xmrig | cf22d37ba0e0a44fac49e89b89388226d6504d8f779023d58215afa4f9e516a0

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 00:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ca85fd72bec980b5e1da8f67b70b870N.exe
Size

1.6MB
MD5

2ca85fd72bec980b5e1da8f67b70b870
SHA1

eea198475d9289c8b7e90f101d2273ce070b56f5
SHA256

cf22d37ba0e0a44fac49e89b89388226d6504d8f779023d58215afa4f9e516a0
SHA512

af98b92db3b67ad989ace2a30a1107fa97994f0cf2772b85f01ca3f9a8557e0a1105025b9f92d7f53f98280ec2b3707b46d33ec45ec89e0165ae57cf0e7a1d14
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWY1s38kQu12bPxvyuzaBgJ9pcFtz:Lz071uv4BPMkibTIA5I4TNrpDGF

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 20 IoCs

miner

resource	yara_rule
behavioral1/memory/2900-17-0x000000013FD90000-0x0000000140182000-memory.dmp	xmrig
behavioral1/memory/2660-41-0x000000013F200000-0x000000013F5F2000-memory.dmp	xmrig
behavioral1/memory/2040-37-0x000000013FD40000-0x0000000140132000-memory.dmp	xmrig
behavioral1/memory/2912-98-0x000000013F320000-0x000000013F712000-memory.dmp	xmrig
behavioral1/memory/560-367-0x000000013F780000-0x000000013FB72000-memory.dmp	xmrig
behavioral1/memory/2876-96-0x000000013F170000-0x000000013F562000-memory.dmp	xmrig
behavioral1/memory/2876-90-0x000000013F320000-0x000000013F712000-memory.dmp	xmrig
behavioral1/memory/2324-79-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	xmrig
behavioral1/memory/2068-76-0x000000013FF10000-0x0000000140302000-memory.dmp	xmrig
behavioral1/memory/2908-74-0x000000013FF40000-0x0000000140332000-memory.dmp	xmrig
behavioral1/memory/2876-72-0x000000013FA60000-0x000000013FE52000-memory.dmp	xmrig
behavioral1/memory/1640-1306-0x000000013FD50000-0x0000000140142000-memory.dmp	xmrig
behavioral1/memory/1340-4574-0x000000013FD70000-0x0000000140162000-memory.dmp	xmrig
behavioral1/memory/2660-5466-0x000000013F200000-0x000000013F5F2000-memory.dmp	xmrig
behavioral1/memory/2796-5494-0x000000013F170000-0x000000013F562000-memory.dmp	xmrig
behavioral1/memory/2912-5493-0x000000013F320000-0x000000013F712000-memory.dmp	xmrig
behavioral1/memory/2900-5492-0x000000013FD90000-0x0000000140182000-memory.dmp	xmrig
behavioral1/memory/1340-5491-0x000000013FD70000-0x0000000140162000-memory.dmp	xmrig
behavioral1/memory/2324-5488-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	xmrig
behavioral1/memory/2068-5498-0x000000013FF10000-0x0000000140302000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2728	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2900	oCthMlE.exe
2908	EvwvdxR.exe
2660	aFayJpR.exe
2040	DkrHOSU.exe
560	mJcywxo.exe
1640	sEasUQu.exe
1340	QMvhkFD.exe
2068	NijzJgB.exe
2324	yoKthKB.exe
2796	DYKVroS.exe
2912	VqriQzJ.exe
868	HnHlKcS.exe
2804	JHOYNsv.exe
1268	FsVdTgo.exe
1900	OhnwfxG.exe
2148	vzOgfJB.exe
3032	kqMBBVN.exe
1104	kAtHLRc.exe
1928	yjporcA.exe
2172	AnZltmU.exe
2152	uuzzKlU.exe
1080	fVunWHy.exe
1356	MVyBXzV.exe
1908	DhFSbyF.exe
1128	dhVWSYQ.exe
2284	BDSjJpm.exe
1520	hqlOXwm.exe
344	HSsTtMT.exe
1736	ndFNcqm.exe
1360	AxsYyaQ.exe
2552	BtIaRGk.exe
2128	LiWguwp.exe
1040	bLiumEF.exe
1776	RosQIPD.exe
1576	ytMGcMY.exe
876	SLydISE.exe
1816	sRizEnC.exe
992	HjGnntU.exe
2952	pGMWuPZ.exe
1992	mCUioOy.exe
2544	tViSuAY.exe
888	toLimnR.exe
2864	RCSemmM.exe
1184	McDgSPu.exe
1572	PJmXFZb.exe
2852	NlNoRBl.exe
2632	LSvOcUT.exe
1836	qTFaIbO.exe
2512	dbyBCcH.exe
2868	FyYWCRf.exe
2860	gAUUpVr.exe
2756	QBbgTEg.exe
1496	bALpsvV.exe
2064	bEqSmyJ.exe
2624	zGOMzrV.exe
2216	XJMEXqo.exe
2088	vYCsCLd.exe
1976	bHYLjnP.exe
2960	OQnNmFY.exe
2968	TBJybFr.exe
1300	vgIWwPD.exe
1948	FhOjQkx.exe
2492	bVFNPyC.exe
2100	lWYwoAe.exe

Loads dropped DLL 64 IoCs

pid	Process
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
2876	2ca85fd72bec980b5e1da8f67b70b870N.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2876-0-0x000000013FA60000-0x000000013FE52000-memory.dmp	upx
behavioral1/files/0x0009000000012286-6.dat	upx
behavioral1/files/0x0011000000015d47-8.dat	upx
behavioral1/files/0x0009000000015d5f-21.dat	upx
behavioral1/memory/2908-19-0x000000013FF40000-0x0000000140332000-memory.dmp	upx
behavioral1/memory/2900-17-0x000000013FD90000-0x0000000140182000-memory.dmp	upx
behavioral1/files/0x000c00000000549e-31.dat	upx
behavioral1/files/0x0008000000015d8f-42.dat	upx
behavioral1/memory/2660-41-0x000000013F200000-0x000000013F5F2000-memory.dmp	upx
behavioral1/memory/560-48-0x000000013F780000-0x000000013FB72000-memory.dmp	upx
behavioral1/memory/2040-37-0x000000013FD40000-0x0000000140132000-memory.dmp	upx
behavioral1/files/0x0007000000015d9c-53.dat	upx
behavioral1/memory/1640-54-0x000000013FD50000-0x0000000140142000-memory.dmp	upx
behavioral1/memory/1340-61-0x000000013FD70000-0x0000000140162000-memory.dmp	upx
behavioral1/files/0x002f000000015d14-62.dat	upx
behavioral1/files/0x0009000000015e4e-68.dat	upx
behavioral1/files/0x0006000000016c9f-83.dat	upx
behavioral1/files/0x0007000000016c88-80.dat	upx
behavioral1/files/0x0006000000016caa-102.dat	upx
behavioral1/memory/2912-98-0x000000013F320000-0x000000013F712000-memory.dmp	upx
behavioral1/files/0x0006000000016d92-135.dat	upx
behavioral1/files/0x0006000000016dbd-145.dat	upx
behavioral1/files/0x0006000000016dcf-151.dat	upx
behavioral1/files/0x000600000001707e-182.dat	upx
behavioral1/memory/560-367-0x000000013F780000-0x000000013FB72000-memory.dmp	upx
behavioral1/files/0x0006000000017226-195.dat	upx
behavioral1/files/0x00060000000174f7-192.dat	upx
behavioral1/files/0x00060000000170da-185.dat	upx
behavioral1/files/0x0006000000016dff-180.dat	upx
behavioral1/files/0x0006000000016df2-170.dat	upx
behavioral1/files/0x000600000001756f-199.dat	upx
behavioral1/files/0x0006000000016df7-175.dat	upx
behavioral1/files/0x0006000000016dec-165.dat	upx
behavioral1/files/0x0006000000016de2-161.dat	upx
behavioral1/files/0x0006000000016dd8-157.dat	upx
behavioral1/files/0x0006000000016da7-140.dat	upx
behavioral1/files/0x0006000000016d76-131.dat	upx
behavioral1/files/0x0006000000016d72-125.dat	upx
behavioral1/files/0x0006000000016d6e-120.dat	upx
behavioral1/files/0x0006000000016d21-110.dat	upx
behavioral1/files/0x0006000000016d67-114.dat	upx
behavioral1/memory/2796-93-0x000000013F170000-0x000000013F562000-memory.dmp	upx
behavioral1/files/0x0006000000016cef-101.dat	upx
behavioral1/memory/2324-79-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	upx
behavioral1/memory/2068-76-0x000000013FF10000-0x0000000140302000-memory.dmp	upx
behavioral1/memory/2908-74-0x000000013FF40000-0x0000000140332000-memory.dmp	upx
behavioral1/memory/2876-72-0x000000013FA60000-0x000000013FE52000-memory.dmp	upx
behavioral1/files/0x0007000000015dab-60.dat	upx
behavioral1/memory/1640-1306-0x000000013FD50000-0x0000000140142000-memory.dmp	upx
behavioral1/memory/1340-4574-0x000000013FD70000-0x0000000140162000-memory.dmp	upx
behavioral1/memory/2660-5466-0x000000013F200000-0x000000013F5F2000-memory.dmp	upx
behavioral1/memory/2796-5494-0x000000013F170000-0x000000013F562000-memory.dmp	upx
behavioral1/memory/2912-5493-0x000000013F320000-0x000000013F712000-memory.dmp	upx
behavioral1/memory/2900-5492-0x000000013FD90000-0x0000000140182000-memory.dmp	upx
behavioral1/memory/1340-5491-0x000000013FD70000-0x0000000140162000-memory.dmp	upx
behavioral1/memory/2324-5488-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	upx
behavioral1/memory/2068-5498-0x000000013FF10000-0x0000000140302000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\InxQJOC.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\mMbddiA.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\iKjlAjc.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\lUoAihH.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\VOtNUWi.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\coIHAvT.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\uEQLgqv.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\kQusigl.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\mdcXLYw.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\rTgzZpY.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\ygRTmqP.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\HCDSLcY.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\UVWwLSh.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\ovUFvgW.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\jHWlIyz.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\tYPDFCZ.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\haiatsx.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\oljGIKr.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\PklTqXd.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\WseusYR.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\AlsUEcE.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\QHjcrvT.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\RFRtBAo.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\zPLMWrE.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\DPIsKje.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\JJyLlku.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\zfobrRh.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\bPqvxLJ.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\MbPTkqN.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\KpUDCYp.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\BfzBmJd.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\vGGWjqg.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\QuhoukA.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\RySqMMU.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\qkArHoO.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\iVVDwhw.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\KLuWKPT.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\YaChYHy.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\JVnGBVO.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\ouILEZn.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\RediWXa.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\whhlXkB.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\mOyhqsS.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\gcaDhjI.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\nBBCYNz.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\CnyGQcN.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\aKRSBkd.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\DrZzhVy.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\scLOoCw.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\bWlsSDJ.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\TaXtsLe.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\IQzGzDT.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\SShFYQS.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\YqrfFvM.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\IzYCjVJ.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\GCrrYjr.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\ybFOXpN.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\stjivkb.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\ncIFmiD.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\WGNSMvj.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\nhDDZlA.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\XcuFyEj.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\UIFGjNI.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe
File created	C:\Windows\System\ajMXucA.exe	2ca85fd72bec980b5e1da8f67b70b870N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2728	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
Token: SeLockMemoryPrivilege	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe
Token: SeDebugPrivilege	2728	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2728	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	31
PID 2876 wrote to memory of 2728	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	31
PID 2876 wrote to memory of 2728	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	31
PID 2876 wrote to memory of 2900	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	32
PID 2876 wrote to memory of 2900	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	32
PID 2876 wrote to memory of 2900	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	32
PID 2876 wrote to memory of 2908	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	33
PID 2876 wrote to memory of 2908	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	33
PID 2876 wrote to memory of 2908	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	33
PID 2876 wrote to memory of 2660	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	34
PID 2876 wrote to memory of 2660	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	34
PID 2876 wrote to memory of 2660	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	34
PID 2876 wrote to memory of 2040	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	35
PID 2876 wrote to memory of 2040	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	35
PID 2876 wrote to memory of 2040	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	35
PID 2876 wrote to memory of 560	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	36
PID 2876 wrote to memory of 560	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	36
PID 2876 wrote to memory of 560	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	36
PID 2876 wrote to memory of 1640	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	37
PID 2876 wrote to memory of 1640	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	37
PID 2876 wrote to memory of 1640	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	37
PID 2876 wrote to memory of 1340	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	38
PID 2876 wrote to memory of 1340	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	38
PID 2876 wrote to memory of 1340	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	38
PID 2876 wrote to memory of 2068	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	39
PID 2876 wrote to memory of 2068	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	39
PID 2876 wrote to memory of 2068	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	39
PID 2876 wrote to memory of 2324	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	40
PID 2876 wrote to memory of 2324	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	40
PID 2876 wrote to memory of 2324	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	40
PID 2876 wrote to memory of 2912	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	41
PID 2876 wrote to memory of 2912	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	41
PID 2876 wrote to memory of 2912	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	41
PID 2876 wrote to memory of 2796	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	42
PID 2876 wrote to memory of 2796	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	42
PID 2876 wrote to memory of 2796	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	42
PID 2876 wrote to memory of 2804	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	43
PID 2876 wrote to memory of 2804	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	43
PID 2876 wrote to memory of 2804	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	43
PID 2876 wrote to memory of 868	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	44
PID 2876 wrote to memory of 868	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	44
PID 2876 wrote to memory of 868	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	44
PID 2876 wrote to memory of 1268	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	45
PID 2876 wrote to memory of 1268	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	45
PID 2876 wrote to memory of 1268	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	45
PID 2876 wrote to memory of 1900	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	46
PID 2876 wrote to memory of 1900	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	46
PID 2876 wrote to memory of 1900	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	46
PID 2876 wrote to memory of 2148	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	47
PID 2876 wrote to memory of 2148	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	47
PID 2876 wrote to memory of 2148	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	47
PID 2876 wrote to memory of 3032	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	48
PID 2876 wrote to memory of 3032	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	48
PID 2876 wrote to memory of 3032	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	48
PID 2876 wrote to memory of 1104	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	49
PID 2876 wrote to memory of 1104	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	49
PID 2876 wrote to memory of 1104	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	49
PID 2876 wrote to memory of 1928	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	50
PID 2876 wrote to memory of 1928	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	50
PID 2876 wrote to memory of 1928	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	50
PID 2876 wrote to memory of 2172	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	51
PID 2876 wrote to memory of 2172	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	51
PID 2876 wrote to memory of 2172	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	51
PID 2876 wrote to memory of 2152	2876	2ca85fd72bec980b5e1da8f67b70b870N.exe	52

C:\Users\Admin\AppData\Local\Temp\2ca85fd72bec980b5e1da8f67b70b870N.exe
"C:\Users\Admin\AppData\Local\Temp\2ca85fd72bec980b5e1da8f67b70b870N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2728
- C:\Windows\System\oCthMlE.exe
  C:\Windows\System\oCthMlE.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\EvwvdxR.exe
  C:\Windows\System\EvwvdxR.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\aFayJpR.exe
  C:\Windows\System\aFayJpR.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\DkrHOSU.exe
  C:\Windows\System\DkrHOSU.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\mJcywxo.exe
  C:\Windows\System\mJcywxo.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\sEasUQu.exe
  C:\Windows\System\sEasUQu.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\QMvhkFD.exe
  C:\Windows\System\QMvhkFD.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\NijzJgB.exe
  C:\Windows\System\NijzJgB.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\yoKthKB.exe
  C:\Windows\System\yoKthKB.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\VqriQzJ.exe
  C:\Windows\System\VqriQzJ.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\DYKVroS.exe
  C:\Windows\System\DYKVroS.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\JHOYNsv.exe
  C:\Windows\System\JHOYNsv.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\HnHlKcS.exe
  C:\Windows\System\HnHlKcS.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\FsVdTgo.exe
  C:\Windows\System\FsVdTgo.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\OhnwfxG.exe
  C:\Windows\System\OhnwfxG.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\vzOgfJB.exe
  C:\Windows\System\vzOgfJB.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\kqMBBVN.exe
  C:\Windows\System\kqMBBVN.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\kAtHLRc.exe
  C:\Windows\System\kAtHLRc.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\yjporcA.exe
  C:\Windows\System\yjporcA.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\AnZltmU.exe
  C:\Windows\System\AnZltmU.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\uuzzKlU.exe
  C:\Windows\System\uuzzKlU.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\fVunWHy.exe
  C:\Windows\System\fVunWHy.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\MVyBXzV.exe
  C:\Windows\System\MVyBXzV.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\DhFSbyF.exe
  C:\Windows\System\DhFSbyF.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\dhVWSYQ.exe
  C:\Windows\System\dhVWSYQ.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\BDSjJpm.exe
  C:\Windows\System\BDSjJpm.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\hqlOXwm.exe
  C:\Windows\System\hqlOXwm.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\HSsTtMT.exe
  C:\Windows\System\HSsTtMT.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\ndFNcqm.exe
  C:\Windows\System\ndFNcqm.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\RosQIPD.exe
  C:\Windows\System\RosQIPD.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\AxsYyaQ.exe
  C:\Windows\System\AxsYyaQ.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\ytMGcMY.exe
  C:\Windows\System\ytMGcMY.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\BtIaRGk.exe
  C:\Windows\System\BtIaRGk.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\SLydISE.exe
  C:\Windows\System\SLydISE.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\LiWguwp.exe
  C:\Windows\System\LiWguwp.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\sRizEnC.exe
  C:\Windows\System\sRizEnC.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\bLiumEF.exe
  C:\Windows\System\bLiumEF.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\pGMWuPZ.exe
  C:\Windows\System\pGMWuPZ.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\HjGnntU.exe
  C:\Windows\System\HjGnntU.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\mCUioOy.exe
  C:\Windows\System\mCUioOy.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\tViSuAY.exe
  C:\Windows\System\tViSuAY.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\McDgSPu.exe
  C:\Windows\System\McDgSPu.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\toLimnR.exe
  C:\Windows\System\toLimnR.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\qTFaIbO.exe
  C:\Windows\System\qTFaIbO.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\RCSemmM.exe
  C:\Windows\System\RCSemmM.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\dbyBCcH.exe
  C:\Windows\System\dbyBCcH.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\PJmXFZb.exe
  C:\Windows\System\PJmXFZb.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\FyYWCRf.exe
  C:\Windows\System\FyYWCRf.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\NlNoRBl.exe
  C:\Windows\System\NlNoRBl.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\gAUUpVr.exe
  C:\Windows\System\gAUUpVr.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\LSvOcUT.exe
  C:\Windows\System\LSvOcUT.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\QBbgTEg.exe
  C:\Windows\System\QBbgTEg.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\bALpsvV.exe
  C:\Windows\System\bALpsvV.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\bEqSmyJ.exe
  C:\Windows\System\bEqSmyJ.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\zGOMzrV.exe
  C:\Windows\System\zGOMzrV.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\vYCsCLd.exe
  C:\Windows\System\vYCsCLd.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\XJMEXqo.exe
  C:\Windows\System\XJMEXqo.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\bHYLjnP.exe
  C:\Windows\System\bHYLjnP.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\OQnNmFY.exe
  C:\Windows\System\OQnNmFY.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\TBJybFr.exe
  C:\Windows\System\TBJybFr.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\vgIWwPD.exe
  C:\Windows\System\vgIWwPD.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\FhOjQkx.exe
  C:\Windows\System\FhOjQkx.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\bVFNPyC.exe
  C:\Windows\System\bVFNPyC.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\FEcLrai.exe
  C:\Windows\System\FEcLrai.exe
  2⤵
  PID:2488
- C:\Windows\System\lWYwoAe.exe
  C:\Windows\System\lWYwoAe.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\uYFiabC.exe
  C:\Windows\System\uYFiabC.exe
  2⤵
  PID:2276
- C:\Windows\System\rFRBCbz.exe
  C:\Windows\System\rFRBCbz.exe
  2⤵
  PID:3028
- C:\Windows\System\XwWcdtu.exe
  C:\Windows\System\XwWcdtu.exe
  2⤵
  PID:768
- C:\Windows\System\pwpMFhQ.exe
  C:\Windows\System\pwpMFhQ.exe
  2⤵
  PID:1548
- C:\Windows\System\AJAbZaB.exe
  C:\Windows\System\AJAbZaB.exe
  2⤵
  PID:844
- C:\Windows\System\aDePgZZ.exe
  C:\Windows\System\aDePgZZ.exe
  2⤵
  PID:2576
- C:\Windows\System\MZFaoST.exe
  C:\Windows\System\MZFaoST.exe
  2⤵
  PID:2516
- C:\Windows\System\qNMZsxO.exe
  C:\Windows\System\qNMZsxO.exe
  2⤵
  PID:2080
- C:\Windows\System\iMqnnwy.exe
  C:\Windows\System\iMqnnwy.exe
  2⤵
  PID:1944
- C:\Windows\System\pcsFUhV.exe
  C:\Windows\System\pcsFUhV.exe
  2⤵
  PID:2380
- C:\Windows\System\UYHoECF.exe
  C:\Windows\System\UYHoECF.exe
  2⤵
  PID:2016
- C:\Windows\System\mmXbGbj.exe
  C:\Windows\System\mmXbGbj.exe
  2⤵
  PID:1636
- C:\Windows\System\viZENyR.exe
  C:\Windows\System\viZENyR.exe
  2⤵
  PID:1756
- C:\Windows\System\ABIRvIk.exe
  C:\Windows\System\ABIRvIk.exe
  2⤵
  PID:2540
- C:\Windows\System\jABtAxE.exe
  C:\Windows\System\jABtAxE.exe
  2⤵
  PID:352
- C:\Windows\System\dZBexJC.exe
  C:\Windows\System\dZBexJC.exe
  2⤵
  PID:1788
- C:\Windows\System\tPeGgLF.exe
  C:\Windows\System\tPeGgLF.exe
  2⤵
  PID:2940
- C:\Windows\System\dDBFWcu.exe
  C:\Windows\System\dDBFWcu.exe
  2⤵
  PID:2256
- C:\Windows\System\NUpNZZr.exe
  C:\Windows\System\NUpNZZr.exe
  2⤵
  PID:2456
- C:\Windows\System\PmqwOVy.exe
  C:\Windows\System\PmqwOVy.exe
  2⤵
  PID:3000
- C:\Windows\System\GiOImbU.exe
  C:\Windows\System\GiOImbU.exe
  2⤵
  PID:2116
- C:\Windows\System\edtFnqb.exe
  C:\Windows\System\edtFnqb.exe
  2⤵
  PID:3048
- C:\Windows\System\BdZgGgX.exe
  C:\Windows\System\BdZgGgX.exe
  2⤵
  PID:2060
- C:\Windows\System\NarRmDw.exe
  C:\Windows\System\NarRmDw.exe
  2⤵
  PID:2928
- C:\Windows\System\uwKZCTo.exe
  C:\Windows\System\uwKZCTo.exe
  2⤵
  PID:2292
- C:\Windows\System\flMohaq.exe
  C:\Windows\System\flMohaq.exe
  2⤵
  PID:1752
- C:\Windows\System\TLoKsRJ.exe
  C:\Windows\System\TLoKsRJ.exe
  2⤵
  PID:1780
- C:\Windows\System\cSLfVNH.exe
  C:\Windows\System\cSLfVNH.exe
  2⤵
  PID:2500
- C:\Windows\System\qmMZWcX.exe
  C:\Windows\System\qmMZWcX.exe
  2⤵
  PID:2200
- C:\Windows\System\NsLCmnB.exe
  C:\Windows\System\NsLCmnB.exe
  2⤵
  PID:236
- C:\Windows\System\BLNGMDV.exe
  C:\Windows\System\BLNGMDV.exe
  2⤵
  PID:1560
- C:\Windows\System\vmFjSmK.exe
  C:\Windows\System\vmFjSmK.exe
  2⤵
  PID:2400
- C:\Windows\System\BOzWWOe.exe
  C:\Windows\System\BOzWWOe.exe
  2⤵
  PID:2348
- C:\Windows\System\eEVFVEj.exe
  C:\Windows\System\eEVFVEj.exe
  2⤵
  PID:1704
- C:\Windows\System\INghoDU.exe
  C:\Windows\System\INghoDU.exe
  2⤵
  PID:1148
- C:\Windows\System\hJNkvhE.exe
  C:\Windows\System\hJNkvhE.exe
  2⤵
  PID:1480
- C:\Windows\System\ewkuXyH.exe
  C:\Windows\System\ewkuXyH.exe
  2⤵
  PID:2272
- C:\Windows\System\utiAqZr.exe
  C:\Windows\System\utiAqZr.exe
  2⤵
  PID:1644
- C:\Windows\System\SCqqRjV.exe
  C:\Windows\System\SCqqRjV.exe
  2⤵
  PID:1708
- C:\Windows\System\uhlxgTO.exe
  C:\Windows\System\uhlxgTO.exe
  2⤵
  PID:1476
- C:\Windows\System\ruIJldW.exe
  C:\Windows\System\ruIJldW.exe
  2⤵
  PID:2856
- C:\Windows\System\mzbvfBz.exe
  C:\Windows\System\mzbvfBz.exe
  2⤵
  PID:572
- C:\Windows\System\gGuyilV.exe
  C:\Windows\System\gGuyilV.exe
  2⤵
  PID:3092
- C:\Windows\System\AeJaFLl.exe
  C:\Windows\System\AeJaFLl.exe
  2⤵
  PID:3108
- C:\Windows\System\Ewujjpp.exe
  C:\Windows\System\Ewujjpp.exe
  2⤵
  PID:3124
- C:\Windows\System\dMeBWZQ.exe
  C:\Windows\System\dMeBWZQ.exe
  2⤵
  PID:3140
- C:\Windows\System\tTpoTxE.exe
  C:\Windows\System\tTpoTxE.exe
  2⤵
  PID:3156
- C:\Windows\System\FtBKKYS.exe
  C:\Windows\System\FtBKKYS.exe
  2⤵
  PID:3176
- C:\Windows\System\bRnRnhD.exe
  C:\Windows\System\bRnRnhD.exe
  2⤵
  PID:3192
- C:\Windows\System\PnqNQuK.exe
  C:\Windows\System\PnqNQuK.exe
  2⤵
  PID:3212
- C:\Windows\System\pnddYca.exe
  C:\Windows\System\pnddYca.exe
  2⤵
  PID:3228
- C:\Windows\System\rPjqsQW.exe
  C:\Windows\System\rPjqsQW.exe
  2⤵
  PID:3244
- C:\Windows\System\qRckPff.exe
  C:\Windows\System\qRckPff.exe
  2⤵
  PID:3260
- C:\Windows\System\PUdcLqE.exe
  C:\Windows\System\PUdcLqE.exe
  2⤵
  PID:3284
- C:\Windows\System\uuCIuBD.exe
  C:\Windows\System\uuCIuBD.exe
  2⤵
  PID:3304
- C:\Windows\System\QZCdiLp.exe
  C:\Windows\System\QZCdiLp.exe
  2⤵
  PID:3324
- C:\Windows\System\vYclzWD.exe
  C:\Windows\System\vYclzWD.exe
  2⤵
  PID:3340
- C:\Windows\System\nTjigMm.exe
  C:\Windows\System\nTjigMm.exe
  2⤵
  PID:3376
- C:\Windows\System\JQNcdSC.exe
  C:\Windows\System\JQNcdSC.exe
  2⤵
  PID:3392
- C:\Windows\System\OyqqWpT.exe
  C:\Windows\System\OyqqWpT.exe
  2⤵
  PID:3412
- C:\Windows\System\RRKDhUq.exe
  C:\Windows\System\RRKDhUq.exe
  2⤵
  PID:3428
- C:\Windows\System\MIXoLVx.exe
  C:\Windows\System\MIXoLVx.exe
  2⤵
  PID:3532
- C:\Windows\System\Xhebbhp.exe
  C:\Windows\System\Xhebbhp.exe
  2⤵
  PID:3548
- C:\Windows\System\ynPunyH.exe
  C:\Windows\System\ynPunyH.exe
  2⤵
  PID:3564
- C:\Windows\System\qxiBKFw.exe
  C:\Windows\System\qxiBKFw.exe
  2⤵
  PID:3580
- C:\Windows\System\fwnQqqJ.exe
  C:\Windows\System\fwnQqqJ.exe
  2⤵
  PID:3600
- C:\Windows\System\bwmXWWf.exe
  C:\Windows\System\bwmXWWf.exe
  2⤵
  PID:3616
- C:\Windows\System\aCROCvt.exe
  C:\Windows\System\aCROCvt.exe
  2⤵
  PID:3636
- C:\Windows\System\dYypfHP.exe
  C:\Windows\System\dYypfHP.exe
  2⤵
  PID:3664
- C:\Windows\System\DUqEdxN.exe
  C:\Windows\System\DUqEdxN.exe
  2⤵
  PID:3684
- C:\Windows\System\VKCsXyC.exe
  C:\Windows\System\VKCsXyC.exe
  2⤵
  PID:3700
- C:\Windows\System\JYMKsrt.exe
  C:\Windows\System\JYMKsrt.exe
  2⤵
  PID:3716
- C:\Windows\System\cpYXKGF.exe
  C:\Windows\System\cpYXKGF.exe
  2⤵
  PID:3732
- C:\Windows\System\YfmmMjZ.exe
  C:\Windows\System\YfmmMjZ.exe
  2⤵
  PID:3752
- C:\Windows\System\AVRfdwN.exe
  C:\Windows\System\AVRfdwN.exe
  2⤵
  PID:3768
- C:\Windows\System\ljxZint.exe
  C:\Windows\System\ljxZint.exe
  2⤵
  PID:3804
- C:\Windows\System\wdqQZqk.exe
  C:\Windows\System\wdqQZqk.exe
  2⤵
  PID:3820
- C:\Windows\System\hBuUhWg.exe
  C:\Windows\System\hBuUhWg.exe
  2⤵
  PID:3848
- C:\Windows\System\GAHexqj.exe
  C:\Windows\System\GAHexqj.exe
  2⤵
  PID:3864
- C:\Windows\System\tVzBzpN.exe
  C:\Windows\System\tVzBzpN.exe
  2⤵
  PID:3880
- C:\Windows\System\sRwhUau.exe
  C:\Windows\System\sRwhUau.exe
  2⤵
  PID:3896
- C:\Windows\System\CmLyQeF.exe
  C:\Windows\System\CmLyQeF.exe
  2⤵
  PID:3912
- C:\Windows\System\xylwnuc.exe
  C:\Windows\System\xylwnuc.exe
  2⤵
  PID:3940
- C:\Windows\System\OGPJCip.exe
  C:\Windows\System\OGPJCip.exe
  2⤵
  PID:3964
- C:\Windows\System\OoCSwiB.exe
  C:\Windows\System\OoCSwiB.exe
  2⤵
  PID:3980
- C:\Windows\System\nPoEWwD.exe
  C:\Windows\System\nPoEWwD.exe
  2⤵
  PID:3996
- C:\Windows\System\xwoTFAJ.exe
  C:\Windows\System\xwoTFAJ.exe
  2⤵
  PID:4012
- C:\Windows\System\INdJPov.exe
  C:\Windows\System\INdJPov.exe
  2⤵
  PID:4028
- C:\Windows\System\pMXGavP.exe
  C:\Windows\System\pMXGavP.exe
  2⤵
  PID:4044
- C:\Windows\System\mShFrOR.exe
  C:\Windows\System\mShFrOR.exe
  2⤵
  PID:4060
- C:\Windows\System\OoVkRup.exe
  C:\Windows\System\OoVkRup.exe
  2⤵
  PID:4076
- C:\Windows\System\nNwiNic.exe
  C:\Windows\System\nNwiNic.exe
  2⤵
  PID:4092
- C:\Windows\System\spMlKLW.exe
  C:\Windows\System\spMlKLW.exe
  2⤵
  PID:2320
- C:\Windows\System\dfTqffo.exe
  C:\Windows\System\dfTqffo.exe
  2⤵
  PID:2304
- C:\Windows\System\SLEjIjO.exe
  C:\Windows\System\SLEjIjO.exe
  2⤵
  PID:2564
- C:\Windows\System\kfPVFCq.exe
  C:\Windows\System\kfPVFCq.exe
  2⤵
  PID:2740
- C:\Windows\System\VsybEHc.exe
  C:\Windows\System\VsybEHc.exe
  2⤵
  PID:3084
- C:\Windows\System\CsWLDWB.exe
  C:\Windows\System\CsWLDWB.exe
  2⤵
  PID:1936
- C:\Windows\System\zmmpuyk.exe
  C:\Windows\System\zmmpuyk.exe
  2⤵
  PID:3152
- C:\Windows\System\orWmTUH.exe
  C:\Windows\System\orWmTUH.exe
  2⤵
  PID:3224
- C:\Windows\System\KPBUyVV.exe
  C:\Windows\System\KPBUyVV.exe
  2⤵
  PID:2980
- C:\Windows\System\FxCLiEg.exe
  C:\Windows\System\FxCLiEg.exe
  2⤵
  PID:3296
- C:\Windows\System\shNqNNQ.exe
  C:\Windows\System\shNqNNQ.exe
  2⤵
  PID:2184
- C:\Windows\System\AKRSEBa.exe
  C:\Windows\System\AKRSEBa.exe
  2⤵
  PID:3388
- C:\Windows\System\cjwyYUH.exe
  C:\Windows\System\cjwyYUH.exe
  2⤵
  PID:3236
- C:\Windows\System\buNrcUh.exe
  C:\Windows\System\buNrcUh.exe
  2⤵
  PID:1276
- C:\Windows\System\BNEotzi.exe
  C:\Windows\System\BNEotzi.exe
  2⤵
  PID:1904
- C:\Windows\System\BBGmmOn.exe
  C:\Windows\System\BBGmmOn.exe
  2⤵
  PID:1720
- C:\Windows\System\kBQjVBF.exe
  C:\Windows\System\kBQjVBF.exe
  2⤵
  PID:2888
- C:\Windows\System\elWpBpM.exe
  C:\Windows\System\elWpBpM.exe
  2⤵
  PID:2708
- C:\Windows\System\qmcFYap.exe
  C:\Windows\System\qmcFYap.exe
  2⤵
  PID:848
- C:\Windows\System\dKlGkBF.exe
  C:\Windows\System\dKlGkBF.exe
  2⤵
  PID:3104
- C:\Windows\System\GtRahfd.exe
  C:\Windows\System\GtRahfd.exe
  2⤵
  PID:3172
- C:\Windows\System\lHklJKV.exe
  C:\Windows\System\lHklJKV.exe
  2⤵
  PID:3268
- C:\Windows\System\iVAdzDX.exe
  C:\Windows\System\iVAdzDX.exe
  2⤵
  PID:3312
- C:\Windows\System\dStnDBE.exe
  C:\Windows\System\dStnDBE.exe
  2⤵
  PID:3352
- C:\Windows\System\ZvLQlvf.exe
  C:\Windows\System\ZvLQlvf.exe
  2⤵
  PID:3368
- C:\Windows\System\OUhSwIV.exe
  C:\Windows\System\OUhSwIV.exe
  2⤵
  PID:3404
- C:\Windows\System\rfwsHPm.exe
  C:\Windows\System\rfwsHPm.exe
  2⤵
  PID:3576
- C:\Windows\System\BmtZlAV.exe
  C:\Windows\System\BmtZlAV.exe
  2⤵
  PID:3440
- C:\Windows\System\oPXibOQ.exe
  C:\Windows\System\oPXibOQ.exe
  2⤵
  PID:1504
- C:\Windows\System\loNsREQ.exe
  C:\Windows\System\loNsREQ.exe
  2⤵
  PID:3448
- C:\Windows\System\WkmxFiz.exe
  C:\Windows\System\WkmxFiz.exe
  2⤵
  PID:2916
- C:\Windows\System\qvWaAQt.exe
  C:\Windows\System\qvWaAQt.exe
  2⤵
  PID:3660
- C:\Windows\System\sLmJgHD.exe
  C:\Windows\System\sLmJgHD.exe
  2⤵
  PID:2616
- C:\Windows\System\QMNtCmY.exe
  C:\Windows\System\QMNtCmY.exe
  2⤵
  PID:3472
- C:\Windows\System\LFfgbOs.exe
  C:\Windows\System\LFfgbOs.exe
  2⤵
  PID:3692
- C:\Windows\System\vNYNeKr.exe
  C:\Windows\System\vNYNeKr.exe
  2⤵
  PID:3764
- C:\Windows\System\rskQCxz.exe
  C:\Windows\System\rskQCxz.exe
  2⤵
  PID:2768
- C:\Windows\System\vSPwfWn.exe
  C:\Windows\System\vSPwfWn.exe
  2⤵
  PID:3632
- C:\Windows\System\WaDQcPi.exe
  C:\Windows\System\WaDQcPi.exe
  2⤵
  PID:3744
- C:\Windows\System\wsbcDKn.exe
  C:\Windows\System\wsbcDKn.exe
  2⤵
  PID:3860
- C:\Windows\System\hYVkTAw.exe
  C:\Windows\System\hYVkTAw.exe
  2⤵
  PID:3928
- C:\Windows\System\wmjWpfM.exe
  C:\Windows\System\wmjWpfM.exe
  2⤵
  PID:2904
- C:\Windows\System\nTFCNWW.exe
  C:\Windows\System\nTFCNWW.exe
  2⤵
  PID:3712
- C:\Windows\System\lTYnDBG.exe
  C:\Windows\System\lTYnDBG.exe
  2⤵
  PID:3840
- C:\Windows\System\EetMZuA.exe
  C:\Windows\System\EetMZuA.exe
  2⤵
  PID:3676
- C:\Windows\System\xdOrprx.exe
  C:\Windows\System\xdOrprx.exe
  2⤵
  PID:3800
- C:\Windows\System\bDbJzZE.exe
  C:\Windows\System\bDbJzZE.exe
  2⤵
  PID:3624
- C:\Windows\System\jUybGhQ.exe
  C:\Windows\System\jUybGhQ.exe
  2⤵
  PID:3972
- C:\Windows\System\mBMzquS.exe
  C:\Windows\System\mBMzquS.exe
  2⤵
  PID:4036
- C:\Windows\System\uiZNBvj.exe
  C:\Windows\System\uiZNBvj.exe
  2⤵
  PID:2156
- C:\Windows\System\iXwISom.exe
  C:\Windows\System\iXwISom.exe
  2⤵
  PID:3792
- C:\Windows\System\RGaOGbs.exe
  C:\Windows\System\RGaOGbs.exe
  2⤵
  PID:3148
- C:\Windows\System\JzmEsdk.exe
  C:\Windows\System\JzmEsdk.exe
  2⤵
  PID:1272
- C:\Windows\System\QrwYGYt.exe
  C:\Windows\System\QrwYGYt.exe
  2⤵
  PID:3796
- C:\Windows\System\SQqFHyo.exe
  C:\Windows\System\SQqFHyo.exe
  2⤵
  PID:3952
- C:\Windows\System\vUPyJtJ.exe
  C:\Windows\System\vUPyJtJ.exe
  2⤵
  PID:4120
- C:\Windows\System\lzHvTMA.exe
  C:\Windows\System\lzHvTMA.exe
  2⤵
  PID:4136
- C:\Windows\System\bdgJRtO.exe
  C:\Windows\System\bdgJRtO.exe
  2⤵
  PID:4152
- C:\Windows\System\LTOZzNU.exe
  C:\Windows\System\LTOZzNU.exe
  2⤵
  PID:4168
- C:\Windows\System\fVlAuIo.exe
  C:\Windows\System\fVlAuIo.exe
  2⤵
  PID:4184
- C:\Windows\System\xjwQZYS.exe
  C:\Windows\System\xjwQZYS.exe
  2⤵
  PID:4200
- C:\Windows\System\XfMTIPi.exe
  C:\Windows\System\XfMTIPi.exe
  2⤵
  PID:4216
- C:\Windows\System\NrencNw.exe
  C:\Windows\System\NrencNw.exe
  2⤵
  PID:4232
- C:\Windows\System\kbTgkjt.exe
  C:\Windows\System\kbTgkjt.exe
  2⤵
  PID:4248
- C:\Windows\System\NeBmnes.exe
  C:\Windows\System\NeBmnes.exe
  2⤵
  PID:4264
- C:\Windows\System\ZMgVnOq.exe
  C:\Windows\System\ZMgVnOq.exe
  2⤵
  PID:4280
- C:\Windows\System\NLTvIkc.exe
  C:\Windows\System\NLTvIkc.exe
  2⤵
  PID:4300
- C:\Windows\System\UeGumUl.exe
  C:\Windows\System\UeGumUl.exe
  2⤵
  PID:4316
- C:\Windows\System\DRIdGxj.exe
  C:\Windows\System\DRIdGxj.exe
  2⤵
  PID:4332
- C:\Windows\System\XYOodYU.exe
  C:\Windows\System\XYOodYU.exe
  2⤵
  PID:4348
- C:\Windows\System\mkRrpRj.exe
  C:\Windows\System\mkRrpRj.exe
  2⤵
  PID:4364
- C:\Windows\System\hsxccTv.exe
  C:\Windows\System\hsxccTv.exe
  2⤵
  PID:4380
- C:\Windows\System\FneIGXV.exe
  C:\Windows\System\FneIGXV.exe
  2⤵
  PID:4396
- C:\Windows\System\wpPBVyJ.exe
  C:\Windows\System\wpPBVyJ.exe
  2⤵
  PID:4416
- C:\Windows\System\fAIHhUE.exe
  C:\Windows\System\fAIHhUE.exe
  2⤵
  PID:4432
- C:\Windows\System\QIhRNyZ.exe
  C:\Windows\System\QIhRNyZ.exe
  2⤵
  PID:4448
- C:\Windows\System\TeePyEU.exe
  C:\Windows\System\TeePyEU.exe
  2⤵
  PID:4464
- C:\Windows\System\HILQIYf.exe
  C:\Windows\System\HILQIYf.exe
  2⤵
  PID:4480
- C:\Windows\System\mqegCfL.exe
  C:\Windows\System\mqegCfL.exe
  2⤵
  PID:4496
- C:\Windows\System\rzXXsyW.exe
  C:\Windows\System\rzXXsyW.exe
  2⤵
  PID:4512
- C:\Windows\System\PcqhJpV.exe
  C:\Windows\System\PcqhJpV.exe
  2⤵
  PID:4528
- C:\Windows\System\TTLnKwa.exe
  C:\Windows\System\TTLnKwa.exe
  2⤵
  PID:4544
- C:\Windows\System\lxuPIBP.exe
  C:\Windows\System\lxuPIBP.exe
  2⤵
  PID:4560
- C:\Windows\System\oECkUNG.exe
  C:\Windows\System\oECkUNG.exe
  2⤵
  PID:4576
- C:\Windows\System\UsOjLVf.exe
  C:\Windows\System\UsOjLVf.exe
  2⤵
  PID:4592
- C:\Windows\System\oKQgJfN.exe
  C:\Windows\System\oKQgJfN.exe
  2⤵
  PID:4608
- C:\Windows\System\CsbDfdK.exe
  C:\Windows\System\CsbDfdK.exe
  2⤵
  PID:4624
- C:\Windows\System\EMvgXYG.exe
  C:\Windows\System\EMvgXYG.exe
  2⤵
  PID:4640
- C:\Windows\System\UCGNJzG.exe
  C:\Windows\System\UCGNJzG.exe
  2⤵
  PID:4656
- C:\Windows\System\QBBCmsR.exe
  C:\Windows\System\QBBCmsR.exe
  2⤵
  PID:4672
- C:\Windows\System\Bbhlfmd.exe
  C:\Windows\System\Bbhlfmd.exe
  2⤵
  PID:4688
- C:\Windows\System\edtGXcI.exe
  C:\Windows\System\edtGXcI.exe
  2⤵
  PID:4704
- C:\Windows\System\HOxEmwt.exe
  C:\Windows\System\HOxEmwt.exe
  2⤵
  PID:4720
- C:\Windows\System\lZiSWln.exe
  C:\Windows\System\lZiSWln.exe
  2⤵
  PID:4736
- C:\Windows\System\vdUjPmv.exe
  C:\Windows\System\vdUjPmv.exe
  2⤵
  PID:4756
- C:\Windows\System\DHwftwj.exe
  C:\Windows\System\DHwftwj.exe
  2⤵
  PID:4772
- C:\Windows\System\PyDOcRZ.exe
  C:\Windows\System\PyDOcRZ.exe
  2⤵
  PID:4788
- C:\Windows\System\IiklqmV.exe
  C:\Windows\System\IiklqmV.exe
  2⤵
  PID:4804
- C:\Windows\System\ktfdmIM.exe
  C:\Windows\System\ktfdmIM.exe
  2⤵
  PID:4820
- C:\Windows\System\ochPIvV.exe
  C:\Windows\System\ochPIvV.exe
  2⤵
  PID:4836
- C:\Windows\System\CrqkpxS.exe
  C:\Windows\System\CrqkpxS.exe
  2⤵
  PID:4852
- C:\Windows\System\SrivKbG.exe
  C:\Windows\System\SrivKbG.exe
  2⤵
  PID:4868
- C:\Windows\System\JMVDkbI.exe
  C:\Windows\System\JMVDkbI.exe
  2⤵
  PID:4884
- C:\Windows\System\ocsSLuZ.exe
  C:\Windows\System\ocsSLuZ.exe
  2⤵
  PID:4900
- C:\Windows\System\UIQBoXb.exe
  C:\Windows\System\UIQBoXb.exe
  2⤵
  PID:4916
- C:\Windows\System\cxYDaha.exe
  C:\Windows\System\cxYDaha.exe
  2⤵
  PID:4932
- C:\Windows\System\vvGlrIH.exe
  C:\Windows\System\vvGlrIH.exe
  2⤵
  PID:4948
- C:\Windows\System\bkBpDKD.exe
  C:\Windows\System\bkBpDKD.exe
  2⤵
  PID:4964
- C:\Windows\System\ldVGDjb.exe
  C:\Windows\System\ldVGDjb.exe
  2⤵
  PID:4980
- C:\Windows\System\jmcMdDS.exe
  C:\Windows\System\jmcMdDS.exe
  2⤵
  PID:4996
- C:\Windows\System\JvuIjde.exe
  C:\Windows\System\JvuIjde.exe
  2⤵
  PID:5012
- C:\Windows\System\pwZxxnX.exe
  C:\Windows\System\pwZxxnX.exe
  2⤵
  PID:5028
- C:\Windows\System\yGyQtRO.exe
  C:\Windows\System\yGyQtRO.exe
  2⤵
  PID:5044
- C:\Windows\System\nkoYOTN.exe
  C:\Windows\System\nkoYOTN.exe
  2⤵
  PID:5060
- C:\Windows\System\wtDKGzP.exe
  C:\Windows\System\wtDKGzP.exe
  2⤵
  PID:5076
- C:\Windows\System\kBBlflB.exe
  C:\Windows\System\kBBlflB.exe
  2⤵
  PID:5092
- C:\Windows\System\zzmrLeq.exe
  C:\Windows\System\zzmrLeq.exe
  2⤵
  PID:5108
- C:\Windows\System\gEcNczF.exe
  C:\Windows\System\gEcNczF.exe
  2⤵
  PID:752
- C:\Windows\System\CowvcCT.exe
  C:\Windows\System\CowvcCT.exe
  2⤵
  PID:3052
- C:\Windows\System\NBNrkIK.exe
  C:\Windows\System\NBNrkIK.exe
  2⤵
  PID:3164
- C:\Windows\System\zTweQde.exe
  C:\Windows\System\zTweQde.exe
  2⤵
  PID:3360
- C:\Windows\System\cMckPhP.exe
  C:\Windows\System\cMckPhP.exe
  2⤵
  PID:3444
- C:\Windows\System\SVigBDg.exe
  C:\Windows\System\SVigBDg.exe
  2⤵
  PID:3456
- C:\Windows\System\qqJcKYU.exe
  C:\Windows\System\qqJcKYU.exe
  2⤵
  PID:2328
- C:\Windows\System\jRLvsSB.exe
  C:\Windows\System\jRLvsSB.exe
  2⤵
  PID:3892
- C:\Windows\System\KsCVtYD.exe
  C:\Windows\System\KsCVtYD.exe
  2⤵
  PID:3708
- C:\Windows\System\XPYFkAF.exe
  C:\Windows\System\XPYFkAF.exe
  2⤵
  PID:4004
- C:\Windows\System\yJVGAGk.exe
  C:\Windows\System\yJVGAGk.exe
  2⤵
  PID:3256
- C:\Windows\System\eHCVHQg.exe
  C:\Windows\System\eHCVHQg.exe
  2⤵
  PID:2280
- C:\Windows\System\NmZxPEe.exe
  C:\Windows\System\NmZxPEe.exe
  2⤵
  PID:1716
- C:\Windows\System\JSMcbSa.exe
  C:\Windows\System\JSMcbSa.exe
  2⤵
  PID:5132
- C:\Windows\System\JFVkwCL.exe
  C:\Windows\System\JFVkwCL.exe
  2⤵
  PID:5148
- C:\Windows\System\nBBCYNz.exe
  C:\Windows\System\nBBCYNz.exe
  2⤵
  PID:5164
- C:\Windows\System\fvMeTQH.exe
  C:\Windows\System\fvMeTQH.exe
  2⤵
  PID:5180
- C:\Windows\System\dfBTFWI.exe
  C:\Windows\System\dfBTFWI.exe
  2⤵
  PID:5196
- C:\Windows\System\oAPSUYs.exe
  C:\Windows\System\oAPSUYs.exe
  2⤵
  PID:5212
- C:\Windows\System\BYLLtUn.exe
  C:\Windows\System\BYLLtUn.exe
  2⤵
  PID:5228
- C:\Windows\System\eTdkMfE.exe
  C:\Windows\System\eTdkMfE.exe
  2⤵
  PID:5248
- C:\Windows\System\zRxEdtl.exe
  C:\Windows\System\zRxEdtl.exe
  2⤵
  PID:5264
- C:\Windows\System\trjWsvT.exe
  C:\Windows\System\trjWsvT.exe
  2⤵
  PID:5280
- C:\Windows\System\TVbwMRy.exe
  C:\Windows\System\TVbwMRy.exe
  2⤵
  PID:5600
- C:\Windows\System\gIyJsNL.exe
  C:\Windows\System\gIyJsNL.exe
  2⤵
  PID:5668
- C:\Windows\System\SBZrpGC.exe
  C:\Windows\System\SBZrpGC.exe
  2⤵
  PID:5684
- C:\Windows\System\DZlTRHm.exe
  C:\Windows\System\DZlTRHm.exe
  2⤵
  PID:5700
- C:\Windows\System\ZfwFfjm.exe
  C:\Windows\System\ZfwFfjm.exe
  2⤵
  PID:5716
- C:\Windows\System\XygXwuz.exe
  C:\Windows\System\XygXwuz.exe
  2⤵
  PID:5740
- C:\Windows\System\iuLRola.exe
  C:\Windows\System\iuLRola.exe
  2⤵
  PID:5800
- C:\Windows\System\gXXBaMf.exe
  C:\Windows\System\gXXBaMf.exe
  2⤵
  PID:5820
- C:\Windows\System\zKxQIBa.exe
  C:\Windows\System\zKxQIBa.exe
  2⤵
  PID:5836
- C:\Windows\System\MRroYpS.exe
  C:\Windows\System\MRroYpS.exe
  2⤵
  PID:5852
- C:\Windows\System\tVHCNOc.exe
  C:\Windows\System\tVHCNOc.exe
  2⤵
  PID:5868
- C:\Windows\System\aoSuuUd.exe
  C:\Windows\System\aoSuuUd.exe
  2⤵
  PID:5884
- C:\Windows\System\mfSBHab.exe
  C:\Windows\System\mfSBHab.exe
  2⤵
  PID:5900
- C:\Windows\System\GjKIGwL.exe
  C:\Windows\System\GjKIGwL.exe
  2⤵
  PID:5920
- C:\Windows\System\ObhaiXV.exe
  C:\Windows\System\ObhaiXV.exe
  2⤵
  PID:5936
- C:\Windows\System\DctmODR.exe
  C:\Windows\System\DctmODR.exe
  2⤵
  PID:5956
- C:\Windows\System\YDaHlKf.exe
  C:\Windows\System\YDaHlKf.exe
  2⤵
  PID:5972
- C:\Windows\System\jImATYG.exe
  C:\Windows\System\jImATYG.exe
  2⤵
  PID:5988
- C:\Windows\System\fomwioG.exe
  C:\Windows\System\fomwioG.exe
  2⤵
  PID:6004
- C:\Windows\System\mOqjHpJ.exe
  C:\Windows\System\mOqjHpJ.exe
  2⤵
  PID:6020
- C:\Windows\System\NudEOqP.exe
  C:\Windows\System\NudEOqP.exe
  2⤵
  PID:6036
- C:\Windows\System\zsUGnSd.exe
  C:\Windows\System\zsUGnSd.exe
  2⤵
  PID:6052
- C:\Windows\System\TnVOtPt.exe
  C:\Windows\System\TnVOtPt.exe
  2⤵
  PID:6068
- C:\Windows\System\AViHzCe.exe
  C:\Windows\System\AViHzCe.exe
  2⤵
  PID:6084
- C:\Windows\System\etqTVzm.exe
  C:\Windows\System\etqTVzm.exe
  2⤵
  PID:6100
- C:\Windows\System\unLPmha.exe
  C:\Windows\System\unLPmha.exe
  2⤵
  PID:6116
- C:\Windows\System\rYrcRCB.exe
  C:\Windows\System\rYrcRCB.exe
  2⤵
  PID:6132
- C:\Windows\System\CIHIOok.exe
  C:\Windows\System\CIHIOok.exe
  2⤵
  PID:3100
- C:\Windows\System\reUZPtZ.exe
  C:\Windows\System\reUZPtZ.exe
  2⤵
  PID:4556
- C:\Windows\System\shGlwye.exe
  C:\Windows\System\shGlwye.exe
  2⤵
  PID:4684
- C:\Windows\System\gaTzcrY.exe
  C:\Windows\System\gaTzcrY.exe
  2⤵
  PID:4784
- C:\Windows\System\RhOtsZW.exe
  C:\Windows\System\RhOtsZW.exe
  2⤵
  PID:4196
- C:\Windows\System\AfHPZUj.exe
  C:\Windows\System\AfHPZUj.exe
  2⤵
  PID:4292
- C:\Windows\System\DPlcgNg.exe
  C:\Windows\System\DPlcgNg.exe
  2⤵
  PID:4356
- C:\Windows\System\gcdhAIS.exe
  C:\Windows\System\gcdhAIS.exe
  2⤵
  PID:2468
- C:\Windows\System\GmfMETH.exe
  C:\Windows\System\GmfMETH.exe
  2⤵
  PID:4748
- C:\Windows\System\TUlfNfp.exe
  C:\Windows\System\TUlfNfp.exe
  2⤵
  PID:4976
- C:\Windows\System\nEsNKLF.exe
  C:\Windows\System\nEsNKLF.exe
  2⤵
  PID:5104
- C:\Windows\System\XWZoGPA.exe
  C:\Windows\System\XWZoGPA.exe
  2⤵
  PID:3280
- C:\Windows\System\PBtztaY.exe
  C:\Windows\System\PBtztaY.exe
  2⤵
  PID:3748
- C:\Windows\System\jztvalV.exe
  C:\Windows\System\jztvalV.exe
  2⤵
  PID:5188
- C:\Windows\System\dwmvJoe.exe
  C:\Windows\System\dwmvJoe.exe
  2⤵
  PID:5256
- C:\Windows\System\JJSYvhp.exe
  C:\Windows\System\JJSYvhp.exe
  2⤵
  PID:5300
- C:\Windows\System\BOqsnZf.exe
  C:\Windows\System\BOqsnZf.exe
  2⤵
  PID:5316
- C:\Windows\System\hESrqVn.exe
  C:\Windows\System\hESrqVn.exe
  2⤵
  PID:5332
- C:\Windows\System\MpthmVT.exe
  C:\Windows\System\MpthmVT.exe
  2⤵
  PID:5348
- C:\Windows\System\DKtaTOc.exe
  C:\Windows\System\DKtaTOc.exe
  2⤵
  PID:5380
- C:\Windows\System\ssRbIuD.exe
  C:\Windows\System\ssRbIuD.exe
  2⤵
  PID:5400
- C:\Windows\System\KqxRTFO.exe
  C:\Windows\System\KqxRTFO.exe
  2⤵
  PID:5412
- C:\Windows\System\vjLDpTB.exe
  C:\Windows\System\vjLDpTB.exe
  2⤵
  PID:5432
- C:\Windows\System\uQTJqaZ.exe
  C:\Windows\System\uQTJqaZ.exe
  2⤵
  PID:2252
- C:\Windows\System\aVyVaaT.exe
  C:\Windows\System\aVyVaaT.exe
  2⤵
  PID:2772
- C:\Windows\System\aBAHYdW.exe
  C:\Windows\System\aBAHYdW.exe
  2⤵
  PID:5444
- C:\Windows\System\wAHUGtR.exe
  C:\Windows\System\wAHUGtR.exe
  2⤵
  PID:5452
- C:\Windows\System\fgDddqd.exe
  C:\Windows\System\fgDddqd.exe
  2⤵
  PID:2416
- C:\Windows\System\EGBdgKv.exe
  C:\Windows\System\EGBdgKv.exe
  2⤵
  PID:4116
- C:\Windows\System\kpQrxhH.exe
  C:\Windows\System\kpQrxhH.exe
  2⤵
  PID:3300
- C:\Windows\System\AMpTcxj.exe
  C:\Windows\System\AMpTcxj.exe
  2⤵
  PID:4344
- C:\Windows\System\YYeiAyY.exe
  C:\Windows\System\YYeiAyY.exe
  2⤵
  PID:4440
- C:\Windows\System\hUsMbWZ.exe
  C:\Windows\System\hUsMbWZ.exe
  2⤵
  PID:1712
- C:\Windows\System\weeLMAZ.exe
  C:\Windows\System\weeLMAZ.exe
  2⤵
  PID:4636
- C:\Windows\System\gRjGGEd.exe
  C:\Windows\System\gRjGGEd.exe
  2⤵
  PID:912
- C:\Windows\System\SqggduK.exe
  C:\Windows\System\SqggduK.exe
  2⤵
  PID:4864
- C:\Windows\System\drsxIaD.exe
  C:\Windows\System\drsxIaD.exe
  2⤵
  PID:2656
- C:\Windows\System\dfahSMo.exe
  C:\Windows\System\dfahSMo.exe
  2⤵
  PID:4956
- C:\Windows\System\jMBafrf.exe
  C:\Windows\System\jMBafrf.exe
  2⤵
  PID:1464
- C:\Windows\System\KURnVVL.exe
  C:\Windows\System\KURnVVL.exe
  2⤵
  PID:4960
- C:\Windows\System\wNrkyda.exe
  C:\Windows\System\wNrkyda.exe
  2⤵
  PID:5140
- C:\Windows\System\nkrXqJz.exe
  C:\Windows\System\nkrXqJz.exe
  2⤵
  PID:5204
- C:\Windows\System\bWqREzn.exe
  C:\Windows\System\bWqREzn.exe
  2⤵
  PID:5272
- C:\Windows\System\sPGnDVl.exe
  C:\Windows\System\sPGnDVl.exe
  2⤵
  PID:2536
- C:\Windows\System\qblntDe.exe
  C:\Windows\System\qblntDe.exe
  2⤵
  PID:2236
- C:\Windows\System\cDLqhSl.exe
  C:\Windows\System\cDLqhSl.exe
  2⤵
  PID:764
- C:\Windows\System\HzlMHsf.exe
  C:\Windows\System\HzlMHsf.exe
  2⤵
  PID:1096
- C:\Windows\System\NmYAdiJ.exe
  C:\Windows\System\NmYAdiJ.exe
  2⤵
  PID:3080
- C:\Windows\System\oYFrwZw.exe
  C:\Windows\System\oYFrwZw.exe
  2⤵
  PID:3988
- C:\Windows\System\MNCnWIP.exe
  C:\Windows\System\MNCnWIP.exe
  2⤵
  PID:4084
- C:\Windows\System\MmDssrd.exe
  C:\Windows\System\MmDssrd.exe
  2⤵
  PID:896
- C:\Windows\System\XJfqaoS.exe
  C:\Windows\System\XJfqaoS.exe
  2⤵
  PID:3188
- C:\Windows\System\mJyYnxV.exe
  C:\Windows\System\mJyYnxV.exe
  2⤵
  PID:5516
- C:\Windows\System\WwlVoii.exe
  C:\Windows\System\WwlVoii.exe
  2⤵
  PID:5532
- C:\Windows\System\yToyzri.exe
  C:\Windows\System\yToyzri.exe
  2⤵
  PID:5548
- C:\Windows\System\TbRXGBf.exe
  C:\Windows\System\TbRXGBf.exe
  2⤵
  PID:5564
- C:\Windows\System\HkuAfAY.exe
  C:\Windows\System\HkuAfAY.exe
  2⤵
  PID:5584
- C:\Windows\System\MvvhqLj.exe
  C:\Windows\System\MvvhqLj.exe
  2⤵
  PID:5572
- C:\Windows\System\mXASbNf.exe
  C:\Windows\System\mXASbNf.exe
  2⤵
  PID:1284
- C:\Windows\System\QByLfHm.exe
  C:\Windows\System\QByLfHm.exe
  2⤵
  PID:2436
- C:\Windows\System\POktUwS.exe
  C:\Windows\System\POktUwS.exe
  2⤵
  PID:1352
- C:\Windows\System\NiMXXWq.exe
  C:\Windows\System\NiMXXWq.exe
  2⤵
  PID:808
- C:\Windows\System\guMDVsG.exe
  C:\Windows\System\guMDVsG.exe
  2⤵
  PID:5620
- C:\Windows\System\KZFUQog.exe
  C:\Windows\System\KZFUQog.exe
  2⤵
  PID:5636
- C:\Windows\System\JXxyOmA.exe
  C:\Windows\System\JXxyOmA.exe
  2⤵
  PID:5652
- C:\Windows\System\aZpegPq.exe
  C:\Windows\System\aZpegPq.exe
  2⤵
  PID:5664
- C:\Windows\System\sHZmBaV.exe
  C:\Windows\System\sHZmBaV.exe
  2⤵
  PID:5708
- C:\Windows\System\rRVCWjZ.exe
  C:\Windows\System\rRVCWjZ.exe
  2⤵
  PID:2820
- C:\Windows\System\fEwvHIH.exe
  C:\Windows\System\fEwvHIH.exe
  2⤵
  PID:1248
- C:\Windows\System\xhAkbHI.exe
  C:\Windows\System\xhAkbHI.exe
  2⤵
  PID:5760
- C:\Windows\System\VGVekPy.exe
  C:\Windows\System\VGVekPy.exe
  2⤵
  PID:5780
- C:\Windows\System\aVRZXyR.exe
  C:\Windows\System\aVRZXyR.exe
  2⤵
  PID:5796
- C:\Windows\System\wwETfnv.exe
  C:\Windows\System\wwETfnv.exe
  2⤵
  PID:5828
- C:\Windows\System\PbMsPZP.exe
  C:\Windows\System\PbMsPZP.exe
  2⤵
  PID:5928
- C:\Windows\System\XRkEahg.exe
  C:\Windows\System\XRkEahg.exe
  2⤵
  PID:2976
- C:\Windows\System\haiatsx.exe
  C:\Windows\System\haiatsx.exe
  2⤵
  PID:6060
- C:\Windows\System\yJxOOuC.exe
  C:\Windows\System\yJxOOuC.exe
  2⤵
  PID:6016
- C:\Windows\System\NqWuZQp.exe
  C:\Windows\System\NqWuZQp.exe
  2⤵
  PID:5736
- C:\Windows\System\EAftWZE.exe
  C:\Windows\System\EAftWZE.exe
  2⤵
  PID:3612
- C:\Windows\System\AEBnLvR.exe
  C:\Windows\System\AEBnLvR.exe
  2⤵
  PID:3520
- C:\Windows\System\DFSWFGk.exe
  C:\Windows\System\DFSWFGk.exe
  2⤵
  PID:4524
- C:\Windows\System\vGhKGdW.exe
  C:\Windows\System\vGhKGdW.exe
  2⤵
  PID:4616
- C:\Windows\System\LGfxGwB.exe
  C:\Windows\System\LGfxGwB.exe
  2⤵
  PID:4752
- C:\Windows\System\qyrpIGp.exe
  C:\Windows\System\qyrpIGp.exe
  2⤵
  PID:4648
- C:\Windows\System\eDKUDkU.exe
  C:\Windows\System\eDKUDkU.exe
  2⤵
  PID:4192
- C:\Windows\System\jqVTeFj.exe
  C:\Windows\System\jqVTeFj.exe
  2⤵
  PID:4260
- C:\Windows\System\dNfhJbD.exe
  C:\Windows\System\dNfhJbD.exe
  2⤵
  PID:4388
- C:\Windows\System\faSbejj.exe
  C:\Windows\System\faSbejj.exe
  2⤵
  PID:4456
- C:\Windows\System\kpZvFPi.exe
  C:\Windows\System\kpZvFPi.exe
  2⤵
  PID:4488
- C:\Windows\System\OFSaWpE.exe
  C:\Windows\System\OFSaWpE.exe
  2⤵
  PID:4940
- C:\Windows\System\fkixuVD.exe
  C:\Windows\System\fkixuVD.exe
  2⤵
  PID:5072
- C:\Windows\System\KBZakGR.exe
  C:\Windows\System\KBZakGR.exe
  2⤵
  PID:5040
- C:\Windows\System\YwdEGiu.exe
  C:\Windows\System\YwdEGiu.exe
  2⤵
  PID:5036
- C:\Windows\System\DbatBPk.exe
  C:\Windows\System\DbatBPk.exe
  2⤵
  PID:5128
- C:\Windows\System\OxMVVDw.exe
  C:\Windows\System\OxMVVDw.exe
  2⤵
  PID:5224
- C:\Windows\System\qBTycqL.exe
  C:\Windows\System\qBTycqL.exe
  2⤵
  PID:5312
- C:\Windows\System\bmbfeMX.exe
  C:\Windows\System\bmbfeMX.exe
  2⤵
  PID:5404
- C:\Windows\System\bKZOSbB.exe
  C:\Windows\System\bKZOSbB.exe
  2⤵
  PID:1856
- C:\Windows\System\ddqCFXZ.exe
  C:\Windows\System\ddqCFXZ.exe
  2⤵
  PID:628
- C:\Windows\System\qCWpQxQ.exe
  C:\Windows\System\qCWpQxQ.exe
  2⤵
  PID:3832
- C:\Windows\System\RhHPiZG.exe
  C:\Windows\System\RhHPiZG.exe
  2⤵
  PID:1768
- C:\Windows\System\ctgzHDf.exe
  C:\Windows\System\ctgzHDf.exe
  2⤵
  PID:5480
- C:\Windows\System\MUiniyv.exe
  C:\Windows\System\MUiniyv.exe
  2⤵
  PID:5468
- C:\Windows\System\qYFmHPb.exe
  C:\Windows\System\qYFmHPb.exe
  2⤵
  PID:4148
- C:\Windows\System\jkqkWxa.exe
  C:\Windows\System\jkqkWxa.exe
  2⤵
  PID:4244
- C:\Windows\System\NCfPXiK.exe
  C:\Windows\System\NCfPXiK.exe
  2⤵
  PID:4376
- C:\Windows\System\HgJeJHp.exe
  C:\Windows\System\HgJeJHp.exe
  2⤵
  PID:4472
- C:\Windows\System\InodHvh.exe
  C:\Windows\System\InodHvh.exe
  2⤵
  PID:4668
- C:\Windows\System\lUoAihH.exe
  C:\Windows\System\lUoAihH.exe
  2⤵
  PID:4732
- C:\Windows\System\ezYcSDx.exe
  C:\Windows\System\ezYcSDx.exe
  2⤵
  PID:4896
- C:\Windows\System\mzFTuUZ.exe
  C:\Windows\System\mzFTuUZ.exe
  2⤵
  PID:5020
- C:\Windows\System\IdNIuyo.exe
  C:\Windows\System\IdNIuyo.exe
  2⤵
  PID:3724
- C:\Windows\System\xAaQeDs.exe
  C:\Windows\System\xAaQeDs.exe
  2⤵
  PID:2828
- C:\Windows\System\iXrsDFx.exe
  C:\Windows\System\iXrsDFx.exe
  2⤵
  PID:5496
- C:\Windows\System\uKxPMak.exe
  C:\Windows\System\uKxPMak.exe
  2⤵
  PID:2480
- C:\Windows\System\zLwPlTj.exe
  C:\Windows\System\zLwPlTj.exe
  2⤵
  PID:5504
- C:\Windows\System\qunUpPI.exe
  C:\Windows\System\qunUpPI.exe
  2⤵
  PID:4604
- C:\Windows\System\iQmzGCV.exe
  C:\Windows\System\iQmzGCV.exe
  2⤵
  PID:4892
- C:\Windows\System\DlIsHoH.exe
  C:\Windows\System\DlIsHoH.exe
  2⤵
  PID:4536
- C:\Windows\System\jUJcBmP.exe
  C:\Windows\System\jUJcBmP.exe
  2⤵
  PID:5052
- C:\Windows\System\tdMkQTA.exe
  C:\Windows\System\tdMkQTA.exe
  2⤵
  PID:5084
- C:\Windows\System\RpCQzrh.exe
  C:\Windows\System\RpCQzrh.exe
  2⤵
  PID:5528
- C:\Windows\System\RsBUAzI.exe
  C:\Windows\System\RsBUAzI.exe
  2⤵
  PID:5588
- C:\Windows\System\uRBQyMM.exe
  C:\Windows\System\uRBQyMM.exe
  2⤵
  PID:2168
- C:\Windows\System\vxjhiVk.exe
  C:\Windows\System\vxjhiVk.exe
  2⤵
  PID:2548
- C:\Windows\System\cyiemSz.exe
  C:\Windows\System\cyiemSz.exe
  2⤵
  PID:5696
- C:\Windows\System\TlvrPZv.exe
  C:\Windows\System\TlvrPZv.exe
  2⤵
  PID:4072
- C:\Windows\System\vfpVdZG.exe
  C:\Windows\System\vfpVdZG.exe
  2⤵
  PID:2104
- C:\Windows\System\qVepBFo.exe
  C:\Windows\System\qVepBFo.exe
  2⤵
  PID:3776
- C:\Windows\System\NpeyuAl.exe
  C:\Windows\System\NpeyuAl.exe
  2⤵
  PID:1632
- C:\Windows\System\QxQxSxa.exe
  C:\Windows\System\QxQxSxa.exe
  2⤵
  PID:5632
- C:\Windows\System\UmXlGEQ.exe
  C:\Windows\System\UmXlGEQ.exe
  2⤵
  PID:5748
- C:\Windows\System\pEzocvE.exe
  C:\Windows\System\pEzocvE.exe
  2⤵
  PID:5728
- C:\Windows\System\DGfBEvi.exe
  C:\Windows\System\DGfBEvi.exe
  2⤵
  PID:5844
- C:\Windows\System\oBwbCbJ.exe
  C:\Windows\System\oBwbCbJ.exe
  2⤵
  PID:5788
- C:\Windows\System\LsWyYbn.exe
  C:\Windows\System\LsWyYbn.exe
  2⤵
  PID:5816
- C:\Windows\System\AhnpJBE.exe
  C:\Windows\System\AhnpJBE.exe
  2⤵
  PID:5912
- C:\Windows\System\zkEPPRT.exe
  C:\Windows\System\zkEPPRT.exe
  2⤵
  PID:5980
- C:\Windows\System\THxSIry.exe
  C:\Windows\System\THxSIry.exe
  2⤵
  PID:6064
- C:\Windows\System\fOdskvH.exe
  C:\Windows\System\fOdskvH.exe
  2⤵
  PID:6032
- C:\Windows\System\YfiwreD.exe
  C:\Windows\System\YfiwreD.exe
  2⤵
  PID:6076
- C:\Windows\System\gjuOIsx.exe
  C:\Windows\System\gjuOIsx.exe
  2⤵
  PID:4160
- C:\Windows\System\hiTXfUu.exe
  C:\Windows\System\hiTXfUu.exe
  2⤵
  PID:4584
- C:\Windows\System\XXkkucD.exe
  C:\Windows\System\XXkkucD.exe
  2⤵
  PID:4912
- C:\Windows\System\iowHrlv.exe
  C:\Windows\System\iowHrlv.exe
  2⤵
  PID:2652
- C:\Windows\System\kFFwsjY.exe
  C:\Windows\System\kFFwsjY.exe
  2⤵
  PID:3788
- C:\Windows\System\jJCaoNS.exe
  C:\Windows\System\jJCaoNS.exe
  2⤵
  PID:5124
- C:\Windows\System\ClvoQga.exe
  C:\Windows\System\ClvoQga.exe
  2⤵
  PID:2992
- C:\Windows\System\rTgzZpY.exe
  C:\Windows\System\rTgzZpY.exe
  2⤵
  PID:5160
- C:\Windows\System\mmwWMis.exe
  C:\Windows\System\mmwWMis.exe
  2⤵
  PID:5732
- C:\Windows\System\MrtDVka.exe
  C:\Windows\System\MrtDVka.exe
  2⤵
  PID:4876
- C:\Windows\System\VBaXnnR.exe
  C:\Windows\System\VBaXnnR.exe
  2⤵
  PID:4588
- C:\Windows\System\TMrWDlW.exe
  C:\Windows\System\TMrWDlW.exe
  2⤵
  PID:5428
- C:\Windows\System\GaKsuww.exe
  C:\Windows\System\GaKsuww.exe
  2⤵
  PID:5916
- C:\Windows\System\JRBQYpz.exe
  C:\Windows\System\JRBQYpz.exe
  2⤵
  PID:5388
- C:\Windows\System\DFqDqQN.exe
  C:\Windows\System\DFqDqQN.exe
  2⤵
  PID:3992
- C:\Windows\System\HHqhNRk.exe
  C:\Windows\System\HHqhNRk.exe
  2⤵
  PID:4408
- C:\Windows\System\MBDfFlJ.exe
  C:\Windows\System\MBDfFlJ.exe
  2⤵
  PID:2584
- C:\Windows\System\iReblex.exe
  C:\Windows\System\iReblex.exe
  2⤵
  PID:4988
- C:\Windows\System\DAoNphY.exe
  C:\Windows\System\DAoNphY.exe
  2⤵
  PID:3856
- C:\Windows\System\SHxJpEZ.exe
  C:\Windows\System\SHxJpEZ.exe
  2⤵
  PID:5088
- C:\Windows\System\ZTUjxRv.exe
  C:\Windows\System\ZTUjxRv.exe
  2⤵
  PID:5540
- C:\Windows\System\jSCMxew.exe
  C:\Windows\System\jSCMxew.exe
  2⤵
  PID:5612
- C:\Windows\System\HBHmOMr.exe
  C:\Windows\System\HBHmOMr.exe
  2⤵
  PID:5616
- C:\Windows\System\kTufuKw.exe
  C:\Windows\System\kTufuKw.exe
  2⤵
  PID:4540
- C:\Windows\System\BNRYMkv.exe
  C:\Windows\System\BNRYMkv.exe
  2⤵
  PID:4600
- C:\Windows\System\iiKgBrk.exe
  C:\Windows\System\iiKgBrk.exe
  2⤵
  PID:4568
- C:\Windows\System\xaOaDAi.exe
  C:\Windows\System\xaOaDAi.exe
  2⤵
  PID:4800
- C:\Windows\System\YXhNetU.exe
  C:\Windows\System\YXhNetU.exe
  2⤵
  PID:4632
- C:\Windows\System\XtTRaCD.exe
  C:\Windows\System\XtTRaCD.exe
  2⤵
  PID:4828
- C:\Windows\System\TSscMOe.exe
  C:\Windows\System\TSscMOe.exe
  2⤵
  PID:5240
- C:\Windows\System\CyszRuJ.exe
  C:\Windows\System\CyszRuJ.exe
  2⤵
  PID:1980
- C:\Windows\System\PqPGhtr.exe
  C:\Windows\System\PqPGhtr.exe
  2⤵
  PID:5476
- C:\Windows\System\WfDhWeZ.exe
  C:\Windows\System\WfDhWeZ.exe
  2⤵
  PID:4024
- C:\Windows\System\EnIwYxf.exe
  C:\Windows\System\EnIwYxf.exe
  2⤵
  PID:4056
- C:\Windows\System\qVvzpQK.exe
  C:\Windows\System\qVvzpQK.exe
  2⤵
  PID:1308
- C:\Windows\System\fqJSATZ.exe
  C:\Windows\System\fqJSATZ.exe
  2⤵
  PID:5892
- C:\Windows\System\THdCtxj.exe
  C:\Windows\System\THdCtxj.exe
  2⤵
  PID:2072
- C:\Windows\System\XbYbdPr.exe
  C:\Windows\System\XbYbdPr.exe
  2⤵
  PID:6108
- C:\Windows\System\ALDMLfU.exe
  C:\Windows\System\ALDMLfU.exe
  2⤵
  PID:3408
- C:\Windows\System\RlpKtjp.exe
  C:\Windows\System\RlpKtjp.exe
  2⤵
  PID:5952
- C:\Windows\System\TLDGgUV.exe
  C:\Windows\System\TLDGgUV.exe
  2⤵
  PID:6012
- C:\Windows\System\JawWbtg.exe
  C:\Windows\System\JawWbtg.exe
  2⤵
  PID:6124
- C:\Windows\System\GWlbBiF.exe
  C:\Windows\System\GWlbBiF.exe
  2⤵
  PID:2204
- C:\Windows\System\tOJlbsJ.exe
  C:\Windows\System\tOJlbsJ.exe
  2⤵
  PID:1888
- C:\Windows\System\vEysatP.exe
  C:\Windows\System\vEysatP.exe
  2⤵
  PID:5772
- C:\Windows\System\jVyMiAn.exe
  C:\Windows\System\jVyMiAn.exe
  2⤵
  PID:4164
- C:\Windows\System\yZPtjCX.exe
  C:\Windows\System\yZPtjCX.exe
  2⤵
  PID:1472
- C:\Windows\System\WUbTCKV.exe
  C:\Windows\System\WUbTCKV.exe
  2⤵
  PID:4224
- C:\Windows\System\WxOyEox.exe
  C:\Windows\System\WxOyEox.exe
  2⤵
  PID:5368
- C:\Windows\System\EfIDauN.exe
  C:\Windows\System\EfIDauN.exe
  2⤵
  PID:2108
- C:\Windows\System\VqtFkZT.exe
  C:\Windows\System\VqtFkZT.exe
  2⤵
  PID:1484
- C:\Windows\System\ASRYkqE.exe
  C:\Windows\System\ASRYkqE.exe
  2⤵
  PID:4764
- C:\Windows\System\XmggqoD.exe
  C:\Windows\System\XmggqoD.exe
  2⤵
  PID:5424
- C:\Windows\System\DJQeCHK.exe
  C:\Windows\System\DJQeCHK.exe
  2⤵
  PID:2636
- C:\Windows\System\HCjAPym.exe
  C:\Windows\System\HCjAPym.exe
  2⤵
  PID:1724
- C:\Windows\System\WtCDSMe.exe
  C:\Windows\System\WtCDSMe.exe
  2⤵
  PID:4508
- C:\Windows\System\LmtHZEc.exe
  C:\Windows\System\LmtHZEc.exe
  2⤵
  PID:2412
- C:\Windows\System\JrNgNgR.exe
  C:\Windows\System\JrNgNgR.exe
  2⤵
  PID:2776
- C:\Windows\System\MsTyeMP.exe
  C:\Windows\System\MsTyeMP.exe
  2⤵
  PID:2504
- C:\Windows\System\FaBUzIF.exe
  C:\Windows\System\FaBUzIF.exe
  2⤵
  PID:852
- C:\Windows\System\aKllMlq.exe
  C:\Windows\System\aKllMlq.exe
  2⤵
  PID:5964
- C:\Windows\System\miHdoEa.exe
  C:\Windows\System\miHdoEa.exe
  2⤵
  PID:4552
- C:\Windows\System\cQHWTmm.exe
  C:\Windows\System\cQHWTmm.exe
  2⤵
  PID:4424
- C:\Windows\System\OCczbkf.exe
  C:\Windows\System\OCczbkf.exe
  2⤵
  PID:696
- C:\Windows\System\ZEkOyae.exe
  C:\Windows\System\ZEkOyae.exe
  2⤵
  PID:3728
- C:\Windows\System\Hzxlnwh.exe
  C:\Windows\System\Hzxlnwh.exe
  2⤵
  PID:5524
- C:\Windows\System\hbwzhoM.exe
  C:\Windows\System\hbwzhoM.exe
  2⤵
  PID:5560
- C:\Windows\System\nyBFRxq.exe
  C:\Windows\System\nyBFRxq.exe
  2⤵
  PID:5896
- C:\Windows\System\NyxHvZR.exe
  C:\Windows\System\NyxHvZR.exe
  2⤵
  PID:780
- C:\Windows\System\uhVusGu.exe
  C:\Windows\System\uhVusGu.exe
  2⤵
  PID:5456
- C:\Windows\System\ATivhaN.exe
  C:\Windows\System\ATivhaN.exe
  2⤵
  PID:4312
- C:\Windows\System\cQTJnFj.exe
  C:\Windows\System\cQTJnFj.exe
  2⤵
  PID:5628
- C:\Windows\System\aIqsdhX.exe
  C:\Windows\System\aIqsdhX.exe
  2⤵
  PID:5592
- C:\Windows\System\SHeVVvC.exe
  C:\Windows\System\SHeVVvC.exe
  2⤵
  PID:4340
- C:\Windows\System\GCSRyaw.exe
  C:\Windows\System\GCSRyaw.exe
  2⤵
  PID:6140
- C:\Windows\System\kWMNBML.exe
  C:\Windows\System\kWMNBML.exe
  2⤵
  PID:5372
- C:\Windows\System\FsqUcue.exe
  C:\Windows\System\FsqUcue.exe
  2⤵
  PID:5344
- C:\Windows\System\XYtRLLy.exe
  C:\Windows\System\XYtRLLy.exe
  2⤵
  PID:4928
- C:\Windows\System\aBVZDHe.exe
  C:\Windows\System\aBVZDHe.exe
  2⤵
  PID:4208
- C:\Windows\System\igIdyss.exe
  C:\Windows\System\igIdyss.exe
  2⤵
  PID:6152
- C:\Windows\System\KGONxlz.exe
  C:\Windows\System\KGONxlz.exe
  2⤵
  PID:6172
- C:\Windows\System\QZrlhGr.exe
  C:\Windows\System\QZrlhGr.exe
  2⤵
  PID:6188
- C:\Windows\System\UbGawzo.exe
  C:\Windows\System\UbGawzo.exe
  2⤵
  PID:6204
- C:\Windows\System\cYqociB.exe
  C:\Windows\System\cYqociB.exe
  2⤵
  PID:6220
- C:\Windows\System\TQcOiXg.exe
  C:\Windows\System\TQcOiXg.exe
  2⤵
  PID:6236
- C:\Windows\System\rQiEIfu.exe
  C:\Windows\System\rQiEIfu.exe
  2⤵
  PID:6264
- C:\Windows\System\WTvzMhe.exe
  C:\Windows\System\WTvzMhe.exe
  2⤵
  PID:6280
- C:\Windows\System\DLhwXDg.exe
  C:\Windows\System\DLhwXDg.exe
  2⤵
  PID:6296
- C:\Windows\System\YMceZZI.exe
  C:\Windows\System\YMceZZI.exe
  2⤵
  PID:6316
- C:\Windows\System\VzgqXoy.exe
  C:\Windows\System\VzgqXoy.exe
  2⤵
  PID:6348
- C:\Windows\System\wUIVIMY.exe
  C:\Windows\System\wUIVIMY.exe
  2⤵
  PID:6376
- C:\Windows\System\GlOaWna.exe
  C:\Windows\System\GlOaWna.exe
  2⤵
  PID:6420
- C:\Windows\System\YlwyGhD.exe
  C:\Windows\System\YlwyGhD.exe
  2⤵
  PID:6436
- C:\Windows\System\upEJZoq.exe
  C:\Windows\System\upEJZoq.exe
  2⤵
  PID:6452
- C:\Windows\System\hMzecqi.exe
  C:\Windows\System\hMzecqi.exe
  2⤵
  PID:6468
- C:\Windows\System\IernNVa.exe
  C:\Windows\System\IernNVa.exe
  2⤵
  PID:6484
- C:\Windows\System\QZNPirD.exe
  C:\Windows\System\QZNPirD.exe
  2⤵
  PID:6500
- C:\Windows\System\XCtAWEO.exe
  C:\Windows\System\XCtAWEO.exe
  2⤵
  PID:6524
- C:\Windows\System\YqxjWiT.exe
  C:\Windows\System\YqxjWiT.exe
  2⤵
  PID:6540
- C:\Windows\System\bPYgpbi.exe
  C:\Windows\System\bPYgpbi.exe
  2⤵
  PID:6556
- C:\Windows\System\QMrLdwa.exe
  C:\Windows\System\QMrLdwa.exe
  2⤵
  PID:6572
- C:\Windows\System\rafSjnA.exe
  C:\Windows\System\rafSjnA.exe
  2⤵
  PID:6588
- C:\Windows\System\aPuxFon.exe
  C:\Windows\System\aPuxFon.exe
  2⤵
  PID:6608
- C:\Windows\System\EporbLt.exe
  C:\Windows\System\EporbLt.exe
  2⤵
  PID:6624
- C:\Windows\System\CtiZBTR.exe
  C:\Windows\System\CtiZBTR.exe
  2⤵
  PID:6640
- C:\Windows\System\hyWFqkm.exe
  C:\Windows\System\hyWFqkm.exe
  2⤵
  PID:6656
- C:\Windows\System\FllVKsm.exe
  C:\Windows\System\FllVKsm.exe
  2⤵
  PID:6672
- C:\Windows\System\LplSDyS.exe
  C:\Windows\System\LplSDyS.exe
  2⤵
  PID:6692
- C:\Windows\System\whyXnXW.exe
  C:\Windows\System\whyXnXW.exe
  2⤵
  PID:6708
- C:\Windows\System\dAJOGoW.exe
  C:\Windows\System\dAJOGoW.exe
  2⤵
  PID:6724
- C:\Windows\System\bAsSlii.exe
  C:\Windows\System\bAsSlii.exe
  2⤵
  PID:6744
- C:\Windows\System\kpffYyc.exe
  C:\Windows\System\kpffYyc.exe
  2⤵
  PID:6760
- C:\Windows\System\xPQmmSn.exe
  C:\Windows\System\xPQmmSn.exe
  2⤵
  PID:6776
- C:\Windows\System\WwEXYZf.exe
  C:\Windows\System\WwEXYZf.exe
  2⤵
  PID:6792
- C:\Windows\System\WzRrUdO.exe
  C:\Windows\System\WzRrUdO.exe
  2⤵
  PID:6812
- C:\Windows\System\QOfyKcO.exe
  C:\Windows\System\QOfyKcO.exe
  2⤵
  PID:6828
- C:\Windows\System\pJyMvTf.exe
  C:\Windows\System\pJyMvTf.exe
  2⤵
  PID:6844
- C:\Windows\System\NpEpTEl.exe
  C:\Windows\System\NpEpTEl.exe
  2⤵
  PID:6860
- C:\Windows\System\KaCXrdi.exe
  C:\Windows\System\KaCXrdi.exe
  2⤵
  PID:6876
- C:\Windows\System\fbuIHMI.exe
  C:\Windows\System\fbuIHMI.exe
  2⤵
  PID:6892
- C:\Windows\System\gtOZhna.exe
  C:\Windows\System\gtOZhna.exe
  2⤵
  PID:6912
- C:\Windows\System\bocCnit.exe
  C:\Windows\System\bocCnit.exe
  2⤵
  PID:6928
- C:\Windows\System\detYWPG.exe
  C:\Windows\System\detYWPG.exe
  2⤵
  PID:6944
- C:\Windows\System\wZZzIEE.exe
  C:\Windows\System\wZZzIEE.exe
  2⤵
  PID:6968
- C:\Windows\System\xMaoHfE.exe
  C:\Windows\System\xMaoHfE.exe
  2⤵
  PID:6984
- C:\Windows\System\hKBDakx.exe
  C:\Windows\System\hKBDakx.exe
  2⤵
  PID:7000
- C:\Windows\System\JiHdxzZ.exe
  C:\Windows\System\JiHdxzZ.exe
  2⤵
  PID:7016
- C:\Windows\System\LyeRQZN.exe
  C:\Windows\System\LyeRQZN.exe
  2⤵
  PID:7032
- C:\Windows\System\nsmWfZb.exe
  C:\Windows\System\nsmWfZb.exe
  2⤵
  PID:7048
- C:\Windows\System\PYVvDxY.exe
  C:\Windows\System\PYVvDxY.exe
  2⤵
  PID:7064
- C:\Windows\System\ztVFzPk.exe
  C:\Windows\System\ztVFzPk.exe
  2⤵
  PID:7080
- C:\Windows\System\OXRvWeB.exe
  C:\Windows\System\OXRvWeB.exe
  2⤵
  PID:7096
- C:\Windows\System\SvZBoys.exe
  C:\Windows\System\SvZBoys.exe
  2⤵
  PID:7112
- C:\Windows\System\caInSCx.exe
  C:\Windows\System\caInSCx.exe
  2⤵
  PID:7128
- C:\Windows\System\DwjShav.exe
  C:\Windows\System\DwjShav.exe
  2⤵
  PID:7144
- C:\Windows\System\BraQwMs.exe
  C:\Windows\System\BraQwMs.exe
  2⤵
  PID:7160
- C:\Windows\System\QGubnEl.exe
  C:\Windows\System\QGubnEl.exe
  2⤵
  PID:3320
- C:\Windows\System\hjdEkSC.exe
  C:\Windows\System\hjdEkSC.exe
  2⤵
  PID:6160
- C:\Windows\System\ybDCusD.exe
  C:\Windows\System\ybDCusD.exe
  2⤵
  PID:5968
- C:\Windows\System\zjHsupo.exe
  C:\Windows\System\zjHsupo.exe
  2⤵
  PID:4728
- C:\Windows\System\YTOKXcH.exe
  C:\Windows\System\YTOKXcH.exe
  2⤵
  PID:6200
- C:\Windows\System\tbJgclf.exe
  C:\Windows\System\tbJgclf.exe
  2⤵
  PID:5648
- C:\Windows\System\qjTOQPb.exe
  C:\Windows\System\qjTOQPb.exe
  2⤵
  PID:6212
- C:\Windows\System\QxPCsxy.exe
  C:\Windows\System\QxPCsxy.exe
  2⤵
  PID:6252
- C:\Windows\System\uKIjRmS.exe
  C:\Windows\System\uKIjRmS.exe
  2⤵
  PID:6304
- C:\Windows\System\XHzQhDK.exe
  C:\Windows\System\XHzQhDK.exe
  2⤵
  PID:5324
- C:\Windows\System\BglYREq.exe
  C:\Windows\System\BglYREq.exe
  2⤵
  PID:6332
- C:\Windows\System\nEtHqMM.exe
  C:\Windows\System\nEtHqMM.exe
  2⤵
  PID:6364
- C:\Windows\System\MTdPUrU.exe
  C:\Windows\System\MTdPUrU.exe
  2⤵
  PID:6328
- C:\Windows\System\QUXyYcq.exe
  C:\Windows\System\QUXyYcq.exe
  2⤵
  PID:6384
- C:\Windows\System\TYxUyLi.exe
  C:\Windows\System\TYxUyLi.exe
  2⤵
  PID:6404
- C:\Windows\System\RHdIqPT.exe
  C:\Windows\System\RHdIqPT.exe
  2⤵
  PID:6476
- C:\Windows\System\MjWgBox.exe
  C:\Windows\System\MjWgBox.exe
  2⤵
  PID:6512
- C:\Windows\System\DEFPxXM.exe
  C:\Windows\System\DEFPxXM.exe
  2⤵
  PID:6552
- C:\Windows\System\nMGuGvE.exe
  C:\Windows\System\nMGuGvE.exe
  2⤵
  PID:6580
- C:\Windows\System\miyHdtU.exe
  C:\Windows\System\miyHdtU.exe
  2⤵
  PID:6688
- C:\Windows\System\BnGEIPu.exe
  C:\Windows\System\BnGEIPu.exe
  2⤵
  PID:6720
- C:\Windows\System\QudnfqE.exe
  C:\Windows\System\QudnfqE.exe
  2⤵
  PID:6756
- C:\Windows\System\ChZcCME.exe
  C:\Windows\System\ChZcCME.exe
  2⤵
  PID:6820
- C:\Windows\System\OHkOTkX.exe
  C:\Windows\System\OHkOTkX.exe
  2⤵
  PID:6888
- C:\Windows\System\bvGFZoI.exe
  C:\Windows\System\bvGFZoI.exe
  2⤵
  PID:6924
- C:\Windows\System\wspMUEi.exe
  C:\Windows\System\wspMUEi.exe
  2⤵
  PID:6632
- C:\Windows\System\GIUFwzu.exe
  C:\Windows\System\GIUFwzu.exe
  2⤵
  PID:6564
- C:\Windows\System\EYUxuhA.exe
  C:\Windows\System\EYUxuhA.exe
  2⤵
  PID:6604
- C:\Windows\System\EPSBbyZ.exe
  C:\Windows\System\EPSBbyZ.exe
  2⤵
  PID:6700
- C:\Windows\System\ABzeovE.exe
  C:\Windows\System\ABzeovE.exe
  2⤵
  PID:6740
- C:\Windows\System\OCeXvGC.exe
  C:\Windows\System\OCeXvGC.exe
  2⤵
  PID:6804
- C:\Windows\System\vGrpyZT.exe
  C:\Windows\System\vGrpyZT.exe
  2⤵
  PID:6872
- C:\Windows\System\XDTLKvP.exe
  C:\Windows\System\XDTLKvP.exe
  2⤵
  PID:6936
- C:\Windows\System\TBLbFYF.exe
  C:\Windows\System\TBLbFYF.exe
  2⤵
  PID:6992
- C:\Windows\System\rJXgtqe.exe
  C:\Windows\System\rJXgtqe.exe
  2⤵
  PID:7056
- C:\Windows\System\uwEnOJz.exe
  C:\Windows\System\uwEnOJz.exe
  2⤵
  PID:7120
- C:\Windows\System\cWnhFkt.exe
  C:\Windows\System\cWnhFkt.exe
  2⤵
  PID:4128
- C:\Windows\System\fEbicDi.exe
  C:\Windows\System\fEbicDi.exe
  2⤵
  PID:6232
- C:\Windows\System\TaXwGKG.exe
  C:\Windows\System\TaXwGKG.exe
  2⤵
  PID:6288
- C:\Windows\System\GfnyDVa.exe
  C:\Windows\System\GfnyDVa.exe
  2⤵
  PID:6396
- C:\Windows\System\mptqvCi.exe
  C:\Windows\System\mptqvCi.exe
  2⤵
  PID:7136
- C:\Windows\System\nrXTNdm.exe
  C:\Windows\System\nrXTNdm.exe
  2⤵
  PID:6684
- C:\Windows\System\HEyvtzo.exe
  C:\Windows\System\HEyvtzo.exe
  2⤵
  PID:6884
- C:\Windows\System\mJIlgSQ.exe
  C:\Windows\System\mJIlgSQ.exe
  2⤵
  PID:6596
- C:\Windows\System\aEJOvhK.exe
  C:\Windows\System\aEJOvhK.exe
  2⤵
  PID:7012
- C:\Windows\System\nzlmqkT.exe
  C:\Windows\System\nzlmqkT.exe
  2⤵
  PID:6184
- C:\Windows\System\chTurKq.exe
  C:\Windows\System\chTurKq.exe
  2⤵
  PID:6312
- C:\Windows\System\frnSoIE.exe
  C:\Windows\System\frnSoIE.exe
  2⤵
  PID:6736
- C:\Windows\System\rjNjluq.exe
  C:\Windows\System\rjNjluq.exe
  2⤵
  PID:6412
- C:\Windows\System\bojnZOV.exe
  C:\Windows\System\bojnZOV.exe
  2⤵
  PID:6548
- C:\Windows\System\dATAYGT.exe
  C:\Windows\System\dATAYGT.exe
  2⤵
  PID:6976
- C:\Windows\System\JDQOpZD.exe
  C:\Windows\System\JDQOpZD.exe
  2⤵
  PID:4504
- C:\Windows\System\LoYCIRo.exe
  C:\Windows\System\LoYCIRo.exe
  2⤵
  PID:6168
- C:\Windows\System\PrkipLS.exe
  C:\Windows\System\PrkipLS.exe
  2⤵
  PID:6260
- C:\Windows\System\xvOTjhB.exe
  C:\Windows\System\xvOTjhB.exe
  2⤵
  PID:6460
- C:\Windows\System\cHNtmiu.exe
  C:\Windows\System\cHNtmiu.exe
  2⤵
  PID:6868
- C:\Windows\System\scVeUsa.exe
  C:\Windows\System\scVeUsa.exe
  2⤵
  PID:6616
- C:\Windows\System\BgNuOjk.exe
  C:\Windows\System\BgNuOjk.exe
  2⤵
  PID:6408
- C:\Windows\System\dkWkGRX.exe
  C:\Windows\System\dkWkGRX.exe
  2⤵
  PID:6788
- C:\Windows\System\enDQHsp.exe
  C:\Windows\System\enDQHsp.exe
  2⤵
  PID:6664
- C:\Windows\System\uqLQvuK.exe
  C:\Windows\System\uqLQvuK.exe
  2⤵
  PID:5024
- C:\Windows\System\qwMfVSK.exe
  C:\Windows\System\qwMfVSK.exe
  2⤵
  PID:6344
- C:\Windows\System\oljGIKr.exe
  C:\Windows\System\oljGIKr.exe
  2⤵
  PID:6428
- C:\Windows\System\xixdyyI.exe
  C:\Windows\System\xixdyyI.exe
  2⤵
  PID:7076
- C:\Windows\System\ArBmIpB.exe
  C:\Windows\System\ArBmIpB.exe
  2⤵
  PID:7072
- C:\Windows\System\hinDWPb.exe
  C:\Windows\System\hinDWPb.exe
  2⤵
  PID:6416
- C:\Windows\System\vapogek.exe
  C:\Windows\System\vapogek.exe
  2⤵
  PID:7044
- C:\Windows\System\PTUTvKG.exe
  C:\Windows\System\PTUTvKG.exe
  2⤵
  PID:6372
- C:\Windows\System\yzfOYcv.exe
  C:\Windows\System\yzfOYcv.exe
  2⤵
  PID:7180
- C:\Windows\System\CkWZyGX.exe
  C:\Windows\System\CkWZyGX.exe
  2⤵
  PID:7196
- C:\Windows\System\YxkUBUO.exe
  C:\Windows\System\YxkUBUO.exe
  2⤵
  PID:7216
- C:\Windows\System\OkuGgFU.exe
  C:\Windows\System\OkuGgFU.exe
  2⤵
  PID:7232
- C:\Windows\System\slsdsQR.exe
  C:\Windows\System\slsdsQR.exe
  2⤵
  PID:7248
- C:\Windows\System\EZdKcqh.exe
  C:\Windows\System\EZdKcqh.exe
  2⤵
  PID:7264
- C:\Windows\System\mqJBwYn.exe
  C:\Windows\System\mqJBwYn.exe
  2⤵
  PID:7280
- C:\Windows\System\HbvunvZ.exe
  C:\Windows\System\HbvunvZ.exe
  2⤵
  PID:7300
- C:\Windows\System\hjbuIXK.exe
  C:\Windows\System\hjbuIXK.exe
  2⤵
  PID:7316
- C:\Windows\System\kEUSBgc.exe
  C:\Windows\System\kEUSBgc.exe
  2⤵
  PID:7332
- C:\Windows\System\hoSSAqr.exe
  C:\Windows\System\hoSSAqr.exe
  2⤵
  PID:7348
- C:\Windows\System\MtyCiqE.exe
  C:\Windows\System\MtyCiqE.exe
  2⤵
  PID:7364
- C:\Windows\System\qomSdUG.exe
  C:\Windows\System\qomSdUG.exe
  2⤵
  PID:7384
- C:\Windows\System\efJVrHD.exe
  C:\Windows\System\efJVrHD.exe
  2⤵
  PID:7404
- C:\Windows\System\BpdhvVH.exe
  C:\Windows\System\BpdhvVH.exe
  2⤵
  PID:7420
- C:\Windows\System\vaYtwRL.exe
  C:\Windows\System\vaYtwRL.exe
  2⤵
  PID:7436
- C:\Windows\System\FdcdfZk.exe
  C:\Windows\System\FdcdfZk.exe
  2⤵
  PID:7452
- C:\Windows\System\CkKkbKY.exe
  C:\Windows\System\CkKkbKY.exe
  2⤵
  PID:7588
- C:\Windows\System\YSBzIOS.exe
  C:\Windows\System\YSBzIOS.exe
  2⤵
  PID:7604
- C:\Windows\System\HEZHKSX.exe
  C:\Windows\System\HEZHKSX.exe
  2⤵
  PID:7620
- C:\Windows\System\sMdPUqj.exe
  C:\Windows\System\sMdPUqj.exe
  2⤵
  PID:7636
- C:\Windows\System\yWEMdEC.exe
  C:\Windows\System\yWEMdEC.exe
  2⤵
  PID:7684
- C:\Windows\System\XcUKMnH.exe
  C:\Windows\System\XcUKMnH.exe
  2⤵
  PID:7704
- C:\Windows\System\zcEvjbq.exe
  C:\Windows\System\zcEvjbq.exe
  2⤵
  PID:7720
- C:\Windows\System\oOOWOES.exe
  C:\Windows\System\oOOWOES.exe
  2⤵
  PID:7736
- C:\Windows\System\AqApqKG.exe
  C:\Windows\System\AqApqKG.exe
  2⤵
  PID:7752
- C:\Windows\System\wMGswSW.exe
  C:\Windows\System\wMGswSW.exe
  2⤵
  PID:7768
- C:\Windows\System\RUfljzg.exe
  C:\Windows\System\RUfljzg.exe
  2⤵
  PID:7784
- C:\Windows\System\lnLqfJg.exe
  C:\Windows\System\lnLqfJg.exe
  2⤵
  PID:7800
- C:\Windows\System\aAimThA.exe
  C:\Windows\System\aAimThA.exe
  2⤵
  PID:7816
- C:\Windows\System\hmFWuXM.exe
  C:\Windows\System\hmFWuXM.exe
  2⤵
  PID:7832
- C:\Windows\System\vaBEVtq.exe
  C:\Windows\System\vaBEVtq.exe
  2⤵
  PID:7848
- C:\Windows\System\RNYQFYq.exe
  C:\Windows\System\RNYQFYq.exe
  2⤵
  PID:7864
- C:\Windows\System\wNLlTVK.exe
  C:\Windows\System\wNLlTVK.exe
  2⤵
  PID:7880
- C:\Windows\System\vLxmewK.exe
  C:\Windows\System\vLxmewK.exe
  2⤵
  PID:7896
- C:\Windows\System\QSJGEfr.exe
  C:\Windows\System\QSJGEfr.exe
  2⤵
  PID:7912
- C:\Windows\System\AJtOcym.exe
  C:\Windows\System\AJtOcym.exe
  2⤵
  PID:7928
- C:\Windows\System\cCAkCyO.exe
  C:\Windows\System\cCAkCyO.exe
  2⤵
  PID:7944
- C:\Windows\System\nbUNxpE.exe
  C:\Windows\System\nbUNxpE.exe
  2⤵
  PID:7960
- C:\Windows\System\OYzMJqy.exe
  C:\Windows\System\OYzMJqy.exe
  2⤵
  PID:7976
- C:\Windows\System\jFBSzGY.exe
  C:\Windows\System\jFBSzGY.exe
  2⤵
  PID:8008
- C:\Windows\System\dSjSqoD.exe
  C:\Windows\System\dSjSqoD.exe
  2⤵
  PID:8024
- C:\Windows\System\DibeyTj.exe
  C:\Windows\System\DibeyTj.exe
  2⤵
  PID:8040
- C:\Windows\System\HrIEouX.exe
  C:\Windows\System\HrIEouX.exe
  2⤵
  PID:8056
- C:\Windows\System\oQHpZLS.exe
  C:\Windows\System\oQHpZLS.exe
  2⤵
  PID:8072
- C:\Windows\System\FjYteOf.exe
  C:\Windows\System\FjYteOf.exe
  2⤵
  PID:8088
- C:\Windows\System\BjSeLoH.exe
  C:\Windows\System\BjSeLoH.exe
  2⤵
  PID:8104
- C:\Windows\System\rxuGisC.exe
  C:\Windows\System\rxuGisC.exe
  2⤵
  PID:8120
- C:\Windows\System\OpzGiiv.exe
  C:\Windows\System\OpzGiiv.exe
  2⤵
  PID:8140
- C:\Windows\System\Zpfwqde.exe
  C:\Windows\System\Zpfwqde.exe
  2⤵
  PID:8156
- C:\Windows\System\unLCMgC.exe
  C:\Windows\System\unLCMgC.exe
  2⤵
  PID:7296
- C:\Windows\System\lmQPveR.exe
  C:\Windows\System\lmQPveR.exe
  2⤵
  PID:7360
- C:\Windows\System\JmQudhI.exe
  C:\Windows\System\JmQudhI.exe
  2⤵
  PID:7240
- C:\Windows\System\siTgNvR.exe
  C:\Windows\System\siTgNvR.exe
  2⤵
  PID:7244
- C:\Windows\System\aMgGHHw.exe
  C:\Windows\System\aMgGHHw.exe
  2⤵
  PID:7212
- C:\Windows\System\jicqLTS.exe
  C:\Windows\System\jicqLTS.exe
  2⤵
  PID:7272
- C:\Windows\System\aaVqvBm.exe
  C:\Windows\System\aaVqvBm.exe
  2⤵
  PID:7340
- C:\Windows\System\MrhVeYh.exe
  C:\Windows\System\MrhVeYh.exe
  2⤵
  PID:7380
- C:\Windows\System\fcKRcAT.exe
  C:\Windows\System\fcKRcAT.exe
  2⤵
  PID:7464
- C:\Windows\System\VnulGou.exe
  C:\Windows\System\VnulGou.exe
  2⤵
  PID:7528
- C:\Windows\System\tDKFgnR.exe
  C:\Windows\System\tDKFgnR.exe
  2⤵
  PID:7512
- C:\Windows\System\jQrZBcc.exe
  C:\Windows\System\jQrZBcc.exe
  2⤵
  PID:7496
- C:\Windows\System\nhXFgqI.exe
  C:\Windows\System\nhXFgqI.exe
  2⤵
  PID:7480
- C:\Windows\System\srVzEdp.exe
  C:\Windows\System\srVzEdp.exe
  2⤵
  PID:7540
- C:\Windows\System\UsdRTci.exe
  C:\Windows\System\UsdRTci.exe
  2⤵
  PID:7556
- C:\Windows\System\XtIZXCO.exe
  C:\Windows\System\XtIZXCO.exe
  2⤵
  PID:7572
- C:\Windows\System\kuTBNqY.exe
  C:\Windows\System\kuTBNqY.exe
  2⤵
  PID:7612
- C:\Windows\System\EHVbahI.exe
  C:\Windows\System\EHVbahI.exe
  2⤵
  PID:7652
- C:\Windows\System\zrDLHUB.exe
  C:\Windows\System\zrDLHUB.exe
  2⤵
  PID:7596
- C:\Windows\System\rtNZrph.exe
  C:\Windows\System\rtNZrph.exe
  2⤵
  PID:7672
- C:\Windows\System\ipthIDL.exe
  C:\Windows\System\ipthIDL.exe
  2⤵
  PID:7712
- C:\Windows\System\tdnZRse.exe
  C:\Windows\System\tdnZRse.exe
  2⤵
  PID:7780
- C:\Windows\System\isNTlKQ.exe
  C:\Windows\System\isNTlKQ.exe
  2⤵
  PID:7872
- C:\Windows\System\wGyNQve.exe
  C:\Windows\System\wGyNQve.exe
  2⤵
  PID:7936
- C:\Windows\System\ejFTBuo.exe
  C:\Windows\System\ejFTBuo.exe
  2⤵
  PID:7840
- C:\Windows\System\WUgOoss.exe
  C:\Windows\System\WUgOoss.exe
  2⤵
  PID:8052
- C:\Windows\System\GBaQEBA.exe
  C:\Windows\System\GBaQEBA.exe
  2⤵
  PID:8116
- C:\Windows\System\CCrLgUj.exe
  C:\Windows\System\CCrLgUj.exe
  2⤵
  PID:7764
- C:\Windows\System\brIepic.exe
  C:\Windows\System\brIepic.exe
  2⤵
  PID:7956
- C:\Windows\System\CNFKDOz.exe
  C:\Windows\System\CNFKDOz.exe
  2⤵
  PID:8068
- C:\Windows\System\VwvoAVA.exe
  C:\Windows\System\VwvoAVA.exe
  2⤵
  PID:7700
- C:\Windows\System\kXsvZuQ.exe
  C:\Windows\System\kXsvZuQ.exe
  2⤵
  PID:7824
- C:\Windows\System\gdcxFCN.exe
  C:\Windows\System\gdcxFCN.exe
  2⤵
  PID:7920
- C:\Windows\System\HnHGLcW.exe
  C:\Windows\System\HnHGLcW.exe
  2⤵
  PID:7992
- C:\Windows\System\PfiODuq.exe
  C:\Windows\System\PfiODuq.exe
  2⤵
  PID:8064
- C:\Windows\System\ayxdOSP.exe
  C:\Windows\System\ayxdOSP.exe
  2⤵
  PID:8132
- C:\Windows\System\UIAwOGs.exe
  C:\Windows\System\UIAwOGs.exe
  2⤵
  PID:8180
- C:\Windows\System\DKimzHp.exe
  C:\Windows\System\DKimzHp.exe
  2⤵
  PID:7188
- C:\Windows\System\kKyVDMy.exe
  C:\Windows\System\kKyVDMy.exe
  2⤵
  PID:6520
- C:\Windows\System\PbVeRUj.exe
  C:\Windows\System\PbVeRUj.exe
  2⤵
  PID:7228
- C:\Windows\System\IBItRiO.exe
  C:\Windows\System\IBItRiO.exe
  2⤵
  PID:6752
- C:\Windows\System\HfsAiQc.exe
  C:\Windows\System\HfsAiQc.exe
  2⤵
  PID:7328
- C:\Windows\System\hTuJfjP.exe
  C:\Windows\System\hTuJfjP.exe
  2⤵
  PID:7392
- C:\Windows\System\bVsRGME.exe
  C:\Windows\System\bVsRGME.exe
  2⤵
  PID:7372
- C:\Windows\System\LAzNhvt.exe
  C:\Windows\System\LAzNhvt.exe
  2⤵
  PID:7500
- C:\Windows\System\eONifSB.exe
  C:\Windows\System\eONifSB.exe
  2⤵
  PID:7532
- C:\Windows\System\NlapicK.exe
  C:\Windows\System\NlapicK.exe
  2⤵
  PID:7568
- C:\Windows\System\AfHRYTM.exe
  C:\Windows\System\AfHRYTM.exe
  2⤵
  PID:7668
- C:\Windows\System\uQmnXTE.exe
  C:\Windows\System\uQmnXTE.exe
  2⤵
  PID:7908
- C:\Windows\System\WCPVmMy.exe
  C:\Windows\System\WCPVmMy.exe
  2⤵
  PID:7432
- C:\Windows\System\olDrlAu.exe
  C:\Windows\System\olDrlAu.exe
  2⤵
  PID:7548
- C:\Windows\System\AFEAnoq.exe
  C:\Windows\System\AFEAnoq.exe
  2⤵
  PID:7644
- C:\Windows\System\DGPJVOM.exe
  C:\Windows\System\DGPJVOM.exe
  2⤵
  PID:7812
- C:\Windows\System\qVpDCLC.exe
  C:\Windows\System\qVpDCLC.exe
  2⤵
  PID:8112
- C:\Windows\System\TyltmHh.exe
  C:\Windows\System\TyltmHh.exe
  2⤵
  PID:7732
- C:\Windows\System\LqBbkip.exe
  C:\Windows\System\LqBbkip.exe
  2⤵
  PID:7792
- C:\Windows\System\IHGtNGg.exe
  C:\Windows\System\IHGtNGg.exe
  2⤵
  PID:8128
- C:\Windows\System\PBGPgcg.exe
  C:\Windows\System\PBGPgcg.exe
  2⤵
  PID:7288
- C:\Windows\System\rADLQoS.exe
  C:\Windows\System\rADLQoS.exe
  2⤵
  PID:7444
- C:\Windows\System\RBfzHoV.exe
  C:\Windows\System\RBfzHoV.exe
  2⤵
  PID:1232
- C:\Windows\System\FguOoJS.exe
  C:\Windows\System\FguOoJS.exe
  2⤵
  PID:7580
- C:\Windows\System\jOOlWrm.exe
  C:\Windows\System\jOOlWrm.exe
  2⤵
  PID:7972
- C:\Windows\System\bzuXaqw.exe
  C:\Windows\System\bzuXaqw.exe
  2⤵
  PID:7664
- C:\Windows\System\zhkIkuF.exe
  C:\Windows\System\zhkIkuF.exe
  2⤵
  PID:7888
- C:\Windows\System\BaQVyIv.exe
  C:\Windows\System\BaQVyIv.exe
  2⤵
  PID:8176
- C:\Windows\System\VRkLhZf.exe
  C:\Windows\System\VRkLhZf.exe
  2⤵
  PID:7172
- C:\Windows\System\JgVGWLY.exe
  C:\Windows\System\JgVGWLY.exe
  2⤵
  PID:7660
- C:\Windows\System\VMLfgnS.exe
  C:\Windows\System\VMLfgnS.exe
  2⤵
  PID:8036
- C:\Windows\System\jVneZfE.exe
  C:\Windows\System\jVneZfE.exe
  2⤵
  PID:7584
- C:\Windows\System\nMndXLs.exe
  C:\Windows\System\nMndXLs.exe
  2⤵
  PID:7984
- C:\Windows\System\inTapfp.exe
  C:\Windows\System\inTapfp.exe
  2⤵
  PID:4908
- C:\Windows\System\prXtkhk.exe
  C:\Windows\System\prXtkhk.exe
  2⤵
  PID:7776
- C:\Windows\System\rvzVCTn.exe
  C:\Windows\System\rvzVCTn.exe
  2⤵
  PID:7484
- C:\Windows\System\ldznroP.exe
  C:\Windows\System\ldznroP.exe
  2⤵
  PID:7760
- C:\Windows\System\IyzsECq.exe
  C:\Windows\System\IyzsECq.exe
  2⤵
  PID:6620
- C:\Windows\System\zhfIerT.exe
  C:\Windows\System\zhfIerT.exe
  2⤵
  PID:7968
- C:\Windows\System\KaqwtSK.exe
  C:\Windows\System\KaqwtSK.exe
  2⤵
  PID:7224
- C:\Windows\System\MFwaEMs.exe
  C:\Windows\System\MFwaEMs.exe
  2⤵
  PID:7860
- C:\Windows\System\KrjVjzb.exe
  C:\Windows\System\KrjVjzb.exe
  2⤵
  PID:8208
- C:\Windows\System\MQaqAVH.exe
  C:\Windows\System\MQaqAVH.exe
  2⤵
  PID:8224
- C:\Windows\System\ttRHxCM.exe
  C:\Windows\System\ttRHxCM.exe
  2⤵
  PID:8240
- C:\Windows\System\BspXNja.exe
  C:\Windows\System\BspXNja.exe
  2⤵
  PID:8272
- C:\Windows\System\rwplJUB.exe
  C:\Windows\System\rwplJUB.exe
  2⤵
  PID:8296
- C:\Windows\System\jNhjmup.exe
  C:\Windows\System\jNhjmup.exe
  2⤵
  PID:8312
- C:\Windows\System\SGCiWxG.exe
  C:\Windows\System\SGCiWxG.exe
  2⤵
  PID:8328
- C:\Windows\System\BuaEOxn.exe
  C:\Windows\System\BuaEOxn.exe
  2⤵
  PID:8344
- C:\Windows\System\DrrrwQT.exe
  C:\Windows\System\DrrrwQT.exe
  2⤵
  PID:8360
- C:\Windows\System\fgtlZpF.exe
  C:\Windows\System\fgtlZpF.exe
  2⤵
  PID:8376
- C:\Windows\System\fCvdKHJ.exe
  C:\Windows\System\fCvdKHJ.exe
  2⤵
  PID:8392
- C:\Windows\System\bEmRotD.exe
  C:\Windows\System\bEmRotD.exe
  2⤵
  PID:8408
- C:\Windows\System\PVrurzf.exe
  C:\Windows\System\PVrurzf.exe
  2⤵
  PID:8428
- C:\Windows\System\gsYxxGf.exe
  C:\Windows\System\gsYxxGf.exe
  2⤵
  PID:8444
- C:\Windows\System\oGMhZfk.exe
  C:\Windows\System\oGMhZfk.exe
  2⤵
  PID:8460
- C:\Windows\System\zTVjRgv.exe
  C:\Windows\System\zTVjRgv.exe
  2⤵
  PID:8476
- C:\Windows\System\ZpLhDRj.exe
  C:\Windows\System\ZpLhDRj.exe
  2⤵
  PID:8492
- C:\Windows\System\CHqAchi.exe
  C:\Windows\System\CHqAchi.exe
  2⤵
  PID:8508
- C:\Windows\System\hAaUyqZ.exe
  C:\Windows\System\hAaUyqZ.exe
  2⤵
  PID:8524
- C:\Windows\System\nXBbekv.exe
  C:\Windows\System\nXBbekv.exe
  2⤵
  PID:8540
- C:\Windows\System\fuvkVGG.exe
  C:\Windows\System\fuvkVGG.exe
  2⤵
  PID:8556
- C:\Windows\System\kKxmXhN.exe
  C:\Windows\System\kKxmXhN.exe
  2⤵
  PID:8572
- C:\Windows\System\FxJpBwz.exe
  C:\Windows\System\FxJpBwz.exe
  2⤵
  PID:8588
- C:\Windows\System\ycborsB.exe
  C:\Windows\System\ycborsB.exe
  2⤵
  PID:8604
- C:\Windows\System\PAfiOwo.exe
  C:\Windows\System\PAfiOwo.exe
  2⤵
  PID:8628
- C:\Windows\System\iiHFKdT.exe
  C:\Windows\System\iiHFKdT.exe
  2⤵
  PID:8644
- C:\Windows\System\ZKUTugD.exe
  C:\Windows\System\ZKUTugD.exe
  2⤵
  PID:8660
- C:\Windows\System\YAhhqYu.exe
  C:\Windows\System\YAhhqYu.exe
  2⤵
  PID:8676
- C:\Windows\System\DhwUjiK.exe
  C:\Windows\System\DhwUjiK.exe
  2⤵
  PID:8692
- C:\Windows\System\WSkwzPY.exe
  C:\Windows\System\WSkwzPY.exe
  2⤵
  PID:8708
- C:\Windows\System\ogPLNrt.exe
  C:\Windows\System\ogPLNrt.exe
  2⤵
  PID:8724
- C:\Windows\System\yrPzCkM.exe
  C:\Windows\System\yrPzCkM.exe
  2⤵
  PID:8740
- C:\Windows\System\caBhBaE.exe
  C:\Windows\System\caBhBaE.exe
  2⤵
  PID:8756
- C:\Windows\System\JTzYHLY.exe
  C:\Windows\System\JTzYHLY.exe
  2⤵
  PID:8772
- C:\Windows\System\izVtqfl.exe
  C:\Windows\System\izVtqfl.exe
  2⤵
  PID:8788
- C:\Windows\System\rMJuKEM.exe
  C:\Windows\System\rMJuKEM.exe
  2⤵
  PID:8804
- C:\Windows\System\xoUHBLv.exe
  C:\Windows\System\xoUHBLv.exe
  2⤵
  PID:8820
- C:\Windows\System\ZGHxUfT.exe
  C:\Windows\System\ZGHxUfT.exe
  2⤵
  PID:8836
- C:\Windows\System\aPKPkOB.exe
  C:\Windows\System\aPKPkOB.exe
  2⤵
  PID:8852
- C:\Windows\System\ByZXLGS.exe
  C:\Windows\System\ByZXLGS.exe
  2⤵
  PID:8868
- C:\Windows\System\cpuduyz.exe
  C:\Windows\System\cpuduyz.exe
  2⤵
  PID:8884
- C:\Windows\System\MnwzQMS.exe
  C:\Windows\System\MnwzQMS.exe
  2⤵
  PID:8900
- C:\Windows\System\rbXJrSn.exe
  C:\Windows\System\rbXJrSn.exe
  2⤵
  PID:8916
- C:\Windows\System\irwwXlQ.exe
  C:\Windows\System\irwwXlQ.exe
  2⤵
  PID:8932
- C:\Windows\System\XUCpHDf.exe
  C:\Windows\System\XUCpHDf.exe
  2⤵
  PID:8948
- C:\Windows\System\ynZpkaP.exe
  C:\Windows\System\ynZpkaP.exe
  2⤵
  PID:8964
- C:\Windows\System\QCTofxb.exe
  C:\Windows\System\QCTofxb.exe
  2⤵
  PID:8980
- C:\Windows\System\heRhGov.exe
  C:\Windows\System\heRhGov.exe
  2⤵
  PID:8996
- C:\Windows\System\pqyHLBk.exe
  C:\Windows\System\pqyHLBk.exe
  2⤵
  PID:9012
- C:\Windows\System\cZEjYKe.exe
  C:\Windows\System\cZEjYKe.exe
  2⤵
  PID:9028
- C:\Windows\System\pcjQOBN.exe
  C:\Windows\System\pcjQOBN.exe
  2⤵
  PID:9044
- C:\Windows\System\RqNCwXX.exe
  C:\Windows\System\RqNCwXX.exe
  2⤵
  PID:9060
- C:\Windows\System\qUMDmqE.exe
  C:\Windows\System\qUMDmqE.exe
  2⤵
  PID:9076
- C:\Windows\System\vCzluQY.exe
  C:\Windows\System\vCzluQY.exe
  2⤵
  PID:9092
- C:\Windows\System\rHCDdzy.exe
  C:\Windows\System\rHCDdzy.exe
  2⤵
  PID:9108
- C:\Windows\System\MyxzLVO.exe
  C:\Windows\System\MyxzLVO.exe
  2⤵
  PID:9124
- C:\Windows\System\hBygkQG.exe
  C:\Windows\System\hBygkQG.exe
  2⤵
  PID:9152
- C:\Windows\System\upBfQyI.exe
  C:\Windows\System\upBfQyI.exe
  2⤵
  PID:9168
- C:\Windows\System\dlLYhbQ.exe
  C:\Windows\System\dlLYhbQ.exe
  2⤵
  PID:9184
- C:\Windows\System\AssHGgX.exe
  C:\Windows\System\AssHGgX.exe
  2⤵
  PID:9200
- C:\Windows\System\IElTUeH.exe
  C:\Windows\System\IElTUeH.exe
  2⤵
  PID:7448
- C:\Windows\System\lRMrELZ.exe
  C:\Windows\System\lRMrELZ.exe
  2⤵
  PID:8152
- C:\Windows\System\tgloQZv.exe
  C:\Windows\System\tgloQZv.exe
  2⤵
  PID:8248
- C:\Windows\System\VLyysBY.exe
  C:\Windows\System\VLyysBY.exe
  2⤵
  PID:8268
- C:\Windows\System\HSecBFG.exe
  C:\Windows\System\HSecBFG.exe
  2⤵
  PID:8204
- C:\Windows\System\cctioPb.exe
  C:\Windows\System\cctioPb.exe
  2⤵
  PID:8336
- C:\Windows\System\scmZxyA.exe
  C:\Windows\System\scmZxyA.exe
  2⤵
  PID:8280
- C:\Windows\System\mSqRmdI.exe
  C:\Windows\System\mSqRmdI.exe
  2⤵
  PID:8368
- C:\Windows\System\ewdknJX.exe
  C:\Windows\System\ewdknJX.exe
  2⤵
  PID:8372
- C:\Windows\System\FovqkQO.exe
  C:\Windows\System\FovqkQO.exe
  2⤵
  PID:8504
- C:\Windows\System\dHzdxLj.exe
  C:\Windows\System\dHzdxLj.exe
  2⤵
  PID:8568
- C:\Windows\System\aqwHywh.exe
  C:\Windows\System\aqwHywh.exe
  2⤵
  PID:8384
- C:\Windows\System\vGHsFhR.exe
  C:\Windows\System\vGHsFhR.exe
  2⤵
  PID:8420
- C:\Windows\System\KEckTPQ.exe
  C:\Windows\System\KEckTPQ.exe
  2⤵
  PID:8700
- C:\Windows\System\yMbOOuk.exe
  C:\Windows\System\yMbOOuk.exe
  2⤵
  PID:8768
- C:\Windows\System\sislRyk.exe
  C:\Windows\System\sislRyk.exe
  2⤵
  PID:8612
- C:\Windows\System\GYoUiXf.exe
  C:\Windows\System\GYoUiXf.exe
  2⤵
  PID:8624
- C:\Windows\System\wNnzlho.exe
  C:\Windows\System\wNnzlho.exe
  2⤵
  PID:8520
- C:\Windows\System\JzNfCrP.exe
  C:\Windows\System\JzNfCrP.exe
  2⤵
  PID:8656
- C:\Windows\System\tBzdDDg.exe
  C:\Windows\System\tBzdDDg.exe
  2⤵
  PID:8752
- C:\Windows\System\AHHQzfo.exe
  C:\Windows\System\AHHQzfo.exe
  2⤵
  PID:8816
- C:\Windows\System\jwaThrj.exe
  C:\Windows\System\jwaThrj.exe
  2⤵
  PID:8892
- C:\Windows\System\teeDfUd.exe
  C:\Windows\System\teeDfUd.exe
  2⤵
  PID:8956
- C:\Windows\System\HIsHSkn.exe
  C:\Windows\System\HIsHSkn.exe
  2⤵
  PID:9024
- C:\Windows\System\RJKnjUa.exe
  C:\Windows\System\RJKnjUa.exe
  2⤵
  PID:9116
- C:\Windows\System\zwYeTFn.exe
  C:\Windows\System\zwYeTFn.exe
  2⤵
  PID:9004
- C:\Windows\System\lkWYdBl.exe
  C:\Windows\System\lkWYdBl.exe
  2⤵
  PID:8976
- C:\Windows\System\FFuOiex.exe
  C:\Windows\System\FFuOiex.exe
  2⤵
  PID:9104
- C:\Windows\System\CXxViDR.exe
  C:\Windows\System\CXxViDR.exe
  2⤵
  PID:8880
- C:\Windows\System\ViZvhNd.exe
  C:\Windows\System\ViZvhNd.exe
  2⤵
  PID:8220
- C:\Windows\System\DlgBqGE.exe
  C:\Windows\System\DlgBqGE.exe
  2⤵
  PID:9036
- C:\Windows\System\dVzAEDT.exe
  C:\Windows\System\dVzAEDT.exe
  2⤵
  PID:9176
- C:\Windows\System\eDkQDfN.exe
  C:\Windows\System\eDkQDfN.exe
  2⤵
  PID:9208
- C:\Windows\System\ayXnZfJ.exe
  C:\Windows\System\ayXnZfJ.exe
  2⤵
  PID:8308
- C:\Windows\System\xsWPCJH.exe
  C:\Windows\System\xsWPCJH.exe
  2⤵
  PID:8324
- C:\Windows\System\sWoFXEQ.exe
  C:\Windows\System\sWoFXEQ.exe
  2⤵
  PID:8636
- C:\Windows\System\vAEuqnh.exe
  C:\Windows\System\vAEuqnh.exe
  2⤵
  PID:8424
- C:\Windows\System\VTdNvHc.exe
  C:\Windows\System\VTdNvHc.exe
  2⤵
  PID:8416
- C:\Windows\System\LOPniIw.exe
  C:\Windows\System\LOPniIw.exe
  2⤵
  PID:8100
- C:\Windows\System\PmNkIbl.exe
  C:\Windows\System\PmNkIbl.exe
  2⤵
  PID:8736
- C:\Windows\System\VyIkdvU.exe
  C:\Windows\System\VyIkdvU.exe
  2⤵
  PID:8552
- C:\Windows\System\sGoeMQU.exe
  C:\Windows\System\sGoeMQU.exe
  2⤵
  PID:8720
- C:\Windows\System\aFNgUhy.exe
  C:\Windows\System\aFNgUhy.exe
  2⤵
  PID:8988
- C:\Windows\System\dyMWPhG.exe
  C:\Windows\System\dyMWPhG.exe
  2⤵
  PID:8580
- C:\Windows\System\wNgErBx.exe
  C:\Windows\System\wNgErBx.exe
  2⤵
  PID:8620
- C:\Windows\System\JmAFpZW.exe
  C:\Windows\System\JmAFpZW.exe
  2⤵
  PID:8356
- C:\Windows\System\DbTVinp.exe
  C:\Windows\System\DbTVinp.exe
  2⤵
  PID:9084
- C:\Windows\System\FDTsjBT.exe
  C:\Windows\System\FDTsjBT.exe
  2⤵
  PID:9100
- C:\Windows\System\IOEjBXB.exe
  C:\Windows\System\IOEjBXB.exe
  2⤵
  PID:8216
- C:\Windows\System\MrizASO.exe
  C:\Windows\System\MrizASO.exe
  2⤵
  PID:8264
- C:\Windows\System\PZYBTAr.exe
  C:\Windows\System\PZYBTAr.exe
  2⤵
  PID:8600
- C:\Windows\System\osvEmms.exe
  C:\Windows\System\osvEmms.exe
  2⤵
  PID:9180
- C:\Windows\System\KLuWKPT.exe
  C:\Windows\System\KLuWKPT.exe
  2⤵
  PID:8320
- C:\Windows\System\pbebqya.exe
  C:\Windows\System\pbebqya.exe
  2⤵
  PID:8796
- C:\Windows\System\TBsfHXo.exe
  C:\Windows\System\TBsfHXo.exe
  2⤵
  PID:8484
- C:\Windows\System\hXaKlkr.exe
  C:\Windows\System\hXaKlkr.exe
  2⤵
  PID:8488
- C:\Windows\System\YAjLqfE.exe
  C:\Windows\System\YAjLqfE.exe
  2⤵
  PID:9040
- C:\Windows\System\sONwkjb.exe
  C:\Windows\System\sONwkjb.exe
  2⤵
  PID:9192
- C:\Windows\System\fKSjemH.exe
  C:\Windows\System\fKSjemH.exe
  2⤵
  PID:8584
- C:\Windows\System\KumFSzU.exe
  C:\Windows\System\KumFSzU.exe
  2⤵
  PID:8716
- C:\Windows\System\vkaghRn.exe
  C:\Windows\System\vkaghRn.exe
  2⤵
  PID:8940
- C:\Windows\System\nLQwiNA.exe
  C:\Windows\System\nLQwiNA.exe
  2⤵
  PID:8436
- C:\Windows\System\seGwrQu.exe
  C:\Windows\System\seGwrQu.exe
  2⤵
  PID:7488
- C:\Windows\System\LoGlDyB.exe
  C:\Windows\System\LoGlDyB.exe
  2⤵
  PID:8912
- C:\Windows\System\qSHKITJ.exe
  C:\Windows\System\qSHKITJ.exe
  2⤵
  PID:8200
- C:\Windows\System\oYduhsd.exe
  C:\Windows\System\oYduhsd.exe
  2⤵
  PID:9148
- C:\Windows\System\EbuHsDy.exe
  C:\Windows\System\EbuHsDy.exe
  2⤵
  PID:9224
- C:\Windows\System\rvuBzXR.exe
  C:\Windows\System\rvuBzXR.exe
  2⤵
  PID:9240
- C:\Windows\System\cbisQOR.exe
  C:\Windows\System\cbisQOR.exe
  2⤵
  PID:9256
- C:\Windows\System\UlNkRka.exe
  C:\Windows\System\UlNkRka.exe
  2⤵
  PID:9272
- C:\Windows\System\wPdbEoh.exe
  C:\Windows\System\wPdbEoh.exe
  2⤵
  PID:9288
- C:\Windows\System\ORQlIyT.exe
  C:\Windows\System\ORQlIyT.exe
  2⤵
  PID:9304
- C:\Windows\System\msoyVkc.exe
  C:\Windows\System\msoyVkc.exe
  2⤵
  PID:9332
- C:\Windows\System\ZyXJqbE.exe
  C:\Windows\System\ZyXJqbE.exe
  2⤵
  PID:9348
- C:\Windows\System\oydfKXm.exe
  C:\Windows\System\oydfKXm.exe
  2⤵
  PID:9364
- C:\Windows\System\KttbXcM.exe
  C:\Windows\System\KttbXcM.exe
  2⤵
  PID:9432
- C:\Windows\System\qffYMJe.exe
  C:\Windows\System\qffYMJe.exe
  2⤵
  PID:9452
- C:\Windows\System\IdUBzjd.exe
  C:\Windows\System\IdUBzjd.exe
  2⤵
  PID:9468
- C:\Windows\System\vofYuhP.exe
  C:\Windows\System\vofYuhP.exe
  2⤵
  PID:9484
- C:\Windows\System\pQkokdE.exe
  C:\Windows\System\pQkokdE.exe
  2⤵
  PID:9584
- C:\Windows\System\WiHqZvj.exe
  C:\Windows\System\WiHqZvj.exe
  2⤵
  PID:9600
- C:\Windows\System\qJpZFZO.exe
  C:\Windows\System\qJpZFZO.exe
  2⤵
  PID:9616
- C:\Windows\System\CkOSFFY.exe
  C:\Windows\System\CkOSFFY.exe
  2⤵
  PID:9632
- C:\Windows\System\BZYDcbG.exe
  C:\Windows\System\BZYDcbG.exe
  2⤵
  PID:9648
- C:\Windows\System\LakRRlI.exe
  C:\Windows\System\LakRRlI.exe
  2⤵
  PID:9664
- C:\Windows\System\EOZVTIy.exe
  C:\Windows\System\EOZVTIy.exe
  2⤵
  PID:9680
- C:\Windows\System\CjtWHXq.exe
  C:\Windows\System\CjtWHXq.exe
  2⤵
  PID:9696
- C:\Windows\System\bvgoQSq.exe
  C:\Windows\System\bvgoQSq.exe
  2⤵
  PID:9712
- C:\Windows\System\wCjJRPT.exe
  C:\Windows\System\wCjJRPT.exe
  2⤵
  PID:9728
- C:\Windows\System\UOlvbyK.exe
  C:\Windows\System\UOlvbyK.exe
  2⤵
  PID:9744
- C:\Windows\System\tIYNANF.exe
  C:\Windows\System\tIYNANF.exe
  2⤵
  PID:9760
- C:\Windows\System\DhwReNO.exe
  C:\Windows\System\DhwReNO.exe
  2⤵
  PID:9776
- C:\Windows\System\FuHiYlE.exe
  C:\Windows\System\FuHiYlE.exe
  2⤵
  PID:9792
- C:\Windows\System\AYkmKQe.exe
  C:\Windows\System\AYkmKQe.exe
  2⤵
  PID:9808
- C:\Windows\System\UopLaWe.exe
  C:\Windows\System\UopLaWe.exe
  2⤵
  PID:9824
- C:\Windows\System\hoWFPir.exe
  C:\Windows\System\hoWFPir.exe
  2⤵
  PID:9840
- C:\Windows\System\fsmfmBy.exe
  C:\Windows\System\fsmfmBy.exe
  2⤵
  PID:9856
- C:\Windows\System\QFtayJL.exe
  C:\Windows\System\QFtayJL.exe
  2⤵
  PID:9872
- C:\Windows\System\WSrVGPk.exe
  C:\Windows\System\WSrVGPk.exe
  2⤵
  PID:9888
- C:\Windows\System\LYzbpMp.exe
  C:\Windows\System\LYzbpMp.exe
  2⤵
  PID:9904
- C:\Windows\System\eLMCEAF.exe
  C:\Windows\System\eLMCEAF.exe
  2⤵
  PID:9920
- C:\Windows\System\lxSnhCG.exe
  C:\Windows\System\lxSnhCG.exe
  2⤵
  PID:9936
- C:\Windows\System\DnnxBSP.exe
  C:\Windows\System\DnnxBSP.exe
  2⤵
  PID:9952
- C:\Windows\System\AqkyjKQ.exe
  C:\Windows\System\AqkyjKQ.exe
  2⤵
  PID:9968
- C:\Windows\System\tjyoYEz.exe
  C:\Windows\System\tjyoYEz.exe
  2⤵
  PID:9984
- C:\Windows\System\IasXHVu.exe
  C:\Windows\System\IasXHVu.exe
  2⤵
  PID:10000
- C:\Windows\System\wEqWiDN.exe
  C:\Windows\System\wEqWiDN.exe
  2⤵
  PID:10016
- C:\Windows\System\zJuxLBz.exe
  C:\Windows\System\zJuxLBz.exe
  2⤵
  PID:10032
- C:\Windows\System\XSuxLLh.exe
  C:\Windows\System\XSuxLLh.exe
  2⤵
  PID:10048
- C:\Windows\System\VBMpsBh.exe
  C:\Windows\System\VBMpsBh.exe
  2⤵
  PID:10064
- C:\Windows\System\YVihfVJ.exe
  C:\Windows\System\YVihfVJ.exe
  2⤵
  PID:10080
- C:\Windows\System\jsjxREU.exe
  C:\Windows\System\jsjxREU.exe
  2⤵
  PID:10096
- C:\Windows\System\zUIigYE.exe
  C:\Windows\System\zUIigYE.exe
  2⤵
  PID:10112
- C:\Windows\System\BHKdgjK.exe
  C:\Windows\System\BHKdgjK.exe
  2⤵
  PID:10128
- C:\Windows\System\SRZbQyN.exe
  C:\Windows\System\SRZbQyN.exe
  2⤵
  PID:10144
- C:\Windows\System\pDnIBAW.exe
  C:\Windows\System\pDnIBAW.exe
  2⤵
  PID:10160
- C:\Windows\System\LEXObpY.exe
  C:\Windows\System\LEXObpY.exe
  2⤵
  PID:10176
- C:\Windows\System\uiApVNp.exe
  C:\Windows\System\uiApVNp.exe
  2⤵
  PID:10192
- C:\Windows\System\HKgiffz.exe
  C:\Windows\System\HKgiffz.exe
  2⤵
  PID:10208
- C:\Windows\System\oyEpIsE.exe
  C:\Windows\System\oyEpIsE.exe
  2⤵
  PID:10224
- C:\Windows\System\snoQxEO.exe
  C:\Windows\System\snoQxEO.exe
  2⤵
  PID:9232
- C:\Windows\System\FlBDyjm.exe
  C:\Windows\System\FlBDyjm.exe
  2⤵
  PID:8640
- C:\Windows\System\rSiOKgn.exe
  C:\Windows\System\rSiOKgn.exe
  2⤵
  PID:8844
- C:\Windows\System\DuNwdrA.exe
  C:\Windows\System\DuNwdrA.exe
  2⤵
  PID:8352
- C:\Windows\System\aRSqgwe.exe
  C:\Windows\System\aRSqgwe.exe
  2⤵
  PID:9252
- C:\Windows\System\nXbKVcu.exe
  C:\Windows\System\nXbKVcu.exe
  2⤵
  PID:9284
- C:\Windows\System\dOnAJzV.exe
  C:\Windows\System\dOnAJzV.exe
  2⤵
  PID:9324
- C:\Windows\System\xpRpdQC.exe
  C:\Windows\System\xpRpdQC.exe
  2⤵
  PID:9356
- C:\Windows\System\GmXqfxg.exe
  C:\Windows\System\GmXqfxg.exe
  2⤵
  PID:9392
- C:\Windows\System\IjQSmWh.exe
  C:\Windows\System\IjQSmWh.exe
  2⤵
  PID:9384
- C:\Windows\System\TQWNSUN.exe
  C:\Windows\System\TQWNSUN.exe
  2⤵
  PID:9416
- C:\Windows\System\PDZFniS.exe
  C:\Windows\System\PDZFniS.exe
  2⤵
  PID:9476
- C:\Windows\System\dUSHZSO.exe
  C:\Windows\System\dUSHZSO.exe
  2⤵
  PID:9424
- C:\Windows\System\nzlIQJD.exe
  C:\Windows\System\nzlIQJD.exe
  2⤵
  PID:9464
- C:\Windows\System\eUDJraC.exe
  C:\Windows\System\eUDJraC.exe
  2⤵
  PID:9508
- C:\Windows\System\vBqLZCK.exe
  C:\Windows\System\vBqLZCK.exe
  2⤵
  PID:9536
- C:\Windows\System\PKyNucz.exe
  C:\Windows\System\PKyNucz.exe
  2⤵
  PID:9552
- C:\Windows\System\OnKMwra.exe
  C:\Windows\System\OnKMwra.exe
  2⤵
  PID:9564
- C:\Windows\System\TxcekPI.exe
  C:\Windows\System\TxcekPI.exe
  2⤵
  PID:8256
- C:\Windows\System\mEkSaRg.exe
  C:\Windows\System\mEkSaRg.exe
  2⤵
  PID:9612
- C:\Windows\System\eMvCslu.exe
  C:\Windows\System\eMvCslu.exe
  2⤵
  PID:9672
- C:\Windows\System\aHUMJnl.exe
  C:\Windows\System\aHUMJnl.exe
  2⤵
  PID:9736
- C:\Windows\System\OoYKOWa.exe
  C:\Windows\System\OoYKOWa.exe
  2⤵
  PID:9656
- C:\Windows\System\VQsUJIr.exe
  C:\Windows\System\VQsUJIr.exe
  2⤵
  PID:9688
- C:\Windows\System\sIwFHJk.exe
  C:\Windows\System\sIwFHJk.exe
  2⤵
  PID:9832
- C:\Windows\System\lEGfRns.exe
  C:\Windows\System\lEGfRns.exe
  2⤵
  PID:9816
- C:\Windows\System\iecwJvk.exe
  C:\Windows\System\iecwJvk.exe
  2⤵
  PID:9848
- C:\Windows\System\LRMMdFo.exe
  C:\Windows\System\LRMMdFo.exe
  2⤵
  PID:9868
- C:\Windows\System\RipoIif.exe
  C:\Windows\System\RipoIif.exe
  2⤵
  PID:9928
- C:\Windows\System\kFmMcwM.exe
  C:\Windows\System\kFmMcwM.exe
  2⤵
  PID:9884
- C:\Windows\System\UvyNvnT.exe
  C:\Windows\System\UvyNvnT.exe
  2⤵
  PID:9964
- C:\Windows\System\aSoEYsz.exe
  C:\Windows\System\aSoEYsz.exe
  2⤵
  PID:10024
- C:\Windows\System\xKsoWXZ.exe
  C:\Windows\System\xKsoWXZ.exe
  2⤵
  PID:10008
- C:\Windows\System\LDhAmRW.exe
  C:\Windows\System\LDhAmRW.exe
  2⤵
  PID:10012
- C:\Windows\System\ZpncQRM.exe
  C:\Windows\System\ZpncQRM.exe
  2⤵
  PID:10120
- C:\Windows\System\CNRjghM.exe
  C:\Windows\System\CNRjghM.exe
  2⤵
  PID:10156
- C:\Windows\System\fTxNQmH.exe
  C:\Windows\System\fTxNQmH.exe
  2⤵
  PID:10188
- C:\Windows\System\eWQDEKp.exe
  C:\Windows\System\eWQDEKp.exe
  2⤵
  PID:10104
- C:\Windows\System\KRiZqzh.exe
  C:\Windows\System\KRiZqzh.exe
  2⤵
  PID:9072
- C:\Windows\System\uglkkjN.exe
  C:\Windows\System\uglkkjN.exe
  2⤵
  PID:10236
- C:\Windows\System\eEInhIL.exe
  C:\Windows\System\eEInhIL.exe
  2⤵
  PID:10204
- C:\Windows\System\IzWtWUV.exe
  C:\Windows\System\IzWtWUV.exe
  2⤵
  PID:9376
- C:\Windows\System\excVLHU.exe
  C:\Windows\System\excVLHU.exe
  2⤵
  PID:9248
- C:\Windows\System\oxSwdCP.exe
  C:\Windows\System\oxSwdCP.exe
  2⤵
  PID:9404
- C:\Windows\System\gvUwYMP.exe
  C:\Windows\System\gvUwYMP.exe
  2⤵
  PID:9492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AnZltmU.exe

Filesize
1.6MB

MD5
a1aedb1b6f841011ec16f53ace0b2524

SHA1
251662ff8581f01c40e987c485aec4e62264ac49

SHA256
38e736398944d71674c7d6ff9a295305ef154a07817e1b21e6341141b8c16cfd

SHA512
eb1ba35a79d3d0731381d8c2bcf3355dd7168d55c43f08b0924da6549212c4982d9c43505a91c40ca5c02b5e0f6d4a6136e2e363ee49027bc400468fd95c06e5

Download Submit
C:\Windows\system\AxsYyaQ.exe

Filesize
1.6MB

MD5
3575d63c19d49499f0d3cdc62eff98f2

SHA1
929616650fad67cb31c0c93aa4af75d1eeaae3bc

SHA256
b3080d1341c04b59659b90cc11dc93e2c536338a517e236bbd48c88ed96cc31c

SHA512
39d054fa3ad002bf1fd99ce6b310f7a7efd9aae26bbd9e72ac8ab6199432f3d52dd31aac4c325772cb6fe695d9497c2f62a9c028d5ad13262cbac0d667099500

Download Submit
C:\Windows\system\BDSjJpm.exe

Filesize
1.6MB

MD5
232651fa8a8be439558c900494a69102

SHA1
b8606070328e055753c3ba88fbf36f85e8c7d664

SHA256
83e9d9d15141ab8f8b17bd1f2c993d7f1b6c5da29c39494996743459a50e26ac

SHA512
0ef0f337803e343d9e0185a98f4469d5f9b9835c8a8913e1d31389a456109b5ed3af687a4c8dd6ad9eed1009545f4f3ee3aebf86f8f259e1d6ac9b027c17ea7b

Download Submit
C:\Windows\system\BtIaRGk.exe

Filesize
1.6MB

MD5
72a5d41e94b46fc439aa44e575f3132b

SHA1
7aa3acceb70c99958b311b1acccde44c5e21dc48

SHA256
28ff13b3ae47d1305838e6c9456a56c80ff6c1e90cb3d291b442314dcff1881a

SHA512
853932ab646e2282cedabe2500fc9ea0e34276d282ecf2d29ce6ee8887a338a0d7b86b1c3171007201e691408aea035e7cba5f4782a975213c1ad98fdbfb103b

Download Submit
C:\Windows\system\DhFSbyF.exe

Filesize
1.6MB

MD5
49f80dc56df4a06c1b41552cf90f9a3b

SHA1
b00d32c2c943509c189d6052035b4d775523fbe3

SHA256
286ea9ee3a519b5eb844933ba0642ace23cb058f210f04b5ae4e77acf09c4482

SHA512
394ff1354b77ec2fb98dc8976db5367f37c096af8c47f267ef7fc06ee3aab14c6dfb64a2a4597b97b7b6cf943e1a118c840f3af0b56823c43519c7ae72b741e2

Download Submit
C:\Windows\system\DkrHOSU.exe

Filesize
1.6MB

MD5
b15a7e5456baa8ee019ed17e8f0421eb

SHA1
afcd5dd7e50c31244307f01e5d3b7e1532cbf852

SHA256
29c41816ebad4e8d1b7f3d9d73175a8a7550706340036e2c44219ac0c98606eb

SHA512
99bdb6cc5492227c5421f29c5de40903572cc3e07d2367aaa70935fc89ac3d0807280ecc4c1c52cb3aa80a5d3e3754a453ef061cc2197a31151f36c4e2447241

Download Submit
C:\Windows\system\FsVdTgo.exe

Filesize
1.6MB

MD5
c916c745c6d5d5dd7a0cfaf9c9df86ff

SHA1
65745f5b59bff3863ed160448b694c907597e21f

SHA256
2a86c589ef8bba5720a6fd59eec19059e25e6e2b9c1619334e38a98b8640070b

SHA512
31cacdbab43840de828e8b91fdf5957dee872c3e33ca39af9ad1209d1d8c5c701c877ed7f3f510f9e47bac22fd23416419cd4d099d090bc3b3e8234e63f082d5

Download Submit
C:\Windows\system\HSsTtMT.exe

Filesize
1.6MB

MD5
ec6f7f7c3ac3db88ea54fd0e483b4def

SHA1
e4f8c2eb315d1cd1663c6ac69df5fdf22ebff126

SHA256
52e242cffe3b813fe6743c174f2ba6c2b04ce27bf6de515ace54296f3e85c1cb

SHA512
c6af1d1478b5860b7bdaeeec0b636ed67a27b212a9c71aec96a18e29ef0f162945ddf6fd657440c7ce6d25c651432bb5893d776c71e174463ef810f90377c555

Download Submit
C:\Windows\system\HnHlKcS.exe

Filesize
1.6MB

MD5
062bd81723e7164c1678e7913afc6a7e

SHA1
923cd704e4aad72fff976418b9e9068f34b4ec22

SHA256
ec77aad5bd729e214acbd0cabd26215e3298f3db03cf564038f8cd7b0cd5ccf0

SHA512
53c658e4d72e75a0d1b2812dd9ee48d82a19e880576b07a02f66f47cbb36eff557319287b7e29dda5f737e41a91050d40a3528bd46590e859fccc0d291c751ad

Download Submit
C:\Windows\system\JHOYNsv.exe

Filesize
1.6MB

MD5
022f8c695d7a19a6528a45ac9003ce06

SHA1
70b7642d005fdfb6f41159b659e388e78b4cdf9d

SHA256
c1d63e4466c354ee6bf991a2f1273c55778ba6976d4c150a324aaaa2ce85bddc

SHA512
f2a25db621afa22798a97a114543a6c738464184ae01af448ab16e831dd9db71057a49a907830d9afbd578a740bfb590ed4c66a4087bc5d7be30d53a68ed01f9

Download Submit
C:\Windows\system\MVyBXzV.exe

Filesize
1.6MB

MD5
a371149db1a1ae17866888fe13af8d59

SHA1
a6c66974ea5cc805e322d676fa9783496a1e1251

SHA256
0d6b70d3d88a0b42546b5181573c31d94d95eb1315cb7d6b572e7b9966106a55

SHA512
4389836dfbe59da93c3c63b7b5a1b65ce803c665303d8818eed65c11c8b9b96eb788db7c47b63d7d6239f30ea7cecf594e51edf1782e47d479b390bc0eee2d9f

Download Submit
C:\Windows\system\OhnwfxG.exe

Filesize
1.6MB

MD5
235bfa93822ad3bb53376f12261eab6a

SHA1
3c02ab469fe5f25e25145b96dcf7f6ac51fc96e2

SHA256
da6b4d421168fe1a4f183c4afa787122af1f5aaa0a1a9696e8e09a49247f111c

SHA512
298e57d7f4c1cd9bdfb04c4e6a9471cd20def24e869b9719d1be7537376c50ad822dc148d45fbf23bed19927848325944d1bb68c2e6923b3e3970c4513ba8c57

Download Submit
C:\Windows\system\QMvhkFD.exe

Filesize
1.6MB

MD5
4316b90b07798b64feb635d31b3dc579

SHA1
4086d88cf1f15d218202131bf59607e10712f1b5

SHA256
dc21cb28d46ffbba539fca4cce43ff32ee32e05ea45346fadf5181b45d3e0550

SHA512
aeaecdd2930e1b400c63a847bc78d23581e76a9c2630e627f71e94e7720e804e0ec050d7096b332dbdcd29621a4cf85a4a95e4aaf4235f455aeb550b18c7b897

Download Submit
C:\Windows\system\dhVWSYQ.exe

Filesize
1.6MB

MD5
d58a9b4da16b94cb142558ac242ddff9

SHA1
0f3c6e6d3daf4cb33d6f70405dfd9d89ce674d51

SHA256
edde95e87de99882915b595e6a8cccfd3a10a737a6ca1c2831fcf0ddd67fd3f6

SHA512
574001c4c92603190afbebff742a7b05c3138f2ad431ef2a4465b4f5a13842c4f2102b11bd75c609abd49c003dbf40645755cba9e237b069278e04af77b18375

Download Submit
C:\Windows\system\fVunWHy.exe

Filesize
1.6MB

MD5
983bf2c59b5e5247d71c303ec03190f3

SHA1
f3f46dc9edf54f2edd4d86bef3e25f9ee2c3fdd4

SHA256
4bf221f068af01fcc52547d86c03345917ed037f76135494311ec9bd3c88eae0

SHA512
6f19a7f48ce94482f25d7684549c1159c93e5bac8194fc838131860faf370396cc2a7298288d7b66777ae8c39957652ed02a0a3f4fa62ec77da19a21a8a617d5

Download Submit
C:\Windows\system\hqlOXwm.exe

Filesize
1.6MB

MD5
4214a5ff14d05e9e44c66a9a703dcab3

SHA1
36b2ef8fb98da96e13429adb049373921863fcc6

SHA256
734a9b4512cc0d3debbe244cf82c992145d38bd190e16d08366cbe1e8803cc6b

SHA512
b586360ea4fb56af2c7b66263022deb736618be3e62bac4925472c536de8f331517fa3ddf99edb666e8f364ffceb4f573f96f33e31b5102e5763e267ac60612d

Download Submit
C:\Windows\system\kAtHLRc.exe

Filesize
1.6MB

MD5
5467fb371e609098d2654a4d3b5f6790

SHA1
b074f57b58043f9ae44129d20a6670290c0b7bf9

SHA256
20ce2abe1be12707a95a5d20b0317e81de3b8f801e8ab1d1f6105f0dea8198a4

SHA512
732fe8777080a0a61eec032fe091d245b2b18efffa40e07436d1fade7fa3c963cb2be042f1aa6b62d5ba14984371a932a1c035d4f9e2939a24e1dd25da0787a8

Download Submit
C:\Windows\system\kqMBBVN.exe

Filesize
1.6MB

MD5
4959d377a6501833f181f352e4298555

SHA1
43fea5fa0aa18013ee52ca85f8c4e076301aba98

SHA256
d46b526a8ab1cb8dfe588cee1b15d3dbf4fe377d00f5df6cc5e04aca3235e6a1

SHA512
f374662420eb9b36486933ceee60a3950a5d7706224e47d581ba6fc6976df0f29ed5bb65cae15f780654fab49bef2b6a3ae7946cb0e2e750efa72691e762506c

Download Submit
C:\Windows\system\oCthMlE.exe

Filesize
1.6MB

MD5
297fa5df7918ab043763dc4b7ace3d66

SHA1
18415daeaf5429d7a9188348657751bc802a9926

SHA256
cb8a47b75dd30ed6e1bcb322eb3faf3183fca460ec53d77fc34d04025d990329

SHA512
0c9601d2111731ad34039e8e37bf82e1352b87e96b79c1e6dbbf875be2a45a33166d407ade8b92ab88a863da32c49cc074704facda67f0c95a49f639a64b8148

Download Submit
C:\Windows\system\sEasUQu.exe

Filesize
1.6MB

MD5
481ab9fd5a562de388c5c5bfa073f67e

SHA1
5b191d03be948d138ac4f1665de2e8f0a45e88dd

SHA256
54f85f54727c53934d37eac01b49e7b886baac8f725759050b56b77e3038b0d7

SHA512
6307d104abe3389c2183d90bbb7fe4f2492f8509e3efd55b6375b2501499ddebe503a9f4602f0e59f9779fcfc92470b62ecaa044a64188df302e2470788110d6

Download Submit
C:\Windows\system\uuzzKlU.exe

Filesize
1.6MB

MD5
4c2c3902f34a8b7359a1ef55c3e347c1

SHA1
dc77ee741b55503e1e90cef0274bcbf0de7740c5

SHA256
c46e7a3b8b3d10ff28a2476d6e21350fea10bb6a972e938e4bda3fbdb71615a2

SHA512
4cf583490e72104f1b578a0396d96f1e5e2842b8597685322ef14959f5ab391041cf922f5b08e2215411f634cf1890502b3ee88cddc43d6e841a465f57cb6bc8

Download Submit
C:\Windows\system\vzOgfJB.exe

Filesize
1.6MB

MD5
3801f0b7dfbcfa4d52a41b2320cd7ec2

SHA1
5856b5d3700b02e68ef9b1e62f88a2ebd791c92b

SHA256
da31c263f1f642ab1800067b5ce77fbd058792c57b134a3932b12067b2c9b89e

SHA512
6f0a4924e1ea48871f2bac1d6d633e148296619ea889dcb1d06eb066c2550565ba505592d589c1b500d2f5e78b055b64536db5cdc87191c226dadfeac6d2a885

Download Submit
C:\Windows\system\yjporcA.exe

Filesize
1.6MB

MD5
e36fc1f92ff825e73ca186a0c7664e43

SHA1
5e3737b8c11e889c865113884b5ccb8b638adad6

SHA256
5ddd45fdfb85607b65b6a1ef96796a849122fff378ce9f8a27a353895397394d

SHA512
3d39e30ab1f31b6fe4862e4e221a5549cb5df4a2a429c04ec976a65787890cd81e9f14b5bee419837e29fd10b824dc0148a6846c62d057d5ce36032461d4c751

Download Submit
\Windows\system\DYKVroS.exe

Filesize
1.6MB

MD5
21f1a1d1f5ddc16c2e10de18f4ac9d7a

SHA1
a95feead3ed466e5f1c290ea208038298abe6f66

SHA256
b7ef9c101034b32597515287e501fa855ac1887bc858f665ed244e725dde84a5

SHA512
ecc62582a957b1ccb01365444947241059a980c95c4f0bd10b0ebbe6c879c46145ae587c052d3977142c37aadc020b93346c5302f88bc728f53708b2abbe0b15

Download Submit
\Windows\system\EvwvdxR.exe

Filesize
1.6MB

MD5
915a844900e7bb4f74d37f2ed5ba3666

SHA1
cb94f7dee2b508c94ec7df635eeba7a037c40264

SHA256
5d03a6bfecd43e72b291dc26cef11f8100bec35f55cf576de97835a051bb5f35

SHA512
5495946a6f2a24c5f494fd4926e2248ea01bbeb0f95c97248611666c445ac9cd95098dcf36e48fd2d54adaae8cc09b29dd52db923bac8537199b2a3efe9f00c1

Download Submit
\Windows\system\NijzJgB.exe

Filesize
1.6MB

MD5
ff07e35e8a861e8c7cd290aba6f6ba65

SHA1
360c6311fc5128ac8475f0ddaa2d1cc5f3cd8d1d

SHA256
30adaca703ab14fc7f14ad4f205aeb204f766140c785b4fd9fed47a3ff72153d

SHA512
754b6c824b3449285bf9867f4f0cc4cb0399d3a0f81bbe68093755694f088e2d69dce65ede5a2ff2ab519c10cf0596c2b23db659630a126feacc29d2f3fbf7cd

Download Submit
\Windows\system\RosQIPD.exe

Filesize
1.6MB

MD5
1609f3dbfd7a35c2a28f577fd597eb30

SHA1
b4fb465b4570fc1f4daa2bfe907e068207817640

SHA256
db2f22193f0fdf9f90fa72b50bc22a3500243e7be238ea4680b3a625227b32f2

SHA512
af2995d6b5209624021d5b53d7c875df908b0bae979146b4a2b23b707e7c2cd13c26e70f3c89986573ee70799caa5edbe228e042928e93e3c33ab64640cc3689

Download Submit
\Windows\system\VqriQzJ.exe

Filesize
1.6MB

MD5
56a7964e7a5ef32f499455a8890c1f7f

SHA1
b0d18a4bba8bcae5cefd86985373607a8275e5df

SHA256
469256f917e919d4dc57aa66303c58f946e1937530be7fbd0540c4d9d03604d2

SHA512
71e1c461b854173847ce1df2d184148a5aa926eeea084ce3ed188eca23e6621dfe8c7d23c11d9e205a39e1607c0d458aade6db4b434f987c3494db2beaacdfd6

Download Submit
\Windows\system\aFayJpR.exe

Filesize
1.6MB

MD5
27ce0521667d13f7492f53c30bde1066

SHA1
82377dddd21dea44f0a8d2c743e3ff924044bebe

SHA256
4b1e7e000b8fe2ff41fbcb656c67efbb0f3c32bf201e647ecfca20fb4b393f6a

SHA512
1ddca4be1b8531252df9af5d5f42fe7e5bbacc212df6eee19b65430cfa5427cfdd7aa287f9e556ed40663abbec0544b670371b274486b26958966e654cc94530

Download Submit
\Windows\system\mJcywxo.exe

Filesize
1.6MB

MD5
615df2dfd934fa0e303f355769fc921a

SHA1
e0674e63a38fc1cfc0e733b2c4fd8b043a5eaa32

SHA256
30526dc825016244f90c23a812639ec23baadb04dd211c392b1511d70a7903cb

SHA512
84b5c58ca7ebd5b3bf87709d23ae35ac833d0e24e4b3ad9458e26c91f6a4d8976c2b1d6ee5787640708c25c0070a34b737205d9e0981653b7d011cf1147b9ec3

Download Submit
\Windows\system\ndFNcqm.exe

Filesize
1.6MB

MD5
e5be9ea44c46aed09315f781e1673d8b

SHA1
dfbe375e6e53c4ba5f6178863ef964ef6941a7a6

SHA256
a581a9f8477d25a0bcfaf1deea074f45595ac7c7bf17585621d2f26e2b342dc1

SHA512
419d58d917d51d73a80e43ef8a9f9ecbd284ac2592b3c816e98a9a56cc5ea7891106c01b2c74dddb3922955bcd8e0f21165133ca843bacff16edfe512981aa53

Download Submit
\Windows\system\yoKthKB.exe

Filesize
1.6MB

MD5
eea26f8dd74c576b2273633dc610b5ed

SHA1
7a92d5ec09051f866012f25cd4874585bc5a456e

SHA256
c2580e8b5a9bc6f3a0aed5f67620e76904238aa73376318618b61ac4ae0be8de

SHA512
6dc02fba0653fdef22891082178fcf51d9a3742667f485e737fe52c42778d006ce65c4ba404a889e125c4ddbe2828b6644a41b6c815cb4fab7f7dacea0c9edaf

Download Submit
\Windows\system\ytMGcMY.exe

Filesize
1.6MB

MD5
c41d7290a5bbb60d26ab144900665a2f

SHA1
a0467251c0ea465b3d50578aac1a73b211501964

SHA256
6f253435f9b0e4ae7b717b154ac17dcc9e0e74120a75fe4e0738031fa48cd5ef

SHA512
c87df1080219338b417d6ac876e7c61a8dddc377f09a49514645b85f595bdf43d74bf8a2fc54d7cf35d57be13acc1d45c3729dae8532be084c6f5420a00e1989

Download Submit
memory/560-48-0x000000013F780000-0x000000013FB72000-memory.dmp

Filesize
3.9MB

Download
memory/560-367-0x000000013F780000-0x000000013FB72000-memory.dmp

Filesize
3.9MB

Download
memory/1340-4574-0x000000013FD70000-0x0000000140162000-memory.dmp

Filesize
3.9MB

Download
memory/1340-5491-0x000000013FD70000-0x0000000140162000-memory.dmp

Filesize
3.9MB

Download
memory/1340-61-0x000000013FD70000-0x0000000140162000-memory.dmp

Filesize
3.9MB

Download
memory/1640-54-0x000000013FD50000-0x0000000140142000-memory.dmp

Filesize
3.9MB

Download
memory/1640-1306-0x000000013FD50000-0x0000000140142000-memory.dmp

Filesize
3.9MB

Download
memory/2040-37-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/2068-5498-0x000000013FF10000-0x0000000140302000-memory.dmp

Filesize
3.9MB

Download
memory/2068-76-0x000000013FF10000-0x0000000140302000-memory.dmp

Filesize
3.9MB

Download
memory/2324-5488-0x000000013FBF0000-0x000000013FFE2000-memory.dmp

Filesize
3.9MB

Download
memory/2324-79-0x000000013FBF0000-0x000000013FFE2000-memory.dmp

Filesize
3.9MB

Download
memory/2660-41-0x000000013F200000-0x000000013F5F2000-memory.dmp

Filesize
3.9MB

Download
memory/2660-5466-0x000000013F200000-0x000000013F5F2000-memory.dmp

Filesize
3.9MB

Download
memory/2728-106-0x000007FEF5DE0000-0x000007FEF677D000-memory.dmp

Filesize
9.6MB

Download
memory/2728-39-0x000007FEF5DE0000-0x000007FEF677D000-memory.dmp

Filesize
9.6MB

Download
memory/2728-20-0x000007FEF609E000-0x000007FEF609F000-memory.dmp

Filesize
4KB

Download
memory/2728-75-0x000007FEF5DE0000-0x000007FEF677D000-memory.dmp

Filesize
9.6MB

Download
memory/2728-18-0x000000001B720000-0x000000001BA02000-memory.dmp

Filesize
2.9MB

Download
memory/2728-35-0x000007FEF5DE0000-0x000007FEF677D000-memory.dmp

Filesize
9.6MB

Download
memory/2728-28-0x000007FEF5DE0000-0x000007FEF677D000-memory.dmp

Filesize
9.6MB

Download
memory/2728-33-0x000007FEF5DE0000-0x000007FEF677D000-memory.dmp

Filesize
9.6MB

Download
memory/2728-29-0x00000000027A0000-0x00000000027A8000-memory.dmp

Filesize
32KB

Download
memory/2728-95-0x000007FEF5DE0000-0x000007FEF677D000-memory.dmp

Filesize
9.6MB

Download
memory/2796-5494-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2796-93-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2876-96-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2876-78-0x00000000034C0000-0x00000000038B2000-memory.dmp

Filesize
3.9MB

Download
memory/2876-90-0x000000013F320000-0x000000013F712000-memory.dmp

Filesize
3.9MB

Download
memory/2876-63-0x000000013FF10000-0x0000000140302000-memory.dmp

Filesize
3.9MB

Download
memory/2876-12979-0x000000013F5B0000-0x000000013F9A2000-memory.dmp

Filesize
3.9MB

Download
memory/2876-97-0x000000013F5B0000-0x000000013F9A2000-memory.dmp

Filesize
3.9MB

Download
memory/2876-12199-0x000000013F320000-0x000000013F712000-memory.dmp

Filesize
3.9MB

Download
memory/2876-72-0x000000013FA60000-0x000000013FE52000-memory.dmp

Filesize
3.9MB

Download
memory/2876-45-0x00000000034C0000-0x00000000038B2000-memory.dmp

Filesize
3.9MB

Download
memory/2876-59-0x00000000034C0000-0x00000000038B2000-memory.dmp

Filesize
3.9MB

Download
memory/2876-52-0x00000000034C0000-0x00000000038B2000-memory.dmp

Filesize
3.9MB

Download
memory/2876-36-0x00000000034C0000-0x00000000038B2000-memory.dmp

Filesize
3.9MB

Download
memory/2876-40-0x000000013F200000-0x000000013F5F2000-memory.dmp

Filesize
3.9MB

Download
memory/2876-16-0x0000000002F50000-0x0000000003342000-memory.dmp

Filesize
3.9MB

Download
memory/2876-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2876-38-0x000000013FF40000-0x0000000140332000-memory.dmp

Filesize
3.9MB

Download
memory/2876-0-0x000000013FA60000-0x000000013FE52000-memory.dmp

Filesize
3.9MB

Download
memory/2876-104-0x000000013F160000-0x000000013F552000-memory.dmp

Filesize
3.9MB

Download
memory/2900-5492-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2900-17-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2908-19-0x000000013FF40000-0x0000000140332000-memory.dmp

Filesize
3.9MB

Download
memory/2908-74-0x000000013FF40000-0x0000000140332000-memory.dmp

Filesize
3.9MB

Download
memory/2912-5493-0x000000013F320000-0x000000013F712000-memory.dmp

Filesize
3.9MB

Download
memory/2912-98-0x000000013F320000-0x000000013F712000-memory.dmp

Filesize
3.9MB

Download