xmrig | 416318934431d67a494b9175a6a1e0308c1490f53b17d85171f451a72f4c14a6

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
03/08/2024, 00:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

274016bda97e6ec3ee7ec855ddbdc240N.exe
Size

1.2MB
MD5

274016bda97e6ec3ee7ec855ddbdc240
SHA1

5a2c4cd3c6e50fa61255863deda89675e4c04664
SHA256

416318934431d67a494b9175a6a1e0308c1490f53b17d85171f451a72f4c14a6
SHA512

2a4fc1aaf5c979d71b802cdedb0eba7d252cf627485f86c917b2fb35e68963f6fbf7e217a0d1dfa98427015166ac94650854fd6045a5a98541bc14def72e3587
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYl9vAmqM7j6:Lz071uv4BPMkibTIA5c1

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 25 IoCs

miner

resource	yara_rule
behavioral1/memory/2104-13-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	xmrig
behavioral1/memory/1744-67-0x000000013F930000-0x000000013FD22000-memory.dmp	xmrig
behavioral1/memory/2824-171-0x000000013FE30000-0x0000000140222000-memory.dmp	xmrig
behavioral1/memory/2688-169-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	xmrig
behavioral1/memory/2636-167-0x000000013F470000-0x000000013F862000-memory.dmp	xmrig
behavioral1/memory/2088-166-0x0000000002EF0000-0x00000000032E2000-memory.dmp	xmrig
behavioral1/memory/2764-165-0x000000013FB30000-0x000000013FF22000-memory.dmp	xmrig
behavioral1/memory/2012-163-0x000000013F160000-0x000000013F552000-memory.dmp	xmrig
behavioral1/memory/2748-161-0x000000013FCF0000-0x00000001400E2000-memory.dmp	xmrig
behavioral1/memory/3024-159-0x000000013F810000-0x000000013FC02000-memory.dmp	xmrig
behavioral1/memory/2812-157-0x000000013F980000-0x000000013FD72000-memory.dmp	xmrig
behavioral1/memory/2744-155-0x000000013F250000-0x000000013F642000-memory.dmp	xmrig
behavioral1/memory/480-131-0x000000013F8B0000-0x000000013FCA2000-memory.dmp	xmrig
behavioral1/memory/2104-4564-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	xmrig
behavioral1/memory/1744-4569-0x000000013F930000-0x000000013FD22000-memory.dmp	xmrig
behavioral1/memory/3024-4608-0x000000013F810000-0x000000013FC02000-memory.dmp	xmrig
behavioral1/memory/2636-4613-0x000000013F470000-0x000000013F862000-memory.dmp	xmrig
behavioral1/memory/2012-4611-0x000000013F160000-0x000000013F552000-memory.dmp	xmrig
behavioral1/memory/2824-4610-0x000000013FE30000-0x0000000140222000-memory.dmp	xmrig
behavioral1/memory/2744-4605-0x000000013F250000-0x000000013F642000-memory.dmp	xmrig
behavioral1/memory/2688-4584-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	xmrig
behavioral1/memory/2748-4582-0x000000013FCF0000-0x00000001400E2000-memory.dmp	xmrig
behavioral1/memory/2812-4590-0x000000013F980000-0x000000013FD72000-memory.dmp	xmrig
behavioral1/memory/480-4588-0x000000013F8B0000-0x000000013FCA2000-memory.dmp	xmrig
behavioral1/memory/2764-4586-0x000000013FB30000-0x000000013FF22000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2532	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2104	gYDyOqN.exe
1744	jpOZUmZ.exe
480	gSXoGcD.exe
2744	owqZSjL.exe
2812	TqINqEZ.exe
3024	cqhOQFF.exe
2748	UhzKTUp.exe
2012	lpQDcqg.exe
2764	mdUZmUW.exe
2636	LjeXWby.exe
2688	mwtOCsT.exe
2824	zRPXiIu.exe
2044	lhbaGiY.exe
2212	PeByjGz.exe
2436	YpeeILp.exe
2784	trGRUyM.exe
1708	zJVCnnx.exe
316	fMZBxlP.exe
2884	uqJVImv.exe
2948	LRjTazh.exe
1544	HJNIIKz.exe
2976	goMhibn.exe
2632	NjFurut.exe
2188	XWkvaYQ.exe
2300	ZmtKYpB.exe
908	CuNXoeE.exe
2700	VDuqkbJ.exe
644	DWBSzAG.exe
2092	yVkYrYI.exe
2940	JLvEOcv.exe
1768	yxbWKZj.exe
2312	fIkZIpY.exe
2932	cRnYSQf.exe
1908	YCmJJhZ.exe
2172	bqMmZes.exe
1872	WxyDShK.exe
1524	FsHFbXs.exe
1652	zDeujCO.exe
2944	vuIZamA.exe
2468	kkleEXR.exe
2608	teMdHXF.exe
2972	wzYqOWA.exe
1012	TQjcNib.exe
2124	ITpjAyw.exe
2872	MeoeGIP.exe
2964	oehvEgj.exe
2176	qkJEkcG.exe
2988	zAMAoAq.exe
2596	LcbDxoV.exe
2052	AlXRoGn.exe
2952	AKcgUcC.exe
668	PnTDsIh.exe
2864	rjcqcJy.exe
2100	zNSAZwy.exe
2332	GRtoHiR.exe
3036	vLmGHAK.exe
2880	vvMmNdY.exe
1636	FqjcagR.exe
2792	CpFAgdB.exe
1992	ypDgAlC.exe
2968	bKnkeRe.exe
1916	HhGXKbv.exe
3076	ZlNouBS.exe
3116	MTrBxbl.exe

Loads dropped DLL 64 IoCs

pid	Process
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
2088	274016bda97e6ec3ee7ec855ddbdc240N.exe

UPX packed file 62 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2088-0-0x000000013F410000-0x000000013F802000-memory.dmp	upx
behavioral1/files/0x00090000000120f8-6.dat	upx
behavioral1/memory/2104-13-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	upx
behavioral1/files/0x0005000000019246-97.dat	upx
behavioral1/files/0x0005000000019221-91.dat	upx
behavioral1/files/0x0006000000018d74-64.dat	upx
behavioral1/files/0x0006000000018d6b-62.dat	upx
behavioral1/files/0x0006000000018d40-58.dat	upx
behavioral1/files/0x0006000000018c2e-54.dat	upx
behavioral1/files/0x0006000000018c27-50.dat	upx
behavioral1/files/0x0008000000015db6-47.dat	upx
behavioral1/files/0x0009000000015dac-43.dat	upx
behavioral1/files/0x0007000000015da2-39.dat	upx
behavioral1/files/0x0007000000015d98-34.dat	upx
behavioral1/files/0x0007000000015d8b-31.dat	upx
behavioral1/files/0x0009000000015d78-27.dat	upx
behavioral1/files/0x0015000000003717-26.dat	upx
behavioral1/files/0x0008000000015d3f-19.dat	upx
behavioral1/files/0x0005000000019309-118.dat	upx
behavioral1/files/0x0005000000019272-112.dat	upx
behavioral1/files/0x0005000000019256-106.dat	upx
behavioral1/memory/1744-67-0x000000013F930000-0x000000013FD22000-memory.dmp	upx
behavioral1/files/0x0005000000019385-185.dat	upx
behavioral1/files/0x00050000000193a2-192.dat	upx
behavioral1/files/0x0005000000019358-174.dat	upx
behavioral1/files/0x0005000000019249-100.dat	upx
behavioral1/files/0x000500000001923a-94.dat	upx
behavioral1/files/0x00050000000191fe-88.dat	upx
behavioral1/files/0x00050000000193c3-198.dat	upx
behavioral1/files/0x0006000000018f94-82.dat	upx
behavioral1/files/0x0006000000018d87-75.dat	upx
behavioral1/files/0x0005000000019394-190.dat	upx
behavioral1/files/0x0005000000019368-180.dat	upx
behavioral1/memory/2824-171-0x000000013FE30000-0x0000000140222000-memory.dmp	upx
behavioral1/memory/2688-169-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	upx
behavioral1/memory/2636-167-0x000000013F470000-0x000000013F862000-memory.dmp	upx
behavioral1/memory/2764-165-0x000000013FB30000-0x000000013FF22000-memory.dmp	upx
behavioral1/memory/2012-163-0x000000013F160000-0x000000013F552000-memory.dmp	upx
behavioral1/memory/2748-161-0x000000013FCF0000-0x00000001400E2000-memory.dmp	upx
behavioral1/memory/3024-159-0x000000013F810000-0x000000013FC02000-memory.dmp	upx
behavioral1/memory/2812-157-0x000000013F980000-0x000000013FD72000-memory.dmp	upx
behavioral1/memory/2744-155-0x000000013F250000-0x000000013F642000-memory.dmp	upx
behavioral1/files/0x0005000000019346-150.dat	upx
behavioral1/files/0x00050000000192fe-149.dat	upx
behavioral1/files/0x000500000001925b-148.dat	upx
behavioral1/files/0x0005000000019253-147.dat	upx
behavioral1/files/0x000600000001904f-135.dat	upx
behavioral1/files/0x0006000000018d89-133.dat	upx
behavioral1/files/0x0006000000018d80-132.dat	upx
behavioral1/memory/480-131-0x000000013F8B0000-0x000000013FCA2000-memory.dmp	upx
behavioral1/memory/2104-4564-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	upx
behavioral1/memory/1744-4569-0x000000013F930000-0x000000013FD22000-memory.dmp	upx
behavioral1/memory/3024-4608-0x000000013F810000-0x000000013FC02000-memory.dmp	upx
behavioral1/memory/2636-4613-0x000000013F470000-0x000000013F862000-memory.dmp	upx
behavioral1/memory/2012-4611-0x000000013F160000-0x000000013F552000-memory.dmp	upx
behavioral1/memory/2824-4610-0x000000013FE30000-0x0000000140222000-memory.dmp	upx
behavioral1/memory/2744-4605-0x000000013F250000-0x000000013F642000-memory.dmp	upx
behavioral1/memory/2688-4584-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	upx
behavioral1/memory/2748-4582-0x000000013FCF0000-0x00000001400E2000-memory.dmp	upx
behavioral1/memory/2812-4590-0x000000013F980000-0x000000013FD72000-memory.dmp	upx
behavioral1/memory/480-4588-0x000000013F8B0000-0x000000013FCA2000-memory.dmp	upx
behavioral1/memory/2764-4586-0x000000013FB30000-0x000000013FF22000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\uiPMGPR.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\ZuoXabb.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\izpAGnz.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\QrZEHlJ.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\SKrMbMU.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\GVDjBnM.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\OEgQMYd.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\ucQNjsw.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\sfvVgEr.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\BAEDhtV.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\eyUuUfy.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\IYmEfFr.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\nAhKTqg.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\mwtOCsT.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\gWzFtwW.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\ZPKUhMe.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\ljfoYYX.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\OHCOxgg.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\XFQRYSm.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\fumQWVy.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\IEWXJpH.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\VcBsYex.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\mKYIJED.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\YtbTpVz.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\HhGXKbv.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\GkQsvrt.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\mDlEZxg.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\KXJnDtQ.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\xsxMRYN.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\PeByjGz.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\fzPHGwD.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\GcUaLjH.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\WhCgjPC.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\ycrvZwD.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\GJARXpi.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\cnAVzez.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\qhFTdeW.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\tmcvQqW.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\hMsRNjY.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\YIlssLT.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\SRmZKzO.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\lnJQZoh.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\BTWMhTX.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\erfnmuK.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\NdtEIuB.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\jdlKfxX.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\kBToUXU.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\BFRlApA.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\hFfbqWA.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\EoqIafh.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\sVMiwWN.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\lgGHJOZ.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\rocxYdP.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\IQUBSTv.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\PedGsVs.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\GziNOJi.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\twqzQZR.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\YmByLPv.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\sINsspF.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\TNIBZGM.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\CBpZHdn.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\iTvkLPR.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\nkpdWeK.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe
File created	C:\Windows\System\OBoUoWz.exe	274016bda97e6ec3ee7ec855ddbdc240N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2532	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
Token: SeLockMemoryPrivilege	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe
Token: SeDebugPrivilege	2532	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2532	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	31
PID 2088 wrote to memory of 2532	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	31
PID 2088 wrote to memory of 2532	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	31
PID 2088 wrote to memory of 2104	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	32
PID 2088 wrote to memory of 2104	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	32
PID 2088 wrote to memory of 2104	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	32
PID 2088 wrote to memory of 1744	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	33
PID 2088 wrote to memory of 1744	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	33
PID 2088 wrote to memory of 1744	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	33
PID 2088 wrote to memory of 480	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	34
PID 2088 wrote to memory of 480	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	34
PID 2088 wrote to memory of 480	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	34
PID 2088 wrote to memory of 2744	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	35
PID 2088 wrote to memory of 2744	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	35
PID 2088 wrote to memory of 2744	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	35
PID 2088 wrote to memory of 2812	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	36
PID 2088 wrote to memory of 2812	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	36
PID 2088 wrote to memory of 2812	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	36
PID 2088 wrote to memory of 3024	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	37
PID 2088 wrote to memory of 3024	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	37
PID 2088 wrote to memory of 3024	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	37
PID 2088 wrote to memory of 2748	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	38
PID 2088 wrote to memory of 2748	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	38
PID 2088 wrote to memory of 2748	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	38
PID 2088 wrote to memory of 2012	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	39
PID 2088 wrote to memory of 2012	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	39
PID 2088 wrote to memory of 2012	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	39
PID 2088 wrote to memory of 2764	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	40
PID 2088 wrote to memory of 2764	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	40
PID 2088 wrote to memory of 2764	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	40
PID 2088 wrote to memory of 2636	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	41
PID 2088 wrote to memory of 2636	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	41
PID 2088 wrote to memory of 2636	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	41
PID 2088 wrote to memory of 2688	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	42
PID 2088 wrote to memory of 2688	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	42
PID 2088 wrote to memory of 2688	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	42
PID 2088 wrote to memory of 2824	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	43
PID 2088 wrote to memory of 2824	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	43
PID 2088 wrote to memory of 2824	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	43
PID 2088 wrote to memory of 2044	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	44
PID 2088 wrote to memory of 2044	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	44
PID 2088 wrote to memory of 2044	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	44
PID 2088 wrote to memory of 2632	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	45
PID 2088 wrote to memory of 2632	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	45
PID 2088 wrote to memory of 2632	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	45
PID 2088 wrote to memory of 2212	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	46
PID 2088 wrote to memory of 2212	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	46
PID 2088 wrote to memory of 2212	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	46
PID 2088 wrote to memory of 2300	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	47
PID 2088 wrote to memory of 2300	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	47
PID 2088 wrote to memory of 2300	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	47
PID 2088 wrote to memory of 2436	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	48
PID 2088 wrote to memory of 2436	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	48
PID 2088 wrote to memory of 2436	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	48
PID 2088 wrote to memory of 644	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	49
PID 2088 wrote to memory of 644	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	49
PID 2088 wrote to memory of 644	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	49
PID 2088 wrote to memory of 2784	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	50
PID 2088 wrote to memory of 2784	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	50
PID 2088 wrote to memory of 2784	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	50
PID 2088 wrote to memory of 2940	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	51
PID 2088 wrote to memory of 2940	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	51
PID 2088 wrote to memory of 2940	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	51
PID 2088 wrote to memory of 1708	2088	274016bda97e6ec3ee7ec855ddbdc240N.exe	52

C:\Users\Admin\AppData\Local\Temp\274016bda97e6ec3ee7ec855ddbdc240N.exe
"C:\Users\Admin\AppData\Local\Temp\274016bda97e6ec3ee7ec855ddbdc240N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2532
- C:\Windows\System\gYDyOqN.exe
  C:\Windows\System\gYDyOqN.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\jpOZUmZ.exe
  C:\Windows\System\jpOZUmZ.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\gSXoGcD.exe
  C:\Windows\System\gSXoGcD.exe
  2⤵
  - Executes dropped EXE
  PID:480
- C:\Windows\System\owqZSjL.exe
  C:\Windows\System\owqZSjL.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\TqINqEZ.exe
  C:\Windows\System\TqINqEZ.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\cqhOQFF.exe
  C:\Windows\System\cqhOQFF.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\UhzKTUp.exe
  C:\Windows\System\UhzKTUp.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\lpQDcqg.exe
  C:\Windows\System\lpQDcqg.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\mdUZmUW.exe
  C:\Windows\System\mdUZmUW.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\LjeXWby.exe
  C:\Windows\System\LjeXWby.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\mwtOCsT.exe
  C:\Windows\System\mwtOCsT.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\zRPXiIu.exe
  C:\Windows\System\zRPXiIu.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\lhbaGiY.exe
  C:\Windows\System\lhbaGiY.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\NjFurut.exe
  C:\Windows\System\NjFurut.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\PeByjGz.exe
  C:\Windows\System\PeByjGz.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\ZmtKYpB.exe
  C:\Windows\System\ZmtKYpB.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\YpeeILp.exe
  C:\Windows\System\YpeeILp.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\DWBSzAG.exe
  C:\Windows\System\DWBSzAG.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\trGRUyM.exe
  C:\Windows\System\trGRUyM.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\JLvEOcv.exe
  C:\Windows\System\JLvEOcv.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\zJVCnnx.exe
  C:\Windows\System\zJVCnnx.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\yxbWKZj.exe
  C:\Windows\System\yxbWKZj.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\fMZBxlP.exe
  C:\Windows\System\fMZBxlP.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\cRnYSQf.exe
  C:\Windows\System\cRnYSQf.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\uqJVImv.exe
  C:\Windows\System\uqJVImv.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\WxyDShK.exe
  C:\Windows\System\WxyDShK.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\LRjTazh.exe
  C:\Windows\System\LRjTazh.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\vuIZamA.exe
  C:\Windows\System\vuIZamA.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\HJNIIKz.exe
  C:\Windows\System\HJNIIKz.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\TQjcNib.exe
  C:\Windows\System\TQjcNib.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\goMhibn.exe
  C:\Windows\System\goMhibn.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\PnTDsIh.exe
  C:\Windows\System\PnTDsIh.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\XWkvaYQ.exe
  C:\Windows\System\XWkvaYQ.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\vvMmNdY.exe
  C:\Windows\System\vvMmNdY.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\CuNXoeE.exe
  C:\Windows\System\CuNXoeE.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\otBQRXB.exe
  C:\Windows\System\otBQRXB.exe
  2⤵
  PID:1208
- C:\Windows\System\VDuqkbJ.exe
  C:\Windows\System\VDuqkbJ.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\KdmvPsN.exe
  C:\Windows\System\KdmvPsN.exe
  2⤵
  PID:3060
- C:\Windows\System\yVkYrYI.exe
  C:\Windows\System\yVkYrYI.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\mPDVuet.exe
  C:\Windows\System\mPDVuet.exe
  2⤵
  PID:336
- C:\Windows\System\fIkZIpY.exe
  C:\Windows\System\fIkZIpY.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\xgLGvWr.exe
  C:\Windows\System\xgLGvWr.exe
  2⤵
  PID:2364
- C:\Windows\System\YCmJJhZ.exe
  C:\Windows\System\YCmJJhZ.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\MehKdbL.exe
  C:\Windows\System\MehKdbL.exe
  2⤵
  PID:1424
- C:\Windows\System\bqMmZes.exe
  C:\Windows\System\bqMmZes.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\zWbadbB.exe
  C:\Windows\System\zWbadbB.exe
  2⤵
  PID:2308
- C:\Windows\System\FsHFbXs.exe
  C:\Windows\System\FsHFbXs.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\WzMBwsQ.exe
  C:\Windows\System\WzMBwsQ.exe
  2⤵
  PID:1532
- C:\Windows\System\zDeujCO.exe
  C:\Windows\System\zDeujCO.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\OtSNtRR.exe
  C:\Windows\System\OtSNtRR.exe
  2⤵
  PID:2576
- C:\Windows\System\kkleEXR.exe
  C:\Windows\System\kkleEXR.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\PVdctxl.exe
  C:\Windows\System\PVdctxl.exe
  2⤵
  PID:2892
- C:\Windows\System\teMdHXF.exe
  C:\Windows\System\teMdHXF.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\QevvfJr.exe
  C:\Windows\System\QevvfJr.exe
  2⤵
  PID:2368
- C:\Windows\System\wzYqOWA.exe
  C:\Windows\System\wzYqOWA.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\UgWJhFj.exe
  C:\Windows\System\UgWJhFj.exe
  2⤵
  PID:996
- C:\Windows\System\ITpjAyw.exe
  C:\Windows\System\ITpjAyw.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\UNbAQnL.exe
  C:\Windows\System\UNbAQnL.exe
  2⤵
  PID:2860
- C:\Windows\System\MeoeGIP.exe
  C:\Windows\System\MeoeGIP.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\oAlioWM.exe
  C:\Windows\System\oAlioWM.exe
  2⤵
  PID:1732
- C:\Windows\System\oehvEgj.exe
  C:\Windows\System\oehvEgj.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\UiSYUMB.exe
  C:\Windows\System\UiSYUMB.exe
  2⤵
  PID:1720
- C:\Windows\System\qkJEkcG.exe
  C:\Windows\System\qkJEkcG.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\dczEyXB.exe
  C:\Windows\System\dczEyXB.exe
  2⤵
  PID:2524
- C:\Windows\System\zAMAoAq.exe
  C:\Windows\System\zAMAoAq.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\uXhYWIM.exe
  C:\Windows\System\uXhYWIM.exe
  2⤵
  PID:2912
- C:\Windows\System\LcbDxoV.exe
  C:\Windows\System\LcbDxoV.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\WimbfBj.exe
  C:\Windows\System\WimbfBj.exe
  2⤵
  PID:800
- C:\Windows\System\AlXRoGn.exe
  C:\Windows\System\AlXRoGn.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\lCezAdk.exe
  C:\Windows\System\lCezAdk.exe
  2⤵
  PID:3044
- C:\Windows\System\AKcgUcC.exe
  C:\Windows\System\AKcgUcC.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\whPDxrs.exe
  C:\Windows\System\whPDxrs.exe
  2⤵
  PID:944
- C:\Windows\System\rjcqcJy.exe
  C:\Windows\System\rjcqcJy.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\OAMBLGs.exe
  C:\Windows\System\OAMBLGs.exe
  2⤵
  PID:1540
- C:\Windows\System\zNSAZwy.exe
  C:\Windows\System\zNSAZwy.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\ZEIcwJS.exe
  C:\Windows\System\ZEIcwJS.exe
  2⤵
  PID:1180
- C:\Windows\System\GRtoHiR.exe
  C:\Windows\System\GRtoHiR.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\DgNLaTy.exe
  C:\Windows\System\DgNLaTy.exe
  2⤵
  PID:876
- C:\Windows\System\vLmGHAK.exe
  C:\Windows\System\vLmGHAK.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\jPDejHn.exe
  C:\Windows\System\jPDejHn.exe
  2⤵
  PID:2164
- C:\Windows\System\FqjcagR.exe
  C:\Windows\System\FqjcagR.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\VvgDpLq.exe
  C:\Windows\System\VvgDpLq.exe
  2⤵
  PID:2876
- C:\Windows\System\CpFAgdB.exe
  C:\Windows\System\CpFAgdB.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\QzFYkew.exe
  C:\Windows\System\QzFYkew.exe
  2⤵
  PID:1360
- C:\Windows\System\ypDgAlC.exe
  C:\Windows\System\ypDgAlC.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\SIpgFjz.exe
  C:\Windows\System\SIpgFjz.exe
  2⤵
  PID:2136
- C:\Windows\System\bKnkeRe.exe
  C:\Windows\System\bKnkeRe.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\hojLOCH.exe
  C:\Windows\System\hojLOCH.exe
  2⤵
  PID:572
- C:\Windows\System\HhGXKbv.exe
  C:\Windows\System\HhGXKbv.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\WqqpHJC.exe
  C:\Windows\System\WqqpHJC.exe
  2⤵
  PID:112
- C:\Windows\System\ZlNouBS.exe
  C:\Windows\System\ZlNouBS.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\oyiroah.exe
  C:\Windows\System\oyiroah.exe
  2⤵
  PID:3092
- C:\Windows\System\MTrBxbl.exe
  C:\Windows\System\MTrBxbl.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\xmjaYXe.exe
  C:\Windows\System\xmjaYXe.exe
  2⤵
  PID:3132
- C:\Windows\System\KgelNny.exe
  C:\Windows\System\KgelNny.exe
  2⤵
  PID:3148
- C:\Windows\System\feNSauv.exe
  C:\Windows\System\feNSauv.exe
  2⤵
  PID:3168
- C:\Windows\System\xdPLJKn.exe
  C:\Windows\System\xdPLJKn.exe
  2⤵
  PID:3232
- C:\Windows\System\OcWwlXL.exe
  C:\Windows\System\OcWwlXL.exe
  2⤵
  PID:3312
- C:\Windows\System\mjJlMqi.exe
  C:\Windows\System\mjJlMqi.exe
  2⤵
  PID:3412
- C:\Windows\System\SBTQakE.exe
  C:\Windows\System\SBTQakE.exe
  2⤵
  PID:3432
- C:\Windows\System\wPaQyDE.exe
  C:\Windows\System\wPaQyDE.exe
  2⤵
  PID:3448
- C:\Windows\System\OjSjPzr.exe
  C:\Windows\System\OjSjPzr.exe
  2⤵
  PID:3472
- C:\Windows\System\jdlKfxX.exe
  C:\Windows\System\jdlKfxX.exe
  2⤵
  PID:3488
- C:\Windows\System\NbplseI.exe
  C:\Windows\System\NbplseI.exe
  2⤵
  PID:3508
- C:\Windows\System\KqEvUXE.exe
  C:\Windows\System\KqEvUXE.exe
  2⤵
  PID:3528
- C:\Windows\System\WPCamqv.exe
  C:\Windows\System\WPCamqv.exe
  2⤵
  PID:3548
- C:\Windows\System\vEUDzzp.exe
  C:\Windows\System\vEUDzzp.exe
  2⤵
  PID:3568
- C:\Windows\System\TllUlsP.exe
  C:\Windows\System\TllUlsP.exe
  2⤵
  PID:3588
- C:\Windows\System\sNhQwyh.exe
  C:\Windows\System\sNhQwyh.exe
  2⤵
  PID:3608
- C:\Windows\System\qCCQrac.exe
  C:\Windows\System\qCCQrac.exe
  2⤵
  PID:3632
- C:\Windows\System\seLsbMd.exe
  C:\Windows\System\seLsbMd.exe
  2⤵
  PID:3648
- C:\Windows\System\fqbfuYk.exe
  C:\Windows\System\fqbfuYk.exe
  2⤵
  PID:3672
- C:\Windows\System\kmdPoGa.exe
  C:\Windows\System\kmdPoGa.exe
  2⤵
  PID:3688
- C:\Windows\System\QVEOwIZ.exe
  C:\Windows\System\QVEOwIZ.exe
  2⤵
  PID:3704
- C:\Windows\System\lyjVWqS.exe
  C:\Windows\System\lyjVWqS.exe
  2⤵
  PID:3720
- C:\Windows\System\tTSennZ.exe
  C:\Windows\System\tTSennZ.exe
  2⤵
  PID:3736
- C:\Windows\System\CTbBcrU.exe
  C:\Windows\System\CTbBcrU.exe
  2⤵
  PID:3752
- C:\Windows\System\bkLfzRF.exe
  C:\Windows\System\bkLfzRF.exe
  2⤵
  PID:3768
- C:\Windows\System\VleOezs.exe
  C:\Windows\System\VleOezs.exe
  2⤵
  PID:3784
- C:\Windows\System\ZWdvnLz.exe
  C:\Windows\System\ZWdvnLz.exe
  2⤵
  PID:3804
- C:\Windows\System\eypyRkt.exe
  C:\Windows\System\eypyRkt.exe
  2⤵
  PID:3824
- C:\Windows\System\qHvvwaJ.exe
  C:\Windows\System\qHvvwaJ.exe
  2⤵
  PID:3868
- C:\Windows\System\QrfdVQq.exe
  C:\Windows\System\QrfdVQq.exe
  2⤵
  PID:3888
- C:\Windows\System\CYbVUwO.exe
  C:\Windows\System\CYbVUwO.exe
  2⤵
  PID:3904
- C:\Windows\System\UUnfalx.exe
  C:\Windows\System\UUnfalx.exe
  2⤵
  PID:3920
- C:\Windows\System\XcrOmSx.exe
  C:\Windows\System\XcrOmSx.exe
  2⤵
  PID:3936
- C:\Windows\System\wPpasTE.exe
  C:\Windows\System\wPpasTE.exe
  2⤵
  PID:3952
- C:\Windows\System\PwJwjUJ.exe
  C:\Windows\System\PwJwjUJ.exe
  2⤵
  PID:3968
- C:\Windows\System\cJQuDcE.exe
  C:\Windows\System\cJQuDcE.exe
  2⤵
  PID:3988
- C:\Windows\System\VnmdWef.exe
  C:\Windows\System\VnmdWef.exe
  2⤵
  PID:4004
- C:\Windows\System\TMFlKcX.exe
  C:\Windows\System\TMFlKcX.exe
  2⤵
  PID:4024
- C:\Windows\System\fHXVwxo.exe
  C:\Windows\System\fHXVwxo.exe
  2⤵
  PID:4040
- C:\Windows\System\RJPQtfw.exe
  C:\Windows\System\RJPQtfw.exe
  2⤵
  PID:4056
- C:\Windows\System\dKwOxam.exe
  C:\Windows\System\dKwOxam.exe
  2⤵
  PID:4076
- C:\Windows\System\rasfefy.exe
  C:\Windows\System\rasfefy.exe
  2⤵
  PID:4092
- C:\Windows\System\OkRLBsb.exe
  C:\Windows\System\OkRLBsb.exe
  2⤵
  PID:2504
- C:\Windows\System\rpkdTcq.exe
  C:\Windows\System\rpkdTcq.exe
  2⤵
  PID:1880
- C:\Windows\System\CAYBOMX.exe
  C:\Windows\System\CAYBOMX.exe
  2⤵
  PID:2840
- C:\Windows\System\pPRUHUg.exe
  C:\Windows\System\pPRUHUg.exe
  2⤵
  PID:1800
- C:\Windows\System\ZnAiTQz.exe
  C:\Windows\System\ZnAiTQz.exe
  2⤵
  PID:1096
- C:\Windows\System\trhxPTh.exe
  C:\Windows\System\trhxPTh.exe
  2⤵
  PID:3156
- C:\Windows\System\ARMhqbh.exe
  C:\Windows\System\ARMhqbh.exe
  2⤵
  PID:2108
- C:\Windows\System\qbsbXjC.exe
  C:\Windows\System\qbsbXjC.exe
  2⤵
  PID:3260
- C:\Windows\System\JmfudSR.exe
  C:\Windows\System\JmfudSR.exe
  2⤵
  PID:3272
- C:\Windows\System\RfYPMTo.exe
  C:\Windows\System\RfYPMTo.exe
  2⤵
  PID:3288
- C:\Windows\System\kqBMRbq.exe
  C:\Windows\System\kqBMRbq.exe
  2⤵
  PID:3308
- C:\Windows\System\rauWHVW.exe
  C:\Windows\System\rauWHVW.exe
  2⤵
  PID:2844
- C:\Windows\System\BHbVyzU.exe
  C:\Windows\System\BHbVyzU.exe
  2⤵
  PID:3100
- C:\Windows\System\hMrpbnD.exe
  C:\Windows\System\hMrpbnD.exe
  2⤵
  PID:2816
- C:\Windows\System\MkuTBXF.exe
  C:\Windows\System\MkuTBXF.exe
  2⤵
  PID:2220
- C:\Windows\System\xAAEUnH.exe
  C:\Windows\System\xAAEUnH.exe
  2⤵
  PID:1844
- C:\Windows\System\EqNJyYD.exe
  C:\Windows\System\EqNJyYD.exe
  2⤵
  PID:3336
- C:\Windows\System\yNGfxFW.exe
  C:\Windows\System\yNGfxFW.exe
  2⤵
  PID:2116
- C:\Windows\System\yZrariP.exe
  C:\Windows\System\yZrariP.exe
  2⤵
  PID:2024
- C:\Windows\System\DHlEsXq.exe
  C:\Windows\System\DHlEsXq.exe
  2⤵
  PID:1972
- C:\Windows\System\oSfjnAo.exe
  C:\Windows\System\oSfjnAo.exe
  2⤵
  PID:2916
- C:\Windows\System\tQcxUFC.exe
  C:\Windows\System\tQcxUFC.exe
  2⤵
  PID:2348
- C:\Windows\System\KsYBIWW.exe
  C:\Windows\System\KsYBIWW.exe
  2⤵
  PID:2692
- C:\Windows\System\ssLSkBu.exe
  C:\Windows\System\ssLSkBu.exe
  2⤵
  PID:2604
- C:\Windows\System\kvoTClJ.exe
  C:\Windows\System\kvoTClJ.exe
  2⤵
  PID:2032
- C:\Windows\System\dMBYIRc.exe
  C:\Windows\System\dMBYIRc.exe
  2⤵
  PID:1984
- C:\Windows\System\TYthWVy.exe
  C:\Windows\System\TYthWVy.exe
  2⤵
  PID:2888
- C:\Windows\System\SvWuzOg.exe
  C:\Windows\System\SvWuzOg.exe
  2⤵
  PID:3204
- C:\Windows\System\ZVxevPb.exe
  C:\Windows\System\ZVxevPb.exe
  2⤵
  PID:3224
- C:\Windows\System\fgTlCfq.exe
  C:\Windows\System\fgTlCfq.exe
  2⤵
  PID:3324
- C:\Windows\System\RBtJsDD.exe
  C:\Windows\System\RBtJsDD.exe
  2⤵
  PID:3144
- C:\Windows\System\TWSeLRb.exe
  C:\Windows\System\TWSeLRb.exe
  2⤵
  PID:2440
- C:\Windows\System\ktCUNbX.exe
  C:\Windows\System\ktCUNbX.exe
  2⤵
  PID:2984
- C:\Windows\System\OZPOyYp.exe
  C:\Windows\System\OZPOyYp.exe
  2⤵
  PID:3420
- C:\Windows\System\BTWMhTX.exe
  C:\Windows\System\BTWMhTX.exe
  2⤵
  PID:3464
- C:\Windows\System\ULHhcZK.exe
  C:\Windows\System\ULHhcZK.exe
  2⤵
  PID:3496
- C:\Windows\System\wMJvqsm.exe
  C:\Windows\System\wMJvqsm.exe
  2⤵
  PID:2848
- C:\Windows\System\nCMQNPp.exe
  C:\Windows\System\nCMQNPp.exe
  2⤵
  PID:3520
- C:\Windows\System\QnOWRWX.exe
  C:\Windows\System\QnOWRWX.exe
  2⤵
  PID:3540
- C:\Windows\System\GFKHDOo.exe
  C:\Windows\System\GFKHDOo.exe
  2⤵
  PID:3576
- C:\Windows\System\ciYdrlE.exe
  C:\Windows\System\ciYdrlE.exe
  2⤵
  PID:1988
- C:\Windows\System\DAbozbj.exe
  C:\Windows\System\DAbozbj.exe
  2⤵
  PID:3600
- C:\Windows\System\kWkKqvZ.exe
  C:\Windows\System\kWkKqvZ.exe
  2⤵
  PID:2716
- C:\Windows\System\COGbqZn.exe
  C:\Windows\System\COGbqZn.exe
  2⤵
  PID:3628
- C:\Windows\System\dYyiRzg.exe
  C:\Windows\System\dYyiRzg.exe
  2⤵
  PID:1508
- C:\Windows\System\kWIrKDv.exe
  C:\Windows\System\kWIrKDv.exe
  2⤵
  PID:3660
- C:\Windows\System\RGexLxR.exe
  C:\Windows\System\RGexLxR.exe
  2⤵
  PID:3796
- C:\Windows\System\MzraOOe.exe
  C:\Windows\System\MzraOOe.exe
  2⤵
  PID:3864
- C:\Windows\System\APRhLNf.exe
  C:\Windows\System\APRhLNf.exe
  2⤵
  PID:3928
- C:\Windows\System\SGRTbkk.exe
  C:\Windows\System\SGRTbkk.exe
  2⤵
  PID:3996
- C:\Windows\System\InhBHQv.exe
  C:\Windows\System\InhBHQv.exe
  2⤵
  PID:4036
- C:\Windows\System\RignPok.exe
  C:\Windows\System\RignPok.exe
  2⤵
  PID:4072
- C:\Windows\System\koMxKrO.exe
  C:\Windows\System\koMxKrO.exe
  2⤵
  PID:2668
- C:\Windows\System\akGOvDq.exe
  C:\Windows\System\akGOvDq.exe
  2⤵
  PID:3004
- C:\Windows\System\xKCCIGe.exe
  C:\Windows\System\xKCCIGe.exe
  2⤵
  PID:2752
- C:\Windows\System\VloenYU.exe
  C:\Windows\System\VloenYU.exe
  2⤵
  PID:1260
- C:\Windows\System\fuBfXsI.exe
  C:\Windows\System\fuBfXsI.exe
  2⤵
  PID:2340
- C:\Windows\System\YmByLPv.exe
  C:\Windows\System\YmByLPv.exe
  2⤵
  PID:1196
- C:\Windows\System\KagattW.exe
  C:\Windows\System\KagattW.exe
  2⤵
  PID:3216
- C:\Windows\System\kWNmOxo.exe
  C:\Windows\System\kWNmOxo.exe
  2⤵
  PID:3176
- C:\Windows\System\SFSFpjq.exe
  C:\Windows\System\SFSFpjq.exe
  2⤵
  PID:3984
- C:\Windows\System\XUBWhxQ.exe
  C:\Windows\System\XUBWhxQ.exe
  2⤵
  PID:4048
- C:\Windows\System\kWlXGqQ.exe
  C:\Windows\System\kWlXGqQ.exe
  2⤵
  PID:2536
- C:\Windows\System\gTJrVHX.exe
  C:\Windows\System\gTJrVHX.exe
  2⤵
  PID:3088
- C:\Windows\System\GJARXpi.exe
  C:\Windows\System\GJARXpi.exe
  2⤵
  PID:3280
- C:\Windows\System\FQGIDGB.exe
  C:\Windows\System\FQGIDGB.exe
  2⤵
  PID:832
- C:\Windows\System\vxlVzXw.exe
  C:\Windows\System\vxlVzXw.exe
  2⤵
  PID:1576
- C:\Windows\System\fcFfbAq.exe
  C:\Windows\System\fcFfbAq.exe
  2⤵
  PID:3196
- C:\Windows\System\EKgmzFK.exe
  C:\Windows\System\EKgmzFK.exe
  2⤵
  PID:2856
- C:\Windows\System\DjiNSLN.exe
  C:\Windows\System\DjiNSLN.exe
  2⤵
  PID:3364
- C:\Windows\System\DWTcXRm.exe
  C:\Windows\System\DWTcXRm.exe
  2⤵
  PID:3292
- C:\Windows\System\jrZIgpk.exe
  C:\Windows\System\jrZIgpk.exe
  2⤵
  PID:896
- C:\Windows\System\tcNdRZf.exe
  C:\Windows\System\tcNdRZf.exe
  2⤵
  PID:2516
- C:\Windows\System\sfkryMw.exe
  C:\Windows\System\sfkryMw.exe
  2⤵
  PID:3456
- C:\Windows\System\njgvDKi.exe
  C:\Windows\System\njgvDKi.exe
  2⤵
  PID:3396
- C:\Windows\System\NpwUxoy.exe
  C:\Windows\System\NpwUxoy.exe
  2⤵
  PID:2008
- C:\Windows\System\xPBotqV.exe
  C:\Windows\System\xPBotqV.exe
  2⤵
  PID:3484
- C:\Windows\System\xcRxVxX.exe
  C:\Windows\System\xcRxVxX.exe
  2⤵
  PID:1864
- C:\Windows\System\BtLEFJY.exe
  C:\Windows\System\BtLEFJY.exe
  2⤵
  PID:1520
- C:\Windows\System\SlmxHDR.exe
  C:\Windows\System\SlmxHDR.exe
  2⤵
  PID:1528
- C:\Windows\System\ihxCbRD.exe
  C:\Windows\System\ihxCbRD.exe
  2⤵
  PID:1472
- C:\Windows\System\HMGAJmO.exe
  C:\Windows\System\HMGAJmO.exe
  2⤵
  PID:2320
- C:\Windows\System\LiNNlmm.exe
  C:\Windows\System\LiNNlmm.exe
  2⤵
  PID:3348
- C:\Windows\System\KgjAdNq.exe
  C:\Windows\System\KgjAdNq.exe
  2⤵
  PID:940
- C:\Windows\System\SyUkvsg.exe
  C:\Windows\System\SyUkvsg.exe
  2⤵
  PID:3300
- C:\Windows\System\PDZrWTL.exe
  C:\Windows\System\PDZrWTL.exe
  2⤵
  PID:3916
- C:\Windows\System\RWblxzk.exe
  C:\Windows\System\RWblxzk.exe
  2⤵
  PID:3912
- C:\Windows\System\INYAAtJ.exe
  C:\Windows\System\INYAAtJ.exe
  2⤵
  PID:3980
- C:\Windows\System\exJwpHX.exe
  C:\Windows\System\exJwpHX.exe
  2⤵
  PID:3964
- C:\Windows\System\xGTHUqC.exe
  C:\Windows\System\xGTHUqC.exe
  2⤵
  PID:4068
- C:\Windows\System\LNaVXst.exe
  C:\Windows\System\LNaVXst.exe
  2⤵
  PID:2160
- C:\Windows\System\UAYzIPJ.exe
  C:\Windows\System\UAYzIPJ.exe
  2⤵
  PID:2316
- C:\Windows\System\IpjQBBV.exe
  C:\Windows\System\IpjQBBV.exe
  2⤵
  PID:3248
- C:\Windows\System\IkyNZPx.exe
  C:\Windows\System\IkyNZPx.exe
  2⤵
  PID:2056
- C:\Windows\System\HjUzSaR.exe
  C:\Windows\System\HjUzSaR.exe
  2⤵
  PID:3392
- C:\Windows\System\KfuaQet.exe
  C:\Windows\System\KfuaQet.exe
  2⤵
  PID:2648
- C:\Windows\System\wZnCNgu.exe
  C:\Windows\System\wZnCNgu.exe
  2⤵
  PID:2068
- C:\Windows\System\GfKHgud.exe
  C:\Windows\System\GfKHgud.exe
  2⤵
  PID:3852
- C:\Windows\System\AlYlynL.exe
  C:\Windows\System\AlYlynL.exe
  2⤵
  PID:540
- C:\Windows\System\NhZivbK.exe
  C:\Windows\System\NhZivbK.exe
  2⤵
  PID:3560
- C:\Windows\System\ATpPQyu.exe
  C:\Windows\System\ATpPQyu.exe
  2⤵
  PID:3620
- C:\Windows\System\CqYQdQB.exe
  C:\Windows\System\CqYQdQB.exe
  2⤵
  PID:4020
- C:\Windows\System\tAcqcxF.exe
  C:\Windows\System\tAcqcxF.exe
  2⤵
  PID:3716
- C:\Windows\System\DnMfVfl.exe
  C:\Windows\System\DnMfVfl.exe
  2⤵
  PID:2808
- C:\Windows\System\dIqlDCT.exe
  C:\Windows\System\dIqlDCT.exe
  2⤵
  PID:3880
- C:\Windows\System\JTlTuPa.exe
  C:\Windows\System\JTlTuPa.exe
  2⤵
  PID:3896
- C:\Windows\System\nqVpurR.exe
  C:\Windows\System\nqVpurR.exe
  2⤵
  PID:2148
- C:\Windows\System\UnLFBdb.exe
  C:\Windows\System\UnLFBdb.exe
  2⤵
  PID:3820
- C:\Windows\System\EqRXlkn.exe
  C:\Windows\System\EqRXlkn.exe
  2⤵
  PID:4032
- C:\Windows\System\isuVEXZ.exe
  C:\Windows\System\isuVEXZ.exe
  2⤵
  PID:3712
- C:\Windows\System\VgdYsmf.exe
  C:\Windows\System\VgdYsmf.exe
  2⤵
  PID:3356
- C:\Windows\System\GkQsvrt.exe
  C:\Windows\System\GkQsvrt.exe
  2⤵
  PID:4104
- C:\Windows\System\PJfiqGT.exe
  C:\Windows\System\PJfiqGT.exe
  2⤵
  PID:4120
- C:\Windows\System\NxtQVqt.exe
  C:\Windows\System\NxtQVqt.exe
  2⤵
  PID:4136
- C:\Windows\System\bJEuhjo.exe
  C:\Windows\System\bJEuhjo.exe
  2⤵
  PID:4152
- C:\Windows\System\OQvfvcq.exe
  C:\Windows\System\OQvfvcq.exe
  2⤵
  PID:4168
- C:\Windows\System\zUpmsEf.exe
  C:\Windows\System\zUpmsEf.exe
  2⤵
  PID:4184
- C:\Windows\System\gyjIHpj.exe
  C:\Windows\System\gyjIHpj.exe
  2⤵
  PID:4200
- C:\Windows\System\REKfDJV.exe
  C:\Windows\System\REKfDJV.exe
  2⤵
  PID:4216
- C:\Windows\System\AceSQjN.exe
  C:\Windows\System\AceSQjN.exe
  2⤵
  PID:4248
- C:\Windows\System\uaDyNJw.exe
  C:\Windows\System\uaDyNJw.exe
  2⤵
  PID:4264
- C:\Windows\System\fCkTPLU.exe
  C:\Windows\System\fCkTPLU.exe
  2⤵
  PID:4392
- C:\Windows\System\zCgaTfY.exe
  C:\Windows\System\zCgaTfY.exe
  2⤵
  PID:4416
- C:\Windows\System\hvPFpZO.exe
  C:\Windows\System\hvPFpZO.exe
  2⤵
  PID:4432
- C:\Windows\System\kPuqkUq.exe
  C:\Windows\System\kPuqkUq.exe
  2⤵
  PID:4448
- C:\Windows\System\pFNAHEs.exe
  C:\Windows\System\pFNAHEs.exe
  2⤵
  PID:4464
- C:\Windows\System\ZPmcgco.exe
  C:\Windows\System\ZPmcgco.exe
  2⤵
  PID:4480
- C:\Windows\System\cEsgEyF.exe
  C:\Windows\System\cEsgEyF.exe
  2⤵
  PID:4500
- C:\Windows\System\qAUjACs.exe
  C:\Windows\System\qAUjACs.exe
  2⤵
  PID:4516
- C:\Windows\System\dLldwdF.exe
  C:\Windows\System\dLldwdF.exe
  2⤵
  PID:4532
- C:\Windows\System\gxEYwdq.exe
  C:\Windows\System\gxEYwdq.exe
  2⤵
  PID:4548
- C:\Windows\System\nLXKJoo.exe
  C:\Windows\System\nLXKJoo.exe
  2⤵
  PID:4564
- C:\Windows\System\RlgKHQr.exe
  C:\Windows\System\RlgKHQr.exe
  2⤵
  PID:4580
- C:\Windows\System\fepsrQt.exe
  C:\Windows\System\fepsrQt.exe
  2⤵
  PID:4596
- C:\Windows\System\uvpoYsU.exe
  C:\Windows\System\uvpoYsU.exe
  2⤵
  PID:4616
- C:\Windows\System\PYRjWIY.exe
  C:\Windows\System\PYRjWIY.exe
  2⤵
  PID:4632
- C:\Windows\System\xHoAALc.exe
  C:\Windows\System\xHoAALc.exe
  2⤵
  PID:4648
- C:\Windows\System\xEUcJXR.exe
  C:\Windows\System\xEUcJXR.exe
  2⤵
  PID:4664
- C:\Windows\System\kSsWhlh.exe
  C:\Windows\System\kSsWhlh.exe
  2⤵
  PID:4680
- C:\Windows\System\QqYBdPW.exe
  C:\Windows\System\QqYBdPW.exe
  2⤵
  PID:4696
- C:\Windows\System\kryDoTf.exe
  C:\Windows\System\kryDoTf.exe
  2⤵
  PID:4716
- C:\Windows\System\aagAybz.exe
  C:\Windows\System\aagAybz.exe
  2⤵
  PID:4732
- C:\Windows\System\tBQFmaM.exe
  C:\Windows\System\tBQFmaM.exe
  2⤵
  PID:4884
- C:\Windows\System\hzCzrVd.exe
  C:\Windows\System\hzCzrVd.exe
  2⤵
  PID:4904
- C:\Windows\System\aKynIIO.exe
  C:\Windows\System\aKynIIO.exe
  2⤵
  PID:4920
- C:\Windows\System\QsxuGlz.exe
  C:\Windows\System\QsxuGlz.exe
  2⤵
  PID:4936
- C:\Windows\System\BRxoSLm.exe
  C:\Windows\System\BRxoSLm.exe
  2⤵
  PID:4952
- C:\Windows\System\NyrCsQe.exe
  C:\Windows\System\NyrCsQe.exe
  2⤵
  PID:4968
- C:\Windows\System\HSxlQHC.exe
  C:\Windows\System\HSxlQHC.exe
  2⤵
  PID:4984
- C:\Windows\System\eIVVzhY.exe
  C:\Windows\System\eIVVzhY.exe
  2⤵
  PID:5000
- C:\Windows\System\DwjTrbA.exe
  C:\Windows\System\DwjTrbA.exe
  2⤵
  PID:5016
- C:\Windows\System\SSowxrh.exe
  C:\Windows\System\SSowxrh.exe
  2⤵
  PID:5032
- C:\Windows\System\sakMHWs.exe
  C:\Windows\System\sakMHWs.exe
  2⤵
  PID:5052
- C:\Windows\System\mxRKUKu.exe
  C:\Windows\System\mxRKUKu.exe
  2⤵
  PID:5068
- C:\Windows\System\ZhBBqWz.exe
  C:\Windows\System\ZhBBqWz.exe
  2⤵
  PID:5084
- C:\Windows\System\NvBaYXa.exe
  C:\Windows\System\NvBaYXa.exe
  2⤵
  PID:5100
- C:\Windows\System\xFIgoEU.exe
  C:\Windows\System\xFIgoEU.exe
  2⤵
  PID:2800
- C:\Windows\System\oqmomrO.exe
  C:\Windows\System\oqmomrO.exe
  2⤵
  PID:3164
- C:\Windows\System\kpjjETk.exe
  C:\Windows\System\kpjjETk.exe
  2⤵
  PID:532
- C:\Windows\System\jEhcmiU.exe
  C:\Windows\System\jEhcmiU.exe
  2⤵
  PID:3516
- C:\Windows\System\ZLrLTFM.exe
  C:\Windows\System\ZLrLTFM.exe
  2⤵
  PID:4180
- C:\Windows\System\DmQQufS.exe
  C:\Windows\System\DmQQufS.exe
  2⤵
  PID:4260
- C:\Windows\System\DSkuFQK.exe
  C:\Windows\System\DSkuFQK.exe
  2⤵
  PID:4336
- C:\Windows\System\uRXPxFl.exe
  C:\Windows\System\uRXPxFl.exe
  2⤵
  PID:3836
- C:\Windows\System\rylcPyr.exe
  C:\Windows\System\rylcPyr.exe
  2⤵
  PID:3332
- C:\Windows\System\GbuuQpZ.exe
  C:\Windows\System\GbuuQpZ.exe
  2⤵
  PID:4372
- C:\Windows\System\hRqKzuI.exe
  C:\Windows\System\hRqKzuI.exe
  2⤵
  PID:4196
- C:\Windows\System\uCndbCf.exe
  C:\Windows\System\uCndbCf.exe
  2⤵
  PID:2772
- C:\Windows\System\challey.exe
  C:\Windows\System\challey.exe
  2⤵
  PID:4232
- C:\Windows\System\NqvWlhC.exe
  C:\Windows\System\NqvWlhC.exe
  2⤵
  PID:2352
- C:\Windows\System\EVNbcuv.exe
  C:\Windows\System\EVNbcuv.exe
  2⤵
  PID:4276
- C:\Windows\System\vveFzsf.exe
  C:\Windows\System\vveFzsf.exe
  2⤵
  PID:4244
- C:\Windows\System\OEgQMYd.exe
  C:\Windows\System\OEgQMYd.exe
  2⤵
  PID:3812
- C:\Windows\System\tbOWIjH.exe
  C:\Windows\System\tbOWIjH.exe
  2⤵
  PID:4388
- C:\Windows\System\dbTsZBH.exe
  C:\Windows\System\dbTsZBH.exe
  2⤵
  PID:4404
- C:\Windows\System\juUnhmi.exe
  C:\Windows\System\juUnhmi.exe
  2⤵
  PID:4492
- C:\Windows\System\rybJIRe.exe
  C:\Windows\System\rybJIRe.exe
  2⤵
  PID:4556
- C:\Windows\System\bNMPYiU.exe
  C:\Windows\System\bNMPYiU.exe
  2⤵
  PID:4624
- C:\Windows\System\jRdHdSi.exe
  C:\Windows\System\jRdHdSi.exe
  2⤵
  PID:4688
- C:\Windows\System\fzPHGwD.exe
  C:\Windows\System\fzPHGwD.exe
  2⤵
  PID:4712
- C:\Windows\System\KMZdSMS.exe
  C:\Windows\System\KMZdSMS.exe
  2⤵
  PID:4472
- C:\Windows\System\TaxWlnL.exe
  C:\Windows\System\TaxWlnL.exe
  2⤵
  PID:4544
- C:\Windows\System\ISVpfJB.exe
  C:\Windows\System\ISVpfJB.exe
  2⤵
  PID:4608
- C:\Windows\System\mDlEZxg.exe
  C:\Windows\System\mDlEZxg.exe
  2⤵
  PID:4672
- C:\Windows\System\nUiLKqz.exe
  C:\Windows\System\nUiLKqz.exe
  2⤵
  PID:4752
- C:\Windows\System\cnAVzez.exe
  C:\Windows\System\cnAVzez.exe
  2⤵
  PID:4776
- C:\Windows\System\sFFJLdG.exe
  C:\Windows\System\sFFJLdG.exe
  2⤵
  PID:4808
- C:\Windows\System\jdGhaui.exe
  C:\Windows\System\jdGhaui.exe
  2⤵
  PID:4820
- C:\Windows\System\gVNprqk.exe
  C:\Windows\System\gVNprqk.exe
  2⤵
  PID:4840
- C:\Windows\System\cgmccCY.exe
  C:\Windows\System\cgmccCY.exe
  2⤵
  PID:4872
- C:\Windows\System\UzKOGXy.exe
  C:\Windows\System\UzKOGXy.exe
  2⤵
  PID:4892
- C:\Windows\System\SJsmYnt.exe
  C:\Windows\System\SJsmYnt.exe
  2⤵
  PID:4912
- C:\Windows\System\vNnvPju.exe
  C:\Windows\System\vNnvPju.exe
  2⤵
  PID:4932
- C:\Windows\System\MVbLMLb.exe
  C:\Windows\System\MVbLMLb.exe
  2⤵
  PID:3368
- C:\Windows\System\OCAfPoP.exe
  C:\Windows\System\OCAfPoP.exe
  2⤵
  PID:2740
- C:\Windows\System\TkuwbVa.exe
  C:\Windows\System\TkuwbVa.exe
  2⤵
  PID:1592
- C:\Windows\System\htbIIRB.exe
  C:\Windows\System\htbIIRB.exe
  2⤵
  PID:3596
- C:\Windows\System\DOairxE.exe
  C:\Windows\System\DOairxE.exe
  2⤵
  PID:3840
- C:\Windows\System\yITJeuo.exe
  C:\Windows\System\yITJeuo.exe
  2⤵
  PID:4212
- C:\Windows\System\JpVrEKR.exe
  C:\Windows\System\JpVrEKR.exe
  2⤵
  PID:4344
- C:\Windows\System\ulcJNaF.exe
  C:\Windows\System\ulcJNaF.exe
  2⤵
  PID:4356
- C:\Windows\System\NZvOVow.exe
  C:\Windows\System\NZvOVow.exe
  2⤵
  PID:4236
- C:\Windows\System\srGwJJA.exe
  C:\Windows\System\srGwJJA.exe
  2⤵
  PID:4384
- C:\Windows\System\rRiVAfu.exe
  C:\Windows\System\rRiVAfu.exe
  2⤵
  PID:2076
- C:\Windows\System\hTfjNCw.exe
  C:\Windows\System\hTfjNCw.exe
  2⤵
  PID:348
- C:\Windows\System\jLMKuNv.exe
  C:\Windows\System\jLMKuNv.exe
  2⤵
  PID:4272
- C:\Windows\System\sVcggMX.exe
  C:\Windows\System\sVcggMX.exe
  2⤵
  PID:4016
- C:\Windows\System\AxHnLZu.exe
  C:\Windows\System\AxHnLZu.exe
  2⤵
  PID:3844
- C:\Windows\System\mOkqfaR.exe
  C:\Windows\System\mOkqfaR.exe
  2⤵
  PID:3684
- C:\Windows\System\HUJpPGu.exe
  C:\Windows\System\HUJpPGu.exe
  2⤵
  PID:4428
- C:\Windows\System\bqzeVAx.exe
  C:\Windows\System\bqzeVAx.exe
  2⤵
  PID:4460
- C:\Windows\System\hyYrmSe.exe
  C:\Windows\System\hyYrmSe.exe
  2⤵
  PID:4512
- C:\Windows\System\LXNQAzu.exe
  C:\Windows\System\LXNQAzu.exe
  2⤵
  PID:4760
- C:\Windows\System\tjCevfF.exe
  C:\Windows\System\tjCevfF.exe
  2⤵
  PID:3876
- C:\Windows\System\XuyBpYh.exe
  C:\Windows\System\XuyBpYh.exe
  2⤵
  PID:5060
- C:\Windows\System\ojQYTcO.exe
  C:\Windows\System\ojQYTcO.exe
  2⤵
  PID:5096
- C:\Windows\System\XKgvHZI.exe
  C:\Windows\System\XKgvHZI.exe
  2⤵
  PID:3832
- C:\Windows\System\TgGrBTM.exe
  C:\Windows\System\TgGrBTM.exe
  2⤵
  PID:4992
- C:\Windows\System\KXJnDtQ.exe
  C:\Windows\System\KXJnDtQ.exe
  2⤵
  PID:4444
- C:\Windows\System\IdTFfsr.exe
  C:\Windows\System\IdTFfsr.exe
  2⤵
  PID:4528
- C:\Windows\System\VZpVTGM.exe
  C:\Windows\System\VZpVTGM.exe
  2⤵
  PID:4948
- C:\Windows\System\yWFeycQ.exe
  C:\Windows\System\yWFeycQ.exe
  2⤵
  PID:4976
- C:\Windows\System\nUhYHGE.exe
  C:\Windows\System\nUhYHGE.exe
  2⤵
  PID:5080
- C:\Windows\System\zxYjgAd.exe
  C:\Windows\System\zxYjgAd.exe
  2⤵
  PID:988
- C:\Windows\System\qvILsmm.exe
  C:\Windows\System\qvILsmm.exe
  2⤵
  PID:1536
- C:\Windows\System\IRmCSpU.exe
  C:\Windows\System\IRmCSpU.exe
  2⤵
  PID:3404
- C:\Windows\System\MtlCIJB.exe
  C:\Windows\System\MtlCIJB.exe
  2⤵
  PID:4812
- C:\Windows\System\UvMKmDR.exe
  C:\Windows\System\UvMKmDR.exe
  2⤵
  PID:4656
- C:\Windows\System\UyYuOkC.exe
  C:\Windows\System\UyYuOkC.exe
  2⤵
  PID:4296
- C:\Windows\System\WjmYJCg.exe
  C:\Windows\System\WjmYJCg.exe
  2⤵
  PID:4560
- C:\Windows\System\TqIksxp.exe
  C:\Windows\System\TqIksxp.exe
  2⤵
  PID:4804
- C:\Windows\System\gNtLhaL.exe
  C:\Windows\System\gNtLhaL.exe
  2⤵
  PID:4816
- C:\Windows\System\rLTECbl.exe
  C:\Windows\System\rLTECbl.exe
  2⤵
  PID:4524
- C:\Windows\System\IxUzdFw.exe
  C:\Windows\System\IxUzdFw.exe
  2⤵
  PID:4640
- C:\Windows\System\lpxoKOq.exe
  C:\Windows\System\lpxoKOq.exe
  2⤵
  PID:4916
- C:\Windows\System\HRngzUi.exe
  C:\Windows\System\HRngzUi.exe
  2⤵
  PID:4408
- C:\Windows\System\fTLrxnY.exe
  C:\Windows\System\fTLrxnY.exe
  2⤵
  PID:1564
- C:\Windows\System\hFzybwI.exe
  C:\Windows\System\hFzybwI.exe
  2⤵
  PID:2992
- C:\Windows\System\GZVVjjs.exe
  C:\Windows\System\GZVVjjs.exe
  2⤵
  PID:3544
- C:\Windows\System\PUtHrzA.exe
  C:\Windows\System\PUtHrzA.exe
  2⤵
  PID:4604
- C:\Windows\System\DQlFNPt.exe
  C:\Windows\System\DQlFNPt.exe
  2⤵
  PID:3976
- C:\Windows\System\TVbmfwX.exe
  C:\Windows\System\TVbmfwX.exe
  2⤵
  PID:4588
- C:\Windows\System\TvguIFe.exe
  C:\Windows\System\TvguIFe.exe
  2⤵
  PID:5040
- C:\Windows\System\SNlCflR.exe
  C:\Windows\System\SNlCflR.exe
  2⤵
  PID:3524
- C:\Windows\System\TRZsaCj.exe
  C:\Windows\System\TRZsaCj.exe
  2⤵
  PID:5108
- C:\Windows\System\XIROGFg.exe
  C:\Windows\System\XIROGFg.exe
  2⤵
  PID:4660
- C:\Windows\System\OMUwTLf.exe
  C:\Windows\System\OMUwTLf.exe
  2⤵
  PID:4836
- C:\Windows\System\DVyHbUU.exe
  C:\Windows\System\DVyHbUU.exe
  2⤵
  PID:3344
- C:\Windows\System\cIzwBXJ.exe
  C:\Windows\System\cIzwBXJ.exe
  2⤵
  PID:4132
- C:\Windows\System\MFnwJaU.exe
  C:\Windows\System\MFnwJaU.exe
  2⤵
  PID:3624
- C:\Windows\System\PSxLusj.exe
  C:\Windows\System\PSxLusj.exe
  2⤵
  PID:4592
- C:\Windows\System\yqfDKOL.exe
  C:\Windows\System\yqfDKOL.exe
  2⤵
  PID:5116
- C:\Windows\System\nEoYWzM.exe
  C:\Windows\System\nEoYWzM.exe
  2⤵
  PID:5124
- C:\Windows\System\gFBwjgr.exe
  C:\Windows\System\gFBwjgr.exe
  2⤵
  PID:5140
- C:\Windows\System\TseBNdK.exe
  C:\Windows\System\TseBNdK.exe
  2⤵
  PID:5156
- C:\Windows\System\nuLxheD.exe
  C:\Windows\System\nuLxheD.exe
  2⤵
  PID:5176
- C:\Windows\System\UcvHtYQ.exe
  C:\Windows\System\UcvHtYQ.exe
  2⤵
  PID:5192
- C:\Windows\System\ywJOyWm.exe
  C:\Windows\System\ywJOyWm.exe
  2⤵
  PID:5208
- C:\Windows\System\hOOAArc.exe
  C:\Windows\System\hOOAArc.exe
  2⤵
  PID:5244
- C:\Windows\System\nzEVnJD.exe
  C:\Windows\System\nzEVnJD.exe
  2⤵
  PID:5260
- C:\Windows\System\AwuehYd.exe
  C:\Windows\System\AwuehYd.exe
  2⤵
  PID:5276
- C:\Windows\System\vBUUFnU.exe
  C:\Windows\System\vBUUFnU.exe
  2⤵
  PID:5292
- C:\Windows\System\qhFTdeW.exe
  C:\Windows\System\qhFTdeW.exe
  2⤵
  PID:5312
- C:\Windows\System\beFdLaH.exe
  C:\Windows\System\beFdLaH.exe
  2⤵
  PID:5332
- C:\Windows\System\rVHBCNl.exe
  C:\Windows\System\rVHBCNl.exe
  2⤵
  PID:5348
- C:\Windows\System\jWKVJPl.exe
  C:\Windows\System\jWKVJPl.exe
  2⤵
  PID:5364
- C:\Windows\System\SuuZzhm.exe
  C:\Windows\System\SuuZzhm.exe
  2⤵
  PID:5380
- C:\Windows\System\bGloiLh.exe
  C:\Windows\System\bGloiLh.exe
  2⤵
  PID:5396
- C:\Windows\System\QzoJNrB.exe
  C:\Windows\System\QzoJNrB.exe
  2⤵
  PID:5412
- C:\Windows\System\lGTsMEC.exe
  C:\Windows\System\lGTsMEC.exe
  2⤵
  PID:5428
- C:\Windows\System\xuAEqpL.exe
  C:\Windows\System\xuAEqpL.exe
  2⤵
  PID:5444
- C:\Windows\System\QkzTHMO.exe
  C:\Windows\System\QkzTHMO.exe
  2⤵
  PID:5460
- C:\Windows\System\SoJlhss.exe
  C:\Windows\System\SoJlhss.exe
  2⤵
  PID:5476
- C:\Windows\System\sgrFtGH.exe
  C:\Windows\System\sgrFtGH.exe
  2⤵
  PID:5496
- C:\Windows\System\FtvXoBb.exe
  C:\Windows\System\FtvXoBb.exe
  2⤵
  PID:5512
- C:\Windows\System\yVykfZB.exe
  C:\Windows\System\yVykfZB.exe
  2⤵
  PID:5528
- C:\Windows\System\FPBsuin.exe
  C:\Windows\System\FPBsuin.exe
  2⤵
  PID:5544
- C:\Windows\System\skBedVE.exe
  C:\Windows\System\skBedVE.exe
  2⤵
  PID:5560
- C:\Windows\System\ucQNjsw.exe
  C:\Windows\System\ucQNjsw.exe
  2⤵
  PID:5576
- C:\Windows\System\fjERtGx.exe
  C:\Windows\System\fjERtGx.exe
  2⤵
  PID:5592
- C:\Windows\System\ufxCGch.exe
  C:\Windows\System\ufxCGch.exe
  2⤵
  PID:5612
- C:\Windows\System\GATIGfn.exe
  C:\Windows\System\GATIGfn.exe
  2⤵
  PID:5628
- C:\Windows\System\lbLJQwi.exe
  C:\Windows\System\lbLJQwi.exe
  2⤵
  PID:5644
- C:\Windows\System\TgmuElz.exe
  C:\Windows\System\TgmuElz.exe
  2⤵
  PID:5664
- C:\Windows\System\DtieLKH.exe
  C:\Windows\System\DtieLKH.exe
  2⤵
  PID:5680
- C:\Windows\System\AlUbdwh.exe
  C:\Windows\System\AlUbdwh.exe
  2⤵
  PID:5700
- C:\Windows\System\AKvayPn.exe
  C:\Windows\System\AKvayPn.exe
  2⤵
  PID:5716
- C:\Windows\System\JGbnrgz.exe
  C:\Windows\System\JGbnrgz.exe
  2⤵
  PID:5732
- C:\Windows\System\DNbHzgg.exe
  C:\Windows\System\DNbHzgg.exe
  2⤵
  PID:5748
- C:\Windows\System\bYQmGuh.exe
  C:\Windows\System\bYQmGuh.exe
  2⤵
  PID:5764
- C:\Windows\System\JuEtIOL.exe
  C:\Windows\System\JuEtIOL.exe
  2⤵
  PID:5784
- C:\Windows\System\jXCIRKI.exe
  C:\Windows\System\jXCIRKI.exe
  2⤵
  PID:5800
- C:\Windows\System\cBjtqET.exe
  C:\Windows\System\cBjtqET.exe
  2⤵
  PID:5816
- C:\Windows\System\zNzRdbb.exe
  C:\Windows\System\zNzRdbb.exe
  2⤵
  PID:5832
- C:\Windows\System\LoCzAWj.exe
  C:\Windows\System\LoCzAWj.exe
  2⤵
  PID:5848
- C:\Windows\System\twqzQZR.exe
  C:\Windows\System\twqzQZR.exe
  2⤵
  PID:5864
- C:\Windows\System\CozOpkf.exe
  C:\Windows\System\CozOpkf.exe
  2⤵
  PID:5880
- C:\Windows\System\SJVxWYA.exe
  C:\Windows\System\SJVxWYA.exe
  2⤵
  PID:5900
- C:\Windows\System\nfMhCFY.exe
  C:\Windows\System\nfMhCFY.exe
  2⤵
  PID:5916
- C:\Windows\System\nNRzygi.exe
  C:\Windows\System\nNRzygi.exe
  2⤵
  PID:5932
- C:\Windows\System\qJCMiTt.exe
  C:\Windows\System\qJCMiTt.exe
  2⤵
  PID:5948
- C:\Windows\System\xRLtMkZ.exe
  C:\Windows\System\xRLtMkZ.exe
  2⤵
  PID:5964
- C:\Windows\System\eQvfemj.exe
  C:\Windows\System\eQvfemj.exe
  2⤵
  PID:5980
- C:\Windows\System\NPoUqfs.exe
  C:\Windows\System\NPoUqfs.exe
  2⤵
  PID:5996
- C:\Windows\System\EFUfARP.exe
  C:\Windows\System\EFUfARP.exe
  2⤵
  PID:6012
- C:\Windows\System\qBSzvwt.exe
  C:\Windows\System\qBSzvwt.exe
  2⤵
  PID:6028
- C:\Windows\System\dwMlNYz.exe
  C:\Windows\System\dwMlNYz.exe
  2⤵
  PID:6048
- C:\Windows\System\ZUApDxB.exe
  C:\Windows\System\ZUApDxB.exe
  2⤵
  PID:6064
- C:\Windows\System\KutMulF.exe
  C:\Windows\System\KutMulF.exe
  2⤵
  PID:6084
- C:\Windows\System\TEqmZbP.exe
  C:\Windows\System\TEqmZbP.exe
  2⤵
  PID:6104
- C:\Windows\System\vaqwUMX.exe
  C:\Windows\System\vaqwUMX.exe
  2⤵
  PID:6124
- C:\Windows\System\iscblCS.exe
  C:\Windows\System\iscblCS.exe
  2⤵
  PID:4744
- C:\Windows\System\eeisoMr.exe
  C:\Windows\System\eeisoMr.exe
  2⤵
  PID:5136
- C:\Windows\System\uSaEOpy.exe
  C:\Windows\System\uSaEOpy.exe
  2⤵
  PID:5168
- C:\Windows\System\lVBBMXU.exe
  C:\Windows\System\lVBBMXU.exe
  2⤵
  PID:5172
- C:\Windows\System\RYRwJPT.exe
  C:\Windows\System\RYRwJPT.exe
  2⤵
  PID:5252
- C:\Windows\System\liywTSN.exe
  C:\Windows\System\liywTSN.exe
  2⤵
  PID:5288
- C:\Windows\System\xlaLhXq.exe
  C:\Windows\System\xlaLhXq.exe
  2⤵
  PID:4832
- C:\Windows\System\kciOdVz.exe
  C:\Windows\System\kciOdVz.exe
  2⤵
  PID:4380
- C:\Windows\System\DUCyevy.exe
  C:\Windows\System\DUCyevy.exe
  2⤵
  PID:5424
- C:\Windows\System\HhAeqKa.exe
  C:\Windows\System\HhAeqKa.exe
  2⤵
  PID:5152
- C:\Windows\System\TLbCgUz.exe
  C:\Windows\System\TLbCgUz.exe
  2⤵
  PID:5484
- C:\Windows\System\QYukQaY.exe
  C:\Windows\System\QYukQaY.exe
  2⤵
  PID:5488
- C:\Windows\System\YwjtxCP.exe
  C:\Windows\System\YwjtxCP.exe
  2⤵
  PID:5556
- C:\Windows\System\lsBGTpD.exe
  C:\Windows\System\lsBGTpD.exe
  2⤵
  PID:5624
- C:\Windows\System\sucoasq.exe
  C:\Windows\System\sucoasq.exe
  2⤵
  PID:5240
- C:\Windows\System\gqjPoQJ.exe
  C:\Windows\System\gqjPoQJ.exe
  2⤵
  PID:5272
- C:\Windows\System\yHorCMg.exe
  C:\Windows\System\yHorCMg.exe
  2⤵
  PID:5344
- C:\Windows\System\BKjlocN.exe
  C:\Windows\System\BKjlocN.exe
  2⤵
  PID:5608
- C:\Windows\System\oMdaTQU.exe
  C:\Windows\System\oMdaTQU.exe
  2⤵
  PID:5408
- C:\Windows\System\MgDlMww.exe
  C:\Windows\System\MgDlMww.exe
  2⤵
  PID:5728
- C:\Windows\System\ntayKbg.exe
  C:\Windows\System\ntayKbg.exe
  2⤵
  PID:5504
- C:\Windows\System\fAIYHaJ.exe
  C:\Windows\System\fAIYHaJ.exe
  2⤵
  PID:5856
- C:\Windows\System\MzrIYeF.exe
  C:\Windows\System\MzrIYeF.exe
  2⤵
  PID:5892
- C:\Windows\System\oOvwJvw.exe
  C:\Windows\System\oOvwJvw.exe
  2⤵
  PID:5568
- C:\Windows\System\IyOZxEf.exe
  C:\Windows\System\IyOZxEf.exe
  2⤵
  PID:5956
- C:\Windows\System\XILqNSK.exe
  C:\Windows\System\XILqNSK.exe
  2⤵
  PID:5536
- C:\Windows\System\gcOLHXx.exe
  C:\Windows\System\gcOLHXx.exe
  2⤵
  PID:5572
- C:\Windows\System\hfQbgyt.exe
  C:\Windows\System\hfQbgyt.exe
  2⤵
  PID:5944
- C:\Windows\System\XiSsGfn.exe
  C:\Windows\System\XiSsGfn.exe
  2⤵
  PID:5780
- C:\Windows\System\qkslwrO.exe
  C:\Windows\System\qkslwrO.exe
  2⤵
  PID:6020
- C:\Windows\System\hIdumnM.exe
  C:\Windows\System\hIdumnM.exe
  2⤵
  PID:6024
- C:\Windows\System\ISLCTlJ.exe
  C:\Windows\System\ISLCTlJ.exe
  2⤵
  PID:6056
- C:\Windows\System\mVDkHri.exe
  C:\Windows\System\mVDkHri.exe
  2⤵
  PID:6044
- C:\Windows\System\OKRnnLR.exe
  C:\Windows\System\OKRnnLR.exe
  2⤵
  PID:6076
- C:\Windows\System\QjUfhJU.exe
  C:\Windows\System\QjUfhJU.exe
  2⤵
  PID:6100
- C:\Windows\System\gpfSmCj.exe
  C:\Windows\System\gpfSmCj.exe
  2⤵
  PID:5132
- C:\Windows\System\mGXXQmv.exe
  C:\Windows\System\mGXXQmv.exe
  2⤵
  PID:6136
- C:\Windows\System\EWShQgm.exe
  C:\Windows\System\EWShQgm.exe
  2⤵
  PID:5324
- C:\Windows\System\rZaoOta.exe
  C:\Windows\System\rZaoOta.exe
  2⤵
  PID:5420
- C:\Windows\System\pBENKGz.exe
  C:\Windows\System\pBENKGz.exe
  2⤵
  PID:5552
- C:\Windows\System\WnakKes.exe
  C:\Windows\System\WnakKes.exe
  2⤵
  PID:3360
- C:\Windows\System\ypHFZRt.exe
  C:\Windows\System\ypHFZRt.exe
  2⤵
  PID:5452
- C:\Windows\System\pfBWiZa.exe
  C:\Windows\System\pfBWiZa.exe
  2⤵
  PID:5356
- C:\Windows\System\WxwPMrG.exe
  C:\Windows\System\WxwPMrG.exe
  2⤵
  PID:5304
- C:\Windows\System\qReqzNm.exe
  C:\Windows\System\qReqzNm.exe
  2⤵
  PID:5588
- C:\Windows\System\nhxlCjl.exe
  C:\Windows\System\nhxlCjl.exe
  2⤵
  PID:5440
- C:\Windows\System\QxGdvdN.exe
  C:\Windows\System\QxGdvdN.exe
  2⤵
  PID:5924
- C:\Windows\System\rJTTapb.exe
  C:\Windows\System\rJTTapb.exe
  2⤵
  PID:6060
- C:\Windows\System\YrzUgas.exe
  C:\Windows\System\YrzUgas.exe
  2⤵
  PID:5232
- C:\Windows\System\KXfjryN.exe
  C:\Windows\System\KXfjryN.exe
  2⤵
  PID:5376
- C:\Windows\System\zwJsPUR.exe
  C:\Windows\System\zwJsPUR.exe
  2⤵
  PID:5808
- C:\Windows\System\FEcFAhW.exe
  C:\Windows\System\FEcFAhW.exe
  2⤵
  PID:5876
- C:\Windows\System\IMkIvYo.exe
  C:\Windows\System\IMkIvYo.exe
  2⤵
  PID:5976
- C:\Windows\System\zIclIRj.exe
  C:\Windows\System\zIclIRj.exe
  2⤵
  PID:3180
- C:\Windows\System\mjDXIlK.exe
  C:\Windows\System\mjDXIlK.exe
  2⤵
  PID:5392
- C:\Windows\System\tOpTdUL.exe
  C:\Windows\System\tOpTdUL.exe
  2⤵
  PID:5308
- C:\Windows\System\xloCKZG.exe
  C:\Windows\System\xloCKZG.exe
  2⤵
  PID:6096
- C:\Windows\System\xsxMRYN.exe
  C:\Windows\System\xsxMRYN.exe
  2⤵
  PID:5940
- C:\Windows\System\zRkRwKg.exe
  C:\Windows\System\zRkRwKg.exe
  2⤵
  PID:5524
- C:\Windows\System\iiaTFPv.exe
  C:\Windows\System\iiaTFPv.exe
  2⤵
  PID:5492
- C:\Windows\System\kmhqtSC.exe
  C:\Windows\System\kmhqtSC.exe
  2⤵
  PID:5696
- C:\Windows\System\BeMemnk.exe
  C:\Windows\System\BeMemnk.exe
  2⤵
  PID:5776
- C:\Windows\System\vHClLCD.exe
  C:\Windows\System\vHClLCD.exe
  2⤵
  PID:5636
- C:\Windows\System\KZltODs.exe
  C:\Windows\System\KZltODs.exe
  2⤵
  PID:5792
- C:\Windows\System\sINsspF.exe
  C:\Windows\System\sINsspF.exe
  2⤵
  PID:5468
- C:\Windows\System\srOTotV.exe
  C:\Windows\System\srOTotV.exe
  2⤵
  PID:5388
- C:\Windows\System\DfsNxWR.exe
  C:\Windows\System\DfsNxWR.exe
  2⤵
  PID:6160
- C:\Windows\System\xuMRcud.exe
  C:\Windows\System\xuMRcud.exe
  2⤵
  PID:6176
- C:\Windows\System\FlBomka.exe
  C:\Windows\System\FlBomka.exe
  2⤵
  PID:6192
- C:\Windows\System\BZMifnz.exe
  C:\Windows\System\BZMifnz.exe
  2⤵
  PID:6208
- C:\Windows\System\SWYFuNd.exe
  C:\Windows\System\SWYFuNd.exe
  2⤵
  PID:6224
- C:\Windows\System\HhtQaYS.exe
  C:\Windows\System\HhtQaYS.exe
  2⤵
  PID:6244
- C:\Windows\System\yZoPguL.exe
  C:\Windows\System\yZoPguL.exe
  2⤵
  PID:6260
- C:\Windows\System\ZlTIVnf.exe
  C:\Windows\System\ZlTIVnf.exe
  2⤵
  PID:6284
- C:\Windows\System\CqwjfsS.exe
  C:\Windows\System\CqwjfsS.exe
  2⤵
  PID:6304
- C:\Windows\System\owfkHZw.exe
  C:\Windows\System\owfkHZw.exe
  2⤵
  PID:6436
- C:\Windows\System\iPjcvvA.exe
  C:\Windows\System\iPjcvvA.exe
  2⤵
  PID:6456
- C:\Windows\System\dwnvCZS.exe
  C:\Windows\System\dwnvCZS.exe
  2⤵
  PID:6472
- C:\Windows\System\qhacGdx.exe
  C:\Windows\System\qhacGdx.exe
  2⤵
  PID:6492
- C:\Windows\System\lwgrjBd.exe
  C:\Windows\System\lwgrjBd.exe
  2⤵
  PID:6508
- C:\Windows\System\NkHKuoW.exe
  C:\Windows\System\NkHKuoW.exe
  2⤵
  PID:6524
- C:\Windows\System\LyYkKIF.exe
  C:\Windows\System\LyYkKIF.exe
  2⤵
  PID:6560
- C:\Windows\System\EZbXMgA.exe
  C:\Windows\System\EZbXMgA.exe
  2⤵
  PID:6576
- C:\Windows\System\WviowMW.exe
  C:\Windows\System\WviowMW.exe
  2⤵
  PID:6592
- C:\Windows\System\EyojlrG.exe
  C:\Windows\System\EyojlrG.exe
  2⤵
  PID:6608
- C:\Windows\System\wIsvhwy.exe
  C:\Windows\System\wIsvhwy.exe
  2⤵
  PID:6628
- C:\Windows\System\vFkIYNj.exe
  C:\Windows\System\vFkIYNj.exe
  2⤵
  PID:6644
- C:\Windows\System\ujDeBon.exe
  C:\Windows\System\ujDeBon.exe
  2⤵
  PID:6660
- C:\Windows\System\WwBkHvh.exe
  C:\Windows\System\WwBkHvh.exe
  2⤵
  PID:6680
- C:\Windows\System\ZmmXUBE.exe
  C:\Windows\System\ZmmXUBE.exe
  2⤵
  PID:6696
- C:\Windows\System\DEktmqO.exe
  C:\Windows\System\DEktmqO.exe
  2⤵
  PID:6712
- C:\Windows\System\hiebczr.exe
  C:\Windows\System\hiebczr.exe
  2⤵
  PID:6732
- C:\Windows\System\tFsLsmB.exe
  C:\Windows\System\tFsLsmB.exe
  2⤵
  PID:6748
- C:\Windows\System\SdMzXWr.exe
  C:\Windows\System\SdMzXWr.exe
  2⤵
  PID:6764
- C:\Windows\System\ixLAdan.exe
  C:\Windows\System\ixLAdan.exe
  2⤵
  PID:6784
- C:\Windows\System\QBUjDtT.exe
  C:\Windows\System\QBUjDtT.exe
  2⤵
  PID:6928
- C:\Windows\System\LaOITdg.exe
  C:\Windows\System\LaOITdg.exe
  2⤵
  PID:6996
- C:\Windows\System\TQqHHWE.exe
  C:\Windows\System\TQqHHWE.exe
  2⤵
  PID:7012
- C:\Windows\System\sKcPHhO.exe
  C:\Windows\System\sKcPHhO.exe
  2⤵
  PID:7028
- C:\Windows\System\MBUeIhz.exe
  C:\Windows\System\MBUeIhz.exe
  2⤵
  PID:7044
- C:\Windows\System\WSeriLG.exe
  C:\Windows\System\WSeriLG.exe
  2⤵
  PID:7060
- C:\Windows\System\oWdRFQA.exe
  C:\Windows\System\oWdRFQA.exe
  2⤵
  PID:7076
- C:\Windows\System\KwdrOVG.exe
  C:\Windows\System\KwdrOVG.exe
  2⤵
  PID:7096
- C:\Windows\System\nkhJrns.exe
  C:\Windows\System\nkhJrns.exe
  2⤵
  PID:7112
- C:\Windows\System\SxwOGae.exe
  C:\Windows\System\SxwOGae.exe
  2⤵
  PID:7128
- C:\Windows\System\FwtLeTi.exe
  C:\Windows\System\FwtLeTi.exe
  2⤵
  PID:7144
- C:\Windows\System\tSiUnOO.exe
  C:\Windows\System\tSiUnOO.exe
  2⤵
  PID:7160
- C:\Windows\System\cWaoyUL.exe
  C:\Windows\System\cWaoyUL.exe
  2⤵
  PID:6188
- C:\Windows\System\OOfSYXE.exe
  C:\Windows\System\OOfSYXE.exe
  2⤵
  PID:6252
- C:\Windows\System\EZbjfvt.exe
  C:\Windows\System\EZbjfvt.exe
  2⤵
  PID:6080
- C:\Windows\System\uneIMOU.exe
  C:\Windows\System\uneIMOU.exe
  2⤵
  PID:6296
- C:\Windows\System\tzgsUWc.exe
  C:\Windows\System\tzgsUWc.exe
  2⤵
  PID:5328
- C:\Windows\System\COomwGN.exe
  C:\Windows\System\COomwGN.exe
  2⤵
  PID:4332
- C:\Windows\System\jECPkHe.exe
  C:\Windows\System\jECPkHe.exe
  2⤵
  PID:5744
- C:\Windows\System\GXlwhLk.exe
  C:\Windows\System\GXlwhLk.exe
  2⤵
  PID:5472
- C:\Windows\System\ceVPJxs.exe
  C:\Windows\System\ceVPJxs.exe
  2⤵
  PID:6272
- C:\Windows\System\BMBdXsb.exe
  C:\Windows\System\BMBdXsb.exe
  2⤵
  PID:6316
- C:\Windows\System\sqODKCT.exe
  C:\Windows\System\sqODKCT.exe
  2⤵
  PID:6332
- C:\Windows\System\nXiUHSy.exe
  C:\Windows\System\nXiUHSy.exe
  2⤵
  PID:6360
- C:\Windows\System\XNqDhgN.exe
  C:\Windows\System\XNqDhgN.exe
  2⤵
  PID:6368
- C:\Windows\System\NsfWyEV.exe
  C:\Windows\System\NsfWyEV.exe
  2⤵
  PID:6376
- C:\Windows\System\rpvwyGf.exe
  C:\Windows\System\rpvwyGf.exe
  2⤵
  PID:6396
- C:\Windows\System\bhyYpfF.exe
  C:\Windows\System\bhyYpfF.exe
  2⤵
  PID:6424
- C:\Windows\System\InVIEmf.exe
  C:\Windows\System\InVIEmf.exe
  2⤵
  PID:6468
- C:\Windows\System\AKIafXS.exe
  C:\Windows\System\AKIafXS.exe
  2⤵
  PID:6536
- C:\Windows\System\xDPRvbq.exe
  C:\Windows\System\xDPRvbq.exe
  2⤵
  PID:6452
- C:\Windows\System\xzXnEsG.exe
  C:\Windows\System\xzXnEsG.exe
  2⤵
  PID:6600
- C:\Windows\System\fTGIkwT.exe
  C:\Windows\System\fTGIkwT.exe
  2⤵
  PID:6516
- C:\Windows\System\APyfnPX.exe
  C:\Windows\System\APyfnPX.exe
  2⤵
  PID:6604
- C:\Windows\System\fJMxADq.exe
  C:\Windows\System\fJMxADq.exe
  2⤵
  PID:6556
- C:\Windows\System\vtyYctT.exe
  C:\Windows\System\vtyYctT.exe
  2⤵
  PID:6652
- C:\Windows\System\xtABjhx.exe
  C:\Windows\System\xtABjhx.exe
  2⤵
  PID:6728
- C:\Windows\System\qsHwSti.exe
  C:\Windows\System\qsHwSti.exe
  2⤵
  PID:6688
- C:\Windows\System\EfCEpaw.exe
  C:\Windows\System\EfCEpaw.exe
  2⤵
  PID:6744
- C:\Windows\System\DOMaNUr.exe
  C:\Windows\System\DOMaNUr.exe
  2⤵
  PID:6816
- C:\Windows\System\lOcLPAa.exe
  C:\Windows\System\lOcLPAa.exe
  2⤵
  PID:6944
- C:\Windows\System\fOKGefi.exe
  C:\Windows\System\fOKGefi.exe
  2⤵
  PID:6960
- C:\Windows\System\paExrRv.exe
  C:\Windows\System\paExrRv.exe
  2⤵
  PID:6976
- C:\Windows\System\UaAJvGG.exe
  C:\Windows\System\UaAJvGG.exe
  2⤵
  PID:6924
- C:\Windows\System\YeyvwZs.exe
  C:\Windows\System\YeyvwZs.exe
  2⤵
  PID:6840
- C:\Windows\System\sBZmjPk.exe
  C:\Windows\System\sBZmjPk.exe
  2⤵
  PID:6860
- C:\Windows\System\QwhFBWT.exe
  C:\Windows\System\QwhFBWT.exe
  2⤵
  PID:6876
- C:\Windows\System\VCxykvW.exe
  C:\Windows\System\VCxykvW.exe
  2⤵
  PID:6892
- C:\Windows\System\AmYlcbA.exe
  C:\Windows\System\AmYlcbA.exe
  2⤵
  PID:6908
- C:\Windows\System\mZGPjDN.exe
  C:\Windows\System\mZGPjDN.exe
  2⤵
  PID:6992
- C:\Windows\System\eUQhabM.exe
  C:\Windows\System\eUQhabM.exe
  2⤵
  PID:7052
- C:\Windows\System\nvtamJV.exe
  C:\Windows\System\nvtamJV.exe
  2⤵
  PID:7120
- C:\Windows\System\mxeCvkr.exe
  C:\Windows\System\mxeCvkr.exe
  2⤵
  PID:6220
- C:\Windows\System\meMzWHp.exe
  C:\Windows\System\meMzWHp.exe
  2⤵
  PID:7008
- C:\Windows\System\DZIQzjd.exe
  C:\Windows\System\DZIQzjd.exe
  2⤵
  PID:7072
- C:\Windows\System\zzgvNbW.exe
  C:\Windows\System\zzgvNbW.exe
  2⤵
  PID:7136
- C:\Windows\System\LMZeJvo.exe
  C:\Windows\System\LMZeJvo.exe
  2⤵
  PID:5640
- C:\Windows\System\SHYUtgB.exe
  C:\Windows\System\SHYUtgB.exe
  2⤵
  PID:6172
- C:\Windows\System\QGbjGIS.exe
  C:\Windows\System\QGbjGIS.exe
  2⤵
  PID:6280
- C:\Windows\System\oohJCsv.exe
  C:\Windows\System\oohJCsv.exe
  2⤵
  PID:6340
- C:\Windows\System\ZobJeMh.exe
  C:\Windows\System\ZobJeMh.exe
  2⤵
  PID:6348
- C:\Windows\System\jKQFBlb.exe
  C:\Windows\System\jKQFBlb.exe
  2⤵
  PID:6412
- C:\Windows\System\gSqvLzh.exe
  C:\Windows\System\gSqvLzh.exe
  2⤵
  PID:6532
- C:\Windows\System\XlzxXsm.exe
  C:\Windows\System\XlzxXsm.exe
  2⤵
  PID:6676
- C:\Windows\System\rgKivXK.exe
  C:\Windows\System\rgKivXK.exe
  2⤵
  PID:6692
- C:\Windows\System\XPFhuac.exe
  C:\Windows\System\XPFhuac.exe
  2⤵
  PID:6392
- C:\Windows\System\ALwnmiT.exe
  C:\Windows\System\ALwnmiT.exe
  2⤵
  PID:6232
- C:\Windows\System\zuYYLry.exe
  C:\Windows\System\zuYYLry.exe
  2⤵
  PID:6544
- C:\Windows\System\sfvVgEr.exe
  C:\Windows\System\sfvVgEr.exe
  2⤵
  PID:6464
- C:\Windows\System\zwrKMQF.exe
  C:\Windows\System\zwrKMQF.exe
  2⤵
  PID:6704
- C:\Windows\System\uvlzTGL.exe
  C:\Windows\System\uvlzTGL.exe
  2⤵
  PID:6780
- C:\Windows\System\WcRmNWi.exe
  C:\Windows\System\WcRmNWi.exe
  2⤵
  PID:6808
- C:\Windows\System\pHmbgTk.exe
  C:\Windows\System\pHmbgTk.exe
  2⤵
  PID:6920
- C:\Windows\System\omitfVB.exe
  C:\Windows\System\omitfVB.exe
  2⤵
  PID:6916
- C:\Windows\System\wJdIlRW.exe
  C:\Windows\System\wJdIlRW.exe
  2⤵
  PID:6940
- C:\Windows\System\YtbTpVz.exe
  C:\Windows\System\YtbTpVz.exe
  2⤵
  PID:6856
- C:\Windows\System\nRyIPyV.exe
  C:\Windows\System\nRyIPyV.exe
  2⤵
  PID:5200
- C:\Windows\System\rMySbiW.exe
  C:\Windows\System\rMySbiW.exe
  2⤵
  PID:6292
- C:\Windows\System\YthxNST.exe
  C:\Windows\System\YthxNST.exe
  2⤵
  PID:7040
- C:\Windows\System\BDguwcJ.exe
  C:\Windows\System\BDguwcJ.exe
  2⤵
  PID:6268
- C:\Windows\System\hoESDOY.exe
  C:\Windows\System\hoESDOY.exe
  2⤵
  PID:6344
- C:\Windows\System\GidZCXr.exe
  C:\Windows\System\GidZCXr.exe
  2⤵
  PID:6384
- C:\Windows\System\VDCbHgj.exe
  C:\Windows\System\VDCbHgj.exe
  2⤵
  PID:6540
- C:\Windows\System\HntxcXE.exe
  C:\Windows\System\HntxcXE.exe
  2⤵
  PID:6812
- C:\Windows\System\APABBex.exe
  C:\Windows\System\APABBex.exe
  2⤵
  PID:6984
- C:\Windows\System\HXcZegN.exe
  C:\Windows\System\HXcZegN.exe
  2⤵
  PID:6300
- C:\Windows\System\LRPbRgQ.exe
  C:\Windows\System\LRPbRgQ.exe
  2⤵
  PID:7024
- C:\Windows\System\tFKJoGi.exe
  C:\Windows\System\tFKJoGi.exe
  2⤵
  PID:4928
- C:\Windows\System\DQCNdaF.exe
  C:\Windows\System\DQCNdaF.exe
  2⤵
  PID:6324
- C:\Windows\System\TelinOK.exe
  C:\Windows\System\TelinOK.exe
  2⤵
  PID:7152
- C:\Windows\System\GYnwVtg.exe
  C:\Windows\System\GYnwVtg.exe
  2⤵
  PID:6740
- C:\Windows\System\SBnUbaE.exe
  C:\Windows\System\SBnUbaE.exe
  2⤵
  PID:6236
- C:\Windows\System\LOngNOa.exe
  C:\Windows\System\LOngNOa.exe
  2⤵
  PID:6484
- C:\Windows\System\pIAqPka.exe
  C:\Windows\System\pIAqPka.exe
  2⤵
  PID:6720
- C:\Windows\System\xAlZxmF.exe
  C:\Windows\System\xAlZxmF.exe
  2⤵
  PID:6400
- C:\Windows\System\HaVYbrI.exe
  C:\Windows\System\HaVYbrI.exe
  2⤵
  PID:6656
- C:\Windows\System\PGgfzfQ.exe
  C:\Windows\System\PGgfzfQ.exe
  2⤵
  PID:6832
- C:\Windows\System\XqCqMTh.exe
  C:\Windows\System\XqCqMTh.exe
  2⤵
  PID:6868
- C:\Windows\System\PqDyWQf.exe
  C:\Windows\System\PqDyWQf.exe
  2⤵
  PID:6488
- C:\Windows\System\tmcvQqW.exe
  C:\Windows\System\tmcvQqW.exe
  2⤵
  PID:7088
- C:\Windows\System\uCJnIYl.exe
  C:\Windows\System\uCJnIYl.exe
  2⤵
  PID:6972
- C:\Windows\System\PxCbsas.exe
  C:\Windows\System\PxCbsas.exe
  2⤵
  PID:6872
- C:\Windows\System\uCLkrra.exe
  C:\Windows\System\uCLkrra.exe
  2⤵
  PID:6792
- C:\Windows\System\KfdyHPl.exe
  C:\Windows\System\KfdyHPl.exe
  2⤵
  PID:7188
- C:\Windows\System\ufrCEfQ.exe
  C:\Windows\System\ufrCEfQ.exe
  2⤵
  PID:7212
- C:\Windows\System\KUnCxqW.exe
  C:\Windows\System\KUnCxqW.exe
  2⤵
  PID:7236
- C:\Windows\System\ICSWsaT.exe
  C:\Windows\System\ICSWsaT.exe
  2⤵
  PID:7252
- C:\Windows\System\oRxdHqk.exe
  C:\Windows\System\oRxdHqk.exe
  2⤵
  PID:7268
- C:\Windows\System\ljfoYYX.exe
  C:\Windows\System\ljfoYYX.exe
  2⤵
  PID:7284
- C:\Windows\System\nQNPBEr.exe
  C:\Windows\System\nQNPBEr.exe
  2⤵
  PID:7300
- C:\Windows\System\ZcOkRSB.exe
  C:\Windows\System\ZcOkRSB.exe
  2⤵
  PID:7316
- C:\Windows\System\IlaYNsg.exe
  C:\Windows\System\IlaYNsg.exe
  2⤵
  PID:7332
- C:\Windows\System\SjYwZrs.exe
  C:\Windows\System\SjYwZrs.exe
  2⤵
  PID:7348
- C:\Windows\System\GjwlUTL.exe
  C:\Windows\System\GjwlUTL.exe
  2⤵
  PID:7364
- C:\Windows\System\SJcKAPX.exe
  C:\Windows\System\SJcKAPX.exe
  2⤵
  PID:7380
- C:\Windows\System\LEKehpp.exe
  C:\Windows\System\LEKehpp.exe
  2⤵
  PID:7396
- C:\Windows\System\mdcIsNs.exe
  C:\Windows\System\mdcIsNs.exe
  2⤵
  PID:7412
- C:\Windows\System\wXavfbW.exe
  C:\Windows\System\wXavfbW.exe
  2⤵
  PID:7428
- C:\Windows\System\qmfefZJ.exe
  C:\Windows\System\qmfefZJ.exe
  2⤵
  PID:7444
- C:\Windows\System\DeMNimb.exe
  C:\Windows\System\DeMNimb.exe
  2⤵
  PID:7460
- C:\Windows\System\zxsWqwr.exe
  C:\Windows\System\zxsWqwr.exe
  2⤵
  PID:7476
- C:\Windows\System\eSHFcjL.exe
  C:\Windows\System\eSHFcjL.exe
  2⤵
  PID:7492
- C:\Windows\System\HYGaOWX.exe
  C:\Windows\System\HYGaOWX.exe
  2⤵
  PID:7508
- C:\Windows\System\tNHCOMe.exe
  C:\Windows\System\tNHCOMe.exe
  2⤵
  PID:7524
- C:\Windows\System\HMtzzaq.exe
  C:\Windows\System\HMtzzaq.exe
  2⤵
  PID:7540
- C:\Windows\System\axhCsIB.exe
  C:\Windows\System\axhCsIB.exe
  2⤵
  PID:7556
- C:\Windows\System\djdLXGB.exe
  C:\Windows\System\djdLXGB.exe
  2⤵
  PID:7576
- C:\Windows\System\OvIqQLB.exe
  C:\Windows\System\OvIqQLB.exe
  2⤵
  PID:7592
- C:\Windows\System\puDTkbk.exe
  C:\Windows\System\puDTkbk.exe
  2⤵
  PID:7608
- C:\Windows\System\RVLTDJi.exe
  C:\Windows\System\RVLTDJi.exe
  2⤵
  PID:7624
- C:\Windows\System\exFabhS.exe
  C:\Windows\System\exFabhS.exe
  2⤵
  PID:7640
- C:\Windows\System\FGXqTzk.exe
  C:\Windows\System\FGXqTzk.exe
  2⤵
  PID:7656
- C:\Windows\System\hDDLXMr.exe
  C:\Windows\System\hDDLXMr.exe
  2⤵
  PID:7672
- C:\Windows\System\FEFFDFk.exe
  C:\Windows\System\FEFFDFk.exe
  2⤵
  PID:7688
- C:\Windows\System\jAwBtqE.exe
  C:\Windows\System\jAwBtqE.exe
  2⤵
  PID:7704
- C:\Windows\System\mTwUqzy.exe
  C:\Windows\System\mTwUqzy.exe
  2⤵
  PID:7720
- C:\Windows\System\VOihGAo.exe
  C:\Windows\System\VOihGAo.exe
  2⤵
  PID:7736
- C:\Windows\System\JQvJUhS.exe
  C:\Windows\System\JQvJUhS.exe
  2⤵
  PID:7752
- C:\Windows\System\tXyjniW.exe
  C:\Windows\System\tXyjniW.exe
  2⤵
  PID:7768
- C:\Windows\System\yhXHIOG.exe
  C:\Windows\System\yhXHIOG.exe
  2⤵
  PID:7784
- C:\Windows\System\OGUUaru.exe
  C:\Windows\System\OGUUaru.exe
  2⤵
  PID:7800
- C:\Windows\System\wByxxtf.exe
  C:\Windows\System\wByxxtf.exe
  2⤵
  PID:7816
- C:\Windows\System\mtWBTru.exe
  C:\Windows\System\mtWBTru.exe
  2⤵
  PID:7832
- C:\Windows\System\FlYweJr.exe
  C:\Windows\System\FlYweJr.exe
  2⤵
  PID:7848
- C:\Windows\System\lWMGOXQ.exe
  C:\Windows\System\lWMGOXQ.exe
  2⤵
  PID:7864
- C:\Windows\System\lRxWzjD.exe
  C:\Windows\System\lRxWzjD.exe
  2⤵
  PID:7880
- C:\Windows\System\TNIBZGM.exe
  C:\Windows\System\TNIBZGM.exe
  2⤵
  PID:7896
- C:\Windows\System\fvdIDOv.exe
  C:\Windows\System\fvdIDOv.exe
  2⤵
  PID:7912
- C:\Windows\System\oKlmfal.exe
  C:\Windows\System\oKlmfal.exe
  2⤵
  PID:7928
- C:\Windows\System\unNEQgG.exe
  C:\Windows\System\unNEQgG.exe
  2⤵
  PID:7944
- C:\Windows\System\MEwbEBD.exe
  C:\Windows\System\MEwbEBD.exe
  2⤵
  PID:7960
- C:\Windows\System\IhLsUHm.exe
  C:\Windows\System\IhLsUHm.exe
  2⤵
  PID:7976
- C:\Windows\System\enqMTaS.exe
  C:\Windows\System\enqMTaS.exe
  2⤵
  PID:7992
- C:\Windows\System\jdocVGE.exe
  C:\Windows\System\jdocVGE.exe
  2⤵
  PID:8008
- C:\Windows\System\ChprWkp.exe
  C:\Windows\System\ChprWkp.exe
  2⤵
  PID:8024
- C:\Windows\System\siMyCms.exe
  C:\Windows\System\siMyCms.exe
  2⤵
  PID:8040
- C:\Windows\System\HfBrdxt.exe
  C:\Windows\System\HfBrdxt.exe
  2⤵
  PID:8056
- C:\Windows\System\fsOARlZ.exe
  C:\Windows\System\fsOARlZ.exe
  2⤵
  PID:8072
- C:\Windows\System\TdImfmp.exe
  C:\Windows\System\TdImfmp.exe
  2⤵
  PID:8088
- C:\Windows\System\FvRchBL.exe
  C:\Windows\System\FvRchBL.exe
  2⤵
  PID:8104
- C:\Windows\System\WJdcTMC.exe
  C:\Windows\System\WJdcTMC.exe
  2⤵
  PID:8120
- C:\Windows\System\xaSLwFu.exe
  C:\Windows\System\xaSLwFu.exe
  2⤵
  PID:8136
- C:\Windows\System\DtgeeCY.exe
  C:\Windows\System\DtgeeCY.exe
  2⤵
  PID:8152
- C:\Windows\System\eEJAEmG.exe
  C:\Windows\System\eEJAEmG.exe
  2⤵
  PID:8168
- C:\Windows\System\DGwBAPR.exe
  C:\Windows\System\DGwBAPR.exe
  2⤵
  PID:8184
- C:\Windows\System\FNnpdgz.exe
  C:\Windows\System\FNnpdgz.exe
  2⤵
  PID:6432
- C:\Windows\System\utApGCp.exe
  C:\Windows\System\utApGCp.exe
  2⤵
  PID:7184
- C:\Windows\System\kPkqrGW.exe
  C:\Windows\System\kPkqrGW.exe
  2⤵
  PID:6756
- C:\Windows\System\asJkHHk.exe
  C:\Windows\System\asJkHHk.exe
  2⤵
  PID:7204
- C:\Windows\System\oipzxUU.exe
  C:\Windows\System\oipzxUU.exe
  2⤵
  PID:7260
- C:\Windows\System\lgehTgD.exe
  C:\Windows\System\lgehTgD.exe
  2⤵
  PID:7356
- C:\Windows\System\LZFKDZQ.exe
  C:\Windows\System\LZFKDZQ.exe
  2⤵
  PID:7420
- C:\Windows\System\jVlRLwa.exe
  C:\Windows\System\jVlRLwa.exe
  2⤵
  PID:7484
- C:\Windows\System\fumQWVy.exe
  C:\Windows\System\fumQWVy.exe
  2⤵
  PID:7548
- C:\Windows\System\FkjdmIJ.exe
  C:\Windows\System\FkjdmIJ.exe
  2⤵
  PID:7248
- C:\Windows\System\gqRJRyF.exe
  C:\Windows\System\gqRJRyF.exe
  2⤵
  PID:7276
- C:\Windows\System\qRAweeR.exe
  C:\Windows\System\qRAweeR.exe
  2⤵
  PID:7344
- C:\Windows\System\IwaUqGh.exe
  C:\Windows\System\IwaUqGh.exe
  2⤵
  PID:7716
- C:\Windows\System\erfnmuK.exe
  C:\Windows\System\erfnmuK.exe
  2⤵
  PID:7840
- C:\Windows\System\XWMfZHC.exe
  C:\Windows\System\XWMfZHC.exe
  2⤵
  PID:7372
- C:\Windows\System\uLQMQxx.exe
  C:\Windows\System\uLQMQxx.exe
  2⤵
  PID:7436
- C:\Windows\System\nDxVFDc.exe
  C:\Windows\System\nDxVFDc.exe
  2⤵
  PID:7500
- C:\Windows\System\yfeaHpf.exe
  C:\Windows\System\yfeaHpf.exe
  2⤵
  PID:7572
- C:\Windows\System\ILPaRJN.exe
  C:\Windows\System\ILPaRJN.exe
  2⤵
  PID:7664
- C:\Windows\System\RuenHPz.exe
  C:\Windows\System\RuenHPz.exe
  2⤵
  PID:7700
- C:\Windows\System\IkdrAMa.exe
  C:\Windows\System\IkdrAMa.exe
  2⤵
  PID:7764
- C:\Windows\System\noDlNdI.exe
  C:\Windows\System\noDlNdI.exe
  2⤵
  PID:7536
- C:\Windows\System\zlHwfOD.exe
  C:\Windows\System\zlHwfOD.exe
  2⤵
  PID:7696
- C:\Windows\System\EiwYarH.exe
  C:\Windows\System\EiwYarH.exe
  2⤵
  PID:7908
- C:\Windows\System\qWMGWjC.exe
  C:\Windows\System\qWMGWjC.exe
  2⤵
  PID:7972
- C:\Windows\System\UknBrEq.exe
  C:\Windows\System\UknBrEq.exe
  2⤵
  PID:7924
- C:\Windows\System\lGbWXOv.exe
  C:\Windows\System\lGbWXOv.exe
  2⤵
  PID:8068
- C:\Windows\System\RlAAyRb.exe
  C:\Windows\System\RlAAyRb.exe
  2⤵
  PID:8064
- C:\Windows\System\OCICgaR.exe
  C:\Windows\System\OCICgaR.exe
  2⤵
  PID:8164
- C:\Windows\System\lZnwfVN.exe
  C:\Windows\System\lZnwfVN.exe
  2⤵
  PID:5188
- C:\Windows\System\RBCVoiw.exe
  C:\Windows\System\RBCVoiw.exe
  2⤵
  PID:7392
- C:\Windows\System\PedRcbv.exe
  C:\Windows\System\PedRcbv.exe
  2⤵
  PID:8020
- C:\Windows\System\PCxeGyu.exe
  C:\Windows\System\PCxeGyu.exe
  2⤵
  PID:8016
- C:\Windows\System\rNbRQMi.exe
  C:\Windows\System\rNbRQMi.exe
  2⤵
  PID:8084
- C:\Windows\System\wgTwWIp.exe
  C:\Windows\System\wgTwWIp.exe
  2⤵
  PID:8148
- C:\Windows\System\QFWdpIf.exe
  C:\Windows\System\QFWdpIf.exe
  2⤵
  PID:7652
- C:\Windows\System\UKELSAN.exe
  C:\Windows\System\UKELSAN.exe
  2⤵
  PID:7196
- C:\Windows\System\ysdKEMu.exe
  C:\Windows\System\ysdKEMu.exe
  2⤵
  PID:7328
- C:\Windows\System\igjYzmC.exe
  C:\Windows\System\igjYzmC.exe
  2⤵
  PID:7616
- C:\Windows\System\SOPKMZi.exe
  C:\Windows\System\SOPKMZi.exe
  2⤵
  PID:7844
- C:\Windows\System\CMIHJNc.exe
  C:\Windows\System\CMIHJNc.exe
  2⤵
  PID:7632
- C:\Windows\System\nZvGStn.exe
  C:\Windows\System\nZvGStn.exe
  2⤵
  PID:7760
- C:\Windows\System\JxpUTDE.exe
  C:\Windows\System\JxpUTDE.exe
  2⤵
  PID:7968
- C:\Windows\System\CYEiejT.exe
  C:\Windows\System\CYEiejT.exe
  2⤵
  PID:8160
- C:\Windows\System\TRIvGsN.exe
  C:\Windows\System\TRIvGsN.exe
  2⤵
  PID:7988
- C:\Windows\System\FsvnGkU.exe
  C:\Windows\System\FsvnGkU.exe
  2⤵
  PID:7532
- C:\Windows\System\inUzDfm.exe
  C:\Windows\System\inUzDfm.exe
  2⤵
  PID:7796
- C:\Windows\System\hDcONSG.exe
  C:\Windows\System\hDcONSG.exe
  2⤵
  PID:7920
- C:\Windows\System\JqvuYRD.exe
  C:\Windows\System\JqvuYRD.exe
  2⤵
  PID:8144
- C:\Windows\System\cvABZEg.exe
  C:\Windows\System\cvABZEg.exe
  2⤵
  PID:7856
- C:\Windows\System\bEffqhZ.exe
  C:\Windows\System\bEffqhZ.exe
  2⤵
  PID:7520
- C:\Windows\System\vWuQooB.exe
  C:\Windows\System\vWuQooB.exe
  2⤵
  PID:8080
- C:\Windows\System\PgmfTMM.exe
  C:\Windows\System\PgmfTMM.exe
  2⤵
  PID:7324
- C:\Windows\System\mtwAuXC.exe
  C:\Windows\System\mtwAuXC.exe
  2⤵
  PID:7604
- C:\Windows\System\jzpsNFp.exe
  C:\Windows\System\jzpsNFp.exe
  2⤵
  PID:7340
- C:\Windows\System\DmuFMlz.exe
  C:\Windows\System\DmuFMlz.exe
  2⤵
  PID:7748
- C:\Windows\System\pXGiSWU.exe
  C:\Windows\System\pXGiSWU.exe
  2⤵
  PID:6668
- C:\Windows\System\YXVwKEM.exe
  C:\Windows\System\YXVwKEM.exe
  2⤵
  PID:8180
- C:\Windows\System\ImvPpkV.exe
  C:\Windows\System\ImvPpkV.exe
  2⤵
  PID:8204
- C:\Windows\System\kwtWzTW.exe
  C:\Windows\System\kwtWzTW.exe
  2⤵
  PID:8220
- C:\Windows\System\hZGQKNY.exe
  C:\Windows\System\hZGQKNY.exe
  2⤵
  PID:8236
- C:\Windows\System\QCLmWgU.exe
  C:\Windows\System\QCLmWgU.exe
  2⤵
  PID:8252
- C:\Windows\System\GiKGJrw.exe
  C:\Windows\System\GiKGJrw.exe
  2⤵
  PID:8268
- C:\Windows\System\JThGPrg.exe
  C:\Windows\System\JThGPrg.exe
  2⤵
  PID:8284
- C:\Windows\System\nOiZBhp.exe
  C:\Windows\System\nOiZBhp.exe
  2⤵
  PID:8300
- C:\Windows\System\lwATBMn.exe
  C:\Windows\System\lwATBMn.exe
  2⤵
  PID:8316
- C:\Windows\System\AtJUalz.exe
  C:\Windows\System\AtJUalz.exe
  2⤵
  PID:8332
- C:\Windows\System\shHGGqJ.exe
  C:\Windows\System\shHGGqJ.exe
  2⤵
  PID:8348
- C:\Windows\System\NIlJlAU.exe
  C:\Windows\System\NIlJlAU.exe
  2⤵
  PID:8364
- C:\Windows\System\KEEgNiT.exe
  C:\Windows\System\KEEgNiT.exe
  2⤵
  PID:8384
- C:\Windows\System\BAEDhtV.exe
  C:\Windows\System\BAEDhtV.exe
  2⤵
  PID:8400
- C:\Windows\System\ZGpaovU.exe
  C:\Windows\System\ZGpaovU.exe
  2⤵
  PID:8416
- C:\Windows\System\nupLSvN.exe
  C:\Windows\System\nupLSvN.exe
  2⤵
  PID:8432
- C:\Windows\System\rgMKjML.exe
  C:\Windows\System\rgMKjML.exe
  2⤵
  PID:8448
- C:\Windows\System\wGhJbUi.exe
  C:\Windows\System\wGhJbUi.exe
  2⤵
  PID:8464
- C:\Windows\System\xXIBlLV.exe
  C:\Windows\System\xXIBlLV.exe
  2⤵
  PID:8564
- C:\Windows\System\lSoshKi.exe
  C:\Windows\System\lSoshKi.exe
  2⤵
  PID:8580
- C:\Windows\System\XfPOuaA.exe
  C:\Windows\System\XfPOuaA.exe
  2⤵
  PID:8596
- C:\Windows\System\hMsRNjY.exe
  C:\Windows\System\hMsRNjY.exe
  2⤵
  PID:8612
- C:\Windows\System\brFsyhR.exe
  C:\Windows\System\brFsyhR.exe
  2⤵
  PID:8628
- C:\Windows\System\HxCPnIh.exe
  C:\Windows\System\HxCPnIh.exe
  2⤵
  PID:8644
- C:\Windows\System\GcUaLjH.exe
  C:\Windows\System\GcUaLjH.exe
  2⤵
  PID:8660
- C:\Windows\System\anvijlm.exe
  C:\Windows\System\anvijlm.exe
  2⤵
  PID:8676
- C:\Windows\System\acQuZcZ.exe
  C:\Windows\System\acQuZcZ.exe
  2⤵
  PID:8692
- C:\Windows\System\UvyDRLT.exe
  C:\Windows\System\UvyDRLT.exe
  2⤵
  PID:8708
- C:\Windows\System\HDZyyMU.exe
  C:\Windows\System\HDZyyMU.exe
  2⤵
  PID:8724
- C:\Windows\System\sqgnsKa.exe
  C:\Windows\System\sqgnsKa.exe
  2⤵
  PID:8740
- C:\Windows\System\HGqkExX.exe
  C:\Windows\System\HGqkExX.exe
  2⤵
  PID:8756
- C:\Windows\System\uVshiiL.exe
  C:\Windows\System\uVshiiL.exe
  2⤵
  PID:8772
- C:\Windows\System\yBUwxPN.exe
  C:\Windows\System\yBUwxPN.exe
  2⤵
  PID:8788
- C:\Windows\System\gksdNpA.exe
  C:\Windows\System\gksdNpA.exe
  2⤵
  PID:8804
- C:\Windows\System\MYQOgdw.exe
  C:\Windows\System\MYQOgdw.exe
  2⤵
  PID:8820
- C:\Windows\System\mIKiepa.exe
  C:\Windows\System\mIKiepa.exe
  2⤵
  PID:8836
- C:\Windows\System\UbSYeNH.exe
  C:\Windows\System\UbSYeNH.exe
  2⤵
  PID:8852
- C:\Windows\System\slJiduJ.exe
  C:\Windows\System\slJiduJ.exe
  2⤵
  PID:8868
- C:\Windows\System\xWJdMXK.exe
  C:\Windows\System\xWJdMXK.exe
  2⤵
  PID:8884
- C:\Windows\System\xzGHPIo.exe
  C:\Windows\System\xzGHPIo.exe
  2⤵
  PID:8900
- C:\Windows\System\BylRUde.exe
  C:\Windows\System\BylRUde.exe
  2⤵
  PID:8916
- C:\Windows\System\VzdAoJM.exe
  C:\Windows\System\VzdAoJM.exe
  2⤵
  PID:8932
- C:\Windows\System\dkuWAqP.exe
  C:\Windows\System\dkuWAqP.exe
  2⤵
  PID:8948
- C:\Windows\System\XQVdFQd.exe
  C:\Windows\System\XQVdFQd.exe
  2⤵
  PID:8964
- C:\Windows\System\bXdZHiZ.exe
  C:\Windows\System\bXdZHiZ.exe
  2⤵
  PID:8980
- C:\Windows\System\BISrezI.exe
  C:\Windows\System\BISrezI.exe
  2⤵
  PID:8996
- C:\Windows\System\vIXQhPT.exe
  C:\Windows\System\vIXQhPT.exe
  2⤵
  PID:9012
- C:\Windows\System\ZNkAcsh.exe
  C:\Windows\System\ZNkAcsh.exe
  2⤵
  PID:9028
- C:\Windows\System\rxzkZSN.exe
  C:\Windows\System\rxzkZSN.exe
  2⤵
  PID:9044
- C:\Windows\System\NAEIitA.exe
  C:\Windows\System\NAEIitA.exe
  2⤵
  PID:9060
- C:\Windows\System\LKncytj.exe
  C:\Windows\System\LKncytj.exe
  2⤵
  PID:9076
- C:\Windows\System\LYshYoM.exe
  C:\Windows\System\LYshYoM.exe
  2⤵
  PID:9092
- C:\Windows\System\dOYTFmQ.exe
  C:\Windows\System\dOYTFmQ.exe
  2⤵
  PID:9108
- C:\Windows\System\oumUTWw.exe
  C:\Windows\System\oumUTWw.exe
  2⤵
  PID:9124
- C:\Windows\System\eyUuUfy.exe
  C:\Windows\System\eyUuUfy.exe
  2⤵
  PID:9140
- C:\Windows\System\xXTUCJE.exe
  C:\Windows\System\xXTUCJE.exe
  2⤵
  PID:9156
- C:\Windows\System\TCpQydz.exe
  C:\Windows\System\TCpQydz.exe
  2⤵
  PID:9172
- C:\Windows\System\zUoRjSQ.exe
  C:\Windows\System\zUoRjSQ.exe
  2⤵
  PID:9188
- C:\Windows\System\XmeFLcN.exe
  C:\Windows\System\XmeFLcN.exe
  2⤵
  PID:9204
- C:\Windows\System\cznDmhy.exe
  C:\Windows\System\cznDmhy.exe
  2⤵
  PID:7940
- C:\Windows\System\meVZhSe.exe
  C:\Windows\System\meVZhSe.exe
  2⤵
  PID:7308
- C:\Windows\System\CHJYlWB.exe
  C:\Windows\System\CHJYlWB.exe
  2⤵
  PID:8264
- C:\Windows\System\kjsHlki.exe
  C:\Windows\System\kjsHlki.exe
  2⤵
  PID:7296
- C:\Windows\System\XLfzeLC.exe
  C:\Windows\System\XLfzeLC.exe
  2⤵
  PID:8276
- C:\Windows\System\LYTfOlc.exe
  C:\Windows\System\LYTfOlc.exe
  2⤵
  PID:8376
- C:\Windows\System\ADmiBDi.exe
  C:\Windows\System\ADmiBDi.exe
  2⤵
  PID:8392
- C:\Windows\System\cXpZLgr.exe
  C:\Windows\System\cXpZLgr.exe
  2⤵
  PID:8440
- C:\Windows\System\QZdnUrM.exe
  C:\Windows\System\QZdnUrM.exe
  2⤵
  PID:8476
- C:\Windows\System\hJnUDNA.exe
  C:\Windows\System\hJnUDNA.exe
  2⤵
  PID:8492
- C:\Windows\System\IcXZTPo.exe
  C:\Windows\System\IcXZTPo.exe
  2⤵
  PID:8504
- C:\Windows\System\EPYekuv.exe
  C:\Windows\System\EPYekuv.exe
  2⤵
  PID:8520
- C:\Windows\System\aBeiDTr.exe
  C:\Windows\System\aBeiDTr.exe
  2⤵
  PID:8536
- C:\Windows\System\ejMWdTR.exe
  C:\Windows\System\ejMWdTR.exe
  2⤵
  PID:8556
- C:\Windows\System\IVzKcUM.exe
  C:\Windows\System\IVzKcUM.exe
  2⤵
  PID:8588
- C:\Windows\System\IGspxHk.exe
  C:\Windows\System\IGspxHk.exe
  2⤵
  PID:8620
- C:\Windows\System\ZiWIaVF.exe
  C:\Windows\System\ZiWIaVF.exe
  2⤵
  PID:8668
- C:\Windows\System\gWzFtwW.exe
  C:\Windows\System\gWzFtwW.exe
  2⤵
  PID:1496
- C:\Windows\System\pEMWbMT.exe
  C:\Windows\System\pEMWbMT.exe
  2⤵
  PID:8736
- C:\Windows\System\kwuJAjO.exe
  C:\Windows\System\kwuJAjO.exe
  2⤵
  PID:8684
- C:\Windows\System\YoSuEYg.exe
  C:\Windows\System\YoSuEYg.exe
  2⤵
  PID:8812
- C:\Windows\System\gpkZlue.exe
  C:\Windows\System\gpkZlue.exe
  2⤵
  PID:8780
- C:\Windows\System\VfjhAKq.exe
  C:\Windows\System\VfjhAKq.exe
  2⤵
  PID:8832
- C:\Windows\System\LZjnfWO.exe
  C:\Windows\System\LZjnfWO.exe
  2⤵
  PID:8844
- C:\Windows\System\EUZxgFQ.exe
  C:\Windows\System\EUZxgFQ.exe
  2⤵
  PID:8956
- C:\Windows\System\ZmFIEWO.exe
  C:\Windows\System\ZmFIEWO.exe
  2⤵
  PID:8848
- C:\Windows\System\aelUyxx.exe
  C:\Windows\System\aelUyxx.exe
  2⤵
  PID:9024
- C:\Windows\System\FhknvCR.exe
  C:\Windows\System\FhknvCR.exe
  2⤵
  PID:9056
- C:\Windows\System\rZtIHoB.exe
  C:\Windows\System\rZtIHoB.exe
  2⤵
  PID:9148
- C:\Windows\System\cxuDIPA.exe
  C:\Windows\System\cxuDIPA.exe
  2⤵
  PID:9212
- C:\Windows\System\AAdCXIy.exe
  C:\Windows\System\AAdCXIy.exe
  2⤵
  PID:8232
- C:\Windows\System\hlJBogU.exe
  C:\Windows\System\hlJBogU.exe
  2⤵
  PID:8324
- C:\Windows\System\DuIbKci.exe
  C:\Windows\System\DuIbKci.exe
  2⤵
  PID:7636
- C:\Windows\System\cPsKezA.exe
  C:\Windows\System\cPsKezA.exe
  2⤵
  PID:8380
- C:\Windows\System\EPIrGIm.exe
  C:\Windows\System\EPIrGIm.exe
  2⤵
  PID:7180
- C:\Windows\System\KAIGYTn.exe
  C:\Windows\System\KAIGYTn.exe
  2⤵
  PID:7588
- C:\Windows\System\nvuIRaX.exe
  C:\Windows\System\nvuIRaX.exe
  2⤵
  PID:9164
- C:\Windows\System\XTVLTtq.exe
  C:\Windows\System\XTVLTtq.exe
  2⤵
  PID:9100
- C:\Windows\System\MhyDxsy.exe
  C:\Windows\System\MhyDxsy.exe
  2⤵
  PID:9036
- C:\Windows\System\RgkivEm.exe
  C:\Windows\System\RgkivEm.exe
  2⤵
  PID:8976
- C:\Windows\System\oCjjknV.exe
  C:\Windows\System\oCjjknV.exe
  2⤵
  PID:7732
- C:\Windows\System\IvjlPZt.exe
  C:\Windows\System\IvjlPZt.exe
  2⤵
  PID:7780
- C:\Windows\System\dtPXrFr.exe
  C:\Windows\System\dtPXrFr.exe
  2⤵
  PID:8408
- C:\Windows\System\QdeRzKg.exe
  C:\Windows\System\QdeRzKg.exe
  2⤵
  PID:8528
- C:\Windows\System\RlleCqq.exe
  C:\Windows\System\RlleCqq.exe
  2⤵
  PID:8636
- C:\Windows\System\mvHncPk.exe
  C:\Windows\System\mvHncPk.exe
  2⤵
  PID:8704
- C:\Windows\System\YcoYxjT.exe
  C:\Windows\System\YcoYxjT.exe
  2⤵
  PID:8688
- C:\Windows\System\tABkEZl.exe
  C:\Windows\System\tABkEZl.exe
  2⤵
  PID:8880
- C:\Windows\System\bypBAPj.exe
  C:\Windows\System\bypBAPj.exe
  2⤵
  PID:9116
- C:\Windows\System\VIrmwZM.exe
  C:\Windows\System\VIrmwZM.exe
  2⤵
  PID:8456
- C:\Windows\System\rohqfvv.exe
  C:\Windows\System\rohqfvv.exe
  2⤵
  PID:8552
- C:\Windows\System\kHdEIhr.exe
  C:\Windows\System\kHdEIhr.exe
  2⤵
  PID:9180
- C:\Windows\System\EoqIafh.exe
  C:\Windows\System\EoqIafh.exe
  2⤵
  PID:8752
- C:\Windows\System\lyPLpCZ.exe
  C:\Windows\System\lyPLpCZ.exe
  2⤵
  PID:8672
- C:\Windows\System\DFhbcHQ.exe
  C:\Windows\System\DFhbcHQ.exe
  2⤵
  PID:8216
- C:\Windows\System\moOTAZt.exe
  C:\Windows\System\moOTAZt.exe
  2⤵
  PID:7404
- C:\Windows\System\uAvRUWJ.exe
  C:\Windows\System\uAvRUWJ.exe
  2⤵
  PID:9068
- C:\Windows\System\BdOTnHE.exe
  C:\Windows\System\BdOTnHE.exe
  2⤵
  PID:8424
- C:\Windows\System\UTIqZrz.exe
  C:\Windows\System\UTIqZrz.exe
  2⤵
  PID:8720
- C:\Windows\System\EPFISXl.exe
  C:\Windows\System\EPFISXl.exe
  2⤵
  PID:7828
- C:\Windows\System\xKMsQOx.exe
  C:\Windows\System\xKMsQOx.exe
  2⤵
  PID:8480
- C:\Windows\System\pBcAPAT.exe
  C:\Windows\System\pBcAPAT.exe
  2⤵
  PID:9136
- C:\Windows\System\wPSKfTe.exe
  C:\Windows\System\wPSKfTe.exe
  2⤵
  PID:8928
- C:\Windows\System\ixJHGPM.exe
  C:\Windows\System\ixJHGPM.exe
  2⤵
  PID:8544
- C:\Windows\System\FWIoxjF.exe
  C:\Windows\System\FWIoxjF.exe
  2⤵
  PID:8864
- C:\Windows\System\YmDRHFO.exe
  C:\Windows\System\YmDRHFO.exe
  2⤵
  PID:8372
- C:\Windows\System\TYlINCi.exe
  C:\Windows\System\TYlINCi.exe
  2⤵
  PID:8296
- C:\Windows\System\BCDHpYr.exe
  C:\Windows\System\BCDHpYr.exe
  2⤵
  PID:8796
- C:\Windows\System\ryeXgpU.exe
  C:\Windows\System\ryeXgpU.exe
  2⤵
  PID:8340
- C:\Windows\System\NtYguzh.exe
  C:\Windows\System\NtYguzh.exe
  2⤵
  PID:8944
- C:\Windows\System\VOPDyuv.exe
  C:\Windows\System\VOPDyuv.exe
  2⤵
  PID:8312
- C:\Windows\System\vCxxhQb.exe
  C:\Windows\System\vCxxhQb.exe
  2⤵
  PID:8260
- C:\Windows\System\hVorjEZ.exe
  C:\Windows\System\hVorjEZ.exe
  2⤵
  PID:8360
- C:\Windows\System\LyBSUvE.exe
  C:\Windows\System\LyBSUvE.exe
  2⤵
  PID:9196
- C:\Windows\System\VSbtVIC.exe
  C:\Windows\System\VSbtVIC.exe
  2⤵
  PID:9228
- C:\Windows\System\XFQRYSm.exe
  C:\Windows\System\XFQRYSm.exe
  2⤵
  PID:9248
- C:\Windows\System\eHXpcsk.exe
  C:\Windows\System\eHXpcsk.exe
  2⤵
  PID:9264
- C:\Windows\System\CiEraNO.exe
  C:\Windows\System\CiEraNO.exe
  2⤵
  PID:9280
- C:\Windows\System\JXXyckw.exe
  C:\Windows\System\JXXyckw.exe
  2⤵
  PID:9308
- C:\Windows\System\ocBJJSR.exe
  C:\Windows\System\ocBJJSR.exe
  2⤵
  PID:9324
- C:\Windows\System\vIuFzZw.exe
  C:\Windows\System\vIuFzZw.exe
  2⤵
  PID:9340
- C:\Windows\System\SKEOkHN.exe
  C:\Windows\System\SKEOkHN.exe
  2⤵
  PID:9356
- C:\Windows\System\oQCqlto.exe
  C:\Windows\System\oQCqlto.exe
  2⤵
  PID:9372
- C:\Windows\System\YRtDTfE.exe
  C:\Windows\System\YRtDTfE.exe
  2⤵
  PID:9388
- C:\Windows\System\pAgkFaS.exe
  C:\Windows\System\pAgkFaS.exe
  2⤵
  PID:9404
- C:\Windows\System\UdUoDqf.exe
  C:\Windows\System\UdUoDqf.exe
  2⤵
  PID:9420
- C:\Windows\System\GXOzPMG.exe
  C:\Windows\System\GXOzPMG.exe
  2⤵
  PID:9440
- C:\Windows\System\IQhLzPU.exe
  C:\Windows\System\IQhLzPU.exe
  2⤵
  PID:9456
- C:\Windows\System\rmGrsac.exe
  C:\Windows\System\rmGrsac.exe
  2⤵
  PID:9472
- C:\Windows\System\fPgVJar.exe
  C:\Windows\System\fPgVJar.exe
  2⤵
  PID:9488
- C:\Windows\System\moZFTFq.exe
  C:\Windows\System\moZFTFq.exe
  2⤵
  PID:9504
- C:\Windows\System\nBsdjXI.exe
  C:\Windows\System\nBsdjXI.exe
  2⤵
  PID:9520
- C:\Windows\System\YjVsBFG.exe
  C:\Windows\System\YjVsBFG.exe
  2⤵
  PID:9540
- C:\Windows\System\tGYaCtH.exe
  C:\Windows\System\tGYaCtH.exe
  2⤵
  PID:9556
- C:\Windows\System\rkIkqjn.exe
  C:\Windows\System\rkIkqjn.exe
  2⤵
  PID:9572
- C:\Windows\System\jqiezxh.exe
  C:\Windows\System\jqiezxh.exe
  2⤵
  PID:9588
- C:\Windows\System\RGRBLEa.exe
  C:\Windows\System\RGRBLEa.exe
  2⤵
  PID:9604
- C:\Windows\System\tuGaZLc.exe
  C:\Windows\System\tuGaZLc.exe
  2⤵
  PID:9620
- C:\Windows\System\zYoYJEc.exe
  C:\Windows\System\zYoYJEc.exe
  2⤵
  PID:9660
- C:\Windows\System\CBpZHdn.exe
  C:\Windows\System\CBpZHdn.exe
  2⤵
  PID:9676
- C:\Windows\System\lXiBDJT.exe
  C:\Windows\System\lXiBDJT.exe
  2⤵
  PID:9692
- C:\Windows\System\OIWkdpY.exe
  C:\Windows\System\OIWkdpY.exe
  2⤵
  PID:9708
- C:\Windows\System\RDWUsbP.exe
  C:\Windows\System\RDWUsbP.exe
  2⤵
  PID:9724
- C:\Windows\System\NXIOXou.exe
  C:\Windows\System\NXIOXou.exe
  2⤵
  PID:9740
- C:\Windows\System\lMUmjOh.exe
  C:\Windows\System\lMUmjOh.exe
  2⤵
  PID:9756
- C:\Windows\System\oJGgHFO.exe
  C:\Windows\System\oJGgHFO.exe
  2⤵
  PID:9772
- C:\Windows\System\VWxuquL.exe
  C:\Windows\System\VWxuquL.exe
  2⤵
  PID:9788
- C:\Windows\System\wKNwoCD.exe
  C:\Windows\System\wKNwoCD.exe
  2⤵
  PID:9804
- C:\Windows\System\hCRBITf.exe
  C:\Windows\System\hCRBITf.exe
  2⤵
  PID:9820
- C:\Windows\System\dUwOxwD.exe
  C:\Windows\System\dUwOxwD.exe
  2⤵
  PID:9836
- C:\Windows\System\PbRWFcB.exe
  C:\Windows\System\PbRWFcB.exe
  2⤵
  PID:9852
- C:\Windows\System\sHcXxks.exe
  C:\Windows\System\sHcXxks.exe
  2⤵
  PID:9868
- C:\Windows\System\zsJikkP.exe
  C:\Windows\System\zsJikkP.exe
  2⤵
  PID:9884
- C:\Windows\System\cYvGJjn.exe
  C:\Windows\System\cYvGJjn.exe
  2⤵
  PID:9900
- C:\Windows\System\XYgeDxt.exe
  C:\Windows\System\XYgeDxt.exe
  2⤵
  PID:9916
- C:\Windows\System\aFFIaCa.exe
  C:\Windows\System\aFFIaCa.exe
  2⤵
  PID:9932
- C:\Windows\System\IhRgKDx.exe
  C:\Windows\System\IhRgKDx.exe
  2⤵
  PID:9948
- C:\Windows\System\iObQSnT.exe
  C:\Windows\System\iObQSnT.exe
  2⤵
  PID:9964
- C:\Windows\System\ZPbltxs.exe
  C:\Windows\System\ZPbltxs.exe
  2⤵
  PID:9980
- C:\Windows\System\sfJnhTs.exe
  C:\Windows\System\sfJnhTs.exe
  2⤵
  PID:9996
- C:\Windows\System\TMZmQKo.exe
  C:\Windows\System\TMZmQKo.exe
  2⤵
  PID:10052
- C:\Windows\System\JzWGfCX.exe
  C:\Windows\System\JzWGfCX.exe
  2⤵
  PID:10068
- C:\Windows\System\DHylGKb.exe
  C:\Windows\System\DHylGKb.exe
  2⤵
  PID:10084
- C:\Windows\System\zfRyPQF.exe
  C:\Windows\System\zfRyPQF.exe
  2⤵
  PID:10100
- C:\Windows\System\iTvkLPR.exe
  C:\Windows\System\iTvkLPR.exe
  2⤵
  PID:10116
- C:\Windows\System\xoYNlCM.exe
  C:\Windows\System\xoYNlCM.exe
  2⤵
  PID:10132
- C:\Windows\System\xQeiVZA.exe
  C:\Windows\System\xQeiVZA.exe
  2⤵
  PID:10148
- C:\Windows\System\vNkqtPf.exe
  C:\Windows\System\vNkqtPf.exe
  2⤵
  PID:10164
- C:\Windows\System\AxZSxrq.exe
  C:\Windows\System\AxZSxrq.exe
  2⤵
  PID:10180
- C:\Windows\System\JEvcrox.exe
  C:\Windows\System\JEvcrox.exe
  2⤵
  PID:10196
- C:\Windows\System\XZpaufc.exe
  C:\Windows\System\XZpaufc.exe
  2⤵
  PID:10212
- C:\Windows\System\nwpfEoR.exe
  C:\Windows\System\nwpfEoR.exe
  2⤵
  PID:10228
- C:\Windows\System\rmieFWy.exe
  C:\Windows\System\rmieFWy.exe
  2⤵
  PID:8640
- C:\Windows\System\ubBtLcY.exe
  C:\Windows\System\ubBtLcY.exe
  2⤵
  PID:9292
- C:\Windows\System\qPaYvOs.exe
  C:\Windows\System\qPaYvOs.exe
  2⤵
  PID:8896
- C:\Windows\System\wmNaPFj.exe
  C:\Windows\System\wmNaPFj.exe
  2⤵
  PID:9332
- C:\Windows\System\GdyYOug.exe
  C:\Windows\System\GdyYOug.exe
  2⤵
  PID:9320
- C:\Windows\System\epdPXZr.exe
  C:\Windows\System\epdPXZr.exe
  2⤵
  PID:9436
- C:\Windows\System\YQDKkYV.exe
  C:\Windows\System\YQDKkYV.exe
  2⤵
  PID:9468
- C:\Windows\System\rJSkbGM.exe
  C:\Windows\System\rJSkbGM.exe
  2⤵
  PID:9452
- C:\Windows\System\CLrrcqh.exe
  C:\Windows\System\CLrrcqh.exe
  2⤵
  PID:9528
- C:\Windows\System\paQUHdY.exe
  C:\Windows\System\paQUHdY.exe
  2⤵
  PID:9484
- C:\Windows\System\CwBujfA.exe
  C:\Windows\System\CwBujfA.exe
  2⤵
  PID:9568
- C:\Windows\System\mySrWvj.exe
  C:\Windows\System\mySrWvj.exe
  2⤵
  PID:9596
- C:\Windows\System\UCOOOvU.exe
  C:\Windows\System\UCOOOvU.exe
  2⤵
  PID:9628
- C:\Windows\System\RMfWCxn.exe
  C:\Windows\System\RMfWCxn.exe
  2⤵
  PID:9812
- C:\Windows\System\RcZPNHC.exe
  C:\Windows\System\RcZPNHC.exe
  2⤵
  PID:9844
- C:\Windows\System\IcycczF.exe
  C:\Windows\System\IcycczF.exe
  2⤵
  PID:9832
- C:\Windows\System\rGcNNjE.exe
  C:\Windows\System\rGcNNjE.exe
  2⤵
  PID:9864
- C:\Windows\System\CysRush.exe
  C:\Windows\System\CysRush.exe
  2⤵
  PID:9912
- C:\Windows\System\lZXMafe.exe
  C:\Windows\System\lZXMafe.exe
  2⤵
  PID:9944
- C:\Windows\System\vqkTXyk.exe
  C:\Windows\System\vqkTXyk.exe
  2⤵
  PID:9992
- C:\Windows\System\DoGyoZF.exe
  C:\Windows\System\DoGyoZF.exe
  2⤵
  PID:10008
- C:\Windows\System\GapqtmQ.exe
  C:\Windows\System\GapqtmQ.exe
  2⤵
  PID:10024
- C:\Windows\System\weduNLW.exe
  C:\Windows\System\weduNLW.exe
  2⤵
  PID:10040
- C:\Windows\System\SIKaJfb.exe
  C:\Windows\System\SIKaJfb.exe
  2⤵
  PID:10080
- C:\Windows\System\ZznPuum.exe
  C:\Windows\System\ZznPuum.exe
  2⤵
  PID:10144
- C:\Windows\System\AIVOEOz.exe
  C:\Windows\System\AIVOEOz.exe
  2⤵
  PID:10176
- C:\Windows\System\DKxGAbG.exe
  C:\Windows\System\DKxGAbG.exe
  2⤵
  PID:10204
- C:\Windows\System\IYmEfFr.exe
  C:\Windows\System\IYmEfFr.exe
  2⤵
  PID:10156
- C:\Windows\System\pFFcGRo.exe
  C:\Windows\System\pFFcGRo.exe
  2⤵
  PID:10188
- C:\Windows\System\IrJZfGP.exe
  C:\Windows\System\IrJZfGP.exe
  2⤵
  PID:9224
- C:\Windows\System\oNbqNyT.exe
  C:\Windows\System\oNbqNyT.exe
  2⤵
  PID:9300
- C:\Windows\System\OPTGlze.exe
  C:\Windows\System\OPTGlze.exe
  2⤵
  PID:9276
- C:\Windows\System\PYLefBv.exe
  C:\Windows\System\PYLefBv.exe
  2⤵
  PID:9380
- C:\Windows\System\UiPagyg.exe
  C:\Windows\System\UiPagyg.exe
  2⤵
  PID:9368
- C:\Windows\System\urbEiWb.exe
  C:\Windows\System\urbEiWb.exe
  2⤵
  PID:9416
- C:\Windows\System\cSLcPjn.exe
  C:\Windows\System\cSLcPjn.exe
  2⤵
  PID:9552
- C:\Windows\System\QyUKHAz.exe
  C:\Windows\System\QyUKHAz.exe
  2⤵
  PID:9348
- C:\Windows\System\VuKOBhz.exe
  C:\Windows\System\VuKOBhz.exe
  2⤵
  PID:9668
- C:\Windows\System\ouLmlgZ.exe
  C:\Windows\System\ouLmlgZ.exe
  2⤵
  PID:9748
- C:\Windows\System\IlWhoqN.exe
  C:\Windows\System\IlWhoqN.exe
  2⤵
  PID:9768
- C:\Windows\System\plwvpRI.exe
  C:\Windows\System\plwvpRI.exe
  2⤵
  PID:9736
- C:\Windows\System\fKauzLY.exe
  C:\Windows\System\fKauzLY.exe
  2⤵
  PID:9780
- C:\Windows\System\DBznTWT.exe
  C:\Windows\System\DBznTWT.exe
  2⤵
  PID:10004
- C:\Windows\System\BbiDecd.exe
  C:\Windows\System\BbiDecd.exe
  2⤵
  PID:10096
- C:\Windows\System\lKgQMrg.exe
  C:\Windows\System\lKgQMrg.exe
  2⤵
  PID:9976
- C:\Windows\System\bxUeQxh.exe
  C:\Windows\System\bxUeQxh.exe
  2⤵
  PID:10192
- C:\Windows\System\eYuQlxT.exe
  C:\Windows\System\eYuQlxT.exe
  2⤵
  PID:10048
- C:\Windows\System\pJPbqJh.exe
  C:\Windows\System\pJPbqJh.exe
  2⤵
  PID:9364
- C:\Windows\System\UIRehKl.exe
  C:\Windows\System\UIRehKl.exe
  2⤵
  PID:10076
- C:\Windows\System\uXCFMGC.exe
  C:\Windows\System\uXCFMGC.exe
  2⤵
  PID:7584
- C:\Windows\System\HczCZso.exe
  C:\Windows\System\HczCZso.exe
  2⤵
  PID:9648
- C:\Windows\System\EdPgsPN.exe
  C:\Windows\System\EdPgsPN.exe
  2⤵
  PID:9220
- C:\Windows\System\XIUQNkk.exe
  C:\Windows\System\XIUQNkk.exe
  2⤵
  PID:9240
- C:\Windows\System\yPsNuQO.exe
  C:\Windows\System\yPsNuQO.exe
  2⤵
  PID:9612
- C:\Windows\System\IDINVYu.exe
  C:\Windows\System\IDINVYu.exe
  2⤵
  PID:9636
- C:\Windows\System\WQeiTJb.exe
  C:\Windows\System\WQeiTJb.exe
  2⤵
  PID:9644
- C:\Windows\System\kXAimok.exe
  C:\Windows\System\kXAimok.exe
  2⤵
  PID:9720
- C:\Windows\System\jknMolg.exe
  C:\Windows\System\jknMolg.exe
  2⤵
  PID:9940
- C:\Windows\System\bGkdCym.exe
  C:\Windows\System\bGkdCym.exe
  2⤵
  PID:9896
- C:\Windows\System\jBWziqN.exe
  C:\Windows\System\jBWziqN.exe
  2⤵
  PID:9656
- C:\Windows\System\mFuNCOx.exe
  C:\Windows\System\mFuNCOx.exe
  2⤵
  PID:9732
- C:\Windows\System\oEFvVwM.exe
  C:\Windows\System\oEFvVwM.exe
  2⤵
  PID:9412
- C:\Windows\System\aagNMGZ.exe
  C:\Windows\System\aagNMGZ.exe
  2⤵
  PID:10036
- C:\Windows\System\WbAStVq.exe
  C:\Windows\System\WbAStVq.exe
  2⤵
  PID:9828
- C:\Windows\System\TxcpZYM.exe
  C:\Windows\System\TxcpZYM.exe
  2⤵
  PID:9400
- C:\Windows\System\RRlENfl.exe
  C:\Windows\System\RRlENfl.exe
  2⤵
  PID:10112
- C:\Windows\System\vnukGhI.exe
  C:\Windows\System\vnukGhI.exe
  2⤵
  PID:10252
- C:\Windows\System\kVQQdpm.exe
  C:\Windows\System\kVQQdpm.exe
  2⤵
  PID:10268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CuNXoeE.exe

Filesize
1.3MB

MD5
cc875bcae96100affaa06d9691d530b8

SHA1
d20323a5509bd226f0055da4fe158a4ab0bd7be3

SHA256
18431a0a68f980baa75b5cc86dcf017408a072eae971627dd2bbd4cee4f171be

SHA512
48c7341fea98f916372bc6bb20404327fedc08d9b46e99519a07a3418082204e95d4fca4835ac4210d355ecbbc77a630fb81c2beca23b2ff6d54054bb48695f0

Download Submit
C:\Windows\system\HJNIIKz.exe

Filesize
1.3MB

MD5
9e8ad29a6ac1f05cf70f7dccbedf95e5

SHA1
8933f6ccdad57b4c4a6c626118a445678b2c962f

SHA256
211562120f9c4d5080a7105e64e1eab271299f958c3a780e909bcc1c20b79ae5

SHA512
769b04b29a31718b4938068e82ec59911571a3b3755d0b3dc02165d8e84713433cdcc98cee384c15b999c684ef1ae1ccfac48f445e08bfdad251b1f886651fed

Download Submit
C:\Windows\system\LRjTazh.exe

Filesize
1.3MB

MD5
b29dc0fb7124e22e07f58805d9ea0c7d

SHA1
d1f80a4bfb574f57b0cdfcb5e2989de85f49109d

SHA256
321a2d38a948b0e99d5be3b10d349c0c9fd76b4b196be658223142003bdafd46

SHA512
98b9e2c7c1f7243b18b38ae0df5bd8cabbc7a68d6a84753264434a1a090f3dc10fe37c3907e9abdb567f0ade7a84f3cb499eba2345cfa7dc68529af8fa3c33a8

Download Submit
C:\Windows\system\LjeXWby.exe

Filesize
1.2MB

MD5
821696263d14cb61a72413c7b6d9bc5d

SHA1
497667a8e51d10f3687b4636cf2317ee28d0e0c7

SHA256
477a8a9282befdfc630c279a5d6d8c6e96d2d39ee2f290df68bca283eeebf94b

SHA512
465c98b20f0188bf2a9669c1a5703be2121de7e79f939f05fba1d7b7297e39301aa63912c83c473379dfbf3e436e0cceac166b4f8db6b040788e5699e31c8286

Download Submit
C:\Windows\system\PeByjGz.exe

Filesize
1.2MB

MD5
8d243c895cfcd8c2de7ddab3ef15ebe6

SHA1
c679d3a830c38e0dbb6ddd4322d8727c60d3b3f3

SHA256
b0c0cd4f641c363e88626865a0f6e14fe72adcb16c69021630010c92df0773fb

SHA512
f0e3ee12aa0cf8ec80002bf376b8eec95890dcda8e24f287bdc4a661308cd7e5db5170a5bc98cb1a93141cb80f8599f7c869471561f3f1fa6e5ea355246d674e

Download Submit
C:\Windows\system\ThHvXnD.exe

Filesize
8B

MD5
8e1226661f8ca09fc62a1fef1fd7fcb8

SHA1
5b44def3d0e8d434236fee53ad977e411181a3d8

SHA256
7c2ccee11204a3d84ff9c71237bbe484161717fa152009f68b3a2efb0ad9c1c9

SHA512
45cc72f2ca6df3fbb9deac023207f7093a2e236cf6702146e776d1f3b55a9e5f29fbb748ba3deb570ab4a7bdfa68cee4df84414f0ac4a063de36a2a303bd6323

Download Submit
C:\Windows\system\TqINqEZ.exe

Filesize
1.2MB

MD5
7a4e0f4d5155d733deffad71465d8678

SHA1
2a2329522745fe6b7d39ff7645d4052882958fd0

SHA256
3db247224bd780a87a47acbba2804211d99c172566b4b800bac53263ff7ab0a3

SHA512
6b3a66f55b7de1ceff8a682bb824fadad102da089416d14098cf0c1175abf61adea7f475aa77f6b29f8f5d2d31d73e93a7894a06b9431eddb7628ef971b25d3b

Download Submit
C:\Windows\system\UhzKTUp.exe

Filesize
1.2MB

MD5
fec7efb1b79cdcb8c75d4b159c5759c0

SHA1
9efdc95679d25d21375c3e75d96b3a681b383d6e

SHA256
da2182a88db8bd4a374d52f7ddcb8f8aff34219de7fe08602b562b869095531b

SHA512
c8484e2eb80d028a21512328b7d2540738c20210a31238e9a949a56f3d8d88695f900482eed3ec927b608e24f9503bac261d416de27ef55afe57c1aa111c1415

Download Submit
C:\Windows\system\VDuqkbJ.exe

Filesize
1.3MB

MD5
bb6a2ea858f32f8943ec7241a3216e73

SHA1
0ebd1753941b4f3ef8770f414249e7f9fb61cd83

SHA256
4b07f7eb5eac0a4e36501bfbd90f533c9c9c9209787f00520390d0e5a07f8d49

SHA512
69c4be4b17aebe9406feb818477984cc26edc6e339fab8de28d4bcd9c6a68d463d78fb3edeb50c8f471ebf00003fe413bc0d6ec016ebf7bdc77ff86c5b9462f5

Download Submit
C:\Windows\system\XWkvaYQ.exe

Filesize
1.3MB

MD5
99567ad76f0b748fb255f4310cdecb09

SHA1
5d17e600a813d8f88eb079653eef452c0e703940

SHA256
c7cebdbad67504bb068eb095e7c2ce550274b70947e20ed19aecd965a364ef50

SHA512
5f70e5c5cd97915b352a4df56162b66dbe565743e9d492a5644b31c94a780af99caa76a8054672fbd46460d7e5840a78fc309f0cc4612c38336606eac81c843d

Download Submit
C:\Windows\system\YpeeILp.exe

Filesize
1.2MB

MD5
b450e425f8124a951679a3729fdff218

SHA1
bc3ce4092162de054f2c7a668433002e53e813c1

SHA256
128ca48c19d5d6f7b8a21b75042478cd973d8001d41df2fc649ecc2836fdd499

SHA512
5b15b4d9e2172c9ca59893ad95ada0364e63fbe758c24847c783484122ede891fc03d33ccc0fdb43dca846a7fc99d91a10f72f81ddcfe043ad7d69977124ebc3

Download Submit
C:\Windows\system\cqhOQFF.exe

Filesize
1.2MB

MD5
72f37678a1502805406e3461ecaafe8e

SHA1
7cd2a54d2e1045019cd1f28df3eb1e20ed0f27de

SHA256
2093c8bf4688d395a88effe171758e13e6d1dc40fda6c91685cafb1e0e37c0fc

SHA512
64f7294c27908fbe87edb0cd1c4fd0256a995c49f91e551b7dfe58e85567a8ee0e702a7c578789ffeed8d77f00999e2f20bee96c3f2adeea776349ad984d431d

Download Submit
C:\Windows\system\gSXoGcD.exe

Filesize
1.2MB

MD5
e073fb77b2148a5707b21c5e5b139598

SHA1
d62797cfa8328c8f23f77ce2fe2452ccfbf38d28

SHA256
379b96ae6c0b7cdd226ef53bbab141510c5c995d3baff7d3a16376c279773873

SHA512
4e3145ec44ab5bab9adf35ee47ef69ce9cc8e29bdef9f2461ca726b91f2e3e65678dd96468f17a23c910b2abaf691c8fd66ee4b19da6e798866eb057ac80aa10

Download Submit
C:\Windows\system\gYDyOqN.exe

Filesize
1.2MB

MD5
f1a364c8f8762c4564684187f1234177

SHA1
8e813eb722ad56648e254d0bfccb4e1a21fa59b4

SHA256
6997370553640c11ea4cc6841625921c3a55384940d8b1ebd32f0dd612d664df

SHA512
fcd129860b4c6df00a05b04f0e3f56ccfde28b3f36c3d49b669600c8f8556a0752c884e3be58aacbff30770a63e47bbc3868e0ea58d54d13c4e7fe2926aa92e8

Download Submit
C:\Windows\system\goMhibn.exe

Filesize
1.3MB

MD5
2167ff022815575e5dc0b4b7489357ed

SHA1
317cc5ee04fa8a89c42f3e2d3636369c62202709

SHA256
1c2401246628c82f713a740333d98c59a09c7fe1a8787df30783527dd643dce7

SHA512
375035cebcd639aeb0859c60a2cfa3902076da550b1c9bc790f786e479ae23d9d7a1350e2819a60a3cf810a22a354f001cfe04cc9840232ce0b5a066165c8f82

Download Submit
C:\Windows\system\jpOZUmZ.exe

Filesize
1.2MB

MD5
e05b40572d419b3e781047f0eeea15ef

SHA1
8f36893d657f61ce5e284205194eba6a91d84990

SHA256
f615456bc8917685ef74e3669561514becfe7144b0bbc25fbec812045eba1fbe

SHA512
a5db6ad89bb1fce1152df7d4de96757e076e4c2e8019d85986c8ddf00d9fe533b337905164c58984aa28a2ff1d14e0fedd17a7db879a28ee9fdca9967438b93a

Download Submit
C:\Windows\system\lhbaGiY.exe

Filesize
1.2MB

MD5
76391b0ac7b2da8ba219b54772385451

SHA1
787020ccb406c14c26a5e63a18980a88328e94f5

SHA256
3e608e4c4fcf40fe0132b30aa5825667403ba0da6eaf7ecebc48cd2b7f13214f

SHA512
601d564f2b54631801a6abe6c3eed1a7e2d3194f755c535c90ad084eec64e26f14396979d00109582d9c66615dccf6a388b45d391f4712afe4b89e5fbc094292

Download Submit
C:\Windows\system\lpQDcqg.exe

Filesize
1.2MB

MD5
c45eba645f8491e80677a56f9f76a27b

SHA1
3be8ae8854ebe67cfc4bff8ddd5d56655dec5c12

SHA256
ae0246c55236a77c73cd3bfd813dadd2ec82021776e366901ed1e63f8c64f322

SHA512
629c443ebc5e8f2882afc9d9ab600b30f3f011fac2ab6b4567cada214e196ef9c9a1e3508f3cb54151bacabd11efc433576af7833aa61bbe3b3ead2325198349

Download Submit
C:\Windows\system\mdUZmUW.exe

Filesize
1.2MB

MD5
2e7d74fabd92f7072ad999e4d0a06f15

SHA1
67270c86aebdc8e763ac4f2969584a75d5c8e934

SHA256
346a43b18f2a108a4a9b5be8a4a9cbe5c2a6b4404cbe2fc2e7502af9e4be6aa2

SHA512
156e95ddd28a1716ee2598413459f5d8fc958c9a8c0d9ecc2f9faa05830cad01839f1b4b303fe734095c2fbe5ad0678b049fc2de3829543721fb1430802bf320

Download Submit
C:\Windows\system\mwtOCsT.exe

Filesize
1.2MB

MD5
d7235efb5b99eca850d7e9c010b569c9

SHA1
edf170634d404acd965821697daecefde075ec8a

SHA256
ff35846a61954d60d62b4c7231baf37ba22d8065f3fdbddb50e09721cb38a403

SHA512
19ea41516586995f206045bf607e66af2754f1afbecde3215ad4b96e0024d2021716111d2518c11ef565ca042b8543d052ab86a7ae159732baf018c712b4a166

Download Submit
C:\Windows\system\owqZSjL.exe

Filesize
1.2MB

MD5
d4402b1e39e96c2d461ebd78f6f1026a

SHA1
aab7aa1e8ef6e804c030a14e2e7ef03b14a15435

SHA256
e899bb2fe5e5eac5134a2bc6be6eb13ca42b14a094a4739ff51dd2c4e117175a

SHA512
b4b4b5301eeb1804cbdb7ccd47ffb8fa6708ba941143ad4434f03c1f39cc641d9a88013d796591df636819d52a004bb79e1e7c483aaf2a141df941c6c6b0954b

Download Submit
C:\Windows\system\trGRUyM.exe

Filesize
1.3MB

MD5
8a6ee955a148987981556836e1aa4c95

SHA1
83c182218d7d09f898a8a0f83b842ff72877abc4

SHA256
a8d11bced59ccf7981c3634274dc03ecfef57a688353c7ece5125fa998f4e03d

SHA512
b5c14505c296f929a5f8ff5b4adddee697afac1ba6bd0b07c7ce9d5dfd0c86519eb8390401627c4bfd2b5b0c655c425768dfc9c0c28b85531ad5d3e1906874e7

Download Submit
C:\Windows\system\uqJVImv.exe

Filesize
1.3MB

MD5
c1cb8b81e2eda6acd3ce840966c766f5

SHA1
1aafdf7e47117de708c1de4bab773d1bc40b3871

SHA256
638bf289155012a2a213709e4fbc41a5b831b40cb2c7381c03a713307ad645a8

SHA512
9d56324355310d247c6b27ca26fe8593945b20ba39781d666c8616a20e8c2e941154a8fa8ba3be40a3ae4e00bc803de91c1d08b9bcdfce5a61759d3e881a871a

Download Submit
C:\Windows\system\zRPXiIu.exe

Filesize
1.2MB

MD5
3f10ee461668fe28ddaadae31884d8bb

SHA1
05c8e9400ac5837548a61dff7ff41562ea95a201

SHA256
d19782ea8ee6bed750ae57e34453b66d56c28d1f7d5c62b1917fa9a2b37b15cf

SHA512
096c1d35e7db0f42b0e4d4ea63b0ab847f1156563b313947378870eea374d27574924b56e42b05e90c39a29c49355b76050512c21c95461b348fa5a886b74ef5

Download Submit
\Windows\system\DWBSzAG.exe

Filesize
1.3MB

MD5
2b0eee4f31134037d1daaed04b88c16b

SHA1
42dc83984db1b922b84d4e10ca4ec2b76badef75

SHA256
b2930f7e5d49b028d0741ff0742aaf0dc4a5476d296d2ba1fdb2b88bbf41bcca

SHA512
9465973862975c0dfe7b265b5b32153c2ae34fbffe3c9cd7a064a8fd5c21f4ab37a5c387285b7716257f35aa214ed342f6a1541d6ca2d0d7cb62f6341fff347d

Download Submit
\Windows\system\JLvEOcv.exe

Filesize
1.3MB

MD5
6c7069c36dba96d3c650a8e4b740de13

SHA1
d8094a1fb6cde019e0525ec897c001be97294f7a

SHA256
17033d7ba9c11154600856f5cb7604f605a081d47c51f3e059e16dafd201432b

SHA512
397c1cd4effeb40e77e84b54c899079270aa41eaadc034015415aa8f3e522f4c9b12393e49ec96748600dc69783091edfdbbb44bfa0ca6629a3c598c1bcf5760

Download Submit
\Windows\system\NjFurut.exe

Filesize
1.2MB

MD5
bd5350f36135655a70740108b19c1a3d

SHA1
b280de9955e315ed34a26dd5787fca26d53aca86

SHA256
78660ed9b7b86ad8eeda7adabf1c26f27d6c97bb745333077287ed411c50e80d

SHA512
fe0851c51149c15cd9feb3df28678fd9e7264b4046a9d0dbd727c513b52a74166f7cb4bc1e0047d33ef4dc66083285b05afbb94b0b978313af64bfb3538ef73c

Download Submit
\Windows\system\PnTDsIh.exe

Filesize
1.3MB

MD5
c7c25a392ad615b567d6a69d59590ede

SHA1
335e0aca3c8978252711a7990c1bf6bf80fb3f7c

SHA256
2e2e8d603b73bd5f8a5c75c9e6ba07047f6a5d045ff55ded441fa1a6bacde0db

SHA512
9773e503afe7669ce6ca83808a6cbd05e1da9972abc39ccc5f86af2e40d3decf63a9a2671225e2f8739176d8deda616791b101a67b8bb35ce37d6bb8d6967b9d

Download Submit
\Windows\system\TQjcNib.exe

Filesize
1.3MB

MD5
7de563766a3401957a53879232f359b8

SHA1
8019674aac138a590119cb7a459df1a5af1a0ac6

SHA256
34b3cd045c342ceba2adad8f92fdeab916d7da10125a9c11f3d8f656a3fd7707

SHA512
e3c3e113b699e9bbb352a4155e24d21143974e684d484803402d064a5aa5e887e854d92c5a40d3179103c920cde58ed105d27b61a3f89f2ad95c2d8eb239b82a

Download Submit
\Windows\system\WxyDShK.exe

Filesize
1.3MB

MD5
ae3d253c740cb02377b7a537bea7011e

SHA1
39c585eb2b3780475593d97fea247b4e63a30b60

SHA256
d923b21ee568ca23428b2838b55bad5922007afb7314486daad8afbe37fd8854

SHA512
ca0a62b99f9d1e042cb2bca9807be9d1787da8985ce33c2050e6038aa7a28c06ea2f90ff2371e8e1a707155d3dcb6e33f5c4a6f3ae7ad97d0dae7ada224c1236

Download Submit
\Windows\system\ZmtKYpB.exe

Filesize
1.2MB

MD5
404f69176ea7005c052ddf25a597b05b

SHA1
d391b2bbeace8aba10143c963ab94106afa516a8

SHA256
47639c78820e42e19babc964cea3ab2318945fb044a62933b6fc4134c8fe8ed9

SHA512
91f1a880931c1d6683b100b8f1ef42ede178e4aefbfdf359fb1068ee589b7bddaa6d3482e2c24498f3d54d1d45bc16c6f437a62a5f1398e3529ac95802e9dc45

Download Submit
\Windows\system\cRnYSQf.exe

Filesize
1.3MB

MD5
cccb8614d4c4d56800cda9d600f08826

SHA1
d4df9058166574f7bde71e8f4585c90f0bd7200b

SHA256
b6195bea83ab3c1a103bad6e1a3e45ee73162c18616b401a90e0d7c68eec78a3

SHA512
8d8f3dddeb403c123ae0c8277a16b5e94b058d7be98a02715a7f4ad1ee868e7ad21744e359b08ae46cdd4e43f5879a0eaa6c5da8f34d2ee8bf407b54966fe992

Download Submit
\Windows\system\fMZBxlP.exe

Filesize
1.3MB

MD5
a1093390dbfe8e5ba9d8311ac75a5552

SHA1
219e3bdff48c343c636b0d9e9fa17ebe534a63bb

SHA256
35acf2271b15f5541d09b367661c143e5c1efa398caaf6409eb41caba27718af

SHA512
a6100bebf2ffd79c960d6d5227f156c8aee517579c48b6a49673445cb4cf35aaf75d1a14376890c96a26fb63c23fafdbc366870f01becd7164d928b5590a3ad6

Download Submit
\Windows\system\otBQRXB.exe

Filesize
1.3MB

MD5
8a5f3094d9aacca3fcf2a769c35e1b82

SHA1
fb95cd05331a077a29296a58151345325dc22690

SHA256
704414ced16f56682dd7b58e5f182f0ffd37c21d16dbf834e4ec9ce0a1051a0e

SHA512
9cee7bb6dbc05206d9dee9b0ff55323664bba51abd86c3795776606fe79022fb51b47ac5fa9b2dbba314e5599438aa724e58ec3ffd130ff96f595d6939281973

Download Submit
\Windows\system\vuIZamA.exe

Filesize
1.3MB

MD5
060eee1b5b8fb184854427d9dce89198

SHA1
dbc7864110f0fcd654bbbe70a9d385232f207a3a

SHA256
a3f7df011a366a1e84cfe57abfb198e88c67fd3f884120495696ca8c099cb96a

SHA512
67a1da0cc739aabb70b80780802c1950fe52ed07e8077ce84983f7cea2ff3cee270247b353c3d4af7f91808a160628474aa731beabb43986bc7cc7eb62847a6c

Download Submit
\Windows\system\vvMmNdY.exe

Filesize
1.3MB

MD5
0e24b507275390db3060045ed664d505

SHA1
11b66ed0ef035ac13700788f03cc304f49a9d63b

SHA256
c89846b0d31fc6e9378e4f3fd6d5fe9b21fbd0ed2822caff74c49433765618fc

SHA512
c195ecf86c14d4225b5bb916a2806770849870f2febf39f0a0c86d7cd1bd42dc6402ba8f465aef2743ecdc4988f3a37ff47829978ea6a687e9baef00d8073eb4

Download Submit
\Windows\system\yxbWKZj.exe

Filesize
1.3MB

MD5
ee0d66075d137e0abdee5f7d01cd6031

SHA1
8a706562644d10348e74ac126697985ee2f5fea1

SHA256
c94968d7641cd1fbc8d012cc5a9cd9635c621c2ad1cb22834f1cf1dee00a7812

SHA512
6ebd71bba98f2a9b258569e8ab56a6d1bb718433430c44fefa6da77ec22f3977f6b35070eb5fb2f49bc72cdf64e6871a0676d110f9100d29909cd2027fcb1d0a

Download Submit
\Windows\system\zJVCnnx.exe

Filesize
1.3MB

MD5
fdfcb71b0b6a8f7a45c1f135b5087149

SHA1
05fc7f1059269936e33d6754a81e5aa0b55d85b9

SHA256
1e78047ddd3da76c271354805e428144b46f4be5e022c246697fc38d1008a3f0

SHA512
c0e829d89f16c47f340ac00f7965a157690db3dfc6c65a580cdf2884e4bfb445694d023e3986ec7dc1e8dfb0103ce5241365829260ff2ad02e8a082f38c87a1c

Download Submit
memory/480-4588-0x000000013F8B0000-0x000000013FCA2000-memory.dmp

Filesize
3.9MB

Download
memory/480-131-0x000000013F8B0000-0x000000013FCA2000-memory.dmp

Filesize
3.9MB

Download
memory/1744-4569-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/1744-67-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/2012-4611-0x000000013F160000-0x000000013F552000-memory.dmp

Filesize
3.9MB

Download
memory/2012-163-0x000000013F160000-0x000000013F552000-memory.dmp

Filesize
3.9MB

Download
memory/2088-166-0x0000000002EF0000-0x00000000032E2000-memory.dmp

Filesize
3.9MB

Download
memory/2088-160-0x000000013FCF0000-0x00000001400E2000-memory.dmp

Filesize
3.9MB

Download
memory/2088-168-0x000000013F9B0000-0x000000013FDA2000-memory.dmp

Filesize
3.9MB

Download
memory/2088-170-0x000000013FE30000-0x0000000140222000-memory.dmp

Filesize
3.9MB

Download
memory/2088-156-0x000000013F980000-0x000000013FD72000-memory.dmp

Filesize
3.9MB

Download
memory/2088-130-0x0000000002EF0000-0x00000000032E2000-memory.dmp

Filesize
3.9MB

Download
memory/2088-164-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/2088-173-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/2088-162-0x0000000002EF0000-0x00000000032E2000-memory.dmp

Filesize
3.9MB

Download
memory/2088-8-0x0000000002EF0000-0x00000000032E2000-memory.dmp

Filesize
3.9MB

Download
memory/2088-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2088-0-0x000000013F410000-0x000000013F802000-memory.dmp

Filesize
3.9MB

Download
memory/2088-158-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/2088-68-0x000000013F8B0000-0x000000013FCA2000-memory.dmp

Filesize
3.9MB

Download
memory/2104-4564-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/2104-13-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/2532-81-0x0000000002790000-0x0000000002798000-memory.dmp

Filesize
32KB

Download
memory/2532-379-0x000007FEF5CB0000-0x000007FEF664D000-memory.dmp

Filesize
9.6MB

Download
memory/2532-14-0x00000000027D0000-0x0000000002850000-memory.dmp

Filesize
512KB

Download
memory/2532-66-0x000007FEF5CB0000-0x000007FEF664D000-memory.dmp

Filesize
9.6MB

Download
memory/2532-172-0x000007FEF5CB0000-0x000007FEF664D000-memory.dmp

Filesize
9.6MB

Download
memory/2532-15-0x000007FEF5F6E000-0x000007FEF5F6F000-memory.dmp

Filesize
4KB

Download
memory/2532-65-0x000000001B560000-0x000000001B842000-memory.dmp

Filesize
2.9MB

Download
memory/2636-167-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2636-4613-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2688-169-0x000000013F9B0000-0x000000013FDA2000-memory.dmp

Filesize
3.9MB

Download
memory/2688-4584-0x000000013F9B0000-0x000000013FDA2000-memory.dmp

Filesize
3.9MB

Download
memory/2744-155-0x000000013F250000-0x000000013F642000-memory.dmp

Filesize
3.9MB

Download
memory/2744-4605-0x000000013F250000-0x000000013F642000-memory.dmp

Filesize
3.9MB

Download
memory/2748-161-0x000000013FCF0000-0x00000001400E2000-memory.dmp

Filesize
3.9MB

Download
memory/2748-4582-0x000000013FCF0000-0x00000001400E2000-memory.dmp

Filesize
3.9MB

Download
memory/2764-165-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/2764-4586-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/2812-157-0x000000013F980000-0x000000013FD72000-memory.dmp

Filesize
3.9MB

Download
memory/2812-4590-0x000000013F980000-0x000000013FD72000-memory.dmp

Filesize
3.9MB

Download
memory/2824-171-0x000000013FE30000-0x0000000140222000-memory.dmp

Filesize
3.9MB

Download
memory/2824-4610-0x000000013FE30000-0x0000000140222000-memory.dmp

Filesize
3.9MB

Download
memory/3024-4608-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/3024-159-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download