xmrig | dfac030518ce6c8c6bc9c80432780aaab3ad0e6b2f7e8cbe3273e8082cda9ffb

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 16:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b9b2c2aa11c44e6fb81863d240aef490N.exe
Size

1.7MB
MD5

b9b2c2aa11c44e6fb81863d240aef490
SHA1

e239e67fe14c87ecf86dc039e07445fcae5206ff
SHA256

dfac030518ce6c8c6bc9c80432780aaab3ad0e6b2f7e8cbe3273e8082cda9ffb
SHA512

60601b3afdf1a8462cfc163ac3341bf56f78fdc9147c0b28576376dc9fae1e95ed745e6c2edfb44b61f1b3631a8108d1f77a30d022fbf1b03803f8953430c83e
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTnHzlyPGkd+TKqxx6j0PT:Lz071uv4BPMkFfdk2auTlGGx7

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 23 IoCs

miner

resource	yara_rule
behavioral1/memory/2772-9-0x000000013F310000-0x000000013F702000-memory.dmp	xmrig
behavioral1/memory/2548-313-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	xmrig
behavioral1/memory/2208-326-0x000000013F780000-0x000000013FB72000-memory.dmp	xmrig
behavioral1/memory/1040-335-0x000000013FAF0000-0x000000013FEE2000-memory.dmp	xmrig
behavioral1/memory/2268-333-0x000000013F920000-0x000000013FD12000-memory.dmp	xmrig
behavioral1/memory/2844-331-0x000000013FD30000-0x0000000140122000-memory.dmp	xmrig
behavioral1/memory/2988-329-0x000000013F900000-0x000000013FCF2000-memory.dmp	xmrig
behavioral1/memory/2956-322-0x000000013FD70000-0x0000000140162000-memory.dmp	xmrig
behavioral1/memory/2552-320-0x000000013FED0000-0x00000001402C2000-memory.dmp	xmrig
behavioral1/memory/2524-318-0x000000013F520000-0x000000013F912000-memory.dmp	xmrig
behavioral1/memory/2576-316-0x000000013F070000-0x000000013F462000-memory.dmp	xmrig
behavioral1/memory/2772-4629-0x000000013F310000-0x000000013F702000-memory.dmp	xmrig
behavioral1/memory/2548-4881-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	xmrig
behavioral1/memory/2844-4886-0x000000013FD30000-0x0000000140122000-memory.dmp	xmrig
behavioral1/memory/2524-4889-0x000000013F520000-0x000000013F912000-memory.dmp	xmrig
behavioral1/memory/2208-4890-0x000000013F780000-0x000000013FB72000-memory.dmp	xmrig
behavioral1/memory/2956-4888-0x000000013FD70000-0x0000000140162000-memory.dmp	xmrig
behavioral1/memory/2988-4887-0x000000013F900000-0x000000013FCF2000-memory.dmp	xmrig
behavioral1/memory/2576-4885-0x000000013F070000-0x000000013F462000-memory.dmp	xmrig
behavioral1/memory/2552-4896-0x000000013FED0000-0x00000001402C2000-memory.dmp	xmrig
behavioral1/memory/2700-4893-0x000000013F120000-0x000000013F512000-memory.dmp	xmrig
behavioral1/memory/2268-4913-0x000000013F920000-0x000000013FD12000-memory.dmp	xmrig
behavioral1/memory/1040-4909-0x000000013FAF0000-0x000000013FEE2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2320	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2772	TBAsYnN.exe
2700	MSvHfsu.exe
2548	LgEpSDH.exe
2576	dTlacdy.exe
2524	xmWnJjj.exe
2552	BPalZQP.exe
2956	bsEvGos.exe
2208	STfhglc.exe
2988	JwmsJla.exe
2844	xuPiMyg.exe
2268	zSPkruf.exe
1040	HnimUrH.exe
2112	kNSJhJk.exe
2388	tIoVTYo.exe
2972	gQxMsTE.exe
2908	FiwmgIJ.exe
1944	hBExULU.exe
2324	sUzAMJL.exe
2828	xNGRKde.exe
2860	pBReXxs.exe
3012	WYoeklS.exe
1836	AjYzhdG.exe
2736	xAsVMkL.exe
1372	YWDjqXn.exe
2292	xtzNcOc.exe
2360	RBpLQUT.exe
2160	YEUZUHY.exe
2148	VIqiKHn.exe
2920	UaGPtwm.exe
2144	rMPBVWh.exe
2924	cShnCql.exe
2212	OWGNWuq.exe
1804	ZuumURi.exe
980	VQmCuef.exe
1100	ArfdcvJ.exe
2308	KmYOLdE.exe
864	JurWnGm.exe
2088	PBcgGmc.exe
1948	NxFHJco.exe
1492	JKbyfex.exe
2180	JVIyreu.exe
1408	iDAVVQx.exe
1540	zOPgtgf.exe
1076	rMEbbfn.exe
604	OCvBEyb.exe
1900	NXmRfrb.exe
1584	xDgCMQM.exe
544	NnfRoAt.exe
2400	GtQJtOB.exe
1048	wPgkQPV.exe
2424	NPxwnSN.exe
2396	HdMuxjD.exe
2332	ofXhHpZ.exe
1784	WgUcNxu.exe
1932	ibciNVv.exe
2876	KyWnrEZ.exe
1000	xGyGPZa.exe
3024	rMMIlzW.exe
1952	tutsBpn.exe
2604	TFQNZeh.exe
3004	BVSaWZS.exe
2132	StnywxM.exe
1588	YNinQdg.exe
2120	PisDzvm.exe

Loads dropped DLL 64 IoCs

pid	Process
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
2708	b9b2c2aa11c44e6fb81863d240aef490N.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2708-2-0x000000013F330000-0x000000013F722000-memory.dmp	upx
behavioral1/files/0x0009000000012281-5.dat	upx
behavioral1/memory/2772-9-0x000000013F310000-0x000000013F702000-memory.dmp	upx
behavioral1/files/0x0008000000016d46-17.dat	upx
behavioral1/files/0x0007000000016dc7-33.dat	upx
behavioral1/files/0x0008000000016eb4-41.dat	upx
behavioral1/files/0x0006000000018c22-52.dat	upx
behavioral1/files/0x0006000000018c2c-56.dat	upx
behavioral1/files/0x000600000001903f-64.dat	upx
behavioral1/files/0x00060000000190e5-72.dat	upx
behavioral1/files/0x0005000000019230-84.dat	upx
behavioral1/files/0x000500000001928e-106.dat	upx
behavioral1/files/0x000500000001935b-120.dat	upx
behavioral1/files/0x00050000000193ab-136.dat	upx
behavioral1/memory/2548-313-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	upx
behavioral1/memory/2208-326-0x000000013F780000-0x000000013FB72000-memory.dmp	upx
behavioral1/memory/1040-335-0x000000013FAF0000-0x000000013FEE2000-memory.dmp	upx
behavioral1/memory/2268-333-0x000000013F920000-0x000000013FD12000-memory.dmp	upx
behavioral1/memory/2844-331-0x000000013FD30000-0x0000000140122000-memory.dmp	upx
behavioral1/memory/2988-329-0x000000013F900000-0x000000013FCF2000-memory.dmp	upx
behavioral1/memory/2956-322-0x000000013FD70000-0x0000000140162000-memory.dmp	upx
behavioral1/memory/2552-320-0x000000013FED0000-0x00000001402C2000-memory.dmp	upx
behavioral1/memory/2524-318-0x000000013F520000-0x000000013F912000-memory.dmp	upx
behavioral1/memory/2576-316-0x000000013F070000-0x000000013F462000-memory.dmp	upx
behavioral1/files/0x000500000001942a-140.dat	upx
behavioral1/files/0x000500000001939d-132.dat	upx
behavioral1/files/0x0005000000019386-128.dat	upx
behavioral1/files/0x0005000000019372-124.dat	upx
behavioral1/files/0x0005000000019358-117.dat	upx
behavioral1/files/0x0005000000019267-100.dat	upx
behavioral1/files/0x0005000000019297-112.dat	upx
behavioral1/files/0x000500000001926a-104.dat	upx
behavioral1/files/0x000500000001925d-96.dat	upx
behavioral1/files/0x000500000001925a-92.dat	upx
behavioral1/files/0x0005000000019248-88.dat	upx
behavioral1/files/0x0005000000019207-80.dat	upx
behavioral1/files/0x00050000000191da-76.dat	upx
behavioral1/files/0x00060000000190d2-68.dat	upx
behavioral1/files/0x0006000000018f58-60.dat	upx
behavioral1/files/0x0005000000018798-48.dat	upx
behavioral1/files/0x00070000000186c8-44.dat	upx
behavioral1/files/0x0009000000016ddf-36.dat	upx
behavioral1/files/0x0008000000016db0-29.dat	upx
behavioral1/memory/2700-19-0x000000013F120000-0x000000013F512000-memory.dmp	upx
behavioral1/files/0x0007000000004e74-25.dat	upx
behavioral1/memory/2772-4629-0x000000013F310000-0x000000013F702000-memory.dmp	upx
behavioral1/memory/2548-4881-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	upx
behavioral1/memory/2844-4886-0x000000013FD30000-0x0000000140122000-memory.dmp	upx
behavioral1/memory/2524-4889-0x000000013F520000-0x000000013F912000-memory.dmp	upx
behavioral1/memory/2208-4890-0x000000013F780000-0x000000013FB72000-memory.dmp	upx
behavioral1/memory/2956-4888-0x000000013FD70000-0x0000000140162000-memory.dmp	upx
behavioral1/memory/2988-4887-0x000000013F900000-0x000000013FCF2000-memory.dmp	upx
behavioral1/memory/2576-4885-0x000000013F070000-0x000000013F462000-memory.dmp	upx
behavioral1/memory/2552-4896-0x000000013FED0000-0x00000001402C2000-memory.dmp	upx
behavioral1/memory/2700-4893-0x000000013F120000-0x000000013F512000-memory.dmp	upx
behavioral1/memory/2268-4913-0x000000013F920000-0x000000013FD12000-memory.dmp	upx
behavioral1/memory/1040-4909-0x000000013FAF0000-0x000000013FEE2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\zTWjAVx.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\HVYhemw.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\CQPuogV.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\fHoVEft.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\KpjoEaQ.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\ZSiMPMf.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\lvPUEca.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\BtPXjFJ.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\cTOVYxW.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\RxUoiVV.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\KXpprat.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\pBaFLVo.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\nxyxqob.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\IYPgThJ.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\SWLwrgT.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\iJoHEsl.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\adzJlNE.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\EiyEUPC.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\vRtGlAF.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\TPbYdpu.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\KELOqHv.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\JVjUztn.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\DixckiX.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\PvkMKVA.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\QbUWzdC.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\oAgguCD.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\TaYEdCd.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\pHRJtrW.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\qJNfeFJ.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\vHdDphT.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\bgaTzXb.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\FejEQCQ.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\NxFHJco.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\sZPmyLP.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\knevkBj.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\BPNWWNR.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\VKRHCSF.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\YmOVcOq.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\wABOgGo.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\sYuDSpu.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\ULDXeDB.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\anLFgLX.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\KImIQtD.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\QTWJvSe.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\CyFBfFw.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\RNGeNAr.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\TpSbukC.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\MLXzhei.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\ekbgjOq.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\nVadlJA.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\UWkBaXV.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\QbBDRhy.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\bcwBsJQ.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\OypQohx.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\hKGCdvW.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\fqiaeJF.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\PXTvUvR.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\EfySAOo.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\PxFbYtN.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\UwJPVek.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\gUIIsuX.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\HffQCHz.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\Ckjoisb.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe
File created	C:\Windows\System\WQURPQT.exe	b9b2c2aa11c44e6fb81863d240aef490N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2320	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
Token: SeLockMemoryPrivilege	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe
Token: SeDebugPrivilege	2320	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 2320	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	31
PID 2708 wrote to memory of 2320	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	31
PID 2708 wrote to memory of 2320	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	31
PID 2708 wrote to memory of 2772	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	32
PID 2708 wrote to memory of 2772	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	32
PID 2708 wrote to memory of 2772	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	32
PID 2708 wrote to memory of 2700	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	33
PID 2708 wrote to memory of 2700	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	33
PID 2708 wrote to memory of 2700	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	33
PID 2708 wrote to memory of 2548	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	34
PID 2708 wrote to memory of 2548	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	34
PID 2708 wrote to memory of 2548	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	34
PID 2708 wrote to memory of 2576	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	35
PID 2708 wrote to memory of 2576	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	35
PID 2708 wrote to memory of 2576	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	35
PID 2708 wrote to memory of 2524	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	36
PID 2708 wrote to memory of 2524	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	36
PID 2708 wrote to memory of 2524	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	36
PID 2708 wrote to memory of 2552	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	37
PID 2708 wrote to memory of 2552	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	37
PID 2708 wrote to memory of 2552	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	37
PID 2708 wrote to memory of 2956	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	38
PID 2708 wrote to memory of 2956	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	38
PID 2708 wrote to memory of 2956	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	38
PID 2708 wrote to memory of 2208	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	39
PID 2708 wrote to memory of 2208	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	39
PID 2708 wrote to memory of 2208	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	39
PID 2708 wrote to memory of 2988	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	40
PID 2708 wrote to memory of 2988	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	40
PID 2708 wrote to memory of 2988	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	40
PID 2708 wrote to memory of 2844	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	41
PID 2708 wrote to memory of 2844	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	41
PID 2708 wrote to memory of 2844	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	41
PID 2708 wrote to memory of 2268	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	42
PID 2708 wrote to memory of 2268	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	42
PID 2708 wrote to memory of 2268	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	42
PID 2708 wrote to memory of 1040	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	43
PID 2708 wrote to memory of 1040	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	43
PID 2708 wrote to memory of 1040	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	43
PID 2708 wrote to memory of 2112	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	44
PID 2708 wrote to memory of 2112	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	44
PID 2708 wrote to memory of 2112	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	44
PID 2708 wrote to memory of 2388	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	45
PID 2708 wrote to memory of 2388	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	45
PID 2708 wrote to memory of 2388	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	45
PID 2708 wrote to memory of 2972	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	46
PID 2708 wrote to memory of 2972	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	46
PID 2708 wrote to memory of 2972	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	46
PID 2708 wrote to memory of 2908	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	47
PID 2708 wrote to memory of 2908	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	47
PID 2708 wrote to memory of 2908	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	47
PID 2708 wrote to memory of 1944	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	48
PID 2708 wrote to memory of 1944	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	48
PID 2708 wrote to memory of 1944	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	48
PID 2708 wrote to memory of 2324	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	49
PID 2708 wrote to memory of 2324	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	49
PID 2708 wrote to memory of 2324	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	49
PID 2708 wrote to memory of 2828	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	50
PID 2708 wrote to memory of 2828	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	50
PID 2708 wrote to memory of 2828	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	50
PID 2708 wrote to memory of 2860	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	51
PID 2708 wrote to memory of 2860	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	51
PID 2708 wrote to memory of 2860	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	51
PID 2708 wrote to memory of 3012	2708	b9b2c2aa11c44e6fb81863d240aef490N.exe	52

C:\Users\Admin\AppData\Local\Temp\b9b2c2aa11c44e6fb81863d240aef490N.exe
"C:\Users\Admin\AppData\Local\Temp\b9b2c2aa11c44e6fb81863d240aef490N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2320
- C:\Windows\System\TBAsYnN.exe
  C:\Windows\System\TBAsYnN.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\MSvHfsu.exe
  C:\Windows\System\MSvHfsu.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\LgEpSDH.exe
  C:\Windows\System\LgEpSDH.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\dTlacdy.exe
  C:\Windows\System\dTlacdy.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\xmWnJjj.exe
  C:\Windows\System\xmWnJjj.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\BPalZQP.exe
  C:\Windows\System\BPalZQP.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\bsEvGos.exe
  C:\Windows\System\bsEvGos.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\STfhglc.exe
  C:\Windows\System\STfhglc.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\JwmsJla.exe
  C:\Windows\System\JwmsJla.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\xuPiMyg.exe
  C:\Windows\System\xuPiMyg.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\zSPkruf.exe
  C:\Windows\System\zSPkruf.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\HnimUrH.exe
  C:\Windows\System\HnimUrH.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\kNSJhJk.exe
  C:\Windows\System\kNSJhJk.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\tIoVTYo.exe
  C:\Windows\System\tIoVTYo.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\gQxMsTE.exe
  C:\Windows\System\gQxMsTE.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\FiwmgIJ.exe
  C:\Windows\System\FiwmgIJ.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\hBExULU.exe
  C:\Windows\System\hBExULU.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\sUzAMJL.exe
  C:\Windows\System\sUzAMJL.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\xNGRKde.exe
  C:\Windows\System\xNGRKde.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\pBReXxs.exe
  C:\Windows\System\pBReXxs.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\WYoeklS.exe
  C:\Windows\System\WYoeklS.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\AjYzhdG.exe
  C:\Windows\System\AjYzhdG.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\xAsVMkL.exe
  C:\Windows\System\xAsVMkL.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\YWDjqXn.exe
  C:\Windows\System\YWDjqXn.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\xtzNcOc.exe
  C:\Windows\System\xtzNcOc.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\RBpLQUT.exe
  C:\Windows\System\RBpLQUT.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\YEUZUHY.exe
  C:\Windows\System\YEUZUHY.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\VIqiKHn.exe
  C:\Windows\System\VIqiKHn.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\UaGPtwm.exe
  C:\Windows\System\UaGPtwm.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\rMPBVWh.exe
  C:\Windows\System\rMPBVWh.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\cShnCql.exe
  C:\Windows\System\cShnCql.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\OWGNWuq.exe
  C:\Windows\System\OWGNWuq.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\ZuumURi.exe
  C:\Windows\System\ZuumURi.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\VQmCuef.exe
  C:\Windows\System\VQmCuef.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\ArfdcvJ.exe
  C:\Windows\System\ArfdcvJ.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\KmYOLdE.exe
  C:\Windows\System\KmYOLdE.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\JurWnGm.exe
  C:\Windows\System\JurWnGm.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\PBcgGmc.exe
  C:\Windows\System\PBcgGmc.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\NxFHJco.exe
  C:\Windows\System\NxFHJco.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\JKbyfex.exe
  C:\Windows\System\JKbyfex.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\JVIyreu.exe
  C:\Windows\System\JVIyreu.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\iDAVVQx.exe
  C:\Windows\System\iDAVVQx.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\zOPgtgf.exe
  C:\Windows\System\zOPgtgf.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\rMEbbfn.exe
  C:\Windows\System\rMEbbfn.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\OCvBEyb.exe
  C:\Windows\System\OCvBEyb.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\NXmRfrb.exe
  C:\Windows\System\NXmRfrb.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\xDgCMQM.exe
  C:\Windows\System\xDgCMQM.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\NnfRoAt.exe
  C:\Windows\System\NnfRoAt.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\GtQJtOB.exe
  C:\Windows\System\GtQJtOB.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\wPgkQPV.exe
  C:\Windows\System\wPgkQPV.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\NPxwnSN.exe
  C:\Windows\System\NPxwnSN.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\HdMuxjD.exe
  C:\Windows\System\HdMuxjD.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\ofXhHpZ.exe
  C:\Windows\System\ofXhHpZ.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\WgUcNxu.exe
  C:\Windows\System\WgUcNxu.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\ibciNVv.exe
  C:\Windows\System\ibciNVv.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\KyWnrEZ.exe
  C:\Windows\System\KyWnrEZ.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\xGyGPZa.exe
  C:\Windows\System\xGyGPZa.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\rMMIlzW.exe
  C:\Windows\System\rMMIlzW.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\tutsBpn.exe
  C:\Windows\System\tutsBpn.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\TFQNZeh.exe
  C:\Windows\System\TFQNZeh.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\BVSaWZS.exe
  C:\Windows\System\BVSaWZS.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\StnywxM.exe
  C:\Windows\System\StnywxM.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\YNinQdg.exe
  C:\Windows\System\YNinQdg.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\PisDzvm.exe
  C:\Windows\System\PisDzvm.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\KvyswCM.exe
  C:\Windows\System\KvyswCM.exe
  2⤵
  PID:2764
- C:\Windows\System\kiHJBhe.exe
  C:\Windows\System\kiHJBhe.exe
  2⤵
  PID:2704
- C:\Windows\System\urFzKDh.exe
  C:\Windows\System\urFzKDh.exe
  2⤵
  PID:2728
- C:\Windows\System\bFJTfFD.exe
  C:\Windows\System\bFJTfFD.exe
  2⤵
  PID:2724
- C:\Windows\System\REiCzcS.exe
  C:\Windows\System\REiCzcS.exe
  2⤵
  PID:1792
- C:\Windows\System\JnvnJhs.exe
  C:\Windows\System\JnvnJhs.exe
  2⤵
  PID:2152
- C:\Windows\System\EZCSlzq.exe
  C:\Windows\System\EZCSlzq.exe
  2⤵
  PID:3008
- C:\Windows\System\rndThyr.exe
  C:\Windows\System\rndThyr.exe
  2⤵
  PID:824
- C:\Windows\System\AHgOMMH.exe
  C:\Windows\System\AHgOMMH.exe
  2⤵
  PID:568
- C:\Windows\System\wKlCgRI.exe
  C:\Windows\System\wKlCgRI.exe
  2⤵
  PID:1860
- C:\Windows\System\AhBxZJM.exe
  C:\Windows\System\AhBxZJM.exe
  2⤵
  PID:2228
- C:\Windows\System\oQKfGfN.exe
  C:\Windows\System\oQKfGfN.exe
  2⤵
  PID:2224
- C:\Windows\System\evPjfLx.exe
  C:\Windows\System\evPjfLx.exe
  2⤵
  PID:3056
- C:\Windows\System\wbdkZPa.exe
  C:\Windows\System\wbdkZPa.exe
  2⤵
  PID:2792
- C:\Windows\System\ykKfboG.exe
  C:\Windows\System\ykKfboG.exe
  2⤵
  PID:1068
- C:\Windows\System\rxaKtSM.exe
  C:\Windows\System\rxaKtSM.exe
  2⤵
  PID:1752
- C:\Windows\System\IAUXmjL.exe
  C:\Windows\System\IAUXmjL.exe
  2⤵
  PID:2164
- C:\Windows\System\XprUmfj.exe
  C:\Windows\System\XprUmfj.exe
  2⤵
  PID:2304
- C:\Windows\System\wHlLlgx.exe
  C:\Windows\System\wHlLlgx.exe
  2⤵
  PID:708
- C:\Windows\System\ZSiMPMf.exe
  C:\Windows\System\ZSiMPMf.exe
  2⤵
  PID:1920
- C:\Windows\System\EeHbmHP.exe
  C:\Windows\System\EeHbmHP.exe
  2⤵
  PID:2040
- C:\Windows\System\ELXbYfE.exe
  C:\Windows\System\ELXbYfE.exe
  2⤵
  PID:960
- C:\Windows\System\bmVUlCG.exe
  C:\Windows\System\bmVUlCG.exe
  2⤵
  PID:1724
- C:\Windows\System\ELibkad.exe
  C:\Windows\System\ELibkad.exe
  2⤵
  PID:1204
- C:\Windows\System\wedGeSn.exe
  C:\Windows\System\wedGeSn.exe
  2⤵
  PID:2100
- C:\Windows\System\cSdCpZi.exe
  C:\Windows\System\cSdCpZi.exe
  2⤵
  PID:1612
- C:\Windows\System\ABbZfxZ.exe
  C:\Windows\System\ABbZfxZ.exe
  2⤵
  PID:896
- C:\Windows\System\sTpyjSH.exe
  C:\Windows\System\sTpyjSH.exe
  2⤵
  PID:2404
- C:\Windows\System\EdjsEdu.exe
  C:\Windows\System\EdjsEdu.exe
  2⤵
  PID:1980
- C:\Windows\System\DZbPnbh.exe
  C:\Windows\System\DZbPnbh.exe
  2⤵
  PID:2880
- C:\Windows\System\abUEXAf.exe
  C:\Windows\System\abUEXAf.exe
  2⤵
  PID:2368
- C:\Windows\System\ZJgaPNI.exe
  C:\Windows\System\ZJgaPNI.exe
  2⤵
  PID:884
- C:\Windows\System\tzqouAF.exe
  C:\Windows\System\tzqouAF.exe
  2⤵
  PID:2804
- C:\Windows\System\ggFjLgT.exe
  C:\Windows\System\ggFjLgT.exe
  2⤵
  PID:1700
- C:\Windows\System\VKeqfoz.exe
  C:\Windows\System\VKeqfoz.exe
  2⤵
  PID:2536
- C:\Windows\System\mkehtxB.exe
  C:\Windows\System\mkehtxB.exe
  2⤵
  PID:2556
- C:\Windows\System\aysXGmi.exe
  C:\Windows\System\aysXGmi.exe
  2⤵
  PID:2428
- C:\Windows\System\aEnQdLQ.exe
  C:\Windows\System\aEnQdLQ.exe
  2⤵
  PID:2504
- C:\Windows\System\hzricCO.exe
  C:\Windows\System\hzricCO.exe
  2⤵
  PID:2848
- C:\Windows\System\pbBropU.exe
  C:\Windows\System\pbBropU.exe
  2⤵
  PID:2752
- C:\Windows\System\XKrgGHZ.exe
  C:\Windows\System\XKrgGHZ.exe
  2⤵
  PID:2084
- C:\Windows\System\mBTKuuy.exe
  C:\Windows\System\mBTKuuy.exe
  2⤵
  PID:1996
- C:\Windows\System\JwmWHme.exe
  C:\Windows\System\JwmWHme.exe
  2⤵
  PID:2176
- C:\Windows\System\cncntau.exe
  C:\Windows\System\cncntau.exe
  2⤵
  PID:3032
- C:\Windows\System\zIOSqWg.exe
  C:\Windows\System\zIOSqWg.exe
  2⤵
  PID:1896
- C:\Windows\System\UInMipy.exe
  C:\Windows\System\UInMipy.exe
  2⤵
  PID:2064
- C:\Windows\System\UqXDliZ.exe
  C:\Windows\System\UqXDliZ.exe
  2⤵
  PID:844
- C:\Windows\System\rdONueP.exe
  C:\Windows\System\rdONueP.exe
  2⤵
  PID:1104
- C:\Windows\System\acKpqrk.exe
  C:\Windows\System\acKpqrk.exe
  2⤵
  PID:1608
- C:\Windows\System\NRwrizg.exe
  C:\Windows\System\NRwrizg.exe
  2⤵
  PID:2016
- C:\Windows\System\junNdWE.exe
  C:\Windows\System\junNdWE.exe
  2⤵
  PID:1528
- C:\Windows\System\BtuJUSx.exe
  C:\Windows\System\BtuJUSx.exe
  2⤵
  PID:1796
- C:\Windows\System\SzDLmSz.exe
  C:\Windows\System\SzDLmSz.exe
  2⤵
  PID:1892
- C:\Windows\System\IvpCybT.exe
  C:\Windows\System\IvpCybT.exe
  2⤵
  PID:1600
- C:\Windows\System\LSFIvRz.exe
  C:\Windows\System\LSFIvRz.exe
  2⤵
  PID:2684
- C:\Windows\System\wswmwdH.exe
  C:\Windows\System\wswmwdH.exe
  2⤵
  PID:2172
- C:\Windows\System\UQkOtou.exe
  C:\Windows\System\UQkOtou.exe
  2⤵
  PID:2936
- C:\Windows\System\mQcIQTs.exe
  C:\Windows\System\mQcIQTs.exe
  2⤵
  PID:2636
- C:\Windows\System\KupNiaC.exe
  C:\Windows\System\KupNiaC.exe
  2⤵
  PID:2140
- C:\Windows\System\whwgDWG.exe
  C:\Windows\System\whwgDWG.exe
  2⤵
  PID:3052
- C:\Windows\System\TLahknl.exe
  C:\Windows\System\TLahknl.exe
  2⤵
  PID:2616
- C:\Windows\System\qMvAqIw.exe
  C:\Windows\System\qMvAqIw.exe
  2⤵
  PID:2532
- C:\Windows\System\nNzeoHd.exe
  C:\Windows\System\nNzeoHd.exe
  2⤵
  PID:2564
- C:\Windows\System\jPfNlOa.exe
  C:\Windows\System\jPfNlOa.exe
  2⤵
  PID:3080
- C:\Windows\System\PXMYZaJ.exe
  C:\Windows\System\PXMYZaJ.exe
  2⤵
  PID:3096
- C:\Windows\System\aOBpJdq.exe
  C:\Windows\System\aOBpJdq.exe
  2⤵
  PID:3112
- C:\Windows\System\JeTaphz.exe
  C:\Windows\System\JeTaphz.exe
  2⤵
  PID:3128
- C:\Windows\System\wbVcLpq.exe
  C:\Windows\System\wbVcLpq.exe
  2⤵
  PID:3144
- C:\Windows\System\nSYYUnU.exe
  C:\Windows\System\nSYYUnU.exe
  2⤵
  PID:3160
- C:\Windows\System\FtMJOav.exe
  C:\Windows\System\FtMJOav.exe
  2⤵
  PID:3176
- C:\Windows\System\nAQFsjt.exe
  C:\Windows\System\nAQFsjt.exe
  2⤵
  PID:3192
- C:\Windows\System\iMGLduK.exe
  C:\Windows\System\iMGLduK.exe
  2⤵
  PID:3208
- C:\Windows\System\pNXkrzW.exe
  C:\Windows\System\pNXkrzW.exe
  2⤵
  PID:3224
- C:\Windows\System\JpNEiCf.exe
  C:\Windows\System\JpNEiCf.exe
  2⤵
  PID:3240
- C:\Windows\System\eFdXdyZ.exe
  C:\Windows\System\eFdXdyZ.exe
  2⤵
  PID:3260
- C:\Windows\System\dgvLNsW.exe
  C:\Windows\System\dgvLNsW.exe
  2⤵
  PID:3276
- C:\Windows\System\xthGFpZ.exe
  C:\Windows\System\xthGFpZ.exe
  2⤵
  PID:3292
- C:\Windows\System\XlOfRTu.exe
  C:\Windows\System\XlOfRTu.exe
  2⤵
  PID:3308
- C:\Windows\System\oiLmTRV.exe
  C:\Windows\System\oiLmTRV.exe
  2⤵
  PID:3324
- C:\Windows\System\qNLnZnM.exe
  C:\Windows\System\qNLnZnM.exe
  2⤵
  PID:3340
- C:\Windows\System\NdwRhUx.exe
  C:\Windows\System\NdwRhUx.exe
  2⤵
  PID:3356
- C:\Windows\System\Tnamfde.exe
  C:\Windows\System\Tnamfde.exe
  2⤵
  PID:3372
- C:\Windows\System\sqaWiio.exe
  C:\Windows\System\sqaWiio.exe
  2⤵
  PID:3388
- C:\Windows\System\VKaFQvB.exe
  C:\Windows\System\VKaFQvB.exe
  2⤵
  PID:3404
- C:\Windows\System\blsFfff.exe
  C:\Windows\System\blsFfff.exe
  2⤵
  PID:3420
- C:\Windows\System\kiODURf.exe
  C:\Windows\System\kiODURf.exe
  2⤵
  PID:3436
- C:\Windows\System\LTzaMFM.exe
  C:\Windows\System\LTzaMFM.exe
  2⤵
  PID:3452
- C:\Windows\System\lZXahQL.exe
  C:\Windows\System\lZXahQL.exe
  2⤵
  PID:3468
- C:\Windows\System\CxvOZwv.exe
  C:\Windows\System\CxvOZwv.exe
  2⤵
  PID:3484
- C:\Windows\System\sYuDSpu.exe
  C:\Windows\System\sYuDSpu.exe
  2⤵
  PID:3500
- C:\Windows\System\ZMkHlhe.exe
  C:\Windows\System\ZMkHlhe.exe
  2⤵
  PID:3516
- C:\Windows\System\hoJRxht.exe
  C:\Windows\System\hoJRxht.exe
  2⤵
  PID:3532
- C:\Windows\System\BQqWjkJ.exe
  C:\Windows\System\BQqWjkJ.exe
  2⤵
  PID:3548
- C:\Windows\System\aJndJVm.exe
  C:\Windows\System\aJndJVm.exe
  2⤵
  PID:3564
- C:\Windows\System\nSQcefD.exe
  C:\Windows\System\nSQcefD.exe
  2⤵
  PID:3580
- C:\Windows\System\itAxuHm.exe
  C:\Windows\System\itAxuHm.exe
  2⤵
  PID:3596
- C:\Windows\System\ZTzGmQJ.exe
  C:\Windows\System\ZTzGmQJ.exe
  2⤵
  PID:3612
- C:\Windows\System\pBaFLVo.exe
  C:\Windows\System\pBaFLVo.exe
  2⤵
  PID:3628
- C:\Windows\System\DOzMmDh.exe
  C:\Windows\System\DOzMmDh.exe
  2⤵
  PID:3644
- C:\Windows\System\JVUIQtn.exe
  C:\Windows\System\JVUIQtn.exe
  2⤵
  PID:3660
- C:\Windows\System\YmSJxwD.exe
  C:\Windows\System\YmSJxwD.exe
  2⤵
  PID:3676
- C:\Windows\System\feWAVZK.exe
  C:\Windows\System\feWAVZK.exe
  2⤵
  PID:3692
- C:\Windows\System\ccSBYEb.exe
  C:\Windows\System\ccSBYEb.exe
  2⤵
  PID:3708
- C:\Windows\System\bIFGIaQ.exe
  C:\Windows\System\bIFGIaQ.exe
  2⤵
  PID:3724
- C:\Windows\System\EFeJfgV.exe
  C:\Windows\System\EFeJfgV.exe
  2⤵
  PID:3740
- C:\Windows\System\rTAorDs.exe
  C:\Windows\System\rTAorDs.exe
  2⤵
  PID:3756
- C:\Windows\System\feTtxKB.exe
  C:\Windows\System\feTtxKB.exe
  2⤵
  PID:3772
- C:\Windows\System\YEdPEVY.exe
  C:\Windows\System\YEdPEVY.exe
  2⤵
  PID:3788
- C:\Windows\System\wmzQgtA.exe
  C:\Windows\System\wmzQgtA.exe
  2⤵
  PID:3804
- C:\Windows\System\ezMzyfr.exe
  C:\Windows\System\ezMzyfr.exe
  2⤵
  PID:3820
- C:\Windows\System\fQycULU.exe
  C:\Windows\System\fQycULU.exe
  2⤵
  PID:3836
- C:\Windows\System\PXTvUvR.exe
  C:\Windows\System\PXTvUvR.exe
  2⤵
  PID:3852
- C:\Windows\System\hwZoHAx.exe
  C:\Windows\System\hwZoHAx.exe
  2⤵
  PID:3868
- C:\Windows\System\IHxEPRE.exe
  C:\Windows\System\IHxEPRE.exe
  2⤵
  PID:3884
- C:\Windows\System\toDXuJb.exe
  C:\Windows\System\toDXuJb.exe
  2⤵
  PID:3900
- C:\Windows\System\yswovGC.exe
  C:\Windows\System\yswovGC.exe
  2⤵
  PID:3916
- C:\Windows\System\VkZisNm.exe
  C:\Windows\System\VkZisNm.exe
  2⤵
  PID:3932
- C:\Windows\System\dVCggiC.exe
  C:\Windows\System\dVCggiC.exe
  2⤵
  PID:3948
- C:\Windows\System\bRrdjiV.exe
  C:\Windows\System\bRrdjiV.exe
  2⤵
  PID:3964
- C:\Windows\System\ILVnBkN.exe
  C:\Windows\System\ILVnBkN.exe
  2⤵
  PID:3980
- C:\Windows\System\aZCSlHI.exe
  C:\Windows\System\aZCSlHI.exe
  2⤵
  PID:4000
- C:\Windows\System\CArOyDl.exe
  C:\Windows\System\CArOyDl.exe
  2⤵
  PID:4016
- C:\Windows\System\bvMYZht.exe
  C:\Windows\System\bvMYZht.exe
  2⤵
  PID:4032
- C:\Windows\System\dsXfqQF.exe
  C:\Windows\System\dsXfqQF.exe
  2⤵
  PID:4048
- C:\Windows\System\XroGCfh.exe
  C:\Windows\System\XroGCfh.exe
  2⤵
  PID:4064
- C:\Windows\System\ghnJFBv.exe
  C:\Windows\System\ghnJFBv.exe
  2⤵
  PID:4080
- C:\Windows\System\inBIhyh.exe
  C:\Windows\System\inBIhyh.exe
  2⤵
  PID:308
- C:\Windows\System\cuvBXDG.exe
  C:\Windows\System\cuvBXDG.exe
  2⤵
  PID:2420
- C:\Windows\System\sjqofKI.exe
  C:\Windows\System\sjqofKI.exe
  2⤵
  PID:3108
- C:\Windows\System\NXZWlbP.exe
  C:\Windows\System\NXZWlbP.exe
  2⤵
  PID:3136
- C:\Windows\System\CSbDjut.exe
  C:\Windows\System\CSbDjut.exe
  2⤵
  PID:3168
- C:\Windows\System\RatNtGv.exe
  C:\Windows\System\RatNtGv.exe
  2⤵
  PID:3200
- C:\Windows\System\xdoGshn.exe
  C:\Windows\System\xdoGshn.exe
  2⤵
  PID:3284
- C:\Windows\System\cKxvhcR.exe
  C:\Windows\System\cKxvhcR.exe
  2⤵
  PID:3476
- C:\Windows\System\SanoFwn.exe
  C:\Windows\System\SanoFwn.exe
  2⤵
  PID:3524
- C:\Windows\System\CmxYNJZ.exe
  C:\Windows\System\CmxYNJZ.exe
  2⤵
  PID:3560
- C:\Windows\System\KdDdoDY.exe
  C:\Windows\System\KdDdoDY.exe
  2⤵
  PID:3700
- C:\Windows\System\DSrTsmj.exe
  C:\Windows\System\DSrTsmj.exe
  2⤵
  PID:2692
- C:\Windows\System\JiTMluy.exe
  C:\Windows\System\JiTMluy.exe
  2⤵
  PID:3752
- C:\Windows\System\BarbQmd.exe
  C:\Windows\System\BarbQmd.exe
  2⤵
  PID:3784
- C:\Windows\System\VHtjKth.exe
  C:\Windows\System\VHtjKth.exe
  2⤵
  PID:3800
- C:\Windows\System\AGXtNUI.exe
  C:\Windows\System\AGXtNUI.exe
  2⤵
  PID:3876
- C:\Windows\System\gfQoRAX.exe
  C:\Windows\System\gfQoRAX.exe
  2⤵
  PID:1288
- C:\Windows\System\WxZRALM.exe
  C:\Windows\System\WxZRALM.exe
  2⤵
  PID:3428
- C:\Windows\System\ylUetiB.exe
  C:\Windows\System\ylUetiB.exe
  2⤵
  PID:3444
- C:\Windows\System\UhKysFp.exe
  C:\Windows\System\UhKysFp.exe
  2⤵
  PID:588
- C:\Windows\System\lFRUDbz.exe
  C:\Windows\System\lFRUDbz.exe
  2⤵
  PID:3540
- C:\Windows\System\HkypWPp.exe
  C:\Windows\System\HkypWPp.exe
  2⤵
  PID:4088
- C:\Windows\System\WcHyDhk.exe
  C:\Windows\System\WcHyDhk.exe
  2⤵
  PID:1088
- C:\Windows\System\zTWjAVx.exe
  C:\Windows\System\zTWjAVx.exe
  2⤵
  PID:2036
- C:\Windows\System\jjcXUUT.exe
  C:\Windows\System\jjcXUUT.exe
  2⤵
  PID:1064
- C:\Windows\System\oMWBpoF.exe
  C:\Windows\System\oMWBpoF.exe
  2⤵
  PID:2796
- C:\Windows\System\gcpqhiK.exe
  C:\Windows\System\gcpqhiK.exe
  2⤵
  PID:2496
- C:\Windows\System\pXOaxMi.exe
  C:\Windows\System\pXOaxMi.exe
  2⤵
  PID:3152
- C:\Windows\System\MjADuzz.exe
  C:\Windows\System\MjADuzz.exe
  2⤵
  PID:3220
- C:\Windows\System\tYUIIUa.exe
  C:\Windows\System\tYUIIUa.exe
  2⤵
  PID:3256
- C:\Windows\System\IsrhcGI.exe
  C:\Windows\System\IsrhcGI.exe
  2⤵
  PID:2192
- C:\Windows\System\oEPiJku.exe
  C:\Windows\System\oEPiJku.exe
  2⤵
  PID:2336
- C:\Windows\System\zszFFGq.exe
  C:\Windows\System\zszFFGq.exe
  2⤵
  PID:2644
- C:\Windows\System\LOlFpTE.exe
  C:\Windows\System\LOlFpTE.exe
  2⤵
  PID:1140
- C:\Windows\System\LOHfqZT.exe
  C:\Windows\System\LOHfqZT.exe
  2⤵
  PID:3672
- C:\Windows\System\eWlRvpk.exe
  C:\Windows\System\eWlRvpk.exe
  2⤵
  PID:3780
- C:\Windows\System\ySvbXhD.exe
  C:\Windows\System\ySvbXhD.exe
  2⤵
  PID:3844
- C:\Windows\System\PYzyISL.exe
  C:\Windows\System\PYzyISL.exe
  2⤵
  PID:3812
- C:\Windows\System\XrHYKmT.exe
  C:\Windows\System\XrHYKmT.exe
  2⤵
  PID:3892
- C:\Windows\System\guqzarm.exe
  C:\Windows\System\guqzarm.exe
  2⤵
  PID:2676
- C:\Windows\System\KTIvBXG.exe
  C:\Windows\System\KTIvBXG.exe
  2⤵
  PID:4008
- C:\Windows\System\pGyCLKr.exe
  C:\Windows\System\pGyCLKr.exe
  2⤵
  PID:4072
- C:\Windows\System\cGZigCr.exe
  C:\Windows\System\cGZigCr.exe
  2⤵
  PID:3928
- C:\Windows\System\tKLUyel.exe
  C:\Windows\System\tKLUyel.exe
  2⤵
  PID:1340
- C:\Windows\System\XNePbJk.exe
  C:\Windows\System\XNePbJk.exe
  2⤵
  PID:4024
- C:\Windows\System\PbGnZJs.exe
  C:\Windows\System\PbGnZJs.exe
  2⤵
  PID:3996
- C:\Windows\System\eRnYAms.exe
  C:\Windows\System\eRnYAms.exe
  2⤵
  PID:2188
- C:\Windows\System\DmBVzdO.exe
  C:\Windows\System\DmBVzdO.exe
  2⤵
  PID:3320
- C:\Windows\System\NwWgIip.exe
  C:\Windows\System\NwWgIip.exe
  2⤵
  PID:3368
- C:\Windows\System\gNLCdqP.exe
  C:\Windows\System\gNLCdqP.exe
  2⤵
  PID:3396
- C:\Windows\System\gInXauo.exe
  C:\Windows\System\gInXauo.exe
  2⤵
  PID:2480
- C:\Windows\System\HNFXDTb.exe
  C:\Windows\System\HNFXDTb.exe
  2⤵
  PID:3000
- C:\Windows\System\RcZzWLP.exe
  C:\Windows\System\RcZzWLP.exe
  2⤵
  PID:3124
- C:\Windows\System\BSnafud.exe
  C:\Windows\System\BSnafud.exe
  2⤵
  PID:3088
- C:\Windows\System\qlGfSDJ.exe
  C:\Windows\System\qlGfSDJ.exe
  2⤵
  PID:3768
- C:\Windows\System\BGERkxy.exe
  C:\Windows\System\BGERkxy.exe
  2⤵
  PID:3832
- C:\Windows\System\SOMTTLi.exe
  C:\Windows\System\SOMTTLi.exe
  2⤵
  PID:3896
- C:\Windows\System\ZCftVmb.exe
  C:\Windows\System\ZCftVmb.exe
  2⤵
  PID:3460
- C:\Windows\System\XRoyOjw.exe
  C:\Windows\System\XRoyOjw.exe
  2⤵
  PID:2608
- C:\Windows\System\IZfSPwP.exe
  C:\Windows\System\IZfSPwP.exe
  2⤵
  PID:2632
- C:\Windows\System\TQJcgzo.exe
  C:\Windows\System\TQJcgzo.exe
  2⤵
  PID:3496
- C:\Windows\System\tNXqpiu.exe
  C:\Windows\System\tNXqpiu.exe
  2⤵
  PID:1956
- C:\Windows\System\kzcoImY.exe
  C:\Windows\System\kzcoImY.exe
  2⤵
  PID:3944
- C:\Windows\System\eFzXhOA.exe
  C:\Windows\System\eFzXhOA.exe
  2⤵
  PID:2156
- C:\Windows\System\EEyOvqK.exe
  C:\Windows\System\EEyOvqK.exe
  2⤵
  PID:3380
- C:\Windows\System\qVeuLbn.exe
  C:\Windows\System\qVeuLbn.exe
  2⤵
  PID:3416
- C:\Windows\System\ltFDibK.exe
  C:\Windows\System\ltFDibK.exe
  2⤵
  PID:4060
- C:\Windows\System\dxARIAH.exe
  C:\Windows\System\dxARIAH.exe
  2⤵
  PID:3736
- C:\Windows\System\wPiBENI.exe
  C:\Windows\System\wPiBENI.exe
  2⤵
  PID:3912
- C:\Windows\System\VxhFILq.exe
  C:\Windows\System\VxhFILq.exe
  2⤵
  PID:3400
- C:\Windows\System\ZpCDvmp.exe
  C:\Windows\System\ZpCDvmp.exe
  2⤵
  PID:3104
- C:\Windows\System\CVfUUHY.exe
  C:\Windows\System\CVfUUHY.exe
  2⤵
  PID:4092
- C:\Windows\System\UeWymyr.exe
  C:\Windows\System\UeWymyr.exe
  2⤵
  PID:3704
- C:\Windows\System\rECPoSB.exe
  C:\Windows\System\rECPoSB.exe
  2⤵
  PID:3992
- C:\Windows\System\aUKuubb.exe
  C:\Windows\System\aUKuubb.exe
  2⤵
  PID:3988
- C:\Windows\System\KjHQBsP.exe
  C:\Windows\System\KjHQBsP.exe
  2⤵
  PID:3640
- C:\Windows\System\KsXmfxn.exe
  C:\Windows\System\KsXmfxn.exe
  2⤵
  PID:3316
- C:\Windows\System\MjsyOAZ.exe
  C:\Windows\System\MjsyOAZ.exe
  2⤵
  PID:2664
- C:\Windows\System\irgySsq.exe
  C:\Windows\System\irgySsq.exe
  2⤵
  PID:4028
- C:\Windows\System\BCIXXph.exe
  C:\Windows\System\BCIXXph.exe
  2⤵
  PID:3508
- C:\Windows\System\sbaSXmD.exe
  C:\Windows\System\sbaSXmD.exe
  2⤵
  PID:4040
- C:\Windows\System\QbhSOeY.exe
  C:\Windows\System\QbhSOeY.exe
  2⤵
  PID:3976
- C:\Windows\System\GwBXfcb.exe
  C:\Windows\System\GwBXfcb.exe
  2⤵
  PID:3364
- C:\Windows\System\iIBfTbh.exe
  C:\Windows\System\iIBfTbh.exe
  2⤵
  PID:2696
- C:\Windows\System\olGLPmK.exe
  C:\Windows\System\olGLPmK.exe
  2⤵
  PID:3940
- C:\Windows\System\Rhmxdnr.exe
  C:\Windows\System\Rhmxdnr.exe
  2⤵
  PID:4112
- C:\Windows\System\rzFbqbg.exe
  C:\Windows\System\rzFbqbg.exe
  2⤵
  PID:4132
- C:\Windows\System\MfFmyot.exe
  C:\Windows\System\MfFmyot.exe
  2⤵
  PID:4148
- C:\Windows\System\aRaElDh.exe
  C:\Windows\System\aRaElDh.exe
  2⤵
  PID:4164
- C:\Windows\System\bsXPZvo.exe
  C:\Windows\System\bsXPZvo.exe
  2⤵
  PID:4180
- C:\Windows\System\QYTmPAT.exe
  C:\Windows\System\QYTmPAT.exe
  2⤵
  PID:4196
- C:\Windows\System\XiHaYBK.exe
  C:\Windows\System\XiHaYBK.exe
  2⤵
  PID:4212
- C:\Windows\System\UqygzME.exe
  C:\Windows\System\UqygzME.exe
  2⤵
  PID:4236
- C:\Windows\System\RPUKZZw.exe
  C:\Windows\System\RPUKZZw.exe
  2⤵
  PID:4252
- C:\Windows\System\HYSrdyM.exe
  C:\Windows\System\HYSrdyM.exe
  2⤵
  PID:4268
- C:\Windows\System\SdTPiXU.exe
  C:\Windows\System\SdTPiXU.exe
  2⤵
  PID:4284
- C:\Windows\System\fgzgueK.exe
  C:\Windows\System\fgzgueK.exe
  2⤵
  PID:4300
- C:\Windows\System\WrlrIeO.exe
  C:\Windows\System\WrlrIeO.exe
  2⤵
  PID:4316
- C:\Windows\System\tDAQECE.exe
  C:\Windows\System\tDAQECE.exe
  2⤵
  PID:4332
- C:\Windows\System\xgaHhPN.exe
  C:\Windows\System\xgaHhPN.exe
  2⤵
  PID:4360
- C:\Windows\System\LvVJUuu.exe
  C:\Windows\System\LvVJUuu.exe
  2⤵
  PID:4404
- C:\Windows\System\NZlBlIN.exe
  C:\Windows\System\NZlBlIN.exe
  2⤵
  PID:4424
- C:\Windows\System\PxjqrKo.exe
  C:\Windows\System\PxjqrKo.exe
  2⤵
  PID:4440
- C:\Windows\System\PgBKQCJ.exe
  C:\Windows\System\PgBKQCJ.exe
  2⤵
  PID:4456
- C:\Windows\System\kZDtQXL.exe
  C:\Windows\System\kZDtQXL.exe
  2⤵
  PID:4476
- C:\Windows\System\BcGISly.exe
  C:\Windows\System\BcGISly.exe
  2⤵
  PID:4492
- C:\Windows\System\HDsnPJM.exe
  C:\Windows\System\HDsnPJM.exe
  2⤵
  PID:4508
- C:\Windows\System\ItoeFgb.exe
  C:\Windows\System\ItoeFgb.exe
  2⤵
  PID:4524
- C:\Windows\System\oVfdXPj.exe
  C:\Windows\System\oVfdXPj.exe
  2⤵
  PID:4540
- C:\Windows\System\GGuGvSS.exe
  C:\Windows\System\GGuGvSS.exe
  2⤵
  PID:4556
- C:\Windows\System\udpafSl.exe
  C:\Windows\System\udpafSl.exe
  2⤵
  PID:4572
- C:\Windows\System\LSevxZw.exe
  C:\Windows\System\LSevxZw.exe
  2⤵
  PID:4588
- C:\Windows\System\DXdgVZc.exe
  C:\Windows\System\DXdgVZc.exe
  2⤵
  PID:4604
- C:\Windows\System\mVoUVjJ.exe
  C:\Windows\System\mVoUVjJ.exe
  2⤵
  PID:4620
- C:\Windows\System\JCOqCUh.exe
  C:\Windows\System\JCOqCUh.exe
  2⤵
  PID:4636
- C:\Windows\System\sMDHWPT.exe
  C:\Windows\System\sMDHWPT.exe
  2⤵
  PID:4652
- C:\Windows\System\aQhlWPa.exe
  C:\Windows\System\aQhlWPa.exe
  2⤵
  PID:4672
- C:\Windows\System\xuxQNni.exe
  C:\Windows\System\xuxQNni.exe
  2⤵
  PID:4688
- C:\Windows\System\PnlyeMH.exe
  C:\Windows\System\PnlyeMH.exe
  2⤵
  PID:4704
- C:\Windows\System\FWJeEKh.exe
  C:\Windows\System\FWJeEKh.exe
  2⤵
  PID:4720
- C:\Windows\System\pNeQphk.exe
  C:\Windows\System\pNeQphk.exe
  2⤵
  PID:4736
- C:\Windows\System\fxfFIeS.exe
  C:\Windows\System\fxfFIeS.exe
  2⤵
  PID:4844
- C:\Windows\System\LHOycwO.exe
  C:\Windows\System\LHOycwO.exe
  2⤵
  PID:4868
- C:\Windows\System\anmjExp.exe
  C:\Windows\System\anmjExp.exe
  2⤵
  PID:4884
- C:\Windows\System\TubSiPX.exe
  C:\Windows\System\TubSiPX.exe
  2⤵
  PID:5052
- C:\Windows\System\plTsGlW.exe
  C:\Windows\System\plTsGlW.exe
  2⤵
  PID:5072
- C:\Windows\System\aAKIIEQ.exe
  C:\Windows\System\aAKIIEQ.exe
  2⤵
  PID:4308
- C:\Windows\System\XbrDeXz.exe
  C:\Windows\System\XbrDeXz.exe
  2⤵
  PID:4192
- C:\Windows\System\pQIcXaK.exe
  C:\Windows\System\pQIcXaK.exe
  2⤵
  PID:4232
- C:\Windows\System\KwLsndT.exe
  C:\Windows\System\KwLsndT.exe
  2⤵
  PID:4296
- C:\Windows\System\kZLKHBu.exe
  C:\Windows\System\kZLKHBu.exe
  2⤵
  PID:3412
- C:\Windows\System\yzwqmYs.exe
  C:\Windows\System\yzwqmYs.exe
  2⤵
  PID:4156
- C:\Windows\System\HkzyQji.exe
  C:\Windows\System\HkzyQji.exe
  2⤵
  PID:4352
- C:\Windows\System\MimpUJw.exe
  C:\Windows\System\MimpUJw.exe
  2⤵
  PID:4392
- C:\Windows\System\qReluxg.exe
  C:\Windows\System\qReluxg.exe
  2⤵
  PID:4420
- C:\Windows\System\HnkFBmN.exe
  C:\Windows\System\HnkFBmN.exe
  2⤵
  PID:4488
- C:\Windows\System\FKpQVUt.exe
  C:\Windows\System\FKpQVUt.exe
  2⤵
  PID:4472
- C:\Windows\System\qrNYqCY.exe
  C:\Windows\System\qrNYqCY.exe
  2⤵
  PID:4520
- C:\Windows\System\RaVmiEl.exe
  C:\Windows\System\RaVmiEl.exe
  2⤵
  PID:4432
- C:\Windows\System\VFCLVmD.exe
  C:\Windows\System\VFCLVmD.exe
  2⤵
  PID:4628
- C:\Windows\System\reuhhmM.exe
  C:\Windows\System\reuhhmM.exe
  2⤵
  PID:4668
- C:\Windows\System\evlyAfI.exe
  C:\Windows\System\evlyAfI.exe
  2⤵
  PID:4732
- C:\Windows\System\QbBDRhy.exe
  C:\Windows\System\QbBDRhy.exe
  2⤵
  PID:4684
- C:\Windows\System\tkuhlyz.exe
  C:\Windows\System\tkuhlyz.exe
  2⤵
  PID:4748
- C:\Windows\System\aJIInqR.exe
  C:\Windows\System\aJIInqR.exe
  2⤵
  PID:4764
- C:\Windows\System\rwkQUvt.exe
  C:\Windows\System\rwkQUvt.exe
  2⤵
  PID:4780
- C:\Windows\System\dhRUFPQ.exe
  C:\Windows\System\dhRUFPQ.exe
  2⤵
  PID:4808
- C:\Windows\System\ljGGqZV.exe
  C:\Windows\System\ljGGqZV.exe
  2⤵
  PID:4852
- C:\Windows\System\vhqzOHq.exe
  C:\Windows\System\vhqzOHq.exe
  2⤵
  PID:4880
- C:\Windows\System\FNfNplT.exe
  C:\Windows\System\FNfNplT.exe
  2⤵
  PID:2620
- C:\Windows\System\FUZDQKZ.exe
  C:\Windows\System\FUZDQKZ.exe
  2⤵
  PID:4912
- C:\Windows\System\VulBRxb.exe
  C:\Windows\System\VulBRxb.exe
  2⤵
  PID:4928
- C:\Windows\System\EagZfUY.exe
  C:\Windows\System\EagZfUY.exe
  2⤵
  PID:2720
- C:\Windows\System\DETKTNu.exe
  C:\Windows\System\DETKTNu.exe
  2⤵
  PID:5048
- C:\Windows\System\IMVuZvP.exe
  C:\Windows\System\IMVuZvP.exe
  2⤵
  PID:5020
- C:\Windows\System\yunsypm.exe
  C:\Windows\System\yunsypm.exe
  2⤵
  PID:5000
- C:\Windows\System\IjezCkB.exe
  C:\Windows\System\IjezCkB.exe
  2⤵
  PID:4984
- C:\Windows\System\gMYQuuU.exe
  C:\Windows\System\gMYQuuU.exe
  2⤵
  PID:2452
- C:\Windows\System\vSjShFf.exe
  C:\Windows\System\vSjShFf.exe
  2⤵
  PID:5116
- C:\Windows\System\mEvAszg.exe
  C:\Windows\System\mEvAszg.exe
  2⤵
  PID:2968
- C:\Windows\System\tLiYELd.exe
  C:\Windows\System\tLiYELd.exe
  2⤵
  PID:4248
- C:\Windows\System\OdXWZcF.exe
  C:\Windows\System\OdXWZcF.exe
  2⤵
  PID:4344
- C:\Windows\System\SXskPsX.exe
  C:\Windows\System\SXskPsX.exe
  2⤵
  PID:4124
- C:\Windows\System\QrlabQV.exe
  C:\Windows\System\QrlabQV.exe
  2⤵
  PID:4384
- C:\Windows\System\lxtUkhg.exe
  C:\Windows\System\lxtUkhg.exe
  2⤵
  PID:4328
- C:\Windows\System\ZeMCXSi.exe
  C:\Windows\System\ZeMCXSi.exe
  2⤵
  PID:4372
- C:\Windows\System\FQUwjEx.exe
  C:\Windows\System\FQUwjEx.exe
  2⤵
  PID:4452
- C:\Windows\System\GKFpPGh.exe
  C:\Windows\System\GKFpPGh.exe
  2⤵
  PID:4464
- C:\Windows\System\BRKPHAu.exe
  C:\Windows\System\BRKPHAu.exe
  2⤵
  PID:4468
- C:\Windows\System\aLYXjme.exe
  C:\Windows\System\aLYXjme.exe
  2⤵
  PID:4548
- C:\Windows\System\SyoTjYz.exe
  C:\Windows\System\SyoTjYz.exe
  2⤵
  PID:4616
- C:\Windows\System\VJwFCpB.exe
  C:\Windows\System\VJwFCpB.exe
  2⤵
  PID:4772
- C:\Windows\System\SmvCWci.exe
  C:\Windows\System\SmvCWci.exe
  2⤵
  PID:4796
- C:\Windows\System\zPDxZbS.exe
  C:\Windows\System\zPDxZbS.exe
  2⤵
  PID:4792
- C:\Windows\System\rtQdOFO.exe
  C:\Windows\System\rtQdOFO.exe
  2⤵
  PID:4936
- C:\Windows\System\mKDIEJj.exe
  C:\Windows\System\mKDIEJj.exe
  2⤵
  PID:4960
- C:\Windows\System\PxFbYtN.exe
  C:\Windows\System\PxFbYtN.exe
  2⤵
  PID:4968
- C:\Windows\System\RJUmEIH.exe
  C:\Windows\System\RJUmEIH.exe
  2⤵
  PID:5036
- C:\Windows\System\GOYFwDw.exe
  C:\Windows\System\GOYFwDw.exe
  2⤵
  PID:1332
- C:\Windows\System\eYjBkhf.exe
  C:\Windows\System\eYjBkhf.exe
  2⤵
  PID:2352
- C:\Windows\System\YRoxICZ.exe
  C:\Windows\System\YRoxICZ.exe
  2⤵
  PID:5012
- C:\Windows\System\vxQhocF.exe
  C:\Windows\System\vxQhocF.exe
  2⤵
  PID:2588
- C:\Windows\System\mBZyWnq.exe
  C:\Windows\System\mBZyWnq.exe
  2⤵
  PID:5104
- C:\Windows\System\nXDrCqn.exe
  C:\Windows\System\nXDrCqn.exe
  2⤵
  PID:4044
- C:\Windows\System\KHYcbgZ.exe
  C:\Windows\System\KHYcbgZ.exe
  2⤵
  PID:4500
- C:\Windows\System\GuuPydF.exe
  C:\Windows\System\GuuPydF.exe
  2⤵
  PID:4204
- C:\Windows\System\bbVlbti.exe
  C:\Windows\System\bbVlbti.exe
  2⤵
  PID:4280
- C:\Windows\System\WxLpjsn.exe
  C:\Windows\System\WxLpjsn.exe
  2⤵
  PID:4504
- C:\Windows\System\QAMaPSC.exe
  C:\Windows\System\QAMaPSC.exe
  2⤵
  PID:4644
- C:\Windows\System\vUvOkcs.exe
  C:\Windows\System\vUvOkcs.exe
  2⤵
  PID:4264
- C:\Windows\System\tNymPwb.exe
  C:\Windows\System\tNymPwb.exe
  2⤵
  PID:2812
- C:\Windows\System\vowsNJI.exe
  C:\Windows\System\vowsNJI.exe
  2⤵
  PID:4820
- C:\Windows\System\BmeVrbf.exe
  C:\Windows\System\BmeVrbf.exe
  2⤵
  PID:2056
- C:\Windows\System\GoWUyur.exe
  C:\Windows\System\GoWUyur.exe
  2⤵
  PID:4824
- C:\Windows\System\iZGEozL.exe
  C:\Windows\System\iZGEozL.exe
  2⤵
  PID:4920
- C:\Windows\System\cKqMLaJ.exe
  C:\Windows\System\cKqMLaJ.exe
  2⤵
  PID:4664
- C:\Windows\System\feafTQR.exe
  C:\Windows\System\feafTQR.exe
  2⤵
  PID:2312
- C:\Windows\System\JxTkBUT.exe
  C:\Windows\System\JxTkBUT.exe
  2⤵
  PID:2628
- C:\Windows\System\QSIIznz.exe
  C:\Windows\System\QSIIznz.exe
  2⤵
  PID:2656
- C:\Windows\System\rwWaXmt.exe
  C:\Windows\System\rwWaXmt.exe
  2⤵
  PID:2544
- C:\Windows\System\qYsylXm.exe
  C:\Windows\System\qYsylXm.exe
  2⤵
  PID:5124
- C:\Windows\System\xuGKyNs.exe
  C:\Windows\System\xuGKyNs.exe
  2⤵
  PID:5140
- C:\Windows\System\rGBCmlt.exe
  C:\Windows\System\rGBCmlt.exe
  2⤵
  PID:5160
- C:\Windows\System\PHyzYxT.exe
  C:\Windows\System\PHyzYxT.exe
  2⤵
  PID:5216
- C:\Windows\System\OomeWFx.exe
  C:\Windows\System\OomeWFx.exe
  2⤵
  PID:5248
- C:\Windows\System\HpGsfCN.exe
  C:\Windows\System\HpGsfCN.exe
  2⤵
  PID:5276
- C:\Windows\System\XDbJPNj.exe
  C:\Windows\System\XDbJPNj.exe
  2⤵
  PID:5312
- C:\Windows\System\swXCtEg.exe
  C:\Windows\System\swXCtEg.exe
  2⤵
  PID:5332
- C:\Windows\System\IOtRMmu.exe
  C:\Windows\System\IOtRMmu.exe
  2⤵
  PID:5348
- C:\Windows\System\GWYLITR.exe
  C:\Windows\System\GWYLITR.exe
  2⤵
  PID:5364
- C:\Windows\System\zNOcdme.exe
  C:\Windows\System\zNOcdme.exe
  2⤵
  PID:5380
- C:\Windows\System\SfhvAVJ.exe
  C:\Windows\System\SfhvAVJ.exe
  2⤵
  PID:5400
- C:\Windows\System\PGflAAR.exe
  C:\Windows\System\PGflAAR.exe
  2⤵
  PID:5416
- C:\Windows\System\hnUpWGJ.exe
  C:\Windows\System\hnUpWGJ.exe
  2⤵
  PID:5432
- C:\Windows\System\VUTMFdK.exe
  C:\Windows\System\VUTMFdK.exe
  2⤵
  PID:5488
- C:\Windows\System\VjcPpWH.exe
  C:\Windows\System\VjcPpWH.exe
  2⤵
  PID:5504
- C:\Windows\System\xVSSCZm.exe
  C:\Windows\System\xVSSCZm.exe
  2⤵
  PID:5520
- C:\Windows\System\FMdyhtV.exe
  C:\Windows\System\FMdyhtV.exe
  2⤵
  PID:5536
- C:\Windows\System\zOYAJPc.exe
  C:\Windows\System\zOYAJPc.exe
  2⤵
  PID:5556
- C:\Windows\System\KLJjvPW.exe
  C:\Windows\System\KLJjvPW.exe
  2⤵
  PID:5572
- C:\Windows\System\KvIklGy.exe
  C:\Windows\System\KvIklGy.exe
  2⤵
  PID:5588
- C:\Windows\System\SYMCFLb.exe
  C:\Windows\System\SYMCFLb.exe
  2⤵
  PID:5608
- C:\Windows\System\BbzWQOD.exe
  C:\Windows\System\BbzWQOD.exe
  2⤵
  PID:5624
- C:\Windows\System\SvEIfDy.exe
  C:\Windows\System\SvEIfDy.exe
  2⤵
  PID:5640
- C:\Windows\System\PMSLXIu.exe
  C:\Windows\System\PMSLXIu.exe
  2⤵
  PID:5656
- C:\Windows\System\jbcbZgf.exe
  C:\Windows\System\jbcbZgf.exe
  2⤵
  PID:5672
- C:\Windows\System\OuVgnSs.exe
  C:\Windows\System\OuVgnSs.exe
  2⤵
  PID:5692
- C:\Windows\System\VavfjEC.exe
  C:\Windows\System\VavfjEC.exe
  2⤵
  PID:5708
- C:\Windows\System\HffQCHz.exe
  C:\Windows\System\HffQCHz.exe
  2⤵
  PID:5724
- C:\Windows\System\JcvobZF.exe
  C:\Windows\System\JcvobZF.exe
  2⤵
  PID:5780
- C:\Windows\System\jbXpKVK.exe
  C:\Windows\System\jbXpKVK.exe
  2⤵
  PID:5800
- C:\Windows\System\guULkiI.exe
  C:\Windows\System\guULkiI.exe
  2⤵
  PID:5816
- C:\Windows\System\QYNcbZw.exe
  C:\Windows\System\QYNcbZw.exe
  2⤵
  PID:5836
- C:\Windows\System\gnYEYuK.exe
  C:\Windows\System\gnYEYuK.exe
  2⤵
  PID:5856
- C:\Windows\System\XEnzkQc.exe
  C:\Windows\System\XEnzkQc.exe
  2⤵
  PID:5872
- C:\Windows\System\qutaDEo.exe
  C:\Windows\System\qutaDEo.exe
  2⤵
  PID:5888
- C:\Windows\System\JLYQJvR.exe
  C:\Windows\System\JLYQJvR.exe
  2⤵
  PID:5904
- C:\Windows\System\IOkjpBA.exe
  C:\Windows\System\IOkjpBA.exe
  2⤵
  PID:5924
- C:\Windows\System\JqmOAmC.exe
  C:\Windows\System\JqmOAmC.exe
  2⤵
  PID:5940
- C:\Windows\System\pwRdEVF.exe
  C:\Windows\System\pwRdEVF.exe
  2⤵
  PID:5980
- C:\Windows\System\ellKHRU.exe
  C:\Windows\System\ellKHRU.exe
  2⤵
  PID:5996
- C:\Windows\System\KtlPyLm.exe
  C:\Windows\System\KtlPyLm.exe
  2⤵
  PID:6012
- C:\Windows\System\CJHDGvN.exe
  C:\Windows\System\CJHDGvN.exe
  2⤵
  PID:6028
- C:\Windows\System\tBVAWiD.exe
  C:\Windows\System\tBVAWiD.exe
  2⤵
  PID:6044
- C:\Windows\System\PWUJioR.exe
  C:\Windows\System\PWUJioR.exe
  2⤵
  PID:6064
- C:\Windows\System\sPPLfOC.exe
  C:\Windows\System\sPPLfOC.exe
  2⤵
  PID:6084
- C:\Windows\System\WtwYxBB.exe
  C:\Windows\System\WtwYxBB.exe
  2⤵
  PID:6100
- C:\Windows\System\RIpHcga.exe
  C:\Windows\System\RIpHcga.exe
  2⤵
  PID:6116
- C:\Windows\System\HcmVjfo.exe
  C:\Windows\System\HcmVjfo.exe
  2⤵
  PID:6132
- C:\Windows\System\OLLvoDz.exe
  C:\Windows\System\OLLvoDz.exe
  2⤵
  PID:5060
- C:\Windows\System\tfjsTjA.exe
  C:\Windows\System\tfjsTjA.exe
  2⤵
  PID:5004
- C:\Windows\System\zoqCaWR.exe
  C:\Windows\System\zoqCaWR.exe
  2⤵
  PID:4992
- C:\Windows\System\rIrsggu.exe
  C:\Windows\System\rIrsggu.exe
  2⤵
  PID:4596
- C:\Windows\System\klDHQsn.exe
  C:\Windows\System\klDHQsn.exe
  2⤵
  PID:5136
- C:\Windows\System\BrxFCrn.exe
  C:\Windows\System\BrxFCrn.exe
  2⤵
  PID:4916
- C:\Windows\System\bYoEkAT.exe
  C:\Windows\System\bYoEkAT.exe
  2⤵
  PID:5168
- C:\Windows\System\ozHKtNX.exe
  C:\Windows\System\ozHKtNX.exe
  2⤵
  PID:5188
- C:\Windows\System\sFjeEKI.exe
  C:\Windows\System\sFjeEKI.exe
  2⤵
  PID:5204
- C:\Windows\System\kbZSDuT.exe
  C:\Windows\System\kbZSDuT.exe
  2⤵
  PID:4976
- C:\Windows\System\nKzQHPS.exe
  C:\Windows\System\nKzQHPS.exe
  2⤵
  PID:4536
- C:\Windows\System\NwDrZnn.exe
  C:\Windows\System\NwDrZnn.exe
  2⤵
  PID:5112
- C:\Windows\System\TnvYnLF.exe
  C:\Windows\System\TnvYnLF.exe
  2⤵
  PID:3576
- C:\Windows\System\PDhiMry.exe
  C:\Windows\System\PDhiMry.exe
  2⤵
  PID:4856
- C:\Windows\System\njEmuHb.exe
  C:\Windows\System\njEmuHb.exe
  2⤵
  PID:5148
- C:\Windows\System\hQrLKWo.exe
  C:\Windows\System\hQrLKWo.exe
  2⤵
  PID:5224
- C:\Windows\System\lGJmzic.exe
  C:\Windows\System\lGJmzic.exe
  2⤵
  PID:1720
- C:\Windows\System\IpciHwv.exe
  C:\Windows\System\IpciHwv.exe
  2⤵
  PID:5240
- C:\Windows\System\VyNwTMv.exe
  C:\Windows\System\VyNwTMv.exe
  2⤵
  PID:5288
- C:\Windows\System\JMdZyED.exe
  C:\Windows\System\JMdZyED.exe
  2⤵
  PID:5300
- C:\Windows\System\jWjrcKN.exe
  C:\Windows\System\jWjrcKN.exe
  2⤵
  PID:5284
- C:\Windows\System\clsBATI.exe
  C:\Windows\System\clsBATI.exe
  2⤵
  PID:5392
- C:\Windows\System\GsFzijz.exe
  C:\Windows\System\GsFzijz.exe
  2⤵
  PID:5428
- C:\Windows\System\hmjmCPs.exe
  C:\Windows\System\hmjmCPs.exe
  2⤵
  PID:5412
- C:\Windows\System\HxHlcpq.exe
  C:\Windows\System\HxHlcpq.exe
  2⤵
  PID:5456
- C:\Windows\System\hADIquu.exe
  C:\Windows\System\hADIquu.exe
  2⤵
  PID:5468
- C:\Windows\System\ssKNRPR.exe
  C:\Windows\System\ssKNRPR.exe
  2⤵
  PID:5496
- C:\Windows\System\RkLRRrp.exe
  C:\Windows\System\RkLRRrp.exe
  2⤵
  PID:5564
- C:\Windows\System\EIVsUBJ.exe
  C:\Windows\System\EIVsUBJ.exe
  2⤵
  PID:5600
- C:\Windows\System\hGKvSib.exe
  C:\Windows\System\hGKvSib.exe
  2⤵
  PID:5668
- C:\Windows\System\xTIZDkq.exe
  C:\Windows\System\xTIZDkq.exe
  2⤵
  PID:5552
- C:\Windows\System\xcMeayq.exe
  C:\Windows\System\xcMeayq.exe
  2⤵
  PID:5652
- C:\Windows\System\kdcIiwc.exe
  C:\Windows\System\kdcIiwc.exe
  2⤵
  PID:5740
- C:\Windows\System\JGHvNbj.exe
  C:\Windows\System\JGHvNbj.exe
  2⤵
  PID:5764
- C:\Windows\System\MMVYzIO.exe
  C:\Windows\System\MMVYzIO.exe
  2⤵
  PID:5776
- C:\Windows\System\hVIWjzk.exe
  C:\Windows\System\hVIWjzk.exe
  2⤵
  PID:5716
- C:\Windows\System\zucHpec.exe
  C:\Windows\System\zucHpec.exe
  2⤵
  PID:5684
- C:\Windows\System\wqEwSrb.exe
  C:\Windows\System\wqEwSrb.exe
  2⤵
  PID:5828
- C:\Windows\System\JIUHnkf.exe
  C:\Windows\System\JIUHnkf.exe
  2⤵
  PID:5852
- C:\Windows\System\wFCKLKU.exe
  C:\Windows\System\wFCKLKU.exe
  2⤵
  PID:5916
- C:\Windows\System\hKGCdvW.exe
  C:\Windows\System\hKGCdvW.exe
  2⤵
  PID:5900
- C:\Windows\System\pjiAECz.exe
  C:\Windows\System\pjiAECz.exe
  2⤵
  PID:5956
- C:\Windows\System\XOKOjyX.exe
  C:\Windows\System\XOKOjyX.exe
  2⤵
  PID:6036
- C:\Windows\System\LefuMoG.exe
  C:\Windows\System\LefuMoG.exe
  2⤵
  PID:6112
- C:\Windows\System\PGtlwVB.exe
  C:\Windows\System\PGtlwVB.exe
  2⤵
  PID:4836
- C:\Windows\System\jeJDNlv.exe
  C:\Windows\System\jeJDNlv.exe
  2⤵
  PID:6052
- C:\Windows\System\ZoUhBbF.exe
  C:\Windows\System\ZoUhBbF.exe
  2⤵
  PID:5180
- C:\Windows\System\DKIlFyf.exe
  C:\Windows\System\DKIlFyf.exe
  2⤵
  PID:4828
- C:\Windows\System\LAfzbRq.exe
  C:\Windows\System\LAfzbRq.exe
  2⤵
  PID:4400
- C:\Windows\System\QEvOOVz.exe
  C:\Windows\System\QEvOOVz.exe
  2⤵
  PID:5156
- C:\Windows\System\dvhNnie.exe
  C:\Windows\System\dvhNnie.exe
  2⤵
  PID:1208
- C:\Windows\System\qkUTGMR.exe
  C:\Windows\System\qkUTGMR.exe
  2⤵
  PID:4176
- C:\Windows\System\MQhiqDE.exe
  C:\Windows\System\MQhiqDE.exe
  2⤵
  PID:4448
- C:\Windows\System\YPylReX.exe
  C:\Windows\System\YPylReX.exe
  2⤵
  PID:5256
- C:\Windows\System\HsqaWvd.exe
  C:\Windows\System\HsqaWvd.exe
  2⤵
  PID:5324
- C:\Windows\System\tAthMmi.exe
  C:\Windows\System\tAthMmi.exe
  2⤵
  PID:2784
- C:\Windows\System\rvphTcp.exe
  C:\Windows\System\rvphTcp.exe
  2⤵
  PID:5340
- C:\Windows\System\FbelhLd.exe
  C:\Windows\System\FbelhLd.exe
  2⤵
  PID:5476
- C:\Windows\System\xyBpamb.exe
  C:\Windows\System\xyBpamb.exe
  2⤵
  PID:5580
- C:\Windows\System\zcTgGgx.exe
  C:\Windows\System\zcTgGgx.exe
  2⤵
  PID:5200
- C:\Windows\System\AbZEcVF.exe
  C:\Windows\System\AbZEcVF.exe
  2⤵
  PID:5512
- C:\Windows\System\nEhXjpZ.exe
  C:\Windows\System\nEhXjpZ.exe
  2⤵
  PID:5772
- C:\Windows\System\dLrzYWb.exe
  C:\Windows\System\dLrzYWb.exe
  2⤵
  PID:4140
- C:\Windows\System\CIoJwrd.exe
  C:\Windows\System\CIoJwrd.exe
  2⤵
  PID:5700
- C:\Windows\System\bYecUPy.exe
  C:\Windows\System\bYecUPy.exe
  2⤵
  PID:5244
- C:\Windows\System\GVqaYOR.exe
  C:\Windows\System\GVqaYOR.exe
  2⤵
  PID:5360
- C:\Windows\System\NvXgrys.exe
  C:\Windows\System\NvXgrys.exe
  2⤵
  PID:5648
- C:\Windows\System\WLIjTUt.exe
  C:\Windows\System\WLIjTUt.exe
  2⤵
  PID:5812
- C:\Windows\System\RpLEUEB.exe
  C:\Windows\System\RpLEUEB.exe
  2⤵
  PID:5848
- C:\Windows\System\iKBCstD.exe
  C:\Windows\System\iKBCstD.exe
  2⤵
  PID:5884
- C:\Windows\System\VWxvBvl.exe
  C:\Windows\System\VWxvBvl.exe
  2⤵
  PID:5896
- C:\Windows\System\mKpbnPR.exe
  C:\Windows\System\mKpbnPR.exe
  2⤵
  PID:6004
- C:\Windows\System\iyzKdEA.exe
  C:\Windows\System\iyzKdEA.exe
  2⤵
  PID:5948
- C:\Windows\System\hPMsORB.exe
  C:\Windows\System\hPMsORB.exe
  2⤵
  PID:6072
- C:\Windows\System\QmWNDqv.exe
  C:\Windows\System\QmWNDqv.exe
  2⤵
  PID:4948
- C:\Windows\System\vnWozBS.exe
  C:\Windows\System\vnWozBS.exe
  2⤵
  PID:6024
- C:\Windows\System\bAIuurV.exe
  C:\Windows\System\bAIuurV.exe
  2⤵
  PID:4728
- C:\Windows\System\rxXtkOJ.exe
  C:\Windows\System\rxXtkOJ.exe
  2⤵
  PID:6124
- C:\Windows\System\hVeyKIP.exe
  C:\Windows\System\hVeyKIP.exe
  2⤵
  PID:4188
- C:\Windows\System\TXSLMWF.exe
  C:\Windows\System\TXSLMWF.exe
  2⤵
  PID:5268
- C:\Windows\System\bTiLymT.exe
  C:\Windows\System\bTiLymT.exe
  2⤵
  PID:4760
- C:\Windows\System\QbAFefL.exe
  C:\Windows\System\QbAFefL.exe
  2⤵
  PID:5568
- C:\Windows\System\EyNkIlU.exe
  C:\Windows\System\EyNkIlU.exe
  2⤵
  PID:5212
- C:\Windows\System\qsRyhhA.exe
  C:\Windows\System\qsRyhhA.exe
  2⤵
  PID:5744
- C:\Windows\System\OZYtdLi.exe
  C:\Windows\System\OZYtdLi.exe
  2⤵
  PID:5636
- C:\Windows\System\ZaXuJhp.exe
  C:\Windows\System\ZaXuJhp.exe
  2⤵
  PID:5844
- C:\Windows\System\XOWnoPE.exe
  C:\Windows\System\XOWnoPE.exe
  2⤵
  PID:5936
- C:\Windows\System\xwFLVIR.exe
  C:\Windows\System\xwFLVIR.exe
  2⤵
  PID:5972
- C:\Windows\System\JRMcvWm.exe
  C:\Windows\System\JRMcvWm.exe
  2⤵
  PID:5976
- C:\Windows\System\BtYssDt.exe
  C:\Windows\System\BtYssDt.exe
  2⤵
  PID:6060
- C:\Windows\System\KadNNQV.exe
  C:\Windows\System\KadNNQV.exe
  2⤵
  PID:5044
- C:\Windows\System\EewKtch.exe
  C:\Windows\System\EewKtch.exe
  2⤵
  PID:5084
- C:\Windows\System\OgJeIIr.exe
  C:\Windows\System\OgJeIIr.exe
  2⤵
  PID:4788
- C:\Windows\System\aQpDVyN.exe
  C:\Windows\System\aQpDVyN.exe
  2⤵
  PID:5096
- C:\Windows\System\rVwvNqq.exe
  C:\Windows\System\rVwvNqq.exe
  2⤵
  PID:5304
- C:\Windows\System\cYLdosI.exe
  C:\Windows\System\cYLdosI.exe
  2⤵
  PID:5752
- C:\Windows\System\czmweGL.exe
  C:\Windows\System\czmweGL.exe
  2⤵
  PID:5680
- C:\Windows\System\WKpFLwJ.exe
  C:\Windows\System\WKpFLwJ.exe
  2⤵
  PID:5964
- C:\Windows\System\SmYvOAu.exe
  C:\Windows\System\SmYvOAu.exe
  2⤵
  PID:5388
- C:\Windows\System\BziOQXG.exe
  C:\Windows\System\BziOQXG.exe
  2⤵
  PID:5720
- C:\Windows\System\bosgqsX.exe
  C:\Windows\System\bosgqsX.exe
  2⤵
  PID:4908
- C:\Windows\System\sJQIzlD.exe
  C:\Windows\System\sJQIzlD.exe
  2⤵
  PID:5396
- C:\Windows\System\bDpLwiZ.exe
  C:\Windows\System\bDpLwiZ.exe
  2⤵
  PID:5480
- C:\Windows\System\kwqUZIB.exe
  C:\Windows\System\kwqUZIB.exe
  2⤵
  PID:5448
- C:\Windows\System\YeaaLJQ.exe
  C:\Windows\System\YeaaLJQ.exe
  2⤵
  PID:5460
- C:\Windows\System\bDroeFw.exe
  C:\Windows\System\bDroeFw.exe
  2⤵
  PID:4980
- C:\Windows\System\unMiWDc.exe
  C:\Windows\System\unMiWDc.exe
  2⤵
  PID:6156
- C:\Windows\System\UlhOVfZ.exe
  C:\Windows\System\UlhOVfZ.exe
  2⤵
  PID:6172
- C:\Windows\System\dmMRZFA.exe
  C:\Windows\System\dmMRZFA.exe
  2⤵
  PID:6188
- C:\Windows\System\ffkfqfx.exe
  C:\Windows\System\ffkfqfx.exe
  2⤵
  PID:6204
- C:\Windows\System\VlwvItg.exe
  C:\Windows\System\VlwvItg.exe
  2⤵
  PID:6220
- C:\Windows\System\RnEuYdJ.exe
  C:\Windows\System\RnEuYdJ.exe
  2⤵
  PID:6236
- C:\Windows\System\LBHviWZ.exe
  C:\Windows\System\LBHviWZ.exe
  2⤵
  PID:6252
- C:\Windows\System\EPnSteg.exe
  C:\Windows\System\EPnSteg.exe
  2⤵
  PID:6272
- C:\Windows\System\ZdTtOao.exe
  C:\Windows\System\ZdTtOao.exe
  2⤵
  PID:6288
- C:\Windows\System\reVlfdp.exe
  C:\Windows\System\reVlfdp.exe
  2⤵
  PID:6324
- C:\Windows\System\HFqLouf.exe
  C:\Windows\System\HFqLouf.exe
  2⤵
  PID:6344
- C:\Windows\System\QpwpNIc.exe
  C:\Windows\System\QpwpNIc.exe
  2⤵
  PID:6360
- C:\Windows\System\bEIuMor.exe
  C:\Windows\System\bEIuMor.exe
  2⤵
  PID:6376
- C:\Windows\System\jZtLhQp.exe
  C:\Windows\System\jZtLhQp.exe
  2⤵
  PID:6408
- C:\Windows\System\esHtMpz.exe
  C:\Windows\System\esHtMpz.exe
  2⤵
  PID:6424
- C:\Windows\System\vUdOKQy.exe
  C:\Windows\System\vUdOKQy.exe
  2⤵
  PID:6440
- C:\Windows\System\qMnsWhX.exe
  C:\Windows\System\qMnsWhX.exe
  2⤵
  PID:6460
- C:\Windows\System\USHQKvB.exe
  C:\Windows\System\USHQKvB.exe
  2⤵
  PID:6476
- C:\Windows\System\AaFAudr.exe
  C:\Windows\System\AaFAudr.exe
  2⤵
  PID:6492
- C:\Windows\System\JpUdUMk.exe
  C:\Windows\System\JpUdUMk.exe
  2⤵
  PID:6512
- C:\Windows\System\ddJyFsb.exe
  C:\Windows\System\ddJyFsb.exe
  2⤵
  PID:6528
- C:\Windows\System\NODkGnw.exe
  C:\Windows\System\NODkGnw.exe
  2⤵
  PID:6544
- C:\Windows\System\qGeeIex.exe
  C:\Windows\System\qGeeIex.exe
  2⤵
  PID:6564
- C:\Windows\System\bptMrdM.exe
  C:\Windows\System\bptMrdM.exe
  2⤵
  PID:6580
- C:\Windows\System\MvTTkFK.exe
  C:\Windows\System\MvTTkFK.exe
  2⤵
  PID:6600
- C:\Windows\System\TscLGrV.exe
  C:\Windows\System\TscLGrV.exe
  2⤵
  PID:6616
- C:\Windows\System\NzbplWF.exe
  C:\Windows\System\NzbplWF.exe
  2⤵
  PID:6636
- C:\Windows\System\clYVAZD.exe
  C:\Windows\System\clYVAZD.exe
  2⤵
  PID:6784
- C:\Windows\System\LruivXY.exe
  C:\Windows\System\LruivXY.exe
  2⤵
  PID:6800
- C:\Windows\System\UkTDDel.exe
  C:\Windows\System\UkTDDel.exe
  2⤵
  PID:6816
- C:\Windows\System\qAgLplp.exe
  C:\Windows\System\qAgLplp.exe
  2⤵
  PID:6836
- C:\Windows\System\cqnpnCa.exe
  C:\Windows\System\cqnpnCa.exe
  2⤵
  PID:6856
- C:\Windows\System\lzCglUA.exe
  C:\Windows\System\lzCglUA.exe
  2⤵
  PID:6872
- C:\Windows\System\PfTqIex.exe
  C:\Windows\System\PfTqIex.exe
  2⤵
  PID:6888
- C:\Windows\System\mMpdOjn.exe
  C:\Windows\System\mMpdOjn.exe
  2⤵
  PID:6908
- C:\Windows\System\EIIxLcN.exe
  C:\Windows\System\EIIxLcN.exe
  2⤵
  PID:6924
- C:\Windows\System\flsJTaZ.exe
  C:\Windows\System\flsJTaZ.exe
  2⤵
  PID:6940
- C:\Windows\System\FZVIAHb.exe
  C:\Windows\System\FZVIAHb.exe
  2⤵
  PID:6956
- C:\Windows\System\yMyqYwg.exe
  C:\Windows\System\yMyqYwg.exe
  2⤵
  PID:6972
- C:\Windows\System\QfgIuid.exe
  C:\Windows\System\QfgIuid.exe
  2⤵
  PID:7076
- C:\Windows\System\UyMNpVc.exe
  C:\Windows\System\UyMNpVc.exe
  2⤵
  PID:7092
- C:\Windows\System\gwUwMQm.exe
  C:\Windows\System\gwUwMQm.exe
  2⤵
  PID:7108
- C:\Windows\System\VrFCIcq.exe
  C:\Windows\System\VrFCIcq.exe
  2⤵
  PID:7124
- C:\Windows\System\YBlxUYy.exe
  C:\Windows\System\YBlxUYy.exe
  2⤵
  PID:7140
- C:\Windows\System\vqYbXHH.exe
  C:\Windows\System\vqYbXHH.exe
  2⤵
  PID:7156
- C:\Windows\System\lQnHNaD.exe
  C:\Windows\System\lQnHNaD.exe
  2⤵
  PID:6152
- C:\Windows\System\sNXgBdf.exe
  C:\Windows\System\sNXgBdf.exe
  2⤵
  PID:6216
- C:\Windows\System\dJdvLQK.exe
  C:\Windows\System\dJdvLQK.exe
  2⤵
  PID:5344
- C:\Windows\System\CQPuogV.exe
  C:\Windows\System\CQPuogV.exe
  2⤵
  PID:6232
- C:\Windows\System\kJMFNcp.exe
  C:\Windows\System\kJMFNcp.exe
  2⤵
  PID:6096
- C:\Windows\System\DmvxsfE.exe
  C:\Windows\System\DmvxsfE.exe
  2⤵
  PID:6284
- C:\Windows\System\xbdpQQi.exe
  C:\Windows\System\xbdpQQi.exe
  2⤵
  PID:6336
- C:\Windows\System\UnIQQNd.exe
  C:\Windows\System\UnIQQNd.exe
  2⤵
  PID:6340
- C:\Windows\System\aUdxunw.exe
  C:\Windows\System\aUdxunw.exe
  2⤵
  PID:6356
- C:\Windows\System\FySORaa.exe
  C:\Windows\System\FySORaa.exe
  2⤵
  PID:6452
- C:\Windows\System\GPgjySx.exe
  C:\Windows\System\GPgjySx.exe
  2⤵
  PID:6524
- C:\Windows\System\esoYlqT.exe
  C:\Windows\System\esoYlqT.exe
  2⤵
  PID:6320
- C:\Windows\System\zCCDwpv.exe
  C:\Windows\System\zCCDwpv.exe
  2⤵
  PID:6588
- C:\Windows\System\ePsAMEQ.exe
  C:\Windows\System\ePsAMEQ.exe
  2⤵
  PID:6624
- C:\Windows\System\xIJdTvz.exe
  C:\Windows\System\xIJdTvz.exe
  2⤵
  PID:6500
- C:\Windows\System\IKeOmYe.exe
  C:\Windows\System\IKeOmYe.exe
  2⤵
  PID:6628
- C:\Windows\System\XxeGDkh.exe
  C:\Windows\System\XxeGDkh.exe
  2⤵
  PID:6576
- C:\Windows\System\JClgNxf.exe
  C:\Windows\System\JClgNxf.exe
  2⤵
  PID:6644
- C:\Windows\System\gFEXVqT.exe
  C:\Windows\System\gFEXVqT.exe
  2⤵
  PID:6672
- C:\Windows\System\WUwAUOW.exe
  C:\Windows\System\WUwAUOW.exe
  2⤵
  PID:6688
- C:\Windows\System\qlxEets.exe
  C:\Windows\System\qlxEets.exe
  2⤵
  PID:6712
- C:\Windows\System\GtzxMSB.exe
  C:\Windows\System\GtzxMSB.exe
  2⤵
  PID:6696
- C:\Windows\System\xYeUeVq.exe
  C:\Windows\System\xYeUeVq.exe
  2⤵
  PID:6732
- C:\Windows\System\AxkQELB.exe
  C:\Windows\System\AxkQELB.exe
  2⤵
  PID:6748
- C:\Windows\System\SGryAAc.exe
  C:\Windows\System\SGryAAc.exe
  2⤵
  PID:6772
- C:\Windows\System\YmOVcOq.exe
  C:\Windows\System\YmOVcOq.exe
  2⤵
  PID:6832
- C:\Windows\System\XIvoNPL.exe
  C:\Windows\System\XIvoNPL.exe
  2⤵
  PID:6764
- C:\Windows\System\qorTsJr.exe
  C:\Windows\System\qorTsJr.exe
  2⤵
  PID:6900
- C:\Windows\System\elNzjUM.exe
  C:\Windows\System\elNzjUM.exe
  2⤵
  PID:6884
- C:\Windows\System\ZowRMSP.exe
  C:\Windows\System\ZowRMSP.exe
  2⤵
  PID:6848
- C:\Windows\System\NIUTsVe.exe
  C:\Windows\System\NIUTsVe.exe
  2⤵
  PID:6920
- C:\Windows\System\LBuGonn.exe
  C:\Windows\System\LBuGonn.exe
  2⤵
  PID:6984
- C:\Windows\System\TNFhweX.exe
  C:\Windows\System\TNFhweX.exe
  2⤵
  PID:7004
- C:\Windows\System\pDPKbEe.exe
  C:\Windows\System\pDPKbEe.exe
  2⤵
  PID:7024
- C:\Windows\System\gzgrfeW.exe
  C:\Windows\System\gzgrfeW.exe
  2⤵
  PID:7036
- C:\Windows\System\ZmIcleb.exe
  C:\Windows\System\ZmIcleb.exe
  2⤵
  PID:7048
- C:\Windows\System\XiSWtYd.exe
  C:\Windows\System\XiSWtYd.exe
  2⤵
  PID:7068
- C:\Windows\System\nfUsqEq.exe
  C:\Windows\System\nfUsqEq.exe
  2⤵
  PID:7120
- C:\Windows\System\oWaLZuT.exe
  C:\Windows\System\oWaLZuT.exe
  2⤵
  PID:6212
- C:\Windows\System\kmndbYA.exe
  C:\Windows\System\kmndbYA.exe
  2⤵
  PID:6316
- C:\Windows\System\rOdzdQh.exe
  C:\Windows\System\rOdzdQh.exe
  2⤵
  PID:6396
- C:\Windows\System\NBOWWXs.exe
  C:\Windows\System\NBOWWXs.exe
  2⤵
  PID:6432
- C:\Windows\System\XwMiqFk.exe
  C:\Windows\System\XwMiqFk.exe
  2⤵
  PID:6560
- C:\Windows\System\QQMUQHR.exe
  C:\Windows\System\QQMUQHR.exe
  2⤵
  PID:7132
- C:\Windows\System\NZNGbNB.exe
  C:\Windows\System\NZNGbNB.exe
  2⤵
  PID:6372
- C:\Windows\System\XkfZYnj.exe
  C:\Windows\System\XkfZYnj.exe
  2⤵
  PID:6520
- C:\Windows\System\cpcVAcT.exe
  C:\Windows\System\cpcVAcT.exe
  2⤵
  PID:6456
- C:\Windows\System\rLmJKYi.exe
  C:\Windows\System\rLmJKYi.exe
  2⤵
  PID:6508
- C:\Windows\System\oRGHwVg.exe
  C:\Windows\System\oRGHwVg.exe
  2⤵
  PID:6656
- C:\Windows\System\PTgSwhu.exe
  C:\Windows\System\PTgSwhu.exe
  2⤵
  PID:6652
- C:\Windows\System\jkiyhKk.exe
  C:\Windows\System\jkiyhKk.exe
  2⤵
  PID:6744
- C:\Windows\System\IdxJrdp.exe
  C:\Windows\System\IdxJrdp.exe
  2⤵
  PID:6864
- C:\Windows\System\zAHWLxM.exe
  C:\Windows\System\zAHWLxM.exe
  2⤵
  PID:6812
- C:\Windows\System\hOPLgVz.exe
  C:\Windows\System\hOPLgVz.exe
  2⤵
  PID:6684
- C:\Windows\System\jvDLVZY.exe
  C:\Windows\System\jvDLVZY.exe
  2⤵
  PID:6728
- C:\Windows\System\QsuMdMp.exe
  C:\Windows\System\QsuMdMp.exe
  2⤵
  PID:7044
- C:\Windows\System\aNNcwog.exe
  C:\Windows\System\aNNcwog.exe
  2⤵
  PID:6780
- C:\Windows\System\GSPHSig.exe
  C:\Windows\System\GSPHSig.exe
  2⤵
  PID:6916
- C:\Windows\System\qiMHGqJ.exe
  C:\Windows\System\qiMHGqJ.exe
  2⤵
  PID:6268
- C:\Windows\System\mDtLVrt.exe
  C:\Windows\System\mDtLVrt.exe
  2⤵
  PID:6280
- C:\Windows\System\XxRTtrQ.exe
  C:\Windows\System\XxRTtrQ.exe
  2⤵
  PID:7016
- C:\Windows\System\igjrgOn.exe
  C:\Windows\System\igjrgOn.exe
  2⤵
  PID:7060
- C:\Windows\System\MwgWDXX.exe
  C:\Windows\System\MwgWDXX.exe
  2⤵
  PID:6488
- C:\Windows\System\DBWHHww.exe
  C:\Windows\System\DBWHHww.exe
  2⤵
  PID:6416
- C:\Windows\System\jIyKGtM.exe
  C:\Windows\System\jIyKGtM.exe
  2⤵
  PID:6796
- C:\Windows\System\saIiyEA.exe
  C:\Windows\System\saIiyEA.exe
  2⤵
  PID:6472
- C:\Windows\System\HTienmI.exe
  C:\Windows\System\HTienmI.exe
  2⤵
  PID:7164
- C:\Windows\System\zSuFPCx.exe
  C:\Windows\System\zSuFPCx.exe
  2⤵
  PID:6720
- C:\Windows\System\lMmWrfB.exe
  C:\Windows\System\lMmWrfB.exe
  2⤵
  PID:6880
- C:\Windows\System\HOgjiYn.exe
  C:\Windows\System\HOgjiYn.exe
  2⤵
  PID:6996
- C:\Windows\System\Zyjsyhc.exe
  C:\Windows\System\Zyjsyhc.exe
  2⤵
  PID:6148
- C:\Windows\System\VaAtJhN.exe
  C:\Windows\System\VaAtJhN.exe
  2⤵
  PID:6760
- C:\Windows\System\gmHoOKS.exe
  C:\Windows\System\gmHoOKS.exe
  2⤵
  PID:6980
- C:\Windows\System\vtYNndB.exe
  C:\Windows\System\vtYNndB.exe
  2⤵
  PID:6536
- C:\Windows\System\RoHNicX.exe
  C:\Windows\System\RoHNicX.exe
  2⤵
  PID:7028
- C:\Windows\System\HTXiqDv.exe
  C:\Windows\System\HTXiqDv.exe
  2⤵
  PID:6724
- C:\Windows\System\pxJWrCh.exe
  C:\Windows\System\pxJWrCh.exe
  2⤵
  PID:6952
- C:\Windows\System\litMfEP.exe
  C:\Windows\System\litMfEP.exe
  2⤵
  PID:6844
- C:\Windows\System\XMVMDzE.exe
  C:\Windows\System\XMVMDzE.exe
  2⤵
  PID:7172
- C:\Windows\System\IefVWfY.exe
  C:\Windows\System\IefVWfY.exe
  2⤵
  PID:7188
- C:\Windows\System\BBSMPPe.exe
  C:\Windows\System\BBSMPPe.exe
  2⤵
  PID:7276
- C:\Windows\System\uLlbagm.exe
  C:\Windows\System\uLlbagm.exe
  2⤵
  PID:7292
- C:\Windows\System\NiJleHw.exe
  C:\Windows\System\NiJleHw.exe
  2⤵
  PID:7308
- C:\Windows\System\fCaXVMf.exe
  C:\Windows\System\fCaXVMf.exe
  2⤵
  PID:7324
- C:\Windows\System\CGwzRRf.exe
  C:\Windows\System\CGwzRRf.exe
  2⤵
  PID:7340
- C:\Windows\System\SmDxsLQ.exe
  C:\Windows\System\SmDxsLQ.exe
  2⤵
  PID:7356
- C:\Windows\System\EJyTWgo.exe
  C:\Windows\System\EJyTWgo.exe
  2⤵
  PID:7376
- C:\Windows\System\usINduc.exe
  C:\Windows\System\usINduc.exe
  2⤵
  PID:7392
- C:\Windows\System\jbTuNTC.exe
  C:\Windows\System\jbTuNTC.exe
  2⤵
  PID:7408
- C:\Windows\System\etGQxAq.exe
  C:\Windows\System\etGQxAq.exe
  2⤵
  PID:7424
- C:\Windows\System\NYXHmCo.exe
  C:\Windows\System\NYXHmCo.exe
  2⤵
  PID:7440
- C:\Windows\System\QThqWbh.exe
  C:\Windows\System\QThqWbh.exe
  2⤵
  PID:7456
- C:\Windows\System\dJvcWFo.exe
  C:\Windows\System\dJvcWFo.exe
  2⤵
  PID:7472
- C:\Windows\System\mqdGcWm.exe
  C:\Windows\System\mqdGcWm.exe
  2⤵
  PID:7488
- C:\Windows\System\fIzeyhf.exe
  C:\Windows\System\fIzeyhf.exe
  2⤵
  PID:7504
- C:\Windows\System\CaEqxqd.exe
  C:\Windows\System\CaEqxqd.exe
  2⤵
  PID:7520
- C:\Windows\System\PsZPopH.exe
  C:\Windows\System\PsZPopH.exe
  2⤵
  PID:7536
- C:\Windows\System\iCpRCxF.exe
  C:\Windows\System\iCpRCxF.exe
  2⤵
  PID:7552
- C:\Windows\System\MJkLOUw.exe
  C:\Windows\System\MJkLOUw.exe
  2⤵
  PID:7568
- C:\Windows\System\AFuSfBz.exe
  C:\Windows\System\AFuSfBz.exe
  2⤵
  PID:7584
- C:\Windows\System\OZvmTRl.exe
  C:\Windows\System\OZvmTRl.exe
  2⤵
  PID:7600
- C:\Windows\System\kPTsWdI.exe
  C:\Windows\System\kPTsWdI.exe
  2⤵
  PID:7620
- C:\Windows\System\cIFIMaf.exe
  C:\Windows\System\cIFIMaf.exe
  2⤵
  PID:7636
- C:\Windows\System\rJRwqAg.exe
  C:\Windows\System\rJRwqAg.exe
  2⤵
  PID:7652
- C:\Windows\System\sSAmBas.exe
  C:\Windows\System\sSAmBas.exe
  2⤵
  PID:7668
- C:\Windows\System\qdnwsHQ.exe
  C:\Windows\System\qdnwsHQ.exe
  2⤵
  PID:7684
- C:\Windows\System\yGrDjWL.exe
  C:\Windows\System\yGrDjWL.exe
  2⤵
  PID:7700
- C:\Windows\System\mJEbHDD.exe
  C:\Windows\System\mJEbHDD.exe
  2⤵
  PID:7716
- C:\Windows\System\oOdGEhl.exe
  C:\Windows\System\oOdGEhl.exe
  2⤵
  PID:7732
- C:\Windows\System\xUgpESv.exe
  C:\Windows\System\xUgpESv.exe
  2⤵
  PID:7748
- C:\Windows\System\pmLjbNg.exe
  C:\Windows\System\pmLjbNg.exe
  2⤵
  PID:7764
- C:\Windows\System\TdnYatZ.exe
  C:\Windows\System\TdnYatZ.exe
  2⤵
  PID:7780
- C:\Windows\System\Adoebdo.exe
  C:\Windows\System\Adoebdo.exe
  2⤵
  PID:7796
- C:\Windows\System\tGpuDvr.exe
  C:\Windows\System\tGpuDvr.exe
  2⤵
  PID:7812
- C:\Windows\System\xkKKwsE.exe
  C:\Windows\System\xkKKwsE.exe
  2⤵
  PID:7828
- C:\Windows\System\oPaXDYD.exe
  C:\Windows\System\oPaXDYD.exe
  2⤵
  PID:7844
- C:\Windows\System\RZUciXz.exe
  C:\Windows\System\RZUciXz.exe
  2⤵
  PID:7860
- C:\Windows\System\qfcsWKl.exe
  C:\Windows\System\qfcsWKl.exe
  2⤵
  PID:7888
- C:\Windows\System\eHjXyXQ.exe
  C:\Windows\System\eHjXyXQ.exe
  2⤵
  PID:7904
- C:\Windows\System\YyErtfz.exe
  C:\Windows\System\YyErtfz.exe
  2⤵
  PID:7920
- C:\Windows\System\OwwUqmf.exe
  C:\Windows\System\OwwUqmf.exe
  2⤵
  PID:7936
- C:\Windows\System\zNXxqFQ.exe
  C:\Windows\System\zNXxqFQ.exe
  2⤵
  PID:7952
- C:\Windows\System\cvgNAnc.exe
  C:\Windows\System\cvgNAnc.exe
  2⤵
  PID:7972
- C:\Windows\System\xggrLsl.exe
  C:\Windows\System\xggrLsl.exe
  2⤵
  PID:7988
- C:\Windows\System\bTUxFjW.exe
  C:\Windows\System\bTUxFjW.exe
  2⤵
  PID:8004
- C:\Windows\System\jnIUFpb.exe
  C:\Windows\System\jnIUFpb.exe
  2⤵
  PID:8020
- C:\Windows\System\ZIlMZoZ.exe
  C:\Windows\System\ZIlMZoZ.exe
  2⤵
  PID:8040
- C:\Windows\System\lTEXJNX.exe
  C:\Windows\System\lTEXJNX.exe
  2⤵
  PID:8060
- C:\Windows\System\UWMaJUL.exe
  C:\Windows\System\UWMaJUL.exe
  2⤵
  PID:8076
- C:\Windows\System\yDviKYF.exe
  C:\Windows\System\yDviKYF.exe
  2⤵
  PID:8092
- C:\Windows\System\BcswksJ.exe
  C:\Windows\System\BcswksJ.exe
  2⤵
  PID:8108
- C:\Windows\System\tGcWkHi.exe
  C:\Windows\System\tGcWkHi.exe
  2⤵
  PID:8124
- C:\Windows\System\btqYtZB.exe
  C:\Windows\System\btqYtZB.exe
  2⤵
  PID:8140
- C:\Windows\System\DqZoBln.exe
  C:\Windows\System\DqZoBln.exe
  2⤵
  PID:8156
- C:\Windows\System\WWfiDtt.exe
  C:\Windows\System\WWfiDtt.exe
  2⤵
  PID:8172
- C:\Windows\System\hpdmDFw.exe
  C:\Windows\System\hpdmDFw.exe
  2⤵
  PID:8188
- C:\Windows\System\kauiniT.exe
  C:\Windows\System\kauiniT.exe
  2⤵
  PID:6704
- C:\Windows\System\WxBhZyU.exe
  C:\Windows\System\WxBhZyU.exe
  2⤵
  PID:6632
- C:\Windows\System\ILCiwXW.exe
  C:\Windows\System\ILCiwXW.exe
  2⤵
  PID:7056
- C:\Windows\System\ZPbZHvU.exe
  C:\Windows\System\ZPbZHvU.exe
  2⤵
  PID:7196
- C:\Windows\System\IFRvOKf.exe
  C:\Windows\System\IFRvOKf.exe
  2⤵
  PID:7220
- C:\Windows\System\KrFoHZs.exe
  C:\Windows\System\KrFoHZs.exe
  2⤵
  PID:7232
- C:\Windows\System\KlrNtig.exe
  C:\Windows\System\KlrNtig.exe
  2⤵
  PID:7248
- C:\Windows\System\wigbbXB.exe
  C:\Windows\System\wigbbXB.exe
  2⤵
  PID:7284
- C:\Windows\System\uMLdgQp.exe
  C:\Windows\System\uMLdgQp.exe
  2⤵
  PID:7348
- C:\Windows\System\BFUtGht.exe
  C:\Windows\System\BFUtGht.exe
  2⤵
  PID:7416
- C:\Windows\System\UuzEMFA.exe
  C:\Windows\System\UuzEMFA.exe
  2⤵
  PID:7272
- C:\Windows\System\tIqwNBx.exe
  C:\Windows\System\tIqwNBx.exe
  2⤵
  PID:7336
- C:\Windows\System\GPMXXoG.exe
  C:\Windows\System\GPMXXoG.exe
  2⤵
  PID:7400
- C:\Windows\System\pmGxlhC.exe
  C:\Windows\System\pmGxlhC.exe
  2⤵
  PID:7480
- C:\Windows\System\IHUYdCJ.exe
  C:\Windows\System\IHUYdCJ.exe
  2⤵
  PID:7512
- C:\Windows\System\QRZmbhy.exe
  C:\Windows\System\QRZmbhy.exe
  2⤵
  PID:7576
- C:\Windows\System\ecONLrK.exe
  C:\Windows\System\ecONLrK.exe
  2⤵
  PID:7496
- C:\Windows\System\OvdxNRu.exe
  C:\Windows\System\OvdxNRu.exe
  2⤵
  PID:7644
- C:\Windows\System\CfrFZJw.exe
  C:\Windows\System\CfrFZJw.exe
  2⤵
  PID:7648
- C:\Windows\System\brZDyLY.exe
  C:\Windows\System\brZDyLY.exe
  2⤵
  PID:7676
- C:\Windows\System\eRLWAVM.exe
  C:\Windows\System\eRLWAVM.exe
  2⤵
  PID:7632
- C:\Windows\System\KzPWivb.exe
  C:\Windows\System\KzPWivb.exe
  2⤵
  PID:7776
- C:\Windows\System\PkPfTrU.exe
  C:\Windows\System\PkPfTrU.exe
  2⤵
  PID:7692
- C:\Windows\System\sRKtfCS.exe
  C:\Windows\System\sRKtfCS.exe
  2⤵
  PID:7788
- C:\Windows\System\mtKcRJV.exe
  C:\Windows\System\mtKcRJV.exe
  2⤵
  PID:7660
- C:\Windows\System\EeuVYhY.exe
  C:\Windows\System\EeuVYhY.exe
  2⤵
  PID:7852
- C:\Windows\System\fNHQeHE.exe
  C:\Windows\System\fNHQeHE.exe
  2⤵
  PID:7876
- C:\Windows\System\lFXRMwA.exe
  C:\Windows\System\lFXRMwA.exe
  2⤵
  PID:7912
- C:\Windows\System\nyLDpPV.exe
  C:\Windows\System\nyLDpPV.exe
  2⤵
  PID:7944
- C:\Windows\System\huKXvqY.exe
  C:\Windows\System\huKXvqY.exe
  2⤵
  PID:8048
- C:\Windows\System\NKTeKdv.exe
  C:\Windows\System\NKTeKdv.exe
  2⤵
  PID:7968
- C:\Windows\System\MOfLbUK.exe
  C:\Windows\System\MOfLbUK.exe
  2⤵
  PID:8032
- C:\Windows\System\AkzgfMq.exe
  C:\Windows\System\AkzgfMq.exe
  2⤵
  PID:7932
- C:\Windows\System\IZucROv.exe
  C:\Windows\System\IZucROv.exe
  2⤵
  PID:8120
- C:\Windows\System\IPCAxzI.exe
  C:\Windows\System\IPCAxzI.exe
  2⤵
  PID:8152
- C:\Windows\System\QDZMRuG.exe
  C:\Windows\System\QDZMRuG.exe
  2⤵
  PID:8136
- C:\Windows\System\QlqTokp.exe
  C:\Windows\System\QlqTokp.exe
  2⤵
  PID:8184
- C:\Windows\System\eCtdUlC.exe
  C:\Windows\System\eCtdUlC.exe
  2⤵
  PID:7184
- C:\Windows\System\yboSBFo.exe
  C:\Windows\System\yboSBFo.exe
  2⤵
  PID:7212
- C:\Windows\System\aOtCPbf.exe
  C:\Windows\System\aOtCPbf.exe
  2⤵
  PID:7216
- C:\Windows\System\fXbxeKq.exe
  C:\Windows\System\fXbxeKq.exe
  2⤵
  PID:7384
- C:\Windows\System\VKBgscc.exe
  C:\Windows\System\VKBgscc.exe
  2⤵
  PID:7244
- C:\Windows\System\WLhCgeH.exe
  C:\Windows\System\WLhCgeH.exe
  2⤵
  PID:7432
- C:\Windows\System\wamvDSs.exe
  C:\Windows\System\wamvDSs.exe
  2⤵
  PID:7548
- C:\Windows\System\kOIIwXj.exe
  C:\Windows\System\kOIIwXj.exe
  2⤵
  PID:7500
- C:\Windows\System\faJCWhK.exe
  C:\Windows\System\faJCWhK.exe
  2⤵
  PID:7744
- C:\Windows\System\PresSpw.exe
  C:\Windows\System\PresSpw.exe
  2⤵
  PID:7608
- C:\Windows\System\jPSpKjk.exe
  C:\Windows\System\jPSpKjk.exe
  2⤵
  PID:7560
- C:\Windows\System\duQLcgY.exe
  C:\Windows\System\duQLcgY.exe
  2⤵
  PID:7868
- C:\Windows\System\psZFmQE.exe
  C:\Windows\System\psZFmQE.exe
  2⤵
  PID:7728
- C:\Windows\System\BYgfnEk.exe
  C:\Windows\System\BYgfnEk.exe
  2⤵
  PID:7884
- C:\Windows\System\kmqtJja.exe
  C:\Windows\System\kmqtJja.exe
  2⤵
  PID:8056
- C:\Windows\System\RShglzE.exe
  C:\Windows\System\RShglzE.exe
  2⤵
  PID:7996
- C:\Windows\System\nBSpvYR.exe
  C:\Windows\System\nBSpvYR.exe
  2⤵
  PID:8068
- C:\Windows\System\zcdECfa.exe
  C:\Windows\System\zcdECfa.exe
  2⤵
  PID:8104
- C:\Windows\System\LMeGPjF.exe
  C:\Windows\System\LMeGPjF.exe
  2⤵
  PID:7040
- C:\Windows\System\NTbdcAo.exe
  C:\Windows\System\NTbdcAo.exe
  2⤵
  PID:7240
- C:\Windows\System\cppvqEC.exe
  C:\Windows\System\cppvqEC.exe
  2⤵
  PID:7468
- C:\Windows\System\qwpyXkE.exe
  C:\Windows\System\qwpyXkE.exe
  2⤵
  PID:7368
- C:\Windows\System\gCroBfu.exe
  C:\Windows\System\gCroBfu.exe
  2⤵
  PID:8168
- C:\Windows\System\OxIQqFp.exe
  C:\Windows\System\OxIQqFp.exe
  2⤵
  PID:7320
- C:\Windows\System\JAPZZSi.exe
  C:\Windows\System\JAPZZSi.exe
  2⤵
  PID:7724
- C:\Windows\System\PnCAbrz.exe
  C:\Windows\System\PnCAbrz.exe
  2⤵
  PID:8016
- C:\Windows\System\gGVKqOl.exe
  C:\Windows\System\gGVKqOl.exe
  2⤵
  PID:1564
- C:\Windows\System\QBVMpTx.exe
  C:\Windows\System\QBVMpTx.exe
  2⤵
  PID:7064
- C:\Windows\System\eZvIRyE.exe
  C:\Windows\System\eZvIRyE.exe
  2⤵
  PID:7544
- C:\Windows\System\plOGmeF.exe
  C:\Windows\System\plOGmeF.exe
  2⤵
  PID:7484
- C:\Windows\System\ovmKPBx.exe
  C:\Windows\System\ovmKPBx.exe
  2⤵
  PID:8088
- C:\Windows\System\tekprwN.exe
  C:\Windows\System\tekprwN.exe
  2⤵
  PID:8072
- C:\Windows\System\nemzoms.exe
  C:\Windows\System\nemzoms.exe
  2⤵
  PID:7980
- C:\Windows\System\GHbfnPw.exe
  C:\Windows\System\GHbfnPw.exe
  2⤵
  PID:7820
- C:\Windows\System\OINFAPo.exe
  C:\Windows\System\OINFAPo.exe
  2⤵
  PID:8028
- C:\Windows\System\yFLqxNX.exe
  C:\Windows\System\yFLqxNX.exe
  2⤵
  PID:6304
- C:\Windows\System\tLNLZBI.exe
  C:\Windows\System\tLNLZBI.exe
  2⤵
  PID:8204
- C:\Windows\System\nwEiCXt.exe
  C:\Windows\System\nwEiCXt.exe
  2⤵
  PID:8220
- C:\Windows\System\NftPlwm.exe
  C:\Windows\System\NftPlwm.exe
  2⤵
  PID:8240
- C:\Windows\System\wZLCZGl.exe
  C:\Windows\System\wZLCZGl.exe
  2⤵
  PID:8260
- C:\Windows\System\rdiUMop.exe
  C:\Windows\System\rdiUMop.exe
  2⤵
  PID:8276
- C:\Windows\System\GOcurHP.exe
  C:\Windows\System\GOcurHP.exe
  2⤵
  PID:8292
- C:\Windows\System\poROSpF.exe
  C:\Windows\System\poROSpF.exe
  2⤵
  PID:8308
- C:\Windows\System\VCGkCYw.exe
  C:\Windows\System\VCGkCYw.exe
  2⤵
  PID:8324
- C:\Windows\System\rbeggJj.exe
  C:\Windows\System\rbeggJj.exe
  2⤵
  PID:8340
- C:\Windows\System\TFPqEwR.exe
  C:\Windows\System\TFPqEwR.exe
  2⤵
  PID:8356
- C:\Windows\System\APDKKaP.exe
  C:\Windows\System\APDKKaP.exe
  2⤵
  PID:8372
- C:\Windows\System\EOOGxUo.exe
  C:\Windows\System\EOOGxUo.exe
  2⤵
  PID:8388
- C:\Windows\System\RaNvoNt.exe
  C:\Windows\System\RaNvoNt.exe
  2⤵
  PID:8404
- C:\Windows\System\gQaaogm.exe
  C:\Windows\System\gQaaogm.exe
  2⤵
  PID:8420
- C:\Windows\System\OPowmew.exe
  C:\Windows\System\OPowmew.exe
  2⤵
  PID:8440
- C:\Windows\System\oBmZvJN.exe
  C:\Windows\System\oBmZvJN.exe
  2⤵
  PID:8456
- C:\Windows\System\DGgEcAM.exe
  C:\Windows\System\DGgEcAM.exe
  2⤵
  PID:8472
- C:\Windows\System\msHjvOW.exe
  C:\Windows\System\msHjvOW.exe
  2⤵
  PID:8488
- C:\Windows\System\ftOiodB.exe
  C:\Windows\System\ftOiodB.exe
  2⤵
  PID:8504
- C:\Windows\System\xbMBxxe.exe
  C:\Windows\System\xbMBxxe.exe
  2⤵
  PID:8520
- C:\Windows\System\dPOGOIa.exe
  C:\Windows\System\dPOGOIa.exe
  2⤵
  PID:8536
- C:\Windows\System\EBOhMXK.exe
  C:\Windows\System\EBOhMXK.exe
  2⤵
  PID:8552
- C:\Windows\System\cTOVYxW.exe
  C:\Windows\System\cTOVYxW.exe
  2⤵
  PID:8568
- C:\Windows\System\QAhSZLd.exe
  C:\Windows\System\QAhSZLd.exe
  2⤵
  PID:8584
- C:\Windows\System\vpUltbH.exe
  C:\Windows\System\vpUltbH.exe
  2⤵
  PID:8600
- C:\Windows\System\FqJdbVr.exe
  C:\Windows\System\FqJdbVr.exe
  2⤵
  PID:8616
- C:\Windows\System\EeNKHgp.exe
  C:\Windows\System\EeNKHgp.exe
  2⤵
  PID:8632
- C:\Windows\System\ZoWizVJ.exe
  C:\Windows\System\ZoWizVJ.exe
  2⤵
  PID:8648
- C:\Windows\System\LvJImBC.exe
  C:\Windows\System\LvJImBC.exe
  2⤵
  PID:8672
- C:\Windows\System\NFkbvwZ.exe
  C:\Windows\System\NFkbvwZ.exe
  2⤵
  PID:8692
- C:\Windows\System\UBuwqCj.exe
  C:\Windows\System\UBuwqCj.exe
  2⤵
  PID:8708
- C:\Windows\System\dHlMKff.exe
  C:\Windows\System\dHlMKff.exe
  2⤵
  PID:8724
- C:\Windows\System\ZnznNLN.exe
  C:\Windows\System\ZnznNLN.exe
  2⤵
  PID:8740
- C:\Windows\System\vxxyOsH.exe
  C:\Windows\System\vxxyOsH.exe
  2⤵
  PID:8756
- C:\Windows\System\OtvgyDe.exe
  C:\Windows\System\OtvgyDe.exe
  2⤵
  PID:8772
- C:\Windows\System\QomBOqq.exe
  C:\Windows\System\QomBOqq.exe
  2⤵
  PID:8788
- C:\Windows\System\fEzrrcA.exe
  C:\Windows\System\fEzrrcA.exe
  2⤵
  PID:8804
- C:\Windows\System\JkQzqhQ.exe
  C:\Windows\System\JkQzqhQ.exe
  2⤵
  PID:8820
- C:\Windows\System\dqdTDTW.exe
  C:\Windows\System\dqdTDTW.exe
  2⤵
  PID:8836
- C:\Windows\System\PGwesHv.exe
  C:\Windows\System\PGwesHv.exe
  2⤵
  PID:8932
- C:\Windows\System\MgtqlFd.exe
  C:\Windows\System\MgtqlFd.exe
  2⤵
  PID:8948
- C:\Windows\System\hecgQGr.exe
  C:\Windows\System\hecgQGr.exe
  2⤵
  PID:8968
- C:\Windows\System\NhZVXuv.exe
  C:\Windows\System\NhZVXuv.exe
  2⤵
  PID:8988
- C:\Windows\System\zlNkANW.exe
  C:\Windows\System\zlNkANW.exe
  2⤵
  PID:9004
- C:\Windows\System\uGMpuol.exe
  C:\Windows\System\uGMpuol.exe
  2⤵
  PID:9020
- C:\Windows\System\yxLpeyg.exe
  C:\Windows\System\yxLpeyg.exe
  2⤵
  PID:9036
- C:\Windows\System\sfQAnio.exe
  C:\Windows\System\sfQAnio.exe
  2⤵
  PID:9052
- C:\Windows\System\VyFPtkT.exe
  C:\Windows\System\VyFPtkT.exe
  2⤵
  PID:9068
- C:\Windows\System\wgAuoCs.exe
  C:\Windows\System\wgAuoCs.exe
  2⤵
  PID:9084
- C:\Windows\System\WSfcSbO.exe
  C:\Windows\System\WSfcSbO.exe
  2⤵
  PID:9100
- C:\Windows\System\BeVcpxD.exe
  C:\Windows\System\BeVcpxD.exe
  2⤵
  PID:9116
- C:\Windows\System\izhWKva.exe
  C:\Windows\System\izhWKva.exe
  2⤵
  PID:9132
- C:\Windows\System\vlseKsL.exe
  C:\Windows\System\vlseKsL.exe
  2⤵
  PID:9148
- C:\Windows\System\PQPxmgt.exe
  C:\Windows\System\PQPxmgt.exe
  2⤵
  PID:9164
- C:\Windows\System\CNmyWrU.exe
  C:\Windows\System\CNmyWrU.exe
  2⤵
  PID:9180
- C:\Windows\System\nrUGkgq.exe
  C:\Windows\System\nrUGkgq.exe
  2⤵
  PID:9196
- C:\Windows\System\cKoghBj.exe
  C:\Windows\System\cKoghBj.exe
  2⤵
  PID:9212
- C:\Windows\System\CppXFaB.exe
  C:\Windows\System\CppXFaB.exe
  2⤵
  PID:7372
- C:\Windows\System\EELpOem.exe
  C:\Windows\System\EELpOem.exe
  2⤵
  PID:8236
- C:\Windows\System\TXZhsFj.exe
  C:\Windows\System\TXZhsFj.exe
  2⤵
  PID:8268
- C:\Windows\System\CAjyXMd.exe
  C:\Windows\System\CAjyXMd.exe
  2⤵
  PID:8272
- C:\Windows\System\oVBHUbJ.exe
  C:\Windows\System\oVBHUbJ.exe
  2⤵
  PID:8304
- C:\Windows\System\cRSmLMB.exe
  C:\Windows\System\cRSmLMB.exe
  2⤵
  PID:8364
- C:\Windows\System\CVcbkyD.exe
  C:\Windows\System\CVcbkyD.exe
  2⤵
  PID:8428
- C:\Windows\System\JSQADIg.exe
  C:\Windows\System\JSQADIg.exe
  2⤵
  PID:8416
- C:\Windows\System\BtCreqF.exe
  C:\Windows\System\BtCreqF.exe
  2⤵
  PID:8432
- C:\Windows\System\NLFHXWg.exe
  C:\Windows\System\NLFHXWg.exe
  2⤵
  PID:8496
- C:\Windows\System\OoYCiiV.exe
  C:\Windows\System\OoYCiiV.exe
  2⤵
  PID:8560
- C:\Windows\System\BaRivPf.exe
  C:\Windows\System\BaRivPf.exe
  2⤵
  PID:8516
- C:\Windows\System\wmaasXt.exe
  C:\Windows\System\wmaasXt.exe
  2⤵
  PID:8448
- C:\Windows\System\AbKxmyb.exe
  C:\Windows\System\AbKxmyb.exe
  2⤵
  PID:8608
- C:\Windows\System\moWbayc.exe
  C:\Windows\System\moWbayc.exe
  2⤵
  PID:8628
- C:\Windows\System\gjdUfzL.exe
  C:\Windows\System\gjdUfzL.exe
  2⤵
  PID:8660
- C:\Windows\System\OpcgFRZ.exe
  C:\Windows\System\OpcgFRZ.exe
  2⤵
  PID:8680
- C:\Windows\System\RgTuknq.exe
  C:\Windows\System\RgTuknq.exe
  2⤵
  PID:8704
- C:\Windows\System\fvibKVt.exe
  C:\Windows\System\fvibKVt.exe
  2⤵
  PID:8736
- C:\Windows\System\QMrHsHP.exe
  C:\Windows\System\QMrHsHP.exe
  2⤵
  PID:8796
- C:\Windows\System\JVLKYwU.exe
  C:\Windows\System\JVLKYwU.exe
  2⤵
  PID:8752
- C:\Windows\System\uDDeivB.exe
  C:\Windows\System\uDDeivB.exe
  2⤵
  PID:8816
- C:\Windows\System\aQTBmZz.exe
  C:\Windows\System\aQTBmZz.exe
  2⤵
  PID:8856
- C:\Windows\System\TDNvUBr.exe
  C:\Windows\System\TDNvUBr.exe
  2⤵
  PID:8872
- C:\Windows\System\PeKrZOe.exe
  C:\Windows\System\PeKrZOe.exe
  2⤵
  PID:8892
- C:\Windows\System\mufFHkh.exe
  C:\Windows\System\mufFHkh.exe
  2⤵
  PID:8908
- C:\Windows\System\IpzCVpe.exe
  C:\Windows\System\IpzCVpe.exe
  2⤵
  PID:8984
- C:\Windows\System\FvlxBTW.exe
  C:\Windows\System\FvlxBTW.exe
  2⤵
  PID:8920
- C:\Windows\System\QpAbVLW.exe
  C:\Windows\System\QpAbVLW.exe
  2⤵
  PID:8960
- C:\Windows\System\cKoaHvE.exe
  C:\Windows\System\cKoaHvE.exe
  2⤵
  PID:9000
- C:\Windows\System\STkAdDP.exe
  C:\Windows\System\STkAdDP.exe
  2⤵
  PID:9032
- C:\Windows\System\fvDccHO.exe
  C:\Windows\System\fvDccHO.exe
  2⤵
  PID:9080
- C:\Windows\System\dDZtjPZ.exe
  C:\Windows\System\dDZtjPZ.exe
  2⤵
  PID:9108
- C:\Windows\System\xFflXEs.exe
  C:\Windows\System\xFflXEs.exe
  2⤵
  PID:9128
- C:\Windows\System\PXkrpJp.exe
  C:\Windows\System\PXkrpJp.exe
  2⤵
  PID:9160
- C:\Windows\System\KvCTxVJ.exe
  C:\Windows\System\KvCTxVJ.exe
  2⤵
  PID:9204
- C:\Windows\System\tLNOXNd.exe
  C:\Windows\System\tLNOXNd.exe
  2⤵
  PID:8216
- C:\Windows\System\RvbRVFV.exe
  C:\Windows\System\RvbRVFV.exe
  2⤵
  PID:8300
- C:\Windows\System\CCIawha.exe
  C:\Windows\System\CCIawha.exe
  2⤵
  PID:8624
- C:\Windows\System\aQDVxJn.exe
  C:\Windows\System\aQDVxJn.exe
  2⤵
  PID:8768
- C:\Windows\System\qlMNcwW.exe
  C:\Windows\System\qlMNcwW.exe
  2⤵
  PID:8716
- C:\Windows\System\qVavgqM.exe
  C:\Windows\System\qVavgqM.exe
  2⤵
  PID:8848
- C:\Windows\System\CvCAewi.exe
  C:\Windows\System\CvCAewi.exe
  2⤵
  PID:8904
- C:\Windows\System\qtoLtLN.exe
  C:\Windows\System\qtoLtLN.exe
  2⤵
  PID:8996
- C:\Windows\System\ASLsgUf.exe
  C:\Windows\System\ASLsgUf.exe
  2⤵
  PID:8944
- C:\Windows\System\CzcxiQf.exe
  C:\Windows\System\CzcxiQf.exe
  2⤵
  PID:8916
- C:\Windows\System\EBkkdPA.exe
  C:\Windows\System\EBkkdPA.exe
  2⤵
  PID:9124
- C:\Windows\System\EUjenca.exe
  C:\Windows\System\EUjenca.exe
  2⤵
  PID:9156
- C:\Windows\System\gANllFk.exe
  C:\Windows\System\gANllFk.exe
  2⤵
  PID:8248
- C:\Windows\System\nMmWjqc.exe
  C:\Windows\System\nMmWjqc.exe
  2⤵
  PID:8320
- C:\Windows\System\voKuaWU.exe
  C:\Windows\System\voKuaWU.exe
  2⤵
  PID:8464
- C:\Windows\System\MdOUusX.exe
  C:\Windows\System\MdOUusX.exe
  2⤵
  PID:8592
- C:\Windows\System\CGKAJnx.exe
  C:\Windows\System\CGKAJnx.exe
  2⤵
  PID:8596
- C:\Windows\System\AcLSDNi.exe
  C:\Windows\System\AcLSDNi.exe
  2⤵
  PID:8564
- C:\Windows\System\QkkqbVU.exe
  C:\Windows\System\QkkqbVU.exe
  2⤵
  PID:8828
- C:\Windows\System\ZrarCfR.exe
  C:\Windows\System\ZrarCfR.exe
  2⤵
  PID:8924
- C:\Windows\System\ZzpVbIN.exe
  C:\Windows\System\ZzpVbIN.exe
  2⤵
  PID:9060
- C:\Windows\System\uvhBnWI.exe
  C:\Windows\System\uvhBnWI.exe
  2⤵
  PID:8288
- C:\Windows\System\EdbNdVm.exe
  C:\Windows\System\EdbNdVm.exe
  2⤵
  PID:8868
- C:\Windows\System\PkqDkHa.exe
  C:\Windows\System\PkqDkHa.exe
  2⤵
  PID:8512
- C:\Windows\System\XuCLIPb.exe
  C:\Windows\System\XuCLIPb.exe
  2⤵
  PID:8396
- C:\Windows\System\TgmBbVd.exe
  C:\Windows\System\TgmBbVd.exe
  2⤵
  PID:8860
- C:\Windows\System\ZwLQsKV.exe
  C:\Windows\System\ZwLQsKV.exe
  2⤵
  PID:8580
- C:\Windows\System\TQSBwyD.exe
  C:\Windows\System\TQSBwyD.exe
  2⤵
  PID:8888
- C:\Windows\System\aAFfSbn.exe
  C:\Windows\System\aAFfSbn.exe
  2⤵
  PID:9188
- C:\Windows\System\KhyCgxz.exe
  C:\Windows\System\KhyCgxz.exe
  2⤵
  PID:8528
- C:\Windows\System\KhofjMG.exe
  C:\Windows\System\KhofjMG.exe
  2⤵
  PID:8748
- C:\Windows\System\ZRoJKbl.exe
  C:\Windows\System\ZRoJKbl.exe
  2⤵
  PID:8252
- C:\Windows\System\ukWRkKS.exe
  C:\Windows\System\ukWRkKS.exe
  2⤵
  PID:8884
- C:\Windows\System\IYIvfNE.exe
  C:\Windows\System\IYIvfNE.exe
  2⤵
  PID:8688
- C:\Windows\System\xcVLMcc.exe
  C:\Windows\System\xcVLMcc.exe
  2⤵
  PID:9232
- C:\Windows\System\PhZuphL.exe
  C:\Windows\System\PhZuphL.exe
  2⤵
  PID:9252
- C:\Windows\System\CxIUjlb.exe
  C:\Windows\System\CxIUjlb.exe
  2⤵
  PID:9280
- C:\Windows\System\TjHRlri.exe
  C:\Windows\System\TjHRlri.exe
  2⤵
  PID:9296
- C:\Windows\System\OLvTWtE.exe
  C:\Windows\System\OLvTWtE.exe
  2⤵
  PID:9316
- C:\Windows\System\FKRlszC.exe
  C:\Windows\System\FKRlszC.exe
  2⤵
  PID:9336
- C:\Windows\System\cCqXYtz.exe
  C:\Windows\System\cCqXYtz.exe
  2⤵
  PID:9352
- C:\Windows\System\PvjZjHO.exe
  C:\Windows\System\PvjZjHO.exe
  2⤵
  PID:9372
- C:\Windows\System\HAiBsUv.exe
  C:\Windows\System\HAiBsUv.exe
  2⤵
  PID:9392
- C:\Windows\System\rESasYI.exe
  C:\Windows\System\rESasYI.exe
  2⤵
  PID:9416
- C:\Windows\System\JXokran.exe
  C:\Windows\System\JXokran.exe
  2⤵
  PID:9432
- C:\Windows\System\cqmYGDp.exe
  C:\Windows\System\cqmYGDp.exe
  2⤵
  PID:9448
- C:\Windows\System\LRFSJOd.exe
  C:\Windows\System\LRFSJOd.exe
  2⤵
  PID:9468
- C:\Windows\System\qlBqhpa.exe
  C:\Windows\System\qlBqhpa.exe
  2⤵
  PID:9488
- C:\Windows\System\IXWMGOZ.exe
  C:\Windows\System\IXWMGOZ.exe
  2⤵
  PID:9528
- C:\Windows\System\FGpIPBT.exe
  C:\Windows\System\FGpIPBT.exe
  2⤵
  PID:9544
- C:\Windows\System\eFUNnHr.exe
  C:\Windows\System\eFUNnHr.exe
  2⤵
  PID:9560
- C:\Windows\System\khbRghS.exe
  C:\Windows\System\khbRghS.exe
  2⤵
  PID:9576
- C:\Windows\System\kqSOEDh.exe
  C:\Windows\System\kqSOEDh.exe
  2⤵
  PID:9592
- C:\Windows\System\uXqhGLy.exe
  C:\Windows\System\uXqhGLy.exe
  2⤵
  PID:9608
- C:\Windows\System\cbFcvLX.exe
  C:\Windows\System\cbFcvLX.exe
  2⤵
  PID:9624
- C:\Windows\System\DOpruSA.exe
  C:\Windows\System\DOpruSA.exe
  2⤵
  PID:9640
- C:\Windows\System\gtwFlSa.exe
  C:\Windows\System\gtwFlSa.exe
  2⤵
  PID:9656
- C:\Windows\System\mDPLGGI.exe
  C:\Windows\System\mDPLGGI.exe
  2⤵
  PID:9672
- C:\Windows\System\gRnFGPT.exe
  C:\Windows\System\gRnFGPT.exe
  2⤵
  PID:9688
- C:\Windows\System\stRcLma.exe
  C:\Windows\System\stRcLma.exe
  2⤵
  PID:9704
- C:\Windows\System\BEwpJKM.exe
  C:\Windows\System\BEwpJKM.exe
  2⤵
  PID:9720
- C:\Windows\System\LFDTPjT.exe
  C:\Windows\System\LFDTPjT.exe
  2⤵
  PID:9736
- C:\Windows\System\PfMRCkJ.exe
  C:\Windows\System\PfMRCkJ.exe
  2⤵
  PID:9752
- C:\Windows\System\MlbReiF.exe
  C:\Windows\System\MlbReiF.exe
  2⤵
  PID:9768
- C:\Windows\System\iugWfdu.exe
  C:\Windows\System\iugWfdu.exe
  2⤵
  PID:9784
- C:\Windows\System\xYliGIW.exe
  C:\Windows\System\xYliGIW.exe
  2⤵
  PID:9800
- C:\Windows\System\ykzgegz.exe
  C:\Windows\System\ykzgegz.exe
  2⤵
  PID:9816
- C:\Windows\System\xaikUmw.exe
  C:\Windows\System\xaikUmw.exe
  2⤵
  PID:9836
- C:\Windows\System\xAQYAPb.exe
  C:\Windows\System\xAQYAPb.exe
  2⤵
  PID:9852
- C:\Windows\System\Cagkasq.exe
  C:\Windows\System\Cagkasq.exe
  2⤵
  PID:9868
- C:\Windows\System\AfIcJAJ.exe
  C:\Windows\System\AfIcJAJ.exe
  2⤵
  PID:9884
- C:\Windows\System\UMingQv.exe
  C:\Windows\System\UMingQv.exe
  2⤵
  PID:9900
- C:\Windows\System\kMceuic.exe
  C:\Windows\System\kMceuic.exe
  2⤵
  PID:9916
- C:\Windows\System\jrCuyWZ.exe
  C:\Windows\System\jrCuyWZ.exe
  2⤵
  PID:9932
- C:\Windows\System\YOwyzQE.exe
  C:\Windows\System\YOwyzQE.exe
  2⤵
  PID:9948
- C:\Windows\System\CWDqAGq.exe
  C:\Windows\System\CWDqAGq.exe
  2⤵
  PID:9964
- C:\Windows\System\CgmGvMz.exe
  C:\Windows\System\CgmGvMz.exe
  2⤵
  PID:9980
- C:\Windows\System\vAOJqOl.exe
  C:\Windows\System\vAOJqOl.exe
  2⤵
  PID:9996
- C:\Windows\System\kFGaXVv.exe
  C:\Windows\System\kFGaXVv.exe
  2⤵
  PID:10012
- C:\Windows\System\pbAIoaD.exe
  C:\Windows\System\pbAIoaD.exe
  2⤵
  PID:10028
- C:\Windows\System\QdYRjeP.exe
  C:\Windows\System\QdYRjeP.exe
  2⤵
  PID:10044
- C:\Windows\System\nNVcVpO.exe
  C:\Windows\System\nNVcVpO.exe
  2⤵
  PID:10060
- C:\Windows\System\mULrebo.exe
  C:\Windows\System\mULrebo.exe
  2⤵
  PID:10076
- C:\Windows\System\CHJxGiT.exe
  C:\Windows\System\CHJxGiT.exe
  2⤵
  PID:10092
- C:\Windows\System\YGrulhG.exe
  C:\Windows\System\YGrulhG.exe
  2⤵
  PID:10108
- C:\Windows\System\ZRvhVWZ.exe
  C:\Windows\System\ZRvhVWZ.exe
  2⤵
  PID:10124
- C:\Windows\System\rzoqTtX.exe
  C:\Windows\System\rzoqTtX.exe
  2⤵
  PID:10140
- C:\Windows\System\fmkfcXI.exe
  C:\Windows\System\fmkfcXI.exe
  2⤵
  PID:10156
- C:\Windows\System\oZreKdh.exe
  C:\Windows\System\oZreKdh.exe
  2⤵
  PID:10172
- C:\Windows\System\nxTEBEN.exe
  C:\Windows\System\nxTEBEN.exe
  2⤵
  PID:10188
- C:\Windows\System\mjSNJNa.exe
  C:\Windows\System\mjSNJNa.exe
  2⤵
  PID:10204
- C:\Windows\System\uOzJRSr.exe
  C:\Windows\System\uOzJRSr.exe
  2⤵
  PID:10220
- C:\Windows\System\pasqAEo.exe
  C:\Windows\System\pasqAEo.exe
  2⤵
  PID:10236
- C:\Windows\System\UfLgxHo.exe
  C:\Windows\System\UfLgxHo.exe
  2⤵
  PID:8412
- C:\Windows\System\WnNWGmM.exe
  C:\Windows\System\WnNWGmM.exe
  2⤵
  PID:9228
- C:\Windows\System\fNxPbOO.exe
  C:\Windows\System\fNxPbOO.exe
  2⤵
  PID:9268
- C:\Windows\System\uroEDrP.exe
  C:\Windows\System\uroEDrP.exe
  2⤵
  PID:9328
- C:\Windows\System\EiyEUPC.exe
  C:\Windows\System\EiyEUPC.exe
  2⤵
  PID:9360
- C:\Windows\System\SpCGmHE.exe
  C:\Windows\System\SpCGmHE.exe
  2⤵
  PID:9400
- C:\Windows\System\rhhuhpb.exe
  C:\Windows\System\rhhuhpb.exe
  2⤵
  PID:9304
- C:\Windows\System\KbihlmT.exe
  C:\Windows\System\KbihlmT.exe
  2⤵
  PID:9344
- C:\Windows\System\CkMBOeU.exe
  C:\Windows\System\CkMBOeU.exe
  2⤵
  PID:9312
- C:\Windows\System\DngSpDs.exe
  C:\Windows\System\DngSpDs.exe
  2⤵
  PID:9424
- C:\Windows\System\RNJzFYc.exe
  C:\Windows\System\RNJzFYc.exe
  2⤵
  PID:9384
- C:\Windows\System\gGlCHKN.exe
  C:\Windows\System\gGlCHKN.exe
  2⤵
  PID:9504
- C:\Windows\System\VHHwqhM.exe
  C:\Windows\System\VHHwqhM.exe
  2⤵
  PID:9524
- C:\Windows\System\rHabOyD.exe
  C:\Windows\System\rHabOyD.exe
  2⤵
  PID:9556
- C:\Windows\System\ThKihsN.exe
  C:\Windows\System\ThKihsN.exe
  2⤵
  PID:9588
- C:\Windows\System\PVdlyvP.exe
  C:\Windows\System\PVdlyvP.exe
  2⤵
  PID:9620
- C:\Windows\System\IMTfrqt.exe
  C:\Windows\System\IMTfrqt.exe
  2⤵
  PID:9668
- C:\Windows\System\UQFjYsG.exe
  C:\Windows\System\UQFjYsG.exe
  2⤵
  PID:9728
- C:\Windows\System\GknBndr.exe
  C:\Windows\System\GknBndr.exe
  2⤵
  PID:9680
- C:\Windows\System\AmGnwvr.exe
  C:\Windows\System\AmGnwvr.exe
  2⤵
  PID:9684
- C:\Windows\System\IkcyebI.exe
  C:\Windows\System\IkcyebI.exe
  2⤵
  PID:9808
- C:\Windows\System\udRxgRG.exe
  C:\Windows\System\udRxgRG.exe
  2⤵
  PID:9776
- C:\Windows\System\jHUAGYe.exe
  C:\Windows\System\jHUAGYe.exe
  2⤵
  PID:9876
- C:\Windows\System\gViFxkt.exe
  C:\Windows\System\gViFxkt.exe
  2⤵
  PID:9940
- C:\Windows\System\ndXvbjb.exe
  C:\Windows\System\ndXvbjb.exe
  2⤵
  PID:9864
- C:\Windows\System\BmYnFhQ.exe
  C:\Windows\System\BmYnFhQ.exe
  2⤵
  PID:9960
- C:\Windows\System\gTJpUaE.exe
  C:\Windows\System\gTJpUaE.exe
  2⤵
  PID:9972
- C:\Windows\System\SKuSgbL.exe
  C:\Windows\System\SKuSgbL.exe
  2⤵
  PID:10084
- C:\Windows\System\snSMjJL.exe
  C:\Windows\System\snSMjJL.exe
  2⤵
  PID:10008
- C:\Windows\System\QaPmXEt.exe
  C:\Windows\System\QaPmXEt.exe
  2⤵
  PID:10088
- C:\Windows\System\eblOQPq.exe
  C:\Windows\System\eblOQPq.exe
  2⤵
  PID:10148
- C:\Windows\System\LHoUnqu.exe
  C:\Windows\System\LHoUnqu.exe
  2⤵
  PID:10180
- C:\Windows\System\mRRyBMW.exe
  C:\Windows\System\mRRyBMW.exe
  2⤵
  PID:10212
- C:\Windows\System\voatfJK.exe
  C:\Windows\System\voatfJK.exe
  2⤵
  PID:10196
- C:\Windows\System\WJwPXrY.exe
  C:\Windows\System\WJwPXrY.exe
  2⤵
  PID:10200
- C:\Windows\System\dSasZzf.exe
  C:\Windows\System\dSasZzf.exe
  2⤵
  PID:9324
- C:\Windows\System\hPWWLRc.exe
  C:\Windows\System\hPWWLRc.exe
  2⤵
  PID:9428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AjYzhdG.exe

Filesize
1.7MB

MD5
da5e907be413854fea8e8927df54e7dc

SHA1
f63ec69e8b16c193241b2817dd96ea033a1ae3ab

SHA256
187407f291d262faf4bffd776a3f39c487bec0b9a010d771285cd42122712037

SHA512
9f12f3104b78083007197db4d1ff822cccde2ad3c0d068150ad748da6b91c6b42ea4a9e13bd91d7bd7b71202832d03d67808106089928ac5ea0a17e4d113f2a3

Download Submit
C:\Windows\system\BPalZQP.exe

Filesize
1.7MB

MD5
570bb000d6212e9a3c7af371c95d22d6

SHA1
207536181dfb591780f9c062adf82798824db10e

SHA256
f20254881ea6952466cb432f367b19473c95368ae39c380f8b855074110d42b4

SHA512
d7f39e4eddd8f6e12cbecc3461bf8545e1f1a32e8ac75a539658a53e2ca44d3e377fad8f2075028b93b75a48ddb9b5510cb41110625751aeb06e7f1f6ac4fcea

Download Submit
C:\Windows\system\FiwmgIJ.exe

Filesize
1.7MB

MD5
0333dc4d65b71690ca98e68db61bf582

SHA1
eaa1043da3b74c75d786ad1a03a361ae58a44542

SHA256
bda584cb787ec219cab1373b9db186b8b0dd7e49aa7e6cedb535ec3f95f1db7a

SHA512
1a999a1b1f6f9a30981d253b04290afebb63d6be4d3f3d42b080744277fdfb19ff759dce6cd14186b6e1170554293507fe92a7b799fab1b6a2358236c89da31e

Download Submit
C:\Windows\system\HnimUrH.exe

Filesize
1.7MB

MD5
faf537cbe98fa2c434233afb45da4823

SHA1
a583ae428923dfbaf75784e0f9e0134a11f41d96

SHA256
375d563d5dbb82e046738314fde1b7f2a74065dc9619201060a6e4681ad732e8

SHA512
b180ff135b49a68bed2a2ef718b2397db970a9a93ed92f13f6c8cb2a18e871224409649085e30456a5f9ad1dfe7aa150238694cc3015debf71322f0495314d2f

Download Submit
C:\Windows\system\JwmsJla.exe

Filesize
1.7MB

MD5
e365fff992cacd5326947922b485a78a

SHA1
2b3aa51d0f1a05bde6f29ed4f351af8917bc6012

SHA256
fcef807c8e566ab9647a2531d0440d1cb770e06f97ca434a036724adec3adff1

SHA512
cbec6610dd6572db1bea4eef74e12006791052ae5f32df475e89791e5df47cbec92efb003ed9de7fee57f1cb76b3dee321102861fc727e655c0cbbcf323f5e8b

Download Submit
C:\Windows\system\LgEpSDH.exe

Filesize
1.7MB

MD5
70e93df4c45878bb6f01e9776b875f30

SHA1
46757083d501bfa616beb7b5234f6abc4474cb64

SHA256
1bb78bebabcf363f353d5fb4cd35800c08218fd78524db2b6e17593c7aac91b3

SHA512
6b3a7563df7860b4dc45fa8eb8eaeefb53a733776b51930ccf0c6cba05331853eb6ddca1affe7c246bffe360493f688a435dd1796d51b2face94df39eccb9783

Download Submit
C:\Windows\system\MSvHfsu.exe

Filesize
1.7MB

MD5
13cfc1bbfabf8379166415e7809ed269

SHA1
8ced1daa24dece31f9437bf96edcf06c3a07d821

SHA256
12aea2bfa6eb85b814e6bda8a283a0ce46ce51f62455099041b425c53abfd733

SHA512
0074a2052819ae18f0e1c1c3ff9737325995fe5a959e69252836df1f2128b5fcfb400fc393ac6d0f324efe24426e22080728d1863b91747429e8584365a4d21a

Download Submit
C:\Windows\system\OWGNWuq.exe

Filesize
1.7MB

MD5
102703514d312807dfe15d11050ea417

SHA1
53046a50448c7a34134eb93355212f1621867ea7

SHA256
97cfb37aed7032caa47e0c10b6cb0108dccded7bcb6e9fe97fdc507139e5ab28

SHA512
0d0b54eabc8becbdedb1658a6fbd306adcaf14ede6c2b7c884e34b149f3cc308c06d42011115a9176b9aaa4f402e4fb2c542d3fa3da7bc9c79bec9d41236f833

Download Submit
C:\Windows\system\RBpLQUT.exe

Filesize
1.7MB

MD5
8f337ee4fc25d0a543a79e321168229a

SHA1
23edef8f2ed1a335ba9f8b61a5549503b9e4a587

SHA256
c00292218a479f9775c7f866dc1f37ae42f483fdbbb4835dbc8df77cae521328

SHA512
dd7d340977479317839f74f0a37cd42534412f818548df3514ea58519a49b91d4f5fbe3e5ffea80585019944b18fb301ffe3c11d2f37bb616f9c4fed236a99ed

Download Submit
C:\Windows\system\STfhglc.exe

Filesize
1.7MB

MD5
82b00bbcc0d7d2fd332115e50214b0c2

SHA1
ec215b0fb3590b5a8dc7c2fda33f5f8bcdab4926

SHA256
b1ea835e92dc26b73b35337a41ecec61708158f18bd23ff1a052d412436a2718

SHA512
5bfa80147f56978e4cd61a83093b1687e26e7de360bd7eb177b116fb5c75f5d136ebfee186d58246def6c17c7b2f41c950f48019fbf2094d9c7d33b2c36049fe

Download Submit
C:\Windows\system\TBAsYnN.exe

Filesize
1.7MB

MD5
d1ffafa1f7d86289ee157a3c61e13dda

SHA1
6000ed228e9e1e7e77bd1c25131725f74857842f

SHA256
b5e9a6395d6f7f3e00545c42e0ef397ef4d68df77f2dbb0a74d580aa0eb05b3e

SHA512
83c82cd045ca92a4ba357abfef1e0684aebd5d6a4ab95350daa9607f9f31ca8206595cc462e37d631525254e4e968f6971f2436fc99163e51e0210f1ea0977a4

Download Submit
C:\Windows\system\TqmrFmd.exe

Filesize
8B

MD5
f691a081f3fbc76f4d31ef7de17a6701

SHA1
c2f76e341f16e6acb16a6ddc45ff81004b3276d6

SHA256
450bfe715b4ccd0a120f80318a52bca1da767f73da444842c593d2dc3aa52f90

SHA512
f6ca059bd1fe81cd2b89f4a60769b80b184c327ad9125f03a3fb647cc5bd867822450e2063331cf912047a4388326ba03f9c0aa4adbfe96890a979115d876404

Download Submit
C:\Windows\system\UaGPtwm.exe

Filesize
1.7MB

MD5
32145cd6f674a5cd90b899e27c235044

SHA1
c475e7733cf2ababd6899f798aa8be6853a827e3

SHA256
070996e71e99b649486a5a16e76c05a3fadefcf9b5ab639782be3ff3e9580223

SHA512
ceb2d32b29498bc9e5c4523b6951e6dfd4e1e6e77cc3c2e2d1297c2f5a47bf312711aed4f59a3683e3379eb6db8dcf03befaf4c9e170ddbab6b86402819f9916

Download Submit
C:\Windows\system\VIqiKHn.exe

Filesize
1.7MB

MD5
355750d9597b871d11a5fddef75e7552

SHA1
bf1b04f499c6aa30a13796df267a73a4f86f67de

SHA256
9a82e617b4a9c2c0c8cef9094e011c1966567a4d50039780bba0209c71a87c49

SHA512
65bb5851e6f56e4ab2ae1a94dec3f1e12a8d7c4364228679a710121b2169ce7dd6effeb23af0f07c9324f812a8391c70bccfce80165761366ae9d478e67b0024

Download Submit
C:\Windows\system\WYoeklS.exe

Filesize
1.7MB

MD5
7dabda4fda7dd192566f43da93d66aac

SHA1
ec2ec62f3e0c444ba7a038baddd550ec64111592

SHA256
82b10fac86f665c40daff85ffedc258ceb2a3573a3a55a0025c5ca4717aba039

SHA512
53231f7693923367ba0d872e0387ee6c1b1bd3c0a347675ceb4cd26242723e2734c87b0c051d7615961eae569bcf9ae17936518e69381061cc587994d016d949

Download Submit
C:\Windows\system\YEUZUHY.exe

Filesize
1.7MB

MD5
1b26e9525aac43eb72d1dd881a1b07f0

SHA1
6bd510018d7373b31f2d22f5f8d0cebe3721d778

SHA256
7501c7d23791c97ee873d4fe7d0597469825d6fb56e6b36b64fdf60b8ba41670

SHA512
4493f3696ad7dae2bb8b783ec2109f3c4eafd992c3311f81bb3486176f1dfd212584812bc5eaee03f32e39a9e3f758ba9f97d0607f358c5131adca32377088a4

Download Submit
C:\Windows\system\bsEvGos.exe

Filesize
1.7MB

MD5
1dfbba3c3a0bb908b1e42f759f78a39d

SHA1
54e87436c31e651c8fd11271d221972278b7917d

SHA256
1769ca204126bc95fa73f99a6e9ad04cdc5e6bc85aa0fa829e3e3c3a9cdd7db9

SHA512
bb777e462b9d2d3d15af557bdca05ad3ff7933832f04868eb216d0674cd04b05c6cdf34ba64d346cc249bb9bf4cae4cd936fa3c587dbedb23750a559ad095a8b

Download Submit
C:\Windows\system\cShnCql.exe

Filesize
1.7MB

MD5
230ab2e862a6af0336ebfe246a314da7

SHA1
11f847b15428bbc4efc5319046609c2c7e5ca7ad

SHA256
fe194bac0251b03318cbe305e26d96c94228bddcdacda485b102828eee9f3356

SHA512
5a2a74e0d6803f6b8b2bc6e2e90987987ee03c01f32424e459d6fcf89838a341cc2ead1ec7ba052a432a2422648ed99fb9408eeae771fc67edd41796c8082dce

Download Submit
C:\Windows\system\dTlacdy.exe

Filesize
1.7MB

MD5
7806a1399dbde146564a06ab5f8236fd

SHA1
425fe120f6465fbc6042bda48e679d797496c40f

SHA256
ae67fcd9b8522289757578bb1c1080186535e1a16a2e2f3d048542bd663f8251

SHA512
98314e5792735be3bd19c5fcb5bc23b465376cd965ffaebdd3d160ed88c6214b00ba54627de289ce8f6ba2ece82f4cd1c1d9bf56733da8eff34940e4bc13fa4f

Download Submit
C:\Windows\system\gQxMsTE.exe

Filesize
1.7MB

MD5
8e131899ff5b5b5428a8e35122db5e1a

SHA1
769af97887f6b74f7ec30b53260cbc4717b433ec

SHA256
e70a1844e93035716bbfb090c6ed73a8719f1ac97ecda894a16447313a1482bb

SHA512
cd0b9db8b231ff2cdb3c895aa4fa19a214b2c3d8ec88347817ed899377373467e38cbc8ca4805b48157e14275314ce1d507c9bda7c6e7782ed447fbeb1c195fa

Download Submit
C:\Windows\system\hBExULU.exe

Filesize
1.7MB

MD5
94e3ccc34b0bae5192941db8cc0eed49

SHA1
13052d84637a44e88c53a62fbc80e9320f6697f6

SHA256
f69cfbc8877c4938c45f8b78c9b689c2706de2e8cba5d5ea10bba407469ca152

SHA512
0ab3a1e27ad7c2bad51ea62895f54ce8772a77599f3354c8ed76006c07796553f16a63f44c55e5ec65b42af01d821713ef9157bfa67b6a30900303c99dbfd0e5

Download Submit
C:\Windows\system\kNSJhJk.exe

Filesize
1.7MB

MD5
2698dba8ac821a0ee48f981b6ed7b45f

SHA1
b5bf11642ae4728880fbd568282f10fd0354afd9

SHA256
d6c483034c18c59e8924b6b6c3a4dfcd08cea09aecadcaba60b893b334817b06

SHA512
03bc3b50b8e48c399d28405b75bbb1ff5317707654745e291d60c27d6fc70796fb4cd238322b71f76728cb62fa02a9381c69795db7c0dbf608834caa38b33848

Download Submit
C:\Windows\system\pBReXxs.exe

Filesize
1.7MB

MD5
8f56886478f5907ddc84aadbd57a6c7f

SHA1
45648204dce68346a45ca6e7327c990d652bf015

SHA256
54450a3bf8766b2f19102b8f5508e3dd7cc5f47cb422a2936cb5a16cac2202b9

SHA512
76985834cb519c0059ab6aba2e890872d2b02d1ffd5a187c1844340ed8b9e71777c59375a4ceb9ce3d8d50be7d836333846ef272eefece7e8b2ac2bde4c27708

Download Submit
C:\Windows\system\rMPBVWh.exe

Filesize
1.7MB

MD5
c8c843abd343f6dc7b7ae5bb71c6d8c3

SHA1
4548d2698a0cd57a989af7784a71c4823eca1c65

SHA256
64b041e4b1bc06e4f4f43c09f2466e0376bd9d63d38f092df3d4e18dd8734039

SHA512
d8b5956861cea19f1d9b7dd1e0f31043a84722a88ada6816d88a6a5926a7c86dbd0f0c5f980f1cfa8a28542032b72f7908fc6e6da248e6aca560b5c7468b6a27

Download Submit
C:\Windows\system\sUzAMJL.exe

Filesize
1.7MB

MD5
1a2b716b44a7953a232bf596e43e7c98

SHA1
8b217294b22c1462b2c8d4e3fc901d27703ea0c1

SHA256
f4095af03ae0672b68643b79c58f73d16588e1d7877f6180a70b5315ecdd1752

SHA512
2999d0d0348ae2075e331943255f53dce87991cd2ab61894e4a78673702cecf6a29f7a47452c26358cbd78c411c232142cfa9d2a9584f90f5d9ef6833faf43d3

Download Submit
C:\Windows\system\tIoVTYo.exe

Filesize
1.7MB

MD5
5863f28b6270d0adea21a6edff1ef7ab

SHA1
c6b880c65d797f36af40b7dfb73783d4e4d981a9

SHA256
5425bc2f1fcfc4f88693c228e2440629b463294cb56c18fc4870b5be5daf4ac5

SHA512
d0110b85683d8d033085e4525dd90c7b99082c21ebe74afca5eefd101205082b4b9720cb601effb7a6c68e1692103d45ca50cfe23a699e7192b2231e0ad8ae63

Download Submit
C:\Windows\system\xAsVMkL.exe

Filesize
1.7MB

MD5
bfbab748b25704680330b79e6f43f36e

SHA1
50e268284b5057424c4d180fb0f212d3ba9cc5cb

SHA256
698f82172a3659ccd727d3e2cd29b6807fb811c145a489486cc260d91c477ed3

SHA512
c226ad4e1bac12630bda7f32e6190762a42cd4c2556cd1dd4a76fff3842b2ec26bf5f954b0a1ed13ab624a2b4bbba9191d385a458d8085c048307452804e58b6

Download Submit
C:\Windows\system\xNGRKde.exe

Filesize
1.7MB

MD5
e1043623d454867f81caa5800cb16d4c

SHA1
7c0f7e3068ecaf751b3d29a45522d4efcc059eef

SHA256
a83a8faeee6acfda6a75b7c64a011331c6797f6a48609dab847f2a139c0fe89f

SHA512
9596a034ee4877ea4d5f0d5f3043461dde2bf91258c82267eeeb78d27de54e8621e08bfe29088f7d522cee25e4e03ecdc022e03a02451288ca00f505dd0597f1

Download Submit
C:\Windows\system\xmWnJjj.exe

Filesize
1.7MB

MD5
256165b0b47e6adfb38c4de7a7c35d6a

SHA1
248dd6bafeba8b986a4b3079963dce1d9ef7df52

SHA256
59137cbc7efea19e987161f879b331953c7aabd28470da53429d2038122d0b0a

SHA512
ea3bb3c069eef1f062510e26b69cb197b8cc57d6cbc6a7c54c2eba8176e8446b48cbc31978f3748e2fa572e3a2e68098411784f07d282686b82eaf2573cfc374

Download Submit
C:\Windows\system\xtzNcOc.exe

Filesize
1.7MB

MD5
e2912600fb4096f784d398af5b9dde1c

SHA1
c710ccc0d3ad16d2e93f67a7be840cd6093513bb

SHA256
bc59416e74934f1e852aaa92c5088d038ac76660eecd42eb84efff635c775473

SHA512
ac51544a28f1fc58623b73b0f674d3dedb2454b0864ca600705760219f12a59bdb2c36a7c6dbf993e7830df48c05cbf501fa835af400b6fcd270cbf74b6aaf80

Download Submit
C:\Windows\system\xuPiMyg.exe

Filesize
1.7MB

MD5
6f1924a64a5d493444a27a803c4f698a

SHA1
3b9855bb1c0698dd6d73470fa37a018a43eeb257

SHA256
c6d585c0d1576dcb5a563e674e225915bd23bc15c04a76b4144046987d9541c7

SHA512
67afc89c49646f54595c922051edc741c32214c105861883bcdb320a8d5654fd09083aa9631c3ded63c8a9de2df10dfcf7cae7cc05714db26b0103d6d0c89560

Download Submit
C:\Windows\system\zSPkruf.exe

Filesize
1.7MB

MD5
49153fe81fffc962674ae349d8b12ea9

SHA1
fbb94a69845b12796eff7da546a6708d54a231d0

SHA256
857b36912839f236cafd0c9d9090bb2fbcec80fb9d448c70a688743be8d087e8

SHA512
66889d7f6d9df076ebf862f81451778d6d586edb3a4f985d9fb2b5b01e70446ae0039d739df9429e29d74047ef8847e98b49ca27688707ee78368ba52a516195

Download Submit
\Windows\system\YWDjqXn.exe

Filesize
1.7MB

MD5
a3ba9ffd5e5bce566f2db1fb033265ad

SHA1
da3913c602cfead808db2bbe16dda14963780eee

SHA256
01c4c6a1696dfec701db6783585961cc117f585f071f2eb3398d1a4119df87e1

SHA512
e1486b6f141a9156e27e50a0b48af6877139bde0cc75655a567792562f66183560fca10a982d3ffc83b1e578fec5eacc60afd8189c1f137230798a48e528e537

Download Submit
memory/1040-4909-0x000000013FAF0000-0x000000013FEE2000-memory.dmp

Filesize
3.9MB

Download
memory/1040-335-0x000000013FAF0000-0x000000013FEE2000-memory.dmp

Filesize
3.9MB

Download
memory/2208-4890-0x000000013F780000-0x000000013FB72000-memory.dmp

Filesize
3.9MB

Download
memory/2208-326-0x000000013F780000-0x000000013FB72000-memory.dmp

Filesize
3.9MB

Download
memory/2268-4913-0x000000013F920000-0x000000013FD12000-memory.dmp

Filesize
3.9MB

Download
memory/2268-333-0x000000013F920000-0x000000013FD12000-memory.dmp

Filesize
3.9MB

Download
memory/2320-308-0x0000000001D20000-0x0000000001D28000-memory.dmp

Filesize
32KB

Download
memory/2320-304-0x000000001B650000-0x000000001B932000-memory.dmp

Filesize
2.9MB

Download
memory/2320-312-0x000007FEF5ED0000-0x000007FEF686D000-memory.dmp

Filesize
9.6MB

Download
memory/2320-21-0x000007FEF618E000-0x000007FEF618F000-memory.dmp

Filesize
4KB

Download
memory/2320-798-0x000007FEF5ED0000-0x000007FEF686D000-memory.dmp

Filesize
9.6MB

Download
memory/2320-20-0x0000000002980000-0x0000000002A00000-memory.dmp

Filesize
512KB

Download
memory/2524-318-0x000000013F520000-0x000000013F912000-memory.dmp

Filesize
3.9MB

Download
memory/2524-4889-0x000000013F520000-0x000000013F912000-memory.dmp

Filesize
3.9MB

Download
memory/2548-313-0x000000013F9B0000-0x000000013FDA2000-memory.dmp

Filesize
3.9MB

Download
memory/2548-4881-0x000000013F9B0000-0x000000013FDA2000-memory.dmp

Filesize
3.9MB

Download
memory/2552-4896-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/2552-320-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/2576-316-0x000000013F070000-0x000000013F462000-memory.dmp

Filesize
3.9MB

Download
memory/2576-4885-0x000000013F070000-0x000000013F462000-memory.dmp

Filesize
3.9MB

Download
memory/2700-19-0x000000013F120000-0x000000013F512000-memory.dmp

Filesize
3.9MB

Download
memory/2700-4893-0x000000013F120000-0x000000013F512000-memory.dmp

Filesize
3.9MB

Download
memory/2708-8-0x0000000002E60000-0x0000000003252000-memory.dmp

Filesize
3.9MB

Download
memory/2708-327-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/2708-330-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/2708-319-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/2708-332-0x000000013F920000-0x000000013FD12000-memory.dmp

Filesize
3.9MB

Download
memory/2708-334-0x000000013FAF0000-0x000000013FEE2000-memory.dmp

Filesize
3.9MB

Download
memory/2708-2-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download
memory/2708-18-0x0000000003650000-0x0000000003A42000-memory.dmp

Filesize
3.9MB

Download
memory/2708-336-0x000000013F9B0000-0x000000013FDA2000-memory.dmp

Filesize
3.9MB

Download
memory/2708-325-0x000000013F780000-0x000000013FB72000-memory.dmp

Filesize
3.9MB

Download
memory/2708-317-0x0000000003650000-0x0000000003A42000-memory.dmp

Filesize
3.9MB

Download
memory/2708-321-0x000000013FD70000-0x0000000140162000-memory.dmp

Filesize
3.9MB

Download
memory/2708-315-0x0000000003650000-0x0000000003A42000-memory.dmp

Filesize
3.9MB

Download
memory/2708-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2772-9-0x000000013F310000-0x000000013F702000-memory.dmp

Filesize
3.9MB

Download
memory/2772-4629-0x000000013F310000-0x000000013F702000-memory.dmp

Filesize
3.9MB

Download
memory/2844-4886-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/2844-331-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/2956-322-0x000000013FD70000-0x0000000140162000-memory.dmp

Filesize
3.9MB

Download
memory/2956-4888-0x000000013FD70000-0x0000000140162000-memory.dmp

Filesize
3.9MB

Download
memory/2988-4887-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/2988-329-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download