xmrig | dc77e0f9b8762aba6513238ce4eca26672659884b146406a21a371d66a74df41

Analysis

max time kernel
120s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05-08-2024 19:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c68df78fb545ea694736ea278fa4cff0N.exe
Size

1.9MB
MD5

c68df78fb545ea694736ea278fa4cff0
SHA1

21273c9d9b467370b10d18104a6d3065ded3ca82
SHA256

dc77e0f9b8762aba6513238ce4eca26672659884b146406a21a371d66a74df41
SHA512

a9a668529db373a3f3c2e175491e79cc4942212e6908ae64114a3d7ddaaab052da027daf1eaa591a74f13b7bc8a8f59be37dea509fe72d9641e60495aa0625e2
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW7r+kQQ7dXQARBa5e0ag2K0hvL71:Lz071uv4BPMkyW10/wKV7hjSe05c2Hw

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 23 IoCs

miner

resource	yara_rule
behavioral1/memory/2684-93-0x000000013F710000-0x000000013FB02000-memory.dmp	xmrig
behavioral1/memory/3056-89-0x000000013F410000-0x000000013F802000-memory.dmp	xmrig
behavioral1/memory/2712-87-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	xmrig
behavioral1/memory/1880-82-0x000000013F2E0000-0x000000013F6D2000-memory.dmp	xmrig
behavioral1/memory/2244-81-0x000000013FC60000-0x0000000140052000-memory.dmp	xmrig
behavioral1/memory/2016-79-0x000000013F860000-0x000000013FC52000-memory.dmp	xmrig
behavioral1/memory/2928-77-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	xmrig
behavioral1/memory/2112-71-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	xmrig
behavioral1/memory/2976-70-0x000000013F780000-0x000000013FB72000-memory.dmp	xmrig
behavioral1/memory/2104-13-0x000000013FB20000-0x000000013FF12000-memory.dmp	xmrig
behavioral1/memory/1616-38-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	xmrig
behavioral1/memory/2104-5098-0x000000013FB20000-0x000000013FF12000-memory.dmp	xmrig
behavioral1/memory/1616-5087-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	xmrig
behavioral1/memory/2112-5116-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	xmrig
behavioral1/memory/2016-5160-0x000000013F860000-0x000000013FC52000-memory.dmp	xmrig
behavioral1/memory/2284-5162-0x000000013FD60000-0x0000000140152000-memory.dmp	xmrig
behavioral1/memory/2928-5216-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	xmrig
behavioral1/memory/2712-5219-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	xmrig
behavioral1/memory/2244-5217-0x000000013FC60000-0x0000000140052000-memory.dmp	xmrig
behavioral1/memory/3056-5169-0x000000013F410000-0x000000013F802000-memory.dmp	xmrig
behavioral1/memory/2684-5166-0x000000013F710000-0x000000013FB02000-memory.dmp	xmrig
behavioral1/memory/2976-5110-0x000000013F780000-0x000000013FB72000-memory.dmp	xmrig
behavioral1/memory/2028-9847-0x000000013F700000-0x000000013FAF2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1932	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2104	IspWCFb.exe
2284	JwvdoAm.exe
1616	MkrAHJH.exe
2976	XrAqxow.exe
2112	YfkNCNO.exe
2928	GReqaax.exe
2684	RQRwzgc.exe
2016	lSGdGJD.exe
2244	VUvQaoh.exe
1880	eAfsUlJ.exe
2712	ZRadBva.exe
3056	IfXNCrG.exe
2352	IohNXqG.exe
308	PbJGKMO.exe
1960	edbgSNE.exe
1488	bhyCBEH.exe
1648	lNNmNWH.exe
636	LrsUudD.exe
1740	Zqvjpgq.exe
1692	YheluKi.exe
2380	QelsjfV.exe
1228	cPZPZqb.exe
840	ppBkNSI.exe
2584	sAoDvVH.exe
2572	HecrBSb.exe
2996	yBELRaN.exe
2948	MShURIy.exe
2024	bXYOgUQ.exe
2832	PHvmKQs.exe
2076	MuPfSdK.exe
1724	CVxbZBX.exe
1416	TXHZscS.exe
1080	XHMfQHd.exe
1352	QZxVxQB.exe
1736	JDMcxcW.exe
2052	VJoRoQS.exe
1516	KadlXxe.exe
712	LHACfXL.exe
2212	LmrGXHe.exe
852	ECFZljk.exe
3004	FovHfmH.exe
1028	jXiADhP.exe
1380	lfUaLQH.exe
1860	VTqOkPk.exe
1652	AyNfTMI.exe
476	VXHZZmc.exe
3060	tNOSMqG.exe
2100	lrxVCiR.exe
1732	aRhPQcv.exe
3064	nRoJTsN.exe
2308	ECTJtrx.exe
1548	iAOuGJe.exe
2392	XfECpQv.exe
2400	gJjVHuI.exe
2908	jxTgrwq.exe
2576	brQRImW.exe
1708	fFmLNVU.exe
3028	okcvjDd.exe
816	wEQnciw.exe
2872	UtCRBim.exe
2496	lyFVdAq.exe
2528	BxlUnRE.exe
2784	KJXAXrt.exe
1748	mPcXhLO.exe

Loads dropped DLL 64 IoCs

pid	Process
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe
2028	c68df78fb545ea694736ea278fa4cff0N.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2028-0-0x000000013F700000-0x000000013FAF2000-memory.dmp	upx
behavioral1/files/0x00080000000120ff-3.dat	upx
behavioral1/files/0x0008000000015d13-8.dat	upx
behavioral1/files/0x0007000000015d34-19.dat	upx
behavioral1/memory/2284-14-0x000000013FD60000-0x0000000140152000-memory.dmp	upx
behavioral1/files/0x0007000000015d56-20.dat	upx
behavioral1/files/0x000d000000018660-66.dat	upx
behavioral1/files/0x0006000000017562-65.dat	upx
behavioral1/files/0x000800000001657e-64.dat	upx
behavioral1/files/0x0007000000004e74-63.dat	upx
behavioral1/files/0x000a000000015d7b-41.dat	upx
behavioral1/files/0x0007000000015d62-40.dat	upx
behavioral1/files/0x0005000000018784-99.dat	upx
behavioral1/files/0x0006000000018c0c-110.dat	upx
behavioral1/files/0x000600000001902d-126.dat	upx
behavioral1/files/0x00050000000191c6-141.dat	upx
behavioral1/files/0x000500000001921e-151.dat	upx
behavioral1/files/0x0005000000019248-162.dat	upx
behavioral1/files/0x0005000000019345-191.dat	upx
behavioral1/files/0x000500000001927e-186.dat	upx
behavioral1/files/0x0005000000019276-181.dat	upx
behavioral1/files/0x0005000000019258-176.dat	upx
behavioral1/files/0x0005000000019255-171.dat	upx
behavioral1/files/0x000500000001924b-165.dat	upx
behavioral1/files/0x0005000000019236-156.dat	upx
behavioral1/files/0x00050000000191f1-146.dat	upx
behavioral1/files/0x00060000000190d2-136.dat	upx
behavioral1/files/0x00060000000190c0-131.dat	upx
behavioral1/files/0x0006000000018f45-121.dat	upx
behavioral1/files/0x0006000000018c18-116.dat	upx
behavioral1/memory/2684-93-0x000000013F710000-0x000000013FB02000-memory.dmp	upx
behavioral1/memory/3056-89-0x000000013F410000-0x000000013F802000-memory.dmp	upx
behavioral1/memory/2712-87-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	upx
behavioral1/memory/1880-82-0x000000013F2E0000-0x000000013F6D2000-memory.dmp	upx
behavioral1/memory/2244-81-0x000000013FC60000-0x0000000140052000-memory.dmp	upx
behavioral1/memory/2016-79-0x000000013F860000-0x000000013FC52000-memory.dmp	upx
behavioral1/memory/2928-77-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	upx
behavioral1/files/0x0009000000015ce1-104.dat	upx
behavioral1/memory/2112-71-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	upx
behavioral1/memory/2976-70-0x000000013F780000-0x000000013FB72000-memory.dmp	upx
behavioral1/files/0x0005000000018679-96.dat	upx
behavioral1/memory/2104-13-0x000000013FB20000-0x000000013FF12000-memory.dmp	upx
behavioral1/files/0x0014000000018655-59.dat	upx
behavioral1/files/0x00060000000174a8-58.dat	upx
behavioral1/memory/1616-38-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	upx
behavioral1/memory/2104-5098-0x000000013FB20000-0x000000013FF12000-memory.dmp	upx
behavioral1/memory/1616-5087-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	upx
behavioral1/memory/2112-5116-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	upx
behavioral1/memory/2016-5160-0x000000013F860000-0x000000013FC52000-memory.dmp	upx
behavioral1/memory/2284-5162-0x000000013FD60000-0x0000000140152000-memory.dmp	upx
behavioral1/memory/2928-5216-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	upx
behavioral1/memory/2712-5219-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	upx
behavioral1/memory/2244-5217-0x000000013FC60000-0x0000000140052000-memory.dmp	upx
behavioral1/memory/3056-5169-0x000000013F410000-0x000000013F802000-memory.dmp	upx
behavioral1/memory/2684-5166-0x000000013F710000-0x000000013FB02000-memory.dmp	upx
behavioral1/memory/2976-5110-0x000000013F780000-0x000000013FB72000-memory.dmp	upx
behavioral1/memory/2028-9847-0x000000013F700000-0x000000013FAF2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\KONKTKB.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\cboWiDA.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\ACSzgfe.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\aRhCPED.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\iCtXeRp.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\wIDjbGm.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\cVxmBjp.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\WzFpEjM.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\ZXQrIqt.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\SKdiujU.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\HLhJCJV.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\ZwptYBB.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\QlusHec.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\wYcrSbZ.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\HOroxkK.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\bSLEhEr.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\coguGXL.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\RkzIaqq.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\RJVXBcc.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\OXgJiPy.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\qAIqquc.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\pSZfZyS.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\pmQvFcB.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\toqQjtt.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\OOnvgPx.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\jjMnKZt.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\yzfKQUo.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\JbZuomg.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\CcvWqUL.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\czyxATv.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\kJjooSJ.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\yIvDGWU.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\ZhwIsZO.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\zjZxZqJ.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\NpzztmT.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\hmTHhoW.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\cTNcngk.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\jxTgrwq.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\iIWHXih.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\GWAfzBQ.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\fkJnZuL.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\iyzpvgH.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\SWcdUcO.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\wrEaJng.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\nvramaf.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\gQLURok.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\beDpKvZ.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\ysBjNHc.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\QLFzANU.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\iVPcmeU.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\vqaWDQn.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\xdQFTMh.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\nlpxmJG.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\WEACoWk.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\bNHsBTv.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\tKdldER.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\VftwNXU.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\VkmKBUU.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\hachUNX.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\PmAsVgH.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\dMHHbSs.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\cQeBJnU.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\XVeTtfy.exe	c68df78fb545ea694736ea278fa4cff0N.exe
File created	C:\Windows\System\sUljlpL.exe	c68df78fb545ea694736ea278fa4cff0N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1932	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2028	c68df78fb545ea694736ea278fa4cff0N.exe
Token: SeLockMemoryPrivilege	2028	c68df78fb545ea694736ea278fa4cff0N.exe
Token: SeDebugPrivilege	1932	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1932	2028	c68df78fb545ea694736ea278fa4cff0N.exe	29
PID 2028 wrote to memory of 1932	2028	c68df78fb545ea694736ea278fa4cff0N.exe	29
PID 2028 wrote to memory of 1932	2028	c68df78fb545ea694736ea278fa4cff0N.exe	29
PID 2028 wrote to memory of 2104	2028	c68df78fb545ea694736ea278fa4cff0N.exe	30
PID 2028 wrote to memory of 2104	2028	c68df78fb545ea694736ea278fa4cff0N.exe	30
PID 2028 wrote to memory of 2104	2028	c68df78fb545ea694736ea278fa4cff0N.exe	30
PID 2028 wrote to memory of 2284	2028	c68df78fb545ea694736ea278fa4cff0N.exe	31
PID 2028 wrote to memory of 2284	2028	c68df78fb545ea694736ea278fa4cff0N.exe	31
PID 2028 wrote to memory of 2284	2028	c68df78fb545ea694736ea278fa4cff0N.exe	31
PID 2028 wrote to memory of 1616	2028	c68df78fb545ea694736ea278fa4cff0N.exe	32
PID 2028 wrote to memory of 1616	2028	c68df78fb545ea694736ea278fa4cff0N.exe	32
PID 2028 wrote to memory of 1616	2028	c68df78fb545ea694736ea278fa4cff0N.exe	32
PID 2028 wrote to memory of 2928	2028	c68df78fb545ea694736ea278fa4cff0N.exe	33
PID 2028 wrote to memory of 2928	2028	c68df78fb545ea694736ea278fa4cff0N.exe	33
PID 2028 wrote to memory of 2928	2028	c68df78fb545ea694736ea278fa4cff0N.exe	33
PID 2028 wrote to memory of 2976	2028	c68df78fb545ea694736ea278fa4cff0N.exe	34
PID 2028 wrote to memory of 2976	2028	c68df78fb545ea694736ea278fa4cff0N.exe	34
PID 2028 wrote to memory of 2976	2028	c68df78fb545ea694736ea278fa4cff0N.exe	34
PID 2028 wrote to memory of 2244	2028	c68df78fb545ea694736ea278fa4cff0N.exe	35
PID 2028 wrote to memory of 2244	2028	c68df78fb545ea694736ea278fa4cff0N.exe	35
PID 2028 wrote to memory of 2244	2028	c68df78fb545ea694736ea278fa4cff0N.exe	35
PID 2028 wrote to memory of 2112	2028	c68df78fb545ea694736ea278fa4cff0N.exe	36
PID 2028 wrote to memory of 2112	2028	c68df78fb545ea694736ea278fa4cff0N.exe	36
PID 2028 wrote to memory of 2112	2028	c68df78fb545ea694736ea278fa4cff0N.exe	36
PID 2028 wrote to memory of 1880	2028	c68df78fb545ea694736ea278fa4cff0N.exe	37
PID 2028 wrote to memory of 1880	2028	c68df78fb545ea694736ea278fa4cff0N.exe	37
PID 2028 wrote to memory of 1880	2028	c68df78fb545ea694736ea278fa4cff0N.exe	37
PID 2028 wrote to memory of 2684	2028	c68df78fb545ea694736ea278fa4cff0N.exe	38
PID 2028 wrote to memory of 2684	2028	c68df78fb545ea694736ea278fa4cff0N.exe	38
PID 2028 wrote to memory of 2684	2028	c68df78fb545ea694736ea278fa4cff0N.exe	38
PID 2028 wrote to memory of 2712	2028	c68df78fb545ea694736ea278fa4cff0N.exe	39
PID 2028 wrote to memory of 2712	2028	c68df78fb545ea694736ea278fa4cff0N.exe	39
PID 2028 wrote to memory of 2712	2028	c68df78fb545ea694736ea278fa4cff0N.exe	39
PID 2028 wrote to memory of 2016	2028	c68df78fb545ea694736ea278fa4cff0N.exe	40
PID 2028 wrote to memory of 2016	2028	c68df78fb545ea694736ea278fa4cff0N.exe	40
PID 2028 wrote to memory of 2016	2028	c68df78fb545ea694736ea278fa4cff0N.exe	40
PID 2028 wrote to memory of 3056	2028	c68df78fb545ea694736ea278fa4cff0N.exe	41
PID 2028 wrote to memory of 3056	2028	c68df78fb545ea694736ea278fa4cff0N.exe	41
PID 2028 wrote to memory of 3056	2028	c68df78fb545ea694736ea278fa4cff0N.exe	41
PID 2028 wrote to memory of 2352	2028	c68df78fb545ea694736ea278fa4cff0N.exe	42
PID 2028 wrote to memory of 2352	2028	c68df78fb545ea694736ea278fa4cff0N.exe	42
PID 2028 wrote to memory of 2352	2028	c68df78fb545ea694736ea278fa4cff0N.exe	42
PID 2028 wrote to memory of 1960	2028	c68df78fb545ea694736ea278fa4cff0N.exe	43
PID 2028 wrote to memory of 1960	2028	c68df78fb545ea694736ea278fa4cff0N.exe	43
PID 2028 wrote to memory of 1960	2028	c68df78fb545ea694736ea278fa4cff0N.exe	43
PID 2028 wrote to memory of 308	2028	c68df78fb545ea694736ea278fa4cff0N.exe	44
PID 2028 wrote to memory of 308	2028	c68df78fb545ea694736ea278fa4cff0N.exe	44
PID 2028 wrote to memory of 308	2028	c68df78fb545ea694736ea278fa4cff0N.exe	44
PID 2028 wrote to memory of 1488	2028	c68df78fb545ea694736ea278fa4cff0N.exe	45
PID 2028 wrote to memory of 1488	2028	c68df78fb545ea694736ea278fa4cff0N.exe	45
PID 2028 wrote to memory of 1488	2028	c68df78fb545ea694736ea278fa4cff0N.exe	45
PID 2028 wrote to memory of 1648	2028	c68df78fb545ea694736ea278fa4cff0N.exe	46
PID 2028 wrote to memory of 1648	2028	c68df78fb545ea694736ea278fa4cff0N.exe	46
PID 2028 wrote to memory of 1648	2028	c68df78fb545ea694736ea278fa4cff0N.exe	46
PID 2028 wrote to memory of 636	2028	c68df78fb545ea694736ea278fa4cff0N.exe	47
PID 2028 wrote to memory of 636	2028	c68df78fb545ea694736ea278fa4cff0N.exe	47
PID 2028 wrote to memory of 636	2028	c68df78fb545ea694736ea278fa4cff0N.exe	47
PID 2028 wrote to memory of 1740	2028	c68df78fb545ea694736ea278fa4cff0N.exe	48
PID 2028 wrote to memory of 1740	2028	c68df78fb545ea694736ea278fa4cff0N.exe	48
PID 2028 wrote to memory of 1740	2028	c68df78fb545ea694736ea278fa4cff0N.exe	48
PID 2028 wrote to memory of 1692	2028	c68df78fb545ea694736ea278fa4cff0N.exe	49
PID 2028 wrote to memory of 1692	2028	c68df78fb545ea694736ea278fa4cff0N.exe	49
PID 2028 wrote to memory of 1692	2028	c68df78fb545ea694736ea278fa4cff0N.exe	49
PID 2028 wrote to memory of 2380	2028	c68df78fb545ea694736ea278fa4cff0N.exe	50

C:\Users\Admin\AppData\Local\Temp\c68df78fb545ea694736ea278fa4cff0N.exe
"C:\Users\Admin\AppData\Local\Temp\c68df78fb545ea694736ea278fa4cff0N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1932
- C:\Windows\System\IspWCFb.exe
  C:\Windows\System\IspWCFb.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\JwvdoAm.exe
  C:\Windows\System\JwvdoAm.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\MkrAHJH.exe
  C:\Windows\System\MkrAHJH.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\GReqaax.exe
  C:\Windows\System\GReqaax.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\XrAqxow.exe
  C:\Windows\System\XrAqxow.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\VUvQaoh.exe
  C:\Windows\System\VUvQaoh.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\YfkNCNO.exe
  C:\Windows\System\YfkNCNO.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\eAfsUlJ.exe
  C:\Windows\System\eAfsUlJ.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\RQRwzgc.exe
  C:\Windows\System\RQRwzgc.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\ZRadBva.exe
  C:\Windows\System\ZRadBva.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\lSGdGJD.exe
  C:\Windows\System\lSGdGJD.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\IfXNCrG.exe
  C:\Windows\System\IfXNCrG.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\IohNXqG.exe
  C:\Windows\System\IohNXqG.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\edbgSNE.exe
  C:\Windows\System\edbgSNE.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\PbJGKMO.exe
  C:\Windows\System\PbJGKMO.exe
  2⤵
  - Executes dropped EXE
  PID:308
- C:\Windows\System\bhyCBEH.exe
  C:\Windows\System\bhyCBEH.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\lNNmNWH.exe
  C:\Windows\System\lNNmNWH.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\LrsUudD.exe
  C:\Windows\System\LrsUudD.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\Zqvjpgq.exe
  C:\Windows\System\Zqvjpgq.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\YheluKi.exe
  C:\Windows\System\YheluKi.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\QelsjfV.exe
  C:\Windows\System\QelsjfV.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\cPZPZqb.exe
  C:\Windows\System\cPZPZqb.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\ppBkNSI.exe
  C:\Windows\System\ppBkNSI.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\sAoDvVH.exe
  C:\Windows\System\sAoDvVH.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\HecrBSb.exe
  C:\Windows\System\HecrBSb.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\yBELRaN.exe
  C:\Windows\System\yBELRaN.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\MShURIy.exe
  C:\Windows\System\MShURIy.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\bXYOgUQ.exe
  C:\Windows\System\bXYOgUQ.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\PHvmKQs.exe
  C:\Windows\System\PHvmKQs.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\MuPfSdK.exe
  C:\Windows\System\MuPfSdK.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\CVxbZBX.exe
  C:\Windows\System\CVxbZBX.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\TXHZscS.exe
  C:\Windows\System\TXHZscS.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\XHMfQHd.exe
  C:\Windows\System\XHMfQHd.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\QZxVxQB.exe
  C:\Windows\System\QZxVxQB.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\JDMcxcW.exe
  C:\Windows\System\JDMcxcW.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\VJoRoQS.exe
  C:\Windows\System\VJoRoQS.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\KadlXxe.exe
  C:\Windows\System\KadlXxe.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\LHACfXL.exe
  C:\Windows\System\LHACfXL.exe
  2⤵
  - Executes dropped EXE
  PID:712
- C:\Windows\System\LmrGXHe.exe
  C:\Windows\System\LmrGXHe.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\ECFZljk.exe
  C:\Windows\System\ECFZljk.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\FovHfmH.exe
  C:\Windows\System\FovHfmH.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\jXiADhP.exe
  C:\Windows\System\jXiADhP.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\lfUaLQH.exe
  C:\Windows\System\lfUaLQH.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\VTqOkPk.exe
  C:\Windows\System\VTqOkPk.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\AyNfTMI.exe
  C:\Windows\System\AyNfTMI.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\VXHZZmc.exe
  C:\Windows\System\VXHZZmc.exe
  2⤵
  - Executes dropped EXE
  PID:476
- C:\Windows\System\tNOSMqG.exe
  C:\Windows\System\tNOSMqG.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\lrxVCiR.exe
  C:\Windows\System\lrxVCiR.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\aRhPQcv.exe
  C:\Windows\System\aRhPQcv.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\nRoJTsN.exe
  C:\Windows\System\nRoJTsN.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\ECTJtrx.exe
  C:\Windows\System\ECTJtrx.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\iAOuGJe.exe
  C:\Windows\System\iAOuGJe.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\XfECpQv.exe
  C:\Windows\System\XfECpQv.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\gJjVHuI.exe
  C:\Windows\System\gJjVHuI.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\jxTgrwq.exe
  C:\Windows\System\jxTgrwq.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\brQRImW.exe
  C:\Windows\System\brQRImW.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\fFmLNVU.exe
  C:\Windows\System\fFmLNVU.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\okcvjDd.exe
  C:\Windows\System\okcvjDd.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\wEQnciw.exe
  C:\Windows\System\wEQnciw.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\UtCRBim.exe
  C:\Windows\System\UtCRBim.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\lyFVdAq.exe
  C:\Windows\System\lyFVdAq.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\BxlUnRE.exe
  C:\Windows\System\BxlUnRE.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\KJXAXrt.exe
  C:\Windows\System\KJXAXrt.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\mPcXhLO.exe
  C:\Windows\System\mPcXhLO.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\HbiuSuB.exe
  C:\Windows\System\HbiuSuB.exe
  2⤵
  PID:1780
- C:\Windows\System\LAExMXo.exe
  C:\Windows\System\LAExMXo.exe
  2⤵
  PID:1808
- C:\Windows\System\NnPAAug.exe
  C:\Windows\System\NnPAAug.exe
  2⤵
  PID:1604
- C:\Windows\System\FHcviDM.exe
  C:\Windows\System\FHcviDM.exe
  2⤵
  PID:2912
- C:\Windows\System\neazGgA.exe
  C:\Windows\System\neazGgA.exe
  2⤵
  PID:2236
- C:\Windows\System\iogSEQr.exe
  C:\Windows\System\iogSEQr.exe
  2⤵
  PID:1244
- C:\Windows\System\yqFgyLi.exe
  C:\Windows\System\yqFgyLi.exe
  2⤵
  PID:2728
- C:\Windows\System\XJnDqme.exe
  C:\Windows\System\XJnDqme.exe
  2⤵
  PID:2196
- C:\Windows\System\efVxMTi.exe
  C:\Windows\System\efVxMTi.exe
  2⤵
  PID:2848
- C:\Windows\System\pHkKJne.exe
  C:\Windows\System\pHkKJne.exe
  2⤵
  PID:2808
- C:\Windows\System\wtyLMUa.exe
  C:\Windows\System\wtyLMUa.exe
  2⤵
  PID:532
- C:\Windows\System\tzogYJO.exe
  C:\Windows\System\tzogYJO.exe
  2⤵
  PID:1556
- C:\Windows\System\sfqMQkz.exe
  C:\Windows\System\sfqMQkz.exe
  2⤵
  PID:2824
- C:\Windows\System\FQDlZTK.exe
  C:\Windows\System\FQDlZTK.exe
  2⤵
  PID:1632
- C:\Windows\System\qwcsaPV.exe
  C:\Windows\System\qwcsaPV.exe
  2⤵
  PID:1264
- C:\Windows\System\wAYlqBj.exe
  C:\Windows\System\wAYlqBj.exe
  2⤵
  PID:916
- C:\Windows\System\WqSSNHn.exe
  C:\Windows\System\WqSSNHn.exe
  2⤵
  PID:1100
- C:\Windows\System\JCbYkQl.exe
  C:\Windows\System\JCbYkQl.exe
  2⤵
  PID:2032
- C:\Windows\System\YfvlwHy.exe
  C:\Windows\System\YfvlwHy.exe
  2⤵
  PID:996
- C:\Windows\System\uQeoEgm.exe
  C:\Windows\System\uQeoEgm.exe
  2⤵
  PID:2356
- C:\Windows\System\LctJGxl.exe
  C:\Windows\System\LctJGxl.exe
  2⤵
  PID:2204
- C:\Windows\System\DKGJLWv.exe
  C:\Windows\System\DKGJLWv.exe
  2⤵
  PID:1676
- C:\Windows\System\XbYXaxP.exe
  C:\Windows\System\XbYXaxP.exe
  2⤵
  PID:2376
- C:\Windows\System\GwaXjuN.exe
  C:\Windows\System\GwaXjuN.exe
  2⤵
  PID:1852
- C:\Windows\System\PpStfuh.exe
  C:\Windows\System\PpStfuh.exe
  2⤵
  PID:1656
- C:\Windows\System\zzVVyqL.exe
  C:\Windows\System\zzVVyqL.exe
  2⤵
  PID:572
- C:\Windows\System\cVxLbkT.exe
  C:\Windows\System\cVxLbkT.exe
  2⤵
  PID:2904
- C:\Windows\System\HCZjXqv.exe
  C:\Windows\System\HCZjXqv.exe
  2⤵
  PID:2864
- C:\Windows\System\MdTJxsK.exe
  C:\Windows\System\MdTJxsK.exe
  2⤵
  PID:2232
- C:\Windows\System\WBQaizH.exe
  C:\Windows\System\WBQaizH.exe
  2⤵
  PID:2844
- C:\Windows\System\vQEwpDI.exe
  C:\Windows\System\vQEwpDI.exe
  2⤵
  PID:2724
- C:\Windows\System\rAysiIS.exe
  C:\Windows\System\rAysiIS.exe
  2⤵
  PID:236
- C:\Windows\System\ztjpmYa.exe
  C:\Windows\System\ztjpmYa.exe
  2⤵
  PID:2544
- C:\Windows\System\ZhwIsZO.exe
  C:\Windows\System\ZhwIsZO.exe
  2⤵
  PID:1712
- C:\Windows\System\JmTPCSe.exe
  C:\Windows\System\JmTPCSe.exe
  2⤵
  PID:1500
- C:\Windows\System\NTnYjpA.exe
  C:\Windows\System\NTnYjpA.exe
  2⤵
  PID:2672
- C:\Windows\System\uEDXONI.exe
  C:\Windows\System\uEDXONI.exe
  2⤵
  PID:2944
- C:\Windows\System\yzfKQUo.exe
  C:\Windows\System\yzfKQUo.exe
  2⤵
  PID:1560
- C:\Windows\System\hachUNX.exe
  C:\Windows\System\hachUNX.exe
  2⤵
  PID:912
- C:\Windows\System\UYQrWVV.exe
  C:\Windows\System\UYQrWVV.exe
  2⤵
  PID:1760
- C:\Windows\System\OYTQpgz.exe
  C:\Windows\System\OYTQpgz.exe
  2⤵
  PID:1136
- C:\Windows\System\PnUOOYJ.exe
  C:\Windows\System\PnUOOYJ.exe
  2⤵
  PID:2780
- C:\Windows\System\MgZZHiH.exe
  C:\Windows\System\MgZZHiH.exe
  2⤵
  PID:280
- C:\Windows\System\FAzpmbE.exe
  C:\Windows\System\FAzpmbE.exe
  2⤵
  PID:2344
- C:\Windows\System\rxdxDSN.exe
  C:\Windows\System\rxdxDSN.exe
  2⤵
  PID:1948
- C:\Windows\System\ggjaMOW.exe
  C:\Windows\System\ggjaMOW.exe
  2⤵
  PID:2700
- C:\Windows\System\ipvuaVY.exe
  C:\Windows\System\ipvuaVY.exe
  2⤵
  PID:660
- C:\Windows\System\OBkGsnf.exe
  C:\Windows\System\OBkGsnf.exe
  2⤵
  PID:2588
- C:\Windows\System\kiEBSZO.exe
  C:\Windows\System\kiEBSZO.exe
  2⤵
  PID:2628
- C:\Windows\System\EcKQFAE.exe
  C:\Windows\System\EcKQFAE.exe
  2⤵
  PID:1580
- C:\Windows\System\WrPyjfZ.exe
  C:\Windows\System\WrPyjfZ.exe
  2⤵
  PID:1972
- C:\Windows\System\aavXbUx.exe
  C:\Windows\System\aavXbUx.exe
  2⤵
  PID:2484
- C:\Windows\System\nbUHpWV.exe
  C:\Windows\System\nbUHpWV.exe
  2⤵
  PID:1936
- C:\Windows\System\xQatMSz.exe
  C:\Windows\System\xQatMSz.exe
  2⤵
  PID:764
- C:\Windows\System\sUljlpL.exe
  C:\Windows\System\sUljlpL.exe
  2⤵
  PID:864
- C:\Windows\System\gohAQkY.exe
  C:\Windows\System\gohAQkY.exe
  2⤵
  PID:1824
- C:\Windows\System\fNzVALn.exe
  C:\Windows\System\fNzVALn.exe
  2⤵
  PID:1768
- C:\Windows\System\dkayZHU.exe
  C:\Windows\System\dkayZHU.exe
  2⤵
  PID:1784
- C:\Windows\System\YBZHQdL.exe
  C:\Windows\System\YBZHQdL.exe
  2⤵
  PID:784
- C:\Windows\System\zZEpthi.exe
  C:\Windows\System\zZEpthi.exe
  2⤵
  PID:2200
- C:\Windows\System\koAzYOz.exe
  C:\Windows\System\koAzYOz.exe
  2⤵
  PID:2228
- C:\Windows\System\eOCqnaa.exe
  C:\Windows\System\eOCqnaa.exe
  2⤵
  PID:2652
- C:\Windows\System\tEsvKxd.exe
  C:\Windows\System\tEsvKxd.exe
  2⤵
  PID:2796
- C:\Windows\System\zyhzMqB.exe
  C:\Windows\System\zyhzMqB.exe
  2⤵
  PID:1576
- C:\Windows\System\MMHSSAY.exe
  C:\Windows\System\MMHSSAY.exe
  2⤵
  PID:2792
- C:\Windows\System\CICripR.exe
  C:\Windows\System\CICripR.exe
  2⤵
  PID:2280
- C:\Windows\System\zjZxZqJ.exe
  C:\Windows\System\zjZxZqJ.exe
  2⤵
  PID:2640
- C:\Windows\System\zUhcviN.exe
  C:\Windows\System\zUhcviN.exe
  2⤵
  PID:2080
- C:\Windows\System\HLCqaPc.exe
  C:\Windows\System\HLCqaPc.exe
  2⤵
  PID:1152
- C:\Windows\System\TUCQDKD.exe
  C:\Windows\System\TUCQDKD.exe
  2⤵
  PID:1268
- C:\Windows\System\MzCjnTk.exe
  C:\Windows\System\MzCjnTk.exe
  2⤵
  PID:1668
- C:\Windows\System\uTsoWiK.exe
  C:\Windows\System\uTsoWiK.exe
  2⤵
  PID:1788
- C:\Windows\System\DMimCnW.exe
  C:\Windows\System\DMimCnW.exe
  2⤵
  PID:1700
- C:\Windows\System\eSUZFBh.exe
  C:\Windows\System\eSUZFBh.exe
  2⤵
  PID:3016
- C:\Windows\System\zwIWaSA.exe
  C:\Windows\System\zwIWaSA.exe
  2⤵
  PID:2804
- C:\Windows\System\tlsrGDL.exe
  C:\Windows\System\tlsrGDL.exe
  2⤵
  PID:2296
- C:\Windows\System\xqGgXoj.exe
  C:\Windows\System\xqGgXoj.exe
  2⤵
  PID:2988
- C:\Windows\System\YvbzIhK.exe
  C:\Windows\System\YvbzIhK.exe
  2⤵
  PID:3076
- C:\Windows\System\FbXtTDu.exe
  C:\Windows\System\FbXtTDu.exe
  2⤵
  PID:3100
- C:\Windows\System\ykcvdFw.exe
  C:\Windows\System\ykcvdFw.exe
  2⤵
  PID:3120
- C:\Windows\System\tGTqpPd.exe
  C:\Windows\System\tGTqpPd.exe
  2⤵
  PID:3140
- C:\Windows\System\AxtOhJg.exe
  C:\Windows\System\AxtOhJg.exe
  2⤵
  PID:3160
- C:\Windows\System\JHBxdAa.exe
  C:\Windows\System\JHBxdAa.exe
  2⤵
  PID:3180
- C:\Windows\System\IFxLjUb.exe
  C:\Windows\System\IFxLjUb.exe
  2⤵
  PID:3200
- C:\Windows\System\XGyfPHl.exe
  C:\Windows\System\XGyfPHl.exe
  2⤵
  PID:3220
- C:\Windows\System\GwAiaGC.exe
  C:\Windows\System\GwAiaGC.exe
  2⤵
  PID:3240
- C:\Windows\System\TQSXINx.exe
  C:\Windows\System\TQSXINx.exe
  2⤵
  PID:3260
- C:\Windows\System\dFmEWla.exe
  C:\Windows\System\dFmEWla.exe
  2⤵
  PID:3280
- C:\Windows\System\WGrXruJ.exe
  C:\Windows\System\WGrXruJ.exe
  2⤵
  PID:3300
- C:\Windows\System\aKUZRVJ.exe
  C:\Windows\System\aKUZRVJ.exe
  2⤵
  PID:3320
- C:\Windows\System\loTMgXM.exe
  C:\Windows\System\loTMgXM.exe
  2⤵
  PID:3336
- C:\Windows\System\VUnrnsM.exe
  C:\Windows\System\VUnrnsM.exe
  2⤵
  PID:3360
- C:\Windows\System\xTteXAH.exe
  C:\Windows\System\xTteXAH.exe
  2⤵
  PID:3380
- C:\Windows\System\nwRYXCO.exe
  C:\Windows\System\nwRYXCO.exe
  2⤵
  PID:3400
- C:\Windows\System\IVvJGqc.exe
  C:\Windows\System\IVvJGqc.exe
  2⤵
  PID:3420
- C:\Windows\System\kegpzGq.exe
  C:\Windows\System\kegpzGq.exe
  2⤵
  PID:3440
- C:\Windows\System\iVaHdaA.exe
  C:\Windows\System\iVaHdaA.exe
  2⤵
  PID:3456
- C:\Windows\System\beeRmYI.exe
  C:\Windows\System\beeRmYI.exe
  2⤵
  PID:3480
- C:\Windows\System\Ryonywb.exe
  C:\Windows\System\Ryonywb.exe
  2⤵
  PID:3496
- C:\Windows\System\NTzLfYY.exe
  C:\Windows\System\NTzLfYY.exe
  2⤵
  PID:3516
- C:\Windows\System\Legvrjn.exe
  C:\Windows\System\Legvrjn.exe
  2⤵
  PID:3532
- C:\Windows\System\xqbZxVz.exe
  C:\Windows\System\xqbZxVz.exe
  2⤵
  PID:3548
- C:\Windows\System\DIavxiu.exe
  C:\Windows\System\DIavxiu.exe
  2⤵
  PID:3564
- C:\Windows\System\tGYjmyi.exe
  C:\Windows\System\tGYjmyi.exe
  2⤵
  PID:3580
- C:\Windows\System\mDgNXas.exe
  C:\Windows\System\mDgNXas.exe
  2⤵
  PID:3596
- C:\Windows\System\pwJRjeP.exe
  C:\Windows\System\pwJRjeP.exe
  2⤵
  PID:3612
- C:\Windows\System\gmsKiws.exe
  C:\Windows\System\gmsKiws.exe
  2⤵
  PID:3628
- C:\Windows\System\Urocpjb.exe
  C:\Windows\System\Urocpjb.exe
  2⤵
  PID:3648
- C:\Windows\System\aEwomka.exe
  C:\Windows\System\aEwomka.exe
  2⤵
  PID:3676
- C:\Windows\System\akjHxfn.exe
  C:\Windows\System\akjHxfn.exe
  2⤵
  PID:3692
- C:\Windows\System\qQAdlpQ.exe
  C:\Windows\System\qQAdlpQ.exe
  2⤵
  PID:3708
- C:\Windows\System\lDColaR.exe
  C:\Windows\System\lDColaR.exe
  2⤵
  PID:3724
- C:\Windows\System\NpzztmT.exe
  C:\Windows\System\NpzztmT.exe
  2⤵
  PID:3740
- C:\Windows\System\mjDxCji.exe
  C:\Windows\System\mjDxCji.exe
  2⤵
  PID:3756
- C:\Windows\System\FgwtoKh.exe
  C:\Windows\System\FgwtoKh.exe
  2⤵
  PID:3772
- C:\Windows\System\VjJMtgB.exe
  C:\Windows\System\VjJMtgB.exe
  2⤵
  PID:3788
- C:\Windows\System\XgXPAHb.exe
  C:\Windows\System\XgXPAHb.exe
  2⤵
  PID:3804
- C:\Windows\System\hxeACLc.exe
  C:\Windows\System\hxeACLc.exe
  2⤵
  PID:3820
- C:\Windows\System\sCzKELi.exe
  C:\Windows\System\sCzKELi.exe
  2⤵
  PID:3836
- C:\Windows\System\pBkILxp.exe
  C:\Windows\System\pBkILxp.exe
  2⤵
  PID:3852
- C:\Windows\System\JbZuomg.exe
  C:\Windows\System\JbZuomg.exe
  2⤵
  PID:3868
- C:\Windows\System\sVrviFQ.exe
  C:\Windows\System\sVrviFQ.exe
  2⤵
  PID:3884
- C:\Windows\System\SbslfnO.exe
  C:\Windows\System\SbslfnO.exe
  2⤵
  PID:3900
- C:\Windows\System\FtGQZiU.exe
  C:\Windows\System\FtGQZiU.exe
  2⤵
  PID:3916
- C:\Windows\System\EKFOKXd.exe
  C:\Windows\System\EKFOKXd.exe
  2⤵
  PID:3932
- C:\Windows\System\XajYonP.exe
  C:\Windows\System\XajYonP.exe
  2⤵
  PID:3952
- C:\Windows\System\fddCqNY.exe
  C:\Windows\System\fddCqNY.exe
  2⤵
  PID:3968
- C:\Windows\System\kjPNTQj.exe
  C:\Windows\System\kjPNTQj.exe
  2⤵
  PID:3984
- C:\Windows\System\FIMifii.exe
  C:\Windows\System\FIMifii.exe
  2⤵
  PID:4000
- C:\Windows\System\CxjmIGr.exe
  C:\Windows\System\CxjmIGr.exe
  2⤵
  PID:4016
- C:\Windows\System\vLhopkK.exe
  C:\Windows\System\vLhopkK.exe
  2⤵
  PID:4032
- C:\Windows\System\rXTUNkk.exe
  C:\Windows\System\rXTUNkk.exe
  2⤵
  PID:4048
- C:\Windows\System\pzcixcE.exe
  C:\Windows\System\pzcixcE.exe
  2⤵
  PID:4064
- C:\Windows\System\beDpKvZ.exe
  C:\Windows\System\beDpKvZ.exe
  2⤵
  PID:4080
- C:\Windows\System\lqAdpDl.exe
  C:\Windows\System\lqAdpDl.exe
  2⤵
  PID:844
- C:\Windows\System\qyAjGwX.exe
  C:\Windows\System\qyAjGwX.exe
  2⤵
  PID:2748
- C:\Windows\System\ugSLNEl.exe
  C:\Windows\System\ugSLNEl.exe
  2⤵
  PID:2192
- C:\Windows\System\oRVtwmJ.exe
  C:\Windows\System\oRVtwmJ.exe
  2⤵
  PID:2776
- C:\Windows\System\cANwzff.exe
  C:\Windows\System\cANwzff.exe
  2⤵
  PID:2968
- C:\Windows\System\beBaulX.exe
  C:\Windows\System\beBaulX.exe
  2⤵
  PID:288
- C:\Windows\System\jpjSWuI.exe
  C:\Windows\System\jpjSWuI.exe
  2⤵
  PID:684
- C:\Windows\System\VUzwxoL.exe
  C:\Windows\System\VUzwxoL.exe
  2⤵
  PID:1964
- C:\Windows\System\uwSGpPt.exe
  C:\Windows\System\uwSGpPt.exe
  2⤵
  PID:3088
- C:\Windows\System\NBaqPzw.exe
  C:\Windows\System\NBaqPzw.exe
  2⤵
  PID:2676
- C:\Windows\System\kQQtrld.exe
  C:\Windows\System\kQQtrld.exe
  2⤵
  PID:2372
- C:\Windows\System\pOoiCOP.exe
  C:\Windows\System\pOoiCOP.exe
  2⤵
  PID:3116
- C:\Windows\System\GBeaGoS.exe
  C:\Windows\System\GBeaGoS.exe
  2⤵
  PID:344
- C:\Windows\System\EZNJkET.exe
  C:\Windows\System\EZNJkET.exe
  2⤵
  PID:3132
- C:\Windows\System\IhWPcXp.exe
  C:\Windows\System\IhWPcXp.exe
  2⤵
  PID:3192
- C:\Windows\System\gxNrCHe.exe
  C:\Windows\System\gxNrCHe.exe
  2⤵
  PID:1408
- C:\Windows\System\vLZmAFB.exe
  C:\Windows\System\vLZmAFB.exe
  2⤵
  PID:3232
- C:\Windows\System\FzETlPU.exe
  C:\Windows\System\FzETlPU.exe
  2⤵
  PID:848
- C:\Windows\System\cJtgnHD.exe
  C:\Windows\System\cJtgnHD.exe
  2⤵
  PID:2320
- C:\Windows\System\lyqbIfL.exe
  C:\Windows\System\lyqbIfL.exe
  2⤵
  PID:3248
- C:\Windows\System\rkLvMEY.exe
  C:\Windows\System\rkLvMEY.exe
  2⤵
  PID:3276
- C:\Windows\System\nopyzzT.exe
  C:\Windows\System\nopyzzT.exe
  2⤵
  PID:3288
- C:\Windows\System\UapINiJ.exe
  C:\Windows\System\UapINiJ.exe
  2⤵
  PID:3344
- C:\Windows\System\jsWiZtw.exe
  C:\Windows\System\jsWiZtw.exe
  2⤵
  PID:3332
- C:\Windows\System\DGCaZBe.exe
  C:\Windows\System\DGCaZBe.exe
  2⤵
  PID:2984
- C:\Windows\System\bZjrXbr.exe
  C:\Windows\System\bZjrXbr.exe
  2⤵
  PID:2520
- C:\Windows\System\BsJkRpF.exe
  C:\Windows\System\BsJkRpF.exe
  2⤵
  PID:3372
- C:\Windows\System\dbKzjyy.exe
  C:\Windows\System\dbKzjyy.exe
  2⤵
  PID:3412
- C:\Windows\System\LejUaDZ.exe
  C:\Windows\System\LejUaDZ.exe
  2⤵
  PID:2364
- C:\Windows\System\TZbRcfq.exe
  C:\Windows\System\TZbRcfq.exe
  2⤵
  PID:3472
- C:\Windows\System\aqzoUAx.exe
  C:\Windows\System\aqzoUAx.exe
  2⤵
  PID:3448
- C:\Windows\System\SfGMHQk.exe
  C:\Windows\System\SfGMHQk.exe
  2⤵
  PID:3544
- C:\Windows\System\LxHRMpY.exe
  C:\Windows\System\LxHRMpY.exe
  2⤵
  PID:3604
- C:\Windows\System\rxHgxWK.exe
  C:\Windows\System\rxHgxWK.exe
  2⤵
  PID:3640
- C:\Windows\System\pMJNrZE.exe
  C:\Windows\System\pMJNrZE.exe
  2⤵
  PID:3556
- C:\Windows\System\DVMODrN.exe
  C:\Windows\System\DVMODrN.exe
  2⤵
  PID:3620
- C:\Windows\System\KAOoIgV.exe
  C:\Windows\System\KAOoIgV.exe
  2⤵
  PID:3668
- C:\Windows\System\rhtyREf.exe
  C:\Windows\System\rhtyREf.exe
  2⤵
  PID:3660
- C:\Windows\System\DIoUEzH.exe
  C:\Windows\System\DIoUEzH.exe
  2⤵
  PID:3704
- C:\Windows\System\XPnsidG.exe
  C:\Windows\System\XPnsidG.exe
  2⤵
  PID:3736
- C:\Windows\System\ZlyHCyq.exe
  C:\Windows\System\ZlyHCyq.exe
  2⤵
  PID:1716
- C:\Windows\System\puVEJIk.exe
  C:\Windows\System\puVEJIk.exe
  2⤵
  PID:3816
- C:\Windows\System\dPKlqMe.exe
  C:\Windows\System\dPKlqMe.exe
  2⤵
  PID:3828
- C:\Windows\System\todAadh.exe
  C:\Windows\System\todAadh.exe
  2⤵
  PID:3860
- C:\Windows\System\NOvNELF.exe
  C:\Windows\System\NOvNELF.exe
  2⤵
  PID:3864
- C:\Windows\System\PenkggE.exe
  C:\Windows\System\PenkggE.exe
  2⤵
  PID:3924
- C:\Windows\System\ZhXfrGd.exe
  C:\Windows\System\ZhXfrGd.exe
  2⤵
  PID:3960
- C:\Windows\System\ktxXUUE.exe
  C:\Windows\System\ktxXUUE.exe
  2⤵
  PID:3992
- C:\Windows\System\XTqJoar.exe
  C:\Windows\System\XTqJoar.exe
  2⤵
  PID:4040
- C:\Windows\System\zDBmlgD.exe
  C:\Windows\System\zDBmlgD.exe
  2⤵
  PID:4072
- C:\Windows\System\DcPHVxb.exe
  C:\Windows\System\DcPHVxb.exe
  2⤵
  PID:4088
- C:\Windows\System\cDZVyPk.exe
  C:\Windows\System\cDZVyPk.exe
  2⤵
  PID:2208
- C:\Windows\System\YlpVxos.exe
  C:\Windows\System\YlpVxos.exe
  2⤵
  PID:2608
- C:\Windows\System\qWUcmTQ.exe
  C:\Windows\System\qWUcmTQ.exe
  2⤵
  PID:2096
- C:\Windows\System\RVsXfez.exe
  C:\Windows\System\RVsXfez.exe
  2⤵
  PID:1216
- C:\Windows\System\TYMKzct.exe
  C:\Windows\System\TYMKzct.exe
  2⤵
  PID:324
- C:\Windows\System\wpipvIx.exe
  C:\Windows\System\wpipvIx.exe
  2⤵
  PID:3148
- C:\Windows\System\fYIclQO.exe
  C:\Windows\System\fYIclQO.exe
  2⤵
  PID:4104
- C:\Windows\System\RWdhiNN.exe
  C:\Windows\System\RWdhiNN.exe
  2⤵
  PID:4120
- C:\Windows\System\QHeXJBx.exe
  C:\Windows\System\QHeXJBx.exe
  2⤵
  PID:4136
- C:\Windows\System\HUzYUJH.exe
  C:\Windows\System\HUzYUJH.exe
  2⤵
  PID:4152
- C:\Windows\System\PddIVEZ.exe
  C:\Windows\System\PddIVEZ.exe
  2⤵
  PID:4168
- C:\Windows\System\IpgMncB.exe
  C:\Windows\System\IpgMncB.exe
  2⤵
  PID:4184
- C:\Windows\System\mWVinSZ.exe
  C:\Windows\System\mWVinSZ.exe
  2⤵
  PID:4400
- C:\Windows\System\hxxzNAH.exe
  C:\Windows\System\hxxzNAH.exe
  2⤵
  PID:4416
- C:\Windows\System\CFxHpxw.exe
  C:\Windows\System\CFxHpxw.exe
  2⤵
  PID:4436
- C:\Windows\System\VHDDeZV.exe
  C:\Windows\System\VHDDeZV.exe
  2⤵
  PID:4452
- C:\Windows\System\jhxDJGV.exe
  C:\Windows\System\jhxDJGV.exe
  2⤵
  PID:4468
- C:\Windows\System\mxvPaSm.exe
  C:\Windows\System\mxvPaSm.exe
  2⤵
  PID:4484
- C:\Windows\System\tRbwzlJ.exe
  C:\Windows\System\tRbwzlJ.exe
  2⤵
  PID:4500
- C:\Windows\System\nJnaUzJ.exe
  C:\Windows\System\nJnaUzJ.exe
  2⤵
  PID:4516
- C:\Windows\System\igforYs.exe
  C:\Windows\System\igforYs.exe
  2⤵
  PID:4532
- C:\Windows\System\DdGCwNT.exe
  C:\Windows\System\DdGCwNT.exe
  2⤵
  PID:4548
- C:\Windows\System\tySPxop.exe
  C:\Windows\System\tySPxop.exe
  2⤵
  PID:4564
- C:\Windows\System\StZJWPT.exe
  C:\Windows\System\StZJWPT.exe
  2⤵
  PID:4580
- C:\Windows\System\eaRLlRV.exe
  C:\Windows\System\eaRLlRV.exe
  2⤵
  PID:4596
- C:\Windows\System\xvghSze.exe
  C:\Windows\System\xvghSze.exe
  2⤵
  PID:4612
- C:\Windows\System\svpflgJ.exe
  C:\Windows\System\svpflgJ.exe
  2⤵
  PID:4628
- C:\Windows\System\KZXUgWK.exe
  C:\Windows\System\KZXUgWK.exe
  2⤵
  PID:4644
- C:\Windows\System\MYvIcFJ.exe
  C:\Windows\System\MYvIcFJ.exe
  2⤵
  PID:4660
- C:\Windows\System\yFPNEOL.exe
  C:\Windows\System\yFPNEOL.exe
  2⤵
  PID:4680
- C:\Windows\System\uOYQzwS.exe
  C:\Windows\System\uOYQzwS.exe
  2⤵
  PID:4696
- C:\Windows\System\KTntRQb.exe
  C:\Windows\System\KTntRQb.exe
  2⤵
  PID:4712
- C:\Windows\System\xmBqFcJ.exe
  C:\Windows\System\xmBqFcJ.exe
  2⤵
  PID:4728
- C:\Windows\System\CFdXkgd.exe
  C:\Windows\System\CFdXkgd.exe
  2⤵
  PID:4744
- C:\Windows\System\UTDdiqY.exe
  C:\Windows\System\UTDdiqY.exe
  2⤵
  PID:4760
- C:\Windows\System\bNHsBTv.exe
  C:\Windows\System\bNHsBTv.exe
  2⤵
  PID:4776
- C:\Windows\System\yoUjANP.exe
  C:\Windows\System\yoUjANP.exe
  2⤵
  PID:4792
- C:\Windows\System\FdBqweC.exe
  C:\Windows\System\FdBqweC.exe
  2⤵
  PID:4808
- C:\Windows\System\yUpXHjf.exe
  C:\Windows\System\yUpXHjf.exe
  2⤵
  PID:4824
- C:\Windows\System\uCwZmsr.exe
  C:\Windows\System\uCwZmsr.exe
  2⤵
  PID:4840
- C:\Windows\System\RlUPcin.exe
  C:\Windows\System\RlUPcin.exe
  2⤵
  PID:4856
- C:\Windows\System\OvgIpKq.exe
  C:\Windows\System\OvgIpKq.exe
  2⤵
  PID:4872
- C:\Windows\System\QSaHJbi.exe
  C:\Windows\System\QSaHJbi.exe
  2⤵
  PID:4888
- C:\Windows\System\pZpvfvf.exe
  C:\Windows\System\pZpvfvf.exe
  2⤵
  PID:4904
- C:\Windows\System\mXKnnuz.exe
  C:\Windows\System\mXKnnuz.exe
  2⤵
  PID:4920
- C:\Windows\System\bBBiQEv.exe
  C:\Windows\System\bBBiQEv.exe
  2⤵
  PID:4936
- C:\Windows\System\rpIXIEz.exe
  C:\Windows\System\rpIXIEz.exe
  2⤵
  PID:4952
- C:\Windows\System\fUqRcVt.exe
  C:\Windows\System\fUqRcVt.exe
  2⤵
  PID:4968
- C:\Windows\System\jUhxfev.exe
  C:\Windows\System\jUhxfev.exe
  2⤵
  PID:4984
- C:\Windows\System\gTZYlyy.exe
  C:\Windows\System\gTZYlyy.exe
  2⤵
  PID:5000
- C:\Windows\System\MSKwiSS.exe
  C:\Windows\System\MSKwiSS.exe
  2⤵
  PID:5016
- C:\Windows\System\tFnrJio.exe
  C:\Windows\System\tFnrJio.exe
  2⤵
  PID:5032
- C:\Windows\System\bowwIfH.exe
  C:\Windows\System\bowwIfH.exe
  2⤵
  PID:5048
- C:\Windows\System\okDGobL.exe
  C:\Windows\System\okDGobL.exe
  2⤵
  PID:5064
- C:\Windows\System\RdatsQb.exe
  C:\Windows\System\RdatsQb.exe
  2⤵
  PID:5080
- C:\Windows\System\RrxGTKD.exe
  C:\Windows\System\RrxGTKD.exe
  2⤵
  PID:5096
- C:\Windows\System\dBhotZo.exe
  C:\Windows\System\dBhotZo.exe
  2⤵
  PID:5112
- C:\Windows\System\zIhmcPp.exe
  C:\Windows\System\zIhmcPp.exe
  2⤵
  PID:3152
- C:\Windows\System\wUlAopt.exe
  C:\Windows\System\wUlAopt.exe
  2⤵
  PID:3896
- C:\Windows\System\svaCMxj.exe
  C:\Windows\System\svaCMxj.exe
  2⤵
  PID:1304
- C:\Windows\System\DExGQet.exe
  C:\Windows\System\DExGQet.exe
  2⤵
  PID:3352
- C:\Windows\System\WmYgNlR.exe
  C:\Windows\System\WmYgNlR.exe
  2⤵
  PID:3396
- C:\Windows\System\XGRpmid.exe
  C:\Windows\System\XGRpmid.exe
  2⤵
  PID:3468
- C:\Windows\System\gzVQfxA.exe
  C:\Windows\System\gzVQfxA.exe
  2⤵
  PID:3644
- C:\Windows\System\NBFFNac.exe
  C:\Windows\System\NBFFNac.exe
  2⤵
  PID:3752
- C:\Windows\System\coguGXL.exe
  C:\Windows\System\coguGXL.exe
  2⤵
  PID:3848
- C:\Windows\System\LrmntRC.exe
  C:\Windows\System\LrmntRC.exe
  2⤵
  PID:3964
- C:\Windows\System\zllGzYm.exe
  C:\Windows\System\zllGzYm.exe
  2⤵
  PID:1476
- C:\Windows\System\OoCnLHW.exe
  C:\Windows\System\OoCnLHW.exe
  2⤵
  PID:4132
- C:\Windows\System\svYLlhw.exe
  C:\Windows\System\svYLlhw.exe
  2⤵
  PID:4196
- C:\Windows\System\HprBtHg.exe
  C:\Windows\System\HprBtHg.exe
  2⤵
  PID:4212
- C:\Windows\System\EAywtpX.exe
  C:\Windows\System\EAywtpX.exe
  2⤵
  PID:4228
- C:\Windows\System\GNjRdHq.exe
  C:\Windows\System\GNjRdHq.exe
  2⤵
  PID:4244
- C:\Windows\System\pJLirlY.exe
  C:\Windows\System\pJLirlY.exe
  2⤵
  PID:4260
- C:\Windows\System\WuLYJAR.exe
  C:\Windows\System\WuLYJAR.exe
  2⤵
  PID:4280
- C:\Windows\System\MbukgHV.exe
  C:\Windows\System\MbukgHV.exe
  2⤵
  PID:4292
- C:\Windows\System\oKOSedz.exe
  C:\Windows\System\oKOSedz.exe
  2⤵
  PID:4308
- C:\Windows\System\cuPEdNc.exe
  C:\Windows\System\cuPEdNc.exe
  2⤵
  PID:3156
- C:\Windows\System\UhJZHwd.exe
  C:\Windows\System\UhJZHwd.exe
  2⤵
  PID:2512
- C:\Windows\System\nowGHvE.exe
  C:\Windows\System\nowGHvE.exe
  2⤵
  PID:2812
- C:\Windows\System\jBXLaBt.exe
  C:\Windows\System\jBXLaBt.exe
  2⤵
  PID:4348
- C:\Windows\System\pmQvFcB.exe
  C:\Windows\System\pmQvFcB.exe
  2⤵
  PID:3608
- C:\Windows\System\XLgixAk.exe
  C:\Windows\System\XLgixAk.exe
  2⤵
  PID:2424
- C:\Windows\System\fOAndTr.exe
  C:\Windows\System\fOAndTr.exe
  2⤵
  PID:1176
- C:\Windows\System\maooGxG.exe
  C:\Windows\System\maooGxG.exe
  2⤵
  PID:4112
- C:\Windows\System\PcpyMSO.exe
  C:\Windows\System\PcpyMSO.exe
  2⤵
  PID:2248
- C:\Windows\System\GvFJhoV.exe
  C:\Windows\System\GvFJhoV.exe
  2⤵
  PID:2276
- C:\Windows\System\GdWMKmj.exe
  C:\Windows\System\GdWMKmj.exe
  2⤵
  PID:4352
- C:\Windows\System\VUpqoiI.exe
  C:\Windows\System\VUpqoiI.exe
  2⤵
  PID:2548
- C:\Windows\System\pZdBdQC.exe
  C:\Windows\System\pZdBdQC.exe
  2⤵
  PID:3492
- C:\Windows\System\rQZNwVx.exe
  C:\Windows\System\rQZNwVx.exe
  2⤵
  PID:3292
- C:\Windows\System\mtHrvzy.exe
  C:\Windows\System\mtHrvzy.exe
  2⤵
  PID:696
- C:\Windows\System\sGsUODV.exe
  C:\Windows\System\sGsUODV.exe
  2⤵
  PID:3528
- C:\Windows\System\YeivqHD.exe
  C:\Windows\System\YeivqHD.exe
  2⤵
  PID:3880
- C:\Windows\System\ABTuXnk.exe
  C:\Windows\System\ABTuXnk.exe
  2⤵
  PID:4076
- C:\Windows\System\uEBlAWK.exe
  C:\Windows\System\uEBlAWK.exe
  2⤵
  PID:4148
- C:\Windows\System\bSnfavD.exe
  C:\Windows\System\bSnfavD.exe
  2⤵
  PID:4448
- C:\Windows\System\DvhBTWK.exe
  C:\Windows\System\DvhBTWK.exe
  2⤵
  PID:4592
- C:\Windows\System\LVyoJWP.exe
  C:\Windows\System\LVyoJWP.exe
  2⤵
  PID:4652
- C:\Windows\System\YtzqBaS.exe
  C:\Windows\System\YtzqBaS.exe
  2⤵
  PID:4720
- C:\Windows\System\JqtlEtJ.exe
  C:\Windows\System\JqtlEtJ.exe
  2⤵
  PID:4784
- C:\Windows\System\bbpCdmk.exe
  C:\Windows\System\bbpCdmk.exe
  2⤵
  PID:4848
- C:\Windows\System\HkVNBNo.exe
  C:\Windows\System\HkVNBNo.exe
  2⤵
  PID:4912
- C:\Windows\System\LbvCssE.exe
  C:\Windows\System\LbvCssE.exe
  2⤵
  PID:3588
- C:\Windows\System\uDMArOh.exe
  C:\Windows\System\uDMArOh.exe
  2⤵
  PID:4236
- C:\Windows\System\bFXZDzD.exe
  C:\Windows\System\bFXZDzD.exe
  2⤵
  PID:5056
- C:\Windows\System\hKekMPF.exe
  C:\Windows\System\hKekMPF.exe
  2⤵
  PID:3636
- C:\Windows\System\OSgguxS.exe
  C:\Windows\System\OSgguxS.exe
  2⤵
  PID:3432
- C:\Windows\System\OiWtYSg.exe
  C:\Windows\System\OiWtYSg.exe
  2⤵
  PID:3008
- C:\Windows\System\iPTklod.exe
  C:\Windows\System\iPTklod.exe
  2⤵
  PID:3784
- C:\Windows\System\rJDkppw.exe
  C:\Windows\System\rJDkppw.exe
  2⤵
  PID:4528
- C:\Windows\System\ArTMSxN.exe
  C:\Windows\System\ArTMSxN.exe
  2⤵
  PID:4444
- C:\Windows\System\IyUFhbZ.exe
  C:\Windows\System\IyUFhbZ.exe
  2⤵
  PID:4588
- C:\Windows\System\knDxSnn.exe
  C:\Windows\System\knDxSnn.exe
  2⤵
  PID:4752
- C:\Windows\System\BZHqFkL.exe
  C:\Windows\System\BZHqFkL.exe
  2⤵
  PID:4816
- C:\Windows\System\weQHWvR.exe
  C:\Windows\System\weQHWvR.exe
  2⤵
  PID:4576
- C:\Windows\System\KHMcIWD.exe
  C:\Windows\System\KHMcIWD.exe
  2⤵
  PID:4704
- C:\Windows\System\VLQvaZV.exe
  C:\Windows\System\VLQvaZV.exe
  2⤵
  PID:5040
- C:\Windows\System\rxiJyPp.exe
  C:\Windows\System\rxiJyPp.exe
  2⤵
  PID:3912
- C:\Windows\System\fPwqBJD.exe
  C:\Windows\System\fPwqBJD.exe
  2⤵
  PID:4864
- C:\Windows\System\KyISDsX.exe
  C:\Windows\System\KyISDsX.exe
  2⤵
  PID:3796
- C:\Windows\System\ZrZmiuK.exe
  C:\Windows\System\ZrZmiuK.exe
  2⤵
  PID:4252
- C:\Windows\System\wxHTqSg.exe
  C:\Windows\System\wxHTqSg.exe
  2⤵
  PID:4320
- C:\Windows\System\IGjKZJK.exe
  C:\Windows\System\IGjKZJK.exe
  2⤵
  PID:3508
- C:\Windows\System\gJVQFlx.exe
  C:\Windows\System\gJVQFlx.exe
  2⤵
  PID:3268
- C:\Windows\System\HIDKHlD.exe
  C:\Windows\System\HIDKHlD.exe
  2⤵
  PID:3996
- C:\Windows\System\oFOWGiX.exe
  C:\Windows\System\oFOWGiX.exe
  2⤵
  PID:3256
- C:\Windows\System\cOfFLRI.exe
  C:\Windows\System\cOfFLRI.exe
  2⤵
  PID:2620
- C:\Windows\System\LMIjEpA.exe
  C:\Windows\System\LMIjEpA.exe
  2⤵
  PID:3928
- C:\Windows\System\FMhxOBn.exe
  C:\Windows\System\FMhxOBn.exe
  2⤵
  PID:4116
- C:\Windows\System\aGFpxzr.exe
  C:\Windows\System\aGFpxzr.exe
  2⤵
  PID:4432
- C:\Windows\System\KtRvmpo.exe
  C:\Windows\System\KtRvmpo.exe
  2⤵
  PID:4556
- C:\Windows\System\sknkcqZ.exe
  C:\Windows\System\sknkcqZ.exe
  2⤵
  PID:4692
- C:\Windows\System\TYhxYiN.exe
  C:\Windows\System\TYhxYiN.exe
  2⤵
  PID:4476
- C:\Windows\System\kTofdBf.exe
  C:\Windows\System\kTofdBf.exe
  2⤵
  PID:4948
- C:\Windows\System\HDDjaNf.exe
  C:\Windows\System\HDDjaNf.exe
  2⤵
  PID:4636
- C:\Windows\System\KoCWMDE.exe
  C:\Windows\System\KoCWMDE.exe
  2⤵
  PID:3212
- C:\Windows\System\gnhCgny.exe
  C:\Windows\System\gnhCgny.exe
  2⤵
  PID:3780
- C:\Windows\System\UVBPPUq.exe
  C:\Windows\System\UVBPPUq.exe
  2⤵
  PID:3436
- C:\Windows\System\Cqyqlwa.exe
  C:\Windows\System\Cqyqlwa.exe
  2⤵
  PID:4736
- C:\Windows\System\lgYmZlX.exe
  C:\Windows\System\lgYmZlX.exe
  2⤵
  PID:3172
- C:\Windows\System\HFpVTLi.exe
  C:\Windows\System\HFpVTLi.exe
  2⤵
  PID:4772
- C:\Windows\System\bxPIQay.exe
  C:\Windows\System\bxPIQay.exe
  2⤵
  PID:1532
- C:\Windows\System\XABuKWJ.exe
  C:\Windows\System\XABuKWJ.exe
  2⤵
  PID:4204
- C:\Windows\System\BvzkLiW.exe
  C:\Windows\System\BvzkLiW.exe
  2⤵
  PID:4276
- C:\Windows\System\RMDFjUU.exe
  C:\Windows\System\RMDFjUU.exe
  2⤵
  PID:5024
- C:\Windows\System\fwNYkhG.exe
  C:\Windows\System\fwNYkhG.exe
  2⤵
  PID:3356
- C:\Windows\System\pgkGFtk.exe
  C:\Windows\System\pgkGFtk.exe
  2⤵
  PID:4328
- C:\Windows\System\gnlIeKS.exe
  C:\Windows\System\gnlIeKS.exe
  2⤵
  PID:4164
- C:\Windows\System\CFBaicE.exe
  C:\Windows\System\CFBaicE.exe
  2⤵
  PID:4288
- C:\Windows\System\MilxtiW.exe
  C:\Windows\System\MilxtiW.exe
  2⤵
  PID:5124
- C:\Windows\System\bgYGLdx.exe
  C:\Windows\System\bgYGLdx.exe
  2⤵
  PID:5144
- C:\Windows\System\xGGfiCH.exe
  C:\Windows\System\xGGfiCH.exe
  2⤵
  PID:5160
- C:\Windows\System\KAEnHsf.exe
  C:\Windows\System\KAEnHsf.exe
  2⤵
  PID:5176
- C:\Windows\System\lwhGYHX.exe
  C:\Windows\System\lwhGYHX.exe
  2⤵
  PID:5192
- C:\Windows\System\yyVsRXT.exe
  C:\Windows\System\yyVsRXT.exe
  2⤵
  PID:5208
- C:\Windows\System\fruslKc.exe
  C:\Windows\System\fruslKc.exe
  2⤵
  PID:5228
- C:\Windows\System\xZZJRKR.exe
  C:\Windows\System\xZZJRKR.exe
  2⤵
  PID:5244
- C:\Windows\System\HsTmftW.exe
  C:\Windows\System\HsTmftW.exe
  2⤵
  PID:5332
- C:\Windows\System\CQzekZy.exe
  C:\Windows\System\CQzekZy.exe
  2⤵
  PID:5352
- C:\Windows\System\aAyuilZ.exe
  C:\Windows\System\aAyuilZ.exe
  2⤵
  PID:5368
- C:\Windows\System\MtzdADo.exe
  C:\Windows\System\MtzdADo.exe
  2⤵
  PID:5384
- C:\Windows\System\TFoblDt.exe
  C:\Windows\System\TFoblDt.exe
  2⤵
  PID:5400
- C:\Windows\System\eeulwko.exe
  C:\Windows\System\eeulwko.exe
  2⤵
  PID:5416
- C:\Windows\System\zCPdmTl.exe
  C:\Windows\System\zCPdmTl.exe
  2⤵
  PID:5432
- C:\Windows\System\cHxOuEw.exe
  C:\Windows\System\cHxOuEw.exe
  2⤵
  PID:5448
- C:\Windows\System\AszQLSN.exe
  C:\Windows\System\AszQLSN.exe
  2⤵
  PID:5468
- C:\Windows\System\TCKPvMf.exe
  C:\Windows\System\TCKPvMf.exe
  2⤵
  PID:5484
- C:\Windows\System\USOrazX.exe
  C:\Windows\System\USOrazX.exe
  2⤵
  PID:5500
- C:\Windows\System\QspHjbV.exe
  C:\Windows\System\QspHjbV.exe
  2⤵
  PID:5516
- C:\Windows\System\INnFVYp.exe
  C:\Windows\System\INnFVYp.exe
  2⤵
  PID:5532
- C:\Windows\System\sXpygdk.exe
  C:\Windows\System\sXpygdk.exe
  2⤵
  PID:5548
- C:\Windows\System\NjRnVCX.exe
  C:\Windows\System\NjRnVCX.exe
  2⤵
  PID:5564
- C:\Windows\System\foZAXAw.exe
  C:\Windows\System\foZAXAw.exe
  2⤵
  PID:5580
- C:\Windows\System\xCMuSoJ.exe
  C:\Windows\System\xCMuSoJ.exe
  2⤵
  PID:5596
- C:\Windows\System\tIIfueX.exe
  C:\Windows\System\tIIfueX.exe
  2⤵
  PID:5612
- C:\Windows\System\GCRfPwH.exe
  C:\Windows\System\GCRfPwH.exe
  2⤵
  PID:5772
- C:\Windows\System\JDbAJvA.exe
  C:\Windows\System\JDbAJvA.exe
  2⤵
  PID:5788
- C:\Windows\System\dDJvwjm.exe
  C:\Windows\System\dDJvwjm.exe
  2⤵
  PID:5804
- C:\Windows\System\BknUNLP.exe
  C:\Windows\System\BknUNLP.exe
  2⤵
  PID:5820
- C:\Windows\System\ZyhcZBE.exe
  C:\Windows\System\ZyhcZBE.exe
  2⤵
  PID:5836
- C:\Windows\System\GgqBiYe.exe
  C:\Windows\System\GgqBiYe.exe
  2⤵
  PID:5852
- C:\Windows\System\GOTtbIM.exe
  C:\Windows\System\GOTtbIM.exe
  2⤵
  PID:5868
- C:\Windows\System\pMETlRU.exe
  C:\Windows\System\pMETlRU.exe
  2⤵
  PID:5884
- C:\Windows\System\ZJFlEBi.exe
  C:\Windows\System\ZJFlEBi.exe
  2⤵
  PID:5900
- C:\Windows\System\pqXTkzi.exe
  C:\Windows\System\pqXTkzi.exe
  2⤵
  PID:5920
- C:\Windows\System\oApOcgZ.exe
  C:\Windows\System\oApOcgZ.exe
  2⤵
  PID:5936
- C:\Windows\System\FRuXkcF.exe
  C:\Windows\System\FRuXkcF.exe
  2⤵
  PID:5952
- C:\Windows\System\FldSrAj.exe
  C:\Windows\System\FldSrAj.exe
  2⤵
  PID:5968
- C:\Windows\System\AtSoaVa.exe
  C:\Windows\System\AtSoaVa.exe
  2⤵
  PID:5984
- C:\Windows\System\KBGhaql.exe
  C:\Windows\System\KBGhaql.exe
  2⤵
  PID:6008
- C:\Windows\System\witxnyh.exe
  C:\Windows\System\witxnyh.exe
  2⤵
  PID:6024
- C:\Windows\System\jgJeJyt.exe
  C:\Windows\System\jgJeJyt.exe
  2⤵
  PID:6040
- C:\Windows\System\DEgxqJO.exe
  C:\Windows\System\DEgxqJO.exe
  2⤵
  PID:6056
- C:\Windows\System\RkzIaqq.exe
  C:\Windows\System\RkzIaqq.exe
  2⤵
  PID:6072
- C:\Windows\System\DiaRJwO.exe
  C:\Windows\System\DiaRJwO.exe
  2⤵
  PID:6088
- C:\Windows\System\xiRwWZi.exe
  C:\Windows\System\xiRwWZi.exe
  2⤵
  PID:6104
- C:\Windows\System\xwPCkIg.exe
  C:\Windows\System\xwPCkIg.exe
  2⤵
  PID:6120
- C:\Windows\System\fmHjFdu.exe
  C:\Windows\System\fmHjFdu.exe
  2⤵
  PID:6136
- C:\Windows\System\IuNtgOB.exe
  C:\Windows\System\IuNtgOB.exe
  2⤵
  PID:2820
- C:\Windows\System\WvTLyGL.exe
  C:\Windows\System\WvTLyGL.exe
  2⤵
  PID:3684
- C:\Windows\System\oqmvNQH.exe
  C:\Windows\System\oqmvNQH.exe
  2⤵
  PID:4688
- C:\Windows\System\xmrSGqa.exe
  C:\Windows\System\xmrSGqa.exe
  2⤵
  PID:4900
- C:\Windows\System\UhJRccK.exe
  C:\Windows\System\UhJRccK.exe
  2⤵
  PID:5076
- C:\Windows\System\FoyixVN.exe
  C:\Windows\System\FoyixVN.exe
  2⤵
  PID:4332
- C:\Windows\System\sznitqr.exe
  C:\Windows\System\sznitqr.exe
  2⤵
  PID:4608
- C:\Windows\System\vKoFILf.exe
  C:\Windows\System\vKoFILf.exe
  2⤵
  PID:4560
- C:\Windows\System\cOKZWlU.exe
  C:\Windows\System\cOKZWlU.exe
  2⤵
  PID:4336
- C:\Windows\System\sAqbyGK.exe
  C:\Windows\System\sAqbyGK.exe
  2⤵
  PID:5072
- C:\Windows\System\jPMNcbj.exe
  C:\Windows\System\jPMNcbj.exe
  2⤵
  PID:2816
- C:\Windows\System\mXPhoiH.exe
  C:\Windows\System\mXPhoiH.exe
  2⤵
  PID:4820
- C:\Windows\System\gGKuweN.exe
  C:\Windows\System\gGKuweN.exe
  2⤵
  PID:4464
- C:\Windows\System\GrlsHzE.exe
  C:\Windows\System\GrlsHzE.exe
  2⤵
  PID:4928
- C:\Windows\System\wOoxcPg.exe
  C:\Windows\System\wOoxcPg.exe
  2⤵
  PID:5092
- C:\Windows\System\EJoSYjn.exe
  C:\Windows\System\EJoSYjn.exe
  2⤵
  PID:2956
- C:\Windows\System\atpQpNm.exe
  C:\Windows\System\atpQpNm.exe
  2⤵
  PID:5140
- C:\Windows\System\yMaVThO.exe
  C:\Windows\System\yMaVThO.exe
  2⤵
  PID:5236
- C:\Windows\System\EsRTJrb.exe
  C:\Windows\System\EsRTJrb.exe
  2⤵
  PID:5256
- C:\Windows\System\untXJGT.exe
  C:\Windows\System\untXJGT.exe
  2⤵
  PID:3812
- C:\Windows\System\EfBrOaQ.exe
  C:\Windows\System\EfBrOaQ.exe
  2⤵
  PID:5168
- C:\Windows\System\VmcAGmp.exe
  C:\Windows\System\VmcAGmp.exe
  2⤵
  PID:5284
- C:\Windows\System\FPMygot.exe
  C:\Windows\System\FPMygot.exe
  2⤵
  PID:1892
- C:\Windows\System\DgqDaBc.exe
  C:\Windows\System\DgqDaBc.exe
  2⤵
  PID:5296
- C:\Windows\System\tKdldER.exe
  C:\Windows\System\tKdldER.exe
  2⤵
  PID:2220
- C:\Windows\System\iisOxpL.exe
  C:\Windows\System\iisOxpL.exe
  2⤵
  PID:5312
- C:\Windows\System\ffwSFfd.exe
  C:\Windows\System\ffwSFfd.exe
  2⤵
  PID:5328
- C:\Windows\System\VsedGcZ.exe
  C:\Windows\System\VsedGcZ.exe
  2⤵
  PID:5428
- C:\Windows\System\ZLuCSpL.exe
  C:\Windows\System\ZLuCSpL.exe
  2⤵
  PID:5348
- C:\Windows\System\LuNWMVX.exe
  C:\Windows\System\LuNWMVX.exe
  2⤵
  PID:5340
- C:\Windows\System\suAxxuO.exe
  C:\Windows\System\suAxxuO.exe
  2⤵
  PID:5380
- C:\Windows\System\DtbtjVi.exe
  C:\Windows\System\DtbtjVi.exe
  2⤵
  PID:5492
- C:\Windows\System\eDijIhw.exe
  C:\Windows\System\eDijIhw.exe
  2⤵
  PID:5556
- C:\Windows\System\saSLjMK.exe
  C:\Windows\System\saSLjMK.exe
  2⤵
  PID:5512
- C:\Windows\System\XrEPcBW.exe
  C:\Windows\System\XrEPcBW.exe
  2⤵
  PID:5544
- C:\Windows\System\HaXSCWI.exe
  C:\Windows\System\HaXSCWI.exe
  2⤵
  PID:5604
- C:\Windows\System\LUhmdxz.exe
  C:\Windows\System\LUhmdxz.exe
  2⤵
  PID:5632
- C:\Windows\System\XjdwUPt.exe
  C:\Windows\System\XjdwUPt.exe
  2⤵
  PID:5652
- C:\Windows\System\AvLVqtG.exe
  C:\Windows\System\AvLVqtG.exe
  2⤵
  PID:5668
- C:\Windows\System\HbDCGTj.exe
  C:\Windows\System\HbDCGTj.exe
  2⤵
  PID:5684
- C:\Windows\System\AzdOWDz.exe
  C:\Windows\System\AzdOWDz.exe
  2⤵
  PID:5700
- C:\Windows\System\lWEDcji.exe
  C:\Windows\System\lWEDcji.exe
  2⤵
  PID:5712
- C:\Windows\System\foRRsZW.exe
  C:\Windows\System\foRRsZW.exe
  2⤵
  PID:5728
- C:\Windows\System\EEiUBGL.exe
  C:\Windows\System\EEiUBGL.exe
  2⤵
  PID:5744
- C:\Windows\System\OSEIMVU.exe
  C:\Windows\System\OSEIMVU.exe
  2⤵
  PID:5760
- C:\Windows\System\yvyLWxb.exe
  C:\Windows\System\yvyLWxb.exe
  2⤵
  PID:5800
- C:\Windows\System\djQWgrx.exe
  C:\Windows\System\djQWgrx.exe
  2⤵
  PID:5844
- C:\Windows\System\afTowAL.exe
  C:\Windows\System\afTowAL.exe
  2⤵
  PID:5780
- C:\Windows\System\xRnzmxA.exe
  C:\Windows\System\xRnzmxA.exe
  2⤵
  PID:5832
- C:\Windows\System\UcvihVN.exe
  C:\Windows\System\UcvihVN.exe
  2⤵
  PID:5992
- C:\Windows\System\eLjtVvn.exe
  C:\Windows\System\eLjtVvn.exe
  2⤵
  PID:5928
- C:\Windows\System\mRvtsXs.exe
  C:\Windows\System\mRvtsXs.exe
  2⤵
  PID:6096
- C:\Windows\System\PBvibuv.exe
  C:\Windows\System\PBvibuv.exe
  2⤵
  PID:6000
- C:\Windows\System\IPtreMj.exe
  C:\Windows\System\IPtreMj.exe
  2⤵
  PID:6132
- C:\Windows\System\QspdfiX.exe
  C:\Windows\System\QspdfiX.exe
  2⤵
  PID:2768
- C:\Windows\System\teMdcPb.exe
  C:\Windows\System\teMdcPb.exe
  2⤵
  PID:4284
- C:\Windows\System\yaTIRMx.exe
  C:\Windows\System\yaTIRMx.exe
  2⤵
  PID:4992
- C:\Windows\System\vEcvWeB.exe
  C:\Windows\System\vEcvWeB.exe
  2⤵
  PID:5204
- C:\Windows\System\OlGTosF.exe
  C:\Windows\System\OlGTosF.exe
  2⤵
  PID:5912
- C:\Windows\System\eUCdPuS.exe
  C:\Windows\System\eUCdPuS.exe
  2⤵
  PID:5964
- C:\Windows\System\lEuoKiV.exe
  C:\Windows\System\lEuoKiV.exe
  2⤵
  PID:5304
- C:\Windows\System\tuLFlBV.exe
  C:\Windows\System\tuLFlBV.exe
  2⤵
  PID:5344
- C:\Windows\System\rKtrlqp.exe
  C:\Windows\System\rKtrlqp.exe
  2⤵
  PID:5132
- C:\Windows\System\uRMZjMB.exe
  C:\Windows\System\uRMZjMB.exe
  2⤵
  PID:5572
- C:\Windows\System\ZXyHPDh.exe
  C:\Windows\System\ZXyHPDh.exe
  2⤵
  PID:6020
- C:\Windows\System\Yzjfnol.exe
  C:\Windows\System\Yzjfnol.exe
  2⤵
  PID:6084
- C:\Windows\System\hJMqcsV.exe
  C:\Windows\System\hJMqcsV.exe
  2⤵
  PID:4996
- C:\Windows\System\OzBdCMc.exe
  C:\Windows\System\OzBdCMc.exe
  2⤵
  PID:5252
- C:\Windows\System\QFpZrjH.exe
  C:\Windows\System\QFpZrjH.exe
  2⤵
  PID:4800
- C:\Windows\System\FrQxnSi.exe
  C:\Windows\System\FrQxnSi.exe
  2⤵
  PID:5272
- C:\Windows\System\JkVSZNm.exe
  C:\Windows\System\JkVSZNm.exe
  2⤵
  PID:5476
- C:\Windows\System\pkeUjPE.exe
  C:\Windows\System\pkeUjPE.exe
  2⤵
  PID:5812
- C:\Windows\System\jjMnKZt.exe
  C:\Windows\System\jjMnKZt.exe
  2⤵
  PID:5976
- C:\Windows\System\HzeDcoG.exe
  C:\Windows\System\HzeDcoG.exe
  2⤵
  PID:2420
- C:\Windows\System\RGvKdlP.exe
  C:\Windows\System\RGvKdlP.exe
  2⤵
  PID:5960
- C:\Windows\System\pNgCpsp.exe
  C:\Windows\System\pNgCpsp.exe
  2⤵
  PID:5396
- C:\Windows\System\YFOAuGH.exe
  C:\Windows\System\YFOAuGH.exe
  2⤵
  PID:5896
- C:\Windows\System\kFSfSmV.exe
  C:\Windows\System\kFSfSmV.exe
  2⤵
  PID:5696
- C:\Windows\System\lFIAgDy.exe
  C:\Windows\System\lFIAgDy.exe
  2⤵
  PID:5848
- C:\Windows\System\VAxhuGc.exe
  C:\Windows\System\VAxhuGc.exe
  2⤵
  PID:2524
- C:\Windows\System\EsPqcOJ.exe
  C:\Windows\System\EsPqcOJ.exe
  2⤵
  PID:4428
- C:\Windows\System\gbcFHuq.exe
  C:\Windows\System\gbcFHuq.exe
  2⤵
  PID:804
- C:\Windows\System\oNgZpYw.exe
  C:\Windows\System\oNgZpYw.exe
  2⤵
  PID:5264
- C:\Windows\System\egKzvZJ.exe
  C:\Windows\System\egKzvZJ.exe
  2⤵
  PID:6016
- C:\Windows\System\ztnfnTU.exe
  C:\Windows\System\ztnfnTU.exe
  2⤵
  PID:5292
- C:\Windows\System\CgazkKQ.exe
  C:\Windows\System\CgazkKQ.exe
  2⤵
  PID:5640
- C:\Windows\System\ULvfSEj.exe
  C:\Windows\System\ULvfSEj.exe
  2⤵
  PID:5152
- C:\Windows\System\ZdryAMv.exe
  C:\Windows\System\ZdryAMv.exe
  2⤵
  PID:5320
- C:\Windows\System\PaLRDYJ.exe
  C:\Windows\System\PaLRDYJ.exe
  2⤵
  PID:6080
- C:\Windows\System\PsQozci.exe
  C:\Windows\System\PsQozci.exe
  2⤵
  PID:5136
- C:\Windows\System\OnWttdu.exe
  C:\Windows\System\OnWttdu.exe
  2⤵
  PID:5188
- C:\Windows\System\GqVulKy.exe
  C:\Windows\System\GqVulKy.exe
  2⤵
  PID:5708
- C:\Windows\System\lxNsrQh.exe
  C:\Windows\System\lxNsrQh.exe
  2⤵
  PID:5660
- C:\Windows\System\jTCxwHX.exe
  C:\Windows\System\jTCxwHX.exe
  2⤵
  PID:5664
- C:\Windows\System\nfMstNC.exe
  C:\Windows\System\nfMstNC.exe
  2⤵
  PID:4300
- C:\Windows\System\rrKovHP.exe
  C:\Windows\System\rrKovHP.exe
  2⤵
  PID:5408
- C:\Windows\System\ocJuRXb.exe
  C:\Windows\System\ocJuRXb.exe
  2⤵
  PID:5752
- C:\Windows\System\QyRuwTI.exe
  C:\Windows\System\QyRuwTI.exe
  2⤵
  PID:4932
- C:\Windows\System\uCWlXew.exe
  C:\Windows\System\uCWlXew.exe
  2⤵
  PID:3316
- C:\Windows\System\pyDGUYV.exe
  C:\Windows\System\pyDGUYV.exe
  2⤵
  PID:5108
- C:\Windows\System\HLffOPm.exe
  C:\Windows\System\HLffOPm.exe
  2⤵
  PID:5412
- C:\Windows\System\EFWNIQZ.exe
  C:\Windows\System\EFWNIQZ.exe
  2⤵
  PID:5456
- C:\Windows\System\RVpBeKO.exe
  C:\Windows\System\RVpBeKO.exe
  2⤵
  PID:6052
- C:\Windows\System\DZondbU.exe
  C:\Windows\System\DZondbU.exe
  2⤵
  PID:2648
- C:\Windows\System\jmvYPZq.exe
  C:\Windows\System\jmvYPZq.exe
  2⤵
  PID:4496
- C:\Windows\System\JHWkUJQ.exe
  C:\Windows\System\JHWkUJQ.exe
  2⤵
  PID:5464
- C:\Windows\System\KRhbGqr.exe
  C:\Windows\System\KRhbGqr.exe
  2⤵
  PID:5880
- C:\Windows\System\yHwpTSD.exe
  C:\Windows\System\yHwpTSD.exe
  2⤵
  PID:4128
- C:\Windows\System\AWXVieq.exe
  C:\Windows\System\AWXVieq.exe
  2⤵
  PID:4708
- C:\Windows\System\vueyhCN.exe
  C:\Windows\System\vueyhCN.exe
  2⤵
  PID:5996
- C:\Windows\System\ESiHKvm.exe
  C:\Windows\System\ESiHKvm.exe
  2⤵
  PID:5648
- C:\Windows\System\LpJMrrO.exe
  C:\Windows\System\LpJMrrO.exe
  2⤵
  PID:6148
- C:\Windows\System\tnnOcqV.exe
  C:\Windows\System\tnnOcqV.exe
  2⤵
  PID:6164
- C:\Windows\System\lPMlYMs.exe
  C:\Windows\System\lPMlYMs.exe
  2⤵
  PID:6180
- C:\Windows\System\nLFNhqY.exe
  C:\Windows\System\nLFNhqY.exe
  2⤵
  PID:6196
- C:\Windows\System\IKhjkvW.exe
  C:\Windows\System\IKhjkvW.exe
  2⤵
  PID:6212
- C:\Windows\System\GlSrpbq.exe
  C:\Windows\System\GlSrpbq.exe
  2⤵
  PID:6228
- C:\Windows\System\HQhgnYx.exe
  C:\Windows\System\HQhgnYx.exe
  2⤵
  PID:6244
- C:\Windows\System\TmoOcwK.exe
  C:\Windows\System\TmoOcwK.exe
  2⤵
  PID:6264
- C:\Windows\System\lrrbewW.exe
  C:\Windows\System\lrrbewW.exe
  2⤵
  PID:6280
- C:\Windows\System\vsyXYmW.exe
  C:\Windows\System\vsyXYmW.exe
  2⤵
  PID:6296
- C:\Windows\System\oFNqiIK.exe
  C:\Windows\System\oFNqiIK.exe
  2⤵
  PID:6312
- C:\Windows\System\XrSHaWt.exe
  C:\Windows\System\XrSHaWt.exe
  2⤵
  PID:6328
- C:\Windows\System\fTgfHWJ.exe
  C:\Windows\System\fTgfHWJ.exe
  2⤵
  PID:6344
- C:\Windows\System\DSzWrzk.exe
  C:\Windows\System\DSzWrzk.exe
  2⤵
  PID:6360
- C:\Windows\System\NdEMpaO.exe
  C:\Windows\System\NdEMpaO.exe
  2⤵
  PID:6376
- C:\Windows\System\DfLwsFx.exe
  C:\Windows\System\DfLwsFx.exe
  2⤵
  PID:6392
- C:\Windows\System\nSnRgVc.exe
  C:\Windows\System\nSnRgVc.exe
  2⤵
  PID:6408
- C:\Windows\System\oKQEXtX.exe
  C:\Windows\System\oKQEXtX.exe
  2⤵
  PID:6424
- C:\Windows\System\HgUQbsz.exe
  C:\Windows\System\HgUQbsz.exe
  2⤵
  PID:6440
- C:\Windows\System\zNdvDuL.exe
  C:\Windows\System\zNdvDuL.exe
  2⤵
  PID:6456
- C:\Windows\System\haIDPqH.exe
  C:\Windows\System\haIDPqH.exe
  2⤵
  PID:6472
- C:\Windows\System\sykHpUM.exe
  C:\Windows\System\sykHpUM.exe
  2⤵
  PID:6488
- C:\Windows\System\rJGAxIx.exe
  C:\Windows\System\rJGAxIx.exe
  2⤵
  PID:6504
- C:\Windows\System\IIjuStX.exe
  C:\Windows\System\IIjuStX.exe
  2⤵
  PID:6520
- C:\Windows\System\XSKsGZe.exe
  C:\Windows\System\XSKsGZe.exe
  2⤵
  PID:6536
- C:\Windows\System\NnxRgBk.exe
  C:\Windows\System\NnxRgBk.exe
  2⤵
  PID:6552
- C:\Windows\System\smItelz.exe
  C:\Windows\System\smItelz.exe
  2⤵
  PID:6568
- C:\Windows\System\xOwKwlq.exe
  C:\Windows\System\xOwKwlq.exe
  2⤵
  PID:6584
- C:\Windows\System\OOqejuh.exe
  C:\Windows\System\OOqejuh.exe
  2⤵
  PID:6600
- C:\Windows\System\REJMoYZ.exe
  C:\Windows\System\REJMoYZ.exe
  2⤵
  PID:6616
- C:\Windows\System\AuzJJBw.exe
  C:\Windows\System\AuzJJBw.exe
  2⤵
  PID:6632
- C:\Windows\System\OGEzBzC.exe
  C:\Windows\System\OGEzBzC.exe
  2⤵
  PID:6648
- C:\Windows\System\KxfaTAe.exe
  C:\Windows\System\KxfaTAe.exe
  2⤵
  PID:6664
- C:\Windows\System\NSIjwbZ.exe
  C:\Windows\System\NSIjwbZ.exe
  2⤵
  PID:6680
- C:\Windows\System\vLIueqV.exe
  C:\Windows\System\vLIueqV.exe
  2⤵
  PID:6696
- C:\Windows\System\oOBgtkl.exe
  C:\Windows\System\oOBgtkl.exe
  2⤵
  PID:6712
- C:\Windows\System\BHuwbYW.exe
  C:\Windows\System\BHuwbYW.exe
  2⤵
  PID:6728
- C:\Windows\System\aMMYOLd.exe
  C:\Windows\System\aMMYOLd.exe
  2⤵
  PID:6744
- C:\Windows\System\DYwqXby.exe
  C:\Windows\System\DYwqXby.exe
  2⤵
  PID:6760
- C:\Windows\System\HneUcAM.exe
  C:\Windows\System\HneUcAM.exe
  2⤵
  PID:6776
- C:\Windows\System\cXWHKCZ.exe
  C:\Windows\System\cXWHKCZ.exe
  2⤵
  PID:6792
- C:\Windows\System\cSeQStU.exe
  C:\Windows\System\cSeQStU.exe
  2⤵
  PID:6808
- C:\Windows\System\ZHerFaJ.exe
  C:\Windows\System\ZHerFaJ.exe
  2⤵
  PID:6824
- C:\Windows\System\Tnfpdmk.exe
  C:\Windows\System\Tnfpdmk.exe
  2⤵
  PID:6840
- C:\Windows\System\yOIDBZi.exe
  C:\Windows\System\yOIDBZi.exe
  2⤵
  PID:6856
- C:\Windows\System\nUeMjCg.exe
  C:\Windows\System\nUeMjCg.exe
  2⤵
  PID:6872
- C:\Windows\System\ygwBlyl.exe
  C:\Windows\System\ygwBlyl.exe
  2⤵
  PID:6888
- C:\Windows\System\lfEPOIN.exe
  C:\Windows\System\lfEPOIN.exe
  2⤵
  PID:6904
- C:\Windows\System\wpyIeEg.exe
  C:\Windows\System\wpyIeEg.exe
  2⤵
  PID:6920
- C:\Windows\System\dPJlMux.exe
  C:\Windows\System\dPJlMux.exe
  2⤵
  PID:6936
- C:\Windows\System\FLFyQRy.exe
  C:\Windows\System\FLFyQRy.exe
  2⤵
  PID:6952
- C:\Windows\System\TnRwZFG.exe
  C:\Windows\System\TnRwZFG.exe
  2⤵
  PID:6968
- C:\Windows\System\KMEScvg.exe
  C:\Windows\System\KMEScvg.exe
  2⤵
  PID:6984
- C:\Windows\System\IOSOJjh.exe
  C:\Windows\System\IOSOJjh.exe
  2⤵
  PID:7000
- C:\Windows\System\USGOGqW.exe
  C:\Windows\System\USGOGqW.exe
  2⤵
  PID:7016
- C:\Windows\System\wujZkoU.exe
  C:\Windows\System\wujZkoU.exe
  2⤵
  PID:7032
- C:\Windows\System\ccYjLTp.exe
  C:\Windows\System\ccYjLTp.exe
  2⤵
  PID:7048
- C:\Windows\System\lvUqqMW.exe
  C:\Windows\System\lvUqqMW.exe
  2⤵
  PID:7064
- C:\Windows\System\XUmzfRr.exe
  C:\Windows\System\XUmzfRr.exe
  2⤵
  PID:7080
- C:\Windows\System\eTbzjil.exe
  C:\Windows\System\eTbzjil.exe
  2⤵
  PID:7096
- C:\Windows\System\rRudyrM.exe
  C:\Windows\System\rRudyrM.exe
  2⤵
  PID:7112
- C:\Windows\System\wFsPfRs.exe
  C:\Windows\System\wFsPfRs.exe
  2⤵
  PID:7128
- C:\Windows\System\agPoJTJ.exe
  C:\Windows\System\agPoJTJ.exe
  2⤵
  PID:7144
- C:\Windows\System\GCMHlDF.exe
  C:\Windows\System\GCMHlDF.exe
  2⤵
  PID:7160
- C:\Windows\System\OjZxKRy.exe
  C:\Windows\System\OjZxKRy.exe
  2⤵
  PID:6176
- C:\Windows\System\QNHFfAV.exe
  C:\Windows\System\QNHFfAV.exe
  2⤵
  PID:6240
- C:\Windows\System\vbPhLVM.exe
  C:\Windows\System\vbPhLVM.exe
  2⤵
  PID:6308
- C:\Windows\System\qhZPwTw.exe
  C:\Windows\System\qhZPwTw.exe
  2⤵
  PID:6372
- C:\Windows\System\JFMRivF.exe
  C:\Windows\System\JFMRivF.exe
  2⤵
  PID:6432
- C:\Windows\System\vqjeOuB.exe
  C:\Windows\System\vqjeOuB.exe
  2⤵
  PID:6288
- C:\Windows\System\ZwptYBB.exe
  C:\Windows\System\ZwptYBB.exe
  2⤵
  PID:6416
- C:\Windows\System\pSEyLeQ.exe
  C:\Windows\System\pSEyLeQ.exe
  2⤵
  PID:6528
- C:\Windows\System\mxtmzrE.exe
  C:\Windows\System\mxtmzrE.exe
  2⤵
  PID:6224
- C:\Windows\System\UoomMpe.exe
  C:\Windows\System\UoomMpe.exe
  2⤵
  PID:6324
- C:\Windows\System\TXgiYFm.exe
  C:\Windows\System\TXgiYFm.exe
  2⤵
  PID:6388
- C:\Windows\System\QZXkaig.exe
  C:\Windows\System\QZXkaig.exe
  2⤵
  PID:4980
- C:\Windows\System\PMDQDPK.exe
  C:\Windows\System\PMDQDPK.exe
  2⤵
  PID:6220
- C:\Windows\System\jNzdHWG.exe
  C:\Windows\System\jNzdHWG.exe
  2⤵
  PID:6480
- C:\Windows\System\zXvsqXJ.exe
  C:\Windows\System\zXvsqXJ.exe
  2⤵
  PID:6596
- C:\Windows\System\buVwHdn.exe
  C:\Windows\System\buVwHdn.exe
  2⤵
  PID:6660
- C:\Windows\System\oqtKBBb.exe
  C:\Windows\System\oqtKBBb.exe
  2⤵
  PID:6720
- C:\Windows\System\DgWVkUM.exe
  C:\Windows\System\DgWVkUM.exe
  2⤵
  PID:6784
- C:\Windows\System\TVITTbK.exe
  C:\Windows\System\TVITTbK.exe
  2⤵
  PID:6848
- C:\Windows\System\yeLNVnd.exe
  C:\Windows\System\yeLNVnd.exe
  2⤵
  PID:6912
- C:\Windows\System\MAHVFJZ.exe
  C:\Windows\System\MAHVFJZ.exe
  2⤵
  PID:6976
- C:\Windows\System\SDBPOIx.exe
  C:\Windows\System\SDBPOIx.exe
  2⤵
  PID:7012
- C:\Windows\System\xZsjVCp.exe
  C:\Windows\System\xZsjVCp.exe
  2⤵
  PID:7040
- C:\Windows\System\DKBZYtW.exe
  C:\Windows\System\DKBZYtW.exe
  2⤵
  PID:6900
- C:\Windows\System\GNRaQhL.exe
  C:\Windows\System\GNRaQhL.exe
  2⤵
  PID:6580
- C:\Windows\System\qRrjwGu.exe
  C:\Windows\System\qRrjwGu.exe
  2⤵
  PID:6992
- C:\Windows\System\elJlWUA.exe
  C:\Windows\System\elJlWUA.exe
  2⤵
  PID:6640
- C:\Windows\System\pOHmrse.exe
  C:\Windows\System\pOHmrse.exe
  2⤵
  PID:6800
- C:\Windows\System\jNYuTZI.exe
  C:\Windows\System\jNYuTZI.exe
  2⤵
  PID:6864
- C:\Windows\System\PYhFwdf.exe
  C:\Windows\System\PYhFwdf.exe
  2⤵
  PID:7076
- C:\Windows\System\PdoLacJ.exe
  C:\Windows\System\PdoLacJ.exe
  2⤵
  PID:7104
- C:\Windows\System\FGUlDkU.exe
  C:\Windows\System\FGUlDkU.exe
  2⤵
  PID:7136
- C:\Windows\System\pFQZLdr.exe
  C:\Windows\System\pFQZLdr.exe
  2⤵
  PID:7124
- C:\Windows\System\mzycqVk.exe
  C:\Windows\System\mzycqVk.exe
  2⤵
  PID:6404
- C:\Windows\System\nMmxkNE.exe
  C:\Windows\System\nMmxkNE.exe
  2⤵
  PID:6188
- C:\Windows\System\SkgoPPO.exe
  C:\Windows\System\SkgoPPO.exe
  2⤵
  PID:6192
- C:\Windows\System\PyrfTBM.exe
  C:\Windows\System\PyrfTBM.exe
  2⤵
  PID:6592
- C:\Windows\System\YcuLlBH.exe
  C:\Windows\System\YcuLlBH.exe
  2⤵
  PID:6532
- C:\Windows\System\OnPhDUx.exe
  C:\Windows\System\OnPhDUx.exe
  2⤵
  PID:6788
- C:\Windows\System\MwtZfUr.exe
  C:\Windows\System\MwtZfUr.exe
  2⤵
  PID:6612
- C:\Windows\System\nxnteCk.exe
  C:\Windows\System\nxnteCk.exe
  2⤵
  PID:7028
- C:\Windows\System\MwYffGd.exe
  C:\Windows\System\MwYffGd.exe
  2⤵
  PID:6236
- C:\Windows\System\QTCAxCn.exe
  C:\Windows\System\QTCAxCn.exe
  2⤵
  PID:6468
- C:\Windows\System\ZnavfKu.exe
  C:\Windows\System\ZnavfKu.exe
  2⤵
  PID:6256
- C:\Windows\System\eJTklIg.exe
  C:\Windows\System\eJTklIg.exe
  2⤵
  PID:5680
- C:\Windows\System\Zzweezz.exe
  C:\Windows\System\Zzweezz.exe
  2⤵
  PID:6704
- C:\Windows\System\QTrAzmy.exe
  C:\Windows\System\QTrAzmy.exe
  2⤵
  PID:6964
- C:\Windows\System\SWcdUcO.exe
  C:\Windows\System\SWcdUcO.exe
  2⤵
  PID:6996
- C:\Windows\System\eYdiIkq.exe
  C:\Windows\System\eYdiIkq.exe
  2⤵
  PID:7072
- C:\Windows\System\CsNwoNQ.exe
  C:\Windows\System\CsNwoNQ.exe
  2⤵
  PID:6564
- C:\Windows\System\UlQrHBJ.exe
  C:\Windows\System\UlQrHBJ.exe
  2⤵
  PID:6928
- C:\Windows\System\ZPbdyUk.exe
  C:\Windows\System\ZPbdyUk.exe
  2⤵
  PID:6752
- C:\Windows\System\eFsStiB.exe
  C:\Windows\System\eFsStiB.exe
  2⤵
  PID:7120
- C:\Windows\System\mJwLbyE.exe
  C:\Windows\System\mJwLbyE.exe
  2⤵
  PID:6672
- C:\Windows\System\TCmbEsO.exe
  C:\Windows\System\TCmbEsO.exe
  2⤵
  PID:7188
- C:\Windows\System\SmugqzM.exe
  C:\Windows\System\SmugqzM.exe
  2⤵
  PID:7204
- C:\Windows\System\CPtHcpv.exe
  C:\Windows\System\CPtHcpv.exe
  2⤵
  PID:7220
- C:\Windows\System\SiuQyHQ.exe
  C:\Windows\System\SiuQyHQ.exe
  2⤵
  PID:7236
- C:\Windows\System\hmTHhoW.exe
  C:\Windows\System\hmTHhoW.exe
  2⤵
  PID:7252
- C:\Windows\System\fmEkvQq.exe
  C:\Windows\System\fmEkvQq.exe
  2⤵
  PID:7268
- C:\Windows\System\vCktCos.exe
  C:\Windows\System\vCktCos.exe
  2⤵
  PID:7284
- C:\Windows\System\ZSsfvsi.exe
  C:\Windows\System\ZSsfvsi.exe
  2⤵
  PID:7300
- C:\Windows\System\ptVuPhv.exe
  C:\Windows\System\ptVuPhv.exe
  2⤵
  PID:7316
- C:\Windows\System\vuqHqRm.exe
  C:\Windows\System\vuqHqRm.exe
  2⤵
  PID:7332
- C:\Windows\System\BuLEkVJ.exe
  C:\Windows\System\BuLEkVJ.exe
  2⤵
  PID:7348
- C:\Windows\System\KZLsvKL.exe
  C:\Windows\System\KZLsvKL.exe
  2⤵
  PID:7364
- C:\Windows\System\ikhjVBn.exe
  C:\Windows\System\ikhjVBn.exe
  2⤵
  PID:7380
- C:\Windows\System\HbTjuXx.exe
  C:\Windows\System\HbTjuXx.exe
  2⤵
  PID:7396
- C:\Windows\System\pSTyNjf.exe
  C:\Windows\System\pSTyNjf.exe
  2⤵
  PID:7412
- C:\Windows\System\koTSTMN.exe
  C:\Windows\System\koTSTMN.exe
  2⤵
  PID:7428
- C:\Windows\System\GKNNDHk.exe
  C:\Windows\System\GKNNDHk.exe
  2⤵
  PID:7444
- C:\Windows\System\qJHvLNk.exe
  C:\Windows\System\qJHvLNk.exe
  2⤵
  PID:7460
- C:\Windows\System\cfOQnUT.exe
  C:\Windows\System\cfOQnUT.exe
  2⤵
  PID:7476
- C:\Windows\System\YsDJkQY.exe
  C:\Windows\System\YsDJkQY.exe
  2⤵
  PID:7492
- C:\Windows\System\PdVACoP.exe
  C:\Windows\System\PdVACoP.exe
  2⤵
  PID:7508
- C:\Windows\System\TEnzCpY.exe
  C:\Windows\System\TEnzCpY.exe
  2⤵
  PID:7524
- C:\Windows\System\aFeJUYx.exe
  C:\Windows\System\aFeJUYx.exe
  2⤵
  PID:7540
- C:\Windows\System\QxdxpYN.exe
  C:\Windows\System\QxdxpYN.exe
  2⤵
  PID:7556
- C:\Windows\System\hcdTdRX.exe
  C:\Windows\System\hcdTdRX.exe
  2⤵
  PID:7572
- C:\Windows\System\KwLscZO.exe
  C:\Windows\System\KwLscZO.exe
  2⤵
  PID:7588
- C:\Windows\System\rrNAcMT.exe
  C:\Windows\System\rrNAcMT.exe
  2⤵
  PID:7604
- C:\Windows\System\BhMKrni.exe
  C:\Windows\System\BhMKrni.exe
  2⤵
  PID:7620
- C:\Windows\System\EbBTxhQ.exe
  C:\Windows\System\EbBTxhQ.exe
  2⤵
  PID:7636
- C:\Windows\System\HjMlmrT.exe
  C:\Windows\System\HjMlmrT.exe
  2⤵
  PID:7652
- C:\Windows\System\CgpiUVS.exe
  C:\Windows\System\CgpiUVS.exe
  2⤵
  PID:7668
- C:\Windows\System\NxgNuiu.exe
  C:\Windows\System\NxgNuiu.exe
  2⤵
  PID:7684
- C:\Windows\System\idfBiRQ.exe
  C:\Windows\System\idfBiRQ.exe
  2⤵
  PID:7700
- C:\Windows\System\dusMnWL.exe
  C:\Windows\System\dusMnWL.exe
  2⤵
  PID:7716
- C:\Windows\System\jFxaYJB.exe
  C:\Windows\System\jFxaYJB.exe
  2⤵
  PID:7732
- C:\Windows\System\XedYAsh.exe
  C:\Windows\System\XedYAsh.exe
  2⤵
  PID:7748
- C:\Windows\System\BGUWSvR.exe
  C:\Windows\System\BGUWSvR.exe
  2⤵
  PID:7764
- C:\Windows\System\XDQocWi.exe
  C:\Windows\System\XDQocWi.exe
  2⤵
  PID:7780
- C:\Windows\System\LLqaPhA.exe
  C:\Windows\System\LLqaPhA.exe
  2⤵
  PID:7796
- C:\Windows\System\CVQoARR.exe
  C:\Windows\System\CVQoARR.exe
  2⤵
  PID:7812
- C:\Windows\System\uzlBEIj.exe
  C:\Windows\System\uzlBEIj.exe
  2⤵
  PID:7828
- C:\Windows\System\MZZvidc.exe
  C:\Windows\System\MZZvidc.exe
  2⤵
  PID:7844
- C:\Windows\System\lLQJjUg.exe
  C:\Windows\System\lLQJjUg.exe
  2⤵
  PID:7860
- C:\Windows\System\CrYVhfl.exe
  C:\Windows\System\CrYVhfl.exe
  2⤵
  PID:7876
- C:\Windows\System\ZJzCtKY.exe
  C:\Windows\System\ZJzCtKY.exe
  2⤵
  PID:7892
- C:\Windows\System\hWGadAn.exe
  C:\Windows\System\hWGadAn.exe
  2⤵
  PID:7908
- C:\Windows\System\ZXQrIqt.exe
  C:\Windows\System\ZXQrIqt.exe
  2⤵
  PID:7924
- C:\Windows\System\SsuoHCc.exe
  C:\Windows\System\SsuoHCc.exe
  2⤵
  PID:7940
- C:\Windows\System\lJpzQOW.exe
  C:\Windows\System\lJpzQOW.exe
  2⤵
  PID:7956
- C:\Windows\System\VppJDSP.exe
  C:\Windows\System\VppJDSP.exe
  2⤵
  PID:7972
- C:\Windows\System\YwiZqdC.exe
  C:\Windows\System\YwiZqdC.exe
  2⤵
  PID:7988
- C:\Windows\System\XMbBgMc.exe
  C:\Windows\System\XMbBgMc.exe
  2⤵
  PID:8004
- C:\Windows\System\EfcfJVu.exe
  C:\Windows\System\EfcfJVu.exe
  2⤵
  PID:8020
- C:\Windows\System\YEjXUkH.exe
  C:\Windows\System\YEjXUkH.exe
  2⤵
  PID:8036
- C:\Windows\System\xXyxjgR.exe
  C:\Windows\System\xXyxjgR.exe
  2⤵
  PID:8052
- C:\Windows\System\NnqCNiW.exe
  C:\Windows\System\NnqCNiW.exe
  2⤵
  PID:8068
- C:\Windows\System\WllXWqU.exe
  C:\Windows\System\WllXWqU.exe
  2⤵
  PID:8084
- C:\Windows\System\SMtqQFk.exe
  C:\Windows\System\SMtqQFk.exe
  2⤵
  PID:8100
- C:\Windows\System\yUptBqH.exe
  C:\Windows\System\yUptBqH.exe
  2⤵
  PID:8116
- C:\Windows\System\ZcxLNce.exe
  C:\Windows\System\ZcxLNce.exe
  2⤵
  PID:8132
- C:\Windows\System\EnZaFMA.exe
  C:\Windows\System\EnZaFMA.exe
  2⤵
  PID:8148
- C:\Windows\System\kNPAfAS.exe
  C:\Windows\System\kNPAfAS.exe
  2⤵
  PID:8164
- C:\Windows\System\mMNpGyM.exe
  C:\Windows\System\mMNpGyM.exe
  2⤵
  PID:8180
- C:\Windows\System\OxIlhsf.exe
  C:\Windows\System\OxIlhsf.exe
  2⤵
  PID:7088
- C:\Windows\System\SVXDvHg.exe
  C:\Windows\System\SVXDvHg.exe
  2⤵
  PID:6384
- C:\Windows\System\Ywovine.exe
  C:\Windows\System\Ywovine.exe
  2⤵
  PID:6948
- C:\Windows\System\FPxewhl.exe
  C:\Windows\System\FPxewhl.exe
  2⤵
  PID:5560
- C:\Windows\System\iJXJebt.exe
  C:\Windows\System\iJXJebt.exe
  2⤵
  PID:6772
- C:\Windows\System\ZkbRSNF.exe
  C:\Windows\System\ZkbRSNF.exe
  2⤵
  PID:6368
- C:\Windows\System\ZBGDGFU.exe
  C:\Windows\System\ZBGDGFU.exe
  2⤵
  PID:6576
- C:\Windows\System\rpGMfOl.exe
  C:\Windows\System\rpGMfOl.exe
  2⤵
  PID:7244
- C:\Windows\System\vPNNiIM.exe
  C:\Windows\System\vPNNiIM.exe
  2⤵
  PID:7308
- C:\Windows\System\nAOAxnX.exe
  C:\Windows\System\nAOAxnX.exe
  2⤵
  PID:7228
- C:\Windows\System\bsczTmd.exe
  C:\Windows\System\bsczTmd.exe
  2⤵
  PID:7404
- C:\Windows\System\CunNxTJ.exe
  C:\Windows\System\CunNxTJ.exe
  2⤵
  PID:7468
- C:\Windows\System\IwTzYNX.exe
  C:\Windows\System\IwTzYNX.exe
  2⤵
  PID:7536
- C:\Windows\System\CtEWycz.exe
  C:\Windows\System\CtEWycz.exe
  2⤵
  PID:7600
- C:\Windows\System\EZgQkdf.exe
  C:\Windows\System\EZgQkdf.exe
  2⤵
  PID:7660
- C:\Windows\System\sPFQlUi.exe
  C:\Windows\System\sPFQlUi.exe
  2⤵
  PID:7328
- C:\Windows\System\bedjSgk.exe
  C:\Windows\System\bedjSgk.exe
  2⤵
  PID:7200
- C:\Windows\System\mzKxHRw.exe
  C:\Windows\System\mzKxHRw.exe
  2⤵
  PID:7264
- C:\Windows\System\GvbyYJi.exe
  C:\Windows\System\GvbyYJi.exe
  2⤵
  PID:7548
- C:\Windows\System\ACouGUa.exe
  C:\Windows\System\ACouGUa.exe
  2⤵
  PID:7584
- C:\Windows\System\fCGnjtU.exe
  C:\Windows\System\fCGnjtU.exe
  2⤵
  PID:7388
- C:\Windows\System\UfcoTPA.exe
  C:\Windows\System\UfcoTPA.exe
  2⤵
  PID:7484
- C:\Windows\System\ysBjNHc.exe
  C:\Windows\System\ysBjNHc.exe
  2⤵
  PID:7680
- C:\Windows\System\tzJBvWS.exe
  C:\Windows\System\tzJBvWS.exe
  2⤵
  PID:7708
- C:\Windows\System\apVrIdQ.exe
  C:\Windows\System\apVrIdQ.exe
  2⤵
  PID:7744
- C:\Windows\System\uffNZcu.exe
  C:\Windows\System\uffNZcu.exe
  2⤵
  PID:7776
- C:\Windows\System\cZZsuOs.exe
  C:\Windows\System\cZZsuOs.exe
  2⤵
  PID:7824
- C:\Windows\System\bNelzty.exe
  C:\Windows\System\bNelzty.exe
  2⤵
  PID:7836
- C:\Windows\System\upWuOXL.exe
  C:\Windows\System\upWuOXL.exe
  2⤵
  PID:7916
- C:\Windows\System\zGdlrBX.exe
  C:\Windows\System\zGdlrBX.exe
  2⤵
  PID:7952
- C:\Windows\System\URLTWxt.exe
  C:\Windows\System\URLTWxt.exe
  2⤵
  PID:7984
- C:\Windows\System\fjYHwuk.exe
  C:\Windows\System\fjYHwuk.exe
  2⤵
  PID:7964
- C:\Windows\System\dTJwJXM.exe
  C:\Windows\System\dTJwJXM.exe
  2⤵
  PID:8000
- C:\Windows\System\SKlPIUN.exe
  C:\Windows\System\SKlPIUN.exe
  2⤵
  PID:8032
- C:\Windows\System\GiKDzQK.exe
  C:\Windows\System\GiKDzQK.exe
  2⤵
  PID:8108
- C:\Windows\System\BVofAaz.exe
  C:\Windows\System\BVofAaz.exe
  2⤵
  PID:8144
- C:\Windows\System\ayyZpWT.exe
  C:\Windows\System\ayyZpWT.exe
  2⤵
  PID:8092
- C:\Windows\System\VatRprq.exe
  C:\Windows\System\VatRprq.exe
  2⤵
  PID:6208
- C:\Windows\System\GtwsBmW.exe
  C:\Windows\System\GtwsBmW.exe
  2⤵
  PID:5944
- C:\Windows\System\SkQhxNT.exe
  C:\Windows\System\SkQhxNT.exe
  2⤵
  PID:7216
- C:\Windows\System\amwFLnr.exe
  C:\Windows\System\amwFLnr.exe
  2⤵
  PID:7108
- C:\Windows\System\nMDTzNh.exe
  C:\Windows\System\nMDTzNh.exe
  2⤵
  PID:7008
- C:\Windows\System\dqVwuTO.exe
  C:\Windows\System\dqVwuTO.exe
  2⤵
  PID:7276
- C:\Windows\System\WRZKlaq.exe
  C:\Windows\System\WRZKlaq.exe
  2⤵
  PID:7372
- C:\Windows\System\kNKhUGN.exe
  C:\Windows\System\kNKhUGN.exe
  2⤵
  PID:7504
- C:\Windows\System\oqBsuaQ.exe
  C:\Windows\System\oqBsuaQ.exe
  2⤵
  PID:7616
- C:\Windows\System\gFRiaQQ.exe
  C:\Windows\System\gFRiaQQ.exe
  2⤵
  PID:7260
- C:\Windows\System\KGUBHzY.exe
  C:\Windows\System\KGUBHzY.exe
  2⤵
  PID:7664
- C:\Windows\System\hEdbUmN.exe
  C:\Windows\System\hEdbUmN.exe
  2⤵
  PID:7456
- C:\Windows\System\zBEBGdm.exe
  C:\Windows\System\zBEBGdm.exe
  2⤵
  PID:7772
- C:\Windows\System\BElQNTW.exe
  C:\Windows\System\BElQNTW.exe
  2⤵
  PID:7868
- C:\Windows\System\WjrvcHx.exe
  C:\Windows\System\WjrvcHx.exe
  2⤵
  PID:8028
- C:\Windows\System\iIWHXih.exe
  C:\Windows\System\iIWHXih.exe
  2⤵
  PID:8112
- C:\Windows\System\KMVrTiJ.exe
  C:\Windows\System\KMVrTiJ.exe
  2⤵
  PID:6884
- C:\Windows\System\keykRth.exe
  C:\Windows\System\keykRth.exe
  2⤵
  PID:7596
- C:\Windows\System\afJRGcb.exe
  C:\Windows\System\afJRGcb.exe
  2⤵
  PID:7724
- C:\Windows\System\pfFuCst.exe
  C:\Windows\System\pfFuCst.exe
  2⤵
  PID:7900
- C:\Windows\System\GxXmCnR.exe
  C:\Windows\System\GxXmCnR.exe
  2⤵
  PID:7740
- C:\Windows\System\yEhUImV.exe
  C:\Windows\System\yEhUImV.exe
  2⤵
  PID:7884
- C:\Windows\System\GQMKZqZ.exe
  C:\Windows\System\GQMKZqZ.exe
  2⤵
  PID:7980
- C:\Windows\System\crVhXdB.exe
  C:\Windows\System\crVhXdB.exe
  2⤵
  PID:8140
- C:\Windows\System\NKHDXtO.exe
  C:\Windows\System\NKHDXtO.exe
  2⤵
  PID:7756
- C:\Windows\System\cTNcngk.exe
  C:\Windows\System\cTNcngk.exe
  2⤵
  PID:7612
- C:\Windows\System\cvSgxTJ.exe
  C:\Windows\System\cvSgxTJ.exe
  2⤵
  PID:7936
- C:\Windows\System\uGvJGUf.exe
  C:\Windows\System\uGvJGUf.exe
  2⤵
  PID:6160
- C:\Windows\System\vNnGUHo.exe
  C:\Windows\System\vNnGUHo.exe
  2⤵
  PID:7500
- C:\Windows\System\ckztTHH.exe
  C:\Windows\System\ckztTHH.exe
  2⤵
  PID:7196
- C:\Windows\System\uoPykYD.exe
  C:\Windows\System\uoPykYD.exe
  2⤵
  PID:7580
- C:\Windows\System\tahacAU.exe
  C:\Windows\System\tahacAU.exe
  2⤵
  PID:4832
- C:\Windows\System\eMZRjVQ.exe
  C:\Windows\System\eMZRjVQ.exe
  2⤵
  PID:7628
- C:\Windows\System\JpbERJy.exe
  C:\Windows\System\JpbERJy.exe
  2⤵
  PID:8200
- C:\Windows\System\JvkflRh.exe
  C:\Windows\System\JvkflRh.exe
  2⤵
  PID:8220
- C:\Windows\System\ZIZolMO.exe
  C:\Windows\System\ZIZolMO.exe
  2⤵
  PID:8236
- C:\Windows\System\JSzKIGl.exe
  C:\Windows\System\JSzKIGl.exe
  2⤵
  PID:8252
- C:\Windows\System\ylrCqRv.exe
  C:\Windows\System\ylrCqRv.exe
  2⤵
  PID:8268
- C:\Windows\System\TLJEJps.exe
  C:\Windows\System\TLJEJps.exe
  2⤵
  PID:8284
- C:\Windows\System\QKHhOIJ.exe
  C:\Windows\System\QKHhOIJ.exe
  2⤵
  PID:8300
- C:\Windows\System\bTpjaBv.exe
  C:\Windows\System\bTpjaBv.exe
  2⤵
  PID:8316
- C:\Windows\System\GJSesXU.exe
  C:\Windows\System\GJSesXU.exe
  2⤵
  PID:8332
- C:\Windows\System\CZAweuc.exe
  C:\Windows\System\CZAweuc.exe
  2⤵
  PID:8348
- C:\Windows\System\PRcHZTv.exe
  C:\Windows\System\PRcHZTv.exe
  2⤵
  PID:8372
- C:\Windows\System\mbjRfsf.exe
  C:\Windows\System\mbjRfsf.exe
  2⤵
  PID:8392
- C:\Windows\System\ObOOaJt.exe
  C:\Windows\System\ObOOaJt.exe
  2⤵
  PID:8408
- C:\Windows\System\UeIbwPt.exe
  C:\Windows\System\UeIbwPt.exe
  2⤵
  PID:8424
- C:\Windows\System\dilNCpz.exe
  C:\Windows\System\dilNCpz.exe
  2⤵
  PID:8440
- C:\Windows\System\CnepEjx.exe
  C:\Windows\System\CnepEjx.exe
  2⤵
  PID:8456
- C:\Windows\System\LUJdPfc.exe
  C:\Windows\System\LUJdPfc.exe
  2⤵
  PID:8472
- C:\Windows\System\ShwxuFi.exe
  C:\Windows\System\ShwxuFi.exe
  2⤵
  PID:8488
- C:\Windows\System\meoXBMA.exe
  C:\Windows\System\meoXBMA.exe
  2⤵
  PID:8504
- C:\Windows\System\usNsFjY.exe
  C:\Windows\System\usNsFjY.exe
  2⤵
  PID:8520
- C:\Windows\System\REYDBoA.exe
  C:\Windows\System\REYDBoA.exe
  2⤵
  PID:8696
- C:\Windows\System\UgOyRtG.exe
  C:\Windows\System\UgOyRtG.exe
  2⤵
  PID:8712
- C:\Windows\System\SnEaTUV.exe
  C:\Windows\System\SnEaTUV.exe
  2⤵
  PID:8728
- C:\Windows\System\WJnAoUa.exe
  C:\Windows\System\WJnAoUa.exe
  2⤵
  PID:8744
- C:\Windows\System\TDhmNZX.exe
  C:\Windows\System\TDhmNZX.exe
  2⤵
  PID:8760
- C:\Windows\System\vMjsiPQ.exe
  C:\Windows\System\vMjsiPQ.exe
  2⤵
  PID:8776
- C:\Windows\System\mSUdnzN.exe
  C:\Windows\System\mSUdnzN.exe
  2⤵
  PID:8792
- C:\Windows\System\luMkbwR.exe
  C:\Windows\System\luMkbwR.exe
  2⤵
  PID:8808
- C:\Windows\System\uDdtdis.exe
  C:\Windows\System\uDdtdis.exe
  2⤵
  PID:8824
- C:\Windows\System\syhCrzp.exe
  C:\Windows\System\syhCrzp.exe
  2⤵
  PID:8840
- C:\Windows\System\pcoaEdz.exe
  C:\Windows\System\pcoaEdz.exe
  2⤵
  PID:8856
- C:\Windows\System\jwIFfbD.exe
  C:\Windows\System\jwIFfbD.exe
  2⤵
  PID:8872
- C:\Windows\System\yXSOBpW.exe
  C:\Windows\System\yXSOBpW.exe
  2⤵
  PID:8888
- C:\Windows\System\sHCwgGQ.exe
  C:\Windows\System\sHCwgGQ.exe
  2⤵
  PID:8904
- C:\Windows\System\EszztMp.exe
  C:\Windows\System\EszztMp.exe
  2⤵
  PID:8920
- C:\Windows\System\srUwPzQ.exe
  C:\Windows\System\srUwPzQ.exe
  2⤵
  PID:8936
- C:\Windows\System\mSJhPCf.exe
  C:\Windows\System\mSJhPCf.exe
  2⤵
  PID:8952
- C:\Windows\System\BYESHPU.exe
  C:\Windows\System\BYESHPU.exe
  2⤵
  PID:8968
- C:\Windows\System\GOotheu.exe
  C:\Windows\System\GOotheu.exe
  2⤵
  PID:8984
- C:\Windows\System\HhJAudk.exe
  C:\Windows\System\HhJAudk.exe
  2⤵
  PID:9000
- C:\Windows\System\NJvQSqd.exe
  C:\Windows\System\NJvQSqd.exe
  2⤵
  PID:9016
- C:\Windows\System\BsVgTlo.exe
  C:\Windows\System\BsVgTlo.exe
  2⤵
  PID:9032
- C:\Windows\System\lxCPwEH.exe
  C:\Windows\System\lxCPwEH.exe
  2⤵
  PID:9048
- C:\Windows\System\rkWqeUg.exe
  C:\Windows\System\rkWqeUg.exe
  2⤵
  PID:9064
- C:\Windows\System\MhMggqj.exe
  C:\Windows\System\MhMggqj.exe
  2⤵
  PID:9080
- C:\Windows\System\xjjKybo.exe
  C:\Windows\System\xjjKybo.exe
  2⤵
  PID:9096
- C:\Windows\System\HVRcnZV.exe
  C:\Windows\System\HVRcnZV.exe
  2⤵
  PID:9112
- C:\Windows\System\cSLtFes.exe
  C:\Windows\System\cSLtFes.exe
  2⤵
  PID:9128
- C:\Windows\System\yNjDlYL.exe
  C:\Windows\System\yNjDlYL.exe
  2⤵
  PID:9144
- C:\Windows\System\zigpOxL.exe
  C:\Windows\System\zigpOxL.exe
  2⤵
  PID:9160
- C:\Windows\System\zIqprsA.exe
  C:\Windows\System\zIqprsA.exe
  2⤵
  PID:9176
- C:\Windows\System\lsiwPZX.exe
  C:\Windows\System\lsiwPZX.exe
  2⤵
  PID:9192
- C:\Windows\System\YGBxykM.exe
  C:\Windows\System\YGBxykM.exe
  2⤵
  PID:9208
- C:\Windows\System\ElVRRZi.exe
  C:\Windows\System\ElVRRZi.exe
  2⤵
  PID:8208
- C:\Windows\System\ZolzSRX.exe
  C:\Windows\System\ZolzSRX.exe
  2⤵
  PID:8244
- C:\Windows\System\fKZBXWh.exe
  C:\Windows\System\fKZBXWh.exe
  2⤵
  PID:8016
- C:\Windows\System\FuROmia.exe
  C:\Windows\System\FuROmia.exe
  2⤵
  PID:8296
- C:\Windows\System\aTzfNkR.exe
  C:\Windows\System\aTzfNkR.exe
  2⤵
  PID:8160
- C:\Windows\System\UfTjNfq.exe
  C:\Windows\System\UfTjNfq.exe
  2⤵
  PID:8416
- C:\Windows\System\sBgyOUO.exe
  C:\Windows\System\sBgyOUO.exe
  2⤵
  PID:8404
- C:\Windows\System\UvhcdfF.exe
  C:\Windows\System\UvhcdfF.exe
  2⤵
  PID:8436
- C:\Windows\System\fJjnmmZ.exe
  C:\Windows\System\fJjnmmZ.exe
  2⤵
  PID:8464
- C:\Windows\System\nVDyURo.exe
  C:\Windows\System\nVDyURo.exe
  2⤵
  PID:8468
- C:\Windows\System\cjtyacj.exe
  C:\Windows\System\cjtyacj.exe
  2⤵
  PID:8544
- C:\Windows\System\SKdiujU.exe
  C:\Windows\System\SKdiujU.exe
  2⤵
  PID:8596
- C:\Windows\System\XjSGpEH.exe
  C:\Windows\System\XjSGpEH.exe
  2⤵
  PID:8580
- C:\Windows\System\CCvtaCo.exe
  C:\Windows\System\CCvtaCo.exe
  2⤵
  PID:8584
- C:\Windows\System\hPljNSh.exe
  C:\Windows\System\hPljNSh.exe
  2⤵
  PID:8604
- C:\Windows\System\FAltycm.exe
  C:\Windows\System\FAltycm.exe
  2⤵
  PID:8624
- C:\Windows\System\eEOoAtA.exe
  C:\Windows\System\eEOoAtA.exe
  2⤵
  PID:8676
- C:\Windows\System\HKnKKAe.exe
  C:\Windows\System\HKnKKAe.exe
  2⤵
  PID:8636
- C:\Windows\System\xilutpr.exe
  C:\Windows\System\xilutpr.exe
  2⤵
  PID:8660
- C:\Windows\System\yJDjQOB.exe
  C:\Windows\System\yJDjQOB.exe
  2⤵
  PID:8692
- C:\Windows\System\DLjZpps.exe
  C:\Windows\System\DLjZpps.exe
  2⤵
  PID:8768
- C:\Windows\System\AxScCtb.exe
  C:\Windows\System\AxScCtb.exe
  2⤵
  PID:8832
- C:\Windows\System\MJvwJEQ.exe
  C:\Windows\System\MJvwJEQ.exe
  2⤵
  PID:8896
- C:\Windows\System\sWCdlSY.exe
  C:\Windows\System\sWCdlSY.exe
  2⤵
  PID:8960
- C:\Windows\System\OCvhGhc.exe
  C:\Windows\System\OCvhGhc.exe
  2⤵
  PID:8848
- C:\Windows\System\iZkOOXL.exe
  C:\Windows\System\iZkOOXL.exe
  2⤵
  PID:8916
- C:\Windows\System\dPJTnnT.exe
  C:\Windows\System\dPJTnnT.exe
  2⤵
  PID:8720
- C:\Windows\System\dxwZxiU.exe
  C:\Windows\System\dxwZxiU.exe
  2⤵
  PID:8788
- C:\Windows\System\qRclbcP.exe
  C:\Windows\System\qRclbcP.exe
  2⤵
  PID:9056
- C:\Windows\System\CfQFdVL.exe
  C:\Windows\System\CfQFdVL.exe
  2⤵
  PID:8976
- C:\Windows\System\FNYNrjo.exe
  C:\Windows\System\FNYNrjo.exe
  2⤵
  PID:9076
- C:\Windows\System\pCCSNCG.exe
  C:\Windows\System\pCCSNCG.exe
  2⤵
  PID:9124
- C:\Windows\System\ursSmcC.exe
  C:\Windows\System\ursSmcC.exe
  2⤵
  PID:9184
- C:\Windows\System\hsWGVhe.exe
  C:\Windows\System\hsWGVhe.exe
  2⤵
  PID:9136
- C:\Windows\System\LtfSEGt.exe
  C:\Windows\System\LtfSEGt.exe
  2⤵
  PID:7280
- C:\Windows\System\PasekBN.exe
  C:\Windows\System\PasekBN.exe
  2⤵
  PID:9140
- C:\Windows\System\ScmcAwX.exe
  C:\Windows\System\ScmcAwX.exe
  2⤵
  PID:8216
- C:\Windows\System\gWqjBFr.exe
  C:\Windows\System\gWqjBFr.exe
  2⤵
  PID:8156
- C:\Windows\System\DRzSrJm.exe
  C:\Windows\System\DRzSrJm.exe
  2⤵
  PID:8196
- C:\Windows\System\qkgfXpz.exe
  C:\Windows\System\qkgfXpz.exe
  2⤵
  PID:8340
- C:\Windows\System\owoSZyH.exe
  C:\Windows\System\owoSZyH.exe
  2⤵
  PID:8328
- C:\Windows\System\TdiKQkt.exe
  C:\Windows\System\TdiKQkt.exe
  2⤵
  PID:8400
- C:\Windows\System\ZSNfAVA.exe
  C:\Windows\System\ZSNfAVA.exe
  2⤵
  PID:8368
- C:\Windows\System\juxdcmy.exe
  C:\Windows\System\juxdcmy.exe
  2⤵
  PID:8556
- C:\Windows\System\tQASgXH.exe
  C:\Windows\System\tQASgXH.exe
  2⤵
  PID:8648
- C:\Windows\System\TvgLuTv.exe
  C:\Windows\System\TvgLuTv.exe
  2⤵
  PID:8736
- C:\Windows\System\UleRsph.exe
  C:\Windows\System\UleRsph.exe
  2⤵
  PID:8756
- C:\Windows\System\GFSGutB.exe
  C:\Windows\System\GFSGutB.exe
  2⤵
  PID:8500
- C:\Windows\System\ofmXoaB.exe
  C:\Windows\System\ofmXoaB.exe
  2⤵
  PID:8616
- C:\Windows\System\jBHELeR.exe
  C:\Windows\System\jBHELeR.exe
  2⤵
  PID:8664
- C:\Windows\System\owUKMuI.exe
  C:\Windows\System\owUKMuI.exe
  2⤵
  PID:8800
- C:\Windows\System\PNPHdjX.exe
  C:\Windows\System\PNPHdjX.exe
  2⤵
  PID:8752
- C:\Windows\System\oFWiEwc.exe
  C:\Windows\System\oFWiEwc.exe
  2⤵
  PID:9092
- C:\Windows\System\nzRFXRg.exe
  C:\Windows\System\nzRFXRg.exe
  2⤵
  PID:9028
- C:\Windows\System\rSNLSAz.exe
  C:\Windows\System\rSNLSAz.exe
  2⤵
  PID:9152
- C:\Windows\System\aFkCvZu.exe
  C:\Windows\System\aFkCvZu.exe
  2⤵
  PID:7232
- C:\Windows\System\iIADPKX.exe
  C:\Windows\System\iIADPKX.exe
  2⤵
  PID:8308
- C:\Windows\System\cyoWwpG.exe
  C:\Windows\System\cyoWwpG.exe
  2⤵
  PID:8356
- C:\Windows\System\gAEgOVI.exe
  C:\Windows\System\gAEgOVI.exe
  2⤵
  PID:8560
- C:\Windows\System\EweMbry.exe
  C:\Windows\System\EweMbry.exe
  2⤵
  PID:9108
- C:\Windows\System\jnLgkPS.exe
  C:\Windows\System\jnLgkPS.exe
  2⤵
  PID:8864
- C:\Windows\System\mOdpLTw.exe
  C:\Windows\System\mOdpLTw.exe
  2⤵
  PID:8948
- C:\Windows\System\AewNpbA.exe
  C:\Windows\System\AewNpbA.exe
  2⤵
  PID:8264
- C:\Windows\System\CAGZQeZ.exe
  C:\Windows\System\CAGZQeZ.exe
  2⤵
  PID:8512
- C:\Windows\System\mqcNrzc.exe
  C:\Windows\System\mqcNrzc.exe
  2⤵
  PID:8656
- C:\Windows\System\ipCwPPb.exe
  C:\Windows\System\ipCwPPb.exe
  2⤵
  PID:8704
- C:\Windows\System\aewZzRU.exe
  C:\Windows\System\aewZzRU.exe
  2⤵
  PID:8312
- C:\Windows\System\cloKbXl.exe
  C:\Windows\System\cloKbXl.exe
  2⤵
  PID:9044
- C:\Windows\System\KzwFjWe.exe
  C:\Windows\System\KzwFjWe.exe
  2⤵
  PID:8540
- C:\Windows\System\LNFukJi.exe
  C:\Windows\System\LNFukJi.exe
  2⤵
  PID:8820
- C:\Windows\System\zLhQYRD.exe
  C:\Windows\System\zLhQYRD.exe
  2⤵
  PID:9228
- C:\Windows\System\DhIdQNG.exe
  C:\Windows\System\DhIdQNG.exe
  2⤵
  PID:9244
- C:\Windows\System\WbNPEnr.exe
  C:\Windows\System\WbNPEnr.exe
  2⤵
  PID:9260
- C:\Windows\System\VfVOwDD.exe
  C:\Windows\System\VfVOwDD.exe
  2⤵
  PID:9356
- C:\Windows\System\vsvBVGG.exe
  C:\Windows\System\vsvBVGG.exe
  2⤵
  PID:9372
- C:\Windows\System\jvCSfQr.exe
  C:\Windows\System\jvCSfQr.exe
  2⤵
  PID:9388
- C:\Windows\System\ECIYBsj.exe
  C:\Windows\System\ECIYBsj.exe
  2⤵
  PID:9404
- C:\Windows\System\jNDsfzO.exe
  C:\Windows\System\jNDsfzO.exe
  2⤵
  PID:9424
- C:\Windows\System\kqyTXiD.exe
  C:\Windows\System\kqyTXiD.exe
  2⤵
  PID:9440
- C:\Windows\System\SiMczLA.exe
  C:\Windows\System\SiMczLA.exe
  2⤵
  PID:9456
- C:\Windows\System\OZEKSvU.exe
  C:\Windows\System\OZEKSvU.exe
  2⤵
  PID:9472
- C:\Windows\System\ygwYmVU.exe
  C:\Windows\System\ygwYmVU.exe
  2⤵
  PID:9488
- C:\Windows\System\cRnrPQb.exe
  C:\Windows\System\cRnrPQb.exe
  2⤵
  PID:9504
- C:\Windows\System\qhiFCZr.exe
  C:\Windows\System\qhiFCZr.exe
  2⤵
  PID:9520
- C:\Windows\System\YrbZcIi.exe
  C:\Windows\System\YrbZcIi.exe
  2⤵
  PID:9536
- C:\Windows\System\yNiKzRv.exe
  C:\Windows\System\yNiKzRv.exe
  2⤵
  PID:9552
- C:\Windows\System\mewHcob.exe
  C:\Windows\System\mewHcob.exe
  2⤵
  PID:9568
- C:\Windows\System\SnKIOjs.exe
  C:\Windows\System\SnKIOjs.exe
  2⤵
  PID:9584
- C:\Windows\System\xjPBCJn.exe
  C:\Windows\System\xjPBCJn.exe
  2⤵
  PID:9600
- C:\Windows\System\KnrjIFt.exe
  C:\Windows\System\KnrjIFt.exe
  2⤵
  PID:9616
- C:\Windows\System\VvjEyVw.exe
  C:\Windows\System\VvjEyVw.exe
  2⤵
  PID:9632
- C:\Windows\System\sqoexnc.exe
  C:\Windows\System\sqoexnc.exe
  2⤵
  PID:9648
- C:\Windows\System\OUfIxgT.exe
  C:\Windows\System\OUfIxgT.exe
  2⤵
  PID:9664
- C:\Windows\System\fVGgIOK.exe
  C:\Windows\System\fVGgIOK.exe
  2⤵
  PID:9680
- C:\Windows\System\XkvTqkZ.exe
  C:\Windows\System\XkvTqkZ.exe
  2⤵
  PID:9696
- C:\Windows\System\YnNMawi.exe
  C:\Windows\System\YnNMawi.exe
  2⤵
  PID:9712
- C:\Windows\System\FTcHmlC.exe
  C:\Windows\System\FTcHmlC.exe
  2⤵
  PID:9732
- C:\Windows\System\ATFhcDx.exe
  C:\Windows\System\ATFhcDx.exe
  2⤵
  PID:9748
- C:\Windows\System\QlusHec.exe
  C:\Windows\System\QlusHec.exe
  2⤵
  PID:9764
- C:\Windows\System\ceFJxXY.exe
  C:\Windows\System\ceFJxXY.exe
  2⤵
  PID:9780
- C:\Windows\System\gzlIgPr.exe
  C:\Windows\System\gzlIgPr.exe
  2⤵
  PID:9796
- C:\Windows\System\EaZzxKM.exe
  C:\Windows\System\EaZzxKM.exe
  2⤵
  PID:9816
- C:\Windows\System\sbuqRqN.exe
  C:\Windows\System\sbuqRqN.exe
  2⤵
  PID:9832
- C:\Windows\System\ErXlbdB.exe
  C:\Windows\System\ErXlbdB.exe
  2⤵
  PID:9856
- C:\Windows\System\RylMHMd.exe
  C:\Windows\System\RylMHMd.exe
  2⤵
  PID:9872
- C:\Windows\System\ActiMRh.exe
  C:\Windows\System\ActiMRh.exe
  2⤵
  PID:9888
- C:\Windows\System\NpQTYql.exe
  C:\Windows\System\NpQTYql.exe
  2⤵
  PID:9904
- C:\Windows\System\ahvmGOS.exe
  C:\Windows\System\ahvmGOS.exe
  2⤵
  PID:9920
- C:\Windows\System\uBPIFFg.exe
  C:\Windows\System\uBPIFFg.exe
  2⤵
  PID:9936
- C:\Windows\System\mKHIWZu.exe
  C:\Windows\System\mKHIWZu.exe
  2⤵
  PID:9952
- C:\Windows\System\fWzFqzk.exe
  C:\Windows\System\fWzFqzk.exe
  2⤵
  PID:9968
- C:\Windows\System\VGreFFK.exe
  C:\Windows\System\VGreFFK.exe
  2⤵
  PID:9984
- C:\Windows\System\RrRtEIf.exe
  C:\Windows\System\RrRtEIf.exe
  2⤵
  PID:10000
- C:\Windows\System\XHtArbn.exe
  C:\Windows\System\XHtArbn.exe
  2⤵
  PID:10016
- C:\Windows\System\qzlduuk.exe
  C:\Windows\System\qzlduuk.exe
  2⤵
  PID:10032
- C:\Windows\System\XidoHLY.exe
  C:\Windows\System\XidoHLY.exe
  2⤵
  PID:10048
- C:\Windows\System\mhAgSch.exe
  C:\Windows\System\mhAgSch.exe
  2⤵
  PID:10124
- C:\Windows\System\yiykVNW.exe
  C:\Windows\System\yiykVNW.exe
  2⤵
  PID:10140
- C:\Windows\System\bmgXYUl.exe
  C:\Windows\System\bmgXYUl.exe
  2⤵
  PID:10156
- C:\Windows\System\nIQBcVA.exe
  C:\Windows\System\nIQBcVA.exe
  2⤵
  PID:10172
- C:\Windows\System\LJwSrjL.exe
  C:\Windows\System\LJwSrjL.exe
  2⤵
  PID:10188
- C:\Windows\System\ABvOiFm.exe
  C:\Windows\System\ABvOiFm.exe
  2⤵
  PID:10204
- C:\Windows\System\FzTFaWL.exe
  C:\Windows\System\FzTFaWL.exe
  2⤵
  PID:10220
- C:\Windows\System\oHYWBTo.exe
  C:\Windows\System\oHYWBTo.exe
  2⤵
  PID:9200
- C:\Windows\System\GbXTGJP.exe
  C:\Windows\System\GbXTGJP.exe
  2⤵
  PID:8496
- C:\Windows\System\OITPCRb.exe
  C:\Windows\System\OITPCRb.exe
  2⤵
  PID:9236
- C:\Windows\System\CmrTxSf.exe
  C:\Windows\System\CmrTxSf.exe
  2⤵
  PID:9276
- C:\Windows\System\XkzesZp.exe
  C:\Windows\System\XkzesZp.exe
  2⤵
  PID:9060
- C:\Windows\System\adlPpca.exe
  C:\Windows\System\adlPpca.exe
  2⤵
  PID:9220
- C:\Windows\System\CTGBUNt.exe
  C:\Windows\System\CTGBUNt.exe
  2⤵
  PID:9280
- C:\Windows\System\uCFrduf.exe
  C:\Windows\System\uCFrduf.exe
  2⤵
  PID:9288
- C:\Windows\System\rhMTdGr.exe
  C:\Windows\System\rhMTdGr.exe
  2⤵
  PID:9300
- C:\Windows\System\yhliRRq.exe
  C:\Windows\System\yhliRRq.exe
  2⤵
  PID:9324
- C:\Windows\System\jwSPORm.exe
  C:\Windows\System\jwSPORm.exe
  2⤵
  PID:9340
- C:\Windows\System\ewSzACd.exe
  C:\Windows\System\ewSzACd.exe
  2⤵
  PID:9464
- C:\Windows\System\peHbsuB.exe
  C:\Windows\System\peHbsuB.exe
  2⤵
  PID:9496
- C:\Windows\System\xlZwhCZ.exe
  C:\Windows\System\xlZwhCZ.exe
  2⤵
  PID:9544
- C:\Windows\System\VoAKVtI.exe
  C:\Windows\System\VoAKVtI.exe
  2⤵
  PID:9576
- C:\Windows\System\fpIBnGS.exe
  C:\Windows\System\fpIBnGS.exe
  2⤵
  PID:9612
- C:\Windows\System\qhREOvJ.exe
  C:\Windows\System\qhREOvJ.exe
  2⤵
  PID:9644
- C:\Windows\System\UMnebcq.exe
  C:\Windows\System\UMnebcq.exe
  2⤵
  PID:9704
- C:\Windows\System\JJtAWyR.exe
  C:\Windows\System\JJtAWyR.exe
  2⤵
  PID:9744
- C:\Windows\System\vAAbyTU.exe
  C:\Windows\System\vAAbyTU.exe
  2⤵
  PID:9812
- C:\Windows\System\ruDWJjY.exe
  C:\Windows\System\ruDWJjY.exe
  2⤵
  PID:9688
- C:\Windows\System\jgxJUog.exe
  C:\Windows\System\jgxJUog.exe
  2⤵
  PID:9760
- C:\Windows\System\gCEUYuh.exe
  C:\Windows\System\gCEUYuh.exe
  2⤵
  PID:9824
- C:\Windows\System\FNPJFtL.exe
  C:\Windows\System\FNPJFtL.exe
  2⤵
  PID:9884
- C:\Windows\System\QCTswGU.exe
  C:\Windows\System\QCTswGU.exe
  2⤵
  PID:9900
- C:\Windows\System\PayshMH.exe
  C:\Windows\System\PayshMH.exe
  2⤵
  PID:9932
- C:\Windows\System\tqQDzEq.exe
  C:\Windows\System\tqQDzEq.exe
  2⤵
  PID:10008
- C:\Windows\System\GWVRlRw.exe
  C:\Windows\System\GWVRlRw.exe
  2⤵
  PID:10040
- C:\Windows\System\rQGGXhm.exe
  C:\Windows\System\rQGGXhm.exe
  2⤵
  PID:10028
- C:\Windows\System\RximacW.exe
  C:\Windows\System\RximacW.exe
  2⤵
  PID:10068
- C:\Windows\System\RjqcqbS.exe
  C:\Windows\System\RjqcqbS.exe
  2⤵
  PID:10084
- C:\Windows\System\bgrKvOh.exe
  C:\Windows\System\bgrKvOh.exe
  2⤵
  PID:9024
- C:\Windows\System\AEKWIvd.exe
  C:\Windows\System\AEKWIvd.exe
  2⤵
  PID:9252
- C:\Windows\System\VVrjQBJ.exe
  C:\Windows\System\VVrjQBJ.exe
  2⤵
  PID:9336
- C:\Windows\System\iwPwjhu.exe
  C:\Windows\System\iwPwjhu.exe
  2⤵
  PID:10180
- C:\Windows\System\IhFISZB.exe
  C:\Windows\System\IhFISZB.exe
  2⤵
  PID:9432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CVxbZBX.exe

Filesize
1.9MB

MD5
3a1a6be6d857efc680d7774abdff857e

SHA1
97806f7d953a1e8cbc07146f0017c17158bb5b0b

SHA256
4644445826d328372bb66502232b2b1cedd28674d3f03bfae9f3c709e50f601a

SHA512
6b0acfb74c511dc354728703b76cd56d3a2afd478fcadd7ec86ff1318a19cc379c47df290b1a45eeae16a94a0944361ff1894842a92459a1a058d5084df0a0f8

Download Submit
C:\Windows\system\HecrBSb.exe

Filesize
1.9MB

MD5
de0506cc0ec5097d25e1d22c764bf110

SHA1
a66ccd6287b6b94dbd22d51f643e2fb915d7f139

SHA256
d21bc53777b292d49bf273249d6a8b01aa2c238a2eb47b1091d563d3bdc1a7e0

SHA512
8847c969a6f9eeefd6813303d81cd0bdfea8a64501e1830dad3c5974cc8ce5fd6ed624a28d965e3a6aaaf6ac8506721c22c016313e0f997529c8af50c389d960

Download Submit
C:\Windows\system\IfXNCrG.exe

Filesize
1.9MB

MD5
af3e3de8cc153c81d69def8118e8ffc5

SHA1
22a78a3a3e7d703468387fe688059c2bb4096488

SHA256
342c0d3e446274eaeab9601c11a42e74715db006e76dc028ec9ae6651d1075a5

SHA512
6e266f494b9f69e9118b4ff2dc01f0e416ada45c089ed35a7357e993013693bfa60da5424cb853218337e7e20e29bcfde30905b38cd9f807240727ae00470a40

Download Submit
C:\Windows\system\IohNXqG.exe

Filesize
1.9MB

MD5
615e4a929611790c5868b614aa70b7a6

SHA1
6b8033b067b3396e3fc05dad5c489dea2b17aaa3

SHA256
c8663855b298bcfdc454cab17ebb2c027f25d19e72b5642eb70868c88b850bd5

SHA512
9b7c32102724b7a9339afc70ba6e393047fe07928a1ac84cb0ac62d5d6c406e79eb7065418f39103a00112de245c42d33f7ab97410f8e6812e75038367a37ac8

Download Submit
C:\Windows\system\LrsUudD.exe

Filesize
1.9MB

MD5
134fab286150cbb01d2237e96c7005ce

SHA1
0d3757a5256df7cf344622e6baf63d0b886a45d7

SHA256
dc2926dfc5bf7d8e973734a94675972d15c5b846b4ac147fa205d403b573b590

SHA512
1d7c853da51a5fa7438a235ad08cd70d3f14016c3868e63af83509a18d41ca267cae5ea1dacaf5b3e6a2fc15f6181cfd9c31ca4acb1c3269d5da3a6537243d88

Download Submit
C:\Windows\system\MShURIy.exe

Filesize
1.9MB

MD5
3015ce54ca8c127be4cc1738aa3cf1e8

SHA1
977c7c93604b13d724eb5bd12ec2115e2da7df6e

SHA256
185534e29d8a6f13d76d34dad9d3b931669bfce8bdddbac01c9c0e8b3acf95ec

SHA512
4db9fa65d51e72aee223c72c003b857ac0615c7cf3b00faa088ea13ef7e416c4be16ee9fa95514fb7eedb0e68cb719af662fc107d6d365bcf2fddcf34807b56d

Download Submit
C:\Windows\system\MkrAHJH.exe

Filesize
1.9MB

MD5
9422f64f0b2fc0b3418431abdcd003a6

SHA1
b8e593e13c7957390f6992ead81e5676c7b0578c

SHA256
ee5c4031794613c21766c7c5019a3151ffcf5d371a742bb68e0665ff38de59e2

SHA512
736659750164f4daa6ebd52f38d0bb5103ea0b65ff0a314e499821d943fd44f1dd64a8e5a7c550d24fd70f428ccdf52c21226e59aedbea722555b5f74d5199fc

Download Submit
C:\Windows\system\MuPfSdK.exe

Filesize
1.9MB

MD5
8b5d3936f32000bbbb1fba3bcfd398af

SHA1
2ab5521c28780a3a785e63d6efb0e4d1de8c919b

SHA256
648d43111e29ac8c675f07adfd75c399b7cca7657b37fd9ebc17ac4e0ad57995

SHA512
571b63d0bffacbba381b58f4dae6d61696789bffd51f30dc0b21d14ab080c97817a5c3ff163917830642a6d12f5cc5eca139502d420c3ff18acbf3ad1160216b

Download Submit
C:\Windows\system\PHvmKQs.exe

Filesize
1.9MB

MD5
b8a9b2233b9731062abef293b1c34172

SHA1
03f0269f556f18f00027e48e8edb1eab0f47e690

SHA256
cc6c08d790c05e92ee3ae94601e344d23660ee315e3ebf06914797ec4d68c30b

SHA512
ce96ffd7eecb02e2f97f4d482f7e96bd1f47160484e337b8dfc893fdc4343cd2e7c792e693a048bdb2b2d3f27d108886eaa545f246a1d6f6a62813a75cd4082d

Download Submit
C:\Windows\system\PbJGKMO.exe

Filesize
1.9MB

MD5
356b5dd426b0dd10b3f98163e47b68dd

SHA1
4e7362b7ee0852cdc2b8daae8be3f80ac74cfddc

SHA256
ef66d8964b021137081e8cbbbcc0b1ea7d28503a3c7efb2f56c445778195cac4

SHA512
36d15dbac192319f8f5ce1f9d56047dc7e0fb1b37a05e939842475f5ab2437064b7fbc7e593e58981193849daad2aa5ab200f74ae338e49db6344dfd649f99a2

Download Submit
C:\Windows\system\QelsjfV.exe

Filesize
1.9MB

MD5
84c472df1235963ef8880ab48a0bc341

SHA1
1233d5dc593f16dcbc41f86000efb550c7dd35e4

SHA256
c6f106bc67cef934866821a5c49d02d1640d5a18ff5b940c7ce126d52c3d5ed8

SHA512
575881d8eb6622a76d8573853004037674d4a5c690ad1276563b108ac1185aba8b810cf421e2dbfd2b028cb9392c99ac01ca54b7aae2c668faddb5e60db70b81

Download Submit
C:\Windows\system\RQRwzgc.exe

Filesize
1.9MB

MD5
db1239b2c4e2ff772e2b4ff47707331c

SHA1
7da9780f056a0c108d039b9a6741206eba202b37

SHA256
f1eb8c878c1eff2d1b683da75d632a83304290cb4015692d6525a207082658f1

SHA512
e9a0742e9fe6e25aa8657a04cc666f762badd6df87e9ec346ff85f3eee0cd4f040bc5760615f6a34c850eaa10e63fc88ae9d2c816755c0ec99e2e97efbfbf505

Download Submit
C:\Windows\system\TXHZscS.exe

Filesize
1.9MB

MD5
f15f6874de2b4be5e867b37829a30518

SHA1
fc853124d605e0ecaf8a970a2fd8d75dc410d1a2

SHA256
b3c374af2b208e0d4f45686257fb87b0690e15cb1863f0efe0a8f085d31ca73a

SHA512
2d47220cae34adb9d688053ac7042bc08e6f199d3b5b3681ebd9401e4fd8362b516cf88e7c75a728d9721de309badf736f3bce944b5347e37b0a76ce5d7ec481

Download Submit
C:\Windows\system\VUvQaoh.exe

Filesize
1.9MB

MD5
ea3bf8751b7f343aefc0f948b72fd45c

SHA1
da6287aad2f21526780959e1e5a765275f39ffc4

SHA256
854ea2f4b609150d357dfa3501d864b89c6fa2087f45349d8bc0a81bf7dacaf1

SHA512
b17928d9db7d0edd2f6a007f202c3f55c9eff4f24ec523aff07981b13c2a2daf535b6b3d248c87c44ee78ea9e8d3c510b5af78ea279d6334b1e68354f2172782

Download Submit
C:\Windows\system\XrAqxow.exe

Filesize
1.9MB

MD5
a2f4878e099e40bc1b0ee5702073266b

SHA1
c1cc42f05f150fafaec6d915b7957ce2dd46b42b

SHA256
5caf8cd9b841a69e53abd80dbd8f76033c2d0ef0d086b80377ee0ccd3302c4db

SHA512
e8ea8ca4773cc3ba65d30387d349deaa537b9f2615487096aacd49b1ffd1c69e1c92853bf08703aa603ed1a900a94b20cc4ac8f16c99ed10b3ef58138706db09

Download Submit
C:\Windows\system\YfkNCNO.exe

Filesize
1.9MB

MD5
a553ec00fae8ede355c724a279435392

SHA1
53220bc33ed9e603f718846a992253224b9bf990

SHA256
cd5934c554d29fdfe38835fcfd8641349386e8be2608bc64ab39ed5055658ca8

SHA512
6c3d34e3a57a72300e620674b35f5259717d4d17423d4240492e52aec454675bd16da81c0af05b6455f88984e5b40a1ff902c8076b1786a6ddfac002c840fde2

Download Submit
C:\Windows\system\YheluKi.exe

Filesize
1.9MB

MD5
b6b7b331b05d7bf366743b9526676778

SHA1
c01dbd2c6ecf4528a63f3b1b17be05d03ad4bd06

SHA256
059470d11c074be96a1a297003cc5585849e5fef3fd194680cfd096b72521466

SHA512
01d179a957570f2f62cbcc98bcefb3466a5c4e5b71a06a871a9c705c86a34de1fb3e1e57fdf3d3643a977fb83c0117ffb597bcb61059ff50248912540344d4ed

Download Submit
C:\Windows\system\ZRadBva.exe

Filesize
1.9MB

MD5
4a3ce2dcdbf43af278433b5308ae7cc1

SHA1
24eeb285b88ea60a6b68624f9376b355cb94026a

SHA256
ab2f1a5d6c126e6b0299fd75cb4a50006cf8beda5ae14153a36870bef445602e

SHA512
8f9c75a79c428373eea91d5cada793894dfc2215905bb0b7d42f9e5e62eb362b9ffdb3300c495c5457d200b05b6039996dcd8dc795503727e4615856b5ae4765

Download Submit
C:\Windows\system\Zqvjpgq.exe

Filesize
1.9MB

MD5
02ea0ba65e446801d0712bc0075ca6fe

SHA1
89ff53f49389a93b694d66c40ca513c368e9bf75

SHA256
32eec295a5f36a207077a61306337a9b79db898ffd65c39626957447f640a28c

SHA512
7782cef0d29a76c0889d0aefcfbadf0bf90e12637119ddd2a10fc3e9e91f7fcb9ad76918dfaaee2d891edd2a3ab83b6190d0173666f2a23ac7bb6c06ee8dd08c

Download Submit
C:\Windows\system\bXYOgUQ.exe

Filesize
1.9MB

MD5
72df7e444ea98974e686801a60959efc

SHA1
7108a0bd9a9599c60a32edbc0dd786b5d4c7663c

SHA256
0bb500a3f1da21767d59fd80f26bd64d1d100dfca3f582f20b0c0992d2b653ad

SHA512
99b59fa2d5ee33dc871b5cfffae726bedea88f4a2e05c2d1b56a2430f1a5025d4fd67771015e1483192f8f3c28a97c4c63a73fa161072322ecf9e5f8513dfa35

Download Submit
C:\Windows\system\bhyCBEH.exe

Filesize
1.9MB

MD5
bc9bef54195b8b80b440ee8ee5cc040b

SHA1
47ae80d7d47178bd7b8e96c712c458db01fa0cab

SHA256
05f4a9434d3599ce2aac2913fe93a2714f8079179c411c57b89606cb4117e9e5

SHA512
223e1557a12137c048ca27c989a2a8b5ed30536671b3165edf9e7d8fdf228788cf4562f8259523c026bc5920a39605c18677f1735db9609e0adaa3af0a84641d

Download Submit
C:\Windows\system\cPZPZqb.exe

Filesize
1.9MB

MD5
53e493edbdcf55920d49bb0281a630a8

SHA1
7e1ee2dae06e7c4135ed800b08a0f6a0cbe4c1b3

SHA256
5c5983302487fd132fdb26c4f03fe5a06c9c819eecc77d05df853ed90b3e4c63

SHA512
3959410930bd9ca03323cd30157f80ce09989ebe680d5bb319498487419f51897fc82f9722d405aeaf75fc144dfc81c986c98397e562a5a04c200953f5a3e145

Download Submit
C:\Windows\system\eAfsUlJ.exe

Filesize
1.9MB

MD5
fd3995521c5b911d099c6783ab9fea15

SHA1
c0c8043c3f76ba7295e7d00802d3d34f3ca39919

SHA256
d4f3060c3da2fc560cc2bd88b6732a5c94b179d9a00a259e396100a96b8bf213

SHA512
27716842cb003350a73ef46bfffbe04de9c53d75ce35e20e7e41991e05bdc99f9d7026753abeb0b6a9978d2aedceffab5eb5d730e117be1b749687c1a499101f

Download Submit
C:\Windows\system\lNNmNWH.exe

Filesize
1.9MB

MD5
f82ac153f4e11a55d27dd2a147372ddf

SHA1
ac28c7795c2ee4c15eaa8f40b6293ab8b3f935be

SHA256
462ebb0e9380867a1cc4b583ccb576f2b1e848e4f66e7c8bcba14fdacd7a3fd7

SHA512
e33463abd745f6652cc83bd173c43952458ed46b5565175833768354a871901643f0522824c5e7f44c33baeea06f696db66dc4bdf86f0e82c863ee204f71bd4e

Download Submit
C:\Windows\system\lSGdGJD.exe

Filesize
1.9MB

MD5
80b472d7b0587122acd02d4f8b917c1a

SHA1
443f7eaf948a004750dbd4de8f36a8824cc8b972

SHA256
a6a23f912e2699d1e8e5237d0c746ad489737a79bbf9f725ab2be37f798eebd2

SHA512
084d9ce4ad2089f681c9b6aefb9f2c9c44bb3792b05d873a8948c209deda30a2643873fdee87f614dd41dc972b10258a0203ad099cc00f577541c8de037e8536

Download Submit
C:\Windows\system\ppBkNSI.exe

Filesize
1.9MB

MD5
8d42cbee69100c3ba1b19861e2517aa1

SHA1
dbfb211b89c0d0e39cd34a2a316ddca4321713a8

SHA256
ad401e94cc1b55bf22346c9d0c8c942784f85121d568a964c07203da80b96a44

SHA512
7c4436f34582d76713867d6eac9b82b613b2fa4a804eb6b5858a1265a2457dcd1c7bfb2027fa3593b718e7efa0a2ec8df4110ce2564aada744e70f4d41696764

Download Submit
C:\Windows\system\sAoDvVH.exe

Filesize
1.9MB

MD5
10353e2e91ab955a35d4626f9ba5848a

SHA1
3c6b05724817bbe7796051b089c149f4a66aeca4

SHA256
1254570a034e7ef511bd622b9e66eaa3e39ae4c02c6a1f1fcb9d8c728acc8e9f

SHA512
1555d5c13903306e7a3415018baff62980e664998ec5b8e3c286a35bfb08e18d5b831a13e1962f4ed1b72978bf00d15313474d792d7079da117caac0587054f3

Download Submit
C:\Windows\system\yBELRaN.exe

Filesize
1.9MB

MD5
c41dcc4965a9a82acf81df283489d96e

SHA1
1670a91a5159c75a2c559c45657ec32d7b9fb6fc

SHA256
ac3b99ce5b965b506f4a69932991edb1149c95dd1c60807756195e1c6d005c24

SHA512
502d2811787d3c3190c3cb5ae529a3109537e1ab207921f07986625784e99253209da706c337e744206d17d80a5316c00702e015488a6559221d5df343c8028a

Download Submit
\Windows\system\GReqaax.exe

Filesize
1.9MB

MD5
547b1b5f9d5d22a341aa528a7c1b53ce

SHA1
08f46c39417a3c0970288085e18c358736915197

SHA256
e3c9453f9da08a384f5a2c0d95f79e3cfa27431bad7baa0cde2414f0433f6783

SHA512
8ba5961c725a43f799bc8fecc0f8044de76ecf04084c2bbca4141e3dfa3abbcec3ea86c6483e2cb2fe9de42042cd485c3c7b131c0f3f8e6b583f936d9126db0c

Download Submit
\Windows\system\IspWCFb.exe

Filesize
1.9MB

MD5
8005f596900a90a048d61d66f836a340

SHA1
359b540a977f972f7a1fdaece063e9a0966c2ed8

SHA256
2117864aa81dbf8dce64862699cb47f3719d93f3202f9563590d051376bce721

SHA512
a8b4e49e93ab1941aff6373aa6abf524d3280ba3729c77c26f72b1a9c8365ff3cb38b322a311232a43de1ae04c72a46beb3f973ac4773acd26ec6dcf59b8b04f

Download Submit
\Windows\system\JwvdoAm.exe

Filesize
1.9MB

MD5
1f5d49c3357c36502467fa446892d567

SHA1
42cefbe40b3988094409f657e3144d155b45c8b7

SHA256
cd0f172ec2a707a65d1108a06061e07f79385fd6b0a905601af7bdc0aad465b6

SHA512
e2225b11d96672d91e88350a35102791b4b0e2073a863758fb10397327dd1ba5b8f2d64586429818542269e59f955fe2620a642b577d901b3cf166460c0d32df

Download Submit
\Windows\system\edbgSNE.exe

Filesize
1.9MB

MD5
ca329c5bbdb778b4eadba155079e8cf7

SHA1
1254ff76f363ddf7a47ae02df4b88d984c37142d

SHA256
f28f4d826e7c4ba9135a517134b4c68a5066f242a18a8686f1fa59b9e5ecf1d1

SHA512
e6fe703ab5173ef510c2fbf408d4545d68f3cfe15aab972b64c7667ab6e0a97afc8102b2f8976b5e2a791ac04f79671bcf8d75640a9d554c99e9ef9bded2fa59

Download Submit
memory/1616-5087-0x000000013F3E0000-0x000000013F7D2000-memory.dmp

Filesize
3.9MB

Download
memory/1616-38-0x000000013F3E0000-0x000000013F7D2000-memory.dmp

Filesize
3.9MB

Download
memory/1880-82-0x000000013F2E0000-0x000000013F6D2000-memory.dmp

Filesize
3.9MB

Download
memory/1932-67-0x000000001B630000-0x000000001B912000-memory.dmp

Filesize
2.9MB

Download
memory/1932-57-0x000007FEF65AE000-0x000007FEF65AF000-memory.dmp

Filesize
4KB

Download
memory/1932-68-0x000007FEF62F0000-0x000007FEF6C8D000-memory.dmp

Filesize
9.6MB

Download
memory/1932-88-0x0000000002810000-0x0000000002818000-memory.dmp

Filesize
32KB

Download
memory/2016-79-0x000000013F860000-0x000000013FC52000-memory.dmp

Filesize
3.9MB

Download
memory/2016-5160-0x000000013F860000-0x000000013FC52000-memory.dmp

Filesize
3.9MB

Download
memory/2028-90-0x0000000002F10000-0x0000000003302000-memory.dmp

Filesize
3.9MB

Download
memory/2028-69-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/2028-9847-0x000000013F700000-0x000000013FAF2000-memory.dmp

Filesize
3.9MB

Download
memory/2028-78-0x00000000033C0000-0x00000000037B2000-memory.dmp

Filesize
3.9MB

Download
memory/2028-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2028-76-0x00000000033C0000-0x00000000037B2000-memory.dmp

Filesize
3.9MB

Download
memory/2028-75-0x00000000033C0000-0x00000000037B2000-memory.dmp

Filesize
3.9MB

Download
memory/2028-92-0x000000013F2E0000-0x000000013F6D2000-memory.dmp

Filesize
3.9MB

Download
memory/2028-80-0x00000000033C0000-0x00000000037B2000-memory.dmp

Filesize
3.9MB

Download
memory/2028-12-0x000000013FB20000-0x000000013FF12000-memory.dmp

Filesize
3.9MB

Download
memory/2028-55-0x000000013FBC0000-0x000000013FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/2028-0-0x000000013F700000-0x000000013FAF2000-memory.dmp

Filesize
3.9MB

Download
memory/2028-33-0x0000000002F10000-0x0000000003302000-memory.dmp

Filesize
3.9MB

Download
memory/2028-91-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2104-13-0x000000013FB20000-0x000000013FF12000-memory.dmp

Filesize
3.9MB

Download
memory/2104-5098-0x000000013FB20000-0x000000013FF12000-memory.dmp

Filesize
3.9MB

Download
memory/2112-71-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2112-5116-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2244-81-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/2244-5217-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/2284-5162-0x000000013FD60000-0x0000000140152000-memory.dmp

Filesize
3.9MB

Download
memory/2284-14-0x000000013FD60000-0x0000000140152000-memory.dmp

Filesize
3.9MB

Download
memory/2684-5166-0x000000013F710000-0x000000013FB02000-memory.dmp

Filesize
3.9MB

Download
memory/2684-93-0x000000013F710000-0x000000013FB02000-memory.dmp

Filesize
3.9MB

Download
memory/2712-5219-0x000000013F9E0000-0x000000013FDD2000-memory.dmp

Filesize
3.9MB

Download
memory/2712-87-0x000000013F9E0000-0x000000013FDD2000-memory.dmp

Filesize
3.9MB

Download
memory/2928-5216-0x000000013FBC0000-0x000000013FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/2928-77-0x000000013FBC0000-0x000000013FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/2976-70-0x000000013F780000-0x000000013FB72000-memory.dmp

Filesize
3.9MB

Download
memory/2976-5110-0x000000013F780000-0x000000013FB72000-memory.dmp

Filesize
3.9MB

Download
memory/3056-5169-0x000000013F410000-0x000000013F802000-memory.dmp

Filesize
3.9MB

Download
memory/3056-89-0x000000013F410000-0x000000013F802000-memory.dmp

Filesize
3.9MB

Download