xmrig | ddcc060356a39cdcd78e9b7655610d9fa0bffb4a0d0efaf4cf2796c5164ead53

Analysis

max time kernel
119s
max time network
116s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 18:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d77711b1da74debc6fef4ced8e6a870N.exe
Size

2.0MB
MD5

3d77711b1da74debc6fef4ced8e6a870
SHA1

fa0298a4cf578b3710af6bcc205a03a4f47cfc59
SHA256

ddcc060356a39cdcd78e9b7655610d9fa0bffb4a0d0efaf4cf2796c5164ead53
SHA512

0d3fe416e04a3ef5db6664f5f3d4f1befb62f9be1dd29280d0d88ffef87445a843de588cb86d8e178cce28824138145a420dc21a1db1fcf93f5fa9adb7dd05e5
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjFkTVnfuDPFFWqreoYtgWqabE1y14dMP5:Lz071uv4BPMkHC0IEFTo/abRcN91M+S

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 18 IoCs

miner

resource	yara_rule
behavioral1/memory/1648-9-0x000000013FD30000-0x0000000140122000-memory.dmp	xmrig
behavioral1/memory/2708-48-0x000000013F140000-0x000000013F532000-memory.dmp	xmrig
behavioral1/memory/2908-55-0x000000013FDB0000-0x00000001401A2000-memory.dmp	xmrig
behavioral1/memory/2612-54-0x000000013FFA0000-0x0000000140392000-memory.dmp	xmrig
behavioral1/memory/1676-1037-0x000000013FC40000-0x0000000140032000-memory.dmp	xmrig
behavioral1/memory/1592-657-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	xmrig
behavioral1/memory/588-266-0x000000013F920000-0x000000013FD12000-memory.dmp	xmrig
behavioral1/memory/2356-84-0x0000000003370000-0x0000000003762000-memory.dmp	xmrig
behavioral1/memory/2356-83-0x000000013F960000-0x000000013FD52000-memory.dmp	xmrig
behavioral1/memory/2128-73-0x000000013F200000-0x000000013F5F2000-memory.dmp	xmrig
behavioral1/memory/2636-62-0x000000013F360000-0x000000013F752000-memory.dmp	xmrig
behavioral1/memory/2560-60-0x000000013FE80000-0x0000000140272000-memory.dmp	xmrig
behavioral1/memory/2680-52-0x000000013F260000-0x000000013F652000-memory.dmp	xmrig
behavioral1/memory/1592-4699-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	xmrig
behavioral1/memory/1060-4701-0x000000013FCC0000-0x00000001400B2000-memory.dmp	xmrig
behavioral1/memory/2128-4708-0x000000013F200000-0x000000013F5F2000-memory.dmp	xmrig
behavioral1/memory/588-4740-0x000000013F920000-0x000000013FD12000-memory.dmp	xmrig
behavioral1/memory/1676-4771-0x000000013FC40000-0x0000000140032000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2216	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1648	UzFWSVV.exe
2708	WRVxIDx.exe
2680	vONlnRh.exe
2612	kwCQXVw.exe
2908	qaQlykd.exe
2560	MzefOSI.exe
2636	FeDfBmt.exe
588	EKEsaPT.exe
2128	YtLngHn.exe
1592	FQZUQqD.exe
1676	rlZrKRS.exe
1060	pQPutxM.exe
2632	lNBopwF.exe
2756	gAxWESk.exe
1688	UtPdkDW.exe
788	baHNQBd.exe
592	OVKEZMo.exe
2212	GWwPTcp.exe
680	LKFIswa.exe
2256	aMEbbum.exe
2084	hCLvmNU.exe
1632	LsgkjVc.exe
2436	OeFjXjg.exe
444	vTsDWKw.exe
2768	uGHbxLq.exe
1972	nlUhJBh.exe
972	DIMWZzz.exe
2512	humciGv.exe
672	vIxJLiw.exe
1016	fSsleIt.exe
1928	PEhNkja.exe
1064	etKQKqk.exe
1548	KrYYqTF.exe
1556	vXUhNWU.exe
1744	nhKiyMW.exe
2148	HisKoKv.exe
1956	KPCPauM.exe
2012	IrAzLYV.exe
624	XFcvhCF.exe
2516	YSLZxFB.exe
996	gvpPyCS.exe
1748	IyAEqVh.exe
3008	MgvXtAM.exe
2852	nNBnwXO.exe
2384	rIkGMqz.exe
2304	KjxwXlo.exe
372	lwhdlNf.exe
696	lTjKMsX.exe
708	aThRMpn.exe
2292	ztfoJUu.exe
392	EovPJqz.exe
316	iHFAdHU.exe
2252	yLSUOiy.exe
2648	qRnTnhU.exe
2968	yNPhzus.exe
1608	iYiVSGp.exe
1604	GWrTFsD.exe
2372	VVVXbOc.exe
2980	WRYzndh.exe
2976	rWkljqn.exe
2876	oJoLeCp.exe
1788	AxZFlfx.exe
1672	fILAQKj.exe
2884	jlRLWIx.exe

Loads dropped DLL 64 IoCs

pid	Process
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe
2356	3d77711b1da74debc6fef4ced8e6a870N.exe

UPX packed file 54 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2356-0-0x000000013F960000-0x000000013FD52000-memory.dmp	upx
behavioral1/files/0x0003000000012000-5.dat	upx
behavioral1/memory/1648-9-0x000000013FD30000-0x0000000140122000-memory.dmp	upx
behavioral1/files/0x00080000000174cc-17.dat	upx
behavioral1/files/0x00120000000054a9-16.dat	upx
behavioral1/files/0x00060000000186e4-30.dat	upx
behavioral1/files/0x00060000000186ea-37.dat	upx
behavioral1/memory/2708-48-0x000000013F140000-0x000000013F532000-memory.dmp	upx
behavioral1/memory/2908-55-0x000000013FDB0000-0x00000001401A2000-memory.dmp	upx
behavioral1/memory/2612-54-0x000000013FFA0000-0x0000000140392000-memory.dmp	upx
behavioral1/files/0x00390000000173a9-76.dat	upx
behavioral1/memory/1060-96-0x000000013FCC0000-0x00000001400B2000-memory.dmp	upx
behavioral1/files/0x000500000001944f-89.dat	upx
behavioral1/files/0x000500000001950c-105.dat	upx
behavioral1/files/0x0005000000019609-119.dat	upx
behavioral1/files/0x0005000000019625-178.dat	upx
behavioral1/memory/1676-1037-0x000000013FC40000-0x0000000140032000-memory.dmp	upx
behavioral1/memory/1592-657-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	upx
behavioral1/memory/588-266-0x000000013F920000-0x000000013FD12000-memory.dmp	upx
behavioral1/files/0x0005000000019623-174.dat	upx
behavioral1/files/0x0005000000019622-171.dat	upx
behavioral1/files/0x0005000000019621-167.dat	upx
behavioral1/files/0x000500000001961f-162.dat	upx
behavioral1/files/0x000500000001961d-159.dat	upx
behavioral1/files/0x000500000001961b-154.dat	upx
behavioral1/files/0x0005000000019619-151.dat	upx
behavioral1/files/0x0005000000019617-146.dat	upx
behavioral1/files/0x0005000000019615-143.dat	upx
behavioral1/files/0x0005000000019613-138.dat	upx
behavioral1/files/0x0005000000019611-135.dat	upx
behavioral1/files/0x000500000001960f-130.dat	upx
behavioral1/files/0x000500000001960d-127.dat	upx
behavioral1/files/0x000500000001960b-122.dat	upx
behavioral1/files/0x00050000000195c5-114.dat	upx
behavioral1/files/0x0005000000019582-110.dat	upx
behavioral1/files/0x0005000000019461-100.dat	upx
behavioral1/memory/1592-78-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	upx
behavioral1/memory/1676-85-0x000000013FC40000-0x0000000140032000-memory.dmp	upx
behavioral1/memory/2356-83-0x000000013F960000-0x000000013FD52000-memory.dmp	upx
behavioral1/files/0x0005000000019441-82.dat	upx
behavioral1/memory/2128-73-0x000000013F200000-0x000000013F5F2000-memory.dmp	upx
behavioral1/memory/588-66-0x000000013F920000-0x000000013FD12000-memory.dmp	upx
behavioral1/files/0x000700000001873d-70.dat	upx
behavioral1/files/0x00060000000186fd-65.dat	upx
behavioral1/memory/2636-62-0x000000013F360000-0x000000013F752000-memory.dmp	upx
behavioral1/memory/2560-60-0x000000013FE80000-0x0000000140272000-memory.dmp	upx
behavioral1/memory/2680-52-0x000000013F260000-0x000000013F652000-memory.dmp	upx
behavioral1/files/0x00060000000186ee-42.dat	upx
behavioral1/files/0x0008000000018683-26.dat	upx
behavioral1/memory/1592-4699-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	upx
behavioral1/memory/1060-4701-0x000000013FCC0000-0x00000001400B2000-memory.dmp	upx
behavioral1/memory/2128-4708-0x000000013F200000-0x000000013F5F2000-memory.dmp	upx
behavioral1/memory/588-4740-0x000000013F920000-0x000000013FD12000-memory.dmp	upx
behavioral1/memory/1676-4771-0x000000013FC40000-0x0000000140032000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\TwftxTM.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\dDcrSqm.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\fkmGNwh.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\ztfnXoM.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\QdKIlUB.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\ZBnepon.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\xzSKkxe.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\NFvQJHG.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\pCjlMmh.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\JTIMtVn.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\ROSRcPt.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\SvKrLoc.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\lulZLGW.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\HYhVpHN.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\wqKETAD.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\HjHxmeM.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\DtzqDyL.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\tegpSRP.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\nyROtPu.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\HvvJSwy.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\SOECgiM.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\mUjwpDi.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\HCjwQvX.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\hDGxBXX.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\SytrkSF.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\xXRCJFF.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\vICCifs.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\pXVlezp.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\lwhdlNf.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\olWJcpJ.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\pGOBVzD.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\gaqEITl.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\XhUHMqU.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\slIQCOA.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\riSQZMh.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\pmpuLxi.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\dIdjcoi.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\HoYmkGB.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\gsUMgrQ.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\atUiWXo.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\GLCdffl.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\JCHAKNt.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\XPsKlxg.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\bRHlrZo.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\FOYuXzZ.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\lNBopwF.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\AGboXFn.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\PBQhicR.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\AhUbEyl.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\UNmOnQg.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\FinLAje.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\QVEPkoP.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\zhWJUAQ.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\yKFSqfI.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\NNbUYGO.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\ebwKKQj.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\kRnVFDH.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\RKdiTgm.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\XmSDtwF.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\XxsdEjq.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\gZucYej.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\TlvKkDv.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\xivuQzx.exe	3d77711b1da74debc6fef4ced8e6a870N.exe
File created	C:\Windows\System\guMJEuL.exe	3d77711b1da74debc6fef4ced8e6a870N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2216	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2356	3d77711b1da74debc6fef4ced8e6a870N.exe
Token: SeLockMemoryPrivilege	2356	3d77711b1da74debc6fef4ced8e6a870N.exe
Token: SeDebugPrivilege	2216	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2216	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	31
PID 2356 wrote to memory of 2216	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	31
PID 2356 wrote to memory of 2216	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	31
PID 2356 wrote to memory of 1648	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	32
PID 2356 wrote to memory of 1648	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	32
PID 2356 wrote to memory of 1648	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	32
PID 2356 wrote to memory of 2708	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	33
PID 2356 wrote to memory of 2708	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	33
PID 2356 wrote to memory of 2708	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	33
PID 2356 wrote to memory of 2680	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	34
PID 2356 wrote to memory of 2680	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	34
PID 2356 wrote to memory of 2680	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	34
PID 2356 wrote to memory of 2908	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	35
PID 2356 wrote to memory of 2908	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	35
PID 2356 wrote to memory of 2908	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	35
PID 2356 wrote to memory of 2612	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	36
PID 2356 wrote to memory of 2612	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	36
PID 2356 wrote to memory of 2612	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	36
PID 2356 wrote to memory of 2560	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	37
PID 2356 wrote to memory of 2560	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	37
PID 2356 wrote to memory of 2560	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	37
PID 2356 wrote to memory of 2636	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	38
PID 2356 wrote to memory of 2636	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	38
PID 2356 wrote to memory of 2636	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	38
PID 2356 wrote to memory of 588	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	39
PID 2356 wrote to memory of 588	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	39
PID 2356 wrote to memory of 588	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	39
PID 2356 wrote to memory of 2128	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	40
PID 2356 wrote to memory of 2128	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	40
PID 2356 wrote to memory of 2128	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	40
PID 2356 wrote to memory of 1592	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	41
PID 2356 wrote to memory of 1592	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	41
PID 2356 wrote to memory of 1592	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	41
PID 2356 wrote to memory of 1676	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	42
PID 2356 wrote to memory of 1676	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	42
PID 2356 wrote to memory of 1676	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	42
PID 2356 wrote to memory of 1060	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	43
PID 2356 wrote to memory of 1060	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	43
PID 2356 wrote to memory of 1060	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	43
PID 2356 wrote to memory of 2632	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	44
PID 2356 wrote to memory of 2632	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	44
PID 2356 wrote to memory of 2632	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	44
PID 2356 wrote to memory of 2756	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	45
PID 2356 wrote to memory of 2756	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	45
PID 2356 wrote to memory of 2756	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	45
PID 2356 wrote to memory of 1688	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	46
PID 2356 wrote to memory of 1688	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	46
PID 2356 wrote to memory of 1688	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	46
PID 2356 wrote to memory of 788	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	47
PID 2356 wrote to memory of 788	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	47
PID 2356 wrote to memory of 788	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	47
PID 2356 wrote to memory of 592	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	48
PID 2356 wrote to memory of 592	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	48
PID 2356 wrote to memory of 592	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	48
PID 2356 wrote to memory of 2212	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	49
PID 2356 wrote to memory of 2212	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	49
PID 2356 wrote to memory of 2212	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	49
PID 2356 wrote to memory of 680	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	50
PID 2356 wrote to memory of 680	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	50
PID 2356 wrote to memory of 680	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	50
PID 2356 wrote to memory of 2256	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	51
PID 2356 wrote to memory of 2256	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	51
PID 2356 wrote to memory of 2256	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	51
PID 2356 wrote to memory of 2084	2356	3d77711b1da74debc6fef4ced8e6a870N.exe	52

C:\Users\Admin\AppData\Local\Temp\3d77711b1da74debc6fef4ced8e6a870N.exe
"C:\Users\Admin\AppData\Local\Temp\3d77711b1da74debc6fef4ced8e6a870N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2216
- C:\Windows\System\UzFWSVV.exe
  C:\Windows\System\UzFWSVV.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\WRVxIDx.exe
  C:\Windows\System\WRVxIDx.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\vONlnRh.exe
  C:\Windows\System\vONlnRh.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\qaQlykd.exe
  C:\Windows\System\qaQlykd.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\kwCQXVw.exe
  C:\Windows\System\kwCQXVw.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\MzefOSI.exe
  C:\Windows\System\MzefOSI.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\FeDfBmt.exe
  C:\Windows\System\FeDfBmt.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\EKEsaPT.exe
  C:\Windows\System\EKEsaPT.exe
  2⤵
  - Executes dropped EXE
  PID:588
- C:\Windows\System\YtLngHn.exe
  C:\Windows\System\YtLngHn.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\FQZUQqD.exe
  C:\Windows\System\FQZUQqD.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\rlZrKRS.exe
  C:\Windows\System\rlZrKRS.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\pQPutxM.exe
  C:\Windows\System\pQPutxM.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\lNBopwF.exe
  C:\Windows\System\lNBopwF.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\gAxWESk.exe
  C:\Windows\System\gAxWESk.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\UtPdkDW.exe
  C:\Windows\System\UtPdkDW.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\baHNQBd.exe
  C:\Windows\System\baHNQBd.exe
  2⤵
  - Executes dropped EXE
  PID:788
- C:\Windows\System\OVKEZMo.exe
  C:\Windows\System\OVKEZMo.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\GWwPTcp.exe
  C:\Windows\System\GWwPTcp.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\LKFIswa.exe
  C:\Windows\System\LKFIswa.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\aMEbbum.exe
  C:\Windows\System\aMEbbum.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\hCLvmNU.exe
  C:\Windows\System\hCLvmNU.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\LsgkjVc.exe
  C:\Windows\System\LsgkjVc.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\OeFjXjg.exe
  C:\Windows\System\OeFjXjg.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\vTsDWKw.exe
  C:\Windows\System\vTsDWKw.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\uGHbxLq.exe
  C:\Windows\System\uGHbxLq.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\nlUhJBh.exe
  C:\Windows\System\nlUhJBh.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\DIMWZzz.exe
  C:\Windows\System\DIMWZzz.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\humciGv.exe
  C:\Windows\System\humciGv.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\vIxJLiw.exe
  C:\Windows\System\vIxJLiw.exe
  2⤵
  - Executes dropped EXE
  PID:672
- C:\Windows\System\fSsleIt.exe
  C:\Windows\System\fSsleIt.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\PEhNkja.exe
  C:\Windows\System\PEhNkja.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\etKQKqk.exe
  C:\Windows\System\etKQKqk.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\KrYYqTF.exe
  C:\Windows\System\KrYYqTF.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\vXUhNWU.exe
  C:\Windows\System\vXUhNWU.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\nhKiyMW.exe
  C:\Windows\System\nhKiyMW.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\HisKoKv.exe
  C:\Windows\System\HisKoKv.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\KPCPauM.exe
  C:\Windows\System\KPCPauM.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\IrAzLYV.exe
  C:\Windows\System\IrAzLYV.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\XFcvhCF.exe
  C:\Windows\System\XFcvhCF.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\YSLZxFB.exe
  C:\Windows\System\YSLZxFB.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\gvpPyCS.exe
  C:\Windows\System\gvpPyCS.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\IyAEqVh.exe
  C:\Windows\System\IyAEqVh.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\MgvXtAM.exe
  C:\Windows\System\MgvXtAM.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\nNBnwXO.exe
  C:\Windows\System\nNBnwXO.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\rIkGMqz.exe
  C:\Windows\System\rIkGMqz.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\KjxwXlo.exe
  C:\Windows\System\KjxwXlo.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\lwhdlNf.exe
  C:\Windows\System\lwhdlNf.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\lTjKMsX.exe
  C:\Windows\System\lTjKMsX.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\aThRMpn.exe
  C:\Windows\System\aThRMpn.exe
  2⤵
  - Executes dropped EXE
  PID:708
- C:\Windows\System\ztfoJUu.exe
  C:\Windows\System\ztfoJUu.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\EovPJqz.exe
  C:\Windows\System\EovPJqz.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\iHFAdHU.exe
  C:\Windows\System\iHFAdHU.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\yLSUOiy.exe
  C:\Windows\System\yLSUOiy.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\qRnTnhU.exe
  C:\Windows\System\qRnTnhU.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\yNPhzus.exe
  C:\Windows\System\yNPhzus.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\iYiVSGp.exe
  C:\Windows\System\iYiVSGp.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\GWrTFsD.exe
  C:\Windows\System\GWrTFsD.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\VVVXbOc.exe
  C:\Windows\System\VVVXbOc.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\WRYzndh.exe
  C:\Windows\System\WRYzndh.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\rWkljqn.exe
  C:\Windows\System\rWkljqn.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\oJoLeCp.exe
  C:\Windows\System\oJoLeCp.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\AxZFlfx.exe
  C:\Windows\System\AxZFlfx.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\fILAQKj.exe
  C:\Windows\System\fILAQKj.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\jlRLWIx.exe
  C:\Windows\System\jlRLWIx.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\tLtpxaU.exe
  C:\Windows\System\tLtpxaU.exe
  2⤵
  PID:1980
- C:\Windows\System\oJsHYxR.exe
  C:\Windows\System\oJsHYxR.exe
  2⤵
  PID:1624
- C:\Windows\System\kkUlHDK.exe
  C:\Windows\System\kkUlHDK.exe
  2⤵
  PID:1260
- C:\Windows\System\xhxyZMJ.exe
  C:\Windows\System\xhxyZMJ.exe
  2⤵
  PID:2624
- C:\Windows\System\csCDUDp.exe
  C:\Windows\System\csCDUDp.exe
  2⤵
  PID:2400
- C:\Windows\System\mSAZgBC.exe
  C:\Windows\System\mSAZgBC.exe
  2⤵
  PID:1756
- C:\Windows\System\xSXYEgM.exe
  C:\Windows\System\xSXYEgM.exe
  2⤵
  PID:2932
- C:\Windows\System\ZlMPNuM.exe
  C:\Windows\System\ZlMPNuM.exe
  2⤵
  PID:376
- C:\Windows\System\emczBiD.exe
  C:\Windows\System\emczBiD.exe
  2⤵
  PID:2236
- C:\Windows\System\ptdlINP.exe
  C:\Windows\System\ptdlINP.exe
  2⤵
  PID:2192
- C:\Windows\System\VWYsmez.exe
  C:\Windows\System\VWYsmez.exe
  2⤵
  PID:3024
- C:\Windows\System\tGVWCEP.exe
  C:\Windows\System\tGVWCEP.exe
  2⤵
  PID:1680
- C:\Windows\System\NjUSJVs.exe
  C:\Windows\System\NjUSJVs.exe
  2⤵
  PID:2964
- C:\Windows\System\WvnrXOd.exe
  C:\Windows\System\WvnrXOd.exe
  2⤵
  PID:1368
- C:\Windows\System\GYSmYQT.exe
  C:\Windows\System\GYSmYQT.exe
  2⤵
  PID:1644
- C:\Windows\System\cBRjIsy.exe
  C:\Windows\System\cBRjIsy.exe
  2⤵
  PID:920
- C:\Windows\System\ZOETxvJ.exe
  C:\Windows\System\ZOETxvJ.exe
  2⤵
  PID:1312
- C:\Windows\System\xnFmbyd.exe
  C:\Windows\System\xnFmbyd.exe
  2⤵
  PID:976
- C:\Windows\System\mbIzKaV.exe
  C:\Windows\System\mbIzKaV.exe
  2⤵
  PID:2032
- C:\Windows\System\NWKOlNl.exe
  C:\Windows\System\NWKOlNl.exe
  2⤵
  PID:2564
- C:\Windows\System\NOzFuwn.exe
  C:\Windows\System\NOzFuwn.exe
  2⤵
  PID:284
- C:\Windows\System\sEuGyaH.exe
  C:\Windows\System\sEuGyaH.exe
  2⤵
  PID:2496
- C:\Windows\System\NwhGsnt.exe
  C:\Windows\System\NwhGsnt.exe
  2⤵
  PID:2960
- C:\Windows\System\hWlTcKc.exe
  C:\Windows\System\hWlTcKc.exe
  2⤵
  PID:2688
- C:\Windows\System\TlgQcME.exe
  C:\Windows\System\TlgQcME.exe
  2⤵
  PID:3012
- C:\Windows\System\pYGwGSZ.exe
  C:\Windows\System\pYGwGSZ.exe
  2⤵
  PID:3004
- C:\Windows\System\XTqIcHQ.exe
  C:\Windows\System\XTqIcHQ.exe
  2⤵
  PID:2684
- C:\Windows\System\wugJheJ.exe
  C:\Windows\System\wugJheJ.exe
  2⤵
  PID:1512
- C:\Windows\System\MPlHuUb.exe
  C:\Windows\System\MPlHuUb.exe
  2⤵
  PID:2840
- C:\Windows\System\ZOfHbRM.exe
  C:\Windows\System\ZOfHbRM.exe
  2⤵
  PID:1596
- C:\Windows\System\AMzRkRE.exe
  C:\Windows\System\AMzRkRE.exe
  2⤵
  PID:1664
- C:\Windows\System\PpwYYmM.exe
  C:\Windows\System\PpwYYmM.exe
  2⤵
  PID:2720
- C:\Windows\System\aqLNRlV.exe
  C:\Windows\System\aqLNRlV.exe
  2⤵
  PID:2732
- C:\Windows\System\RDRheYF.exe
  C:\Windows\System\RDRheYF.exe
  2⤵
  PID:2820
- C:\Windows\System\ESqsnDp.exe
  C:\Windows\System\ESqsnDp.exe
  2⤵
  PID:2524
- C:\Windows\System\ZEtVzaD.exe
  C:\Windows\System\ZEtVzaD.exe
  2⤵
  PID:2940
- C:\Windows\System\oNlVroU.exe
  C:\Windows\System\oNlVroU.exe
  2⤵
  PID:2740
- C:\Windows\System\hhWmNDz.exe
  C:\Windows\System\hhWmNDz.exe
  2⤵
  PID:2804
- C:\Windows\System\rKaAqRi.exe
  C:\Windows\System\rKaAqRi.exe
  2⤵
  PID:1288
- C:\Windows\System\lNTbxlj.exe
  C:\Windows\System\lNTbxlj.exe
  2⤵
  PID:2176
- C:\Windows\System\XxrHNjt.exe
  C:\Windows\System\XxrHNjt.exe
  2⤵
  PID:2900
- C:\Windows\System\yNfGtDY.exe
  C:\Windows\System\yNfGtDY.exe
  2⤵
  PID:2180
- C:\Windows\System\AyRPzcM.exe
  C:\Windows\System\AyRPzcM.exe
  2⤵
  PID:816
- C:\Windows\System\UYVafPc.exe
  C:\Windows\System\UYVafPc.exe
  2⤵
  PID:2284
- C:\Windows\System\nOAKQob.exe
  C:\Windows\System\nOAKQob.exe
  2⤵
  PID:2044
- C:\Windows\System\xTZxQPL.exe
  C:\Windows\System\xTZxQPL.exe
  2⤵
  PID:1404
- C:\Windows\System\rOUboWB.exe
  C:\Windows\System\rOUboWB.exe
  2⤵
  PID:1008
- C:\Windows\System\gkzAreE.exe
  C:\Windows\System\gkzAreE.exe
  2⤵
  PID:1488
- C:\Windows\System\IavpsnF.exe
  C:\Windows\System\IavpsnF.exe
  2⤵
  PID:1996
- C:\Windows\System\yaJBlPE.exe
  C:\Windows\System\yaJBlPE.exe
  2⤵
  PID:2140
- C:\Windows\System\rsTnjkI.exe
  C:\Windows\System\rsTnjkI.exe
  2⤵
  PID:1600
- C:\Windows\System\lTWwfVY.exe
  C:\Windows\System\lTWwfVY.exe
  2⤵
  PID:2700
- C:\Windows\System\wtVGdcF.exe
  C:\Windows\System\wtVGdcF.exe
  2⤵
  PID:2848
- C:\Windows\System\JHAamFM.exe
  C:\Windows\System\JHAamFM.exe
  2⤵
  PID:2924
- C:\Windows\System\KXRiSAc.exe
  C:\Windows\System\KXRiSAc.exe
  2⤵
  PID:2580
- C:\Windows\System\Ykonsie.exe
  C:\Windows\System\Ykonsie.exe
  2⤵
  PID:3080
- C:\Windows\System\BCCqznY.exe
  C:\Windows\System\BCCqznY.exe
  2⤵
  PID:3096
- C:\Windows\System\FKyySiQ.exe
  C:\Windows\System\FKyySiQ.exe
  2⤵
  PID:3112
- C:\Windows\System\AlBBije.exe
  C:\Windows\System\AlBBije.exe
  2⤵
  PID:3128
- C:\Windows\System\YmHAEMz.exe
  C:\Windows\System\YmHAEMz.exe
  2⤵
  PID:3144
- C:\Windows\System\SbRfetN.exe
  C:\Windows\System\SbRfetN.exe
  2⤵
  PID:3160
- C:\Windows\System\meVuhif.exe
  C:\Windows\System\meVuhif.exe
  2⤵
  PID:3176
- C:\Windows\System\LftdYsS.exe
  C:\Windows\System\LftdYsS.exe
  2⤵
  PID:3192
- C:\Windows\System\arNQLXB.exe
  C:\Windows\System\arNQLXB.exe
  2⤵
  PID:3208
- C:\Windows\System\kBkXkkJ.exe
  C:\Windows\System\kBkXkkJ.exe
  2⤵
  PID:3224
- C:\Windows\System\awtbyDI.exe
  C:\Windows\System\awtbyDI.exe
  2⤵
  PID:3240
- C:\Windows\System\EJJatHi.exe
  C:\Windows\System\EJJatHi.exe
  2⤵
  PID:3256
- C:\Windows\System\DqeWpAG.exe
  C:\Windows\System\DqeWpAG.exe
  2⤵
  PID:3272
- C:\Windows\System\noPaPAQ.exe
  C:\Windows\System\noPaPAQ.exe
  2⤵
  PID:3288
- C:\Windows\System\WTKRScI.exe
  C:\Windows\System\WTKRScI.exe
  2⤵
  PID:3304
- C:\Windows\System\HcOJXOr.exe
  C:\Windows\System\HcOJXOr.exe
  2⤵
  PID:3320
- C:\Windows\System\mfYzROz.exe
  C:\Windows\System\mfYzROz.exe
  2⤵
  PID:3336
- C:\Windows\System\qVAaOVs.exe
  C:\Windows\System\qVAaOVs.exe
  2⤵
  PID:3352
- C:\Windows\System\dtarqxB.exe
  C:\Windows\System\dtarqxB.exe
  2⤵
  PID:3368
- C:\Windows\System\jOxtHpq.exe
  C:\Windows\System\jOxtHpq.exe
  2⤵
  PID:3384
- C:\Windows\System\vxicDKY.exe
  C:\Windows\System\vxicDKY.exe
  2⤵
  PID:3400
- C:\Windows\System\NkIoWze.exe
  C:\Windows\System\NkIoWze.exe
  2⤵
  PID:3416
- C:\Windows\System\nopznRv.exe
  C:\Windows\System\nopznRv.exe
  2⤵
  PID:3432
- C:\Windows\System\DhNhLJd.exe
  C:\Windows\System\DhNhLJd.exe
  2⤵
  PID:3448
- C:\Windows\System\VQDlNRD.exe
  C:\Windows\System\VQDlNRD.exe
  2⤵
  PID:3464
- C:\Windows\System\mIuoFFT.exe
  C:\Windows\System\mIuoFFT.exe
  2⤵
  PID:3480
- C:\Windows\System\YLrBpPP.exe
  C:\Windows\System\YLrBpPP.exe
  2⤵
  PID:3496
- C:\Windows\System\CTomJBA.exe
  C:\Windows\System\CTomJBA.exe
  2⤵
  PID:3512
- C:\Windows\System\rCfYfEx.exe
  C:\Windows\System\rCfYfEx.exe
  2⤵
  PID:3528
- C:\Windows\System\YWwPgBS.exe
  C:\Windows\System\YWwPgBS.exe
  2⤵
  PID:3544
- C:\Windows\System\GVuuhWL.exe
  C:\Windows\System\GVuuhWL.exe
  2⤵
  PID:3560
- C:\Windows\System\OLoThqj.exe
  C:\Windows\System\OLoThqj.exe
  2⤵
  PID:3576
- C:\Windows\System\TlvKkDv.exe
  C:\Windows\System\TlvKkDv.exe
  2⤵
  PID:3592
- C:\Windows\System\bRoXMof.exe
  C:\Windows\System\bRoXMof.exe
  2⤵
  PID:3608
- C:\Windows\System\bKWfgtR.exe
  C:\Windows\System\bKWfgtR.exe
  2⤵
  PID:3624
- C:\Windows\System\fVdmCVU.exe
  C:\Windows\System\fVdmCVU.exe
  2⤵
  PID:3640
- C:\Windows\System\aXdzEPg.exe
  C:\Windows\System\aXdzEPg.exe
  2⤵
  PID:3656
- C:\Windows\System\VVftHIk.exe
  C:\Windows\System\VVftHIk.exe
  2⤵
  PID:3672
- C:\Windows\System\pEEztOx.exe
  C:\Windows\System\pEEztOx.exe
  2⤵
  PID:3688
- C:\Windows\System\ndVMFTc.exe
  C:\Windows\System\ndVMFTc.exe
  2⤵
  PID:3704
- C:\Windows\System\QjiqUbr.exe
  C:\Windows\System\QjiqUbr.exe
  2⤵
  PID:3720
- C:\Windows\System\kHOMkiG.exe
  C:\Windows\System\kHOMkiG.exe
  2⤵
  PID:3736
- C:\Windows\System\zimPhTS.exe
  C:\Windows\System\zimPhTS.exe
  2⤵
  PID:3752
- C:\Windows\System\UsLDGcH.exe
  C:\Windows\System\UsLDGcH.exe
  2⤵
  PID:3768
- C:\Windows\System\yIpiKGx.exe
  C:\Windows\System\yIpiKGx.exe
  2⤵
  PID:3784
- C:\Windows\System\BmEFFXD.exe
  C:\Windows\System\BmEFFXD.exe
  2⤵
  PID:3800
- C:\Windows\System\JETEMOC.exe
  C:\Windows\System\JETEMOC.exe
  2⤵
  PID:3816
- C:\Windows\System\uInIzxg.exe
  C:\Windows\System\uInIzxg.exe
  2⤵
  PID:3832
- C:\Windows\System\ubkJqdc.exe
  C:\Windows\System\ubkJqdc.exe
  2⤵
  PID:3848
- C:\Windows\System\shFMcPw.exe
  C:\Windows\System\shFMcPw.exe
  2⤵
  PID:3864
- C:\Windows\System\BzGMqeC.exe
  C:\Windows\System\BzGMqeC.exe
  2⤵
  PID:3880
- C:\Windows\System\IMAZIaH.exe
  C:\Windows\System\IMAZIaH.exe
  2⤵
  PID:3896
- C:\Windows\System\zgrAvUX.exe
  C:\Windows\System\zgrAvUX.exe
  2⤵
  PID:3912
- C:\Windows\System\kHkabTj.exe
  C:\Windows\System\kHkabTj.exe
  2⤵
  PID:3928
- C:\Windows\System\jlUUWov.exe
  C:\Windows\System\jlUUWov.exe
  2⤵
  PID:3944
- C:\Windows\System\KdKXfOr.exe
  C:\Windows\System\KdKXfOr.exe
  2⤵
  PID:3960
- C:\Windows\System\LJgifuh.exe
  C:\Windows\System\LJgifuh.exe
  2⤵
  PID:3976
- C:\Windows\System\IDQYsNP.exe
  C:\Windows\System\IDQYsNP.exe
  2⤵
  PID:3992
- C:\Windows\System\FqHqUgU.exe
  C:\Windows\System\FqHqUgU.exe
  2⤵
  PID:4008
- C:\Windows\System\bMnFkVQ.exe
  C:\Windows\System\bMnFkVQ.exe
  2⤵
  PID:4024
- C:\Windows\System\upbrFMQ.exe
  C:\Windows\System\upbrFMQ.exe
  2⤵
  PID:4040
- C:\Windows\System\hbRcOfm.exe
  C:\Windows\System\hbRcOfm.exe
  2⤵
  PID:4056
- C:\Windows\System\rjUfNME.exe
  C:\Windows\System\rjUfNME.exe
  2⤵
  PID:4072
- C:\Windows\System\EjpDFRY.exe
  C:\Windows\System\EjpDFRY.exe
  2⤵
  PID:4088
- C:\Windows\System\aLedCIL.exe
  C:\Windows\System\aLedCIL.exe
  2⤵
  PID:1960
- C:\Windows\System\dznBUVO.exe
  C:\Windows\System\dznBUVO.exe
  2⤵
  PID:1560
- C:\Windows\System\RmYFTDP.exe
  C:\Windows\System\RmYFTDP.exe
  2⤵
  PID:2004
- C:\Windows\System\fRqfifq.exe
  C:\Windows\System\fRqfifq.exe
  2⤵
  PID:2096
- C:\Windows\System\ScJatyZ.exe
  C:\Windows\System\ScJatyZ.exe
  2⤵
  PID:1532
- C:\Windows\System\ferkIJI.exe
  C:\Windows\System\ferkIJI.exe
  2⤵
  PID:2716
- C:\Windows\System\rNgOEZC.exe
  C:\Windows\System\rNgOEZC.exe
  2⤵
  PID:2028
- C:\Windows\System\Ruehdua.exe
  C:\Windows\System\Ruehdua.exe
  2⤵
  PID:2736
- C:\Windows\System\lHDpWPc.exe
  C:\Windows\System\lHDpWPc.exe
  2⤵
  PID:3104
- C:\Windows\System\RMenTAD.exe
  C:\Windows\System\RMenTAD.exe
  2⤵
  PID:3120
- C:\Windows\System\AXXKqYe.exe
  C:\Windows\System\AXXKqYe.exe
  2⤵
  PID:3156
- C:\Windows\System\FSCoahu.exe
  C:\Windows\System\FSCoahu.exe
  2⤵
  PID:3200
- C:\Windows\System\qBmZcnE.exe
  C:\Windows\System\qBmZcnE.exe
  2⤵
  PID:3216
- C:\Windows\System\XTlVtmb.exe
  C:\Windows\System\XTlVtmb.exe
  2⤵
  PID:3248
- C:\Windows\System\ZlTYlLw.exe
  C:\Windows\System\ZlTYlLw.exe
  2⤵
  PID:3296
- C:\Windows\System\erhYiTY.exe
  C:\Windows\System\erhYiTY.exe
  2⤵
  PID:3332
- C:\Windows\System\opCLQju.exe
  C:\Windows\System\opCLQju.exe
  2⤵
  PID:3344
- C:\Windows\System\ABsDQDO.exe
  C:\Windows\System\ABsDQDO.exe
  2⤵
  PID:3376
- C:\Windows\System\tuMdpDD.exe
  C:\Windows\System\tuMdpDD.exe
  2⤵
  PID:3392
- C:\Windows\System\pdWzSuh.exe
  C:\Windows\System\pdWzSuh.exe
  2⤵
  PID:3412
- C:\Windows\System\LuCltcR.exe
  C:\Windows\System\LuCltcR.exe
  2⤵
  PID:3444
- C:\Windows\System\GGlXmHC.exe
  C:\Windows\System\GGlXmHC.exe
  2⤵
  PID:3476
- C:\Windows\System\lOCyCYq.exe
  C:\Windows\System\lOCyCYq.exe
  2⤵
  PID:3504
- C:\Windows\System\RnLSmZY.exe
  C:\Windows\System\RnLSmZY.exe
  2⤵
  PID:3536
- C:\Windows\System\CrzHVMm.exe
  C:\Windows\System\CrzHVMm.exe
  2⤵
  PID:3572
- C:\Windows\System\mUjwpDi.exe
  C:\Windows\System\mUjwpDi.exe
  2⤵
  PID:3604
- C:\Windows\System\vLCVAkx.exe
  C:\Windows\System\vLCVAkx.exe
  2⤵
  PID:3652
- C:\Windows\System\tXxVTeZ.exe
  C:\Windows\System\tXxVTeZ.exe
  2⤵
  PID:3668
- C:\Windows\System\wPzYuua.exe
  C:\Windows\System\wPzYuua.exe
  2⤵
  PID:3716
- C:\Windows\System\sBHKAHT.exe
  C:\Windows\System\sBHKAHT.exe
  2⤵
  PID:2916
- C:\Windows\System\XbKtkJk.exe
  C:\Windows\System\XbKtkJk.exe
  2⤵
  PID:3776
- C:\Windows\System\FYSLelG.exe
  C:\Windows\System\FYSLelG.exe
  2⤵
  PID:3812
- C:\Windows\System\lcKLaqu.exe
  C:\Windows\System\lcKLaqu.exe
  2⤵
  PID:3844
- C:\Windows\System\gHHsvoU.exe
  C:\Windows\System\gHHsvoU.exe
  2⤵
  PID:3876
- C:\Windows\System\CFmmMlr.exe
  C:\Windows\System\CFmmMlr.exe
  2⤵
  PID:3908
- C:\Windows\System\zmEFmcw.exe
  C:\Windows\System\zmEFmcw.exe
  2⤵
  PID:3924
- C:\Windows\System\VBdNwbs.exe
  C:\Windows\System\VBdNwbs.exe
  2⤵
  PID:3956
- C:\Windows\System\DjBwuRZ.exe
  C:\Windows\System\DjBwuRZ.exe
  2⤵
  PID:3988
- C:\Windows\System\bYZjmnS.exe
  C:\Windows\System\bYZjmnS.exe
  2⤵
  PID:4020
- C:\Windows\System\NHFdNIQ.exe
  C:\Windows\System\NHFdNIQ.exe
  2⤵
  PID:4052
- C:\Windows\System\dSOXqCi.exe
  C:\Windows\System\dSOXqCi.exe
  2⤵
  PID:1804
- C:\Windows\System\gBrKPDM.exe
  C:\Windows\System\gBrKPDM.exe
  2⤵
  PID:1000
- C:\Windows\System\iBEdelN.exe
  C:\Windows\System\iBEdelN.exe
  2⤵
  PID:2352
- C:\Windows\System\ZQCzYik.exe
  C:\Windows\System\ZQCzYik.exe
  2⤵
  PID:2280
- C:\Windows\System\hdMuWlD.exe
  C:\Windows\System\hdMuWlD.exe
  2⤵
  PID:2224
- C:\Windows\System\XcVleox.exe
  C:\Windows\System\XcVleox.exe
  2⤵
  PID:3140
- C:\Windows\System\ehYgyMi.exe
  C:\Windows\System\ehYgyMi.exe
  2⤵
  PID:2552
- C:\Windows\System\HUracgI.exe
  C:\Windows\System\HUracgI.exe
  2⤵
  PID:3236
- C:\Windows\System\nVOHCkY.exe
  C:\Windows\System\nVOHCkY.exe
  2⤵
  PID:3312
- C:\Windows\System\zuxFIPB.exe
  C:\Windows\System\zuxFIPB.exe
  2⤵
  PID:2784
- C:\Windows\System\LFvnpeE.exe
  C:\Windows\System\LFvnpeE.exe
  2⤵
  PID:3408
- C:\Windows\System\dFQHixh.exe
  C:\Windows\System\dFQHixh.exe
  2⤵
  PID:3472
- C:\Windows\System\YyZsyXj.exe
  C:\Windows\System\YyZsyXj.exe
  2⤵
  PID:3524
- C:\Windows\System\kAeIvzV.exe
  C:\Windows\System\kAeIvzV.exe
  2⤵
  PID:3584
- C:\Windows\System\yMLeUsR.exe
  C:\Windows\System\yMLeUsR.exe
  2⤵
  PID:3648
- C:\Windows\System\ArTCfSz.exe
  C:\Windows\System\ArTCfSz.exe
  2⤵
  PID:3700
- C:\Windows\System\ihTtuDM.exe
  C:\Windows\System\ihTtuDM.exe
  2⤵
  PID:3764
- C:\Windows\System\LmtaVHH.exe
  C:\Windows\System\LmtaVHH.exe
  2⤵
  PID:3808
- C:\Windows\System\kyvVtHH.exe
  C:\Windows\System\kyvVtHH.exe
  2⤵
  PID:3872
- C:\Windows\System\GglfvCD.exe
  C:\Windows\System\GglfvCD.exe
  2⤵
  PID:3936
- C:\Windows\System\BZHRwuC.exe
  C:\Windows\System\BZHRwuC.exe
  2⤵
  PID:4000
- C:\Windows\System\Xwizhwb.exe
  C:\Windows\System\Xwizhwb.exe
  2⤵
  PID:4064
- C:\Windows\System\PNbXVEl.exe
  C:\Windows\System\PNbXVEl.exe
  2⤵
  PID:2468
- C:\Windows\System\BplGday.exe
  C:\Windows\System\BplGday.exe
  2⤵
  PID:2896
- C:\Windows\System\UpOsdAX.exe
  C:\Windows\System\UpOsdAX.exe
  2⤵
  PID:3184
- C:\Windows\System\AJkCGzd.exe
  C:\Windows\System\AJkCGzd.exe
  2⤵
  PID:3220
- C:\Windows\System\qWghvOF.exe
  C:\Windows\System\qWghvOF.exe
  2⤵
  PID:3380
- C:\Windows\System\psIfpdF.exe
  C:\Windows\System\psIfpdF.exe
  2⤵
  PID:3488
- C:\Windows\System\DDzXzQE.exe
  C:\Windows\System\DDzXzQE.exe
  2⤵
  PID:3600
- C:\Windows\System\BfWmQXq.exe
  C:\Windows\System\BfWmQXq.exe
  2⤵
  PID:3696
- C:\Windows\System\mFeRMEd.exe
  C:\Windows\System\mFeRMEd.exe
  2⤵
  PID:1168
- C:\Windows\System\SwSYBjf.exe
  C:\Windows\System\SwSYBjf.exe
  2⤵
  PID:3920
- C:\Windows\System\YMJYLRm.exe
  C:\Windows\System\YMJYLRm.exe
  2⤵
  PID:4032
- C:\Windows\System\gVbDrdm.exe
  C:\Windows\System\gVbDrdm.exe
  2⤵
  PID:2188
- C:\Windows\System\PiGvZmn.exe
  C:\Windows\System\PiGvZmn.exe
  2⤵
  PID:2832
- C:\Windows\System\tfFCEwp.exe
  C:\Windows\System\tfFCEwp.exe
  2⤵
  PID:3188
- C:\Windows\System\QpoOUif.exe
  C:\Windows\System\QpoOUif.exe
  2⤵
  PID:3520
- C:\Windows\System\HbYGYpt.exe
  C:\Windows\System\HbYGYpt.exe
  2⤵
  PID:3732
- C:\Windows\System\dhLGfRk.exe
  C:\Windows\System\dhLGfRk.exe
  2⤵
  PID:1616
- C:\Windows\System\YoCSRQa.exe
  C:\Windows\System\YoCSRQa.exe
  2⤵
  PID:4084
- C:\Windows\System\ZqFckTo.exe
  C:\Windows\System\ZqFckTo.exe
  2⤵
  PID:4048
- C:\Windows\System\EXyyxFB.exe
  C:\Windows\System\EXyyxFB.exe
  2⤵
  PID:912
- C:\Windows\System\GSEQTHI.exe
  C:\Windows\System\GSEQTHI.exe
  2⤵
  PID:4100
- C:\Windows\System\vMJFnkn.exe
  C:\Windows\System\vMJFnkn.exe
  2⤵
  PID:4116
- C:\Windows\System\BhVkOec.exe
  C:\Windows\System\BhVkOec.exe
  2⤵
  PID:4132
- C:\Windows\System\WyjXfQe.exe
  C:\Windows\System\WyjXfQe.exe
  2⤵
  PID:4148
- C:\Windows\System\mSKfiOG.exe
  C:\Windows\System\mSKfiOG.exe
  2⤵
  PID:4164
- C:\Windows\System\iPfnCFZ.exe
  C:\Windows\System\iPfnCFZ.exe
  2⤵
  PID:4188
- C:\Windows\System\rZInDsB.exe
  C:\Windows\System\rZInDsB.exe
  2⤵
  PID:4204
- C:\Windows\System\cpSTKUi.exe
  C:\Windows\System\cpSTKUi.exe
  2⤵
  PID:4220
- C:\Windows\System\ObuNCwq.exe
  C:\Windows\System\ObuNCwq.exe
  2⤵
  PID:4236
- C:\Windows\System\henRnBJ.exe
  C:\Windows\System\henRnBJ.exe
  2⤵
  PID:4252
- C:\Windows\System\CFfXkfQ.exe
  C:\Windows\System\CFfXkfQ.exe
  2⤵
  PID:4268
- C:\Windows\System\oMrtqzs.exe
  C:\Windows\System\oMrtqzs.exe
  2⤵
  PID:4284
- C:\Windows\System\mbIycIa.exe
  C:\Windows\System\mbIycIa.exe
  2⤵
  PID:4300
- C:\Windows\System\fqLpssX.exe
  C:\Windows\System\fqLpssX.exe
  2⤵
  PID:4316
- C:\Windows\System\zzqwmvL.exe
  C:\Windows\System\zzqwmvL.exe
  2⤵
  PID:4332
- C:\Windows\System\cadhfEy.exe
  C:\Windows\System\cadhfEy.exe
  2⤵
  PID:4348
- C:\Windows\System\AvQLjrV.exe
  C:\Windows\System\AvQLjrV.exe
  2⤵
  PID:4364
- C:\Windows\System\cXJAYEy.exe
  C:\Windows\System\cXJAYEy.exe
  2⤵
  PID:4380
- C:\Windows\System\jhwBPGh.exe
  C:\Windows\System\jhwBPGh.exe
  2⤵
  PID:4396
- C:\Windows\System\gBBUngo.exe
  C:\Windows\System\gBBUngo.exe
  2⤵
  PID:4412
- C:\Windows\System\vVVBIcA.exe
  C:\Windows\System\vVVBIcA.exe
  2⤵
  PID:4428
- C:\Windows\System\kgRBWZm.exe
  C:\Windows\System\kgRBWZm.exe
  2⤵
  PID:4444
- C:\Windows\System\Gsziefo.exe
  C:\Windows\System\Gsziefo.exe
  2⤵
  PID:4460
- C:\Windows\System\atUiWXo.exe
  C:\Windows\System\atUiWXo.exe
  2⤵
  PID:4476
- C:\Windows\System\EMsQSIc.exe
  C:\Windows\System\EMsQSIc.exe
  2⤵
  PID:4492
- C:\Windows\System\mZVzHiM.exe
  C:\Windows\System\mZVzHiM.exe
  2⤵
  PID:4508
- C:\Windows\System\xkSttDq.exe
  C:\Windows\System\xkSttDq.exe
  2⤵
  PID:4524
- C:\Windows\System\BAPBoWC.exe
  C:\Windows\System\BAPBoWC.exe
  2⤵
  PID:4540
- C:\Windows\System\qwHvAGj.exe
  C:\Windows\System\qwHvAGj.exe
  2⤵
  PID:4556
- C:\Windows\System\KeOHhac.exe
  C:\Windows\System\KeOHhac.exe
  2⤵
  PID:4572
- C:\Windows\System\NGSiMcw.exe
  C:\Windows\System\NGSiMcw.exe
  2⤵
  PID:4588
- C:\Windows\System\MJJPQrD.exe
  C:\Windows\System\MJJPQrD.exe
  2⤵
  PID:4604
- C:\Windows\System\GnFGupo.exe
  C:\Windows\System\GnFGupo.exe
  2⤵
  PID:4620
- C:\Windows\System\puBiqba.exe
  C:\Windows\System\puBiqba.exe
  2⤵
  PID:4636
- C:\Windows\System\TWmqRjZ.exe
  C:\Windows\System\TWmqRjZ.exe
  2⤵
  PID:4652
- C:\Windows\System\lMhdySm.exe
  C:\Windows\System\lMhdySm.exe
  2⤵
  PID:4668
- C:\Windows\System\IAMvBVU.exe
  C:\Windows\System\IAMvBVU.exe
  2⤵
  PID:4684
- C:\Windows\System\YlTgaik.exe
  C:\Windows\System\YlTgaik.exe
  2⤵
  PID:4700
- C:\Windows\System\hxmBXKe.exe
  C:\Windows\System\hxmBXKe.exe
  2⤵
  PID:4716
- C:\Windows\System\QKcuVgf.exe
  C:\Windows\System\QKcuVgf.exe
  2⤵
  PID:4732
- C:\Windows\System\zCcHYDa.exe
  C:\Windows\System\zCcHYDa.exe
  2⤵
  PID:4748
- C:\Windows\System\OnDFYKV.exe
  C:\Windows\System\OnDFYKV.exe
  2⤵
  PID:4764
- C:\Windows\System\evWZjTd.exe
  C:\Windows\System\evWZjTd.exe
  2⤵
  PID:4780
- C:\Windows\System\ZZMHOTk.exe
  C:\Windows\System\ZZMHOTk.exe
  2⤵
  PID:4796
- C:\Windows\System\tYRyAHU.exe
  C:\Windows\System\tYRyAHU.exe
  2⤵
  PID:4812
- C:\Windows\System\nwEckjh.exe
  C:\Windows\System\nwEckjh.exe
  2⤵
  PID:4828
- C:\Windows\System\XceHqmK.exe
  C:\Windows\System\XceHqmK.exe
  2⤵
  PID:4844
- C:\Windows\System\RqLVTQp.exe
  C:\Windows\System\RqLVTQp.exe
  2⤵
  PID:4860
- C:\Windows\System\KegeATW.exe
  C:\Windows\System\KegeATW.exe
  2⤵
  PID:4876
- C:\Windows\System\sDcyylz.exe
  C:\Windows\System\sDcyylz.exe
  2⤵
  PID:4892
- C:\Windows\System\CMsSgxr.exe
  C:\Windows\System\CMsSgxr.exe
  2⤵
  PID:4908
- C:\Windows\System\KtaYnff.exe
  C:\Windows\System\KtaYnff.exe
  2⤵
  PID:4924
- C:\Windows\System\fjwGYyG.exe
  C:\Windows\System\fjwGYyG.exe
  2⤵
  PID:4940
- C:\Windows\System\AjpJGQV.exe
  C:\Windows\System\AjpJGQV.exe
  2⤵
  PID:4956
- C:\Windows\System\nkBeWcb.exe
  C:\Windows\System\nkBeWcb.exe
  2⤵
  PID:4972
- C:\Windows\System\tIToiJS.exe
  C:\Windows\System\tIToiJS.exe
  2⤵
  PID:4988
- C:\Windows\System\BNaQeeo.exe
  C:\Windows\System\BNaQeeo.exe
  2⤵
  PID:5004
- C:\Windows\System\ujVchpq.exe
  C:\Windows\System\ujVchpq.exe
  2⤵
  PID:5020
- C:\Windows\System\EDyarNf.exe
  C:\Windows\System\EDyarNf.exe
  2⤵
  PID:5036
- C:\Windows\System\DxBHSaK.exe
  C:\Windows\System\DxBHSaK.exe
  2⤵
  PID:5052
- C:\Windows\System\QbWyenS.exe
  C:\Windows\System\QbWyenS.exe
  2⤵
  PID:5068
- C:\Windows\System\InTGpYq.exe
  C:\Windows\System\InTGpYq.exe
  2⤵
  PID:5084
- C:\Windows\System\iDleDAk.exe
  C:\Windows\System\iDleDAk.exe
  2⤵
  PID:5100
- C:\Windows\System\mXforqq.exe
  C:\Windows\System\mXforqq.exe
  2⤵
  PID:4124
- C:\Windows\System\iyMQjAk.exe
  C:\Windows\System\iyMQjAk.exe
  2⤵
  PID:4112
- C:\Windows\System\qPJsLAs.exe
  C:\Windows\System\qPJsLAs.exe
  2⤵
  PID:1728
- C:\Windows\System\aBQWDHM.exe
  C:\Windows\System\aBQWDHM.exe
  2⤵
  PID:4200
- C:\Windows\System\HzHXvox.exe
  C:\Windows\System\HzHXvox.exe
  2⤵
  PID:4244
- C:\Windows\System\sTBbekr.exe
  C:\Windows\System\sTBbekr.exe
  2⤵
  PID:1932
- C:\Windows\System\NRrmpda.exe
  C:\Windows\System\NRrmpda.exe
  2⤵
  PID:2416
- C:\Windows\System\UbeTLWb.exe
  C:\Windows\System\UbeTLWb.exe
  2⤵
  PID:4312
- C:\Windows\System\bReRqpb.exe
  C:\Windows\System\bReRqpb.exe
  2⤵
  PID:4344
- C:\Windows\System\maEzbBO.exe
  C:\Windows\System\maEzbBO.exe
  2⤵
  PID:4392
- C:\Windows\System\tKOCxFx.exe
  C:\Windows\System\tKOCxFx.exe
  2⤵
  PID:4408
- C:\Windows\System\eypVPBQ.exe
  C:\Windows\System\eypVPBQ.exe
  2⤵
  PID:4436
- C:\Windows\System\Qqnpqxj.exe
  C:\Windows\System\Qqnpqxj.exe
  2⤵
  PID:4488
- C:\Windows\System\QFOmDDJ.exe
  C:\Windows\System\QFOmDDJ.exe
  2⤵
  PID:4504
- C:\Windows\System\OqAmpeo.exe
  C:\Windows\System\OqAmpeo.exe
  2⤵
  PID:4552
- C:\Windows\System\SFDmlFg.exe
  C:\Windows\System\SFDmlFg.exe
  2⤵
  PID:4580
- C:\Windows\System\ebWwLTQ.exe
  C:\Windows\System\ebWwLTQ.exe
  2⤵
  PID:4596
- C:\Windows\System\nYLEvmi.exe
  C:\Windows\System\nYLEvmi.exe
  2⤵
  PID:4628
- C:\Windows\System\gsUMgrQ.exe
  C:\Windows\System\gsUMgrQ.exe
  2⤵
  PID:4660
- C:\Windows\System\LbyAGZH.exe
  C:\Windows\System\LbyAGZH.exe
  2⤵
  PID:4692
- C:\Windows\System\eimkSQr.exe
  C:\Windows\System\eimkSQr.exe
  2⤵
  PID:4724
- C:\Windows\System\tQoFKMM.exe
  C:\Windows\System\tQoFKMM.exe
  2⤵
  PID:4756
- C:\Windows\System\NmDUmeB.exe
  C:\Windows\System\NmDUmeB.exe
  2⤵
  PID:4760
- C:\Windows\System\neKBkFA.exe
  C:\Windows\System\neKBkFA.exe
  2⤵
  PID:4792
- C:\Windows\System\KjIJKPU.exe
  C:\Windows\System\KjIJKPU.exe
  2⤵
  PID:4824
- C:\Windows\System\ieFLcEG.exe
  C:\Windows\System\ieFLcEG.exe
  2⤵
  PID:3440
- C:\Windows\System\yNtgRUv.exe
  C:\Windows\System\yNtgRUv.exe
  2⤵
  PID:4216
- C:\Windows\System\ItgyVaP.exe
  C:\Windows\System\ItgyVaP.exe
  2⤵
  PID:4340
- C:\Windows\System\LlqapCX.exe
  C:\Windows\System\LlqapCX.exe
  2⤵
  PID:1820
- C:\Windows\System\XEydrwG.exe
  C:\Windows\System\XEydrwG.exe
  2⤵
  PID:4160
- C:\Windows\System\bqELXNu.exe
  C:\Windows\System\bqELXNu.exe
  2⤵
  PID:4264
- C:\Windows\System\GjqCsCG.exe
  C:\Windows\System\GjqCsCG.exe
  2⤵
  PID:4388
- C:\Windows\System\fJkdrei.exe
  C:\Windows\System\fJkdrei.exe
  2⤵
  PID:4516
- C:\Windows\System\EloqthQ.exe
  C:\Windows\System\EloqthQ.exe
  2⤵
  PID:4600
- C:\Windows\System\qzQJtVT.exe
  C:\Windows\System\qzQJtVT.exe
  2⤵
  PID:4728
- C:\Windows\System\hzOYleT.exe
  C:\Windows\System\hzOYleT.exe
  2⤵
  PID:4852
- C:\Windows\System\iVZYfuL.exe
  C:\Windows\System\iVZYfuL.exe
  2⤵
  PID:4964
- C:\Windows\System\EONiLxA.exe
  C:\Windows\System\EONiLxA.exe
  2⤵
  PID:4980
- C:\Windows\System\aGPcaOa.exe
  C:\Windows\System\aGPcaOa.exe
  2⤵
  PID:5012
- C:\Windows\System\IBClGbU.exe
  C:\Windows\System\IBClGbU.exe
  2⤵
  PID:5080
- C:\Windows\System\bMvcdJJ.exe
  C:\Windows\System\bMvcdJJ.exe
  2⤵
  PID:4468
- C:\Windows\System\TtKHptc.exe
  C:\Windows\System\TtKHptc.exe
  2⤵
  PID:2608
- C:\Windows\System\WuTQHzu.exe
  C:\Windows\System\WuTQHzu.exe
  2⤵
  PID:4156
- C:\Windows\System\yCcsRQR.exe
  C:\Windows\System\yCcsRQR.exe
  2⤵
  PID:4584
- C:\Windows\System\DtITGQr.exe
  C:\Windows\System\DtITGQr.exe
  2⤵
  PID:4872
- C:\Windows\System\WQDXoho.exe
  C:\Windows\System\WQDXoho.exe
  2⤵
  PID:3060
- C:\Windows\System\QhiYfXV.exe
  C:\Windows\System\QhiYfXV.exe
  2⤵
  PID:2780
- C:\Windows\System\hqUTKZg.exe
  C:\Windows\System\hqUTKZg.exe
  2⤵
  PID:4952
- C:\Windows\System\AUmHhZf.exe
  C:\Windows\System\AUmHhZf.exe
  2⤵
  PID:5076
- C:\Windows\System\zVNTohr.exe
  C:\Windows\System\zVNTohr.exe
  2⤵
  PID:3032
- C:\Windows\System\GaJHNys.exe
  C:\Windows\System\GaJHNys.exe
  2⤵
  PID:4744
- C:\Windows\System\bmooWaQ.exe
  C:\Windows\System\bmooWaQ.exe
  2⤵
  PID:4888
- C:\Windows\System\AWfCHAc.exe
  C:\Windows\System\AWfCHAc.exe
  2⤵
  PID:4920
- C:\Windows\System\rbAOcsN.exe
  C:\Windows\System\rbAOcsN.exe
  2⤵
  PID:5116
- C:\Windows\System\RsHlLcJ.exe
  C:\Windows\System\RsHlLcJ.exe
  2⤵
  PID:4372
- C:\Windows\System\OreOgJr.exe
  C:\Windows\System\OreOgJr.exe
  2⤵
  PID:3556
- C:\Windows\System\RYrleNH.exe
  C:\Windows\System\RYrleNH.exe
  2⤵
  PID:5028
- C:\Windows\System\zroNgXD.exe
  C:\Windows\System\zroNgXD.exe
  2⤵
  PID:4904
- C:\Windows\System\DTOjPQb.exe
  C:\Windows\System\DTOjPQb.exe
  2⤵
  PID:5060
- C:\Windows\System\uyTFDng.exe
  C:\Windows\System\uyTFDng.exe
  2⤵
  PID:5136
- C:\Windows\System\PHTMmJy.exe
  C:\Windows\System\PHTMmJy.exe
  2⤵
  PID:5152
- C:\Windows\System\RmoNYYt.exe
  C:\Windows\System\RmoNYYt.exe
  2⤵
  PID:5168
- C:\Windows\System\mzXZccS.exe
  C:\Windows\System\mzXZccS.exe
  2⤵
  PID:5184
- C:\Windows\System\EcuggWk.exe
  C:\Windows\System\EcuggWk.exe
  2⤵
  PID:5200
- C:\Windows\System\XYclJXH.exe
  C:\Windows\System\XYclJXH.exe
  2⤵
  PID:5216
- C:\Windows\System\bBqxCfD.exe
  C:\Windows\System\bBqxCfD.exe
  2⤵
  PID:5232
- C:\Windows\System\dKmItiA.exe
  C:\Windows\System\dKmItiA.exe
  2⤵
  PID:5248
- C:\Windows\System\sbNXpXt.exe
  C:\Windows\System\sbNXpXt.exe
  2⤵
  PID:5268
- C:\Windows\System\AHbIBss.exe
  C:\Windows\System\AHbIBss.exe
  2⤵
  PID:5284
- C:\Windows\System\VeIduCN.exe
  C:\Windows\System\VeIduCN.exe
  2⤵
  PID:5300
- C:\Windows\System\WQSrpEl.exe
  C:\Windows\System\WQSrpEl.exe
  2⤵
  PID:5316
- C:\Windows\System\awJTJZg.exe
  C:\Windows\System\awJTJZg.exe
  2⤵
  PID:5332
- C:\Windows\System\JVMozqe.exe
  C:\Windows\System\JVMozqe.exe
  2⤵
  PID:5352
- C:\Windows\System\lhSQBUO.exe
  C:\Windows\System\lhSQBUO.exe
  2⤵
  PID:5368
- C:\Windows\System\lwScdbb.exe
  C:\Windows\System\lwScdbb.exe
  2⤵
  PID:5384
- C:\Windows\System\pDbFiio.exe
  C:\Windows\System\pDbFiio.exe
  2⤵
  PID:5400
- C:\Windows\System\cNRahYe.exe
  C:\Windows\System\cNRahYe.exe
  2⤵
  PID:5420
- C:\Windows\System\jJjFXWd.exe
  C:\Windows\System\jJjFXWd.exe
  2⤵
  PID:5436
- C:\Windows\System\wgPCjQH.exe
  C:\Windows\System\wgPCjQH.exe
  2⤵
  PID:5452
- C:\Windows\System\EmKMdZs.exe
  C:\Windows\System\EmKMdZs.exe
  2⤵
  PID:5488
- C:\Windows\System\qKqdfWc.exe
  C:\Windows\System\qKqdfWc.exe
  2⤵
  PID:5508
- C:\Windows\System\WNfdWUe.exe
  C:\Windows\System\WNfdWUe.exe
  2⤵
  PID:5524
- C:\Windows\System\xdvVqih.exe
  C:\Windows\System\xdvVqih.exe
  2⤵
  PID:5540
- C:\Windows\System\BOUROEi.exe
  C:\Windows\System\BOUROEi.exe
  2⤵
  PID:5556
- C:\Windows\System\orjlYnV.exe
  C:\Windows\System\orjlYnV.exe
  2⤵
  PID:5572
- C:\Windows\System\VsGoIXR.exe
  C:\Windows\System\VsGoIXR.exe
  2⤵
  PID:5592
- C:\Windows\System\xNZBvSV.exe
  C:\Windows\System\xNZBvSV.exe
  2⤵
  PID:5608
- C:\Windows\System\ULpAlRQ.exe
  C:\Windows\System\ULpAlRQ.exe
  2⤵
  PID:5632
- C:\Windows\System\ReffVDi.exe
  C:\Windows\System\ReffVDi.exe
  2⤵
  PID:5740
- C:\Windows\System\pAvjrSH.exe
  C:\Windows\System\pAvjrSH.exe
  2⤵
  PID:5760
- C:\Windows\System\LQjqQfy.exe
  C:\Windows\System\LQjqQfy.exe
  2⤵
  PID:5776
- C:\Windows\System\xTsCxkt.exe
  C:\Windows\System\xTsCxkt.exe
  2⤵
  PID:5792
- C:\Windows\System\tZOsAwG.exe
  C:\Windows\System\tZOsAwG.exe
  2⤵
  PID:5812
- C:\Windows\System\jOIhWRN.exe
  C:\Windows\System\jOIhWRN.exe
  2⤵
  PID:5828
- C:\Windows\System\ifehIzV.exe
  C:\Windows\System\ifehIzV.exe
  2⤵
  PID:5844
- C:\Windows\System\AMgfCdk.exe
  C:\Windows\System\AMgfCdk.exe
  2⤵
  PID:5860
- C:\Windows\System\JAOdzFO.exe
  C:\Windows\System\JAOdzFO.exe
  2⤵
  PID:5876
- C:\Windows\System\Xylreiq.exe
  C:\Windows\System\Xylreiq.exe
  2⤵
  PID:5928
- C:\Windows\System\zTTFuZu.exe
  C:\Windows\System\zTTFuZu.exe
  2⤵
  PID:5972
- C:\Windows\System\YShIgEf.exe
  C:\Windows\System\YShIgEf.exe
  2⤵
  PID:5988
- C:\Windows\System\roqDyDz.exe
  C:\Windows\System\roqDyDz.exe
  2⤵
  PID:6004
- C:\Windows\System\ZGBodAB.exe
  C:\Windows\System\ZGBodAB.exe
  2⤵
  PID:6024
- C:\Windows\System\GcJzOlO.exe
  C:\Windows\System\GcJzOlO.exe
  2⤵
  PID:6044
- C:\Windows\System\wYApLdl.exe
  C:\Windows\System\wYApLdl.exe
  2⤵
  PID:6060
- C:\Windows\System\AkglixA.exe
  C:\Windows\System\AkglixA.exe
  2⤵
  PID:6076
- C:\Windows\System\aUdXhRA.exe
  C:\Windows\System\aUdXhRA.exe
  2⤵
  PID:6092
- C:\Windows\System\GoMEkSO.exe
  C:\Windows\System\GoMEkSO.exe
  2⤵
  PID:6108
- C:\Windows\System\HPayEhy.exe
  C:\Windows\System\HPayEhy.exe
  2⤵
  PID:6124
- C:\Windows\System\tFEkXat.exe
  C:\Windows\System\tFEkXat.exe
  2⤵
  PID:6140
- C:\Windows\System\YHLzQIt.exe
  C:\Windows\System\YHLzQIt.exe
  2⤵
  PID:5128
- C:\Windows\System\KvTzvHi.exe
  C:\Windows\System\KvTzvHi.exe
  2⤵
  PID:5192
- C:\Windows\System\IXzsvOy.exe
  C:\Windows\System\IXzsvOy.exe
  2⤵
  PID:5256
- C:\Windows\System\Jrgcryd.exe
  C:\Windows\System\Jrgcryd.exe
  2⤵
  PID:5296
- C:\Windows\System\goMBuRm.exe
  C:\Windows\System\goMBuRm.exe
  2⤵
  PID:5392
- C:\Windows\System\hQqonAR.exe
  C:\Windows\System\hQqonAR.exe
  2⤵
  PID:5460
- C:\Windows\System\qHeZXOm.exe
  C:\Windows\System\qHeZXOm.exe
  2⤵
  PID:5480
- C:\Windows\System\uHqCdbT.exe
  C:\Windows\System\uHqCdbT.exe
  2⤵
  PID:4712
- C:\Windows\System\YYUBoFQ.exe
  C:\Windows\System\YYUBoFQ.exe
  2⤵
  PID:4840
- C:\Windows\System\riYEfQV.exe
  C:\Windows\System\riYEfQV.exe
  2⤵
  PID:4292
- C:\Windows\System\mmLeYQH.exe
  C:\Windows\System\mmLeYQH.exe
  2⤵
  PID:4296
- C:\Windows\System\OClDlcF.exe
  C:\Windows\System\OClDlcF.exe
  2⤵
  PID:4808
- C:\Windows\System\qwOzlWq.exe
  C:\Windows\System\qwOzlWq.exe
  2⤵
  PID:2956
- C:\Windows\System\gGEbkEP.exe
  C:\Windows\System\gGEbkEP.exe
  2⤵
  PID:5624
- C:\Windows\System\qbLqPAe.exe
  C:\Windows\System\qbLqPAe.exe
  2⤵
  PID:5240
- C:\Windows\System\fRxCcud.exe
  C:\Windows\System\fRxCcud.exe
  2⤵
  PID:5308
- C:\Windows\System\sKlbfSJ.exe
  C:\Windows\System\sKlbfSJ.exe
  2⤵
  PID:5348
- C:\Windows\System\SlKfcQX.exe
  C:\Windows\System\SlKfcQX.exe
  2⤵
  PID:5412
- C:\Windows\System\KtUbnWL.exe
  C:\Windows\System\KtUbnWL.exe
  2⤵
  PID:5496
- C:\Windows\System\dLUpnEW.exe
  C:\Windows\System\dLUpnEW.exe
  2⤵
  PID:5536
- C:\Windows\System\koFGKnl.exe
  C:\Windows\System\koFGKnl.exe
  2⤵
  PID:5604
- C:\Windows\System\jggIApr.exe
  C:\Windows\System\jggIApr.exe
  2⤵
  PID:4916
- C:\Windows\System\FfaevIg.exe
  C:\Windows\System\FfaevIg.exe
  2⤵
  PID:2604
- C:\Windows\System\ZmhaRHB.exe
  C:\Windows\System\ZmhaRHB.exe
  2⤵
  PID:5652
- C:\Windows\System\EfhuKnB.exe
  C:\Windows\System\EfhuKnB.exe
  2⤵
  PID:2228
- C:\Windows\System\KlQzJDx.exe
  C:\Windows\System\KlQzJDx.exe
  2⤵
  PID:5680
- C:\Windows\System\DVhMFuF.exe
  C:\Windows\System\DVhMFuF.exe
  2⤵
  PID:5696
- C:\Windows\System\JwpDguh.exe
  C:\Windows\System\JwpDguh.exe
  2⤵
  PID:5720
- C:\Windows\System\JISTxoM.exe
  C:\Windows\System\JISTxoM.exe
  2⤵
  PID:532
- C:\Windows\System\RvcKsft.exe
  C:\Windows\System\RvcKsft.exe
  2⤵
  PID:5752
- C:\Windows\System\JrAgBma.exe
  C:\Windows\System\JrAgBma.exe
  2⤵
  PID:5824
- C:\Windows\System\UCkTtdI.exe
  C:\Windows\System\UCkTtdI.exe
  2⤵
  PID:5856
- C:\Windows\System\gqPGLIi.exe
  C:\Windows\System\gqPGLIi.exe
  2⤵
  PID:5800
- C:\Windows\System\TXSAQyy.exe
  C:\Windows\System\TXSAQyy.exe
  2⤵
  PID:5840
- C:\Windows\System\LgBXgmy.exe
  C:\Windows\System\LgBXgmy.exe
  2⤵
  PID:2060
- C:\Windows\System\kLGBDMZ.exe
  C:\Windows\System\kLGBDMZ.exe
  2⤵
  PID:908
- C:\Windows\System\NiInHOV.exe
  C:\Windows\System\NiInHOV.exe
  2⤵
  PID:5900
- C:\Windows\System\alDHTMZ.exe
  C:\Windows\System\alDHTMZ.exe
  2⤵
  PID:5888
- C:\Windows\System\VDQZSmT.exe
  C:\Windows\System\VDQZSmT.exe
  2⤵
  PID:2664
- C:\Windows\System\SsSjDyu.exe
  C:\Windows\System\SsSjDyu.exe
  2⤵
  PID:6088
- C:\Windows\System\MfPqCSK.exe
  C:\Windows\System\MfPqCSK.exe
  2⤵
  PID:5164
- C:\Windows\System\rjKFIee.exe
  C:\Windows\System\rjKFIee.exe
  2⤵
  PID:5360
- C:\Windows\System\SwJtAHL.exe
  C:\Windows\System\SwJtAHL.exe
  2⤵
  PID:5476
- C:\Windows\System\djRTByN.exe
  C:\Windows\System\djRTByN.exe
  2⤵
  PID:5580
- C:\Windows\System\nhWLpmP.exe
  C:\Windows\System\nhWLpmP.exe
  2⤵
  PID:5428
- C:\Windows\System\oQiwCQP.exe
  C:\Windows\System\oQiwCQP.exe
  2⤵
  PID:4820
- C:\Windows\System\dPMwtVQ.exe
  C:\Windows\System\dPMwtVQ.exe
  2⤵
  PID:5276
- C:\Windows\System\rpgrBPB.exe
  C:\Windows\System\rpgrBPB.exe
  2⤵
  PID:5504
- C:\Windows\System\lisYZSC.exe
  C:\Windows\System\lisYZSC.exe
  2⤵
  PID:5208
- C:\Windows\System\blaGOsp.exe
  C:\Windows\System\blaGOsp.exe
  2⤵
  PID:5600
- C:\Windows\System\KMLMyaU.exe
  C:\Windows\System\KMLMyaU.exe
  2⤵
  PID:2808
- C:\Windows\System\ovkAXjT.exe
  C:\Windows\System\ovkAXjT.exe
  2⤵
  PID:4500
- C:\Windows\System\ayeQmCU.exe
  C:\Windows\System\ayeQmCU.exe
  2⤵
  PID:5144
- C:\Windows\System\rPYhdrJ.exe
  C:\Windows\System\rPYhdrJ.exe
  2⤵
  PID:2036
- C:\Windows\System\SOECgiM.exe
  C:\Windows\System\SOECgiM.exe
  2⤵
  PID:1656
- C:\Windows\System\AswrbzO.exe
  C:\Windows\System\AswrbzO.exe
  2⤵
  PID:5176
- C:\Windows\System\lYwFTrP.exe
  C:\Windows\System\lYwFTrP.exe
  2⤵
  PID:5692
- C:\Windows\System\BbnteTO.exe
  C:\Windows\System\BbnteTO.exe
  2⤵
  PID:5736
- C:\Windows\System\fbfjeZk.exe
  C:\Windows\System\fbfjeZk.exe
  2⤵
  PID:5820
- C:\Windows\System\TNVhLBo.exe
  C:\Windows\System\TNVhLBo.exe
  2⤵
  PID:5788
- C:\Windows\System\Wylsamo.exe
  C:\Windows\System\Wylsamo.exe
  2⤵
  PID:5772
- C:\Windows\System\mbGosOd.exe
  C:\Windows\System\mbGosOd.exe
  2⤵
  PID:5836
- C:\Windows\System\TVWWXuM.exe
  C:\Windows\System\TVWWXuM.exe
  2⤵
  PID:1332
- C:\Windows\System\EhyWvNz.exe
  C:\Windows\System\EhyWvNz.exe
  2⤵
  PID:2168
- C:\Windows\System\YfzdMly.exe
  C:\Windows\System\YfzdMly.exe
  2⤵
  PID:1976
- C:\Windows\System\DHYFnWE.exe
  C:\Windows\System\DHYFnWE.exe
  2⤵
  PID:5940
- C:\Windows\System\ygDNDAm.exe
  C:\Windows\System\ygDNDAm.exe
  2⤵
  PID:5964
- C:\Windows\System\IYxENuA.exe
  C:\Windows\System\IYxENuA.exe
  2⤵
  PID:3020
- C:\Windows\System\ZfvkaPZ.exe
  C:\Windows\System\ZfvkaPZ.exe
  2⤵
  PID:5996
- C:\Windows\System\kCxOWZU.exe
  C:\Windows\System\kCxOWZU.exe
  2⤵
  PID:1044
- C:\Windows\System\HAJglzJ.exe
  C:\Windows\System\HAJglzJ.exe
  2⤵
  PID:1764
- C:\Windows\System\cHpSmAG.exe
  C:\Windows\System\cHpSmAG.exe
  2⤵
  PID:6100
- C:\Windows\System\cXDScyg.exe
  C:\Windows\System\cXDScyg.exe
  2⤵
  PID:6012
- C:\Windows\System\YqpBAMz.exe
  C:\Windows\System\YqpBAMz.exe
  2⤵
  PID:5160
- C:\Windows\System\hpiaRga.exe
  C:\Windows\System\hpiaRga.exe
  2⤵
  PID:2432
- C:\Windows\System\qaHNRbZ.exe
  C:\Windows\System\qaHNRbZ.exe
  2⤵
  PID:5096
- C:\Windows\System\lCOuIHU.exe
  C:\Windows\System\lCOuIHU.exe
  2⤵
  PID:6152
- C:\Windows\System\VtEIfKm.exe
  C:\Windows\System\VtEIfKm.exe
  2⤵
  PID:6168
- C:\Windows\System\gSOCzKe.exe
  C:\Windows\System\gSOCzKe.exe
  2⤵
  PID:6184
- C:\Windows\System\vDJFskX.exe
  C:\Windows\System\vDJFskX.exe
  2⤵
  PID:6200
- C:\Windows\System\NtabOCv.exe
  C:\Windows\System\NtabOCv.exe
  2⤵
  PID:6216
- C:\Windows\System\lsMrDzK.exe
  C:\Windows\System\lsMrDzK.exe
  2⤵
  PID:6232
- C:\Windows\System\XpouNgy.exe
  C:\Windows\System\XpouNgy.exe
  2⤵
  PID:6248
- C:\Windows\System\eEeHhsC.exe
  C:\Windows\System\eEeHhsC.exe
  2⤵
  PID:6264
- C:\Windows\System\FSpvNNb.exe
  C:\Windows\System\FSpvNNb.exe
  2⤵
  PID:6280
- C:\Windows\System\CSXZeFB.exe
  C:\Windows\System\CSXZeFB.exe
  2⤵
  PID:6296
- C:\Windows\System\koeApMf.exe
  C:\Windows\System\koeApMf.exe
  2⤵
  PID:6312
- C:\Windows\System\CNggTDB.exe
  C:\Windows\System\CNggTDB.exe
  2⤵
  PID:6344
- C:\Windows\System\pZSKCIa.exe
  C:\Windows\System\pZSKCIa.exe
  2⤵
  PID:6504
- C:\Windows\System\fHpWhmq.exe
  C:\Windows\System\fHpWhmq.exe
  2⤵
  PID:6640
- C:\Windows\System\NmmyrpA.exe
  C:\Windows\System\NmmyrpA.exe
  2⤵
  PID:6656
- C:\Windows\System\jEtwsCu.exe
  C:\Windows\System\jEtwsCu.exe
  2⤵
  PID:6956
- C:\Windows\System\ZCnCUeu.exe
  C:\Windows\System\ZCnCUeu.exe
  2⤵
  PID:6972
- C:\Windows\System\phecQsi.exe
  C:\Windows\System\phecQsi.exe
  2⤵
  PID:6988
- C:\Windows\System\McAJonw.exe
  C:\Windows\System\McAJonw.exe
  2⤵
  PID:7004
- C:\Windows\System\goNtAXp.exe
  C:\Windows\System\goNtAXp.exe
  2⤵
  PID:7024
- C:\Windows\System\wFbWXhN.exe
  C:\Windows\System\wFbWXhN.exe
  2⤵
  PID:7044
- C:\Windows\System\ZIkRmnT.exe
  C:\Windows\System\ZIkRmnT.exe
  2⤵
  PID:7064
- C:\Windows\System\WZiWteQ.exe
  C:\Windows\System\WZiWteQ.exe
  2⤵
  PID:7088
- C:\Windows\System\sYUEPjL.exe
  C:\Windows\System\sYUEPjL.exe
  2⤵
  PID:7108
- C:\Windows\System\IHyeynD.exe
  C:\Windows\System\IHyeynD.exe
  2⤵
  PID:7128
- C:\Windows\System\noBdZXI.exe
  C:\Windows\System\noBdZXI.exe
  2⤵
  PID:7144
- C:\Windows\System\MOQTCAV.exe
  C:\Windows\System\MOQTCAV.exe
  2⤵
  PID:2380
- C:\Windows\System\QkaBhEO.exe
  C:\Windows\System\QkaBhEO.exe
  2⤵
  PID:1056
- C:\Windows\System\MeHnMVF.exe
  C:\Windows\System\MeHnMVF.exe
  2⤵
  PID:5852
- C:\Windows\System\bFqApls.exe
  C:\Windows\System\bFqApls.exe
  2⤵
  PID:5896
- C:\Windows\System\TZjaEuR.exe
  C:\Windows\System\TZjaEuR.exe
  2⤵
  PID:6020
- C:\Windows\System\UVqWlxd.exe
  C:\Windows\System\UVqWlxd.exe
  2⤵
  PID:5920
- C:\Windows\System\uOCEdnb.exe
  C:\Windows\System\uOCEdnb.exe
  2⤵
  PID:6136
- C:\Windows\System\uWyfWzM.exe
  C:\Windows\System\uWyfWzM.exe
  2⤵
  PID:5448
- C:\Windows\System\adXWxOc.exe
  C:\Windows\System\adXWxOc.exe
  2⤵
  PID:6180
- C:\Windows\System\yEiuxkr.exe
  C:\Windows\System\yEiuxkr.exe
  2⤵
  PID:6244
- C:\Windows\System\RnUNYTc.exe
  C:\Windows\System\RnUNYTc.exe
  2⤵
  PID:6272
- C:\Windows\System\XWqWwtu.exe
  C:\Windows\System\XWqWwtu.exe
  2⤵
  PID:6292
- C:\Windows\System\HwjmgAU.exe
  C:\Windows\System\HwjmgAU.exe
  2⤵
  PID:968
- C:\Windows\System\CxMizRx.exe
  C:\Windows\System\CxMizRx.exe
  2⤵
  PID:5616
- C:\Windows\System\JXFynyh.exe
  C:\Windows\System\JXFynyh.exe
  2⤵
  PID:6320
- C:\Windows\System\UfWbKXj.exe
  C:\Windows\System\UfWbKXj.exe
  2⤵
  PID:5016
- C:\Windows\System\aEpXgsK.exe
  C:\Windows\System\aEpXgsK.exe
  2⤵
  PID:5148
- C:\Windows\System\RbcvWro.exe
  C:\Windows\System\RbcvWro.exe
  2⤵
  PID:5784
- C:\Windows\System\onqcBiG.exe
  C:\Windows\System\onqcBiG.exe
  2⤵
  PID:2208
- C:\Windows\System\xIIJmCX.exe
  C:\Windows\System\xIIJmCX.exe
  2⤵
  PID:6356
- C:\Windows\System\PCuxTmr.exe
  C:\Windows\System\PCuxTmr.exe
  2⤵
  PID:6372
- C:\Windows\System\QkZQcZa.exe
  C:\Windows\System\QkZQcZa.exe
  2⤵
  PID:6396
- C:\Windows\System\mcPNylL.exe
  C:\Windows\System\mcPNylL.exe
  2⤵
  PID:6412
- C:\Windows\System\WMNxxkg.exe
  C:\Windows\System\WMNxxkg.exe
  2⤵
  PID:6432
- C:\Windows\System\pNuVmOH.exe
  C:\Windows\System\pNuVmOH.exe
  2⤵
  PID:6448
- C:\Windows\System\SMRYpjL.exe
  C:\Windows\System\SMRYpjL.exe
  2⤵
  PID:6464
- C:\Windows\System\fAirEfu.exe
  C:\Windows\System\fAirEfu.exe
  2⤵
  PID:6484
- C:\Windows\System\KlflShs.exe
  C:\Windows\System\KlflShs.exe
  2⤵
  PID:2112
- C:\Windows\System\pxxTdwu.exe
  C:\Windows\System\pxxTdwu.exe
  2⤵
  PID:6516
- C:\Windows\System\RrZybKx.exe
  C:\Windows\System\RrZybKx.exe
  2⤵
  PID:4176
- C:\Windows\System\ilMDoWP.exe
  C:\Windows\System\ilMDoWP.exe
  2⤵
  PID:6548
- C:\Windows\System\frpsQLH.exe
  C:\Windows\System\frpsQLH.exe
  2⤵
  PID:6564
- C:\Windows\System\KcKWfiV.exe
  C:\Windows\System\KcKWfiV.exe
  2⤵
  PID:6580
- C:\Windows\System\qnCOduM.exe
  C:\Windows\System\qnCOduM.exe
  2⤵
  PID:6596
- C:\Windows\System\dAJhorS.exe
  C:\Windows\System\dAJhorS.exe
  2⤵
  PID:6612
- C:\Windows\System\TUFFhvC.exe
  C:\Windows\System\TUFFhvC.exe
  2⤵
  PID:6628
- C:\Windows\System\dkinhOv.exe
  C:\Windows\System\dkinhOv.exe
  2⤵
  PID:5668
- C:\Windows\System\gHndteh.exe
  C:\Windows\System\gHndteh.exe
  2⤵
  PID:6664
- C:\Windows\System\ULeSNZU.exe
  C:\Windows\System\ULeSNZU.exe
  2⤵
  PID:6684
- C:\Windows\System\OYcZkZV.exe
  C:\Windows\System\OYcZkZV.exe
  2⤵
  PID:6696
- C:\Windows\System\FKRQfvC.exe
  C:\Windows\System\FKRQfvC.exe
  2⤵
  PID:6716
- C:\Windows\System\AISRWHd.exe
  C:\Windows\System\AISRWHd.exe
  2⤵
  PID:6736
- C:\Windows\System\kphiBzl.exe
  C:\Windows\System\kphiBzl.exe
  2⤵
  PID:6744
- C:\Windows\System\tZFSrah.exe
  C:\Windows\System\tZFSrah.exe
  2⤵
  PID:6768
- C:\Windows\System\BMgSILL.exe
  C:\Windows\System\BMgSILL.exe
  2⤵
  PID:6780
- C:\Windows\System\VKwUrQD.exe
  C:\Windows\System\VKwUrQD.exe
  2⤵
  PID:6796
- C:\Windows\System\akyOlpr.exe
  C:\Windows\System\akyOlpr.exe
  2⤵
  PID:6816
- C:\Windows\System\hPTOyoj.exe
  C:\Windows\System\hPTOyoj.exe
  2⤵
  PID:6828
- C:\Windows\System\hrVZmEb.exe
  C:\Windows\System\hrVZmEb.exe
  2⤵
  PID:6844
- C:\Windows\System\HEwCEEJ.exe
  C:\Windows\System\HEwCEEJ.exe
  2⤵
  PID:6856
- C:\Windows\System\IlpZGdL.exe
  C:\Windows\System\IlpZGdL.exe
  2⤵
  PID:6884
- C:\Windows\System\OfuYNAM.exe
  C:\Windows\System\OfuYNAM.exe
  2⤵
  PID:6904
- C:\Windows\System\iaAMDpb.exe
  C:\Windows\System\iaAMDpb.exe
  2⤵
  PID:6964
- C:\Windows\System\gJZQZys.exe
  C:\Windows\System\gJZQZys.exe
  2⤵
  PID:6924
- C:\Windows\System\REZxgGG.exe
  C:\Windows\System\REZxgGG.exe
  2⤵
  PID:6996
- C:\Windows\System\tuqIrfy.exe
  C:\Windows\System\tuqIrfy.exe
  2⤵
  PID:7032
- C:\Windows\System\RnHpzbM.exe
  C:\Windows\System\RnHpzbM.exe
  2⤵
  PID:6940
- C:\Windows\System\tVqABLF.exe
  C:\Windows\System\tVqABLF.exe
  2⤵
  PID:6980
- C:\Windows\System\yhlMPqF.exe
  C:\Windows\System\yhlMPqF.exe
  2⤵
  PID:7080
- C:\Windows\System\tqBAsgV.exe
  C:\Windows\System\tqBAsgV.exe
  2⤵
  PID:7016
- C:\Windows\System\dhgHHWW.exe
  C:\Windows\System\dhgHHWW.exe
  2⤵
  PID:7160
- C:\Windows\System\WYONXYi.exe
  C:\Windows\System\WYONXYi.exe
  2⤵
  PID:7156
- C:\Windows\System\rvaqnJc.exe
  C:\Windows\System\rvaqnJc.exe
  2⤵
  PID:7104
- C:\Windows\System\gYzrOYG.exe
  C:\Windows\System\gYzrOYG.exe
  2⤵
  PID:1148
- C:\Windows\System\gqDoiaX.exe
  C:\Windows\System\gqDoiaX.exe
  2⤵
  PID:1028
- C:\Windows\System\KIYEJnq.exe
  C:\Windows\System\KIYEJnq.exe
  2⤵
  PID:5468
- C:\Windows\System\fEXuLgl.exe
  C:\Windows\System\fEXuLgl.exe
  2⤵
  PID:6164
- C:\Windows\System\tCBdiUT.exe
  C:\Windows\System\tCBdiUT.exe
  2⤵
  PID:6040
- C:\Windows\System\hhZLLCv.exe
  C:\Windows\System\hhZLLCv.exe
  2⤵
  PID:6288
- C:\Windows\System\RhDjFXi.exe
  C:\Windows\System\RhDjFXi.exe
  2⤵
  PID:4172
- C:\Windows\System\xXrigCd.exe
  C:\Windows\System\xXrigCd.exe
  2⤵
  PID:7140
- C:\Windows\System\XRTuIzQ.exe
  C:\Windows\System\XRTuIzQ.exe
  2⤵
  PID:5768
- C:\Windows\System\VAJNdzR.exe
  C:\Windows\System\VAJNdzR.exe
  2⤵
  PID:5472
- C:\Windows\System\wnCmaiI.exe
  C:\Windows\System\wnCmaiI.exe
  2⤵
  PID:4776
- C:\Windows\System\cmUlrvP.exe
  C:\Windows\System\cmUlrvP.exe
  2⤵
  PID:6308
- C:\Windows\System\EPRESuQ.exe
  C:\Windows\System\EPRESuQ.exe
  2⤵
  PID:6072
- C:\Windows\System\JTIMtVn.exe
  C:\Windows\System\JTIMtVn.exe
  2⤵
  PID:5908
- C:\Windows\System\iIjGAPZ.exe
  C:\Windows\System\iIjGAPZ.exe
  2⤵
  PID:5732
- C:\Windows\System\crshPRV.exe
  C:\Windows\System\crshPRV.exe
  2⤵
  PID:6336
- C:\Windows\System\yKNgxoc.exe
  C:\Windows\System\yKNgxoc.exe
  2⤵
  PID:6392
- C:\Windows\System\wQmXQmV.exe
  C:\Windows\System\wQmXQmV.exe
  2⤵
  PID:6440
- C:\Windows\System\OCYVrSV.exe
  C:\Windows\System\OCYVrSV.exe
  2⤵
  PID:2388
- C:\Windows\System\kwspokO.exe
  C:\Windows\System\kwspokO.exe
  2⤵
  PID:6424
- C:\Windows\System\ErkjWwe.exe
  C:\Windows\System\ErkjWwe.exe
  2⤵
  PID:6492
- C:\Windows\System\rkvwzFp.exe
  C:\Windows\System\rkvwzFp.exe
  2⤵
  PID:6524
- C:\Windows\System\fQEBJJs.exe
  C:\Windows\System\fQEBJJs.exe
  2⤵
  PID:6576
- C:\Windows\System\SChHHNO.exe
  C:\Windows\System\SChHHNO.exe
  2⤵
  PID:6592
- C:\Windows\System\LKlrJIR.exe
  C:\Windows\System\LKlrJIR.exe
  2⤵
  PID:6652
- C:\Windows\System\BScOClA.exe
  C:\Windows\System\BScOClA.exe
  2⤵
  PID:6620
- C:\Windows\System\FHhfUNH.exe
  C:\Windows\System\FHhfUNH.exe
  2⤵
  PID:6672
- C:\Windows\System\MnIWocq.exe
  C:\Windows\System\MnIWocq.exe
  2⤵
  PID:6720
- C:\Windows\System\PIykSYc.exe
  C:\Windows\System\PIykSYc.exe
  2⤵
  PID:6776
- C:\Windows\System\YJbqRFE.exe
  C:\Windows\System\YJbqRFE.exe
  2⤵
  PID:6792
- C:\Windows\System\IHQXqqj.exe
  C:\Windows\System\IHQXqqj.exe
  2⤵
  PID:6820
- C:\Windows\System\HnCHoXD.exe
  C:\Windows\System\HnCHoXD.exe
  2⤵
  PID:6868
- C:\Windows\System\mZfnHSh.exe
  C:\Windows\System\mZfnHSh.exe
  2⤵
  PID:6900
- C:\Windows\System\wFKPZqT.exe
  C:\Windows\System\wFKPZqT.exe
  2⤵
  PID:6932
- C:\Windows\System\lCELGGV.exe
  C:\Windows\System\lCELGGV.exe
  2⤵
  PID:7020
- C:\Windows\System\puaYEnc.exe
  C:\Windows\System\puaYEnc.exe
  2⤵
  PID:7036
- C:\Windows\System\MnrfzyZ.exe
  C:\Windows\System\MnrfzyZ.exe
  2⤵
  PID:7096
- C:\Windows\System\deMFfWA.exe
  C:\Windows\System\deMFfWA.exe
  2⤵
  PID:7060
- C:\Windows\System\nabANgj.exe
  C:\Windows\System\nabANgj.exe
  2⤵
  PID:6228
- C:\Windows\System\rnMWQRA.exe
  C:\Windows\System\rnMWQRA.exe
  2⤵
  PID:5000
- C:\Windows\System\siKHLCq.exe
  C:\Windows\System\siKHLCq.exe
  2⤵
  PID:5648
- C:\Windows\System\jgGpYDE.exe
  C:\Windows\System\jgGpYDE.exe
  2⤵
  PID:6176
- C:\Windows\System\QxtZndB.exe
  C:\Windows\System\QxtZndB.exe
  2⤵
  PID:6240
- C:\Windows\System\JWAbYrI.exe
  C:\Windows\System\JWAbYrI.exe
  2⤵
  PID:5716
- C:\Windows\System\IEZvvpa.exe
  C:\Windows\System\IEZvvpa.exe
  2⤵
  PID:6420
- C:\Windows\System\LwSfWwk.exe
  C:\Windows\System\LwSfWwk.exe
  2⤵
  PID:6408
- C:\Windows\System\Kudndjl.exe
  C:\Windows\System\Kudndjl.exe
  2⤵
  PID:6528
- C:\Windows\System\XiEhQaH.exe
  C:\Windows\System\XiEhQaH.exe
  2⤵
  PID:6588
- C:\Windows\System\NERkdsb.exe
  C:\Windows\System\NERkdsb.exe
  2⤵
  PID:6480
- C:\Windows\System\MTDwdPV.exe
  C:\Windows\System\MTDwdPV.exe
  2⤵
  PID:6572
- C:\Windows\System\hXdCaAc.exe
  C:\Windows\System\hXdCaAc.exe
  2⤵
  PID:6332
- C:\Windows\System\uLgGvpu.exe
  C:\Windows\System\uLgGvpu.exe
  2⤵
  PID:6680
- C:\Windows\System\MVNYJqP.exe
  C:\Windows\System\MVNYJqP.exe
  2⤵
  PID:6748
- C:\Windows\System\gGobizs.exe
  C:\Windows\System\gGobizs.exe
  2⤵
  PID:6852
- C:\Windows\System\OdEfSxT.exe
  C:\Windows\System\OdEfSxT.exe
  2⤵
  PID:2080
- C:\Windows\System\leAmrfe.exe
  C:\Windows\System\leAmrfe.exe
  2⤵
  PID:5968
- C:\Windows\System\ODnErnl.exe
  C:\Windows\System\ODnErnl.exe
  2⤵
  PID:6556
- C:\Windows\System\wjKQCed.exe
  C:\Windows\System\wjKQCed.exe
  2⤵
  PID:5924
- C:\Windows\System\lOQrUNJ.exe
  C:\Windows\System\lOQrUNJ.exe
  2⤵
  PID:6388
- C:\Windows\System\GLCdffl.exe
  C:\Windows\System\GLCdffl.exe
  2⤵
  PID:6536
- C:\Windows\System\zypfGIE.exe
  C:\Windows\System\zypfGIE.exe
  2⤵
  PID:6836
- C:\Windows\System\YZqUQxy.exe
  C:\Windows\System\YZqUQxy.exe
  2⤵
  PID:7072
- C:\Windows\System\DtzqDyL.exe
  C:\Windows\System\DtzqDyL.exe
  2⤵
  PID:6888
- C:\Windows\System\WqOKLlU.exe
  C:\Windows\System\WqOKLlU.exe
  2⤵
  PID:6456
- C:\Windows\System\BSPPcuX.exe
  C:\Windows\System\BSPPcuX.exe
  2⤵
  PID:7164
- C:\Windows\System\rcwkWTT.exe
  C:\Windows\System\rcwkWTT.exe
  2⤵
  PID:6636
- C:\Windows\System\BPyozAQ.exe
  C:\Windows\System\BPyozAQ.exe
  2⤵
  PID:6352
- C:\Windows\System\AHyvpyC.exe
  C:\Windows\System\AHyvpyC.exe
  2⤵
  PID:6740
- C:\Windows\System\FQTtHDM.exe
  C:\Windows\System\FQTtHDM.exe
  2⤵
  PID:7100
- C:\Windows\System\XhxlYFT.exe
  C:\Windows\System\XhxlYFT.exe
  2⤵
  PID:6384
- C:\Windows\System\Ufardto.exe
  C:\Windows\System\Ufardto.exe
  2⤵
  PID:6056
- C:\Windows\System\AnFlszz.exe
  C:\Windows\System\AnFlszz.exe
  2⤵
  PID:6212
- C:\Windows\System\QDJWxpf.exe
  C:\Windows\System\QDJWxpf.exe
  2⤵
  PID:7176
- C:\Windows\System\zZOkCfX.exe
  C:\Windows\System\zZOkCfX.exe
  2⤵
  PID:7192
- C:\Windows\System\HKnmJjU.exe
  C:\Windows\System\HKnmJjU.exe
  2⤵
  PID:7208
- C:\Windows\System\cyuoqbH.exe
  C:\Windows\System\cyuoqbH.exe
  2⤵
  PID:7224
- C:\Windows\System\kPnVYmj.exe
  C:\Windows\System\kPnVYmj.exe
  2⤵
  PID:7240
- C:\Windows\System\QWGHTOB.exe
  C:\Windows\System\QWGHTOB.exe
  2⤵
  PID:7256
- C:\Windows\System\EIuoMIh.exe
  C:\Windows\System\EIuoMIh.exe
  2⤵
  PID:7272
- C:\Windows\System\IKtINBE.exe
  C:\Windows\System\IKtINBE.exe
  2⤵
  PID:7288
- C:\Windows\System\fhdDeTk.exe
  C:\Windows\System\fhdDeTk.exe
  2⤵
  PID:7304
- C:\Windows\System\sJxqIfZ.exe
  C:\Windows\System\sJxqIfZ.exe
  2⤵
  PID:7320
- C:\Windows\System\jwGCnqB.exe
  C:\Windows\System\jwGCnqB.exe
  2⤵
  PID:7336
- C:\Windows\System\qWQSuus.exe
  C:\Windows\System\qWQSuus.exe
  2⤵
  PID:7352
- C:\Windows\System\UYHxmhS.exe
  C:\Windows\System\UYHxmhS.exe
  2⤵
  PID:7368
- C:\Windows\System\zOdrEqL.exe
  C:\Windows\System\zOdrEqL.exe
  2⤵
  PID:7384
- C:\Windows\System\hqXNGYc.exe
  C:\Windows\System\hqXNGYc.exe
  2⤵
  PID:7400
- C:\Windows\System\SLJFjzv.exe
  C:\Windows\System\SLJFjzv.exe
  2⤵
  PID:7416
- C:\Windows\System\zvjpONm.exe
  C:\Windows\System\zvjpONm.exe
  2⤵
  PID:7432
- C:\Windows\System\vaOyRpx.exe
  C:\Windows\System\vaOyRpx.exe
  2⤵
  PID:7448
- C:\Windows\System\ztGjemi.exe
  C:\Windows\System\ztGjemi.exe
  2⤵
  PID:7464
- C:\Windows\System\HcdBghH.exe
  C:\Windows\System\HcdBghH.exe
  2⤵
  PID:7480
- C:\Windows\System\yVHZumq.exe
  C:\Windows\System\yVHZumq.exe
  2⤵
  PID:7496
- C:\Windows\System\clOFHli.exe
  C:\Windows\System\clOFHli.exe
  2⤵
  PID:7512
- C:\Windows\System\umLSUdC.exe
  C:\Windows\System\umLSUdC.exe
  2⤵
  PID:7528
- C:\Windows\System\EFtPOyz.exe
  C:\Windows\System\EFtPOyz.exe
  2⤵
  PID:7544
- C:\Windows\System\JxZulQt.exe
  C:\Windows\System\JxZulQt.exe
  2⤵
  PID:7560
- C:\Windows\System\AoeCfxp.exe
  C:\Windows\System\AoeCfxp.exe
  2⤵
  PID:7576
- C:\Windows\System\XGTdhnx.exe
  C:\Windows\System\XGTdhnx.exe
  2⤵
  PID:7592
- C:\Windows\System\baOltTI.exe
  C:\Windows\System\baOltTI.exe
  2⤵
  PID:7608
- C:\Windows\System\zsFMscO.exe
  C:\Windows\System\zsFMscO.exe
  2⤵
  PID:7624
- C:\Windows\System\AwiAPzo.exe
  C:\Windows\System\AwiAPzo.exe
  2⤵
  PID:7640
- C:\Windows\System\pjqZJyq.exe
  C:\Windows\System\pjqZJyq.exe
  2⤵
  PID:7656
- C:\Windows\System\Kfrvueo.exe
  C:\Windows\System\Kfrvueo.exe
  2⤵
  PID:7672
- C:\Windows\System\dAEBhdf.exe
  C:\Windows\System\dAEBhdf.exe
  2⤵
  PID:7688
- C:\Windows\System\AszpADz.exe
  C:\Windows\System\AszpADz.exe
  2⤵
  PID:7704
- C:\Windows\System\ZJUFlwp.exe
  C:\Windows\System\ZJUFlwp.exe
  2⤵
  PID:7720
- C:\Windows\System\YWmDEiN.exe
  C:\Windows\System\YWmDEiN.exe
  2⤵
  PID:7736
- C:\Windows\System\ckFcvPY.exe
  C:\Windows\System\ckFcvPY.exe
  2⤵
  PID:7752
- C:\Windows\System\ujVchPL.exe
  C:\Windows\System\ujVchPL.exe
  2⤵
  PID:7768
- C:\Windows\System\lDhRkyo.exe
  C:\Windows\System\lDhRkyo.exe
  2⤵
  PID:7784
- C:\Windows\System\hrjoZxm.exe
  C:\Windows\System\hrjoZxm.exe
  2⤵
  PID:7800
- C:\Windows\System\oZLnZZf.exe
  C:\Windows\System\oZLnZZf.exe
  2⤵
  PID:7816
- C:\Windows\System\JxYdbKo.exe
  C:\Windows\System\JxYdbKo.exe
  2⤵
  PID:7832
- C:\Windows\System\qJzmeRl.exe
  C:\Windows\System\qJzmeRl.exe
  2⤵
  PID:7848
- C:\Windows\System\JyOpblq.exe
  C:\Windows\System\JyOpblq.exe
  2⤵
  PID:7864
- C:\Windows\System\kcwXODr.exe
  C:\Windows\System\kcwXODr.exe
  2⤵
  PID:7880
- C:\Windows\System\GyUzGnt.exe
  C:\Windows\System\GyUzGnt.exe
  2⤵
  PID:7896
- C:\Windows\System\XGhoEgr.exe
  C:\Windows\System\XGhoEgr.exe
  2⤵
  PID:7912
- C:\Windows\System\xrYqgCF.exe
  C:\Windows\System\xrYqgCF.exe
  2⤵
  PID:7928
- C:\Windows\System\yYRUqZg.exe
  C:\Windows\System\yYRUqZg.exe
  2⤵
  PID:7944
- C:\Windows\System\xxfZeVv.exe
  C:\Windows\System\xxfZeVv.exe
  2⤵
  PID:7960
- C:\Windows\System\iGgHpsH.exe
  C:\Windows\System\iGgHpsH.exe
  2⤵
  PID:7976
- C:\Windows\System\cXjZPwb.exe
  C:\Windows\System\cXjZPwb.exe
  2⤵
  PID:7992
- C:\Windows\System\MUgnMAE.exe
  C:\Windows\System\MUgnMAE.exe
  2⤵
  PID:8008
- C:\Windows\System\LdatEtJ.exe
  C:\Windows\System\LdatEtJ.exe
  2⤵
  PID:8024
- C:\Windows\System\dwzsAzg.exe
  C:\Windows\System\dwzsAzg.exe
  2⤵
  PID:8040
- C:\Windows\System\yykSoWc.exe
  C:\Windows\System\yykSoWc.exe
  2⤵
  PID:8056
- C:\Windows\System\iVUmReE.exe
  C:\Windows\System\iVUmReE.exe
  2⤵
  PID:8072
- C:\Windows\System\PYRzqsk.exe
  C:\Windows\System\PYRzqsk.exe
  2⤵
  PID:8088
- C:\Windows\System\zatAXOC.exe
  C:\Windows\System\zatAXOC.exe
  2⤵
  PID:8104
- C:\Windows\System\bbDkkYN.exe
  C:\Windows\System\bbDkkYN.exe
  2⤵
  PID:8120
- C:\Windows\System\HEBfdtZ.exe
  C:\Windows\System\HEBfdtZ.exe
  2⤵
  PID:8136
- C:\Windows\System\xJyoEFr.exe
  C:\Windows\System\xJyoEFr.exe
  2⤵
  PID:8152
- C:\Windows\System\hKBeWPr.exe
  C:\Windows\System\hKBeWPr.exe
  2⤵
  PID:8168
- C:\Windows\System\nndQitr.exe
  C:\Windows\System\nndQitr.exe
  2⤵
  PID:8184
- C:\Windows\System\KZcrLZF.exe
  C:\Windows\System\KZcrLZF.exe
  2⤵
  PID:7184
- C:\Windows\System\TXyVWfD.exe
  C:\Windows\System\TXyVWfD.exe
  2⤵
  PID:7248
- C:\Windows\System\yEoDfAr.exe
  C:\Windows\System\yEoDfAr.exe
  2⤵
  PID:6804
- C:\Windows\System\eIPGhOU.exe
  C:\Windows\System\eIPGhOU.exe
  2⤵
  PID:7200
- C:\Windows\System\mkMoOqM.exe
  C:\Windows\System\mkMoOqM.exe
  2⤵
  PID:7252
- C:\Windows\System\SNlLACq.exe
  C:\Windows\System\SNlLACq.exe
  2⤵
  PID:7280
- C:\Windows\System\kzIChFX.exe
  C:\Windows\System\kzIChFX.exe
  2⤵
  PID:7264
- C:\Windows\System\HCjwQvX.exe
  C:\Windows\System\HCjwQvX.exe
  2⤵
  PID:7300
- C:\Windows\System\MTquhzv.exe
  C:\Windows\System\MTquhzv.exe
  2⤵
  PID:7364
- C:\Windows\System\GAUTcYK.exe
  C:\Windows\System\GAUTcYK.exe
  2⤵
  PID:7412
- C:\Windows\System\tSQstcE.exe
  C:\Windows\System\tSQstcE.exe
  2⤵
  PID:7392
- C:\Windows\System\HeHlxAK.exe
  C:\Windows\System\HeHlxAK.exe
  2⤵
  PID:7460
- C:\Windows\System\bOldHPX.exe
  C:\Windows\System\bOldHPX.exe
  2⤵
  PID:7536
- C:\Windows\System\zLVnUFX.exe
  C:\Windows\System\zLVnUFX.exe
  2⤵
  PID:7568
- C:\Windows\System\kGQvfWw.exe
  C:\Windows\System\kGQvfWw.exe
  2⤵
  PID:7556
- C:\Windows\System\WsSZJHb.exe
  C:\Windows\System\WsSZJHb.exe
  2⤵
  PID:7636
- C:\Windows\System\kfpgmcq.exe
  C:\Windows\System\kfpgmcq.exe
  2⤵
  PID:7668
- C:\Windows\System\DzPZVIA.exe
  C:\Windows\System\DzPZVIA.exe
  2⤵
  PID:7520
- C:\Windows\System\OXMDaMI.exe
  C:\Windows\System\OXMDaMI.exe
  2⤵
  PID:7492
- C:\Windows\System\YvVqgZu.exe
  C:\Windows\System\YvVqgZu.exe
  2⤵
  PID:7684
- C:\Windows\System\skgpjsA.exe
  C:\Windows\System\skgpjsA.exe
  2⤵
  PID:7748
- C:\Windows\System\LVzgXuz.exe
  C:\Windows\System\LVzgXuz.exe
  2⤵
  PID:7824
- C:\Windows\System\RVgsHsu.exe
  C:\Windows\System\RVgsHsu.exe
  2⤵
  PID:7856
- C:\Windows\System\qShMrae.exe
  C:\Windows\System\qShMrae.exe
  2⤵
  PID:7952
- C:\Windows\System\pCITFKN.exe
  C:\Windows\System\pCITFKN.exe
  2⤵
  PID:7812
- C:\Windows\System\JkcbKPJ.exe
  C:\Windows\System\JkcbKPJ.exe
  2⤵
  PID:7876
- C:\Windows\System\mgjYebM.exe
  C:\Windows\System\mgjYebM.exe
  2⤵
  PID:7904
- C:\Windows\System\PXlwKvt.exe
  C:\Windows\System\PXlwKvt.exe
  2⤵
  PID:7984
- C:\Windows\System\xfyIZqp.exe
  C:\Windows\System\xfyIZqp.exe
  2⤵
  PID:8000
- C:\Windows\System\tZRzhuj.exe
  C:\Windows\System\tZRzhuj.exe
  2⤵
  PID:8036
- C:\Windows\System\KxVxeQy.exe
  C:\Windows\System\KxVxeQy.exe
  2⤵
  PID:8032
- C:\Windows\System\NXHABFO.exe
  C:\Windows\System\NXHABFO.exe
  2⤵
  PID:8116
- C:\Windows\System\zGsQMpm.exe
  C:\Windows\System\zGsQMpm.exe
  2⤵
  PID:2972
- C:\Windows\System\DZbLwPL.exe
  C:\Windows\System\DZbLwPL.exe
  2⤵
  PID:7236
- C:\Windows\System\ihIfaIc.exe
  C:\Windows\System\ihIfaIc.exe
  2⤵
  PID:7332
- C:\Windows\System\aSfeTuf.exe
  C:\Windows\System\aSfeTuf.exe
  2⤵
  PID:7444
- C:\Windows\System\zaryMhH.exe
  C:\Windows\System\zaryMhH.exe
  2⤵
  PID:7924
- C:\Windows\System\IpsqPDC.exe
  C:\Windows\System\IpsqPDC.exe
  2⤵
  PID:7716
- C:\Windows\System\GaZyqJA.exe
  C:\Windows\System\GaZyqJA.exe
  2⤵
  PID:8176
- C:\Windows\System\KFQIcGk.exe
  C:\Windows\System\KFQIcGk.exe
  2⤵
  PID:7172
- C:\Windows\System\fpLXLhy.exe
  C:\Windows\System\fpLXLhy.exe
  2⤵
  PID:8160
- C:\Windows\System\ghNGFAI.exe
  C:\Windows\System\ghNGFAI.exe
  2⤵
  PID:7312
- C:\Windows\System\cfeqFXK.exe
  C:\Windows\System\cfeqFXK.exe
  2⤵
  PID:7408
- C:\Windows\System\bfrgMYn.exe
  C:\Windows\System\bfrgMYn.exe
  2⤵
  PID:7524
- C:\Windows\System\WtCQeUl.exe
  C:\Windows\System\WtCQeUl.exe
  2⤵
  PID:7604
- C:\Windows\System\IJCXtgZ.exe
  C:\Windows\System\IJCXtgZ.exe
  2⤵
  PID:8052
- C:\Windows\System\xwCjtKo.exe
  C:\Windows\System\xwCjtKo.exe
  2⤵
  PID:2288
- C:\Windows\System\FjpUvSf.exe
  C:\Windows\System\FjpUvSf.exe
  2⤵
  PID:8080
- C:\Windows\System\zZAJzdJ.exe
  C:\Windows\System\zZAJzdJ.exe
  2⤵
  PID:8100
- C:\Windows\System\lNjFhIH.exe
  C:\Windows\System\lNjFhIH.exe
  2⤵
  PID:8132
- C:\Windows\System\zCRDMJF.exe
  C:\Windows\System\zCRDMJF.exe
  2⤵
  PID:8164
- C:\Windows\System\UgTjAEq.exe
  C:\Windows\System\UgTjAEq.exe
  2⤵
  PID:6860
- C:\Windows\System\qQfvWwC.exe
  C:\Windows\System\qQfvWwC.exe
  2⤵
  PID:7600
- C:\Windows\System\bdYLpDY.exe
  C:\Windows\System\bdYLpDY.exe
  2⤵
  PID:7616
- C:\Windows\System\GpmlIfj.exe
  C:\Windows\System\GpmlIfj.exe
  2⤵
  PID:7648
- C:\Windows\System\ZJCYLBz.exe
  C:\Windows\System\ZJCYLBz.exe
  2⤵
  PID:6472
- C:\Windows\System\ULSDMQP.exe
  C:\Windows\System\ULSDMQP.exe
  2⤵
  PID:7940
- C:\Windows\System\qBageAy.exe
  C:\Windows\System\qBageAy.exe
  2⤵
  PID:7760
- C:\Windows\System\iZiplKK.exe
  C:\Windows\System\iZiplKK.exe
  2⤵
  PID:7968
- C:\Windows\System\YRIPapE.exe
  C:\Windows\System\YRIPapE.exe
  2⤵
  PID:7892
- C:\Windows\System\sRNcCzs.exe
  C:\Windows\System\sRNcCzs.exe
  2⤵
  PID:7792
- C:\Windows\System\HUUshOV.exe
  C:\Windows\System\HUUshOV.exe
  2⤵
  PID:8112
- C:\Windows\System\UPmUCAw.exe
  C:\Windows\System\UPmUCAw.exe
  2⤵
  PID:7700
- C:\Windows\System\nfNDPpv.exe
  C:\Windows\System\nfNDPpv.exe
  2⤵
  PID:7344
- C:\Windows\System\kqcdfSy.exe
  C:\Windows\System\kqcdfSy.exe
  2⤵
  PID:8200
- C:\Windows\System\ETZMnzn.exe
  C:\Windows\System\ETZMnzn.exe
  2⤵
  PID:8224
- C:\Windows\System\puzADom.exe
  C:\Windows\System\puzADom.exe
  2⤵
  PID:8240
- C:\Windows\System\jcYSZNq.exe
  C:\Windows\System\jcYSZNq.exe
  2⤵
  PID:8256
- C:\Windows\System\CPUSYqa.exe
  C:\Windows\System\CPUSYqa.exe
  2⤵
  PID:8276
- C:\Windows\System\YHWXHDq.exe
  C:\Windows\System\YHWXHDq.exe
  2⤵
  PID:8292
- C:\Windows\System\irhuhae.exe
  C:\Windows\System\irhuhae.exe
  2⤵
  PID:8312
- C:\Windows\System\jESJveg.exe
  C:\Windows\System\jESJveg.exe
  2⤵
  PID:8332
- C:\Windows\System\WGstTlS.exe
  C:\Windows\System\WGstTlS.exe
  2⤵
  PID:8348
- C:\Windows\System\TQarpUA.exe
  C:\Windows\System\TQarpUA.exe
  2⤵
  PID:8364
- C:\Windows\System\bfATIXz.exe
  C:\Windows\System\bfATIXz.exe
  2⤵
  PID:8504
- C:\Windows\System\tceCQpK.exe
  C:\Windows\System\tceCQpK.exe
  2⤵
  PID:8524
- C:\Windows\System\EuywXHB.exe
  C:\Windows\System\EuywXHB.exe
  2⤵
  PID:8540
- C:\Windows\System\voJjGNa.exe
  C:\Windows\System\voJjGNa.exe
  2⤵
  PID:8556
- C:\Windows\System\CkxcRMe.exe
  C:\Windows\System\CkxcRMe.exe
  2⤵
  PID:8572
- C:\Windows\System\eFQkBQT.exe
  C:\Windows\System\eFQkBQT.exe
  2⤵
  PID:8588
- C:\Windows\System\AcJMEQZ.exe
  C:\Windows\System\AcJMEQZ.exe
  2⤵
  PID:8604
- C:\Windows\System\uRrqMOs.exe
  C:\Windows\System\uRrqMOs.exe
  2⤵
  PID:8632
- C:\Windows\System\JtnbtMF.exe
  C:\Windows\System\JtnbtMF.exe
  2⤵
  PID:8652
- C:\Windows\System\vLcVldB.exe
  C:\Windows\System\vLcVldB.exe
  2⤵
  PID:8668
- C:\Windows\System\XowoHRk.exe
  C:\Windows\System\XowoHRk.exe
  2⤵
  PID:8684
- C:\Windows\System\CEZllET.exe
  C:\Windows\System\CEZllET.exe
  2⤵
  PID:8700
- C:\Windows\System\nOJdJev.exe
  C:\Windows\System\nOJdJev.exe
  2⤵
  PID:8716
- C:\Windows\System\beTCeMh.exe
  C:\Windows\System\beTCeMh.exe
  2⤵
  PID:8732
- C:\Windows\System\kWtnPHl.exe
  C:\Windows\System\kWtnPHl.exe
  2⤵
  PID:8752
- C:\Windows\System\tWScsaF.exe
  C:\Windows\System\tWScsaF.exe
  2⤵
  PID:8772
- C:\Windows\System\oXgnlLW.exe
  C:\Windows\System\oXgnlLW.exe
  2⤵
  PID:8796
- C:\Windows\System\JSsviqb.exe
  C:\Windows\System\JSsviqb.exe
  2⤵
  PID:8812
- C:\Windows\System\wvyOrwk.exe
  C:\Windows\System\wvyOrwk.exe
  2⤵
  PID:8828
- C:\Windows\System\JimOWyN.exe
  C:\Windows\System\JimOWyN.exe
  2⤵
  PID:8844
- C:\Windows\System\gsSwyln.exe
  C:\Windows\System\gsSwyln.exe
  2⤵
  PID:8860
- C:\Windows\System\MTkCfSz.exe
  C:\Windows\System\MTkCfSz.exe
  2⤵
  PID:8876
- C:\Windows\System\ZTRopPh.exe
  C:\Windows\System\ZTRopPh.exe
  2⤵
  PID:8892
- C:\Windows\System\gMtQlTM.exe
  C:\Windows\System\gMtQlTM.exe
  2⤵
  PID:8908
- C:\Windows\System\HtCMVbC.exe
  C:\Windows\System\HtCMVbC.exe
  2⤵
  PID:8924
- C:\Windows\System\qVTAXUG.exe
  C:\Windows\System\qVTAXUG.exe
  2⤵
  PID:8940
- C:\Windows\System\wGBgcWH.exe
  C:\Windows\System\wGBgcWH.exe
  2⤵
  PID:8956
- C:\Windows\System\evlNrdA.exe
  C:\Windows\System\evlNrdA.exe
  2⤵
  PID:8972
- C:\Windows\System\lLnphTJ.exe
  C:\Windows\System\lLnphTJ.exe
  2⤵
  PID:8996
- C:\Windows\System\gtNFdUF.exe
  C:\Windows\System\gtNFdUF.exe
  2⤵
  PID:9012
- C:\Windows\System\XhUHMqU.exe
  C:\Windows\System\XhUHMqU.exe
  2⤵
  PID:9028
- C:\Windows\System\puItXrF.exe
  C:\Windows\System\puItXrF.exe
  2⤵
  PID:9048
- C:\Windows\System\pIbcijO.exe
  C:\Windows\System\pIbcijO.exe
  2⤵
  PID:9064
- C:\Windows\System\CNsEpPi.exe
  C:\Windows\System\CNsEpPi.exe
  2⤵
  PID:9080
- C:\Windows\System\WEawnNT.exe
  C:\Windows\System\WEawnNT.exe
  2⤵
  PID:9096
- C:\Windows\System\uohcynM.exe
  C:\Windows\System\uohcynM.exe
  2⤵
  PID:9112
- C:\Windows\System\WsOOboW.exe
  C:\Windows\System\WsOOboW.exe
  2⤵
  PID:9128
- C:\Windows\System\FYguMVs.exe
  C:\Windows\System\FYguMVs.exe
  2⤵
  PID:9144
- C:\Windows\System\MxYLeyK.exe
  C:\Windows\System\MxYLeyK.exe
  2⤵
  PID:9160
- C:\Windows\System\yyncdCL.exe
  C:\Windows\System\yyncdCL.exe
  2⤵
  PID:9176
- C:\Windows\System\kdyAdst.exe
  C:\Windows\System\kdyAdst.exe
  2⤵
  PID:9192
- C:\Windows\System\uDSEcsu.exe
  C:\Windows\System\uDSEcsu.exe
  2⤵
  PID:9208
- C:\Windows\System\vhoVJMs.exe
  C:\Windows\System\vhoVJMs.exe
  2⤵
  PID:7776
- C:\Windows\System\WoWmIut.exe
  C:\Windows\System\WoWmIut.exe
  2⤵
  PID:8220
- C:\Windows\System\VfsJlIy.exe
  C:\Windows\System\VfsJlIy.exe
  2⤵
  PID:7888
- C:\Windows\System\pLSGZdc.exe
  C:\Windows\System\pLSGZdc.exe
  2⤵
  PID:8320
- C:\Windows\System\plFEtPS.exe
  C:\Windows\System\plFEtPS.exe
  2⤵
  PID:8268
- C:\Windows\System\TrZjnsm.exe
  C:\Windows\System\TrZjnsm.exe
  2⤵
  PID:8196
- C:\Windows\System\NbAaJzu.exe
  C:\Windows\System\NbAaJzu.exe
  2⤵
  PID:8304
- C:\Windows\System\jtcANix.exe
  C:\Windows\System\jtcANix.exe
  2⤵
  PID:8328
- C:\Windows\System\mYtLsVQ.exe
  C:\Windows\System\mYtLsVQ.exe
  2⤵
  PID:8376
- C:\Windows\System\tfrgESn.exe
  C:\Windows\System\tfrgESn.exe
  2⤵
  PID:8392
- C:\Windows\System\NNLjOBa.exe
  C:\Windows\System\NNLjOBa.exe
  2⤵
  PID:8408
- C:\Windows\System\majwJvu.exe
  C:\Windows\System\majwJvu.exe
  2⤵
  PID:8428
- C:\Windows\System\WnavuIz.exe
  C:\Windows\System\WnavuIz.exe
  2⤵
  PID:8440
- C:\Windows\System\AhUbEyl.exe
  C:\Windows\System\AhUbEyl.exe
  2⤵
  PID:8452
- C:\Windows\System\kvTTkJT.exe
  C:\Windows\System\kvTTkJT.exe
  2⤵
  PID:8476
- C:\Windows\System\SZjkAkS.exe
  C:\Windows\System\SZjkAkS.exe
  2⤵
  PID:8492
- C:\Windows\System\kLPDjFI.exe
  C:\Windows\System\kLPDjFI.exe
  2⤵
  PID:8512
- C:\Windows\System\DBXkAKS.exe
  C:\Windows\System\DBXkAKS.exe
  2⤵
  PID:8552
- C:\Windows\System\DYAgKOm.exe
  C:\Windows\System\DYAgKOm.exe
  2⤵
  PID:8616
- C:\Windows\System\abuefft.exe
  C:\Windows\System\abuefft.exe
  2⤵
  PID:8564
- C:\Windows\System\HrnimtL.exe
  C:\Windows\System\HrnimtL.exe
  2⤵
  PID:8600
- C:\Windows\System\NjLhFAE.exe
  C:\Windows\System\NjLhFAE.exe
  2⤵
  PID:8692
- C:\Windows\System\QRBLuoJ.exe
  C:\Windows\System\QRBLuoJ.exe
  2⤵
  PID:8760
- C:\Windows\System\qfQmHuz.exe
  C:\Windows\System\qfQmHuz.exe
  2⤵
  PID:8640
- C:\Windows\System\nvmJgsk.exe
  C:\Windows\System\nvmJgsk.exe
  2⤵
  PID:8708
- C:\Windows\System\TZWJSOp.exe
  C:\Windows\System\TZWJSOp.exe
  2⤵
  PID:8792
- C:\Windows\System\iCwsKOV.exe
  C:\Windows\System\iCwsKOV.exe
  2⤵
  PID:8808
- C:\Windows\System\HBzhffO.exe
  C:\Windows\System\HBzhffO.exe
  2⤵
  PID:8868
- C:\Windows\System\hgGkkbD.exe
  C:\Windows\System\hgGkkbD.exe
  2⤵
  PID:8932
- C:\Windows\System\iZPWQYJ.exe
  C:\Windows\System\iZPWQYJ.exe
  2⤵
  PID:8884
- C:\Windows\System\wLrNRhB.exe
  C:\Windows\System\wLrNRhB.exe
  2⤵
  PID:8820
- C:\Windows\System\EkPoiZS.exe
  C:\Windows\System\EkPoiZS.exe
  2⤵
  PID:9008
- C:\Windows\System\teXxvfB.exe
  C:\Windows\System\teXxvfB.exe
  2⤵
  PID:9040
- C:\Windows\System\OLbSWUu.exe
  C:\Windows\System\OLbSWUu.exe
  2⤵
  PID:8988
- C:\Windows\System\jFIMwop.exe
  C:\Windows\System\jFIMwop.exe
  2⤵
  PID:9020
- C:\Windows\System\JztMajm.exe
  C:\Windows\System\JztMajm.exe
  2⤵
  PID:9060
- C:\Windows\System\MlntHFb.exe
  C:\Windows\System\MlntHFb.exe
  2⤵
  PID:9140
- C:\Windows\System\LBDjHMn.exe
  C:\Windows\System\LBDjHMn.exe
  2⤵
  PID:9204
- C:\Windows\System\zBijiSf.exe
  C:\Windows\System\zBijiSf.exe
  2⤵
  PID:9120
- C:\Windows\System\qzprzle.exe
  C:\Windows\System\qzprzle.exe
  2⤵
  PID:9184
- C:\Windows\System\CFNvdtY.exe
  C:\Windows\System\CFNvdtY.exe
  2⤵
  PID:8252
- C:\Windows\System\dyELUor.exe
  C:\Windows\System\dyELUor.exe
  2⤵
  PID:8236
- C:\Windows\System\EqGNHiF.exe
  C:\Windows\System\EqGNHiF.exe
  2⤵
  PID:8284
- C:\Windows\System\cmewvkY.exe
  C:\Windows\System\cmewvkY.exe
  2⤵
  PID:8388
- C:\Windows\System\vwnMVKL.exe
  C:\Windows\System\vwnMVKL.exe
  2⤵
  PID:8424
- C:\Windows\System\DhLYmGC.exe
  C:\Windows\System\DhLYmGC.exe
  2⤵
  PID:8480
- C:\Windows\System\EkYTeKj.exe
  C:\Windows\System\EkYTeKj.exe
  2⤵
  PID:8520
- C:\Windows\System\wtmPWzm.exe
  C:\Windows\System\wtmPWzm.exe
  2⤵
  PID:8432
- C:\Windows\System\jjKMAjV.exe
  C:\Windows\System\jjKMAjV.exe
  2⤵
  PID:8660
- C:\Windows\System\BFEMlBJ.exe
  C:\Windows\System\BFEMlBJ.exe
  2⤵
  PID:8468
- C:\Windows\System\KdZXotw.exe
  C:\Windows\System\KdZXotw.exe
  2⤵
  PID:8500
- C:\Windows\System\qNcnEgp.exe
  C:\Windows\System\qNcnEgp.exe
  2⤵
  PID:8584
- C:\Windows\System\WsiruwB.exe
  C:\Windows\System\WsiruwB.exe
  2⤵
  PID:9004
- C:\Windows\System\ldrHuoj.exe
  C:\Windows\System\ldrHuoj.exe
  2⤵
  PID:9104
- C:\Windows\System\zpIZtJe.exe
  C:\Windows\System\zpIZtJe.exe
  2⤵
  PID:9152
- C:\Windows\System\AFzAaCt.exe
  C:\Windows\System\AFzAaCt.exe
  2⤵
  PID:8272
- C:\Windows\System\UsWCXFf.exe
  C:\Windows\System\UsWCXFf.exe
  2⤵
  PID:7552
- C:\Windows\System\lrJdxfm.exe
  C:\Windows\System\lrJdxfm.exe
  2⤵
  PID:9036
- C:\Windows\System\NOmHwaC.exe
  C:\Windows\System\NOmHwaC.exe
  2⤵
  PID:8404
- C:\Windows\System\icDJPok.exe
  C:\Windows\System\icDJPok.exe
  2⤵
  PID:9136
- C:\Windows\System\ZEiOfBp.exe
  C:\Windows\System\ZEiOfBp.exe
  2⤵
  PID:8344
- C:\Windows\System\elyRdAl.exe
  C:\Windows\System\elyRdAl.exe
  2⤵
  PID:7508
- C:\Windows\System\xlBeZEF.exe
  C:\Windows\System\xlBeZEF.exe
  2⤵
  PID:8532
- C:\Windows\System\SDrEtjc.exe
  C:\Windows\System\SDrEtjc.exe
  2⤵
  PID:8836
- C:\Windows\System\ZrRSXDY.exe
  C:\Windows\System\ZrRSXDY.exe
  2⤵
  PID:8964
- C:\Windows\System\SrBFGjq.exe
  C:\Windows\System\SrBFGjq.exe
  2⤵
  PID:8900
- C:\Windows\System\eeiQygz.exe
  C:\Windows\System\eeiQygz.exe
  2⤵
  PID:8904
- C:\Windows\System\khzYFoJ.exe
  C:\Windows\System\khzYFoJ.exe
  2⤵
  PID:8824
- C:\Windows\System\LmhKgAQ.exe
  C:\Windows\System\LmhKgAQ.exe
  2⤵
  PID:8448
- C:\Windows\System\mYTGLMC.exe
  C:\Windows\System\mYTGLMC.exe
  2⤵
  PID:8360
- C:\Windows\System\rFKMcKR.exe
  C:\Windows\System\rFKMcKR.exe
  2⤵
  PID:8596
- C:\Windows\System\UDTYgXu.exe
  C:\Windows\System\UDTYgXu.exe
  2⤵
  PID:8968
- C:\Windows\System\XRLGeyB.exe
  C:\Windows\System\XRLGeyB.exe
  2⤵
  PID:8624
- C:\Windows\System\slIQCOA.exe
  C:\Windows\System\slIQCOA.exe
  2⤵
  PID:7696
- C:\Windows\System\xCHmLGY.exe
  C:\Windows\System\xCHmLGY.exe
  2⤵
  PID:8648
- C:\Windows\System\uhiQSyQ.exe
  C:\Windows\System\uhiQSyQ.exe
  2⤵
  PID:8436
- C:\Windows\System\YElBnxm.exe
  C:\Windows\System\YElBnxm.exe
  2⤵
  PID:8724
- C:\Windows\System\SYdHEBM.exe
  C:\Windows\System\SYdHEBM.exe
  2⤵
  PID:9200
- C:\Windows\System\nMBKkvU.exe
  C:\Windows\System\nMBKkvU.exe
  2⤵
  PID:9220
- C:\Windows\System\jMOpIKS.exe
  C:\Windows\System\jMOpIKS.exe
  2⤵
  PID:9236
- C:\Windows\System\QhRCJok.exe
  C:\Windows\System\QhRCJok.exe
  2⤵
  PID:9252
- C:\Windows\System\xHedHeg.exe
  C:\Windows\System\xHedHeg.exe
  2⤵
  PID:9268
- C:\Windows\System\tDIBPWX.exe
  C:\Windows\System\tDIBPWX.exe
  2⤵
  PID:9284
- C:\Windows\System\exzwdOE.exe
  C:\Windows\System\exzwdOE.exe
  2⤵
  PID:9300
- C:\Windows\System\dFsrMaQ.exe
  C:\Windows\System\dFsrMaQ.exe
  2⤵
  PID:9316
- C:\Windows\System\GSbWKAt.exe
  C:\Windows\System\GSbWKAt.exe
  2⤵
  PID:9332
- C:\Windows\System\GBjruDl.exe
  C:\Windows\System\GBjruDl.exe
  2⤵
  PID:9352
- C:\Windows\System\hoJhOnR.exe
  C:\Windows\System\hoJhOnR.exe
  2⤵
  PID:9368
- C:\Windows\System\oGSldkU.exe
  C:\Windows\System\oGSldkU.exe
  2⤵
  PID:9384
- C:\Windows\System\PRRWYGH.exe
  C:\Windows\System\PRRWYGH.exe
  2⤵
  PID:9552
- C:\Windows\System\gXnywwh.exe
  C:\Windows\System\gXnywwh.exe
  2⤵
  PID:9600
- C:\Windows\System\zJPewQM.exe
  C:\Windows\System\zJPewQM.exe
  2⤵
  PID:9616
- C:\Windows\System\evYYnWk.exe
  C:\Windows\System\evYYnWk.exe
  2⤵
  PID:9640
- C:\Windows\System\xfdFQyr.exe
  C:\Windows\System\xfdFQyr.exe
  2⤵
  PID:9660
- C:\Windows\System\XUNfgsp.exe
  C:\Windows\System\XUNfgsp.exe
  2⤵
  PID:9676
- C:\Windows\System\oYUtyUw.exe
  C:\Windows\System\oYUtyUw.exe
  2⤵
  PID:9692
- C:\Windows\System\klJJMrH.exe
  C:\Windows\System\klJJMrH.exe
  2⤵
  PID:9708
- C:\Windows\System\hmbnkCV.exe
  C:\Windows\System\hmbnkCV.exe
  2⤵
  PID:9724
- C:\Windows\System\BevObqx.exe
  C:\Windows\System\BevObqx.exe
  2⤵
  PID:9748
- C:\Windows\System\nfxvdsO.exe
  C:\Windows\System\nfxvdsO.exe
  2⤵
  PID:9764
- C:\Windows\System\fAFPxlE.exe
  C:\Windows\System\fAFPxlE.exe
  2⤵
  PID:9780
- C:\Windows\System\fjfYBBO.exe
  C:\Windows\System\fjfYBBO.exe
  2⤵
  PID:9796
- C:\Windows\System\OzxbuSY.exe
  C:\Windows\System\OzxbuSY.exe
  2⤵
  PID:9812
- C:\Windows\System\AxCvUvS.exe
  C:\Windows\System\AxCvUvS.exe
  2⤵
  PID:9828
- C:\Windows\System\tEQjLSO.exe
  C:\Windows\System\tEQjLSO.exe
  2⤵
  PID:9844
- C:\Windows\System\hPTgJof.exe
  C:\Windows\System\hPTgJof.exe
  2⤵
  PID:9860
- C:\Windows\System\zFaxPqg.exe
  C:\Windows\System\zFaxPqg.exe
  2⤵
  PID:9880
- C:\Windows\System\rIeIUof.exe
  C:\Windows\System\rIeIUof.exe
  2⤵
  PID:9896
- C:\Windows\System\lAmRDMQ.exe
  C:\Windows\System\lAmRDMQ.exe
  2⤵
  PID:9912
- C:\Windows\System\AHdiHxp.exe
  C:\Windows\System\AHdiHxp.exe
  2⤵
  PID:9928
- C:\Windows\System\JHICJUv.exe
  C:\Windows\System\JHICJUv.exe
  2⤵
  PID:9944
- C:\Windows\System\PnMOKlP.exe
  C:\Windows\System\PnMOKlP.exe
  2⤵
  PID:9960
- C:\Windows\System\JSmupsf.exe
  C:\Windows\System\JSmupsf.exe
  2⤵
  PID:9976
- C:\Windows\System\AnXEFqx.exe
  C:\Windows\System\AnXEFqx.exe
  2⤵
  PID:9992
- C:\Windows\System\uZRbXjc.exe
  C:\Windows\System\uZRbXjc.exe
  2⤵
  PID:10008
- C:\Windows\System\AtUVZVY.exe
  C:\Windows\System\AtUVZVY.exe
  2⤵
  PID:10024
- C:\Windows\System\mMRwXMN.exe
  C:\Windows\System\mMRwXMN.exe
  2⤵
  PID:10044
- C:\Windows\System\PmVrxeO.exe
  C:\Windows\System\PmVrxeO.exe
  2⤵
  PID:10060
- C:\Windows\System\pubUCso.exe
  C:\Windows\System\pubUCso.exe
  2⤵
  PID:10076
- C:\Windows\System\ArVuvwN.exe
  C:\Windows\System\ArVuvwN.exe
  2⤵
  PID:10092
- C:\Windows\System\omJMENY.exe
  C:\Windows\System\omJMENY.exe
  2⤵
  PID:10112
- C:\Windows\System\XFeUmNT.exe
  C:\Windows\System\XFeUmNT.exe
  2⤵
  PID:10128
- C:\Windows\System\CFUiOLa.exe
  C:\Windows\System\CFUiOLa.exe
  2⤵
  PID:10144
- C:\Windows\System\nDUUVKk.exe
  C:\Windows\System\nDUUVKk.exe
  2⤵
  PID:10160
- C:\Windows\System\OYIFDOU.exe
  C:\Windows\System\OYIFDOU.exe
  2⤵
  PID:10176
- C:\Windows\System\zaQRRKz.exe
  C:\Windows\System\zaQRRKz.exe
  2⤵
  PID:10192
- C:\Windows\System\mXlEKOY.exe
  C:\Windows\System\mXlEKOY.exe
  2⤵
  PID:10208
- C:\Windows\System\FiBOuey.exe
  C:\Windows\System\FiBOuey.exe
  2⤵
  PID:10224
- C:\Windows\System\irNFalc.exe
  C:\Windows\System\irNFalc.exe
  2⤵
  PID:9092
- C:\Windows\System\tpCFCte.exe
  C:\Windows\System\tpCFCte.exe
  2⤵
  PID:9260
- C:\Windows\System\lEGRvvR.exe
  C:\Windows\System\lEGRvvR.exe
  2⤵
  PID:9296
- C:\Windows\System\onVTvoR.exe
  C:\Windows\System\onVTvoR.exe
  2⤵
  PID:9276
- C:\Windows\System\tLbECjh.exe
  C:\Windows\System\tLbECjh.exe
  2⤵
  PID:9312
- C:\Windows\System\XGxXknI.exe
  C:\Windows\System\XGxXknI.exe
  2⤵
  PID:9396
- C:\Windows\System\iyaHAjr.exe
  C:\Windows\System\iyaHAjr.exe
  2⤵
  PID:9344
- C:\Windows\System\EudTTjN.exe
  C:\Windows\System\EudTTjN.exe
  2⤵
  PID:9420
- C:\Windows\System\WPtXbbv.exe
  C:\Windows\System\WPtXbbv.exe
  2⤵
  PID:9448
- C:\Windows\System\mjpdylg.exe
  C:\Windows\System\mjpdylg.exe
  2⤵
  PID:9432
- C:\Windows\System\SfKnsCI.exe
  C:\Windows\System\SfKnsCI.exe
  2⤵
  PID:9468
- C:\Windows\System\dwOedrh.exe
  C:\Windows\System\dwOedrh.exe
  2⤵
  PID:9484
- C:\Windows\System\SIEEmXx.exe
  C:\Windows\System\SIEEmXx.exe
  2⤵
  PID:9496
- C:\Windows\System\rByLVYA.exe
  C:\Windows\System\rByLVYA.exe
  2⤵
  PID:9516
- C:\Windows\System\mFDJKIw.exe
  C:\Windows\System\mFDJKIw.exe
  2⤵
  PID:9532
- C:\Windows\System\ylYlcck.exe
  C:\Windows\System\ylYlcck.exe
  2⤵
  PID:9548
- C:\Windows\System\CtLokLl.exe
  C:\Windows\System\CtLokLl.exe
  2⤵
  PID:9572
- C:\Windows\System\UAubYIy.exe
  C:\Windows\System\UAubYIy.exe
  2⤵
  PID:9588
- C:\Windows\System\CsuBsZp.exe
  C:\Windows\System\CsuBsZp.exe
  2⤵
  PID:9648
- C:\Windows\System\eDeWtyn.exe
  C:\Windows\System\eDeWtyn.exe
  2⤵
  PID:9740
- C:\Windows\System\XeGsQZf.exe
  C:\Windows\System\XeGsQZf.exe
  2⤵
  PID:9852
- C:\Windows\System\gEDFXvK.exe
  C:\Windows\System\gEDFXvK.exe
  2⤵
  PID:9836
- C:\Windows\System\IqjgMHp.exe
  C:\Windows\System\IqjgMHp.exe
  2⤵
  PID:9872
- C:\Windows\System\umhrNrA.exe
  C:\Windows\System\umhrNrA.exe
  2⤵
  PID:9952
- C:\Windows\System\XrVTqsZ.exe
  C:\Windows\System\XrVTqsZ.exe
  2⤵
  PID:9908
- C:\Windows\System\IRFhUaf.exe
  C:\Windows\System\IRFhUaf.exe
  2⤵
  PID:9988
- C:\Windows\System\oZJLyBS.exe
  C:\Windows\System\oZJLyBS.exe
  2⤵
  PID:10052
- C:\Windows\System\wQEMWSA.exe
  C:\Windows\System\wQEMWSA.exe
  2⤵
  PID:10032
- C:\Windows\System\nuPCbAJ.exe
  C:\Windows\System\nuPCbAJ.exe
  2⤵
  PID:10072
- C:\Windows\System\VaeCUsC.exe
  C:\Windows\System\VaeCUsC.exe
  2⤵
  PID:10140
- C:\Windows\System\jgrREVn.exe
  C:\Windows\System\jgrREVn.exe
  2⤵
  PID:9172
- C:\Windows\System\JdpoLfH.exe
  C:\Windows\System\JdpoLfH.exe
  2⤵
  PID:10236
- C:\Windows\System\aqfkRIr.exe
  C:\Windows\System\aqfkRIr.exe
  2⤵
  PID:9264
- C:\Windows\System\VkMeltG.exe
  C:\Windows\System\VkMeltG.exe
  2⤵
  PID:9364
- C:\Windows\System\JEVKCvd.exe
  C:\Windows\System\JEVKCvd.exe
  2⤵
  PID:9416
- C:\Windows\System\NWtySba.exe
  C:\Windows\System\NWtySba.exe
  2⤵
  PID:9404
- C:\Windows\System\fvdKqqh.exe
  C:\Windows\System\fvdKqqh.exe
  2⤵
  PID:9248
- C:\Windows\System\JRmRoSy.exe
  C:\Windows\System\JRmRoSy.exe
  2⤵
  PID:9544
- C:\Windows\System\dcGYkXM.exe
  C:\Windows\System\dcGYkXM.exe
  2⤵
  PID:9444
- C:\Windows\System\sNiZRBL.exe
  C:\Windows\System\sNiZRBL.exe
  2⤵
  PID:9348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DIMWZzz.exe

Filesize
2.0MB

MD5
4031a4bc72d44848133524ea05a0d111

SHA1
9faed984340d8b69a6f8cb552cc51d9ebd5cdcdc

SHA256
277adc1ae9030d2d8e58109f6f7e84f39dd9156a8bff16e591fb277dfb50b827

SHA512
c61d2a3c462e7a945f4a843c2d03b679f2545866f207d57be890d2a074802b5906eac06226a5fa256e47fcd160446941961d9cf29d32340b0877723a0c777c1b

Download Submit
C:\Windows\system\EKEsaPT.exe

Filesize
2.0MB

MD5
a19d7b94096f1abc01249b856be9b34c

SHA1
de38452da456f4544a6a7efc887fd1bf45d64776

SHA256
4bd011c5328f2e438a6e0e9045c07bd0dc2d30dbf96abc764026a4d503fa98ec

SHA512
67a6117c47d3e7bcbb1f1092d1e9e2af7e8a0f70bdc991803fa562e3a7f67b09e16dbe21703ab1ec2c8af407c127cfd0781a41d21df7863ecd1d30c78d4e3939

Download Submit
C:\Windows\system\FQZUQqD.exe

Filesize
2.0MB

MD5
aa1f0e9d0ec175f17ac7fdca4a2d0e96

SHA1
90680761b2ff2e16fa7742766a67a322a9fd3319

SHA256
b914fdf16819b534686503291892d0c57b81f36976a16db9d0e9e8487ea74c5b

SHA512
65e64789b8f1f28b76b403de598afa06cdb32ca5757f4f0474b1f9fe1779da0e18f654a007e4cd363db405b174d01b16823ca8e0479fe816640cfeb90d5ced53

Download Submit
C:\Windows\system\FeDfBmt.exe

Filesize
2.0MB

MD5
0512bbf11b409312adbc4d2179b43838

SHA1
93a2b068f76106d9d6f31c7b8608114fe72d6c03

SHA256
f133986647ed6d728521a84f8828ca229019ccac0481819ae03899a9ef1977d7

SHA512
a1e44fcaaf5f262563249a173f8a705f91c6c37831c370bbc9c6dd68e1c6718ef8ed3902a412e1927764c1fdede70a90934cb8c9eb0a59fa4387f851abc92398

Download Submit
C:\Windows\system\GWwPTcp.exe

Filesize
2.0MB

MD5
bd301e79c82ba4d27adb0f5a2498acf9

SHA1
6fa34230eb9e6afb45c187c1dc594aeca094479c

SHA256
99d18604ff4e603de06b2b529047859d5d16767a30a1955ea1834141e1fef7c8

SHA512
8680d364ec9885e75a66148ff3cf3fe31a37311f98bb79094e75b745f9683cb3dbb501825c08759c0aaab75deb708d1d339ef95e7c352cd9969a1c382477fd58

Download Submit
C:\Windows\system\LKFIswa.exe

Filesize
2.0MB

MD5
5143fc0e124c2e26a2439088b19f822a

SHA1
65c2d662ca4de0254e1409792146adf8edc49ce8

SHA256
ec7c6ed474c98380d71e4efe212cbf873acf8eea772d47d92738982f466dc486

SHA512
da04e65dfaf89ff55f8f0e4607725ef4eeba75989dd9e514e7573fedd9474c915ea946dcec7313653e842dc5f5817f283ee95214cef49584abb943f9b21c1113

Download Submit
C:\Windows\system\LsgkjVc.exe

Filesize
2.0MB

MD5
b24f2cf906f119ad25e3a77cf9e45f53

SHA1
1b7040611d137d1e9bf6a03902c76705102a659f

SHA256
328cecef89b320fc3e9e397101afe566436f1ec2181bfb50e88127ede5d5bb28

SHA512
f9c1ce397cae980570c758d20b51f7c9687a441cdda47a5a4aed071bd6a897ed84081d6383edca05d70dccd40e97d64fbde76591638297e614ff0727280bc165

Download Submit
C:\Windows\system\MzefOSI.exe

Filesize
2.0MB

MD5
b00675384cba922d31a101d607e13953

SHA1
9cb2e56203c342077f651c0174869a7406f4dcf9

SHA256
be7801fdd0959e147a659b22458e390df9ee6b00097bd5c7e5ec4bdd086ed353

SHA512
ef94ea0f4bbc8340c071961315c06e2603e5c239ea918a8070876ca8598dbff63adf9d71a14b4b7609d730500d3c13e0a5d5ef1e1b4050b0969f74741f887af4

Download Submit
C:\Windows\system\OVKEZMo.exe

Filesize
2.0MB

MD5
dc86d852bc8d43ec285b9bd4e18bb83f

SHA1
a7edc53066e25314b7599370e3d89f245b1e4f22

SHA256
ccfcc04b14a073d8966c931c725ff769b8d6d7e9a5b7a3a9b65897654a7e0547

SHA512
c3156f4f0c3d82400f18661e48957c81dcf67cb38a71375a924470c4b148cc62ca5a97995d6525fc1507d054f3d450c1a36f60037b5916bb32bae1efefc9d502

Download Submit
C:\Windows\system\OeFjXjg.exe

Filesize
2.0MB

MD5
adf272003d8d3cbbb0a47ffcd6336acb

SHA1
ba1afc0604df3bdae03dfa918dc24ecf2500c6b4

SHA256
3fbc650b3fabbb361209000eeac41dda0a920d9e12d7d04b1ff3f4e04b6b20ed

SHA512
a0f46d04b3380c578d44065ff70336d88dc1cef73b7a77b59397f0efcf2186754bae288e64e7ebfb2ab0384577e0dd84fb15b8aff2e6bf8b00e0936cedde7b9d

Download Submit
C:\Windows\system\PEhNkja.exe

Filesize
2.0MB

MD5
4fa588575bcfb7d8f73593d884da5779

SHA1
b651f9d1c8ded2d917b7b69455fea03c4bcc426d

SHA256
d907a79a0788941897fd885c5be03fd8743da01ea0f33b9a2751ce08af686c20

SHA512
43812d0b66e55096030b49951e9a1f775125510bbf4c887a1a05c8512ce573ac8091d3d780aa004644828ec0b8277abe1c37c02c8fccadaa6e72c0ed7e960ab0

Download Submit
C:\Windows\system\UtPdkDW.exe

Filesize
2.0MB

MD5
ef036ea46b8f9f9ec0e3f47f8a480804

SHA1
aaf086c06dabf139948c94e73df2735fb200c179

SHA256
adb05d4b2e0c5ed6ad04d9c37b3323244332316769a232e44e4f71fe00051845

SHA512
ea15df250e7ae7275e10fc09573590e9a30c01200f24d2b03fcfbaa29d4673018eb5132a149c3e81f14801d88256960e37c3d31b311ef1c65e232494dc4cb123

Download Submit
C:\Windows\system\UzFWSVV.exe

Filesize
2.0MB

MD5
8a27583fa41fb72d5d2a85a15e2ee08c

SHA1
66291724d8e0e211a2ce802c515558fae3df034d

SHA256
c7a4e854e953de156895f7122fa435486518a36ed3a508ef9ac28364c2cbe29e

SHA512
ec709dbbf4077597a17c9e9cce32f7adff0375057988a9570d7318f699ef8196b61b378c6c8bcf2b7a8809ca2c5ed7adbd42a413f6d9cc85872416599590ad5d

Download Submit
C:\Windows\system\WRVxIDx.exe

Filesize
2.0MB

MD5
27039f05fa4062e94ebb7d73a01e67ad

SHA1
9ab658d3605b5577c2dc8c71beb3dd83c7cf33cb

SHA256
adbd0ea62f192a2bc2334aebd0502e561087725ebb80a874de6a9c48986cd0d6

SHA512
e409d3e67fbe26327bf214405f857ee7cac739188329bcecbb66544a9a5be89a75a1ebedcfa0be580d28af1ee69ffadbcc6ec9a8b30f5f7408aeeb7addf40981

Download Submit
C:\Windows\system\YtLngHn.exe

Filesize
2.0MB

MD5
c3e6785917c518cdfed951dc7a5c85bc

SHA1
d3763706c3b2388cd7112a585f668b98066ca9fe

SHA256
01e6a28eaeef0899e90bdeae4f231b69bb4ef2620bf654962d1f2b916048b5a8

SHA512
c98c6b0900cda85f19564a9ac3df06f66a735fa89b50e44df974757ed1cdbc45b6ce0e5ed5e6baeccd9c7a4a705fe049febb273fa51c39bd37cd0ce6cd47738a

Download Submit
C:\Windows\system\aMEbbum.exe

Filesize
2.0MB

MD5
b065265b5cd3b29cbb2860d42f3966d3

SHA1
f52f5e57793fe80356ce4c487d26115fecc0f311

SHA256
5ef730a97ff0780232054170b6b53519003decaaeb66716f5cf9e2d973dcac96

SHA512
0784ffdaa6f45a56f48eb0744c0856a900640083185523df810d6699f6c6e255e81f0033b182560dbeb72289643653e6fd941d61eadd8aa643df6abd9a9919b5

Download Submit
C:\Windows\system\baHNQBd.exe

Filesize
2.0MB

MD5
b8d4b4691e5554be3efc37f09dba697a

SHA1
71878b688b5f7fd01b31d88dc055b1391aec0879

SHA256
4f36f5dc635cde688e9a0362bef83b714aa6824c93959a6c0022487b8198fc37

SHA512
9390e53a0a61a8a461375ca5261a674453367b5b98bca94c3c5e1a7c304087fe0ebb859ba48de72c00c9121791a50628d796f51e5c7e4dfbc79ca06c3a73ffad

Download Submit
C:\Windows\system\etKQKqk.exe

Filesize
2.0MB

MD5
98d4c298fc1203d32992394981968a7e

SHA1
8ae1ec00896655c9d4f500823585fee46691cfe5

SHA256
00a8fd62d568384eb2cbbcc7870e887df11eeb1e7a74f0765f6af7c308e5c61c

SHA512
32ced77a1ecf4493e62148ad345da190299267fa5065ef6125eeca6369a4d60ca1363e13ef13fb29bddd2ae5bb083de554198c32633b71db28dbaffdd98735e9

Download Submit
C:\Windows\system\fSsleIt.exe

Filesize
2.0MB

MD5
1afa3a1db23b37db073f8e94e76a3073

SHA1
6b5c960dc07c8d53b267693390d684b7e7e2b675

SHA256
66454aed44853f79b330c514c5412390ba3c338af8ddace88ee34d871e131a00

SHA512
a82283d2d0ea1952d89da7eeaa27399736692983a6fb51bfe1a506605cf4c9844cab7f5aab6c7bc8482fbc780c9351a87d5f4ce3590a06670a39763cc15f554b

Download Submit
C:\Windows\system\gAxWESk.exe

Filesize
2.0MB

MD5
d97d81b40a94aafc8144cafdac0f4a31

SHA1
e86474ae63d9ec2512d50b255e76e3507e51980c

SHA256
ba1c89aa4b8d03400f64b82115aec2e9ef68c07a3197b16487fc3a97f6412135

SHA512
b07872e0a25e68ce4970e592b50cff27e5f5d7c65a08a663396bd274af2a7fc3bd47a0118e09bd308f2c88bc945aec9febc9a5632e9fb3ab34a3d551119623eb

Download Submit
C:\Windows\system\hCLvmNU.exe

Filesize
2.0MB

MD5
10dd573fe020bc8ef8c245ce14d7570f

SHA1
116eb7667294ff6d45354699fd06f640a10dfef4

SHA256
1715d354d9fc21c6678445867bfd79ad54e31ddfeae302683f56e760fa589acd

SHA512
6f180ffcf7b4200685a2800f3a4e80b8c183c1f11c8702f04a7287d75c98a51b832a27a9295e9ab324fb676bfc1e2ecbda33286add39ca685aaa7de229d0f89f

Download Submit
C:\Windows\system\humciGv.exe

Filesize
2.0MB

MD5
7d21e60501c78c7f73d495855b07a2cb

SHA1
40dac4098be2a22cfb18a344d595cf9aa995f464

SHA256
30d51bcc1b398a9cbe55823940350d358c11a77d3f85daa6729b6f7e95fac198

SHA512
641b254b328ccdaabc9a42ce60d1b8ce3894ba0b102406e6d9a33099e027829a71569bd003640fb7d5e802f84fe7a27a7923c5ea14c962c306a1dd1c9a48207b

Download Submit
C:\Windows\system\lNBopwF.exe

Filesize
2.0MB

MD5
a4c8459ced00b47c1fc7841267b1148b

SHA1
8ed7c2721ef21c6631b14ff87e9712e81c907147

SHA256
e0d54a1288104f7d5cd1f2a9f4cf8a429d9b3a732049a3d45caae1e1af7b9466

SHA512
3f6548dc4e7977591282b700961983f0bd3f31602e67500470a90efa199edd50679fdb72faf1048c8a5efb8bc79d5afd5c0d7c0fc6ed3e5115c25439860e5fe6

Download Submit
C:\Windows\system\nlUhJBh.exe

Filesize
2.0MB

MD5
4bc7e915c0a6666a8d3b6a821d7f639a

SHA1
55c1f64a0cef3b19f8a66c55bf8eaf41ee284d4b

SHA256
480536024f41efcba2d28d7a90430400611b38d3149b3bd15829bee0894bc31e

SHA512
c1c0f0aa05a6469409cbf5ca2964584a6920a0a7007e82827d2d979aa4332af7cab12ba8f3da0d312b01477227bd2f86e2cc879c14843c3cb0f068e496389ec6

Download Submit
C:\Windows\system\pQPutxM.exe

Filesize
2.0MB

MD5
6fe207259889af795f213ef4466d7c75

SHA1
420e1b273485abf708d81c17f28296248860858f

SHA256
31be38edae9c7b27c43776905e6c6b924d951f5742ea57a7c1e985c0b3e0b205

SHA512
5f8a9c6c0ef6602c98158c11ecaf9a9970158678bb20d92263c981082223eee717fcf012e50bbae8af67af0409f241544bde42f955d963acd7163c7f1e2561dd

Download Submit
C:\Windows\system\rlZrKRS.exe

Filesize
2.0MB

MD5
908968974f9cd8af1fee72ecb9d46699

SHA1
7922cb6f99b79ef17a1eb0f76082b9569865da0d

SHA256
4d9f773f6c3d41f7cfc1fa46d235e7993f1698b95486b907772420131357cdb5

SHA512
41825299c5a913299025d39e62606be254d9a443b0c8e40ee40d31120f6180bdf7b8b521ef1876f70427cc1ddcfb20b3bc006dca7dcac0f19f690bfb320f60b2

Download Submit
C:\Windows\system\uGHbxLq.exe

Filesize
2.0MB

MD5
ae0ff7353fa63b2f9af98449cc088100

SHA1
b3e5a0630115c89cbb389343e2aaf299d9274131

SHA256
55cc0a2a4890606aa766659b7a9a1dc4deb90993666915748545f09694aa5b20

SHA512
6d9c3edef7ee4d42088a5db3f847d12a31fc7b061fe119ec68bc1b6903d791940f51a2933d987834b3ee6e344d3fd7ddbc51f53b14644a0b301080e716e60481

Download Submit
C:\Windows\system\vIxJLiw.exe

Filesize
2.0MB

MD5
310f6013448c2e20db9bdda601726c6e

SHA1
b414375c2eb91d03fffacc3d2226e9d669d9c918

SHA256
5ef613a036f76b3e30298075d5fa398f132357db2cbb6851abf58197143bdaee

SHA512
3327cd1fbae37c5062352966cb5f1ceef515c8513fdbe13bb81eb28c67a5260795635ef1331745daa54e171539129b3562fc704f9b79ceed351d4f24c407f2f7

Download Submit
C:\Windows\system\vONlnRh.exe

Filesize
2.0MB

MD5
08623c4a4031b1451240db48f39010ed

SHA1
4bb4be0bfccb89db11ba04feb87d415144ed1b92

SHA256
44f2e731fbc35ab9047c66f5733df88a0edc9e4d7f48318eaf817a692b59f528

SHA512
8adcb373e88bfac372ef803e2d49a27710cdd15ac7aa8b0975b296320953bf19310c893e2875d387b1c9411fb2b904517c179be417503f6c36cecdeb8be6e63c

Download Submit
C:\Windows\system\vTsDWKw.exe

Filesize
2.0MB

MD5
862819237eb50927963cd927016534a9

SHA1
1579828961016c76ea75d61c0700f4d3c9b320d9

SHA256
1a9de04be488b277920248490e999927930197395fd99f5e7f93243fe4661f06

SHA512
1e9a543a44a457dcbc68e9713dcddf1cc87d9c80e8dc1d8a13294d0a2641b7b0e9719278979a6ce2b504d564d877b26fb1dd5cd750189f746241617afe607a58

Download Submit
\Windows\system\kwCQXVw.exe

Filesize
2.0MB

MD5
874cff4d4b07d79e2a7b8a7dadf3fcb6

SHA1
1d5cb2a197f2c4e213706878fc4744ef36dda5d8

SHA256
1e8fcee6d39225828880994890d8c20f8569280c9783be861abef35ab76a27a9

SHA512
b3a71bd64c7c91fb20803f0396a015626628987942e4db7e1a66fefae3909dbf92ce41b001f323c8a00f9514b35cf3630f1fed31d7de57e97bd2bc26eb9692a8

Download Submit
\Windows\system\qaQlykd.exe

Filesize
2.0MB

MD5
d37b0ca67ae1ea1d13c60964bf25ae0c

SHA1
5e7723c70ab1dac65633c13a6884e1e6a36ab49c

SHA256
a541eaaa48cfe328bbf77e1e7978eb90c873ad17f3bb4de72cf2bda053ad4395

SHA512
be3b9404d9b4e0fcb0e9dc5dbcada9ce5c2b67082792bd08288dc3a42a65b470444c728dd577bd0b8db36ea43d3ca193688b06709696c2ddfa1eddd57108a479

Download Submit
memory/588-4740-0x000000013F920000-0x000000013FD12000-memory.dmp

Filesize
3.9MB

Download
memory/588-266-0x000000013F920000-0x000000013FD12000-memory.dmp

Filesize
3.9MB

Download
memory/588-66-0x000000013F920000-0x000000013FD12000-memory.dmp

Filesize
3.9MB

Download
memory/1060-4701-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download
memory/1060-96-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download
memory/1592-4699-0x000000013F3F0000-0x000000013F7E2000-memory.dmp

Filesize
3.9MB

Download
memory/1592-78-0x000000013F3F0000-0x000000013F7E2000-memory.dmp

Filesize
3.9MB

Download
memory/1592-657-0x000000013F3F0000-0x000000013F7E2000-memory.dmp

Filesize
3.9MB

Download
memory/1648-9-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/1676-1037-0x000000013FC40000-0x0000000140032000-memory.dmp

Filesize
3.9MB

Download
memory/1676-85-0x000000013FC40000-0x0000000140032000-memory.dmp

Filesize
3.9MB

Download
memory/1676-4771-0x000000013FC40000-0x0000000140032000-memory.dmp

Filesize
3.9MB

Download
memory/2128-4708-0x000000013F200000-0x000000013F5F2000-memory.dmp

Filesize
3.9MB

Download
memory/2128-73-0x000000013F200000-0x000000013F5F2000-memory.dmp

Filesize
3.9MB

Download
memory/2216-43-0x000007FEF4FB0000-0x000007FEF594D000-memory.dmp

Filesize
9.6MB

Download
memory/2216-90-0x000007FEF4FB0000-0x000007FEF594D000-memory.dmp

Filesize
9.6MB

Download
memory/2216-49-0x000007FEF4FB0000-0x000007FEF594D000-memory.dmp

Filesize
9.6MB

Download
memory/2216-101-0x000007FEF4FB0000-0x000007FEF594D000-memory.dmp

Filesize
9.6MB

Download
memory/2216-19-0x000007FEF526E000-0x000007FEF526F000-memory.dmp

Filesize
4KB

Download
memory/2216-23-0x0000000001EC0000-0x0000000001EC8000-memory.dmp

Filesize
32KB

Download
memory/2216-22-0x000000001B760000-0x000000001BA42000-memory.dmp

Filesize
2.9MB

Download
memory/2216-107-0x000007FEF4FB0000-0x000007FEF594D000-memory.dmp

Filesize
9.6MB

Download
memory/2356-51-0x000000013FDB0000-0x00000001401A2000-memory.dmp

Filesize
3.9MB

Download
memory/2356-84-0x0000000003370000-0x0000000003762000-memory.dmp

Filesize
3.9MB

Download
memory/2356-8-0x0000000002D40000-0x0000000003132000-memory.dmp

Filesize
3.9MB

Download
memory/2356-64-0x0000000003370000-0x0000000003762000-memory.dmp

Filesize
3.9MB

Download
memory/2356-63-0x000000013F260000-0x000000013F652000-memory.dmp

Filesize
3.9MB

Download
memory/2356-6743-0x0000000003370000-0x0000000003762000-memory.dmp

Filesize
3.9MB

Download
memory/2356-61-0x000000013F360000-0x000000013F752000-memory.dmp

Filesize
3.9MB

Download
memory/2356-656-0x000000013F3F0000-0x000000013F7E2000-memory.dmp

Filesize
3.9MB

Download
memory/2356-59-0x000000013FE80000-0x0000000140272000-memory.dmp

Filesize
3.9MB

Download
memory/2356-53-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download
memory/2356-1036-0x0000000003370000-0x0000000003762000-memory.dmp

Filesize
3.9MB

Download
memory/2356-83-0x000000013F960000-0x000000013FD52000-memory.dmp

Filesize
3.9MB

Download
memory/2356-77-0x000000013F3F0000-0x000000013F7E2000-memory.dmp

Filesize
3.9MB

Download
memory/2356-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2356-18-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/2356-0-0x000000013F960000-0x000000013FD52000-memory.dmp

Filesize
3.9MB

Download
memory/2356-72-0x000000013F200000-0x000000013F5F2000-memory.dmp

Filesize
3.9MB

Download
memory/2560-60-0x000000013FE80000-0x0000000140272000-memory.dmp

Filesize
3.9MB

Download
memory/2612-54-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download
memory/2636-62-0x000000013F360000-0x000000013F752000-memory.dmp

Filesize
3.9MB

Download
memory/2680-52-0x000000013F260000-0x000000013F652000-memory.dmp

Filesize
3.9MB

Download
memory/2708-48-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/2908-55-0x000000013FDB0000-0x00000001401A2000-memory.dmp

Filesize
3.9MB

Download