xmrig | 85e187327343cd0e3a6ccd36dcc6ceba6b0d48b7348f287975d007bd5c4b5932

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
24-08-2024 10:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a935878da87905106d019ada57c5a290N.exe
Size

1.5MB
MD5

a935878da87905106d019ada57c5a290
SHA1

3ec31bdc537754436285676626bfe25c490d6ce2
SHA256

85e187327343cd0e3a6ccd36dcc6ceba6b0d48b7348f287975d007bd5c4b5932
SHA512

76f8820b7140848903de1de111e3a562c27ab4a2edc0666ea17d19c908b13d8ab627a23c085cea12cd0858f0028181ee240024470b6c697e6e5b8c51246d9df9
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZrV5GgCzxcMfS0GcLMwWVV:Lz071uv4BPMkyW10/w16BWgac2xGvV

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 24 IoCs

miner

resource	yara_rule
behavioral1/memory/2752-13-0x000000013F650000-0x000000013FA42000-memory.dmp	xmrig
behavioral1/memory/2676-30-0x000000013FC50000-0x0000000140042000-memory.dmp	xmrig
behavioral1/memory/2584-34-0x000000013FFA0000-0x0000000140392000-memory.dmp	xmrig
behavioral1/memory/2836-41-0x000000013FA80000-0x000000013FE72000-memory.dmp	xmrig
behavioral1/memory/2620-49-0x000000013FE90000-0x0000000140282000-memory.dmp	xmrig
behavioral1/memory/2740-61-0x000000013FC40000-0x0000000140032000-memory.dmp	xmrig
behavioral1/memory/700-97-0x000000013FF40000-0x0000000140332000-memory.dmp	xmrig
behavioral1/memory/2860-96-0x000000013F040000-0x000000013F432000-memory.dmp	xmrig
behavioral1/memory/2428-106-0x000000013F250000-0x000000013F642000-memory.dmp	xmrig
behavioral1/memory/1984-350-0x000000013F860000-0x000000013FC52000-memory.dmp	xmrig
behavioral1/memory/2740-349-0x0000000003300000-0x00000000036F2000-memory.dmp	xmrig
behavioral1/memory/2868-487-0x000000013F960000-0x000000013FD52000-memory.dmp	xmrig
behavioral1/memory/2192-104-0x000000013F2A0000-0x000000013F692000-memory.dmp	xmrig
behavioral1/memory/2836-81-0x000000013FA80000-0x000000013FE72000-memory.dmp	xmrig
behavioral1/memory/2616-66-0x000000013FA80000-0x000000013FE72000-memory.dmp	xmrig
behavioral1/memory/2740-65-0x0000000003300000-0x00000000036F2000-memory.dmp	xmrig
behavioral1/memory/2740-1556-0x000000013F250000-0x000000013F642000-memory.dmp	xmrig
behavioral1/memory/2752-4491-0x000000013F650000-0x000000013FA42000-memory.dmp	xmrig
behavioral1/memory/2676-4494-0x000000013FC50000-0x0000000140042000-memory.dmp	xmrig
behavioral1/memory/2584-4528-0x000000013FFA0000-0x0000000140392000-memory.dmp	xmrig
behavioral1/memory/2620-4584-0x000000013FE90000-0x0000000140282000-memory.dmp	xmrig
behavioral1/memory/2860-4679-0x000000013F040000-0x000000013F432000-memory.dmp	xmrig
behavioral1/memory/2836-4725-0x000000013FA80000-0x000000013FE72000-memory.dmp	xmrig
behavioral1/memory/2428-5003-0x000000013F250000-0x000000013F642000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1688	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2752	VZrSJpO.exe
2676	MNQmIwF.exe
2584	mOpWpVe.exe
2836	tBNlDZh.exe
2620	zegdvtb.exe
2192	mdjsZkQ.exe
2616	BuwLRTs.exe
1984	KcCBenz.exe
2868	bGxeTWP.exe
2860	mzTSFaT.exe
700	XzjybwT.exe
2428	HHvixYN.exe
2000	SwNNycI.exe
2368	Yiesxas.exe
552	CQWPTpL.exe
2264	DJaudLG.exe
2072	GMFvfDR.exe
3064	NNTHCaP.exe
1860	FjPBbOG.exe
2376	rqskmgz.exe
2220	vqlTfoT.exe
444	VIqLwHO.exe
944	MCxRzCS.exe
1280	zbmwbBn.exe
1248	pGdRkCV.exe
896	gARSRiy.exe
2500	exSVeEw.exe
1524	RiqJVHV.exe
844	gvgdhCu.exe
2224	DIRxuBy.exe
1996	JDTBzIF.exe
2392	aNEEIRE.exe
980	UHjaYMP.exe
2064	yoBjthj.exe
1292	bjGrNXu.exe
2968	fiCzHYr.exe
2332	hVmmWDo.exe
560	TBYqZgh.exe
2484	mOKVSSD.exe
2912	dVakWKO.exe
1032	FNUXWeS.exe
2124	mlyjbhS.exe
888	KnOeqsQ.exe
1084	jNVkYKR.exe
2204	yfXVpPu.exe
1592	nFziYPp.exe
1588	hvuNdtJ.exe
2800	uqucTqA.exe
2712	iaZlhXp.exe
2708	iIMkLQP.exe
340	SBQkByI.exe
2680	nMxFisd.exe
2820	nImuRYO.exe
3016	ihLTWQd.exe
348	vMTYifo.exe
2564	FZNnnUw.exe
1468	rqewlfF.exe
2660	YQmQHsB.exe
2624	LenNODO.exe
1016	dZdMVXq.exe
776	CPxZnxm.exe
2600	wymjtBS.exe
1952	ZXCooJa.exe
1888	jMJAiKf.exe

Loads dropped DLL 64 IoCs

pid	Process
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe
2740	a935878da87905106d019ada57c5a290N.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2740-0-0x000000013FC40000-0x0000000140032000-memory.dmp	upx
behavioral1/files/0x000a00000001225e-7.dat	upx
behavioral1/memory/2752-13-0x000000013F650000-0x000000013FA42000-memory.dmp	upx
behavioral1/files/0x0007000000004e74-18.dat	upx
behavioral1/files/0x000700000001945c-17.dat	upx
behavioral1/memory/2676-30-0x000000013FC50000-0x0000000140042000-memory.dmp	upx
behavioral1/memory/2584-34-0x000000013FFA0000-0x0000000140392000-memory.dmp	upx
behavioral1/files/0x000600000001948d-35.dat	upx
behavioral1/memory/2836-41-0x000000013FA80000-0x000000013FE72000-memory.dmp	upx
behavioral1/memory/2620-49-0x000000013FE90000-0x0000000140282000-memory.dmp	upx
behavioral1/memory/2740-61-0x000000013FC40000-0x0000000140032000-memory.dmp	upx
behavioral1/files/0x000900000001958b-52.dat	upx
behavioral1/files/0x001700000001937b-60.dat	upx
behavioral1/files/0x00060000000194e2-45.dat	upx
behavioral1/files/0x0007000000019931-68.dat	upx
behavioral1/memory/1984-74-0x000000013F860000-0x000000013FC52000-memory.dmp	upx
behavioral1/memory/700-97-0x000000013FF40000-0x0000000140332000-memory.dmp	upx
behavioral1/files/0x000500000001a470-83.dat	upx
behavioral1/memory/2860-96-0x000000013F040000-0x000000013F432000-memory.dmp	upx
behavioral1/files/0x000500000001a472-90.dat	upx
behavioral1/files/0x000500000001a478-101.dat	upx
behavioral1/memory/2428-106-0x000000013F250000-0x000000013F642000-memory.dmp	upx
behavioral1/files/0x000500000001a481-120.dat	upx
behavioral1/files/0x000500000001a483-124.dat	upx
behavioral1/files/0x000500000001a485-130.dat	upx
behavioral1/files/0x000500000001a489-140.dat	upx
behavioral1/files/0x000500000001a48b-144.dat	upx
behavioral1/files/0x000500000001a491-160.dat	upx
behavioral1/files/0x000500000001a4a4-205.dat	upx
behavioral1/memory/1984-350-0x000000013F860000-0x000000013FC52000-memory.dmp	upx
behavioral1/files/0x000500000001a4a0-195.dat	upx
behavioral1/files/0x000500000001a4a2-198.dat	upx
behavioral1/files/0x000500000001a49b-184.dat	upx
behavioral1/files/0x000500000001a49e-189.dat	upx
behavioral1/files/0x000500000001a499-180.dat	upx
behavioral1/files/0x000500000001a497-174.dat	upx
behavioral1/files/0x000500000001a495-170.dat	upx
behavioral1/files/0x000500000001a493-164.dat	upx
behavioral1/files/0x000500000001a48f-154.dat	upx
behavioral1/files/0x000500000001a48d-150.dat	upx
behavioral1/memory/2868-487-0x000000013F960000-0x000000013FD52000-memory.dmp	upx
behavioral1/files/0x000500000001a487-134.dat	upx
behavioral1/files/0x000500000001a47f-114.dat	upx
behavioral1/files/0x000500000001a47c-110.dat	upx
behavioral1/memory/2192-104-0x000000013F2A0000-0x000000013F692000-memory.dmp	upx
behavioral1/memory/2836-81-0x000000013FA80000-0x000000013FE72000-memory.dmp	upx
behavioral1/memory/2868-80-0x000000013F960000-0x000000013FD52000-memory.dmp	upx
behavioral1/files/0x000500000001a46d-77.dat	upx
behavioral1/memory/2192-54-0x000000013F2A0000-0x000000013F692000-memory.dmp	upx
behavioral1/memory/2616-66-0x000000013FA80000-0x000000013FE72000-memory.dmp	upx
behavioral1/memory/2752-4491-0x000000013F650000-0x000000013FA42000-memory.dmp	upx
behavioral1/memory/2676-4494-0x000000013FC50000-0x0000000140042000-memory.dmp	upx
behavioral1/memory/2584-4528-0x000000013FFA0000-0x0000000140392000-memory.dmp	upx
behavioral1/memory/2620-4584-0x000000013FE90000-0x0000000140282000-memory.dmp	upx
behavioral1/memory/2860-4679-0x000000013F040000-0x000000013F432000-memory.dmp	upx
behavioral1/memory/2836-4725-0x000000013FA80000-0x000000013FE72000-memory.dmp	upx
behavioral1/memory/2428-5003-0x000000013F250000-0x000000013F642000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\gBaHKaM.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\OGKjpyR.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\TrvqbDR.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\QybRPli.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\SMbFpFK.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\JbqOPfM.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\aYvQmbf.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\VZQpmCE.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\zNZewsw.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\MGXFvkx.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\QBGSYJS.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\DIRxuBy.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\puIEayL.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\udJexZo.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\wdpqWSc.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\ZVfMPkX.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\GaVwYqW.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\kChYRVx.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\zZUbmAp.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\vhjdRcd.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\KKDAQuH.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\cLdURWZ.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\UjqBudr.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\RMswkKD.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\hPFQdgi.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\FLZDHeZ.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\LfmDmOk.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\aniZroV.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\GVtatHD.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\NLDKfcR.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\ObiXjwq.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\rVczQIQ.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\MLOjQcc.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\hnhZiPh.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\ZHkFYxn.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\JxwKeqd.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\xHsdztE.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\hzdysdq.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\MoOYbit.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\nJJrpre.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\FcIZcRR.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\GmhlHDW.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\gmozJKe.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\GSbfWNu.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\gDLkHJf.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\hkxdNnB.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\loJNNXL.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\NYwAkrj.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\qZfmChl.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\HzZOLYn.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\NKrYibN.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\heoMQQw.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\CHjmHXw.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\rMXiNAD.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\rVKMQCO.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\ktrijeg.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\OpWPzQU.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\UBmrQcy.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\hgpaOBv.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\zzcfToZ.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\JFsuqUQ.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\aVArPht.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\KaTujiC.exe	a935878da87905106d019ada57c5a290N.exe
File created	C:\Windows\System\LYTjdom.exe	a935878da87905106d019ada57c5a290N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1688	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2740	a935878da87905106d019ada57c5a290N.exe
Token: SeLockMemoryPrivilege	2740	a935878da87905106d019ada57c5a290N.exe
Token: SeDebugPrivilege	1688	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 1688	2740	a935878da87905106d019ada57c5a290N.exe	31
PID 2740 wrote to memory of 1688	2740	a935878da87905106d019ada57c5a290N.exe	31
PID 2740 wrote to memory of 1688	2740	a935878da87905106d019ada57c5a290N.exe	31
PID 2740 wrote to memory of 2752	2740	a935878da87905106d019ada57c5a290N.exe	32
PID 2740 wrote to memory of 2752	2740	a935878da87905106d019ada57c5a290N.exe	32
PID 2740 wrote to memory of 2752	2740	a935878da87905106d019ada57c5a290N.exe	32
PID 2740 wrote to memory of 2676	2740	a935878da87905106d019ada57c5a290N.exe	33
PID 2740 wrote to memory of 2676	2740	a935878da87905106d019ada57c5a290N.exe	33
PID 2740 wrote to memory of 2676	2740	a935878da87905106d019ada57c5a290N.exe	33
PID 2740 wrote to memory of 2584	2740	a935878da87905106d019ada57c5a290N.exe	34
PID 2740 wrote to memory of 2584	2740	a935878da87905106d019ada57c5a290N.exe	34
PID 2740 wrote to memory of 2584	2740	a935878da87905106d019ada57c5a290N.exe	34
PID 2740 wrote to memory of 2836	2740	a935878da87905106d019ada57c5a290N.exe	35
PID 2740 wrote to memory of 2836	2740	a935878da87905106d019ada57c5a290N.exe	35
PID 2740 wrote to memory of 2836	2740	a935878da87905106d019ada57c5a290N.exe	35
PID 2740 wrote to memory of 2620	2740	a935878da87905106d019ada57c5a290N.exe	36
PID 2740 wrote to memory of 2620	2740	a935878da87905106d019ada57c5a290N.exe	36
PID 2740 wrote to memory of 2620	2740	a935878da87905106d019ada57c5a290N.exe	36
PID 2740 wrote to memory of 2192	2740	a935878da87905106d019ada57c5a290N.exe	37
PID 2740 wrote to memory of 2192	2740	a935878da87905106d019ada57c5a290N.exe	37
PID 2740 wrote to memory of 2192	2740	a935878da87905106d019ada57c5a290N.exe	37
PID 2740 wrote to memory of 2616	2740	a935878da87905106d019ada57c5a290N.exe	38
PID 2740 wrote to memory of 2616	2740	a935878da87905106d019ada57c5a290N.exe	38
PID 2740 wrote to memory of 2616	2740	a935878da87905106d019ada57c5a290N.exe	38
PID 2740 wrote to memory of 1984	2740	a935878da87905106d019ada57c5a290N.exe	39
PID 2740 wrote to memory of 1984	2740	a935878da87905106d019ada57c5a290N.exe	39
PID 2740 wrote to memory of 1984	2740	a935878da87905106d019ada57c5a290N.exe	39
PID 2740 wrote to memory of 2868	2740	a935878da87905106d019ada57c5a290N.exe	40
PID 2740 wrote to memory of 2868	2740	a935878da87905106d019ada57c5a290N.exe	40
PID 2740 wrote to memory of 2868	2740	a935878da87905106d019ada57c5a290N.exe	40
PID 2740 wrote to memory of 700	2740	a935878da87905106d019ada57c5a290N.exe	41
PID 2740 wrote to memory of 700	2740	a935878da87905106d019ada57c5a290N.exe	41
PID 2740 wrote to memory of 700	2740	a935878da87905106d019ada57c5a290N.exe	41
PID 2740 wrote to memory of 2860	2740	a935878da87905106d019ada57c5a290N.exe	42
PID 2740 wrote to memory of 2860	2740	a935878da87905106d019ada57c5a290N.exe	42
PID 2740 wrote to memory of 2860	2740	a935878da87905106d019ada57c5a290N.exe	42
PID 2740 wrote to memory of 2428	2740	a935878da87905106d019ada57c5a290N.exe	43
PID 2740 wrote to memory of 2428	2740	a935878da87905106d019ada57c5a290N.exe	43
PID 2740 wrote to memory of 2428	2740	a935878da87905106d019ada57c5a290N.exe	43
PID 2740 wrote to memory of 2000	2740	a935878da87905106d019ada57c5a290N.exe	44
PID 2740 wrote to memory of 2000	2740	a935878da87905106d019ada57c5a290N.exe	44
PID 2740 wrote to memory of 2000	2740	a935878da87905106d019ada57c5a290N.exe	44
PID 2740 wrote to memory of 2368	2740	a935878da87905106d019ada57c5a290N.exe	45
PID 2740 wrote to memory of 2368	2740	a935878da87905106d019ada57c5a290N.exe	45
PID 2740 wrote to memory of 2368	2740	a935878da87905106d019ada57c5a290N.exe	45
PID 2740 wrote to memory of 552	2740	a935878da87905106d019ada57c5a290N.exe	46
PID 2740 wrote to memory of 552	2740	a935878da87905106d019ada57c5a290N.exe	46
PID 2740 wrote to memory of 552	2740	a935878da87905106d019ada57c5a290N.exe	46
PID 2740 wrote to memory of 2264	2740	a935878da87905106d019ada57c5a290N.exe	47
PID 2740 wrote to memory of 2264	2740	a935878da87905106d019ada57c5a290N.exe	47
PID 2740 wrote to memory of 2264	2740	a935878da87905106d019ada57c5a290N.exe	47
PID 2740 wrote to memory of 2072	2740	a935878da87905106d019ada57c5a290N.exe	48
PID 2740 wrote to memory of 2072	2740	a935878da87905106d019ada57c5a290N.exe	48
PID 2740 wrote to memory of 2072	2740	a935878da87905106d019ada57c5a290N.exe	48
PID 2740 wrote to memory of 3064	2740	a935878da87905106d019ada57c5a290N.exe	49
PID 2740 wrote to memory of 3064	2740	a935878da87905106d019ada57c5a290N.exe	49
PID 2740 wrote to memory of 3064	2740	a935878da87905106d019ada57c5a290N.exe	49
PID 2740 wrote to memory of 1860	2740	a935878da87905106d019ada57c5a290N.exe	50
PID 2740 wrote to memory of 1860	2740	a935878da87905106d019ada57c5a290N.exe	50
PID 2740 wrote to memory of 1860	2740	a935878da87905106d019ada57c5a290N.exe	50
PID 2740 wrote to memory of 2376	2740	a935878da87905106d019ada57c5a290N.exe	51
PID 2740 wrote to memory of 2376	2740	a935878da87905106d019ada57c5a290N.exe	51
PID 2740 wrote to memory of 2376	2740	a935878da87905106d019ada57c5a290N.exe	51
PID 2740 wrote to memory of 2220	2740	a935878da87905106d019ada57c5a290N.exe	52

C:\Users\Admin\AppData\Local\Temp\a935878da87905106d019ada57c5a290N.exe
"C:\Users\Admin\AppData\Local\Temp\a935878da87905106d019ada57c5a290N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1688
- C:\Windows\System\VZrSJpO.exe
  C:\Windows\System\VZrSJpO.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\MNQmIwF.exe
  C:\Windows\System\MNQmIwF.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\mOpWpVe.exe
  C:\Windows\System\mOpWpVe.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\tBNlDZh.exe
  C:\Windows\System\tBNlDZh.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\zegdvtb.exe
  C:\Windows\System\zegdvtb.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\mdjsZkQ.exe
  C:\Windows\System\mdjsZkQ.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\BuwLRTs.exe
  C:\Windows\System\BuwLRTs.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\KcCBenz.exe
  C:\Windows\System\KcCBenz.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\bGxeTWP.exe
  C:\Windows\System\bGxeTWP.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\XzjybwT.exe
  C:\Windows\System\XzjybwT.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\mzTSFaT.exe
  C:\Windows\System\mzTSFaT.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\HHvixYN.exe
  C:\Windows\System\HHvixYN.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\SwNNycI.exe
  C:\Windows\System\SwNNycI.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\Yiesxas.exe
  C:\Windows\System\Yiesxas.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\CQWPTpL.exe
  C:\Windows\System\CQWPTpL.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\DJaudLG.exe
  C:\Windows\System\DJaudLG.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\GMFvfDR.exe
  C:\Windows\System\GMFvfDR.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\NNTHCaP.exe
  C:\Windows\System\NNTHCaP.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\FjPBbOG.exe
  C:\Windows\System\FjPBbOG.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\rqskmgz.exe
  C:\Windows\System\rqskmgz.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\vqlTfoT.exe
  C:\Windows\System\vqlTfoT.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\VIqLwHO.exe
  C:\Windows\System\VIqLwHO.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\MCxRzCS.exe
  C:\Windows\System\MCxRzCS.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\zbmwbBn.exe
  C:\Windows\System\zbmwbBn.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\pGdRkCV.exe
  C:\Windows\System\pGdRkCV.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\gARSRiy.exe
  C:\Windows\System\gARSRiy.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\exSVeEw.exe
  C:\Windows\System\exSVeEw.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\RiqJVHV.exe
  C:\Windows\System\RiqJVHV.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\gvgdhCu.exe
  C:\Windows\System\gvgdhCu.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\DIRxuBy.exe
  C:\Windows\System\DIRxuBy.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\JDTBzIF.exe
  C:\Windows\System\JDTBzIF.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\aNEEIRE.exe
  C:\Windows\System\aNEEIRE.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\UHjaYMP.exe
  C:\Windows\System\UHjaYMP.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\yoBjthj.exe
  C:\Windows\System\yoBjthj.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\bjGrNXu.exe
  C:\Windows\System\bjGrNXu.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\fiCzHYr.exe
  C:\Windows\System\fiCzHYr.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\hVmmWDo.exe
  C:\Windows\System\hVmmWDo.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\TBYqZgh.exe
  C:\Windows\System\TBYqZgh.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\mOKVSSD.exe
  C:\Windows\System\mOKVSSD.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\dVakWKO.exe
  C:\Windows\System\dVakWKO.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\FNUXWeS.exe
  C:\Windows\System\FNUXWeS.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\mlyjbhS.exe
  C:\Windows\System\mlyjbhS.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\KnOeqsQ.exe
  C:\Windows\System\KnOeqsQ.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\jNVkYKR.exe
  C:\Windows\System\jNVkYKR.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\yfXVpPu.exe
  C:\Windows\System\yfXVpPu.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\nFziYPp.exe
  C:\Windows\System\nFziYPp.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\hvuNdtJ.exe
  C:\Windows\System\hvuNdtJ.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\uqucTqA.exe
  C:\Windows\System\uqucTqA.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\iaZlhXp.exe
  C:\Windows\System\iaZlhXp.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\iIMkLQP.exe
  C:\Windows\System\iIMkLQP.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\SBQkByI.exe
  C:\Windows\System\SBQkByI.exe
  2⤵
  - Executes dropped EXE
  PID:340
- C:\Windows\System\nMxFisd.exe
  C:\Windows\System\nMxFisd.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\nImuRYO.exe
  C:\Windows\System\nImuRYO.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\ihLTWQd.exe
  C:\Windows\System\ihLTWQd.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\vMTYifo.exe
  C:\Windows\System\vMTYifo.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\FZNnnUw.exe
  C:\Windows\System\FZNnnUw.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\rqewlfF.exe
  C:\Windows\System\rqewlfF.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\YQmQHsB.exe
  C:\Windows\System\YQmQHsB.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\LenNODO.exe
  C:\Windows\System\LenNODO.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\dZdMVXq.exe
  C:\Windows\System\dZdMVXq.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\CPxZnxm.exe
  C:\Windows\System\CPxZnxm.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\wymjtBS.exe
  C:\Windows\System\wymjtBS.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\ZXCooJa.exe
  C:\Windows\System\ZXCooJa.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\jMJAiKf.exe
  C:\Windows\System\jMJAiKf.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\aFjahWL.exe
  C:\Windows\System\aFjahWL.exe
  2⤵
  PID:628
- C:\Windows\System\uQiVytW.exe
  C:\Windows\System\uQiVytW.exe
  2⤵
  PID:408
- C:\Windows\System\KZqNSHC.exe
  C:\Windows\System\KZqNSHC.exe
  2⤵
  PID:1640
- C:\Windows\System\ZguGNiI.exe
  C:\Windows\System\ZguGNiI.exe
  2⤵
  PID:1508
- C:\Windows\System\UGCDPbW.exe
  C:\Windows\System\UGCDPbW.exe
  2⤵
  PID:2872
- C:\Windows\System\yXNmfbk.exe
  C:\Windows\System\yXNmfbk.exe
  2⤵
  PID:316
- C:\Windows\System\ZHzYvdH.exe
  C:\Windows\System\ZHzYvdH.exe
  2⤵
  PID:1964
- C:\Windows\System\AqTPkWc.exe
  C:\Windows\System\AqTPkWc.exe
  2⤵
  PID:1080
- C:\Windows\System\kjciMkn.exe
  C:\Windows\System\kjciMkn.exe
  2⤵
  PID:768
- C:\Windows\System\zGlLBye.exe
  C:\Windows\System\zGlLBye.exe
  2⤵
  PID:2060
- C:\Windows\System\HMrBAjV.exe
  C:\Windows\System\HMrBAjV.exe
  2⤵
  PID:2832
- C:\Windows\System\mPxQTWn.exe
  C:\Windows\System\mPxQTWn.exe
  2⤵
  PID:2464
- C:\Windows\System\TwUGEXM.exe
  C:\Windows\System\TwUGEXM.exe
  2⤵
  PID:2364
- C:\Windows\System\bSYZrXS.exe
  C:\Windows\System\bSYZrXS.exe
  2⤵
  PID:300
- C:\Windows\System\piEiclw.exe
  C:\Windows\System\piEiclw.exe
  2⤵
  PID:1264
- C:\Windows\System\tikxDhv.exe
  C:\Windows\System\tikxDhv.exe
  2⤵
  PID:2980
- C:\Windows\System\rHipOjx.exe
  C:\Windows\System\rHipOjx.exe
  2⤵
  PID:3032
- C:\Windows\System\OXkYDiO.exe
  C:\Windows\System\OXkYDiO.exe
  2⤵
  PID:2996
- C:\Windows\System\mrpBAya.exe
  C:\Windows\System\mrpBAya.exe
  2⤵
  PID:1608
- C:\Windows\System\oWEgVdj.exe
  C:\Windows\System\oWEgVdj.exe
  2⤵
  PID:2644
- C:\Windows\System\KslbMIn.exe
  C:\Windows\System\KslbMIn.exe
  2⤵
  PID:2896
- C:\Windows\System\dEpGthF.exe
  C:\Windows\System\dEpGthF.exe
  2⤵
  PID:1736
- C:\Windows\System\Sqygpnl.exe
  C:\Windows\System\Sqygpnl.exe
  2⤵
  PID:2136
- C:\Windows\System\xcKbHmi.exe
  C:\Windows\System\xcKbHmi.exe
  2⤵
  PID:2804
- C:\Windows\System\byrDawm.exe
  C:\Windows\System\byrDawm.exe
  2⤵
  PID:1660
- C:\Windows\System\AcnGNsU.exe
  C:\Windows\System\AcnGNsU.exe
  2⤵
  PID:3012
- C:\Windows\System\fdGAstW.exe
  C:\Windows\System\fdGAstW.exe
  2⤵
  PID:1300
- C:\Windows\System\mWZhDZK.exe
  C:\Windows\System\mWZhDZK.exe
  2⤵
  PID:536
- C:\Windows\System\QzrMQBw.exe
  C:\Windows\System\QzrMQBw.exe
  2⤵
  PID:2288
- C:\Windows\System\PcBwxWk.exe
  C:\Windows\System\PcBwxWk.exe
  2⤵
  PID:2988
- C:\Windows\System\JItVHLN.exe
  C:\Windows\System\JItVHLN.exe
  2⤵
  PID:1472
- C:\Windows\System\JQgkPdC.exe
  C:\Windows\System\JQgkPdC.exe
  2⤵
  PID:2080
- C:\Windows\System\PqyPNGx.exe
  C:\Windows\System\PqyPNGx.exe
  2⤵
  PID:2112
- C:\Windows\System\AjMYBzd.exe
  C:\Windows\System\AjMYBzd.exe
  2⤵
  PID:836
- C:\Windows\System\XRkFfmr.exe
  C:\Windows\System\XRkFfmr.exe
  2⤵
  PID:1780
- C:\Windows\System\SMbFpFK.exe
  C:\Windows\System\SMbFpFK.exe
  2⤵
  PID:1672
- C:\Windows\System\YDOdpEX.exe
  C:\Windows\System\YDOdpEX.exe
  2⤵
  PID:2144
- C:\Windows\System\Giahnvh.exe
  C:\Windows\System\Giahnvh.exe
  2⤵
  PID:1868
- C:\Windows\System\DcPqxBd.exe
  C:\Windows\System\DcPqxBd.exe
  2⤵
  PID:2424
- C:\Windows\System\ojsUpBk.exe
  C:\Windows\System\ojsUpBk.exe
  2⤵
  PID:2876
- C:\Windows\System\XexKOlY.exe
  C:\Windows\System\XexKOlY.exe
  2⤵
  PID:1872
- C:\Windows\System\vKeUYFd.exe
  C:\Windows\System\vKeUYFd.exe
  2⤵
  PID:1676
- C:\Windows\System\cVxhFsK.exe
  C:\Windows\System\cVxhFsK.exe
  2⤵
  PID:1696
- C:\Windows\System\LqwQgSl.exe
  C:\Windows\System\LqwQgSl.exe
  2⤵
  PID:2128
- C:\Windows\System\eXHUfWs.exe
  C:\Windows\System\eXHUfWs.exe
  2⤵
  PID:1380
- C:\Windows\System\PaKpZPe.exe
  C:\Windows\System\PaKpZPe.exe
  2⤵
  PID:1140
- C:\Windows\System\OUfVGdj.exe
  C:\Windows\System\OUfVGdj.exe
  2⤵
  PID:2964
- C:\Windows\System\mGmstnk.exe
  C:\Windows\System\mGmstnk.exe
  2⤵
  PID:1056
- C:\Windows\System\usIgQTW.exe
  C:\Windows\System\usIgQTW.exe
  2⤵
  PID:1580
- C:\Windows\System\nCCnFRY.exe
  C:\Windows\System\nCCnFRY.exe
  2⤵
  PID:2716
- C:\Windows\System\LsGmCDO.exe
  C:\Windows\System\LsGmCDO.exe
  2⤵
  PID:1720
- C:\Windows\System\IPBSNOd.exe
  C:\Windows\System\IPBSNOd.exe
  2⤵
  PID:2736
- C:\Windows\System\MrImtXl.exe
  C:\Windows\System\MrImtXl.exe
  2⤵
  PID:3048
- C:\Windows\System\qYKAcxd.exe
  C:\Windows\System\qYKAcxd.exe
  2⤵
  PID:1620
- C:\Windows\System\KhqDGXm.exe
  C:\Windows\System\KhqDGXm.exe
  2⤵
  PID:1884
- C:\Windows\System\viupIHc.exe
  C:\Windows\System\viupIHc.exe
  2⤵
  PID:2440
- C:\Windows\System\aKBeAiY.exe
  C:\Windows\System\aKBeAiY.exe
  2⤵
  PID:2280
- C:\Windows\System\xZOQuRL.exe
  C:\Windows\System\xZOQuRL.exe
  2⤵
  PID:692
- C:\Windows\System\GgZIHTj.exe
  C:\Windows\System\GgZIHTj.exe
  2⤵
  PID:324
- C:\Windows\System\nShcNGy.exe
  C:\Windows\System\nShcNGy.exe
  2⤵
  PID:1160
- C:\Windows\System\yCgSLIV.exe
  C:\Windows\System\yCgSLIV.exe
  2⤵
  PID:2452
- C:\Windows\System\qmnBWNv.exe
  C:\Windows\System\qmnBWNv.exe
  2⤵
  PID:2416
- C:\Windows\System\EvkWkUK.exe
  C:\Windows\System\EvkWkUK.exe
  2⤵
  PID:1012
- C:\Windows\System\YRoIMCw.exe
  C:\Windows\System\YRoIMCw.exe
  2⤵
  PID:1816
- C:\Windows\System\hnhZiPh.exe
  C:\Windows\System\hnhZiPh.exe
  2⤵
  PID:1308
- C:\Windows\System\MHBgnTO.exe
  C:\Windows\System\MHBgnTO.exe
  2⤵
  PID:2764
- C:\Windows\System\WbgmBQh.exe
  C:\Windows\System\WbgmBQh.exe
  2⤵
  PID:2516
- C:\Windows\System\eZPRPGj.exe
  C:\Windows\System\eZPRPGj.exe
  2⤵
  PID:3036
- C:\Windows\System\hFwneyA.exe
  C:\Windows\System\hFwneyA.exe
  2⤵
  PID:1980
- C:\Windows\System\QOvOaFZ.exe
  C:\Windows\System\QOvOaFZ.exe
  2⤵
  PID:616
- C:\Windows\System\EtRfZfr.exe
  C:\Windows\System\EtRfZfr.exe
  2⤵
  PID:2704
- C:\Windows\System\XEttBOX.exe
  C:\Windows\System\XEttBOX.exe
  2⤵
  PID:1476
- C:\Windows\System\WUHMyph.exe
  C:\Windows\System\WUHMyph.exe
  2⤵
  PID:2696
- C:\Windows\System\qVDgowl.exe
  C:\Windows\System\qVDgowl.exe
  2⤵
  PID:2588
- C:\Windows\System\LHwVhGP.exe
  C:\Windows\System\LHwVhGP.exe
  2⤵
  PID:2816
- C:\Windows\System\HyZAmYJ.exe
  C:\Windows\System\HyZAmYJ.exe
  2⤵
  PID:1288
- C:\Windows\System\MgcrrMo.exe
  C:\Windows\System\MgcrrMo.exe
  2⤵
  PID:2300
- C:\Windows\System\opZvSNm.exe
  C:\Windows\System\opZvSNm.exe
  2⤵
  PID:2724
- C:\Windows\System\OWkjdMx.exe
  C:\Windows\System\OWkjdMx.exe
  2⤵
  PID:2576
- C:\Windows\System\CgcJURX.exe
  C:\Windows\System\CgcJURX.exe
  2⤵
  PID:948
- C:\Windows\System\bsdtmvu.exe
  C:\Windows\System\bsdtmvu.exe
  2⤵
  PID:2292
- C:\Windows\System\rVDmVMM.exe
  C:\Windows\System\rVDmVMM.exe
  2⤵
  PID:2512
- C:\Windows\System\oOQmvUh.exe
  C:\Windows\System\oOQmvUh.exe
  2⤵
  PID:1760
- C:\Windows\System\RrQTwuY.exe
  C:\Windows\System\RrQTwuY.exe
  2⤵
  PID:2372
- C:\Windows\System\RBGMXWa.exe
  C:\Windows\System\RBGMXWa.exe
  2⤵
  PID:1188
- C:\Windows\System\gucALGl.exe
  C:\Windows\System\gucALGl.exe
  2⤵
  PID:2312
- C:\Windows\System\PTqHaZm.exe
  C:\Windows\System\PTqHaZm.exe
  2⤵
  PID:2908
- C:\Windows\System\uFUYVOP.exe
  C:\Windows\System\uFUYVOP.exe
  2⤵
  PID:2744
- C:\Windows\System\kjjgQtf.exe
  C:\Windows\System\kjjgQtf.exe
  2⤵
  PID:1732
- C:\Windows\System\PLiejTG.exe
  C:\Windows\System\PLiejTG.exe
  2⤵
  PID:1344
- C:\Windows\System\Ahsissm.exe
  C:\Windows\System\Ahsissm.exe
  2⤵
  PID:2120
- C:\Windows\System\kcXIyHt.exe
  C:\Windows\System\kcXIyHt.exe
  2⤵
  PID:2768
- C:\Windows\System\oKigRIB.exe
  C:\Windows\System\oKigRIB.exe
  2⤵
  PID:2604
- C:\Windows\System\WdflIgY.exe
  C:\Windows\System\WdflIgY.exe
  2⤵
  PID:3088
- C:\Windows\System\SPaMLKO.exe
  C:\Windows\System\SPaMLKO.exe
  2⤵
  PID:3104
- C:\Windows\System\AUaJQAu.exe
  C:\Windows\System\AUaJQAu.exe
  2⤵
  PID:3120
- C:\Windows\System\tDATVeP.exe
  C:\Windows\System\tDATVeP.exe
  2⤵
  PID:3136
- C:\Windows\System\mdkWnWD.exe
  C:\Windows\System\mdkWnWD.exe
  2⤵
  PID:3152
- C:\Windows\System\DrWEwAI.exe
  C:\Windows\System\DrWEwAI.exe
  2⤵
  PID:3172
- C:\Windows\System\inHiTUK.exe
  C:\Windows\System\inHiTUK.exe
  2⤵
  PID:3188
- C:\Windows\System\HcXtKid.exe
  C:\Windows\System\HcXtKid.exe
  2⤵
  PID:3204
- C:\Windows\System\vEDLahD.exe
  C:\Windows\System\vEDLahD.exe
  2⤵
  PID:3220
- C:\Windows\System\fvXBlhX.exe
  C:\Windows\System\fvXBlhX.exe
  2⤵
  PID:3240
- C:\Windows\System\WEbZDmh.exe
  C:\Windows\System\WEbZDmh.exe
  2⤵
  PID:3256
- C:\Windows\System\TRmkmws.exe
  C:\Windows\System\TRmkmws.exe
  2⤵
  PID:3392
- C:\Windows\System\hPkKyTD.exe
  C:\Windows\System\hPkKyTD.exe
  2⤵
  PID:3412
- C:\Windows\System\HHIlxFr.exe
  C:\Windows\System\HHIlxFr.exe
  2⤵
  PID:3428
- C:\Windows\System\FaqMxWW.exe
  C:\Windows\System\FaqMxWW.exe
  2⤵
  PID:3452
- C:\Windows\System\XvIcvTl.exe
  C:\Windows\System\XvIcvTl.exe
  2⤵
  PID:3468
- C:\Windows\System\ipdTuGU.exe
  C:\Windows\System\ipdTuGU.exe
  2⤵
  PID:3492
- C:\Windows\System\mPfDfgp.exe
  C:\Windows\System\mPfDfgp.exe
  2⤵
  PID:3512
- C:\Windows\System\hJwQcWc.exe
  C:\Windows\System\hJwQcWc.exe
  2⤵
  PID:3532
- C:\Windows\System\BDvxsjP.exe
  C:\Windows\System\BDvxsjP.exe
  2⤵
  PID:3556
- C:\Windows\System\wHFzAYv.exe
  C:\Windows\System\wHFzAYv.exe
  2⤵
  PID:3576
- C:\Windows\System\UjqBudr.exe
  C:\Windows\System\UjqBudr.exe
  2⤵
  PID:3592
- C:\Windows\System\nLMjDKa.exe
  C:\Windows\System\nLMjDKa.exe
  2⤵
  PID:3616
- C:\Windows\System\tiPLTck.exe
  C:\Windows\System\tiPLTck.exe
  2⤵
  PID:3632
- C:\Windows\System\vsEDlme.exe
  C:\Windows\System\vsEDlme.exe
  2⤵
  PID:3656
- C:\Windows\System\UPYYmiZ.exe
  C:\Windows\System\UPYYmiZ.exe
  2⤵
  PID:3672
- C:\Windows\System\EGQsvTv.exe
  C:\Windows\System\EGQsvTv.exe
  2⤵
  PID:3696
- C:\Windows\System\UMkagFc.exe
  C:\Windows\System\UMkagFc.exe
  2⤵
  PID:3712
- C:\Windows\System\DhUNLPk.exe
  C:\Windows\System\DhUNLPk.exe
  2⤵
  PID:3732
- C:\Windows\System\JtJLCZf.exe
  C:\Windows\System\JtJLCZf.exe
  2⤵
  PID:3756
- C:\Windows\System\yctCOmr.exe
  C:\Windows\System\yctCOmr.exe
  2⤵
  PID:3776
- C:\Windows\System\NJIIJhA.exe
  C:\Windows\System\NJIIJhA.exe
  2⤵
  PID:3792
- C:\Windows\System\NtfSPIO.exe
  C:\Windows\System\NtfSPIO.exe
  2⤵
  PID:3816
- C:\Windows\System\EEguweY.exe
  C:\Windows\System\EEguweY.exe
  2⤵
  PID:3832
- C:\Windows\System\WbkFYjg.exe
  C:\Windows\System\WbkFYjg.exe
  2⤵
  PID:3856
- C:\Windows\System\CHjmHXw.exe
  C:\Windows\System\CHjmHXw.exe
  2⤵
  PID:3872
- C:\Windows\System\iWatjPR.exe
  C:\Windows\System\iWatjPR.exe
  2⤵
  PID:3896
- C:\Windows\System\yZXLfWc.exe
  C:\Windows\System\yZXLfWc.exe
  2⤵
  PID:3916
- C:\Windows\System\KDfztxU.exe
  C:\Windows\System\KDfztxU.exe
  2⤵
  PID:3936
- C:\Windows\System\CMEfCnh.exe
  C:\Windows\System\CMEfCnh.exe
  2⤵
  PID:3952
- C:\Windows\System\VPMJAnP.exe
  C:\Windows\System\VPMJAnP.exe
  2⤵
  PID:3976
- C:\Windows\System\dNfGucd.exe
  C:\Windows\System\dNfGucd.exe
  2⤵
  PID:3992
- C:\Windows\System\mBRgLXS.exe
  C:\Windows\System\mBRgLXS.exe
  2⤵
  PID:4016
- C:\Windows\System\bUFBkmD.exe
  C:\Windows\System\bUFBkmD.exe
  2⤵
  PID:4032
- C:\Windows\System\yYjmGhr.exe
  C:\Windows\System\yYjmGhr.exe
  2⤵
  PID:4056
- C:\Windows\System\YHKlJNL.exe
  C:\Windows\System\YHKlJNL.exe
  2⤵
  PID:4072
- C:\Windows\System\mWVbBls.exe
  C:\Windows\System\mWVbBls.exe
  2⤵
  PID:2272
- C:\Windows\System\VIKGoOe.exe
  C:\Windows\System\VIKGoOe.exe
  2⤵
  PID:1372
- C:\Windows\System\TVZFNmy.exe
  C:\Windows\System\TVZFNmy.exe
  2⤵
  PID:3212
- C:\Windows\System\BMUTGwM.exe
  C:\Windows\System\BMUTGwM.exe
  2⤵
  PID:1496
- C:\Windows\System\DZodSWG.exe
  C:\Windows\System\DZodSWG.exe
  2⤵
  PID:1912
- C:\Windows\System\gKscySB.exe
  C:\Windows\System\gKscySB.exe
  2⤵
  PID:2904
- C:\Windows\System\ZSXEqzB.exe
  C:\Windows\System\ZSXEqzB.exe
  2⤵
  PID:3100
- C:\Windows\System\FlxTYXj.exe
  C:\Windows\System\FlxTYXj.exe
  2⤵
  PID:1804
- C:\Windows\System\furBTWa.exe
  C:\Windows\System\furBTWa.exe
  2⤵
  PID:3148
- C:\Windows\System\YCDNgxU.exe
  C:\Windows\System\YCDNgxU.exe
  2⤵
  PID:3236
- C:\Windows\System\dVqxkeO.exe
  C:\Windows\System\dVqxkeO.exe
  2⤵
  PID:2156
- C:\Windows\System\ViVoMac.exe
  C:\Windows\System\ViVoMac.exe
  2⤵
  PID:3168
- C:\Windows\System\odPtVTM.exe
  C:\Windows\System\odPtVTM.exe
  2⤵
  PID:3164
- C:\Windows\System\GSbfWNu.exe
  C:\Windows\System\GSbfWNu.exe
  2⤵
  PID:3280
- C:\Windows\System\HhLsDsy.exe
  C:\Windows\System\HhLsDsy.exe
  2⤵
  PID:3300
- C:\Windows\System\RteqeRd.exe
  C:\Windows\System\RteqeRd.exe
  2⤵
  PID:3320
- C:\Windows\System\dHIOdgl.exe
  C:\Windows\System\dHIOdgl.exe
  2⤵
  PID:3340
- C:\Windows\System\HwjsIGS.exe
  C:\Windows\System\HwjsIGS.exe
  2⤵
  PID:3372
- C:\Windows\System\HBReLlV.exe
  C:\Windows\System\HBReLlV.exe
  2⤵
  PID:3268
- C:\Windows\System\FDyhPIo.exe
  C:\Windows\System\FDyhPIo.exe
  2⤵
  PID:3420
- C:\Windows\System\oTAWoHO.exe
  C:\Windows\System\oTAWoHO.exe
  2⤵
  PID:3440
- C:\Windows\System\dFyGaLX.exe
  C:\Windows\System\dFyGaLX.exe
  2⤵
  PID:3480
- C:\Windows\System\hgdQTDD.exe
  C:\Windows\System\hgdQTDD.exe
  2⤵
  PID:3528
- C:\Windows\System\PUCrOiI.exe
  C:\Windows\System\PUCrOiI.exe
  2⤵
  PID:3544
- C:\Windows\System\xVHZJMz.exe
  C:\Windows\System\xVHZJMz.exe
  2⤵
  PID:3608
- C:\Windows\System\OFZVyaC.exe
  C:\Windows\System\OFZVyaC.exe
  2⤵
  PID:3624
- C:\Windows\System\KEQbIGS.exe
  C:\Windows\System\KEQbIGS.exe
  2⤵
  PID:3664
- C:\Windows\System\ZzOCtrH.exe
  C:\Windows\System\ZzOCtrH.exe
  2⤵
  PID:3692
- C:\Windows\System\NqbiGdK.exe
  C:\Windows\System\NqbiGdK.exe
  2⤵
  PID:3724
- C:\Windows\System\FRxEKud.exe
  C:\Windows\System\FRxEKud.exe
  2⤵
  PID:3744
- C:\Windows\System\ejmUfqs.exe
  C:\Windows\System\ejmUfqs.exe
  2⤵
  PID:3788
- C:\Windows\System\CsJOYsf.exe
  C:\Windows\System\CsJOYsf.exe
  2⤵
  PID:3824
- C:\Windows\System\KmvSaVA.exe
  C:\Windows\System\KmvSaVA.exe
  2⤵
  PID:3864
- C:\Windows\System\sHSNaeR.exe
  C:\Windows\System\sHSNaeR.exe
  2⤵
  PID:3892
- C:\Windows\System\yeKAPJP.exe
  C:\Windows\System\yeKAPJP.exe
  2⤵
  PID:3924
- C:\Windows\System\EYKlxfo.exe
  C:\Windows\System\EYKlxfo.exe
  2⤵
  PID:3960
- C:\Windows\System\lsrUWWO.exe
  C:\Windows\System\lsrUWWO.exe
  2⤵
  PID:4000
- C:\Windows\System\VkFiMeG.exe
  C:\Windows\System\VkFiMeG.exe
  2⤵
  PID:4024
- C:\Windows\System\qJREycZ.exe
  C:\Windows\System\qJREycZ.exe
  2⤵
  PID:4044
- C:\Windows\System\CiDMUNL.exe
  C:\Windows\System\CiDMUNL.exe
  2⤵
  PID:4092
- C:\Windows\System\wljJzXl.exe
  C:\Windows\System\wljJzXl.exe
  2⤵
  PID:1492
- C:\Windows\System\ndLJDGK.exe
  C:\Windows\System\ndLJDGK.exe
  2⤵
  PID:2244
- C:\Windows\System\reBNLLo.exe
  C:\Windows\System\reBNLLo.exe
  2⤵
  PID:2420
- C:\Windows\System\HHcJGxt.exe
  C:\Windows\System\HHcJGxt.exe
  2⤵
  PID:608
- C:\Windows\System\eWDvIxB.exe
  C:\Windows\System\eWDvIxB.exe
  2⤵
  PID:928
- C:\Windows\System\fYVBErN.exe
  C:\Windows\System\fYVBErN.exe
  2⤵
  PID:3116
- C:\Windows\System\cqCWjzc.exe
  C:\Windows\System\cqCWjzc.exe
  2⤵
  PID:3248
- C:\Windows\System\oveXvkS.exe
  C:\Windows\System\oveXvkS.exe
  2⤵
  PID:1540
- C:\Windows\System\sdUHrNG.exe
  C:\Windows\System\sdUHrNG.exe
  2⤵
  PID:3288
- C:\Windows\System\xTqPtvm.exe
  C:\Windows\System\xTqPtvm.exe
  2⤵
  PID:3316
- C:\Windows\System\ndadsah.exe
  C:\Windows\System\ndadsah.exe
  2⤵
  PID:3356
- C:\Windows\System\ObQZIsK.exe
  C:\Windows\System\ObQZIsK.exe
  2⤵
  PID:2268
- C:\Windows\System\LfmDmOk.exe
  C:\Windows\System\LfmDmOk.exe
  2⤵
  PID:3408
- C:\Windows\System\FAsmDEA.exe
  C:\Windows\System\FAsmDEA.exe
  2⤵
  PID:3464
- C:\Windows\System\BfjlQhT.exe
  C:\Windows\System\BfjlQhT.exe
  2⤵
  PID:3504
- C:\Windows\System\rCXIWRB.exe
  C:\Windows\System\rCXIWRB.exe
  2⤵
  PID:3572
- C:\Windows\System\wDWQPod.exe
  C:\Windows\System\wDWQPod.exe
  2⤵
  PID:3604
- C:\Windows\System\Irszluq.exe
  C:\Windows\System\Irszluq.exe
  2⤵
  PID:3648
- C:\Windows\System\baoPLoT.exe
  C:\Windows\System\baoPLoT.exe
  2⤵
  PID:3720
- C:\Windows\System\sCbqUUf.exe
  C:\Windows\System\sCbqUUf.exe
  2⤵
  PID:3752
- C:\Windows\System\FqOMYqo.exe
  C:\Windows\System\FqOMYqo.exe
  2⤵
  PID:3808
- C:\Windows\System\GpiYKCv.exe
  C:\Windows\System\GpiYKCv.exe
  2⤵
  PID:3844
- C:\Windows\System\eSsZiDc.exe
  C:\Windows\System\eSsZiDc.exe
  2⤵
  PID:3904
- C:\Windows\System\GqtKmbD.exe
  C:\Windows\System\GqtKmbD.exe
  2⤵
  PID:3948
- C:\Windows\System\kvTxraV.exe
  C:\Windows\System\kvTxraV.exe
  2⤵
  PID:3964
- C:\Windows\System\abEdQFQ.exe
  C:\Windows\System\abEdQFQ.exe
  2⤵
  PID:4052
- C:\Windows\System\NqURMCM.exe
  C:\Windows\System\NqURMCM.exe
  2⤵
  PID:4080
- C:\Windows\System\WzyZvWQ.exe
  C:\Windows\System\WzyZvWQ.exe
  2⤵
  PID:1880
- C:\Windows\System\VJyijlw.exe
  C:\Windows\System\VJyijlw.exe
  2⤵
  PID:2024
- C:\Windows\System\wdpqWSc.exe
  C:\Windows\System\wdpqWSc.exe
  2⤵
  PID:3096
- C:\Windows\System\KXMLNht.exe
  C:\Windows\System\KXMLNht.exe
  2⤵
  PID:2664
- C:\Windows\System\aniZroV.exe
  C:\Windows\System\aniZroV.exe
  2⤵
  PID:1956
- C:\Windows\System\LzMpCnR.exe
  C:\Windows\System\LzMpCnR.exe
  2⤵
  PID:3276
- C:\Windows\System\QDyufyx.exe
  C:\Windows\System\QDyufyx.exe
  2⤵
  PID:3308
- C:\Windows\System\vCGMSnl.exe
  C:\Windows\System\vCGMSnl.exe
  2⤵
  PID:4100
- C:\Windows\System\mfAjeWC.exe
  C:\Windows\System\mfAjeWC.exe
  2⤵
  PID:4116
- C:\Windows\System\SpbfEVQ.exe
  C:\Windows\System\SpbfEVQ.exe
  2⤵
  PID:4132
- C:\Windows\System\HjSyomW.exe
  C:\Windows\System\HjSyomW.exe
  2⤵
  PID:4152
- C:\Windows\System\PLENRrS.exe
  C:\Windows\System\PLENRrS.exe
  2⤵
  PID:4168
- C:\Windows\System\GsZiSDs.exe
  C:\Windows\System\GsZiSDs.exe
  2⤵
  PID:4184
- C:\Windows\System\EYgSgRa.exe
  C:\Windows\System\EYgSgRa.exe
  2⤵
  PID:4240
- C:\Windows\System\YKttNZV.exe
  C:\Windows\System\YKttNZV.exe
  2⤵
  PID:4256
- C:\Windows\System\SqGpyVz.exe
  C:\Windows\System\SqGpyVz.exe
  2⤵
  PID:4276
- C:\Windows\System\fUyxjKr.exe
  C:\Windows\System\fUyxjKr.exe
  2⤵
  PID:4292
- C:\Windows\System\gtUotZV.exe
  C:\Windows\System\gtUotZV.exe
  2⤵
  PID:4308
- C:\Windows\System\gNybrCX.exe
  C:\Windows\System\gNybrCX.exe
  2⤵
  PID:4332
- C:\Windows\System\nlnXZVb.exe
  C:\Windows\System\nlnXZVb.exe
  2⤵
  PID:4352
- C:\Windows\System\MafHLPL.exe
  C:\Windows\System\MafHLPL.exe
  2⤵
  PID:4368
- C:\Windows\System\KAtDzjC.exe
  C:\Windows\System\KAtDzjC.exe
  2⤵
  PID:4384
- C:\Windows\System\OxcCwgu.exe
  C:\Windows\System\OxcCwgu.exe
  2⤵
  PID:4400
- C:\Windows\System\rxjKvcK.exe
  C:\Windows\System\rxjKvcK.exe
  2⤵
  PID:4420
- C:\Windows\System\ppkGRKo.exe
  C:\Windows\System\ppkGRKo.exe
  2⤵
  PID:4436
- C:\Windows\System\QGoAodJ.exe
  C:\Windows\System\QGoAodJ.exe
  2⤵
  PID:4452
- C:\Windows\System\xTszyVL.exe
  C:\Windows\System\xTszyVL.exe
  2⤵
  PID:4468
- C:\Windows\System\UPmHCnl.exe
  C:\Windows\System\UPmHCnl.exe
  2⤵
  PID:4484
- C:\Windows\System\qNfXtYf.exe
  C:\Windows\System\qNfXtYf.exe
  2⤵
  PID:4500
- C:\Windows\System\EtnLmsj.exe
  C:\Windows\System\EtnLmsj.exe
  2⤵
  PID:4516
- C:\Windows\System\VmtyjHM.exe
  C:\Windows\System\VmtyjHM.exe
  2⤵
  PID:4536
- C:\Windows\System\MQTEMDk.exe
  C:\Windows\System\MQTEMDk.exe
  2⤵
  PID:4552
- C:\Windows\System\MegUGCZ.exe
  C:\Windows\System\MegUGCZ.exe
  2⤵
  PID:4576
- C:\Windows\System\gGHNCcQ.exe
  C:\Windows\System\gGHNCcQ.exe
  2⤵
  PID:4596
- C:\Windows\System\cijZUJG.exe
  C:\Windows\System\cijZUJG.exe
  2⤵
  PID:4612
- C:\Windows\System\fBfBWqH.exe
  C:\Windows\System\fBfBWqH.exe
  2⤵
  PID:4628
- C:\Windows\System\XsZQlrZ.exe
  C:\Windows\System\XsZQlrZ.exe
  2⤵
  PID:4644
- C:\Windows\System\HUcLWHU.exe
  C:\Windows\System\HUcLWHU.exe
  2⤵
  PID:4660
- C:\Windows\System\YLRDheX.exe
  C:\Windows\System\YLRDheX.exe
  2⤵
  PID:4676
- C:\Windows\System\hqZuFTT.exe
  C:\Windows\System\hqZuFTT.exe
  2⤵
  PID:4692
- C:\Windows\System\VFYbeTf.exe
  C:\Windows\System\VFYbeTf.exe
  2⤵
  PID:4708
- C:\Windows\System\QOATgYL.exe
  C:\Windows\System\QOATgYL.exe
  2⤵
  PID:4724
- C:\Windows\System\NitiBRU.exe
  C:\Windows\System\NitiBRU.exe
  2⤵
  PID:4744
- C:\Windows\System\SBasMMY.exe
  C:\Windows\System\SBasMMY.exe
  2⤵
  PID:4764
- C:\Windows\System\DTkXWlg.exe
  C:\Windows\System\DTkXWlg.exe
  2⤵
  PID:4788
- C:\Windows\System\gaKycIB.exe
  C:\Windows\System\gaKycIB.exe
  2⤵
  PID:4804
- C:\Windows\System\Chwjbzz.exe
  C:\Windows\System\Chwjbzz.exe
  2⤵
  PID:4820
- C:\Windows\System\rXtDZVl.exe
  C:\Windows\System\rXtDZVl.exe
  2⤵
  PID:4836
- C:\Windows\System\rDzyQGa.exe
  C:\Windows\System\rDzyQGa.exe
  2⤵
  PID:4852
- C:\Windows\System\FgsNHOC.exe
  C:\Windows\System\FgsNHOC.exe
  2⤵
  PID:4872
- C:\Windows\System\ezUtMzp.exe
  C:\Windows\System\ezUtMzp.exe
  2⤵
  PID:4892
- C:\Windows\System\fNObfwA.exe
  C:\Windows\System\fNObfwA.exe
  2⤵
  PID:4908
- C:\Windows\System\fHZrMrK.exe
  C:\Windows\System\fHZrMrK.exe
  2⤵
  PID:4924
- C:\Windows\System\PJYzFXk.exe
  C:\Windows\System\PJYzFXk.exe
  2⤵
  PID:4944
- C:\Windows\System\FBudmSm.exe
  C:\Windows\System\FBudmSm.exe
  2⤵
  PID:4964
- C:\Windows\System\LGvHuZD.exe
  C:\Windows\System\LGvHuZD.exe
  2⤵
  PID:4980
- C:\Windows\System\hVLCOhT.exe
  C:\Windows\System\hVLCOhT.exe
  2⤵
  PID:4996
- C:\Windows\System\oDHIXHt.exe
  C:\Windows\System\oDHIXHt.exe
  2⤵
  PID:5012
- C:\Windows\System\sQuKISz.exe
  C:\Windows\System\sQuKISz.exe
  2⤵
  PID:5028
- C:\Windows\System\eMOogzk.exe
  C:\Windows\System\eMOogzk.exe
  2⤵
  PID:5044
- C:\Windows\System\zFpEiua.exe
  C:\Windows\System\zFpEiua.exe
  2⤵
  PID:5060
- C:\Windows\System\DTppuez.exe
  C:\Windows\System\DTppuez.exe
  2⤵
  PID:5076
- C:\Windows\System\rqUgiSZ.exe
  C:\Windows\System\rqUgiSZ.exe
  2⤵
  PID:5096
- C:\Windows\System\ABGEHvH.exe
  C:\Windows\System\ABGEHvH.exe
  2⤵
  PID:5116
- C:\Windows\System\pQgukBl.exe
  C:\Windows\System\pQgukBl.exe
  2⤵
  PID:3332
- C:\Windows\System\LyUvCGG.exe
  C:\Windows\System\LyUvCGG.exe
  2⤵
  PID:3552
- C:\Windows\System\yeWaqMJ.exe
  C:\Windows\System\yeWaqMJ.exe
  2⤵
  PID:2792
- C:\Windows\System\QvCGSPc.exe
  C:\Windows\System\QvCGSPc.exe
  2⤵
  PID:3568
- C:\Windows\System\kxJHBXt.exe
  C:\Windows\System\kxJHBXt.exe
  2⤵
  PID:3984
- C:\Windows\System\BlNMtWp.exe
  C:\Windows\System\BlNMtWp.exe
  2⤵
  PID:3840
- C:\Windows\System\rzydYhy.exe
  C:\Windows\System\rzydYhy.exe
  2⤵
  PID:4200
- C:\Windows\System\YRKSkXF.exe
  C:\Windows\System\YRKSkXF.exe
  2⤵
  PID:3228
- C:\Windows\System\MpdJUWa.exe
  C:\Windows\System\MpdJUWa.exe
  2⤵
  PID:4128
- C:\Windows\System\UowlIpv.exe
  C:\Windows\System\UowlIpv.exe
  2⤵
  PID:3912
- C:\Windows\System\eRbuSWL.exe
  C:\Windows\System\eRbuSWL.exe
  2⤵
  PID:4412
- C:\Windows\System\rNKYenB.exe
  C:\Windows\System\rNKYenB.exe
  2⤵
  PID:4288
- C:\Windows\System\sqGPoKJ.exe
  C:\Windows\System\sqGPoKJ.exe
  2⤵
  PID:4688
- C:\Windows\System\xHsdztE.exe
  C:\Windows\System\xHsdztE.exe
  2⤵
  PID:4564
- C:\Windows\System\cQoXohU.exe
  C:\Windows\System\cQoXohU.exe
  2⤵
  PID:4668
- C:\Windows\System\jsqOlli.exe
  C:\Windows\System\jsqOlli.exe
  2⤵
  PID:4756
- C:\Windows\System\jwpcwDj.exe
  C:\Windows\System\jwpcwDj.exe
  2⤵
  PID:4832
- C:\Windows\System\zHpnkYv.exe
  C:\Windows\System\zHpnkYv.exe
  2⤵
  PID:4772
- C:\Windows\System\kzCnYeF.exe
  C:\Windows\System\kzCnYeF.exe
  2⤵
  PID:4932
- C:\Windows\System\ifDPaOW.exe
  C:\Windows\System\ifDPaOW.exe
  2⤵
  PID:4976
- C:\Windows\System\cSlomBW.exe
  C:\Windows\System\cSlomBW.exe
  2⤵
  PID:5104
- C:\Windows\System\ZQPzZiR.exe
  C:\Windows\System\ZQPzZiR.exe
  2⤵
  PID:4956
- C:\Windows\System\VpNIDXd.exe
  C:\Windows\System\VpNIDXd.exe
  2⤵
  PID:5024
- C:\Windows\System\vQqoqIz.exe
  C:\Windows\System\vQqoqIz.exe
  2⤵
  PID:5056
- C:\Windows\System\IpFFdgS.exe
  C:\Windows\System\IpFFdgS.exe
  2⤵
  PID:3484
- C:\Windows\System\jjHroeU.exe
  C:\Windows\System\jjHroeU.exe
  2⤵
  PID:3652
- C:\Windows\System\PnRQGKu.exe
  C:\Windows\System\PnRQGKu.exe
  2⤵
  PID:3216
- C:\Windows\System\qbCzDOk.exe
  C:\Windows\System\qbCzDOk.exe
  2⤵
  PID:3336
- C:\Windows\System\FNWFzex.exe
  C:\Windows\System\FNWFzex.exe
  2⤵
  PID:4224
- C:\Windows\System\QduLXiA.exe
  C:\Windows\System\QduLXiA.exe
  2⤵
  PID:1740
- C:\Windows\System\fgVUVNy.exe
  C:\Windows\System\fgVUVNy.exe
  2⤵
  PID:4140
- C:\Windows\System\lAzmpVl.exe
  C:\Windows\System\lAzmpVl.exe
  2⤵
  PID:2380
- C:\Windows\System\bSyfzYW.exe
  C:\Windows\System\bSyfzYW.exe
  2⤵
  PID:4232
- C:\Windows\System\QQoPwsV.exe
  C:\Windows\System\QQoPwsV.exe
  2⤵
  PID:3812
- C:\Windows\System\heTygXr.exe
  C:\Windows\System\heTygXr.exe
  2⤵
  PID:4284
- C:\Windows\System\tqNjsFI.exe
  C:\Windows\System\tqNjsFI.exe
  2⤵
  PID:4408
- C:\Windows\System\FOlhXnk.exe
  C:\Windows\System\FOlhXnk.exe
  2⤵
  PID:4448
- C:\Windows\System\htErFqd.exe
  C:\Windows\System\htErFqd.exe
  2⤵
  PID:4364
- C:\Windows\System\xJjRREG.exe
  C:\Windows\System\xJjRREG.exe
  2⤵
  PID:4460
- C:\Windows\System\pPVJTff.exe
  C:\Windows\System\pPVJTff.exe
  2⤵
  PID:4496
- C:\Windows\System\gYTdqJN.exe
  C:\Windows\System\gYTdqJN.exe
  2⤵
  PID:4528
- C:\Windows\System\eNaAFlH.exe
  C:\Windows\System\eNaAFlH.exe
  2⤵
  PID:4684
- C:\Windows\System\RxZipPr.exe
  C:\Windows\System\RxZipPr.exe
  2⤵
  PID:4720
- C:\Windows\System\AtbTTzG.exe
  C:\Windows\System\AtbTTzG.exe
  2⤵
  PID:4868
- C:\Windows\System\bMXoQjh.exe
  C:\Windows\System\bMXoQjh.exe
  2⤵
  PID:4940
- C:\Windows\System\mizdRui.exe
  C:\Windows\System\mizdRui.exe
  2⤵
  PID:5008
- C:\Windows\System\SfHnkYj.exe
  C:\Windows\System\SfHnkYj.exe
  2⤵
  PID:4848
- C:\Windows\System\dWioSXL.exe
  C:\Windows\System\dWioSXL.exe
  2⤵
  PID:4988
- C:\Windows\System\GVtatHD.exe
  C:\Windows\System\GVtatHD.exe
  2⤵
  PID:5088
- C:\Windows\System\zAMAtIE.exe
  C:\Windows\System\zAMAtIE.exe
  2⤵
  PID:5092
- C:\Windows\System\tgDKRPM.exe
  C:\Windows\System\tgDKRPM.exe
  2⤵
  PID:3612
- C:\Windows\System\uSqdpBp.exe
  C:\Windows\System\uSqdpBp.exe
  2⤵
  PID:3888
- C:\Windows\System\oYnaICi.exe
  C:\Windows\System\oYnaICi.exe
  2⤵
  PID:4048
- C:\Windows\System\ylJkQSY.exe
  C:\Windows\System\ylJkQSY.exe
  2⤵
  PID:3292
- C:\Windows\System\eLdPhwU.exe
  C:\Windows\System\eLdPhwU.exe
  2⤵
  PID:4108
- C:\Windows\System\OcpWBuM.exe
  C:\Windows\System\OcpWBuM.exe
  2⤵
  PID:4112
- C:\Windows\System\RRKQtUL.exe
  C:\Windows\System\RRKQtUL.exe
  2⤵
  PID:3852
- C:\Windows\System\rbCdsKu.exe
  C:\Windows\System\rbCdsKu.exe
  2⤵
  PID:4328
- C:\Windows\System\bslfTiB.exe
  C:\Windows\System\bslfTiB.exe
  2⤵
  PID:4252
- C:\Windows\System\eJucUpj.exe
  C:\Windows\System\eJucUpj.exe
  2⤵
  PID:4584
- C:\Windows\System\wPzWQfQ.exe
  C:\Windows\System\wPzWQfQ.exe
  2⤵
  PID:4624
- C:\Windows\System\svKwiDu.exe
  C:\Windows\System\svKwiDu.exe
  2⤵
  PID:4640
- C:\Windows\System\AptkCBV.exe
  C:\Windows\System\AptkCBV.exe
  2⤵
  PID:4736
- C:\Windows\System\aaUROyv.exe
  C:\Windows\System\aaUROyv.exe
  2⤵
  PID:4920
- C:\Windows\System\yjpuqLn.exe
  C:\Windows\System\yjpuqLn.exe
  2⤵
  PID:5068
- C:\Windows\System\pKYpPAi.exe
  C:\Windows\System\pKYpPAi.exe
  2⤵
  PID:3944
- C:\Windows\System\qVGNGGy.exe
  C:\Windows\System\qVGNGGy.exe
  2⤵
  PID:4192
- C:\Windows\System\WgBbJcK.exe
  C:\Windows\System\WgBbJcK.exe
  2⤵
  PID:4264
- C:\Windows\System\ZWdmwPp.exe
  C:\Windows\System\ZWdmwPp.exe
  2⤵
  PID:2188
- C:\Windows\System\yFJZBqO.exe
  C:\Windows\System\yFJZBqO.exe
  2⤵
  PID:4360
- C:\Windows\System\nWAIgph.exe
  C:\Windows\System\nWAIgph.exe
  2⤵
  PID:4636
- C:\Windows\System\chJGaui.exe
  C:\Windows\System\chJGaui.exe
  2⤵
  PID:4592
- C:\Windows\System\BtGOuiX.exe
  C:\Windows\System\BtGOuiX.exe
  2⤵
  PID:5040
- C:\Windows\System\KAqcPrd.exe
  C:\Windows\System\KAqcPrd.exe
  2⤵
  PID:4796
- C:\Windows\System\mNZOFth.exe
  C:\Windows\System\mNZOFth.exe
  2⤵
  PID:2580
- C:\Windows\System\fyuTQBH.exe
  C:\Windows\System\fyuTQBH.exe
  2⤵
  PID:3084
- C:\Windows\System\pUkoEDG.exe
  C:\Windows\System\pUkoEDG.exe
  2⤵
  PID:2936
- C:\Windows\System\EHjaOxn.exe
  C:\Windows\System\EHjaOxn.exe
  2⤵
  PID:3644
- C:\Windows\System\MCEVuQR.exe
  C:\Windows\System\MCEVuQR.exe
  2⤵
  PID:4880
- C:\Windows\System\qgNCwJq.exe
  C:\Windows\System\qgNCwJq.exe
  2⤵
  PID:3688
- C:\Windows\System\dxutUcB.exe
  C:\Windows\System\dxutUcB.exe
  2⤵
  PID:4196
- C:\Windows\System\nJPOSBk.exe
  C:\Windows\System\nJPOSBk.exe
  2⤵
  PID:4572
- C:\Windows\System\uakdlRQ.exe
  C:\Windows\System\uakdlRQ.exe
  2⤵
  PID:4800
- C:\Windows\System\tAHjgHI.exe
  C:\Windows\System\tAHjgHI.exe
  2⤵
  PID:1444
- C:\Windows\System\NrwRzVv.exe
  C:\Windows\System\NrwRzVv.exe
  2⤵
  PID:4348
- C:\Windows\System\qqQagAu.exe
  C:\Windows\System\qqQagAu.exe
  2⤵
  PID:4548
- C:\Windows\System\hhWixnv.exe
  C:\Windows\System\hhWixnv.exe
  2⤵
  PID:4432
- C:\Windows\System\IYMshBt.exe
  C:\Windows\System\IYMshBt.exe
  2⤵
  PID:4732
- C:\Windows\System\cyRuxai.exe
  C:\Windows\System\cyRuxai.exe
  2⤵
  PID:4176
- C:\Windows\System\Wbaympa.exe
  C:\Windows\System\Wbaympa.exe
  2⤵
  PID:5124
- C:\Windows\System\IQSQqsv.exe
  C:\Windows\System\IQSQqsv.exe
  2⤵
  PID:5140
- C:\Windows\System\MqQDqKb.exe
  C:\Windows\System\MqQDqKb.exe
  2⤵
  PID:5160
- C:\Windows\System\wOuUIuT.exe
  C:\Windows\System\wOuUIuT.exe
  2⤵
  PID:5188
- C:\Windows\System\DPdhhQt.exe
  C:\Windows\System\DPdhhQt.exe
  2⤵
  PID:5208
- C:\Windows\System\cvzKuog.exe
  C:\Windows\System\cvzKuog.exe
  2⤵
  PID:5224
- C:\Windows\System\zylTeHL.exe
  C:\Windows\System\zylTeHL.exe
  2⤵
  PID:5252
- C:\Windows\System\HHmMJyN.exe
  C:\Windows\System\HHmMJyN.exe
  2⤵
  PID:5268
- C:\Windows\System\sSXewtp.exe
  C:\Windows\System\sSXewtp.exe
  2⤵
  PID:5284
- C:\Windows\System\kAyiUNS.exe
  C:\Windows\System\kAyiUNS.exe
  2⤵
  PID:5300
- C:\Windows\System\PNNVYDc.exe
  C:\Windows\System\PNNVYDc.exe
  2⤵
  PID:5316
- C:\Windows\System\SbxOEcx.exe
  C:\Windows\System\SbxOEcx.exe
  2⤵
  PID:5332
- C:\Windows\System\dkEOIFX.exe
  C:\Windows\System\dkEOIFX.exe
  2⤵
  PID:5348
- C:\Windows\System\jvLdcvS.exe
  C:\Windows\System\jvLdcvS.exe
  2⤵
  PID:5368
- C:\Windows\System\XuHXdWk.exe
  C:\Windows\System\XuHXdWk.exe
  2⤵
  PID:5388
- C:\Windows\System\qJdRmfh.exe
  C:\Windows\System\qJdRmfh.exe
  2⤵
  PID:5404
- C:\Windows\System\sscpRoH.exe
  C:\Windows\System\sscpRoH.exe
  2⤵
  PID:5420
- C:\Windows\System\flXBlEE.exe
  C:\Windows\System\flXBlEE.exe
  2⤵
  PID:5436
- C:\Windows\System\KMNalwI.exe
  C:\Windows\System\KMNalwI.exe
  2⤵
  PID:5452
- C:\Windows\System\mQEmHrl.exe
  C:\Windows\System\mQEmHrl.exe
  2⤵
  PID:5472
- C:\Windows\System\ynvhiAM.exe
  C:\Windows\System\ynvhiAM.exe
  2⤵
  PID:5488
- C:\Windows\System\esInGzK.exe
  C:\Windows\System\esInGzK.exe
  2⤵
  PID:5504
- C:\Windows\System\dzvoPwW.exe
  C:\Windows\System\dzvoPwW.exe
  2⤵
  PID:5520
- C:\Windows\System\vhjdRcd.exe
  C:\Windows\System\vhjdRcd.exe
  2⤵
  PID:5536
- C:\Windows\System\VjckuXl.exe
  C:\Windows\System\VjckuXl.exe
  2⤵
  PID:5556
- C:\Windows\System\HyZuiGv.exe
  C:\Windows\System\HyZuiGv.exe
  2⤵
  PID:5576
- C:\Windows\System\xHnrkAp.exe
  C:\Windows\System\xHnrkAp.exe
  2⤵
  PID:5596
- C:\Windows\System\sQXpiOd.exe
  C:\Windows\System\sQXpiOd.exe
  2⤵
  PID:5612
- C:\Windows\System\yqOFOMJ.exe
  C:\Windows\System\yqOFOMJ.exe
  2⤵
  PID:5628
- C:\Windows\System\AQllGcK.exe
  C:\Windows\System\AQllGcK.exe
  2⤵
  PID:5704
- C:\Windows\System\rzmLsqL.exe
  C:\Windows\System\rzmLsqL.exe
  2⤵
  PID:5720
- C:\Windows\System\SAQhDkB.exe
  C:\Windows\System\SAQhDkB.exe
  2⤵
  PID:5736
- C:\Windows\System\KXWqTax.exe
  C:\Windows\System\KXWqTax.exe
  2⤵
  PID:5752
- C:\Windows\System\huwLJhU.exe
  C:\Windows\System\huwLJhU.exe
  2⤵
  PID:5768
- C:\Windows\System\OuOUqEx.exe
  C:\Windows\System\OuOUqEx.exe
  2⤵
  PID:5788
- C:\Windows\System\WRRtwSN.exe
  C:\Windows\System\WRRtwSN.exe
  2⤵
  PID:5804
- C:\Windows\System\kOiRJeG.exe
  C:\Windows\System\kOiRJeG.exe
  2⤵
  PID:5820
- C:\Windows\System\CzLBcaY.exe
  C:\Windows\System\CzLBcaY.exe
  2⤵
  PID:5840
- C:\Windows\System\OMcdNig.exe
  C:\Windows\System\OMcdNig.exe
  2⤵
  PID:5856
- C:\Windows\System\CTFIwxn.exe
  C:\Windows\System\CTFIwxn.exe
  2⤵
  PID:5872
- C:\Windows\System\ztJkawJ.exe
  C:\Windows\System\ztJkawJ.exe
  2⤵
  PID:5888
- C:\Windows\System\ceBOCAR.exe
  C:\Windows\System\ceBOCAR.exe
  2⤵
  PID:5904
- C:\Windows\System\YXlviSM.exe
  C:\Windows\System\YXlviSM.exe
  2⤵
  PID:5924
- C:\Windows\System\LgyuaVk.exe
  C:\Windows\System\LgyuaVk.exe
  2⤵
  PID:5940
- C:\Windows\System\VStBMVI.exe
  C:\Windows\System\VStBMVI.exe
  2⤵
  PID:5956
- C:\Windows\System\WGKAFLA.exe
  C:\Windows\System\WGKAFLA.exe
  2⤵
  PID:5972
- C:\Windows\System\pvTKEpT.exe
  C:\Windows\System\pvTKEpT.exe
  2⤵
  PID:5988
- C:\Windows\System\cXOxBOd.exe
  C:\Windows\System\cXOxBOd.exe
  2⤵
  PID:6004
- C:\Windows\System\MalEDra.exe
  C:\Windows\System\MalEDra.exe
  2⤵
  PID:6020
- C:\Windows\System\melErkU.exe
  C:\Windows\System\melErkU.exe
  2⤵
  PID:6036
- C:\Windows\System\fTGelgE.exe
  C:\Windows\System\fTGelgE.exe
  2⤵
  PID:6052
- C:\Windows\System\KaTujiC.exe
  C:\Windows\System\KaTujiC.exe
  2⤵
  PID:6068
- C:\Windows\System\lJxqBNj.exe
  C:\Windows\System\lJxqBNj.exe
  2⤵
  PID:6084
- C:\Windows\System\NHtQlYW.exe
  C:\Windows\System\NHtQlYW.exe
  2⤵
  PID:5200
- C:\Windows\System\ruDBrQj.exe
  C:\Windows\System\ruDBrQj.exe
  2⤵
  PID:5232
- C:\Windows\System\lvTtNVr.exe
  C:\Windows\System\lvTtNVr.exe
  2⤵
  PID:5248
- C:\Windows\System\vjmqebp.exe
  C:\Windows\System\vjmqebp.exe
  2⤵
  PID:5280
- C:\Windows\System\nfivSkc.exe
  C:\Windows\System\nfivSkc.exe
  2⤵
  PID:5324
- C:\Windows\System\kYdwtTa.exe
  C:\Windows\System\kYdwtTa.exe
  2⤵
  PID:5364
- C:\Windows\System\iHYPeGk.exe
  C:\Windows\System\iHYPeGk.exe
  2⤵
  PID:5464
- C:\Windows\System\pKAAeOj.exe
  C:\Windows\System\pKAAeOj.exe
  2⤵
  PID:5400
- C:\Windows\System\VElVNqN.exe
  C:\Windows\System\VElVNqN.exe
  2⤵
  PID:5572
- C:\Windows\System\YPJbUpQ.exe
  C:\Windows\System\YPJbUpQ.exe
  2⤵
  PID:5644
- C:\Windows\System\KRVvene.exe
  C:\Windows\System\KRVvene.exe
  2⤵
  PID:5584
- C:\Windows\System\SKPaPiH.exe
  C:\Windows\System\SKPaPiH.exe
  2⤵
  PID:5548
- C:\Windows\System\ezqzHds.exe
  C:\Windows\System\ezqzHds.exe
  2⤵
  PID:5484
- C:\Windows\System\udzojoV.exe
  C:\Windows\System\udzojoV.exe
  2⤵
  PID:5660
- C:\Windows\System\Mdvzrbn.exe
  C:\Windows\System\Mdvzrbn.exe
  2⤵
  PID:5712
- C:\Windows\System\kiqiCSM.exe
  C:\Windows\System\kiqiCSM.exe
  2⤵
  PID:5764
- C:\Windows\System\VNptFek.exe
  C:\Windows\System\VNptFek.exe
  2⤵
  PID:5896
- C:\Windows\System\EJoyQcz.exe
  C:\Windows\System\EJoyQcz.exe
  2⤵
  PID:5716
- C:\Windows\System\KKOzyYd.exe
  C:\Windows\System\KKOzyYd.exe
  2⤵
  PID:5744
- C:\Windows\System\YHmFygo.exe
  C:\Windows\System\YHmFygo.exe
  2⤵
  PID:5812
- C:\Windows\System\hHNtcLB.exe
  C:\Windows\System\hHNtcLB.exe
  2⤵
  PID:6076
- C:\Windows\System\RheFiRL.exe
  C:\Windows\System\RheFiRL.exe
  2⤵
  PID:5952
- C:\Windows\System\YQeIGbt.exe
  C:\Windows\System\YQeIGbt.exe
  2⤵
  PID:5796
- C:\Windows\System\qwXnIYW.exe
  C:\Windows\System\qwXnIYW.exe
  2⤵
  PID:5968
- C:\Windows\System\VkkpAro.exe
  C:\Windows\System\VkkpAro.exe
  2⤵
  PID:6096
- C:\Windows\System\svNXfNH.exe
  C:\Windows\System\svNXfNH.exe
  2⤵
  PID:6032
- C:\Windows\System\Cbbkjch.exe
  C:\Windows\System\Cbbkjch.exe
  2⤵
  PID:6100
- C:\Windows\System\XPgXSYe.exe
  C:\Windows\System\XPgXSYe.exe
  2⤵
  PID:6132
- C:\Windows\System\nERKCtV.exe
  C:\Windows\System\nERKCtV.exe
  2⤵
  PID:5148
- C:\Windows\System\FTFORis.exe
  C:\Windows\System\FTFORis.exe
  2⤵
  PID:5152
- C:\Windows\System\qUNANJl.exe
  C:\Windows\System\qUNANJl.exe
  2⤵
  PID:5172
- C:\Windows\System\QybRPli.exe
  C:\Windows\System\QybRPli.exe
  2⤵
  PID:5204
- C:\Windows\System\XxyNvwJ.exe
  C:\Windows\System\XxyNvwJ.exe
  2⤵
  PID:5236
- C:\Windows\System\clDSlhG.exe
  C:\Windows\System\clDSlhG.exe
  2⤵
  PID:5528
- C:\Windows\System\iGjyOEQ.exe
  C:\Windows\System\iGjyOEQ.exe
  2⤵
  PID:5604
- C:\Windows\System\rvykxNQ.exe
  C:\Windows\System\rvykxNQ.exe
  2⤵
  PID:5312
- C:\Windows\System\mZPwogg.exe
  C:\Windows\System\mZPwogg.exe
  2⤵
  PID:5480
- C:\Windows\System\AgxLKkf.exe
  C:\Windows\System\AgxLKkf.exe
  2⤵
  PID:5552
- C:\Windows\System\FMsJSMP.exe
  C:\Windows\System\FMsJSMP.exe
  2⤵
  PID:5640
- C:\Windows\System\gsVYtGM.exe
  C:\Windows\System\gsVYtGM.exe
  2⤵
  PID:5676
- C:\Windows\System\uBmgtlj.exe
  C:\Windows\System\uBmgtlj.exe
  2⤵
  PID:6044
- C:\Windows\System\tcbDHOX.exe
  C:\Windows\System\tcbDHOX.exe
  2⤵
  PID:5980
- C:\Windows\System\CLBMxjo.exe
  C:\Windows\System\CLBMxjo.exe
  2⤵
  PID:5848
- C:\Windows\System\hiDAUXA.exe
  C:\Windows\System\hiDAUXA.exe
  2⤵
  PID:5852
- C:\Windows\System\cGVdEEo.exe
  C:\Windows\System\cGVdEEo.exe
  2⤵
  PID:5680
- C:\Windows\System\SPHFKwa.exe
  C:\Windows\System\SPHFKwa.exe
  2⤵
  PID:5648
- C:\Windows\System\vDRYSue.exe
  C:\Windows\System\vDRYSue.exe
  2⤵
  PID:6028
- C:\Windows\System\WSVxEeb.exe
  C:\Windows\System\WSVxEeb.exe
  2⤵
  PID:6092
- C:\Windows\System\vNmvwsi.exe
  C:\Windows\System\vNmvwsi.exe
  2⤵
  PID:6124
- C:\Windows\System\vMEYJZO.exe
  C:\Windows\System\vMEYJZO.exe
  2⤵
  PID:5136
- C:\Windows\System\vsEBpWn.exe
  C:\Windows\System\vsEBpWn.exe
  2⤵
  PID:6080
- C:\Windows\System\pYncDKk.exe
  C:\Windows\System\pYncDKk.exe
  2⤵
  PID:6112
- C:\Windows\System\ocbaOuJ.exe
  C:\Windows\System\ocbaOuJ.exe
  2⤵
  PID:5868
- C:\Windows\System\GHutpyU.exe
  C:\Windows\System\GHutpyU.exe
  2⤵
  PID:5412
- C:\Windows\System\ZYMqNRJ.exe
  C:\Windows\System\ZYMqNRJ.exe
  2⤵
  PID:5444
- C:\Windows\System\hVrQMAs.exe
  C:\Windows\System\hVrQMAs.exe
  2⤵
  PID:5656
- C:\Windows\System\OdBoBze.exe
  C:\Windows\System\OdBoBze.exe
  2⤵
  PID:5884
- C:\Windows\System\IalDqMO.exe
  C:\Windows\System\IalDqMO.exe
  2⤵
  PID:6140
- C:\Windows\System\pyonXxZ.exe
  C:\Windows\System\pyonXxZ.exe
  2⤵
  PID:5356
- C:\Windows\System\rVqMiUy.exe
  C:\Windows\System\rVqMiUy.exe
  2⤵
  PID:5376
- C:\Windows\System\rtIouLs.exe
  C:\Windows\System\rtIouLs.exe
  2⤵
  PID:5292
- C:\Windows\System\rcAnwho.exe
  C:\Windows\System\rcAnwho.exe
  2⤵
  PID:5668
- C:\Windows\System\IYHNUPV.exe
  C:\Windows\System\IYHNUPV.exe
  2⤵
  PID:5916
- C:\Windows\System\YltlkNd.exe
  C:\Windows\System\YltlkNd.exe
  2⤵
  PID:5184
- C:\Windows\System\FIrYrVW.exe
  C:\Windows\System\FIrYrVW.exe
  2⤵
  PID:5448
- C:\Windows\System\SptubbO.exe
  C:\Windows\System\SptubbO.exe
  2⤵
  PID:5832
- C:\Windows\System\PHPAZFv.exe
  C:\Windows\System\PHPAZFv.exe
  2⤵
  PID:5264
- C:\Windows\System\fMvLPjM.exe
  C:\Windows\System\fMvLPjM.exe
  2⤵
  PID:6148
- C:\Windows\System\JVfGLqN.exe
  C:\Windows\System\JVfGLqN.exe
  2⤵
  PID:6164
- C:\Windows\System\nZvucQe.exe
  C:\Windows\System\nZvucQe.exe
  2⤵
  PID:6180
- C:\Windows\System\bzGxfdr.exe
  C:\Windows\System\bzGxfdr.exe
  2⤵
  PID:6196
- C:\Windows\System\GczQJvW.exe
  C:\Windows\System\GczQJvW.exe
  2⤵
  PID:6216
- C:\Windows\System\AvoMUGx.exe
  C:\Windows\System\AvoMUGx.exe
  2⤵
  PID:6232
- C:\Windows\System\CDpEXZw.exe
  C:\Windows\System\CDpEXZw.exe
  2⤵
  PID:6316
- C:\Windows\System\DmnluIk.exe
  C:\Windows\System\DmnluIk.exe
  2⤵
  PID:6332
- C:\Windows\System\BmEClFT.exe
  C:\Windows\System\BmEClFT.exe
  2⤵
  PID:6348
- C:\Windows\System\PUJAoxL.exe
  C:\Windows\System\PUJAoxL.exe
  2⤵
  PID:6372
- C:\Windows\System\xgHpvcW.exe
  C:\Windows\System\xgHpvcW.exe
  2⤵
  PID:6388
- C:\Windows\System\YlZmFmf.exe
  C:\Windows\System\YlZmFmf.exe
  2⤵
  PID:6404
- C:\Windows\System\bLDJTrr.exe
  C:\Windows\System\bLDJTrr.exe
  2⤵
  PID:6420
- C:\Windows\System\LitVDVA.exe
  C:\Windows\System\LitVDVA.exe
  2⤵
  PID:6448
- C:\Windows\System\biNYBxo.exe
  C:\Windows\System\biNYBxo.exe
  2⤵
  PID:6472
- C:\Windows\System\qulqMRW.exe
  C:\Windows\System\qulqMRW.exe
  2⤵
  PID:6488
- C:\Windows\System\oULdmUW.exe
  C:\Windows\System\oULdmUW.exe
  2⤵
  PID:6504
- C:\Windows\System\QQbucxZ.exe
  C:\Windows\System\QQbucxZ.exe
  2⤵
  PID:6520
- C:\Windows\System\PEvwPeh.exe
  C:\Windows\System\PEvwPeh.exe
  2⤵
  PID:6536
- C:\Windows\System\WNxvHnN.exe
  C:\Windows\System\WNxvHnN.exe
  2⤵
  PID:6556
- C:\Windows\System\OCpXEPu.exe
  C:\Windows\System\OCpXEPu.exe
  2⤵
  PID:6572
- C:\Windows\System\HZKJzOl.exe
  C:\Windows\System\HZKJzOl.exe
  2⤵
  PID:6588
- C:\Windows\System\eRuaZQC.exe
  C:\Windows\System\eRuaZQC.exe
  2⤵
  PID:6604
- C:\Windows\System\prfNPpr.exe
  C:\Windows\System\prfNPpr.exe
  2⤵
  PID:6624
- C:\Windows\System\hplmCiP.exe
  C:\Windows\System\hplmCiP.exe
  2⤵
  PID:6640
- C:\Windows\System\NPuaeqY.exe
  C:\Windows\System\NPuaeqY.exe
  2⤵
  PID:6656
- C:\Windows\System\Plpvvmo.exe
  C:\Windows\System\Plpvvmo.exe
  2⤵
  PID:6676
- C:\Windows\System\OjczsgH.exe
  C:\Windows\System\OjczsgH.exe
  2⤵
  PID:6692
- C:\Windows\System\tqJjNLm.exe
  C:\Windows\System\tqJjNLm.exe
  2⤵
  PID:6740
- C:\Windows\System\QOxLirq.exe
  C:\Windows\System\QOxLirq.exe
  2⤵
  PID:6760
- C:\Windows\System\sqamumT.exe
  C:\Windows\System\sqamumT.exe
  2⤵
  PID:6776
- C:\Windows\System\DNTKzME.exe
  C:\Windows\System\DNTKzME.exe
  2⤵
  PID:6792
- C:\Windows\System\RRtRqrL.exe
  C:\Windows\System\RRtRqrL.exe
  2⤵
  PID:6808
- C:\Windows\System\cLvFxvZ.exe
  C:\Windows\System\cLvFxvZ.exe
  2⤵
  PID:6860
- C:\Windows\System\nkEqumF.exe
  C:\Windows\System\nkEqumF.exe
  2⤵
  PID:6876
- C:\Windows\System\aTuqoMY.exe
  C:\Windows\System\aTuqoMY.exe
  2⤵
  PID:6896
- C:\Windows\System\ApYBrTn.exe
  C:\Windows\System\ApYBrTn.exe
  2⤵
  PID:6928
- C:\Windows\System\gaYIGsv.exe
  C:\Windows\System\gaYIGsv.exe
  2⤵
  PID:6944
- C:\Windows\System\CHKuChA.exe
  C:\Windows\System\CHKuChA.exe
  2⤵
  PID:6960
- C:\Windows\System\ntFGUCU.exe
  C:\Windows\System\ntFGUCU.exe
  2⤵
  PID:7008
- C:\Windows\System\hBGPITt.exe
  C:\Windows\System\hBGPITt.exe
  2⤵
  PID:7028
- C:\Windows\System\enaFOGV.exe
  C:\Windows\System\enaFOGV.exe
  2⤵
  PID:7044
- C:\Windows\System\qnmzBrD.exe
  C:\Windows\System\qnmzBrD.exe
  2⤵
  PID:7060
- C:\Windows\System\ZUidWvh.exe
  C:\Windows\System\ZUidWvh.exe
  2⤵
  PID:7076
- C:\Windows\System\iYbUQpF.exe
  C:\Windows\System\iYbUQpF.exe
  2⤵
  PID:7092
- C:\Windows\System\pmGtygD.exe
  C:\Windows\System\pmGtygD.exe
  2⤵
  PID:7108
- C:\Windows\System\XKWJUkB.exe
  C:\Windows\System\XKWJUkB.exe
  2⤵
  PID:7128
- C:\Windows\System\HIHdvXA.exe
  C:\Windows\System\HIHdvXA.exe
  2⤵
  PID:7144
- C:\Windows\System\DXCgTNS.exe
  C:\Windows\System\DXCgTNS.exe
  2⤵
  PID:7160
- C:\Windows\System\uoApDjO.exe
  C:\Windows\System\uoApDjO.exe
  2⤵
  PID:5912
- C:\Windows\System\EGtfXTs.exe
  C:\Windows\System\EGtfXTs.exe
  2⤵
  PID:6176
- C:\Windows\System\TFPzvqe.exe
  C:\Windows\System\TFPzvqe.exe
  2⤵
  PID:6212
- C:\Windows\System\EOotgCV.exe
  C:\Windows\System\EOotgCV.exe
  2⤵
  PID:6244
- C:\Windows\System\qwSdXID.exe
  C:\Windows\System\qwSdXID.exe
  2⤵
  PID:1560
- C:\Windows\System\yDVEoPz.exe
  C:\Windows\System\yDVEoPz.exe
  2⤵
  PID:6192
- C:\Windows\System\sXuAujp.exe
  C:\Windows\System\sXuAujp.exe
  2⤵
  PID:5664
- C:\Windows\System\xTPxjuu.exe
  C:\Windows\System\xTPxjuu.exe
  2⤵
  PID:6312
- C:\Windows\System\yKCQwFO.exe
  C:\Windows\System\yKCQwFO.exe
  2⤵
  PID:6328
- C:\Windows\System\UQzXdMT.exe
  C:\Windows\System\UQzXdMT.exe
  2⤵
  PID:6400
- C:\Windows\System\SBwgSJD.exe
  C:\Windows\System\SBwgSJD.exe
  2⤵
  PID:6384
- C:\Windows\System\WKaukED.exe
  C:\Windows\System\WKaukED.exe
  2⤵
  PID:6360
- C:\Windows\System\CEfYLwt.exe
  C:\Windows\System\CEfYLwt.exe
  2⤵
  PID:6460
- C:\Windows\System\UqlGyul.exe
  C:\Windows\System\UqlGyul.exe
  2⤵
  PID:6512
- C:\Windows\System\ThatSxA.exe
  C:\Windows\System\ThatSxA.exe
  2⤵
  PID:6584
- C:\Windows\System\UgQUHRf.exe
  C:\Windows\System\UgQUHRf.exe
  2⤵
  PID:6648
- C:\Windows\System\WZvFFBE.exe
  C:\Windows\System\WZvFFBE.exe
  2⤵
  PID:6500
- C:\Windows\System\iNLUFHx.exe
  C:\Windows\System\iNLUFHx.exe
  2⤵
  PID:6636
- C:\Windows\System\wycYWVa.exe
  C:\Windows\System\wycYWVa.exe
  2⤵
  PID:6700
- C:\Windows\System\WHlnQNi.exe
  C:\Windows\System\WHlnQNi.exe
  2⤵
  PID:6784
- C:\Windows\System\wShosbR.exe
  C:\Windows\System\wShosbR.exe
  2⤵
  PID:6736
- C:\Windows\System\iYMgnQy.exe
  C:\Windows\System\iYMgnQy.exe
  2⤵
  PID:6724
- C:\Windows\System\ysRCXZi.exe
  C:\Windows\System\ysRCXZi.exe
  2⤵
  PID:6800
- C:\Windows\System\VxPfRJq.exe
  C:\Windows\System\VxPfRJq.exe
  2⤵
  PID:6820
- C:\Windows\System\KKDAQuH.exe
  C:\Windows\System\KKDAQuH.exe
  2⤵
  PID:6968
- C:\Windows\System\rSATQFO.exe
  C:\Windows\System\rSATQFO.exe
  2⤵
  PID:6912
- C:\Windows\System\IkALAam.exe
  C:\Windows\System\IkALAam.exe
  2⤵
  PID:6976
- C:\Windows\System\IBDPFMo.exe
  C:\Windows\System\IBDPFMo.exe
  2⤵
  PID:7020
- C:\Windows\System\hgpaOBv.exe
  C:\Windows\System\hgpaOBv.exe
  2⤵
  PID:7116
- C:\Windows\System\ooxdjZG.exe
  C:\Windows\System\ooxdjZG.exe
  2⤵
  PID:5168
- C:\Windows\System\tBHaCCE.exe
  C:\Windows\System\tBHaCCE.exe
  2⤵
  PID:5176
- C:\Windows\System\VpJlBin.exe
  C:\Windows\System\VpJlBin.exe
  2⤵
  PID:7000
- C:\Windows\System\ZjMipxr.exe
  C:\Windows\System\ZjMipxr.exe
  2⤵
  PID:4700
- C:\Windows\System\dTDBhsq.exe
  C:\Windows\System\dTDBhsq.exe
  2⤵
  PID:5688
- C:\Windows\System\MllWGdf.exe
  C:\Windows\System\MllWGdf.exe
  2⤵
  PID:7072
- C:\Windows\System\cteqrhf.exe
  C:\Windows\System\cteqrhf.exe
  2⤵
  PID:6992
- C:\Windows\System\RpleEWm.exe
  C:\Windows\System\RpleEWm.exe
  2⤵
  PID:7140
- C:\Windows\System\jJKEMaL.exe
  C:\Windows\System\jJKEMaL.exe
  2⤵
  PID:5932
- C:\Windows\System\BNLtsNC.exe
  C:\Windows\System\BNLtsNC.exe
  2⤵
  PID:6292
- C:\Windows\System\YTXxIhU.exe
  C:\Windows\System\YTXxIhU.exe
  2⤵
  PID:6308
- C:\Windows\System\pFaRXyM.exe
  C:\Windows\System\pFaRXyM.exe
  2⤵
  PID:6368
- C:\Windows\System\ljqwPgr.exe
  C:\Windows\System\ljqwPgr.exe
  2⤵
  PID:6484
- C:\Windows\System\FqjbSBR.exe
  C:\Windows\System\FqjbSBR.exe
  2⤵
  PID:6528
- C:\Windows\System\HwfrGXE.exe
  C:\Windows\System\HwfrGXE.exe
  2⤵
  PID:6548
- C:\Windows\System\cyFZOaH.exe
  C:\Windows\System\cyFZOaH.exe
  2⤵
  PID:6516
- C:\Windows\System\zbIGAbd.exe
  C:\Windows\System\zbIGAbd.exe
  2⤵
  PID:6616
- C:\Windows\System\mqZZQIq.exe
  C:\Windows\System\mqZZQIq.exe
  2⤵
  PID:6600
- C:\Windows\System\TsNXFMi.exe
  C:\Windows\System\TsNXFMi.exe
  2⤵
  PID:6716
- C:\Windows\System\gKrJPUA.exe
  C:\Windows\System\gKrJPUA.exe
  2⤵
  PID:6752
- C:\Windows\System\aDoTUqS.exe
  C:\Windows\System\aDoTUqS.exe
  2⤵
  PID:6844
- C:\Windows\System\brRrJhd.exe
  C:\Windows\System\brRrJhd.exe
  2⤵
  PID:6848
- C:\Windows\System\zfySKws.exe
  C:\Windows\System\zfySKws.exe
  2⤵
  PID:6872
- C:\Windows\System\OukINUX.exe
  C:\Windows\System\OukINUX.exe
  2⤵
  PID:6904
- C:\Windows\System\xjRvyhG.exe
  C:\Windows\System\xjRvyhG.exe
  2⤵
  PID:7052
- C:\Windows\System\zgQDnQa.exe
  C:\Windows\System\zgQDnQa.exe
  2⤵
  PID:7036
- C:\Windows\System\wIRKtTS.exe
  C:\Windows\System\wIRKtTS.exe
  2⤵
  PID:6272
- C:\Windows\System\yWyYxYT.exe
  C:\Windows\System\yWyYxYT.exe
  2⤵
  PID:6260
- C:\Windows\System\PvaZRrD.exe
  C:\Windows\System\PvaZRrD.exe
  2⤵
  PID:6276
- C:\Windows\System\zlclpvf.exe
  C:\Windows\System\zlclpvf.exe
  2⤵
  PID:6980
- C:\Windows\System\gPpRjcN.exe
  C:\Windows\System\gPpRjcN.exe
  2⤵
  PID:6532
- C:\Windows\System\LDbQWFb.exe
  C:\Windows\System\LDbQWFb.exe
  2⤵
  PID:6204
- C:\Windows\System\OpcFoaJ.exe
  C:\Windows\System\OpcFoaJ.exe
  2⤵
  PID:7172
- C:\Windows\System\NNMDFwv.exe
  C:\Windows\System\NNMDFwv.exe
  2⤵
  PID:7288
- C:\Windows\System\JJiYIur.exe
  C:\Windows\System\JJiYIur.exe
  2⤵
  PID:7304
- C:\Windows\System\mptGLkk.exe
  C:\Windows\System\mptGLkk.exe
  2⤵
  PID:7324
- C:\Windows\System\iEIRuCP.exe
  C:\Windows\System\iEIRuCP.exe
  2⤵
  PID:7340
- C:\Windows\System\FJnJfMH.exe
  C:\Windows\System\FJnJfMH.exe
  2⤵
  PID:7456
- C:\Windows\System\BgNxfEm.exe
  C:\Windows\System\BgNxfEm.exe
  2⤵
  PID:7472
- C:\Windows\System\yifijfb.exe
  C:\Windows\System\yifijfb.exe
  2⤵
  PID:7488
- C:\Windows\System\BisPPJc.exe
  C:\Windows\System\BisPPJc.exe
  2⤵
  PID:7504
- C:\Windows\System\SBXXxKP.exe
  C:\Windows\System\SBXXxKP.exe
  2⤵
  PID:7524
- C:\Windows\System\gUKuGnY.exe
  C:\Windows\System\gUKuGnY.exe
  2⤵
  PID:7540
- C:\Windows\System\HsItPHk.exe
  C:\Windows\System\HsItPHk.exe
  2⤵
  PID:7556
- C:\Windows\System\QIDlsse.exe
  C:\Windows\System\QIDlsse.exe
  2⤵
  PID:7572
- C:\Windows\System\ESSYTxV.exe
  C:\Windows\System\ESSYTxV.exe
  2⤵
  PID:7588
- C:\Windows\System\tBlKIGD.exe
  C:\Windows\System\tBlKIGD.exe
  2⤵
  PID:7604
- C:\Windows\System\fojNVFj.exe
  C:\Windows\System\fojNVFj.exe
  2⤵
  PID:7652
- C:\Windows\System\AFRVKgi.exe
  C:\Windows\System\AFRVKgi.exe
  2⤵
  PID:7668
- C:\Windows\System\dUIRHFC.exe
  C:\Windows\System\dUIRHFC.exe
  2⤵
  PID:7684
- C:\Windows\System\oFXqlMo.exe
  C:\Windows\System\oFXqlMo.exe
  2⤵
  PID:7716
- C:\Windows\System\xnqqjKH.exe
  C:\Windows\System\xnqqjKH.exe
  2⤵
  PID:7732
- C:\Windows\System\xEAzgvc.exe
  C:\Windows\System\xEAzgvc.exe
  2⤵
  PID:7752
- C:\Windows\System\VpIsoQs.exe
  C:\Windows\System\VpIsoQs.exe
  2⤵
  PID:7768
- C:\Windows\System\nIqxXhv.exe
  C:\Windows\System\nIqxXhv.exe
  2⤵
  PID:7784
- C:\Windows\System\AwrZubQ.exe
  C:\Windows\System\AwrZubQ.exe
  2⤵
  PID:7800
- C:\Windows\System\gTOHWHw.exe
  C:\Windows\System\gTOHWHw.exe
  2⤵
  PID:7816
- C:\Windows\System\XMSufZi.exe
  C:\Windows\System\XMSufZi.exe
  2⤵
  PID:7832
- C:\Windows\System\gfDVQnU.exe
  C:\Windows\System\gfDVQnU.exe
  2⤵
  PID:7872
- C:\Windows\System\ihpfZln.exe
  C:\Windows\System\ihpfZln.exe
  2⤵
  PID:7892
- C:\Windows\System\ufWCMAp.exe
  C:\Windows\System\ufWCMAp.exe
  2⤵
  PID:7908
- C:\Windows\System\zfdgVwE.exe
  C:\Windows\System\zfdgVwE.exe
  2⤵
  PID:7924
- C:\Windows\System\nVekfMS.exe
  C:\Windows\System\nVekfMS.exe
  2⤵
  PID:7940
- C:\Windows\System\rtffPjd.exe
  C:\Windows\System\rtffPjd.exe
  2⤵
  PID:7956
- C:\Windows\System\HcwAFal.exe
  C:\Windows\System\HcwAFal.exe
  2⤵
  PID:7976
- C:\Windows\System\GoYOcij.exe
  C:\Windows\System\GoYOcij.exe
  2⤵
  PID:7992
- C:\Windows\System\NprKtik.exe
  C:\Windows\System\NprKtik.exe
  2⤵
  PID:8008
- C:\Windows\System\lPkdlii.exe
  C:\Windows\System\lPkdlii.exe
  2⤵
  PID:8024
- C:\Windows\System\MpXmSoy.exe
  C:\Windows\System\MpXmSoy.exe
  2⤵
  PID:8040
- C:\Windows\System\itGCTkR.exe
  C:\Windows\System\itGCTkR.exe
  2⤵
  PID:8056
- C:\Windows\System\YaWPXrq.exe
  C:\Windows\System\YaWPXrq.exe
  2⤵
  PID:8072
- C:\Windows\System\zBREDXN.exe
  C:\Windows\System\zBREDXN.exe
  2⤵
  PID:8088
- C:\Windows\System\ZqNsmwl.exe
  C:\Windows\System\ZqNsmwl.exe
  2⤵
  PID:8104
- C:\Windows\System\HoBHhNe.exe
  C:\Windows\System\HoBHhNe.exe
  2⤵
  PID:8120
- C:\Windows\System\mIDpECl.exe
  C:\Windows\System\mIDpECl.exe
  2⤵
  PID:8136
- C:\Windows\System\UUhuQGt.exe
  C:\Windows\System\UUhuQGt.exe
  2⤵
  PID:8152
- C:\Windows\System\gNVOZLR.exe
  C:\Windows\System\gNVOZLR.exe
  2⤵
  PID:8168
- C:\Windows\System\RBIzWAO.exe
  C:\Windows\System\RBIzWAO.exe
  2⤵
  PID:8184
- C:\Windows\System\oojbgUO.exe
  C:\Windows\System\oojbgUO.exe
  2⤵
  PID:6580
- C:\Windows\System\VCaYNYT.exe
  C:\Windows\System\VCaYNYT.exe
  2⤵
  PID:6456
- C:\Windows\System\vDtDOrU.exe
  C:\Windows\System\vDtDOrU.exe
  2⤵
  PID:6544
- C:\Windows\System\QsXGZzA.exe
  C:\Windows\System\QsXGZzA.exe
  2⤵
  PID:6996
- C:\Windows\System\mmuNGKn.exe
  C:\Windows\System\mmuNGKn.exe
  2⤵
  PID:6936
- C:\Windows\System\iCJbwGQ.exe
  C:\Windows\System\iCJbwGQ.exe
  2⤵
  PID:6972
- C:\Windows\System\WTKMwTG.exe
  C:\Windows\System\WTKMwTG.exe
  2⤵
  PID:7180
- C:\Windows\System\hlBVjgg.exe
  C:\Windows\System\hlBVjgg.exe
  2⤵
  PID:7296
- C:\Windows\System\gqzwFpR.exe
  C:\Windows\System\gqzwFpR.exe
  2⤵
  PID:7336
- C:\Windows\System\EOENbil.exe
  C:\Windows\System\EOENbil.exe
  2⤵
  PID:7212
- C:\Windows\System\Xpnnpnh.exe
  C:\Windows\System\Xpnnpnh.exe
  2⤵
  PID:7196
- C:\Windows\System\RtLmxSo.exe
  C:\Windows\System\RtLmxSo.exe
  2⤵
  PID:7280
- C:\Windows\System\AaOihmy.exe
  C:\Windows\System\AaOihmy.exe
  2⤵
  PID:7256
- C:\Windows\System\cjpeAKv.exe
  C:\Windows\System\cjpeAKv.exe
  2⤵
  PID:7236
- C:\Windows\System\cHXocgp.exe
  C:\Windows\System\cHXocgp.exe
  2⤵
  PID:7268
- C:\Windows\System\pZXXZUh.exe
  C:\Windows\System\pZXXZUh.exe
  2⤵
  PID:7228
- C:\Windows\System\owxRHuZ.exe
  C:\Windows\System\owxRHuZ.exe
  2⤵
  PID:7316
- C:\Windows\System\JIJbpYz.exe
  C:\Windows\System\JIJbpYz.exe
  2⤵
  PID:7380
- C:\Windows\System\OmhMIAr.exe
  C:\Windows\System\OmhMIAr.exe
  2⤵
  PID:7384
- C:\Windows\System\BHtQPYn.exe
  C:\Windows\System\BHtQPYn.exe
  2⤵
  PID:7412
- C:\Windows\System\svgKcZX.exe
  C:\Windows\System\svgKcZX.exe
  2⤵
  PID:7436
- C:\Windows\System\lUIycov.exe
  C:\Windows\System\lUIycov.exe
  2⤵
  PID:7444
- C:\Windows\System\JTlBEyh.exe
  C:\Windows\System\JTlBEyh.exe
  2⤵
  PID:7480
- C:\Windows\System\chRrpFu.exe
  C:\Windows\System\chRrpFu.exe
  2⤵
  PID:7580
- C:\Windows\System\NEgTjJF.exe
  C:\Windows\System\NEgTjJF.exe
  2⤵
  PID:7500
- C:\Windows\System\zkKwpPi.exe
  C:\Windows\System\zkKwpPi.exe
  2⤵
  PID:7596
- C:\Windows\System\PmTICiK.exe
  C:\Windows\System\PmTICiK.exe
  2⤵
  PID:7764
- C:\Windows\System\VtYVnkh.exe
  C:\Windows\System\VtYVnkh.exe
  2⤵
  PID:7792
- C:\Windows\System\riWgzxC.exe
  C:\Windows\System\riWgzxC.exe
  2⤵
  PID:7884
- C:\Windows\System\zcVCChU.exe
  C:\Windows\System\zcVCChU.exe
  2⤵
  PID:7780
- C:\Windows\System\tvQzJKX.exe
  C:\Windows\System\tvQzJKX.exe
  2⤵
  PID:7844
- C:\Windows\System\SmNwSSJ.exe
  C:\Windows\System\SmNwSSJ.exe
  2⤵
  PID:7860
- C:\Windows\System\nxvpzQE.exe
  C:\Windows\System\nxvpzQE.exe
  2⤵
  PID:7964
- C:\Windows\System\ksdDxfF.exe
  C:\Windows\System\ksdDxfF.exe
  2⤵
  PID:8000
- C:\Windows\System\ppcuqqQ.exe
  C:\Windows\System\ppcuqqQ.exe
  2⤵
  PID:8032
- C:\Windows\System\KOeHIAB.exe
  C:\Windows\System\KOeHIAB.exe
  2⤵
  PID:7952
- C:\Windows\System\RBqgKJR.exe
  C:\Windows\System\RBqgKJR.exe
  2⤵
  PID:8064
- C:\Windows\System\ybUtMAY.exe
  C:\Windows\System\ybUtMAY.exe
  2⤵
  PID:8128
- C:\Windows\System\BvCKZRi.exe
  C:\Windows\System\BvCKZRi.exe
  2⤵
  PID:8144
- C:\Windows\System\igkMnvp.exe
  C:\Windows\System\igkMnvp.exe
  2⤵
  PID:8116
- C:\Windows\System\nifpiKd.exe
  C:\Windows\System\nifpiKd.exe
  2⤵
  PID:6432
- C:\Windows\System\ViSuXjC.exe
  C:\Windows\System\ViSuXjC.exe
  2⤵
  PID:6156
- C:\Windows\System\BgsUuCs.exe
  C:\Windows\System\BgsUuCs.exe
  2⤵
  PID:5864
- C:\Windows\System\eWSZkZH.exe
  C:\Windows\System\eWSZkZH.exe
  2⤵
  PID:6160
- C:\Windows\System\IpgvRiO.exe
  C:\Windows\System\IpgvRiO.exe
  2⤵
  PID:6984
- C:\Windows\System\SThQexx.exe
  C:\Windows\System\SThQexx.exe
  2⤵
  PID:6888
- C:\Windows\System\ZJWlpsX.exe
  C:\Windows\System\ZJWlpsX.exe
  2⤵
  PID:6708
- C:\Windows\System\sdOZRkG.exe
  C:\Windows\System\sdOZRkG.exe
  2⤵
  PID:7260
- C:\Windows\System\wDUDIEB.exe
  C:\Windows\System\wDUDIEB.exe
  2⤵
  PID:6240
- C:\Windows\System\BZuIrvS.exe
  C:\Windows\System\BZuIrvS.exe
  2⤵
  PID:7156
- C:\Windows\System\BSvaipV.exe
  C:\Windows\System\BSvaipV.exe
  2⤵
  PID:7612
- C:\Windows\System\JyMouaL.exe
  C:\Windows\System\JyMouaL.exe
  2⤵
  PID:7620
- C:\Windows\System\atTjEnD.exe
  C:\Windows\System\atTjEnD.exe
  2⤵
  PID:7636
- C:\Windows\System\WpDqWKe.exe
  C:\Windows\System\WpDqWKe.exe
  2⤵
  PID:7648
- C:\Windows\System\ysgHAFm.exe
  C:\Windows\System\ysgHAFm.exe
  2⤵
  PID:7696
- C:\Windows\System\ZEgbiuu.exe
  C:\Windows\System\ZEgbiuu.exe
  2⤵
  PID:7368
- C:\Windows\System\TlZHjkF.exe
  C:\Windows\System\TlZHjkF.exe
  2⤵
  PID:7440
- C:\Windows\System\NZnHcTM.exe
  C:\Windows\System\NZnHcTM.exe
  2⤵
  PID:7568
- C:\Windows\System\GGHfJZE.exe
  C:\Windows\System\GGHfJZE.exe
  2⤵
  PID:7984
- C:\Windows\System\odTJhVD.exe
  C:\Windows\System\odTJhVD.exe
  2⤵
  PID:7776
- C:\Windows\System\ZhzJnNA.exe
  C:\Windows\System\ZhzJnNA.exe
  2⤵
  PID:6596
- C:\Windows\System\chTuxVU.exe
  C:\Windows\System\chTuxVU.exe
  2⤵
  PID:8100
- C:\Windows\System\bapYdsq.exe
  C:\Windows\System\bapYdsq.exe
  2⤵
  PID:7900
- C:\Windows\System\tXKYMES.exe
  C:\Windows\System\tXKYMES.exe
  2⤵
  PID:6268
- C:\Windows\System\HBzhKgx.exe
  C:\Windows\System\HBzhKgx.exe
  2⤵
  PID:8164
- C:\Windows\System\qdsQCHR.exe
  C:\Windows\System\qdsQCHR.exe
  2⤵
  PID:7948
- C:\Windows\System\CUhgQqJ.exe
  C:\Windows\System\CUhgQqJ.exe
  2⤵
  PID:8112
- C:\Windows\System\XIgJOCU.exe
  C:\Windows\System\XIgJOCU.exe
  2⤵
  PID:7356
- C:\Windows\System\kooDRaX.exe
  C:\Windows\System\kooDRaX.exe
  2⤵
  PID:7420
- C:\Windows\System\WoHsaXV.exe
  C:\Windows\System\WoHsaXV.exe
  2⤵
  PID:7200
- C:\Windows\System\dGkyKpO.exe
  C:\Windows\System\dGkyKpO.exe
  2⤵
  PID:7532
- C:\Windows\System\usaUYNv.exe
  C:\Windows\System\usaUYNv.exe
  2⤵
  PID:7240
- C:\Windows\System\WTLGchQ.exe
  C:\Windows\System\WTLGchQ.exe
  2⤵
  PID:7660
- C:\Windows\System\ymOnqeH.exe
  C:\Windows\System\ymOnqeH.exe
  2⤵
  PID:8180
- C:\Windows\System\WEoatOd.exe
  C:\Windows\System\WEoatOd.exe
  2⤵
  PID:6672
- C:\Windows\System\tzgwQMg.exe
  C:\Windows\System\tzgwQMg.exe
  2⤵
  PID:7692
- C:\Windows\System\sYjHTKB.exe
  C:\Windows\System\sYjHTKB.exe
  2⤵
  PID:7512
- C:\Windows\System\UBXrPXf.exe
  C:\Windows\System\UBXrPXf.exe
  2⤵
  PID:7744
- C:\Windows\System\EexsIXj.exe
  C:\Windows\System\EexsIXj.exe
  2⤵
  PID:7224
- C:\Windows\System\TNTBYai.exe
  C:\Windows\System\TNTBYai.exe
  2⤵
  PID:7404
- C:\Windows\System\CrpUTEb.exe
  C:\Windows\System\CrpUTEb.exe
  2⤵
  PID:7724
- C:\Windows\System\vUFTahq.exe
  C:\Windows\System\vUFTahq.exe
  2⤵
  PID:7856
- C:\Windows\System\YUdpgyC.exe
  C:\Windows\System\YUdpgyC.exe
  2⤵
  PID:7016
- C:\Windows\System\XcgHFcs.exe
  C:\Windows\System\XcgHFcs.exe
  2⤵
  PID:7320
- C:\Windows\System\WZCLOVO.exe
  C:\Windows\System\WZCLOVO.exe
  2⤵
  PID:7828
- C:\Windows\System\RJPFVAU.exe
  C:\Windows\System\RJPFVAU.exe
  2⤵
  PID:7968
- C:\Windows\System\bsztDgK.exe
  C:\Windows\System\bsztDgK.exe
  2⤵
  PID:7348
- C:\Windows\System\qsTGdns.exe
  C:\Windows\System\qsTGdns.exe
  2⤵
  PID:6252
- C:\Windows\System\mGPoMqx.exe
  C:\Windows\System\mGPoMqx.exe
  2⤵
  PID:7428
- C:\Windows\System\fVWXFtw.exe
  C:\Windows\System\fVWXFtw.exe
  2⤵
  PID:6264
- C:\Windows\System\TwFRwca.exe
  C:\Windows\System\TwFRwca.exe
  2⤵
  PID:7748
- C:\Windows\System\XjDSull.exe
  C:\Windows\System\XjDSull.exe
  2⤵
  PID:7616
- C:\Windows\System\OKifPor.exe
  C:\Windows\System\OKifPor.exe
  2⤵
  PID:7564
- C:\Windows\System\IaUphex.exe
  C:\Windows\System\IaUphex.exe
  2⤵
  PID:7372
- C:\Windows\System\CCiGUKQ.exe
  C:\Windows\System\CCiGUKQ.exe
  2⤵
  PID:7708
- C:\Windows\System\UuCZcdN.exe
  C:\Windows\System\UuCZcdN.exe
  2⤵
  PID:7644
- C:\Windows\System\DnImTqK.exe
  C:\Windows\System\DnImTqK.exe
  2⤵
  PID:8048
- C:\Windows\System\VTQtLHd.exe
  C:\Windows\System\VTQtLHd.exe
  2⤵
  PID:7728
- C:\Windows\System\FXaqWUf.exe
  C:\Windows\System\FXaqWUf.exe
  2⤵
  PID:7704
- C:\Windows\System\QwasiTh.exe
  C:\Windows\System\QwasiTh.exe
  2⤵
  PID:7396
- C:\Windows\System\dMnnsMV.exe
  C:\Windows\System\dMnnsMV.exe
  2⤵
  PID:8196
- C:\Windows\System\hQuLKcJ.exe
  C:\Windows\System\hQuLKcJ.exe
  2⤵
  PID:8212
- C:\Windows\System\IuheUYy.exe
  C:\Windows\System\IuheUYy.exe
  2⤵
  PID:8228
- C:\Windows\System\AGCRtdN.exe
  C:\Windows\System\AGCRtdN.exe
  2⤵
  PID:8244
- C:\Windows\System\JOKsZuB.exe
  C:\Windows\System\JOKsZuB.exe
  2⤵
  PID:8260
- C:\Windows\System\FjOwdyH.exe
  C:\Windows\System\FjOwdyH.exe
  2⤵
  PID:8280
- C:\Windows\System\vWgwCcl.exe
  C:\Windows\System\vWgwCcl.exe
  2⤵
  PID:8296
- C:\Windows\System\LhZqlwB.exe
  C:\Windows\System\LhZqlwB.exe
  2⤵
  PID:8312
- C:\Windows\System\InqekTK.exe
  C:\Windows\System\InqekTK.exe
  2⤵
  PID:8328
- C:\Windows\System\XSpTHsk.exe
  C:\Windows\System\XSpTHsk.exe
  2⤵
  PID:8344
- C:\Windows\System\remZVed.exe
  C:\Windows\System\remZVed.exe
  2⤵
  PID:8360
- C:\Windows\System\ADdoLmy.exe
  C:\Windows\System\ADdoLmy.exe
  2⤵
  PID:8376
- C:\Windows\System\TTxlCMW.exe
  C:\Windows\System\TTxlCMW.exe
  2⤵
  PID:8392
- C:\Windows\System\vtCfxkO.exe
  C:\Windows\System\vtCfxkO.exe
  2⤵
  PID:8408
- C:\Windows\System\QVVKsVq.exe
  C:\Windows\System\QVVKsVq.exe
  2⤵
  PID:8424
- C:\Windows\System\eJXBsKJ.exe
  C:\Windows\System\eJXBsKJ.exe
  2⤵
  PID:8440
- C:\Windows\System\WMcydqS.exe
  C:\Windows\System\WMcydqS.exe
  2⤵
  PID:8456
- C:\Windows\System\CQRmDWC.exe
  C:\Windows\System\CQRmDWC.exe
  2⤵
  PID:8472
- C:\Windows\System\FJitZIE.exe
  C:\Windows\System\FJitZIE.exe
  2⤵
  PID:8488
- C:\Windows\System\DTDkDBO.exe
  C:\Windows\System\DTDkDBO.exe
  2⤵
  PID:8504
- C:\Windows\System\XKvtEJW.exe
  C:\Windows\System\XKvtEJW.exe
  2⤵
  PID:8520
- C:\Windows\System\sYtmzwy.exe
  C:\Windows\System\sYtmzwy.exe
  2⤵
  PID:8536
- C:\Windows\System\VeMVciI.exe
  C:\Windows\System\VeMVciI.exe
  2⤵
  PID:8552
- C:\Windows\System\CQkUzsW.exe
  C:\Windows\System\CQkUzsW.exe
  2⤵
  PID:8568
- C:\Windows\System\UmYevay.exe
  C:\Windows\System\UmYevay.exe
  2⤵
  PID:8584
- C:\Windows\System\HjIgmof.exe
  C:\Windows\System\HjIgmof.exe
  2⤵
  PID:8600
- C:\Windows\System\mXFPHei.exe
  C:\Windows\System\mXFPHei.exe
  2⤵
  PID:8616
- C:\Windows\System\SttRNmR.exe
  C:\Windows\System\SttRNmR.exe
  2⤵
  PID:8632
- C:\Windows\System\jQOpMAO.exe
  C:\Windows\System\jQOpMAO.exe
  2⤵
  PID:8648
- C:\Windows\System\zgvJqwz.exe
  C:\Windows\System\zgvJqwz.exe
  2⤵
  PID:8664
- C:\Windows\System\zTFLGSS.exe
  C:\Windows\System\zTFLGSS.exe
  2⤵
  PID:8680
- C:\Windows\System\NaQsrBE.exe
  C:\Windows\System\NaQsrBE.exe
  2⤵
  PID:8696
- C:\Windows\System\fJcDurf.exe
  C:\Windows\System\fJcDurf.exe
  2⤵
  PID:8712
- C:\Windows\System\YgcHAsY.exe
  C:\Windows\System\YgcHAsY.exe
  2⤵
  PID:8728
- C:\Windows\System\BgUEvGQ.exe
  C:\Windows\System\BgUEvGQ.exe
  2⤵
  PID:8744
- C:\Windows\System\sCdXXTl.exe
  C:\Windows\System\sCdXXTl.exe
  2⤵
  PID:8760
- C:\Windows\System\vmWabdA.exe
  C:\Windows\System\vmWabdA.exe
  2⤵
  PID:8776
- C:\Windows\System\dhghMTH.exe
  C:\Windows\System\dhghMTH.exe
  2⤵
  PID:8792
- C:\Windows\System\TBAXlMb.exe
  C:\Windows\System\TBAXlMb.exe
  2⤵
  PID:8808
- C:\Windows\System\rblADZI.exe
  C:\Windows\System\rblADZI.exe
  2⤵
  PID:8824
- C:\Windows\System\weiQrYv.exe
  C:\Windows\System\weiQrYv.exe
  2⤵
  PID:8840
- C:\Windows\System\KFwCmEd.exe
  C:\Windows\System\KFwCmEd.exe
  2⤵
  PID:8856
- C:\Windows\System\JZYsbco.exe
  C:\Windows\System\JZYsbco.exe
  2⤵
  PID:8872
- C:\Windows\System\RJkPlaW.exe
  C:\Windows\System\RJkPlaW.exe
  2⤵
  PID:8888
- C:\Windows\System\vjgNzFW.exe
  C:\Windows\System\vjgNzFW.exe
  2⤵
  PID:8904
- C:\Windows\System\xQKLkrn.exe
  C:\Windows\System\xQKLkrn.exe
  2⤵
  PID:8920
- C:\Windows\System\lIJRYHh.exe
  C:\Windows\System\lIJRYHh.exe
  2⤵
  PID:8940
- C:\Windows\System\vyfZUfq.exe
  C:\Windows\System\vyfZUfq.exe
  2⤵
  PID:8960
- C:\Windows\System\RCiOyjg.exe
  C:\Windows\System\RCiOyjg.exe
  2⤵
  PID:8976
- C:\Windows\System\cbtmeAt.exe
  C:\Windows\System\cbtmeAt.exe
  2⤵
  PID:8992
- C:\Windows\System\OCihVUa.exe
  C:\Windows\System\OCihVUa.exe
  2⤵
  PID:9008
- C:\Windows\System\UXbhHDC.exe
  C:\Windows\System\UXbhHDC.exe
  2⤵
  PID:9024
- C:\Windows\System\VNBYwjC.exe
  C:\Windows\System\VNBYwjC.exe
  2⤵
  PID:9040
- C:\Windows\System\fCbzDxB.exe
  C:\Windows\System\fCbzDxB.exe
  2⤵
  PID:9056
- C:\Windows\System\Fkqondn.exe
  C:\Windows\System\Fkqondn.exe
  2⤵
  PID:9072
- C:\Windows\System\DOJNOba.exe
  C:\Windows\System\DOJNOba.exe
  2⤵
  PID:9088
- C:\Windows\System\hzdysdq.exe
  C:\Windows\System\hzdysdq.exe
  2⤵
  PID:9104
- C:\Windows\System\IJnXkfP.exe
  C:\Windows\System\IJnXkfP.exe
  2⤵
  PID:9128
- C:\Windows\System\zhqFank.exe
  C:\Windows\System\zhqFank.exe
  2⤵
  PID:9144
- C:\Windows\System\GeHHfSz.exe
  C:\Windows\System\GeHHfSz.exe
  2⤵
  PID:9164
- C:\Windows\System\VjdivIx.exe
  C:\Windows\System\VjdivIx.exe
  2⤵
  PID:9184
- C:\Windows\System\qWLUXBR.exe
  C:\Windows\System\qWLUXBR.exe
  2⤵
  PID:9200
- C:\Windows\System\zLrQmxj.exe
  C:\Windows\System\zLrQmxj.exe
  2⤵
  PID:7220
- C:\Windows\System\JEKwLRS.exe
  C:\Windows\System\JEKwLRS.exe
  2⤵
  PID:8224
- C:\Windows\System\WTBHAwU.exe
  C:\Windows\System\WTBHAwU.exe
  2⤵
  PID:6892
- C:\Windows\System\vKCEkNQ.exe
  C:\Windows\System\vKCEkNQ.exe
  2⤵
  PID:7192
- C:\Windows\System\khJbSmW.exe
  C:\Windows\System\khJbSmW.exe
  2⤵
  PID:8084
- C:\Windows\System\JQtzJwx.exe
  C:\Windows\System\JQtzJwx.exe
  2⤵
  PID:8484
- C:\Windows\System\RspZAeB.exe
  C:\Windows\System\RspZAeB.exe
  2⤵
  PID:8500
- C:\Windows\System\qEQDCuX.exe
  C:\Windows\System\qEQDCuX.exe
  2⤵
  PID:8528
- C:\Windows\System\XKQbaeX.exe
  C:\Windows\System\XKQbaeX.exe
  2⤵
  PID:8564
- C:\Windows\System\KOvyuzk.exe
  C:\Windows\System\KOvyuzk.exe
  2⤵
  PID:8596
- C:\Windows\System\wIeRwhC.exe
  C:\Windows\System\wIeRwhC.exe
  2⤵
  PID:8644
- C:\Windows\System\WiTyJrt.exe
  C:\Windows\System\WiTyJrt.exe
  2⤵
  PID:8676
- C:\Windows\System\yesVzix.exe
  C:\Windows\System\yesVzix.exe
  2⤵
  PID:8708
- C:\Windows\System\cohrqVt.exe
  C:\Windows\System\cohrqVt.exe
  2⤵
  PID:8688
- C:\Windows\System\VgtdEsb.exe
  C:\Windows\System\VgtdEsb.exe
  2⤵
  PID:8772
- C:\Windows\System\tBTpIUN.exe
  C:\Windows\System\tBTpIUN.exe
  2⤵
  PID:8752
- C:\Windows\System\SOtZzss.exe
  C:\Windows\System\SOtZzss.exe
  2⤵
  PID:8816
- C:\Windows\System\dCVUTBf.exe
  C:\Windows\System\dCVUTBf.exe
  2⤵
  PID:8868
- C:\Windows\System\bzTpwqE.exe
  C:\Windows\System\bzTpwqE.exe
  2⤵
  PID:8884
- C:\Windows\System\kFKhUud.exe
  C:\Windows\System\kFKhUud.exe
  2⤵
  PID:8916
- C:\Windows\System\DfusAde.exe
  C:\Windows\System\DfusAde.exe
  2⤵
  PID:8968
- C:\Windows\System\GSzJyhl.exe
  C:\Windows\System\GSzJyhl.exe
  2⤵
  PID:9032
- C:\Windows\System\RYBCMtL.exe
  C:\Windows\System\RYBCMtL.exe
  2⤵
  PID:8984
- C:\Windows\System\WnNqkKL.exe
  C:\Windows\System\WnNqkKL.exe
  2⤵
  PID:7376
- C:\Windows\System\CZdtDLV.exe
  C:\Windows\System\CZdtDLV.exe
  2⤵
  PID:9064
- C:\Windows\System\LcMnMEB.exe
  C:\Windows\System\LcMnMEB.exe
  2⤵
  PID:9084
- C:\Windows\System\jqbkSgE.exe
  C:\Windows\System\jqbkSgE.exe
  2⤵
  PID:9124
- C:\Windows\System\MfZdQXL.exe
  C:\Windows\System\MfZdQXL.exe
  2⤵
  PID:9180
- C:\Windows\System\VcTjwGu.exe
  C:\Windows\System\VcTjwGu.exe
  2⤵
  PID:9152
- C:\Windows\System\WehTjRT.exe
  C:\Windows\System\WehTjRT.exe
  2⤵
  PID:9196
- C:\Windows\System\jUgMuvb.exe
  C:\Windows\System\jUgMuvb.exe
  2⤵
  PID:8256
- C:\Windows\System\dXMOzvl.exe
  C:\Windows\System\dXMOzvl.exe
  2⤵
  PID:7204
- C:\Windows\System\ubzdUxt.exe
  C:\Windows\System\ubzdUxt.exe
  2⤵
  PID:8276
- C:\Windows\System\RJjtNDm.exe
  C:\Windows\System\RJjtNDm.exe
  2⤵
  PID:8368
- C:\Windows\System\mSsXqmp.exe
  C:\Windows\System\mSsXqmp.exe
  2⤵
  PID:8388
- C:\Windows\System\NaUCCoH.exe
  C:\Windows\System\NaUCCoH.exe
  2⤵
  PID:8420
- C:\Windows\System\ZPVjhkm.exe
  C:\Windows\System\ZPVjhkm.exe
  2⤵
  PID:8516
- C:\Windows\System\BnAHbfV.exe
  C:\Windows\System\BnAHbfV.exe
  2⤵
  PID:8672
- C:\Windows\System\eOABPcZ.exe
  C:\Windows\System\eOABPcZ.exe
  2⤵
  PID:8272
- C:\Windows\System\vsYkcmr.exe
  C:\Windows\System\vsYkcmr.exe
  2⤵
  PID:8804
- C:\Windows\System\fwTTNlF.exe
  C:\Windows\System\fwTTNlF.exe
  2⤵
  PID:9004
- C:\Windows\System\UVFXXSu.exe
  C:\Windows\System\UVFXXSu.exe
  2⤵
  PID:9080
- C:\Windows\System\wbqWxbE.exe
  C:\Windows\System\wbqWxbE.exe
  2⤵
  PID:9192
- C:\Windows\System\mmMMuJU.exe
  C:\Windows\System\mmMMuJU.exe
  2⤵
  PID:8268
- C:\Windows\System\GjIZErM.exe
  C:\Windows\System\GjIZErM.exe
  2⤵
  PID:8496
- C:\Windows\System\gQveoUp.exe
  C:\Windows\System\gQveoUp.exe
  2⤵
  PID:9100
- C:\Windows\System\xBuVbrd.exe
  C:\Windows\System\xBuVbrd.exe
  2⤵
  PID:9160
- C:\Windows\System\rEPllXE.exe
  C:\Windows\System\rEPllXE.exe
  2⤵
  PID:8404
- C:\Windows\System\nyvncYa.exe
  C:\Windows\System\nyvncYa.exe
  2⤵
  PID:8640
- C:\Windows\System\ZFRmSzt.exe
  C:\Windows\System\ZFRmSzt.exe
  2⤵
  PID:8768
- C:\Windows\System\QLfdMuG.exe
  C:\Windows\System\QLfdMuG.exe
  2⤵
  PID:8936
- C:\Windows\System\JbqOPfM.exe
  C:\Windows\System\JbqOPfM.exe
  2⤵
  PID:8432
- C:\Windows\System\xjqqFmp.exe
  C:\Windows\System\xjqqFmp.exe
  2⤵
  PID:8628
- C:\Windows\System\LhYNMMK.exe
  C:\Windows\System\LhYNMMK.exe
  2⤵
  PID:8480
- C:\Windows\System\zeCbIsB.exe
  C:\Windows\System\zeCbIsB.exe
  2⤵
  PID:8800
- C:\Windows\System\wDZLrDO.exe
  C:\Windows\System\wDZLrDO.exe
  2⤵
  PID:9228
- C:\Windows\System\dJeFKBM.exe
  C:\Windows\System\dJeFKBM.exe
  2⤵
  PID:9244
- C:\Windows\System\UTDfRXg.exe
  C:\Windows\System\UTDfRXg.exe
  2⤵
  PID:9260
- C:\Windows\System\QboOEsx.exe
  C:\Windows\System\QboOEsx.exe
  2⤵
  PID:9276
- C:\Windows\System\SOpfEfK.exe
  C:\Windows\System\SOpfEfK.exe
  2⤵
  PID:9296
- C:\Windows\System\YzWpVaz.exe
  C:\Windows\System\YzWpVaz.exe
  2⤵
  PID:9316
- C:\Windows\System\FlelkcR.exe
  C:\Windows\System\FlelkcR.exe
  2⤵
  PID:9332
- C:\Windows\System\hwtUXVV.exe
  C:\Windows\System\hwtUXVV.exe
  2⤵
  PID:9416
- C:\Windows\System\bsVbmAb.exe
  C:\Windows\System\bsVbmAb.exe
  2⤵
  PID:9444
- C:\Windows\System\bgnJyGM.exe
  C:\Windows\System\bgnJyGM.exe
  2⤵
  PID:9460
- C:\Windows\System\gGRetXx.exe
  C:\Windows\System\gGRetXx.exe
  2⤵
  PID:9476
- C:\Windows\System\PmEXbOe.exe
  C:\Windows\System\PmEXbOe.exe
  2⤵
  PID:9492
- C:\Windows\System\mjqAqlM.exe
  C:\Windows\System\mjqAqlM.exe
  2⤵
  PID:9516
- C:\Windows\System\MrnwFkh.exe
  C:\Windows\System\MrnwFkh.exe
  2⤵
  PID:9540
- C:\Windows\System\zVpdftT.exe
  C:\Windows\System\zVpdftT.exe
  2⤵
  PID:9556
- C:\Windows\System\HvLJvJr.exe
  C:\Windows\System\HvLJvJr.exe
  2⤵
  PID:9572
- C:\Windows\System\ChaypIe.exe
  C:\Windows\System\ChaypIe.exe
  2⤵
  PID:9588
- C:\Windows\System\KYDkiDy.exe
  C:\Windows\System\KYDkiDy.exe
  2⤵
  PID:9604
- C:\Windows\System\fUdgsyl.exe
  C:\Windows\System\fUdgsyl.exe
  2⤵
  PID:9620
- C:\Windows\System\IJmVgWV.exe
  C:\Windows\System\IJmVgWV.exe
  2⤵
  PID:9636
- C:\Windows\System\LUFLmZq.exe
  C:\Windows\System\LUFLmZq.exe
  2⤵
  PID:9760
- C:\Windows\System\BXXyTjN.exe
  C:\Windows\System\BXXyTjN.exe
  2⤵
  PID:9780
- C:\Windows\System\cZqeURQ.exe
  C:\Windows\System\cZqeURQ.exe
  2⤵
  PID:9800
- C:\Windows\System\kqZUSHZ.exe
  C:\Windows\System\kqZUSHZ.exe
  2⤵
  PID:9816
- C:\Windows\System\zMGFOkQ.exe
  C:\Windows\System\zMGFOkQ.exe
  2⤵
  PID:9868
- C:\Windows\System\hkxjdjg.exe
  C:\Windows\System\hkxjdjg.exe
  2⤵
  PID:9884
- C:\Windows\System\nAfuFQv.exe
  C:\Windows\System\nAfuFQv.exe
  2⤵
  PID:9900
- C:\Windows\System\gGWAZdd.exe
  C:\Windows\System\gGWAZdd.exe
  2⤵
  PID:9916
- C:\Windows\System\YwjGNtU.exe
  C:\Windows\System\YwjGNtU.exe
  2⤵
  PID:9956
- C:\Windows\System\iQPsBPj.exe
  C:\Windows\System\iQPsBPj.exe
  2⤵
  PID:9980
- C:\Windows\System\oIlkUDr.exe
  C:\Windows\System\oIlkUDr.exe
  2⤵
  PID:9996
- C:\Windows\System\qHZGcay.exe
  C:\Windows\System\qHZGcay.exe
  2⤵
  PID:10012
- C:\Windows\System\leRGsez.exe
  C:\Windows\System\leRGsez.exe
  2⤵
  PID:10032
- C:\Windows\System\xBUwufI.exe
  C:\Windows\System\xBUwufI.exe
  2⤵
  PID:10048
- C:\Windows\System\SyDcdKe.exe
  C:\Windows\System\SyDcdKe.exe
  2⤵
  PID:10064
- C:\Windows\System\KWLeivc.exe
  C:\Windows\System\KWLeivc.exe
  2⤵
  PID:10080
- C:\Windows\System\bBhhlVh.exe
  C:\Windows\System\bBhhlVh.exe
  2⤵
  PID:10096
- C:\Windows\System\goKTWEY.exe
  C:\Windows\System\goKTWEY.exe
  2⤵
  PID:10112
- C:\Windows\System\jDCqXCB.exe
  C:\Windows\System\jDCqXCB.exe
  2⤵
  PID:10128
- C:\Windows\System\Eiqicye.exe
  C:\Windows\System\Eiqicye.exe
  2⤵
  PID:10144
- C:\Windows\System\OJNLXLN.exe
  C:\Windows\System\OJNLXLN.exe
  2⤵
  PID:10160
- C:\Windows\System\PlVxmHE.exe
  C:\Windows\System\PlVxmHE.exe
  2⤵
  PID:10176
- C:\Windows\System\ThixWdF.exe
  C:\Windows\System\ThixWdF.exe
  2⤵
  PID:10192
- C:\Windows\System\pHCrMbv.exe
  C:\Windows\System\pHCrMbv.exe
  2⤵
  PID:10208
- C:\Windows\System\rVUOIII.exe
  C:\Windows\System\rVUOIII.exe
  2⤵
  PID:10224
- C:\Windows\System\hEPzmTi.exe
  C:\Windows\System\hEPzmTi.exe
  2⤵
  PID:9048
- C:\Windows\System\vllIGxV.exe
  C:\Windows\System\vllIGxV.exe
  2⤵
  PID:8612
- C:\Windows\System\vFdmGfb.exe
  C:\Windows\System\vFdmGfb.exe
  2⤵
  PID:8704
- C:\Windows\System\KrBcKTC.exe
  C:\Windows\System\KrBcKTC.exe
  2⤵
  PID:8384
- C:\Windows\System\twOVxrd.exe
  C:\Windows\System\twOVxrd.exe
  2⤵
  PID:9224
- C:\Windows\System\ScTRmft.exe
  C:\Windows\System\ScTRmft.exe
  2⤵
  PID:9324
- C:\Windows\System\IwLgBkR.exe
  C:\Windows\System\IwLgBkR.exe
  2⤵
  PID:8560
- C:\Windows\System\VhDARJc.exe
  C:\Windows\System\VhDARJc.exe
  2⤵
  PID:9344
- C:\Windows\System\DFdefjo.exe
  C:\Windows\System\DFdefjo.exe
  2⤵
  PID:9020
- C:\Windows\System\OjGeVwz.exe
  C:\Windows\System\OjGeVwz.exe
  2⤵
  PID:8864
- C:\Windows\System\KIDTHAm.exe
  C:\Windows\System\KIDTHAm.exe
  2⤵
  PID:9268
- C:\Windows\System\SHCicYM.exe
  C:\Windows\System\SHCicYM.exe
  2⤵
  PID:9340
- C:\Windows\System\wJkgFMM.exe
  C:\Windows\System\wJkgFMM.exe
  2⤵
  PID:9360
- C:\Windows\System\CKiZhxd.exe
  C:\Windows\System\CKiZhxd.exe
  2⤵
  PID:9380
- C:\Windows\System\nEFdcbm.exe
  C:\Windows\System\nEFdcbm.exe
  2⤵
  PID:9396
- C:\Windows\System\UouksKw.exe
  C:\Windows\System\UouksKw.exe
  2⤵
  PID:9428
- C:\Windows\System\covIIlc.exe
  C:\Windows\System\covIIlc.exe
  2⤵
  PID:9452
- C:\Windows\System\awmyqzi.exe
  C:\Windows\System\awmyqzi.exe
  2⤵
  PID:8448
- C:\Windows\System\nMGYREA.exe
  C:\Windows\System\nMGYREA.exe
  2⤵
  PID:9568
- C:\Windows\System\tYNTeVm.exe
  C:\Windows\System\tYNTeVm.exe
  2⤵
  PID:9580
- C:\Windows\System\jsxJRdn.exe
  C:\Windows\System\jsxJRdn.exe
  2⤵
  PID:9768
- C:\Windows\System\ISEnYQz.exe
  C:\Windows\System\ISEnYQz.exe
  2⤵
  PID:9644
- C:\Windows\System\jjgPpdE.exe
  C:\Windows\System\jjgPpdE.exe
  2⤵
  PID:9724
- C:\Windows\System\CIyirzy.exe
  C:\Windows\System\CIyirzy.exe
  2⤵
  PID:9676
- C:\Windows\System\NRIunjh.exe
  C:\Windows\System\NRIunjh.exe
  2⤵
  PID:9756
- C:\Windows\System\XguUQgW.exe
  C:\Windows\System\XguUQgW.exe
  2⤵
  PID:9836
- C:\Windows\System\LrrZQua.exe
  C:\Windows\System\LrrZQua.exe
  2⤵
  PID:9672
- C:\Windows\System\RaTfGtF.exe
  C:\Windows\System\RaTfGtF.exe
  2⤵
  PID:9696
- C:\Windows\System\mCadPaK.exe
  C:\Windows\System\mCadPaK.exe
  2⤵
  PID:9740
- C:\Windows\System\RWezOVQ.exe
  C:\Windows\System\RWezOVQ.exe
  2⤵
  PID:9744
- C:\Windows\System\ElUUclw.exe
  C:\Windows\System\ElUUclw.exe
  2⤵
  PID:9796
- C:\Windows\System\gchGkNx.exe
  C:\Windows\System\gchGkNx.exe
  2⤵
  PID:9908
- C:\Windows\System\AMhCPxI.exe
  C:\Windows\System\AMhCPxI.exe
  2⤵
  PID:9844
- C:\Windows\System\pGHgHnB.exe
  C:\Windows\System\pGHgHnB.exe
  2⤵
  PID:9944
- C:\Windows\System\zEYMjIJ.exe
  C:\Windows\System\zEYMjIJ.exe
  2⤵
  PID:9928
- C:\Windows\System\TBGuWLF.exe
  C:\Windows\System\TBGuWLF.exe
  2⤵
  PID:9972
- C:\Windows\System\DHQYeEi.exe
  C:\Windows\System\DHQYeEi.exe
  2⤵
  PID:9988
- C:\Windows\System\XoRVdkC.exe
  C:\Windows\System\XoRVdkC.exe
  2⤵
  PID:10020
- C:\Windows\System\sGoiVMr.exe
  C:\Windows\System\sGoiVMr.exe
  2⤵
  PID:10104
- C:\Windows\System\jMqvzzE.exe
  C:\Windows\System\jMqvzzE.exe
  2⤵
  PID:10140
- C:\Windows\System\ZefEVyw.exe
  C:\Windows\System\ZefEVyw.exe
  2⤵
  PID:10168
- C:\Windows\System\VeoaQgO.exe
  C:\Windows\System\VeoaQgO.exe
  2⤵
  PID:10188
- C:\Windows\System\ODneddR.exe
  C:\Windows\System\ODneddR.exe
  2⤵
  PID:10124
- C:\Windows\System\iHVRTnu.exe
  C:\Windows\System\iHVRTnu.exe
  2⤵
  PID:9272
- C:\Windows\System\XFcjTlg.exe
  C:\Windows\System\XFcjTlg.exe
  2⤵
  PID:9308
- C:\Windows\System\yUTXgDo.exe
  C:\Windows\System\yUTXgDo.exe
  2⤵
  PID:9376
- C:\Windows\System\toXcsgJ.exe
  C:\Windows\System\toXcsgJ.exe
  2⤵
  PID:9488
- C:\Windows\System\SoOVXTM.exe
  C:\Windows\System\SoOVXTM.exe
  2⤵
  PID:9512
- C:\Windows\System\NYwAkrj.exe
  C:\Windows\System\NYwAkrj.exe
  2⤵
  PID:9612
- C:\Windows\System\TObTXjo.exe
  C:\Windows\System\TObTXjo.exe
  2⤵
  PID:9692
- C:\Windows\System\BMJkJVG.exe
  C:\Windows\System\BMJkJVG.exe
  2⤵
  PID:9548
- C:\Windows\System\LYTjdom.exe
  C:\Windows\System\LYTjdom.exe
  2⤵
  PID:9236
- C:\Windows\System\XWLlJzX.exe
  C:\Windows\System\XWLlJzX.exe
  2⤵
  PID:9392
- C:\Windows\System\fxtUCoM.exe
  C:\Windows\System\fxtUCoM.exe
  2⤵
  PID:9532
- C:\Windows\System\CtMtJAk.exe
  C:\Windows\System\CtMtJAk.exe
  2⤵
  PID:9660
- C:\Windows\System\goDDODk.exe
  C:\Windows\System\goDDODk.exe
  2⤵
  PID:9156
- C:\Windows\System\PYbArXq.exe
  C:\Windows\System\PYbArXq.exe
  2⤵
  PID:9716
- C:\Windows\System\TAJNWpl.exe
  C:\Windows\System\TAJNWpl.exe
  2⤵
  PID:9848
- C:\Windows\System\raWKuAm.exe
  C:\Windows\System\raWKuAm.exe
  2⤵
  PID:10004
- C:\Windows\System\ojMCIsI.exe
  C:\Windows\System\ojMCIsI.exe
  2⤵
  PID:10076
- C:\Windows\System\zIKgZad.exe
  C:\Windows\System\zIKgZad.exe
  2⤵
  PID:10060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BuwLRTs.exe

Filesize
1.5MB

MD5
11c05b61ced330a6b62f1a8170c6e5f4

SHA1
9bda484475326bae103d6d1129a1e151ffcc60c9

SHA256
35496bc3d21d37fd7c87001494142b1a99565cd611278a2981dabad20d488368

SHA512
041f2b0cc1ba671be0aadca2ae923fc09fd3701dd60edecdcd624016aaabe6b386cf5800627626f9980181be213c96a37e441a8376f10a80a8502b0e49947629

Download Submit
C:\Windows\system\CQWPTpL.exe

Filesize
1.5MB

MD5
4c2ec3570899ea4afabbd0d8f6b35625

SHA1
1d79c63179b8d649fcbcee385fc035c45427cb1b

SHA256
410bf9813fa6f74d29f026a9173cbb2e9335069376ed42c4ce1f6fece4e2a89f

SHA512
db1772f188273d5d761641ff8276e5d18359cae65569dcbcd6bcdc1339d8d20a8aaf02aacb1df7a4e7298c089c4dbed8795b8a72e5bd45e9fc5ae14529497ac6

Download Submit
C:\Windows\system\DIRxuBy.exe

Filesize
1.5MB

MD5
8ade761a05af8666779030e15d63ba03

SHA1
688d386dff606b8bdbee5750b10d43bac0d3cf2c

SHA256
73f60379f94369be1475834923eb58b2c6f1d1455bf8335b6ebbd74039a5e7cf

SHA512
a453e4bca0eadb3c4897d77831405bbd89affba4411fb83fbc3e94c48997d1ec993398455cc001691b162fe6e1427a7ffaefb39e6ae95ab271055d065f65ad50

Download Submit
C:\Windows\system\DJaudLG.exe

Filesize
1.5MB

MD5
662159edb9f2a184485c438b53544e8c

SHA1
08e89c8b36e2005074883d42cd9b5efbfe94ea91

SHA256
96c2cbb2fbeaed650b5ec1cdec34d4102582d9148077ed0bc7577484704bf3e5

SHA512
da46a91581c7f13ae1aa9a7c74e55f16e828750a697204e54a0fdadbdda85fa84267b470ac7d9e4ecf7f0f52b09698b00de768f84de9173b45563895c6a42bb1

Download Submit
C:\Windows\system\DVrFMfD.exe

Filesize
8B

MD5
6c6a33c852f4e05ffd14cdf0dcab7779

SHA1
70449821f99925d7b8d245181569b7ac4d2ffae8

SHA256
889f3baefc9f46c7632a467db8882ec92f1f0df14da91d5a211e7484de261e45

SHA512
92e5654661ef50c470f84dbec4dcad9efdca5e4026c073f08c798af48c0b5d8107a7b2ff4d63fdb982f371e15d79e95f8a6d716a30b5c5123a7273c49d650d19

Download Submit
C:\Windows\system\FjPBbOG.exe

Filesize
1.5MB

MD5
6da6690aca34e455985cea35710a36ba

SHA1
c6ccf114fc14b51660007e504c02481846b3d7e5

SHA256
c8a17459df72cddf8541d206cad657656af61974002ff9b02b592d69c30e809d

SHA512
e35b6f3fe9a9ebbdfb68d8af2c12ec8f143d2f8675eb4234e255016307eb2cc52ecd217192e7a9a43be3023f97296b3ee3da397a1d3241430cb2b757e2fa38eb

Download Submit
C:\Windows\system\GMFvfDR.exe

Filesize
1.5MB

MD5
3a84e6a5cffb08bb9d2136d238eb669e

SHA1
72c400c4db9ac0e374ab2f8577d6d5baee7e629f

SHA256
e23a3d70ade7f4e25fbc316305c6bb9dfc114ac5bc32c102ca2f213748fd898f

SHA512
85603bd1023f19bd03496dd783b842957f7fe696896d59487080250b7c1a7c3e0f057a88690effa80294f9fedcb0c60d4bad8275dc516d0848ce4b387db85f91

Download Submit
C:\Windows\system\HHvixYN.exe

Filesize
1.5MB

MD5
d9c3899d17122a11c4e373f05845775c

SHA1
f7499ad7cf32c6046f1a69f4b2c58a00672ac794

SHA256
a7ea6e9a0d39622cc4126764d6fe64362dcd298f8b1edf3bf0de447363e5f999

SHA512
174961f06b529c7b145dad832cae28780e0b4fed83419deaccd37911e664b63f354f38ae08c63eea881322717c8f209d09281284d8092f9a6d25b23f0c586136

Download Submit
C:\Windows\system\JDTBzIF.exe

Filesize
1.5MB

MD5
9f5d76ed21c17958b45fca461a6eabca

SHA1
eeb5d8871e5de6613e093e2f35ba7c40b804669b

SHA256
3d3be35317f655c47bfe31936337d66939a2fef682e66382d5026c82b21d5348

SHA512
cd13602a71aaa26a4a1bee0e1302961f53cc1448afb34f5267ea577056f680e7b946324ed5ef5bdd76b972a86be5844da2f459a2fc062f242cb75e4e39215353

Download Submit
C:\Windows\system\MCxRzCS.exe

Filesize
1.5MB

MD5
055d91aaadafe036771c3f7ed132c9a2

SHA1
4c0d4bd970dd3a6a8e274921203eb4c0aaa4b107

SHA256
1c2679bf649d6de7226019e17ec1667668064c18a9e70875117de3ebdd28c9ef

SHA512
5868c5e657240b55ce69760b4ddcd006132966aa3abfb46d5ccfc4ae25a8b8969df05a36c42badadaacb1336f86f880a4d19f595247e1599ca1e8f1692966f24

Download Submit
C:\Windows\system\MNQmIwF.exe

Filesize
1.5MB

MD5
e0bc964fe820de1d5cca939f07a82c2d

SHA1
6fd62dc4696c433de038a140df502ccc8fda1131

SHA256
b2fceb2f4c5ec19896788760ed16922fe3d3d3fb78f41935a961b08e9ea9117b

SHA512
fb6d02a9b8e18179b46d73bd4a6140ced87a6107b9574f5267d6e659a5637d116489281eccb3f6d4a4beb31688282ef14e4cae8d26af36fda0a39c4bf5b3b2aa

Download Submit
C:\Windows\system\NNTHCaP.exe

Filesize
1.5MB

MD5
63df1cafabab2d6d5a228f243ab916a0

SHA1
da5736da7dddec8ce9b84a6e577bcf67e15d3500

SHA256
68019d463a3a16dd96b0aeb8502939a8aa542b1fa528b5ce7f7bd155cce24eba

SHA512
57f9d4a56f45756eea1139cd64c7f1306d4169838b98dd7e5fb671a9547fc759a684b6a239e2cf495a448a24ccda9dcdef9a6a7e61ed82e1d36a75645cc62915

Download Submit
C:\Windows\system\RiqJVHV.exe

Filesize
1.5MB

MD5
b3f9b72741eb7e42c3aa0e06e71247b0

SHA1
7abf452c3d2cb9ed9467b76c61f207b4de153ed7

SHA256
c085e2aa0d682d4a9858eae500ce77a5c0758f0c67ce42753471ceaeead2c545

SHA512
5bf85e8d61793009ba186045d5fc0a86d0bd0ac18f90c6c6d38b08b1ca3f71f1d18fa4e59f70fcbbec69f0bf0f775027bb7f7c4c01ca6f14f3504c1c7c862f7b

Download Submit
C:\Windows\system\SwNNycI.exe

Filesize
1.5MB

MD5
be7592fd21c46db3758410bca2b3efc7

SHA1
aeadcfe4e88b7f1cb4d97dbd8c21e7b18948e245

SHA256
58420d326aa436a647617aa7186947720ab1a718733da1011d8f61d9fc10a84b

SHA512
68fb3a98c8819d84cbc2816c587cca5d56411db14cc444a6df8c73feb5889387996e182ab0b1bb2527567034cf0464e3e4f8cfb7b460ba06e89733dadadfbcdb

Download Submit
C:\Windows\system\VIqLwHO.exe

Filesize
1.5MB

MD5
0e078b410557709a40689edc21ed9d0a

SHA1
e90f2d2d5a1d996986244937e794788a846a8600

SHA256
c209c50dcdc8b36e632c0d21fc4bab1587456628eedf8d484c836f51e315bb07

SHA512
63afc0ac88a1f3c0ec83f360d09952382cd7afedcff32b6fdc5356be11e6fda9365b46f5c83bf115185ebfb8a87cb6ed14c11339c33bace80f490420027eb3c3

Download Submit
C:\Windows\system\Yiesxas.exe

Filesize
1.5MB

MD5
8e93012dabb135592ff2e475b5a3b04e

SHA1
282027ae2177fd49a05425cf56c7b92cdb0be65b

SHA256
a0a471dc3c3e1ca7feef25601b321ec6044fa61e7c1772f6e0afa049368c3184

SHA512
d2754db9b9d5d5e5f800745ec457b32ff2be60a11502f3de0a433d9e8415cd454e3e28fba506a107e94bee4c23c2a2cc19d5019996db857288638a90af07fa87

Download Submit
C:\Windows\system\aNEEIRE.exe

Filesize
1.5MB

MD5
02d883b9d76099ce9270f4dc9f7bd626

SHA1
eb5f1554aafed2aba4068ef704d12f36e8d17dd1

SHA256
32f4331d99644ef77d17d7e756a386ee1d75ea05967072f8b084acf1611740b0

SHA512
313b13dfa6ce5f6c85a09bc3758e3d4757007ed3fd7cea70f88b86248699c4d87b5008cdf1130dbc71fce966211ad74650a70614e560975bfc5206c7ad317438

Download Submit
C:\Windows\system\bGxeTWP.exe

Filesize
1.5MB

MD5
6b8fce9fb92391b964d1e40636ce0f26

SHA1
dea50ec093025da8a3a8430334290324150fd968

SHA256
963fd4f2af23c40f2a7ae0abf70ac93fc95f8656a6da0904ae034a45826fad3a

SHA512
80b5e8f8bd9a1c7aebe015b8a9b0d45a8e1f05b949d75b32a7c37949b47a8685706ccb3e303092a4770c5c96dfd42d3c9d23daf7b9db57c9ce2396b89bd6d733

Download Submit
C:\Windows\system\exSVeEw.exe

Filesize
1.5MB

MD5
e427fc17e5bf02d17e7145d684f760ed

SHA1
7364ff76764d41b39774d0d163d18572c7334596

SHA256
63dda1197e491241e314ab91985e642a13e00ce44b14b5b9582ccc9ef2d496f5

SHA512
48c0a1fd95dab3243b6bbecc706f3c597f741d41e33f7160e479bb41d22a0e7108322abc46f89fa3aabb033b41150a064dfbe20c39b0ab158e317a552c69e9d6

Download Submit
C:\Windows\system\gARSRiy.exe

Filesize
1.5MB

MD5
76ef3d4086fb48d23565db36af627766

SHA1
007a979825d51d53f2fbb537b79423035a4ea9a5

SHA256
6e08d339b0ea34ec21e7554aa5ad6459cf700a011ea4bd508c6d19aef648598e

SHA512
7373efe72fba46da9e8d720da92827614270ed6381f41da0d9ef5d35eb2a79aaa8f4cae5f0d34a619093416368d7b6ca45e58334896211f50435efe608a9b645

Download Submit
C:\Windows\system\gvgdhCu.exe

Filesize
1.5MB

MD5
09272fafd32780667f1f088c194d2d65

SHA1
83ba73be8d6da47494fe80d1c2fe47458306f8a8

SHA256
f9dd569df978008a2fd4ab490c8851996b6f1f9764bbe8064f3a6f1c36a09ae3

SHA512
77465bf594206bd20a0b741fa7dfbaa024bae9f98a4fdbd0c9daaf3f7909c77db124ac69706125ca28ebbb4a13a5b9f1389f84e74cfe3e6018938593bcbdc826

Download Submit
C:\Windows\system\mOpWpVe.exe

Filesize
1.5MB

MD5
90a7f005bdc73190afb33d1bd0beec82

SHA1
7790d70a38019d36717d5cd7523c3aa3a38f8262

SHA256
61326285ea3930201f164fd5f72915da6b65a706b5d561a7fd67bb18d56d7122

SHA512
92158e7bfb67523877d42a8384d22ae558c02794442533ac8aea60004f0007cc8ae300a97a1f3e03f811072f5456c46e800dc8070a2a2509f6d0e6efb76c304c

Download Submit
C:\Windows\system\mdjsZkQ.exe

Filesize
1.5MB

MD5
084ca3e2fef6d1a795c370bd8d6717d5

SHA1
b114385f085269fb237c3183780338b93b7f59b5

SHA256
983c90a0612616a27ce740de52f9ac508d54bf26ed6bd6fe7d2ec76c098a7b45

SHA512
2ca10a134672d928d6ea3a525aace0858fb22e7d3df112ee42b8a0a4b0e6c2c1128a24d7a33d57b127428a5d7cb42ee4fd55218cc400bbc75026f2e7313573ae

Download Submit
C:\Windows\system\mzTSFaT.exe

Filesize
1.5MB

MD5
f673be67f336e17471d044438c070469

SHA1
5a04cac73fada6b883c22e92a9b27c3661837fc8

SHA256
93ce93369c37a4276d593bfadfcfbf0e5ea7f4bd239968487756578429e54283

SHA512
3845813b00850bbebb2bf7d695787d10cc623ad6915e10093ac1633864fe646fad5f7025e850e9c02c2e97a231d9158fc93f5fb578fed61485da6d95e54d958a

Download Submit
C:\Windows\system\pGdRkCV.exe

Filesize
1.5MB

MD5
14c9ab233d0f09a9950185c21078ca27

SHA1
b8232be154ab984f67464788ac777b8ff7dba7dd

SHA256
4886a58307c95228256148f545a930e853ab0cf65f55ba025a95a898e994d164

SHA512
d7e20464eca3e7bcca2a129697c9a9ac67b0d4f7bfb6f99864c75d797792b7d7908af8e89d83c556c7df47c63207e1868730a8fd71df939191b8d50e948c1281

Download Submit
C:\Windows\system\rqskmgz.exe

Filesize
1.5MB

MD5
4180ddd5b9353546a288c099cccce904

SHA1
abc4a1d932aad43f1a69b5f9ee5c0311ef3fceab

SHA256
2a2b3c24a6f34673fcd553fbd7a075a3d18a67d8f8a14584c392617bd3d65725

SHA512
884f0b50f817b6cda9f58d4ee0a8d347f3ed39d20193b766dbcf9fdf472a499657bf466d173685b26ff1b878fd69854f3a3192cdac8337a0da0329ce871ef02a

Download Submit
C:\Windows\system\vqlTfoT.exe

Filesize
1.5MB

MD5
eff86e6034acc42dc32b3369840cc88f

SHA1
a1ff6563c9828c5075858a0be62f365bc9079638

SHA256
628af4777036565df765475c7587e7523305d4e5bdc4bcf7eba23fa30cba3d78

SHA512
6f5b7ea63ecf0d9394b046ac9af57c7ef25440cc752da2e40be68e62b8d42ddf8cb754edded48ae7eb3b8ab6d61f317c6d3195785f714126a787e6e6e1d606b4

Download Submit
C:\Windows\system\zbmwbBn.exe

Filesize
1.5MB

MD5
89d1feb29092135537f3f21a84c94414

SHA1
d05c454daf5f2223652921d08ba94af4a0846673

SHA256
65caea587aea6d2a19065ee96e95ed33ed8d9a4be5b524e01857a7eb29c837df

SHA512
98a346aa1566292ed359e854210a65d0859d8f8c1f4609e8722d2a1f996e1c21da384116da4a97315e829c9ec9ad6364143a05598b70ad8376458037affda2be

Download Submit
C:\Windows\system\zegdvtb.exe

Filesize
1.5MB

MD5
30ae59d30b05f683599c3aeea7000d6b

SHA1
b6a2bad0d90851e0e2b9100e7d644be7ce372c86

SHA256
5d9b1ba933578262e08731b3fc3dd901213fe5bb736727c191a6c21ba6f5f3ab

SHA512
0a59d606b0eaf3f94efd8caaa807241036e9538d16dbe9e827deda5cf86ae1d3b6253c8fc4b9d7ebf01c947d123eb1b49331b580968b6628aa3834a9a2e071a2

Download Submit
\Windows\system\KcCBenz.exe

Filesize
1.5MB

MD5
bcde5c21d0b133e82a3358164d973b52

SHA1
6ceedb0d79d85990b0f92c80211160eaab25a506

SHA256
554040b32b644081b5599c8d730bf010a383904ae7590878ae81978bd9f37516

SHA512
f6438fb4c6f1f22acaef50993ac2aa8bb9975c9800cf3e6166bc4cb056ec4fdf8cfbad5bef611d22faac488e0f62022e13dfe7284d993493c6d5cd697d02b18d

Download Submit
\Windows\system\VZrSJpO.exe

Filesize
1.5MB

MD5
3206f7d0b905db0fa37375e3b4f4ed2b

SHA1
c9cf420f8e3560c9056cc154228eb21301db614e

SHA256
05c873620dfa55ba07d45d16e66dd1c5662e1bb6277018828e0748f7e2130054

SHA512
bd087981faed6e9bb6d286e7f69b1d9966e474b4e151a265154ac4747ec0f8016f20be06ba2da43e731682be070d579cbafc663abd2ab95b4ff7e1f8a68cece6

Download Submit
\Windows\system\XzjybwT.exe

Filesize
1.5MB

MD5
dab5ce85b0a18cb32dfa91910b7a7e26

SHA1
e22c09db6ef637ee801f49086a507aaf9a59e524

SHA256
43ea3244db690847c8bdd61aabf92f67496c3bd7cbb1610bfb705c2f17283372

SHA512
5ca206d4749393c878cbb8540da181bd859f28090de8e57492f84f17bef76f404e7f7aea938963f860251996e269adc9e18fecfeb6ac21c5ec1f3545daf1a57b

Download Submit
\Windows\system\tBNlDZh.exe

Filesize
1.5MB

MD5
372d8ff7514f84eb834c9aa27970272f

SHA1
1bc0fd8b389e38d602a11205cffd4f06940ebcab

SHA256
c2421f1424ef7d4c3194c3f64db7b1b3b92ba04640cbcc0c4edcd65d199addb1

SHA512
48da54520bf1a3bea611f32f3157f5dda5828c43bd04e1283a5c4c1de1d47b69a1be2b2776bfd344d23e5ab9b3faa5524d2b487c6ad43f9222c7044350f9b1da

Download Submit
memory/700-97-0x000000013FF40000-0x0000000140332000-memory.dmp

Filesize
3.9MB

Download
memory/1688-67-0x000007FEF5E60000-0x000007FEF67FD000-memory.dmp

Filesize
9.6MB

Download
memory/1688-27-0x000007FEF5E60000-0x000007FEF67FD000-memory.dmp

Filesize
9.6MB

Download
memory/1688-56-0x000007FEF5E60000-0x000007FEF67FD000-memory.dmp

Filesize
9.6MB

Download
memory/1688-31-0x000007FEF5E60000-0x000007FEF67FD000-memory.dmp

Filesize
9.6MB

Download
memory/1688-38-0x000007FEF5E60000-0x000007FEF67FD000-memory.dmp

Filesize
9.6MB

Download
memory/1688-72-0x000007FEF5E60000-0x000007FEF67FD000-memory.dmp

Filesize
9.6MB

Download
memory/1688-23-0x000007FEF5E60000-0x000007FEF67FD000-memory.dmp

Filesize
9.6MB

Download
memory/1688-87-0x000007FEF5E60000-0x000007FEF67FD000-memory.dmp

Filesize
9.6MB

Download
memory/1688-22-0x000007FEF5E60000-0x000007FEF67FD000-memory.dmp

Filesize
9.6MB

Download
memory/1688-21-0x0000000001D80000-0x0000000001D88000-memory.dmp

Filesize
32KB

Download
memory/1688-20-0x000000001B670000-0x000000001B952000-memory.dmp

Filesize
2.9MB

Download
memory/1688-63-0x000007FEF5E60000-0x000007FEF67FD000-memory.dmp

Filesize
9.6MB

Download
memory/1688-14-0x000007FEF611E000-0x000007FEF611F000-memory.dmp

Filesize
4KB

Download
memory/1984-74-0x000000013F860000-0x000000013FC52000-memory.dmp

Filesize
3.9MB

Download
memory/1984-350-0x000000013F860000-0x000000013FC52000-memory.dmp

Filesize
3.9MB

Download
memory/2192-104-0x000000013F2A0000-0x000000013F692000-memory.dmp

Filesize
3.9MB

Download
memory/2192-54-0x000000013F2A0000-0x000000013F692000-memory.dmp

Filesize
3.9MB

Download
memory/2428-5003-0x000000013F250000-0x000000013F642000-memory.dmp

Filesize
3.9MB

Download
memory/2428-106-0x000000013F250000-0x000000013F642000-memory.dmp

Filesize
3.9MB

Download
memory/2584-34-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download
memory/2584-4528-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download
memory/2616-66-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/2620-49-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/2620-4584-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/2676-4494-0x000000013FC50000-0x0000000140042000-memory.dmp

Filesize
3.9MB

Download
memory/2676-30-0x000000013FC50000-0x0000000140042000-memory.dmp

Filesize
3.9MB

Download
memory/2740-0-0x000000013FC40000-0x0000000140032000-memory.dmp

Filesize
3.9MB

Download
memory/2740-73-0x0000000003300000-0x00000000036F2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2740-32-0x00000000031A0000-0x0000000003592000-memory.dmp

Filesize
3.9MB

Download
memory/2740-40-0x0000000003300000-0x00000000036F2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-105-0x000000013F250000-0x000000013F642000-memory.dmp

Filesize
3.9MB

Download
memory/2740-33-0x0000000003300000-0x00000000036F2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-1556-0x000000013F250000-0x000000013F642000-memory.dmp

Filesize
3.9MB

Download
memory/2740-222-0x0000000003300000-0x00000000036F2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-485-0x0000000003300000-0x00000000036F2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-349-0x0000000003300000-0x00000000036F2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-95-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/2740-78-0x0000000003300000-0x00000000036F2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-61-0x000000013FC40000-0x0000000140032000-memory.dmp

Filesize
3.9MB

Download
memory/2740-12-0x000000013F650000-0x000000013FA42000-memory.dmp

Filesize
3.9MB

Download
memory/2740-98-0x0000000003300000-0x00000000036F2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-53-0x000000013F2A0000-0x000000013F692000-memory.dmp

Filesize
3.9MB

Download
memory/2740-48-0x0000000003300000-0x00000000036F2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-65-0x0000000003300000-0x00000000036F2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-755-0x0000000003300000-0x00000000036F2000-memory.dmp

Filesize
3.9MB

Download
memory/2752-13-0x000000013F650000-0x000000013FA42000-memory.dmp

Filesize
3.9MB

Download
memory/2752-4491-0x000000013F650000-0x000000013FA42000-memory.dmp

Filesize
3.9MB

Download
memory/2836-81-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/2836-4725-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/2836-41-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/2860-96-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/2860-4679-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/2868-80-0x000000013F960000-0x000000013FD52000-memory.dmp

Filesize
3.9MB

Download
memory/2868-487-0x000000013F960000-0x000000013FD52000-memory.dmp

Filesize
3.9MB

Download