xmrig | 1e40af59069f4075086b4554507562e6ceae52cc1687c4fcd9a0a30cbaf655e7

Analysis

max time kernel
116s
max time network
127s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 15:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27fa828604b3f93a3241b73b74019ae0N.exe
Size

1.9MB
MD5

27fa828604b3f93a3241b73b74019ae0
SHA1

b63dcb801844978f51718d42f919362326e90a53
SHA256

1e40af59069f4075086b4554507562e6ceae52cc1687c4fcd9a0a30cbaf655e7
SHA512

2505edbc9e2d5ebae0223fefe7566e604941c4f843ee72e9dc970922fcb58fd0ea463f16646eb4136659e3270f65d14be6b2163332db51a44dcaae34581021c2
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTd7mCsY2YWIJJh6Egf/px:Lz071uv4BPMkFfdk2auTxw5x

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 26 IoCs

miner

resource	yara_rule
behavioral1/memory/2744-9-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	xmrig
behavioral1/memory/2296-16-0x000000013F9D0000-0x000000013FDC2000-memory.dmp	xmrig
behavioral1/memory/2796-26-0x000000013FF30000-0x0000000140322000-memory.dmp	xmrig
behavioral1/memory/1988-88-0x000000013F710000-0x000000013FB02000-memory.dmp	xmrig
behavioral1/memory/2348-87-0x0000000003210000-0x0000000003602000-memory.dmp	xmrig
behavioral1/memory/2076-80-0x000000013F370000-0x000000013F762000-memory.dmp	xmrig
behavioral1/memory/2348-86-0x000000013F4A0000-0x000000013F892000-memory.dmp	xmrig
behavioral1/memory/2492-75-0x000000013FEE0000-0x00000001402D2000-memory.dmp	xmrig
behavioral1/memory/2904-94-0x000000013F1B0000-0x000000013F5A2000-memory.dmp	xmrig
behavioral1/memory/2348-237-0x000000013F4A0000-0x000000013F892000-memory.dmp	xmrig
behavioral1/memory/1728-66-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	xmrig
behavioral1/memory/388-56-0x000000013FA30000-0x000000013FE22000-memory.dmp	xmrig
behavioral1/memory/2652-49-0x000000013FA10000-0x000000013FE02000-memory.dmp	xmrig
behavioral1/memory/2684-43-0x000000013F860000-0x000000013FC52000-memory.dmp	xmrig
behavioral1/memory/2680-668-0x000000013F790000-0x000000013FB82000-memory.dmp	xmrig
behavioral1/memory/2744-1279-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	xmrig
behavioral1/memory/2796-1290-0x000000013FF30000-0x0000000140322000-memory.dmp	xmrig
behavioral1/memory/388-1358-0x000000013FA30000-0x000000013FE22000-memory.dmp	xmrig
behavioral1/memory/2652-1364-0x000000013FA10000-0x000000013FE02000-memory.dmp	xmrig
behavioral1/memory/2680-1396-0x000000013F790000-0x000000013FB82000-memory.dmp	xmrig
behavioral1/memory/2492-1409-0x000000013FEE0000-0x00000001402D2000-memory.dmp	xmrig
behavioral1/memory/1728-1414-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	xmrig
behavioral1/memory/1988-1420-0x000000013F710000-0x000000013FB02000-memory.dmp	xmrig
behavioral1/memory/2904-1436-0x000000013F1B0000-0x000000013F5A2000-memory.dmp	xmrig
behavioral1/memory/2076-1437-0x000000013F370000-0x000000013F762000-memory.dmp	xmrig
behavioral1/memory/2684-1439-0x000000013F860000-0x000000013FC52000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
972	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2744	TfsqyYA.exe
2296	vqDSjFV.exe
2796	aurIclD.exe
2684	QCqGfRM.exe
2652	AKvfAum.exe
388	UzrpvwA.exe
2680	oYUsdVi.exe
1728	JsVeGBm.exe
2492	noZvCfr.exe
2076	GXUqdGs.exe
1988	qhieWcW.exe
2904	cjFkuTw.exe
2984	gpvyrCP.exe
3056	UYgmtpJ.exe
784	wfEQEnd.exe
3032	WoNCqeT.exe
1984	ibHHFxP.exe
2424	QEBIeZU.exe
1708	VwiQNmW.exe
1752	DOCPTUj.exe
2824	yhkyXYV.exe
2464	bVplvJi.exe
2272	eJSvETk.exe
2188	qJhqpUK.exe
2244	lpKADTc.exe
2536	xkkbkpS.exe
2484	XsFYurh.exe
2160	dJLOknP.exe
2156	xErdFlR.exe
2024	oPxJuli.exe
640	TTyZnbJ.exe
1996	qfQnksK.exe
1716	iJHJnPJ.exe
1012	YDDMOrj.exe
1528	lFNInkR.exe
840	ykiXJzZ.exe
3036	qrPlABW.exe
2148	qNuBahU.exe
908	hlzxrYV.exe
1956	XrqCHJE.exe
2460	sfBulPd.exe
1816	lZVuAQe.exe
2192	JXcTSVj.exe
1256	NndJPop.exe
2380	UVNleYr.exe
1216	oKpQUQU.exe
924	KjiYhBt.exe
2972	GYBbwVI.exe
1116	srakQVt.exe
1652	mzhrxqz.exe
2740	qxGppqz.exe
2248	sgGFDwh.exe
2792	EdPhOIJ.exe
2852	jJZaoTI.exe
2828	SQVVGay.exe
2700	ltuhtUu.exe
2756	LfPbydk.exe
2520	xsuNZFN.exe
2704	jMXvxjw.exe
1168	fEbzVSC.exe
1048	lhVUgva.exe
2688	avVxOTd.exe
2636	bxsBtuC.exe
3040	IotfxgB.exe

Loads dropped DLL 64 IoCs

pid	Process
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe
2348	27fa828604b3f93a3241b73b74019ae0N.exe

UPX packed file 59 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2348-0-0x000000013F4A0000-0x000000013F892000-memory.dmp	upx
behavioral1/files/0x000c000000014132-3.dat	upx
behavioral1/memory/2744-9-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	upx
behavioral1/files/0x0008000000018b4d-10.dat	upx
behavioral1/memory/2296-16-0x000000013F9D0000-0x000000013FDC2000-memory.dmp	upx
behavioral1/files/0x0006000000018b54-12.dat	upx
behavioral1/memory/2796-26-0x000000013FF30000-0x0000000140322000-memory.dmp	upx
behavioral1/files/0x0007000000018b62-32.dat	upx
behavioral1/files/0x001000000000558f-31.dat	upx
behavioral1/files/0x0006000000018b6e-57.dat	upx
behavioral1/memory/2680-58-0x000000013F790000-0x000000013FB82000-memory.dmp	upx
behavioral1/files/0x0008000000018bac-62.dat	upx
behavioral1/files/0x0006000000018f82-72.dat	upx
behavioral1/memory/1988-88-0x000000013F710000-0x000000013FB02000-memory.dmp	upx
behavioral1/memory/2076-80-0x000000013F370000-0x000000013F762000-memory.dmp	upx
behavioral1/memory/2348-86-0x000000013F4A0000-0x000000013F892000-memory.dmp	upx
behavioral1/files/0x0005000000018fe4-83.dat	upx
behavioral1/memory/2492-75-0x000000013FEE0000-0x00000001402D2000-memory.dmp	upx
behavioral1/files/0x0005000000019078-91.dat	upx
behavioral1/memory/2904-94-0x000000013F1B0000-0x000000013F5A2000-memory.dmp	upx
behavioral1/files/0x0004000000019206-97.dat	upx
behavioral1/files/0x00040000000192a8-102.dat	upx
behavioral1/files/0x0004000000019438-117.dat	upx
behavioral1/files/0x0004000000019461-122.dat	upx
behavioral1/files/0x0005000000019575-140.dat	upx
behavioral1/files/0x00050000000196af-157.dat	upx
behavioral1/files/0x000500000001a056-167.dat	upx
behavioral1/files/0x000500000001a1e8-172.dat	upx
behavioral1/files/0x000500000001a1f1-182.dat	upx
behavioral1/files/0x000500000001a201-192.dat	upx
behavioral1/memory/2348-237-0x000000013F4A0000-0x000000013F892000-memory.dmp	upx
behavioral1/files/0x000500000001a1fe-187.dat	upx
behavioral1/files/0x000500000001a1ee-177.dat	upx
behavioral1/files/0x0005000000019f50-162.dat	upx
behavioral1/files/0x000500000001966c-153.dat	upx
behavioral1/files/0x000500000001962f-146.dat	upx
behavioral1/files/0x0005000000019571-137.dat	upx
behavioral1/files/0x00040000000194ec-132.dat	upx
behavioral1/files/0x0004000000019485-126.dat	upx
behavioral1/files/0x0004000000019380-112.dat	upx
behavioral1/files/0x00040000000192ad-107.dat	upx
behavioral1/memory/1728-66-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	upx
behavioral1/files/0x0007000000018bbf-70.dat	upx
behavioral1/memory/388-56-0x000000013FA30000-0x000000013FE22000-memory.dmp	upx
behavioral1/files/0x0006000000018b89-52.dat	upx
behavioral1/memory/2652-49-0x000000013FA10000-0x000000013FE02000-memory.dmp	upx
behavioral1/memory/2684-43-0x000000013F860000-0x000000013FC52000-memory.dmp	upx
behavioral1/memory/2680-668-0x000000013F790000-0x000000013FB82000-memory.dmp	upx
behavioral1/memory/2744-1279-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	upx
behavioral1/memory/2796-1290-0x000000013FF30000-0x0000000140322000-memory.dmp	upx
behavioral1/memory/388-1358-0x000000013FA30000-0x000000013FE22000-memory.dmp	upx
behavioral1/memory/2652-1364-0x000000013FA10000-0x000000013FE02000-memory.dmp	upx
behavioral1/memory/2680-1396-0x000000013F790000-0x000000013FB82000-memory.dmp	upx
behavioral1/memory/2492-1409-0x000000013FEE0000-0x00000001402D2000-memory.dmp	upx
behavioral1/memory/1728-1414-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	upx
behavioral1/memory/1988-1420-0x000000013F710000-0x000000013FB02000-memory.dmp	upx
behavioral1/memory/2904-1436-0x000000013F1B0000-0x000000013F5A2000-memory.dmp	upx
behavioral1/memory/2076-1437-0x000000013F370000-0x000000013F762000-memory.dmp	upx
behavioral1/memory/2684-1439-0x000000013F860000-0x000000013FC52000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\MSBrbSc.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\HjFGbOY.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\VYjYNzF.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\yqYMLZb.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\ABfVQoi.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\xbHsSmf.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\aebJfxK.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\LvFEQMn.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\GUWdnCA.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\UiqkUpx.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\JRsmlMY.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\shbhdXT.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\HJXfURH.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\RMDvVBi.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\YPemHMG.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\tdhhkvg.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\RywQKrK.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\dtSuLzo.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\WhYXotg.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\XVavWlM.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\enwqSXx.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\aJTqpct.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\tKBtVsM.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\FxddvTG.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\BBazzEY.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\QkHVxpK.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\LVuYmVH.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\sASJQER.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\TtEXkfS.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\pUUlWxe.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\DdRQJQz.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\eoDSsTa.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\zdhDmrk.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\xsVQUdL.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\mqowpTc.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\ePcbMmC.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\UzrpvwA.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\TiCJuPp.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\sxdJjxo.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\UVNleYr.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\UBPpqrT.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\zFOqhEu.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\HAcWLGg.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\NlZUurZ.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\figYpeS.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\qCVCcul.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\vGglPZh.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\igncCWu.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\UkaWZyV.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\bjjoJTS.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\NVosYIq.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\ofZPGUm.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\mdbBtqW.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\fnsBMsr.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\alyhwJP.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\QUMeXrK.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\wuIJeRR.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\pfMNFVd.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\KwXeCzZ.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\LslNHiG.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\ROYGaGE.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\TRwXAar.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\YFULnMk.exe	27fa828604b3f93a3241b73b74019ae0N.exe
File created	C:\Windows\System\emeBswX.exe	27fa828604b3f93a3241b73b74019ae0N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
972	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2348	27fa828604b3f93a3241b73b74019ae0N.exe
Token: SeLockMemoryPrivilege	2348	27fa828604b3f93a3241b73b74019ae0N.exe
Token: SeDebugPrivilege	972	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 972	2348	27fa828604b3f93a3241b73b74019ae0N.exe	30
PID 2348 wrote to memory of 972	2348	27fa828604b3f93a3241b73b74019ae0N.exe	30
PID 2348 wrote to memory of 972	2348	27fa828604b3f93a3241b73b74019ae0N.exe	30
PID 2348 wrote to memory of 2744	2348	27fa828604b3f93a3241b73b74019ae0N.exe	31
PID 2348 wrote to memory of 2744	2348	27fa828604b3f93a3241b73b74019ae0N.exe	31
PID 2348 wrote to memory of 2744	2348	27fa828604b3f93a3241b73b74019ae0N.exe	31
PID 2348 wrote to memory of 2296	2348	27fa828604b3f93a3241b73b74019ae0N.exe	32
PID 2348 wrote to memory of 2296	2348	27fa828604b3f93a3241b73b74019ae0N.exe	32
PID 2348 wrote to memory of 2296	2348	27fa828604b3f93a3241b73b74019ae0N.exe	32
PID 2348 wrote to memory of 2796	2348	27fa828604b3f93a3241b73b74019ae0N.exe	33
PID 2348 wrote to memory of 2796	2348	27fa828604b3f93a3241b73b74019ae0N.exe	33
PID 2348 wrote to memory of 2796	2348	27fa828604b3f93a3241b73b74019ae0N.exe	33
PID 2348 wrote to memory of 2684	2348	27fa828604b3f93a3241b73b74019ae0N.exe	34
PID 2348 wrote to memory of 2684	2348	27fa828604b3f93a3241b73b74019ae0N.exe	34
PID 2348 wrote to memory of 2684	2348	27fa828604b3f93a3241b73b74019ae0N.exe	34
PID 2348 wrote to memory of 2652	2348	27fa828604b3f93a3241b73b74019ae0N.exe	35
PID 2348 wrote to memory of 2652	2348	27fa828604b3f93a3241b73b74019ae0N.exe	35
PID 2348 wrote to memory of 2652	2348	27fa828604b3f93a3241b73b74019ae0N.exe	35
PID 2348 wrote to memory of 2680	2348	27fa828604b3f93a3241b73b74019ae0N.exe	36
PID 2348 wrote to memory of 2680	2348	27fa828604b3f93a3241b73b74019ae0N.exe	36
PID 2348 wrote to memory of 2680	2348	27fa828604b3f93a3241b73b74019ae0N.exe	36
PID 2348 wrote to memory of 388	2348	27fa828604b3f93a3241b73b74019ae0N.exe	37
PID 2348 wrote to memory of 388	2348	27fa828604b3f93a3241b73b74019ae0N.exe	37
PID 2348 wrote to memory of 388	2348	27fa828604b3f93a3241b73b74019ae0N.exe	37
PID 2348 wrote to memory of 1728	2348	27fa828604b3f93a3241b73b74019ae0N.exe	38
PID 2348 wrote to memory of 1728	2348	27fa828604b3f93a3241b73b74019ae0N.exe	38
PID 2348 wrote to memory of 1728	2348	27fa828604b3f93a3241b73b74019ae0N.exe	38
PID 2348 wrote to memory of 2492	2348	27fa828604b3f93a3241b73b74019ae0N.exe	39
PID 2348 wrote to memory of 2492	2348	27fa828604b3f93a3241b73b74019ae0N.exe	39
PID 2348 wrote to memory of 2492	2348	27fa828604b3f93a3241b73b74019ae0N.exe	39
PID 2348 wrote to memory of 2076	2348	27fa828604b3f93a3241b73b74019ae0N.exe	40
PID 2348 wrote to memory of 2076	2348	27fa828604b3f93a3241b73b74019ae0N.exe	40
PID 2348 wrote to memory of 2076	2348	27fa828604b3f93a3241b73b74019ae0N.exe	40
PID 2348 wrote to memory of 1988	2348	27fa828604b3f93a3241b73b74019ae0N.exe	41
PID 2348 wrote to memory of 1988	2348	27fa828604b3f93a3241b73b74019ae0N.exe	41
PID 2348 wrote to memory of 1988	2348	27fa828604b3f93a3241b73b74019ae0N.exe	41
PID 2348 wrote to memory of 2904	2348	27fa828604b3f93a3241b73b74019ae0N.exe	42
PID 2348 wrote to memory of 2904	2348	27fa828604b3f93a3241b73b74019ae0N.exe	42
PID 2348 wrote to memory of 2904	2348	27fa828604b3f93a3241b73b74019ae0N.exe	42
PID 2348 wrote to memory of 2984	2348	27fa828604b3f93a3241b73b74019ae0N.exe	43
PID 2348 wrote to memory of 2984	2348	27fa828604b3f93a3241b73b74019ae0N.exe	43
PID 2348 wrote to memory of 2984	2348	27fa828604b3f93a3241b73b74019ae0N.exe	43
PID 2348 wrote to memory of 3056	2348	27fa828604b3f93a3241b73b74019ae0N.exe	44
PID 2348 wrote to memory of 3056	2348	27fa828604b3f93a3241b73b74019ae0N.exe	44
PID 2348 wrote to memory of 3056	2348	27fa828604b3f93a3241b73b74019ae0N.exe	44
PID 2348 wrote to memory of 784	2348	27fa828604b3f93a3241b73b74019ae0N.exe	45
PID 2348 wrote to memory of 784	2348	27fa828604b3f93a3241b73b74019ae0N.exe	45
PID 2348 wrote to memory of 784	2348	27fa828604b3f93a3241b73b74019ae0N.exe	45
PID 2348 wrote to memory of 3032	2348	27fa828604b3f93a3241b73b74019ae0N.exe	46
PID 2348 wrote to memory of 3032	2348	27fa828604b3f93a3241b73b74019ae0N.exe	46
PID 2348 wrote to memory of 3032	2348	27fa828604b3f93a3241b73b74019ae0N.exe	46
PID 2348 wrote to memory of 1984	2348	27fa828604b3f93a3241b73b74019ae0N.exe	47
PID 2348 wrote to memory of 1984	2348	27fa828604b3f93a3241b73b74019ae0N.exe	47
PID 2348 wrote to memory of 1984	2348	27fa828604b3f93a3241b73b74019ae0N.exe	47
PID 2348 wrote to memory of 2424	2348	27fa828604b3f93a3241b73b74019ae0N.exe	48
PID 2348 wrote to memory of 2424	2348	27fa828604b3f93a3241b73b74019ae0N.exe	48
PID 2348 wrote to memory of 2424	2348	27fa828604b3f93a3241b73b74019ae0N.exe	48
PID 2348 wrote to memory of 1708	2348	27fa828604b3f93a3241b73b74019ae0N.exe	49
PID 2348 wrote to memory of 1708	2348	27fa828604b3f93a3241b73b74019ae0N.exe	49
PID 2348 wrote to memory of 1708	2348	27fa828604b3f93a3241b73b74019ae0N.exe	49
PID 2348 wrote to memory of 1752	2348	27fa828604b3f93a3241b73b74019ae0N.exe	50
PID 2348 wrote to memory of 1752	2348	27fa828604b3f93a3241b73b74019ae0N.exe	50
PID 2348 wrote to memory of 1752	2348	27fa828604b3f93a3241b73b74019ae0N.exe	50
PID 2348 wrote to memory of 2824	2348	27fa828604b3f93a3241b73b74019ae0N.exe	51

C:\Users\Admin\AppData\Local\Temp\27fa828604b3f93a3241b73b74019ae0N.exe
"C:\Users\Admin\AppData\Local\Temp\27fa828604b3f93a3241b73b74019ae0N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:972
- C:\Windows\System\TfsqyYA.exe
  C:\Windows\System\TfsqyYA.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\vqDSjFV.exe
  C:\Windows\System\vqDSjFV.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\aurIclD.exe
  C:\Windows\System\aurIclD.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\QCqGfRM.exe
  C:\Windows\System\QCqGfRM.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\AKvfAum.exe
  C:\Windows\System\AKvfAum.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\oYUsdVi.exe
  C:\Windows\System\oYUsdVi.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\UzrpvwA.exe
  C:\Windows\System\UzrpvwA.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\JsVeGBm.exe
  C:\Windows\System\JsVeGBm.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\noZvCfr.exe
  C:\Windows\System\noZvCfr.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\GXUqdGs.exe
  C:\Windows\System\GXUqdGs.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\qhieWcW.exe
  C:\Windows\System\qhieWcW.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\cjFkuTw.exe
  C:\Windows\System\cjFkuTw.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\gpvyrCP.exe
  C:\Windows\System\gpvyrCP.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\UYgmtpJ.exe
  C:\Windows\System\UYgmtpJ.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\wfEQEnd.exe
  C:\Windows\System\wfEQEnd.exe
  2⤵
  - Executes dropped EXE
  PID:784
- C:\Windows\System\WoNCqeT.exe
  C:\Windows\System\WoNCqeT.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\ibHHFxP.exe
  C:\Windows\System\ibHHFxP.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\QEBIeZU.exe
  C:\Windows\System\QEBIeZU.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\VwiQNmW.exe
  C:\Windows\System\VwiQNmW.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\DOCPTUj.exe
  C:\Windows\System\DOCPTUj.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\yhkyXYV.exe
  C:\Windows\System\yhkyXYV.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\bVplvJi.exe
  C:\Windows\System\bVplvJi.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\eJSvETk.exe
  C:\Windows\System\eJSvETk.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\qJhqpUK.exe
  C:\Windows\System\qJhqpUK.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\lpKADTc.exe
  C:\Windows\System\lpKADTc.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\xkkbkpS.exe
  C:\Windows\System\xkkbkpS.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\XsFYurh.exe
  C:\Windows\System\XsFYurh.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\dJLOknP.exe
  C:\Windows\System\dJLOknP.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\xErdFlR.exe
  C:\Windows\System\xErdFlR.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\oPxJuli.exe
  C:\Windows\System\oPxJuli.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\TTyZnbJ.exe
  C:\Windows\System\TTyZnbJ.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\qfQnksK.exe
  C:\Windows\System\qfQnksK.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\iJHJnPJ.exe
  C:\Windows\System\iJHJnPJ.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\YDDMOrj.exe
  C:\Windows\System\YDDMOrj.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\lFNInkR.exe
  C:\Windows\System\lFNInkR.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\ykiXJzZ.exe
  C:\Windows\System\ykiXJzZ.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\qrPlABW.exe
  C:\Windows\System\qrPlABW.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\qNuBahU.exe
  C:\Windows\System\qNuBahU.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\hlzxrYV.exe
  C:\Windows\System\hlzxrYV.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\XrqCHJE.exe
  C:\Windows\System\XrqCHJE.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\sfBulPd.exe
  C:\Windows\System\sfBulPd.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\lZVuAQe.exe
  C:\Windows\System\lZVuAQe.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\JXcTSVj.exe
  C:\Windows\System\JXcTSVj.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\NndJPop.exe
  C:\Windows\System\NndJPop.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\UVNleYr.exe
  C:\Windows\System\UVNleYr.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\oKpQUQU.exe
  C:\Windows\System\oKpQUQU.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\KjiYhBt.exe
  C:\Windows\System\KjiYhBt.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\srakQVt.exe
  C:\Windows\System\srakQVt.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\GYBbwVI.exe
  C:\Windows\System\GYBbwVI.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\mzhrxqz.exe
  C:\Windows\System\mzhrxqz.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\qxGppqz.exe
  C:\Windows\System\qxGppqz.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\sgGFDwh.exe
  C:\Windows\System\sgGFDwh.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\EdPhOIJ.exe
  C:\Windows\System\EdPhOIJ.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\jJZaoTI.exe
  C:\Windows\System\jJZaoTI.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\SQVVGay.exe
  C:\Windows\System\SQVVGay.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\ltuhtUu.exe
  C:\Windows\System\ltuhtUu.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\LfPbydk.exe
  C:\Windows\System\LfPbydk.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\jMXvxjw.exe
  C:\Windows\System\jMXvxjw.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\xsuNZFN.exe
  C:\Windows\System\xsuNZFN.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\fEbzVSC.exe
  C:\Windows\System\fEbzVSC.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\lhVUgva.exe
  C:\Windows\System\lhVUgva.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\avVxOTd.exe
  C:\Windows\System\avVxOTd.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\bxsBtuC.exe
  C:\Windows\System\bxsBtuC.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\IotfxgB.exe
  C:\Windows\System\IotfxgB.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\pXxJLyM.exe
  C:\Windows\System\pXxJLyM.exe
  2⤵
  PID:2216
- C:\Windows\System\ToTTbBJ.exe
  C:\Windows\System\ToTTbBJ.exe
  2⤵
  PID:2444
- C:\Windows\System\bclQnEP.exe
  C:\Windows\System\bclQnEP.exe
  2⤵
  PID:2204
- C:\Windows\System\hJtOuUT.exe
  C:\Windows\System\hJtOuUT.exe
  2⤵
  PID:2572
- C:\Windows\System\qvDSAog.exe
  C:\Windows\System\qvDSAog.exe
  2⤵
  PID:2264
- C:\Windows\System\QFFzJtY.exe
  C:\Windows\System\QFFzJtY.exe
  2⤵
  PID:2452
- C:\Windows\System\CsVXCyP.exe
  C:\Windows\System\CsVXCyP.exe
  2⤵
  PID:2676
- C:\Windows\System\FDOQSDc.exe
  C:\Windows\System\FDOQSDc.exe
  2⤵
  PID:2412
- C:\Windows\System\HxQuJbx.exe
  C:\Windows\System\HxQuJbx.exe
  2⤵
  PID:616
- C:\Windows\System\LozrpbM.exe
  C:\Windows\System\LozrpbM.exe
  2⤵
  PID:1360
- C:\Windows\System\RYqPuBu.exe
  C:\Windows\System\RYqPuBu.exe
  2⤵
  PID:2032
- C:\Windows\System\TteNSTd.exe
  C:\Windows\System\TteNSTd.exe
  2⤵
  PID:1792
- C:\Windows\System\aRkhOGP.exe
  C:\Windows\System\aRkhOGP.exe
  2⤵
  PID:1588
- C:\Windows\System\NlZUurZ.exe
  C:\Windows\System\NlZUurZ.exe
  2⤵
  PID:1948
- C:\Windows\System\zfdPWmB.exe
  C:\Windows\System\zfdPWmB.exe
  2⤵
  PID:2084
- C:\Windows\System\iiuHlln.exe
  C:\Windows\System\iiuHlln.exe
  2⤵
  PID:2196
- C:\Windows\System\NDwcvLg.exe
  C:\Windows\System\NDwcvLg.exe
  2⤵
  PID:1712
- C:\Windows\System\wHvkfuY.exe
  C:\Windows\System\wHvkfuY.exe
  2⤵
  PID:336
- C:\Windows\System\csFQFQR.exe
  C:\Windows\System\csFQFQR.exe
  2⤵
  PID:2400
- C:\Windows\System\ojKCZFG.exe
  C:\Windows\System\ojKCZFG.exe
  2⤵
  PID:864
- C:\Windows\System\DNltYKy.exe
  C:\Windows\System\DNltYKy.exe
  2⤵
  PID:2884
- C:\Windows\System\djpuXSi.exe
  C:\Windows\System\djpuXSi.exe
  2⤵
  PID:2644
- C:\Windows\System\LPAjgii.exe
  C:\Windows\System\LPAjgii.exe
  2⤵
  PID:1644
- C:\Windows\System\alsKHPV.exe
  C:\Windows\System\alsKHPV.exe
  2⤵
  PID:2728
- C:\Windows\System\cTBBLlt.exe
  C:\Windows\System\cTBBLlt.exe
  2⤵
  PID:1020
- C:\Windows\System\PnyvjEc.exe
  C:\Windows\System\PnyvjEc.exe
  2⤵
  PID:2616
- C:\Windows\System\nYEEWfa.exe
  C:\Windows\System\nYEEWfa.exe
  2⤵
  PID:1520
- C:\Windows\System\zXzpuRb.exe
  C:\Windows\System\zXzpuRb.exe
  2⤵
  PID:2948
- C:\Windows\System\LISGXuC.exe
  C:\Windows\System\LISGXuC.exe
  2⤵
  PID:2800
- C:\Windows\System\IVLdYFV.exe
  C:\Windows\System\IVLdYFV.exe
  2⤵
  PID:2768
- C:\Windows\System\vLDeCqr.exe
  C:\Windows\System\vLDeCqr.exe
  2⤵
  PID:2736
- C:\Windows\System\AweWrPG.exe
  C:\Windows\System\AweWrPG.exe
  2⤵
  PID:2920
- C:\Windows\System\AnFOaYf.exe
  C:\Windows\System\AnFOaYf.exe
  2⤵
  PID:1252
- C:\Windows\System\JtJHsPy.exe
  C:\Windows\System\JtJHsPy.exe
  2⤵
  PID:2220
- C:\Windows\System\sntyxHk.exe
  C:\Windows\System\sntyxHk.exe
  2⤵
  PID:2340
- C:\Windows\System\gpyMGhS.exe
  C:\Windows\System\gpyMGhS.exe
  2⤵
  PID:264
- C:\Windows\System\QVTTdaN.exe
  C:\Windows\System\QVTTdaN.exe
  2⤵
  PID:2152
- C:\Windows\System\XUzeAVx.exe
  C:\Windows\System\XUzeAVx.exe
  2⤵
  PID:2428
- C:\Windows\System\aaQZCvl.exe
  C:\Windows\System\aaQZCvl.exe
  2⤵
  PID:2208
- C:\Windows\System\hOlmlbV.exe
  C:\Windows\System\hOlmlbV.exe
  2⤵
  PID:324
- C:\Windows\System\vYyEoNM.exe
  C:\Windows\System\vYyEoNM.exe
  2⤵
  PID:684
- C:\Windows\System\KQkusYb.exe
  C:\Windows\System\KQkusYb.exe
  2⤵
  PID:2592
- C:\Windows\System\vPYgrNk.exe
  C:\Windows\System\vPYgrNk.exe
  2⤵
  PID:1692
- C:\Windows\System\zcEpzJm.exe
  C:\Windows\System\zcEpzJm.exe
  2⤵
  PID:2168
- C:\Windows\System\UoMSwAP.exe
  C:\Windows\System\UoMSwAP.exe
  2⤵
  PID:2888
- C:\Windows\System\AvxRRcw.exe
  C:\Windows\System\AvxRRcw.exe
  2⤵
  PID:548
- C:\Windows\System\hhUcVjz.exe
  C:\Windows\System\hhUcVjz.exe
  2⤵
  PID:1800
- C:\Windows\System\kaEhzai.exe
  C:\Windows\System\kaEhzai.exe
  2⤵
  PID:1732
- C:\Windows\System\uWzBPbs.exe
  C:\Windows\System\uWzBPbs.exe
  2⤵
  PID:436
- C:\Windows\System\DdRQJQz.exe
  C:\Windows\System\DdRQJQz.exe
  2⤵
  PID:2096
- C:\Windows\System\zlmXokg.exe
  C:\Windows\System\zlmXokg.exe
  2⤵
  PID:760
- C:\Windows\System\pUUlWxe.exe
  C:\Windows\System\pUUlWxe.exe
  2⤵
  PID:1056
- C:\Windows\System\ZeMsANs.exe
  C:\Windows\System\ZeMsANs.exe
  2⤵
  PID:2480
- C:\Windows\System\RliQODT.exe
  C:\Windows\System\RliQODT.exe
  2⤵
  PID:1920
- C:\Windows\System\ByaQxzU.exe
  C:\Windows\System\ByaQxzU.exe
  2⤵
  PID:1672
- C:\Windows\System\ftPQuXP.exe
  C:\Windows\System\ftPQuXP.exe
  2⤵
  PID:2228
- C:\Windows\System\NJJfitC.exe
  C:\Windows\System\NJJfitC.exe
  2⤵
  PID:2352
- C:\Windows\System\BBBbNMP.exe
  C:\Windows\System\BBBbNMP.exe
  2⤵
  PID:1724
- C:\Windows\System\cZZpdzv.exe
  C:\Windows\System\cZZpdzv.exe
  2⤵
  PID:2868
- C:\Windows\System\LerdekC.exe
  C:\Windows\System\LerdekC.exe
  2⤵
  PID:2980
- C:\Windows\System\Zxfrksi.exe
  C:\Windows\System\Zxfrksi.exe
  2⤵
  PID:2748
- C:\Windows\System\IVqdzxB.exe
  C:\Windows\System\IVqdzxB.exe
  2⤵
  PID:2280
- C:\Windows\System\DwhfphS.exe
  C:\Windows\System\DwhfphS.exe
  2⤵
  PID:1888
- C:\Windows\System\OXzdClR.exe
  C:\Windows\System\OXzdClR.exe
  2⤵
  PID:2436
- C:\Windows\System\oTsLsyz.exe
  C:\Windows\System\oTsLsyz.exe
  2⤵
  PID:2624
- C:\Windows\System\eyggjeL.exe
  C:\Windows\System\eyggjeL.exe
  2⤵
  PID:108
- C:\Windows\System\gpbIMfd.exe
  C:\Windows\System\gpbIMfd.exe
  2⤵
  PID:1392
- C:\Windows\System\fQGTBOG.exe
  C:\Windows\System\fQGTBOG.exe
  2⤵
  PID:2252
- C:\Windows\System\sBTMNfg.exe
  C:\Windows\System\sBTMNfg.exe
  2⤵
  PID:1092
- C:\Windows\System\SuYxNUW.exe
  C:\Windows\System\SuYxNUW.exe
  2⤵
  PID:2976
- C:\Windows\System\hOQXQOK.exe
  C:\Windows\System\hOQXQOK.exe
  2⤵
  PID:2040
- C:\Windows\System\lFzKLCo.exe
  C:\Windows\System\lFzKLCo.exe
  2⤵
  PID:1668
- C:\Windows\System\hWcvjzc.exe
  C:\Windows\System\hWcvjzc.exe
  2⤵
  PID:1260
- C:\Windows\System\IMaUCJL.exe
  C:\Windows\System\IMaUCJL.exe
  2⤵
  PID:2544
- C:\Windows\System\fVKwPbk.exe
  C:\Windows\System\fVKwPbk.exe
  2⤵
  PID:2088
- C:\Windows\System\uGMwedm.exe
  C:\Windows\System\uGMwedm.exe
  2⤵
  PID:1572
- C:\Windows\System\MTdgDDi.exe
  C:\Windows\System\MTdgDDi.exe
  2⤵
  PID:2836
- C:\Windows\System\MGkMfxp.exe
  C:\Windows\System\MGkMfxp.exe
  2⤵
  PID:2956
- C:\Windows\System\mUkYMjx.exe
  C:\Windows\System\mUkYMjx.exe
  2⤵
  PID:1928
- C:\Windows\System\pzfRoUN.exe
  C:\Windows\System\pzfRoUN.exe
  2⤵
  PID:2856
- C:\Windows\System\OXuzroW.exe
  C:\Windows\System\OXuzroW.exe
  2⤵
  PID:2968
- C:\Windows\System\KxaPywD.exe
  C:\Windows\System\KxaPywD.exe
  2⤵
  PID:2308
- C:\Windows\System\igncCWu.exe
  C:\Windows\System\igncCWu.exe
  2⤵
  PID:1720
- C:\Windows\System\VNxzhed.exe
  C:\Windows\System\VNxzhed.exe
  2⤵
  PID:2260
- C:\Windows\System\zkeZnRK.exe
  C:\Windows\System\zkeZnRK.exe
  2⤵
  PID:2236
- C:\Windows\System\TkzJCuq.exe
  C:\Windows\System\TkzJCuq.exe
  2⤵
  PID:1820
- C:\Windows\System\cyYlSQY.exe
  C:\Windows\System\cyYlSQY.exe
  2⤵
  PID:1292
- C:\Windows\System\KwXeCzZ.exe
  C:\Windows\System\KwXeCzZ.exe
  2⤵
  PID:2716
- C:\Windows\System\cCWwSeC.exe
  C:\Windows\System\cCWwSeC.exe
  2⤵
  PID:2808
- C:\Windows\System\YFULnMk.exe
  C:\Windows\System\YFULnMk.exe
  2⤵
  PID:2780
- C:\Windows\System\NnsAmAJ.exe
  C:\Windows\System\NnsAmAJ.exe
  2⤵
  PID:2844
- C:\Windows\System\JaKKKIH.exe
  C:\Windows\System\JaKKKIH.exe
  2⤵
  PID:2596
- C:\Windows\System\oXaWiMl.exe
  C:\Windows\System\oXaWiMl.exe
  2⤵
  PID:2516
- C:\Windows\System\BDKgVbs.exe
  C:\Windows\System\BDKgVbs.exe
  2⤵
  PID:1084
- C:\Windows\System\cMOsTId.exe
  C:\Windows\System\cMOsTId.exe
  2⤵
  PID:1832
- C:\Windows\System\OVpAoKr.exe
  C:\Windows\System\OVpAoKr.exe
  2⤵
  PID:2052
- C:\Windows\System\QiSEBAA.exe
  C:\Windows\System\QiSEBAA.exe
  2⤵
  PID:2060
- C:\Windows\System\hynmzoQ.exe
  C:\Windows\System\hynmzoQ.exe
  2⤵
  PID:2432
- C:\Windows\System\SzurBHK.exe
  C:\Windows\System\SzurBHK.exe
  2⤵
  PID:1760
- C:\Windows\System\izRvaWj.exe
  C:\Windows\System\izRvaWj.exe
  2⤵
  PID:2116
- C:\Windows\System\NpbBiHm.exe
  C:\Windows\System\NpbBiHm.exe
  2⤵
  PID:2548
- C:\Windows\System\VYjYNzF.exe
  C:\Windows\System\VYjYNzF.exe
  2⤵
  PID:880
- C:\Windows\System\HonnjAM.exe
  C:\Windows\System\HonnjAM.exe
  2⤵
  PID:2588
- C:\Windows\System\ybsiFSZ.exe
  C:\Windows\System\ybsiFSZ.exe
  2⤵
  PID:1160
- C:\Windows\System\UZerqai.exe
  C:\Windows\System\UZerqai.exe
  2⤵
  PID:1596
- C:\Windows\System\WVbTmYq.exe
  C:\Windows\System\WVbTmYq.exe
  2⤵
  PID:1576
- C:\Windows\System\UmRpVxz.exe
  C:\Windows\System\UmRpVxz.exe
  2⤵
  PID:2916
- C:\Windows\System\dSZSPQr.exe
  C:\Windows\System\dSZSPQr.exe
  2⤵
  PID:2496
- C:\Windows\System\XKHzXhB.exe
  C:\Windows\System\XKHzXhB.exe
  2⤵
  PID:2672
- C:\Windows\System\dpvYYSI.exe
  C:\Windows\System\dpvYYSI.exe
  2⤵
  PID:2892
- C:\Windows\System\lnMyEcl.exe
  C:\Windows\System\lnMyEcl.exe
  2⤵
  PID:844
- C:\Windows\System\WctCnnx.exe
  C:\Windows\System\WctCnnx.exe
  2⤵
  PID:1740
- C:\Windows\System\oZKMVzr.exe
  C:\Windows\System\oZKMVzr.exe
  2⤵
  PID:944
- C:\Windows\System\jOxQGeh.exe
  C:\Windows\System\jOxQGeh.exe
  2⤵
  PID:1980
- C:\Windows\System\rEbIEfI.exe
  C:\Windows\System\rEbIEfI.exe
  2⤵
  PID:1592
- C:\Windows\System\PfkPMMH.exe
  C:\Windows\System\PfkPMMH.exe
  2⤵
  PID:3092
- C:\Windows\System\MSBrbSc.exe
  C:\Windows\System\MSBrbSc.exe
  2⤵
  PID:3112
- C:\Windows\System\EtlobKZ.exe
  C:\Windows\System\EtlobKZ.exe
  2⤵
  PID:3132
- C:\Windows\System\ERtQcar.exe
  C:\Windows\System\ERtQcar.exe
  2⤵
  PID:3160
- C:\Windows\System\kvApADT.exe
  C:\Windows\System\kvApADT.exe
  2⤵
  PID:3176
- C:\Windows\System\HEFxErr.exe
  C:\Windows\System\HEFxErr.exe
  2⤵
  PID:3196
- C:\Windows\System\xUfPSjX.exe
  C:\Windows\System\xUfPSjX.exe
  2⤵
  PID:3220
- C:\Windows\System\KmxFGeU.exe
  C:\Windows\System\KmxFGeU.exe
  2⤵
  PID:3236
- C:\Windows\System\ARpduNK.exe
  C:\Windows\System\ARpduNK.exe
  2⤵
  PID:3260
- C:\Windows\System\jjoZKOJ.exe
  C:\Windows\System\jjoZKOJ.exe
  2⤵
  PID:3276
- C:\Windows\System\EkdKINs.exe
  C:\Windows\System\EkdKINs.exe
  2⤵
  PID:3296
- C:\Windows\System\MrRaEzS.exe
  C:\Windows\System\MrRaEzS.exe
  2⤵
  PID:3316
- C:\Windows\System\YtivnWb.exe
  C:\Windows\System\YtivnWb.exe
  2⤵
  PID:3336
- C:\Windows\System\tUdSoRL.exe
  C:\Windows\System\tUdSoRL.exe
  2⤵
  PID:3356
- C:\Windows\System\cFYRIbn.exe
  C:\Windows\System\cFYRIbn.exe
  2⤵
  PID:3376
- C:\Windows\System\LMpgXvB.exe
  C:\Windows\System\LMpgXvB.exe
  2⤵
  PID:3400
- C:\Windows\System\acCWDaJ.exe
  C:\Windows\System\acCWDaJ.exe
  2⤵
  PID:3420
- C:\Windows\System\UHLqwyL.exe
  C:\Windows\System\UHLqwyL.exe
  2⤵
  PID:3444
- C:\Windows\System\wkRMjyd.exe
  C:\Windows\System\wkRMjyd.exe
  2⤵
  PID:3464
- C:\Windows\System\pMCcZZC.exe
  C:\Windows\System\pMCcZZC.exe
  2⤵
  PID:3480
- C:\Windows\System\MaBcVpn.exe
  C:\Windows\System\MaBcVpn.exe
  2⤵
  PID:3500
- C:\Windows\System\QkHVxpK.exe
  C:\Windows\System\QkHVxpK.exe
  2⤵
  PID:3520
- C:\Windows\System\LvFEQMn.exe
  C:\Windows\System\LvFEQMn.exe
  2⤵
  PID:3540
- C:\Windows\System\HVDRmOM.exe
  C:\Windows\System\HVDRmOM.exe
  2⤵
  PID:3560
- C:\Windows\System\jJckZyg.exe
  C:\Windows\System\jJckZyg.exe
  2⤵
  PID:3580
- C:\Windows\System\AoqKhIr.exe
  C:\Windows\System\AoqKhIr.exe
  2⤵
  PID:3600
- C:\Windows\System\AMpRWMh.exe
  C:\Windows\System\AMpRWMh.exe
  2⤵
  PID:3620
- C:\Windows\System\KtJbFfF.exe
  C:\Windows\System\KtJbFfF.exe
  2⤵
  PID:3640
- C:\Windows\System\XOtyJUh.exe
  C:\Windows\System\XOtyJUh.exe
  2⤵
  PID:3660
- C:\Windows\System\MJLXzgo.exe
  C:\Windows\System\MJLXzgo.exe
  2⤵
  PID:3680
- C:\Windows\System\IRExuys.exe
  C:\Windows\System\IRExuys.exe
  2⤵
  PID:3704
- C:\Windows\System\oGRnBFh.exe
  C:\Windows\System\oGRnBFh.exe
  2⤵
  PID:3720
- C:\Windows\System\bnmOBcY.exe
  C:\Windows\System\bnmOBcY.exe
  2⤵
  PID:3740
- C:\Windows\System\WZvkiYA.exe
  C:\Windows\System\WZvkiYA.exe
  2⤵
  PID:3760
- C:\Windows\System\fnsBMsr.exe
  C:\Windows\System\fnsBMsr.exe
  2⤵
  PID:3776
- C:\Windows\System\alyhwJP.exe
  C:\Windows\System\alyhwJP.exe
  2⤵
  PID:3792
- C:\Windows\System\dtSuLzo.exe
  C:\Windows\System\dtSuLzo.exe
  2⤵
  PID:3808
- C:\Windows\System\qxdpESw.exe
  C:\Windows\System\qxdpESw.exe
  2⤵
  PID:3824
- C:\Windows\System\MKyWNZC.exe
  C:\Windows\System\MKyWNZC.exe
  2⤵
  PID:3844
- C:\Windows\System\HJXfURH.exe
  C:\Windows\System\HJXfURH.exe
  2⤵
  PID:3860
- C:\Windows\System\UBPpqrT.exe
  C:\Windows\System\UBPpqrT.exe
  2⤵
  PID:3876
- C:\Windows\System\oxRfqfi.exe
  C:\Windows\System\oxRfqfi.exe
  2⤵
  PID:3900
- C:\Windows\System\LKkDBNz.exe
  C:\Windows\System\LKkDBNz.exe
  2⤵
  PID:3920
- C:\Windows\System\VlHEIhA.exe
  C:\Windows\System\VlHEIhA.exe
  2⤵
  PID:3936
- C:\Windows\System\fArOGSW.exe
  C:\Windows\System\fArOGSW.exe
  2⤵
  PID:3952
- C:\Windows\System\hZMEqSq.exe
  C:\Windows\System\hZMEqSq.exe
  2⤵
  PID:3968
- C:\Windows\System\dBesHBn.exe
  C:\Windows\System\dBesHBn.exe
  2⤵
  PID:3988
- C:\Windows\System\TiCJuPp.exe
  C:\Windows\System\TiCJuPp.exe
  2⤵
  PID:4004
- C:\Windows\System\ORBPmNQ.exe
  C:\Windows\System\ORBPmNQ.exe
  2⤵
  PID:4020
- C:\Windows\System\RMDvVBi.exe
  C:\Windows\System\RMDvVBi.exe
  2⤵
  PID:4040
- C:\Windows\System\MkpIxAa.exe
  C:\Windows\System\MkpIxAa.exe
  2⤵
  PID:4056
- C:\Windows\System\mrDjAFs.exe
  C:\Windows\System\mrDjAFs.exe
  2⤵
  PID:4072
- C:\Windows\System\rfkNlBq.exe
  C:\Windows\System\rfkNlBq.exe
  2⤵
  PID:2036
- C:\Windows\System\dcEMTJI.exe
  C:\Windows\System\dcEMTJI.exe
  2⤵
  PID:3184
- C:\Windows\System\ZmaPZcU.exe
  C:\Windows\System\ZmaPZcU.exe
  2⤵
  PID:3212
- C:\Windows\System\FjRdQyz.exe
  C:\Windows\System\FjRdQyz.exe
  2⤵
  PID:3232
- C:\Windows\System\JVBRFSE.exe
  C:\Windows\System\JVBRFSE.exe
  2⤵
  PID:3248
- C:\Windows\System\FWPDHjU.exe
  C:\Windows\System\FWPDHjU.exe
  2⤵
  PID:3292
- C:\Windows\System\orHEvfY.exe
  C:\Windows\System\orHEvfY.exe
  2⤵
  PID:3312
- C:\Windows\System\KrPRakY.exe
  C:\Windows\System\KrPRakY.exe
  2⤵
  PID:3344
- C:\Windows\System\EZrbwdK.exe
  C:\Windows\System\EZrbwdK.exe
  2⤵
  PID:3372
- C:\Windows\System\WVcVWuT.exe
  C:\Windows\System\WVcVWuT.exe
  2⤵
  PID:3452
- C:\Windows\System\yeaRNsN.exe
  C:\Windows\System\yeaRNsN.exe
  2⤵
  PID:3476
- C:\Windows\System\mdbBtqW.exe
  C:\Windows\System\mdbBtqW.exe
  2⤵
  PID:3516
- C:\Windows\System\KUOTFqw.exe
  C:\Windows\System\KUOTFqw.exe
  2⤵
  PID:3532
- C:\Windows\System\HULuckb.exe
  C:\Windows\System\HULuckb.exe
  2⤵
  PID:3568
- C:\Windows\System\AGHdvkI.exe
  C:\Windows\System\AGHdvkI.exe
  2⤵
  PID:3592
- C:\Windows\System\VdbnxQN.exe
  C:\Windows\System\VdbnxQN.exe
  2⤵
  PID:3628
- C:\Windows\System\QTOTHPZ.exe
  C:\Windows\System\QTOTHPZ.exe
  2⤵
  PID:3656
- C:\Windows\System\LHzFKIJ.exe
  C:\Windows\System\LHzFKIJ.exe
  2⤵
  PID:3688
- C:\Windows\System\BiZWUiW.exe
  C:\Windows\System\BiZWUiW.exe
  2⤵
  PID:3696
- C:\Windows\System\HlIoAFK.exe
  C:\Windows\System\HlIoAFK.exe
  2⤵
  PID:3732
- C:\Windows\System\OdJCaVW.exe
  C:\Windows\System\OdJCaVW.exe
  2⤵
  PID:3768
- C:\Windows\System\ZQBfdBN.exe
  C:\Windows\System\ZQBfdBN.exe
  2⤵
  PID:3836
- C:\Windows\System\lfuQDEX.exe
  C:\Windows\System\lfuQDEX.exe
  2⤵
  PID:3840
- C:\Windows\System\LSXXqXW.exe
  C:\Windows\System\LSXXqXW.exe
  2⤵
  PID:4048
- C:\Windows\System\MtBZlBU.exe
  C:\Windows\System\MtBZlBU.exe
  2⤵
  PID:3916
- C:\Windows\System\yqdOXuv.exe
  C:\Windows\System\yqdOXuv.exe
  2⤵
  PID:3984
- C:\Windows\System\JsgxnYS.exe
  C:\Windows\System\JsgxnYS.exe
  2⤵
  PID:4084
- C:\Windows\System\SqUruok.exe
  C:\Windows\System\SqUruok.exe
  2⤵
  PID:3084
- C:\Windows\System\iFXTnxs.exe
  C:\Windows\System\iFXTnxs.exe
  2⤵
  PID:4068
- C:\Windows\System\LPrUTmb.exe
  C:\Windows\System\LPrUTmb.exe
  2⤵
  PID:3892
- C:\Windows\System\wXMUdSb.exe
  C:\Windows\System\wXMUdSb.exe
  2⤵
  PID:4032
- C:\Windows\System\eTOiNPt.exe
  C:\Windows\System\eTOiNPt.exe
  2⤵
  PID:3124
- C:\Windows\System\SWqqxkn.exe
  C:\Windows\System\SWqqxkn.exe
  2⤵
  PID:3252
- C:\Windows\System\cjQFJOZ.exe
  C:\Windows\System\cjQFJOZ.exe
  2⤵
  PID:3168
- C:\Windows\System\GtsYITB.exe
  C:\Windows\System\GtsYITB.exe
  2⤵
  PID:3172
- C:\Windows\System\LDwtOyK.exe
  C:\Windows\System\LDwtOyK.exe
  2⤵
  PID:3412
- C:\Windows\System\yITijBV.exe
  C:\Windows\System\yITijBV.exe
  2⤵
  PID:3472
- C:\Windows\System\YYwQTey.exe
  C:\Windows\System\YYwQTey.exe
  2⤵
  PID:3572
- C:\Windows\System\VLloQrq.exe
  C:\Windows\System\VLloQrq.exe
  2⤵
  PID:3588
- C:\Windows\System\YupHxKZ.exe
  C:\Windows\System\YupHxKZ.exe
  2⤵
  PID:3832
- C:\Windows\System\AMimKUT.exe
  C:\Windows\System\AMimKUT.exe
  2⤵
  PID:3772
- C:\Windows\System\zOiBqmt.exe
  C:\Windows\System\zOiBqmt.exe
  2⤵
  PID:3856
- C:\Windows\System\JsmvnFz.exe
  C:\Windows\System\JsmvnFz.exe
  2⤵
  PID:3140
- C:\Windows\System\wrkqEZW.exe
  C:\Windows\System\wrkqEZW.exe
  2⤵
  PID:4036
- C:\Windows\System\rGBGryv.exe
  C:\Windows\System\rGBGryv.exe
  2⤵
  PID:3804
- C:\Windows\System\UIAuLJX.exe
  C:\Windows\System\UIAuLJX.exe
  2⤵
  PID:3204
- C:\Windows\System\oqKLShT.exe
  C:\Windows\System\oqKLShT.exe
  2⤵
  PID:3668
- C:\Windows\System\CRHWNIG.exe
  C:\Windows\System\CRHWNIG.exe
  2⤵
  PID:3980
- C:\Windows\System\KliJEoG.exe
  C:\Windows\System\KliJEoG.exe
  2⤵
  PID:4088
- C:\Windows\System\UQjwSAF.exe
  C:\Windows\System\UQjwSAF.exe
  2⤵
  PID:3384
- C:\Windows\System\UhIRkWh.exe
  C:\Windows\System\UhIRkWh.exe
  2⤵
  PID:3440
- C:\Windows\System\ctrLvKy.exe
  C:\Windows\System\ctrLvKy.exe
  2⤵
  PID:3228
- C:\Windows\System\sZidtQk.exe
  C:\Windows\System\sZidtQk.exe
  2⤵
  PID:3536
- C:\Windows\System\PdZyHKt.exe
  C:\Windows\System\PdZyHKt.exe
  2⤵
  PID:3752
- C:\Windows\System\eGUVwVD.exe
  C:\Windows\System\eGUVwVD.exe
  2⤵
  PID:3128
- C:\Windows\System\sXuujMG.exe
  C:\Windows\System\sXuujMG.exe
  2⤵
  PID:3736
- C:\Windows\System\fVqANHk.exe
  C:\Windows\System\fVqANHk.exe
  2⤵
  PID:3492
- C:\Windows\System\LdMZXvY.exe
  C:\Windows\System\LdMZXvY.exe
  2⤵
  PID:3884
- C:\Windows\System\TucWAjQ.exe
  C:\Windows\System\TucWAjQ.exe
  2⤵
  PID:4052
- C:\Windows\System\YPemHMG.exe
  C:\Windows\System\YPemHMG.exe
  2⤵
  PID:3304
- C:\Windows\System\ncAkgMB.exe
  C:\Windows\System\ncAkgMB.exe
  2⤵
  PID:4080
- C:\Windows\System\kRINhfz.exe
  C:\Windows\System\kRINhfz.exe
  2⤵
  PID:3328
- C:\Windows\System\wNVdccW.exe
  C:\Windows\System\wNVdccW.exe
  2⤵
  PID:3308
- C:\Windows\System\emeBswX.exe
  C:\Windows\System\emeBswX.exe
  2⤵
  PID:3632
- C:\Windows\System\aebJfxK.exe
  C:\Windows\System\aebJfxK.exe
  2⤵
  PID:3552
- C:\Windows\System\IeQXbfT.exe
  C:\Windows\System\IeQXbfT.exe
  2⤵
  PID:3964
- C:\Windows\System\jYVvJav.exe
  C:\Windows\System\jYVvJav.exe
  2⤵
  PID:4104
- C:\Windows\System\snaVsoj.exe
  C:\Windows\System\snaVsoj.exe
  2⤵
  PID:4120
- C:\Windows\System\ygaWvnq.exe
  C:\Windows\System\ygaWvnq.exe
  2⤵
  PID:4136
- C:\Windows\System\GJqipZa.exe
  C:\Windows\System\GJqipZa.exe
  2⤵
  PID:4164
- C:\Windows\System\HqKyVnR.exe
  C:\Windows\System\HqKyVnR.exe
  2⤵
  PID:4264
- C:\Windows\System\knzWsqO.exe
  C:\Windows\System\knzWsqO.exe
  2⤵
  PID:4284
- C:\Windows\System\dMIAeUB.exe
  C:\Windows\System\dMIAeUB.exe
  2⤵
  PID:4300
- C:\Windows\System\lVAgWXf.exe
  C:\Windows\System\lVAgWXf.exe
  2⤵
  PID:4316
- C:\Windows\System\YEGtwbz.exe
  C:\Windows\System\YEGtwbz.exe
  2⤵
  PID:4332
- C:\Windows\System\YtsaLKO.exe
  C:\Windows\System\YtsaLKO.exe
  2⤵
  PID:4348
- C:\Windows\System\CZeIijh.exe
  C:\Windows\System\CZeIijh.exe
  2⤵
  PID:4368
- C:\Windows\System\lZsYZXU.exe
  C:\Windows\System\lZsYZXU.exe
  2⤵
  PID:4384
- C:\Windows\System\aryMicS.exe
  C:\Windows\System\aryMicS.exe
  2⤵
  PID:4400
- C:\Windows\System\XVavWlM.exe
  C:\Windows\System\XVavWlM.exe
  2⤵
  PID:4444
- C:\Windows\System\MjjEHYV.exe
  C:\Windows\System\MjjEHYV.exe
  2⤵
  PID:4460
- C:\Windows\System\QUMeXrK.exe
  C:\Windows\System\QUMeXrK.exe
  2⤵
  PID:4480
- C:\Windows\System\oePMYBr.exe
  C:\Windows\System\oePMYBr.exe
  2⤵
  PID:4496
- C:\Windows\System\AecjsFL.exe
  C:\Windows\System\AecjsFL.exe
  2⤵
  PID:4512
- C:\Windows\System\JajpcPX.exe
  C:\Windows\System\JajpcPX.exe
  2⤵
  PID:4528
- C:\Windows\System\mkHBUsz.exe
  C:\Windows\System\mkHBUsz.exe
  2⤵
  PID:4544
- C:\Windows\System\eXVdiNm.exe
  C:\Windows\System\eXVdiNm.exe
  2⤵
  PID:4560
- C:\Windows\System\einFwRT.exe
  C:\Windows\System\einFwRT.exe
  2⤵
  PID:4576
- C:\Windows\System\fsLOFYH.exe
  C:\Windows\System\fsLOFYH.exe
  2⤵
  PID:4592
- C:\Windows\System\ZcqEhHy.exe
  C:\Windows\System\ZcqEhHy.exe
  2⤵
  PID:4636
- C:\Windows\System\FxddvTG.exe
  C:\Windows\System\FxddvTG.exe
  2⤵
  PID:4680
- C:\Windows\System\ojulGhZ.exe
  C:\Windows\System\ojulGhZ.exe
  2⤵
  PID:4696
- C:\Windows\System\wGriYub.exe
  C:\Windows\System\wGriYub.exe
  2⤵
  PID:4712
- C:\Windows\System\SiQlEzJ.exe
  C:\Windows\System\SiQlEzJ.exe
  2⤵
  PID:4728
- C:\Windows\System\IzxHGNO.exe
  C:\Windows\System\IzxHGNO.exe
  2⤵
  PID:4744
- C:\Windows\System\cTEfYzZ.exe
  C:\Windows\System\cTEfYzZ.exe
  2⤵
  PID:4760
- C:\Windows\System\jszDtMa.exe
  C:\Windows\System\jszDtMa.exe
  2⤵
  PID:4776
- C:\Windows\System\xeTfpdT.exe
  C:\Windows\System\xeTfpdT.exe
  2⤵
  PID:4792
- C:\Windows\System\oJksAWy.exe
  C:\Windows\System\oJksAWy.exe
  2⤵
  PID:4808
- C:\Windows\System\GRFNCqe.exe
  C:\Windows\System\GRFNCqe.exe
  2⤵
  PID:4828
- C:\Windows\System\pbIFYLP.exe
  C:\Windows\System\pbIFYLP.exe
  2⤵
  PID:4848
- C:\Windows\System\TSKKfcD.exe
  C:\Windows\System\TSKKfcD.exe
  2⤵
  PID:4868
- C:\Windows\System\nODZqce.exe
  C:\Windows\System\nODZqce.exe
  2⤵
  PID:4884
- C:\Windows\System\XxaBAPq.exe
  C:\Windows\System\XxaBAPq.exe
  2⤵
  PID:4900
- C:\Windows\System\FRAzlhf.exe
  C:\Windows\System\FRAzlhf.exe
  2⤵
  PID:4916
- C:\Windows\System\vJLBofj.exe
  C:\Windows\System\vJLBofj.exe
  2⤵
  PID:4932
- C:\Windows\System\tKBtVsM.exe
  C:\Windows\System\tKBtVsM.exe
  2⤵
  PID:4992
- C:\Windows\System\gSeJpel.exe
  C:\Windows\System\gSeJpel.exe
  2⤵
  PID:5008
- C:\Windows\System\stjoxKu.exe
  C:\Windows\System\stjoxKu.exe
  2⤵
  PID:5028
- C:\Windows\System\FLmoRhB.exe
  C:\Windows\System\FLmoRhB.exe
  2⤵
  PID:5044
- C:\Windows\System\WhHTrdw.exe
  C:\Windows\System\WhHTrdw.exe
  2⤵
  PID:5064
- C:\Windows\System\quxlCys.exe
  C:\Windows\System\quxlCys.exe
  2⤵
  PID:5084
- C:\Windows\System\jQFAnZp.exe
  C:\Windows\System\jQFAnZp.exe
  2⤵
  PID:5100
- C:\Windows\System\LVuYmVH.exe
  C:\Windows\System\LVuYmVH.exe
  2⤵
  PID:5116
- C:\Windows\System\fmeYYAU.exe
  C:\Windows\System\fmeYYAU.exe
  2⤵
  PID:3156
- C:\Windows\System\cIzlXxo.exe
  C:\Windows\System\cIzlXxo.exe
  2⤵
  PID:4148
- C:\Windows\System\qSPDDXQ.exe
  C:\Windows\System\qSPDDXQ.exe
  2⤵
  PID:4128
- C:\Windows\System\CoseVhj.exe
  C:\Windows\System\CoseVhj.exe
  2⤵
  PID:4184
- C:\Windows\System\efaouUS.exe
  C:\Windows\System\efaouUS.exe
  2⤵
  PID:4200
- C:\Windows\System\gVHtyCQ.exe
  C:\Windows\System\gVHtyCQ.exe
  2⤵
  PID:4216
- C:\Windows\System\ympNRgk.exe
  C:\Windows\System\ympNRgk.exe
  2⤵
  PID:4232
- C:\Windows\System\zyzMWKC.exe
  C:\Windows\System\zyzMWKC.exe
  2⤵
  PID:4244
- C:\Windows\System\drLsriA.exe
  C:\Windows\System\drLsriA.exe
  2⤵
  PID:4292
- C:\Windows\System\LXvmaOq.exe
  C:\Windows\System\LXvmaOq.exe
  2⤵
  PID:4408
- C:\Windows\System\pgMgecq.exe
  C:\Windows\System\pgMgecq.exe
  2⤵
  PID:4340
- C:\Windows\System\CFEuruD.exe
  C:\Windows\System\CFEuruD.exe
  2⤵
  PID:4524
- C:\Windows\System\xbHsSmf.exe
  C:\Windows\System\xbHsSmf.exe
  2⤵
  PID:4584
- C:\Windows\System\yqYMLZb.exe
  C:\Windows\System\yqYMLZb.exe
  2⤵
  PID:4428
- C:\Windows\System\NDrgCGj.exe
  C:\Windows\System\NDrgCGj.exe
  2⤵
  PID:4572
- C:\Windows\System\PyCHTTO.exe
  C:\Windows\System\PyCHTTO.exe
  2⤵
  PID:4608
- C:\Windows\System\lOwmGEF.exe
  C:\Windows\System\lOwmGEF.exe
  2⤵
  PID:4620
- C:\Windows\System\ndztBjM.exe
  C:\Windows\System\ndztBjM.exe
  2⤵
  PID:4652
- C:\Windows\System\MAKAAOj.exe
  C:\Windows\System\MAKAAOj.exe
  2⤵
  PID:4736
- C:\Windows\System\KrCSDYW.exe
  C:\Windows\System\KrCSDYW.exe
  2⤵
  PID:4724
- C:\Windows\System\oOPuqBd.exe
  C:\Windows\System\oOPuqBd.exe
  2⤵
  PID:4800
- C:\Windows\System\wjKdVaI.exe
  C:\Windows\System\wjKdVaI.exe
  2⤵
  PID:4784
- C:\Windows\System\tWisuDm.exe
  C:\Windows\System\tWisuDm.exe
  2⤵
  PID:4816
- C:\Windows\System\uuykOcf.exe
  C:\Windows\System\uuykOcf.exe
  2⤵
  PID:4908
- C:\Windows\System\aNPMVbn.exe
  C:\Windows\System\aNPMVbn.exe
  2⤵
  PID:4964
- C:\Windows\System\RcIjCfJ.exe
  C:\Windows\System\RcIjCfJ.exe
  2⤵
  PID:4928
- C:\Windows\System\TvcOZXm.exe
  C:\Windows\System\TvcOZXm.exe
  2⤵
  PID:4952
- C:\Windows\System\mNuSvWf.exe
  C:\Windows\System\mNuSvWf.exe
  2⤵
  PID:5016
- C:\Windows\System\chYAYjh.exe
  C:\Windows\System\chYAYjh.exe
  2⤵
  PID:5060
- C:\Windows\System\rugwZgb.exe
  C:\Windows\System\rugwZgb.exe
  2⤵
  PID:5096
- C:\Windows\System\eFBpwGU.exe
  C:\Windows\System\eFBpwGU.exe
  2⤵
  PID:5112
- C:\Windows\System\GUWdnCA.exe
  C:\Windows\System\GUWdnCA.exe
  2⤵
  PID:4172
- C:\Windows\System\iRGjYpm.exe
  C:\Windows\System\iRGjYpm.exe
  2⤵
  PID:4192
- C:\Windows\System\fSwOFil.exe
  C:\Windows\System\fSwOFil.exe
  2⤵
  PID:3284
- C:\Windows\System\lHDqeMs.exe
  C:\Windows\System\lHDqeMs.exe
  2⤵
  PID:4248
- C:\Windows\System\WuleBMY.exe
  C:\Windows\System\WuleBMY.exe
  2⤵
  PID:4976
- C:\Windows\System\FgGvANu.exe
  C:\Windows\System\FgGvANu.exe
  2⤵
  PID:4308
- C:\Windows\System\HPVlwLz.exe
  C:\Windows\System\HPVlwLz.exe
  2⤵
  PID:4416
- C:\Windows\System\yWqnhvL.exe
  C:\Windows\System\yWqnhvL.exe
  2⤵
  PID:4588
- C:\Windows\System\BjacihH.exe
  C:\Windows\System\BjacihH.exe
  2⤵
  PID:4508
- C:\Windows\System\AclQgqV.exe
  C:\Windows\System\AclQgqV.exe
  2⤵
  PID:4504
- C:\Windows\System\FepIYbH.exe
  C:\Windows\System\FepIYbH.exe
  2⤵
  PID:4656
- C:\Windows\System\WoVOvqK.exe
  C:\Windows\System\WoVOvqK.exe
  2⤵
  PID:4628
- C:\Windows\System\knkeGYC.exe
  C:\Windows\System\knkeGYC.exe
  2⤵
  PID:4704
- C:\Windows\System\enwqSXx.exe
  C:\Windows\System\enwqSXx.exe
  2⤵
  PID:4692
- C:\Windows\System\crwpPqJ.exe
  C:\Windows\System\crwpPqJ.exe
  2⤵
  PID:4940
- C:\Windows\System\wAdTTlH.exe
  C:\Windows\System\wAdTTlH.exe
  2⤵
  PID:4824
- C:\Windows\System\XysaUDW.exe
  C:\Windows\System\XysaUDW.exe
  2⤵
  PID:5004
- C:\Windows\System\pfXnKOQ.exe
  C:\Windows\System\pfXnKOQ.exe
  2⤵
  PID:5036
- C:\Windows\System\thmNovs.exe
  C:\Windows\System\thmNovs.exe
  2⤵
  PID:4116
- C:\Windows\System\NLOKJgA.exe
  C:\Windows\System\NLOKJgA.exe
  2⤵
  PID:4212
- C:\Windows\System\tPnbNrO.exe
  C:\Windows\System\tPnbNrO.exe
  2⤵
  PID:4412
- C:\Windows\System\amKDWHT.exe
  C:\Windows\System\amKDWHT.exe
  2⤵
  PID:4616
- C:\Windows\System\rkucGHy.exe
  C:\Windows\System\rkucGHy.exe
  2⤵
  PID:4424
- C:\Windows\System\EkezBnp.exe
  C:\Windows\System\EkezBnp.exe
  2⤵
  PID:4160
- C:\Windows\System\UkaWZyV.exe
  C:\Windows\System\UkaWZyV.exe
  2⤵
  PID:4208
- C:\Windows\System\smfvksb.exe
  C:\Windows\System\smfvksb.exe
  2⤵
  PID:4392
- C:\Windows\System\jIhjzvi.exe
  C:\Windows\System\jIhjzvi.exe
  2⤵
  PID:4664
- C:\Windows\System\FlWDmxR.exe
  C:\Windows\System\FlWDmxR.exe
  2⤵
  PID:4980
- C:\Windows\System\eoDSsTa.exe
  C:\Windows\System\eoDSsTa.exe
  2⤵
  PID:4768
- C:\Windows\System\dWOgeHp.exe
  C:\Windows\System\dWOgeHp.exe
  2⤵
  PID:4840
- C:\Windows\System\sjaJpvr.exe
  C:\Windows\System\sjaJpvr.exe
  2⤵
  PID:4520
- C:\Windows\System\HlZTrTS.exe
  C:\Windows\System\HlZTrTS.exe
  2⤵
  PID:4836
- C:\Windows\System\wuIJeRR.exe
  C:\Windows\System\wuIJeRR.exe
  2⤵
  PID:4364
- C:\Windows\System\MzhWlqU.exe
  C:\Windows\System\MzhWlqU.exe
  2⤵
  PID:4648
- C:\Windows\System\DtfYQcT.exe
  C:\Windows\System\DtfYQcT.exe
  2⤵
  PID:4568
- C:\Windows\System\RcfuMSN.exe
  C:\Windows\System\RcfuMSN.exe
  2⤵
  PID:4452
- C:\Windows\System\oOwdkxv.exe
  C:\Windows\System\oOwdkxv.exe
  2⤵
  PID:4876
- C:\Windows\System\sYjhQJC.exe
  C:\Windows\System\sYjhQJC.exe
  2⤵
  PID:5024
- C:\Windows\System\pUWSEfb.exe
  C:\Windows\System\pUWSEfb.exe
  2⤵
  PID:5040
- C:\Windows\System\YUUtmWu.exe
  C:\Windows\System\YUUtmWu.exe
  2⤵
  PID:4552
- C:\Windows\System\rDnZJMA.exe
  C:\Windows\System\rDnZJMA.exe
  2⤵
  PID:4468
- C:\Windows\System\aaduCNm.exe
  C:\Windows\System\aaduCNm.exe
  2⤵
  PID:4272
- C:\Windows\System\yRIabcE.exe
  C:\Windows\System\yRIabcE.exe
  2⤵
  PID:5140
- C:\Windows\System\UAjdGMz.exe
  C:\Windows\System\UAjdGMz.exe
  2⤵
  PID:5180
- C:\Windows\System\TodzpOA.exe
  C:\Windows\System\TodzpOA.exe
  2⤵
  PID:5224
- C:\Windows\System\fazZojw.exe
  C:\Windows\System\fazZojw.exe
  2⤵
  PID:5244
- C:\Windows\System\JifNdVv.exe
  C:\Windows\System\JifNdVv.exe
  2⤵
  PID:5264
- C:\Windows\System\vveGeTD.exe
  C:\Windows\System\vveGeTD.exe
  2⤵
  PID:5280
- C:\Windows\System\keqVpvR.exe
  C:\Windows\System\keqVpvR.exe
  2⤵
  PID:5328
- C:\Windows\System\hCouRmN.exe
  C:\Windows\System\hCouRmN.exe
  2⤵
  PID:5352
- C:\Windows\System\MmMoMiL.exe
  C:\Windows\System\MmMoMiL.exe
  2⤵
  PID:5604
- C:\Windows\System\zdYkjQt.exe
  C:\Windows\System\zdYkjQt.exe
  2⤵
  PID:5620
- C:\Windows\System\izyxXnx.exe
  C:\Windows\System\izyxXnx.exe
  2⤵
  PID:5636
- C:\Windows\System\hylfyme.exe
  C:\Windows\System\hylfyme.exe
  2⤵
  PID:5652
- C:\Windows\System\MVPZMKr.exe
  C:\Windows\System\MVPZMKr.exe
  2⤵
  PID:5672
- C:\Windows\System\ofEfWsR.exe
  C:\Windows\System\ofEfWsR.exe
  2⤵
  PID:5688
- C:\Windows\System\YHmaAyv.exe
  C:\Windows\System\YHmaAyv.exe
  2⤵
  PID:5704
- C:\Windows\System\vlvsiEh.exe
  C:\Windows\System\vlvsiEh.exe
  2⤵
  PID:5724
- C:\Windows\System\mpZLTlt.exe
  C:\Windows\System\mpZLTlt.exe
  2⤵
  PID:5740
- C:\Windows\System\WhYXotg.exe
  C:\Windows\System\WhYXotg.exe
  2⤵
  PID:5760
- C:\Windows\System\eLTwzBw.exe
  C:\Windows\System\eLTwzBw.exe
  2⤵
  PID:5776
- C:\Windows\System\QfYWRoo.exe
  C:\Windows\System\QfYWRoo.exe
  2⤵
  PID:5820
- C:\Windows\System\ngkkYKO.exe
  C:\Windows\System\ngkkYKO.exe
  2⤵
  PID:5844
- C:\Windows\System\sRKhLgs.exe
  C:\Windows\System\sRKhLgs.exe
  2⤵
  PID:5860
- C:\Windows\System\hFHBGbW.exe
  C:\Windows\System\hFHBGbW.exe
  2⤵
  PID:5876
- C:\Windows\System\cLAleCU.exe
  C:\Windows\System\cLAleCU.exe
  2⤵
  PID:5892
- C:\Windows\System\iJgEGza.exe
  C:\Windows\System\iJgEGza.exe
  2⤵
  PID:5912
- C:\Windows\System\ChComQY.exe
  C:\Windows\System\ChComQY.exe
  2⤵
  PID:5928
- C:\Windows\System\yTLnvlf.exe
  C:\Windows\System\yTLnvlf.exe
  2⤵
  PID:5944
- C:\Windows\System\Fexqpge.exe
  C:\Windows\System\Fexqpge.exe
  2⤵
  PID:5960
- C:\Windows\System\UFFrzvs.exe
  C:\Windows\System\UFFrzvs.exe
  2⤵
  PID:5980
- C:\Windows\System\ImpknQW.exe
  C:\Windows\System\ImpknQW.exe
  2⤵
  PID:5996
- C:\Windows\System\ivIRrzr.exe
  C:\Windows\System\ivIRrzr.exe
  2⤵
  PID:6016
- C:\Windows\System\OGSAyxq.exe
  C:\Windows\System\OGSAyxq.exe
  2⤵
  PID:6032
- C:\Windows\System\akYuuBE.exe
  C:\Windows\System\akYuuBE.exe
  2⤵
  PID:6052
- C:\Windows\System\uTgYNxG.exe
  C:\Windows\System\uTgYNxG.exe
  2⤵
  PID:6072
- C:\Windows\System\hrxTQCN.exe
  C:\Windows\System\hrxTQCN.exe
  2⤵
  PID:6088
- C:\Windows\System\hQdkVzM.exe
  C:\Windows\System\hQdkVzM.exe
  2⤵
  PID:6104
- C:\Windows\System\czbkRwR.exe
  C:\Windows\System\czbkRwR.exe
  2⤵
  PID:6124
- C:\Windows\System\bjjoJTS.exe
  C:\Windows\System\bjjoJTS.exe
  2⤵
  PID:6140
- C:\Windows\System\qqXTKrh.exe
  C:\Windows\System\qqXTKrh.exe
  2⤵
  PID:4864
- C:\Windows\System\dhzKNPh.exe
  C:\Windows\System\dhzKNPh.exe
  2⤵
  PID:4180
- C:\Windows\System\SPnkTYw.exe
  C:\Windows\System\SPnkTYw.exe
  2⤵
  PID:5132
- C:\Windows\System\PQnJEnO.exe
  C:\Windows\System\PQnJEnO.exe
  2⤵
  PID:5164
- C:\Windows\System\CbZHXPH.exe
  C:\Windows\System\CbZHXPH.exe
  2⤵
  PID:5256
- C:\Windows\System\mLcPSaT.exe
  C:\Windows\System\mLcPSaT.exe
  2⤵
  PID:5152
- C:\Windows\System\YPkxzWH.exe
  C:\Windows\System\YPkxzWH.exe
  2⤵
  PID:5312
- C:\Windows\System\zmMqilG.exe
  C:\Windows\System\zmMqilG.exe
  2⤵
  PID:5304
- C:\Windows\System\ysLhxMU.exe
  C:\Windows\System\ysLhxMU.exe
  2⤵
  PID:5344
- C:\Windows\System\StSMkBE.exe
  C:\Windows\System\StSMkBE.exe
  2⤵
  PID:5460
- C:\Windows\System\ZUEZGYh.exe
  C:\Windows\System\ZUEZGYh.exe
  2⤵
  PID:5644
- C:\Windows\System\kqbdWCp.exe
  C:\Windows\System\kqbdWCp.exe
  2⤵
  PID:5548
- C:\Windows\System\mLJEcJA.exe
  C:\Windows\System\mLJEcJA.exe
  2⤵
  PID:5748
- C:\Windows\System\pWePtMa.exe
  C:\Windows\System\pWePtMa.exe
  2⤵
  PID:5400
- C:\Windows\System\PxlzzSK.exe
  C:\Windows\System\PxlzzSK.exe
  2⤵
  PID:5440
- C:\Windows\System\zVNdEKp.exe
  C:\Windows\System\zVNdEKp.exe
  2⤵
  PID:5500
- C:\Windows\System\NnQsZbL.exe
  C:\Windows\System\NnQsZbL.exe
  2⤵
  PID:5368
- C:\Windows\System\pSjgPZO.exe
  C:\Windows\System\pSjgPZO.exe
  2⤵
  PID:5816
- C:\Windows\System\xCHKnzZ.exe
  C:\Windows\System\xCHKnzZ.exe
  2⤵
  PID:5568
- C:\Windows\System\JWUDMnm.exe
  C:\Windows\System\JWUDMnm.exe
  2⤵
  PID:5572
- C:\Windows\System\IOQTRiM.exe
  C:\Windows\System\IOQTRiM.exe
  2⤵
  PID:5884
- C:\Windows\System\WStrsVa.exe
  C:\Windows\System\WStrsVa.exe
  2⤵
  PID:5576
- C:\Windows\System\ooPoxim.exe
  C:\Windows\System\ooPoxim.exe
  2⤵
  PID:5412
- C:\Windows\System\JGTeYMu.exe
  C:\Windows\System\JGTeYMu.exe
  2⤵
  PID:5468
- C:\Windows\System\ldKDvRG.exe
  C:\Windows\System\ldKDvRG.exe
  2⤵
  PID:5632
- C:\Windows\System\yrYfSpx.exe
  C:\Windows\System\yrYfSpx.exe
  2⤵
  PID:5696
- C:\Windows\System\UbROYTY.exe
  C:\Windows\System\UbROYTY.exe
  2⤵
  PID:5768
- C:\Windows\System\UZsHaON.exe
  C:\Windows\System\UZsHaON.exe
  2⤵
  PID:5956
- C:\Windows\System\wFVHsSc.exe
  C:\Windows\System\wFVHsSc.exe
  2⤵
  PID:6024
- C:\Windows\System\zxuftLt.exe
  C:\Windows\System\zxuftLt.exe
  2⤵
  PID:4312
- C:\Windows\System\cXYDaMr.exe
  C:\Windows\System\cXYDaMr.exe
  2⤵
  PID:5160
- C:\Windows\System\UiqkUpx.exe
  C:\Windows\System\UiqkUpx.exe
  2⤵
  PID:5288
- C:\Windows\System\mbUVvcw.exe
  C:\Windows\System\mbUVvcw.exe
  2⤵
  PID:5596
- C:\Windows\System\xUnkkGy.exe
  C:\Windows\System\xUnkkGy.exe
  2⤵
  PID:5836
- C:\Windows\System\JORbDlo.exe
  C:\Windows\System\JORbDlo.exe
  2⤵
  PID:5552
- C:\Windows\System\veUJGFn.exe
  C:\Windows\System\veUJGFn.exe
  2⤵
  PID:5380
- C:\Windows\System\AimfYDF.exe
  C:\Windows\System\AimfYDF.exe
  2⤵
  PID:5236
- C:\Windows\System\wHSlKyr.exe
  C:\Windows\System\wHSlKyr.exe
  2⤵
  PID:5376
- C:\Windows\System\qvVLPQS.exe
  C:\Windows\System\qvVLPQS.exe
  2⤵
  PID:5172
- C:\Windows\System\qyCfUYz.exe
  C:\Windows\System\qyCfUYz.exe
  2⤵
  PID:5784
- C:\Windows\System\aJNyCMf.exe
  C:\Windows\System\aJNyCMf.exe
  2⤵
  PID:5360
- C:\Windows\System\CXMblhB.exe
  C:\Windows\System\CXMblhB.exe
  2⤵
  PID:5852
- C:\Windows\System\llGSkLf.exe
  C:\Windows\System\llGSkLf.exe
  2⤵
  PID:5396
- C:\Windows\System\dkPtpJN.exe
  C:\Windows\System\dkPtpJN.exe
  2⤵
  PID:5524
- C:\Windows\System\dYFlwek.exe
  C:\Windows\System\dYFlwek.exe
  2⤵
  PID:5476
- C:\Windows\System\dDymmZD.exe
  C:\Windows\System\dDymmZD.exe
  2⤵
  PID:5660
- C:\Windows\System\gGOISCt.exe
  C:\Windows\System\gGOISCt.exe
  2⤵
  PID:5428
- C:\Windows\System\khUFGHn.exe
  C:\Windows\System\khUFGHn.exe
  2⤵
  PID:5520
- C:\Windows\System\NfKDJaE.exe
  C:\Windows\System\NfKDJaE.exe
  2⤵
  PID:5324
- C:\Windows\System\gLrOYfX.exe
  C:\Windows\System\gLrOYfX.exe
  2⤵
  PID:6068
- C:\Windows\System\XvEWJBh.exe
  C:\Windows\System\XvEWJBh.exe
  2⤵
  PID:5580
- C:\Windows\System\kPmIGeZ.exe
  C:\Windows\System\kPmIGeZ.exe
  2⤵
  PID:5592
- C:\Windows\System\IrFXuaz.exe
  C:\Windows\System\IrFXuaz.exe
  2⤵
  PID:6044
- C:\Windows\System\DEzPdhC.exe
  C:\Windows\System\DEzPdhC.exe
  2⤵
  PID:5196
- C:\Windows\System\nXYqWpB.exe
  C:\Windows\System\nXYqWpB.exe
  2⤵
  PID:5736
- C:\Windows\System\pRkICwL.exe
  C:\Windows\System\pRkICwL.exe
  2⤵
  PID:5908
- C:\Windows\System\AvDsGLf.exe
  C:\Windows\System\AvDsGLf.exe
  2⤵
  PID:5292
- C:\Windows\System\crjedFd.exe
  C:\Windows\System\crjedFd.exe
  2⤵
  PID:5828
- C:\Windows\System\BJHPiBP.exe
  C:\Windows\System\BJHPiBP.exe
  2⤵
  PID:6008
- C:\Windows\System\HGfbiSx.exe
  C:\Windows\System\HGfbiSx.exe
  2⤵
  PID:6080
- C:\Windows\System\xRingVa.exe
  C:\Windows\System\xRingVa.exe
  2⤵
  PID:6120
- C:\Windows\System\dxpznSL.exe
  C:\Windows\System\dxpznSL.exe
  2⤵
  PID:6084
- C:\Windows\System\aJTqpct.exe
  C:\Windows\System\aJTqpct.exe
  2⤵
  PID:4632
- C:\Windows\System\mlRLJxb.exe
  C:\Windows\System\mlRLJxb.exe
  2⤵
  PID:5252
- C:\Windows\System\TXdNzeo.exe
  C:\Windows\System\TXdNzeo.exe
  2⤵
  PID:5900
- C:\Windows\System\YJeMxlg.exe
  C:\Windows\System\YJeMxlg.exe
  2⤵
  PID:5924
- C:\Windows\System\boEDIWn.exe
  C:\Windows\System\boEDIWn.exe
  2⤵
  PID:5668
- C:\Windows\System\qqGZLJA.exe
  C:\Windows\System\qqGZLJA.exe
  2⤵
  PID:5564
- C:\Windows\System\WpLkyXq.exe
  C:\Windows\System\WpLkyXq.exe
  2⤵
  PID:5148
- C:\Windows\System\AkcpJCo.exe
  C:\Windows\System\AkcpJCo.exe
  2⤵
  PID:5296
- C:\Windows\System\aHcgULQ.exe
  C:\Windows\System\aHcgULQ.exe
  2⤵
  PID:5200
- C:\Windows\System\AKSlooU.exe
  C:\Windows\System\AKSlooU.exe
  2⤵
  PID:6064
- C:\Windows\System\dMjxQxy.exe
  C:\Windows\System\dMjxQxy.exe
  2⤵
  PID:6004
- C:\Windows\System\XbBglWo.exe
  C:\Windows\System\XbBglWo.exe
  2⤵
  PID:5540
- C:\Windows\System\SLXyajv.exe
  C:\Windows\System\SLXyajv.exe
  2⤵
  PID:5472
- C:\Windows\System\kvfXNOJ.exe
  C:\Windows\System\kvfXNOJ.exe
  2⤵
  PID:5232
- C:\Windows\System\EKXdxII.exe
  C:\Windows\System\EKXdxII.exe
  2⤵
  PID:6152
- C:\Windows\System\ucJTbDr.exe
  C:\Windows\System\ucJTbDr.exe
  2⤵
  PID:6168
- C:\Windows\System\vberFoJ.exe
  C:\Windows\System\vberFoJ.exe
  2⤵
  PID:6184
- C:\Windows\System\tMtTaFb.exe
  C:\Windows\System\tMtTaFb.exe
  2⤵
  PID:6216
- C:\Windows\System\kZFRfUp.exe
  C:\Windows\System\kZFRfUp.exe
  2⤵
  PID:6232
- C:\Windows\System\VrmJmBq.exe
  C:\Windows\System\VrmJmBq.exe
  2⤵
  PID:6248
- C:\Windows\System\eQcgSXN.exe
  C:\Windows\System\eQcgSXN.exe
  2⤵
  PID:6268
- C:\Windows\System\ysgWQuX.exe
  C:\Windows\System\ysgWQuX.exe
  2⤵
  PID:6284
- C:\Windows\System\cVAOTcc.exe
  C:\Windows\System\cVAOTcc.exe
  2⤵
  PID:6300
- C:\Windows\System\CoSbkLC.exe
  C:\Windows\System\CoSbkLC.exe
  2⤵
  PID:6316
- C:\Windows\System\TILAOYZ.exe
  C:\Windows\System\TILAOYZ.exe
  2⤵
  PID:6332
- C:\Windows\System\eySyYHY.exe
  C:\Windows\System\eySyYHY.exe
  2⤵
  PID:6348
- C:\Windows\System\vgzfkEd.exe
  C:\Windows\System\vgzfkEd.exe
  2⤵
  PID:6364
- C:\Windows\System\dLrXQeL.exe
  C:\Windows\System\dLrXQeL.exe
  2⤵
  PID:6380
- C:\Windows\System\VnSlimG.exe
  C:\Windows\System\VnSlimG.exe
  2⤵
  PID:6396
- C:\Windows\System\SGLzxOv.exe
  C:\Windows\System\SGLzxOv.exe
  2⤵
  PID:6412
- C:\Windows\System\bNazNPi.exe
  C:\Windows\System\bNazNPi.exe
  2⤵
  PID:6428
- C:\Windows\System\nkmTQNy.exe
  C:\Windows\System\nkmTQNy.exe
  2⤵
  PID:6444
- C:\Windows\System\whEHOmn.exe
  C:\Windows\System\whEHOmn.exe
  2⤵
  PID:6460
- C:\Windows\System\cnaaqzF.exe
  C:\Windows\System\cnaaqzF.exe
  2⤵
  PID:6476
- C:\Windows\System\NQBGHJr.exe
  C:\Windows\System\NQBGHJr.exe
  2⤵
  PID:6492
- C:\Windows\System\XqrjARK.exe
  C:\Windows\System\XqrjARK.exe
  2⤵
  PID:6508
- C:\Windows\System\FhjGcuE.exe
  C:\Windows\System\FhjGcuE.exe
  2⤵
  PID:6524
- C:\Windows\System\sASJQER.exe
  C:\Windows\System\sASJQER.exe
  2⤵
  PID:6540
- C:\Windows\System\WTuxOYL.exe
  C:\Windows\System\WTuxOYL.exe
  2⤵
  PID:6556
- C:\Windows\System\MxVeEsg.exe
  C:\Windows\System\MxVeEsg.exe
  2⤵
  PID:6572
- C:\Windows\System\ExCnNot.exe
  C:\Windows\System\ExCnNot.exe
  2⤵
  PID:6588
- C:\Windows\System\XrIyLxa.exe
  C:\Windows\System\XrIyLxa.exe
  2⤵
  PID:6604
- C:\Windows\System\OoJLHEM.exe
  C:\Windows\System\OoJLHEM.exe
  2⤵
  PID:6620
- C:\Windows\System\VgNRZGE.exe
  C:\Windows\System\VgNRZGE.exe
  2⤵
  PID:6636
- C:\Windows\System\Ykzirhw.exe
  C:\Windows\System\Ykzirhw.exe
  2⤵
  PID:6652
- C:\Windows\System\mIbQuMv.exe
  C:\Windows\System\mIbQuMv.exe
  2⤵
  PID:6668
- C:\Windows\System\vYjelDB.exe
  C:\Windows\System\vYjelDB.exe
  2⤵
  PID:6684
- C:\Windows\System\DmmjlHu.exe
  C:\Windows\System\DmmjlHu.exe
  2⤵
  PID:6700
- C:\Windows\System\XlyDDtU.exe
  C:\Windows\System\XlyDDtU.exe
  2⤵
  PID:6716
- C:\Windows\System\geKFbjb.exe
  C:\Windows\System\geKFbjb.exe
  2⤵
  PID:6732
- C:\Windows\System\SeHXCUi.exe
  C:\Windows\System\SeHXCUi.exe
  2⤵
  PID:6748
- C:\Windows\System\sauwolw.exe
  C:\Windows\System\sauwolw.exe
  2⤵
  PID:6764
- C:\Windows\System\YvNbdji.exe
  C:\Windows\System\YvNbdji.exe
  2⤵
  PID:6780
- C:\Windows\System\kCVGdfO.exe
  C:\Windows\System\kCVGdfO.exe
  2⤵
  PID:6796
- C:\Windows\System\xpjfOEO.exe
  C:\Windows\System\xpjfOEO.exe
  2⤵
  PID:6812
- C:\Windows\System\VWuCodO.exe
  C:\Windows\System\VWuCodO.exe
  2⤵
  PID:6828
- C:\Windows\System\TtEXkfS.exe
  C:\Windows\System\TtEXkfS.exe
  2⤵
  PID:6844
- C:\Windows\System\ByDkCGK.exe
  C:\Windows\System\ByDkCGK.exe
  2⤵
  PID:6860
- C:\Windows\System\jQJltav.exe
  C:\Windows\System\jQJltav.exe
  2⤵
  PID:6876
- C:\Windows\System\hzclNmC.exe
  C:\Windows\System\hzclNmC.exe
  2⤵
  PID:6892
- C:\Windows\System\PIqsjYo.exe
  C:\Windows\System\PIqsjYo.exe
  2⤵
  PID:6912
- C:\Windows\System\VOPoXup.exe
  C:\Windows\System\VOPoXup.exe
  2⤵
  PID:6988
- C:\Windows\System\srnnCIh.exe
  C:\Windows\System\srnnCIh.exe
  2⤵
  PID:7032
- C:\Windows\System\KvuYRvS.exe
  C:\Windows\System\KvuYRvS.exe
  2⤵
  PID:7048
- C:\Windows\System\BXyNhSF.exe
  C:\Windows\System\BXyNhSF.exe
  2⤵
  PID:7064
- C:\Windows\System\riTLqoa.exe
  C:\Windows\System\riTLqoa.exe
  2⤵
  PID:7080
- C:\Windows\System\lhkhLQr.exe
  C:\Windows\System\lhkhLQr.exe
  2⤵
  PID:7096
- C:\Windows\System\yTuneDd.exe
  C:\Windows\System\yTuneDd.exe
  2⤵
  PID:7112
- C:\Windows\System\uwdtxdI.exe
  C:\Windows\System\uwdtxdI.exe
  2⤵
  PID:6388
- C:\Windows\System\NMEPcJW.exe
  C:\Windows\System\NMEPcJW.exe
  2⤵
  PID:6452
- C:\Windows\System\hOqojFc.exe
  C:\Windows\System\hOqojFc.exe
  2⤵
  PID:6516
- C:\Windows\System\qGCcjKV.exe
  C:\Windows\System\qGCcjKV.exe
  2⤵
  PID:6612
- C:\Windows\System\dMqYnvF.exe
  C:\Windows\System\dMqYnvF.exe
  2⤵
  PID:6584
- C:\Windows\System\tVpMXkZ.exe
  C:\Windows\System\tVpMXkZ.exe
  2⤵
  PID:6680
- C:\Windows\System\WhMjuEs.exe
  C:\Windows\System\WhMjuEs.exe
  2⤵
  PID:6772
- C:\Windows\System\YvchoUV.exe
  C:\Windows\System\YvchoUV.exe
  2⤵
  PID:6808
- C:\Windows\System\ehmQjuG.exe
  C:\Windows\System\ehmQjuG.exe
  2⤵
  PID:5480
- C:\Windows\System\aploPNs.exe
  C:\Windows\System\aploPNs.exe
  2⤵
  PID:6160
- C:\Windows\System\eqlJcDH.exe
  C:\Windows\System\eqlJcDH.exe
  2⤵
  PID:6112
- C:\Windows\System\FKrJUZM.exe
  C:\Windows\System\FKrJUZM.exe
  2⤵
  PID:6240
- C:\Windows\System\oSRUKEE.exe
  C:\Windows\System\oSRUKEE.exe
  2⤵
  PID:6308
- C:\Windows\System\uVhcBhD.exe
  C:\Windows\System\uVhcBhD.exe
  2⤵
  PID:6376
- C:\Windows\System\kAxswfH.exe
  C:\Windows\System\kAxswfH.exe
  2⤵
  PID:6440
- C:\Windows\System\YgxSLBN.exe
  C:\Windows\System\YgxSLBN.exe
  2⤵
  PID:6504
- C:\Windows\System\uOcZHgg.exe
  C:\Windows\System\uOcZHgg.exe
  2⤵
  PID:5976
- C:\Windows\System\gjiXOwI.exe
  C:\Windows\System\gjiXOwI.exe
  2⤵
  PID:6792
- C:\Windows\System\figYpeS.exe
  C:\Windows\System\figYpeS.exe
  2⤵
  PID:6204
- C:\Windows\System\LTskPEG.exe
  C:\Windows\System\LTskPEG.exe
  2⤵
  PID:6888
- C:\Windows\System\vpIalhc.exe
  C:\Windows\System\vpIalhc.exe
  2⤵
  PID:6840
- C:\Windows\System\tdhhkvg.exe
  C:\Windows\System\tdhhkvg.exe
  2⤵
  PID:6904
- C:\Windows\System\Ljmcgen.exe
  C:\Windows\System\Ljmcgen.exe
  2⤵
  PID:7044
- C:\Windows\System\jmWbTfT.exe
  C:\Windows\System\jmWbTfT.exe
  2⤵
  PID:6968
- C:\Windows\System\RFzEKbK.exe
  C:\Windows\System\RFzEKbK.exe
  2⤵
  PID:6928
- C:\Windows\System\gYhhLKA.exe
  C:\Windows\System\gYhhLKA.exe
  2⤵
  PID:6948
- C:\Windows\System\OnTDPYu.exe
  C:\Windows\System\OnTDPYu.exe
  2⤵
  PID:2004
- C:\Windows\System\ZdVpfCP.exe
  C:\Windows\System\ZdVpfCP.exe
  2⤵
  PID:1648
- C:\Windows\System\RvppeGj.exe
  C:\Windows\System\RvppeGj.exe
  2⤵
  PID:6420
- C:\Windows\System\HTazlis.exe
  C:\Windows\System\HTazlis.exe
  2⤵
  PID:6708
- C:\Windows\System\RqHZPEy.exe
  C:\Windows\System\RqHZPEy.exe
  2⤵
  PID:7152
- C:\Windows\System\NlXQyuI.exe
  C:\Windows\System\NlXQyuI.exe
  2⤵
  PID:2364
- C:\Windows\System\RywQKrK.exe
  C:\Windows\System\RywQKrK.exe
  2⤵
  PID:5904
- C:\Windows\System\KCixGOb.exe
  C:\Windows\System\KCixGOb.exe
  2⤵
  PID:7092
- C:\Windows\System\rnGnFlE.exe
  C:\Windows\System\rnGnFlE.exe
  2⤵
  PID:7020
- C:\Windows\System\ZvTgmJJ.exe
  C:\Windows\System\ZvTgmJJ.exe
  2⤵
  PID:5808
- C:\Windows\System\soGUODU.exe
  C:\Windows\System\soGUODU.exe
  2⤵
  PID:7164
- C:\Windows\System\DUnoXjo.exe
  C:\Windows\System\DUnoXjo.exe
  2⤵
  PID:5800
- C:\Windows\System\bHoyjvM.exe
  C:\Windows\System\bHoyjvM.exe
  2⤵
  PID:6292
- C:\Windows\System\PDiHeBw.exe
  C:\Windows\System\PDiHeBw.exe
  2⤵
  PID:6356
- C:\Windows\System\iRAcuUr.exe
  C:\Windows\System\iRAcuUr.exe
  2⤵
  PID:6488
- C:\Windows\System\AEGqumd.exe
  C:\Windows\System\AEGqumd.exe
  2⤵
  PID:6256
- C:\Windows\System\hulHQkN.exe
  C:\Windows\System\hulHQkN.exe
  2⤵
  PID:1676
- C:\Windows\System\SjESUNS.exe
  C:\Windows\System\SjESUNS.exe
  2⤵
  PID:6980
- C:\Windows\System\SwwvAXz.exe
  C:\Windows\System\SwwvAXz.exe
  2⤵
  PID:2392
- C:\Windows\System\zDosVPa.exe
  C:\Windows\System\zDosVPa.exe
  2⤵
  PID:2368
- C:\Windows\System\ZBqIfBY.exe
  C:\Windows\System\ZBqIfBY.exe
  2⤵
  PID:7004
- C:\Windows\System\CoQUpQY.exe
  C:\Windows\System\CoQUpQY.exe
  2⤵
  PID:7056
- C:\Windows\System\EtZMGWN.exe
  C:\Windows\System\EtZMGWN.exe
  2⤵
  PID:6328
- C:\Windows\System\VVSZXSz.exe
  C:\Windows\System\VVSZXSz.exe
  2⤵
  PID:6552
- C:\Windows\System\SmFvgOM.exe
  C:\Windows\System\SmFvgOM.exe
  2⤵
  PID:1640
- C:\Windows\System\UOMCDTG.exe
  C:\Windows\System\UOMCDTG.exe
  2⤵
  PID:2952
- C:\Windows\System\kYbpBKb.exe
  C:\Windows\System\kYbpBKb.exe
  2⤵
  PID:5684
- C:\Windows\System\AqHXngU.exe
  C:\Windows\System\AqHXngU.exe
  2⤵
  PID:6176
- C:\Windows\System\zdhDmrk.exe
  C:\Windows\System\zdhDmrk.exe
  2⤵
  PID:1088
- C:\Windows\System\wNxvWcV.exe
  C:\Windows\System\wNxvWcV.exe
  2⤵
  PID:1112
- C:\Windows\System\ZapFpFz.exe
  C:\Windows\System\ZapFpFz.exe
  2⤵
  PID:5176
- C:\Windows\System\UaZPXtJ.exe
  C:\Windows\System\UaZPXtJ.exe
  2⤵
  PID:5600
- C:\Windows\System\qiUykQC.exe
  C:\Windows\System\qiUykQC.exe
  2⤵
  PID:5408
- C:\Windows\System\VRmSZba.exe
  C:\Windows\System\VRmSZba.exe
  2⤵
  PID:1108
- C:\Windows\System\hxGBAYV.exe
  C:\Windows\System\hxGBAYV.exe
  2⤵
  PID:7140
- C:\Windows\System\oFZagTT.exe
  C:\Windows\System\oFZagTT.exe
  2⤵
  PID:7124
- C:\Windows\System\HPibbhX.exe
  C:\Windows\System\HPibbhX.exe
  2⤵
  PID:7108
- C:\Windows\System\EkygcWw.exe
  C:\Windows\System\EkygcWw.exe
  2⤵
  PID:7028
- C:\Windows\System\JCvHrYq.exe
  C:\Windows\System\JCvHrYq.exe
  2⤵
  PID:7184
- C:\Windows\System\OTbzxUI.exe
  C:\Windows\System\OTbzxUI.exe
  2⤵
  PID:7200
- C:\Windows\System\TRwXAar.exe
  C:\Windows\System\TRwXAar.exe
  2⤵
  PID:7216
- C:\Windows\System\ikHBEMS.exe
  C:\Windows\System\ikHBEMS.exe
  2⤵
  PID:7232
- C:\Windows\System\dieeaFO.exe
  C:\Windows\System\dieeaFO.exe
  2⤵
  PID:7248
- C:\Windows\System\hvXSkgE.exe
  C:\Windows\System\hvXSkgE.exe
  2⤵
  PID:7264
- C:\Windows\System\PfMDMGX.exe
  C:\Windows\System\PfMDMGX.exe
  2⤵
  PID:7284
- C:\Windows\System\DqrNgjp.exe
  C:\Windows\System\DqrNgjp.exe
  2⤵
  PID:7300
- C:\Windows\System\eiNcVhQ.exe
  C:\Windows\System\eiNcVhQ.exe
  2⤵
  PID:7316
- C:\Windows\System\kksaRSQ.exe
  C:\Windows\System\kksaRSQ.exe
  2⤵
  PID:7336
- C:\Windows\System\XiLarvn.exe
  C:\Windows\System\XiLarvn.exe
  2⤵
  PID:7352
- C:\Windows\System\phiVxWG.exe
  C:\Windows\System\phiVxWG.exe
  2⤵
  PID:7368
- C:\Windows\System\GyKLRXE.exe
  C:\Windows\System\GyKLRXE.exe
  2⤵
  PID:7396
- C:\Windows\System\DdtxRmp.exe
  C:\Windows\System\DdtxRmp.exe
  2⤵
  PID:7412
- C:\Windows\System\VMQQYBF.exe
  C:\Windows\System\VMQQYBF.exe
  2⤵
  PID:7436
- C:\Windows\System\WCMHASO.exe
  C:\Windows\System\WCMHASO.exe
  2⤵
  PID:7452
- C:\Windows\System\KeASoBY.exe
  C:\Windows\System\KeASoBY.exe
  2⤵
  PID:7468
- C:\Windows\System\fjddEld.exe
  C:\Windows\System\fjddEld.exe
  2⤵
  PID:7484
- C:\Windows\System\JGJhVRC.exe
  C:\Windows\System\JGJhVRC.exe
  2⤵
  PID:7508
- C:\Windows\System\dKdoMUy.exe
  C:\Windows\System\dKdoMUy.exe
  2⤵
  PID:7524
- C:\Windows\System\trcxfUb.exe
  C:\Windows\System\trcxfUb.exe
  2⤵
  PID:7540
- C:\Windows\System\wuVdaMa.exe
  C:\Windows\System\wuVdaMa.exe
  2⤵
  PID:7556
- C:\Windows\System\wbrfPTe.exe
  C:\Windows\System\wbrfPTe.exe
  2⤵
  PID:7572
- C:\Windows\System\dApjjBG.exe
  C:\Windows\System\dApjjBG.exe
  2⤵
  PID:7588
- C:\Windows\System\sawvyTY.exe
  C:\Windows\System\sawvyTY.exe
  2⤵
  PID:7604
- C:\Windows\System\oTEBdTu.exe
  C:\Windows\System\oTEBdTu.exe
  2⤵
  PID:7620
- C:\Windows\System\cUMutqw.exe
  C:\Windows\System\cUMutqw.exe
  2⤵
  PID:7668
- C:\Windows\System\QBOcBZh.exe
  C:\Windows\System\QBOcBZh.exe
  2⤵
  PID:7700
- C:\Windows\System\MeFkNVz.exe
  C:\Windows\System\MeFkNVz.exe
  2⤵
  PID:7724
- C:\Windows\System\WtScKCg.exe
  C:\Windows\System\WtScKCg.exe
  2⤵
  PID:7748
- C:\Windows\System\bRkOamh.exe
  C:\Windows\System\bRkOamh.exe
  2⤵
  PID:7816
- C:\Windows\System\GQPiFft.exe
  C:\Windows\System\GQPiFft.exe
  2⤵
  PID:7832
- C:\Windows\System\zFOqhEu.exe
  C:\Windows\System\zFOqhEu.exe
  2⤵
  PID:7848
- C:\Windows\System\qNtAKWJ.exe
  C:\Windows\System\qNtAKWJ.exe
  2⤵
  PID:7868
- C:\Windows\System\LyGdxTz.exe
  C:\Windows\System\LyGdxTz.exe
  2⤵
  PID:7884
- C:\Windows\System\EdKzaYO.exe
  C:\Windows\System\EdKzaYO.exe
  2⤵
  PID:7912
- C:\Windows\System\ZATzSpr.exe
  C:\Windows\System\ZATzSpr.exe
  2⤵
  PID:7932
- C:\Windows\System\HjFGbOY.exe
  C:\Windows\System\HjFGbOY.exe
  2⤵
  PID:7948
- C:\Windows\System\SjMWywt.exe
  C:\Windows\System\SjMWywt.exe
  2⤵
  PID:7964
- C:\Windows\System\oxElkvL.exe
  C:\Windows\System\oxElkvL.exe
  2⤵
  PID:7980
- C:\Windows\System\bsunfcP.exe
  C:\Windows\System\bsunfcP.exe
  2⤵
  PID:7996
- C:\Windows\System\zlXkhXr.exe
  C:\Windows\System\zlXkhXr.exe
  2⤵
  PID:8012
- C:\Windows\System\ZHbzUPK.exe
  C:\Windows\System\ZHbzUPK.exe
  2⤵
  PID:8040
- C:\Windows\System\GosjOBl.exe
  C:\Windows\System\GosjOBl.exe
  2⤵
  PID:8056
- C:\Windows\System\zgsVLIS.exe
  C:\Windows\System\zgsVLIS.exe
  2⤵
  PID:8152
- C:\Windows\System\NOOvzgz.exe
  C:\Windows\System\NOOvzgz.exe
  2⤵
  PID:6344
- C:\Windows\System\sVzXzcD.exe
  C:\Windows\System\sVzXzcD.exe
  2⤵
  PID:7424
- C:\Windows\System\gkLxLnq.exe
  C:\Windows\System\gkLxLnq.exe
  2⤵
  PID:7380
- C:\Windows\System\vbSxpCn.exe
  C:\Windows\System\vbSxpCn.exe
  2⤵
  PID:7420
- C:\Windows\System\SyhCkBs.exe
  C:\Windows\System\SyhCkBs.exe
  2⤵
  PID:6692
- C:\Windows\System\qhLKCKr.exe
  C:\Windows\System\qhLKCKr.exe
  2⤵
  PID:5452
- C:\Windows\System\NVosYIq.exe
  C:\Windows\System\NVosYIq.exe
  2⤵
  PID:6340
- C:\Windows\System\aokqxRo.exe
  C:\Windows\System\aokqxRo.exe
  2⤵
  PID:3888
- C:\Windows\System\edGWVbv.exe
  C:\Windows\System\edGWVbv.exe
  2⤵
  PID:1620
- C:\Windows\System\NfMHnPN.exe
  C:\Windows\System\NfMHnPN.exe
  2⤵
  PID:6600
- C:\Windows\System\Dajplia.exe
  C:\Windows\System\Dajplia.exe
  2⤵
  PID:1176
- C:\Windows\System\qCVCcul.exe
  C:\Windows\System\qCVCcul.exe
  2⤵
  PID:6696
- C:\Windows\System\QzJzRWd.exe
  C:\Windows\System\QzJzRWd.exe
  2⤵
  PID:6976
- C:\Windows\System\vRRJXUd.exe
  C:\Windows\System\vRRJXUd.exe
  2⤵
  PID:6596
- C:\Windows\System\QBMOxOl.exe
  C:\Windows\System\QBMOxOl.exe
  2⤵
  PID:7224
- C:\Windows\System\ChVPmMC.exe
  C:\Windows\System\ChVPmMC.exe
  2⤵
  PID:7292
- C:\Windows\System\kLLRvba.exe
  C:\Windows\System\kLLRvba.exe
  2⤵
  PID:7772
- C:\Windows\System\rGFqJQG.exe
  C:\Windows\System\rGFqJQG.exe
  2⤵
  PID:7860
- C:\Windows\System\AIaeMti.exe
  C:\Windows\System\AIaeMti.exe
  2⤵
  PID:7940
- C:\Windows\System\zzUVHoL.exe
  C:\Windows\System\zzUVHoL.exe
  2⤵
  PID:7976
- C:\Windows\System\QqQQFeO.exe
  C:\Windows\System\QqQQFeO.exe
  2⤵
  PID:7876
- C:\Windows\System\xvGPbEF.exe
  C:\Windows\System\xvGPbEF.exe
  2⤵
  PID:7812
- C:\Windows\System\jDlbwVw.exe
  C:\Windows\System\jDlbwVw.exe
  2⤵
  PID:8008
- C:\Windows\System\LUQmIKT.exe
  C:\Windows\System\LUQmIKT.exe
  2⤵
  PID:7924
- C:\Windows\System\AXlcNpB.exe
  C:\Windows\System\AXlcNpB.exe
  2⤵
  PID:7992
- C:\Windows\System\yReAIbG.exe
  C:\Windows\System\yReAIbG.exe
  2⤵
  PID:6984
- C:\Windows\System\SPnsIeb.exe
  C:\Windows\System\SPnsIeb.exe
  2⤵
  PID:8028
- C:\Windows\System\oxpdBlE.exe
  C:\Windows\System\oxpdBlE.exe
  2⤵
  PID:8052
- C:\Windows\System\DXGVVyg.exe
  C:\Windows\System\DXGVVyg.exe
  2⤵
  PID:8068
- C:\Windows\System\HghakES.exe
  C:\Windows\System\HghakES.exe
  2⤵
  PID:8088
- C:\Windows\System\xsvmoVj.exe
  C:\Windows\System\xsvmoVj.exe
  2⤵
  PID:8104
- C:\Windows\System\yPBscpT.exe
  C:\Windows\System\yPBscpT.exe
  2⤵
  PID:8132
- C:\Windows\System\rjVyvjp.exe
  C:\Windows\System\rjVyvjp.exe
  2⤵
  PID:8144
- C:\Windows\System\HAcWLGg.exe
  C:\Windows\System\HAcWLGg.exe
  2⤵
  PID:8160
- C:\Windows\System\oITPLQt.exe
  C:\Windows\System\oITPLQt.exe
  2⤵
  PID:7244
- C:\Windows\System\dQhSvLC.exe
  C:\Windows\System\dQhSvLC.exe
  2⤵
  PID:7344
- C:\Windows\System\DYXYwly.exe
  C:\Windows\System\DYXYwly.exe
  2⤵
  PID:8176
- C:\Windows\System\jdRymkB.exe
  C:\Windows\System\jdRymkB.exe
  2⤵
  PID:2420
- C:\Windows\System\UfsUFnS.exe
  C:\Windows\System\UfsUFnS.exe
  2⤵
  PID:7176
- C:\Windows\System\YhyCdui.exe
  C:\Windows\System\YhyCdui.exe
  2⤵
  PID:7312
- C:\Windows\System\iCMcthf.exe
  C:\Windows\System\iCMcthf.exe
  2⤵
  PID:7460
- C:\Windows\System\KbXAiOY.exe
  C:\Windows\System\KbXAiOY.exe
  2⤵
  PID:7432
- C:\Windows\System\ZERzYjC.exe
  C:\Windows\System\ZERzYjC.exe
  2⤵
  PID:5840
- C:\Windows\System\CmmxIBB.exe
  C:\Windows\System\CmmxIBB.exe
  2⤵
  PID:7536
- C:\Windows\System\AGpmVUY.exe
  C:\Windows\System\AGpmVUY.exe
  2⤵
  PID:6148
- C:\Windows\System\xQqhJRs.exe
  C:\Windows\System\xQqhJRs.exe
  2⤵
  PID:5612
- C:\Windows\System\sXNRTji.exe
  C:\Windows\System\sXNRTji.exe
  2⤵
  PID:6096
- C:\Windows\System\kJHtWyQ.exe
  C:\Windows\System\kJHtWyQ.exe
  2⤵
  PID:6580
- C:\Windows\System\rSfVEmO.exe
  C:\Windows\System\rSfVEmO.exe
  2⤵
  PID:6996
- C:\Windows\System\dgrIcSh.exe
  C:\Windows\System\dgrIcSh.exe
  2⤵
  PID:2396
- C:\Windows\System\udfvBhH.exe
  C:\Windows\System\udfvBhH.exe
  2⤵
  PID:6500
- C:\Windows\System\YEzTJSr.exe
  C:\Windows\System\YEzTJSr.exe
  2⤵
  PID:7144
- C:\Windows\System\eZFcWhD.exe
  C:\Windows\System\eZFcWhD.exe
  2⤵
  PID:6564
- C:\Windows\System\ScXmuqL.exe
  C:\Windows\System\ScXmuqL.exe
  2⤵
  PID:4492
- C:\Windows\System\bJHtOqD.exe
  C:\Windows\System\bJHtOqD.exe
  2⤵
  PID:7076
- C:\Windows\System\LsGDeFq.exe
  C:\Windows\System\LsGDeFq.exe
  2⤵
  PID:6724
- C:\Windows\System\dRUcmJO.exe
  C:\Windows\System\dRUcmJO.exe
  2⤵
  PID:7864
- C:\Windows\System\RELoEQd.exe
  C:\Windows\System\RELoEQd.exe
  2⤵
  PID:7880
- C:\Windows\System\hqNeUzs.exe
  C:\Windows\System\hqNeUzs.exe
  2⤵
  PID:8048
- C:\Windows\System\bffdtJW.exe
  C:\Windows\System\bffdtJW.exe
  2⤵
  PID:8124
- C:\Windows\System\nKyhzqd.exe
  C:\Windows\System\nKyhzqd.exe
  2⤵
  PID:8148
- C:\Windows\System\hqdLmqu.exe
  C:\Windows\System\hqdLmqu.exe
  2⤵
  PID:7240
- C:\Windows\System\jWHFTfl.exe
  C:\Windows\System\jWHFTfl.exe
  2⤵
  PID:6908
- C:\Windows\System\NBSoCHe.exe
  C:\Windows\System\NBSoCHe.exe
  2⤵
  PID:5648
- C:\Windows\System\LslNHiG.exe
  C:\Windows\System\LslNHiG.exe
  2⤵
  PID:6944
- C:\Windows\System\NRaMtmd.exe
  C:\Windows\System\NRaMtmd.exe
  2⤵
  PID:7404
- C:\Windows\System\hHjBPrC.exe
  C:\Windows\System\hHjBPrC.exe
  2⤵
  PID:7476
- C:\Windows\System\WnyBIGm.exe
  C:\Windows\System\WnyBIGm.exe
  2⤵
  PID:7552
- C:\Windows\System\piGEkZe.exe
  C:\Windows\System\piGEkZe.exe
  2⤵
  PID:7676
- C:\Windows\System\svSxqVc.exe
  C:\Windows\System\svSxqVc.exe
  2⤵
  PID:5920
- C:\Windows\System\yiqANoq.exe
  C:\Windows\System\yiqANoq.exe
  2⤵
  PID:7708
- C:\Windows\System\uNTLAWF.exe
  C:\Windows\System\uNTLAWF.exe
  2⤵
  PID:7648
- C:\Windows\System\wGOVJSF.exe
  C:\Windows\System\wGOVJSF.exe
  2⤵
  PID:7720
- C:\Windows\System\vGglPZh.exe
  C:\Windows\System\vGglPZh.exe
  2⤵
  PID:7824
- C:\Windows\System\ZdYOUxN.exe
  C:\Windows\System\ZdYOUxN.exe
  2⤵
  PID:7632
- C:\Windows\System\JRsmlMY.exe
  C:\Windows\System\JRsmlMY.exe
  2⤵
  PID:8004
- C:\Windows\System\VBstHiZ.exe
  C:\Windows\System\VBstHiZ.exe
  2⤵
  PID:7804
- C:\Windows\System\AqeggZO.exe
  C:\Windows\System\AqeggZO.exe
  2⤵
  PID:8064
- C:\Windows\System\AFAkrrZ.exe
  C:\Windows\System\AFAkrrZ.exe
  2⤵
  PID:8140
- C:\Windows\System\EAWnYOO.exe
  C:\Windows\System\EAWnYOO.exe
  2⤵
  PID:8172
- C:\Windows\System\TjFTEkI.exe
  C:\Windows\System\TjFTEkI.exe
  2⤵
  PID:6648
- C:\Windows\System\wybXjVS.exe
  C:\Windows\System\wybXjVS.exe
  2⤵
  PID:7732
- C:\Windows\System\UDCDgJx.exe
  C:\Windows\System\UDCDgJx.exe
  2⤵
  PID:5220
- C:\Windows\System\IXqSrwy.exe
  C:\Windows\System\IXqSrwy.exe
  2⤵
  PID:6824
- C:\Windows\System\kiwXUHE.exe
  C:\Windows\System\kiwXUHE.exe
  2⤵
  PID:6200
- C:\Windows\System\dAZObvl.exe
  C:\Windows\System\dAZObvl.exe
  2⤵
  PID:5508
- C:\Windows\System\xXhnUsF.exe
  C:\Windows\System\xXhnUsF.exe
  2⤵
  PID:5320
- C:\Windows\System\BulbVao.exe
  C:\Windows\System\BulbVao.exe
  2⤵
  PID:1552
- C:\Windows\System\OSkWsWc.exe
  C:\Windows\System\OSkWsWc.exe
  2⤵
  PID:8120
- C:\Windows\System\CIVLMio.exe
  C:\Windows\System\CIVLMio.exe
  2⤵
  PID:7212
- C:\Windows\System\ojOQGGr.exe
  C:\Windows\System\ojOQGGr.exe
  2⤵
  PID:6324
- C:\Windows\System\aCMFJaS.exe
  C:\Windows\System\aCMFJaS.exe
  2⤵
  PID:7364
- C:\Windows\System\UDaHJME.exe
  C:\Windows\System\UDaHJME.exe
  2⤵
  PID:7612
- C:\Windows\System\DBDJiBX.exe
  C:\Windows\System\DBDJiBX.exe
  2⤵
  PID:7684
- C:\Windows\System\DMblXvF.exe
  C:\Windows\System\DMblXvF.exe
  2⤵
  PID:7788
- C:\Windows\System\Wcbaihv.exe
  C:\Windows\System\Wcbaihv.exe
  2⤵
  PID:7764
- C:\Windows\System\mIOCNtX.exe
  C:\Windows\System\mIOCNtX.exe
  2⤵
  PID:7904
- C:\Windows\System\uJqtthK.exe
  C:\Windows\System\uJqtthK.exe
  2⤵
  PID:7180
- C:\Windows\System\kQmrneR.exe
  C:\Windows\System\kQmrneR.exe
  2⤵
  PID:7696
- C:\Windows\System\SJeDrmT.exe
  C:\Windows\System\SJeDrmT.exe
  2⤵
  PID:6660
- C:\Windows\System\ZVnpwzv.exe
  C:\Windows\System\ZVnpwzv.exe
  2⤵
  PID:8076
- C:\Windows\System\nGOnkIR.exe
  C:\Windows\System\nGOnkIR.exe
  2⤵
  PID:7132
- C:\Windows\System\ofZPGUm.exe
  C:\Windows\System\ofZPGUm.exe
  2⤵
  PID:7532
- C:\Windows\System\owmhiuR.exe
  C:\Windows\System\owmhiuR.exe
  2⤵
  PID:8084
- C:\Windows\System\DpsGpmV.exe
  C:\Windows\System\DpsGpmV.exe
  2⤵
  PID:7688
- C:\Windows\System\RMEKHQj.exe
  C:\Windows\System\RMEKHQj.exe
  2⤵
  PID:6208
- C:\Windows\System\ROYGaGE.exe
  C:\Windows\System\ROYGaGE.exe
  2⤵
  PID:7496
- C:\Windows\System\UUrXzHL.exe
  C:\Windows\System\UUrXzHL.exe
  2⤵
  PID:8168
- C:\Windows\System\WaxYkTX.exe
  C:\Windows\System\WaxYkTX.exe
  2⤵
  PID:6744
- C:\Windows\System\RLzXqlT.exe
  C:\Windows\System\RLzXqlT.exe
  2⤵
  PID:7280
- C:\Windows\System\BBazzEY.exe
  C:\Windows\System\BBazzEY.exe
  2⤵
  PID:7408
- C:\Windows\System\wmXQDip.exe
  C:\Windows\System\wmXQDip.exe
  2⤵
  PID:7628
- C:\Windows\System\winVrvP.exe
  C:\Windows\System\winVrvP.exe
  2⤵
  PID:8208
- C:\Windows\System\dgfcNJE.exe
  C:\Windows\System\dgfcNJE.exe
  2⤵
  PID:8252
- C:\Windows\System\GpjEmjg.exe
  C:\Windows\System\GpjEmjg.exe
  2⤵
  PID:8284
- C:\Windows\System\dMtVKtv.exe
  C:\Windows\System\dMtVKtv.exe
  2⤵
  PID:8356
- C:\Windows\System\MBQRAfu.exe
  C:\Windows\System\MBQRAfu.exe
  2⤵
  PID:8372
- C:\Windows\System\EbAmhpG.exe
  C:\Windows\System\EbAmhpG.exe
  2⤵
  PID:8396
- C:\Windows\System\IVHvJHF.exe
  C:\Windows\System\IVHvJHF.exe
  2⤵
  PID:8844
- C:\Windows\System\ShgZsZC.exe
  C:\Windows\System\ShgZsZC.exe
  2⤵
  PID:8864
- C:\Windows\System\TReBJhO.exe
  C:\Windows\System\TReBJhO.exe
  2⤵
  PID:8880
- C:\Windows\System\FhMIZKO.exe
  C:\Windows\System\FhMIZKO.exe
  2⤵
  PID:8896
- C:\Windows\System\IRODobb.exe
  C:\Windows\System\IRODobb.exe
  2⤵
  PID:8916
- C:\Windows\System\KQBDAar.exe
  C:\Windows\System\KQBDAar.exe
  2⤵
  PID:8932
- C:\Windows\System\glDnYML.exe
  C:\Windows\System\glDnYML.exe
  2⤵
  PID:8948
- C:\Windows\System\cgrSsZI.exe
  C:\Windows\System\cgrSsZI.exe
  2⤵
  PID:8964
- C:\Windows\System\JMTVzpU.exe
  C:\Windows\System\JMTVzpU.exe
  2⤵
  PID:8980
- C:\Windows\System\kynNXoG.exe
  C:\Windows\System\kynNXoG.exe
  2⤵
  PID:8996
- C:\Windows\System\rEvUFgD.exe
  C:\Windows\System\rEvUFgD.exe
  2⤵
  PID:9012
- C:\Windows\System\vuISrTE.exe
  C:\Windows\System\vuISrTE.exe
  2⤵
  PID:9028
- C:\Windows\System\FIStHQk.exe
  C:\Windows\System\FIStHQk.exe
  2⤵
  PID:9044
- C:\Windows\System\PxjdMjI.exe
  C:\Windows\System\PxjdMjI.exe
  2⤵
  PID:9060
- C:\Windows\System\xsVQUdL.exe
  C:\Windows\System\xsVQUdL.exe
  2⤵
  PID:9076
- C:\Windows\System\GQtYuyb.exe
  C:\Windows\System\GQtYuyb.exe
  2⤵
  PID:9092
- C:\Windows\System\lLeBUqz.exe
  C:\Windows\System\lLeBUqz.exe
  2⤵
  PID:9108
- C:\Windows\System\SOwjiCL.exe
  C:\Windows\System\SOwjiCL.exe
  2⤵
  PID:9124
- C:\Windows\System\EqafhqY.exe
  C:\Windows\System\EqafhqY.exe
  2⤵
  PID:9140
- C:\Windows\System\jpeEKrO.exe
  C:\Windows\System\jpeEKrO.exe
  2⤵
  PID:9156
- C:\Windows\System\PrdrloX.exe
  C:\Windows\System\PrdrloX.exe
  2⤵
  PID:9172
- C:\Windows\System\oDUBOiq.exe
  C:\Windows\System\oDUBOiq.exe
  2⤵
  PID:9188
- C:\Windows\System\gbBQMgF.exe
  C:\Windows\System\gbBQMgF.exe
  2⤵
  PID:9204
- C:\Windows\System\PKQqVfe.exe
  C:\Windows\System\PKQqVfe.exe
  2⤵
  PID:7740
- C:\Windows\System\OJmbZzw.exe
  C:\Windows\System\OJmbZzw.exe
  2⤵
  PID:7328
- C:\Windows\System\clRMEIz.exe
  C:\Windows\System\clRMEIz.exe
  2⤵
  PID:7392
- C:\Windows\System\ZGUZFVM.exe
  C:\Windows\System\ZGUZFVM.exe
  2⤵
  PID:6664
- C:\Windows\System\yqHyAiZ.exe
  C:\Windows\System\yqHyAiZ.exe
  2⤵
  PID:6280
- C:\Windows\System\LMuXmOb.exe
  C:\Windows\System\LMuXmOb.exe
  2⤵
  PID:8200
- C:\Windows\System\UFwLRVH.exe
  C:\Windows\System\UFwLRVH.exe
  2⤵
  PID:8292
- C:\Windows\System\cXuvaeb.exe
  C:\Windows\System\cXuvaeb.exe
  2⤵
  PID:8304
- C:\Windows\System\VXbkMHX.exe
  C:\Windows\System\VXbkMHX.exe
  2⤵
  PID:8276
- C:\Windows\System\kPQteKG.exe
  C:\Windows\System\kPQteKG.exe
  2⤵
  PID:8312
- C:\Windows\System\JurmtNG.exe
  C:\Windows\System\JurmtNG.exe
  2⤵
  PID:8380
- C:\Windows\System\IYPTMVJ.exe
  C:\Windows\System\IYPTMVJ.exe
  2⤵
  PID:8340
- C:\Windows\System\PbTkPor.exe
  C:\Windows\System\PbTkPor.exe
  2⤵
  PID:8384
- C:\Windows\System\BueitvV.exe
  C:\Windows\System\BueitvV.exe
  2⤵
  PID:3728
- C:\Windows\System\HjIszoK.exe
  C:\Windows\System\HjIszoK.exe
  2⤵
  PID:7360
- C:\Windows\System\GrZSERh.exe
  C:\Windows\System\GrZSERh.exe
  2⤵
  PID:8408
- C:\Windows\System\BUWZNDu.exe
  C:\Windows\System\BUWZNDu.exe
  2⤵
  PID:8416
- C:\Windows\System\ehgCIYT.exe
  C:\Windows\System\ehgCIYT.exe
  2⤵
  PID:8488
- C:\Windows\System\ABfVQoi.exe
  C:\Windows\System\ABfVQoi.exe
  2⤵
  PID:8528
- C:\Windows\System\LoWilbT.exe
  C:\Windows\System\LoWilbT.exe
  2⤵
  PID:8560
- C:\Windows\System\bCTOzrZ.exe
  C:\Windows\System\bCTOzrZ.exe
  2⤵
  PID:8424
- C:\Windows\System\IvZSflh.exe
  C:\Windows\System\IvZSflh.exe
  2⤵
  PID:8616
- C:\Windows\System\fpfWEpd.exe
  C:\Windows\System\fpfWEpd.exe
  2⤵
  PID:8632
- C:\Windows\System\zvmQHnl.exe
  C:\Windows\System\zvmQHnl.exe
  2⤵
  PID:8492
- C:\Windows\System\jCiMcFE.exe
  C:\Windows\System\jCiMcFE.exe
  2⤵
  PID:8636
- C:\Windows\System\GFwbVXT.exe
  C:\Windows\System\GFwbVXT.exe
  2⤵
  PID:8652
- C:\Windows\System\pfMNFVd.exe
  C:\Windows\System\pfMNFVd.exe
  2⤵
  PID:8624
- C:\Windows\System\fGLoydG.exe
  C:\Windows\System\fGLoydG.exe
  2⤵
  PID:8600
- C:\Windows\System\JaXuUVq.exe
  C:\Windows\System\JaXuUVq.exe
  2⤵
  PID:8580
- C:\Windows\System\HUUlxCJ.exe
  C:\Windows\System\HUUlxCJ.exe
  2⤵
  PID:8556
- C:\Windows\System\sxdJjxo.exe
  C:\Windows\System\sxdJjxo.exe
  2⤵
  PID:8524
- C:\Windows\System\xPXRnhl.exe
  C:\Windows\System\xPXRnhl.exe
  2⤵
  PID:8676
- C:\Windows\System\kAANYtb.exe
  C:\Windows\System\kAANYtb.exe
  2⤵
  PID:8688
- C:\Windows\System\DENnWny.exe
  C:\Windows\System\DENnWny.exe
  2⤵
  PID:8708
- C:\Windows\System\aWZUDUh.exe
  C:\Windows\System\aWZUDUh.exe
  2⤵
  PID:8728
- C:\Windows\System\TgwdHhS.exe
  C:\Windows\System\TgwdHhS.exe
  2⤵
  PID:8716
- C:\Windows\System\dsfBqDo.exe
  C:\Windows\System\dsfBqDo.exe
  2⤵
  PID:8776
- C:\Windows\System\EbkFgeK.exe
  C:\Windows\System\EbkFgeK.exe
  2⤵
  PID:8804
- C:\Windows\System\UgXRptO.exe
  C:\Windows\System\UgXRptO.exe
  2⤵
  PID:8764
- C:\Windows\System\TiZliro.exe
  C:\Windows\System\TiZliro.exe
  2⤵
  PID:8824
- C:\Windows\System\ByYnoBT.exe
  C:\Windows\System\ByYnoBT.exe
  2⤵
  PID:8756
- C:\Windows\System\NlBIjSW.exe
  C:\Windows\System\NlBIjSW.exe
  2⤵
  PID:8800
- C:\Windows\System\uXvhmmt.exe
  C:\Windows\System\uXvhmmt.exe
  2⤵
  PID:8872
- C:\Windows\System\gEdDFlA.exe
  C:\Windows\System\gEdDFlA.exe
  2⤵
  PID:8912
- C:\Windows\System\HzXaiTz.exe
  C:\Windows\System\HzXaiTz.exe
  2⤵
  PID:8860
- C:\Windows\System\nvssKco.exe
  C:\Windows\System\nvssKco.exe
  2⤵
  PID:8972
- C:\Windows\System\oXKUtIL.exe
  C:\Windows\System\oXKUtIL.exe
  2⤵
  PID:9008
- C:\Windows\System\CjnnZER.exe
  C:\Windows\System\CjnnZER.exe
  2⤵
  PID:8992
- C:\Windows\System\mxSVDVU.exe
  C:\Windows\System\mxSVDVU.exe
  2⤵
  PID:9068
- C:\Windows\System\lfWuudM.exe
  C:\Windows\System\lfWuudM.exe
  2⤵
  PID:9100
- C:\Windows\System\sMmDMMh.exe
  C:\Windows\System\sMmDMMh.exe
  2⤵
  PID:9116
- C:\Windows\System\TLetLPi.exe
  C:\Windows\System\TLetLPi.exe
  2⤵
  PID:9136
- C:\Windows\System\ewPSkqf.exe
  C:\Windows\System\ewPSkqf.exe
  2⤵
  PID:9168
- C:\Windows\System\UQNYYFw.exe
  C:\Windows\System\UQNYYFw.exe
  2⤵
  PID:8836
- C:\Windows\System\PKcpGJU.exe
  C:\Windows\System\PKcpGJU.exe
  2⤵
  PID:7520
- C:\Windows\System\CWKqSvJ.exe
  C:\Windows\System\CWKqSvJ.exe
  2⤵
  PID:7548
- C:\Windows\System\rrfGMTh.exe
  C:\Windows\System\rrfGMTh.exe
  2⤵
  PID:8300
- C:\Windows\System\pdIInrj.exe
  C:\Windows\System\pdIInrj.exe
  2⤵
  PID:7780
- C:\Windows\System\wQnYMYY.exe
  C:\Windows\System\wQnYMYY.exe
  2⤵
  PID:8308
- C:\Windows\System\cRlFjaC.exe
  C:\Windows\System\cRlFjaC.exe
  2⤵
  PID:8336
- C:\Windows\System\shbhdXT.exe
  C:\Windows\System\shbhdXT.exe
  2⤵
  PID:3188
- C:\Windows\System\bArbXAf.exe
  C:\Windows\System\bArbXAf.exe
  2⤵
  PID:8388
- C:\Windows\System\GfjBFVe.exe
  C:\Windows\System\GfjBFVe.exe
  2⤵
  PID:8468
- C:\Windows\System\zmzVIJi.exe
  C:\Windows\System\zmzVIJi.exe
  2⤵
  PID:8540
- C:\Windows\System\KMZoAdb.exe
  C:\Windows\System\KMZoAdb.exe
  2⤵
  PID:8428
- C:\Windows\System\hiioiWI.exe
  C:\Windows\System\hiioiWI.exe
  2⤵
  PID:8480
- C:\Windows\System\IeSHcAE.exe
  C:\Windows\System\IeSHcAE.exe
  2⤵
  PID:8460
- C:\Windows\System\aAeHDnZ.exe
  C:\Windows\System\aAeHDnZ.exe
  2⤵
  PID:8604
- C:\Windows\System\NPVCIsd.exe
  C:\Windows\System\NPVCIsd.exe
  2⤵
  PID:8564
- C:\Windows\System\tTbEZna.exe
  C:\Windows\System\tTbEZna.exe
  2⤵
  PID:8544
- C:\Windows\System\PiOjwDH.exe
  C:\Windows\System\PiOjwDH.exe
  2⤵
  PID:8696
- C:\Windows\System\lAhZbDe.exe
  C:\Windows\System\lAhZbDe.exe
  2⤵
  PID:8684
- C:\Windows\System\UBKuyXT.exe
  C:\Windows\System\UBKuyXT.exe
  2⤵
  PID:8768
- C:\Windows\System\gcZUYfY.exe
  C:\Windows\System\gcZUYfY.exe
  2⤵
  PID:8816
- C:\Windows\System\GGQasNv.exe
  C:\Windows\System\GGQasNv.exe
  2⤵
  PID:8788
- C:\Windows\System\osWohTI.exe
  C:\Windows\System\osWohTI.exe
  2⤵
  PID:8828
- C:\Windows\System\BwPuVBu.exe
  C:\Windows\System\BwPuVBu.exe
  2⤵
  PID:8944
- C:\Windows\System\ZDdZBYF.exe
  C:\Windows\System\ZDdZBYF.exe
  2⤵
  PID:8976
- C:\Windows\System\mKUXuWR.exe
  C:\Windows\System\mKUXuWR.exe
  2⤵
  PID:9024
- C:\Windows\System\kctWWJF.exe
  C:\Windows\System\kctWWJF.exe
  2⤵
  PID:9088
- C:\Windows\System\PiEXddL.exe
  C:\Windows\System\PiEXddL.exe
  2⤵
  PID:9164
- C:\Windows\System\mqowpTc.exe
  C:\Windows\System\mqowpTc.exe
  2⤵
  PID:7128
- C:\Windows\System\ePcbMmC.exe
  C:\Windows\System\ePcbMmC.exe
  2⤵
  PID:8228
- C:\Windows\System\lSXmiyh.exe
  C:\Windows\System\lSXmiyh.exe
  2⤵
  PID:8324
- C:\Windows\System\kEtxMMk.exe
  C:\Windows\System\kEtxMMk.exe
  2⤵
  PID:8368
- C:\Windows\System\WIRGJki.exe
  C:\Windows\System\WIRGJki.exe
  2⤵
  PID:8348
- C:\Windows\System\Hkoeehy.exe
  C:\Windows\System\Hkoeehy.exe
  2⤵
  PID:8476
- C:\Windows\System\XFadBXP.exe
  C:\Windows\System\XFadBXP.exe
  2⤵
  PID:8548
- C:\Windows\System\xNvIceQ.exe
  C:\Windows\System\xNvIceQ.exe
  2⤵
  PID:8508
- C:\Windows\System\EzdZXuP.exe
  C:\Windows\System\EzdZXuP.exe
  2⤵
  PID:8592
- C:\Windows\System\LTUHoLY.exe
  C:\Windows\System\LTUHoLY.exe
  2⤵
  PID:8536
- C:\Windows\System\qWDyUXN.exe
  C:\Windows\System\qWDyUXN.exe
  2⤵
  PID:8720
- C:\Windows\System\nwpQkIx.exe
  C:\Windows\System\nwpQkIx.exe
  2⤵
  PID:8852
- C:\Windows\System\dbAHSyA.exe
  C:\Windows\System\dbAHSyA.exe
  2⤵
  PID:1196
- C:\Windows\System\UdrCEkH.exe
  C:\Windows\System\UdrCEkH.exe
  2⤵
  PID:8808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DOCPTUj.exe

Filesize
1.9MB

MD5
624452e48521489504b6eacdddc3711c

SHA1
5c5097f074f0181fe49f7be62ef9fd4ffc8b1808

SHA256
aef896ed648b19e35ed0bf00612f77690f86b9c8e5ec4653af2b6f6f0fb05f39

SHA512
059c8d75ebb7fd1520fbf43ff124f4a4668b02f918916f46eccc6c34e65588cccb4f1fa3410ee5ef41671b1fa34224a2b655d86332f46189094344d0e0e59ead

Download Submit
C:\Windows\system\JsVeGBm.exe

Filesize
1.9MB

MD5
dba2912329a5a5ba9b03700cb5076da8

SHA1
05fa5d2c903df4e4f4039fea6b686ee0028fee27

SHA256
c47952e3a930ff628da23296429ebb45a85d40327218a4d954b9b5408d4ae55f

SHA512
09f7c7d28699a81d62d26f403f82eca1c6f071776a2d11a5b36efc8e966727855ffdce0f2dbcdeafa54e20c174aad92f4cd127c282c1d1e305b05e44fd3c9980

Download Submit
C:\Windows\system\QCqGfRM.exe

Filesize
1.9MB

MD5
662ab4abbdd533611ee17111b5eaffba

SHA1
e96aa182f5fb711142325182e81e4a179681c3ab

SHA256
e08a0a3490e137e90b2da4142c2879241fd6876a47c4f2aba469c9da36c57ca3

SHA512
ad65de712834a0d4c009f317c31dd43bd86fa79fa41d14a1f092b9e377a4e8e529c1d3dfc6c386c995ebc16b25bde605e327ff51761af233aff4105a70f19857

Download Submit
C:\Windows\system\QEBIeZU.exe

Filesize
1.9MB

MD5
ff73193bb0f343ab0db4d7a1fcf639ef

SHA1
fa81e9be273176e81abf2759e6b2270563c97679

SHA256
bb06c101d75f70df7367326d36e9f016f6e9fe46f4e452fd967a4128e16514c4

SHA512
f305e634453a59550eadc963a8bdbeb06dba6957dea609b1acf7d1288a271af74268dafba18ed81480eeeddbb1f43ad635832cf6a55ab4f46b4a5654d283649a

Download Submit
C:\Windows\system\TTyZnbJ.exe

Filesize
1.9MB

MD5
ed21e41a698ff212cbec5f95a9838c7e

SHA1
47f830196be6133ebbdc7257d39448f57e83e6e5

SHA256
8a0876321700ac06b0aaad0be3e1a7e47e5515895c2a18b5b30868b9e8442c5a

SHA512
f2fc0dfd9c681281f7b9ce5eb70c535283ea192344db3865b9b092d35e92a240111e83b00c650b7563a7129a63de77d2ad136cf09f45c460f2f35078e1825ece

Download Submit
C:\Windows\system\UYgmtpJ.exe

Filesize
1.9MB

MD5
dbd1c5094fe7fcab99bf1f80b4f2b54b

SHA1
989c2fc3718353ebd5142b3fcc5fb134a4aec739

SHA256
e9145c4e2ba1f1acb868bf987d456e0116060c91ac1274baa4bfae73d16ad553

SHA512
1b08e46cd6553a73c36ee9cf0ea97a424f9274bd30f1b41eaf5fc06a38a60a8eb13709e19a12160ab22a122493adc5ca9e9f0c98c78303e2868f49ba17660708

Download Submit
C:\Windows\system\UzrpvwA.exe

Filesize
1.9MB

MD5
130b7333e7bc123a6186da67ab3d248a

SHA1
0319567ddf0c668c637800dbc9db366195201edb

SHA256
a81e7495dbb4fcf9eec3b85c4268b7f8e755fec63262a3d78d57f62800618f86

SHA512
dab7c5e652e0e25c1e62230db032bf6773c4c2be1665edc3a159224d2180e1496575de2b368a26ba9882630725b2f314673a89faae9677681bac24f38dff6999

Download Submit
C:\Windows\system\VwiQNmW.exe

Filesize
1.9MB

MD5
0f394111d5ef4dbff0de2e7a2efe94bd

SHA1
891d6739c8e1bdb574117d4bf1ab74bf81f6a5bc

SHA256
9e189763d1d44ce78cf3baddf61696bf35555a276f3a18c680224f9929952ac0

SHA512
34ae5ccd377761e2990a80f00feaaecb7f56e12eaf2b3ff84ab19b23e13b1fe1cda2f43b2a03cff044bce19e04f39848b6f7326d25b7279d7f07756c8a9a312b

Download Submit
C:\Windows\system\WoNCqeT.exe

Filesize
1.9MB

MD5
54aae6838f5cf32bc632f56f1f07f0a4

SHA1
7bb6697534d0f5c40d3d3971455226a1a64112a3

SHA256
f6f7e363b34b2d64802cd9ebe07da30c625a7234d2c8c4d5e8b7b3106d55168f

SHA512
28d9fc54fbee454396a01005b1a8f5d3ff42abd316a402e485af4bba42428e284a2eb876c847ce28b979cea56ce10cf5bad54cbc1d57a2e41ae306de4e419abf

Download Submit
C:\Windows\system\XsFYurh.exe

Filesize
1.9MB

MD5
b9413ba5c1ef635dfbc2db46fc58c23b

SHA1
a4c146e34b5e1b756baac67d3217b87214a96c2f

SHA256
5cacf1e2f49c808db12e4e511d6d9376e31f3d5d81545ef1c1ca6b9651647b0d

SHA512
0cb0795962a89ff8d20fa851ceac041d3bcf879d1f5c2136925b445c8ac176cb041599761ced0250ddfae058098c69a773448b3de33e33a5f9993dce2b8dd00c

Download Submit
C:\Windows\system\aurIclD.exe

Filesize
1.9MB

MD5
777aaa85ca65f6fc1ce36e3c008f7ee9

SHA1
e7e16bf9cd8c9812b78acdc5b1a41fa406dc21e4

SHA256
1c75f59ab49efab94cbdc2e900fac6eb7f7847b27dab112df7201209e435ce48

SHA512
dc4cc97f371f9b7837dfe3f277d44402a0edefad70c3c6bbfc6377c6e3756c15b92139fe76852a73903e6890afd424b657086e312afaee935e027951ba7e6c74

Download Submit
C:\Windows\system\cjFkuTw.exe

Filesize
1.9MB

MD5
7eb565c7ab2e379ec998e5412140b4d2

SHA1
f6963857abb2044a37fe6fc278ae95647c22ba0b

SHA256
11dff0b85fd520854c69cdccd4e254cc856ab4530f6244a0329bd4be748c698c

SHA512
27aaa859133805464787da7eb74a4bafd2d3863962de6548a8dc65b37a77c15f6f75707981b7ceccd01f605ae81e921763bc37ab6dc14a8da2cc7b55e4c5f3bd

Download Submit
C:\Windows\system\dJLOknP.exe

Filesize
1.9MB

MD5
c8ded3d77c43013856c7dc356740d07b

SHA1
0404482e0c8a29009f8397de562cb198d12539fb

SHA256
914425e5a93201efd31f0e5f87beffb0822c0ef9ff4801fba496a0adbcd4b5f9

SHA512
44e844e881efa197a9b468d3688b3bdcba9c1957e3729604f298054332f75f277e28f1f5a552cb9706df50610bba1be2b7c61f57505c22efd1b50f2cc17b3844

Download Submit
C:\Windows\system\eJSvETk.exe

Filesize
1.9MB

MD5
89cbc684905091625eac81db44e02f28

SHA1
77558a70dad9ed04433c6be8b64dffd149403475

SHA256
3a286ec6bf3eda51438b6ca40a367d226c375b7138d212f687679a04005c79f0

SHA512
2dcbd2abbfef4b1bdb05d0e4ab5317beeca3ba46176cbfd04c8413608a0edf2c79d03ad3a8da5233c6ef19a369ed7da8938c82732826d904dd0d343f5db67c4f

Download Submit
C:\Windows\system\gpvyrCP.exe

Filesize
1.9MB

MD5
2a9427aaf7865d37bee923a743901835

SHA1
1d63548e730749689a71650c0cd86db2da51ffdd

SHA256
172f5253639dcd5fad5dade1035741b9c54fb99542444079f769bd5ff524c6bc

SHA512
3b448e5e52308ec6d83b5e8651b6ec2584c0ad90084b791e8099c3e2a13f682d473f4782ba879aa90ade4b1cd657bddd50b490c6c4a3e8995b3c782f36b1e774

Download Submit
C:\Windows\system\ibHHFxP.exe

Filesize
1.9MB

MD5
a460e9ac38c17464242159c7708d60f9

SHA1
f2fe0ca19f8cd99106c64f7f2cc37574e3ab7396

SHA256
9a343e9a42d18a75f451419f47bdbbad026d25a74cc982b18a541890f9cae69a

SHA512
e0370027296a2db04931344440472b289d3b27d80fb6bb0bb6ef404cd3219fb3a3f411b82282b0700b0808589e6f4b826e4d5bd6f3dc5f180ffc8cbdf7eb44ca

Download Submit
C:\Windows\system\lpKADTc.exe

Filesize
1.9MB

MD5
25c41e46b2552ca5afff10946e60be8b

SHA1
1062f5f4e84a4f0ad0ea205d0f283edcea24a002

SHA256
96db24e6519fc06f5280c52582e0a3814911a75d5f7e7e1463e2234dd4ef06a0

SHA512
0500215843c24738bc2e1bb32b7b1b25d414f7daf7e95385b6cd811050487b9ffe8152f7a86659b9ae77a2ebbb816f5f3eddf8f06ec63d8232476444c00f8373

Download Submit
C:\Windows\system\noZvCfr.exe

Filesize
1.9MB

MD5
25347ff796d7aa385592eeb6dbfb3e5f

SHA1
b9d759624e2bf7331a06aa2b58a65e8403f68d7d

SHA256
787e959024996ba2bc80372dd72d7b77d1d1be235159222a37317896b21a85c8

SHA512
8be987cb6b36dd15d869d5d7223d39565ba85ed4c967e956751598addbb32554d6b043c3bf0a8a33d2938d6c6571f96c00265db26edd3ea13258c44d3bb1b4ea

Download Submit
C:\Windows\system\oPxJuli.exe

Filesize
1.9MB

MD5
9fb5ac9a76c7a30e65aaddfeef1c103f

SHA1
925f683d32153720ffda02156828efa1d62eebab

SHA256
9ffc0e5069af3455acf77d86cddf07db95cd1bf5129bcffbf1e3e2767902311e

SHA512
2257af6b58569d2dba4b845e5ea6fdad27c139164eed7bff3cebf0d88a7c205fc38ff22640d025e0f635e419bd58c1d2958771cc960b71fb2d4ae1cabf51c95c

Download Submit
C:\Windows\system\oYUsdVi.exe

Filesize
1.9MB

MD5
c1ce4b3568d9a7e9602ae2ce2ca9a4e6

SHA1
f096fa611fcc00f0069e79a8ba4433d5d019a707

SHA256
ef1f57edd1efe953b868a631952be3a8675cae8d9a42e1edc1b522b56174265c

SHA512
a3f11dad267c69f053ed61abf244613dbd1f4e2b424ada376f5f2639b2b7594c3c7cada3d23788a75b02ae8df5753033f10684457a7c235ea2daf9c373686689

Download Submit
C:\Windows\system\qJhqpUK.exe

Filesize
1.9MB

MD5
d2b523a17a325f5a12ceb2e70ee95760

SHA1
cd3c5bc2206e9c0e007423edda5447090b1f0460

SHA256
136085e88c0c846545429294f48c79cd5f169ea3f9be90fa99df905a86aa9400

SHA512
69fcf17e074c7e1cc7c8d73d342b606b4a040efb089b929ba621ad8cc969299d9dca52fd94e026217efaa646dd24eab97f4262dbab22cb6ba3c4fbfc3fc1df14

Download Submit
C:\Windows\system\qfQnksK.exe

Filesize
1.9MB

MD5
a36337fa6bc17fca0e7bf5ed61ff3ea1

SHA1
5e694b65c438c56fbc4be9760253abec1aab0e4e

SHA256
22de1345686ba7dce2e4c2123260940bf60e9294251edcae99600e9657942791

SHA512
857652854387089f435b9a10a0ffa756cbc820455520a7cd808026bb0aca8e1259bd1013e594075ccda0a858c1bc4829a666c1e5e92760d1f58f82eba623d4bc

Download Submit
C:\Windows\system\qhieWcW.exe

Filesize
1.9MB

MD5
f8e7d8ac8f3b36a9c91f6a4b7cdfc2ea

SHA1
1a5be6bed060f35c636f5f2154062a421066b9ae

SHA256
8489d5b0171a4afbd8eae369156cc7f7b2f1a00dfb1ca33bda4a2100bc69a800

SHA512
a6cbc987692bbadf5289ad8b56ae7acb99883c50d2b48c3cda778440975ed02bb0dc8b26abd4cb7911dc21f9aff0c2a4f11b513a278849b15212c48ec8f18f67

Download Submit
C:\Windows\system\wfEQEnd.exe

Filesize
1.9MB

MD5
97c1d7a641ef673512a25d75e7c54b76

SHA1
30a2c47b6b09087a80546133a0d9b68a20db2e3d

SHA256
e985ebe1f70b9f72e1edb6a77bc53a03493d07adbb3c37a11e21741fc9623207

SHA512
0af62e86fe151b4b000bd5ab82854faa78e00e28d009adc32904c5678d5b5a7ced31ed90c374215de80e781277330a71e9afc9c7033bbba8dd8b4eb6a807dcbb

Download Submit
C:\Windows\system\xErdFlR.exe

Filesize
1.9MB

MD5
06377c99238ff8a050d7eeafcba1864c

SHA1
3497e1d68093a3dc9c68d91dd80a8ba10289766d

SHA256
fe3eb570c0bc1068a20567674bfa26ef9a87dd090e0f17a48924be792d96a174

SHA512
3e031d2f29598ea59e8d5bac62533356ec965e6bc1f69cc2929ce5859e52b66f3e06ddc82bdc77664426a8eb614eb996b6969ee674fc38502e9cfafd153e7acf

Download Submit
C:\Windows\system\xkkbkpS.exe

Filesize
1.9MB

MD5
a09c2a74d5ad4f7e438e72cdf799d553

SHA1
9014c18a3124a7a67530d54e8f10369d08ce0a41

SHA256
8447778d220a0ccd1ecdbde76e373662d84bcd1b7f329204e765c2a731077108

SHA512
f92f7b6c27aa2c8e6a5166e3e9743bd078dfb7e0aa4520e1002e5a81a74b3b5c01b3b3890959852a7f7687559f564d8e57b44834d605cc9f3d21a7666396d2d0

Download Submit
C:\Windows\system\yhkyXYV.exe

Filesize
1.9MB

MD5
1e16fc6c2ba6e7c82daf3238a5c5edb7

SHA1
6266dbc27d11508ff1bd70b87cc97ef8c3157a65

SHA256
a694f6749f87a30823be3ab6d202375b21eedd1250519df10225a58445b3ff65

SHA512
8da00a94be3d1c090d8494c852a706e611f4cddd0465ad9dd569ada563ceb94a8376951ff0c9f7eaa9fa942a8e41246b9a6535163f8ddb872ed4cefc22ac42ec

Download Submit
\Windows\system\AKvfAum.exe

Filesize
1.9MB

MD5
9e5d0f87090016773158bef543461673

SHA1
62fd28550fdb0bc3ed3ba4e4c84161a7b6c7cd09

SHA256
18d44c5d18360766a3edb5c656b04fff3edb2e70dfa4cd32f96adc7c89d693cc

SHA512
80ad872693c60641c6862c9eaca0cc8ccc679f182b6711ac9376d0e79aba15d86f762b761fee33feb065fb9cd425218552cb7b5e94546f9bc75574083dcbed7f

Download Submit
\Windows\system\GXUqdGs.exe

Filesize
1.9MB

MD5
5f5095b614e88ca703f39056d6787869

SHA1
712d7dac94e92b9c60f1ae6e8a9d00fcd021cb75

SHA256
10793e240e5968a810f2a98581978e8d72867894dba21d68c16337e0e045fbb7

SHA512
2a6884a7b60ff3d4c1d4957ccb1f1f23390cc75d9bf2fccc459b7fa1039631f8e966158eefe25d179460f3aa853b3b7449b71b0c62b20518a1d67a9a2e3dbb9a

Download Submit
\Windows\system\TfsqyYA.exe

Filesize
1.9MB

MD5
fc6ab3f2e7f3d23a3ad94fd79f3631b3

SHA1
5054d11371e6278d9ab1d964dfa46f537471ab1b

SHA256
2b5b16295987e5c527dbeffdf34e016f768c7f18252f0548be3991bade86bef5

SHA512
74c7e22835671049c5ab7244929887d1ea6552d45f9365f20e4e7fb5d757dda75111a69bd679a0af2972413131df3f314559faf29478492d76107ba68e73cd0a

Download Submit
\Windows\system\bVplvJi.exe

Filesize
1.9MB

MD5
4fba7b2420b950464117821ab2b81d69

SHA1
7df772c112ecb4606d13d16ebee5b099fed47e9f

SHA256
19bdfc6b4bae705c4f84e1166c1ced40d5c25a249feb241e179da9526ebfdede

SHA512
28b557a7446d1ca08ffe1a2cafdff93549e5c25dd2f1369b324f8bfebcb31589065b12ad66770a9c985504b8e0a7bc2c2209e850b8238c5f1ad3b5fa04304f51

Download Submit
\Windows\system\vqDSjFV.exe

Filesize
1.9MB

MD5
77ebb19357af1668d85e83b2bd1c1da6

SHA1
3a85905a50e80c3f25af349a14c02158fdf5a25f

SHA256
2e0f255aa822e0d3eb110a9529f2558b78499fa24f9bb3181373f9fb2d66f5bd

SHA512
c2fa4e196d57fb2597568e3e1c42263d8e2231abbd55b5d946a433acca19aaf6bcb2a3e648b94089574d94411a51b74611b7bb1837d6307f9a7792c3be8de865

Download Submit
memory/388-56-0x000000013FA30000-0x000000013FE22000-memory.dmp

Filesize
3.9MB

Download
memory/388-1358-0x000000013FA30000-0x000000013FE22000-memory.dmp

Filesize
3.9MB

Download
memory/972-305-0x000007FEF5E7E000-0x000007FEF5E7F000-memory.dmp

Filesize
4KB

Download
memory/972-27-0x000007FEF5E7E000-0x000007FEF5E7F000-memory.dmp

Filesize
4KB

Download
memory/972-41-0x000007FEF5BC0000-0x000007FEF655D000-memory.dmp

Filesize
9.6MB

Download
memory/972-347-0x000007FEF5BC0000-0x000007FEF655D000-memory.dmp

Filesize
9.6MB

Download
memory/972-33-0x000000001B280000-0x000000001B562000-memory.dmp

Filesize
2.9MB

Download
memory/972-40-0x000007FEF5BC0000-0x000007FEF655D000-memory.dmp

Filesize
9.6MB

Download
memory/972-38-0x0000000001F50000-0x0000000001F58000-memory.dmp

Filesize
32KB

Download
memory/972-240-0x000007FEF5BC0000-0x000007FEF655D000-memory.dmp

Filesize
9.6MB

Download
memory/1728-66-0x000000013FAC0000-0x000000013FEB2000-memory.dmp

Filesize
3.9MB

Download
memory/1728-1414-0x000000013FAC0000-0x000000013FEB2000-memory.dmp

Filesize
3.9MB

Download
memory/1988-1420-0x000000013F710000-0x000000013FB02000-memory.dmp

Filesize
3.9MB

Download
memory/1988-88-0x000000013F710000-0x000000013FB02000-memory.dmp

Filesize
3.9MB

Download
memory/2076-1437-0x000000013F370000-0x000000013F762000-memory.dmp

Filesize
3.9MB

Download
memory/2076-80-0x000000013F370000-0x000000013F762000-memory.dmp

Filesize
3.9MB

Download
memory/2296-16-0x000000013F9D0000-0x000000013FDC2000-memory.dmp

Filesize
3.9MB

Download
memory/2348-55-0x000000013FA30000-0x000000013FE22000-memory.dmp

Filesize
3.9MB

Download
memory/2348-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2348-15-0x000000013F9D0000-0x000000013FDC2000-memory.dmp

Filesize
3.9MB

Download
memory/2348-237-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/2348-239-0x000000013F9D0000-0x000000013FDC2000-memory.dmp

Filesize
3.9MB

Download
memory/2348-42-0x0000000002D90000-0x0000000003182000-memory.dmp

Filesize
3.9MB

Download
memory/2348-8-0x00000000027C0000-0x0000000002BB2000-memory.dmp

Filesize
3.9MB

Download
memory/2348-74-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download
memory/2348-65-0x000000013FAC0000-0x000000013FEB2000-memory.dmp

Filesize
3.9MB

Download
memory/2348-76-0x0000000003210000-0x0000000003602000-memory.dmp

Filesize
3.9MB

Download
memory/2348-46-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/2348-0-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/2348-54-0x0000000003210000-0x0000000003602000-memory.dmp

Filesize
3.9MB

Download
memory/2348-87-0x0000000003210000-0x0000000003602000-memory.dmp

Filesize
3.9MB

Download
memory/2348-86-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/2492-1409-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download
memory/2492-75-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download
memory/2652-1364-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/2652-49-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/2680-668-0x000000013F790000-0x000000013FB82000-memory.dmp

Filesize
3.9MB

Download
memory/2680-1396-0x000000013F790000-0x000000013FB82000-memory.dmp

Filesize
3.9MB

Download
memory/2680-58-0x000000013F790000-0x000000013FB82000-memory.dmp

Filesize
3.9MB

Download
memory/2684-43-0x000000013F860000-0x000000013FC52000-memory.dmp

Filesize
3.9MB

Download
memory/2684-1439-0x000000013F860000-0x000000013FC52000-memory.dmp

Filesize
3.9MB

Download
memory/2744-1279-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2744-9-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2796-1290-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2796-26-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2904-1436-0x000000013F1B0000-0x000000013F5A2000-memory.dmp

Filesize
3.9MB

Download
memory/2904-94-0x000000013F1B0000-0x000000013F5A2000-memory.dmp

Filesize
3.9MB

Download