xmrig | b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18/09/2024, 22:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
Size

1.3MB
MD5

af26de04625f7e13d9d381622b37e520
SHA1

ed2a6e4bce534686d5c0c20dd437f028464227da
SHA256

b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5
SHA512

6cd38f8080c6bcde5887ddca84235a0e696c88c3970b63d7e2c76484c767b4ba45406dd66777e16fc0ea458a20188274ac753aeb9552bdd0f9a47256df322c37
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYKpGzouXeqaSxbaI2a4:Lz071uv4BPMkibTIA5peqLO

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 22 IoCs

miner

resource	yara_rule
behavioral1/memory/2692-16-0x000000013FF90000-0x0000000140382000-memory.dmp	xmrig
behavioral1/memory/2524-27-0x000000013F4A0000-0x000000013F892000-memory.dmp	xmrig
behavioral1/memory/2052-14-0x000000013F730000-0x000000013FB22000-memory.dmp	xmrig
behavioral1/memory/1952-663-0x000000013FC50000-0x0000000140042000-memory.dmp	xmrig
behavioral1/memory/2500-660-0x000000013FE30000-0x0000000140222000-memory.dmp	xmrig
behavioral1/memory/1868-658-0x000000013F390000-0x000000013F782000-memory.dmp	xmrig
behavioral1/memory/2728-657-0x00000000034D0000-0x00000000038C2000-memory.dmp	xmrig
behavioral1/memory/1916-656-0x000000013FD60000-0x0000000140152000-memory.dmp	xmrig
behavioral1/memory/556-652-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	xmrig
behavioral1/memory/1572-648-0x000000013FFC0000-0x00000001403B2000-memory.dmp	xmrig
behavioral1/memory/1136-643-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	xmrig
behavioral1/memory/792-639-0x000000013F730000-0x000000013FB22000-memory.dmp	xmrig
behavioral1/memory/536-634-0x000000013F050000-0x000000013F442000-memory.dmp	xmrig
behavioral1/memory/2728-1953-0x000000013F250000-0x000000013F642000-memory.dmp	xmrig
behavioral1/memory/2052-3941-0x000000013F730000-0x000000013FB22000-memory.dmp	xmrig
behavioral1/memory/2692-3948-0x000000013FF90000-0x0000000140382000-memory.dmp	xmrig
behavioral1/memory/2524-3937-0x000000013F4A0000-0x000000013F892000-memory.dmp	xmrig
behavioral1/memory/1916-5096-0x000000013FD60000-0x0000000140152000-memory.dmp	xmrig
behavioral1/memory/1572-5092-0x000000013FFC0000-0x00000001403B2000-memory.dmp	xmrig
behavioral1/memory/792-5090-0x000000013F730000-0x000000013FB22000-memory.dmp	xmrig
behavioral1/memory/556-5112-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	xmrig
behavioral1/memory/1868-5107-0x000000013F390000-0x000000013F782000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2840	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2052	dpXCpNX.exe
2692	lBYJKbz.exe
2524	aaDpPJq.exe
1952	ZNOeSJm.exe
536	CGmKKbP.exe
792	DLrQCkX.exe
1136	hGUgKDF.exe
1572	tAspJix.exe
556	FIBcVhV.exe
1916	rUShrLW.exe
1868	hrHwOUp.exe
2500	hviOfRS.exe
2088	IPHyvtp.exe
2792	GXoqngA.exe
1696	ygqWEJb.exe
2592	crYHvHh.exe
2620	SCAQqPL.exe
3044	CBEdIMZ.exe
1380	KAnfwdW.exe
1192	xwnUeQS.exe
1384	tHYHfRX.exe
1704	DhhvDWy.exe
2100	wceKAQt.exe
2004	fRIafeN.exe
2708	WRvpdzC.exe
2376	TLzoErw.exe
1864	qlsCLmq.exe
2508	ucxXIYz.exe
608	JWrKDUy.exe
1176	PeNOhKQ.exe
1544	qYrMBHo.exe
2176	DYREkVa.exe
1900	CeFXOVM.exe
1620	iQgsezv.exe
2200	DkvkMnl.exe
2216	UIxTIGa.exe
2364	UEKcsvA.exe
1672	RkmXfTW.exe
1164	FheqoVo.exe
1316	tejGqon.exe
764	lTiXvfb.exe
1808	BbvjcRj.exe
1480	LwuVdGH.exe
1288	oqCROVJ.exe
2208	aVsfZGo.exe
1992	HtkBtVX.exe
1652	QgUVsqV.exe
2056	yFLTzqf.exe
2320	hGUvJhX.exe
3008	yxzGdvy.exe
1956	GVXZXoC.exe
1460	wMeIyvm.exe
2452	xQXBijf.exe
1284	AyusXuw.exe
1140	QFuxnFs.exe
712	opCFhLT.exe
316	XMgiXna.exe
3012	CAWoQyw.exe
2188	xQVyFFc.exe
908	bnmAEaI.exe
2612	ltjdnZq.exe
1632	vBQBlzL.exe
1528	TXjILmF.exe
2380	vSrYdlA.exe

Loads dropped DLL 64 IoCs

pid	Process
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe

UPX packed file 54 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2728-0-0x000000013F250000-0x000000013F642000-memory.dmp	upx
behavioral1/files/0x000a00000001227e-3.dat	upx
behavioral1/files/0x0008000000016d0e-7.dat	upx
behavioral1/memory/2692-16-0x000000013FF90000-0x0000000140382000-memory.dmp	upx
behavioral1/memory/2524-27-0x000000013F4A0000-0x000000013F892000-memory.dmp	upx
behavioral1/files/0x00120000000054a9-30.dat	upx
behavioral1/files/0x0008000000016d18-9.dat	upx
behavioral1/memory/2052-14-0x000000013F730000-0x000000013FB22000-memory.dmp	upx
behavioral1/files/0x0007000000016d3a-43.dat	upx
behavioral1/files/0x0007000000016d42-48.dat	upx
behavioral1/files/0x0006000000018683-55.dat	upx
behavioral1/files/0x00050000000186e4-59.dat	upx
behavioral1/files/0x0005000000018728-75.dat	upx
behavioral1/files/0x0005000000018784-83.dat	upx
behavioral1/files/0x0006000000019023-95.dat	upx
behavioral1/files/0x0005000000019261-103.dat	upx
behavioral1/files/0x000500000001944f-147.dat	upx
behavioral1/files/0x0005000000019441-143.dat	upx
behavioral1/files/0x0005000000019431-139.dat	upx
behavioral1/files/0x0005000000019427-135.dat	upx
behavioral1/files/0x000500000001941e-131.dat	upx
behavioral1/files/0x00050000000193e1-127.dat	upx
behavioral1/files/0x00050000000193c2-123.dat	upx
behavioral1/files/0x00050000000193b4-119.dat	upx
behavioral1/files/0x0005000000019350-115.dat	upx
behavioral1/files/0x0005000000019334-111.dat	upx
behavioral1/files/0x0005000000019282-107.dat	upx
behavioral1/files/0x000500000001925e-99.dat	upx
behavioral1/files/0x00050000000187a5-91.dat	upx
behavioral1/files/0x000500000001878f-87.dat	upx
behavioral1/files/0x000500000001873d-79.dat	upx
behavioral1/files/0x00050000000186fd-71.dat	upx
behavioral1/files/0x00050000000186ee-67.dat	upx
behavioral1/files/0x00050000000186ea-63.dat	upx
behavioral1/files/0x0008000000016d5e-52.dat	upx
behavioral1/files/0x0008000000016d31-40.dat	upx
behavioral1/memory/1952-663-0x000000013FC50000-0x0000000140042000-memory.dmp	upx
behavioral1/memory/2500-660-0x000000013FE30000-0x0000000140222000-memory.dmp	upx
behavioral1/memory/1868-658-0x000000013F390000-0x000000013F782000-memory.dmp	upx
behavioral1/memory/1916-656-0x000000013FD60000-0x0000000140152000-memory.dmp	upx
behavioral1/memory/556-652-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	upx
behavioral1/memory/1572-648-0x000000013FFC0000-0x00000001403B2000-memory.dmp	upx
behavioral1/memory/1136-643-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	upx
behavioral1/memory/792-639-0x000000013F730000-0x000000013FB22000-memory.dmp	upx
behavioral1/memory/536-634-0x000000013F050000-0x000000013F442000-memory.dmp	upx
behavioral1/memory/2728-1953-0x000000013F250000-0x000000013F642000-memory.dmp	upx
behavioral1/memory/2052-3941-0x000000013F730000-0x000000013FB22000-memory.dmp	upx
behavioral1/memory/2692-3948-0x000000013FF90000-0x0000000140382000-memory.dmp	upx
behavioral1/memory/2524-3937-0x000000013F4A0000-0x000000013F892000-memory.dmp	upx
behavioral1/memory/1916-5096-0x000000013FD60000-0x0000000140152000-memory.dmp	upx
behavioral1/memory/1572-5092-0x000000013FFC0000-0x00000001403B2000-memory.dmp	upx
behavioral1/memory/792-5090-0x000000013F730000-0x000000013FB22000-memory.dmp	upx
behavioral1/memory/556-5112-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	upx
behavioral1/memory/1868-5107-0x000000013F390000-0x000000013F782000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\yXxrTST.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\aQQpwcv.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\yOrvEug.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\JqMLJGB.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\KArXTcZ.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\OxlgyFZ.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\tSULmIY.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\HaMynmX.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\pvhEMiq.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\JNXgiDL.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\PMQvneM.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\saMCNBa.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\JKojjlh.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\JtNPdsI.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\aUJeGPZ.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\jBSWkjN.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\ByxNsbZ.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\WRVZjBE.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\dlfaWfv.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\DbRUNRI.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\pyMswtH.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\PmboUol.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\HuXhZIZ.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\ARsehSj.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\tmzVziU.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\VFpTZEJ.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\qIsXVvA.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\FmALHTF.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\umKvPpW.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\cCKtZsa.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\lfYVgvm.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\oDUQncL.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\WPtVeMV.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\tPxCFcc.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\iwMwLRj.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\CenLwdA.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\vvdSJBp.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\emHSpKS.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\ghXPoid.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\BAEWFnY.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\FApYFne.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\GcNpEYE.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\nUOPilm.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\omDjEqt.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\cXSjhPr.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\cUKRbTV.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\MBGPzwt.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\ujaLRmx.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\XgWIamK.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\arwUZnR.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\uefXZWB.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\IROjoFL.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\cBRJFea.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\VycgioY.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\mawwham.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\iOdEoYJ.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\wpLOGau.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\QfJGJrF.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\bDmPrGd.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\CCAfHbp.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\idTUvMR.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\OHqgIhS.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\Fzfkuhl.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
File created	C:\Windows\System\mzqyvuR.exe	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2840	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
Token: SeLockMemoryPrivilege	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
Token: SeDebugPrivilege	2840	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 2840	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	31
PID 2728 wrote to memory of 2840	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	31
PID 2728 wrote to memory of 2840	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	31
PID 2728 wrote to memory of 2052	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	32
PID 2728 wrote to memory of 2052	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	32
PID 2728 wrote to memory of 2052	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	32
PID 2728 wrote to memory of 2692	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	33
PID 2728 wrote to memory of 2692	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	33
PID 2728 wrote to memory of 2692	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	33
PID 2728 wrote to memory of 2524	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	34
PID 2728 wrote to memory of 2524	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	34
PID 2728 wrote to memory of 2524	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	34
PID 2728 wrote to memory of 1952	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	35
PID 2728 wrote to memory of 1952	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	35
PID 2728 wrote to memory of 1952	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	35
PID 2728 wrote to memory of 536	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	36
PID 2728 wrote to memory of 536	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	36
PID 2728 wrote to memory of 536	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	36
PID 2728 wrote to memory of 792	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	37
PID 2728 wrote to memory of 792	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	37
PID 2728 wrote to memory of 792	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	37
PID 2728 wrote to memory of 1136	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	38
PID 2728 wrote to memory of 1136	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	38
PID 2728 wrote to memory of 1136	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	38
PID 2728 wrote to memory of 1572	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	39
PID 2728 wrote to memory of 1572	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	39
PID 2728 wrote to memory of 1572	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	39
PID 2728 wrote to memory of 556	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	40
PID 2728 wrote to memory of 556	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	40
PID 2728 wrote to memory of 556	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	40
PID 2728 wrote to memory of 1916	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	41
PID 2728 wrote to memory of 1916	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	41
PID 2728 wrote to memory of 1916	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	41
PID 2728 wrote to memory of 1868	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	42
PID 2728 wrote to memory of 1868	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	42
PID 2728 wrote to memory of 1868	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	42
PID 2728 wrote to memory of 2500	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	43
PID 2728 wrote to memory of 2500	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	43
PID 2728 wrote to memory of 2500	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	43
PID 2728 wrote to memory of 2088	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	44
PID 2728 wrote to memory of 2088	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	44
PID 2728 wrote to memory of 2088	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	44
PID 2728 wrote to memory of 2792	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	45
PID 2728 wrote to memory of 2792	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	45
PID 2728 wrote to memory of 2792	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	45
PID 2728 wrote to memory of 1696	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	46
PID 2728 wrote to memory of 1696	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	46
PID 2728 wrote to memory of 1696	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	46
PID 2728 wrote to memory of 2592	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	47
PID 2728 wrote to memory of 2592	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	47
PID 2728 wrote to memory of 2592	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	47
PID 2728 wrote to memory of 2620	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	48
PID 2728 wrote to memory of 2620	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	48
PID 2728 wrote to memory of 2620	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	48
PID 2728 wrote to memory of 3044	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	49
PID 2728 wrote to memory of 3044	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	49
PID 2728 wrote to memory of 3044	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	49
PID 2728 wrote to memory of 1380	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	50
PID 2728 wrote to memory of 1380	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	50
PID 2728 wrote to memory of 1380	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	50
PID 2728 wrote to memory of 1192	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	51
PID 2728 wrote to memory of 1192	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	51
PID 2728 wrote to memory of 1192	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	51
PID 2728 wrote to memory of 1384	2728	b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe	52

C:\Users\Admin\AppData\Local\Temp\b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe
"C:\Users\Admin\AppData\Local\Temp\b879a0d3b5a9a0d564f5eeaa1923e96ea174e4a940de0e7e1fb19f93b6b109a5N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2840
- C:\Windows\System\dpXCpNX.exe
  C:\Windows\System\dpXCpNX.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\lBYJKbz.exe
  C:\Windows\System\lBYJKbz.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\aaDpPJq.exe
  C:\Windows\System\aaDpPJq.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\ZNOeSJm.exe
  C:\Windows\System\ZNOeSJm.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\CGmKKbP.exe
  C:\Windows\System\CGmKKbP.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\DLrQCkX.exe
  C:\Windows\System\DLrQCkX.exe
  2⤵
  - Executes dropped EXE
  PID:792
- C:\Windows\System\hGUgKDF.exe
  C:\Windows\System\hGUgKDF.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\tAspJix.exe
  C:\Windows\System\tAspJix.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\FIBcVhV.exe
  C:\Windows\System\FIBcVhV.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\rUShrLW.exe
  C:\Windows\System\rUShrLW.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\hrHwOUp.exe
  C:\Windows\System\hrHwOUp.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\hviOfRS.exe
  C:\Windows\System\hviOfRS.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\IPHyvtp.exe
  C:\Windows\System\IPHyvtp.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\GXoqngA.exe
  C:\Windows\System\GXoqngA.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\ygqWEJb.exe
  C:\Windows\System\ygqWEJb.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\crYHvHh.exe
  C:\Windows\System\crYHvHh.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\SCAQqPL.exe
  C:\Windows\System\SCAQqPL.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\CBEdIMZ.exe
  C:\Windows\System\CBEdIMZ.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\KAnfwdW.exe
  C:\Windows\System\KAnfwdW.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\xwnUeQS.exe
  C:\Windows\System\xwnUeQS.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\tHYHfRX.exe
  C:\Windows\System\tHYHfRX.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\DhhvDWy.exe
  C:\Windows\System\DhhvDWy.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\wceKAQt.exe
  C:\Windows\System\wceKAQt.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\fRIafeN.exe
  C:\Windows\System\fRIafeN.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\WRvpdzC.exe
  C:\Windows\System\WRvpdzC.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\TLzoErw.exe
  C:\Windows\System\TLzoErw.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\qlsCLmq.exe
  C:\Windows\System\qlsCLmq.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\ucxXIYz.exe
  C:\Windows\System\ucxXIYz.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\JWrKDUy.exe
  C:\Windows\System\JWrKDUy.exe
  2⤵
  - Executes dropped EXE
  PID:608
- C:\Windows\System\PeNOhKQ.exe
  C:\Windows\System\PeNOhKQ.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\qYrMBHo.exe
  C:\Windows\System\qYrMBHo.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\DYREkVa.exe
  C:\Windows\System\DYREkVa.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\CeFXOVM.exe
  C:\Windows\System\CeFXOVM.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\iQgsezv.exe
  C:\Windows\System\iQgsezv.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\DkvkMnl.exe
  C:\Windows\System\DkvkMnl.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\UIxTIGa.exe
  C:\Windows\System\UIxTIGa.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\UEKcsvA.exe
  C:\Windows\System\UEKcsvA.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\RkmXfTW.exe
  C:\Windows\System\RkmXfTW.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\FheqoVo.exe
  C:\Windows\System\FheqoVo.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\tejGqon.exe
  C:\Windows\System\tejGqon.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\lTiXvfb.exe
  C:\Windows\System\lTiXvfb.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\BbvjcRj.exe
  C:\Windows\System\BbvjcRj.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\LwuVdGH.exe
  C:\Windows\System\LwuVdGH.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\oqCROVJ.exe
  C:\Windows\System\oqCROVJ.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\aVsfZGo.exe
  C:\Windows\System\aVsfZGo.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\HtkBtVX.exe
  C:\Windows\System\HtkBtVX.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\QgUVsqV.exe
  C:\Windows\System\QgUVsqV.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\yFLTzqf.exe
  C:\Windows\System\yFLTzqf.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\hGUvJhX.exe
  C:\Windows\System\hGUvJhX.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\yxzGdvy.exe
  C:\Windows\System\yxzGdvy.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\GVXZXoC.exe
  C:\Windows\System\GVXZXoC.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\wMeIyvm.exe
  C:\Windows\System\wMeIyvm.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\xQXBijf.exe
  C:\Windows\System\xQXBijf.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\AyusXuw.exe
  C:\Windows\System\AyusXuw.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\QFuxnFs.exe
  C:\Windows\System\QFuxnFs.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\opCFhLT.exe
  C:\Windows\System\opCFhLT.exe
  2⤵
  - Executes dropped EXE
  PID:712
- C:\Windows\System\XMgiXna.exe
  C:\Windows\System\XMgiXna.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\CAWoQyw.exe
  C:\Windows\System\CAWoQyw.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\xQVyFFc.exe
  C:\Windows\System\xQVyFFc.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\bnmAEaI.exe
  C:\Windows\System\bnmAEaI.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\ltjdnZq.exe
  C:\Windows\System\ltjdnZq.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\vBQBlzL.exe
  C:\Windows\System\vBQBlzL.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\TXjILmF.exe
  C:\Windows\System\TXjILmF.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\vSrYdlA.exe
  C:\Windows\System\vSrYdlA.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\lfldYiN.exe
  C:\Windows\System\lfldYiN.exe
  2⤵
  PID:2664
- C:\Windows\System\hyQVBrZ.exe
  C:\Windows\System\hyQVBrZ.exe
  2⤵
  PID:2564
- C:\Windows\System\tTqYVdt.exe
  C:\Windows\System\tTqYVdt.exe
  2⤵
  PID:2548
- C:\Windows\System\iIRsOiZ.exe
  C:\Windows\System\iIRsOiZ.exe
  2⤵
  PID:1680
- C:\Windows\System\iWEvNLq.exe
  C:\Windows\System\iWEvNLq.exe
  2⤵
  PID:2572
- C:\Windows\System\JBDTeGo.exe
  C:\Windows\System\JBDTeGo.exe
  2⤵
  PID:3064
- C:\Windows\System\wUIDdlG.exe
  C:\Windows\System\wUIDdlG.exe
  2⤵
  PID:332
- C:\Windows\System\sWMflQA.exe
  C:\Windows\System\sWMflQA.exe
  2⤵
  PID:2240
- C:\Windows\System\FrhdvqB.exe
  C:\Windows\System\FrhdvqB.exe
  2⤵
  PID:1424
- C:\Windows\System\WQkjNQE.exe
  C:\Windows\System\WQkjNQE.exe
  2⤵
  PID:2076
- C:\Windows\System\KhUPKgj.exe
  C:\Windows\System\KhUPKgj.exe
  2⤵
  PID:1456
- C:\Windows\System\lQmIZEm.exe
  C:\Windows\System\lQmIZEm.exe
  2⤵
  PID:2884
- C:\Windows\System\VbRxLwW.exe
  C:\Windows\System\VbRxLwW.exe
  2⤵
  PID:1852
- C:\Windows\System\HWjFtIb.exe
  C:\Windows\System\HWjFtIb.exe
  2⤵
  PID:2276
- C:\Windows\System\bpdFvlQ.exe
  C:\Windows\System\bpdFvlQ.exe
  2⤵
  PID:3052
- C:\Windows\System\jNrOHuY.exe
  C:\Windows\System\jNrOHuY.exe
  2⤵
  PID:1932
- C:\Windows\System\iBIhfRt.exe
  C:\Windows\System\iBIhfRt.exe
  2⤵
  PID:1940
- C:\Windows\System\lbwDPyD.exe
  C:\Windows\System\lbwDPyD.exe
  2⤵
  PID:2264
- C:\Windows\System\tQNzcZG.exe
  C:\Windows\System\tQNzcZG.exe
  2⤵
  PID:2488
- C:\Windows\System\EJbiyNf.exe
  C:\Windows\System\EJbiyNf.exe
  2⤵
  PID:2392
- C:\Windows\System\iuqlGKz.exe
  C:\Windows\System\iuqlGKz.exe
  2⤵
  PID:1420
- C:\Windows\System\lQvUGNw.exe
  C:\Windows\System\lQvUGNw.exe
  2⤵
  PID:2400
- C:\Windows\System\TTBdWEX.exe
  C:\Windows\System\TTBdWEX.exe
  2⤵
  PID:1216
- C:\Windows\System\rZJecVH.exe
  C:\Windows\System\rZJecVH.exe
  2⤵
  PID:704
- C:\Windows\System\iKRcOiw.exe
  C:\Windows\System\iKRcOiw.exe
  2⤵
  PID:1692
- C:\Windows\System\xZvBLoC.exe
  C:\Windows\System\xZvBLoC.exe
  2⤵
  PID:1944
- C:\Windows\System\eNXAIFU.exe
  C:\Windows\System\eNXAIFU.exe
  2⤵
  PID:1276
- C:\Windows\System\rrwbGRt.exe
  C:\Windows\System\rrwbGRt.exe
  2⤵
  PID:1256
- C:\Windows\System\FWCIwcy.exe
  C:\Windows\System\FWCIwcy.exe
  2⤵
  PID:2360
- C:\Windows\System\JqnUCkA.exe
  C:\Windows\System\JqnUCkA.exe
  2⤵
  PID:784
- C:\Windows\System\Wpslnsl.exe
  C:\Windows\System\Wpslnsl.exe
  2⤵
  PID:1604
- C:\Windows\System\PawIcQQ.exe
  C:\Windows\System\PawIcQQ.exe
  2⤵
  PID:272
- C:\Windows\System\zHaQUaJ.exe
  C:\Windows\System\zHaQUaJ.exe
  2⤵
  PID:1876
- C:\Windows\System\FNADEhS.exe
  C:\Windows\System\FNADEhS.exe
  2⤵
  PID:2464
- C:\Windows\System\MGyORgI.exe
  C:\Windows\System\MGyORgI.exe
  2⤵
  PID:2184
- C:\Windows\System\TSnTKgz.exe
  C:\Windows\System\TSnTKgz.exe
  2⤵
  PID:896
- C:\Windows\System\gyJFFrp.exe
  C:\Windows\System\gyJFFrp.exe
  2⤵
  PID:2764
- C:\Windows\System\ZKoDRZi.exe
  C:\Windows\System\ZKoDRZi.exe
  2⤵
  PID:2968
- C:\Windows\System\woSVPVa.exe
  C:\Windows\System\woSVPVa.exe
  2⤵
  PID:2804
- C:\Windows\System\iEyqqTB.exe
  C:\Windows\System\iEyqqTB.exe
  2⤵
  PID:2528
- C:\Windows\System\gXtcBmf.exe
  C:\Windows\System\gXtcBmf.exe
  2⤵
  PID:2136
- C:\Windows\System\JGzuiSr.exe
  C:\Windows\System\JGzuiSr.exe
  2⤵
  PID:592
- C:\Windows\System\xdxRSVo.exe
  C:\Windows\System\xdxRSVo.exe
  2⤵
  PID:2568
- C:\Windows\System\IVGfBqe.exe
  C:\Windows\System\IVGfBqe.exe
  2⤵
  PID:2896
- C:\Windows\System\GVOBgqx.exe
  C:\Windows\System\GVOBgqx.exe
  2⤵
  PID:2876
- C:\Windows\System\fxYALMP.exe
  C:\Windows\System\fxYALMP.exe
  2⤵
  PID:1752
- C:\Windows\System\aYlRWWJ.exe
  C:\Windows\System\aYlRWWJ.exe
  2⤵
  PID:2340
- C:\Windows\System\JNkrYUc.exe
  C:\Windows\System\JNkrYUc.exe
  2⤵
  PID:2992
- C:\Windows\System\jsTyFbo.exe
  C:\Windows\System\jsTyFbo.exe
  2⤵
  PID:2256
- C:\Windows\System\HbjAETc.exe
  C:\Windows\System\HbjAETc.exe
  2⤵
  PID:444
- C:\Windows\System\bWEYXlG.exe
  C:\Windows\System\bWEYXlG.exe
  2⤵
  PID:3040
- C:\Windows\System\pEnElki.exe
  C:\Windows\System\pEnElki.exe
  2⤵
  PID:1324
- C:\Windows\System\aCJkmny.exe
  C:\Windows\System\aCJkmny.exe
  2⤵
  PID:948
- C:\Windows\System\PICawmS.exe
  C:\Windows\System\PICawmS.exe
  2⤵
  PID:972
- C:\Windows\System\bSZPKIv.exe
  C:\Windows\System\bSZPKIv.exe
  2⤵
  PID:2492
- C:\Windows\System\UdOYuMB.exe
  C:\Windows\System\UdOYuMB.exe
  2⤵
  PID:584
- C:\Windows\System\rWWKNoI.exe
  C:\Windows\System\rWWKNoI.exe
  2⤵
  PID:2432
- C:\Windows\System\xNfbUBs.exe
  C:\Windows\System\xNfbUBs.exe
  2⤵
  PID:3028
- C:\Windows\System\KXFpQew.exe
  C:\Windows\System\KXFpQew.exe
  2⤵
  PID:3016
- C:\Windows\System\fflkuhS.exe
  C:\Windows\System\fflkuhS.exe
  2⤵
  PID:2744
- C:\Windows\System\PyZRXfl.exe
  C:\Windows\System\PyZRXfl.exe
  2⤵
  PID:2404
- C:\Windows\System\AefnLIU.exe
  C:\Windows\System\AefnLIU.exe
  2⤵
  PID:2108
- C:\Windows\System\kEhnALS.exe
  C:\Windows\System\kEhnALS.exe
  2⤵
  PID:2704
- C:\Windows\System\bRoJeYw.exe
  C:\Windows\System\bRoJeYw.exe
  2⤵
  PID:1728
- C:\Windows\System\wXIkoPE.exe
  C:\Windows\System\wXIkoPE.exe
  2⤵
  PID:2092
- C:\Windows\System\KMHDfWE.exe
  C:\Windows\System\KMHDfWE.exe
  2⤵
  PID:1856
- C:\Windows\System\VloFKgV.exe
  C:\Windows\System\VloFKgV.exe
  2⤵
  PID:432
- C:\Windows\System\OBFrLZu.exe
  C:\Windows\System\OBFrLZu.exe
  2⤵
  PID:2164
- C:\Windows\System\vyklkjd.exe
  C:\Windows\System\vyklkjd.exe
  2⤵
  PID:1664
- C:\Windows\System\HHLJaEs.exe
  C:\Windows\System\HHLJaEs.exe
  2⤵
  PID:1904
- C:\Windows\System\WwYaxRZ.exe
  C:\Windows\System\WwYaxRZ.exe
  2⤵
  PID:2336
- C:\Windows\System\bNmlgwL.exe
  C:\Windows\System\bNmlgwL.exe
  2⤵
  PID:2244
- C:\Windows\System\cIQNOPO.exe
  C:\Windows\System\cIQNOPO.exe
  2⤵
  PID:3024
- C:\Windows\System\epRDxNG.exe
  C:\Windows\System\epRDxNG.exe
  2⤵
  PID:2584
- C:\Windows\System\pYHnReR.exe
  C:\Windows\System\pYHnReR.exe
  2⤵
  PID:2496
- C:\Windows\System\tASpdXU.exe
  C:\Windows\System\tASpdXU.exe
  2⤵
  PID:3080
- C:\Windows\System\cDmmaZy.exe
  C:\Windows\System\cDmmaZy.exe
  2⤵
  PID:3096
- C:\Windows\System\TYzYYpH.exe
  C:\Windows\System\TYzYYpH.exe
  2⤵
  PID:3112
- C:\Windows\System\acDEUqg.exe
  C:\Windows\System\acDEUqg.exe
  2⤵
  PID:3128
- C:\Windows\System\PTtaePw.exe
  C:\Windows\System\PTtaePw.exe
  2⤵
  PID:3144
- C:\Windows\System\BCBaaYx.exe
  C:\Windows\System\BCBaaYx.exe
  2⤵
  PID:3160
- C:\Windows\System\saEraWN.exe
  C:\Windows\System\saEraWN.exe
  2⤵
  PID:3176
- C:\Windows\System\RGFgIUX.exe
  C:\Windows\System\RGFgIUX.exe
  2⤵
  PID:3192
- C:\Windows\System\uJPwYKu.exe
  C:\Windows\System\uJPwYKu.exe
  2⤵
  PID:3208
- C:\Windows\System\IbFNUCA.exe
  C:\Windows\System\IbFNUCA.exe
  2⤵
  PID:3224
- C:\Windows\System\OmUsdZg.exe
  C:\Windows\System\OmUsdZg.exe
  2⤵
  PID:3240
- C:\Windows\System\iBcKNOg.exe
  C:\Windows\System\iBcKNOg.exe
  2⤵
  PID:3256
- C:\Windows\System\NhvXUjh.exe
  C:\Windows\System\NhvXUjh.exe
  2⤵
  PID:3272
- C:\Windows\System\GRDcgtf.exe
  C:\Windows\System\GRDcgtf.exe
  2⤵
  PID:3288
- C:\Windows\System\VEVMZTM.exe
  C:\Windows\System\VEVMZTM.exe
  2⤵
  PID:3304
- C:\Windows\System\QCoURdT.exe
  C:\Windows\System\QCoURdT.exe
  2⤵
  PID:3320
- C:\Windows\System\XkHXsOo.exe
  C:\Windows\System\XkHXsOo.exe
  2⤵
  PID:3336
- C:\Windows\System\lQfSsbd.exe
  C:\Windows\System\lQfSsbd.exe
  2⤵
  PID:3352
- C:\Windows\System\ORCiEff.exe
  C:\Windows\System\ORCiEff.exe
  2⤵
  PID:3368
- C:\Windows\System\KFwdyyV.exe
  C:\Windows\System\KFwdyyV.exe
  2⤵
  PID:3384
- C:\Windows\System\sQeqqyV.exe
  C:\Windows\System\sQeqqyV.exe
  2⤵
  PID:3400
- C:\Windows\System\IjbFngD.exe
  C:\Windows\System\IjbFngD.exe
  2⤵
  PID:3416
- C:\Windows\System\hXiUSRR.exe
  C:\Windows\System\hXiUSRR.exe
  2⤵
  PID:3432
- C:\Windows\System\HJOqStr.exe
  C:\Windows\System\HJOqStr.exe
  2⤵
  PID:3448
- C:\Windows\System\IfMfeSv.exe
  C:\Windows\System\IfMfeSv.exe
  2⤵
  PID:3464
- C:\Windows\System\NxKQBqK.exe
  C:\Windows\System\NxKQBqK.exe
  2⤵
  PID:3480
- C:\Windows\System\oreHhwV.exe
  C:\Windows\System\oreHhwV.exe
  2⤵
  PID:3496
- C:\Windows\System\muyXjnK.exe
  C:\Windows\System\muyXjnK.exe
  2⤵
  PID:3512
- C:\Windows\System\gcLEZUk.exe
  C:\Windows\System\gcLEZUk.exe
  2⤵
  PID:3528
- C:\Windows\System\feNUlZm.exe
  C:\Windows\System\feNUlZm.exe
  2⤵
  PID:3544
- C:\Windows\System\mhkKotc.exe
  C:\Windows\System\mhkKotc.exe
  2⤵
  PID:3560
- C:\Windows\System\QLROKqY.exe
  C:\Windows\System\QLROKqY.exe
  2⤵
  PID:3576
- C:\Windows\System\XSestLV.exe
  C:\Windows\System\XSestLV.exe
  2⤵
  PID:3592
- C:\Windows\System\rpGInVJ.exe
  C:\Windows\System\rpGInVJ.exe
  2⤵
  PID:3608
- C:\Windows\System\TXfSnrZ.exe
  C:\Windows\System\TXfSnrZ.exe
  2⤵
  PID:3624
- C:\Windows\System\HilKZfL.exe
  C:\Windows\System\HilKZfL.exe
  2⤵
  PID:3640
- C:\Windows\System\ShTokUq.exe
  C:\Windows\System\ShTokUq.exe
  2⤵
  PID:3656
- C:\Windows\System\QFmkubo.exe
  C:\Windows\System\QFmkubo.exe
  2⤵
  PID:3672
- C:\Windows\System\VOxHrIm.exe
  C:\Windows\System\VOxHrIm.exe
  2⤵
  PID:3688
- C:\Windows\System\SIYozJX.exe
  C:\Windows\System\SIYozJX.exe
  2⤵
  PID:3708
- C:\Windows\System\gkVEVKw.exe
  C:\Windows\System\gkVEVKw.exe
  2⤵
  PID:3724
- C:\Windows\System\hsigOiN.exe
  C:\Windows\System\hsigOiN.exe
  2⤵
  PID:3740
- C:\Windows\System\ypmYpal.exe
  C:\Windows\System\ypmYpal.exe
  2⤵
  PID:3756
- C:\Windows\System\BNIQqwN.exe
  C:\Windows\System\BNIQqwN.exe
  2⤵
  PID:3772
- C:\Windows\System\IFkAJDv.exe
  C:\Windows\System\IFkAJDv.exe
  2⤵
  PID:3788
- C:\Windows\System\TTFBYNg.exe
  C:\Windows\System\TTFBYNg.exe
  2⤵
  PID:3804
- C:\Windows\System\VjifkAx.exe
  C:\Windows\System\VjifkAx.exe
  2⤵
  PID:3820
- C:\Windows\System\UffuqOE.exe
  C:\Windows\System\UffuqOE.exe
  2⤵
  PID:3836
- C:\Windows\System\baEQhYj.exe
  C:\Windows\System\baEQhYj.exe
  2⤵
  PID:3852
- C:\Windows\System\aTKLKPp.exe
  C:\Windows\System\aTKLKPp.exe
  2⤵
  PID:3868
- C:\Windows\System\pGRtWio.exe
  C:\Windows\System\pGRtWio.exe
  2⤵
  PID:3884
- C:\Windows\System\SHMphVU.exe
  C:\Windows\System\SHMphVU.exe
  2⤵
  PID:3900
- C:\Windows\System\tKOPGhA.exe
  C:\Windows\System\tKOPGhA.exe
  2⤵
  PID:3916
- C:\Windows\System\HqiHydS.exe
  C:\Windows\System\HqiHydS.exe
  2⤵
  PID:3932
- C:\Windows\System\NSkStkD.exe
  C:\Windows\System\NSkStkD.exe
  2⤵
  PID:3948
- C:\Windows\System\mUMkmyg.exe
  C:\Windows\System\mUMkmyg.exe
  2⤵
  PID:3964
- C:\Windows\System\VRlohII.exe
  C:\Windows\System\VRlohII.exe
  2⤵
  PID:3980
- C:\Windows\System\tDTodgM.exe
  C:\Windows\System\tDTodgM.exe
  2⤵
  PID:3996
- C:\Windows\System\PSaHBzG.exe
  C:\Windows\System\PSaHBzG.exe
  2⤵
  PID:4012
- C:\Windows\System\zrANmAm.exe
  C:\Windows\System\zrANmAm.exe
  2⤵
  PID:4028
- C:\Windows\System\chemffG.exe
  C:\Windows\System\chemffG.exe
  2⤵
  PID:4044
- C:\Windows\System\apLtWwu.exe
  C:\Windows\System\apLtWwu.exe
  2⤵
  PID:4060
- C:\Windows\System\HDgIkMI.exe
  C:\Windows\System\HDgIkMI.exe
  2⤵
  PID:4076
- C:\Windows\System\cUhVrWf.exe
  C:\Windows\System\cUhVrWf.exe
  2⤵
  PID:4092
- C:\Windows\System\rKGaVHx.exe
  C:\Windows\System\rKGaVHx.exe
  2⤵
  PID:2068
- C:\Windows\System\fDNwgtf.exe
  C:\Windows\System\fDNwgtf.exe
  2⤵
  PID:1716
- C:\Windows\System\SLqGUbm.exe
  C:\Windows\System\SLqGUbm.exe
  2⤵
  PID:1676
- C:\Windows\System\xqKSWTN.exe
  C:\Windows\System\xqKSWTN.exe
  2⤵
  PID:328
- C:\Windows\System\ohFYATn.exe
  C:\Windows\System\ohFYATn.exe
  2⤵
  PID:2084
- C:\Windows\System\DmuiOnb.exe
  C:\Windows\System\DmuiOnb.exe
  2⤵
  PID:3076
- C:\Windows\System\BNRxFRb.exe
  C:\Windows\System\BNRxFRb.exe
  2⤵
  PID:3088
- C:\Windows\System\PEIPrhL.exe
  C:\Windows\System\PEIPrhL.exe
  2⤵
  PID:4660
- C:\Windows\System\LgTiaYY.exe
  C:\Windows\System\LgTiaYY.exe
  2⤵
  PID:4716
- C:\Windows\System\EzDipAJ.exe
  C:\Windows\System\EzDipAJ.exe
  2⤵
  PID:4732
- C:\Windows\System\CamzJhD.exe
  C:\Windows\System\CamzJhD.exe
  2⤵
  PID:4748
- C:\Windows\System\oqrUxff.exe
  C:\Windows\System\oqrUxff.exe
  2⤵
  PID:4764
- C:\Windows\System\wKwiCkz.exe
  C:\Windows\System\wKwiCkz.exe
  2⤵
  PID:4780
- C:\Windows\System\VDiXgdU.exe
  C:\Windows\System\VDiXgdU.exe
  2⤵
  PID:4796
- C:\Windows\System\BUyVaYm.exe
  C:\Windows\System\BUyVaYm.exe
  2⤵
  PID:4812
- C:\Windows\System\jwfCMhZ.exe
  C:\Windows\System\jwfCMhZ.exe
  2⤵
  PID:4828
- C:\Windows\System\KxfHwUG.exe
  C:\Windows\System\KxfHwUG.exe
  2⤵
  PID:4844
- C:\Windows\System\XtWDTBx.exe
  C:\Windows\System\XtWDTBx.exe
  2⤵
  PID:4860
- C:\Windows\System\qLlMHrH.exe
  C:\Windows\System\qLlMHrH.exe
  2⤵
  PID:4876
- C:\Windows\System\IoNNeUn.exe
  C:\Windows\System\IoNNeUn.exe
  2⤵
  PID:4892
- C:\Windows\System\mTFFgXP.exe
  C:\Windows\System\mTFFgXP.exe
  2⤵
  PID:4908
- C:\Windows\System\EmDpuXk.exe
  C:\Windows\System\EmDpuXk.exe
  2⤵
  PID:4924
- C:\Windows\System\GNpGzcE.exe
  C:\Windows\System\GNpGzcE.exe
  2⤵
  PID:4940
- C:\Windows\System\HUJjucD.exe
  C:\Windows\System\HUJjucD.exe
  2⤵
  PID:4956
- C:\Windows\System\hemPGtt.exe
  C:\Windows\System\hemPGtt.exe
  2⤵
  PID:4972
- C:\Windows\System\QMqhEXP.exe
  C:\Windows\System\QMqhEXP.exe
  2⤵
  PID:4988
- C:\Windows\System\GeAnyXq.exe
  C:\Windows\System\GeAnyXq.exe
  2⤵
  PID:5004
- C:\Windows\System\OGiCVJB.exe
  C:\Windows\System\OGiCVJB.exe
  2⤵
  PID:5020
- C:\Windows\System\fwvLasX.exe
  C:\Windows\System\fwvLasX.exe
  2⤵
  PID:5036
- C:\Windows\System\cMoEqJv.exe
  C:\Windows\System\cMoEqJv.exe
  2⤵
  PID:5052
- C:\Windows\System\Mxksdss.exe
  C:\Windows\System\Mxksdss.exe
  2⤵
  PID:5068
- C:\Windows\System\sVzFCis.exe
  C:\Windows\System\sVzFCis.exe
  2⤵
  PID:5084
- C:\Windows\System\lCeFqBn.exe
  C:\Windows\System\lCeFqBn.exe
  2⤵
  PID:5100
- C:\Windows\System\VeMtBOi.exe
  C:\Windows\System\VeMtBOi.exe
  2⤵
  PID:5116
- C:\Windows\System\ywHVbPQ.exe
  C:\Windows\System\ywHVbPQ.exe
  2⤵
  PID:2936
- C:\Windows\System\gYuiiRU.exe
  C:\Windows\System\gYuiiRU.exe
  2⤵
  PID:1724
- C:\Windows\System\HqUiswM.exe
  C:\Windows\System\HqUiswM.exe
  2⤵
  PID:768
- C:\Windows\System\DcUKpqd.exe
  C:\Windows\System\DcUKpqd.exe
  2⤵
  PID:3264
- C:\Windows\System\oKqXoZw.exe
  C:\Windows\System\oKqXoZw.exe
  2⤵
  PID:3684
- C:\Windows\System\uOVeWQL.exe
  C:\Windows\System\uOVeWQL.exe
  2⤵
  PID:1012
- C:\Windows\System\TNXTakJ.exe
  C:\Windows\System\TNXTakJ.exe
  2⤵
  PID:3268
- C:\Windows\System\ZkdCJwo.exe
  C:\Windows\System\ZkdCJwo.exe
  2⤵
  PID:3332
- C:\Windows\System\cpKWkqO.exe
  C:\Windows\System\cpKWkqO.exe
  2⤵
  PID:3424
- C:\Windows\System\HTHROgJ.exe
  C:\Windows\System\HTHROgJ.exe
  2⤵
  PID:3488
- C:\Windows\System\dqohcxV.exe
  C:\Windows\System\dqohcxV.exe
  2⤵
  PID:3552
- C:\Windows\System\ZqbwsTz.exe
  C:\Windows\System\ZqbwsTz.exe
  2⤵
  PID:3620
- C:\Windows\System\OJfIndd.exe
  C:\Windows\System\OJfIndd.exe
  2⤵
  PID:3720
- C:\Windows\System\MLncTxp.exe
  C:\Windows\System\MLncTxp.exe
  2⤵
  PID:3816
- C:\Windows\System\mMnQyQi.exe
  C:\Windows\System\mMnQyQi.exe
  2⤵
  PID:3880
- C:\Windows\System\PhEKJOB.exe
  C:\Windows\System\PhEKJOB.exe
  2⤵
  PID:3972
- C:\Windows\System\QNAmZkh.exe
  C:\Windows\System\QNAmZkh.exe
  2⤵
  PID:4040
- C:\Windows\System\mhnnUDB.exe
  C:\Windows\System\mhnnUDB.exe
  2⤵
  PID:1736
- C:\Windows\System\MHTThtL.exe
  C:\Windows\System\MHTThtL.exe
  2⤵
  PID:596
- C:\Windows\System\gQhpcYi.exe
  C:\Windows\System\gQhpcYi.exe
  2⤵
  PID:3348
- C:\Windows\System\MBbrFcv.exe
  C:\Windows\System\MBbrFcv.exe
  2⤵
  PID:3444
- C:\Windows\System\tcacieY.exe
  C:\Windows\System\tcacieY.exe
  2⤵
  PID:3568
- C:\Windows\System\sPZCNrJ.exe
  C:\Windows\System\sPZCNrJ.exe
  2⤵
  PID:3668
- C:\Windows\System\sMfmuFb.exe
  C:\Windows\System\sMfmuFb.exe
  2⤵
  PID:3796
- C:\Windows\System\jRzAsjW.exe
  C:\Windows\System\jRzAsjW.exe
  2⤵
  PID:3860
- C:\Windows\System\rYEHYli.exe
  C:\Windows\System\rYEHYli.exe
  2⤵
  PID:3924
- C:\Windows\System\FFZYwdN.exe
  C:\Windows\System\FFZYwdN.exe
  2⤵
  PID:3988
- C:\Windows\System\vgntQWo.exe
  C:\Windows\System\vgntQWo.exe
  2⤵
  PID:4052
- C:\Windows\System\KVdjzKH.exe
  C:\Windows\System\KVdjzKH.exe
  2⤵
  PID:1252
- C:\Windows\System\VAIlEuO.exe
  C:\Windows\System\VAIlEuO.exe
  2⤵
  PID:2648
- C:\Windows\System\cYOrzXn.exe
  C:\Windows\System\cYOrzXn.exe
  2⤵
  PID:716
- C:\Windows\System\DMynZMo.exe
  C:\Windows\System\DMynZMo.exe
  2⤵
  PID:3136
- C:\Windows\System\hieZNdD.exe
  C:\Windows\System\hieZNdD.exe
  2⤵
  PID:3168
- C:\Windows\System\rrhoZgY.exe
  C:\Windows\System\rrhoZgY.exe
  2⤵
  PID:3200
- C:\Windows\System\qcbnxun.exe
  C:\Windows\System\qcbnxun.exe
  2⤵
  PID:3216
- C:\Windows\System\MkWazvA.exe
  C:\Windows\System\MkWazvA.exe
  2⤵
  PID:3248
- C:\Windows\System\bhcdePR.exe
  C:\Windows\System\bhcdePR.exe
  2⤵
  PID:4100
- C:\Windows\System\ZOUsqZE.exe
  C:\Windows\System\ZOUsqZE.exe
  2⤵
  PID:4116
- C:\Windows\System\LhHrujf.exe
  C:\Windows\System\LhHrujf.exe
  2⤵
  PID:4132
- C:\Windows\System\QBLQaia.exe
  C:\Windows\System\QBLQaia.exe
  2⤵
  PID:4148
- C:\Windows\System\OuMbLmX.exe
  C:\Windows\System\OuMbLmX.exe
  2⤵
  PID:4164
- C:\Windows\System\BhyRyGA.exe
  C:\Windows\System\BhyRyGA.exe
  2⤵
  PID:4180
- C:\Windows\System\MLPKtHV.exe
  C:\Windows\System\MLPKtHV.exe
  2⤵
  PID:4196
- C:\Windows\System\HscBxJA.exe
  C:\Windows\System\HscBxJA.exe
  2⤵
  PID:4212
- C:\Windows\System\DUgAeJF.exe
  C:\Windows\System\DUgAeJF.exe
  2⤵
  PID:4228
- C:\Windows\System\bPAtXfr.exe
  C:\Windows\System\bPAtXfr.exe
  2⤵
  PID:1860
- C:\Windows\System\NfefRmu.exe
  C:\Windows\System\NfefRmu.exe
  2⤵
  PID:4232
- C:\Windows\System\uEgRpRh.exe
  C:\Windows\System\uEgRpRh.exe
  2⤵
  PID:4248
- C:\Windows\System\lfYVgvm.exe
  C:\Windows\System\lfYVgvm.exe
  2⤵
  PID:4264
- C:\Windows\System\eFupHrj.exe
  C:\Windows\System\eFupHrj.exe
  2⤵
  PID:4280
- C:\Windows\System\eaPeZSl.exe
  C:\Windows\System\eaPeZSl.exe
  2⤵
  PID:4296
- C:\Windows\System\PPYxMqL.exe
  C:\Windows\System\PPYxMqL.exe
  2⤵
  PID:4312
- C:\Windows\System\ENrqzNX.exe
  C:\Windows\System\ENrqzNX.exe
  2⤵
  PID:4328
- C:\Windows\System\AoWXdBz.exe
  C:\Windows\System\AoWXdBz.exe
  2⤵
  PID:4344
- C:\Windows\System\hgIKAZF.exe
  C:\Windows\System\hgIKAZF.exe
  2⤵
  PID:4360
- C:\Windows\System\MznrjPU.exe
  C:\Windows\System\MznrjPU.exe
  2⤵
  PID:4376
- C:\Windows\System\PkyGvXd.exe
  C:\Windows\System\PkyGvXd.exe
  2⤵
  PID:4392
- C:\Windows\System\KleMTwR.exe
  C:\Windows\System\KleMTwR.exe
  2⤵
  PID:4408
- C:\Windows\System\jZYQHXi.exe
  C:\Windows\System\jZYQHXi.exe
  2⤵
  PID:4424
- C:\Windows\System\VowfIBS.exe
  C:\Windows\System\VowfIBS.exe
  2⤵
  PID:4440
- C:\Windows\System\fWaIyJc.exe
  C:\Windows\System\fWaIyJc.exe
  2⤵
  PID:4460
- C:\Windows\System\SrkOlhF.exe
  C:\Windows\System\SrkOlhF.exe
  2⤵
  PID:4476
- C:\Windows\System\WAutMIe.exe
  C:\Windows\System\WAutMIe.exe
  2⤵
  PID:4492
- C:\Windows\System\MHwfaCj.exe
  C:\Windows\System\MHwfaCj.exe
  2⤵
  PID:4508
- C:\Windows\System\bcPPFkT.exe
  C:\Windows\System\bcPPFkT.exe
  2⤵
  PID:3476
- C:\Windows\System\zkTdHze.exe
  C:\Windows\System\zkTdHze.exe
  2⤵
  PID:2972
- C:\Windows\System\CUXfGmC.exe
  C:\Windows\System\CUXfGmC.exe
  2⤵
  PID:4728
- C:\Windows\System\KKLwMXM.exe
  C:\Windows\System\KKLwMXM.exe
  2⤵
  PID:4840
- C:\Windows\System\RWMhRQy.exe
  C:\Windows\System\RWMhRQy.exe
  2⤵
  PID:4968
- C:\Windows\System\klVOTNA.exe
  C:\Windows\System\klVOTNA.exe
  2⤵
  PID:5032
- C:\Windows\System\oulWQzD.exe
  C:\Windows\System\oulWQzD.exe
  2⤵
  PID:5108
- C:\Windows\System\VjWZHxP.exe
  C:\Windows\System\VjWZHxP.exe
  2⤵
  PID:3312
- C:\Windows\System\JsSvQUO.exe
  C:\Windows\System\JsSvQUO.exe
  2⤵
  PID:2428
- C:\Windows\System\IPKKgdv.exe
  C:\Windows\System\IPKKgdv.exe
  2⤵
  PID:3908
- C:\Windows\System\sAqZVtz.exe
  C:\Windows\System\sAqZVtz.exe
  2⤵
  PID:3364
- C:\Windows\System\bEWiRiD.exe
  C:\Windows\System\bEWiRiD.exe
  2⤵
  PID:3520
- C:\Windows\System\YTvXZMW.exe
  C:\Windows\System\YTvXZMW.exe
  2⤵
  PID:3652
- C:\Windows\System\pEtQcWN.exe
  C:\Windows\System\pEtQcWN.exe
  2⤵
  PID:3960
- C:\Windows\System\bALTPRD.exe
  C:\Windows\System\bALTPRD.exe
  2⤵
  PID:3184
- C:\Windows\System\QEBnPTx.exe
  C:\Windows\System\QEBnPTx.exe
  2⤵
  PID:3236
- C:\Windows\System\PTHXCWN.exe
  C:\Windows\System\PTHXCWN.exe
  2⤵
  PID:4112
- C:\Windows\System\tRSovPs.exe
  C:\Windows\System\tRSovPs.exe
  2⤵
  PID:4160
- C:\Windows\System\kghpTPj.exe
  C:\Windows\System\kghpTPj.exe
  2⤵
  PID:4220
- C:\Windows\System\VRAiwIM.exe
  C:\Windows\System\VRAiwIM.exe
  2⤵
  PID:2552
- C:\Windows\System\hgHeBLa.exe
  C:\Windows\System\hgHeBLa.exe
  2⤵
  PID:4240
- C:\Windows\System\QUiuExw.exe
  C:\Windows\System\QUiuExw.exe
  2⤵
  PID:4272
- C:\Windows\System\hQFrtrA.exe
  C:\Windows\System\hQFrtrA.exe
  2⤵
  PID:4304
- C:\Windows\System\omKoWgG.exe
  C:\Windows\System\omKoWgG.exe
  2⤵
  PID:4336
- C:\Windows\System\OWfJwMA.exe
  C:\Windows\System\OWfJwMA.exe
  2⤵
  PID:4368
- C:\Windows\System\nosYHWL.exe
  C:\Windows\System\nosYHWL.exe
  2⤵
  PID:4400
- C:\Windows\System\seZMshI.exe
  C:\Windows\System\seZMshI.exe
  2⤵
  PID:4420
- C:\Windows\System\jBnwShI.exe
  C:\Windows\System\jBnwShI.exe
  2⤵
  PID:4472
- C:\Windows\System\BgocZuV.exe
  C:\Windows\System\BgocZuV.exe
  2⤵
  PID:3380
- C:\Windows\System\rxufsow.exe
  C:\Windows\System\rxufsow.exe
  2⤵
  PID:2696
- C:\Windows\System\pfOPWkQ.exe
  C:\Windows\System\pfOPWkQ.exe
  2⤵
  PID:1072
- C:\Windows\System\lihRShZ.exe
  C:\Windows\System\lihRShZ.exe
  2⤵
  PID:2908
- C:\Windows\System\KXaObgO.exe
  C:\Windows\System\KXaObgO.exe
  2⤵
  PID:4556
- C:\Windows\System\wKAmxLC.exe
  C:\Windows\System\wKAmxLC.exe
  2⤵
  PID:4712
- C:\Windows\System\ZQjoBXD.exe
  C:\Windows\System\ZQjoBXD.exe
  2⤵
  PID:4900
- C:\Windows\System\VRzFNgG.exe
  C:\Windows\System\VRzFNgG.exe
  2⤵
  PID:4760
- C:\Windows\System\iqCuCjv.exe
  C:\Windows\System\iqCuCjv.exe
  2⤵
  PID:4820
- C:\Windows\System\VyPmLrh.exe
  C:\Windows\System\VyPmLrh.exe
  2⤵
  PID:3944
- C:\Windows\System\eBvcemN.exe
  C:\Windows\System\eBvcemN.exe
  2⤵
  PID:4628
- C:\Windows\System\lLppVlM.exe
  C:\Windows\System\lLppVlM.exe
  2⤵
  PID:3956
- C:\Windows\System\tzXiJIO.exe
  C:\Windows\System\tzXiJIO.exe
  2⤵
  PID:4128
- C:\Windows\System\KjFqlFr.exe
  C:\Windows\System\KjFqlFr.exe
  2⤵
  PID:4156
- C:\Windows\System\xtccmxT.exe
  C:\Windows\System\xtccmxT.exe
  2⤵
  PID:4548
- C:\Windows\System\YnrHOGV.exe
  C:\Windows\System\YnrHOGV.exe
  2⤵
  PID:4384
- C:\Windows\System\WZMcGIQ.exe
  C:\Windows\System\WZMcGIQ.exe
  2⤵
  PID:4292
- C:\Windows\System\QyLmVfi.exe
  C:\Windows\System\QyLmVfi.exe
  2⤵
  PID:4452
- C:\Windows\System\uNpSzJA.exe
  C:\Windows\System\uNpSzJA.exe
  2⤵
  PID:4504
- C:\Windows\System\xLvdiwZ.exe
  C:\Windows\System\xLvdiwZ.exe
  2⤵
  PID:4964
- C:\Windows\System\zWzJJga.exe
  C:\Windows\System\zWzJJga.exe
  2⤵
  PID:4904
- C:\Windows\System\HJfZZuB.exe
  C:\Windows\System\HJfZZuB.exe
  2⤵
  PID:4980
- C:\Windows\System\uGqpQEH.exe
  C:\Windows\System\uGqpQEH.exe
  2⤵
  PID:5080
- C:\Windows\System\mjpoiKM.exe
  C:\Windows\System\mjpoiKM.exe
  2⤵
  PID:4588
- C:\Windows\System\XwvnmRf.exe
  C:\Windows\System\XwvnmRf.exe
  2⤵
  PID:3812
- C:\Windows\System\uAyHnNb.exe
  C:\Windows\System\uAyHnNb.exe
  2⤵
  PID:4824
- C:\Windows\System\AYTJvqv.exe
  C:\Windows\System\AYTJvqv.exe
  2⤵
  PID:3588
- C:\Windows\System\UwzPEtW.exe
  C:\Windows\System\UwzPEtW.exe
  2⤵
  PID:4772
- C:\Windows\System\jAgBmMX.exe
  C:\Windows\System\jAgBmMX.exe
  2⤵
  PID:3716
- C:\Windows\System\JyWxjfw.exe
  C:\Windows\System\JyWxjfw.exe
  2⤵
  PID:3456
- C:\Windows\System\cqEDnxl.exe
  C:\Windows\System\cqEDnxl.exe
  2⤵
  PID:4648
- C:\Windows\System\FfULPOD.exe
  C:\Windows\System\FfULPOD.exe
  2⤵
  PID:4008
- C:\Windows\System\rfaadgZ.exe
  C:\Windows\System\rfaadgZ.exe
  2⤵
  PID:3680
- C:\Windows\System\wCPguOd.exe
  C:\Windows\System\wCPguOd.exe
  2⤵
  PID:4624
- C:\Windows\System\SdLxcfU.exe
  C:\Windows\System\SdLxcfU.exe
  2⤵
  PID:2628
- C:\Windows\System\oNeAKdc.exe
  C:\Windows\System\oNeAKdc.exe
  2⤵
  PID:3440
- C:\Windows\System\MbrIYZj.exe
  C:\Windows\System\MbrIYZj.exe
  2⤵
  PID:3828
- C:\Windows\System\GGsRKFP.exe
  C:\Windows\System\GGsRKFP.exe
  2⤵
  PID:3764
- C:\Windows\System\GqohMOw.exe
  C:\Windows\System\GqohMOw.exe
  2⤵
  PID:2632
- C:\Windows\System\wbqdIwy.exe
  C:\Windows\System\wbqdIwy.exe
  2⤵
  PID:3092
- C:\Windows\System\GjllFiI.exe
  C:\Windows\System\GjllFiI.exe
  2⤵
  PID:2588
- C:\Windows\System\idmjcBp.exe
  C:\Windows\System\idmjcBp.exe
  2⤵
  PID:3172
- C:\Windows\System\hVINIXE.exe
  C:\Windows\System\hVINIXE.exe
  2⤵
  PID:4176
- C:\Windows\System\fUhqYsX.exe
  C:\Windows\System\fUhqYsX.exe
  2⤵
  PID:2420
- C:\Windows\System\ZVSQaqs.exe
  C:\Windows\System\ZVSQaqs.exe
  2⤵
  PID:4724
- C:\Windows\System\zGCnrqv.exe
  C:\Windows\System\zGCnrqv.exe
  2⤵
  PID:1088
- C:\Windows\System\kjqKCst.exe
  C:\Windows\System\kjqKCst.exe
  2⤵
  PID:4516
- C:\Windows\System\DcdwwBa.exe
  C:\Windows\System\DcdwwBa.exe
  2⤵
  PID:3732
- C:\Windows\System\oXBACzq.exe
  C:\Windows\System\oXBACzq.exe
  2⤵
  PID:4244
- C:\Windows\System\qZVKzKK.exe
  C:\Windows\System\qZVKzKK.exe
  2⤵
  PID:5044
- C:\Windows\System\oiCuGnO.exe
  C:\Windows\System\oiCuGnO.exe
  2⤵
  PID:4560
- C:\Windows\System\KHjaLDN.exe
  C:\Windows\System\KHjaLDN.exe
  2⤵
  PID:3460
- C:\Windows\System\dvqvtxi.exe
  C:\Windows\System\dvqvtxi.exe
  2⤵
  PID:4884
- C:\Windows\System\sgVmMCd.exe
  C:\Windows\System\sgVmMCd.exe
  2⤵
  PID:4568
- C:\Windows\System\NricZhL.exe
  C:\Windows\System\NricZhL.exe
  2⤵
  PID:2912
- C:\Windows\System\FEzfBUU.exe
  C:\Windows\System\FEzfBUU.exe
  2⤵
  PID:4024
- C:\Windows\System\rVvGjgN.exe
  C:\Windows\System\rVvGjgN.exe
  2⤵
  PID:2716
- C:\Windows\System\txpCGns.exe
  C:\Windows\System\txpCGns.exe
  2⤵
  PID:3280
- C:\Windows\System\OcJnbEC.exe
  C:\Windows\System\OcJnbEC.exe
  2⤵
  PID:4540
- C:\Windows\System\ZlCJByO.exe
  C:\Windows\System\ZlCJByO.exe
  2⤵
  PID:2328
- C:\Windows\System\cqHWyRg.exe
  C:\Windows\System\cqHWyRg.exe
  2⤵
  PID:3540
- C:\Windows\System\NPlGLDP.exe
  C:\Windows\System\NPlGLDP.exe
  2⤵
  PID:4596
- C:\Windows\System\sUshcjv.exe
  C:\Windows\System\sUshcjv.exe
  2⤵
  PID:5060
- C:\Windows\System\fVPPCZa.exe
  C:\Windows\System\fVPPCZa.exe
  2⤵
  PID:4488
- C:\Windows\System\qrtGOFk.exe
  C:\Windows\System\qrtGOFk.exe
  2⤵
  PID:4260
- C:\Windows\System\ibeCPor.exe
  C:\Windows\System\ibeCPor.exe
  2⤵
  PID:4644
- C:\Windows\System\tyLTKGj.exe
  C:\Windows\System\tyLTKGj.exe
  2⤵
  PID:4604
- C:\Windows\System\MpCwxtC.exe
  C:\Windows\System\MpCwxtC.exe
  2⤵
  PID:4756
- C:\Windows\System\rLuwOnU.exe
  C:\Windows\System\rLuwOnU.exe
  2⤵
  PID:2996
- C:\Windows\System\tAfvKSx.exe
  C:\Windows\System\tAfvKSx.exe
  2⤵
  PID:3396
- C:\Windows\System\ZsxngDX.exe
  C:\Windows\System\ZsxngDX.exe
  2⤵
  PID:2700
- C:\Windows\System\IJZMktP.exe
  C:\Windows\System\IJZMktP.exe
  2⤵
  PID:4620
- C:\Windows\System\qPdgqGi.exe
  C:\Windows\System\qPdgqGi.exe
  2⤵
  PID:5092
- C:\Windows\System\WKwbvpG.exe
  C:\Windows\System\WKwbvpG.exe
  2⤵
  PID:3536
- C:\Windows\System\BjnVwCM.exe
  C:\Windows\System\BjnVwCM.exe
  2⤵
  PID:4872
- C:\Windows\System\ouZDkcB.exe
  C:\Windows\System\ouZDkcB.exe
  2⤵
  PID:4356
- C:\Windows\System\qwxoNmj.exe
  C:\Windows\System\qwxoNmj.exe
  2⤵
  PID:5148
- C:\Windows\System\RLwucVQ.exe
  C:\Windows\System\RLwucVQ.exe
  2⤵
  PID:5176
- C:\Windows\System\XkoIidx.exe
  C:\Windows\System\XkoIidx.exe
  2⤵
  PID:5192
- C:\Windows\System\styZlEt.exe
  C:\Windows\System\styZlEt.exe
  2⤵
  PID:5208
- C:\Windows\System\WvTRRZq.exe
  C:\Windows\System\WvTRRZq.exe
  2⤵
  PID:5224
- C:\Windows\System\aJEUGjx.exe
  C:\Windows\System\aJEUGjx.exe
  2⤵
  PID:5240
- C:\Windows\System\HtdRndh.exe
  C:\Windows\System\HtdRndh.exe
  2⤵
  PID:5256
- C:\Windows\System\yGxuGJt.exe
  C:\Windows\System\yGxuGJt.exe
  2⤵
  PID:5304
- C:\Windows\System\YLeWAat.exe
  C:\Windows\System\YLeWAat.exe
  2⤵
  PID:5320
- C:\Windows\System\bzUAhPZ.exe
  C:\Windows\System\bzUAhPZ.exe
  2⤵
  PID:5336
- C:\Windows\System\IzktjRt.exe
  C:\Windows\System\IzktjRt.exe
  2⤵
  PID:5352
- C:\Windows\System\fhuPNaQ.exe
  C:\Windows\System\fhuPNaQ.exe
  2⤵
  PID:5368
- C:\Windows\System\UVRmAoq.exe
  C:\Windows\System\UVRmAoq.exe
  2⤵
  PID:5384
- C:\Windows\System\JZPScQD.exe
  C:\Windows\System\JZPScQD.exe
  2⤵
  PID:5400
- C:\Windows\System\WLdvUnc.exe
  C:\Windows\System\WLdvUnc.exe
  2⤵
  PID:5416
- C:\Windows\System\GNUcUST.exe
  C:\Windows\System\GNUcUST.exe
  2⤵
  PID:5432
- C:\Windows\System\zHzUOBu.exe
  C:\Windows\System\zHzUOBu.exe
  2⤵
  PID:5448
- C:\Windows\System\fiHyAXM.exe
  C:\Windows\System\fiHyAXM.exe
  2⤵
  PID:5464
- C:\Windows\System\zoeHyZt.exe
  C:\Windows\System\zoeHyZt.exe
  2⤵
  PID:5480
- C:\Windows\System\MVQFXgq.exe
  C:\Windows\System\MVQFXgq.exe
  2⤵
  PID:5496
- C:\Windows\System\gtstvHi.exe
  C:\Windows\System\gtstvHi.exe
  2⤵
  PID:5512
- C:\Windows\System\IOYQLGi.exe
  C:\Windows\System\IOYQLGi.exe
  2⤵
  PID:5528
- C:\Windows\System\xJzhEbA.exe
  C:\Windows\System\xJzhEbA.exe
  2⤵
  PID:5544
- C:\Windows\System\VwCxJKx.exe
  C:\Windows\System\VwCxJKx.exe
  2⤵
  PID:5560
- C:\Windows\System\lcfBwud.exe
  C:\Windows\System\lcfBwud.exe
  2⤵
  PID:5576
- C:\Windows\System\snFYagK.exe
  C:\Windows\System\snFYagK.exe
  2⤵
  PID:5596
- C:\Windows\System\rQDwFxG.exe
  C:\Windows\System\rQDwFxG.exe
  2⤵
  PID:5616
- C:\Windows\System\RGCKCBK.exe
  C:\Windows\System\RGCKCBK.exe
  2⤵
  PID:5632
- C:\Windows\System\BhPTESz.exe
  C:\Windows\System\BhPTESz.exe
  2⤵
  PID:5648
- C:\Windows\System\NJqegfC.exe
  C:\Windows\System\NJqegfC.exe
  2⤵
  PID:5680
- C:\Windows\System\lHyDQPn.exe
  C:\Windows\System\lHyDQPn.exe
  2⤵
  PID:5700
- C:\Windows\System\HlOJdxS.exe
  C:\Windows\System\HlOJdxS.exe
  2⤵
  PID:5716
- C:\Windows\System\MQvsMYk.exe
  C:\Windows\System\MQvsMYk.exe
  2⤵
  PID:5732
- C:\Windows\System\CIZzzdZ.exe
  C:\Windows\System\CIZzzdZ.exe
  2⤵
  PID:5748
- C:\Windows\System\QKxQuyj.exe
  C:\Windows\System\QKxQuyj.exe
  2⤵
  PID:5776
- C:\Windows\System\zYgybxi.exe
  C:\Windows\System\zYgybxi.exe
  2⤵
  PID:5804
- C:\Windows\System\ArADGQL.exe
  C:\Windows\System\ArADGQL.exe
  2⤵
  PID:5820
- C:\Windows\System\tDYdCxf.exe
  C:\Windows\System\tDYdCxf.exe
  2⤵
  PID:5836
- C:\Windows\System\oUOJeZo.exe
  C:\Windows\System\oUOJeZo.exe
  2⤵
  PID:5852
- C:\Windows\System\iDgqfqR.exe
  C:\Windows\System\iDgqfqR.exe
  2⤵
  PID:5868
- C:\Windows\System\WyRMgxu.exe
  C:\Windows\System\WyRMgxu.exe
  2⤵
  PID:5884
- C:\Windows\System\lyUeiPM.exe
  C:\Windows\System\lyUeiPM.exe
  2⤵
  PID:5904
- C:\Windows\System\rGlxBgD.exe
  C:\Windows\System\rGlxBgD.exe
  2⤵
  PID:5920
- C:\Windows\System\UeDcvpu.exe
  C:\Windows\System\UeDcvpu.exe
  2⤵
  PID:5936
- C:\Windows\System\udMwNMB.exe
  C:\Windows\System\udMwNMB.exe
  2⤵
  PID:5956
- C:\Windows\System\aelDjrc.exe
  C:\Windows\System\aelDjrc.exe
  2⤵
  PID:5972
- C:\Windows\System\ZqiQmZB.exe
  C:\Windows\System\ZqiQmZB.exe
  2⤵
  PID:5988
- C:\Windows\System\oAxvPWR.exe
  C:\Windows\System\oAxvPWR.exe
  2⤵
  PID:6008
- C:\Windows\System\lsLSQmH.exe
  C:\Windows\System\lsLSQmH.exe
  2⤵
  PID:6024
- C:\Windows\System\TYVfZSY.exe
  C:\Windows\System\TYVfZSY.exe
  2⤵
  PID:6040
- C:\Windows\System\VKZovZu.exe
  C:\Windows\System\VKZovZu.exe
  2⤵
  PID:6056
- C:\Windows\System\VMLWrlL.exe
  C:\Windows\System\VMLWrlL.exe
  2⤵
  PID:6072
- C:\Windows\System\YjEKieP.exe
  C:\Windows\System\YjEKieP.exe
  2⤵
  PID:6088
- C:\Windows\System\OBAyqIa.exe
  C:\Windows\System\OBAyqIa.exe
  2⤵
  PID:6104
- C:\Windows\System\UHEvXws.exe
  C:\Windows\System\UHEvXws.exe
  2⤵
  PID:6124
- C:\Windows\System\jQpccnP.exe
  C:\Windows\System\jQpccnP.exe
  2⤵
  PID:6140
- C:\Windows\System\OJOBDLP.exe
  C:\Windows\System\OJOBDLP.exe
  2⤵
  PID:4432
- C:\Windows\System\AcqbUJv.exe
  C:\Windows\System\AcqbUJv.exe
  2⤵
  PID:4616
- C:\Windows\System\PJusCpD.exe
  C:\Windows\System\PJusCpD.exe
  2⤵
  PID:5140
- C:\Windows\System\LMKfwfa.exe
  C:\Windows\System\LMKfwfa.exe
  2⤵
  PID:5048
- C:\Windows\System\fpLVkcM.exe
  C:\Windows\System\fpLVkcM.exe
  2⤵
  PID:4792
- C:\Windows\System\ouDQrEv.exe
  C:\Windows\System\ouDQrEv.exe
  2⤵
  PID:5156
- C:\Windows\System\ussdLPi.exe
  C:\Windows\System\ussdLPi.exe
  2⤵
  PID:5184
- C:\Windows\System\AlMmyRy.exe
  C:\Windows\System\AlMmyRy.exe
  2⤵
  PID:5248
- C:\Windows\System\zTTXedu.exe
  C:\Windows\System\zTTXedu.exe
  2⤵
  PID:5232
- C:\Windows\System\zOsCRRb.exe
  C:\Windows\System\zOsCRRb.exe
  2⤵
  PID:5272
- C:\Windows\System\LwdVGAo.exe
  C:\Windows\System\LwdVGAo.exe
  2⤵
  PID:5376
- C:\Windows\System\PttzGCT.exe
  C:\Windows\System\PttzGCT.exe
  2⤵
  PID:5440
- C:\Windows\System\XJYgSNF.exe
  C:\Windows\System\XJYgSNF.exe
  2⤵
  PID:5476
- C:\Windows\System\aKwNqws.exe
  C:\Windows\System\aKwNqws.exe
  2⤵
  PID:5292
- C:\Windows\System\yXxrTST.exe
  C:\Windows\System\yXxrTST.exe
  2⤵
  PID:5508
- C:\Windows\System\kCRhyuR.exe
  C:\Windows\System\kCRhyuR.exe
  2⤵
  PID:5364
- C:\Windows\System\xnlFksm.exe
  C:\Windows\System\xnlFksm.exe
  2⤵
  PID:5456
- C:\Windows\System\aRZSBPj.exe
  C:\Windows\System\aRZSBPj.exe
  2⤵
  PID:5568
- C:\Windows\System\nEwWCcL.exe
  C:\Windows\System\nEwWCcL.exe
  2⤵
  PID:5460
- C:\Windows\System\zGcSOrB.exe
  C:\Windows\System\zGcSOrB.exe
  2⤵
  PID:5612
- C:\Windows\System\lmeDqFK.exe
  C:\Windows\System\lmeDqFK.exe
  2⤵
  PID:5552
- C:\Windows\System\xfXadqH.exe
  C:\Windows\System\xfXadqH.exe
  2⤵
  PID:5584
- C:\Windows\System\PNIJNky.exe
  C:\Windows\System\PNIJNky.exe
  2⤵
  PID:5628
- C:\Windows\System\hGYfgCl.exe
  C:\Windows\System\hGYfgCl.exe
  2⤵
  PID:5664
- C:\Windows\System\ZxxqTHf.exe
  C:\Windows\System\ZxxqTHf.exe
  2⤵
  PID:5724
- C:\Windows\System\hhXDSXj.exe
  C:\Windows\System\hhXDSXj.exe
  2⤵
  PID:5760
- C:\Windows\System\buGkRvI.exe
  C:\Windows\System\buGkRvI.exe
  2⤵
  PID:6048
- C:\Windows\System\WpEQALP.exe
  C:\Windows\System\WpEQALP.exe
  2⤵
  PID:6112
- C:\Windows\System\mPcJNAD.exe
  C:\Windows\System\mPcJNAD.exe
  2⤵
  PID:1468
- C:\Windows\System\wvTdrlv.exe
  C:\Windows\System\wvTdrlv.exe
  2⤵
  PID:5708
- C:\Windows\System\kfwYyMu.exe
  C:\Windows\System\kfwYyMu.exe
  2⤵
  PID:5784
- C:\Windows\System\HssBHlD.exe
  C:\Windows\System\HssBHlD.exe
  2⤵
  PID:4744
- C:\Windows\System\AsHOpxm.exe
  C:\Windows\System\AsHOpxm.exe
  2⤵
  PID:5164
- C:\Windows\System\FvXCTwa.exe
  C:\Windows\System\FvXCTwa.exe
  2⤵
  PID:5344
- C:\Windows\System\psdJVjs.exe
  C:\Windows\System\psdJVjs.exe
  2⤵
  PID:5860
- C:\Windows\System\SbJfJTw.exe
  C:\Windows\System\SbJfJTw.exe
  2⤵
  PID:5896
- C:\Windows\System\crEeqpi.exe
  C:\Windows\System\crEeqpi.exe
  2⤵
  PID:5968
- C:\Windows\System\KCAqLkL.exe
  C:\Windows\System\KCAqLkL.exe
  2⤵
  PID:6004
- C:\Windows\System\QbhZqkw.exe
  C:\Windows\System\QbhZqkw.exe
  2⤵
  PID:6068
- C:\Windows\System\rzmCkKS.exe
  C:\Windows\System\rzmCkKS.exe
  2⤵
  PID:6136
- C:\Windows\System\jXnwPzm.exe
  C:\Windows\System\jXnwPzm.exe
  2⤵
  PID:5128
- C:\Windows\System\sgBXlLu.exe
  C:\Windows\System\sgBXlLu.exe
  2⤵
  PID:4552
- C:\Windows\System\GRJYJbm.exe
  C:\Windows\System\GRJYJbm.exe
  2⤵
  PID:5264
- C:\Windows\System\exDLAiR.exe
  C:\Windows\System\exDLAiR.exe
  2⤵
  PID:5300
- C:\Windows\System\Orezhzk.exe
  C:\Windows\System\Orezhzk.exe
  2⤵
  PID:5604
- C:\Windows\System\RiMOAqo.exe
  C:\Windows\System\RiMOAqo.exe
  2⤵
  PID:5360
- C:\Windows\System\EPSbzTX.exe
  C:\Windows\System\EPSbzTX.exe
  2⤵
  PID:5688
- C:\Windows\System\yoTwqsm.exe
  C:\Windows\System\yoTwqsm.exe
  2⤵
  PID:5668
- C:\Windows\System\SbUzsio.exe
  C:\Windows\System\SbUzsio.exe
  2⤵
  PID:5676
- C:\Windows\System\KngDqIK.exe
  C:\Windows\System\KngDqIK.exe
  2⤵
  PID:5880
- C:\Windows\System\HFSolfI.exe
  C:\Windows\System\HFSolfI.exe
  2⤵
  PID:5952
- C:\Windows\System\OOWpSCv.exe
  C:\Windows\System\OOWpSCv.exe
  2⤵
  PID:5944
- C:\Windows\System\yLvcmzp.exe
  C:\Windows\System\yLvcmzp.exe
  2⤵
  PID:5740
- C:\Windows\System\FUIyfJE.exe
  C:\Windows\System\FUIyfJE.exe
  2⤵
  PID:5832
- C:\Windows\System\oDqktfK.exe
  C:\Windows\System\oDqktfK.exe
  2⤵
  PID:6064
- C:\Windows\System\PkSHgll.exe
  C:\Windows\System\PkSHgll.exe
  2⤵
  PID:5536
- C:\Windows\System\BdUeQtv.exe
  C:\Windows\System\BdUeQtv.exe
  2⤵
  PID:4416
- C:\Windows\System\MUygHcE.exe
  C:\Windows\System\MUygHcE.exe
  2⤵
  PID:5932
- C:\Windows\System\PxIkFZC.exe
  C:\Windows\System\PxIkFZC.exe
  2⤵
  PID:5316
- C:\Windows\System\XiHItdV.exe
  C:\Windows\System\XiHItdV.exe
  2⤵
  PID:5408
- C:\Windows\System\vAxzpqi.exe
  C:\Windows\System\vAxzpqi.exe
  2⤵
  PID:5200
- C:\Windows\System\HosxXVN.exe
  C:\Windows\System\HosxXVN.exe
  2⤵
  PID:6036
- C:\Windows\System\iSxGZjv.exe
  C:\Windows\System\iSxGZjv.exe
  2⤵
  PID:6084
- C:\Windows\System\YgLjOAw.exe
  C:\Windows\System\YgLjOAw.exe
  2⤵
  PID:5788
- C:\Windows\System\hrvRlwZ.exe
  C:\Windows\System\hrvRlwZ.exe
  2⤵
  PID:5624
- C:\Windows\System\Cvmskyb.exe
  C:\Windows\System\Cvmskyb.exe
  2⤵
  PID:6000
- C:\Windows\System\NPcSMOE.exe
  C:\Windows\System\NPcSMOE.exe
  2⤵
  PID:5492
- C:\Windows\System\dxvOxeH.exe
  C:\Windows\System\dxvOxeH.exe
  2⤵
  PID:5816
- C:\Windows\System\RrTDqUz.exe
  C:\Windows\System\RrTDqUz.exe
  2⤵
  PID:5876
- C:\Windows\System\vrsbebA.exe
  C:\Windows\System\vrsbebA.exe
  2⤵
  PID:5132
- C:\Windows\System\DMwFzgu.exe
  C:\Windows\System\DMwFzgu.exe
  2⤵
  PID:2796
- C:\Windows\System\kZMXvQQ.exe
  C:\Windows\System\kZMXvQQ.exe
  2⤵
  PID:5172
- C:\Windows\System\jUGMMIr.exe
  C:\Windows\System\jUGMMIr.exe
  2⤵
  PID:5472
- C:\Windows\System\lQAtTGR.exe
  C:\Windows\System\lQAtTGR.exe
  2⤵
  PID:5220
- C:\Windows\System\PsJUwCG.exe
  C:\Windows\System\PsJUwCG.exe
  2⤵
  PID:5772
- C:\Windows\System\iwMwLRj.exe
  C:\Windows\System\iwMwLRj.exe
  2⤵
  PID:2740
- C:\Windows\System\dEHdnUc.exe
  C:\Windows\System\dEHdnUc.exe
  2⤵
  PID:6156
- C:\Windows\System\aLBmWxr.exe
  C:\Windows\System\aLBmWxr.exe
  2⤵
  PID:6172
- C:\Windows\System\xoUVFPw.exe
  C:\Windows\System\xoUVFPw.exe
  2⤵
  PID:6188
- C:\Windows\System\AXjWQYy.exe
  C:\Windows\System\AXjWQYy.exe
  2⤵
  PID:6204
- C:\Windows\System\AWYxJvV.exe
  C:\Windows\System\AWYxJvV.exe
  2⤵
  PID:6220
- C:\Windows\System\cIrEvJw.exe
  C:\Windows\System\cIrEvJw.exe
  2⤵
  PID:6236
- C:\Windows\System\jqCWfVJ.exe
  C:\Windows\System\jqCWfVJ.exe
  2⤵
  PID:6256
- C:\Windows\System\jiNAXlo.exe
  C:\Windows\System\jiNAXlo.exe
  2⤵
  PID:6272
- C:\Windows\System\UIkRaBG.exe
  C:\Windows\System\UIkRaBG.exe
  2⤵
  PID:6288
- C:\Windows\System\TlMIIaf.exe
  C:\Windows\System\TlMIIaf.exe
  2⤵
  PID:6304
- C:\Windows\System\QNCHnTz.exe
  C:\Windows\System\QNCHnTz.exe
  2⤵
  PID:6320
- C:\Windows\System\FcGnjsW.exe
  C:\Windows\System\FcGnjsW.exe
  2⤵
  PID:6336
- C:\Windows\System\blAnSKb.exe
  C:\Windows\System\blAnSKb.exe
  2⤵
  PID:6352
- C:\Windows\System\lqwkllQ.exe
  C:\Windows\System\lqwkllQ.exe
  2⤵
  PID:6368
- C:\Windows\System\fhcUGJk.exe
  C:\Windows\System\fhcUGJk.exe
  2⤵
  PID:6384
- C:\Windows\System\HLsSTaH.exe
  C:\Windows\System\HLsSTaH.exe
  2⤵
  PID:6400
- C:\Windows\System\aOrHBro.exe
  C:\Windows\System\aOrHBro.exe
  2⤵
  PID:6416
- C:\Windows\System\eAwceGg.exe
  C:\Windows\System\eAwceGg.exe
  2⤵
  PID:6432
- C:\Windows\System\lEJbNpO.exe
  C:\Windows\System\lEJbNpO.exe
  2⤵
  PID:6448
- C:\Windows\System\LoNucAc.exe
  C:\Windows\System\LoNucAc.exe
  2⤵
  PID:6464
- C:\Windows\System\iqMvPkc.exe
  C:\Windows\System\iqMvPkc.exe
  2⤵
  PID:6480
- C:\Windows\System\RFMYFpl.exe
  C:\Windows\System\RFMYFpl.exe
  2⤵
  PID:6496
- C:\Windows\System\QkYIgnK.exe
  C:\Windows\System\QkYIgnK.exe
  2⤵
  PID:6512
- C:\Windows\System\lAgfBCo.exe
  C:\Windows\System\lAgfBCo.exe
  2⤵
  PID:6528
- C:\Windows\System\hqvfEqU.exe
  C:\Windows\System\hqvfEqU.exe
  2⤵
  PID:6544
- C:\Windows\System\cvtIisd.exe
  C:\Windows\System\cvtIisd.exe
  2⤵
  PID:6560
- C:\Windows\System\uSjjQyz.exe
  C:\Windows\System\uSjjQyz.exe
  2⤵
  PID:6576
- C:\Windows\System\YlnYyRd.exe
  C:\Windows\System\YlnYyRd.exe
  2⤵
  PID:6592
- C:\Windows\System\QYcIQHm.exe
  C:\Windows\System\QYcIQHm.exe
  2⤵
  PID:6608
- C:\Windows\System\WLEirzI.exe
  C:\Windows\System\WLEirzI.exe
  2⤵
  PID:6624
- C:\Windows\System\JGEOvZo.exe
  C:\Windows\System\JGEOvZo.exe
  2⤵
  PID:6640
- C:\Windows\System\kuGkqre.exe
  C:\Windows\System\kuGkqre.exe
  2⤵
  PID:6656
- C:\Windows\System\ZQOUEFJ.exe
  C:\Windows\System\ZQOUEFJ.exe
  2⤵
  PID:6672
- C:\Windows\System\ylfNESZ.exe
  C:\Windows\System\ylfNESZ.exe
  2⤵
  PID:6688
- C:\Windows\System\aSFBBHh.exe
  C:\Windows\System\aSFBBHh.exe
  2⤵
  PID:6704
- C:\Windows\System\MdYrIUS.exe
  C:\Windows\System\MdYrIUS.exe
  2⤵
  PID:6720
- C:\Windows\System\drMzmPE.exe
  C:\Windows\System\drMzmPE.exe
  2⤵
  PID:6736
- C:\Windows\System\yyXrmyd.exe
  C:\Windows\System\yyXrmyd.exe
  2⤵
  PID:6752
- C:\Windows\System\nxFwgMs.exe
  C:\Windows\System\nxFwgMs.exe
  2⤵
  PID:6768
- C:\Windows\System\fZxBWsB.exe
  C:\Windows\System\fZxBWsB.exe
  2⤵
  PID:6784
- C:\Windows\System\vFRNSQs.exe
  C:\Windows\System\vFRNSQs.exe
  2⤵
  PID:6800
- C:\Windows\System\VnsjeLc.exe
  C:\Windows\System\VnsjeLc.exe
  2⤵
  PID:6816
- C:\Windows\System\WLvrSWK.exe
  C:\Windows\System\WLvrSWK.exe
  2⤵
  PID:6832
- C:\Windows\System\cUtQIfR.exe
  C:\Windows\System\cUtQIfR.exe
  2⤵
  PID:6848
- C:\Windows\System\ABJmlIu.exe
  C:\Windows\System\ABJmlIu.exe
  2⤵
  PID:6868
- C:\Windows\System\YbCkXcy.exe
  C:\Windows\System\YbCkXcy.exe
  2⤵
  PID:6884
- C:\Windows\System\bMpXdTG.exe
  C:\Windows\System\bMpXdTG.exe
  2⤵
  PID:6900
- C:\Windows\System\QWnKQfJ.exe
  C:\Windows\System\QWnKQfJ.exe
  2⤵
  PID:6916
- C:\Windows\System\rxRifFd.exe
  C:\Windows\System\rxRifFd.exe
  2⤵
  PID:6932
- C:\Windows\System\FnylMqw.exe
  C:\Windows\System\FnylMqw.exe
  2⤵
  PID:6948
- C:\Windows\System\rkJwIac.exe
  C:\Windows\System\rkJwIac.exe
  2⤵
  PID:6964
- C:\Windows\System\CsmaDEq.exe
  C:\Windows\System\CsmaDEq.exe
  2⤵
  PID:6980
- C:\Windows\System\fKLSLxg.exe
  C:\Windows\System\fKLSLxg.exe
  2⤵
  PID:6996
- C:\Windows\System\ApZwsax.exe
  C:\Windows\System\ApZwsax.exe
  2⤵
  PID:7012
- C:\Windows\System\BpJlIiY.exe
  C:\Windows\System\BpJlIiY.exe
  2⤵
  PID:7028
- C:\Windows\System\CwZAMJK.exe
  C:\Windows\System\CwZAMJK.exe
  2⤵
  PID:7044
- C:\Windows\System\drtCfPa.exe
  C:\Windows\System\drtCfPa.exe
  2⤵
  PID:7060
- C:\Windows\System\TprIbkl.exe
  C:\Windows\System\TprIbkl.exe
  2⤵
  PID:7076
- C:\Windows\System\Xytwdic.exe
  C:\Windows\System\Xytwdic.exe
  2⤵
  PID:7092
- C:\Windows\System\GqXOPrG.exe
  C:\Windows\System\GqXOPrG.exe
  2⤵
  PID:7108
- C:\Windows\System\qdVWzIS.exe
  C:\Windows\System\qdVWzIS.exe
  2⤵
  PID:7124
- C:\Windows\System\GUTBGEM.exe
  C:\Windows\System\GUTBGEM.exe
  2⤵
  PID:7140
- C:\Windows\System\tAKVWeZ.exe
  C:\Windows\System\tAKVWeZ.exe
  2⤵
  PID:7156
- C:\Windows\System\ESPlVkp.exe
  C:\Windows\System\ESPlVkp.exe
  2⤵
  PID:5412
- C:\Windows\System\FsIEnqb.exe
  C:\Windows\System\FsIEnqb.exe
  2⤵
  PID:6148
- C:\Windows\System\cYROEkq.exe
  C:\Windows\System\cYROEkq.exe
  2⤵
  PID:6212
- C:\Windows\System\DokHzom.exe
  C:\Windows\System\DokHzom.exe
  2⤵
  PID:6228
- C:\Windows\System\gJzIySG.exe
  C:\Windows\System\gJzIySG.exe
  2⤵
  PID:6164
- C:\Windows\System\nzoQrqm.exe
  C:\Windows\System\nzoQrqm.exe
  2⤵
  PID:6280
- C:\Windows\System\CzcCKLe.exe
  C:\Windows\System\CzcCKLe.exe
  2⤵
  PID:4592
- C:\Windows\System\QwmDriw.exe
  C:\Windows\System\QwmDriw.exe
  2⤵
  PID:6344
- C:\Windows\System\WEjeGHe.exe
  C:\Windows\System\WEjeGHe.exe
  2⤵
  PID:6360
- C:\Windows\System\bGVVKDx.exe
  C:\Windows\System\bGVVKDx.exe
  2⤵
  PID:6412
- C:\Windows\System\xwgXvBv.exe
  C:\Windows\System\xwgXvBv.exe
  2⤵
  PID:6264
- C:\Windows\System\TcZQPmV.exe
  C:\Windows\System\TcZQPmV.exe
  2⤵
  PID:6536
- C:\Windows\System\GnSqdds.exe
  C:\Windows\System\GnSqdds.exe
  2⤵
  PID:6300
- C:\Windows\System\IsGtxRN.exe
  C:\Windows\System\IsGtxRN.exe
  2⤵
  PID:6604
- C:\Windows\System\hmxQJKP.exe
  C:\Windows\System\hmxQJKP.exe
  2⤵
  PID:6392
- C:\Windows\System\RZUxfdE.exe
  C:\Windows\System\RZUxfdE.exe
  2⤵
  PID:6456
- C:\Windows\System\shcXHNB.exe
  C:\Windows\System\shcXHNB.exe
  2⤵
  PID:6488
- C:\Windows\System\mePrNpd.exe
  C:\Windows\System\mePrNpd.exe
  2⤵
  PID:6556
- C:\Windows\System\panZMmV.exe
  C:\Windows\System\panZMmV.exe
  2⤵
  PID:6620
- C:\Windows\System\SHGGAPY.exe
  C:\Windows\System\SHGGAPY.exe
  2⤵
  PID:6844
- C:\Windows\System\XsntFty.exe
  C:\Windows\System\XsntFty.exe
  2⤵
  PID:7084
- C:\Windows\System\MTAXyrJ.exe
  C:\Windows\System\MTAXyrJ.exe
  2⤵
  PID:7120
- C:\Windows\System\wimqgWi.exe
  C:\Windows\System\wimqgWi.exe
  2⤵
  PID:5692
- C:\Windows\System\AkmhWCN.exe
  C:\Windows\System\AkmhWCN.exe
  2⤵
  PID:6252
- C:\Windows\System\LbkPmmy.exe
  C:\Windows\System\LbkPmmy.exe
  2⤵
  PID:7136
- C:\Windows\System\XpYFIrD.exe
  C:\Windows\System\XpYFIrD.exe
  2⤵
  PID:6508
- C:\Windows\System\mlrAzmW.exe
  C:\Windows\System\mlrAzmW.exe
  2⤵
  PID:6424
- C:\Windows\System\grOAscw.exe
  C:\Windows\System\grOAscw.exe
  2⤵
  PID:6184
- C:\Windows\System\vIfrcSt.exe
  C:\Windows\System\vIfrcSt.exe
  2⤵
  PID:6132
- C:\Windows\System\BDgnyME.exe
  C:\Windows\System\BDgnyME.exe
  2⤵
  PID:6520
- C:\Windows\System\StwJvHR.exe
  C:\Windows\System\StwJvHR.exe
  2⤵
  PID:6636
- C:\Windows\System\mDYhtHr.exe
  C:\Windows\System\mDYhtHr.exe
  2⤵
  PID:6524
- C:\Windows\System\BJFxpZu.exe
  C:\Windows\System\BJFxpZu.exe
  2⤵
  PID:6616
- C:\Windows\System\ZOUkFWq.exe
  C:\Windows\System\ZOUkFWq.exe
  2⤵
  PID:3600
- C:\Windows\System\gxcJNMy.exe
  C:\Windows\System\gxcJNMy.exe
  2⤵
  PID:6652
- C:\Windows\System\nvlWALM.exe
  C:\Windows\System\nvlWALM.exe
  2⤵
  PID:6792
- C:\Windows\System\vrzkKeX.exe
  C:\Windows\System\vrzkKeX.exe
  2⤵
  PID:6856
- C:\Windows\System\HeXacpH.exe
  C:\Windows\System\HeXacpH.exe
  2⤵
  PID:6840
- C:\Windows\System\hrjXHcf.exe
  C:\Windows\System\hrjXHcf.exe
  2⤵
  PID:6680
- C:\Windows\System\VKqyOXp.exe
  C:\Windows\System\VKqyOXp.exe
  2⤵
  PID:6876
- C:\Windows\System\DPthXLO.exe
  C:\Windows\System\DPthXLO.exe
  2⤵
  PID:6928
- C:\Windows\System\hHszdUQ.exe
  C:\Windows\System\hHszdUQ.exe
  2⤵
  PID:6732
- C:\Windows\System\mmPlUXR.exe
  C:\Windows\System\mmPlUXR.exe
  2⤵
  PID:6960
- C:\Windows\System\fZYuUNE.exe
  C:\Windows\System\fZYuUNE.exe
  2⤵
  PID:7024
- C:\Windows\System\mxqTYbE.exe
  C:\Windows\System\mxqTYbE.exe
  2⤵
  PID:6992
- C:\Windows\System\jvlxzzL.exe
  C:\Windows\System\jvlxzzL.exe
  2⤵
  PID:6232
- C:\Windows\System\zgPMcYC.exe
  C:\Windows\System\zgPMcYC.exe
  2⤵
  PID:7104
- C:\Windows\System\jgAySFJ.exe
  C:\Windows\System\jgAySFJ.exe
  2⤵
  PID:5608
- C:\Windows\System\AFLjIFU.exe
  C:\Windows\System\AFLjIFU.exe
  2⤵
  PID:6316
- C:\Windows\System\wbinkfU.exe
  C:\Windows\System\wbinkfU.exe
  2⤵
  PID:6472
- C:\Windows\System\trSaANf.exe
  C:\Windows\System\trSaANf.exe
  2⤵
  PID:6712
- C:\Windows\System\DRuDRub.exe
  C:\Windows\System\DRuDRub.exe
  2⤵
  PID:6864
- C:\Windows\System\yRkYLWY.exe
  C:\Windows\System\yRkYLWY.exe
  2⤵
  PID:6748
- C:\Windows\System\IZDqbnG.exe
  C:\Windows\System\IZDqbnG.exe
  2⤵
  PID:6760
- C:\Windows\System\RFxjqYB.exe
  C:\Windows\System\RFxjqYB.exe
  2⤵
  PID:6600
- C:\Windows\System\qIcLwQx.exe
  C:\Windows\System\qIcLwQx.exe
  2⤵
  PID:6812
- C:\Windows\System\CPahvFX.exe
  C:\Windows\System\CPahvFX.exe
  2⤵
  PID:6668
- C:\Windows\System\JyBfDVV.exe
  C:\Windows\System\JyBfDVV.exe
  2⤵
  PID:7052
- C:\Windows\System\VLYzUwb.exe
  C:\Windows\System\VLYzUwb.exe
  2⤵
  PID:6956
- C:\Windows\System\NbGDPAB.exe
  C:\Windows\System\NbGDPAB.exe
  2⤵
  PID:7116
- C:\Windows\System\NLfvabI.exe
  C:\Windows\System\NLfvabI.exe
  2⤵
  PID:1500
- C:\Windows\System\gQTvbNH.exe
  C:\Windows\System\gQTvbNH.exe
  2⤵
  PID:6168
- C:\Windows\System\SPDnqGK.exe
  C:\Windows\System\SPDnqGK.exe
  2⤵
  PID:6764
- C:\Windows\System\kxOHHJI.exe
  C:\Windows\System\kxOHHJI.exe
  2⤵
  PID:6428
- C:\Windows\System\MuPdZMB.exe
  C:\Windows\System\MuPdZMB.exe
  2⤵
  PID:6572
- C:\Windows\System\lMLAqOv.exe
  C:\Windows\System\lMLAqOv.exe
  2⤵
  PID:6648
- C:\Windows\System\XfDrCWJ.exe
  C:\Windows\System\XfDrCWJ.exe
  2⤵
  PID:5964
- C:\Windows\System\krtYjCT.exe
  C:\Windows\System\krtYjCT.exe
  2⤵
  PID:7176
- C:\Windows\System\FXlkXen.exe
  C:\Windows\System\FXlkXen.exe
  2⤵
  PID:7228
- C:\Windows\System\BTvvCSS.exe
  C:\Windows\System\BTvvCSS.exe
  2⤵
  PID:7244
- C:\Windows\System\KPCYmJf.exe
  C:\Windows\System\KPCYmJf.exe
  2⤵
  PID:7260
- C:\Windows\System\KnUmrlG.exe
  C:\Windows\System\KnUmrlG.exe
  2⤵
  PID:7276
- C:\Windows\System\kdQESOy.exe
  C:\Windows\System\kdQESOy.exe
  2⤵
  PID:7292
- C:\Windows\System\QlLnBRt.exe
  C:\Windows\System\QlLnBRt.exe
  2⤵
  PID:7308
- C:\Windows\System\pISgEas.exe
  C:\Windows\System\pISgEas.exe
  2⤵
  PID:7324
- C:\Windows\System\ueohDNC.exe
  C:\Windows\System\ueohDNC.exe
  2⤵
  PID:7340
- C:\Windows\System\tLpxeQa.exe
  C:\Windows\System\tLpxeQa.exe
  2⤵
  PID:7356
- C:\Windows\System\gqdOGBg.exe
  C:\Windows\System\gqdOGBg.exe
  2⤵
  PID:7372
- C:\Windows\System\XtqUiVo.exe
  C:\Windows\System\XtqUiVo.exe
  2⤵
  PID:7664
- C:\Windows\System\IaSvmvD.exe
  C:\Windows\System\IaSvmvD.exe
  2⤵
  PID:7680
- C:\Windows\System\bVIpjlE.exe
  C:\Windows\System\bVIpjlE.exe
  2⤵
  PID:7700
- C:\Windows\System\UyiRIKy.exe
  C:\Windows\System\UyiRIKy.exe
  2⤵
  PID:7716
- C:\Windows\System\ZYcEGYC.exe
  C:\Windows\System\ZYcEGYC.exe
  2⤵
  PID:7732
- C:\Windows\System\exfElds.exe
  C:\Windows\System\exfElds.exe
  2⤵
  PID:7748
- C:\Windows\System\ppYNNor.exe
  C:\Windows\System\ppYNNor.exe
  2⤵
  PID:7764
- C:\Windows\System\IvtGTPo.exe
  C:\Windows\System\IvtGTPo.exe
  2⤵
  PID:7780
- C:\Windows\System\OqDkQAm.exe
  C:\Windows\System\OqDkQAm.exe
  2⤵
  PID:7796
- C:\Windows\System\WiOrzYf.exe
  C:\Windows\System\WiOrzYf.exe
  2⤵
  PID:7812
- C:\Windows\System\ZUgWIGG.exe
  C:\Windows\System\ZUgWIGG.exe
  2⤵
  PID:7832
- C:\Windows\System\iKbJgta.exe
  C:\Windows\System\iKbJgta.exe
  2⤵
  PID:7848
- C:\Windows\System\agThXnj.exe
  C:\Windows\System\agThXnj.exe
  2⤵
  PID:7864
- C:\Windows\System\osZFFib.exe
  C:\Windows\System\osZFFib.exe
  2⤵
  PID:7904
- C:\Windows\System\WgksBaN.exe
  C:\Windows\System\WgksBaN.exe
  2⤵
  PID:7924
- C:\Windows\System\VhNSoBI.exe
  C:\Windows\System\VhNSoBI.exe
  2⤵
  PID:7940
- C:\Windows\System\FNYwDLv.exe
  C:\Windows\System\FNYwDLv.exe
  2⤵
  PID:7960
- C:\Windows\System\LovyBDS.exe
  C:\Windows\System\LovyBDS.exe
  2⤵
  PID:7976
- C:\Windows\System\VfFVxfz.exe
  C:\Windows\System\VfFVxfz.exe
  2⤵
  PID:7996
- C:\Windows\System\qdcRiVI.exe
  C:\Windows\System\qdcRiVI.exe
  2⤵
  PID:8012
- C:\Windows\System\sZbbgBX.exe
  C:\Windows\System\sZbbgBX.exe
  2⤵
  PID:8028
- C:\Windows\System\UTmnYTO.exe
  C:\Windows\System\UTmnYTO.exe
  2⤵
  PID:8044
- C:\Windows\System\nhIPmHD.exe
  C:\Windows\System\nhIPmHD.exe
  2⤵
  PID:8064
- C:\Windows\System\NbfAcTn.exe
  C:\Windows\System\NbfAcTn.exe
  2⤵
  PID:8088
- C:\Windows\System\jTeOmTf.exe
  C:\Windows\System\jTeOmTf.exe
  2⤵
  PID:8104
- C:\Windows\System\LndmHmt.exe
  C:\Windows\System\LndmHmt.exe
  2⤵
  PID:8120
- C:\Windows\System\DLtwCep.exe
  C:\Windows\System\DLtwCep.exe
  2⤵
  PID:8136
- C:\Windows\System\pzqEEqE.exe
  C:\Windows\System\pzqEEqE.exe
  2⤵
  PID:8152
- C:\Windows\System\xOkkJGV.exe
  C:\Windows\System\xOkkJGV.exe
  2⤵
  PID:8176
- C:\Windows\System\XmltMds.exe
  C:\Windows\System\XmltMds.exe
  2⤵
  PID:6504
- C:\Windows\System\QfZkaKw.exe
  C:\Windows\System\QfZkaKw.exe
  2⤵
  PID:6716
- C:\Windows\System\osSsqTG.exe
  C:\Windows\System\osSsqTG.exe
  2⤵
  PID:7196
- C:\Windows\System\RkIXeVh.exe
  C:\Windows\System\RkIXeVh.exe
  2⤵
  PID:7396
- C:\Windows\System\ZROwdEl.exe
  C:\Windows\System\ZROwdEl.exe
  2⤵
  PID:7416
- C:\Windows\System\zmMENLp.exe
  C:\Windows\System\zmMENLp.exe
  2⤵
  PID:7132
- C:\Windows\System\iOWpNfj.exe
  C:\Windows\System\iOWpNfj.exe
  2⤵
  PID:7236
- C:\Windows\System\uAhprjL.exe
  C:\Windows\System\uAhprjL.exe
  2⤵
  PID:7436
- C:\Windows\System\SFQJifM.exe
  C:\Windows\System\SFQJifM.exe
  2⤵
  PID:7460
- C:\Windows\System\KOEvSPF.exe
  C:\Windows\System\KOEvSPF.exe
  2⤵
  PID:7540
- C:\Windows\System\oectMVW.exe
  C:\Windows\System\oectMVW.exe
  2⤵
  PID:7560
- C:\Windows\System\pcBLNqc.exe
  C:\Windows\System\pcBLNqc.exe
  2⤵
  PID:7608
- C:\Windows\System\YEkJLlh.exe
  C:\Windows\System\YEkJLlh.exe
  2⤵
  PID:7592
- C:\Windows\System\NkkfsRu.exe
  C:\Windows\System\NkkfsRu.exe
  2⤵
  PID:7576
- C:\Windows\System\TbPKWBU.exe
  C:\Windows\System\TbPKWBU.exe
  2⤵
  PID:6408
- C:\Windows\System\fWkzQiY.exe
  C:\Windows\System\fWkzQiY.exe
  2⤵
  PID:7632
- C:\Windows\System\vqTCuDn.exe
  C:\Windows\System\vqTCuDn.exe
  2⤵
  PID:7332
- C:\Windows\System\KxaBkTa.exe
  C:\Windows\System\KxaBkTa.exe
  2⤵
  PID:7648
- C:\Windows\System\aJCIlmz.exe
  C:\Windows\System\aJCIlmz.exe
  2⤵
  PID:7252
- C:\Windows\System\hgzObNa.exe
  C:\Windows\System\hgzObNa.exe
  2⤵
  PID:7656
- C:\Windows\System\wrkjDaP.exe
  C:\Windows\System\wrkjDaP.exe
  2⤵
  PID:7552
- C:\Windows\System\cpypRhL.exe
  C:\Windows\System\cpypRhL.exe
  2⤵
  PID:7708
- C:\Windows\System\bJAOhNq.exe
  C:\Windows\System\bJAOhNq.exe
  2⤵
  PID:7772
- C:\Windows\System\PZLpSqg.exe
  C:\Windows\System\PZLpSqg.exe
  2⤵
  PID:7840
- C:\Windows\System\MoZFwFy.exe
  C:\Windows\System\MoZFwFy.exe
  2⤵
  PID:7696
- C:\Windows\System\EKlVbYo.exe
  C:\Windows\System\EKlVbYo.exe
  2⤵
  PID:7760
- C:\Windows\System\iuPpGjz.exe
  C:\Windows\System\iuPpGjz.exe
  2⤵
  PID:7856
- C:\Windows\System\KXUljMW.exe
  C:\Windows\System\KXUljMW.exe
  2⤵
  PID:7876
- C:\Windows\System\drVuNuh.exe
  C:\Windows\System\drVuNuh.exe
  2⤵
  PID:7900
- C:\Windows\System\xlKVPuY.exe
  C:\Windows\System\xlKVPuY.exe
  2⤵
  PID:8004
- C:\Windows\System\aNYubAS.exe
  C:\Windows\System\aNYubAS.exe
  2⤵
  PID:8072
- C:\Windows\System\KYiqleY.exe
  C:\Windows\System\KYiqleY.exe
  2⤵
  PID:8112
- C:\Windows\System\oOXeBBF.exe
  C:\Windows\System\oOXeBBF.exe
  2⤵
  PID:8184
- C:\Windows\System\ovVfebU.exe
  C:\Windows\System\ovVfebU.exe
  2⤵
  PID:7404
- C:\Windows\System\PaoGbGm.exe
  C:\Windows\System\PaoGbGm.exe
  2⤵
  PID:7172
- C:\Windows\System\tWrnlQU.exe
  C:\Windows\System\tWrnlQU.exe
  2⤵
  PID:7956
- C:\Windows\System\BvjkhQX.exe
  C:\Windows\System\BvjkhQX.exe
  2⤵
  PID:8024
- C:\Windows\System\SURKhWW.exe
  C:\Windows\System\SURKhWW.exe
  2⤵
  PID:8100
- C:\Windows\System\DTvcSBs.exe
  C:\Windows\System\DTvcSBs.exe
  2⤵
  PID:6568
- C:\Windows\System\GbsMCVo.exe
  C:\Windows\System\GbsMCVo.exe
  2⤵
  PID:7420
- C:\Windows\System\FisRQQz.exe
  C:\Windows\System\FisRQQz.exe
  2⤵
  PID:7432
- C:\Windows\System\gbHHDDV.exe
  C:\Windows\System\gbHHDDV.exe
  2⤵
  PID:7920
- C:\Windows\System\olCSgYd.exe
  C:\Windows\System\olCSgYd.exe
  2⤵
  PID:8164
- C:\Windows\System\ksNJdub.exe
  C:\Windows\System\ksNJdub.exe
  2⤵
  PID:7468
- C:\Windows\System\IzAOUQK.exe
  C:\Windows\System\IzAOUQK.exe
  2⤵
  PID:7480
- C:\Windows\System\qVDKPiI.exe
  C:\Windows\System\qVDKPiI.exe
  2⤵
  PID:7500
- C:\Windows\System\DulLKTa.exe
  C:\Windows\System\DulLKTa.exe
  2⤵
  PID:7516
- C:\Windows\System\TLOQLzZ.exe
  C:\Windows\System\TLOQLzZ.exe
  2⤵
  PID:7224
- C:\Windows\System\ELIOPuR.exe
  C:\Windows\System\ELIOPuR.exe
  2⤵
  PID:7272
- C:\Windows\System\XwkbVtV.exe
  C:\Windows\System\XwkbVtV.exe
  2⤵
  PID:7652
- C:\Windows\System\Dmmkgif.exe
  C:\Windows\System\Dmmkgif.exe
  2⤵
  PID:7628
- C:\Windows\System\wAIWFkA.exe
  C:\Windows\System\wAIWFkA.exe
  2⤵
  PID:7740
- C:\Windows\System\BeoFBGR.exe
  C:\Windows\System\BeoFBGR.exe
  2⤵
  PID:7792
- C:\Windows\System\VbEFyOC.exe
  C:\Windows\System\VbEFyOC.exe
  2⤵
  PID:7644
- C:\Windows\System\EsjTijx.exe
  C:\Windows\System\EsjTijx.exe
  2⤵
  PID:7676
- C:\Windows\System\MnQyeFE.exe
  C:\Windows\System\MnQyeFE.exe
  2⤵
  PID:7756
- C:\Windows\System\YlGkykC.exe
  C:\Windows\System\YlGkykC.exe
  2⤵
  PID:7968
- C:\Windows\System\gQobuHs.exe
  C:\Windows\System\gQobuHs.exe
  2⤵
  PID:7692
- C:\Windows\System\lDLqhSC.exe
  C:\Windows\System\lDLqhSC.exe
  2⤵
  PID:7580
- C:\Windows\System\IKeVhis.exe
  C:\Windows\System\IKeVhis.exe
  2⤵
  PID:7896
- C:\Windows\System\fpvbnnu.exe
  C:\Windows\System\fpvbnnu.exe
  2⤵
  PID:7972
- C:\Windows\System\FGtvhuO.exe
  C:\Windows\System\FGtvhuO.exe
  2⤵
  PID:8148
- C:\Windows\System\BTKGdXB.exe
  C:\Windows\System\BTKGdXB.exe
  2⤵
  PID:7992
- C:\Windows\System\oOnShnG.exe
  C:\Windows\System\oOnShnG.exe
  2⤵
  PID:7388
- C:\Windows\System\rGuToee.exe
  C:\Windows\System\rGuToee.exe
  2⤵
  PID:7484
- C:\Windows\System\VxvqMjY.exe
  C:\Windows\System\VxvqMjY.exe
  2⤵
  PID:7600
- C:\Windows\System\xbzGecr.exe
  C:\Windows\System\xbzGecr.exe
  2⤵
  PID:8056
- C:\Windows\System\DiJWJal.exe
  C:\Windows\System\DiJWJal.exe
  2⤵
  PID:8080
- C:\Windows\System\cGtDnTR.exe
  C:\Windows\System\cGtDnTR.exe
  2⤵
  PID:7456
- C:\Windows\System\FqoZQvE.exe
  C:\Windows\System\FqoZQvE.exe
  2⤵
  PID:7524
- C:\Windows\System\KBsBYxX.exe
  C:\Windows\System\KBsBYxX.exe
  2⤵
  PID:7284
- C:\Windows\System\XxtqlPO.exe
  C:\Windows\System\XxtqlPO.exe
  2⤵
  PID:8040
- C:\Windows\System\NfBClAY.exe
  C:\Windows\System\NfBClAY.exe
  2⤵
  PID:7188
- C:\Windows\System\HRmQInP.exe
  C:\Windows\System\HRmQInP.exe
  2⤵
  PID:7316
- C:\Windows\System\wJVsuwU.exe
  C:\Windows\System\wJVsuwU.exe
  2⤵
  PID:7380
- C:\Windows\System\YeJFtto.exe
  C:\Windows\System\YeJFtto.exe
  2⤵
  PID:7936
- C:\Windows\System\DgXShRy.exe
  C:\Windows\System\DgXShRy.exe
  2⤵
  PID:8172
- C:\Windows\System\vjafCas.exe
  C:\Windows\System\vjafCas.exe
  2⤵
  PID:7476
- C:\Windows\System\qUwmIYr.exe
  C:\Windows\System\qUwmIYr.exe
  2⤵
  PID:7596
- C:\Windows\System\rCVpgvG.exe
  C:\Windows\System\rCVpgvG.exe
  2⤵
  PID:8216
- C:\Windows\System\towgnTs.exe
  C:\Windows\System\towgnTs.exe
  2⤵
  PID:8232
- C:\Windows\System\nQnEGpg.exe
  C:\Windows\System\nQnEGpg.exe
  2⤵
  PID:8248
- C:\Windows\System\WZRorkI.exe
  C:\Windows\System\WZRorkI.exe
  2⤵
  PID:8308
- C:\Windows\System\TsjkNFr.exe
  C:\Windows\System\TsjkNFr.exe
  2⤵
  PID:8324
- C:\Windows\System\Biwgeum.exe
  C:\Windows\System\Biwgeum.exe
  2⤵
  PID:8340
- C:\Windows\System\jXmMfWc.exe
  C:\Windows\System\jXmMfWc.exe
  2⤵
  PID:8356
- C:\Windows\System\xybNOSt.exe
  C:\Windows\System\xybNOSt.exe
  2⤵
  PID:8372
- C:\Windows\System\UpRlCNI.exe
  C:\Windows\System\UpRlCNI.exe
  2⤵
  PID:8388
- C:\Windows\System\voFFSNn.exe
  C:\Windows\System\voFFSNn.exe
  2⤵
  PID:8404
- C:\Windows\System\gFIpWtx.exe
  C:\Windows\System\gFIpWtx.exe
  2⤵
  PID:8536
- C:\Windows\System\yXrLTcL.exe
  C:\Windows\System\yXrLTcL.exe
  2⤵
  PID:8552
- C:\Windows\System\BhmuJIf.exe
  C:\Windows\System\BhmuJIf.exe
  2⤵
  PID:8572
- C:\Windows\System\hDzcTXA.exe
  C:\Windows\System\hDzcTXA.exe
  2⤵
  PID:8588
- C:\Windows\System\pXcaNuH.exe
  C:\Windows\System\pXcaNuH.exe
  2⤵
  PID:8604
- C:\Windows\System\tZfHobG.exe
  C:\Windows\System\tZfHobG.exe
  2⤵
  PID:8624
- C:\Windows\System\sZUjBMR.exe
  C:\Windows\System\sZUjBMR.exe
  2⤵
  PID:8640
- C:\Windows\System\xBKiEqC.exe
  C:\Windows\System\xBKiEqC.exe
  2⤵
  PID:8656
- C:\Windows\System\dLLelnC.exe
  C:\Windows\System\dLLelnC.exe
  2⤵
  PID:8672
- C:\Windows\System\RxnnCDS.exe
  C:\Windows\System\RxnnCDS.exe
  2⤵
  PID:8692
- C:\Windows\System\muwuBMt.exe
  C:\Windows\System\muwuBMt.exe
  2⤵
  PID:8916
- C:\Windows\System\mktlHUb.exe
  C:\Windows\System\mktlHUb.exe
  2⤵
  PID:8932
- C:\Windows\System\Ylmmgka.exe
  C:\Windows\System\Ylmmgka.exe
  2⤵
  PID:8952
- C:\Windows\System\PFCdrPZ.exe
  C:\Windows\System\PFCdrPZ.exe
  2⤵
  PID:8968
- C:\Windows\System\dXyRqBV.exe
  C:\Windows\System\dXyRqBV.exe
  2⤵
  PID:8984
- C:\Windows\System\nCejLQD.exe
  C:\Windows\System\nCejLQD.exe
  2⤵
  PID:9000
- C:\Windows\System\kaAulUL.exe
  C:\Windows\System\kaAulUL.exe
  2⤵
  PID:9084
- C:\Windows\System\HCSRLys.exe
  C:\Windows\System\HCSRLys.exe
  2⤵
  PID:9100
- C:\Windows\System\QVDtkpu.exe
  C:\Windows\System\QVDtkpu.exe
  2⤵
  PID:9116
- C:\Windows\System\oecAvfZ.exe
  C:\Windows\System\oecAvfZ.exe
  2⤵
  PID:9132
- C:\Windows\System\aXHoAsN.exe
  C:\Windows\System\aXHoAsN.exe
  2⤵
  PID:9148
- C:\Windows\System\EsEGUTp.exe
  C:\Windows\System\EsEGUTp.exe
  2⤵
  PID:9164
- C:\Windows\System\abuRyhf.exe
  C:\Windows\System\abuRyhf.exe
  2⤵
  PID:9180
- C:\Windows\System\qcDCyeM.exe
  C:\Windows\System\qcDCyeM.exe
  2⤵
  PID:9196
- C:\Windows\System\VJSQIPu.exe
  C:\Windows\System\VJSQIPu.exe
  2⤵
  PID:7528
- C:\Windows\System\FGLGNZD.exe
  C:\Windows\System\FGLGNZD.exe
  2⤵
  PID:7948
- C:\Windows\System\aZlYoqv.exe
  C:\Windows\System\aZlYoqv.exe
  2⤵
  PID:7492
- C:\Windows\System\JBHBTsg.exe
  C:\Windows\System\JBHBTsg.exe
  2⤵
  PID:8084
- C:\Windows\System\TiskcOk.exe
  C:\Windows\System\TiskcOk.exe
  2⤵
  PID:8260
- C:\Windows\System\XjzjZsr.exe
  C:\Windows\System\XjzjZsr.exe
  2⤵
  PID:7916
- C:\Windows\System\yUPzLju.exe
  C:\Windows\System\yUPzLju.exe
  2⤵
  PID:8264
- C:\Windows\System\TGykAmc.exe
  C:\Windows\System\TGykAmc.exe
  2⤵
  PID:8280
- C:\Windows\System\fcBxQCl.exe
  C:\Windows\System\fcBxQCl.exe
  2⤵
  PID:8296
- C:\Windows\System\JqnwbyW.exe
  C:\Windows\System\JqnwbyW.exe
  2⤵
  PID:8424
- C:\Windows\System\gIuMifY.exe
  C:\Windows\System\gIuMifY.exe
  2⤵
  PID:8368
- C:\Windows\System\cAmhWuH.exe
  C:\Windows\System\cAmhWuH.exe
  2⤵
  PID:8364
- C:\Windows\System\XrEiWSB.exe
  C:\Windows\System\XrEiWSB.exe
  2⤵
  PID:8448
- C:\Windows\System\fPENSfF.exe
  C:\Windows\System\fPENSfF.exe
  2⤵
  PID:8460
- C:\Windows\System\sTAplPD.exe
  C:\Windows\System\sTAplPD.exe
  2⤵
  PID:8476
- C:\Windows\System\lwvtxby.exe
  C:\Windows\System\lwvtxby.exe
  2⤵
  PID:8488
- C:\Windows\System\qACuZfR.exe
  C:\Windows\System\qACuZfR.exe
  2⤵
  PID:8512
- C:\Windows\System\NVcEPKS.exe
  C:\Windows\System\NVcEPKS.exe
  2⤵
  PID:8496
- C:\Windows\System\XvXNdkU.exe
  C:\Windows\System\XvXNdkU.exe
  2⤵
  PID:8584
- C:\Windows\System\vkPgNsS.exe
  C:\Windows\System\vkPgNsS.exe
  2⤵
  PID:8580
- C:\Windows\System\KIxxzSl.exe
  C:\Windows\System\KIxxzSl.exe
  2⤵
  PID:8652
- C:\Windows\System\KRAHzrH.exe
  C:\Windows\System\KRAHzrH.exe
  2⤵
  PID:8600
- C:\Windows\System\qDIdqWi.exe
  C:\Windows\System\qDIdqWi.exe
  2⤵
  PID:8564
- C:\Windows\System\mvGrRSF.exe
  C:\Windows\System\mvGrRSF.exe
  2⤵
  PID:8668
- C:\Windows\System\aXiyOxN.exe
  C:\Windows\System\aXiyOxN.exe
  2⤵
  PID:8716
- C:\Windows\System\yDanKUU.exe
  C:\Windows\System\yDanKUU.exe
  2⤵
  PID:8736
- C:\Windows\System\CWNsiIW.exe
  C:\Windows\System\CWNsiIW.exe
  2⤵
  PID:8756
- C:\Windows\System\XNNAmTX.exe
  C:\Windows\System\XNNAmTX.exe
  2⤵
  PID:8784
- C:\Windows\System\dtAkBMH.exe
  C:\Windows\System\dtAkBMH.exe
  2⤵
  PID:8804
- C:\Windows\System\maqVeVD.exe
  C:\Windows\System\maqVeVD.exe
  2⤵
  PID:8820
- C:\Windows\System\QuJwKGA.exe
  C:\Windows\System\QuJwKGA.exe
  2⤵
  PID:8840
- C:\Windows\System\RFBGVvO.exe
  C:\Windows\System\RFBGVvO.exe
  2⤵
  PID:8824
- C:\Windows\System\lPiemqG.exe
  C:\Windows\System\lPiemqG.exe
  2⤵
  PID:8868
- C:\Windows\System\eItUTfE.exe
  C:\Windows\System\eItUTfE.exe
  2⤵
  PID:8884
- C:\Windows\System\wXsuthz.exe
  C:\Windows\System\wXsuthz.exe
  2⤵
  PID:8996
- C:\Windows\System\jpGckhh.exe
  C:\Windows\System\jpGckhh.exe
  2⤵
  PID:9072
- C:\Windows\System\truACES.exe
  C:\Windows\System\truACES.exe
  2⤵
  PID:8976
- C:\Windows\System\BUVebmB.exe
  C:\Windows\System\BUVebmB.exe
  2⤵
  PID:9080
- C:\Windows\System\uxJbxbL.exe
  C:\Windows\System\uxJbxbL.exe
  2⤵
  PID:8892
- C:\Windows\System\yGaNNNm.exe
  C:\Windows\System\yGaNNNm.exe
  2⤵
  PID:8900
- C:\Windows\System\tlcNYtu.exe
  C:\Windows\System\tlcNYtu.exe
  2⤵
  PID:8908
- C:\Windows\System\dDHVmKU.exe
  C:\Windows\System\dDHVmKU.exe
  2⤵
  PID:9040
- C:\Windows\System\PKoKJRK.exe
  C:\Windows\System\PKoKJRK.exe
  2⤵
  PID:7512
- C:\Windows\System\bgEfcVf.exe
  C:\Windows\System\bgEfcVf.exe
  2⤵
  PID:8432
- C:\Windows\System\MAiuczu.exe
  C:\Windows\System\MAiuczu.exe
  2⤵
  PID:8320
- C:\Windows\System\GectwYG.exe
  C:\Windows\System\GectwYG.exe
  2⤵
  PID:8444
- C:\Windows\System\HycIYiG.exe
  C:\Windows\System\HycIYiG.exe
  2⤵
  PID:8468
- C:\Windows\System\JSVyIgN.exe
  C:\Windows\System\JSVyIgN.exe
  2⤵
  PID:8304
- C:\Windows\System\jhULTTA.exe
  C:\Windows\System\jhULTTA.exe
  2⤵
  PID:8380
- C:\Windows\System\DKCiixJ.exe
  C:\Windows\System\DKCiixJ.exe
  2⤵
  PID:8548
- C:\Windows\System\aABQtcx.exe
  C:\Windows\System\aABQtcx.exe
  2⤵
  PID:8704
- C:\Windows\System\EfKBkrw.exe
  C:\Windows\System\EfKBkrw.exe
  2⤵
  PID:8520
- C:\Windows\System\VlquESw.exe
  C:\Windows\System\VlquESw.exe
  2⤵
  PID:8560
- C:\Windows\System\QvjbIkL.exe
  C:\Windows\System\QvjbIkL.exe
  2⤵
  PID:8796
- C:\Windows\System\sbJIJDj.exe
  C:\Windows\System\sbJIJDj.exe
  2⤵
  PID:8852
- C:\Windows\System\EITgvAi.exe
  C:\Windows\System\EITgvAi.exe
  2⤵
  PID:8856
- C:\Windows\System\VVjvOjJ.exe
  C:\Windows\System\VVjvOjJ.exe
  2⤵
  PID:8964
- C:\Windows\System\ZBrzLAx.exe
  C:\Windows\System\ZBrzLAx.exe
  2⤵
  PID:9024
- C:\Windows\System\wYNGrpc.exe
  C:\Windows\System\wYNGrpc.exe
  2⤵
  PID:8904
- C:\Windows\System\dhaPSVo.exe
  C:\Windows\System\dhaPSVo.exe
  2⤵
  PID:8284
- C:\Windows\System\txTHpeY.exe
  C:\Windows\System\txTHpeY.exe
  2⤵
  PID:8256
- C:\Windows\System\fyKztig.exe
  C:\Windows\System\fyKztig.exe
  2⤵
  PID:9036
- C:\Windows\System\JkxfYqh.exe
  C:\Windows\System\JkxfYqh.exe
  2⤵
  PID:9156
- C:\Windows\System\UQKRbSi.exe
  C:\Windows\System\UQKRbSi.exe
  2⤵
  PID:9044
- C:\Windows\System\UyqGqXS.exe
  C:\Windows\System\UyqGqXS.exe
  2⤵
  PID:7884
- C:\Windows\System\vYhMQPy.exe
  C:\Windows\System\vYhMQPy.exe
  2⤵
  PID:8612
- C:\Windows\System\aBtxQVI.exe
  C:\Windows\System\aBtxQVI.exe
  2⤵
  PID:8688
- C:\Windows\System\mJcbVkE.exe
  C:\Windows\System\mJcbVkE.exe
  2⤵
  PID:8764
- C:\Windows\System\VHMzEyv.exe
  C:\Windows\System\VHMzEyv.exe
  2⤵
  PID:8276
- C:\Windows\System\gYSZrvA.exe
  C:\Windows\System\gYSZrvA.exe
  2⤵
  PID:8744
- C:\Windows\System\czsasAg.exe
  C:\Windows\System\czsasAg.exe
  2⤵
  PID:8844
- C:\Windows\System\IaXUQJw.exe
  C:\Windows\System\IaXUQJw.exe
  2⤵
  PID:9068
- C:\Windows\System\uUVFGjG.exe
  C:\Windows\System\uUVFGjG.exe
  2⤵
  PID:8708
- C:\Windows\System\bHLiKSp.exe
  C:\Windows\System\bHLiKSp.exe
  2⤵
  PID:8636
- C:\Windows\System\wkiikTb.exe
  C:\Windows\System\wkiikTb.exe
  2⤵
  PID:7620
- C:\Windows\System\GPICFYU.exe
  C:\Windows\System\GPICFYU.exe
  2⤵
  PID:8728
- C:\Windows\System\QAJwcjy.exe
  C:\Windows\System\QAJwcjy.exe
  2⤵
  PID:9204
- C:\Windows\System\GUUrmxR.exe
  C:\Windows\System\GUUrmxR.exe
  2⤵
  PID:7192
- C:\Windows\System\CBvNcpY.exe
  C:\Windows\System\CBvNcpY.exe
  2⤵
  PID:8568
- C:\Windows\System\rEATcNo.exe
  C:\Windows\System\rEATcNo.exe
  2⤵
  PID:7532
- C:\Windows\System\YIoUtax.exe
  C:\Windows\System\YIoUtax.exe
  2⤵
  PID:8772
- C:\Windows\System\UmuWmMb.exe
  C:\Windows\System\UmuWmMb.exe
  2⤵
  PID:8400
- C:\Windows\System\rTEkqzE.exe
  C:\Windows\System\rTEkqzE.exe
  2⤵
  PID:8456
- C:\Windows\System\EPTOFYC.exe
  C:\Windows\System\EPTOFYC.exe
  2⤵
  PID:9236
- C:\Windows\System\HmehszM.exe
  C:\Windows\System\HmehszM.exe
  2⤵
  PID:9252
- C:\Windows\System\QVCmxfa.exe
  C:\Windows\System\QVCmxfa.exe
  2⤵
  PID:9268
- C:\Windows\System\uuRFKsZ.exe
  C:\Windows\System\uuRFKsZ.exe
  2⤵
  PID:9284
- C:\Windows\System\THwEWph.exe
  C:\Windows\System\THwEWph.exe
  2⤵
  PID:9300
- C:\Windows\System\SLciCen.exe
  C:\Windows\System\SLciCen.exe
  2⤵
  PID:9316
- C:\Windows\System\QoTdyRK.exe
  C:\Windows\System\QoTdyRK.exe
  2⤵
  PID:9336
- C:\Windows\System\LlJKcAv.exe
  C:\Windows\System\LlJKcAv.exe
  2⤵
  PID:9352
- C:\Windows\System\VycgioY.exe
  C:\Windows\System\VycgioY.exe
  2⤵
  PID:9368
- C:\Windows\System\xWacRmF.exe
  C:\Windows\System\xWacRmF.exe
  2⤵
  PID:9384
- C:\Windows\System\PgzwmtK.exe
  C:\Windows\System\PgzwmtK.exe
  2⤵
  PID:9400
- C:\Windows\System\hPrtztO.exe
  C:\Windows\System\hPrtztO.exe
  2⤵
  PID:9420
- C:\Windows\System\gxqwwIz.exe
  C:\Windows\System\gxqwwIz.exe
  2⤵
  PID:9436
- C:\Windows\System\ZzjlqZZ.exe
  C:\Windows\System\ZzjlqZZ.exe
  2⤵
  PID:9452
- C:\Windows\System\kZYQcKy.exe
  C:\Windows\System\kZYQcKy.exe
  2⤵
  PID:9468
- C:\Windows\System\hcEjxCW.exe
  C:\Windows\System\hcEjxCW.exe
  2⤵
  PID:9488
- C:\Windows\System\SleEuHU.exe
  C:\Windows\System\SleEuHU.exe
  2⤵
  PID:9504
- C:\Windows\System\aOSiyTj.exe
  C:\Windows\System\aOSiyTj.exe
  2⤵
  PID:9520
- C:\Windows\System\inVZKkp.exe
  C:\Windows\System\inVZKkp.exe
  2⤵
  PID:9536
- C:\Windows\System\deUDrHf.exe
  C:\Windows\System\deUDrHf.exe
  2⤵
  PID:9556
- C:\Windows\System\fvuFNCj.exe
  C:\Windows\System\fvuFNCj.exe
  2⤵
  PID:9572
- C:\Windows\System\LhnwCwD.exe
  C:\Windows\System\LhnwCwD.exe
  2⤵
  PID:9588
- C:\Windows\System\kRfGGds.exe
  C:\Windows\System\kRfGGds.exe
  2⤵
  PID:9608
- C:\Windows\System\UmWelaj.exe
  C:\Windows\System\UmWelaj.exe
  2⤵
  PID:9624
- C:\Windows\System\GSnIcrG.exe
  C:\Windows\System\GSnIcrG.exe
  2⤵
  PID:9640
- C:\Windows\System\WTAGJky.exe
  C:\Windows\System\WTAGJky.exe
  2⤵
  PID:9656
- C:\Windows\System\fzrxznD.exe
  C:\Windows\System\fzrxznD.exe
  2⤵
  PID:9676
- C:\Windows\System\LUeEbhz.exe
  C:\Windows\System\LUeEbhz.exe
  2⤵
  PID:9692
- C:\Windows\System\MegxBGm.exe
  C:\Windows\System\MegxBGm.exe
  2⤵
  PID:9712
- C:\Windows\System\SWXFltb.exe
  C:\Windows\System\SWXFltb.exe
  2⤵
  PID:9728
- C:\Windows\System\TyOCzLd.exe
  C:\Windows\System\TyOCzLd.exe
  2⤵
  PID:9744
- C:\Windows\System\ZFHLndy.exe
  C:\Windows\System\ZFHLndy.exe
  2⤵
  PID:9760
- C:\Windows\System\wZViIIY.exe
  C:\Windows\System\wZViIIY.exe
  2⤵
  PID:9780
- C:\Windows\System\APziqZs.exe
  C:\Windows\System\APziqZs.exe
  2⤵
  PID:9796
- C:\Windows\System\uxujvvF.exe
  C:\Windows\System\uxujvvF.exe
  2⤵
  PID:9812
- C:\Windows\System\hMXFrQR.exe
  C:\Windows\System\hMXFrQR.exe
  2⤵
  PID:9832
- C:\Windows\System\wkFddZb.exe
  C:\Windows\System\wkFddZb.exe
  2⤵
  PID:9848
- C:\Windows\System\DZwSmNT.exe
  C:\Windows\System\DZwSmNT.exe
  2⤵
  PID:9864
- C:\Windows\System\anUNrnM.exe
  C:\Windows\System\anUNrnM.exe
  2⤵
  PID:9884
- C:\Windows\System\fqbhodw.exe
  C:\Windows\System\fqbhodw.exe
  2⤵
  PID:9900
- C:\Windows\System\PZKDTRj.exe
  C:\Windows\System\PZKDTRj.exe
  2⤵
  PID:9916
- C:\Windows\System\DlkNccg.exe
  C:\Windows\System\DlkNccg.exe
  2⤵
  PID:9936
- C:\Windows\System\iABNlzk.exe
  C:\Windows\System\iABNlzk.exe
  2⤵
  PID:9960
- C:\Windows\System\htWzRWH.exe
  C:\Windows\System\htWzRWH.exe
  2⤵
  PID:9976
- C:\Windows\System\ZvmRAcu.exe
  C:\Windows\System\ZvmRAcu.exe
  2⤵
  PID:10004
- C:\Windows\System\UAdCrxu.exe
  C:\Windows\System\UAdCrxu.exe
  2⤵
  PID:10032
- C:\Windows\System\PNeKHXD.exe
  C:\Windows\System\PNeKHXD.exe
  2⤵
  PID:10052
- C:\Windows\System\WANqdsA.exe
  C:\Windows\System\WANqdsA.exe
  2⤵
  PID:10068
- C:\Windows\System\TJoTiGT.exe
  C:\Windows\System\TJoTiGT.exe
  2⤵
  PID:10084
- C:\Windows\System\CYsGEbB.exe
  C:\Windows\System\CYsGEbB.exe
  2⤵
  PID:10112
- C:\Windows\System\RleZAJC.exe
  C:\Windows\System\RleZAJC.exe
  2⤵
  PID:10128
- C:\Windows\System\ouHqzsR.exe
  C:\Windows\System\ouHqzsR.exe
  2⤵
  PID:10144
- C:\Windows\System\yozIhQn.exe
  C:\Windows\System\yozIhQn.exe
  2⤵
  PID:10160
- C:\Windows\System\WZbObzj.exe
  C:\Windows\System\WZbObzj.exe
  2⤵
  PID:10176
- C:\Windows\System\BLHbGHK.exe
  C:\Windows\System\BLHbGHK.exe
  2⤵
  PID:10192
- C:\Windows\System\KLfYzBr.exe
  C:\Windows\System\KLfYzBr.exe
  2⤵
  PID:10208
- C:\Windows\System\RzEUCRh.exe
  C:\Windows\System\RzEUCRh.exe
  2⤵
  PID:10224
- C:\Windows\System\giZezdV.exe
  C:\Windows\System\giZezdV.exe
  2⤵
  PID:8352
- C:\Windows\System\diiaoKi.exe
  C:\Windows\System\diiaoKi.exe
  2⤵
  PID:9160
- C:\Windows\System\VzFEFud.exe
  C:\Windows\System\VzFEFud.exe
  2⤵
  PID:8944
- C:\Windows\System\jASgAnc.exe
  C:\Windows\System\jASgAnc.exe
  2⤵
  PID:9276
- C:\Windows\System\TQoLMDi.exe
  C:\Windows\System\TQoLMDi.exe
  2⤵
  PID:8800
- C:\Windows\System\SijrKTO.exe
  C:\Windows\System\SijrKTO.exe
  2⤵
  PID:8544
- C:\Windows\System\FFNawqj.exe
  C:\Windows\System\FFNawqj.exe
  2⤵
  PID:8740
- C:\Windows\System\GqMuZum.exe
  C:\Windows\System\GqMuZum.exe
  2⤵
  PID:8212
- C:\Windows\System\ednpGgx.exe
  C:\Windows\System\ednpGgx.exe
  2⤵
  PID:9264
- C:\Windows\System\rrGLmxa.exe
  C:\Windows\System\rrGLmxa.exe
  2⤵
  PID:8244
- C:\Windows\System\HpUGKIN.exe
  C:\Windows\System\HpUGKIN.exe
  2⤵
  PID:9344
- C:\Windows\System\TxSlUgr.exe
  C:\Windows\System\TxSlUgr.exe
  2⤵
  PID:9408
- C:\Windows\System\KLwoylC.exe
  C:\Windows\System\KLwoylC.exe
  2⤵
  PID:9448
- C:\Windows\System\ogYPzar.exe
  C:\Windows\System\ogYPzar.exe
  2⤵
  PID:9324
- C:\Windows\System\XKtQHgK.exe
  C:\Windows\System\XKtQHgK.exe
  2⤵
  PID:9544
- C:\Windows\System\XkxFyrd.exe
  C:\Windows\System\XkxFyrd.exe
  2⤵
  PID:9548
- C:\Windows\System\ZmMgqtp.exe
  C:\Windows\System\ZmMgqtp.exe
  2⤵
  PID:9584
- C:\Windows\System\ZTNJecK.exe
  C:\Windows\System\ZTNJecK.exe
  2⤵
  PID:9396
- C:\Windows\System\IxbAANc.exe
  C:\Windows\System\IxbAANc.exe
  2⤵
  PID:9620
- C:\Windows\System\jXUNUti.exe
  C:\Windows\System\jXUNUti.exe
  2⤵
  PID:9528
- C:\Windows\System\iHrllXr.exe
  C:\Windows\System\iHrllXr.exe
  2⤵
  PID:9720
- C:\Windows\System\uVbjVaG.exe
  C:\Windows\System\uVbjVaG.exe
  2⤵
  PID:9724
- C:\Windows\System\EgVwfzq.exe
  C:\Windows\System\EgVwfzq.exe
  2⤵
  PID:9604
- C:\Windows\System\GdBPOzs.exe
  C:\Windows\System\GdBPOzs.exe
  2⤵
  PID:9788
- C:\Windows\System\jUexjue.exe
  C:\Windows\System\jUexjue.exe
  2⤵
  PID:9820
- C:\Windows\System\gKuNdWt.exe
  C:\Windows\System\gKuNdWt.exe
  2⤵
  PID:9708
- C:\Windows\System\RrAoImb.exe
  C:\Windows\System\RrAoImb.exe
  2⤵
  PID:9740
- C:\Windows\System\YSXJLrf.exe
  C:\Windows\System\YSXJLrf.exe
  2⤵
  PID:9776
- C:\Windows\System\aTQAqBM.exe
  C:\Windows\System\aTQAqBM.exe
  2⤵
  PID:9808
- C:\Windows\System\lHPPSkm.exe
  C:\Windows\System\lHPPSkm.exe
  2⤵
  PID:9928
- C:\Windows\System\McIqbwu.exe
  C:\Windows\System\McIqbwu.exe
  2⤵
  PID:9908
- C:\Windows\System\JQwnnTZ.exe
  C:\Windows\System\JQwnnTZ.exe
  2⤵
  PID:9952
- C:\Windows\System\UNeqGSM.exe
  C:\Windows\System\UNeqGSM.exe
  2⤵
  PID:9972
- C:\Windows\System\pdsfuKv.exe
  C:\Windows\System\pdsfuKv.exe
  2⤵
  PID:10000
- C:\Windows\System\MDXhEEs.exe
  C:\Windows\System\MDXhEEs.exe
  2⤵
  PID:10028
- C:\Windows\System\WtoYzgm.exe
  C:\Windows\System\WtoYzgm.exe
  2⤵
  PID:10092
- C:\Windows\System\mBMJpJF.exe
  C:\Windows\System\mBMJpJF.exe
  2⤵
  PID:10096
- C:\Windows\System\LlVVNGX.exe
  C:\Windows\System\LlVVNGX.exe
  2⤵
  PID:10080
- C:\Windows\System\ExowuSW.exe
  C:\Windows\System\ExowuSW.exe
  2⤵
  PID:10168
- C:\Windows\System\slmlrrZ.exe
  C:\Windows\System\slmlrrZ.exe
  2⤵
  PID:10200
- C:\Windows\System\AskxoAn.exe
  C:\Windows\System\AskxoAn.exe
  2⤵
  PID:10156
- C:\Windows\System\mdvBWhb.exe
  C:\Windows\System\mdvBWhb.exe
  2⤵
  PID:10184
- C:\Windows\System\ulHIAwy.exe
  C:\Windows\System\ulHIAwy.exe
  2⤵
  PID:9224
- C:\Windows\System\MLvFYeC.exe
  C:\Windows\System\MLvFYeC.exe
  2⤵
  PID:9228
- C:\Windows\System\nBMjeqe.exe
  C:\Windows\System\nBMjeqe.exe
  2⤵
  PID:8896
- C:\Windows\System\KwSviOS.exe
  C:\Windows\System\KwSviOS.exe
  2⤵
  PID:9292
- C:\Windows\System\tzOhmmR.exe
  C:\Windows\System\tzOhmmR.exe
  2⤵
  PID:8960
- C:\Windows\System\WFxNEMK.exe
  C:\Windows\System\WFxNEMK.exe
  2⤵
  PID:9444
- C:\Windows\System\oEQiPYT.exe
  C:\Windows\System\oEQiPYT.exe
  2⤵
  PID:9332
- C:\Windows\System\XQvRUHs.exe
  C:\Windows\System\XQvRUHs.exe
  2⤵
  PID:9432
- C:\Windows\System\jvpEFMh.exe
  C:\Windows\System\jvpEFMh.exe
  2⤵
  PID:9652
- C:\Windows\System\hkZkbJI.exe
  C:\Windows\System\hkZkbJI.exe
  2⤵
  PID:9756
- C:\Windows\System\RzdvQXv.exe
  C:\Windows\System\RzdvQXv.exe
  2⤵
  PID:9596
- C:\Windows\System\esEHzPS.exe
  C:\Windows\System\esEHzPS.exe
  2⤵
  PID:9636
- C:\Windows\System\lNmbTkl.exe
  C:\Windows\System\lNmbTkl.exe
  2⤵
  PID:9840
- C:\Windows\System\KtloyMK.exe
  C:\Windows\System\KtloyMK.exe
  2⤵
  PID:9844
- C:\Windows\System\KSwgyoV.exe
  C:\Windows\System\KSwgyoV.exe
  2⤵
  PID:9932
- C:\Windows\System\oSRGBao.exe
  C:\Windows\System\oSRGBao.exe
  2⤵
  PID:10024
- C:\Windows\System\NJRsmOH.exe
  C:\Windows\System\NJRsmOH.exe
  2⤵
  PID:10140
- C:\Windows\System\aRgvbfH.exe
  C:\Windows\System\aRgvbfH.exe
  2⤵
  PID:8204
- C:\Windows\System\QTHpPld.exe
  C:\Windows\System\QTHpPld.exe
  2⤵
  PID:9308
- C:\Windows\System\SFHUnYV.exe
  C:\Windows\System\SFHUnYV.exe
  2⤵
  PID:9616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CBEdIMZ.exe

Filesize
1.4MB

MD5
f64e2d954c595c155beaaa2e422d4dfd

SHA1
6b7847708ab06b815c7a27bfd29fc80a902a6f63

SHA256
9bcc609fcf1fdc061ad7480726dfbc91506a2a97f8ac6df52ea887f150163e87

SHA512
f68ed49f313ba5c4766b2c1366d02c0f3d1480fa9937fee6cba10f2810dc6bec1698d010c0d326b166333251290ee4b62601d3f1a9fe8498d0b21a0a01a70958

Download Submit
C:\Windows\system\CGmKKbP.exe

Filesize
1.4MB

MD5
6a350f33864b8f36d854dd4bea6bece5

SHA1
092ff82ca8f75a750d7a80f371f2c9fc68e55061

SHA256
d2acd098cdffb514fc1af9a612a9f570684bdd3d5413d9b4fc7c7103df705a5e

SHA512
ea646ecc46396de6ac97cdef1a94805cc5373391c233585e9c64e75d62d0c9fd79a1649c2077dd2bff7a2c31ac4e6ee96f713cad33e93bdf67da5ef0b556e77e

Download Submit
C:\Windows\system\DLrQCkX.exe

Filesize
1.4MB

MD5
bde0ec5b2e16da3517edc40391e21904

SHA1
c19ac1145a50784edc7de56223e16b147cb90b3d

SHA256
41ba9df3a43c71758dd7a85cfa79f1a28a4a67472d4e9a3be75a6871e5c04761

SHA512
9d79cbfe6a059f4aa8fbe1031ac3294b708640cc12ecd7fefc5e3d821d9b78946c946b92a9cd3498f71e0bfffd1a6e9ca8fce4b94b73536feb346006444832c5

Download Submit
C:\Windows\system\DYREkVa.exe

Filesize
1.4MB

MD5
7d7a9447f509ab86ed2ef7e4333f5bde

SHA1
f53e6ae55f00703aea164baecaecb7db018665f4

SHA256
1a037951e1c982778d5854be16882388bf927e16f48c6386b1f8391b658cef4d

SHA512
d0524b48f5895b34df9900fafdbb2204b4c526ec6bfae1869075a2ed5c97bdd41c98977b1ce5c1cc929cf99d243da91fd864c4328986f8004f2a8b46657bee73

Download Submit
C:\Windows\system\DhhvDWy.exe

Filesize
1.4MB

MD5
e3cf97e4e0dbc98d6bc2e72388dc5a74

SHA1
fdfdecdf686906b3c8da28d6f248c65cea84c0f5

SHA256
2a5b91f0446765805057b3ac688a1a4b6ce701681b8d2dfec730030d2a3d0df6

SHA512
8969b4d93dc6aabbc8e737953ec805852e5c0307291fa49e201463dd3021b92e44a980e976bf13905b94214215e7ccd8e6637b733fa1d8f15600fba93cf621c1

Download Submit
C:\Windows\system\FIBcVhV.exe

Filesize
1.4MB

MD5
cf934be72246f10a9023869a2cb5f700

SHA1
ab1857deb1e3e23a8c7bab1db33ee77869465bac

SHA256
8f4e59c673efe60393c8cc80f3019a7fca8652505e147582fd70c5ee8315e90b

SHA512
1303edd6166b329123ce74bef872ce303dffc28651f83696be5009edc88526b66b8ff0122a94857ca42bad741cb821ed72a2c35fe821cb376e0d8b5a0f096dc2

Download Submit
C:\Windows\system\GXoqngA.exe

Filesize
1.4MB

MD5
431990658cc8d0c8ebca5c7d4771a24f

SHA1
8acac8f9ef3b8a5168b31fefa915fbc44c12b178

SHA256
490b44f06fe0318cc933832f9ca9d037891e43c29e7d95cd70f70e4c5a80e6a5

SHA512
6f01c07303efca3bb51ce1387f3146cfeb8a5340ec1d1eda58773a6f39c3649f0424350d393f0441ba05bed1b0cf0bc9da729b3975b39602ef72fa7ab71bcccb

Download Submit
C:\Windows\system\IPHyvtp.exe

Filesize
1.4MB

MD5
099e9323e7f331cdfdeed43819b0e2fe

SHA1
44420e51c76e823fc78a35eb8d05806cc9349919

SHA256
dbf8e3de63b041bbbb512fe8042d19aeee418a34015f3e283d2b07ca97c5ddbc

SHA512
684225392d211bd41045867a3eb557b66f351cb8ffbb3f50509f2c0a9b8bf19759930fdce75967743cbe3109bdf3c8b841856448a9b9b2394f52bda90ac880c9

Download Submit
C:\Windows\system\JWrKDUy.exe

Filesize
1.4MB

MD5
8ea7c695b27b5901f7e83106f5cc3dfe

SHA1
564a59774ca7c4f9fb9efd6fbe928f5f162160e2

SHA256
fb5486ea354a30f870938ce97cd6698b92db78f91bb92120c3083b9d8c5933e0

SHA512
d6a8744ad8e1a13fb0eee9846f8c90da86c4860e1984e06bee2e961ccbe1e5f50e03a548ceb87d8a3acb899e0be20af66859d6a313cebdd6a220fb5352e14e93

Download Submit
C:\Windows\system\KAnfwdW.exe

Filesize
1.4MB

MD5
f373fbb31170afd431671ecc5b2ef23f

SHA1
7e6e5a1f71b6d4074e53f0567ae87797e89d846c

SHA256
8f9adae38623e24b4e42b2a557839296c332adcd83700b1d541da4e7afad5d2e

SHA512
9b847ca11faa61add0a0395c6bcec846201f04db87996d65c0f2840779365abc5fd327f2211017a917bab1d08c1e7c8e68e2ba2df130fdaeaecb49ed7ff5ab1e

Download Submit
C:\Windows\system\PeNOhKQ.exe

Filesize
1.4MB

MD5
db1b52671e5e0cb804595121b5611c66

SHA1
f9e982456dbdc1f5e265d526a2cb5b3a18e739cd

SHA256
afcc8d0b8ae05c499793f0ceb2c32d47e1dfaae841a75aee9498e252ace83a0c

SHA512
d280209740fb8c159f1a8b9fe230f1c367437284dfc4d63ddcc58741a1b895f6c19f22e5d58451e13a959377b356b28b08e39897821a23ffd9bb4959b941b42f

Download Submit
C:\Windows\system\SCAQqPL.exe

Filesize
1.4MB

MD5
688c491f420aef2d29b816730dc05a5e

SHA1
9b6d1f48cbf4c0f97b7fe36712d446874fc10137

SHA256
22ad16b290378e1baa151656e0e76677842b024e19866bd348d3ccf546d75f59

SHA512
5c26e320d684905e2e99f94f693f2abd63484702f7141e4f890583e4bade35cb8f2d128e9725fadeb41f109b1b810e5a74625ade8923524e313d518ca3f36c7a

Download Submit
C:\Windows\system\TLzoErw.exe

Filesize
1.4MB

MD5
3f87bc0624363ff5f8b718283cd2997b

SHA1
49c6f95affa225de6439f4af81f2ff23764ab4b4

SHA256
48fffbe64f3b73cec1a1a7ba17d39e8d6782053b7513fbdae9d1c4167ab30289

SHA512
b1806f892bb343dbdfcf7a0ea6cecdae448b1a42883d0e50ea768b2dfddadf915667d288d8bb86869eb3a19a3a9d8118112ea00c9abfb698baa962cc1a7f896c

Download Submit
C:\Windows\system\WRvpdzC.exe

Filesize
1.4MB

MD5
0980d589cb0dec0e766fd2fe922f138d

SHA1
f97e8ef6d1944a3c03ea3b22e8e22989d7f3a9c7

SHA256
6af028b69b983ad8b409b5556ebaf6fb9d21268396e3ecfea4766acc432fce3d

SHA512
61f21ff2268044b0e2f1fd2eadba3c398bd145c88b82787320547de84576a45b84466e025ac1a676ce7d0d6d5db918e7c5cbc92acc4fb7f2543983e0d633ece6

Download Submit
C:\Windows\system\aaDpPJq.exe

Filesize
1.3MB

MD5
c8d0062344f8cb35ef3e87ec18436a0e

SHA1
31dc4e387a88be537c4832b0a51bb3df1a9e45fb

SHA256
806159195650289acb39600c50a390154d50f0fae74cea1ae613bcca03c13507

SHA512
368df6187318702d80a2be1a819c972a8abc51dc82dcaa3793ee487c5604709ad220a80579b2ec2de6c204a6e61fe732c133631088d7e0e2e8484a664e4b45f2

Download Submit
C:\Windows\system\crYHvHh.exe

Filesize
1.4MB

MD5
e38be08760180ba2ec843e2070e3b77b

SHA1
1ddc35a061b4f8f77957f967c891869ef84e1917

SHA256
de51d0034fea443945702d16489dea10abb149a942e4f2c877253826d9bdada9

SHA512
278b1da495c2fbe54705945029bdfcbc1f5dda5dbacd8392fc6d63b46a0faf8d952c5d2f685df0e760c621fb6cd00cbc42bc90251d10d65c91833fdfc37f4b26

Download Submit
C:\Windows\system\fRIafeN.exe

Filesize
1.4MB

MD5
ef0151e21afeb8b298f5a6897136808b

SHA1
76cb5bf490447343a12cbfd82950e19d750954fc

SHA256
47b44e5641d0a02c187a7ac3c224b9cba87311def4e6cf4195ff15fa3937cc40

SHA512
e98231c64548008568330a88b352d34add34e1e4d24c899a322f3d676adccbf1089de1c23cb913e3040860d1ff5577469c004b72e2c8c1ebca416652ebab4788

Download Submit
C:\Windows\system\hGUgKDF.exe

Filesize
1.4MB

MD5
2d165c9f37cbc018bf638a21c71af353

SHA1
76f4616a1bbd2b46e86e903c2f83daa7e2f1e102

SHA256
e63fbab56dfafb964410983a0ab723f8e7b71b488971a82d86a568772439d77c

SHA512
a9096bc2ab13f106d24369f237f5a812a15d54d2b7e3b0f16009c9de885a2ef0d916ae840e2286b7e9c06a4fb7f8dd44ee07c9cd355be550ff0f32ce5ce5f185

Download Submit
C:\Windows\system\hrHwOUp.exe

Filesize
1.4MB

MD5
561bebc7738036df5d1a17f843154896

SHA1
1b46b99c9588c33a3adb7fab1d768f7c0955d401

SHA256
a1067610fdae5733722ae7df101b44b1101436ea6b4812cbc9ca5ba3fcb0a4f3

SHA512
32f5fd3d7bc84063ef077d8f24b44c4ebcc5794b756cb57d3cb330c535cb5dbfad03edb604c34fe79f235b538f091bdbd044386a1aaa9a4bbf31a5db352f18ce

Download Submit
C:\Windows\system\hviOfRS.exe

Filesize
1.4MB

MD5
46b1f7bb148db2a2f261c10297c9da4d

SHA1
4511e6728f99e93cd7bbce8e1bac0f679a600d97

SHA256
86491bead1c2a83384f778c38c02ab37ffcb2a425e659fd2af9e2a31db8390aa

SHA512
90c3cb921acf5a8d40bb0475ea73e1058db36612012fa27155a9c91148d09dd5b2f7b732a76c11d9d6f962878ba7d74554bb21b1e58d58a6bcd3e58d69fae7b1

Download Submit
C:\Windows\system\qYrMBHo.exe

Filesize
1.4MB

MD5
57b2709080a0d4f64bd912e2d75b7b03

SHA1
b55bab3f766359ed0091846692d1e325ba6ad68d

SHA256
9efcd2a770b6dcc95dc5b23d1fc45c3a0342e717aad242c8b37931ed2d9b3b81

SHA512
505eb6df4143a22eafb45397af9b7cb954106be041b4e8e1e48bae23e55b0d1ba282a6207db4f9bb1a58b22a5664ab241dd693f3b48c4fb7a27405eb6589c367

Download Submit
C:\Windows\system\qlsCLmq.exe

Filesize
1.4MB

MD5
a4a6efbfc10ec22271046b94a2766e75

SHA1
135341f2eec576900d723d757dbe668f57f027e7

SHA256
7e8be5d9dd4e717155757f455551a3f5345b5ebe8bca38b46b673c6f1b140d56

SHA512
36aa0c93150bd7707d844e840771a5540e56f56834635a11333af6e959eb4ec7a442ccf19bb209d7a72ac30ebf7e53fa55c2fd43f2ffaea050b80b780ff328f0

Download Submit
C:\Windows\system\rUShrLW.exe

Filesize
1.4MB

MD5
2ebda920724dfa1be5c396d8f559ef66

SHA1
6cf03ef4ee0234f01d01b3dc8ff29f7a3f07070e

SHA256
180c85e6833c0cecb3ec7913439453af6c6c6bddde232e52af5cf4488e8e3cb7

SHA512
7164edaf67ae88ce63ae556e5b259552c6fabe901cd66514e23ccf7bdb7b786699eb99b4d5565f84ff0dffe5b949c74d783561c3c041244ca1729cac829ff391

Download Submit
C:\Windows\system\tAspJix.exe

Filesize
1.4MB

MD5
62a9fcc0c69da0edd03652f216ad548f

SHA1
1b39121a8bee28a4b64091df30625e68eb055b49

SHA256
3de5f4738b327b564a1fc33ca27f32407af9410d10f139af7baa527c3a401b4f

SHA512
748a530eb4012b7b8866240070ea5ba39a7ef2d1fd75107f21a623c3691d2061d246297f6c9d613b00cfef975a85d25d0cff880eb4fac817190253a4a8807c78

Download Submit
C:\Windows\system\tHYHfRX.exe

Filesize
1.4MB

MD5
62f5609142e580bf2857bfa4b82bd8b6

SHA1
074232cefa4969a96de3be1fc4188aaea7e7b9b7

SHA256
196a2593813a1e690ae20f349737accb2a472007e74ede7486252ab6fd9916d2

SHA512
99f13637a519ec592bdcebd78454c812f73cd03769bd745b3129cecebfea569cb6fcb2685610ff4481594eddf9e441997f2f7effa051757bd2a1aa876a0c5bdd

Download Submit
C:\Windows\system\ucxXIYz.exe

Filesize
1.4MB

MD5
98813c89d36f1e3c5dc97e61ac613248

SHA1
565492001b8f4b3455b8673b71066da8fa5e2168

SHA256
939939ba363129f2ada6210cd0700e6b66ccfc1554a533aeb2ff3bd7958de44b

SHA512
9f6ae63148dc1ac9e08a4b9d40384eeb0ac652901f6b20f0126ca69bea0f2f19dbf78d1ba87b4de1cfd10530837acb8d1c6737981223467d52d347e352156c6a

Download Submit
C:\Windows\system\wceKAQt.exe

Filesize
1.4MB

MD5
0a598519b57de87898fca9383460c110

SHA1
7b115837ed1d6cf07045f59ee22d01727e4cac67

SHA256
ab245d82ae68919b406cbb0f0b61850bc7f58a3e23b82ec29f60910bae99f9ea

SHA512
44f89150071708d9489abd70d368b3cd588baa95a5560df3e6aec932860ea2dcb949a7ce5f935a430e3e55e2af32f1130df0b8f698aea265602848c6212b781c

Download Submit
C:\Windows\system\xwnUeQS.exe

Filesize
1.4MB

MD5
2b770c1a8b0607818c3b17ef0897cafc

SHA1
cf5b6ccecee7d62b5d8e3ac3a90e8c8ba1f2afd6

SHA256
edeced1eaa101c5fdaa99262e1e08bebafd4f0292d5bf50491d260a990b0b719

SHA512
67b47ae84e495946d8f3b593f57d7d1da8f246080b971ff67d36acf1bbc98bf23d7759377f021d980a0c37d575b5697968c04d197cde2e78a0d075577a969783

Download Submit
C:\Windows\system\ygqWEJb.exe

Filesize
1.4MB

MD5
464033bbb226891c8d3e42a882e1820d

SHA1
491e6afdd474b823b54fbc8addc864a3e9045e34

SHA256
37754b35689268fc524a86eff7484705707fca9f2a494893c93d91fd9d13eca5

SHA512
345a27c4ebb355be1e0bf76d36ce7f442bb99e99eaa7bcc4f43a9c389490d66a4c576db102d203b17db041903d63aa58264591eb6017017f35980e456ea3ee85

Download Submit
C:\Windows\system\znBnCeU.exe

Filesize
8B

MD5
04fb555b8cd94be191d28e1d1555012a

SHA1
f68bfb376c85060677a3e3d6958642dcb68cf78a

SHA256
dd92076705282d67c3923eaa8a5d2387a6c3c4348dc1ff64e77d343f16306a7a

SHA512
2a7e7fdf4642fdb0fddb3581c1a005a238abb65c3b1260b5f9f0a1cfdd6929317e34da57176c769087ea1da3dad40efaaeb24bee48bc355f4de12d5f06a21168

Download Submit
\Windows\system\ZNOeSJm.exe

Filesize
1.4MB

MD5
826a36b62e08054167f4f65e352efc39

SHA1
22ba1eda9ed5772ca88ca1f3ce20330a9e85be7c

SHA256
4d835948ef714e84041c7a410a598961370330a09af6cfb4ac3d35f9dac64f47

SHA512
f5fb30381c6158febcefbe50114e69a687cf0c67d39933e99137d4d602cdeb06f902f202c20fd9c8caf9751d11488dabda745a37dc0b3ffdd53fc75610aa6642

Download Submit
\Windows\system\dpXCpNX.exe

Filesize
1.3MB

MD5
61e1a7f30cef9dedae724b9187d63826

SHA1
96290e5a6358b1b5fdbb63c329926200a141335f

SHA256
eeb567fc6d506602a2f05d85fc1fc419c894d2069a54248458d62e2bbf2bdfaf

SHA512
3d0399c97151b1c1b42c1bb2d198d028f5e717ba5948128b3d88717b9182bfd8eac0f5e0232cc3ba73a1d27d0812de2c354c37548192eaeb78d6e8fe2a4dd057

Download Submit
\Windows\system\lBYJKbz.exe

Filesize
1.3MB

MD5
6f06b2a9ff1c7e140363ba748f3aee31

SHA1
6bea6c8d64c0c069b0fd21b5e061d98b464b6b39

SHA256
5c5e0ada42c66638e4f3d674b8d38e0d1634aa7e8cd6b2258191c2da2e719cd0

SHA512
b94480d59975fcc7e1d6afed869f1cdbd82a079ab1010a0e8d993e3856a119d5d5568dc273e9c8be58ee2fda0e8fbf1ec508fb121079413a631edfbedfeebb47

Download Submit
memory/536-634-0x000000013F050000-0x000000013F442000-memory.dmp

Filesize
3.9MB

Download
memory/556-652-0x000000013F0E0000-0x000000013F4D2000-memory.dmp

Filesize
3.9MB

Download
memory/556-5112-0x000000013F0E0000-0x000000013F4D2000-memory.dmp

Filesize
3.9MB

Download
memory/792-639-0x000000013F730000-0x000000013FB22000-memory.dmp

Filesize
3.9MB

Download
memory/792-5090-0x000000013F730000-0x000000013FB22000-memory.dmp

Filesize
3.9MB

Download
memory/1136-643-0x000000013F3E0000-0x000000013F7D2000-memory.dmp

Filesize
3.9MB

Download
memory/1572-5092-0x000000013FFC0000-0x00000001403B2000-memory.dmp

Filesize
3.9MB

Download
memory/1572-648-0x000000013FFC0000-0x00000001403B2000-memory.dmp

Filesize
3.9MB

Download
memory/1868-5107-0x000000013F390000-0x000000013F782000-memory.dmp

Filesize
3.9MB

Download
memory/1868-658-0x000000013F390000-0x000000013F782000-memory.dmp

Filesize
3.9MB

Download
memory/1916-5096-0x000000013FD60000-0x0000000140152000-memory.dmp

Filesize
3.9MB

Download
memory/1916-656-0x000000013FD60000-0x0000000140152000-memory.dmp

Filesize
3.9MB

Download
memory/1952-663-0x000000013FC50000-0x0000000140042000-memory.dmp

Filesize
3.9MB

Download
memory/2052-3941-0x000000013F730000-0x000000013FB22000-memory.dmp

Filesize
3.9MB

Download
memory/2052-14-0x000000013F730000-0x000000013FB22000-memory.dmp

Filesize
3.9MB

Download
memory/2500-660-0x000000013FE30000-0x0000000140222000-memory.dmp

Filesize
3.9MB

Download
memory/2524-3937-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/2524-27-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/2692-16-0x000000013FF90000-0x0000000140382000-memory.dmp

Filesize
3.9MB

Download
memory/2692-3948-0x000000013FF90000-0x0000000140382000-memory.dmp

Filesize
3.9MB

Download
memory/2728-6-0x000000013F730000-0x000000013FB22000-memory.dmp

Filesize
3.9MB

Download
memory/2728-3990-0x000000013FF90000-0x0000000140382000-memory.dmp

Filesize
3.9MB

Download
memory/2728-650-0x00000000034D0000-0x00000000038C2000-memory.dmp

Filesize
3.9MB

Download
memory/2728-7201-0x000000013FC50000-0x0000000140042000-memory.dmp

Filesize
3.9MB

Download
memory/2728-646-0x000000013FFC0000-0x00000001403B2000-memory.dmp

Filesize
3.9MB

Download
memory/2728-662-0x000000013FC50000-0x0000000140042000-memory.dmp

Filesize
3.9MB

Download
memory/2728-641-0x00000000034D0000-0x00000000038C2000-memory.dmp

Filesize
3.9MB

Download
memory/2728-7112-0x000000013FE30000-0x0000000140222000-memory.dmp

Filesize
3.9MB

Download
memory/2728-636-0x000000013F730000-0x000000013FB22000-memory.dmp

Filesize
3.9MB

Download
memory/2728-1-0x0000000000300000-0x0000000000310000-memory.dmp

Filesize
64KB

Download
memory/2728-633-0x00000000034D0000-0x00000000038C2000-memory.dmp

Filesize
3.9MB

Download
memory/2728-7025-0x000000013FD60000-0x0000000140152000-memory.dmp

Filesize
3.9MB

Download
memory/2728-7090-0x00000000034D0000-0x00000000038C2000-memory.dmp

Filesize
3.9MB

Download
memory/2728-1953-0x000000013F250000-0x000000013F642000-memory.dmp

Filesize
3.9MB

Download
memory/2728-0-0x000000013F250000-0x000000013F642000-memory.dmp

Filesize
3.9MB

Download
memory/2728-654-0x000000013FD60000-0x0000000140152000-memory.dmp

Filesize
3.9MB

Download
memory/2728-659-0x000000013FE30000-0x0000000140222000-memory.dmp

Filesize
3.9MB

Download
memory/2728-6974-0x00000000034D0000-0x00000000038C2000-memory.dmp

Filesize
3.9MB

Download
memory/2728-26-0x0000000002F90000-0x0000000003382000-memory.dmp

Filesize
3.9MB

Download
memory/2728-6764-0x000000013FFC0000-0x00000001403B2000-memory.dmp

Filesize
3.9MB

Download
memory/2728-12-0x000000013FF90000-0x0000000140382000-memory.dmp

Filesize
3.9MB

Download
memory/2728-6760-0x00000000034D0000-0x00000000038C2000-memory.dmp

Filesize
3.9MB

Download
memory/2728-6663-0x000000013F730000-0x000000013FB22000-memory.dmp

Filesize
3.9MB

Download
memory/2728-657-0x00000000034D0000-0x00000000038C2000-memory.dmp

Filesize
3.9MB

Download
memory/2728-5737-0x00000000034D0000-0x00000000038C2000-memory.dmp

Filesize
3.9MB

Download
memory/2840-31-0x000000001B700000-0x000000001B9E2000-memory.dmp

Filesize
2.9MB

Download
memory/2840-32-0x0000000001D70000-0x0000000001D78000-memory.dmp

Filesize
32KB

Download
memory/2840-28-0x0000000002DD0000-0x0000000002E50000-memory.dmp

Filesize
512KB

Download
memory/2840-29-0x000007FEF62FE000-0x000007FEF62FF000-memory.dmp

Filesize
4KB

Download
memory/2840-1789-0x000007FEF6040000-0x000007FEF69DD000-memory.dmp

Filesize
9.6MB

Download
memory/2840-439-0x000007FEF6040000-0x000007FEF69DD000-memory.dmp

Filesize
9.6MB

Download
memory/2840-35-0x000007FEF6040000-0x000007FEF69DD000-memory.dmp

Filesize
9.6MB

Download
memory/2840-661-0x000007FEF6040000-0x000007FEF69DD000-memory.dmp

Filesize
9.6MB

Download