xmrig | 695acc56d6a395dc91e0d52b50d6af2ce5aee2d34d7997b3a3797f82f8a075c2

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
06/08/2024, 09:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
Size

1.8MB
MD5

8d1ecfb1e8ed3582813a16c68f8ffb00
SHA1

184ce6f94725cf9fa0027a60f6cd04014982edd4
SHA256

695acc56d6a395dc91e0d52b50d6af2ce5aee2d34d7997b3a3797f82f8a075c2
SHA512

7369458ed7836be5df259a45e8b4a12445874bd06bc5d76cfcac1dc334d0b1cc8404c9647b3d7713e0e412ad4d98886acc31f188bd4313978276c702ccff8072
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkFfkeMlNIZbElhzBXeCnfJCwCvHMJs2+fKOhO6nFy0:Lz071uv4BPMkFfdgIZohteLPCsXH00

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 15 IoCs

miner

resource	yara_rule
behavioral1/memory/804-30-0x000000013F230000-0x000000013F622000-memory.dmp	xmrig
behavioral1/memory/2648-117-0x000000013F710000-0x000000013FB02000-memory.dmp	xmrig
behavioral1/memory/1800-116-0x000000013FA00000-0x000000013FDF2000-memory.dmp	xmrig
behavioral1/memory/1952-115-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	xmrig
behavioral1/memory/2720-112-0x000000013F050000-0x000000013F442000-memory.dmp	xmrig
behavioral1/memory/2580-111-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	xmrig
behavioral1/memory/2292-106-0x0000000003100000-0x00000000034F2000-memory.dmp	xmrig
behavioral1/memory/2748-105-0x000000013F370000-0x000000013F762000-memory.dmp	xmrig
behavioral1/memory/2648-6042-0x000000013F710000-0x000000013FB02000-memory.dmp	xmrig
behavioral1/memory/2580-6043-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	xmrig
behavioral1/memory/804-6046-0x000000013F230000-0x000000013F622000-memory.dmp	xmrig
behavioral1/memory/1800-6053-0x000000013FA00000-0x000000013FDF2000-memory.dmp	xmrig
behavioral1/memory/2748-6055-0x000000013F370000-0x000000013F762000-memory.dmp	xmrig
behavioral1/memory/2720-6044-0x000000013F050000-0x000000013F442000-memory.dmp	xmrig
behavioral1/memory/1952-6058-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3044	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
804	fbYCBhA.exe
1952	FjFdJdk.exe
1800	cWUXDTc.exe
2648	Nxbehpi.exe
2748	PmqbHcB.exe
2580	eWAPBSs.exe
2720	wuMlcBq.exe
2556	glJiNYC.exe
3016	KxKfKjP.exe
1480	tQMBvQg.exe
2052	bkVTyfW.exe
2228	WWFvCzG.exe
2012	VixiaFR.exe
2756	EtgsIVs.exe
2552	ckISizd.exe
2632	FQhkHfw.exe
1980	njEvbHg.exe
2596	OlKMbgc.exe
2272	QwIUkyP.exe
1660	ImwCpPU.exe
2028	TNgtqOt.exe
1740	dQhelkt.exe
1296	NJtFuyT.exe
2404	iFMFBdk.exe
2524	OMUXmZh.exe
820	PjCuPwH.exe
1712	ZKAtMUo.exe
2512	vSoewTY.exe
2528	YolHJzH.exe
2184	hdFXwaF.exe
2400	Ipkfech.exe
1524	TbMoUPa.exe
2612	AZagijx.exe
1700	LAxfGiM.exe
696	GtBmeSi.exe
1664	orPfhTN.exe
2116	HxISqEL.exe
2936	STXSqmM.exe
844	dTkvviw.exe
2484	swISCdy.exe
2892	WdeyOoP.exe
580	XTAPTiO.exe
296	MNjTYiW.exe
1748	mGecsDV.exe
1752	sbEgLbt.exe
372	YLCGPJD.exe
1572	JRVGHPL.exe
864	TYQvrNH.exe
2688	RggrELC.exe
2576	UphumES.exe
112	SKbjPgG.exe
2320	PEkIWhq.exe
1144	LHFddoW.exe
1672	LFmQBbl.exe
2584	sHlGyTz.exe
2852	opvMxUj.exe
1580	KETolkn.exe
2728	ZLmYDAx.exe
2856	uwtfFSb.exe
1192	zslgeVv.exe
2708	ckFNikO.exe
2980	kHGsNPr.exe
1972	qpobxpH.exe
2372	HpVlkgg.exe

Loads dropped DLL 64 IoCs

pid	Process
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe

UPX packed file 47 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2292-0-0x000000013F600000-0x000000013F9F2000-memory.dmp	upx
behavioral1/files/0x0007000000016d3a-14.dat	upx
behavioral1/files/0x0008000000016d2a-12.dat	upx
behavioral1/files/0x0008000000016d21-7.dat	upx
behavioral1/files/0x000f00000001227f-6.dat	upx
behavioral1/memory/804-30-0x000000013F230000-0x000000013F622000-memory.dmp	upx
behavioral1/files/0x0009000000016d56-27.dat	upx
behavioral1/files/0x0007000000016d43-20.dat	upx
behavioral1/files/0x000500000001872e-45.dat	upx
behavioral1/files/0x000500000001927e-80.dat	upx
behavioral1/files/0x0005000000019372-130.dat	upx
behavioral1/files/0x000f0000000054a8-144.dat	upx
behavioral1/files/0x0005000000019431-154.dat	upx
behavioral1/files/0x0005000000019456-163.dat	upx
behavioral1/files/0x00050000000194ab-173.dat	upx
behavioral1/files/0x00050000000194e7-183.dat	upx
behavioral1/files/0x00050000000194b9-178.dat	upx
behavioral1/files/0x000500000001948a-168.dat	upx
behavioral1/files/0x000500000001944b-158.dat	upx
behavioral1/files/0x000600000001941e-147.dat	upx
behavioral1/files/0x000600000001902b-126.dat	upx
behavioral1/files/0x0006000000018bcd-124.dat	upx
behavioral1/files/0x0006000000018b00-122.dat	upx
behavioral1/files/0x0005000000018736-120.dat	upx
behavioral1/files/0x000500000001872a-119.dat	upx
behavioral1/memory/2648-117-0x000000013F710000-0x000000013FB02000-memory.dmp	upx
behavioral1/memory/1800-116-0x000000013FA00000-0x000000013FDF2000-memory.dmp	upx
behavioral1/memory/1952-115-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	upx
behavioral1/memory/2720-112-0x000000013F050000-0x000000013F442000-memory.dmp	upx
behavioral1/memory/2580-111-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	upx
behavioral1/memory/2748-105-0x000000013F370000-0x000000013F762000-memory.dmp	upx
behavioral1/files/0x0008000000016d67-104.dat	upx
behavioral1/files/0x000500000001938f-139.dat	upx
behavioral1/files/0x0007000000016d4b-100.dat	upx
behavioral1/files/0x0005000000019354-97.dat	upx
behavioral1/files/0x000500000001927c-93.dat	upx
behavioral1/files/0x0006000000018bd2-91.dat	upx
behavioral1/files/0x0006000000018b83-90.dat	upx
behavioral1/files/0x000600000001871e-57.dat	upx
behavioral1/files/0x0005000000018780-70.dat	upx
behavioral1/memory/2648-6042-0x000000013F710000-0x000000013FB02000-memory.dmp	upx
behavioral1/memory/2580-6043-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	upx
behavioral1/memory/804-6046-0x000000013F230000-0x000000013F622000-memory.dmp	upx
behavioral1/memory/1800-6053-0x000000013FA00000-0x000000013FDF2000-memory.dmp	upx
behavioral1/memory/2748-6055-0x000000013F370000-0x000000013F762000-memory.dmp	upx
behavioral1/memory/2720-6044-0x000000013F050000-0x000000013F442000-memory.dmp	upx
behavioral1/memory/1952-6058-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\VabvZme.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\KAzoOBs.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\jSEibND.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\ebOKJsJ.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\oWTxDax.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\HxISqEL.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\bGdZJOE.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\LikLcLX.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\bVkfbOq.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\sDMzVso.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\aoTmwOa.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\YEAqNFi.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\jhVAIla.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\dWMAXOb.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\NVNSHmI.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\KMYpKkA.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\NIvfyOp.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\ewZKZHA.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\xyOknIR.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\ajBorpk.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\RhrbhEv.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\EIBLdfP.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\ObTnpMD.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\RMOCYuL.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\pphTIAv.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\jEyPZye.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\LvsZuma.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\ctvFWun.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\OXxiyFb.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\rszdHOX.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\AqvrDzl.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\WdeyOoP.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\WufaFwB.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\tlUdtfN.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\zeCCTND.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\YIlYzRA.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\VFLynXX.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\XVndLNw.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\HRTRBGc.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\ChckirS.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\SGqZkyN.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\VdTsVNv.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\BSBrbaV.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\ipwwFeI.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\wqhwMwt.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\tATbgLx.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\dzjZtZy.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\ZRbwXqZ.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\iiPUhFS.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\nAtkYcQ.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\TcGPIed.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\DocOmqz.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\YYaGCCB.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\rgKnLRn.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\MpuQWvm.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\FxWZUeM.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\ZONqlut.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\MllooTz.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\NMnpIur.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\VmwDTWk.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\FAfTigg.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\StlvrYp.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\wOqxGgF.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
File created	C:\Windows\System\mbaIUfa.exe	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3044	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
Token: SeLockMemoryPrivilege	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
Token: SeDebugPrivilege	3044	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 3044	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	32
PID 2292 wrote to memory of 3044	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	32
PID 2292 wrote to memory of 3044	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	32
PID 2292 wrote to memory of 804	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	33
PID 2292 wrote to memory of 804	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	33
PID 2292 wrote to memory of 804	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	33
PID 2292 wrote to memory of 1952	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	34
PID 2292 wrote to memory of 1952	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	34
PID 2292 wrote to memory of 1952	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	34
PID 2292 wrote to memory of 1800	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	35
PID 2292 wrote to memory of 1800	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	35
PID 2292 wrote to memory of 1800	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	35
PID 2292 wrote to memory of 2228	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	36
PID 2292 wrote to memory of 2228	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	36
PID 2292 wrote to memory of 2228	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	36
PID 2292 wrote to memory of 2648	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	37
PID 2292 wrote to memory of 2648	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	37
PID 2292 wrote to memory of 2648	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	37
PID 2292 wrote to memory of 2756	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	38
PID 2292 wrote to memory of 2756	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	38
PID 2292 wrote to memory of 2756	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	38
PID 2292 wrote to memory of 2748	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	39
PID 2292 wrote to memory of 2748	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	39
PID 2292 wrote to memory of 2748	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	39
PID 2292 wrote to memory of 2552	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	40
PID 2292 wrote to memory of 2552	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	40
PID 2292 wrote to memory of 2552	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	40
PID 2292 wrote to memory of 2580	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	41
PID 2292 wrote to memory of 2580	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	41
PID 2292 wrote to memory of 2580	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	41
PID 2292 wrote to memory of 2632	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	42
PID 2292 wrote to memory of 2632	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	42
PID 2292 wrote to memory of 2632	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	42
PID 2292 wrote to memory of 2720	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	43
PID 2292 wrote to memory of 2720	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	43
PID 2292 wrote to memory of 2720	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	43
PID 2292 wrote to memory of 1980	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	44
PID 2292 wrote to memory of 1980	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	44
PID 2292 wrote to memory of 1980	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	44
PID 2292 wrote to memory of 2556	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	45
PID 2292 wrote to memory of 2556	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	45
PID 2292 wrote to memory of 2556	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	45
PID 2292 wrote to memory of 2596	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	46
PID 2292 wrote to memory of 2596	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	46
PID 2292 wrote to memory of 2596	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	46
PID 2292 wrote to memory of 3016	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	47
PID 2292 wrote to memory of 3016	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	47
PID 2292 wrote to memory of 3016	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	47
PID 2292 wrote to memory of 2272	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	48
PID 2292 wrote to memory of 2272	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	48
PID 2292 wrote to memory of 2272	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	48
PID 2292 wrote to memory of 1480	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	49
PID 2292 wrote to memory of 1480	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	49
PID 2292 wrote to memory of 1480	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	49
PID 2292 wrote to memory of 1660	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	50
PID 2292 wrote to memory of 1660	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	50
PID 2292 wrote to memory of 1660	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	50
PID 2292 wrote to memory of 2052	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	51
PID 2292 wrote to memory of 2052	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	51
PID 2292 wrote to memory of 2052	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	51
PID 2292 wrote to memory of 2028	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	52
PID 2292 wrote to memory of 2028	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	52
PID 2292 wrote to memory of 2028	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	52
PID 2292 wrote to memory of 2012	2292	8d1ecfb1e8ed3582813a16c68f8ffb00N.exe	53

C:\Users\Admin\AppData\Local\Temp\8d1ecfb1e8ed3582813a16c68f8ffb00N.exe
"C:\Users\Admin\AppData\Local\Temp\8d1ecfb1e8ed3582813a16c68f8ffb00N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3044
- C:\Windows\System\fbYCBhA.exe
  C:\Windows\System\fbYCBhA.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\FjFdJdk.exe
  C:\Windows\System\FjFdJdk.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\cWUXDTc.exe
  C:\Windows\System\cWUXDTc.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\WWFvCzG.exe
  C:\Windows\System\WWFvCzG.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\Nxbehpi.exe
  C:\Windows\System\Nxbehpi.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\EtgsIVs.exe
  C:\Windows\System\EtgsIVs.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\PmqbHcB.exe
  C:\Windows\System\PmqbHcB.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\ckISizd.exe
  C:\Windows\System\ckISizd.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\eWAPBSs.exe
  C:\Windows\System\eWAPBSs.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\FQhkHfw.exe
  C:\Windows\System\FQhkHfw.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\wuMlcBq.exe
  C:\Windows\System\wuMlcBq.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\njEvbHg.exe
  C:\Windows\System\njEvbHg.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\glJiNYC.exe
  C:\Windows\System\glJiNYC.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\OlKMbgc.exe
  C:\Windows\System\OlKMbgc.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\KxKfKjP.exe
  C:\Windows\System\KxKfKjP.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\QwIUkyP.exe
  C:\Windows\System\QwIUkyP.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\tQMBvQg.exe
  C:\Windows\System\tQMBvQg.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\ImwCpPU.exe
  C:\Windows\System\ImwCpPU.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\bkVTyfW.exe
  C:\Windows\System\bkVTyfW.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\TNgtqOt.exe
  C:\Windows\System\TNgtqOt.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\VixiaFR.exe
  C:\Windows\System\VixiaFR.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\dQhelkt.exe
  C:\Windows\System\dQhelkt.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\NJtFuyT.exe
  C:\Windows\System\NJtFuyT.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\iFMFBdk.exe
  C:\Windows\System\iFMFBdk.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\OMUXmZh.exe
  C:\Windows\System\OMUXmZh.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\PjCuPwH.exe
  C:\Windows\System\PjCuPwH.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\ZKAtMUo.exe
  C:\Windows\System\ZKAtMUo.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\vSoewTY.exe
  C:\Windows\System\vSoewTY.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\YolHJzH.exe
  C:\Windows\System\YolHJzH.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\hdFXwaF.exe
  C:\Windows\System\hdFXwaF.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\Ipkfech.exe
  C:\Windows\System\Ipkfech.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\TbMoUPa.exe
  C:\Windows\System\TbMoUPa.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\AZagijx.exe
  C:\Windows\System\AZagijx.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\LAxfGiM.exe
  C:\Windows\System\LAxfGiM.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\GtBmeSi.exe
  C:\Windows\System\GtBmeSi.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\orPfhTN.exe
  C:\Windows\System\orPfhTN.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\HxISqEL.exe
  C:\Windows\System\HxISqEL.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\STXSqmM.exe
  C:\Windows\System\STXSqmM.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\dTkvviw.exe
  C:\Windows\System\dTkvviw.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\swISCdy.exe
  C:\Windows\System\swISCdy.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\WdeyOoP.exe
  C:\Windows\System\WdeyOoP.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\XTAPTiO.exe
  C:\Windows\System\XTAPTiO.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\MNjTYiW.exe
  C:\Windows\System\MNjTYiW.exe
  2⤵
  - Executes dropped EXE
  PID:296
- C:\Windows\System\mGecsDV.exe
  C:\Windows\System\mGecsDV.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\sbEgLbt.exe
  C:\Windows\System\sbEgLbt.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\YLCGPJD.exe
  C:\Windows\System\YLCGPJD.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\JRVGHPL.exe
  C:\Windows\System\JRVGHPL.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\KETolkn.exe
  C:\Windows\System\KETolkn.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\TYQvrNH.exe
  C:\Windows\System\TYQvrNH.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\ZLmYDAx.exe
  C:\Windows\System\ZLmYDAx.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\RggrELC.exe
  C:\Windows\System\RggrELC.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\uwtfFSb.exe
  C:\Windows\System\uwtfFSb.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\UphumES.exe
  C:\Windows\System\UphumES.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\zslgeVv.exe
  C:\Windows\System\zslgeVv.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\SKbjPgG.exe
  C:\Windows\System\SKbjPgG.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\ckFNikO.exe
  C:\Windows\System\ckFNikO.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\PEkIWhq.exe
  C:\Windows\System\PEkIWhq.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\kHGsNPr.exe
  C:\Windows\System\kHGsNPr.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\LHFddoW.exe
  C:\Windows\System\LHFddoW.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\qpobxpH.exe
  C:\Windows\System\qpobxpH.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\LFmQBbl.exe
  C:\Windows\System\LFmQBbl.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\HpVlkgg.exe
  C:\Windows\System\HpVlkgg.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\sHlGyTz.exe
  C:\Windows\System\sHlGyTz.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\NyFPAFV.exe
  C:\Windows\System\NyFPAFV.exe
  2⤵
  PID:1036
- C:\Windows\System\opvMxUj.exe
  C:\Windows\System\opvMxUj.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\YeFVKJM.exe
  C:\Windows\System\YeFVKJM.exe
  2⤵
  PID:1332
- C:\Windows\System\ixOSUHw.exe
  C:\Windows\System\ixOSUHw.exe
  2⤵
  PID:1340
- C:\Windows\System\UIdRvvh.exe
  C:\Windows\System\UIdRvvh.exe
  2⤵
  PID:1724
- C:\Windows\System\jgUiOIY.exe
  C:\Windows\System\jgUiOIY.exe
  2⤵
  PID:1048
- C:\Windows\System\OvhlDwf.exe
  C:\Windows\System\OvhlDwf.exe
  2⤵
  PID:108
- C:\Windows\System\IusdcCP.exe
  C:\Windows\System\IusdcCP.exe
  2⤵
  PID:2500
- C:\Windows\System\chqMfcx.exe
  C:\Windows\System\chqMfcx.exe
  2⤵
  PID:2232
- C:\Windows\System\pCELpfo.exe
  C:\Windows\System\pCELpfo.exe
  2⤵
  PID:1304
- C:\Windows\System\wOjEjGF.exe
  C:\Windows\System\wOjEjGF.exe
  2⤵
  PID:2380
- C:\Windows\System\QLJQitC.exe
  C:\Windows\System\QLJQitC.exe
  2⤵
  PID:2188
- C:\Windows\System\plzCvBO.exe
  C:\Windows\System\plzCvBO.exe
  2⤵
  PID:2276
- C:\Windows\System\rxQGJVy.exe
  C:\Windows\System\rxQGJVy.exe
  2⤵
  PID:2984
- C:\Windows\System\xLryuUv.exe
  C:\Windows\System\xLryuUv.exe
  2⤵
  PID:2240
- C:\Windows\System\EAzERRI.exe
  C:\Windows\System\EAzERRI.exe
  2⤵
  PID:748
- C:\Windows\System\TJKJbkQ.exe
  C:\Windows\System\TJKJbkQ.exe
  2⤵
  PID:2256
- C:\Windows\System\BIEuiUA.exe
  C:\Windows\System\BIEuiUA.exe
  2⤵
  PID:2656
- C:\Windows\System\eaFfWOd.exe
  C:\Windows\System\eaFfWOd.exe
  2⤵
  PID:2824
- C:\Windows\System\PmdCGBe.exe
  C:\Windows\System\PmdCGBe.exe
  2⤵
  PID:1668
- C:\Windows\System\yXnhZhr.exe
  C:\Windows\System\yXnhZhr.exe
  2⤵
  PID:2464
- C:\Windows\System\WdSrSCj.exe
  C:\Windows\System\WdSrSCj.exe
  2⤵
  PID:1136
- C:\Windows\System\qEjZktW.exe
  C:\Windows\System\qEjZktW.exe
  2⤵
  PID:1788
- C:\Windows\System\CNtjEGP.exe
  C:\Windows\System\CNtjEGP.exe
  2⤵
  PID:1244
- C:\Windows\System\xgGJSqZ.exe
  C:\Windows\System\xgGJSqZ.exe
  2⤵
  PID:872
- C:\Windows\System\hvaGDQe.exe
  C:\Windows\System\hvaGDQe.exe
  2⤵
  PID:1384
- C:\Windows\System\PzxZtPO.exe
  C:\Windows\System\PzxZtPO.exe
  2⤵
  PID:2352
- C:\Windows\System\RkHaLIW.exe
  C:\Windows\System\RkHaLIW.exe
  2⤵
  PID:1964
- C:\Windows\System\powycrb.exe
  C:\Windows\System\powycrb.exe
  2⤵
  PID:2044
- C:\Windows\System\ytlEVns.exe
  C:\Windows\System\ytlEVns.exe
  2⤵
  PID:2356
- C:\Windows\System\tenEPNm.exe
  C:\Windows\System\tenEPNm.exe
  2⤵
  PID:1760
- C:\Windows\System\dnCvdbc.exe
  C:\Windows\System\dnCvdbc.exe
  2⤵
  PID:288
- C:\Windows\System\tAmdGcD.exe
  C:\Windows\System\tAmdGcD.exe
  2⤵
  PID:2204
- C:\Windows\System\RzwiSxU.exe
  C:\Windows\System\RzwiSxU.exe
  2⤵
  PID:2488
- C:\Windows\System\LENPWSo.exe
  C:\Windows\System\LENPWSo.exe
  2⤵
  PID:2940
- C:\Windows\System\twfSubb.exe
  C:\Windows\System\twfSubb.exe
  2⤵
  PID:464
- C:\Windows\System\aDbFYLQ.exe
  C:\Windows\System\aDbFYLQ.exe
  2⤵
  PID:2884
- C:\Windows\System\IOvqjiU.exe
  C:\Windows\System\IOvqjiU.exe
  2⤵
  PID:1684
- C:\Windows\System\kwbGmmz.exe
  C:\Windows\System\kwbGmmz.exe
  2⤵
  PID:552
- C:\Windows\System\MtzzLdI.exe
  C:\Windows\System\MtzzLdI.exe
  2⤵
  PID:1516
- C:\Windows\System\AdmtRHy.exe
  C:\Windows\System\AdmtRHy.exe
  2⤵
  PID:976
- C:\Windows\System\rFvPFDN.exe
  C:\Windows\System\rFvPFDN.exe
  2⤵
  PID:2904
- C:\Windows\System\ZSeOQAJ.exe
  C:\Windows\System\ZSeOQAJ.exe
  2⤵
  PID:2616
- C:\Windows\System\jfFgaVN.exe
  C:\Windows\System\jfFgaVN.exe
  2⤵
  PID:1084
- C:\Windows\System\ahCdLKd.exe
  C:\Windows\System\ahCdLKd.exe
  2⤵
  PID:1348
- C:\Windows\System\NbTwWlC.exe
  C:\Windows\System\NbTwWlC.exe
  2⤵
  PID:2164
- C:\Windows\System\mpYIYkE.exe
  C:\Windows\System\mpYIYkE.exe
  2⤵
  PID:2600
- C:\Windows\System\TvpiklU.exe
  C:\Windows\System\TvpiklU.exe
  2⤵
  PID:2444
- C:\Windows\System\kTHrVkO.exe
  C:\Windows\System\kTHrVkO.exe
  2⤵
  PID:2972
- C:\Windows\System\PcWEnlC.exe
  C:\Windows\System\PcWEnlC.exe
  2⤵
  PID:3036
- C:\Windows\System\xruybRT.exe
  C:\Windows\System\xruybRT.exe
  2⤵
  PID:848
- C:\Windows\System\OKsCJDD.exe
  C:\Windows\System\OKsCJDD.exe
  2⤵
  PID:1140
- C:\Windows\System\FpSyVVF.exe
  C:\Windows\System\FpSyVVF.exe
  2⤵
  PID:2344
- C:\Windows\System\smotGEv.exe
  C:\Windows\System\smotGEv.exe
  2⤵
  PID:1692
- C:\Windows\System\VMdfOGf.exe
  C:\Windows\System\VMdfOGf.exe
  2⤵
  PID:1584
- C:\Windows\System\SHzqoNc.exe
  C:\Windows\System\SHzqoNc.exe
  2⤵
  PID:2744
- C:\Windows\System\BHbqGSk.exe
  C:\Windows\System\BHbqGSk.exe
  2⤵
  PID:1948
- C:\Windows\System\ZgKlmuG.exe
  C:\Windows\System\ZgKlmuG.exe
  2⤵
  PID:1628
- C:\Windows\System\vBWRTNs.exe
  C:\Windows\System\vBWRTNs.exe
  2⤵
  PID:2248
- C:\Windows\System\PLlBtXv.exe
  C:\Windows\System\PLlBtXv.exe
  2⤵
  PID:1264
- C:\Windows\System\GUpXAGc.exe
  C:\Windows\System\GUpXAGc.exe
  2⤵
  PID:2640
- C:\Windows\System\fyCBzgT.exe
  C:\Windows\System\fyCBzgT.exe
  2⤵
  PID:2360
- C:\Windows\System\QzwcbJL.exe
  C:\Windows\System\QzwcbJL.exe
  2⤵
  PID:2864
- C:\Windows\System\lAeNveN.exe
  C:\Windows\System\lAeNveN.exe
  2⤵
  PID:1288
- C:\Windows\System\axxWrsE.exe
  C:\Windows\System\axxWrsE.exe
  2⤵
  PID:936
- C:\Windows\System\NSAenjF.exe
  C:\Windows\System\NSAenjF.exe
  2⤵
  PID:3032
- C:\Windows\System\lZQyYeg.exe
  C:\Windows\System\lZQyYeg.exe
  2⤵
  PID:1576
- C:\Windows\System\ngEGiyb.exe
  C:\Windows\System\ngEGiyb.exe
  2⤵
  PID:2672
- C:\Windows\System\esvvzvz.exe
  C:\Windows\System\esvvzvz.exe
  2⤵
  PID:532
- C:\Windows\System\UbNQjlX.exe
  C:\Windows\System\UbNQjlX.exe
  2⤵
  PID:2780
- C:\Windows\System\RuzFgMa.exe
  C:\Windows\System\RuzFgMa.exe
  2⤵
  PID:2624
- C:\Windows\System\iIgGUAB.exe
  C:\Windows\System\iIgGUAB.exe
  2⤵
  PID:1732
- C:\Windows\System\mDbosLp.exe
  C:\Windows\System\mDbosLp.exe
  2⤵
  PID:688
- C:\Windows\System\ZfGpUEv.exe
  C:\Windows\System\ZfGpUEv.exe
  2⤵
  PID:2684
- C:\Windows\System\CbjOAnX.exe
  C:\Windows\System\CbjOAnX.exe
  2⤵
  PID:2876
- C:\Windows\System\vTNkAjz.exe
  C:\Windows\System\vTNkAjz.exe
  2⤵
  PID:2304
- C:\Windows\System\sJTchmn.exe
  C:\Windows\System\sJTchmn.exe
  2⤵
  PID:3124
- C:\Windows\System\RhrbhEv.exe
  C:\Windows\System\RhrbhEv.exe
  2⤵
  PID:3140
- C:\Windows\System\RXNGCJi.exe
  C:\Windows\System\RXNGCJi.exe
  2⤵
  PID:3156
- C:\Windows\System\SuuccLp.exe
  C:\Windows\System\SuuccLp.exe
  2⤵
  PID:3172
- C:\Windows\System\JOcDbwl.exe
  C:\Windows\System\JOcDbwl.exe
  2⤵
  PID:3188
- C:\Windows\System\tMmKMLX.exe
  C:\Windows\System\tMmKMLX.exe
  2⤵
  PID:3204
- C:\Windows\System\jqlSoLD.exe
  C:\Windows\System\jqlSoLD.exe
  2⤵
  PID:3220
- C:\Windows\System\pcGBWxb.exe
  C:\Windows\System\pcGBWxb.exe
  2⤵
  PID:3236
- C:\Windows\System\VnPMbvk.exe
  C:\Windows\System\VnPMbvk.exe
  2⤵
  PID:3252
- C:\Windows\System\hQnRmen.exe
  C:\Windows\System\hQnRmen.exe
  2⤵
  PID:3268
- C:\Windows\System\YCtEtNh.exe
  C:\Windows\System\YCtEtNh.exe
  2⤵
  PID:3284
- C:\Windows\System\RziPIqm.exe
  C:\Windows\System\RziPIqm.exe
  2⤵
  PID:3300
- C:\Windows\System\DCQbEIL.exe
  C:\Windows\System\DCQbEIL.exe
  2⤵
  PID:3316
- C:\Windows\System\hUlNGvs.exe
  C:\Windows\System\hUlNGvs.exe
  2⤵
  PID:3332
- C:\Windows\System\tafpTBO.exe
  C:\Windows\System\tafpTBO.exe
  2⤵
  PID:3348
- C:\Windows\System\cbJNOqS.exe
  C:\Windows\System\cbJNOqS.exe
  2⤵
  PID:3364
- C:\Windows\System\fgCwPOu.exe
  C:\Windows\System\fgCwPOu.exe
  2⤵
  PID:3380
- C:\Windows\System\HipOKaj.exe
  C:\Windows\System\HipOKaj.exe
  2⤵
  PID:3396
- C:\Windows\System\xNHIkAr.exe
  C:\Windows\System\xNHIkAr.exe
  2⤵
  PID:3412
- C:\Windows\System\fCdVDJV.exe
  C:\Windows\System\fCdVDJV.exe
  2⤵
  PID:3428
- C:\Windows\System\dBUvVel.exe
  C:\Windows\System\dBUvVel.exe
  2⤵
  PID:3444
- C:\Windows\System\PuQrtMi.exe
  C:\Windows\System\PuQrtMi.exe
  2⤵
  PID:3460
- C:\Windows\System\inIVWBp.exe
  C:\Windows\System\inIVWBp.exe
  2⤵
  PID:3476
- C:\Windows\System\bXwLqDm.exe
  C:\Windows\System\bXwLqDm.exe
  2⤵
  PID:3492
- C:\Windows\System\VabvZme.exe
  C:\Windows\System\VabvZme.exe
  2⤵
  PID:3508
- C:\Windows\System\oHqyxiK.exe
  C:\Windows\System\oHqyxiK.exe
  2⤵
  PID:3524
- C:\Windows\System\jGkCdlN.exe
  C:\Windows\System\jGkCdlN.exe
  2⤵
  PID:3540
- C:\Windows\System\toctWFw.exe
  C:\Windows\System\toctWFw.exe
  2⤵
  PID:3556
- C:\Windows\System\gCXmdjr.exe
  C:\Windows\System\gCXmdjr.exe
  2⤵
  PID:3572
- C:\Windows\System\BsuHPSu.exe
  C:\Windows\System\BsuHPSu.exe
  2⤵
  PID:3588
- C:\Windows\System\XuBvlJe.exe
  C:\Windows\System\XuBvlJe.exe
  2⤵
  PID:3728
- C:\Windows\System\tWfrESd.exe
  C:\Windows\System\tWfrESd.exe
  2⤵
  PID:3748
- C:\Windows\System\uyvNECM.exe
  C:\Windows\System\uyvNECM.exe
  2⤵
  PID:3772
- C:\Windows\System\vLOtAdc.exe
  C:\Windows\System\vLOtAdc.exe
  2⤵
  PID:3788
- C:\Windows\System\AWHSwDt.exe
  C:\Windows\System\AWHSwDt.exe
  2⤵
  PID:3808
- C:\Windows\System\SHvWwfR.exe
  C:\Windows\System\SHvWwfR.exe
  2⤵
  PID:3824
- C:\Windows\System\ajzEtPC.exe
  C:\Windows\System\ajzEtPC.exe
  2⤵
  PID:3840
- C:\Windows\System\cKWkOMt.exe
  C:\Windows\System\cKWkOMt.exe
  2⤵
  PID:3856
- C:\Windows\System\vMCNTDa.exe
  C:\Windows\System\vMCNTDa.exe
  2⤵
  PID:3876
- C:\Windows\System\hwVKAgm.exe
  C:\Windows\System\hwVKAgm.exe
  2⤵
  PID:3896
- C:\Windows\System\NhZRwMO.exe
  C:\Windows\System\NhZRwMO.exe
  2⤵
  PID:3940
- C:\Windows\System\yLDuTTl.exe
  C:\Windows\System\yLDuTTl.exe
  2⤵
  PID:3984
- C:\Windows\System\TVzBAbW.exe
  C:\Windows\System\TVzBAbW.exe
  2⤵
  PID:4000
- C:\Windows\System\ipdIEfp.exe
  C:\Windows\System\ipdIEfp.exe
  2⤵
  PID:4016
- C:\Windows\System\UBVYytj.exe
  C:\Windows\System\UBVYytj.exe
  2⤵
  PID:4032
- C:\Windows\System\HuGZAPZ.exe
  C:\Windows\System\HuGZAPZ.exe
  2⤵
  PID:4048
- C:\Windows\System\xDHUhqY.exe
  C:\Windows\System\xDHUhqY.exe
  2⤵
  PID:4068
- C:\Windows\System\tMxeEpp.exe
  C:\Windows\System\tMxeEpp.exe
  2⤵
  PID:4084
- C:\Windows\System\jZzvawp.exe
  C:\Windows\System\jZzvawp.exe
  2⤵
  PID:348
- C:\Windows\System\ZnlACAa.exe
  C:\Windows\System\ZnlACAa.exe
  2⤵
  PID:2244
- C:\Windows\System\jQVJPuC.exe
  C:\Windows\System\jQVJPuC.exe
  2⤵
  PID:2588
- C:\Windows\System\zicoeZm.exe
  C:\Windows\System\zicoeZm.exe
  2⤵
  PID:3092
- C:\Windows\System\qIVXiiF.exe
  C:\Windows\System\qIVXiiF.exe
  2⤵
  PID:3108
- C:\Windows\System\bYHerFn.exe
  C:\Windows\System\bYHerFn.exe
  2⤵
  PID:876
- C:\Windows\System\RRXwrKX.exe
  C:\Windows\System\RRXwrKX.exe
  2⤵
  PID:2572
- C:\Windows\System\SnVbBTS.exe
  C:\Windows\System\SnVbBTS.exe
  2⤵
  PID:3148
- C:\Windows\System\JqvYGWV.exe
  C:\Windows\System\JqvYGWV.exe
  2⤵
  PID:3164
- C:\Windows\System\beKzJUd.exe
  C:\Windows\System\beKzJUd.exe
  2⤵
  PID:3216
- C:\Windows\System\QkwgcDV.exe
  C:\Windows\System\QkwgcDV.exe
  2⤵
  PID:3200
- C:\Windows\System\hYOuKFi.exe
  C:\Windows\System\hYOuKFi.exe
  2⤵
  PID:3264
- C:\Windows\System\ugUqKAc.exe
  C:\Windows\System\ugUqKAc.exe
  2⤵
  PID:3312
- C:\Windows\System\RrqrxNC.exe
  C:\Windows\System\RrqrxNC.exe
  2⤵
  PID:3376
- C:\Windows\System\rdnVRej.exe
  C:\Windows\System\rdnVRej.exe
  2⤵
  PID:3360
- C:\Windows\System\skFBriS.exe
  C:\Windows\System\skFBriS.exe
  2⤵
  PID:3408
- C:\Windows\System\fARmRsw.exe
  C:\Windows\System\fARmRsw.exe
  2⤵
  PID:3436
- C:\Windows\System\ZFtoPlm.exe
  C:\Windows\System\ZFtoPlm.exe
  2⤵
  PID:3500
- C:\Windows\System\CMFhaOF.exe
  C:\Windows\System\CMFhaOF.exe
  2⤵
  PID:3564
- C:\Windows\System\VhOMIla.exe
  C:\Windows\System\VhOMIla.exe
  2⤵
  PID:3596
- C:\Windows\System\uEyGDmR.exe
  C:\Windows\System\uEyGDmR.exe
  2⤵
  PID:3624
- C:\Windows\System\vBROwne.exe
  C:\Windows\System\vBROwne.exe
  2⤵
  PID:3644
- C:\Windows\System\fXBlvTj.exe
  C:\Windows\System\fXBlvTj.exe
  2⤵
  PID:3664
- C:\Windows\System\Siuqbry.exe
  C:\Windows\System\Siuqbry.exe
  2⤵
  PID:1372
- C:\Windows\System\qyFFvGx.exe
  C:\Windows\System\qyFFvGx.exe
  2⤵
  PID:3452
- C:\Windows\System\vjcgfAt.exe
  C:\Windows\System\vjcgfAt.exe
  2⤵
  PID:620
- C:\Windows\System\ePKqgmh.exe
  C:\Windows\System\ePKqgmh.exe
  2⤵
  PID:3684
- C:\Windows\System\LntzjVB.exe
  C:\Windows\System\LntzjVB.exe
  2⤵
  PID:3704
- C:\Windows\System\jZmJGtb.exe
  C:\Windows\System\jZmJGtb.exe
  2⤵
  PID:3720
- C:\Windows\System\uAeCMud.exe
  C:\Windows\System\uAeCMud.exe
  2⤵
  PID:2024
- C:\Windows\System\eCVilJt.exe
  C:\Windows\System\eCVilJt.exe
  2⤵
  PID:3760
- C:\Windows\System\OmvQiDn.exe
  C:\Windows\System\OmvQiDn.exe
  2⤵
  PID:3796
- C:\Windows\System\yWBVkWR.exe
  C:\Windows\System\yWBVkWR.exe
  2⤵
  PID:3836
- C:\Windows\System\HrwJfrs.exe
  C:\Windows\System\HrwJfrs.exe
  2⤵
  PID:264
- C:\Windows\System\eHpbgnc.exe
  C:\Windows\System\eHpbgnc.exe
  2⤵
  PID:3552
- C:\Windows\System\hUqjXkr.exe
  C:\Windows\System\hUqjXkr.exe
  2⤵
  PID:920
- C:\Windows\System\tHVWdvx.exe
  C:\Windows\System\tHVWdvx.exe
  2⤵
  PID:3784
- C:\Windows\System\ZEdnbfI.exe
  C:\Windows\System\ZEdnbfI.exe
  2⤵
  PID:3888
- C:\Windows\System\fLbMbSo.exe
  C:\Windows\System\fLbMbSo.exe
  2⤵
  PID:2880
- C:\Windows\System\bGNdbhL.exe
  C:\Windows\System\bGNdbhL.exe
  2⤵
  PID:3848
- C:\Windows\System\UHivxeE.exe
  C:\Windows\System\UHivxeE.exe
  2⤵
  PID:3956
- C:\Windows\System\rVQvLQm.exe
  C:\Windows\System\rVQvLQm.exe
  2⤵
  PID:3976
- C:\Windows\System\PDHxWFw.exe
  C:\Windows\System\PDHxWFw.exe
  2⤵
  PID:4024
- C:\Windows\System\eFaPIZH.exe
  C:\Windows\System\eFaPIZH.exe
  2⤵
  PID:4100
- C:\Windows\System\CwrstFT.exe
  C:\Windows\System\CwrstFT.exe
  2⤵
  PID:4116
- C:\Windows\System\YgqGzZr.exe
  C:\Windows\System\YgqGzZr.exe
  2⤵
  PID:4136
- C:\Windows\System\bOnkmzZ.exe
  C:\Windows\System\bOnkmzZ.exe
  2⤵
  PID:4152
- C:\Windows\System\hRRrkNS.exe
  C:\Windows\System\hRRrkNS.exe
  2⤵
  PID:4168
- C:\Windows\System\kaCwshS.exe
  C:\Windows\System\kaCwshS.exe
  2⤵
  PID:4356
- C:\Windows\System\tvEoYTI.exe
  C:\Windows\System\tvEoYTI.exe
  2⤵
  PID:4380
- C:\Windows\System\bVkfbOq.exe
  C:\Windows\System\bVkfbOq.exe
  2⤵
  PID:4396
- C:\Windows\System\dSuRqpR.exe
  C:\Windows\System\dSuRqpR.exe
  2⤵
  PID:4412
- C:\Windows\System\meudOUJ.exe
  C:\Windows\System\meudOUJ.exe
  2⤵
  PID:4432
- C:\Windows\System\VTAHDUc.exe
  C:\Windows\System\VTAHDUc.exe
  2⤵
  PID:4448
- C:\Windows\System\gMmVMvi.exe
  C:\Windows\System\gMmVMvi.exe
  2⤵
  PID:4464
- C:\Windows\System\zeMbzEy.exe
  C:\Windows\System\zeMbzEy.exe
  2⤵
  PID:4480
- C:\Windows\System\WuiWeHj.exe
  C:\Windows\System\WuiWeHj.exe
  2⤵
  PID:4500
- C:\Windows\System\HphcQMW.exe
  C:\Windows\System\HphcQMW.exe
  2⤵
  PID:4516
- C:\Windows\System\SAyLRfp.exe
  C:\Windows\System\SAyLRfp.exe
  2⤵
  PID:4532
- C:\Windows\System\MCllOlG.exe
  C:\Windows\System\MCllOlG.exe
  2⤵
  PID:4548
- C:\Windows\System\NYXLqfv.exe
  C:\Windows\System\NYXLqfv.exe
  2⤵
  PID:4564
- C:\Windows\System\OiYcdso.exe
  C:\Windows\System\OiYcdso.exe
  2⤵
  PID:4584
- C:\Windows\System\iQjbMxp.exe
  C:\Windows\System\iQjbMxp.exe
  2⤵
  PID:4600
- C:\Windows\System\HNxolAZ.exe
  C:\Windows\System\HNxolAZ.exe
  2⤵
  PID:4616
- C:\Windows\System\pUMqrNS.exe
  C:\Windows\System\pUMqrNS.exe
  2⤵
  PID:4632
- C:\Windows\System\ipwwFeI.exe
  C:\Windows\System\ipwwFeI.exe
  2⤵
  PID:4652
- C:\Windows\System\uCLaLPY.exe
  C:\Windows\System\uCLaLPY.exe
  2⤵
  PID:4668
- C:\Windows\System\VHDFcsX.exe
  C:\Windows\System\VHDFcsX.exe
  2⤵
  PID:4684
- C:\Windows\System\FogFmpw.exe
  C:\Windows\System\FogFmpw.exe
  2⤵
  PID:4700
- C:\Windows\System\qFDiegF.exe
  C:\Windows\System\qFDiegF.exe
  2⤵
  PID:4716
- C:\Windows\System\QIyMSAr.exe
  C:\Windows\System\QIyMSAr.exe
  2⤵
  PID:4736
- C:\Windows\System\LGlegSw.exe
  C:\Windows\System\LGlegSw.exe
  2⤵
  PID:4752
- C:\Windows\System\dWMAXOb.exe
  C:\Windows\System\dWMAXOb.exe
  2⤵
  PID:4768
- C:\Windows\System\EmeLPxH.exe
  C:\Windows\System\EmeLPxH.exe
  2⤵
  PID:4784
- C:\Windows\System\oEJjXXz.exe
  C:\Windows\System\oEJjXXz.exe
  2⤵
  PID:4800
- C:\Windows\System\UvptHnD.exe
  C:\Windows\System\UvptHnD.exe
  2⤵
  PID:4816
- C:\Windows\System\KucEhLI.exe
  C:\Windows\System\KucEhLI.exe
  2⤵
  PID:4836
- C:\Windows\System\SlLoZbR.exe
  C:\Windows\System\SlLoZbR.exe
  2⤵
  PID:4852
- C:\Windows\System\SjTIXTc.exe
  C:\Windows\System\SjTIXTc.exe
  2⤵
  PID:4872
- C:\Windows\System\kNMkiJW.exe
  C:\Windows\System\kNMkiJW.exe
  2⤵
  PID:4972
- C:\Windows\System\CtpDdak.exe
  C:\Windows\System\CtpDdak.exe
  2⤵
  PID:4996
- C:\Windows\System\gxbvcsn.exe
  C:\Windows\System\gxbvcsn.exe
  2⤵
  PID:5012
- C:\Windows\System\DkXTgjj.exe
  C:\Windows\System\DkXTgjj.exe
  2⤵
  PID:5036
- C:\Windows\System\xWsOkXO.exe
  C:\Windows\System\xWsOkXO.exe
  2⤵
  PID:5056
- C:\Windows\System\BFHmcCa.exe
  C:\Windows\System\BFHmcCa.exe
  2⤵
  PID:5080
- C:\Windows\System\MshcTrU.exe
  C:\Windows\System\MshcTrU.exe
  2⤵
  PID:5108
- C:\Windows\System\hoBOfUo.exe
  C:\Windows\System\hoBOfUo.exe
  2⤵
  PID:1632
- C:\Windows\System\pphTIAv.exe
  C:\Windows\System\pphTIAv.exe
  2⤵
  PID:3116
- C:\Windows\System\becyGBy.exe
  C:\Windows\System\becyGBy.exe
  2⤵
  PID:2376
- C:\Windows\System\zPUodfo.exe
  C:\Windows\System\zPUodfo.exe
  2⤵
  PID:3260
- C:\Windows\System\BFsDfLw.exe
  C:\Windows\System\BFsDfLw.exe
  2⤵
  PID:3388
- C:\Windows\System\ztxSNNs.exe
  C:\Windows\System\ztxSNNs.exe
  2⤵
  PID:3608
- C:\Windows\System\mrnthjQ.exe
  C:\Windows\System\mrnthjQ.exe
  2⤵
  PID:3676
- C:\Windows\System\HhBnYhO.exe
  C:\Windows\System\HhBnYhO.exe
  2⤵
  PID:1856
- C:\Windows\System\OyzAIjQ.exe
  C:\Windows\System\OyzAIjQ.exe
  2⤵
  PID:3276
- C:\Windows\System\rtIpnlh.exe
  C:\Windows\System\rtIpnlh.exe
  2⤵
  PID:2660
- C:\Windows\System\yyaCQmP.exe
  C:\Windows\System\yyaCQmP.exe
  2⤵
  PID:3616
- C:\Windows\System\SkHtNte.exe
  C:\Windows\System\SkHtNte.exe
  2⤵
  PID:3660
- C:\Windows\System\DGoSneI.exe
  C:\Windows\System\DGoSneI.exe
  2⤵
  PID:1708
- C:\Windows\System\koAlugo.exe
  C:\Windows\System\koAlugo.exe
  2⤵
  PID:3600
- C:\Windows\System\bsKTVxa.exe
  C:\Windows\System\bsKTVxa.exe
  2⤵
  PID:3904
- C:\Windows\System\QAReMmy.exe
  C:\Windows\System\QAReMmy.exe
  2⤵
  PID:3948
- C:\Windows\System\feFQEYd.exe
  C:\Windows\System\feFQEYd.exe
  2⤵
  PID:4112
- C:\Windows\System\eqRAcNR.exe
  C:\Windows\System\eqRAcNR.exe
  2⤵
  PID:4188
- C:\Windows\System\UfdDMWK.exe
  C:\Windows\System\UfdDMWK.exe
  2⤵
  PID:4208
- C:\Windows\System\kmCSGUc.exe
  C:\Windows\System\kmCSGUc.exe
  2⤵
  PID:4224
- C:\Windows\System\vSjHWZi.exe
  C:\Windows\System\vSjHWZi.exe
  2⤵
  PID:4240
- C:\Windows\System\AFucExu.exe
  C:\Windows\System\AFucExu.exe
  2⤵
  PID:4256
- C:\Windows\System\SWviyhQ.exe
  C:\Windows\System\SWviyhQ.exe
  2⤵
  PID:4272
- C:\Windows\System\LLktaVo.exe
  C:\Windows\System\LLktaVo.exe
  2⤵
  PID:4292
- C:\Windows\System\pNhSVDV.exe
  C:\Windows\System\pNhSVDV.exe
  2⤵
  PID:4308
- C:\Windows\System\ccKknSV.exe
  C:\Windows\System\ccKknSV.exe
  2⤵
  PID:3700
- C:\Windows\System\OMqendt.exe
  C:\Windows\System\OMqendt.exe
  2⤵
  PID:4344
- C:\Windows\System\BEtzwQO.exe
  C:\Windows\System\BEtzwQO.exe
  2⤵
  PID:3768
- C:\Windows\System\OeKvBBG.exe
  C:\Windows\System\OeKvBBG.exe
  2⤵
  PID:4596
- C:\Windows\System\VSTPHTl.exe
  C:\Windows\System\VSTPHTl.exe
  2⤵
  PID:4628
- C:\Windows\System\RmZQXoB.exe
  C:\Windows\System\RmZQXoB.exe
  2⤵
  PID:4660
- C:\Windows\System\ztohrgH.exe
  C:\Windows\System\ztohrgH.exe
  2⤵
  PID:4732
- C:\Windows\System\QZdmKNY.exe
  C:\Windows\System\QZdmKNY.exe
  2⤵
  PID:4796
- C:\Windows\System\wxoaWRn.exe
  C:\Windows\System\wxoaWRn.exe
  2⤵
  PID:4860
- C:\Windows\System\fSwCKif.exe
  C:\Windows\System\fSwCKif.exe
  2⤵
  PID:4728
- C:\Windows\System\HWPaKHL.exe
  C:\Windows\System\HWPaKHL.exe
  2⤵
  PID:3484
- C:\Windows\System\tKLXREo.exe
  C:\Windows\System\tKLXREo.exe
  2⤵
  PID:3584
- C:\Windows\System\dxCOLnX.exe
  C:\Windows\System\dxCOLnX.exe
  2⤵
  PID:3972
- C:\Windows\System\KLknjCW.exe
  C:\Windows\System\KLknjCW.exe
  2⤵
  PID:4128
- C:\Windows\System\tQEqphD.exe
  C:\Windows\System\tQEqphD.exe
  2⤵
  PID:4472
- C:\Windows\System\NKKUrOf.exe
  C:\Windows\System\NKKUrOf.exe
  2⤵
  PID:4848
- C:\Windows\System\SGwvtun.exe
  C:\Windows\System\SGwvtun.exe
  2⤵
  PID:4576
- C:\Windows\System\fClgGHK.exe
  C:\Windows\System\fClgGHK.exe
  2⤵
  PID:4404
- C:\Windows\System\OeHEauu.exe
  C:\Windows\System\OeHEauu.exe
  2⤵
  PID:4572
- C:\Windows\System\BvfyBIe.exe
  C:\Windows\System\BvfyBIe.exe
  2⤵
  PID:4648
- C:\Windows\System\kTQaUjg.exe
  C:\Windows\System\kTQaUjg.exe
  2⤵
  PID:4748
- C:\Windows\System\ybbMivo.exe
  C:\Windows\System\ybbMivo.exe
  2⤵
  PID:4712
- C:\Windows\System\JMxJIbi.exe
  C:\Windows\System\JMxJIbi.exe
  2⤵
  PID:5028
- C:\Windows\System\FcwAOYA.exe
  C:\Windows\System\FcwAOYA.exe
  2⤵
  PID:5068
- C:\Windows\System\opiiILz.exe
  C:\Windows\System\opiiILz.exe
  2⤵
  PID:5044
- C:\Windows\System\asnMvug.exe
  C:\Windows\System\asnMvug.exe
  2⤵
  PID:5096
- C:\Windows\System\tVeQORo.exe
  C:\Windows\System\tVeQORo.exe
  2⤵
  PID:4012
- C:\Windows\System\Qilgsnw.exe
  C:\Windows\System\Qilgsnw.exe
  2⤵
  PID:1588
- C:\Windows\System\YHKLGlM.exe
  C:\Windows\System\YHKLGlM.exe
  2⤵
  PID:1960
- C:\Windows\System\Iwszccq.exe
  C:\Windows\System\Iwszccq.exe
  2⤵
  PID:1228
- C:\Windows\System\jhGwvsY.exe
  C:\Windows\System\jhGwvsY.exe
  2⤵
  PID:1188
- C:\Windows\System\UFXZOrX.exe
  C:\Windows\System\UFXZOrX.exe
  2⤵
  PID:1388
- C:\Windows\System\yHznnBg.exe
  C:\Windows\System\yHznnBg.exe
  2⤵
  PID:3232
- C:\Windows\System\qjOTrLM.exe
  C:\Windows\System\qjOTrLM.exe
  2⤵
  PID:2760
- C:\Windows\System\tSUjreN.exe
  C:\Windows\System\tSUjreN.exe
  2⤵
  PID:1676
- C:\Windows\System\dGuJloV.exe
  C:\Windows\System\dGuJloV.exe
  2⤵
  PID:4908
- C:\Windows\System\tqUjaVO.exe
  C:\Windows\System\tqUjaVO.exe
  2⤵
  PID:3532
- C:\Windows\System\TXwjygh.exe
  C:\Windows\System\TXwjygh.exe
  2⤵
  PID:304
- C:\Windows\System\PpfagbX.exe
  C:\Windows\System\PpfagbX.exe
  2⤵
  PID:4200
- C:\Windows\System\yYoUfAj.exe
  C:\Windows\System\yYoUfAj.exe
  2⤵
  PID:4268
- C:\Windows\System\PvoySTu.exe
  C:\Windows\System\PvoySTu.exe
  2⤵
  PID:2432
- C:\Windows\System\kFeSnIa.exe
  C:\Windows\System\kFeSnIa.exe
  2⤵
  PID:4300
- C:\Windows\System\iCzyfBt.exe
  C:\Windows\System\iCzyfBt.exe
  2⤵
  PID:3868
- C:\Windows\System\lSYbjsH.exe
  C:\Windows\System\lSYbjsH.exe
  2⤵
  PID:3692
- C:\Windows\System\fRUIFhb.exe
  C:\Windows\System\fRUIFhb.exe
  2⤵
  PID:4312
- C:\Windows\System\AuEZRkz.exe
  C:\Windows\System\AuEZRkz.exe
  2⤵
  PID:4336
- C:\Windows\System\wAhHvhC.exe
  C:\Windows\System\wAhHvhC.exe
  2⤵
  PID:4352
- C:\Windows\System\JyVHIbC.exe
  C:\Windows\System\JyVHIbC.exe
  2⤵
  PID:4392
- C:\Windows\System\SgVzoGO.exe
  C:\Windows\System\SgVzoGO.exe
  2⤵
  PID:3088
- C:\Windows\System\WYJVfdR.exe
  C:\Windows\System\WYJVfdR.exe
  2⤵
  PID:4456
- C:\Windows\System\bqRKzqN.exe
  C:\Windows\System\bqRKzqN.exe
  2⤵
  PID:3764
- C:\Windows\System\ZUZDdVs.exe
  C:\Windows\System\ZUZDdVs.exe
  2⤵
  PID:4124
- C:\Windows\System\zqUhYjR.exe
  C:\Windows\System\zqUhYjR.exe
  2⤵
  PID:4608
- C:\Windows\System\rWDIauh.exe
  C:\Windows\System\rWDIauh.exe
  2⤵
  PID:4420
- C:\Windows\System\AmdpvFL.exe
  C:\Windows\System\AmdpvFL.exe
  2⤵
  PID:4880
- C:\Windows\System\OqfVDBo.exe
  C:\Windows\System\OqfVDBo.exe
  2⤵
  PID:4368
- C:\Windows\System\kZOkKjl.exe
  C:\Windows\System\kZOkKjl.exe
  2⤵
  PID:4832
- C:\Windows\System\FcTyRej.exe
  C:\Windows\System\FcTyRej.exe
  2⤵
  PID:4868
- C:\Windows\System\PsECZbP.exe
  C:\Windows\System\PsECZbP.exe
  2⤵
  PID:5064
- C:\Windows\System\cHJUcRj.exe
  C:\Windows\System\cHJUcRj.exe
  2⤵
  PID:5092
- C:\Windows\System\OrcvzpE.exe
  C:\Windows\System\OrcvzpE.exe
  2⤵
  PID:4008
- C:\Windows\System\eErGwES.exe
  C:\Windows\System\eErGwES.exe
  2⤵
  PID:2176
- C:\Windows\System\rQgaggE.exe
  C:\Windows\System\rQgaggE.exe
  2⤵
  PID:1640
- C:\Windows\System\KOyaUmv.exe
  C:\Windows\System\KOyaUmv.exe
  2⤵
  PID:1844
- C:\Windows\System\OIvKYtW.exe
  C:\Windows\System\OIvKYtW.exe
  2⤵
  PID:1248
- C:\Windows\System\IjkUYdm.exe
  C:\Windows\System\IjkUYdm.exe
  2⤵
  PID:3632
- C:\Windows\System\QInshid.exe
  C:\Windows\System\QInshid.exe
  2⤵
  PID:3136
- C:\Windows\System\KByWFUC.exe
  C:\Windows\System\KByWFUC.exe
  2⤵
  PID:3212
- C:\Windows\System\KVKkuNJ.exe
  C:\Windows\System\KVKkuNJ.exe
  2⤵
  PID:4196
- C:\Windows\System\mFzUZZO.exe
  C:\Windows\System\mFzUZZO.exe
  2⤵
  PID:1616
- C:\Windows\System\CJBmmBZ.exe
  C:\Windows\System\CJBmmBZ.exe
  2⤵
  PID:4252
- C:\Windows\System\uCxwcWw.exe
  C:\Windows\System\uCxwcWw.exe
  2⤵
  PID:4644
- C:\Windows\System\bLzxrZm.exe
  C:\Windows\System\bLzxrZm.exe
  2⤵
  PID:4332
- C:\Windows\System\ZswyhZn.exe
  C:\Windows\System\ZswyhZn.exe
  2⤵
  PID:4864
- C:\Windows\System\FkMOYMT.exe
  C:\Windows\System\FkMOYMT.exe
  2⤵
  PID:4328
- C:\Windows\System\pReTbBX.exe
  C:\Windows\System\pReTbBX.exe
  2⤵
  PID:4744
- C:\Windows\System\AytCjlb.exe
  C:\Windows\System\AytCjlb.exe
  2⤵
  PID:4844
- C:\Windows\System\NCZMxUq.exe
  C:\Windows\System\NCZMxUq.exe
  2⤵
  PID:4764
- C:\Windows\System\dBtUDTF.exe
  C:\Windows\System\dBtUDTF.exe
  2⤵
  PID:1044
- C:\Windows\System\XUKyHFg.exe
  C:\Windows\System\XUKyHFg.exe
  2⤵
  PID:4524
- C:\Windows\System\VkfHvOy.exe
  C:\Windows\System\VkfHvOy.exe
  2⤵
  PID:4544
- C:\Windows\System\tNhxkZt.exe
  C:\Windows\System\tNhxkZt.exe
  2⤵
  PID:4944
- C:\Windows\System\kHNKusT.exe
  C:\Windows\System\kHNKusT.exe
  2⤵
  PID:4988
- C:\Windows\System\aphRuxg.exe
  C:\Windows\System\aphRuxg.exe
  2⤵
  PID:5024
- C:\Windows\System\Iwnarrp.exe
  C:\Windows\System\Iwnarrp.exe
  2⤵
  PID:1420
- C:\Windows\System\OXBYQHu.exe
  C:\Windows\System\OXBYQHu.exe
  2⤵
  PID:3196
- C:\Windows\System\hhhTlDL.exe
  C:\Windows\System\hhhTlDL.exe
  2⤵
  PID:2840
- C:\Windows\System\VYSyquj.exe
  C:\Windows\System\VYSyquj.exe
  2⤵
  PID:3440
- C:\Windows\System\XBuaYek.exe
  C:\Windows\System\XBuaYek.exe
  2⤵
  PID:3104
- C:\Windows\System\zJvqVnp.exe
  C:\Windows\System\zJvqVnp.exe
  2⤵
  PID:3344
- C:\Windows\System\gdRSWOW.exe
  C:\Windows\System\gdRSWOW.exe
  2⤵
  PID:3292
- C:\Windows\System\RyGJEDS.exe
  C:\Windows\System\RyGJEDS.exe
  2⤵
  PID:4060
- C:\Windows\System\luIlQHA.exe
  C:\Windows\System\luIlQHA.exe
  2⤵
  PID:4680
- C:\Windows\System\sywAVAx.exe
  C:\Windows\System\sywAVAx.exe
  2⤵
  PID:4968
- C:\Windows\System\qXCDAJa.exe
  C:\Windows\System\qXCDAJa.exe
  2⤵
  PID:4984
- C:\Windows\System\ILaHVoI.exe
  C:\Windows\System\ILaHVoI.exe
  2⤵
  PID:3980
- C:\Windows\System\LsecHrw.exe
  C:\Windows\System\LsecHrw.exe
  2⤵
  PID:5132
- C:\Windows\System\bsZyrlc.exe
  C:\Windows\System\bsZyrlc.exe
  2⤵
  PID:5148
- C:\Windows\System\JeRoSpR.exe
  C:\Windows\System\JeRoSpR.exe
  2⤵
  PID:5164
- C:\Windows\System\LbDKkKX.exe
  C:\Windows\System\LbDKkKX.exe
  2⤵
  PID:5184
- C:\Windows\System\mkVMvAR.exe
  C:\Windows\System\mkVMvAR.exe
  2⤵
  PID:5200
- C:\Windows\System\UpQKZNB.exe
  C:\Windows\System\UpQKZNB.exe
  2⤵
  PID:5216
- C:\Windows\System\GtDHNkQ.exe
  C:\Windows\System\GtDHNkQ.exe
  2⤵
  PID:5232
- C:\Windows\System\WlzTTZY.exe
  C:\Windows\System\WlzTTZY.exe
  2⤵
  PID:5252
- C:\Windows\System\civCcQu.exe
  C:\Windows\System\civCcQu.exe
  2⤵
  PID:5268
- C:\Windows\System\KmIFLXK.exe
  C:\Windows\System\KmIFLXK.exe
  2⤵
  PID:5284
- C:\Windows\System\YOzoyFj.exe
  C:\Windows\System\YOzoyFj.exe
  2⤵
  PID:5380
- C:\Windows\System\BxpLLZZ.exe
  C:\Windows\System\BxpLLZZ.exe
  2⤵
  PID:5396
- C:\Windows\System\ATPyMxd.exe
  C:\Windows\System\ATPyMxd.exe
  2⤵
  PID:5412
- C:\Windows\System\sNtnVbE.exe
  C:\Windows\System\sNtnVbE.exe
  2⤵
  PID:5432
- C:\Windows\System\zKHGxwK.exe
  C:\Windows\System\zKHGxwK.exe
  2⤵
  PID:5448
- C:\Windows\System\imavZFJ.exe
  C:\Windows\System\imavZFJ.exe
  2⤵
  PID:5464
- C:\Windows\System\jQJOyBQ.exe
  C:\Windows\System\jQJOyBQ.exe
  2⤵
  PID:5480
- C:\Windows\System\DMNIsdj.exe
  C:\Windows\System\DMNIsdj.exe
  2⤵
  PID:5496
- C:\Windows\System\izXVThD.exe
  C:\Windows\System\izXVThD.exe
  2⤵
  PID:5512
- C:\Windows\System\AfzXVEf.exe
  C:\Windows\System\AfzXVEf.exe
  2⤵
  PID:5532
- C:\Windows\System\LrCMBKJ.exe
  C:\Windows\System\LrCMBKJ.exe
  2⤵
  PID:5548
- C:\Windows\System\TDzfIBm.exe
  C:\Windows\System\TDzfIBm.exe
  2⤵
  PID:5580
- C:\Windows\System\subjNMX.exe
  C:\Windows\System\subjNMX.exe
  2⤵
  PID:5596
- C:\Windows\System\zqhHhhg.exe
  C:\Windows\System\zqhHhhg.exe
  2⤵
  PID:5612
- C:\Windows\System\sxRttcW.exe
  C:\Windows\System\sxRttcW.exe
  2⤵
  PID:5628
- C:\Windows\System\KXiUUPk.exe
  C:\Windows\System\KXiUUPk.exe
  2⤵
  PID:5644
- C:\Windows\System\pNpjNXQ.exe
  C:\Windows\System\pNpjNXQ.exe
  2⤵
  PID:5660
- C:\Windows\System\hzBodtc.exe
  C:\Windows\System\hzBodtc.exe
  2⤵
  PID:5676
- C:\Windows\System\lyzSwla.exe
  C:\Windows\System\lyzSwla.exe
  2⤵
  PID:5700
- C:\Windows\System\bibvCQC.exe
  C:\Windows\System\bibvCQC.exe
  2⤵
  PID:5716
- C:\Windows\System\PDRjkYc.exe
  C:\Windows\System\PDRjkYc.exe
  2⤵
  PID:5732
- C:\Windows\System\airGLDK.exe
  C:\Windows\System\airGLDK.exe
  2⤵
  PID:5752
- C:\Windows\System\KHLRhqA.exe
  C:\Windows\System\KHLRhqA.exe
  2⤵
  PID:5768
- C:\Windows\System\LVAQQRc.exe
  C:\Windows\System\LVAQQRc.exe
  2⤵
  PID:5784
- C:\Windows\System\NsUdKPR.exe
  C:\Windows\System\NsUdKPR.exe
  2⤵
  PID:5800
- C:\Windows\System\PKoYTcZ.exe
  C:\Windows\System\PKoYTcZ.exe
  2⤵
  PID:5820
- C:\Windows\System\jWqUUQc.exe
  C:\Windows\System\jWqUUQc.exe
  2⤵
  PID:5848
- C:\Windows\System\OJqhksV.exe
  C:\Windows\System\OJqhksV.exe
  2⤵
  PID:5872
- C:\Windows\System\NkfbcBO.exe
  C:\Windows\System\NkfbcBO.exe
  2⤵
  PID:5888
- C:\Windows\System\XrzUDla.exe
  C:\Windows\System\XrzUDla.exe
  2⤵
  PID:5904
- C:\Windows\System\lWpOHDP.exe
  C:\Windows\System\lWpOHDP.exe
  2⤵
  PID:5920
- C:\Windows\System\cQSpSAD.exe
  C:\Windows\System\cQSpSAD.exe
  2⤵
  PID:5936
- C:\Windows\System\OyKEPjc.exe
  C:\Windows\System\OyKEPjc.exe
  2⤵
  PID:5952
- C:\Windows\System\aTmSUmN.exe
  C:\Windows\System\aTmSUmN.exe
  2⤵
  PID:5968
- C:\Windows\System\DWKUJTH.exe
  C:\Windows\System\DWKUJTH.exe
  2⤵
  PID:5984
- C:\Windows\System\CNpeMQj.exe
  C:\Windows\System\CNpeMQj.exe
  2⤵
  PID:6000
- C:\Windows\System\OHXkwoD.exe
  C:\Windows\System\OHXkwoD.exe
  2⤵
  PID:6020
- C:\Windows\System\XDAxAyW.exe
  C:\Windows\System\XDAxAyW.exe
  2⤵
  PID:6036
- C:\Windows\System\GVJdhrP.exe
  C:\Windows\System\GVJdhrP.exe
  2⤵
  PID:6052
- C:\Windows\System\liGOQzJ.exe
  C:\Windows\System\liGOQzJ.exe
  2⤵
  PID:6080
- C:\Windows\System\lBbVEMx.exe
  C:\Windows\System\lBbVEMx.exe
  2⤵
  PID:6100
- C:\Windows\System\DCUbVbR.exe
  C:\Windows\System\DCUbVbR.exe
  2⤵
  PID:6116
- C:\Windows\System\JHMpJmR.exe
  C:\Windows\System\JHMpJmR.exe
  2⤵
  PID:6136
- C:\Windows\System\dzjZtZy.exe
  C:\Windows\System\dzjZtZy.exe
  2⤵
  PID:5020
- C:\Windows\System\JAmYAmM.exe
  C:\Windows\System\JAmYAmM.exe
  2⤵
  PID:4496
- C:\Windows\System\UUgBvqw.exe
  C:\Windows\System\UUgBvqw.exe
  2⤵
  PID:4508
- C:\Windows\System\IhRIFci.exe
  C:\Windows\System\IhRIFci.exe
  2⤵
  PID:4932
- C:\Windows\System\sTBPSjO.exe
  C:\Windows\System\sTBPSjO.exe
  2⤵
  PID:4440
- C:\Windows\System\tRYaeGd.exe
  C:\Windows\System\tRYaeGd.exe
  2⤵
  PID:5260
- C:\Windows\System\zNIwaTn.exe
  C:\Windows\System\zNIwaTn.exe
  2⤵
  PID:5192
- C:\Windows\System\anUNZNw.exe
  C:\Windows\System\anUNZNw.exe
  2⤵
  PID:5124
- C:\Windows\System\fEjZhNa.exe
  C:\Windows\System\fEjZhNa.exe
  2⤵
  PID:4236
- C:\Windows\System\ETcuIbo.exe
  C:\Windows\System\ETcuIbo.exe
  2⤵
  PID:5304
- C:\Windows\System\HlhbpUm.exe
  C:\Windows\System\HlhbpUm.exe
  2⤵
  PID:4940
- C:\Windows\System\rVIVxzV.exe
  C:\Windows\System\rVIVxzV.exe
  2⤵
  PID:5052
- C:\Windows\System\VrtcSLb.exe
  C:\Windows\System\VrtcSLb.exe
  2⤵
  PID:5116
- C:\Windows\System\YrujNfC.exe
  C:\Windows\System\YrujNfC.exe
  2⤵
  PID:5316
- C:\Windows\System\CpOKmvg.exe
  C:\Windows\System\CpOKmvg.exe
  2⤵
  PID:5340
- C:\Windows\System\QUssqqQ.exe
  C:\Windows\System\QUssqqQ.exe
  2⤵
  PID:5360
- C:\Windows\System\PuEdsTj.exe
  C:\Windows\System\PuEdsTj.exe
  2⤵
  PID:5424
- C:\Windows\System\VHFnngS.exe
  C:\Windows\System\VHFnngS.exe
  2⤵
  PID:5460
- C:\Windows\System\AqdLchO.exe
  C:\Windows\System\AqdLchO.exe
  2⤵
  PID:5372
- C:\Windows\System\TwWXwar.exe
  C:\Windows\System\TwWXwar.exe
  2⤵
  PID:5560
- C:\Windows\System\xhBouzW.exe
  C:\Windows\System\xhBouzW.exe
  2⤵
  PID:5568
- C:\Windows\System\gmGUNzL.exe
  C:\Windows\System\gmGUNzL.exe
  2⤵
  PID:5444
- C:\Windows\System\mRQFFCX.exe
  C:\Windows\System\mRQFFCX.exe
  2⤵
  PID:5604
- C:\Windows\System\BftGJyj.exe
  C:\Windows\System\BftGJyj.exe
  2⤵
  PID:5640
- C:\Windows\System\jMlGSEX.exe
  C:\Windows\System\jMlGSEX.exe
  2⤵
  PID:5708
- C:\Windows\System\WeWQBsW.exe
  C:\Windows\System\WeWQBsW.exe
  2⤵
  PID:5692
- C:\Windows\System\ymaVuJq.exe
  C:\Windows\System\ymaVuJq.exe
  2⤵
  PID:5748
- C:\Windows\System\cTpuFac.exe
  C:\Windows\System\cTpuFac.exe
  2⤵
  PID:5656
- C:\Windows\System\JTLWQag.exe
  C:\Windows\System\JTLWQag.exe
  2⤵
  PID:5724
- C:\Windows\System\RhtsqLW.exe
  C:\Windows\System\RhtsqLW.exe
  2⤵
  PID:5780
- C:\Windows\System\jBvDXsO.exe
  C:\Windows\System\jBvDXsO.exe
  2⤵
  PID:5792
- C:\Windows\System\Qhtnged.exe
  C:\Windows\System\Qhtnged.exe
  2⤵
  PID:5836
- C:\Windows\System\BBfHiSF.exe
  C:\Windows\System\BBfHiSF.exe
  2⤵
  PID:5860
- C:\Windows\System\sUrvFYw.exe
  C:\Windows\System\sUrvFYw.exe
  2⤵
  PID:5900
- C:\Windows\System\TWevpiV.exe
  C:\Windows\System\TWevpiV.exe
  2⤵
  PID:5964
- C:\Windows\System\nMhfUSG.exe
  C:\Windows\System\nMhfUSG.exe
  2⤵
  PID:6032
- C:\Windows\System\ktPZDro.exe
  C:\Windows\System\ktPZDro.exe
  2⤵
  PID:6072
- C:\Windows\System\eLKkBiu.exe
  C:\Windows\System\eLKkBiu.exe
  2⤵
  PID:3996
- C:\Windows\System\ToDbJJh.exe
  C:\Windows\System\ToDbJJh.exe
  2⤵
  PID:5944
- C:\Windows\System\AMDNUxg.exe
  C:\Windows\System\AMDNUxg.exe
  2⤵
  PID:5916
- C:\Windows\System\IMCpRjk.exe
  C:\Windows\System\IMCpRjk.exe
  2⤵
  PID:6012
- C:\Windows\System\YBcLPPI.exe
  C:\Windows\System\YBcLPPI.exe
  2⤵
  PID:6092
- C:\Windows\System\gWjwolz.exe
  C:\Windows\System\gWjwolz.exe
  2⤵
  PID:3656
- C:\Windows\System\dijJXCd.exe
  C:\Windows\System\dijJXCd.exe
  2⤵
  PID:5140
- C:\Windows\System\DhxMmtl.exe
  C:\Windows\System\DhxMmtl.exe
  2⤵
  PID:5244
- C:\Windows\System\dhosoCw.exe
  C:\Windows\System\dhosoCw.exe
  2⤵
  PID:4216
- C:\Windows\System\BGwyNPM.exe
  C:\Windows\System\BGwyNPM.exe
  2⤵
  PID:4896
- C:\Windows\System\RFDTZKr.exe
  C:\Windows\System\RFDTZKr.exe
  2⤵
  PID:5128
- C:\Windows\System\sxXjLam.exe
  C:\Windows\System\sxXjLam.exe
  2⤵
  PID:5332
- C:\Windows\System\ZlQmQdH.exe
  C:\Windows\System\ZlQmQdH.exe
  2⤵
  PID:5544
- C:\Windows\System\mcxdDCd.exe
  C:\Windows\System\mcxdDCd.exe
  2⤵
  PID:5456
- C:\Windows\System\qNwDdfC.exe
  C:\Windows\System\qNwDdfC.exe
  2⤵
  PID:5556
- C:\Windows\System\rGNqqDq.exe
  C:\Windows\System\rGNqqDq.exe
  2⤵
  PID:5588
- C:\Windows\System\tfyKvIL.exe
  C:\Windows\System\tfyKvIL.exe
  2⤵
  PID:5812
- C:\Windows\System\jHwoXMP.exe
  C:\Windows\System\jHwoXMP.exe
  2⤵
  PID:5932
- C:\Windows\System\vLICZZv.exe
  C:\Windows\System\vLICZZv.exe
  2⤵
  PID:6064
- C:\Windows\System\OYdyrSe.exe
  C:\Windows\System\OYdyrSe.exe
  2⤵
  PID:5760
- C:\Windows\System\TkUckGA.exe
  C:\Windows\System\TkUckGA.exe
  2⤵
  PID:5652
- C:\Windows\System\SpXxpNV.exe
  C:\Windows\System\SpXxpNV.exe
  2⤵
  PID:5996
- C:\Windows\System\SuTDMvF.exe
  C:\Windows\System\SuTDMvF.exe
  2⤵
  PID:6132
- C:\Windows\System\hyNtLNM.exe
  C:\Windows\System\hyNtLNM.exe
  2⤵
  PID:5176
- C:\Windows\System\ZXRFiGB.exe
  C:\Windows\System\ZXRFiGB.exe
  2⤵
  PID:5224
- C:\Windows\System\ERgEPgi.exe
  C:\Windows\System\ERgEPgi.exe
  2⤵
  PID:5280
- C:\Windows\System\CEerZCR.exe
  C:\Windows\System\CEerZCR.exe
  2⤵
  PID:5324
- C:\Windows\System\GzRnIpH.exe
  C:\Windows\System\GzRnIpH.exe
  2⤵
  PID:5264
- C:\Windows\System\GpsMFZU.exe
  C:\Windows\System\GpsMFZU.exe
  2⤵
  PID:5008
- C:\Windows\System\dwFhZIX.exe
  C:\Windows\System\dwFhZIX.exe
  2⤵
  PID:5572
- C:\Windows\System\dwMPvnW.exe
  C:\Windows\System\dwMPvnW.exe
  2⤵
  PID:5476
- C:\Windows\System\fMhwmPu.exe
  C:\Windows\System\fMhwmPu.exe
  2⤵
  PID:6128
- C:\Windows\System\JJviHgq.exe
  C:\Windows\System\JJviHgq.exe
  2⤵
  PID:5440
- C:\Windows\System\hFJDPbL.exe
  C:\Windows\System\hFJDPbL.exe
  2⤵
  PID:5832
- C:\Windows\System\cuVNRAj.exe
  C:\Windows\System\cuVNRAj.exe
  2⤵
  PID:4324
- C:\Windows\System\FKaYatt.exe
  C:\Windows\System\FKaYatt.exe
  2⤵
  PID:5172
- C:\Windows\System\opMrKhp.exe
  C:\Windows\System\opMrKhp.exe
  2⤵
  PID:2520
- C:\Windows\System\xgLHWGi.exe
  C:\Windows\System\xgLHWGi.exe
  2⤵
  PID:5248
- C:\Windows\System\tPiovWw.exe
  C:\Windows\System\tPiovWw.exe
  2⤵
  PID:5352
- C:\Windows\System\zsnpkeq.exe
  C:\Windows\System\zsnpkeq.exe
  2⤵
  PID:5312
- C:\Windows\System\lnamWfV.exe
  C:\Windows\System\lnamWfV.exe
  2⤵
  PID:5884
- C:\Windows\System\WlyFnRp.exe
  C:\Windows\System\WlyFnRp.exe
  2⤵
  PID:5776
- C:\Windows\System\ymYnMBv.exe
  C:\Windows\System\ymYnMBv.exe
  2⤵
  PID:5868
- C:\Windows\System\ZIACzQb.exe
  C:\Windows\System\ZIACzQb.exe
  2⤵
  PID:6156
- C:\Windows\System\ZGoKhAv.exe
  C:\Windows\System\ZGoKhAv.exe
  2⤵
  PID:6176
- C:\Windows\System\NbvsGLK.exe
  C:\Windows\System\NbvsGLK.exe
  2⤵
  PID:6192
- C:\Windows\System\JzYuPAv.exe
  C:\Windows\System\JzYuPAv.exe
  2⤵
  PID:6208
- C:\Windows\System\lmfdnSV.exe
  C:\Windows\System\lmfdnSV.exe
  2⤵
  PID:6224
- C:\Windows\System\vOQFhco.exe
  C:\Windows\System\vOQFhco.exe
  2⤵
  PID:6240
- C:\Windows\System\wcZPKHo.exe
  C:\Windows\System\wcZPKHo.exe
  2⤵
  PID:6256
- C:\Windows\System\PCwiZqU.exe
  C:\Windows\System\PCwiZqU.exe
  2⤵
  PID:6272
- C:\Windows\System\wfVqrjr.exe
  C:\Windows\System\wfVqrjr.exe
  2⤵
  PID:6292
- C:\Windows\System\lfzJAQh.exe
  C:\Windows\System\lfzJAQh.exe
  2⤵
  PID:6308
- C:\Windows\System\QnPTjTg.exe
  C:\Windows\System\QnPTjTg.exe
  2⤵
  PID:6324
- C:\Windows\System\nnRHEFh.exe
  C:\Windows\System\nnRHEFh.exe
  2⤵
  PID:6340
- C:\Windows\System\bACbCqJ.exe
  C:\Windows\System\bACbCqJ.exe
  2⤵
  PID:6356
- C:\Windows\System\WGWZjSy.exe
  C:\Windows\System\WGWZjSy.exe
  2⤵
  PID:6376
- C:\Windows\System\TpQOhfl.exe
  C:\Windows\System\TpQOhfl.exe
  2⤵
  PID:6392
- C:\Windows\System\xSyMhtU.exe
  C:\Windows\System\xSyMhtU.exe
  2⤵
  PID:6408
- C:\Windows\System\NLGMEdl.exe
  C:\Windows\System\NLGMEdl.exe
  2⤵
  PID:6424
- C:\Windows\System\yEZjozo.exe
  C:\Windows\System\yEZjozo.exe
  2⤵
  PID:6440
- C:\Windows\System\BanDNpV.exe
  C:\Windows\System\BanDNpV.exe
  2⤵
  PID:6456
- C:\Windows\System\hYADsbi.exe
  C:\Windows\System\hYADsbi.exe
  2⤵
  PID:6472
- C:\Windows\System\bxRtMIc.exe
  C:\Windows\System\bxRtMIc.exe
  2⤵
  PID:6488
- C:\Windows\System\mFXkbfG.exe
  C:\Windows\System\mFXkbfG.exe
  2⤵
  PID:6564
- C:\Windows\System\KUSpAem.exe
  C:\Windows\System\KUSpAem.exe
  2⤵
  PID:6580
- C:\Windows\System\QUKqfyJ.exe
  C:\Windows\System\QUKqfyJ.exe
  2⤵
  PID:6596
- C:\Windows\System\vmphtvY.exe
  C:\Windows\System\vmphtvY.exe
  2⤵
  PID:6612
- C:\Windows\System\OYoOFHP.exe
  C:\Windows\System\OYoOFHP.exe
  2⤵
  PID:6628
- C:\Windows\System\luYjEOu.exe
  C:\Windows\System\luYjEOu.exe
  2⤵
  PID:6648
- C:\Windows\System\XKfqlYa.exe
  C:\Windows\System\XKfqlYa.exe
  2⤵
  PID:6664
- C:\Windows\System\QwIjjtu.exe
  C:\Windows\System\QwIjjtu.exe
  2⤵
  PID:6680
- C:\Windows\System\sCMgemM.exe
  C:\Windows\System\sCMgemM.exe
  2⤵
  PID:6696
- C:\Windows\System\LrdytnD.exe
  C:\Windows\System\LrdytnD.exe
  2⤵
  PID:6712
- C:\Windows\System\nybOQdV.exe
  C:\Windows\System\nybOQdV.exe
  2⤵
  PID:6728
- C:\Windows\System\NVNSHmI.exe
  C:\Windows\System\NVNSHmI.exe
  2⤵
  PID:6744
- C:\Windows\System\CgWZGiU.exe
  C:\Windows\System\CgWZGiU.exe
  2⤵
  PID:6760
- C:\Windows\System\MJzOrgl.exe
  C:\Windows\System\MJzOrgl.exe
  2⤵
  PID:6776
- C:\Windows\System\dfySDlK.exe
  C:\Windows\System\dfySDlK.exe
  2⤵
  PID:6792
- C:\Windows\System\PueTFPl.exe
  C:\Windows\System\PueTFPl.exe
  2⤵
  PID:6808
- C:\Windows\System\DCnlwrb.exe
  C:\Windows\System\DCnlwrb.exe
  2⤵
  PID:6824
- C:\Windows\System\NRrhBNA.exe
  C:\Windows\System\NRrhBNA.exe
  2⤵
  PID:6840
- C:\Windows\System\fPoXtgG.exe
  C:\Windows\System\fPoXtgG.exe
  2⤵
  PID:6856
- C:\Windows\System\RHlyPvn.exe
  C:\Windows\System\RHlyPvn.exe
  2⤵
  PID:6872
- C:\Windows\System\VfuTyIB.exe
  C:\Windows\System\VfuTyIB.exe
  2⤵
  PID:6892
- C:\Windows\System\EjNWnjC.exe
  C:\Windows\System\EjNWnjC.exe
  2⤵
  PID:6908
- C:\Windows\System\oMpjMGO.exe
  C:\Windows\System\oMpjMGO.exe
  2⤵
  PID:6928
- C:\Windows\System\RYpohrW.exe
  C:\Windows\System\RYpohrW.exe
  2⤵
  PID:6960
- C:\Windows\System\jEyPZye.exe
  C:\Windows\System\jEyPZye.exe
  2⤵
  PID:7088
- C:\Windows\System\umzsIuT.exe
  C:\Windows\System\umzsIuT.exe
  2⤵
  PID:7108
- C:\Windows\System\rkqMENI.exe
  C:\Windows\System\rkqMENI.exe
  2⤵
  PID:7124
- C:\Windows\System\GPPbHLK.exe
  C:\Windows\System\GPPbHLK.exe
  2⤵
  PID:7140
- C:\Windows\System\kdlgeBg.exe
  C:\Windows\System\kdlgeBg.exe
  2⤵
  PID:7156
- C:\Windows\System\oICaQFj.exe
  C:\Windows\System\oICaQFj.exe
  2⤵
  PID:5896
- C:\Windows\System\LUDbxhv.exe
  C:\Windows\System\LUDbxhv.exe
  2⤵
  PID:6016
- C:\Windows\System\xXaMUAS.exe
  C:\Windows\System\xXaMUAS.exe
  2⤵
  PID:4180
- C:\Windows\System\ANJkVgN.exe
  C:\Windows\System\ANJkVgN.exe
  2⤵
  PID:4936
- C:\Windows\System\IMWxLYA.exe
  C:\Windows\System\IMWxLYA.exe
  2⤵
  PID:6188
- C:\Windows\System\urhsfai.exe
  C:\Windows\System\urhsfai.exe
  2⤵
  PID:6252
- C:\Windows\System\NwpQwCl.exe
  C:\Windows\System\NwpQwCl.exe
  2⤵
  PID:6316
- C:\Windows\System\chxnPDy.exe
  C:\Windows\System\chxnPDy.exe
  2⤵
  PID:6384
- C:\Windows\System\RitQvKj.exe
  C:\Windows\System\RitQvKj.exe
  2⤵
  PID:6448
- C:\Windows\System\ewDwxHM.exe
  C:\Windows\System\ewDwxHM.exe
  2⤵
  PID:3652
- C:\Windows\System\WMLdMUM.exe
  C:\Windows\System\WMLdMUM.exe
  2⤵
  PID:6200
- C:\Windows\System\JMafuVG.exe
  C:\Windows\System\JMafuVG.exe
  2⤵
  PID:6264
- C:\Windows\System\KIQfOKh.exe
  C:\Windows\System\KIQfOKh.exe
  2⤵
  PID:6332
- C:\Windows\System\tiDoFIh.exe
  C:\Windows\System\tiDoFIh.exe
  2⤵
  PID:6372
- C:\Windows\System\GCXgXjg.exe
  C:\Windows\System\GCXgXjg.exe
  2⤵
  PID:5240
- C:\Windows\System\agpQJJw.exe
  C:\Windows\System\agpQJJw.exe
  2⤵
  PID:5328
- C:\Windows\System\AFZLlvn.exe
  C:\Windows\System\AFZLlvn.exe
  2⤵
  PID:6432
- C:\Windows\System\iSNpcDc.exe
  C:\Windows\System\iSNpcDc.exe
  2⤵
  PID:6464
- C:\Windows\System\BKbmraQ.exe
  C:\Windows\System\BKbmraQ.exe
  2⤵
  PID:6500
- C:\Windows\System\ASGnSeA.exe
  C:\Windows\System\ASGnSeA.exe
  2⤵
  PID:6520
- C:\Windows\System\KxfkNZN.exe
  C:\Windows\System\KxfkNZN.exe
  2⤵
  PID:6536
- C:\Windows\System\SCgIEDx.exe
  C:\Windows\System\SCgIEDx.exe
  2⤵
  PID:6108
- C:\Windows\System\gLIPFok.exe
  C:\Windows\System\gLIPFok.exe
  2⤵
  PID:6604
- C:\Windows\System\pzqRyzg.exe
  C:\Windows\System\pzqRyzg.exe
  2⤵
  PID:6672
- C:\Windows\System\hrOTCYk.exe
  C:\Windows\System\hrOTCYk.exe
  2⤵
  PID:6768
- C:\Windows\System\syFlsaw.exe
  C:\Windows\System\syFlsaw.exe
  2⤵
  PID:6800
- C:\Windows\System\CCAfvGV.exe
  C:\Windows\System\CCAfvGV.exe
  2⤵
  PID:6864
- C:\Windows\System\FkXbQXw.exe
  C:\Windows\System\FkXbQXw.exe
  2⤵
  PID:6936
- C:\Windows\System\rnsMNbX.exe
  C:\Windows\System\rnsMNbX.exe
  2⤵
  PID:6956
- C:\Windows\System\XExtldw.exe
  C:\Windows\System\XExtldw.exe
  2⤵
  PID:6620
- C:\Windows\System\odyuUia.exe
  C:\Windows\System\odyuUia.exe
  2⤵
  PID:6920
- C:\Windows\System\wLAimrj.exe
  C:\Windows\System\wLAimrj.exe
  2⤵
  PID:6852
- C:\Windows\System\mCcphvV.exe
  C:\Windows\System\mCcphvV.exe
  2⤵
  PID:6788
- C:\Windows\System\JYSYxKx.exe
  C:\Windows\System\JYSYxKx.exe
  2⤵
  PID:6720
- C:\Windows\System\WmWkPMg.exe
  C:\Windows\System\WmWkPMg.exe
  2⤵
  PID:6972
- C:\Windows\System\cIHgNOU.exe
  C:\Windows\System\cIHgNOU.exe
  2⤵
  PID:7056
- C:\Windows\System\ZhWXVmC.exe
  C:\Windows\System\ZhWXVmC.exe
  2⤵
  PID:7164
- C:\Windows\System\JmeSceK.exe
  C:\Windows\System\JmeSceK.exe
  2⤵
  PID:7060
- C:\Windows\System\ZoXdFSd.exe
  C:\Windows\System\ZoXdFSd.exe
  2⤵
  PID:6988
- C:\Windows\System\ZRjklTm.exe
  C:\Windows\System\ZRjklTm.exe
  2⤵
  PID:7004
- C:\Windows\System\drIjetW.exe
  C:\Windows\System\drIjetW.exe
  2⤵
  PID:7020
- C:\Windows\System\DiSFsry.exe
  C:\Windows\System\DiSFsry.exe
  2⤵
  PID:7024
- C:\Windows\System\JsERTKG.exe
  C:\Windows\System\JsERTKG.exe
  2⤵
  PID:7052
- C:\Windows\System\FvktepR.exe
  C:\Windows\System\FvktepR.exe
  2⤵
  PID:7076
- C:\Windows\System\JzrafTV.exe
  C:\Windows\System\JzrafTV.exe
  2⤵
  PID:6152
- C:\Windows\System\qxIHOcr.exe
  C:\Windows\System\qxIHOcr.exe
  2⤵
  PID:5744
- C:\Windows\System\pVaqwrw.exe
  C:\Windows\System\pVaqwrw.exe
  2⤵
  PID:6288
- C:\Windows\System\bVxbsul.exe
  C:\Windows\System\bVxbsul.exe
  2⤵
  PID:6168
- C:\Windows\System\lKtpUCM.exe
  C:\Windows\System\lKtpUCM.exe
  2⤵
  PID:5508
- C:\Windows\System\PyfiStE.exe
  C:\Windows\System\PyfiStE.exe
  2⤵
  PID:4916
- C:\Windows\System\fBsnCTA.exe
  C:\Windows\System\fBsnCTA.exe
  2⤵
  PID:6368
- C:\Windows\System\MIPipNd.exe
  C:\Windows\System\MIPipNd.exe
  2⤵
  PID:6248
- C:\Windows\System\DBcGCWt.exe
  C:\Windows\System\DBcGCWt.exe
  2⤵
  PID:5212
- C:\Windows\System\QglwXON.exe
  C:\Windows\System\QglwXON.exe
  2⤵
  PID:2308
- C:\Windows\System\iPoYTZa.exe
  C:\Windows\System\iPoYTZa.exe
  2⤵
  PID:6572
- C:\Windows\System\bkdgbGy.exe
  C:\Windows\System\bkdgbGy.exe
  2⤵
  PID:6704
- C:\Windows\System\kiDgWil.exe
  C:\Windows\System\kiDgWil.exe
  2⤵
  PID:6836
- C:\Windows\System\pOyoYir.exe
  C:\Windows\System\pOyoYir.exe
  2⤵
  PID:6772
- C:\Windows\System\GkfOdKl.exe
  C:\Windows\System\GkfOdKl.exe
  2⤵
  PID:6544
- C:\Windows\System\EuelYdx.exe
  C:\Windows\System\EuelYdx.exe
  2⤵
  PID:6900
- C:\Windows\System\dtTATzv.exe
  C:\Windows\System\dtTATzv.exe
  2⤵
  PID:6560
- C:\Windows\System\OyXwBZP.exe
  C:\Windows\System\OyXwBZP.exe
  2⤵
  PID:6816
- C:\Windows\System\EDIDbHm.exe
  C:\Windows\System\EDIDbHm.exe
  2⤵
  PID:6756
- C:\Windows\System\qeTSFpb.exe
  C:\Windows\System\qeTSFpb.exe
  2⤵
  PID:7132
- C:\Windows\System\PZqsinI.exe
  C:\Windows\System\PZqsinI.exe
  2⤵
  PID:6980
- C:\Windows\System\JoCQgpC.exe
  C:\Windows\System\JoCQgpC.exe
  2⤵
  PID:5912
- C:\Windows\System\JgxPNMd.exe
  C:\Windows\System\JgxPNMd.exe
  2⤵
  PID:6996
- C:\Windows\System\SlHDTeW.exe
  C:\Windows\System\SlHDTeW.exe
  2⤵
  PID:7048
- C:\Windows\System\YAWyVQs.exe
  C:\Windows\System\YAWyVQs.exe
  2⤵
  PID:6184
- C:\Windows\System\FaOmjRF.exe
  C:\Windows\System\FaOmjRF.exe
  2⤵
  PID:6304
- C:\Windows\System\cLrdDaD.exe
  C:\Windows\System\cLrdDaD.exe
  2⤵
  PID:6236
- C:\Windows\System\sYMbuNf.exe
  C:\Windows\System\sYMbuNf.exe
  2⤵
  PID:6436
- C:\Windows\System\YZzLdsr.exe
  C:\Windows\System\YZzLdsr.exe
  2⤵
  PID:6420
- C:\Windows\System\umAddNC.exe
  C:\Windows\System\umAddNC.exe
  2⤵
  PID:7068
- C:\Windows\System\tBYVTSD.exe
  C:\Windows\System\tBYVTSD.exe
  2⤵
  PID:6516
- C:\Windows\System\vFyAQpp.exe
  C:\Windows\System\vFyAQpp.exe
  2⤵
  PID:6904
- C:\Windows\System\PRXMwke.exe
  C:\Windows\System\PRXMwke.exe
  2⤵
  PID:5388
- C:\Windows\System\MgSyEGv.exe
  C:\Windows\System\MgSyEGv.exe
  2⤵
  PID:6636
- C:\Windows\System\thGKoQb.exe
  C:\Windows\System\thGKoQb.exe
  2⤵
  PID:6752
- C:\Windows\System\UIjhXSs.exe
  C:\Windows\System\UIjhXSs.exe
  2⤵
  PID:6984
- C:\Windows\System\iCryINm.exe
  C:\Windows\System\iCryINm.exe
  2⤵
  PID:6348
- C:\Windows\System\BJbRZge.exe
  C:\Windows\System\BJbRZge.exe
  2⤵
  PID:6832
- C:\Windows\System\dnQZClO.exe
  C:\Windows\System\dnQZClO.exe
  2⤵
  PID:6880
- C:\Windows\System\YycaPbx.exe
  C:\Windows\System\YycaPbx.exe
  2⤵
  PID:7044
- C:\Windows\System\RlrjjWu.exe
  C:\Windows\System\RlrjjWu.exe
  2⤵
  PID:7120
- C:\Windows\System\ZVbOhXC.exe
  C:\Windows\System\ZVbOhXC.exe
  2⤵
  PID:7016
- C:\Windows\System\zakposY.exe
  C:\Windows\System\zakposY.exe
  2⤵
  PID:6364
- C:\Windows\System\ulGxirv.exe
  C:\Windows\System\ulGxirv.exe
  2⤵
  PID:6484
- C:\Windows\System\dcKwVPe.exe
  C:\Windows\System\dcKwVPe.exe
  2⤵
  PID:7032
- C:\Windows\System\VOAscJw.exe
  C:\Windows\System\VOAscJw.exe
  2⤵
  PID:7176
- C:\Windows\System\GLijvXF.exe
  C:\Windows\System\GLijvXF.exe
  2⤵
  PID:7192
- C:\Windows\System\vmLmhLk.exe
  C:\Windows\System\vmLmhLk.exe
  2⤵
  PID:7208
- C:\Windows\System\gApVnzB.exe
  C:\Windows\System\gApVnzB.exe
  2⤵
  PID:7224
- C:\Windows\System\atVpUBu.exe
  C:\Windows\System\atVpUBu.exe
  2⤵
  PID:7240
- C:\Windows\System\akolcKV.exe
  C:\Windows\System\akolcKV.exe
  2⤵
  PID:7256
- C:\Windows\System\PHBkCDC.exe
  C:\Windows\System\PHBkCDC.exe
  2⤵
  PID:7276
- C:\Windows\System\yrgEfPk.exe
  C:\Windows\System\yrgEfPk.exe
  2⤵
  PID:7292
- C:\Windows\System\gUNJmiB.exe
  C:\Windows\System\gUNJmiB.exe
  2⤵
  PID:7308
- C:\Windows\System\qWbzOtb.exe
  C:\Windows\System\qWbzOtb.exe
  2⤵
  PID:7324
- C:\Windows\System\VOCljrT.exe
  C:\Windows\System\VOCljrT.exe
  2⤵
  PID:7340
- C:\Windows\System\dZVLknR.exe
  C:\Windows\System\dZVLknR.exe
  2⤵
  PID:7356
- C:\Windows\System\fjYKILG.exe
  C:\Windows\System\fjYKILG.exe
  2⤵
  PID:7372
- C:\Windows\System\xzhHuHv.exe
  C:\Windows\System\xzhHuHv.exe
  2⤵
  PID:7388
- C:\Windows\System\XpSRoro.exe
  C:\Windows\System\XpSRoro.exe
  2⤵
  PID:7404
- C:\Windows\System\XIbQYOo.exe
  C:\Windows\System\XIbQYOo.exe
  2⤵
  PID:7420
- C:\Windows\System\COFlrVC.exe
  C:\Windows\System\COFlrVC.exe
  2⤵
  PID:7436
- C:\Windows\System\CGzmZuq.exe
  C:\Windows\System\CGzmZuq.exe
  2⤵
  PID:7456
- C:\Windows\System\twMwBmw.exe
  C:\Windows\System\twMwBmw.exe
  2⤵
  PID:7472
- C:\Windows\System\IlvFZzD.exe
  C:\Windows\System\IlvFZzD.exe
  2⤵
  PID:7492
- C:\Windows\System\yuaEajZ.exe
  C:\Windows\System\yuaEajZ.exe
  2⤵
  PID:7508
- C:\Windows\System\chXgdrC.exe
  C:\Windows\System\chXgdrC.exe
  2⤵
  PID:7524
- C:\Windows\System\BIrPfPt.exe
  C:\Windows\System\BIrPfPt.exe
  2⤵
  PID:7540
- C:\Windows\System\gUWttNw.exe
  C:\Windows\System\gUWttNw.exe
  2⤵
  PID:7556
- C:\Windows\System\PeIfFzf.exe
  C:\Windows\System\PeIfFzf.exe
  2⤵
  PID:7572
- C:\Windows\System\gZhrCmy.exe
  C:\Windows\System\gZhrCmy.exe
  2⤵
  PID:7588
- C:\Windows\System\oCqnmwl.exe
  C:\Windows\System\oCqnmwl.exe
  2⤵
  PID:7604
- C:\Windows\System\WTHFpwJ.exe
  C:\Windows\System\WTHFpwJ.exe
  2⤵
  PID:7620
- C:\Windows\System\hokjXpf.exe
  C:\Windows\System\hokjXpf.exe
  2⤵
  PID:7640
- C:\Windows\System\WuPDMJq.exe
  C:\Windows\System\WuPDMJq.exe
  2⤵
  PID:7656
- C:\Windows\System\KfWReAi.exe
  C:\Windows\System\KfWReAi.exe
  2⤵
  PID:7728
- C:\Windows\System\zdgnlsN.exe
  C:\Windows\System\zdgnlsN.exe
  2⤵
  PID:7744
- C:\Windows\System\oULOQgb.exe
  C:\Windows\System\oULOQgb.exe
  2⤵
  PID:7760
- C:\Windows\System\giCCYUT.exe
  C:\Windows\System\giCCYUT.exe
  2⤵
  PID:7780
- C:\Windows\System\zEzdMKu.exe
  C:\Windows\System\zEzdMKu.exe
  2⤵
  PID:7796
- C:\Windows\System\MWxyFJf.exe
  C:\Windows\System\MWxyFJf.exe
  2⤵
  PID:7812
- C:\Windows\System\cOCQuty.exe
  C:\Windows\System\cOCQuty.exe
  2⤵
  PID:7828
- C:\Windows\System\ZbkJfOA.exe
  C:\Windows\System\ZbkJfOA.exe
  2⤵
  PID:7844
- C:\Windows\System\JyGMyIi.exe
  C:\Windows\System\JyGMyIi.exe
  2⤵
  PID:7864
- C:\Windows\System\otuHSYM.exe
  C:\Windows\System\otuHSYM.exe
  2⤵
  PID:7880
- C:\Windows\System\BgQDAjX.exe
  C:\Windows\System\BgQDAjX.exe
  2⤵
  PID:7896
- C:\Windows\System\ZPpBxVA.exe
  C:\Windows\System\ZPpBxVA.exe
  2⤵
  PID:7912
- C:\Windows\System\WVpfdiI.exe
  C:\Windows\System\WVpfdiI.exe
  2⤵
  PID:7928
- C:\Windows\System\cLraaFb.exe
  C:\Windows\System\cLraaFb.exe
  2⤵
  PID:7944
- C:\Windows\System\hUUrvcT.exe
  C:\Windows\System\hUUrvcT.exe
  2⤵
  PID:7988
- C:\Windows\System\GRxPmAK.exe
  C:\Windows\System\GRxPmAK.exe
  2⤵
  PID:8004
- C:\Windows\System\udtipnb.exe
  C:\Windows\System\udtipnb.exe
  2⤵
  PID:8020
- C:\Windows\System\iYkvLoH.exe
  C:\Windows\System\iYkvLoH.exe
  2⤵
  PID:8036
- C:\Windows\System\kwJvQGy.exe
  C:\Windows\System\kwJvQGy.exe
  2⤵
  PID:8052
- C:\Windows\System\xwjUphk.exe
  C:\Windows\System\xwjUphk.exe
  2⤵
  PID:8072
- C:\Windows\System\guFPKvJ.exe
  C:\Windows\System\guFPKvJ.exe
  2⤵
  PID:8088
- C:\Windows\System\dHMQVSN.exe
  C:\Windows\System\dHMQVSN.exe
  2⤵
  PID:8104
- C:\Windows\System\UgsmiFx.exe
  C:\Windows\System\UgsmiFx.exe
  2⤵
  PID:8120
- C:\Windows\System\GbIaWbv.exe
  C:\Windows\System\GbIaWbv.exe
  2⤵
  PID:8136
- C:\Windows\System\aKbukbM.exe
  C:\Windows\System\aKbukbM.exe
  2⤵
  PID:8156
- C:\Windows\System\fMwjQdr.exe
  C:\Windows\System\fMwjQdr.exe
  2⤵
  PID:8172
- C:\Windows\System\boYvjvS.exe
  C:\Windows\System\boYvjvS.exe
  2⤵
  PID:8188
- C:\Windows\System\bzvoPxE.exe
  C:\Windows\System\bzvoPxE.exe
  2⤵
  PID:7216
- C:\Windows\System\vHemhBH.exe
  C:\Windows\System\vHemhBH.exe
  2⤵
  PID:6884
- C:\Windows\System\YORWMYH.exe
  C:\Windows\System\YORWMYH.exe
  2⤵
  PID:6820
- C:\Windows\System\NGWLxYW.exe
  C:\Windows\System\NGWLxYW.exe
  2⤵
  PID:7348
- C:\Windows\System\gSqBjlR.exe
  C:\Windows\System\gSqBjlR.exe
  2⤵
  PID:7452
- C:\Windows\System\kCcHpMl.exe
  C:\Windows\System\kCcHpMl.exe
  2⤵
  PID:7480
- C:\Windows\System\zdZagTt.exe
  C:\Windows\System\zdZagTt.exe
  2⤵
  PID:5856
- C:\Windows\System\YGmBFXq.exe
  C:\Windows\System\YGmBFXq.exe
  2⤵
  PID:7172
- C:\Windows\System\eGTVZLx.exe
  C:\Windows\System\eGTVZLx.exe
  2⤵
  PID:7552
- C:\Windows\System\EIkCkBO.exe
  C:\Windows\System\EIkCkBO.exe
  2⤵
  PID:7300
- C:\Windows\System\KOvVIvr.exe
  C:\Windows\System\KOvVIvr.exe
  2⤵
  PID:7612
- C:\Windows\System\ForYyhF.exe
  C:\Windows\System\ForYyhF.exe
  2⤵
  PID:7648
- C:\Windows\System\CSnFFjq.exe
  C:\Windows\System\CSnFFjq.exe
  2⤵
  PID:7272
- C:\Windows\System\uqrBNaR.exe
  C:\Windows\System\uqrBNaR.exe
  2⤵
  PID:7568
- C:\Windows\System\sDMzVso.exe
  C:\Windows\System\sDMzVso.exe
  2⤵
  PID:7464
- C:\Windows\System\BsWMQlW.exe
  C:\Windows\System\BsWMQlW.exe
  2⤵
  PID:7636
- C:\Windows\System\SgDkreC.exe
  C:\Windows\System\SgDkreC.exe
  2⤵
  PID:7632
- C:\Windows\System\kUmAyWo.exe
  C:\Windows\System\kUmAyWo.exe
  2⤵
  PID:7680
- C:\Windows\System\qDRDGnV.exe
  C:\Windows\System\qDRDGnV.exe
  2⤵
  PID:5408
- C:\Windows\System\hVvEHQH.exe
  C:\Windows\System\hVvEHQH.exe
  2⤵
  PID:7736
- C:\Windows\System\wybhnec.exe
  C:\Windows\System\wybhnec.exe
  2⤵
  PID:7724
- C:\Windows\System\DfEuBPq.exe
  C:\Windows\System\DfEuBPq.exe
  2⤵
  PID:7716
- C:\Windows\System\MdGyjGg.exe
  C:\Windows\System\MdGyjGg.exe
  2⤵
  PID:7840
- C:\Windows\System\YuwNoBl.exe
  C:\Windows\System\YuwNoBl.exe
  2⤵
  PID:7908
- C:\Windows\System\xvuGKHq.exe
  C:\Windows\System\xvuGKHq.exe
  2⤵
  PID:7824
- C:\Windows\System\vZLPKqJ.exe
  C:\Windows\System\vZLPKqJ.exe
  2⤵
  PID:7860
- C:\Windows\System\gVhSUjI.exe
  C:\Windows\System\gVhSUjI.exe
  2⤵
  PID:7924
- C:\Windows\System\uazoGCW.exe
  C:\Windows\System\uazoGCW.exe
  2⤵
  PID:7960
- C:\Windows\System\dazCXtB.exe
  C:\Windows\System\dazCXtB.exe
  2⤵
  PID:8164
- C:\Windows\System\nVhfCAR.exe
  C:\Windows\System\nVhfCAR.exe
  2⤵
  PID:3640
- C:\Windows\System\GhHiHeJ.exe
  C:\Windows\System\GhHiHeJ.exe
  2⤵
  PID:8152
- C:\Windows\System\mFtRtQo.exe
  C:\Windows\System\mFtRtQo.exe
  2⤵
  PID:7488
- C:\Windows\System\ikaldqg.exe
  C:\Windows\System\ikaldqg.exe
  2⤵
  PID:8148
- C:\Windows\System\qYeucWS.exe
  C:\Windows\System\qYeucWS.exe
  2⤵
  PID:7268
- C:\Windows\System\uEjMLiG.exe
  C:\Windows\System\uEjMLiG.exe
  2⤵
  PID:7396
- C:\Windows\System\YSVpDYB.exe
  C:\Windows\System\YSVpDYB.exe
  2⤵
  PID:7600
- C:\Windows\System\lytHuEg.exe
  C:\Windows\System\lytHuEg.exe
  2⤵
  PID:7768
- C:\Windows\System\KAlyAum.exe
  C:\Windows\System\KAlyAum.exe
  2⤵
  PID:7136
- C:\Windows\System\ccpIdIn.exe
  C:\Windows\System\ccpIdIn.exe
  2⤵
  PID:7676
- C:\Windows\System\yKnRKJE.exe
  C:\Windows\System\yKnRKJE.exe
  2⤵
  PID:7416
- C:\Windows\System\vevyiXw.exe
  C:\Windows\System\vevyiXw.exe
  2⤵
  PID:7504
- C:\Windows\System\GfLNhAY.exe
  C:\Windows\System\GfLNhAY.exe
  2⤵
  PID:7264
- C:\Windows\System\siIsdDC.exe
  C:\Windows\System\siIsdDC.exe
  2⤵
  PID:7696
- C:\Windows\System\EkzKcVo.exe
  C:\Windows\System\EkzKcVo.exe
  2⤵
  PID:7876
- C:\Windows\System\pkYIAGs.exe
  C:\Windows\System\pkYIAGs.exe
  2⤵
  PID:7892
- C:\Windows\System\psANiYd.exe
  C:\Windows\System\psANiYd.exe
  2⤵
  PID:7968
- C:\Windows\System\XaiMiXN.exe
  C:\Windows\System\XaiMiXN.exe
  2⤵
  PID:7940
- C:\Windows\System\gZxyIDS.exe
  C:\Windows\System\gZxyIDS.exe
  2⤵
  PID:8060
- C:\Windows\System\CYzarKD.exe
  C:\Windows\System\CYzarKD.exe
  2⤵
  PID:8016
- C:\Windows\System\IKegRUv.exe
  C:\Windows\System\IKegRUv.exe
  2⤵
  PID:7980
- C:\Windows\System\tcyCCmq.exe
  C:\Windows\System\tcyCCmq.exe
  2⤵
  PID:8080
- C:\Windows\System\JrMvgON.exe
  C:\Windows\System\JrMvgON.exe
  2⤵
  PID:7184
- C:\Windows\System\momCmwM.exe
  C:\Windows\System\momCmwM.exe
  2⤵
  PID:8184
- C:\Windows\System\kHrAJlH.exe
  C:\Windows\System\kHrAJlH.exe
  2⤵
  PID:7204
- C:\Windows\System\COFHuPK.exe
  C:\Windows\System\COFHuPK.exe
  2⤵
  PID:7580
- C:\Windows\System\hSufdhD.exe
  C:\Windows\System\hSufdhD.exe
  2⤵
  PID:7536
- C:\Windows\System\uCEBxEa.exe
  C:\Windows\System\uCEBxEa.exe
  2⤵
  PID:7564
- C:\Windows\System\QsgLNLS.exe
  C:\Windows\System\QsgLNLS.exe
  2⤵
  PID:7836
- C:\Windows\System\nYTQAEh.exe
  C:\Windows\System\nYTQAEh.exe
  2⤵
  PID:7332
- C:\Windows\System\xvrBagy.exe
  C:\Windows\System\xvrBagy.exe
  2⤵
  PID:7996
- C:\Windows\System\LJuQcAF.exe
  C:\Windows\System\LJuQcAF.exe
  2⤵
  PID:8044
- C:\Windows\System\FrJdYwz.exe
  C:\Windows\System\FrJdYwz.exe
  2⤵
  PID:8112
- C:\Windows\System\uFAEQQS.exe
  C:\Windows\System\uFAEQQS.exe
  2⤵
  PID:7752
- C:\Windows\System\DvYWhRU.exe
  C:\Windows\System\DvYWhRU.exe
  2⤵
  PID:8028
- C:\Windows\System\JQvazta.exe
  C:\Windows\System\JQvazta.exe
  2⤵
  PID:8084
- C:\Windows\System\QTHXwif.exe
  C:\Windows\System\QTHXwif.exe
  2⤵
  PID:7364
- C:\Windows\System\kdooHWH.exe
  C:\Windows\System\kdooHWH.exe
  2⤵
  PID:7316
- C:\Windows\System\htYTMhK.exe
  C:\Windows\System\htYTMhK.exe
  2⤵
  PID:8064
- C:\Windows\System\keBJTlf.exe
  C:\Windows\System\keBJTlf.exe
  2⤵
  PID:7688
- C:\Windows\System\CwEFKoq.exe
  C:\Windows\System\CwEFKoq.exe
  2⤵
  PID:7628
- C:\Windows\System\cKcNkCy.exe
  C:\Windows\System\cKcNkCy.exe
  2⤵
  PID:7712
- C:\Windows\System\NqFCjSi.exe
  C:\Windows\System\NqFCjSi.exe
  2⤵
  PID:8208
- C:\Windows\System\fQJiWQQ.exe
  C:\Windows\System\fQJiWQQ.exe
  2⤵
  PID:8224
- C:\Windows\System\wnLvHwx.exe
  C:\Windows\System\wnLvHwx.exe
  2⤵
  PID:8240
- C:\Windows\System\wWLQwXE.exe
  C:\Windows\System\wWLQwXE.exe
  2⤵
  PID:8256
- C:\Windows\System\ZVaiadP.exe
  C:\Windows\System\ZVaiadP.exe
  2⤵
  PID:8272
- C:\Windows\System\NAZayTt.exe
  C:\Windows\System\NAZayTt.exe
  2⤵
  PID:8288
- C:\Windows\System\uXrSuiE.exe
  C:\Windows\System\uXrSuiE.exe
  2⤵
  PID:8304
- C:\Windows\System\lAEITkO.exe
  C:\Windows\System\lAEITkO.exe
  2⤵
  PID:8320
- C:\Windows\System\hRIQffp.exe
  C:\Windows\System\hRIQffp.exe
  2⤵
  PID:8336
- C:\Windows\System\MZglmHo.exe
  C:\Windows\System\MZglmHo.exe
  2⤵
  PID:8352
- C:\Windows\System\eHlTKfa.exe
  C:\Windows\System\eHlTKfa.exe
  2⤵
  PID:8368
- C:\Windows\System\TLqCrws.exe
  C:\Windows\System\TLqCrws.exe
  2⤵
  PID:8384
- C:\Windows\System\HOAyMsC.exe
  C:\Windows\System\HOAyMsC.exe
  2⤵
  PID:8400
- C:\Windows\System\FsQBKby.exe
  C:\Windows\System\FsQBKby.exe
  2⤵
  PID:8416
- C:\Windows\System\PWvdRXw.exe
  C:\Windows\System\PWvdRXw.exe
  2⤵
  PID:8432
- C:\Windows\System\UddiGnp.exe
  C:\Windows\System\UddiGnp.exe
  2⤵
  PID:8448
- C:\Windows\System\wKqLIjp.exe
  C:\Windows\System\wKqLIjp.exe
  2⤵
  PID:8464
- C:\Windows\System\AeAdqTN.exe
  C:\Windows\System\AeAdqTN.exe
  2⤵
  PID:8484
- C:\Windows\System\cyhXPbE.exe
  C:\Windows\System\cyhXPbE.exe
  2⤵
  PID:8500
- C:\Windows\System\ZjdDDLC.exe
  C:\Windows\System\ZjdDDLC.exe
  2⤵
  PID:8520
- C:\Windows\System\nbpSvpD.exe
  C:\Windows\System\nbpSvpD.exe
  2⤵
  PID:8536
- C:\Windows\System\sizuRiq.exe
  C:\Windows\System\sizuRiq.exe
  2⤵
  PID:8552
- C:\Windows\System\eEOfflo.exe
  C:\Windows\System\eEOfflo.exe
  2⤵
  PID:8568
- C:\Windows\System\TbrVuic.exe
  C:\Windows\System\TbrVuic.exe
  2⤵
  PID:8584
- C:\Windows\System\YUCVCzb.exe
  C:\Windows\System\YUCVCzb.exe
  2⤵
  PID:8600
- C:\Windows\System\YYaGCCB.exe
  C:\Windows\System\YYaGCCB.exe
  2⤵
  PID:8616
- C:\Windows\System\KLVajGh.exe
  C:\Windows\System\KLVajGh.exe
  2⤵
  PID:8632
- C:\Windows\System\uKxRrcq.exe
  C:\Windows\System\uKxRrcq.exe
  2⤵
  PID:8648
- C:\Windows\System\SiLHsLr.exe
  C:\Windows\System\SiLHsLr.exe
  2⤵
  PID:8664
- C:\Windows\System\eakAwNz.exe
  C:\Windows\System\eakAwNz.exe
  2⤵
  PID:8680
- C:\Windows\System\nMtJpga.exe
  C:\Windows\System\nMtJpga.exe
  2⤵
  PID:8696
- C:\Windows\System\tvaaKGL.exe
  C:\Windows\System\tvaaKGL.exe
  2⤵
  PID:8712
- C:\Windows\System\XIDhgHC.exe
  C:\Windows\System\XIDhgHC.exe
  2⤵
  PID:8728
- C:\Windows\System\CYKlSmh.exe
  C:\Windows\System\CYKlSmh.exe
  2⤵
  PID:8744
- C:\Windows\System\iRibKhE.exe
  C:\Windows\System\iRibKhE.exe
  2⤵
  PID:8760
- C:\Windows\System\NHRBhiN.exe
  C:\Windows\System\NHRBhiN.exe
  2⤵
  PID:8776
- C:\Windows\System\oUhgmJK.exe
  C:\Windows\System\oUhgmJK.exe
  2⤵
  PID:8792
- C:\Windows\System\bgIgGxN.exe
  C:\Windows\System\bgIgGxN.exe
  2⤵
  PID:8808
- C:\Windows\System\xHDINob.exe
  C:\Windows\System\xHDINob.exe
  2⤵
  PID:8824
- C:\Windows\System\OqVRvoD.exe
  C:\Windows\System\OqVRvoD.exe
  2⤵
  PID:8840
- C:\Windows\System\FRjTBZW.exe
  C:\Windows\System\FRjTBZW.exe
  2⤵
  PID:8856
- C:\Windows\System\rjrKozG.exe
  C:\Windows\System\rjrKozG.exe
  2⤵
  PID:8872
- C:\Windows\System\WufaFwB.exe
  C:\Windows\System\WufaFwB.exe
  2⤵
  PID:8888
- C:\Windows\System\zjasorR.exe
  C:\Windows\System\zjasorR.exe
  2⤵
  PID:8904
- C:\Windows\System\CFeKlNz.exe
  C:\Windows\System\CFeKlNz.exe
  2⤵
  PID:8920
- C:\Windows\System\JzfXSLK.exe
  C:\Windows\System\JzfXSLK.exe
  2⤵
  PID:8936
- C:\Windows\System\icjxxTu.exe
  C:\Windows\System\icjxxTu.exe
  2⤵
  PID:8956
- C:\Windows\System\hxJxmbW.exe
  C:\Windows\System\hxJxmbW.exe
  2⤵
  PID:8972
- C:\Windows\System\QYqPeLy.exe
  C:\Windows\System\QYqPeLy.exe
  2⤵
  PID:8988
- C:\Windows\System\DCCWYSb.exe
  C:\Windows\System\DCCWYSb.exe
  2⤵
  PID:9004
- C:\Windows\System\fZigomC.exe
  C:\Windows\System\fZigomC.exe
  2⤵
  PID:9020
- C:\Windows\System\GrrGqKE.exe
  C:\Windows\System\GrrGqKE.exe
  2⤵
  PID:9036
- C:\Windows\System\mngEhoC.exe
  C:\Windows\System\mngEhoC.exe
  2⤵
  PID:9052
- C:\Windows\System\ywUGbfl.exe
  C:\Windows\System\ywUGbfl.exe
  2⤵
  PID:9068
- C:\Windows\System\YRQoDVf.exe
  C:\Windows\System\YRQoDVf.exe
  2⤵
  PID:9084
- C:\Windows\System\wPEDdUi.exe
  C:\Windows\System\wPEDdUi.exe
  2⤵
  PID:9100
- C:\Windows\System\mrJCglA.exe
  C:\Windows\System\mrJCglA.exe
  2⤵
  PID:9116
- C:\Windows\System\XYlPpNT.exe
  C:\Windows\System\XYlPpNT.exe
  2⤵
  PID:9132
- C:\Windows\System\EkzCvRJ.exe
  C:\Windows\System\EkzCvRJ.exe
  2⤵
  PID:9148
- C:\Windows\System\VjQadsm.exe
  C:\Windows\System\VjQadsm.exe
  2⤵
  PID:9164
- C:\Windows\System\nWXmpCV.exe
  C:\Windows\System\nWXmpCV.exe
  2⤵
  PID:9180
- C:\Windows\System\ftDrQbH.exe
  C:\Windows\System\ftDrQbH.exe
  2⤵
  PID:9196
- C:\Windows\System\VIpqCsE.exe
  C:\Windows\System\VIpqCsE.exe
  2⤵
  PID:9212
- C:\Windows\System\bLadZvA.exe
  C:\Windows\System\bLadZvA.exe
  2⤵
  PID:8048
- C:\Windows\System\BGfRVIX.exe
  C:\Windows\System\BGfRVIX.exe
  2⤵
  PID:8248
- C:\Windows\System\gTIzytH.exe
  C:\Windows\System\gTIzytH.exe
  2⤵
  PID:8284
- C:\Windows\System\yVbxuKJ.exe
  C:\Windows\System\yVbxuKJ.exe
  2⤵
  PID:8348
- C:\Windows\System\PdtqXXB.exe
  C:\Windows\System\PdtqXXB.exe
  2⤵
  PID:8408
- C:\Windows\System\ponDJyp.exe
  C:\Windows\System\ponDJyp.exe
  2⤵
  PID:8232
- C:\Windows\System\TruJQpV.exe
  C:\Windows\System\TruJQpV.exe
  2⤵
  PID:8268
- C:\Windows\System\maxlWby.exe
  C:\Windows\System\maxlWby.exe
  2⤵
  PID:7448
- C:\Windows\System\dRvfyKt.exe
  C:\Windows\System\dRvfyKt.exe
  2⤵
  PID:8392
- C:\Windows\System\MRthSii.exe
  C:\Windows\System\MRthSii.exe
  2⤵
  PID:8328
- C:\Windows\System\lPalooP.exe
  C:\Windows\System\lPalooP.exe
  2⤵
  PID:8544
- C:\Windows\System\DNPcWbC.exe
  C:\Windows\System\DNPcWbC.exe
  2⤵
  PID:8608
- C:\Windows\System\BJxIfBG.exe
  C:\Windows\System\BJxIfBG.exe
  2⤵
  PID:8672
- C:\Windows\System\noiTAVu.exe
  C:\Windows\System\noiTAVu.exe
  2⤵
  PID:7288
- C:\Windows\System\CzNWQzx.exe
  C:\Windows\System\CzNWQzx.exe
  2⤵
  PID:8740
- C:\Windows\System\gwrMMoF.exe
  C:\Windows\System\gwrMMoF.exe
  2⤵
  PID:8800
- C:\Windows\System\eiLSmDM.exe
  C:\Windows\System\eiLSmDM.exe
  2⤵
  PID:8864
- C:\Windows\System\nqUyyjv.exe
  C:\Windows\System\nqUyyjv.exe
  2⤵
  PID:8928
- C:\Windows\System\zHzQwQo.exe
  C:\Windows\System\zHzQwQo.exe
  2⤵
  PID:8816
- C:\Windows\System\IosZYjc.exe
  C:\Windows\System\IosZYjc.exe
  2⤵
  PID:8912
- C:\Windows\System\mbaIUfa.exe
  C:\Windows\System\mbaIUfa.exe
  2⤵
  PID:8496
- C:\Windows\System\xXQBkoI.exe
  C:\Windows\System\xXQBkoI.exe
  2⤵
  PID:8564
- C:\Windows\System\zTOXUst.exe
  C:\Windows\System\zTOXUst.exe
  2⤵
  PID:8628
- C:\Windows\System\iuwlzmP.exe
  C:\Windows\System\iuwlzmP.exe
  2⤵
  PID:8692
- C:\Windows\System\aBjsxjx.exe
  C:\Windows\System\aBjsxjx.exe
  2⤵
  PID:9000
- C:\Windows\System\gwelzjL.exe
  C:\Windows\System\gwelzjL.exe
  2⤵
  PID:8788
- C:\Windows\System\znPneSq.exe
  C:\Windows\System\znPneSq.exe
  2⤵
  PID:8944
- C:\Windows\System\CCXHbEC.exe
  C:\Windows\System\CCXHbEC.exe
  2⤵
  PID:8984
- C:\Windows\System\TDlqfWN.exe
  C:\Windows\System\TDlqfWN.exe
  2⤵
  PID:9044
- C:\Windows\System\uMLslGU.exe
  C:\Windows\System\uMLslGU.exe
  2⤵
  PID:9092
- C:\Windows\System\utxuzgQ.exe
  C:\Windows\System\utxuzgQ.exe
  2⤵
  PID:9156
- C:\Windows\System\UhLrFPh.exe
  C:\Windows\System\UhLrFPh.exe
  2⤵
  PID:7964
- C:\Windows\System\TWGkvOE.exe
  C:\Windows\System\TWGkvOE.exe
  2⤵
  PID:9176
- C:\Windows\System\XSnqaIm.exe
  C:\Windows\System\XSnqaIm.exe
  2⤵
  PID:9108
- C:\Windows\System\CEfsppq.exe
  C:\Windows\System\CEfsppq.exe
  2⤵
  PID:8220
- C:\Windows\System\qvZqMoV.exe
  C:\Windows\System\qvZqMoV.exe
  2⤵
  PID:8344
- C:\Windows\System\CnXBaAU.exe
  C:\Windows\System\CnXBaAU.exe
  2⤵
  PID:8316
- C:\Windows\System\luNBmij.exe
  C:\Windows\System\luNBmij.exe
  2⤵
  PID:8444
- C:\Windows\System\QlwNAyU.exe
  C:\Windows\System\QlwNAyU.exe
  2⤵
  PID:8640
- C:\Windows\System\WdDIqNd.exe
  C:\Windows\System\WdDIqNd.exe
  2⤵
  PID:8704
- C:\Windows\System\XvMExHo.exe
  C:\Windows\System\XvMExHo.exe
  2⤵
  PID:8512
- C:\Windows\System\RiUwKZn.exe
  C:\Windows\System\RiUwKZn.exe
  2⤵
  PID:8832
- C:\Windows\System\xwQJXQQ.exe
  C:\Windows\System\xwQJXQQ.exe
  2⤵
  PID:8460
- C:\Windows\System\BvDVGrc.exe
  C:\Windows\System\BvDVGrc.exe
  2⤵
  PID:8880
- C:\Windows\System\REICpET.exe
  C:\Windows\System\REICpET.exe
  2⤵
  PID:8884
- C:\Windows\System\QYRdUlI.exe
  C:\Windows\System\QYRdUlI.exe
  2⤵
  PID:9124
- C:\Windows\System\XqwkfXb.exe
  C:\Windows\System\XqwkfXb.exe
  2⤵
  PID:8252
- C:\Windows\System\JrYlvmp.exe
  C:\Windows\System\JrYlvmp.exe
  2⤵
  PID:9208
- C:\Windows\System\GpusyWc.exe
  C:\Windows\System\GpusyWc.exe
  2⤵
  PID:9204
- C:\Windows\System\TfplcKf.exe
  C:\Windows\System\TfplcKf.exe
  2⤵
  PID:7972
- C:\Windows\System\JMeayBc.exe
  C:\Windows\System\JMeayBc.exe
  2⤵
  PID:8980
- C:\Windows\System\oulGoeu.exe
  C:\Windows\System\oulGoeu.exe
  2⤵
  PID:8592
- C:\Windows\System\NJtIGNi.exe
  C:\Windows\System\NJtIGNi.exe
  2⤵
  PID:9140
- C:\Windows\System\kKSdfzH.exe
  C:\Windows\System\kKSdfzH.exe
  2⤵
  PID:9192
- C:\Windows\System\fLWNGIi.exe
  C:\Windows\System\fLWNGIi.exe
  2⤵
  PID:9128
- C:\Windows\System\gatuoet.exe
  C:\Windows\System\gatuoet.exe
  2⤵
  PID:8424
- C:\Windows\System\RtwPvDn.exe
  C:\Windows\System\RtwPvDn.exe
  2⤵
  PID:8768
- C:\Windows\System\YmMXzbx.exe
  C:\Windows\System\YmMXzbx.exe
  2⤵
  PID:8896
- C:\Windows\System\nWlvDqw.exe
  C:\Windows\System\nWlvDqw.exe
  2⤵
  PID:8948
- C:\Windows\System\PQcBDWo.exe
  C:\Windows\System\PQcBDWo.exe
  2⤵
  PID:8624
- C:\Windows\System\afTidKO.exe
  C:\Windows\System\afTidKO.exe
  2⤵
  PID:8560
- C:\Windows\System\UxQYtHs.exe
  C:\Windows\System\UxQYtHs.exe
  2⤵
  PID:8476
- C:\Windows\System\wFAmhHB.exe
  C:\Windows\System\wFAmhHB.exe
  2⤵
  PID:8772
- C:\Windows\System\Ufoyxhl.exe
  C:\Windows\System\Ufoyxhl.exe
  2⤵
  PID:8900
- C:\Windows\System\VMQLjmU.exe
  C:\Windows\System\VMQLjmU.exe
  2⤵
  PID:9064
- C:\Windows\System\kHkRYsH.exe
  C:\Windows\System\kHkRYsH.exe
  2⤵
  PID:8264
- C:\Windows\System\mMaDYWO.exe
  C:\Windows\System\mMaDYWO.exe
  2⤵
  PID:9220
- C:\Windows\System\WoWZWvE.exe
  C:\Windows\System\WoWZWvE.exe
  2⤵
  PID:9236
- C:\Windows\System\DWIgIke.exe
  C:\Windows\System\DWIgIke.exe
  2⤵
  PID:9252
- C:\Windows\System\yFeEuuC.exe
  C:\Windows\System\yFeEuuC.exe
  2⤵
  PID:9272
- C:\Windows\System\jOUNqBD.exe
  C:\Windows\System\jOUNqBD.exe
  2⤵
  PID:9288
- C:\Windows\System\TTYUBDQ.exe
  C:\Windows\System\TTYUBDQ.exe
  2⤵
  PID:9304
- C:\Windows\System\TKGiuSC.exe
  C:\Windows\System\TKGiuSC.exe
  2⤵
  PID:9320
- C:\Windows\System\deqcZvR.exe
  C:\Windows\System\deqcZvR.exe
  2⤵
  PID:9336
- C:\Windows\System\onyMJxw.exe
  C:\Windows\System\onyMJxw.exe
  2⤵
  PID:9352
- C:\Windows\System\CUiGjcg.exe
  C:\Windows\System\CUiGjcg.exe
  2⤵
  PID:9368
- C:\Windows\System\nFKVNyk.exe
  C:\Windows\System\nFKVNyk.exe
  2⤵
  PID:9384
- C:\Windows\System\PBSPmfZ.exe
  C:\Windows\System\PBSPmfZ.exe
  2⤵
  PID:9400
- C:\Windows\System\RSJgcYz.exe
  C:\Windows\System\RSJgcYz.exe
  2⤵
  PID:9416
- C:\Windows\System\qgmpBwS.exe
  C:\Windows\System\qgmpBwS.exe
  2⤵
  PID:9432
- C:\Windows\System\jIdAzsE.exe
  C:\Windows\System\jIdAzsE.exe
  2⤵
  PID:9448
- C:\Windows\System\caZfcym.exe
  C:\Windows\System\caZfcym.exe
  2⤵
  PID:9464
- C:\Windows\System\javNFlG.exe
  C:\Windows\System\javNFlG.exe
  2⤵
  PID:9484
- C:\Windows\System\yxGkfYp.exe
  C:\Windows\System\yxGkfYp.exe
  2⤵
  PID:9500
- C:\Windows\System\QptPgvD.exe
  C:\Windows\System\QptPgvD.exe
  2⤵
  PID:9516
- C:\Windows\System\fhZqHoY.exe
  C:\Windows\System\fhZqHoY.exe
  2⤵
  PID:9532
- C:\Windows\System\IAaRsQV.exe
  C:\Windows\System\IAaRsQV.exe
  2⤵
  PID:9548
- C:\Windows\System\WxMqVIa.exe
  C:\Windows\System\WxMqVIa.exe
  2⤵
  PID:9564
- C:\Windows\System\UPDRdDE.exe
  C:\Windows\System\UPDRdDE.exe
  2⤵
  PID:9580
- C:\Windows\System\nHZfxCp.exe
  C:\Windows\System\nHZfxCp.exe
  2⤵
  PID:9596
- C:\Windows\System\eERPMnH.exe
  C:\Windows\System\eERPMnH.exe
  2⤵
  PID:9612
- C:\Windows\System\wMJxHUI.exe
  C:\Windows\System\wMJxHUI.exe
  2⤵
  PID:9628
- C:\Windows\System\hamGkkQ.exe
  C:\Windows\System\hamGkkQ.exe
  2⤵
  PID:9644
- C:\Windows\System\KBxLUJt.exe
  C:\Windows\System\KBxLUJt.exe
  2⤵
  PID:9660
- C:\Windows\System\IxnpmgX.exe
  C:\Windows\System\IxnpmgX.exe
  2⤵
  PID:9676
- C:\Windows\System\xdHxzNM.exe
  C:\Windows\System\xdHxzNM.exe
  2⤵
  PID:9692
- C:\Windows\System\VJWUhwL.exe
  C:\Windows\System\VJWUhwL.exe
  2⤵
  PID:9708
- C:\Windows\System\lByZxHc.exe
  C:\Windows\System\lByZxHc.exe
  2⤵
  PID:9724
- C:\Windows\System\mHtlqcG.exe
  C:\Windows\System\mHtlqcG.exe
  2⤵
  PID:9740
- C:\Windows\System\cycSuVw.exe
  C:\Windows\System\cycSuVw.exe
  2⤵
  PID:9756
- C:\Windows\System\gJjInuO.exe
  C:\Windows\System\gJjInuO.exe
  2⤵
  PID:9772
- C:\Windows\System\aOfZNqc.exe
  C:\Windows\System\aOfZNqc.exe
  2⤵
  PID:9788
- C:\Windows\System\gSLjjNJ.exe
  C:\Windows\System\gSLjjNJ.exe
  2⤵
  PID:9804
- C:\Windows\System\XuBKbpu.exe
  C:\Windows\System\XuBKbpu.exe
  2⤵
  PID:9820
- C:\Windows\System\mIPgvsJ.exe
  C:\Windows\System\mIPgvsJ.exe
  2⤵
  PID:9836
- C:\Windows\System\ASgvYMT.exe
  C:\Windows\System\ASgvYMT.exe
  2⤵
  PID:9852
- C:\Windows\System\AATghOh.exe
  C:\Windows\System\AATghOh.exe
  2⤵
  PID:9868
- C:\Windows\System\YobOPYs.exe
  C:\Windows\System\YobOPYs.exe
  2⤵
  PID:9884
- C:\Windows\System\PLYictN.exe
  C:\Windows\System\PLYictN.exe
  2⤵
  PID:9900
- C:\Windows\System\yiyySwd.exe
  C:\Windows\System\yiyySwd.exe
  2⤵
  PID:9916
- C:\Windows\System\ndcXNWZ.exe
  C:\Windows\System\ndcXNWZ.exe
  2⤵
  PID:9932
- C:\Windows\System\dkTcTcU.exe
  C:\Windows\System\dkTcTcU.exe
  2⤵
  PID:9948
- C:\Windows\System\bUthfTj.exe
  C:\Windows\System\bUthfTj.exe
  2⤵
  PID:9964
- C:\Windows\System\npMAOvF.exe
  C:\Windows\System\npMAOvF.exe
  2⤵
  PID:9980
- C:\Windows\System\bIjJGgk.exe
  C:\Windows\System\bIjJGgk.exe
  2⤵
  PID:9996
- C:\Windows\System\TQaWphV.exe
  C:\Windows\System\TQaWphV.exe
  2⤵
  PID:10012
- C:\Windows\System\NQJxlXA.exe
  C:\Windows\System\NQJxlXA.exe
  2⤵
  PID:10028
- C:\Windows\System\DnuKTrr.exe
  C:\Windows\System\DnuKTrr.exe
  2⤵
  PID:10044
- C:\Windows\System\vCzGSMZ.exe
  C:\Windows\System\vCzGSMZ.exe
  2⤵
  PID:10060
- C:\Windows\System\ZgIrLzE.exe
  C:\Windows\System\ZgIrLzE.exe
  2⤵
  PID:10076
- C:\Windows\System\QLEcdrC.exe
  C:\Windows\System\QLEcdrC.exe
  2⤵
  PID:10092
- C:\Windows\System\sysVAaj.exe
  C:\Windows\System\sysVAaj.exe
  2⤵
  PID:10108
- C:\Windows\System\WeTqCiw.exe
  C:\Windows\System\WeTqCiw.exe
  2⤵
  PID:10124
- C:\Windows\System\wxgaDBJ.exe
  C:\Windows\System\wxgaDBJ.exe
  2⤵
  PID:10140
- C:\Windows\System\UkfZQoF.exe
  C:\Windows\System\UkfZQoF.exe
  2⤵
  PID:10156
- C:\Windows\System\bPGRnor.exe
  C:\Windows\System\bPGRnor.exe
  2⤵
  PID:10172
- C:\Windows\System\IiVNvFs.exe
  C:\Windows\System\IiVNvFs.exe
  2⤵
  PID:10188
- C:\Windows\System\UrBNqJa.exe
  C:\Windows\System\UrBNqJa.exe
  2⤵
  PID:10204
- C:\Windows\System\SxGJpwG.exe
  C:\Windows\System\SxGJpwG.exe
  2⤵
  PID:10220
- C:\Windows\System\BjxSjOT.exe
  C:\Windows\System\BjxSjOT.exe
  2⤵
  PID:10236
- C:\Windows\System\BMcyNzM.exe
  C:\Windows\System\BMcyNzM.exe
  2⤵
  PID:9248
- C:\Windows\System\yWcpPxA.exe
  C:\Windows\System\yWcpPxA.exe
  2⤵
  PID:9012
- C:\Windows\System\bIpQPgi.exe
  C:\Windows\System\bIpQPgi.exe
  2⤵
  PID:9284
- C:\Windows\System\ctyzSqT.exe
  C:\Windows\System\ctyzSqT.exe
  2⤵
  PID:9316
- C:\Windows\System\aZRhVzC.exe
  C:\Windows\System\aZRhVzC.exe
  2⤵
  PID:9380
- C:\Windows\System\RuNdnzN.exe
  C:\Windows\System\RuNdnzN.exe
  2⤵
  PID:9444
- C:\Windows\System\ATQqGRl.exe
  C:\Windows\System\ATQqGRl.exe
  2⤵
  PID:9396
- C:\Windows\System\dfqrSbB.exe
  C:\Windows\System\dfqrSbB.exe
  2⤵
  PID:9328
- C:\Windows\System\XKEygeK.exe
  C:\Windows\System\XKEygeK.exe
  2⤵
  PID:9428
- C:\Windows\System\QjzhZEw.exe
  C:\Windows\System\QjzhZEw.exe
  2⤵
  PID:9492
- C:\Windows\System\KzJFegm.exe
  C:\Windows\System\KzJFegm.exe
  2⤵
  PID:9544
- C:\Windows\System\LokCrcD.exe
  C:\Windows\System\LokCrcD.exe
  2⤵
  PID:9608
- C:\Windows\System\iFFPgsV.exe
  C:\Windows\System\iFFPgsV.exe
  2⤵
  PID:9556
- C:\Windows\System\ErJaRFf.exe
  C:\Windows\System\ErJaRFf.exe
  2⤵
  PID:9668
- C:\Windows\System\aFbDYgH.exe
  C:\Windows\System\aFbDYgH.exe
  2⤵
  PID:9732
- C:\Windows\System\gTWcimn.exe
  C:\Windows\System\gTWcimn.exe
  2⤵
  PID:9768
- C:\Windows\System\grGKcqs.exe
  C:\Windows\System\grGKcqs.exe
  2⤵
  PID:9652
- C:\Windows\System\HPrAWcF.exe
  C:\Windows\System\HPrAWcF.exe
  2⤵
  PID:9688
- C:\Windows\System\mFJBaMD.exe
  C:\Windows\System\mFJBaMD.exe
  2⤵
  PID:9748
- C:\Windows\System\qZMikTE.exe
  C:\Windows\System\qZMikTE.exe
  2⤵
  PID:9784
- C:\Windows\System\TREUgXH.exe
  C:\Windows\System\TREUgXH.exe
  2⤵
  PID:9848
- C:\Windows\System\zrRLCFw.exe
  C:\Windows\System\zrRLCFw.exe
  2⤵
  PID:9880
- C:\Windows\System\kxGKOhM.exe
  C:\Windows\System\kxGKOhM.exe
  2⤵
  PID:9928
- C:\Windows\System\lXUlrzY.exe
  C:\Windows\System\lXUlrzY.exe
  2⤵
  PID:9944
- C:\Windows\System\OLFyBPD.exe
  C:\Windows\System\OLFyBPD.exe
  2⤵
  PID:10020
- C:\Windows\System\cHrYsyU.exe
  C:\Windows\System\cHrYsyU.exe
  2⤵
  PID:10008
- C:\Windows\System\fnRdxGj.exe
  C:\Windows\System\fnRdxGj.exe
  2⤵
  PID:10056
- C:\Windows\System\rPIKOoa.exe
  C:\Windows\System\rPIKOoa.exe
  2⤵
  PID:10084
- C:\Windows\System\SywqXEj.exe
  C:\Windows\System\SywqXEj.exe
  2⤵
  PID:10120
- C:\Windows\System\vvUBTIe.exe
  C:\Windows\System\vvUBTIe.exe
  2⤵
  PID:10184
- C:\Windows\System\FspVjdw.exe
  C:\Windows\System\FspVjdw.exe
  2⤵
  PID:9080
- C:\Windows\System\tzRQtQg.exe
  C:\Windows\System\tzRQtQg.exe
  2⤵
  PID:10132
- C:\Windows\System\vLIlfbi.exe
  C:\Windows\System\vLIlfbi.exe
  2⤵
  PID:10196
- C:\Windows\System\EwfXddx.exe
  C:\Windows\System\EwfXddx.exe
  2⤵
  PID:10228
- C:\Windows\System\nldeyhw.exe
  C:\Windows\System\nldeyhw.exe
  2⤵
  PID:9296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\EtgsIVs.exe

Filesize
1.8MB

MD5
26b83fba2a6dc3967f726aad4b09cd3f

SHA1
12f96d49ba1123bb9bfccafe50962566309d9346

SHA256
38fe9a3d85342a14d91e3d67efedbc09dc5c5d2fd335242e7fb20835267352dd

SHA512
a89cc71353e0070e50e707d5a62c636784f1534bbd263e2c67655fdc54193b4aabfd9dcf88f4aafb8dd1fe002b7e1059d166e9cbade9fd4d9b332ad40c895c1a

Download Submit
C:\Windows\system\FQhkHfw.exe

Filesize
1.8MB

MD5
69b9f8a0585250920201184afc683232

SHA1
af2137c59088db9b2dc6ba7927226bfc7d8fb7d5

SHA256
93d922ca93561e2fdc9958ebe20863205dfe545da45aefab190a5f10b016f964

SHA512
72cc69d05aa7428f50e2cbeacf89cae6d91e0df6fe05fae3d9da7a878d2e330c742cdc78fa0426a00f3b3fb62c723921ad3cc0f3604ee673b5ff86e1cf780d18

Download Submit
C:\Windows\system\ImwCpPU.exe

Filesize
1.8MB

MD5
fe6633af977fcfafff3851974ac38bae

SHA1
36e5fb7b86bfff0f0e738bad71ee208d6e3ddaba

SHA256
f9b8ef15ece1231b395ca8ec431f2d18178551722428100c24a493d8d6b72dd8

SHA512
f4c865e015537114aa1260777e04df0c451bee18db834d1db281f809a363c558d275cc549c418d85b0923cd5e414cf65e22a691ef89eebb22a4565f23b0ab5f1

Download Submit
C:\Windows\system\Ipkfech.exe

Filesize
1.8MB

MD5
2f84fdbbce3ad050727dabbf15137e31

SHA1
367f7a41fa7efc5e165f20d2b0266c8dc0e89b92

SHA256
d0526c7580684454d090194a81dce74720ea7cea3531cc589bbff56ff27a871f

SHA512
9c7347bcfe9973fc92379174a7fa4f495ed0fb5e7f95fee717377ff1b5424576e21cf3eeecf430b40ef98c5050b5ad770f9abfe1e9d78d2ebb88faa4d1011750

Download Submit
C:\Windows\system\KxKfKjP.exe

Filesize
1.8MB

MD5
5e7aa1a108be37a07e947c8bef5a82cc

SHA1
48e71515054c95967e4c1c9620098dbb850ce854

SHA256
d71f46105ee15cba2039891185b1bfaf65c0f8d04dcecc4e4cd5a5db032e8c61

SHA512
4e883951b2853a782c93d723f9e1ad1c4797fc5a757648fba643ea1239db56c31a34bd303aed3ac89f56ad9686173beac7feed9acc9bef10ac9e9febb76b95e1

Download Submit
C:\Windows\system\NJtFuyT.exe

Filesize
1.8MB

MD5
8e5e55e77896a8d1a3cbadba783472d9

SHA1
c4d249ca244247e288665d63bd2ba2861cfed152

SHA256
932067f72a0503b2ddcce1c16f7415d7e4b58672444a482f939ab1d78a34b5e6

SHA512
31dcb369f1c4be0f7859fffc1176ac33f36283075862ee99fd1023330f1cf956db5c0b1d037fecafee2e64ed0dbc3bbdb6f71fef97bda32e57be912471c4ec94

Download Submit
C:\Windows\system\OMUXmZh.exe

Filesize
1.8MB

MD5
7d4cd94691cfa75fc5535319c14536ed

SHA1
9dae0892a5d637ddb27ebb49b0fa7c458417368b

SHA256
ad26902590fcc0596abd0eb08a8e99f28fb074d272ce70b10776e45fccffc563

SHA512
62a64f476041223bb56e8c4bd0a622627fbb168e9e4fc4d1bf39aabe28f5fc436530f840e9f899e33ebf4e27bb383e3b5e93ff7b30db87ce86a1cceea5be413d

Download Submit
C:\Windows\system\OlKMbgc.exe

Filesize
1.8MB

MD5
79619da52830f6393448dbca69b9600e

SHA1
ce815b81f55cc5437b8fa3a4dfa041edbb364ef6

SHA256
7fcfb83a49aa23436cbf2ca5b1ec093c40c11a405d164f9fd09a1bb5b1f01341

SHA512
aa8aabc5936b7d1c5b4530b97ef9dac41abfacc25da8944999fc60de3146be79f417bb8ef6e17edae19e79454b5080495ad59179422c5037d4889c556b655da5

Download Submit
C:\Windows\system\PjCuPwH.exe

Filesize
1.8MB

MD5
f9511c2dc91bd87b14f61714e6496765

SHA1
d3437ce2bd5201e8237296277a8b829bdcae20b0

SHA256
ec171cba5de4d54fdce453c25e0de27cea23a321b7ffd2848075ba48d644d769

SHA512
ed114969ab2ca7c94ec898fd8657457d249f1f78fba3d0748ccf523e1fdd01e361ec87667876894e40cd3786e6bb81650185fbfbf82b092713980903f75ffef9

Download Submit
C:\Windows\system\QwIUkyP.exe

Filesize
1.8MB

MD5
d6aecd37205e331e2335f1b1c55033fd

SHA1
f49de26f3ec2c29b067569cadacd48f529e35e83

SHA256
12a7d120eb1bf051272de5eb355e35dcd51b76b75aae0a41c1914e25dea2b0ba

SHA512
f934dcc3d944e12a92d42cb1bc6fa114e746c6eb39bca3c2a55c26f64529d09116b74a5e8a86bea8cf0b80068418e778af1ece0a7908c4e1e14663bf12a1ee0a

Download Submit
C:\Windows\system\TbMoUPa.exe

Filesize
1.8MB

MD5
03805d274e3bb64641104ad8443af156

SHA1
6705528ba363b4d5614b74b7e176eecb3419cc78

SHA256
c28925d9e014805792ccef564ade9ea948f64745d3cade17fe2cc6ef93c65b06

SHA512
d6b5156f2064d9e3f22c823b17d08ed0c2c7c2d36010d604249ed160dbbe5d61d6d09d7cccac9d74ed3fe5a412962b88b5457a20af31dfbe76f089852b9d310c

Download Submit
C:\Windows\system\VixiaFR.exe

Filesize
1.8MB

MD5
3333b565d2bf24829723c9aa55f20eb7

SHA1
39c4af058956b44b9e2989baf2c0b03a4140f0b3

SHA256
b28ff55beb1b3c5cc2df72006ccdec95835ea1b834603f4811d050bcfe23df94

SHA512
f0f858a509a64333edf62df2abe14d0759d0ac5e2ff210c1cae5cddc920123b6264f5c2773a2095dc6dbd4582c296a19b5991ba32d1a92adda02fd30a49afe25

Download Submit
C:\Windows\system\WWFvCzG.exe

Filesize
1.8MB

MD5
b8d9f23dcc7d597ff00d65555917d2ae

SHA1
9eb7569f50a49c7bb4fabaa5fbab134241b0cda0

SHA256
87a7bd6619f445aaf0043278f85617554db6b1c298b3ea5935a0ad6e2785db28

SHA512
93e38f3f3b8df3fc45f61fe35eb710a123a3a9b3d55c069b8a29508495a77bc851f35b72733f9c0c4b9e4887e29f1fd64ba056568135703bfade90f41eadd459

Download Submit
C:\Windows\system\YolHJzH.exe

Filesize
1.8MB

MD5
82730e1d4362612930edc68b9f68b233

SHA1
852866083202c34cc47ee10874078f222499c06d

SHA256
2fcf40b4035c0bf2f2754555138779c2857868a977bff86847405b333532814b

SHA512
1f1468596fe1bc61873b35224be07e87ac91b9ae9d33d235f1fde690bcfe76b55cd165b2b3653b796a4efa842a8595f81b6553d58913a196f6b9685159115bed

Download Submit
C:\Windows\system\ZKAtMUo.exe

Filesize
1.8MB

MD5
99d504e80f08b3891689926bcf769eb9

SHA1
a8e14acfdbf5dee74845585220a2dd441556756f

SHA256
ac308b3c063c8a544b1c4176f505c2bb1682525eef9a2324ec618b7f62c10e85

SHA512
afa127fa95c439c0c77b1c1c78e14e8737645e2c443529af16f4e1e2f32039eb8bb4edeed4a199f9817688e816c7426923afd043635fd6d253d7e0ff7fb77201

Download Submit
C:\Windows\system\bkVTyfW.exe

Filesize
1.8MB

MD5
930204107a1010eec91d99ef12036d8f

SHA1
9e0b863387becd94e8fc22b89eaba392d6f01423

SHA256
f6cdef5649994c49164cd6b760ca31983437bc68679367a64a50f2bbd53ab044

SHA512
c1683f9cdd4ba0f2461e912c6d82b9369472386f92de110f15534a984927831eabbdaa964253e4b7bd0dd842ef67b574889bbb69efbb91956c26fc15ebc93fe8

Download Submit
C:\Windows\system\ckISizd.exe

Filesize
1.8MB

MD5
c61154a546f1e8d6e8d3eaff77bf9d39

SHA1
9e98a5e1d2e007aa13eb71de7fe93a5161ac0155

SHA256
0205d28e6dc6bf84e9d7e6d7bd5ff2149a3cc50fe2a9a071893f98aac6bbb329

SHA512
5c97f80b0ecad02999e03fe91eb71f89dcccb7fe9f47e9500d541cd2338b20084002f98b969f2102a6b4b4f8dc5c5cc7e8dc308c2f62a5605affd36c20cfa978

Download Submit
C:\Windows\system\dQhelkt.exe

Filesize
1.8MB

MD5
1c32aec7a529e7b4ce36f7f5ffee0ffb

SHA1
f673ac51d2a6966c4af7e9b44dd84acd6b099193

SHA256
334b7a9c382cc97f0f49f2959a61e46e59228dc3f8a5af1b6fa08c53c3d3da31

SHA512
362ff12d211f4c72e25b71afee33d2c48f800abbd6bf8e9203f74884b0e86df77e191b14989e8b433a94c86cbc1b12472bfda62d2cfa4014e93950854c69cea9

Download Submit
C:\Windows\system\eWAPBSs.exe

Filesize
1.8MB

MD5
2301531be8414ce45c761d6545ea3e06

SHA1
266cf6e8ce7fe12aa4765133b0be12b3a08ac646

SHA256
024f1cccae1a7f177eab7f1c90ee177c897cf3188535b546c4d6dd2cc6bec730

SHA512
fb018892d6529531b499b05a5c82fd4e1428fef18f9c41d6ce2ee150c62dcd2a56c872b305c5da7264f957c0b02e1848a92445d7e48200b4e2599bd599413aa1

Download Submit
C:\Windows\system\fbYCBhA.exe

Filesize
1.8MB

MD5
c7f46ce068076e1fc9cb8c63f6d523ea

SHA1
0cbc69839e233d047ac907cc2f3be1eb0a500a49

SHA256
f3b9c28d1f764380f05e4c34dd3d07f80a961de48ba7c4d21d0b0321e5b40e8f

SHA512
3e61741c9d17430e2f5af77978a8e6087d7f02f54150eae65851ec7593aa860d792f256ed0d7f18670dbd45e5a99e2f9c2d6cf951639f755d102ca4642e281e5

Download Submit
C:\Windows\system\glJiNYC.exe

Filesize
1.8MB

MD5
8a49971db81758a0e381a3b7de61c8f8

SHA1
f16459a281f900ec151d05caf6915d3f43762f33

SHA256
89cce950d0582890d703d4513d6e7259b9ed120fababc4365833e31da7c982f2

SHA512
67d246e5fbb7eb6b62dc8a4ef4d80011b681e16b74256198e2d2ffec3981304aaf6d89159017d5abdd127e103af3c7c5f9a1c2137b9d027adfe6bf66d7a26875

Download Submit
C:\Windows\system\hdFXwaF.exe

Filesize
1.8MB

MD5
3cf1a3bc4673cd050f1a44621a8127af

SHA1
a4bab2204aec7d8dde4bfd828b500ced09664787

SHA256
7f1104fce7cf08c74a0ec2166a80aa48c28fe6773d4ab5f1ed6e688a91e376a9

SHA512
071d3710da42b7abeb0a1229d9c59d496585a6660f09c3e8accc9a1594f172d0f8ca2a49dfe194c2a696f971b70eaf7d6b6d1b68cce9b97824e165b54350de98

Download Submit
C:\Windows\system\iFMFBdk.exe

Filesize
1.8MB

MD5
af1f20e782439c445ea81653eb049a4f

SHA1
ae90fca45c011fdcfd173431446f5acce44d5fa1

SHA256
8d087a375f2b03710bff27b9fbeff4fb955cd0820c89b4debd6a9b841547ce33

SHA512
d417d0fdbdc19719023eff67d60079957d12f47d2cebe3e5584acf67770858991a5e42074b528f7f4d75c2cafc5780e1b718def4b67c668510ca2e3bffe9a5c7

Download Submit
C:\Windows\system\njEvbHg.exe

Filesize
1.8MB

MD5
cc9c5aa5d9788e0bbbf5bd8743f20c0c

SHA1
9cb94124ecd3fc5c9c880907929f9964a6b742bb

SHA256
44811c2499d972d6c8d2d1bf19cf3a9cacfa54955c0322e5f8b699e08fefb746

SHA512
67a5dc5992c9e62f221af435c085784f5d92ef18dcb1e6695051ad8ade1a5990ea8aa580592afa956c988aff88eab83b71f602fb5f331dd354c86b0cc32ed84b

Download Submit
C:\Windows\system\tQMBvQg.exe

Filesize
1.8MB

MD5
3fb949d973f03429901e5792767ab98e

SHA1
3c4e907e3c90e905a320892e534246a959901654

SHA256
9bf40a38e71f8f3c023a2f1c35f9a24ae15691c89a3827c5503be13b4161e767

SHA512
b8c9b7cb15515d02af470ddfd02a64f559cbf7bdd92968aa2f62d51c1dae0aacec71cf73a499c965dd50fe07349521e847dc651c1ff8747d428e440e8c88c31e

Download Submit
C:\Windows\system\vSoewTY.exe

Filesize
1.8MB

MD5
4c12dd4a0a6a7e232df2efed58b1ff94

SHA1
05ffe3aff3d885c12d184af76fbb1f6281de4e0b

SHA256
efeefdb320b61d07779d65e2d32fdc7837e188ff1bed5235da3d5ca279b0111c

SHA512
63a6fe079282ee4c4eda531fe8de9cd8dde714585568e111ad5404ef21519738251288094b821e9126b96a90510a5f467e337ccc12184bd5f1d18f0fed9a0de6

Download Submit
\Windows\system\FjFdJdk.exe

Filesize
1.8MB

MD5
99fbf76071ae0b63290665e3410abb46

SHA1
7e33b3862656ba66ea491eee4c6f3f405f131282

SHA256
8af6ec1a7b13115eda2e40d106d6fef64a7000139d33325f5f8203bbc6b1846f

SHA512
5d3a81dbd44d0cb7ca0eb166b06e85f505372952ea8e6890bdb172ce5c7150c15679bac0bba730bba4cbec2f62e0074444cb8ae8fc081c73430112104af818e8

Download Submit
\Windows\system\Nxbehpi.exe

Filesize
1.8MB

MD5
961680d4a4ab322c6ba462a084439176

SHA1
550bf8d22fd174eb8e827e5a879a0af3c48cda44

SHA256
7a78673c5b400471325c20a4ad74905375f220f26fd3b25b0210ef23f84d0ea8

SHA512
59b6fda3572629d8d2265006ea02492bc23ba5c27fe9021bf5c7e006f89d8b7f840a37f7cd81ef123e9d1ebd6b3c38528c449851c6aebab2a602915c5df58a46

Download Submit
\Windows\system\PmqbHcB.exe

Filesize
1.8MB

MD5
b4b7ecccab334917ee77bb1665457d4a

SHA1
685ffef17c277e2f3ac492c99b350b7ab132a70d

SHA256
27aebd045b8127360827ab593f3eaf24e6d185497119b55e427a5b5d380b910a

SHA512
862cd5477327c0a50857696ad5736cbceca995fa37e7d76f20f628549dfc09f6bc66d5c7c5885bb851c0997af084b77c62225e9c9a4811d77d762d0dc50ea080

Download Submit
\Windows\system\TNgtqOt.exe

Filesize
1.8MB

MD5
35c4b3f5dcaa7931060f27cba7d45fe8

SHA1
16e0711bfa9c46f6bf57f9fca4d8e920d77ad631

SHA256
93797d79553482a5d46163085ab0a0976c367279894076fed004d1f7ed6efbab

SHA512
9e97d6e7ff05c0a1efce15c3ef51bd3c11f4586534d4171e171bc37918eda943d87f93cd92fe3bb69b618bac545b7ba59d0a65e3cecd87cca40a283e7ac4b36b

Download Submit
\Windows\system\cWUXDTc.exe

Filesize
1.8MB

MD5
e1a962749a71c275f9c98291b9d23be0

SHA1
2b32827332b51c8993702b30056396e672960171

SHA256
6d54794c70463d22bb3cbb03908ccb4a46cecc724f59155568da7d37ee0a7880

SHA512
905cb6c47dda0dfd1fa851eabcd93c3f01811e2b3b9ff955b162602a27cafb6ca7d8d7c7381aef38857c9b4492bac5511e9a3c8c68e2911fe7f8e117ecea38de

Download Submit
\Windows\system\wuMlcBq.exe

Filesize
1.8MB

MD5
9fd6367a9fa7d439def288bbe293fd48

SHA1
03b7175204c753bc43d6d01c2a4770b4ca9188c2

SHA256
1a477ee9941df012c37d5bc3c658b3b0eab6a1eea4398997184764fe6343b1e6

SHA512
092c3208e89f2e6da55d44cd6fc3da31f647c2c010024f3c230271f310a19f94bcd608e8278a70574b6c327d98c9c864151f01dc805daa12d857b3a50af1d4ed

Download Submit
memory/804-6046-0x000000013F230000-0x000000013F622000-memory.dmp

Filesize
3.9MB

Download
memory/804-30-0x000000013F230000-0x000000013F622000-memory.dmp

Filesize
3.9MB

Download
memory/1800-116-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/1800-6053-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/1952-115-0x000000013FAC0000-0x000000013FEB2000-memory.dmp

Filesize
3.9MB

Download
memory/1952-6058-0x000000013FAC0000-0x000000013FEB2000-memory.dmp

Filesize
3.9MB

Download
memory/2292-47-0x000000013FAC0000-0x000000013FEB2000-memory.dmp

Filesize
3.9MB

Download
memory/2292-85-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/2292-108-0x000000013F050000-0x000000013F442000-memory.dmp

Filesize
3.9MB

Download
memory/2292-107-0x000000013FFF0000-0x00000001403E2000-memory.dmp

Filesize
3.9MB

Download
memory/2292-106-0x0000000003100000-0x00000000034F2000-memory.dmp

Filesize
3.9MB

Download
memory/2292-113-0x000000013FE00000-0x00000001401F2000-memory.dmp

Filesize
3.9MB

Download
memory/2292-114-0x000000013FFD0000-0x00000001403C2000-memory.dmp

Filesize
3.9MB

Download
memory/2292-102-0x0000000003100000-0x00000000034F2000-memory.dmp

Filesize
3.9MB

Download
memory/2292-110-0x0000000003540000-0x0000000003932000-memory.dmp

Filesize
3.9MB

Download
memory/2292-101-0x000000013F0E0000-0x000000013F4D2000-memory.dmp

Filesize
3.9MB

Download
memory/2292-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2292-78-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/2292-118-0x000000013FE80000-0x0000000140272000-memory.dmp

Filesize
3.9MB

Download
memory/2292-109-0x0000000003540000-0x0000000003932000-memory.dmp

Filesize
3.9MB

Download
memory/2292-0-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/2292-15-0x0000000003100000-0x00000000034F2000-memory.dmp

Filesize
3.9MB

Download
memory/2580-6043-0x000000013F3F0000-0x000000013F7E2000-memory.dmp

Filesize
3.9MB

Download
memory/2580-111-0x000000013F3F0000-0x000000013F7E2000-memory.dmp

Filesize
3.9MB

Download
memory/2648-117-0x000000013F710000-0x000000013FB02000-memory.dmp

Filesize
3.9MB

Download
memory/2648-6042-0x000000013F710000-0x000000013FB02000-memory.dmp

Filesize
3.9MB

Download
memory/2720-6044-0x000000013F050000-0x000000013F442000-memory.dmp

Filesize
3.9MB

Download
memory/2720-112-0x000000013F050000-0x000000013F442000-memory.dmp

Filesize
3.9MB

Download
memory/2748-105-0x000000013F370000-0x000000013F762000-memory.dmp

Filesize
3.9MB

Download
memory/2748-6055-0x000000013F370000-0x000000013F762000-memory.dmp

Filesize
3.9MB

Download
memory/3044-232-0x0000000001C10000-0x0000000001C18000-memory.dmp

Filesize
32KB

Download
memory/3044-228-0x000000001B6E0000-0x000000001B9C2000-memory.dmp

Filesize
2.9MB

Download