xmrig | f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c

Analysis

max time kernel
150s
max time network
146s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/08/2024, 05:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
Size

1.9MB
MD5

4cc3e21feb6abdc431c8cc4d0aec71dd
SHA1

51cd88fe333ad2062d1f941cb220f95357c45675
SHA256

f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c
SHA512

93195e5a17d1d45a4eab5ac72a993384a5003899ae75dfbd43f8a901df9ad08c8e5af7efe57ce5282a3eb141ab8c1a0a62d7b02799c21345cda837116117fc84
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82S5k7hzD9zu:NABI

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 15 IoCs

miner

resource	yara_rule
behavioral1/memory/2620-188-0x000000013F370000-0x000000013F762000-memory.dmp	xmrig
behavioral1/memory/2408-193-0x000000013FF90000-0x0000000140382000-memory.dmp	xmrig
behavioral1/memory/532-101-0x000000013F950000-0x000000013FD42000-memory.dmp	xmrig
behavioral1/memory/2772-192-0x000000013F270000-0x000000013F662000-memory.dmp	xmrig
behavioral1/memory/2680-191-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	xmrig
behavioral1/memory/2676-190-0x000000013F520000-0x000000013F912000-memory.dmp	xmrig
behavioral1/memory/2460-89-0x000000013F090000-0x000000013F482000-memory.dmp	xmrig
behavioral1/memory/2620-5256-0x000000013F370000-0x000000013F762000-memory.dmp	xmrig
behavioral1/memory/2408-5280-0x000000013FF90000-0x0000000140382000-memory.dmp	xmrig
behavioral1/memory/532-5298-0x000000013F950000-0x000000013FD42000-memory.dmp	xmrig
behavioral1/memory/2460-5302-0x000000013F090000-0x000000013F482000-memory.dmp	xmrig
behavioral1/memory/2676-5325-0x000000013F520000-0x000000013F912000-memory.dmp	xmrig
behavioral1/memory/2680-5346-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	xmrig
behavioral1/memory/2772-5336-0x000000013F270000-0x000000013F662000-memory.dmp	xmrig
behavioral1/memory/1840-11229-0x000000013FE10000-0x0000000140202000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2440	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2460	AVPCsAE.exe
532	dYvbjES.exe
2620	mJVVAcx.exe
2676	RzRkAlX.exe
2680	JKoNyAE.exe
2772	rsFQLJa.exe
2408	BFONeej.exe
2756	ynKQaLh.exe
2652	JMzuXrx.exe
2816	RHpyGwn.exe
2692	AAxXmVa.exe
2544	CRHhDTa.exe
3024	zbdMWwu.exe
1504	twqyEVJ.exe
2008	lFwITIR.exe
2828	LePsolB.exe
832	HnWrAaq.exe
2288	QIBYRkz.exe
2696	xBtgInv.exe
2916	HhUIGqI.exe
2852	CqdVBaP.exe
3052	EnbLkmv.exe
3056	KjEfznI.exe
408	Loabnlw.exe
3012	QubzLYx.exe
1196	FBvurpH.exe
1700	aJVqiUR.exe
1800	HKVrOZJ.exe
2604	eZqLTDY.exe
2184	OyuxbtB.exe
1808	jYRlRfE.exe
2804	XLoQoaU.exe
1028	XolcIfB.exe
2812	GCugdRY.exe
2900	IThBymD.exe
2380	MNaZaeG.exe
2224	rFjBxoF.exe
996	PuqYIWz.exe
2948	TlEJLAF.exe
2132	jYsSdju.exe
1656	QoEIGJN.exe
588	fyyOCCL.exe
320	eXmKwiP.exe
2336	wokTgez.exe
2300	ATgwaAF.exe
2452	wywJfMq.exe
1592	SYHFWCa.exe
2500	ZjlwjSb.exe
2944	CvwOecX.exe
2552	QZwrxLA.exe
2800	iNpgtnI.exe
2520	OINhIzD.exe
2736	qHrLUTY.exe
2760	qjHPAQr.exe
3032	WmACtTN.exe
1140	wdxAJoa.exe
1684	LlrHpZs.exe
2512	ydeRLTv.exe
2880	GkAewaQ.exe
2212	kqTkcRr.exe
912	uNlQddR.exe
1836	YMpEHaL.exe
920	XwhNTfa.exe
1544	IPYMcPg.exe

Loads dropped DLL 64 IoCs

pid	Process
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1840-0-0x000000013FE10000-0x0000000140202000-memory.dmp	upx
behavioral1/files/0x000c000000012261-3.dat	upx
behavioral1/files/0x000500000001924b-46.dat	upx
behavioral1/files/0x0005000000019348-65.dat	upx
behavioral1/files/0x000500000001943f-170.dat	upx
behavioral1/memory/2620-188-0x000000013F370000-0x000000013F762000-memory.dmp	upx
behavioral1/memory/2408-193-0x000000013FF90000-0x0000000140382000-memory.dmp	upx
behavioral1/files/0x000500000001962d-151.dat	upx
behavioral1/files/0x0005000000019624-145.dat	upx
behavioral1/files/0x000500000001951e-139.dat	upx
behavioral1/files/0x00050000000194d1-133.dat	upx
behavioral1/files/0x00050000000194a0-126.dat	upx
behavioral1/files/0x000500000001945d-120.dat	upx
behavioral1/files/0x000500000001944a-114.dat	upx
behavioral1/files/0x0005000000019236-110.dat	upx
behavioral1/files/0x000500000001942a-109.dat	upx
behavioral1/files/0x0005000000019415-108.dat	upx
behavioral1/files/0x0005000000019389-107.dat	upx
behavioral1/files/0x000500000001935d-106.dat	upx
behavioral1/files/0x0005000000019345-105.dat	upx
behavioral1/files/0x0005000000019276-104.dat	upx
behavioral1/files/0x0005000000019255-103.dat	upx
behavioral1/files/0x0005000000019248-102.dat	upx
behavioral1/memory/532-101-0x000000013F950000-0x000000013FD42000-memory.dmp	upx
behavioral1/files/0x0005000000019434-97.dat	upx
behavioral1/files/0x00080000000164be-92.dat	upx
behavioral1/files/0x0005000000019418-90.dat	upx
behavioral1/files/0x0005000000019397-82.dat	upx
behavioral1/files/0x000500000001936d-75.dat	upx
behavioral1/files/0x00070000000161f3-68.dat	upx
behavioral1/memory/2772-192-0x000000013F270000-0x000000013F662000-memory.dmp	upx
behavioral1/memory/2680-191-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	upx
behavioral1/memory/2676-190-0x000000013F520000-0x000000013F912000-memory.dmp	upx
behavioral1/files/0x00050000000194bb-173.dat	upx
behavioral1/files/0x0005000000019460-172.dat	upx
behavioral1/files/0x000500000001944e-171.dat	upx
behavioral1/files/0x000500000001979c-154.dat	upx
behavioral1/files/0x000500000001962c-148.dat	upx
behavioral1/files/0x0005000000019622-142.dat	upx
behavioral1/files/0x00050000000194f1-136.dat	upx
behavioral1/files/0x000500000001927e-59.dat	upx
behavioral1/files/0x0005000000019258-52.dat	upx
behavioral1/memory/2460-89-0x000000013F090000-0x000000013F482000-memory.dmp	upx
behavioral1/files/0x0007000000015ff5-42.dat	upx
behavioral1/files/0x000500000001921e-41.dat	upx
behavioral1/files/0x0008000000016317-40.dat	upx
behavioral1/files/0x0007000000016123-39.dat	upx
behavioral1/files/0x0008000000015ebb-38.dat	upx
behavioral1/files/0x0008000000015da7-5.dat	upx
behavioral1/memory/2620-5256-0x000000013F370000-0x000000013F762000-memory.dmp	upx
behavioral1/memory/2408-5280-0x000000013FF90000-0x0000000140382000-memory.dmp	upx
behavioral1/memory/532-5298-0x000000013F950000-0x000000013FD42000-memory.dmp	upx
behavioral1/memory/2460-5302-0x000000013F090000-0x000000013F482000-memory.dmp	upx
behavioral1/memory/2676-5325-0x000000013F520000-0x000000013F912000-memory.dmp	upx
behavioral1/memory/2680-5346-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	upx
behavioral1/memory/2772-5336-0x000000013F270000-0x000000013F662000-memory.dmp	upx
behavioral1/memory/1840-11229-0x000000013FE10000-0x0000000140202000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\OzHzCFa.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\jnWaLPA.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\prbgeaM.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\OpQFjqb.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\hWKchFT.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\jqeWzyr.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\WQyXeSK.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\YhXDkNh.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\WEPuSyt.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\GzAbecN.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\hlpQKec.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\ClEIgWA.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\wyRKHnV.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\IIkomsE.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\QfnLsoh.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\FyXBkmh.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\RQfsRee.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\GkHGOUd.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\aFpnGbU.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\nzanFSD.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\JrHtdZc.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\LkgoIzu.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\ZkFtbgt.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\aeXOITH.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\OqXMpRt.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\QoUgnTy.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\jJJRJXG.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\peAnbAk.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\OWIxbbl.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\anfpBpO.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\ZEuHEHq.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\RVBnIog.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\JqeuwYa.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\WIcTyQv.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\uFyjzkU.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\tRwaOBl.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\BAnxOvt.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\RFdxJEj.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\DklwIOG.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\dNxVQip.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\ZDuYHIq.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\RguqtNx.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\gzBPlQJ.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\NaCGIJS.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\QXTAAse.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\QScVMNX.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\JMzuXrx.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\cRLQyvw.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\VOHztCg.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\gmpaJxZ.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\qhlwVpH.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\Rplbmgy.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\HIibWyn.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\qACHLoJ.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\ygrjqcA.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\DLOgQuh.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\gpWwvgg.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\hpcFFTJ.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\ZkvkRUV.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\uYBydPt.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\TCcaWQf.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\GeXpHDa.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\hupqIyI.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
File created	C:\Windows\System\mAEMktY.exe	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2440	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
Token: SeLockMemoryPrivilege	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
Token: SeDebugPrivilege	2440	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 2440	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	32
PID 1840 wrote to memory of 2440	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	32
PID 1840 wrote to memory of 2440	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	32
PID 1840 wrote to memory of 2460	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	33
PID 1840 wrote to memory of 2460	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	33
PID 1840 wrote to memory of 2460	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	33
PID 1840 wrote to memory of 532	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	34
PID 1840 wrote to memory of 532	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	34
PID 1840 wrote to memory of 532	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	34
PID 1840 wrote to memory of 2620	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	35
PID 1840 wrote to memory of 2620	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	35
PID 1840 wrote to memory of 2620	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	35
PID 1840 wrote to memory of 2408	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	36
PID 1840 wrote to memory of 2408	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	36
PID 1840 wrote to memory of 2408	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	36
PID 1840 wrote to memory of 2676	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	37
PID 1840 wrote to memory of 2676	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	37
PID 1840 wrote to memory of 2676	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	37
PID 1840 wrote to memory of 2756	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	38
PID 1840 wrote to memory of 2756	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	38
PID 1840 wrote to memory of 2756	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	38
PID 1840 wrote to memory of 2680	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	39
PID 1840 wrote to memory of 2680	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	39
PID 1840 wrote to memory of 2680	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	39
PID 1840 wrote to memory of 2652	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	40
PID 1840 wrote to memory of 2652	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	40
PID 1840 wrote to memory of 2652	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	40
PID 1840 wrote to memory of 2772	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	41
PID 1840 wrote to memory of 2772	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	41
PID 1840 wrote to memory of 2772	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	41
PID 1840 wrote to memory of 2288	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	42
PID 1840 wrote to memory of 2288	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	42
PID 1840 wrote to memory of 2288	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	42
PID 1840 wrote to memory of 2816	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	43
PID 1840 wrote to memory of 2816	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	43
PID 1840 wrote to memory of 2816	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	43
PID 1840 wrote to memory of 2696	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	44
PID 1840 wrote to memory of 2696	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	44
PID 1840 wrote to memory of 2696	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	44
PID 1840 wrote to memory of 2692	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	45
PID 1840 wrote to memory of 2692	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	45
PID 1840 wrote to memory of 2692	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	45
PID 1840 wrote to memory of 1800	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	46
PID 1840 wrote to memory of 1800	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	46
PID 1840 wrote to memory of 1800	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	46
PID 1840 wrote to memory of 2544	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	47
PID 1840 wrote to memory of 2544	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	47
PID 1840 wrote to memory of 2544	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	47
PID 1840 wrote to memory of 2604	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	48
PID 1840 wrote to memory of 2604	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	48
PID 1840 wrote to memory of 2604	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	48
PID 1840 wrote to memory of 3024	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	49
PID 1840 wrote to memory of 3024	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	49
PID 1840 wrote to memory of 3024	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	49
PID 1840 wrote to memory of 2184	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	50
PID 1840 wrote to memory of 2184	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	50
PID 1840 wrote to memory of 2184	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	50
PID 1840 wrote to memory of 1504	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	51
PID 1840 wrote to memory of 1504	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	51
PID 1840 wrote to memory of 1504	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	51
PID 1840 wrote to memory of 1808	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	52
PID 1840 wrote to memory of 1808	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	52
PID 1840 wrote to memory of 1808	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	52
PID 1840 wrote to memory of 2008	1840	f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe	53

C:\Users\Admin\AppData\Local\Temp\f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe
"C:\Users\Admin\AppData\Local\Temp\f8148fd006d7d67b390e925da141b924a3be3e2af4d48ac6adf57e9bbbe71f5c.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2440
- C:\Windows\System\AVPCsAE.exe
  C:\Windows\System\AVPCsAE.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\dYvbjES.exe
  C:\Windows\System\dYvbjES.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\mJVVAcx.exe
  C:\Windows\System\mJVVAcx.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\BFONeej.exe
  C:\Windows\System\BFONeej.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\RzRkAlX.exe
  C:\Windows\System\RzRkAlX.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\ynKQaLh.exe
  C:\Windows\System\ynKQaLh.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\JKoNyAE.exe
  C:\Windows\System\JKoNyAE.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\JMzuXrx.exe
  C:\Windows\System\JMzuXrx.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\rsFQLJa.exe
  C:\Windows\System\rsFQLJa.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\QIBYRkz.exe
  C:\Windows\System\QIBYRkz.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\RHpyGwn.exe
  C:\Windows\System\RHpyGwn.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\xBtgInv.exe
  C:\Windows\System\xBtgInv.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\AAxXmVa.exe
  C:\Windows\System\AAxXmVa.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\HKVrOZJ.exe
  C:\Windows\System\HKVrOZJ.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\CRHhDTa.exe
  C:\Windows\System\CRHhDTa.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\eZqLTDY.exe
  C:\Windows\System\eZqLTDY.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\zbdMWwu.exe
  C:\Windows\System\zbdMWwu.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\OyuxbtB.exe
  C:\Windows\System\OyuxbtB.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\twqyEVJ.exe
  C:\Windows\System\twqyEVJ.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\jYRlRfE.exe
  C:\Windows\System\jYRlRfE.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\lFwITIR.exe
  C:\Windows\System\lFwITIR.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\XLoQoaU.exe
  C:\Windows\System\XLoQoaU.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\LePsolB.exe
  C:\Windows\System\LePsolB.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\XolcIfB.exe
  C:\Windows\System\XolcIfB.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\HnWrAaq.exe
  C:\Windows\System\HnWrAaq.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\GCugdRY.exe
  C:\Windows\System\GCugdRY.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\HhUIGqI.exe
  C:\Windows\System\HhUIGqI.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\IThBymD.exe
  C:\Windows\System\IThBymD.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\CqdVBaP.exe
  C:\Windows\System\CqdVBaP.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\MNaZaeG.exe
  C:\Windows\System\MNaZaeG.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\EnbLkmv.exe
  C:\Windows\System\EnbLkmv.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\rFjBxoF.exe
  C:\Windows\System\rFjBxoF.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\KjEfznI.exe
  C:\Windows\System\KjEfznI.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\PuqYIWz.exe
  C:\Windows\System\PuqYIWz.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\Loabnlw.exe
  C:\Windows\System\Loabnlw.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\TlEJLAF.exe
  C:\Windows\System\TlEJLAF.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\QubzLYx.exe
  C:\Windows\System\QubzLYx.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\jYsSdju.exe
  C:\Windows\System\jYsSdju.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\FBvurpH.exe
  C:\Windows\System\FBvurpH.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\QoEIGJN.exe
  C:\Windows\System\QoEIGJN.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\aJVqiUR.exe
  C:\Windows\System\aJVqiUR.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\fyyOCCL.exe
  C:\Windows\System\fyyOCCL.exe
  2⤵
  - Executes dropped EXE
  PID:588
- C:\Windows\System\eXmKwiP.exe
  C:\Windows\System\eXmKwiP.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\wokTgez.exe
  C:\Windows\System\wokTgez.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\ATgwaAF.exe
  C:\Windows\System\ATgwaAF.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\wywJfMq.exe
  C:\Windows\System\wywJfMq.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\SYHFWCa.exe
  C:\Windows\System\SYHFWCa.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\ZjlwjSb.exe
  C:\Windows\System\ZjlwjSb.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\CvwOecX.exe
  C:\Windows\System\CvwOecX.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\iNpgtnI.exe
  C:\Windows\System\iNpgtnI.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\QZwrxLA.exe
  C:\Windows\System\QZwrxLA.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\qHrLUTY.exe
  C:\Windows\System\qHrLUTY.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\OINhIzD.exe
  C:\Windows\System\OINhIzD.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\WmACtTN.exe
  C:\Windows\System\WmACtTN.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\qjHPAQr.exe
  C:\Windows\System\qjHPAQr.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\LlrHpZs.exe
  C:\Windows\System\LlrHpZs.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\wdxAJoa.exe
  C:\Windows\System\wdxAJoa.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\GkAewaQ.exe
  C:\Windows\System\GkAewaQ.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\ydeRLTv.exe
  C:\Windows\System\ydeRLTv.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\kqTkcRr.exe
  C:\Windows\System\kqTkcRr.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\uNlQddR.exe
  C:\Windows\System\uNlQddR.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\XwhNTfa.exe
  C:\Windows\System\XwhNTfa.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\YMpEHaL.exe
  C:\Windows\System\YMpEHaL.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\IPYMcPg.exe
  C:\Windows\System\IPYMcPg.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\qSSqqAb.exe
  C:\Windows\System\qSSqqAb.exe
  2⤵
  PID:2764
- C:\Windows\System\VzOXJuW.exe
  C:\Windows\System\VzOXJuW.exe
  2⤵
  PID:2148
- C:\Windows\System\PCtJaYC.exe
  C:\Windows\System\PCtJaYC.exe
  2⤵
  PID:2776
- C:\Windows\System\aZUDiOK.exe
  C:\Windows\System\aZUDiOK.exe
  2⤵
  PID:1820
- C:\Windows\System\VHGLUMY.exe
  C:\Windows\System\VHGLUMY.exe
  2⤵
  PID:2868
- C:\Windows\System\nPQHjRJ.exe
  C:\Windows\System\nPQHjRJ.exe
  2⤵
  PID:2116
- C:\Windows\System\nXSRhQU.exe
  C:\Windows\System\nXSRhQU.exe
  2⤵
  PID:2508
- C:\Windows\System\vheADud.exe
  C:\Windows\System\vheADud.exe
  2⤵
  PID:636
- C:\Windows\System\NcAQRzX.exe
  C:\Windows\System\NcAQRzX.exe
  2⤵
  PID:112
- C:\Windows\System\NUuBcGQ.exe
  C:\Windows\System\NUuBcGQ.exe
  2⤵
  PID:324
- C:\Windows\System\kxlzKYZ.exe
  C:\Windows\System\kxlzKYZ.exe
  2⤵
  PID:2784
- C:\Windows\System\gLUFSzL.exe
  C:\Windows\System\gLUFSzL.exe
  2⤵
  PID:2628
- C:\Windows\System\WcNqgYg.exe
  C:\Windows\System\WcNqgYg.exe
  2⤵
  PID:2528
- C:\Windows\System\gsqwnQy.exe
  C:\Windows\System\gsqwnQy.exe
  2⤵
  PID:2720
- C:\Windows\System\SaXfNja.exe
  C:\Windows\System\SaXfNja.exe
  2⤵
  PID:1824
- C:\Windows\System\YSozPhp.exe
  C:\Windows\System\YSozPhp.exe
  2⤵
  PID:848
- C:\Windows\System\libpkUQ.exe
  C:\Windows\System\libpkUQ.exe
  2⤵
  PID:1988
- C:\Windows\System\nxAflRI.exe
  C:\Windows\System\nxAflRI.exe
  2⤵
  PID:1948
- C:\Windows\System\UHjjYBv.exe
  C:\Windows\System\UHjjYBv.exe
  2⤵
  PID:2832
- C:\Windows\System\VEUlrAM.exe
  C:\Windows\System\VEUlrAM.exe
  2⤵
  PID:1816
- C:\Windows\System\goAQGZI.exe
  C:\Windows\System\goAQGZI.exe
  2⤵
  PID:1308
- C:\Windows\System\cZkqSVa.exe
  C:\Windows\System\cZkqSVa.exe
  2⤵
  PID:2888
- C:\Windows\System\gRQVUyx.exe
  C:\Windows\System\gRQVUyx.exe
  2⤵
  PID:1960
- C:\Windows\System\xlQkdBx.exe
  C:\Windows\System\xlQkdBx.exe
  2⤵
  PID:1320
- C:\Windows\System\qqMEgBX.exe
  C:\Windows\System\qqMEgBX.exe
  2⤵
  PID:2332
- C:\Windows\System\QIPIxwJ.exe
  C:\Windows\System\QIPIxwJ.exe
  2⤵
  PID:2032
- C:\Windows\System\QgYooqX.exe
  C:\Windows\System\QgYooqX.exe
  2⤵
  PID:1588
- C:\Windows\System\oncQRsO.exe
  C:\Windows\System\oncQRsO.exe
  2⤵
  PID:2656
- C:\Windows\System\fCRGjUE.exe
  C:\Windows\System\fCRGjUE.exe
  2⤵
  PID:888
- C:\Windows\System\xmWgtWL.exe
  C:\Windows\System\xmWgtWL.exe
  2⤵
  PID:2740
- C:\Windows\System\ruBFKKm.exe
  C:\Windows\System\ruBFKKm.exe
  2⤵
  PID:2824
- C:\Windows\System\AwPztHl.exe
  C:\Windows\System\AwPztHl.exe
  2⤵
  PID:2356
- C:\Windows\System\ZCetLtw.exe
  C:\Windows\System\ZCetLtw.exe
  2⤵
  PID:1516
- C:\Windows\System\uzYjNDt.exe
  C:\Windows\System\uzYjNDt.exe
  2⤵
  PID:2412
- C:\Windows\System\GnfaoEK.exe
  C:\Windows\System\GnfaoEK.exe
  2⤵
  PID:3016
- C:\Windows\System\xqNtNOF.exe
  C:\Windows\System\xqNtNOF.exe
  2⤵
  PID:924
- C:\Windows\System\Eangkps.exe
  C:\Windows\System\Eangkps.exe
  2⤵
  PID:2120
- C:\Windows\System\FeVHNza.exe
  C:\Windows\System\FeVHNza.exe
  2⤵
  PID:1796
- C:\Windows\System\CgOKSJO.exe
  C:\Windows\System\CgOKSJO.exe
  2⤵
  PID:1148
- C:\Windows\System\YXgwmLX.exe
  C:\Windows\System\YXgwmLX.exe
  2⤵
  PID:2744
- C:\Windows\System\QYtqACp.exe
  C:\Windows\System\QYtqACp.exe
  2⤵
  PID:1892
- C:\Windows\System\UjhbiOn.exe
  C:\Windows\System\UjhbiOn.exe
  2⤵
  PID:1936
- C:\Windows\System\NKtQBst.exe
  C:\Windows\System\NKtQBst.exe
  2⤵
  PID:1632
- C:\Windows\System\WmFwCzw.exe
  C:\Windows\System\WmFwCzw.exe
  2⤵
  PID:2920
- C:\Windows\System\jCRSuiM.exe
  C:\Windows\System\jCRSuiM.exe
  2⤵
  PID:2432
- C:\Windows\System\bwqzIsR.exe
  C:\Windows\System\bwqzIsR.exe
  2⤵
  PID:1772
- C:\Windows\System\vWSNpwX.exe
  C:\Windows\System\vWSNpwX.exe
  2⤵
  PID:2164
- C:\Windows\System\DEdBYZH.exe
  C:\Windows\System\DEdBYZH.exe
  2⤵
  PID:2220
- C:\Windows\System\NfJIiSV.exe
  C:\Windows\System\NfJIiSV.exe
  2⤵
  PID:2200
- C:\Windows\System\ISrKOfF.exe
  C:\Windows\System\ISrKOfF.exe
  2⤵
  PID:476
- C:\Windows\System\dGCCsfj.exe
  C:\Windows\System\dGCCsfj.exe
  2⤵
  PID:2848
- C:\Windows\System\psBRcXJ.exe
  C:\Windows\System\psBRcXJ.exe
  2⤵
  PID:768
- C:\Windows\System\dALfxOR.exe
  C:\Windows\System\dALfxOR.exe
  2⤵
  PID:1528
- C:\Windows\System\juQTEgA.exe
  C:\Windows\System\juQTEgA.exe
  2⤵
  PID:1984
- C:\Windows\System\yBdEbpq.exe
  C:\Windows\System\yBdEbpq.exe
  2⤵
  PID:1624
- C:\Windows\System\roGPEaq.exe
  C:\Windows\System\roGPEaq.exe
  2⤵
  PID:2084
- C:\Windows\System\KvsZsUe.exe
  C:\Windows\System\KvsZsUe.exe
  2⤵
  PID:1532
- C:\Windows\System\UOjzVSB.exe
  C:\Windows\System\UOjzVSB.exe
  2⤵
  PID:1092
- C:\Windows\System\OdJehAW.exe
  C:\Windows\System\OdJehAW.exe
  2⤵
  PID:2664
- C:\Windows\System\XTEDrAZ.exe
  C:\Windows\System\XTEDrAZ.exe
  2⤵
  PID:2532
- C:\Windows\System\xxFgmyU.exe
  C:\Windows\System\xxFgmyU.exe
  2⤵
  PID:2612
- C:\Windows\System\HgTYhwV.exe
  C:\Windows\System\HgTYhwV.exe
  2⤵
  PID:2768
- C:\Windows\System\kcnEroH.exe
  C:\Windows\System\kcnEroH.exe
  2⤵
  PID:2548
- C:\Windows\System\KHWzpMP.exe
  C:\Windows\System\KHWzpMP.exe
  2⤵
  PID:2988
- C:\Windows\System\SaDjnFH.exe
  C:\Windows\System\SaDjnFH.exe
  2⤵
  PID:1088
- C:\Windows\System\BWRlcqN.exe
  C:\Windows\System\BWRlcqN.exe
  2⤵
  PID:3076
- C:\Windows\System\UsKQVCx.exe
  C:\Windows\System\UsKQVCx.exe
  2⤵
  PID:3092
- C:\Windows\System\hEgdSSi.exe
  C:\Windows\System\hEgdSSi.exe
  2⤵
  PID:3112
- C:\Windows\System\NsVxyCn.exe
  C:\Windows\System\NsVxyCn.exe
  2⤵
  PID:3132
- C:\Windows\System\yKcOtop.exe
  C:\Windows\System\yKcOtop.exe
  2⤵
  PID:3148
- C:\Windows\System\GaCBQoh.exe
  C:\Windows\System\GaCBQoh.exe
  2⤵
  PID:3164
- C:\Windows\System\NPGMZsh.exe
  C:\Windows\System\NPGMZsh.exe
  2⤵
  PID:3180
- C:\Windows\System\uzZpbyl.exe
  C:\Windows\System\uzZpbyl.exe
  2⤵
  PID:3200
- C:\Windows\System\yCjooAX.exe
  C:\Windows\System\yCjooAX.exe
  2⤵
  PID:3216
- C:\Windows\System\rMyqbUe.exe
  C:\Windows\System\rMyqbUe.exe
  2⤵
  PID:3372
- C:\Windows\System\ZoeWsxb.exe
  C:\Windows\System\ZoeWsxb.exe
  2⤵
  PID:3388
- C:\Windows\System\PSDTgKw.exe
  C:\Windows\System\PSDTgKw.exe
  2⤵
  PID:3404
- C:\Windows\System\adpNMAz.exe
  C:\Windows\System\adpNMAz.exe
  2⤵
  PID:3420
- C:\Windows\System\kWxUazf.exe
  C:\Windows\System\kWxUazf.exe
  2⤵
  PID:3436
- C:\Windows\System\WbFqGRR.exe
  C:\Windows\System\WbFqGRR.exe
  2⤵
  PID:3452
- C:\Windows\System\lMfNhOj.exe
  C:\Windows\System\lMfNhOj.exe
  2⤵
  PID:3468
- C:\Windows\System\bUasdVD.exe
  C:\Windows\System\bUasdVD.exe
  2⤵
  PID:3484
- C:\Windows\System\zzxeRxc.exe
  C:\Windows\System\zzxeRxc.exe
  2⤵
  PID:3500
- C:\Windows\System\WTJVNbe.exe
  C:\Windows\System\WTJVNbe.exe
  2⤵
  PID:3516
- C:\Windows\System\yppbwpm.exe
  C:\Windows\System\yppbwpm.exe
  2⤵
  PID:3532
- C:\Windows\System\SBrhHoZ.exe
  C:\Windows\System\SBrhHoZ.exe
  2⤵
  PID:3548
- C:\Windows\System\YjQqLAq.exe
  C:\Windows\System\YjQqLAq.exe
  2⤵
  PID:3564
- C:\Windows\System\LfTKvul.exe
  C:\Windows\System\LfTKvul.exe
  2⤵
  PID:3580
- C:\Windows\System\HwFxOZq.exe
  C:\Windows\System\HwFxOZq.exe
  2⤵
  PID:3596
- C:\Windows\System\BmIDTBd.exe
  C:\Windows\System\BmIDTBd.exe
  2⤵
  PID:3616
- C:\Windows\System\QlZSTdc.exe
  C:\Windows\System\QlZSTdc.exe
  2⤵
  PID:3632
- C:\Windows\System\ZjiWITv.exe
  C:\Windows\System\ZjiWITv.exe
  2⤵
  PID:3648
- C:\Windows\System\klNiPhA.exe
  C:\Windows\System\klNiPhA.exe
  2⤵
  PID:3664
- C:\Windows\System\TBFmfHM.exe
  C:\Windows\System\TBFmfHM.exe
  2⤵
  PID:3680
- C:\Windows\System\scWTfiC.exe
  C:\Windows\System\scWTfiC.exe
  2⤵
  PID:3696
- C:\Windows\System\RJiHDaf.exe
  C:\Windows\System\RJiHDaf.exe
  2⤵
  PID:3712
- C:\Windows\System\WUCwedM.exe
  C:\Windows\System\WUCwedM.exe
  2⤵
  PID:3728
- C:\Windows\System\PBkArox.exe
  C:\Windows\System\PBkArox.exe
  2⤵
  PID:3744
- C:\Windows\System\ZsEXGeO.exe
  C:\Windows\System\ZsEXGeO.exe
  2⤵
  PID:3764
- C:\Windows\System\cXFlWFJ.exe
  C:\Windows\System\cXFlWFJ.exe
  2⤵
  PID:3780
- C:\Windows\System\zoIOLpO.exe
  C:\Windows\System\zoIOLpO.exe
  2⤵
  PID:3796
- C:\Windows\System\tjhjgtW.exe
  C:\Windows\System\tjhjgtW.exe
  2⤵
  PID:3812
- C:\Windows\System\YfLOgGV.exe
  C:\Windows\System\YfLOgGV.exe
  2⤵
  PID:3828
- C:\Windows\System\PPUbKlU.exe
  C:\Windows\System\PPUbKlU.exe
  2⤵
  PID:3848
- C:\Windows\System\fTQjWBR.exe
  C:\Windows\System\fTQjWBR.exe
  2⤵
  PID:3868
- C:\Windows\System\sFdIPCi.exe
  C:\Windows\System\sFdIPCi.exe
  2⤵
  PID:3896
- C:\Windows\System\EaAMkwN.exe
  C:\Windows\System\EaAMkwN.exe
  2⤵
  PID:3912
- C:\Windows\System\xfIWYqe.exe
  C:\Windows\System\xfIWYqe.exe
  2⤵
  PID:3928
- C:\Windows\System\pqCWNMS.exe
  C:\Windows\System\pqCWNMS.exe
  2⤵
  PID:3944
- C:\Windows\System\MgHEFkZ.exe
  C:\Windows\System\MgHEFkZ.exe
  2⤵
  PID:3964
- C:\Windows\System\ZwYpQTg.exe
  C:\Windows\System\ZwYpQTg.exe
  2⤵
  PID:3980
- C:\Windows\System\pClRrIu.exe
  C:\Windows\System\pClRrIu.exe
  2⤵
  PID:3996
- C:\Windows\System\dHgHhGJ.exe
  C:\Windows\System\dHgHhGJ.exe
  2⤵
  PID:4012
- C:\Windows\System\aIRCpDl.exe
  C:\Windows\System\aIRCpDl.exe
  2⤵
  PID:4028
- C:\Windows\System\CVUYQOR.exe
  C:\Windows\System\CVUYQOR.exe
  2⤵
  PID:4044
- C:\Windows\System\SchXXsK.exe
  C:\Windows\System\SchXXsK.exe
  2⤵
  PID:4060
- C:\Windows\System\kGuDXUm.exe
  C:\Windows\System\kGuDXUm.exe
  2⤵
  PID:4076
- C:\Windows\System\akOADSj.exe
  C:\Windows\System\akOADSj.exe
  2⤵
  PID:2396
- C:\Windows\System\RzSJvgp.exe
  C:\Windows\System\RzSJvgp.exe
  2⤵
  PID:1052
- C:\Windows\System\WJiQxDW.exe
  C:\Windows\System\WJiQxDW.exe
  2⤵
  PID:1964
- C:\Windows\System\icbvfEW.exe
  C:\Windows\System\icbvfEW.exe
  2⤵
  PID:1672
- C:\Windows\System\RVHLnWc.exe
  C:\Windows\System\RVHLnWc.exe
  2⤵
  PID:1596
- C:\Windows\System\tKUpRVz.exe
  C:\Windows\System\tKUpRVz.exe
  2⤵
  PID:3084
- C:\Windows\System\naHVBDL.exe
  C:\Windows\System\naHVBDL.exe
  2⤵
  PID:3188
- C:\Windows\System\sZKXFTR.exe
  C:\Windows\System\sZKXFTR.exe
  2⤵
  PID:2216
- C:\Windows\System\hPDSTJR.exe
  C:\Windows\System\hPDSTJR.exe
  2⤵
  PID:2020
- C:\Windows\System\GULESkT.exe
  C:\Windows\System\GULESkT.exe
  2⤵
  PID:3272
- C:\Windows\System\egUArIt.exe
  C:\Windows\System\egUArIt.exe
  2⤵
  PID:3228
- C:\Windows\System\IKjHUTT.exe
  C:\Windows\System\IKjHUTT.exe
  2⤵
  PID:3524
- C:\Windows\System\dLRluSz.exe
  C:\Windows\System\dLRluSz.exe
  2⤵
  PID:3660
- C:\Windows\System\ArPQGAu.exe
  C:\Windows\System\ArPQGAu.exe
  2⤵
  PID:3172
- C:\Windows\System\SGTrFQr.exe
  C:\Windows\System\SGTrFQr.exe
  2⤵
  PID:1256
- C:\Windows\System\YrsIacY.exe
  C:\Windows\System\YrsIacY.exe
  2⤵
  PID:616
- C:\Windows\System\uIXcuJG.exe
  C:\Windows\System\uIXcuJG.exe
  2⤵
  PID:3432
- C:\Windows\System\jZRVuma.exe
  C:\Windows\System\jZRVuma.exe
  2⤵
  PID:3856
- C:\Windows\System\rmGqdlD.exe
  C:\Windows\System\rmGqdlD.exe
  2⤵
  PID:3556
- C:\Windows\System\sBRBMhc.exe
  C:\Windows\System\sBRBMhc.exe
  2⤵
  PID:3904
- C:\Windows\System\CUZxKuh.exe
  C:\Windows\System\CUZxKuh.exe
  2⤵
  PID:4068
- C:\Windows\System\uxHrHuu.exe
  C:\Windows\System\uxHrHuu.exe
  2⤵
  PID:2648
- C:\Windows\System\bBjbmor.exe
  C:\Windows\System\bBjbmor.exe
  2⤵
  PID:3760
- C:\Windows\System\HtwLBci.exe
  C:\Windows\System\HtwLBci.exe
  2⤵
  PID:3860
- C:\Windows\System\ehrzhpR.exe
  C:\Windows\System\ehrzhpR.exe
  2⤵
  PID:3940
- C:\Windows\System\PZWOnZd.exe
  C:\Windows\System\PZWOnZd.exe
  2⤵
  PID:4072
- C:\Windows\System\MpoyapL.exe
  C:\Windows\System\MpoyapL.exe
  2⤵
  PID:2940
- C:\Windows\System\uFJKBse.exe
  C:\Windows\System\uFJKBse.exe
  2⤵
  PID:3960
- C:\Windows\System\KNZHnwI.exe
  C:\Windows\System\KNZHnwI.exe
  2⤵
  PID:2252
- C:\Windows\System\ZgDfhzb.exe
  C:\Windows\System\ZgDfhzb.exe
  2⤵
  PID:2196
- C:\Windows\System\woppuLP.exe
  C:\Windows\System\woppuLP.exe
  2⤵
  PID:1352
- C:\Windows\System\JXqlXpe.exe
  C:\Windows\System\JXqlXpe.exe
  2⤵
  PID:1972
- C:\Windows\System\yZZoIBV.exe
  C:\Windows\System\yZZoIBV.exe
  2⤵
  PID:3100
- C:\Windows\System\hlrPGTv.exe
  C:\Windows\System\hlrPGTv.exe
  2⤵
  PID:3212
- C:\Windows\System\oGyfTSa.exe
  C:\Windows\System\oGyfTSa.exe
  2⤵
  PID:3480
- C:\Windows\System\KZZiJSR.exe
  C:\Windows\System\KZZiJSR.exe
  2⤵
  PID:2572
- C:\Windows\System\HujvmKI.exe
  C:\Windows\System\HujvmKI.exe
  2⤵
  PID:3512
- C:\Windows\System\zHOjkPp.exe
  C:\Windows\System\zHOjkPp.exe
  2⤵
  PID:3576
- C:\Windows\System\oOekGcr.exe
  C:\Windows\System\oOekGcr.exe
  2⤵
  PID:3644
- C:\Windows\System\gMaEQdu.exe
  C:\Windows\System\gMaEQdu.exe
  2⤵
  PID:3708
- C:\Windows\System\cQLRVmu.exe
  C:\Windows\System\cQLRVmu.exe
  2⤵
  PID:3776
- C:\Windows\System\OZNwoUL.exe
  C:\Windows\System\OZNwoUL.exe
  2⤵
  PID:3844
- C:\Windows\System\yKndyvA.exe
  C:\Windows\System\yKndyvA.exe
  2⤵
  PID:3888
- C:\Windows\System\oFOmctl.exe
  C:\Windows\System\oFOmctl.exe
  2⤵
  PID:4024
- C:\Windows\System\JswzjbQ.exe
  C:\Windows\System\JswzjbQ.exe
  2⤵
  PID:4088
- C:\Windows\System\vllTWXR.exe
  C:\Windows\System\vllTWXR.exe
  2⤵
  PID:1716
- C:\Windows\System\xCMNHFG.exe
  C:\Windows\System\xCMNHFG.exe
  2⤵
  PID:1692
- C:\Windows\System\ebRzzEL.exe
  C:\Windows\System\ebRzzEL.exe
  2⤵
  PID:3300
- C:\Windows\System\KKTYrEP.exe
  C:\Windows\System\KKTYrEP.exe
  2⤵
  PID:3308
- C:\Windows\System\vSPmKks.exe
  C:\Windows\System\vSPmKks.exe
  2⤵
  PID:3088
- C:\Windows\System\LFhkgNX.exe
  C:\Windows\System\LFhkgNX.exe
  2⤵
  PID:3328
- C:\Windows\System\YlZffiu.exe
  C:\Windows\System\YlZffiu.exe
  2⤵
  PID:3340
- C:\Windows\System\IEdmWYQ.exe
  C:\Windows\System\IEdmWYQ.exe
  2⤵
  PID:3224
- C:\Windows\System\WHjukEQ.exe
  C:\Windows\System\WHjukEQ.exe
  2⤵
  PID:3240
- C:\Windows\System\GrOPxVl.exe
  C:\Windows\System\GrOPxVl.exe
  2⤵
  PID:3252
- C:\Windows\System\scMIwVd.exe
  C:\Windows\System\scMIwVd.exe
  2⤵
  PID:3416
- C:\Windows\System\rbuaGyZ.exe
  C:\Windows\System\rbuaGyZ.exe
  2⤵
  PID:3360
- C:\Windows\System\NtINDAS.exe
  C:\Windows\System\NtINDAS.exe
  2⤵
  PID:3368
- C:\Windows\System\rxtWohI.exe
  C:\Windows\System\rxtWohI.exe
  2⤵
  PID:3460
- C:\Windows\System\fGulfXJ.exe
  C:\Windows\System\fGulfXJ.exe
  2⤵
  PID:4100
- C:\Windows\System\TUdfSpc.exe
  C:\Windows\System\TUdfSpc.exe
  2⤵
  PID:4116
- C:\Windows\System\apHQboC.exe
  C:\Windows\System\apHQboC.exe
  2⤵
  PID:4132
- C:\Windows\System\FwctSTp.exe
  C:\Windows\System\FwctSTp.exe
  2⤵
  PID:4152
- C:\Windows\System\GMthbNp.exe
  C:\Windows\System\GMthbNp.exe
  2⤵
  PID:4168
- C:\Windows\System\vKTNyxw.exe
  C:\Windows\System\vKTNyxw.exe
  2⤵
  PID:4188
- C:\Windows\System\MgWymLl.exe
  C:\Windows\System\MgWymLl.exe
  2⤵
  PID:4204
- C:\Windows\System\dHmkoeJ.exe
  C:\Windows\System\dHmkoeJ.exe
  2⤵
  PID:4412
- C:\Windows\System\bdUktyo.exe
  C:\Windows\System\bdUktyo.exe
  2⤵
  PID:4428
- C:\Windows\System\CdQFUku.exe
  C:\Windows\System\CdQFUku.exe
  2⤵
  PID:4444
- C:\Windows\System\tsrPjMu.exe
  C:\Windows\System\tsrPjMu.exe
  2⤵
  PID:4460
- C:\Windows\System\QxYXTUu.exe
  C:\Windows\System\QxYXTUu.exe
  2⤵
  PID:4476
- C:\Windows\System\ufHohjw.exe
  C:\Windows\System\ufHohjw.exe
  2⤵
  PID:4492
- C:\Windows\System\gNiVYEd.exe
  C:\Windows\System\gNiVYEd.exe
  2⤵
  PID:4508
- C:\Windows\System\xuSwNQs.exe
  C:\Windows\System\xuSwNQs.exe
  2⤵
  PID:4524
- C:\Windows\System\fnvTXjd.exe
  C:\Windows\System\fnvTXjd.exe
  2⤵
  PID:4540
- C:\Windows\System\jVSkomg.exe
  C:\Windows\System\jVSkomg.exe
  2⤵
  PID:4556
- C:\Windows\System\UYtXIiD.exe
  C:\Windows\System\UYtXIiD.exe
  2⤵
  PID:4572
- C:\Windows\System\cXpLpUG.exe
  C:\Windows\System\cXpLpUG.exe
  2⤵
  PID:4588
- C:\Windows\System\YHxBweQ.exe
  C:\Windows\System\YHxBweQ.exe
  2⤵
  PID:4604
- C:\Windows\System\LCzKblg.exe
  C:\Windows\System\LCzKblg.exe
  2⤵
  PID:4620
- C:\Windows\System\UtBbPyr.exe
  C:\Windows\System\UtBbPyr.exe
  2⤵
  PID:4640
- C:\Windows\System\NSGxcRY.exe
  C:\Windows\System\NSGxcRY.exe
  2⤵
  PID:4656
- C:\Windows\System\AOcGeBk.exe
  C:\Windows\System\AOcGeBk.exe
  2⤵
  PID:4672
- C:\Windows\System\kaYhtfL.exe
  C:\Windows\System\kaYhtfL.exe
  2⤵
  PID:4688
- C:\Windows\System\CIoxeiG.exe
  C:\Windows\System\CIoxeiG.exe
  2⤵
  PID:4704
- C:\Windows\System\EjsiMDE.exe
  C:\Windows\System\EjsiMDE.exe
  2⤵
  PID:4720
- C:\Windows\System\zwuFvYA.exe
  C:\Windows\System\zwuFvYA.exe
  2⤵
  PID:4740
- C:\Windows\System\fRbcXIH.exe
  C:\Windows\System\fRbcXIH.exe
  2⤵
  PID:4756
- C:\Windows\System\zsQpCvU.exe
  C:\Windows\System\zsQpCvU.exe
  2⤵
  PID:4772
- C:\Windows\System\bzCUUwb.exe
  C:\Windows\System\bzCUUwb.exe
  2⤵
  PID:4788
- C:\Windows\System\VJSdXkI.exe
  C:\Windows\System\VJSdXkI.exe
  2⤵
  PID:4804
- C:\Windows\System\oNfWenT.exe
  C:\Windows\System\oNfWenT.exe
  2⤵
  PID:4820
- C:\Windows\System\xrRvOOg.exe
  C:\Windows\System\xrRvOOg.exe
  2⤵
  PID:4836
- C:\Windows\System\rHDWuUt.exe
  C:\Windows\System\rHDWuUt.exe
  2⤵
  PID:4852
- C:\Windows\System\LhraPsy.exe
  C:\Windows\System\LhraPsy.exe
  2⤵
  PID:4872
- C:\Windows\System\uiYQTXF.exe
  C:\Windows\System\uiYQTXF.exe
  2⤵
  PID:4888
- C:\Windows\System\YgNPlCG.exe
  C:\Windows\System\YgNPlCG.exe
  2⤵
  PID:4908
- C:\Windows\System\EZIpRnh.exe
  C:\Windows\System\EZIpRnh.exe
  2⤵
  PID:4924
- C:\Windows\System\JnPGFZn.exe
  C:\Windows\System\JnPGFZn.exe
  2⤵
  PID:4940
- C:\Windows\System\ydrMPwM.exe
  C:\Windows\System\ydrMPwM.exe
  2⤵
  PID:4956
- C:\Windows\System\TPaanSi.exe
  C:\Windows\System\TPaanSi.exe
  2⤵
  PID:4972
- C:\Windows\System\aqMGeYY.exe
  C:\Windows\System\aqMGeYY.exe
  2⤵
  PID:4988
- C:\Windows\System\wpVvQNQ.exe
  C:\Windows\System\wpVvQNQ.exe
  2⤵
  PID:5004
- C:\Windows\System\YsgPcAX.exe
  C:\Windows\System\YsgPcAX.exe
  2⤵
  PID:5020
- C:\Windows\System\GKbbGxZ.exe
  C:\Windows\System\GKbbGxZ.exe
  2⤵
  PID:5036
- C:\Windows\System\fxQyMfc.exe
  C:\Windows\System\fxQyMfc.exe
  2⤵
  PID:5052
- C:\Windows\System\CpsZLws.exe
  C:\Windows\System\CpsZLws.exe
  2⤵
  PID:5068
- C:\Windows\System\JxHxjve.exe
  C:\Windows\System\JxHxjve.exe
  2⤵
  PID:5084
- C:\Windows\System\KUxxBSR.exe
  C:\Windows\System\KUxxBSR.exe
  2⤵
  PID:5100
- C:\Windows\System\NQIFjXT.exe
  C:\Windows\System\NQIFjXT.exe
  2⤵
  PID:5116
- C:\Windows\System\kxtxcXI.exe
  C:\Windows\System\kxtxcXI.exe
  2⤵
  PID:2640
- C:\Windows\System\lkPCVKD.exe
  C:\Windows\System\lkPCVKD.exe
  2⤵
  PID:3108
- C:\Windows\System\ldUhNUt.exe
  C:\Windows\System\ldUhNUt.exe
  2⤵
  PID:3156
- C:\Windows\System\wrGCQwM.exe
  C:\Windows\System\wrGCQwM.exe
  2⤵
  PID:2668
- C:\Windows\System\OAqIcdV.exe
  C:\Windows\System\OAqIcdV.exe
  2⤵
  PID:3464
- C:\Windows\System\fJpEoLc.exe
  C:\Windows\System\fJpEoLc.exe
  2⤵
  PID:3592
- C:\Windows\System\EIKKfOg.exe
  C:\Windows\System\EIKKfOg.exe
  2⤵
  PID:3356
- C:\Windows\System\MFPyeTW.exe
  C:\Windows\System\MFPyeTW.exe
  2⤵
  PID:3824
- C:\Windows\System\xVrYiek.exe
  C:\Windows\System\xVrYiek.exe
  2⤵
  PID:4008
- C:\Windows\System\GyvlyJk.exe
  C:\Windows\System\GyvlyJk.exe
  2⤵
  PID:2928
- C:\Windows\System\fmAoKNS.exe
  C:\Windows\System\fmAoKNS.exe
  2⤵
  PID:3924
- C:\Windows\System\ahflxVA.exe
  C:\Windows\System\ahflxVA.exe
  2⤵
  PID:3316
- C:\Windows\System\oFHGnlY.exe
  C:\Windows\System\oFHGnlY.exe
  2⤵
  PID:3284
- C:\Windows\System\moLURht.exe
  C:\Windows\System\moLURht.exe
  2⤵
  PID:4244
- C:\Windows\System\wwVbYeZ.exe
  C:\Windows\System\wwVbYeZ.exe
  2⤵
  PID:4084
- C:\Windows\System\KOWPaBd.exe
  C:\Windows\System\KOWPaBd.exe
  2⤵
  PID:3196
- C:\Windows\System\RCCzdeX.exe
  C:\Windows\System\RCCzdeX.exe
  2⤵
  PID:3380
- C:\Windows\System\nntFQlA.exe
  C:\Windows\System\nntFQlA.exe
  2⤵
  PID:4180
- C:\Windows\System\tSGGxpw.exe
  C:\Windows\System\tSGGxpw.exe
  2⤵
  PID:4256
- C:\Windows\System\KIgvYUp.exe
  C:\Windows\System\KIgvYUp.exe
  2⤵
  PID:4272
- C:\Windows\System\MiSNwZn.exe
  C:\Windows\System\MiSNwZn.exe
  2⤵
  PID:4292
- C:\Windows\System\uJTevdm.exe
  C:\Windows\System\uJTevdm.exe
  2⤵
  PID:4324
- C:\Windows\System\rfpYWmH.exe
  C:\Windows\System\rfpYWmH.exe
  2⤵
  PID:4400
- C:\Windows\System\ErAbqDB.exe
  C:\Windows\System\ErAbqDB.exe
  2⤵
  PID:4452
- C:\Windows\System\oKJihyG.exe
  C:\Windows\System\oKJihyG.exe
  2⤵
  PID:4548
- C:\Windows\System\YKBvLBL.exe
  C:\Windows\System\YKBvLBL.exe
  2⤵
  PID:4612
- C:\Windows\System\FyIYdJe.exe
  C:\Windows\System\FyIYdJe.exe
  2⤵
  PID:4684
- C:\Windows\System\WMTMTCy.exe
  C:\Windows\System\WMTMTCy.exe
  2⤵
  PID:4780
- C:\Windows\System\vWKIdes.exe
  C:\Windows\System\vWKIdes.exe
  2⤵
  PID:4880
- C:\Windows\System\wyLNMPq.exe
  C:\Windows\System\wyLNMPq.exe
  2⤵
  PID:4948
- C:\Windows\System\bLObRoi.exe
  C:\Windows\System\bLObRoi.exe
  2⤵
  PID:5012
- C:\Windows\System\AcYIxMd.exe
  C:\Windows\System\AcYIxMd.exe
  2⤵
  PID:5044
- C:\Windows\System\zMSwvaS.exe
  C:\Windows\System\zMSwvaS.exe
  2⤵
  PID:5080
- C:\Windows\System\lnPCehH.exe
  C:\Windows\System\lnPCehH.exe
  2⤵
  PID:5108
- C:\Windows\System\YyRGDld.exe
  C:\Windows\System\YyRGDld.exe
  2⤵
  PID:5112
- C:\Windows\System\pjehmpe.exe
  C:\Windows\System\pjehmpe.exe
  2⤵
  PID:4828
- C:\Windows\System\QPREAxb.exe
  C:\Windows\System\QPREAxb.exe
  2⤵
  PID:3624
- C:\Windows\System\BjVaalw.exe
  C:\Windows\System\BjVaalw.exe
  2⤵
  PID:3544
- C:\Windows\System\GcYCLhp.exe
  C:\Windows\System\GcYCLhp.exe
  2⤵
  PID:5028
- C:\Windows\System\eNXDjot.exe
  C:\Windows\System\eNXDjot.exe
  2⤵
  PID:5092
- C:\Windows\System\hrEuTCa.exe
  C:\Windows\System\hrEuTCa.exe
  2⤵
  PID:4600
- C:\Windows\System\HmSXAAb.exe
  C:\Windows\System\HmSXAAb.exe
  2⤵
  PID:4736
- C:\Windows\System\KebCuTf.exe
  C:\Windows\System\KebCuTf.exe
  2⤵
  PID:4864
- C:\Windows\System\iFUWQUO.exe
  C:\Windows\System\iFUWQUO.exe
  2⤵
  PID:5032
- C:\Windows\System\aVmeeKn.exe
  C:\Windows\System\aVmeeKn.exe
  2⤵
  PID:3840
- C:\Windows\System\NtynaIM.exe
  C:\Windows\System\NtynaIM.exe
  2⤵
  PID:4456
- C:\Windows\System\cipGTvW.exe
  C:\Windows\System\cipGTvW.exe
  2⤵
  PID:692
- C:\Windows\System\BHSnUxV.exe
  C:\Windows\System\BHSnUxV.exe
  2⤵
  PID:4164
- C:\Windows\System\YGAKrKF.exe
  C:\Windows\System\YGAKrKF.exe
  2⤵
  PID:3676
- C:\Windows\System\IGuFKBW.exe
  C:\Windows\System\IGuFKBW.exe
  2⤵
  PID:376
- C:\Windows\System\fHIGxBT.exe
  C:\Windows\System\fHIGxBT.exe
  2⤵
  PID:3972
- C:\Windows\System\cdkeLlk.exe
  C:\Windows\System\cdkeLlk.exe
  2⤵
  PID:3756
- C:\Windows\System\uIAiAzm.exe
  C:\Windows\System\uIAiAzm.exe
  2⤵
  PID:2316
- C:\Windows\System\PMMdtcg.exe
  C:\Windows\System\PMMdtcg.exe
  2⤵
  PID:3280
- C:\Windows\System\AhBvKSV.exe
  C:\Windows\System\AhBvKSV.exe
  2⤵
  PID:3772
- C:\Windows\System\NuubyFV.exe
  C:\Windows\System\NuubyFV.exe
  2⤵
  PID:3884
- C:\Windows\System\SCTJCYe.exe
  C:\Windows\System\SCTJCYe.exe
  2⤵
  PID:4220
- C:\Windows\System\QRiVIOz.exe
  C:\Windows\System\QRiVIOz.exe
  2⤵
  PID:2960
- C:\Windows\System\FXWmfeN.exe
  C:\Windows\System\FXWmfeN.exe
  2⤵
  PID:3508
- C:\Windows\System\oIotUsq.exe
  C:\Windows\System\oIotUsq.exe
  2⤵
  PID:3324
- C:\Windows\System\qJikKIW.exe
  C:\Windows\System\qJikKIW.exe
  2⤵
  PID:4408
- C:\Windows\System\GAUMBOU.exe
  C:\Windows\System\GAUMBOU.exe
  2⤵
  PID:4308
- C:\Windows\System\zOCYQsx.exe
  C:\Windows\System\zOCYQsx.exe
  2⤵
  PID:4248
- C:\Windows\System\yMrESXL.exe
  C:\Windows\System\yMrESXL.exe
  2⤵
  PID:4300
- C:\Windows\System\RPcRwdi.exe
  C:\Windows\System\RPcRwdi.exe
  2⤵
  PID:4320
- C:\Windows\System\MhFXRgd.exe
  C:\Windows\System\MhFXRgd.exe
  2⤵
  PID:4344
- C:\Windows\System\ZHvmnJH.exe
  C:\Windows\System\ZHvmnJH.exe
  2⤵
  PID:4364
- C:\Windows\System\nDDfZoV.exe
  C:\Windows\System\nDDfZoV.exe
  2⤵
  PID:4380
- C:\Windows\System\YYERicu.exe
  C:\Windows\System\YYERicu.exe
  2⤵
  PID:4396
- C:\Windows\System\zJgIcCi.exe
  C:\Windows\System\zJgIcCi.exe
  2⤵
  PID:4520
- C:\Windows\System\YFIYxbi.exe
  C:\Windows\System\YFIYxbi.exe
  2⤵
  PID:4652
- C:\Windows\System\uMUBiBW.exe
  C:\Windows\System\uMUBiBW.exe
  2⤵
  PID:4748
- C:\Windows\System\aUyWXEF.exe
  C:\Windows\System\aUyWXEF.exe
  2⤵
  PID:4916
- C:\Windows\System\TSPnhoh.exe
  C:\Windows\System\TSPnhoh.exe
  2⤵
  PID:4848
- C:\Windows\System\dfthuZI.exe
  C:\Windows\System\dfthuZI.exe
  2⤵
  PID:4564
- C:\Windows\System\dgARLzv.exe
  C:\Windows\System\dgARLzv.exe
  2⤵
  PID:4768
- C:\Windows\System\duNcLNO.exe
  C:\Windows\System\duNcLNO.exe
  2⤵
  PID:4536
- C:\Windows\System\UBGjTIi.exe
  C:\Windows\System\UBGjTIi.exe
  2⤵
  PID:4900
- C:\Windows\System\dGxJvvh.exe
  C:\Windows\System\dGxJvvh.exe
  2⤵
  PID:4568
- C:\Windows\System\VMGTIhP.exe
  C:\Windows\System\VMGTIhP.exe
  2⤵
  PID:4696
- C:\Windows\System\nIfqnXb.exe
  C:\Windows\System\nIfqnXb.exe
  2⤵
  PID:4868
- C:\Windows\System\tsyEzUo.exe
  C:\Windows\System\tsyEzUo.exe
  2⤵
  PID:4596
- C:\Windows\System\FqcrHuC.exe
  C:\Windows\System\FqcrHuC.exe
  2⤵
  PID:3952
- C:\Windows\System\FXdBPKy.exe
  C:\Windows\System\FXdBPKy.exe
  2⤵
  PID:1392
- C:\Windows\System\viDRWCT.exe
  C:\Windows\System\viDRWCT.exe
  2⤵
  PID:1844
- C:\Windows\System\KPejExw.exe
  C:\Windows\System\KPejExw.exe
  2⤵
  PID:2372
- C:\Windows\System\PNLapWy.exe
  C:\Windows\System\PNLapWy.exe
  2⤵
  PID:3992
- C:\Windows\System\HQIdrRi.exe
  C:\Windows\System\HQIdrRi.exe
  2⤵
  PID:4108
- C:\Windows\System\MzEVzZS.exe
  C:\Windows\System\MzEVzZS.exe
  2⤵
  PID:3720
- C:\Windows\System\pOXUPLT.exe
  C:\Windows\System\pOXUPLT.exe
  2⤵
  PID:1676
- C:\Windows\System\fjoXeWM.exe
  C:\Windows\System\fjoXeWM.exe
  2⤵
  PID:4144
- C:\Windows\System\pJzQpBI.exe
  C:\Windows\System\pJzQpBI.exe
  2⤵
  PID:2672
- C:\Windows\System\iaWYNPl.exe
  C:\Windows\System\iaWYNPl.exe
  2⤵
  PID:4392
- C:\Windows\System\fnvGYgE.exe
  C:\Windows\System\fnvGYgE.exe
  2⤵
  PID:1584
- C:\Windows\System\tjIWLhX.exe
  C:\Windows\System\tjIWLhX.exe
  2⤵
  PID:4056
- C:\Windows\System\PDfnXbH.exe
  C:\Windows\System\PDfnXbH.exe
  2⤵
  PID:4484
- C:\Windows\System\lfhapvw.exe
  C:\Windows\System\lfhapvw.exe
  2⤵
  PID:4356
- C:\Windows\System\MpgkqAZ.exe
  C:\Windows\System\MpgkqAZ.exe
  2⤵
  PID:5000
- C:\Windows\System\xtTKPoc.exe
  C:\Windows\System\xtTKPoc.exe
  2⤵
  PID:4752
- C:\Windows\System\qLZevKJ.exe
  C:\Windows\System\qLZevKJ.exe
  2⤵
  PID:3236
- C:\Windows\System\hpcFFTJ.exe
  C:\Windows\System\hpcFFTJ.exe
  2⤵
  PID:4860
- C:\Windows\System\QuBvPUM.exe
  C:\Windows\System\QuBvPUM.exe
  2⤵
  PID:5076
- C:\Windows\System\hCslecf.exe
  C:\Windows\System\hCslecf.exe
  2⤵
  PID:4036
- C:\Windows\System\IparTjh.exe
  C:\Windows\System\IparTjh.exe
  2⤵
  PID:2884
- C:\Windows\System\IkVYcsE.exe
  C:\Windows\System\IkVYcsE.exe
  2⤵
  PID:2248
- C:\Windows\System\iJZVKem.exe
  C:\Windows\System\iJZVKem.exe
  2⤵
  PID:4304
- C:\Windows\System\TLdoFHb.exe
  C:\Windows\System\TLdoFHb.exe
  2⤵
  PID:4372
- C:\Windows\System\udJYINZ.exe
  C:\Windows\System\udJYINZ.exe
  2⤵
  PID:4420
- C:\Windows\System\znGpzjZ.exe
  C:\Windows\System\znGpzjZ.exe
  2⤵
  PID:4236
- C:\Windows\System\nYNQVaF.exe
  C:\Windows\System\nYNQVaF.exe
  2⤵
  PID:4932
- C:\Windows\System\byyHJzv.exe
  C:\Windows\System\byyHJzv.exe
  2⤵
  PID:4316
- C:\Windows\System\inTvdpB.exe
  C:\Windows\System\inTvdpB.exe
  2⤵
  PID:4352
- C:\Windows\System\DJIartR.exe
  C:\Windows\System\DJIartR.exe
  2⤵
  PID:5132
- C:\Windows\System\NnFVSqe.exe
  C:\Windows\System\NnFVSqe.exe
  2⤵
  PID:5148
- C:\Windows\System\Hspxtpd.exe
  C:\Windows\System\Hspxtpd.exe
  2⤵
  PID:5164
- C:\Windows\System\qwWDKzP.exe
  C:\Windows\System\qwWDKzP.exe
  2⤵
  PID:5180
- C:\Windows\System\aTBRsoP.exe
  C:\Windows\System\aTBRsoP.exe
  2⤵
  PID:5196
- C:\Windows\System\HOMbqIh.exe
  C:\Windows\System\HOMbqIh.exe
  2⤵
  PID:5212
- C:\Windows\System\gkFaPAs.exe
  C:\Windows\System\gkFaPAs.exe
  2⤵
  PID:5228
- C:\Windows\System\MDaJEkq.exe
  C:\Windows\System\MDaJEkq.exe
  2⤵
  PID:5244
- C:\Windows\System\GOPAzfp.exe
  C:\Windows\System\GOPAzfp.exe
  2⤵
  PID:5260
- C:\Windows\System\rYxBvgx.exe
  C:\Windows\System\rYxBvgx.exe
  2⤵
  PID:5276
- C:\Windows\System\mHbtTAR.exe
  C:\Windows\System\mHbtTAR.exe
  2⤵
  PID:5292
- C:\Windows\System\AOYjgFB.exe
  C:\Windows\System\AOYjgFB.exe
  2⤵
  PID:5308
- C:\Windows\System\JyEMyHG.exe
  C:\Windows\System\JyEMyHG.exe
  2⤵
  PID:5324
- C:\Windows\System\mfjLCuH.exe
  C:\Windows\System\mfjLCuH.exe
  2⤵
  PID:5340
- C:\Windows\System\fYsRhZU.exe
  C:\Windows\System\fYsRhZU.exe
  2⤵
  PID:5356
- C:\Windows\System\HZKGHxu.exe
  C:\Windows\System\HZKGHxu.exe
  2⤵
  PID:5372
- C:\Windows\System\XEPWcJR.exe
  C:\Windows\System\XEPWcJR.exe
  2⤵
  PID:5388
- C:\Windows\System\urkKCUu.exe
  C:\Windows\System\urkKCUu.exe
  2⤵
  PID:5404
- C:\Windows\System\QwVcdHK.exe
  C:\Windows\System\QwVcdHK.exe
  2⤵
  PID:5420
- C:\Windows\System\XjnXqWH.exe
  C:\Windows\System\XjnXqWH.exe
  2⤵
  PID:5436
- C:\Windows\System\qArwNON.exe
  C:\Windows\System\qArwNON.exe
  2⤵
  PID:5452
- C:\Windows\System\NxNlxGF.exe
  C:\Windows\System\NxNlxGF.exe
  2⤵
  PID:5468
- C:\Windows\System\nMyNsjE.exe
  C:\Windows\System\nMyNsjE.exe
  2⤵
  PID:5484
- C:\Windows\System\kQJhPCd.exe
  C:\Windows\System\kQJhPCd.exe
  2⤵
  PID:5500
- C:\Windows\System\sdswLbB.exe
  C:\Windows\System\sdswLbB.exe
  2⤵
  PID:5516
- C:\Windows\System\tXXQeKN.exe
  C:\Windows\System\tXXQeKN.exe
  2⤵
  PID:5532
- C:\Windows\System\BAcPlKe.exe
  C:\Windows\System\BAcPlKe.exe
  2⤵
  PID:5548
- C:\Windows\System\OqcFRXP.exe
  C:\Windows\System\OqcFRXP.exe
  2⤵
  PID:5564
- C:\Windows\System\dBnIUAY.exe
  C:\Windows\System\dBnIUAY.exe
  2⤵
  PID:5584
- C:\Windows\System\aJgmNAw.exe
  C:\Windows\System\aJgmNAw.exe
  2⤵
  PID:5608
- C:\Windows\System\VpGpwPD.exe
  C:\Windows\System\VpGpwPD.exe
  2⤵
  PID:5624
- C:\Windows\System\wITuDIb.exe
  C:\Windows\System\wITuDIb.exe
  2⤵
  PID:5640
- C:\Windows\System\PBdERNH.exe
  C:\Windows\System\PBdERNH.exe
  2⤵
  PID:5656
- C:\Windows\System\GevkoiU.exe
  C:\Windows\System\GevkoiU.exe
  2⤵
  PID:5672
- C:\Windows\System\WptYclA.exe
  C:\Windows\System\WptYclA.exe
  2⤵
  PID:5688
- C:\Windows\System\miFaQRP.exe
  C:\Windows\System\miFaQRP.exe
  2⤵
  PID:5708
- C:\Windows\System\JrRfWjS.exe
  C:\Windows\System\JrRfWjS.exe
  2⤵
  PID:5724
- C:\Windows\System\BlbNVCP.exe
  C:\Windows\System\BlbNVCP.exe
  2⤵
  PID:5740
- C:\Windows\System\fZtyaGg.exe
  C:\Windows\System\fZtyaGg.exe
  2⤵
  PID:5756
- C:\Windows\System\lKihtCZ.exe
  C:\Windows\System\lKihtCZ.exe
  2⤵
  PID:5772
- C:\Windows\System\XTtjoir.exe
  C:\Windows\System\XTtjoir.exe
  2⤵
  PID:5788
- C:\Windows\System\mPvLYwj.exe
  C:\Windows\System\mPvLYwj.exe
  2⤵
  PID:5804
- C:\Windows\System\jeTyjYH.exe
  C:\Windows\System\jeTyjYH.exe
  2⤵
  PID:5828
- C:\Windows\System\ppGlmFr.exe
  C:\Windows\System\ppGlmFr.exe
  2⤵
  PID:5844
- C:\Windows\System\CEflaXV.exe
  C:\Windows\System\CEflaXV.exe
  2⤵
  PID:5860
- C:\Windows\System\HPZTbKH.exe
  C:\Windows\System\HPZTbKH.exe
  2⤵
  PID:5876
- C:\Windows\System\HIibWyn.exe
  C:\Windows\System\HIibWyn.exe
  2⤵
  PID:5896
- C:\Windows\System\WubwKJf.exe
  C:\Windows\System\WubwKJf.exe
  2⤵
  PID:5912
- C:\Windows\System\wKeNXFo.exe
  C:\Windows\System\wKeNXFo.exe
  2⤵
  PID:5928
- C:\Windows\System\dMiIceZ.exe
  C:\Windows\System\dMiIceZ.exe
  2⤵
  PID:5944
- C:\Windows\System\UkFdiBL.exe
  C:\Windows\System\UkFdiBL.exe
  2⤵
  PID:5960
- C:\Windows\System\NWyawUZ.exe
  C:\Windows\System\NWyawUZ.exe
  2⤵
  PID:5976
- C:\Windows\System\VlLfvRG.exe
  C:\Windows\System\VlLfvRG.exe
  2⤵
  PID:5992
- C:\Windows\System\plYjncF.exe
  C:\Windows\System\plYjncF.exe
  2⤵
  PID:6008
- C:\Windows\System\QRcfTVI.exe
  C:\Windows\System\QRcfTVI.exe
  2⤵
  PID:6028
- C:\Windows\System\hKCgJWn.exe
  C:\Windows\System\hKCgJWn.exe
  2⤵
  PID:6044
- C:\Windows\System\VFQyIwH.exe
  C:\Windows\System\VFQyIwH.exe
  2⤵
  PID:6060
- C:\Windows\System\lQOYlUj.exe
  C:\Windows\System\lQOYlUj.exe
  2⤵
  PID:6076
- C:\Windows\System\KDlOtBY.exe
  C:\Windows\System\KDlOtBY.exe
  2⤵
  PID:6092
- C:\Windows\System\rxsrzbp.exe
  C:\Windows\System\rxsrzbp.exe
  2⤵
  PID:6108
- C:\Windows\System\HGzKmPm.exe
  C:\Windows\System\HGzKmPm.exe
  2⤵
  PID:6124
- C:\Windows\System\WlKVJoz.exe
  C:\Windows\System\WlKVJoz.exe
  2⤵
  PID:4500
- C:\Windows\System\ZEfiRun.exe
  C:\Windows\System\ZEfiRun.exe
  2⤵
  PID:5172
- C:\Windows\System\HVUQaIS.exe
  C:\Windows\System\HVUQaIS.exe
  2⤵
  PID:5140
- C:\Windows\System\frWjPKx.exe
  C:\Windows\System\frWjPKx.exe
  2⤵
  PID:4424
- C:\Windows\System\OFRjDWp.exe
  C:\Windows\System\OFRjDWp.exe
  2⤵
  PID:4668
- C:\Windows\System\uhdQIqf.exe
  C:\Windows\System\uhdQIqf.exe
  2⤵
  PID:3384
- C:\Windows\System\ZtXRzLH.exe
  C:\Windows\System\ZtXRzLH.exe
  2⤵
  PID:4680
- C:\Windows\System\ivrCTUc.exe
  C:\Windows\System\ivrCTUc.exe
  2⤵
  PID:5272
- C:\Windows\System\EYaljqH.exe
  C:\Windows\System\EYaljqH.exe
  2⤵
  PID:5336
- C:\Windows\System\YoqXZFB.exe
  C:\Windows\System\YoqXZFB.exe
  2⤵
  PID:5400
- C:\Windows\System\iNFWTnQ.exe
  C:\Windows\System\iNFWTnQ.exe
  2⤵
  PID:5464
- C:\Windows\System\LuSLcQE.exe
  C:\Windows\System\LuSLcQE.exe
  2⤵
  PID:5124
- C:\Windows\System\ucYLfIm.exe
  C:\Windows\System\ucYLfIm.exe
  2⤵
  PID:5192
- C:\Windows\System\tynEsni.exe
  C:\Windows\System\tynEsni.exe
  2⤵
  PID:5284
- C:\Windows\System\NYOdHzw.exe
  C:\Windows\System\NYOdHzw.exe
  2⤵
  PID:5540
- C:\Windows\System\AMnfsRK.exe
  C:\Windows\System\AMnfsRK.exe
  2⤵
  PID:5348
- C:\Windows\System\foJGnDG.exe
  C:\Windows\System\foJGnDG.exe
  2⤵
  PID:5416
- C:\Windows\System\bMbxPFF.exe
  C:\Windows\System\bMbxPFF.exe
  2⤵
  PID:5480
- C:\Windows\System\UHWmRnv.exe
  C:\Windows\System\UHWmRnv.exe
  2⤵
  PID:5576
- C:\Windows\System\DQUXAVg.exe
  C:\Windows\System\DQUXAVg.exe
  2⤵
  PID:5636
- C:\Windows\System\XjEzRsl.exe
  C:\Windows\System\XjEzRsl.exe
  2⤵
  PID:5648
- C:\Windows\System\XFORvWW.exe
  C:\Windows\System\XFORvWW.exe
  2⤵
  PID:5700
- C:\Windows\System\FdOoTFh.exe
  C:\Windows\System\FdOoTFh.exe
  2⤵
  PID:5732
- C:\Windows\System\wHayiTX.exe
  C:\Windows\System\wHayiTX.exe
  2⤵
  PID:5752
- C:\Windows\System\krtqJPB.exe
  C:\Windows\System\krtqJPB.exe
  2⤵
  PID:5824
- C:\Windows\System\ZvtkaOf.exe
  C:\Windows\System\ZvtkaOf.exe
  2⤵
  PID:5852
- C:\Windows\System\tinIZHL.exe
  C:\Windows\System\tinIZHL.exe
  2⤵
  PID:5892
- C:\Windows\System\kxNqvbr.exe
  C:\Windows\System\kxNqvbr.exe
  2⤵
  PID:6024
- C:\Windows\System\FRLmsMw.exe
  C:\Windows\System\FRLmsMw.exe
  2⤵
  PID:6056
- C:\Windows\System\iEOGMMd.exe
  C:\Windows\System\iEOGMMd.exe
  2⤵
  PID:5908
- C:\Windows\System\hjHFCgz.exe
  C:\Windows\System\hjHFCgz.exe
  2⤵
  PID:5868
- C:\Windows\System\RcKGraU.exe
  C:\Windows\System\RcKGraU.exe
  2⤵
  PID:5968
- C:\Windows\System\XJsheaq.exe
  C:\Windows\System\XJsheaq.exe
  2⤵
  PID:6036
- C:\Windows\System\NscTrxU.exe
  C:\Windows\System\NscTrxU.exe
  2⤵
  PID:6016
- C:\Windows\System\LYcmDrK.exe
  C:\Windows\System\LYcmDrK.exe
  2⤵
  PID:6140
- C:\Windows\System\UlDzeYT.exe
  C:\Windows\System\UlDzeYT.exe
  2⤵
  PID:4764
- C:\Windows\System\SNVXeAu.exe
  C:\Windows\System\SNVXeAu.exe
  2⤵
  PID:3752
- C:\Windows\System\NTFmekz.exe
  C:\Windows\System\NTFmekz.exe
  2⤵
  PID:5984
- C:\Windows\System\MTTsehG.exe
  C:\Windows\System\MTTsehG.exe
  2⤵
  PID:884
- C:\Windows\System\OqQDjDk.exe
  C:\Windows\System\OqQDjDk.exe
  2⤵
  PID:6120
- C:\Windows\System\kCSfeoL.exe
  C:\Windows\System\kCSfeoL.exe
  2⤵
  PID:5432
- C:\Windows\System\LyMFRJA.exe
  C:\Windows\System\LyMFRJA.exe
  2⤵
  PID:5556
- C:\Windows\System\HUYXdmL.exe
  C:\Windows\System\HUYXdmL.exe
  2⤵
  PID:5156
- C:\Windows\System\HmBeprw.exe
  C:\Windows\System\HmBeprw.exe
  2⤵
  PID:5508
- C:\Windows\System\Xpewrwp.exe
  C:\Windows\System\Xpewrwp.exe
  2⤵
  PID:5572
- C:\Windows\System\tdMBXMi.exe
  C:\Windows\System\tdMBXMi.exe
  2⤵
  PID:5720
- C:\Windows\System\TYPRfCH.exe
  C:\Windows\System\TYPRfCH.exe
  2⤵
  PID:5884
- C:\Windows\System\xTYdQvc.exe
  C:\Windows\System\xTYdQvc.exe
  2⤵
  PID:5840
- C:\Windows\System\tOSUKyn.exe
  C:\Windows\System\tOSUKyn.exe
  2⤵
  PID:6136
- C:\Windows\System\NqFtcNG.exe
  C:\Windows\System\NqFtcNG.exe
  2⤵
  PID:5144
- C:\Windows\System\tnTTTrO.exe
  C:\Windows\System\tnTTTrO.exe
  2⤵
  PID:4128
- C:\Windows\System\YoDjcpP.exe
  C:\Windows\System\YoDjcpP.exe
  2⤵
  PID:5616
- C:\Windows\System\foAGkDT.exe
  C:\Windows\System\foAGkDT.exe
  2⤵
  PID:5764
- C:\Windows\System\JytAGnb.exe
  C:\Windows\System\JytAGnb.exe
  2⤵
  PID:5448
- C:\Windows\System\CcSXwEJ.exe
  C:\Windows\System\CcSXwEJ.exe
  2⤵
  PID:5320
- C:\Windows\System\MBSkWeJ.exe
  C:\Windows\System\MBSkWeJ.exe
  2⤵
  PID:5768
- C:\Windows\System\rDJsOyD.exe
  C:\Windows\System\rDJsOyD.exe
  2⤵
  PID:5936
- C:\Windows\System\SxlvJuL.exe
  C:\Windows\System\SxlvJuL.exe
  2⤵
  PID:5208
- C:\Windows\System\qIKAUgY.exe
  C:\Windows\System\qIKAUgY.exe
  2⤵
  PID:5332
- C:\Windows\System\ktuETQD.exe
  C:\Windows\System\ktuETQD.exe
  2⤵
  PID:5528
- C:\Windows\System\ANjGLhT.exe
  C:\Windows\System\ANjGLhT.exe
  2⤵
  PID:5780
- C:\Windows\System\yPwZgwZ.exe
  C:\Windows\System\yPwZgwZ.exe
  2⤵
  PID:4376
- C:\Windows\System\eQyhGCW.exe
  C:\Windows\System\eQyhGCW.exe
  2⤵
  PID:5256
- C:\Windows\System\veZxazl.exe
  C:\Windows\System\veZxazl.exe
  2⤵
  PID:6100
- C:\Windows\System\zKiuPAu.exe
  C:\Windows\System\zKiuPAu.exe
  2⤵
  PID:5680
- C:\Windows\System\yiJkjNZ.exe
  C:\Windows\System\yiJkjNZ.exe
  2⤵
  PID:6160
- C:\Windows\System\wshESyH.exe
  C:\Windows\System\wshESyH.exe
  2⤵
  PID:6180
- C:\Windows\System\xxXAGnK.exe
  C:\Windows\System\xxXAGnK.exe
  2⤵
  PID:6196
- C:\Windows\System\OYJCetS.exe
  C:\Windows\System\OYJCetS.exe
  2⤵
  PID:6216
- C:\Windows\System\yEEIkQe.exe
  C:\Windows\System\yEEIkQe.exe
  2⤵
  PID:6232
- C:\Windows\System\uKejsXr.exe
  C:\Windows\System\uKejsXr.exe
  2⤵
  PID:6248
- C:\Windows\System\mgGWTID.exe
  C:\Windows\System\mgGWTID.exe
  2⤵
  PID:6264
- C:\Windows\System\rULbPJd.exe
  C:\Windows\System\rULbPJd.exe
  2⤵
  PID:6280
- C:\Windows\System\bObnIGR.exe
  C:\Windows\System\bObnIGR.exe
  2⤵
  PID:6296
- C:\Windows\System\MoyKUki.exe
  C:\Windows\System\MoyKUki.exe
  2⤵
  PID:6312
- C:\Windows\System\SEAOBKM.exe
  C:\Windows\System\SEAOBKM.exe
  2⤵
  PID:6332
- C:\Windows\System\FRIIcIF.exe
  C:\Windows\System\FRIIcIF.exe
  2⤵
  PID:6348
- C:\Windows\System\mwewLzD.exe
  C:\Windows\System\mwewLzD.exe
  2⤵
  PID:6364
- C:\Windows\System\LRSUuHM.exe
  C:\Windows\System\LRSUuHM.exe
  2⤵
  PID:6380
- C:\Windows\System\HATbrig.exe
  C:\Windows\System\HATbrig.exe
  2⤵
  PID:6396
- C:\Windows\System\VlZVEVq.exe
  C:\Windows\System\VlZVEVq.exe
  2⤵
  PID:6412
- C:\Windows\System\qACHLoJ.exe
  C:\Windows\System\qACHLoJ.exe
  2⤵
  PID:6432
- C:\Windows\System\pirBRAr.exe
  C:\Windows\System\pirBRAr.exe
  2⤵
  PID:6448
- C:\Windows\System\ckXTXHB.exe
  C:\Windows\System\ckXTXHB.exe
  2⤵
  PID:6464
- C:\Windows\System\QQhiqDr.exe
  C:\Windows\System\QQhiqDr.exe
  2⤵
  PID:6480
- C:\Windows\System\lEZjIbm.exe
  C:\Windows\System\lEZjIbm.exe
  2⤵
  PID:6500
- C:\Windows\System\hznVDtb.exe
  C:\Windows\System\hznVDtb.exe
  2⤵
  PID:6516
- C:\Windows\System\eCeyEoE.exe
  C:\Windows\System\eCeyEoE.exe
  2⤵
  PID:6532
- C:\Windows\System\toLHIdJ.exe
  C:\Windows\System\toLHIdJ.exe
  2⤵
  PID:6548
- C:\Windows\System\AMFxZlC.exe
  C:\Windows\System\AMFxZlC.exe
  2⤵
  PID:6564
- C:\Windows\System\dpKoSCX.exe
  C:\Windows\System\dpKoSCX.exe
  2⤵
  PID:6580
- C:\Windows\System\tpUsucM.exe
  C:\Windows\System\tpUsucM.exe
  2⤵
  PID:6596
- C:\Windows\System\GQIvksF.exe
  C:\Windows\System\GQIvksF.exe
  2⤵
  PID:6612
- C:\Windows\System\ZPSAbYY.exe
  C:\Windows\System\ZPSAbYY.exe
  2⤵
  PID:6628
- C:\Windows\System\RrgaHyw.exe
  C:\Windows\System\RrgaHyw.exe
  2⤵
  PID:6644
- C:\Windows\System\JJKWUCr.exe
  C:\Windows\System\JJKWUCr.exe
  2⤵
  PID:6660
- C:\Windows\System\xPfdSIK.exe
  C:\Windows\System\xPfdSIK.exe
  2⤵
  PID:6680
- C:\Windows\System\wFiUATT.exe
  C:\Windows\System\wFiUATT.exe
  2⤵
  PID:6696
- C:\Windows\System\lViJaNo.exe
  C:\Windows\System\lViJaNo.exe
  2⤵
  PID:6712
- C:\Windows\System\vsvybcJ.exe
  C:\Windows\System\vsvybcJ.exe
  2⤵
  PID:6728
- C:\Windows\System\KhsQyYW.exe
  C:\Windows\System\KhsQyYW.exe
  2⤵
  PID:6748
- C:\Windows\System\GUHHKxu.exe
  C:\Windows\System\GUHHKxu.exe
  2⤵
  PID:6764
- C:\Windows\System\MUoSvWQ.exe
  C:\Windows\System\MUoSvWQ.exe
  2⤵
  PID:6780
- C:\Windows\System\oNTOGWY.exe
  C:\Windows\System\oNTOGWY.exe
  2⤵
  PID:6796
- C:\Windows\System\euMZrET.exe
  C:\Windows\System\euMZrET.exe
  2⤵
  PID:6812
- C:\Windows\System\qwYFyjc.exe
  C:\Windows\System\qwYFyjc.exe
  2⤵
  PID:6828
- C:\Windows\System\oonHvRs.exe
  C:\Windows\System\oonHvRs.exe
  2⤵
  PID:6844
- C:\Windows\System\hIIFRdi.exe
  C:\Windows\System\hIIFRdi.exe
  2⤵
  PID:6860
- C:\Windows\System\UNPDDgm.exe
  C:\Windows\System\UNPDDgm.exe
  2⤵
  PID:6876
- C:\Windows\System\UnUcKwF.exe
  C:\Windows\System\UnUcKwF.exe
  2⤵
  PID:6892
- C:\Windows\System\OCPiQwP.exe
  C:\Windows\System\OCPiQwP.exe
  2⤵
  PID:6912
- C:\Windows\System\fzqvAWF.exe
  C:\Windows\System\fzqvAWF.exe
  2⤵
  PID:6928
- C:\Windows\System\QFKVJvj.exe
  C:\Windows\System\QFKVJvj.exe
  2⤵
  PID:6944
- C:\Windows\System\fCZqzYD.exe
  C:\Windows\System\fCZqzYD.exe
  2⤵
  PID:6960
- C:\Windows\System\PtZYWHD.exe
  C:\Windows\System\PtZYWHD.exe
  2⤵
  PID:6976
- C:\Windows\System\XwlWVhQ.exe
  C:\Windows\System\XwlWVhQ.exe
  2⤵
  PID:6992
- C:\Windows\System\wCrHRox.exe
  C:\Windows\System\wCrHRox.exe
  2⤵
  PID:7008
- C:\Windows\System\zbYsJev.exe
  C:\Windows\System\zbYsJev.exe
  2⤵
  PID:7024
- C:\Windows\System\NyRogsS.exe
  C:\Windows\System\NyRogsS.exe
  2⤵
  PID:7040
- C:\Windows\System\UbPrjZH.exe
  C:\Windows\System\UbPrjZH.exe
  2⤵
  PID:7056
- C:\Windows\System\XHFhCdy.exe
  C:\Windows\System\XHFhCdy.exe
  2⤵
  PID:7072
- C:\Windows\System\ZLjBNaN.exe
  C:\Windows\System\ZLjBNaN.exe
  2⤵
  PID:7088
- C:\Windows\System\CDrNdpj.exe
  C:\Windows\System\CDrNdpj.exe
  2⤵
  PID:7104
- C:\Windows\System\YcKinmz.exe
  C:\Windows\System\YcKinmz.exe
  2⤵
  PID:7120
- C:\Windows\System\iKoqpZJ.exe
  C:\Windows\System\iKoqpZJ.exe
  2⤵
  PID:7136
- C:\Windows\System\DhmzaEf.exe
  C:\Windows\System\DhmzaEf.exe
  2⤵
  PID:7152
- C:\Windows\System\nqrkRmr.exe
  C:\Windows\System\nqrkRmr.exe
  2⤵
  PID:5812
- C:\Windows\System\iXrCXdf.exe
  C:\Windows\System\iXrCXdf.exe
  2⤵
  PID:5544
- C:\Windows\System\COIEWBN.exe
  C:\Windows\System\COIEWBN.exe
  2⤵
  PID:6068
- C:\Windows\System\AyIryKy.exe
  C:\Windows\System\AyIryKy.exe
  2⤵
  PID:6116
- C:\Windows\System\UMzeDbm.exe
  C:\Windows\System\UMzeDbm.exe
  2⤵
  PID:6004
- C:\Windows\System\xJHlNWI.exe
  C:\Windows\System\xJHlNWI.exe
  2⤵
  PID:5396
- C:\Windows\System\iViknvW.exe
  C:\Windows\System\iViknvW.exe
  2⤵
  PID:5604
- C:\Windows\System\HPdPyDy.exe
  C:\Windows\System\HPdPyDy.exe
  2⤵
  PID:5620
- C:\Windows\System\RzZxdNE.exe
  C:\Windows\System\RzZxdNE.exe
  2⤵
  PID:6156
- C:\Windows\System\dexDAnc.exe
  C:\Windows\System\dexDAnc.exe
  2⤵
  PID:6240
- C:\Windows\System\XUqlIFz.exe
  C:\Windows\System\XUqlIFz.exe
  2⤵
  PID:6308
- C:\Windows\System\CMSIKec.exe
  C:\Windows\System\CMSIKec.exe
  2⤵
  PID:6372
- C:\Windows\System\tJjrzhS.exe
  C:\Windows\System\tJjrzhS.exe
  2⤵
  PID:6440
- C:\Windows\System\XiIVNVQ.exe
  C:\Windows\System\XiIVNVQ.exe
  2⤵
  PID:6228
- C:\Windows\System\nypWTXT.exe
  C:\Windows\System\nypWTXT.exe
  2⤵
  PID:6324
- C:\Windows\System\UJvPvIZ.exe
  C:\Windows\System\UJvPvIZ.exe
  2⤵
  PID:6420
- C:\Windows\System\YoqmxgU.exe
  C:\Windows\System\YoqmxgU.exe
  2⤵
  PID:6292
- C:\Windows\System\tIPakOU.exe
  C:\Windows\System\tIPakOU.exe
  2⤵
  PID:6492
- C:\Windows\System\VtcJgMW.exe
  C:\Windows\System\VtcJgMW.exe
  2⤵
  PID:6524
- C:\Windows\System\aqWfFqw.exe
  C:\Windows\System\aqWfFqw.exe
  2⤵
  PID:6576
- C:\Windows\System\JbMNGEC.exe
  C:\Windows\System\JbMNGEC.exe
  2⤵
  PID:6588
- C:\Windows\System\ruVAOuN.exe
  C:\Windows\System\ruVAOuN.exe
  2⤵
  PID:6604
- C:\Windows\System\BqOgItc.exe
  C:\Windows\System\BqOgItc.exe
  2⤵
  PID:6624
- C:\Windows\System\EPHoMIb.exe
  C:\Windows\System\EPHoMIb.exe
  2⤵
  PID:6704
- C:\Windows\System\qgHNjOD.exe
  C:\Windows\System\qgHNjOD.exe
  2⤵
  PID:6740
- C:\Windows\System\HCPfgnr.exe
  C:\Windows\System\HCPfgnr.exe
  2⤵
  PID:6724
- C:\Windows\System\AlUQvQa.exe
  C:\Windows\System\AlUQvQa.exe
  2⤵
  PID:6804
- C:\Windows\System\hStvyOb.exe
  C:\Windows\System\hStvyOb.exe
  2⤵
  PID:6840
- C:\Windows\System\lwNnkNK.exe
  C:\Windows\System\lwNnkNK.exe
  2⤵
  PID:6900
- C:\Windows\System\AviWluL.exe
  C:\Windows\System\AviWluL.exe
  2⤵
  PID:6940
- C:\Windows\System\KQSCOcM.exe
  C:\Windows\System\KQSCOcM.exe
  2⤵
  PID:6972
- C:\Windows\System\JlRWxgo.exe
  C:\Windows\System\JlRWxgo.exe
  2⤵
  PID:7032
- C:\Windows\System\ubgfgVq.exe
  C:\Windows\System\ubgfgVq.exe
  2⤵
  PID:6788
- C:\Windows\System\MqmFLLg.exe
  C:\Windows\System\MqmFLLg.exe
  2⤵
  PID:7064
- C:\Windows\System\otpEzIx.exe
  C:\Windows\System\otpEzIx.exe
  2⤵
  PID:7128
- C:\Windows\System\UEFGWFa.exe
  C:\Windows\System\UEFGWFa.exe
  2⤵
  PID:6172
- C:\Windows\System\PoxWuxc.exe
  C:\Windows\System\PoxWuxc.exe
  2⤵
  PID:6984
- C:\Windows\System\nKWdURL.exe
  C:\Windows\System\nKWdURL.exe
  2⤵
  PID:7052
- C:\Windows\System\yWrPMce.exe
  C:\Windows\System\yWrPMce.exe
  2⤵
  PID:7116
- C:\Windows\System\NsThjHG.exe
  C:\Windows\System\NsThjHG.exe
  2⤵
  PID:5352
- C:\Windows\System\uDgUQYM.exe
  C:\Windows\System\uDgUQYM.exe
  2⤵
  PID:6132
- C:\Windows\System\RaWeOZX.exe
  C:\Windows\System\RaWeOZX.exe
  2⤵
  PID:6276
- C:\Windows\System\RdFnfUg.exe
  C:\Windows\System\RdFnfUg.exe
  2⤵
  PID:6320
- C:\Windows\System\tPUAsFx.exe
  C:\Windows\System\tPUAsFx.exe
  2⤵
  PID:5268
- C:\Windows\System\xtKRakY.exe
  C:\Windows\System\xtKRakY.exe
  2⤵
  PID:6224
- C:\Windows\System\oeKJxFB.exe
  C:\Windows\System\oeKJxFB.exe
  2⤵
  PID:6260
- C:\Windows\System\YtQtBWF.exe
  C:\Windows\System\YtQtBWF.exe
  2⤵
  PID:6356
- C:\Windows\System\RYHYqye.exe
  C:\Windows\System\RYHYqye.exe
  2⤵
  PID:6512
- C:\Windows\System\HjaKhzI.exe
  C:\Windows\System\HjaKhzI.exe
  2⤵
  PID:6560
- C:\Windows\System\VYZmSUZ.exe
  C:\Windows\System\VYZmSUZ.exe
  2⤵
  PID:6708
- C:\Windows\System\NyQjbRA.exe
  C:\Windows\System\NyQjbRA.exe
  2⤵
  PID:6836
- C:\Windows\System\gOhRreX.exe
  C:\Windows\System\gOhRreX.exe
  2⤵
  PID:6952
- C:\Windows\System\BQijCbz.exe
  C:\Windows\System\BQijCbz.exe
  2⤵
  PID:6760
- C:\Windows\System\GgnlaSB.exe
  C:\Windows\System\GgnlaSB.exe
  2⤵
  PID:7164
- C:\Windows\System\RUadADB.exe
  C:\Windows\System\RUadADB.exe
  2⤵
  PID:6072
- C:\Windows\System\vTVnXms.exe
  C:\Windows\System\vTVnXms.exe
  2⤵
  PID:6620
- C:\Windows\System\RaSFAaU.exe
  C:\Windows\System\RaSFAaU.exe
  2⤵
  PID:5600
- C:\Windows\System\LenYOAg.exe
  C:\Windows\System\LenYOAg.exe
  2⤵
  PID:6968
- C:\Windows\System\QfnLsoh.exe
  C:\Windows\System\QfnLsoh.exe
  2⤵
  PID:5716
- C:\Windows\System\WVGNDpd.exe
  C:\Windows\System\WVGNDpd.exe
  2⤵
  PID:5816
- C:\Windows\System\ysoJAlh.exe
  C:\Windows\System\ysoJAlh.exe
  2⤵
  PID:6408
- C:\Windows\System\OixoSNw.exe
  C:\Windows\System\OixoSNw.exe
  2⤵
  PID:6392
- C:\Windows\System\IxKsuIm.exe
  C:\Windows\System\IxKsuIm.exe
  2⤵
  PID:6852
- C:\Windows\System\TTupsJl.exe
  C:\Windows\System\TTupsJl.exe
  2⤵
  PID:6496
- C:\Windows\System\ynSffMF.exe
  C:\Windows\System\ynSffMF.exe
  2⤵
  PID:6476
- C:\Windows\System\pqhZDzU.exe
  C:\Windows\System\pqhZDzU.exe
  2⤵
  PID:4844
- C:\Windows\System\vKJJcUB.exe
  C:\Windows\System\vKJJcUB.exe
  2⤵
  PID:6544
- C:\Windows\System\wnPtXXm.exe
  C:\Windows\System\wnPtXXm.exe
  2⤵
  PID:6656
- C:\Windows\System\cxihWDb.exe
  C:\Windows\System\cxihWDb.exe
  2⤵
  PID:6456
- C:\Windows\System\CxlqUiq.exe
  C:\Windows\System\CxlqUiq.exe
  2⤵
  PID:6472
- C:\Windows\System\eDzQloV.exe
  C:\Windows\System\eDzQloV.exe
  2⤵
  PID:5696
- C:\Windows\System\OZJXVEi.exe
  C:\Windows\System\OZJXVEi.exe
  2⤵
  PID:7184
- C:\Windows\System\yeFDuYC.exe
  C:\Windows\System\yeFDuYC.exe
  2⤵
  PID:7200
- C:\Windows\System\IZGOwIk.exe
  C:\Windows\System\IZGOwIk.exe
  2⤵
  PID:7216
- C:\Windows\System\lLULTOb.exe
  C:\Windows\System\lLULTOb.exe
  2⤵
  PID:7236
- C:\Windows\System\lAQggcd.exe
  C:\Windows\System\lAQggcd.exe
  2⤵
  PID:7252
- C:\Windows\System\GiRuThF.exe
  C:\Windows\System\GiRuThF.exe
  2⤵
  PID:7268
- C:\Windows\System\xzuwpFd.exe
  C:\Windows\System\xzuwpFd.exe
  2⤵
  PID:7284
- C:\Windows\System\VqCTIhE.exe
  C:\Windows\System\VqCTIhE.exe
  2⤵
  PID:7300
- C:\Windows\System\LanSquP.exe
  C:\Windows\System\LanSquP.exe
  2⤵
  PID:7316
- C:\Windows\System\pTgVDNp.exe
  C:\Windows\System\pTgVDNp.exe
  2⤵
  PID:7332
- C:\Windows\System\HmkjTWY.exe
  C:\Windows\System\HmkjTWY.exe
  2⤵
  PID:7352
- C:\Windows\System\LcuUUtU.exe
  C:\Windows\System\LcuUUtU.exe
  2⤵
  PID:7368
- C:\Windows\System\ZJiFtMp.exe
  C:\Windows\System\ZJiFtMp.exe
  2⤵
  PID:7384
- C:\Windows\System\YgqnyDD.exe
  C:\Windows\System\YgqnyDD.exe
  2⤵
  PID:7400
- C:\Windows\System\oQyBMSD.exe
  C:\Windows\System\oQyBMSD.exe
  2⤵
  PID:7416
- C:\Windows\System\mBHTwKT.exe
  C:\Windows\System\mBHTwKT.exe
  2⤵
  PID:7432
- C:\Windows\System\AoEiNnw.exe
  C:\Windows\System\AoEiNnw.exe
  2⤵
  PID:7448
- C:\Windows\System\FgOyqIK.exe
  C:\Windows\System\FgOyqIK.exe
  2⤵
  PID:7464
- C:\Windows\System\XDcHGGp.exe
  C:\Windows\System\XDcHGGp.exe
  2⤵
  PID:7480
- C:\Windows\System\UkElyNL.exe
  C:\Windows\System\UkElyNL.exe
  2⤵
  PID:7496
- C:\Windows\System\Xwydczb.exe
  C:\Windows\System\Xwydczb.exe
  2⤵
  PID:7512
- C:\Windows\System\RdlwXWj.exe
  C:\Windows\System\RdlwXWj.exe
  2⤵
  PID:7528
- C:\Windows\System\NduQsee.exe
  C:\Windows\System\NduQsee.exe
  2⤵
  PID:7544
- C:\Windows\System\GRhTNyf.exe
  C:\Windows\System\GRhTNyf.exe
  2⤵
  PID:7560
- C:\Windows\System\HnDpXit.exe
  C:\Windows\System\HnDpXit.exe
  2⤵
  PID:7576
- C:\Windows\System\CGzPMlM.exe
  C:\Windows\System\CGzPMlM.exe
  2⤵
  PID:7592
- C:\Windows\System\fdLxvyQ.exe
  C:\Windows\System\fdLxvyQ.exe
  2⤵
  PID:7608
- C:\Windows\System\yBxELlC.exe
  C:\Windows\System\yBxELlC.exe
  2⤵
  PID:7624
- C:\Windows\System\yHBzuhL.exe
  C:\Windows\System\yHBzuhL.exe
  2⤵
  PID:7640
- C:\Windows\System\dAgpTRr.exe
  C:\Windows\System\dAgpTRr.exe
  2⤵
  PID:7656
- C:\Windows\System\VDwUxzR.exe
  C:\Windows\System\VDwUxzR.exe
  2⤵
  PID:7672
- C:\Windows\System\JUbULrc.exe
  C:\Windows\System\JUbULrc.exe
  2⤵
  PID:7688
- C:\Windows\System\tMmSjie.exe
  C:\Windows\System\tMmSjie.exe
  2⤵
  PID:7704
- C:\Windows\System\ZqqeQcY.exe
  C:\Windows\System\ZqqeQcY.exe
  2⤵
  PID:7720
- C:\Windows\System\NfjksyZ.exe
  C:\Windows\System\NfjksyZ.exe
  2⤵
  PID:7736
- C:\Windows\System\ictReSe.exe
  C:\Windows\System\ictReSe.exe
  2⤵
  PID:7752
- C:\Windows\System\fnRocxu.exe
  C:\Windows\System\fnRocxu.exe
  2⤵
  PID:7768
- C:\Windows\System\mQaifhe.exe
  C:\Windows\System\mQaifhe.exe
  2⤵
  PID:7784
- C:\Windows\System\ZCqQlao.exe
  C:\Windows\System\ZCqQlao.exe
  2⤵
  PID:7800
- C:\Windows\System\DrRkBPL.exe
  C:\Windows\System\DrRkBPL.exe
  2⤵
  PID:7816
- C:\Windows\System\vwsfUZC.exe
  C:\Windows\System\vwsfUZC.exe
  2⤵
  PID:7832
- C:\Windows\System\WsLDZvZ.exe
  C:\Windows\System\WsLDZvZ.exe
  2⤵
  PID:7852
- C:\Windows\System\bqkcuNg.exe
  C:\Windows\System\bqkcuNg.exe
  2⤵
  PID:7868
- C:\Windows\System\IztoJkd.exe
  C:\Windows\System\IztoJkd.exe
  2⤵
  PID:7884
- C:\Windows\System\ckeKVPR.exe
  C:\Windows\System\ckeKVPR.exe
  2⤵
  PID:7900
- C:\Windows\System\fghRkVa.exe
  C:\Windows\System\fghRkVa.exe
  2⤵
  PID:7916
- C:\Windows\System\kAvcKZz.exe
  C:\Windows\System\kAvcKZz.exe
  2⤵
  PID:7936
- C:\Windows\System\BPGGlOz.exe
  C:\Windows\System\BPGGlOz.exe
  2⤵
  PID:7952
- C:\Windows\System\IGtrtPS.exe
  C:\Windows\System\IGtrtPS.exe
  2⤵
  PID:7968
- C:\Windows\System\uiimfFK.exe
  C:\Windows\System\uiimfFK.exe
  2⤵
  PID:7984
- C:\Windows\System\dqdLzDX.exe
  C:\Windows\System\dqdLzDX.exe
  2⤵
  PID:8004
- C:\Windows\System\kTkYzFB.exe
  C:\Windows\System\kTkYzFB.exe
  2⤵
  PID:8020
- C:\Windows\System\ggRXaLY.exe
  C:\Windows\System\ggRXaLY.exe
  2⤵
  PID:8036
- C:\Windows\System\iRmTFAy.exe
  C:\Windows\System\iRmTFAy.exe
  2⤵
  PID:8056
- C:\Windows\System\lXPWQxq.exe
  C:\Windows\System\lXPWQxq.exe
  2⤵
  PID:8072
- C:\Windows\System\OlhcUaS.exe
  C:\Windows\System\OlhcUaS.exe
  2⤵
  PID:8088
- C:\Windows\System\LkFYaTk.exe
  C:\Windows\System\LkFYaTk.exe
  2⤵
  PID:8104
- C:\Windows\System\ifkZdDU.exe
  C:\Windows\System\ifkZdDU.exe
  2⤵
  PID:8120
- C:\Windows\System\YZFrvgz.exe
  C:\Windows\System\YZFrvgz.exe
  2⤵
  PID:8136
- C:\Windows\System\NAJbKDG.exe
  C:\Windows\System\NAJbKDG.exe
  2⤵
  PID:8152
- C:\Windows\System\hcfAefs.exe
  C:\Windows\System\hcfAefs.exe
  2⤵
  PID:8168
- C:\Windows\System\XMKIGjg.exe
  C:\Windows\System\XMKIGjg.exe
  2⤵
  PID:8188
- C:\Windows\System\doCDCHR.exe
  C:\Windows\System\doCDCHR.exe
  2⤵
  PID:7208
- C:\Windows\System\JZFCxNm.exe
  C:\Windows\System\JZFCxNm.exe
  2⤵
  PID:7248
- C:\Windows\System\rKzTbJr.exe
  C:\Windows\System\rKzTbJr.exe
  2⤵
  PID:7048
- C:\Windows\System\wsphOMN.exe
  C:\Windows\System\wsphOMN.exe
  2⤵
  PID:6608
- C:\Windows\System\yNGkBhr.exe
  C:\Windows\System\yNGkBhr.exe
  2⤵
  PID:7196
- C:\Windows\System\QlBSjwr.exe
  C:\Windows\System\QlBSjwr.exe
  2⤵
  PID:7260
- C:\Windows\System\XNLhZaB.exe
  C:\Windows\System\XNLhZaB.exe
  2⤵
  PID:7340
- C:\Windows\System\elbUdsq.exe
  C:\Windows\System\elbUdsq.exe
  2⤵
  PID:7360
- C:\Windows\System\lTEwwer.exe
  C:\Windows\System\lTEwwer.exe
  2⤵
  PID:7408
- C:\Windows\System\OiINfeX.exe
  C:\Windows\System\OiINfeX.exe
  2⤵
  PID:7440
- C:\Windows\System\tFeGBeH.exe
  C:\Windows\System\tFeGBeH.exe
  2⤵
  PID:7492
- C:\Windows\System\RpMwtov.exe
  C:\Windows\System\RpMwtov.exe
  2⤵
  PID:7552
- C:\Windows\System\tItSLgW.exe
  C:\Windows\System\tItSLgW.exe
  2⤵
  PID:7584
- C:\Windows\System\reusgyR.exe
  C:\Windows\System\reusgyR.exe
  2⤵
  PID:7508
- C:\Windows\System\PtPNuEN.exe
  C:\Windows\System\PtPNuEN.exe
  2⤵
  PID:7648
- C:\Windows\System\UvFAaFr.exe
  C:\Windows\System\UvFAaFr.exe
  2⤵
  PID:7684
- C:\Windows\System\KYiKjnp.exe
  C:\Windows\System\KYiKjnp.exe
  2⤵
  PID:7776
- C:\Windows\System\mlqBVOl.exe
  C:\Windows\System\mlqBVOl.exe
  2⤵
  PID:7600
- C:\Windows\System\iVDIoja.exe
  C:\Windows\System\iVDIoja.exe
  2⤵
  PID:7636
- C:\Windows\System\VPDENzD.exe
  C:\Windows\System\VPDENzD.exe
  2⤵
  PID:7728
- C:\Windows\System\EGaNVrd.exe
  C:\Windows\System\EGaNVrd.exe
  2⤵
  PID:7796
- C:\Windows\System\mLzzEuC.exe
  C:\Windows\System\mLzzEuC.exe
  2⤵
  PID:7840
- C:\Windows\System\QMPMoKB.exe
  C:\Windows\System\QMPMoKB.exe
  2⤵
  PID:7912
- C:\Windows\System\JLJPBjb.exe
  C:\Windows\System\JLJPBjb.exe
  2⤵
  PID:7980
- C:\Windows\System\PGNfWuC.exe
  C:\Windows\System\PGNfWuC.exe
  2⤵
  PID:8080
- C:\Windows\System\pAAHeQE.exe
  C:\Windows\System\pAAHeQE.exe
  2⤵
  PID:8112
- C:\Windows\System\DnXXxYC.exe
  C:\Windows\System\DnXXxYC.exe
  2⤵
  PID:7932
- C:\Windows\System\zPsUkmv.exe
  C:\Windows\System\zPsUkmv.exe
  2⤵
  PID:8032
- C:\Windows\System\ZRVUVci.exe
  C:\Windows\System\ZRVUVci.exe
  2⤵
  PID:8096
- C:\Windows\System\cxwPSqy.exe
  C:\Windows\System\cxwPSqy.exe
  2⤵
  PID:8028
- C:\Windows\System\RntBTYy.exe
  C:\Windows\System\RntBTYy.exe
  2⤵
  PID:8128
- C:\Windows\System\uZUWKIp.exe
  C:\Windows\System\uZUWKIp.exe
  2⤵
  PID:8176
- C:\Windows\System\BEQjJbs.exe
  C:\Windows\System\BEQjJbs.exe
  2⤵
  PID:6936
- C:\Windows\System\EvHXIZg.exe
  C:\Windows\System\EvHXIZg.exe
  2⤵
  PID:7328
- C:\Windows\System\CWgsPGc.exe
  C:\Windows\System\CWgsPGc.exe
  2⤵
  PID:7456
- C:\Windows\System\mwTMYYt.exe
  C:\Windows\System\mwTMYYt.exe
  2⤵
  PID:7680
- C:\Windows\System\KCgtAOx.exe
  C:\Windows\System\KCgtAOx.exe
  2⤵
  PID:7424
- C:\Windows\System\kxDgBMA.exe
  C:\Windows\System\kxDgBMA.exe
  2⤵
  PID:7192
- C:\Windows\System\RsrDRgN.exe
  C:\Windows\System\RsrDRgN.exe
  2⤵
  PID:7180
- C:\Windows\System\zLTRiqW.exe
  C:\Windows\System\zLTRiqW.exe
  2⤵
  PID:6488
- C:\Windows\System\ECszgss.exe
  C:\Windows\System\ECszgss.exe
  2⤵
  PID:7540
- C:\Windows\System\uuIqakE.exe
  C:\Windows\System\uuIqakE.exe
  2⤵
  PID:7700
- C:\Windows\System\nLkTzxo.exe
  C:\Windows\System\nLkTzxo.exe
  2⤵
  PID:7876
- C:\Windows\System\WnbsQlH.exe
  C:\Windows\System\WnbsQlH.exe
  2⤵
  PID:7924
- C:\Windows\System\xVwRzVh.exe
  C:\Windows\System\xVwRzVh.exe
  2⤵
  PID:7996
- C:\Windows\System\kSFyycU.exe
  C:\Windows\System\kSFyycU.exe
  2⤵
  PID:7280
- C:\Windows\System\tqjJpTH.exe
  C:\Windows\System\tqjJpTH.exe
  2⤵
  PID:7844
- C:\Windows\System\AhURorf.exe
  C:\Windows\System\AhURorf.exe
  2⤵
  PID:7896
- C:\Windows\System\DayHWVt.exe
  C:\Windows\System\DayHWVt.exe
  2⤵
  PID:7892
- C:\Windows\System\lAqcfYY.exe
  C:\Windows\System\lAqcfYY.exe
  2⤵
  PID:7228
- C:\Windows\System\rtDTTWI.exe
  C:\Windows\System\rtDTTWI.exe
  2⤵
  PID:7620
- C:\Windows\System\dsMDiRB.exe
  C:\Windows\System\dsMDiRB.exe
  2⤵
  PID:7176
- C:\Windows\System\ffbEtUl.exe
  C:\Windows\System\ffbEtUl.exe
  2⤵
  PID:7524
- C:\Windows\System\AJwNBzl.exe
  C:\Windows\System\AJwNBzl.exe
  2⤵
  PID:7568
- C:\Windows\System\Rplbmgy.exe
  C:\Windows\System\Rplbmgy.exe
  2⤵
  PID:7808
- C:\Windows\System\dMNMjTd.exe
  C:\Windows\System\dMNMjTd.exe
  2⤵
  PID:8132
- C:\Windows\System\OIkNauc.exe
  C:\Windows\System\OIkNauc.exe
  2⤵
  PID:7976
- C:\Windows\System\bihCYYc.exe
  C:\Windows\System\bihCYYc.exe
  2⤵
  PID:7792
- C:\Windows\System\KgjPPGI.exe
  C:\Windows\System\KgjPPGI.exe
  2⤵
  PID:7760
- C:\Windows\System\Ieogvuf.exe
  C:\Windows\System\Ieogvuf.exe
  2⤵
  PID:7244
- C:\Windows\System\ydlfOLB.exe
  C:\Windows\System\ydlfOLB.exe
  2⤵
  PID:7380
- C:\Windows\System\IpTBPHT.exe
  C:\Windows\System\IpTBPHT.exe
  2⤵
  PID:7744
- C:\Windows\System\BvEqmFt.exe
  C:\Windows\System\BvEqmFt.exe
  2⤵
  PID:8144
- C:\Windows\System\GvakopL.exe
  C:\Windows\System\GvakopL.exe
  2⤵
  PID:7824
- C:\Windows\System\JCFIsts.exe
  C:\Windows\System\JCFIsts.exe
  2⤵
  PID:7324
- C:\Windows\System\ElsXTce.exe
  C:\Windows\System\ElsXTce.exe
  2⤵
  PID:8048
- C:\Windows\System\aWtbMsN.exe
  C:\Windows\System\aWtbMsN.exe
  2⤵
  PID:8064
- C:\Windows\System\LGnTKJk.exe
  C:\Windows\System\LGnTKJk.exe
  2⤵
  PID:8204
- C:\Windows\System\gPbYjJF.exe
  C:\Windows\System\gPbYjJF.exe
  2⤵
  PID:8220
- C:\Windows\System\hKVIqXv.exe
  C:\Windows\System\hKVIqXv.exe
  2⤵
  PID:8236
- C:\Windows\System\hKzpLPb.exe
  C:\Windows\System\hKzpLPb.exe
  2⤵
  PID:8252
- C:\Windows\System\bJmwQyu.exe
  C:\Windows\System\bJmwQyu.exe
  2⤵
  PID:8276
- C:\Windows\System\amcbzlN.exe
  C:\Windows\System\amcbzlN.exe
  2⤵
  PID:8296
- C:\Windows\System\LzvqLuh.exe
  C:\Windows\System\LzvqLuh.exe
  2⤵
  PID:8312
- C:\Windows\System\TMTaHeT.exe
  C:\Windows\System\TMTaHeT.exe
  2⤵
  PID:8328
- C:\Windows\System\eKbjHYh.exe
  C:\Windows\System\eKbjHYh.exe
  2⤵
  PID:8344
- C:\Windows\System\eADbFqy.exe
  C:\Windows\System\eADbFqy.exe
  2⤵
  PID:8360
- C:\Windows\System\gHtbDtg.exe
  C:\Windows\System\gHtbDtg.exe
  2⤵
  PID:8376
- C:\Windows\System\tvJPoIX.exe
  C:\Windows\System\tvJPoIX.exe
  2⤵
  PID:8396
- C:\Windows\System\jboTtue.exe
  C:\Windows\System\jboTtue.exe
  2⤵
  PID:8412
- C:\Windows\System\CgowEif.exe
  C:\Windows\System\CgowEif.exe
  2⤵
  PID:8428
- C:\Windows\System\imIxwKl.exe
  C:\Windows\System\imIxwKl.exe
  2⤵
  PID:8444
- C:\Windows\System\mJhaYEF.exe
  C:\Windows\System\mJhaYEF.exe
  2⤵
  PID:8464
- C:\Windows\System\ndmxQcg.exe
  C:\Windows\System\ndmxQcg.exe
  2⤵
  PID:8480
- C:\Windows\System\wysmOks.exe
  C:\Windows\System\wysmOks.exe
  2⤵
  PID:8500
- C:\Windows\System\GBcQeRM.exe
  C:\Windows\System\GBcQeRM.exe
  2⤵
  PID:8516
- C:\Windows\System\NehFxVS.exe
  C:\Windows\System\NehFxVS.exe
  2⤵
  PID:8532
- C:\Windows\System\gGOYHPK.exe
  C:\Windows\System\gGOYHPK.exe
  2⤵
  PID:8548
- C:\Windows\System\DaTlcUm.exe
  C:\Windows\System\DaTlcUm.exe
  2⤵
  PID:8564
- C:\Windows\System\gPDUBxr.exe
  C:\Windows\System\gPDUBxr.exe
  2⤵
  PID:8580
- C:\Windows\System\AuieKEM.exe
  C:\Windows\System\AuieKEM.exe
  2⤵
  PID:8600
- C:\Windows\System\FcotPAz.exe
  C:\Windows\System\FcotPAz.exe
  2⤵
  PID:8700
- C:\Windows\System\HCXMMiz.exe
  C:\Windows\System\HCXMMiz.exe
  2⤵
  PID:8860
- C:\Windows\System\ZgmzpdQ.exe
  C:\Windows\System\ZgmzpdQ.exe
  2⤵
  PID:8876
- C:\Windows\System\jNaOaXg.exe
  C:\Windows\System\jNaOaXg.exe
  2⤵
  PID:8892
- C:\Windows\System\nHspLOV.exe
  C:\Windows\System\nHspLOV.exe
  2⤵
  PID:8908
- C:\Windows\System\aLzmQfc.exe
  C:\Windows\System\aLzmQfc.exe
  2⤵
  PID:8924
- C:\Windows\System\jggtjGb.exe
  C:\Windows\System\jggtjGb.exe
  2⤵
  PID:8940
- C:\Windows\System\ekRKmrN.exe
  C:\Windows\System\ekRKmrN.exe
  2⤵
  PID:8960
- C:\Windows\System\glKmAiu.exe
  C:\Windows\System\glKmAiu.exe
  2⤵
  PID:8976
- C:\Windows\System\JeRARun.exe
  C:\Windows\System\JeRARun.exe
  2⤵
  PID:8996
- C:\Windows\System\gqbCkcH.exe
  C:\Windows\System\gqbCkcH.exe
  2⤵
  PID:9012
- C:\Windows\System\HTdwYfT.exe
  C:\Windows\System\HTdwYfT.exe
  2⤵
  PID:9028
- C:\Windows\System\XzIBCpO.exe
  C:\Windows\System\XzIBCpO.exe
  2⤵
  PID:9044
- C:\Windows\System\cJKvrvh.exe
  C:\Windows\System\cJKvrvh.exe
  2⤵
  PID:9160
- C:\Windows\System\pSDqdUP.exe
  C:\Windows\System\pSDqdUP.exe
  2⤵
  PID:9176
- C:\Windows\System\xtnjNqO.exe
  C:\Windows\System\xtnjNqO.exe
  2⤵
  PID:9192
- C:\Windows\System\YSdNwHm.exe
  C:\Windows\System\YSdNwHm.exe
  2⤵
  PID:9208
- C:\Windows\System\eFQLasp.exe
  C:\Windows\System\eFQLasp.exe
  2⤵
  PID:7472
- C:\Windows\System\iBLcXJe.exe
  C:\Windows\System\iBLcXJe.exe
  2⤵
  PID:8196
- C:\Windows\System\QWprrGu.exe
  C:\Windows\System\QWprrGu.exe
  2⤵
  PID:8244
- C:\Windows\System\QzHuVAP.exe
  C:\Windows\System\QzHuVAP.exe
  2⤵
  PID:8292
- C:\Windows\System\APfTaKI.exe
  C:\Windows\System\APfTaKI.exe
  2⤵
  PID:8232
- C:\Windows\System\FqQVfYg.exe
  C:\Windows\System\FqQVfYg.exe
  2⤵
  PID:8304
- C:\Windows\System\ciALUpb.exe
  C:\Windows\System\ciALUpb.exe
  2⤵
  PID:8368
- C:\Windows\System\aKZtAmI.exe
  C:\Windows\System\aKZtAmI.exe
  2⤵
  PID:8384
- C:\Windows\System\xFuLxoJ.exe
  C:\Windows\System\xFuLxoJ.exe
  2⤵
  PID:8424
- C:\Windows\System\HSCLjeO.exe
  C:\Windows\System\HSCLjeO.exe
  2⤵
  PID:8456
- C:\Windows\System\NvNVlVS.exe
  C:\Windows\System\NvNVlVS.exe
  2⤵
  PID:8488
- C:\Windows\System\YHleyAv.exe
  C:\Windows\System\YHleyAv.exe
  2⤵
  PID:8496
- C:\Windows\System\hrmDksi.exe
  C:\Windows\System\hrmDksi.exe
  2⤵
  PID:8524
- C:\Windows\System\YAxDpcF.exe
  C:\Windows\System\YAxDpcF.exe
  2⤵
  PID:6088
- C:\Windows\System\SPzmwKY.exe
  C:\Windows\System\SPzmwKY.exe
  2⤵
  PID:8544
- C:\Windows\System\XFPXEnX.exe
  C:\Windows\System\XFPXEnX.exe
  2⤵
  PID:8640
- C:\Windows\System\EnVgiuK.exe
  C:\Windows\System\EnVgiuK.exe
  2⤵
  PID:8656
- C:\Windows\System\qSkqAJh.exe
  C:\Windows\System\qSkqAJh.exe
  2⤵
  PID:8672
- C:\Windows\System\FQBOwbc.exe
  C:\Windows\System\FQBOwbc.exe
  2⤵
  PID:8684
- C:\Windows\System\RArCgzM.exe
  C:\Windows\System\RArCgzM.exe
  2⤵
  PID:8708
- C:\Windows\System\krbBxUg.exe
  C:\Windows\System\krbBxUg.exe
  2⤵
  PID:8904
- C:\Windows\System\iSnBKrY.exe
  C:\Windows\System\iSnBKrY.exe
  2⤵
  PID:8972
- C:\Windows\System\WpUPpkn.exe
  C:\Windows\System\WpUPpkn.exe
  2⤵
  PID:9040
- C:\Windows\System\dqghxcX.exe
  C:\Windows\System\dqghxcX.exe
  2⤵
  PID:8760
- C:\Windows\System\aJpdXcB.exe
  C:\Windows\System\aJpdXcB.exe
  2⤵
  PID:8724
- C:\Windows\System\QijbFMM.exe
  C:\Windows\System\QijbFMM.exe
  2⤵
  PID:8752
- C:\Windows\System\LJETjzc.exe
  C:\Windows\System\LJETjzc.exe
  2⤵
  PID:8776
- C:\Windows\System\TGNFBwV.exe
  C:\Windows\System\TGNFBwV.exe
  2⤵
  PID:8792
- C:\Windows\System\FdmbKQY.exe
  C:\Windows\System\FdmbKQY.exe
  2⤵
  PID:8808
- C:\Windows\System\ctORRpS.exe
  C:\Windows\System\ctORRpS.exe
  2⤵
  PID:8824
- C:\Windows\System\cmXqxwH.exe
  C:\Windows\System\cmXqxwH.exe
  2⤵
  PID:8844
- C:\Windows\System\hupqIyI.exe
  C:\Windows\System\hupqIyI.exe
  2⤵
  PID:8884
- C:\Windows\System\HBmTJbR.exe
  C:\Windows\System\HBmTJbR.exe
  2⤵
  PID:8948
- C:\Windows\System\LLHDuVj.exe
  C:\Windows\System\LLHDuVj.exe
  2⤵
  PID:9024
- C:\Windows\System\XxcooPU.exe
  C:\Windows\System\XxcooPU.exe
  2⤵
  PID:9064
- C:\Windows\System\trUwNTD.exe
  C:\Windows\System\trUwNTD.exe
  2⤵
  PID:9084
- C:\Windows\System\QrwZOFG.exe
  C:\Windows\System\QrwZOFG.exe
  2⤵
  PID:9100
- C:\Windows\System\BckDVsM.exe
  C:\Windows\System\BckDVsM.exe
  2⤵
  PID:9116
- C:\Windows\System\EkdALGo.exe
  C:\Windows\System\EkdALGo.exe
  2⤵
  PID:9136
- C:\Windows\System\fTFKOua.exe
  C:\Windows\System\fTFKOua.exe
  2⤵
  PID:9152
- C:\Windows\System\XPjoJwC.exe
  C:\Windows\System\XPjoJwC.exe
  2⤵
  PID:9204
- C:\Windows\System\PWDeIwI.exe
  C:\Windows\System\PWDeIwI.exe
  2⤵
  PID:8288
- C:\Windows\System\lgYIpnS.exe
  C:\Windows\System\lgYIpnS.exe
  2⤵
  PID:8352
- C:\Windows\System\HDYMMGf.exe
  C:\Windows\System\HDYMMGf.exe
  2⤵
  PID:8492
- C:\Windows\System\sxPgOLY.exe
  C:\Windows\System\sxPgOLY.exe
  2⤵
  PID:8460
- C:\Windows\System\ncgvpBd.exe
  C:\Windows\System\ncgvpBd.exe
  2⤵
  PID:7616
- C:\Windows\System\ThPtzRX.exe
  C:\Windows\System\ThPtzRX.exe
  2⤵
  PID:8324
- C:\Windows\System\ZYuzCIj.exe
  C:\Windows\System\ZYuzCIj.exe
  2⤵
  PID:8440
- C:\Windows\System\tsuvFSj.exe
  C:\Windows\System\tsuvFSj.exe
  2⤵
  PID:8576
- C:\Windows\System\feyfYZK.exe
  C:\Windows\System\feyfYZK.exe
  2⤵
  PID:8616
- C:\Windows\System\QcwlroZ.exe
  C:\Windows\System\QcwlroZ.exe
  2⤵
  PID:8632
- C:\Windows\System\TeVOavk.exe
  C:\Windows\System\TeVOavk.exe
  2⤵
  PID:8692
- C:\Windows\System\piYZYxQ.exe
  C:\Windows\System\piYZYxQ.exe
  2⤵
  PID:8728
- C:\Windows\System\FdGIfWR.exe
  C:\Windows\System\FdGIfWR.exe
  2⤵
  PID:8748
- C:\Windows\System\SdEdxuA.exe
  C:\Windows\System\SdEdxuA.exe
  2⤵
  PID:8872
- C:\Windows\System\sxAJXdM.exe
  C:\Windows\System\sxAJXdM.exe
  2⤵
  PID:8680
- C:\Windows\System\hTARgBh.exe
  C:\Windows\System\hTARgBh.exe
  2⤵
  PID:8800
- C:\Windows\System\qGWRPNb.exe
  C:\Windows\System\qGWRPNb.exe
  2⤵
  PID:8984
- C:\Windows\System\sWMfgVr.exe
  C:\Windows\System\sWMfgVr.exe
  2⤵
  PID:9076
- C:\Windows\System\ytOooAz.exe
  C:\Windows\System\ytOooAz.exe
  2⤵
  PID:8084
- C:\Windows\System\yDmCxfq.exe
  C:\Windows\System\yDmCxfq.exe
  2⤵
  PID:8804
- C:\Windows\System\UjuweTh.exe
  C:\Windows\System\UjuweTh.exe
  2⤵
  PID:8556
- C:\Windows\System\wDsSfYZ.exe
  C:\Windows\System\wDsSfYZ.exe
  2⤵
  PID:8628
- C:\Windows\System\coPaPrh.exe
  C:\Windows\System\coPaPrh.exe
  2⤵
  PID:8740
- C:\Windows\System\SrFLmiP.exe
  C:\Windows\System\SrFLmiP.exe
  2⤵
  PID:8744
- C:\Windows\System\aXgWEAG.exe
  C:\Windows\System\aXgWEAG.exe
  2⤵
  PID:8852
- C:\Windows\System\wjAqGNt.exe
  C:\Windows\System\wjAqGNt.exe
  2⤵
  PID:9144
- C:\Windows\System\drfmksd.exe
  C:\Windows\System\drfmksd.exe
  2⤵
  PID:8920
- C:\Windows\System\ScLqpMP.exe
  C:\Windows\System\ScLqpMP.exe
  2⤵
  PID:9096
- C:\Windows\System\oRZYpMy.exe
  C:\Windows\System\oRZYpMy.exe
  2⤵
  PID:8764
- C:\Windows\System\STondSL.exe
  C:\Windows\System\STondSL.exe
  2⤵
  PID:8452
- C:\Windows\System\BnFmWwt.exe
  C:\Windows\System\BnFmWwt.exe
  2⤵
  PID:9184
- C:\Windows\System\adVguUc.exe
  C:\Windows\System\adVguUc.exe
  2⤵
  PID:9200
- C:\Windows\System\zTjBYLE.exe
  C:\Windows\System\zTjBYLE.exe
  2⤵
  PID:8216
- C:\Windows\System\NZSixQJ.exe
  C:\Windows\System\NZSixQJ.exe
  2⤵
  PID:9072
- C:\Windows\System\bchOcNg.exe
  C:\Windows\System\bchOcNg.exe
  2⤵
  PID:8952
- C:\Windows\System\dWcKZgu.exe
  C:\Windows\System\dWcKZgu.exe
  2⤵
  PID:8840
- C:\Windows\System\wnNdIcQ.exe
  C:\Windows\System\wnNdIcQ.exe
  2⤵
  PID:9112
- C:\Windows\System\wZCIFsF.exe
  C:\Windows\System\wZCIFsF.exe
  2⤵
  PID:8648
- C:\Windows\System\siBPZxr.exe
  C:\Windows\System\siBPZxr.exe
  2⤵
  PID:9092
- C:\Windows\System\KaKAENt.exe
  C:\Windows\System\KaKAENt.exe
  2⤵
  PID:8916
- C:\Windows\System\BdQUtTL.exe
  C:\Windows\System\BdQUtTL.exe
  2⤵
  PID:8668
- C:\Windows\System\QBPcLxO.exe
  C:\Windows\System\QBPcLxO.exe
  2⤵
  PID:9108
- C:\Windows\System\fVweNQY.exe
  C:\Windows\System\fVweNQY.exe
  2⤵
  PID:9060
- C:\Windows\System\TMwvncd.exe
  C:\Windows\System\TMwvncd.exe
  2⤵
  PID:8560
- C:\Windows\System\AdvSPBJ.exe
  C:\Windows\System\AdvSPBJ.exe
  2⤵
  PID:9228
- C:\Windows\System\IvfvOpF.exe
  C:\Windows\System\IvfvOpF.exe
  2⤵
  PID:9244
- C:\Windows\System\YCHEATc.exe
  C:\Windows\System\YCHEATc.exe
  2⤵
  PID:9260
- C:\Windows\System\HJEJhXL.exe
  C:\Windows\System\HJEJhXL.exe
  2⤵
  PID:9276
- C:\Windows\System\ZpPRDJW.exe
  C:\Windows\System\ZpPRDJW.exe
  2⤵
  PID:9296
- C:\Windows\System\MCxrQLc.exe
  C:\Windows\System\MCxrQLc.exe
  2⤵
  PID:9312
- C:\Windows\System\CIWJgAO.exe
  C:\Windows\System\CIWJgAO.exe
  2⤵
  PID:9328
- C:\Windows\System\KWYeQxM.exe
  C:\Windows\System\KWYeQxM.exe
  2⤵
  PID:9344
- C:\Windows\System\kpiacgx.exe
  C:\Windows\System\kpiacgx.exe
  2⤵
  PID:9368
- C:\Windows\System\qvKBLvk.exe
  C:\Windows\System\qvKBLvk.exe
  2⤵
  PID:9384
- C:\Windows\System\dyehUYM.exe
  C:\Windows\System\dyehUYM.exe
  2⤵
  PID:9400
- C:\Windows\System\kHJcmLP.exe
  C:\Windows\System\kHJcmLP.exe
  2⤵
  PID:9416
- C:\Windows\System\fLfjJye.exe
  C:\Windows\System\fLfjJye.exe
  2⤵
  PID:9432
- C:\Windows\System\ghvaKBM.exe
  C:\Windows\System\ghvaKBM.exe
  2⤵
  PID:9452
- C:\Windows\System\HxRqeGD.exe
  C:\Windows\System\HxRqeGD.exe
  2⤵
  PID:9468
- C:\Windows\System\rRwOjCG.exe
  C:\Windows\System\rRwOjCG.exe
  2⤵
  PID:9484
- C:\Windows\System\wkoXDuS.exe
  C:\Windows\System\wkoXDuS.exe
  2⤵
  PID:9500
- C:\Windows\System\juxiCdU.exe
  C:\Windows\System\juxiCdU.exe
  2⤵
  PID:9516
- C:\Windows\System\MbSkQMU.exe
  C:\Windows\System\MbSkQMU.exe
  2⤵
  PID:9532
- C:\Windows\System\mcHYZPm.exe
  C:\Windows\System\mcHYZPm.exe
  2⤵
  PID:9552
- C:\Windows\System\yupIdhk.exe
  C:\Windows\System\yupIdhk.exe
  2⤵
  PID:9568
- C:\Windows\System\lnTKFgs.exe
  C:\Windows\System\lnTKFgs.exe
  2⤵
  PID:9584
- C:\Windows\System\VkepOdv.exe
  C:\Windows\System\VkepOdv.exe
  2⤵
  PID:9600
- C:\Windows\System\TLOHXvF.exe
  C:\Windows\System\TLOHXvF.exe
  2⤵
  PID:9620
- C:\Windows\System\BGJhmhC.exe
  C:\Windows\System\BGJhmhC.exe
  2⤵
  PID:9636
- C:\Windows\System\Mnwsfbe.exe
  C:\Windows\System\Mnwsfbe.exe
  2⤵
  PID:9660
- C:\Windows\System\LrPYZYH.exe
  C:\Windows\System\LrPYZYH.exe
  2⤵
  PID:9676
- C:\Windows\System\rIiYrKi.exe
  C:\Windows\System\rIiYrKi.exe
  2⤵
  PID:9692
- C:\Windows\System\frdbabN.exe
  C:\Windows\System\frdbabN.exe
  2⤵
  PID:9708
- C:\Windows\System\KbyypdU.exe
  C:\Windows\System\KbyypdU.exe
  2⤵
  PID:9724
- C:\Windows\System\nSjyeIJ.exe
  C:\Windows\System\nSjyeIJ.exe
  2⤵
  PID:9744
- C:\Windows\System\mUwpewl.exe
  C:\Windows\System\mUwpewl.exe
  2⤵
  PID:9760
- C:\Windows\System\HMICYuh.exe
  C:\Windows\System\HMICYuh.exe
  2⤵
  PID:9776
- C:\Windows\System\JBCnARn.exe
  C:\Windows\System\JBCnARn.exe
  2⤵
  PID:9796
- C:\Windows\System\OcFjuZC.exe
  C:\Windows\System\OcFjuZC.exe
  2⤵
  PID:9812
- C:\Windows\System\EuWoFGV.exe
  C:\Windows\System\EuWoFGV.exe
  2⤵
  PID:9856
- C:\Windows\System\BdcQJTz.exe
  C:\Windows\System\BdcQJTz.exe
  2⤵
  PID:9872
- C:\Windows\System\dfLoLmi.exe
  C:\Windows\System\dfLoLmi.exe
  2⤵
  PID:9888
- C:\Windows\System\Krwloic.exe
  C:\Windows\System\Krwloic.exe
  2⤵
  PID:9904
- C:\Windows\System\yzEyvUU.exe
  C:\Windows\System\yzEyvUU.exe
  2⤵
  PID:9920
- C:\Windows\System\OduoUNh.exe
  C:\Windows\System\OduoUNh.exe
  2⤵
  PID:9936
- C:\Windows\System\RLEHsIg.exe
  C:\Windows\System\RLEHsIg.exe
  2⤵
  PID:9952
- C:\Windows\System\plSMBAR.exe
  C:\Windows\System\plSMBAR.exe
  2⤵
  PID:9968
- C:\Windows\System\jNLmgsQ.exe
  C:\Windows\System\jNLmgsQ.exe
  2⤵
  PID:9984
- C:\Windows\System\LkgoIzu.exe
  C:\Windows\System\LkgoIzu.exe
  2⤵
  PID:10000
- C:\Windows\System\fNzQiqi.exe
  C:\Windows\System\fNzQiqi.exe
  2⤵
  PID:10016
- C:\Windows\System\ZrIAgLq.exe
  C:\Windows\System\ZrIAgLq.exe
  2⤵
  PID:10032
- C:\Windows\System\aLGabPb.exe
  C:\Windows\System\aLGabPb.exe
  2⤵
  PID:10048
- C:\Windows\System\TlkZMYQ.exe
  C:\Windows\System\TlkZMYQ.exe
  2⤵
  PID:10064
- C:\Windows\System\mGLICAP.exe
  C:\Windows\System\mGLICAP.exe
  2⤵
  PID:10080
- C:\Windows\System\NbrwQTN.exe
  C:\Windows\System\NbrwQTN.exe
  2⤵
  PID:10096
- C:\Windows\System\rxxQJGS.exe
  C:\Windows\System\rxxQJGS.exe
  2⤵
  PID:10112
- C:\Windows\System\YaLztkO.exe
  C:\Windows\System\YaLztkO.exe
  2⤵
  PID:10128
- C:\Windows\System\VZUpSbP.exe
  C:\Windows\System\VZUpSbP.exe
  2⤵
  PID:10144
- C:\Windows\System\RyxxHNr.exe
  C:\Windows\System\RyxxHNr.exe
  2⤵
  PID:10160
- C:\Windows\System\jsoJmoi.exe
  C:\Windows\System\jsoJmoi.exe
  2⤵
  PID:10180
- C:\Windows\System\UkXWQrv.exe
  C:\Windows\System\UkXWQrv.exe
  2⤵
  PID:10196
- C:\Windows\System\rGEUJnX.exe
  C:\Windows\System\rGEUJnX.exe
  2⤵
  PID:10212
- C:\Windows\System\LvSSFcI.exe
  C:\Windows\System\LvSSFcI.exe
  2⤵
  PID:10228
- C:\Windows\System\bSgyrCi.exe
  C:\Windows\System\bSgyrCi.exe
  2⤵
  PID:8820
- C:\Windows\System\BECmxrn.exe
  C:\Windows\System\BECmxrn.exe
  2⤵
  PID:9240
- C:\Windows\System\LPVkYhb.exe
  C:\Windows\System\LPVkYhb.exe
  2⤵
  PID:8212
- C:\Windows\System\dYmloMb.exe
  C:\Windows\System\dYmloMb.exe
  2⤵
  PID:8272
- C:\Windows\System\FPbMPda.exe
  C:\Windows\System\FPbMPda.exe
  2⤵
  PID:9412
- C:\Windows\System\yYQoaOt.exe
  C:\Windows\System\yYQoaOt.exe
  2⤵
  PID:9288
- C:\Windows\System\TBwjPrV.exe
  C:\Windows\System\TBwjPrV.exe
  2⤵
  PID:9352
- C:\Windows\System\othSLbk.exe
  C:\Windows\System\othSLbk.exe
  2⤵
  PID:9392
- C:\Windows\System\UWfrkgB.exe
  C:\Windows\System\UWfrkgB.exe
  2⤵
  PID:9424
- C:\Windows\System\bgmApMd.exe
  C:\Windows\System\bgmApMd.exe
  2⤵
  PID:9460
- C:\Windows\System\AzDFTpi.exe
  C:\Windows\System\AzDFTpi.exe
  2⤵
  PID:9444
- C:\Windows\System\tHabQvO.exe
  C:\Windows\System\tHabQvO.exe
  2⤵
  PID:9512
- C:\Windows\System\IToSiPE.exe
  C:\Windows\System\IToSiPE.exe
  2⤵
  PID:9544
- C:\Windows\System\wiqBhle.exe
  C:\Windows\System\wiqBhle.exe
  2⤵
  PID:9596
- C:\Windows\System\iTvOEHu.exe
  C:\Windows\System\iTvOEHu.exe
  2⤵
  PID:9612
- C:\Windows\System\PoBFtDs.exe
  C:\Windows\System\PoBFtDs.exe
  2⤵
  PID:9700
- C:\Windows\System\AqpotOb.exe
  C:\Windows\System\AqpotOb.exe
  2⤵
  PID:9740
- C:\Windows\System\hxaHHMX.exe
  C:\Windows\System\hxaHHMX.exe
  2⤵
  PID:9804
- C:\Windows\System\ZVSzGqa.exe
  C:\Windows\System\ZVSzGqa.exe
  2⤵
  PID:9784
- C:\Windows\System\BtqEGtZ.exe
  C:\Windows\System\BtqEGtZ.exe
  2⤵
  PID:9688
- C:\Windows\System\kuGIHjj.exe
  C:\Windows\System\kuGIHjj.exe
  2⤵
  PID:9836
- C:\Windows\System\jQplfKj.exe
  C:\Windows\System\jQplfKj.exe
  2⤵
  PID:9840
- C:\Windows\System\wzKkchk.exe
  C:\Windows\System\wzKkchk.exe
  2⤵
  PID:9852
- C:\Windows\System\Tnphegn.exe
  C:\Windows\System\Tnphegn.exe
  2⤵
  PID:9928
- C:\Windows\System\hQDXmJx.exe
  C:\Windows\System\hQDXmJx.exe
  2⤵
  PID:9964
- C:\Windows\System\SdGeObw.exe
  C:\Windows\System\SdGeObw.exe
  2⤵
  PID:10028
- C:\Windows\System\VYjyIhV.exe
  C:\Windows\System\VYjyIhV.exe
  2⤵
  PID:9948
- C:\Windows\System\XOFtiCN.exe
  C:\Windows\System\XOFtiCN.exe
  2⤵
  PID:9916
- C:\Windows\System\kEHRgsM.exe
  C:\Windows\System\kEHRgsM.exe
  2⤵
  PID:9980
- C:\Windows\System\DZiJeXm.exe
  C:\Windows\System\DZiJeXm.exe
  2⤵
  PID:10104
- C:\Windows\System\SQGjjeS.exe
  C:\Windows\System\SQGjjeS.exe
  2⤵
  PID:10152
- C:\Windows\System\CCzZXKh.exe
  C:\Windows\System\CCzZXKh.exe
  2⤵
  PID:10220
- C:\Windows\System\oQuXMpT.exe
  C:\Windows\System\oQuXMpT.exe
  2⤵
  PID:10168
- C:\Windows\System\wwufwtc.exe
  C:\Windows\System\wwufwtc.exe
  2⤵
  PID:10172
- C:\Windows\System\WUZxhZC.exe
  C:\Windows\System\WUZxhZC.exe
  2⤵
  PID:9224
- C:\Windows\System\zUVsDzt.exe
  C:\Windows\System\zUVsDzt.exe
  2⤵
  PID:9304
- C:\Windows\System\kdblFEX.exe
  C:\Windows\System\kdblFEX.exe
  2⤵
  PID:9324
- C:\Windows\System\dMbVosY.exe
  C:\Windows\System\dMbVosY.exe
  2⤵
  PID:9480
- C:\Windows\System\ZUGtaKf.exe
  C:\Windows\System\ZUGtaKf.exe
  2⤵
  PID:9492
- C:\Windows\System\GTQyEie.exe
  C:\Windows\System\GTQyEie.exe
  2⤵
  PID:9576
- C:\Windows\System\rxexfzr.exe
  C:\Windows\System\rxexfzr.exe
  2⤵
  PID:9668
- C:\Windows\System\WrZLHvs.exe
  C:\Windows\System\WrZLHvs.exe
  2⤵
  PID:9736
- C:\Windows\System\ahnXfmH.exe
  C:\Windows\System\ahnXfmH.exe
  2⤵
  PID:9716
- C:\Windows\System\YfMgBDb.exe
  C:\Windows\System\YfMgBDb.exe
  2⤵
  PID:9828
- C:\Windows\System\TIxSFur.exe
  C:\Windows\System\TIxSFur.exe
  2⤵
  PID:9756
- C:\Windows\System\kgDGAmk.exe
  C:\Windows\System\kgDGAmk.exe
  2⤵
  PID:9848
- C:\Windows\System\YzynVsQ.exe
  C:\Windows\System\YzynVsQ.exe
  2⤵
  PID:10088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AAxXmVa.exe

Filesize
1.9MB

MD5
047eeca40be647a1dcf7e5f11f30823b

SHA1
85de487486a3874a21a9e10b86adf5e0b632ff6f

SHA256
03c1b2559cf1a78e599dcbd29333d6509e79c69ff183d02082981074f4f83cae

SHA512
93a200765e74fd031f4c02b11d03a86363419f166ce5b89f375d8ffa2d2b95b04c1cb47bc58a32688ddf30226079cb8a81d92dcc084806c1737913ad8f021b26

Download Submit
C:\Windows\system\BFONeej.exe

Filesize
1.9MB

MD5
fd67e7d3c58ce32468c1f90a65f9e9a5

SHA1
c13706ea6727c9d643fee9a94dc9ec4e2dd700f9

SHA256
5b28e6d0b3acf9aea1dec3911f83ede887a907d5c6dc321cd9d9d17d9d9eb916

SHA512
6e2ceb7b2a126428fbea5095daf08b8603c4a25affd17b4084bbea1282979e43841641f26d477869cd48d516238b28a439b3b4cc4c4e0c2232aa524b3824bb8d

Download Submit
C:\Windows\system\CRHhDTa.exe

Filesize
1.9MB

MD5
26102ee214e208742fa26398425f4191

SHA1
884d65353e856b538ab7bce02c0d8f7353798aa4

SHA256
345b43a9e0149e3751919cceb7d62bfaeaba7bec35cceae53229cd56d1f29c0a

SHA512
bb7936317292a2547adfc5635f9720d247270a2b62b11196ae3020d812b447b93d997b25b25340412fe82722b9314409ea65d7b4924b3420903e6959c179e08c

Download Submit
C:\Windows\system\CqdVBaP.exe

Filesize
1.9MB

MD5
95f4fe74bb51aab536a5c53d6752ba6c

SHA1
a992d8a754167ec507cb00e6a7d46d10a59ce89b

SHA256
ec5bcaa5021a4dbfaa5cc0bca4805c7331b77be4b25a3e6017fb2fe5dc5e2c6a

SHA512
476f118b6e4fa7cdd46b547d6e00a34d8748e1ea5b017fe1743992b09812f9c843920ffdfd4bba5d30922378a03f3ca8c8e5805c4f77287bc98fc06f4dd6beaa

Download Submit
C:\Windows\system\EnbLkmv.exe

Filesize
1.9MB

MD5
6f51f600ac2b5cb244a9c6ea0c1594f9

SHA1
0e400014c0c202c611d739c7be8612083f61895b

SHA256
be6b27ef5066b0658239eda129a6b85d21bf4f08730050613974899ee76e4f61

SHA512
16e86fb75922aaf31a09f66f2d3fb7dde4a07e9c41371d166f0ebf6f595298ad15c8cf6ed964e41de44364c20c9848b9cd8ffd880b7c1a17e82707599b6d5cf1

Download Submit
C:\Windows\system\HhUIGqI.exe

Filesize
1.9MB

MD5
6c732865293641123032f225f48ba5c1

SHA1
bba737f17f8a17439095124ae6afe357e0ac9559

SHA256
4bce2cb690391ce8bcc64a39ed78137e4ccd9ee931b1e30a81c73838fffa1416

SHA512
6b93495054c56d254b1ddf1694ae495d453593fa46712ccd99e3371f572ca19a4aeace0e32a083f020ad3109b8dc684f69f14374fbb0be18b9038e4312f85c8a

Download Submit
C:\Windows\system\HnWrAaq.exe

Filesize
1.9MB

MD5
7bcbea494b474b12fade573e9c60b9a8

SHA1
af0146094f5c3509ce59f06cf22b358c6c557ec4

SHA256
ca1c08d830ee73ef7342542cc9e4147503e45f3775d9cbc4dc4781ca37853cc6

SHA512
40a3eaa4d02b467f9c5374956d8c7d12af4b4f65c861ee0988182d49898f1e8caa7ef8217238067556d3ca348b5024e60fca608e9e15a286228126910e452c73

Download Submit
C:\Windows\system\JKoNyAE.exe

Filesize
1.9MB

MD5
482b5cb09f51b163eb1273411f205783

SHA1
607833f053dbfba9efff0d03be4596d873d08299

SHA256
2d511cb33918f6259ab6c4ee0d2155114d67d1ed06ef6e710e2ad7bf826cd46d

SHA512
c3a1b59a6d0d431f9eb2f8ed69579547f6c6540d84678931d743dfe7444bd9da965dbccaeb82e98a0fd8da03d478b2d63b96749bbfba2ead85579de869f5f0e9

Download Submit
C:\Windows\system\JMzuXrx.exe

Filesize
1.9MB

MD5
3737b4cbad9bd0a07f63c70fdd3bf060

SHA1
50bb1ce111111ca88d708c40efc9df31a1394cd3

SHA256
5f0c525dfdb4abc9924edc8fe4dfac08a3728541cb6a0a2641c186e0065a824b

SHA512
9829820e904dc70414eb12854bc57d6a0dc4edd68a24bf8378321ccb062ead21451bb1d4dc026154e636fad7ec89633d0c1066ae0a489b1f0fa8c27db6569563

Download Submit
C:\Windows\system\KjEfznI.exe

Filesize
1.9MB

MD5
ff8abbeede0f10013141911260666b15

SHA1
814e5d94c06b40be1f0305b7a2c146ed57ceb2f9

SHA256
c960967c8ddbb372e209956de589b2190f411a2edbfdbde866a967a4fd5556e9

SHA512
80fea8f833436925a7fd3f3b39e4618410453d6c4093bb3211c7738ae56c9da4bee6d4fe3808cf8be47d043cf5045061a0edcce4a1676d0700a1950011a6252a

Download Submit
C:\Windows\system\LePsolB.exe

Filesize
1.9MB

MD5
15b8467e0e7ee57373143e55ddd74f57

SHA1
ce2c8b658a0bc6a074da0c871a6f617d87d02b77

SHA256
3eee1781e4e77b78f99d6e5673b9278ae3e071da6bd382cd88d97b281aef7c6b

SHA512
0dd79c918251f48251552b8e5533b2317bb4ddd5fa5f94c84b8fddad45da6107f3b94ecfb113ddd6cd4f5de5ff82446eeabae8bdf21d431837be53db7fd77ad2

Download Submit
C:\Windows\system\QIBYRkz.exe

Filesize
1.9MB

MD5
d0b7138399a5a237f783667b1336a15f

SHA1
935badd2f54c63f6844ecbad09dbf4cffcffdf0b

SHA256
807b471ad60179c1a2469bfe0632083db0f4d1b73c5c11d94fd4a95afe220544

SHA512
e457c2b08e1194816a0d42a33bd2b4734e35e019405b78b5f60222b5124c37e51d3c5663ad8c21ba8d7e2acabc50efaf0a559918e932adb2a3786680e3f15bbb

Download Submit
C:\Windows\system\RHpyGwn.exe

Filesize
1.9MB

MD5
8b73e22262c1649d2ddfb6fa7a18cf13

SHA1
5cc417bad653314e519d1d6b4ee10a1ffed513ce

SHA256
11f323685d0c8ea2a2c3fdc0d90461fb254e5369625f0a09847484da7a557999

SHA512
3c4b1fb2435798d29827c4274b57c01ce301e88958c80dfbce733376cf161665c85573413a42d70215a583218113a2b98e0bf558d311f22fd399ff7d7ff06d1c

Download Submit
C:\Windows\system\RzRkAlX.exe

Filesize
1.9MB

MD5
04c1d2f3555c84190b5269f086ca61b4

SHA1
65308b947f2b9153deb7f9c0b3272e4e37502ff2

SHA256
cf0a53be71195c72f4fced2f5942fd2766e0bf0e48bdc504c01f4d3ef751412d

SHA512
f2f72bb15090775dc154c6e8ecb87ebc70f680eadbb172d9c320a5319a5f38101ea287b178f0af8437c1f7e936d4219c4c6904cf5b696d9db2f735175ff6882c

Download Submit
C:\Windows\system\dYvbjES.exe

Filesize
1.9MB

MD5
52cbcdee91a4276398a71234e5895c50

SHA1
cc3e27d28b72c63bfcf9cc27d180f442f01371d6

SHA256
31b7c42a4c9f7ce7ec21fe4ea6d7264573bea1fda0649a67a21dca469d741108

SHA512
6ccc258821d56a900cb6fe306d07dd5f472b91e01e646c5897a0d955342b74b5c288ce5b96cda92997e671870cb5b7c5f39d0ee3c6b2636c6f94d63036ec835a

Download Submit
C:\Windows\system\lFwITIR.exe

Filesize
1.9MB

MD5
467486f278f4ef6cdbac9c1157003ea9

SHA1
6a20c0605ffb5368f94282161c6c7c62638acd52

SHA256
3e2427ee17fa225118225f15f72c978982fdb2297bc14802d4a6809b84e3ea4d

SHA512
2c4928ff17e87e61cf43b9d9cb3ab324cf5e22401cf8100833c8282b127a07698c327acbdf277aae8a099001b12cc4d685d6093f67fa3b291cc59bdf848b6581

Download Submit
C:\Windows\system\mJVVAcx.exe

Filesize
1.9MB

MD5
334861e865f9ddab96a9ccd0fd6e64a7

SHA1
280e185b704471f020eee28c8e9365615fe213d0

SHA256
99d9a53303c7242cb06f621c5899492ffbf8eef7d4a84b6941fc2c502c5d303c

SHA512
11291e58d6760346a55ec7e0a1dc7a05fc9b3f997cf322eef2a33be375ebb53991b414e582f427abd0b1eed53be82a22c63c214c895fcd49716de4a33eb7cf39

Download Submit
C:\Windows\system\rsFQLJa.exe

Filesize
1.9MB

MD5
177b1a2ebcdfd2eff3149d911da05d0e

SHA1
c354a0d9d801c3e326d16c72556b67a2db87b3cf

SHA256
d7976e4f15ff2a77f4ca05bcd63d3ba7a5e1a2cfb5055bf25a083848f74f9e80

SHA512
14d0c33c7fcaabd5b8435f8cfc97e3a12eae738fb22ab533121d60310571ab11031ee8cbe15dbdbe97d53b1eeebc2052dd1c00597224a285d885a8b71f9d7f9d

Download Submit
C:\Windows\system\twqyEVJ.exe

Filesize
1.9MB

MD5
2e7921f36e0ab2b61dd53433d3f260b5

SHA1
c0767c6b20079fe3cc67394bd5c31939b9472192

SHA256
596ee354b9673b924747b75ad31a7cc72846f2bef7c8522d0b550af6d988408c

SHA512
4ee3127762324177054391ee452b805edcb3ccf03bee2d078226737cce14ac45603da3f591aab53ec51160d4a339e5fdf67f4992d3f0085358d2d15ded0dfa44

Download Submit
C:\Windows\system\ynKQaLh.exe

Filesize
1.9MB

MD5
c7c62a4e908a81c765cfc6136baa0c13

SHA1
3357ba83f90fee6028f00b48eb3c531f7cde8aef

SHA256
66837c009f7429cacbc092fbac89127b06482700798204a4556048639b11e7d5

SHA512
b9e7736e6c8952b52d2c4b70e137b45c7c3a7d88eb2223f366b678a3826750f4b202e895844ebbbb3cfe8a7d582e7d66f9e3a45c4ca2f721114ad65e36d0dfa0

Download Submit
C:\Windows\system\zbdMWwu.exe

Filesize
1.9MB

MD5
eb99b372f82613939a5b45d04c12b3bf

SHA1
9c2859ecdd88e94e35665047730595576d311938

SHA256
e77086075ba17df2a904bfca3f22498efcb3b4f1f0427bf4bbd54287f6235023

SHA512
6d27c61cd893a37229016258704d9e079932af00bd25cd4d230ce520bc8366db68cf517aef300ba093a1d9603424af49cae6be495f61aa2d7bd4f9d35e2443df

Download Submit
\Windows\system\AVPCsAE.exe

Filesize
1.9MB

MD5
d859bdca6da38eb171dc9e415b3ef82b

SHA1
30e408ceb3c4a67ab352b6c2f51a26e68df939e4

SHA256
f31033438627f4cf4846aeb4d7dd533686f1985ab063914d8ca19211fed87a3d

SHA512
e662cd6d80c62b862168cb9370545722434f5b98a51d7ac40ed3d502ff4ea877e16c79512d53b8fb074705cb04ca2c99abe5a28d8256110b433fd05de229e7a5

Download Submit
\Windows\system\FBvurpH.exe

Filesize
1.9MB

MD5
2ea221daef79deea4f6bdcc19cb02d3a

SHA1
6920a02bee6faab34b761e7f94da888ee3c09d1d

SHA256
c47e41c7bdbe422896f18795989d932badd114fa1c9e3545b012ebb67eebc4a5

SHA512
655f90caa364ac4768dc0ddd17bc69117218389f3626f5b44c3cec098978147e3f98eeff11afe5d03b7e5a673374ec0b284de0d2783619ea5efba2d4fe69be20

Download Submit
\Windows\system\GCugdRY.exe

Filesize
1.9MB

MD5
b945c7b187c32c64220bf89ce880dd4f

SHA1
74ef6188bd788194c16836cd33fd9befb79dd2e5

SHA256
d6ab02b632e8fe008123ff9d91de5ff7af178ba0c69debd65e38eceef195d945

SHA512
55b3a07496ea62f17394d186faec5ca0aaf6673cd520db58e7c4b247ef4b2eff31d9a8e11c96767584188bc6b72e82a600dd8be34aa9b3fb4ba31788a16da966

Download Submit
\Windows\system\HKVrOZJ.exe

Filesize
1.9MB

MD5
4840db788a3d6326ee2604996be5be05

SHA1
1f81db666dc6aba9e3f09017f51ed7681d78b649

SHA256
cbb2008ec9c31e714ed7cd271cc40407eaad997184a92f80123077c12f252f02

SHA512
61c090e18d781757998b22a526a5fb03b22f43eae5b81d75ea418135cb905290667ae7fbc79187b1c2bbbe7c09522a933ce2f6c462dbba3d26a437122f7ddf69

Download Submit
\Windows\system\IThBymD.exe

Filesize
1.9MB

MD5
19d8615e82ae631736471445ae8f4ef5

SHA1
d491a6ed27769627a2535e9dcdf5f54b699ada87

SHA256
a2b66129ef90f6bde3948e813cfa705dbb73dd8dbd5d6ae1de8a60e94cbfc94d

SHA512
5c4d2408c2045b062250547d23c6af95591993e5af0071d9c120ecdc83792510d19b4d8368a7476068de0605bef1e053fd60154e8d17ea3711ffc204bb81c9cb

Download Submit
\Windows\system\Loabnlw.exe

Filesize
1.9MB

MD5
625b29233a49b49167b425a604e48fed

SHA1
e60e91d46461607d093f54ffbed60b74d148ccfd

SHA256
10f4347d24a95c813e35cdbd205cdc596e004891e4262d88e4511c20a0d1780d

SHA512
e0621a57dee9e7e7931b24c8809cd0e4d971d9ca3c59d285954f3ee3087a30959e9d5f3fbc234910824b311367e8817e157fc514782e1f596e7bd511f2f0e93a

Download Submit
\Windows\system\MNaZaeG.exe

Filesize
1.9MB

MD5
cfe428eebfd45bc342dc31e9fd6050a0

SHA1
003051bdec635a2d21e69a5d32df8cd2edad9177

SHA256
144848588bcf56c01b781d3986444880382fbf886e89bc69b45d15c2d01e1ea3

SHA512
9fffa5cd573598b6d9ce6ed387b12d30e5d487274cf89436a9f865ec59c45f7b6bd41ced5629e2ff0933f4e4049379d01130f81fbe0c910fa78946cace083433

Download Submit
\Windows\system\OyuxbtB.exe

Filesize
1.9MB

MD5
80ec4a4d08a21a8e57a596f8b9eacab9

SHA1
6a41b4d4f25af3f5068883a97ad80bf8d5abfbcc

SHA256
87cfe8ae3a183315a117a5df62b5995fae055dc37cb8dd08a0a91dc3d244803f

SHA512
df9fb08dbca26f65124d2612b59af6d7542de50680ea346d4aee2b8f5c839308f557427ae0f6bf4975ad768a3f09383b2c6849457924316839a6b1ee618471e9

Download Submit
\Windows\system\PuqYIWz.exe

Filesize
1.9MB

MD5
7f6a1311f06fb90a0401fb3a231a4ec0

SHA1
d7e8a55be613153dafd4c5034a3450cd4fb13e53

SHA256
576a10b1774f5a0a9b96a05e9a1b329e3f446a2e127bcdbb99c5cdc4d8cea6e7

SHA512
50f77ecc17d4f7aeed0c8203758116ab44271a7aadcc9dab1a30a5661d47ce464b03af8178011e07c9cc08e723568d224bac45dc8e45348ba6ceb1105c67dbaf

Download Submit
\Windows\system\QoEIGJN.exe

Filesize
1.9MB

MD5
1a11a0f2dcb8dc066d68d9c98f7277eb

SHA1
bc7e5760ef8d8d7b4521f3e922f2d69a40c756f2

SHA256
4b98898e7eae5623631d192a04f8f9aee00a2cadfcdeb78cfb5d8ccc758bb02b

SHA512
f0000267a7430fae5259e3abd4f280e937966ec902d9cd0755f5b89046dd90774286d14241a5b19bcd53fabc64c76e78036f128c5f0c5fa1f53192ce3ba24bcc

Download Submit
\Windows\system\QubzLYx.exe

Filesize
1.9MB

MD5
289298d4d0b97274f17a655e0120bb92

SHA1
fe70246bfd75832f346985b155fb324e3eadd6db

SHA256
adf83c3d6f5a1ee48d7f2ee79479ebf9c7436b7a03e1adaf5503828a85b655ac

SHA512
d6d7259dda0740a8305eb7c90a42f0939e388dcad1d324ed2f2e54b31b6a28654d92d36ebb2fb65cccc8837e522f38f4ec23b90ae7177dcee1eba2966ab4fc8c

Download Submit
\Windows\system\TlEJLAF.exe

Filesize
1.9MB

MD5
01d3b11429ac462b03690bc90de0d562

SHA1
795756351b8d4db3948cd7160a53e4c7ce00fac7

SHA256
0cf47f8e06091ca51a18fcfd57114cb015a925e502358d4fa74c92d72252f32d

SHA512
c2dbf1e67e3d8732cf5ed1a7f9e43008c04cb7a6e4012c6cc62452100173bd07b34e566653aa76db49e3d61c3aa8925c2e614b3c9aca981ec003c2dd0c38f49d

Download Submit
\Windows\system\XLoQoaU.exe

Filesize
1.9MB

MD5
87dea1f0a19fcce0a7ffd02135753e1b

SHA1
e1d1bf7288f365355d0d8cfab644c61fb8bcc240

SHA256
5a1d5672e1ecad62d1c2b2847196f6c9564e86e1ce3d8609470de18de5da77bd

SHA512
98c5a5146107dc199019f70280d1480ba61711863fda082ce99c6b1569a1c48975193bb2c9a6d06977bb16e6b6440fd18aabdf6cadc709a5e4be7ba971da8c2c

Download Submit
\Windows\system\XolcIfB.exe

Filesize
1.9MB

MD5
818aa901f55d88fceb2c14d02e9afe20

SHA1
bff40e289e612c53e1b8dbdd240e6b53b3c2cc4b

SHA256
2c7f938decba5a04dd7f0ddc396d76c642d2f01cedffc5e77ec9f0c8a4ffd5e3

SHA512
b3c1afd08d934dbedafc7286f55e9a8321f61aed8db14cc4f4b46d577812d1e47fc583d86d665e1cb0d8bafa1d266ea9e70b24305e030a4336bb4b6005659c75

Download Submit
\Windows\system\aJVqiUR.exe

Filesize
1.9MB

MD5
08ec08936af82814f5ac3e9eefaabd59

SHA1
78185e0a99d4813b57900aae9b8fc8e7bc399615

SHA256
2b17384d58819285c71681ddb4279641e6299d9c21346abadcd4bb986b12eb43

SHA512
cd7ce10e9374a392c4dee7c924fbb3c8741320b167fd0e864aa6ca0a91cae7537bd0aa895b581e097d9b18ee62ae0442b231bd9b587bc0f1d252502f31380739

Download Submit
\Windows\system\eZqLTDY.exe

Filesize
1.9MB

MD5
f57dfb8253fa7a06140faea304ee2a0a

SHA1
7f8cd987c2748c6e98d62794c7b689ac64356f7f

SHA256
a190ccba84d5af3e940341acf466fa6ed7cdb57c158ba576295d1a809018bfc4

SHA512
870547e4d036356dd7f98ab3a96fe74db8a3544483c7e04e983c3897b9d27ba95b1063313bc2b6eb27afe2715e485905ac4b3f3f22ccbc42b09b5278731f5cf6

Download Submit
\Windows\system\jYRlRfE.exe

Filesize
1.9MB

MD5
c1e9bdec1fe21d3de6ad82dd896621a4

SHA1
11da0732d3190c9fd497f1051ffe9188c217d8de

SHA256
7d991b3213bcbb7a28fd102e5d50cfae9250e4a6fe8849f80cc6d2b99ea1087f

SHA512
23e30bf8698ca0771f18beb023a916aed140694bd8f9f16de1da600dc6dc599714233129e278e1ff7f1e429f7567dad1af759e1dd571529338ff895ef2720708

Download Submit
\Windows\system\jYsSdju.exe

Filesize
1.9MB

MD5
302ad018f9ca4ba27182fdf0b8d06e42

SHA1
9220c1bee6d486a4d69427006775973e5c407515

SHA256
6146bea659d77452f431b8c3a15b0b56a3d5fe6f59c06e6a265112cc07399040

SHA512
ed52c54ea0d842998759e0f5f9de028065817b5b1cecd64bb57618fb0bd671d23605ed414e079b7f31e1ead887230c5e64576cb340b5f8e2283bee170adc385f

Download Submit
\Windows\system\rFjBxoF.exe

Filesize
1.9MB

MD5
27b6852d58061aa73e61c12181b241cc

SHA1
997331a3de2f3e162ce590cce7a3d1ed49c891b7

SHA256
f4a583c6a8e9d6d508a420baa445eec00e70be29a93c2b6df7f431cace99d5e2

SHA512
83ec50862d931de3948b5429146f150d8f70790fa78367f65e9ec86fed5d61537c28837e09ce9b0d4431c5e59b184dba85eb698347d1bf817c42c9a879aa483c

Download Submit
\Windows\system\xBtgInv.exe

Filesize
1.9MB

MD5
f33d1f4be6416639bac40d303d3a3d9d

SHA1
e541fb5ce26dc1bbfbd04f77e06c2aa12d2f2d1c

SHA256
4b8118c488f14c69d65bc8b642f7c5fc3925683888d081e6d6318b3a797af876

SHA512
4254e452df1da0c65de107ca09e4f16d95b0a757cb9e7f9b051ceaabe5aaa60bc9395b5c199cd96345671d06a5e13e17348df664d1a2ed668b62d88c8adc7db0

Download Submit
memory/532-5298-0x000000013F950000-0x000000013FD42000-memory.dmp

Filesize
3.9MB

Download
memory/532-101-0x000000013F950000-0x000000013FD42000-memory.dmp

Filesize
3.9MB

Download
memory/1840-195-0x0000000002F10000-0x0000000003302000-memory.dmp

Filesize
3.9MB

Download
memory/1840-198-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/1840-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/1840-169-0x000000013F520000-0x000000013F912000-memory.dmp

Filesize
3.9MB

Download
memory/1840-168-0x0000000002F10000-0x0000000003302000-memory.dmp

Filesize
3.9MB

Download
memory/1840-167-0x000000013F370000-0x000000013F762000-memory.dmp

Filesize
3.9MB

Download
memory/1840-185-0x0000000002F10000-0x0000000003302000-memory.dmp

Filesize
3.9MB

Download
memory/1840-186-0x0000000002F10000-0x0000000003302000-memory.dmp

Filesize
3.9MB

Download
memory/1840-11229-0x000000013FE10000-0x0000000140202000-memory.dmp

Filesize
3.9MB

Download
memory/1840-196-0x000000013F120000-0x000000013F512000-memory.dmp

Filesize
3.9MB

Download
memory/1840-0-0x000000013FE10000-0x0000000140202000-memory.dmp

Filesize
3.9MB

Download
memory/1840-199-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/1840-28-0x000000013F090000-0x000000013F482000-memory.dmp

Filesize
3.9MB

Download
memory/1840-197-0x0000000002F10000-0x0000000003302000-memory.dmp

Filesize
3.9MB

Download
memory/1840-12447-0x000000013F370000-0x000000013F762000-memory.dmp

Filesize
3.9MB

Download
memory/1840-194-0x000000013F520000-0x000000013F912000-memory.dmp

Filesize
3.9MB

Download
memory/1840-176-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/2408-193-0x000000013FF90000-0x0000000140382000-memory.dmp

Filesize
3.9MB

Download
memory/2408-5280-0x000000013FF90000-0x0000000140382000-memory.dmp

Filesize
3.9MB

Download
memory/2440-229-0x0000000002350000-0x0000000002358000-memory.dmp

Filesize
32KB

Download
memory/2440-222-0x000000001B800000-0x000000001BAE2000-memory.dmp

Filesize
2.9MB

Download
memory/2460-89-0x000000013F090000-0x000000013F482000-memory.dmp

Filesize
3.9MB

Download
memory/2460-5302-0x000000013F090000-0x000000013F482000-memory.dmp

Filesize
3.9MB

Download
memory/2620-188-0x000000013F370000-0x000000013F762000-memory.dmp

Filesize
3.9MB

Download
memory/2620-5256-0x000000013F370000-0x000000013F762000-memory.dmp

Filesize
3.9MB

Download
memory/2676-190-0x000000013F520000-0x000000013F912000-memory.dmp

Filesize
3.9MB

Download
memory/2676-5325-0x000000013F520000-0x000000013F912000-memory.dmp

Filesize
3.9MB

Download
memory/2680-5346-0x000000013F6E0000-0x000000013FAD2000-memory.dmp

Filesize
3.9MB

Download
memory/2680-191-0x000000013F6E0000-0x000000013FAD2000-memory.dmp

Filesize
3.9MB

Download
memory/2772-5336-0x000000013F270000-0x000000013F662000-memory.dmp

Filesize
3.9MB

Download
memory/2772-192-0x000000013F270000-0x000000013F662000-memory.dmp

Filesize
3.9MB

Download