xmrig | 60402931ebbf00f7bb849b6489d3b964d3c388569f853f7b6b11b34dbbb7f27e

Analysis

max time kernel
150s
max time network
147s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 04:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4305e4da58b4a27ebb12ce7a2c1413c0.exe
Size

1.8MB
MD5

4305e4da58b4a27ebb12ce7a2c1413c0
SHA1

893aad41217a00815cc532a8d3b3993e5ed350ef
SHA256

60402931ebbf00f7bb849b6489d3b964d3c388569f853f7b6b11b34dbbb7f27e
SHA512

033b28409674f0505dbe94811173ac099fd1a9fc1e1cfd6a8402310a6c126e69a4cbe9736c284c476a8bee9c514c44e530e93169f72511e5649931fdc1f42c12
SSDEEP

49152:Lz071uv4BPMkyW10/w16BvZX71Fq86zpK:NABI

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 16 IoCs

miner

resource	yara_rule
behavioral1/memory/2916-9-0x000000013F790000-0x000000013FB82000-memory.dmp	xmrig
behavioral1/memory/2300-20-0x000000013FFB0000-0x00000001403A2000-memory.dmp	xmrig
behavioral1/memory/2756-171-0x000000013F020000-0x000000013F412000-memory.dmp	xmrig
behavioral1/memory/2752-168-0x000000013FEF0000-0x00000001402E2000-memory.dmp	xmrig
behavioral1/memory/2832-166-0x000000013FA80000-0x000000013FE72000-memory.dmp	xmrig
behavioral1/memory/2740-164-0x000000013FFB0000-0x00000001403A2000-memory.dmp	xmrig
behavioral1/memory/2712-182-0x000000013F3D0000-0x000000013F7C2000-memory.dmp	xmrig
behavioral1/memory/2588-181-0x000000013F590000-0x000000013F982000-memory.dmp	xmrig
behavioral1/memory/2740-3752-0x000000013FFB0000-0x00000001403A2000-memory.dmp	xmrig
behavioral1/memory/2300-3753-0x000000013FFB0000-0x00000001403A2000-memory.dmp	xmrig
behavioral1/memory/2712-3760-0x000000013F3D0000-0x000000013F7C2000-memory.dmp	xmrig
behavioral1/memory/2756-3767-0x000000013F020000-0x000000013F412000-memory.dmp	xmrig
behavioral1/memory/2752-3762-0x000000013FEF0000-0x00000001402E2000-memory.dmp	xmrig
behavioral1/memory/2588-3759-0x000000013F590000-0x000000013F982000-memory.dmp	xmrig
behavioral1/memory/2832-3756-0x000000013FA80000-0x000000013FE72000-memory.dmp	xmrig
behavioral1/memory/2916-3755-0x000000013F790000-0x000000013FB82000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2496	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2916	rQRpcFB.exe
2300	zONQZLB.exe
2740	KDeDYsC.exe
2832	RzKgDSd.exe
2752	MJpbPzl.exe
2756	rmbjOch.exe
2588	ENWxVOg.exe
2712	dZgtJup.exe
2520	ZYuhvxR.exe
852	cttlndr.exe
2692	LQAxnlm.exe
1964	oPZRItG.exe
1576	uGHmxfF.exe
1736	fzogLKG.exe
1700	CHfyvms.exe
1408	qZgpMVK.exe
3028	PkfdsUC.exe
572	IpLMWQo.exe
2632	zjyXHNV.exe
3016	dnkVJLh.exe
708	CWoegpG.exe
1468	BLkmssy.exe
2680	HMjWhVS.exe
2408	LpeNNRe.exe
1032	sVyPKTt.exe
2016	GiSRmux.exe
1404	gRRsZjV.exe
1748	gMsDpAq.exe
2920	VwWnlrS.exe
2372	dyuAUtD.exe
1732	GprUGzh.exe
2480	SMFgbfV.exe
1688	rOkaHsP.exe
1692	pKSTeAa.exe
1896	SaWhdjO.exe
1804	SwnVSmk.exe
2168	flNpLXP.exe
2424	pJOwrDG.exe
2772	gPHdlFA.exe
2532	ukTcqAE.exe
3060	RftAmyp.exe
2132	PIqaWtN.exe
2444	BbWUtJF.exe
1348	WFBxuBu.exe
1012	STZcxWk.exe
656	ZCjUpzK.exe
316	dsdYTHF.exe
2984	NUTPbrn.exe
2988	WRQQBGS.exe
1592	rGEeJck.exe
1712	ZsWQeBy.exe
2816	tRDtPcl.exe
2252	TGbbANC.exe
2728	OVagHYo.exe
2380	pJFhJkz.exe
2696	mtLlSUJ.exe
2872	tcxsEiA.exe
2392	TxUwgKu.exe
1716	rVJMqgL.exe
1880	EnjFtJt.exe
1456	vTYXDeL.exe
2996	KjQFHpx.exe
2600	NpfKCJX.exe
2768	ACskJNj.exe

Loads dropped DLL 64 IoCs

pid	Process
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe

UPX packed file 49 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2072-0-0x000000013F0A0000-0x000000013F492000-memory.dmp	upx
behavioral1/files/0x0007000000012117-5.dat	upx
behavioral1/files/0x0008000000016cff-10.dat	upx
behavioral1/memory/2916-9-0x000000013F790000-0x000000013FB82000-memory.dmp	upx
behavioral1/files/0x0008000000016d08-22.dat	upx
behavioral1/memory/2300-20-0x000000013FFB0000-0x00000001403A2000-memory.dmp	upx
behavioral1/files/0x001400000000549c-32.dat	upx
behavioral1/files/0x00050000000193ea-191.dat	upx
behavioral1/files/0x000500000001941b-193.dat	upx
behavioral1/memory/2756-171-0x000000013F020000-0x000000013F412000-memory.dmp	upx
behavioral1/memory/2752-168-0x000000013FEF0000-0x00000001402E2000-memory.dmp	upx
behavioral1/memory/2832-166-0x000000013FA80000-0x000000013FE72000-memory.dmp	upx
behavioral1/memory/2740-164-0x000000013FFB0000-0x00000001403A2000-memory.dmp	upx
behavioral1/files/0x00050000000193b3-156.dat	upx
behavioral1/files/0x0005000000019392-155.dat	upx
behavioral1/files/0x000500000001927d-153.dat	upx
behavioral1/files/0x0005000000019255-150.dat	upx
behavioral1/files/0x0006000000019023-149.dat	upx
behavioral1/files/0x0005000000018782-146.dat	upx
behavioral1/files/0x000500000001870b-145.dat	upx
behavioral1/files/0x0005000000018691-138.dat	upx
behavioral1/files/0x00060000000175f2-77.dat	upx
behavioral1/files/0x0031000000018675-58.dat	upx
behavioral1/files/0x00060000000175ec-52.dat	upx
behavioral1/files/0x0007000000016d3e-46.dat	upx
behavioral1/memory/2712-182-0x000000013F3D0000-0x000000013F7C2000-memory.dmp	upx
behavioral1/memory/2588-181-0x000000013F590000-0x000000013F982000-memory.dmp	upx
behavioral1/files/0x00050000000193ec-179.dat	upx
behavioral1/files/0x00050000000193d0-131.dat	upx
behavioral1/files/0x00050000000193a5-130.dat	upx
behavioral1/files/0x000500000001928b-129.dat	upx
behavioral1/files/0x000500000001926a-128.dat	upx
behavioral1/files/0x000500000001924b-127.dat	upx
behavioral1/files/0x0005000000018784-126.dat	upx
behavioral1/files/0x0005000000018738-90.dat	upx
behavioral1/files/0x00050000000186f9-88.dat	upx
behavioral1/files/0x000d000000018678-86.dat	upx
behavioral1/files/0x0009000000016d4e-62.dat	upx
behavioral1/files/0x0007000000016d35-61.dat	upx
behavioral1/files/0x0008000000016d2d-45.dat	upx
behavioral1/files/0x0008000000016c96-36.dat	upx
behavioral1/memory/2740-3752-0x000000013FFB0000-0x00000001403A2000-memory.dmp	upx
behavioral1/memory/2300-3753-0x000000013FFB0000-0x00000001403A2000-memory.dmp	upx
behavioral1/memory/2712-3760-0x000000013F3D0000-0x000000013F7C2000-memory.dmp	upx
behavioral1/memory/2756-3767-0x000000013F020000-0x000000013F412000-memory.dmp	upx
behavioral1/memory/2752-3762-0x000000013FEF0000-0x00000001402E2000-memory.dmp	upx
behavioral1/memory/2588-3759-0x000000013F590000-0x000000013F982000-memory.dmp	upx
behavioral1/memory/2832-3756-0x000000013FA80000-0x000000013FE72000-memory.dmp	upx
behavioral1/memory/2916-3755-0x000000013F790000-0x000000013FB82000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\SzReSzv.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\lNBfzyO.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\BSLmruA.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\vHYaYro.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\FDQDKXu.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\qaTSdHt.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\sXfNWIg.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\LsBqbVY.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\qyeXcXH.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\QqlyyRH.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\mrUqBwI.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\IjQssEj.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\PrVJrkO.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\dSbMgnK.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\PkfdsUC.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\FxkhBFG.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\LnQDAUC.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\nWwVloe.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\wVqhgBp.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\fIHHvxZ.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\BVZXqhx.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\bsZrEuE.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\FGCOzIq.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\FMaXYae.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\gZIJjkQ.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\ngndxtv.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\uvNKpiz.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\HFACOLz.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\zXlqsIq.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\yWnTaMd.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\YFBxjay.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\tHYTpCD.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\FpjgyBF.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\gwvmCJJ.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\zGsqvSg.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\sbGxBWs.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\IyDGTod.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\CcavAPE.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\tPjyQsn.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\AyHfENN.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\utpskin.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\HErZtsm.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\cttlndr.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\WxgCDlA.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\hexdQFd.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\hYiFgBy.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\rmHinMI.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\hucdCvE.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\AdWtnzU.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\cJDhkuy.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\iZSIdCp.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\FCluqGA.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\wVVZjdk.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\YDVeTqt.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\ifeacBX.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\KdQnNkA.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\FYiUmvZ.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\WhIIFFm.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\mWaIqrJ.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\cyGoequ.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\LBakHLW.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\eJziGsx.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\IFOmQOB.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe
File created	C:\Windows\System\ingCEHY.exe	4305e4da58b4a27ebb12ce7a2c1413c0.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2496	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
Token: SeLockMemoryPrivilege	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe
Token: SeDebugPrivilege	2496	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2496	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	31
PID 2072 wrote to memory of 2496	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	31
PID 2072 wrote to memory of 2496	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	31
PID 2072 wrote to memory of 2916	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	32
PID 2072 wrote to memory of 2916	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	32
PID 2072 wrote to memory of 2916	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	32
PID 2072 wrote to memory of 2300	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	33
PID 2072 wrote to memory of 2300	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	33
PID 2072 wrote to memory of 2300	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	33
PID 2072 wrote to memory of 2740	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	34
PID 2072 wrote to memory of 2740	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	34
PID 2072 wrote to memory of 2740	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	34
PID 2072 wrote to memory of 2832	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	35
PID 2072 wrote to memory of 2832	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	35
PID 2072 wrote to memory of 2832	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	35
PID 2072 wrote to memory of 2752	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	36
PID 2072 wrote to memory of 2752	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	36
PID 2072 wrote to memory of 2752	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	36
PID 2072 wrote to memory of 2756	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	37
PID 2072 wrote to memory of 2756	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	37
PID 2072 wrote to memory of 2756	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	37
PID 2072 wrote to memory of 2588	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	38
PID 2072 wrote to memory of 2588	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	38
PID 2072 wrote to memory of 2588	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	38
PID 2072 wrote to memory of 2632	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	39
PID 2072 wrote to memory of 2632	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	39
PID 2072 wrote to memory of 2632	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	39
PID 2072 wrote to memory of 2712	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	40
PID 2072 wrote to memory of 2712	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	40
PID 2072 wrote to memory of 2712	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	40
PID 2072 wrote to memory of 3016	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	41
PID 2072 wrote to memory of 3016	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	41
PID 2072 wrote to memory of 3016	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	41
PID 2072 wrote to memory of 2520	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	42
PID 2072 wrote to memory of 2520	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	42
PID 2072 wrote to memory of 2520	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	42
PID 2072 wrote to memory of 708	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	43
PID 2072 wrote to memory of 708	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	43
PID 2072 wrote to memory of 708	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	43
PID 2072 wrote to memory of 852	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	44
PID 2072 wrote to memory of 852	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	44
PID 2072 wrote to memory of 852	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	44
PID 2072 wrote to memory of 1468	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	45
PID 2072 wrote to memory of 1468	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	45
PID 2072 wrote to memory of 1468	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	45
PID 2072 wrote to memory of 2692	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	46
PID 2072 wrote to memory of 2692	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	46
PID 2072 wrote to memory of 2692	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	46
PID 2072 wrote to memory of 2680	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	47
PID 2072 wrote to memory of 2680	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	47
PID 2072 wrote to memory of 2680	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	47
PID 2072 wrote to memory of 1964	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	48
PID 2072 wrote to memory of 1964	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	48
PID 2072 wrote to memory of 1964	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	48
PID 2072 wrote to memory of 2408	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	49
PID 2072 wrote to memory of 2408	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	49
PID 2072 wrote to memory of 2408	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	49
PID 2072 wrote to memory of 1576	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	50
PID 2072 wrote to memory of 1576	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	50
PID 2072 wrote to memory of 1576	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	50
PID 2072 wrote to memory of 1032	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	51
PID 2072 wrote to memory of 1032	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	51
PID 2072 wrote to memory of 1032	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	51
PID 2072 wrote to memory of 1736	2072	4305e4da58b4a27ebb12ce7a2c1413c0.exe	52

C:\Users\Admin\AppData\Local\Temp\4305e4da58b4a27ebb12ce7a2c1413c0.exe
"C:\Users\Admin\AppData\Local\Temp\4305e4da58b4a27ebb12ce7a2c1413c0.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2496
- C:\Windows\System\rQRpcFB.exe
  C:\Windows\System\rQRpcFB.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\zONQZLB.exe
  C:\Windows\System\zONQZLB.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\KDeDYsC.exe
  C:\Windows\System\KDeDYsC.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\RzKgDSd.exe
  C:\Windows\System\RzKgDSd.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\MJpbPzl.exe
  C:\Windows\System\MJpbPzl.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\rmbjOch.exe
  C:\Windows\System\rmbjOch.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\ENWxVOg.exe
  C:\Windows\System\ENWxVOg.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\zjyXHNV.exe
  C:\Windows\System\zjyXHNV.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\dZgtJup.exe
  C:\Windows\System\dZgtJup.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\dnkVJLh.exe
  C:\Windows\System\dnkVJLh.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\ZYuhvxR.exe
  C:\Windows\System\ZYuhvxR.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\CWoegpG.exe
  C:\Windows\System\CWoegpG.exe
  2⤵
  - Executes dropped EXE
  PID:708
- C:\Windows\System\cttlndr.exe
  C:\Windows\System\cttlndr.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\BLkmssy.exe
  C:\Windows\System\BLkmssy.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\LQAxnlm.exe
  C:\Windows\System\LQAxnlm.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\HMjWhVS.exe
  C:\Windows\System\HMjWhVS.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\oPZRItG.exe
  C:\Windows\System\oPZRItG.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\LpeNNRe.exe
  C:\Windows\System\LpeNNRe.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\uGHmxfF.exe
  C:\Windows\System\uGHmxfF.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\sVyPKTt.exe
  C:\Windows\System\sVyPKTt.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\fzogLKG.exe
  C:\Windows\System\fzogLKG.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\GiSRmux.exe
  C:\Windows\System\GiSRmux.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\CHfyvms.exe
  C:\Windows\System\CHfyvms.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\gRRsZjV.exe
  C:\Windows\System\gRRsZjV.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\qZgpMVK.exe
  C:\Windows\System\qZgpMVK.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\gMsDpAq.exe
  C:\Windows\System\gMsDpAq.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\PkfdsUC.exe
  C:\Windows\System\PkfdsUC.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\VwWnlrS.exe
  C:\Windows\System\VwWnlrS.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\IpLMWQo.exe
  C:\Windows\System\IpLMWQo.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\GprUGzh.exe
  C:\Windows\System\GprUGzh.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\dyuAUtD.exe
  C:\Windows\System\dyuAUtD.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\SMFgbfV.exe
  C:\Windows\System\SMFgbfV.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\rOkaHsP.exe
  C:\Windows\System\rOkaHsP.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\pKSTeAa.exe
  C:\Windows\System\pKSTeAa.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\SaWhdjO.exe
  C:\Windows\System\SaWhdjO.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\SwnVSmk.exe
  C:\Windows\System\SwnVSmk.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\flNpLXP.exe
  C:\Windows\System\flNpLXP.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\pJOwrDG.exe
  C:\Windows\System\pJOwrDG.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\gPHdlFA.exe
  C:\Windows\System\gPHdlFA.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\ukTcqAE.exe
  C:\Windows\System\ukTcqAE.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\RftAmyp.exe
  C:\Windows\System\RftAmyp.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\BbWUtJF.exe
  C:\Windows\System\BbWUtJF.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\PIqaWtN.exe
  C:\Windows\System\PIqaWtN.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\STZcxWk.exe
  C:\Windows\System\STZcxWk.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\WFBxuBu.exe
  C:\Windows\System\WFBxuBu.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\ZCjUpzK.exe
  C:\Windows\System\ZCjUpzK.exe
  2⤵
  - Executes dropped EXE
  PID:656
- C:\Windows\System\dsdYTHF.exe
  C:\Windows\System\dsdYTHF.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\NUTPbrn.exe
  C:\Windows\System\NUTPbrn.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\WRQQBGS.exe
  C:\Windows\System\WRQQBGS.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\rGEeJck.exe
  C:\Windows\System\rGEeJck.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\ZsWQeBy.exe
  C:\Windows\System\ZsWQeBy.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\TGbbANC.exe
  C:\Windows\System\TGbbANC.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\tRDtPcl.exe
  C:\Windows\System\tRDtPcl.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\pJFhJkz.exe
  C:\Windows\System\pJFhJkz.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\OVagHYo.exe
  C:\Windows\System\OVagHYo.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\mtLlSUJ.exe
  C:\Windows\System\mtLlSUJ.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\tcxsEiA.exe
  C:\Windows\System\tcxsEiA.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\TxUwgKu.exe
  C:\Windows\System\TxUwgKu.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\rVJMqgL.exe
  C:\Windows\System\rVJMqgL.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\EnjFtJt.exe
  C:\Windows\System\EnjFtJt.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\vTYXDeL.exe
  C:\Windows\System\vTYXDeL.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\KjQFHpx.exe
  C:\Windows\System\KjQFHpx.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\NpfKCJX.exe
  C:\Windows\System\NpfKCJX.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\ACskJNj.exe
  C:\Windows\System\ACskJNj.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\YcDrLkq.exe
  C:\Windows\System\YcDrLkq.exe
  2⤵
  PID:2000
- C:\Windows\System\AaqpdOh.exe
  C:\Windows\System\AaqpdOh.exe
  2⤵
  PID:2908
- C:\Windows\System\LWvysOz.exe
  C:\Windows\System\LWvysOz.exe
  2⤵
  PID:2068
- C:\Windows\System\oYQnyif.exe
  C:\Windows\System\oYQnyif.exe
  2⤵
  PID:2704
- C:\Windows\System\CFgBsud.exe
  C:\Windows\System\CFgBsud.exe
  2⤵
  PID:2220
- C:\Windows\System\TQiWFUr.exe
  C:\Windows\System\TQiWFUr.exe
  2⤵
  PID:2652
- C:\Windows\System\zALZdFD.exe
  C:\Windows\System\zALZdFD.exe
  2⤵
  PID:1884
- C:\Windows\System\FBxHsZq.exe
  C:\Windows\System\FBxHsZq.exe
  2⤵
  PID:1140
- C:\Windows\System\MtfglcR.exe
  C:\Windows\System\MtfglcR.exe
  2⤵
  PID:2544
- C:\Windows\System\sCVLPQy.exe
  C:\Windows\System\sCVLPQy.exe
  2⤵
  PID:2144
- C:\Windows\System\dttauEl.exe
  C:\Windows\System\dttauEl.exe
  2⤵
  PID:840
- C:\Windows\System\bepCSEU.exe
  C:\Windows\System\bepCSEU.exe
  2⤵
  PID:684
- C:\Windows\System\QqJwCZB.exe
  C:\Windows\System\QqJwCZB.exe
  2⤵
  PID:2788
- C:\Windows\System\aUDNABq.exe
  C:\Windows\System\aUDNABq.exe
  2⤵
  PID:1996
- C:\Windows\System\eMIDeJy.exe
  C:\Windows\System\eMIDeJy.exe
  2⤵
  PID:1464
- C:\Windows\System\KjURkZV.exe
  C:\Windows\System\KjURkZV.exe
  2⤵
  PID:688
- C:\Windows\System\rLYVBWA.exe
  C:\Windows\System\rLYVBWA.exe
  2⤵
  PID:1652
- C:\Windows\System\SfIKUlQ.exe
  C:\Windows\System\SfIKUlQ.exe
  2⤵
  PID:2120
- C:\Windows\System\OdHwlgh.exe
  C:\Windows\System\OdHwlgh.exe
  2⤵
  PID:2296
- C:\Windows\System\hQnaNvu.exe
  C:\Windows\System\hQnaNvu.exe
  2⤵
  PID:2932
- C:\Windows\System\lQMGhVT.exe
  C:\Windows\System\lQMGhVT.exe
  2⤵
  PID:1028
- C:\Windows\System\fRdXTNA.exe
  C:\Windows\System\fRdXTNA.exe
  2⤵
  PID:1580
- C:\Windows\System\PuaFhEQ.exe
  C:\Windows\System\PuaFhEQ.exe
  2⤵
  PID:2292
- C:\Windows\System\QiZhMYl.exe
  C:\Windows\System\QiZhMYl.exe
  2⤵
  PID:1224
- C:\Windows\System\jFZIUeQ.exe
  C:\Windows\System\jFZIUeQ.exe
  2⤵
  PID:2012
- C:\Windows\System\SiHTLPH.exe
  C:\Windows\System\SiHTLPH.exe
  2⤵
  PID:1588
- C:\Windows\System\hocjjRB.exe
  C:\Windows\System\hocjjRB.exe
  2⤵
  PID:2724
- C:\Windows\System\kxBuaZq.exe
  C:\Windows\System\kxBuaZq.exe
  2⤵
  PID:3020
- C:\Windows\System\BMnvzxp.exe
  C:\Windows\System\BMnvzxp.exe
  2⤵
  PID:2684
- C:\Windows\System\xrIOEoj.exe
  C:\Windows\System\xrIOEoj.exe
  2⤵
  PID:608
- C:\Windows\System\lbQdNLE.exe
  C:\Windows\System\lbQdNLE.exe
  2⤵
  PID:1564
- C:\Windows\System\KIWnjys.exe
  C:\Windows\System\KIWnjys.exe
  2⤵
  PID:2876
- C:\Windows\System\mYeCsaw.exe
  C:\Windows\System\mYeCsaw.exe
  2⤵
  PID:536
- C:\Windows\System\kkDKpjw.exe
  C:\Windows\System\kkDKpjw.exe
  2⤵
  PID:1144
- C:\Windows\System\QIQkIIY.exe
  C:\Windows\System\QIQkIIY.exe
  2⤵
  PID:2732
- C:\Windows\System\hTtrawu.exe
  C:\Windows\System\hTtrawu.exe
  2⤵
  PID:1972
- C:\Windows\System\RpvstAn.exe
  C:\Windows\System\RpvstAn.exe
  2⤵
  PID:560
- C:\Windows\System\WxgCDlA.exe
  C:\Windows\System\WxgCDlA.exe
  2⤵
  PID:1872
- C:\Windows\System\CSOdoot.exe
  C:\Windows\System\CSOdoot.exe
  2⤵
  PID:1076
- C:\Windows\System\mZVsunD.exe
  C:\Windows\System\mZVsunD.exe
  2⤵
  PID:380
- C:\Windows\System\nytrHxb.exe
  C:\Windows\System\nytrHxb.exe
  2⤵
  PID:2964
- C:\Windows\System\AvBjcAm.exe
  C:\Windows\System\AvBjcAm.exe
  2⤵
  PID:644
- C:\Windows\System\SWrwKCM.exe
  C:\Windows\System\SWrwKCM.exe
  2⤵
  PID:2064
- C:\Windows\System\mvAQrFc.exe
  C:\Windows\System\mvAQrFc.exe
  2⤵
  PID:2456
- C:\Windows\System\PBFLnJK.exe
  C:\Windows\System\PBFLnJK.exe
  2⤵
  PID:2276
- C:\Windows\System\EefMUGU.exe
  C:\Windows\System\EefMUGU.exe
  2⤵
  PID:1816
- C:\Windows\System\hexdQFd.exe
  C:\Windows\System\hexdQFd.exe
  2⤵
  PID:1108
- C:\Windows\System\UguEXQJ.exe
  C:\Windows\System\UguEXQJ.exe
  2⤵
  PID:1860
- C:\Windows\System\iOeeQON.exe
  C:\Windows\System\iOeeQON.exe
  2⤵
  PID:2420
- C:\Windows\System\kLuSiUn.exe
  C:\Windows\System\kLuSiUn.exe
  2⤵
  PID:2868
- C:\Windows\System\jiPZEZz.exe
  C:\Windows\System\jiPZEZz.exe
  2⤵
  PID:2660
- C:\Windows\System\SuYVcoD.exe
  C:\Windows\System\SuYVcoD.exe
  2⤵
  PID:1904
- C:\Windows\System\MGVjuQm.exe
  C:\Windows\System\MGVjuQm.exe
  2⤵
  PID:2328
- C:\Windows\System\UhTIrFK.exe
  C:\Windows\System\UhTIrFK.exe
  2⤵
  PID:2800
- C:\Windows\System\CIXLpTX.exe
  C:\Windows\System\CIXLpTX.exe
  2⤵
  PID:2936
- C:\Windows\System\HQHdccN.exe
  C:\Windows\System\HQHdccN.exe
  2⤵
  PID:348
- C:\Windows\System\NUfDEfc.exe
  C:\Windows\System\NUfDEfc.exe
  2⤵
  PID:2140
- C:\Windows\System\kcVNmfm.exe
  C:\Windows\System\kcVNmfm.exe
  2⤵
  PID:2440
- C:\Windows\System\JqgMtzk.exe
  C:\Windows\System\JqgMtzk.exe
  2⤵
  PID:2172
- C:\Windows\System\uHPdJTc.exe
  C:\Windows\System\uHPdJTc.exe
  2⤵
  PID:2396
- C:\Windows\System\XNFdvGp.exe
  C:\Windows\System\XNFdvGp.exe
  2⤵
  PID:3068
- C:\Windows\System\kAWERbl.exe
  C:\Windows\System\kAWERbl.exe
  2⤵
  PID:2468
- C:\Windows\System\tTsFtKF.exe
  C:\Windows\System\tTsFtKF.exe
  2⤵
  PID:1556
- C:\Windows\System\XDMFKqZ.exe
  C:\Windows\System\XDMFKqZ.exe
  2⤵
  PID:3056
- C:\Windows\System\PPoqCIz.exe
  C:\Windows\System\PPoqCIz.exe
  2⤵
  PID:880
- C:\Windows\System\RosDjMg.exe
  C:\Windows\System\RosDjMg.exe
  2⤵
  PID:2824
- C:\Windows\System\XLdEpby.exe
  C:\Windows\System\XLdEpby.exe
  2⤵
  PID:1788
- C:\Windows\System\XcRbwTF.exe
  C:\Windows\System\XcRbwTF.exe
  2⤵
  PID:2836
- C:\Windows\System\DmAZqpM.exe
  C:\Windows\System\DmAZqpM.exe
  2⤵
  PID:2200
- C:\Windows\System\JBPCTtm.exe
  C:\Windows\System\JBPCTtm.exe
  2⤵
  PID:2256
- C:\Windows\System\EyMhDQO.exe
  C:\Windows\System\EyMhDQO.exe
  2⤵
  PID:2236
- C:\Windows\System\aZYijUz.exe
  C:\Windows\System\aZYijUz.exe
  2⤵
  PID:2348
- C:\Windows\System\sAYUqXi.exe
  C:\Windows\System\sAYUqXi.exe
  2⤵
  PID:1708
- C:\Windows\System\iOykTkD.exe
  C:\Windows\System\iOykTkD.exe
  2⤵
  PID:352
- C:\Windows\System\wzIdWvv.exe
  C:\Windows\System\wzIdWvv.exe
  2⤵
  PID:2504
- C:\Windows\System\JGBqTvQ.exe
  C:\Windows\System\JGBqTvQ.exe
  2⤵
  PID:1480
- C:\Windows\System\IAxJWkj.exe
  C:\Windows\System\IAxJWkj.exe
  2⤵
  PID:3076
- C:\Windows\System\QEUEuEv.exe
  C:\Windows\System\QEUEuEv.exe
  2⤵
  PID:3100
- C:\Windows\System\aEAmNxC.exe
  C:\Windows\System\aEAmNxC.exe
  2⤵
  PID:3116
- C:\Windows\System\gHyngDK.exe
  C:\Windows\System\gHyngDK.exe
  2⤵
  PID:3140
- C:\Windows\System\QqlyyRH.exe
  C:\Windows\System\QqlyyRH.exe
  2⤵
  PID:3160
- C:\Windows\System\FPbNEYB.exe
  C:\Windows\System\FPbNEYB.exe
  2⤵
  PID:3180
- C:\Windows\System\eKxILgE.exe
  C:\Windows\System\eKxILgE.exe
  2⤵
  PID:3200
- C:\Windows\System\IBLSrxD.exe
  C:\Windows\System\IBLSrxD.exe
  2⤵
  PID:3220
- C:\Windows\System\UfcVZkj.exe
  C:\Windows\System\UfcVZkj.exe
  2⤵
  PID:3236
- C:\Windows\System\zKndbEf.exe
  C:\Windows\System\zKndbEf.exe
  2⤵
  PID:3256
- C:\Windows\System\zpYDTDS.exe
  C:\Windows\System\zpYDTDS.exe
  2⤵
  PID:3276
- C:\Windows\System\PkhsOQj.exe
  C:\Windows\System\PkhsOQj.exe
  2⤵
  PID:3300
- C:\Windows\System\GNsenxQ.exe
  C:\Windows\System\GNsenxQ.exe
  2⤵
  PID:3320
- C:\Windows\System\PaWhKtK.exe
  C:\Windows\System\PaWhKtK.exe
  2⤵
  PID:3340
- C:\Windows\System\TCdUTiB.exe
  C:\Windows\System\TCdUTiB.exe
  2⤵
  PID:3356
- C:\Windows\System\NFHBiQU.exe
  C:\Windows\System\NFHBiQU.exe
  2⤵
  PID:3376
- C:\Windows\System\XhQomxs.exe
  C:\Windows\System\XhQomxs.exe
  2⤵
  PID:3400
- C:\Windows\System\CUzleeG.exe
  C:\Windows\System\CUzleeG.exe
  2⤵
  PID:3420
- C:\Windows\System\OiwGROa.exe
  C:\Windows\System\OiwGROa.exe
  2⤵
  PID:3436
- C:\Windows\System\FxkhBFG.exe
  C:\Windows\System\FxkhBFG.exe
  2⤵
  PID:3456
- C:\Windows\System\hJizAom.exe
  C:\Windows\System\hJizAom.exe
  2⤵
  PID:3476
- C:\Windows\System\icBImdg.exe
  C:\Windows\System\icBImdg.exe
  2⤵
  PID:3496
- C:\Windows\System\WCjsQlw.exe
  C:\Windows\System\WCjsQlw.exe
  2⤵
  PID:3516
- C:\Windows\System\ipplecI.exe
  C:\Windows\System\ipplecI.exe
  2⤵
  PID:3536
- C:\Windows\System\Ojhpfca.exe
  C:\Windows\System\Ojhpfca.exe
  2⤵
  PID:3552
- C:\Windows\System\tQJrPRb.exe
  C:\Windows\System\tQJrPRb.exe
  2⤵
  PID:3576
- C:\Windows\System\OAQRjlu.exe
  C:\Windows\System\OAQRjlu.exe
  2⤵
  PID:3604
- C:\Windows\System\JrdFAaV.exe
  C:\Windows\System\JrdFAaV.exe
  2⤵
  PID:3624
- C:\Windows\System\ulseHsv.exe
  C:\Windows\System\ulseHsv.exe
  2⤵
  PID:3644
- C:\Windows\System\qEURoGp.exe
  C:\Windows\System\qEURoGp.exe
  2⤵
  PID:3664
- C:\Windows\System\Ztslfnd.exe
  C:\Windows\System\Ztslfnd.exe
  2⤵
  PID:3684
- C:\Windows\System\YqxUEVm.exe
  C:\Windows\System\YqxUEVm.exe
  2⤵
  PID:3704
- C:\Windows\System\lVdmrXg.exe
  C:\Windows\System\lVdmrXg.exe
  2⤵
  PID:3724
- C:\Windows\System\SCKLvpb.exe
  C:\Windows\System\SCKLvpb.exe
  2⤵
  PID:3744
- C:\Windows\System\mLoydFe.exe
  C:\Windows\System\mLoydFe.exe
  2⤵
  PID:3760
- C:\Windows\System\WQrLIsx.exe
  C:\Windows\System\WQrLIsx.exe
  2⤵
  PID:3780
- C:\Windows\System\PHfJzrM.exe
  C:\Windows\System\PHfJzrM.exe
  2⤵
  PID:3804
- C:\Windows\System\EhtdJuN.exe
  C:\Windows\System\EhtdJuN.exe
  2⤵
  PID:3824
- C:\Windows\System\JNBNdpf.exe
  C:\Windows\System\JNBNdpf.exe
  2⤵
  PID:3840
- C:\Windows\System\SyLakgp.exe
  C:\Windows\System\SyLakgp.exe
  2⤵
  PID:3860
- C:\Windows\System\KdAEiIh.exe
  C:\Windows\System\KdAEiIh.exe
  2⤵
  PID:3884
- C:\Windows\System\UgRkRyS.exe
  C:\Windows\System\UgRkRyS.exe
  2⤵
  PID:3904
- C:\Windows\System\AaOijyy.exe
  C:\Windows\System\AaOijyy.exe
  2⤵
  PID:3924
- C:\Windows\System\oZrOkDE.exe
  C:\Windows\System\oZrOkDE.exe
  2⤵
  PID:3944
- C:\Windows\System\zkUtnSu.exe
  C:\Windows\System\zkUtnSu.exe
  2⤵
  PID:3964
- C:\Windows\System\mwuIyal.exe
  C:\Windows\System\mwuIyal.exe
  2⤵
  PID:3984
- C:\Windows\System\rMDBaxg.exe
  C:\Windows\System\rMDBaxg.exe
  2⤵
  PID:4004
- C:\Windows\System\WjCApvE.exe
  C:\Windows\System\WjCApvE.exe
  2⤵
  PID:4024
- C:\Windows\System\mAKdZKl.exe
  C:\Windows\System\mAKdZKl.exe
  2⤵
  PID:4040
- C:\Windows\System\YZmWeBj.exe
  C:\Windows\System\YZmWeBj.exe
  2⤵
  PID:4064
- C:\Windows\System\EcvbrXn.exe
  C:\Windows\System\EcvbrXn.exe
  2⤵
  PID:4080
- C:\Windows\System\nIgnUSj.exe
  C:\Windows\System\nIgnUSj.exe
  2⤵
  PID:2720
- C:\Windows\System\cJDhkuy.exe
  C:\Windows\System\cJDhkuy.exe
  2⤵
  PID:3000
- C:\Windows\System\FmuomRR.exe
  C:\Windows\System\FmuomRR.exe
  2⤵
  PID:1980
- C:\Windows\System\DIsMIrH.exe
  C:\Windows\System\DIsMIrH.exe
  2⤵
  PID:2820
- C:\Windows\System\RYBnehY.exe
  C:\Windows\System\RYBnehY.exe
  2⤵
  PID:2020
- C:\Windows\System\AgpIhOS.exe
  C:\Windows\System\AgpIhOS.exe
  2⤵
  PID:3136
- C:\Windows\System\ZWzeJPV.exe
  C:\Windows\System\ZWzeJPV.exe
  2⤵
  PID:3132
- C:\Windows\System\WXihWRm.exe
  C:\Windows\System\WXihWRm.exe
  2⤵
  PID:3148
- C:\Windows\System\zZUaril.exe
  C:\Windows\System\zZUaril.exe
  2⤵
  PID:3188
- C:\Windows\System\KqdHKcA.exe
  C:\Windows\System\KqdHKcA.exe
  2⤵
  PID:2624
- C:\Windows\System\czzqgoO.exe
  C:\Windows\System\czzqgoO.exe
  2⤵
  PID:3292
- C:\Windows\System\rLcTxVL.exe
  C:\Windows\System\rLcTxVL.exe
  2⤵
  PID:3332
- C:\Windows\System\qwsSswj.exe
  C:\Windows\System\qwsSswj.exe
  2⤵
  PID:3272
- C:\Windows\System\vcBTAKT.exe
  C:\Windows\System\vcBTAKT.exe
  2⤵
  PID:3416
- C:\Windows\System\kjsEZsN.exe
  C:\Windows\System\kjsEZsN.exe
  2⤵
  PID:3312
- C:\Windows\System\QbNxvTP.exe
  C:\Windows\System\QbNxvTP.exe
  2⤵
  PID:3348
- C:\Windows\System\WksTexW.exe
  C:\Windows\System\WksTexW.exe
  2⤵
  PID:3524
- C:\Windows\System\iEdXehe.exe
  C:\Windows\System\iEdXehe.exe
  2⤵
  PID:3468
- C:\Windows\System\jLaGuuw.exe
  C:\Windows\System\jLaGuuw.exe
  2⤵
  PID:3564
- C:\Windows\System\ObvXaPx.exe
  C:\Windows\System\ObvXaPx.exe
  2⤵
  PID:2656
- C:\Windows\System\ZuROkvl.exe
  C:\Windows\System\ZuROkvl.exe
  2⤵
  PID:3508
- C:\Windows\System\RitDyNJ.exe
  C:\Windows\System\RitDyNJ.exe
  2⤵
  PID:856
- C:\Windows\System\kmUXCYI.exe
  C:\Windows\System\kmUXCYI.exe
  2⤵
  PID:3592
- C:\Windows\System\jrgeIHU.exe
  C:\Windows\System\jrgeIHU.exe
  2⤵
  PID:3612
- C:\Windows\System\iLSJUXP.exe
  C:\Windows\System\iLSJUXP.exe
  2⤵
  PID:3656
- C:\Windows\System\zcmoOIf.exe
  C:\Windows\System\zcmoOIf.exe
  2⤵
  PID:3640
- C:\Windows\System\Emuxmij.exe
  C:\Windows\System\Emuxmij.exe
  2⤵
  PID:1376
- C:\Windows\System\VZrPwKd.exe
  C:\Windows\System\VZrPwKd.exe
  2⤵
  PID:3676
- C:\Windows\System\wcrAGsF.exe
  C:\Windows\System\wcrAGsF.exe
  2⤵
  PID:3712
- C:\Windows\System\IjegWsJ.exe
  C:\Windows\System\IjegWsJ.exe
  2⤵
  PID:3768
- C:\Windows\System\MkEQDpu.exe
  C:\Windows\System\MkEQDpu.exe
  2⤵
  PID:3820
- C:\Windows\System\CJyahOU.exe
  C:\Windows\System\CJyahOU.exe
  2⤵
  PID:3756
- C:\Windows\System\kILcgmH.exe
  C:\Windows\System\kILcgmH.exe
  2⤵
  PID:3848
- C:\Windows\System\LFIMoMx.exe
  C:\Windows\System\LFIMoMx.exe
  2⤵
  PID:3872
- C:\Windows\System\gdfXsGv.exe
  C:\Windows\System\gdfXsGv.exe
  2⤵
  PID:3892
- C:\Windows\System\oOaXNND.exe
  C:\Windows\System\oOaXNND.exe
  2⤵
  PID:3932
- C:\Windows\System\IJlLikb.exe
  C:\Windows\System\IJlLikb.exe
  2⤵
  PID:3920
- C:\Windows\System\aJsBETr.exe
  C:\Windows\System\aJsBETr.exe
  2⤵
  PID:3980
- C:\Windows\System\NmEtnKz.exe
  C:\Windows\System\NmEtnKz.exe
  2⤵
  PID:4012
- C:\Windows\System\TccxhSI.exe
  C:\Windows\System\TccxhSI.exe
  2⤵
  PID:3992
- C:\Windows\System\sfhgfMN.exe
  C:\Windows\System\sfhgfMN.exe
  2⤵
  PID:4060
- C:\Windows\System\PmeWbdS.exe
  C:\Windows\System\PmeWbdS.exe
  2⤵
  PID:4088
- C:\Windows\System\UdkFrLc.exe
  C:\Windows\System\UdkFrLc.exe
  2⤵
  PID:1640
- C:\Windows\System\YlWPamV.exe
  C:\Windows\System\YlWPamV.exe
  2⤵
  PID:2948
- C:\Windows\System\bslpBCA.exe
  C:\Windows\System\bslpBCA.exe
  2⤵
  PID:3600
- C:\Windows\System\qvecMBO.exe
  C:\Windows\System\qvecMBO.exe
  2⤵
  PID:3088
- C:\Windows\System\khjTpyb.exe
  C:\Windows\System\khjTpyb.exe
  2⤵
  PID:3108
- C:\Windows\System\psFeFVX.exe
  C:\Windows\System\psFeFVX.exe
  2⤵
  PID:3112
- C:\Windows\System\YuTUWfR.exe
  C:\Windows\System\YuTUWfR.exe
  2⤵
  PID:3176
- C:\Windows\System\SXmkxlj.exe
  C:\Windows\System\SXmkxlj.exe
  2⤵
  PID:1800
- C:\Windows\System\UVRBaoJ.exe
  C:\Windows\System\UVRBaoJ.exe
  2⤵
  PID:3196
- C:\Windows\System\mpHOPHq.exe
  C:\Windows\System\mpHOPHq.exe
  2⤵
  PID:3232
- C:\Windows\System\HMtwkFc.exe
  C:\Windows\System\HMtwkFc.exe
  2⤵
  PID:1496
- C:\Windows\System\XNnfUTz.exe
  C:\Windows\System\XNnfUTz.exe
  2⤵
  PID:3452
- C:\Windows\System\KFcETND.exe
  C:\Windows\System\KFcETND.exe
  2⤵
  PID:3412
- C:\Windows\System\ogMRwbe.exe
  C:\Windows\System\ogMRwbe.exe
  2⤵
  PID:1628
- C:\Windows\System\BSciWyC.exe
  C:\Windows\System\BSciWyC.exe
  2⤵
  PID:1740
- C:\Windows\System\iuXMKjc.exe
  C:\Windows\System\iuXMKjc.exe
  2⤵
  PID:2952
- C:\Windows\System\exYxHZK.exe
  C:\Windows\System\exYxHZK.exe
  2⤵
  PID:1284
- C:\Windows\System\FkHJRHP.exe
  C:\Windows\System\FkHJRHP.exe
  2⤵
  PID:3432
- C:\Windows\System\AyczRLg.exe
  C:\Windows\System\AyczRLg.exe
  2⤵
  PID:3464
- C:\Windows\System\lcIYooY.exe
  C:\Windows\System\lcIYooY.exe
  2⤵
  PID:3544
- C:\Windows\System\hAlRApR.exe
  C:\Windows\System\hAlRApR.exe
  2⤵
  PID:3616
- C:\Windows\System\sgJiNKt.exe
  C:\Windows\System\sgJiNKt.exe
  2⤵
  PID:1520
- C:\Windows\System\WbFzsBz.exe
  C:\Windows\System\WbFzsBz.exe
  2⤵
  PID:1512
- C:\Windows\System\qjlsGUU.exe
  C:\Windows\System\qjlsGUU.exe
  2⤵
  PID:3772
- C:\Windows\System\NKZnvml.exe
  C:\Windows\System\NKZnvml.exe
  2⤵
  PID:3788
- C:\Windows\System\mOYKUyk.exe
  C:\Windows\System\mOYKUyk.exe
  2⤵
  PID:3856
- C:\Windows\System\kyYDvhz.exe
  C:\Windows\System\kyYDvhz.exe
  2⤵
  PID:3868
- C:\Windows\System\sfywHbD.exe
  C:\Windows\System\sfywHbD.exe
  2⤵
  PID:3900
- C:\Windows\System\qCZKeWJ.exe
  C:\Windows\System\qCZKeWJ.exe
  2⤵
  PID:3976
- C:\Windows\System\OcwFgbK.exe
  C:\Windows\System\OcwFgbK.exe
  2⤵
  PID:4048
- C:\Windows\System\AXcESfT.exe
  C:\Windows\System\AXcESfT.exe
  2⤵
  PID:2644
- C:\Windows\System\ebwHaVK.exe
  C:\Windows\System\ebwHaVK.exe
  2⤵
  PID:1500
- C:\Windows\System\aeVXvaT.exe
  C:\Windows\System\aeVXvaT.exe
  2⤵
  PID:3096
- C:\Windows\System\VEYmcyD.exe
  C:\Windows\System\VEYmcyD.exe
  2⤵
  PID:1852
- C:\Windows\System\IhhTplc.exe
  C:\Windows\System\IhhTplc.exe
  2⤵
  PID:2224
- C:\Windows\System\ZkeYcgx.exe
  C:\Windows\System\ZkeYcgx.exe
  2⤵
  PID:3244
- C:\Windows\System\OCnwPhv.exe
  C:\Windows\System\OCnwPhv.exe
  2⤵
  PID:3268
- C:\Windows\System\ktaDFKd.exe
  C:\Windows\System\ktaDFKd.exe
  2⤵
  PID:3316
- C:\Windows\System\IKMlhiR.exe
  C:\Windows\System\IKMlhiR.exe
  2⤵
  PID:3392
- C:\Windows\System\BqwUmyu.exe
  C:\Windows\System\BqwUmyu.exe
  2⤵
  PID:2184
- C:\Windows\System\htWxpcW.exe
  C:\Windows\System\htWxpcW.exe
  2⤵
  PID:3528
- C:\Windows\System\xaFnzVZ.exe
  C:\Windows\System\xaFnzVZ.exe
  2⤵
  PID:2004
- C:\Windows\System\kXyqOPI.exe
  C:\Windows\System\kXyqOPI.exe
  2⤵
  PID:3736
- C:\Windows\System\bOmfIVO.exe
  C:\Windows\System\bOmfIVO.exe
  2⤵
  PID:3792
- C:\Windows\System\LmbNSax.exe
  C:\Windows\System\LmbNSax.exe
  2⤵
  PID:1324
- C:\Windows\System\uYwmNFm.exe
  C:\Windows\System\uYwmNFm.exe
  2⤵
  PID:1508
- C:\Windows\System\EfjkRBO.exe
  C:\Windows\System\EfjkRBO.exe
  2⤵
  PID:1680
- C:\Windows\System\hevvBxA.exe
  C:\Windows\System\hevvBxA.exe
  2⤵
  PID:3084
- C:\Windows\System\NguUJrA.exe
  C:\Windows\System\NguUJrA.exe
  2⤵
  PID:1540
- C:\Windows\System\zZlgHIL.exe
  C:\Windows\System\zZlgHIL.exe
  2⤵
  PID:292
- C:\Windows\System\NntYupM.exe
  C:\Windows\System\NntYupM.exe
  2⤵
  PID:1940
- C:\Windows\System\MZYpJGe.exe
  C:\Windows\System\MZYpJGe.exe
  2⤵
  PID:2852
- C:\Windows\System\JrpukZi.exe
  C:\Windows\System\JrpukZi.exe
  2⤵
  PID:3008
- C:\Windows\System\vffHRXP.exe
  C:\Windows\System\vffHRXP.exe
  2⤵
  PID:3396
- C:\Windows\System\LjyalDi.exe
  C:\Windows\System\LjyalDi.exe
  2⤵
  PID:3692
- C:\Windows\System\mYNMcyA.exe
  C:\Windows\System\mYNMcyA.exe
  2⤵
  PID:3212
- C:\Windows\System\qXjZUSg.exe
  C:\Windows\System\qXjZUSg.exe
  2⤵
  PID:2288
- C:\Windows\System\BnaNkMx.exe
  C:\Windows\System\BnaNkMx.exe
  2⤵
  PID:3296
- C:\Windows\System\IVedRez.exe
  C:\Windows\System\IVedRez.exe
  2⤵
  PID:4112
- C:\Windows\System\zxcWuBe.exe
  C:\Windows\System\zxcWuBe.exe
  2⤵
  PID:4132
- C:\Windows\System\EYOLSDv.exe
  C:\Windows\System\EYOLSDv.exe
  2⤵
  PID:4148
- C:\Windows\System\WwTdvRn.exe
  C:\Windows\System\WwTdvRn.exe
  2⤵
  PID:4164
- C:\Windows\System\yjtmoUI.exe
  C:\Windows\System\yjtmoUI.exe
  2⤵
  PID:4180
- C:\Windows\System\CzGiynz.exe
  C:\Windows\System\CzGiynz.exe
  2⤵
  PID:4196
- C:\Windows\System\VAIaOTl.exe
  C:\Windows\System\VAIaOTl.exe
  2⤵
  PID:4212
- C:\Windows\System\znNwTtI.exe
  C:\Windows\System\znNwTtI.exe
  2⤵
  PID:4252
- C:\Windows\System\kpzNBVu.exe
  C:\Windows\System\kpzNBVu.exe
  2⤵
  PID:4268
- C:\Windows\System\qCbgGWt.exe
  C:\Windows\System\qCbgGWt.exe
  2⤵
  PID:4284
- C:\Windows\System\NSTDDPg.exe
  C:\Windows\System\NSTDDPg.exe
  2⤵
  PID:4344
- C:\Windows\System\ljFXgOx.exe
  C:\Windows\System\ljFXgOx.exe
  2⤵
  PID:4388
- C:\Windows\System\eohPLqK.exe
  C:\Windows\System\eohPLqK.exe
  2⤵
  PID:4412
- C:\Windows\System\bWIPadY.exe
  C:\Windows\System\bWIPadY.exe
  2⤵
  PID:4432
- C:\Windows\System\wlxnAls.exe
  C:\Windows\System\wlxnAls.exe
  2⤵
  PID:4460
- C:\Windows\System\vyeKKRD.exe
  C:\Windows\System\vyeKKRD.exe
  2⤵
  PID:4476
- C:\Windows\System\TahTHrL.exe
  C:\Windows\System\TahTHrL.exe
  2⤵
  PID:4492
- C:\Windows\System\gOjwnFz.exe
  C:\Windows\System\gOjwnFz.exe
  2⤵
  PID:4508
- C:\Windows\System\KyDwghI.exe
  C:\Windows\System\KyDwghI.exe
  2⤵
  PID:4524
- C:\Windows\System\pFEklJX.exe
  C:\Windows\System\pFEklJX.exe
  2⤵
  PID:4540
- C:\Windows\System\dRCkxkP.exe
  C:\Windows\System\dRCkxkP.exe
  2⤵
  PID:4556
- C:\Windows\System\zXlqsIq.exe
  C:\Windows\System\zXlqsIq.exe
  2⤵
  PID:4572
- C:\Windows\System\DrfhbXt.exe
  C:\Windows\System\DrfhbXt.exe
  2⤵
  PID:4588
- C:\Windows\System\uMYItTI.exe
  C:\Windows\System\uMYItTI.exe
  2⤵
  PID:4604
- C:\Windows\System\nzQKYxZ.exe
  C:\Windows\System\nzQKYxZ.exe
  2⤵
  PID:4620
- C:\Windows\System\DmXEFqy.exe
  C:\Windows\System\DmXEFqy.exe
  2⤵
  PID:4636
- C:\Windows\System\cPfgwWj.exe
  C:\Windows\System\cPfgwWj.exe
  2⤵
  PID:4664
- C:\Windows\System\CwtpOyc.exe
  C:\Windows\System\CwtpOyc.exe
  2⤵
  PID:4684
- C:\Windows\System\wTPGWMl.exe
  C:\Windows\System\wTPGWMl.exe
  2⤵
  PID:4704
- C:\Windows\System\qwpCPwo.exe
  C:\Windows\System\qwpCPwo.exe
  2⤵
  PID:4724
- C:\Windows\System\pGAMqxA.exe
  C:\Windows\System\pGAMqxA.exe
  2⤵
  PID:4740
- C:\Windows\System\RqwmepC.exe
  C:\Windows\System\RqwmepC.exe
  2⤵
  PID:4756
- C:\Windows\System\VHBHQBr.exe
  C:\Windows\System\VHBHQBr.exe
  2⤵
  PID:4772
- C:\Windows\System\FDQDKXu.exe
  C:\Windows\System\FDQDKXu.exe
  2⤵
  PID:4788
- C:\Windows\System\VQCmrCp.exe
  C:\Windows\System\VQCmrCp.exe
  2⤵
  PID:4804
- C:\Windows\System\crEBqDz.exe
  C:\Windows\System\crEBqDz.exe
  2⤵
  PID:4820
- C:\Windows\System\EqtZRYb.exe
  C:\Windows\System\EqtZRYb.exe
  2⤵
  PID:4836
- C:\Windows\System\znpidAN.exe
  C:\Windows\System\znpidAN.exe
  2⤵
  PID:4852
- C:\Windows\System\vZkKAoY.exe
  C:\Windows\System\vZkKAoY.exe
  2⤵
  PID:4868
- C:\Windows\System\MmtQSSd.exe
  C:\Windows\System\MmtQSSd.exe
  2⤵
  PID:4884
- C:\Windows\System\nCczNwh.exe
  C:\Windows\System\nCczNwh.exe
  2⤵
  PID:4900
- C:\Windows\System\kGMTlgi.exe
  C:\Windows\System\kGMTlgi.exe
  2⤵
  PID:4916
- C:\Windows\System\ZHMkVMm.exe
  C:\Windows\System\ZHMkVMm.exe
  2⤵
  PID:4932
- C:\Windows\System\ZeBKbiH.exe
  C:\Windows\System\ZeBKbiH.exe
  2⤵
  PID:4948
- C:\Windows\System\ddfhnqa.exe
  C:\Windows\System\ddfhnqa.exe
  2⤵
  PID:4996
- C:\Windows\System\bGtxKUn.exe
  C:\Windows\System\bGtxKUn.exe
  2⤵
  PID:5112
- C:\Windows\System\mcznuYG.exe
  C:\Windows\System\mcznuYG.exe
  2⤵
  PID:868
- C:\Windows\System\wVxedXg.exe
  C:\Windows\System\wVxedXg.exe
  2⤵
  PID:2856
- C:\Windows\System\YqKGLbf.exe
  C:\Windows\System\YqKGLbf.exe
  2⤵
  PID:3512
- C:\Windows\System\QXwlpNC.exe
  C:\Windows\System\QXwlpNC.exe
  2⤵
  PID:4144
- C:\Windows\System\jkZTxsu.exe
  C:\Windows\System\jkZTxsu.exe
  2⤵
  PID:4260
- C:\Windows\System\CRRhWrl.exe
  C:\Windows\System\CRRhWrl.exe
  2⤵
  PID:3584
- C:\Windows\System\zwZxbqs.exe
  C:\Windows\System\zwZxbqs.exe
  2⤵
  PID:2180
- C:\Windows\System\VbGazzt.exe
  C:\Windows\System\VbGazzt.exe
  2⤵
  PID:3128
- C:\Windows\System\NLHQJub.exe
  C:\Windows\System\NLHQJub.exe
  2⤵
  PID:4124
- C:\Windows\System\cyogIKz.exe
  C:\Windows\System\cyogIKz.exe
  2⤵
  PID:4548
- C:\Windows\System\bszvhjP.exe
  C:\Windows\System\bszvhjP.exe
  2⤵
  PID:4616
- C:\Windows\System\VZXpYzQ.exe
  C:\Windows\System\VZXpYzQ.exe
  2⤵
  PID:4780
- C:\Windows\System\qZrtZrD.exe
  C:\Windows\System\qZrtZrD.exe
  2⤵
  PID:4924
- C:\Windows\System\xQLolhy.exe
  C:\Windows\System\xQLolhy.exe
  2⤵
  PID:4876
- C:\Windows\System\JESxQbM.exe
  C:\Windows\System\JESxQbM.exe
  2⤵
  PID:4972
- C:\Windows\System\vaVycIM.exe
  C:\Windows\System\vaVycIM.exe
  2⤵
  PID:5004
- C:\Windows\System\cHOVhho.exe
  C:\Windows\System\cHOVhho.exe
  2⤵
  PID:5028
- C:\Windows\System\iZSIdCp.exe
  C:\Windows\System\iZSIdCp.exe
  2⤵
  PID:2956
- C:\Windows\System\CQbfwlQ.exe
  C:\Windows\System\CQbfwlQ.exe
  2⤵
  PID:5108
- C:\Windows\System\KKUGerB.exe
  C:\Windows\System\KKUGerB.exe
  2⤵
  PID:3588
- C:\Windows\System\XkmSBKo.exe
  C:\Windows\System\XkmSBKo.exe
  2⤵
  PID:4208
- C:\Windows\System\SbotNJW.exe
  C:\Windows\System\SbotNJW.exe
  2⤵
  PID:4140
- C:\Windows\System\gwvmCJJ.exe
  C:\Windows\System\gwvmCJJ.exe
  2⤵
  PID:4316
- C:\Windows\System\WLBpZqA.exe
  C:\Windows\System\WLBpZqA.exe
  2⤵
  PID:4332
- C:\Windows\System\bsZrEuE.exe
  C:\Windows\System\bsZrEuE.exe
  2⤵
  PID:4340
- C:\Windows\System\hNsGljp.exe
  C:\Windows\System\hNsGljp.exe
  2⤵
  PID:4228
- C:\Windows\System\eNwZtIG.exe
  C:\Windows\System\eNwZtIG.exe
  2⤵
  PID:3836
- C:\Windows\System\aOBaGSQ.exe
  C:\Windows\System\aOBaGSQ.exe
  2⤵
  PID:4120
- C:\Windows\System\PbantiF.exe
  C:\Windows\System\PbantiF.exe
  2⤵
  PID:4404
- C:\Windows\System\PeLwcFE.exe
  C:\Windows\System\PeLwcFE.exe
  2⤵
  PID:4520
- C:\Windows\System\PMnYtIf.exe
  C:\Windows\System\PMnYtIf.exe
  2⤵
  PID:4584
- C:\Windows\System\dIQekNN.exe
  C:\Windows\System\dIQekNN.exe
  2⤵
  PID:4564
- C:\Windows\System\niecQBG.exe
  C:\Windows\System\niecQBG.exe
  2⤵
  PID:4736
- C:\Windows\System\AkmYQSD.exe
  C:\Windows\System\AkmYQSD.exe
  2⤵
  PID:4468
- C:\Windows\System\bbdllrC.exe
  C:\Windows\System\bbdllrC.exe
  2⤵
  PID:4568
- C:\Windows\System\twPPRSH.exe
  C:\Windows\System\twPPRSH.exe
  2⤵
  PID:4696
- C:\Windows\System\fjAdJrO.exe
  C:\Windows\System\fjAdJrO.exe
  2⤵
  PID:4796
- C:\Windows\System\UlvwtUh.exe
  C:\Windows\System\UlvwtUh.exe
  2⤵
  PID:4812
- C:\Windows\System\VUBdqYa.exe
  C:\Windows\System\VUBdqYa.exe
  2⤵
  PID:4748
- C:\Windows\System\asxdmWu.exe
  C:\Windows\System\asxdmWu.exe
  2⤵
  PID:4816
- C:\Windows\System\HvuGvcs.exe
  C:\Windows\System\HvuGvcs.exe
  2⤵
  PID:4908
- C:\Windows\System\vSZUGDE.exe
  C:\Windows\System\vSZUGDE.exe
  2⤵
  PID:4976
- C:\Windows\System\woCmnTe.exe
  C:\Windows\System\woCmnTe.exe
  2⤵
  PID:5072
- C:\Windows\System\RISXLzW.exe
  C:\Windows\System\RISXLzW.exe
  2⤵
  PID:5048
- C:\Windows\System\AJzTRcz.exe
  C:\Windows\System\AJzTRcz.exe
  2⤵
  PID:4052
- C:\Windows\System\RSFAouo.exe
  C:\Windows\System\RSFAouo.exe
  2⤵
  PID:1300
- C:\Windows\System\CkJzpFO.exe
  C:\Windows\System\CkJzpFO.exe
  2⤵
  PID:4188
- C:\Windows\System\ELlyNdk.exe
  C:\Windows\System\ELlyNdk.exe
  2⤵
  PID:4244
- C:\Windows\System\YMljyMx.exe
  C:\Windows\System\YMljyMx.exe
  2⤵
  PID:4516
- C:\Windows\System\EqNFSbo.exe
  C:\Windows\System\EqNFSbo.exe
  2⤵
  PID:4156
- C:\Windows\System\TglQdbw.exe
  C:\Windows\System\TglQdbw.exe
  2⤵
  PID:4692
- C:\Windows\System\IcXHKmo.exe
  C:\Windows\System\IcXHKmo.exe
  2⤵
  PID:4628
- C:\Windows\System\SmOyksy.exe
  C:\Windows\System\SmOyksy.exe
  2⤵
  PID:4752
- C:\Windows\System\zSTxjLd.exe
  C:\Windows\System\zSTxjLd.exe
  2⤵
  PID:5060
- C:\Windows\System\oqbEeTe.exe
  C:\Windows\System\oqbEeTe.exe
  2⤵
  PID:1600
- C:\Windows\System\CfCaQXw.exe
  C:\Windows\System\CfCaQXw.exe
  2⤵
  PID:4192
- C:\Windows\System\oOIbehH.exe
  C:\Windows\System\oOIbehH.exe
  2⤵
  PID:4308
- C:\Windows\System\xJuURmF.exe
  C:\Windows\System\xJuURmF.exe
  2⤵
  PID:4652
- C:\Windows\System\lunQtku.exe
  C:\Windows\System\lunQtku.exe
  2⤵
  PID:5088
- C:\Windows\System\KEntMcW.exe
  C:\Windows\System\KEntMcW.exe
  2⤵
  PID:5092
- C:\Windows\System\GQgkejZ.exe
  C:\Windows\System\GQgkejZ.exe
  2⤵
  PID:4408
- C:\Windows\System\jWLKcXW.exe
  C:\Windows\System\jWLKcXW.exe
  2⤵
  PID:5096
- C:\Windows\System\PZojdqa.exe
  C:\Windows\System\PZojdqa.exe
  2⤵
  PID:4956
- C:\Windows\System\eCFadDQ.exe
  C:\Windows\System\eCFadDQ.exe
  2⤵
  PID:3880
- C:\Windows\System\bQAWtzx.exe
  C:\Windows\System\bQAWtzx.exe
  2⤵
  PID:4292
- C:\Windows\System\jqRrRvV.exe
  C:\Windows\System\jqRrRvV.exe
  2⤵
  PID:4648
- C:\Windows\System\achXrhP.exe
  C:\Windows\System\achXrhP.exe
  2⤵
  PID:4452
- C:\Windows\System\kifZroZ.exe
  C:\Windows\System\kifZroZ.exe
  2⤵
  PID:4280
- C:\Windows\System\VKRtLkB.exe
  C:\Windows\System\VKRtLkB.exe
  2⤵
  PID:4424
- C:\Windows\System\YQaImDt.exe
  C:\Windows\System\YQaImDt.exe
  2⤵
  PID:2576
- C:\Windows\System\wOosfyQ.exe
  C:\Windows\System\wOosfyQ.exe
  2⤵
  PID:4940
- C:\Windows\System\Orodlim.exe
  C:\Windows\System\Orodlim.exe
  2⤵
  PID:4504
- C:\Windows\System\RjlnuhY.exe
  C:\Windows\System\RjlnuhY.exe
  2⤵
  PID:4764
- C:\Windows\System\REcFPXv.exe
  C:\Windows\System\REcFPXv.exe
  2⤵
  PID:5132
- C:\Windows\System\CtHrIef.exe
  C:\Windows\System\CtHrIef.exe
  2⤵
  PID:5148
- C:\Windows\System\YaTSaoq.exe
  C:\Windows\System\YaTSaoq.exe
  2⤵
  PID:5164
- C:\Windows\System\CqFAVip.exe
  C:\Windows\System\CqFAVip.exe
  2⤵
  PID:5184
- C:\Windows\System\hYiFgBy.exe
  C:\Windows\System\hYiFgBy.exe
  2⤵
  PID:5212
- C:\Windows\System\XpzXUqM.exe
  C:\Windows\System\XpzXUqM.exe
  2⤵
  PID:5228
- C:\Windows\System\ZPwLnDM.exe
  C:\Windows\System\ZPwLnDM.exe
  2⤵
  PID:5244
- C:\Windows\System\RnrTknT.exe
  C:\Windows\System\RnrTknT.exe
  2⤵
  PID:5260
- C:\Windows\System\KAflcnU.exe
  C:\Windows\System\KAflcnU.exe
  2⤵
  PID:5276
- C:\Windows\System\dmONipN.exe
  C:\Windows\System\dmONipN.exe
  2⤵
  PID:5292
- C:\Windows\System\KLhjjre.exe
  C:\Windows\System\KLhjjre.exe
  2⤵
  PID:5308
- C:\Windows\System\VPFgsOp.exe
  C:\Windows\System\VPFgsOp.exe
  2⤵
  PID:5324
- C:\Windows\System\ousGWNG.exe
  C:\Windows\System\ousGWNG.exe
  2⤵
  PID:5344
- C:\Windows\System\qzlXOkR.exe
  C:\Windows\System\qzlXOkR.exe
  2⤵
  PID:5360
- C:\Windows\System\IaPZcXO.exe
  C:\Windows\System\IaPZcXO.exe
  2⤵
  PID:5376
- C:\Windows\System\DSvRjZX.exe
  C:\Windows\System\DSvRjZX.exe
  2⤵
  PID:5396
- C:\Windows\System\GhonJDt.exe
  C:\Windows\System\GhonJDt.exe
  2⤵
  PID:5412
- C:\Windows\System\CkkGBNq.exe
  C:\Windows\System\CkkGBNq.exe
  2⤵
  PID:5432
- C:\Windows\System\usMuYlx.exe
  C:\Windows\System\usMuYlx.exe
  2⤵
  PID:5448
- C:\Windows\System\PwnnKSL.exe
  C:\Windows\System\PwnnKSL.exe
  2⤵
  PID:5468
- C:\Windows\System\GkgyTVn.exe
  C:\Windows\System\GkgyTVn.exe
  2⤵
  PID:5484
- C:\Windows\System\YdyPEcS.exe
  C:\Windows\System\YdyPEcS.exe
  2⤵
  PID:5500
- C:\Windows\System\xBzFdzi.exe
  C:\Windows\System\xBzFdzi.exe
  2⤵
  PID:5516
- C:\Windows\System\mxEGZAi.exe
  C:\Windows\System\mxEGZAi.exe
  2⤵
  PID:5532
- C:\Windows\System\EQaHiWy.exe
  C:\Windows\System\EQaHiWy.exe
  2⤵
  PID:5552
- C:\Windows\System\mDeLATW.exe
  C:\Windows\System\mDeLATW.exe
  2⤵
  PID:5568
- C:\Windows\System\eHkEjqU.exe
  C:\Windows\System\eHkEjqU.exe
  2⤵
  PID:5588
- C:\Windows\System\JGURdxh.exe
  C:\Windows\System\JGURdxh.exe
  2⤵
  PID:5604
- C:\Windows\System\trBTFYP.exe
  C:\Windows\System\trBTFYP.exe
  2⤵
  PID:5620
- C:\Windows\System\lZATlow.exe
  C:\Windows\System\lZATlow.exe
  2⤵
  PID:5676
- C:\Windows\System\SwBAwiq.exe
  C:\Windows\System\SwBAwiq.exe
  2⤵
  PID:5692
- C:\Windows\System\WPaSGYR.exe
  C:\Windows\System\WPaSGYR.exe
  2⤵
  PID:5708
- C:\Windows\System\wBcqSpL.exe
  C:\Windows\System\wBcqSpL.exe
  2⤵
  PID:5728
- C:\Windows\System\GgoVSrI.exe
  C:\Windows\System\GgoVSrI.exe
  2⤵
  PID:5744
- C:\Windows\System\jTOnMmt.exe
  C:\Windows\System\jTOnMmt.exe
  2⤵
  PID:5764
- C:\Windows\System\Lyyexzu.exe
  C:\Windows\System\Lyyexzu.exe
  2⤵
  PID:5780
- C:\Windows\System\GAeEkBp.exe
  C:\Windows\System\GAeEkBp.exe
  2⤵
  PID:5796
- C:\Windows\System\kOIWWme.exe
  C:\Windows\System\kOIWWme.exe
  2⤵
  PID:5816
- C:\Windows\System\DeWdeLx.exe
  C:\Windows\System\DeWdeLx.exe
  2⤵
  PID:5836
- C:\Windows\System\zXxcAuR.exe
  C:\Windows\System\zXxcAuR.exe
  2⤵
  PID:5852
- C:\Windows\System\yYaFXDI.exe
  C:\Windows\System\yYaFXDI.exe
  2⤵
  PID:5868
- C:\Windows\System\LAjoxxS.exe
  C:\Windows\System\LAjoxxS.exe
  2⤵
  PID:5884
- C:\Windows\System\QrmyAsk.exe
  C:\Windows\System\QrmyAsk.exe
  2⤵
  PID:5900
- C:\Windows\System\kLEboaY.exe
  C:\Windows\System\kLEboaY.exe
  2⤵
  PID:5924
- C:\Windows\System\UfMSMwn.exe
  C:\Windows\System\UfMSMwn.exe
  2⤵
  PID:6020
- C:\Windows\System\nfJpBOf.exe
  C:\Windows\System\nfJpBOf.exe
  2⤵
  PID:6036
- C:\Windows\System\bZYaaMI.exe
  C:\Windows\System\bZYaaMI.exe
  2⤵
  PID:6056
- C:\Windows\System\JgErydI.exe
  C:\Windows\System\JgErydI.exe
  2⤵
  PID:6076
- C:\Windows\System\rhBSGYF.exe
  C:\Windows\System\rhBSGYF.exe
  2⤵
  PID:6092
- C:\Windows\System\gRsYYRU.exe
  C:\Windows\System\gRsYYRU.exe
  2⤵
  PID:6108
- C:\Windows\System\bEqcNep.exe
  C:\Windows\System\bEqcNep.exe
  2⤵
  PID:6132
- C:\Windows\System\ZnWgvct.exe
  C:\Windows\System\ZnWgvct.exe
  2⤵
  PID:5128
- C:\Windows\System\cyDdkOW.exe
  C:\Windows\System\cyDdkOW.exe
  2⤵
  PID:5156
- C:\Windows\System\bfBEGws.exe
  C:\Windows\System\bfBEGws.exe
  2⤵
  PID:4848
- C:\Windows\System\aknvkvS.exe
  C:\Windows\System\aknvkvS.exe
  2⤵
  PID:5160
- C:\Windows\System\QNKwhyr.exe
  C:\Windows\System\QNKwhyr.exe
  2⤵
  PID:4676
- C:\Windows\System\BwRevvh.exe
  C:\Windows\System\BwRevvh.exe
  2⤵
  PID:5180
- C:\Windows\System\dKifHwE.exe
  C:\Windows\System\dKifHwE.exe
  2⤵
  PID:5200
- C:\Windows\System\lOfQmeG.exe
  C:\Windows\System\lOfQmeG.exe
  2⤵
  PID:5268
- C:\Windows\System\ETwEOBb.exe
  C:\Windows\System\ETwEOBb.exe
  2⤵
  PID:5440
- C:\Windows\System\XHFcifq.exe
  C:\Windows\System\XHFcifq.exe
  2⤵
  PID:5408
- C:\Windows\System\GGPRoGb.exe
  C:\Windows\System\GGPRoGb.exe
  2⤵
  PID:5336
- C:\Windows\System\haMIHSg.exe
  C:\Windows\System\haMIHSg.exe
  2⤵
  PID:5544
- C:\Windows\System\gcHzujE.exe
  C:\Windows\System\gcHzujE.exe
  2⤵
  PID:5584
- C:\Windows\System\hMMETAE.exe
  C:\Windows\System\hMMETAE.exe
  2⤵
  PID:5464
- C:\Windows\System\ogRGemP.exe
  C:\Windows\System\ogRGemP.exe
  2⤵
  PID:5256
- C:\Windows\System\EoPONLq.exe
  C:\Windows\System\EoPONLq.exe
  2⤵
  PID:5320
- C:\Windows\System\jPJIJlr.exe
  C:\Windows\System\jPJIJlr.exe
  2⤵
  PID:5392
- C:\Windows\System\XLjjuBf.exe
  C:\Windows\System\XLjjuBf.exe
  2⤵
  PID:5496
- C:\Windows\System\JwkzecQ.exe
  C:\Windows\System\JwkzecQ.exe
  2⤵
  PID:5636
- C:\Windows\System\FoJoBgV.exe
  C:\Windows\System\FoJoBgV.exe
  2⤵
  PID:5564
- C:\Windows\System\JsUAdlE.exe
  C:\Windows\System\JsUAdlE.exe
  2⤵
  PID:4988
- C:\Windows\System\HNZpEsZ.exe
  C:\Windows\System\HNZpEsZ.exe
  2⤵
  PID:5704
- C:\Windows\System\BwUUgbK.exe
  C:\Windows\System\BwUUgbK.exe
  2⤵
  PID:5792
- C:\Windows\System\FemnCLG.exe
  C:\Windows\System\FemnCLG.exe
  2⤵
  PID:5832
- C:\Windows\System\MODeGIz.exe
  C:\Windows\System\MODeGIz.exe
  2⤵
  PID:5772
- C:\Windows\System\YPPeLfH.exe
  C:\Windows\System\YPPeLfH.exe
  2⤵
  PID:5776
- C:\Windows\System\jajDYqQ.exe
  C:\Windows\System\jajDYqQ.exe
  2⤵
  PID:5812
- C:\Windows\System\gAvhfso.exe
  C:\Windows\System\gAvhfso.exe
  2⤵
  PID:5880
- C:\Windows\System\kkqJjSU.exe
  C:\Windows\System\kkqJjSU.exe
  2⤵
  PID:5724
- C:\Windows\System\YxEGjLY.exe
  C:\Windows\System\YxEGjLY.exe
  2⤵
  PID:5940
- C:\Windows\System\QfabsCe.exe
  C:\Windows\System\QfabsCe.exe
  2⤵
  PID:5956
- C:\Windows\System\ZubZTTV.exe
  C:\Windows\System\ZubZTTV.exe
  2⤵
  PID:5972
- C:\Windows\System\cXKHXzN.exe
  C:\Windows\System\cXKHXzN.exe
  2⤵
  PID:5988
- C:\Windows\System\kQgrRaT.exe
  C:\Windows\System\kQgrRaT.exe
  2⤵
  PID:6004
- C:\Windows\System\kjJJCkM.exe
  C:\Windows\System\kjJJCkM.exe
  2⤵
  PID:6052
- C:\Windows\System\SpVYdaQ.exe
  C:\Windows\System\SpVYdaQ.exe
  2⤵
  PID:6116
- C:\Windows\System\xNynBCJ.exe
  C:\Windows\System\xNynBCJ.exe
  2⤵
  PID:4828
- C:\Windows\System\YgjhzRX.exe
  C:\Windows\System\YgjhzRX.exe
  2⤵
  PID:6064
- C:\Windows\System\mWTiWhT.exe
  C:\Windows\System\mWTiWhT.exe
  2⤵
  PID:6104
- C:\Windows\System\yvKUIis.exe
  C:\Windows\System\yvKUIis.exe
  2⤵
  PID:5076
- C:\Windows\System\KcCRtgk.exe
  C:\Windows\System\KcCRtgk.exe
  2⤵
  PID:5144
- C:\Windows\System\bCZrNhB.exe
  C:\Windows\System\bCZrNhB.exe
  2⤵
  PID:5476
- C:\Windows\System\UHXzNrA.exe
  C:\Windows\System\UHXzNrA.exe
  2⤵
  PID:5208
- C:\Windows\System\ArWXtOa.exe
  C:\Windows\System\ArWXtOa.exe
  2⤵
  PID:5508
- C:\Windows\System\iNfkyIU.exe
  C:\Windows\System\iNfkyIU.exe
  2⤵
  PID:5388
- C:\Windows\System\YZuzafc.exe
  C:\Windows\System\YZuzafc.exe
  2⤵
  PID:5316
- C:\Windows\System\aMwtUYv.exe
  C:\Windows\System\aMwtUYv.exe
  2⤵
  PID:5648
- C:\Windows\System\skzuppi.exe
  C:\Windows\System\skzuppi.exe
  2⤵
  PID:5660
- C:\Windows\System\iGrVlIL.exe
  C:\Windows\System\iGrVlIL.exe
  2⤵
  PID:5700
- C:\Windows\System\NUXHxUO.exe
  C:\Windows\System\NUXHxUO.exe
  2⤵
  PID:5740
- C:\Windows\System\NqzPxyx.exe
  C:\Windows\System\NqzPxyx.exe
  2⤵
  PID:5596
- C:\Windows\System\okPMuqK.exe
  C:\Windows\System\okPMuqK.exe
  2⤵
  PID:5736
- C:\Windows\System\FDrfXnw.exe
  C:\Windows\System\FDrfXnw.exe
  2⤵
  PID:5716
- C:\Windows\System\gHEYuXf.exe
  C:\Windows\System\gHEYuXf.exe
  2⤵
  PID:5808
- C:\Windows\System\ofclldg.exe
  C:\Windows\System\ofclldg.exe
  2⤵
  PID:5804
- C:\Windows\System\vmePoRb.exe
  C:\Windows\System\vmePoRb.exe
  2⤵
  PID:5948
- C:\Windows\System\cIhDkCy.exe
  C:\Windows\System\cIhDkCy.exe
  2⤵
  PID:5996
- C:\Windows\System\LwEalHK.exe
  C:\Windows\System\LwEalHK.exe
  2⤵
  PID:6084
- C:\Windows\System\qFocuQn.exe
  C:\Windows\System\qFocuQn.exe
  2⤵
  PID:5020
- C:\Windows\System\NDeOBit.exe
  C:\Windows\System\NDeOBit.exe
  2⤵
  PID:5124
- C:\Windows\System\ZjpgjUs.exe
  C:\Windows\System\ZjpgjUs.exe
  2⤵
  PID:5480
- C:\Windows\System\UebWkaC.exe
  C:\Windows\System\UebWkaC.exe
  2⤵
  PID:5384
- C:\Windows\System\YzvFXrH.exe
  C:\Windows\System\YzvFXrH.exe
  2⤵
  PID:5656
- C:\Windows\System\spZljMe.exe
  C:\Windows\System\spZljMe.exe
  2⤵
  PID:5140
- C:\Windows\System\dWrcIRS.exe
  C:\Windows\System\dWrcIRS.exe
  2⤵
  PID:5876
- C:\Windows\System\ecqcFda.exe
  C:\Windows\System\ecqcFda.exe
  2⤵
  PID:5980
- C:\Windows\System\bOvuUFJ.exe
  C:\Windows\System\bOvuUFJ.exe
  2⤵
  PID:5512
- C:\Windows\System\VyAMqwp.exe
  C:\Windows\System\VyAMqwp.exe
  2⤵
  PID:5372
- C:\Windows\System\ZUwwnYL.exe
  C:\Windows\System\ZUwwnYL.exe
  2⤵
  PID:1552
- C:\Windows\System\XvebSBv.exe
  C:\Windows\System\XvebSBv.exe
  2⤵
  PID:5460
- C:\Windows\System\iGxkbMF.exe
  C:\Windows\System\iGxkbMF.exe
  2⤵
  PID:5828
- C:\Windows\System\FfbMHTt.exe
  C:\Windows\System\FfbMHTt.exe
  2⤵
  PID:6128
- C:\Windows\System\mTuSPvr.exe
  C:\Windows\System\mTuSPvr.exe
  2⤵
  PID:5968
- C:\Windows\System\sYmvGhn.exe
  C:\Windows\System\sYmvGhn.exe
  2⤵
  PID:5788
- C:\Windows\System\nijRfpd.exe
  C:\Windows\System\nijRfpd.exe
  2⤵
  PID:5560
- C:\Windows\System\ydrHcPz.exe
  C:\Windows\System\ydrHcPz.exe
  2⤵
  PID:5688
- C:\Windows\System\DuSSqcz.exe
  C:\Windows\System\DuSSqcz.exe
  2⤵
  PID:6032
- C:\Windows\System\VoxScnF.exe
  C:\Windows\System\VoxScnF.exe
  2⤵
  PID:6148
- C:\Windows\System\vHKOwcI.exe
  C:\Windows\System\vHKOwcI.exe
  2⤵
  PID:6164
- C:\Windows\System\jrkkpiZ.exe
  C:\Windows\System\jrkkpiZ.exe
  2⤵
  PID:6180
- C:\Windows\System\ligzgqm.exe
  C:\Windows\System\ligzgqm.exe
  2⤵
  PID:6196
- C:\Windows\System\zZGMMfM.exe
  C:\Windows\System\zZGMMfM.exe
  2⤵
  PID:6216
- C:\Windows\System\qwSVZqF.exe
  C:\Windows\System\qwSVZqF.exe
  2⤵
  PID:6232
- C:\Windows\System\PAcRYVP.exe
  C:\Windows\System\PAcRYVP.exe
  2⤵
  PID:6248
- C:\Windows\System\CjmSrBQ.exe
  C:\Windows\System\CjmSrBQ.exe
  2⤵
  PID:6264
- C:\Windows\System\qaTSdHt.exe
  C:\Windows\System\qaTSdHt.exe
  2⤵
  PID:6280
- C:\Windows\System\kMcWiVt.exe
  C:\Windows\System\kMcWiVt.exe
  2⤵
  PID:6296
- C:\Windows\System\kyNFOmA.exe
  C:\Windows\System\kyNFOmA.exe
  2⤵
  PID:6312
- C:\Windows\System\QMLVnOW.exe
  C:\Windows\System\QMLVnOW.exe
  2⤵
  PID:6328
- C:\Windows\System\tvszLSc.exe
  C:\Windows\System\tvszLSc.exe
  2⤵
  PID:6344
- C:\Windows\System\kjeNTjJ.exe
  C:\Windows\System\kjeNTjJ.exe
  2⤵
  PID:6360
- C:\Windows\System\FRalBGH.exe
  C:\Windows\System\FRalBGH.exe
  2⤵
  PID:6376
- C:\Windows\System\YExHyHL.exe
  C:\Windows\System\YExHyHL.exe
  2⤵
  PID:6392
- C:\Windows\System\IbtjibN.exe
  C:\Windows\System\IbtjibN.exe
  2⤵
  PID:6408
- C:\Windows\System\rEXQPhD.exe
  C:\Windows\System\rEXQPhD.exe
  2⤵
  PID:6424
- C:\Windows\System\wZzhkxr.exe
  C:\Windows\System\wZzhkxr.exe
  2⤵
  PID:6444
- C:\Windows\System\bZlAnZs.exe
  C:\Windows\System\bZlAnZs.exe
  2⤵
  PID:6464
- C:\Windows\System\ONmMjAU.exe
  C:\Windows\System\ONmMjAU.exe
  2⤵
  PID:6480
- C:\Windows\System\YWBIILc.exe
  C:\Windows\System\YWBIILc.exe
  2⤵
  PID:6500
- C:\Windows\System\tMxwmyX.exe
  C:\Windows\System\tMxwmyX.exe
  2⤵
  PID:6516
- C:\Windows\System\vKhGhvL.exe
  C:\Windows\System\vKhGhvL.exe
  2⤵
  PID:6532
- C:\Windows\System\EeAqtLC.exe
  C:\Windows\System\EeAqtLC.exe
  2⤵
  PID:6548
- C:\Windows\System\MEaEPPJ.exe
  C:\Windows\System\MEaEPPJ.exe
  2⤵
  PID:6564
- C:\Windows\System\dAINiwP.exe
  C:\Windows\System\dAINiwP.exe
  2⤵
  PID:6580
- C:\Windows\System\UijCJpk.exe
  C:\Windows\System\UijCJpk.exe
  2⤵
  PID:6600
- C:\Windows\System\DPQWlYt.exe
  C:\Windows\System\DPQWlYt.exe
  2⤵
  PID:6616
- C:\Windows\System\bOkOviX.exe
  C:\Windows\System\bOkOviX.exe
  2⤵
  PID:6632
- C:\Windows\System\blbfmYr.exe
  C:\Windows\System\blbfmYr.exe
  2⤵
  PID:6648
- C:\Windows\System\FMYQoCq.exe
  C:\Windows\System\FMYQoCq.exe
  2⤵
  PID:6664
- C:\Windows\System\IKdOVAY.exe
  C:\Windows\System\IKdOVAY.exe
  2⤵
  PID:6684
- C:\Windows\System\YGOhOOi.exe
  C:\Windows\System\YGOhOOi.exe
  2⤵
  PID:6700
- C:\Windows\System\ZSovpQC.exe
  C:\Windows\System\ZSovpQC.exe
  2⤵
  PID:6716
- C:\Windows\System\MtLhERw.exe
  C:\Windows\System\MtLhERw.exe
  2⤵
  PID:6732
- C:\Windows\System\xcyeBwr.exe
  C:\Windows\System\xcyeBwr.exe
  2⤵
  PID:6752
- C:\Windows\System\eKkOdkC.exe
  C:\Windows\System\eKkOdkC.exe
  2⤵
  PID:6768
- C:\Windows\System\mluAuOs.exe
  C:\Windows\System\mluAuOs.exe
  2⤵
  PID:6788
- C:\Windows\System\voxxYvB.exe
  C:\Windows\System\voxxYvB.exe
  2⤵
  PID:6816
- C:\Windows\System\tvTomCo.exe
  C:\Windows\System\tvTomCo.exe
  2⤵
  PID:6832
- C:\Windows\System\QtURoCe.exe
  C:\Windows\System\QtURoCe.exe
  2⤵
  PID:6852
- C:\Windows\System\xfeWNhA.exe
  C:\Windows\System\xfeWNhA.exe
  2⤵
  PID:6868
- C:\Windows\System\RDtAMLZ.exe
  C:\Windows\System\RDtAMLZ.exe
  2⤵
  PID:6884
- C:\Windows\System\DwDrxaN.exe
  C:\Windows\System\DwDrxaN.exe
  2⤵
  PID:6900
- C:\Windows\System\NIDxIFm.exe
  C:\Windows\System\NIDxIFm.exe
  2⤵
  PID:6916
- C:\Windows\System\JgWbCtC.exe
  C:\Windows\System\JgWbCtC.exe
  2⤵
  PID:6932
- C:\Windows\System\xvGnCKj.exe
  C:\Windows\System\xvGnCKj.exe
  2⤵
  PID:6960
- C:\Windows\System\dIHgcGD.exe
  C:\Windows\System\dIHgcGD.exe
  2⤵
  PID:6976
- C:\Windows\System\SkRSWTz.exe
  C:\Windows\System\SkRSWTz.exe
  2⤵
  PID:6992
- C:\Windows\System\hjWlHNV.exe
  C:\Windows\System\hjWlHNV.exe
  2⤵
  PID:7008
- C:\Windows\System\rADFgcP.exe
  C:\Windows\System\rADFgcP.exe
  2⤵
  PID:7028
- C:\Windows\System\JaIQpGL.exe
  C:\Windows\System\JaIQpGL.exe
  2⤵
  PID:7044
- C:\Windows\System\XFRjPaJ.exe
  C:\Windows\System\XFRjPaJ.exe
  2⤵
  PID:7060
- C:\Windows\System\IbgKcXs.exe
  C:\Windows\System\IbgKcXs.exe
  2⤵
  PID:7080
- C:\Windows\System\JLgyjFe.exe
  C:\Windows\System\JLgyjFe.exe
  2⤵
  PID:7096
- C:\Windows\System\QgsqrrA.exe
  C:\Windows\System\QgsqrrA.exe
  2⤵
  PID:7116
- C:\Windows\System\YmjUfWj.exe
  C:\Windows\System\YmjUfWj.exe
  2⤵
  PID:7132
- C:\Windows\System\YBzDWvL.exe
  C:\Windows\System\YBzDWvL.exe
  2⤵
  PID:7148
- C:\Windows\System\IGKxNWj.exe
  C:\Windows\System\IGKxNWj.exe
  2⤵
  PID:7164
- C:\Windows\System\jhjXFws.exe
  C:\Windows\System\jhjXFws.exe
  2⤵
  PID:5756
- C:\Windows\System\DwYXgeB.exe
  C:\Windows\System\DwYXgeB.exe
  2⤵
  PID:5356
- C:\Windows\System\crteYWX.exe
  C:\Windows\System\crteYWX.exe
  2⤵
  PID:6204
- C:\Windows\System\itVLFIN.exe
  C:\Windows\System\itVLFIN.exe
  2⤵
  PID:6244
- C:\Windows\System\ZeviUlo.exe
  C:\Windows\System\ZeviUlo.exe
  2⤵
  PID:6012
- C:\Windows\System\HpyKqfe.exe
  C:\Windows\System\HpyKqfe.exe
  2⤵
  PID:6224
- C:\Windows\System\iYWEwbq.exe
  C:\Windows\System\iYWEwbq.exe
  2⤵
  PID:6256
- C:\Windows\System\WJlGQQh.exe
  C:\Windows\System\WJlGQQh.exe
  2⤵
  PID:6308
- C:\Windows\System\UShGCGC.exe
  C:\Windows\System\UShGCGC.exe
  2⤵
  PID:6372
- C:\Windows\System\nlUFiuS.exe
  C:\Windows\System\nlUFiuS.exe
  2⤵
  PID:6436
- C:\Windows\System\yWnTaMd.exe
  C:\Windows\System\yWnTaMd.exe
  2⤵
  PID:6508
- C:\Windows\System\mTEHbZf.exe
  C:\Windows\System\mTEHbZf.exe
  2⤵
  PID:6576
- C:\Windows\System\GJaSZeI.exe
  C:\Windows\System\GJaSZeI.exe
  2⤵
  PID:6644
- C:\Windows\System\oMDpgVU.exe
  C:\Windows\System\oMDpgVU.exe
  2⤵
  PID:6824
- C:\Windows\System\uQjBtLt.exe
  C:\Windows\System\uQjBtLt.exe
  2⤵
  PID:6864
- C:\Windows\System\qxqEpVp.exe
  C:\Windows\System\qxqEpVp.exe
  2⤵
  PID:6808
- C:\Windows\System\YrMknfK.exe
  C:\Windows\System\YrMknfK.exe
  2⤵
  PID:6844
- C:\Windows\System\hBOlocV.exe
  C:\Windows\System\hBOlocV.exe
  2⤵
  PID:6628
- C:\Windows\System\XyPaCaz.exe
  C:\Windows\System\XyPaCaz.exe
  2⤵
  PID:6492
- C:\Windows\System\bAcQWbN.exe
  C:\Windows\System\bAcQWbN.exe
  2⤵
  PID:6556
- C:\Windows\System\NmLjuJJ.exe
  C:\Windows\System\NmLjuJJ.exe
  2⤵
  PID:6596
- C:\Windows\System\YZCVFxh.exe
  C:\Windows\System\YZCVFxh.exe
  2⤵
  PID:6696
- C:\Windows\System\jigYXpg.exe
  C:\Windows\System\jigYXpg.exe
  2⤵
  PID:6760
- C:\Windows\System\wveITNz.exe
  C:\Windows\System\wveITNz.exe
  2⤵
  PID:7000
- C:\Windows\System\bAPyRbR.exe
  C:\Windows\System\bAPyRbR.exe
  2⤵
  PID:7068
- C:\Windows\System\sfuaVaH.exe
  C:\Windows\System\sfuaVaH.exe
  2⤵
  PID:7104
- C:\Windows\System\qHgvFbf.exe
  C:\Windows\System\qHgvFbf.exe
  2⤵
  PID:6940
- C:\Windows\System\NUYTcoP.exe
  C:\Windows\System\NUYTcoP.exe
  2⤵
  PID:7144
- C:\Windows\System\fhGolZZ.exe
  C:\Windows\System\fhGolZZ.exe
  2⤵
  PID:6172
- C:\Windows\System\XJjrdDX.exe
  C:\Windows\System\XJjrdDX.exe
  2⤵
  PID:6984
- C:\Windows\System\tHrZlil.exe
  C:\Windows\System\tHrZlil.exe
  2⤵
  PID:7024
- C:\Windows\System\LGzrMjg.exe
  C:\Windows\System\LGzrMjg.exe
  2⤵
  PID:7124
- C:\Windows\System\YLOmsfN.exe
  C:\Windows\System\YLOmsfN.exe
  2⤵
  PID:5952
- C:\Windows\System\hGFnmHg.exe
  C:\Windows\System\hGFnmHg.exe
  2⤵
  PID:6240
- C:\Windows\System\dGuOnLZ.exe
  C:\Windows\System\dGuOnLZ.exe
  2⤵
  PID:6340
- C:\Windows\System\HUqCLsT.exe
  C:\Windows\System\HUqCLsT.exe
  2⤵
  PID:6612
- C:\Windows\System\LQdGtoy.exe
  C:\Windows\System\LQdGtoy.exe
  2⤵
  PID:6540
- C:\Windows\System\oPDJfxu.exe
  C:\Windows\System\oPDJfxu.exe
  2⤵
  PID:6188
- C:\Windows\System\FpKTSpJ.exe
  C:\Windows\System\FpKTSpJ.exe
  2⤵
  PID:6708
- C:\Windows\System\PPGAjsS.exe
  C:\Windows\System\PPGAjsS.exe
  2⤵
  PID:6776
- C:\Windows\System\XvDKRBS.exe
  C:\Windows\System\XvDKRBS.exe
  2⤵
  PID:6352
- C:\Windows\System\zkwvbSp.exe
  C:\Windows\System\zkwvbSp.exe
  2⤵
  PID:6416
- C:\Windows\System\mCHDaDL.exe
  C:\Windows\System\mCHDaDL.exe
  2⤵
  PID:6292
- C:\Windows\System\BrLcPyF.exe
  C:\Windows\System\BrLcPyF.exe
  2⤵
  PID:6812
- C:\Windows\System\LEOrcxM.exe
  C:\Windows\System\LEOrcxM.exe
  2⤵
  PID:6800
- C:\Windows\System\MyWSYQd.exe
  C:\Windows\System\MyWSYQd.exe
  2⤵
  PID:6952
- C:\Windows\System\XxQrEkZ.exe
  C:\Windows\System\XxQrEkZ.exe
  2⤵
  PID:6956
- C:\Windows\System\sFfhThl.exe
  C:\Windows\System\sFfhThl.exe
  2⤵
  PID:7112
- C:\Windows\System\NbMUBvN.exe
  C:\Windows\System\NbMUBvN.exe
  2⤵
  PID:5240
- C:\Windows\System\PlXgsJn.exe
  C:\Windows\System\PlXgsJn.exe
  2⤵
  PID:7016
- C:\Windows\System\LgpjUlk.exe
  C:\Windows\System\LgpjUlk.exe
  2⤵
  PID:7108
- C:\Windows\System\gUwdPop.exe
  C:\Windows\System\gUwdPop.exe
  2⤵
  PID:7092
- C:\Windows\System\loHoBCS.exe
  C:\Windows\System\loHoBCS.exe
  2⤵
  PID:7160
- C:\Windows\System\Cwqjdnb.exe
  C:\Windows\System\Cwqjdnb.exe
  2⤵
  PID:6208
- C:\Windows\System\yyXzRxQ.exe
  C:\Windows\System\yyXzRxQ.exe
  2⤵
  PID:6432
- C:\Windows\System\PhNpwoJ.exe
  C:\Windows\System\PhNpwoJ.exe
  2⤵
  PID:6676
- C:\Windows\System\fGATsjh.exe
  C:\Windows\System\fGATsjh.exe
  2⤵
  PID:7176
- C:\Windows\System\fugCpub.exe
  C:\Windows\System\fugCpub.exe
  2⤵
  PID:7196
- C:\Windows\System\yLibmmM.exe
  C:\Windows\System\yLibmmM.exe
  2⤵
  PID:7212
- C:\Windows\System\QkfawdT.exe
  C:\Windows\System\QkfawdT.exe
  2⤵
  PID:7228
- C:\Windows\System\xNmXykU.exe
  C:\Windows\System\xNmXykU.exe
  2⤵
  PID:7248
- C:\Windows\System\FNQRiIl.exe
  C:\Windows\System\FNQRiIl.exe
  2⤵
  PID:7400
- C:\Windows\System\TcljzWs.exe
  C:\Windows\System\TcljzWs.exe
  2⤵
  PID:7420
- C:\Windows\System\xkJIuyg.exe
  C:\Windows\System\xkJIuyg.exe
  2⤵
  PID:7440
- C:\Windows\System\vFJDUEL.exe
  C:\Windows\System\vFJDUEL.exe
  2⤵
  PID:7456
- C:\Windows\System\oqtWOvo.exe
  C:\Windows\System\oqtWOvo.exe
  2⤵
  PID:7472
- C:\Windows\System\YHFmBxL.exe
  C:\Windows\System\YHFmBxL.exe
  2⤵
  PID:7488
- C:\Windows\System\AKNqVHh.exe
  C:\Windows\System\AKNqVHh.exe
  2⤵
  PID:7504
- C:\Windows\System\ohtTtXi.exe
  C:\Windows\System\ohtTtXi.exe
  2⤵
  PID:7520
- C:\Windows\System\JWBerqw.exe
  C:\Windows\System\JWBerqw.exe
  2⤵
  PID:7540
- C:\Windows\System\ERAWQkW.exe
  C:\Windows\System\ERAWQkW.exe
  2⤵
  PID:7556
- C:\Windows\System\gbtumnJ.exe
  C:\Windows\System\gbtumnJ.exe
  2⤵
  PID:7572
- C:\Windows\System\qbmbIGx.exe
  C:\Windows\System\qbmbIGx.exe
  2⤵
  PID:7588
- C:\Windows\System\vPHnhBZ.exe
  C:\Windows\System\vPHnhBZ.exe
  2⤵
  PID:7608
- C:\Windows\System\vsMVrsk.exe
  C:\Windows\System\vsMVrsk.exe
  2⤵
  PID:7640
- C:\Windows\System\JwvlFUQ.exe
  C:\Windows\System\JwvlFUQ.exe
  2⤵
  PID:7664
- C:\Windows\System\FYiUmvZ.exe
  C:\Windows\System\FYiUmvZ.exe
  2⤵
  PID:7692
- C:\Windows\System\VqUwMBL.exe
  C:\Windows\System\VqUwMBL.exe
  2⤵
  PID:7712
- C:\Windows\System\EmbkBQs.exe
  C:\Windows\System\EmbkBQs.exe
  2⤵
  PID:7728
- C:\Windows\System\yhIrySB.exe
  C:\Windows\System\yhIrySB.exe
  2⤵
  PID:7744
- C:\Windows\System\dxuRHEk.exe
  C:\Windows\System\dxuRHEk.exe
  2⤵
  PID:7760
- C:\Windows\System\BkeIDUc.exe
  C:\Windows\System\BkeIDUc.exe
  2⤵
  PID:7776
- C:\Windows\System\MBjyzfj.exe
  C:\Windows\System\MBjyzfj.exe
  2⤵
  PID:7796
- C:\Windows\System\juVLXuq.exe
  C:\Windows\System\juVLXuq.exe
  2⤵
  PID:7812
- C:\Windows\System\pyCIdSH.exe
  C:\Windows\System\pyCIdSH.exe
  2⤵
  PID:7828
- C:\Windows\System\vhRyceA.exe
  C:\Windows\System\vhRyceA.exe
  2⤵
  PID:7844
- C:\Windows\System\xINRbds.exe
  C:\Windows\System\xINRbds.exe
  2⤵
  PID:7860
- C:\Windows\System\urZZrNY.exe
  C:\Windows\System\urZZrNY.exe
  2⤵
  PID:7876
- C:\Windows\System\FqjYLXS.exe
  C:\Windows\System\FqjYLXS.exe
  2⤵
  PID:7892
- C:\Windows\System\UArqrrp.exe
  C:\Windows\System\UArqrrp.exe
  2⤵
  PID:7912
- C:\Windows\System\AxmLpJf.exe
  C:\Windows\System\AxmLpJf.exe
  2⤵
  PID:7928
- C:\Windows\System\aLliQPi.exe
  C:\Windows\System\aLliQPi.exe
  2⤵
  PID:7960
- C:\Windows\System\ypZIGJy.exe
  C:\Windows\System\ypZIGJy.exe
  2⤵
  PID:7980
- C:\Windows\System\IBHyWwO.exe
  C:\Windows\System\IBHyWwO.exe
  2⤵
  PID:7996
- C:\Windows\System\AfbyuvZ.exe
  C:\Windows\System\AfbyuvZ.exe
  2⤵
  PID:8012
- C:\Windows\System\ZWJErFV.exe
  C:\Windows\System\ZWJErFV.exe
  2⤵
  PID:8028
- C:\Windows\System\XOCquEl.exe
  C:\Windows\System\XOCquEl.exe
  2⤵
  PID:8044
- C:\Windows\System\fYWGzzB.exe
  C:\Windows\System\fYWGzzB.exe
  2⤵
  PID:8060
- C:\Windows\System\buYtjTw.exe
  C:\Windows\System\buYtjTw.exe
  2⤵
  PID:8076
- C:\Windows\System\FxgaQgq.exe
  C:\Windows\System\FxgaQgq.exe
  2⤵
  PID:8092
- C:\Windows\System\iTulTvX.exe
  C:\Windows\System\iTulTvX.exe
  2⤵
  PID:8108
- C:\Windows\System\csrtciL.exe
  C:\Windows\System\csrtciL.exe
  2⤵
  PID:8124
- C:\Windows\System\WhIIFFm.exe
  C:\Windows\System\WhIIFFm.exe
  2⤵
  PID:8144
- C:\Windows\System\UdHMqfA.exe
  C:\Windows\System\UdHMqfA.exe
  2⤵
  PID:8160
- C:\Windows\System\ipwWckx.exe
  C:\Windows\System\ipwWckx.exe
  2⤵
  PID:8176
- C:\Windows\System\nnaWjjk.exe
  C:\Windows\System\nnaWjjk.exe
  2⤵
  PID:6320
- C:\Windows\System\wRgrhqe.exe
  C:\Windows\System\wRgrhqe.exe
  2⤵
  PID:6928
- C:\Windows\System\aSXGoxY.exe
  C:\Windows\System\aSXGoxY.exe
  2⤵
  PID:7072
- C:\Windows\System\HSmcEyb.exe
  C:\Windows\System\HSmcEyb.exe
  2⤵
  PID:6404
- C:\Windows\System\fKbrWgJ.exe
  C:\Windows\System\fKbrWgJ.exe
  2⤵
  PID:7204
- C:\Windows\System\BoNqpzw.exe
  C:\Windows\System\BoNqpzw.exe
  2⤵
  PID:6588
- C:\Windows\System\lngqesZ.exe
  C:\Windows\System\lngqesZ.exe
  2⤵
  PID:6456
- C:\Windows\System\wNYJZhe.exe
  C:\Windows\System\wNYJZhe.exe
  2⤵
  PID:7384
- C:\Windows\System\ZzYRVQH.exe
  C:\Windows\System\ZzYRVQH.exe
  2⤵
  PID:7280
- C:\Windows\System\CvirBLH.exe
  C:\Windows\System\CvirBLH.exe
  2⤵
  PID:7364
- C:\Windows\System\HuKpGwZ.exe
  C:\Windows\System\HuKpGwZ.exe
  2⤵
  PID:6848
- C:\Windows\System\JsMrhRk.exe
  C:\Windows\System\JsMrhRk.exe
  2⤵
  PID:6968
- C:\Windows\System\bTqYClT.exe
  C:\Windows\System\bTqYClT.exe
  2⤵
  PID:6160
- C:\Windows\System\uHEagox.exe
  C:\Windows\System\uHEagox.exe
  2⤵
  PID:7192
- C:\Windows\System\YRSCbpw.exe
  C:\Windows\System\YRSCbpw.exe
  2⤵
  PID:7268
- C:\Windows\System\uCvzEGP.exe
  C:\Windows\System\uCvzEGP.exe
  2⤵
  PID:7292
- C:\Windows\System\OMXuTNs.exe
  C:\Windows\System\OMXuTNs.exe
  2⤵
  PID:7316
- C:\Windows\System\JPjpvbE.exe
  C:\Windows\System\JPjpvbE.exe
  2⤵
  PID:7340
- C:\Windows\System\wNsAbEn.exe
  C:\Windows\System\wNsAbEn.exe
  2⤵
  PID:7360
- C:\Windows\System\eYdTCEK.exe
  C:\Windows\System\eYdTCEK.exe
  2⤵
  PID:7380
- C:\Windows\System\ingCEHY.exe
  C:\Windows\System\ingCEHY.exe
  2⤵
  PID:7260
- C:\Windows\System\SEmmhUk.exe
  C:\Windows\System\SEmmhUk.exe
  2⤵
  PID:7448
- C:\Windows\System\XpSjzUF.exe
  C:\Windows\System\XpSjzUF.exe
  2⤵
  PID:7512
- C:\Windows\System\xobjyyZ.exe
  C:\Windows\System\xobjyyZ.exe
  2⤵
  PID:7580
- C:\Windows\System\jSTounC.exe
  C:\Windows\System\jSTounC.exe
  2⤵
  PID:7628
- C:\Windows\System\yvgZZSk.exe
  C:\Windows\System\yvgZZSk.exe
  2⤵
  PID:7680
- C:\Windows\System\yLisTBg.exe
  C:\Windows\System\yLisTBg.exe
  2⤵
  PID:7464
- C:\Windows\System\jsgvDkG.exe
  C:\Windows\System\jsgvDkG.exe
  2⤵
  PID:7500
- C:\Windows\System\pGmSkzL.exe
  C:\Windows\System\pGmSkzL.exe
  2⤵
  PID:7568
- C:\Windows\System\OwmLZgw.exe
  C:\Windows\System\OwmLZgw.exe
  2⤵
  PID:7648
- C:\Windows\System\LUEiBYi.exe
  C:\Windows\System\LUEiBYi.exe
  2⤵
  PID:7684
- C:\Windows\System\XbldZnw.exe
  C:\Windows\System\XbldZnw.exe
  2⤵
  PID:7736
- C:\Windows\System\PWPYVEi.exe
  C:\Windows\System\PWPYVEi.exe
  2⤵
  PID:7740
- C:\Windows\System\ydPesdY.exe
  C:\Windows\System\ydPesdY.exe
  2⤵
  PID:7784
- C:\Windows\System\wOreEVc.exe
  C:\Windows\System\wOreEVc.exe
  2⤵
  PID:7792
- C:\Windows\System\ndCAQAZ.exe
  C:\Windows\System\ndCAQAZ.exe
  2⤵
  PID:7840
- C:\Windows\System\JMhLBDI.exe
  C:\Windows\System\JMhLBDI.exe
  2⤵
  PID:7904
- C:\Windows\System\GeXcOcK.exe
  C:\Windows\System\GeXcOcK.exe
  2⤵
  PID:7824
- C:\Windows\System\QIQOGva.exe
  C:\Windows\System\QIQOGva.exe
  2⤵
  PID:7888
- C:\Windows\System\HrDmaTv.exe
  C:\Windows\System\HrDmaTv.exe
  2⤵
  PID:7976
- C:\Windows\System\VozonGx.exe
  C:\Windows\System\VozonGx.exe
  2⤵
  PID:7936
- C:\Windows\System\mUCvcZo.exe
  C:\Windows\System\mUCvcZo.exe
  2⤵
  PID:7952
- C:\Windows\System\BtNbaAB.exe
  C:\Windows\System\BtNbaAB.exe
  2⤵
  PID:6692
- C:\Windows\System\ZTxAFvU.exe
  C:\Windows\System\ZTxAFvU.exe
  2⤵
  PID:8068
- C:\Windows\System\fclDFQz.exe
  C:\Windows\System\fclDFQz.exe
  2⤵
  PID:8088
- C:\Windows\System\HbrIVQa.exe
  C:\Windows\System\HbrIVQa.exe
  2⤵
  PID:8136
- C:\Windows\System\GvwlSTp.exe
  C:\Windows\System\GvwlSTp.exe
  2⤵
  PID:8152
- C:\Windows\System\RzlVMQd.exe
  C:\Windows\System\RzlVMQd.exe
  2⤵
  PID:6592
- C:\Windows\System\vHRQHXF.exe
  C:\Windows\System\vHRQHXF.exe
  2⤵
  PID:6304
- C:\Windows\System\kNuHQwg.exe
  C:\Windows\System\kNuHQwg.exe
  2⤵
  PID:7348
- C:\Windows\System\zfNwpeT.exe
  C:\Windows\System\zfNwpeT.exe
  2⤵
  PID:7036
- C:\Windows\System\lGcnBZt.exe
  C:\Windows\System\lGcnBZt.exe
  2⤵
  PID:7184
- C:\Windows\System\TZKZuGJ.exe
  C:\Windows\System\TZKZuGJ.exe
  2⤵
  PID:7324
- C:\Windows\System\KvLKRDU.exe
  C:\Windows\System\KvLKRDU.exe
  2⤵
  PID:7416
- C:\Windows\System\YZGFlxD.exe
  C:\Windows\System\YZGFlxD.exe
  2⤵
  PID:6288
- C:\Windows\System\klFiMqX.exe
  C:\Windows\System\klFiMqX.exe
  2⤵
  PID:7352
- C:\Windows\System\dKAfizn.exe
  C:\Windows\System\dKAfizn.exe
  2⤵
  PID:7484
- C:\Windows\System\kWgVTgn.exe
  C:\Windows\System\kWgVTgn.exe
  2⤵
  PID:6476
- C:\Windows\System\vzXoWso.exe
  C:\Windows\System\vzXoWso.exe
  2⤵
  PID:7264
- C:\Windows\System\BsDGeFH.exe
  C:\Windows\System\BsDGeFH.exe
  2⤵
  PID:7480
- C:\Windows\System\TYVuZfk.exe
  C:\Windows\System\TYVuZfk.exe
  2⤵
  PID:7604
- C:\Windows\System\FuzTFRq.exe
  C:\Windows\System\FuzTFRq.exe
  2⤵
  PID:7724
- C:\Windows\System\uhHkwsD.exe
  C:\Windows\System\uhHkwsD.exe
  2⤵
  PID:7624
- C:\Windows\System\rmHinMI.exe
  C:\Windows\System\rmHinMI.exe
  2⤵
  PID:7924
- C:\Windows\System\zmcUQEU.exe
  C:\Windows\System\zmcUQEU.exe
  2⤵
  PID:7536
- C:\Windows\System\jArTshC.exe
  C:\Windows\System\jArTshC.exe
  2⤵
  PID:7768
- C:\Windows\System\TSDOyuF.exe
  C:\Windows\System\TSDOyuF.exe
  2⤵
  PID:7872
- C:\Windows\System\Ahqfeyc.exe
  C:\Windows\System\Ahqfeyc.exe
  2⤵
  PID:8008
- C:\Windows\System\vNiIhAS.exe
  C:\Windows\System\vNiIhAS.exe
  2⤵
  PID:7944
- C:\Windows\System\nQEMnFN.exe
  C:\Windows\System\nQEMnFN.exe
  2⤵
  PID:8100
- C:\Windows\System\LnQDAUC.exe
  C:\Windows\System\LnQDAUC.exe
  2⤵
  PID:8172
- C:\Windows\System\NjaCMQv.exe
  C:\Windows\System\NjaCMQv.exe
  2⤵
  PID:8184
- C:\Windows\System\jtNFoel.exe
  C:\Windows\System\jtNFoel.exe
  2⤵
  PID:8120
- C:\Windows\System\DpeYSBG.exe
  C:\Windows\System\DpeYSBG.exe
  2⤵
  PID:7372
- C:\Windows\System\meaLdEn.exe
  C:\Windows\System\meaLdEn.exe
  2⤵
  PID:6784
- C:\Windows\System\ZuFbdzI.exe
  C:\Windows\System\ZuFbdzI.exe
  2⤵
  PID:7288
- C:\Windows\System\KuYaAgx.exe
  C:\Windows\System\KuYaAgx.exe
  2⤵
  PID:7548
- C:\Windows\System\FMqIQnE.exe
  C:\Windows\System\FMqIQnE.exe
  2⤵
  PID:7636
- C:\Windows\System\aJCXfzb.exe
  C:\Windows\System\aJCXfzb.exe
  2⤵
  PID:7552
- C:\Windows\System\qhhPKqp.exe
  C:\Windows\System\qhhPKqp.exe
  2⤵
  PID:7616
- C:\Windows\System\tnDBovQ.exe
  C:\Windows\System\tnDBovQ.exe
  2⤵
  PID:7436
- C:\Windows\System\mFbXcpt.exe
  C:\Windows\System\mFbXcpt.exe
  2⤵
  PID:8040
- C:\Windows\System\mQldreu.exe
  C:\Windows\System\mQldreu.exe
  2⤵
  PID:6780
- C:\Windows\System\KvhgLzn.exe
  C:\Windows\System\KvhgLzn.exe
  2⤵
  PID:7956
- C:\Windows\System\uAirjgg.exe
  C:\Windows\System\uAirjgg.exe
  2⤵
  PID:8104
- C:\Windows\System\khdzkuK.exe
  C:\Windows\System\khdzkuK.exe
  2⤵
  PID:8116
- C:\Windows\System\LGumHGD.exe
  C:\Windows\System\LGumHGD.exe
  2⤵
  PID:7836
- C:\Windows\System\YKbzAwp.exe
  C:\Windows\System\YKbzAwp.exe
  2⤵
  PID:7884
- C:\Windows\System\fPygram.exe
  C:\Windows\System\fPygram.exe
  2⤵
  PID:6660
- C:\Windows\System\tyGFcjt.exe
  C:\Windows\System\tyGFcjt.exe
  2⤵
  PID:7076
- C:\Windows\System\sGDXqSh.exe
  C:\Windows\System\sGDXqSh.exe
  2⤵
  PID:7756
- C:\Windows\System\xtveAol.exe
  C:\Windows\System\xtveAol.exe
  2⤵
  PID:7660
- C:\Windows\System\OdmDgde.exe
  C:\Windows\System\OdmDgde.exe
  2⤵
  PID:7208
- C:\Windows\System\EXyxwru.exe
  C:\Windows\System\EXyxwru.exe
  2⤵
  PID:8208
- C:\Windows\System\wUdhbdb.exe
  C:\Windows\System\wUdhbdb.exe
  2⤵
  PID:8228
- C:\Windows\System\EprTWRg.exe
  C:\Windows\System\EprTWRg.exe
  2⤵
  PID:8244
- C:\Windows\System\nrfWXyW.exe
  C:\Windows\System\nrfWXyW.exe
  2⤵
  PID:8260
- C:\Windows\System\CJJItbo.exe
  C:\Windows\System\CJJItbo.exe
  2⤵
  PID:8276
- C:\Windows\System\XBfRpTa.exe
  C:\Windows\System\XBfRpTa.exe
  2⤵
  PID:8292
- C:\Windows\System\lXHmYwI.exe
  C:\Windows\System\lXHmYwI.exe
  2⤵
  PID:8312
- C:\Windows\System\ONjaZmU.exe
  C:\Windows\System\ONjaZmU.exe
  2⤵
  PID:8328
- C:\Windows\System\ziIWZUr.exe
  C:\Windows\System\ziIWZUr.exe
  2⤵
  PID:8344
- C:\Windows\System\LKXNPir.exe
  C:\Windows\System\LKXNPir.exe
  2⤵
  PID:8360
- C:\Windows\System\TgDzJOH.exe
  C:\Windows\System\TgDzJOH.exe
  2⤵
  PID:8376
- C:\Windows\System\gyFHJop.exe
  C:\Windows\System\gyFHJop.exe
  2⤵
  PID:8392
- C:\Windows\System\NSzrhoF.exe
  C:\Windows\System\NSzrhoF.exe
  2⤵
  PID:8408
- C:\Windows\System\MpnmHlX.exe
  C:\Windows\System\MpnmHlX.exe
  2⤵
  PID:8424
- C:\Windows\System\MxkZamc.exe
  C:\Windows\System\MxkZamc.exe
  2⤵
  PID:8440
- C:\Windows\System\dutUznC.exe
  C:\Windows\System\dutUznC.exe
  2⤵
  PID:8456
- C:\Windows\System\NTatpRH.exe
  C:\Windows\System\NTatpRH.exe
  2⤵
  PID:8472
- C:\Windows\System\YCpCJRO.exe
  C:\Windows\System\YCpCJRO.exe
  2⤵
  PID:8488
- C:\Windows\System\CcavAPE.exe
  C:\Windows\System\CcavAPE.exe
  2⤵
  PID:8516
- C:\Windows\System\dKvIQTo.exe
  C:\Windows\System\dKvIQTo.exe
  2⤵
  PID:8532
- C:\Windows\System\SVRXTZV.exe
  C:\Windows\System\SVRXTZV.exe
  2⤵
  PID:8548
- C:\Windows\System\oALLhYj.exe
  C:\Windows\System\oALLhYj.exe
  2⤵
  PID:8564
- C:\Windows\System\HMYvtEY.exe
  C:\Windows\System\HMYvtEY.exe
  2⤵
  PID:8580
- C:\Windows\System\HcIIaJt.exe
  C:\Windows\System\HcIIaJt.exe
  2⤵
  PID:8596
- C:\Windows\System\UdsoaKN.exe
  C:\Windows\System\UdsoaKN.exe
  2⤵
  PID:8612
- C:\Windows\System\YDVeTqt.exe
  C:\Windows\System\YDVeTqt.exe
  2⤵
  PID:8628
- C:\Windows\System\mLyyiMw.exe
  C:\Windows\System\mLyyiMw.exe
  2⤵
  PID:8644
- C:\Windows\System\OiLmmiF.exe
  C:\Windows\System\OiLmmiF.exe
  2⤵
  PID:8660
- C:\Windows\System\yULZarC.exe
  C:\Windows\System\yULZarC.exe
  2⤵
  PID:8676
- C:\Windows\System\VarNXbV.exe
  C:\Windows\System\VarNXbV.exe
  2⤵
  PID:8692
- C:\Windows\System\rBpVjPV.exe
  C:\Windows\System\rBpVjPV.exe
  2⤵
  PID:8708
- C:\Windows\System\HLWGJiu.exe
  C:\Windows\System\HLWGJiu.exe
  2⤵
  PID:8728
- C:\Windows\System\xQjxnIs.exe
  C:\Windows\System\xQjxnIs.exe
  2⤵
  PID:8744
- C:\Windows\System\etNrmWv.exe
  C:\Windows\System\etNrmWv.exe
  2⤵
  PID:8760
- C:\Windows\System\mrUqBwI.exe
  C:\Windows\System\mrUqBwI.exe
  2⤵
  PID:8776
- C:\Windows\System\nbmbCjI.exe
  C:\Windows\System\nbmbCjI.exe
  2⤵
  PID:8792
- C:\Windows\System\ENMDTKq.exe
  C:\Windows\System\ENMDTKq.exe
  2⤵
  PID:8808
- C:\Windows\System\kEbYdfQ.exe
  C:\Windows\System\kEbYdfQ.exe
  2⤵
  PID:8824
- C:\Windows\System\sWzsQuc.exe
  C:\Windows\System\sWzsQuc.exe
  2⤵
  PID:8840
- C:\Windows\System\hAYxTNn.exe
  C:\Windows\System\hAYxTNn.exe
  2⤵
  PID:8856
- C:\Windows\System\slfTXKx.exe
  C:\Windows\System\slfTXKx.exe
  2⤵
  PID:8872
- C:\Windows\System\jTOASOT.exe
  C:\Windows\System\jTOASOT.exe
  2⤵
  PID:8888
- C:\Windows\System\EvDvTsh.exe
  C:\Windows\System\EvDvTsh.exe
  2⤵
  PID:8904
- C:\Windows\System\AZHSBYm.exe
  C:\Windows\System\AZHSBYm.exe
  2⤵
  PID:8920
- C:\Windows\System\ByJhOlm.exe
  C:\Windows\System\ByJhOlm.exe
  2⤵
  PID:8936
- C:\Windows\System\cqRaTyR.exe
  C:\Windows\System\cqRaTyR.exe
  2⤵
  PID:8952
- C:\Windows\System\oxHGkIT.exe
  C:\Windows\System\oxHGkIT.exe
  2⤵
  PID:8968
- C:\Windows\System\rHAjNPf.exe
  C:\Windows\System\rHAjNPf.exe
  2⤵
  PID:8984
- C:\Windows\System\hHpwvQK.exe
  C:\Windows\System\hHpwvQK.exe
  2⤵
  PID:9000
- C:\Windows\System\rDEAFCK.exe
  C:\Windows\System\rDEAFCK.exe
  2⤵
  PID:9016
- C:\Windows\System\QPNXBTl.exe
  C:\Windows\System\QPNXBTl.exe
  2⤵
  PID:9032
- C:\Windows\System\XPwLGUW.exe
  C:\Windows\System\XPwLGUW.exe
  2⤵
  PID:9048
- C:\Windows\System\wKZlwUL.exe
  C:\Windows\System\wKZlwUL.exe
  2⤵
  PID:9064
- C:\Windows\System\ZMrTlvn.exe
  C:\Windows\System\ZMrTlvn.exe
  2⤵
  PID:9080
- C:\Windows\System\msFobaD.exe
  C:\Windows\System\msFobaD.exe
  2⤵
  PID:9096
- C:\Windows\System\roXwlOI.exe
  C:\Windows\System\roXwlOI.exe
  2⤵
  PID:9112
- C:\Windows\System\WsAmquT.exe
  C:\Windows\System\WsAmquT.exe
  2⤵
  PID:9128
- C:\Windows\System\YFBxjay.exe
  C:\Windows\System\YFBxjay.exe
  2⤵
  PID:9144
- C:\Windows\System\BDGUSHh.exe
  C:\Windows\System\BDGUSHh.exe
  2⤵
  PID:9160
- C:\Windows\System\GttOCBl.exe
  C:\Windows\System\GttOCBl.exe
  2⤵
  PID:9176
- C:\Windows\System\uMWsfWv.exe
  C:\Windows\System\uMWsfWv.exe
  2⤵
  PID:9192
- C:\Windows\System\JmFNDXJ.exe
  C:\Windows\System\JmFNDXJ.exe
  2⤵
  PID:9208
- C:\Windows\System\rUDiVTT.exe
  C:\Windows\System\rUDiVTT.exe
  2⤵
  PID:7700
- C:\Windows\System\ScIHEAq.exe
  C:\Windows\System\ScIHEAq.exe
  2⤵
  PID:7396
- C:\Windows\System\NEuaxaZ.exe
  C:\Windows\System\NEuaxaZ.exe
  2⤵
  PID:6860
- C:\Windows\System\TzBtIAZ.exe
  C:\Windows\System\TzBtIAZ.exe
  2⤵
  PID:8268
- C:\Windows\System\YrMhCpB.exe
  C:\Windows\System\YrMhCpB.exe
  2⤵
  PID:8336
- C:\Windows\System\CMMvSTl.exe
  C:\Windows\System\CMMvSTl.exe
  2⤵
  PID:992
- C:\Windows\System\DkyyuKB.exe
  C:\Windows\System\DkyyuKB.exe
  2⤵
  PID:8320
- C:\Windows\System\GJMePbz.exe
  C:\Windows\System\GJMePbz.exe
  2⤵
  PID:8388
- C:\Windows\System\rukmmfZ.exe
  C:\Windows\System\rukmmfZ.exe
  2⤵
  PID:8432
- C:\Windows\System\AZltlia.exe
  C:\Windows\System\AZltlia.exe
  2⤵
  PID:8420
- C:\Windows\System\YQFTyCv.exe
  C:\Windows\System\YQFTyCv.exe
  2⤵
  PID:8480
- C:\Windows\System\DTQQmCU.exe
  C:\Windows\System\DTQQmCU.exe
  2⤵
  PID:8540
- C:\Windows\System\FQGIkHv.exe
  C:\Windows\System\FQGIkHv.exe
  2⤵
  PID:8604
- C:\Windows\System\PQHPhFT.exe
  C:\Windows\System\PQHPhFT.exe
  2⤵
  PID:8668
- C:\Windows\System\uebMBEQ.exe
  C:\Windows\System\uebMBEQ.exe
  2⤵
  PID:8528
- C:\Windows\System\quBPJVM.exe
  C:\Windows\System\quBPJVM.exe
  2⤵
  PID:3328
- C:\Windows\System\XhoxyRK.exe
  C:\Windows\System\XhoxyRK.exe
  2⤵
  PID:8620
- C:\Windows\System\YLrmQMy.exe
  C:\Windows\System\YLrmQMy.exe
  2⤵
  PID:8684
- C:\Windows\System\GMVMCeq.exe
  C:\Windows\System\GMVMCeq.exe
  2⤵
  PID:8768
- C:\Windows\System\XYcPMpg.exe
  C:\Windows\System\XYcPMpg.exe
  2⤵
  PID:8724
- C:\Windows\System\pcmmBic.exe
  C:\Windows\System\pcmmBic.exe
  2⤵
  PID:8800
- C:\Windows\System\rjGWjZB.exe
  C:\Windows\System\rjGWjZB.exe
  2⤵
  PID:8788
- C:\Windows\System\FUHzlaD.exe
  C:\Windows\System\FUHzlaD.exe
  2⤵
  PID:8868
- C:\Windows\System\JzRFBFS.exe
  C:\Windows\System\JzRFBFS.exe
  2⤵
  PID:8848
- C:\Windows\System\oHVKYmR.exe
  C:\Windows\System\oHVKYmR.exe
  2⤵
  PID:8932
- C:\Windows\System\dmojCSZ.exe
  C:\Windows\System\dmojCSZ.exe
  2⤵
  PID:8964
- C:\Windows\System\OQBIIUF.exe
  C:\Windows\System\OQBIIUF.exe
  2⤵
  PID:8980
- C:\Windows\System\qsfDNZs.exe
  C:\Windows\System\qsfDNZs.exe
  2⤵
  PID:9028
- C:\Windows\System\qgGzMED.exe
  C:\Windows\System\qgGzMED.exe
  2⤵
  PID:9040
- C:\Windows\System\jmHPAXp.exe
  C:\Windows\System\jmHPAXp.exe
  2⤵
  PID:9076
- C:\Windows\System\hmEotSL.exe
  C:\Windows\System\hmEotSL.exe
  2⤵
  PID:9124
- C:\Windows\System\qCPPUtA.exe
  C:\Windows\System\qCPPUtA.exe
  2⤵
  PID:9184
- C:\Windows\System\BQXHCna.exe
  C:\Windows\System\BQXHCna.exe
  2⤵
  PID:9168
- C:\Windows\System\RAKnFBg.exe
  C:\Windows\System\RAKnFBg.exe
  2⤵
  PID:8204
- C:\Windows\System\corYmhV.exe
  C:\Windows\System\corYmhV.exe
  2⤵
  PID:7088
- C:\Windows\System\zQvrjtT.exe
  C:\Windows\System\zQvrjtT.exe
  2⤵
  PID:8240
- C:\Windows\System\yCYKYuB.exe
  C:\Windows\System\yCYKYuB.exe
  2⤵
  PID:8288
- C:\Windows\System\CRKFjlW.exe
  C:\Windows\System\CRKFjlW.exe
  2⤵
  PID:8720
- C:\Windows\System\XSIbFQP.exe
  C:\Windows\System\XSIbFQP.exe
  2⤵
  PID:8464
- C:\Windows\System\AzIwSKj.exe
  C:\Windows\System\AzIwSKj.exe
  2⤵
  PID:8496
- C:\Windows\System\rbtYtAX.exe
  C:\Windows\System\rbtYtAX.exe
  2⤵
  PID:8636
- C:\Windows\System\ENleYQp.exe
  C:\Windows\System\ENleYQp.exe
  2⤵
  PID:8592
- C:\Windows\System\JnKpBls.exe
  C:\Windows\System\JnKpBls.exe
  2⤵
  PID:8756
- C:\Windows\System\Mymhwwy.exe
  C:\Windows\System\Mymhwwy.exe
  2⤵
  PID:8652
- C:\Windows\System\UnnFpqQ.exe
  C:\Windows\System\UnnFpqQ.exe
  2⤵
  PID:8688
- C:\Windows\System\FGCOzIq.exe
  C:\Windows\System\FGCOzIq.exe
  2⤵
  PID:8912
- C:\Windows\System\xPuCqpi.exe
  C:\Windows\System\xPuCqpi.exe
  2⤵
  PID:9012
- C:\Windows\System\qkOVOYB.exe
  C:\Windows\System\qkOVOYB.exe
  2⤵
  PID:9120
- C:\Windows\System\zNBPExp.exe
  C:\Windows\System\zNBPExp.exe
  2⤵
  PID:8996
- C:\Windows\System\VscRaAR.exe
  C:\Windows\System\VscRaAR.exe
  2⤵
  PID:9156
- C:\Windows\System\oeVSHBr.exe
  C:\Windows\System\oeVSHBr.exe
  2⤵
  PID:9204
- C:\Windows\System\xdtxEyT.exe
  C:\Windows\System\xdtxEyT.exe
  2⤵
  PID:8200
- C:\Windows\System\IBMbjFJ.exe
  C:\Windows\System\IBMbjFJ.exe
  2⤵
  PID:8252
- C:\Windows\System\tpmmuQr.exe
  C:\Windows\System\tpmmuQr.exe
  2⤵
  PID:8416
- C:\Windows\System\QTCfYch.exe
  C:\Windows\System\QTCfYch.exe
  2⤵
  PID:8556
- C:\Windows\System\XBxIFQE.exe
  C:\Windows\System\XBxIFQE.exe
  2⤵
  PID:8784
- C:\Windows\System\uKGiMjF.exe
  C:\Windows\System\uKGiMjF.exe
  2⤵
  PID:8832
- C:\Windows\System\yAaimBV.exe
  C:\Windows\System\yAaimBV.exe
  2⤵
  PID:8960
- C:\Windows\System\oDIXJiG.exe
  C:\Windows\System\oDIXJiG.exe
  2⤵
  PID:7224
- C:\Windows\System\HMnACvl.exe
  C:\Windows\System\HMnACvl.exe
  2⤵
  PID:8512
- C:\Windows\System\kMPozMa.exe
  C:\Windows\System\kMPozMa.exe
  2⤵
  PID:8740
- C:\Windows\System\ZlkvbCa.exe
  C:\Windows\System\ZlkvbCa.exe
  2⤵
  PID:9172
- C:\Windows\System\oVtsGuV.exe
  C:\Windows\System\oVtsGuV.exe
  2⤵
  PID:8976
- C:\Windows\System\GXEAaPT.exe
  C:\Windows\System\GXEAaPT.exe
  2⤵
  PID:8576
- C:\Windows\System\hfkwBNH.exe
  C:\Windows\System\hfkwBNH.exe
  2⤵
  PID:8716
- C:\Windows\System\mVxIwpr.exe
  C:\Windows\System\mVxIwpr.exe
  2⤵
  PID:9220
- C:\Windows\System\uCWsnjU.exe
  C:\Windows\System\uCWsnjU.exe
  2⤵
  PID:9236
- C:\Windows\System\vWTJCzA.exe
  C:\Windows\System\vWTJCzA.exe
  2⤵
  PID:9252
- C:\Windows\System\VsAXOBO.exe
  C:\Windows\System\VsAXOBO.exe
  2⤵
  PID:9268
- C:\Windows\System\xnKiMvT.exe
  C:\Windows\System\xnKiMvT.exe
  2⤵
  PID:9284
- C:\Windows\System\nPSEWXC.exe
  C:\Windows\System\nPSEWXC.exe
  2⤵
  PID:9300
- C:\Windows\System\MiBtvuD.exe
  C:\Windows\System\MiBtvuD.exe
  2⤵
  PID:9316
- C:\Windows\System\NqSZmBh.exe
  C:\Windows\System\NqSZmBh.exe
  2⤵
  PID:9332
- C:\Windows\System\MAVJRXY.exe
  C:\Windows\System\MAVJRXY.exe
  2⤵
  PID:9348
- C:\Windows\System\RvXKIkp.exe
  C:\Windows\System\RvXKIkp.exe
  2⤵
  PID:9364
- C:\Windows\System\iQoLubT.exe
  C:\Windows\System\iQoLubT.exe
  2⤵
  PID:9380
- C:\Windows\System\IzDOKNU.exe
  C:\Windows\System\IzDOKNU.exe
  2⤵
  PID:9396
- C:\Windows\System\KLaKuRo.exe
  C:\Windows\System\KLaKuRo.exe
  2⤵
  PID:9412
- C:\Windows\System\lithVlq.exe
  C:\Windows\System\lithVlq.exe
  2⤵
  PID:9464
- C:\Windows\System\UosOCAD.exe
  C:\Windows\System\UosOCAD.exe
  2⤵
  PID:9488
- C:\Windows\System\uJZPzbr.exe
  C:\Windows\System\uJZPzbr.exe
  2⤵
  PID:9504
- C:\Windows\System\FTznIBz.exe
  C:\Windows\System\FTznIBz.exe
  2⤵
  PID:9520
- C:\Windows\System\aOJBRvk.exe
  C:\Windows\System\aOJBRvk.exe
  2⤵
  PID:9536
- C:\Windows\System\YlyUWOj.exe
  C:\Windows\System\YlyUWOj.exe
  2⤵
  PID:9556
- C:\Windows\System\duYUkLw.exe
  C:\Windows\System\duYUkLw.exe
  2⤵
  PID:9572
- C:\Windows\System\ppGGzja.exe
  C:\Windows\System\ppGGzja.exe
  2⤵
  PID:9688
- C:\Windows\System\KSXDTdp.exe
  C:\Windows\System\KSXDTdp.exe
  2⤵
  PID:9704
- C:\Windows\System\EvTcYVH.exe
  C:\Windows\System\EvTcYVH.exe
  2⤵
  PID:9812
- C:\Windows\System\qEKnoDs.exe
  C:\Windows\System\qEKnoDs.exe
  2⤵
  PID:9828
- C:\Windows\System\huGbFjj.exe
  C:\Windows\System\huGbFjj.exe
  2⤵
  PID:9844
- C:\Windows\System\AgoTkFU.exe
  C:\Windows\System\AgoTkFU.exe
  2⤵
  PID:9860
- C:\Windows\System\ScYsbAI.exe
  C:\Windows\System\ScYsbAI.exe
  2⤵
  PID:9908
- C:\Windows\System\Hvhzduu.exe
  C:\Windows\System\Hvhzduu.exe
  2⤵
  PID:9932
- C:\Windows\System\AgDiDYA.exe
  C:\Windows\System\AgDiDYA.exe
  2⤵
  PID:9952
- C:\Windows\System\PztMonD.exe
  C:\Windows\System\PztMonD.exe
  2⤵
  PID:9968
- C:\Windows\System\SUEMITC.exe
  C:\Windows\System\SUEMITC.exe
  2⤵
  PID:9984
- C:\Windows\System\XoWWivK.exe
  C:\Windows\System\XoWWivK.exe
  2⤵
  PID:10000
- C:\Windows\System\ZOETZqD.exe
  C:\Windows\System\ZOETZqD.exe
  2⤵
  PID:10024
- C:\Windows\System\GcUeUCB.exe
  C:\Windows\System\GcUeUCB.exe
  2⤵
  PID:10040
- C:\Windows\System\fJaEYxc.exe
  C:\Windows\System\fJaEYxc.exe
  2⤵
  PID:10056
- C:\Windows\System\Qdfqyhu.exe
  C:\Windows\System\Qdfqyhu.exe
  2⤵
  PID:10076
- C:\Windows\System\dBJJlLL.exe
  C:\Windows\System\dBJJlLL.exe
  2⤵
  PID:10100
- C:\Windows\System\HKTznzh.exe
  C:\Windows\System\HKTznzh.exe
  2⤵
  PID:10116
- C:\Windows\System\UDGKtpI.exe
  C:\Windows\System\UDGKtpI.exe
  2⤵
  PID:10136
- C:\Windows\System\vSvRLKQ.exe
  C:\Windows\System\vSvRLKQ.exe
  2⤵
  PID:10152
- C:\Windows\System\hmocKYv.exe
  C:\Windows\System\hmocKYv.exe
  2⤵
  PID:10168
- C:\Windows\System\dHqZMVR.exe
  C:\Windows\System\dHqZMVR.exe
  2⤵
  PID:10184
- C:\Windows\System\wkCSFIo.exe
  C:\Windows\System\wkCSFIo.exe
  2⤵
  PID:10200
- C:\Windows\System\uipezkj.exe
  C:\Windows\System\uipezkj.exe
  2⤵
  PID:10216
- C:\Windows\System\tsBsjcp.exe
  C:\Windows\System\tsBsjcp.exe
  2⤵
  PID:10232
- C:\Windows\System\TWqnhjv.exe
  C:\Windows\System\TWqnhjv.exe
  2⤵
  PID:9260
- C:\Windows\System\MLLtrNT.exe
  C:\Windows\System\MLLtrNT.exe
  2⤵
  PID:9324
- C:\Windows\System\FqBKegJ.exe
  C:\Windows\System\FqBKegJ.exe
  2⤵
  PID:8356
- C:\Windows\System\hUmarrh.exe
  C:\Windows\System\hUmarrh.exe
  2⤵
  PID:9312
- C:\Windows\System\WndHMsu.exe
  C:\Windows\System\WndHMsu.exe
  2⤵
  PID:9092
- C:\Windows\System\UhACaco.exe
  C:\Windows\System\UhACaco.exe
  2⤵
  PID:9308
- C:\Windows\System\pFhrpxN.exe
  C:\Windows\System\pFhrpxN.exe
  2⤵
  PID:9376
- C:\Windows\System\XfsDHvG.exe
  C:\Windows\System\XfsDHvG.exe
  2⤵
  PID:9424
- C:\Windows\System\qrVZwFc.exe
  C:\Windows\System\qrVZwFc.exe
  2⤵
  PID:9440
- C:\Windows\System\Rjkvisq.exe
  C:\Windows\System\Rjkvisq.exe
  2⤵
  PID:9456
- C:\Windows\System\NpkWfMu.exe
  C:\Windows\System\NpkWfMu.exe
  2⤵
  PID:9564
- C:\Windows\System\GGQvrFz.exe
  C:\Windows\System\GGQvrFz.exe
  2⤵
  PID:9548
- C:\Windows\System\hMwHtlM.exe
  C:\Windows\System\hMwHtlM.exe
  2⤵
  PID:9584
- C:\Windows\System\PuHIWNJ.exe
  C:\Windows\System\PuHIWNJ.exe
  2⤵
  PID:9604
- C:\Windows\System\sHTIgyD.exe
  C:\Windows\System\sHTIgyD.exe
  2⤵
  PID:9620
- C:\Windows\System\LRRZNem.exe
  C:\Windows\System\LRRZNem.exe
  2⤵
  PID:9672
- C:\Windows\System\AOvMxjZ.exe
  C:\Windows\System\AOvMxjZ.exe
  2⤵
  PID:9712
- C:\Windows\System\utPGWNV.exe
  C:\Windows\System\utPGWNV.exe
  2⤵
  PID:9728
- C:\Windows\System\ezGZOuO.exe
  C:\Windows\System\ezGZOuO.exe
  2⤵
  PID:9752
- C:\Windows\System\EqZFbuJ.exe
  C:\Windows\System\EqZFbuJ.exe
  2⤵
  PID:9768
- C:\Windows\System\CJYNXrF.exe
  C:\Windows\System\CJYNXrF.exe
  2⤵
  PID:9788
- C:\Windows\System\RDIivwf.exe
  C:\Windows\System\RDIivwf.exe
  2⤵
  PID:9800
- C:\Windows\System\YMqGunv.exe
  C:\Windows\System\YMqGunv.exe
  2⤵
  PID:9840
- C:\Windows\System\krUfuyT.exe
  C:\Windows\System\krUfuyT.exe
  2⤵
  PID:9852
- C:\Windows\System\gogDpUA.exe
  C:\Windows\System\gogDpUA.exe
  2⤵
  PID:9880
- C:\Windows\System\tNPudUJ.exe
  C:\Windows\System\tNPudUJ.exe
  2⤵
  PID:9992
- C:\Windows\System\inNtPPH.exe
  C:\Windows\System\inNtPPH.exe
  2⤵
  PID:10032
- C:\Windows\System\CqLQAtf.exe
  C:\Windows\System\CqLQAtf.exe
  2⤵
  PID:9948
- C:\Windows\System\pXdPAUd.exe
  C:\Windows\System\pXdPAUd.exe
  2⤵
  PID:10016
- C:\Windows\System\CLPrlBq.exe
  C:\Windows\System\CLPrlBq.exe
  2⤵
  PID:10052
- C:\Windows\System\EOibMsq.exe
  C:\Windows\System\EOibMsq.exe
  2⤵
  PID:9904
- C:\Windows\System\UYKDINY.exe
  C:\Windows\System\UYKDINY.exe
  2⤵
  PID:10088
- C:\Windows\System\mWOSIzu.exe
  C:\Windows\System\mWOSIzu.exe
  2⤵
  PID:10124
- C:\Windows\System\JQLobbR.exe
  C:\Windows\System\JQLobbR.exe
  2⤵
  PID:10160
- C:\Windows\System\gXPfBUL.exe
  C:\Windows\System\gXPfBUL.exe
  2⤵
  PID:10212
- C:\Windows\System\YXbhBQR.exe
  C:\Windows\System\YXbhBQR.exe
  2⤵
  PID:10224
- C:\Windows\System\TllcxCp.exe
  C:\Windows\System\TllcxCp.exe
  2⤵
  PID:9360
- C:\Windows\System\mFvqkIi.exe
  C:\Windows\System\mFvqkIi.exe
  2⤵
  PID:9392
- C:\Windows\System\YAwOcBl.exe
  C:\Windows\System\YAwOcBl.exe
  2⤵
  PID:9388
- C:\Windows\System\rUClSkI.exe
  C:\Windows\System\rUClSkI.exe
  2⤵
  PID:9476
- C:\Windows\System\EQNTAIZ.exe
  C:\Windows\System\EQNTAIZ.exe
  2⤵
  PID:9280
- C:\Windows\System\MvqmIsr.exe
  C:\Windows\System\MvqmIsr.exe
  2⤵
  PID:9472
- C:\Windows\System\XxACVfa.exe
  C:\Windows\System\XxACVfa.exe
  2⤵
  PID:9528
- C:\Windows\System\uPwSwWR.exe
  C:\Windows\System\uPwSwWR.exe
  2⤵
  PID:9580
- C:\Windows\System\lGOrZtd.exe
  C:\Windows\System\lGOrZtd.exe
  2⤵
  PID:9544
- C:\Windows\System\LYvyQEI.exe
  C:\Windows\System\LYvyQEI.exe
  2⤵
  PID:9640
- C:\Windows\System\GDakeoO.exe
  C:\Windows\System\GDakeoO.exe
  2⤵
  PID:9636
- C:\Windows\System\MfjgQQF.exe
  C:\Windows\System\MfjgQQF.exe
  2⤵
  PID:9652
- C:\Windows\System\pCPEWEx.exe
  C:\Windows\System\pCPEWEx.exe
  2⤵
  PID:9684
- C:\Windows\System\yrebRzL.exe
  C:\Windows\System\yrebRzL.exe
  2⤵
  PID:9736
- C:\Windows\System\cVyYoOc.exe
  C:\Windows\System\cVyYoOc.exe
  2⤵
  PID:9760
- C:\Windows\System\iWRkccz.exe
  C:\Windows\System\iWRkccz.exe
  2⤵
  PID:9792
- C:\Windows\System\FCluqGA.exe
  C:\Windows\System\FCluqGA.exe
  2⤵
  PID:9876
- C:\Windows\System\fLtIpHN.exe
  C:\Windows\System\fLtIpHN.exe
  2⤵
  PID:9916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BLkmssy.exe

Filesize
1.9MB

MD5
ca8a236123d35a52944078a831282053

SHA1
09732a5c7811acf8cc284af284c16f83e701d87b

SHA256
b02e30c743505be8c6e1b1053f71b3f2d2c4e48844bbf514b0adb42b24b22cad

SHA512
b3b0fb0f1403781a438701395334a95a58ae0cd67c65fb02910284b194bcbcefcd885a9b6dc0f0ee6393a371981e11615cd303b9f42b2e7dd4a8e603ca47a67c

Download Submit
C:\Windows\system\CHfyvms.exe

Filesize
1.9MB

MD5
828a279a1ad1495064d3b946b15e8d6e

SHA1
82bc0e93cc2faf62a88283613c54ff2bb413d9a3

SHA256
93888089e2aaacf0b4f0bba9580ef7a3e78c39fc1dd8097098e39b18a1f54fa4

SHA512
98b086b3f1d0d94bd5032ef9c6b9c391aae21fb76cd3dd964b705a08212d86e5304105d8568b2f84b7bdbb730a7a0bd83a709c1c30a04a0bf0dab349ee4f3a51

Download Submit
C:\Windows\system\ENWxVOg.exe

Filesize
1.9MB

MD5
639e302271782b1287625d8a73e2ebcc

SHA1
cc7f3cd29bc1d1ac05ea7d7fdae41c3a71fe7416

SHA256
c2bd45268ffcecbb465e8c34be6a96352d0e99074ec3a45a0880ec0c57dbd19c

SHA512
3e8debd696f8f8eb071863f89e71b4cfbae4fb07f14d7a61f9ee317349e3df1d610cda478565c695c78bb91cfc632aa5e029693064beece6af8bf55282aebb49

Download Submit
C:\Windows\system\GiSRmux.exe

Filesize
1.9MB

MD5
94b8b44b0f7fc44a11f4c5ca33628afa

SHA1
175cefbab340463cdd79fe62ed4636f2350067b9

SHA256
d206015aca258601eaa6a3d1723fc7a8292cf1e15f67b432a3ae8ca4efcfd56c

SHA512
b551593910b6938755c821808437811f2fdcd6ec273eb0f1daeba6ed63b83673f109a68fba8333510256331c477a1f2e0586411e621f1bbc0e367b7420a08c7d

Download Submit
C:\Windows\system\GprUGzh.exe

Filesize
1.9MB

MD5
b3d0ac13fa7a7d3121fd982640cd655b

SHA1
e701f728dada252ef250657eab348ab3f9d9abca

SHA256
1f16ad2c7aa961275b1be47731bedf37219ecfc0b17984de67b0dad2b33d1834

SHA512
3983ed216b1231de731e94fff5f979cc06170526b5b05cd49959d30f4d69e9c4ec6bbbe9caac39f66d525a03c3c4f42d1597153f1c3da48e1e948e3ef4b32a51

Download Submit
C:\Windows\system\HMjWhVS.exe

Filesize
1.9MB

MD5
c67dbea374cdb1e16f396540d610f6ac

SHA1
6e1f2d6f4e77046dfecc95a413bf05af08cdaef7

SHA256
01b956fa8a85358d1e3738d8908cfbed039c517d6c1746867aa204c86d7b6f9d

SHA512
dee69d79a9dc2e536cd364932b820b8cd5fb2406926f1db29c7adb5036486e336a5ca3b46cc89d7b635db782dbf349028f810e1d917635eb7b76d6f127cc24d8

Download Submit
C:\Windows\system\IpLMWQo.exe

Filesize
1.9MB

MD5
c64fe86a9529467d7a483b4825c5049b

SHA1
a60becbd948adac340c3fe107daa33ae01174679

SHA256
ff64190442cb2a34927f120530fb240a0923b0baafd1daea7c985af0de9f9dd5

SHA512
c6f88f0e693385a1dcc1791623a1fcf54dba0700039a555c06e036839e37cf4b5fda562e5afac2390b8416f8f8d4afb866b004bcd9f1979822250076d1d7f975

Download Submit
C:\Windows\system\LQAxnlm.exe

Filesize
1.9MB

MD5
18ba42326c841e79b7abcc49c22ba5b8

SHA1
ead7e15047ac6518532cccc6d7c11d93522d1b1e

SHA256
6caeb16a32424628f0c78312e1f203e4818e67bf1fca7fa774baff7c3e678336

SHA512
9755560f98deb5abfbf5a817b0d86cfe21570dee5cce8ae83406eb833920ce1a6a33970d15d548c592176194dff634bb801242543aae4c47bd173d43787baf69

Download Submit
C:\Windows\system\LpeNNRe.exe

Filesize
1.9MB

MD5
0ac6c994033f9ffec12f278a3528dfd9

SHA1
e850ba6bd44e93e3a2f1730100120e13f2e2bb58

SHA256
7cf2e0d6dd643d0c4aab13db5ac0d3b0fbccdd45b10ba8c7d9990241345b8d07

SHA512
cc340b2c52d7bda5f04d9ba4649bec9eb3d7105b42ad281d4b9c5be2b226d649cb9670dd92551a3e4423e0f596c2479506410bd396d6f8af647d66a318686e26

Download Submit
C:\Windows\system\MJpbPzl.exe

Filesize
1.9MB

MD5
85a340e1b9d3f9dcb13b28b96e3d561c

SHA1
20b1c4a450b4e6613e35a168582b8fc1d027bf93

SHA256
4f6ba24b4b0b121a4675e2ce614dd4b3460a12f29d3913ee895f1ad1d770698a

SHA512
ca9bd00490a3072a803a1f483ed0d64fe51c00b7cf22b9a1998b2207fddef287dd66d506a3c6444fba9660e35ca12e75b399c2c5887d6041ae5c30a64f5a2d3f

Download Submit
C:\Windows\system\PkfdsUC.exe

Filesize
1.9MB

MD5
91390eb11a54996d12b17fe8eac7044a

SHA1
09f5a1e1e3becd51df59ef2fd247ac5d4e993a4c

SHA256
246a3d5c256bb64dff71963599e93ccc63bcefb6872e8db1877e81c0ab41541a

SHA512
6371643dd84226d78557dbf19cf378df3562cfe6ef948e73db1ad770f329e5b177d6f34489e0b1a70c82edcd05458c5a080e94348e5b3eec84757ebb43651bd9

Download Submit
C:\Windows\system\RzKgDSd.exe

Filesize
1.9MB

MD5
db74399958089f5d2a877d8013f064d1

SHA1
67b724cf5d0a1246b5ee6137ea6bcb495115fe6c

SHA256
98ad9cd96da86d3d5fe4f4b8ca3f658bbd233211fd28316ef1f75d92b051e3a7

SHA512
3c873d705fb96abe91e82a8f24f96c369cd996069d8256ca96248a4cefcfc2186ee65f5f69f03878d98fc55ef85ac6353113b1787ce3ff30122e2ebd6bb564df

Download Submit
C:\Windows\system\SMFgbfV.exe

Filesize
1.9MB

MD5
79fd9c45e3016eaf0779e8110fa7f3b9

SHA1
48e7b9438cffb862c1ec34914c53c33a9ac4169d

SHA256
aee0528f5ef2fe6264a5c74cd7ff7b56c13772c3dec89836156d186d3e2d39fc

SHA512
df11c1aa37c944478eef968b5374c6060851c4be478459560ac97e82d2fd751beff587d0c89b6b377be8523eabe480aaecbb41120166de6e65387538fbddcc5e

Download Submit
C:\Windows\system\VwWnlrS.exe

Filesize
1.9MB

MD5
4c2f0980cbe24ab8738276856a245862

SHA1
2e80b2ffccb3cd25a347af021399836a6a7fae1d

SHA256
7950fbc42b2d022f974a6c0fb22734726114ed0e63a695b4fde24d36b60f82f4

SHA512
daea954504a00b2d7a5adbee969ac0703838b5b6b9f216447c04727f1467ba69b38dbe658552014c73074576c63c7efba202c77dbbd909f89736147aa1134ad5

Download Submit
C:\Windows\system\ZYuhvxR.exe

Filesize
1.9MB

MD5
29b6a9eae1524dc99ef58cb19fba80c7

SHA1
0707b9c4656926b5985697f9fae54e9295582a1c

SHA256
1fbedcddc959416abfbce4b69ef30e3f8835e2c03f7d06cd128b751b700ead84

SHA512
10bde16fac3c4f19bf15412a8cea268d11339e2367a01629cc972bfe764171ba25b5ef157bf4825b914b1a52edc37f86936831338cd67a3fe3fb4e17ea60618f

Download Submit
C:\Windows\system\cttlndr.exe

Filesize
1.9MB

MD5
d29dfb967fab0246bafd2989edbb9e4b

SHA1
9d74476d61e505847c88aeabd169c4f0c77e66c4

SHA256
4377759feee6ee2964ff4e866680e2ad991beff3e3cf457b6e3e66853062e771

SHA512
a13467bb5aada9389c1e87983a8d126ac578a4410c5f0b2d0cfb9c00e3e0e2c69f72443aa1da309d398a619104ea15c45b7aaa349bf28db9f5821453b678c542

Download Submit
C:\Windows\system\dZgtJup.exe

Filesize
1.9MB

MD5
ee91fc99f627f028ebe69fbf6a264afc

SHA1
d3665c002e9e971ce0a187843f35ab70d9e79a6c

SHA256
135df875943527fdf94b726d4a67ca88f56aa7a024b01b1f4aae1ff7e34d3f1a

SHA512
460d9e34810e84be51632fceccf4da78c2ce58d02db95a167603610a86e5dcd8818951b6ec5b29cacdf5ee99361f62db17bac515ffb36075ae39c95831e3bfb7

Download Submit
C:\Windows\system\dyuAUtD.exe

Filesize
1.9MB

MD5
d4731a280412fb3baa5f648388eac4fd

SHA1
a6174ef2dfb37903ec812bafa3261636bb712ac4

SHA256
647686d82c65fe691d070197146def227ee351cdc09fd52e8e32069b4e64ae7c

SHA512
e3c527eda40cb12049ef4aa89ef8e182edb11eb7d4e29df29eea8a8ded360fe18f6f01e85219acbd6e17f04db7ba7a3449a3e9f9a6b0d4456c0d3d1396c13a9d

Download Submit
C:\Windows\system\fzogLKG.exe

Filesize
1.9MB

MD5
7012998ad01e3adfeb70b02b01a71306

SHA1
2dd1cf37703ebbf54743104e203881c49177e974

SHA256
1b23a406979856b1c6e57ca3b2526430bdf6b72695e25123b27706a62503c0f7

SHA512
d280136671ae281502162255c1a3511bff83bc8d5e618e8bab0634ddc63da93722fbfa3b5d785d87748102c8e34cb1f0ce94a2a1203b9d83c8c75f5e6e18f334

Download Submit
C:\Windows\system\gMsDpAq.exe

Filesize
1.9MB

MD5
e4eb0b446f2e71ea171a234c5ecdce6a

SHA1
a7060152ea61d45ba9c07727fe387397d24cbb39

SHA256
9d6efc799b8109a61df3b2a8cad8a635b451f0096e6326bb2c98082bfcbe554f

SHA512
953f76d7bac382b6dcf4e51a2df31aae633be13b948a774ae7bcaebaf6980efdb5451fc7ff8457be443f5bb933cbf0ab5f16ba8c2065b61600c257f113c394dc

Download Submit
C:\Windows\system\gRRsZjV.exe

Filesize
1.9MB

MD5
add137dc1b2e75e7f4cbf69da6508da4

SHA1
892b0905f464813918c0f1e6d240aec9c5b5116d

SHA256
600e0e47c1509ec328231d32588d2f363c79596b295a7a58e3c171bfc62fe0c4

SHA512
43a757024fef06a84a19b816a7da6cf78dce22cf029a1ecc004964d500a0978fe9cd7bf357538579a2474a584168abedf4dd70392ce18ed25f930a78c6717cfa

Download Submit
C:\Windows\system\oPZRItG.exe

Filesize
1.9MB

MD5
9761640ddffbf8a9859165a9e1357df6

SHA1
a7c9839f724d2e36dcb6a91d6d00169c88c6aec2

SHA256
bdd1a08824bf85d10062f0e25c45da8fa215016e9a9eb7759f6b8b75aa303401

SHA512
9e34decff46077fc4d0e6d68e73d43feee519910975b5e9a5ed2f17c4e3fb8c2443af06f274b7149d7053f23a1038783bff87866d6239295f2fa4a9630a0e03b

Download Submit
C:\Windows\system\qZgpMVK.exe

Filesize
1.9MB

MD5
9312dd183b555b109c5bbe3125d2e0ac

SHA1
17694688b3c481b6ea90e4980feb74f6bd57165b

SHA256
9cfc1e79a65817ef62663fa61e04a3586a11b370de2c4c777ba59b2542b37afd

SHA512
984537750ce8ab6f7b31318925d9ea0a5a2e5523657974316b5c128af7cf0488e422f11ac044e32713a4d2f4db75e4b295b514ac99e8acf8f9c363be5ea5e661

Download Submit
C:\Windows\system\rQRpcFB.exe

Filesize
1.8MB

MD5
5cccc6c33aa8fc34f554110958f9cad6

SHA1
7364580c6b84eb85a9bbba0b99b3aa63a316df1c

SHA256
60a841a052722e18094d50578a67ee4d0b09268698767b5fd47f9b6359537c70

SHA512
15fef6a9df2dbbd01818baac599bea4227d17c7c335de7d627a1d8acace45e4b207e2e991f2e8b74d2f7faece104313a40e0fc4d3f16ff42892c32aeeb867743

Download Submit
C:\Windows\system\rmbjOch.exe

Filesize
1.9MB

MD5
04a81117301f58d6dcb347068360900d

SHA1
07396e6ea618b8e272c38d22e5ba6d29d372e434

SHA256
5cef5afdeff54ea448d63af80668d185440918e4c58ed05b5bfce4f4294cae83

SHA512
60df7412db5f81d6310bbe8a4c0b007880c5303971c83a9759d23697e2058c34cb981e709358447cc60b5930646dd3b2bef3f7006a99fcdcb1db9c9e94dc109e

Download Submit
C:\Windows\system\sVyPKTt.exe

Filesize
1.9MB

MD5
b328699f436bbedcf85fbb0b551983af

SHA1
1e07b3f3649a97a4c5ac40d6fb72af960ff3845e

SHA256
b62c9fe811062a0ca17746cfc4e3e8de6219b40ab3a14c4fceb73be9e8280d66

SHA512
5e42b4a0a1ea4e0f8dd83a0abcbcc1c9cf7d008d2a5509fd0e5214ecd70a2d1406788cb15a5db2fc74af5b9e6a962b37f58bf9688435bbc4a023cd4aee81ec69

Download Submit
C:\Windows\system\uGHmxfF.exe

Filesize
1.9MB

MD5
97445e602085d926fae08ef10bef3f25

SHA1
88daf8112edbcd7034d758df3677360085e64882

SHA256
68752d956345d8678df2774ba4d2272448f80391314b39b2bbf0b5c144bb9362

SHA512
9b277cabade28bfbec560f73ebaf05861aed746ae8d5ef35bf28d288b9c807e8e3e5080cf46d25f2105612765f1f86b4ac0ac942064f152e55354f9bd222af7f

Download Submit
\Windows\system\CWoegpG.exe

Filesize
1.9MB

MD5
814614b3b2851e4ee6aac5a2bb01d061

SHA1
60e8e7ba19cdee26e93c809eb5e598ab759d8514

SHA256
de0187667f0e0aa1e8ddae92bfa43542c48892dfd861f4b089e465afe51896ce

SHA512
49b028591a0209d939954cd5a340c0b7ebc2bd8862a4b345fe07aba4cfd4aaf9d57b2e2e61280619357c72c0884f24d6356912a1d155025afb4aca98dc478cb5

Download Submit
\Windows\system\KDeDYsC.exe

Filesize
1.9MB

MD5
1512e904787a7d82e8a4f36fa35179b9

SHA1
c70f5c25b02b79ce44fb0ec31fcf2d11bb06d6f7

SHA256
60b731414c4e9d1d0ae5ea673a99fee0442d4e54c415eec6e39b3e7fb64780b7

SHA512
4b74f4d61c7c624f6f428ede808b8a1505603261b1b3b09b02e88f10dafa61efd5b2599dca144728c256ea3af64dc1dfa0a27c34a061d020ce3076cc7a979352

Download Submit
\Windows\system\dnkVJLh.exe

Filesize
1.9MB

MD5
ba27207b6e57c3baf1f485f9a20b350d

SHA1
3429060d806e5f9abf12ff3fd51725e924b1cfbe

SHA256
67f7fdd033bb1aae938127072b2d374c9aad91c75b1843543c5fb5e317d1a0ba

SHA512
26e43003ef262aeba19599c9b7c6f8ba6b149a4e353061ee2d5afb6d1469fb021456ff012dca9db88e5d8b4e595e694c8b23048c871635080b74af7dcc6bbb27

Download Submit
\Windows\system\zONQZLB.exe

Filesize
1.8MB

MD5
a147f7ef0aa5a052e91f9b368ce86962

SHA1
109edf721c4377ea4d471d50cbf61a0512272da2

SHA256
a62995e047ea2119fbe90a5b36bca82c5e21f9016b8a37672e081e64502a6d7d

SHA512
336a8737348431a0e55e65cc7a9b70fb87665a369ca290e6304b9ac037d4118141bb084ce0326274c24f39e38bd9463bb936d10b77bb3ad61191a4ad147526ff

Download Submit
\Windows\system\zjyXHNV.exe

Filesize
1.9MB

MD5
6035e8863a092ffe8fbed06972c2674a

SHA1
187b16277b719737dad131f8fc99f2d1c6983eb1

SHA256
0027ec4d21da025b691e446c2372e8c3b93762e26450e9d3a585d59f8a3fa06d

SHA512
7a7ddbb0c73f227bec89f000bc1000a1196bc0df25a25b6e835b7ae2033dc265621bb4056ee01be67da148e1005325d72b9c347fe6f21e6024bd5ecc2f057c68

Download Submit
memory/2072-173-0x00000000036A0000-0x0000000003A92000-memory.dmp

Filesize
3.9MB

Download
memory/2072-185-0x00000000036A0000-0x0000000003A92000-memory.dmp

Filesize
3.9MB

Download
memory/2072-169-0x00000000036A0000-0x0000000003A92000-memory.dmp

Filesize
3.9MB

Download
memory/2072-8-0x000000013F790000-0x000000013FB82000-memory.dmp

Filesize
3.9MB

Download
memory/2072-186-0x000000013F760000-0x000000013FB52000-memory.dmp

Filesize
3.9MB

Download
memory/2072-187-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/2072-19-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/2072-165-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/2072-177-0x00000000036A0000-0x0000000003A92000-memory.dmp

Filesize
3.9MB

Download
memory/2072-0-0x000000013F0A0000-0x000000013F492000-memory.dmp

Filesize
3.9MB

Download
memory/2072-1-0x00000000003F0000-0x0000000000400000-memory.dmp

Filesize
64KB

Download
memory/2072-184-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2072-183-0x00000000036A0000-0x0000000003A92000-memory.dmp

Filesize
3.9MB

Download
memory/2072-172-0x00000000036A0000-0x0000000003A92000-memory.dmp

Filesize
3.9MB

Download
memory/2072-170-0x000000013F590000-0x000000013F982000-memory.dmp

Filesize
3.9MB

Download
memory/2072-167-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/2072-178-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/2300-3753-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/2300-20-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/2496-195-0x000007FEF51E0000-0x000007FEF5B7D000-memory.dmp

Filesize
9.6MB

Download
memory/2496-159-0x000007FEF51E0000-0x000007FEF5B7D000-memory.dmp

Filesize
9.6MB

Download
memory/2496-21-0x000007FEF549E000-0x000007FEF549F000-memory.dmp

Filesize
4KB

Download
memory/2496-162-0x000007FEF51E0000-0x000007FEF5B7D000-memory.dmp

Filesize
9.6MB

Download
memory/2496-24-0x0000000001D10000-0x0000000001D18000-memory.dmp

Filesize
32KB

Download
memory/2496-23-0x000000001B770000-0x000000001BA52000-memory.dmp

Filesize
2.9MB

Download
memory/2588-3759-0x000000013F590000-0x000000013F982000-memory.dmp

Filesize
3.9MB

Download
memory/2588-181-0x000000013F590000-0x000000013F982000-memory.dmp

Filesize
3.9MB

Download
memory/2712-3760-0x000000013F3D0000-0x000000013F7C2000-memory.dmp

Filesize
3.9MB

Download
memory/2712-182-0x000000013F3D0000-0x000000013F7C2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-164-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-3752-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/2752-3762-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/2752-168-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/2756-171-0x000000013F020000-0x000000013F412000-memory.dmp

Filesize
3.9MB

Download
memory/2756-3767-0x000000013F020000-0x000000013F412000-memory.dmp

Filesize
3.9MB

Download
memory/2832-166-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/2832-3756-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/2916-9-0x000000013F790000-0x000000013FB82000-memory.dmp

Filesize
3.9MB

Download
memory/2916-3755-0x000000013F790000-0x000000013FB82000-memory.dmp

Filesize
3.9MB

Download