xmrig | 90b5b00f8103a60a9aa51934e085c828ee0fa5415974acb2c4624292e7953a15

Analysis

max time kernel
120s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 07:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20d5968a079fb744afae49221cf33e80N.exe
Size

2.0MB
MD5

20d5968a079fb744afae49221cf33e80
SHA1

0d8c600d562826d27d0b5f7a5451690ef4d791b0
SHA256

90b5b00f8103a60a9aa51934e085c828ee0fa5415974acb2c4624292e7953a15
SHA512

e0738eb03c0fc3a03a422b948d203251a83300bf1e4c9ee9b58b610b00ce09a743df9322c9d148539ac3c34688b5af5934474ed3776d9953231c52bdc4ce61bd
SSDEEP

49152:Lz071uv4BPMkHC0IEFTo/abRcN91M+Ayf:NABg

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 20 IoCs

miner

resource	yara_rule
behavioral1/memory/2776-16-0x000000013FCA0000-0x0000000140092000-memory.dmp	xmrig
behavioral1/memory/2392-664-0x000000013FB10000-0x000000013FF02000-memory.dmp	xmrig
behavioral1/memory/2128-155-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	xmrig
behavioral1/memory/3064-153-0x000000013FEE0000-0x00000001402D2000-memory.dmp	xmrig
behavioral1/memory/920-151-0x000000013FC60000-0x0000000140052000-memory.dmp	xmrig
behavioral1/memory/476-149-0x000000013FA70000-0x000000013FE62000-memory.dmp	xmrig
behavioral1/memory/2804-147-0x000000013FA00000-0x000000013FDF2000-memory.dmp	xmrig
behavioral1/memory/3040-145-0x000000013F6A0000-0x000000013FA92000-memory.dmp	xmrig
behavioral1/memory/2616-143-0x000000013FEA0000-0x0000000140292000-memory.dmp	xmrig
behavioral1/memory/2552-141-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	xmrig
behavioral1/memory/2588-139-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	xmrig
behavioral1/memory/2024-137-0x000000013F790000-0x000000013FB82000-memory.dmp	xmrig
behavioral1/memory/2688-912-0x000000013F080000-0x000000013F472000-memory.dmp	xmrig
behavioral1/memory/2776-3821-0x000000013FCA0000-0x0000000140092000-memory.dmp	xmrig
behavioral1/memory/2552-4758-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	xmrig
behavioral1/memory/920-4762-0x000000013FC60000-0x0000000140052000-memory.dmp	xmrig
behavioral1/memory/3040-4760-0x000000013F6A0000-0x000000013FA92000-memory.dmp	xmrig
behavioral1/memory/2024-4779-0x000000013F790000-0x000000013FB82000-memory.dmp	xmrig
behavioral1/memory/3064-4775-0x000000013FEE0000-0x00000001402D2000-memory.dmp	xmrig
behavioral1/memory/2588-4835-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2744	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2776	UtbIVzS.exe
2688	rISGXLa.exe
2024	dmHjnxi.exe
2588	NvtaYuR.exe
2552	EmMZzvG.exe
2616	eKEVENh.exe
3040	qGGwQmL.exe
2804	XdKaLUJ.exe
476	fAPnsIW.exe
920	LIakdJW.exe
3064	DUCMSbt.exe
2128	XxswGZk.exe
2436	PpaBxHk.exe
1836	GrSzjaM.exe
2452	TdzTcsP.exe
2612	OUlnQpg.exe
1264	cViAJzV.exe
2868	UQQmriK.exe
1940	AJBedTM.exe
1780	PlKXYpa.exe
2116	Pgdqjtf.exe
1204	uMfnsmC.exe
1036	lGLMqQc.exe
1920	DIBoFuQ.exe
2644	VbVmecI.exe
344	SYvrJur.exe
816	xaNvIEw.exe
1908	EfolRAW.exe
1892	FNJoOUz.exe
1960	AzBgzZR.exe
824	LNmIWFf.exe
1756	hKNZqXL.exe
1352	HtlEgvX.exe
1716	gkStaje.exe
1308	wHIIMeK.exe
1720	FTVeenR.exe
660	KyuxNGR.exe
1980	BhNcVBZ.exe
2976	xKOpIoT.exe
2344	riAykuE.exe
2100	NPROjAk.exe
356	UOrpWPv.exe
1240	NpFhoMd.exe
2284	QzsQGrh.exe
1728	SqcRvgL.exe
872	wfVObxN.exe
1912	jrwNyZa.exe
2220	uCtILxw.exe
1584	LFfJKSA.exe
1580	PgOwoqX.exe
2700	KNdjRIq.exe
2832	ABpAYDE.exe
2932	CAtefhT.exe
2716	VGzcnlN.exe
2536	JlKdUcW.exe
2564	RYETWEL.exe
1976	mGbCBsb.exe
1276	zmAgfcj.exe
2900	LnEMfCg.exe
2800	gCFvliL.exe
2712	dJtfaAn.exe
2088	jYjnuWg.exe
2312	kSNXyyI.exe
3052	mRayQMo.exe

Loads dropped DLL 64 IoCs

pid	Process
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe
2392	20d5968a079fb744afae49221cf33e80N.exe

UPX packed file 54 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2392-0-0x000000013FB10000-0x000000013FF02000-memory.dmp	upx
behavioral1/files/0x0008000000016ca2-7.dat	upx
behavioral1/files/0x0007000000012116-6.dat	upx
behavioral1/memory/2688-14-0x000000013F080000-0x000000013F472000-memory.dmp	upx
behavioral1/memory/2776-16-0x000000013FCA0000-0x0000000140092000-memory.dmp	upx
behavioral1/files/0x0007000000004e74-29.dat	upx
behavioral1/files/0x0007000000016d13-39.dat	upx
behavioral1/files/0x0007000000016d24-50.dat	upx
behavioral1/files/0x000600000001748f-64.dat	upx
behavioral1/files/0x00060000000174ac-69.dat	upx
behavioral1/files/0x000600000001752f-74.dat	upx
behavioral1/files/0x001500000001866d-79.dat	upx
behavioral1/files/0x0005000000018690-89.dat	upx
behavioral1/files/0x000500000001879b-94.dat	upx
behavioral1/files/0x00060000000190cd-99.dat	upx
behavioral1/files/0x0005000000019218-126.dat	upx
behavioral1/files/0x0005000000019229-131.dat	upx
behavioral1/files/0x000500000001926b-167.dat	upx
behavioral1/memory/2392-664-0x000000013FB10000-0x000000013FF02000-memory.dmp	upx
behavioral1/files/0x0005000000019389-187.dat	upx
behavioral1/files/0x0005000000019382-183.dat	upx
behavioral1/files/0x0005000000019277-179.dat	upx
behavioral1/files/0x0005000000019273-175.dat	upx
behavioral1/files/0x0005000000019271-172.dat	upx
behavioral1/files/0x000500000001924c-163.dat	upx
behavioral1/files/0x0005000000019234-159.dat	upx
behavioral1/memory/2128-155-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	upx
behavioral1/memory/3064-153-0x000000013FEE0000-0x00000001402D2000-memory.dmp	upx
behavioral1/memory/920-151-0x000000013FC60000-0x0000000140052000-memory.dmp	upx
behavioral1/memory/476-149-0x000000013FA70000-0x000000013FE62000-memory.dmp	upx
behavioral1/memory/2804-147-0x000000013FA00000-0x000000013FDF2000-memory.dmp	upx
behavioral1/memory/3040-145-0x000000013F6A0000-0x000000013FA92000-memory.dmp	upx
behavioral1/memory/2616-143-0x000000013FEA0000-0x0000000140292000-memory.dmp	upx
behavioral1/memory/2552-141-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	upx
behavioral1/memory/2588-139-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	upx
behavioral1/memory/2024-137-0x000000013F790000-0x000000013FB82000-memory.dmp	upx
behavioral1/files/0x0035000000016c3d-121.dat	upx
behavioral1/files/0x00050000000191f7-117.dat	upx
behavioral1/files/0x00050000000191f3-112.dat	upx
behavioral1/files/0x00060000000190d6-106.dat	upx
behavioral1/files/0x0009000000018678-84.dat	upx
behavioral1/files/0x000600000001747b-59.dat	upx
behavioral1/files/0x0008000000016d36-53.dat	upx
behavioral1/files/0x0007000000016d1b-45.dat	upx
behavioral1/files/0x0008000000016d0b-35.dat	upx
behavioral1/files/0x0007000000016cd3-9.dat	upx
behavioral1/memory/2688-912-0x000000013F080000-0x000000013F472000-memory.dmp	upx
behavioral1/memory/2776-3821-0x000000013FCA0000-0x0000000140092000-memory.dmp	upx
behavioral1/memory/2552-4758-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	upx
behavioral1/memory/920-4762-0x000000013FC60000-0x0000000140052000-memory.dmp	upx
behavioral1/memory/3040-4760-0x000000013F6A0000-0x000000013FA92000-memory.dmp	upx
behavioral1/memory/2024-4779-0x000000013F790000-0x000000013FB82000-memory.dmp	upx
behavioral1/memory/3064-4775-0x000000013FEE0000-0x00000001402D2000-memory.dmp	upx
behavioral1/memory/2588-4835-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\NzwQagP.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\LmVaDGw.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\jZUYzSL.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\sHNcFet.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\cFaKzRs.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\vxxEAgv.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\PzdbgoI.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\vjCsULF.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\sCdFWKJ.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\fHoAROh.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\qrzypTj.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\dSLyRYI.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\FIFDaqS.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\xQKvpXz.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\btKGHre.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\EoEVbAE.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\VmcdIhE.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\qDZPWYY.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\MxVDWmu.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\PEqvGIU.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\iOypsxN.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\SUHIfUT.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\JFSVqtU.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\YbnUaeW.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\QSJtIxk.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\lZIpBKE.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\xCAMcGt.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\moVUXaR.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\vRyUUWd.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\MPRTLTe.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\TfKTtgt.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\HCATpNI.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\YaCxJKH.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\vGzAXOh.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\ddCSXHw.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\TkYqNom.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\aPiAezD.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\wjjMJMY.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\jGynYBL.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\cdcDwzC.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\zwjOyEy.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\UzjoFwx.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\WROJiGP.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\xjXXOjV.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\PAKqKgg.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\TKunxrw.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\cbzccmQ.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\wNuFIvb.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\wYxnJhB.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\LQyLvKb.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\XXfdDSO.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\BUscWHb.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\UqnbhRx.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\TLfxDDk.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\RVkwUQi.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\wkZxPXU.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\Qutpsli.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\JjTiRvY.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\FPjGDYf.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\zcLkVzm.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\RhgdPzN.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\YVPJnPR.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\geVbTUN.exe	20d5968a079fb744afae49221cf33e80N.exe
File created	C:\Windows\System\GMTXyAt.exe	20d5968a079fb744afae49221cf33e80N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2744	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2392	20d5968a079fb744afae49221cf33e80N.exe
Token: SeLockMemoryPrivilege	2392	20d5968a079fb744afae49221cf33e80N.exe
Token: SeDebugPrivilege	2744	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 2744	2392	20d5968a079fb744afae49221cf33e80N.exe	31
PID 2392 wrote to memory of 2744	2392	20d5968a079fb744afae49221cf33e80N.exe	31
PID 2392 wrote to memory of 2744	2392	20d5968a079fb744afae49221cf33e80N.exe	31
PID 2392 wrote to memory of 2776	2392	20d5968a079fb744afae49221cf33e80N.exe	32
PID 2392 wrote to memory of 2776	2392	20d5968a079fb744afae49221cf33e80N.exe	32
PID 2392 wrote to memory of 2776	2392	20d5968a079fb744afae49221cf33e80N.exe	32
PID 2392 wrote to memory of 2688	2392	20d5968a079fb744afae49221cf33e80N.exe	33
PID 2392 wrote to memory of 2688	2392	20d5968a079fb744afae49221cf33e80N.exe	33
PID 2392 wrote to memory of 2688	2392	20d5968a079fb744afae49221cf33e80N.exe	33
PID 2392 wrote to memory of 2024	2392	20d5968a079fb744afae49221cf33e80N.exe	34
PID 2392 wrote to memory of 2024	2392	20d5968a079fb744afae49221cf33e80N.exe	34
PID 2392 wrote to memory of 2024	2392	20d5968a079fb744afae49221cf33e80N.exe	34
PID 2392 wrote to memory of 2588	2392	20d5968a079fb744afae49221cf33e80N.exe	35
PID 2392 wrote to memory of 2588	2392	20d5968a079fb744afae49221cf33e80N.exe	35
PID 2392 wrote to memory of 2588	2392	20d5968a079fb744afae49221cf33e80N.exe	35
PID 2392 wrote to memory of 2552	2392	20d5968a079fb744afae49221cf33e80N.exe	36
PID 2392 wrote to memory of 2552	2392	20d5968a079fb744afae49221cf33e80N.exe	36
PID 2392 wrote to memory of 2552	2392	20d5968a079fb744afae49221cf33e80N.exe	36
PID 2392 wrote to memory of 2616	2392	20d5968a079fb744afae49221cf33e80N.exe	37
PID 2392 wrote to memory of 2616	2392	20d5968a079fb744afae49221cf33e80N.exe	37
PID 2392 wrote to memory of 2616	2392	20d5968a079fb744afae49221cf33e80N.exe	37
PID 2392 wrote to memory of 3040	2392	20d5968a079fb744afae49221cf33e80N.exe	38
PID 2392 wrote to memory of 3040	2392	20d5968a079fb744afae49221cf33e80N.exe	38
PID 2392 wrote to memory of 3040	2392	20d5968a079fb744afae49221cf33e80N.exe	38
PID 2392 wrote to memory of 2804	2392	20d5968a079fb744afae49221cf33e80N.exe	39
PID 2392 wrote to memory of 2804	2392	20d5968a079fb744afae49221cf33e80N.exe	39
PID 2392 wrote to memory of 2804	2392	20d5968a079fb744afae49221cf33e80N.exe	39
PID 2392 wrote to memory of 476	2392	20d5968a079fb744afae49221cf33e80N.exe	40
PID 2392 wrote to memory of 476	2392	20d5968a079fb744afae49221cf33e80N.exe	40
PID 2392 wrote to memory of 476	2392	20d5968a079fb744afae49221cf33e80N.exe	40
PID 2392 wrote to memory of 920	2392	20d5968a079fb744afae49221cf33e80N.exe	41
PID 2392 wrote to memory of 920	2392	20d5968a079fb744afae49221cf33e80N.exe	41
PID 2392 wrote to memory of 920	2392	20d5968a079fb744afae49221cf33e80N.exe	41
PID 2392 wrote to memory of 3064	2392	20d5968a079fb744afae49221cf33e80N.exe	42
PID 2392 wrote to memory of 3064	2392	20d5968a079fb744afae49221cf33e80N.exe	42
PID 2392 wrote to memory of 3064	2392	20d5968a079fb744afae49221cf33e80N.exe	42
PID 2392 wrote to memory of 2128	2392	20d5968a079fb744afae49221cf33e80N.exe	43
PID 2392 wrote to memory of 2128	2392	20d5968a079fb744afae49221cf33e80N.exe	43
PID 2392 wrote to memory of 2128	2392	20d5968a079fb744afae49221cf33e80N.exe	43
PID 2392 wrote to memory of 2436	2392	20d5968a079fb744afae49221cf33e80N.exe	44
PID 2392 wrote to memory of 2436	2392	20d5968a079fb744afae49221cf33e80N.exe	44
PID 2392 wrote to memory of 2436	2392	20d5968a079fb744afae49221cf33e80N.exe	44
PID 2392 wrote to memory of 1836	2392	20d5968a079fb744afae49221cf33e80N.exe	45
PID 2392 wrote to memory of 1836	2392	20d5968a079fb744afae49221cf33e80N.exe	45
PID 2392 wrote to memory of 1836	2392	20d5968a079fb744afae49221cf33e80N.exe	45
PID 2392 wrote to memory of 2452	2392	20d5968a079fb744afae49221cf33e80N.exe	46
PID 2392 wrote to memory of 2452	2392	20d5968a079fb744afae49221cf33e80N.exe	46
PID 2392 wrote to memory of 2452	2392	20d5968a079fb744afae49221cf33e80N.exe	46
PID 2392 wrote to memory of 2612	2392	20d5968a079fb744afae49221cf33e80N.exe	47
PID 2392 wrote to memory of 2612	2392	20d5968a079fb744afae49221cf33e80N.exe	47
PID 2392 wrote to memory of 2612	2392	20d5968a079fb744afae49221cf33e80N.exe	47
PID 2392 wrote to memory of 1264	2392	20d5968a079fb744afae49221cf33e80N.exe	48
PID 2392 wrote to memory of 1264	2392	20d5968a079fb744afae49221cf33e80N.exe	48
PID 2392 wrote to memory of 1264	2392	20d5968a079fb744afae49221cf33e80N.exe	48
PID 2392 wrote to memory of 2868	2392	20d5968a079fb744afae49221cf33e80N.exe	49
PID 2392 wrote to memory of 2868	2392	20d5968a079fb744afae49221cf33e80N.exe	49
PID 2392 wrote to memory of 2868	2392	20d5968a079fb744afae49221cf33e80N.exe	49
PID 2392 wrote to memory of 1940	2392	20d5968a079fb744afae49221cf33e80N.exe	50
PID 2392 wrote to memory of 1940	2392	20d5968a079fb744afae49221cf33e80N.exe	50
PID 2392 wrote to memory of 1940	2392	20d5968a079fb744afae49221cf33e80N.exe	50
PID 2392 wrote to memory of 1780	2392	20d5968a079fb744afae49221cf33e80N.exe	51
PID 2392 wrote to memory of 1780	2392	20d5968a079fb744afae49221cf33e80N.exe	51
PID 2392 wrote to memory of 1780	2392	20d5968a079fb744afae49221cf33e80N.exe	51
PID 2392 wrote to memory of 2116	2392	20d5968a079fb744afae49221cf33e80N.exe	52

C:\Users\Admin\AppData\Local\Temp\20d5968a079fb744afae49221cf33e80N.exe
"C:\Users\Admin\AppData\Local\Temp\20d5968a079fb744afae49221cf33e80N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2744
- C:\Windows\System\UtbIVzS.exe
  C:\Windows\System\UtbIVzS.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\rISGXLa.exe
  C:\Windows\System\rISGXLa.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\dmHjnxi.exe
  C:\Windows\System\dmHjnxi.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\NvtaYuR.exe
  C:\Windows\System\NvtaYuR.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\EmMZzvG.exe
  C:\Windows\System\EmMZzvG.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\eKEVENh.exe
  C:\Windows\System\eKEVENh.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\qGGwQmL.exe
  C:\Windows\System\qGGwQmL.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\XdKaLUJ.exe
  C:\Windows\System\XdKaLUJ.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\fAPnsIW.exe
  C:\Windows\System\fAPnsIW.exe
  2⤵
  - Executes dropped EXE
  PID:476
- C:\Windows\System\LIakdJW.exe
  C:\Windows\System\LIakdJW.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\DUCMSbt.exe
  C:\Windows\System\DUCMSbt.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\XxswGZk.exe
  C:\Windows\System\XxswGZk.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\PpaBxHk.exe
  C:\Windows\System\PpaBxHk.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\GrSzjaM.exe
  C:\Windows\System\GrSzjaM.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\TdzTcsP.exe
  C:\Windows\System\TdzTcsP.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\OUlnQpg.exe
  C:\Windows\System\OUlnQpg.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\cViAJzV.exe
  C:\Windows\System\cViAJzV.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\UQQmriK.exe
  C:\Windows\System\UQQmriK.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\AJBedTM.exe
  C:\Windows\System\AJBedTM.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\PlKXYpa.exe
  C:\Windows\System\PlKXYpa.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\Pgdqjtf.exe
  C:\Windows\System\Pgdqjtf.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\uMfnsmC.exe
  C:\Windows\System\uMfnsmC.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\lGLMqQc.exe
  C:\Windows\System\lGLMqQc.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\DIBoFuQ.exe
  C:\Windows\System\DIBoFuQ.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\VbVmecI.exe
  C:\Windows\System\VbVmecI.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\SYvrJur.exe
  C:\Windows\System\SYvrJur.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\xaNvIEw.exe
  C:\Windows\System\xaNvIEw.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\EfolRAW.exe
  C:\Windows\System\EfolRAW.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\FNJoOUz.exe
  C:\Windows\System\FNJoOUz.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\AzBgzZR.exe
  C:\Windows\System\AzBgzZR.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\LNmIWFf.exe
  C:\Windows\System\LNmIWFf.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\hKNZqXL.exe
  C:\Windows\System\hKNZqXL.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\HtlEgvX.exe
  C:\Windows\System\HtlEgvX.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\gkStaje.exe
  C:\Windows\System\gkStaje.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\wHIIMeK.exe
  C:\Windows\System\wHIIMeK.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\FTVeenR.exe
  C:\Windows\System\FTVeenR.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\KyuxNGR.exe
  C:\Windows\System\KyuxNGR.exe
  2⤵
  - Executes dropped EXE
  PID:660
- C:\Windows\System\BhNcVBZ.exe
  C:\Windows\System\BhNcVBZ.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\xKOpIoT.exe
  C:\Windows\System\xKOpIoT.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\riAykuE.exe
  C:\Windows\System\riAykuE.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\NPROjAk.exe
  C:\Windows\System\NPROjAk.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\UOrpWPv.exe
  C:\Windows\System\UOrpWPv.exe
  2⤵
  - Executes dropped EXE
  PID:356
- C:\Windows\System\NpFhoMd.exe
  C:\Windows\System\NpFhoMd.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\QzsQGrh.exe
  C:\Windows\System\QzsQGrh.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\SqcRvgL.exe
  C:\Windows\System\SqcRvgL.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\wfVObxN.exe
  C:\Windows\System\wfVObxN.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\jrwNyZa.exe
  C:\Windows\System\jrwNyZa.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\uCtILxw.exe
  C:\Windows\System\uCtILxw.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\LFfJKSA.exe
  C:\Windows\System\LFfJKSA.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\PgOwoqX.exe
  C:\Windows\System\PgOwoqX.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\KNdjRIq.exe
  C:\Windows\System\KNdjRIq.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\ABpAYDE.exe
  C:\Windows\System\ABpAYDE.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\CAtefhT.exe
  C:\Windows\System\CAtefhT.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\VGzcnlN.exe
  C:\Windows\System\VGzcnlN.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\JlKdUcW.exe
  C:\Windows\System\JlKdUcW.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\RYETWEL.exe
  C:\Windows\System\RYETWEL.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\mGbCBsb.exe
  C:\Windows\System\mGbCBsb.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\zmAgfcj.exe
  C:\Windows\System\zmAgfcj.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\LnEMfCg.exe
  C:\Windows\System\LnEMfCg.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\gCFvliL.exe
  C:\Windows\System\gCFvliL.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\dJtfaAn.exe
  C:\Windows\System\dJtfaAn.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\jYjnuWg.exe
  C:\Windows\System\jYjnuWg.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\kSNXyyI.exe
  C:\Windows\System\kSNXyyI.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\mRayQMo.exe
  C:\Windows\System\mRayQMo.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\EJFqHOp.exe
  C:\Windows\System\EJFqHOp.exe
  2⤵
  PID:3068
- C:\Windows\System\yFCnDAt.exe
  C:\Windows\System\yFCnDAt.exe
  2⤵
  PID:2248
- C:\Windows\System\AvWtfDk.exe
  C:\Windows\System\AvWtfDk.exe
  2⤵
  PID:1828
- C:\Windows\System\WqbIrhF.exe
  C:\Windows\System\WqbIrhF.exe
  2⤵
  PID:448
- C:\Windows\System\zEAHoQv.exe
  C:\Windows\System\zEAHoQv.exe
  2⤵
  PID:1676
- C:\Windows\System\uHYezee.exe
  C:\Windows\System\uHYezee.exe
  2⤵
  PID:1268
- C:\Windows\System\NlfQgNf.exe
  C:\Windows\System\NlfQgNf.exe
  2⤵
  PID:1684
- C:\Windows\System\ClYnPKn.exe
  C:\Windows\System\ClYnPKn.exe
  2⤵
  PID:1236
- C:\Windows\System\tztsTuY.exe
  C:\Windows\System\tztsTuY.exe
  2⤵
  PID:2632
- C:\Windows\System\qMgumKn.exe
  C:\Windows\System\qMgumKn.exe
  2⤵
  PID:3000
- C:\Windows\System\mtfIPag.exe
  C:\Windows\System\mtfIPag.exe
  2⤵
  PID:2356
- C:\Windows\System\KAdiKRR.exe
  C:\Windows\System\KAdiKRR.exe
  2⤵
  PID:1648
- C:\Windows\System\ZarQHEJ.exe
  C:\Windows\System\ZarQHEJ.exe
  2⤵
  PID:288
- C:\Windows\System\cGwqVcv.exe
  C:\Windows\System\cGwqVcv.exe
  2⤵
  PID:880
- C:\Windows\System\biscTQH.exe
  C:\Windows\System\biscTQH.exe
  2⤵
  PID:1708
- C:\Windows\System\jCKRLmo.exe
  C:\Windows\System\jCKRLmo.exe
  2⤵
  PID:2056
- C:\Windows\System\CqoGhXa.exe
  C:\Windows\System\CqoGhXa.exe
  2⤵
  PID:2796
- C:\Windows\System\cimXSIx.exe
  C:\Windows\System\cimXSIx.exe
  2⤵
  PID:2756
- C:\Windows\System\icjmyoU.exe
  C:\Windows\System\icjmyoU.exe
  2⤵
  PID:2836
- C:\Windows\System\RbVnbXt.exe
  C:\Windows\System\RbVnbXt.exe
  2⤵
  PID:1432
- C:\Windows\System\mZSnvDz.exe
  C:\Windows\System\mZSnvDz.exe
  2⤵
  PID:2112
- C:\Windows\System\MVOgYnp.exe
  C:\Windows\System\MVOgYnp.exe
  2⤵
  PID:236
- C:\Windows\System\gMANQQi.exe
  C:\Windows\System\gMANQQi.exe
  2⤵
  PID:2152
- C:\Windows\System\zcUpdix.exe
  C:\Windows\System\zcUpdix.exe
  2⤵
  PID:2260
- C:\Windows\System\rYmDfch.exe
  C:\Windows\System\rYmDfch.exe
  2⤵
  PID:3012
- C:\Windows\System\vfQGTeV.exe
  C:\Windows\System\vfQGTeV.exe
  2⤵
  PID:2848
- C:\Windows\System\WhIMhxk.exe
  C:\Windows\System\WhIMhxk.exe
  2⤵
  PID:3032
- C:\Windows\System\folQzBa.exe
  C:\Windows\System\folQzBa.exe
  2⤵
  PID:2680
- C:\Windows\System\sDjgXGA.exe
  C:\Windows\System\sDjgXGA.exe
  2⤵
  PID:2272
- C:\Windows\System\iryMYJz.exe
  C:\Windows\System\iryMYJz.exe
  2⤵
  PID:1792
- C:\Windows\System\aqvkCqF.exe
  C:\Windows\System\aqvkCqF.exe
  2⤵
  PID:808
- C:\Windows\System\CsvyIIT.exe
  C:\Windows\System\CsvyIIT.exe
  2⤵
  PID:2420
- C:\Windows\System\aFbzzen.exe
  C:\Windows\System\aFbzzen.exe
  2⤵
  PID:1356
- C:\Windows\System\rZSpHRn.exe
  C:\Windows\System\rZSpHRn.exe
  2⤵
  PID:1704
- C:\Windows\System\kzoURVB.exe
  C:\Windows\System\kzoURVB.exe
  2⤵
  PID:2656
- C:\Windows\System\tZfaFGZ.exe
  C:\Windows\System\tZfaFGZ.exe
  2⤵
  PID:1956
- C:\Windows\System\DJxHyyG.exe
  C:\Windows\System\DJxHyyG.exe
  2⤵
  PID:2336
- C:\Windows\System\IZJbwqo.exe
  C:\Windows\System\IZJbwqo.exe
  2⤵
  PID:2724
- C:\Windows\System\uDlhmZC.exe
  C:\Windows\System\uDlhmZC.exe
  2⤵
  PID:2996
- C:\Windows\System\jtSxlJD.exe
  C:\Windows\System\jtSxlJD.exe
  2⤵
  PID:2696
- C:\Windows\System\kAweUQV.exe
  C:\Windows\System\kAweUQV.exe
  2⤵
  PID:2660
- C:\Windows\System\BAMfWac.exe
  C:\Windows\System\BAMfWac.exe
  2⤵
  PID:2864
- C:\Windows\System\ecwpsWI.exe
  C:\Windows\System\ecwpsWI.exe
  2⤵
  PID:3036
- C:\Windows\System\RLvWgZF.exe
  C:\Windows\System\RLvWgZF.exe
  2⤵
  PID:1476
- C:\Windows\System\YzeHWSy.exe
  C:\Windows\System\YzeHWSy.exe
  2⤵
  PID:2992
- C:\Windows\System\XnldwZS.exe
  C:\Windows\System\XnldwZS.exe
  2⤵
  PID:2228
- C:\Windows\System\zCtfZsr.exe
  C:\Windows\System\zCtfZsr.exe
  2⤵
  PID:2212
- C:\Windows\System\hqFetRU.exe
  C:\Windows\System\hqFetRU.exe
  2⤵
  PID:2320
- C:\Windows\System\sxAMthq.exe
  C:\Windows\System\sxAMthq.exe
  2⤵
  PID:2784
- C:\Windows\System\HCATpNI.exe
  C:\Windows\System\HCATpNI.exe
  2⤵
  PID:2728
- C:\Windows\System\wVrZIvL.exe
  C:\Windows\System\wVrZIvL.exe
  2⤵
  PID:1556
- C:\Windows\System\JNYiDcg.exe
  C:\Windows\System\JNYiDcg.exe
  2⤵
  PID:2444
- C:\Windows\System\vfAUWGb.exe
  C:\Windows\System\vfAUWGb.exe
  2⤵
  PID:680
- C:\Windows\System\vypKvrQ.exe
  C:\Windows\System\vypKvrQ.exe
  2⤵
  PID:2424
- C:\Windows\System\dLkJoeL.exe
  C:\Windows\System\dLkJoeL.exe
  2⤵
  PID:3044
- C:\Windows\System\GMTXyAt.exe
  C:\Windows\System\GMTXyAt.exe
  2⤵
  PID:1936
- C:\Windows\System\pgbGwmW.exe
  C:\Windows\System\pgbGwmW.exe
  2⤵
  PID:2936
- C:\Windows\System\KODzFyQ.exe
  C:\Windows\System\KODzFyQ.exe
  2⤵
  PID:2608
- C:\Windows\System\GMuJjyr.exe
  C:\Windows\System\GMuJjyr.exe
  2⤵
  PID:532
- C:\Windows\System\cHLlFJC.exe
  C:\Windows\System\cHLlFJC.exe
  2⤵
  PID:2396
- C:\Windows\System\kXAdRzC.exe
  C:\Windows\System\kXAdRzC.exe
  2⤵
  PID:3020
- C:\Windows\System\uJziUgM.exe
  C:\Windows\System\uJziUgM.exe
  2⤵
  PID:2792
- C:\Windows\System\qGaldSe.exe
  C:\Windows\System\qGaldSe.exe
  2⤵
  PID:2264
- C:\Windows\System\mBCcpkb.exe
  C:\Windows\System\mBCcpkb.exe
  2⤵
  PID:2528
- C:\Windows\System\BEHbCNG.exe
  C:\Windows\System\BEHbCNG.exe
  2⤵
  PID:2448
- C:\Windows\System\xujpNrz.exe
  C:\Windows\System\xujpNrz.exe
  2⤵
  PID:1520
- C:\Windows\System\IHKjyvl.exe
  C:\Windows\System\IHKjyvl.exe
  2⤵
  PID:1752
- C:\Windows\System\xDAeXjl.exe
  C:\Windows\System\xDAeXjl.exe
  2⤵
  PID:1500
- C:\Windows\System\yNlSozw.exe
  C:\Windows\System\yNlSozw.exe
  2⤵
  PID:2732
- C:\Windows\System\sWPWyKB.exe
  C:\Windows\System\sWPWyKB.exe
  2⤵
  PID:2944
- C:\Windows\System\LTLTwMw.exe
  C:\Windows\System\LTLTwMw.exe
  2⤵
  PID:2828
- C:\Windows\System\eMmhYef.exe
  C:\Windows\System\eMmhYef.exe
  2⤵
  PID:1368
- C:\Windows\System\OUivSwP.exe
  C:\Windows\System\OUivSwP.exe
  2⤵
  PID:612
- C:\Windows\System\KgAlucX.exe
  C:\Windows\System\KgAlucX.exe
  2⤵
  PID:1620
- C:\Windows\System\FaJNLGq.exe
  C:\Windows\System\FaJNLGq.exe
  2⤵
  PID:2520
- C:\Windows\System\AZJolDs.exe
  C:\Windows\System\AZJolDs.exe
  2⤵
  PID:704
- C:\Windows\System\Hbxczby.exe
  C:\Windows\System\Hbxczby.exe
  2⤵
  PID:1844
- C:\Windows\System\UjlgnTr.exe
  C:\Windows\System\UjlgnTr.exe
  2⤵
  PID:2504
- C:\Windows\System\ykyXdnp.exe
  C:\Windows\System\ykyXdnp.exe
  2⤵
  PID:2316
- C:\Windows\System\VchTPxQ.exe
  C:\Windows\System\VchTPxQ.exe
  2⤵
  PID:1120
- C:\Windows\System\eRhCgSk.exe
  C:\Windows\System\eRhCgSk.exe
  2⤵
  PID:2180
- C:\Windows\System\sUYxYdf.exe
  C:\Windows\System\sUYxYdf.exe
  2⤵
  PID:1904
- C:\Windows\System\NvOuuUD.exe
  C:\Windows\System\NvOuuUD.exe
  2⤵
  PID:640
- C:\Windows\System\kmTSFkV.exe
  C:\Windows\System\kmTSFkV.exe
  2⤵
  PID:3088
- C:\Windows\System\VqPNROL.exe
  C:\Windows\System\VqPNROL.exe
  2⤵
  PID:3108
- C:\Windows\System\RVkwUQi.exe
  C:\Windows\System\RVkwUQi.exe
  2⤵
  PID:3124
- C:\Windows\System\dTjtidW.exe
  C:\Windows\System\dTjtidW.exe
  2⤵
  PID:3140
- C:\Windows\System\sonrmfx.exe
  C:\Windows\System\sonrmfx.exe
  2⤵
  PID:3156
- C:\Windows\System\brrPksO.exe
  C:\Windows\System\brrPksO.exe
  2⤵
  PID:3172
- C:\Windows\System\MdWOvGq.exe
  C:\Windows\System\MdWOvGq.exe
  2⤵
  PID:3188
- C:\Windows\System\zolSBJX.exe
  C:\Windows\System\zolSBJX.exe
  2⤵
  PID:3204
- C:\Windows\System\IzRmASn.exe
  C:\Windows\System\IzRmASn.exe
  2⤵
  PID:3220
- C:\Windows\System\XwLonmB.exe
  C:\Windows\System\XwLonmB.exe
  2⤵
  PID:3236
- C:\Windows\System\iFDeEuZ.exe
  C:\Windows\System\iFDeEuZ.exe
  2⤵
  PID:3252
- C:\Windows\System\XFuTdCo.exe
  C:\Windows\System\XFuTdCo.exe
  2⤵
  PID:3268
- C:\Windows\System\otZLLHB.exe
  C:\Windows\System\otZLLHB.exe
  2⤵
  PID:3284
- C:\Windows\System\WmtZNsN.exe
  C:\Windows\System\WmtZNsN.exe
  2⤵
  PID:3300
- C:\Windows\System\qCoBiBv.exe
  C:\Windows\System\qCoBiBv.exe
  2⤵
  PID:3316
- C:\Windows\System\XDAJxew.exe
  C:\Windows\System\XDAJxew.exe
  2⤵
  PID:3332
- C:\Windows\System\TQskJoe.exe
  C:\Windows\System\TQskJoe.exe
  2⤵
  PID:3348
- C:\Windows\System\oUZWtbb.exe
  C:\Windows\System\oUZWtbb.exe
  2⤵
  PID:3364
- C:\Windows\System\xnjgEmz.exe
  C:\Windows\System\xnjgEmz.exe
  2⤵
  PID:3380
- C:\Windows\System\NFGXoRK.exe
  C:\Windows\System\NFGXoRK.exe
  2⤵
  PID:3396
- C:\Windows\System\qQhtARY.exe
  C:\Windows\System\qQhtARY.exe
  2⤵
  PID:3412
- C:\Windows\System\uWvwlAX.exe
  C:\Windows\System\uWvwlAX.exe
  2⤵
  PID:3428
- C:\Windows\System\PSmeJAj.exe
  C:\Windows\System\PSmeJAj.exe
  2⤵
  PID:3444
- C:\Windows\System\IfxCKWF.exe
  C:\Windows\System\IfxCKWF.exe
  2⤵
  PID:3460
- C:\Windows\System\bRBrRhC.exe
  C:\Windows\System\bRBrRhC.exe
  2⤵
  PID:3476
- C:\Windows\System\qvktDxd.exe
  C:\Windows\System\qvktDxd.exe
  2⤵
  PID:3492
- C:\Windows\System\wsUWIVx.exe
  C:\Windows\System\wsUWIVx.exe
  2⤵
  PID:3508
- C:\Windows\System\QcmEjEl.exe
  C:\Windows\System\QcmEjEl.exe
  2⤵
  PID:3524
- C:\Windows\System\FKKsJqL.exe
  C:\Windows\System\FKKsJqL.exe
  2⤵
  PID:3540
- C:\Windows\System\viFhBxY.exe
  C:\Windows\System\viFhBxY.exe
  2⤵
  PID:3556
- C:\Windows\System\bvffAzn.exe
  C:\Windows\System\bvffAzn.exe
  2⤵
  PID:3572
- C:\Windows\System\rDXwVPH.exe
  C:\Windows\System\rDXwVPH.exe
  2⤵
  PID:3588
- C:\Windows\System\TXaimRk.exe
  C:\Windows\System\TXaimRk.exe
  2⤵
  PID:3604
- C:\Windows\System\YaUGEYC.exe
  C:\Windows\System\YaUGEYC.exe
  2⤵
  PID:3620
- C:\Windows\System\LIHDHEx.exe
  C:\Windows\System\LIHDHEx.exe
  2⤵
  PID:3636
- C:\Windows\System\TjRIpUt.exe
  C:\Windows\System\TjRIpUt.exe
  2⤵
  PID:3652
- C:\Windows\System\aEwTZKj.exe
  C:\Windows\System\aEwTZKj.exe
  2⤵
  PID:3668
- C:\Windows\System\GQBlLIe.exe
  C:\Windows\System\GQBlLIe.exe
  2⤵
  PID:3684
- C:\Windows\System\BeAPwex.exe
  C:\Windows\System\BeAPwex.exe
  2⤵
  PID:3700
- C:\Windows\System\SZpDagy.exe
  C:\Windows\System\SZpDagy.exe
  2⤵
  PID:3716
- C:\Windows\System\aTpzdwB.exe
  C:\Windows\System\aTpzdwB.exe
  2⤵
  PID:3732
- C:\Windows\System\nQgkxAg.exe
  C:\Windows\System\nQgkxAg.exe
  2⤵
  PID:3748
- C:\Windows\System\moVUXaR.exe
  C:\Windows\System\moVUXaR.exe
  2⤵
  PID:3764
- C:\Windows\System\eUBxZbe.exe
  C:\Windows\System\eUBxZbe.exe
  2⤵
  PID:3780
- C:\Windows\System\pcAVfih.exe
  C:\Windows\System\pcAVfih.exe
  2⤵
  PID:3796
- C:\Windows\System\lrIulLs.exe
  C:\Windows\System\lrIulLs.exe
  2⤵
  PID:3812
- C:\Windows\System\QexItgt.exe
  C:\Windows\System\QexItgt.exe
  2⤵
  PID:3828
- C:\Windows\System\HrnuChd.exe
  C:\Windows\System\HrnuChd.exe
  2⤵
  PID:3844
- C:\Windows\System\yttRXRn.exe
  C:\Windows\System\yttRXRn.exe
  2⤵
  PID:3860
- C:\Windows\System\uiDtyzP.exe
  C:\Windows\System\uiDtyzP.exe
  2⤵
  PID:3876
- C:\Windows\System\cXdNlWx.exe
  C:\Windows\System\cXdNlWx.exe
  2⤵
  PID:3892
- C:\Windows\System\zeeIAaL.exe
  C:\Windows\System\zeeIAaL.exe
  2⤵
  PID:3908
- C:\Windows\System\BSynlnv.exe
  C:\Windows\System\BSynlnv.exe
  2⤵
  PID:3924
- C:\Windows\System\gHmBddX.exe
  C:\Windows\System\gHmBddX.exe
  2⤵
  PID:3940
- C:\Windows\System\ZopYwIH.exe
  C:\Windows\System\ZopYwIH.exe
  2⤵
  PID:3956
- C:\Windows\System\JboiQtj.exe
  C:\Windows\System\JboiQtj.exe
  2⤵
  PID:3972
- C:\Windows\System\fkBEFKr.exe
  C:\Windows\System\fkBEFKr.exe
  2⤵
  PID:3992
- C:\Windows\System\pfIpxnC.exe
  C:\Windows\System\pfIpxnC.exe
  2⤵
  PID:4008
- C:\Windows\System\PuSIGdJ.exe
  C:\Windows\System\PuSIGdJ.exe
  2⤵
  PID:4024
- C:\Windows\System\LEGJHKo.exe
  C:\Windows\System\LEGJHKo.exe
  2⤵
  PID:4040
- C:\Windows\System\uxMWXJT.exe
  C:\Windows\System\uxMWXJT.exe
  2⤵
  PID:4056
- C:\Windows\System\kBtRslr.exe
  C:\Windows\System\kBtRslr.exe
  2⤵
  PID:4072
- C:\Windows\System\cpILcro.exe
  C:\Windows\System\cpILcro.exe
  2⤵
  PID:4088
- C:\Windows\System\zSzPIZR.exe
  C:\Windows\System\zSzPIZR.exe
  2⤵
  PID:2704
- C:\Windows\System\eGwzoJS.exe
  C:\Windows\System\eGwzoJS.exe
  2⤵
  PID:2216
- C:\Windows\System\QPycqPF.exe
  C:\Windows\System\QPycqPF.exe
  2⤵
  PID:2540
- C:\Windows\System\QVtbkxr.exe
  C:\Windows\System\QVtbkxr.exe
  2⤵
  PID:3152
- C:\Windows\System\cbuHAJy.exe
  C:\Windows\System\cbuHAJy.exe
  2⤵
  PID:2676
- C:\Windows\System\JQsialU.exe
  C:\Windows\System\JQsialU.exe
  2⤵
  PID:3104
- C:\Windows\System\ZTLNpzw.exe
  C:\Windows\System\ZTLNpzw.exe
  2⤵
  PID:3164
- C:\Windows\System\GyNvWZO.exe
  C:\Windows\System\GyNvWZO.exe
  2⤵
  PID:3212
- C:\Windows\System\VWOMblZ.exe
  C:\Windows\System\VWOMblZ.exe
  2⤵
  PID:3276
- C:\Windows\System\PTEHOip.exe
  C:\Windows\System\PTEHOip.exe
  2⤵
  PID:3260
- C:\Windows\System\OKPpAgg.exe
  C:\Windows\System\OKPpAgg.exe
  2⤵
  PID:3296
- C:\Windows\System\whcXguB.exe
  C:\Windows\System\whcXguB.exe
  2⤵
  PID:3340
- C:\Windows\System\zCJdoTI.exe
  C:\Windows\System\zCJdoTI.exe
  2⤵
  PID:3372
- C:\Windows\System\hTFlNse.exe
  C:\Windows\System\hTFlNse.exe
  2⤵
  PID:3404
- C:\Windows\System\xMaFcaX.exe
  C:\Windows\System\xMaFcaX.exe
  2⤵
  PID:3436
- C:\Windows\System\BWLJLvu.exe
  C:\Windows\System\BWLJLvu.exe
  2⤵
  PID:3500
- C:\Windows\System\faiGmoN.exe
  C:\Windows\System\faiGmoN.exe
  2⤵
  PID:3456
- C:\Windows\System\HhoJVao.exe
  C:\Windows\System\HhoJVao.exe
  2⤵
  PID:3516
- C:\Windows\System\OaxSOCK.exe
  C:\Windows\System\OaxSOCK.exe
  2⤵
  PID:3548
- C:\Windows\System\BeBgnZQ.exe
  C:\Windows\System\BeBgnZQ.exe
  2⤵
  PID:3552
- C:\Windows\System\pRjTfVb.exe
  C:\Windows\System\pRjTfVb.exe
  2⤵
  PID:3616
- C:\Windows\System\ujJudkG.exe
  C:\Windows\System\ujJudkG.exe
  2⤵
  PID:3648
- C:\Windows\System\ZNJdavN.exe
  C:\Windows\System\ZNJdavN.exe
  2⤵
  PID:3696
- C:\Windows\System\MPRyaGe.exe
  C:\Windows\System\MPRyaGe.exe
  2⤵
  PID:3680
- C:\Windows\System\FtjXHrO.exe
  C:\Windows\System\FtjXHrO.exe
  2⤵
  PID:3756
- C:\Windows\System\AFRCDiI.exe
  C:\Windows\System\AFRCDiI.exe
  2⤵
  PID:3788
- C:\Windows\System\wDYQSiG.exe
  C:\Windows\System\wDYQSiG.exe
  2⤵
  PID:3776
- C:\Windows\System\MzStpVV.exe
  C:\Windows\System\MzStpVV.exe
  2⤵
  PID:3824
- C:\Windows\System\EnlbCXR.exe
  C:\Windows\System\EnlbCXR.exe
  2⤵
  PID:3884
- C:\Windows\System\wJIPrBi.exe
  C:\Windows\System\wJIPrBi.exe
  2⤵
  PID:2404
- C:\Windows\System\YtsCJcg.exe
  C:\Windows\System\YtsCJcg.exe
  2⤵
  PID:3868
- C:\Windows\System\nIXgEmO.exe
  C:\Windows\System\nIXgEmO.exe
  2⤵
  PID:3920
- C:\Windows\System\SKQTElb.exe
  C:\Windows\System\SKQTElb.exe
  2⤵
  PID:3932
- C:\Windows\System\YvjtpqC.exe
  C:\Windows\System\YvjtpqC.exe
  2⤵
  PID:3984
- C:\Windows\System\hgtxEfQ.exe
  C:\Windows\System\hgtxEfQ.exe
  2⤵
  PID:4004
- C:\Windows\System\ZkDPIAr.exe
  C:\Windows\System\ZkDPIAr.exe
  2⤵
  PID:4108
- C:\Windows\System\EUSFFep.exe
  C:\Windows\System\EUSFFep.exe
  2⤵
  PID:4124
- C:\Windows\System\bvZolJg.exe
  C:\Windows\System\bvZolJg.exe
  2⤵
  PID:4140
- C:\Windows\System\ZdXziRv.exe
  C:\Windows\System\ZdXziRv.exe
  2⤵
  PID:4156
- C:\Windows\System\lxSwVvc.exe
  C:\Windows\System\lxSwVvc.exe
  2⤵
  PID:4504
- C:\Windows\System\xtVFbYv.exe
  C:\Windows\System\xtVFbYv.exe
  2⤵
  PID:4544
- C:\Windows\System\SsNHsOK.exe
  C:\Windows\System\SsNHsOK.exe
  2⤵
  PID:4560
- C:\Windows\System\ONhDsiV.exe
  C:\Windows\System\ONhDsiV.exe
  2⤵
  PID:4576
- C:\Windows\System\hxTExEY.exe
  C:\Windows\System\hxTExEY.exe
  2⤵
  PID:4592
- C:\Windows\System\hHbAwGj.exe
  C:\Windows\System\hHbAwGj.exe
  2⤵
  PID:4608
- C:\Windows\System\AfCTAVC.exe
  C:\Windows\System\AfCTAVC.exe
  2⤵
  PID:4624
- C:\Windows\System\aFRcrVr.exe
  C:\Windows\System\aFRcrVr.exe
  2⤵
  PID:4644
- C:\Windows\System\PmxHMea.exe
  C:\Windows\System\PmxHMea.exe
  2⤵
  PID:4660
- C:\Windows\System\fCFFkIY.exe
  C:\Windows\System\fCFFkIY.exe
  2⤵
  PID:4676
- C:\Windows\System\lJNkXqu.exe
  C:\Windows\System\lJNkXqu.exe
  2⤵
  PID:4692
- C:\Windows\System\Jyjlrtu.exe
  C:\Windows\System\Jyjlrtu.exe
  2⤵
  PID:4708
- C:\Windows\System\rVfqxFT.exe
  C:\Windows\System\rVfqxFT.exe
  2⤵
  PID:4724
- C:\Windows\System\hbIcsDK.exe
  C:\Windows\System\hbIcsDK.exe
  2⤵
  PID:4740
- C:\Windows\System\lhTqfOR.exe
  C:\Windows\System\lhTqfOR.exe
  2⤵
  PID:4756
- C:\Windows\System\dcClcCZ.exe
  C:\Windows\System\dcClcCZ.exe
  2⤵
  PID:4772
- C:\Windows\System\wvPQEKp.exe
  C:\Windows\System\wvPQEKp.exe
  2⤵
  PID:4788
- C:\Windows\System\ULgbHhj.exe
  C:\Windows\System\ULgbHhj.exe
  2⤵
  PID:4804
- C:\Windows\System\VkDGREM.exe
  C:\Windows\System\VkDGREM.exe
  2⤵
  PID:4820
- C:\Windows\System\PjcShFJ.exe
  C:\Windows\System\PjcShFJ.exe
  2⤵
  PID:4844
- C:\Windows\System\riVztuL.exe
  C:\Windows\System\riVztuL.exe
  2⤵
  PID:4860
- C:\Windows\System\RuNKKZk.exe
  C:\Windows\System\RuNKKZk.exe
  2⤵
  PID:4880
- C:\Windows\System\XSZxQDA.exe
  C:\Windows\System\XSZxQDA.exe
  2⤵
  PID:4896
- C:\Windows\System\sbMrYoT.exe
  C:\Windows\System\sbMrYoT.exe
  2⤵
  PID:4912
- C:\Windows\System\IehXWfZ.exe
  C:\Windows\System\IehXWfZ.exe
  2⤵
  PID:4928
- C:\Windows\System\GwQRMHi.exe
  C:\Windows\System\GwQRMHi.exe
  2⤵
  PID:4944
- C:\Windows\System\KthfPJw.exe
  C:\Windows\System\KthfPJw.exe
  2⤵
  PID:4960
- C:\Windows\System\fnabtJX.exe
  C:\Windows\System\fnabtJX.exe
  2⤵
  PID:4976
- C:\Windows\System\tkVAVBJ.exe
  C:\Windows\System\tkVAVBJ.exe
  2⤵
  PID:4992
- C:\Windows\System\iRIcesE.exe
  C:\Windows\System\iRIcesE.exe
  2⤵
  PID:5008
- C:\Windows\System\xTONrqf.exe
  C:\Windows\System\xTONrqf.exe
  2⤵
  PID:5024
- C:\Windows\System\NVOrWeI.exe
  C:\Windows\System\NVOrWeI.exe
  2⤵
  PID:1852
- C:\Windows\System\LjBAmRJ.exe
  C:\Windows\System\LjBAmRJ.exe
  2⤵
  PID:3312
- C:\Windows\System\mEZDHUu.exe
  C:\Windows\System\mEZDHUu.exe
  2⤵
  PID:3472
- C:\Windows\System\stmOouc.exe
  C:\Windows\System\stmOouc.exe
  2⤵
  PID:3600
- C:\Windows\System\VPVfYzL.exe
  C:\Windows\System\VPVfYzL.exe
  2⤵
  PID:3676
- C:\Windows\System\Yzfrlxu.exe
  C:\Windows\System\Yzfrlxu.exe
  2⤵
  PID:2512
- C:\Windows\System\MsTpAOF.exe
  C:\Windows\System\MsTpAOF.exe
  2⤵
  PID:3840
- C:\Windows\System\PbmkZeT.exe
  C:\Windows\System\PbmkZeT.exe
  2⤵
  PID:3980
- C:\Windows\System\qJJtrkL.exe
  C:\Windows\System\qJJtrkL.exe
  2⤵
  PID:4136
- C:\Windows\System\wGjvHmE.exe
  C:\Windows\System\wGjvHmE.exe
  2⤵
  PID:4188
- C:\Windows\System\jmZHeQG.exe
  C:\Windows\System\jmZHeQG.exe
  2⤵
  PID:4204
- C:\Windows\System\ZMzxBPQ.exe
  C:\Windows\System\ZMzxBPQ.exe
  2⤵
  PID:4224
- C:\Windows\System\vQXaRTc.exe
  C:\Windows\System\vQXaRTc.exe
  2⤵
  PID:4240
- C:\Windows\System\SPeXqNu.exe
  C:\Windows\System\SPeXqNu.exe
  2⤵
  PID:4348
- C:\Windows\System\kfeHBIl.exe
  C:\Windows\System\kfeHBIl.exe
  2⤵
  PID:4328
- C:\Windows\System\eZmUxri.exe
  C:\Windows\System\eZmUxri.exe
  2⤵
  PID:4312
- C:\Windows\System\neSBzWh.exe
  C:\Windows\System\neSBzWh.exe
  2⤵
  PID:4296
- C:\Windows\System\iYeiJbQ.exe
  C:\Windows\System\iYeiJbQ.exe
  2⤵
  PID:4276
- C:\Windows\System\KDBFdKu.exe
  C:\Windows\System\KDBFdKu.exe
  2⤵
  PID:4260
- C:\Windows\System\DSlUReQ.exe
  C:\Windows\System\DSlUReQ.exe
  2⤵
  PID:4244
- C:\Windows\System\qzhgjBv.exe
  C:\Windows\System\qzhgjBv.exe
  2⤵
  PID:4032
- C:\Windows\System\NULAlBy.exe
  C:\Windows\System\NULAlBy.exe
  2⤵
  PID:4388
- C:\Windows\System\ujsVsZx.exe
  C:\Windows\System\ujsVsZx.exe
  2⤵
  PID:4404
- C:\Windows\System\wEvPcKP.exe
  C:\Windows\System\wEvPcKP.exe
  2⤵
  PID:4420
- C:\Windows\System\TerYNex.exe
  C:\Windows\System\TerYNex.exe
  2⤵
  PID:3356
- C:\Windows\System\YhJevyc.exe
  C:\Windows\System\YhJevyc.exe
  2⤵
  PID:3452
- C:\Windows\System\xgfDpoh.exe
  C:\Windows\System\xgfDpoh.exe
  2⤵
  PID:3852
- C:\Windows\System\DYfmQKV.exe
  C:\Windows\System\DYfmQKV.exe
  2⤵
  PID:4120
- C:\Windows\System\TDjNGoZ.exe
  C:\Windows\System\TDjNGoZ.exe
  2⤵
  PID:4568
- C:\Windows\System\xtXFsIG.exe
  C:\Windows\System\xtXFsIG.exe
  2⤵
  PID:4736
- C:\Windows\System\irFtZvF.exe
  C:\Windows\System\irFtZvF.exe
  2⤵
  PID:4796
- C:\Windows\System\kqcRgrA.exe
  C:\Windows\System\kqcRgrA.exe
  2⤵
  PID:4836
- C:\Windows\System\eXzMJmd.exe
  C:\Windows\System\eXzMJmd.exe
  2⤵
  PID:4888
- C:\Windows\System\wIAhJir.exe
  C:\Windows\System\wIAhJir.exe
  2⤵
  PID:4984
- C:\Windows\System\JFSVqtU.exe
  C:\Windows\System\JFSVqtU.exe
  2⤵
  PID:4936
- C:\Windows\System\tmNpksv.exe
  C:\Windows\System\tmNpksv.exe
  2⤵
  PID:5032
- C:\Windows\System\BCnXheO.exe
  C:\Windows\System\BCnXheO.exe
  2⤵
  PID:2580
- C:\Windows\System\SDMXwVz.exe
  C:\Windows\System\SDMXwVz.exe
  2⤵
  PID:5036
- C:\Windows\System\xcduAWs.exe
  C:\Windows\System\xcduAWs.exe
  2⤵
  PID:2164
- C:\Windows\System\oyiCveO.exe
  C:\Windows\System\oyiCveO.exe
  2⤵
  PID:5076
- C:\Windows\System\ewssmeX.exe
  C:\Windows\System\ewssmeX.exe
  2⤵
  PID:5100
- C:\Windows\System\eqGSoKZ.exe
  C:\Windows\System\eqGSoKZ.exe
  2⤵
  PID:5116
- C:\Windows\System\zZBNxID.exe
  C:\Windows\System\zZBNxID.exe
  2⤵
  PID:4052
- C:\Windows\System\CGLtXMq.exe
  C:\Windows\System\CGLtXMq.exe
  2⤵
  PID:2144
- C:\Windows\System\dSLyRYI.exe
  C:\Windows\System\dSLyRYI.exe
  2⤵
  PID:3596
- C:\Windows\System\rUHyEEB.exe
  C:\Windows\System\rUHyEEB.exe
  2⤵
  PID:4080
- C:\Windows\System\NdBXtYr.exe
  C:\Windows\System\NdBXtYr.exe
  2⤵
  PID:3964
- C:\Windows\System\pnMuDzD.exe
  C:\Windows\System\pnMuDzD.exe
  2⤵
  PID:632
- C:\Windows\System\YeIkfPv.exe
  C:\Windows\System\YeIkfPv.exe
  2⤵
  PID:668
- C:\Windows\System\gaecKVO.exe
  C:\Windows\System\gaecKVO.exe
  2⤵
  PID:4176
- C:\Windows\System\AjSulfr.exe
  C:\Windows\System\AjSulfr.exe
  2⤵
  PID:4212
- C:\Windows\System\BWAjYGq.exe
  C:\Windows\System\BWAjYGq.exe
  2⤵
  PID:4352
- C:\Windows\System\BrGNcRv.exe
  C:\Windows\System\BrGNcRv.exe
  2⤵
  PID:4316
- C:\Windows\System\evIkfkf.exe
  C:\Windows\System\evIkfkf.exe
  2⤵
  PID:4280
- C:\Windows\System\rKzNpYB.exe
  C:\Windows\System\rKzNpYB.exe
  2⤵
  PID:4336
- C:\Windows\System\FOvVXGV.exe
  C:\Windows\System\FOvVXGV.exe
  2⤵
  PID:4248
- C:\Windows\System\WSSrcOZ.exe
  C:\Windows\System\WSSrcOZ.exe
  2⤵
  PID:4384
- C:\Windows\System\dmPWGMw.exe
  C:\Windows\System\dmPWGMw.exe
  2⤵
  PID:4364
- C:\Windows\System\hGLveTS.exe
  C:\Windows\System\hGLveTS.exe
  2⤵
  PID:4432
- C:\Windows\System\zZACulD.exe
  C:\Windows\System\zZACulD.exe
  2⤵
  PID:1968
- C:\Windows\System\PLWTSRv.exe
  C:\Windows\System\PLWTSRv.exe
  2⤵
  PID:4456
- C:\Windows\System\wYxnJhB.exe
  C:\Windows\System\wYxnJhB.exe
  2⤵
  PID:4468
- C:\Windows\System\phJrRPr.exe
  C:\Windows\System\phJrRPr.exe
  2⤵
  PID:1732
- C:\Windows\System\WRmJHoI.exe
  C:\Windows\System\WRmJHoI.exe
  2⤵
  PID:3248
- C:\Windows\System\AYxWbEJ.exe
  C:\Windows\System\AYxWbEJ.exe
  2⤵
  PID:3084
- C:\Windows\System\NkTddHj.exe
  C:\Windows\System\NkTddHj.exe
  2⤵
  PID:3344
- C:\Windows\System\sGIidAm.exe
  C:\Windows\System\sGIidAm.exe
  2⤵
  PID:4168
- C:\Windows\System\TMXEmiY.exe
  C:\Windows\System\TMXEmiY.exe
  2⤵
  PID:2824
- C:\Windows\System\oHgJqsV.exe
  C:\Windows\System\oHgJqsV.exe
  2⤵
  PID:1492
- C:\Windows\System\qaFJSMs.exe
  C:\Windows\System\qaFJSMs.exe
  2⤵
  PID:4152
- C:\Windows\System\MflAouo.exe
  C:\Windows\System\MflAouo.exe
  2⤵
  PID:4588
- C:\Windows\System\kEobqWf.exe
  C:\Windows\System\kEobqWf.exe
  2⤵
  PID:4540
- C:\Windows\System\knUSupv.exe
  C:\Windows\System\knUSupv.exe
  2⤵
  PID:2908
- C:\Windows\System\gdwZQiy.exe
  C:\Windows\System\gdwZQiy.exe
  2⤵
  PID:4640
- C:\Windows\System\bcBmXNy.exe
  C:\Windows\System\bcBmXNy.exe
  2⤵
  PID:4684
- C:\Windows\System\NoxoJsk.exe
  C:\Windows\System\NoxoJsk.exe
  2⤵
  PID:4688
- C:\Windows\System\RSzwuZG.exe
  C:\Windows\System\RSzwuZG.exe
  2⤵
  PID:4732
- C:\Windows\System\Sdikqkg.exe
  C:\Windows\System\Sdikqkg.exe
  2⤵
  PID:4784
- C:\Windows\System\RGxtPTo.exe
  C:\Windows\System\RGxtPTo.exe
  2⤵
  PID:4856
- C:\Windows\System\KuBOqRt.exe
  C:\Windows\System\KuBOqRt.exe
  2⤵
  PID:5072
- C:\Windows\System\TtKXltm.exe
  C:\Windows\System\TtKXltm.exe
  2⤵
  PID:5064
- C:\Windows\System\LljvyNt.exe
  C:\Windows\System\LljvyNt.exe
  2⤵
  PID:2892
- C:\Windows\System\shZwmHd.exe
  C:\Windows\System\shZwmHd.exe
  2⤵
  PID:3568
- C:\Windows\System\IhAYXZA.exe
  C:\Windows\System\IhAYXZA.exe
  2⤵
  PID:544
- C:\Windows\System\knnYnBC.exe
  C:\Windows\System\knnYnBC.exe
  2⤵
  PID:3916
- C:\Windows\System\RjbpyQp.exe
  C:\Windows\System\RjbpyQp.exe
  2⤵
  PID:1464
- C:\Windows\System\uJGeTEb.exe
  C:\Windows\System\uJGeTEb.exe
  2⤵
  PID:4220
- C:\Windows\System\YqInisj.exe
  C:\Windows\System\YqInisj.exe
  2⤵
  PID:3536
- C:\Windows\System\dgUahQn.exe
  C:\Windows\System\dgUahQn.exe
  2⤵
  PID:4000
- C:\Windows\System\kxnQxgh.exe
  C:\Windows\System\kxnQxgh.exe
  2⤵
  PID:4252
- C:\Windows\System\jGynYBL.exe
  C:\Windows\System\jGynYBL.exe
  2⤵
  PID:4340
- C:\Windows\System\Abenril.exe
  C:\Windows\System\Abenril.exe
  2⤵
  PID:4464
- C:\Windows\System\cADFVri.exe
  C:\Windows\System\cADFVri.exe
  2⤵
  PID:4476
- C:\Windows\System\DcOKNYy.exe
  C:\Windows\System\DcOKNYy.exe
  2⤵
  PID:4400
- C:\Windows\System\TsYguAr.exe
  C:\Windows\System\TsYguAr.exe
  2⤵
  PID:1784
- C:\Windows\System\FpkIhND.exe
  C:\Windows\System\FpkIhND.exe
  2⤵
  PID:3080
- C:\Windows\System\uHvDoSA.exe
  C:\Windows\System\uHvDoSA.exe
  2⤵
  PID:2156
- C:\Windows\System\kTIrODJ.exe
  C:\Windows\System\kTIrODJ.exe
  2⤵
  PID:3584
- C:\Windows\System\AoIkXkM.exe
  C:\Windows\System\AoIkXkM.exe
  2⤵
  PID:4132
- C:\Windows\System\dPEKkFC.exe
  C:\Windows\System\dPEKkFC.exe
  2⤵
  PID:4852
- C:\Windows\System\NeucgkF.exe
  C:\Windows\System\NeucgkF.exe
  2⤵
  PID:4872
- C:\Windows\System\STIIDCM.exe
  C:\Windows\System\STIIDCM.exe
  2⤵
  PID:4972
- C:\Windows\System\oWmGARX.exe
  C:\Windows\System\oWmGARX.exe
  2⤵
  PID:5048
- C:\Windows\System\AUKqcdN.exe
  C:\Windows\System\AUKqcdN.exe
  2⤵
  PID:5108
- C:\Windows\System\ANWTaLU.exe
  C:\Windows\System\ANWTaLU.exe
  2⤵
  PID:5056
- C:\Windows\System\iBXOXjY.exe
  C:\Windows\System\iBXOXjY.exe
  2⤵
  PID:2000
- C:\Windows\System\jQOiEXg.exe
  C:\Windows\System\jQOiEXg.exe
  2⤵
  PID:844
- C:\Windows\System\mORlvUD.exe
  C:\Windows\System\mORlvUD.exe
  2⤵
  PID:4304
- C:\Windows\System\sVJbJyB.exe
  C:\Windows\System\sVJbJyB.exe
  2⤵
  PID:4428
- C:\Windows\System\KSPJYDs.exe
  C:\Windows\System\KSPJYDs.exe
  2⤵
  PID:4752
- C:\Windows\System\rVekFVJ.exe
  C:\Windows\System\rVekFVJ.exe
  2⤵
  PID:4716
- C:\Windows\System\xQsOdJA.exe
  C:\Windows\System\xQsOdJA.exe
  2⤵
  PID:4572
- C:\Windows\System\RJeWHfH.exe
  C:\Windows\System\RJeWHfH.exe
  2⤵
  PID:4920
- C:\Windows\System\MQOtOSL.exe
  C:\Windows\System\MQOtOSL.exe
  2⤵
  PID:2200
- C:\Windows\System\MuElZiZ.exe
  C:\Windows\System\MuElZiZ.exe
  2⤵
  PID:4940
- C:\Windows\System\butLMgt.exe
  C:\Windows\System\butLMgt.exe
  2⤵
  PID:5136
- C:\Windows\System\kCwbgas.exe
  C:\Windows\System\kCwbgas.exe
  2⤵
  PID:5156
- C:\Windows\System\feNdCNk.exe
  C:\Windows\System\feNdCNk.exe
  2⤵
  PID:5172
- C:\Windows\System\CnBjnqr.exe
  C:\Windows\System\CnBjnqr.exe
  2⤵
  PID:5188
- C:\Windows\System\zvSCNEJ.exe
  C:\Windows\System\zvSCNEJ.exe
  2⤵
  PID:5208
- C:\Windows\System\vvbyMMj.exe
  C:\Windows\System\vvbyMMj.exe
  2⤵
  PID:5224
- C:\Windows\System\BbCDMbn.exe
  C:\Windows\System\BbCDMbn.exe
  2⤵
  PID:5240
- C:\Windows\System\kHzNWxZ.exe
  C:\Windows\System\kHzNWxZ.exe
  2⤵
  PID:5256
- C:\Windows\System\vmXsCVk.exe
  C:\Windows\System\vmXsCVk.exe
  2⤵
  PID:5336
- C:\Windows\System\DWoXRmz.exe
  C:\Windows\System\DWoXRmz.exe
  2⤵
  PID:5356
- C:\Windows\System\ySrOqJq.exe
  C:\Windows\System\ySrOqJq.exe
  2⤵
  PID:5376
- C:\Windows\System\jXhRTCX.exe
  C:\Windows\System\jXhRTCX.exe
  2⤵
  PID:5392
- C:\Windows\System\zUaJFHN.exe
  C:\Windows\System\zUaJFHN.exe
  2⤵
  PID:5412
- C:\Windows\System\gZWRJvT.exe
  C:\Windows\System\gZWRJvT.exe
  2⤵
  PID:5440
- C:\Windows\System\isNgCWY.exe
  C:\Windows\System\isNgCWY.exe
  2⤵
  PID:5460
- C:\Windows\System\OrBCdSB.exe
  C:\Windows\System\OrBCdSB.exe
  2⤵
  PID:5476
- C:\Windows\System\lJboYqR.exe
  C:\Windows\System\lJboYqR.exe
  2⤵
  PID:5492
- C:\Windows\System\fzMUGSO.exe
  C:\Windows\System\fzMUGSO.exe
  2⤵
  PID:5512
- C:\Windows\System\uODSfLX.exe
  C:\Windows\System\uODSfLX.exe
  2⤵
  PID:5528
- C:\Windows\System\dxduANv.exe
  C:\Windows\System\dxduANv.exe
  2⤵
  PID:5544
- C:\Windows\System\mAoTCfN.exe
  C:\Windows\System\mAoTCfN.exe
  2⤵
  PID:5560
- C:\Windows\System\pmWLNuF.exe
  C:\Windows\System\pmWLNuF.exe
  2⤵
  PID:5576
- C:\Windows\System\XxvTcBa.exe
  C:\Windows\System\XxvTcBa.exe
  2⤵
  PID:5596
- C:\Windows\System\nLiRPpJ.exe
  C:\Windows\System\nLiRPpJ.exe
  2⤵
  PID:5612
- C:\Windows\System\QSrdxxa.exe
  C:\Windows\System\QSrdxxa.exe
  2⤵
  PID:5628
- C:\Windows\System\PAXpqlq.exe
  C:\Windows\System\PAXpqlq.exe
  2⤵
  PID:5648
- C:\Windows\System\gdNAaKo.exe
  C:\Windows\System\gdNAaKo.exe
  2⤵
  PID:5664
- C:\Windows\System\ZnXxmaJ.exe
  C:\Windows\System\ZnXxmaJ.exe
  2⤵
  PID:5680
- C:\Windows\System\OUgctMQ.exe
  C:\Windows\System\OUgctMQ.exe
  2⤵
  PID:5696
- C:\Windows\System\NqJQeLA.exe
  C:\Windows\System\NqJQeLA.exe
  2⤵
  PID:5716
- C:\Windows\System\hZygNZx.exe
  C:\Windows\System\hZygNZx.exe
  2⤵
  PID:5732
- C:\Windows\System\WyfjBBX.exe
  C:\Windows\System\WyfjBBX.exe
  2⤵
  PID:5752
- C:\Windows\System\PmuEpVq.exe
  C:\Windows\System\PmuEpVq.exe
  2⤵
  PID:5768
- C:\Windows\System\HiypQPR.exe
  C:\Windows\System\HiypQPR.exe
  2⤵
  PID:5784
- C:\Windows\System\HnzsLiI.exe
  C:\Windows\System\HnzsLiI.exe
  2⤵
  PID:5868
- C:\Windows\System\ZNzBamO.exe
  C:\Windows\System\ZNzBamO.exe
  2⤵
  PID:5884
- C:\Windows\System\XYRsfAz.exe
  C:\Windows\System\XYRsfAz.exe
  2⤵
  PID:5900
- C:\Windows\System\kgFqxSe.exe
  C:\Windows\System\kgFqxSe.exe
  2⤵
  PID:5916
- C:\Windows\System\Qpnjocm.exe
  C:\Windows\System\Qpnjocm.exe
  2⤵
  PID:5932
- C:\Windows\System\GbbkJnY.exe
  C:\Windows\System\GbbkJnY.exe
  2⤵
  PID:5948
- C:\Windows\System\fTwFeBC.exe
  C:\Windows\System\fTwFeBC.exe
  2⤵
  PID:5968
- C:\Windows\System\yavibXh.exe
  C:\Windows\System\yavibXh.exe
  2⤵
  PID:5984
- C:\Windows\System\zlsiJPH.exe
  C:\Windows\System\zlsiJPH.exe
  2⤵
  PID:6004
- C:\Windows\System\GOdBiRd.exe
  C:\Windows\System\GOdBiRd.exe
  2⤵
  PID:6040
- C:\Windows\System\WjxiEOO.exe
  C:\Windows\System\WjxiEOO.exe
  2⤵
  PID:6056
- C:\Windows\System\vRyUUWd.exe
  C:\Windows\System\vRyUUWd.exe
  2⤵
  PID:6072
- C:\Windows\System\YBpGGxe.exe
  C:\Windows\System\YBpGGxe.exe
  2⤵
  PID:6092
- C:\Windows\System\YvwxPRL.exe
  C:\Windows\System\YvwxPRL.exe
  2⤵
  PID:6108
- C:\Windows\System\vommUHq.exe
  C:\Windows\System\vommUHq.exe
  2⤵
  PID:6124
- C:\Windows\System\cWXlpjg.exe
  C:\Windows\System\cWXlpjg.exe
  2⤵
  PID:6140
- C:\Windows\System\zMPhODR.exe
  C:\Windows\System\zMPhODR.exe
  2⤵
  PID:4288
- C:\Windows\System\JralQMb.exe
  C:\Windows\System\JralQMb.exe
  2⤵
  PID:4620
- C:\Windows\System\gGIublE.exe
  C:\Windows\System\gGIublE.exe
  2⤵
  PID:5232
- C:\Windows\System\gTQFdcm.exe
  C:\Windows\System\gTQFdcm.exe
  2⤵
  PID:5200
- C:\Windows\System\FASvYDy.exe
  C:\Windows\System\FASvYDy.exe
  2⤵
  PID:3808
- C:\Windows\System\LKjfJTN.exe
  C:\Windows\System\LKjfJTN.exe
  2⤵
  PID:4440
- C:\Windows\System\naqbMJd.exe
  C:\Windows\System\naqbMJd.exe
  2⤵
  PID:4668
- C:\Windows\System\wFoNUwF.exe
  C:\Windows\System\wFoNUwF.exe
  2⤵
  PID:4536
- C:\Windows\System\bImyPVN.exe
  C:\Windows\System\bImyPVN.exe
  2⤵
  PID:4704
- C:\Windows\System\vPhgWGM.exe
  C:\Windows\System\vPhgWGM.exe
  2⤵
  PID:3136
- C:\Windows\System\JhIHeZI.exe
  C:\Windows\System\JhIHeZI.exe
  2⤵
  PID:4444
- C:\Windows\System\kyuaybE.exe
  C:\Windows\System\kyuaybE.exe
  2⤵
  PID:4828
- C:\Windows\System\fajPwxv.exe
  C:\Windows\System\fajPwxv.exe
  2⤵
  PID:2232
- C:\Windows\System\npMUDbH.exe
  C:\Windows\System\npMUDbH.exe
  2⤵
  PID:5180
- C:\Windows\System\LPBqVdB.exe
  C:\Windows\System\LPBqVdB.exe
  2⤵
  PID:5220
- C:\Windows\System\aRkHTYN.exe
  C:\Windows\System\aRkHTYN.exe
  2⤵
  PID:5272
- C:\Windows\System\RXWjddm.exe
  C:\Windows\System\RXWjddm.exe
  2⤵
  PID:5288
- C:\Windows\System\LRCwqDa.exe
  C:\Windows\System\LRCwqDa.exe
  2⤵
  PID:5332
- C:\Windows\System\xKCDwCB.exe
  C:\Windows\System\xKCDwCB.exe
  2⤵
  PID:5400
- C:\Windows\System\JiLXIuz.exe
  C:\Windows\System\JiLXIuz.exe
  2⤵
  PID:5420
- C:\Windows\System\KemIkbN.exe
  C:\Windows\System\KemIkbN.exe
  2⤵
  PID:5428
- C:\Windows\System\LJgJJkz.exe
  C:\Windows\System\LJgJJkz.exe
  2⤵
  PID:5592
- C:\Windows\System\pqJYpsd.exe
  C:\Windows\System\pqJYpsd.exe
  2⤵
  PID:5656
- C:\Windows\System\eansCdC.exe
  C:\Windows\System\eansCdC.exe
  2⤵
  PID:5488
- C:\Windows\System\hVhnvkf.exe
  C:\Windows\System\hVhnvkf.exe
  2⤵
  PID:5456
- C:\Windows\System\zmIaORx.exe
  C:\Windows\System\zmIaORx.exe
  2⤵
  PID:5432
- C:\Windows\System\JajfFhJ.exe
  C:\Windows\System\JajfFhJ.exe
  2⤵
  PID:5800
- C:\Windows\System\zwjOyEy.exe
  C:\Windows\System\zwjOyEy.exe
  2⤵
  PID:5816
- C:\Windows\System\oAEGoTh.exe
  C:\Windows\System\oAEGoTh.exe
  2⤵
  PID:5740
- C:\Windows\System\fIjvwZQ.exe
  C:\Windows\System\fIjvwZQ.exe
  2⤵
  PID:5672
- C:\Windows\System\pEzweVI.exe
  C:\Windows\System\pEzweVI.exe
  2⤵
  PID:5608
- C:\Windows\System\TjJrgXq.exe
  C:\Windows\System\TjJrgXq.exe
  2⤵
  PID:5540
- C:\Windows\System\JlMhEmL.exe
  C:\Windows\System\JlMhEmL.exe
  2⤵
  PID:5828
- C:\Windows\System\JwgKHfY.exe
  C:\Windows\System\JwgKHfY.exe
  2⤵
  PID:5504
- C:\Windows\System\UogvMrP.exe
  C:\Windows\System\UogvMrP.exe
  2⤵
  PID:5836
- C:\Windows\System\pjnatys.exe
  C:\Windows\System\pjnatys.exe
  2⤵
  PID:5852
- C:\Windows\System\PrWniRW.exe
  C:\Windows\System\PrWniRW.exe
  2⤵
  PID:5892
- C:\Windows\System\rFtMBxH.exe
  C:\Windows\System\rFtMBxH.exe
  2⤵
  PID:5956
- C:\Windows\System\suDkStx.exe
  C:\Windows\System\suDkStx.exe
  2⤵
  PID:5996
- C:\Windows\System\cdcDwzC.exe
  C:\Windows\System\cdcDwzC.exe
  2⤵
  PID:5912
- C:\Windows\System\IHIjJYe.exe
  C:\Windows\System\IHIjJYe.exe
  2⤵
  PID:6116
- C:\Windows\System\WdwFJAG.exe
  C:\Windows\System\WdwFJAG.exe
  2⤵
  PID:6016
- C:\Windows\System\ilNwLcN.exe
  C:\Windows\System\ilNwLcN.exe
  2⤵
  PID:5880
- C:\Windows\System\pgnUAkQ.exe
  C:\Windows\System\pgnUAkQ.exe
  2⤵
  PID:3228
- C:\Windows\System\vJyWnOY.exe
  C:\Windows\System\vJyWnOY.exe
  2⤵
  PID:3664
- C:\Windows\System\oTlHesp.exe
  C:\Windows\System\oTlHesp.exe
  2⤵
  PID:4956
- C:\Windows\System\EoEVbAE.exe
  C:\Windows\System\EoEVbAE.exe
  2⤵
  PID:5976
- C:\Windows\System\RdinwGn.exe
  C:\Windows\System\RdinwGn.exe
  2⤵
  PID:6064
- C:\Windows\System\vElKURk.exe
  C:\Windows\System\vElKURk.exe
  2⤵
  PID:6136
- C:\Windows\System\FXkXVHe.exe
  C:\Windows\System\FXkXVHe.exe
  2⤵
  PID:5196
- C:\Windows\System\bWIGlqO.exe
  C:\Windows\System\bWIGlqO.exe
  2⤵
  PID:4264
- C:\Windows\System\WlJtOIe.exe
  C:\Windows\System\WlJtOIe.exe
  2⤵
  PID:2160
- C:\Windows\System\lRvCZRh.exe
  C:\Windows\System\lRvCZRh.exe
  2⤵
  PID:5268
- C:\Windows\System\GIcaZEc.exe
  C:\Windows\System\GIcaZEc.exe
  2⤵
  PID:1080
- C:\Windows\System\MBGTqVA.exe
  C:\Windows\System\MBGTqVA.exe
  2⤵
  PID:5284
- C:\Windows\System\MihPkNc.exe
  C:\Windows\System\MihPkNc.exe
  2⤵
  PID:5308
- C:\Windows\System\ODFseOu.exe
  C:\Windows\System\ODFseOu.exe
  2⤵
  PID:5328
- C:\Windows\System\mGCNbRd.exe
  C:\Windows\System\mGCNbRd.exe
  2⤵
  PID:5348
- C:\Windows\System\nxDudYj.exe
  C:\Windows\System\nxDudYj.exe
  2⤵
  PID:5624
- C:\Windows\System\zFMhzWK.exe
  C:\Windows\System\zFMhzWK.exe
  2⤵
  PID:5792
- C:\Windows\System\AHzVMFC.exe
  C:\Windows\System\AHzVMFC.exe
  2⤵
  PID:5748
- C:\Windows\System\AiEeIfR.exe
  C:\Windows\System\AiEeIfR.exe
  2⤵
  PID:5640
- C:\Windows\System\QcLVMHn.exe
  C:\Windows\System\QcLVMHn.exe
  2⤵
  PID:5448
- C:\Windows\System\keAfYEV.exe
  C:\Windows\System\keAfYEV.exe
  2⤵
  PID:5808
- C:\Windows\System\TvVTtbM.exe
  C:\Windows\System\TvVTtbM.exe
  2⤵
  PID:5704
- C:\Windows\System\zFpeICB.exe
  C:\Windows\System\zFpeICB.exe
  2⤵
  PID:5832
- C:\Windows\System\ckffgvR.exe
  C:\Windows\System\ckffgvR.exe
  2⤵
  PID:5992
- C:\Windows\System\KrtJsgu.exe
  C:\Windows\System\KrtJsgu.exe
  2⤵
  PID:5924
- C:\Windows\System\lSGdjTM.exe
  C:\Windows\System\lSGdjTM.exe
  2⤵
  PID:3196
- C:\Windows\System\PQSlIUs.exe
  C:\Windows\System\PQSlIUs.exe
  2⤵
  PID:3132
- C:\Windows\System\PBuosRt.exe
  C:\Windows\System\PBuosRt.exe
  2⤵
  PID:4172
- C:\Windows\System\QYQshZB.exe
  C:\Windows\System\QYQshZB.exe
  2⤵
  PID:6080
- C:\Windows\System\SZPqrjv.exe
  C:\Windows\System\SZPqrjv.exe
  2⤵
  PID:6104
- C:\Windows\System\eeUDjyA.exe
  C:\Windows\System\eeUDjyA.exe
  2⤵
  PID:6132
- C:\Windows\System\ByFVVGX.exe
  C:\Windows\System\ByFVVGX.exe
  2⤵
  PID:5152
- C:\Windows\System\VpWlSHx.exe
  C:\Windows\System\VpWlSHx.exe
  2⤵
  PID:5216
- C:\Windows\System\TIBaxNJ.exe
  C:\Windows\System\TIBaxNJ.exe
  2⤵
  PID:5168
- C:\Windows\System\nvdwjpE.exe
  C:\Windows\System\nvdwjpE.exe
  2⤵
  PID:5320
- C:\Windows\System\JuHHZKX.exe
  C:\Windows\System\JuHHZKX.exe
  2⤵
  PID:5760
- C:\Windows\System\dAJmfxc.exe
  C:\Windows\System\dAJmfxc.exe
  2⤵
  PID:5484
- C:\Windows\System\iqGZopt.exe
  C:\Windows\System\iqGZopt.exe
  2⤵
  PID:5368
- C:\Windows\System\qltzdZn.exe
  C:\Windows\System\qltzdZn.exe
  2⤵
  PID:3728
- C:\Windows\System\jGjZubT.exe
  C:\Windows\System\jGjZubT.exe
  2⤵
  PID:5908
- C:\Windows\System\eWfbJHE.exe
  C:\Windows\System\eWfbJHE.exe
  2⤵
  PID:5844
- C:\Windows\System\OCDGnWq.exe
  C:\Windows\System\OCDGnWq.exe
  2⤵
  PID:4284
- C:\Windows\System\GFuVZVt.exe
  C:\Windows\System\GFuVZVt.exe
  2⤵
  PID:4412
- C:\Windows\System\WiWaZvY.exe
  C:\Windows\System\WiWaZvY.exe
  2⤵
  PID:5300
- C:\Windows\System\WgEutON.exe
  C:\Windows\System\WgEutON.exe
  2⤵
  PID:4104
- C:\Windows\System\uGRKIra.exe
  C:\Windows\System\uGRKIra.exe
  2⤵
  PID:5620
- C:\Windows\System\JSbRpbX.exe
  C:\Windows\System\JSbRpbX.exe
  2⤵
  PID:5744
- C:\Windows\System\eXmoTTg.exe
  C:\Windows\System\eXmoTTg.exe
  2⤵
  PID:5408
- C:\Windows\System\sYWFIqu.exe
  C:\Windows\System\sYWFIqu.exe
  2⤵
  PID:5688
- C:\Windows\System\iMpalKw.exe
  C:\Windows\System\iMpalKw.exe
  2⤵
  PID:5572
- C:\Windows\System\SFGwkKi.exe
  C:\Windows\System\SFGwkKi.exe
  2⤵
  PID:5236
- C:\Windows\System\OkxxELb.exe
  C:\Windows\System\OkxxELb.exe
  2⤵
  PID:5568
- C:\Windows\System\rDXPEkF.exe
  C:\Windows\System\rDXPEkF.exe
  2⤵
  PID:5436
- C:\Windows\System\BsTfpEA.exe
  C:\Windows\System\BsTfpEA.exe
  2⤵
  PID:5552
- C:\Windows\System\XlLBgmi.exe
  C:\Windows\System\XlLBgmi.exe
  2⤵
  PID:5964
- C:\Windows\System\azBUlTV.exe
  C:\Windows\System\azBUlTV.exe
  2⤵
  PID:5472
- C:\Windows\System\qGUowvU.exe
  C:\Windows\System\qGUowvU.exe
  2⤵
  PID:5944
- C:\Windows\System\PivWKKQ.exe
  C:\Windows\System\PivWKKQ.exe
  2⤵
  PID:6156
- C:\Windows\System\rOYgBgI.exe
  C:\Windows\System\rOYgBgI.exe
  2⤵
  PID:6172
- C:\Windows\System\DDbDqJF.exe
  C:\Windows\System\DDbDqJF.exe
  2⤵
  PID:6188
- C:\Windows\System\eZvuvaV.exe
  C:\Windows\System\eZvuvaV.exe
  2⤵
  PID:6204
- C:\Windows\System\SidQFuI.exe
  C:\Windows\System\SidQFuI.exe
  2⤵
  PID:6220
- C:\Windows\System\uqsbAul.exe
  C:\Windows\System\uqsbAul.exe
  2⤵
  PID:6236
- C:\Windows\System\CFvATfy.exe
  C:\Windows\System\CFvATfy.exe
  2⤵
  PID:6252
- C:\Windows\System\fDEudGo.exe
  C:\Windows\System\fDEudGo.exe
  2⤵
  PID:6268
- C:\Windows\System\xMDFWZv.exe
  C:\Windows\System\xMDFWZv.exe
  2⤵
  PID:6284
- C:\Windows\System\KLAwVmZ.exe
  C:\Windows\System\KLAwVmZ.exe
  2⤵
  PID:6304
- C:\Windows\System\vHoSWCw.exe
  C:\Windows\System\vHoSWCw.exe
  2⤵
  PID:6320
- C:\Windows\System\MTsJKvE.exe
  C:\Windows\System\MTsJKvE.exe
  2⤵
  PID:6336
- C:\Windows\System\NQLHxDi.exe
  C:\Windows\System\NQLHxDi.exe
  2⤵
  PID:6352
- C:\Windows\System\TWHkYUX.exe
  C:\Windows\System\TWHkYUX.exe
  2⤵
  PID:6372
- C:\Windows\System\froYytc.exe
  C:\Windows\System\froYytc.exe
  2⤵
  PID:6388
- C:\Windows\System\OwkOmpz.exe
  C:\Windows\System\OwkOmpz.exe
  2⤵
  PID:6408
- C:\Windows\System\awNOZsg.exe
  C:\Windows\System\awNOZsg.exe
  2⤵
  PID:6424
- C:\Windows\System\pdvxaFP.exe
  C:\Windows\System\pdvxaFP.exe
  2⤵
  PID:6440
- C:\Windows\System\DtqLNDL.exe
  C:\Windows\System\DtqLNDL.exe
  2⤵
  PID:6456
- C:\Windows\System\qzcNqtl.exe
  C:\Windows\System\qzcNqtl.exe
  2⤵
  PID:6472
- C:\Windows\System\jHFVvZl.exe
  C:\Windows\System\jHFVvZl.exe
  2⤵
  PID:6488
- C:\Windows\System\pDqUgtu.exe
  C:\Windows\System\pDqUgtu.exe
  2⤵
  PID:6504
- C:\Windows\System\BSWCMbH.exe
  C:\Windows\System\BSWCMbH.exe
  2⤵
  PID:6520
- C:\Windows\System\ZuZnvhp.exe
  C:\Windows\System\ZuZnvhp.exe
  2⤵
  PID:6536
- C:\Windows\System\UsuJwup.exe
  C:\Windows\System\UsuJwup.exe
  2⤵
  PID:6552
- C:\Windows\System\ckaTcHe.exe
  C:\Windows\System\ckaTcHe.exe
  2⤵
  PID:6568
- C:\Windows\System\DpjaRYp.exe
  C:\Windows\System\DpjaRYp.exe
  2⤵
  PID:6584
- C:\Windows\System\QBrBRTe.exe
  C:\Windows\System\QBrBRTe.exe
  2⤵
  PID:6600
- C:\Windows\System\oAeZUbI.exe
  C:\Windows\System\oAeZUbI.exe
  2⤵
  PID:6620
- C:\Windows\System\pwzmAVf.exe
  C:\Windows\System\pwzmAVf.exe
  2⤵
  PID:6636
- C:\Windows\System\UNjoXfO.exe
  C:\Windows\System\UNjoXfO.exe
  2⤵
  PID:6652
- C:\Windows\System\fkBUEom.exe
  C:\Windows\System\fkBUEom.exe
  2⤵
  PID:6668
- C:\Windows\System\tdvLESc.exe
  C:\Windows\System\tdvLESc.exe
  2⤵
  PID:6684
- C:\Windows\System\blCrlwf.exe
  C:\Windows\System\blCrlwf.exe
  2⤵
  PID:6704
- C:\Windows\System\BZiMBQt.exe
  C:\Windows\System\BZiMBQt.exe
  2⤵
  PID:6724
- C:\Windows\System\USlvPzv.exe
  C:\Windows\System\USlvPzv.exe
  2⤵
  PID:6744
- C:\Windows\System\DvAxvNp.exe
  C:\Windows\System\DvAxvNp.exe
  2⤵
  PID:6760
- C:\Windows\System\qTWIgSx.exe
  C:\Windows\System\qTWIgSx.exe
  2⤵
  PID:6776
- C:\Windows\System\CibrSZW.exe
  C:\Windows\System\CibrSZW.exe
  2⤵
  PID:6804
- C:\Windows\System\UCZfGmk.exe
  C:\Windows\System\UCZfGmk.exe
  2⤵
  PID:6840
- C:\Windows\System\HhFBjnr.exe
  C:\Windows\System\HhFBjnr.exe
  2⤵
  PID:6856
- C:\Windows\System\bCLltKk.exe
  C:\Windows\System\bCLltKk.exe
  2⤵
  PID:6872
- C:\Windows\System\NbhuFyV.exe
  C:\Windows\System\NbhuFyV.exe
  2⤵
  PID:6892
- C:\Windows\System\wqfnSDr.exe
  C:\Windows\System\wqfnSDr.exe
  2⤵
  PID:6912
- C:\Windows\System\iOypsxN.exe
  C:\Windows\System\iOypsxN.exe
  2⤵
  PID:6928
- C:\Windows\System\cLIZYek.exe
  C:\Windows\System\cLIZYek.exe
  2⤵
  PID:6952
- C:\Windows\System\tlRICVE.exe
  C:\Windows\System\tlRICVE.exe
  2⤵
  PID:6968
- C:\Windows\System\lopCtIR.exe
  C:\Windows\System\lopCtIR.exe
  2⤵
  PID:6984
- C:\Windows\System\jlhYDVC.exe
  C:\Windows\System\jlhYDVC.exe
  2⤵
  PID:7000
- C:\Windows\System\aqOVcQh.exe
  C:\Windows\System\aqOVcQh.exe
  2⤵
  PID:7024
- C:\Windows\System\gxywkis.exe
  C:\Windows\System\gxywkis.exe
  2⤵
  PID:7052
- C:\Windows\System\ybZEmxq.exe
  C:\Windows\System\ybZEmxq.exe
  2⤵
  PID:7072
- C:\Windows\System\aNNcRZS.exe
  C:\Windows\System\aNNcRZS.exe
  2⤵
  PID:7092
- C:\Windows\System\dlwHUsX.exe
  C:\Windows\System\dlwHUsX.exe
  2⤵
  PID:7108
- C:\Windows\System\nBWrIAC.exe
  C:\Windows\System\nBWrIAC.exe
  2⤵
  PID:7128
- C:\Windows\System\CKZjmvv.exe
  C:\Windows\System\CKZjmvv.exe
  2⤵
  PID:7144
- C:\Windows\System\sjTWEuD.exe
  C:\Windows\System\sjTWEuD.exe
  2⤵
  PID:7160
- C:\Windows\System\kVCSfVC.exe
  C:\Windows\System\kVCSfVC.exe
  2⤵
  PID:6312
- C:\Windows\System\GCzueyY.exe
  C:\Windows\System\GCzueyY.exe
  2⤵
  PID:6380
- C:\Windows\System\feiAnsI.exe
  C:\Windows\System\feiAnsI.exe
  2⤵
  PID:6328
- C:\Windows\System\camEOFH.exe
  C:\Windows\System\camEOFH.exe
  2⤵
  PID:6396
- C:\Windows\System\fLxqoTJ.exe
  C:\Windows\System\fLxqoTJ.exe
  2⤵
  PID:6404
- C:\Windows\System\YCQWLWR.exe
  C:\Windows\System\YCQWLWR.exe
  2⤵
  PID:6448
- C:\Windows\System\xiXsweh.exe
  C:\Windows\System\xiXsweh.exe
  2⤵
  PID:6512
- C:\Windows\System\mHoXgma.exe
  C:\Windows\System\mHoXgma.exe
  2⤵
  PID:6516
- C:\Windows\System\gQBpzUN.exe
  C:\Windows\System\gQBpzUN.exe
  2⤵
  PID:6608
- C:\Windows\System\sWaYTwu.exe
  C:\Windows\System\sWaYTwu.exe
  2⤵
  PID:6564
- C:\Windows\System\keDaBjH.exe
  C:\Windows\System\keDaBjH.exe
  2⤵
  PID:6644
- C:\Windows\System\WreoZbr.exe
  C:\Windows\System\WreoZbr.exe
  2⤵
  PID:6596
- C:\Windows\System\njAnrgY.exe
  C:\Windows\System\njAnrgY.exe
  2⤵
  PID:6756
- C:\Windows\System\jNycNye.exe
  C:\Windows\System\jNycNye.exe
  2⤵
  PID:6732
- C:\Windows\System\EtZTbXG.exe
  C:\Windows\System\EtZTbXG.exe
  2⤵
  PID:6696
- C:\Windows\System\bfdMguo.exe
  C:\Windows\System\bfdMguo.exe
  2⤵
  PID:6772
- C:\Windows\System\QThRWpV.exe
  C:\Windows\System\QThRWpV.exe
  2⤵
  PID:6888
- C:\Windows\System\Upblosl.exe
  C:\Windows\System\Upblosl.exe
  2⤵
  PID:6960
- C:\Windows\System\DBesCCc.exe
  C:\Windows\System\DBesCCc.exe
  2⤵
  PID:6996
- C:\Windows\System\ttTLXgV.exe
  C:\Windows\System\ttTLXgV.exe
  2⤵
  PID:6824
- C:\Windows\System\UWJrvtJ.exe
  C:\Windows\System\UWJrvtJ.exe
  2⤵
  PID:6940
- C:\Windows\System\QkcTdWl.exe
  C:\Windows\System\QkcTdWl.exe
  2⤵
  PID:7008
- C:\Windows\System\UteqnJS.exe
  C:\Windows\System\UteqnJS.exe
  2⤵
  PID:6904
- C:\Windows\System\PnYXmdF.exe
  C:\Windows\System\PnYXmdF.exe
  2⤵
  PID:7032
- C:\Windows\System\oBjXepF.exe
  C:\Windows\System\oBjXepF.exe
  2⤵
  PID:7040
- C:\Windows\System\YaCxJKH.exe
  C:\Windows\System\YaCxJKH.exe
  2⤵
  PID:7012
- C:\Windows\System\ATkkqiy.exe
  C:\Windows\System\ATkkqiy.exe
  2⤵
  PID:7064
- C:\Windows\System\JYVssjS.exe
  C:\Windows\System\JYVssjS.exe
  2⤵
  PID:7152
- C:\Windows\System\DaNdNUU.exe
  C:\Windows\System\DaNdNUU.exe
  2⤵
  PID:5708
- C:\Windows\System\WPqnGJf.exe
  C:\Windows\System\WPqnGJf.exe
  2⤵
  PID:7140
- C:\Windows\System\FdCpzIR.exe
  C:\Windows\System\FdCpzIR.exe
  2⤵
  PID:6184
- C:\Windows\System\QtjtqFH.exe
  C:\Windows\System\QtjtqFH.exe
  2⤵
  PID:6036
- C:\Windows\System\QCUaJoe.exe
  C:\Windows\System\QCUaJoe.exe
  2⤵
  PID:5824
- C:\Windows\System\EIqRxYQ.exe
  C:\Windows\System\EIqRxYQ.exe
  2⤵
  PID:6168
- C:\Windows\System\zcLkVzm.exe
  C:\Windows\System\zcLkVzm.exe
  2⤵
  PID:6228
- C:\Windows\System\weLZLjh.exe
  C:\Windows\System\weLZLjh.exe
  2⤵
  PID:6532
- C:\Windows\System\QlExUKy.exe
  C:\Windows\System\QlExUKy.exe
  2⤵
  PID:6480
- C:\Windows\System\gyIiZEt.exe
  C:\Windows\System\gyIiZEt.exe
  2⤵
  PID:6736
- C:\Windows\System\NIrqPkU.exe
  C:\Windows\System\NIrqPkU.exe
  2⤵
  PID:6792
- C:\Windows\System\MKFWzmD.exe
  C:\Windows\System\MKFWzmD.exe
  2⤵
  PID:6980
- C:\Windows\System\UenGAwt.exe
  C:\Windows\System\UenGAwt.exe
  2⤵
  PID:7048
- C:\Windows\System\NzAWukb.exe
  C:\Windows\System\NzAWukb.exe
  2⤵
  PID:6784
- C:\Windows\System\UgrnEGV.exe
  C:\Windows\System\UgrnEGV.exe
  2⤵
  PID:6692
- C:\Windows\System\yvhiLKd.exe
  C:\Windows\System\yvhiLKd.exe
  2⤵
  PID:6880
- C:\Windows\System\ZubIdBr.exe
  C:\Windows\System\ZubIdBr.exe
  2⤵
  PID:7084
- C:\Windows\System\eWLWMWr.exe
  C:\Windows\System\eWLWMWr.exe
  2⤵
  PID:7100
- C:\Windows\System\aIvrCtw.exe
  C:\Windows\System\aIvrCtw.exe
  2⤵
  PID:5316
- C:\Windows\System\zeKUUrY.exe
  C:\Windows\System\zeKUUrY.exe
  2⤵
  PID:1544
- C:\Windows\System\IjuHRrv.exe
  C:\Windows\System\IjuHRrv.exe
  2⤵
  PID:6280
- C:\Windows\System\UBeNaCp.exe
  C:\Windows\System\UBeNaCp.exe
  2⤵
  PID:6384
- C:\Windows\System\iQuEPmE.exe
  C:\Windows\System\iQuEPmE.exe
  2⤵
  PID:6468
- C:\Windows\System\vIsUzka.exe
  C:\Windows\System\vIsUzka.exe
  2⤵
  PID:6296
- C:\Windows\System\wXqhEer.exe
  C:\Windows\System\wXqhEer.exe
  2⤵
  PID:6616
- C:\Windows\System\LMdzQoB.exe
  C:\Windows\System\LMdzQoB.exe
  2⤵
  PID:6660
- C:\Windows\System\WQbPiRY.exe
  C:\Windows\System\WQbPiRY.exe
  2⤵
  PID:7124
- C:\Windows\System\EnpfiLV.exe
  C:\Windows\System\EnpfiLV.exe
  2⤵
  PID:6836
- C:\Windows\System\ZuurxAN.exe
  C:\Windows\System\ZuurxAN.exe
  2⤵
  PID:6344
- C:\Windows\System\kNlMgcB.exe
  C:\Windows\System\kNlMgcB.exe
  2⤵
  PID:6680
- C:\Windows\System\fZsbexm.exe
  C:\Windows\System\fZsbexm.exe
  2⤵
  PID:6484
- C:\Windows\System\IFApCXI.exe
  C:\Windows\System\IFApCXI.exe
  2⤵
  PID:6276
- C:\Windows\System\bRhXfOj.exe
  C:\Windows\System\bRhXfOj.exe
  2⤵
  PID:7060
- C:\Windows\System\JmvuSOr.exe
  C:\Windows\System\JmvuSOr.exe
  2⤵
  PID:6816
- C:\Windows\System\nmHYgYy.exe
  C:\Windows\System\nmHYgYy.exe
  2⤵
  PID:6924
- C:\Windows\System\uySXmcF.exe
  C:\Windows\System\uySXmcF.exe
  2⤵
  PID:7136
- C:\Windows\System\uwMdgVa.exe
  C:\Windows\System\uwMdgVa.exe
  2⤵
  PID:6548
- C:\Windows\System\cSMphHy.exe
  C:\Windows\System\cSMphHy.exe
  2⤵
  PID:5088
- C:\Windows\System\yAaRvVd.exe
  C:\Windows\System\yAaRvVd.exe
  2⤵
  PID:7172
- C:\Windows\System\QdsXITb.exe
  C:\Windows\System\QdsXITb.exe
  2⤵
  PID:7192
- C:\Windows\System\WXdqEJR.exe
  C:\Windows\System\WXdqEJR.exe
  2⤵
  PID:7208
- C:\Windows\System\rZscEug.exe
  C:\Windows\System\rZscEug.exe
  2⤵
  PID:7228
- C:\Windows\System\LQyLvKb.exe
  C:\Windows\System\LQyLvKb.exe
  2⤵
  PID:7244
- C:\Windows\System\uNLocKL.exe
  C:\Windows\System\uNLocKL.exe
  2⤵
  PID:7260
- C:\Windows\System\cRqeLpQ.exe
  C:\Windows\System\cRqeLpQ.exe
  2⤵
  PID:7276
- C:\Windows\System\ffcbYXU.exe
  C:\Windows\System\ffcbYXU.exe
  2⤵
  PID:7292
- C:\Windows\System\LtPGpZk.exe
  C:\Windows\System\LtPGpZk.exe
  2⤵
  PID:7308
- C:\Windows\System\EuRaZoE.exe
  C:\Windows\System\EuRaZoE.exe
  2⤵
  PID:7324
- C:\Windows\System\LHOmitd.exe
  C:\Windows\System\LHOmitd.exe
  2⤵
  PID:7340
- C:\Windows\System\LBmppgR.exe
  C:\Windows\System\LBmppgR.exe
  2⤵
  PID:7356
- C:\Windows\System\ScpjBDQ.exe
  C:\Windows\System\ScpjBDQ.exe
  2⤵
  PID:7372
- C:\Windows\System\BWYAMIJ.exe
  C:\Windows\System\BWYAMIJ.exe
  2⤵
  PID:7388
- C:\Windows\System\KniilpT.exe
  C:\Windows\System\KniilpT.exe
  2⤵
  PID:7404
- C:\Windows\System\QAWyDOD.exe
  C:\Windows\System\QAWyDOD.exe
  2⤵
  PID:7420
- C:\Windows\System\enmbMLw.exe
  C:\Windows\System\enmbMLw.exe
  2⤵
  PID:7436
- C:\Windows\System\zvPlMGh.exe
  C:\Windows\System\zvPlMGh.exe
  2⤵
  PID:7452
- C:\Windows\System\TBzsmhc.exe
  C:\Windows\System\TBzsmhc.exe
  2⤵
  PID:7468
- C:\Windows\System\ooabysh.exe
  C:\Windows\System\ooabysh.exe
  2⤵
  PID:7484
- C:\Windows\System\IIwBzqB.exe
  C:\Windows\System\IIwBzqB.exe
  2⤵
  PID:7504
- C:\Windows\System\kuQEWjy.exe
  C:\Windows\System\kuQEWjy.exe
  2⤵
  PID:7524
- C:\Windows\System\AZgbYyW.exe
  C:\Windows\System\AZgbYyW.exe
  2⤵
  PID:7540
- C:\Windows\System\AFoCtkx.exe
  C:\Windows\System\AFoCtkx.exe
  2⤵
  PID:7556
- C:\Windows\System\GLdXhBa.exe
  C:\Windows\System\GLdXhBa.exe
  2⤵
  PID:7572
- C:\Windows\System\aXrShJM.exe
  C:\Windows\System\aXrShJM.exe
  2⤵
  PID:7588
- C:\Windows\System\qzwdioL.exe
  C:\Windows\System\qzwdioL.exe
  2⤵
  PID:7608
- C:\Windows\System\YIHIRMu.exe
  C:\Windows\System\YIHIRMu.exe
  2⤵
  PID:7624
- C:\Windows\System\DJpJbCS.exe
  C:\Windows\System\DJpJbCS.exe
  2⤵
  PID:7640
- C:\Windows\System\oKUGaqU.exe
  C:\Windows\System\oKUGaqU.exe
  2⤵
  PID:7656
- C:\Windows\System\tEMcRHq.exe
  C:\Windows\System\tEMcRHq.exe
  2⤵
  PID:7672
- C:\Windows\System\TEIQuMF.exe
  C:\Windows\System\TEIQuMF.exe
  2⤵
  PID:7692
- C:\Windows\System\vDwMSlx.exe
  C:\Windows\System\vDwMSlx.exe
  2⤵
  PID:7708
- C:\Windows\System\uWPAbmb.exe
  C:\Windows\System\uWPAbmb.exe
  2⤵
  PID:7728
- C:\Windows\System\Bswekwn.exe
  C:\Windows\System\Bswekwn.exe
  2⤵
  PID:7748
- C:\Windows\System\kmKlAfE.exe
  C:\Windows\System\kmKlAfE.exe
  2⤵
  PID:7764
- C:\Windows\System\eAGyvXf.exe
  C:\Windows\System\eAGyvXf.exe
  2⤵
  PID:7780
- C:\Windows\System\AIhRQLm.exe
  C:\Windows\System\AIhRQLm.exe
  2⤵
  PID:7796
- C:\Windows\System\wbmeBjm.exe
  C:\Windows\System\wbmeBjm.exe
  2⤵
  PID:7812
- C:\Windows\System\LGWDKbe.exe
  C:\Windows\System\LGWDKbe.exe
  2⤵
  PID:7828
- C:\Windows\System\kunvwES.exe
  C:\Windows\System\kunvwES.exe
  2⤵
  PID:7844
- C:\Windows\System\MoMeAfy.exe
  C:\Windows\System\MoMeAfy.exe
  2⤵
  PID:7860
- C:\Windows\System\ZmDCKED.exe
  C:\Windows\System\ZmDCKED.exe
  2⤵
  PID:7876
- C:\Windows\System\veUWGwD.exe
  C:\Windows\System\veUWGwD.exe
  2⤵
  PID:7892
- C:\Windows\System\ZQteive.exe
  C:\Windows\System\ZQteive.exe
  2⤵
  PID:7912
- C:\Windows\System\grzATQh.exe
  C:\Windows\System\grzATQh.exe
  2⤵
  PID:7928
- C:\Windows\System\cBKVTHd.exe
  C:\Windows\System\cBKVTHd.exe
  2⤵
  PID:7944
- C:\Windows\System\MJSyqpl.exe
  C:\Windows\System\MJSyqpl.exe
  2⤵
  PID:7960
- C:\Windows\System\VlymOvF.exe
  C:\Windows\System\VlymOvF.exe
  2⤵
  PID:7980
- C:\Windows\System\WnZNGfl.exe
  C:\Windows\System\WnZNGfl.exe
  2⤵
  PID:7996
- C:\Windows\System\NcvwXPv.exe
  C:\Windows\System\NcvwXPv.exe
  2⤵
  PID:8012
- C:\Windows\System\yqhXYSc.exe
  C:\Windows\System\yqhXYSc.exe
  2⤵
  PID:8028
- C:\Windows\System\RBwfHtV.exe
  C:\Windows\System\RBwfHtV.exe
  2⤵
  PID:8044
- C:\Windows\System\pCSeruP.exe
  C:\Windows\System\pCSeruP.exe
  2⤵
  PID:8064
- C:\Windows\System\xJkxnes.exe
  C:\Windows\System\xJkxnes.exe
  2⤵
  PID:8080
- C:\Windows\System\THXGkWX.exe
  C:\Windows\System\THXGkWX.exe
  2⤵
  PID:8096
- C:\Windows\System\bqfjrqq.exe
  C:\Windows\System\bqfjrqq.exe
  2⤵
  PID:8112
- C:\Windows\System\MrydPBS.exe
  C:\Windows\System\MrydPBS.exe
  2⤵
  PID:8128
- C:\Windows\System\zehmaqt.exe
  C:\Windows\System\zehmaqt.exe
  2⤵
  PID:8144
- C:\Windows\System\uWgxDWz.exe
  C:\Windows\System\uWgxDWz.exe
  2⤵
  PID:8160
- C:\Windows\System\bnAEqop.exe
  C:\Windows\System\bnAEqop.exe
  2⤵
  PID:8176
- C:\Windows\System\pwaohsy.exe
  C:\Windows\System\pwaohsy.exe
  2⤵
  PID:6964
- C:\Windows\System\EIywDHx.exe
  C:\Windows\System\EIywDHx.exe
  2⤵
  PID:6976
- C:\Windows\System\IjwukVB.exe
  C:\Windows\System\IjwukVB.exe
  2⤵
  PID:7188
- C:\Windows\System\Hfgnibu.exe
  C:\Windows\System\Hfgnibu.exe
  2⤵
  PID:7252
- C:\Windows\System\vaCddkL.exe
  C:\Windows\System\vaCddkL.exe
  2⤵
  PID:6292
- C:\Windows\System\msZBNeW.exe
  C:\Windows\System\msZBNeW.exe
  2⤵
  PID:6216
- C:\Windows\System\xzFPeIf.exe
  C:\Windows\System\xzFPeIf.exe
  2⤵
  PID:6432
- C:\Windows\System\SYXYLtr.exe
  C:\Windows\System\SYXYLtr.exe
  2⤵
  PID:7240
- C:\Windows\System\jWvqvdj.exe
  C:\Windows\System\jWvqvdj.exe
  2⤵
  PID:7272
- C:\Windows\System\NtRkCZP.exe
  C:\Windows\System\NtRkCZP.exe
  2⤵
  PID:7380
- C:\Windows\System\UlRJZeE.exe
  C:\Windows\System\UlRJZeE.exe
  2⤵
  PID:7444
- C:\Windows\System\VNtvXNt.exe
  C:\Windows\System\VNtvXNt.exe
  2⤵
  PID:7364
- C:\Windows\System\RSsEqVF.exe
  C:\Windows\System\RSsEqVF.exe
  2⤵
  PID:7396
- C:\Windows\System\NwUstiP.exe
  C:\Windows\System\NwUstiP.exe
  2⤵
  PID:7512
- C:\Windows\System\gkrzLDv.exe
  C:\Windows\System\gkrzLDv.exe
  2⤵
  PID:7500
- C:\Windows\System\TkzNHwo.exe
  C:\Windows\System\TkzNHwo.exe
  2⤵
  PID:7548
- C:\Windows\System\zpstRwk.exe
  C:\Windows\System\zpstRwk.exe
  2⤵
  PID:7620
- C:\Windows\System\VKlNbQJ.exe
  C:\Windows\System\VKlNbQJ.exe
  2⤵
  PID:7684
- C:\Windows\System\OYUDxMD.exe
  C:\Windows\System\OYUDxMD.exe
  2⤵
  PID:7720
- C:\Windows\System\dcDwcBW.exe
  C:\Windows\System\dcDwcBW.exe
  2⤵
  PID:7756
- C:\Windows\System\Mfilaqq.exe
  C:\Windows\System\Mfilaqq.exe
  2⤵
  PID:7536
- C:\Windows\System\QUcdqqg.exe
  C:\Windows\System\QUcdqqg.exe
  2⤵
  PID:7596
- C:\Windows\System\gAerNso.exe
  C:\Windows\System\gAerNso.exe
  2⤵
  PID:7704
- C:\Windows\System\WYYWMuW.exe
  C:\Windows\System\WYYWMuW.exe
  2⤵
  PID:7776
- C:\Windows\System\VINGAbW.exe
  C:\Windows\System\VINGAbW.exe
  2⤵
  PID:7804
- C:\Windows\System\kMOXENH.exe
  C:\Windows\System\kMOXENH.exe
  2⤵
  PID:7856
- C:\Windows\System\uCeedJD.exe
  C:\Windows\System\uCeedJD.exe
  2⤵
  PID:7900
- C:\Windows\System\RKnnCpp.exe
  C:\Windows\System\RKnnCpp.exe
  2⤵
  PID:7956
- C:\Windows\System\dYlHnfr.exe
  C:\Windows\System\dYlHnfr.exe
  2⤵
  PID:7904
- C:\Windows\System\XmFLXqs.exe
  C:\Windows\System\XmFLXqs.exe
  2⤵
  PID:8052
- C:\Windows\System\BouSXQY.exe
  C:\Windows\System\BouSXQY.exe
  2⤵
  PID:8040
- C:\Windows\System\vLoAvJc.exe
  C:\Windows\System\vLoAvJc.exe
  2⤵
  PID:7936
- C:\Windows\System\oKbEVYh.exe
  C:\Windows\System\oKbEVYh.exe
  2⤵
  PID:8008
- C:\Windows\System\RhBUbYE.exe
  C:\Windows\System\RhBUbYE.exe
  2⤵
  PID:8120
- C:\Windows\System\kiWhHLu.exe
  C:\Windows\System\kiWhHLu.exe
  2⤵
  PID:8184
- C:\Windows\System\MpOgeMM.exe
  C:\Windows\System\MpOgeMM.exe
  2⤵
  PID:7184
- C:\Windows\System\GApNGQH.exe
  C:\Windows\System\GApNGQH.exe
  2⤵
  PID:6768
- C:\Windows\System\YUIONsN.exe
  C:\Windows\System\YUIONsN.exe
  2⤵
  PID:8136
- C:\Windows\System\xaGwKcu.exe
  C:\Windows\System\xaGwKcu.exe
  2⤵
  PID:7224
- C:\Windows\System\sTfdjaz.exe
  C:\Windows\System\sTfdjaz.exe
  2⤵
  PID:7044
- C:\Windows\System\hBRRIPI.exe
  C:\Windows\System\hBRRIPI.exe
  2⤵
  PID:7268
- C:\Windows\System\lbledzb.exe
  C:\Windows\System\lbledzb.exe
  2⤵
  PID:7368
- C:\Windows\System\vPqqHVq.exe
  C:\Windows\System\vPqqHVq.exe
  2⤵
  PID:7520
- C:\Windows\System\VfrQJHB.exe
  C:\Windows\System\VfrQJHB.exe
  2⤵
  PID:7352
- C:\Windows\System\vjCsULF.exe
  C:\Windows\System\vjCsULF.exe
  2⤵
  PID:7428
- C:\Windows\System\QsuDnPr.exe
  C:\Windows\System\QsuDnPr.exe
  2⤵
  PID:7744
- C:\Windows\System\UVpmxoP.exe
  C:\Windows\System\UVpmxoP.exe
  2⤵
  PID:7680
- C:\Windows\System\flJXeRE.exe
  C:\Windows\System\flJXeRE.exe
  2⤵
  PID:7824
- C:\Windows\System\sTyxoOk.exe
  C:\Windows\System\sTyxoOk.exe
  2⤵
  PID:7568
- C:\Windows\System\deffgMj.exe
  C:\Windows\System\deffgMj.exe
  2⤵
  PID:7908
- C:\Windows\System\HWupPtn.exe
  C:\Windows\System\HWupPtn.exe
  2⤵
  PID:8060
- C:\Windows\System\xCAMcGt.exe
  C:\Windows\System\xCAMcGt.exe
  2⤵
  PID:7852
- C:\Windows\System\QoWlOaE.exe
  C:\Windows\System\QoWlOaE.exe
  2⤵
  PID:8020
- C:\Windows\System\djIeneY.exe
  C:\Windows\System\djIeneY.exe
  2⤵
  PID:8108
- C:\Windows\System\IQXLOFr.exe
  C:\Windows\System\IQXLOFr.exe
  2⤵
  PID:6720
- C:\Windows\System\GQUBUpi.exe
  C:\Windows\System\GQUBUpi.exe
  2⤵
  PID:6716
- C:\Windows\System\OkvjSHp.exe
  C:\Windows\System\OkvjSHp.exe
  2⤵
  PID:7204
- C:\Windows\System\htWvwKO.exe
  C:\Windows\System\htWvwKO.exe
  2⤵
  PID:7288
- C:\Windows\System\gyxngry.exe
  C:\Windows\System\gyxngry.exe
  2⤵
  PID:7416
- C:\Windows\System\bgALfus.exe
  C:\Windows\System\bgALfus.exe
  2⤵
  PID:7664
- C:\Windows\System\CuLbAjt.exe
  C:\Windows\System\CuLbAjt.exe
  2⤵
  PID:7788
- C:\Windows\System\OtUEdzU.exe
  C:\Windows\System\OtUEdzU.exe
  2⤵
  PID:7952
- C:\Windows\System\MyQqCPf.exe
  C:\Windows\System\MyQqCPf.exe
  2⤵
  PID:7316
- C:\Windows\System\gZUmwse.exe
  C:\Windows\System\gZUmwse.exe
  2⤵
  PID:7872
- C:\Windows\System\PLXaOVa.exe
  C:\Windows\System\PLXaOVa.exe
  2⤵
  PID:7448
- C:\Windows\System\HfyckWb.exe
  C:\Windows\System\HfyckWb.exe
  2⤵
  PID:8156
- C:\Windows\System\CKnfGuJ.exe
  C:\Windows\System\CKnfGuJ.exe
  2⤵
  PID:7604
- C:\Windows\System\btKGHre.exe
  C:\Windows\System\btKGHre.exe
  2⤵
  PID:8172
- C:\Windows\System\cwWKDYh.exe
  C:\Windows\System\cwWKDYh.exe
  2⤵
  PID:8196
- C:\Windows\System\gXcaZDU.exe
  C:\Windows\System\gXcaZDU.exe
  2⤵
  PID:8212
- C:\Windows\System\MJyHnXY.exe
  C:\Windows\System\MJyHnXY.exe
  2⤵
  PID:8228
- C:\Windows\System\UloVXbH.exe
  C:\Windows\System\UloVXbH.exe
  2⤵
  PID:8280
- C:\Windows\System\DfQUDpD.exe
  C:\Windows\System\DfQUDpD.exe
  2⤵
  PID:8296
- C:\Windows\System\JNprait.exe
  C:\Windows\System\JNprait.exe
  2⤵
  PID:8312
- C:\Windows\System\XJlimUk.exe
  C:\Windows\System\XJlimUk.exe
  2⤵
  PID:8328
- C:\Windows\System\zcwMwno.exe
  C:\Windows\System\zcwMwno.exe
  2⤵
  PID:8344
- C:\Windows\System\nImfSJI.exe
  C:\Windows\System\nImfSJI.exe
  2⤵
  PID:8360
- C:\Windows\System\hqBUEiX.exe
  C:\Windows\System\hqBUEiX.exe
  2⤵
  PID:8376
- C:\Windows\System\FDWdzkE.exe
  C:\Windows\System\FDWdzkE.exe
  2⤵
  PID:8392
- C:\Windows\System\WSxmtzJ.exe
  C:\Windows\System\WSxmtzJ.exe
  2⤵
  PID:8408
- C:\Windows\System\eLayZOD.exe
  C:\Windows\System\eLayZOD.exe
  2⤵
  PID:8424
- C:\Windows\System\XZpEqEy.exe
  C:\Windows\System\XZpEqEy.exe
  2⤵
  PID:8440
- C:\Windows\System\BGpuEBX.exe
  C:\Windows\System\BGpuEBX.exe
  2⤵
  PID:8456
- C:\Windows\System\gVFEygM.exe
  C:\Windows\System\gVFEygM.exe
  2⤵
  PID:8472
- C:\Windows\System\uxYULTM.exe
  C:\Windows\System\uxYULTM.exe
  2⤵
  PID:8488
- C:\Windows\System\DaEYCxq.exe
  C:\Windows\System\DaEYCxq.exe
  2⤵
  PID:8504
- C:\Windows\System\BomECei.exe
  C:\Windows\System\BomECei.exe
  2⤵
  PID:8520
- C:\Windows\System\WlcSJpQ.exe
  C:\Windows\System\WlcSJpQ.exe
  2⤵
  PID:8536
- C:\Windows\System\GRsgkQF.exe
  C:\Windows\System\GRsgkQF.exe
  2⤵
  PID:8556
- C:\Windows\System\jLJUGJW.exe
  C:\Windows\System\jLJUGJW.exe
  2⤵
  PID:8572
- C:\Windows\System\hEHpFrb.exe
  C:\Windows\System\hEHpFrb.exe
  2⤵
  PID:8588
- C:\Windows\System\XKOoYPD.exe
  C:\Windows\System\XKOoYPD.exe
  2⤵
  PID:8604
- C:\Windows\System\aOpLAUD.exe
  C:\Windows\System\aOpLAUD.exe
  2⤵
  PID:8620
- C:\Windows\System\DyNApFB.exe
  C:\Windows\System\DyNApFB.exe
  2⤵
  PID:8636
- C:\Windows\System\noGNXKt.exe
  C:\Windows\System\noGNXKt.exe
  2⤵
  PID:8652
- C:\Windows\System\liNZzKX.exe
  C:\Windows\System\liNZzKX.exe
  2⤵
  PID:8668
- C:\Windows\System\FmTnJIZ.exe
  C:\Windows\System\FmTnJIZ.exe
  2⤵
  PID:8684
- C:\Windows\System\uiHIXKa.exe
  C:\Windows\System\uiHIXKa.exe
  2⤵
  PID:8700
- C:\Windows\System\vGzAXOh.exe
  C:\Windows\System\vGzAXOh.exe
  2⤵
  PID:8716
- C:\Windows\System\MnBlgxh.exe
  C:\Windows\System\MnBlgxh.exe
  2⤵
  PID:8732
- C:\Windows\System\gnTdOvD.exe
  C:\Windows\System\gnTdOvD.exe
  2⤵
  PID:8748
- C:\Windows\System\WOjdChk.exe
  C:\Windows\System\WOjdChk.exe
  2⤵
  PID:8764
- C:\Windows\System\iqmkCeo.exe
  C:\Windows\System\iqmkCeo.exe
  2⤵
  PID:8780
- C:\Windows\System\RbnvjdI.exe
  C:\Windows\System\RbnvjdI.exe
  2⤵
  PID:8828
- C:\Windows\System\tRvyJIY.exe
  C:\Windows\System\tRvyJIY.exe
  2⤵
  PID:8848
- C:\Windows\System\ODCHqZe.exe
  C:\Windows\System\ODCHqZe.exe
  2⤵
  PID:8864
- C:\Windows\System\NuqZIDr.exe
  C:\Windows\System\NuqZIDr.exe
  2⤵
  PID:8880
- C:\Windows\System\NIBOwTA.exe
  C:\Windows\System\NIBOwTA.exe
  2⤵
  PID:8896
- C:\Windows\System\hwwNEPo.exe
  C:\Windows\System\hwwNEPo.exe
  2⤵
  PID:8916
- C:\Windows\System\prsvcVZ.exe
  C:\Windows\System\prsvcVZ.exe
  2⤵
  PID:8936
- C:\Windows\System\oscKGmC.exe
  C:\Windows\System\oscKGmC.exe
  2⤵
  PID:8952
- C:\Windows\System\XQUMKrw.exe
  C:\Windows\System\XQUMKrw.exe
  2⤵
  PID:8968
- C:\Windows\System\lfuPbXy.exe
  C:\Windows\System\lfuPbXy.exe
  2⤵
  PID:9000
- C:\Windows\System\BDqrGLr.exe
  C:\Windows\System\BDqrGLr.exe
  2⤵
  PID:9032
- C:\Windows\System\oRwQoMm.exe
  C:\Windows\System\oRwQoMm.exe
  2⤵
  PID:9048
- C:\Windows\System\snKbnvk.exe
  C:\Windows\System\snKbnvk.exe
  2⤵
  PID:7480
- C:\Windows\System\XbpYGYh.exe
  C:\Windows\System\XbpYGYh.exe
  2⤵
  PID:8004
- C:\Windows\System\LjTmqeC.exe
  C:\Windows\System\LjTmqeC.exe
  2⤵
  PID:8236
- C:\Windows\System\ThqUKRp.exe
  C:\Windows\System\ThqUKRp.exe
  2⤵
  PID:7564
- C:\Windows\System\yEfqdos.exe
  C:\Windows\System\yEfqdos.exe
  2⤵
  PID:7636
- C:\Windows\System\YFyffNC.exe
  C:\Windows\System\YFyffNC.exe
  2⤵
  PID:8244
- C:\Windows\System\QgqCYvH.exe
  C:\Windows\System\QgqCYvH.exe
  2⤵
  PID:8268
- C:\Windows\System\rDZnsUC.exe
  C:\Windows\System\rDZnsUC.exe
  2⤵
  PID:8292
- C:\Windows\System\swacJPa.exe
  C:\Windows\System\swacJPa.exe
  2⤵
  PID:8352
- C:\Windows\System\uHvHqji.exe
  C:\Windows\System\uHvHqji.exe
  2⤵
  PID:8384
- C:\Windows\System\uGSgRjU.exe
  C:\Windows\System\uGSgRjU.exe
  2⤵
  PID:8448
- C:\Windows\System\yGkLmuh.exe
  C:\Windows\System\yGkLmuh.exe
  2⤵
  PID:8512
- C:\Windows\System\HmXjiwD.exe
  C:\Windows\System\HmXjiwD.exe
  2⤵
  PID:8340
- C:\Windows\System\CAdtWvx.exe
  C:\Windows\System\CAdtWvx.exe
  2⤵
  PID:8580
- C:\Windows\System\hVGQXDV.exe
  C:\Windows\System\hVGQXDV.exe
  2⤵
  PID:8400
- C:\Windows\System\bOFtxzO.exe
  C:\Windows\System\bOFtxzO.exe
  2⤵
  PID:8464
- C:\Windows\System\raeRqNJ.exe
  C:\Windows\System\raeRqNJ.exe
  2⤵
  PID:8632
- C:\Windows\System\sYpJVEg.exe
  C:\Windows\System\sYpJVEg.exe
  2⤵
  PID:8840
- C:\Windows\System\BMfqOvP.exe
  C:\Windows\System\BMfqOvP.exe
  2⤵
  PID:8860
- C:\Windows\System\WSaLmwd.exe
  C:\Windows\System\WSaLmwd.exe
  2⤵
  PID:8904
- C:\Windows\System\gcYbnaF.exe
  C:\Windows\System\gcYbnaF.exe
  2⤵
  PID:8924
- C:\Windows\System\nnufejt.exe
  C:\Windows\System\nnufejt.exe
  2⤵
  PID:8964
- C:\Windows\System\ONyqlge.exe
  C:\Windows\System\ONyqlge.exe
  2⤵
  PID:8992
- C:\Windows\System\NmFaPSm.exe
  C:\Windows\System\NmFaPSm.exe
  2⤵
  PID:9060
- C:\Windows\System\GDkaWuL.exe
  C:\Windows\System\GDkaWuL.exe
  2⤵
  PID:9080
- C:\Windows\System\AcvSnJE.exe
  C:\Windows\System\AcvSnJE.exe
  2⤵
  PID:9100
- C:\Windows\System\HOYvgfL.exe
  C:\Windows\System\HOYvgfL.exe
  2⤵
  PID:9124
- C:\Windows\System\eSNMtyc.exe
  C:\Windows\System\eSNMtyc.exe
  2⤵
  PID:9148
- C:\Windows\System\HCKJAzf.exe
  C:\Windows\System\HCKJAzf.exe
  2⤵
  PID:9188
- C:\Windows\System\NYUQkhh.exe
  C:\Windows\System\NYUQkhh.exe
  2⤵
  PID:9096
- C:\Windows\System\izGHgRW.exe
  C:\Windows\System\izGHgRW.exe
  2⤵
  PID:8324
- C:\Windows\System\XWFHzpk.exe
  C:\Windows\System\XWFHzpk.exe
  2⤵
  PID:8616
- C:\Windows\System\UpQiOWU.exe
  C:\Windows\System\UpQiOWU.exe
  2⤵
  PID:8532
- C:\Windows\System\vpBaZDH.exe
  C:\Windows\System\vpBaZDH.exe
  2⤵
  PID:8680
- C:\Windows\System\cNbJBAx.exe
  C:\Windows\System\cNbJBAx.exe
  2⤵
  PID:7836
- C:\Windows\System\ywXpihg.exe
  C:\Windows\System\ywXpihg.exe
  2⤵
  PID:8288
- C:\Windows\System\ttuMWUD.exe
  C:\Windows\System\ttuMWUD.exe
  2⤵
  PID:8548
- C:\Windows\System\AHPbewz.exe
  C:\Windows\System\AHPbewz.exe
  2⤵
  PID:8760
- C:\Windows\System\zypZOTN.exe
  C:\Windows\System\zypZOTN.exe
  2⤵
  PID:8564
- C:\Windows\System\vcjSVrI.exe
  C:\Windows\System\vcjSVrI.exe
  2⤵
  PID:8628
- C:\Windows\System\SwnZVHJ.exe
  C:\Windows\System\SwnZVHJ.exe
  2⤵
  PID:8788
- C:\Windows\System\JOtRqVg.exe
  C:\Windows\System\JOtRqVg.exe
  2⤵
  PID:9208
- C:\Windows\System\onBgSXI.exe
  C:\Windows\System\onBgSXI.exe
  2⤵
  PID:8812
- C:\Windows\System\pYiItGd.exe
  C:\Windows\System\pYiItGd.exe
  2⤵
  PID:8892
- C:\Windows\System\mweJIEP.exe
  C:\Windows\System\mweJIEP.exe
  2⤵
  PID:9024
- C:\Windows\System\qmrFsmD.exe
  C:\Windows\System\qmrFsmD.exe
  2⤵
  PID:9132
- C:\Windows\System\WyLlmWT.exe
  C:\Windows\System\WyLlmWT.exe
  2⤵
  PID:8876
- C:\Windows\System\hPCeURh.exe
  C:\Windows\System\hPCeURh.exe
  2⤵
  PID:8980
- C:\Windows\System\oomOsAl.exe
  C:\Windows\System\oomOsAl.exe
  2⤵
  PID:9076
- C:\Windows\System\YIEHepc.exe
  C:\Windows\System\YIEHepc.exe
  2⤵
  PID:9156
- C:\Windows\System\ZecWOVP.exe
  C:\Windows\System\ZecWOVP.exe
  2⤵
  PID:9140
- C:\Windows\System\ihMhrtc.exe
  C:\Windows\System\ihMhrtc.exe
  2⤵
  PID:9172
- C:\Windows\System\IhTfbre.exe
  C:\Windows\System\IhTfbre.exe
  2⤵
  PID:9196
- C:\Windows\System\xOGXNyw.exe
  C:\Windows\System\xOGXNyw.exe
  2⤵
  PID:5384
- C:\Windows\System\vjvhKsQ.exe
  C:\Windows\System\vjvhKsQ.exe
  2⤵
  PID:8240
- C:\Windows\System\GadpGdp.exe
  C:\Windows\System\GadpGdp.exe
  2⤵
  PID:8420
- C:\Windows\System\KFTZGBf.exe
  C:\Windows\System\KFTZGBf.exe
  2⤵
  PID:8208
- C:\Windows\System\VSARRzs.exe
  C:\Windows\System\VSARRzs.exe
  2⤵
  PID:8276
- C:\Windows\System\JQNRWvA.exe
  C:\Windows\System\JQNRWvA.exe
  2⤵
  PID:8756
- C:\Windows\System\JWwcZJI.exe
  C:\Windows\System\JWwcZJI.exe
  2⤵
  PID:988
- C:\Windows\System\NFLybgM.exe
  C:\Windows\System\NFLybgM.exe
  2⤵
  PID:8600
- C:\Windows\System\FiPNUdY.exe
  C:\Windows\System\FiPNUdY.exe
  2⤵
  PID:8808
- C:\Windows\System\OrtqPvb.exe
  C:\Windows\System\OrtqPvb.exe
  2⤵
  PID:9088
- C:\Windows\System\XGOIJmK.exe
  C:\Windows\System\XGOIJmK.exe
  2⤵
  PID:9008
- C:\Windows\System\fXefAdX.exe
  C:\Windows\System\fXefAdX.exe
  2⤵
  PID:8264
- C:\Windows\System\BjUxWCT.exe
  C:\Windows\System\BjUxWCT.exe
  2⤵
  PID:8308
- C:\Windows\System\slCJulZ.exe
  C:\Windows\System\slCJulZ.exe
  2⤵
  PID:8480
- C:\Windows\System\SXGmtjG.exe
  C:\Windows\System\SXGmtjG.exe
  2⤵
  PID:8612
- C:\Windows\System\TixievU.exe
  C:\Windows\System\TixievU.exe
  2⤵
  PID:9072
- C:\Windows\System\lOSZqpl.exe
  C:\Windows\System\lOSZqpl.exe
  2⤵
  PID:8596
- C:\Windows\System\EWbSJdD.exe
  C:\Windows\System\EWbSJdD.exe
  2⤵
  PID:8256
- C:\Windows\System\sWltgxE.exe
  C:\Windows\System\sWltgxE.exe
  2⤵
  PID:8928
- C:\Windows\System\FRJytFP.exe
  C:\Windows\System\FRJytFP.exe
  2⤵
  PID:7348
- C:\Windows\System\seLirMU.exe
  C:\Windows\System\seLirMU.exe
  2⤵
  PID:9224
- C:\Windows\System\xVfHRLJ.exe
  C:\Windows\System\xVfHRLJ.exe
  2⤵
  PID:9240
- C:\Windows\System\UZBcpTv.exe
  C:\Windows\System\UZBcpTv.exe
  2⤵
  PID:9256
- C:\Windows\System\FYKuZPW.exe
  C:\Windows\System\FYKuZPW.exe
  2⤵
  PID:9272
- C:\Windows\System\NqFgQcL.exe
  C:\Windows\System\NqFgQcL.exe
  2⤵
  PID:9288
- C:\Windows\System\kIwCseh.exe
  C:\Windows\System\kIwCseh.exe
  2⤵
  PID:9304
- C:\Windows\System\ZsCDUXk.exe
  C:\Windows\System\ZsCDUXk.exe
  2⤵
  PID:9320
- C:\Windows\System\LIzRztr.exe
  C:\Windows\System\LIzRztr.exe
  2⤵
  PID:9336
- C:\Windows\System\hGMHvwg.exe
  C:\Windows\System\hGMHvwg.exe
  2⤵
  PID:9352
- C:\Windows\System\wDEtvHA.exe
  C:\Windows\System\wDEtvHA.exe
  2⤵
  PID:9368
- C:\Windows\System\xvmoTux.exe
  C:\Windows\System\xvmoTux.exe
  2⤵
  PID:9384
- C:\Windows\System\mRnlfws.exe
  C:\Windows\System\mRnlfws.exe
  2⤵
  PID:9404
- C:\Windows\System\UkBzumS.exe
  C:\Windows\System\UkBzumS.exe
  2⤵
  PID:9500
- C:\Windows\System\vtIuSYC.exe
  C:\Windows\System\vtIuSYC.exe
  2⤵
  PID:9516
- C:\Windows\System\ItbkQYg.exe
  C:\Windows\System\ItbkQYg.exe
  2⤵
  PID:9532
- C:\Windows\System\ZdmtfDA.exe
  C:\Windows\System\ZdmtfDA.exe
  2⤵
  PID:9548
- C:\Windows\System\fFfejlJ.exe
  C:\Windows\System\fFfejlJ.exe
  2⤵
  PID:9564
- C:\Windows\System\fEbVryI.exe
  C:\Windows\System\fEbVryI.exe
  2⤵
  PID:9584
- C:\Windows\System\romESSo.exe
  C:\Windows\System\romESSo.exe
  2⤵
  PID:9600
- C:\Windows\System\SkPHSim.exe
  C:\Windows\System\SkPHSim.exe
  2⤵
  PID:9616
- C:\Windows\System\vOomMOm.exe
  C:\Windows\System\vOomMOm.exe
  2⤵
  PID:9636
- C:\Windows\System\RJgIkkh.exe
  C:\Windows\System\RJgIkkh.exe
  2⤵
  PID:9716
- C:\Windows\System\PEwriSX.exe
  C:\Windows\System\PEwriSX.exe
  2⤵
  PID:9736
- C:\Windows\System\zpEYhQE.exe
  C:\Windows\System\zpEYhQE.exe
  2⤵
  PID:9752
- C:\Windows\System\SyGDLDf.exe
  C:\Windows\System\SyGDLDf.exe
  2⤵
  PID:9768
- C:\Windows\System\DeVFZXI.exe
  C:\Windows\System\DeVFZXI.exe
  2⤵
  PID:9788
- C:\Windows\System\XfmTTyI.exe
  C:\Windows\System\XfmTTyI.exe
  2⤵
  PID:9804
- C:\Windows\System\ZOAtcrH.exe
  C:\Windows\System\ZOAtcrH.exe
  2⤵
  PID:9820
- C:\Windows\System\RAgfSMg.exe
  C:\Windows\System\RAgfSMg.exe
  2⤵
  PID:9840
- C:\Windows\System\DMPgsuf.exe
  C:\Windows\System\DMPgsuf.exe
  2⤵
  PID:9856
- C:\Windows\System\LpfeRIy.exe
  C:\Windows\System\LpfeRIy.exe
  2⤵
  PID:9872
- C:\Windows\System\svAPIcJ.exe
  C:\Windows\System\svAPIcJ.exe
  2⤵
  PID:9888
- C:\Windows\System\bvghfFu.exe
  C:\Windows\System\bvghfFu.exe
  2⤵
  PID:9904
- C:\Windows\System\YCoSgEf.exe
  C:\Windows\System\YCoSgEf.exe
  2⤵
  PID:9920
- C:\Windows\System\nLYQFog.exe
  C:\Windows\System\nLYQFog.exe
  2⤵
  PID:9940
- C:\Windows\System\cfeMEpR.exe
  C:\Windows\System\cfeMEpR.exe
  2⤵
  PID:9956
- C:\Windows\System\OBBRdFp.exe
  C:\Windows\System\OBBRdFp.exe
  2⤵
  PID:9972
- C:\Windows\System\DKTCiHj.exe
  C:\Windows\System\DKTCiHj.exe
  2⤵
  PID:9988
- C:\Windows\System\EKlrVHZ.exe
  C:\Windows\System\EKlrVHZ.exe
  2⤵
  PID:10004
- C:\Windows\System\lRzYSsV.exe
  C:\Windows\System\lRzYSsV.exe
  2⤵
  PID:10020
- C:\Windows\System\GSItuyr.exe
  C:\Windows\System\GSItuyr.exe
  2⤵
  PID:10036
- C:\Windows\System\TLhGfBF.exe
  C:\Windows\System\TLhGfBF.exe
  2⤵
  PID:10052
- C:\Windows\System\zAPmzvj.exe
  C:\Windows\System\zAPmzvj.exe
  2⤵
  PID:10072
- C:\Windows\System\xgdePwe.exe
  C:\Windows\System\xgdePwe.exe
  2⤵
  PID:10088
- C:\Windows\System\WROJiGP.exe
  C:\Windows\System\WROJiGP.exe
  2⤵
  PID:10104
- C:\Windows\System\MqWXUtm.exe
  C:\Windows\System\MqWXUtm.exe
  2⤵
  PID:10120
- C:\Windows\System\MsTlPjQ.exe
  C:\Windows\System\MsTlPjQ.exe
  2⤵
  PID:10136
- C:\Windows\System\yNbIRZs.exe
  C:\Windows\System\yNbIRZs.exe
  2⤵
  PID:10152
- C:\Windows\System\migbeKi.exe
  C:\Windows\System\migbeKi.exe
  2⤵
  PID:10172
- C:\Windows\System\mfKuYEY.exe
  C:\Windows\System\mfKuYEY.exe
  2⤵
  PID:10188
- C:\Windows\System\TcuaPql.exe
  C:\Windows\System\TcuaPql.exe
  2⤵
  PID:10204
- C:\Windows\System\JnJcDZS.exe
  C:\Windows\System\JnJcDZS.exe
  2⤵
  PID:10220
- C:\Windows\System\ySGYLId.exe
  C:\Windows\System\ySGYLId.exe
  2⤵
  PID:10236
- C:\Windows\System\DfGbqxd.exe
  C:\Windows\System\DfGbqxd.exe
  2⤵
  PID:9044
- C:\Windows\System\MMqUCsb.exe
  C:\Windows\System\MMqUCsb.exe
  2⤵
  PID:8872
- C:\Windows\System\TLfPcdU.exe
  C:\Windows\System\TLfPcdU.exe
  2⤵
  PID:8836
- C:\Windows\System\FFGFaQm.exe
  C:\Windows\System\FFGFaQm.exe
  2⤵
  PID:8948
- C:\Windows\System\eRvvOYO.exe
  C:\Windows\System\eRvvOYO.exe
  2⤵
  PID:8996
- C:\Windows\System\ALbENbW.exe
  C:\Windows\System\ALbENbW.exe
  2⤵
  PID:9344
- C:\Windows\System\LOzdXac.exe
  C:\Windows\System\LOzdXac.exe
  2⤵
  PID:9296
- C:\Windows\System\fzHnzCE.exe
  C:\Windows\System\fzHnzCE.exe
  2⤵
  PID:9212
- C:\Windows\System\oUBScyv.exe
  C:\Windows\System\oUBScyv.exe
  2⤵
  PID:9364
- C:\Windows\System\nOYSFBK.exe
  C:\Windows\System\nOYSFBK.exe
  2⤵
  PID:9428
- C:\Windows\System\BxJQzdT.exe
  C:\Windows\System\BxJQzdT.exe
  2⤵
  PID:9448
- C:\Windows\System\tClcRQD.exe
  C:\Windows\System\tClcRQD.exe
  2⤵
  PID:9464
- C:\Windows\System\mhThsKr.exe
  C:\Windows\System\mhThsKr.exe
  2⤵
  PID:9480
- C:\Windows\System\igYaqpE.exe
  C:\Windows\System\igYaqpE.exe
  2⤵
  PID:9544
- C:\Windows\System\UofcfGi.exe
  C:\Windows\System\UofcfGi.exe
  2⤵
  PID:9580
- C:\Windows\System\nzBkXqZ.exe
  C:\Windows\System\nzBkXqZ.exe
  2⤵
  PID:9644
- C:\Windows\System\bZvXnek.exe
  C:\Windows\System\bZvXnek.exe
  2⤵
  PID:9664
- C:\Windows\System\yUjvQns.exe
  C:\Windows\System\yUjvQns.exe
  2⤵
  PID:9684
- C:\Windows\System\UUNxqSg.exe
  C:\Windows\System\UUNxqSg.exe
  2⤵
  PID:9560
- C:\Windows\System\IJdQFwx.exe
  C:\Windows\System\IJdQFwx.exe
  2⤵
  PID:9496
- C:\Windows\System\knwCQvJ.exe
  C:\Windows\System\knwCQvJ.exe
  2⤵
  PID:9692
- C:\Windows\System\UETeSzQ.exe
  C:\Windows\System\UETeSzQ.exe
  2⤵
  PID:9704
- C:\Windows\System\CzJxsBs.exe
  C:\Windows\System\CzJxsBs.exe
  2⤵
  PID:9776
- C:\Windows\System\cDyfRXz.exe
  C:\Windows\System\cDyfRXz.exe
  2⤵
  PID:9812
- C:\Windows\System\pAofVKN.exe
  C:\Windows\System\pAofVKN.exe
  2⤵
  PID:9848
- C:\Windows\System\CGdcepc.exe
  C:\Windows\System\CGdcepc.exe
  2⤵
  PID:9916
- C:\Windows\System\fHoAROh.exe
  C:\Windows\System\fHoAROh.exe
  2⤵
  PID:9764
- C:\Windows\System\YvjyUUn.exe
  C:\Windows\System\YvjyUUn.exe
  2⤵
  PID:9900
- C:\Windows\System\FMxxjCH.exe
  C:\Windows\System\FMxxjCH.exe
  2⤵
  PID:9928
- C:\Windows\System\oSYAlYP.exe
  C:\Windows\System\oSYAlYP.exe
  2⤵
  PID:9936
- C:\Windows\System\jPeINZL.exe
  C:\Windows\System\jPeINZL.exe
  2⤵
  PID:10148
- C:\Windows\System\imVxesj.exe
  C:\Windows\System\imVxesj.exe
  2⤵
  PID:10184
- C:\Windows\System\kXPxqNn.exe
  C:\Windows\System\kXPxqNn.exe
  2⤵
  PID:9996
- C:\Windows\System\FPKyRWz.exe
  C:\Windows\System\FPKyRWz.exe
  2⤵
  PID:10060
- C:\Windows\System\nZdCuZn.exe
  C:\Windows\System\nZdCuZn.exe
  2⤵
  PID:9040
- C:\Windows\System\LApixaZ.exe
  C:\Windows\System\LApixaZ.exe
  2⤵
  PID:10132
- C:\Windows\System\gMmcZux.exe
  C:\Windows\System\gMmcZux.exe
  2⤵
  PID:9112
- C:\Windows\System\PNdOjxI.exe
  C:\Windows\System\PNdOjxI.exe
  2⤵
  PID:9360
- C:\Windows\System\kgtZhCY.exe
  C:\Windows\System\kgtZhCY.exe
  2⤵
  PID:9424
- C:\Windows\System\DYxYRHh.exe
  C:\Windows\System\DYxYRHh.exe
  2⤵
  PID:9688
- C:\Windows\System\keBWZMs.exe
  C:\Windows\System\keBWZMs.exe
  2⤵
  PID:9460
- C:\Windows\System\uEFgaYh.exe
  C:\Windows\System\uEFgaYh.exe
  2⤵
  PID:9476
- C:\Windows\System\bYLZCfF.exe
  C:\Windows\System\bYLZCfF.exe
  2⤵
  PID:9540
- C:\Windows\System\GOmYdRJ.exe
  C:\Windows\System\GOmYdRJ.exe
  2⤵
  PID:9488
- C:\Windows\System\CfCXCdk.exe
  C:\Windows\System\CfCXCdk.exe
  2⤵
  PID:9608
- C:\Windows\System\hGLgbzK.exe
  C:\Windows\System\hGLgbzK.exe
  2⤵
  PID:9680
- C:\Windows\System\dbFxlRf.exe
  C:\Windows\System\dbFxlRf.exe
  2⤵
  PID:9708
- C:\Windows\System\TDgpUGe.exe
  C:\Windows\System\TDgpUGe.exe
  2⤵
  PID:9672
- C:\Windows\System\IuBcQWi.exe
  C:\Windows\System\IuBcQWi.exe
  2⤵
  PID:9784
- C:\Windows\System\ueTjDVc.exe
  C:\Windows\System\ueTjDVc.exe
  2⤵
  PID:9836
- C:\Windows\System\taSzKOE.exe
  C:\Windows\System\taSzKOE.exe
  2⤵
  PID:9868
- C:\Windows\System\vaPweon.exe
  C:\Windows\System\vaPweon.exe
  2⤵
  PID:10016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AJBedTM.exe

Filesize
2.0MB

MD5
7a4a2f8a1b35767c09add008914b693e

SHA1
56f2d49f70410043b900903949597116fc8c3bd0

SHA256
eafc09a9584946437b92e84efda320282a947837fc04b3b7e5b4d88b3fe22de0

SHA512
06a1e948ad0d03840c24f0307bdf998bb03fa9f2e91f0d44c4bee1f5c95b247e9dc3a3b00840fc01cd64dba0f2d8ef1758a013e11e9750abaecd3dfd96a014d5

Download Submit
C:\Windows\system\AzBgzZR.exe

Filesize
2.0MB

MD5
16307ed2104ffcb8c50f63660cc43a54

SHA1
bf5a03c82bc2a8d52c6e06af16f78367adbc1c26

SHA256
34a538b3b8203ff0d25c75990e69b31bc49200252c9565164e29bdc3a19d92d1

SHA512
fbfd912b0e47d0d90e3d45fdeee44a727425711e25ba8c22a9c66cb675fcd24e5423a9d4ddad90bcfa4078b2ac310e9a2eade0266be2f4f6bfa93418d330b1dd

Download Submit
C:\Windows\system\DIBoFuQ.exe

Filesize
2.0MB

MD5
8c9bc5cf75121ab426fb5d1de42755a6

SHA1
5ded3de57040cbd9b83ee2d35121b38896049f32

SHA256
3b2f2a2abea4fd2392dd39c750d3ee5d1a875a418d9bc8e1777059ffbed0aff4

SHA512
37486c44ee053be8e573e4f2b7a2fe3af530eba59be71a2f2440149f74426d4c17fdc0f5f03adadfa55b895be792a61cb8ae463625c6c2adcf4870adb57a722a

Download Submit
C:\Windows\system\DUCMSbt.exe

Filesize
2.0MB

MD5
6134505e5dfee95cdf94a13f532a75be

SHA1
85dd6cc3091b19cabcac60d3f0ae808086e394fe

SHA256
eb4aa5b7e895c60dbacb09b451516f236c479b085a9be9fbcad5901740b0814c

SHA512
7294a7e62d0dcad53648cb5d4f2cf7cb71f35361c305defbc60a8e56efdada0ddaa8b26d36198172e4d77ebd5cddb987aee003ead3dc41ae4a6fc71e82abe898

Download Submit
C:\Windows\system\EfolRAW.exe

Filesize
2.0MB

MD5
1aaf6051c2f9232db45adbb5af38a981

SHA1
7d503fd8487ee827ac9661ab62f8727882004b72

SHA256
a5545e219cc1a14fbe4f4e8896593ee541f862ebe8f59e6ccc24c26e3515c265

SHA512
1141fe5949ca8397699b1a0394ff93be2e2ac85363c322d7573b6a83131783b3d3c92908d9886c836170d12e18022db0d4fc19ed3403e93c2f89e9c7456f0963

Download Submit
C:\Windows\system\EmMZzvG.exe

Filesize
2.0MB

MD5
8717f7d6ab8f64937573e6f578c865c9

SHA1
dcc89f4930099d5e32b9032252558872cf547881

SHA256
be9467f3de67ef61b89f2b3eb64c5716277b60d5559d5327dbc47c664ba321df

SHA512
58ff425e7cd90b278beceed22d12c8b72afacfdbc4c22306564e24f0ac9317c00338c79e9dfb1b17c4065fb40711dbd8c9b5ef20ee974082f6c12911a19bade1

Download Submit
C:\Windows\system\FNJoOUz.exe

Filesize
2.0MB

MD5
d4f0b68d217ae9032ac2cb8d71361a52

SHA1
1846c8edccee547702440f4ff33423f8fe7f1cdb

SHA256
15b3516081a4884ecadb950e8dcad60d9b61f348e12735cafe88320557fcada8

SHA512
f37026f9c4d96cf3b58b1382cd3a12847d7b43c8f7b7fb0fb87852d2066174f7e5c0f03f99fb7a0497c097d3f4b09eb6759c259c5aff087268499ef605f13408

Download Submit
C:\Windows\system\GrSzjaM.exe

Filesize
2.0MB

MD5
81ea810cef51a705d6fafa8920a8b959

SHA1
dbf34b0dbc9673a4bd824b718a5c4748a8a3daab

SHA256
65efe874ff03caa0a2b4508a020d6de8820ff29aa968dc3605428f0940a515a3

SHA512
b75e806d4a8e09d51aee78723750064c9edac20bcfbe09320ea9cc0e2e1058368c4f316757c2da3b0d2ab36d9e61fe09023996830d116dffeb440434b30d4e08

Download Submit
C:\Windows\system\LIakdJW.exe

Filesize
2.0MB

MD5
10f238b4947395559da184a8a9368898

SHA1
9823a113409a8d5a89edad79f631ac388ad3b423

SHA256
123e190eda19676362b85287e87ebf07fe9a2617366321c95b1f11dae6dca04a

SHA512
fafbf362305dde696a8ca0fa014e0b82a22a4b0cd890ccbb420706cd7a2af1e39c1c3fbe03f8a4f28e66a207bf943a7883b6d4381c21d4f4e35e7faa5ea4def1

Download Submit
C:\Windows\system\LNmIWFf.exe

Filesize
2.0MB

MD5
59454eac72f4a3c8541c477ac7957b7b

SHA1
97c07beb7716347c116ddba3a8840ebbdb555495

SHA256
e64760ad81843da6b53f14a0213b9f72ffa82801f838d7a79d910e80c8f1ab60

SHA512
8fc92de2636e10b6808db5c427968ac07da946ab4a3e540b206370a40bdca3733a66d951e74b61a1fc55a371dfa24d0fcc64f1dc10455b0e219822ca5c34ad54

Download Submit
C:\Windows\system\NvtaYuR.exe

Filesize
2.0MB

MD5
72d5c8ab177e6f7216af15c99eaf1e68

SHA1
3316b4c1a7db26460fe8d92ee9c57ed7c55a439e

SHA256
5ccf7a10f4e6a29e52f5ad83c00c9257db38664f47a65e32bc1ab7a066a0f91c

SHA512
0ed7a20f0184bc941774fb36ebb95656200584c7c53e058a3ad17f46864bce38233cf08a3d1df97edfe67354d20d163f94326c04b9ab20f1173dd875d2117b0d

Download Submit
C:\Windows\system\OUlnQpg.exe

Filesize
2.0MB

MD5
32f4570b3b6397a8d85db5610da0b746

SHA1
1af42dafe18124fae9f5a5d9f4baf878a3890cba

SHA256
88ae443f71de00c20fae5fab12238b2a35ac7c08888bba40aab7072622a42dc8

SHA512
9f4872a3a0a46c3e7f684595ecafa0a8478b8adc3c5245d638f50777c47fe6cb1d51f2713127344ed53544fffefaa99e99b43fcb56cce1dec3c08c6b3f00f8a4

Download Submit
C:\Windows\system\Pgdqjtf.exe

Filesize
2.0MB

MD5
005e3ac2f89b06102a138a061d9fd27f

SHA1
ba67677daf73664c99cc1b3e5553a4e639960179

SHA256
ac1b4eba754525497a8e95da98720a5f2b96824a96e63cc21fbffb629695252c

SHA512
c811ea0721e738ec798b0b828711210e723fbd7a929deb89ff270492b5ff38a23aa3c073633aa12f9fe5600e11c3d34ea336e085e3d4710f070213e88e8312d7

Download Submit
C:\Windows\system\PlKXYpa.exe

Filesize
2.0MB

MD5
7d22067d29d53cf61cb4f0bc54d1131b

SHA1
faa69a2f8c7f71a700ff55d313e2e9de600d907b

SHA256
048251f7776a83bfb8c11c2755ee3809398f31b7181c934b3ead5526170de152

SHA512
abe99c2f49eccbc2c5212bbcd057f9014c71e5d9af231109e8515bc3d3bc7a3ccb2ab754705cdd08ec8b5442959e28b2b122390955c0503eb9e9de1b75311422

Download Submit
C:\Windows\system\PpaBxHk.exe

Filesize
2.0MB

MD5
558b07f904be04366d8d1a23cc8d096e

SHA1
96718a1d5714d9440545f96d440cb35035f8d450

SHA256
c5723a11116d66d16c68d64d31bceda5ff2cc30483f5ec1e3ff2a82e315e14ee

SHA512
81cff3831efb03ac5cbffc94e3a5de1e69b8e2bd612c0559351e0855f3dc57c77fb0d90c16675b1a54d438fe59d501f212f73b56986c7409eabf9f88dc0d55ee

Download Submit
C:\Windows\system\RGssNlv.exe

Filesize
8B

MD5
bee58415341bb5c8e4ae4d1668ac5213

SHA1
1891cba00d3e93e7c4debc5af2aef970fb1cf89e

SHA256
90d0c2417821b57dd70bcff90a766e3215a5cf09ad1872be76181d868e5cdeb5

SHA512
3523f1bba41f440fea4189db4e1ab2a217299e6cac50bccfb31f6b7adb451cca1bcdefca4ade81f64a328f90fec523276427c472a8979413913fce840500eb28

Download Submit
C:\Windows\system\SYvrJur.exe

Filesize
2.0MB

MD5
dbc90fb895baf57d8f2f90ddd460db59

SHA1
2ea251884324c5e8691c014656c50e805d95bfa2

SHA256
1230bbd12efe91583d91eb0cfdf6ceb7d98b1995b31d8f14680ba6cab6aa3e9b

SHA512
1049593dc5c83d6541f618c663d73ebcc64b0716805fea0c440a979d13b262aeb7ce01baddf8f4f7467379771f3fefd74e5593d8e3130a14e38d074e20a64373

Download Submit
C:\Windows\system\TdzTcsP.exe

Filesize
2.0MB

MD5
dc4adc47fb2c54ed4adc6e5abdf41802

SHA1
ec591f312ee0d43a8b443248cf70c16d9c998940

SHA256
cd99deed4691056f4d86f4fe1811136d2717655102c3a6a0af8d88597d01c2e8

SHA512
dae8d9cf2ef2c522ffda8cff3914e91b0652236f5ea4b998d0343fa0a68db2b9f9d0eed232ca121bbf51687c28b019c446f819f42bd71fc15b498924dab44ba4

Download Submit
C:\Windows\system\UQQmriK.exe

Filesize
2.0MB

MD5
be28c31cdb2ce1b64e5ad431d9c5cccf

SHA1
9c6c3921ff5d42e63da69e0db0149f2badba16f3

SHA256
973c15b41d877030fccbee21e8d1d4aceb00ec3e3983259ffe95c32a0f58153e

SHA512
113d22a9563994cf64cf8410e0216d10483469f1e77ac533972c01870f7b684f2f9fcc5afa126a619d7027b006e705b4a11a96cda4ee707ec232267be4ab4ce9

Download Submit
C:\Windows\system\UtbIVzS.exe

Filesize
2.0MB

MD5
6422fac8878a281ffcb92bf2bcc518fa

SHA1
6253e67f4cbdca808562b04d8133f492398883f1

SHA256
19dfddbe804d9961da204240fd2b76ca8dd392f9ef910a3ded6bdf4143ef8d13

SHA512
6e84953a92e2c6cd745bc795568bed5973c3347effed9c31c7e45b243d0e18f4bfcef4074d0c66d1d7d5957cf81686bb12f57f33efcc0295c2b821c0dbca4c2c

Download Submit
C:\Windows\system\VbVmecI.exe

Filesize
2.0MB

MD5
91b4371f40fc81d21e8205eff02dca1c

SHA1
df6034fc4ccae618e2acc92a5553ecb5a300d8e2

SHA256
4bbe7a090f68955d25f19dbeecc83cff979b0a21ddb5c052c45729ddcb97cfde

SHA512
f54edb8bc62daa1e46c5f57cb1b9f48ad7936ed29de7f6ecea9b95dea229188d90f650254ea36db9674c01e7b85e32294950bd5f3f0477dcfd41fd10e1802d66

Download Submit
C:\Windows\system\XdKaLUJ.exe

Filesize
2.0MB

MD5
3cf0bd951ea95a7d57869c251332af23

SHA1
9d7bcc114b53ec5c070eb089fda13520d165d388

SHA256
d6395a8a45802bd547cacb958f99c263623de1b99e99b7486a2fd26175315a7b

SHA512
cea4e0b0768253495849fa320d611dcc6729bc969b8ba7b1e824a0e9025125304405e4439bb7be12c43a1ae45f870c911baf0bea80cf93e3811a8f1719637621

Download Submit
C:\Windows\system\XxswGZk.exe

Filesize
2.0MB

MD5
11e21c76f174d46ffb800b7dab1884a0

SHA1
aed826bc8cde1f2b5e20db6a5a322b7269a8af97

SHA256
2e34fd159711e07826cab90e786a6063b728bcc4586a8a98abd8bdc933898528

SHA512
9137073570d3272130407a8983302aebbe23e61c7068904d08eb50866842a8ef30519286e369be30a9604ab630c8631df1714f7c525a6e73728530001ca58d86

Download Submit
C:\Windows\system\cViAJzV.exe

Filesize
2.0MB

MD5
0ae7e577c1b843c18ca6200fd633e7b5

SHA1
facbb6cb06a9fb8b557eb20c63c3183ad2df2d36

SHA256
87d40699fa7403563ec9be674178207aa435afedc915b08108d180443be6a3f2

SHA512
038746e70f7ba54cfd28a63a22cc724319af719fdd3e2c7c8170d3996dcfc0648c493230dc7086c0f6325a92cb688efa5646193dabf40fbcca211bb2ca9b694d

Download Submit
C:\Windows\system\dmHjnxi.exe

Filesize
2.0MB

MD5
fe696cd17e410bd90cc0b14b0648cf7e

SHA1
33bf1378f3a1183f402f09df18266af87695cec6

SHA256
f67b81a54982412c9c88f07e1649aa1039d65f43c303f3a50a601255b03e16d1

SHA512
aaea2b62b41c36135a42cc928f45cdb561fd53876c884bc89dfedfc0d0e878aab29c6e13712a336ffbabf8e5c3e8059543027e6ee50035c6350d54df71b3960a

Download Submit
C:\Windows\system\eKEVENh.exe

Filesize
2.0MB

MD5
8866a927d58de3315c8ab5ed5d8f9725

SHA1
a614484742374ae72419452fa451c3c5b6c00711

SHA256
fe30081c758e467008a439720a4ad40a0d9d366c6de2bc026de53e88e7d6d79a

SHA512
e4c2a0c7cd2126cd8b300febca6f7929e9318a5d0f0b824c161aa14414a5cea0feb48ac9bd1dc4a98034888ae547672deea2a7398ce926df7611eb577a747ef2

Download Submit
C:\Windows\system\fAPnsIW.exe

Filesize
2.0MB

MD5
40d156417b9312b7e4dba032fa8adef3

SHA1
5c5ea6c8d1fca01d2381115890eca8465184e7c8

SHA256
78c428460cfb641d30de66b6ddce6c352f7c4a8fda1e1a549b8e7af19bfd655c

SHA512
06fad182b5839f4180f004f135c3603aa6575223668591763d1953a8d8928befda9fbae3e3291901444495bec8ed586312745492b3717593b5067eb660833906

Download Submit
C:\Windows\system\hKNZqXL.exe

Filesize
2.0MB

MD5
cce4e42386f751e34c8e382c75f2dbaf

SHA1
ba806591cbed79aef9eacab57056045e86411506

SHA256
80cde81c61a0513a2d033a5a0fcb885e8af42585f43c5e1061cb5fd493db3122

SHA512
5ebb4b9be6966f442c70cdea65b5202ca898efa66308368b059dc3a4e7a0c4c3d96aee9c0c1dd745226e984144b82fbdeed73f17f57893123f6e25ac3092883d

Download Submit
C:\Windows\system\lGLMqQc.exe

Filesize
2.0MB

MD5
fb81063767e7f2d7115997e2e7dcd7f2

SHA1
b816d86478cdc6f9c8fa4725d8f084507a8e632c

SHA256
cfa3512e6118b2f35eeb1d5510780ca1f0c91576e6ab04280853f4393e044275

SHA512
2cfacb44419ce8ff66a85ce7a78da8d624f9f2cab1b263419b30861a7242a8e6c3952e756afb3f0cd2bd2f74f07ecfc66884e01c7a5a430342825c4a9c4e57f5

Download Submit
C:\Windows\system\qGGwQmL.exe

Filesize
2.0MB

MD5
dc8dc1989e482426fccb2fc6e6295d46

SHA1
ccbf2acadfb40f61e56fb6dcb6ee5a8cebd721ad

SHA256
ad4b5f0ba63eacf356404424695b7d04764cbccf453e3fe872fd7cccb0a44228

SHA512
82bf38603349d0f89932bed3e9e635327901e07fce9d93aa0028b43d2c26f910d3b44acf93ee9fb4d98947a0c6fe0aaaac84aa970ac2fc020fd8e171ed21c955

Download Submit
C:\Windows\system\uMfnsmC.exe

Filesize
2.0MB

MD5
7b9752d92e51cd92e1369a27251f8185

SHA1
610f0b654502c01e6a35494d603866bc9a7af114

SHA256
977d420ddf6a2fbc12902ed55be1f81628467b948987895eba52faa98915cb2d

SHA512
346015660968f49389dd1b2605a9181cc42ff317f23ddc89bcdd7c25e86ae5047c439b88178417533fe4c7bb7b07b8b03b232af7e6eed6f65df9271d61620ce6

Download Submit
C:\Windows\system\xaNvIEw.exe

Filesize
2.0MB

MD5
e35e954d0240f9e8b2763ac7823b6b7b

SHA1
6a314be8034967e993cb3c3bb2552ddbb2932c01

SHA256
d0da6e05b5eab20a44a9b5ab17238ee0512432a472bb5dcf05ae0b88fecd5b2d

SHA512
9c6dbd19654dec032d4bf2ec17a4b5b6ab14a1b7430697a8c6385646e90e2a3a2e028738cc6db4577e69afbbb2d4f4ab9e02c81b8aeda8f508b50d61bcaed8b4

Download Submit
\Windows\system\rISGXLa.exe

Filesize
2.0MB

MD5
a7f315da163dd8d1beffe03a69b21dd0

SHA1
7308fe9f0d29cccac28d2dba4fb3a0aeec36e723

SHA256
157f761fb828a636e872d7048f97926506f0692dbbe12bfdfac0834b3e10b755

SHA512
166e143b43c0dfe06d73927093a35fea7aa4c3abe2262283fa65608b670cda41f48e7d47b8dff39e90bce6036e48e7827b3531b39b09b97d22ddfb27bc32ff67

Download Submit
memory/476-149-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download
memory/920-4762-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/920-151-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/2024-137-0x000000013F790000-0x000000013FB82000-memory.dmp

Filesize
3.9MB

Download
memory/2024-4779-0x000000013F790000-0x000000013FB82000-memory.dmp

Filesize
3.9MB

Download
memory/2128-155-0x000000013F3F0000-0x000000013F7E2000-memory.dmp

Filesize
3.9MB

Download
memory/2392-13-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/2392-1201-0x0000000003530000-0x0000000003922000-memory.dmp

Filesize
3.9MB

Download
memory/2392-146-0x0000000003530000-0x0000000003922000-memory.dmp

Filesize
3.9MB

Download
memory/2392-664-0x000000013FB10000-0x000000013FF02000-memory.dmp

Filesize
3.9MB

Download
memory/2392-144-0x000000013F6A0000-0x000000013FA92000-memory.dmp

Filesize
3.9MB

Download
memory/2392-154-0x000000013F3F0000-0x000000013F7E2000-memory.dmp

Filesize
3.9MB

Download
memory/2392-142-0x00000000031B0000-0x00000000035A2000-memory.dmp

Filesize
3.9MB

Download
memory/2392-1202-0x000000013F3F0000-0x000000013F7E2000-memory.dmp

Filesize
3.9MB

Download
memory/2392-140-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2392-1200-0x0000000003530000-0x0000000003922000-memory.dmp

Filesize
3.9MB

Download
memory/2392-138-0x000000013F4F0000-0x000000013F8E2000-memory.dmp

Filesize
3.9MB

Download
memory/2392-148-0x0000000003530000-0x0000000003922000-memory.dmp

Filesize
3.9MB

Download
memory/2392-136-0x00000000031B0000-0x00000000035A2000-memory.dmp

Filesize
3.9MB

Download
memory/2392-1-0x0000000000300000-0x0000000000310000-memory.dmp

Filesize
64KB

Download
memory/2392-11-0x0000000002B80000-0x0000000002F72000-memory.dmp

Filesize
3.9MB

Download
memory/2392-150-0x0000000003530000-0x0000000003922000-memory.dmp

Filesize
3.9MB

Download
memory/2392-152-0x0000000003530000-0x0000000003922000-memory.dmp

Filesize
3.9MB

Download
memory/2392-0-0x000000013FB10000-0x000000013FF02000-memory.dmp

Filesize
3.9MB

Download
memory/2552-4758-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2552-141-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2588-139-0x000000013F4F0000-0x000000013F8E2000-memory.dmp

Filesize
3.9MB

Download
memory/2588-4835-0x000000013F4F0000-0x000000013F8E2000-memory.dmp

Filesize
3.9MB

Download
memory/2616-143-0x000000013FEA0000-0x0000000140292000-memory.dmp

Filesize
3.9MB

Download
memory/2688-912-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/2688-14-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/2744-273-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

Filesize
9.6MB

Download
memory/2744-156-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

Filesize
9.6MB

Download
memory/2744-135-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

Filesize
9.6MB

Download
memory/2744-134-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

Filesize
9.6MB

Download
memory/2744-21-0x000007FEF58DE000-0x000007FEF58DF000-memory.dmp

Filesize
4KB

Download
memory/2744-103-0x0000000002240000-0x0000000002248000-memory.dmp

Filesize
32KB

Download
memory/2744-102-0x000000001B6D0000-0x000000001B9B2000-memory.dmp

Filesize
2.9MB

Download
memory/2776-16-0x000000013FCA0000-0x0000000140092000-memory.dmp

Filesize
3.9MB

Download
memory/2776-3821-0x000000013FCA0000-0x0000000140092000-memory.dmp

Filesize
3.9MB

Download
memory/2804-147-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/3040-4760-0x000000013F6A0000-0x000000013FA92000-memory.dmp

Filesize
3.9MB

Download
memory/3040-145-0x000000013F6A0000-0x000000013FA92000-memory.dmp

Filesize
3.9MB

Download
memory/3064-4775-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download
memory/3064-153-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download