xmrig | 79341d891a20e028095d52e9a0af4bf7fbaf2514edbdd90889532a02296ea89a

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
05-08-2024 09:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75a470f52b7902d9ada7b9a395e83170N.exe
Size

2.5MB
MD5

75a470f52b7902d9ada7b9a395e83170
SHA1

5f14d944fb8ec110cb8073ebd3884204c881235f
SHA256

79341d891a20e028095d52e9a0af4bf7fbaf2514edbdd90889532a02296ea89a
SHA512

850124bb3d1442fe01b9cea3dd132f6eaef9d35619c13ec3ea8d9b75acad4e3bb0c61dba0f345e0f5e739e45935e39f0f4c7438a1f795a0bdb8797eef6acc5c3
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleL6dH:NABH

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 17 IoCs

miner

resource	yara_rule
behavioral1/memory/1672-14-0x000000013F390000-0x000000013F782000-memory.dmp	xmrig
behavioral1/memory/2748-405-0x000000013FCB0000-0x00000001400A2000-memory.dmp	xmrig
behavioral1/memory/2840-131-0x000000013FEF0000-0x00000001402E2000-memory.dmp	xmrig
behavioral1/memory/2632-109-0x000000013F160000-0x000000013F552000-memory.dmp	xmrig
behavioral1/memory/2720-39-0x000000013F5A0000-0x000000013F992000-memory.dmp	xmrig
behavioral1/memory/2292-37-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	xmrig
behavioral1/memory/2992-114-0x000000013FCF0000-0x00000001400E2000-memory.dmp	xmrig
behavioral1/memory/2764-87-0x000000013F310000-0x000000013F702000-memory.dmp	xmrig
behavioral1/memory/2876-85-0x000000013F400000-0x000000013F7F2000-memory.dmp	xmrig
behavioral1/memory/2840-3994-0x000000013FEF0000-0x00000001402E2000-memory.dmp	xmrig
behavioral1/memory/2720-4193-0x000000013F5A0000-0x000000013F992000-memory.dmp	xmrig
behavioral1/memory/2876-4212-0x000000013F400000-0x000000013F7F2000-memory.dmp	xmrig
behavioral1/memory/2292-4274-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	xmrig
behavioral1/memory/2632-4211-0x000000013F160000-0x000000013F552000-memory.dmp	xmrig
behavioral1/memory/2992-4210-0x000000013FCF0000-0x00000001400E2000-memory.dmp	xmrig
behavioral1/memory/2764-4205-0x000000013F310000-0x000000013F702000-memory.dmp	xmrig
behavioral1/memory/2748-4183-0x000000013FCB0000-0x00000001400A2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2428	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1672	RhhdrYT.exe
2292	JNLakFe.exe
2720	wYtkudH.exe
2748	SFHqlMr.exe
2876	TEjzTnO.exe
2764	CvomPow.exe
2632	RBVyiau.exe
2992	RfqdPet.exe
2840	ACaaVVt.exe
676	genZEPa.exe
1964	qTfxgmJ.exe
344	xnPCGGc.exe
1956	dFkmsaf.exe
808	zidGiBC.exe
2008	PnVjJmx.exe
2724	yQrZONR.exe
2872	UiHIicL.exe
2704	eOMsBTM.exe
2384	wcWccQa.exe
2372	WxWbVGc.exe
580	UnitkFy.exe
336	QaODWSU.exe
2016	GzdoyOU.exe
352	jQsdSxl.exe
1268	atkjvJA.exe
1764	ICvAwVg.exe
448	aBRuztg.exe
968	QMYdcLD.exe
1592	UgtSbmE.exe
1616	GtXImyZ.exe
1488	KKLeoru.exe
2488	pUNqicE.exe
1660	pimSYmf.exe
1856	YxVegTo.exe
572	ihEgJVl.exe
840	TxQRyIC.exe
2444	iTttiUy.exe
1724	jwHEhRs.exe
2396	aAayDXV.exe
2024	spaWmen.exe
1744	WwxuBVm.exe
2432	qUgfoqI.exe
1048	mwmPfEy.exe
2388	xLIVokR.exe
896	bQoFwRB.exe
2888	lMbdDiZ.exe
1556	gRRZoiK.exe
2908	gGmUvpC.exe
2716	wqUoUmZ.exe
2664	IGgWuEJ.exe
1968	YyoapUG.exe
1480	uaZhsOp.exe
2464	hmqTAaX.exe
1760	LHCEIZU.exe
2100	ARdxvNt.exe
1780	Hwosbdp.exe
2860	DxlfrTy.exe
2624	OikDNOY.exe
836	JtLWcFj.exe
1560	ZuhAemV.exe
2732	yxORWtU.exe
2608	JnfGlaZ.exe
2424	JlASSsg.exe
2836	ePxRVtY.exe

Loads dropped DLL 64 IoCs

pid	Process
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe
2980	75a470f52b7902d9ada7b9a395e83170N.exe

UPX packed file 50 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2980-1-0x000000013F340000-0x000000013F732000-memory.dmp	upx
behavioral1/files/0x0009000000012286-3.dat	upx
behavioral1/files/0x000700000001660d-28.dat	upx
behavioral1/memory/1672-14-0x000000013F390000-0x000000013F782000-memory.dmp	upx
behavioral1/files/0x0008000000016140-23.dat	upx
behavioral1/files/0x0009000000016398-21.dat	upx
behavioral1/files/0x000c00000000549e-19.dat	upx
behavioral1/files/0x0007000000016dd8-47.dat	upx
behavioral1/files/0x000700000001688f-40.dat	upx
behavioral1/files/0x00050000000187c0-121.dat	upx
behavioral1/files/0x0006000000016df7-70.dat	upx
behavioral1/files/0x0005000000018708-149.dat	upx
behavioral1/files/0x0006000000018be5-164.dat	upx
behavioral1/files/0x0006000000018c31-185.dat	upx
behavioral1/memory/2748-405-0x000000013FCB0000-0x00000001400A2000-memory.dmp	upx
behavioral1/files/0x0006000000018c05-175.dat	upx
behavioral1/files/0x0006000000018c11-178.dat	upx
behavioral1/files/0x0006000000018bf9-168.dat	upx
behavioral1/files/0x0006000000018b7f-155.dat	upx
behavioral1/files/0x00050000000187ac-153.dat	upx
behavioral1/files/0x000500000001871a-151.dat	upx
behavioral1/files/0x00060000000174f7-147.dat	upx
behavioral1/files/0x00060000000170da-145.dat	upx
behavioral1/files/0x0006000000016dff-142.dat	upx
behavioral1/files/0x0006000000016df2-139.dat	upx
behavioral1/files/0x0006000000016de2-137.dat	upx
behavioral1/files/0x0009000000016c88-135.dat	upx
behavioral1/files/0x0007000000016688-133.dat	upx
behavioral1/files/0x0006000000018bb0-159.dat	upx
behavioral1/memory/2840-131-0x000000013FEF0000-0x00000001402E2000-memory.dmp	upx
behavioral1/files/0x00050000000187a7-128.dat	upx
behavioral1/memory/2632-109-0x000000013F160000-0x000000013F552000-memory.dmp	upx
behavioral1/files/0x0006000000017226-90.dat	upx
behavioral1/files/0x000600000001707e-89.dat	upx
behavioral1/files/0x0006000000016dec-69.dat	upx
behavioral1/memory/2720-39-0x000000013F5A0000-0x000000013F992000-memory.dmp	upx
behavioral1/memory/2292-37-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	upx
behavioral1/memory/2992-114-0x000000013FCF0000-0x00000001400E2000-memory.dmp	upx
behavioral1/files/0x000500000001870a-112.dat	upx
behavioral1/files/0x000600000001756f-111.dat	upx
behavioral1/memory/2764-87-0x000000013F310000-0x000000013F702000-memory.dmp	upx
behavioral1/memory/2876-85-0x000000013F400000-0x000000013F7F2000-memory.dmp	upx
behavioral1/memory/2840-3994-0x000000013FEF0000-0x00000001402E2000-memory.dmp	upx
behavioral1/memory/2720-4193-0x000000013F5A0000-0x000000013F992000-memory.dmp	upx
behavioral1/memory/2876-4212-0x000000013F400000-0x000000013F7F2000-memory.dmp	upx
behavioral1/memory/2292-4274-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	upx
behavioral1/memory/2632-4211-0x000000013F160000-0x000000013F552000-memory.dmp	upx
behavioral1/memory/2992-4210-0x000000013FCF0000-0x00000001400E2000-memory.dmp	upx
behavioral1/memory/2764-4205-0x000000013F310000-0x000000013F702000-memory.dmp	upx
behavioral1/memory/2748-4183-0x000000013FCB0000-0x00000001400A2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\AsifsRI.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\bHDCfno.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\xwgVoEF.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\CjwlzLs.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\jxQhiLh.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\uAliFgg.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\kAJmjpi.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\EjNNJck.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\vgLrvhN.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\sziOTXD.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\kuMwfyf.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\VwZQeEi.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\HrZJcoU.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\XIqboSW.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\pPRvQSP.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\pyYVPVY.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\AEaEqAY.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\quNyEyT.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\ReJGlwf.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\rFGXFdd.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\jGpNxbs.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\yhdRWSA.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\MDwlCns.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\OmujMSM.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\xcIAcvH.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\xLIVokR.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\SwsTDCn.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\fAyTfzL.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\XdFdnfC.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\ijWkSIv.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\RJraXvm.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\QiywhxH.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\wGjcgiA.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\kddGTlB.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\hYQPYEP.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\LcVEHnK.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\UwXPSRl.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\IWbxzKk.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\kBNeoRZ.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\CxtIuni.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\sTgVfuv.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\PKIlHzg.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\oyuRNAS.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\iMgBCtx.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\zZGEbtr.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\IXoneRf.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\gcCfElj.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\qRXPLBk.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\kbYRJji.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\WRllvTm.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\fPZywev.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\msdmDNl.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\JmrtOPa.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\hyIouve.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\VIklNmo.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\VtazYAX.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\GDksxai.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\GSGcSml.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\EyPIiqd.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\meixEYa.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\oAgzsek.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\hLwlEBE.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\PtfHwWl.exe	75a470f52b7902d9ada7b9a395e83170N.exe
File created	C:\Windows\System\IqcpGiU.exe	75a470f52b7902d9ada7b9a395e83170N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2428	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2980	75a470f52b7902d9ada7b9a395e83170N.exe
Token: SeLockMemoryPrivilege	2980	75a470f52b7902d9ada7b9a395e83170N.exe
Token: SeDebugPrivilege	2428	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2428	2980	75a470f52b7902d9ada7b9a395e83170N.exe	31
PID 2980 wrote to memory of 2428	2980	75a470f52b7902d9ada7b9a395e83170N.exe	31
PID 2980 wrote to memory of 2428	2980	75a470f52b7902d9ada7b9a395e83170N.exe	31
PID 2980 wrote to memory of 1672	2980	75a470f52b7902d9ada7b9a395e83170N.exe	32
PID 2980 wrote to memory of 1672	2980	75a470f52b7902d9ada7b9a395e83170N.exe	32
PID 2980 wrote to memory of 1672	2980	75a470f52b7902d9ada7b9a395e83170N.exe	32
PID 2980 wrote to memory of 2292	2980	75a470f52b7902d9ada7b9a395e83170N.exe	33
PID 2980 wrote to memory of 2292	2980	75a470f52b7902d9ada7b9a395e83170N.exe	33
PID 2980 wrote to memory of 2292	2980	75a470f52b7902d9ada7b9a395e83170N.exe	33
PID 2980 wrote to memory of 2720	2980	75a470f52b7902d9ada7b9a395e83170N.exe	34
PID 2980 wrote to memory of 2720	2980	75a470f52b7902d9ada7b9a395e83170N.exe	34
PID 2980 wrote to memory of 2720	2980	75a470f52b7902d9ada7b9a395e83170N.exe	34
PID 2980 wrote to memory of 2840	2980	75a470f52b7902d9ada7b9a395e83170N.exe	35
PID 2980 wrote to memory of 2840	2980	75a470f52b7902d9ada7b9a395e83170N.exe	35
PID 2980 wrote to memory of 2840	2980	75a470f52b7902d9ada7b9a395e83170N.exe	35
PID 2980 wrote to memory of 2748	2980	75a470f52b7902d9ada7b9a395e83170N.exe	36
PID 2980 wrote to memory of 2748	2980	75a470f52b7902d9ada7b9a395e83170N.exe	36
PID 2980 wrote to memory of 2748	2980	75a470f52b7902d9ada7b9a395e83170N.exe	36
PID 2980 wrote to memory of 2724	2980	75a470f52b7902d9ada7b9a395e83170N.exe	37
PID 2980 wrote to memory of 2724	2980	75a470f52b7902d9ada7b9a395e83170N.exe	37
PID 2980 wrote to memory of 2724	2980	75a470f52b7902d9ada7b9a395e83170N.exe	37
PID 2980 wrote to memory of 2876	2980	75a470f52b7902d9ada7b9a395e83170N.exe	38
PID 2980 wrote to memory of 2876	2980	75a470f52b7902d9ada7b9a395e83170N.exe	38
PID 2980 wrote to memory of 2876	2980	75a470f52b7902d9ada7b9a395e83170N.exe	38
PID 2980 wrote to memory of 2872	2980	75a470f52b7902d9ada7b9a395e83170N.exe	39
PID 2980 wrote to memory of 2872	2980	75a470f52b7902d9ada7b9a395e83170N.exe	39
PID 2980 wrote to memory of 2872	2980	75a470f52b7902d9ada7b9a395e83170N.exe	39
PID 2980 wrote to memory of 2764	2980	75a470f52b7902d9ada7b9a395e83170N.exe	40
PID 2980 wrote to memory of 2764	2980	75a470f52b7902d9ada7b9a395e83170N.exe	40
PID 2980 wrote to memory of 2764	2980	75a470f52b7902d9ada7b9a395e83170N.exe	40
PID 2980 wrote to memory of 2704	2980	75a470f52b7902d9ada7b9a395e83170N.exe	41
PID 2980 wrote to memory of 2704	2980	75a470f52b7902d9ada7b9a395e83170N.exe	41
PID 2980 wrote to memory of 2704	2980	75a470f52b7902d9ada7b9a395e83170N.exe	41
PID 2980 wrote to memory of 2632	2980	75a470f52b7902d9ada7b9a395e83170N.exe	42
PID 2980 wrote to memory of 2632	2980	75a470f52b7902d9ada7b9a395e83170N.exe	42
PID 2980 wrote to memory of 2632	2980	75a470f52b7902d9ada7b9a395e83170N.exe	42
PID 2980 wrote to memory of 2384	2980	75a470f52b7902d9ada7b9a395e83170N.exe	43
PID 2980 wrote to memory of 2384	2980	75a470f52b7902d9ada7b9a395e83170N.exe	43
PID 2980 wrote to memory of 2384	2980	75a470f52b7902d9ada7b9a395e83170N.exe	43
PID 2980 wrote to memory of 2992	2980	75a470f52b7902d9ada7b9a395e83170N.exe	44
PID 2980 wrote to memory of 2992	2980	75a470f52b7902d9ada7b9a395e83170N.exe	44
PID 2980 wrote to memory of 2992	2980	75a470f52b7902d9ada7b9a395e83170N.exe	44
PID 2980 wrote to memory of 2372	2980	75a470f52b7902d9ada7b9a395e83170N.exe	45
PID 2980 wrote to memory of 2372	2980	75a470f52b7902d9ada7b9a395e83170N.exe	45
PID 2980 wrote to memory of 2372	2980	75a470f52b7902d9ada7b9a395e83170N.exe	45
PID 2980 wrote to memory of 676	2980	75a470f52b7902d9ada7b9a395e83170N.exe	46
PID 2980 wrote to memory of 676	2980	75a470f52b7902d9ada7b9a395e83170N.exe	46
PID 2980 wrote to memory of 676	2980	75a470f52b7902d9ada7b9a395e83170N.exe	46
PID 2980 wrote to memory of 580	2980	75a470f52b7902d9ada7b9a395e83170N.exe	47
PID 2980 wrote to memory of 580	2980	75a470f52b7902d9ada7b9a395e83170N.exe	47
PID 2980 wrote to memory of 580	2980	75a470f52b7902d9ada7b9a395e83170N.exe	47
PID 2980 wrote to memory of 1964	2980	75a470f52b7902d9ada7b9a395e83170N.exe	48
PID 2980 wrote to memory of 1964	2980	75a470f52b7902d9ada7b9a395e83170N.exe	48
PID 2980 wrote to memory of 1964	2980	75a470f52b7902d9ada7b9a395e83170N.exe	48
PID 2980 wrote to memory of 336	2980	75a470f52b7902d9ada7b9a395e83170N.exe	49
PID 2980 wrote to memory of 336	2980	75a470f52b7902d9ada7b9a395e83170N.exe	49
PID 2980 wrote to memory of 336	2980	75a470f52b7902d9ada7b9a395e83170N.exe	49
PID 2980 wrote to memory of 344	2980	75a470f52b7902d9ada7b9a395e83170N.exe	50
PID 2980 wrote to memory of 344	2980	75a470f52b7902d9ada7b9a395e83170N.exe	50
PID 2980 wrote to memory of 344	2980	75a470f52b7902d9ada7b9a395e83170N.exe	50
PID 2980 wrote to memory of 2016	2980	75a470f52b7902d9ada7b9a395e83170N.exe	51
PID 2980 wrote to memory of 2016	2980	75a470f52b7902d9ada7b9a395e83170N.exe	51
PID 2980 wrote to memory of 2016	2980	75a470f52b7902d9ada7b9a395e83170N.exe	51
PID 2980 wrote to memory of 1956	2980	75a470f52b7902d9ada7b9a395e83170N.exe	52

C:\Users\Admin\AppData\Local\Temp\75a470f52b7902d9ada7b9a395e83170N.exe
"C:\Users\Admin\AppData\Local\Temp\75a470f52b7902d9ada7b9a395e83170N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2428
- C:\Windows\System\RhhdrYT.exe
  C:\Windows\System\RhhdrYT.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\JNLakFe.exe
  C:\Windows\System\JNLakFe.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\wYtkudH.exe
  C:\Windows\System\wYtkudH.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\ACaaVVt.exe
  C:\Windows\System\ACaaVVt.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\SFHqlMr.exe
  C:\Windows\System\SFHqlMr.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\yQrZONR.exe
  C:\Windows\System\yQrZONR.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\TEjzTnO.exe
  C:\Windows\System\TEjzTnO.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\UiHIicL.exe
  C:\Windows\System\UiHIicL.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\CvomPow.exe
  C:\Windows\System\CvomPow.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\eOMsBTM.exe
  C:\Windows\System\eOMsBTM.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\RBVyiau.exe
  C:\Windows\System\RBVyiau.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\wcWccQa.exe
  C:\Windows\System\wcWccQa.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\RfqdPet.exe
  C:\Windows\System\RfqdPet.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\WxWbVGc.exe
  C:\Windows\System\WxWbVGc.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\genZEPa.exe
  C:\Windows\System\genZEPa.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System\UnitkFy.exe
  C:\Windows\System\UnitkFy.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\qTfxgmJ.exe
  C:\Windows\System\qTfxgmJ.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\QaODWSU.exe
  C:\Windows\System\QaODWSU.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\xnPCGGc.exe
  C:\Windows\System\xnPCGGc.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\GzdoyOU.exe
  C:\Windows\System\GzdoyOU.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\dFkmsaf.exe
  C:\Windows\System\dFkmsaf.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\jQsdSxl.exe
  C:\Windows\System\jQsdSxl.exe
  2⤵
  - Executes dropped EXE
  PID:352
- C:\Windows\System\zidGiBC.exe
  C:\Windows\System\zidGiBC.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\atkjvJA.exe
  C:\Windows\System\atkjvJA.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\PnVjJmx.exe
  C:\Windows\System\PnVjJmx.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\ICvAwVg.exe
  C:\Windows\System\ICvAwVg.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\aBRuztg.exe
  C:\Windows\System\aBRuztg.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\QMYdcLD.exe
  C:\Windows\System\QMYdcLD.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\UgtSbmE.exe
  C:\Windows\System\UgtSbmE.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\GtXImyZ.exe
  C:\Windows\System\GtXImyZ.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\KKLeoru.exe
  C:\Windows\System\KKLeoru.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\pUNqicE.exe
  C:\Windows\System\pUNqicE.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\pimSYmf.exe
  C:\Windows\System\pimSYmf.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\YxVegTo.exe
  C:\Windows\System\YxVegTo.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\ihEgJVl.exe
  C:\Windows\System\ihEgJVl.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\TxQRyIC.exe
  C:\Windows\System\TxQRyIC.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\iTttiUy.exe
  C:\Windows\System\iTttiUy.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\jwHEhRs.exe
  C:\Windows\System\jwHEhRs.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\aAayDXV.exe
  C:\Windows\System\aAayDXV.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\spaWmen.exe
  C:\Windows\System\spaWmen.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\WwxuBVm.exe
  C:\Windows\System\WwxuBVm.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\qUgfoqI.exe
  C:\Windows\System\qUgfoqI.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\mwmPfEy.exe
  C:\Windows\System\mwmPfEy.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\xLIVokR.exe
  C:\Windows\System\xLIVokR.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\bQoFwRB.exe
  C:\Windows\System\bQoFwRB.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\LHCEIZU.exe
  C:\Windows\System\LHCEIZU.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\lMbdDiZ.exe
  C:\Windows\System\lMbdDiZ.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\ARdxvNt.exe
  C:\Windows\System\ARdxvNt.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\gRRZoiK.exe
  C:\Windows\System\gRRZoiK.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\Hwosbdp.exe
  C:\Windows\System\Hwosbdp.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\gGmUvpC.exe
  C:\Windows\System\gGmUvpC.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\DxlfrTy.exe
  C:\Windows\System\DxlfrTy.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\wqUoUmZ.exe
  C:\Windows\System\wqUoUmZ.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\OikDNOY.exe
  C:\Windows\System\OikDNOY.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\IGgWuEJ.exe
  C:\Windows\System\IGgWuEJ.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\JtLWcFj.exe
  C:\Windows\System\JtLWcFj.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\YyoapUG.exe
  C:\Windows\System\YyoapUG.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\ZuhAemV.exe
  C:\Windows\System\ZuhAemV.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\uaZhsOp.exe
  C:\Windows\System\uaZhsOp.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\yxORWtU.exe
  C:\Windows\System\yxORWtU.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\hmqTAaX.exe
  C:\Windows\System\hmqTAaX.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\JnfGlaZ.exe
  C:\Windows\System\JnfGlaZ.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\JlASSsg.exe
  C:\Windows\System\JlASSsg.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\cQzoGUN.exe
  C:\Windows\System\cQzoGUN.exe
  2⤵
  PID:1264
- C:\Windows\System\ePxRVtY.exe
  C:\Windows\System\ePxRVtY.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\DRrpeAx.exe
  C:\Windows\System\DRrpeAx.exe
  2⤵
  PID:1776
- C:\Windows\System\YOrYXil.exe
  C:\Windows\System\YOrYXil.exe
  2⤵
  PID:2776
- C:\Windows\System\vQobaKH.exe
  C:\Windows\System\vQobaKH.exe
  2⤵
  PID:964
- C:\Windows\System\NEFnjwP.exe
  C:\Windows\System\NEFnjwP.exe
  2⤵
  PID:2240
- C:\Windows\System\qQtmsIH.exe
  C:\Windows\System\qQtmsIH.exe
  2⤵
  PID:108
- C:\Windows\System\oGxOGxz.exe
  C:\Windows\System\oGxOGxz.exe
  2⤵
  PID:2300
- C:\Windows\System\GxsNXlU.exe
  C:\Windows\System\GxsNXlU.exe
  2⤵
  PID:576
- C:\Windows\System\dqAKbSF.exe
  C:\Windows\System\dqAKbSF.exe
  2⤵
  PID:784
- C:\Windows\System\SLlmPDP.exe
  C:\Windows\System\SLlmPDP.exe
  2⤵
  PID:2152
- C:\Windows\System\Pufujqr.exe
  C:\Windows\System\Pufujqr.exe
  2⤵
  PID:1736
- C:\Windows\System\jUsPyDw.exe
  C:\Windows\System\jUsPyDw.exe
  2⤵
  PID:2808
- C:\Windows\System\YgvZnQo.exe
  C:\Windows\System\YgvZnQo.exe
  2⤵
  PID:3064
- C:\Windows\System\LlUkUdy.exe
  C:\Windows\System\LlUkUdy.exe
  2⤵
  PID:1044
- C:\Windows\System\RgnPbca.exe
  C:\Windows\System\RgnPbca.exe
  2⤵
  PID:2392
- C:\Windows\System\erhMinb.exe
  C:\Windows\System\erhMinb.exe
  2⤵
  PID:1864
- C:\Windows\System\eNidnEQ.exe
  C:\Windows\System\eNidnEQ.exe
  2⤵
  PID:2644
- C:\Windows\System\jjUDMnj.exe
  C:\Windows\System\jjUDMnj.exe
  2⤵
  PID:1800
- C:\Windows\System\tMIwBiw.exe
  C:\Windows\System\tMIwBiw.exe
  2⤵
  PID:1580
- C:\Windows\System\VgUnyap.exe
  C:\Windows\System\VgUnyap.exe
  2⤵
  PID:2832
- C:\Windows\System\vxeqtve.exe
  C:\Windows\System\vxeqtve.exe
  2⤵
  PID:1612
- C:\Windows\System\JxkRahN.exe
  C:\Windows\System\JxkRahN.exe
  2⤵
  PID:2756
- C:\Windows\System\YGSGDFZ.exe
  C:\Windows\System\YGSGDFZ.exe
  2⤵
  PID:1052
- C:\Windows\System\tlXIUIU.exe
  C:\Windows\System\tlXIUIU.exe
  2⤵
  PID:1236
- C:\Windows\System\JzNosWl.exe
  C:\Windows\System\JzNosWl.exe
  2⤵
  PID:876
- C:\Windows\System\KBKzWkj.exe
  C:\Windows\System\KBKzWkj.exe
  2⤵
  PID:1092
- C:\Windows\System\SgCTEfa.exe
  C:\Windows\System\SgCTEfa.exe
  2⤵
  PID:2996
- C:\Windows\System\iCyFQsv.exe
  C:\Windows\System\iCyFQsv.exe
  2⤵
  PID:1088
- C:\Windows\System\kKfWDtG.exe
  C:\Windows\System\kKfWDtG.exe
  2⤵
  PID:476
- C:\Windows\System\ODwVEAx.exe
  C:\Windows\System\ODwVEAx.exe
  2⤵
  PID:2472
- C:\Windows\System\FUOYsxL.exe
  C:\Windows\System\FUOYsxL.exe
  2⤵
  PID:2812
- C:\Windows\System\jolorfY.exe
  C:\Windows\System\jolorfY.exe
  2⤵
  PID:1708
- C:\Windows\System\didrGrB.exe
  C:\Windows\System\didrGrB.exe
  2⤵
  PID:2336
- C:\Windows\System\GQCPHaQ.exe
  C:\Windows\System\GQCPHaQ.exe
  2⤵
  PID:1364
- C:\Windows\System\KveOcrp.exe
  C:\Windows\System\KveOcrp.exe
  2⤵
  PID:1320
- C:\Windows\System\gytjSIc.exe
  C:\Windows\System\gytjSIc.exe
  2⤵
  PID:1160
- C:\Windows\System\GEhaPfu.exe
  C:\Windows\System\GEhaPfu.exe
  2⤵
  PID:2484
- C:\Windows\System\jgESbUf.exe
  C:\Windows\System\jgESbUf.exe
  2⤵
  PID:904
- C:\Windows\System\QLsEoPt.exe
  C:\Windows\System\QLsEoPt.exe
  2⤵
  PID:2064
- C:\Windows\System\eEZRxcZ.exe
  C:\Windows\System\eEZRxcZ.exe
  2⤵
  PID:1740
- C:\Windows\System\CgjunRq.exe
  C:\Windows\System\CgjunRq.exe
  2⤵
  PID:2316
- C:\Windows\System\MLMVRea.exe
  C:\Windows\System\MLMVRea.exe
  2⤵
  PID:2556
- C:\Windows\System\eOPvTPa.exe
  C:\Windows\System\eOPvTPa.exe
  2⤵
  PID:2800
- C:\Windows\System\tAIbYxx.exe
  C:\Windows\System\tAIbYxx.exe
  2⤵
  PID:2772
- C:\Windows\System\qZRApUl.exe
  C:\Windows\System\qZRApUl.exe
  2⤵
  PID:2700
- C:\Windows\System\NUdbSmB.exe
  C:\Windows\System\NUdbSmB.exe
  2⤵
  PID:2480
- C:\Windows\System\cpTBOsZ.exe
  C:\Windows\System\cpTBOsZ.exe
  2⤵
  PID:1700
- C:\Windows\System\sOTshmW.exe
  C:\Windows\System\sOTshmW.exe
  2⤵
  PID:376
- C:\Windows\System\QmjpTYl.exe
  C:\Windows\System\QmjpTYl.exe
  2⤵
  PID:3044
- C:\Windows\System\aEPedGJ.exe
  C:\Windows\System\aEPedGJ.exe
  2⤵
  PID:1916
- C:\Windows\System\znlUMCn.exe
  C:\Windows\System\znlUMCn.exe
  2⤵
  PID:2168
- C:\Windows\System\ZUbrSLf.exe
  C:\Windows\System\ZUbrSLf.exe
  2⤵
  PID:1448
- C:\Windows\System\sglIsdY.exe
  C:\Windows\System\sglIsdY.exe
  2⤵
  PID:1540
- C:\Windows\System\gWQIkqU.exe
  C:\Windows\System\gWQIkqU.exe
  2⤵
  PID:1732
- C:\Windows\System\maONJuD.exe
  C:\Windows\System\maONJuD.exe
  2⤵
  PID:1392
- C:\Windows\System\otHpikg.exe
  C:\Windows\System\otHpikg.exe
  2⤵
  PID:2080
- C:\Windows\System\jKHuxqo.exe
  C:\Windows\System\jKHuxqo.exe
  2⤵
  PID:2684
- C:\Windows\System\JTfMgIE.exe
  C:\Windows\System\JTfMgIE.exe
  2⤵
  PID:2352
- C:\Windows\System\ArQCUTb.exe
  C:\Windows\System\ArQCUTb.exe
  2⤵
  PID:2248
- C:\Windows\System\dLhsgEP.exe
  C:\Windows\System\dLhsgEP.exe
  2⤵
  PID:1820
- C:\Windows\System\FgJOZyf.exe
  C:\Windows\System\FgJOZyf.exe
  2⤵
  PID:320
- C:\Windows\System\apOiZEM.exe
  C:\Windows\System\apOiZEM.exe
  2⤵
  PID:2252
- C:\Windows\System\TqyNmmq.exe
  C:\Windows\System\TqyNmmq.exe
  2⤵
  PID:1684
- C:\Windows\System\gGSLaRB.exe
  C:\Windows\System\gGSLaRB.exe
  2⤵
  PID:3100
- C:\Windows\System\SCbTblj.exe
  C:\Windows\System\SCbTblj.exe
  2⤵
  PID:3116
- C:\Windows\System\FgFZHxf.exe
  C:\Windows\System\FgFZHxf.exe
  2⤵
  PID:3132
- C:\Windows\System\QceIEwP.exe
  C:\Windows\System\QceIEwP.exe
  2⤵
  PID:3148
- C:\Windows\System\jwArqiy.exe
  C:\Windows\System\jwArqiy.exe
  2⤵
  PID:3168
- C:\Windows\System\nTUIwli.exe
  C:\Windows\System\nTUIwli.exe
  2⤵
  PID:3184
- C:\Windows\System\VjGVffX.exe
  C:\Windows\System\VjGVffX.exe
  2⤵
  PID:3200
- C:\Windows\System\YHJEVTK.exe
  C:\Windows\System\YHJEVTK.exe
  2⤵
  PID:3288
- C:\Windows\System\UcfiHMf.exe
  C:\Windows\System\UcfiHMf.exe
  2⤵
  PID:3304
- C:\Windows\System\FeANrQM.exe
  C:\Windows\System\FeANrQM.exe
  2⤵
  PID:3320
- C:\Windows\System\XHchjFJ.exe
  C:\Windows\System\XHchjFJ.exe
  2⤵
  PID:3336
- C:\Windows\System\JKTeeXL.exe
  C:\Windows\System\JKTeeXL.exe
  2⤵
  PID:3352
- C:\Windows\System\IyxRQya.exe
  C:\Windows\System\IyxRQya.exe
  2⤵
  PID:3368
- C:\Windows\System\cZsOVkR.exe
  C:\Windows\System\cZsOVkR.exe
  2⤵
  PID:3384
- C:\Windows\System\tHpKIgZ.exe
  C:\Windows\System\tHpKIgZ.exe
  2⤵
  PID:3400
- C:\Windows\System\vzmrCJT.exe
  C:\Windows\System\vzmrCJT.exe
  2⤵
  PID:3416
- C:\Windows\System\QfqUbbc.exe
  C:\Windows\System\QfqUbbc.exe
  2⤵
  PID:3432
- C:\Windows\System\lUnCOCQ.exe
  C:\Windows\System\lUnCOCQ.exe
  2⤵
  PID:3448
- C:\Windows\System\bjLewYR.exe
  C:\Windows\System\bjLewYR.exe
  2⤵
  PID:3464
- C:\Windows\System\wMbOrIz.exe
  C:\Windows\System\wMbOrIz.exe
  2⤵
  PID:3480
- C:\Windows\System\GWtYFpY.exe
  C:\Windows\System\GWtYFpY.exe
  2⤵
  PID:3496
- C:\Windows\System\msdmDNl.exe
  C:\Windows\System\msdmDNl.exe
  2⤵
  PID:3512
- C:\Windows\System\KkgAFIK.exe
  C:\Windows\System\KkgAFIK.exe
  2⤵
  PID:3528
- C:\Windows\System\LjqQMVq.exe
  C:\Windows\System\LjqQMVq.exe
  2⤵
  PID:3544
- C:\Windows\System\MhzpvQw.exe
  C:\Windows\System\MhzpvQw.exe
  2⤵
  PID:3560
- C:\Windows\System\lEdDCVL.exe
  C:\Windows\System\lEdDCVL.exe
  2⤵
  PID:3576
- C:\Windows\System\EfbzCsS.exe
  C:\Windows\System\EfbzCsS.exe
  2⤵
  PID:3592
- C:\Windows\System\GerhkbL.exe
  C:\Windows\System\GerhkbL.exe
  2⤵
  PID:3608
- C:\Windows\System\rRnrdVA.exe
  C:\Windows\System\rRnrdVA.exe
  2⤵
  PID:3624
- C:\Windows\System\AwizIaM.exe
  C:\Windows\System\AwizIaM.exe
  2⤵
  PID:3640
- C:\Windows\System\wmlAJQG.exe
  C:\Windows\System\wmlAJQG.exe
  2⤵
  PID:3656
- C:\Windows\System\OLkMwvR.exe
  C:\Windows\System\OLkMwvR.exe
  2⤵
  PID:3672
- C:\Windows\System\hbyPajA.exe
  C:\Windows\System\hbyPajA.exe
  2⤵
  PID:3688
- C:\Windows\System\UZLuYII.exe
  C:\Windows\System\UZLuYII.exe
  2⤵
  PID:3704
- C:\Windows\System\EjNNJck.exe
  C:\Windows\System\EjNNJck.exe
  2⤵
  PID:3720
- C:\Windows\System\yxWBlCX.exe
  C:\Windows\System\yxWBlCX.exe
  2⤵
  PID:3736
- C:\Windows\System\oAhEKkc.exe
  C:\Windows\System\oAhEKkc.exe
  2⤵
  PID:3752
- C:\Windows\System\npfYOXF.exe
  C:\Windows\System\npfYOXF.exe
  2⤵
  PID:3768
- C:\Windows\System\QNNjSCP.exe
  C:\Windows\System\QNNjSCP.exe
  2⤵
  PID:3784
- C:\Windows\System\QcyRZeW.exe
  C:\Windows\System\QcyRZeW.exe
  2⤵
  PID:3800
- C:\Windows\System\kbYRJji.exe
  C:\Windows\System\kbYRJji.exe
  2⤵
  PID:3816
- C:\Windows\System\YdccBgo.exe
  C:\Windows\System\YdccBgo.exe
  2⤵
  PID:3832
- C:\Windows\System\eVNoMaL.exe
  C:\Windows\System\eVNoMaL.exe
  2⤵
  PID:3848
- C:\Windows\System\ngJEuvu.exe
  C:\Windows\System\ngJEuvu.exe
  2⤵
  PID:3864
- C:\Windows\System\LDfsciH.exe
  C:\Windows\System\LDfsciH.exe
  2⤵
  PID:3880
- C:\Windows\System\hpIPYhM.exe
  C:\Windows\System\hpIPYhM.exe
  2⤵
  PID:3896
- C:\Windows\System\AHgZrbm.exe
  C:\Windows\System\AHgZrbm.exe
  2⤵
  PID:3912
- C:\Windows\System\GmKmNtX.exe
  C:\Windows\System\GmKmNtX.exe
  2⤵
  PID:3928
- C:\Windows\System\kQmoxhO.exe
  C:\Windows\System\kQmoxhO.exe
  2⤵
  PID:3944
- C:\Windows\System\FAwYKFZ.exe
  C:\Windows\System\FAwYKFZ.exe
  2⤵
  PID:3960
- C:\Windows\System\pASwixF.exe
  C:\Windows\System\pASwixF.exe
  2⤵
  PID:3976
- C:\Windows\System\bzwtGkA.exe
  C:\Windows\System\bzwtGkA.exe
  2⤵
  PID:3996
- C:\Windows\System\ydAOiFm.exe
  C:\Windows\System\ydAOiFm.exe
  2⤵
  PID:4012
- C:\Windows\System\ZADNCWx.exe
  C:\Windows\System\ZADNCWx.exe
  2⤵
  PID:4028
- C:\Windows\System\gvnNgBS.exe
  C:\Windows\System\gvnNgBS.exe
  2⤵
  PID:4044
- C:\Windows\System\GxEbQkX.exe
  C:\Windows\System\GxEbQkX.exe
  2⤵
  PID:4060
- C:\Windows\System\jtHESNB.exe
  C:\Windows\System\jtHESNB.exe
  2⤵
  PID:4076
- C:\Windows\System\AtEFNUY.exe
  C:\Windows\System\AtEFNUY.exe
  2⤵
  PID:4092
- C:\Windows\System\KXqMbju.exe
  C:\Windows\System\KXqMbju.exe
  2⤵
  PID:3032
- C:\Windows\System\yrsAjxQ.exe
  C:\Windows\System\yrsAjxQ.exe
  2⤵
  PID:2436
- C:\Windows\System\rkcSSLS.exe
  C:\Windows\System\rkcSSLS.exe
  2⤵
  PID:2504
- C:\Windows\System\RaFBgcC.exe
  C:\Windows\System\RaFBgcC.exe
  2⤵
  PID:3080
- C:\Windows\System\RyABVHE.exe
  C:\Windows\System\RyABVHE.exe
  2⤵
  PID:3096
- C:\Windows\System\DMwmWIJ.exe
  C:\Windows\System\DMwmWIJ.exe
  2⤵
  PID:3160
- C:\Windows\System\wwNWwIw.exe
  C:\Windows\System\wwNWwIw.exe
  2⤵
  PID:1712
- C:\Windows\System\sbBAtmG.exe
  C:\Windows\System\sbBAtmG.exe
  2⤵
  PID:2956
- C:\Windows\System\rXQtFLg.exe
  C:\Windows\System\rXQtFLg.exe
  2⤵
  PID:2460
- C:\Windows\System\kVbtKUD.exe
  C:\Windows\System\kVbtKUD.exe
  2⤵
  PID:3208
- C:\Windows\System\uloZnqG.exe
  C:\Windows\System\uloZnqG.exe
  2⤵
  PID:700
- C:\Windows\System\WOdGOJV.exe
  C:\Windows\System\WOdGOJV.exe
  2⤵
  PID:1252
- C:\Windows\System\RjWHZRE.exe
  C:\Windows\System\RjWHZRE.exe
  2⤵
  PID:2400
- C:\Windows\System\mQAcIpC.exe
  C:\Windows\System\mQAcIpC.exe
  2⤵
  PID:3112
- C:\Windows\System\jLPooMa.exe
  C:\Windows\System\jLPooMa.exe
  2⤵
  PID:3220
- C:\Windows\System\QAXqwaY.exe
  C:\Windows\System\QAXqwaY.exe
  2⤵
  PID:3236
- C:\Windows\System\LjnstVW.exe
  C:\Windows\System\LjnstVW.exe
  2⤵
  PID:3252
- C:\Windows\System\bincHKT.exe
  C:\Windows\System\bincHKT.exe
  2⤵
  PID:3268
- C:\Windows\System\LWOZLFO.exe
  C:\Windows\System\LWOZLFO.exe
  2⤵
  PID:3296
- C:\Windows\System\DGAneZG.exe
  C:\Windows\System\DGAneZG.exe
  2⤵
  PID:3328
- C:\Windows\System\CDpnMax.exe
  C:\Windows\System\CDpnMax.exe
  2⤵
  PID:3344
- C:\Windows\System\MPBCOON.exe
  C:\Windows\System\MPBCOON.exe
  2⤵
  PID:3376
- C:\Windows\System\CSIMOcQ.exe
  C:\Windows\System\CSIMOcQ.exe
  2⤵
  PID:3408
- C:\Windows\System\RewjZHx.exe
  C:\Windows\System\RewjZHx.exe
  2⤵
  PID:3456
- C:\Windows\System\azsbioW.exe
  C:\Windows\System\azsbioW.exe
  2⤵
  PID:3472
- C:\Windows\System\fcfpfLR.exe
  C:\Windows\System\fcfpfLR.exe
  2⤵
  PID:3504
- C:\Windows\System\NRqQZcr.exe
  C:\Windows\System\NRqQZcr.exe
  2⤵
  PID:3536
- C:\Windows\System\IWucIwi.exe
  C:\Windows\System\IWucIwi.exe
  2⤵
  PID:3568
- C:\Windows\System\tUOuEbo.exe
  C:\Windows\System\tUOuEbo.exe
  2⤵
  PID:3600
- C:\Windows\System\cKBBpAo.exe
  C:\Windows\System\cKBBpAo.exe
  2⤵
  PID:3652
- C:\Windows\System\fgYnguO.exe
  C:\Windows\System\fgYnguO.exe
  2⤵
  PID:4328
- C:\Windows\System\AcYxIpl.exe
  C:\Windows\System\AcYxIpl.exe
  2⤵
  PID:4344
- C:\Windows\System\zVgHhqg.exe
  C:\Windows\System\zVgHhqg.exe
  2⤵
  PID:4360
- C:\Windows\System\iEKHxpA.exe
  C:\Windows\System\iEKHxpA.exe
  2⤵
  PID:4376
- C:\Windows\System\ezjUtla.exe
  C:\Windows\System\ezjUtla.exe
  2⤵
  PID:4392
- C:\Windows\System\MWOhohA.exe
  C:\Windows\System\MWOhohA.exe
  2⤵
  PID:4408
- C:\Windows\System\cUdqzJt.exe
  C:\Windows\System\cUdqzJt.exe
  2⤵
  PID:4436
- C:\Windows\System\xQGTwRN.exe
  C:\Windows\System\xQGTwRN.exe
  2⤵
  PID:4452
- C:\Windows\System\XTkvDYL.exe
  C:\Windows\System\XTkvDYL.exe
  2⤵
  PID:4468
- C:\Windows\System\BcNwaAZ.exe
  C:\Windows\System\BcNwaAZ.exe
  2⤵
  PID:4488
- C:\Windows\System\GiMgYHj.exe
  C:\Windows\System\GiMgYHj.exe
  2⤵
  PID:4508
- C:\Windows\System\PaEwZvh.exe
  C:\Windows\System\PaEwZvh.exe
  2⤵
  PID:4524
- C:\Windows\System\eJIkvkw.exe
  C:\Windows\System\eJIkvkw.exe
  2⤵
  PID:4540
- C:\Windows\System\PCWuXOP.exe
  C:\Windows\System\PCWuXOP.exe
  2⤵
  PID:4556
- C:\Windows\System\oYsekgg.exe
  C:\Windows\System\oYsekgg.exe
  2⤵
  PID:4572
- C:\Windows\System\XvfdyKx.exe
  C:\Windows\System\XvfdyKx.exe
  2⤵
  PID:4588
- C:\Windows\System\bdwhokL.exe
  C:\Windows\System\bdwhokL.exe
  2⤵
  PID:4604
- C:\Windows\System\PrNofkq.exe
  C:\Windows\System\PrNofkq.exe
  2⤵
  PID:4620
- C:\Windows\System\NbfoFtY.exe
  C:\Windows\System\NbfoFtY.exe
  2⤵
  PID:4636
- C:\Windows\System\fKAZOJR.exe
  C:\Windows\System\fKAZOJR.exe
  2⤵
  PID:4656
- C:\Windows\System\XHlMsqx.exe
  C:\Windows\System\XHlMsqx.exe
  2⤵
  PID:4672
- C:\Windows\System\tGfaCvn.exe
  C:\Windows\System\tGfaCvn.exe
  2⤵
  PID:4688
- C:\Windows\System\WcZelHp.exe
  C:\Windows\System\WcZelHp.exe
  2⤵
  PID:4704
- C:\Windows\System\Ficbgxa.exe
  C:\Windows\System\Ficbgxa.exe
  2⤵
  PID:4720
- C:\Windows\System\MhqMaVG.exe
  C:\Windows\System\MhqMaVG.exe
  2⤵
  PID:4736
- C:\Windows\System\khcyCuf.exe
  C:\Windows\System\khcyCuf.exe
  2⤵
  PID:4752
- C:\Windows\System\NfHnppf.exe
  C:\Windows\System\NfHnppf.exe
  2⤵
  PID:4776
- C:\Windows\System\mTsCjpL.exe
  C:\Windows\System\mTsCjpL.exe
  2⤵
  PID:4792
- C:\Windows\System\cLYDpoi.exe
  C:\Windows\System\cLYDpoi.exe
  2⤵
  PID:4912
- C:\Windows\System\ldGyKIS.exe
  C:\Windows\System\ldGyKIS.exe
  2⤵
  PID:4928
- C:\Windows\System\yKhDDUk.exe
  C:\Windows\System\yKhDDUk.exe
  2⤵
  PID:4944
- C:\Windows\System\wFUbzhH.exe
  C:\Windows\System\wFUbzhH.exe
  2⤵
  PID:4960
- C:\Windows\System\XAhldjd.exe
  C:\Windows\System\XAhldjd.exe
  2⤵
  PID:4976
- C:\Windows\System\ARgrORd.exe
  C:\Windows\System\ARgrORd.exe
  2⤵
  PID:4992
- C:\Windows\System\byCEFUf.exe
  C:\Windows\System\byCEFUf.exe
  2⤵
  PID:5008
- C:\Windows\System\wedXcpY.exe
  C:\Windows\System\wedXcpY.exe
  2⤵
  PID:5024
- C:\Windows\System\jOyOZpb.exe
  C:\Windows\System\jOyOZpb.exe
  2⤵
  PID:5040
- C:\Windows\System\efKZBYc.exe
  C:\Windows\System\efKZBYc.exe
  2⤵
  PID:5056
- C:\Windows\System\msCWUNV.exe
  C:\Windows\System\msCWUNV.exe
  2⤵
  PID:5072
- C:\Windows\System\BUVWHul.exe
  C:\Windows\System\BUVWHul.exe
  2⤵
  PID:5088
- C:\Windows\System\AwmVMcD.exe
  C:\Windows\System\AwmVMcD.exe
  2⤵
  PID:5104
- C:\Windows\System\wNmrPGX.exe
  C:\Windows\System\wNmrPGX.exe
  2⤵
  PID:3776
- C:\Windows\System\tRZmGDY.exe
  C:\Windows\System\tRZmGDY.exe
  2⤵
  PID:3840
- C:\Windows\System\ZqlquWb.exe
  C:\Windows\System\ZqlquWb.exe
  2⤵
  PID:3904
- C:\Windows\System\zgbuHib.exe
  C:\Windows\System\zgbuHib.exe
  2⤵
  PID:2408
- C:\Windows\System\UwuVvef.exe
  C:\Windows\System\UwuVvef.exe
  2⤵
  PID:3632
- C:\Windows\System\gQpnYru.exe
  C:\Windows\System\gQpnYru.exe
  2⤵
  PID:3940
- C:\Windows\System\FgTEjWX.exe
  C:\Windows\System\FgTEjWX.exe
  2⤵
  PID:3796
- C:\Windows\System\VVgjgyw.exe
  C:\Windows\System\VVgjgyw.exe
  2⤵
  PID:2476
- C:\Windows\System\NLCOwzW.exe
  C:\Windows\System\NLCOwzW.exe
  2⤵
  PID:4036
- C:\Windows\System\EfQUJiy.exe
  C:\Windows\System\EfQUJiy.exe
  2⤵
  PID:1996
- C:\Windows\System\JuVByHy.exe
  C:\Windows\System\JuVByHy.exe
  2⤵
  PID:3824
- C:\Windows\System\oPtwBzb.exe
  C:\Windows\System\oPtwBzb.exe
  2⤵
  PID:2020
- C:\Windows\System\WaMJkom.exe
  C:\Windows\System\WaMJkom.exe
  2⤵
  PID:3244
- C:\Windows\System\sZAjjga.exe
  C:\Windows\System\sZAjjga.exe
  2⤵
  PID:3316
- C:\Windows\System\SmbQVCY.exe
  C:\Windows\System\SmbQVCY.exe
  2⤵
  PID:3440
- C:\Windows\System\UVHpDrL.exe
  C:\Windows\System\UVHpDrL.exe
  2⤵
  PID:3588
- C:\Windows\System\rFMOAgX.exe
  C:\Windows\System\rFMOAgX.exe
  2⤵
  PID:3744
- C:\Windows\System\xaRsmNC.exe
  C:\Windows\System\xaRsmNC.exe
  2⤵
  PID:2928
- C:\Windows\System\bkQtIMy.exe
  C:\Windows\System\bkQtIMy.exe
  2⤵
  PID:4112
- C:\Windows\System\GrNbouL.exe
  C:\Windows\System\GrNbouL.exe
  2⤵
  PID:4128
- C:\Windows\System\nBjtbqC.exe
  C:\Windows\System\nBjtbqC.exe
  2⤵
  PID:4144
- C:\Windows\System\XSAaYCj.exe
  C:\Windows\System\XSAaYCj.exe
  2⤵
  PID:4164
- C:\Windows\System\jDbFOHY.exe
  C:\Windows\System\jDbFOHY.exe
  2⤵
  PID:4176
- C:\Windows\System\HziGktg.exe
  C:\Windows\System\HziGktg.exe
  2⤵
  PID:4232
- C:\Windows\System\AYyGzIc.exe
  C:\Windows\System\AYyGzIc.exe
  2⤵
  PID:4216
- C:\Windows\System\ljbQShg.exe
  C:\Windows\System\ljbQShg.exe
  2⤵
  PID:4200
- C:\Windows\System\XeqKFYf.exe
  C:\Windows\System\XeqKFYf.exe
  2⤵
  PID:4316
- C:\Windows\System\XZPUpJV.exe
  C:\Windows\System\XZPUpJV.exe
  2⤵
  PID:4320
- C:\Windows\System\RTYfeVc.exe
  C:\Windows\System\RTYfeVc.exe
  2⤵
  PID:4284
- C:\Windows\System\yGkzhxQ.exe
  C:\Windows\System\yGkzhxQ.exe
  2⤵
  PID:4272
- C:\Windows\System\XzegRqp.exe
  C:\Windows\System\XzegRqp.exe
  2⤵
  PID:4240
- C:\Windows\System\dJLTDcs.exe
  C:\Windows\System\dJLTDcs.exe
  2⤵
  PID:4264
- C:\Windows\System\AGJplLO.exe
  C:\Windows\System\AGJplLO.exe
  2⤵
  PID:3732
- C:\Windows\System\pMhzyvV.exe
  C:\Windows\System\pMhzyvV.exe
  2⤵
  PID:3860
- C:\Windows\System\Dzuvmti.exe
  C:\Windows\System\Dzuvmti.exe
  2⤵
  PID:3924
- C:\Windows\System\uKfyEna.exe
  C:\Windows\System\uKfyEna.exe
  2⤵
  PID:3712
- C:\Windows\System\sSBtbRU.exe
  C:\Windows\System\sSBtbRU.exe
  2⤵
  PID:4388
- C:\Windows\System\tYrnHCn.exe
  C:\Windows\System\tYrnHCn.exe
  2⤵
  PID:4428
- C:\Windows\System\AbjkLVU.exe
  C:\Windows\System\AbjkLVU.exe
  2⤵
  PID:4496
- C:\Windows\System\RXyulXG.exe
  C:\Windows\System\RXyulXG.exe
  2⤵
  PID:4536
- C:\Windows\System\ebJASfS.exe
  C:\Windows\System\ebJASfS.exe
  2⤵
  PID:4600
- C:\Windows\System\EYuAgpD.exe
  C:\Windows\System\EYuAgpD.exe
  2⤵
  PID:4632
- C:\Windows\System\PkMTMoY.exe
  C:\Windows\System\PkMTMoY.exe
  2⤵
  PID:4700
- C:\Windows\System\qVmGZGR.exe
  C:\Windows\System\qVmGZGR.exe
  2⤵
  PID:4772
- C:\Windows\System\cyIntqA.exe
  C:\Windows\System\cyIntqA.exe
  2⤵
  PID:4812
- C:\Windows\System\mGypXnN.exe
  C:\Windows\System\mGypXnN.exe
  2⤵
  PID:4832
- C:\Windows\System\PnVaARW.exe
  C:\Windows\System\PnVaARW.exe
  2⤵
  PID:4852
- C:\Windows\System\lysuaCs.exe
  C:\Windows\System\lysuaCs.exe
  2⤵
  PID:4864
- C:\Windows\System\uOjvNTp.exe
  C:\Windows\System\uOjvNTp.exe
  2⤵
  PID:856
- C:\Windows\System\MOJmvjt.exe
  C:\Windows\System\MOJmvjt.exe
  2⤵
  PID:4888
- C:\Windows\System\Snmgmuq.exe
  C:\Windows\System\Snmgmuq.exe
  2⤵
  PID:3992
- C:\Windows\System\UUPjNej.exe
  C:\Windows\System\UUPjNej.exe
  2⤵
  PID:4052
- C:\Windows\System\apaRkpK.exe
  C:\Windows\System\apaRkpK.exe
  2⤵
  PID:2312
- C:\Windows\System\vLbgjmQ.exe
  C:\Windows\System\vLbgjmQ.exe
  2⤵
  PID:3128
- C:\Windows\System\ZSoveuB.exe
  C:\Windows\System\ZSoveuB.exe
  2⤵
  PID:3176
- C:\Windows\System\KvwuJnJ.exe
  C:\Windows\System\KvwuJnJ.exe
  2⤵
  PID:2932
- C:\Windows\System\FKwvSqX.exe
  C:\Windows\System\FKwvSqX.exe
  2⤵
  PID:3260
- C:\Windows\System\nukmsOr.exe
  C:\Windows\System\nukmsOr.exe
  2⤵
  PID:3360
- C:\Windows\System\iekuGfT.exe
  C:\Windows\System\iekuGfT.exe
  2⤵
  PID:3476
- C:\Windows\System\VpWBDDt.exe
  C:\Windows\System\VpWBDDt.exe
  2⤵
  PID:3620
- C:\Windows\System\WAIBkFx.exe
  C:\Windows\System\WAIBkFx.exe
  2⤵
  PID:4900
- C:\Windows\System\iXWmAfX.exe
  C:\Windows\System\iXWmAfX.exe
  2⤵
  PID:4404
- C:\Windows\System\WRllvTm.exe
  C:\Windows\System\WRllvTm.exe
  2⤵
  PID:4476
- C:\Windows\System\VtTmTSM.exe
  C:\Windows\System\VtTmTSM.exe
  2⤵
  PID:4904
- C:\Windows\System\ihOZSRx.exe
  C:\Windows\System\ihOZSRx.exe
  2⤵
  PID:4584
- C:\Windows\System\UXqwsYk.exe
  C:\Windows\System\UXqwsYk.exe
  2⤵
  PID:4648
- C:\Windows\System\afnocJp.exe
  C:\Windows\System\afnocJp.exe
  2⤵
  PID:4712
- C:\Windows\System\CERdMxN.exe
  C:\Windows\System\CERdMxN.exe
  2⤵
  PID:4784
- C:\Windows\System\TeEIRkb.exe
  C:\Windows\System\TeEIRkb.exe
  2⤵
  PID:4936
- C:\Windows\System\ZHjeyBJ.exe
  C:\Windows\System\ZHjeyBJ.exe
  2⤵
  PID:4968
- C:\Windows\System\jxQhiLh.exe
  C:\Windows\System\jxQhiLh.exe
  2⤵
  PID:4984
- C:\Windows\System\oTuiOKB.exe
  C:\Windows\System\oTuiOKB.exe
  2⤵
  PID:5016
- C:\Windows\System\EozJxcE.exe
  C:\Windows\System\EozJxcE.exe
  2⤵
  PID:5048
- C:\Windows\System\JCBwvZF.exe
  C:\Windows\System\JCBwvZF.exe
  2⤵
  PID:5080
- C:\Windows\System\YFHUYlb.exe
  C:\Windows\System\YFHUYlb.exe
  2⤵
  PID:3808
- C:\Windows\System\UiAOwRx.exe
  C:\Windows\System\UiAOwRx.exe
  2⤵
  PID:3872
- C:\Windows\System\uiFQpFd.exe
  C:\Windows\System\uiFQpFd.exe
  2⤵
  PID:1728
- C:\Windows\System\lwTKjCp.exe
  C:\Windows\System\lwTKjCp.exe
  2⤵
  PID:3972
- C:\Windows\System\DufocWx.exe
  C:\Windows\System\DufocWx.exe
  2⤵
  PID:4324
- C:\Windows\System\ijXGWzd.exe
  C:\Windows\System\ijXGWzd.exe
  2⤵
  PID:4008
- C:\Windows\System\UZLkIgO.exe
  C:\Windows\System\UZLkIgO.exe
  2⤵
  PID:860
- C:\Windows\System\hNkGUQB.exe
  C:\Windows\System\hNkGUQB.exe
  2⤵
  PID:3280
- C:\Windows\System\uYqBELz.exe
  C:\Windows\System\uYqBELz.exe
  2⤵
  PID:3524
- C:\Windows\System\OmsowAx.exe
  C:\Windows\System\OmsowAx.exe
  2⤵
  PID:3716
- C:\Windows\System\ajmcVRG.exe
  C:\Windows\System\ajmcVRG.exe
  2⤵
  PID:4124
- C:\Windows\System\qxVsIdf.exe
  C:\Windows\System\qxVsIdf.exe
  2⤵
  PID:4140
- C:\Windows\System\liAUgWo.exe
  C:\Windows\System\liAUgWo.exe
  2⤵
  PID:4168
- C:\Windows\System\KSexpmA.exe
  C:\Windows\System\KSexpmA.exe
  2⤵
  PID:4204
- C:\Windows\System\jzDBdTt.exe
  C:\Windows\System\jzDBdTt.exe
  2⤵
  PID:2600
- C:\Windows\System\McfKorQ.exe
  C:\Windows\System\McfKorQ.exe
  2⤵
  PID:4268
- C:\Windows\System\bvDGbkC.exe
  C:\Windows\System\bvDGbkC.exe
  2⤵
  PID:4260
- C:\Windows\System\uqNKyVm.exe
  C:\Windows\System\uqNKyVm.exe
  2⤵
  PID:3700
- C:\Windows\System\KPWFbfy.exe
  C:\Windows\System\KPWFbfy.exe
  2⤵
  PID:620
- C:\Windows\System\WPiazcF.exe
  C:\Windows\System\WPiazcF.exe
  2⤵
  PID:4424
- C:\Windows\System\CTKYxrf.exe
  C:\Windows\System\CTKYxrf.exe
  2⤵
  PID:4532
- C:\Windows\System\HgnHcRJ.exe
  C:\Windows\System\HgnHcRJ.exe
  2⤵
  PID:1808
- C:\Windows\System\hMFYnTk.exe
  C:\Windows\System\hMFYnTk.exe
  2⤵
  PID:4568
- C:\Windows\System\vCXTSVG.exe
  C:\Windows\System\vCXTSVG.exe
  2⤵
  PID:2744
- C:\Windows\System\kjFoRhL.exe
  C:\Windows\System\kjFoRhL.exe
  2⤵
  PID:4804
- C:\Windows\System\QOgrNWJ.exe
  C:\Windows\System\QOgrNWJ.exe
  2⤵
  PID:2308
- C:\Windows\System\luORhXo.exe
  C:\Windows\System\luORhXo.exe
  2⤵
  PID:4884
- C:\Windows\System\duJXCnG.exe
  C:\Windows\System\duJXCnG.exe
  2⤵
  PID:3228
- C:\Windows\System\zBmpYnF.exe
  C:\Windows\System\zBmpYnF.exe
  2⤵
  PID:3412
- C:\Windows\System\YNNTkbZ.exe
  C:\Windows\System\YNNTkbZ.exe
  2⤵
  PID:4336
- C:\Windows\System\mpsKtZX.exe
  C:\Windows\System\mpsKtZX.exe
  2⤵
  PID:4444
- C:\Windows\System\KZiVJaq.exe
  C:\Windows\System\KZiVJaq.exe
  2⤵
  PID:4552
- C:\Windows\System\YtOGVZp.exe
  C:\Windows\System\YtOGVZp.exe
  2⤵
  PID:4680
- C:\Windows\System\eluPqqB.exe
  C:\Windows\System\eluPqqB.exe
  2⤵
  PID:4908
- C:\Windows\System\whuILsI.exe
  C:\Windows\System\whuILsI.exe
  2⤵
  PID:2000
- C:\Windows\System\feOnRaG.exe
  C:\Windows\System\feOnRaG.exe
  2⤵
  PID:5052
- C:\Windows\System\HGFHnxH.exe
  C:\Windows\System\HGFHnxH.exe
  2⤵
  PID:5096
- C:\Windows\System\hGqbYqK.exe
  C:\Windows\System\hGqbYqK.exe
  2⤵
  PID:3092
- C:\Windows\System\SSyiAnt.exe
  C:\Windows\System\SSyiAnt.exe
  2⤵
  PID:3088
- C:\Windows\System\gZwWCLC.exe
  C:\Windows\System\gZwWCLC.exe
  2⤵
  PID:4072
- C:\Windows\System\xShrXuc.exe
  C:\Windows\System\xShrXuc.exe
  2⤵
  PID:3196
- C:\Windows\System\HdZRFIV.exe
  C:\Windows\System\HdZRFIV.exe
  2⤵
  PID:1924
- C:\Windows\System\PtfHwWl.exe
  C:\Windows\System\PtfHwWl.exe
  2⤵
  PID:2856
- C:\Windows\System\dlLMfNB.exe
  C:\Windows\System\dlLMfNB.exe
  2⤵
  PID:4156
- C:\Windows\System\PxTQCzA.exe
  C:\Windows\System\PxTQCzA.exe
  2⤵
  PID:4220
- C:\Windows\System\aZMvABT.exe
  C:\Windows\System\aZMvABT.exe
  2⤵
  PID:3696
- C:\Windows\System\diixnau.exe
  C:\Windows\System\diixnau.exe
  2⤵
  PID:1952
- C:\Windows\System\cdygSqP.exe
  C:\Windows\System\cdygSqP.exe
  2⤵
  PID:3004
- C:\Windows\System\FdfeDbZ.exe
  C:\Windows\System\FdfeDbZ.exe
  2⤵
  PID:4824
- C:\Windows\System\hqibGII.exe
  C:\Windows\System\hqibGII.exe
  2⤵
  PID:4844
- C:\Windows\System\zAPPpId.exe
  C:\Windows\System\zAPPpId.exe
  2⤵
  PID:4988
- C:\Windows\System\nxCAoIu.exe
  C:\Windows\System\nxCAoIu.exe
  2⤵
  PID:3216
- C:\Windows\System\wZQacMs.exe
  C:\Windows\System\wZQacMs.exe
  2⤵
  PID:1476
- C:\Windows\System\JtCXjCU.exe
  C:\Windows\System\JtCXjCU.exe
  2⤵
  PID:4504
- C:\Windows\System\mPiiscw.exe
  C:\Windows\System\mPiiscw.exe
  2⤵
  PID:4300
- C:\Windows\System\mBEmdbS.exe
  C:\Windows\System\mBEmdbS.exe
  2⤵
  PID:3920
- C:\Windows\System\KjDblOz.exe
  C:\Windows\System\KjDblOz.exe
  2⤵
  PID:4304
- C:\Windows\System\DyiklXp.exe
  C:\Windows\System\DyiklXp.exe
  2⤵
  PID:2864
- C:\Windows\System\eQsgeYP.exe
  C:\Windows\System\eQsgeYP.exe
  2⤵
  PID:5068
- C:\Windows\System\AAIIBCl.exe
  C:\Windows\System\AAIIBCl.exe
  2⤵
  PID:1980
- C:\Windows\System\vvtSJDI.exe
  C:\Windows\System\vvtSJDI.exe
  2⤵
  PID:2196
- C:\Windows\System\ugpmqnJ.exe
  C:\Windows\System\ugpmqnJ.exe
  2⤵
  PID:4580
- C:\Windows\System\CXrSxAf.exe
  C:\Windows\System\CXrSxAf.exe
  2⤵
  PID:2332
- C:\Windows\System\pxQJzNL.exe
  C:\Windows\System\pxQJzNL.exe
  2⤵
  PID:3556
- C:\Windows\System\qgTnHJc.exe
  C:\Windows\System\qgTnHJc.exe
  2⤵
  PID:4684
- C:\Windows\System\hzdeGec.exe
  C:\Windows\System\hzdeGec.exe
  2⤵
  PID:1224
- C:\Windows\System\qtbHIPn.exe
  C:\Windows\System\qtbHIPn.exe
  2⤵
  PID:4208
- C:\Windows\System\UwEPvzU.exe
  C:\Windows\System\UwEPvzU.exe
  2⤵
  PID:5084
- C:\Windows\System\CnbzAiC.exe
  C:\Windows\System\CnbzAiC.exe
  2⤵
  PID:3764
- C:\Windows\System\JNURDFO.exe
  C:\Windows\System\JNURDFO.exe
  2⤵
  PID:3828
- C:\Windows\System\DjxULIS.exe
  C:\Windows\System\DjxULIS.exe
  2⤵
  PID:1904
- C:\Windows\System\gzPAkEo.exe
  C:\Windows\System\gzPAkEo.exe
  2⤵
  PID:4768
- C:\Windows\System\GLxSqjy.exe
  C:\Windows\System\GLxSqjy.exe
  2⤵
  PID:1948
- C:\Windows\System\sGKMQGH.exe
  C:\Windows\System\sGKMQGH.exe
  2⤵
  PID:5020
- C:\Windows\System\poSrspJ.exe
  C:\Windows\System\poSrspJ.exe
  2⤵
  PID:920
- C:\Windows\System\zKNBTLB.exe
  C:\Windows\System\zKNBTLB.exe
  2⤵
  PID:3956
- C:\Windows\System\oSFdVwl.exe
  C:\Windows\System\oSFdVwl.exe
  2⤵
  PID:3076
- C:\Windows\System\qFixxoo.exe
  C:\Windows\System\qFixxoo.exe
  2⤵
  PID:3212
- C:\Windows\System\sHfHUxj.exe
  C:\Windows\System\sHfHUxj.exe
  2⤵
  PID:4520
- C:\Windows\System\PVYgtVH.exe
  C:\Windows\System\PVYgtVH.exe
  2⤵
  PID:4872
- C:\Windows\System\sMlCnGr.exe
  C:\Windows\System\sMlCnGr.exe
  2⤵
  PID:2648
- C:\Windows\System\zoHTXdz.exe
  C:\Windows\System\zoHTXdz.exe
  2⤵
  PID:5124
- C:\Windows\System\GDCRZyU.exe
  C:\Windows\System\GDCRZyU.exe
  2⤵
  PID:5140
- C:\Windows\System\ltHMhLH.exe
  C:\Windows\System\ltHMhLH.exe
  2⤵
  PID:5160
- C:\Windows\System\jpojCse.exe
  C:\Windows\System\jpojCse.exe
  2⤵
  PID:5176
- C:\Windows\System\iKYgoPR.exe
  C:\Windows\System\iKYgoPR.exe
  2⤵
  PID:5196
- C:\Windows\System\JFUeNmM.exe
  C:\Windows\System\JFUeNmM.exe
  2⤵
  PID:5212
- C:\Windows\System\agmoXNm.exe
  C:\Windows\System\agmoXNm.exe
  2⤵
  PID:5228
- C:\Windows\System\djCVrTu.exe
  C:\Windows\System\djCVrTu.exe
  2⤵
  PID:5332
- C:\Windows\System\UupTepV.exe
  C:\Windows\System\UupTepV.exe
  2⤵
  PID:5348
- C:\Windows\System\iFodByE.exe
  C:\Windows\System\iFodByE.exe
  2⤵
  PID:5364
- C:\Windows\System\XRtSswr.exe
  C:\Windows\System\XRtSswr.exe
  2⤵
  PID:5384
- C:\Windows\System\QIwoaOq.exe
  C:\Windows\System\QIwoaOq.exe
  2⤵
  PID:5404
- C:\Windows\System\vqARlNy.exe
  C:\Windows\System\vqARlNy.exe
  2⤵
  PID:5420
- C:\Windows\System\IJSSTDB.exe
  C:\Windows\System\IJSSTDB.exe
  2⤵
  PID:5440
- C:\Windows\System\NuzmplA.exe
  C:\Windows\System\NuzmplA.exe
  2⤵
  PID:5456
- C:\Windows\System\UmARTkB.exe
  C:\Windows\System\UmARTkB.exe
  2⤵
  PID:5472
- C:\Windows\System\VzxHOBz.exe
  C:\Windows\System\VzxHOBz.exe
  2⤵
  PID:5488
- C:\Windows\System\UwFVjLc.exe
  C:\Windows\System\UwFVjLc.exe
  2⤵
  PID:5504
- C:\Windows\System\nXhHXdM.exe
  C:\Windows\System\nXhHXdM.exe
  2⤵
  PID:5520
- C:\Windows\System\BGlYPdR.exe
  C:\Windows\System\BGlYPdR.exe
  2⤵
  PID:5540
- C:\Windows\System\GmSCFXf.exe
  C:\Windows\System\GmSCFXf.exe
  2⤵
  PID:5556
- C:\Windows\System\UXMnkbO.exe
  C:\Windows\System\UXMnkbO.exe
  2⤵
  PID:5572
- C:\Windows\System\rgtbfEu.exe
  C:\Windows\System\rgtbfEu.exe
  2⤵
  PID:5592
- C:\Windows\System\JJkuOTB.exe
  C:\Windows\System\JJkuOTB.exe
  2⤵
  PID:5608
- C:\Windows\System\gVfHRRU.exe
  C:\Windows\System\gVfHRRU.exe
  2⤵
  PID:5624
- C:\Windows\System\kkCLjKQ.exe
  C:\Windows\System\kkCLjKQ.exe
  2⤵
  PID:5640
- C:\Windows\System\pRvvKnf.exe
  C:\Windows\System\pRvvKnf.exe
  2⤵
  PID:5656
- C:\Windows\System\QGhlJfk.exe
  C:\Windows\System\QGhlJfk.exe
  2⤵
  PID:5676
- C:\Windows\System\uAliFgg.exe
  C:\Windows\System\uAliFgg.exe
  2⤵
  PID:5692
- C:\Windows\System\jnceASO.exe
  C:\Windows\System\jnceASO.exe
  2⤵
  PID:5708
- C:\Windows\System\xfSiCsB.exe
  C:\Windows\System\xfSiCsB.exe
  2⤵
  PID:5724
- C:\Windows\System\YbIWzEG.exe
  C:\Windows\System\YbIWzEG.exe
  2⤵
  PID:5744
- C:\Windows\System\DVmvVyI.exe
  C:\Windows\System\DVmvVyI.exe
  2⤵
  PID:5836
- C:\Windows\System\UYHMJEo.exe
  C:\Windows\System\UYHMJEo.exe
  2⤵
  PID:5852
- C:\Windows\System\XQtxYpK.exe
  C:\Windows\System\XQtxYpK.exe
  2⤵
  PID:5868
- C:\Windows\System\htGucoI.exe
  C:\Windows\System\htGucoI.exe
  2⤵
  PID:5884
- C:\Windows\System\edKsWTU.exe
  C:\Windows\System\edKsWTU.exe
  2⤵
  PID:5900
- C:\Windows\System\xCIlnzM.exe
  C:\Windows\System\xCIlnzM.exe
  2⤵
  PID:5920
- C:\Windows\System\BCABkDE.exe
  C:\Windows\System\BCABkDE.exe
  2⤵
  PID:5936
- C:\Windows\System\TfAicdk.exe
  C:\Windows\System\TfAicdk.exe
  2⤵
  PID:5956
- C:\Windows\System\GSGcSml.exe
  C:\Windows\System\GSGcSml.exe
  2⤵
  PID:5972
- C:\Windows\System\txkstGm.exe
  C:\Windows\System\txkstGm.exe
  2⤵
  PID:5988
- C:\Windows\System\BeRokKe.exe
  C:\Windows\System\BeRokKe.exe
  2⤵
  PID:6004
- C:\Windows\System\hftBlXI.exe
  C:\Windows\System\hftBlXI.exe
  2⤵
  PID:6020
- C:\Windows\System\xJiaBas.exe
  C:\Windows\System\xJiaBas.exe
  2⤵
  PID:6040
- C:\Windows\System\xbjWuws.exe
  C:\Windows\System\xbjWuws.exe
  2⤵
  PID:6056
- C:\Windows\System\msEziPk.exe
  C:\Windows\System\msEziPk.exe
  2⤵
  PID:6076
- C:\Windows\System\JakGJLk.exe
  C:\Windows\System\JakGJLk.exe
  2⤵
  PID:6092
- C:\Windows\System\xhixRDt.exe
  C:\Windows\System\xhixRDt.exe
  2⤵
  PID:6108
- C:\Windows\System\NMvvRzk.exe
  C:\Windows\System\NMvvRzk.exe
  2⤵
  PID:6124
- C:\Windows\System\JLtLQMl.exe
  C:\Windows\System\JLtLQMl.exe
  2⤵
  PID:5136
- C:\Windows\System\rSehoJR.exe
  C:\Windows\System\rSehoJR.exe
  2⤵
  PID:5168
- C:\Windows\System\DjSbiVT.exe
  C:\Windows\System\DjSbiVT.exe
  2⤵
  PID:5208
- C:\Windows\System\craPLQI.exe
  C:\Windows\System\craPLQI.exe
  2⤵
  PID:5240
- C:\Windows\System\IeMvLaJ.exe
  C:\Windows\System\IeMvLaJ.exe
  2⤵
  PID:5224
- C:\Windows\System\KOSvHRF.exe
  C:\Windows\System\KOSvHRF.exe
  2⤵
  PID:5184
- C:\Windows\System\LQvaUzr.exe
  C:\Windows\System\LQvaUzr.exe
  2⤵
  PID:5268
- C:\Windows\System\AJzfxQO.exe
  C:\Windows\System\AJzfxQO.exe
  2⤵
  PID:5288
- C:\Windows\System\bZFJrcj.exe
  C:\Windows\System\bZFJrcj.exe
  2⤵
  PID:5308
- C:\Windows\System\eDEQKGI.exe
  C:\Windows\System\eDEQKGI.exe
  2⤵
  PID:5324
- C:\Windows\System\KegqjVj.exe
  C:\Windows\System\KegqjVj.exe
  2⤵
  PID:5344
- C:\Windows\System\zxGTTTx.exe
  C:\Windows\System\zxGTTTx.exe
  2⤵
  PID:5396
- C:\Windows\System\OpfHsex.exe
  C:\Windows\System\OpfHsex.exe
  2⤵
  PID:5436
- C:\Windows\System\EMYrxWY.exe
  C:\Windows\System\EMYrxWY.exe
  2⤵
  PID:5416
- C:\Windows\System\KLPmUzu.exe
  C:\Windows\System\KLPmUzu.exe
  2⤵
  PID:5464
- C:\Windows\System\DHvxdEZ.exe
  C:\Windows\System\DHvxdEZ.exe
  2⤵
  PID:5664
- C:\Windows\System\plfkTmx.exe
  C:\Windows\System\plfkTmx.exe
  2⤵
  PID:5480
- C:\Windows\System\HxSELIi.exe
  C:\Windows\System\HxSELIi.exe
  2⤵
  PID:5516
- C:\Windows\System\EPPuqbs.exe
  C:\Windows\System\EPPuqbs.exe
  2⤵
  PID:5584
- C:\Windows\System\mbqDQYl.exe
  C:\Windows\System\mbqDQYl.exe
  2⤵
  PID:5648
- C:\Windows\System\BVeRQSN.exe
  C:\Windows\System\BVeRQSN.exe
  2⤵
  PID:5720
- C:\Windows\System\iPjyrOY.exe
  C:\Windows\System\iPjyrOY.exe
  2⤵
  PID:5760
- C:\Windows\System\etZdHXq.exe
  C:\Windows\System\etZdHXq.exe
  2⤵
  PID:5772
- C:\Windows\System\roEiLGa.exe
  C:\Windows\System\roEiLGa.exe
  2⤵
  PID:5800
- C:\Windows\System\LXNEXBx.exe
  C:\Windows\System\LXNEXBx.exe
  2⤵
  PID:5812
- C:\Windows\System\XdGffYh.exe
  C:\Windows\System\XdGffYh.exe
  2⤵
  PID:5832
- C:\Windows\System\qHxcRJL.exe
  C:\Windows\System\qHxcRJL.exe
  2⤵
  PID:5928
- C:\Windows\System\RmDNadI.exe
  C:\Windows\System\RmDNadI.exe
  2⤵
  PID:5860
- C:\Windows\System\ImiYCKZ.exe
  C:\Windows\System\ImiYCKZ.exe
  2⤵
  PID:5916
- C:\Windows\System\pWEVcIZ.exe
  C:\Windows\System\pWEVcIZ.exe
  2⤵
  PID:5996
- C:\Windows\System\WisBfwi.exe
  C:\Windows\System\WisBfwi.exe
  2⤵
  PID:6016
- C:\Windows\System\jnlXRXH.exe
  C:\Windows\System\jnlXRXH.exe
  2⤵
  PID:5984
- C:\Windows\System\OyDGdYD.exe
  C:\Windows\System\OyDGdYD.exe
  2⤵
  PID:6088
- C:\Windows\System\JUzfnEc.exe
  C:\Windows\System\JUzfnEc.exe
  2⤵
  PID:6048
- C:\Windows\System\KVPBvhP.exe
  C:\Windows\System\KVPBvhP.exe
  2⤵
  PID:5284
- C:\Windows\System\UVYTQTg.exe
  C:\Windows\System\UVYTQTg.exe
  2⤵
  PID:5204
- C:\Windows\System\LaSUfnJ.exe
  C:\Windows\System\LaSUfnJ.exe
  2⤵
  PID:6028
- C:\Windows\System\xkpdzmq.exe
  C:\Windows\System\xkpdzmq.exe
  2⤵
  PID:5500
- C:\Windows\System\XKjutbE.exe
  C:\Windows\System\XKjutbE.exe
  2⤵
  PID:5604
- C:\Windows\System\tvlzHzl.exe
  C:\Windows\System\tvlzHzl.exe
  2⤵
  PID:5564
- C:\Windows\System\sTCgGoi.exe
  C:\Windows\System\sTCgGoi.exe
  2⤵
  PID:6132
- C:\Windows\System\qpaYlnR.exe
  C:\Windows\System\qpaYlnR.exe
  2⤵
  PID:4084
- C:\Windows\System\uFPJfNR.exe
  C:\Windows\System\uFPJfNR.exe
  2⤵
  PID:5264
- C:\Windows\System\blVKViE.exe
  C:\Windows\System\blVKViE.exe
  2⤵
  PID:5328
- C:\Windows\System\iWjRMjz.exe
  C:\Windows\System\iWjRMjz.exe
  2⤵
  PID:5380
- C:\Windows\System\mGSTUOi.exe
  C:\Windows\System\mGSTUOi.exe
  2⤵
  PID:5296
- C:\Windows\System\YmQKQaJ.exe
  C:\Windows\System\YmQKQaJ.exe
  2⤵
  PID:5636
- C:\Windows\System\dQtPqKL.exe
  C:\Windows\System\dQtPqKL.exe
  2⤵
  PID:5512
- C:\Windows\System\YUbJxak.exe
  C:\Windows\System\YUbJxak.exe
  2⤵
  PID:5740
- C:\Windows\System\rITIZIs.exe
  C:\Windows\System\rITIZIs.exe
  2⤵
  PID:5796
- C:\Windows\System\qdTbTWb.exe
  C:\Windows\System\qdTbTWb.exe
  2⤵
  PID:5864
- C:\Windows\System\pXiztNC.exe
  C:\Windows\System\pXiztNC.exe
  2⤵
  PID:6012
- C:\Windows\System\wHNoVml.exe
  C:\Windows\System\wHNoVml.exe
  2⤵
  PID:5496
- C:\Windows\System\MivqYxE.exe
  C:\Windows\System\MivqYxE.exe
  2⤵
  PID:5276
- C:\Windows\System\wjBEjAb.exe
  C:\Windows\System\wjBEjAb.exe
  2⤵
  PID:5252
- C:\Windows\System\YSKCeiY.exe
  C:\Windows\System\YSKCeiY.exe
  2⤵
  PID:5732
- C:\Windows\System\EGsTnrI.exe
  C:\Windows\System\EGsTnrI.exe
  2⤵
  PID:5304
- C:\Windows\System\xBoWwzh.exe
  C:\Windows\System\xBoWwzh.exe
  2⤵
  PID:5892
- C:\Windows\System\oKTvJmr.exe
  C:\Windows\System\oKTvJmr.exe
  2⤵
  PID:5580
- C:\Windows\System\XldAXnh.exe
  C:\Windows\System\XldAXnh.exe
  2⤵
  PID:5684
- C:\Windows\System\EShdWzl.exe
  C:\Windows\System\EShdWzl.exe
  2⤵
  PID:5848
- C:\Windows\System\woGKlCk.exe
  C:\Windows\System\woGKlCk.exe
  2⤵
  PID:5880
- C:\Windows\System\ftmSYQW.exe
  C:\Windows\System\ftmSYQW.exe
  2⤵
  PID:6068
- C:\Windows\System\BisTQYE.exe
  C:\Windows\System\BisTQYE.exe
  2⤵
  PID:5320
- C:\Windows\System\YrkZYdf.exe
  C:\Windows\System\YrkZYdf.exe
  2⤵
  PID:6100
- C:\Windows\System\DTwxgox.exe
  C:\Windows\System\DTwxgox.exe
  2⤵
  PID:5568
- C:\Windows\System\SFRHfme.exe
  C:\Windows\System\SFRHfme.exe
  2⤵
  PID:5248
- C:\Windows\System\vxqROjy.exe
  C:\Windows\System\vxqROjy.exe
  2⤵
  PID:5360
- C:\Windows\System\UgSDLmW.exe
  C:\Windows\System\UgSDLmW.exe
  2⤵
  PID:5716
- C:\Windows\System\WAXpxFX.exe
  C:\Windows\System\WAXpxFX.exe
  2⤵
  PID:5876
- C:\Windows\System\FQPbcYA.exe
  C:\Windows\System\FQPbcYA.exe
  2⤵
  PID:5536
- C:\Windows\System\bmZfhLX.exe
  C:\Windows\System\bmZfhLX.exe
  2⤵
  PID:6160
- C:\Windows\System\BKfMDWb.exe
  C:\Windows\System\BKfMDWb.exe
  2⤵
  PID:6176
- C:\Windows\System\BuLnMgc.exe
  C:\Windows\System\BuLnMgc.exe
  2⤵
  PID:6192
- C:\Windows\System\ukfHbqV.exe
  C:\Windows\System\ukfHbqV.exe
  2⤵
  PID:6208
- C:\Windows\System\goRPawN.exe
  C:\Windows\System\goRPawN.exe
  2⤵
  PID:6224
- C:\Windows\System\BpKGlMz.exe
  C:\Windows\System\BpKGlMz.exe
  2⤵
  PID:6240
- C:\Windows\System\xoBQmcU.exe
  C:\Windows\System\xoBQmcU.exe
  2⤵
  PID:6256
- C:\Windows\System\QxrhJqG.exe
  C:\Windows\System\QxrhJqG.exe
  2⤵
  PID:6272
- C:\Windows\System\IftRUmB.exe
  C:\Windows\System\IftRUmB.exe
  2⤵
  PID:6288
- C:\Windows\System\EqjnltF.exe
  C:\Windows\System\EqjnltF.exe
  2⤵
  PID:6312
- C:\Windows\System\dyLQQoj.exe
  C:\Windows\System\dyLQQoj.exe
  2⤵
  PID:6328
- C:\Windows\System\fNLVeFX.exe
  C:\Windows\System\fNLVeFX.exe
  2⤵
  PID:6344
- C:\Windows\System\OPXyLyz.exe
  C:\Windows\System\OPXyLyz.exe
  2⤵
  PID:6360
- C:\Windows\System\jpjfqJc.exe
  C:\Windows\System\jpjfqJc.exe
  2⤵
  PID:6376
- C:\Windows\System\XGGVhbS.exe
  C:\Windows\System\XGGVhbS.exe
  2⤵
  PID:6392
- C:\Windows\System\zREyEVs.exe
  C:\Windows\System\zREyEVs.exe
  2⤵
  PID:6408
- C:\Windows\System\lHQrnFU.exe
  C:\Windows\System\lHQrnFU.exe
  2⤵
  PID:6424
- C:\Windows\System\OhNQKBQ.exe
  C:\Windows\System\OhNQKBQ.exe
  2⤵
  PID:6440
- C:\Windows\System\McCcJtN.exe
  C:\Windows\System\McCcJtN.exe
  2⤵
  PID:6456
- C:\Windows\System\tjTPuin.exe
  C:\Windows\System\tjTPuin.exe
  2⤵
  PID:6472
- C:\Windows\System\XhvjBHQ.exe
  C:\Windows\System\XhvjBHQ.exe
  2⤵
  PID:6488
- C:\Windows\System\QKKvehJ.exe
  C:\Windows\System\QKKvehJ.exe
  2⤵
  PID:6504
- C:\Windows\System\miAyXyI.exe
  C:\Windows\System\miAyXyI.exe
  2⤵
  PID:6520
- C:\Windows\System\NWJiwWi.exe
  C:\Windows\System\NWJiwWi.exe
  2⤵
  PID:6536
- C:\Windows\System\vaWCpNx.exe
  C:\Windows\System\vaWCpNx.exe
  2⤵
  PID:6552
- C:\Windows\System\yjsMsKb.exe
  C:\Windows\System\yjsMsKb.exe
  2⤵
  PID:6568
- C:\Windows\System\wApMzrE.exe
  C:\Windows\System\wApMzrE.exe
  2⤵
  PID:6584
- C:\Windows\System\zNVhHNm.exe
  C:\Windows\System\zNVhHNm.exe
  2⤵
  PID:6600
- C:\Windows\System\ixsifqT.exe
  C:\Windows\System\ixsifqT.exe
  2⤵
  PID:6616
- C:\Windows\System\rbZGtnf.exe
  C:\Windows\System\rbZGtnf.exe
  2⤵
  PID:6632
- C:\Windows\System\xmjGzOx.exe
  C:\Windows\System\xmjGzOx.exe
  2⤵
  PID:6648
- C:\Windows\System\HgfhWXC.exe
  C:\Windows\System\HgfhWXC.exe
  2⤵
  PID:6664
- C:\Windows\System\GuqPyZK.exe
  C:\Windows\System\GuqPyZK.exe
  2⤵
  PID:6680
- C:\Windows\System\RWcwjBm.exe
  C:\Windows\System\RWcwjBm.exe
  2⤵
  PID:6696
- C:\Windows\System\jJDtUSX.exe
  C:\Windows\System\jJDtUSX.exe
  2⤵
  PID:6712
- C:\Windows\System\mzqoQAh.exe
  C:\Windows\System\mzqoQAh.exe
  2⤵
  PID:6728
- C:\Windows\System\xVZBqVC.exe
  C:\Windows\System\xVZBqVC.exe
  2⤵
  PID:6744
- C:\Windows\System\jPJpskk.exe
  C:\Windows\System\jPJpskk.exe
  2⤵
  PID:6760
- C:\Windows\System\pHNJrTC.exe
  C:\Windows\System\pHNJrTC.exe
  2⤵
  PID:6776
- C:\Windows\System\CIZjXfz.exe
  C:\Windows\System\CIZjXfz.exe
  2⤵
  PID:6792
- C:\Windows\System\aPTCGdp.exe
  C:\Windows\System\aPTCGdp.exe
  2⤵
  PID:6808
- C:\Windows\System\AugLlyO.exe
  C:\Windows\System\AugLlyO.exe
  2⤵
  PID:6824
- C:\Windows\System\EUgWyMq.exe
  C:\Windows\System\EUgWyMq.exe
  2⤵
  PID:6840
- C:\Windows\System\jMtZOnh.exe
  C:\Windows\System\jMtZOnh.exe
  2⤵
  PID:6856
- C:\Windows\System\oyywkTs.exe
  C:\Windows\System\oyywkTs.exe
  2⤵
  PID:6872
- C:\Windows\System\fYWkpKR.exe
  C:\Windows\System\fYWkpKR.exe
  2⤵
  PID:6888
- C:\Windows\System\RdeOPjT.exe
  C:\Windows\System\RdeOPjT.exe
  2⤵
  PID:6904
- C:\Windows\System\LysSRBR.exe
  C:\Windows\System\LysSRBR.exe
  2⤵
  PID:6920
- C:\Windows\System\YzVbVva.exe
  C:\Windows\System\YzVbVva.exe
  2⤵
  PID:6940
- C:\Windows\System\NInEKDY.exe
  C:\Windows\System\NInEKDY.exe
  2⤵
  PID:6956
- C:\Windows\System\QFSzMOc.exe
  C:\Windows\System\QFSzMOc.exe
  2⤵
  PID:6972
- C:\Windows\System\LOOhnEM.exe
  C:\Windows\System\LOOhnEM.exe
  2⤵
  PID:6988
- C:\Windows\System\SFfSUrc.exe
  C:\Windows\System\SFfSUrc.exe
  2⤵
  PID:7004
- C:\Windows\System\ZHLQRIF.exe
  C:\Windows\System\ZHLQRIF.exe
  2⤵
  PID:7020
- C:\Windows\System\nKJHjKq.exe
  C:\Windows\System\nKJHjKq.exe
  2⤵
  PID:7036
- C:\Windows\System\rGlrTwh.exe
  C:\Windows\System\rGlrTwh.exe
  2⤵
  PID:7052
- C:\Windows\System\CtVkhrA.exe
  C:\Windows\System\CtVkhrA.exe
  2⤵
  PID:7068
- C:\Windows\System\SALKwll.exe
  C:\Windows\System\SALKwll.exe
  2⤵
  PID:7084
- C:\Windows\System\sqRoQLu.exe
  C:\Windows\System\sqRoQLu.exe
  2⤵
  PID:7100
- C:\Windows\System\BiWDPFh.exe
  C:\Windows\System\BiWDPFh.exe
  2⤵
  PID:7116
- C:\Windows\System\coqRyyG.exe
  C:\Windows\System\coqRyyG.exe
  2⤵
  PID:7132
- C:\Windows\System\IRZzuTB.exe
  C:\Windows\System\IRZzuTB.exe
  2⤵
  PID:7148
- C:\Windows\System\OWGwhqE.exe
  C:\Windows\System\OWGwhqE.exe
  2⤵
  PID:7164
- C:\Windows\System\taaTxwS.exe
  C:\Windows\System\taaTxwS.exe
  2⤵
  PID:5828
- C:\Windows\System\XLQgaFf.exe
  C:\Windows\System\XLQgaFf.exe
  2⤵
  PID:6216
- C:\Windows\System\FkgdsKw.exe
  C:\Windows\System\FkgdsKw.exe
  2⤵
  PID:6252
- C:\Windows\System\fftrGlo.exe
  C:\Windows\System\fftrGlo.exe
  2⤵
  PID:5280
- C:\Windows\System\ydzVBmv.exe
  C:\Windows\System\ydzVBmv.exe
  2⤵
  PID:5912
- C:\Windows\System\LdeUltX.exe
  C:\Windows\System\LdeUltX.exe
  2⤵
  PID:6116
- C:\Windows\System\UFKyJEz.exe
  C:\Windows\System\UFKyJEz.exe
  2⤵
  PID:5412
- C:\Windows\System\CEySkrz.exe
  C:\Windows\System\CEySkrz.exe
  2⤵
  PID:5632
- C:\Windows\System\PLqpSsm.exe
  C:\Windows\System\PLqpSsm.exe
  2⤵
  PID:6172
- C:\Windows\System\lKMbVzt.exe
  C:\Windows\System\lKMbVzt.exe
  2⤵
  PID:6236
- C:\Windows\System\RdVhwLn.exe
  C:\Windows\System\RdVhwLn.exe
  2⤵
  PID:6336
- C:\Windows\System\RNXulrh.exe
  C:\Windows\System\RNXulrh.exe
  2⤵
  PID:6384
- C:\Windows\System\mSrskAQ.exe
  C:\Windows\System\mSrskAQ.exe
  2⤵
  PID:6420
- C:\Windows\System\fADIKAm.exe
  C:\Windows\System\fADIKAm.exe
  2⤵
  PID:6484
- C:\Windows\System\XqeNuiB.exe
  C:\Windows\System\XqeNuiB.exe
  2⤵
  PID:6548
- C:\Windows\System\cRqjYKf.exe
  C:\Windows\System\cRqjYKf.exe
  2⤵
  PID:6576
- C:\Windows\System\tzqJZeb.exe
  C:\Windows\System\tzqJZeb.exe
  2⤵
  PID:6640
- C:\Windows\System\WtBOlAp.exe
  C:\Windows\System\WtBOlAp.exe
  2⤵
  PID:6704
- C:\Windows\System\uGvbmxo.exe
  C:\Windows\System\uGvbmxo.exe
  2⤵
  PID:6768
- C:\Windows\System\okqjHua.exe
  C:\Windows\System\okqjHua.exe
  2⤵
  PID:6532
- C:\Windows\System\oTGzydu.exe
  C:\Windows\System\oTGzydu.exe
  2⤵
  PID:6400
- C:\Windows\System\cliAUoO.exe
  C:\Windows\System\cliAUoO.exe
  2⤵
  PID:6692
- C:\Windows\System\LKyaghk.exe
  C:\Windows\System\LKyaghk.exe
  2⤵
  PID:6788
- C:\Windows\System\TdCnwWm.exe
  C:\Windows\System\TdCnwWm.exe
  2⤵
  PID:6052
- C:\Windows\System\mVehRBP.exe
  C:\Windows\System\mVehRBP.exe
  2⤵
  PID:6596
- C:\Windows\System\kAJmjpi.exe
  C:\Windows\System\kAJmjpi.exe
  2⤵
  PID:6864
- C:\Windows\System\kaZgiJl.exe
  C:\Windows\System\kaZgiJl.exe
  2⤵
  PID:6900
- C:\Windows\System\wdykLde.exe
  C:\Windows\System\wdykLde.exe
  2⤵
  PID:6928
- C:\Windows\System\MDwlCns.exe
  C:\Windows\System\MDwlCns.exe
  2⤵
  PID:6916
- C:\Windows\System\GbvUXIT.exe
  C:\Windows\System\GbvUXIT.exe
  2⤵
  PID:6884
- C:\Windows\System\LVMFQNV.exe
  C:\Windows\System\LVMFQNV.exe
  2⤵
  PID:7000
- C:\Windows\System\uwyHgEn.exe
  C:\Windows\System\uwyHgEn.exe
  2⤵
  PID:7064
- C:\Windows\System\vQGqmIw.exe
  C:\Windows\System\vQGqmIw.exe
  2⤵
  PID:6984
- C:\Windows\System\gQUxveJ.exe
  C:\Windows\System\gQUxveJ.exe
  2⤵
  PID:7128
- C:\Windows\System\EbpqLuT.exe
  C:\Windows\System\EbpqLuT.exe
  2⤵
  PID:7044
- C:\Windows\System\iuqRMNL.exe
  C:\Windows\System\iuqRMNL.exe
  2⤵
  PID:7080
- C:\Windows\System\iwDgcYo.exe
  C:\Windows\System\iwDgcYo.exe
  2⤵
  PID:7144
- C:\Windows\System\lbYKDcy.exe
  C:\Windows\System\lbYKDcy.exe
  2⤵
  PID:6156
- C:\Windows\System\BRIZzTk.exe
  C:\Windows\System\BRIZzTk.exe
  2⤵
  PID:6268
- C:\Windows\System\MFJXRJc.exe
  C:\Windows\System\MFJXRJc.exe
  2⤵
  PID:6232
- C:\Windows\System\PDCXKnn.exe
  C:\Windows\System\PDCXKnn.exe
  2⤵
  PID:6188
- C:\Windows\System\bqrxwXZ.exe
  C:\Windows\System\bqrxwXZ.exe
  2⤵
  PID:6324
- C:\Windows\System\OaUceea.exe
  C:\Windows\System\OaUceea.exe
  2⤵
  PID:6480
- C:\Windows\System\nJrprPR.exe
  C:\Windows\System\nJrprPR.exe
  2⤵
  PID:6388
- C:\Windows\System\wOpVDRm.exe
  C:\Windows\System\wOpVDRm.exe
  2⤵
  PID:6612
- C:\Windows\System\wCqHvtk.exe
  C:\Windows\System\wCqHvtk.exe
  2⤵
  PID:6676
- C:\Windows\System\iQlRevk.exe
  C:\Windows\System\iQlRevk.exe
  2⤵
  PID:6688
- C:\Windows\System\jYeUMKh.exe
  C:\Windows\System\jYeUMKh.exe
  2⤵
  PID:6836
- C:\Windows\System\lXdvabh.exe
  C:\Windows\System\lXdvabh.exe
  2⤵
  PID:6896
- C:\Windows\System\DXtWGZy.exe
  C:\Windows\System\DXtWGZy.exe
  2⤵
  PID:6468
- C:\Windows\System\knZsFWY.exe
  C:\Windows\System\knZsFWY.exe
  2⤵
  PID:6724
- C:\Windows\System\kirOEZw.exe
  C:\Windows\System\kirOEZw.exe
  2⤵
  PID:7032
- C:\Windows\System\qaNnUgt.exe
  C:\Windows\System\qaNnUgt.exe
  2⤵
  PID:6880
- C:\Windows\System\IqcpGiU.exe
  C:\Windows\System\IqcpGiU.exe
  2⤵
  PID:7076
- C:\Windows\System\qdDQinv.exe
  C:\Windows\System\qdDQinv.exe
  2⤵
  PID:6104
- C:\Windows\System\ygaJzZb.exe
  C:\Windows\System\ygaJzZb.exe
  2⤵
  PID:6516
- C:\Windows\System\hNwpaUt.exe
  C:\Windows\System\hNwpaUt.exe
  2⤵
  PID:5188
- C:\Windows\System\urwOAgO.exe
  C:\Windows\System\urwOAgO.exe
  2⤵
  PID:6608
- C:\Windows\System\xrBuFJl.exe
  C:\Windows\System\xrBuFJl.exe
  2⤵
  PID:6980
- C:\Windows\System\nSulkZM.exe
  C:\Windows\System\nSulkZM.exe
  2⤵
  PID:6500
- C:\Windows\System\oOffhGH.exe
  C:\Windows\System\oOffhGH.exe
  2⤵
  PID:6452
- C:\Windows\System\LwEAedv.exe
  C:\Windows\System\LwEAedv.exe
  2⤵
  PID:6816
- C:\Windows\System\MSlYzGE.exe
  C:\Windows\System\MSlYzGE.exe
  2⤵
  PID:6932
- C:\Windows\System\zXNvEFA.exe
  C:\Windows\System\zXNvEFA.exe
  2⤵
  PID:5964
- C:\Windows\System\vRtthZd.exe
  C:\Windows\System\vRtthZd.exe
  2⤵
  PID:5792
- C:\Windows\System\qTsCaEX.exe
  C:\Windows\System\qTsCaEX.exe
  2⤵
  PID:6832
- C:\Windows\System\HLFEgPt.exe
  C:\Windows\System\HLFEgPt.exe
  2⤵
  PID:6404
- C:\Windows\System\HGmvsmy.exe
  C:\Windows\System\HGmvsmy.exe
  2⤵
  PID:6436
- C:\Windows\System\qyEzNXb.exe
  C:\Windows\System\qyEzNXb.exe
  2⤵
  PID:7172
- C:\Windows\System\AYHtcGt.exe
  C:\Windows\System\AYHtcGt.exe
  2⤵
  PID:7188
- C:\Windows\System\IQEnqtz.exe
  C:\Windows\System\IQEnqtz.exe
  2⤵
  PID:7204
- C:\Windows\System\zHhRFYR.exe
  C:\Windows\System\zHhRFYR.exe
  2⤵
  PID:7220
- C:\Windows\System\poYJzqQ.exe
  C:\Windows\System\poYJzqQ.exe
  2⤵
  PID:7236
- C:\Windows\System\vpchbNH.exe
  C:\Windows\System\vpchbNH.exe
  2⤵
  PID:7252
- C:\Windows\System\kavBONZ.exe
  C:\Windows\System\kavBONZ.exe
  2⤵
  PID:7268
- C:\Windows\System\LpGPKCd.exe
  C:\Windows\System\LpGPKCd.exe
  2⤵
  PID:7284
- C:\Windows\System\ZStQwxt.exe
  C:\Windows\System\ZStQwxt.exe
  2⤵
  PID:7300
- C:\Windows\System\jTXhxeq.exe
  C:\Windows\System\jTXhxeq.exe
  2⤵
  PID:7316
- C:\Windows\System\yaRAogS.exe
  C:\Windows\System\yaRAogS.exe
  2⤵
  PID:7332
- C:\Windows\System\JTvPnqz.exe
  C:\Windows\System\JTvPnqz.exe
  2⤵
  PID:7348
- C:\Windows\System\KnnrvvA.exe
  C:\Windows\System\KnnrvvA.exe
  2⤵
  PID:7364
- C:\Windows\System\rrMYRid.exe
  C:\Windows\System\rrMYRid.exe
  2⤵
  PID:7380
- C:\Windows\System\MAwoBop.exe
  C:\Windows\System\MAwoBop.exe
  2⤵
  PID:7396
- C:\Windows\System\xChthfk.exe
  C:\Windows\System\xChthfk.exe
  2⤵
  PID:7412
- C:\Windows\System\LPTcnBA.exe
  C:\Windows\System\LPTcnBA.exe
  2⤵
  PID:7428
- C:\Windows\System\jvFnUcY.exe
  C:\Windows\System\jvFnUcY.exe
  2⤵
  PID:7444
- C:\Windows\System\CVYOsPu.exe
  C:\Windows\System\CVYOsPu.exe
  2⤵
  PID:7460
- C:\Windows\System\sVZNPfj.exe
  C:\Windows\System\sVZNPfj.exe
  2⤵
  PID:7476
- C:\Windows\System\BJafryl.exe
  C:\Windows\System\BJafryl.exe
  2⤵
  PID:7492
- C:\Windows\System\YNQmgzO.exe
  C:\Windows\System\YNQmgzO.exe
  2⤵
  PID:7508
- C:\Windows\System\daATFuP.exe
  C:\Windows\System\daATFuP.exe
  2⤵
  PID:7524
- C:\Windows\System\XcinDXw.exe
  C:\Windows\System\XcinDXw.exe
  2⤵
  PID:7540
- C:\Windows\System\dOICrmp.exe
  C:\Windows\System\dOICrmp.exe
  2⤵
  PID:7556
- C:\Windows\System\wPRonXF.exe
  C:\Windows\System\wPRonXF.exe
  2⤵
  PID:7572
- C:\Windows\System\vBZEuRZ.exe
  C:\Windows\System\vBZEuRZ.exe
  2⤵
  PID:7588
- C:\Windows\System\mZTcEYN.exe
  C:\Windows\System\mZTcEYN.exe
  2⤵
  PID:7604
- C:\Windows\System\ECQRCHg.exe
  C:\Windows\System\ECQRCHg.exe
  2⤵
  PID:7620
- C:\Windows\System\RKHjdco.exe
  C:\Windows\System\RKHjdco.exe
  2⤵
  PID:7636
- C:\Windows\System\RxJTjmW.exe
  C:\Windows\System\RxJTjmW.exe
  2⤵
  PID:7652
- C:\Windows\System\bexsEMv.exe
  C:\Windows\System\bexsEMv.exe
  2⤵
  PID:7668
- C:\Windows\System\msNxVKl.exe
  C:\Windows\System\msNxVKl.exe
  2⤵
  PID:7684
- C:\Windows\System\kzOmcrH.exe
  C:\Windows\System\kzOmcrH.exe
  2⤵
  PID:7700
- C:\Windows\System\eiwWfXf.exe
  C:\Windows\System\eiwWfXf.exe
  2⤵
  PID:7716
- C:\Windows\System\zSyyQQe.exe
  C:\Windows\System\zSyyQQe.exe
  2⤵
  PID:7732
- C:\Windows\System\WZJmtan.exe
  C:\Windows\System\WZJmtan.exe
  2⤵
  PID:7748
- C:\Windows\System\gdsVgiV.exe
  C:\Windows\System\gdsVgiV.exe
  2⤵
  PID:7764
- C:\Windows\System\SgTMqCn.exe
  C:\Windows\System\SgTMqCn.exe
  2⤵
  PID:7780
- C:\Windows\System\IBawgCt.exe
  C:\Windows\System\IBawgCt.exe
  2⤵
  PID:7796
- C:\Windows\System\RVVpCRS.exe
  C:\Windows\System\RVVpCRS.exe
  2⤵
  PID:7812
- C:\Windows\System\noBBqiE.exe
  C:\Windows\System\noBBqiE.exe
  2⤵
  PID:7828
- C:\Windows\System\lMhSpGi.exe
  C:\Windows\System\lMhSpGi.exe
  2⤵
  PID:7844
- C:\Windows\System\MOMFrDn.exe
  C:\Windows\System\MOMFrDn.exe
  2⤵
  PID:7860
- C:\Windows\System\ltKecrO.exe
  C:\Windows\System\ltKecrO.exe
  2⤵
  PID:7876
- C:\Windows\System\DHKBGSe.exe
  C:\Windows\System\DHKBGSe.exe
  2⤵
  PID:7892
- C:\Windows\System\GIaLdGG.exe
  C:\Windows\System\GIaLdGG.exe
  2⤵
  PID:7912
- C:\Windows\System\TBnrYoI.exe
  C:\Windows\System\TBnrYoI.exe
  2⤵
  PID:7928
- C:\Windows\System\GWuCvtM.exe
  C:\Windows\System\GWuCvtM.exe
  2⤵
  PID:7944
- C:\Windows\System\UtIMDsN.exe
  C:\Windows\System\UtIMDsN.exe
  2⤵
  PID:7960
- C:\Windows\System\EiPwJwp.exe
  C:\Windows\System\EiPwJwp.exe
  2⤵
  PID:7976
- C:\Windows\System\lhTrRNE.exe
  C:\Windows\System\lhTrRNE.exe
  2⤵
  PID:7992
- C:\Windows\System\GaxDWMK.exe
  C:\Windows\System\GaxDWMK.exe
  2⤵
  PID:8024
- C:\Windows\System\KsQIqiU.exe
  C:\Windows\System\KsQIqiU.exe
  2⤵
  PID:8040
- C:\Windows\System\PUSsWUL.exe
  C:\Windows\System\PUSsWUL.exe
  2⤵
  PID:8056
- C:\Windows\System\VLNRkLD.exe
  C:\Windows\System\VLNRkLD.exe
  2⤵
  PID:8076
- C:\Windows\System\HmiZscX.exe
  C:\Windows\System\HmiZscX.exe
  2⤵
  PID:8092
- C:\Windows\System\BGGhKLR.exe
  C:\Windows\System\BGGhKLR.exe
  2⤵
  PID:8108
- C:\Windows\System\UfLVuem.exe
  C:\Windows\System\UfLVuem.exe
  2⤵
  PID:8124
- C:\Windows\System\nxSTVRf.exe
  C:\Windows\System\nxSTVRf.exe
  2⤵
  PID:8140
- C:\Windows\System\AxKuiwJ.exe
  C:\Windows\System\AxKuiwJ.exe
  2⤵
  PID:8156
- C:\Windows\System\eWWMopd.exe
  C:\Windows\System\eWWMopd.exe
  2⤵
  PID:8172
- C:\Windows\System\DtZDoDU.exe
  C:\Windows\System\DtZDoDU.exe
  2⤵
  PID:8188
- C:\Windows\System\Vuyxaqh.exe
  C:\Windows\System\Vuyxaqh.exe
  2⤵
  PID:6152
- C:\Windows\System\KrayXNn.exe
  C:\Windows\System\KrayXNn.exe
  2⤵
  PID:6464
- C:\Windows\System\IILIwyE.exe
  C:\Windows\System\IILIwyE.exe
  2⤵
  PID:7216
- C:\Windows\System\DjTkWIB.exe
  C:\Windows\System\DjTkWIB.exe
  2⤵
  PID:5968
- C:\Windows\System\kuMwfyf.exe
  C:\Windows\System\kuMwfyf.exe
  2⤵
  PID:7248
- C:\Windows\System\pqdXgow.exe
  C:\Windows\System\pqdXgow.exe
  2⤵
  PID:7312
- C:\Windows\System\sDFvoZU.exe
  C:\Windows\System\sDFvoZU.exe
  2⤵
  PID:7292
- C:\Windows\System\lQQcxWE.exe
  C:\Windows\System\lQQcxWE.exe
  2⤵
  PID:7328
- C:\Windows\System\TroDnVh.exe
  C:\Windows\System\TroDnVh.exe
  2⤵
  PID:7372
- C:\Windows\System\caoUmkA.exe
  C:\Windows\System\caoUmkA.exe
  2⤵
  PID:7436
- C:\Windows\System\tYtkcLX.exe
  C:\Windows\System\tYtkcLX.exe
  2⤵
  PID:7500
- C:\Windows\System\dBqMRAK.exe
  C:\Windows\System\dBqMRAK.exe
  2⤵
  PID:7568
- C:\Windows\System\npZDHYC.exe
  C:\Windows\System\npZDHYC.exe
  2⤵
  PID:7612
- C:\Windows\System\xErAEUV.exe
  C:\Windows\System\xErAEUV.exe
  2⤵
  PID:7520
- C:\Windows\System\xZskcNo.exe
  C:\Windows\System\xZskcNo.exe
  2⤵
  PID:7456
- C:\Windows\System\lPJkpDP.exe
  C:\Windows\System\lPJkpDP.exe
  2⤵
  PID:7392
- C:\Windows\System\hmTuTLQ.exe
  C:\Windows\System\hmTuTLQ.exe
  2⤵
  PID:7648
- C:\Windows\System\eOYNTjO.exe
  C:\Windows\System\eOYNTjO.exe
  2⤵
  PID:7696
- C:\Windows\System\krGMrFM.exe
  C:\Windows\System\krGMrFM.exe
  2⤵
  PID:7660
- C:\Windows\System\OgzKqKs.exe
  C:\Windows\System\OgzKqKs.exe
  2⤵
  PID:7760
- C:\Windows\System\pPRvQSP.exe
  C:\Windows\System\pPRvQSP.exe
  2⤵
  PID:7792
- C:\Windows\System\imNQYMx.exe
  C:\Windows\System\imNQYMx.exe
  2⤵
  PID:7888
- C:\Windows\System\Anhimet.exe
  C:\Windows\System\Anhimet.exe
  2⤵
  PID:7924
- C:\Windows\System\jXjRAvP.exe
  C:\Windows\System\jXjRAvP.exe
  2⤵
  PID:7740
- C:\Windows\System\vchsToU.exe
  C:\Windows\System\vchsToU.exe
  2⤵
  PID:7712
- C:\Windows\System\eYZvVHS.exe
  C:\Windows\System\eYZvVHS.exe
  2⤵
  PID:7972
- C:\Windows\System\lwbLvBT.exe
  C:\Windows\System\lwbLvBT.exe
  2⤵
  PID:7872
- C:\Windows\System\EyPIiqd.exe
  C:\Windows\System\EyPIiqd.exe
  2⤵
  PID:7808
- C:\Windows\System\WuEbiBa.exe
  C:\Windows\System\WuEbiBa.exe
  2⤵
  PID:8032
- C:\Windows\System\rCVQHLJ.exe
  C:\Windows\System\rCVQHLJ.exe
  2⤵
  PID:8012
- C:\Windows\System\HzzRWrO.exe
  C:\Windows\System\HzzRWrO.exe
  2⤵
  PID:8052
- C:\Windows\System\sdAfUqR.exe
  C:\Windows\System\sdAfUqR.exe
  2⤵
  PID:8100
- C:\Windows\System\qrmiAiR.exe
  C:\Windows\System\qrmiAiR.exe
  2⤵
  PID:8136
- C:\Windows\System\vlPSwtP.exe
  C:\Windows\System\vlPSwtP.exe
  2⤵
  PID:8152
- C:\Windows\System\YwIkOpB.exe
  C:\Windows\System\YwIkOpB.exe
  2⤵
  PID:6912
- C:\Windows\System\QDloWEV.exe
  C:\Windows\System\QDloWEV.exe
  2⤵
  PID:7180
- C:\Windows\System\PDsmeqL.exe
  C:\Windows\System\PDsmeqL.exe
  2⤵
  PID:6952
- C:\Windows\System\WMcDVat.exe
  C:\Windows\System\WMcDVat.exe
  2⤵
  PID:7280
- C:\Windows\System\yjNKOCM.exe
  C:\Windows\System\yjNKOCM.exe
  2⤵
  PID:7324
- C:\Windows\System\UfmmrVJ.exe
  C:\Windows\System\UfmmrVJ.exe
  2⤵
  PID:7472
- C:\Windows\System\PKUpGIS.exe
  C:\Windows\System\PKUpGIS.exe
  2⤵
  PID:7404
- C:\Windows\System\aLTCAKJ.exe
  C:\Windows\System\aLTCAKJ.exe
  2⤵
  PID:7360
- C:\Windows\System\QMjFinO.exe
  C:\Windows\System\QMjFinO.exe
  2⤵
  PID:7548
- C:\Windows\System\BjzszHo.exe
  C:\Windows\System\BjzszHo.exe
  2⤵
  PID:7644
- C:\Windows\System\yQjgFGT.exe
  C:\Windows\System\yQjgFGT.exe
  2⤵
  PID:7856
- C:\Windows\System\WNmAZoE.exe
  C:\Windows\System\WNmAZoE.exe
  2⤵
  PID:7904
- C:\Windows\System\SepJzcY.exe
  C:\Windows\System\SepJzcY.exe
  2⤵
  PID:7776
- C:\Windows\System\OOKwUhB.exe
  C:\Windows\System\OOKwUhB.exe
  2⤵
  PID:7728
- C:\Windows\System\vRzbgGG.exe
  C:\Windows\System\vRzbgGG.exe
  2⤵
  PID:8164
- C:\Windows\System\hlwZYkP.exe
  C:\Windows\System\hlwZYkP.exe
  2⤵
  PID:7692
- C:\Windows\System\CRvxYur.exe
  C:\Windows\System\CRvxYur.exe
  2⤵
  PID:8088
- C:\Windows\System\JfhFGGm.exe
  C:\Windows\System\JfhFGGm.exe
  2⤵
  PID:8048
- C:\Windows\System\wpKqVGT.exe
  C:\Windows\System\wpKqVGT.exe
  2⤵
  PID:8184
- C:\Windows\System\oQpzVTk.exe
  C:\Windows\System\oQpzVTk.exe
  2⤵
  PID:7184
- C:\Windows\System\PVeTFyt.exe
  C:\Windows\System\PVeTFyt.exe
  2⤵
  PID:7836
- C:\Windows\System\GPfhmbV.exe
  C:\Windows\System\GPfhmbV.exe
  2⤵
  PID:7564
- C:\Windows\System\xHsMMcv.exe
  C:\Windows\System\xHsMMcv.exe
  2⤵
  PID:7664
- C:\Windows\System\ieGeugv.exe
  C:\Windows\System\ieGeugv.exe
  2⤵
  PID:7920
- C:\Windows\System\UejBjpM.exe
  C:\Windows\System\UejBjpM.exe
  2⤵
  PID:7600
- C:\Windows\System\BbhwzQs.exe
  C:\Windows\System\BbhwzQs.exe
  2⤵
  PID:7852
- C:\Windows\System\QiUwLHp.exe
  C:\Windows\System\QiUwLHp.exe
  2⤵
  PID:8068
- C:\Windows\System\qYTufAf.exe
  C:\Windows\System\qYTufAf.exe
  2⤵
  PID:7200
- C:\Windows\System\ZyEjEri.exe
  C:\Windows\System\ZyEjEri.exe
  2⤵
  PID:7724
- C:\Windows\System\RTHwNXF.exe
  C:\Windows\System\RTHwNXF.exe
  2⤵
  PID:7884
- C:\Windows\System\ScBGkzq.exe
  C:\Windows\System\ScBGkzq.exe
  2⤵
  PID:8200
- C:\Windows\System\DjdakWp.exe
  C:\Windows\System\DjdakWp.exe
  2⤵
  PID:8216
- C:\Windows\System\deCCDqR.exe
  C:\Windows\System\deCCDqR.exe
  2⤵
  PID:8232
- C:\Windows\System\LizeTML.exe
  C:\Windows\System\LizeTML.exe
  2⤵
  PID:8248
- C:\Windows\System\mktUMKX.exe
  C:\Windows\System\mktUMKX.exe
  2⤵
  PID:8264
- C:\Windows\System\XadIuBY.exe
  C:\Windows\System\XadIuBY.exe
  2⤵
  PID:8280
- C:\Windows\System\VZsiXCp.exe
  C:\Windows\System\VZsiXCp.exe
  2⤵
  PID:8296
- C:\Windows\System\YEYusDp.exe
  C:\Windows\System\YEYusDp.exe
  2⤵
  PID:8312
- C:\Windows\System\ZnWtwPb.exe
  C:\Windows\System\ZnWtwPb.exe
  2⤵
  PID:8328
- C:\Windows\System\HSFpXAP.exe
  C:\Windows\System\HSFpXAP.exe
  2⤵
  PID:8344
- C:\Windows\System\puzxbsR.exe
  C:\Windows\System\puzxbsR.exe
  2⤵
  PID:8360
- C:\Windows\System\MJsIkKR.exe
  C:\Windows\System\MJsIkKR.exe
  2⤵
  PID:8380
- C:\Windows\System\MLQIhcI.exe
  C:\Windows\System\MLQIhcI.exe
  2⤵
  PID:8396
- C:\Windows\System\eizTeEg.exe
  C:\Windows\System\eizTeEg.exe
  2⤵
  PID:8412
- C:\Windows\System\XOlEEuy.exe
  C:\Windows\System\XOlEEuy.exe
  2⤵
  PID:8428
- C:\Windows\System\oBwDYaL.exe
  C:\Windows\System\oBwDYaL.exe
  2⤵
  PID:8444
- C:\Windows\System\DnAWVjU.exe
  C:\Windows\System\DnAWVjU.exe
  2⤵
  PID:8460
- C:\Windows\System\OBPzlne.exe
  C:\Windows\System\OBPzlne.exe
  2⤵
  PID:8476
- C:\Windows\System\LIDpTNs.exe
  C:\Windows\System\LIDpTNs.exe
  2⤵
  PID:8492
- C:\Windows\System\qSnXGPA.exe
  C:\Windows\System\qSnXGPA.exe
  2⤵
  PID:8508
- C:\Windows\System\WuqCvmy.exe
  C:\Windows\System\WuqCvmy.exe
  2⤵
  PID:8524
- C:\Windows\System\yJHXqdN.exe
  C:\Windows\System\yJHXqdN.exe
  2⤵
  PID:8540
- C:\Windows\System\hcTUTzf.exe
  C:\Windows\System\hcTUTzf.exe
  2⤵
  PID:8556
- C:\Windows\System\EORFKIs.exe
  C:\Windows\System\EORFKIs.exe
  2⤵
  PID:8572
- C:\Windows\System\SmrgUeh.exe
  C:\Windows\System\SmrgUeh.exe
  2⤵
  PID:8588
- C:\Windows\System\nOEKmaR.exe
  C:\Windows\System\nOEKmaR.exe
  2⤵
  PID:8604
- C:\Windows\System\PKzcMiD.exe
  C:\Windows\System\PKzcMiD.exe
  2⤵
  PID:8620
- C:\Windows\System\QiywhxH.exe
  C:\Windows\System\QiywhxH.exe
  2⤵
  PID:8636
- C:\Windows\System\nLXqGwG.exe
  C:\Windows\System\nLXqGwG.exe
  2⤵
  PID:8652
- C:\Windows\System\FjtVwiP.exe
  C:\Windows\System\FjtVwiP.exe
  2⤵
  PID:8668
- C:\Windows\System\lhQsqkP.exe
  C:\Windows\System\lhQsqkP.exe
  2⤵
  PID:8684
- C:\Windows\System\hTfNAKu.exe
  C:\Windows\System\hTfNAKu.exe
  2⤵
  PID:8700
- C:\Windows\System\wFjOAQc.exe
  C:\Windows\System\wFjOAQc.exe
  2⤵
  PID:8716
- C:\Windows\System\DZPkOaP.exe
  C:\Windows\System\DZPkOaP.exe
  2⤵
  PID:8732
- C:\Windows\System\PKIlHzg.exe
  C:\Windows\System\PKIlHzg.exe
  2⤵
  PID:8748
- C:\Windows\System\dLHKuMj.exe
  C:\Windows\System\dLHKuMj.exe
  2⤵
  PID:8764
- C:\Windows\System\qXYSSon.exe
  C:\Windows\System\qXYSSon.exe
  2⤵
  PID:8780
- C:\Windows\System\VcmfEkM.exe
  C:\Windows\System\VcmfEkM.exe
  2⤵
  PID:8796
- C:\Windows\System\TpcoWMm.exe
  C:\Windows\System\TpcoWMm.exe
  2⤵
  PID:8812
- C:\Windows\System\xjfrcwM.exe
  C:\Windows\System\xjfrcwM.exe
  2⤵
  PID:8828
- C:\Windows\System\NQdtPKA.exe
  C:\Windows\System\NQdtPKA.exe
  2⤵
  PID:8844
- C:\Windows\System\gIifvRf.exe
  C:\Windows\System\gIifvRf.exe
  2⤵
  PID:8860
- C:\Windows\System\PdYUlkh.exe
  C:\Windows\System\PdYUlkh.exe
  2⤵
  PID:8876
- C:\Windows\System\ECBLnBY.exe
  C:\Windows\System\ECBLnBY.exe
  2⤵
  PID:8892
- C:\Windows\System\vKPvYWP.exe
  C:\Windows\System\vKPvYWP.exe
  2⤵
  PID:8908
- C:\Windows\System\SzBhTYL.exe
  C:\Windows\System\SzBhTYL.exe
  2⤵
  PID:8924
- C:\Windows\System\mZwhjnu.exe
  C:\Windows\System\mZwhjnu.exe
  2⤵
  PID:8940
- C:\Windows\System\vmFcQjd.exe
  C:\Windows\System\vmFcQjd.exe
  2⤵
  PID:8956
- C:\Windows\System\aPxmIkF.exe
  C:\Windows\System\aPxmIkF.exe
  2⤵
  PID:8976
- C:\Windows\System\hULaDwN.exe
  C:\Windows\System\hULaDwN.exe
  2⤵
  PID:8992
- C:\Windows\System\ijWkSIv.exe
  C:\Windows\System\ijWkSIv.exe
  2⤵
  PID:9008
- C:\Windows\System\DXHWlui.exe
  C:\Windows\System\DXHWlui.exe
  2⤵
  PID:9024
- C:\Windows\System\ANCBjCW.exe
  C:\Windows\System\ANCBjCW.exe
  2⤵
  PID:9040
- C:\Windows\System\ckhxlOP.exe
  C:\Windows\System\ckhxlOP.exe
  2⤵
  PID:9060
- C:\Windows\System\nuYfHAJ.exe
  C:\Windows\System\nuYfHAJ.exe
  2⤵
  PID:9076
- C:\Windows\System\wXuVPus.exe
  C:\Windows\System\wXuVPus.exe
  2⤵
  PID:9092
- C:\Windows\System\LIOhJRZ.exe
  C:\Windows\System\LIOhJRZ.exe
  2⤵
  PID:9108
- C:\Windows\System\uindStn.exe
  C:\Windows\System\uindStn.exe
  2⤵
  PID:9124
- C:\Windows\System\eonMviQ.exe
  C:\Windows\System\eonMviQ.exe
  2⤵
  PID:9140
- C:\Windows\System\hnNeGYQ.exe
  C:\Windows\System\hnNeGYQ.exe
  2⤵
  PID:9156
- C:\Windows\System\wGXlQXv.exe
  C:\Windows\System\wGXlQXv.exe
  2⤵
  PID:9172
- C:\Windows\System\bwDoXfB.exe
  C:\Windows\System\bwDoXfB.exe
  2⤵
  PID:9188
- C:\Windows\System\RFASOXv.exe
  C:\Windows\System\RFASOXv.exe
  2⤵
  PID:9204
- C:\Windows\System\pchDSqC.exe
  C:\Windows\System\pchDSqC.exe
  2⤵
  PID:7468
- C:\Windows\System\YTApmKf.exe
  C:\Windows\System\YTApmKf.exe
  2⤵
  PID:8208
- C:\Windows\System\IulOmAz.exe
  C:\Windows\System\IulOmAz.exe
  2⤵
  PID:7616
- C:\Windows\System\FJMuXmi.exe
  C:\Windows\System\FJMuXmi.exe
  2⤵
  PID:8240
- C:\Windows\System\PYcRvbU.exe
  C:\Windows\System\PYcRvbU.exe
  2⤵
  PID:8288
- C:\Windows\System\nbjwHMz.exe
  C:\Windows\System\nbjwHMz.exe
  2⤵
  PID:8276
- C:\Windows\System\XjVnPFt.exe
  C:\Windows\System\XjVnPFt.exe
  2⤵
  PID:8308
- C:\Windows\System\PjnKtRV.exe
  C:\Windows\System\PjnKtRV.exe
  2⤵
  PID:8368
- C:\Windows\System\xBzavIH.exe
  C:\Windows\System\xBzavIH.exe
  2⤵
  PID:8452
- C:\Windows\System\SoKOSVB.exe
  C:\Windows\System\SoKOSVB.exe
  2⤵
  PID:8440
- C:\Windows\System\jlynZyB.exe
  C:\Windows\System\jlynZyB.exe
  2⤵
  PID:8488
- C:\Windows\System\jivybgV.exe
  C:\Windows\System\jivybgV.exe
  2⤵
  PID:8520
- C:\Windows\System\EQCtIxT.exe
  C:\Windows\System\EQCtIxT.exe
  2⤵
  PID:8584
- C:\Windows\System\itdNCZp.exe
  C:\Windows\System\itdNCZp.exe
  2⤵
  PID:8564
- C:\Windows\System\FXxhsEH.exe
  C:\Windows\System\FXxhsEH.exe
  2⤵
  PID:8612
- C:\Windows\System\BXnYnco.exe
  C:\Windows\System\BXnYnco.exe
  2⤵
  PID:8676
- C:\Windows\System\dszkUYT.exe
  C:\Windows\System\dszkUYT.exe
  2⤵
  PID:8664
- C:\Windows\System\zxIEvDa.exe
  C:\Windows\System\zxIEvDa.exe
  2⤵
  PID:8660
- C:\Windows\System\hAChtQx.exe
  C:\Windows\System\hAChtQx.exe
  2⤵
  PID:8724
- C:\Windows\System\wPTAiMa.exe
  C:\Windows\System\wPTAiMa.exe
  2⤵
  PID:8804
- C:\Windows\System\dENVUek.exe
  C:\Windows\System\dENVUek.exe
  2⤵
  PID:8760
- C:\Windows\System\AQUyhQg.exe
  C:\Windows\System\AQUyhQg.exe
  2⤵
  PID:8868
- C:\Windows\System\zGAlnFL.exe
  C:\Windows\System\zGAlnFL.exe
  2⤵
  PID:8900
- C:\Windows\System\hkpOZtF.exe
  C:\Windows\System\hkpOZtF.exe
  2⤵
  PID:8904
- C:\Windows\System\jfGsZtu.exe
  C:\Windows\System\jfGsZtu.exe
  2⤵
  PID:8916
- C:\Windows\System\zeoDszr.exe
  C:\Windows\System\zeoDszr.exe
  2⤵
  PID:7356
- C:\Windows\System\dfjoeaU.exe
  C:\Windows\System\dfjoeaU.exe
  2⤵
  PID:9068
- C:\Windows\System\QPyEEUs.exe
  C:\Windows\System\QPyEEUs.exe
  2⤵
  PID:9084
- C:\Windows\System\NiaJpOt.exe
  C:\Windows\System\NiaJpOt.exe
  2⤵
  PID:8228
- C:\Windows\System\EXWdcgx.exe
  C:\Windows\System\EXWdcgx.exe
  2⤵
  PID:8388
- C:\Windows\System\cOgYlJC.exe
  C:\Windows\System\cOgYlJC.exe
  2⤵
  PID:8648
- C:\Windows\System\nBmIzTj.exe
  C:\Windows\System\nBmIzTj.exe
  2⤵
  PID:8756
- C:\Windows\System\FCsCZxI.exe
  C:\Windows\System\FCsCZxI.exe
  2⤵
  PID:8468
- C:\Windows\System\PtzpxOv.exe
  C:\Windows\System\PtzpxOv.exe
  2⤵
  PID:8600
- C:\Windows\System\ckUjNdK.exe
  C:\Windows\System\ckUjNdK.exe
  2⤵
  PID:8744
- C:\Windows\System\gnERBsM.exe
  C:\Windows\System\gnERBsM.exe
  2⤵
  PID:8792
- C:\Windows\System\LvTdpdz.exe
  C:\Windows\System\LvTdpdz.exe
  2⤵
  PID:8840
- C:\Windows\System\NjgzsFC.exe
  C:\Windows\System\NjgzsFC.exe
  2⤵
  PID:8988
- C:\Windows\System\KmbaUTk.exe
  C:\Windows\System\KmbaUTk.exe
  2⤵
  PID:8920
- C:\Windows\System\VaNisAY.exe
  C:\Windows\System\VaNisAY.exe
  2⤵
  PID:8824
- C:\Windows\System\DFwbdqk.exe
  C:\Windows\System\DFwbdqk.exe
  2⤵
  PID:9152
- C:\Windows\System\oMVjtcb.exe
  C:\Windows\System\oMVjtcb.exe
  2⤵
  PID:9164
- C:\Windows\System\NiBZNqR.exe
  C:\Windows\System\NiBZNqR.exe
  2⤵
  PID:9116
- C:\Windows\System\ZPYCwcd.exe
  C:\Windows\System\ZPYCwcd.exe
  2⤵
  PID:7308
- C:\Windows\System\EJYadpw.exe
  C:\Windows\System\EJYadpw.exe
  2⤵
  PID:8196
- C:\Windows\System\RvjaOAq.exe
  C:\Windows\System\RvjaOAq.exe
  2⤵
  PID:7408
- C:\Windows\System\NiXUFAw.exe
  C:\Windows\System\NiXUFAw.exe
  2⤵
  PID:8320
- C:\Windows\System\iIAupJj.exe
  C:\Windows\System\iIAupJj.exe
  2⤵
  PID:8500
- C:\Windows\System\fgnbwZm.exe
  C:\Windows\System\fgnbwZm.exe
  2⤵
  PID:8644
- C:\Windows\System\bmHXVJV.exe
  C:\Windows\System\bmHXVJV.exe
  2⤵
  PID:8352
- C:\Windows\System\QCoacaW.exe
  C:\Windows\System\QCoacaW.exe
  2⤵
  PID:8536
- C:\Windows\System\wnrPwtr.exe
  C:\Windows\System\wnrPwtr.exe
  2⤵
  PID:9004
- C:\Windows\System\xDHszja.exe
  C:\Windows\System\xDHszja.exe
  2⤵
  PID:9052
- C:\Windows\System\PVKtgfE.exe
  C:\Windows\System\PVKtgfE.exe
  2⤵
  PID:8740
- C:\Windows\System\zKoHRgv.exe
  C:\Windows\System\zKoHRgv.exe
  2⤵
  PID:9088
- C:\Windows\System\YarDHzU.exe
  C:\Windows\System\YarDHzU.exe
  2⤵
  PID:9180
- C:\Windows\System\cQcLsYV.exe
  C:\Windows\System\cQcLsYV.exe
  2⤵
  PID:7212
- C:\Windows\System\zSytBeD.exe
  C:\Windows\System\zSytBeD.exe
  2⤵
  PID:8696
- C:\Windows\System\BNhoIZF.exe
  C:\Windows\System\BNhoIZF.exe
  2⤵
  PID:8568
- C:\Windows\System\eriZnvV.exe
  C:\Windows\System\eriZnvV.exe
  2⤵
  PID:8680
- C:\Windows\System\ePauYOn.exe
  C:\Windows\System\ePauYOn.exe
  2⤵
  PID:8272
- C:\Windows\System\FyILDkf.exe
  C:\Windows\System\FyILDkf.exe
  2⤵
  PID:8936
- C:\Windows\System\pRGZktl.exe
  C:\Windows\System\pRGZktl.exe
  2⤵
  PID:8424
- C:\Windows\System\dzxarRb.exe
  C:\Windows\System\dzxarRb.exe
  2⤵
  PID:8532
- C:\Windows\System\MOrSvpQ.exe
  C:\Windows\System\MOrSvpQ.exe
  2⤵
  PID:9212
- C:\Windows\System\JkxHsKp.exe
  C:\Windows\System\JkxHsKp.exe
  2⤵
  PID:9168
- C:\Windows\System\EyrjjbM.exe
  C:\Windows\System\EyrjjbM.exe
  2⤵
  PID:9032
- C:\Windows\System\jilFGtJ.exe
  C:\Windows\System\jilFGtJ.exe
  2⤵
  PID:9232
- C:\Windows\System\PFmURGM.exe
  C:\Windows\System\PFmURGM.exe
  2⤵
  PID:9248
- C:\Windows\System\FcSqMvh.exe
  C:\Windows\System\FcSqMvh.exe
  2⤵
  PID:9264
- C:\Windows\System\xebdtOw.exe
  C:\Windows\System\xebdtOw.exe
  2⤵
  PID:9280
- C:\Windows\System\JcEesZT.exe
  C:\Windows\System\JcEesZT.exe
  2⤵
  PID:9360
- C:\Windows\System\tEppysF.exe
  C:\Windows\System\tEppysF.exe
  2⤵
  PID:9376
- C:\Windows\System\MzCyYHl.exe
  C:\Windows\System\MzCyYHl.exe
  2⤵
  PID:9392
- C:\Windows\System\axYBuNW.exe
  C:\Windows\System\axYBuNW.exe
  2⤵
  PID:9408
- C:\Windows\System\AAzpCUB.exe
  C:\Windows\System\AAzpCUB.exe
  2⤵
  PID:9424
- C:\Windows\System\ISKeriA.exe
  C:\Windows\System\ISKeriA.exe
  2⤵
  PID:9440
- C:\Windows\System\oCeDwjx.exe
  C:\Windows\System\oCeDwjx.exe
  2⤵
  PID:9456
- C:\Windows\System\qtDFyTs.exe
  C:\Windows\System\qtDFyTs.exe
  2⤵
  PID:9476
- C:\Windows\System\LkaxQUc.exe
  C:\Windows\System\LkaxQUc.exe
  2⤵
  PID:9492
- C:\Windows\System\gYNsEiR.exe
  C:\Windows\System\gYNsEiR.exe
  2⤵
  PID:9508
- C:\Windows\System\dufMtqI.exe
  C:\Windows\System\dufMtqI.exe
  2⤵
  PID:9524
- C:\Windows\System\ZyfdPLI.exe
  C:\Windows\System\ZyfdPLI.exe
  2⤵
  PID:9540
- C:\Windows\System\XbKVKzJ.exe
  C:\Windows\System\XbKVKzJ.exe
  2⤵
  PID:9556
- C:\Windows\System\VuDDVGH.exe
  C:\Windows\System\VuDDVGH.exe
  2⤵
  PID:9572
- C:\Windows\System\SCMiRce.exe
  C:\Windows\System\SCMiRce.exe
  2⤵
  PID:9588
- C:\Windows\System\fssGdOi.exe
  C:\Windows\System\fssGdOi.exe
  2⤵
  PID:9604
- C:\Windows\System\uEtwGVB.exe
  C:\Windows\System\uEtwGVB.exe
  2⤵
  PID:9620
- C:\Windows\System\wmSlZFJ.exe
  C:\Windows\System\wmSlZFJ.exe
  2⤵
  PID:9636
- C:\Windows\System\OoQYprW.exe
  C:\Windows\System\OoQYprW.exe
  2⤵
  PID:9652
- C:\Windows\System\GsQQLYu.exe
  C:\Windows\System\GsQQLYu.exe
  2⤵
  PID:9668
- C:\Windows\System\HtdXptV.exe
  C:\Windows\System\HtdXptV.exe
  2⤵
  PID:9684
- C:\Windows\System\VNjTXUC.exe
  C:\Windows\System\VNjTXUC.exe
  2⤵
  PID:9704
- C:\Windows\System\FTfxQjT.exe
  C:\Windows\System\FTfxQjT.exe
  2⤵
  PID:9720
- C:\Windows\System\GaHyWbi.exe
  C:\Windows\System\GaHyWbi.exe
  2⤵
  PID:9736
- C:\Windows\System\ZuhEikS.exe
  C:\Windows\System\ZuhEikS.exe
  2⤵
  PID:9756
- C:\Windows\System\GPdWGcj.exe
  C:\Windows\System\GPdWGcj.exe
  2⤵
  PID:9772
- C:\Windows\System\pzKmJzY.exe
  C:\Windows\System\pzKmJzY.exe
  2⤵
  PID:9808
- C:\Windows\System\VrqmXyd.exe
  C:\Windows\System\VrqmXyd.exe
  2⤵
  PID:9824
- C:\Windows\System\aJbbTld.exe
  C:\Windows\System\aJbbTld.exe
  2⤵
  PID:9840
- C:\Windows\System\NbwVScr.exe
  C:\Windows\System\NbwVScr.exe
  2⤵
  PID:9860
- C:\Windows\System\NTmYUnI.exe
  C:\Windows\System\NTmYUnI.exe
  2⤵
  PID:9876
- C:\Windows\System\WqLjXVp.exe
  C:\Windows\System\WqLjXVp.exe
  2⤵
  PID:9892
- C:\Windows\System\nMiwgdc.exe
  C:\Windows\System\nMiwgdc.exe
  2⤵
  PID:9908
- C:\Windows\System\vZYdOsi.exe
  C:\Windows\System\vZYdOsi.exe
  2⤵
  PID:9924
- C:\Windows\System\mOEkmen.exe
  C:\Windows\System\mOEkmen.exe
  2⤵
  PID:9940
- C:\Windows\System\PCuwAgx.exe
  C:\Windows\System\PCuwAgx.exe
  2⤵
  PID:9956
- C:\Windows\System\sUoqIgy.exe
  C:\Windows\System\sUoqIgy.exe
  2⤵
  PID:9972
- C:\Windows\System\PHNiZLr.exe
  C:\Windows\System\PHNiZLr.exe
  2⤵
  PID:9988
- C:\Windows\System\DwKPtno.exe
  C:\Windows\System\DwKPtno.exe
  2⤵
  PID:10004
- C:\Windows\System\NnsyLfJ.exe
  C:\Windows\System\NnsyLfJ.exe
  2⤵
  PID:10020
- C:\Windows\System\eSuDwvD.exe
  C:\Windows\System\eSuDwvD.exe
  2⤵
  PID:10040
- C:\Windows\System\dEpokXU.exe
  C:\Windows\System\dEpokXU.exe
  2⤵
  PID:10056
- C:\Windows\System\mUoPdOP.exe
  C:\Windows\System\mUoPdOP.exe
  2⤵
  PID:10072
- C:\Windows\System\YgFAfKD.exe
  C:\Windows\System\YgFAfKD.exe
  2⤵
  PID:10140
- C:\Windows\System\xwYEtKV.exe
  C:\Windows\System\xwYEtKV.exe
  2⤵
  PID:10156
- C:\Windows\System\rCgrKCM.exe
  C:\Windows\System\rCgrKCM.exe
  2⤵
  PID:10172
- C:\Windows\System\rVMGHVF.exe
  C:\Windows\System\rVMGHVF.exe
  2⤵
  PID:10188
- C:\Windows\System\UFmrQas.exe
  C:\Windows\System\UFmrQas.exe
  2⤵
  PID:10204
- C:\Windows\System\dOAolzy.exe
  C:\Windows\System\dOAolzy.exe
  2⤵
  PID:10220
- C:\Windows\System\SMCLWOK.exe
  C:\Windows\System\SMCLWOK.exe
  2⤵
  PID:10236
- C:\Windows\System\lqCsOGX.exe
  C:\Windows\System\lqCsOGX.exe
  2⤵
  PID:8324
- C:\Windows\System\JsUopdm.exe
  C:\Windows\System\JsUopdm.exe
  2⤵
  PID:9120
- C:\Windows\System\AAUpkUE.exe
  C:\Windows\System\AAUpkUE.exe
  2⤵
  PID:9272
- C:\Windows\System\HuLODtu.exe
  C:\Windows\System\HuLODtu.exe
  2⤵
  PID:9300
- C:\Windows\System\eWZVJjj.exe
  C:\Windows\System\eWZVJjj.exe
  2⤵
  PID:9316
- C:\Windows\System\SMwclcW.exe
  C:\Windows\System\SMwclcW.exe
  2⤵
  PID:9332
- C:\Windows\System\hdvnlYp.exe
  C:\Windows\System\hdvnlYp.exe
  2⤵
  PID:9348
- C:\Windows\System\cCPqzIo.exe
  C:\Windows\System\cCPqzIo.exe
  2⤵
  PID:9384
- C:\Windows\System\LbeUrhZ.exe
  C:\Windows\System\LbeUrhZ.exe
  2⤵
  PID:9388
- C:\Windows\System\ZJSlxQk.exe
  C:\Windows\System\ZJSlxQk.exe
  2⤵
  PID:9452
- C:\Windows\System\rFNqWMp.exe
  C:\Windows\System\rFNqWMp.exe
  2⤵
  PID:9484
- C:\Windows\System\bjZkhIb.exe
  C:\Windows\System\bjZkhIb.exe
  2⤵
  PID:9548
- C:\Windows\System\SGrnYIz.exe
  C:\Windows\System\SGrnYIz.exe
  2⤵
  PID:9612
- C:\Windows\System\BrFhHyL.exe
  C:\Windows\System\BrFhHyL.exe
  2⤵
  PID:9644
- C:\Windows\System\fhSgVAZ.exe
  C:\Windows\System\fhSgVAZ.exe
  2⤵
  PID:9680
- C:\Windows\System\XRHmNsR.exe
  C:\Windows\System\XRHmNsR.exe
  2⤵
  PID:9748
- C:\Windows\System\tYskpkC.exe
  C:\Windows\System\tYskpkC.exe
  2⤵
  PID:9792
- C:\Windows\System\mfggpny.exe
  C:\Windows\System\mfggpny.exe
  2⤵
  PID:9564
- C:\Windows\System\iTCeWwH.exe
  C:\Windows\System\iTCeWwH.exe
  2⤵
  PID:9800
- C:\Windows\System\rcbNogg.exe
  C:\Windows\System\rcbNogg.exe
  2⤵
  PID:9832
- C:\Windows\System\SaBOtQB.exe
  C:\Windows\System\SaBOtQB.exe
  2⤵
  PID:9664
- C:\Windows\System\FEEUUTG.exe
  C:\Windows\System\FEEUUTG.exe
  2⤵
  PID:9732
- C:\Windows\System\NUWHvuw.exe
  C:\Windows\System\NUWHvuw.exe
  2⤵
  PID:9848
- C:\Windows\System\lWWmgAc.exe
  C:\Windows\System\lWWmgAc.exe
  2⤵
  PID:9872
- C:\Windows\System\JUdEMls.exe
  C:\Windows\System\JUdEMls.exe
  2⤵
  PID:9904
- C:\Windows\System\Bsdcwoe.exe
  C:\Windows\System\Bsdcwoe.exe
  2⤵
  PID:9916
- C:\Windows\System\tCAWKKd.exe
  C:\Windows\System\tCAWKKd.exe
  2⤵
  PID:9948
- C:\Windows\System\BLOqzYp.exe
  C:\Windows\System\BLOqzYp.exe
  2⤵
  PID:10032
- C:\Windows\System\XnczyFa.exe
  C:\Windows\System\XnczyFa.exe
  2⤵
  PID:10064
- C:\Windows\System\tYkVzpO.exe
  C:\Windows\System\tYkVzpO.exe
  2⤵
  PID:9980
- C:\Windows\System\jUfbNCJ.exe
  C:\Windows\System\jUfbNCJ.exe
  2⤵
  PID:10012
- C:\Windows\System\zOFNkhV.exe
  C:\Windows\System\zOFNkhV.exe
  2⤵
  PID:10096
- C:\Windows\System\bfQkmrC.exe
  C:\Windows\System\bfQkmrC.exe
  2⤵
  PID:10112
- C:\Windows\System\QkegekP.exe
  C:\Windows\System\QkegekP.exe
  2⤵
  PID:10124
- C:\Windows\System\EArcNdI.exe
  C:\Windows\System\EArcNdI.exe
  2⤵
  PID:10148
- C:\Windows\System\ScWpksK.exe
  C:\Windows\System\ScWpksK.exe
  2⤵
  PID:10164
- C:\Windows\System\qHNGWiA.exe
  C:\Windows\System\qHNGWiA.exe
  2⤵
  PID:10196
- C:\Windows\System\SwsTDCn.exe
  C:\Windows\System\SwsTDCn.exe
  2⤵
  PID:9228
- C:\Windows\System\fKCBQyl.exe
  C:\Windows\System\fKCBQyl.exe
  2⤵
  PID:9292
- C:\Windows\System\mSdgnKP.exe
  C:\Windows\System\mSdgnKP.exe
  2⤵
  PID:9244
- C:\Windows\System\wnIWmLT.exe
  C:\Windows\System\wnIWmLT.exe
  2⤵
  PID:9340
- C:\Windows\System\iidCjwq.exe
  C:\Windows\System\iidCjwq.exe
  2⤵
  PID:9372
- C:\Windows\System\PAVIBan.exe
  C:\Windows\System\PAVIBan.exe
  2⤵
  PID:9432
- C:\Windows\System\fidVxsV.exe
  C:\Windows\System\fidVxsV.exe
  2⤵
  PID:9420
- C:\Windows\System\dadqyHe.exe
  C:\Windows\System\dadqyHe.exe
  2⤵
  PID:9676
- C:\Windows\System\fAyTfzL.exe
  C:\Windows\System\fAyTfzL.exe
  2⤵
  PID:9520
- C:\Windows\System\xQAEbQk.exe
  C:\Windows\System\xQAEbQk.exe
  2⤵
  PID:9596
- C:\Windows\System\avnhnGo.exe
  C:\Windows\System\avnhnGo.exe
  2⤵
  PID:9532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ACaaVVt.exe

Filesize
2.5MB

MD5
de316edee9bc19858b842561fb8b9ac4

SHA1
8751c74ce0f20d939c029fa7690d8a7b6d0a3ea3

SHA256
3f701f48de2ebea60ea7f58c4490a6c6b29ec6972af47a32575f43e4cc374725

SHA512
549d49597d46059ce30d2f64e50cdd9999643f140f6413d96c16ee81766dd94a90f5a59c2b1e00552b8c500139c344e19b11ab6b2a10bc3116f40b47a859aaf0

Download Submit
C:\Windows\system\GtXImyZ.exe

Filesize
2.5MB

MD5
4091328cf51da044fae08640b2228418

SHA1
b23c6492bb57c0a9357abc4ba0e8cb483a1b118a

SHA256
a0c9240b4520bd2e45d8dc24d2c2f69d649a5290b992000ed26156faee157c47

SHA512
d08107f03610798fd0c39eaa6b863b217108916bad1f1a79398b5be28b29647e3e46779c0674180f6bf6d13919f1890d0ac853498691c4a4ce57ce592351f041

Download Submit
C:\Windows\system\GzdoyOU.exe

Filesize
2.5MB

MD5
f9fbdbc68aa9fdb39e5a41ac3a3c81cb

SHA1
20051354738dfeb1ac451d54f66bc375f2299012

SHA256
b337c83c178e1d4383396406249cddd545764cf32ab91d134486e09bd0a9e3e9

SHA512
986e7c5766b7ad746d04e19321e206e0c8b3a4b59a44d4547a5320216a5b41451e4d4893ac4c6ccbcd40d3b340dbc7c71c68f17d2d52ae72a4881b00fbe2af57

Download Submit
C:\Windows\system\ICvAwVg.exe

Filesize
2.5MB

MD5
d80f78882fd11f890e8e6ec7f3f9ef15

SHA1
4d339478a18cc6a14f3a92c04f468b3a902d9d03

SHA256
4fc8025571a6d92e67480c83bff49119f2bf292943098a0cd1bd266b56b1c007

SHA512
71e1d501291dea6d2adc517a87bda7a46ad951b055f8b125b4c01ecb6e84b773fe820ceefc6a30cba9c74c29c21028d369b65d0b13373dad679149bc396a4179

Download Submit
C:\Windows\system\JNLakFe.exe

Filesize
2.5MB

MD5
d728cc3c56379742cd7a17ac78430a5b

SHA1
393b0a4876e366eac59c51c51647f8c93fb57a64

SHA256
1249aea3e5752a2cf5ef6f84c330b3d9caf436d40886c94bebcbb4f2e3f10476

SHA512
277f58bbe3149ac06617e3bf7bbf8935167d13677d29a5cc35502cd559a4bd9e78f29113a68d9d66597c380a0b5380a7c4a3ce892071240e21e8b9f360d46d92

Download Submit
C:\Windows\system\KKLeoru.exe

Filesize
2.5MB

MD5
6a358d645f6c7ead5495099908935b5e

SHA1
0483cb17bc1e4439fc9ad06899f87a403865b336

SHA256
e9e1814cf9077581000266258587a62fcc0786c688e92e5c8a48d6f5ec61699a

SHA512
c963e8b944414e1347a9939c2a5cccb5f1e6b828ffdf676e44bcc07930902c21ad0875922bc2d84c129ed3e80e7d2312dd417fbb5c82cf7ad2d6a197f3fc818c

Download Submit
C:\Windows\system\QMYdcLD.exe

Filesize
2.5MB

MD5
4c700aa6b73bece74783d0a63368f6ff

SHA1
40032d3ec434b697fb61fe18b20d7666eb656620

SHA256
98d11821087f4e948818804bc9d900b907bddb1d061c17b31bdd784a1f3c2a88

SHA512
ffba6f025cf669703331be16bcebbfd1ac8b326032a25ee28a9dd449ecbe4eeadb34dc07288773bc90d75097ffaeea214f56acb20b3f767f664893cdcc4699f4

Download Submit
C:\Windows\system\QaODWSU.exe

Filesize
2.5MB

MD5
e0184b2d8b6671d18add2a6c4ba0bbf4

SHA1
139a626b6d780e086fd9119f26d8066d27810727

SHA256
0d2087183b749dafd8c627e3cbc2e7bae1c8f9f3596a8b912d47e310d79df632

SHA512
29d0afb1fdf84147ae721dc9e3abd1b1d38ca3d2428b6b2ac64920c6327679ae4d2a42853f0af0e640e9b8763c671113c94b36b1fbbbdb9d68b6a414a53826c8

Download Submit
C:\Windows\system\RBVyiau.exe

Filesize
2.5MB

MD5
4059584e3d6a534461b65bb1d7aac00b

SHA1
6f64cf70a9ff2ea97ec2965e09021c877060a966

SHA256
ab6f2c294bbf397e34b02283c1bc182fd8239f8689f6e8765c740d33796ac78d

SHA512
24464478888e702552fb8fb23ae67044757aa6e4432b8e01fa033d27cf2e9e8f8198664fc2bf19be9a21035a8c9292d0bcd584b8761cd7b3101c333721aab778

Download Submit
C:\Windows\system\RfqdPet.exe

Filesize
2.5MB

MD5
09906b9935541c8b66e0bb4e4eed496d

SHA1
77f398c0c878827d0b2f0742a6672a617b38893b

SHA256
0c1ffa29a251dc0bec79e52c95b9b7c72a271b71f2d8a7765d8d584ccd393d57

SHA512
62c67775f31f53c5974f47526f179bf345a56bd25d4db9396168ae03c3a53b5de655b7f1ee3aca19e6b7ec50db3e57f7f669c05614cfe0137e68c6f11b4aa3be

Download Submit
C:\Windows\system\UgtSbmE.exe

Filesize
2.5MB

MD5
15b602461f5b7c92aceea49a881d3b61

SHA1
6feae91154728c3530c0ad3832a5efbfcea2c09c

SHA256
a964173c13c3fbc72729bb01fc63b2a4029c40c4e6a19ea6fa01f4d1da76406e

SHA512
8552ab2f6dad2776b4342093edb2c7b7aa6f1ee7e03bda7a86e00875cdbf9d80bea6a0645b0ff4f43d79d9232e1fe3fd838f388534d112600969b91e37dff24b

Download Submit
C:\Windows\system\UiHIicL.exe

Filesize
2.5MB

MD5
2b7cf08bb6fb39b495a8194dba999307

SHA1
4daec168e901c95fbba11b86aae764e83eecfc0e

SHA256
ce11750d5f01199223aacaae16eb502db584e06908d3c9c9bb9da29f90536b6c

SHA512
6f061bea88c059c41dce4a2eb3f376fbc80a3677877d1da38d2310db5f15e74b7962356ad25181d853bfc9d6ada03249ed90bbac36c74e64243ec50006002b1f

Download Submit
C:\Windows\system\UnitkFy.exe

Filesize
2.5MB

MD5
fd59baec19b8ddec39546019c4755d4b

SHA1
3b585387d520cc49f2fd849e387044b634c4d38c

SHA256
f5cbaf39cdb478e9306c0da1ffa2f412736cc8dd3126a3a88106df317203cfa7

SHA512
beccaef1a15fe6c603e5f676fc67d66f99cfde419b7355a8fabe815644fb84d4bab97986dbfeb8f779292a8981e36fabc963db4a2f32cd129415fc8bb7b083f8

Download Submit
C:\Windows\system\WxWbVGc.exe

Filesize
2.5MB

MD5
82dac320b2a2fd3a328385773dc1d9b2

SHA1
794aff2e3f6f634eba2c1e6df4c664bd92440e9c

SHA256
781784e3092ad530d81c4efdeecc2d8596e7d8e6c46944409c5283e50a830400

SHA512
b60b5f545dae7d89398d0e64aed9240b1bfcddd2be1c5799d66ceaffd33fe55f138e3e86bc4b07a9bdfb15e6f2526787c9c677e58f739fcbe4f8620f724179b3

Download Submit
C:\Windows\system\aBRuztg.exe

Filesize
2.5MB

MD5
5f8c5c910404ec2783cddf2ebf1dffdc

SHA1
f6b0fb1432a9484498d36e9d4d806e7e1b46f078

SHA256
d2fd9ab7cb4e071aac927975e234d77725b3d27c98664e2ab343998f2dce3483

SHA512
04815f421d35a34cec0b2a5d375280deb0f4a6d7db6a4254c6b2911af1e19ccf92e04d4a457bb86ffdf84e6924fe604be989c1e4e4313e32eaa50576d6967edf

Download Submit
C:\Windows\system\atkjvJA.exe

Filesize
2.5MB

MD5
30d1990f1c65938f3edb7e00a58d7eb3

SHA1
a1ea1234233cca21a32e6654be2f706192c6a4fd

SHA256
5c1bf7f8ddb99a09ed4d13ab313ec975d6f2cf01c2e3509ae5f074f26da96bba

SHA512
201f36836fc48fec4f4951d04edb99a0b054e5b5ea418d88697c407b5626b3ab9f9a32032ff3cf26e19bc9f9cef78df2ec7451dd60476197e77d2cfdf0adaeba

Download Submit
C:\Windows\system\dFkmsaf.exe

Filesize
2.5MB

MD5
89ac60533357defad5546197e891b853

SHA1
a5a745e8072fdbaba6214048ee7ba6ca2c770452

SHA256
c196116ed242156bb6837bc5bd3826ce3cd421e1dae7680112d0c783930aa265

SHA512
2cf09ee59c40eb0e0c45c548a0f3b9efd5c0aa6daac6ea8fa7d0b14e9a0fac04642e9623cc22e87817b79f476f2fe53140d9011a8b51b32ddbc14c473b756ea5

Download Submit
C:\Windows\system\eOMsBTM.exe

Filesize
2.5MB

MD5
040a30c7f1398368c42a545d308537b8

SHA1
02878449f39b0f6b614c623c2021cb9a835cffea

SHA256
aa1c3310fac1c7f4736ad89cb507da71d2bd52f4897cedd2e14d9212c31a4e26

SHA512
245a063c5554c7176573357403c1d56b725329aad3e40088c516c60a885afa55709542f03716762440fcf7db386f52b1b141b28f00932ec366f30185b2cb50ae

Download Submit
C:\Windows\system\genZEPa.exe

Filesize
2.5MB

MD5
5f9a484f387c008a4e75c52f6f9d6d04

SHA1
54824eee5c7a2e914fe862bc8ff1f5d54e8c60e2

SHA256
72cd9ec79d0e7b457d506f6673e0300abacce713308ad9b13f374ad6487d1747

SHA512
53dd94c38171ab9fea8830dfc494b3aaa05ed7ada5101e53236eec1be557b9421b205606306fa62a40863e7fc8efc5b1b443683b453b1cbdaee42762e3fff21c

Download Submit
C:\Windows\system\jQsdSxl.exe

Filesize
2.5MB

MD5
a351da01748cf21ad43119a21d7ea25d

SHA1
69551615b5986e6068c9c6b1e04c61b9247462b5

SHA256
e08b77843ef117f7e1a40b03e5ce2ff241b521191188d24caa5e80a60e3bdfc8

SHA512
18f5dc1482b8c06898ca1241300d2f5f6f0566d718b049f2cf8a44ff0cb0e5716e415dd954502dfb0433004e40f6eda66eca1ac760e2b16acbe110ea8702696b

Download Submit
C:\Windows\system\pUNqicE.exe

Filesize
2.5MB

MD5
60cc2dcbc09ce796ece13f4c78df8e61

SHA1
19dcab63aee89ce09e80945d6b97752fae2de865

SHA256
ff1c3f0fd279b5aa532dc59ebed45b54a242806e770a3d260dc369138999ae56

SHA512
d2aa33b9372783160362bc4a724e42b1c51d7be099e7f0d759e8c8c8f020abe93bb75c4224122d05a31238f5863fe1a5b99d475f571027829f86064413d586ab

Download Submit
C:\Windows\system\qTfxgmJ.exe

Filesize
2.5MB

MD5
2384c7851e5008e55a52f03de2a8150a

SHA1
8dd11e83ddc26d61be7876e141e6a5eb8c83fdde

SHA256
529c8553ef3f2e8f42695d439c285cc1cbd8d91ad716761554092a197d44c613

SHA512
63b612950415211c88fa34bba77fa9dddd94a117382a65aeca2655cf8a7acc53576f3a2dd2ab6b32f48bf237c118f4a57e4d33923779d73f7cf09e1689ea8c82

Download Submit
C:\Windows\system\wcWccQa.exe

Filesize
2.5MB

MD5
4ee683d7f11cc357be01f73141004e48

SHA1
0699894ac949a8fb7464a8571b958daa8cbea8cd

SHA256
10fc271e5dc72a2cb9af5d46ebb48839572304296db87786a2aaa0d277362029

SHA512
25d58ba9294b29b717bf14b7d0ea9ec9a21174e5d6cfcb88a14e1affc8bd1c300ccea3b8d59e8f1a6b67f0b9d851a882371f0347a1557c3d1a32c4166f350d09

Download Submit
C:\Windows\system\xnPCGGc.exe

Filesize
2.5MB

MD5
193aa0b88cee3eb29d4f456185bad137

SHA1
4d725b742f965346576811b2e6d0cce4af27f3e3

SHA256
144c17a3c2560a92b8ef7a8d6ead11e474cdcca30a22e95a6b5ca160f48480a7

SHA512
ba11c7fa98bf5b1fc1b0a65d4074c792ed67909ed6e279d275fa00273832b7cff022e017a569af7c193c5904fb2f561c0fd71b4d7242c3c1b1e234f1173a50f8

Download Submit
C:\Windows\system\yQrZONR.exe

Filesize
2.5MB

MD5
7128d18bb11369aabf4caa4e2f672f31

SHA1
4cd30b182413ca961c8e97432d7065d934138c2f

SHA256
c75a84423991bf3c5cbcd271f6c62999c69724375a64881ef690575422b12ee9

SHA512
bf1163c2de864c922283f539765ff40c945feb66f1803515fa0f95f14caab5b7db9e112b9d3a3e2c74bdb2eabc174b63e582562ff823ce040605287e3eca400c

Download Submit
C:\Windows\system\zidGiBC.exe

Filesize
2.5MB

MD5
3f83d387e082a84bd9c9ab31736925a4

SHA1
fa66f63c4093bdc82f4a390b9f2edeac63111278

SHA256
0b05b4e3ba7c97cc4c6d2505c0066740958db8085897ef9c07020459dcfb8211

SHA512
e6dbbfe7d50c5afeee2930ddd5f5e51d9c68bcf965fc5ba0c492d0fbc84d2f3f3072ffcfa1abf8e0776da331110fe401f50e7d6b77a89cfd589386ba2213301f

Download Submit
\Windows\system\CvomPow.exe

Filesize
2.5MB

MD5
016124be5c66e33b579a7195df9cdf06

SHA1
193b287da1eaa103b879c066ecd11d69da693dc0

SHA256
3ac1f5e1eddbb79fdb9d0498f08fdedb02c9b8778a486f44b44c5c3d6d6c5206

SHA512
4642036cc0faa9a388b74f93f2269b274bb2ba13ed113c79951d1c4346fd7b6b71387551d69b6ae51db622c47c6dc0ac5ea70abdbaaa1812c7f35754a97d29bb

Download Submit
\Windows\system\PnVjJmx.exe

Filesize
2.5MB

MD5
b5c0353389ccedbf10cd7526a613f5fa

SHA1
46bb78534bda5c8dc48bf560dda9b34279ffd0b8

SHA256
1b9e21465f299e946014df7da69108cc1c6aece985f1e7288502330007bbb56f

SHA512
fd8284c0711335227b595a70ff901d12f4b5d9a2730848515ade77747dfda7fb93a8327e3121d17ac7daefa3c2cc7d4314644159d8744e36e19625548554f385

Download Submit
\Windows\system\RhhdrYT.exe

Filesize
2.5MB

MD5
b299b22610285f19966f3f9ceca506ac

SHA1
1cf8fff8da1357eb29026a120fc74891836358ad

SHA256
2a1507ecc56955ec61e873d6a21bb546ec76fec4450d8c3ea66413c061b2daab

SHA512
5dbef2ca7ca5196e533f2279c0f911b1aa055dce24e35d61e8c8b24dae0a71d2ed241fae77bc91a8229bf6957c3abd14ef3211b8881c327b9074c4da8a242bde

Download Submit
\Windows\system\SFHqlMr.exe

Filesize
2.5MB

MD5
89e18dc97d3193b39fb41ab64e73011f

SHA1
6db066305af1b1bb7dd633bafd5e2df5d5de2017

SHA256
f61cd7f617214e3f2dcbd62c23445d9196df1031d050f7a5253a1417c54cfc05

SHA512
1e020537ba3b860a171be519e988b56dc5c49d4e200925e94b448b3a8957397190b6833fe39b99c1fd761e28159bce3a5965a3fee4767ba09658bfb31c6db0f4

Download Submit
\Windows\system\TEjzTnO.exe

Filesize
2.5MB

MD5
7d4966a26996042eeed9047662d3cd37

SHA1
098ccd437f938654f8237db82b575b8a3a03a179

SHA256
82ca9cab213308209ee7a921543793bf62fa6bd46507973f72cfe866865b7c6d

SHA512
cf0d9b8841c2c7f8275e85eec0601577286e95f3acf389184fff684981dcf5763307d3e4f630e79ad12920267a022629998abeb061245b1972d21f647f84dc35

Download Submit
\Windows\system\wYtkudH.exe

Filesize
2.5MB

MD5
c3364b5ac3f6c941a2784d00daf3a4d0

SHA1
80f1dc3839edb7ebb0a1e9d0a57fdde2894220bc

SHA256
e5fc85e505bea06f6a69a3033721ea0c2e6e35181ae90c5faaf4e425b822094f

SHA512
5e07720b4cd86b6aee747cf46cd28fbe5bddfb17912042233e7440e058c0473fce9dfa1ae6d3ea820e8fa931b83ff79189f2f303466f62047680b0787aa2f0a5

Download Submit
memory/1672-14-0x000000013F390000-0x000000013F782000-memory.dmp

Filesize
3.9MB

Download
memory/2292-37-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2292-4274-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2428-143-0x0000000001EE0000-0x0000000001EE8000-memory.dmp

Filesize
32KB

Download
memory/2428-18-0x000007FEF59CE000-0x000007FEF59CF000-memory.dmp

Filesize
4KB

Download
memory/2428-17-0x0000000002960000-0x00000000029E0000-memory.dmp

Filesize
512KB

Download
memory/2428-141-0x000000001B780000-0x000000001BA62000-memory.dmp

Filesize
2.9MB

Download
memory/2428-402-0x000007FEF5710000-0x000007FEF60AD000-memory.dmp

Filesize
9.6MB

Download
memory/2632-109-0x000000013F160000-0x000000013F552000-memory.dmp

Filesize
3.9MB

Download
memory/2632-4211-0x000000013F160000-0x000000013F552000-memory.dmp

Filesize
3.9MB

Download
memory/2720-39-0x000000013F5A0000-0x000000013F992000-memory.dmp

Filesize
3.9MB

Download
memory/2720-4193-0x000000013F5A0000-0x000000013F992000-memory.dmp

Filesize
3.9MB

Download
memory/2748-405-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2748-4183-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2764-4205-0x000000013F310000-0x000000013F702000-memory.dmp

Filesize
3.9MB

Download
memory/2764-87-0x000000013F310000-0x000000013F702000-memory.dmp

Filesize
3.9MB

Download
memory/2840-131-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/2840-3994-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/2876-4212-0x000000013F400000-0x000000013F7F2000-memory.dmp

Filesize
3.9MB

Download
memory/2876-85-0x000000013F400000-0x000000013F7F2000-memory.dmp

Filesize
3.9MB

Download
memory/2980-418-0x000000013FB00000-0x000000013FEF2000-memory.dmp

Filesize
3.9MB

Download
memory/2980-67-0x0000000003680000-0x0000000003A72000-memory.dmp

Filesize
3.9MB

Download
memory/2980-91-0x0000000003680000-0x0000000003A72000-memory.dmp

Filesize
3.9MB

Download
memory/2980-115-0x000000013FD10000-0x0000000140102000-memory.dmp

Filesize
3.9MB

Download
memory/2980-49-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2980-92-0x000000013FCF0000-0x00000001400E2000-memory.dmp

Filesize
3.9MB

Download
memory/2980-32-0x00000000031D0000-0x00000000035C2000-memory.dmp

Filesize
3.9MB

Download
memory/2980-1-0x000000013F340000-0x000000013F732000-memory.dmp

Filesize
3.9MB

Download
memory/2980-22-0x00000000031D0000-0x00000000035C2000-memory.dmp

Filesize
3.9MB

Download
memory/2980-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2980-12-0x00000000031D0000-0x00000000035C2000-memory.dmp

Filesize
3.9MB

Download
memory/2980-403-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/2980-406-0x00000000031D0000-0x00000000035C2000-memory.dmp

Filesize
3.9MB

Download
memory/2980-414-0x000000013FEA0000-0x0000000140292000-memory.dmp

Filesize
3.9MB

Download
memory/2980-404-0x00000000031D0000-0x00000000035C2000-memory.dmp

Filesize
3.9MB

Download
memory/2980-419-0x0000000003680000-0x0000000003A72000-memory.dmp

Filesize
3.9MB

Download
memory/2992-4210-0x000000013FCF0000-0x00000001400E2000-memory.dmp

Filesize
3.9MB

Download
memory/2992-114-0x000000013FCF0000-0x00000001400E2000-memory.dmp

Filesize
3.9MB

Download