xmrig | 3432451df8aad17ba60664446662692f6e7733e95009d73f7af29ed99bc18281

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/09/2024, 19:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f532f79a96c14af4d39c1dd6c7398bd0N.exe
Size

2.0MB
MD5

f532f79a96c14af4d39c1dd6c7398bd0
SHA1

9ce46bb57032cda90d2aa4af18998510e16a2ede
SHA256

3432451df8aad17ba60664446662692f6e7733e95009d73f7af29ed99bc18281
SHA512

9da4668a35f331387fb36df99805d0748911bf6468849a412e85af88e68e8dfc31e7f5e99c730164bdee56134eee0b09ca459a4192b94cc56d6d2d27592941c4
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHqx4EKB6Se:NABO

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 27 IoCs

miner

resource	yara_rule
behavioral1/memory/2744-9-0x000000013F380000-0x000000013F772000-memory.dmp	xmrig
behavioral1/memory/2892-16-0x000000013F930000-0x000000013FD22000-memory.dmp	xmrig
behavioral1/memory/2892-193-0x000000013F930000-0x000000013FD22000-memory.dmp	xmrig
behavioral1/memory/2164-215-0x000000013FCC0000-0x00000001400B2000-memory.dmp	xmrig
behavioral1/memory/2564-260-0x000000013FE60000-0x0000000140252000-memory.dmp	xmrig
behavioral1/memory/2592-191-0x000000013FD10000-0x0000000140102000-memory.dmp	xmrig
behavioral1/memory/928-162-0x000000013F180000-0x000000013F572000-memory.dmp	xmrig
behavioral1/memory/2476-160-0x000000013F190000-0x000000013F582000-memory.dmp	xmrig
behavioral1/memory/1608-158-0x000000013F430000-0x000000013F822000-memory.dmp	xmrig
behavioral1/memory/2616-156-0x000000013F810000-0x000000013FC02000-memory.dmp	xmrig
behavioral1/memory/2500-154-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	xmrig
behavioral1/memory/3052-152-0x000000013FEB0000-0x00000001402A2000-memory.dmp	xmrig
behavioral1/memory/2708-150-0x000000013F520000-0x000000013F912000-memory.dmp	xmrig
behavioral1/memory/2640-148-0x000000013F070000-0x000000013F462000-memory.dmp	xmrig
behavioral1/memory/2800-146-0x000000013F3B0000-0x000000013F7A2000-memory.dmp	xmrig
behavioral1/memory/3052-1830-0x000000013FEB0000-0x00000001402A2000-memory.dmp	xmrig
behavioral1/memory/2616-1831-0x000000013F810000-0x000000013FC02000-memory.dmp	xmrig
behavioral1/memory/2800-1832-0x000000013F3B0000-0x000000013F7A2000-memory.dmp	xmrig
behavioral1/memory/2892-1833-0x000000013F930000-0x000000013FD22000-memory.dmp	xmrig
behavioral1/memory/2476-2070-0x000000013F190000-0x000000013F582000-memory.dmp	xmrig
behavioral1/memory/2640-2091-0x000000013F070000-0x000000013F462000-memory.dmp	xmrig
behavioral1/memory/1608-2134-0x000000013F430000-0x000000013F822000-memory.dmp	xmrig
behavioral1/memory/2500-2133-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	xmrig
behavioral1/memory/2164-2151-0x000000013FCC0000-0x00000001400B2000-memory.dmp	xmrig
behavioral1/memory/928-2158-0x000000013F180000-0x000000013F572000-memory.dmp	xmrig
behavioral1/memory/2744-2148-0x000000013F380000-0x000000013F772000-memory.dmp	xmrig
behavioral1/memory/2708-2118-0x000000013F520000-0x000000013F912000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2416	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2744	yOQDwYo.exe
2892	moSySJA.exe
2164	nWxXrqk.exe
2800	yAjqkzH.exe
2640	ZGqDMnB.exe
2708	efhwlaW.exe
3052	VpSdVmm.exe
2500	iWPBUiY.exe
2616	RBDJlGc.exe
1608	CvdgwqF.exe
2476	oMKEGHC.exe
928	goXOutM.exe
2564	usLRxBj.exe
1092	jhityBN.exe
1148	cTYIJwU.exe
2696	JPlikDO.exe
1476	NOPZsEW.exe
2952	HLUDOUQ.exe
2904	rRkkatL.exe
908	bYqlFnV.exe
1068	nAafQlp.exe
2260	LlrMpPj.exe
2520	MJGKIEp.exe
1100	daElaED.exe
2984	dneGipA.exe
2284	jEFbOJJ.exe
580	DcJcwIU.exe
2148	yGMJVCI.exe
2488	qmrFCdX.exe
1668	rWhvwpj.exe
1448	cPkhQVW.exe
2612	iUVURps.exe
1804	OBJxMHH.exe
2604	GcKqvqN.exe
1568	NpANdCF.exe
628	sBzXOUN.exe
1780	hxjaucp.exe
1732	GIBoEoe.exe
916	NDsRVPc.exe
2212	LEybtav.exe
2204	mpfwxBG.exe
472	JGiHLMf.exe
3020	nYlrxFM.exe
2960	UKqTrIV.exe
888	yLvIuGq.exe
3032	KpEeSoq.exe
2248	cfYZjxQ.exe
1684	NZPERdk.exe
2196	xtTVFhe.exe
2752	wLwIkxw.exe
2692	WKTdRnN.exe
2832	jLRjgZB.exe
3060	ChdjMJh.exe
1056	SfakdVH.exe
2124	BvPCzNh.exe
1984	OpxdDaU.exe
1076	ZakruQL.exe
2120	wKuIQMb.exe
2668	VfSyHen.exe
2872	SSmaTCp.exe
2544	jwrLQYZ.exe
2812	JGQnHzD.exe
964	DbzGewx.exe
1084	ZgFdwxm.exe

Loads dropped DLL 64 IoCs

pid	Process
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe

UPX packed file 61 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2592-0-0x000000013FD10000-0x0000000140102000-memory.dmp	upx
behavioral1/files/0x000d000000012255-3.dat	upx
behavioral1/memory/2744-9-0x000000013F380000-0x000000013F772000-memory.dmp	upx
behavioral1/files/0x0007000000018b3e-13.dat	upx
behavioral1/memory/2892-16-0x000000013F930000-0x000000013FD22000-memory.dmp	upx
behavioral1/memory/2164-27-0x000000013FCC0000-0x00000001400B2000-memory.dmp	upx
behavioral1/files/0x0007000000018b4d-12.dat	upx
behavioral1/files/0x001700000000558f-32.dat	upx
behavioral1/files/0x0006000000018b62-41.dat	upx
behavioral1/files/0x0007000000018b6e-52.dat	upx
behavioral1/files/0x0005000000018fca-61.dat	upx
behavioral1/files/0x0005000000018fcd-66.dat	upx
behavioral1/files/0x0005000000018fe2-71.dat	upx
behavioral1/files/0x000500000001901a-81.dat	upx
behavioral1/files/0x00040000000191c8-139.dat	upx
behavioral1/files/0x00040000000191da-141.dat	upx
behavioral1/files/0x0023000000018ab4-167.dat	upx
behavioral1/files/0x00040000000191ed-172.dat	upx
behavioral1/files/0x00040000000192ad-188.dat	upx
behavioral1/memory/2892-193-0x000000013F930000-0x000000013FD22000-memory.dmp	upx
behavioral1/files/0x00040000000192d3-196.dat	upx
behavioral1/memory/2164-215-0x000000013FCC0000-0x00000001400B2000-memory.dmp	upx
behavioral1/memory/2564-260-0x000000013FE60000-0x0000000140252000-memory.dmp	upx
behavioral1/memory/2592-191-0x000000013FD10000-0x0000000140102000-memory.dmp	upx
behavioral1/files/0x0004000000019206-183.dat	upx
behavioral1/files/0x00040000000191f7-177.dat	upx
behavioral1/memory/928-162-0x000000013F180000-0x000000013F572000-memory.dmp	upx
behavioral1/memory/2476-160-0x000000013F190000-0x000000013F582000-memory.dmp	upx
behavioral1/memory/1608-158-0x000000013F430000-0x000000013F822000-memory.dmp	upx
behavioral1/memory/2616-156-0x000000013F810000-0x000000013FC02000-memory.dmp	upx
behavioral1/memory/2500-154-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	upx
behavioral1/memory/3052-152-0x000000013FEB0000-0x00000001402A2000-memory.dmp	upx
behavioral1/memory/2708-150-0x000000013F520000-0x000000013F912000-memory.dmp	upx
behavioral1/memory/2640-148-0x000000013F070000-0x000000013F462000-memory.dmp	upx
behavioral1/memory/2800-146-0x000000013F3B0000-0x000000013F7A2000-memory.dmp	upx
behavioral1/files/0x00040000000191b3-117.dat	upx
behavioral1/files/0x000400000001915a-110.dat	upx
behavioral1/files/0x00040000000191d2-131.dat	upx
behavioral1/files/0x00040000000191bb-123.dat	upx
behavioral1/files/0x000400000001919b-115.dat	upx
behavioral1/files/0x000500000001904d-107.dat	upx
behavioral1/files/0x0005000000019074-106.dat	upx
behavioral1/files/0x000500000001903d-91.dat	upx
behavioral1/files/0x0005000000019044-97.dat	upx
behavioral1/files/0x0005000000019028-86.dat	upx
behavioral1/files/0x0005000000018ffa-76.dat	upx
behavioral1/files/0x0006000000018e46-56.dat	upx
behavioral1/files/0x0007000000018b64-47.dat	upx
behavioral1/files/0x0007000000018b5d-37.dat	upx
behavioral1/memory/3052-1830-0x000000013FEB0000-0x00000001402A2000-memory.dmp	upx
behavioral1/memory/2616-1831-0x000000013F810000-0x000000013FC02000-memory.dmp	upx
behavioral1/memory/2800-1832-0x000000013F3B0000-0x000000013F7A2000-memory.dmp	upx
behavioral1/memory/2892-1833-0x000000013F930000-0x000000013FD22000-memory.dmp	upx
behavioral1/memory/2476-2070-0x000000013F190000-0x000000013F582000-memory.dmp	upx
behavioral1/memory/2640-2091-0x000000013F070000-0x000000013F462000-memory.dmp	upx
behavioral1/memory/1608-2134-0x000000013F430000-0x000000013F822000-memory.dmp	upx
behavioral1/memory/2500-2133-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	upx
behavioral1/memory/2164-2151-0x000000013FCC0000-0x00000001400B2000-memory.dmp	upx
behavioral1/memory/928-2158-0x000000013F180000-0x000000013F572000-memory.dmp	upx
behavioral1/memory/2744-2148-0x000000013F380000-0x000000013F772000-memory.dmp	upx
behavioral1/memory/2708-2118-0x000000013F520000-0x000000013F912000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\rfdIRCX.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\UbQfggB.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\gAjhlas.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\AuiNCCS.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\FnOWbXs.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\kjBHSTx.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\wuqKFQJ.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\pIFlydq.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\EqHkdge.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\rYrRPEc.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\MPYXaAu.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\UxANCid.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\bYotBba.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\ugesvcU.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\UkXittj.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\WqciecC.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\gmMzxPd.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\mBpeOSt.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\RXEwxRJ.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\HDPPrhl.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\JxdiCHJ.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\lhAZygn.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\tgQjThB.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\NpANdCF.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\wRczCRM.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\DopnBXR.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\rYtLmQI.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\VyKxwQO.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\VzcQjTv.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\XkDekIo.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\kpIRfqs.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\ZhexbBY.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\aLxALnq.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\JRzkNII.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\Ptyeclw.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\lwDFmVU.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\KemtGpf.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\agWQvBI.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\ByExYKK.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\nqnrjbJ.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\MTiZLmI.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\ovEwumL.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\lTOqAjz.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\BLBYwYk.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\ZTQLXKj.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\JHFnNGN.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\ELHBAay.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\iBhZmTW.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\oLVeThO.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\kxfjgxw.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\ItKfJJZ.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\JPlikDO.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\LlrMpPj.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\EmYEvmQ.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\GCnDMOk.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\qroyshU.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\xfBpiiQ.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\DbzGewx.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\mJLMcTO.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\bBdczYv.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\RVHHMfg.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\jvlRGwc.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\GSVrMDx.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe
File created	C:\Windows\System\vJUMQzF.exe	f532f79a96c14af4d39c1dd6c7398bd0N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2416	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
Token: SeLockMemoryPrivilege	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe
Token: SeDebugPrivilege	2416	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 2416	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	30
PID 2592 wrote to memory of 2416	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	30
PID 2592 wrote to memory of 2416	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	30
PID 2592 wrote to memory of 2744	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	31
PID 2592 wrote to memory of 2744	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	31
PID 2592 wrote to memory of 2744	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	31
PID 2592 wrote to memory of 2892	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	32
PID 2592 wrote to memory of 2892	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	32
PID 2592 wrote to memory of 2892	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	32
PID 2592 wrote to memory of 2164	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	33
PID 2592 wrote to memory of 2164	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	33
PID 2592 wrote to memory of 2164	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	33
PID 2592 wrote to memory of 2800	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	34
PID 2592 wrote to memory of 2800	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	34
PID 2592 wrote to memory of 2800	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	34
PID 2592 wrote to memory of 2640	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	35
PID 2592 wrote to memory of 2640	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	35
PID 2592 wrote to memory of 2640	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	35
PID 2592 wrote to memory of 2708	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	36
PID 2592 wrote to memory of 2708	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	36
PID 2592 wrote to memory of 2708	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	36
PID 2592 wrote to memory of 3052	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	37
PID 2592 wrote to memory of 3052	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	37
PID 2592 wrote to memory of 3052	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	37
PID 2592 wrote to memory of 2500	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	38
PID 2592 wrote to memory of 2500	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	38
PID 2592 wrote to memory of 2500	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	38
PID 2592 wrote to memory of 2616	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	39
PID 2592 wrote to memory of 2616	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	39
PID 2592 wrote to memory of 2616	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	39
PID 2592 wrote to memory of 1608	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	40
PID 2592 wrote to memory of 1608	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	40
PID 2592 wrote to memory of 1608	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	40
PID 2592 wrote to memory of 2476	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	41
PID 2592 wrote to memory of 2476	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	41
PID 2592 wrote to memory of 2476	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	41
PID 2592 wrote to memory of 928	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	42
PID 2592 wrote to memory of 928	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	42
PID 2592 wrote to memory of 928	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	42
PID 2592 wrote to memory of 2564	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	43
PID 2592 wrote to memory of 2564	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	43
PID 2592 wrote to memory of 2564	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	43
PID 2592 wrote to memory of 1092	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	44
PID 2592 wrote to memory of 1092	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	44
PID 2592 wrote to memory of 1092	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	44
PID 2592 wrote to memory of 1148	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	45
PID 2592 wrote to memory of 1148	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	45
PID 2592 wrote to memory of 1148	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	45
PID 2592 wrote to memory of 2696	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	46
PID 2592 wrote to memory of 2696	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	46
PID 2592 wrote to memory of 2696	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	46
PID 2592 wrote to memory of 1476	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	47
PID 2592 wrote to memory of 1476	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	47
PID 2592 wrote to memory of 1476	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	47
PID 2592 wrote to memory of 2904	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	48
PID 2592 wrote to memory of 2904	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	48
PID 2592 wrote to memory of 2904	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	48
PID 2592 wrote to memory of 2952	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	49
PID 2592 wrote to memory of 2952	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	49
PID 2592 wrote to memory of 2952	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	49
PID 2592 wrote to memory of 2520	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	50
PID 2592 wrote to memory of 2520	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	50
PID 2592 wrote to memory of 2520	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	50
PID 2592 wrote to memory of 908	2592	f532f79a96c14af4d39c1dd6c7398bd0N.exe	51

C:\Users\Admin\AppData\Local\Temp\f532f79a96c14af4d39c1dd6c7398bd0N.exe
"C:\Users\Admin\AppData\Local\Temp\f532f79a96c14af4d39c1dd6c7398bd0N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2416
- C:\Windows\System\yOQDwYo.exe
  C:\Windows\System\yOQDwYo.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\moSySJA.exe
  C:\Windows\System\moSySJA.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\nWxXrqk.exe
  C:\Windows\System\nWxXrqk.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\yAjqkzH.exe
  C:\Windows\System\yAjqkzH.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\ZGqDMnB.exe
  C:\Windows\System\ZGqDMnB.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\efhwlaW.exe
  C:\Windows\System\efhwlaW.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\VpSdVmm.exe
  C:\Windows\System\VpSdVmm.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\iWPBUiY.exe
  C:\Windows\System\iWPBUiY.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\RBDJlGc.exe
  C:\Windows\System\RBDJlGc.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\CvdgwqF.exe
  C:\Windows\System\CvdgwqF.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\oMKEGHC.exe
  C:\Windows\System\oMKEGHC.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\goXOutM.exe
  C:\Windows\System\goXOutM.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\usLRxBj.exe
  C:\Windows\System\usLRxBj.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\jhityBN.exe
  C:\Windows\System\jhityBN.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\cTYIJwU.exe
  C:\Windows\System\cTYIJwU.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\JPlikDO.exe
  C:\Windows\System\JPlikDO.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\NOPZsEW.exe
  C:\Windows\System\NOPZsEW.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\rRkkatL.exe
  C:\Windows\System\rRkkatL.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\HLUDOUQ.exe
  C:\Windows\System\HLUDOUQ.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\MJGKIEp.exe
  C:\Windows\System\MJGKIEp.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\bYqlFnV.exe
  C:\Windows\System\bYqlFnV.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\daElaED.exe
  C:\Windows\System\daElaED.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\nAafQlp.exe
  C:\Windows\System\nAafQlp.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\dneGipA.exe
  C:\Windows\System\dneGipA.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\LlrMpPj.exe
  C:\Windows\System\LlrMpPj.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\jEFbOJJ.exe
  C:\Windows\System\jEFbOJJ.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\DcJcwIU.exe
  C:\Windows\System\DcJcwIU.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\yGMJVCI.exe
  C:\Windows\System\yGMJVCI.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\qmrFCdX.exe
  C:\Windows\System\qmrFCdX.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\rWhvwpj.exe
  C:\Windows\System\rWhvwpj.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\cPkhQVW.exe
  C:\Windows\System\cPkhQVW.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\iUVURps.exe
  C:\Windows\System\iUVURps.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\OBJxMHH.exe
  C:\Windows\System\OBJxMHH.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\GcKqvqN.exe
  C:\Windows\System\GcKqvqN.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\NpANdCF.exe
  C:\Windows\System\NpANdCF.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\sBzXOUN.exe
  C:\Windows\System\sBzXOUN.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\hxjaucp.exe
  C:\Windows\System\hxjaucp.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\GIBoEoe.exe
  C:\Windows\System\GIBoEoe.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\NDsRVPc.exe
  C:\Windows\System\NDsRVPc.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\mpfwxBG.exe
  C:\Windows\System\mpfwxBG.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\LEybtav.exe
  C:\Windows\System\LEybtav.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\nYlrxFM.exe
  C:\Windows\System\nYlrxFM.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\JGiHLMf.exe
  C:\Windows\System\JGiHLMf.exe
  2⤵
  - Executes dropped EXE
  PID:472
- C:\Windows\System\UKqTrIV.exe
  C:\Windows\System\UKqTrIV.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\yLvIuGq.exe
  C:\Windows\System\yLvIuGq.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\KpEeSoq.exe
  C:\Windows\System\KpEeSoq.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\cfYZjxQ.exe
  C:\Windows\System\cfYZjxQ.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\NZPERdk.exe
  C:\Windows\System\NZPERdk.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\xtTVFhe.exe
  C:\Windows\System\xtTVFhe.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\wLwIkxw.exe
  C:\Windows\System\wLwIkxw.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\WKTdRnN.exe
  C:\Windows\System\WKTdRnN.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\jLRjgZB.exe
  C:\Windows\System\jLRjgZB.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\ChdjMJh.exe
  C:\Windows\System\ChdjMJh.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\SfakdVH.exe
  C:\Windows\System\SfakdVH.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\BvPCzNh.exe
  C:\Windows\System\BvPCzNh.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\OpxdDaU.exe
  C:\Windows\System\OpxdDaU.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\ZakruQL.exe
  C:\Windows\System\ZakruQL.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\wKuIQMb.exe
  C:\Windows\System\wKuIQMb.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\VfSyHen.exe
  C:\Windows\System\VfSyHen.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\SSmaTCp.exe
  C:\Windows\System\SSmaTCp.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\jwrLQYZ.exe
  C:\Windows\System\jwrLQYZ.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\JGQnHzD.exe
  C:\Windows\System\JGQnHzD.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\DbzGewx.exe
  C:\Windows\System\DbzGewx.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\ZgFdwxm.exe
  C:\Windows\System\ZgFdwxm.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\woXhDXc.exe
  C:\Windows\System\woXhDXc.exe
  2⤵
  PID:1632
- C:\Windows\System\tqTSTlp.exe
  C:\Windows\System\tqTSTlp.exe
  2⤵
  PID:2704
- C:\Windows\System\tnPDBrs.exe
  C:\Windows\System\tnPDBrs.exe
  2⤵
  PID:2404
- C:\Windows\System\XncjSfB.exe
  C:\Windows\System\XncjSfB.exe
  2⤵
  PID:2816
- C:\Windows\System\ySQksFu.exe
  C:\Windows\System\ySQksFu.exe
  2⤵
  PID:2184
- C:\Windows\System\gVhHAVO.exe
  C:\Windows\System\gVhHAVO.exe
  2⤵
  PID:1936
- C:\Windows\System\mBpeOSt.exe
  C:\Windows\System\mBpeOSt.exe
  2⤵
  PID:360
- C:\Windows\System\CIJiFEU.exe
  C:\Windows\System\CIJiFEU.exe
  2⤵
  PID:2860
- C:\Windows\System\orrAExJ.exe
  C:\Windows\System\orrAExJ.exe
  2⤵
  PID:1000
- C:\Windows\System\OMgPVJW.exe
  C:\Windows\System\OMgPVJW.exe
  2⤵
  PID:2024
- C:\Windows\System\opzymSn.exe
  C:\Windows\System\opzymSn.exe
  2⤵
  PID:1528
- C:\Windows\System\zPlUaIG.exe
  C:\Windows\System\zPlUaIG.exe
  2⤵
  PID:1500
- C:\Windows\System\MiAjtoQ.exe
  C:\Windows\System\MiAjtoQ.exe
  2⤵
  PID:936
- C:\Windows\System\ICxJoii.exe
  C:\Windows\System\ICxJoii.exe
  2⤵
  PID:1624
- C:\Windows\System\OtkPNKD.exe
  C:\Windows\System\OtkPNKD.exe
  2⤵
  PID:2056
- C:\Windows\System\RXEwxRJ.exe
  C:\Windows\System\RXEwxRJ.exe
  2⤵
  PID:1168
- C:\Windows\System\xthxyzM.exe
  C:\Windows\System\xthxyzM.exe
  2⤵
  PID:2980
- C:\Windows\System\dBUSujH.exe
  C:\Windows\System\dBUSujH.exe
  2⤵
  PID:1248
- C:\Windows\System\qNleyNB.exe
  C:\Windows\System\qNleyNB.exe
  2⤵
  PID:2784
- C:\Windows\System\OLXEoRc.exe
  C:\Windows\System\OLXEoRc.exe
  2⤵
  PID:2840
- C:\Windows\System\vKmbuZI.exe
  C:\Windows\System\vKmbuZI.exe
  2⤵
  PID:1912
- C:\Windows\System\JVqgbrN.exe
  C:\Windows\System\JVqgbrN.exe
  2⤵
  PID:2388
- C:\Windows\System\GafPVdr.exe
  C:\Windows\System\GafPVdr.exe
  2⤵
  PID:2964
- C:\Windows\System\gFKBKEr.exe
  C:\Windows\System\gFKBKEr.exe
  2⤵
  PID:2956
- C:\Windows\System\gRBfYOw.exe
  C:\Windows\System\gRBfYOw.exe
  2⤵
  PID:2656
- C:\Windows\System\mJLMcTO.exe
  C:\Windows\System\mJLMcTO.exe
  2⤵
  PID:2776
- C:\Windows\System\rhphlet.exe
  C:\Windows\System\rhphlet.exe
  2⤵
  PID:1996
- C:\Windows\System\FPpvlxh.exe
  C:\Windows\System\FPpvlxh.exe
  2⤵
  PID:2268
- C:\Windows\System\DfiEWJD.exe
  C:\Windows\System\DfiEWJD.exe
  2⤵
  PID:1700
- C:\Windows\System\fBDHaLv.exe
  C:\Windows\System\fBDHaLv.exe
  2⤵
  PID:2880
- C:\Windows\System\sueMuKW.exe
  C:\Windows\System\sueMuKW.exe
  2⤵
  PID:2528
- C:\Windows\System\EKJiQAx.exe
  C:\Windows\System\EKJiQAx.exe
  2⤵
  PID:968
- C:\Windows\System\vHCCDXJ.exe
  C:\Windows\System\vHCCDXJ.exe
  2⤵
  PID:2240
- C:\Windows\System\iGNPRUO.exe
  C:\Windows\System\iGNPRUO.exe
  2⤵
  PID:3000
- C:\Windows\System\XkDekIo.exe
  C:\Windows\System\XkDekIo.exe
  2⤵
  PID:2444
- C:\Windows\System\AEtAFgS.exe
  C:\Windows\System\AEtAFgS.exe
  2⤵
  PID:1180
- C:\Windows\System\kYKusSo.exe
  C:\Windows\System\kYKusSo.exe
  2⤵
  PID:796
- C:\Windows\System\zViwuos.exe
  C:\Windows\System\zViwuos.exe
  2⤵
  PID:284
- C:\Windows\System\eZOrcSH.exe
  C:\Windows\System\eZOrcSH.exe
  2⤵
  PID:2116
- C:\Windows\System\eYrDuJt.exe
  C:\Windows\System\eYrDuJt.exe
  2⤵
  PID:1332
- C:\Windows\System\ikVseLW.exe
  C:\Windows\System\ikVseLW.exe
  2⤵
  PID:1352
- C:\Windows\System\YfldVTr.exe
  C:\Windows\System\YfldVTr.exe
  2⤵
  PID:1120
- C:\Windows\System\DhTwbvB.exe
  C:\Windows\System\DhTwbvB.exe
  2⤵
  PID:1452
- C:\Windows\System\kePKGFX.exe
  C:\Windows\System\kePKGFX.exe
  2⤵
  PID:2884
- C:\Windows\System\AaCDDXf.exe
  C:\Windows\System\AaCDDXf.exe
  2⤵
  PID:2900
- C:\Windows\System\ocCLRoL.exe
  C:\Windows\System\ocCLRoL.exe
  2⤵
  PID:548
- C:\Windows\System\RdqxPbJ.exe
  C:\Windows\System\RdqxPbJ.exe
  2⤵
  PID:920
- C:\Windows\System\bTTFozp.exe
  C:\Windows\System\bTTFozp.exe
  2⤵
  PID:112
- C:\Windows\System\tfmlHAW.exe
  C:\Windows\System\tfmlHAW.exe
  2⤵
  PID:1208
- C:\Windows\System\uYaDFor.exe
  C:\Windows\System\uYaDFor.exe
  2⤵
  PID:2768
- C:\Windows\System\NtrqaVo.exe
  C:\Windows\System\NtrqaVo.exe
  2⤵
  PID:1636
- C:\Windows\System\AQLNLGW.exe
  C:\Windows\System\AQLNLGW.exe
  2⤵
  PID:2844
- C:\Windows\System\PyVMVzR.exe
  C:\Windows\System\PyVMVzR.exe
  2⤵
  PID:1724
- C:\Windows\System\thRnewr.exe
  C:\Windows\System\thRnewr.exe
  2⤵
  PID:1968
- C:\Windows\System\aeEcXsz.exe
  C:\Windows\System\aeEcXsz.exe
  2⤵
  PID:3044
- C:\Windows\System\FHQCkHK.exe
  C:\Windows\System\FHQCkHK.exe
  2⤵
  PID:1064
- C:\Windows\System\EoNfHJV.exe
  C:\Windows\System\EoNfHJV.exe
  2⤵
  PID:2944
- C:\Windows\System\CGkQpdF.exe
  C:\Windows\System\CGkQpdF.exe
  2⤵
  PID:2448
- C:\Windows\System\jrqZKwp.exe
  C:\Windows\System\jrqZKwp.exe
  2⤵
  PID:1016
- C:\Windows\System\CIRuFXH.exe
  C:\Windows\System\CIRuFXH.exe
  2⤵
  PID:856
- C:\Windows\System\AOsIhal.exe
  C:\Windows\System\AOsIhal.exe
  2⤵
  PID:1572
- C:\Windows\System\GylBacr.exe
  C:\Windows\System\GylBacr.exe
  2⤵
  PID:2536
- C:\Windows\System\vZuQhiR.exe
  C:\Windows\System\vZuQhiR.exe
  2⤵
  PID:2940
- C:\Windows\System\hdJyNXU.exe
  C:\Windows\System\hdJyNXU.exe
  2⤵
  PID:2760
- C:\Windows\System\IGeOhkY.exe
  C:\Windows\System\IGeOhkY.exe
  2⤵
  PID:2676
- C:\Windows\System\sQFZGoI.exe
  C:\Windows\System\sQFZGoI.exe
  2⤵
  PID:2080
- C:\Windows\System\vilVxrS.exe
  C:\Windows\System\vilVxrS.exe
  2⤵
  PID:956
- C:\Windows\System\WxLwVbV.exe
  C:\Windows\System\WxLwVbV.exe
  2⤵
  PID:1588
- C:\Windows\System\Tjnvhqq.exe
  C:\Windows\System\Tjnvhqq.exe
  2⤵
  PID:2320
- C:\Windows\System\HWLHnpT.exe
  C:\Windows\System\HWLHnpT.exe
  2⤵
  PID:3068
- C:\Windows\System\HkeCnrB.exe
  C:\Windows\System\HkeCnrB.exe
  2⤵
  PID:1532
- C:\Windows\System\yoAKfVC.exe
  C:\Windows\System\yoAKfVC.exe
  2⤵
  PID:3016
- C:\Windows\System\XldiLBA.exe
  C:\Windows\System\XldiLBA.exe
  2⤵
  PID:632
- C:\Windows\System\VeEANbi.exe
  C:\Windows\System\VeEANbi.exe
  2⤵
  PID:1980
- C:\Windows\System\DOMGBcX.exe
  C:\Windows\System\DOMGBcX.exe
  2⤵
  PID:952
- C:\Windows\System\gIZuijt.exe
  C:\Windows\System\gIZuijt.exe
  2⤵
  PID:3056
- C:\Windows\System\KphsDiM.exe
  C:\Windows\System\KphsDiM.exe
  2⤵
  PID:1748
- C:\Windows\System\KemtGpf.exe
  C:\Windows\System\KemtGpf.exe
  2⤵
  PID:2216
- C:\Windows\System\uazrMcW.exe
  C:\Windows\System\uazrMcW.exe
  2⤵
  PID:1688
- C:\Windows\System\ZTQLXKj.exe
  C:\Windows\System\ZTQLXKj.exe
  2⤵
  PID:2792
- C:\Windows\System\zDhFwCb.exe
  C:\Windows\System\zDhFwCb.exe
  2⤵
  PID:2756
- C:\Windows\System\XXgKBcO.exe
  C:\Windows\System\XXgKBcO.exe
  2⤵
  PID:2736
- C:\Windows\System\leoovpf.exe
  C:\Windows\System\leoovpf.exe
  2⤵
  PID:1276
- C:\Windows\System\RAmGbvn.exe
  C:\Windows\System\RAmGbvn.exe
  2⤵
  PID:524
- C:\Windows\System\GyKmSvR.exe
  C:\Windows\System\GyKmSvR.exe
  2⤵
  PID:2484
- C:\Windows\System\vjaKheY.exe
  C:\Windows\System\vjaKheY.exe
  2⤵
  PID:2188
- C:\Windows\System\rLXMfKK.exe
  C:\Windows\System\rLXMfKK.exe
  2⤵
  PID:2848
- C:\Windows\System\LkbOYTY.exe
  C:\Windows\System\LkbOYTY.exe
  2⤵
  PID:2440
- C:\Windows\System\HdxlPmu.exe
  C:\Windows\System\HdxlPmu.exe
  2⤵
  PID:288
- C:\Windows\System\KTOgHQF.exe
  C:\Windows\System\KTOgHQF.exe
  2⤵
  PID:2888
- C:\Windows\System\SvGfnXw.exe
  C:\Windows\System\SvGfnXw.exe
  2⤵
  PID:2308
- C:\Windows\System\RakdZxj.exe
  C:\Windows\System\RakdZxj.exe
  2⤵
  PID:656
- C:\Windows\System\QVVCgdS.exe
  C:\Windows\System\QVVCgdS.exe
  2⤵
  PID:976
- C:\Windows\System\xyCXwes.exe
  C:\Windows\System\xyCXwes.exe
  2⤵
  PID:388
- C:\Windows\System\WwTPZXo.exe
  C:\Windows\System\WwTPZXo.exe
  2⤵
  PID:2932
- C:\Windows\System\iRGuEiU.exe
  C:\Windows\System\iRGuEiU.exe
  2⤵
  PID:1812
- C:\Windows\System\qgibJkk.exe
  C:\Windows\System\qgibJkk.exe
  2⤵
  PID:2224
- C:\Windows\System\kBdfRth.exe
  C:\Windows\System\kBdfRth.exe
  2⤵
  PID:560
- C:\Windows\System\FfsJBKy.exe
  C:\Windows\System\FfsJBKy.exe
  2⤵
  PID:1020
- C:\Windows\System\CpeuDRM.exe
  C:\Windows\System\CpeuDRM.exe
  2⤵
  PID:2492
- C:\Windows\System\rcdYMCk.exe
  C:\Windows\System\rcdYMCk.exe
  2⤵
  PID:2356
- C:\Windows\System\NGOIZdj.exe
  C:\Windows\System\NGOIZdj.exe
  2⤵
  PID:3084
- C:\Windows\System\JRaSvpb.exe
  C:\Windows\System\JRaSvpb.exe
  2⤵
  PID:3104
- C:\Windows\System\SkoINfb.exe
  C:\Windows\System\SkoINfb.exe
  2⤵
  PID:3120
- C:\Windows\System\TLyofao.exe
  C:\Windows\System\TLyofao.exe
  2⤵
  PID:3136
- C:\Windows\System\JLZErgk.exe
  C:\Windows\System\JLZErgk.exe
  2⤵
  PID:3152
- C:\Windows\System\IddMAte.exe
  C:\Windows\System\IddMAte.exe
  2⤵
  PID:3168
- C:\Windows\System\NtDCHTS.exe
  C:\Windows\System\NtDCHTS.exe
  2⤵
  PID:3184
- C:\Windows\System\mtyMCiP.exe
  C:\Windows\System\mtyMCiP.exe
  2⤵
  PID:3200
- C:\Windows\System\jlnhhBN.exe
  C:\Windows\System\jlnhhBN.exe
  2⤵
  PID:3216
- C:\Windows\System\bRelOCy.exe
  C:\Windows\System\bRelOCy.exe
  2⤵
  PID:3232
- C:\Windows\System\ZWbEhfM.exe
  C:\Windows\System\ZWbEhfM.exe
  2⤵
  PID:3292
- C:\Windows\System\iNfFMhz.exe
  C:\Windows\System\iNfFMhz.exe
  2⤵
  PID:3320
- C:\Windows\System\EeQPEvo.exe
  C:\Windows\System\EeQPEvo.exe
  2⤵
  PID:3336
- C:\Windows\System\kKTxJrC.exe
  C:\Windows\System\kKTxJrC.exe
  2⤵
  PID:3352
- C:\Windows\System\idcvipw.exe
  C:\Windows\System\idcvipw.exe
  2⤵
  PID:3368
- C:\Windows\System\AEhuvFs.exe
  C:\Windows\System\AEhuvFs.exe
  2⤵
  PID:3384
- C:\Windows\System\hqCiHIk.exe
  C:\Windows\System\hqCiHIk.exe
  2⤵
  PID:3400
- C:\Windows\System\IkfDJEC.exe
  C:\Windows\System\IkfDJEC.exe
  2⤵
  PID:3416
- C:\Windows\System\vSfMGIH.exe
  C:\Windows\System\vSfMGIH.exe
  2⤵
  PID:3432
- C:\Windows\System\sIRwQIv.exe
  C:\Windows\System\sIRwQIv.exe
  2⤵
  PID:3452
- C:\Windows\System\qqXTDWK.exe
  C:\Windows\System\qqXTDWK.exe
  2⤵
  PID:3468
- C:\Windows\System\IvXfUwy.exe
  C:\Windows\System\IvXfUwy.exe
  2⤵
  PID:3520
- C:\Windows\System\CxsCnaR.exe
  C:\Windows\System\CxsCnaR.exe
  2⤵
  PID:3552
- C:\Windows\System\AVaaXvr.exe
  C:\Windows\System\AVaaXvr.exe
  2⤵
  PID:3568
- C:\Windows\System\NmgrGNs.exe
  C:\Windows\System\NmgrGNs.exe
  2⤵
  PID:3584
- C:\Windows\System\UPYDHEE.exe
  C:\Windows\System\UPYDHEE.exe
  2⤵
  PID:3604
- C:\Windows\System\MKnaBUp.exe
  C:\Windows\System\MKnaBUp.exe
  2⤵
  PID:3624
- C:\Windows\System\dmDHbCG.exe
  C:\Windows\System\dmDHbCG.exe
  2⤵
  PID:3640
- C:\Windows\System\fYbVCyH.exe
  C:\Windows\System\fYbVCyH.exe
  2⤵
  PID:3656
- C:\Windows\System\AqcafaP.exe
  C:\Windows\System\AqcafaP.exe
  2⤵
  PID:3680
- C:\Windows\System\fOlJzJw.exe
  C:\Windows\System\fOlJzJw.exe
  2⤵
  PID:3700
- C:\Windows\System\gaLoEiU.exe
  C:\Windows\System\gaLoEiU.exe
  2⤵
  PID:3716
- C:\Windows\System\wqVjJLg.exe
  C:\Windows\System\wqVjJLg.exe
  2⤵
  PID:3736
- C:\Windows\System\DuOvUdR.exe
  C:\Windows\System\DuOvUdR.exe
  2⤵
  PID:3756
- C:\Windows\System\uFrkTtj.exe
  C:\Windows\System\uFrkTtj.exe
  2⤵
  PID:3792
- C:\Windows\System\UGRpBGX.exe
  C:\Windows\System\UGRpBGX.exe
  2⤵
  PID:3808
- C:\Windows\System\AhMzdIJ.exe
  C:\Windows\System\AhMzdIJ.exe
  2⤵
  PID:3824
- C:\Windows\System\zZOhYdO.exe
  C:\Windows\System\zZOhYdO.exe
  2⤵
  PID:3848
- C:\Windows\System\eJgsmAI.exe
  C:\Windows\System\eJgsmAI.exe
  2⤵
  PID:3868
- C:\Windows\System\UJfWrPz.exe
  C:\Windows\System\UJfWrPz.exe
  2⤵
  PID:3884
- C:\Windows\System\aJCZDZZ.exe
  C:\Windows\System\aJCZDZZ.exe
  2⤵
  PID:3900
- C:\Windows\System\MeUzvzi.exe
  C:\Windows\System\MeUzvzi.exe
  2⤵
  PID:3916
- C:\Windows\System\kpIRfqs.exe
  C:\Windows\System\kpIRfqs.exe
  2⤵
  PID:3932
- C:\Windows\System\XwYmlve.exe
  C:\Windows\System\XwYmlve.exe
  2⤵
  PID:3948
- C:\Windows\System\oqYAckr.exe
  C:\Windows\System\oqYAckr.exe
  2⤵
  PID:3964
- C:\Windows\System\fHGMeoh.exe
  C:\Windows\System\fHGMeoh.exe
  2⤵
  PID:3988
- C:\Windows\System\KEkYaCr.exe
  C:\Windows\System\KEkYaCr.exe
  2⤵
  PID:4004
- C:\Windows\System\EyDkfcV.exe
  C:\Windows\System\EyDkfcV.exe
  2⤵
  PID:4020
- C:\Windows\System\TPJRevU.exe
  C:\Windows\System\TPJRevU.exe
  2⤵
  PID:4036
- C:\Windows\System\mPmUbtl.exe
  C:\Windows\System\mPmUbtl.exe
  2⤵
  PID:2192
- C:\Windows\System\FYouPhr.exe
  C:\Windows\System\FYouPhr.exe
  2⤵
  PID:3148
- C:\Windows\System\oXRQeYo.exe
  C:\Windows\System\oXRQeYo.exe
  2⤵
  PID:3212
- C:\Windows\System\MLdtYfn.exe
  C:\Windows\System\MLdtYfn.exe
  2⤵
  PID:3256
- C:\Windows\System\FKfsPjW.exe
  C:\Windows\System\FKfsPjW.exe
  2⤵
  PID:3268
- C:\Windows\System\OBOvYOZ.exe
  C:\Windows\System\OBOvYOZ.exe
  2⤵
  PID:3196
- C:\Windows\System\AgKCPEH.exe
  C:\Windows\System\AgKCPEH.exe
  2⤵
  PID:236
- C:\Windows\System\JHFnNGN.exe
  C:\Windows\System\JHFnNGN.exe
  2⤵
  PID:896
- C:\Windows\System\GdixLea.exe
  C:\Windows\System\GdixLea.exe
  2⤵
  PID:576
- C:\Windows\System\vsMdfPn.exe
  C:\Windows\System\vsMdfPn.exe
  2⤵
  PID:2228
- C:\Windows\System\OUgJDeM.exe
  C:\Windows\System\OUgJDeM.exe
  2⤵
  PID:3132
- C:\Windows\System\jJiomlW.exe
  C:\Windows\System\jJiomlW.exe
  2⤵
  PID:3300
- C:\Windows\System\ifRDUbG.exe
  C:\Windows\System\ifRDUbG.exe
  2⤵
  PID:3328
- C:\Windows\System\CKRrUEe.exe
  C:\Windows\System\CKRrUEe.exe
  2⤵
  PID:3364
- C:\Windows\System\CZZQpig.exe
  C:\Windows\System\CZZQpig.exe
  2⤵
  PID:3464
- C:\Windows\System\JaoAvzD.exe
  C:\Windows\System\JaoAvzD.exe
  2⤵
  PID:3376
- C:\Windows\System\dJiRyyX.exe
  C:\Windows\System\dJiRyyX.exe
  2⤵
  PID:3448
- C:\Windows\System\WdtbRZn.exe
  C:\Windows\System\WdtbRZn.exe
  2⤵
  PID:3504
- C:\Windows\System\ZhexbBY.exe
  C:\Windows\System\ZhexbBY.exe
  2⤵
  PID:3480
- C:\Windows\System\iBNKbpE.exe
  C:\Windows\System\iBNKbpE.exe
  2⤵
  PID:3576
- C:\Windows\System\KSPBiWe.exe
  C:\Windows\System\KSPBiWe.exe
  2⤵
  PID:3616
- C:\Windows\System\gcNKJWm.exe
  C:\Windows\System\gcNKJWm.exe
  2⤵
  PID:3560
- C:\Windows\System\biqULBJ.exe
  C:\Windows\System\biqULBJ.exe
  2⤵
  PID:3668
- C:\Windows\System\YCmEEjo.exe
  C:\Windows\System\YCmEEjo.exe
  2⤵
  PID:3688
- C:\Windows\System\LZJhFqF.exe
  C:\Windows\System\LZJhFqF.exe
  2⤵
  PID:3764
- C:\Windows\System\mjYxQHi.exe
  C:\Windows\System\mjYxQHi.exe
  2⤵
  PID:3752
- C:\Windows\System\wqbqJeN.exe
  C:\Windows\System\wqbqJeN.exe
  2⤵
  PID:3784
- C:\Windows\System\FqPGBpx.exe
  C:\Windows\System\FqPGBpx.exe
  2⤵
  PID:3800
- C:\Windows\System\agRlIXj.exe
  C:\Windows\System\agRlIXj.exe
  2⤵
  PID:3804
- C:\Windows\System\eMbdxMK.exe
  C:\Windows\System\eMbdxMK.exe
  2⤵
  PID:3860
- C:\Windows\System\IHmHnVZ.exe
  C:\Windows\System\IHmHnVZ.exe
  2⤵
  PID:3996
- C:\Windows\System\ELHBAay.exe
  C:\Windows\System\ELHBAay.exe
  2⤵
  PID:4032
- C:\Windows\System\zGFFcVq.exe
  C:\Windows\System\zGFFcVq.exe
  2⤵
  PID:4068
- C:\Windows\System\KvvEeXu.exe
  C:\Windows\System\KvvEeXu.exe
  2⤵
  PID:4088
- C:\Windows\System\lQglUEB.exe
  C:\Windows\System\lQglUEB.exe
  2⤵
  PID:2128
- C:\Windows\System\DcDLXRV.exe
  C:\Windows\System\DcDLXRV.exe
  2⤵
  PID:3980
- C:\Windows\System\BFZnasF.exe
  C:\Windows\System\BFZnasF.exe
  2⤵
  PID:3080
- C:\Windows\System\xFtmwZH.exe
  C:\Windows\System\xFtmwZH.exe
  2⤵
  PID:3116
- C:\Windows\System\YRFXDUH.exe
  C:\Windows\System\YRFXDUH.exe
  2⤵
  PID:2300
- C:\Windows\System\dMCFpgK.exe
  C:\Windows\System\dMCFpgK.exe
  2⤵
  PID:3264
- C:\Windows\System\GQhqUvB.exe
  C:\Windows\System\GQhqUvB.exe
  2⤵
  PID:3096
- C:\Windows\System\TcVfqdB.exe
  C:\Windows\System\TcVfqdB.exe
  2⤵
  PID:3208
- C:\Windows\System\sSeBNpQ.exe
  C:\Windows\System\sSeBNpQ.exe
  2⤵
  PID:3360
- C:\Windows\System\RxCrcYs.exe
  C:\Windows\System\RxCrcYs.exe
  2⤵
  PID:2652
- C:\Windows\System\FnfYuoC.exe
  C:\Windows\System\FnfYuoC.exe
  2⤵
  PID:3500
- C:\Windows\System\dquGowh.exe
  C:\Windows\System\dquGowh.exe
  2⤵
  PID:3540
- C:\Windows\System\gdzkwtQ.exe
  C:\Windows\System\gdzkwtQ.exe
  2⤵
  PID:3308
- C:\Windows\System\ntlTixe.exe
  C:\Windows\System\ntlTixe.exe
  2⤵
  PID:3248
- C:\Windows\System\AXhPdMW.exe
  C:\Windows\System\AXhPdMW.exe
  2⤵
  PID:3440
- C:\Windows\System\BmzMgED.exe
  C:\Windows\System\BmzMgED.exe
  2⤵
  PID:3648
- C:\Windows\System\bBdczYv.exe
  C:\Windows\System\bBdczYv.exe
  2⤵
  PID:3592
- C:\Windows\System\SFxEIYi.exe
  C:\Windows\System\SFxEIYi.exe
  2⤵
  PID:3496
- C:\Windows\System\BVNlWar.exe
  C:\Windows\System\BVNlWar.exe
  2⤵
  PID:3696
- C:\Windows\System\axOqhik.exe
  C:\Windows\System\axOqhik.exe
  2⤵
  PID:3788
- C:\Windows\System\RGmeNUo.exe
  C:\Windows\System\RGmeNUo.exe
  2⤵
  PID:3844
- C:\Windows\System\YswNUqY.exe
  C:\Windows\System\YswNUqY.exe
  2⤵
  PID:3960
- C:\Windows\System\zmZLmsa.exe
  C:\Windows\System\zmZLmsa.exe
  2⤵
  PID:3732
- C:\Windows\System\HQGREWX.exe
  C:\Windows\System\HQGREWX.exe
  2⤵
  PID:3816
- C:\Windows\System\RdJiWCW.exe
  C:\Windows\System\RdJiWCW.exe
  2⤵
  PID:4084
- C:\Windows\System\hGBsGQu.exe
  C:\Windows\System\hGBsGQu.exe
  2⤵
  PID:4064
- C:\Windows\System\tJymviJ.exe
  C:\Windows\System\tJymviJ.exe
  2⤵
  PID:3252
- C:\Windows\System\JTgaILY.exe
  C:\Windows\System\JTgaILY.exe
  2⤵
  PID:3224
- C:\Windows\System\nccIyQr.exe
  C:\Windows\System\nccIyQr.exe
  2⤵
  PID:2580
- C:\Windows\System\IfnEOJU.exe
  C:\Windows\System\IfnEOJU.exe
  2⤵
  PID:3332
- C:\Windows\System\jCTRoUt.exe
  C:\Windows\System\jCTRoUt.exe
  2⤵
  PID:3516
- C:\Windows\System\oNursWe.exe
  C:\Windows\System\oNursWe.exe
  2⤵
  PID:3128
- C:\Windows\System\WZzDASj.exe
  C:\Windows\System\WZzDASj.exe
  2⤵
  PID:3536
- C:\Windows\System\bHNBHCI.exe
  C:\Windows\System\bHNBHCI.exe
  2⤵
  PID:3488
- C:\Windows\System\wvNHRzb.exe
  C:\Windows\System\wvNHRzb.exe
  2⤵
  PID:4076
- C:\Windows\System\WuGxrgE.exe
  C:\Windows\System\WuGxrgE.exe
  2⤵
  PID:2316
- C:\Windows\System\MZzvIKL.exe
  C:\Windows\System\MZzvIKL.exe
  2⤵
  PID:3180
- C:\Windows\System\qsebWDX.exe
  C:\Windows\System\qsebWDX.exe
  2⤵
  PID:3840
- C:\Windows\System\gmAYMmx.exe
  C:\Windows\System\gmAYMmx.exe
  2⤵
  PID:3976
- C:\Windows\System\sOmxCTg.exe
  C:\Windows\System\sOmxCTg.exe
  2⤵
  PID:3228
- C:\Windows\System\AjlDtWo.exe
  C:\Windows\System\AjlDtWo.exe
  2⤵
  PID:3312
- C:\Windows\System\NnvAhYv.exe
  C:\Windows\System\NnvAhYv.exe
  2⤵
  PID:3632
- C:\Windows\System\TdbiEXc.exe
  C:\Windows\System\TdbiEXc.exe
  2⤵
  PID:3244
- C:\Windows\System\vuTAGvB.exe
  C:\Windows\System\vuTAGvB.exe
  2⤵
  PID:4112
- C:\Windows\System\YKubRpu.exe
  C:\Windows\System\YKubRpu.exe
  2⤵
  PID:4136
- C:\Windows\System\XwlUcSL.exe
  C:\Windows\System\XwlUcSL.exe
  2⤵
  PID:4152
- C:\Windows\System\zAjfAwI.exe
  C:\Windows\System\zAjfAwI.exe
  2⤵
  PID:4168
- C:\Windows\System\twQAYmq.exe
  C:\Windows\System\twQAYmq.exe
  2⤵
  PID:4184
- C:\Windows\System\IWFebyY.exe
  C:\Windows\System\IWFebyY.exe
  2⤵
  PID:4200
- C:\Windows\System\Wwyasti.exe
  C:\Windows\System\Wwyasti.exe
  2⤵
  PID:4216
- C:\Windows\System\uNzwOeg.exe
  C:\Windows\System\uNzwOeg.exe
  2⤵
  PID:4240
- C:\Windows\System\JZDuqfa.exe
  C:\Windows\System\JZDuqfa.exe
  2⤵
  PID:4256
- C:\Windows\System\okzdlTx.exe
  C:\Windows\System\okzdlTx.exe
  2⤵
  PID:4276
- C:\Windows\System\jSQOrvT.exe
  C:\Windows\System\jSQOrvT.exe
  2⤵
  PID:4372
- C:\Windows\System\tAvpTPA.exe
  C:\Windows\System\tAvpTPA.exe
  2⤵
  PID:4408
- C:\Windows\System\bINYgaT.exe
  C:\Windows\System\bINYgaT.exe
  2⤵
  PID:4424
- C:\Windows\System\keajaBj.exe
  C:\Windows\System\keajaBj.exe
  2⤵
  PID:4440
- C:\Windows\System\ibLgvlP.exe
  C:\Windows\System\ibLgvlP.exe
  2⤵
  PID:4456
- C:\Windows\System\IHzEWHi.exe
  C:\Windows\System\IHzEWHi.exe
  2⤵
  PID:4484
- C:\Windows\System\QrUgzFF.exe
  C:\Windows\System\QrUgzFF.exe
  2⤵
  PID:4500
- C:\Windows\System\MocelFM.exe
  C:\Windows\System\MocelFM.exe
  2⤵
  PID:4520
- C:\Windows\System\AaFUowM.exe
  C:\Windows\System\AaFUowM.exe
  2⤵
  PID:4536
- C:\Windows\System\lfCwyna.exe
  C:\Windows\System\lfCwyna.exe
  2⤵
  PID:4552
- C:\Windows\System\klbTQWj.exe
  C:\Windows\System\klbTQWj.exe
  2⤵
  PID:4612
- C:\Windows\System\EHVaoxU.exe
  C:\Windows\System\EHVaoxU.exe
  2⤵
  PID:4628
- C:\Windows\System\vXnilTr.exe
  C:\Windows\System\vXnilTr.exe
  2⤵
  PID:4644
- C:\Windows\System\KgHNvnL.exe
  C:\Windows\System\KgHNvnL.exe
  2⤵
  PID:4664
- C:\Windows\System\hkJCReT.exe
  C:\Windows\System\hkJCReT.exe
  2⤵
  PID:4680
- C:\Windows\System\YageBAT.exe
  C:\Windows\System\YageBAT.exe
  2⤵
  PID:4696
- C:\Windows\System\DyOjToY.exe
  C:\Windows\System\DyOjToY.exe
  2⤵
  PID:4716
- C:\Windows\System\njUdOQq.exe
  C:\Windows\System\njUdOQq.exe
  2⤵
  PID:4732
- C:\Windows\System\yEzXYxb.exe
  C:\Windows\System\yEzXYxb.exe
  2⤵
  PID:4752
- C:\Windows\System\VNBmPxC.exe
  C:\Windows\System\VNBmPxC.exe
  2⤵
  PID:4768
- C:\Windows\System\jTmYwZX.exe
  C:\Windows\System\jTmYwZX.exe
  2⤵
  PID:4784
- C:\Windows\System\mVXEzqs.exe
  C:\Windows\System\mVXEzqs.exe
  2⤵
  PID:4804
- C:\Windows\System\qpZwdAG.exe
  C:\Windows\System\qpZwdAG.exe
  2⤵
  PID:4820
- C:\Windows\System\wFoFmwk.exe
  C:\Windows\System\wFoFmwk.exe
  2⤵
  PID:4836
- C:\Windows\System\ovHXYRJ.exe
  C:\Windows\System\ovHXYRJ.exe
  2⤵
  PID:4852
- C:\Windows\System\LsKghsX.exe
  C:\Windows\System\LsKghsX.exe
  2⤵
  PID:4868
- C:\Windows\System\wxPODXB.exe
  C:\Windows\System\wxPODXB.exe
  2⤵
  PID:4884
- C:\Windows\System\woubhcD.exe
  C:\Windows\System\woubhcD.exe
  2⤵
  PID:4900
- C:\Windows\System\UOaPsbJ.exe
  C:\Windows\System\UOaPsbJ.exe
  2⤵
  PID:4916
- C:\Windows\System\UyYvhxW.exe
  C:\Windows\System\UyYvhxW.exe
  2⤵
  PID:4932
- C:\Windows\System\EMfcklQ.exe
  C:\Windows\System\EMfcklQ.exe
  2⤵
  PID:4948
- C:\Windows\System\dMVxEbo.exe
  C:\Windows\System\dMVxEbo.exe
  2⤵
  PID:4964
- C:\Windows\System\XVNSIYo.exe
  C:\Windows\System\XVNSIYo.exe
  2⤵
  PID:4980
- C:\Windows\System\zAHTQCs.exe
  C:\Windows\System\zAHTQCs.exe
  2⤵
  PID:4996
- C:\Windows\System\hHzkfIt.exe
  C:\Windows\System\hHzkfIt.exe
  2⤵
  PID:5012
- C:\Windows\System\gAtLSBz.exe
  C:\Windows\System\gAtLSBz.exe
  2⤵
  PID:5032
- C:\Windows\System\STvOFCU.exe
  C:\Windows\System\STvOFCU.exe
  2⤵
  PID:5048
- C:\Windows\System\HRmqZrY.exe
  C:\Windows\System\HRmqZrY.exe
  2⤵
  PID:5068
- C:\Windows\System\qNPFCIh.exe
  C:\Windows\System\qNPFCIh.exe
  2⤵
  PID:5084
- C:\Windows\System\FnOWbXs.exe
  C:\Windows\System\FnOWbXs.exe
  2⤵
  PID:5100
- C:\Windows\System\fTTnCcA.exe
  C:\Windows\System\fTTnCcA.exe
  2⤵
  PID:5116
- C:\Windows\System\ZMvyMpK.exe
  C:\Windows\System\ZMvyMpK.exe
  2⤵
  PID:3428
- C:\Windows\System\NblrueT.exe
  C:\Windows\System\NblrueT.exe
  2⤵
  PID:4176
- C:\Windows\System\eNLCpSO.exe
  C:\Windows\System\eNLCpSO.exe
  2⤵
  PID:3712
- C:\Windows\System\VJCSkIv.exe
  C:\Windows\System\VJCSkIv.exe
  2⤵
  PID:3780
- C:\Windows\System\GgTgoBm.exe
  C:\Windows\System\GgTgoBm.exe
  2⤵
  PID:1364
- C:\Windows\System\fDZXWvg.exe
  C:\Windows\System\fDZXWvg.exe
  2⤵
  PID:2424
- C:\Windows\System\MPYXaAu.exe
  C:\Windows\System\MPYXaAu.exe
  2⤵
  PID:4228
- C:\Windows\System\AjSgKxu.exe
  C:\Windows\System\AjSgKxu.exe
  2⤵
  PID:4268
- C:\Windows\System\nhsoNTs.exe
  C:\Windows\System\nhsoNTs.exe
  2⤵
  PID:4300
- C:\Windows\System\ggFEsyP.exe
  C:\Windows\System\ggFEsyP.exe
  2⤵
  PID:4416
- C:\Windows\System\vWZYyuh.exe
  C:\Windows\System\vWZYyuh.exe
  2⤵
  PID:4492
- C:\Windows\System\LNlxVKq.exe
  C:\Windows\System\LNlxVKq.exe
  2⤵
  PID:4560
- C:\Windows\System\UApoaGW.exe
  C:\Windows\System\UApoaGW.exe
  2⤵
  PID:4512
- C:\Windows\System\KlcCvMs.exe
  C:\Windows\System\KlcCvMs.exe
  2⤵
  PID:4472
- C:\Windows\System\CeDrafm.exe
  C:\Windows\System\CeDrafm.exe
  2⤵
  PID:4388
- C:\Windows\System\eGloZGI.exe
  C:\Windows\System\eGloZGI.exe
  2⤵
  PID:4576
- C:\Windows\System\zGseKeq.exe
  C:\Windows\System\zGseKeq.exe
  2⤵
  PID:4592
- C:\Windows\System\brWHUCo.exe
  C:\Windows\System\brWHUCo.exe
  2⤵
  PID:4608
- C:\Windows\System\qXKzqss.exe
  C:\Windows\System\qXKzqss.exe
  2⤵
  PID:4676
- C:\Windows\System\GMUVjkT.exe
  C:\Windows\System\GMUVjkT.exe
  2⤵
  PID:4748
- C:\Windows\System\OYamMdl.exe
  C:\Windows\System\OYamMdl.exe
  2⤵
  PID:4816
- C:\Windows\System\TuCHuBv.exe
  C:\Windows\System\TuCHuBv.exe
  2⤵
  PID:4620
- C:\Windows\System\RzdJlwA.exe
  C:\Windows\System\RzdJlwA.exe
  2⤵
  PID:4940
- C:\Windows\System\ThscdoX.exe
  C:\Windows\System\ThscdoX.exe
  2⤵
  PID:4972
- C:\Windows\System\NSjxNdf.exe
  C:\Windows\System\NSjxNdf.exe
  2⤵
  PID:4724
- C:\Windows\System\vWUFmwm.exe
  C:\Windows\System\vWUFmwm.exe
  2⤵
  PID:4728
- C:\Windows\System\SFzvWNa.exe
  C:\Windows\System\SFzvWNa.exe
  2⤵
  PID:4956
- C:\Windows\System\KtHnLpl.exe
  C:\Windows\System\KtHnLpl.exe
  2⤵
  PID:5020
- C:\Windows\System\OHZmJOQ.exe
  C:\Windows\System\OHZmJOQ.exe
  2⤵
  PID:4864
- C:\Windows\System\TBJqVHh.exe
  C:\Windows\System\TBJqVHh.exe
  2⤵
  PID:5028
- C:\Windows\System\AZPTkED.exe
  C:\Windows\System\AZPTkED.exe
  2⤵
  PID:4960
- C:\Windows\System\RVHHMfg.exe
  C:\Windows\System\RVHHMfg.exe
  2⤵
  PID:3664
- C:\Windows\System\ICRPgqz.exe
  C:\Windows\System\ICRPgqz.exe
  2⤵
  PID:4108
- C:\Windows\System\xEIsPrA.exe
  C:\Windows\System\xEIsPrA.exe
  2⤵
  PID:4212
- C:\Windows\System\JqRfLYg.exe
  C:\Windows\System\JqRfLYg.exe
  2⤵
  PID:4120
- C:\Windows\System\zUQCkBw.exe
  C:\Windows\System\zUQCkBw.exe
  2⤵
  PID:3544
- C:\Windows\System\ifSBxZk.exe
  C:\Windows\System\ifSBxZk.exe
  2⤵
  PID:3396
- C:\Windows\System\XTHXSMb.exe
  C:\Windows\System\XTHXSMb.exe
  2⤵
  PID:4164
- C:\Windows\System\UgYnUPN.exe
  C:\Windows\System\UgYnUPN.exe
  2⤵
  PID:4264
- C:\Windows\System\GzBGdwv.exe
  C:\Windows\System\GzBGdwv.exe
  2⤵
  PID:4356
- C:\Windows\System\kmqsftg.exe
  C:\Windows\System\kmqsftg.exe
  2⤵
  PID:4368
- C:\Windows\System\cZvIVIA.exe
  C:\Windows\System\cZvIVIA.exe
  2⤵
  PID:4516
- C:\Windows\System\zGGwoCF.exe
  C:\Windows\System\zGGwoCF.exe
  2⤵
  PID:4708
- C:\Windows\System\kCGnxwZ.exe
  C:\Windows\System\kCGnxwZ.exe
  2⤵
  PID:4876
- C:\Windows\System\jhoXiHp.exe
  C:\Windows\System\jhoXiHp.exe
  2⤵
  PID:4688
- C:\Windows\System\zIPqqSA.exe
  C:\Windows\System\zIPqqSA.exe
  2⤵
  PID:5044
- C:\Windows\System\cfaFClG.exe
  C:\Windows\System\cfaFClG.exe
  2⤵
  PID:5024
- C:\Windows\System\WJozhGg.exe
  C:\Windows\System\WJozhGg.exe
  2⤵
  PID:4392
- C:\Windows\System\nLyxsCl.exe
  C:\Windows\System\nLyxsCl.exe
  2⤵
  PID:4640
- C:\Windows\System\eCknUMy.exe
  C:\Windows\System\eCknUMy.exe
  2⤵
  PID:5004
- C:\Windows\System\OKjOCUo.exe
  C:\Windows\System\OKjOCUo.exe
  2⤵
  PID:4568
- C:\Windows\System\OZYEyiI.exe
  C:\Windows\System\OZYEyiI.exe
  2⤵
  PID:5060
- C:\Windows\System\GMwUdwM.exe
  C:\Windows\System\GMwUdwM.exe
  2⤵
  PID:5092
- C:\Windows\System\bCqWWVp.exe
  C:\Windows\System\bCqWWVp.exe
  2⤵
  PID:5096
- C:\Windows\System\OkFRIGH.exe
  C:\Windows\System\OkFRIGH.exe
  2⤵
  PID:1052
- C:\Windows\System\capesfM.exe
  C:\Windows\System\capesfM.exe
  2⤵
  PID:4124
- C:\Windows\System\iGxjiZO.exe
  C:\Windows\System\iGxjiZO.exe
  2⤵
  PID:4528
- C:\Windows\System\HxCIoia.exe
  C:\Windows\System\HxCIoia.exe
  2⤵
  PID:4476
- C:\Windows\System\MvDgqBg.exe
  C:\Windows\System\MvDgqBg.exe
  2⤵
  PID:3972
- C:\Windows\System\baBOpAx.exe
  C:\Windows\System\baBOpAx.exe
  2⤵
  PID:4288
- C:\Windows\System\odXkqbV.exe
  C:\Windows\System\odXkqbV.exe
  2⤵
  PID:4692
- C:\Windows\System\IiZPkbz.exe
  C:\Windows\System\IiZPkbz.exe
  2⤵
  PID:4396
- C:\Windows\System\qmxiJec.exe
  C:\Windows\System\qmxiJec.exe
  2⤵
  PID:4080
- C:\Windows\System\HhSKqQC.exe
  C:\Windows\System\HhSKqQC.exe
  2⤵
  PID:4564
- C:\Windows\System\lxFnPzH.exe
  C:\Windows\System\lxFnPzH.exe
  2⤵
  PID:4436
- C:\Windows\System\XzolaJW.exe
  C:\Windows\System\XzolaJW.exe
  2⤵
  PID:4908
- C:\Windows\System\EFyNGDm.exe
  C:\Windows\System\EFyNGDm.exe
  2⤵
  PID:4764
- C:\Windows\System\uAnKOKp.exe
  C:\Windows\System\uAnKOKp.exe
  2⤵
  PID:4052
- C:\Windows\System\EKrPJWg.exe
  C:\Windows\System\EKrPJWg.exe
  2⤵
  PID:4848
- C:\Windows\System\VPfNtck.exe
  C:\Windows\System\VPfNtck.exe
  2⤵
  PID:4380
- C:\Windows\System\bheKGgr.exe
  C:\Windows\System\bheKGgr.exe
  2⤵
  PID:4452
- C:\Windows\System\JtYoCNd.exe
  C:\Windows\System\JtYoCNd.exe
  2⤵
  PID:5124
- C:\Windows\System\nrYbGxE.exe
  C:\Windows\System\nrYbGxE.exe
  2⤵
  PID:5140
- C:\Windows\System\IvRFPVS.exe
  C:\Windows\System\IvRFPVS.exe
  2⤵
  PID:5156
- C:\Windows\System\gTXaHAm.exe
  C:\Windows\System\gTXaHAm.exe
  2⤵
  PID:5172
- C:\Windows\System\cpQVjTn.exe
  C:\Windows\System\cpQVjTn.exe
  2⤵
  PID:5188
- C:\Windows\System\wkADxoW.exe
  C:\Windows\System\wkADxoW.exe
  2⤵
  PID:5204
- C:\Windows\System\ejrfjqQ.exe
  C:\Windows\System\ejrfjqQ.exe
  2⤵
  PID:5220
- C:\Windows\System\jKtuAMC.exe
  C:\Windows\System\jKtuAMC.exe
  2⤵
  PID:5236
- C:\Windows\System\jbIcqkx.exe
  C:\Windows\System\jbIcqkx.exe
  2⤵
  PID:5252
- C:\Windows\System\QPblAHY.exe
  C:\Windows\System\QPblAHY.exe
  2⤵
  PID:5268
- C:\Windows\System\VsCwJBQ.exe
  C:\Windows\System\VsCwJBQ.exe
  2⤵
  PID:5284
- C:\Windows\System\BaSMaTm.exe
  C:\Windows\System\BaSMaTm.exe
  2⤵
  PID:5300
- C:\Windows\System\FpelMBX.exe
  C:\Windows\System\FpelMBX.exe
  2⤵
  PID:5316
- C:\Windows\System\iZyazzA.exe
  C:\Windows\System\iZyazzA.exe
  2⤵
  PID:5336
- C:\Windows\System\vJZrjzw.exe
  C:\Windows\System\vJZrjzw.exe
  2⤵
  PID:5352
- C:\Windows\System\hnjOGMq.exe
  C:\Windows\System\hnjOGMq.exe
  2⤵
  PID:5368
- C:\Windows\System\ojbzjRf.exe
  C:\Windows\System\ojbzjRf.exe
  2⤵
  PID:5384
- C:\Windows\System\qsqpTlL.exe
  C:\Windows\System\qsqpTlL.exe
  2⤵
  PID:5400
- C:\Windows\System\vWiYNCk.exe
  C:\Windows\System\vWiYNCk.exe
  2⤵
  PID:5416
- C:\Windows\System\qTfEmmq.exe
  C:\Windows\System\qTfEmmq.exe
  2⤵
  PID:5432
- C:\Windows\System\XrTUMFB.exe
  C:\Windows\System\XrTUMFB.exe
  2⤵
  PID:5448
- C:\Windows\System\jEIZugR.exe
  C:\Windows\System\jEIZugR.exe
  2⤵
  PID:5464
- C:\Windows\System\UxANCid.exe
  C:\Windows\System\UxANCid.exe
  2⤵
  PID:5480
- C:\Windows\System\jnWyNJs.exe
  C:\Windows\System\jnWyNJs.exe
  2⤵
  PID:5496
- C:\Windows\System\pLPecIT.exe
  C:\Windows\System\pLPecIT.exe
  2⤵
  PID:5512
- C:\Windows\System\klzCZzt.exe
  C:\Windows\System\klzCZzt.exe
  2⤵
  PID:5528
- C:\Windows\System\iwBzcor.exe
  C:\Windows\System\iwBzcor.exe
  2⤵
  PID:5548
- C:\Windows\System\nnzUmHF.exe
  C:\Windows\System\nnzUmHF.exe
  2⤵
  PID:5564
- C:\Windows\System\yViNZOX.exe
  C:\Windows\System\yViNZOX.exe
  2⤵
  PID:5580
- C:\Windows\System\CwJPpWT.exe
  C:\Windows\System\CwJPpWT.exe
  2⤵
  PID:5600
- C:\Windows\System\SQQzePX.exe
  C:\Windows\System\SQQzePX.exe
  2⤵
  PID:5616
- C:\Windows\System\THMWJtN.exe
  C:\Windows\System\THMWJtN.exe
  2⤵
  PID:5632
- C:\Windows\System\YTnIvKb.exe
  C:\Windows\System\YTnIvKb.exe
  2⤵
  PID:5652
- C:\Windows\System\oMWPDUq.exe
  C:\Windows\System\oMWPDUq.exe
  2⤵
  PID:5668
- C:\Windows\System\qLnoCms.exe
  C:\Windows\System\qLnoCms.exe
  2⤵
  PID:5684
- C:\Windows\System\nrhyNEF.exe
  C:\Windows\System\nrhyNEF.exe
  2⤵
  PID:5700
- C:\Windows\System\dqPQwbq.exe
  C:\Windows\System\dqPQwbq.exe
  2⤵
  PID:5716
- C:\Windows\System\XxVEOyo.exe
  C:\Windows\System\XxVEOyo.exe
  2⤵
  PID:5736
- C:\Windows\System\CysDCAi.exe
  C:\Windows\System\CysDCAi.exe
  2⤵
  PID:5752
- C:\Windows\System\nOwOjWW.exe
  C:\Windows\System\nOwOjWW.exe
  2⤵
  PID:5768
- C:\Windows\System\BtgXxsU.exe
  C:\Windows\System\BtgXxsU.exe
  2⤵
  PID:5788
- C:\Windows\System\tiYmQUw.exe
  C:\Windows\System\tiYmQUw.exe
  2⤵
  PID:5804
- C:\Windows\System\ITqNKNq.exe
  C:\Windows\System\ITqNKNq.exe
  2⤵
  PID:5820
- C:\Windows\System\yHKdzKS.exe
  C:\Windows\System\yHKdzKS.exe
  2⤵
  PID:5836
- C:\Windows\System\nwjTJLY.exe
  C:\Windows\System\nwjTJLY.exe
  2⤵
  PID:5852
- C:\Windows\System\MEZHziN.exe
  C:\Windows\System\MEZHziN.exe
  2⤵
  PID:5868
- C:\Windows\System\YzrhoqD.exe
  C:\Windows\System\YzrhoqD.exe
  2⤵
  PID:5912
- C:\Windows\System\CwyESQE.exe
  C:\Windows\System\CwyESQE.exe
  2⤵
  PID:5928
- C:\Windows\System\rmLTETg.exe
  C:\Windows\System\rmLTETg.exe
  2⤵
  PID:5944
- C:\Windows\System\RfRfDlA.exe
  C:\Windows\System\RfRfDlA.exe
  2⤵
  PID:5964
- C:\Windows\System\VXluKLx.exe
  C:\Windows\System\VXluKLx.exe
  2⤵
  PID:5988
- C:\Windows\System\iBhZmTW.exe
  C:\Windows\System\iBhZmTW.exe
  2⤵
  PID:6004
- C:\Windows\System\XNkBQoZ.exe
  C:\Windows\System\XNkBQoZ.exe
  2⤵
  PID:6032
- C:\Windows\System\pHEsHvF.exe
  C:\Windows\System\pHEsHvF.exe
  2⤵
  PID:6048
- C:\Windows\System\bTlqNeG.exe
  C:\Windows\System\bTlqNeG.exe
  2⤵
  PID:6064
- C:\Windows\System\bXxIofC.exe
  C:\Windows\System\bXxIofC.exe
  2⤵
  PID:6084
- C:\Windows\System\pyjqmlA.exe
  C:\Windows\System\pyjqmlA.exe
  2⤵
  PID:6100
- C:\Windows\System\muSEuep.exe
  C:\Windows\System\muSEuep.exe
  2⤵
  PID:6116
- C:\Windows\System\snslEwd.exe
  C:\Windows\System\snslEwd.exe
  2⤵
  PID:6132
- C:\Windows\System\PgIQzoT.exe
  C:\Windows\System\PgIQzoT.exe
  2⤵
  PID:4296
- C:\Windows\System\LDNgGeW.exe
  C:\Windows\System\LDNgGeW.exe
  2⤵
  PID:4272
- C:\Windows\System\GKWYQbB.exe
  C:\Windows\System\GKWYQbB.exe
  2⤵
  PID:4404
- C:\Windows\System\pifknVN.exe
  C:\Windows\System\pifknVN.exe
  2⤵
  PID:5180
- C:\Windows\System\OthuwIP.exe
  C:\Windows\System\OthuwIP.exe
  2⤵
  PID:5248
- C:\Windows\System\zbpxeNh.exe
  C:\Windows\System\zbpxeNh.exe
  2⤵
  PID:5040
- C:\Windows\System\CJFWSdV.exe
  C:\Windows\System\CJFWSdV.exe
  2⤵
  PID:4248
- C:\Windows\System\MExsTeS.exe
  C:\Windows\System\MExsTeS.exe
  2⤵
  PID:5280
- C:\Windows\System\jAYAUHt.exe
  C:\Windows\System\jAYAUHt.exe
  2⤵
  PID:5376
- C:\Windows\System\ViXzrkb.exe
  C:\Windows\System\ViXzrkb.exe
  2⤵
  PID:5412
- C:\Windows\System\khTpSJk.exe
  C:\Windows\System\khTpSJk.exe
  2⤵
  PID:5164
- C:\Windows\System\kglZvdp.exe
  C:\Windows\System\kglZvdp.exe
  2⤵
  PID:5232
- C:\Windows\System\wDUfIUg.exe
  C:\Windows\System\wDUfIUg.exe
  2⤵
  PID:5504
- C:\Windows\System\xXhoOGP.exe
  C:\Windows\System\xXhoOGP.exe
  2⤵
  PID:5640
- C:\Windows\System\vfhIxEz.exe
  C:\Windows\System\vfhIxEz.exe
  2⤵
  PID:5612
- C:\Windows\System\HmOYMTz.exe
  C:\Windows\System\HmOYMTz.exe
  2⤵
  PID:5328
- C:\Windows\System\pZIBUwY.exe
  C:\Windows\System\pZIBUwY.exe
  2⤵
  PID:5460
- C:\Windows\System\kjBHSTx.exe
  C:\Windows\System\kjBHSTx.exe
  2⤵
  PID:5696
- C:\Windows\System\WjHwxBT.exe
  C:\Windows\System\WjHwxBT.exe
  2⤵
  PID:5776
- C:\Windows\System\QUWsDTO.exe
  C:\Windows\System\QUWsDTO.exe
  2⤵
  PID:5812
- C:\Windows\System\IYKqtMD.exe
  C:\Windows\System\IYKqtMD.exe
  2⤵
  PID:5728
- C:\Windows\System\AddhkQE.exe
  C:\Windows\System\AddhkQE.exe
  2⤵
  PID:5796
- C:\Windows\System\kkDmUlo.exe
  C:\Windows\System\kkDmUlo.exe
  2⤵
  PID:5864
- C:\Windows\System\arSCGmU.exe
  C:\Windows\System\arSCGmU.exe
  2⤵
  PID:5884
- C:\Windows\System\vodxNYe.exe
  C:\Windows\System\vodxNYe.exe
  2⤵
  PID:5892
- C:\Windows\System\STdIHXg.exe
  C:\Windows\System\STdIHXg.exe
  2⤵
  PID:5908
- C:\Windows\System\zGcSNJk.exe
  C:\Windows\System\zGcSNJk.exe
  2⤵
  PID:5976
- C:\Windows\System\SZZUrGq.exe
  C:\Windows\System\SZZUrGq.exe
  2⤵
  PID:6024
- C:\Windows\System\izGMDCP.exe
  C:\Windows\System\izGMDCP.exe
  2⤵
  PID:6092
- C:\Windows\System\FkumPiX.exe
  C:\Windows\System\FkumPiX.exe
  2⤵
  PID:6076
- C:\Windows\System\ufDducz.exe
  C:\Windows\System\ufDducz.exe
  2⤵
  PID:4780
- C:\Windows\System\jxfUycU.exe
  C:\Windows\System\jxfUycU.exe
  2⤵
  PID:6140
- C:\Windows\System\bYotBba.exe
  C:\Windows\System\bYotBba.exe
  2⤵
  PID:5216
- C:\Windows\System\ZrEeQuB.exe
  C:\Windows\System\ZrEeQuB.exe
  2⤵
  PID:4232
- C:\Windows\System\BbNnKiZ.exe
  C:\Windows\System\BbNnKiZ.exe
  2⤵
  PID:5264
- C:\Windows\System\PtkkKvI.exe
  C:\Windows\System\PtkkKvI.exe
  2⤵
  PID:5168
- C:\Windows\System\NQpIbGM.exe
  C:\Windows\System\NQpIbGM.exe
  2⤵
  PID:5424
- C:\Windows\System\mabzxOT.exe
  C:\Windows\System\mabzxOT.exe
  2⤵
  PID:5392
- C:\Windows\System\xWBLMUd.exe
  C:\Windows\System\xWBLMUd.exe
  2⤵
  PID:5648
- C:\Windows\System\LSjyePa.exe
  C:\Windows\System\LSjyePa.exe
  2⤵
  PID:5572
- C:\Windows\System\EwbYZXd.exe
  C:\Windows\System\EwbYZXd.exe
  2⤵
  PID:5784
- C:\Windows\System\KXALgFy.exe
  C:\Windows\System\KXALgFy.exe
  2⤵
  PID:5396
- C:\Windows\System\SPPjopW.exe
  C:\Windows\System\SPPjopW.exe
  2⤵
  PID:5492
- C:\Windows\System\XqbZanh.exe
  C:\Windows\System\XqbZanh.exe
  2⤵
  PID:5732
- C:\Windows\System\KyXOGyK.exe
  C:\Windows\System\KyXOGyK.exe
  2⤵
  PID:5588
- C:\Windows\System\WBGcRnk.exe
  C:\Windows\System\WBGcRnk.exe
  2⤵
  PID:5624
- C:\Windows\System\JctUnQT.exe
  C:\Windows\System\JctUnQT.exe
  2⤵
  PID:5900
- C:\Windows\System\WpQFyYc.exe
  C:\Windows\System\WpQFyYc.exe
  2⤵
  PID:5920
- C:\Windows\System\DQUgIdc.exe
  C:\Windows\System\DQUgIdc.exe
  2⤵
  PID:4924
- C:\Windows\System\kliViQE.exe
  C:\Windows\System\kliViQE.exe
  2⤵
  PID:6056
- C:\Windows\System\ZkqMXvZ.exe
  C:\Windows\System\ZkqMXvZ.exe
  2⤵
  PID:4760
- C:\Windows\System\mEcjKtB.exe
  C:\Windows\System\mEcjKtB.exe
  2⤵
  PID:4652
- C:\Windows\System\RaLtqQw.exe
  C:\Windows\System\RaLtqQw.exe
  2⤵
  PID:3876
- C:\Windows\System\TQsrHkq.exe
  C:\Windows\System\TQsrHkq.exe
  2⤵
  PID:5228
- C:\Windows\System\PvkYdmr.exe
  C:\Windows\System\PvkYdmr.exe
  2⤵
  PID:5344
- C:\Windows\System\jykTyHK.exe
  C:\Windows\System\jykTyHK.exe
  2⤵
  PID:5292
- C:\Windows\System\mGAetll.exe
  C:\Windows\System\mGAetll.exe
  2⤵
  PID:5708
- C:\Windows\System\WKkFowP.exe
  C:\Windows\System\WKkFowP.exe
  2⤵
  PID:5748
- C:\Windows\System\eiafGiP.exe
  C:\Windows\System\eiafGiP.exe
  2⤵
  PID:5880
- C:\Windows\System\pOsdujN.exe
  C:\Windows\System\pOsdujN.exe
  2⤵
  PID:6060
- C:\Windows\System\setxCAD.exe
  C:\Windows\System\setxCAD.exe
  2⤵
  PID:5972
- C:\Windows\System\lDbBNbK.exe
  C:\Windows\System\lDbBNbK.exe
  2⤵
  PID:1412
- C:\Windows\System\FtyJFyP.exe
  C:\Windows\System\FtyJFyP.exe
  2⤵
  PID:5472
- C:\Windows\System\oVETHVe.exe
  C:\Windows\System\oVETHVe.exe
  2⤵
  PID:5332
- C:\Windows\System\kiQnoQM.exe
  C:\Windows\System\kiQnoQM.exe
  2⤵
  PID:6108
- C:\Windows\System\MkDATBF.exe
  C:\Windows\System\MkDATBF.exe
  2⤵
  PID:5960
- C:\Windows\System\HLvEcrA.exe
  C:\Windows\System\HLvEcrA.exe
  2⤵
  PID:5712
- C:\Windows\System\HQSXgYi.exe
  C:\Windows\System\HQSXgYi.exe
  2⤵
  PID:5828
- C:\Windows\System\xWYYPWN.exe
  C:\Windows\System\xWYYPWN.exe
  2⤵
  PID:5980
- C:\Windows\System\qXwiNnx.exe
  C:\Windows\System\qXwiNnx.exe
  2⤵
  PID:6072
- C:\Windows\System\qGmWata.exe
  C:\Windows\System\qGmWata.exe
  2⤵
  PID:5536
- C:\Windows\System\ThlJCby.exe
  C:\Windows\System\ThlJCby.exe
  2⤵
  PID:5524
- C:\Windows\System\HDzCMrj.exe
  C:\Windows\System\HDzCMrj.exe
  2⤵
  PID:5924
- C:\Windows\System\hUTLIbm.exe
  C:\Windows\System\hUTLIbm.exe
  2⤵
  PID:5560
- C:\Windows\System\njYxlaq.exe
  C:\Windows\System\njYxlaq.exe
  2⤵
  PID:6152
- C:\Windows\System\cUGnPFy.exe
  C:\Windows\System\cUGnPFy.exe
  2⤵
  PID:6172
- C:\Windows\System\ZJDFObM.exe
  C:\Windows\System\ZJDFObM.exe
  2⤵
  PID:6188
- C:\Windows\System\ZrwFaWq.exe
  C:\Windows\System\ZrwFaWq.exe
  2⤵
  PID:6204
- C:\Windows\System\rfdIRCX.exe
  C:\Windows\System\rfdIRCX.exe
  2⤵
  PID:6224
- C:\Windows\System\ZlqWlNt.exe
  C:\Windows\System\ZlqWlNt.exe
  2⤵
  PID:6240
- C:\Windows\System\kDteLtK.exe
  C:\Windows\System\kDteLtK.exe
  2⤵
  PID:6256
- C:\Windows\System\PaRQpLq.exe
  C:\Windows\System\PaRQpLq.exe
  2⤵
  PID:6272
- C:\Windows\System\BWpjbtv.exe
  C:\Windows\System\BWpjbtv.exe
  2⤵
  PID:6288
- C:\Windows\System\MytgmIl.exe
  C:\Windows\System\MytgmIl.exe
  2⤵
  PID:6304
- C:\Windows\System\svJcaWO.exe
  C:\Windows\System\svJcaWO.exe
  2⤵
  PID:6324
- C:\Windows\System\pZZsJct.exe
  C:\Windows\System\pZZsJct.exe
  2⤵
  PID:6344
- C:\Windows\System\NIPaZfp.exe
  C:\Windows\System\NIPaZfp.exe
  2⤵
  PID:6360
- C:\Windows\System\KxupdZb.exe
  C:\Windows\System\KxupdZb.exe
  2⤵
  PID:6380
- C:\Windows\System\RJOCVXb.exe
  C:\Windows\System\RJOCVXb.exe
  2⤵
  PID:6396
- C:\Windows\System\KNHpgUJ.exe
  C:\Windows\System\KNHpgUJ.exe
  2⤵
  PID:6412
- C:\Windows\System\whgOxRy.exe
  C:\Windows\System\whgOxRy.exe
  2⤵
  PID:6432
- C:\Windows\System\rJVPskv.exe
  C:\Windows\System\rJVPskv.exe
  2⤵
  PID:6448
- C:\Windows\System\NYmHPTp.exe
  C:\Windows\System\NYmHPTp.exe
  2⤵
  PID:6468
- C:\Windows\System\UojhiZc.exe
  C:\Windows\System\UojhiZc.exe
  2⤵
  PID:6484
- C:\Windows\System\yUOgLzx.exe
  C:\Windows\System\yUOgLzx.exe
  2⤵
  PID:6504
- C:\Windows\System\XvuTLTY.exe
  C:\Windows\System\XvuTLTY.exe
  2⤵
  PID:6548
- C:\Windows\System\lfcGzlj.exe
  C:\Windows\System\lfcGzlj.exe
  2⤵
  PID:6572
- C:\Windows\System\gjLJoph.exe
  C:\Windows\System\gjLJoph.exe
  2⤵
  PID:6596
- C:\Windows\System\MySeZRV.exe
  C:\Windows\System\MySeZRV.exe
  2⤵
  PID:6612
- C:\Windows\System\dhmIVoW.exe
  C:\Windows\System\dhmIVoW.exe
  2⤵
  PID:6628
- C:\Windows\System\AVrvvKG.exe
  C:\Windows\System\AVrvvKG.exe
  2⤵
  PID:6644
- C:\Windows\System\LciGuOP.exe
  C:\Windows\System\LciGuOP.exe
  2⤵
  PID:6660
- C:\Windows\System\UizyfNo.exe
  C:\Windows\System\UizyfNo.exe
  2⤵
  PID:6680
- C:\Windows\System\VSwXLLH.exe
  C:\Windows\System\VSwXLLH.exe
  2⤵
  PID:6696
- C:\Windows\System\vvgiZcC.exe
  C:\Windows\System\vvgiZcC.exe
  2⤵
  PID:6712
- C:\Windows\System\eWSsmWY.exe
  C:\Windows\System\eWSsmWY.exe
  2⤵
  PID:6728
- C:\Windows\System\ixFcMHj.exe
  C:\Windows\System\ixFcMHj.exe
  2⤵
  PID:6748
- C:\Windows\System\uahDaUp.exe
  C:\Windows\System\uahDaUp.exe
  2⤵
  PID:6764
- C:\Windows\System\pvfUzAj.exe
  C:\Windows\System\pvfUzAj.exe
  2⤵
  PID:6840
- C:\Windows\System\xYHQdHd.exe
  C:\Windows\System\xYHQdHd.exe
  2⤵
  PID:6856
- C:\Windows\System\eUpNFRP.exe
  C:\Windows\System\eUpNFRP.exe
  2⤵
  PID:6876
- C:\Windows\System\PNnoozl.exe
  C:\Windows\System\PNnoozl.exe
  2⤵
  PID:6896
- C:\Windows\System\OTYoooX.exe
  C:\Windows\System\OTYoooX.exe
  2⤵
  PID:6912
- C:\Windows\System\djGlgcu.exe
  C:\Windows\System\djGlgcu.exe
  2⤵
  PID:6928
- C:\Windows\System\uSYntrX.exe
  C:\Windows\System\uSYntrX.exe
  2⤵
  PID:6944
- C:\Windows\System\mHfOTQk.exe
  C:\Windows\System\mHfOTQk.exe
  2⤵
  PID:6960
- C:\Windows\System\cthcYBi.exe
  C:\Windows\System\cthcYBi.exe
  2⤵
  PID:6984
- C:\Windows\System\piMQSjL.exe
  C:\Windows\System\piMQSjL.exe
  2⤵
  PID:7000
- C:\Windows\System\maJQxkj.exe
  C:\Windows\System\maJQxkj.exe
  2⤵
  PID:7016
- C:\Windows\System\wOdmfGL.exe
  C:\Windows\System\wOdmfGL.exe
  2⤵
  PID:7032
- C:\Windows\System\cSrDUVQ.exe
  C:\Windows\System\cSrDUVQ.exe
  2⤵
  PID:7048
- C:\Windows\System\RcIoFjA.exe
  C:\Windows\System\RcIoFjA.exe
  2⤵
  PID:7064
- C:\Windows\System\yWVbPHZ.exe
  C:\Windows\System\yWVbPHZ.exe
  2⤵
  PID:7112
- C:\Windows\System\Attwixx.exe
  C:\Windows\System\Attwixx.exe
  2⤵
  PID:7136
- C:\Windows\System\kltrdbT.exe
  C:\Windows\System\kltrdbT.exe
  2⤵
  PID:7152
- C:\Windows\System\uSWlLXS.exe
  C:\Windows\System\uSWlLXS.exe
  2⤵
  PID:6128
- C:\Windows\System\CEITUre.exe
  C:\Windows\System\CEITUre.exe
  2⤵
  PID:6164
- C:\Windows\System\BERDIKt.exe
  C:\Windows\System\BERDIKt.exe
  2⤵
  PID:5200
- C:\Windows\System\OTPLgYG.exe
  C:\Windows\System\OTPLgYG.exe
  2⤵
  PID:6212
- C:\Windows\System\tPeuqEz.exe
  C:\Windows\System\tPeuqEz.exe
  2⤵
  PID:6236
- C:\Windows\System\IcwZSGy.exe
  C:\Windows\System\IcwZSGy.exe
  2⤵
  PID:6296
- C:\Windows\System\qCgZdYY.exe
  C:\Windows\System\qCgZdYY.exe
  2⤵
  PID:6372
- C:\Windows\System\HBsdwEu.exe
  C:\Windows\System\HBsdwEu.exe
  2⤵
  PID:6280
- C:\Windows\System\wzfXEGa.exe
  C:\Windows\System\wzfXEGa.exe
  2⤵
  PID:6284
- C:\Windows\System\PWRZGnk.exe
  C:\Windows\System\PWRZGnk.exe
  2⤵
  PID:6352
- C:\Windows\System\WcbgCHc.exe
  C:\Windows\System\WcbgCHc.exe
  2⤵
  PID:6444
- C:\Windows\System\xuxIYYL.exe
  C:\Windows\System\xuxIYYL.exe
  2⤵
  PID:6480
- C:\Windows\System\NLbhnCb.exe
  C:\Windows\System\NLbhnCb.exe
  2⤵
  PID:6392
- C:\Windows\System\aeQPxFV.exe
  C:\Windows\System\aeQPxFV.exe
  2⤵
  PID:6500
- C:\Windows\System\pUFBDSA.exe
  C:\Windows\System\pUFBDSA.exe
  2⤵
  PID:6524
- C:\Windows\System\pVDDVeT.exe
  C:\Windows\System\pVDDVeT.exe
  2⤵
  PID:6540
- C:\Windows\System\DJTKWWK.exe
  C:\Windows\System\DJTKWWK.exe
  2⤵
  PID:6584
- C:\Windows\System\lNwXepL.exe
  C:\Windows\System\lNwXepL.exe
  2⤵
  PID:6588
- C:\Windows\System\aVYBfBp.exe
  C:\Windows\System\aVYBfBp.exe
  2⤵
  PID:6652
- C:\Windows\System\fgdQBfx.exe
  C:\Windows\System\fgdQBfx.exe
  2⤵
  PID:6692
- C:\Windows\System\erpHPqZ.exe
  C:\Windows\System\erpHPqZ.exe
  2⤵
  PID:6672
- C:\Windows\System\cCLWTRD.exe
  C:\Windows\System\cCLWTRD.exe
  2⤵
  PID:6708
- C:\Windows\System\YXzlVms.exe
  C:\Windows\System\YXzlVms.exe
  2⤵
  PID:6784
- C:\Windows\System\LmpUAQw.exe
  C:\Windows\System\LmpUAQw.exe
  2⤵
  PID:6808
- C:\Windows\System\wRczCRM.exe
  C:\Windows\System\wRczCRM.exe
  2⤵
  PID:6828
- C:\Windows\System\XSFzaiL.exe
  C:\Windows\System\XSFzaiL.exe
  2⤵
  PID:6884
- C:\Windows\System\AHWvFEB.exe
  C:\Windows\System\AHWvFEB.exe
  2⤵
  PID:6920
- C:\Windows\System\ugesvcU.exe
  C:\Windows\System\ugesvcU.exe
  2⤵
  PID:6836
- C:\Windows\System\xHNVGBq.exe
  C:\Windows\System\xHNVGBq.exe
  2⤵
  PID:6940
- C:\Windows\System\oOFraAz.exe
  C:\Windows\System\oOFraAz.exe
  2⤵
  PID:6908
- C:\Windows\System\kbYGgSV.exe
  C:\Windows\System\kbYGgSV.exe
  2⤵
  PID:6996
- C:\Windows\System\PFnldey.exe
  C:\Windows\System\PFnldey.exe
  2⤵
  PID:7024
- C:\Windows\System\czbNhRm.exe
  C:\Windows\System\czbNhRm.exe
  2⤵
  PID:7072
- C:\Windows\System\HtMMXCB.exe
  C:\Windows\System\HtMMXCB.exe
  2⤵
  PID:6820
- C:\Windows\System\DayMoOv.exe
  C:\Windows\System\DayMoOv.exe
  2⤵
  PID:4340
- C:\Windows\System\UiyQhMG.exe
  C:\Windows\System\UiyQhMG.exe
  2⤵
  PID:7160
- C:\Windows\System\qAiHOrg.exe
  C:\Windows\System\qAiHOrg.exe
  2⤵
  PID:5596
- C:\Windows\System\vyvDWIU.exe
  C:\Windows\System\vyvDWIU.exe
  2⤵
  PID:6000
- C:\Windows\System\aEDdAns.exe
  C:\Windows\System\aEDdAns.exe
  2⤵
  PID:6232
- C:\Windows\System\ScpVdZi.exe
  C:\Windows\System\ScpVdZi.exe
  2⤵
  PID:6312
- C:\Windows\System\xpLpHjF.exe
  C:\Windows\System\xpLpHjF.exe
  2⤵
  PID:6440
- C:\Windows\System\MpfaXPZ.exe
  C:\Windows\System\MpfaXPZ.exe
  2⤵
  PID:6516
- C:\Windows\System\FPetCaq.exe
  C:\Windows\System\FPetCaq.exe
  2⤵
  PID:6556
- C:\Windows\System\Mtvdxuk.exe
  C:\Windows\System\Mtvdxuk.exe
  2⤵
  PID:6248
- C:\Windows\System\aVxDmjd.exe
  C:\Windows\System\aVxDmjd.exe
  2⤵
  PID:6424
- C:\Windows\System\ZRhHxUy.exe
  C:\Windows\System\ZRhHxUy.exe
  2⤵
  PID:6512
- C:\Windows\System\mZZVtKd.exe
  C:\Windows\System\mZZVtKd.exe
  2⤵
  PID:6688
- C:\Windows\System\DhroZSM.exe
  C:\Windows\System\DhroZSM.exe
  2⤵
  PID:6756
- C:\Windows\System\GqzNwAD.exe
  C:\Windows\System\GqzNwAD.exe
  2⤵
  PID:6640
- C:\Windows\System\tVbazPz.exe
  C:\Windows\System\tVbazPz.exe
  2⤵
  PID:6804
- C:\Windows\System\IlXNHRE.exe
  C:\Windows\System\IlXNHRE.exe
  2⤵
  PID:6872
- C:\Windows\System\fmHDYBe.exe
  C:\Windows\System\fmHDYBe.exe
  2⤵
  PID:7060
- C:\Windows\System\tazOVWb.exe
  C:\Windows\System\tazOVWb.exe
  2⤵
  PID:6832
- C:\Windows\System\nsGEgiA.exe
  C:\Windows\System\nsGEgiA.exe
  2⤵
  PID:7100
- C:\Windows\System\LSgpcpo.exe
  C:\Windows\System\LSgpcpo.exe
  2⤵
  PID:6976
- C:\Windows\System\TNTpDYr.exe
  C:\Windows\System\TNTpDYr.exe
  2⤵
  PID:5628
- C:\Windows\System\AEalBre.exe
  C:\Windows\System\AEalBre.exe
  2⤵
  PID:7132
- C:\Windows\System\fQBFOMr.exe
  C:\Windows\System\fQBFOMr.exe
  2⤵
  PID:6196
- C:\Windows\System\sMuyyYC.exe
  C:\Windows\System\sMuyyYC.exe
  2⤵
  PID:6356
- C:\Windows\System\jBAkbyQ.exe
  C:\Windows\System\jBAkbyQ.exe
  2⤵
  PID:6268
- C:\Windows\System\YDVFQxn.exe
  C:\Windows\System\YDVFQxn.exe
  2⤵
  PID:6604
- C:\Windows\System\urgCOkM.exe
  C:\Windows\System\urgCOkM.exe
  2⤵
  PID:6536
- C:\Windows\System\ofWbaUB.exe
  C:\Windows\System\ofWbaUB.exe
  2⤵
  PID:6740
- C:\Windows\System\xdTcxSl.exe
  C:\Windows\System\xdTcxSl.exe
  2⤵
  PID:6492
- C:\Windows\System\BJbVyPN.exe
  C:\Windows\System\BJbVyPN.exe
  2⤵
  PID:6724
- C:\Windows\System\gGFYqJi.exe
  C:\Windows\System\gGFYqJi.exe
  2⤵
  PID:6904
- C:\Windows\System\QbLlfuD.exe
  C:\Windows\System\QbLlfuD.exe
  2⤵
  PID:7080
- C:\Windows\System\enNuslt.exe
  C:\Windows\System\enNuslt.exe
  2⤵
  PID:6168
- C:\Windows\System\pmCWHCb.exe
  C:\Windows\System\pmCWHCb.exe
  2⤵
  PID:7096
- C:\Windows\System\xnBxqkG.exe
  C:\Windows\System\xnBxqkG.exe
  2⤵
  PID:6476
- C:\Windows\System\PGIUCtH.exe
  C:\Windows\System\PGIUCtH.exe
  2⤵
  PID:6892
- C:\Windows\System\MUlDypW.exe
  C:\Windows\System\MUlDypW.exe
  2⤵
  PID:6772
- C:\Windows\System\TWEgauc.exe
  C:\Windows\System\TWEgauc.exe
  2⤵
  PID:6608
- C:\Windows\System\OtiRNJS.exe
  C:\Windows\System\OtiRNJS.exe
  2⤵
  PID:6704
- C:\Windows\System\VIJdLqR.exe
  C:\Windows\System\VIJdLqR.exe
  2⤵
  PID:6252
- C:\Windows\System\hoOzjWO.exe
  C:\Windows\System\hoOzjWO.exe
  2⤵
  PID:6180
- C:\Windows\System\hfAGocT.exe
  C:\Windows\System\hfAGocT.exe
  2⤵
  PID:6736
- C:\Windows\System\tiKHvoE.exe
  C:\Windows\System\tiKHvoE.exe
  2⤵
  PID:6200
- C:\Windows\System\EGiDigb.exe
  C:\Windows\System\EGiDigb.exe
  2⤵
  PID:7180
- C:\Windows\System\JePWyrt.exe
  C:\Windows\System\JePWyrt.exe
  2⤵
  PID:7196
- C:\Windows\System\WDAOREe.exe
  C:\Windows\System\WDAOREe.exe
  2⤵
  PID:7216
- C:\Windows\System\JXqTaWM.exe
  C:\Windows\System\JXqTaWM.exe
  2⤵
  PID:7232
- C:\Windows\System\vCaLbtf.exe
  C:\Windows\System\vCaLbtf.exe
  2⤵
  PID:7252
- C:\Windows\System\dkTqqLh.exe
  C:\Windows\System\dkTqqLh.exe
  2⤵
  PID:7272
- C:\Windows\System\oImUGhv.exe
  C:\Windows\System\oImUGhv.exe
  2⤵
  PID:7288
- C:\Windows\System\GbKmpkh.exe
  C:\Windows\System\GbKmpkh.exe
  2⤵
  PID:7304
- C:\Windows\System\XzUmsFo.exe
  C:\Windows\System\XzUmsFo.exe
  2⤵
  PID:7320
- C:\Windows\System\GvKiUEA.exe
  C:\Windows\System\GvKiUEA.exe
  2⤵
  PID:7336
- C:\Windows\System\AvFGjfq.exe
  C:\Windows\System\AvFGjfq.exe
  2⤵
  PID:7352
- C:\Windows\System\WIDjOie.exe
  C:\Windows\System\WIDjOie.exe
  2⤵
  PID:7372
- C:\Windows\System\DoLbDaR.exe
  C:\Windows\System\DoLbDaR.exe
  2⤵
  PID:7408
- C:\Windows\System\AbodiNq.exe
  C:\Windows\System\AbodiNq.exe
  2⤵
  PID:7424
- C:\Windows\System\cWNrmYA.exe
  C:\Windows\System\cWNrmYA.exe
  2⤵
  PID:7440
- C:\Windows\System\nQbnaLq.exe
  C:\Windows\System\nQbnaLq.exe
  2⤵
  PID:7456
- C:\Windows\System\AECZkOY.exe
  C:\Windows\System\AECZkOY.exe
  2⤵
  PID:7472
- C:\Windows\System\lwYQZoy.exe
  C:\Windows\System\lwYQZoy.exe
  2⤵
  PID:7488
- C:\Windows\System\StBVTKc.exe
  C:\Windows\System\StBVTKc.exe
  2⤵
  PID:7504
- C:\Windows\System\ioYnHHZ.exe
  C:\Windows\System\ioYnHHZ.exe
  2⤵
  PID:7520
- C:\Windows\System\PDezUrN.exe
  C:\Windows\System\PDezUrN.exe
  2⤵
  PID:7536
- C:\Windows\System\FIruzAV.exe
  C:\Windows\System\FIruzAV.exe
  2⤵
  PID:7556
- C:\Windows\System\QdOiFEO.exe
  C:\Windows\System\QdOiFEO.exe
  2⤵
  PID:7572
- C:\Windows\System\ZgVxUua.exe
  C:\Windows\System\ZgVxUua.exe
  2⤵
  PID:7600
- C:\Windows\System\sZDKHKA.exe
  C:\Windows\System\sZDKHKA.exe
  2⤵
  PID:7616
- C:\Windows\System\jcAJcAV.exe
  C:\Windows\System\jcAJcAV.exe
  2⤵
  PID:7632
- C:\Windows\System\RCvsXGP.exe
  C:\Windows\System\RCvsXGP.exe
  2⤵
  PID:7648
- C:\Windows\System\aIOGyiV.exe
  C:\Windows\System\aIOGyiV.exe
  2⤵
  PID:7664
- C:\Windows\System\mtYheVY.exe
  C:\Windows\System\mtYheVY.exe
  2⤵
  PID:7708
- C:\Windows\System\uTdTocq.exe
  C:\Windows\System\uTdTocq.exe
  2⤵
  PID:7724
- C:\Windows\System\aidBHSY.exe
  C:\Windows\System\aidBHSY.exe
  2⤵
  PID:7744
- C:\Windows\System\nqEUQsg.exe
  C:\Windows\System\nqEUQsg.exe
  2⤵
  PID:7760
- C:\Windows\System\QLsLspe.exe
  C:\Windows\System\QLsLspe.exe
  2⤵
  PID:7776
- C:\Windows\System\kwHvJcD.exe
  C:\Windows\System\kwHvJcD.exe
  2⤵
  PID:7792
- C:\Windows\System\grRKDOB.exe
  C:\Windows\System\grRKDOB.exe
  2⤵
  PID:7828
- C:\Windows\System\RAcABqM.exe
  C:\Windows\System\RAcABqM.exe
  2⤵
  PID:7844
- C:\Windows\System\trTkoHG.exe
  C:\Windows\System\trTkoHG.exe
  2⤵
  PID:7880
- C:\Windows\System\ZfNbMYq.exe
  C:\Windows\System\ZfNbMYq.exe
  2⤵
  PID:7896
- C:\Windows\System\xGweeUe.exe
  C:\Windows\System\xGweeUe.exe
  2⤵
  PID:7912
- C:\Windows\System\voJLAZj.exe
  C:\Windows\System\voJLAZj.exe
  2⤵
  PID:7928
- C:\Windows\System\TUMwBDs.exe
  C:\Windows\System\TUMwBDs.exe
  2⤵
  PID:7944
- C:\Windows\System\ayyAISD.exe
  C:\Windows\System\ayyAISD.exe
  2⤵
  PID:7960
- C:\Windows\System\ScnyHzt.exe
  C:\Windows\System\ScnyHzt.exe
  2⤵
  PID:7988
- C:\Windows\System\htvqCUE.exe
  C:\Windows\System\htvqCUE.exe
  2⤵
  PID:8004
- C:\Windows\System\NXjFLlc.exe
  C:\Windows\System\NXjFLlc.exe
  2⤵
  PID:8024
- C:\Windows\System\IfESJMQ.exe
  C:\Windows\System\IfESJMQ.exe
  2⤵
  PID:8040
- C:\Windows\System\LnPLlOt.exe
  C:\Windows\System\LnPLlOt.exe
  2⤵
  PID:8056
- C:\Windows\System\tpMbOID.exe
  C:\Windows\System\tpMbOID.exe
  2⤵
  PID:8076
- C:\Windows\System\qDUeOAq.exe
  C:\Windows\System\qDUeOAq.exe
  2⤵
  PID:8092
- C:\Windows\System\MPwnHoh.exe
  C:\Windows\System\MPwnHoh.exe
  2⤵
  PID:8112
- C:\Windows\System\yfvlIdK.exe
  C:\Windows\System\yfvlIdK.exe
  2⤵
  PID:8152
- C:\Windows\System\oLVeThO.exe
  C:\Windows\System\oLVeThO.exe
  2⤵
  PID:8172
- C:\Windows\System\UpRmLlY.exe
  C:\Windows\System\UpRmLlY.exe
  2⤵
  PID:8188
- C:\Windows\System\EbpGjvY.exe
  C:\Windows\System\EbpGjvY.exe
  2⤵
  PID:7208
- C:\Windows\System\gaqFNCW.exe
  C:\Windows\System\gaqFNCW.exe
  2⤵
  PID:7040
- C:\Windows\System\RYPfLVN.exe
  C:\Windows\System\RYPfLVN.exe
  2⤵
  PID:7224
- C:\Windows\System\emTzvXq.exe
  C:\Windows\System\emTzvXq.exe
  2⤵
  PID:7380
- C:\Windows\System\agWQvBI.exe
  C:\Windows\System\agWQvBI.exe
  2⤵
  PID:7364
- C:\Windows\System\bsvZMDK.exe
  C:\Windows\System\bsvZMDK.exe
  2⤵
  PID:7388
- C:\Windows\System\rzWtIxi.exe
  C:\Windows\System\rzWtIxi.exe
  2⤵
  PID:7432
- C:\Windows\System\vpIlGIg.exe
  C:\Windows\System\vpIlGIg.exe
  2⤵
  PID:7496
- C:\Windows\System\mthtGpr.exe
  C:\Windows\System\mthtGpr.exe
  2⤵
  PID:7480
- C:\Windows\System\hEywGFW.exe
  C:\Windows\System\hEywGFW.exe
  2⤵
  PID:7448
- C:\Windows\System\DgsCvqJ.exe
  C:\Windows\System\DgsCvqJ.exe
  2⤵
  PID:7568
- C:\Windows\System\lATRwUG.exe
  C:\Windows\System\lATRwUG.exe
  2⤵
  PID:7612
- C:\Windows\System\lMcbZEi.exe
  C:\Windows\System\lMcbZEi.exe
  2⤵
  PID:7596
- C:\Windows\System\TXTrcHS.exe
  C:\Windows\System\TXTrcHS.exe
  2⤵
  PID:7672
- C:\Windows\System\iLaOZgd.exe
  C:\Windows\System\iLaOZgd.exe
  2⤵
  PID:7688
- C:\Windows\System\bgYDljF.exe
  C:\Windows\System\bgYDljF.exe
  2⤵
  PID:7732
- C:\Windows\System\UbQfggB.exe
  C:\Windows\System\UbQfggB.exe
  2⤵
  PID:7772
- C:\Windows\System\VzYCyac.exe
  C:\Windows\System\VzYCyac.exe
  2⤵
  PID:7716
- C:\Windows\System\UylUVKC.exe
  C:\Windows\System\UylUVKC.exe
  2⤵
  PID:7788
- C:\Windows\System\DzknCSQ.exe
  C:\Windows\System\DzknCSQ.exe
  2⤵
  PID:7552
- C:\Windows\System\UEQHOED.exe
  C:\Windows\System\UEQHOED.exe
  2⤵
  PID:7840
- C:\Windows\System\aBpdrHW.exe
  C:\Windows\System\aBpdrHW.exe
  2⤵
  PID:7860
- C:\Windows\System\oBXUJzJ.exe
  C:\Windows\System\oBXUJzJ.exe
  2⤵
  PID:7908
- C:\Windows\System\JtBRfSI.exe
  C:\Windows\System\JtBRfSI.exe
  2⤵
  PID:7976
- C:\Windows\System\vxRaQYJ.exe
  C:\Windows\System\vxRaQYJ.exe
  2⤵
  PID:7920
- C:\Windows\System\qvwnoPu.exe
  C:\Windows\System\qvwnoPu.exe
  2⤵
  PID:8052
- C:\Windows\System\LONdrgI.exe
  C:\Windows\System\LONdrgI.exe
  2⤵
  PID:8064
- C:\Windows\System\VFOUsHj.exe
  C:\Windows\System\VFOUsHj.exe
  2⤵
  PID:8032
- C:\Windows\System\elPqeOQ.exe
  C:\Windows\System\elPqeOQ.exe
  2⤵
  PID:8104
- C:\Windows\System\VvfYUsX.exe
  C:\Windows\System\VvfYUsX.exe
  2⤵
  PID:8180
- C:\Windows\System\HDPPrhl.exe
  C:\Windows\System\HDPPrhl.exe
  2⤵
  PID:7592
- C:\Windows\System\GwmhJDV.exe
  C:\Windows\System\GwmhJDV.exe
  2⤵
  PID:7980
- C:\Windows\System\kxfjgxw.exe
  C:\Windows\System\kxfjgxw.exe
  2⤵
  PID:6796
- C:\Windows\System\yMbPKYP.exe
  C:\Windows\System\yMbPKYP.exe
  2⤵
  PID:7260
- C:\Windows\System\DqISIyi.exe
  C:\Windows\System\DqISIyi.exe
  2⤵
  PID:7268
- C:\Windows\System\bLpfRbL.exe
  C:\Windows\System\bLpfRbL.exe
  2⤵
  PID:7864
- C:\Windows\System\sZzmdhn.exe
  C:\Windows\System\sZzmdhn.exe
  2⤵
  PID:7972
- C:\Windows\System\GJaXvxR.exe
  C:\Windows\System\GJaXvxR.exe
  2⤵
  PID:7544
- C:\Windows\System\mRHSNOH.exe
  C:\Windows\System\mRHSNOH.exe
  2⤵
  PID:7608
- C:\Windows\System\OJXIAvF.exe
  C:\Windows\System\OJXIAvF.exe
  2⤵
  PID:7704
- C:\Windows\System\qXKqPgR.exe
  C:\Windows\System\qXKqPgR.exe
  2⤵
  PID:7532
- C:\Windows\System\JgZQWdO.exe
  C:\Windows\System\JgZQWdO.exe
  2⤵
  PID:6580
- C:\Windows\System\hUVrIcE.exe
  C:\Windows\System\hUVrIcE.exe
  2⤵
  PID:7564
- C:\Windows\System\ftyqvRD.exe
  C:\Windows\System\ftyqvRD.exe
  2⤵
  PID:7588
- C:\Windows\System\uQhnmkF.exe
  C:\Windows\System\uQhnmkF.exe
  2⤵
  PID:7768
- C:\Windows\System\QDKbOCE.exe
  C:\Windows\System\QDKbOCE.exe
  2⤵
  PID:7384
- C:\Windows\System\XqUGiKC.exe
  C:\Windows\System\XqUGiKC.exe
  2⤵
  PID:8012
- C:\Windows\System\VqEFyvb.exe
  C:\Windows\System\VqEFyvb.exe
  2⤵
  PID:7888
- C:\Windows\System\VUVvPnH.exe
  C:\Windows\System\VUVvPnH.exe
  2⤵
  PID:7892
- C:\Windows\System\IzeMKmc.exe
  C:\Windows\System\IzeMKmc.exe
  2⤵
  PID:8124
- C:\Windows\System\TJlRfOt.exe
  C:\Windows\System\TJlRfOt.exe
  2⤵
  PID:7280
- C:\Windows\System\UhbHhOd.exe
  C:\Windows\System\UhbHhOd.exe
  2⤵
  PID:7468
- C:\Windows\System\UxCuWXZ.exe
  C:\Windows\System\UxCuWXZ.exe
  2⤵
  PID:7656
- C:\Windows\System\UjGnVZh.exe
  C:\Windows\System\UjGnVZh.exe
  2⤵
  PID:7856
- C:\Windows\System\xmxrpee.exe
  C:\Windows\System\xmxrpee.exe
  2⤵
  PID:7784
- C:\Windows\System\keJqyCM.exe
  C:\Windows\System\keJqyCM.exe
  2⤵
  PID:7284
- C:\Windows\System\KwmfSfB.exe
  C:\Windows\System\KwmfSfB.exe
  2⤵
  PID:8132
- C:\Windows\System\tsxAHCS.exe
  C:\Windows\System\tsxAHCS.exe
  2⤵
  PID:8128
- C:\Windows\System\kQFxovw.exe
  C:\Windows\System\kQFxovw.exe
  2⤵
  PID:8144
- C:\Windows\System\SPuOaRM.exe
  C:\Windows\System\SPuOaRM.exe
  2⤵
  PID:7684
- C:\Windows\System\nWvHrpN.exe
  C:\Windows\System\nWvHrpN.exe
  2⤵
  PID:6340
- C:\Windows\System\wAlghAH.exe
  C:\Windows\System\wAlghAH.exe
  2⤵
  PID:7368
- C:\Windows\System\dfTPBhr.exe
  C:\Windows\System\dfTPBhr.exe
  2⤵
  PID:7300
- C:\Windows\System\ffEkVrX.exe
  C:\Windows\System\ffEkVrX.exe
  2⤵
  PID:8184
- C:\Windows\System\DZAyeDE.exe
  C:\Windows\System\DZAyeDE.exe
  2⤵
  PID:7204
- C:\Windows\System\gAjhlas.exe
  C:\Windows\System\gAjhlas.exe
  2⤵
  PID:8088
- C:\Windows\System\pNOvRJP.exe
  C:\Windows\System\pNOvRJP.exe
  2⤵
  PID:7512
- C:\Windows\System\uIEKbSe.exe
  C:\Windows\System\uIEKbSe.exe
  2⤵
  PID:7696
- C:\Windows\System\LKcfoIF.exe
  C:\Windows\System\LKcfoIF.exe
  2⤵
  PID:8048
- C:\Windows\System\tRFGOFV.exe
  C:\Windows\System\tRFGOFV.exe
  2⤵
  PID:7720
- C:\Windows\System\WoNVvyp.exe
  C:\Windows\System\WoNVvyp.exe
  2⤵
  PID:7212
- C:\Windows\System\BrDGvdO.exe
  C:\Windows\System\BrDGvdO.exe
  2⤵
  PID:7420
- C:\Windows\System\lJnQtio.exe
  C:\Windows\System\lJnQtio.exe
  2⤵
  PID:7348
- C:\Windows\System\QKAJSRb.exe
  C:\Windows\System\QKAJSRb.exe
  2⤵
  PID:7756
- C:\Windows\System\VaLKgnp.exe
  C:\Windows\System\VaLKgnp.exe
  2⤵
  PID:8196
- C:\Windows\System\LNygHga.exe
  C:\Windows\System\LNygHga.exe
  2⤵
  PID:8212
- C:\Windows\System\wuqKFQJ.exe
  C:\Windows\System\wuqKFQJ.exe
  2⤵
  PID:8228
- C:\Windows\System\SzNkSjr.exe
  C:\Windows\System\SzNkSjr.exe
  2⤵
  PID:8244
- C:\Windows\System\RLFyxDr.exe
  C:\Windows\System\RLFyxDr.exe
  2⤵
  PID:8260
- C:\Windows\System\zEnhMZl.exe
  C:\Windows\System\zEnhMZl.exe
  2⤵
  PID:8276
- C:\Windows\System\lRzBAlq.exe
  C:\Windows\System\lRzBAlq.exe
  2⤵
  PID:8292
- C:\Windows\System\OXqktbb.exe
  C:\Windows\System\OXqktbb.exe
  2⤵
  PID:8308
- C:\Windows\System\aFNNCvZ.exe
  C:\Windows\System\aFNNCvZ.exe
  2⤵
  PID:8324
- C:\Windows\System\ZNWEkPR.exe
  C:\Windows\System\ZNWEkPR.exe
  2⤵
  PID:8340
- C:\Windows\System\qfuptLt.exe
  C:\Windows\System\qfuptLt.exe
  2⤵
  PID:8356
- C:\Windows\System\tWIJeXu.exe
  C:\Windows\System\tWIJeXu.exe
  2⤵
  PID:8380
- C:\Windows\System\OJhVxBV.exe
  C:\Windows\System\OJhVxBV.exe
  2⤵
  PID:8396
- C:\Windows\System\DHsJgae.exe
  C:\Windows\System\DHsJgae.exe
  2⤵
  PID:8412
- C:\Windows\System\syZgpjs.exe
  C:\Windows\System\syZgpjs.exe
  2⤵
  PID:8428
- C:\Windows\System\UdJpzdJ.exe
  C:\Windows\System\UdJpzdJ.exe
  2⤵
  PID:8444
- C:\Windows\System\CGcdZBE.exe
  C:\Windows\System\CGcdZBE.exe
  2⤵
  PID:8460
- C:\Windows\System\jooPvgj.exe
  C:\Windows\System\jooPvgj.exe
  2⤵
  PID:8476
- C:\Windows\System\PWOWcGp.exe
  C:\Windows\System\PWOWcGp.exe
  2⤵
  PID:8492
- C:\Windows\System\CTqVevi.exe
  C:\Windows\System\CTqVevi.exe
  2⤵
  PID:8508
- C:\Windows\System\ZkFzesX.exe
  C:\Windows\System\ZkFzesX.exe
  2⤵
  PID:8524
- C:\Windows\System\FXktXXL.exe
  C:\Windows\System\FXktXXL.exe
  2⤵
  PID:8540
- C:\Windows\System\olhRRzw.exe
  C:\Windows\System\olhRRzw.exe
  2⤵
  PID:8556
- C:\Windows\System\rMMLdAi.exe
  C:\Windows\System\rMMLdAi.exe
  2⤵
  PID:8572
- C:\Windows\System\hGPpyGh.exe
  C:\Windows\System\hGPpyGh.exe
  2⤵
  PID:8588
- C:\Windows\System\cveUbUz.exe
  C:\Windows\System\cveUbUz.exe
  2⤵
  PID:8604
- C:\Windows\System\tfcKoGX.exe
  C:\Windows\System\tfcKoGX.exe
  2⤵
  PID:8620
- C:\Windows\System\FgsKOWp.exe
  C:\Windows\System\FgsKOWp.exe
  2⤵
  PID:8640
- C:\Windows\System\nWAWTMV.exe
  C:\Windows\System\nWAWTMV.exe
  2⤵
  PID:8656
- C:\Windows\System\VeXgonE.exe
  C:\Windows\System\VeXgonE.exe
  2⤵
  PID:8672
- C:\Windows\System\IvJoRBJ.exe
  C:\Windows\System\IvJoRBJ.exe
  2⤵
  PID:8688
- C:\Windows\System\gHBujeu.exe
  C:\Windows\System\gHBujeu.exe
  2⤵
  PID:8704
- C:\Windows\System\fvSBeqT.exe
  C:\Windows\System\fvSBeqT.exe
  2⤵
  PID:8720
- C:\Windows\System\sdKkJGO.exe
  C:\Windows\System\sdKkJGO.exe
  2⤵
  PID:8756
- C:\Windows\System\DWTJhTR.exe
  C:\Windows\System\DWTJhTR.exe
  2⤵
  PID:8772
- C:\Windows\System\Vnpkcjw.exe
  C:\Windows\System\Vnpkcjw.exe
  2⤵
  PID:8788
- C:\Windows\System\jLiPEAR.exe
  C:\Windows\System\jLiPEAR.exe
  2⤵
  PID:8808
- C:\Windows\System\deJICqu.exe
  C:\Windows\System\deJICqu.exe
  2⤵
  PID:8824
- C:\Windows\System\DAMTdvY.exe
  C:\Windows\System\DAMTdvY.exe
  2⤵
  PID:8840
- C:\Windows\System\TaQQzOd.exe
  C:\Windows\System\TaQQzOd.exe
  2⤵
  PID:8856
- C:\Windows\System\aLxALnq.exe
  C:\Windows\System\aLxALnq.exe
  2⤵
  PID:8872
- C:\Windows\System\KxtWpmG.exe
  C:\Windows\System\KxtWpmG.exe
  2⤵
  PID:9032
- C:\Windows\System\hAKZKAS.exe
  C:\Windows\System\hAKZKAS.exe
  2⤵
  PID:9048
- C:\Windows\System\ZmMxrwl.exe
  C:\Windows\System\ZmMxrwl.exe
  2⤵
  PID:9064
- C:\Windows\System\rJgUFQw.exe
  C:\Windows\System\rJgUFQw.exe
  2⤵
  PID:9080
- C:\Windows\System\YrYpWRv.exe
  C:\Windows\System\YrYpWRv.exe
  2⤵
  PID:9096
- C:\Windows\System\WJPtoYz.exe
  C:\Windows\System\WJPtoYz.exe
  2⤵
  PID:9112
- C:\Windows\System\byMEvKB.exe
  C:\Windows\System\byMEvKB.exe
  2⤵
  PID:9128
- C:\Windows\System\nFyijeQ.exe
  C:\Windows\System\nFyijeQ.exe
  2⤵
  PID:9144
- C:\Windows\System\QXmhpMC.exe
  C:\Windows\System\QXmhpMC.exe
  2⤵
  PID:9160
- C:\Windows\System\OFyrllH.exe
  C:\Windows\System\OFyrllH.exe
  2⤵
  PID:9176
- C:\Windows\System\gEelOTl.exe
  C:\Windows\System\gEelOTl.exe
  2⤵
  PID:9192
- C:\Windows\System\YGIhmfo.exe
  C:\Windows\System\YGIhmfo.exe
  2⤵
  PID:9208
- C:\Windows\System\OisdkIx.exe
  C:\Windows\System\OisdkIx.exe
  2⤵
  PID:8208
- C:\Windows\System\wDyWBsR.exe
  C:\Windows\System\wDyWBsR.exe
  2⤵
  PID:8268
- C:\Windows\System\TWtQiJQ.exe
  C:\Windows\System\TWtQiJQ.exe
  2⤵
  PID:8272
- C:\Windows\System\kTmZSRH.exe
  C:\Windows\System\kTmZSRH.exe
  2⤵
  PID:8220
- C:\Windows\System\AGIuLub.exe
  C:\Windows\System\AGIuLub.exe
  2⤵
  PID:8404
- C:\Windows\System\TAaUkbZ.exe
  C:\Windows\System\TAaUkbZ.exe
  2⤵
  PID:8288
- C:\Windows\System\hduXgYs.exe
  C:\Windows\System\hduXgYs.exe
  2⤵
  PID:8320
- C:\Windows\System\yMbhNYq.exe
  C:\Windows\System\yMbhNYq.exe
  2⤵
  PID:8472
- C:\Windows\System\qOXCZZL.exe
  C:\Windows\System\qOXCZZL.exe
  2⤵
  PID:8632
- C:\Windows\System\ltEbbfa.exe
  C:\Windows\System\ltEbbfa.exe
  2⤵
  PID:8700
- C:\Windows\System\aOffTUj.exe
  C:\Windows\System\aOffTUj.exe
  2⤵
  PID:8684
- C:\Windows\System\HyChTjH.exe
  C:\Windows\System\HyChTjH.exe
  2⤵
  PID:8612
- C:\Windows\System\jpwWtqu.exe
  C:\Windows\System\jpwWtqu.exe
  2⤵
  PID:8816
- C:\Windows\System\LrgYHPO.exe
  C:\Windows\System\LrgYHPO.exe
  2⤵
  PID:8928
- C:\Windows\System\iOKNwcx.exe
  C:\Windows\System\iOKNwcx.exe
  2⤵
  PID:1464
- C:\Windows\System\hyPuLCG.exe
  C:\Windows\System\hyPuLCG.exe
  2⤵
  PID:8936
- C:\Windows\System\ncbVxCA.exe
  C:\Windows\System\ncbVxCA.exe
  2⤵
  PID:8916
- C:\Windows\System\HvSHxIc.exe
  C:\Windows\System\HvSHxIc.exe
  2⤵
  PID:8964
- C:\Windows\System\DopnBXR.exe
  C:\Windows\System\DopnBXR.exe
  2⤵
  PID:8920
- C:\Windows\System\DqqrRzT.exe
  C:\Windows\System\DqqrRzT.exe
  2⤵
  PID:8984
- C:\Windows\System\ELPZumz.exe
  C:\Windows\System\ELPZumz.exe
  2⤵
  PID:8996
- C:\Windows\System\zzgOGhV.exe
  C:\Windows\System\zzgOGhV.exe
  2⤵
  PID:9016
- C:\Windows\System\WSSsWdb.exe
  C:\Windows\System\WSSsWdb.exe
  2⤵
  PID:9060
- C:\Windows\System\bkqHgwW.exe
  C:\Windows\System\bkqHgwW.exe
  2⤵
  PID:9124
- C:\Windows\System\YrLfTOK.exe
  C:\Windows\System\YrLfTOK.exe
  2⤵
  PID:7680
- C:\Windows\System\PaPuGss.exe
  C:\Windows\System\PaPuGss.exe
  2⤵
  PID:8372
- C:\Windows\System\pfyVUms.exe
  C:\Windows\System\pfyVUms.exe
  2⤵
  PID:9072
- C:\Windows\System\ErnviBj.exe
  C:\Windows\System\ErnviBj.exe
  2⤵
  PID:8436
- C:\Windows\System\QLKvmXs.exe
  C:\Windows\System\QLKvmXs.exe
  2⤵
  PID:9140
- C:\Windows\System\kUNkEKU.exe
  C:\Windows\System\kUNkEKU.exe
  2⤵
  PID:9204
- C:\Windows\System\tTFJfoi.exe
  C:\Windows\System\tTFJfoi.exe
  2⤵
  PID:8548
- C:\Windows\System\ZVtTwws.exe
  C:\Windows\System\ZVtTwws.exe
  2⤵
  PID:8596
- C:\Windows\System\sbSiAad.exe
  C:\Windows\System\sbSiAad.exe
  2⤵
  PID:8664
- C:\Windows\System\RkSvhmd.exe
  C:\Windows\System\RkSvhmd.exe
  2⤵
  PID:8696
- C:\Windows\System\YSOlNDL.exe
  C:\Windows\System\YSOlNDL.exe
  2⤵
  PID:8652
- C:\Windows\System\yLrWVdL.exe
  C:\Windows\System\yLrWVdL.exe
  2⤵
  PID:8880
- C:\Windows\System\zmVaBfQ.exe
  C:\Windows\System\zmVaBfQ.exe
  2⤵
  PID:8800
- C:\Windows\System\ByExYKK.exe
  C:\Windows\System\ByExYKK.exe
  2⤵
  PID:8900
- C:\Windows\System\RaUtako.exe
  C:\Windows\System\RaUtako.exe
  2⤵
  PID:8376
- C:\Windows\System\GqyapDY.exe
  C:\Windows\System\GqyapDY.exe
  2⤵
  PID:9136
- C:\Windows\System\wzfzZja.exe
  C:\Windows\System\wzfzZja.exe
  2⤵
  PID:8468
- C:\Windows\System\nqnrjbJ.exe
  C:\Windows\System\nqnrjbJ.exe
  2⤵
  PID:8452
- C:\Windows\System\XfixBPO.exe
  C:\Windows\System\XfixBPO.exe
  2⤵
  PID:8532
- C:\Windows\System\QnTxGIh.exe
  C:\Windows\System\QnTxGIh.exe
  2⤵
  PID:2660
- C:\Windows\System\rYtLmQI.exe
  C:\Windows\System\rYtLmQI.exe
  2⤵
  PID:8252
- C:\Windows\System\PQBuSmY.exe
  C:\Windows\System\PQBuSmY.exe
  2⤵
  PID:9004
- C:\Windows\System\QJHlKAA.exe
  C:\Windows\System\QJHlKAA.exe
  2⤵
  PID:8364
- C:\Windows\System\sgndcGQ.exe
  C:\Windows\System\sgndcGQ.exe
  2⤵
  PID:9200
- C:\Windows\System\FDkdMFI.exe
  C:\Windows\System\FDkdMFI.exe
  2⤵
  PID:9220
- C:\Windows\System\SjpDEhW.exe
  C:\Windows\System\SjpDEhW.exe
  2⤵
  PID:9236
- C:\Windows\System\qBnLSdw.exe
  C:\Windows\System\qBnLSdw.exe
  2⤵
  PID:9268
- C:\Windows\System\ZeqKEjd.exe
  C:\Windows\System\ZeqKEjd.exe
  2⤵
  PID:9284
- C:\Windows\System\GcNyEnw.exe
  C:\Windows\System\GcNyEnw.exe
  2⤵
  PID:9300
- C:\Windows\System\TMjvwgm.exe
  C:\Windows\System\TMjvwgm.exe
  2⤵
  PID:9316
- C:\Windows\System\nDFyEVC.exe
  C:\Windows\System\nDFyEVC.exe
  2⤵
  PID:9332
- C:\Windows\System\CcfRzEr.exe
  C:\Windows\System\CcfRzEr.exe
  2⤵
  PID:9348
- C:\Windows\System\LdUnbok.exe
  C:\Windows\System\LdUnbok.exe
  2⤵
  PID:9368
- C:\Windows\System\ItKfJJZ.exe
  C:\Windows\System\ItKfJJZ.exe
  2⤵
  PID:9384
- C:\Windows\System\AVjRVcn.exe
  C:\Windows\System\AVjRVcn.exe
  2⤵
  PID:9488
- C:\Windows\System\RCUOIzK.exe
  C:\Windows\System\RCUOIzK.exe
  2⤵
  PID:9504
- C:\Windows\System\ThodXDp.exe
  C:\Windows\System\ThodXDp.exe
  2⤵
  PID:9528
- C:\Windows\System\lGmIwEQ.exe
  C:\Windows\System\lGmIwEQ.exe
  2⤵
  PID:9544
- C:\Windows\System\NrSlPVf.exe
  C:\Windows\System\NrSlPVf.exe
  2⤵
  PID:9560
- C:\Windows\System\NxobiKr.exe
  C:\Windows\System\NxobiKr.exe
  2⤵
  PID:9576
- C:\Windows\System\sWooNky.exe
  C:\Windows\System\sWooNky.exe
  2⤵
  PID:9592
- C:\Windows\System\foiGLFW.exe
  C:\Windows\System\foiGLFW.exe
  2⤵
  PID:9608
- C:\Windows\System\xGzhhEr.exe
  C:\Windows\System\xGzhhEr.exe
  2⤵
  PID:9624
- C:\Windows\System\jLuNkrO.exe
  C:\Windows\System\jLuNkrO.exe
  2⤵
  PID:9640
- C:\Windows\System\wfLpGUI.exe
  C:\Windows\System\wfLpGUI.exe
  2⤵
  PID:9656
- C:\Windows\System\oUKbRAL.exe
  C:\Windows\System\oUKbRAL.exe
  2⤵
  PID:9672
- C:\Windows\System\GlNhZdR.exe
  C:\Windows\System\GlNhZdR.exe
  2⤵
  PID:9688
- C:\Windows\System\nAbprXH.exe
  C:\Windows\System\nAbprXH.exe
  2⤵
  PID:9704
- C:\Windows\System\zCDUZBK.exe
  C:\Windows\System\zCDUZBK.exe
  2⤵
  PID:9720
- C:\Windows\System\zPDRZec.exe
  C:\Windows\System\zPDRZec.exe
  2⤵
  PID:9736
- C:\Windows\System\tXfweje.exe
  C:\Windows\System\tXfweje.exe
  2⤵
  PID:9752
- C:\Windows\System\MTiZLmI.exe
  C:\Windows\System\MTiZLmI.exe
  2⤵
  PID:9768
- C:\Windows\System\UsQtOpX.exe
  C:\Windows\System\UsQtOpX.exe
  2⤵
  PID:9784
- C:\Windows\System\lcXsadT.exe
  C:\Windows\System\lcXsadT.exe
  2⤵
  PID:9864
- C:\Windows\System\okpPOvc.exe
  C:\Windows\System\okpPOvc.exe
  2⤵
  PID:9880
- C:\Windows\System\fQzWOLV.exe
  C:\Windows\System\fQzWOLV.exe
  2⤵
  PID:9908
- C:\Windows\System\CSXQHCB.exe
  C:\Windows\System\CSXQHCB.exe
  2⤵
  PID:9924
- C:\Windows\System\DPmNpka.exe
  C:\Windows\System\DPmNpka.exe
  2⤵
  PID:10012
- C:\Windows\System\weEsWyy.exe
  C:\Windows\System\weEsWyy.exe
  2⤵
  PID:10044
- C:\Windows\System\YYLQZOn.exe
  C:\Windows\System\YYLQZOn.exe
  2⤵
  PID:10060
- C:\Windows\System\pEGHfBJ.exe
  C:\Windows\System\pEGHfBJ.exe
  2⤵
  PID:10076
- C:\Windows\System\YMwUIzM.exe
  C:\Windows\System\YMwUIzM.exe
  2⤵
  PID:10092
- C:\Windows\System\RRlEFYA.exe
  C:\Windows\System\RRlEFYA.exe
  2⤵
  PID:10112
- C:\Windows\System\BOugntX.exe
  C:\Windows\System\BOugntX.exe
  2⤵
  PID:10128
- C:\Windows\System\tXuALIt.exe
  C:\Windows\System\tXuALIt.exe
  2⤵
  PID:10144
- C:\Windows\System\wJoEzih.exe
  C:\Windows\System\wJoEzih.exe
  2⤵
  PID:10160
- C:\Windows\System\THsrnSp.exe
  C:\Windows\System\THsrnSp.exe
  2⤵
  PID:10196
- C:\Windows\System\OVjjrAt.exe
  C:\Windows\System\OVjjrAt.exe
  2⤵
  PID:10212
- C:\Windows\System\xRuTxIt.exe
  C:\Windows\System\xRuTxIt.exe
  2⤵
  PID:10228
- C:\Windows\System\pIFlydq.exe
  C:\Windows\System\pIFlydq.exe
  2⤵
  PID:8732
- C:\Windows\System\tyOJkFj.exe
  C:\Windows\System\tyOJkFj.exe
  2⤵
  PID:8972
- C:\Windows\System\fZkTjaj.exe
  C:\Windows\System\fZkTjaj.exe
  2⤵
  PID:8992
- C:\Windows\System\qIsWRkJ.exe
  C:\Windows\System\qIsWRkJ.exe
  2⤵
  PID:8420
- C:\Windows\System\NelChqr.exe
  C:\Windows\System\NelChqr.exe
  2⤵
  PID:9244
- C:\Windows\System\gkRdrUL.exe
  C:\Windows\System\gkRdrUL.exe
  2⤵
  PID:8752
- C:\Windows\System\vdfFWnr.exe
  C:\Windows\System\vdfFWnr.exe
  2⤵
  PID:8352
- C:\Windows\System\vdDLSbG.exe
  C:\Windows\System\vdDLSbG.exe
  2⤵
  PID:8976
- C:\Windows\System\erCtmVc.exe
  C:\Windows\System\erCtmVc.exe
  2⤵
  PID:8256
- C:\Windows\System\AjaJsDV.exe
  C:\Windows\System\AjaJsDV.exe
  2⤵
  PID:9024
- C:\Windows\System\CBcWfmX.exe
  C:\Windows\System\CBcWfmX.exe
  2⤵
  PID:8568
- C:\Windows\System\figQUWS.exe
  C:\Windows\System\figQUWS.exe
  2⤵
  PID:8832
- C:\Windows\System\sgoexDJ.exe
  C:\Windows\System\sgoexDJ.exe
  2⤵
  PID:9008
- C:\Windows\System\dYMTVfr.exe
  C:\Windows\System\dYMTVfr.exe
  2⤵
  PID:2092
- C:\Windows\System\NxGKblt.exe
  C:\Windows\System\NxGKblt.exe
  2⤵
  PID:8892
- C:\Windows\System\bXrFUnw.exe
  C:\Windows\System\bXrFUnw.exe
  2⤵
  PID:8852
- C:\Windows\System\kQRlwjW.exe
  C:\Windows\System\kQRlwjW.exe
  2⤵
  PID:8368
- C:\Windows\System\VjIqwbl.exe
  C:\Windows\System\VjIqwbl.exe
  2⤵
  PID:9276
- C:\Windows\System\PArzEuv.exe
  C:\Windows\System\PArzEuv.exe
  2⤵
  PID:1512
- C:\Windows\System\MdOBnCd.exe
  C:\Windows\System\MdOBnCd.exe
  2⤵
  PID:9364
- C:\Windows\System\ntZrSPd.exe
  C:\Windows\System\ntZrSPd.exe
  2⤵
  PID:9392
- C:\Windows\System\QmjDuEi.exe
  C:\Windows\System\QmjDuEi.exe
  2⤵
  PID:9540
- C:\Windows\System\MaUVDib.exe
  C:\Windows\System\MaUVDib.exe
  2⤵
  PID:9600
- C:\Windows\System\cirFTRr.exe
  C:\Windows\System\cirFTRr.exe
  2⤵
  PID:9668
- C:\Windows\System\MKlTbag.exe
  C:\Windows\System\MKlTbag.exe
  2⤵
  PID:9732
- C:\Windows\System\ScAIcGo.exe
  C:\Windows\System\ScAIcGo.exe
  2⤵
  PID:9404
- C:\Windows\System\vecbmBe.exe
  C:\Windows\System\vecbmBe.exe
  2⤵
  PID:9468
- C:\Windows\System\qwguWqJ.exe
  C:\Windows\System\qwguWqJ.exe
  2⤵
  PID:9480
- C:\Windows\System\frdtCAA.exe
  C:\Windows\System\frdtCAA.exe
  2⤵
  PID:9524
- C:\Windows\System\NmzAoaL.exe
  C:\Windows\System\NmzAoaL.exe
  2⤵
  PID:9588
- C:\Windows\System\rhyjHcP.exe
  C:\Windows\System\rhyjHcP.exe
  2⤵
  PID:9652
- C:\Windows\System\EeiFCcR.exe
  C:\Windows\System\EeiFCcR.exe
  2⤵
  PID:9744
- C:\Windows\System\XYiTMvj.exe
  C:\Windows\System\XYiTMvj.exe
  2⤵
  PID:9920
- C:\Windows\System\EuZpEnm.exe
  C:\Windows\System\EuZpEnm.exe
  2⤵
  PID:9860
- C:\Windows\System\bSaBqxp.exe
  C:\Windows\System\bSaBqxp.exe
  2⤵
  PID:9796
- C:\Windows\System\OQtFUUZ.exe
  C:\Windows\System\OQtFUUZ.exe
  2⤵
  PID:9808
- C:\Windows\System\LsFKFEn.exe
  C:\Windows\System\LsFKFEn.exe
  2⤵
  PID:9844
- C:\Windows\System\TvqYqlh.exe
  C:\Windows\System\TvqYqlh.exe
  2⤵
  PID:9972
- C:\Windows\System\ivbvLpH.exe
  C:\Windows\System\ivbvLpH.exe
  2⤵
  PID:9944
- C:\Windows\System\BPsQRii.exe
  C:\Windows\System\BPsQRii.exe
  2⤵
  PID:9988
- C:\Windows\System\PxFRjhI.exe
  C:\Windows\System\PxFRjhI.exe
  2⤵
  PID:10008
- C:\Windows\System\xvrCdeR.exe
  C:\Windows\System\xvrCdeR.exe
  2⤵
  PID:10040
- C:\Windows\System\HGZKcow.exe
  C:\Windows\System\HGZKcow.exe
  2⤵
  PID:10104
- C:\Windows\System\kQdMPzE.exe
  C:\Windows\System\kQdMPzE.exe
  2⤵
  PID:10024
- C:\Windows\System\XYxAPSM.exe
  C:\Windows\System\XYxAPSM.exe
  2⤵
  PID:10156
- C:\Windows\System\DoHzXwv.exe
  C:\Windows\System\DoHzXwv.exe
  2⤵
  PID:10224
- C:\Windows\System\pNqcRoo.exe
  C:\Windows\System\pNqcRoo.exe
  2⤵
  PID:1716
- C:\Windows\System\ECrIfNp.exe
  C:\Windows\System\ECrIfNp.exe
  2⤵
  PID:10056
- C:\Windows\System\DqfJPWB.exe
  C:\Windows\System\DqfJPWB.exe
  2⤵
  PID:8736
- C:\Windows\System\jhQgLuj.exe
  C:\Windows\System\jhQgLuj.exe
  2⤵
  PID:8868
- C:\Windows\System\DGuqIip.exe
  C:\Windows\System\DGuqIip.exe
  2⤵
  PID:8516
- C:\Windows\System\NZEYHpd.exe
  C:\Windows\System\NZEYHpd.exe
  2⤵
  PID:8924
- C:\Windows\System\tPmAxiB.exe
  C:\Windows\System\tPmAxiB.exe
  2⤵
  PID:8728
- C:\Windows\System\MRUEJgd.exe
  C:\Windows\System\MRUEJgd.exe
  2⤵
  PID:8908
- C:\Windows\System\JrJXHdf.exe
  C:\Windows\System\JrJXHdf.exe
  2⤵
  PID:8980
- C:\Windows\System\DDUocGs.exe
  C:\Windows\System\DDUocGs.exe
  2⤵
  PID:9340
- C:\Windows\System\hebBsDV.exe
  C:\Windows\System\hebBsDV.exe
  2⤵
  PID:2352
- C:\Windows\System\WTAjDvS.exe
  C:\Windows\System\WTAjDvS.exe
  2⤵
  PID:9728
- C:\Windows\System\twstNWJ.exe
  C:\Windows\System\twstNWJ.exe
  2⤵
  PID:9412
- C:\Windows\System\apLCJJj.exe
  C:\Windows\System\apLCJJj.exe
  2⤵
  PID:9556
- C:\Windows\System\ifwuQtq.exe
  C:\Windows\System\ifwuQtq.exe
  2⤵
  PID:9432
- C:\Windows\System\XAKYnpZ.exe
  C:\Windows\System\XAKYnpZ.exe
  2⤵
  PID:9436
- C:\Windows\System\QpcxbKd.exe
  C:\Windows\System\QpcxbKd.exe
  2⤵
  PID:9776
- C:\Windows\System\duMDjpf.exe
  C:\Windows\System\duMDjpf.exe
  2⤵
  PID:9460
- C:\Windows\System\IImbifG.exe
  C:\Windows\System\IImbifG.exe
  2⤵
  PID:9780
- C:\Windows\System\TseZUgU.exe
  C:\Windows\System\TseZUgU.exe
  2⤵
  PID:9792
- C:\Windows\System\OsVXBwS.exe
  C:\Windows\System\OsVXBwS.exe
  2⤵
  PID:9932
- C:\Windows\System\EOnktxL.exe
  C:\Windows\System\EOnktxL.exe
  2⤵
  PID:9828
- C:\Windows\System\OYEoFsR.exe
  C:\Windows\System\OYEoFsR.exe
  2⤵
  PID:9948
- C:\Windows\System\srMzuJS.exe
  C:\Windows\System\srMzuJS.exe
  2⤵
  PID:9976
- C:\Windows\System\LQYvIUy.exe
  C:\Windows\System\LQYvIUy.exe
  2⤵
  PID:10036
- C:\Windows\System\JuQZfwg.exe
  C:\Windows\System\JuQZfwg.exe
  2⤵
  PID:10188
- C:\Windows\System\VQoDZDM.exe
  C:\Windows\System\VQoDZDM.exe
  2⤵
  PID:8960
- C:\Windows\System\zvURrHa.exe
  C:\Windows\System\zvURrHa.exe
  2⤵
  PID:10072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CvdgwqF.exe

Filesize
2.0MB

MD5
6c16beb2927f758901f9c886f829f388

SHA1
7e55eab23b7ad0245b39457922e776754e92cf1d

SHA256
6c4f127ee2b1c9d1f7cbbac37e0ed048f08acff65363faa03ceea91913cbc92f

SHA512
41e061d149ab6181726970d7abfaa857e5cee07729db6031843ce93e315b1673fd782a20bfaea5a9835db7bad5c69b1bd94b57a3a3b9a189a450958bcaba1f0d

Download Submit
C:\Windows\system\DcJcwIU.exe

Filesize
2.0MB

MD5
709dc4e2adbd64488f1dba1b5bda36ab

SHA1
f97b2027ee53deb5599591d8174361ec547307b6

SHA256
e3a0698e1e7075fbde57a83ce4e61417211e12d357a15dca16d3032c4beda5b2

SHA512
b8151b3410b13b70b944a7f63372c10aac869746612f72f96314f4ccf7f32e34fb7305339a639b6575c17f666a1a09e4f0223617a10818cd281252fe172147e8

Download Submit
C:\Windows\system\HLUDOUQ.exe

Filesize
2.0MB

MD5
f3464a11ae2383157cbc1c77538e5b1f

SHA1
9169134882b89318875f7ff33a634de4403e8428

SHA256
cdd418151aaac3c0ff8a7a2d96743b36faa857168f895720766ec62e5ca355b8

SHA512
f81058e0fa98db515dc62eaa4fe0091995ed19c557f74b85b8cc037467ee4eadf83836b6945bc1dfab03baa53d16f160b82e14040962246b760945fdabb2876b

Download Submit
C:\Windows\system\JPlikDO.exe

Filesize
2.0MB

MD5
928484b27d3574a3a706e9355cadfe39

SHA1
584cf05905e1e486a8eb88c9e569cf004493c42d

SHA256
b70425e3b8ea1cf34b0b80a3527181b806b588a1da47bfbb40bf07ace43baa5b

SHA512
37fd30fdb20f16a3d521128ef4fb340f42e51efe423d894744fbde4729d9608731071ee847d410091d9b54f56c6de2bbcc00f1c1a15c74a1f2e999a7c8af20d5

Download Submit
C:\Windows\system\LlrMpPj.exe

Filesize
2.0MB

MD5
91c41cc69c092e272ba5b19089ac4f29

SHA1
e0671d0f50ec6bcf3277dbcd827cca0447064661

SHA256
d196d37ef880e820882280a5ab1356887c766116cbbe5aa3073201e6e31ea920

SHA512
98204cae250e298bc837e559d536287e6ba96f9d1900ad81e0da3c4f17750740b92585daa2f881264cff8262295a28dc62fd83ef36ea172d896b011d350e2229

Download Submit
C:\Windows\system\NOPZsEW.exe

Filesize
2.0MB

MD5
cf79f9acb665d3fc71fc85e33379d557

SHA1
808fcab04f4ca041c1d16482488c520c780916ab

SHA256
74dd5c74c3586993aefab3875910ea04607dfe37cf0ada82e5983b4ae7fd3fde

SHA512
0ed39342addca355a9ac7c69d80c391759033289ca93018f4c7be663fd8cb86ffa45134629487214fb690ddc42b30e26b1e77d0e331a2e01cd82ef9cf39976eb

Download Submit
C:\Windows\system\RBDJlGc.exe

Filesize
2.0MB

MD5
90b74d858a29bb4a3967fc6bf0b364e7

SHA1
16fea1865bfee42576d52b5149b719f9170895b9

SHA256
7c420c3aee7670e5476f037d9848d1633f5a4cf2a1f5a50a6a286f438817444c

SHA512
00c596ab69082bfe6fb7cc67a499823f900266db279282bcf1d9a77e979778786ecd7a626ac278d6db8aa1f9ac19cfb30c7c69a0a553de3e41ccce26dab78d05

Download Submit
C:\Windows\system\VpSdVmm.exe

Filesize
2.0MB

MD5
7e56e47d8e52d90755ad5b9a9648f177

SHA1
a078a595b7c1fe978f5c4e6ae9dd8dcf54c16753

SHA256
e919d5bcbbcab209ffac13c22d2eb65b54c1f46b92ccea7289857e55da885155

SHA512
f2005378688fafcd1a48d7bc4c3a63ecfd4fa4d371e0017b35c5f27c5b6a32e12c1b0982a0c1310578ff1395692d2e344b5c3b9a9c5ed56a8dac02effd90beb3

Download Submit
C:\Windows\system\ZGqDMnB.exe

Filesize
2.0MB

MD5
4b0fe76f2a274de0cd894d6f08bdf995

SHA1
7fe1d07c47e4be25e801221a896d7a1da82bc80b

SHA256
83c5ae257a5802d682d647c248f21800947ef922c37be070e75ed0f344ff001c

SHA512
ffefc09a76e1c1936b9d4dd9eccd283327fb6b1413730ad0b0eaf8b49025bd2a4b067debf3c55e1c001ed4dd9424ec54af7b3f3523c931da642c41ca5844de2f

Download Submit
C:\Windows\system\bYqlFnV.exe

Filesize
2.0MB

MD5
28573e6aa042e4b61604568847e5e2b2

SHA1
e45e2fdfa831bab3b0247e702dbb33f599678d06

SHA256
3d1a51723226e8cf49e646650c6a02544343cdc461a76174f6d45d5ac7dd1314

SHA512
1d7e8e807599b399812e7333438b1abb7cb77f22620f70b3b14173fd4efe17a65e6261255610b8b7940058478a0414e03a5c49746d4e5febb0047a19737eaee4

Download Submit
C:\Windows\system\cPkhQVW.exe

Filesize
2.0MB

MD5
4787d1f883ed7cfa8579bfbeeb8d1fc1

SHA1
ece02fb8170fbcdc4e31a033600bf04ccf9c6c7d

SHA256
a8590685c55392fc0b1cb6548ee09b663882877734071eb6401008185d572825

SHA512
75cdd4d2104df46f9fce9f23edeff4b521e6eb461dec1ed6fb5aba959fe32a021c66b7a5a1afba89c048c71f4b99800dfd35bedf704c59d1936a4de636c0bc96

Download Submit
C:\Windows\system\cTYIJwU.exe

Filesize
2.0MB

MD5
18326d40eec409d8087f2391133a15d0

SHA1
968711c9a28f07b4301530bb0241e0e665b70760

SHA256
3c96904e0da7db0cbdab7633bdabbc20a0ee03b1efb9c41e2395cc79b3951c95

SHA512
bf045ba1c5cf496dcc0eb649218a352e4814ae39b9f39765da8bf716a155de54ad91ad48eb20d65cec33a5a652eeb1ca9a96356756b794aeabc1c51c55faf702

Download Submit
C:\Windows\system\dneGipA.exe

Filesize
2.0MB

MD5
6a5d848f2d6d39eff308a5a5c8a6af53

SHA1
741210d2828aa91a1337b494deb83f2cdd78819f

SHA256
244fc0c3267ff6f7b75daa9153134cebdbbc3768ae350e33c9d9cfb39567b93b

SHA512
553357b80b3703d2f4e512a46a0c110f4fbfd39e1531eace3ae758e3d11fec17e1d7412ec9ac300a19f38d48911407e915ffd8bf04a85f21f040b3f02e71ead1

Download Submit
C:\Windows\system\efhwlaW.exe

Filesize
2.0MB

MD5
f72350231a454d08ed938ae351558994

SHA1
2ae1fcf41d892f7649b8bdf6f55830ca13da60d4

SHA256
59ceebfd77f04a776ec665a2a55d98175d3362de915632a17a355e4bc429e209

SHA512
622885940882fa633b6ffa8e606544e9bc94ba98df554a8be94a5739cf71f1ec93a7e517185d76d5ff65a3106343adee4b95e90bf373678e1528c7ee4f5d3014

Download Submit
C:\Windows\system\goXOutM.exe

Filesize
2.0MB

MD5
0e20908a0c4007dd443ad78c2fbf9b84

SHA1
301b06d2fb52ac7b2dfe851fc19227cad09d203e

SHA256
11a6b2b2dd2b3c4e055c76411a164f025ddd90a20fd79de5e3823bb47fe6371e

SHA512
a1ccc6223d5a491206df1965af0cf88f56baed4ca2ce0690208c785fbdb1cc3014ffadee8ac70f3de59673f2168ed38068ff3083c08d4006ee62ba68846c3feb

Download Submit
C:\Windows\system\iUVURps.exe

Filesize
2.0MB

MD5
47d757d0edd81bf83e2a0616ca7ee259

SHA1
7111ebfa270bbe5461de8265eb43abf2bca81597

SHA256
b7436f91be3450faf0c20fd03b4e706979d119eae00d7b36662a56f91ae94fef

SHA512
b7cede53f36f9c0a5e24db23a551c32cdae9d20fb8aa3f6dad8b8a95a833da5120ed696cd8e23667b85837e9c571c0ede57b98db168fd4fa4b791e504f362ab6

Download Submit
C:\Windows\system\iWPBUiY.exe

Filesize
2.0MB

MD5
911aaf860a6f4a20affbf19a792e8753

SHA1
d7eadf8aa96ede8c2fcae374af49bceebb2162c1

SHA256
b4c022bbe72fd2a30e066ab38bd4bcdea00d86793c8b8fa4e4529c37ccf6e25c

SHA512
263625d67b888d3ca61574b6959c1cd22356c4df07afb605a57b2d1e06e58f8a933d487750ab1e729f20773e35e4ea7b2672b83b7ae6edf8a31a212c2218f483

Download Submit
C:\Windows\system\jhityBN.exe

Filesize
2.0MB

MD5
8a2b697c8b74741427abf5f0a97fd244

SHA1
63235467a7861123053d537ef571fff4c06130ab

SHA256
c20c8db26525f8b10cb00fc05dae6942c9b8c4568ba95cdb480984793cd310a2

SHA512
e2ee9de8d287926b11812dd40f4b3127971488d83aeff0bec62d4436c62d11d33f9c837776c275fe8fa0355cc1e3884b5a02ffa20b00dc6e4dc4049d6215e670

Download Submit
C:\Windows\system\moSySJA.exe

Filesize
2.0MB

MD5
01f6e689b645792827de085271e72820

SHA1
6cc16debe1aec63a8d65b19fd29b520bb45edac2

SHA256
83650943ecd07e301445f421ab044b26b9f04149679ed62a1c12c539ac70b1b8

SHA512
1a42ffa0351fda4b112564fce75dc7ade430404b9274a29c8163bb3e4e06e7c6a2632b482e3d7d66499c60f4f01bdee514f0ec44d1083c239613cd6941eaf7aa

Download Submit
C:\Windows\system\nAafQlp.exe

Filesize
2.0MB

MD5
97eded8b41c0e57c9dcadf0b2cbeaab7

SHA1
13b9b8ad2d945ab46010d8e70dd02c96a07c729f

SHA256
e2b915f2343cfd4eb4d2dcd2f079b45b23184dc8393bc439efe2bc8ec31f0574

SHA512
35a33caa51c75990aa92637b510d17e7b2c195fbbe8a61421458925c80646436711a9f3273d74e4ce40f69d5984292a913b1d27354bf678f52cbfbe25db9e617

Download Submit
C:\Windows\system\nWxXrqk.exe

Filesize
2.0MB

MD5
70cab38485d69cc64ff189cb6e431e24

SHA1
1696c03e5e55823f50a487029ff48ae3a4d8d32a

SHA256
e53c35de0da542b4c5ca021e900d59c8464184149331f052ec4625e32caebbaf

SHA512
7c90eef91e72250e6d2c57e5d4cbd3c66289a75e39c31a531e6c000c1f76c684bfae46ff994f52c5ceb660979d324082acd41eae3e649441c597a0eda8edd025

Download Submit
C:\Windows\system\oMKEGHC.exe

Filesize
2.0MB

MD5
5723a485f32c6797f96f7d83bbaef4ad

SHA1
84da9b273c1055d924ce98bebfe55ceaceefe087

SHA256
0bb3b15cc37d313933388ece81983a584b76086100dc5694cf3984678e564c57

SHA512
64ba1e9ed90d43a63f8983c9bb32bf61768f53a790875f560bcee6a67434fb27402148cfcc8e98a082807c4680e76fd70f61c63297d9afa9fc4d6cb2b2d03925

Download Submit
C:\Windows\system\qmrFCdX.exe

Filesize
2.0MB

MD5
a6f1bcd58452b612314b4d2c6870ed47

SHA1
19a116070d0dd04b3cdd7c88f1bca62a6ff918a5

SHA256
b3efca5a8aa38d3c4df8129c252d261fa6e81b2926abd6e2a6c998ffaaa47c19

SHA512
4b0114875f1cba0fa5432637449072fbcfa5d7e5a711e6161c6a9ff0583a8c7ad449f6fc725cd07a67ec07face0a2c17d5ee14429d5834d662b087876620547f

Download Submit
C:\Windows\system\rRkkatL.exe

Filesize
2.0MB

MD5
ec59c492ad2e2ce738b51c8603ccd85f

SHA1
0b2866603529bb8d079e8207d59a23114447f9ac

SHA256
423c973b34a13758f076faf7ac0044cda05b7254ebf855cc04cc02fd01bf9ca5

SHA512
1f64fbe909971c42893e8e04f450e5537675bc9016e45ea62a4fa405d09752da02384d16abbef8182f912e4638177f8c3934473a455d485f2d07edf33a43d414

Download Submit
C:\Windows\system\rWhvwpj.exe

Filesize
2.0MB

MD5
885849153153db49a932003524f23cf7

SHA1
a4c5db00fdf4091c9954cee70137cbcdefdc329e

SHA256
67ad5d7e210bb661b5b18aba0bceeda5051bfe111e647367099ad036a01c8430

SHA512
8f8a569687fbb0f43cf44933ef168116e4678cf9486c9cb8e4063239a1af9e06ed5234097a55a0cb49e52bf4eed8be6ab69c4088b0da6f572ddc62a98bb8264e

Download Submit
C:\Windows\system\usLRxBj.exe

Filesize
2.0MB

MD5
f05f9b413ff7342fde3369a7a1a06e07

SHA1
bdf3e2b28c5b505c8886504ea9a54362847d108c

SHA256
61698644f8972c1e4b1b4ceac0bc4f79a8fba5310b0aa97152dab83350f96a9d

SHA512
b5834dbbe86fa96f081487cd1150db9db217893a360414e85bfd22411b96a64d9598fe9ac4b92ef8e84e432976e9efb2cdbdd4f564297527d2038d140cea0b32

Download Submit
C:\Windows\system\yAjqkzH.exe

Filesize
2.0MB

MD5
6b5b35638f78c4ea27013d6b63f97c51

SHA1
acb79e3d351fabdb54204e195dc96c80d0746f65

SHA256
2ac2a542f242f4e7a921f6084542533dc124d3e6ae104738846bbaa07d3cf6d3

SHA512
8cc472bf9de070ef256dea93b4e3b34ea27ab1ae7eadd039ca059a519ce56c18e6bb8d6c4e011fe513920550451c4de5b9967527718a3ddc92fc9bc6501e8a24

Download Submit
C:\Windows\system\yGMJVCI.exe

Filesize
2.0MB

MD5
829b8d5830f30906864e45485b24a479

SHA1
0b179f9107ad27f4fd8829bed25a1567618a80ab

SHA256
32aa79d5999214d0ffe1c520a9e619f16fa4588414bd96195b24706bc3b54cd6

SHA512
cc2d381738c643145d9ac9a8d9a53c88cc661514fd631f3ad84053dba1d43c0242072479f6b7be677328614a8de3467bda81eff7c4dd97cc60e0ff3f728cb89e

Download Submit
\Windows\system\MJGKIEp.exe

Filesize
2.0MB

MD5
810e0d3b87a2f01bf13127f51a334481

SHA1
a472433364431cb9e802fd8f1d511675b2c47a83

SHA256
0c894cb57b80e256f55b1302056b2320ceb7bd46bb913e40574662c1301babd8

SHA512
8ef93261efc26adb02b9dc39db2a62d3f66c259c531b42471546845afd437a0e744f27b00546c42cc2ca8311ced0d9760f537479ee841135ce213f5b534fedd1

Download Submit
\Windows\system\daElaED.exe

Filesize
2.0MB

MD5
a3a15ba306b8dd490f2792c4dd52bae2

SHA1
5bb46d58356b6e8fe576c73089b4326f208a117a

SHA256
f9d00a7f46963479d38a4dae8e59123d849e57fe0c4a99c626f8f5c34aa82c0b

SHA512
b9e280f9c1f0d09c48a441a4c10869e84b8ef744592a0464ecbca19f976de549317e8174af5b2202c4815f2f2ebcfa03c06bdc2ee2b748f65cb9e97b8e5145ba

Download Submit
\Windows\system\jEFbOJJ.exe

Filesize
2.0MB

MD5
e5cf3eed20d44324185daf7a204fca58

SHA1
8d081636c12d5c5b13cbc16a3b2509137750ad15

SHA256
7b332a7fb8db32349f8f41b588068300e63220f71d24a6c359e9fe82d0693c07

SHA512
2f122a44c7b22876d0b6a790a35555806c813eb840cefe58826792f454798738d8ba40de65386343d02c95eca5e7ee0d3c6af137b1444774093255a74c42964e

Download Submit
\Windows\system\yOQDwYo.exe

Filesize
2.0MB

MD5
16c900cefdf4a1be060d26560cc7f070

SHA1
138338301a66194c5705175d5b373f0fb6c6ab5e

SHA256
80e6b772464b466cf53b0dfd1c3ca0a81a8540f4f95a8551dc0544b4c90ca980

SHA512
4979fcb65842844c5e849265254dd57c804551abf11d1967bbaede4782a9246e8c27b1c68447a77896b551ee2f85bf36153b9acc05f2449442a02349ebf399da

Download Submit
memory/928-2158-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/928-162-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/1608-158-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/1608-2134-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/2164-27-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download
memory/2164-215-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download
memory/2164-2151-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download
memory/2416-94-0x000000001B360000-0x000000001B642000-memory.dmp

Filesize
2.9MB

Download
memory/2416-145-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

Filesize
9.6MB

Download
memory/2416-100-0x0000000001FC0000-0x0000000001FC8000-memory.dmp

Filesize
32KB

Download
memory/2416-28-0x000007FEF621E000-0x000007FEF621F000-memory.dmp

Filesize
4KB

Download
memory/2416-180-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

Filesize
9.6MB

Download
memory/2416-144-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

Filesize
9.6MB

Download
memory/2476-160-0x000000013F190000-0x000000013F582000-memory.dmp

Filesize
3.9MB

Download
memory/2476-2070-0x000000013F190000-0x000000013F582000-memory.dmp

Filesize
3.9MB

Download
memory/2500-2133-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/2500-154-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/2564-260-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/2592-425-0x0000000003060000-0x0000000003452000-memory.dmp

Filesize
3.9MB

Download
memory/2592-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2592-147-0x000000013F070000-0x000000013F462000-memory.dmp

Filesize
3.9MB

Download
memory/2592-0-0x000000013FD10000-0x0000000140102000-memory.dmp

Filesize
3.9MB

Download
memory/2592-149-0x000000013F520000-0x000000013F912000-memory.dmp

Filesize
3.9MB

Download
memory/2592-191-0x000000013FD10000-0x0000000140102000-memory.dmp

Filesize
3.9MB

Download
memory/2592-151-0x0000000003060000-0x0000000003452000-memory.dmp

Filesize
3.9MB

Download
memory/2592-161-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/2592-153-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/2592-159-0x000000013F190000-0x000000013F582000-memory.dmp

Filesize
3.9MB

Download
memory/2592-155-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/2592-8-0x000000013F380000-0x000000013F772000-memory.dmp

Filesize
3.9MB

Download
memory/2592-14-0x0000000002CC0000-0x00000000030B2000-memory.dmp

Filesize
3.9MB

Download
memory/2592-24-0x0000000002CC0000-0x00000000030B2000-memory.dmp

Filesize
3.9MB

Download
memory/2592-157-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/2616-156-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/2616-1831-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/2640-2091-0x000000013F070000-0x000000013F462000-memory.dmp

Filesize
3.9MB

Download
memory/2640-148-0x000000013F070000-0x000000013F462000-memory.dmp

Filesize
3.9MB

Download
memory/2708-150-0x000000013F520000-0x000000013F912000-memory.dmp

Filesize
3.9MB

Download
memory/2708-2118-0x000000013F520000-0x000000013F912000-memory.dmp

Filesize
3.9MB

Download
memory/2744-9-0x000000013F380000-0x000000013F772000-memory.dmp

Filesize
3.9MB

Download
memory/2744-2148-0x000000013F380000-0x000000013F772000-memory.dmp

Filesize
3.9MB

Download
memory/2800-146-0x000000013F3B0000-0x000000013F7A2000-memory.dmp

Filesize
3.9MB

Download
memory/2800-1832-0x000000013F3B0000-0x000000013F7A2000-memory.dmp

Filesize
3.9MB

Download
memory/2892-16-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/2892-1833-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/2892-193-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/3052-1830-0x000000013FEB0000-0x00000001402A2000-memory.dmp

Filesize
3.9MB

Download
memory/3052-152-0x000000013FEB0000-0x00000001402A2000-memory.dmp

Filesize
3.9MB

Download