xmrig | 900dea0c73214d95824c9a873a590bffeee2f0b9b6c1e43652c1765971812384

Analysis

max time kernel
119s
max time network
118s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06/08/2024, 05:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

65537fa8e9151c10e492991f73d20930N.exe
Size

1.2MB
MD5

65537fa8e9151c10e492991f73d20930
SHA1

a159141509e7f41ef35aad9106d6fb662cfe1576
SHA256

900dea0c73214d95824c9a873a590bffeee2f0b9b6c1e43652c1765971812384
SHA512

613494d961f45684603122f1a41df8ce7d86185f543c390dd4ec8710409e4fff9018aa63dede5868dd1faa9d00557729b81f1e6b7e1b8d629a0ae2bdc29c94ab
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYsfLGrAvWWXkCV+1MKTbcMfHLF:Lz071uv4BPMkibTIA5sf6r+WVc2HLF

Score

10^/10

xmrig execution miner persistence privilege_escalation upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 22 IoCs

miner

resource	yara_rule
behavioral1/memory/2632-427-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	xmrig
behavioral1/memory/2380-599-0x000000013FCC0000-0x00000001400B2000-memory.dmp	xmrig
behavioral1/memory/2408-580-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	xmrig
behavioral1/memory/2684-425-0x000000013F720000-0x000000013FB12000-memory.dmp	xmrig
behavioral1/memory/2944-423-0x000000013F140000-0x000000013F532000-memory.dmp	xmrig
behavioral1/memory/2828-421-0x000000013FB60000-0x000000013FF52000-memory.dmp	xmrig
behavioral1/memory/2932-419-0x000000013FD60000-0x0000000140152000-memory.dmp	xmrig
behavioral1/memory/3032-417-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	xmrig
behavioral1/memory/2604-244-0x000000013F830000-0x000000013FC22000-memory.dmp	xmrig
behavioral1/memory/2008-242-0x000000013F850000-0x000000013FC42000-memory.dmp	xmrig
behavioral1/memory/2816-238-0x000000013FE30000-0x0000000140222000-memory.dmp	xmrig
behavioral1/memory/2636-231-0x000000013FA10000-0x000000013FE02000-memory.dmp	xmrig
behavioral1/memory/2828-5929-0x000000013FB60000-0x000000013FF52000-memory.dmp	xmrig
behavioral1/memory/2408-5933-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	xmrig
behavioral1/memory/3032-5893-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	xmrig
behavioral1/memory/2632-6039-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	xmrig
behavioral1/memory/2816-6037-0x000000013FE30000-0x0000000140222000-memory.dmp	xmrig
behavioral1/memory/2380-6035-0x000000013FCC0000-0x00000001400B2000-memory.dmp	xmrig
behavioral1/memory/2944-6033-0x000000013F140000-0x000000013F532000-memory.dmp	xmrig
behavioral1/memory/2932-6031-0x000000013FD60000-0x0000000140152000-memory.dmp	xmrig
behavioral1/memory/2604-6030-0x000000013F830000-0x000000013FC22000-memory.dmp	xmrig
behavioral1/memory/2064-9773-0x000000013F800000-0x000000013FBF2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2280	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2636	wwbsaQv.exe
2816	nGkIqUR.exe
2008	YeQhynl.exe
2604	mUmYyfn.exe
3032	ppeEQqN.exe
2932	SFSrsCJ.exe
2828	wBZfdod.exe
2944	CxseAJu.exe
2684	wUcptlO.exe
2632	kZmNtST.exe
2408	bPzywBL.exe
2380	uyEcNOg.exe
2904	ROfndyN.exe
1820	rnSijDP.exe
804	GPgPrRt.exe
2372	obMJatm.exe
876	XNrsZzE.exe
944	XABszUu.exe
1264	YzCDHTS.exe
3028	ckGVnnf.exe
2900	zWQDcPG.exe
3064	qYKaANi.exe
3068	vrbljbY.exe
3048	QiMhwRt.exe
3016	HPmvnaP.exe
2284	yiwNfdF.exe
2084	DwqXSBz.exe
2520	PWTkOqT.exe
2608	FwATYqC.exe
2216	Skvoqnj.exe
2464	uhgMwJp.exe
380	ucIwYLo.exe
908	qQJLHry.exe
700	moMSHgT.exe
548	hnuOyMm.exe
2004	wYiQmPH.exe
2528	oKUepDm.exe
1084	gsYImPQ.exe
1828	OcdZgZX.exe
1796	IVUlsHY.exe
1536	cdGIRKm.exe
2188	xlYLruH.exe
2184	EsXRTRT.exe
1476	GpsYEOS.exe
1816	orIOUZg.exe
340	boCYxFm.exe
1376	vZCnmpQ.exe
756	fJwzWzP.exe
1964	WprCqXc.exe
2168	OALYNTC.exe
684	lGXqVAz.exe
1716	UlARPyF.exe
1680	vtZbLfv.exe
2548	scGtinT.exe
1104	NmTObye.exe
296	pVmqyql.exe
568	YHGbCrK.exe
2220	HuZMzTk.exe
2160	wpgiLKZ.exe
2824	jKaTRoY.exe
2720	wsEWOvd.exe
2556	jyXNkGx.exe
2876	KIUvCkZ.exe
692	qrpEQPU.exe

Loads dropped DLL 64 IoCs

pid	Process
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe
2064	65537fa8e9151c10e492991f73d20930N.exe

UPX packed file 55 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2064-1-0x000000013F800000-0x000000013FBF2000-memory.dmp	upx
behavioral1/files/0x00090000000120fa-5.dat	upx
behavioral1/files/0x00070000000193df-13.dat	upx
behavioral1/files/0x000f00000000549c-20.dat	upx
behavioral1/files/0x0008000000019427-24.dat	upx
behavioral1/files/0x000600000001945a-28.dat	upx
behavioral1/files/0x00060000000194f7-31.dat	upx
behavioral1/files/0x00070000000195d8-39.dat	upx
behavioral1/files/0x000500000001a3c3-47.dat	upx
behavioral1/files/0x000500000001a453-56.dat	upx
behavioral1/files/0x000500000001a459-61.dat	upx
behavioral1/files/0x000500000001a4b2-80.dat	upx
behavioral1/files/0x000500000001a4d1-105.dat	upx
behavioral1/files/0x000500000001a4d7-116.dat	upx
behavioral1/files/0x000500000001a4dc-129.dat	upx
behavioral1/memory/2632-427-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	upx
behavioral1/memory/2380-599-0x000000013FCC0000-0x00000001400B2000-memory.dmp	upx
behavioral1/memory/2408-580-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	upx
behavioral1/memory/2684-425-0x000000013F720000-0x000000013FB12000-memory.dmp	upx
behavioral1/memory/2944-423-0x000000013F140000-0x000000013F532000-memory.dmp	upx
behavioral1/memory/2828-421-0x000000013FB60000-0x000000013FF52000-memory.dmp	upx
behavioral1/memory/2932-419-0x000000013FD60000-0x0000000140152000-memory.dmp	upx
behavioral1/memory/3032-417-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	upx
behavioral1/memory/2604-244-0x000000013F830000-0x000000013FC22000-memory.dmp	upx
behavioral1/memory/2008-242-0x000000013F850000-0x000000013FC42000-memory.dmp	upx
behavioral1/memory/2816-238-0x000000013FE30000-0x0000000140222000-memory.dmp	upx
behavioral1/memory/2636-231-0x000000013FA10000-0x000000013FE02000-memory.dmp	upx
behavioral1/files/0x000500000001a4e0-137.dat	upx
behavioral1/files/0x000500000001a4de-132.dat	upx
behavioral1/files/0x0034000000019338-124.dat	upx
behavioral1/files/0x000500000001a4da-121.dat	upx
behavioral1/files/0x000500000001a4d5-113.dat	upx
behavioral1/files/0x000500000001a4d3-108.dat	upx
behavioral1/files/0x000500000001a4cf-100.dat	upx
behavioral1/files/0x000500000001a4c9-96.dat	upx
behavioral1/files/0x000500000001a4bf-92.dat	upx
behavioral1/files/0x000500000001a4bd-89.dat	upx
behavioral1/files/0x000500000001a4b5-84.dat	upx
behavioral1/files/0x000500000001a496-76.dat	upx
behavioral1/files/0x000500000001a463-72.dat	upx
behavioral1/files/0x000500000001a461-69.dat	upx
behavioral1/files/0x000500000001a45b-64.dat	upx
behavioral1/files/0x000500000001a3fd-51.dat	upx
behavioral1/files/0x000500000001a0da-43.dat	upx
behavioral1/files/0x000600000001950b-36.dat	upx
behavioral1/memory/2828-5929-0x000000013FB60000-0x000000013FF52000-memory.dmp	upx
behavioral1/memory/2408-5933-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	upx
behavioral1/memory/3032-5893-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	upx
behavioral1/memory/2632-6039-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	upx
behavioral1/memory/2816-6037-0x000000013FE30000-0x0000000140222000-memory.dmp	upx
behavioral1/memory/2380-6035-0x000000013FCC0000-0x00000001400B2000-memory.dmp	upx
behavioral1/memory/2944-6033-0x000000013F140000-0x000000013F532000-memory.dmp	upx
behavioral1/memory/2932-6031-0x000000013FD60000-0x0000000140152000-memory.dmp	upx
behavioral1/memory/2604-6030-0x000000013F830000-0x000000013FC22000-memory.dmp	upx
behavioral1/memory/2064-9773-0x000000013F800000-0x000000013FBF2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\sdoDrDi.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\KuwHYps.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\ZUqsEgO.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\jrHZVJJ.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\BphwTXe.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\UQFUiVp.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\ZHvmqEq.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\chBnayW.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\ELFepjK.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\kyLjkDY.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\oZQinUF.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\eETPEzq.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\Xiqhuox.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\ZuOKPYt.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\tIJjxjU.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\dSeUSSw.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\mcJVcAU.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\gTkarZI.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\FQasfkY.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\vpPvOiQ.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\MZBObLb.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\WAEWcNd.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\EKUjxrt.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\WIpRhtN.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\OaixQDR.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\GOOroDA.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\dfbZUDb.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\UBocUxU.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\kZPVIHQ.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\AsuSLxE.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\JTIRCgv.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\vbKnZpw.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\ryyMQeU.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\dohvVXi.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\JYaWTRN.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\cqUWbGH.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\lLCSQrI.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\SVmkEVD.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\uobGccc.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\gVLgdLn.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\cPIIEvZ.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\hlHMlaC.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\YrAzaCf.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\KXHrDrB.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\LtktWOy.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\oKqbdOB.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\BDGGuaY.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\JIiEBom.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\KzjvNNz.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\TSaTKyg.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\hcLTAPS.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\UmpBHcd.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\fDIlmAt.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\XsTIchM.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\wOCPEdR.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\khQpuRT.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\PeaoXqT.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\WzIRVOK.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\wfFQkGc.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\TWHGgEm.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\mHCKuEJ.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\AZSisFD.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\LxLcgLs.exe	65537fa8e9151c10e492991f73d20930N.exe
File created	C:\Windows\System\PnQgWcK.exe	65537fa8e9151c10e492991f73d20930N.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2280	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2064	65537fa8e9151c10e492991f73d20930N.exe
Token: SeLockMemoryPrivilege	2064	65537fa8e9151c10e492991f73d20930N.exe
Token: SeDebugPrivilege	2280	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 2280	2064	65537fa8e9151c10e492991f73d20930N.exe	31
PID 2064 wrote to memory of 2280	2064	65537fa8e9151c10e492991f73d20930N.exe	31
PID 2064 wrote to memory of 2280	2064	65537fa8e9151c10e492991f73d20930N.exe	31
PID 2064 wrote to memory of 2636	2064	65537fa8e9151c10e492991f73d20930N.exe	32
PID 2064 wrote to memory of 2636	2064	65537fa8e9151c10e492991f73d20930N.exe	32
PID 2064 wrote to memory of 2636	2064	65537fa8e9151c10e492991f73d20930N.exe	32
PID 2064 wrote to memory of 2816	2064	65537fa8e9151c10e492991f73d20930N.exe	33
PID 2064 wrote to memory of 2816	2064	65537fa8e9151c10e492991f73d20930N.exe	33
PID 2064 wrote to memory of 2816	2064	65537fa8e9151c10e492991f73d20930N.exe	33
PID 2064 wrote to memory of 2008	2064	65537fa8e9151c10e492991f73d20930N.exe	34
PID 2064 wrote to memory of 2008	2064	65537fa8e9151c10e492991f73d20930N.exe	34
PID 2064 wrote to memory of 2008	2064	65537fa8e9151c10e492991f73d20930N.exe	34
PID 2064 wrote to memory of 2604	2064	65537fa8e9151c10e492991f73d20930N.exe	35
PID 2064 wrote to memory of 2604	2064	65537fa8e9151c10e492991f73d20930N.exe	35
PID 2064 wrote to memory of 2604	2064	65537fa8e9151c10e492991f73d20930N.exe	35
PID 2064 wrote to memory of 3032	2064	65537fa8e9151c10e492991f73d20930N.exe	36
PID 2064 wrote to memory of 3032	2064	65537fa8e9151c10e492991f73d20930N.exe	36
PID 2064 wrote to memory of 3032	2064	65537fa8e9151c10e492991f73d20930N.exe	36
PID 2064 wrote to memory of 2932	2064	65537fa8e9151c10e492991f73d20930N.exe	37
PID 2064 wrote to memory of 2932	2064	65537fa8e9151c10e492991f73d20930N.exe	37
PID 2064 wrote to memory of 2932	2064	65537fa8e9151c10e492991f73d20930N.exe	37
PID 2064 wrote to memory of 2828	2064	65537fa8e9151c10e492991f73d20930N.exe	38
PID 2064 wrote to memory of 2828	2064	65537fa8e9151c10e492991f73d20930N.exe	38
PID 2064 wrote to memory of 2828	2064	65537fa8e9151c10e492991f73d20930N.exe	38
PID 2064 wrote to memory of 2944	2064	65537fa8e9151c10e492991f73d20930N.exe	39
PID 2064 wrote to memory of 2944	2064	65537fa8e9151c10e492991f73d20930N.exe	39
PID 2064 wrote to memory of 2944	2064	65537fa8e9151c10e492991f73d20930N.exe	39
PID 2064 wrote to memory of 2684	2064	65537fa8e9151c10e492991f73d20930N.exe	40
PID 2064 wrote to memory of 2684	2064	65537fa8e9151c10e492991f73d20930N.exe	40
PID 2064 wrote to memory of 2684	2064	65537fa8e9151c10e492991f73d20930N.exe	40
PID 2064 wrote to memory of 2632	2064	65537fa8e9151c10e492991f73d20930N.exe	41
PID 2064 wrote to memory of 2632	2064	65537fa8e9151c10e492991f73d20930N.exe	41
PID 2064 wrote to memory of 2632	2064	65537fa8e9151c10e492991f73d20930N.exe	41
PID 2064 wrote to memory of 2408	2064	65537fa8e9151c10e492991f73d20930N.exe	42
PID 2064 wrote to memory of 2408	2064	65537fa8e9151c10e492991f73d20930N.exe	42
PID 2064 wrote to memory of 2408	2064	65537fa8e9151c10e492991f73d20930N.exe	42
PID 2064 wrote to memory of 2380	2064	65537fa8e9151c10e492991f73d20930N.exe	43
PID 2064 wrote to memory of 2380	2064	65537fa8e9151c10e492991f73d20930N.exe	43
PID 2064 wrote to memory of 2380	2064	65537fa8e9151c10e492991f73d20930N.exe	43
PID 2064 wrote to memory of 2904	2064	65537fa8e9151c10e492991f73d20930N.exe	44
PID 2064 wrote to memory of 2904	2064	65537fa8e9151c10e492991f73d20930N.exe	44
PID 2064 wrote to memory of 2904	2064	65537fa8e9151c10e492991f73d20930N.exe	44
PID 2064 wrote to memory of 1820	2064	65537fa8e9151c10e492991f73d20930N.exe	45
PID 2064 wrote to memory of 1820	2064	65537fa8e9151c10e492991f73d20930N.exe	45
PID 2064 wrote to memory of 1820	2064	65537fa8e9151c10e492991f73d20930N.exe	45
PID 2064 wrote to memory of 804	2064	65537fa8e9151c10e492991f73d20930N.exe	46
PID 2064 wrote to memory of 804	2064	65537fa8e9151c10e492991f73d20930N.exe	46
PID 2064 wrote to memory of 804	2064	65537fa8e9151c10e492991f73d20930N.exe	46
PID 2064 wrote to memory of 2372	2064	65537fa8e9151c10e492991f73d20930N.exe	47
PID 2064 wrote to memory of 2372	2064	65537fa8e9151c10e492991f73d20930N.exe	47
PID 2064 wrote to memory of 2372	2064	65537fa8e9151c10e492991f73d20930N.exe	47
PID 2064 wrote to memory of 876	2064	65537fa8e9151c10e492991f73d20930N.exe	48
PID 2064 wrote to memory of 876	2064	65537fa8e9151c10e492991f73d20930N.exe	48
PID 2064 wrote to memory of 876	2064	65537fa8e9151c10e492991f73d20930N.exe	48
PID 2064 wrote to memory of 944	2064	65537fa8e9151c10e492991f73d20930N.exe	49
PID 2064 wrote to memory of 944	2064	65537fa8e9151c10e492991f73d20930N.exe	49
PID 2064 wrote to memory of 944	2064	65537fa8e9151c10e492991f73d20930N.exe	49
PID 2064 wrote to memory of 1264	2064	65537fa8e9151c10e492991f73d20930N.exe	50
PID 2064 wrote to memory of 1264	2064	65537fa8e9151c10e492991f73d20930N.exe	50
PID 2064 wrote to memory of 1264	2064	65537fa8e9151c10e492991f73d20930N.exe	50
PID 2064 wrote to memory of 3028	2064	65537fa8e9151c10e492991f73d20930N.exe	51
PID 2064 wrote to memory of 3028	2064	65537fa8e9151c10e492991f73d20930N.exe	51
PID 2064 wrote to memory of 3028	2064	65537fa8e9151c10e492991f73d20930N.exe	51
PID 2064 wrote to memory of 2900	2064	65537fa8e9151c10e492991f73d20930N.exe	52

C:\Users\Admin\AppData\Local\Temp\65537fa8e9151c10e492991f73d20930N.exe
"C:\Users\Admin\AppData\Local\Temp\65537fa8e9151c10e492991f73d20930N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2280
- C:\Windows\System\wwbsaQv.exe
  C:\Windows\System\wwbsaQv.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\nGkIqUR.exe
  C:\Windows\System\nGkIqUR.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\YeQhynl.exe
  C:\Windows\System\YeQhynl.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\mUmYyfn.exe
  C:\Windows\System\mUmYyfn.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\ppeEQqN.exe
  C:\Windows\System\ppeEQqN.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\SFSrsCJ.exe
  C:\Windows\System\SFSrsCJ.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\wBZfdod.exe
  C:\Windows\System\wBZfdod.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\CxseAJu.exe
  C:\Windows\System\CxseAJu.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\wUcptlO.exe
  C:\Windows\System\wUcptlO.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\kZmNtST.exe
  C:\Windows\System\kZmNtST.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\bPzywBL.exe
  C:\Windows\System\bPzywBL.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\uyEcNOg.exe
  C:\Windows\System\uyEcNOg.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\ROfndyN.exe
  C:\Windows\System\ROfndyN.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\rnSijDP.exe
  C:\Windows\System\rnSijDP.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\GPgPrRt.exe
  C:\Windows\System\GPgPrRt.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\obMJatm.exe
  C:\Windows\System\obMJatm.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\XNrsZzE.exe
  C:\Windows\System\XNrsZzE.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\XABszUu.exe
  C:\Windows\System\XABszUu.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\YzCDHTS.exe
  C:\Windows\System\YzCDHTS.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\ckGVnnf.exe
  C:\Windows\System\ckGVnnf.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\zWQDcPG.exe
  C:\Windows\System\zWQDcPG.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\qYKaANi.exe
  C:\Windows\System\qYKaANi.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\vrbljbY.exe
  C:\Windows\System\vrbljbY.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\QiMhwRt.exe
  C:\Windows\System\QiMhwRt.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\HPmvnaP.exe
  C:\Windows\System\HPmvnaP.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\yiwNfdF.exe
  C:\Windows\System\yiwNfdF.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\DwqXSBz.exe
  C:\Windows\System\DwqXSBz.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\PWTkOqT.exe
  C:\Windows\System\PWTkOqT.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\FwATYqC.exe
  C:\Windows\System\FwATYqC.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\Skvoqnj.exe
  C:\Windows\System\Skvoqnj.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\uhgMwJp.exe
  C:\Windows\System\uhgMwJp.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\ucIwYLo.exe
  C:\Windows\System\ucIwYLo.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\qQJLHry.exe
  C:\Windows\System\qQJLHry.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\moMSHgT.exe
  C:\Windows\System\moMSHgT.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\hnuOyMm.exe
  C:\Windows\System\hnuOyMm.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\wYiQmPH.exe
  C:\Windows\System\wYiQmPH.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\oKUepDm.exe
  C:\Windows\System\oKUepDm.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\gsYImPQ.exe
  C:\Windows\System\gsYImPQ.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\OcdZgZX.exe
  C:\Windows\System\OcdZgZX.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\IVUlsHY.exe
  C:\Windows\System\IVUlsHY.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\cdGIRKm.exe
  C:\Windows\System\cdGIRKm.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\xlYLruH.exe
  C:\Windows\System\xlYLruH.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\EsXRTRT.exe
  C:\Windows\System\EsXRTRT.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\GpsYEOS.exe
  C:\Windows\System\GpsYEOS.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\orIOUZg.exe
  C:\Windows\System\orIOUZg.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\boCYxFm.exe
  C:\Windows\System\boCYxFm.exe
  2⤵
  - Executes dropped EXE
  PID:340
- C:\Windows\System\vZCnmpQ.exe
  C:\Windows\System\vZCnmpQ.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\fJwzWzP.exe
  C:\Windows\System\fJwzWzP.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\WprCqXc.exe
  C:\Windows\System\WprCqXc.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\OALYNTC.exe
  C:\Windows\System\OALYNTC.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\lGXqVAz.exe
  C:\Windows\System\lGXqVAz.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\UlARPyF.exe
  C:\Windows\System\UlARPyF.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\vtZbLfv.exe
  C:\Windows\System\vtZbLfv.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\scGtinT.exe
  C:\Windows\System\scGtinT.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\NmTObye.exe
  C:\Windows\System\NmTObye.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\pVmqyql.exe
  C:\Windows\System\pVmqyql.exe
  2⤵
  - Executes dropped EXE
  PID:296
- C:\Windows\System\YHGbCrK.exe
  C:\Windows\System\YHGbCrK.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\HuZMzTk.exe
  C:\Windows\System\HuZMzTk.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\wpgiLKZ.exe
  C:\Windows\System\wpgiLKZ.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\dpNWlzA.exe
  C:\Windows\System\dpNWlzA.exe
  2⤵
  PID:2960
- C:\Windows\System\jKaTRoY.exe
  C:\Windows\System\jKaTRoY.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\ppfueLy.exe
  C:\Windows\System\ppfueLy.exe
  2⤵
  PID:2116
- C:\Windows\System\wsEWOvd.exe
  C:\Windows\System\wsEWOvd.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\lwXTbkB.exe
  C:\Windows\System\lwXTbkB.exe
  2⤵
  PID:320
- C:\Windows\System\jyXNkGx.exe
  C:\Windows\System\jyXNkGx.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\hWxNIEZ.exe
  C:\Windows\System\hWxNIEZ.exe
  2⤵
  PID:2648
- C:\Windows\System\KIUvCkZ.exe
  C:\Windows\System\KIUvCkZ.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\lOGLdEf.exe
  C:\Windows\System\lOGLdEf.exe
  2⤵
  PID:2672
- C:\Windows\System\qrpEQPU.exe
  C:\Windows\System\qrpEQPU.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\MWCqERf.exe
  C:\Windows\System\MWCqERf.exe
  2⤵
  PID:2644
- C:\Windows\System\WIpRhtN.exe
  C:\Windows\System\WIpRhtN.exe
  2⤵
  PID:2972
- C:\Windows\System\HVEfSyR.exe
  C:\Windows\System\HVEfSyR.exe
  2⤵
  PID:2204
- C:\Windows\System\fadyBot.exe
  C:\Windows\System\fadyBot.exe
  2⤵
  PID:2476
- C:\Windows\System\LedtLfZ.exe
  C:\Windows\System\LedtLfZ.exe
  2⤵
  PID:2288
- C:\Windows\System\EpLLdYS.exe
  C:\Windows\System\EpLLdYS.exe
  2⤵
  PID:924
- C:\Windows\System\BSHbqmv.exe
  C:\Windows\System\BSHbqmv.exe
  2⤵
  PID:1532
- C:\Windows\System\TwNeUru.exe
  C:\Windows\System\TwNeUru.exe
  2⤵
  PID:2616
- C:\Windows\System\rAfHoFu.exe
  C:\Windows\System\rAfHoFu.exe
  2⤵
  PID:1624
- C:\Windows\System\RLbzSsF.exe
  C:\Windows\System\RLbzSsF.exe
  2⤵
  PID:2228
- C:\Windows\System\OyZOHNL.exe
  C:\Windows\System\OyZOHNL.exe
  2⤵
  PID:1712
- C:\Windows\System\TfQlAHP.exe
  C:\Windows\System\TfQlAHP.exe
  2⤵
  PID:2024
- C:\Windows\System\iXwbGrg.exe
  C:\Windows\System\iXwbGrg.exe
  2⤵
  PID:768
- C:\Windows\System\xEDBWHi.exe
  C:\Windows\System\xEDBWHi.exe
  2⤵
  PID:668
- C:\Windows\System\dXpuIgf.exe
  C:\Windows\System\dXpuIgf.exe
  2⤵
  PID:1068
- C:\Windows\System\LFlZEXG.exe
  C:\Windows\System\LFlZEXG.exe
  2⤵
  PID:1756
- C:\Windows\System\cVgtJti.exe
  C:\Windows\System\cVgtJti.exe
  2⤵
  PID:2328
- C:\Windows\System\KGJkUjG.exe
  C:\Windows\System\KGJkUjG.exe
  2⤵
  PID:984
- C:\Windows\System\KVFszqP.exe
  C:\Windows\System\KVFszqP.exe
  2⤵
  PID:2712
- C:\Windows\System\TxiVIQB.exe
  C:\Windows\System\TxiVIQB.exe
  2⤵
  PID:2984
- C:\Windows\System\biikrHS.exe
  C:\Windows\System\biikrHS.exe
  2⤵
  PID:884
- C:\Windows\System\alBDdRB.exe
  C:\Windows\System\alBDdRB.exe
  2⤵
  PID:1692
- C:\Windows\System\AoYXVJa.exe
  C:\Windows\System\AoYXVJa.exe
  2⤵
  PID:1976
- C:\Windows\System\ETETxQG.exe
  C:\Windows\System\ETETxQG.exe
  2⤵
  PID:2052
- C:\Windows\System\vZmycIl.exe
  C:\Windows\System\vZmycIl.exe
  2⤵
  PID:1560
- C:\Windows\System\xkMXYiy.exe
  C:\Windows\System\xkMXYiy.exe
  2⤵
  PID:1708
- C:\Windows\System\LomqmnS.exe
  C:\Windows\System\LomqmnS.exe
  2⤵
  PID:2772
- C:\Windows\System\bvFeZuB.exe
  C:\Windows\System\bvFeZuB.exe
  2⤵
  PID:2940
- C:\Windows\System\oCzdGrJ.exe
  C:\Windows\System\oCzdGrJ.exe
  2⤵
  PID:2176
- C:\Windows\System\TPYbGQt.exe
  C:\Windows\System\TPYbGQt.exe
  2⤵
  PID:2852
- C:\Windows\System\mHPmfht.exe
  C:\Windows\System\mHPmfht.exe
  2⤵
  PID:2456
- C:\Windows\System\iBLHPOS.exe
  C:\Windows\System\iBLHPOS.exe
  2⤵
  PID:1504
- C:\Windows\System\IrEYOzE.exe
  C:\Windows\System\IrEYOzE.exe
  2⤵
  PID:2468
- C:\Windows\System\cBgHxmO.exe
  C:\Windows\System\cBgHxmO.exe
  2⤵
  PID:2728
- C:\Windows\System\oAKgube.exe
  C:\Windows\System\oAKgube.exe
  2⤵
  PID:2832
- C:\Windows\System\eqewhoJ.exe
  C:\Windows\System\eqewhoJ.exe
  2⤵
  PID:2588
- C:\Windows\System\uOrEPwS.exe
  C:\Windows\System\uOrEPwS.exe
  2⤵
  PID:448
- C:\Windows\System\izTKCBj.exe
  C:\Windows\System\izTKCBj.exe
  2⤵
  PID:2804
- C:\Windows\System\CBaniLZ.exe
  C:\Windows\System\CBaniLZ.exe
  2⤵
  PID:332
- C:\Windows\System\OmLjISw.exe
  C:\Windows\System\OmLjISw.exe
  2⤵
  PID:2864
- C:\Windows\System\DjVyDvp.exe
  C:\Windows\System\DjVyDvp.exe
  2⤵
  PID:2680
- C:\Windows\System\sSGYwTt.exe
  C:\Windows\System\sSGYwTt.exe
  2⤵
  PID:2156
- C:\Windows\System\SsMBGMJ.exe
  C:\Windows\System\SsMBGMJ.exe
  2⤵
  PID:2340
- C:\Windows\System\ckFNMFB.exe
  C:\Windows\System\ckFNMFB.exe
  2⤵
  PID:2952
- C:\Windows\System\cYYdKKT.exe
  C:\Windows\System\cYYdKKT.exe
  2⤵
  PID:1128
- C:\Windows\System\mCiTtba.exe
  C:\Windows\System\mCiTtba.exe
  2⤵
  PID:2200
- C:\Windows\System\sKUETkD.exe
  C:\Windows\System\sKUETkD.exe
  2⤵
  PID:1696
- C:\Windows\System\oQCixJs.exe
  C:\Windows\System\oQCixJs.exe
  2⤵
  PID:1700
- C:\Windows\System\NvsSOil.exe
  C:\Windows\System\NvsSOil.exe
  2⤵
  PID:2304
- C:\Windows\System\cYQhqWE.exe
  C:\Windows\System\cYQhqWE.exe
  2⤵
  PID:2060
- C:\Windows\System\OVtctSl.exe
  C:\Windows\System\OVtctSl.exe
  2⤵
  PID:3008
- C:\Windows\System\kUQNclU.exe
  C:\Windows\System\kUQNclU.exe
  2⤵
  PID:2296
- C:\Windows\System\ySmMSXG.exe
  C:\Windows\System\ySmMSXG.exe
  2⤵
  PID:1420
- C:\Windows\System\gCnaMfM.exe
  C:\Windows\System\gCnaMfM.exe
  2⤵
  PID:1584
- C:\Windows\System\SCpxVae.exe
  C:\Windows\System\SCpxVae.exe
  2⤵
  PID:1932
- C:\Windows\System\qoILniK.exe
  C:\Windows\System\qoILniK.exe
  2⤵
  PID:2996
- C:\Windows\System\DBNoxQc.exe
  C:\Windows\System\DBNoxQc.exe
  2⤵
  PID:2352
- C:\Windows\System\iAFvhnc.exe
  C:\Windows\System\iAFvhnc.exe
  2⤵
  PID:1044
- C:\Windows\System\YAMinlX.exe
  C:\Windows\System\YAMinlX.exe
  2⤵
  PID:1080
- C:\Windows\System\fHgyVIa.exe
  C:\Windows\System\fHgyVIa.exe
  2⤵
  PID:2360
- C:\Windows\System\urlrohH.exe
  C:\Windows\System\urlrohH.exe
  2⤵
  PID:2120
- C:\Windows\System\HOxDiDO.exe
  C:\Windows\System\HOxDiDO.exe
  2⤵
  PID:3020
- C:\Windows\System\xikaOgf.exe
  C:\Windows\System\xikaOgf.exe
  2⤵
  PID:2612
- C:\Windows\System\NONWQDI.exe
  C:\Windows\System\NONWQDI.exe
  2⤵
  PID:2660
- C:\Windows\System\fOQNXPx.exe
  C:\Windows\System\fOQNXPx.exe
  2⤵
  PID:2532
- C:\Windows\System\NkyTAzI.exe
  C:\Windows\System\NkyTAzI.exe
  2⤵
  PID:1120
- C:\Windows\System\DebZtdm.exe
  C:\Windows\System\DebZtdm.exe
  2⤵
  PID:1996
- C:\Windows\System\GaoeTaT.exe
  C:\Windows\System\GaoeTaT.exe
  2⤵
  PID:2716
- C:\Windows\System\pvfhluR.exe
  C:\Windows\System\pvfhluR.exe
  2⤵
  PID:1728
- C:\Windows\System\noXhqcz.exe
  C:\Windows\System\noXhqcz.exe
  2⤵
  PID:2196
- C:\Windows\System\pFEpZvS.exe
  C:\Windows\System\pFEpZvS.exe
  2⤵
  PID:2936
- C:\Windows\System\IWTdoPc.exe
  C:\Windows\System\IWTdoPc.exe
  2⤵
  PID:1204
- C:\Windows\System\HepwbTl.exe
  C:\Windows\System\HepwbTl.exe
  2⤵
  PID:2848
- C:\Windows\System\hdzSrEH.exe
  C:\Windows\System\hdzSrEH.exe
  2⤵
  PID:1036
- C:\Windows\System\uZRBJft.exe
  C:\Windows\System\uZRBJft.exe
  2⤵
  PID:2884
- C:\Windows\System\DPzhmjy.exe
  C:\Windows\System\DPzhmjy.exe
  2⤵
  PID:2504
- C:\Windows\System\spiPjdE.exe
  C:\Windows\System\spiPjdE.exe
  2⤵
  PID:1732
- C:\Windows\System\IvblVcg.exe
  C:\Windows\System\IvblVcg.exe
  2⤵
  PID:1672
- C:\Windows\System\TZWTooj.exe
  C:\Windows\System\TZWTooj.exe
  2⤵
  PID:2752
- C:\Windows\System\qxNIAOk.exe
  C:\Windows\System\qxNIAOk.exe
  2⤵
  PID:1592
- C:\Windows\System\DZHfdCm.exe
  C:\Windows\System\DZHfdCm.exe
  2⤵
  PID:2676
- C:\Windows\System\ezAKRUA.exe
  C:\Windows\System\ezAKRUA.exe
  2⤵
  PID:3376
- C:\Windows\System\SvmtvCS.exe
  C:\Windows\System\SvmtvCS.exe
  2⤵
  PID:3396
- C:\Windows\System\XRbCTOD.exe
  C:\Windows\System\XRbCTOD.exe
  2⤵
  PID:3412
- C:\Windows\System\fmzUUkh.exe
  C:\Windows\System\fmzUUkh.exe
  2⤵
  PID:3428
- C:\Windows\System\HuvMpvJ.exe
  C:\Windows\System\HuvMpvJ.exe
  2⤵
  PID:3444
- C:\Windows\System\ZHraOZI.exe
  C:\Windows\System\ZHraOZI.exe
  2⤵
  PID:3460
- C:\Windows\System\BjHNeND.exe
  C:\Windows\System\BjHNeND.exe
  2⤵
  PID:3476
- C:\Windows\System\conIxtj.exe
  C:\Windows\System\conIxtj.exe
  2⤵
  PID:3492
- C:\Windows\System\xWCCOQX.exe
  C:\Windows\System\xWCCOQX.exe
  2⤵
  PID:3508
- C:\Windows\System\bcjSrpZ.exe
  C:\Windows\System\bcjSrpZ.exe
  2⤵
  PID:3524
- C:\Windows\System\mZUEZCA.exe
  C:\Windows\System\mZUEZCA.exe
  2⤵
  PID:3540
- C:\Windows\System\IYlqqnW.exe
  C:\Windows\System\IYlqqnW.exe
  2⤵
  PID:3556
- C:\Windows\System\jXCgHKZ.exe
  C:\Windows\System\jXCgHKZ.exe
  2⤵
  PID:3572
- C:\Windows\System\EEBiQMv.exe
  C:\Windows\System\EEBiQMv.exe
  2⤵
  PID:3796
- C:\Windows\System\bDiaJKb.exe
  C:\Windows\System\bDiaJKb.exe
  2⤵
  PID:3820
- C:\Windows\System\NITUIgs.exe
  C:\Windows\System\NITUIgs.exe
  2⤵
  PID:3836
- C:\Windows\System\TdfoVfV.exe
  C:\Windows\System\TdfoVfV.exe
  2⤵
  PID:3856
- C:\Windows\System\jrHZVJJ.exe
  C:\Windows\System\jrHZVJJ.exe
  2⤵
  PID:3872
- C:\Windows\System\ZhjQNzI.exe
  C:\Windows\System\ZhjQNzI.exe
  2⤵
  PID:3888
- C:\Windows\System\uzNhcxO.exe
  C:\Windows\System\uzNhcxO.exe
  2⤵
  PID:3904
- C:\Windows\System\rhiAqqI.exe
  C:\Windows\System\rhiAqqI.exe
  2⤵
  PID:3920
- C:\Windows\System\zzhovQg.exe
  C:\Windows\System\zzhovQg.exe
  2⤵
  PID:3936
- C:\Windows\System\mCDtVdu.exe
  C:\Windows\System\mCDtVdu.exe
  2⤵
  PID:3956
- C:\Windows\System\fcGSvhn.exe
  C:\Windows\System\fcGSvhn.exe
  2⤵
  PID:3972
- C:\Windows\System\qtTRJlZ.exe
  C:\Windows\System\qtTRJlZ.exe
  2⤵
  PID:3988
- C:\Windows\System\jbIgSwf.exe
  C:\Windows\System\jbIgSwf.exe
  2⤵
  PID:4004
- C:\Windows\System\fVoflLK.exe
  C:\Windows\System\fVoflLK.exe
  2⤵
  PID:4020
- C:\Windows\System\ppkoXHV.exe
  C:\Windows\System\ppkoXHV.exe
  2⤵
  PID:4036
- C:\Windows\System\ISYlsTC.exe
  C:\Windows\System\ISYlsTC.exe
  2⤵
  PID:4052
- C:\Windows\System\YkamWrp.exe
  C:\Windows\System\YkamWrp.exe
  2⤵
  PID:4076
- C:\Windows\System\VrKNstC.exe
  C:\Windows\System\VrKNstC.exe
  2⤵
  PID:4092
- C:\Windows\System\WzoBJwq.exe
  C:\Windows\System\WzoBJwq.exe
  2⤵
  PID:3424
- C:\Windows\System\kEqfYva.exe
  C:\Windows\System\kEqfYva.exe
  2⤵
  PID:3488
- C:\Windows\System\teIjKlT.exe
  C:\Windows\System\teIjKlT.exe
  2⤵
  PID:3552
- C:\Windows\System\AQgVtaJ.exe
  C:\Windows\System\AQgVtaJ.exe
  2⤵
  PID:3760
- C:\Windows\System\faXllpZ.exe
  C:\Windows\System\faXllpZ.exe
  2⤵
  PID:2072
- C:\Windows\System\WYxkiyV.exe
  C:\Windows\System\WYxkiyV.exe
  2⤵
  PID:3600
- C:\Windows\System\sEbbnWM.exe
  C:\Windows\System\sEbbnWM.exe
  2⤵
  PID:3612
- C:\Windows\System\SlWLIJu.exe
  C:\Windows\System\SlWLIJu.exe
  2⤵
  PID:3632
- C:\Windows\System\IDohLGy.exe
  C:\Windows\System\IDohLGy.exe
  2⤵
  PID:3648
- C:\Windows\System\YzDcTnb.exe
  C:\Windows\System\YzDcTnb.exe
  2⤵
  PID:3664
- C:\Windows\System\ZoZXTUL.exe
  C:\Windows\System\ZoZXTUL.exe
  2⤵
  PID:3680
- C:\Windows\System\MtLqlOC.exe
  C:\Windows\System\MtLqlOC.exe
  2⤵
  PID:3696
- C:\Windows\System\GnGSUwO.exe
  C:\Windows\System\GnGSUwO.exe
  2⤵
  PID:3712
- C:\Windows\System\SARfogt.exe
  C:\Windows\System\SARfogt.exe
  2⤵
  PID:3768
- C:\Windows\System\GsXYpln.exe
  C:\Windows\System\GsXYpln.exe
  2⤵
  PID:3148
- C:\Windows\System\XQcWVMy.exe
  C:\Windows\System\XQcWVMy.exe
  2⤵
  PID:3164
- C:\Windows\System\CYnetyb.exe
  C:\Windows\System\CYnetyb.exe
  2⤵
  PID:3204
- C:\Windows\System\QfALRUj.exe
  C:\Windows\System\QfALRUj.exe
  2⤵
  PID:3236
- C:\Windows\System\xbtMgWk.exe
  C:\Windows\System\xbtMgWk.exe
  2⤵
  PID:3252
- C:\Windows\System\xoQqfhG.exe
  C:\Windows\System\xoQqfhG.exe
  2⤵
  PID:3268
- C:\Windows\System\KkJTFsK.exe
  C:\Windows\System\KkJTFsK.exe
  2⤵
  PID:3284
- C:\Windows\System\Zqyssfe.exe
  C:\Windows\System\Zqyssfe.exe
  2⤵
  PID:3300
- C:\Windows\System\SDmKoYB.exe
  C:\Windows\System\SDmKoYB.exe
  2⤵
  PID:3316
- C:\Windows\System\QDYmNRN.exe
  C:\Windows\System\QDYmNRN.exe
  2⤵
  PID:3332
- C:\Windows\System\MvpYkFv.exe
  C:\Windows\System\MvpYkFv.exe
  2⤵
  PID:3348
- C:\Windows\System\BBqAcoG.exe
  C:\Windows\System\BBqAcoG.exe
  2⤵
  PID:3364
- C:\Windows\System\lUVdfcw.exe
  C:\Windows\System\lUVdfcw.exe
  2⤵
  PID:3404
- C:\Windows\System\sdUJuPA.exe
  C:\Windows\System\sdUJuPA.exe
  2⤵
  PID:3468
- C:\Windows\System\cYwRcBm.exe
  C:\Windows\System\cYwRcBm.exe
  2⤵
  PID:3868
- C:\Windows\System\KZbtmUw.exe
  C:\Windows\System\KZbtmUw.exe
  2⤵
  PID:3932
- C:\Windows\System\mAIDSZS.exe
  C:\Windows\System\mAIDSZS.exe
  2⤵
  PID:3996
- C:\Windows\System\UMZtFjT.exe
  C:\Windows\System\UMZtFjT.exe
  2⤵
  PID:4032
- C:\Windows\System\KyQMzea.exe
  C:\Windows\System\KyQMzea.exe
  2⤵
  PID:2820
- C:\Windows\System\jquzbUy.exe
  C:\Windows\System\jquzbUy.exe
  2⤵
  PID:1088
- C:\Windows\System\perjYXq.exe
  C:\Windows\System\perjYXq.exe
  2⤵
  PID:2592
- C:\Windows\System\jMqaajs.exe
  C:\Windows\System\jMqaajs.exe
  2⤵
  PID:3548
- C:\Windows\System\aygWBDC.exe
  C:\Windows\System\aygWBDC.exe
  2⤵
  PID:3640
- C:\Windows\System\WgtaxPb.exe
  C:\Windows\System\WgtaxPb.exe
  2⤵
  PID:3708
- C:\Windows\System\vxUMmJR.exe
  C:\Windows\System\vxUMmJR.exe
  2⤵
  PID:3788
- C:\Windows\System\NfvIIDV.exe
  C:\Windows\System\NfvIIDV.exe
  2⤵
  PID:3144
- C:\Windows\System\rdRhInw.exe
  C:\Windows\System\rdRhInw.exe
  2⤵
  PID:3196
- C:\Windows\System\xqJIrKP.exe
  C:\Windows\System\xqJIrKP.exe
  2⤵
  PID:3216
- C:\Windows\System\SckXKla.exe
  C:\Windows\System\SckXKla.exe
  2⤵
  PID:540
- C:\Windows\System\FAzuoWO.exe
  C:\Windows\System\FAzuoWO.exe
  2⤵
  PID:3176
- C:\Windows\System\XPzQilo.exe
  C:\Windows\System\XPzQilo.exe
  2⤵
  PID:3624
- C:\Windows\System\VbYDEOn.exe
  C:\Windows\System\VbYDEOn.exe
  2⤵
  PID:3720
- C:\Windows\System\jrtBXPs.exe
  C:\Windows\System\jrtBXPs.exe
  2⤵
  PID:3736
- C:\Windows\System\aZdeZRq.exe
  C:\Windows\System\aZdeZRq.exe
  2⤵
  PID:3752
- C:\Windows\System\ujjPhpL.exe
  C:\Windows\System\ujjPhpL.exe
  2⤵
  PID:3764
- C:\Windows\System\XqdojEA.exe
  C:\Windows\System\XqdojEA.exe
  2⤵
  PID:3584
- C:\Windows\System\winTtZG.exe
  C:\Windows\System\winTtZG.exe
  2⤵
  PID:4088
- C:\Windows\System\ZmDHbma.exe
  C:\Windows\System\ZmDHbma.exe
  2⤵
  PID:4016
- C:\Windows\System\kcWMSnU.exe
  C:\Windows\System\kcWMSnU.exe
  2⤵
  PID:3948
- C:\Windows\System\qnBTGOX.exe
  C:\Windows\System\qnBTGOX.exe
  2⤵
  PID:3884
- C:\Windows\System\szSVXha.exe
  C:\Windows\System\szSVXha.exe
  2⤵
  PID:3804
- C:\Windows\System\VKCcCSV.exe
  C:\Windows\System\VKCcCSV.exe
  2⤵
  PID:3532
- C:\Windows\System\hUJWqMB.exe
  C:\Windows\System\hUJWqMB.exe
  2⤵
  PID:3136
- C:\Windows\System\heqQYjq.exe
  C:\Windows\System\heqQYjq.exe
  2⤵
  PID:3160
- C:\Windows\System\jnUUmpY.exe
  C:\Windows\System\jnUUmpY.exe
  2⤵
  PID:3232
- C:\Windows\System\CcVUBFK.exe
  C:\Windows\System\CcVUBFK.exe
  2⤵
  PID:3276
- C:\Windows\System\ZdckEim.exe
  C:\Windows\System\ZdckEim.exe
  2⤵
  PID:3296
- C:\Windows\System\CCGNtis.exe
  C:\Windows\System\CCGNtis.exe
  2⤵
  PID:3344
- C:\Windows\System\JtJQQCO.exe
  C:\Windows\System\JtJQQCO.exe
  2⤵
  PID:3360
- C:\Windows\System\wbungPi.exe
  C:\Windows\System\wbungPi.exe
  2⤵
  PID:3440
- C:\Windows\System\vqSkjng.exe
  C:\Windows\System\vqSkjng.exe
  2⤵
  PID:3472
- C:\Windows\System\FDWDwbw.exe
  C:\Windows\System\FDWDwbw.exe
  2⤵
  PID:4060
- C:\Windows\System\UrefDGj.exe
  C:\Windows\System\UrefDGj.exe
  2⤵
  PID:3704
- C:\Windows\System\NyeddMe.exe
  C:\Windows\System\NyeddMe.exe
  2⤵
  PID:3616
- C:\Windows\System\DOkHhBv.exe
  C:\Windows\System\DOkHhBv.exe
  2⤵
  PID:3676
- C:\Windows\System\rBHHBoc.exe
  C:\Windows\System\rBHHBoc.exe
  2⤵
  PID:3124
- C:\Windows\System\OpidZeR.exe
  C:\Windows\System\OpidZeR.exe
  2⤵
  PID:3212
- C:\Windows\System\ebXMCnQ.exe
  C:\Windows\System\ebXMCnQ.exe
  2⤵
  PID:2740
- C:\Windows\System\PrVqwzb.exe
  C:\Windows\System\PrVqwzb.exe
  2⤵
  PID:3732
- C:\Windows\System\yXETTXV.exe
  C:\Windows\System\yXETTXV.exe
  2⤵
  PID:3748
- C:\Windows\System\BUOEcxJ.exe
  C:\Windows\System\BUOEcxJ.exe
  2⤵
  PID:3592
- C:\Windows\System\lmwIfEX.exe
  C:\Windows\System\lmwIfEX.exe
  2⤵
  PID:4044
- C:\Windows\System\gsFaYWj.exe
  C:\Windows\System\gsFaYWj.exe
  2⤵
  PID:3912
- C:\Windows\System\wPlhxMq.exe
  C:\Windows\System\wPlhxMq.exe
  2⤵
  PID:3128
- C:\Windows\System\nZwFQSi.exe
  C:\Windows\System\nZwFQSi.exe
  2⤵
  PID:3244
- C:\Windows\System\wnXGLsJ.exe
  C:\Windows\System\wnXGLsJ.exe
  2⤵
  PID:3308
- C:\Windows\System\WNculdg.exe
  C:\Windows\System\WNculdg.exe
  2⤵
  PID:3340
- C:\Windows\System\ocNPkhB.exe
  C:\Windows\System\ocNPkhB.exe
  2⤵
  PID:3968
- C:\Windows\System\qcABMCQ.exe
  C:\Windows\System\qcABMCQ.exe
  2⤵
  PID:4072
- C:\Windows\System\VgGgnQI.exe
  C:\Windows\System\VgGgnQI.exe
  2⤵
  PID:3608
- C:\Windows\System\KaavJTl.exe
  C:\Windows\System\KaavJTl.exe
  2⤵
  PID:3184
- C:\Windows\System\adJADkS.exe
  C:\Windows\System\adJADkS.exe
  2⤵
  PID:3728
- C:\Windows\System\jGamwdH.exe
  C:\Windows\System\jGamwdH.exe
  2⤵
  PID:3744
- C:\Windows\System\qtxPXNj.exe
  C:\Windows\System\qtxPXNj.exe
  2⤵
  PID:3916
- C:\Windows\System\ulOTRox.exe
  C:\Windows\System\ulOTRox.exe
  2⤵
  PID:3228
- C:\Windows\System\ebJJScg.exe
  C:\Windows\System\ebJJScg.exe
  2⤵
  PID:3324
- C:\Windows\System\CPpiKHO.exe
  C:\Windows\System\CPpiKHO.exe
  2⤵
  PID:3436
- C:\Windows\System\RhWjhPb.exe
  C:\Windows\System\RhWjhPb.exe
  2⤵
  PID:3208
- C:\Windows\System\POiPGHh.exe
  C:\Windows\System\POiPGHh.exe
  2⤵
  PID:4108
- C:\Windows\System\jvTLjmJ.exe
  C:\Windows\System\jvTLjmJ.exe
  2⤵
  PID:4124
- C:\Windows\System\JCtmPSN.exe
  C:\Windows\System\JCtmPSN.exe
  2⤵
  PID:4140
- C:\Windows\System\osdWHHg.exe
  C:\Windows\System\osdWHHg.exe
  2⤵
  PID:4156
- C:\Windows\System\uOaYQXd.exe
  C:\Windows\System\uOaYQXd.exe
  2⤵
  PID:4172
- C:\Windows\System\YbAnBcP.exe
  C:\Windows\System\YbAnBcP.exe
  2⤵
  PID:4188
- C:\Windows\System\ShHBRbg.exe
  C:\Windows\System\ShHBRbg.exe
  2⤵
  PID:4204
- C:\Windows\System\thGBLFF.exe
  C:\Windows\System\thGBLFF.exe
  2⤵
  PID:4220
- C:\Windows\System\bPsMUUo.exe
  C:\Windows\System\bPsMUUo.exe
  2⤵
  PID:4236
- C:\Windows\System\RZbBhhv.exe
  C:\Windows\System\RZbBhhv.exe
  2⤵
  PID:4252
- C:\Windows\System\tFOBoxr.exe
  C:\Windows\System\tFOBoxr.exe
  2⤵
  PID:4268
- C:\Windows\System\omiYjQa.exe
  C:\Windows\System\omiYjQa.exe
  2⤵
  PID:4284
- C:\Windows\System\pkdUOcd.exe
  C:\Windows\System\pkdUOcd.exe
  2⤵
  PID:4300
- C:\Windows\System\WLbxShv.exe
  C:\Windows\System\WLbxShv.exe
  2⤵
  PID:4316
- C:\Windows\System\ftEqBgd.exe
  C:\Windows\System\ftEqBgd.exe
  2⤵
  PID:4332
- C:\Windows\System\MWJmdPY.exe
  C:\Windows\System\MWJmdPY.exe
  2⤵
  PID:4348
- C:\Windows\System\JZNbPSb.exe
  C:\Windows\System\JZNbPSb.exe
  2⤵
  PID:4364
- C:\Windows\System\XjSkeFW.exe
  C:\Windows\System\XjSkeFW.exe
  2⤵
  PID:4380
- C:\Windows\System\CcngcpN.exe
  C:\Windows\System\CcngcpN.exe
  2⤵
  PID:4396
- C:\Windows\System\AAMnNRK.exe
  C:\Windows\System\AAMnNRK.exe
  2⤵
  PID:4412
- C:\Windows\System\IIdZkZu.exe
  C:\Windows\System\IIdZkZu.exe
  2⤵
  PID:4428
- C:\Windows\System\TGgPgeC.exe
  C:\Windows\System\TGgPgeC.exe
  2⤵
  PID:4444
- C:\Windows\System\txDGtAV.exe
  C:\Windows\System\txDGtAV.exe
  2⤵
  PID:4460
- C:\Windows\System\VlbdvkQ.exe
  C:\Windows\System\VlbdvkQ.exe
  2⤵
  PID:4476
- C:\Windows\System\wSQcQcL.exe
  C:\Windows\System\wSQcQcL.exe
  2⤵
  PID:4492
- C:\Windows\System\UWUsvkU.exe
  C:\Windows\System\UWUsvkU.exe
  2⤵
  PID:4508
- C:\Windows\System\RORZtuw.exe
  C:\Windows\System\RORZtuw.exe
  2⤵
  PID:4524
- C:\Windows\System\uCtIUZu.exe
  C:\Windows\System\uCtIUZu.exe
  2⤵
  PID:4540
- C:\Windows\System\rWxoAyz.exe
  C:\Windows\System\rWxoAyz.exe
  2⤵
  PID:4556
- C:\Windows\System\gFXnmRV.exe
  C:\Windows\System\gFXnmRV.exe
  2⤵
  PID:4572
- C:\Windows\System\SeTlHRe.exe
  C:\Windows\System\SeTlHRe.exe
  2⤵
  PID:4588
- C:\Windows\System\hKQEDTW.exe
  C:\Windows\System\hKQEDTW.exe
  2⤵
  PID:4604
- C:\Windows\System\DevFSzw.exe
  C:\Windows\System\DevFSzw.exe
  2⤵
  PID:4620
- C:\Windows\System\KnTdufE.exe
  C:\Windows\System\KnTdufE.exe
  2⤵
  PID:4636
- C:\Windows\System\rUyYQdD.exe
  C:\Windows\System\rUyYQdD.exe
  2⤵
  PID:4652
- C:\Windows\System\JPRNYDA.exe
  C:\Windows\System\JPRNYDA.exe
  2⤵
  PID:4668
- C:\Windows\System\ufleLGN.exe
  C:\Windows\System\ufleLGN.exe
  2⤵
  PID:4684
- C:\Windows\System\mvsfuHV.exe
  C:\Windows\System\mvsfuHV.exe
  2⤵
  PID:4700
- C:\Windows\System\UlERAwg.exe
  C:\Windows\System\UlERAwg.exe
  2⤵
  PID:4716
- C:\Windows\System\yFpLziP.exe
  C:\Windows\System\yFpLziP.exe
  2⤵
  PID:4732
- C:\Windows\System\pvgyhba.exe
  C:\Windows\System\pvgyhba.exe
  2⤵
  PID:4748
- C:\Windows\System\PbZzsTM.exe
  C:\Windows\System\PbZzsTM.exe
  2⤵
  PID:4764
- C:\Windows\System\RMXNISi.exe
  C:\Windows\System\RMXNISi.exe
  2⤵
  PID:4780
- C:\Windows\System\wxbvFzz.exe
  C:\Windows\System\wxbvFzz.exe
  2⤵
  PID:4796
- C:\Windows\System\qqUljdT.exe
  C:\Windows\System\qqUljdT.exe
  2⤵
  PID:4812
- C:\Windows\System\JKCyJfn.exe
  C:\Windows\System\JKCyJfn.exe
  2⤵
  PID:4828
- C:\Windows\System\jRifFhN.exe
  C:\Windows\System\jRifFhN.exe
  2⤵
  PID:4844
- C:\Windows\System\rtSOMGD.exe
  C:\Windows\System\rtSOMGD.exe
  2⤵
  PID:4860
- C:\Windows\System\BApsSuR.exe
  C:\Windows\System\BApsSuR.exe
  2⤵
  PID:4876
- C:\Windows\System\RpQgQlE.exe
  C:\Windows\System\RpQgQlE.exe
  2⤵
  PID:4892
- C:\Windows\System\sTeGMqx.exe
  C:\Windows\System\sTeGMqx.exe
  2⤵
  PID:4908
- C:\Windows\System\nhZbBCH.exe
  C:\Windows\System\nhZbBCH.exe
  2⤵
  PID:4924
- C:\Windows\System\uDPGYbN.exe
  C:\Windows\System\uDPGYbN.exe
  2⤵
  PID:4940
- C:\Windows\System\VuTtbrz.exe
  C:\Windows\System\VuTtbrz.exe
  2⤵
  PID:4956
- C:\Windows\System\ddCTlTZ.exe
  C:\Windows\System\ddCTlTZ.exe
  2⤵
  PID:4972
- C:\Windows\System\WyOCEPd.exe
  C:\Windows\System\WyOCEPd.exe
  2⤵
  PID:4988
- C:\Windows\System\cPvDRtt.exe
  C:\Windows\System\cPvDRtt.exe
  2⤵
  PID:5004
- C:\Windows\System\lbLZGLP.exe
  C:\Windows\System\lbLZGLP.exe
  2⤵
  PID:5020
- C:\Windows\System\CzPxwud.exe
  C:\Windows\System\CzPxwud.exe
  2⤵
  PID:5036
- C:\Windows\System\DryGJYm.exe
  C:\Windows\System\DryGJYm.exe
  2⤵
  PID:5052
- C:\Windows\System\UCFtsbq.exe
  C:\Windows\System\UCFtsbq.exe
  2⤵
  PID:5068
- C:\Windows\System\HUnOUFW.exe
  C:\Windows\System\HUnOUFW.exe
  2⤵
  PID:5084
- C:\Windows\System\KTsYmkB.exe
  C:\Windows\System\KTsYmkB.exe
  2⤵
  PID:5100
- C:\Windows\System\nXVVGDY.exe
  C:\Windows\System\nXVVGDY.exe
  2⤵
  PID:5116
- C:\Windows\System\BFbHsYy.exe
  C:\Windows\System\BFbHsYy.exe
  2⤵
  PID:3484
- C:\Windows\System\itqGMyv.exe
  C:\Windows\System\itqGMyv.exe
  2⤵
  PID:864
- C:\Windows\System\FinIzfA.exe
  C:\Windows\System\FinIzfA.exe
  2⤵
  PID:3536
- C:\Windows\System\TfEhiEC.exe
  C:\Windows\System\TfEhiEC.exe
  2⤵
  PID:2324
- C:\Windows\System\jQywDUT.exe
  C:\Windows\System\jQywDUT.exe
  2⤵
  PID:3900
- C:\Windows\System\dONvlFA.exe
  C:\Windows\System\dONvlFA.exe
  2⤵
  PID:4120
- C:\Windows\System\qBXRnNI.exe
  C:\Windows\System\qBXRnNI.exe
  2⤵
  PID:4152
- C:\Windows\System\CgkQSrB.exe
  C:\Windows\System\CgkQSrB.exe
  2⤵
  PID:4200
- C:\Windows\System\qTUkuAg.exe
  C:\Windows\System\qTUkuAg.exe
  2⤵
  PID:4232
- C:\Windows\System\pHViLOM.exe
  C:\Windows\System\pHViLOM.exe
  2⤵
  PID:4264
- C:\Windows\System\RrKxtVM.exe
  C:\Windows\System\RrKxtVM.exe
  2⤵
  PID:4280
- C:\Windows\System\ifshSzw.exe
  C:\Windows\System\ifshSzw.exe
  2⤵
  PID:4312
- C:\Windows\System\JFiTHmh.exe
  C:\Windows\System\JFiTHmh.exe
  2⤵
  PID:4344
- C:\Windows\System\IPBBAzT.exe
  C:\Windows\System\IPBBAzT.exe
  2⤵
  PID:4376
- C:\Windows\System\WlItRcd.exe
  C:\Windows\System\WlItRcd.exe
  2⤵
  PID:4424
- C:\Windows\System\peUhpfO.exe
  C:\Windows\System\peUhpfO.exe
  2⤵
  PID:4456
- C:\Windows\System\VUCHtNo.exe
  C:\Windows\System\VUCHtNo.exe
  2⤵
  PID:4488
- C:\Windows\System\nsbNVxb.exe
  C:\Windows\System\nsbNVxb.exe
  2⤵
  PID:4504
- C:\Windows\System\igGSQsJ.exe
  C:\Windows\System\igGSQsJ.exe
  2⤵
  PID:4552
- C:\Windows\System\hfqYVcA.exe
  C:\Windows\System\hfqYVcA.exe
  2⤵
  PID:4568
- C:\Windows\System\DoxyHGt.exe
  C:\Windows\System\DoxyHGt.exe
  2⤵
  PID:4616
- C:\Windows\System\EYpZojc.exe
  C:\Windows\System\EYpZojc.exe
  2⤵
  PID:4648
- C:\Windows\System\PYbijoJ.exe
  C:\Windows\System\PYbijoJ.exe
  2⤵
  PID:4664
- C:\Windows\System\PGaWeMB.exe
  C:\Windows\System\PGaWeMB.exe
  2⤵
  PID:4712
- C:\Windows\System\UrNpnDh.exe
  C:\Windows\System\UrNpnDh.exe
  2⤵
  PID:4728
- C:\Windows\System\ZtOqYUX.exe
  C:\Windows\System\ZtOqYUX.exe
  2⤵
  PID:4776
- C:\Windows\System\QGFcGrW.exe
  C:\Windows\System\QGFcGrW.exe
  2⤵
  PID:4808
- C:\Windows\System\KWjNOes.exe
  C:\Windows\System\KWjNOes.exe
  2⤵
  PID:4840
- C:\Windows\System\ZmPygVc.exe
  C:\Windows\System\ZmPygVc.exe
  2⤵
  PID:4872
- C:\Windows\System\zfFVrHx.exe
  C:\Windows\System\zfFVrHx.exe
  2⤵
  PID:4884
- C:\Windows\System\bVewRPW.exe
  C:\Windows\System\bVewRPW.exe
  2⤵
  PID:4920
- C:\Windows\System\yJZzLmi.exe
  C:\Windows\System\yJZzLmi.exe
  2⤵
  PID:4952
- C:\Windows\System\kLGUlqb.exe
  C:\Windows\System\kLGUlqb.exe
  2⤵
  PID:4984
- C:\Windows\System\QbgTMuq.exe
  C:\Windows\System\QbgTMuq.exe
  2⤵
  PID:5016
- C:\Windows\System\xVhMToL.exe
  C:\Windows\System\xVhMToL.exe
  2⤵
  PID:5048
- C:\Windows\System\NmMQsZH.exe
  C:\Windows\System\NmMQsZH.exe
  2⤵
  PID:5096
- C:\Windows\System\dxSvSFZ.exe
  C:\Windows\System\dxSvSFZ.exe
  2⤵
  PID:5112
- C:\Windows\System\sNPKcku.exe
  C:\Windows\System\sNPKcku.exe
  2⤵
  PID:3852
- C:\Windows\System\IqeDyVi.exe
  C:\Windows\System\IqeDyVi.exe
  2⤵
  PID:4104
- C:\Windows\System\ZreZggn.exe
  C:\Windows\System\ZreZggn.exe
  2⤵
  PID:4136
- C:\Windows\System\yLAeWPC.exe
  C:\Windows\System\yLAeWPC.exe
  2⤵
  PID:4216
- C:\Windows\System\FBefjRO.exe
  C:\Windows\System\FBefjRO.exe
  2⤵
  PID:4356
- C:\Windows\System\AdudPfb.exe
  C:\Windows\System\AdudPfb.exe
  2⤵
  PID:4360
- C:\Windows\System\NHouVho.exe
  C:\Windows\System\NHouVho.exe
  2⤵
  PID:4392
- C:\Windows\System\uSgHdrT.exe
  C:\Windows\System\uSgHdrT.exe
  2⤵
  PID:4440
- C:\Windows\System\NrdzfkQ.exe
  C:\Windows\System\NrdzfkQ.exe
  2⤵
  PID:4520
- C:\Windows\System\QdSvzaS.exe
  C:\Windows\System\QdSvzaS.exe
  2⤵
  PID:4600
- C:\Windows\System\RpyLvAS.exe
  C:\Windows\System\RpyLvAS.exe
  2⤵
  PID:4632
- C:\Windows\System\IpsagUd.exe
  C:\Windows\System\IpsagUd.exe
  2⤵
  PID:4696
- C:\Windows\System\YkPTzFM.exe
  C:\Windows\System\YkPTzFM.exe
  2⤵
  PID:4760
- C:\Windows\System\vPeRcjP.exe
  C:\Windows\System\vPeRcjP.exe
  2⤵
  PID:4856
- C:\Windows\System\VgTeopx.exe
  C:\Windows\System\VgTeopx.exe
  2⤵
  PID:4936
- C:\Windows\System\HDrxZKx.exe
  C:\Windows\System\HDrxZKx.exe
  2⤵
  PID:4948
- C:\Windows\System\KXafUEh.exe
  C:\Windows\System\KXafUEh.exe
  2⤵
  PID:5032
- C:\Windows\System\ruXVGuE.exe
  C:\Windows\System\ruXVGuE.exe
  2⤵
  PID:5108
- C:\Windows\System\jqneVuS.exe
  C:\Windows\System\jqneVuS.exe
  2⤵
  PID:4048
- C:\Windows\System\AVQYGRP.exe
  C:\Windows\System\AVQYGRP.exe
  2⤵
  PID:4184
- C:\Windows\System\nWRLekb.exe
  C:\Windows\System\nWRLekb.exe
  2⤵
  PID:4292
- C:\Windows\System\IPGkGIr.exe
  C:\Windows\System\IPGkGIr.exe
  2⤵
  PID:4472
- C:\Windows\System\ixiOPEE.exe
  C:\Windows\System\ixiOPEE.exe
  2⤵
  PID:4612
- C:\Windows\System\TdaSFlU.exe
  C:\Windows\System\TdaSFlU.exe
  2⤵
  PID:4676
- C:\Windows\System\ReWVEZj.exe
  C:\Windows\System\ReWVEZj.exe
  2⤵
  PID:3672
- C:\Windows\System\VWHfmrh.exe
  C:\Windows\System\VWHfmrh.exe
  2⤵
  PID:4932
- C:\Windows\System\iLueqfO.exe
  C:\Windows\System\iLueqfO.exe
  2⤵
  PID:5080
- C:\Windows\System\NkAYraI.exe
  C:\Windows\System\NkAYraI.exe
  2⤵
  PID:4168
- C:\Windows\System\gsVCewo.exe
  C:\Windows\System\gsVCewo.exe
  2⤵
  PID:4404
- C:\Windows\System\qkyNVMq.exe
  C:\Windows\System\qkyNVMq.exe
  2⤵
  PID:4516
- C:\Windows\System\FLjBJrn.exe
  C:\Windows\System\FLjBJrn.exe
  2⤵
  PID:5000
- C:\Windows\System\QkoCGFO.exe
  C:\Windows\System\QkoCGFO.exe
  2⤵
  PID:5132
- C:\Windows\System\MgbmPxh.exe
  C:\Windows\System\MgbmPxh.exe
  2⤵
  PID:5148
- C:\Windows\System\hoiCaxq.exe
  C:\Windows\System\hoiCaxq.exe
  2⤵
  PID:5164
- C:\Windows\System\ZUYNMpx.exe
  C:\Windows\System\ZUYNMpx.exe
  2⤵
  PID:5180
- C:\Windows\System\VELsuxp.exe
  C:\Windows\System\VELsuxp.exe
  2⤵
  PID:5196
- C:\Windows\System\JxafVoD.exe
  C:\Windows\System\JxafVoD.exe
  2⤵
  PID:5212
- C:\Windows\System\IfvEFyk.exe
  C:\Windows\System\IfvEFyk.exe
  2⤵
  PID:5228
- C:\Windows\System\aXWXGgn.exe
  C:\Windows\System\aXWXGgn.exe
  2⤵
  PID:5244
- C:\Windows\System\VxdZakV.exe
  C:\Windows\System\VxdZakV.exe
  2⤵
  PID:5260
- C:\Windows\System\OJGQlhe.exe
  C:\Windows\System\OJGQlhe.exe
  2⤵
  PID:5276
- C:\Windows\System\dCsRFff.exe
  C:\Windows\System\dCsRFff.exe
  2⤵
  PID:5292
- C:\Windows\System\pEggYHT.exe
  C:\Windows\System\pEggYHT.exe
  2⤵
  PID:5308
- C:\Windows\System\UPLkryr.exe
  C:\Windows\System\UPLkryr.exe
  2⤵
  PID:5324
- C:\Windows\System\mMPjAAa.exe
  C:\Windows\System\mMPjAAa.exe
  2⤵
  PID:5340
- C:\Windows\System\PBbrnQy.exe
  C:\Windows\System\PBbrnQy.exe
  2⤵
  PID:5356
- C:\Windows\System\cGcAyRb.exe
  C:\Windows\System\cGcAyRb.exe
  2⤵
  PID:5372
- C:\Windows\System\SJCqvYH.exe
  C:\Windows\System\SJCqvYH.exe
  2⤵
  PID:5388
- C:\Windows\System\CcXHiVJ.exe
  C:\Windows\System\CcXHiVJ.exe
  2⤵
  PID:5404
- C:\Windows\System\hcCkgnj.exe
  C:\Windows\System\hcCkgnj.exe
  2⤵
  PID:5420
- C:\Windows\System\AWuWora.exe
  C:\Windows\System\AWuWora.exe
  2⤵
  PID:5436
- C:\Windows\System\aRtfPMz.exe
  C:\Windows\System\aRtfPMz.exe
  2⤵
  PID:5452
- C:\Windows\System\AMIkWWr.exe
  C:\Windows\System\AMIkWWr.exe
  2⤵
  PID:5468
- C:\Windows\System\LhfOtAc.exe
  C:\Windows\System\LhfOtAc.exe
  2⤵
  PID:5484
- C:\Windows\System\tSVAxeY.exe
  C:\Windows\System\tSVAxeY.exe
  2⤵
  PID:5500
- C:\Windows\System\AQXbfYZ.exe
  C:\Windows\System\AQXbfYZ.exe
  2⤵
  PID:5516
- C:\Windows\System\MeBKaOs.exe
  C:\Windows\System\MeBKaOs.exe
  2⤵
  PID:5532
- C:\Windows\System\zBxEMHf.exe
  C:\Windows\System\zBxEMHf.exe
  2⤵
  PID:5548
- C:\Windows\System\jeHqbEB.exe
  C:\Windows\System\jeHqbEB.exe
  2⤵
  PID:5564
- C:\Windows\System\cIxnErt.exe
  C:\Windows\System\cIxnErt.exe
  2⤵
  PID:5580
- C:\Windows\System\GQsRvbt.exe
  C:\Windows\System\GQsRvbt.exe
  2⤵
  PID:5596
- C:\Windows\System\AYBycPn.exe
  C:\Windows\System\AYBycPn.exe
  2⤵
  PID:5612
- C:\Windows\System\YqXYquA.exe
  C:\Windows\System\YqXYquA.exe
  2⤵
  PID:5628
- C:\Windows\System\omwjrYZ.exe
  C:\Windows\System\omwjrYZ.exe
  2⤵
  PID:5644
- C:\Windows\System\HeABwhG.exe
  C:\Windows\System\HeABwhG.exe
  2⤵
  PID:5660
- C:\Windows\System\CDPbNYv.exe
  C:\Windows\System\CDPbNYv.exe
  2⤵
  PID:5676
- C:\Windows\System\bPpmneP.exe
  C:\Windows\System\bPpmneP.exe
  2⤵
  PID:5692
- C:\Windows\System\OMTnECk.exe
  C:\Windows\System\OMTnECk.exe
  2⤵
  PID:5708
- C:\Windows\System\WvPywgO.exe
  C:\Windows\System\WvPywgO.exe
  2⤵
  PID:5724
- C:\Windows\System\pUycELX.exe
  C:\Windows\System\pUycELX.exe
  2⤵
  PID:5740
- C:\Windows\System\oVDrVZa.exe
  C:\Windows\System\oVDrVZa.exe
  2⤵
  PID:5756
- C:\Windows\System\WlKhBJb.exe
  C:\Windows\System\WlKhBJb.exe
  2⤵
  PID:5772
- C:\Windows\System\uKXgjcB.exe
  C:\Windows\System\uKXgjcB.exe
  2⤵
  PID:5788
- C:\Windows\System\YGaIaSd.exe
  C:\Windows\System\YGaIaSd.exe
  2⤵
  PID:5804
- C:\Windows\System\ZcXDlzZ.exe
  C:\Windows\System\ZcXDlzZ.exe
  2⤵
  PID:5820
- C:\Windows\System\TuuiGYT.exe
  C:\Windows\System\TuuiGYT.exe
  2⤵
  PID:5836
- C:\Windows\System\yydAmON.exe
  C:\Windows\System\yydAmON.exe
  2⤵
  PID:5852
- C:\Windows\System\qigXONp.exe
  C:\Windows\System\qigXONp.exe
  2⤵
  PID:5868
- C:\Windows\System\efFykcm.exe
  C:\Windows\System\efFykcm.exe
  2⤵
  PID:5884
- C:\Windows\System\JaZKpqt.exe
  C:\Windows\System\JaZKpqt.exe
  2⤵
  PID:5900
- C:\Windows\System\YTDMzWm.exe
  C:\Windows\System\YTDMzWm.exe
  2⤵
  PID:5916
- C:\Windows\System\YAYNMYx.exe
  C:\Windows\System\YAYNMYx.exe
  2⤵
  PID:5932
- C:\Windows\System\dFqGYtD.exe
  C:\Windows\System\dFqGYtD.exe
  2⤵
  PID:5948
- C:\Windows\System\fPkXgnS.exe
  C:\Windows\System\fPkXgnS.exe
  2⤵
  PID:5964
- C:\Windows\System\UxLaiHk.exe
  C:\Windows\System\UxLaiHk.exe
  2⤵
  PID:5980
- C:\Windows\System\ncbCLdI.exe
  C:\Windows\System\ncbCLdI.exe
  2⤵
  PID:5996
- C:\Windows\System\ovGPHTu.exe
  C:\Windows\System\ovGPHTu.exe
  2⤵
  PID:6012
- C:\Windows\System\iCIrNso.exe
  C:\Windows\System\iCIrNso.exe
  2⤵
  PID:6028
- C:\Windows\System\sLagSiA.exe
  C:\Windows\System\sLagSiA.exe
  2⤵
  PID:6044
- C:\Windows\System\GiFfnAT.exe
  C:\Windows\System\GiFfnAT.exe
  2⤵
  PID:6060
- C:\Windows\System\tWpypIr.exe
  C:\Windows\System\tWpypIr.exe
  2⤵
  PID:6076
- C:\Windows\System\wjZqjOU.exe
  C:\Windows\System\wjZqjOU.exe
  2⤵
  PID:6092
- C:\Windows\System\BrLQlEx.exe
  C:\Windows\System\BrLQlEx.exe
  2⤵
  PID:6108
- C:\Windows\System\XwTRCJo.exe
  C:\Windows\System\XwTRCJo.exe
  2⤵
  PID:6124
- C:\Windows\System\xTVKIlE.exe
  C:\Windows\System\xTVKIlE.exe
  2⤵
  PID:6140
- C:\Windows\System\KiHoaqU.exe
  C:\Windows\System\KiHoaqU.exe
  2⤵
  PID:5028
- C:\Windows\System\DXCTdOJ.exe
  C:\Windows\System\DXCTdOJ.exe
  2⤵
  PID:4296
- C:\Windows\System\SjZkdXJ.exe
  C:\Windows\System\SjZkdXJ.exe
  2⤵
  PID:4772
- C:\Windows\System\IwBGZQt.exe
  C:\Windows\System\IwBGZQt.exe
  2⤵
  PID:5160
- C:\Windows\System\NtfaqRg.exe
  C:\Windows\System\NtfaqRg.exe
  2⤵
  PID:5176
- C:\Windows\System\nfSiLlz.exe
  C:\Windows\System\nfSiLlz.exe
  2⤵
  PID:5236
- C:\Windows\System\NZKTbeI.exe
  C:\Windows\System\NZKTbeI.exe
  2⤵
  PID:5268
- C:\Windows\System\JXEuyvx.exe
  C:\Windows\System\JXEuyvx.exe
  2⤵
  PID:5300
- C:\Windows\System\tCKPMqR.exe
  C:\Windows\System\tCKPMqR.exe
  2⤵
  PID:5348
- C:\Windows\System\deYLIgR.exe
  C:\Windows\System\deYLIgR.exe
  2⤵
  PID:5364
- C:\Windows\System\KCTLGjL.exe
  C:\Windows\System\KCTLGjL.exe
  2⤵
  PID:5396
- C:\Windows\System\rYPyVoE.exe
  C:\Windows\System\rYPyVoE.exe
  2⤵
  PID:5428
- C:\Windows\System\BWPiSJY.exe
  C:\Windows\System\BWPiSJY.exe
  2⤵
  PID:5460
- C:\Windows\System\vFMbsIu.exe
  C:\Windows\System\vFMbsIu.exe
  2⤵
  PID:5508
- C:\Windows\System\klZbJvd.exe
  C:\Windows\System\klZbJvd.exe
  2⤵
  PID:5524
- C:\Windows\System\GphoQcB.exe
  C:\Windows\System\GphoQcB.exe
  2⤵
  PID:5556
- C:\Windows\System\eZopbZN.exe
  C:\Windows\System\eZopbZN.exe
  2⤵
  PID:5588
- C:\Windows\System\QyfHbPz.exe
  C:\Windows\System\QyfHbPz.exe
  2⤵
  PID:5620
- C:\Windows\System\JXdqmHq.exe
  C:\Windows\System\JXdqmHq.exe
  2⤵
  PID:5668
- C:\Windows\System\DzsGdiz.exe
  C:\Windows\System\DzsGdiz.exe
  2⤵
  PID:5672
- C:\Windows\System\enVyvPI.exe
  C:\Windows\System\enVyvPI.exe
  2⤵
  PID:3088
- C:\Windows\System\ObWUhuJ.exe
  C:\Windows\System\ObWUhuJ.exe
  2⤵
  PID:2320
- C:\Windows\System\qZyDrut.exe
  C:\Windows\System\qZyDrut.exe
  2⤵
  PID:3080
- C:\Windows\System\jSbodvK.exe
  C:\Windows\System\jSbodvK.exe
  2⤵
  PID:5732
- C:\Windows\System\Uswfxvm.exe
  C:\Windows\System\Uswfxvm.exe
  2⤵
  PID:6152
- C:\Windows\System\FkKqYYX.exe
  C:\Windows\System\FkKqYYX.exe
  2⤵
  PID:6168
- C:\Windows\System\SZrRbtK.exe
  C:\Windows\System\SZrRbtK.exe
  2⤵
  PID:6184
- C:\Windows\System\oOKrxjE.exe
  C:\Windows\System\oOKrxjE.exe
  2⤵
  PID:6200
- C:\Windows\System\WVTrETz.exe
  C:\Windows\System\WVTrETz.exe
  2⤵
  PID:6216
- C:\Windows\System\iFJxmzC.exe
  C:\Windows\System\iFJxmzC.exe
  2⤵
  PID:6232
- C:\Windows\System\XdzUcib.exe
  C:\Windows\System\XdzUcib.exe
  2⤵
  PID:6252
- C:\Windows\System\iqVGcUP.exe
  C:\Windows\System\iqVGcUP.exe
  2⤵
  PID:6268
- C:\Windows\System\gapCnLN.exe
  C:\Windows\System\gapCnLN.exe
  2⤵
  PID:6288
- C:\Windows\System\SNCiaqe.exe
  C:\Windows\System\SNCiaqe.exe
  2⤵
  PID:6304
- C:\Windows\System\TVEfdKc.exe
  C:\Windows\System\TVEfdKc.exe
  2⤵
  PID:6320
- C:\Windows\System\DdJnBFn.exe
  C:\Windows\System\DdJnBFn.exe
  2⤵
  PID:6336
- C:\Windows\System\kdSGqSo.exe
  C:\Windows\System\kdSGqSo.exe
  2⤵
  PID:6352
- C:\Windows\System\VBLJoer.exe
  C:\Windows\System\VBLJoer.exe
  2⤵
  PID:6368
- C:\Windows\System\VNYyvgT.exe
  C:\Windows\System\VNYyvgT.exe
  2⤵
  PID:6384
- C:\Windows\System\HEzxqzy.exe
  C:\Windows\System\HEzxqzy.exe
  2⤵
  PID:6400
- C:\Windows\System\PJmeJTj.exe
  C:\Windows\System\PJmeJTj.exe
  2⤵
  PID:6416
- C:\Windows\System\DTxgKFi.exe
  C:\Windows\System\DTxgKFi.exe
  2⤵
  PID:6432
- C:\Windows\System\mzdyRnl.exe
  C:\Windows\System\mzdyRnl.exe
  2⤵
  PID:6448
- C:\Windows\System\EKmvuSk.exe
  C:\Windows\System\EKmvuSk.exe
  2⤵
  PID:6464
- C:\Windows\System\XfhjJye.exe
  C:\Windows\System\XfhjJye.exe
  2⤵
  PID:6480
- C:\Windows\System\zlzOuKF.exe
  C:\Windows\System\zlzOuKF.exe
  2⤵
  PID:6496
- C:\Windows\System\pnPlPWD.exe
  C:\Windows\System\pnPlPWD.exe
  2⤵
  PID:6512
- C:\Windows\System\hmGWgwc.exe
  C:\Windows\System\hmGWgwc.exe
  2⤵
  PID:6528
- C:\Windows\System\DGwToVN.exe
  C:\Windows\System\DGwToVN.exe
  2⤵
  PID:6544
- C:\Windows\System\uAusJwf.exe
  C:\Windows\System\uAusJwf.exe
  2⤵
  PID:6560
- C:\Windows\System\jBJCDwb.exe
  C:\Windows\System\jBJCDwb.exe
  2⤵
  PID:6576
- C:\Windows\System\UibByhg.exe
  C:\Windows\System\UibByhg.exe
  2⤵
  PID:6592
- C:\Windows\System\FQsbDfc.exe
  C:\Windows\System\FQsbDfc.exe
  2⤵
  PID:6608
- C:\Windows\System\DsgnXQW.exe
  C:\Windows\System\DsgnXQW.exe
  2⤵
  PID:6624
- C:\Windows\System\jMdauHd.exe
  C:\Windows\System\jMdauHd.exe
  2⤵
  PID:6640
- C:\Windows\System\xONxPzv.exe
  C:\Windows\System\xONxPzv.exe
  2⤵
  PID:6656
- C:\Windows\System\ehAOkDV.exe
  C:\Windows\System\ehAOkDV.exe
  2⤵
  PID:6672
- C:\Windows\System\PmpqkGd.exe
  C:\Windows\System\PmpqkGd.exe
  2⤵
  PID:6688
- C:\Windows\System\amDwwLH.exe
  C:\Windows\System\amDwwLH.exe
  2⤵
  PID:6704
- C:\Windows\System\tPepelP.exe
  C:\Windows\System\tPepelP.exe
  2⤵
  PID:6776
- C:\Windows\System\xeVdjVO.exe
  C:\Windows\System\xeVdjVO.exe
  2⤵
  PID:7048
- C:\Windows\System\YuZGQup.exe
  C:\Windows\System\YuZGQup.exe
  2⤵
  PID:7084
- C:\Windows\System\EuKAZmR.exe
  C:\Windows\System\EuKAZmR.exe
  2⤵
  PID:7104
- C:\Windows\System\ffzUYlo.exe
  C:\Windows\System\ffzUYlo.exe
  2⤵
  PID:7120
- C:\Windows\System\gWcpqQB.exe
  C:\Windows\System\gWcpqQB.exe
  2⤵
  PID:7136
- C:\Windows\System\GNLEkPJ.exe
  C:\Windows\System\GNLEkPJ.exe
  2⤵
  PID:3812
- C:\Windows\System\SbEYJfN.exe
  C:\Windows\System\SbEYJfN.exe
  2⤵
  PID:6392
- C:\Windows\System\MdgxAOI.exe
  C:\Windows\System\MdgxAOI.exe
  2⤵
  PID:6584
- C:\Windows\System\xJaZayJ.exe
  C:\Windows\System\xJaZayJ.exe
  2⤵
  PID:5208
- C:\Windows\System\UFaaHQV.exe
  C:\Windows\System\UFaaHQV.exe
  2⤵
  PID:6244
- C:\Windows\System\WpXcAjU.exe
  C:\Windows\System\WpXcAjU.exe
  2⤵
  PID:6348
- C:\Windows\System\uvJvfUg.exe
  C:\Windows\System\uvJvfUg.exe
  2⤵
  PID:6412
- C:\Windows\System\DiBXYUI.exe
  C:\Windows\System\DiBXYUI.exe
  2⤵
  PID:6504
- C:\Windows\System\swXcWuL.exe
  C:\Windows\System\swXcWuL.exe
  2⤵
  PID:6600
- C:\Windows\System\ZLOBsGM.exe
  C:\Windows\System\ZLOBsGM.exe
  2⤵
  PID:6696
- C:\Windows\System\lSzLVMl.exe
  C:\Windows\System\lSzLVMl.exe
  2⤵
  PID:5124
- C:\Windows\System\NtHBFmi.exe
  C:\Windows\System\NtHBFmi.exe
  2⤵
  PID:5380
- C:\Windows\System\jmYHFrQ.exe
  C:\Windows\System\jmYHFrQ.exe
  2⤵
  PID:5336
- C:\Windows\System\OTJCZCF.exe
  C:\Windows\System\OTJCZCF.exe
  2⤵
  PID:5240
- C:\Windows\System\OQiVTur.exe
  C:\Windows\System\OQiVTur.exe
  2⤵
  PID:5784
- C:\Windows\System\bHFwZme.exe
  C:\Windows\System\bHFwZme.exe
  2⤵
  PID:5400
- C:\Windows\System\vvpDnNz.exe
  C:\Windows\System\vvpDnNz.exe
  2⤵
  PID:5928
- C:\Windows\System\vToNBWP.exe
  C:\Windows\System\vToNBWP.exe
  2⤵
  PID:6808
- C:\Windows\System\xrfsYpD.exe
  C:\Windows\System\xrfsYpD.exe
  2⤵
  PID:5924
- C:\Windows\System\FYRyoEC.exe
  C:\Windows\System\FYRyoEC.exe
  2⤵
  PID:5960
- C:\Windows\System\mSTNcZM.exe
  C:\Windows\System\mSTNcZM.exe
  2⤵
  PID:6004
- C:\Windows\System\vovrQAF.exe
  C:\Windows\System\vovrQAF.exe
  2⤵
  PID:6072
- C:\Windows\System\fHkUNDh.exe
  C:\Windows\System\fHkUNDh.exe
  2⤵
  PID:5880
- C:\Windows\System\lOjaVOC.exe
  C:\Windows\System\lOjaVOC.exe
  2⤵
  PID:5764
- C:\Windows\System\eMlGtrl.exe
  C:\Windows\System\eMlGtrl.exe
  2⤵
  PID:5832
- C:\Windows\System\zVpWfxm.exe
  C:\Windows\System\zVpWfxm.exe
  2⤵
  PID:5844
- C:\Windows\System\ncUoxxe.exe
  C:\Windows\System\ncUoxxe.exe
  2⤵
  PID:3012
- C:\Windows\System\SWJJBBw.exe
  C:\Windows\System\SWJJBBw.exe
  2⤵
  PID:5476
- C:\Windows\System\gelSVAs.exe
  C:\Windows\System\gelSVAs.exe
  2⤵
  PID:5272
- C:\Windows\System\LgPlvBf.exe
  C:\Windows\System\LgPlvBf.exe
  2⤵
  PID:6916
- C:\Windows\System\CTvgiBH.exe
  C:\Windows\System\CTvgiBH.exe
  2⤵
  PID:6920
- C:\Windows\System\hrWoWPw.exe
  C:\Windows\System\hrWoWPw.exe
  2⤵
  PID:6952
- C:\Windows\System\ahaSnHC.exe
  C:\Windows\System\ahaSnHC.exe
  2⤵
  PID:6972
- C:\Windows\System\yWFBFBI.exe
  C:\Windows\System\yWFBFBI.exe
  2⤵
  PID:6980
- C:\Windows\System\XSDmGXm.exe
  C:\Windows\System\XSDmGXm.exe
  2⤵
  PID:7000
- C:\Windows\System\xqhttBy.exe
  C:\Windows\System\xqhttBy.exe
  2⤵
  PID:7020
- C:\Windows\System\vbvFKyp.exe
  C:\Windows\System\vbvFKyp.exe
  2⤵
  PID:7044
- C:\Windows\System\zpznicn.exe
  C:\Windows\System\zpznicn.exe
  2⤵
  PID:3040
- C:\Windows\System\PGacHXw.exe
  C:\Windows\System\PGacHXw.exe
  2⤵
  PID:7096
- C:\Windows\System\MgzyqVK.exe
  C:\Windows\System\MgzyqVK.exe
  2⤵
  PID:6332
- C:\Windows\System\Jzefvpy.exe
  C:\Windows\System\Jzefvpy.exe
  2⤵
  PID:7152
- C:\Windows\System\PcItlrz.exe
  C:\Windows\System\PcItlrz.exe
  2⤵
  PID:6456
- C:\Windows\System\JNPRxAu.exe
  C:\Windows\System\JNPRxAu.exe
  2⤵
  PID:6364
- C:\Windows\System\XEaJZKD.exe
  C:\Windows\System\XEaJZKD.exe
  2⤵
  PID:6556
- C:\Windows\System\yABmXEd.exe
  C:\Windows\System\yABmXEd.exe
  2⤵
  PID:6712
- C:\Windows\System\WGoiWbw.exe
  C:\Windows\System\WGoiWbw.exe
  2⤵
  PID:6716
- C:\Windows\System\vqTUwiv.exe
  C:\Windows\System\vqTUwiv.exe
  2⤵
  PID:6508
- C:\Windows\System\ypCvFso.exe
  C:\Windows\System\ypCvFso.exe
  2⤵
  PID:6116
- C:\Windows\System\xPTQaCH.exe
  C:\Windows\System\xPTQaCH.exe
  2⤵
  PID:4468
- C:\Windows\System\FzWcGGX.exe
  C:\Windows\System\FzWcGGX.exe
  2⤵
  PID:2776
- C:\Windows\System\foBjeEY.exe
  C:\Windows\System\foBjeEY.exe
  2⤵
  PID:6024
- C:\Windows\System\SmYvaFK.exe
  C:\Windows\System\SmYvaFK.exe
  2⤵
  PID:920
- C:\Windows\System\VnVIJke.exe
  C:\Windows\System\VnVIJke.exe
  2⤵
  PID:6260
- C:\Windows\System\EWNSEYt.exe
  C:\Windows\System\EWNSEYt.exe
  2⤵
  PID:6248
- C:\Windows\System\ocgZzSx.exe
  C:\Windows\System\ocgZzSx.exe
  2⤵
  PID:5128
- C:\Windows\System\zCOZeDF.exe
  C:\Windows\System\zCOZeDF.exe
  2⤵
  PID:6148
- C:\Windows\System\vyNvcPR.exe
  C:\Windows\System\vyNvcPR.exe
  2⤵
  PID:5608
- C:\Windows\System\MaxHmwo.exe
  C:\Windows\System\MaxHmwo.exe
  2⤵
  PID:5416
- C:\Windows\System\ypEbelM.exe
  C:\Windows\System\ypEbelM.exe
  2⤵
  PID:5480
- C:\Windows\System\FpdJQqB.exe
  C:\Windows\System\FpdJQqB.exe
  2⤵
  PID:6944
- C:\Windows\System\GFrOEPC.exe
  C:\Windows\System\GFrOEPC.exe
  2⤵
  PID:5768
- C:\Windows\System\rDKfjML.exe
  C:\Windows\System\rDKfjML.exe
  2⤵
  PID:5432
- C:\Windows\System\lIVnhix.exe
  C:\Windows\System\lIVnhix.exe
  2⤵
  PID:6984
- C:\Windows\System\rgDYodC.exe
  C:\Windows\System\rgDYodC.exe
  2⤵
  PID:7016
- C:\Windows\System\eVaobwA.exe
  C:\Windows\System\eVaobwA.exe
  2⤵
  PID:2880
- C:\Windows\System\FfWMNOI.exe
  C:\Windows\System\FfWMNOI.exe
  2⤵
  PID:7068
- C:\Windows\System\IgYcaNP.exe
  C:\Windows\System\IgYcaNP.exe
  2⤵
  PID:7132
- C:\Windows\System\XysJQmX.exe
  C:\Windows\System\XysJQmX.exe
  2⤵
  PID:3952
- C:\Windows\System\vfKbqVg.exe
  C:\Windows\System\vfKbqVg.exe
  2⤵
  PID:7076
- C:\Windows\System\IQtVMEb.exe
  C:\Windows\System\IQtVMEb.exe
  2⤵
  PID:6968
- C:\Windows\System\ekuJpHY.exe
  C:\Windows\System\ekuJpHY.exe
  2⤵
  PID:6520
- C:\Windows\System\BwxWvGj.exe
  C:\Windows\System\BwxWvGj.exe
  2⤵
  PID:5748
- C:\Windows\System\YsZZDlK.exe
  C:\Windows\System\YsZZDlK.exe
  2⤵
  PID:6428
- C:\Windows\System\PYdZOry.exe
  C:\Windows\System\PYdZOry.exe
  2⤵
  PID:6648
- C:\Windows\System\gqAKwxh.exe
  C:\Windows\System\gqAKwxh.exe
  2⤵
  PID:7032
- C:\Windows\System\AhjSFVB.exe
  C:\Windows\System\AhjSFVB.exe
  2⤵
  PID:6632
- C:\Windows\System\NHLJuUs.exe
  C:\Windows\System\NHLJuUs.exe
  2⤵
  PID:6100
- C:\Windows\System\ADnUvaI.exe
  C:\Windows\System\ADnUvaI.exe
  2⤵
  PID:1992
- C:\Windows\System\RDfUOdc.exe
  C:\Windows\System\RDfUOdc.exe
  2⤵
  PID:6040
- C:\Windows\System\MifeGAz.exe
  C:\Windows\System\MifeGAz.exe
  2⤵
  PID:5256
- C:\Windows\System\WlEmNPE.exe
  C:\Windows\System\WlEmNPE.exe
  2⤵
  PID:7100
- C:\Windows\System\VPSSVby.exe
  C:\Windows\System\VPSSVby.exe
  2⤵
  PID:6680
- C:\Windows\System\NtUChdn.exe
  C:\Windows\System\NtUChdn.exe
  2⤵
  PID:6276
- C:\Windows\System\vucblfK.exe
  C:\Windows\System\vucblfK.exe
  2⤵
  PID:6264
- C:\Windows\System\BpwwIBJ.exe
  C:\Windows\System\BpwwIBJ.exe
  2⤵
  PID:5720
- C:\Windows\System\zJKHvRy.exe
  C:\Windows\System\zJKHvRy.exe
  2⤵
  PID:7008
- C:\Windows\System\JDZqGBC.exe
  C:\Windows\System\JDZqGBC.exe
  2⤵
  PID:6936
- C:\Windows\System\quDAThm.exe
  C:\Windows\System\quDAThm.exe
  2⤵
  PID:7156
- C:\Windows\System\guyEUCz.exe
  C:\Windows\System\guyEUCz.exe
  2⤵
  PID:7024
- C:\Windows\System\XlHNDUF.exe
  C:\Windows\System\XlHNDUF.exe
  2⤵
  PID:6664
- C:\Windows\System\aMaPpIA.exe
  C:\Windows\System\aMaPpIA.exe
  2⤵
  PID:4548
- C:\Windows\System\KznQSAm.exe
  C:\Windows\System\KznQSAm.exe
  2⤵
  PID:1748
- C:\Windows\System\NLMEarw.exe
  C:\Windows\System\NLMEarw.exe
  2⤵
  PID:5828
- C:\Windows\System\AyEJNpO.exe
  C:\Windows\System\AyEJNpO.exe
  2⤵
  PID:6132
- C:\Windows\System\NXBwSgd.exe
  C:\Windows\System\NXBwSgd.exe
  2⤵
  PID:5576
- C:\Windows\System\eueZvmT.exe
  C:\Windows\System\eueZvmT.exe
  2⤵
  PID:6056
- C:\Windows\System\noQKzUx.exe
  C:\Windows\System\noQKzUx.exe
  2⤵
  PID:5592
- C:\Windows\System\wgpEBut.exe
  C:\Windows\System\wgpEBut.exe
  2⤵
  PID:7128
- C:\Windows\System\ckWYFCl.exe
  C:\Windows\System\ckWYFCl.exe
  2⤵
  PID:5816
- C:\Windows\System\kbLWBOl.exe
  C:\Windows\System\kbLWBOl.exe
  2⤵
  PID:6472
- C:\Windows\System\oBTiUsO.exe
  C:\Windows\System\oBTiUsO.exe
  2⤵
  PID:5528
- C:\Windows\System\JaETPNG.exe
  C:\Windows\System\JaETPNG.exe
  2⤵
  PID:7080
- C:\Windows\System\jNxsdBf.exe
  C:\Windows\System\jNxsdBf.exe
  2⤵
  PID:6084
- C:\Windows\System\rFWNnzw.exe
  C:\Windows\System\rFWNnzw.exe
  2⤵
  PID:5188
- C:\Windows\System\LkYNHaO.exe
  C:\Windows\System\LkYNHaO.exe
  2⤵
  PID:5780
- C:\Windows\System\apaRGdi.exe
  C:\Windows\System\apaRGdi.exe
  2⤵
  PID:1752
- C:\Windows\System\uqpzvzw.exe
  C:\Windows\System\uqpzvzw.exe
  2⤵
  PID:6620
- C:\Windows\System\teoItgZ.exe
  C:\Windows\System\teoItgZ.exe
  2⤵
  PID:6380
- C:\Windows\System\EDaClwY.exe
  C:\Windows\System\EDaClwY.exe
  2⤵
  PID:5812
- C:\Windows\System\afuSIZZ.exe
  C:\Windows\System\afuSIZZ.exe
  2⤵
  PID:7176
- C:\Windows\System\LhvHuqt.exe
  C:\Windows\System\LhvHuqt.exe
  2⤵
  PID:7196
- C:\Windows\System\aKQDlsr.exe
  C:\Windows\System\aKQDlsr.exe
  2⤵
  PID:7216
- C:\Windows\System\lVlWqgU.exe
  C:\Windows\System\lVlWqgU.exe
  2⤵
  PID:7232
- C:\Windows\System\uBSPKeF.exe
  C:\Windows\System\uBSPKeF.exe
  2⤵
  PID:7324
- C:\Windows\System\rJtYhYH.exe
  C:\Windows\System\rJtYhYH.exe
  2⤵
  PID:7340
- C:\Windows\System\ZdzpuKL.exe
  C:\Windows\System\ZdzpuKL.exe
  2⤵
  PID:7356
- C:\Windows\System\VnKnnZY.exe
  C:\Windows\System\VnKnnZY.exe
  2⤵
  PID:7372
- C:\Windows\System\dOWhFOC.exe
  C:\Windows\System\dOWhFOC.exe
  2⤵
  PID:7388
- C:\Windows\System\ePDZYTR.exe
  C:\Windows\System\ePDZYTR.exe
  2⤵
  PID:7404
- C:\Windows\System\sSBbGWE.exe
  C:\Windows\System\sSBbGWE.exe
  2⤵
  PID:7420
- C:\Windows\System\zRKOuEh.exe
  C:\Windows\System\zRKOuEh.exe
  2⤵
  PID:7436
- C:\Windows\System\iayCFkP.exe
  C:\Windows\System\iayCFkP.exe
  2⤵
  PID:7452
- C:\Windows\System\LCLpFSk.exe
  C:\Windows\System\LCLpFSk.exe
  2⤵
  PID:7468
- C:\Windows\System\ARUiCdG.exe
  C:\Windows\System\ARUiCdG.exe
  2⤵
  PID:7484
- C:\Windows\System\GIQClit.exe
  C:\Windows\System\GIQClit.exe
  2⤵
  PID:7500
- C:\Windows\System\KpEEYZX.exe
  C:\Windows\System\KpEEYZX.exe
  2⤵
  PID:7516
- C:\Windows\System\lUrUPeE.exe
  C:\Windows\System\lUrUPeE.exe
  2⤵
  PID:7532
- C:\Windows\System\jhHXEzH.exe
  C:\Windows\System\jhHXEzH.exe
  2⤵
  PID:7548
- C:\Windows\System\TPHHwZD.exe
  C:\Windows\System\TPHHwZD.exe
  2⤵
  PID:7564
- C:\Windows\System\GjQJyqE.exe
  C:\Windows\System\GjQJyqE.exe
  2⤵
  PID:7580
- C:\Windows\System\BJLibzO.exe
  C:\Windows\System\BJLibzO.exe
  2⤵
  PID:7596
- C:\Windows\System\AESTlEL.exe
  C:\Windows\System\AESTlEL.exe
  2⤵
  PID:7612
- C:\Windows\System\SBGZPYu.exe
  C:\Windows\System\SBGZPYu.exe
  2⤵
  PID:7632
- C:\Windows\System\usxNqkq.exe
  C:\Windows\System\usxNqkq.exe
  2⤵
  PID:7648
- C:\Windows\System\FgrPAdG.exe
  C:\Windows\System\FgrPAdG.exe
  2⤵
  PID:7664
- C:\Windows\System\nAWldUC.exe
  C:\Windows\System\nAWldUC.exe
  2⤵
  PID:7680
- C:\Windows\System\NngZSUL.exe
  C:\Windows\System\NngZSUL.exe
  2⤵
  PID:7696
- C:\Windows\System\kNjqROD.exe
  C:\Windows\System\kNjqROD.exe
  2⤵
  PID:7800
- C:\Windows\System\PJfaRSh.exe
  C:\Windows\System\PJfaRSh.exe
  2⤵
  PID:7816
- C:\Windows\System\lceLKjH.exe
  C:\Windows\System\lceLKjH.exe
  2⤵
  PID:7832
- C:\Windows\System\mELgMjp.exe
  C:\Windows\System\mELgMjp.exe
  2⤵
  PID:7848
- C:\Windows\System\wtWulZn.exe
  C:\Windows\System\wtWulZn.exe
  2⤵
  PID:7864
- C:\Windows\System\rzDzdyW.exe
  C:\Windows\System\rzDzdyW.exe
  2⤵
  PID:7880
- C:\Windows\System\SQuKplU.exe
  C:\Windows\System\SQuKplU.exe
  2⤵
  PID:7896
- C:\Windows\System\eiBIVxY.exe
  C:\Windows\System\eiBIVxY.exe
  2⤵
  PID:7912
- C:\Windows\System\FCoYRuG.exe
  C:\Windows\System\FCoYRuG.exe
  2⤵
  PID:7928
- C:\Windows\System\xVTCVdW.exe
  C:\Windows\System\xVTCVdW.exe
  2⤵
  PID:7944
- C:\Windows\System\IJDSvZL.exe
  C:\Windows\System\IJDSvZL.exe
  2⤵
  PID:7960
- C:\Windows\System\HwMTJQE.exe
  C:\Windows\System\HwMTJQE.exe
  2⤵
  PID:7976
- C:\Windows\System\xAOldzt.exe
  C:\Windows\System\xAOldzt.exe
  2⤵
  PID:7996
- C:\Windows\System\TcBtnNF.exe
  C:\Windows\System\TcBtnNF.exe
  2⤵
  PID:8012
- C:\Windows\System\fNtaZpN.exe
  C:\Windows\System\fNtaZpN.exe
  2⤵
  PID:8032
- C:\Windows\System\nWAaCZp.exe
  C:\Windows\System\nWAaCZp.exe
  2⤵
  PID:8048
- C:\Windows\System\tdIewAc.exe
  C:\Windows\System\tdIewAc.exe
  2⤵
  PID:8064
- C:\Windows\System\FiLySPu.exe
  C:\Windows\System\FiLySPu.exe
  2⤵
  PID:8084
- C:\Windows\System\IRkcMeO.exe
  C:\Windows\System\IRkcMeO.exe
  2⤵
  PID:8100
- C:\Windows\System\RofvbtZ.exe
  C:\Windows\System\RofvbtZ.exe
  2⤵
  PID:8116
- C:\Windows\System\JBDAAEU.exe
  C:\Windows\System\JBDAAEU.exe
  2⤵
  PID:8132
- C:\Windows\System\OjGNpBZ.exe
  C:\Windows\System\OjGNpBZ.exe
  2⤵
  PID:8148
- C:\Windows\System\AEDuLeW.exe
  C:\Windows\System\AEDuLeW.exe
  2⤵
  PID:8164
- C:\Windows\System\ohDJaVQ.exe
  C:\Windows\System\ohDJaVQ.exe
  2⤵
  PID:8180
- C:\Windows\System\kOxIbWA.exe
  C:\Windows\System\kOxIbWA.exe
  2⤵
  PID:6444
- C:\Windows\System\JsDWXlb.exe
  C:\Windows\System\JsDWXlb.exe
  2⤵
  PID:7012
- C:\Windows\System\KwhwBhN.exe
  C:\Windows\System\KwhwBhN.exe
  2⤵
  PID:7212
- C:\Windows\System\sYyJzgg.exe
  C:\Windows\System\sYyJzgg.exe
  2⤵
  PID:7064
- C:\Windows\System\jWPWmSl.exe
  C:\Windows\System\jWPWmSl.exe
  2⤵
  PID:6996
- C:\Windows\System\AXvmUKk.exe
  C:\Windows\System\AXvmUKk.exe
  2⤵
  PID:6284
- C:\Windows\System\iMaTqlz.exe
  C:\Windows\System\iMaTqlz.exe
  2⤵
  PID:6068
- C:\Windows\System\yMgzhPC.exe
  C:\Windows\System\yMgzhPC.exe
  2⤵
  PID:7192
- C:\Windows\System\IyIDblc.exe
  C:\Windows\System\IyIDblc.exe
  2⤵
  PID:7248
- C:\Windows\System\XWZfTSa.exe
  C:\Windows\System\XWZfTSa.exe
  2⤵
  PID:7264
- C:\Windows\System\OPlIKRG.exe
  C:\Windows\System\OPlIKRG.exe
  2⤵
  PID:7280
- C:\Windows\System\YunkbmY.exe
  C:\Windows\System\YunkbmY.exe
  2⤵
  PID:7292
- C:\Windows\System\cOfsFrZ.exe
  C:\Windows\System\cOfsFrZ.exe
  2⤵
  PID:7312
- C:\Windows\System\GkfwYxc.exe
  C:\Windows\System\GkfwYxc.exe
  2⤵
  PID:7348
- C:\Windows\System\iFZJQPi.exe
  C:\Windows\System\iFZJQPi.exe
  2⤵
  PID:7412
- C:\Windows\System\RAQbAuf.exe
  C:\Windows\System\RAQbAuf.exe
  2⤵
  PID:7476
- C:\Windows\System\VzOMOsk.exe
  C:\Windows\System\VzOMOsk.exe
  2⤵
  PID:7540
- C:\Windows\System\XIygfLf.exe
  C:\Windows\System\XIygfLf.exe
  2⤵
  PID:7676
- C:\Windows\System\bnysykp.exe
  C:\Windows\System\bnysykp.exe
  2⤵
  PID:7628
- C:\Windows\System\cSCjyVY.exe
  C:\Windows\System\cSCjyVY.exe
  2⤵
  PID:7524
- C:\Windows\System\TkBHQIZ.exe
  C:\Windows\System\TkBHQIZ.exe
  2⤵
  PID:7460
- C:\Windows\System\DWBDmWG.exe
  C:\Windows\System\DWBDmWG.exe
  2⤵
  PID:7368
- C:\Windows\System\mzKYAZE.exe
  C:\Windows\System\mzKYAZE.exe
  2⤵
  PID:7692
- C:\Windows\System\gPpqLJs.exe
  C:\Windows\System\gPpqLJs.exe
  2⤵
  PID:7708
- C:\Windows\System\RGzLwqA.exe
  C:\Windows\System\RGzLwqA.exe
  2⤵
  PID:7724
- C:\Windows\System\RlhRenH.exe
  C:\Windows\System\RlhRenH.exe
  2⤵
  PID:1180
- C:\Windows\System\NgbFkKx.exe
  C:\Windows\System\NgbFkKx.exe
  2⤵
  PID:7740
- C:\Windows\System\SvFkWiB.exe
  C:\Windows\System\SvFkWiB.exe
  2⤵
  PID:7756
- C:\Windows\System\BWMhLHU.exe
  C:\Windows\System\BWMhLHU.exe
  2⤵
  PID:7776
- C:\Windows\System\INAVdAM.exe
  C:\Windows\System\INAVdAM.exe
  2⤵
  PID:7772
- C:\Windows\System\TzVtwQQ.exe
  C:\Windows\System\TzVtwQQ.exe
  2⤵
  PID:7856
- C:\Windows\System\RLdCMTe.exe
  C:\Windows\System\RLdCMTe.exe
  2⤵
  PID:7892
- C:\Windows\System\ymqwkpV.exe
  C:\Windows\System\ymqwkpV.exe
  2⤵
  PID:7984
- C:\Windows\System\vVKvSKg.exe
  C:\Windows\System\vVKvSKg.exe
  2⤵
  PID:8020
- C:\Windows\System\HtgBooQ.exe
  C:\Windows\System\HtgBooQ.exe
  2⤵
  PID:8060
- C:\Windows\System\CYtMcNJ.exe
  C:\Windows\System\CYtMcNJ.exe
  2⤵
  PID:8128
- C:\Windows\System\JLbkTNB.exe
  C:\Windows\System\JLbkTNB.exe
  2⤵
  PID:7204
- C:\Windows\System\yVnjfcS.exe
  C:\Windows\System\yVnjfcS.exe
  2⤵
  PID:5332
- C:\Windows\System\KqZLpjs.exe
  C:\Windows\System\KqZLpjs.exe
  2⤵
  PID:5860
- C:\Windows\System\KjoQsvx.exe
  C:\Windows\System\KjoQsvx.exe
  2⤵
  PID:7272
- C:\Windows\System\XuNcofV.exe
  C:\Windows\System\XuNcofV.exe
  2⤵
  PID:7308
- C:\Windows\System\jRsgJjs.exe
  C:\Windows\System\jRsgJjs.exe
  2⤵
  PID:7512
- C:\Windows\System\BERqnue.exe
  C:\Windows\System\BERqnue.exe
  2⤵
  PID:7812
- C:\Windows\System\ChhsGRE.exe
  C:\Windows\System\ChhsGRE.exe
  2⤵
  PID:7572
- C:\Windows\System\fljaJRF.exe
  C:\Windows\System\fljaJRF.exe
  2⤵
  PID:7936
- C:\Windows\System\bWbUKKq.exe
  C:\Windows\System\bWbUKKq.exe
  2⤵
  PID:7968
- C:\Windows\System\xcYWjPA.exe
  C:\Windows\System\xcYWjPA.exe
  2⤵
  PID:8044
- C:\Windows\System\OsrxVPD.exe
  C:\Windows\System\OsrxVPD.exe
  2⤵
  PID:7260
- C:\Windows\System\HiiPqHU.exe
  C:\Windows\System\HiiPqHU.exe
  2⤵
  PID:5976
- C:\Windows\System\ivvqUYl.exe
  C:\Windows\System\ivvqUYl.exe
  2⤵
  PID:6180
- C:\Windows\System\jnqNmYa.exe
  C:\Windows\System\jnqNmYa.exe
  2⤵
  PID:8172
- C:\Windows\System\UwMHWgY.exe
  C:\Windows\System\UwMHWgY.exe
  2⤵
  PID:8108
- C:\Windows\System\DxkjZFJ.exe
  C:\Windows\System\DxkjZFJ.exe
  2⤵
  PID:7644
- C:\Windows\System\fhiRRfZ.exe
  C:\Windows\System\fhiRRfZ.exe
  2⤵
  PID:7760
- C:\Windows\System\idtSNcE.exe
  C:\Windows\System\idtSNcE.exe
  2⤵
  PID:7492
- C:\Windows\System\nIoWuwO.exe
  C:\Windows\System\nIoWuwO.exe
  2⤵
  PID:7720
- C:\Windows\System\Wdgfebm.exe
  C:\Windows\System\Wdgfebm.exe
  2⤵
  PID:7400
- C:\Windows\System\NChIjeP.exe
  C:\Windows\System\NChIjeP.exe
  2⤵
  PID:7560
- C:\Windows\System\EGNJaeH.exe
  C:\Windows\System\EGNJaeH.exe
  2⤵
  PID:7796
- C:\Windows\System\EZGAAFB.exe
  C:\Windows\System\EZGAAFB.exe
  2⤵
  PID:7752
- C:\Windows\System\vjPHPcu.exe
  C:\Windows\System\vjPHPcu.exe
  2⤵
  PID:2600
- C:\Windows\System\KoTTyoy.exe
  C:\Windows\System\KoTTyoy.exe
  2⤵
  PID:7640
- C:\Windows\System\LXpaOKg.exe
  C:\Windows\System\LXpaOKg.exe
  2⤵
  PID:2908
- C:\Windows\System\mRcWHWW.exe
  C:\Windows\System\mRcWHWW.exe
  2⤵
  PID:7844
- C:\Windows\System\XkwlhgQ.exe
  C:\Windows\System\XkwlhgQ.exe
  2⤵
  PID:8140
- C:\Windows\System\HfdSAjx.exe
  C:\Windows\System\HfdSAjx.exe
  2⤵
  PID:7480
- C:\Windows\System\zSfKiGo.exe
  C:\Windows\System\zSfKiGo.exe
  2⤵
  PID:6208
- C:\Windows\System\SuBhuGQ.exe
  C:\Windows\System\SuBhuGQ.exe
  2⤵
  PID:7688
- C:\Windows\System\zvvFgvz.exe
  C:\Windows\System\zvvFgvz.exe
  2⤵
  PID:7716
- C:\Windows\System\RWRMrZD.exe
  C:\Windows\System\RWRMrZD.exe
  2⤵
  PID:928
- C:\Windows\System\FtcMfEl.exe
  C:\Windows\System\FtcMfEl.exe
  2⤵
  PID:8056
- C:\Windows\System\NuRDWEd.exe
  C:\Windows\System\NuRDWEd.exe
  2⤵
  PID:7876
- C:\Windows\System\dXGBsfz.exe
  C:\Windows\System\dXGBsfz.exe
  2⤵
  PID:6160
- C:\Windows\System\ibzTyZb.exe
  C:\Windows\System\ibzTyZb.exe
  2⤵
  PID:7336
- C:\Windows\System\JpGxkbv.exe
  C:\Windows\System\JpGxkbv.exe
  2⤵
  PID:7732
- C:\Windows\System\rpIqmzl.exe
  C:\Windows\System\rpIqmzl.exe
  2⤵
  PID:8040
- C:\Windows\System\OHAPYYG.exe
  C:\Windows\System\OHAPYYG.exe
  2⤵
  PID:7792
- C:\Windows\System\MszBayk.exe
  C:\Windows\System\MszBayk.exe
  2⤵
  PID:6196
- C:\Windows\System\vanyRbQ.exe
  C:\Windows\System\vanyRbQ.exe
  2⤵
  PID:7908
- C:\Windows\System\uuOcxhP.exe
  C:\Windows\System\uuOcxhP.exe
  2⤵
  PID:8188
- C:\Windows\System\HVFlLIM.exe
  C:\Windows\System\HVFlLIM.exe
  2⤵
  PID:7860
- C:\Windows\System\BphwTXe.exe
  C:\Windows\System\BphwTXe.exe
  2⤵
  PID:8204
- C:\Windows\System\PxkZThp.exe
  C:\Windows\System\PxkZThp.exe
  2⤵
  PID:8220
- C:\Windows\System\ammsWPd.exe
  C:\Windows\System\ammsWPd.exe
  2⤵
  PID:8236
- C:\Windows\System\lsaoOSN.exe
  C:\Windows\System\lsaoOSN.exe
  2⤵
  PID:8252
- C:\Windows\System\yQrZhPx.exe
  C:\Windows\System\yQrZhPx.exe
  2⤵
  PID:8268
- C:\Windows\System\RTdQKpy.exe
  C:\Windows\System\RTdQKpy.exe
  2⤵
  PID:8284
- C:\Windows\System\yGuYTOH.exe
  C:\Windows\System\yGuYTOH.exe
  2⤵
  PID:8300
- C:\Windows\System\kmkJMhy.exe
  C:\Windows\System\kmkJMhy.exe
  2⤵
  PID:8316
- C:\Windows\System\jfIZqYy.exe
  C:\Windows\System\jfIZqYy.exe
  2⤵
  PID:8332
- C:\Windows\System\RQqMflR.exe
  C:\Windows\System\RQqMflR.exe
  2⤵
  PID:8348
- C:\Windows\System\viePgZT.exe
  C:\Windows\System\viePgZT.exe
  2⤵
  PID:8364
- C:\Windows\System\iBNNVNA.exe
  C:\Windows\System\iBNNVNA.exe
  2⤵
  PID:8380
- C:\Windows\System\xpsgAhi.exe
  C:\Windows\System\xpsgAhi.exe
  2⤵
  PID:8396
- C:\Windows\System\gAArqeo.exe
  C:\Windows\System\gAArqeo.exe
  2⤵
  PID:8412
- C:\Windows\System\TCUvSwg.exe
  C:\Windows\System\TCUvSwg.exe
  2⤵
  PID:8432
- C:\Windows\System\EPXQamR.exe
  C:\Windows\System\EPXQamR.exe
  2⤵
  PID:8448
- C:\Windows\System\pTAnQBG.exe
  C:\Windows\System\pTAnQBG.exe
  2⤵
  PID:8464
- C:\Windows\System\FiRczuL.exe
  C:\Windows\System\FiRczuL.exe
  2⤵
  PID:8480
- C:\Windows\System\eOAgyUV.exe
  C:\Windows\System\eOAgyUV.exe
  2⤵
  PID:8496
- C:\Windows\System\FEqCGSX.exe
  C:\Windows\System\FEqCGSX.exe
  2⤵
  PID:8512
- C:\Windows\System\yevYiCT.exe
  C:\Windows\System\yevYiCT.exe
  2⤵
  PID:8528
- C:\Windows\System\SOmIgpG.exe
  C:\Windows\System\SOmIgpG.exe
  2⤵
  PID:8544
- C:\Windows\System\syCSsaa.exe
  C:\Windows\System\syCSsaa.exe
  2⤵
  PID:8564
- C:\Windows\System\OsSfYyd.exe
  C:\Windows\System\OsSfYyd.exe
  2⤵
  PID:8580
- C:\Windows\System\AYmxXEr.exe
  C:\Windows\System\AYmxXEr.exe
  2⤵
  PID:8596
- C:\Windows\System\EHniZYe.exe
  C:\Windows\System\EHniZYe.exe
  2⤵
  PID:8616
- C:\Windows\System\MLMZNok.exe
  C:\Windows\System\MLMZNok.exe
  2⤵
  PID:8636
- C:\Windows\System\kbyGXxr.exe
  C:\Windows\System\kbyGXxr.exe
  2⤵
  PID:8652
- C:\Windows\System\CCTmWYn.exe
  C:\Windows\System\CCTmWYn.exe
  2⤵
  PID:8668
- C:\Windows\System\sbeRjpE.exe
  C:\Windows\System\sbeRjpE.exe
  2⤵
  PID:8688
- C:\Windows\System\gtPJfiG.exe
  C:\Windows\System\gtPJfiG.exe
  2⤵
  PID:8704
- C:\Windows\System\EaDLvWA.exe
  C:\Windows\System\EaDLvWA.exe
  2⤵
  PID:8720
- C:\Windows\System\zDVNyMo.exe
  C:\Windows\System\zDVNyMo.exe
  2⤵
  PID:8736
- C:\Windows\System\QNYuBii.exe
  C:\Windows\System\QNYuBii.exe
  2⤵
  PID:8844
- C:\Windows\System\WYYBYTy.exe
  C:\Windows\System\WYYBYTy.exe
  2⤵
  PID:8864
- C:\Windows\System\qJkYkPM.exe
  C:\Windows\System\qJkYkPM.exe
  2⤵
  PID:8880
- C:\Windows\System\NNNfEDb.exe
  C:\Windows\System\NNNfEDb.exe
  2⤵
  PID:8896
- C:\Windows\System\cIqWjAL.exe
  C:\Windows\System\cIqWjAL.exe
  2⤵
  PID:8912
- C:\Windows\System\jEayGbz.exe
  C:\Windows\System\jEayGbz.exe
  2⤵
  PID:8928
- C:\Windows\System\KtxFowV.exe
  C:\Windows\System\KtxFowV.exe
  2⤵
  PID:8944
- C:\Windows\System\qcRNelk.exe
  C:\Windows\System\qcRNelk.exe
  2⤵
  PID:8960
- C:\Windows\System\MwlPZBu.exe
  C:\Windows\System\MwlPZBu.exe
  2⤵
  PID:8976
- C:\Windows\System\NuYBuzV.exe
  C:\Windows\System\NuYBuzV.exe
  2⤵
  PID:8992
- C:\Windows\System\yTFYQIk.exe
  C:\Windows\System\yTFYQIk.exe
  2⤵
  PID:9008
- C:\Windows\System\pkfSzVU.exe
  C:\Windows\System\pkfSzVU.exe
  2⤵
  PID:9028
- C:\Windows\System\WBiQfSi.exe
  C:\Windows\System\WBiQfSi.exe
  2⤵
  PID:9044
- C:\Windows\System\sOCXCEQ.exe
  C:\Windows\System\sOCXCEQ.exe
  2⤵
  PID:9060
- C:\Windows\System\NCPsjDK.exe
  C:\Windows\System\NCPsjDK.exe
  2⤵
  PID:9076
- C:\Windows\System\KQyerif.exe
  C:\Windows\System\KQyerif.exe
  2⤵
  PID:9092
- C:\Windows\System\ODQabtQ.exe
  C:\Windows\System\ODQabtQ.exe
  2⤵
  PID:9108
- C:\Windows\System\yZAqejl.exe
  C:\Windows\System\yZAqejl.exe
  2⤵
  PID:9124
- C:\Windows\System\jzxqRoh.exe
  C:\Windows\System\jzxqRoh.exe
  2⤵
  PID:9140
- C:\Windows\System\IdnDbJX.exe
  C:\Windows\System\IdnDbJX.exe
  2⤵
  PID:9156
- C:\Windows\System\JMkdUnK.exe
  C:\Windows\System\JMkdUnK.exe
  2⤵
  PID:9172
- C:\Windows\System\mxIjyWs.exe
  C:\Windows\System\mxIjyWs.exe
  2⤵
  PID:9188
- C:\Windows\System\NhbRvET.exe
  C:\Windows\System\NhbRvET.exe
  2⤵
  PID:9204
- C:\Windows\System\RbymoII.exe
  C:\Windows\System\RbymoII.exe
  2⤵
  PID:7144
- C:\Windows\System\rDOsKMb.exe
  C:\Windows\System\rDOsKMb.exe
  2⤵
  PID:7448
- C:\Windows\System\JNkyBlx.exe
  C:\Windows\System\JNkyBlx.exe
  2⤵
  PID:7304
- C:\Windows\System\ZyAUaqV.exe
  C:\Windows\System\ZyAUaqV.exe
  2⤵
  PID:8248
- C:\Windows\System\UEqTqoW.exe
  C:\Windows\System\UEqTqoW.exe
  2⤵
  PID:8476
- C:\Windows\System\gOavRLu.exe
  C:\Windows\System\gOavRLu.exe
  2⤵
  PID:8524
- C:\Windows\System\UaRUMry.exe
  C:\Windows\System\UaRUMry.exe
  2⤵
  PID:8676
- C:\Windows\System\bzEEZCD.exe
  C:\Windows\System\bzEEZCD.exe
  2⤵
  PID:8660
- C:\Windows\System\iVmWKHY.exe
  C:\Windows\System\iVmWKHY.exe
  2⤵
  PID:8696
- C:\Windows\System\SMOycXy.exe
  C:\Windows\System\SMOycXy.exe
  2⤵
  PID:8732
- C:\Windows\System\WtCemXH.exe
  C:\Windows\System\WtCemXH.exe
  2⤵
  PID:8756
- C:\Windows\System\ILVJyQE.exe
  C:\Windows\System\ILVJyQE.exe
  2⤵
  PID:8768
- C:\Windows\System\wvldMDi.exe
  C:\Windows\System\wvldMDi.exe
  2⤵
  PID:8784
- C:\Windows\System\stdDSUB.exe
  C:\Windows\System\stdDSUB.exe
  2⤵
  PID:8804
- C:\Windows\System\gDQBazu.exe
  C:\Windows\System\gDQBazu.exe
  2⤵
  PID:8820
- C:\Windows\System\pfcIdDG.exe
  C:\Windows\System\pfcIdDG.exe
  2⤵
  PID:8836
- C:\Windows\System\eSALIqd.exe
  C:\Windows\System\eSALIqd.exe
  2⤵
  PID:8872
- C:\Windows\System\cnANWWj.exe
  C:\Windows\System\cnANWWj.exe
  2⤵
  PID:8908
- C:\Windows\System\cSGPTmD.exe
  C:\Windows\System\cSGPTmD.exe
  2⤵
  PID:8972
- C:\Windows\System\zVYohPc.exe
  C:\Windows\System\zVYohPc.exe
  2⤵
  PID:9040
- C:\Windows\System\lqFjTrt.exe
  C:\Windows\System\lqFjTrt.exe
  2⤵
  PID:9104
- C:\Windows\System\CrVbeYT.exe
  C:\Windows\System\CrVbeYT.exe
  2⤵
  PID:9168
- C:\Windows\System\mqyTPJG.exe
  C:\Windows\System\mqyTPJG.exe
  2⤵
  PID:7592
- C:\Windows\System\iHoxVdF.exe
  C:\Windows\System\iHoxVdF.exe
  2⤵
  PID:8892
- C:\Windows\System\cfDjZAn.exe
  C:\Windows\System\cfDjZAn.exe
  2⤵
  PID:9020
- C:\Windows\System\Owqtnqg.exe
  C:\Windows\System\Owqtnqg.exe
  2⤵
  PID:7608
- C:\Windows\System\PZqFMmX.exe
  C:\Windows\System\PZqFMmX.exe
  2⤵
  PID:8308
- C:\Windows\System\ZmePgcR.exe
  C:\Windows\System\ZmePgcR.exe
  2⤵
  PID:8372
- C:\Windows\System\MjyKqym.exe
  C:\Windows\System\MjyKqym.exe
  2⤵
  PID:8440
- C:\Windows\System\iEBUyQr.exe
  C:\Windows\System\iEBUyQr.exe
  2⤵
  PID:8424
- C:\Windows\System\vXKHPqu.exe
  C:\Windows\System\vXKHPqu.exe
  2⤵
  PID:8196
- C:\Windows\System\SNbbpkK.exe
  C:\Windows\System\SNbbpkK.exe
  2⤵
  PID:7768
- C:\Windows\System\NBymZZi.exe
  C:\Windows\System\NBymZZi.exe
  2⤵
  PID:8556
- C:\Windows\System\ZzCbgcZ.exe
  C:\Windows\System\ZzCbgcZ.exe
  2⤵
  PID:8588
- C:\Windows\System\xgWsRNO.exe
  C:\Windows\System\xgWsRNO.exe
  2⤵
  PID:8488
- C:\Windows\System\toSdIZN.exe
  C:\Windows\System\toSdIZN.exe
  2⤵
  PID:8628
- C:\Windows\System\ECylIUS.exe
  C:\Windows\System\ECylIUS.exe
  2⤵
  PID:8700
- C:\Windows\System\PHfHjjc.exe
  C:\Windows\System\PHfHjjc.exe
  2⤵
  PID:8796
- C:\Windows\System\CoZwIkl.exe
  C:\Windows\System\CoZwIkl.exe
  2⤵
  PID:8828
- C:\Windows\System\cXMgVwJ.exe
  C:\Windows\System\cXMgVwJ.exe
  2⤵
  PID:8748
- C:\Windows\System\BiAPaEG.exe
  C:\Windows\System\BiAPaEG.exe
  2⤵
  PID:8940
- C:\Windows\System\ZoiUJCg.exe
  C:\Windows\System\ZoiUJCg.exe
  2⤵
  PID:9036
- C:\Windows\System\QzjzzwN.exe
  C:\Windows\System\QzjzzwN.exe
  2⤵
  PID:8816
- C:\Windows\System\xmlACVr.exe
  C:\Windows\System\xmlACVr.exe
  2⤵
  PID:8244
- C:\Windows\System\WiFFnSy.exe
  C:\Windows\System\WiFFnSy.exe
  2⤵
  PID:8956
- C:\Windows\System\cBJAtvh.exe
  C:\Windows\System\cBJAtvh.exe
  2⤵
  PID:8280
- C:\Windows\System\HzZxPiQ.exe
  C:\Windows\System\HzZxPiQ.exe
  2⤵
  PID:7872
- C:\Windows\System\oqZJjXG.exe
  C:\Windows\System\oqZJjXG.exe
  2⤵
  PID:8404
- C:\Windows\System\DMKicZp.exe
  C:\Windows\System\DMKicZp.exe
  2⤵
  PID:9052
- C:\Windows\System\iSJitZr.exe
  C:\Windows\System\iSJitZr.exe
  2⤵
  PID:9084
- C:\Windows\System\Ykqwdzk.exe
  C:\Windows\System\Ykqwdzk.exe
  2⤵
  PID:2916
- C:\Windows\System\xZJhEka.exe
  C:\Windows\System\xZJhEka.exe
  2⤵
  PID:2912
- C:\Windows\System\KRnTVRp.exe
  C:\Windows\System\KRnTVRp.exe
  2⤵
  PID:8296
- C:\Windows\System\qZTGzSo.exe
  C:\Windows\System\qZTGzSo.exe
  2⤵
  PID:8444
- C:\Windows\System\HRKzxhq.exe
  C:\Windows\System\HRKzxhq.exe
  2⤵
  PID:9056
- C:\Windows\System\uQCbyxu.exe
  C:\Windows\System\uQCbyxu.exe
  2⤵
  PID:8508
- C:\Windows\System\dHQVBVQ.exe
  C:\Windows\System\dHQVBVQ.exe
  2⤵
  PID:7208
- C:\Windows\System\IdYQxqt.exe
  C:\Windows\System\IdYQxqt.exe
  2⤵
  PID:7788
- C:\Windows\System\xnKYblI.exe
  C:\Windows\System\xnKYblI.exe
  2⤵
  PID:8260
- C:\Windows\System\rVhXdBv.exe
  C:\Windows\System\rVhXdBv.exe
  2⤵
  PID:8792
- C:\Windows\System\WMAsokJ.exe
  C:\Windows\System\WMAsokJ.exe
  2⤵
  PID:8744
- C:\Windows\System\WyxAnZc.exe
  C:\Windows\System\WyxAnZc.exe
  2⤵
  PID:8712
- C:\Windows\System\DrFuEzC.exe
  C:\Windows\System\DrFuEzC.exe
  2⤵
  PID:8904
- C:\Windows\System\PWIGqOt.exe
  C:\Windows\System\PWIGqOt.exe
  2⤵
  PID:9004
- C:\Windows\System\QdzsZoE.exe
  C:\Windows\System\QdzsZoE.exe
  2⤵
  PID:8988
- C:\Windows\System\fkiLhXg.exe
  C:\Windows\System\fkiLhXg.exe
  2⤵
  PID:9024
- C:\Windows\System\JQofxBF.exe
  C:\Windows\System\JQofxBF.exe
  2⤵
  PID:5864
- C:\Windows\System\AIhwSQR.exe
  C:\Windows\System\AIhwSQR.exe
  2⤵
  PID:9116
- C:\Windows\System\PEVjqRy.exe
  C:\Windows\System\PEVjqRy.exe
  2⤵
  PID:8592
- C:\Windows\System\OPAOoPz.exe
  C:\Windows\System\OPAOoPz.exe
  2⤵
  PID:8920
- C:\Windows\System\OkVmeeo.exe
  C:\Windows\System\OkVmeeo.exe
  2⤵
  PID:9100
- C:\Windows\System\yFnkrXX.exe
  C:\Windows\System\yFnkrXX.exe
  2⤵
  PID:8504
- C:\Windows\System\VuIwDbq.exe
  C:\Windows\System\VuIwDbq.exe
  2⤵
  PID:8612
- C:\Windows\System\UqkIHwB.exe
  C:\Windows\System\UqkIHwB.exe
  2⤵
  PID:8460
- C:\Windows\System\BdFBbZE.exe
  C:\Windows\System\BdFBbZE.exe
  2⤵
  PID:8344
- C:\Windows\System\QXNEVHu.exe
  C:\Windows\System\QXNEVHu.exe
  2⤵
  PID:8388
- C:\Windows\System\QHCGrIw.exe
  C:\Windows\System\QHCGrIw.exe
  2⤵
  PID:9232
- C:\Windows\System\IFqJEYH.exe
  C:\Windows\System\IFqJEYH.exe
  2⤵
  PID:9248
- C:\Windows\System\XnwOzhZ.exe
  C:\Windows\System\XnwOzhZ.exe
  2⤵
  PID:9264
- C:\Windows\System\gnYcqPA.exe
  C:\Windows\System\gnYcqPA.exe
  2⤵
  PID:9396
- C:\Windows\System\iHzBJHL.exe
  C:\Windows\System\iHzBJHL.exe
  2⤵
  PID:9412
- C:\Windows\System\tLaTuFi.exe
  C:\Windows\System\tLaTuFi.exe
  2⤵
  PID:9428
- C:\Windows\System\nlywuBw.exe
  C:\Windows\System\nlywuBw.exe
  2⤵
  PID:9444
- C:\Windows\System\gcwesZf.exe
  C:\Windows\System\gcwesZf.exe
  2⤵
  PID:9460
- C:\Windows\System\zLMMrHD.exe
  C:\Windows\System\zLMMrHD.exe
  2⤵
  PID:9480
- C:\Windows\System\QcYqhmD.exe
  C:\Windows\System\QcYqhmD.exe
  2⤵
  PID:9496
- C:\Windows\System\RIlbrrA.exe
  C:\Windows\System\RIlbrrA.exe
  2⤵
  PID:9512
- C:\Windows\System\lXNDEiU.exe
  C:\Windows\System\lXNDEiU.exe
  2⤵
  PID:9528
- C:\Windows\System\oAMpEHE.exe
  C:\Windows\System\oAMpEHE.exe
  2⤵
  PID:9544
- C:\Windows\System\NlPPflj.exe
  C:\Windows\System\NlPPflj.exe
  2⤵
  PID:9560
- C:\Windows\System\YUkInhn.exe
  C:\Windows\System\YUkInhn.exe
  2⤵
  PID:9576
- C:\Windows\System\qflfdNn.exe
  C:\Windows\System\qflfdNn.exe
  2⤵
  PID:9592
- C:\Windows\System\REhlfoX.exe
  C:\Windows\System\REhlfoX.exe
  2⤵
  PID:9612
- C:\Windows\System\rhZvSjI.exe
  C:\Windows\System\rhZvSjI.exe
  2⤵
  PID:9628
- C:\Windows\System\eCsjJxH.exe
  C:\Windows\System\eCsjJxH.exe
  2⤵
  PID:9652
- C:\Windows\System\aHYpSfR.exe
  C:\Windows\System\aHYpSfR.exe
  2⤵
  PID:9668
- C:\Windows\System\HIYtADg.exe
  C:\Windows\System\HIYtADg.exe
  2⤵
  PID:9684
- C:\Windows\System\NHTtTFI.exe
  C:\Windows\System\NHTtTFI.exe
  2⤵
  PID:9704
- C:\Windows\System\huwPtJi.exe
  C:\Windows\System\huwPtJi.exe
  2⤵
  PID:9724
- C:\Windows\System\SagacdW.exe
  C:\Windows\System\SagacdW.exe
  2⤵
  PID:9740
- C:\Windows\System\klRZGCP.exe
  C:\Windows\System\klRZGCP.exe
  2⤵
  PID:9756
- C:\Windows\System\kJRcURz.exe
  C:\Windows\System\kJRcURz.exe
  2⤵
  PID:9772
- C:\Windows\System\oJBvzTY.exe
  C:\Windows\System\oJBvzTY.exe
  2⤵
  PID:9788
- C:\Windows\System\ybIWInE.exe
  C:\Windows\System\ybIWInE.exe
  2⤵
  PID:9804
- C:\Windows\System\YmddlZk.exe
  C:\Windows\System\YmddlZk.exe
  2⤵
  PID:9820
- C:\Windows\System\szwXWIc.exe
  C:\Windows\System\szwXWIc.exe
  2⤵
  PID:9836
- C:\Windows\System\snGnKHj.exe
  C:\Windows\System\snGnKHj.exe
  2⤵
  PID:9852
- C:\Windows\System\JygnHEV.exe
  C:\Windows\System\JygnHEV.exe
  2⤵
  PID:9868
- C:\Windows\System\egcMcGv.exe
  C:\Windows\System\egcMcGv.exe
  2⤵
  PID:9884
- C:\Windows\System\wEdCxXT.exe
  C:\Windows\System\wEdCxXT.exe
  2⤵
  PID:9900
- C:\Windows\System\VXiTIWw.exe
  C:\Windows\System\VXiTIWw.exe
  2⤵
  PID:9916
- C:\Windows\System\JLMyqgc.exe
  C:\Windows\System\JLMyqgc.exe
  2⤵
  PID:9932
- C:\Windows\System\pzlFQUp.exe
  C:\Windows\System\pzlFQUp.exe
  2⤵
  PID:9948
- C:\Windows\System\mAZWSvh.exe
  C:\Windows\System\mAZWSvh.exe
  2⤵
  PID:9964
- C:\Windows\System\TJkzpJw.exe
  C:\Windows\System\TJkzpJw.exe
  2⤵
  PID:9984
- C:\Windows\System\FReUnkb.exe
  C:\Windows\System\FReUnkb.exe
  2⤵
  PID:10004
- C:\Windows\System\ySnYHmH.exe
  C:\Windows\System\ySnYHmH.exe
  2⤵
  PID:10020
- C:\Windows\System\XvLTpmJ.exe
  C:\Windows\System\XvLTpmJ.exe
  2⤵
  PID:10120
- C:\Windows\System\TnAXiLv.exe
  C:\Windows\System\TnAXiLv.exe
  2⤵
  PID:10136
- C:\Windows\System\ZLgkmNT.exe
  C:\Windows\System\ZLgkmNT.exe
  2⤵
  PID:10152
- C:\Windows\System\xITzpZR.exe
  C:\Windows\System\xITzpZR.exe
  2⤵
  PID:10168
- C:\Windows\System\VKBWUuE.exe
  C:\Windows\System\VKBWUuE.exe
  2⤵
  PID:10184
- C:\Windows\System\baEXIak.exe
  C:\Windows\System\baEXIak.exe
  2⤵
  PID:10200
- C:\Windows\System\sBmHXjU.exe
  C:\Windows\System\sBmHXjU.exe
  2⤵
  PID:10216
- C:\Windows\System\WzNGptg.exe
  C:\Windows\System\WzNGptg.exe
  2⤵
  PID:10232
- C:\Windows\System\TRQvooY.exe
  C:\Windows\System\TRQvooY.exe
  2⤵
  PID:9072
- C:\Windows\System\UHTnxMA.exe
  C:\Windows\System\UHTnxMA.exe
  2⤵
  PID:8232
- C:\Windows\System\rEwQpDp.exe
  C:\Windows\System\rEwQpDp.exe
  2⤵
  PID:9300
- C:\Windows\System\otZlofF.exe
  C:\Windows\System\otZlofF.exe
  2⤵
  PID:9356
- C:\Windows\System\fKOINgq.exe
  C:\Windows\System\fKOINgq.exe
  2⤵
  PID:9336
- C:\Windows\System\EMwRCgY.exe
  C:\Windows\System\EMwRCgY.exe
  2⤵
  PID:9352
- C:\Windows\System\UXUUJSA.exe
  C:\Windows\System\UXUUJSA.exe
  2⤵
  PID:9408
- C:\Windows\System\UbIzSUX.exe
  C:\Windows\System\UbIzSUX.exe
  2⤵
  PID:9476
- C:\Windows\System\FnzJdLk.exe
  C:\Windows\System\FnzJdLk.exe
  2⤵
  PID:9380
- C:\Windows\System\dUXQGEP.exe
  C:\Windows\System\dUXQGEP.exe
  2⤵
  PID:9540
- C:\Windows\System\UQFUiVp.exe
  C:\Windows\System\UQFUiVp.exe
  2⤵
  PID:9584
- C:\Windows\System\QGUBjIo.exe
  C:\Windows\System\QGUBjIo.exe
  2⤵
  PID:9392
- C:\Windows\System\gVBQGHO.exe
  C:\Windows\System\gVBQGHO.exe
  2⤵
  PID:9700
- C:\Windows\System\ylzGohG.exe
  C:\Windows\System\ylzGohG.exe
  2⤵
  PID:9624
- C:\Windows\System\IKKzbhU.exe
  C:\Windows\System\IKKzbhU.exe
  2⤵
  PID:9764
- C:\Windows\System\TeTEQMw.exe
  C:\Windows\System\TeTEQMw.exe
  2⤵
  PID:9832
- C:\Windows\System\sfiXZAN.exe
  C:\Windows\System\sfiXZAN.exe
  2⤵
  PID:9892
- C:\Windows\System\DgGVqme.exe
  C:\Windows\System\DgGVqme.exe
  2⤵
  PID:9716
- C:\Windows\System\LIbNABf.exe
  C:\Windows\System\LIbNABf.exe
  2⤵
  PID:9784
- C:\Windows\System\ijnmtIp.exe
  C:\Windows\System\ijnmtIp.exe
  2⤵
  PID:9848
- C:\Windows\System\hbnarrv.exe
  C:\Windows\System\hbnarrv.exe
  2⤵
  PID:9928
- C:\Windows\System\MRheyeH.exe
  C:\Windows\System\MRheyeH.exe
  2⤵
  PID:9992
- C:\Windows\System\WGmbGjC.exe
  C:\Windows\System\WGmbGjC.exe
  2⤵
  PID:9600
- C:\Windows\System\BYgiEaZ.exe
  C:\Windows\System\BYgiEaZ.exe
  2⤵
  PID:9644
- C:\Windows\System\vvYVjkS.exe
  C:\Windows\System\vvYVjkS.exe
  2⤵
  PID:9680
- C:\Windows\System\NFpuRNt.exe
  C:\Windows\System\NFpuRNt.exe
  2⤵
  PID:9944
- C:\Windows\System\MoROopU.exe
  C:\Windows\System\MoROopU.exe
  2⤵
  PID:9536
- C:\Windows\System\EBmHxiJ.exe
  C:\Windows\System\EBmHxiJ.exe
  2⤵
  PID:10028
- C:\Windows\System\PPnJoln.exe
  C:\Windows\System\PPnJoln.exe
  2⤵
  PID:10044
- C:\Windows\System\XXiAnfI.exe
  C:\Windows\System\XXiAnfI.exe
  2⤵
  PID:9148
- C:\Windows\System\jrdqNeA.exe
  C:\Windows\System\jrdqNeA.exe
  2⤵
  PID:10072
- C:\Windows\System\JBcyNUp.exe
  C:\Windows\System\JBcyNUp.exe
  2⤵
  PID:10088
- C:\Windows\System\JrrJlCp.exe
  C:\Windows\System\JrrJlCp.exe
  2⤵
  PID:10108
- C:\Windows\System\lTfedJv.exe
  C:\Windows\System\lTfedJv.exe
  2⤵
  PID:10128
- C:\Windows\System\rRoXIdl.exe
  C:\Windows\System\rRoXIdl.exe
  2⤵
  PID:8392
- C:\Windows\System\dtjYzUO.exe
  C:\Windows\System\dtjYzUO.exe
  2⤵
  PID:9276
- C:\Windows\System\MfxMzNq.exe
  C:\Windows\System\MfxMzNq.exe
  2⤵
  PID:9296
- C:\Windows\System\DntoGLH.exe
  C:\Windows\System\DntoGLH.exe
  2⤵
  PID:8876
- C:\Windows\System\ZXETiJf.exe
  C:\Windows\System\ZXETiJf.exe
  2⤵
  PID:8200
- C:\Windows\System\TCfOFud.exe
  C:\Windows\System\TCfOFud.exe
  2⤵
  PID:9404
- C:\Windows\System\FqFBVPK.exe
  C:\Windows\System\FqFBVPK.exe
  2⤵
  PID:9424
- C:\Windows\System\rgqUxGG.exe
  C:\Windows\System\rgqUxGG.exe
  2⤵
  PID:9768
- C:\Windows\System\fQkKbpV.exe
  C:\Windows\System\fQkKbpV.exe
  2⤵
  PID:9880
- C:\Windows\System\HpQhKpa.exe
  C:\Windows\System\HpQhKpa.exe
  2⤵
  PID:9648
- C:\Windows\System\hldjzgS.exe
  C:\Windows\System\hldjzgS.exe
  2⤵
  PID:10040
- C:\Windows\System\PbdMSRV.exe
  C:\Windows\System\PbdMSRV.exe
  2⤵
  PID:10100
- C:\Windows\System\unYtmib.exe
  C:\Windows\System\unYtmib.exe
  2⤵
  PID:10148
- C:\Windows\System\UdmJwFe.exe
  C:\Windows\System\UdmJwFe.exe
  2⤵
  PID:10164
- C:\Windows\System\xNIPrrN.exe
  C:\Windows\System\xNIPrrN.exe
  2⤵
  PID:8576
- C:\Windows\System\HKYAfpw.exe
  C:\Windows\System\HKYAfpw.exe
  2⤵
  PID:8608
- C:\Windows\System\pDkbGrs.exe
  C:\Windows\System\pDkbGrs.exe
  2⤵
  PID:9440
- C:\Windows\System\EbekHEB.exe
  C:\Windows\System\EbekHEB.exe
  2⤵
  PID:9800
- C:\Windows\System\NylIXkJ.exe
  C:\Windows\System\NylIXkJ.exe
  2⤵
  PID:10084
- C:\Windows\System\THxwhxi.exe
  C:\Windows\System\THxwhxi.exe
  2⤵
  PID:10016
- C:\Windows\System\FHFLghU.exe
  C:\Windows\System\FHFLghU.exe
  2⤵
  PID:9608
- C:\Windows\System\kHraSCC.exe
  C:\Windows\System\kHraSCC.exe
  2⤵
  PID:9816
- C:\Windows\System\AXwfaWO.exe
  C:\Windows\System\AXwfaWO.exe
  2⤵
  PID:9388
- C:\Windows\System\jPgRddA.exe
  C:\Windows\System\jPgRddA.exe
  2⤵
  PID:9556
- C:\Windows\System\Gtitfky.exe
  C:\Windows\System\Gtitfky.exe
  2⤵
  PID:10224
- C:\Windows\System\JbsYQQF.exe
  C:\Windows\System\JbsYQQF.exe
  2⤵
  PID:7952
- C:\Windows\System\EMJFrfh.exe
  C:\Windows\System\EMJFrfh.exe
  2⤵
  PID:8984
- C:\Windows\System\gZRrixS.exe
  C:\Windows\System\gZRrixS.exe
  2⤵
  PID:9312
- C:\Windows\System\WXNeXAx.exe
  C:\Windows\System\WXNeXAx.exe
  2⤵
  PID:9780
- C:\Windows\System\efqJTMK.exe
  C:\Windows\System\efqJTMK.exe
  2⤵
  PID:10212
- C:\Windows\System\FXRBYPx.exe
  C:\Windows\System\FXRBYPx.exe
  2⤵
  PID:10116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CxseAJu.exe

Filesize
1.2MB

MD5
125d514df8a462b6f96ead682bfc4aaf

SHA1
cc2d4cea011523c3d9071997fcc8ffd77b1ea2ed

SHA256
f4599708d0414e813abc2129685ed37a240536c11fa3e42c490123fa885ac868

SHA512
64bff950aee5821de74b95b94bb71db45eca670c53a770d3215726aa2426eb26493fa3a4c27b391bd4ab56b98f5c15eb9e5aad2d277b4a89f4443c3208ad3461

Download Submit
C:\Windows\system\DwqXSBz.exe

Filesize
1.2MB

MD5
cf14067697fa2a3e8821743ffe0b5578

SHA1
b7cf0591ad82e40365162368b0fb0a6403dcfe4c

SHA256
29f9553f3168e735da04730939dc04691143c2ceead797234415a8d92678cf49

SHA512
9c9e0abf0c1f7aa30eb6c1d988777831d4405003c041aa7825b65c39e90ca03b1c04049b3a5699d4066e0ea7d95f4df7cc49f6cf7ef7530b4c0ef8669ac5404b

Download Submit
C:\Windows\system\FwATYqC.exe

Filesize
1.2MB

MD5
ddd0e59fee428d763ba3001902476c7c

SHA1
eadee70dc027bd98ebed0758cd5cfab243467cb6

SHA256
87b0060e2f4384217ddf512e02694da25883fee9fc62bfed588b593e3281bdc7

SHA512
e7048bd0d2ecabb4b587c481fc0e7ae2735f56efdec827821f8cbfa7076e955fe0846b7b2dfd281f226d956dba87466ae3f660d747c904ab293b3cfc80257df0

Download Submit
C:\Windows\system\GPgPrRt.exe

Filesize
1.2MB

MD5
93cc3c5383c052986cf5dd069c2d08f0

SHA1
5ef87aceecdb85167ed10a229ac090caf144dd24

SHA256
2d66de7da633d0c3f11e945799517e5cd5c5ce703d22d7dbdc3801d29aa8d034

SHA512
4565554cb525faacc3d6474341122f4863b5eaf132d73f38ab57a9661dc52b975abc2057e914910d3d6fe28293057dd109902771fdc4253e510fa15aaf37d8c8

Download Submit
C:\Windows\system\HPmvnaP.exe

Filesize
1.2MB

MD5
0736aae31a5cb33fa340840355f95bff

SHA1
06ae2aaadfcf09d694c0675460c3e1438fa72b25

SHA256
913ef23cef684ebc236e45dd416032211e8f7ce1e71aec4cfc2e78c3ea3b61a2

SHA512
aa5a2c8588181bdeac3b6413eb1ea5331722e84c2c4ac61de8b60948a8de206d93bd63cee7572496a5d8ca863641c5f3666de31a214a9a62363f2f2582adc071

Download Submit
C:\Windows\system\PWTkOqT.exe

Filesize
1.2MB

MD5
9bae6e2a479f2ad55dcb2fcc3542cd13

SHA1
272c6756c889da70945e944146e403c6b2f43c3b

SHA256
e1176aa17f5f039454ff439fbbd6bc8b558da1884e4d62472384c68a6df38d6c

SHA512
f5e9e975d17a9c3c62f8ac9b9f029dbb4cc532a1235798e97c5cfed7905174d5bbb627d4f0fdd8e75b52aa4bfdf4c9833310af58c1f5ff40c02d855b2a8aba15

Download Submit
C:\Windows\system\QiMhwRt.exe

Filesize
1.2MB

MD5
013a49bfe165aae07ecd68ea6abe3096

SHA1
30842539b7f649c2ef71e9f318f542422b61b61a

SHA256
0b222f58401a0263575a950036e40faf4ddb3475f26198c4e1caaba4290c08c3

SHA512
837b8c195374ba5306684be6ec735f92a19a276f34410648e2c6f084c69f7a13c70dec04447578900198b95b620bd827f61e4047faad9eb3d1a37875533a5560

Download Submit
C:\Windows\system\ROfndyN.exe

Filesize
1.2MB

MD5
5eaaf349c63d53496aa25b4042a7a70d

SHA1
f493d30834f5a9dffb70cbeb43833edf0f66af72

SHA256
72b6edf1837896305a9619f7658b6d1f44af3a8e1f3145b39955ea4c9fe92225

SHA512
490065d6b31fbebab24130d11ff1a84e69bdfc625eb97be4be369d8e035165b3f5167a313867e8e637e57d54c9d002a236c33c24dedbf8b526f223d6e4fe076a

Download Submit
C:\Windows\system\SFSrsCJ.exe

Filesize
1.2MB

MD5
78f2d1bf44076242abb42adef67a2b79

SHA1
136c0951cb43d1d9e657948f368f1e250af0e04c

SHA256
8e1b45fe926a03eb445c39d358c08aa811ab48c67a6af3f5e89aff3525c5876e

SHA512
4107736ac7817cf6d34dab4f5d3d60a9d556253308047138a5fe55ebf8c387837ad599027f57de7652d4613f76e30ef8fe83a30d2908784325300ae36f162416

Download Submit
C:\Windows\system\Skvoqnj.exe

Filesize
1.2MB

MD5
0fb3ce38b5dd15fcb27ef32a01bfcf0b

SHA1
398420b5be2fb101ccde012e1e76c91d4bc75c6f

SHA256
03c12c50c6131231ce2e53146bad7acfb148c746f3620a44381949a85bd8e3f5

SHA512
6d865c860eaad8aeaf1cee618346094e6e778e24ca1634d71d068cabcdb8f3df164df067172cc892f64bdbd6a93804f7f42480af7eb89c7abdeb2e5b69fa9d49

Download Submit
C:\Windows\system\XABszUu.exe

Filesize
1.2MB

MD5
c436b75612fbd0e29803cdac7bb6d5a8

SHA1
e8fc4e65c0dcac13e1a51d5165700d3119df64e3

SHA256
de1a874c0708d6ec4997e70d93ebd844009b3511a82da61fd294408e279d4e22

SHA512
b9859cac5845141f53f24d1d13aec9f0fcff230911b4fa5bb5418bd1d0c297ac31efdfdabe25314515553b7ea1c790c6e8d464d83ce70cbf016bfb35deffab03

Download Submit
C:\Windows\system\XNrsZzE.exe

Filesize
1.2MB

MD5
aa881da122c3b45c367fae2a560746e7

SHA1
58286888f9596258554a1def3001519ddf24e790

SHA256
a31b42646c56abf0e8426a9efb6b78b2ed1a2daa1067288ecc20b7a06c1919fd

SHA512
f242443ecbde518bc613964653b6eda919fbe157ce01167fa5110ee486360f1031f060e748169e5a94ee2d5fbd51fd18d84ccebb747c7f282139f28ba4b5c2b2

Download Submit
C:\Windows\system\YeQhynl.exe

Filesize
1.2MB

MD5
d35e402330722c7732e3e2da14fd2ebc

SHA1
2b1ad6df863cc1af41e605b9e7b7e59fb428e50e

SHA256
de1c85265c838f3690e4d934dc2d862be50230dfd00d898946cc3b5fbb71def5

SHA512
c2147a61baf5ecc9c982a01688302315c3214b4788cf3dffe1c1e3602d2aa06307b54fef8168b84f715ada1efd64cce84e3e13a0e86662830d0705e2daccef53

Download Submit
C:\Windows\system\YzCDHTS.exe

Filesize
1.2MB

MD5
3ef8195a2920582b166555b501e74f24

SHA1
26e074019c12591522b552d7691481c04347f6ae

SHA256
5514f0cb2ae5ec7f885b3f5a2de2fe65f3bc1b1d41a1927d57362f9e299f7107

SHA512
d7a29f8f41b561a981eb3e0ad2ee93418e34a3140ead478c32c62b99f7aa45f4e8f031d89d7fb9eabec0083950adbcde70d6b9944ed367a733ce9d18e8b7adfb

Download Submit
C:\Windows\system\bPzywBL.exe

Filesize
1.2MB

MD5
5f3c3d0cb239c921805cd5a2a8e741af

SHA1
21a01245651e05527a497ec916279e4f005ad87a

SHA256
406a3a3c580dc7378a8352f7fa9eb2114cb67a89ea2eb2c7c92d9ae7692ffbf7

SHA512
67382ba389ae4d6af8f1b9a4f4f713ca2a464821efd19c57ca190c978eb3cbe8f0b860568812795fc8d4e35432566cb6231763df5f5a5e2e9ac97aef54251757

Download Submit
C:\Windows\system\ckGVnnf.exe

Filesize
1.2MB

MD5
ceda39763df22707476a2a92612c3af9

SHA1
e18aa1eda797ad534f1db8bc1c0ac3538c326cb9

SHA256
b4d90cc37541ee7267c62bae6d024403426fefef899d6ab7d97c63a782607c81

SHA512
957fa53a6e485572e59b77ce901edfc8cb86bb4284f1f1d692e733f1b91f6cd8513a4a4e309e620b05aa34bd2cff7859217a865bc522e5ec31cb7ba549ac7960

Download Submit
C:\Windows\system\kZmNtST.exe

Filesize
1.2MB

MD5
ffa262ae6b298b85003c139c6bef987a

SHA1
65252a043ccc045441a0a09972aaf82b5e8988ed

SHA256
16ca992794b2f60909c96f963d0dfd2411fe6f62835d816a7a1a5b00833e61c0

SHA512
571163da6bdb12a34af8337341e48266c2627e1778c688b349ea06fbb33fe2a967804e33cd4a7b5040997009cfe79e5f668062f0eec9558a8406d7d2ecdd77be

Download Submit
C:\Windows\system\mUmYyfn.exe

Filesize
1.2MB

MD5
7ed0d13dd84b2c1ddfba4519e2099b6c

SHA1
1bf073bd7945c9a913c7a93155ce4f00095c3eb0

SHA256
0fd459ffa8777117362dda11910ca3654238c98b30ccc60e7d15a1b05a9e233c

SHA512
78a6911d3b644debae5792dd16fb63bfe8eb30e0bdb4ad2de523247e39085904acc780d65977859d08b2d210a0317d2858cfeb9a8d8cf312d4533c1bcf2ff836

Download Submit
C:\Windows\system\obMJatm.exe

Filesize
1.2MB

MD5
64e0b497a7764122214105d13f2c40ca

SHA1
db85080dcb9dedd0d71cae8434b5990040ecd726

SHA256
1ea3a69802d9f67efe6ae6cb4ffa3e157e8d01756ce9ecffeeaf6ef2a4ff16a7

SHA512
32e5b261969c897bdf3dbcffdd5d87c8a222ad7a7353d13465c752d136b04c3d1aeb77e31288f9cb0009abc97168c92c294183c97e7f413b9fab826dcbd79be8

Download Submit
C:\Windows\system\ppeEQqN.exe

Filesize
1.2MB

MD5
00f7a5d14b88137faed5eb39e5f91239

SHA1
469dc3428b3cc1c8960a7dda10232d10c2d36ece

SHA256
5d0a7c0c39539c487b9b00635905cb18ff03c1665acdb050d8dc3b99db44ad31

SHA512
5fb9c6f8cef3f804a062680882f3c166d9eed1e0c1edfe669e99ab8d9c014d293d291e2ca5383172217df7f27db4ef6f8f90d6f6d892e091e071041b964d5844

Download Submit
C:\Windows\system\qYKaANi.exe

Filesize
1.2MB

MD5
498934d24177011a4dab223301f0c616

SHA1
fda761d3ade3528bcb1fe1cca6426a0fcd90561b

SHA256
1c611661ecc68bbae64bbe81706c4222cbb65acd96038f3e5dfd49d55f8c09a4

SHA512
befd790a098516ff11b826bf8efa67b2333fd8a9b8b7fa97db4e8c476019dc9cfe631660127abbb8ac58d06700f55729a5fbbb3d0c2a5a862e596412eef57a01

Download Submit
C:\Windows\system\rnSijDP.exe

Filesize
1.2MB

MD5
1be652e3d03b4e9377cb118010b0da43

SHA1
478054c0c5e74bcd154ddfed83be66cd2645496b

SHA256
2fa0a80d473350a508e5ef207aa525dd200b78bd7e47cba2be78816227130afc

SHA512
1cb1348e6578c93a9a083d6012a3607ecc030a1b9706f3d192f11572282fc5b852eef53d6233413ec0429bcdb5ea04bc6b5d9d0b48375343af34c6d070f4b551

Download Submit
C:\Windows\system\ucIwYLo.exe

Filesize
1.2MB

MD5
f24b128f7428f7898a81e25421813954

SHA1
c0d5210b9044fa719ad721351d8a86b67b0b5470

SHA256
c2a4263d819b8d4cb10402f012d0848a1a1bbbd9aea3743d118e6c86e376b827

SHA512
4e6b6a246ee3629f6c6c80323be14bde5d7472b050e559de578a1d42773aa91a1371be36379ac5db8fc3d32e66f8de2a84977ba373c908ec833e294873652db4

Download Submit
C:\Windows\system\uhgMwJp.exe

Filesize
1.2MB

MD5
c09abfefad4ef78f69728e13ba690f11

SHA1
f571099008b920fe0cd35f454126ec5012fde042

SHA256
d5ebc3197e83645453f422d4657c7dce835bc2a147ada40172a72c51b0f3fd51

SHA512
f7b0556302736e13bdc5a627d8c4eb37ebc7fd9b183550609b98f8d00aac6ab424ecfd290e1abe7558ae59cab0df2fc67921a46649abe559fce22d1a0762ed5b

Download Submit
C:\Windows\system\uyEcNOg.exe

Filesize
1.2MB

MD5
44fac7d11ee9f3073509731a452168ff

SHA1
618595fce4543ad714c64f4c927a344eab8eb191

SHA256
96e9ce06008d1165cd2feb32c73aac79a57061db12621e2b7a59a649184354ae

SHA512
2b04c36572b864d88dbad8265b491ac6b9cd143724ced366833ca241e1ad7dbc901885824fc3b2c35bd996b3574d47cab980e2279b42ce873097b9b02bf2c8ef

Download Submit
C:\Windows\system\vrbljbY.exe

Filesize
1.2MB

MD5
1d360640434fef085108a2380080047c

SHA1
1e7ff22003429a821a31e751de65f30db4306494

SHA256
4d0bd1ed08dee3372bbe816dcad7b0956800b5cc0037d34de7f27c92fba9af9d

SHA512
ca7eb8b6942a9ce08b01dd9b6b5554a591faacc9a0ae78cc04f0ed61812176a6a71cec2b79dfd550dabd712c4bcd4095ae830c8c8afe796a1b0343eef38ddc06

Download Submit
C:\Windows\system\wBZfdod.exe

Filesize
1.2MB

MD5
92b42dc3c1442dcf9db3bd2b79528e35

SHA1
cbf8ce8d464e167f2dba90915252e165093d4728

SHA256
e2834923a858c54be24651ad8549829feda6982f2413af11d7953d79a052254d

SHA512
2cd6eb4735e438845f785cd07451fdae388307218db31afe614cc773f9caec166c325f4e0d5713f337a250d3a8b65d238d3c0b2adb8d753216cb892578d81900

Download Submit
C:\Windows\system\wUcptlO.exe

Filesize
1.2MB

MD5
87fb81c7d0298d4e83c53ff0df50a921

SHA1
55f6b1deb2cfcfa0d53c1f6fa2235e4b0fc1b5f0

SHA256
698813ac52a1390b27370ecff41b1e1cffa265645650639451a8d381c5126ea6

SHA512
3c782b7b1ce70f226dc96d8b14cc667e1a47cb1247305139025e583e915ec4c59a8488e898ebcaf4f9961bf2b85a9d3f1d489c502e705b209b9f168fed161b04

Download Submit
C:\Windows\system\wwbsaQv.exe

Filesize
1.2MB

MD5
0e76c18c6c772a34ce4a40f8066acb40

SHA1
1a0e831d81aa304cc4f3246dc5ead235120daee9

SHA256
48fe778ff4695529ee7cc245d073e7fa3715b86689d8cd135137af4c21d07062

SHA512
57cd0b5e2b962869be853b479c17400f16684adce7e2ba1ddb7003e2cdcd8e4c0b6c0762d59088c1ef19ed353e69d2e7234c71122702658cc92aa8f9ed8f1b1d

Download Submit
C:\Windows\system\yiwNfdF.exe

Filesize
1.2MB

MD5
b4aaa9a57f6c2316e97652aeee5c5f1a

SHA1
ec446e456e1e4025cbaa3e4b9a298866c3532b39

SHA256
d9774978d52484dd82eaf96b501ecab005cfe040725e4aecda7767a2d1ccbd83

SHA512
265dab2bf8adbd5a9798303acd1ebe122d13e00be389447f519ae5c2c57b9bd8b348c2cb6e8f7b1bbc3a54eff0a5f7f0937de393b83fb57cfe771a6d982ce779

Download Submit
C:\Windows\system\zWQDcPG.exe

Filesize
1.2MB

MD5
c6c5f7dbdf615d22c0083d127c25626d

SHA1
ce8f6cec53f7c75e111a55f061cb5126c4481f8d

SHA256
84eeadb48979262d68a857959551e314c0ad287839b19307c1c309ff8f38055f

SHA512
35ebe8a859406906c2a939c0e330352fab555766377f0b9093d7e6d2f1614c86ebf7b1b399bdff5619c0b329199aa85f251e51a9d09734a64b8ee9502375c9bf

Download Submit
\Windows\system\nGkIqUR.exe

Filesize
1.2MB

MD5
fa1d0631c2b82c36367fd638014b5d83

SHA1
cfd56857e6b3ba5d04cda1bac07bcae784fc7784

SHA256
fd5d3f148613c2735ef1662cdb656d2b35d644750308ebe6b18e8c2130f5cf55

SHA512
ad16f95a24666590fa2aeec66d4f9bfca37881984bacc69270480605edb9dabed65f5da7a896ea11ff7b8dbbc6a85f1a325fa4cb3909aa5aefa33529af79e523

Download Submit
memory/2008-242-0x000000013F850000-0x000000013FC42000-memory.dmp

Filesize
3.9MB

Download
memory/2064-579-0x000000013F3E0000-0x000000013F7D2000-memory.dmp

Filesize
3.9MB

Download
memory/2064-8-0x0000000002E10000-0x0000000003202000-memory.dmp

Filesize
3.9MB

Download
memory/2064-246-0x000000013F1D0000-0x000000013F5C2000-memory.dmp

Filesize
3.9MB

Download
memory/2064-9773-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/2064-0-0x0000000000580000-0x0000000000590000-memory.dmp

Filesize
64KB

Download
memory/2064-243-0x0000000003400000-0x00000000037F2000-memory.dmp

Filesize
3.9MB

Download
memory/2064-1-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/2064-241-0x0000000003400000-0x00000000037F2000-memory.dmp

Filesize
3.9MB

Download
memory/2064-584-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download
memory/2064-426-0x0000000003400000-0x00000000037F2000-memory.dmp

Filesize
3.9MB

Download
memory/2064-424-0x0000000003400000-0x00000000037F2000-memory.dmp

Filesize
3.9MB

Download
memory/2064-422-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/2064-420-0x0000000003400000-0x00000000037F2000-memory.dmp

Filesize
3.9MB

Download
memory/2064-418-0x000000013FD60000-0x0000000140152000-memory.dmp

Filesize
3.9MB

Download
memory/2280-618-0x000007FEF42A0000-0x000007FEF4C3D000-memory.dmp

Filesize
9.6MB

Download
memory/2280-236-0x000007FEF42A0000-0x000007FEF4C3D000-memory.dmp

Filesize
9.6MB

Download
memory/2280-248-0x00000000029A0000-0x00000000029A8000-memory.dmp

Filesize
32KB

Download
memory/2280-232-0x0000000002810000-0x0000000002890000-memory.dmp

Filesize
512KB

Download
memory/2280-233-0x000007FEF455E000-0x000007FEF455F000-memory.dmp

Filesize
4KB

Download
memory/2280-53-0x000000001B540000-0x000000001B822000-memory.dmp

Filesize
2.9MB

Download
memory/2380-6035-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download
memory/2380-599-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download
memory/2408-580-0x000000013F3E0000-0x000000013F7D2000-memory.dmp

Filesize
3.9MB

Download
memory/2408-5933-0x000000013F3E0000-0x000000013F7D2000-memory.dmp

Filesize
3.9MB

Download
memory/2604-6030-0x000000013F830000-0x000000013FC22000-memory.dmp

Filesize
3.9MB

Download
memory/2604-244-0x000000013F830000-0x000000013FC22000-memory.dmp

Filesize
3.9MB

Download
memory/2632-6039-0x000000013F6D0000-0x000000013FAC2000-memory.dmp

Filesize
3.9MB

Download
memory/2632-427-0x000000013F6D0000-0x000000013FAC2000-memory.dmp

Filesize
3.9MB

Download
memory/2636-231-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/2684-425-0x000000013F720000-0x000000013FB12000-memory.dmp

Filesize
3.9MB

Download
memory/2816-238-0x000000013FE30000-0x0000000140222000-memory.dmp

Filesize
3.9MB

Download
memory/2816-6037-0x000000013FE30000-0x0000000140222000-memory.dmp

Filesize
3.9MB

Download
memory/2828-5929-0x000000013FB60000-0x000000013FF52000-memory.dmp

Filesize
3.9MB

Download
memory/2828-421-0x000000013FB60000-0x000000013FF52000-memory.dmp

Filesize
3.9MB

Download
memory/2932-419-0x000000013FD60000-0x0000000140152000-memory.dmp

Filesize
3.9MB

Download
memory/2932-6031-0x000000013FD60000-0x0000000140152000-memory.dmp

Filesize
3.9MB

Download
memory/2944-423-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/2944-6033-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/3032-5893-0x000000013F1D0000-0x000000013F5C2000-memory.dmp

Filesize
3.9MB

Download
memory/3032-417-0x000000013F1D0000-0x000000013F5C2000-memory.dmp

Filesize
3.9MB

Download