xmrig | 2368fda70702e5630d59256692901054fd28ce3782f18ad9504ebb9ce2456bf4

Analysis

max time kernel
119s
max time network
115s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
07/08/2024, 07:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
Size

2.3MB
MD5

810c8fa2ed8b5ce0e5a44db87dbeb640
SHA1

48504534caaf09c8cf83d6af034e858bdbd0b4a8
SHA256

2368fda70702e5630d59256692901054fd28ce3782f18ad9504ebb9ce2456bf4
SHA512

f3977c1af6e04dd83313a7c686ec3a528b643421dbf84fe194313fe47c03d25c5817c13a978771980709dbe7bee4974926431d2e64e2262f9654e86758802883
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9cRbuQO:NAB6

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 16 IoCs

miner

resource	yara_rule
behavioral1/memory/316-9-0x000000013FFF0000-0x00000001403E2000-memory.dmp	xmrig
behavioral1/memory/2808-19-0x000000013F870000-0x000000013FC62000-memory.dmp	xmrig
behavioral1/memory/2812-108-0x000000013F110000-0x000000013F502000-memory.dmp	xmrig
behavioral1/memory/2704-79-0x000000013F300000-0x000000013F6F2000-memory.dmp	xmrig
behavioral1/memory/2524-71-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	xmrig
behavioral1/memory/2660-66-0x000000013F780000-0x000000013FB72000-memory.dmp	xmrig
behavioral1/memory/2480-65-0x000000013F4A0000-0x000000013F892000-memory.dmp	xmrig
behavioral1/memory/2676-49-0x000000013F310000-0x000000013F702000-memory.dmp	xmrig
behavioral1/memory/3024-5457-0x000000013F190000-0x000000013F582000-memory.dmp	xmrig
behavioral1/memory/2704-5462-0x000000013F300000-0x000000013F6F2000-memory.dmp	xmrig
behavioral1/memory/2660-5466-0x000000013F780000-0x000000013FB72000-memory.dmp	xmrig
behavioral1/memory/2524-5510-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	xmrig
behavioral1/memory/2176-5557-0x000000013F190000-0x000000013F582000-memory.dmp	xmrig
behavioral1/memory/2480-5562-0x000000013F4A0000-0x000000013F892000-memory.dmp	xmrig
behavioral1/memory/2676-5586-0x000000013F310000-0x000000013F702000-memory.dmp	xmrig
behavioral1/memory/316-5555-0x000000013FFF0000-0x00000001403E2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
768	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
316	gUEFJZW.exe
2808	qQBVcrL.exe
3024	OBRpygB.exe
2676	whPQVGj.exe
2480	hnQbjwt.exe
2660	JmgnofU.exe
2524	JjxxcPn.exe
2176	eJaWzUZ.exe
2704	wugQCJk.exe
1204	auwLSFw.exe
2592	YzHQuKa.exe
2424	xyrhTRQ.exe
676	RUxeOHq.exe
2576	ICfPoxh.exe
2556	ByDgMWr.exe
352	OlQCnGO.exe
1220	DuLoltw.exe
2584	xozwfXi.exe
1900	DGljSmN.exe
2832	lUcsgYd.exe
2192	WrrIAyl.exe
2864	RXGmjlB.exe
2196	YMvKHPU.exe
2396	avxzDnB.exe
1196	hWymjAx.exe
1792	FvIkccT.exe
2252	dDNOguR.exe
1680	HntcjCM.exe
272	KeEFkrQ.exe
1720	gtpKdqL.exe
1728	GdhtXiW.exe
1488	pTYvTAn.exe
1904	IFcVGsB.exe
536	VrckVZN.exe
1872	njoVnMU.exe
628	yWJJcMT.exe
2076	LVaNMiH.exe
1448	nmvrMyc.exe
2924	QEKrzSA.exe
1540	aZYprQI.exe
2720	IwIaJnq.exe
2784	hkyywsR.exe
2552	KTFRiGb.exe
2760	PXFrPts.exe
2856	nXHSEIi.exe
1660	kwgUuAU.exe
1672	uRsExif.exe
2180	cKGdpXd.exe
1972	fokiecU.exe
1600	owWrvFT.exe
2300	QdxtRXv.exe
1592	GBrSNSd.exe
356	jIiDQtq.exe
3080	nvgyBff.exe
3112	tFvktkG.exe
3144	scEbuIL.exe
3176	EgglDCF.exe
3208	WbzsnYi.exe
3240	dlopkll.exe
3272	lfopBEr.exe
3304	bwNmGzn.exe
3336	gWBvYcn.exe
3368	BEodvzc.exe
3400	gXGCEql.exe

Loads dropped DLL 64 IoCs

pid	Process
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe

UPX packed file 54 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2812-0-0x000000013F110000-0x000000013F502000-memory.dmp	upx
behavioral1/files/0x000f000000013423-6.dat	upx
behavioral1/files/0x00080000000174a8-10.dat	upx
behavioral1/files/0x0015000000018655-12.dat	upx
behavioral1/memory/316-9-0x000000013FFF0000-0x00000001403E2000-memory.dmp	upx
behavioral1/files/0x000e000000018660-27.dat	upx
behavioral1/files/0x000a000000018c0c-34.dat	upx
behavioral1/files/0x000500000001979c-54.dat	upx
behavioral1/memory/2808-19-0x000000013F870000-0x000000013FC62000-memory.dmp	upx
behavioral1/memory/3024-26-0x000000013F190000-0x000000013F582000-memory.dmp	upx
behavioral1/files/0x0005000000019c4d-74.dat	upx
behavioral1/files/0x0005000000019d6d-91.dat	upx
behavioral1/files/0x0005000000019f50-97.dat	upx
behavioral1/files/0x0005000000019a54-46.dat	upx
behavioral1/files/0x0005000000019c68-82.dat	upx
behavioral1/files/0x0007000000004e74-31.dat	upx
behavioral1/files/0x0005000000019c66-122.dat	upx
behavioral1/files/0x000500000001a2df-135.dat	upx
behavioral1/files/0x000500000001a4a4-182.dat	upx
behavioral1/files/0x0006000000019258-73.dat	upx
behavioral1/files/0x000500000001a04b-131.dat	upx
behavioral1/files/0x000500000001a310-137.dat	upx
behavioral1/files/0x000500000001a4a2-179.dat	upx
behavioral1/files/0x000500000001a486-172.dat	upx
behavioral1/files/0x000500000001a475-165.dat	upx
behavioral1/files/0x000500000001a452-158.dat	upx
behavioral1/files/0x000500000001a425-151.dat	upx
behavioral1/files/0x000500000001a41b-144.dat	upx
behavioral1/files/0x0005000000019af1-114.dat	upx
behavioral1/memory/2812-108-0x000000013F110000-0x000000013F502000-memory.dmp	upx
behavioral1/files/0x0005000000019f39-94.dat	upx
behavioral1/files/0x0005000000019c9f-86.dat	upx
behavioral1/memory/2704-79-0x000000013F300000-0x000000013F6F2000-memory.dmp	upx
behavioral1/files/0x000500000001a08c-123.dat	upx
behavioral1/memory/2524-71-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	upx
behavioral1/files/0x000500000001a498-177.dat	upx
behavioral1/files/0x000500000001a481-170.dat	upx
behavioral1/files/0x000500000001a473-163.dat	upx
behavioral1/files/0x000500000001a426-156.dat	upx
behavioral1/files/0x000500000001a423-149.dat	upx
behavioral1/files/0x000500000001a419-143.dat	upx
behavioral1/memory/2660-66-0x000000013F780000-0x000000013FB72000-memory.dmp	upx
behavioral1/memory/2480-65-0x000000013F4A0000-0x000000013F892000-memory.dmp	upx
behavioral1/files/0x0005000000019aef-63.dat	upx
behavioral1/memory/2676-49-0x000000013F310000-0x000000013F702000-memory.dmp	upx
behavioral1/files/0x000500000001a055-119.dat	upx
behavioral1/memory/3024-5457-0x000000013F190000-0x000000013F582000-memory.dmp	upx
behavioral1/memory/2704-5462-0x000000013F300000-0x000000013F6F2000-memory.dmp	upx
behavioral1/memory/2660-5466-0x000000013F780000-0x000000013FB72000-memory.dmp	upx
behavioral1/memory/2524-5510-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	upx
behavioral1/memory/2176-5557-0x000000013F190000-0x000000013F582000-memory.dmp	upx
behavioral1/memory/2480-5562-0x000000013F4A0000-0x000000013F892000-memory.dmp	upx
behavioral1/memory/2676-5586-0x000000013F310000-0x000000013F702000-memory.dmp	upx
behavioral1/memory/316-5555-0x000000013FFF0000-0x00000001403E2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\deakZgb.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\hrunfoS.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\YjwFhmN.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\ngAunYE.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\ErZFkLU.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\JqIbjfA.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\XhaXoyt.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\cNPFPix.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\TpxHceH.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\WZQZDHu.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\TPEHyYB.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\pjECSAI.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\wnfqKnh.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\KaTEUhK.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\mJByMAD.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\sKFnurZ.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\nuttGSb.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\mlkmqpg.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\kdjdpdd.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\SykSYsJ.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\tpJzHDE.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\afTTJbx.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\hKWKgmf.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\NFyVnyB.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\wUXyrpp.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\ENbnfaO.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\bwQlSWD.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\pjdzMNk.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\NGsaxBi.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\cSgrMhz.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\sizVKHa.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\rewWVZa.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\yIVaFKQ.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\vhszSBn.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\eeLgStV.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\fQFVtrK.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\yDfNOBa.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\PJgLaRP.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\OuaeyyZ.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\fBWEjzN.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\XiyqpJT.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\vseuglM.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\XUSXPrD.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\tpZdgHO.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\NssoJjw.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\szwpabf.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\VWafZzw.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\TfhtAxD.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\vmBnEEc.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\JAifNyY.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\KnRCOGt.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\DKOwyfF.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\kDTwHgJ.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\VraZtfq.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\tffQECE.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\dfNlZSQ.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\QwWWQDs.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\kcgtUVu.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\EdvnJqI.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\RgUBALt.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\bZZlJDd.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\zIQSgxO.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\KxnmrrN.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
File created	C:\Windows\System\NgXLpXr.exe	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
768	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
Token: SeLockMemoryPrivilege	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
Token: SeDebugPrivilege	768	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 768	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	32
PID 2812 wrote to memory of 768	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	32
PID 2812 wrote to memory of 768	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	32
PID 2812 wrote to memory of 316	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	33
PID 2812 wrote to memory of 316	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	33
PID 2812 wrote to memory of 316	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	33
PID 2812 wrote to memory of 2808	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	34
PID 2812 wrote to memory of 2808	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	34
PID 2812 wrote to memory of 2808	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	34
PID 2812 wrote to memory of 3024	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	35
PID 2812 wrote to memory of 3024	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	35
PID 2812 wrote to memory of 3024	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	35
PID 2812 wrote to memory of 2676	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	36
PID 2812 wrote to memory of 2676	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	36
PID 2812 wrote to memory of 2676	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	36
PID 2812 wrote to memory of 2176	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	37
PID 2812 wrote to memory of 2176	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	37
PID 2812 wrote to memory of 2176	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	37
PID 2812 wrote to memory of 2480	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	38
PID 2812 wrote to memory of 2480	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	38
PID 2812 wrote to memory of 2480	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	38
PID 2812 wrote to memory of 2704	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	39
PID 2812 wrote to memory of 2704	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	39
PID 2812 wrote to memory of 2704	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	39
PID 2812 wrote to memory of 2660	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	40
PID 2812 wrote to memory of 2660	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	40
PID 2812 wrote to memory of 2660	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	40
PID 2812 wrote to memory of 2576	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	41
PID 2812 wrote to memory of 2576	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	41
PID 2812 wrote to memory of 2576	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	41
PID 2812 wrote to memory of 2524	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	42
PID 2812 wrote to memory of 2524	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	42
PID 2812 wrote to memory of 2524	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	42
PID 2812 wrote to memory of 2556	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	43
PID 2812 wrote to memory of 2556	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	43
PID 2812 wrote to memory of 2556	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	43
PID 2812 wrote to memory of 1204	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	44
PID 2812 wrote to memory of 1204	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	44
PID 2812 wrote to memory of 1204	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	44
PID 2812 wrote to memory of 1220	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	45
PID 2812 wrote to memory of 1220	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	45
PID 2812 wrote to memory of 1220	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	45
PID 2812 wrote to memory of 2592	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	46
PID 2812 wrote to memory of 2592	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	46
PID 2812 wrote to memory of 2592	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	46
PID 2812 wrote to memory of 2584	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	47
PID 2812 wrote to memory of 2584	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	47
PID 2812 wrote to memory of 2584	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	47
PID 2812 wrote to memory of 2424	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	48
PID 2812 wrote to memory of 2424	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	48
PID 2812 wrote to memory of 2424	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	48
PID 2812 wrote to memory of 1900	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	49
PID 2812 wrote to memory of 1900	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	49
PID 2812 wrote to memory of 1900	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	49
PID 2812 wrote to memory of 676	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	50
PID 2812 wrote to memory of 676	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	50
PID 2812 wrote to memory of 676	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	50
PID 2812 wrote to memory of 2832	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	51
PID 2812 wrote to memory of 2832	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	51
PID 2812 wrote to memory of 2832	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	51
PID 2812 wrote to memory of 352	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	52
PID 2812 wrote to memory of 352	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	52
PID 2812 wrote to memory of 352	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	52
PID 2812 wrote to memory of 1980	2812	810c8fa2ed8b5ce0e5a44db87dbeb640N.exe	53

C:\Users\Admin\AppData\Local\Temp\810c8fa2ed8b5ce0e5a44db87dbeb640N.exe
"C:\Users\Admin\AppData\Local\Temp\810c8fa2ed8b5ce0e5a44db87dbeb640N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:768
- C:\Windows\System\gUEFJZW.exe
  C:\Windows\System\gUEFJZW.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\qQBVcrL.exe
  C:\Windows\System\qQBVcrL.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\OBRpygB.exe
  C:\Windows\System\OBRpygB.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\whPQVGj.exe
  C:\Windows\System\whPQVGj.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\eJaWzUZ.exe
  C:\Windows\System\eJaWzUZ.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\hnQbjwt.exe
  C:\Windows\System\hnQbjwt.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\wugQCJk.exe
  C:\Windows\System\wugQCJk.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\JmgnofU.exe
  C:\Windows\System\JmgnofU.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\ICfPoxh.exe
  C:\Windows\System\ICfPoxh.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\JjxxcPn.exe
  C:\Windows\System\JjxxcPn.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\ByDgMWr.exe
  C:\Windows\System\ByDgMWr.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\auwLSFw.exe
  C:\Windows\System\auwLSFw.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\DuLoltw.exe
  C:\Windows\System\DuLoltw.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\YzHQuKa.exe
  C:\Windows\System\YzHQuKa.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\xozwfXi.exe
  C:\Windows\System\xozwfXi.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\xyrhTRQ.exe
  C:\Windows\System\xyrhTRQ.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\DGljSmN.exe
  C:\Windows\System\DGljSmN.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\RUxeOHq.exe
  C:\Windows\System\RUxeOHq.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System\lUcsgYd.exe
  C:\Windows\System\lUcsgYd.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\OlQCnGO.exe
  C:\Windows\System\OlQCnGO.exe
  2⤵
  - Executes dropped EXE
  PID:352
- C:\Windows\System\dcIIjnt.exe
  C:\Windows\System\dcIIjnt.exe
  2⤵
  PID:1980
- C:\Windows\System\WrrIAyl.exe
  C:\Windows\System\WrrIAyl.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\PfVKdUR.exe
  C:\Windows\System\PfVKdUR.exe
  2⤵
  PID:1880
- C:\Windows\System\RXGmjlB.exe
  C:\Windows\System\RXGmjlB.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\mPMANqq.exe
  C:\Windows\System\mPMANqq.exe
  2⤵
  PID:2620
- C:\Windows\System\YMvKHPU.exe
  C:\Windows\System\YMvKHPU.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\jtsBxCU.exe
  C:\Windows\System\jtsBxCU.exe
  2⤵
  PID:1240
- C:\Windows\System\avxzDnB.exe
  C:\Windows\System\avxzDnB.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\EKywZWw.exe
  C:\Windows\System\EKywZWw.exe
  2⤵
  PID:1000
- C:\Windows\System\hWymjAx.exe
  C:\Windows\System\hWymjAx.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\izJmLNN.exe
  C:\Windows\System\izJmLNN.exe
  2⤵
  PID:1756
- C:\Windows\System\FvIkccT.exe
  C:\Windows\System\FvIkccT.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\UvHSnzV.exe
  C:\Windows\System\UvHSnzV.exe
  2⤵
  PID:1556
- C:\Windows\System\dDNOguR.exe
  C:\Windows\System\dDNOguR.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\rxlWdqo.exe
  C:\Windows\System\rxlWdqo.exe
  2⤵
  PID:2504
- C:\Windows\System\HntcjCM.exe
  C:\Windows\System\HntcjCM.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\lGifLHS.exe
  C:\Windows\System\lGifLHS.exe
  2⤵
  PID:916
- C:\Windows\System\KeEFkrQ.exe
  C:\Windows\System\KeEFkrQ.exe
  2⤵
  - Executes dropped EXE
  PID:272
- C:\Windows\System\DhTxgtV.exe
  C:\Windows\System\DhTxgtV.exe
  2⤵
  PID:944
- C:\Windows\System\gtpKdqL.exe
  C:\Windows\System\gtpKdqL.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\asAHcps.exe
  C:\Windows\System\asAHcps.exe
  2⤵
  PID:1476
- C:\Windows\System\GdhtXiW.exe
  C:\Windows\System\GdhtXiW.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\JImWkqC.exe
  C:\Windows\System\JImWkqC.exe
  2⤵
  PID:2420
- C:\Windows\System\pTYvTAn.exe
  C:\Windows\System\pTYvTAn.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\mCqgSxu.exe
  C:\Windows\System\mCqgSxu.exe
  2⤵
  PID:1568
- C:\Windows\System\IFcVGsB.exe
  C:\Windows\System\IFcVGsB.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\ZFHSsLU.exe
  C:\Windows\System\ZFHSsLU.exe
  2⤵
  PID:2068
- C:\Windows\System\VrckVZN.exe
  C:\Windows\System\VrckVZN.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\vnuOqUA.exe
  C:\Windows\System\vnuOqUA.exe
  2⤵
  PID:2208
- C:\Windows\System\njoVnMU.exe
  C:\Windows\System\njoVnMU.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\ZFIuqIs.exe
  C:\Windows\System\ZFIuqIs.exe
  2⤵
  PID:1940
- C:\Windows\System\yWJJcMT.exe
  C:\Windows\System\yWJJcMT.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\wgBndPf.exe
  C:\Windows\System\wgBndPf.exe
  2⤵
  PID:2212
- C:\Windows\System\LVaNMiH.exe
  C:\Windows\System\LVaNMiH.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\VZRPcEw.exe
  C:\Windows\System\VZRPcEw.exe
  2⤵
  PID:924
- C:\Windows\System\nmvrMyc.exe
  C:\Windows\System\nmvrMyc.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\KnZOPOB.exe
  C:\Windows\System\KnZOPOB.exe
  2⤵
  PID:2948
- C:\Windows\System\QEKrzSA.exe
  C:\Windows\System\QEKrzSA.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\SROQvqf.exe
  C:\Windows\System\SROQvqf.exe
  2⤵
  PID:1780
- C:\Windows\System\aZYprQI.exe
  C:\Windows\System\aZYprQI.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\aXUSHXZ.exe
  C:\Windows\System\aXUSHXZ.exe
  2⤵
  PID:1544
- C:\Windows\System\IwIaJnq.exe
  C:\Windows\System\IwIaJnq.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\SMYkqGS.exe
  C:\Windows\System\SMYkqGS.exe
  2⤵
  PID:2780
- C:\Windows\System\hkyywsR.exe
  C:\Windows\System\hkyywsR.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\GkQaTKJ.exe
  C:\Windows\System\GkQaTKJ.exe
  2⤵
  PID:2632
- C:\Windows\System\KTFRiGb.exe
  C:\Windows\System\KTFRiGb.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\BmpaIID.exe
  C:\Windows\System\BmpaIID.exe
  2⤵
  PID:2624
- C:\Windows\System\PXFrPts.exe
  C:\Windows\System\PXFrPts.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\GvkRBlJ.exe
  C:\Windows\System\GvkRBlJ.exe
  2⤵
  PID:2736
- C:\Windows\System\nXHSEIi.exe
  C:\Windows\System\nXHSEIi.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\PSIdvxx.exe
  C:\Windows\System\PSIdvxx.exe
  2⤵
  PID:2160
- C:\Windows\System\kwgUuAU.exe
  C:\Windows\System\kwgUuAU.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\zvZviFH.exe
  C:\Windows\System\zvZviFH.exe
  2⤵
  PID:964
- C:\Windows\System\uRsExif.exe
  C:\Windows\System\uRsExif.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\ByPJGQw.exe
  C:\Windows\System\ByPJGQw.exe
  2⤵
  PID:2128
- C:\Windows\System\cKGdpXd.exe
  C:\Windows\System\cKGdpXd.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\optJZxo.exe
  C:\Windows\System\optJZxo.exe
  2⤵
  PID:376
- C:\Windows\System\fokiecU.exe
  C:\Windows\System\fokiecU.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\gLweFbI.exe
  C:\Windows\System\gLweFbI.exe
  2⤵
  PID:2928
- C:\Windows\System\owWrvFT.exe
  C:\Windows\System\owWrvFT.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\zlYrypt.exe
  C:\Windows\System\zlYrypt.exe
  2⤵
  PID:2560
- C:\Windows\System\QdxtRXv.exe
  C:\Windows\System\QdxtRXv.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\ZheLUbd.exe
  C:\Windows\System\ZheLUbd.exe
  2⤵
  PID:2296
- C:\Windows\System\GBrSNSd.exe
  C:\Windows\System\GBrSNSd.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\avFJXQa.exe
  C:\Windows\System\avFJXQa.exe
  2⤵
  PID:2380
- C:\Windows\System\jIiDQtq.exe
  C:\Windows\System\jIiDQtq.exe
  2⤵
  - Executes dropped EXE
  PID:356
- C:\Windows\System\yASIxPT.exe
  C:\Windows\System\yASIxPT.exe
  2⤵
  PID:1736
- C:\Windows\System\nvgyBff.exe
  C:\Windows\System\nvgyBff.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\CNoiOqe.exe
  C:\Windows\System\CNoiOqe.exe
  2⤵
  PID:3096
- C:\Windows\System\tFvktkG.exe
  C:\Windows\System\tFvktkG.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\wEtFcXI.exe
  C:\Windows\System\wEtFcXI.exe
  2⤵
  PID:3128
- C:\Windows\System\scEbuIL.exe
  C:\Windows\System\scEbuIL.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\QrYXNyl.exe
  C:\Windows\System\QrYXNyl.exe
  2⤵
  PID:3160
- C:\Windows\System\EgglDCF.exe
  C:\Windows\System\EgglDCF.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\svKVAMH.exe
  C:\Windows\System\svKVAMH.exe
  2⤵
  PID:3192
- C:\Windows\System\WbzsnYi.exe
  C:\Windows\System\WbzsnYi.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\dYVtcrI.exe
  C:\Windows\System\dYVtcrI.exe
  2⤵
  PID:3224
- C:\Windows\System\dlopkll.exe
  C:\Windows\System\dlopkll.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\RhAQIRt.exe
  C:\Windows\System\RhAQIRt.exe
  2⤵
  PID:3256
- C:\Windows\System\lfopBEr.exe
  C:\Windows\System\lfopBEr.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\XMxDwqQ.exe
  C:\Windows\System\XMxDwqQ.exe
  2⤵
  PID:3288
- C:\Windows\System\bwNmGzn.exe
  C:\Windows\System\bwNmGzn.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System\jNmKXFT.exe
  C:\Windows\System\jNmKXFT.exe
  2⤵
  PID:3320
- C:\Windows\System\gWBvYcn.exe
  C:\Windows\System\gWBvYcn.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\jZCwnaj.exe
  C:\Windows\System\jZCwnaj.exe
  2⤵
  PID:3352
- C:\Windows\System\BEodvzc.exe
  C:\Windows\System\BEodvzc.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System\nsyceem.exe
  C:\Windows\System\nsyceem.exe
  2⤵
  PID:3384
- C:\Windows\System\gXGCEql.exe
  C:\Windows\System\gXGCEql.exe
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Windows\System\DFagPNp.exe
  C:\Windows\System\DFagPNp.exe
  2⤵
  PID:3416
- C:\Windows\System\tjcPBTM.exe
  C:\Windows\System\tjcPBTM.exe
  2⤵
  PID:3432
- C:\Windows\System\LvlrvCt.exe
  C:\Windows\System\LvlrvCt.exe
  2⤵
  PID:3448
- C:\Windows\System\GnQskiS.exe
  C:\Windows\System\GnQskiS.exe
  2⤵
  PID:3464
- C:\Windows\System\vRoCHCj.exe
  C:\Windows\System\vRoCHCj.exe
  2⤵
  PID:3480
- C:\Windows\System\ibArTsZ.exe
  C:\Windows\System\ibArTsZ.exe
  2⤵
  PID:3496
- C:\Windows\System\JVVMzjY.exe
  C:\Windows\System\JVVMzjY.exe
  2⤵
  PID:3512
- C:\Windows\System\NNahfzg.exe
  C:\Windows\System\NNahfzg.exe
  2⤵
  PID:3528
- C:\Windows\System\stjOQdh.exe
  C:\Windows\System\stjOQdh.exe
  2⤵
  PID:3544
- C:\Windows\System\LsjDBUq.exe
  C:\Windows\System\LsjDBUq.exe
  2⤵
  PID:3560
- C:\Windows\System\ZmSxKgn.exe
  C:\Windows\System\ZmSxKgn.exe
  2⤵
  PID:3576
- C:\Windows\System\uFXjbNt.exe
  C:\Windows\System\uFXjbNt.exe
  2⤵
  PID:3592
- C:\Windows\System\qBYArLV.exe
  C:\Windows\System\qBYArLV.exe
  2⤵
  PID:3608
- C:\Windows\System\TzXvIdj.exe
  C:\Windows\System\TzXvIdj.exe
  2⤵
  PID:3624
- C:\Windows\System\RFglVZV.exe
  C:\Windows\System\RFglVZV.exe
  2⤵
  PID:3640
- C:\Windows\System\yOrppGr.exe
  C:\Windows\System\yOrppGr.exe
  2⤵
  PID:3656
- C:\Windows\System\GbthobO.exe
  C:\Windows\System\GbthobO.exe
  2⤵
  PID:3672
- C:\Windows\System\VHpuDGa.exe
  C:\Windows\System\VHpuDGa.exe
  2⤵
  PID:3688
- C:\Windows\System\kZOilwz.exe
  C:\Windows\System\kZOilwz.exe
  2⤵
  PID:3704
- C:\Windows\System\sxuzeie.exe
  C:\Windows\System\sxuzeie.exe
  2⤵
  PID:3720
- C:\Windows\System\yMgTYVW.exe
  C:\Windows\System\yMgTYVW.exe
  2⤵
  PID:3736
- C:\Windows\System\uFLLwRb.exe
  C:\Windows\System\uFLLwRb.exe
  2⤵
  PID:3752
- C:\Windows\System\YhaHcXc.exe
  C:\Windows\System\YhaHcXc.exe
  2⤵
  PID:3768
- C:\Windows\System\ASGqVuO.exe
  C:\Windows\System\ASGqVuO.exe
  2⤵
  PID:3784
- C:\Windows\System\uOwbBGF.exe
  C:\Windows\System\uOwbBGF.exe
  2⤵
  PID:3800
- C:\Windows\System\McpKufQ.exe
  C:\Windows\System\McpKufQ.exe
  2⤵
  PID:3816
- C:\Windows\System\wmPagqz.exe
  C:\Windows\System\wmPagqz.exe
  2⤵
  PID:3832
- C:\Windows\System\YTbpuOk.exe
  C:\Windows\System\YTbpuOk.exe
  2⤵
  PID:3848
- C:\Windows\System\SAIBAHL.exe
  C:\Windows\System\SAIBAHL.exe
  2⤵
  PID:3864
- C:\Windows\System\nqdGdGa.exe
  C:\Windows\System\nqdGdGa.exe
  2⤵
  PID:3880
- C:\Windows\System\OnZwvDe.exe
  C:\Windows\System\OnZwvDe.exe
  2⤵
  PID:3896
- C:\Windows\System\ZWAENXj.exe
  C:\Windows\System\ZWAENXj.exe
  2⤵
  PID:3912
- C:\Windows\System\xSrJshP.exe
  C:\Windows\System\xSrJshP.exe
  2⤵
  PID:3928
- C:\Windows\System\RWAYbto.exe
  C:\Windows\System\RWAYbto.exe
  2⤵
  PID:3944
- C:\Windows\System\anwCdBH.exe
  C:\Windows\System\anwCdBH.exe
  2⤵
  PID:3960
- C:\Windows\System\cEfcBMq.exe
  C:\Windows\System\cEfcBMq.exe
  2⤵
  PID:3976
- C:\Windows\System\WZQZDHu.exe
  C:\Windows\System\WZQZDHu.exe
  2⤵
  PID:3992
- C:\Windows\System\gpPSSzY.exe
  C:\Windows\System\gpPSSzY.exe
  2⤵
  PID:4008
- C:\Windows\System\xVxEixB.exe
  C:\Windows\System\xVxEixB.exe
  2⤵
  PID:4024
- C:\Windows\System\QGyFkcF.exe
  C:\Windows\System\QGyFkcF.exe
  2⤵
  PID:3088
- C:\Windows\System\pUMxVYd.exe
  C:\Windows\System\pUMxVYd.exe
  2⤵
  PID:3188
- C:\Windows\System\TRlLlGc.exe
  C:\Windows\System\TRlLlGc.exe
  2⤵
  PID:3220
- C:\Windows\System\nASnrQv.exe
  C:\Windows\System\nASnrQv.exe
  2⤵
  PID:2512
- C:\Windows\System\qpSVVOY.exe
  C:\Windows\System\qpSVVOY.exe
  2⤵
  PID:3344
- C:\Windows\System\QPLlVkP.exe
  C:\Windows\System\QPLlVkP.exe
  2⤵
  PID:3408
- C:\Windows\System\KBNuhRj.exe
  C:\Windows\System\KBNuhRj.exe
  2⤵
  PID:3472
- C:\Windows\System\FhsUhgD.exe
  C:\Windows\System\FhsUhgD.exe
  2⤵
  PID:3604
- C:\Windows\System\ZNWfCnH.exe
  C:\Windows\System\ZNWfCnH.exe
  2⤵
  PID:332
- C:\Windows\System\ArLqwDx.exe
  C:\Windows\System\ArLqwDx.exe
  2⤵
  PID:3796
- C:\Windows\System\mbJdhKS.exe
  C:\Windows\System\mbJdhKS.exe
  2⤵
  PID:568
- C:\Windows\System\FqqVjpa.exe
  C:\Windows\System\FqqVjpa.exe
  2⤵
  PID:3920
- C:\Windows\System\UAnPcDd.exe
  C:\Windows\System\UAnPcDd.exe
  2⤵
  PID:3956
- C:\Windows\System\dSGFqpj.exe
  C:\Windows\System\dSGFqpj.exe
  2⤵
  PID:3984
- C:\Windows\System\WJQrbkB.exe
  C:\Windows\System\WJQrbkB.exe
  2⤵
  PID:2116
- C:\Windows\System\hXEEaQO.exe
  C:\Windows\System\hXEEaQO.exe
  2⤵
  PID:4020
- C:\Windows\System\CQTDnJg.exe
  C:\Windows\System\CQTDnJg.exe
  2⤵
  PID:3248
- C:\Windows\System\ulpzXxW.exe
  C:\Windows\System\ulpzXxW.exe
  2⤵
  PID:3504
- C:\Windows\System\jIplEwg.exe
  C:\Windows\System\jIplEwg.exe
  2⤵
  PID:2684
- C:\Windows\System\akmxigG.exe
  C:\Windows\System\akmxigG.exe
  2⤵
  PID:4112
- C:\Windows\System\YAWvCSH.exe
  C:\Windows\System\YAWvCSH.exe
  2⤵
  PID:4128
- C:\Windows\System\jDlmgmj.exe
  C:\Windows\System\jDlmgmj.exe
  2⤵
  PID:4144
- C:\Windows\System\gSmFTJh.exe
  C:\Windows\System\gSmFTJh.exe
  2⤵
  PID:4160
- C:\Windows\System\uLRldHp.exe
  C:\Windows\System\uLRldHp.exe
  2⤵
  PID:4180
- C:\Windows\System\XDPZXrA.exe
  C:\Windows\System\XDPZXrA.exe
  2⤵
  PID:4200
- C:\Windows\System\xRsvXlB.exe
  C:\Windows\System\xRsvXlB.exe
  2⤵
  PID:4216
- C:\Windows\System\sVICwBF.exe
  C:\Windows\System\sVICwBF.exe
  2⤵
  PID:4232
- C:\Windows\System\MAvefoj.exe
  C:\Windows\System\MAvefoj.exe
  2⤵
  PID:4248
- C:\Windows\System\wAqqeIr.exe
  C:\Windows\System\wAqqeIr.exe
  2⤵
  PID:4264
- C:\Windows\System\RmBmorz.exe
  C:\Windows\System\RmBmorz.exe
  2⤵
  PID:4280
- C:\Windows\System\qqEEtMV.exe
  C:\Windows\System\qqEEtMV.exe
  2⤵
  PID:4296
- C:\Windows\System\FkzpORY.exe
  C:\Windows\System\FkzpORY.exe
  2⤵
  PID:4312
- C:\Windows\System\XgDiWMD.exe
  C:\Windows\System\XgDiWMD.exe
  2⤵
  PID:4328
- C:\Windows\System\tbmfeMX.exe
  C:\Windows\System\tbmfeMX.exe
  2⤵
  PID:4344
- C:\Windows\System\eHPJmQA.exe
  C:\Windows\System\eHPJmQA.exe
  2⤵
  PID:4360
- C:\Windows\System\MXGhmKk.exe
  C:\Windows\System\MXGhmKk.exe
  2⤵
  PID:4376
- C:\Windows\System\dDNSRbe.exe
  C:\Windows\System\dDNSRbe.exe
  2⤵
  PID:4392
- C:\Windows\System\KArkgpr.exe
  C:\Windows\System\KArkgpr.exe
  2⤵
  PID:4496
- C:\Windows\System\uICWgZW.exe
  C:\Windows\System\uICWgZW.exe
  2⤵
  PID:4528
- C:\Windows\System\knMaNAy.exe
  C:\Windows\System\knMaNAy.exe
  2⤵
  PID:4560
- C:\Windows\System\oABibij.exe
  C:\Windows\System\oABibij.exe
  2⤵
  PID:4588
- C:\Windows\System\XuXjgsi.exe
  C:\Windows\System\XuXjgsi.exe
  2⤵
  PID:4604
- C:\Windows\System\XGSbnTx.exe
  C:\Windows\System\XGSbnTx.exe
  2⤵
  PID:4620
- C:\Windows\System\DSEsTAd.exe
  C:\Windows\System\DSEsTAd.exe
  2⤵
  PID:4636
- C:\Windows\System\JQXDzfr.exe
  C:\Windows\System\JQXDzfr.exe
  2⤵
  PID:4652
- C:\Windows\System\lfHKPKs.exe
  C:\Windows\System\lfHKPKs.exe
  2⤵
  PID:4668
- C:\Windows\System\AwCpwgv.exe
  C:\Windows\System\AwCpwgv.exe
  2⤵
  PID:4684
- C:\Windows\System\MvdPnOU.exe
  C:\Windows\System\MvdPnOU.exe
  2⤵
  PID:4700
- C:\Windows\System\RJjLEdd.exe
  C:\Windows\System\RJjLEdd.exe
  2⤵
  PID:4724
- C:\Windows\System\HwJUbjl.exe
  C:\Windows\System\HwJUbjl.exe
  2⤵
  PID:4740
- C:\Windows\System\sKMjEDY.exe
  C:\Windows\System\sKMjEDY.exe
  2⤵
  PID:4756
- C:\Windows\System\NZWtSen.exe
  C:\Windows\System\NZWtSen.exe
  2⤵
  PID:4780
- C:\Windows\System\htnMigY.exe
  C:\Windows\System\htnMigY.exe
  2⤵
  PID:4796
- C:\Windows\System\zWCLzrs.exe
  C:\Windows\System\zWCLzrs.exe
  2⤵
  PID:4812
- C:\Windows\System\QcbzoJl.exe
  C:\Windows\System\QcbzoJl.exe
  2⤵
  PID:4828
- C:\Windows\System\EPYmWfL.exe
  C:\Windows\System\EPYmWfL.exe
  2⤵
  PID:4844
- C:\Windows\System\VOpdOQL.exe
  C:\Windows\System\VOpdOQL.exe
  2⤵
  PID:4860
- C:\Windows\System\vNkQOku.exe
  C:\Windows\System\vNkQOku.exe
  2⤵
  PID:4876
- C:\Windows\System\RccANrG.exe
  C:\Windows\System\RccANrG.exe
  2⤵
  PID:4892
- C:\Windows\System\GysXxmg.exe
  C:\Windows\System\GysXxmg.exe
  2⤵
  PID:4908
- C:\Windows\System\EuxEjsR.exe
  C:\Windows\System\EuxEjsR.exe
  2⤵
  PID:4924
- C:\Windows\System\vJHQFLZ.exe
  C:\Windows\System\vJHQFLZ.exe
  2⤵
  PID:4940
- C:\Windows\System\ZvbPFwd.exe
  C:\Windows\System\ZvbPFwd.exe
  2⤵
  PID:4956
- C:\Windows\System\GTXdfvo.exe
  C:\Windows\System\GTXdfvo.exe
  2⤵
  PID:4996
- C:\Windows\System\ZnlgsEn.exe
  C:\Windows\System\ZnlgsEn.exe
  2⤵
  PID:5036
- C:\Windows\System\QwRQiRN.exe
  C:\Windows\System\QwRQiRN.exe
  2⤵
  PID:5068
- C:\Windows\System\lqbBTFE.exe
  C:\Windows\System\lqbBTFE.exe
  2⤵
  PID:5084
- C:\Windows\System\jJmTMTY.exe
  C:\Windows\System\jJmTMTY.exe
  2⤵
  PID:5100
- C:\Windows\System\CKzgIRZ.exe
  C:\Windows\System\CKzgIRZ.exe
  2⤵
  PID:1304
- C:\Windows\System\IeaBcAa.exe
  C:\Windows\System\IeaBcAa.exe
  2⤵
  PID:4108
- C:\Windows\System\wjRLJTw.exe
  C:\Windows\System\wjRLJTw.exe
  2⤵
  PID:4212
- C:\Windows\System\fUduNlC.exe
  C:\Windows\System\fUduNlC.exe
  2⤵
  PID:4372
- C:\Windows\System\BOsNzkA.exe
  C:\Windows\System\BOsNzkA.exe
  2⤵
  PID:2716
- C:\Windows\System\lVgElst.exe
  C:\Windows\System\lVgElst.exe
  2⤵
  PID:2060
- C:\Windows\System\aCumyQJ.exe
  C:\Windows\System\aCumyQJ.exe
  2⤵
  PID:4596
- C:\Windows\System\bKiCKwr.exe
  C:\Windows\System\bKiCKwr.exe
  2⤵
  PID:4660
- C:\Windows\System\aYdZMfo.exe
  C:\Windows\System\aYdZMfo.exe
  2⤵
  PID:4732
- C:\Windows\System\XoDCZpd.exe
  C:\Windows\System\XoDCZpd.exe
  2⤵
  PID:4804
- C:\Windows\System\EcihowV.exe
  C:\Windows\System\EcihowV.exe
  2⤵
  PID:5136
- C:\Windows\System\hrunfoS.exe
  C:\Windows\System\hrunfoS.exe
  2⤵
  PID:5152
- C:\Windows\System\dRePSDe.exe
  C:\Windows\System\dRePSDe.exe
  2⤵
  PID:5168
- C:\Windows\System\lQTWBkb.exe
  C:\Windows\System\lQTWBkb.exe
  2⤵
  PID:5184
- C:\Windows\System\WzphyEG.exe
  C:\Windows\System\WzphyEG.exe
  2⤵
  PID:5208
- C:\Windows\System\AQhkCEX.exe
  C:\Windows\System\AQhkCEX.exe
  2⤵
  PID:5256
- C:\Windows\System\JZtqWYj.exe
  C:\Windows\System\JZtqWYj.exe
  2⤵
  PID:5300
- C:\Windows\System\lAGVRry.exe
  C:\Windows\System\lAGVRry.exe
  2⤵
  PID:5332
- C:\Windows\System\wJdjtnh.exe
  C:\Windows\System\wJdjtnh.exe
  2⤵
  PID:5352
- C:\Windows\System\GvVdktE.exe
  C:\Windows\System\GvVdktE.exe
  2⤵
  PID:5368
- C:\Windows\System\AHgGmCR.exe
  C:\Windows\System\AHgGmCR.exe
  2⤵
  PID:5384
- C:\Windows\System\TLnKuwM.exe
  C:\Windows\System\TLnKuwM.exe
  2⤵
  PID:5400
- C:\Windows\System\CfozQcv.exe
  C:\Windows\System\CfozQcv.exe
  2⤵
  PID:5424
- C:\Windows\System\AiNBzkn.exe
  C:\Windows\System\AiNBzkn.exe
  2⤵
  PID:5440
- C:\Windows\System\fLxQrNf.exe
  C:\Windows\System\fLxQrNf.exe
  2⤵
  PID:5456
- C:\Windows\System\OECwKuZ.exe
  C:\Windows\System\OECwKuZ.exe
  2⤵
  PID:5472
- C:\Windows\System\vLzxyFK.exe
  C:\Windows\System\vLzxyFK.exe
  2⤵
  PID:5488
- C:\Windows\System\Pxnlobr.exe
  C:\Windows\System\Pxnlobr.exe
  2⤵
  PID:5512
- C:\Windows\System\DfwDyXM.exe
  C:\Windows\System\DfwDyXM.exe
  2⤵
  PID:5544
- C:\Windows\System\irQAiQc.exe
  C:\Windows\System\irQAiQc.exe
  2⤵
  PID:5584
- C:\Windows\System\PKvBwSu.exe
  C:\Windows\System\PKvBwSu.exe
  2⤵
  PID:5608
- C:\Windows\System\RUSaySW.exe
  C:\Windows\System\RUSaySW.exe
  2⤵
  PID:5624
- C:\Windows\System\tuIHlmL.exe
  C:\Windows\System\tuIHlmL.exe
  2⤵
  PID:5640
- C:\Windows\System\EqKEpev.exe
  C:\Windows\System\EqKEpev.exe
  2⤵
  PID:5656
- C:\Windows\System\zLiMTUw.exe
  C:\Windows\System\zLiMTUw.exe
  2⤵
  PID:5672
- C:\Windows\System\oUKeoMP.exe
  C:\Windows\System\oUKeoMP.exe
  2⤵
  PID:5696
- C:\Windows\System\sxzImlO.exe
  C:\Windows\System\sxzImlO.exe
  2⤵
  PID:5720
- C:\Windows\System\szDsqVu.exe
  C:\Windows\System\szDsqVu.exe
  2⤵
  PID:5764
- C:\Windows\System\pRjEXyA.exe
  C:\Windows\System\pRjEXyA.exe
  2⤵
  PID:5792
- C:\Windows\System\VwKcjuR.exe
  C:\Windows\System\VwKcjuR.exe
  2⤵
  PID:5828
- C:\Windows\System\BVZbGBP.exe
  C:\Windows\System\BVZbGBP.exe
  2⤵
  PID:5848
- C:\Windows\System\aLGyKKl.exe
  C:\Windows\System\aLGyKKl.exe
  2⤵
  PID:5864
- C:\Windows\System\GNnWXHW.exe
  C:\Windows\System\GNnWXHW.exe
  2⤵
  PID:5880
- C:\Windows\System\gyFalSQ.exe
  C:\Windows\System\gyFalSQ.exe
  2⤵
  PID:5904
- C:\Windows\System\EsYdDmX.exe
  C:\Windows\System\EsYdDmX.exe
  2⤵
  PID:5928
- C:\Windows\System\QIvFYoo.exe
  C:\Windows\System\QIvFYoo.exe
  2⤵
  PID:5944
- C:\Windows\System\yLZlXqx.exe
  C:\Windows\System\yLZlXqx.exe
  2⤵
  PID:5960
- C:\Windows\System\nNpxgrB.exe
  C:\Windows\System\nNpxgrB.exe
  2⤵
  PID:5984
- C:\Windows\System\ChUrEOI.exe
  C:\Windows\System\ChUrEOI.exe
  2⤵
  PID:6020
- C:\Windows\System\WPzPeWQ.exe
  C:\Windows\System\WPzPeWQ.exe
  2⤵
  PID:6052
- C:\Windows\System\Thrrxdz.exe
  C:\Windows\System\Thrrxdz.exe
  2⤵
  PID:6080
- C:\Windows\System\mRJYEeE.exe
  C:\Windows\System\mRJYEeE.exe
  2⤵
  PID:6096
- C:\Windows\System\MSpuTsp.exe
  C:\Windows\System\MSpuTsp.exe
  2⤵
  PID:6112
- C:\Windows\System\BfOeeod.exe
  C:\Windows\System\BfOeeod.exe
  2⤵
  PID:6128
- C:\Windows\System\cyHqHAF.exe
  C:\Windows\System\cyHqHAF.exe
  2⤵
  PID:4868
- C:\Windows\System\VCbNlZD.exe
  C:\Windows\System\VCbNlZD.exe
  2⤵
  PID:4932
- C:\Windows\System\ZjVbGgD.exe
  C:\Windows\System\ZjVbGgD.exe
  2⤵
  PID:4984
- C:\Windows\System\otiQzdK.exe
  C:\Windows\System\otiQzdK.exe
  2⤵
  PID:3380
- C:\Windows\System\WPMyosx.exe
  C:\Windows\System\WPMyosx.exe
  2⤵
  PID:4628
- C:\Windows\System\HGGRmuP.exe
  C:\Windows\System\HGGRmuP.exe
  2⤵
  PID:5144
- C:\Windows\System\UQPwFGX.exe
  C:\Windows\System\UQPwFGX.exe
  2⤵
  PID:5220
- C:\Windows\System\UVfvSzg.exe
  C:\Windows\System\UVfvSzg.exe
  2⤵
  PID:5360
- C:\Windows\System\CrYjZWu.exe
  C:\Windows\System\CrYjZWu.exe
  2⤵
  PID:5432
- C:\Windows\System\yyixTwH.exe
  C:\Windows\System\yyixTwH.exe
  2⤵
  PID:5496
- C:\Windows\System\aIdhxch.exe
  C:\Windows\System\aIdhxch.exe
  2⤵
  PID:5648
- C:\Windows\System\cggyvue.exe
  C:\Windows\System\cggyvue.exe
  2⤵
  PID:5856
- C:\Windows\System\uLqjPFQ.exe
  C:\Windows\System\uLqjPFQ.exe
  2⤵
  PID:2712
- C:\Windows\System\ZSbkLfJ.exe
  C:\Windows\System\ZSbkLfJ.exe
  2⤵
  PID:4904
- C:\Windows\System\DHpshcj.exe
  C:\Windows\System\DHpshcj.exe
  2⤵
  PID:4768
- C:\Windows\System\LNyxNhJ.exe
  C:\Windows\System\LNyxNhJ.exe
  2⤵
  PID:1432
- C:\Windows\System\VRitphC.exe
  C:\Windows\System\VRitphC.exe
  2⤵
  PID:1652
- C:\Windows\System\BttlaBG.exe
  C:\Windows\System\BttlaBG.exe
  2⤵
  PID:600
- C:\Windows\System\uioyafm.exe
  C:\Windows\System\uioyafm.exe
  2⤵
  PID:6152
- C:\Windows\System\QmwQokk.exe
  C:\Windows\System\QmwQokk.exe
  2⤵
  PID:6168
- C:\Windows\System\WJqVsTE.exe
  C:\Windows\System\WJqVsTE.exe
  2⤵
  PID:6192
- C:\Windows\System\SmpeGXG.exe
  C:\Windows\System\SmpeGXG.exe
  2⤵
  PID:6208
- C:\Windows\System\LuszeQG.exe
  C:\Windows\System\LuszeQG.exe
  2⤵
  PID:6224
- C:\Windows\System\RJWENDQ.exe
  C:\Windows\System\RJWENDQ.exe
  2⤵
  PID:6240
- C:\Windows\System\nuttGSb.exe
  C:\Windows\System\nuttGSb.exe
  2⤵
  PID:6276
- C:\Windows\System\MMfdPnF.exe
  C:\Windows\System\MMfdPnF.exe
  2⤵
  PID:6324
- C:\Windows\System\PAhAZiG.exe
  C:\Windows\System\PAhAZiG.exe
  2⤵
  PID:6340
- C:\Windows\System\KKsRGbS.exe
  C:\Windows\System\KKsRGbS.exe
  2⤵
  PID:6356
- C:\Windows\System\FfpVFkG.exe
  C:\Windows\System\FfpVFkG.exe
  2⤵
  PID:6372
- C:\Windows\System\bGXcBWL.exe
  C:\Windows\System\bGXcBWL.exe
  2⤵
  PID:6396
- C:\Windows\System\ksFgBbf.exe
  C:\Windows\System\ksFgBbf.exe
  2⤵
  PID:6428
- C:\Windows\System\lEYwEUm.exe
  C:\Windows\System\lEYwEUm.exe
  2⤵
  PID:6472
- C:\Windows\System\mpPBNqb.exe
  C:\Windows\System\mpPBNqb.exe
  2⤵
  PID:6488
- C:\Windows\System\OfuqURY.exe
  C:\Windows\System\OfuqURY.exe
  2⤵
  PID:6504
- C:\Windows\System\qdqFOzL.exe
  C:\Windows\System\qdqFOzL.exe
  2⤵
  PID:6520
- C:\Windows\System\FuXeYzk.exe
  C:\Windows\System\FuXeYzk.exe
  2⤵
  PID:6548
- C:\Windows\System\RmbsCxm.exe
  C:\Windows\System\RmbsCxm.exe
  2⤵
  PID:6584
- C:\Windows\System\kYhsNqa.exe
  C:\Windows\System\kYhsNqa.exe
  2⤵
  PID:6620
- C:\Windows\System\OKEOvYv.exe
  C:\Windows\System\OKEOvYv.exe
  2⤵
  PID:6636
- C:\Windows\System\QeeQeDN.exe
  C:\Windows\System\QeeQeDN.exe
  2⤵
  PID:6652
- C:\Windows\System\kJvWSin.exe
  C:\Windows\System\kJvWSin.exe
  2⤵
  PID:6668
- C:\Windows\System\VByIntl.exe
  C:\Windows\System\VByIntl.exe
  2⤵
  PID:6684
- C:\Windows\System\mYZQIKL.exe
  C:\Windows\System\mYZQIKL.exe
  2⤵
  PID:6708
- C:\Windows\System\UpUqjhg.exe
  C:\Windows\System\UpUqjhg.exe
  2⤵
  PID:6732
- C:\Windows\System\bMgiMEn.exe
  C:\Windows\System\bMgiMEn.exe
  2⤵
  PID:6748
- C:\Windows\System\dKhoinI.exe
  C:\Windows\System\dKhoinI.exe
  2⤵
  PID:6808
- C:\Windows\System\AKIfWFK.exe
  C:\Windows\System\AKIfWFK.exe
  2⤵
  PID:6828
- C:\Windows\System\qywRYai.exe
  C:\Windows\System\qywRYai.exe
  2⤵
  PID:6844
- C:\Windows\System\hwvPIvu.exe
  C:\Windows\System\hwvPIvu.exe
  2⤵
  PID:6860
- C:\Windows\System\myvhnST.exe
  C:\Windows\System\myvhnST.exe
  2⤵
  PID:6876
- C:\Windows\System\PIOxUDj.exe
  C:\Windows\System\PIOxUDj.exe
  2⤵
  PID:6904
- C:\Windows\System\HrBrtPO.exe
  C:\Windows\System\HrBrtPO.exe
  2⤵
  PID:6932
- C:\Windows\System\YpdWoHZ.exe
  C:\Windows\System\YpdWoHZ.exe
  2⤵
  PID:6948
- C:\Windows\System\NLMsRJE.exe
  C:\Windows\System\NLMsRJE.exe
  2⤵
  PID:6964
- C:\Windows\System\FDUQHip.exe
  C:\Windows\System\FDUQHip.exe
  2⤵
  PID:6980
- C:\Windows\System\GWUIQJb.exe
  C:\Windows\System\GWUIQJb.exe
  2⤵
  PID:6996
- C:\Windows\System\vMjtyXM.exe
  C:\Windows\System\vMjtyXM.exe
  2⤵
  PID:7032
- C:\Windows\System\dVgTHPU.exe
  C:\Windows\System\dVgTHPU.exe
  2⤵
  PID:7048
- C:\Windows\System\gXkEQQr.exe
  C:\Windows\System\gXkEQQr.exe
  2⤵
  PID:7064
- C:\Windows\System\NdMcOig.exe
  C:\Windows\System\NdMcOig.exe
  2⤵
  PID:7080
- C:\Windows\System\qPoSJdF.exe
  C:\Windows\System\qPoSJdF.exe
  2⤵
  PID:7096
- C:\Windows\System\ddPtMtJ.exe
  C:\Windows\System\ddPtMtJ.exe
  2⤵
  PID:7140
- C:\Windows\System\ZDudBWo.exe
  C:\Windows\System\ZDudBWo.exe
  2⤵
  PID:6036
- C:\Windows\System\MmCvtgg.exe
  C:\Windows\System\MmCvtgg.exe
  2⤵
  PID:2692
- C:\Windows\System\SMzAezu.exe
  C:\Windows\System\SMzAezu.exe
  2⤵
  PID:6200
- C:\Windows\System\eKiUnhH.exe
  C:\Windows\System\eKiUnhH.exe
  2⤵
  PID:6284
- C:\Windows\System\TtLJFQp.exe
  C:\Windows\System\TtLJFQp.exe
  2⤵
  PID:6348
- C:\Windows\System\mlkmqpg.exe
  C:\Windows\System\mlkmqpg.exe
  2⤵
  PID:6460
- C:\Windows\System\kdjdpdd.exe
  C:\Windows\System\kdjdpdd.exe
  2⤵
  PID:6648
- C:\Windows\System\WsGvwwi.exe
  C:\Windows\System\WsGvwwi.exe
  2⤵
  PID:7332
- C:\Windows\System\PVxGyCo.exe
  C:\Windows\System\PVxGyCo.exe
  2⤵
  PID:7348
- C:\Windows\System\spPERYC.exe
  C:\Windows\System\spPERYC.exe
  2⤵
  PID:7364
- C:\Windows\System\NRGbLGp.exe
  C:\Windows\System\NRGbLGp.exe
  2⤵
  PID:7380
- C:\Windows\System\XDVfiUI.exe
  C:\Windows\System\XDVfiUI.exe
  2⤵
  PID:7396
- C:\Windows\System\bZZlJDd.exe
  C:\Windows\System\bZZlJDd.exe
  2⤵
  PID:7412
- C:\Windows\System\hPOMTeQ.exe
  C:\Windows\System\hPOMTeQ.exe
  2⤵
  PID:7432
- C:\Windows\System\qhpyrfE.exe
  C:\Windows\System\qhpyrfE.exe
  2⤵
  PID:7448
- C:\Windows\System\INLscAv.exe
  C:\Windows\System\INLscAv.exe
  2⤵
  PID:7464
- C:\Windows\System\rZXDSOs.exe
  C:\Windows\System\rZXDSOs.exe
  2⤵
  PID:7480
- C:\Windows\System\xHXJbGU.exe
  C:\Windows\System\xHXJbGU.exe
  2⤵
  PID:7500
- C:\Windows\System\KMeIcnk.exe
  C:\Windows\System\KMeIcnk.exe
  2⤵
  PID:7516
- C:\Windows\System\VNoYOVT.exe
  C:\Windows\System\VNoYOVT.exe
  2⤵
  PID:7532
- C:\Windows\System\pSWKIzE.exe
  C:\Windows\System\pSWKIzE.exe
  2⤵
  PID:7548
- C:\Windows\System\rAEosow.exe
  C:\Windows\System\rAEosow.exe
  2⤵
  PID:7564
- C:\Windows\System\xvDBHnu.exe
  C:\Windows\System\xvDBHnu.exe
  2⤵
  PID:7584
- C:\Windows\System\TSOXnPq.exe
  C:\Windows\System\TSOXnPq.exe
  2⤵
  PID:7600
- C:\Windows\System\MzuhiCY.exe
  C:\Windows\System\MzuhiCY.exe
  2⤵
  PID:7616
- C:\Windows\System\JoLlQuE.exe
  C:\Windows\System\JoLlQuE.exe
  2⤵
  PID:7632
- C:\Windows\System\PlMHtKk.exe
  C:\Windows\System\PlMHtKk.exe
  2⤵
  PID:7648
- C:\Windows\System\jkibkwd.exe
  C:\Windows\System\jkibkwd.exe
  2⤵
  PID:7668
- C:\Windows\System\NGLxHQV.exe
  C:\Windows\System\NGLxHQV.exe
  2⤵
  PID:7692
- C:\Windows\System\GoZvlkT.exe
  C:\Windows\System\GoZvlkT.exe
  2⤵
  PID:7708
- C:\Windows\System\yDEWJiq.exe
  C:\Windows\System\yDEWJiq.exe
  2⤵
  PID:7728
- C:\Windows\System\YfeKxzl.exe
  C:\Windows\System\YfeKxzl.exe
  2⤵
  PID:7756
- C:\Windows\System\KwNTtyX.exe
  C:\Windows\System\KwNTtyX.exe
  2⤵
  PID:7780
- C:\Windows\System\JCTYsst.exe
  C:\Windows\System\JCTYsst.exe
  2⤵
  PID:7796
- C:\Windows\System\tTiTKSh.exe
  C:\Windows\System\tTiTKSh.exe
  2⤵
  PID:7820
- C:\Windows\System\LBLrtxn.exe
  C:\Windows\System\LBLrtxn.exe
  2⤵
  PID:7840
- C:\Windows\System\qIpkIhT.exe
  C:\Windows\System\qIpkIhT.exe
  2⤵
  PID:7860
- C:\Windows\System\jwbGAGh.exe
  C:\Windows\System\jwbGAGh.exe
  2⤵
  PID:7880
- C:\Windows\System\zkpCYyN.exe
  C:\Windows\System\zkpCYyN.exe
  2⤵
  PID:7900
- C:\Windows\System\nBAXYZA.exe
  C:\Windows\System\nBAXYZA.exe
  2⤵
  PID:7916
- C:\Windows\System\bJwiFvL.exe
  C:\Windows\System\bJwiFvL.exe
  2⤵
  PID:7932
- C:\Windows\System\HaXfzKt.exe
  C:\Windows\System\HaXfzKt.exe
  2⤵
  PID:7956
- C:\Windows\System\WhakNFZ.exe
  C:\Windows\System\WhakNFZ.exe
  2⤵
  PID:7972
- C:\Windows\System\ACBboJr.exe
  C:\Windows\System\ACBboJr.exe
  2⤵
  PID:7988
- C:\Windows\System\PXAAZZT.exe
  C:\Windows\System\PXAAZZT.exe
  2⤵
  PID:8004
- C:\Windows\System\roSAJLD.exe
  C:\Windows\System\roSAJLD.exe
  2⤵
  PID:8028
- C:\Windows\System\JDQGgYw.exe
  C:\Windows\System\JDQGgYw.exe
  2⤵
  PID:8088
- C:\Windows\System\aDKbeCU.exe
  C:\Windows\System\aDKbeCU.exe
  2⤵
  PID:8112
- C:\Windows\System\ewdoKIv.exe
  C:\Windows\System\ewdoKIv.exe
  2⤵
  PID:8132
- C:\Windows\System\YzfQXrV.exe
  C:\Windows\System\YzfQXrV.exe
  2⤵
  PID:8152
- C:\Windows\System\QPvvxPB.exe
  C:\Windows\System\QPvvxPB.exe
  2⤵
  PID:8168
- C:\Windows\System\SIUrsBe.exe
  C:\Windows\System\SIUrsBe.exe
  2⤵
  PID:8184
- C:\Windows\System\tBETVlb.exe
  C:\Windows\System\tBETVlb.exe
  2⤵
  PID:7072
- C:\Windows\System\JjzFCje.exe
  C:\Windows\System\JjzFCje.exe
  2⤵
  PID:2956
- C:\Windows\System\UbZxETU.exe
  C:\Windows\System\UbZxETU.exe
  2⤵
  PID:2628
- C:\Windows\System\znfxMFv.exe
  C:\Windows\System\znfxMFv.exe
  2⤵
  PID:2100
- C:\Windows\System\JOvtrse.exe
  C:\Windows\System\JOvtrse.exe
  2⤵
  PID:348
- C:\Windows\System\FCiXmiZ.exe
  C:\Windows\System\FCiXmiZ.exe
  2⤵
  PID:7360
- C:\Windows\System\uKExPGA.exe
  C:\Windows\System\uKExPGA.exe
  2⤵
  PID:7428
- C:\Windows\System\RJiJyBh.exe
  C:\Windows\System\RJiJyBh.exe
  2⤵
  PID:7488
- C:\Windows\System\qDhNLae.exe
  C:\Windows\System\qDhNLae.exe
  2⤵
  PID:5016
- C:\Windows\System\dvNezhr.exe
  C:\Windows\System\dvNezhr.exe
  2⤵
  PID:7492
- C:\Windows\System\dEPIsxb.exe
  C:\Windows\System\dEPIsxb.exe
  2⤵
  PID:7560
- C:\Windows\System\crYNzFd.exe
  C:\Windows\System\crYNzFd.exe
  2⤵
  PID:7628
- C:\Windows\System\IjGIjLd.exe
  C:\Windows\System\IjGIjLd.exe
  2⤵
  PID:7700
- C:\Windows\System\sgnHedq.exe
  C:\Windows\System\sgnHedq.exe
  2⤵
  PID:7376
- C:\Windows\System\DqBLZwR.exe
  C:\Windows\System\DqBLZwR.exe
  2⤵
  PID:7704
- C:\Windows\System\PaxwIAs.exe
  C:\Windows\System\PaxwIAs.exe
  2⤵
  PID:7788
- C:\Windows\System\BSKzSIG.exe
  C:\Windows\System\BSKzSIG.exe
  2⤵
  PID:4916
- C:\Windows\System\oxuUFrw.exe
  C:\Windows\System\oxuUFrw.exe
  2⤵
  PID:4224
- C:\Windows\System\SKQzgVc.exe
  C:\Windows\System\SKQzgVc.exe
  2⤵
  PID:4124
- C:\Windows\System\EwkNtHQ.exe
  C:\Windows\System\EwkNtHQ.exe
  2⤵
  PID:1292
- C:\Windows\System\rGjsYkf.exe
  C:\Windows\System\rGjsYkf.exe
  2⤵
  PID:3316
- C:\Windows\System\prcAaVx.exe
  C:\Windows\System\prcAaVx.exe
  2⤵
  PID:1100
- C:\Windows\System\LeTzLLq.exe
  C:\Windows\System\LeTzLLq.exe
  2⤵
  PID:4000
- C:\Windows\System\LQkLypW.exe
  C:\Windows\System\LQkLypW.exe
  2⤵
  PID:3936
- C:\Windows\System\FnupQit.exe
  C:\Windows\System\FnupQit.exe
  2⤵
  PID:3872
- C:\Windows\System\KyEvgwU.exe
  C:\Windows\System\KyEvgwU.exe
  2⤵
  PID:3808
- C:\Windows\System\hCxkSFA.exe
  C:\Windows\System\hCxkSFA.exe
  2⤵
  PID:3716
- C:\Windows\System\cvBMwuh.exe
  C:\Windows\System\cvBMwuh.exe
  2⤵
  PID:3648
- C:\Windows\System\nyYglxO.exe
  C:\Windows\System\nyYglxO.exe
  2⤵
  PID:3584
- C:\Windows\System\YXEQwXP.exe
  C:\Windows\System\YXEQwXP.exe
  2⤵
  PID:3520
- C:\Windows\System\OsWRXTI.exe
  C:\Windows\System\OsWRXTI.exe
  2⤵
  PID:3456
- C:\Windows\System\ExbRXaV.exe
  C:\Windows\System\ExbRXaV.exe
  2⤵
  PID:3392
- C:\Windows\System\OtoFnjt.exe
  C:\Windows\System\OtoFnjt.exe
  2⤵
  PID:3328
- C:\Windows\System\ZeQddvH.exe
  C:\Windows\System\ZeQddvH.exe
  2⤵
  PID:3264
- C:\Windows\System\cwyQkjh.exe
  C:\Windows\System\cwyQkjh.exe
  2⤵
  PID:3200
- C:\Windows\System\lFcUDjN.exe
  C:\Windows\System\lFcUDjN.exe
  2⤵
  PID:3136
- C:\Windows\System\ItgQHjX.exe
  C:\Windows\System\ItgQHjX.exe
  2⤵
  PID:2168
- C:\Windows\System\GFGeWuo.exe
  C:\Windows\System\GFGeWuo.exe
  2⤵
  PID:2536
- C:\Windows\System\uVTOOQo.exe
  C:\Windows\System\uVTOOQo.exe
  2⤵
  PID:1764
- C:\Windows\System\UYouqff.exe
  C:\Windows\System\UYouqff.exe
  2⤵
  PID:2236
- C:\Windows\System\LhjtsDU.exe
  C:\Windows\System\LhjtsDU.exe
  2⤵
  PID:684
- C:\Windows\System\gyZhMMq.exe
  C:\Windows\System\gyZhMMq.exe
  2⤵
  PID:2664
- C:\Windows\System\EQgdyUV.exe
  C:\Windows\System\EQgdyUV.exe
  2⤵
  PID:2880
- C:\Windows\System\mPvQbJD.exe
  C:\Windows\System\mPvQbJD.exe
  2⤵
  PID:1032
- C:\Windows\System\rxAwyXd.exe
  C:\Windows\System\rxAwyXd.exe
  2⤵
  PID:3016
- C:\Windows\System\JzXIPZb.exe
  C:\Windows\System\JzXIPZb.exe
  2⤵
  PID:2268
- C:\Windows\System\PRonEgU.exe
  C:\Windows\System\PRonEgU.exe
  2⤵
  PID:1232
- C:\Windows\System\mPEaAjL.exe
  C:\Windows\System\mPEaAjL.exe
  2⤵
  PID:928
- C:\Windows\System\TKtXEDK.exe
  C:\Windows\System\TKtXEDK.exe
  2⤵
  PID:6232
- C:\Windows\System\IfjnfEg.exe
  C:\Windows\System\IfjnfEg.exe
  2⤵
  PID:6380
- C:\Windows\System\FrIgRnl.exe
  C:\Windows\System\FrIgRnl.exe
  2⤵
  PID:7544
- C:\Windows\System\WARwerW.exe
  C:\Windows\System\WARwerW.exe
  2⤵
  PID:2752
- C:\Windows\System\XVjfTQk.exe
  C:\Windows\System\XVjfTQk.exe
  2⤵
  PID:7676
- C:\Windows\System\GVtVUWR.exe
  C:\Windows\System\GVtVUWR.exe
  2⤵
  PID:7716
- C:\Windows\System\kZEIFdB.exe
  C:\Windows\System\kZEIFdB.exe
  2⤵
  PID:7804
- C:\Windows\System\NLXruAq.exe
  C:\Windows\System\NLXruAq.exe
  2⤵
  PID:7892
- C:\Windows\System\pdYrFoe.exe
  C:\Windows\System\pdYrFoe.exe
  2⤵
  PID:7968
- C:\Windows\System\NLAQUuA.exe
  C:\Windows\System\NLAQUuA.exe
  2⤵
  PID:7404
- C:\Windows\System\rdluSwS.exe
  C:\Windows\System\rdluSwS.exe
  2⤵
  PID:6944
- C:\Windows\System\QFskVao.exe
  C:\Windows\System\QFskVao.exe
  2⤵
  PID:6824
- C:\Windows\System\GtOFrdG.exe
  C:\Windows\System\GtOFrdG.exe
  2⤵
  PID:6664
- C:\Windows\System\nvLriUQ.exe
  C:\Windows\System\nvLriUQ.exe
  2⤵
  PID:6484
- C:\Windows\System\tuaNble.exe
  C:\Windows\System\tuaNble.exe
  2⤵
  PID:5968
- C:\Windows\System\MCgyxdf.exe
  C:\Windows\System\MCgyxdf.exe
  2⤵
  PID:4404
- C:\Windows\System\MoTMIzO.exe
  C:\Windows\System\MoTMIzO.exe
  2⤵
  PID:5836
- C:\Windows\System\DoNQPNb.exe
  C:\Windows\System\DoNQPNb.exe
  2⤵
  PID:5412
- C:\Windows\System\XnPwbqi.exe
  C:\Windows\System\XnPwbqi.exe
  2⤵
  PID:4536
- C:\Windows\System\FdBZddW.exe
  C:\Windows\System\FdBZddW.exe
  2⤵
  PID:4140
- C:\Windows\System\wunitMY.exe
  C:\Windows\System\wunitMY.exe
  2⤵
  PID:5008
- C:\Windows\System\tBVtjAT.exe
  C:\Windows\System\tBVtjAT.exe
  2⤵
  PID:4852
- C:\Windows\System\wfornLG.exe
  C:\Windows\System\wfornLG.exe
  2⤵
  PID:4788
- C:\Windows\System\UmHoGhn.exe
  C:\Windows\System\UmHoGhn.exe
  2⤵
  PID:4708
- C:\Windows\System\RGDdlhM.exe
  C:\Windows\System\RGDdlhM.exe
  2⤵
  PID:4644
- C:\Windows\System\tNudEaP.exe
  C:\Windows\System\tNudEaP.exe
  2⤵
  PID:4520
- C:\Windows\System\NHUCthI.exe
  C:\Windows\System\NHUCthI.exe
  2⤵
  PID:4352
- C:\Windows\System\czCzVsw.exe
  C:\Windows\System\czCzVsw.exe
  2⤵
  PID:4260
- C:\Windows\System\fIFtWlX.exe
  C:\Windows\System\fIFtWlX.exe
  2⤵
  PID:3952
- C:\Windows\System\kYavetD.exe
  C:\Windows\System\kYavetD.exe
  2⤵
  PID:3156
- C:\Windows\System\KtkEFDx.exe
  C:\Windows\System\KtkEFDx.exe
  2⤵
  PID:7472
- C:\Windows\System\dqwVbVw.exe
  C:\Windows\System\dqwVbVw.exe
  2⤵
  PID:7848
- C:\Windows\System\MFLvSwn.exe
  C:\Windows\System\MFLvSwn.exe
  2⤵
  PID:8084
- C:\Windows\System\EVkLBIx.exe
  C:\Windows\System\EVkLBIx.exe
  2⤵
  PID:8164
- C:\Windows\System\ZwuIHyz.exe
  C:\Windows\System\ZwuIHyz.exe
  2⤵
  PID:8120
- C:\Windows\System\UXcboCS.exe
  C:\Windows\System\UXcboCS.exe
  2⤵
  PID:7996
- C:\Windows\System\ngIECIP.exe
  C:\Windows\System\ngIECIP.exe
  2⤵
  PID:2392
- C:\Windows\System\iybERfO.exe
  C:\Windows\System\iybERfO.exe
  2⤵
  PID:1596
- C:\Windows\System\AQfdPrp.exe
  C:\Windows\System\AQfdPrp.exe
  2⤵
  PID:1424
- C:\Windows\System\FCjLuhu.exe
  C:\Windows\System\FCjLuhu.exe
  2⤵
  PID:7328
- C:\Windows\System\zohwJaE.exe
  C:\Windows\System\zohwJaE.exe
  2⤵
  PID:1256
- C:\Windows\System\JRhTFAa.exe
  C:\Windows\System\JRhTFAa.exe
  2⤵
  PID:1028
- C:\Windows\System\GYnBMrr.exe
  C:\Windows\System\GYnBMrr.exe
  2⤵
  PID:4068
- C:\Windows\System\cbESmXL.exe
  C:\Windows\System\cbESmXL.exe
  2⤵
  PID:448
- C:\Windows\System\pooXkXe.exe
  C:\Windows\System\pooXkXe.exe
  2⤵
  PID:2960
- C:\Windows\System\jyAaEQK.exe
  C:\Windows\System\jyAaEQK.exe
  2⤵
  PID:7392
- C:\Windows\System\VXpDAum.exe
  C:\Windows\System\VXpDAum.exe
  2⤵
  PID:7556
- C:\Windows\System\uxxONWx.exe
  C:\Windows\System\uxxONWx.exe
  2⤵
  PID:6576
- C:\Windows\System\bFZHmna.exe
  C:\Windows\System\bFZHmna.exe
  2⤵
  PID:7980
- C:\Windows\System\OwoCiMu.exe
  C:\Windows\System\OwoCiMu.exe
  2⤵
  PID:8096
- C:\Windows\System\ljrCouz.exe
  C:\Windows\System\ljrCouz.exe
  2⤵
  PID:8144
- C:\Windows\System\UGpEWHU.exe
  C:\Windows\System\UGpEWHU.exe
  2⤵
  PID:7008
- C:\Windows\System\WChgBSo.exe
  C:\Windows\System\WChgBSo.exe
  2⤵
  PID:8176
- C:\Windows\System\kZHVitQ.exe
  C:\Windows\System\kZHVitQ.exe
  2⤵
  PID:6632
- C:\Windows\System\zdteToJ.exe
  C:\Windows\System\zdteToJ.exe
  2⤵
  PID:6364
- C:\Windows\System\UdpyosS.exe
  C:\Windows\System\UdpyosS.exe
  2⤵
  PID:5308
- C:\Windows\System\vGEhHhW.exe
  C:\Windows\System\vGEhHhW.exe
  2⤵
  PID:6188
- C:\Windows\System\ZwWZzer.exe
  C:\Windows\System\ZwWZzer.exe
  2⤵
  PID:5708
- C:\Windows\System\GwBofGE.exe
  C:\Windows\System\GwBofGE.exe
  2⤵
  PID:5952
- C:\Windows\System\McGQAvh.exe
  C:\Windows\System\McGQAvh.exe
  2⤵
  PID:5636
- C:\Windows\System\vpcZPLs.exe
  C:\Windows\System\vpcZPLs.exe
  2⤵
  PID:5532
- C:\Windows\System\pCBLIlE.exe
  C:\Windows\System\pCBLIlE.exe
  2⤵
  PID:5380
- C:\Windows\System\vkHIuEJ.exe
  C:\Windows\System\vkHIuEJ.exe
  2⤵
  PID:5280
- C:\Windows\System\MRkaqbi.exe
  C:\Windows\System\MRkaqbi.exe
  2⤵
  PID:1844
- C:\Windows\System\YaLuTNJ.exe
  C:\Windows\System\YaLuTNJ.exe
  2⤵
  PID:2372
- C:\Windows\System\zJyJILc.exe
  C:\Windows\System\zJyJILc.exe
  2⤵
  PID:5124
- C:\Windows\System\pVVAlEP.exe
  C:\Windows\System\pVVAlEP.exe
  2⤵
  PID:5004
- C:\Windows\System\GpQBSqs.exe
  C:\Windows\System\GpQBSqs.exe
  2⤵
  PID:6660
- C:\Windows\System\OISKSsQ.exe
  C:\Windows\System\OISKSsQ.exe
  2⤵
  PID:2428
- C:\Windows\System\KeZSvNd.exe
  C:\Windows\System\KeZSvNd.exe
  2⤵
  PID:4952
- C:\Windows\System\zIXspUy.exe
  C:\Windows\System\zIXspUy.exe
  2⤵
  PID:4156
- C:\Windows\System\UQugBcG.exe
  C:\Windows\System\UQugBcG.exe
  2⤵
  PID:3776
- C:\Windows\System\ARVyYMN.exe
  C:\Windows\System\ARVyYMN.exe
  2⤵
  PID:2600
- C:\Windows\System\iaBdIvW.exe
  C:\Windows\System\iaBdIvW.exe
  2⤵
  PID:2964
- C:\Windows\System\xAEBbQf.exe
  C:\Windows\System\xAEBbQf.exe
  2⤵
  PID:3204
- C:\Windows\System\zaMQTSb.exe
  C:\Windows\System\zaMQTSb.exe
  2⤵
  PID:7060
- C:\Windows\System\qDmgdgf.exe
  C:\Windows\System\qDmgdgf.exe
  2⤵
  PID:7092
- C:\Windows\System\vsGhfmG.exe
  C:\Windows\System\vsGhfmG.exe
  2⤵
  PID:6300
- C:\Windows\System\RKNjaQs.exe
  C:\Windows\System\RKNjaQs.exe
  2⤵
  PID:1548
- C:\Windows\System\VMRiPES.exe
  C:\Windows\System\VMRiPES.exe
  2⤵
  PID:3032
- C:\Windows\System\TewMCdV.exe
  C:\Windows\System\TewMCdV.exe
  2⤵
  PID:6528
- C:\Windows\System\PYmYEtB.exe
  C:\Windows\System\PYmYEtB.exe
  2⤵
  PID:2572
- C:\Windows\System\QFqVEKA.exe
  C:\Windows\System\QFqVEKA.exe
  2⤵
  PID:2968
- C:\Windows\System\YYAlGZt.exe
  C:\Windows\System\YYAlGZt.exe
  2⤵
  PID:4228
- C:\Windows\System\tJGRTJs.exe
  C:\Windows\System\tJGRTJs.exe
  2⤵
  PID:1800
- C:\Windows\System\FRqevhg.exe
  C:\Windows\System\FRqevhg.exe
  2⤵
  PID:3812
- C:\Windows\System\EdxVBSO.exe
  C:\Windows\System\EdxVBSO.exe
  2⤵
  PID:3552
- C:\Windows\System\NuVBDzL.exe
  C:\Windows\System\NuVBDzL.exe
  2⤵
  PID:3296
- C:\Windows\System\dKXoVfi.exe
  C:\Windows\System\dKXoVfi.exe
  2⤵
  PID:2244
- C:\Windows\System\nziZGZE.exe
  C:\Windows\System\nziZGZE.exe
  2⤵
  PID:2264
- C:\Windows\System\SoqSJtl.exe
  C:\Windows\System\SoqSJtl.exe
  2⤵
  PID:864
- C:\Windows\System\dxZSlEU.exe
  C:\Windows\System\dxZSlEU.exe
  2⤵
  PID:6740
- C:\Windows\System\LxsrSpI.exe
  C:\Windows\System\LxsrSpI.exe
  2⤵
  PID:5912
- C:\Windows\System\dujlVlx.exe
  C:\Windows\System\dujlVlx.exe
  2⤵
  PID:7576
- C:\Windows\System\vDipKQW.exe
  C:\Windows\System\vDipKQW.exe
  2⤵
  PID:2044
- C:\Windows\System\nqisqdJ.exe
  C:\Windows\System\nqisqdJ.exe
  2⤵
  PID:6384
- C:\Windows\System\LOmfwcE.exe
  C:\Windows\System\LOmfwcE.exe
  2⤵
  PID:7684
- C:\Windows\System\bmRwmaR.exe
  C:\Windows\System\bmRwmaR.exe
  2⤵
  PID:5080
- C:\Windows\System\BRlwPbe.exe
  C:\Windows\System\BRlwPbe.exe
  2⤵
  PID:4696
- C:\Windows\System\sLlDCxo.exe
  C:\Windows\System\sLlDCxo.exe
  2⤵
  PID:7888
- C:\Windows\System\ZpRBJzR.exe
  C:\Windows\System\ZpRBJzR.exe
  2⤵
  PID:6516
- C:\Windows\System\RczPkZc.exe
  C:\Windows\System\RczPkZc.exe
  2⤵
  PID:5484
- C:\Windows\System\zefYLpN.exe
  C:\Windows\System\zefYLpN.exe
  2⤵
  PID:3508
- C:\Windows\System\WblljWP.exe
  C:\Windows\System\WblljWP.exe
  2⤵
  PID:8128
- C:\Windows\System\yrZOJdf.exe
  C:\Windows\System\yrZOJdf.exe
  2⤵
  PID:1984
- C:\Windows\System\vISlfTx.exe
  C:\Windows\System\vISlfTx.exe
  2⤵
  PID:7460
- C:\Windows\System\XRnZBNu.exe
  C:\Windows\System\XRnZBNu.exe
  2⤵
  PID:7740
- C:\Windows\System\xoJIbVk.exe
  C:\Windows\System\xoJIbVk.exe
  2⤵
  PID:4292
- C:\Windows\System\FGUCobI.exe
  C:\Windows\System\FGUCobI.exe
  2⤵
  PID:4612
- C:\Windows\System\LWlXOeI.exe
  C:\Windows\System\LWlXOeI.exe
  2⤵
  PID:2256
- C:\Windows\System\yvYpFvV.exe
  C:\Windows\System\yvYpFvV.exe
  2⤵
  PID:1908
- C:\Windows\System\mhnxHLi.exe
  C:\Windows\System\mhnxHLi.exe
  2⤵
  PID:2944
- C:\Windows\System\kvPFXjj.exe
  C:\Windows\System\kvPFXjj.exe
  2⤵
  PID:7624
- C:\Windows\System\NfbVwHs.exe
  C:\Windows\System\NfbVwHs.exe
  2⤵
  PID:2260
- C:\Windows\System\dMBrOSU.exe
  C:\Windows\System\dMBrOSU.exe
  2⤵
  PID:2672
- C:\Windows\System\TduPUHm.exe
  C:\Windows\System\TduPUHm.exe
  2⤵
  PID:5604
- C:\Windows\System\CgaBfHb.exe
  C:\Windows\System\CgaBfHb.exe
  2⤵
  PID:5992
- C:\Windows\System\aeNPtNM.exe
  C:\Windows\System\aeNPtNM.exe
  2⤵
  PID:4692
- C:\Windows\System\rsDstur.exe
  C:\Windows\System\rsDstur.exe
  2⤵
  PID:3440
- C:\Windows\System\fZWzzXz.exe
  C:\Windows\System\fZWzzXz.exe
  2⤵
  PID:3360
- C:\Windows\System\DGHXUkA.exe
  C:\Windows\System\DGHXUkA.exe
  2⤵
  PID:8012
- C:\Windows\System\YmShDOG.exe
  C:\Windows\System\YmShDOG.exe
  2⤵
  PID:7104
- C:\Windows\System\hHcLqVb.exe
  C:\Windows\System\hHcLqVb.exe
  2⤵
  PID:5652
- C:\Windows\System\vDGwAMe.exe
  C:\Windows\System\vDGwAMe.exe
  2⤵
  PID:5448
- C:\Windows\System\RmbPZAF.exe
  C:\Windows\System\RmbPZAF.exe
  2⤵
  PID:5160
- C:\Windows\System\yvcZQdx.exe
  C:\Windows\System\yvcZQdx.exe
  2⤵
  PID:2284
- C:\Windows\System\GaYudzc.exe
  C:\Windows\System\GaYudzc.exe
  2⤵
  PID:3488
- C:\Windows\System\hYQHmVh.exe
  C:\Windows\System\hYQHmVh.exe
  2⤵
  PID:2304
- C:\Windows\System\aEWzNgM.exe
  C:\Windows\System\aEWzNgM.exe
  2⤵
  PID:1796
- C:\Windows\System\ODdIVBK.exe
  C:\Windows\System\ODdIVBK.exe
  2⤵
  PID:3168
- C:\Windows\System\honobJS.exe
  C:\Windows\System\honobJS.exe
  2⤵
  PID:7088
- C:\Windows\System\uNwFqRB.exe
  C:\Windows\System\uNwFqRB.exe
  2⤵
  PID:6180
- C:\Windows\System\TIpZNBZ.exe
  C:\Windows\System\TIpZNBZ.exe
  2⤵
  PID:4676
- C:\Windows\System\yhmOMdM.exe
  C:\Windows\System\yhmOMdM.exe
  2⤵
  PID:7164
- C:\Windows\System\CEZCqlF.exe
  C:\Windows\System\CEZCqlF.exe
  2⤵
  PID:1628
- C:\Windows\System\fmMLQrt.exe
  C:\Windows\System\fmMLQrt.exe
  2⤵
  PID:3940
- C:\Windows\System\THlrVHU.exe
  C:\Windows\System\THlrVHU.exe
  2⤵
  PID:2088
- C:\Windows\System\ppqvAXu.exe
  C:\Windows\System\ppqvAXu.exe
  2⤵
  PID:804
- C:\Windows\System\JCEbrwE.exe
  C:\Windows\System\JCEbrwE.exe
  2⤵
  PID:5108
- C:\Windows\System\KReDzlW.exe
  C:\Windows\System\KReDzlW.exe
  2⤵
  PID:2188
- C:\Windows\System\ExOgDVp.exe
  C:\Windows\System\ExOgDVp.exe
  2⤵
  PID:6564
- C:\Windows\System\fUCWDrU.exe
  C:\Windows\System\fUCWDrU.exe
  2⤵
  PID:4712
- C:\Windows\System\QdceVKk.exe
  C:\Windows\System\QdceVKk.exe
  2⤵
  PID:7908
- C:\Windows\System\cmYTWBG.exe
  C:\Windows\System\cmYTWBG.exe
  2⤵
  PID:8048
- C:\Windows\System\jtrrqQr.exe
  C:\Windows\System\jtrrqQr.exe
  2⤵
  PID:4820
- C:\Windows\System\CYXGyPy.exe
  C:\Windows\System\CYXGyPy.exe
  2⤵
  PID:7664
- C:\Windows\System\xprGoyp.exe
  C:\Windows\System\xprGoyp.exe
  2⤵
  PID:6148
- C:\Windows\System\EOITsNL.exe
  C:\Windows\System\EOITsNL.exe
  2⤵
  PID:5520
- C:\Windows\System\VVQYxSJ.exe
  C:\Windows\System\VVQYxSJ.exe
  2⤵
  PID:5164
- C:\Windows\System\ZARuxTu.exe
  C:\Windows\System\ZARuxTu.exe
  2⤵
  PID:4576
- C:\Windows\System\EzBRHsQ.exe
  C:\Windows\System\EzBRHsQ.exe
  2⤵
  PID:2332
- C:\Windows\System\NvSnZfR.exe
  C:\Windows\System\NvSnZfR.exe
  2⤵
  PID:2364
- C:\Windows\System\phBOIeQ.exe
  C:\Windows\System\phBOIeQ.exe
  2⤵
  PID:3876
- C:\Windows\System\YdBSEOU.exe
  C:\Windows\System\YdBSEOU.exe
  2⤵
  PID:7612
- C:\Windows\System\QvySThG.exe
  C:\Windows\System\QvySThG.exe
  2⤵
  PID:1724
- C:\Windows\System\PSmfcQP.exe
  C:\Windows\System\PSmfcQP.exe
  2⤵
  PID:4792
- C:\Windows\System\PafaGUB.exe
  C:\Windows\System\PafaGUB.exe
  2⤵
  PID:5348
- C:\Windows\System\KiNTaGO.exe
  C:\Windows\System\KiNTaGO.exe
  2⤵
  PID:7012
- C:\Windows\System\ICXEkAK.exe
  C:\Windows\System\ICXEkAK.exe
  2⤵
  PID:7776
- C:\Windows\System\vejTOKz.exe
  C:\Windows\System\vejTOKz.exe
  2⤵
  PID:7456
- C:\Windows\System\sNimJYU.exe
  C:\Windows\System\sNimJYU.exe
  2⤵
  PID:7964
- C:\Windows\System\EuCOzDh.exe
  C:\Windows\System\EuCOzDh.exe
  2⤵
  PID:7420
- C:\Windows\System\lDfkHUM.exe
  C:\Windows\System\lDfkHUM.exe
  2⤵
  PID:1416
- C:\Windows\System\lOxyCAJ.exe
  C:\Windows\System\lOxyCAJ.exe
  2⤵
  PID:4948
- C:\Windows\System\prafNDl.exe
  C:\Windows\System\prafNDl.exe
  2⤵
  PID:4188
- C:\Windows\System\zRmdoaZ.exe
  C:\Windows\System\zRmdoaZ.exe
  2⤵
  PID:5716
- C:\Windows\System\pcHEMpv.exe
  C:\Windows\System\pcHEMpv.exe
  2⤵
  PID:3076
- C:\Windows\System\uJbogeG.exe
  C:\Windows\System\uJbogeG.exe
  2⤵
  PID:3652
- C:\Windows\System\ucUKwBd.exe
  C:\Windows\System\ucUKwBd.exe
  2⤵
  PID:6220
- C:\Windows\System\PQPsKnJ.exe
  C:\Windows\System\PQPsKnJ.exe
  2⤵
  PID:3424
- C:\Windows\System\AYURoTE.exe
  C:\Windows\System\AYURoTE.exe
  2⤵
  PID:7512
- C:\Windows\System\akgxbnp.exe
  C:\Windows\System\akgxbnp.exe
  2⤵
  PID:712
- C:\Windows\System\RQIKttD.exe
  C:\Windows\System\RQIKttD.exe
  2⤵
  PID:6744
- C:\Windows\System\opUInXu.exe
  C:\Windows\System\opUInXu.exe
  2⤵
  PID:6252
- C:\Windows\System\OemJueC.exe
  C:\Windows\System\OemJueC.exe
  2⤵
  PID:2220
- C:\Windows\System\QiwNaDx.exe
  C:\Windows\System\QiwNaDx.exe
  2⤵
  PID:8196
- C:\Windows\System\PwChLLb.exe
  C:\Windows\System\PwChLLb.exe
  2⤵
  PID:8212
- C:\Windows\System\jBqBngT.exe
  C:\Windows\System\jBqBngT.exe
  2⤵
  PID:8232
- C:\Windows\System\XrdLrme.exe
  C:\Windows\System\XrdLrme.exe
  2⤵
  PID:8248
- C:\Windows\System\LCKZkrE.exe
  C:\Windows\System\LCKZkrE.exe
  2⤵
  PID:8264
- C:\Windows\System\FpmHhmr.exe
  C:\Windows\System\FpmHhmr.exe
  2⤵
  PID:8280
- C:\Windows\System\VOUVvdL.exe
  C:\Windows\System\VOUVvdL.exe
  2⤵
  PID:8300
- C:\Windows\System\ukNGbjL.exe
  C:\Windows\System\ukNGbjL.exe
  2⤵
  PID:8316
- C:\Windows\System\UuDBHMh.exe
  C:\Windows\System\UuDBHMh.exe
  2⤵
  PID:8336
- C:\Windows\System\jrAtxil.exe
  C:\Windows\System\jrAtxil.exe
  2⤵
  PID:8352
- C:\Windows\System\GNVDUge.exe
  C:\Windows\System\GNVDUge.exe
  2⤵
  PID:8368
- C:\Windows\System\lLBAUDV.exe
  C:\Windows\System\lLBAUDV.exe
  2⤵
  PID:8384
- C:\Windows\System\LBYDeKq.exe
  C:\Windows\System\LBYDeKq.exe
  2⤵
  PID:8400
- C:\Windows\System\KLtXQEI.exe
  C:\Windows\System\KLtXQEI.exe
  2⤵
  PID:8420
- C:\Windows\System\kGVvzuW.exe
  C:\Windows\System\kGVvzuW.exe
  2⤵
  PID:8436
- C:\Windows\System\cVyupTs.exe
  C:\Windows\System\cVyupTs.exe
  2⤵
  PID:8452
- C:\Windows\System\ICHlSyr.exe
  C:\Windows\System\ICHlSyr.exe
  2⤵
  PID:8472
- C:\Windows\System\MQfzhye.exe
  C:\Windows\System\MQfzhye.exe
  2⤵
  PID:8488
- C:\Windows\System\COIpOAm.exe
  C:\Windows\System\COIpOAm.exe
  2⤵
  PID:8504
- C:\Windows\System\dGsHceE.exe
  C:\Windows\System\dGsHceE.exe
  2⤵
  PID:8520
- C:\Windows\System\XqWnLVC.exe
  C:\Windows\System\XqWnLVC.exe
  2⤵
  PID:8536
- C:\Windows\System\vbvWBlv.exe
  C:\Windows\System\vbvWBlv.exe
  2⤵
  PID:8620
- C:\Windows\System\QmJKANT.exe
  C:\Windows\System\QmJKANT.exe
  2⤵
  PID:8636
- C:\Windows\System\DoycvQu.exe
  C:\Windows\System\DoycvQu.exe
  2⤵
  PID:8656
- C:\Windows\System\oAquMIJ.exe
  C:\Windows\System\oAquMIJ.exe
  2⤵
  PID:8764
- C:\Windows\System\WLSAhTG.exe
  C:\Windows\System\WLSAhTG.exe
  2⤵
  PID:8780
- C:\Windows\System\XAOKdsz.exe
  C:\Windows\System\XAOKdsz.exe
  2⤵
  PID:8800
- C:\Windows\System\ZmrMCFM.exe
  C:\Windows\System\ZmrMCFM.exe
  2⤵
  PID:8816
- C:\Windows\System\aqRuiZV.exe
  C:\Windows\System\aqRuiZV.exe
  2⤵
  PID:8840
- C:\Windows\System\sTqFKMV.exe
  C:\Windows\System\sTqFKMV.exe
  2⤵
  PID:8864
- C:\Windows\System\URDyJpi.exe
  C:\Windows\System\URDyJpi.exe
  2⤵
  PID:8884
- C:\Windows\System\ppCztGq.exe
  C:\Windows\System\ppCztGq.exe
  2⤵
  PID:8900
- C:\Windows\System\aMgSNLU.exe
  C:\Windows\System\aMgSNLU.exe
  2⤵
  PID:8916
- C:\Windows\System\YjwFhmN.exe
  C:\Windows\System\YjwFhmN.exe
  2⤵
  PID:8936
- C:\Windows\System\ftwoBnc.exe
  C:\Windows\System\ftwoBnc.exe
  2⤵
  PID:8964
- C:\Windows\System\rTudWnm.exe
  C:\Windows\System\rTudWnm.exe
  2⤵
  PID:8980
- C:\Windows\System\YmnJyVd.exe
  C:\Windows\System\YmnJyVd.exe
  2⤵
  PID:8996
- C:\Windows\System\UdTNUEo.exe
  C:\Windows\System\UdTNUEo.exe
  2⤵
  PID:9012
- C:\Windows\System\rcepSJD.exe
  C:\Windows\System\rcepSJD.exe
  2⤵
  PID:9032
- C:\Windows\System\iNQGevX.exe
  C:\Windows\System\iNQGevX.exe
  2⤵
  PID:9052
- C:\Windows\System\YDWurqo.exe
  C:\Windows\System\YDWurqo.exe
  2⤵
  PID:9068
- C:\Windows\System\KdkMuRx.exe
  C:\Windows\System\KdkMuRx.exe
  2⤵
  PID:9084
- C:\Windows\System\jUBJfps.exe
  C:\Windows\System\jUBJfps.exe
  2⤵
  PID:9124
- C:\Windows\System\OhgZEGm.exe
  C:\Windows\System\OhgZEGm.exe
  2⤵
  PID:9140
- C:\Windows\System\EkFfpcF.exe
  C:\Windows\System\EkFfpcF.exe
  2⤵
  PID:9156
- C:\Windows\System\JryeDRl.exe
  C:\Windows\System\JryeDRl.exe
  2⤵
  PID:9172
- C:\Windows\System\IUVouKK.exe
  C:\Windows\System\IUVouKK.exe
  2⤵
  PID:2000
- C:\Windows\System\vFYouRf.exe
  C:\Windows\System\vFYouRf.exe
  2⤵
  PID:8272
- C:\Windows\System\uPxwmRg.exe
  C:\Windows\System\uPxwmRg.exe
  2⤵
  PID:8224
- C:\Windows\System\YuwodRA.exe
  C:\Windows\System\YuwodRA.exe
  2⤵
  PID:8416
- C:\Windows\System\ULHRBNQ.exe
  C:\Windows\System\ULHRBNQ.exe
  2⤵
  PID:8480
- C:\Windows\System\KISSJRS.exe
  C:\Windows\System\KISSJRS.exe
  2⤵
  PID:6480
- C:\Windows\System\SKZddHe.exe
  C:\Windows\System\SKZddHe.exe
  2⤵
  PID:3396
- C:\Windows\System\pJamhyy.exe
  C:\Windows\System\pJamhyy.exe
  2⤵
  PID:8228
- C:\Windows\System\PzVmMAC.exe
  C:\Windows\System\PzVmMAC.exe
  2⤵
  PID:8328
- C:\Windows\System\pCzeyXG.exe
  C:\Windows\System\pCzeyXG.exe
  2⤵
  PID:8392
- C:\Windows\System\wmgwHcz.exe
  C:\Windows\System\wmgwHcz.exe
  2⤵
  PID:8460
- C:\Windows\System\yojfVdP.exe
  C:\Windows\System\yojfVdP.exe
  2⤵
  PID:8512
- C:\Windows\System\WLvbdmg.exe
  C:\Windows\System\WLvbdmg.exe
  2⤵
  PID:8552
- C:\Windows\System\SQnTdGO.exe
  C:\Windows\System\SQnTdGO.exe
  2⤵
  PID:8568
- C:\Windows\System\knsFFFV.exe
  C:\Windows\System\knsFFFV.exe
  2⤵
  PID:8576
- C:\Windows\System\aOzIuFw.exe
  C:\Windows\System\aOzIuFw.exe
  2⤵
  PID:8604
- C:\Windows\System\VRAcfZn.exe
  C:\Windows\System\VRAcfZn.exe
  2⤵
  PID:8632
- C:\Windows\System\NqoHAPY.exe
  C:\Windows\System\NqoHAPY.exe
  2⤵
  PID:8644
- C:\Windows\System\OWmeSRK.exe
  C:\Windows\System\OWmeSRK.exe
  2⤵
  PID:8688
- C:\Windows\System\KrItlAr.exe
  C:\Windows\System\KrItlAr.exe
  2⤵
  PID:8704
- C:\Windows\System\wYYOqfc.exe
  C:\Windows\System\wYYOqfc.exe
  2⤵
  PID:8720
- C:\Windows\System\ZBSObDi.exe
  C:\Windows\System\ZBSObDi.exe
  2⤵
  PID:8740
- C:\Windows\System\nxzCnPi.exe
  C:\Windows\System\nxzCnPi.exe
  2⤵
  PID:8756
- C:\Windows\System\jTiHFDc.exe
  C:\Windows\System\jTiHFDc.exe
  2⤵
  PID:8788
- C:\Windows\System\NMRqbtl.exe
  C:\Windows\System\NMRqbtl.exe
  2⤵
  PID:8828
- C:\Windows\System\DkupCJh.exe
  C:\Windows\System\DkupCJh.exe
  2⤵
  PID:8652
- C:\Windows\System\kDTwHgJ.exe
  C:\Windows\System\kDTwHgJ.exe
  2⤵
  PID:8848
- C:\Windows\System\pTGqvta.exe
  C:\Windows\System\pTGqvta.exe
  2⤵
  PID:8852
- C:\Windows\System\HLgaysb.exe
  C:\Windows\System\HLgaysb.exe
  2⤵
  PID:8896
- C:\Windows\System\tJbMoVH.exe
  C:\Windows\System\tJbMoVH.exe
  2⤵
  PID:8908
- C:\Windows\System\fswYLQT.exe
  C:\Windows\System\fswYLQT.exe
  2⤵
  PID:8948
- C:\Windows\System\JQEsHmE.exe
  C:\Windows\System\JQEsHmE.exe
  2⤵
  PID:8972
- C:\Windows\System\aMkHMrq.exe
  C:\Windows\System\aMkHMrq.exe
  2⤵
  PID:9004
- C:\Windows\System\cMDKBWS.exe
  C:\Windows\System\cMDKBWS.exe
  2⤵
  PID:9008
- C:\Windows\System\WQOIDAK.exe
  C:\Windows\System\WQOIDAK.exe
  2⤵
  PID:9060
- C:\Windows\System\rvqfklw.exe
  C:\Windows\System\rvqfklw.exe
  2⤵
  PID:9080
- C:\Windows\System\RBrOsSL.exe
  C:\Windows\System\RBrOsSL.exe
  2⤵
  PID:9108
- C:\Windows\System\uWeNTfa.exe
  C:\Windows\System\uWeNTfa.exe
  2⤵
  PID:9120
- C:\Windows\System\dGitgcD.exe
  C:\Windows\System\dGitgcD.exe
  2⤵
  PID:9152
- C:\Windows\System\ubJfhHT.exe
  C:\Windows\System\ubJfhHT.exe
  2⤵
  PID:9184
- C:\Windows\System\luSQjlG.exe
  C:\Windows\System\luSQjlG.exe
  2⤵
  PID:3680
- C:\Windows\System\vMkMpxg.exe
  C:\Windows\System\vMkMpxg.exe
  2⤵
  PID:8348
- C:\Windows\System\nVDXQPq.exe
  C:\Windows\System\nVDXQPq.exe
  2⤵
  PID:8448
- C:\Windows\System\zywDgfo.exe
  C:\Windows\System\zywDgfo.exe
  2⤵
  PID:4920
- C:\Windows\System\HYGXPkC.exe
  C:\Windows\System\HYGXPkC.exe
  2⤵
  PID:8220
- C:\Windows\System\JoiwTtQ.exe
  C:\Windows\System\JoiwTtQ.exe
  2⤵
  PID:8496
- C:\Windows\System\ORuwIln.exe
  C:\Windows\System\ORuwIln.exe
  2⤵
  PID:8596
- C:\Windows\System\DZNvNtb.exe
  C:\Windows\System\DZNvNtb.exe
  2⤵
  PID:8732
- C:\Windows\System\KpmZazf.exe
  C:\Windows\System\KpmZazf.exe
  2⤵
  PID:6216
- C:\Windows\System\FJktFUJ.exe
  C:\Windows\System\FJktFUJ.exe
  2⤵
  PID:8808
- C:\Windows\System\jTXxJwf.exe
  C:\Windows\System\jTXxJwf.exe
  2⤵
  PID:8876
- C:\Windows\System\tHuSDFv.exe
  C:\Windows\System\tHuSDFv.exe
  2⤵
  PID:9028
- C:\Windows\System\vKwkMBj.exe
  C:\Windows\System\vKwkMBj.exe
  2⤵
  PID:9116
- C:\Windows\System\xkGkXnX.exe
  C:\Windows\System\xkGkXnX.exe
  2⤵
  PID:8308
- C:\Windows\System\RFDiWFm.exe
  C:\Windows\System\RFDiWFm.exe
  2⤵
  PID:8364
- C:\Windows\System\ddRPEMs.exe
  C:\Windows\System\ddRPEMs.exe
  2⤵
  PID:8292
- C:\Windows\System\wjoXVTj.exe
  C:\Windows\System\wjoXVTj.exe
  2⤵
  PID:8296
- C:\Windows\System\SLrIFpv.exe
  C:\Windows\System\SLrIFpv.exe
  2⤵
  PID:8500
- C:\Windows\System\BUyBZmt.exe
  C:\Windows\System\BUyBZmt.exe
  2⤵
  PID:9024
- C:\Windows\System\sQJsSrq.exe
  C:\Windows\System\sQJsSrq.exe
  2⤵
  PID:8612
- C:\Windows\System\NeQgPeX.exe
  C:\Windows\System\NeQgPeX.exe
  2⤵
  PID:8712
- C:\Windows\System\cYHXweK.exe
  C:\Windows\System\cYHXweK.exe
  2⤵
  PID:8796
- C:\Windows\System\blZXpoL.exe
  C:\Windows\System\blZXpoL.exe
  2⤵
  PID:8824
- C:\Windows\System\eUEEZLC.exe
  C:\Windows\System\eUEEZLC.exe
  2⤵
  PID:8528
- C:\Windows\System\jkfUFjS.exe
  C:\Windows\System\jkfUFjS.exe
  2⤵
  PID:8412
- C:\Windows\System\wfxRsll.exe
  C:\Windows\System\wfxRsll.exe
  2⤵
  PID:8428
- C:\Windows\System\PXZezre.exe
  C:\Windows\System\PXZezre.exe
  2⤵
  PID:8532
- C:\Windows\System\KdUxvWk.exe
  C:\Windows\System\KdUxvWk.exe
  2⤵
  PID:8716
- C:\Windows\System\TUHBwGc.exe
  C:\Windows\System\TUHBwGc.exe
  2⤵
  PID:8944
- C:\Windows\System\vLPoOXT.exe
  C:\Windows\System\vLPoOXT.exe
  2⤵
  PID:8988
- C:\Windows\System\cpvarPW.exe
  C:\Windows\System\cpvarPW.exe
  2⤵
  PID:8992
- C:\Windows\System\qjOuCzl.exe
  C:\Windows\System\qjOuCzl.exe
  2⤵
  PID:9048
- C:\Windows\System\DznWuGu.exe
  C:\Windows\System\DznWuGu.exe
  2⤵
  PID:4568
- C:\Windows\System\QQuEhLH.exe
  C:\Windows\System\QQuEhLH.exe
  2⤵
  PID:8592
- C:\Windows\System\pkVaBAJ.exe
  C:\Windows\System\pkVaBAJ.exe
  2⤵
  PID:8432
- C:\Windows\System\qpNSJJd.exe
  C:\Windows\System\qpNSJJd.exe
  2⤵
  PID:2064
- C:\Windows\System\sHnkVXA.exe
  C:\Windows\System\sHnkVXA.exe
  2⤵
  PID:8728
- C:\Windows\System\VbIhSUE.exe
  C:\Windows\System\VbIhSUE.exe
  2⤵
  PID:8932
- C:\Windows\System\rjulKDx.exe
  C:\Windows\System\rjulKDx.exe
  2⤵
  PID:7040
- C:\Windows\System\DkSabYO.exe
  C:\Windows\System\DkSabYO.exe
  2⤵
  PID:8696
- C:\Windows\System\fcaeFDM.exe
  C:\Windows\System\fcaeFDM.exe
  2⤵
  PID:9148
- C:\Windows\System\CeKRXiU.exe
  C:\Windows\System\CeKRXiU.exe
  2⤵
  PID:9220
- C:\Windows\System\OLqQuxg.exe
  C:\Windows\System\OLqQuxg.exe
  2⤵
  PID:9236
- C:\Windows\System\JwmIaBS.exe
  C:\Windows\System\JwmIaBS.exe
  2⤵
  PID:9252
- C:\Windows\System\HLKdFFq.exe
  C:\Windows\System\HLKdFFq.exe
  2⤵
  PID:9268
- C:\Windows\System\kENgaPv.exe
  C:\Windows\System\kENgaPv.exe
  2⤵
  PID:9284
- C:\Windows\System\UaOLQfv.exe
  C:\Windows\System\UaOLQfv.exe
  2⤵
  PID:9300
- C:\Windows\System\QVOPhqw.exe
  C:\Windows\System\QVOPhqw.exe
  2⤵
  PID:9316
- C:\Windows\System\ZIYSuNM.exe
  C:\Windows\System\ZIYSuNM.exe
  2⤵
  PID:9332
- C:\Windows\System\btjumKV.exe
  C:\Windows\System\btjumKV.exe
  2⤵
  PID:9348
- C:\Windows\System\DbXtARn.exe
  C:\Windows\System\DbXtARn.exe
  2⤵
  PID:9364
- C:\Windows\System\zxOqNgf.exe
  C:\Windows\System\zxOqNgf.exe
  2⤵
  PID:9380
- C:\Windows\System\iSnfQHj.exe
  C:\Windows\System\iSnfQHj.exe
  2⤵
  PID:9396
- C:\Windows\System\CGnMXUd.exe
  C:\Windows\System\CGnMXUd.exe
  2⤵
  PID:9412
- C:\Windows\System\kiddiaz.exe
  C:\Windows\System\kiddiaz.exe
  2⤵
  PID:9428
- C:\Windows\System\PJiGbCq.exe
  C:\Windows\System\PJiGbCq.exe
  2⤵
  PID:9444
- C:\Windows\System\JvUHoEe.exe
  C:\Windows\System\JvUHoEe.exe
  2⤵
  PID:9464
- C:\Windows\System\PLwUqqF.exe
  C:\Windows\System\PLwUqqF.exe
  2⤵
  PID:9480
- C:\Windows\System\TfhtAxD.exe
  C:\Windows\System\TfhtAxD.exe
  2⤵
  PID:9496
- C:\Windows\System\rLCtyMF.exe
  C:\Windows\System\rLCtyMF.exe
  2⤵
  PID:9512
- C:\Windows\System\rkAFrye.exe
  C:\Windows\System\rkAFrye.exe
  2⤵
  PID:9528
- C:\Windows\System\MYxGhMT.exe
  C:\Windows\System\MYxGhMT.exe
  2⤵
  PID:9544
- C:\Windows\System\PErHjTP.exe
  C:\Windows\System\PErHjTP.exe
  2⤵
  PID:9560
- C:\Windows\System\LPXqzrh.exe
  C:\Windows\System\LPXqzrh.exe
  2⤵
  PID:9576
- C:\Windows\System\cTEGxJM.exe
  C:\Windows\System\cTEGxJM.exe
  2⤵
  PID:9592
- C:\Windows\System\RgFlUYg.exe
  C:\Windows\System\RgFlUYg.exe
  2⤵
  PID:9608
- C:\Windows\System\JzQFSIF.exe
  C:\Windows\System\JzQFSIF.exe
  2⤵
  PID:9624
- C:\Windows\System\QGdGZbe.exe
  C:\Windows\System\QGdGZbe.exe
  2⤵
  PID:9640
- C:\Windows\System\evKsdCf.exe
  C:\Windows\System\evKsdCf.exe
  2⤵
  PID:9656
- C:\Windows\System\WccLmaX.exe
  C:\Windows\System\WccLmaX.exe
  2⤵
  PID:9676
- C:\Windows\System\DDNAsCV.exe
  C:\Windows\System\DDNAsCV.exe
  2⤵
  PID:9692
- C:\Windows\System\VrnmJRm.exe
  C:\Windows\System\VrnmJRm.exe
  2⤵
  PID:9712
- C:\Windows\System\IfvfFps.exe
  C:\Windows\System\IfvfFps.exe
  2⤵
  PID:9728
- C:\Windows\System\wVurGMS.exe
  C:\Windows\System\wVurGMS.exe
  2⤵
  PID:9744
- C:\Windows\System\mWBKxwo.exe
  C:\Windows\System\mWBKxwo.exe
  2⤵
  PID:9760
- C:\Windows\System\PxJbzoM.exe
  C:\Windows\System\PxJbzoM.exe
  2⤵
  PID:9776
- C:\Windows\System\tLwVoKM.exe
  C:\Windows\System\tLwVoKM.exe
  2⤵
  PID:9792
- C:\Windows\System\AuEaTTv.exe
  C:\Windows\System\AuEaTTv.exe
  2⤵
  PID:9808
- C:\Windows\System\CBIOFic.exe
  C:\Windows\System\CBIOFic.exe
  2⤵
  PID:9824
- C:\Windows\System\VFGOcKL.exe
  C:\Windows\System\VFGOcKL.exe
  2⤵
  PID:9840
- C:\Windows\System\jofNQFX.exe
  C:\Windows\System\jofNQFX.exe
  2⤵
  PID:9856
- C:\Windows\System\ZJmfdgO.exe
  C:\Windows\System\ZJmfdgO.exe
  2⤵
  PID:9872
- C:\Windows\System\lFGfZpA.exe
  C:\Windows\System\lFGfZpA.exe
  2⤵
  PID:9888
- C:\Windows\System\alYIdfW.exe
  C:\Windows\System\alYIdfW.exe
  2⤵
  PID:9904
- C:\Windows\System\iVSNLOn.exe
  C:\Windows\System\iVSNLOn.exe
  2⤵
  PID:9920
- C:\Windows\System\IOkgKzB.exe
  C:\Windows\System\IOkgKzB.exe
  2⤵
  PID:9936
- C:\Windows\System\qMnlQgx.exe
  C:\Windows\System\qMnlQgx.exe
  2⤵
  PID:9956
- C:\Windows\System\pBRiPgU.exe
  C:\Windows\System\pBRiPgU.exe
  2⤵
  PID:9972
- C:\Windows\System\SnCPmMa.exe
  C:\Windows\System\SnCPmMa.exe
  2⤵
  PID:9988
- C:\Windows\System\wyyTPHq.exe
  C:\Windows\System\wyyTPHq.exe
  2⤵
  PID:10004
- C:\Windows\System\zYGddfp.exe
  C:\Windows\System\zYGddfp.exe
  2⤵
  PID:10084
- C:\Windows\System\AjltYKr.exe
  C:\Windows\System\AjltYKr.exe
  2⤵
  PID:10104
- C:\Windows\System\wUXyrpp.exe
  C:\Windows\System\wUXyrpp.exe
  2⤵
  PID:10120
- C:\Windows\System\JsNhhcl.exe
  C:\Windows\System\JsNhhcl.exe
  2⤵
  PID:10136
- C:\Windows\System\KOjvfGG.exe
  C:\Windows\System\KOjvfGG.exe
  2⤵
  PID:10152
- C:\Windows\System\npVzDSG.exe
  C:\Windows\System\npVzDSG.exe
  2⤵
  PID:10168
- C:\Windows\System\sKuJzsu.exe
  C:\Windows\System\sKuJzsu.exe
  2⤵
  PID:10188
- C:\Windows\System\eqIDMhS.exe
  C:\Windows\System\eqIDMhS.exe
  2⤵
  PID:10204
- C:\Windows\System\ZWyYNKB.exe
  C:\Windows\System\ZWyYNKB.exe
  2⤵
  PID:10220
- C:\Windows\System\YgoAsNX.exe
  C:\Windows\System\YgoAsNX.exe
  2⤵
  PID:10236
- C:\Windows\System\ciLiuWh.exe
  C:\Windows\System\ciLiuWh.exe
  2⤵
  PID:9228
- C:\Windows\System\FtSCIvJ.exe
  C:\Windows\System\FtSCIvJ.exe
  2⤵
  PID:408
- C:\Windows\System\TdBLlBB.exe
  C:\Windows\System\TdBLlBB.exe
  2⤵
  PID:9276
- C:\Windows\System\aixCiMi.exe
  C:\Windows\System\aixCiMi.exe
  2⤵
  PID:9340
- C:\Windows\System\ZtpMiNh.exe
  C:\Windows\System\ZtpMiNh.exe
  2⤵
  PID:9296
- C:\Windows\System\eOkQqrS.exe
  C:\Windows\System\eOkQqrS.exe
  2⤵
  PID:9440
- C:\Windows\System\YDXnrTQ.exe
  C:\Windows\System\YDXnrTQ.exe
  2⤵
  PID:9392
- C:\Windows\System\VnfytuZ.exe
  C:\Windows\System\VnfytuZ.exe
  2⤵
  PID:9328
- C:\Windows\System\ZCEwysu.exe
  C:\Windows\System\ZCEwysu.exe
  2⤵
  PID:9460
- C:\Windows\System\vaCybUP.exe
  C:\Windows\System\vaCybUP.exe
  2⤵
  PID:9536
- C:\Windows\System\idSOQQE.exe
  C:\Windows\System\idSOQQE.exe
  2⤵
  PID:9700
- C:\Windows\System\rTxhqQF.exe
  C:\Windows\System\rTxhqQF.exe
  2⤵
  PID:9636
- C:\Windows\System\WOhprxZ.exe
  C:\Windows\System\WOhprxZ.exe
  2⤵
  PID:9492
- C:\Windows\System\JVocGVq.exe
  C:\Windows\System\JVocGVq.exe
  2⤵
  PID:9488
- C:\Windows\System\YMbOKVm.exe
  C:\Windows\System\YMbOKVm.exe
  2⤵
  PID:9556
- C:\Windows\System\lRkRlvr.exe
  C:\Windows\System\lRkRlvr.exe
  2⤵
  PID:9648
- C:\Windows\System\IweoCTE.exe
  C:\Windows\System\IweoCTE.exe
  2⤵
  PID:9456
- C:\Windows\System\QwhycvW.exe
  C:\Windows\System\QwhycvW.exe
  2⤵
  PID:9740
- C:\Windows\System\aSkCENS.exe
  C:\Windows\System\aSkCENS.exe
  2⤵
  PID:9864
- C:\Windows\System\snzBgAJ.exe
  C:\Windows\System\snzBgAJ.exe
  2⤵
  PID:9932
- C:\Windows\System\BEaFOBO.exe
  C:\Windows\System\BEaFOBO.exe
  2⤵
  PID:9996
- C:\Windows\System\AGUGYZS.exe
  C:\Windows\System\AGUGYZS.exe
  2⤵
  PID:9784
- C:\Windows\System\GeASOMl.exe
  C:\Windows\System\GeASOMl.exe
  2⤵
  PID:9880
- C:\Windows\System\HhQTKem.exe
  C:\Windows\System\HhQTKem.exe
  2⤵
  PID:9720
- C:\Windows\System\IaOATAq.exe
  C:\Windows\System\IaOATAq.exe
  2⤵
  PID:9916
- C:\Windows\System\vQKzqWc.exe
  C:\Windows\System\vQKzqWc.exe
  2⤵
  PID:2132
- C:\Windows\System\eLRzUTX.exe
  C:\Windows\System\eLRzUTX.exe
  2⤵
  PID:2852
- C:\Windows\System\jngaYlU.exe
  C:\Windows\System\jngaYlU.exe
  2⤵
  PID:10032
- C:\Windows\System\DvsTddq.exe
  C:\Windows\System\DvsTddq.exe
  2⤵
  PID:10064
- C:\Windows\System\mBZnEOu.exe
  C:\Windows\System\mBZnEOu.exe
  2⤵
  PID:10076
- C:\Windows\System\excUbPu.exe
  C:\Windows\System\excUbPu.exe
  2⤵
  PID:10132
- C:\Windows\System\OoHYprf.exe
  C:\Windows\System\OoHYprf.exe
  2⤵
  PID:10200
- C:\Windows\System\nvxPYWd.exe
  C:\Windows\System\nvxPYWd.exe
  2⤵
  PID:9232
- C:\Windows\System\EiTiwbm.exe
  C:\Windows\System\EiTiwbm.exe
  2⤵
  PID:9376
- C:\Windows\System\FOREKGS.exe
  C:\Windows\System\FOREKGS.exe
  2⤵
  PID:9504
- C:\Windows\System\tWeWuCv.exe
  C:\Windows\System\tWeWuCv.exe
  2⤵
  PID:9664
- C:\Windows\System\zjBVHPA.exe
  C:\Windows\System\zjBVHPA.exe
  2⤵
  PID:10144
- C:\Windows\System\VVTHQfc.exe
  C:\Windows\System\VVTHQfc.exe
  2⤵
  PID:9616
- C:\Windows\System\gwnMitv.exe
  C:\Windows\System\gwnMitv.exe
  2⤵
  PID:9572
- C:\Windows\System\ZFXemyl.exe
  C:\Windows\System\ZFXemyl.exe
  2⤵
  PID:10184
- C:\Windows\System\CIPjdcv.exe
  C:\Windows\System\CIPjdcv.exe
  2⤵
  PID:9248
- C:\Windows\System\AnvblQP.exe
  C:\Windows\System\AnvblQP.exe
  2⤵
  PID:9472
- C:\Windows\System\sbvZiyg.exe
  C:\Windows\System\sbvZiyg.exe
  2⤵
  PID:9708
- C:\Windows\System\HFnaxry.exe
  C:\Windows\System\HFnaxry.exe
  2⤵
  PID:9832
- C:\Windows\System\iTpaMMb.exe
  C:\Windows\System\iTpaMMb.exe
  2⤵
  PID:9836
- C:\Windows\System\fIkoBqO.exe
  C:\Windows\System\fIkoBqO.exe
  2⤵
  PID:8344
- C:\Windows\System\biKFsuA.exe
  C:\Windows\System\biKFsuA.exe
  2⤵
  PID:9896
- C:\Windows\System\JgAumOa.exe
  C:\Windows\System\JgAumOa.exe
  2⤵
  PID:9704
- C:\Windows\System\RchfELJ.exe
  C:\Windows\System\RchfELJ.exe
  2⤵
  PID:10164
- C:\Windows\System\wZagDcE.exe
  C:\Windows\System\wZagDcE.exe
  2⤵
  PID:10148
- C:\Windows\System\StbHaIT.exe
  C:\Windows\System\StbHaIT.exe
  2⤵
  PID:9372
- C:\Windows\System\HubuWIV.exe
  C:\Windows\System\HubuWIV.exe
  2⤵
  PID:9244
- C:\Windows\System\KkyRyVJ.exe
  C:\Windows\System\KkyRyVJ.exe
  2⤵
  PID:9568
- C:\Windows\System\TKWqPOg.exe
  C:\Windows\System\TKWqPOg.exe
  2⤵
  PID:10012
- C:\Windows\System\VZelToS.exe
  C:\Windows\System\VZelToS.exe
  2⤵
  PID:9820
- C:\Windows\System\eXLYsjy.exe
  C:\Windows\System\eXLYsjy.exe
  2⤵
  PID:10040
- C:\Windows\System\waSonyo.exe
  C:\Windows\System\waSonyo.exe
  2⤵
  PID:10060
- C:\Windows\System\YXdsrSp.exe
  C:\Windows\System\YXdsrSp.exe
  2⤵
  PID:10128
- C:\Windows\System\WRBDaaO.exe
  C:\Windows\System\WRBDaaO.exe
  2⤵
  PID:10116
- C:\Windows\System\mngSCTk.exe
  C:\Windows\System\mngSCTk.exe
  2⤵
  PID:9524
- C:\Windows\System\NOHXWLK.exe
  C:\Windows\System\NOHXWLK.exe
  2⤵
  PID:9668
- C:\Windows\System\eUHgspa.exe
  C:\Windows\System\eUHgspa.exe
  2⤵
  PID:9980
- C:\Windows\System\DASnhDj.exe
  C:\Windows\System\DASnhDj.exe
  2⤵
  PID:10160
- C:\Windows\System\OGBalZY.exe
  C:\Windows\System\OGBalZY.exe
  2⤵
  PID:10080
- C:\Windows\System\jemBvjM.exe
  C:\Windows\System\jemBvjM.exe
  2⤵
  PID:10044
- C:\Windows\System\RASCaSu.exe
  C:\Windows\System\RASCaSu.exe
  2⤵
  PID:10096
- C:\Windows\System\PyqIfMt.exe
  C:\Windows\System\PyqIfMt.exe
  2⤵
  PID:10336
- C:\Windows\System\QdHTdrM.exe
  C:\Windows\System\QdHTdrM.exe
  2⤵
  PID:10356
- C:\Windows\System\IQWBSzK.exe
  C:\Windows\System\IQWBSzK.exe
  2⤵
  PID:10380
- C:\Windows\System\kaNVSbd.exe
  C:\Windows\System\kaNVSbd.exe
  2⤵
  PID:10396
- C:\Windows\System\GQrEEIK.exe
  C:\Windows\System\GQrEEIK.exe
  2⤵
  PID:10412
- C:\Windows\System\OQRrAWo.exe
  C:\Windows\System\OQRrAWo.exe
  2⤵
  PID:10428
- C:\Windows\System\mxFpXOA.exe
  C:\Windows\System\mxFpXOA.exe
  2⤵
  PID:10448
- C:\Windows\System\rmMiuEv.exe
  C:\Windows\System\rmMiuEv.exe
  2⤵
  PID:10464
- C:\Windows\System\oPoFLlB.exe
  C:\Windows\System\oPoFLlB.exe
  2⤵
  PID:10480
- C:\Windows\System\lRYzDwL.exe
  C:\Windows\System\lRYzDwL.exe
  2⤵
  PID:10496
- C:\Windows\System\nqrzPlD.exe
  C:\Windows\System\nqrzPlD.exe
  2⤵
  PID:10632
- C:\Windows\System\eFsTTSd.exe
  C:\Windows\System\eFsTTSd.exe
  2⤵
  PID:10660
- C:\Windows\System\ghqpETz.exe
  C:\Windows\System\ghqpETz.exe
  2⤵
  PID:10784
- C:\Windows\System\sfnfYmL.exe
  C:\Windows\System\sfnfYmL.exe
  2⤵
  PID:10804
- C:\Windows\System\dboqpeK.exe
  C:\Windows\System\dboqpeK.exe
  2⤵
  PID:10920
- C:\Windows\System\WBcsdSX.exe
  C:\Windows\System\WBcsdSX.exe
  2⤵
  PID:10936
- C:\Windows\System\IokBpfy.exe
  C:\Windows\System\IokBpfy.exe
  2⤵
  PID:10952
- C:\Windows\System\XAUJdce.exe
  C:\Windows\System\XAUJdce.exe
  2⤵
  PID:10972
- C:\Windows\System\lIqjUaF.exe
  C:\Windows\System\lIqjUaF.exe
  2⤵
  PID:10988
- C:\Windows\System\cpouSmt.exe
  C:\Windows\System\cpouSmt.exe
  2⤵
  PID:11004
- C:\Windows\System\oRxhABl.exe
  C:\Windows\System\oRxhABl.exe
  2⤵
  PID:11024
- C:\Windows\System\wWDkBtf.exe
  C:\Windows\System\wWDkBtf.exe
  2⤵
  PID:11044
- C:\Windows\System\LurhnEg.exe
  C:\Windows\System\LurhnEg.exe
  2⤵
  PID:11060
- C:\Windows\System\KKBWJEp.exe
  C:\Windows\System\KKBWJEp.exe
  2⤵
  PID:11076
- C:\Windows\System\BWyeZvW.exe
  C:\Windows\System\BWyeZvW.exe
  2⤵
  PID:11092
- C:\Windows\System\hoZPvRt.exe
  C:\Windows\System\hoZPvRt.exe
  2⤵
  PID:11108
- C:\Windows\System\iQOvAhL.exe
  C:\Windows\System\iQOvAhL.exe
  2⤵
  PID:11124
- C:\Windows\System\mBReQxV.exe
  C:\Windows\System\mBReQxV.exe
  2⤵
  PID:11140
- C:\Windows\System\evEQCVY.exe
  C:\Windows\System\evEQCVY.exe
  2⤵
  PID:11156
- C:\Windows\System\wlaBXvs.exe
  C:\Windows\System\wlaBXvs.exe
  2⤵
  PID:11172
- C:\Windows\System\QLsyrYN.exe
  C:\Windows\System\QLsyrYN.exe
  2⤵
  PID:11192
- C:\Windows\System\zWvXVEB.exe
  C:\Windows\System\zWvXVEB.exe
  2⤵
  PID:11220
- C:\Windows\System\PgzXYaU.exe
  C:\Windows\System\PgzXYaU.exe
  2⤵
  PID:11236
- C:\Windows\System\oYoMvCN.exe
  C:\Windows\System\oYoMvCN.exe
  2⤵
  PID:11252
- C:\Windows\System\WVVBQNR.exe
  C:\Windows\System\WVVBQNR.exe
  2⤵
  PID:9308
- C:\Windows\System\whUASfY.exe
  C:\Windows\System\whUASfY.exe
  2⤵
  PID:9324
- C:\Windows\System\trlbgYH.exe
  C:\Windows\System\trlbgYH.exe
  2⤵
  PID:10232
- C:\Windows\System\YHmRrhG.exe
  C:\Windows\System\YHmRrhG.exe
  2⤵
  PID:10112
- C:\Windows\System\WZOuKJY.exe
  C:\Windows\System\WZOuKJY.exe
  2⤵
  PID:10252
- C:\Windows\System\YCVrmsG.exe
  C:\Windows\System\YCVrmsG.exe
  2⤵
  PID:10268
- C:\Windows\System\HwMbqHZ.exe
  C:\Windows\System\HwMbqHZ.exe
  2⤵
  PID:10288
- C:\Windows\System\ApQsXCs.exe
  C:\Windows\System\ApQsXCs.exe
  2⤵
  PID:10308
- C:\Windows\System\KdwVImS.exe
  C:\Windows\System\KdwVImS.exe
  2⤵
  PID:10348
- C:\Windows\System\rqedCmH.exe
  C:\Windows\System\rqedCmH.exe
  2⤵
  PID:10328
- C:\Windows\System\ETBkpJV.exe
  C:\Windows\System\ETBkpJV.exe
  2⤵
  PID:10392
- C:\Windows\System\MCWEita.exe
  C:\Windows\System\MCWEita.exe
  2⤵
  PID:10460
- C:\Windows\System\TnaCuvM.exe
  C:\Windows\System\TnaCuvM.exe
  2⤵
  PID:10368
- C:\Windows\System\knWHyFn.exe
  C:\Windows\System\knWHyFn.exe
  2⤵
  PID:10516
- C:\Windows\System\DMYwihY.exe
  C:\Windows\System\DMYwihY.exe
  2⤵
  PID:10440
- C:\Windows\System\kUoOdtL.exe
  C:\Windows\System\kUoOdtL.exe
  2⤵
  PID:10504
- C:\Windows\System\PqFPQex.exe
  C:\Windows\System\PqFPQex.exe
  2⤵
  PID:10524
- C:\Windows\System\xFGSMML.exe
  C:\Windows\System\xFGSMML.exe
  2⤵
  PID:10544
- C:\Windows\System\zSaSiMJ.exe
  C:\Windows\System\zSaSiMJ.exe
  2⤵
  PID:10560
- C:\Windows\System\uEkfKAw.exe
  C:\Windows\System\uEkfKAw.exe
  2⤵
  PID:7320
- C:\Windows\System\SzlDXpl.exe
  C:\Windows\System\SzlDXpl.exe
  2⤵
  PID:10592
- C:\Windows\System\wVOfEHO.exe
  C:\Windows\System\wVOfEHO.exe
  2⤵
  PID:10612
- C:\Windows\System\hqgqIdp.exe
  C:\Windows\System\hqgqIdp.exe
  2⤵
  PID:10628
- C:\Windows\System\cBPFAGU.exe
  C:\Windows\System\cBPFAGU.exe
  2⤵
  PID:10644
- C:\Windows\System\XFdhMtV.exe
  C:\Windows\System\XFdhMtV.exe
  2⤵
  PID:10680
- C:\Windows\System\NXxOQkk.exe
  C:\Windows\System\NXxOQkk.exe
  2⤵
  PID:10696
- C:\Windows\System\bmiYqVG.exe
  C:\Windows\System\bmiYqVG.exe
  2⤵
  PID:10712
- C:\Windows\System\AqnCQFY.exe
  C:\Windows\System\AqnCQFY.exe
  2⤵
  PID:10740
- C:\Windows\System\BSJOMOd.exe
  C:\Windows\System\BSJOMOd.exe
  2⤵
  PID:10764
- C:\Windows\System\BZnZGtn.exe
  C:\Windows\System\BZnZGtn.exe
  2⤵
  PID:10800
- C:\Windows\System\fsdpYyo.exe
  C:\Windows\System\fsdpYyo.exe
  2⤵
  PID:10832
- C:\Windows\System\orFpswz.exe
  C:\Windows\System\orFpswz.exe
  2⤵
  PID:10896
- C:\Windows\System\MCNdYJp.exe
  C:\Windows\System\MCNdYJp.exe
  2⤵
  PID:10816
- C:\Windows\System\tOtKjge.exe
  C:\Windows\System\tOtKjge.exe
  2⤵
  PID:10848
- C:\Windows\System\RRDRKSR.exe
  C:\Windows\System\RRDRKSR.exe
  2⤵
  PID:10864
- C:\Windows\System\kzZfErK.exe
  C:\Windows\System\kzZfErK.exe
  2⤵
  PID:10868
- C:\Windows\System\xkOmQGn.exe
  C:\Windows\System\xkOmQGn.exe
  2⤵
  PID:10892
- C:\Windows\System\zIQSgxO.exe
  C:\Windows\System\zIQSgxO.exe
  2⤵
  PID:10932
- C:\Windows\System\rXsnopp.exe
  C:\Windows\System\rXsnopp.exe
  2⤵
  PID:11000
- C:\Windows\System\dQjLtFM.exe
  C:\Windows\System\dQjLtFM.exe
  2⤵
  PID:11072
- C:\Windows\System\NIjMuao.exe
  C:\Windows\System\NIjMuao.exe
  2⤵
  PID:11136
- C:\Windows\System\iGoPchp.exe
  C:\Windows\System\iGoPchp.exe
  2⤵
  PID:11200
- C:\Windows\System\KPxhXzm.exe
  C:\Windows\System\KPxhXzm.exe
  2⤵
  PID:11120
- C:\Windows\System\YLfxlyL.exe
  C:\Windows\System\YLfxlyL.exe
  2⤵
  PID:11248
- C:\Windows\System\EOlmpLD.exe
  C:\Windows\System\EOlmpLD.exe
  2⤵
  PID:9884
- C:\Windows\System\BMFRYdE.exe
  C:\Windows\System\BMFRYdE.exe
  2⤵
  PID:11052
- C:\Windows\System\roWjEWZ.exe
  C:\Windows\System\roWjEWZ.exe
  2⤵
  PID:10284
- C:\Windows\System\ZeluOSx.exe
  C:\Windows\System\ZeluOSx.exe
  2⤵
  PID:10608
- C:\Windows\System\KCDwbfE.exe
  C:\Windows\System\KCDwbfE.exe
  2⤵
  PID:10720
- C:\Windows\System\rpXXRVN.exe
  C:\Windows\System\rpXXRVN.exe
  2⤵
  PID:10276
- C:\Windows\System\JYHBIkK.exe
  C:\Windows\System\JYHBIkK.exe
  2⤵
  PID:9684
- C:\Windows\System\CRNUyIX.exe
  C:\Windows\System\CRNUyIX.exe
  2⤵
  PID:10732
- C:\Windows\System\pNYPgKg.exe
  C:\Windows\System\pNYPgKg.exe
  2⤵
  PID:10364
- C:\Windows\System\yHBInBZ.exe
  C:\Windows\System\yHBInBZ.exe
  2⤵
  PID:10676
- C:\Windows\System\ViMhICq.exe
  C:\Windows\System\ViMhICq.exe
  2⤵
  PID:10736
- C:\Windows\System\GwtJaPU.exe
  C:\Windows\System\GwtJaPU.exe
  2⤵
  PID:10624
- C:\Windows\System\yIVaFKQ.exe
  C:\Windows\System\yIVaFKQ.exe
  2⤵
  PID:10552
- C:\Windows\System\kaZfgbJ.exe
  C:\Windows\System\kaZfgbJ.exe
  2⤵
  PID:10884
- C:\Windows\System\UBgBFEs.exe
  C:\Windows\System\UBgBFEs.exe
  2⤵
  PID:10824
- C:\Windows\System\nUjpYHA.exe
  C:\Windows\System\nUjpYHA.exe
  2⤵
  PID:11032
- C:\Windows\System\yLXPHlL.exe
  C:\Windows\System\yLXPHlL.exe
  2⤵
  PID:11132
- C:\Windows\System\qpGExhE.exe
  C:\Windows\System\qpGExhE.exe
  2⤵
  PID:10760
- C:\Windows\System\mPGGoLA.exe
  C:\Windows\System\mPGGoLA.exe
  2⤵
  PID:11104
- C:\Windows\System\mjSixQO.exe
  C:\Windows\System\mjSixQO.exe
  2⤵
  PID:10916
- C:\Windows\System\yeXdknA.exe
  C:\Windows\System\yeXdknA.exe
  2⤵
  PID:10964
- C:\Windows\System\bqMGByC.exe
  C:\Windows\System\bqMGByC.exe
  2⤵
  PID:11216
- C:\Windows\System\MWHzmKB.exe
  C:\Windows\System\MWHzmKB.exe
  2⤵
  PID:9848
- C:\Windows\System\wXePTBa.exe
  C:\Windows\System\wXePTBa.exe
  2⤵
  PID:11180
- C:\Windows\System\JWJaEoC.exe
  C:\Windows\System\JWJaEoC.exe
  2⤵
  PID:10584
- C:\Windows\System\FPjXapd.exe
  C:\Windows\System\FPjXapd.exe
  2⤵
  PID:11232
- C:\Windows\System\yHyIEkR.exe
  C:\Windows\System\yHyIEkR.exe
  2⤵
  PID:10424
- C:\Windows\System\QpkqxLf.exe
  C:\Windows\System\QpkqxLf.exe
  2⤵
  PID:10572
- C:\Windows\System\ycYkCAB.exe
  C:\Windows\System\ycYkCAB.exe
  2⤵
  PID:10728
- C:\Windows\System\OpwMEka.exe
  C:\Windows\System\OpwMEka.exe
  2⤵
  PID:10704
- C:\Windows\System\oYfcuCh.exe
  C:\Windows\System\oYfcuCh.exe
  2⤵
  PID:10872
- C:\Windows\System\gRyJJUB.exe
  C:\Windows\System\gRyJJUB.exe
  2⤵
  PID:10756
- C:\Windows\System\XCwigNN.exe
  C:\Windows\System\XCwigNN.exe
  2⤵
  PID:11208
- C:\Windows\System\BzcuYaB.exe
  C:\Windows\System\BzcuYaB.exe
  2⤵
  PID:10648
- C:\Windows\System\slvAouI.exe
  C:\Windows\System\slvAouI.exe
  2⤵
  PID:10888
- C:\Windows\System\jioMlMS.exe
  C:\Windows\System\jioMlMS.exe
  2⤵
  PID:10020
- C:\Windows\System\UrVHtQD.exe
  C:\Windows\System\UrVHtQD.exe
  2⤵
  PID:10980
- C:\Windows\System\pgxkdhw.exe
  C:\Windows\System\pgxkdhw.exe
  2⤵
  PID:10016
- C:\Windows\System\yPJxdCB.exe
  C:\Windows\System\yPJxdCB.exe
  2⤵
  PID:10836
- C:\Windows\System\JUCYnlC.exe
  C:\Windows\System\JUCYnlC.exe
  2⤵
  PID:10948
- C:\Windows\System\TYgAkTM.exe
  C:\Windows\System\TYgAkTM.exe
  2⤵
  PID:10540
- C:\Windows\System\MsldXle.exe
  C:\Windows\System\MsldXle.exe
  2⤵
  PID:11244
- C:\Windows\System\aJlUIFA.exe
  C:\Windows\System\aJlUIFA.exe
  2⤵
  PID:10024
- C:\Windows\System\wktuUPK.exe
  C:\Windows\System\wktuUPK.exe
  2⤵
  PID:10912
- C:\Windows\System\pCdBhkY.exe
  C:\Windows\System\pCdBhkY.exe
  2⤵
  PID:10580
- C:\Windows\System\PeuddZk.exe
  C:\Windows\System\PeuddZk.exe
  2⤵
  PID:11356
- C:\Windows\System\bRiyPaD.exe
  C:\Windows\System\bRiyPaD.exe
  2⤵
  PID:11380
- C:\Windows\System\zcLGfSh.exe
  C:\Windows\System\zcLGfSh.exe
  2⤵
  PID:11412
- C:\Windows\System\ZenLPwD.exe
  C:\Windows\System\ZenLPwD.exe
  2⤵
  PID:11428
- C:\Windows\System\jZXXRUf.exe
  C:\Windows\System\jZXXRUf.exe
  2⤵
  PID:11444
- C:\Windows\System\YVJdvNa.exe
  C:\Windows\System\YVJdvNa.exe
  2⤵
  PID:11508
- C:\Windows\System\rCqogWY.exe
  C:\Windows\System\rCqogWY.exe
  2⤵
  PID:11524
- C:\Windows\System\sBWNsnR.exe
  C:\Windows\System\sBWNsnR.exe
  2⤵
  PID:11540
- C:\Windows\System\pPFRAQQ.exe
  C:\Windows\System\pPFRAQQ.exe
  2⤵
  PID:11556
- C:\Windows\System\USCQpXJ.exe
  C:\Windows\System\USCQpXJ.exe
  2⤵
  PID:11580
- C:\Windows\System\aIOjwxU.exe
  C:\Windows\System\aIOjwxU.exe
  2⤵
  PID:11596
- C:\Windows\System\izTlegs.exe
  C:\Windows\System\izTlegs.exe
  2⤵
  PID:11612
- C:\Windows\System\EYqlBqR.exe
  C:\Windows\System\EYqlBqR.exe
  2⤵
  PID:11628
- C:\Windows\System\voZrQaF.exe
  C:\Windows\System\voZrQaF.exe
  2⤵
  PID:11740
- C:\Windows\System\QuxIHxC.exe
  C:\Windows\System\QuxIHxC.exe
  2⤵
  PID:11780
- C:\Windows\System\UMwxHeR.exe
  C:\Windows\System\UMwxHeR.exe
  2⤵
  PID:11796
- C:\Windows\System\gzncaOL.exe
  C:\Windows\System\gzncaOL.exe
  2⤵
  PID:11812
- C:\Windows\System\PMAiKVS.exe
  C:\Windows\System\PMAiKVS.exe
  2⤵
  PID:11836
- C:\Windows\System\sqWVVVm.exe
  C:\Windows\System\sqWVVVm.exe
  2⤵
  PID:11860
- C:\Windows\System\OVvqOyU.exe
  C:\Windows\System\OVvqOyU.exe
  2⤵
  PID:11880
- C:\Windows\System\lBUdxss.exe
  C:\Windows\System\lBUdxss.exe
  2⤵
  PID:11900
- C:\Windows\System\KrqNyUv.exe
  C:\Windows\System\KrqNyUv.exe
  2⤵
  PID:11916
- C:\Windows\System\KrJglKN.exe
  C:\Windows\System\KrJglKN.exe
  2⤵
  PID:11932
- C:\Windows\System\oiaAOka.exe
  C:\Windows\System\oiaAOka.exe
  2⤵
  PID:11952
- C:\Windows\System\lAOVQeX.exe
  C:\Windows\System\lAOVQeX.exe
  2⤵
  PID:12196
- C:\Windows\System\ojsWDBm.exe
  C:\Windows\System\ojsWDBm.exe
  2⤵
  PID:12212
- C:\Windows\System\UWvXzMP.exe
  C:\Windows\System\UWvXzMP.exe
  2⤵
  PID:12232
- C:\Windows\System\lItORjV.exe
  C:\Windows\System\lItORjV.exe
  2⤵
  PID:12248
- C:\Windows\System\KxnmrrN.exe
  C:\Windows\System\KxnmrrN.exe
  2⤵
  PID:12264
- C:\Windows\System\CcXnFyQ.exe
  C:\Windows\System\CcXnFyQ.exe
  2⤵
  PID:10880
- C:\Windows\System\yoBQqjM.exe
  C:\Windows\System\yoBQqjM.exe
  2⤵
  PID:11016
- C:\Windows\System\XyqAxrF.exe
  C:\Windows\System\XyqAxrF.exe
  2⤵
  PID:10320
- C:\Windows\System\pqUwuaw.exe
  C:\Windows\System\pqUwuaw.exe
  2⤵
  PID:10616
- C:\Windows\System\JkAHUKm.exe
  C:\Windows\System\JkAHUKm.exe
  2⤵
  PID:11036
- C:\Windows\System\Wdykcgd.exe
  C:\Windows\System\Wdykcgd.exe
  2⤵
  PID:10508
- C:\Windows\System\sTZRkPa.exe
  C:\Windows\System\sTZRkPa.exe
  2⤵
  PID:11288
- C:\Windows\System\FNyMjye.exe
  C:\Windows\System\FNyMjye.exe
  2⤵
  PID:11312
- C:\Windows\System\KlQHCAt.exe
  C:\Windows\System\KlQHCAt.exe
  2⤵
  PID:11332
- C:\Windows\System\yFrGXUD.exe
  C:\Windows\System\yFrGXUD.exe
  2⤵
  PID:11352
- C:\Windows\System\PECkmVM.exe
  C:\Windows\System\PECkmVM.exe
  2⤵
  PID:11396
- C:\Windows\System\EyAaBeh.exe
  C:\Windows\System\EyAaBeh.exe
  2⤵
  PID:11368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ByDgMWr.exe

Filesize
2.3MB

MD5
845eb1528495c6519ac55cb579a1d774

SHA1
586b7351892a817399a0d614bd535d131f6a42f7

SHA256
f55d425ea9b966785ab2bbb1cbb335560c1c7a476c2a443093d7838e4b25980f

SHA512
1ec20f3b2f62b7d1cd2aba5c85fca668a4ad98ba1e9d6f853b5cf2444f30b5397d8cd0fdbdb133698ac5efce299d23bc99b7de79bed6bf70959b2b96f62d231a

Download Submit
C:\Windows\system\DuLoltw.exe

Filesize
2.3MB

MD5
a181a6d80a68e03ea75d384f6d5680fc

SHA1
f7e5ff4cd281efc0c365c9b974e7c6f993ff54f0

SHA256
72c99fc611ae824cf8e295f6b2b5abbc29197838f8e1e3b2a0c6bfcf971d3410

SHA512
8be273b9ba8593dfda44f40a80e4cf9018a62f91dfd50b0f8ed2be78573a5fd652d5ed39caa0605c3e32b1aa1915303a3f7d0270e3ec6a1838779103b48421b4

Download Submit
C:\Windows\system\FvIkccT.exe

Filesize
2.3MB

MD5
ad7c338e042a6bfa46922703f15c2fd7

SHA1
fbcf96923756e575bf4237f27e6490bd9dd09a4b

SHA256
654ad53ec0eb03e6f6a22edc0ad9eac30a1c877031a0a0ac261f2c43b17087ad

SHA512
1523a6df1052eccff6f4949b81e18974523a93cde020b52be47c18713b5877abf15803041e01858f92b155e9156965d28b9322635ffbb2a276d22a86d04650ac

Download Submit
C:\Windows\system\JjxxcPn.exe

Filesize
2.3MB

MD5
5add97fad22d1c1a769c0a979ea99ee2

SHA1
fbf67e785ee6b9991a3d10c99f95fc25a8737312

SHA256
1530db18afd98a1c512e14a6c12f379673b5f9c3a8b93ec85b23a73fc48b5f23

SHA512
cb9731b65f7ad5dbf11e11dec462049a48061cb55f1184b64a9455d316c5131224dc0b2b81a9d0551979cfa435d993f63a536f684e087f1840a15e5fc4fbc4df

Download Submit
C:\Windows\system\JmgnofU.exe

Filesize
2.3MB

MD5
4e81b9ec2bf17025f76ef6aa6445d3e4

SHA1
583e8e7650d37f720a4dd6361492b139dd35ef5f

SHA256
1380d8c6462c54a7d8be551b4966a477f8bf9d85e8d8bcd4d2a41e7aca636a4b

SHA512
eb685a5aed32700f6da99880b6ed0d5ecf82ceb07ca6d22b8b6cf5ca18af76a6b52ed39c6b028a8cf8cd4278bc06588bb06baffa6a9329a06768ce8721ffe181

Download Submit
C:\Windows\system\OBRpygB.exe

Filesize
2.3MB

MD5
28335b8d3e9abbf6dada2da68da929a9

SHA1
d2ea5fadc48e236805b9f7a422bb2665dbc68744

SHA256
db8586da909a08343f09e2c4424b9cb756b9dee644776505ee4e91219160e52f

SHA512
ead328bc74daac43ae2cd1e72b592802a04a166fc20177863f3fc7b306915e2f10487c2511c10f06ddc758a34c33f00b0af24fa3db8643552cd56bc7bff7a9cc

Download Submit
C:\Windows\system\OlQCnGO.exe

Filesize
2.3MB

MD5
22eea94af5408ed773bd3895ccedcded

SHA1
502fe6afe9e206af9b3578ae0a6165f44ea6830e

SHA256
d491affc884337748f0d9d407eb967133934d9fd331185c192a7ca31575bd280

SHA512
364810cd7dc6ad5e47e5ec38412c5bddbbb90cfa8534d02651b6e134312ef9c64cd95c4faca55b944fa036c8a7587971e10f347ddc2900452581f06e4961c39d

Download Submit
C:\Windows\system\RXGmjlB.exe

Filesize
2.3MB

MD5
88d24bb113163877d0218b3c2d8d942b

SHA1
804e7b58fb5f207a4cb0fc504d0ba6673cb1ec5a

SHA256
b28135a365d2680270de4e0652e942ed2e2c1fe564eaeec696e5c7fd542ddde2

SHA512
42ffc5adff655628c0b123f917bca5ea76299e3a052605e3853b87977c68e25a056ced30897af6cf26bba10cdb484e40c5938caf44bd5119102f41d7027b4843

Download Submit
C:\Windows\system\WrrIAyl.exe

Filesize
2.3MB

MD5
9e2f21de925bdad3eceefc615349ade8

SHA1
30c5143c2ffab92a0ae0e75134744f6876f0f358

SHA256
0a6d094a602e246a21d8ce759f4b0a580f16456270e7159d4e1ee76e0bca104b

SHA512
3cfbed475aed5ec7b917d61e2933cbf22bd5301b7393e121298a5acdad6de5de8fdeac2e371c4eb4c1fe259e21b284796b5276927a5a2c8d41b092893aaeb2ec

Download Submit
C:\Windows\system\YFUEkAv.exe

Filesize
18B

MD5
659bd1053fc0116690a42f30292cd3d4

SHA1
f4047500dd0292499dd1b70f726796bd5c02e84f

SHA256
f65fa1ea15eb1fe02c0db79aa83dca830a2510c5eafc20e0115f448064fffaf2

SHA512
f48b84b8a01308d9b05b4a77a6d12a284387153f1657b9b4c1a7cb73dea93189aa398f2bd5986d2d5d4f4737b93c3ca6a3f002b634cf96837732621df4de711a

Download Submit
C:\Windows\system\YMvKHPU.exe

Filesize
2.3MB

MD5
266506b0f007de6018c3d3f846731e4f

SHA1
67436e77b3f198e339684ba87f2d93a5f5dbe291

SHA256
5055746e282188d273d80946898ff6baee4d5b2da73891b8ad5172e207296e4c

SHA512
283b63f3ccee1aa002f6e6b632aa9c14beaaf02968507fc122556783d38c2e89f10082c7e1669123ee3560b6810db5b31c39dad634d3b31a54a54781a52c66b9

Download Submit
C:\Windows\system\avxzDnB.exe

Filesize
2.3MB

MD5
7719d7a067d435d93b87081b478a0531

SHA1
c2ba89181dbace92a1cfa31674b31bdfd0923ab2

SHA256
2056f42ae808e2aa56a551daf6f13b60d6669b5cfcde757c54631ada8ccad29a

SHA512
456572adc46ac0dc31d58754d8dc65370c9c43181b4beecb2c914283d1a86214bbc266860c47639d0af476776c94ae1cf6f853cf18a74dfdb0e085e2ab5cd663

Download Submit
C:\Windows\system\dDNOguR.exe

Filesize
2.3MB

MD5
c73a79deffd7444ec5ae7d59f4776e77

SHA1
d844c33d64f5471b95f3f5ff1693cf91ad3f76c9

SHA256
6d81555346d9ab9d1cbae6163a185512b5f76838f2771bc90d841d9e09d154f5

SHA512
fffe68d348d67a2e2832341e31ae1e90b2c723b1ccf00f18ca6e795b42c1c5f3fb3d307ea4f5ad420fb8494384f9b1e9baef77f4e4f472514702c01bafe5e1bf

Download Submit
C:\Windows\system\gUEFJZW.exe

Filesize
2.3MB

MD5
94935de7d45687b6e082f8f3cbd8e7df

SHA1
a3d32f82a31fc5d3d93dfabe9bc9f4dbea8fcd9f

SHA256
ee6e0493c944dc87c0307e4bcb40195fd3ff36933e65b8b71463f478eabdc3f8

SHA512
51c5a81b85d0dc0666232ec37abaca91cee71f34ab7ddccd2904883877b688762c304860f289e43d1872cdd4cba1d0b1891480c1782eb368bbc62d8608020ea5

Download Submit
C:\Windows\system\hWymjAx.exe

Filesize
2.3MB

MD5
88f88d9e6a94a223a39d65a062032ed7

SHA1
ee81fc306669c7dc3b19865021d5b3e7fbb6513a

SHA256
a4bfbad3e120601d9f451988bbbc0f45a330985273a7350fc2bc4331e26141df

SHA512
3e520a713b054493ed299d48979aaa780aca461d8afbe6931c93d06b60eb3245f265d50666531041e0cd3b6366885b8e7a34507072139fab7db9fa0c22b5bd28

Download Submit
C:\Windows\system\lUcsgYd.exe

Filesize
2.3MB

MD5
3e36cb1cb1c6f0a3117a1ef200810b83

SHA1
1f3aa02a5645e4a22b4775a69ad75a630a57a8c7

SHA256
505f89f87af2be6d9b63c85ea9c14f58199dd5214eaabd47099ad269627be042

SHA512
effceec2aa7162363bade939d70d51752ee4ee408378ecbb6ea0b36b9d2a32026884f003291b4fee3b662767f298d4633067e47665f9c4bfab7415579f7e9e65

Download Submit
C:\Windows\system\wugQCJk.exe

Filesize
2.3MB

MD5
785316c901012a5cf0935c18ffecf3a7

SHA1
a714c5cf521d60d1c44fe12c40fb218d920d7efa

SHA256
618a0ed0fc7c67d4b8aa8e93b54a8fdbb41eec23a3e99df4f1f74ec97b687606

SHA512
37e13711631c529b766d5eb8108173e7bbe6b19a2a4286d1a15418f8f944ebc4c2cd6ab63132be9ebfe2e25ba375c27fb2e3b5221695273ab7ee2cd94b5df5e7

Download Submit
\Windows\system\DGljSmN.exe

Filesize
2.3MB

MD5
6cd97ebd25f7516641de73418bee10e8

SHA1
c1a811901d14030516a7847a2168327d7a07ffbd

SHA256
1deb98b98c2d3cf9ac80ef0b35778ff88ae51512e753d637ced14b95ee4b79c9

SHA512
8e59262d2142fbb0bd34eeebd86ae60f7894206deb40cdb99e5eac954aa344117f048bfb89dd7ccde5204d0391fe3c415b98af00dba72dbe31757b70a5e40fb9

Download Submit
\Windows\system\EKywZWw.exe

Filesize
2.3MB

MD5
d5ea020d9dec10f76989f8898a636a1f

SHA1
7ac542848fc19c9ae2c345ba331f6efcbbfecb84

SHA256
15201167258357b2a7cee759f5680e0c997e8c5a9086cc5f45f4ed73b013d7a0

SHA512
dba65948b801adce7fb9a66680c1db470be988b5d3e8f72522ff75c96f846f27ed63c112433c51da7a2b862ae271c852fc45cbca37b3c84cb5c152c02f49fec2

Download Submit
\Windows\system\HntcjCM.exe

Filesize
2.3MB

MD5
5533b20e0cb10eb135c92483b6af68da

SHA1
e5e5f4320672dafbc072813f70410de515184f32

SHA256
6a1c3edaeba625508c5e124e17b1474e1764b2a60518e941fac2546895bec244

SHA512
9311d4513941914edeb7418dd5183d2d64da6d53b64b848471a2048e88db6a906abf4ea89c75ca7480e470b8d9d54c237c4bdda9059e7ae98dfb54a2e2c5e210

Download Submit
\Windows\system\ICfPoxh.exe

Filesize
2.3MB

MD5
c3e600e7551ecd261dc23c5401a5798f

SHA1
217508475a73b20207e03fba0e13097dc7316afd

SHA256
9f0df299b096b30537ead426720a0213b9c2f93b1775841c4ee3ac36024be1e2

SHA512
b5b275b86910542ef2f805498e9669e6fbb7c2aa8b3f217f04a3219347a4b4afaefd59b034d96967803ef93644e6bb67013e52ec03b8c7761741c3fb0210fded

Download Submit
\Windows\system\PfVKdUR.exe

Filesize
2.3MB

MD5
17cad87a5ae60713813846518bba7cf2

SHA1
f2ddc5e72b2c8b0ce59ac805afe0d4a9aac9a14a

SHA256
6f11cafa48b2af283578350d2a32426210b10a4459463ed2e4d8f44bc2996e76

SHA512
3d44c4d98cba337349915f4414ab7135d6b097cb0c7ae9e49246c06368b7745aeb5b707b8d4a6f100303a472f6630e8aa6307404ad9139aa4874ae9b082b8099

Download Submit
\Windows\system\RUxeOHq.exe

Filesize
2.3MB

MD5
d792d3113fc073d15ab1491c56799099

SHA1
3b3066cbb934673e79232376f9e4f961f8b0f076

SHA256
aec4a182a4615272880b65f6e31fec5e40c9c6e3fd579c45870c0bf93f0b3b1a

SHA512
f682bbed39e83679fd65502a21fb968d2270ee715e1b6db9a8a7b7785b35ba7109db77af5575a3dd83db895729e78e7e2aa711c28b9bb32ef3bbac51c40ccd1d

Download Submit
\Windows\system\UvHSnzV.exe

Filesize
2.3MB

MD5
bdaeffa1e9c884eb7a23a4ea7d57b453

SHA1
fd11e39febb339f5d71a7e24c99cd06675993386

SHA256
31677dacd3eff43ac290f59befb3394e116809806c9c57bfd6b4b6e216479286

SHA512
9d45056b7c94ea537910a9a84d11157f8d5337ee0181699f64d8fcb5eaaeb7f0da7c4f8f1e10a1cb6195e7399583fb1c46b5227fa405e5b109d23b121093448f

Download Submit
\Windows\system\YzHQuKa.exe

Filesize
2.3MB

MD5
98c6818f34ae9f69944b5b7ade7e9bb4

SHA1
0768deff84b6fd7e2203f4ac0a44ea2a8e23bbae

SHA256
225b5dfae8a7522abc7c39434f8ddcaa406aad654e80ec642bba337ff420e9aa

SHA512
5df90b93a4e0e818bd6762b410285f1fcabea6b0a2751fc6a736f73b194cb6a85b6376fb0579f40623f51da4314834a6eb4aa388907b07c65d33d2cf4c81b6cb

Download Submit
\Windows\system\auwLSFw.exe

Filesize
2.3MB

MD5
86d7ee74ad4b508bed186f58346b883d

SHA1
16347976e7132e44c62901bec346154eace251da

SHA256
9fb589d5c06c61d732d1ca4363ad3b917f8deeb2dbf6745f1af5ad171db99ed2

SHA512
25c25a2c430d234cb15ad753222db54824d6e6ab32e414e2a6ec397b22212966bef253d854599bb6cbb163fc0e73aa1e5db7a25b17c5a844cac4af2c55862ed5

Download Submit
\Windows\system\dcIIjnt.exe

Filesize
2.3MB

MD5
904ce2490916185119618f23a5f9b9fc

SHA1
3b08743d5480adaf87ff16b112f3484760e536ed

SHA256
2db53aba3dcef7879c753f64224b963170ced643a58a68362d10ba1d65a9d5ba

SHA512
b1c0954c349aa2a7de42995f241c7d653ac905d53ebe8463d9e1d3d857a457aaedae86693d3d2f446fe1846407e71a38d11e80c1fb04909399b5ba743efb1383

Download Submit
\Windows\system\eJaWzUZ.exe

Filesize
2.3MB

MD5
4e188ee511bf26832e482d9175abc84a

SHA1
578e8eaa1d12a19ae0212569a68bcbe126a6f9a2

SHA256
bfd693e7bb33ccc179549c452f34c0a3fabb1c70ebe85641a5acd85a930efeee

SHA512
07ea873259c34d4f5a3fe6669da25c4a21e7b7480dfa513b825154525a6db83d7f06b1f2ccabafe09846d2e53139764daef53ceeee1825f139fb143054084b4d

Download Submit
\Windows\system\hnQbjwt.exe

Filesize
2.3MB

MD5
ab4cfbc9e19101a9f0b2954fe3f8a667

SHA1
c162983b7516834d1e51303b5cc8be144b2da212

SHA256
8bd77dc2afafc76e02127e08e76232e7f486cfb78639e76f8da24b1ba12c3a2f

SHA512
d6f9b3d76e6c4523e9548b69522f5b64dc08a74980bd2d8de74bbe9faf649ba279a9ec8dbd66d992821a92e17582f690ac08867202cb71148103b78496a6ee5c

Download Submit
\Windows\system\izJmLNN.exe

Filesize
2.3MB

MD5
fa325eb1e64f8f3bca83a0aafcd74cad

SHA1
2c5f051b856da38460a252d32a2e3a7014377427

SHA256
4d53078655c9d741769e351820ab1c2acd31acdf6d176a36305ee37513eb930f

SHA512
06c6fa0ae8556fd04630476de6f0484131765061e9ad7da4906ed877f2a4554bf979854aa1da21b7694fd007adffb342a758b20bb24e17d1e66d8ccfee4d3dd6

Download Submit
\Windows\system\jtsBxCU.exe

Filesize
2.3MB

MD5
626d02af2351b77c5c39a1a5e1ba0025

SHA1
03474bc39874dfb1ba1ea83d90774ed2c5dfb43a

SHA256
008ccd9e33c6bd59e3af4a1f273e0b16b53c0b12afa6982cfef4e5c0bffa139d

SHA512
c43a19df965250532f4a89ed3ebc925420eddf8e4011684350f3582c7adb71776000d9c1bf81bcb8cac05e8d8cb73396e11d6fa136324e6c3f81ffc7da6c7457

Download Submit
\Windows\system\mPMANqq.exe

Filesize
2.3MB

MD5
4edd6cc4c9631b8eb5b6e712fce26d4c

SHA1
d2f00a33521127728115d752dd84ae3471eefd76

SHA256
b88fa9a5dde7d911e12786e64012c7313eee77db1e96900f94fbb5bb7483c0ee

SHA512
9c878795ebad3ae021a51889c28ee4481d977e9883cc175d86805a628cb4b0c87ff3d801a46e8e769bf44ac72d6754561ceadd60255296afc513dc3e34a1e7b1

Download Submit
\Windows\system\qQBVcrL.exe

Filesize
2.3MB

MD5
16aa3b89a3acc0d99851c465cdddf4fc

SHA1
429554c6afac91f95944552a63af131b2ab775f6

SHA256
81a7592ef4790fa98eb9f6168b4461d72105e83139ca509859236722f29ebfab

SHA512
4abca93fe2c4f970c84b9df9753057a0981dcbef309a1a0cda44338ceb36544294370cb5d6e863eaffca32a273bda005bb652f3fcbd5d664cca44e51efd42b1d

Download Submit
\Windows\system\rxlWdqo.exe

Filesize
2.3MB

MD5
defa20ffcb85469d1a8384399e96ebf0

SHA1
585828d7f2e8a25bc27bf9892610cb50d58f77c9

SHA256
1295fa5a04a6e84d016353fd28823550e82b3e1ba5e81e4ad33b3cacfca0db2b

SHA512
5453cb66a484c24c4ea8e8a5fe7c1ef3f645be52d0a7d08bfb00f8b9813e5856a3eb2c8c97dec51ac9421cb0165c9f3e4d71775edd79f378f974ea117a148a67

Download Submit
\Windows\system\whPQVGj.exe

Filesize
2.3MB

MD5
590d2a0d496498980b5e3d3dbb44387e

SHA1
28d02c9cb00554e0e8865d851ffba63647e04cb3

SHA256
e50ad1f814c1006453ed8382f6b6cb0079e095ed5923d1ba35dcbe9878c18e6f

SHA512
69710db3b048a6d6b1f1f30cd1aeca82f7306a514fc09fc0deee4eb32e548ce044e680fb64ec6c8ca52883d3e4c21edb208d0eae6797ed0f68eb3918c2d6d6d6

Download Submit
\Windows\system\xozwfXi.exe

Filesize
2.3MB

MD5
c622530d1982dd3774493ab0a47788fe

SHA1
4f51704efaf9a4616d43cbc571237427be9832f7

SHA256
514514606402b67eec3cce111155427fc747ec3a6787dca9d46e29e6801c7819

SHA512
5a7f26a2ccdf66bb496a1152c102f29e68a0226949fd38441307fd490a036d27e9a35eee1f2fdd087d67a9c86927b2f63c1101b3338b350b5880707edd9ebb18

Download Submit
\Windows\system\xyrhTRQ.exe

Filesize
2.3MB

MD5
199de399038655c41f598ba839261ede

SHA1
ebe64ea80b3a9e038ce5f5c3f954577e79e2fefd

SHA256
938be1ace03516d1464017026f74a8e03099f6420dc89e976cd4875ec3ecd8f2

SHA512
4df1c24d519f1f0fec5b8ac30a58fd271854056b97fb96012068f6f75fdffd76a9135935428e6494623008247bf3ea2c284b59b422584f69a3e3eede453e329d

Download Submit
memory/316-5555-0x000000013FFF0000-0x00000001403E2000-memory.dmp

Filesize
3.9MB

Download
memory/316-9-0x000000013FFF0000-0x00000001403E2000-memory.dmp

Filesize
3.9MB

Download
memory/768-116-0x00000000003A0000-0x00000000003A8000-memory.dmp

Filesize
32KB

Download
memory/768-115-0x000000001B870000-0x000000001BB52000-memory.dmp

Filesize
2.9MB

Download
memory/768-61-0x0000000002D10000-0x0000000002D90000-memory.dmp

Filesize
512KB

Download
memory/2176-5557-0x000000013F190000-0x000000013F582000-memory.dmp

Filesize
3.9MB

Download
memory/2480-5562-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/2480-65-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/2524-5510-0x000000013F4C0000-0x000000013F8B2000-memory.dmp

Filesize
3.9MB

Download
memory/2524-71-0x000000013F4C0000-0x000000013F8B2000-memory.dmp

Filesize
3.9MB

Download
memory/2660-5466-0x000000013F780000-0x000000013FB72000-memory.dmp

Filesize
3.9MB

Download
memory/2660-66-0x000000013F780000-0x000000013FB72000-memory.dmp

Filesize
3.9MB

Download
memory/2676-49-0x000000013F310000-0x000000013F702000-memory.dmp

Filesize
3.9MB

Download
memory/2676-5586-0x000000013F310000-0x000000013F702000-memory.dmp

Filesize
3.9MB

Download
memory/2704-79-0x000000013F300000-0x000000013F6F2000-memory.dmp

Filesize
3.9MB

Download
memory/2704-5462-0x000000013F300000-0x000000013F6F2000-memory.dmp

Filesize
3.9MB

Download
memory/2808-19-0x000000013F870000-0x000000013FC62000-memory.dmp

Filesize
3.9MB

Download
memory/2812-85-0x000000013FDC0000-0x00000001401B2000-memory.dmp

Filesize
3.9MB

Download
memory/2812-42-0x0000000003660000-0x0000000003A52000-memory.dmp

Filesize
3.9MB

Download
memory/2812-62-0x0000000003660000-0x0000000003A52000-memory.dmp

Filesize
3.9MB

Download
memory/2812-68-0x0000000003660000-0x0000000003A52000-memory.dmp

Filesize
3.9MB

Download
memory/2812-60-0x0000000003660000-0x0000000003A52000-memory.dmp

Filesize
3.9MB

Download
memory/2812-69-0x000000013F780000-0x000000013FB72000-memory.dmp

Filesize
3.9MB

Download
memory/2812-7-0x000000013FFF0000-0x00000001403E2000-memory.dmp

Filesize
3.9MB

Download
memory/2812-18-0x000000013F870000-0x000000013FC62000-memory.dmp

Filesize
3.9MB

Download
memory/2812-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2812-0-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download
memory/2812-70-0x0000000003660000-0x0000000003A52000-memory.dmp

Filesize
3.9MB

Download
memory/2812-20-0x0000000003200000-0x00000000035F2000-memory.dmp

Filesize
3.9MB

Download
memory/2812-108-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download
memory/2812-67-0x000000013F9D0000-0x000000013FDC2000-memory.dmp

Filesize
3.9MB

Download
memory/2812-107-0x000000013F940000-0x000000013FD32000-memory.dmp

Filesize
3.9MB

Download
memory/3024-26-0x000000013F190000-0x000000013F582000-memory.dmp

Filesize
3.9MB

Download
memory/3024-5457-0x000000013F190000-0x000000013F582000-memory.dmp

Filesize
3.9MB

Download