xmrig | eea39b3a7c16f091abc2d5cd627ae66d3f67278b941741fb39e94905ea1ed9ce

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/09/2024, 00:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
Size

1.9MB
MD5

dab976ab2fe481f6ad2b8588e2bdf4b0
SHA1

cea1f9a618457236831cd24b27d67629d2666110
SHA256

eea39b3a7c16f091abc2d5cd627ae66d3f67278b941741fb39e94905ea1ed9ce
SHA512

e8ec1986c9e70785b7ed3ef02278b5e448b38eef453716a31fa332de21651cff7f404cf15ae147e00c69ccea8c6ee5b34070c739767a60dc407ae473f62ffc3a
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82S5k7l:NABP

Score

10^/10

xmrig discovery execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 20 IoCs

miner

resource	yara_rule
behavioral1/memory/2100-15-0x000000013FF90000-0x0000000140382000-memory.dmp	xmrig
behavioral1/memory/2584-186-0x000000013F3D0000-0x000000013F7C2000-memory.dmp	xmrig
behavioral1/memory/2968-189-0x000000013FB60000-0x000000013FF52000-memory.dmp	xmrig
behavioral1/memory/2668-179-0x000000013F8B0000-0x000000013FCA2000-memory.dmp	xmrig
behavioral1/memory/2252-210-0x000000013FB60000-0x000000013FF52000-memory.dmp	xmrig
behavioral1/memory/2608-205-0x000000013FAA0000-0x000000013FE92000-memory.dmp	xmrig
behavioral1/memory/2824-227-0x000000013FC00000-0x000000013FFF2000-memory.dmp	xmrig
behavioral1/memory/2588-195-0x000000013FCB0000-0x00000001400A2000-memory.dmp	xmrig
behavioral1/memory/2964-184-0x000000013FEE0000-0x00000001402D2000-memory.dmp	xmrig
behavioral1/memory/2212-36-0x000000013F910000-0x000000013FD02000-memory.dmp	xmrig
behavioral1/memory/2332-14-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	xmrig
behavioral1/memory/2208-790-0x000000013F360000-0x000000013F752000-memory.dmp	xmrig
behavioral1/memory/2824-5473-0x000000013FC00000-0x000000013FFF2000-memory.dmp	xmrig
behavioral1/memory/2968-5755-0x000000013FB60000-0x000000013FF52000-memory.dmp	xmrig
behavioral1/memory/2668-5756-0x000000013F8B0000-0x000000013FCA2000-memory.dmp	xmrig
behavioral1/memory/2588-5775-0x000000013FCB0000-0x00000001400A2000-memory.dmp	xmrig
behavioral1/memory/2608-5774-0x000000013FAA0000-0x000000013FE92000-memory.dmp	xmrig
behavioral1/memory/2212-5773-0x000000013F910000-0x000000013FD02000-memory.dmp	xmrig
behavioral1/memory/2584-6384-0x000000013F3D0000-0x000000013F7C2000-memory.dmp	xmrig
behavioral1/memory/2252-6401-0x000000013FB60000-0x000000013FF52000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1800	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2332	acmKUEI.exe
2100	cknNqlE.exe
2212	OcfbQzt.exe
2824	xkyhaLG.exe
2668	inxdlSu.exe
2964	gTvOTZD.exe
2584	QkDfKRo.exe
2968	yaVVygN.exe
2588	OAAcFAC.exe
2608	nHRaupm.exe
2252	qsGZMUU.exe
2604	SVHRsMk.exe
2636	dYzaZJo.exe
2044	qZVCxDL.exe
2448	WmTwGkx.exe
640	fxZRfTE.exe
2904	cdrQwpT.exe
2852	BJsFGbj.exe
2916	hgkZAVt.exe
320	jarlkMq.exe
572	SiyxQFI.exe
1436	QNmJnBu.exe
860	jwIWqkU.exe
3068	pcOYeNs.exe
2936	AqSxxar.exe
328	yAzYtVv.exe
1900	dXXxptz.exe
1204	aUDJhTS.exe
1244	hhoOerw.exe
2440	IncjIzd.exe
1384	DpQbpKS.exe
812	jNAVOuW.exe
1888	xpBxUym.exe
2228	EaPSbSx.exe
2036	CHdKWbp.exe
2236	sDtTWvB.exe
1652	XEuLhCu.exe
1760	ZVXRfRq.exe
3004	INOpEMQ.exe
2424	HOpBQzf.exe
1680	BLgHTRp.exe
2832	nVoLoDZ.exe
2220	GdmkQhv.exe
2628	YRBQgbR.exe
1716	fPMaHTT.exe
2516	ColTATo.exe
2028	JKEjCAX.exe
1536	gqsEYyo.exe
3028	WIrFMxE.exe
2416	rEMBuXk.exe
2272	miKDwSR.exe
1968	PSAAWBK.exe
1656	PyxSTDD.exe
1764	yABKEIC.exe
2888	ZVjwDPl.exe
2472	BlvbDhM.exe
1572	BtpCLvc.exe
2664	gYgLuXP.exe
1028	xrutcZi.exe
2944	FCRtCpD.exe
1476	wcRfIbR.exe
2088	lhbahFI.exe
2128	RmAzJYZ.exe
2328	mHWTISU.exe

Loads dropped DLL 64 IoCs

pid	Process
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe

UPX packed file 55 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2208-0-0x000000013F360000-0x000000013F752000-memory.dmp	upx
behavioral1/files/0x0007000000019467-7.dat	upx
behavioral1/files/0x000b000000012281-6.dat	upx
behavioral1/memory/2100-15-0x000000013FF90000-0x0000000140382000-memory.dmp	upx
behavioral1/files/0x0006000000019496-9.dat	upx
behavioral1/files/0x0009000000019506-40.dat	upx
behavioral1/files/0x000500000001967f-50.dat	upx
behavioral1/files/0x000500000001970b-58.dat	upx
behavioral1/files/0x0005000000019c54-65.dat	upx
behavioral1/files/0x00060000000194ad-21.dat	upx
behavioral1/files/0x0005000000019c58-84.dat	upx
behavioral1/files/0x0005000000019dcb-104.dat	upx
behavioral1/files/0x0005000000019fbc-110.dat	upx
behavioral1/files/0x0005000000019dd7-117.dat	upx
behavioral1/files/0x000500000001a377-145.dat	upx
behavioral1/files/0x000500000001a443-162.dat	upx
behavioral1/memory/2584-186-0x000000013F3D0000-0x000000013F7C2000-memory.dmp	upx
behavioral1/files/0x000500000001a43f-152.dat	upx
behavioral1/memory/2968-189-0x000000013FB60000-0x000000013FF52000-memory.dmp	upx
behavioral1/memory/2668-179-0x000000013F8B0000-0x000000013FCA2000-memory.dmp	upx
behavioral1/files/0x000500000001a488-173.dat	upx
behavioral1/files/0x000500000001a445-167.dat	upx
behavioral1/files/0x000500000001a441-158.dat	upx
behavioral1/memory/2252-210-0x000000013FB60000-0x000000013FF52000-memory.dmp	upx
behavioral1/memory/2608-205-0x000000013FAA0000-0x000000013FE92000-memory.dmp	upx
behavioral1/memory/2824-227-0x000000013FC00000-0x000000013FFF2000-memory.dmp	upx
behavioral1/memory/2588-195-0x000000013FCB0000-0x00000001400A2000-memory.dmp	upx
behavioral1/memory/2964-184-0x000000013FEE0000-0x00000001402D2000-memory.dmp	upx
behavioral1/files/0x000500000001a44b-170.dat	upx
behavioral1/files/0x0008000000019438-156.dat	upx
behavioral1/files/0x000500000001a322-142.dat	upx
behavioral1/files/0x000500000001a09f-132.dat	upx
behavioral1/files/0x000500000001a0b8-136.dat	upx
behavioral1/files/0x000500000001a094-126.dat	upx
behavioral1/files/0x0005000000019fda-121.dat	upx
behavioral1/files/0x0005000000019c73-100.dat	upx
behavioral1/files/0x0005000000019d62-95.dat	upx
behavioral1/files/0x0005000000019c56-89.dat	upx
behavioral1/files/0x00050000000199b9-80.dat	upx
behavioral1/files/0x0007000000004e74-57.dat	upx
behavioral1/files/0x00050000000196c0-53.dat	upx
behavioral1/files/0x000700000001963b-43.dat	upx
behavioral1/files/0x0005000000019d3d-93.dat	upx
behavioral1/files/0x00060000000194d0-38.dat	upx
behavioral1/memory/2212-36-0x000000013F910000-0x000000013FD02000-memory.dmp	upx
behavioral1/memory/2332-14-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	upx
behavioral1/memory/2208-790-0x000000013F360000-0x000000013F752000-memory.dmp	upx
behavioral1/memory/2824-5473-0x000000013FC00000-0x000000013FFF2000-memory.dmp	upx
behavioral1/memory/2968-5755-0x000000013FB60000-0x000000013FF52000-memory.dmp	upx
behavioral1/memory/2668-5756-0x000000013F8B0000-0x000000013FCA2000-memory.dmp	upx
behavioral1/memory/2588-5775-0x000000013FCB0000-0x00000001400A2000-memory.dmp	upx
behavioral1/memory/2608-5774-0x000000013FAA0000-0x000000013FE92000-memory.dmp	upx
behavioral1/memory/2212-5773-0x000000013F910000-0x000000013FD02000-memory.dmp	upx
behavioral1/memory/2584-6384-0x000000013F3D0000-0x000000013F7C2000-memory.dmp	upx
behavioral1/memory/2252-6401-0x000000013FB60000-0x000000013FF52000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\XPKegey.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\lzcingi.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\SfPMvrO.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\xlsygJH.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\DTZibRP.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\hTZnzEk.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\taBywYB.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\RmAzJYZ.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\BsRldWC.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\YRJUifO.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\LluJzmU.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\GLDWUcr.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\pdqWwjU.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\MCgFoKu.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\UoIWTup.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\zVwTsLH.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\hSeWYBb.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\LkOKVFY.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\rJtqBIy.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\QIEexjA.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\oNZDUjT.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\kgfgdwt.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\JIZaoww.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\efWToUe.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\kbrRved.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\nuQbSfQ.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\zzAvrlK.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\ocbqndS.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\PNLeVAI.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\XPEaZgc.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\kmGfGdF.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\HuScraP.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\QCZLnPQ.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\nbTvtim.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\ZMlMwYc.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\cqwYnjB.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\xZeUNtn.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\YEuDfXL.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\LTwDCQl.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\qweYhSb.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\vZLGeRP.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\ssPdnFF.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\BIanpxZ.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\JYfrAYF.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\nATVOZT.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\KOKCRSH.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\AofAzpT.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\xNINygj.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\uYeDrTR.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\skaiWtD.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\hVuajPl.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\lQxHmMM.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\ZrxsMSg.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\TXhwyNY.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\yEBHTZW.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\wJnsOeK.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\zwWcSnK.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\tKoPLVg.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\KGMYKqh.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\cqBESot.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\msndCjX.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\ZDXvGuL.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\FglIhRc.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
File created	C:\Windows\System\JXEuKmC.exe	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
9412	hpingfH.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1800	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
Token: SeLockMemoryPrivilege	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
Token: SeDebugPrivilege	1800	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 1800	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	32
PID 2208 wrote to memory of 1800	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	32
PID 2208 wrote to memory of 1800	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	32
PID 2208 wrote to memory of 2332	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	33
PID 2208 wrote to memory of 2332	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	33
PID 2208 wrote to memory of 2332	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	33
PID 2208 wrote to memory of 2100	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	34
PID 2208 wrote to memory of 2100	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	34
PID 2208 wrote to memory of 2100	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	34
PID 2208 wrote to memory of 2212	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	35
PID 2208 wrote to memory of 2212	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	35
PID 2208 wrote to memory of 2212	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	35
PID 2208 wrote to memory of 2668	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	36
PID 2208 wrote to memory of 2668	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	36
PID 2208 wrote to memory of 2668	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	36
PID 2208 wrote to memory of 2824	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	37
PID 2208 wrote to memory of 2824	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	37
PID 2208 wrote to memory of 2824	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	37
PID 2208 wrote to memory of 2968	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	38
PID 2208 wrote to memory of 2968	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	38
PID 2208 wrote to memory of 2968	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	38
PID 2208 wrote to memory of 2964	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	39
PID 2208 wrote to memory of 2964	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	39
PID 2208 wrote to memory of 2964	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	39
PID 2208 wrote to memory of 2252	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	40
PID 2208 wrote to memory of 2252	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	40
PID 2208 wrote to memory of 2252	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	40
PID 2208 wrote to memory of 2584	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	41
PID 2208 wrote to memory of 2584	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	41
PID 2208 wrote to memory of 2584	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	41
PID 2208 wrote to memory of 2604	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	42
PID 2208 wrote to memory of 2604	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	42
PID 2208 wrote to memory of 2604	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	42
PID 2208 wrote to memory of 2588	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	43
PID 2208 wrote to memory of 2588	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	43
PID 2208 wrote to memory of 2588	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	43
PID 2208 wrote to memory of 2636	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	44
PID 2208 wrote to memory of 2636	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	44
PID 2208 wrote to memory of 2636	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	44
PID 2208 wrote to memory of 2608	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	45
PID 2208 wrote to memory of 2608	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	45
PID 2208 wrote to memory of 2608	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	45
PID 2208 wrote to memory of 2448	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	46
PID 2208 wrote to memory of 2448	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	46
PID 2208 wrote to memory of 2448	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	46
PID 2208 wrote to memory of 2044	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	47
PID 2208 wrote to memory of 2044	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	47
PID 2208 wrote to memory of 2044	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	47
PID 2208 wrote to memory of 2904	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	48
PID 2208 wrote to memory of 2904	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	48
PID 2208 wrote to memory of 2904	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	48
PID 2208 wrote to memory of 640	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	49
PID 2208 wrote to memory of 640	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	49
PID 2208 wrote to memory of 640	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	49
PID 2208 wrote to memory of 320	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	50
PID 2208 wrote to memory of 320	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	50
PID 2208 wrote to memory of 320	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	50
PID 2208 wrote to memory of 2852	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	51
PID 2208 wrote to memory of 2852	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	51
PID 2208 wrote to memory of 2852	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	51
PID 2208 wrote to memory of 572	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	52
PID 2208 wrote to memory of 572	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	52
PID 2208 wrote to memory of 572	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	52
PID 2208 wrote to memory of 2916	2208	dab976ab2fe481f6ad2b8588e2bdf4b0N.exe	53

C:\Users\Admin\AppData\Local\Temp\dab976ab2fe481f6ad2b8588e2bdf4b0N.exe
"C:\Users\Admin\AppData\Local\Temp\dab976ab2fe481f6ad2b8588e2bdf4b0N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1800
- C:\Windows\System\acmKUEI.exe
  C:\Windows\System\acmKUEI.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\cknNqlE.exe
  C:\Windows\System\cknNqlE.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\OcfbQzt.exe
  C:\Windows\System\OcfbQzt.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\inxdlSu.exe
  C:\Windows\System\inxdlSu.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\xkyhaLG.exe
  C:\Windows\System\xkyhaLG.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\yaVVygN.exe
  C:\Windows\System\yaVVygN.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\gTvOTZD.exe
  C:\Windows\System\gTvOTZD.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\qsGZMUU.exe
  C:\Windows\System\qsGZMUU.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\QkDfKRo.exe
  C:\Windows\System\QkDfKRo.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\SVHRsMk.exe
  C:\Windows\System\SVHRsMk.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\OAAcFAC.exe
  C:\Windows\System\OAAcFAC.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\dYzaZJo.exe
  C:\Windows\System\dYzaZJo.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\nHRaupm.exe
  C:\Windows\System\nHRaupm.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\WmTwGkx.exe
  C:\Windows\System\WmTwGkx.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\qZVCxDL.exe
  C:\Windows\System\qZVCxDL.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\cdrQwpT.exe
  C:\Windows\System\cdrQwpT.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\fxZRfTE.exe
  C:\Windows\System\fxZRfTE.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\jarlkMq.exe
  C:\Windows\System\jarlkMq.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\BJsFGbj.exe
  C:\Windows\System\BJsFGbj.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\SiyxQFI.exe
  C:\Windows\System\SiyxQFI.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\hgkZAVt.exe
  C:\Windows\System\hgkZAVt.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\QNmJnBu.exe
  C:\Windows\System\QNmJnBu.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\jwIWqkU.exe
  C:\Windows\System\jwIWqkU.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\pcOYeNs.exe
  C:\Windows\System\pcOYeNs.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\AqSxxar.exe
  C:\Windows\System\AqSxxar.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\yAzYtVv.exe
  C:\Windows\System\yAzYtVv.exe
  2⤵
  - Executes dropped EXE
  PID:328
- C:\Windows\System\dXXxptz.exe
  C:\Windows\System\dXXxptz.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\aUDJhTS.exe
  C:\Windows\System\aUDJhTS.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\hhoOerw.exe
  C:\Windows\System\hhoOerw.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\GdmkQhv.exe
  C:\Windows\System\GdmkQhv.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\IncjIzd.exe
  C:\Windows\System\IncjIzd.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\fPMaHTT.exe
  C:\Windows\System\fPMaHTT.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\DpQbpKS.exe
  C:\Windows\System\DpQbpKS.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\ColTATo.exe
  C:\Windows\System\ColTATo.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\jNAVOuW.exe
  C:\Windows\System\jNAVOuW.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\JKEjCAX.exe
  C:\Windows\System\JKEjCAX.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\xpBxUym.exe
  C:\Windows\System\xpBxUym.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\gqsEYyo.exe
  C:\Windows\System\gqsEYyo.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\EaPSbSx.exe
  C:\Windows\System\EaPSbSx.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\WIrFMxE.exe
  C:\Windows\System\WIrFMxE.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\CHdKWbp.exe
  C:\Windows\System\CHdKWbp.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\rEMBuXk.exe
  C:\Windows\System\rEMBuXk.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\sDtTWvB.exe
  C:\Windows\System\sDtTWvB.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\miKDwSR.exe
  C:\Windows\System\miKDwSR.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\XEuLhCu.exe
  C:\Windows\System\XEuLhCu.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\PyxSTDD.exe
  C:\Windows\System\PyxSTDD.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\ZVXRfRq.exe
  C:\Windows\System\ZVXRfRq.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\yABKEIC.exe
  C:\Windows\System\yABKEIC.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\INOpEMQ.exe
  C:\Windows\System\INOpEMQ.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\BlvbDhM.exe
  C:\Windows\System\BlvbDhM.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\HOpBQzf.exe
  C:\Windows\System\HOpBQzf.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\BtpCLvc.exe
  C:\Windows\System\BtpCLvc.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\BLgHTRp.exe
  C:\Windows\System\BLgHTRp.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\gYgLuXP.exe
  C:\Windows\System\gYgLuXP.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\nVoLoDZ.exe
  C:\Windows\System\nVoLoDZ.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\xrutcZi.exe
  C:\Windows\System\xrutcZi.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\YRBQgbR.exe
  C:\Windows\System\YRBQgbR.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\BLwWfEM.exe
  C:\Windows\System\BLwWfEM.exe
  2⤵
  PID:2868
- C:\Windows\System\PSAAWBK.exe
  C:\Windows\System\PSAAWBK.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\FFTNbAk.exe
  C:\Windows\System\FFTNbAk.exe
  2⤵
  PID:2296
- C:\Windows\System\ZVjwDPl.exe
  C:\Windows\System\ZVjwDPl.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\bTfQOeX.exe
  C:\Windows\System\bTfQOeX.exe
  2⤵
  PID:2948
- C:\Windows\System\FCRtCpD.exe
  C:\Windows\System\FCRtCpD.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\izMqQPf.exe
  C:\Windows\System\izMqQPf.exe
  2⤵
  PID:2308
- C:\Windows\System\wcRfIbR.exe
  C:\Windows\System\wcRfIbR.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\VAwwqNg.exe
  C:\Windows\System\VAwwqNg.exe
  2⤵
  PID:1732
- C:\Windows\System\lhbahFI.exe
  C:\Windows\System\lhbahFI.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\uAFGphi.exe
  C:\Windows\System\uAFGphi.exe
  2⤵
  PID:1000
- C:\Windows\System\RmAzJYZ.exe
  C:\Windows\System\RmAzJYZ.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\MgGSwch.exe
  C:\Windows\System\MgGSwch.exe
  2⤵
  PID:596
- C:\Windows\System\mHWTISU.exe
  C:\Windows\System\mHWTISU.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\JIUCnMf.exe
  C:\Windows\System\JIUCnMf.exe
  2⤵
  PID:1632
- C:\Windows\System\ALeVMgA.exe
  C:\Windows\System\ALeVMgA.exe
  2⤵
  PID:2696
- C:\Windows\System\KHESNje.exe
  C:\Windows\System\KHESNje.exe
  2⤵
  PID:2632
- C:\Windows\System\EVDDXOX.exe
  C:\Windows\System\EVDDXOX.exe
  2⤵
  PID:2768
- C:\Windows\System\OSLBEuq.exe
  C:\Windows\System\OSLBEuq.exe
  2⤵
  PID:2808
- C:\Windows\System\RFczEWR.exe
  C:\Windows\System\RFczEWR.exe
  2⤵
  PID:2564
- C:\Windows\System\ZyCAGmD.exe
  C:\Windows\System\ZyCAGmD.exe
  2⤵
  PID:1504
- C:\Windows\System\sOCBIth.exe
  C:\Windows\System\sOCBIth.exe
  2⤵
  PID:2336
- C:\Windows\System\zfOAhUK.exe
  C:\Windows\System\zfOAhUK.exe
  2⤵
  PID:1556
- C:\Windows\System\diAlxjL.exe
  C:\Windows\System\diAlxjL.exe
  2⤵
  PID:1592
- C:\Windows\System\iqPrVJs.exe
  C:\Windows\System\iqPrVJs.exe
  2⤵
  PID:2756
- C:\Windows\System\ZQVZroJ.exe
  C:\Windows\System\ZQVZroJ.exe
  2⤵
  PID:2720
- C:\Windows\System\hJJHdLp.exe
  C:\Windows\System\hJJHdLp.exe
  2⤵
  PID:1156
- C:\Windows\System\LaPdEdX.exe
  C:\Windows\System\LaPdEdX.exe
  2⤵
  PID:1196
- C:\Windows\System\yoTxQpo.exe
  C:\Windows\System\yoTxQpo.exe
  2⤵
  PID:3024
- C:\Windows\System\TpRrXGB.exe
  C:\Windows\System\TpRrXGB.exe
  2⤵
  PID:2812
- C:\Windows\System\DZcBmap.exe
  C:\Windows\System\DZcBmap.exe
  2⤵
  PID:908
- C:\Windows\System\dayjjqj.exe
  C:\Windows\System\dayjjqj.exe
  2⤵
  PID:2192
- C:\Windows\System\lYzOgOH.exe
  C:\Windows\System\lYzOgOH.exe
  2⤵
  PID:1776
- C:\Windows\System\HBlkQpL.exe
  C:\Windows\System\HBlkQpL.exe
  2⤵
  PID:2660
- C:\Windows\System\AaMgjJs.exe
  C:\Windows\System\AaMgjJs.exe
  2⤵
  PID:1940
- C:\Windows\System\xDWrhMF.exe
  C:\Windows\System\xDWrhMF.exe
  2⤵
  PID:1736
- C:\Windows\System\muScDtY.exe
  C:\Windows\System\muScDtY.exe
  2⤵
  PID:2760
- C:\Windows\System\KkptqWC.exe
  C:\Windows\System\KkptqWC.exe
  2⤵
  PID:2816
- C:\Windows\System\ARBcgme.exe
  C:\Windows\System\ARBcgme.exe
  2⤵
  PID:1964
- C:\Windows\System\jnehgUD.exe
  C:\Windows\System\jnehgUD.exe
  2⤵
  PID:1784
- C:\Windows\System\WfenNzY.exe
  C:\Windows\System\WfenNzY.exe
  2⤵
  PID:700
- C:\Windows\System\dYrxIoq.exe
  C:\Windows\System\dYrxIoq.exe
  2⤵
  PID:1728
- C:\Windows\System\DlCACKz.exe
  C:\Windows\System\DlCACKz.exe
  2⤵
  PID:2644
- C:\Windows\System\idoLVhv.exe
  C:\Windows\System\idoLVhv.exe
  2⤵
  PID:2616
- C:\Windows\System\EabVtFL.exe
  C:\Windows\System\EabVtFL.exe
  2⤵
  PID:2144
- C:\Windows\System\yGrpOED.exe
  C:\Windows\System\yGrpOED.exe
  2⤵
  PID:1516
- C:\Windows\System\YnhUYZg.exe
  C:\Windows\System\YnhUYZg.exe
  2⤵
  PID:568
- C:\Windows\System\NCkixSr.exe
  C:\Windows\System\NCkixSr.exe
  2⤵
  PID:3000
- C:\Windows\System\QXeyFwJ.exe
  C:\Windows\System\QXeyFwJ.exe
  2⤵
  PID:1608
- C:\Windows\System\LVOlGwk.exe
  C:\Windows\System\LVOlGwk.exe
  2⤵
  PID:3084
- C:\Windows\System\wDWAcfJ.exe
  C:\Windows\System\wDWAcfJ.exe
  2⤵
  PID:3104
- C:\Windows\System\oVRBfOl.exe
  C:\Windows\System\oVRBfOl.exe
  2⤵
  PID:3120
- C:\Windows\System\KmoFYqa.exe
  C:\Windows\System\KmoFYqa.exe
  2⤵
  PID:3136
- C:\Windows\System\MkvRxOI.exe
  C:\Windows\System\MkvRxOI.exe
  2⤵
  PID:3152
- C:\Windows\System\HXWpDNg.exe
  C:\Windows\System\HXWpDNg.exe
  2⤵
  PID:3168
- C:\Windows\System\wjrytLn.exe
  C:\Windows\System\wjrytLn.exe
  2⤵
  PID:3184
- C:\Windows\System\jISbdWO.exe
  C:\Windows\System\jISbdWO.exe
  2⤵
  PID:3200
- C:\Windows\System\abROMra.exe
  C:\Windows\System\abROMra.exe
  2⤵
  PID:3216
- C:\Windows\System\hqWcrpl.exe
  C:\Windows\System\hqWcrpl.exe
  2⤵
  PID:3232
- C:\Windows\System\MKlTtTy.exe
  C:\Windows\System\MKlTtTy.exe
  2⤵
  PID:3248
- C:\Windows\System\pQrnZyN.exe
  C:\Windows\System\pQrnZyN.exe
  2⤵
  PID:3264
- C:\Windows\System\KWOSyaM.exe
  C:\Windows\System\KWOSyaM.exe
  2⤵
  PID:3280
- C:\Windows\System\WODbYKP.exe
  C:\Windows\System\WODbYKP.exe
  2⤵
  PID:3296
- C:\Windows\System\BdxkrcS.exe
  C:\Windows\System\BdxkrcS.exe
  2⤵
  PID:3312
- C:\Windows\System\aHGTgvL.exe
  C:\Windows\System\aHGTgvL.exe
  2⤵
  PID:3328
- C:\Windows\System\RhYjLnc.exe
  C:\Windows\System\RhYjLnc.exe
  2⤵
  PID:3344
- C:\Windows\System\ArgGurw.exe
  C:\Windows\System\ArgGurw.exe
  2⤵
  PID:3360
- C:\Windows\System\cuUGmQi.exe
  C:\Windows\System\cuUGmQi.exe
  2⤵
  PID:3376
- C:\Windows\System\vjwmySO.exe
  C:\Windows\System\vjwmySO.exe
  2⤵
  PID:3392
- C:\Windows\System\BBtkLaT.exe
  C:\Windows\System\BBtkLaT.exe
  2⤵
  PID:3412
- C:\Windows\System\oeDjrIZ.exe
  C:\Windows\System\oeDjrIZ.exe
  2⤵
  PID:3428
- C:\Windows\System\GBJaptO.exe
  C:\Windows\System\GBJaptO.exe
  2⤵
  PID:3444
- C:\Windows\System\IBphzJh.exe
  C:\Windows\System\IBphzJh.exe
  2⤵
  PID:3460
- C:\Windows\System\vKKHzTg.exe
  C:\Windows\System\vKKHzTg.exe
  2⤵
  PID:3476
- C:\Windows\System\DdTQsnm.exe
  C:\Windows\System\DdTQsnm.exe
  2⤵
  PID:3496
- C:\Windows\System\vWJYgQw.exe
  C:\Windows\System\vWJYgQw.exe
  2⤵
  PID:3512
- C:\Windows\System\bejzcxY.exe
  C:\Windows\System\bejzcxY.exe
  2⤵
  PID:3528
- C:\Windows\System\YzmMopE.exe
  C:\Windows\System\YzmMopE.exe
  2⤵
  PID:3544
- C:\Windows\System\mGqGCYj.exe
  C:\Windows\System\mGqGCYj.exe
  2⤵
  PID:3560
- C:\Windows\System\PaKHdZU.exe
  C:\Windows\System\PaKHdZU.exe
  2⤵
  PID:3576
- C:\Windows\System\ErPxqqd.exe
  C:\Windows\System\ErPxqqd.exe
  2⤵
  PID:3592
- C:\Windows\System\kTRoIIJ.exe
  C:\Windows\System\kTRoIIJ.exe
  2⤵
  PID:3608
- C:\Windows\System\wTbItsA.exe
  C:\Windows\System\wTbItsA.exe
  2⤵
  PID:3624
- C:\Windows\System\IkHCSSu.exe
  C:\Windows\System\IkHCSSu.exe
  2⤵
  PID:3640
- C:\Windows\System\wyjZYWU.exe
  C:\Windows\System\wyjZYWU.exe
  2⤵
  PID:3656
- C:\Windows\System\ufwJBFK.exe
  C:\Windows\System\ufwJBFK.exe
  2⤵
  PID:3680
- C:\Windows\System\hQdCeuS.exe
  C:\Windows\System\hQdCeuS.exe
  2⤵
  PID:3696
- C:\Windows\System\vCIjZRO.exe
  C:\Windows\System\vCIjZRO.exe
  2⤵
  PID:3724
- C:\Windows\System\EbJLHhW.exe
  C:\Windows\System\EbJLHhW.exe
  2⤵
  PID:3740
- C:\Windows\System\XwpwowR.exe
  C:\Windows\System\XwpwowR.exe
  2⤵
  PID:3756
- C:\Windows\System\zsAWgXx.exe
  C:\Windows\System\zsAWgXx.exe
  2⤵
  PID:3772
- C:\Windows\System\HuScraP.exe
  C:\Windows\System\HuScraP.exe
  2⤵
  PID:3788
- C:\Windows\System\pCRhCDC.exe
  C:\Windows\System\pCRhCDC.exe
  2⤵
  PID:3804
- C:\Windows\System\WiqEbPd.exe
  C:\Windows\System\WiqEbPd.exe
  2⤵
  PID:3824
- C:\Windows\System\GLUVnuS.exe
  C:\Windows\System\GLUVnuS.exe
  2⤵
  PID:3840
- C:\Windows\System\yiHSDYu.exe
  C:\Windows\System\yiHSDYu.exe
  2⤵
  PID:3856
- C:\Windows\System\WFeKDzx.exe
  C:\Windows\System\WFeKDzx.exe
  2⤵
  PID:3872
- C:\Windows\System\ShbVEdj.exe
  C:\Windows\System\ShbVEdj.exe
  2⤵
  PID:3888
- C:\Windows\System\LoaXEEW.exe
  C:\Windows\System\LoaXEEW.exe
  2⤵
  PID:3904
- C:\Windows\System\XXLaElK.exe
  C:\Windows\System\XXLaElK.exe
  2⤵
  PID:3924
- C:\Windows\System\rbsNllp.exe
  C:\Windows\System\rbsNllp.exe
  2⤵
  PID:3940
- C:\Windows\System\oRIYluG.exe
  C:\Windows\System\oRIYluG.exe
  2⤵
  PID:3956
- C:\Windows\System\EBtddcS.exe
  C:\Windows\System\EBtddcS.exe
  2⤵
  PID:3972
- C:\Windows\System\URUkBBG.exe
  C:\Windows\System\URUkBBG.exe
  2⤵
  PID:3988
- C:\Windows\System\LmllFOi.exe
  C:\Windows\System\LmllFOi.exe
  2⤵
  PID:4004
- C:\Windows\System\KEKvalz.exe
  C:\Windows\System\KEKvalz.exe
  2⤵
  PID:4020
- C:\Windows\System\dEmScva.exe
  C:\Windows\System\dEmScva.exe
  2⤵
  PID:4040
- C:\Windows\System\hVuajPl.exe
  C:\Windows\System\hVuajPl.exe
  2⤵
  PID:4056
- C:\Windows\System\xiPjYBq.exe
  C:\Windows\System\xiPjYBq.exe
  2⤵
  PID:4072
- C:\Windows\System\gmQJLIt.exe
  C:\Windows\System\gmQJLIt.exe
  2⤵
  PID:4088
- C:\Windows\System\UbvtXRF.exe
  C:\Windows\System\UbvtXRF.exe
  2⤵
  PID:2288
- C:\Windows\System\BZdPXfT.exe
  C:\Windows\System\BZdPXfT.exe
  2⤵
  PID:1064
- C:\Windows\System\ysDZIpz.exe
  C:\Windows\System\ysDZIpz.exe
  2⤵
  PID:1084
- C:\Windows\System\lkhdRgZ.exe
  C:\Windows\System\lkhdRgZ.exe
  2⤵
  PID:2396
- C:\Windows\System\dEzGGuo.exe
  C:\Windows\System\dEzGGuo.exe
  2⤵
  PID:1564
- C:\Windows\System\rvnyyaS.exe
  C:\Windows\System\rvnyyaS.exe
  2⤵
  PID:2052
- C:\Windows\System\eKlDHOl.exe
  C:\Windows\System\eKlDHOl.exe
  2⤵
  PID:4108
- C:\Windows\System\QHIpBVF.exe
  C:\Windows\System\QHIpBVF.exe
  2⤵
  PID:4124
- C:\Windows\System\uxCjORK.exe
  C:\Windows\System\uxCjORK.exe
  2⤵
  PID:4140
- C:\Windows\System\kBWIgsu.exe
  C:\Windows\System\kBWIgsu.exe
  2⤵
  PID:4156
- C:\Windows\System\wIpwzSE.exe
  C:\Windows\System\wIpwzSE.exe
  2⤵
  PID:4208
- C:\Windows\System\nuJGFXC.exe
  C:\Windows\System\nuJGFXC.exe
  2⤵
  PID:4228
- C:\Windows\System\ueEndng.exe
  C:\Windows\System\ueEndng.exe
  2⤵
  PID:4244
- C:\Windows\System\QqFdult.exe
  C:\Windows\System\QqFdult.exe
  2⤵
  PID:4260
- C:\Windows\System\BMrILvu.exe
  C:\Windows\System\BMrILvu.exe
  2⤵
  PID:4276
- C:\Windows\System\hTUiWTB.exe
  C:\Windows\System\hTUiWTB.exe
  2⤵
  PID:4292
- C:\Windows\System\NXzctvN.exe
  C:\Windows\System\NXzctvN.exe
  2⤵
  PID:4312
- C:\Windows\System\OZDFUKv.exe
  C:\Windows\System\OZDFUKv.exe
  2⤵
  PID:4328
- C:\Windows\System\wCuvBKP.exe
  C:\Windows\System\wCuvBKP.exe
  2⤵
  PID:4344
- C:\Windows\System\aRAUFdv.exe
  C:\Windows\System\aRAUFdv.exe
  2⤵
  PID:4360
- C:\Windows\System\CxLwMrP.exe
  C:\Windows\System\CxLwMrP.exe
  2⤵
  PID:4380
- C:\Windows\System\pVNydId.exe
  C:\Windows\System\pVNydId.exe
  2⤵
  PID:4396
- C:\Windows\System\oEWlNoV.exe
  C:\Windows\System\oEWlNoV.exe
  2⤵
  PID:4412
- C:\Windows\System\RIivxhD.exe
  C:\Windows\System\RIivxhD.exe
  2⤵
  PID:4428
- C:\Windows\System\kmEgKMs.exe
  C:\Windows\System\kmEgKMs.exe
  2⤵
  PID:4444
- C:\Windows\System\kgfgdwt.exe
  C:\Windows\System\kgfgdwt.exe
  2⤵
  PID:4460
- C:\Windows\System\lsIIYQv.exe
  C:\Windows\System\lsIIYQv.exe
  2⤵
  PID:4484
- C:\Windows\System\qiEqVAi.exe
  C:\Windows\System\qiEqVAi.exe
  2⤵
  PID:4500
- C:\Windows\System\jlFexyk.exe
  C:\Windows\System\jlFexyk.exe
  2⤵
  PID:4516
- C:\Windows\System\fvsXwoN.exe
  C:\Windows\System\fvsXwoN.exe
  2⤵
  PID:4532
- C:\Windows\System\xQeZqAi.exe
  C:\Windows\System\xQeZqAi.exe
  2⤵
  PID:4548
- C:\Windows\System\mHUnOdb.exe
  C:\Windows\System\mHUnOdb.exe
  2⤵
  PID:4568
- C:\Windows\System\VabFSjt.exe
  C:\Windows\System\VabFSjt.exe
  2⤵
  PID:4584
- C:\Windows\System\HkbagLu.exe
  C:\Windows\System\HkbagLu.exe
  2⤵
  PID:4600
- C:\Windows\System\gxlrDAS.exe
  C:\Windows\System\gxlrDAS.exe
  2⤵
  PID:4616
- C:\Windows\System\enqLSGJ.exe
  C:\Windows\System\enqLSGJ.exe
  2⤵
  PID:4632
- C:\Windows\System\BXBgUHV.exe
  C:\Windows\System\BXBgUHV.exe
  2⤵
  PID:4648
- C:\Windows\System\qhYsROX.exe
  C:\Windows\System\qhYsROX.exe
  2⤵
  PID:4664
- C:\Windows\System\DtgKkvQ.exe
  C:\Windows\System\DtgKkvQ.exe
  2⤵
  PID:4684
- C:\Windows\System\APMJsmP.exe
  C:\Windows\System\APMJsmP.exe
  2⤵
  PID:4700
- C:\Windows\System\VWGLXAQ.exe
  C:\Windows\System\VWGLXAQ.exe
  2⤵
  PID:4716
- C:\Windows\System\FlGhzYp.exe
  C:\Windows\System\FlGhzYp.exe
  2⤵
  PID:4732
- C:\Windows\System\HvgiRJN.exe
  C:\Windows\System\HvgiRJN.exe
  2⤵
  PID:4748
- C:\Windows\System\nZoFNkS.exe
  C:\Windows\System\nZoFNkS.exe
  2⤵
  PID:4812
- C:\Windows\System\tiJNCpU.exe
  C:\Windows\System\tiJNCpU.exe
  2⤵
  PID:4828
- C:\Windows\System\RKLKbpk.exe
  C:\Windows\System\RKLKbpk.exe
  2⤵
  PID:4844
- C:\Windows\System\nnIujPv.exe
  C:\Windows\System\nnIujPv.exe
  2⤵
  PID:4860
- C:\Windows\System\hjtHEcQ.exe
  C:\Windows\System\hjtHEcQ.exe
  2⤵
  PID:4876
- C:\Windows\System\MDADrHR.exe
  C:\Windows\System\MDADrHR.exe
  2⤵
  PID:4896
- C:\Windows\System\jtdlifF.exe
  C:\Windows\System\jtdlifF.exe
  2⤵
  PID:4916
- C:\Windows\System\aIMxiLM.exe
  C:\Windows\System\aIMxiLM.exe
  2⤵
  PID:4940
- C:\Windows\System\wSzWnpl.exe
  C:\Windows\System\wSzWnpl.exe
  2⤵
  PID:4956
- C:\Windows\System\CttYPtX.exe
  C:\Windows\System\CttYPtX.exe
  2⤵
  PID:4972
- C:\Windows\System\jgDkECt.exe
  C:\Windows\System\jgDkECt.exe
  2⤵
  PID:5008
- C:\Windows\System\XbiWFst.exe
  C:\Windows\System\XbiWFst.exe
  2⤵
  PID:5108
- C:\Windows\System\iNvYfkt.exe
  C:\Windows\System\iNvYfkt.exe
  2⤵
  PID:3288
- C:\Windows\System\tWlcKys.exe
  C:\Windows\System\tWlcKys.exe
  2⤵
  PID:3352
- C:\Windows\System\EHwfDXd.exe
  C:\Windows\System\EHwfDXd.exe
  2⤵
  PID:3424
- C:\Windows\System\LQUyilI.exe
  C:\Windows\System\LQUyilI.exe
  2⤵
  PID:3488
- C:\Windows\System\AnMgEyx.exe
  C:\Windows\System\AnMgEyx.exe
  2⤵
  PID:3552
- C:\Windows\System\AKbBYVc.exe
  C:\Windows\System\AKbBYVc.exe
  2⤵
  PID:3616
- C:\Windows\System\SsYpIxw.exe
  C:\Windows\System\SsYpIxw.exe
  2⤵
  PID:3688
- C:\Windows\System\FJwVpzj.exe
  C:\Windows\System\FJwVpzj.exe
  2⤵
  PID:3768
- C:\Windows\System\TaiduZe.exe
  C:\Windows\System\TaiduZe.exe
  2⤵
  PID:3832
- C:\Windows\System\SSTVWgn.exe
  C:\Windows\System\SSTVWgn.exe
  2⤵
  PID:3900
- C:\Windows\System\ZPqlrKf.exe
  C:\Windows\System\ZPqlrKf.exe
  2⤵
  PID:3996
- C:\Windows\System\TCTqvxa.exe
  C:\Windows\System\TCTqvxa.exe
  2⤵
  PID:4036
- C:\Windows\System\YUoQJTb.exe
  C:\Windows\System\YUoQJTb.exe
  2⤵
  PID:2640
- C:\Windows\System\fgtAbnD.exe
  C:\Windows\System\fgtAbnD.exe
  2⤵
  PID:2716
- C:\Windows\System\DTsFYlU.exe
  C:\Windows\System\DTsFYlU.exe
  2⤵
  PID:1208
- C:\Windows\System\lVbfkoa.exe
  C:\Windows\System\lVbfkoa.exe
  2⤵
  PID:560
- C:\Windows\System\EVJGXxx.exe
  C:\Windows\System\EVJGXxx.exe
  2⤵
  PID:1848
- C:\Windows\System\qDdXRRm.exe
  C:\Windows\System\qDdXRRm.exe
  2⤵
  PID:3096
- C:\Windows\System\cbKGqiP.exe
  C:\Windows\System\cbKGqiP.exe
  2⤵
  PID:3016
- C:\Windows\System\yyGJdWI.exe
  C:\Windows\System\yyGJdWI.exe
  2⤵
  PID:2704
- C:\Windows\System\uafYWjE.exe
  C:\Windows\System\uafYWjE.exe
  2⤵
  PID:1956
- C:\Windows\System\yyXvaLz.exe
  C:\Windows\System\yyXvaLz.exe
  2⤵
  PID:3044
- C:\Windows\System\DAAKovU.exe
  C:\Windows\System\DAAKovU.exe
  2⤵
  PID:2872
- C:\Windows\System\GnlFzpb.exe
  C:\Windows\System\GnlFzpb.exe
  2⤵
  PID:4132
- C:\Windows\System\lPPjlCC.exe
  C:\Windows\System\lPPjlCC.exe
  2⤵
  PID:4172
- C:\Windows\System\OKiARXV.exe
  C:\Windows\System\OKiARXV.exe
  2⤵
  PID:4188
- C:\Windows\System\vsybIOX.exe
  C:\Windows\System\vsybIOX.exe
  2⤵
  PID:4200
- C:\Windows\System\ElqlGAw.exe
  C:\Windows\System\ElqlGAw.exe
  2⤵
  PID:3304
- C:\Windows\System\tbCPnmI.exe
  C:\Windows\System\tbCPnmI.exe
  2⤵
  PID:3368
- C:\Windows\System\dqvbQkp.exe
  C:\Windows\System\dqvbQkp.exe
  2⤵
  PID:3436
- C:\Windows\System\ltRRcNE.exe
  C:\Windows\System\ltRRcNE.exe
  2⤵
  PID:3504
- C:\Windows\System\skxRtHy.exe
  C:\Windows\System\skxRtHy.exe
  2⤵
  PID:3540
- C:\Windows\System\pegDGOe.exe
  C:\Windows\System\pegDGOe.exe
  2⤵
  PID:3632
- C:\Windows\System\TtJOlgg.exe
  C:\Windows\System\TtJOlgg.exe
  2⤵
  PID:3672
- C:\Windows\System\ToBMDhn.exe
  C:\Windows\System\ToBMDhn.exe
  2⤵
  PID:3716
- C:\Windows\System\QMOqtOe.exe
  C:\Windows\System\QMOqtOe.exe
  2⤵
  PID:3720
- C:\Windows\System\MHmAPUB.exe
  C:\Windows\System\MHmAPUB.exe
  2⤵
  PID:4640
- C:\Windows\System\zBVdMPZ.exe
  C:\Windows\System\zBVdMPZ.exe
  2⤵
  PID:4300
- C:\Windows\System\mjbIQoP.exe
  C:\Windows\System\mjbIQoP.exe
  2⤵
  PID:3848
- C:\Windows\System\MJJvqBf.exe
  C:\Windows\System\MJJvqBf.exe
  2⤵
  PID:3912
- C:\Windows\System\tqydrXF.exe
  C:\Windows\System\tqydrXF.exe
  2⤵
  PID:4336
- C:\Windows\System\PDPClCf.exe
  C:\Windows\System\PDPClCf.exe
  2⤵
  PID:4372
- C:\Windows\System\AqRiFuU.exe
  C:\Windows\System\AqRiFuU.exe
  2⤵
  PID:4440
- C:\Windows\System\mkjMAWb.exe
  C:\Windows\System\mkjMAWb.exe
  2⤵
  PID:3980
- C:\Windows\System\qgCybLl.exe
  C:\Windows\System\qgCybLl.exe
  2⤵
  PID:4048
- C:\Windows\System\LDQFOwF.exe
  C:\Windows\System\LDQFOwF.exe
  2⤵
  PID:4508
- C:\Windows\System\aoldnBa.exe
  C:\Windows\System\aoldnBa.exe
  2⤵
  PID:4576
- C:\Windows\System\DkPDbZb.exe
  C:\Windows\System\DkPDbZb.exe
  2⤵
  PID:1232
- C:\Windows\System\uTMjxNW.exe
  C:\Windows\System\uTMjxNW.exe
  2⤵
  PID:2176
- C:\Windows\System\XtLqYuW.exe
  C:\Windows\System\XtLqYuW.exe
  2⤵
  PID:4708
- C:\Windows\System\kBMLkhu.exe
  C:\Windows\System\kBMLkhu.exe
  2⤵
  PID:4820
- C:\Windows\System\ljJYHNe.exe
  C:\Windows\System\ljJYHNe.exe
  2⤵
  PID:4884
- C:\Windows\System\dFaBeMI.exe
  C:\Windows\System\dFaBeMI.exe
  2⤵
  PID:2016
- C:\Windows\System\AILRFAe.exe
  C:\Windows\System\AILRFAe.exe
  2⤵
  PID:1636
- C:\Windows\System\ttsGKVS.exe
  C:\Windows\System\ttsGKVS.exe
  2⤵
  PID:1588
- C:\Windows\System\eIcYign.exe
  C:\Windows\System\eIcYign.exe
  2⤵
  PID:3440
- C:\Windows\System\wHdGIIO.exe
  C:\Windows\System\wHdGIIO.exe
  2⤵
  PID:624
- C:\Windows\System\YUzkPTV.exe
  C:\Windows\System\YUzkPTV.exe
  2⤵
  PID:3076
- C:\Windows\System\oQpCeIW.exe
  C:\Windows\System\oQpCeIW.exe
  2⤵
  PID:3116
- C:\Windows\System\EJNalnI.exe
  C:\Windows\System\EJNalnI.exe
  2⤵
  PID:3208
- C:\Windows\System\QdTVbAk.exe
  C:\Windows\System\QdTVbAk.exe
  2⤵
  PID:3064
- C:\Windows\System\AOtVcsn.exe
  C:\Windows\System\AOtVcsn.exe
  2⤵
  PID:4932
- C:\Windows\System\KXqAnCR.exe
  C:\Windows\System\KXqAnCR.exe
  2⤵
  PID:848
- C:\Windows\System\ozewesQ.exe
  C:\Windows\System\ozewesQ.exe
  2⤵
  PID:4148
- C:\Windows\System\UhYgqrA.exe
  C:\Windows\System\UhYgqrA.exe
  2⤵
  PID:4252
- C:\Windows\System\BxfCnAX.exe
  C:\Windows\System\BxfCnAX.exe
  2⤵
  PID:4320
- C:\Windows\System\wsZnYWv.exe
  C:\Windows\System\wsZnYWv.exe
  2⤵
  PID:4388
- C:\Windows\System\GriBnwg.exe
  C:\Windows\System\GriBnwg.exe
  2⤵
  PID:4452
- C:\Windows\System\hqBXCyw.exe
  C:\Windows\System\hqBXCyw.exe
  2⤵
  PID:4524
- C:\Windows\System\eURoKwp.exe
  C:\Windows\System\eURoKwp.exe
  2⤵
  PID:4564
- C:\Windows\System\GYIFCWI.exe
  C:\Windows\System\GYIFCWI.exe
  2⤵
  PID:4628
- C:\Windows\System\CIqDwTQ.exe
  C:\Windows\System\CIqDwTQ.exe
  2⤵
  PID:4696
- C:\Windows\System\RlNbbsC.exe
  C:\Windows\System\RlNbbsC.exe
  2⤵
  PID:4760
- C:\Windows\System\LSXIqHO.exe
  C:\Windows\System\LSXIqHO.exe
  2⤵
  PID:4776
- C:\Windows\System\aJBfFPD.exe
  C:\Windows\System\aJBfFPD.exe
  2⤵
  PID:4792
- C:\Windows\System\jCGaKUK.exe
  C:\Windows\System\jCGaKUK.exe
  2⤵
  PID:4836
- C:\Windows\System\ZfxhhGO.exe
  C:\Windows\System\ZfxhhGO.exe
  2⤵
  PID:4904
- C:\Windows\System\BcZnFcE.exe
  C:\Windows\System\BcZnFcE.exe
  2⤵
  PID:5052
- C:\Windows\System\qIEnmwc.exe
  C:\Windows\System\qIEnmwc.exe
  2⤵
  PID:2864
- C:\Windows\System\hQGDXHf.exe
  C:\Windows\System\hQGDXHf.exe
  2⤵
  PID:5068
- C:\Windows\System\JbwXfzg.exe
  C:\Windows\System\JbwXfzg.exe
  2⤵
  PID:5084
- C:\Windows\System\NMvxMgv.exe
  C:\Windows\System\NMvxMgv.exe
  2⤵
  PID:5096
- C:\Windows\System\tEcxBCY.exe
  C:\Windows\System\tEcxBCY.exe
  2⤵
  PID:2580
- C:\Windows\System\PWjwPVu.exe
  C:\Windows\System\PWjwPVu.exe
  2⤵
  PID:2952
- C:\Windows\System\cthGnWG.exe
  C:\Windows\System\cthGnWG.exe
  2⤵
  PID:3324
- C:\Windows\System\vOwTQNJ.exe
  C:\Windows\System\vOwTQNJ.exe
  2⤵
  PID:3588
- C:\Windows\System\kPWWKUl.exe
  C:\Windows\System\kPWWKUl.exe
  2⤵
  PID:3736
- C:\Windows\System\LGfDMNm.exe
  C:\Windows\System\LGfDMNm.exe
  2⤵
  PID:3224
- C:\Windows\System\AXXsumW.exe
  C:\Windows\System\AXXsumW.exe
  2⤵
  PID:2840
- C:\Windows\System\hqZaaOF.exe
  C:\Windows\System\hqZaaOF.exe
  2⤵
  PID:2596
- C:\Windows\System\sDGVtQO.exe
  C:\Windows\System\sDGVtQO.exe
  2⤵
  PID:4100
- C:\Windows\System\DTZibRP.exe
  C:\Windows\System\DTZibRP.exe
  2⤵
  PID:4180
- C:\Windows\System\yTnGwDh.exe
  C:\Windows\System\yTnGwDh.exe
  2⤵
  PID:3400
- C:\Windows\System\wnPmyMT.exe
  C:\Windows\System\wnPmyMT.exe
  2⤵
  PID:3664
- C:\Windows\System\ebEnkNQ.exe
  C:\Windows\System\ebEnkNQ.exe
  2⤵
  PID:2576
- C:\Windows\System\JUStcMf.exe
  C:\Windows\System\JUStcMf.exe
  2⤵
  PID:3228
- C:\Windows\System\aozgRgk.exe
  C:\Windows\System\aozgRgk.exe
  2⤵
  PID:3812
- C:\Windows\System\LgVMUrJ.exe
  C:\Windows\System\LgVMUrJ.exe
  2⤵
  PID:4608
- C:\Windows\System\dvYILfl.exe
  C:\Windows\System\dvYILfl.exe
  2⤵
  PID:4472
- C:\Windows\System\hyYLyhC.exe
  C:\Windows\System\hyYLyhC.exe
  2⤵
  PID:3384
- C:\Windows\System\UVKpZQk.exe
  C:\Windows\System\UVKpZQk.exe
  2⤵
  PID:4052
- C:\Windows\System\MlRJhhe.exe
  C:\Windows\System\MlRJhhe.exe
  2⤵
  PID:3128
- C:\Windows\System\efNojbh.exe
  C:\Windows\System\efNojbh.exe
  2⤵
  PID:2772
- C:\Windows\System\fiWqQIz.exe
  C:\Windows\System\fiWqQIz.exe
  2⤵
  PID:1672
- C:\Windows\System\LFyVNLP.exe
  C:\Windows\System\LFyVNLP.exe
  2⤵
  PID:3968
- C:\Windows\System\PSOOVhP.exe
  C:\Windows\System\PSOOVhP.exe
  2⤵
  PID:3648
- C:\Windows\System\gExTQfc.exe
  C:\Windows\System\gExTQfc.exe
  2⤵
  PID:4196
- C:\Windows\System\aFcchge.exe
  C:\Windows\System\aFcchge.exe
  2⤵
  PID:3336
- C:\Windows\System\FjpTtob.exe
  C:\Windows\System\FjpTtob.exe
  2⤵
  PID:3604
- C:\Windows\System\BDImJvs.exe
  C:\Windows\System\BDImJvs.exe
  2⤵
  PID:4852
- C:\Windows\System\YchwOEy.exe
  C:\Windows\System\YchwOEy.exe
  2⤵
  PID:988
- C:\Windows\System\HnGyTCS.exe
  C:\Windows\System\HnGyTCS.exe
  2⤵
  PID:4888
- C:\Windows\System\MbmQMSh.exe
  C:\Windows\System\MbmQMSh.exe
  2⤵
  PID:3148
- C:\Windows\System\DnrUdPK.exe
  C:\Windows\System\DnrUdPK.exe
  2⤵
  PID:4436
- C:\Windows\System\aIUzKYq.exe
  C:\Windows\System\aIUzKYq.exe
  2⤵
  PID:4540
- C:\Windows\System\wOlFpoT.exe
  C:\Windows\System\wOlFpoT.exe
  2⤵
  PID:4740
- C:\Windows\System\iCMTrLP.exe
  C:\Windows\System\iCMTrLP.exe
  2⤵
  PID:1772
- C:\Windows\System\axiuDsP.exe
  C:\Windows\System\axiuDsP.exe
  2⤵
  PID:5016
- C:\Windows\System\bVYliUF.exe
  C:\Windows\System\bVYliUF.exe
  2⤵
  PID:4284
- C:\Windows\System\JhRarDW.exe
  C:\Windows\System\JhRarDW.exe
  2⤵
  PID:4660
- C:\Windows\System\IDmZWJM.exe
  C:\Windows\System\IDmZWJM.exe
  2⤵
  PID:4800
- C:\Windows\System\eotcgCC.exe
  C:\Windows\System\eotcgCC.exe
  2⤵
  PID:5056
- C:\Windows\System\mbSGxDD.exe
  C:\Windows\System\mbSGxDD.exe
  2⤵
  PID:4980
- C:\Windows\System\fTmeAyV.exe
  C:\Windows\System\fTmeAyV.exe
  2⤵
  PID:3584
- C:\Windows\System\idWKrLz.exe
  C:\Windows\System\idWKrLz.exe
  2⤵
  PID:2384
- C:\Windows\System\DXCarUV.exe
  C:\Windows\System\DXCarUV.exe
  2⤵
  PID:3080
- C:\Windows\System\ncxXPWC.exe
  C:\Windows\System\ncxXPWC.exe
  2⤵
  PID:3276
- C:\Windows\System\gqrvaKm.exe
  C:\Windows\System\gqrvaKm.exe
  2⤵
  PID:2356
- C:\Windows\System\apKxIYh.exe
  C:\Windows\System\apKxIYh.exe
  2⤵
  PID:2300
- C:\Windows\System\eeJPZdz.exe
  C:\Windows\System\eeJPZdz.exe
  2⤵
  PID:2152
- C:\Windows\System\BJLzkHs.exe
  C:\Windows\System\BJLzkHs.exe
  2⤵
  PID:2844
- C:\Windows\System\eEbzUKR.exe
  C:\Windows\System\eEbzUKR.exe
  2⤵
  PID:1500
- C:\Windows\System\gEhVgaB.exe
  C:\Windows\System\gEhVgaB.exe
  2⤵
  PID:3800
- C:\Windows\System\ZREsCdp.exe
  C:\Windows\System\ZREsCdp.exe
  2⤵
  PID:4164
- C:\Windows\System\cZoJsDC.exe
  C:\Windows\System\cZoJsDC.exe
  2⤵
  PID:2368
- C:\Windows\System\fLZfCwo.exe
  C:\Windows\System\fLZfCwo.exe
  2⤵
  PID:4496
- C:\Windows\System\oMFQfAd.exe
  C:\Windows\System\oMFQfAd.exe
  2⤵
  PID:4756
- C:\Windows\System\qHNlSxW.exe
  C:\Windows\System\qHNlSxW.exe
  2⤵
  PID:4872
- C:\Windows\System\SDVaJxd.exe
  C:\Windows\System\SDVaJxd.exe
  2⤵
  PID:5076
- C:\Windows\System\IIoZhgT.exe
  C:\Windows\System\IIoZhgT.exe
  2⤵
  PID:3320
- C:\Windows\System\dmealVj.exe
  C:\Windows\System\dmealVj.exe
  2⤵
  PID:3732
- C:\Windows\System\vcinWQZ.exe
  C:\Windows\System\vcinWQZ.exe
  2⤵
  PID:4408
- C:\Windows\System\ETzwNfE.exe
  C:\Windows\System\ETzwNfE.exe
  2⤵
  PID:3408
- C:\Windows\System\wqfghdX.exe
  C:\Windows\System\wqfghdX.exe
  2⤵
  PID:4560
- C:\Windows\System\BsRldWC.exe
  C:\Windows\System\BsRldWC.exe
  2⤵
  PID:1400
- C:\Windows\System\TqZnIDh.exe
  C:\Windows\System\TqZnIDh.exe
  2⤵
  PID:4964
- C:\Windows\System\lsyJPHI.exe
  C:\Windows\System\lsyJPHI.exe
  2⤵
  PID:4240
- C:\Windows\System\CPrOttY.exe
  C:\Windows\System\CPrOttY.exe
  2⤵
  PID:2912
- C:\Windows\System\HxCpUVi.exe
  C:\Windows\System\HxCpUVi.exe
  2⤵
  PID:3420
- C:\Windows\System\PBtsZle.exe
  C:\Windows\System\PBtsZle.exe
  2⤵
  PID:3964
- C:\Windows\System\rEIYPJG.exe
  C:\Windows\System\rEIYPJG.exe
  2⤵
  PID:3600
- C:\Windows\System\slblcjh.exe
  C:\Windows\System\slblcjh.exe
  2⤵
  PID:3180
- C:\Windows\System\ovxGxMU.exe
  C:\Windows\System\ovxGxMU.exe
  2⤵
  PID:3132
- C:\Windows\System\uwWnzuL.exe
  C:\Windows\System\uwWnzuL.exe
  2⤵
  PID:4424
- C:\Windows\System\phHspAU.exe
  C:\Windows\System\phHspAU.exe
  2⤵
  PID:5064
- C:\Windows\System\cSvVRzW.exe
  C:\Windows\System\cSvVRzW.exe
  2⤵
  PID:1704
- C:\Windows\System\JoUiyUH.exe
  C:\Windows\System\JoUiyUH.exe
  2⤵
  PID:4356
- C:\Windows\System\HftRitj.exe
  C:\Windows\System\HftRitj.exe
  2⤵
  PID:4840
- C:\Windows\System\WuWjPRq.exe
  C:\Windows\System\WuWjPRq.exe
  2⤵
  PID:3176
- C:\Windows\System\GPDGRKT.exe
  C:\Windows\System\GPDGRKT.exe
  2⤵
  PID:2836
- C:\Windows\System\ylIZRgp.exe
  C:\Windows\System\ylIZRgp.exe
  2⤵
  PID:4476
- C:\Windows\System\KCZwceH.exe
  C:\Windows\System\KCZwceH.exe
  2⤵
  PID:2672
- C:\Windows\System\cBFFJbK.exe
  C:\Windows\System\cBFFJbK.exe
  2⤵
  PID:3340
- C:\Windows\System\kJlTrjc.exe
  C:\Windows\System\kJlTrjc.exe
  2⤵
  PID:4768
- C:\Windows\System\KaGYHQV.exe
  C:\Windows\System\KaGYHQV.exe
  2⤵
  PID:3240
- C:\Windows\System\JwbpAhF.exe
  C:\Windows\System\JwbpAhF.exe
  2⤵
  PID:4268
- C:\Windows\System\hOLzrWV.exe
  C:\Windows\System\hOLzrWV.exe
  2⤵
  PID:3192
- C:\Windows\System\KjgqRMH.exe
  C:\Windows\System\KjgqRMH.exe
  2⤵
  PID:2796
- C:\Windows\System\CMXRxQE.exe
  C:\Windows\System\CMXRxQE.exe
  2⤵
  PID:2776
- C:\Windows\System\ICNhIjE.exe
  C:\Windows\System\ICNhIjE.exe
  2⤵
  PID:4068
- C:\Windows\System\kppMZSw.exe
  C:\Windows\System\kppMZSw.exe
  2⤵
  PID:4624
- C:\Windows\System\ocbqndS.exe
  C:\Windows\System\ocbqndS.exe
  2⤵
  PID:1648
- C:\Windows\System\xMTSjda.exe
  C:\Windows\System\xMTSjda.exe
  2⤵
  PID:2876
- C:\Windows\System\XbtIzPX.exe
  C:\Windows\System\XbtIzPX.exe
  2⤵
  PID:4272
- C:\Windows\System\pmLmIuq.exe
  C:\Windows\System\pmLmIuq.exe
  2⤵
  PID:3752
- C:\Windows\System\CVXZNUL.exe
  C:\Windows\System\CVXZNUL.exe
  2⤵
  PID:2112
- C:\Windows\System\jOxXqAD.exe
  C:\Windows\System\jOxXqAD.exe
  2⤵
  PID:3952
- C:\Windows\System\NBKBzAi.exe
  C:\Windows\System\NBKBzAi.exe
  2⤵
  PID:1096
- C:\Windows\System\pCxHfMG.exe
  C:\Windows\System\pCxHfMG.exe
  2⤵
  PID:1396
- C:\Windows\System\eqRkbDa.exe
  C:\Windows\System\eqRkbDa.exe
  2⤵
  PID:5080
- C:\Windows\System\wVAkEqP.exe
  C:\Windows\System\wVAkEqP.exe
  2⤵
  PID:4352
- C:\Windows\System\xauDnLk.exe
  C:\Windows\System\xauDnLk.exe
  2⤵
  PID:3652
- C:\Windows\System\vbTLyXZ.exe
  C:\Windows\System\vbTLyXZ.exe
  2⤵
  PID:2652
- C:\Windows\System\cWrxeXE.exe
  C:\Windows\System\cWrxeXE.exe
  2⤵
  PID:4968
- C:\Windows\System\kWcFGsE.exe
  C:\Windows\System\kWcFGsE.exe
  2⤵
  PID:3008
- C:\Windows\System\LkOKVFY.exe
  C:\Windows\System\LkOKVFY.exe
  2⤵
  PID:5128
- C:\Windows\System\XVfjuzG.exe
  C:\Windows\System\XVfjuzG.exe
  2⤵
  PID:5204
- C:\Windows\System\tXtlwCD.exe
  C:\Windows\System\tXtlwCD.exe
  2⤵
  PID:5300
- C:\Windows\System\unQqfxp.exe
  C:\Windows\System\unQqfxp.exe
  2⤵
  PID:5336
- C:\Windows\System\WfxYcWk.exe
  C:\Windows\System\WfxYcWk.exe
  2⤵
  PID:5376
- C:\Windows\System\laONaho.exe
  C:\Windows\System\laONaho.exe
  2⤵
  PID:5416
- C:\Windows\System\FpxCkJU.exe
  C:\Windows\System\FpxCkJU.exe
  2⤵
  PID:5436
- C:\Windows\System\ZkhvYHW.exe
  C:\Windows\System\ZkhvYHW.exe
  2⤵
  PID:5560
- C:\Windows\System\uVqZVyh.exe
  C:\Windows\System\uVqZVyh.exe
  2⤵
  PID:5836
- C:\Windows\System\oWkMmQr.exe
  C:\Windows\System\oWkMmQr.exe
  2⤵
  PID:5852
- C:\Windows\System\JXEuKmC.exe
  C:\Windows\System\JXEuKmC.exe
  2⤵
  PID:5872
- C:\Windows\System\gylwMQw.exe
  C:\Windows\System\gylwMQw.exe
  2⤵
  PID:5888
- C:\Windows\System\XJqjmgk.exe
  C:\Windows\System\XJqjmgk.exe
  2⤵
  PID:5904
- C:\Windows\System\cFqXxnP.exe
  C:\Windows\System\cFqXxnP.exe
  2⤵
  PID:5920
- C:\Windows\System\OKTjoyn.exe
  C:\Windows\System\OKTjoyn.exe
  2⤵
  PID:5936
- C:\Windows\System\qaLdpXw.exe
  C:\Windows\System\qaLdpXw.exe
  2⤵
  PID:5952
- C:\Windows\System\OwadvMa.exe
  C:\Windows\System\OwadvMa.exe
  2⤵
  PID:5968
- C:\Windows\System\DomqBHG.exe
  C:\Windows\System\DomqBHG.exe
  2⤵
  PID:5988
- C:\Windows\System\eYuMBbg.exe
  C:\Windows\System\eYuMBbg.exe
  2⤵
  PID:6004
- C:\Windows\System\hbnbVBJ.exe
  C:\Windows\System\hbnbVBJ.exe
  2⤵
  PID:6020
- C:\Windows\System\rQljYid.exe
  C:\Windows\System\rQljYid.exe
  2⤵
  PID:6036
- C:\Windows\System\MAgZATq.exe
  C:\Windows\System\MAgZATq.exe
  2⤵
  PID:6052
- C:\Windows\System\tNmoyDD.exe
  C:\Windows\System\tNmoyDD.exe
  2⤵
  PID:6088
- C:\Windows\System\yZlHviZ.exe
  C:\Windows\System\yZlHviZ.exe
  2⤵
  PID:6104
- C:\Windows\System\KNJJLHj.exe
  C:\Windows\System\KNJJLHj.exe
  2⤵
  PID:3260
- C:\Windows\System\GWaWLbL.exe
  C:\Windows\System\GWaWLbL.exe
  2⤵
  PID:904
- C:\Windows\System\Fumsaci.exe
  C:\Windows\System\Fumsaci.exe
  2⤵
  PID:5164
- C:\Windows\System\AAsikWm.exe
  C:\Windows\System\AAsikWm.exe
  2⤵
  PID:5180
- C:\Windows\System\FrsNhSh.exe
  C:\Windows\System\FrsNhSh.exe
  2⤵
  PID:5212
- C:\Windows\System\FnMEqqe.exe
  C:\Windows\System\FnMEqqe.exe
  2⤵
  PID:5236
- C:\Windows\System\UeAwuou.exe
  C:\Windows\System\UeAwuou.exe
  2⤵
  PID:5240
- C:\Windows\System\lYXznRZ.exe
  C:\Windows\System\lYXznRZ.exe
  2⤵
  PID:5256
- C:\Windows\System\vvCgjxx.exe
  C:\Windows\System\vvCgjxx.exe
  2⤵
  PID:5284
- C:\Windows\System\TrobuDP.exe
  C:\Windows\System\TrobuDP.exe
  2⤵
  PID:5288
- C:\Windows\System\iHAiMQb.exe
  C:\Windows\System\iHAiMQb.exe
  2⤵
  PID:5320
- C:\Windows\System\GXMGwrb.exe
  C:\Windows\System\GXMGwrb.exe
  2⤵
  PID:5332
- C:\Windows\System\UPbWvwJ.exe
  C:\Windows\System\UPbWvwJ.exe
  2⤵
  PID:5392
- C:\Windows\System\WymnILZ.exe
  C:\Windows\System\WymnILZ.exe
  2⤵
  PID:5360
- C:\Windows\System\nONHktV.exe
  C:\Windows\System\nONHktV.exe
  2⤵
  PID:5400
- C:\Windows\System\fdzisRf.exe
  C:\Windows\System\fdzisRf.exe
  2⤵
  PID:5396
- C:\Windows\System\fkXauwR.exe
  C:\Windows\System\fkXauwR.exe
  2⤵
  PID:2344
- C:\Windows\System\izUlIov.exe
  C:\Windows\System\izUlIov.exe
  2⤵
  PID:5296
- C:\Windows\System\qAJrlkn.exe
  C:\Windows\System\qAJrlkn.exe
  2⤵
  PID:5456
- C:\Windows\System\KbuVxPc.exe
  C:\Windows\System\KbuVxPc.exe
  2⤵
  PID:5484
- C:\Windows\System\mCXBTZK.exe
  C:\Windows\System\mCXBTZK.exe
  2⤵
  PID:5516
- C:\Windows\System\trXmLFR.exe
  C:\Windows\System\trXmLFR.exe
  2⤵
  PID:5536
- C:\Windows\System\hqhSMLj.exe
  C:\Windows\System\hqhSMLj.exe
  2⤵
  PID:5524
- C:\Windows\System\cQeuwtC.exe
  C:\Windows\System\cQeuwtC.exe
  2⤵
  PID:5556
- C:\Windows\System\JyDqEjD.exe
  C:\Windows\System\JyDqEjD.exe
  2⤵
  PID:5624
- C:\Windows\System\lUiyMCf.exe
  C:\Windows\System\lUiyMCf.exe
  2⤵
  PID:5684
- C:\Windows\System\kyhQddN.exe
  C:\Windows\System\kyhQddN.exe
  2⤵
  PID:5572
- C:\Windows\System\tKoPLVg.exe
  C:\Windows\System\tKoPLVg.exe
  2⤵
  PID:5708
- C:\Windows\System\TNFrvlk.exe
  C:\Windows\System\TNFrvlk.exe
  2⤵
  PID:5648
- C:\Windows\System\yjBAuLE.exe
  C:\Windows\System\yjBAuLE.exe
  2⤵
  PID:5664
- C:\Windows\System\RRcOZEo.exe
  C:\Windows\System\RRcOZEo.exe
  2⤵
  PID:5736
- C:\Windows\System\BeAIZVk.exe
  C:\Windows\System\BeAIZVk.exe
  2⤵
  PID:5724
- C:\Windows\System\UAHrSSA.exe
  C:\Windows\System\UAHrSSA.exe
  2⤵
  PID:5740
- C:\Windows\System\eTvWtCK.exe
  C:\Windows\System\eTvWtCK.exe
  2⤵
  PID:5768
- C:\Windows\System\pBkcJww.exe
  C:\Windows\System\pBkcJww.exe
  2⤵
  PID:5848
- C:\Windows\System\QTzREPL.exe
  C:\Windows\System\QTzREPL.exe
  2⤵
  PID:5944
- C:\Windows\System\xbxDWdT.exe
  C:\Windows\System\xbxDWdT.exe
  2⤵
  PID:5984
- C:\Windows\System\beyYriR.exe
  C:\Windows\System\beyYriR.exe
  2⤵
  PID:6000
- C:\Windows\System\PFXeMgU.exe
  C:\Windows\System\PFXeMgU.exe
  2⤵
  PID:6060
- C:\Windows\System\xbebioP.exe
  C:\Windows\System\xbebioP.exe
  2⤵
  PID:6096
- C:\Windows\System\hzaZIZR.exe
  C:\Windows\System\hzaZIZR.exe
  2⤵
  PID:6100
- C:\Windows\System\ptUWrQW.exe
  C:\Windows\System\ptUWrQW.exe
  2⤵
  PID:5816
- C:\Windows\System\cXWRTEv.exe
  C:\Windows\System\cXWRTEv.exe
  2⤵
  PID:5832
- C:\Windows\System\ejwfLVp.exe
  C:\Windows\System\ejwfLVp.exe
  2⤵
  PID:5900
- C:\Windows\System\uuHRGIz.exe
  C:\Windows\System\uuHRGIz.exe
  2⤵
  PID:5136
- C:\Windows\System\akpSlqg.exe
  C:\Windows\System\akpSlqg.exe
  2⤵
  PID:5252
- C:\Windows\System\XLFJWrq.exe
  C:\Windows\System\XLFJWrq.exe
  2⤵
  PID:5172
- C:\Windows\System\MkBAoOK.exe
  C:\Windows\System\MkBAoOK.exe
  2⤵
  PID:5248
- C:\Windows\System\GtOqoyg.exe
  C:\Windows\System\GtOqoyg.exe
  2⤵
  PID:5408
- C:\Windows\System\ZKLsrhu.exe
  C:\Windows\System\ZKLsrhu.exe
  2⤵
  PID:5488
- C:\Windows\System\ZMvORVB.exe
  C:\Windows\System\ZMvORVB.exe
  2⤵
  PID:5308
- C:\Windows\System\rDqlEsG.exe
  C:\Windows\System\rDqlEsG.exe
  2⤵
  PID:5316
- C:\Windows\System\BhYEEAo.exe
  C:\Windows\System\BhYEEAo.exe
  2⤵
  PID:5468
- C:\Windows\System\hXELnXl.exe
  C:\Windows\System\hXELnXl.exe
  2⤵
  PID:5636
- C:\Windows\System\BQZeQac.exe
  C:\Windows\System\BQZeQac.exe
  2⤵
  PID:5756
- C:\Windows\System\xzYcFhC.exe
  C:\Windows\System\xzYcFhC.exe
  2⤵
  PID:5656
- C:\Windows\System\XhUFoaX.exe
  C:\Windows\System\XhUFoaX.exe
  2⤵
  PID:5748
- C:\Windows\System\JZSmVWJ.exe
  C:\Windows\System\JZSmVWJ.exe
  2⤵
  PID:6048
- C:\Windows\System\yDtyZtG.exe
  C:\Windows\System\yDtyZtG.exe
  2⤵
  PID:3676
- C:\Windows\System\zauceog.exe
  C:\Windows\System\zauceog.exe
  2⤵
  PID:5864
- C:\Windows\System\MGThiQA.exe
  C:\Windows\System\MGThiQA.exe
  2⤵
  PID:6112
- C:\Windows\System\MKTjmgo.exe
  C:\Windows\System\MKTjmgo.exe
  2⤵
  PID:5280
- C:\Windows\System\iykTJiU.exe
  C:\Windows\System\iykTJiU.exe
  2⤵
  PID:5268
- C:\Windows\System\LnBVjBt.exe
  C:\Windows\System\LnBVjBt.exe
  2⤵
  PID:6128
- C:\Windows\System\vRGWhDJ.exe
  C:\Windows\System\vRGWhDJ.exe
  2⤵
  PID:6076
- C:\Windows\System\ZGIRyaA.exe
  C:\Windows\System\ZGIRyaA.exe
  2⤵
  PID:6136
- C:\Windows\System\xNNtHCc.exe
  C:\Windows\System\xNNtHCc.exe
  2⤵
  PID:4220
- C:\Windows\System\hjnEFJt.exe
  C:\Windows\System\hjnEFJt.exe
  2⤵
  PID:5188
- C:\Windows\System\EjQwoqV.exe
  C:\Windows\System\EjQwoqV.exe
  2⤵
  PID:5224
- C:\Windows\System\OJSkjPP.exe
  C:\Windows\System\OJSkjPP.exe
  2⤵
  PID:5480
- C:\Windows\System\HxPDhxg.exe
  C:\Windows\System\HxPDhxg.exe
  2⤵
  PID:5500
- C:\Windows\System\qFLpQPp.exe
  C:\Windows\System\qFLpQPp.exe
  2⤵
  PID:5552
- C:\Windows\System\kJFcfAp.exe
  C:\Windows\System\kJFcfAp.exe
  2⤵
  PID:5680
- C:\Windows\System\AtlUEoB.exe
  C:\Windows\System\AtlUEoB.exe
  2⤵
  PID:5692
- C:\Windows\System\BUegHMQ.exe
  C:\Windows\System\BUegHMQ.exe
  2⤵
  PID:5716
- C:\Windows\System\dLVPFcO.exe
  C:\Windows\System\dLVPFcO.exe
  2⤵
  PID:5844
- C:\Windows\System\QmzETzw.exe
  C:\Windows\System\QmzETzw.exe
  2⤵
  PID:2340
- C:\Windows\System\HEellkj.exe
  C:\Windows\System\HEellkj.exe
  2⤵
  PID:6028
- C:\Windows\System\XfYRaIk.exe
  C:\Windows\System\XfYRaIk.exe
  2⤵
  PID:5932
- C:\Windows\System\CygcHbA.exe
  C:\Windows\System\CygcHbA.exe
  2⤵
  PID:2820
- C:\Windows\System\pahQAAg.exe
  C:\Windows\System\pahQAAg.exe
  2⤵
  PID:5328
- C:\Windows\System\Nuzxqyy.exe
  C:\Windows\System\Nuzxqyy.exe
  2⤵
  PID:6148
- C:\Windows\System\NfnzIrC.exe
  C:\Windows\System\NfnzIrC.exe
  2⤵
  PID:6164
- C:\Windows\System\fluvBqK.exe
  C:\Windows\System\fluvBqK.exe
  2⤵
  PID:6180
- C:\Windows\System\BDqRLrN.exe
  C:\Windows\System\BDqRLrN.exe
  2⤵
  PID:6196
- C:\Windows\System\AnjnoZb.exe
  C:\Windows\System\AnjnoZb.exe
  2⤵
  PID:6216
- C:\Windows\System\kgkvEMu.exe
  C:\Windows\System\kgkvEMu.exe
  2⤵
  PID:6232
- C:\Windows\System\uYDiILB.exe
  C:\Windows\System\uYDiILB.exe
  2⤵
  PID:6248
- C:\Windows\System\VHCYmRR.exe
  C:\Windows\System\VHCYmRR.exe
  2⤵
  PID:6264
- C:\Windows\System\XuwyiKp.exe
  C:\Windows\System\XuwyiKp.exe
  2⤵
  PID:6280
- C:\Windows\System\xKSJodS.exe
  C:\Windows\System\xKSJodS.exe
  2⤵
  PID:6300
- C:\Windows\System\PoPSlFt.exe
  C:\Windows\System\PoPSlFt.exe
  2⤵
  PID:6316
- C:\Windows\System\PrqWiuQ.exe
  C:\Windows\System\PrqWiuQ.exe
  2⤵
  PID:6332
- C:\Windows\System\GNEBtxQ.exe
  C:\Windows\System\GNEBtxQ.exe
  2⤵
  PID:6348
- C:\Windows\System\woVNzxc.exe
  C:\Windows\System\woVNzxc.exe
  2⤵
  PID:6364
- C:\Windows\System\csBSyJT.exe
  C:\Windows\System\csBSyJT.exe
  2⤵
  PID:6384
- C:\Windows\System\LeSUDCu.exe
  C:\Windows\System\LeSUDCu.exe
  2⤵
  PID:6400
- C:\Windows\System\IzRGAcn.exe
  C:\Windows\System\IzRGAcn.exe
  2⤵
  PID:6416
- C:\Windows\System\wzzGzmL.exe
  C:\Windows\System\wzzGzmL.exe
  2⤵
  PID:6432
- C:\Windows\System\jYBHEkm.exe
  C:\Windows\System\jYBHEkm.exe
  2⤵
  PID:6452
- C:\Windows\System\iICGqLh.exe
  C:\Windows\System\iICGqLh.exe
  2⤵
  PID:6476
- C:\Windows\System\CJjkeRN.exe
  C:\Windows\System\CJjkeRN.exe
  2⤵
  PID:6492
- C:\Windows\System\zwUIweq.exe
  C:\Windows\System\zwUIweq.exe
  2⤵
  PID:6508
- C:\Windows\System\VzpmjeX.exe
  C:\Windows\System\VzpmjeX.exe
  2⤵
  PID:6660
- C:\Windows\System\SNWshJr.exe
  C:\Windows\System\SNWshJr.exe
  2⤵
  PID:6676
- C:\Windows\System\vQOyDrT.exe
  C:\Windows\System\vQOyDrT.exe
  2⤵
  PID:6692
- C:\Windows\System\JVaejhW.exe
  C:\Windows\System\JVaejhW.exe
  2⤵
  PID:6712
- C:\Windows\System\lHNuxCh.exe
  C:\Windows\System\lHNuxCh.exe
  2⤵
  PID:6728
- C:\Windows\System\JwfkyLI.exe
  C:\Windows\System\JwfkyLI.exe
  2⤵
  PID:6744
- C:\Windows\System\jPhCzNY.exe
  C:\Windows\System\jPhCzNY.exe
  2⤵
  PID:6760
- C:\Windows\System\iZKwbFI.exe
  C:\Windows\System\iZKwbFI.exe
  2⤵
  PID:6776
- C:\Windows\System\UeMdCqZ.exe
  C:\Windows\System\UeMdCqZ.exe
  2⤵
  PID:6792
- C:\Windows\System\XpIxSYv.exe
  C:\Windows\System\XpIxSYv.exe
  2⤵
  PID:6808
- C:\Windows\System\PgVmgGz.exe
  C:\Windows\System\PgVmgGz.exe
  2⤵
  PID:6824
- C:\Windows\System\qaAwHMc.exe
  C:\Windows\System\qaAwHMc.exe
  2⤵
  PID:6840
- C:\Windows\System\CHtrTGo.exe
  C:\Windows\System\CHtrTGo.exe
  2⤵
  PID:6856
- C:\Windows\System\NENrWop.exe
  C:\Windows\System\NENrWop.exe
  2⤵
  PID:6872
- C:\Windows\System\ndKFnhm.exe
  C:\Windows\System\ndKFnhm.exe
  2⤵
  PID:6896
- C:\Windows\System\cOdNyfR.exe
  C:\Windows\System\cOdNyfR.exe
  2⤵
  PID:6920
- C:\Windows\System\WyotlaS.exe
  C:\Windows\System\WyotlaS.exe
  2⤵
  PID:6936
- C:\Windows\System\gxHKGFX.exe
  C:\Windows\System\gxHKGFX.exe
  2⤵
  PID:6952
- C:\Windows\System\YTqtYsu.exe
  C:\Windows\System\YTqtYsu.exe
  2⤵
  PID:6968
- C:\Windows\System\cAbWZXu.exe
  C:\Windows\System\cAbWZXu.exe
  2⤵
  PID:6984
- C:\Windows\System\SRWFdJW.exe
  C:\Windows\System\SRWFdJW.exe
  2⤵
  PID:7000
- C:\Windows\System\AeEplNn.exe
  C:\Windows\System\AeEplNn.exe
  2⤵
  PID:7016
- C:\Windows\System\IzypKiu.exe
  C:\Windows\System\IzypKiu.exe
  2⤵
  PID:7032
- C:\Windows\System\bKkDliP.exe
  C:\Windows\System\bKkDliP.exe
  2⤵
  PID:7048
- C:\Windows\System\ruczrvD.exe
  C:\Windows\System\ruczrvD.exe
  2⤵
  PID:7064
- C:\Windows\System\EMHLlmr.exe
  C:\Windows\System\EMHLlmr.exe
  2⤵
  PID:7080
- C:\Windows\System\rMZLYUB.exe
  C:\Windows\System\rMZLYUB.exe
  2⤵
  PID:7096
- C:\Windows\System\bSsAVcL.exe
  C:\Windows\System\bSsAVcL.exe
  2⤵
  PID:7112
- C:\Windows\System\WdcTEVf.exe
  C:\Windows\System\WdcTEVf.exe
  2⤵
  PID:7128
- C:\Windows\System\GdDvKWy.exe
  C:\Windows\System\GdDvKWy.exe
  2⤵
  PID:7144
- C:\Windows\System\EmVMptv.exe
  C:\Windows\System\EmVMptv.exe
  2⤵
  PID:7160
- C:\Windows\System\vDkbabc.exe
  C:\Windows\System\vDkbabc.exe
  2⤵
  PID:1896
- C:\Windows\System\WMaSZRe.exe
  C:\Windows\System\WMaSZRe.exe
  2⤵
  PID:6156
- C:\Windows\System\aSShBkZ.exe
  C:\Windows\System\aSShBkZ.exe
  2⤵
  PID:5780
- C:\Windows\System\DRQTCwk.exe
  C:\Windows\System\DRQTCwk.exe
  2⤵
  PID:5644
- C:\Windows\System\DCkhhgW.exe
  C:\Windows\System\DCkhhgW.exe
  2⤵
  PID:6224
- C:\Windows\System\NXiNTxj.exe
  C:\Windows\System\NXiNTxj.exe
  2⤵
  PID:6288
- C:\Windows\System\uHrkLdV.exe
  C:\Windows\System\uHrkLdV.exe
  2⤵
  PID:6328
- C:\Windows\System\pLzUVUx.exe
  C:\Windows\System\pLzUVUx.exe
  2⤵
  PID:6396
- C:\Windows\System\MTswRxq.exe
  C:\Windows\System\MTswRxq.exe
  2⤵
  PID:6464
- C:\Windows\System\bglPHFF.exe
  C:\Windows\System\bglPHFF.exe
  2⤵
  PID:5388
- C:\Windows\System\AfFPZAu.exe
  C:\Windows\System\AfFPZAu.exe
  2⤵
  PID:5800
- C:\Windows\System\vipNTPr.exe
  C:\Windows\System\vipNTPr.exe
  2⤵
  PID:6700
- C:\Windows\System\xgQPqmH.exe
  C:\Windows\System\xgQPqmH.exe
  2⤵
  PID:6740
- C:\Windows\System\gkPBqrn.exe
  C:\Windows\System\gkPBqrn.exe
  2⤵
  PID:6124
- C:\Windows\System\SjxgUMU.exe
  C:\Windows\System\SjxgUMU.exe
  2⤵
  PID:6804
- C:\Windows\System\EWNUzBv.exe
  C:\Windows\System\EWNUzBv.exe
  2⤵
  PID:5432
- C:\Windows\System\XVYdnKU.exe
  C:\Windows\System\XVYdnKU.exe
  2⤵
  PID:6580
- C:\Windows\System\alupYIp.exe
  C:\Windows\System\alupYIp.exe
  2⤵
  PID:5520
- C:\Windows\System\CfdTlpr.exe
  C:\Windows\System\CfdTlpr.exe
  2⤵
  PID:6868
- C:\Windows\System\oVWbkiw.exe
  C:\Windows\System\oVWbkiw.exe
  2⤵
  PID:5508
- C:\Windows\System\YApsaEJ.exe
  C:\Windows\System\YApsaEJ.exe
  2⤵
  PID:5964
- C:\Windows\System\ajQKlmQ.exe
  C:\Windows\System\ajQKlmQ.exe
  2⤵
  PID:6632
- C:\Windows\System\CFrQVQU.exe
  C:\Windows\System\CFrQVQU.exe
  2⤵
  PID:6640
- C:\Windows\System\eSRtSMX.exe
  C:\Windows\System\eSRtSMX.exe
  2⤵
  PID:6176
- C:\Windows\System\TyrJvYv.exe
  C:\Windows\System\TyrJvYv.exe
  2⤵
  PID:6372
- C:\Windows\System\AgFjwRb.exe
  C:\Windows\System\AgFjwRb.exe
  2⤵
  PID:6016
- C:\Windows\System\qkqWCXj.exe
  C:\Windows\System\qkqWCXj.exe
  2⤵
  PID:6540
- C:\Windows\System\AkGxSRB.exe
  C:\Windows\System\AkGxSRB.exe
  2⤵
  PID:6520
- C:\Windows\System\RiwboAi.exe
  C:\Windows\System\RiwboAi.exe
  2⤵
  PID:6584
- C:\Windows\System\uENuSQU.exe
  C:\Windows\System\uENuSQU.exe
  2⤵
  PID:6616
- C:\Windows\System\gaeXeBJ.exe
  C:\Windows\System\gaeXeBJ.exe
  2⤵
  PID:6752
- C:\Windows\System\etgJLLF.exe
  C:\Windows\System\etgJLLF.exe
  2⤵
  PID:6820
- C:\Windows\System\HGVGyRc.exe
  C:\Windows\System\HGVGyRc.exe
  2⤵
  PID:6888
- C:\Windows\System\otQgQkx.exe
  C:\Windows\System\otQgQkx.exe
  2⤵
  PID:6912
- C:\Windows\System\QyPHxSA.exe
  C:\Windows\System\QyPHxSA.exe
  2⤵
  PID:6976
- C:\Windows\System\LpHlfZw.exe
  C:\Windows\System\LpHlfZw.exe
  2⤵
  PID:7040
- C:\Windows\System\foBjkby.exe
  C:\Windows\System\foBjkby.exe
  2⤵
  PID:7104
- C:\Windows\System\ASjOFFJ.exe
  C:\Windows\System\ASjOFFJ.exe
  2⤵
  PID:2788
- C:\Windows\System\CnGtWBV.exe
  C:\Windows\System\CnGtWBV.exe
  2⤵
  PID:6964
- C:\Windows\System\sdGHbRC.exe
  C:\Windows\System\sdGHbRC.exe
  2⤵
  PID:7028
- C:\Windows\System\JvljJYC.exe
  C:\Windows\System\JvljJYC.exe
  2⤵
  PID:7092
- C:\Windows\System\KxOEUKR.exe
  C:\Windows\System\KxOEUKR.exe
  2⤵
  PID:7156
- C:\Windows\System\IMOwpIc.exe
  C:\Windows\System\IMOwpIc.exe
  2⤵
  PID:5824
- C:\Windows\System\orraizo.exe
  C:\Windows\System\orraizo.exe
  2⤵
  PID:6296
- C:\Windows\System\qylEOjx.exe
  C:\Windows\System\qylEOjx.exe
  2⤵
  PID:6428
- C:\Windows\System\ZXRtLeg.exe
  C:\Windows\System\ZXRtLeg.exe
  2⤵
  PID:6140
- C:\Windows\System\rEKSQob.exe
  C:\Windows\System\rEKSQob.exe
  2⤵
  PID:6736
- C:\Windows\System\ouOixFO.exe
  C:\Windows\System\ouOixFO.exe
  2⤵
  PID:6568
- C:\Windows\System\XnqtlWw.exe
  C:\Windows\System\XnqtlWw.exe
  2⤵
  PID:5760
- C:\Windows\System\hmItGrz.exe
  C:\Windows\System\hmItGrz.exe
  2⤵
  PID:6208
- C:\Windows\System\FZkvXxt.exe
  C:\Windows\System\FZkvXxt.exe
  2⤵
  PID:6472
- C:\Windows\System\iXwqMeY.exe
  C:\Windows\System\iXwqMeY.exe
  2⤵
  PID:6772
- C:\Windows\System\IyodWgj.exe
  C:\Windows\System\IyodWgj.exe
  2⤵
  PID:6604
- C:\Windows\System\AnPzevf.exe
  C:\Windows\System\AnPzevf.exe
  2⤵
  PID:5452
- C:\Windows\System\hYfVxak.exe
  C:\Windows\System\hYfVxak.exe
  2⤵
  PID:6172
- C:\Windows\System\YATdYmq.exe
  C:\Windows\System\YATdYmq.exe
  2⤵
  PID:6308
- C:\Windows\System\QSAgokW.exe
  C:\Windows\System\QSAgokW.exe
  2⤵
  PID:6576
- C:\Windows\System\hGSevkZ.exe
  C:\Windows\System\hGSevkZ.exe
  2⤵
  PID:6344
- C:\Windows\System\dsSZryn.exe
  C:\Windows\System\dsSZryn.exe
  2⤵
  PID:6444
- C:\Windows\System\GgWbHNo.exe
  C:\Windows\System\GgWbHNo.exe
  2⤵
  PID:5696
- C:\Windows\System\PEVXyNr.exe
  C:\Windows\System\PEVXyNr.exe
  2⤵
  PID:6620
- C:\Windows\System\rfWmhjQ.exe
  C:\Windows\System\rfWmhjQ.exe
  2⤵
  PID:6412
- C:\Windows\System\RsNvYtY.exe
  C:\Windows\System\RsNvYtY.exe
  2⤵
  PID:6684
- C:\Windows\System\dcxxVBC.exe
  C:\Windows\System\dcxxVBC.exe
  2⤵
  PID:6880
- C:\Windows\System\gOynhIr.exe
  C:\Windows\System\gOynhIr.exe
  2⤵
  PID:6816
- C:\Windows\System\wYslXnM.exe
  C:\Windows\System\wYslXnM.exe
  2⤵
  PID:6192
- C:\Windows\System\UTnutqr.exe
  C:\Windows\System\UTnutqr.exe
  2⤵
  PID:4116
- C:\Windows\System\YHrVLsc.exe
  C:\Windows\System\YHrVLsc.exe
  2⤵
  PID:6960
- C:\Windows\System\yGNUvrB.exe
  C:\Windows\System\yGNUvrB.exe
  2⤵
  PID:5896
- C:\Windows\System\kqAPoFk.exe
  C:\Windows\System\kqAPoFk.exe
  2⤵
  PID:6708
- C:\Windows\System\idhXrTj.exe
  C:\Windows\System\idhXrTj.exe
  2⤵
  PID:5812
- C:\Windows\System\OcpTyFl.exe
  C:\Windows\System\OcpTyFl.exe
  2⤵
  PID:6648
- C:\Windows\System\ZPJcCrk.exe
  C:\Windows\System\ZPJcCrk.exe
  2⤵
  PID:6408
- C:\Windows\System\awYWTeE.exe
  C:\Windows\System\awYWTeE.exe
  2⤵
  PID:6656
- C:\Windows\System\PcSGjLY.exe
  C:\Windows\System\PcSGjLY.exe
  2⤵
  PID:6256
- C:\Windows\System\rkvPRfh.exe
  C:\Windows\System\rkvPRfh.exe
  2⤵
  PID:6636
- C:\Windows\System\snssNQo.exe
  C:\Windows\System\snssNQo.exe
  2⤵
  PID:7024
- C:\Windows\System\FlNbeRT.exe
  C:\Windows\System\FlNbeRT.exe
  2⤵
  PID:6260
- C:\Windows\System\VwTNYqc.exe
  C:\Windows\System\VwTNYqc.exe
  2⤵
  PID:6788
- C:\Windows\System\nZTbkQL.exe
  C:\Windows\System\nZTbkQL.exe
  2⤵
  PID:6084
- C:\Windows\System\SaVvAdR.exe
  C:\Windows\System\SaVvAdR.exe
  2⤵
  PID:6312
- C:\Windows\System\ssdSRQK.exe
  C:\Windows\System\ssdSRQK.exe
  2⤵
  PID:6884
- C:\Windows\System\Hjazbef.exe
  C:\Windows\System\Hjazbef.exe
  2⤵
  PID:6132
- C:\Windows\System\LWOQaGF.exe
  C:\Windows\System\LWOQaGF.exe
  2⤵
  PID:6380
- C:\Windows\System\hjAqwfA.exe
  C:\Windows\System\hjAqwfA.exe
  2⤵
  PID:7012
- C:\Windows\System\QZxqfhf.exe
  C:\Windows\System\QZxqfhf.exe
  2⤵
  PID:5720
- C:\Windows\System\LOiIQNJ.exe
  C:\Windows\System\LOiIQNJ.exe
  2⤵
  PID:6516
- C:\Windows\System\bSefBIh.exe
  C:\Windows\System\bSefBIh.exe
  2⤵
  PID:6592
- C:\Windows\System\qAfKVtt.exe
  C:\Windows\System\qAfKVtt.exe
  2⤵
  PID:6488
- C:\Windows\System\fxVuyYg.exe
  C:\Windows\System\fxVuyYg.exe
  2⤵
  PID:6340
- C:\Windows\System\xhIJnGP.exe
  C:\Windows\System\xhIJnGP.exe
  2⤵
  PID:6836
- C:\Windows\System\PCmWlzV.exe
  C:\Windows\System\PCmWlzV.exe
  2⤵
  PID:6560
- C:\Windows\System\gslHiVv.exe
  C:\Windows\System\gslHiVv.exe
  2⤵
  PID:7088
- C:\Windows\System\evFqPoB.exe
  C:\Windows\System\evFqPoB.exe
  2⤵
  PID:7172
- C:\Windows\System\BrWjvCd.exe
  C:\Windows\System\BrWjvCd.exe
  2⤵
  PID:7188
- C:\Windows\System\pbjSjac.exe
  C:\Windows\System\pbjSjac.exe
  2⤵
  PID:7204
- C:\Windows\System\scEszLB.exe
  C:\Windows\System\scEszLB.exe
  2⤵
  PID:7220
- C:\Windows\System\ZcxBlOj.exe
  C:\Windows\System\ZcxBlOj.exe
  2⤵
  PID:7236
- C:\Windows\System\ifuveMc.exe
  C:\Windows\System\ifuveMc.exe
  2⤵
  PID:7252
- C:\Windows\System\CzPeTGn.exe
  C:\Windows\System\CzPeTGn.exe
  2⤵
  PID:7268
- C:\Windows\System\gQcxkYM.exe
  C:\Windows\System\gQcxkYM.exe
  2⤵
  PID:7284
- C:\Windows\System\cdWHOJz.exe
  C:\Windows\System\cdWHOJz.exe
  2⤵
  PID:7300
- C:\Windows\System\VcghCXE.exe
  C:\Windows\System\VcghCXE.exe
  2⤵
  PID:7316
- C:\Windows\System\ZGZVuvI.exe
  C:\Windows\System\ZGZVuvI.exe
  2⤵
  PID:7332
- C:\Windows\System\sRAfpBX.exe
  C:\Windows\System\sRAfpBX.exe
  2⤵
  PID:7348
- C:\Windows\System\yZfueuT.exe
  C:\Windows\System\yZfueuT.exe
  2⤵
  PID:7364
- C:\Windows\System\aDunbpZ.exe
  C:\Windows\System\aDunbpZ.exe
  2⤵
  PID:7380
- C:\Windows\System\XokOEjT.exe
  C:\Windows\System\XokOEjT.exe
  2⤵
  PID:7396
- C:\Windows\System\jkdrRND.exe
  C:\Windows\System\jkdrRND.exe
  2⤵
  PID:7412
- C:\Windows\System\weiwOnY.exe
  C:\Windows\System\weiwOnY.exe
  2⤵
  PID:7432
- C:\Windows\System\YmZizPC.exe
  C:\Windows\System\YmZizPC.exe
  2⤵
  PID:7448
- C:\Windows\System\qXbZVGi.exe
  C:\Windows\System\qXbZVGi.exe
  2⤵
  PID:7464
- C:\Windows\System\uADKjzT.exe
  C:\Windows\System\uADKjzT.exe
  2⤵
  PID:7484
- C:\Windows\System\jgCbmUA.exe
  C:\Windows\System\jgCbmUA.exe
  2⤵
  PID:7500
- C:\Windows\System\ShpxGjb.exe
  C:\Windows\System\ShpxGjb.exe
  2⤵
  PID:7516
- C:\Windows\System\KhyKsbz.exe
  C:\Windows\System\KhyKsbz.exe
  2⤵
  PID:7532
- C:\Windows\System\eeFqWFY.exe
  C:\Windows\System\eeFqWFY.exe
  2⤵
  PID:7548
- C:\Windows\System\TMWexSg.exe
  C:\Windows\System\TMWexSg.exe
  2⤵
  PID:7564
- C:\Windows\System\tXiSATe.exe
  C:\Windows\System\tXiSATe.exe
  2⤵
  PID:7580
- C:\Windows\System\BNpskLC.exe
  C:\Windows\System\BNpskLC.exe
  2⤵
  PID:7596
- C:\Windows\System\hKeFZwA.exe
  C:\Windows\System\hKeFZwA.exe
  2⤵
  PID:7612
- C:\Windows\System\ssPdnFF.exe
  C:\Windows\System\ssPdnFF.exe
  2⤵
  PID:7628
- C:\Windows\System\muSgPPj.exe
  C:\Windows\System\muSgPPj.exe
  2⤵
  PID:7644
- C:\Windows\System\TpdKFyM.exe
  C:\Windows\System\TpdKFyM.exe
  2⤵
  PID:7660
- C:\Windows\System\lohIcKp.exe
  C:\Windows\System\lohIcKp.exe
  2⤵
  PID:7676
- C:\Windows\System\FUumsLh.exe
  C:\Windows\System\FUumsLh.exe
  2⤵
  PID:7692
- C:\Windows\System\DxOfjgs.exe
  C:\Windows\System\DxOfjgs.exe
  2⤵
  PID:7708
- C:\Windows\System\DAObIDh.exe
  C:\Windows\System\DAObIDh.exe
  2⤵
  PID:7724
- C:\Windows\System\AzegzGW.exe
  C:\Windows\System\AzegzGW.exe
  2⤵
  PID:7740
- C:\Windows\System\brlrsBT.exe
  C:\Windows\System\brlrsBT.exe
  2⤵
  PID:7756
- C:\Windows\System\CUuMzaN.exe
  C:\Windows\System\CUuMzaN.exe
  2⤵
  PID:7772
- C:\Windows\System\wqYlend.exe
  C:\Windows\System\wqYlend.exe
  2⤵
  PID:7788
- C:\Windows\System\QHdiWCh.exe
  C:\Windows\System\QHdiWCh.exe
  2⤵
  PID:7808
- C:\Windows\System\UoIWTup.exe
  C:\Windows\System\UoIWTup.exe
  2⤵
  PID:7824
- C:\Windows\System\QkjkvVD.exe
  C:\Windows\System\QkjkvVD.exe
  2⤵
  PID:7840
- C:\Windows\System\viQnWkE.exe
  C:\Windows\System\viQnWkE.exe
  2⤵
  PID:7856
- C:\Windows\System\GezAmzV.exe
  C:\Windows\System\GezAmzV.exe
  2⤵
  PID:7872
- C:\Windows\System\jtLPTck.exe
  C:\Windows\System\jtLPTck.exe
  2⤵
  PID:7892
- C:\Windows\System\DFpaELs.exe
  C:\Windows\System\DFpaELs.exe
  2⤵
  PID:7908
- C:\Windows\System\BgbfnbU.exe
  C:\Windows\System\BgbfnbU.exe
  2⤵
  PID:7924
- C:\Windows\System\IrfdgeP.exe
  C:\Windows\System\IrfdgeP.exe
  2⤵
  PID:8048
- C:\Windows\System\znFjglf.exe
  C:\Windows\System\znFjglf.exe
  2⤵
  PID:8064
- C:\Windows\System\mucthfm.exe
  C:\Windows\System\mucthfm.exe
  2⤵
  PID:8080
- C:\Windows\System\fwfRTMW.exe
  C:\Windows\System\fwfRTMW.exe
  2⤵
  PID:8096
- C:\Windows\System\NbgKjvm.exe
  C:\Windows\System\NbgKjvm.exe
  2⤵
  PID:8120
- C:\Windows\System\pAzFBxl.exe
  C:\Windows\System\pAzFBxl.exe
  2⤵
  PID:8136
- C:\Windows\System\IekDzpe.exe
  C:\Windows\System\IekDzpe.exe
  2⤵
  PID:8152
- C:\Windows\System\shhnUtm.exe
  C:\Windows\System\shhnUtm.exe
  2⤵
  PID:8168
- C:\Windows\System\IsCrvaA.exe
  C:\Windows\System\IsCrvaA.exe
  2⤵
  PID:8184
- C:\Windows\System\TSEjPyl.exe
  C:\Windows\System\TSEjPyl.exe
  2⤵
  PID:7212
- C:\Windows\System\VEIrnBA.exe
  C:\Windows\System\VEIrnBA.exe
  2⤵
  PID:7280
- C:\Windows\System\fjIVqOK.exe
  C:\Windows\System\fjIVqOK.exe
  2⤵
  PID:7344
- C:\Windows\System\FpfERTf.exe
  C:\Windows\System\FpfERTf.exe
  2⤵
  PID:7408
- C:\Windows\System\UcXkcLb.exe
  C:\Windows\System\UcXkcLb.exe
  2⤵
  PID:7440
- C:\Windows\System\sNWsDWq.exe
  C:\Windows\System\sNWsDWq.exe
  2⤵
  PID:7540
- C:\Windows\System\XiZHIoR.exe
  C:\Windows\System\XiZHIoR.exe
  2⤵
  PID:7604
- C:\Windows\System\luBlUmV.exe
  C:\Windows\System\luBlUmV.exe
  2⤵
  PID:7260
- C:\Windows\System\dTjCZfZ.exe
  C:\Windows\System\dTjCZfZ.exe
  2⤵
  PID:5444
- C:\Windows\System\ApZqDzT.exe
  C:\Windows\System\ApZqDzT.exe
  2⤵
  PID:6324
- C:\Windows\System\xizQNet.exe
  C:\Windows\System\xizQNet.exe
  2⤵
  PID:7200
- C:\Windows\System\EWkMFZJ.exe
  C:\Windows\System\EWkMFZJ.exe
  2⤵
  PID:7328
- C:\Windows\System\cligPLb.exe
  C:\Windows\System\cligPLb.exe
  2⤵
  PID:7420
- C:\Windows\System\Mzprlpz.exe
  C:\Windows\System\Mzprlpz.exe
  2⤵
  PID:7460
- C:\Windows\System\qgmqXbj.exe
  C:\Windows\System\qgmqXbj.exe
  2⤵
  PID:7672
- C:\Windows\System\beqKZsf.exe
  C:\Windows\System\beqKZsf.exe
  2⤵
  PID:7608
- C:\Windows\System\AEOkCHl.exe
  C:\Windows\System\AEOkCHl.exe
  2⤵
  PID:7528
- C:\Windows\System\XCFQups.exe
  C:\Windows\System\XCFQups.exe
  2⤵
  PID:7592
- C:\Windows\System\fPFjibl.exe
  C:\Windows\System\fPFjibl.exe
  2⤵
  PID:7620
- C:\Windows\System\LqhYYYc.exe
  C:\Windows\System\LqhYYYc.exe
  2⤵
  PID:7688
- C:\Windows\System\VMEmwwp.exe
  C:\Windows\System\VMEmwwp.exe
  2⤵
  PID:7752
- C:\Windows\System\nOTHLsh.exe
  C:\Windows\System\nOTHLsh.exe
  2⤵
  PID:7820
- C:\Windows\System\YHgPmHK.exe
  C:\Windows\System\YHgPmHK.exe
  2⤵
  PID:7848
- C:\Windows\System\jLoprPq.exe
  C:\Windows\System\jLoprPq.exe
  2⤵
  PID:7900
- C:\Windows\System\gesTDCT.exe
  C:\Windows\System\gesTDCT.exe
  2⤵
  PID:7920
- C:\Windows\System\qFrpRpi.exe
  C:\Windows\System\qFrpRpi.exe
  2⤵
  PID:7932
- C:\Windows\System\TTFAvtc.exe
  C:\Windows\System\TTFAvtc.exe
  2⤵
  PID:7948
- C:\Windows\System\mUSwnxF.exe
  C:\Windows\System\mUSwnxF.exe
  2⤵
  PID:7968
- C:\Windows\System\ubQEmkX.exe
  C:\Windows\System\ubQEmkX.exe
  2⤵
  PID:7992
- C:\Windows\System\DoEIrjY.exe
  C:\Windows\System\DoEIrjY.exe
  2⤵
  PID:8000
- C:\Windows\System\sxLYEkf.exe
  C:\Windows\System\sxLYEkf.exe
  2⤵
  PID:8016
- C:\Windows\System\XMIyrqP.exe
  C:\Windows\System\XMIyrqP.exe
  2⤵
  PID:8036
- C:\Windows\System\ValdmIX.exe
  C:\Windows\System\ValdmIX.exe
  2⤵
  PID:8072
- C:\Windows\System\vEIbnoN.exe
  C:\Windows\System\vEIbnoN.exe
  2⤵
  PID:8112
- C:\Windows\System\RBYpOKA.exe
  C:\Windows\System\RBYpOKA.exe
  2⤵
  PID:8176
- C:\Windows\System\OphrEhN.exe
  C:\Windows\System\OphrEhN.exe
  2⤵
  PID:7376
- C:\Windows\System\SgPOPyu.exe
  C:\Windows\System\SgPOPyu.exe
  2⤵
  PID:7508
- C:\Windows\System\HBTPKTV.exe
  C:\Windows\System\HBTPKTV.exe
  2⤵
  PID:6072
- C:\Windows\System\TggksfZ.exe
  C:\Windows\System\TggksfZ.exe
  2⤵
  PID:8088
- C:\Windows\System\tCxHenz.exe
  C:\Windows\System\tCxHenz.exe
  2⤵
  PID:8160
- C:\Windows\System\KhiTVQR.exe
  C:\Windows\System\KhiTVQR.exe
  2⤵
  PID:7216
- C:\Windows\System\PkOJtPU.exe
  C:\Windows\System\PkOJtPU.exe
  2⤵
  PID:7476
- C:\Windows\System\chdllOu.exe
  C:\Windows\System\chdllOu.exe
  2⤵
  PID:6608
- C:\Windows\System\oVCeHmL.exe
  C:\Windows\System\oVCeHmL.exe
  2⤵
  PID:7456
- C:\Windows\System\JiZsVCv.exe
  C:\Windows\System\JiZsVCv.exe
  2⤵
  PID:7556
- C:\Windows\System\kgWfQXG.exe
  C:\Windows\System\kgWfQXG.exe
  2⤵
  PID:7392
- C:\Windows\System\FzdEYqY.exe
  C:\Windows\System\FzdEYqY.exe
  2⤵
  PID:6668
- C:\Windows\System\EGRbdAK.exe
  C:\Windows\System\EGRbdAK.exe
  2⤵
  PID:7496
- C:\Windows\System\jbwdAxc.exe
  C:\Windows\System\jbwdAxc.exe
  2⤵
  PID:7800
- C:\Windows\System\FNUUMzH.exe
  C:\Windows\System\FNUUMzH.exe
  2⤵
  PID:7888
- C:\Windows\System\FXAkYcz.exe
  C:\Windows\System\FXAkYcz.exe
  2⤵
  PID:7868
- C:\Windows\System\PxGhzVQ.exe
  C:\Windows\System\PxGhzVQ.exe
  2⤵
  PID:7864
- C:\Windows\System\LpljUMi.exe
  C:\Windows\System\LpljUMi.exe
  2⤵
  PID:7980
- C:\Windows\System\KlovDJv.exe
  C:\Windows\System\KlovDJv.exe
  2⤵
  PID:8108
- C:\Windows\System\hhSmRvB.exe
  C:\Windows\System\hhSmRvB.exe
  2⤵
  PID:7956
- C:\Windows\System\fFaUTQi.exe
  C:\Windows\System\fFaUTQi.exe
  2⤵
  PID:8132
- C:\Windows\System\MkxGsDN.exe
  C:\Windows\System\MkxGsDN.exe
  2⤵
  PID:7292
- C:\Windows\System\CyAYtnd.exe
  C:\Windows\System\CyAYtnd.exe
  2⤵
  PID:7576
- C:\Windows\System\LeDlgaA.exe
  C:\Windows\System\LeDlgaA.exe
  2⤵
  PID:7944
- C:\Windows\System\VXPmYKR.exe
  C:\Windows\System\VXPmYKR.exe
  2⤵
  PID:8008
- C:\Windows\System\fnQoedk.exe
  C:\Windows\System\fnQoedk.exe
  2⤵
  PID:1552
- C:\Windows\System\BOkklet.exe
  C:\Windows\System\BOkklet.exe
  2⤵
  PID:7652
- C:\Windows\System\ztgReYt.exe
  C:\Windows\System\ztgReYt.exe
  2⤵
  PID:7184
- C:\Windows\System\JiTKSwW.exe
  C:\Windows\System\JiTKSwW.exe
  2⤵
  PID:7804
- C:\Windows\System\SjMdaEa.exe
  C:\Windows\System\SjMdaEa.exe
  2⤵
  PID:7684
- C:\Windows\System\yXmhnuv.exe
  C:\Windows\System\yXmhnuv.exe
  2⤵
  PID:8032
- C:\Windows\System\XTkABSC.exe
  C:\Windows\System\XTkABSC.exe
  2⤵
  PID:7180
- C:\Windows\System\IGVSXDj.exe
  C:\Windows\System\IGVSXDj.exe
  2⤵
  PID:7836
- C:\Windows\System\nNdQryK.exe
  C:\Windows\System\nNdQryK.exe
  2⤵
  PID:8104
- C:\Windows\System\saWfUcc.exe
  C:\Windows\System\saWfUcc.exe
  2⤵
  PID:8144
- C:\Windows\System\WMvebVr.exe
  C:\Windows\System\WMvebVr.exe
  2⤵
  PID:7656
- C:\Windows\System\dzxKqCk.exe
  C:\Windows\System\dzxKqCk.exe
  2⤵
  PID:8208
- C:\Windows\System\JdOoBDI.exe
  C:\Windows\System\JdOoBDI.exe
  2⤵
  PID:8224
- C:\Windows\System\NsyDwTC.exe
  C:\Windows\System\NsyDwTC.exe
  2⤵
  PID:8240
- C:\Windows\System\ZkITQcO.exe
  C:\Windows\System\ZkITQcO.exe
  2⤵
  PID:8256
- C:\Windows\System\krcQGqM.exe
  C:\Windows\System\krcQGqM.exe
  2⤵
  PID:8272
- C:\Windows\System\pjGCAgE.exe
  C:\Windows\System\pjGCAgE.exe
  2⤵
  PID:8288
- C:\Windows\System\CLhMvXW.exe
  C:\Windows\System\CLhMvXW.exe
  2⤵
  PID:8304
- C:\Windows\System\htNsTMw.exe
  C:\Windows\System\htNsTMw.exe
  2⤵
  PID:8320
- C:\Windows\System\rSfiOIr.exe
  C:\Windows\System\rSfiOIr.exe
  2⤵
  PID:8336
- C:\Windows\System\PmrycDq.exe
  C:\Windows\System\PmrycDq.exe
  2⤵
  PID:8356
- C:\Windows\System\eaKdTaJ.exe
  C:\Windows\System\eaKdTaJ.exe
  2⤵
  PID:8372
- C:\Windows\System\coiWRAF.exe
  C:\Windows\System\coiWRAF.exe
  2⤵
  PID:8388
- C:\Windows\System\KDmNRVD.exe
  C:\Windows\System\KDmNRVD.exe
  2⤵
  PID:8404
- C:\Windows\System\hoHVeXh.exe
  C:\Windows\System\hoHVeXh.exe
  2⤵
  PID:8420
- C:\Windows\System\kQpshRQ.exe
  C:\Windows\System\kQpshRQ.exe
  2⤵
  PID:8436
- C:\Windows\System\HzPMkjz.exe
  C:\Windows\System\HzPMkjz.exe
  2⤵
  PID:8452
- C:\Windows\System\pIaKLsq.exe
  C:\Windows\System\pIaKLsq.exe
  2⤵
  PID:8472
- C:\Windows\System\rYDESfh.exe
  C:\Windows\System\rYDESfh.exe
  2⤵
  PID:8488
- C:\Windows\System\yKJngMn.exe
  C:\Windows\System\yKJngMn.exe
  2⤵
  PID:8512
- C:\Windows\System\JcBozaC.exe
  C:\Windows\System\JcBozaC.exe
  2⤵
  PID:8528
- C:\Windows\System\lIHiyJC.exe
  C:\Windows\System\lIHiyJC.exe
  2⤵
  PID:8548
- C:\Windows\System\wcMAHYM.exe
  C:\Windows\System\wcMAHYM.exe
  2⤵
  PID:8584
- C:\Windows\System\kTQryBY.exe
  C:\Windows\System\kTQryBY.exe
  2⤵
  PID:8600
- C:\Windows\System\kyjFAts.exe
  C:\Windows\System\kyjFAts.exe
  2⤵
  PID:8620
- C:\Windows\System\NDTIkGo.exe
  C:\Windows\System\NDTIkGo.exe
  2⤵
  PID:8636
- C:\Windows\System\EnhxyPG.exe
  C:\Windows\System\EnhxyPG.exe
  2⤵
  PID:8652
- C:\Windows\System\HqaWfYR.exe
  C:\Windows\System\HqaWfYR.exe
  2⤵
  PID:8668
- C:\Windows\System\uZcyfui.exe
  C:\Windows\System\uZcyfui.exe
  2⤵
  PID:8684
- C:\Windows\System\fEtBBAB.exe
  C:\Windows\System\fEtBBAB.exe
  2⤵
  PID:8700
- C:\Windows\System\ueCqvfg.exe
  C:\Windows\System\ueCqvfg.exe
  2⤵
  PID:8716
- C:\Windows\System\lvlLaQj.exe
  C:\Windows\System\lvlLaQj.exe
  2⤵
  PID:8732
- C:\Windows\System\IJqQrsP.exe
  C:\Windows\System\IJqQrsP.exe
  2⤵
  PID:8748
- C:\Windows\System\IlMxsXm.exe
  C:\Windows\System\IlMxsXm.exe
  2⤵
  PID:8764
- C:\Windows\System\EeTMNrr.exe
  C:\Windows\System\EeTMNrr.exe
  2⤵
  PID:8780
- C:\Windows\System\tlJBIxe.exe
  C:\Windows\System\tlJBIxe.exe
  2⤵
  PID:8796
- C:\Windows\System\OtkEYja.exe
  C:\Windows\System\OtkEYja.exe
  2⤵
  PID:8812
- C:\Windows\System\ZqfsEPo.exe
  C:\Windows\System\ZqfsEPo.exe
  2⤵
  PID:8832
- C:\Windows\System\pwAzjSB.exe
  C:\Windows\System\pwAzjSB.exe
  2⤵
  PID:8848
- C:\Windows\System\mIDaaOi.exe
  C:\Windows\System\mIDaaOi.exe
  2⤵
  PID:8868
- C:\Windows\System\JCpOWxH.exe
  C:\Windows\System\JCpOWxH.exe
  2⤵
  PID:8888
- C:\Windows\System\WHXuLuI.exe
  C:\Windows\System\WHXuLuI.exe
  2⤵
  PID:8904
- C:\Windows\System\fVKpXFW.exe
  C:\Windows\System\fVKpXFW.exe
  2⤵
  PID:8920
- C:\Windows\System\LcAHIkE.exe
  C:\Windows\System\LcAHIkE.exe
  2⤵
  PID:8936
- C:\Windows\System\CAGVjaE.exe
  C:\Windows\System\CAGVjaE.exe
  2⤵
  PID:8952
- C:\Windows\System\cgCjHUX.exe
  C:\Windows\System\cgCjHUX.exe
  2⤵
  PID:8968
- C:\Windows\System\oVOtYBc.exe
  C:\Windows\System\oVOtYBc.exe
  2⤵
  PID:8984
- C:\Windows\System\ypMoggS.exe
  C:\Windows\System\ypMoggS.exe
  2⤵
  PID:9000
- C:\Windows\System\XoNEfCG.exe
  C:\Windows\System\XoNEfCG.exe
  2⤵
  PID:9016
- C:\Windows\System\AdTCGJr.exe
  C:\Windows\System\AdTCGJr.exe
  2⤵
  PID:9032
- C:\Windows\System\aMrvGKv.exe
  C:\Windows\System\aMrvGKv.exe
  2⤵
  PID:9048
- C:\Windows\System\TQnFKPV.exe
  C:\Windows\System\TQnFKPV.exe
  2⤵
  PID:9064
- C:\Windows\System\eYNdAtW.exe
  C:\Windows\System\eYNdAtW.exe
  2⤵
  PID:9080
- C:\Windows\System\cfIXsHM.exe
  C:\Windows\System\cfIXsHM.exe
  2⤵
  PID:9096
- C:\Windows\System\AiYtGIZ.exe
  C:\Windows\System\AiYtGIZ.exe
  2⤵
  PID:9112
- C:\Windows\System\esAdxwv.exe
  C:\Windows\System\esAdxwv.exe
  2⤵
  PID:9128
- C:\Windows\System\gjqBAvt.exe
  C:\Windows\System\gjqBAvt.exe
  2⤵
  PID:9148
- C:\Windows\System\tnrcBOs.exe
  C:\Windows\System\tnrcBOs.exe
  2⤵
  PID:9164
- C:\Windows\System\VMNjSYy.exe
  C:\Windows\System\VMNjSYy.exe
  2⤵
  PID:9180
- C:\Windows\System\tpDJquM.exe
  C:\Windows\System\tpDJquM.exe
  2⤵
  PID:9200
- C:\Windows\System\sKdHKPN.exe
  C:\Windows\System\sKdHKPN.exe
  2⤵
  PID:7512
- C:\Windows\System\XDjhDJv.exe
  C:\Windows\System\XDjhDJv.exe
  2⤵
  PID:8024
- C:\Windows\System\MTqTpML.exe
  C:\Windows\System\MTqTpML.exe
  2⤵
  PID:8044
- C:\Windows\System\HxeQAYO.exe
  C:\Windows\System\HxeQAYO.exe
  2⤵
  PID:7984
- C:\Windows\System\PvoPSlN.exe
  C:\Windows\System\PvoPSlN.exe
  2⤵
  PID:8204
- C:\Windows\System\GhvJYGk.exe
  C:\Windows\System\GhvJYGk.exe
  2⤵
  PID:8232
- C:\Windows\System\EcSNMlm.exe
  C:\Windows\System\EcSNMlm.exe
  2⤵
  PID:8252
- C:\Windows\System\oRbDZsi.exe
  C:\Windows\System\oRbDZsi.exe
  2⤵
  PID:8280
- C:\Windows\System\NyWOOgq.exe
  C:\Windows\System\NyWOOgq.exe
  2⤵
  PID:8312
- C:\Windows\System\RsGgFsu.exe
  C:\Windows\System\RsGgFsu.exe
  2⤵
  PID:8344
- C:\Windows\System\EfpXytu.exe
  C:\Windows\System\EfpXytu.exe
  2⤵
  PID:8352
- C:\Windows\System\ZnDuGfD.exe
  C:\Windows\System\ZnDuGfD.exe
  2⤵
  PID:8432
- C:\Windows\System\uhOhklO.exe
  C:\Windows\System\uhOhklO.exe
  2⤵
  PID:8480
- C:\Windows\System\ysHFmwf.exe
  C:\Windows\System\ysHFmwf.exe
  2⤵
  PID:8464
- C:\Windows\System\rfmMscm.exe
  C:\Windows\System\rfmMscm.exe
  2⤵
  PID:8536
- C:\Windows\System\sIlRLTH.exe
  C:\Windows\System\sIlRLTH.exe
  2⤵
  PID:8592
- C:\Windows\System\qlQRyXI.exe
  C:\Windows\System\qlQRyXI.exe
  2⤵
  PID:8560
- C:\Windows\System\NAhvDDN.exe
  C:\Windows\System\NAhvDDN.exe
  2⤵
  PID:8576
- C:\Windows\System\MBCvlVG.exe
  C:\Windows\System\MBCvlVG.exe
  2⤵
  PID:8608
- C:\Windows\System\ayUSRPW.exe
  C:\Windows\System\ayUSRPW.exe
  2⤵
  PID:8664
- C:\Windows\System\UdxLmCF.exe
  C:\Windows\System\UdxLmCF.exe
  2⤵
  PID:8724
- C:\Windows\System\BmnRWFg.exe
  C:\Windows\System\BmnRWFg.exe
  2⤵
  PID:8756
- C:\Windows\System\jTPITVm.exe
  C:\Windows\System\jTPITVm.exe
  2⤵
  PID:8820
- C:\Windows\System\hBBQnGB.exe
  C:\Windows\System\hBBQnGB.exe
  2⤵
  PID:8864
- C:\Windows\System\rvtoaAX.exe
  C:\Windows\System\rvtoaAX.exe
  2⤵
  PID:8900
- C:\Windows\System\JUIFqLW.exe
  C:\Windows\System\JUIFqLW.exe
  2⤵
  PID:8964
- C:\Windows\System\rKEeEjJ.exe
  C:\Windows\System\rKEeEjJ.exe
  2⤵
  PID:8840
- C:\Windows\System\pFpvDYA.exe
  C:\Windows\System\pFpvDYA.exe
  2⤵
  PID:9028
- C:\Windows\System\GFnxJmy.exe
  C:\Windows\System\GFnxJmy.exe
  2⤵
  PID:8916
- C:\Windows\System\VYJupyR.exe
  C:\Windows\System\VYJupyR.exe
  2⤵
  PID:9060
- C:\Windows\System\LXrucHQ.exe
  C:\Windows\System\LXrucHQ.exe
  2⤵
  PID:9120
- C:\Windows\System\hqyzSQT.exe
  C:\Windows\System\hqyzSQT.exe
  2⤵
  PID:9108
- C:\Windows\System\iQJQppb.exe
  C:\Windows\System\iQJQppb.exe
  2⤵
  PID:9136
- C:\Windows\System\AaGcZkY.exe
  C:\Windows\System\AaGcZkY.exe
  2⤵
  PID:8248
- C:\Windows\System\IRAQkDP.exe
  C:\Windows\System\IRAQkDP.exe
  2⤵
  PID:7276
- C:\Windows\System\GhBIBis.exe
  C:\Windows\System\GhBIBis.exe
  2⤵
  PID:8384
- C:\Windows\System\IHfbWQq.exe
  C:\Windows\System\IHfbWQq.exe
  2⤵
  PID:7996
- C:\Windows\System\cOiWWTn.exe
  C:\Windows\System\cOiWWTn.exe
  2⤵
  PID:8564
- C:\Windows\System\ejSGvsh.exe
  C:\Windows\System\ejSGvsh.exe
  2⤵
  PID:8632
- C:\Windows\System\hfsIXzU.exe
  C:\Windows\System\hfsIXzU.exe
  2⤵
  PID:8444
- C:\Windows\System\kAxwIWa.exe
  C:\Windows\System\kAxwIWa.exe
  2⤵
  PID:8680
- C:\Windows\System\lCOnMqw.exe
  C:\Windows\System\lCOnMqw.exe
  2⤵
  PID:8708
- C:\Windows\System\IXjRJTn.exe
  C:\Windows\System\IXjRJTn.exe
  2⤵
  PID:8856
- C:\Windows\System\FzJqLex.exe
  C:\Windows\System\FzJqLex.exe
  2⤵
  PID:8772
- C:\Windows\System\nOUCgPw.exe
  C:\Windows\System\nOUCgPw.exe
  2⤵
  PID:8876
- C:\Windows\System\WBdkeQE.exe
  C:\Windows\System\WBdkeQE.exe
  2⤵
  PID:8776
- C:\Windows\System\LaJiwfg.exe
  C:\Windows\System\LaJiwfg.exe
  2⤵
  PID:9012
- C:\Windows\System\wJrQZob.exe
  C:\Windows\System\wJrQZob.exe
  2⤵
  PID:9140
- C:\Windows\System\EEsvViV.exe
  C:\Windows\System\EEsvViV.exe
  2⤵
  PID:8980
- C:\Windows\System\yawVFpF.exe
  C:\Windows\System\yawVFpF.exe
  2⤵
  PID:9160
- C:\Windows\System\wsSmkhn.exe
  C:\Windows\System\wsSmkhn.exe
  2⤵
  PID:9196
- C:\Windows\System\hVWCrZU.exe
  C:\Windows\System\hVWCrZU.exe
  2⤵
  PID:7880
- C:\Windows\System\LNHBBZc.exe
  C:\Windows\System\LNHBBZc.exe
  2⤵
  PID:8328
- C:\Windows\System\zGwCFaV.exe
  C:\Windows\System\zGwCFaV.exe
  2⤵
  PID:8316
- C:\Windows\System\HweQajv.exe
  C:\Windows\System\HweQajv.exe
  2⤵
  PID:8348
- C:\Windows\System\PEBtXbC.exe
  C:\Windows\System\PEBtXbC.exe
  2⤵
  PID:8572
- C:\Windows\System\GVoOVWC.exe
  C:\Windows\System\GVoOVWC.exe
  2⤵
  PID:8644
- C:\Windows\System\UrCYFxp.exe
  C:\Windows\System\UrCYFxp.exe
  2⤵
  PID:8788
- C:\Windows\System\iUHAjwP.exe
  C:\Windows\System\iUHAjwP.exe
  2⤵
  PID:9092
- C:\Windows\System\wvtTzwY.exe
  C:\Windows\System\wvtTzwY.exe
  2⤵
  PID:8740
- C:\Windows\System\bnDQTdS.exe
  C:\Windows\System\bnDQTdS.exe
  2⤵
  PID:8568
- C:\Windows\System\PgrBQMY.exe
  C:\Windows\System\PgrBQMY.exe
  2⤵
  PID:9192
- C:\Windows\System\wJbeNNG.exe
  C:\Windows\System\wJbeNNG.exe
  2⤵
  PID:8428
- C:\Windows\System\fnDcSlm.exe
  C:\Windows\System\fnDcSlm.exe
  2⤵
  PID:9024
- C:\Windows\System\JNqjeKU.exe
  C:\Windows\System\JNqjeKU.exe
  2⤵
  PID:7388
- C:\Windows\System\jvnYCQq.exe
  C:\Windows\System\jvnYCQq.exe
  2⤵
  PID:8380
- C:\Windows\System\nbKBwuk.exe
  C:\Windows\System\nbKBwuk.exe
  2⤵
  PID:7852
- C:\Windows\System\nZUlZNW.exe
  C:\Windows\System\nZUlZNW.exe
  2⤵
  PID:9104
- C:\Windows\System\dEVLNFV.exe
  C:\Windows\System\dEVLNFV.exe
  2⤵
  PID:9188
- C:\Windows\System\GdoPyCl.exe
  C:\Windows\System\GdoPyCl.exe
  2⤵
  PID:9228
- C:\Windows\System\QSbvJIg.exe
  C:\Windows\System\QSbvJIg.exe
  2⤵
  PID:9244
- C:\Windows\System\NITGmjc.exe
  C:\Windows\System\NITGmjc.exe
  2⤵
  PID:9260
- C:\Windows\System\ZntKGmd.exe
  C:\Windows\System\ZntKGmd.exe
  2⤵
  PID:9276
- C:\Windows\System\mlhFmwQ.exe
  C:\Windows\System\mlhFmwQ.exe
  2⤵
  PID:9292
- C:\Windows\System\NVbaAxN.exe
  C:\Windows\System\NVbaAxN.exe
  2⤵
  PID:9308
- C:\Windows\System\TWScYIA.exe
  C:\Windows\System\TWScYIA.exe
  2⤵
  PID:9324
- C:\Windows\System\MajpAJl.exe
  C:\Windows\System\MajpAJl.exe
  2⤵
  PID:9340
- C:\Windows\System\oTyyfIi.exe
  C:\Windows\System\oTyyfIi.exe
  2⤵
  PID:9356
- C:\Windows\System\TBVPGXh.exe
  C:\Windows\System\TBVPGXh.exe
  2⤵
  PID:9372
- C:\Windows\System\crIwcvC.exe
  C:\Windows\System\crIwcvC.exe
  2⤵
  PID:9388
- C:\Windows\System\sFjlxLu.exe
  C:\Windows\System\sFjlxLu.exe
  2⤵
  PID:9404
- C:\Windows\System\psNpwSL.exe
  C:\Windows\System\psNpwSL.exe
  2⤵
  PID:9420
- C:\Windows\System\cFwfHbo.exe
  C:\Windows\System\cFwfHbo.exe
  2⤵
  PID:9436
- C:\Windows\System\oXwIvKH.exe
  C:\Windows\System\oXwIvKH.exe
  2⤵
  PID:9452
- C:\Windows\System\QYKdMNA.exe
  C:\Windows\System\QYKdMNA.exe
  2⤵
  PID:9468
- C:\Windows\System\POfzxGe.exe
  C:\Windows\System\POfzxGe.exe
  2⤵
  PID:9484
- C:\Windows\System\HxEWOly.exe
  C:\Windows\System\HxEWOly.exe
  2⤵
  PID:9500
- C:\Windows\System\mJtvSAV.exe
  C:\Windows\System\mJtvSAV.exe
  2⤵
  PID:9516
- C:\Windows\System\RveFmcv.exe
  C:\Windows\System\RveFmcv.exe
  2⤵
  PID:9532
- C:\Windows\System\priUMex.exe
  C:\Windows\System\priUMex.exe
  2⤵
  PID:9548
- C:\Windows\System\FbPDMqf.exe
  C:\Windows\System\FbPDMqf.exe
  2⤵
  PID:9564
- C:\Windows\System\bUrPCcq.exe
  C:\Windows\System\bUrPCcq.exe
  2⤵
  PID:9580
- C:\Windows\System\zFtPFuG.exe
  C:\Windows\System\zFtPFuG.exe
  2⤵
  PID:9596
- C:\Windows\System\EHlNydr.exe
  C:\Windows\System\EHlNydr.exe
  2⤵
  PID:9612
- C:\Windows\System\eQmXHhl.exe
  C:\Windows\System\eQmXHhl.exe
  2⤵
  PID:9628
- C:\Windows\System\iYpUOHZ.exe
  C:\Windows\System\iYpUOHZ.exe
  2⤵
  PID:9644
- C:\Windows\System\LbAOmwP.exe
  C:\Windows\System\LbAOmwP.exe
  2⤵
  PID:9660
- C:\Windows\System\qcBYyuD.exe
  C:\Windows\System\qcBYyuD.exe
  2⤵
  PID:9676
- C:\Windows\System\xZmZkPL.exe
  C:\Windows\System\xZmZkPL.exe
  2⤵
  PID:9692
- C:\Windows\System\cyldOKQ.exe
  C:\Windows\System\cyldOKQ.exe
  2⤵
  PID:9708
- C:\Windows\System\CPPQCkO.exe
  C:\Windows\System\CPPQCkO.exe
  2⤵
  PID:9724
- C:\Windows\System\DdXFlvF.exe
  C:\Windows\System\DdXFlvF.exe
  2⤵
  PID:9740
- C:\Windows\System\XmtFqGu.exe
  C:\Windows\System\XmtFqGu.exe
  2⤵
  PID:9756
- C:\Windows\System\IWJeKNY.exe
  C:\Windows\System\IWJeKNY.exe
  2⤵
  PID:9772
- C:\Windows\System\qLrosKJ.exe
  C:\Windows\System\qLrosKJ.exe
  2⤵
  PID:9788
- C:\Windows\System\SPRTCGj.exe
  C:\Windows\System\SPRTCGj.exe
  2⤵
  PID:9804
- C:\Windows\System\sLJCHTr.exe
  C:\Windows\System\sLJCHTr.exe
  2⤵
  PID:9820
- C:\Windows\System\zitbqwD.exe
  C:\Windows\System\zitbqwD.exe
  2⤵
  PID:9836
- C:\Windows\System\nwitbRZ.exe
  C:\Windows\System\nwitbRZ.exe
  2⤵
  PID:9852
- C:\Windows\System\sVRMZxA.exe
  C:\Windows\System\sVRMZxA.exe
  2⤵
  PID:9868
- C:\Windows\System\brVsTDc.exe
  C:\Windows\System\brVsTDc.exe
  2⤵
  PID:9884
- C:\Windows\System\PLZAOor.exe
  C:\Windows\System\PLZAOor.exe
  2⤵
  PID:9900
- C:\Windows\System\CgopRLF.exe
  C:\Windows\System\CgopRLF.exe
  2⤵
  PID:9916
- C:\Windows\System\rsGExXu.exe
  C:\Windows\System\rsGExXu.exe
  2⤵
  PID:9932
- C:\Windows\System\KQiCJgY.exe
  C:\Windows\System\KQiCJgY.exe
  2⤵
  PID:9948
- C:\Windows\System\hAFMtfl.exe
  C:\Windows\System\hAFMtfl.exe
  2⤵
  PID:9964
- C:\Windows\System\anzYvUc.exe
  C:\Windows\System\anzYvUc.exe
  2⤵
  PID:9980
- C:\Windows\System\QRwFBqE.exe
  C:\Windows\System\QRwFBqE.exe
  2⤵
  PID:9996
- C:\Windows\System\pcmWcmT.exe
  C:\Windows\System\pcmWcmT.exe
  2⤵
  PID:10012
- C:\Windows\System\dBqfQjc.exe
  C:\Windows\System\dBqfQjc.exe
  2⤵
  PID:10028
- C:\Windows\System\nrAfRxG.exe
  C:\Windows\System\nrAfRxG.exe
  2⤵
  PID:10044
- C:\Windows\System\nyVNpRu.exe
  C:\Windows\System\nyVNpRu.exe
  2⤵
  PID:10060
- C:\Windows\System\XHqSoWG.exe
  C:\Windows\System\XHqSoWG.exe
  2⤵
  PID:10076
- C:\Windows\System\dRsWDJr.exe
  C:\Windows\System\dRsWDJr.exe
  2⤵
  PID:10092
- C:\Windows\System\pQuCpHQ.exe
  C:\Windows\System\pQuCpHQ.exe
  2⤵
  PID:10108
- C:\Windows\System\agpgvlZ.exe
  C:\Windows\System\agpgvlZ.exe
  2⤵
  PID:10124
- C:\Windows\System\LBXGaII.exe
  C:\Windows\System\LBXGaII.exe
  2⤵
  PID:10140
- C:\Windows\System\iUeyekF.exe
  C:\Windows\System\iUeyekF.exe
  2⤵
  PID:10156
- C:\Windows\System\qIhwYbV.exe
  C:\Windows\System\qIhwYbV.exe
  2⤵
  PID:10172
- C:\Windows\System\KHMAOdD.exe
  C:\Windows\System\KHMAOdD.exe
  2⤵
  PID:10188
- C:\Windows\System\NohZeUn.exe
  C:\Windows\System\NohZeUn.exe
  2⤵
  PID:10204
- C:\Windows\System\nIPmhUS.exe
  C:\Windows\System\nIPmhUS.exe
  2⤵
  PID:10220
- C:\Windows\System\OnYmsMO.exe
  C:\Windows\System\OnYmsMO.exe
  2⤵
  PID:10236
- C:\Windows\System\zyZAhqf.exe
  C:\Windows\System\zyZAhqf.exe
  2⤵
  PID:8520
- C:\Windows\System\wopycBs.exe
  C:\Windows\System\wopycBs.exe
  2⤵
  PID:9220
- C:\Windows\System\UdifDHm.exe
  C:\Windows\System\UdifDHm.exe
  2⤵
  PID:9284
- C:\Windows\System\xMRmkZM.exe
  C:\Windows\System\xMRmkZM.exe
  2⤵
  PID:9256
- C:\Windows\System\OBqHVtg.exe
  C:\Windows\System\OBqHVtg.exe
  2⤵
  PID:9352
- C:\Windows\System\ARYACBV.exe
  C:\Windows\System\ARYACBV.exe
  2⤵
  PID:9384
- C:\Windows\System\hpingfH.exe
  C:\Windows\System\hpingfH.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:9412
- C:\Windows\System\BIanpxZ.exe
  C:\Windows\System\BIanpxZ.exe
  2⤵
  PID:9480
- C:\Windows\System\bQMCRDV.exe
  C:\Windows\System\bQMCRDV.exe
  2⤵
  PID:9304
- C:\Windows\System\IOSvHHj.exe
  C:\Windows\System\IOSvHHj.exe
  2⤵
  PID:9056
- C:\Windows\System\SkuJFbi.exe
  C:\Windows\System\SkuJFbi.exe
  2⤵
  PID:9332
- C:\Windows\System\eRjiGdE.exe
  C:\Windows\System\eRjiGdE.exe
  2⤵
  PID:9428
- C:\Windows\System\AcasDwE.exe
  C:\Windows\System\AcasDwE.exe
  2⤵
  PID:9560
- C:\Windows\System\XqIyCVj.exe
  C:\Windows\System\XqIyCVj.exe
  2⤵
  PID:9524
- C:\Windows\System\JIZaoww.exe
  C:\Windows\System\JIZaoww.exe
  2⤵
  PID:9624
- C:\Windows\System\dFuNKvc.exe
  C:\Windows\System\dFuNKvc.exe
  2⤵
  PID:9604
- C:\Windows\System\DASXUWK.exe
  C:\Windows\System\DASXUWK.exe
  2⤵
  PID:9576
- C:\Windows\System\znXoYGq.exe
  C:\Windows\System\znXoYGq.exe
  2⤵
  PID:9700
- C:\Windows\System\RXUVBtm.exe
  C:\Windows\System\RXUVBtm.exe
  2⤵
  PID:9764
- C:\Windows\System\LSlDtiC.exe
  C:\Windows\System\LSlDtiC.exe
  2⤵
  PID:9800
- C:\Windows\System\gWSENaY.exe
  C:\Windows\System\gWSENaY.exe
  2⤵
  PID:9688
- C:\Windows\System\RoxSZpL.exe
  C:\Windows\System\RoxSZpL.exe
  2⤵
  PID:8332
- C:\Windows\System\wpecXbE.exe
  C:\Windows\System\wpecXbE.exe
  2⤵
  PID:9784
- C:\Windows\System\lLLIWdy.exe
  C:\Windows\System\lLLIWdy.exe
  2⤵
  PID:9896
- C:\Windows\System\dHxQvMT.exe
  C:\Windows\System\dHxQvMT.exe
  2⤵
  PID:9880
- C:\Windows\System\dsiVVpB.exe
  C:\Windows\System\dsiVVpB.exe
  2⤵
  PID:9940
- C:\Windows\System\obQzeGF.exe
  C:\Windows\System\obQzeGF.exe
  2⤵
  PID:10004
- C:\Windows\System\IavZQyy.exe
  C:\Windows\System\IavZQyy.exe
  2⤵
  PID:9988
- C:\Windows\System\zyAQyyk.exe
  C:\Windows\System\zyAQyyk.exe
  2⤵
  PID:10056
- C:\Windows\System\HYadVqx.exe
  C:\Windows\System\HYadVqx.exe
  2⤵
  PID:10036
- C:\Windows\System\iXHjIUX.exe
  C:\Windows\System\iXHjIUX.exe
  2⤵
  PID:10100
- C:\Windows\System\GIqshPg.exe
  C:\Windows\System\GIqshPg.exe
  2⤵
  PID:10152
- C:\Windows\System\IljLTqw.exe
  C:\Windows\System\IljLTqw.exe
  2⤵
  PID:10216
- C:\Windows\System\NKGsMaC.exe
  C:\Windows\System\NKGsMaC.exe
  2⤵
  PID:10228
- C:\Windows\System\ogeTRuB.exe
  C:\Windows\System\ogeTRuB.exe
  2⤵
  PID:10168
- C:\Windows\System\saKhtsX.exe
  C:\Windows\System\saKhtsX.exe
  2⤵
  PID:8524
- C:\Windows\System\nDejiMx.exe
  C:\Windows\System\nDejiMx.exe
  2⤵
  PID:9316
- C:\Windows\System\aeVppaA.exe
  C:\Windows\System\aeVppaA.exe
  2⤵
  PID:9240
- C:\Windows\System\CVRUfMp.exe
  C:\Windows\System\CVRUfMp.exe
  2⤵
  PID:9288
- C:\Windows\System\dzgTevw.exe
  C:\Windows\System\dzgTevw.exe
  2⤵
  PID:9512
- C:\Windows\System\UztHVOW.exe
  C:\Windows\System\UztHVOW.exe
  2⤵
  PID:9400
- C:\Windows\System\YwGitQw.exe
  C:\Windows\System\YwGitQw.exe
  2⤵
  PID:9464
- C:\Windows\System\wvGryUg.exe
  C:\Windows\System\wvGryUg.exe
  2⤵
  PID:9636
- C:\Windows\System\sLRoEOw.exe
  C:\Windows\System\sLRoEOw.exe
  2⤵
  PID:9736
- C:\Windows\System\lOmTjnn.exe
  C:\Windows\System\lOmTjnn.exe
  2⤵
  PID:9668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AqSxxar.exe

Filesize
1.9MB

MD5
c1c5f1845c8d9a2d1f812c53eadb66ce

SHA1
0287c49ce04a570c9c8a5bbdc7030670d4361824

SHA256
055e9a3630b6cb4f429c03f772c80f526b88db7d5dbd600ccfcf44af0e5c14c4

SHA512
4f631c607c3718d229cd0a74d863e5d4672f83cf7c0d10808d6c3b9905132ede1b67489848daa89c0da8b93a807fb6eb610c47c0d624485b2cb2ff461c94689c

Download Submit
C:\Windows\system\BJsFGbj.exe

Filesize
1.9MB

MD5
4e7cb2e08908458feed04d557cd4c271

SHA1
86f0cc9f994ce494467e237a509223a0056f75d2

SHA256
d80952dba387dd237c377ebbafa6e622cfed5cf785ab1e73834e3bb9f9ad0740

SHA512
a993dbc4c64b1f7435c0dfb1672238ffc8e65a391c2e3139d491b3323d82ec0042072a269ec393d73e135409ff0b900f4f66b665153ec552e9fe5bea143e5125

Download Submit
C:\Windows\system\OcfbQzt.exe

Filesize
1.9MB

MD5
bf869f52ae208a8fcd27a7a69efb34c5

SHA1
64b77764f05c78c343081e0a1d1aa05821bc79f9

SHA256
b7a916729a6b4dbc2855a20b04d90d3d47168f6045e38147cd42975fc38172d6

SHA512
cff78891a56938bad41be4d8299de42d4fd60af00332a0102d68a4dbe828802254c1767ed219289dfb77eaaa3bdef69ec2022672e6043aaa2eaa5c27ff4b8f7c

Download Submit
C:\Windows\system\QNmJnBu.exe

Filesize
1.9MB

MD5
2075b089ad793c3611f1375a0b54f6c2

SHA1
f75dcc145e577de6299e504df87e476887aaf077

SHA256
14798484a16f12c711ab7d58245db78704ffcb97de90a7f569ee352837c1a900

SHA512
6a0cd8d4024f8aac41801e935cc845f6a2a37f456141114a75dd1a7cf8e6632aaafbd8d755e0c85b6bb7bb25524dad45dc690d91cfce560cc6fefdec07ab2daf

Download Submit
C:\Windows\system\QkDfKRo.exe

Filesize
1.9MB

MD5
39acc7732fdb50d5623f07d97c9157ad

SHA1
6b651ca523fbe63cd99607fe90de8f31e5846ab2

SHA256
8a7d1da388767aface8443a2924f7c8c482d74fed75e8399389a65604be47961

SHA512
447d5e22b02cc53f55f7f7cdda7b1bcf9b369ad9f44f5efa201a9c53befc3254d607de4b4e858d8209be6991c50915e0363d5e4108a52a94906fec3180b0a7df

Download Submit
C:\Windows\system\SiyxQFI.exe

Filesize
1.9MB

MD5
859dcb1f0a2858396dd21fdfbfa9e4de

SHA1
0bd5ae9620e9a20053f5e8a2a88b9be0df681b0f

SHA256
b04c4c13fe51b6b1329c2d93c3fb98ae717c8d62c478816851c8c4a4d9714cd5

SHA512
c6135608fa2ba34ec5239088e119f092cbafe8227400d217f9c38478494df5bbcbdd4c1a48379ed5a97e2360e36654ab76f681e1e2642044edfebc19bdb1ba44

Download Submit
C:\Windows\system\WmTwGkx.exe

Filesize
1.9MB

MD5
07fa560b47e8aeb2bba9e5283f588f9a

SHA1
6c9d7002373a1c833bf58897d881a11af3df3e74

SHA256
77cee7cb4b53cf1a1de56577e29ff25bce2db3015fc2201b1f26267069116f18

SHA512
14361d1c931979d8682a2e09fbf2c4ecc75e186b33e3174e6d63d41872b983e0c726c8af1b0b9f80449eff56eb55bb652f598ab051fb415b48b8001a54d16b6e

Download Submit
C:\Windows\system\aUDJhTS.exe

Filesize
1.9MB

MD5
ba0084a1edf66face4796a804d362eea

SHA1
c04e2f875f6718499352e458fa12b7b8863fba1e

SHA256
bcb85f1dc64002727a6c9e873fe8350288a71876700dabcb8d782913f3aab276

SHA512
487b33a34066e2579627ddda73154ffcfaca177b69b6502911eba760e619a3fd91d51346da97520f29cc39ecbe8051ed5fe250e5168c656e0392f4cdaef8bdf2

Download Submit
C:\Windows\system\acmKUEI.exe

Filesize
1.9MB

MD5
79053bd12b4fa69ace693b90bc83263b

SHA1
5ba756a6e225814708d279364833cfda7a7fa7f0

SHA256
a300bdba4440ba21e6c2c03d53312681af325de5f0056fbecbb98532d124436b

SHA512
046d5a74628958b582ad4c85ddf4c95ea54cc7b48d53b3a2201936f62bc3a873137c1693cd4070e15c3f4333dda651947370ea3a43c4921b14fe49e3ed40ad48

Download Submit
C:\Windows\system\cdrQwpT.exe

Filesize
1.9MB

MD5
324ccd7c96d72f2e520fcc1130ade192

SHA1
a4f7c1007dabc1e58770483641b0dd755a7ad45c

SHA256
2f8056b8d7fb5c1d462c746513d1d7f3196ab67b61a290f01bb25d93c16fabac

SHA512
b03cf3c624e2705903ac90c9acd0309a6ea917130e81d0a0a675e722eedfa6944cfbdbc65279ff10058e99d9223fc25968be9ab2da57191875f237010937ace3

Download Submit
C:\Windows\system\dXXxptz.exe

Filesize
1.9MB

MD5
a1f4bddf4eb8e3b09076db92d59fdba0

SHA1
b556b84a5d5e7a2dd4d5a348a7a41150081f7029

SHA256
327b1532f1c2733ed4cf8f1c2c9428a6838a071d36d31d319194314fb35d1432

SHA512
a169c004b4135db59f4a9994b56e5febd84c69775c761b7c650454ab32e5ca6835fbbd0b82e628c7b3c5ea21a111acc2b9cbf26a741676ae9f409150a1569ca1

Download Submit
C:\Windows\system\dYzaZJo.exe

Filesize
1.9MB

MD5
b4d9b926eead3763917be43d283cc2e2

SHA1
415764ffbd1672287540f6e0d0893a327467adbc

SHA256
c9f2b988f173258ae7cba42a31838cefdeda8517a2e9d08566adf8f3cdb5c0e8

SHA512
a99b1ce122b36e11a1f941df952b6f5c5173eb131474cb5b53c9fe6b9eef770db6a061ca5e61ae3ac1225b36101e19df11cf22abff253747c0e14eb1a5d8a129

Download Submit
C:\Windows\system\fxZRfTE.exe

Filesize
1.9MB

MD5
1c401857f00648014a049a12bf12822e

SHA1
e09f605408515e4b108243bbc44f118932ca37bb

SHA256
2996d68e6e322e8901a72a7b72c2fa7204762541ee5caa405ae9ae2364c7876a

SHA512
8207b3ca86fb27c1d3f3ceddec777be80aea94a8bad5cfe30704b270befdda2ef0c35f9e7b9bb0cc12440bc09395d52d5e1fd09b298c7bc150de5f97e59226ce

Download Submit
C:\Windows\system\hgkZAVt.exe

Filesize
1.9MB

MD5
e36702cc5d16a828be162f63f634f8d7

SHA1
7e79c5bac3c0cb179073af2dafa99bc2fa89ba3f

SHA256
ee4002e5c65a24a1fcbb61badf138d8fad3cad6eb7ed1ae3eb218e1031d82a5b

SHA512
931a1e04de5fcbb0d72a4691602e3f9c342e81b3d1efad66798515ae2d0ecf9ee42b08784088d913c7296d7db54e2da3d8de0974c879e4e7b6f86b2823d7f488

Download Submit
C:\Windows\system\hhoOerw.exe

Filesize
1.9MB

MD5
503a81e1d87983e8ad74bb26432b4424

SHA1
aebe05703160db854dd91c20d01efea9f0393c5b

SHA256
f35d5ddfbaa2c169f14b574527dded3f6079f9a8f9d8aee46d360594da0f6eb2

SHA512
0e5b3a48b6142f08a556d4dcd14c48ede3e0de0cad75bc5cc2ea2ae75136600a903594b0c96862c0c118527c396d18d9748ab6d50739c481e3bb4dd66bbe17cf

Download Submit
C:\Windows\system\jwIWqkU.exe

Filesize
1.9MB

MD5
18575ed42726682d604831b7dbaeef7f

SHA1
24709ee274c14c8d3621566857e268009a251730

SHA256
867b3d6e029ceb0cc3c7cfa15fe7b7b1efaa3c5e0249fbb1106c6b1d24328657

SHA512
0e6d0c4c74d8ac7cbe62e0143d79fbe179a517beb702dea4be69918522e38779af935131fd1c4993aa1d290aa87fbf082f5837648f9c1f565f4057ee5c9bd9bd

Download Submit
C:\Windows\system\masAVQA.exe

Filesize
18B

MD5
18cb720530fcb5807adda1d7127a9ca6

SHA1
85edfa2186465c5a41c8530d75843fa2a25bcb9a

SHA256
fd955c12f4ba49f8782743f47e87adc9356d78c35e9329ac8019cba6f3e0b984

SHA512
8773526471e474fac1c61694871a036b159dc869efb5a8803483523cf1e5d80c654ce91b77f2be87cf0e0005ab1ee6945947cf6e3171f928270a1f341928cee9

Download Submit
C:\Windows\system\pcOYeNs.exe

Filesize
1.9MB

MD5
233a8ec966bb58a25fcb5d71673db27d

SHA1
38683f11e4a21066d3d6b6d768a2d522153b05e8

SHA256
ff8d9b3182ac99aa022290035353129e765a69abee272f037560430a2855286e

SHA512
5416823ae50bebab3130324ed56ccc086a331cf15f5daaf7b09e307c2a7e0b5bc4f667ca2715bf841a7ca89d6345b680ff4028415b0686aa90a0aa171cc47607

Download Submit
C:\Windows\system\qZVCxDL.exe

Filesize
1.9MB

MD5
d766793fa2d06d6cfcfe33f8ffbabf99

SHA1
f35c5930827a586595dcae263a14ee931dbe5fdc

SHA256
bfe07278b1d7cfce9d48ab1bbee61e419e5fb0088b33198ab58abdf5fc5f6a1c

SHA512
c4ea54a370a4bbf2e822e23f21bbfc3ba32858d5344f0c788b22ff9d67ad41d39991bcbcf3ba3f63bb638014cc0cd1cb9732c9dd30d4ae68cb9e7f48a425da0d

Download Submit
C:\Windows\system\xkyhaLG.exe

Filesize
1.9MB

MD5
778272b6580083683aceddc15862cd41

SHA1
d5b46cffa6dcd67c75e3b064ce2fdbaa148c4688

SHA256
dee07971fa1ec4c5766f913741267c447deb36c51a15ca34ed71b7aa67b58ebc

SHA512
a1a62198ccf447df442407da6a63438fbe67fef2f93fff13b158d1111e14c356e68d9eab6cc7350dce8602e6a11f93c8bc20a4af4aabd8198f484e88f0172d42

Download Submit
C:\Windows\system\yAzYtVv.exe

Filesize
1.9MB

MD5
cc24cf5b16d5ec8c93ad146cb4918730

SHA1
c8b42893a583eca46746971ad43ff14641fac71d

SHA256
02115b3b8fc8900ba73877a1d326f35a8a5482239052cff3e510a52a94082f61

SHA512
2db9d6719f693517fc5869b43426846176f99b91909c4390f1ae150219f98f58c4d3b74ec47bc1e9cabee4e33a135b0426d325ed7aa2ddcd447ed455f69bc4fc

Download Submit
C:\Windows\system\yaVVygN.exe

Filesize
1.9MB

MD5
7e2c26755460337bb77c5f8e6c5b0282

SHA1
fab13d9ee4102f28d07b2b35e79d3a471179672a

SHA256
6c3c08b90e9b6575fb70aa7041652b09a9057b698340ed1081538839d8317b10

SHA512
3517619759372f269b4d67987c75ff7fa4a82433e94f36da9a18f6c1a4e87d4238f3cdb92462017d503cb797422abbf8f47927952a412d43ac2260b57a3f2f33

Download Submit
\Windows\system\ColTATo.exe

Filesize
1.9MB

MD5
6203c26f0e83a1842a25cc9740be3c9b

SHA1
80f30a29bd6c4461afd9797b7d5d5abc3f42b52c

SHA256
08deadab22e12e8f0e8bcec7a58ba94765d42c1551baafd2212f7726abadbaf5

SHA512
7994b0778b2b78e28a3ae4395f2ad13465f8e094caa944a2e584076fc447acfcb908d63e9b2be42cd8057c57a184d7ceaf7ac345c990aaefda1c67104e2fb473

Download Submit
\Windows\system\DpQbpKS.exe

Filesize
1.9MB

MD5
82d1197e878aa77e1aeebeea6bd3af85

SHA1
7217d27294a8d585000ef1b8d1abeef412dd3b9e

SHA256
921d4e998ea1fb16bf8b309b46607123c792749189b4e5790a971ade51259740

SHA512
31aa59db0b2d9878160e7b97ae043133516f1673ad0b84837a8a7b81d87d4f009c83ea9cf10af124dc321a41fe6e9555eb98b76efa0039dd52af7b1a35db1369

Download Submit
\Windows\system\GdmkQhv.exe

Filesize
1.9MB

MD5
e0501ca81def24a286b8da41c7695c2d

SHA1
398238f2709f992a4a8a6ece08a14932f15d824f

SHA256
b9af819eb0895da8a3f5b855685c3517dba5275ec271cebcc3409e2dd2f10b9f

SHA512
6c74668d09b442f6e52c8ada1952da9441cdb75c3c5dc2689490b37a6ad82f06faedff4dad86017ffda04c817d82b270d17ed0df74e67beef70d39e356301ccb

Download Submit
\Windows\system\IncjIzd.exe

Filesize
1.9MB

MD5
79734a9d482a92c05dfa5e947d3cb51c

SHA1
dc288f61b49ecc53f82a3347aa9a60bef36a5a25

SHA256
0d22fcd0fbc1a64e79b2746083b3d48bd7d98ceefc33ef53be37565a4f06f18b

SHA512
0a6685b042bacfce4682e613b3724468281d4fe290a633974ed2f5aece2daa29956a6a642091bcdb9a3cb3c9e05a400f084c6442ce4a5f72a0162cfa867d85ec

Download Submit
\Windows\system\OAAcFAC.exe

Filesize
1.9MB

MD5
8efbf136b4c0dd9e95af5cca65bc3a76

SHA1
5b31e21d39e0263513d38440dd8ff616a32bc1b5

SHA256
583fbf7b82d79bef1ee3441544882a3be3a910f9ae2128362c2e5fe4098a1f12

SHA512
e9452cc3e73fb991c5b99b96e69297f5e627a526af9b28eb398cc03b853f41a50227c95218ff5a079cc7fbe3d21b47a6cb0a78571473f89559cf8b7151043dc7

Download Submit
\Windows\system\SVHRsMk.exe

Filesize
1.9MB

MD5
fcf73b6c58e704aa5c994851297aeb8c

SHA1
b42d29f2157765f13bf64284ccba527594610be4

SHA256
2c0f9aa801ae33a1bc75971619c51b5895fde55b8563c63e83af95a6791c38dd

SHA512
4d8de6b92820c8934bb716f3c2e1740d876fce19cb91f304b4b322d9c51b73f610b0a0cbeadab978e19ec725e41f2d7e16038f9624db0bc7b2dbf55f2b10b916

Download Submit
\Windows\system\cknNqlE.exe

Filesize
1.9MB

MD5
8853ef6f629409cb7dbb91e06641ad91

SHA1
bbab3d6d1f504fad5054aa90cbff4b29d1b6b37e

SHA256
1ab1fa938e66a413ea997121ab085b3687cccbe3f8c8525d8edee7ae884f1807

SHA512
6b6b2c2b0d5fe38ede09cb309754ec93c72cd98d851cb4e3a2714c23f718f2702aaf8e2dbcfb7964b9d4e9cfd23445b36e118fda99a209cfa1a97446c671f55a

Download Submit
\Windows\system\fPMaHTT.exe

Filesize
1.9MB

MD5
bcfb6fe8425fbaf99c708f8283ac4fee

SHA1
eedb1acf81bee55d8c600fa97a528688ba54065b

SHA256
76d0b957d47f563771f29deb440c883eaf660402fdeeb671daac6bcc0c4be4d6

SHA512
3e1baa4b82e9be5b95a41dd255462dd8e3b048286e1cd9c4ed73f27a06d455cc60e7a29798e0c2b3a97bc074740a2cb305ce6b44653fa24e70bef85d802b3179

Download Submit
\Windows\system\gTvOTZD.exe

Filesize
1.9MB

MD5
716a7fd7a26687d8c664a26f0e4fa3da

SHA1
d73a63bd802cb7b9bb5908b91720a847b0fe1a61

SHA256
a6da2f5a4c40489cdd13a05883e29e3836aea7b0fba58cd7db2efb07fe8f4d0b

SHA512
aa0407b6ef6ae50f12d8d517717465fee8cb95f165360132a15a2c80146c1740beb8085efffcfa517399dd53cf16d8ded03e6482aacf48a6ac826b1f75e6c2ca

Download Submit
\Windows\system\inxdlSu.exe

Filesize
1.9MB

MD5
3f05506bd356c59bfd864b79ab6ef5ab

SHA1
6da348ca372eb9633395ae84cc24699029745334

SHA256
82ae2363f6b2051cf6223d645e953b107ab21fd8e395dd8ca2252927c7aee18d

SHA512
60e5d35ff243e15dac3a7a479ae6cb920b426b248b5d7aef8ee4a492502a3c966e24de1c116f404764a40bad51c789006b7f3dedbfb332c089a19e7d23b8bee0

Download Submit
\Windows\system\jarlkMq.exe

Filesize
1.9MB

MD5
11f22ad1cacc8e726a87383900b09e74

SHA1
385a1c1aed0b70a1533ed85c2e6aef83b2e92e66

SHA256
d058e67ab53916da1184b27889309b60eaf0d93fc9360b8f99b9f58395d3184e

SHA512
3a7babc57267328f82c462b05aeb43c8663b3fe908229b0c2cadb6d84642b1a1675c77ae1890f3e2369053d56e3914ed5b8449b7b034f55a5ee225d6ec8d72f0

Download Submit
\Windows\system\nHRaupm.exe

Filesize
1.9MB

MD5
dc65e211fde1e1f40caf828bb6756eba

SHA1
fcca058e15c27ef631072153f38fbe204e8626cb

SHA256
dee9e6759cd14ea1ebfc934dfb0c2df16a7dd9014d22f404e6a40526a33dc36a

SHA512
e6d5a8d9b9ea0a8220536a2919de402f134d246470e10bab95e9041e8260d4e5567a7f039ca49e8567d65b8d5fa738e7233d113b80f12255a0a9884164dfbaba

Download Submit
\Windows\system\qsGZMUU.exe

Filesize
1.9MB

MD5
e7954c996bab63abea7cf795f87aa4c5

SHA1
2025edb38cfae633d525856677cafceb7df3900b

SHA256
ae52d2e8a885fb77b1231067dada77d6811298454f42ed5c1c69fdeea02fcb6c

SHA512
dfa6dd0cf4dc241f7b5031ad76f52597969662bc1d82449b044a753e075b5b54600972d63943823c845fe26c9ddf48671e8a759f338ecadc4cbbda346744aab0

Download Submit
memory/1800-269-0x0000000001E10000-0x0000000001E18000-memory.dmp

Filesize
32KB

Download
memory/1800-166-0x000007FEF5430000-0x000007FEF5DCD000-memory.dmp

Filesize
9.6MB

Download
memory/1800-1347-0x000007FEF5430000-0x000007FEF5DCD000-memory.dmp

Filesize
9.6MB

Download
memory/1800-37-0x000007FEF56EE000-0x000007FEF56EF000-memory.dmp

Filesize
4KB

Download
memory/1800-265-0x000000001B720000-0x000000001BA02000-memory.dmp

Filesize
2.9MB

Download
memory/2100-15-0x000000013FF90000-0x0000000140382000-memory.dmp

Filesize
3.9MB

Download
memory/2208-218-0x000000013F8B0000-0x000000013FCA2000-memory.dmp

Filesize
3.9MB

Download
memory/2208-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2208-190-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2208-192-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/2208-200-0x000000013FAA0000-0x000000013FE92000-memory.dmp

Filesize
3.9MB

Download
memory/2208-10281-0x000000013FB60000-0x000000013FF52000-memory.dmp

Filesize
3.9MB

Download
memory/2208-222-0x000000013FB60000-0x000000013FF52000-memory.dmp

Filesize
3.9MB

Download
memory/2208-10280-0x000000013F8B0000-0x000000013FCA2000-memory.dmp

Filesize
3.9MB

Download
memory/2208-185-0x0000000003010000-0x0000000003402000-memory.dmp

Filesize
3.9MB

Download
memory/2208-188-0x0000000003010000-0x0000000003402000-memory.dmp

Filesize
3.9MB

Download
memory/2208-32-0x000000013F910000-0x000000013FD02000-memory.dmp

Filesize
3.9MB

Download
memory/2208-183-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download
memory/2208-16-0x000000013FF90000-0x0000000140382000-memory.dmp

Filesize
3.9MB

Download
memory/2208-0-0x000000013F360000-0x000000013F752000-memory.dmp

Filesize
3.9MB

Download
memory/2208-790-0x000000013F360000-0x000000013F752000-memory.dmp

Filesize
3.9MB

Download
memory/2208-12-0x0000000003010000-0x0000000003402000-memory.dmp

Filesize
3.9MB

Download
memory/2212-36-0x000000013F910000-0x000000013FD02000-memory.dmp

Filesize
3.9MB

Download
memory/2212-5773-0x000000013F910000-0x000000013FD02000-memory.dmp

Filesize
3.9MB

Download
memory/2252-210-0x000000013FB60000-0x000000013FF52000-memory.dmp

Filesize
3.9MB

Download
memory/2252-6401-0x000000013FB60000-0x000000013FF52000-memory.dmp

Filesize
3.9MB

Download
memory/2332-14-0x000000013F6E0000-0x000000013FAD2000-memory.dmp

Filesize
3.9MB

Download
memory/2584-186-0x000000013F3D0000-0x000000013F7C2000-memory.dmp

Filesize
3.9MB

Download
memory/2584-6384-0x000000013F3D0000-0x000000013F7C2000-memory.dmp

Filesize
3.9MB

Download
memory/2588-5775-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2588-195-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2608-5774-0x000000013FAA0000-0x000000013FE92000-memory.dmp

Filesize
3.9MB

Download
memory/2608-205-0x000000013FAA0000-0x000000013FE92000-memory.dmp

Filesize
3.9MB

Download
memory/2668-5756-0x000000013F8B0000-0x000000013FCA2000-memory.dmp

Filesize
3.9MB

Download
memory/2668-179-0x000000013F8B0000-0x000000013FCA2000-memory.dmp

Filesize
3.9MB

Download
memory/2824-5473-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download
memory/2824-227-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download
memory/2964-184-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download
memory/2968-5755-0x000000013FB60000-0x000000013FF52000-memory.dmp

Filesize
3.9MB

Download
memory/2968-189-0x000000013FB60000-0x000000013FF52000-memory.dmp

Filesize
3.9MB

Download