002000-memory.dmp

Filesize
3.9MB

Download
memory/2128-135-0x000000013FE30000-0x0000000140222000-memory.dmp

Filesize
3.9MB

Download
memory/2128-24-0x0000000003010000-0x0000000003402000-memory.dmp

Filesize
3.9MB

Download
memory/2128-133-0x000000013F850000-0x000000013FC42000-memory.dmp

Filesize
3.9MB

Download
memory/2128-143-0x000000013FB70000-0x000000013FF62000-memory.dmp

Filesize
3.9MB

Download
memory/2128-131-0x0000000003240000-0x0000000003632000-memory.dmp

Filesize
3.9MB

Download
memory/2456-132-0x000000013F0E0000-0x000000013F4D2000-memory.dmp

Filesize
3.9MB

Download
memory/2456-5025-0x000000013F0E0000-0x000000013F4D2000-memory.dmp

Filesize
3.9MB

Download
memory/2540-126-0x000000013FB70000-0x000000013FF62000-memory.dmp

Filesize
3.9MB

Download
memory/2540-5162-0x000000013FB70000-0x000000013FF62000-memory.dmp

Filesize
3.9MB

Download
memory/2584-5023-0x000000013F660000-0x000000013FA52000-memory.dmp

Filesize
3.9MB

Download
memory/2584-140-0x000000013F660000-0x000000013FA52000-memory.dmp

Filesize
3.9MB

Download
memory/2608-4775-0x000000013FC10000-0x0000000140002000-memory.dmp

Filesize
3.9MB

Download
memory/2608-130-0x000000013FC10000-0x0000000140002000-memory.dmp

Filesize
3.9MB

Download
memory/2668-5032-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/2668-128-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/2736-5028-0x000000013F480000-0x000000013F872000-memory.dmp

Filesize
3.9MB

Download
memory/2736-27-0x000000013F480000-0x000000013F872000-memory.dmp

Filesize
3.9MB

Download
memory/2756-28-0x0000000002C90000-0x0000000002D10000-memory.dmp

Filesize
512KB

Download
memory/2756-282-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp

Filesize
9.6MB

Download
memory/2756-145-0x0000000002780000-0x0000000002788000-memory.dmp

Filesize
32KB

Download
memory/2756-144-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

Filesize
2.9MB

Download
memory/2756-29-0x000007FEF587E000-0x000007FEF587F000-memory.dmp

Filesize
4KB

Download
memory/2756-125-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp

Filesize
9.6MB

Download
memory/2796-5093-0x000000013F050000-0x000000013F442000-memory.dmp

Filesize
3.9MB

Download
memory/2796-19-0x000000013F050000-0x000000013F442000-memory.dmp

Filesize
3.9MB

Download
memory/2820-5027-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2820-9-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2840-5091-0x000000013F850000-0x000000013FC42000-memory.dmp

Filesize
3.9MB

Download
memory/2840-134-0x000000013F850000-0x000000013FC42000-memory.dmp

Filesize
3.9MB

Download
memory/2892-5026-0x000000013FE30000-0x0000000140222000-memory.dmp

Filesize
3.9MB

Download
memory/2892-136-0x000000013FE30000-0x0000000140222000-memory.dmp

Filesize
3.9MB

Download
memory/2904-138-0x000000013F670000-0x000000013FA62000-memory.dmp

Filesize
3.9MB

Download
memory/2904-5144-0x000000013F670000-0x000000013FA62000-memory.dmp

Filesize
3.9MB

Download