xmrig | a730a80e53bcb14fcfd71e8becdfc7d2008888c66917b65e6dbee41cf2ef28f1

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 09:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9bf4b234405bc11dce86e0a058f03bd0N.exe
Size

1.6MB
MD5

9bf4b234405bc11dce86e0a058f03bd0
SHA1

ab6cd055881798d10c26364d531be581bc65268a
SHA256

a730a80e53bcb14fcfd71e8becdfc7d2008888c66917b65e6dbee41cf2ef28f1
SHA512

615ef14bb22174fc89745345bc2e11211c2c90f8f23a3225881a2df69913fd59ead17c8fc67fe2cb9040ce5f4e11095bc38ca63dd5245696064e6dc40c133296
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYKpGncHBN/VPwa/eebVs4:Lz071uv4BPMkibTIA5CJ31

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 18 IoCs

miner

resource	yara_rule
behavioral1/memory/2744-13-0x000000013F080000-0x000000013F472000-memory.dmp	xmrig
behavioral1/memory/2824-37-0x000000013F0A0000-0x000000013F492000-memory.dmp	xmrig
behavioral1/memory/340-39-0x000000013FD10000-0x0000000140102000-memory.dmp	xmrig
behavioral1/memory/2780-421-0x000000013F1C0000-0x000000013F5B2000-memory.dmp	xmrig
behavioral1/memory/2144-413-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	xmrig
behavioral1/memory/2044-434-0x000000013F910000-0x000000013FD02000-memory.dmp	xmrig
behavioral1/memory/764-419-0x000000013FCC0000-0x00000001400B2000-memory.dmp	xmrig
behavioral1/memory/2828-34-0x000000013FC80000-0x0000000140072000-memory.dmp	xmrig
behavioral1/memory/2744-3406-0x000000013F080000-0x000000013F472000-memory.dmp	xmrig
behavioral1/memory/2824-3531-0x000000013F0A0000-0x000000013F492000-memory.dmp	xmrig
behavioral1/memory/764-4397-0x000000013FCC0000-0x00000001400B2000-memory.dmp	xmrig
behavioral1/memory/2572-4400-0x000000013F1C0000-0x000000013F5B2000-memory.dmp	xmrig
behavioral1/memory/348-4410-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	xmrig
behavioral1/memory/2780-4402-0x000000013F1C0000-0x000000013F5B2000-memory.dmp	xmrig
behavioral1/memory/2200-4447-0x000000013F650000-0x000000013FA42000-memory.dmp	xmrig
behavioral1/memory/1252-4449-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	xmrig
behavioral1/memory/2144-4401-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	xmrig
behavioral1/memory/2044-4399-0x000000013F910000-0x000000013FD02000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1808	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2744	JgabAOC.exe
2828	QkyMaAx.exe
2824	ssYEPpt.exe
340	YgCIDSR.exe
2572	ILvGnkO.exe
2200	VostJRc.exe
348	KkCGLKk.exe
1252	jmxnMuw.exe
2144	cvCyCMg.exe
764	RXgJEBI.exe
2780	vkFKfqC.exe
2044	RPmdQrM.exe
2892	NbPzwQd.exe
1756	rFUffSe.exe
548	NoUQbVR.exe
2860	TbJktBe.exe
1300	pdMZXBG.exe
2420	gFBCKnl.exe
912	lKFPXMw.exe
880	wvevCjc.exe
2368	VdtvGFW.exe
1532	seKzebN.exe
2268	QUIgsBh.exe
2068	YvtGhOa.exe
2288	OSskYpu.exe
1872	hHtZuGp.exe
1144	UcdkQaK.exe
2376	BhViCdf.exe
2988	YrPMVqE.exe
2876	MtvzshX.exe
2908	LSySRlo.exe
1348	YypRyls.exe
928	EcZrtLU.exe
1936	zhFfVrz.exe
2080	wGzhZcp.exe
896	FSUmrUE.exe
1056	CrZNUeQ.exe
1752	RRqhmyb.exe
1956	agNahMq.exe
1496	AZnpElU.exe
2240	ktFuveG.exe
1372	yebLZFA.exe
2224	ibQUNPs.exe
2416	SNgrOdw.exe
1708	SFOpWyu.exe
768	xcTLvzz.exe
1636	JFZJEmi.exe
2060	MnkepGS.exe
2452	OkoMkPW.exe
2448	oDVfFkR.exe
2328	nzXQdbk.exe
2968	lNfBTjD.exe
660	NdWZQRs.exe
572	HDVLIke.exe
2124	CUsbqIT.exe
1972	SHVLkgk.exe
560	ROtpHbq.exe
1028	fEeELPH.exe
3040	YyrLNnK.exe
2924	xutXWXA.exe
1264	OqbBien.exe
3024	sUbPbnh.exe
3032	yudLfPC.exe
1580	nWvCDIX.exe

Loads dropped DLL 64 IoCs

pid	Process
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
2916	9bf4b234405bc11dce86e0a058f03bd0N.exe

UPX packed file 55 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2916-1-0x000000013F6B0000-0x000000013FAA2000-memory.dmp	upx
behavioral1/files/0x000a00000001225e-6.dat	upx
behavioral1/memory/2744-13-0x000000013F080000-0x000000013F472000-memory.dmp	upx
behavioral1/files/0x00070000000193e6-16.dat	upx
behavioral1/files/0x0007000000004e74-23.dat	upx
behavioral1/files/0x000700000001948d-30.dat	upx
behavioral1/files/0x00060000000194e2-40.dat	upx
behavioral1/memory/2824-37-0x000000013F0A0000-0x000000013F492000-memory.dmp	upx
behavioral1/memory/340-39-0x000000013FD10000-0x0000000140102000-memory.dmp	upx
behavioral1/files/0x000900000001958b-47.dat	upx
behavioral1/files/0x0007000000019931-56.dat	upx
behavioral1/files/0x000500000001a478-71.dat	upx
behavioral1/files/0x000500000001a47c-76.dat	upx
behavioral1/files/0x000500000001a47f-79.dat	upx
behavioral1/files/0x000500000001a485-92.dat	upx
behavioral1/files/0x000500000001a489-100.dat	upx
behavioral1/files/0x000500000001a48b-103.dat	upx
behavioral1/files/0x000500000001a491-116.dat	upx
behavioral1/files/0x000500000001a497-127.dat	upx
behavioral1/files/0x000500000001a4a2-147.dat	upx
behavioral1/memory/2780-421-0x000000013F1C0000-0x000000013F5B2000-memory.dmp	upx
behavioral1/memory/2144-413-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	upx
behavioral1/memory/2044-434-0x000000013F910000-0x000000013FD02000-memory.dmp	upx
behavioral1/memory/764-419-0x000000013FCC0000-0x00000001400B2000-memory.dmp	upx
behavioral1/memory/1252-411-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	upx
behavioral1/memory/348-354-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	upx
behavioral1/memory/2200-352-0x000000013F650000-0x000000013FA42000-memory.dmp	upx
behavioral1/memory/2572-351-0x000000013F1C0000-0x000000013F5B2000-memory.dmp	upx
behavioral1/files/0x000500000001a4a4-152.dat	upx
behavioral1/files/0x000500000001a4a0-144.dat	upx
behavioral1/files/0x000500000001a49e-139.dat	upx
behavioral1/files/0x000500000001a49b-135.dat	upx
behavioral1/files/0x000500000001a499-132.dat	upx
behavioral1/files/0x000500000001a495-124.dat	upx
behavioral1/files/0x000500000001a493-119.dat	upx
behavioral1/files/0x000500000001a48f-111.dat	upx
behavioral1/files/0x000500000001a48d-108.dat	upx
behavioral1/files/0x000500000001a487-95.dat	upx
behavioral1/files/0x000500000001a483-87.dat	upx
behavioral1/files/0x000500000001a481-84.dat	upx
behavioral1/files/0x000500000001a472-67.dat	upx
behavioral1/files/0x000500000001a470-64.dat	upx
behavioral1/files/0x000500000001a46d-59.dat	upx
behavioral1/files/0x001700000001937b-52.dat	upx
behavioral1/memory/2828-34-0x000000013FC80000-0x0000000140072000-memory.dmp	upx
behavioral1/memory/2744-3406-0x000000013F080000-0x000000013F472000-memory.dmp	upx
behavioral1/memory/2824-3531-0x000000013F0A0000-0x000000013F492000-memory.dmp	upx
behavioral1/memory/764-4397-0x000000013FCC0000-0x00000001400B2000-memory.dmp	upx
behavioral1/memory/2572-4400-0x000000013F1C0000-0x000000013F5B2000-memory.dmp	upx
behavioral1/memory/348-4410-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	upx
behavioral1/memory/2780-4402-0x000000013F1C0000-0x000000013F5B2000-memory.dmp	upx
behavioral1/memory/2200-4447-0x000000013F650000-0x000000013FA42000-memory.dmp	upx
behavioral1/memory/1252-4449-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	upx
behavioral1/memory/2144-4401-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	upx
behavioral1/memory/2044-4399-0x000000013F910000-0x000000013FD02000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\xvjtuvM.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\emQgztE.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\UJMEiqG.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\qyYWruv.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\ZBXYher.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\dYuoVpb.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\soNNIwp.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\nWLSvvt.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\eiBybfc.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\CYMSPKx.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\xFggZOq.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\hylNOCY.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\wihNihh.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\JBogSKV.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\JhimRTW.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\ABWPgkb.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\CKStWsW.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\MjbbnGS.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\fcnCOod.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\etWsWfz.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\LSPErBe.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\MrjLivw.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\TNkoSMP.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\mpgMBlU.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\kUjWObO.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\fEeELPH.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\HFuZWWI.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\TzWlsHK.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\AZbEkWv.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\WwxMdud.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\XRiKAiN.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\EiHjVPe.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\MQRCJxV.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\LRduBBS.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\AZHxMBy.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\RrQeGZQ.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\XjqhanJ.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\UfVTLkN.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\vpjgfFU.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\KatWxie.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\CLKLPDs.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\FSUmrUE.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\tDeCWyE.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\YnjXDAo.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\DkCdFVL.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\ICxHEqG.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\QUIgsBh.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\vDBlKhF.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\naNWTEm.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\kEExnsB.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\vEUOuYs.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\zElqMqh.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\Dpmzqtc.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\oNwdDXT.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\xqVCFBX.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\WWGqYbI.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\lcjUbTF.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\bYahIqe.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\YLcTnIE.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\eAtqsvO.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\mVmxWnZ.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\AZfRuHa.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\QfjBLHe.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe
File created	C:\Windows\System\yyoCVOO.exe	9bf4b234405bc11dce86e0a058f03bd0N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1808	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
Token: SeLockMemoryPrivilege	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe
Token: SeDebugPrivilege	1808	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 1808	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	31
PID 2916 wrote to memory of 1808	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	31
PID 2916 wrote to memory of 1808	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	31
PID 2916 wrote to memory of 2744	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	32
PID 2916 wrote to memory of 2744	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	32
PID 2916 wrote to memory of 2744	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	32
PID 2916 wrote to memory of 2828	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	33
PID 2916 wrote to memory of 2828	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	33
PID 2916 wrote to memory of 2828	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	33
PID 2916 wrote to memory of 2824	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	34
PID 2916 wrote to memory of 2824	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	34
PID 2916 wrote to memory of 2824	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	34
PID 2916 wrote to memory of 340	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	35
PID 2916 wrote to memory of 340	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	35
PID 2916 wrote to memory of 340	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	35
PID 2916 wrote to memory of 2572	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	36
PID 2916 wrote to memory of 2572	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	36
PID 2916 wrote to memory of 2572	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	36
PID 2916 wrote to memory of 2200	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	37
PID 2916 wrote to memory of 2200	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	37
PID 2916 wrote to memory of 2200	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	37
PID 2916 wrote to memory of 348	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	38
PID 2916 wrote to memory of 348	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	38
PID 2916 wrote to memory of 348	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	38
PID 2916 wrote to memory of 1252	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	39
PID 2916 wrote to memory of 1252	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	39
PID 2916 wrote to memory of 1252	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	39
PID 2916 wrote to memory of 2144	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	40
PID 2916 wrote to memory of 2144	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	40
PID 2916 wrote to memory of 2144	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	40
PID 2916 wrote to memory of 764	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	41
PID 2916 wrote to memory of 764	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	41
PID 2916 wrote to memory of 764	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	41
PID 2916 wrote to memory of 2780	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	42
PID 2916 wrote to memory of 2780	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	42
PID 2916 wrote to memory of 2780	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	42
PID 2916 wrote to memory of 2044	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	43
PID 2916 wrote to memory of 2044	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	43
PID 2916 wrote to memory of 2044	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	43
PID 2916 wrote to memory of 2892	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	44
PID 2916 wrote to memory of 2892	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	44
PID 2916 wrote to memory of 2892	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	44
PID 2916 wrote to memory of 1756	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	45
PID 2916 wrote to memory of 1756	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	45
PID 2916 wrote to memory of 1756	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	45
PID 2916 wrote to memory of 548	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	46
PID 2916 wrote to memory of 548	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	46
PID 2916 wrote to memory of 548	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	46
PID 2916 wrote to memory of 2860	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	47
PID 2916 wrote to memory of 2860	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	47
PID 2916 wrote to memory of 2860	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	47
PID 2916 wrote to memory of 1300	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	48
PID 2916 wrote to memory of 1300	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	48
PID 2916 wrote to memory of 1300	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	48
PID 2916 wrote to memory of 2420	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	49
PID 2916 wrote to memory of 2420	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	49
PID 2916 wrote to memory of 2420	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	49
PID 2916 wrote to memory of 912	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	50
PID 2916 wrote to memory of 912	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	50
PID 2916 wrote to memory of 912	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	50
PID 2916 wrote to memory of 880	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	51
PID 2916 wrote to memory of 880	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	51
PID 2916 wrote to memory of 880	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	51
PID 2916 wrote to memory of 2368	2916	9bf4b234405bc11dce86e0a058f03bd0N.exe	52

C:\Users\Admin\AppData\Local\Temp\9bf4b234405bc11dce86e0a058f03bd0N.exe
"C:\Users\Admin\AppData\Local\Temp\9bf4b234405bc11dce86e0a058f03bd0N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1808
- C:\Windows\System\JgabAOC.exe
  C:\Windows\System\JgabAOC.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\QkyMaAx.exe
  C:\Windows\System\QkyMaAx.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\ssYEPpt.exe
  C:\Windows\System\ssYEPpt.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\YgCIDSR.exe
  C:\Windows\System\YgCIDSR.exe
  2⤵
  - Executes dropped EXE
  PID:340
- C:\Windows\System\ILvGnkO.exe
  C:\Windows\System\ILvGnkO.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\VostJRc.exe
  C:\Windows\System\VostJRc.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\KkCGLKk.exe
  C:\Windows\System\KkCGLKk.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\jmxnMuw.exe
  C:\Windows\System\jmxnMuw.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\cvCyCMg.exe
  C:\Windows\System\cvCyCMg.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\RXgJEBI.exe
  C:\Windows\System\RXgJEBI.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\vkFKfqC.exe
  C:\Windows\System\vkFKfqC.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\RPmdQrM.exe
  C:\Windows\System\RPmdQrM.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\NbPzwQd.exe
  C:\Windows\System\NbPzwQd.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\rFUffSe.exe
  C:\Windows\System\rFUffSe.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\NoUQbVR.exe
  C:\Windows\System\NoUQbVR.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\TbJktBe.exe
  C:\Windows\System\TbJktBe.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\pdMZXBG.exe
  C:\Windows\System\pdMZXBG.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\gFBCKnl.exe
  C:\Windows\System\gFBCKnl.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\lKFPXMw.exe
  C:\Windows\System\lKFPXMw.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\wvevCjc.exe
  C:\Windows\System\wvevCjc.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\VdtvGFW.exe
  C:\Windows\System\VdtvGFW.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\seKzebN.exe
  C:\Windows\System\seKzebN.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\QUIgsBh.exe
  C:\Windows\System\QUIgsBh.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\YvtGhOa.exe
  C:\Windows\System\YvtGhOa.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\OSskYpu.exe
  C:\Windows\System\OSskYpu.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\hHtZuGp.exe
  C:\Windows\System\hHtZuGp.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\UcdkQaK.exe
  C:\Windows\System\UcdkQaK.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\BhViCdf.exe
  C:\Windows\System\BhViCdf.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\YrPMVqE.exe
  C:\Windows\System\YrPMVqE.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\MtvzshX.exe
  C:\Windows\System\MtvzshX.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\LSySRlo.exe
  C:\Windows\System\LSySRlo.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\YypRyls.exe
  C:\Windows\System\YypRyls.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\EcZrtLU.exe
  C:\Windows\System\EcZrtLU.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\zhFfVrz.exe
  C:\Windows\System\zhFfVrz.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\wGzhZcp.exe
  C:\Windows\System\wGzhZcp.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\FSUmrUE.exe
  C:\Windows\System\FSUmrUE.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\CrZNUeQ.exe
  C:\Windows\System\CrZNUeQ.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\RRqhmyb.exe
  C:\Windows\System\RRqhmyb.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\agNahMq.exe
  C:\Windows\System\agNahMq.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\AZnpElU.exe
  C:\Windows\System\AZnpElU.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\ktFuveG.exe
  C:\Windows\System\ktFuveG.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\yebLZFA.exe
  C:\Windows\System\yebLZFA.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\ibQUNPs.exe
  C:\Windows\System\ibQUNPs.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\SNgrOdw.exe
  C:\Windows\System\SNgrOdw.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\SFOpWyu.exe
  C:\Windows\System\SFOpWyu.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\xcTLvzz.exe
  C:\Windows\System\xcTLvzz.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\JFZJEmi.exe
  C:\Windows\System\JFZJEmi.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\MnkepGS.exe
  C:\Windows\System\MnkepGS.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\OkoMkPW.exe
  C:\Windows\System\OkoMkPW.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\oDVfFkR.exe
  C:\Windows\System\oDVfFkR.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\nzXQdbk.exe
  C:\Windows\System\nzXQdbk.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\lNfBTjD.exe
  C:\Windows\System\lNfBTjD.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\NdWZQRs.exe
  C:\Windows\System\NdWZQRs.exe
  2⤵
  - Executes dropped EXE
  PID:660
- C:\Windows\System\HDVLIke.exe
  C:\Windows\System\HDVLIke.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\CUsbqIT.exe
  C:\Windows\System\CUsbqIT.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\SHVLkgk.exe
  C:\Windows\System\SHVLkgk.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\ROtpHbq.exe
  C:\Windows\System\ROtpHbq.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\fEeELPH.exe
  C:\Windows\System\fEeELPH.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\YyrLNnK.exe
  C:\Windows\System\YyrLNnK.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\xutXWXA.exe
  C:\Windows\System\xutXWXA.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\OqbBien.exe
  C:\Windows\System\OqbBien.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\sUbPbnh.exe
  C:\Windows\System\sUbPbnh.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\yudLfPC.exe
  C:\Windows\System\yudLfPC.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\nWvCDIX.exe
  C:\Windows\System\nWvCDIX.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\pfkroSe.exe
  C:\Windows\System\pfkroSe.exe
  2⤵
  PID:1584
- C:\Windows\System\yUsEEmx.exe
  C:\Windows\System\yUsEEmx.exe
  2⤵
  PID:876
- C:\Windows\System\YECpKFu.exe
  C:\Windows\System\YECpKFu.exe
  2⤵
  PID:2708
- C:\Windows\System\NHSgmdM.exe
  C:\Windows\System\NHSgmdM.exe
  2⤵
  PID:2764
- C:\Windows\System\fIGKosi.exe
  C:\Windows\System\fIGKosi.exe
  2⤵
  PID:2812
- C:\Windows\System\XqQeeFD.exe
  C:\Windows\System\XqQeeFD.exe
  2⤵
  PID:3044
- C:\Windows\System\bnopZvo.exe
  C:\Windows\System\bnopZvo.exe
  2⤵
  PID:2732
- C:\Windows\System\OgrAtsD.exe
  C:\Windows\System\OgrAtsD.exe
  2⤵
  PID:3012
- C:\Windows\System\PotCVwy.exe
  C:\Windows\System\PotCVwy.exe
  2⤵
  PID:3020
- C:\Windows\System\CXLtHLm.exe
  C:\Windows\System\CXLtHLm.exe
  2⤵
  PID:1608
- C:\Windows\System\wPjXpDy.exe
  C:\Windows\System\wPjXpDy.exe
  2⤵
  PID:2188
- C:\Windows\System\QjZVvRv.exe
  C:\Windows\System\QjZVvRv.exe
  2⤵
  PID:1976
- C:\Windows\System\HCkSzko.exe
  C:\Windows\System\HCkSzko.exe
  2⤵
  PID:2724
- C:\Windows\System\oITkecm.exe
  C:\Windows\System\oITkecm.exe
  2⤵
  PID:700
- C:\Windows\System\SXdlyoV.exe
  C:\Windows\System\SXdlyoV.exe
  2⤵
  PID:2784
- C:\Windows\System\heopqxj.exe
  C:\Windows\System\heopqxj.exe
  2⤵
  PID:2108
- C:\Windows\System\gxrZrtU.exe
  C:\Windows\System\gxrZrtU.exe
  2⤵
  PID:1728
- C:\Windows\System\CVzhNXz.exe
  C:\Windows\System\CVzhNXz.exe
  2⤵
  PID:1364
- C:\Windows\System\rQDmoBy.exe
  C:\Windows\System\rQDmoBy.exe
  2⤵
  PID:2024
- C:\Windows\System\bRltnYb.exe
  C:\Windows\System\bRltnYb.exe
  2⤵
  PID:3064
- C:\Windows\System\KccqebH.exe
  C:\Windows\System\KccqebH.exe
  2⤵
  PID:1012
- C:\Windows\System\mNCVkKK.exe
  C:\Windows\System\mNCVkKK.exe
  2⤵
  PID:2712
- C:\Windows\System\fFAEzSb.exe
  C:\Windows\System\fFAEzSb.exe
  2⤵
  PID:2964
- C:\Windows\System\fpdiWTf.exe
  C:\Windows\System\fpdiWTf.exe
  2⤵
  PID:1812
- C:\Windows\System\GmxqYqm.exe
  C:\Windows\System\GmxqYqm.exe
  2⤵
  PID:2516
- C:\Windows\System\DviVnnS.exe
  C:\Windows\System\DviVnnS.exe
  2⤵
  PID:804
- C:\Windows\System\tkZOmWp.exe
  C:\Windows\System\tkZOmWp.exe
  2⤵
  PID:2948
- C:\Windows\System\JQVouIk.exe
  C:\Windows\System\JQVouIk.exe
  2⤵
  PID:1804
- C:\Windows\System\ldRzxMB.exe
  C:\Windows\System\ldRzxMB.exe
  2⤵
  PID:1540
- C:\Windows\System\WyNqxDG.exe
  C:\Windows\System\WyNqxDG.exe
  2⤵
  PID:1996
- C:\Windows\System\TikVZzx.exe
  C:\Windows\System\TikVZzx.exe
  2⤵
  PID:2392
- C:\Windows\System\EQwRirF.exe
  C:\Windows\System\EQwRirF.exe
  2⤵
  PID:2092
- C:\Windows\System\kLvfPRN.exe
  C:\Windows\System\kLvfPRN.exe
  2⤵
  PID:2308
- C:\Windows\System\kCDsKWl.exe
  C:\Windows\System\kCDsKWl.exe
  2⤵
  PID:1188
- C:\Windows\System\zXmMrHw.exe
  C:\Windows\System\zXmMrHw.exe
  2⤵
  PID:996
- C:\Windows\System\QBYKkdN.exe
  C:\Windows\System\QBYKkdN.exe
  2⤵
  PID:2432
- C:\Windows\System\dzilnjI.exe
  C:\Windows\System\dzilnjI.exe
  2⤵
  PID:1744
- C:\Windows\System\kzRTGWw.exe
  C:\Windows\System\kzRTGWw.exe
  2⤵
  PID:1616
- C:\Windows\System\rVVbgTV.exe
  C:\Windows\System\rVVbgTV.exe
  2⤵
  PID:2700
- C:\Windows\System\lImvYqp.exe
  C:\Windows\System\lImvYqp.exe
  2⤵
  PID:1592
- C:\Windows\System\jMuQqqD.exe
  C:\Windows\System\jMuQqqD.exe
  2⤵
  PID:1688
- C:\Windows\System\vgNeZft.exe
  C:\Windows\System\vgNeZft.exe
  2⤵
  PID:2584
- C:\Windows\System\LVEMbgw.exe
  C:\Windows\System\LVEMbgw.exe
  2⤵
  PID:3016
- C:\Windows\System\AFwJiDt.exe
  C:\Windows\System\AFwJiDt.exe
  2⤵
  PID:2588
- C:\Windows\System\WCLJcwW.exe
  C:\Windows\System\WCLJcwW.exe
  2⤵
  PID:2440
- C:\Windows\System\yBACmEO.exe
  C:\Windows\System\yBACmEO.exe
  2⤵
  PID:2396
- C:\Windows\System\TkeLKie.exe
  C:\Windows\System\TkeLKie.exe
  2⤵
  PID:1596
- C:\Windows\System\OFOQUyy.exe
  C:\Windows\System\OFOQUyy.exe
  2⤵
  PID:2616
- C:\Windows\System\nsjJrog.exe
  C:\Windows\System\nsjJrog.exe
  2⤵
  PID:2136
- C:\Windows\System\dggAyFt.exe
  C:\Windows\System\dggAyFt.exe
  2⤵
  PID:1344
- C:\Windows\System\oyhNKqz.exe
  C:\Windows\System\oyhNKqz.exe
  2⤵
  PID:2052
- C:\Windows\System\yPhMLdK.exe
  C:\Windows\System\yPhMLdK.exe
  2⤵
  PID:1356
- C:\Windows\System\zMMcqbZ.exe
  C:\Windows\System\zMMcqbZ.exe
  2⤵
  PID:3000
- C:\Windows\System\CCZKIUs.exe
  C:\Windows\System\CCZKIUs.exe
  2⤵
  PID:2360
- C:\Windows\System\LrlnOIc.exe
  C:\Windows\System\LrlnOIc.exe
  2⤵
  PID:1280
- C:\Windows\System\EOlAcei.exe
  C:\Windows\System\EOlAcei.exe
  2⤵
  PID:2684
- C:\Windows\System\JcHKHzZ.exe
  C:\Windows\System\JcHKHzZ.exe
  2⤵
  PID:2500
- C:\Windows\System\qfaIdIU.exe
  C:\Windows\System\qfaIdIU.exe
  2⤵
  PID:1460
- C:\Windows\System\qZhYZHS.exe
  C:\Windows\System\qZhYZHS.exe
  2⤵
  PID:1720
- C:\Windows\System\UfjjqZU.exe
  C:\Windows\System\UfjjqZU.exe
  2⤵
  PID:1712
- C:\Windows\System\SWmllOh.exe
  C:\Windows\System\SWmllOh.exe
  2⤵
  PID:2872
- C:\Windows\System\lLWUMlm.exe
  C:\Windows\System\lLWUMlm.exe
  2⤵
  PID:1444
- C:\Windows\System\vyHidus.exe
  C:\Windows\System\vyHidus.exe
  2⤵
  PID:2236
- C:\Windows\System\krZqpGn.exe
  C:\Windows\System\krZqpGn.exe
  2⤵
  PID:2912
- C:\Windows\System\eGhUhts.exe
  C:\Windows\System\eGhUhts.exe
  2⤵
  PID:2000
- C:\Windows\System\dqybcwR.exe
  C:\Windows\System\dqybcwR.exe
  2⤵
  PID:2304
- C:\Windows\System\pKqlrRL.exe
  C:\Windows\System\pKqlrRL.exe
  2⤵
  PID:3048
- C:\Windows\System\JjuAtvx.exe
  C:\Windows\System\JjuAtvx.exe
  2⤵
  PID:2788
- C:\Windows\System\qgWNAFi.exe
  C:\Windows\System\qgWNAFi.exe
  2⤵
  PID:2280
- C:\Windows\System\bofIgCl.exe
  C:\Windows\System\bofIgCl.exe
  2⤵
  PID:2928
- C:\Windows\System\gaFtcqd.exe
  C:\Windows\System\gaFtcqd.exe
  2⤵
  PID:1140
- C:\Windows\System\CFbXMOO.exe
  C:\Windows\System\CFbXMOO.exe
  2⤵
  PID:1904
- C:\Windows\System\Wlovgrt.exe
  C:\Windows\System\Wlovgrt.exe
  2⤵
  PID:2792
- C:\Windows\System\ghnTVmX.exe
  C:\Windows\System\ghnTVmX.exe
  2⤵
  PID:3088
- C:\Windows\System\BACClQG.exe
  C:\Windows\System\BACClQG.exe
  2⤵
  PID:3104
- C:\Windows\System\qZDpeyP.exe
  C:\Windows\System\qZDpeyP.exe
  2⤵
  PID:3128
- C:\Windows\System\xsCAUMi.exe
  C:\Windows\System\xsCAUMi.exe
  2⤵
  PID:3148
- C:\Windows\System\UbaeCML.exe
  C:\Windows\System\UbaeCML.exe
  2⤵
  PID:3176
- C:\Windows\System\xTJjGcC.exe
  C:\Windows\System\xTJjGcC.exe
  2⤵
  PID:3196
- C:\Windows\System\HYJKGGu.exe
  C:\Windows\System\HYJKGGu.exe
  2⤵
  PID:3216
- C:\Windows\System\aVxXgEz.exe
  C:\Windows\System\aVxXgEz.exe
  2⤵
  PID:3232
- C:\Windows\System\OTkkSzZ.exe
  C:\Windows\System\OTkkSzZ.exe
  2⤵
  PID:3248
- C:\Windows\System\iYiYAJC.exe
  C:\Windows\System\iYiYAJC.exe
  2⤵
  PID:3264
- C:\Windows\System\RrHdEfk.exe
  C:\Windows\System\RrHdEfk.exe
  2⤵
  PID:3284
- C:\Windows\System\paRdeRw.exe
  C:\Windows\System\paRdeRw.exe
  2⤵
  PID:3300
- C:\Windows\System\mVmxWnZ.exe
  C:\Windows\System\mVmxWnZ.exe
  2⤵
  PID:3356
- C:\Windows\System\QeknIaD.exe
  C:\Windows\System\QeknIaD.exe
  2⤵
  PID:3372
- C:\Windows\System\LFONufH.exe
  C:\Windows\System\LFONufH.exe
  2⤵
  PID:3388
- C:\Windows\System\xdlZsxI.exe
  C:\Windows\System\xdlZsxI.exe
  2⤵
  PID:3404
- C:\Windows\System\ixhZyNi.exe
  C:\Windows\System\ixhZyNi.exe
  2⤵
  PID:3420
- C:\Windows\System\ISTugCo.exe
  C:\Windows\System\ISTugCo.exe
  2⤵
  PID:3436
- C:\Windows\System\gjRTnBK.exe
  C:\Windows\System\gjRTnBK.exe
  2⤵
  PID:3452
- C:\Windows\System\UGVonSN.exe
  C:\Windows\System\UGVonSN.exe
  2⤵
  PID:3468
- C:\Windows\System\zsCGSkm.exe
  C:\Windows\System\zsCGSkm.exe
  2⤵
  PID:3484
- C:\Windows\System\OWiwZbL.exe
  C:\Windows\System\OWiwZbL.exe
  2⤵
  PID:3500
- C:\Windows\System\pcylCEK.exe
  C:\Windows\System\pcylCEK.exe
  2⤵
  PID:3516
- C:\Windows\System\PGgMShQ.exe
  C:\Windows\System\PGgMShQ.exe
  2⤵
  PID:3532
- C:\Windows\System\xduxyaL.exe
  C:\Windows\System\xduxyaL.exe
  2⤵
  PID:3552
- C:\Windows\System\GnrOTxz.exe
  C:\Windows\System\GnrOTxz.exe
  2⤵
  PID:3572
- C:\Windows\System\aMrjNTL.exe
  C:\Windows\System\aMrjNTL.exe
  2⤵
  PID:3596
- C:\Windows\System\MKhIEYE.exe
  C:\Windows\System\MKhIEYE.exe
  2⤵
  PID:3612
- C:\Windows\System\epImOtm.exe
  C:\Windows\System\epImOtm.exe
  2⤵
  PID:3636
- C:\Windows\System\jecObdd.exe
  C:\Windows\System\jecObdd.exe
  2⤵
  PID:3724
- C:\Windows\System\ryjkOGp.exe
  C:\Windows\System\ryjkOGp.exe
  2⤵
  PID:3836
- C:\Windows\System\tzqgarh.exe
  C:\Windows\System\tzqgarh.exe
  2⤵
  PID:3916
- C:\Windows\System\mhcIgOb.exe
  C:\Windows\System\mhcIgOb.exe
  2⤵
  PID:4020
- C:\Windows\System\slyPNMU.exe
  C:\Windows\System\slyPNMU.exe
  2⤵
  PID:4056
- C:\Windows\System\KoQYWqM.exe
  C:\Windows\System\KoQYWqM.exe
  2⤵
  PID:2672
- C:\Windows\System\bYahIqe.exe
  C:\Windows\System\bYahIqe.exe
  2⤵
  PID:2372
- C:\Windows\System\SzNfaTK.exe
  C:\Windows\System\SzNfaTK.exe
  2⤵
  PID:2380
- C:\Windows\System\XXLGAXw.exe
  C:\Windows\System\XXLGAXw.exe
  2⤵
  PID:760
- C:\Windows\System\wKOMADx.exe
  C:\Windows\System\wKOMADx.exe
  2⤵
  PID:3084
- C:\Windows\System\RgFYeIo.exe
  C:\Windows\System\RgFYeIo.exe
  2⤵
  PID:3204
- C:\Windows\System\jiVtrLB.exe
  C:\Windows\System\jiVtrLB.exe
  2⤵
  PID:776
- C:\Windows\System\liShREN.exe
  C:\Windows\System\liShREN.exe
  2⤵
  PID:2884
- C:\Windows\System\xBEtqRM.exe
  C:\Windows\System\xBEtqRM.exe
  2⤵
  PID:860
- C:\Windows\System\SBDWPhW.exe
  C:\Windows\System\SBDWPhW.exe
  2⤵
  PID:3192
- C:\Windows\System\zxVilqQ.exe
  C:\Windows\System\zxVilqQ.exe
  2⤵
  PID:2084
- C:\Windows\System\kmbbebb.exe
  C:\Windows\System\kmbbebb.exe
  2⤵
  PID:2168
- C:\Windows\System\uXsNztd.exe
  C:\Windows\System\uXsNztd.exe
  2⤵
  PID:2128
- C:\Windows\System\jtmQktO.exe
  C:\Windows\System\jtmQktO.exe
  2⤵
  PID:3448
- C:\Windows\System\VdPfaGY.exe
  C:\Windows\System\VdPfaGY.exe
  2⤵
  PID:3508
- C:\Windows\System\hSFgAfI.exe
  C:\Windows\System\hSFgAfI.exe
  2⤵
  PID:3460
- C:\Windows\System\rNphoJJ.exe
  C:\Windows\System\rNphoJJ.exe
  2⤵
  PID:3492
- C:\Windows\System\nIOYOGj.exe
  C:\Windows\System\nIOYOGj.exe
  2⤵
  PID:3564
- C:\Windows\System\VrNfNEd.exe
  C:\Windows\System\VrNfNEd.exe
  2⤵
  PID:3620
- C:\Windows\System\XTwuobP.exe
  C:\Windows\System\XTwuobP.exe
  2⤵
  PID:3604
- C:\Windows\System\xKhRdPw.exe
  C:\Windows\System\xKhRdPw.exe
  2⤵
  PID:3676
- C:\Windows\System\HFuZWWI.exe
  C:\Windows\System\HFuZWWI.exe
  2⤵
  PID:3732
- C:\Windows\System\NrDJjCR.exe
  C:\Windows\System\NrDJjCR.exe
  2⤵
  PID:3756
- C:\Windows\System\SOslXWL.exe
  C:\Windows\System\SOslXWL.exe
  2⤵
  PID:3776
- C:\Windows\System\gKFmBTY.exe
  C:\Windows\System\gKFmBTY.exe
  2⤵
  PID:3684
- C:\Windows\System\NxMInSe.exe
  C:\Windows\System\NxMInSe.exe
  2⤵
  PID:3700
- C:\Windows\System\bvtkvmD.exe
  C:\Windows\System\bvtkvmD.exe
  2⤵
  PID:3720
- C:\Windows\System\TReWIjF.exe
  C:\Windows\System\TReWIjF.exe
  2⤵
  PID:3808
- C:\Windows\System\GrFKqFo.exe
  C:\Windows\System\GrFKqFo.exe
  2⤵
  PID:3816
- C:\Windows\System\TzWlsHK.exe
  C:\Windows\System\TzWlsHK.exe
  2⤵
  PID:3852
- C:\Windows\System\fdlhxoR.exe
  C:\Windows\System\fdlhxoR.exe
  2⤵
  PID:3932
- C:\Windows\System\yDOFfJy.exe
  C:\Windows\System\yDOFfJy.exe
  2⤵
  PID:3948
- C:\Windows\System\HOlLTUM.exe
  C:\Windows\System\HOlLTUM.exe
  2⤵
  PID:3868
- C:\Windows\System\wDqAoNI.exe
  C:\Windows\System\wDqAoNI.exe
  2⤵
  PID:2004
- C:\Windows\System\nXVhzqv.exe
  C:\Windows\System\nXVhzqv.exe
  2⤵
  PID:2148
- C:\Windows\System\OWWzzPQ.exe
  C:\Windows\System\OWWzzPQ.exe
  2⤵
  PID:3904
- C:\Windows\System\NfcZAqS.exe
  C:\Windows\System\NfcZAqS.exe
  2⤵
  PID:3124
- C:\Windows\System\CZjyFcY.exe
  C:\Windows\System\CZjyFcY.exe
  2⤵
  PID:4000
- C:\Windows\System\ajSGuXD.exe
  C:\Windows\System\ajSGuXD.exe
  2⤵
  PID:4016
- C:\Windows\System\aBPOvyH.exe
  C:\Windows\System\aBPOvyH.exe
  2⤵
  PID:3212
- C:\Windows\System\tGevaAS.exe
  C:\Windows\System\tGevaAS.exe
  2⤵
  PID:4068
- C:\Windows\System\HSPCkTJ.exe
  C:\Windows\System\HSPCkTJ.exe
  2⤵
  PID:4032
- C:\Windows\System\tYyKZqZ.exe
  C:\Windows\System\tYyKZqZ.exe
  2⤵
  PID:4092
- C:\Windows\System\kXDKFrp.exe
  C:\Windows\System\kXDKFrp.exe
  2⤵
  PID:2800
- C:\Windows\System\ondwQTP.exe
  C:\Windows\System\ondwQTP.exe
  2⤵
  PID:1988
- C:\Windows\System\zghmpWL.exe
  C:\Windows\System\zghmpWL.exe
  2⤵
  PID:3240
- C:\Windows\System\yShrkTW.exe
  C:\Windows\System\yShrkTW.exe
  2⤵
  PID:1620
- C:\Windows\System\GtyNkCb.exe
  C:\Windows\System\GtyNkCb.exe
  2⤵
  PID:1640
- C:\Windows\System\NzxTYcS.exe
  C:\Windows\System\NzxTYcS.exe
  2⤵
  PID:1992
- C:\Windows\System\Plmhrxp.exe
  C:\Windows\System\Plmhrxp.exe
  2⤵
  PID:3144
- C:\Windows\System\GhTfLak.exe
  C:\Windows\System\GhTfLak.exe
  2⤵
  PID:3292
- C:\Windows\System\UjvxmBP.exe
  C:\Windows\System\UjvxmBP.exe
  2⤵
  PID:2612
- C:\Windows\System\fqdnoCa.exe
  C:\Windows\System\fqdnoCa.exe
  2⤵
  PID:3384
- C:\Windows\System\xhpntXE.exe
  C:\Windows\System\xhpntXE.exe
  2⤵
  PID:3416
- C:\Windows\System\nbsQEWY.exe
  C:\Windows\System\nbsQEWY.exe
  2⤵
  PID:2796
- C:\Windows\System\mUVrysp.exe
  C:\Windows\System\mUVrysp.exe
  2⤵
  PID:3544
- C:\Windows\System\WsvlEUq.exe
  C:\Windows\System\WsvlEUq.exe
  2⤵
  PID:3588
- C:\Windows\System\wGGyUFf.exe
  C:\Windows\System\wGGyUFf.exe
  2⤵
  PID:3652
- C:\Windows\System\WEnODxK.exe
  C:\Windows\System\WEnODxK.exe
  2⤵
  PID:3664
- C:\Windows\System\pTXtLmn.exe
  C:\Windows\System\pTXtLmn.exe
  2⤵
  PID:3764
- C:\Windows\System\KhtsPGx.exe
  C:\Windows\System\KhtsPGx.exe
  2⤵
  PID:3696
- C:\Windows\System\VXiMKTw.exe
  C:\Windows\System\VXiMKTw.exe
  2⤵
  PID:3548
- C:\Windows\System\sUQiypo.exe
  C:\Windows\System\sUQiypo.exe
  2⤵
  PID:3804
- C:\Windows\System\mfaNYpc.exe
  C:\Windows\System\mfaNYpc.exe
  2⤵
  PID:3856
- C:\Windows\System\afkVaQw.exe
  C:\Windows\System\afkVaQw.exe
  2⤵
  PID:3944
- C:\Windows\System\sZrrkom.exe
  C:\Windows\System\sZrrkom.exe
  2⤵
  PID:3872
- C:\Windows\System\TAOQrsp.exe
  C:\Windows\System\TAOQrsp.exe
  2⤵
  PID:3968
- C:\Windows\System\GfDqTLj.exe
  C:\Windows\System\GfDqTLj.exe
  2⤵
  PID:3896
- C:\Windows\System\LRzrYoA.exe
  C:\Windows\System\LRzrYoA.exe
  2⤵
  PID:4004
- C:\Windows\System\DZejNti.exe
  C:\Windows\System\DZejNti.exe
  2⤵
  PID:3172
- C:\Windows\System\ZvEgOZE.exe
  C:\Windows\System\ZvEgOZE.exe
  2⤵
  PID:4040
- C:\Windows\System\nFAvHrD.exe
  C:\Windows\System\nFAvHrD.exe
  2⤵
  PID:4076
- C:\Windows\System\OYRbPny.exe
  C:\Windows\System\OYRbPny.exe
  2⤵
  PID:4072
- C:\Windows\System\ZkJnCDm.exe
  C:\Windows\System\ZkJnCDm.exe
  2⤵
  PID:2388
- C:\Windows\System\PlkMKyd.exe
  C:\Windows\System\PlkMKyd.exe
  2⤵
  PID:3136
- C:\Windows\System\ntARzTI.exe
  C:\Windows\System\ntARzTI.exe
  2⤵
  PID:2772
- C:\Windows\System\NKQNFjz.exe
  C:\Windows\System\NKQNFjz.exe
  2⤵
  PID:3580
- C:\Windows\System\onLTZNM.exe
  C:\Windows\System\onLTZNM.exe
  2⤵
  PID:3076
- C:\Windows\System\JceRBUY.exe
  C:\Windows\System\JceRBUY.exe
  2⤵
  PID:3272
- C:\Windows\System\gBfrdPv.exe
  C:\Windows\System\gBfrdPv.exe
  2⤵
  PID:3316
- C:\Windows\System\XOTzhzw.exe
  C:\Windows\System\XOTzhzw.exe
  2⤵
  PID:2276
- C:\Windows\System\IsgWeut.exe
  C:\Windows\System\IsgWeut.exe
  2⤵
  PID:1092
- C:\Windows\System\MjbbnGS.exe
  C:\Windows\System\MjbbnGS.exe
  2⤵
  PID:2292
- C:\Windows\System\aLZjrCQ.exe
  C:\Windows\System\aLZjrCQ.exe
  2⤵
  PID:3228
- C:\Windows\System\XcbzpJk.exe
  C:\Windows\System\XcbzpJk.exe
  2⤵
  PID:3100
- C:\Windows\System\WNDkYdJ.exe
  C:\Windows\System\WNDkYdJ.exe
  2⤵
  PID:2152
- C:\Windows\System\tJBmhcw.exe
  C:\Windows\System\tJBmhcw.exe
  2⤵
  PID:1952
- C:\Windows\System\kAjjqXM.exe
  C:\Windows\System\kAjjqXM.exe
  2⤵
  PID:3428
- C:\Windows\System\WCYJtsI.exe
  C:\Windows\System\WCYJtsI.exe
  2⤵
  PID:3632
- C:\Windows\System\WdcqkjZ.exe
  C:\Windows\System\WdcqkjZ.exe
  2⤵
  PID:3644
- C:\Windows\System\whYdOTg.exe
  C:\Windows\System\whYdOTg.exe
  2⤵
  PID:3752
- C:\Windows\System\RAvApKh.exe
  C:\Windows\System\RAvApKh.exe
  2⤵
  PID:3692
- C:\Windows\System\LUocOLW.exe
  C:\Windows\System\LUocOLW.exe
  2⤵
  PID:3812
- C:\Windows\System\mMXRlKg.exe
  C:\Windows\System\mMXRlKg.exe
  2⤵
  PID:3832
- C:\Windows\System\SXRGUvm.exe
  C:\Windows\System\SXRGUvm.exe
  2⤵
  PID:3960
- C:\Windows\System\ttwvcWd.exe
  C:\Windows\System\ttwvcWd.exe
  2⤵
  PID:3964
- C:\Windows\System\DLuGcdP.exe
  C:\Windows\System\DLuGcdP.exe
  2⤵
  PID:3120
- C:\Windows\System\sNoMHlN.exe
  C:\Windows\System\sNoMHlN.exe
  2⤵
  PID:4012
- C:\Windows\System\cDsNgCg.exe
  C:\Windows\System\cDsNgCg.exe
  2⤵
  PID:1736
- C:\Windows\System\LpibgEI.exe
  C:\Windows\System\LpibgEI.exe
  2⤵
  PID:3028
- C:\Windows\System\IRospTh.exe
  C:\Windows\System\IRospTh.exe
  2⤵
  PID:2512
- C:\Windows\System\hygbDzn.exe
  C:\Windows\System\hygbDzn.exe
  2⤵
  PID:444
- C:\Windows\System\GRpDczg.exe
  C:\Windows\System\GRpDczg.exe
  2⤵
  PID:324
- C:\Windows\System\KRimcfb.exe
  C:\Windows\System\KRimcfb.exe
  2⤵
  PID:3188
- C:\Windows\System\IInxlHu.exe
  C:\Windows\System\IInxlHu.exe
  2⤵
  PID:944
- C:\Windows\System\vJbXFxB.exe
  C:\Windows\System\vJbXFxB.exe
  2⤵
  PID:3768
- C:\Windows\System\CjdMgff.exe
  C:\Windows\System\CjdMgff.exe
  2⤵
  PID:780
- C:\Windows\System\eBhGiPU.exe
  C:\Windows\System\eBhGiPU.exe
  2⤵
  PID:3892
- C:\Windows\System\FwKVNwj.exe
  C:\Windows\System\FwKVNwj.exe
  2⤵
  PID:2836
- C:\Windows\System\PUtLDFo.exe
  C:\Windows\System\PUtLDFo.exe
  2⤵
  PID:2640
- C:\Windows\System\CwvdVRO.exe
  C:\Windows\System\CwvdVRO.exe
  2⤵
  PID:2556
- C:\Windows\System\ebGgXSx.exe
  C:\Windows\System\ebGgXSx.exe
  2⤵
  PID:3512
- C:\Windows\System\JKpEiiQ.exe
  C:\Windows\System\JKpEiiQ.exe
  2⤵
  PID:3528
- C:\Windows\System\bjJQLfg.exe
  C:\Windows\System\bjJQLfg.exe
  2⤵
  PID:3976
- C:\Windows\System\sTrqCTL.exe
  C:\Windows\System\sTrqCTL.exe
  2⤵
  PID:2664
- C:\Windows\System\kHAKbBR.exe
  C:\Windows\System\kHAKbBR.exe
  2⤵
  PID:3940
- C:\Windows\System\urJdoES.exe
  C:\Windows\System\urJdoES.exe
  2⤵
  PID:1876
- C:\Windows\System\lEhyJjG.exe
  C:\Windows\System\lEhyJjG.exe
  2⤵
  PID:3364
- C:\Windows\System\yaDLOLZ.exe
  C:\Windows\System\yaDLOLZ.exe
  2⤵
  PID:1008
- C:\Windows\System\SnljYHH.exe
  C:\Windows\System\SnljYHH.exe
  2⤵
  PID:3052
- C:\Windows\System\AvllHvH.exe
  C:\Windows\System\AvllHvH.exe
  2⤵
  PID:3368
- C:\Windows\System\FJwXumC.exe
  C:\Windows\System\FJwXumC.exe
  2⤵
  PID:3256
- C:\Windows\System\FmxktQj.exe
  C:\Windows\System\FmxktQj.exe
  2⤵
  PID:3848
- C:\Windows\System\GUmqAwr.exe
  C:\Windows\System\GUmqAwr.exe
  2⤵
  PID:3740
- C:\Windows\System\trhsPXV.exe
  C:\Windows\System\trhsPXV.exe
  2⤵
  PID:4124
- C:\Windows\System\cruWnAq.exe
  C:\Windows\System\cruWnAq.exe
  2⤵
  PID:4148
- C:\Windows\System\wRHyGkN.exe
  C:\Windows\System\wRHyGkN.exe
  2⤵
  PID:4164
- C:\Windows\System\dkzCHaj.exe
  C:\Windows\System\dkzCHaj.exe
  2⤵
  PID:4180
- C:\Windows\System\ByvSnwi.exe
  C:\Windows\System\ByvSnwi.exe
  2⤵
  PID:4212
- C:\Windows\System\mklNWjt.exe
  C:\Windows\System\mklNWjt.exe
  2⤵
  PID:4244
- C:\Windows\System\QWWrFnc.exe
  C:\Windows\System\QWWrFnc.exe
  2⤵
  PID:4264
- C:\Windows\System\kKrLetc.exe
  C:\Windows\System\kKrLetc.exe
  2⤵
  PID:4284
- C:\Windows\System\KhaJuJf.exe
  C:\Windows\System\KhaJuJf.exe
  2⤵
  PID:4300
- C:\Windows\System\DBkAyBB.exe
  C:\Windows\System\DBkAyBB.exe
  2⤵
  PID:4316
- C:\Windows\System\UiIPgsP.exe
  C:\Windows\System\UiIPgsP.exe
  2⤵
  PID:4340
- C:\Windows\System\WGzFHat.exe
  C:\Windows\System\WGzFHat.exe
  2⤵
  PID:4356
- C:\Windows\System\TTHVQTr.exe
  C:\Windows\System\TTHVQTr.exe
  2⤵
  PID:4380
- C:\Windows\System\VBvDgda.exe
  C:\Windows\System\VBvDgda.exe
  2⤵
  PID:4408
- C:\Windows\System\SQDOoEo.exe
  C:\Windows\System\SQDOoEo.exe
  2⤵
  PID:4428
- C:\Windows\System\xFggZOq.exe
  C:\Windows\System\xFggZOq.exe
  2⤵
  PID:4444
- C:\Windows\System\cMZMBOM.exe
  C:\Windows\System\cMZMBOM.exe
  2⤵
  PID:4476
- C:\Windows\System\IcRjLng.exe
  C:\Windows\System\IcRjLng.exe
  2⤵
  PID:4496
- C:\Windows\System\WanCfCM.exe
  C:\Windows\System\WanCfCM.exe
  2⤵
  PID:4512
- C:\Windows\System\wyHNRHN.exe
  C:\Windows\System\wyHNRHN.exe
  2⤵
  PID:4528
- C:\Windows\System\zbEzArd.exe
  C:\Windows\System\zbEzArd.exe
  2⤵
  PID:4552
- C:\Windows\System\LCsjFvq.exe
  C:\Windows\System\LCsjFvq.exe
  2⤵
  PID:4576
- C:\Windows\System\BqyoyqI.exe
  C:\Windows\System\BqyoyqI.exe
  2⤵
  PID:4596
- C:\Windows\System\bcWamTy.exe
  C:\Windows\System\bcWamTy.exe
  2⤵
  PID:4612
- C:\Windows\System\CbnUmnY.exe
  C:\Windows\System\CbnUmnY.exe
  2⤵
  PID:4636
- C:\Windows\System\wAHAKXb.exe
  C:\Windows\System\wAHAKXb.exe
  2⤵
  PID:4656
- C:\Windows\System\OSVfuaL.exe
  C:\Windows\System\OSVfuaL.exe
  2⤵
  PID:4676
- C:\Windows\System\LxoFjEf.exe
  C:\Windows\System\LxoFjEf.exe
  2⤵
  PID:4696
- C:\Windows\System\llalPEq.exe
  C:\Windows\System\llalPEq.exe
  2⤵
  PID:4716
- C:\Windows\System\jzJnoBo.exe
  C:\Windows\System\jzJnoBo.exe
  2⤵
  PID:4732
- C:\Windows\System\hIJfCni.exe
  C:\Windows\System\hIJfCni.exe
  2⤵
  PID:4760
- C:\Windows\System\FrYzuDw.exe
  C:\Windows\System\FrYzuDw.exe
  2⤵
  PID:4780
- C:\Windows\System\xPNUtyT.exe
  C:\Windows\System\xPNUtyT.exe
  2⤵
  PID:4796
- C:\Windows\System\hylNOCY.exe
  C:\Windows\System\hylNOCY.exe
  2⤵
  PID:4820
- C:\Windows\System\WXmihGy.exe
  C:\Windows\System\WXmihGy.exe
  2⤵
  PID:4840
- C:\Windows\System\YoEIYfU.exe
  C:\Windows\System\YoEIYfU.exe
  2⤵
  PID:4860
- C:\Windows\System\hpfOBQE.exe
  C:\Windows\System\hpfOBQE.exe
  2⤵
  PID:4876
- C:\Windows\System\sNbnkqq.exe
  C:\Windows\System\sNbnkqq.exe
  2⤵
  PID:4892
- C:\Windows\System\cTumyMm.exe
  C:\Windows\System\cTumyMm.exe
  2⤵
  PID:4908
- C:\Windows\System\atelCSS.exe
  C:\Windows\System\atelCSS.exe
  2⤵
  PID:4936
- C:\Windows\System\INqegMQ.exe
  C:\Windows\System\INqegMQ.exe
  2⤵
  PID:4956
- C:\Windows\System\iuhcdIz.exe
  C:\Windows\System\iuhcdIz.exe
  2⤵
  PID:4972
- C:\Windows\System\LhqvVXt.exe
  C:\Windows\System\LhqvVXt.exe
  2⤵
  PID:4996
- C:\Windows\System\njaecor.exe
  C:\Windows\System\njaecor.exe
  2⤵
  PID:5012
- C:\Windows\System\SbZYMgb.exe
  C:\Windows\System\SbZYMgb.exe
  2⤵
  PID:5028
- C:\Windows\System\rdBSIvx.exe
  C:\Windows\System\rdBSIvx.exe
  2⤵
  PID:5048
- C:\Windows\System\qzoXkKL.exe
  C:\Windows\System\qzoXkKL.exe
  2⤵
  PID:5068
- C:\Windows\System\vqcLRtF.exe
  C:\Windows\System\vqcLRtF.exe
  2⤵
  PID:5084
- C:\Windows\System\OKoOpBu.exe
  C:\Windows\System\OKoOpBu.exe
  2⤵
  PID:5104
- C:\Windows\System\CQwqlvj.exe
  C:\Windows\System\CQwqlvj.exe
  2⤵
  PID:1032
- C:\Windows\System\fdqWMbW.exe
  C:\Windows\System\fdqWMbW.exe
  2⤵
  PID:3984
- C:\Windows\System\OHBeIez.exe
  C:\Windows\System\OHBeIez.exe
  2⤵
  PID:4112
- C:\Windows\System\UGEzFdX.exe
  C:\Windows\System\UGEzFdX.exe
  2⤵
  PID:4144
- C:\Windows\System\bumLxqb.exe
  C:\Windows\System\bumLxqb.exe
  2⤵
  PID:4172
- C:\Windows\System\MxDlgKc.exe
  C:\Windows\System\MxDlgKc.exe
  2⤵
  PID:4208
- C:\Windows\System\iAchpQA.exe
  C:\Windows\System\iAchpQA.exe
  2⤵
  PID:4236
- C:\Windows\System\VdXpLGK.exe
  C:\Windows\System\VdXpLGK.exe
  2⤵
  PID:4280
- C:\Windows\System\YcFnKBt.exe
  C:\Windows\System\YcFnKBt.exe
  2⤵
  PID:4328
- C:\Windows\System\FYXlVjG.exe
  C:\Windows\System\FYXlVjG.exe
  2⤵
  PID:4348
- C:\Windows\System\TBnqlul.exe
  C:\Windows\System\TBnqlul.exe
  2⤵
  PID:4420
- C:\Windows\System\ZfXuWIa.exe
  C:\Windows\System\ZfXuWIa.exe
  2⤵
  PID:4400
- C:\Windows\System\aWMkTvt.exe
  C:\Windows\System\aWMkTvt.exe
  2⤵
  PID:4468
- C:\Windows\System\ndCiTNW.exe
  C:\Windows\System\ndCiTNW.exe
  2⤵
  PID:4492
- C:\Windows\System\iKkzNsg.exe
  C:\Windows\System\iKkzNsg.exe
  2⤵
  PID:4544
- C:\Windows\System\RbDKpsY.exe
  C:\Windows\System\RbDKpsY.exe
  2⤵
  PID:4584
- C:\Windows\System\ZyZRRQZ.exe
  C:\Windows\System\ZyZRRQZ.exe
  2⤵
  PID:4608
- C:\Windows\System\wkXelXh.exe
  C:\Windows\System\wkXelXh.exe
  2⤵
  PID:4628
- C:\Windows\System\IuZHIgi.exe
  C:\Windows\System\IuZHIgi.exe
  2⤵
  PID:4648
- C:\Windows\System\yuylBqO.exe
  C:\Windows\System\yuylBqO.exe
  2⤵
  PID:4692
- C:\Windows\System\BchxjhI.exe
  C:\Windows\System\BchxjhI.exe
  2⤵
  PID:4704
- C:\Windows\System\fgWTnJK.exe
  C:\Windows\System\fgWTnJK.exe
  2⤵
  PID:4748
- C:\Windows\System\cOuJDVb.exe
  C:\Windows\System\cOuJDVb.exe
  2⤵
  PID:4240
- C:\Windows\System\ioLfHiK.exe
  C:\Windows\System\ioLfHiK.exe
  2⤵
  PID:4804
- C:\Windows\System\NOlmvnm.exe
  C:\Windows\System\NOlmvnm.exe
  2⤵
  PID:4836
- C:\Windows\System\PcqwAqh.exe
  C:\Windows\System\PcqwAqh.exe
  2⤵
  PID:4856
- C:\Windows\System\tpYvDtD.exe
  C:\Windows\System\tpYvDtD.exe
  2⤵
  PID:4904
- C:\Windows\System\OVUteil.exe
  C:\Windows\System\OVUteil.exe
  2⤵
  PID:4992
- C:\Windows\System\toQaVvd.exe
  C:\Windows\System\toQaVvd.exe
  2⤵
  PID:5020
- C:\Windows\System\PYuSiZM.exe
  C:\Windows\System\PYuSiZM.exe
  2⤵
  PID:5064
- C:\Windows\System\dYcQQrt.exe
  C:\Windows\System\dYcQQrt.exe
  2⤵
  PID:5080
- C:\Windows\System\kfUSYdV.exe
  C:\Windows\System\kfUSYdV.exe
  2⤵
  PID:5116
- C:\Windows\System\qmOASgd.exe
  C:\Windows\System\qmOASgd.exe
  2⤵
  PID:3788
- C:\Windows\System\PZxHTEb.exe
  C:\Windows\System\PZxHTEb.exe
  2⤵
  PID:4108
- C:\Windows\System\wFYyovX.exe
  C:\Windows\System\wFYyovX.exe
  2⤵
  PID:4196
- C:\Windows\System\FBdAHeT.exe
  C:\Windows\System\FBdAHeT.exe
  2⤵
  PID:4160
- C:\Windows\System\teKciXP.exe
  C:\Windows\System\teKciXP.exe
  2⤵
  PID:4260
- C:\Windows\System\pKTuRAU.exe
  C:\Windows\System\pKTuRAU.exe
  2⤵
  PID:4292
- C:\Windows\System\HwHdrHm.exe
  C:\Windows\System\HwHdrHm.exe
  2⤵
  PID:4332
- C:\Windows\System\FBExnJv.exe
  C:\Windows\System\FBExnJv.exe
  2⤵
  PID:4388
- C:\Windows\System\cMjOVms.exe
  C:\Windows\System\cMjOVms.exe
  2⤵
  PID:4436
- C:\Windows\System\sdiKdZu.exe
  C:\Windows\System\sdiKdZu.exe
  2⤵
  PID:4456
- C:\Windows\System\OUjqrRT.exe
  C:\Windows\System\OUjqrRT.exe
  2⤵
  PID:4508
- C:\Windows\System\QlIeBie.exe
  C:\Windows\System\QlIeBie.exe
  2⤵
  PID:4560
- C:\Windows\System\EPgXWOG.exe
  C:\Windows\System\EPgXWOG.exe
  2⤵
  PID:4620
- C:\Windows\System\TiLynlK.exe
  C:\Windows\System\TiLynlK.exe
  2⤵
  PID:4724
- C:\Windows\System\UTYbXvE.exe
  C:\Windows\System\UTYbXvE.exe
  2⤵
  PID:4440
- C:\Windows\System\fojYupU.exe
  C:\Windows\System\fojYupU.exe
  2⤵
  PID:4808
- C:\Windows\System\mkKLolC.exe
  C:\Windows\System\mkKLolC.exe
  2⤵
  PID:4872
- C:\Windows\System\mtlRBdy.exe
  C:\Windows\System\mtlRBdy.exe
  2⤵
  PID:4884
- C:\Windows\System\LOWoGET.exe
  C:\Windows\System\LOWoGET.exe
  2⤵
  PID:4944
- C:\Windows\System\VqobnNv.exe
  C:\Windows\System\VqobnNv.exe
  2⤵
  PID:4984
- C:\Windows\System\ZXwOMKH.exe
  C:\Windows\System\ZXwOMKH.exe
  2⤵
  PID:4224
- C:\Windows\System\WOjFghz.exe
  C:\Windows\System\WOjFghz.exe
  2⤵
  PID:4104
- C:\Windows\System\zVVLtri.exe
  C:\Windows\System\zVVLtri.exe
  2⤵
  PID:4312
- C:\Windows\System\JTBbmNK.exe
  C:\Windows\System\JTBbmNK.exe
  2⤵
  PID:4392
- C:\Windows\System\GnyuJPs.exe
  C:\Windows\System\GnyuJPs.exe
  2⤵
  PID:4568
- C:\Windows\System\BTFmdYF.exe
  C:\Windows\System\BTFmdYF.exe
  2⤵
  PID:4604
- C:\Windows\System\sAckjRC.exe
  C:\Windows\System\sAckjRC.exe
  2⤵
  PID:4728
- C:\Windows\System\KCOxwgu.exe
  C:\Windows\System\KCOxwgu.exe
  2⤵
  PID:4776
- C:\Windows\System\YHopaik.exe
  C:\Windows\System\YHopaik.exe
  2⤵
  PID:4916
- C:\Windows\System\pTOjRwU.exe
  C:\Windows\System\pTOjRwU.exe
  2⤵
  PID:4952
- C:\Windows\System\LnOifVX.exe
  C:\Windows\System\LnOifVX.exe
  2⤵
  PID:5044
- C:\Windows\System\FvUGLuB.exe
  C:\Windows\System\FvUGLuB.exe
  2⤵
  PID:5100
- C:\Windows\System\vEXuIaj.exe
  C:\Windows\System\vEXuIaj.exe
  2⤵
  PID:4176
- C:\Windows\System\lAYFKxJ.exe
  C:\Windows\System\lAYFKxJ.exe
  2⤵
  PID:4424
- C:\Windows\System\jCIyIGM.exe
  C:\Windows\System\jCIyIGM.exe
  2⤵
  PID:4464
- C:\Windows\System\ltfSBeA.exe
  C:\Windows\System\ltfSBeA.exe
  2⤵
  PID:4652
- C:\Windows\System\IrAppsd.exe
  C:\Windows\System\IrAppsd.exe
  2⤵
  PID:4252
- C:\Windows\System\IzjGYPX.exe
  C:\Windows\System\IzjGYPX.exe
  2⤵
  PID:4256
- C:\Windows\System\rVhZkkt.exe
  C:\Windows\System\rVhZkkt.exe
  2⤵
  PID:4540
- C:\Windows\System\IWXVpMp.exe
  C:\Windows\System\IWXVpMp.exe
  2⤵
  PID:4852
- C:\Windows\System\CsJZrOL.exe
  C:\Windows\System\CsJZrOL.exe
  2⤵
  PID:5024
- C:\Windows\System\loBGwnK.exe
  C:\Windows\System\loBGwnK.exe
  2⤵
  PID:4376
- C:\Windows\System\AZHxMBy.exe
  C:\Windows\System\AZHxMBy.exe
  2⤵
  PID:5124
- C:\Windows\System\tbhXuPe.exe
  C:\Windows\System\tbhXuPe.exe
  2⤵
  PID:5140
- C:\Windows\System\MNycrRr.exe
  C:\Windows\System\MNycrRr.exe
  2⤵
  PID:5156
- C:\Windows\System\vkgySga.exe
  C:\Windows\System\vkgySga.exe
  2⤵
  PID:5176
- C:\Windows\System\QXaqHDH.exe
  C:\Windows\System\QXaqHDH.exe
  2⤵
  PID:5192
- C:\Windows\System\mRKEChv.exe
  C:\Windows\System\mRKEChv.exe
  2⤵
  PID:5208
- C:\Windows\System\qGclbet.exe
  C:\Windows\System\qGclbet.exe
  2⤵
  PID:5224
- C:\Windows\System\JBogSKV.exe
  C:\Windows\System\JBogSKV.exe
  2⤵
  PID:5244
- C:\Windows\System\wfSKQFw.exe
  C:\Windows\System\wfSKQFw.exe
  2⤵
  PID:5260
- C:\Windows\System\udZkYCT.exe
  C:\Windows\System\udZkYCT.exe
  2⤵
  PID:5276
- C:\Windows\System\ojDdqMD.exe
  C:\Windows\System\ojDdqMD.exe
  2⤵
  PID:5292
- C:\Windows\System\BKqoJEF.exe
  C:\Windows\System\BKqoJEF.exe
  2⤵
  PID:5364
- C:\Windows\System\jSpcnLH.exe
  C:\Windows\System\jSpcnLH.exe
  2⤵
  PID:5384
- C:\Windows\System\PlZszzc.exe
  C:\Windows\System\PlZszzc.exe
  2⤵
  PID:5404
- C:\Windows\System\nqhBwjJ.exe
  C:\Windows\System\nqhBwjJ.exe
  2⤵
  PID:5424
- C:\Windows\System\XPGRfoU.exe
  C:\Windows\System\XPGRfoU.exe
  2⤵
  PID:5440
- C:\Windows\System\pnTvkIo.exe
  C:\Windows\System\pnTvkIo.exe
  2⤵
  PID:5456
- C:\Windows\System\zElqMqh.exe
  C:\Windows\System\zElqMqh.exe
  2⤵
  PID:5472
- C:\Windows\System\qeiQkuh.exe
  C:\Windows\System\qeiQkuh.exe
  2⤵
  PID:5488
- C:\Windows\System\DwcfBfy.exe
  C:\Windows\System\DwcfBfy.exe
  2⤵
  PID:5504
- C:\Windows\System\cgExXif.exe
  C:\Windows\System\cgExXif.exe
  2⤵
  PID:5520
- C:\Windows\System\tlZcaYu.exe
  C:\Windows\System\tlZcaYu.exe
  2⤵
  PID:5544
- C:\Windows\System\vMTqRqY.exe
  C:\Windows\System\vMTqRqY.exe
  2⤵
  PID:5560
- C:\Windows\System\xLVKKSK.exe
  C:\Windows\System\xLVKKSK.exe
  2⤵
  PID:5584
- C:\Windows\System\JGffJIs.exe
  C:\Windows\System\JGffJIs.exe
  2⤵
  PID:5600
- C:\Windows\System\FONWCHC.exe
  C:\Windows\System\FONWCHC.exe
  2⤵
  PID:5628
- C:\Windows\System\tlRnSIL.exe
  C:\Windows\System\tlRnSIL.exe
  2⤵
  PID:5644
- C:\Windows\System\MGBVRgZ.exe
  C:\Windows\System\MGBVRgZ.exe
  2⤵
  PID:5660
- C:\Windows\System\aBDVYAc.exe
  C:\Windows\System\aBDVYAc.exe
  2⤵
  PID:5708
- C:\Windows\System\lUuoufu.exe
  C:\Windows\System\lUuoufu.exe
  2⤵
  PID:5728
- C:\Windows\System\TDOshIS.exe
  C:\Windows\System\TDOshIS.exe
  2⤵
  PID:5744
- C:\Windows\System\GZBdqHc.exe
  C:\Windows\System\GZBdqHc.exe
  2⤵
  PID:5764
- C:\Windows\System\yoTulaO.exe
  C:\Windows\System\yoTulaO.exe
  2⤵
  PID:5780
- C:\Windows\System\pNetjOj.exe
  C:\Windows\System\pNetjOj.exe
  2⤵
  PID:5796
- C:\Windows\System\yVEWTnc.exe
  C:\Windows\System\yVEWTnc.exe
  2⤵
  PID:5812
- C:\Windows\System\JFMWURL.exe
  C:\Windows\System\JFMWURL.exe
  2⤵
  PID:5832
- C:\Windows\System\SaPNGch.exe
  C:\Windows\System\SaPNGch.exe
  2⤵
  PID:5848
- C:\Windows\System\mLMkTQV.exe
  C:\Windows\System\mLMkTQV.exe
  2⤵
  PID:5868
- C:\Windows\System\luKVuye.exe
  C:\Windows\System\luKVuye.exe
  2⤵
  PID:5888
- C:\Windows\System\jRNfIJe.exe
  C:\Windows\System\jRNfIJe.exe
  2⤵
  PID:5908
- C:\Windows\System\gqFTHuZ.exe
  C:\Windows\System\gqFTHuZ.exe
  2⤵
  PID:5956
- C:\Windows\System\MYRRWwH.exe
  C:\Windows\System\MYRRWwH.exe
  2⤵
  PID:5972
- C:\Windows\System\aTaTvvz.exe
  C:\Windows\System\aTaTvvz.exe
  2⤵
  PID:5996
- C:\Windows\System\kelcfHc.exe
  C:\Windows\System\kelcfHc.exe
  2⤵
  PID:6012
- C:\Windows\System\QBkLgfj.exe
  C:\Windows\System\QBkLgfj.exe
  2⤵
  PID:6036
- C:\Windows\System\yjeAnWQ.exe
  C:\Windows\System\yjeAnWQ.exe
  2⤵
  PID:6080
- C:\Windows\System\IYSmskQ.exe
  C:\Windows\System\IYSmskQ.exe
  2⤵
  PID:6096
- C:\Windows\System\XnNBTot.exe
  C:\Windows\System\XnNBTot.exe
  2⤵
  PID:6112
- C:\Windows\System\CKMuUCp.exe
  C:\Windows\System\CKMuUCp.exe
  2⤵
  PID:6128
- C:\Windows\System\ppSGdma.exe
  C:\Windows\System\ppSGdma.exe
  2⤵
  PID:4768
- C:\Windows\System\JcFTPIb.exe
  C:\Windows\System\JcFTPIb.exe
  2⤵
  PID:5168
- C:\Windows\System\iiAFmPD.exe
  C:\Windows\System\iiAFmPD.exe
  2⤵
  PID:5184
- C:\Windows\System\NBDCzbj.exe
  C:\Windows\System\NBDCzbj.exe
  2⤵
  PID:5272
- C:\Windows\System\MBmRMPw.exe
  C:\Windows\System\MBmRMPw.exe
  2⤵
  PID:5324
- C:\Windows\System\cgtjMcF.exe
  C:\Windows\System\cgtjMcF.exe
  2⤵
  PID:5300
- C:\Windows\System\PsCQGvn.exe
  C:\Windows\System\PsCQGvn.exe
  2⤵
  PID:5328
- C:\Windows\System\UqmKfbp.exe
  C:\Windows\System\UqmKfbp.exe
  2⤵
  PID:5344
- C:\Windows\System\ppJKEGO.exe
  C:\Windows\System\ppJKEGO.exe
  2⤵
  PID:5284
- C:\Windows\System\ajwmZvk.exe
  C:\Windows\System\ajwmZvk.exe
  2⤵
  PID:4416
- C:\Windows\System\JRygEKz.exe
  C:\Windows\System\JRygEKz.exe
  2⤵
  PID:5392
- C:\Windows\System\LyAezvo.exe
  C:\Windows\System\LyAezvo.exe
  2⤵
  PID:5252
- C:\Windows\System\tElweaU.exe
  C:\Windows\System\tElweaU.exe
  2⤵
  PID:5400
- C:\Windows\System\uvMzhwh.exe
  C:\Windows\System\uvMzhwh.exe
  2⤵
  PID:5436
- C:\Windows\System\SGdGlMG.exe
  C:\Windows\System\SGdGlMG.exe
  2⤵
  PID:5532
- C:\Windows\System\LDsqWEP.exe
  C:\Windows\System\LDsqWEP.exe
  2⤵
  PID:5624
- C:\Windows\System\ITbSXEo.exe
  C:\Windows\System\ITbSXEo.exe
  2⤵
  PID:5620
- C:\Windows\System\rOBCxqZ.exe
  C:\Windows\System\rOBCxqZ.exe
  2⤵
  PID:5552
- C:\Windows\System\mahCZJt.exe
  C:\Windows\System\mahCZJt.exe
  2⤵
  PID:5636
- C:\Windows\System\FRQqmYv.exe
  C:\Windows\System\FRQqmYv.exe
  2⤵
  PID:5676
- C:\Windows\System\PNnchGG.exe
  C:\Windows\System\PNnchGG.exe
  2⤵
  PID:5840
- C:\Windows\System\oyivySP.exe
  C:\Windows\System\oyivySP.exe
  2⤵
  PID:5884
- C:\Windows\System\iRYCLBx.exe
  C:\Windows\System\iRYCLBx.exe
  2⤵
  PID:5896
- C:\Windows\System\VSPZCPm.exe
  C:\Windows\System\VSPZCPm.exe
  2⤵
  PID:5920
- C:\Windows\System\ptndrQO.exe
  C:\Windows\System\ptndrQO.exe
  2⤵
  PID:5932
- C:\Windows\System\oMCsYfZ.exe
  C:\Windows\System\oMCsYfZ.exe
  2⤵
  PID:5944
- C:\Windows\System\eoxmVCh.exe
  C:\Windows\System\eoxmVCh.exe
  2⤵
  PID:5984
- C:\Windows\System\JSYgxTx.exe
  C:\Windows\System\JSYgxTx.exe
  2⤵
  PID:6048
- C:\Windows\System\hRZEBMS.exe
  C:\Windows\System\hRZEBMS.exe
  2⤵
  PID:6024
- C:\Windows\System\vDBlKhF.exe
  C:\Windows\System\vDBlKhF.exe
  2⤵
  PID:6060
- C:\Windows\System\gQLZdvC.exe
  C:\Windows\System\gQLZdvC.exe
  2⤵
  PID:5232
- C:\Windows\System\VSrWRLF.exe
  C:\Windows\System\VSrWRLF.exe
  2⤵
  PID:6136
- C:\Windows\System\rfxVLtG.exe
  C:\Windows\System\rfxVLtG.exe
  2⤵
  PID:5092
- C:\Windows\System\gteaKwH.exe
  C:\Windows\System\gteaKwH.exe
  2⤵
  PID:4624
- C:\Windows\System\hzGJZUy.exe
  C:\Windows\System\hzGJZUy.exe
  2⤵
  PID:5304
- C:\Windows\System\KjULbHB.exe
  C:\Windows\System\KjULbHB.exe
  2⤵
  PID:5468
- C:\Windows\System\moToWfT.exe
  C:\Windows\System\moToWfT.exe
  2⤵
  PID:4816
- C:\Windows\System\CSfWNfd.exe
  C:\Windows\System\CSfWNfd.exe
  2⤵
  PID:5484
- C:\Windows\System\bjHNwQt.exe
  C:\Windows\System\bjHNwQt.exe
  2⤵
  PID:5500
- C:\Windows\System\LdHGVsN.exe
  C:\Windows\System\LdHGVsN.exe
  2⤵
  PID:5616
- C:\Windows\System\gIlBrtk.exe
  C:\Windows\System\gIlBrtk.exe
  2⤵
  PID:5596
- C:\Windows\System\xqVCFBX.exe
  C:\Windows\System\xqVCFBX.exe
  2⤵
  PID:5612
- C:\Windows\System\ByGZNGk.exe
  C:\Windows\System\ByGZNGk.exe
  2⤵
  PID:5668
- C:\Windows\System\DaOvFEb.exe
  C:\Windows\System\DaOvFEb.exe
  2⤵
  PID:5704
- C:\Windows\System\uSvzElt.exe
  C:\Windows\System\uSvzElt.exe
  2⤵
  PID:5756
- C:\Windows\System\MvVHVnd.exe
  C:\Windows\System\MvVHVnd.exe
  2⤵
  PID:5876
- C:\Windows\System\hAyCbau.exe
  C:\Windows\System\hAyCbau.exe
  2⤵
  PID:5864
- C:\Windows\System\KTVpqTQ.exe
  C:\Windows\System\KTVpqTQ.exe
  2⤵
  PID:5980
- C:\Windows\System\dJgQaEK.exe
  C:\Windows\System\dJgQaEK.exe
  2⤵
  PID:6068
- C:\Windows\System\tNSAzNa.exe
  C:\Windows\System\tNSAzNa.exe
  2⤵
  PID:5968
- C:\Windows\System\ZIpnCju.exe
  C:\Windows\System\ZIpnCju.exe
  2⤵
  PID:6052
- C:\Windows\System\KevnVsJ.exe
  C:\Windows\System\KevnVsJ.exe
  2⤵
  PID:6124
- C:\Windows\System\dUxOZbp.exe
  C:\Windows\System\dUxOZbp.exe
  2⤵
  PID:6104
- C:\Windows\System\voTVpaH.exe
  C:\Windows\System\voTVpaH.exe
  2⤵
  PID:5352
- C:\Windows\System\BMzZKsu.exe
  C:\Windows\System\BMzZKsu.exe
  2⤵
  PID:4572
- C:\Windows\System\MIypzfT.exe
  C:\Windows\System\MIypzfT.exe
  2⤵
  PID:5288
- C:\Windows\System\OOFkmZt.exe
  C:\Windows\System\OOFkmZt.exe
  2⤵
  PID:4120
- C:\Windows\System\EFWfwQn.exe
  C:\Windows\System\EFWfwQn.exe
  2⤵
  PID:5420
- C:\Windows\System\jzWtLEA.exe
  C:\Windows\System\jzWtLEA.exe
  2⤵
  PID:5720
- C:\Windows\System\ixSQvMu.exe
  C:\Windows\System\ixSQvMu.exe
  2⤵
  PID:5136
- C:\Windows\System\kRZTroF.exe
  C:\Windows\System\kRZTroF.exe
  2⤵
  PID:5692
- C:\Windows\System\mIiDxnp.exe
  C:\Windows\System\mIiDxnp.exe
  2⤵
  PID:5860
- C:\Windows\System\OKjOghZ.exe
  C:\Windows\System\OKjOghZ.exe
  2⤵
  PID:6088
- C:\Windows\System\lyxrHcf.exe
  C:\Windows\System\lyxrHcf.exe
  2⤵
  PID:5236
- C:\Windows\System\KYTJmZh.exe
  C:\Windows\System\KYTJmZh.exe
  2⤵
  PID:5372
- C:\Windows\System\PCDQKjq.exe
  C:\Windows\System\PCDQKjq.exe
  2⤵
  PID:5480
- C:\Windows\System\eiaPUdz.exe
  C:\Windows\System\eiaPUdz.exe
  2⤵
  PID:5716
- C:\Windows\System\WPlWTrd.exe
  C:\Windows\System\WPlWTrd.exe
  2⤵
  PID:5792
- C:\Windows\System\LmhTvkW.exe
  C:\Windows\System\LmhTvkW.exe
  2⤵
  PID:5580
- C:\Windows\System\iQftELg.exe
  C:\Windows\System\iQftELg.exe
  2⤵
  PID:5416
- C:\Windows\System\WTLbtBC.exe
  C:\Windows\System\WTLbtBC.exe
  2⤵
  PID:5820
- C:\Windows\System\uUplYgi.exe
  C:\Windows\System\uUplYgi.exe
  2⤵
  PID:5952
- C:\Windows\System\MlDkBIz.exe
  C:\Windows\System\MlDkBIz.exe
  2⤵
  PID:4928
- C:\Windows\System\ItduTGC.exe
  C:\Windows\System\ItduTGC.exe
  2⤵
  PID:328
- C:\Windows\System\CLFfhPh.exe
  C:\Windows\System\CLFfhPh.exe
  2⤵
  PID:6152
- C:\Windows\System\SXQwTso.exe
  C:\Windows\System\SXQwTso.exe
  2⤵
  PID:6208
- C:\Windows\System\FpwHtlq.exe
  C:\Windows\System\FpwHtlq.exe
  2⤵
  PID:6224
- C:\Windows\System\pPbTgRq.exe
  C:\Windows\System\pPbTgRq.exe
  2⤵
  PID:6240
- C:\Windows\System\LimhkYm.exe
  C:\Windows\System\LimhkYm.exe
  2⤵
  PID:6256
- C:\Windows\System\BjSfqMz.exe
  C:\Windows\System\BjSfqMz.exe
  2⤵
  PID:6272
- C:\Windows\System\pfMSQbU.exe
  C:\Windows\System\pfMSQbU.exe
  2⤵
  PID:6292
- C:\Windows\System\OVyoagT.exe
  C:\Windows\System\OVyoagT.exe
  2⤵
  PID:6308
- C:\Windows\System\HhZQdcM.exe
  C:\Windows\System\HhZQdcM.exe
  2⤵
  PID:6328
- C:\Windows\System\ZPNHtCa.exe
  C:\Windows\System\ZPNHtCa.exe
  2⤵
  PID:6344
- C:\Windows\System\gQmofXQ.exe
  C:\Windows\System\gQmofXQ.exe
  2⤵
  PID:6364
- C:\Windows\System\eGcBJgr.exe
  C:\Windows\System\eGcBJgr.exe
  2⤵
  PID:6380
- C:\Windows\System\UuUXlBc.exe
  C:\Windows\System\UuUXlBc.exe
  2⤵
  PID:6396
- C:\Windows\System\qPDXzYU.exe
  C:\Windows\System\qPDXzYU.exe
  2⤵
  PID:6444
- C:\Windows\System\OdZLTsb.exe
  C:\Windows\System\OdZLTsb.exe
  2⤵
  PID:6460
- C:\Windows\System\kkzqwqz.exe
  C:\Windows\System\kkzqwqz.exe
  2⤵
  PID:6476
- C:\Windows\System\JewdhGw.exe
  C:\Windows\System\JewdhGw.exe
  2⤵
  PID:6492
- C:\Windows\System\tmOCflJ.exe
  C:\Windows\System\tmOCflJ.exe
  2⤵
  PID:6508
- C:\Windows\System\PWjupJr.exe
  C:\Windows\System\PWjupJr.exe
  2⤵
  PID:6528
- C:\Windows\System\lgZqtVT.exe
  C:\Windows\System\lgZqtVT.exe
  2⤵
  PID:6548
- C:\Windows\System\dYuoVpb.exe
  C:\Windows\System\dYuoVpb.exe
  2⤵
  PID:6564
- C:\Windows\System\WfhtYnJ.exe
  C:\Windows\System\WfhtYnJ.exe
  2⤵
  PID:6580
- C:\Windows\System\OWSMGKx.exe
  C:\Windows\System\OWSMGKx.exe
  2⤵
  PID:6596
- C:\Windows\System\qzHOPbu.exe
  C:\Windows\System\qzHOPbu.exe
  2⤵
  PID:6612
- C:\Windows\System\zLrAtnv.exe
  C:\Windows\System\zLrAtnv.exe
  2⤵
  PID:6628
- C:\Windows\System\GnXHLTO.exe
  C:\Windows\System\GnXHLTO.exe
  2⤵
  PID:6648
- C:\Windows\System\MWzkNmH.exe
  C:\Windows\System\MWzkNmH.exe
  2⤵
  PID:6664
- C:\Windows\System\QkLzahH.exe
  C:\Windows\System\QkLzahH.exe
  2⤵
  PID:6680
- C:\Windows\System\mRmyNDv.exe
  C:\Windows\System\mRmyNDv.exe
  2⤵
  PID:6696
- C:\Windows\System\NnhFYBB.exe
  C:\Windows\System\NnhFYBB.exe
  2⤵
  PID:6712
- C:\Windows\System\euBBceX.exe
  C:\Windows\System\euBBceX.exe
  2⤵
  PID:6728
- C:\Windows\System\dwnQeCj.exe
  C:\Windows\System\dwnQeCj.exe
  2⤵
  PID:6752
- C:\Windows\System\cjLXmKR.exe
  C:\Windows\System\cjLXmKR.exe
  2⤵
  PID:6768
- C:\Windows\System\rfxajGI.exe
  C:\Windows\System\rfxajGI.exe
  2⤵
  PID:6784
- C:\Windows\System\HypkIUn.exe
  C:\Windows\System\HypkIUn.exe
  2⤵
  PID:6800
- C:\Windows\System\kvYkmdb.exe
  C:\Windows\System\kvYkmdb.exe
  2⤵
  PID:6816
- C:\Windows\System\QdMXiQT.exe
  C:\Windows\System\QdMXiQT.exe
  2⤵
  PID:6832
- C:\Windows\System\EMgceBH.exe
  C:\Windows\System\EMgceBH.exe
  2⤵
  PID:6848
- C:\Windows\System\XtQtKZO.exe
  C:\Windows\System\XtQtKZO.exe
  2⤵
  PID:6864
- C:\Windows\System\AnWOdDv.exe
  C:\Windows\System\AnWOdDv.exe
  2⤵
  PID:6880
- C:\Windows\System\srlZsnf.exe
  C:\Windows\System\srlZsnf.exe
  2⤵
  PID:6896
- C:\Windows\System\NOKXYWS.exe
  C:\Windows\System\NOKXYWS.exe
  2⤵
  PID:6912
- C:\Windows\System\FUxzvmF.exe
  C:\Windows\System\FUxzvmF.exe
  2⤵
  PID:6928
- C:\Windows\System\wSKGFDt.exe
  C:\Windows\System\wSKGFDt.exe
  2⤵
  PID:6944
- C:\Windows\System\joXJWzN.exe
  C:\Windows\System\joXJWzN.exe
  2⤵
  PID:6960
- C:\Windows\System\GcsyNts.exe
  C:\Windows\System\GcsyNts.exe
  2⤵
  PID:6976
- C:\Windows\System\HUYZyZE.exe
  C:\Windows\System\HUYZyZE.exe
  2⤵
  PID:6992
- C:\Windows\System\DtYPUFb.exe
  C:\Windows\System\DtYPUFb.exe
  2⤵
  PID:7008
- C:\Windows\System\erqnzHF.exe
  C:\Windows\System\erqnzHF.exe
  2⤵
  PID:7024
- C:\Windows\System\kNgGIfW.exe
  C:\Windows\System\kNgGIfW.exe
  2⤵
  PID:7040
- C:\Windows\System\emZqRhi.exe
  C:\Windows\System\emZqRhi.exe
  2⤵
  PID:7056
- C:\Windows\System\dhWUuYz.exe
  C:\Windows\System\dhWUuYz.exe
  2⤵
  PID:7072
- C:\Windows\System\OrjXwlA.exe
  C:\Windows\System\OrjXwlA.exe
  2⤵
  PID:7088
- C:\Windows\System\cRAnGJp.exe
  C:\Windows\System\cRAnGJp.exe
  2⤵
  PID:7104
- C:\Windows\System\ezydkbA.exe
  C:\Windows\System\ezydkbA.exe
  2⤵
  PID:7120
- C:\Windows\System\xzoUslc.exe
  C:\Windows\System\xzoUslc.exe
  2⤵
  PID:7136
- C:\Windows\System\oqbTbtF.exe
  C:\Windows\System\oqbTbtF.exe
  2⤵
  PID:7152
- C:\Windows\System\uhFoMuI.exe
  C:\Windows\System\uhFoMuI.exe
  2⤵
  PID:5464
- C:\Windows\System\rBOQuBs.exe
  C:\Windows\System\rBOQuBs.exe
  2⤵
  PID:5516
- C:\Windows\System\kQdMRBR.exe
  C:\Windows\System\kQdMRBR.exe
  2⤵
  PID:6004
- C:\Windows\System\tFBAzUE.exe
  C:\Windows\System\tFBAzUE.exe
  2⤵
  PID:5340
- C:\Windows\System\BBasYAf.exe
  C:\Windows\System\BBasYAf.exe
  2⤵
  PID:5992
- C:\Windows\System\VxIbegI.exe
  C:\Windows\System\VxIbegI.exe
  2⤵
  PID:6168
- C:\Windows\System\PdgiDhf.exe
  C:\Windows\System\PdgiDhf.exe
  2⤵
  PID:6184
- C:\Windows\System\BNTXaCQ.exe
  C:\Windows\System\BNTXaCQ.exe
  2⤵
  PID:6200
- C:\Windows\System\vczIXjV.exe
  C:\Windows\System\vczIXjV.exe
  2⤵
  PID:6280
- C:\Windows\System\LwdMSXo.exe
  C:\Windows\System\LwdMSXo.exe
  2⤵
  PID:6324
- C:\Windows\System\rvtAnsk.exe
  C:\Windows\System\rvtAnsk.exe
  2⤵
  PID:6360
- C:\Windows\System\VACIbJF.exe
  C:\Windows\System\VACIbJF.exe
  2⤵
  PID:6300
- C:\Windows\System\VtKzZXH.exe
  C:\Windows\System\VtKzZXH.exe
  2⤵
  PID:6440
- C:\Windows\System\dnpUaNV.exe
  C:\Windows\System\dnpUaNV.exe
  2⤵
  PID:6372
- C:\Windows\System\VmRRaOQ.exe
  C:\Windows\System\VmRRaOQ.exe
  2⤵
  PID:6432
- C:\Windows\System\PctHiNe.exe
  C:\Windows\System\PctHiNe.exe
  2⤵
  PID:6416
- C:\Windows\System\zVtxhTN.exe
  C:\Windows\System\zVtxhTN.exe
  2⤵
  PID:6456
- C:\Windows\System\fIWbQga.exe
  C:\Windows\System\fIWbQga.exe
  2⤵
  PID:6504
- C:\Windows\System\OPmUtZl.exe
  C:\Windows\System\OPmUtZl.exe
  2⤵
  PID:6560
- C:\Windows\System\DKfrvAP.exe
  C:\Windows\System\DKfrvAP.exe
  2⤵
  PID:6624
- C:\Windows\System\cmkwXuF.exe
  C:\Windows\System\cmkwXuF.exe
  2⤵
  PID:6720
- C:\Windows\System\yJvOXDB.exe
  C:\Windows\System\yJvOXDB.exe
  2⤵
  PID:6708
- C:\Windows\System\FBVTndE.exe
  C:\Windows\System\FBVTndE.exe
  2⤵
  PID:6644
- C:\Windows\System\StyJdfA.exe
  C:\Windows\System\StyJdfA.exe
  2⤵
  PID:6572
- C:\Windows\System\cCAAKOS.exe
  C:\Windows\System\cCAAKOS.exe
  2⤵
  PID:6796
- C:\Windows\System\VBqAVXY.exe
  C:\Windows\System\VBqAVXY.exe
  2⤵
  PID:6860
- C:\Windows\System\SlItAca.exe
  C:\Windows\System\SlItAca.exe
  2⤵
  PID:6888
- C:\Windows\System\DmqqIwU.exe
  C:\Windows\System\DmqqIwU.exe
  2⤵
  PID:6936
- C:\Windows\System\ETROBah.exe
  C:\Windows\System\ETROBah.exe
  2⤵
  PID:6968
- C:\Windows\System\MaZYjZW.exe
  C:\Windows\System\MaZYjZW.exe
  2⤵
  PID:7004
- C:\Windows\System\tDeCWyE.exe
  C:\Windows\System\tDeCWyE.exe
  2⤵
  PID:7036
- C:\Windows\System\WshIqra.exe
  C:\Windows\System\WshIqra.exe
  2⤵
  PID:5152
- C:\Windows\System\JnxHAgM.exe
  C:\Windows\System\JnxHAgM.exe
  2⤵
  PID:7080
- C:\Windows\System\ymBqCZa.exe
  C:\Windows\System\ymBqCZa.exe
  2⤵
  PID:7112
- C:\Windows\System\NXygnmn.exe
  C:\Windows\System\NXygnmn.exe
  2⤵
  PID:7096
- C:\Windows\System\OpLzsph.exe
  C:\Windows\System\OpLzsph.exe
  2⤵
  PID:7164
- C:\Windows\System\UHcqRGa.exe
  C:\Windows\System\UHcqRGa.exe
  2⤵
  PID:5776
- C:\Windows\System\bQZClhX.exe
  C:\Windows\System\bQZClhX.exe
  2⤵
  PID:6160
- C:\Windows\System\GRXpSDK.exe
  C:\Windows\System\GRXpSDK.exe
  2⤵
  PID:6268
- C:\Windows\System\jrvCQEH.exe
  C:\Windows\System\jrvCQEH.exe
  2⤵
  PID:6176
- C:\Windows\System\xosqKyn.exe
  C:\Windows\System\xosqKyn.exe
  2⤵
  PID:6316
- C:\Windows\System\VoQdrGh.exe
  C:\Windows\System\VoQdrGh.exe
  2⤵
  PID:6236
- C:\Windows\System\THSdEJB.exe
  C:\Windows\System\THSdEJB.exe
  2⤵
  PID:6484
- C:\Windows\System\chAvnLM.exe
  C:\Windows\System\chAvnLM.exe
  2⤵
  PID:6500
- C:\Windows\System\JEpRsqM.exe
  C:\Windows\System\JEpRsqM.exe
  2⤵
  PID:6452
- C:\Windows\System\RuBPeXQ.exe
  C:\Windows\System\RuBPeXQ.exe
  2⤵
  PID:6524
- C:\Windows\System\sjHKOZs.exe
  C:\Windows\System\sjHKOZs.exe
  2⤵
  PID:6744
- C:\Windows\System\leNJfqR.exe
  C:\Windows\System\leNJfqR.exe
  2⤵
  PID:6604
- C:\Windows\System\HiErsWM.exe
  C:\Windows\System\HiErsWM.exe
  2⤵
  PID:6640
- C:\Windows\System\SxuEfhZ.exe
  C:\Windows\System\SxuEfhZ.exe
  2⤵
  PID:6776
- C:\Windows\System\jsioVuS.exe
  C:\Windows\System\jsioVuS.exe
  2⤵
  PID:6840
- C:\Windows\System\WzERsfX.exe
  C:\Windows\System\WzERsfX.exe
  2⤵
  PID:6924
- C:\Windows\System\kaIrGve.exe
  C:\Windows\System\kaIrGve.exe
  2⤵
  PID:6764
- C:\Windows\System\mCMTumh.exe
  C:\Windows\System\mCMTumh.exe
  2⤵
  PID:6808
- C:\Windows\System\LwLqXae.exe
  C:\Windows\System\LwLqXae.exe
  2⤵
  PID:7148
- C:\Windows\System\XnvJUMM.exe
  C:\Windows\System\XnvJUMM.exe
  2⤵
  PID:7100
- C:\Windows\System\YVWJZFg.exe
  C:\Windows\System\YVWJZFg.exe
  2⤵
  PID:7068
- C:\Windows\System\dATbJDL.exe
  C:\Windows\System\dATbJDL.exe
  2⤵
  PID:7020
- C:\Windows\System\UnVngoA.exe
  C:\Windows\System\UnVngoA.exe
  2⤵
  PID:6196
- C:\Windows\System\ChgPKCX.exe
  C:\Windows\System\ChgPKCX.exe
  2⤵
  PID:6248
- C:\Windows\System\gWQWXTn.exe
  C:\Windows\System\gWQWXTn.exe
  2⤵
  PID:6336
- C:\Windows\System\pemOqDa.exe
  C:\Windows\System\pemOqDa.exe
  2⤵
  PID:6220
- C:\Windows\System\NalclUK.exe
  C:\Windows\System\NalclUK.exe
  2⤵
  PID:6424
- C:\Windows\System\VjAMGTt.exe
  C:\Windows\System\VjAMGTt.exe
  2⤵
  PID:6404
- C:\Windows\System\AbSDRmN.exe
  C:\Windows\System\AbSDRmN.exe
  2⤵
  PID:6692
- C:\Windows\System\oWUQqWi.exe
  C:\Windows\System\oWUQqWi.exe
  2⤵
  PID:6620
- C:\Windows\System\IsLsnJk.exe
  C:\Windows\System\IsLsnJk.exe
  2⤵
  PID:6608
- C:\Windows\System\NAxIHad.exe
  C:\Windows\System\NAxIHad.exe
  2⤵
  PID:6856
- C:\Windows\System\MkghfZf.exe
  C:\Windows\System\MkghfZf.exe
  2⤵
  PID:6812
- C:\Windows\System\ttSjMSY.exe
  C:\Windows\System\ttSjMSY.exe
  2⤵
  PID:5220
- C:\Windows\System\zeNAuAk.exe
  C:\Windows\System\zeNAuAk.exe
  2⤵
  PID:6636
- C:\Windows\System\aYpYkAK.exe
  C:\Windows\System\aYpYkAK.exe
  2⤵
  PID:5752
- C:\Windows\System\PZSAgwp.exe
  C:\Windows\System\PZSAgwp.exe
  2⤵
  PID:7032
- C:\Windows\System\BlncXSm.exe
  C:\Windows\System\BlncXSm.exe
  2⤵
  PID:6288
- C:\Windows\System\jrHHjpz.exe
  C:\Windows\System\jrHHjpz.exe
  2⤵
  PID:6904
- C:\Windows\System\HoqZDao.exe
  C:\Windows\System\HoqZDao.exe
  2⤵
  PID:6148
- C:\Windows\System\ppkmjjf.exe
  C:\Windows\System\ppkmjjf.exe
  2⤵
  PID:7084
- C:\Windows\System\rIxuBgM.exe
  C:\Windows\System\rIxuBgM.exe
  2⤵
  PID:7180
- C:\Windows\System\aWdFojF.exe
  C:\Windows\System\aWdFojF.exe
  2⤵
  PID:7208
- C:\Windows\System\qgJbLlR.exe
  C:\Windows\System\qgJbLlR.exe
  2⤵
  PID:7224
- C:\Windows\System\MXSBWSX.exe
  C:\Windows\System\MXSBWSX.exe
  2⤵
  PID:7272
- C:\Windows\System\CzghMZr.exe
  C:\Windows\System\CzghMZr.exe
  2⤵
  PID:7288
- C:\Windows\System\xvjtuvM.exe
  C:\Windows\System\xvjtuvM.exe
  2⤵
  PID:7304
- C:\Windows\System\KYPWuAt.exe
  C:\Windows\System\KYPWuAt.exe
  2⤵
  PID:7320
- C:\Windows\System\affQVgm.exe
  C:\Windows\System\affQVgm.exe
  2⤵
  PID:7336
- C:\Windows\System\EZIqgTN.exe
  C:\Windows\System\EZIqgTN.exe
  2⤵
  PID:7352
- C:\Windows\System\XNhLdEp.exe
  C:\Windows\System\XNhLdEp.exe
  2⤵
  PID:7368
- C:\Windows\System\vnAbyLx.exe
  C:\Windows\System\vnAbyLx.exe
  2⤵
  PID:7396
- C:\Windows\System\BKeolYV.exe
  C:\Windows\System\BKeolYV.exe
  2⤵
  PID:7468
- C:\Windows\System\VbHufRd.exe
  C:\Windows\System\VbHufRd.exe
  2⤵
  PID:7484
- C:\Windows\System\WiPckQP.exe
  C:\Windows\System\WiPckQP.exe
  2⤵
  PID:7500
- C:\Windows\System\OeoESjF.exe
  C:\Windows\System\OeoESjF.exe
  2⤵
  PID:7520
- C:\Windows\System\WFizWyR.exe
  C:\Windows\System\WFizWyR.exe
  2⤵
  PID:7536
- C:\Windows\System\EFNGLiU.exe
  C:\Windows\System\EFNGLiU.exe
  2⤵
  PID:7552
- C:\Windows\System\oFmtgVG.exe
  C:\Windows\System\oFmtgVG.exe
  2⤵
  PID:7568
- C:\Windows\System\pAVJzCO.exe
  C:\Windows\System\pAVJzCO.exe
  2⤵
  PID:7588
- C:\Windows\System\GjgRewc.exe
  C:\Windows\System\GjgRewc.exe
  2⤵
  PID:7604
- C:\Windows\System\ZYQwOAW.exe
  C:\Windows\System\ZYQwOAW.exe
  2⤵
  PID:7620
- C:\Windows\System\UtuTBdo.exe
  C:\Windows\System\UtuTBdo.exe
  2⤵
  PID:7636
- C:\Windows\System\zYCPFoO.exe
  C:\Windows\System\zYCPFoO.exe
  2⤵
  PID:7652
- C:\Windows\System\sgGnVLt.exe
  C:\Windows\System\sgGnVLt.exe
  2⤵
  PID:7668
- C:\Windows\System\GCEBLKq.exe
  C:\Windows\System\GCEBLKq.exe
  2⤵
  PID:7684
- C:\Windows\System\soNNIwp.exe
  C:\Windows\System\soNNIwp.exe
  2⤵
  PID:7700
- C:\Windows\System\AsfhXNX.exe
  C:\Windows\System\AsfhXNX.exe
  2⤵
  PID:7720
- C:\Windows\System\yuPnukX.exe
  C:\Windows\System\yuPnukX.exe
  2⤵
  PID:7740
- C:\Windows\System\zcxNlZL.exe
  C:\Windows\System\zcxNlZL.exe
  2⤵
  PID:7756
- C:\Windows\System\BPcsKPS.exe
  C:\Windows\System\BPcsKPS.exe
  2⤵
  PID:7772
- C:\Windows\System\NOJibmg.exe
  C:\Windows\System\NOJibmg.exe
  2⤵
  PID:7788
- C:\Windows\System\QJwxxoG.exe
  C:\Windows\System\QJwxxoG.exe
  2⤵
  PID:7808
- C:\Windows\System\gGltHMk.exe
  C:\Windows\System\gGltHMk.exe
  2⤵
  PID:7824
- C:\Windows\System\FKquJaJ.exe
  C:\Windows\System\FKquJaJ.exe
  2⤵
  PID:7840
- C:\Windows\System\KthFHuZ.exe
  C:\Windows\System\KthFHuZ.exe
  2⤵
  PID:7912
- C:\Windows\System\HKCpdkM.exe
  C:\Windows\System\HKCpdkM.exe
  2⤵
  PID:7928
- C:\Windows\System\LtYjGNU.exe
  C:\Windows\System\LtYjGNU.exe
  2⤵
  PID:7944
- C:\Windows\System\lHBHygX.exe
  C:\Windows\System\lHBHygX.exe
  2⤵
  PID:7964
- C:\Windows\System\usPwZjm.exe
  C:\Windows\System\usPwZjm.exe
  2⤵
  PID:7980
- C:\Windows\System\bSuDmNe.exe
  C:\Windows\System\bSuDmNe.exe
  2⤵
  PID:7996
- C:\Windows\System\YwTRQag.exe
  C:\Windows\System\YwTRQag.exe
  2⤵
  PID:8012
- C:\Windows\System\HAMPYnx.exe
  C:\Windows\System\HAMPYnx.exe
  2⤵
  PID:8028
- C:\Windows\System\eoqBhjA.exe
  C:\Windows\System\eoqBhjA.exe
  2⤵
  PID:8044
- C:\Windows\System\zFUByIY.exe
  C:\Windows\System\zFUByIY.exe
  2⤵
  PID:8060
- C:\Windows\System\hVjENwI.exe
  C:\Windows\System\hVjENwI.exe
  2⤵
  PID:8076
- C:\Windows\System\lwobqZV.exe
  C:\Windows\System\lwobqZV.exe
  2⤵
  PID:8092
- C:\Windows\System\nWLSvvt.exe
  C:\Windows\System\nWLSvvt.exe
  2⤵
  PID:8108
- C:\Windows\System\tsClOEh.exe
  C:\Windows\System\tsClOEh.exe
  2⤵
  PID:8124
- C:\Windows\System\XCFYONJ.exe
  C:\Windows\System\XCFYONJ.exe
  2⤵
  PID:8140
- C:\Windows\System\wfxuQvL.exe
  C:\Windows\System\wfxuQvL.exe
  2⤵
  PID:8156
- C:\Windows\System\VXsuyru.exe
  C:\Windows\System\VXsuyru.exe
  2⤵
  PID:8172
- C:\Windows\System\ohmQblg.exe
  C:\Windows\System\ohmQblg.exe
  2⤵
  PID:8188
- C:\Windows\System\upEzyUL.exe
  C:\Windows\System\upEzyUL.exe
  2⤵
  PID:6304
- C:\Windows\System\uNMqtjM.exe
  C:\Windows\System\uNMqtjM.exe
  2⤵
  PID:7248
- C:\Windows\System\KVuEexH.exe
  C:\Windows\System\KVuEexH.exe
  2⤵
  PID:7260
- C:\Windows\System\MEAJUyG.exe
  C:\Windows\System\MEAJUyG.exe
  2⤵
  PID:7284
- C:\Windows\System\PhGkvOl.exe
  C:\Windows\System\PhGkvOl.exe
  2⤵
  PID:7360
- C:\Windows\System\HzfewDN.exe
  C:\Windows\System\HzfewDN.exe
  2⤵
  PID:7404
- C:\Windows\System\rSDqzjk.exe
  C:\Windows\System\rSDqzjk.exe
  2⤵
  PID:7420
- C:\Windows\System\tuseKry.exe
  C:\Windows\System\tuseKry.exe
  2⤵
  PID:7312
- C:\Windows\System\QEvIekX.exe
  C:\Windows\System\QEvIekX.exe
  2⤵
  PID:7348
- C:\Windows\System\BkNagwR.exe
  C:\Windows\System\BkNagwR.exe
  2⤵
  PID:7448
- C:\Windows\System\KTUmbnS.exe
  C:\Windows\System\KTUmbnS.exe
  2⤵
  PID:7388
- C:\Windows\System\qPwQXqW.exe
  C:\Windows\System\qPwQXqW.exe
  2⤵
  PID:7492
- C:\Windows\System\IsZZYWR.exe
  C:\Windows\System\IsZZYWR.exe
  2⤵
  PID:7596
- C:\Windows\System\zTHcNGB.exe
  C:\Windows\System\zTHcNGB.exe
  2⤵
  PID:7580
- C:\Windows\System\cnZgZKy.exe
  C:\Windows\System\cnZgZKy.exe
  2⤵
  PID:7644
- C:\Windows\System\PdulHQO.exe
  C:\Windows\System\PdulHQO.exe
  2⤵
  PID:7532
- C:\Windows\System\NzbmiDM.exe
  C:\Windows\System\NzbmiDM.exe
  2⤵
  PID:7560
- C:\Windows\System\GMkPjcp.exe
  C:\Windows\System\GMkPjcp.exe
  2⤵
  PID:7736
- C:\Windows\System\iEtJVIc.exe
  C:\Windows\System\iEtJVIc.exe
  2⤵
  PID:7716
- C:\Windows\System\hHDDSiK.exe
  C:\Windows\System\hHDDSiK.exe
  2⤵
  PID:7820
- C:\Windows\System\JdMIZie.exe
  C:\Windows\System\JdMIZie.exe
  2⤵
  PID:7696
- C:\Windows\System\BCzqyfm.exe
  C:\Windows\System\BCzqyfm.exe
  2⤵
  PID:7860
- C:\Windows\System\uGyFkuU.exe
  C:\Windows\System\uGyFkuU.exe
  2⤵
  PID:7880
- C:\Windows\System\pzvRhFV.exe
  C:\Windows\System\pzvRhFV.exe
  2⤵
  PID:7900
- C:\Windows\System\JPJmvet.exe
  C:\Windows\System\JPJmvet.exe
  2⤵
  PID:7904
- C:\Windows\System\BLyVZzC.exe
  C:\Windows\System\BLyVZzC.exe
  2⤵
  PID:8004
- C:\Windows\System\xvIgSet.exe
  C:\Windows\System\xvIgSet.exe
  2⤵
  PID:7956
- C:\Windows\System\lttbNSs.exe
  C:\Windows\System\lttbNSs.exe
  2⤵
  PID:7988
- C:\Windows\System\aBzBNFY.exe
  C:\Windows\System\aBzBNFY.exe
  2⤵
  PID:8056
- C:\Windows\System\FNozFsj.exe
  C:\Windows\System\FNozFsj.exe
  2⤵
  PID:8136
- C:\Windows\System\OkiodQo.exe
  C:\Windows\System\OkiodQo.exe
  2⤵
  PID:8148
- C:\Windows\System\SDFowCp.exe
  C:\Windows\System\SDFowCp.exe
  2⤵
  PID:8120
- C:\Windows\System\BFBFpgF.exe
  C:\Windows\System\BFBFpgF.exe
  2⤵
  PID:7512
- C:\Windows\System\CkAvDmb.exe
  C:\Windows\System\CkAvDmb.exe
  2⤵
  PID:7240
- C:\Windows\System\EcmuVXr.exe
  C:\Windows\System\EcmuVXr.exe
  2⤵
  PID:7216
- C:\Windows\System\MYYPUkJ.exe
  C:\Windows\System\MYYPUkJ.exe
  2⤵
  PID:7316
- C:\Windows\System\cpeMaRp.exe
  C:\Windows\System\cpeMaRp.exe
  2⤵
  PID:7576
- C:\Windows\System\LJIgBZc.exe
  C:\Windows\System\LJIgBZc.exe
  2⤵
  PID:7852
- C:\Windows\System\Tomihkd.exe
  C:\Windows\System\Tomihkd.exe
  2⤵
  PID:7328
- C:\Windows\System\KPNlGMF.exe
  C:\Windows\System\KPNlGMF.exe
  2⤵
  PID:7344
- C:\Windows\System\nSwcNsA.exe
  C:\Windows\System\nSwcNsA.exe
  2⤵
  PID:7508
- C:\Windows\System\VQeYRTE.exe
  C:\Windows\System\VQeYRTE.exe
  2⤵
  PID:7628
- C:\Windows\System\KCQpKVh.exe
  C:\Windows\System\KCQpKVh.exe
  2⤵
  PID:7600
- C:\Windows\System\nkgNlKz.exe
  C:\Windows\System\nkgNlKz.exe
  2⤵
  PID:7872
- C:\Windows\System\PHZNZjV.exe
  C:\Windows\System\PHZNZjV.exe
  2⤵
  PID:7960
- C:\Windows\System\yLLtDRd.exe
  C:\Windows\System\yLLtDRd.exe
  2⤵
  PID:8052
- C:\Windows\System\cFMXnBX.exe
  C:\Windows\System\cFMXnBX.exe
  2⤵
  PID:8072
- C:\Windows\System\dmsojAO.exe
  C:\Windows\System\dmsojAO.exe
  2⤵
  PID:7712
- C:\Windows\System\RmJuDMn.exe
  C:\Windows\System\RmJuDMn.exe
  2⤵
  PID:7972
- C:\Windows\System\mpIQYPT.exe
  C:\Windows\System\mpIQYPT.exe
  2⤵
  PID:6828
- C:\Windows\System\SPMZBzU.exe
  C:\Windows\System\SPMZBzU.exe
  2⤵
  PID:8184
- C:\Windows\System\uFxJEnj.exe
  C:\Windows\System\uFxJEnj.exe
  2⤵
  PID:7376
- C:\Windows\System\IGVhuYI.exe
  C:\Windows\System\IGVhuYI.exe
  2⤵
  PID:7268
- C:\Windows\System\TnukjET.exe
  C:\Windows\System\TnukjET.exe
  2⤵
  PID:7836
- C:\Windows\System\ZVOTfQK.exe
  C:\Windows\System\ZVOTfQK.exe
  2⤵
  PID:7832
- C:\Windows\System\QeNbxyF.exe
  C:\Windows\System\QeNbxyF.exe
  2⤵
  PID:7460
- C:\Windows\System\ZQEkaGw.exe
  C:\Windows\System\ZQEkaGw.exe
  2⤵
  PID:7616
- C:\Windows\System\BlCFJVF.exe
  C:\Windows\System\BlCFJVF.exe
  2⤵
  PID:7416
- C:\Windows\System\JNjASEA.exe
  C:\Windows\System\JNjASEA.exe
  2⤵
  PID:7680
- C:\Windows\System\atGGRqa.exe
  C:\Windows\System\atGGRqa.exe
  2⤵
  PID:7908
- C:\Windows\System\XdMzJaG.exe
  C:\Windows\System\XdMzJaG.exe
  2⤵
  PID:7924
- C:\Windows\System\BymkeCt.exe
  C:\Windows\System\BymkeCt.exe
  2⤵
  PID:7976
- C:\Windows\System\nXdRKJZ.exe
  C:\Windows\System\nXdRKJZ.exe
  2⤵
  PID:8180
- C:\Windows\System\ILChdyk.exe
  C:\Windows\System\ILChdyk.exe
  2⤵
  PID:7664
- C:\Windows\System\oaeaEBf.exe
  C:\Windows\System\oaeaEBf.exe
  2⤵
  PID:7780
- C:\Windows\System\MVkkUXS.exe
  C:\Windows\System\MVkkUXS.exe
  2⤵
  PID:7992
- C:\Windows\System\PxlmjsH.exe
  C:\Windows\System\PxlmjsH.exe
  2⤵
  PID:7380
- C:\Windows\System\JzyhUzl.exe
  C:\Windows\System\JzyhUzl.exe
  2⤵
  PID:7412
- C:\Windows\System\QJXyWgz.exe
  C:\Windows\System\QJXyWgz.exe
  2⤵
  PID:7888
- C:\Windows\System\oVfLMbh.exe
  C:\Windows\System\oVfLMbh.exe
  2⤵
  PID:7528
- C:\Windows\System\CVAFSVJ.exe
  C:\Windows\System\CVAFSVJ.exe
  2⤵
  PID:8036
- C:\Windows\System\egikdUl.exe
  C:\Windows\System\egikdUl.exe
  2⤵
  PID:7676
- C:\Windows\System\bpxSfzA.exe
  C:\Windows\System\bpxSfzA.exe
  2⤵
  PID:7476
- C:\Windows\System\DciKhdH.exe
  C:\Windows\System\DciKhdH.exe
  2⤵
  PID:7764
- C:\Windows\System\aXAahAc.exe
  C:\Windows\System\aXAahAc.exe
  2⤵
  PID:8208
- C:\Windows\System\LQJVWOR.exe
  C:\Windows\System\LQJVWOR.exe
  2⤵
  PID:8224
- C:\Windows\System\ctNagur.exe
  C:\Windows\System\ctNagur.exe
  2⤵
  PID:8240
- C:\Windows\System\kfqDUYh.exe
  C:\Windows\System\kfqDUYh.exe
  2⤵
  PID:8256
- C:\Windows\System\EPsSQmo.exe
  C:\Windows\System\EPsSQmo.exe
  2⤵
  PID:8272
- C:\Windows\System\RXKXsvi.exe
  C:\Windows\System\RXKXsvi.exe
  2⤵
  PID:8288
- C:\Windows\System\uuUSylh.exe
  C:\Windows\System\uuUSylh.exe
  2⤵
  PID:8304
- C:\Windows\System\iUsaBDX.exe
  C:\Windows\System\iUsaBDX.exe
  2⤵
  PID:8320
- C:\Windows\System\amECOcx.exe
  C:\Windows\System\amECOcx.exe
  2⤵
  PID:8336
- C:\Windows\System\tkhRxAL.exe
  C:\Windows\System\tkhRxAL.exe
  2⤵
  PID:8352
- C:\Windows\System\NuVCMnd.exe
  C:\Windows\System\NuVCMnd.exe
  2⤵
  PID:8368
- C:\Windows\System\wOSlRLa.exe
  C:\Windows\System\wOSlRLa.exe
  2⤵
  PID:8384
- C:\Windows\System\vBXhDCN.exe
  C:\Windows\System\vBXhDCN.exe
  2⤵
  PID:8400
- C:\Windows\System\EnQrSkP.exe
  C:\Windows\System\EnQrSkP.exe
  2⤵
  PID:8416
- C:\Windows\System\tAhJuEh.exe
  C:\Windows\System\tAhJuEh.exe
  2⤵
  PID:8432
- C:\Windows\System\KlQrasG.exe
  C:\Windows\System\KlQrasG.exe
  2⤵
  PID:8448
- C:\Windows\System\NsVklhB.exe
  C:\Windows\System\NsVklhB.exe
  2⤵
  PID:8464
- C:\Windows\System\knWGmKf.exe
  C:\Windows\System\knWGmKf.exe
  2⤵
  PID:8480
- C:\Windows\System\joaQDnO.exe
  C:\Windows\System\joaQDnO.exe
  2⤵
  PID:8496
- C:\Windows\System\FTQAoPU.exe
  C:\Windows\System\FTQAoPU.exe
  2⤵
  PID:8512
- C:\Windows\System\KtGTovM.exe
  C:\Windows\System\KtGTovM.exe
  2⤵
  PID:8528
- C:\Windows\System\JkzIXlY.exe
  C:\Windows\System\JkzIXlY.exe
  2⤵
  PID:8544
- C:\Windows\System\KLfhGYL.exe
  C:\Windows\System\KLfhGYL.exe
  2⤵
  PID:8560
- C:\Windows\System\jSfEiSA.exe
  C:\Windows\System\jSfEiSA.exe
  2⤵
  PID:8576
- C:\Windows\System\NDgMAqM.exe
  C:\Windows\System\NDgMAqM.exe
  2⤵
  PID:8592
- C:\Windows\System\hStKxFY.exe
  C:\Windows\System\hStKxFY.exe
  2⤵
  PID:8608
- C:\Windows\System\ErwJBTn.exe
  C:\Windows\System\ErwJBTn.exe
  2⤵
  PID:8624
- C:\Windows\System\mJtSZzi.exe
  C:\Windows\System\mJtSZzi.exe
  2⤵
  PID:8640
- C:\Windows\System\GFOwFgg.exe
  C:\Windows\System\GFOwFgg.exe
  2⤵
  PID:8656
- C:\Windows\System\cZvkrfd.exe
  C:\Windows\System\cZvkrfd.exe
  2⤵
  PID:8672
- C:\Windows\System\eypysPp.exe
  C:\Windows\System\eypysPp.exe
  2⤵
  PID:8692
- C:\Windows\System\LkbJApE.exe
  C:\Windows\System\LkbJApE.exe
  2⤵
  PID:8708
- C:\Windows\System\IfBOQMN.exe
  C:\Windows\System\IfBOQMN.exe
  2⤵
  PID:8724
- C:\Windows\System\HeWgrUQ.exe
  C:\Windows\System\HeWgrUQ.exe
  2⤵
  PID:8740
- C:\Windows\System\TLpmbTQ.exe
  C:\Windows\System\TLpmbTQ.exe
  2⤵
  PID:8756
- C:\Windows\System\EdVvwnZ.exe
  C:\Windows\System\EdVvwnZ.exe
  2⤵
  PID:8772
- C:\Windows\System\mYHWIuW.exe
  C:\Windows\System\mYHWIuW.exe
  2⤵
  PID:8788
- C:\Windows\System\XTydBre.exe
  C:\Windows\System\XTydBre.exe
  2⤵
  PID:8804
- C:\Windows\System\TuesfQq.exe
  C:\Windows\System\TuesfQq.exe
  2⤵
  PID:8820
- C:\Windows\System\tcylmFM.exe
  C:\Windows\System\tcylmFM.exe
  2⤵
  PID:8836
- C:\Windows\System\HEyiQPp.exe
  C:\Windows\System\HEyiQPp.exe
  2⤵
  PID:8852
- C:\Windows\System\SpujJdf.exe
  C:\Windows\System\SpujJdf.exe
  2⤵
  PID:8868
- C:\Windows\System\rJPqATG.exe
  C:\Windows\System\rJPqATG.exe
  2⤵
  PID:8884
- C:\Windows\System\ADbsOWh.exe
  C:\Windows\System\ADbsOWh.exe
  2⤵
  PID:8900
- C:\Windows\System\GVhxSTe.exe
  C:\Windows\System\GVhxSTe.exe
  2⤵
  PID:8916
- C:\Windows\System\YyhNsuE.exe
  C:\Windows\System\YyhNsuE.exe
  2⤵
  PID:8932
- C:\Windows\System\uNfnfcT.exe
  C:\Windows\System\uNfnfcT.exe
  2⤵
  PID:8948
- C:\Windows\System\XfIjdDG.exe
  C:\Windows\System\XfIjdDG.exe
  2⤵
  PID:8964
- C:\Windows\System\HSmlAqN.exe
  C:\Windows\System\HSmlAqN.exe
  2⤵
  PID:8980
- C:\Windows\System\YkLPVAC.exe
  C:\Windows\System\YkLPVAC.exe
  2⤵
  PID:9000
- C:\Windows\System\BJacSgA.exe
  C:\Windows\System\BJacSgA.exe
  2⤵
  PID:9016
- C:\Windows\System\uosgGuZ.exe
  C:\Windows\System\uosgGuZ.exe
  2⤵
  PID:9032
- C:\Windows\System\wkktXFq.exe
  C:\Windows\System\wkktXFq.exe
  2⤵
  PID:9048
- C:\Windows\System\GldHJVy.exe
  C:\Windows\System\GldHJVy.exe
  2⤵
  PID:9064
- C:\Windows\System\nGtHATA.exe
  C:\Windows\System\nGtHATA.exe
  2⤵
  PID:9080
- C:\Windows\System\EKFQHSi.exe
  C:\Windows\System\EKFQHSi.exe
  2⤵
  PID:9096
- C:\Windows\System\diKskzM.exe
  C:\Windows\System\diKskzM.exe
  2⤵
  PID:9112
- C:\Windows\System\WAJUqcs.exe
  C:\Windows\System\WAJUqcs.exe
  2⤵
  PID:9128
- C:\Windows\System\caXBZJw.exe
  C:\Windows\System\caXBZJw.exe
  2⤵
  PID:9144
- C:\Windows\System\NVRarmN.exe
  C:\Windows\System\NVRarmN.exe
  2⤵
  PID:9160
- C:\Windows\System\zoZmORf.exe
  C:\Windows\System\zoZmORf.exe
  2⤵
  PID:9180
- C:\Windows\System\qCXMsgF.exe
  C:\Windows\System\qCXMsgF.exe
  2⤵
  PID:9196
- C:\Windows\System\TpsonKp.exe
  C:\Windows\System\TpsonKp.exe
  2⤵
  PID:9212
- C:\Windows\System\rcDAmIk.exe
  C:\Windows\System\rcDAmIk.exe
  2⤵
  PID:8232
- C:\Windows\System\auaZWKi.exe
  C:\Windows\System\auaZWKi.exe
  2⤵
  PID:8296
- C:\Windows\System\BmLFTmw.exe
  C:\Windows\System\BmLFTmw.exe
  2⤵
  PID:8252
- C:\Windows\System\WOYLtAO.exe
  C:\Windows\System\WOYLtAO.exe
  2⤵
  PID:8220
- C:\Windows\System\uVPQfiR.exe
  C:\Windows\System\uVPQfiR.exe
  2⤵
  PID:8360
- C:\Windows\System\imaafUw.exe
  C:\Windows\System\imaafUw.exe
  2⤵
  PID:8424
- C:\Windows\System\elhCLEc.exe
  C:\Windows\System\elhCLEc.exe
  2⤵
  PID:8380
- C:\Windows\System\GDTyxGV.exe
  C:\Windows\System\GDTyxGV.exe
  2⤵
  PID:8408
- C:\Windows\System\AhNCQDj.exe
  C:\Windows\System\AhNCQDj.exe
  2⤵
  PID:8440
- C:\Windows\System\HehXCwf.exe
  C:\Windows\System\HehXCwf.exe
  2⤵
  PID:7200
- C:\Windows\System\pYhTLyS.exe
  C:\Windows\System\pYhTLyS.exe
  2⤵
  PID:8508
- C:\Windows\System\PixiDKK.exe
  C:\Windows\System\PixiDKK.exe
  2⤵
  PID:7464
- C:\Windows\System\MYzDuqa.exe
  C:\Windows\System\MYzDuqa.exe
  2⤵
  PID:8572
- C:\Windows\System\DvEWWcA.exe
  C:\Windows\System\DvEWWcA.exe
  2⤵
  PID:8648
- C:\Windows\System\JEUePRj.exe
  C:\Windows\System\JEUePRj.exe
  2⤵
  PID:8720
- C:\Windows\System\KoHsAWU.exe
  C:\Windows\System\KoHsAWU.exe
  2⤵
  PID:8632
- C:\Windows\System\Feulwig.exe
  C:\Windows\System\Feulwig.exe
  2⤵
  PID:8668
- C:\Windows\System\RuoOSBp.exe
  C:\Windows\System\RuoOSBp.exe
  2⤵
  PID:8844
- C:\Windows\System\QPUEKSB.exe
  C:\Windows\System\QPUEKSB.exe
  2⤵
  PID:8816
- C:\Windows\System\vQwVeih.exe
  C:\Windows\System\vQwVeih.exe
  2⤵
  PID:8908
- C:\Windows\System\PsGIRed.exe
  C:\Windows\System\PsGIRed.exe
  2⤵
  PID:8972
- C:\Windows\System\wFNYwMu.exe
  C:\Windows\System\wFNYwMu.exe
  2⤵
  PID:8996
- C:\Windows\System\ysYZzjJ.exe
  C:\Windows\System\ysYZzjJ.exe
  2⤵
  PID:8800
- C:\Windows\System\jzHombh.exe
  C:\Windows\System\jzHombh.exe
  2⤵
  PID:8864
- C:\Windows\System\KFRXCzO.exe
  C:\Windows\System\KFRXCzO.exe
  2⤵
  PID:8956
- C:\Windows\System\fQDyyhg.exe
  C:\Windows\System\fQDyyhg.exe
  2⤵
  PID:9024
- C:\Windows\System\aOzpBWX.exe
  C:\Windows\System\aOzpBWX.exe
  2⤵
  PID:9072
- C:\Windows\System\ruiXtCm.exe
  C:\Windows\System\ruiXtCm.exe
  2⤵
  PID:9104
- C:\Windows\System\hSjbXoz.exe
  C:\Windows\System\hSjbXoz.exe
  2⤵
  PID:9172
- C:\Windows\System\fqgvljp.exe
  C:\Windows\System\fqgvljp.exe
  2⤵
  PID:9156
- C:\Windows\System\BfMdUHi.exe
  C:\Windows\System\BfMdUHi.exe
  2⤵
  PID:9208
- C:\Windows\System\zJbkVCt.exe
  C:\Windows\System\zJbkVCt.exe
  2⤵
  PID:8268
- C:\Windows\System\JNsnMmV.exe
  C:\Windows\System\JNsnMmV.exe
  2⤵
  PID:9192
- C:\Windows\System\nPryEcM.exe
  C:\Windows\System\nPryEcM.exe
  2⤵
  PID:7424
- C:\Windows\System\nJhyIes.exe
  C:\Windows\System\nJhyIes.exe
  2⤵
  PID:8332
- C:\Windows\System\XEoRyCZ.exe
  C:\Windows\System\XEoRyCZ.exe
  2⤵
  PID:8444
- C:\Windows\System\PexcQZd.exe
  C:\Windows\System\PexcQZd.exe
  2⤵
  PID:8520
- C:\Windows\System\eQGqhVj.exe
  C:\Windows\System\eQGqhVj.exe
  2⤵
  PID:8620
- C:\Windows\System\njTuTjn.exe
  C:\Windows\System\njTuTjn.exe
  2⤵
  PID:8460
- C:\Windows\System\ngqBNkw.exe
  C:\Windows\System\ngqBNkw.exe
  2⤵
  PID:8568
- C:\Windows\System\XzMAVxj.exe
  C:\Windows\System\XzMAVxj.exe
  2⤵
  PID:8552
- C:\Windows\System\kXantzi.exe
  C:\Windows\System\kXantzi.exe
  2⤵
  PID:8748
- C:\Windows\System\fUgksfi.exe
  C:\Windows\System\fUgksfi.exe
  2⤵
  PID:8780
- C:\Windows\System\prREzxl.exe
  C:\Windows\System\prREzxl.exe
  2⤵
  PID:8832
- C:\Windows\System\iOUkDjX.exe
  C:\Windows\System\iOUkDjX.exe
  2⤵
  PID:8988
- C:\Windows\System\xqwQtBX.exe
  C:\Windows\System\xqwQtBX.exe
  2⤵
  PID:9092
- C:\Windows\System\mXuljcM.exe
  C:\Windows\System\mXuljcM.exe
  2⤵
  PID:7204
- C:\Windows\System\zQkByOn.exe
  C:\Windows\System\zQkByOn.exe
  2⤵
  PID:8396
- C:\Windows\System\MoOitvV.exe
  C:\Windows\System\MoOitvV.exe
  2⤵
  PID:8204
- C:\Windows\System\xmFZtPb.exe
  C:\Windows\System\xmFZtPb.exe
  2⤵
  PID:8504
- C:\Windows\System\KSyKNuT.exe
  C:\Windows\System\KSyKNuT.exe
  2⤵
  PID:8812
- C:\Windows\System\uNkxjNk.exe
  C:\Windows\System\uNkxjNk.exe
  2⤵
  PID:9008
- C:\Windows\System\YLUYZJq.exe
  C:\Windows\System\YLUYZJq.exe
  2⤵
  PID:9152
- C:\Windows\System\wNgeFsI.exe
  C:\Windows\System\wNgeFsI.exe
  2⤵
  PID:9140
- C:\Windows\System\HIYDhal.exe
  C:\Windows\System\HIYDhal.exe
  2⤵
  PID:8924
- C:\Windows\System\SrywHVU.exe
  C:\Windows\System\SrywHVU.exe
  2⤵
  PID:8616
- C:\Windows\System\aLExfGr.exe
  C:\Windows\System\aLExfGr.exe
  2⤵
  PID:8684
- C:\Windows\System\QGIRaOg.exe
  C:\Windows\System\QGIRaOg.exe
  2⤵
  PID:8688
- C:\Windows\System\rkGZDin.exe
  C:\Windows\System\rkGZDin.exe
  2⤵
  PID:8928
- C:\Windows\System\uabGOHi.exe
  C:\Windows\System\uabGOHi.exe
  2⤵
  PID:8604
- C:\Windows\System\bjQBVyN.exe
  C:\Windows\System\bjQBVyN.exe
  2⤵
  PID:9236
- C:\Windows\System\XHeEfry.exe
  C:\Windows\System\XHeEfry.exe
  2⤵
  PID:9256
- C:\Windows\System\IvVZjVX.exe
  C:\Windows\System\IvVZjVX.exe
  2⤵
  PID:9272
- C:\Windows\System\wihNihh.exe
  C:\Windows\System\wihNihh.exe
  2⤵
  PID:9288
- C:\Windows\System\xhcTpWS.exe
  C:\Windows\System\xhcTpWS.exe
  2⤵
  PID:9304
- C:\Windows\System\zGFTBHn.exe
  C:\Windows\System\zGFTBHn.exe
  2⤵
  PID:9320
- C:\Windows\System\UzMtEim.exe
  C:\Windows\System\UzMtEim.exe
  2⤵
  PID:9336
- C:\Windows\System\XmnimAI.exe
  C:\Windows\System\XmnimAI.exe
  2⤵
  PID:9352
- C:\Windows\System\RFqdTIw.exe
  C:\Windows\System\RFqdTIw.exe
  2⤵
  PID:9368
- C:\Windows\System\naNWTEm.exe
  C:\Windows\System\naNWTEm.exe
  2⤵
  PID:9384
- C:\Windows\System\tkYxGQs.exe
  C:\Windows\System\tkYxGQs.exe
  2⤵
  PID:9400
- C:\Windows\System\EmXgnkN.exe
  C:\Windows\System\EmXgnkN.exe
  2⤵
  PID:9416
- C:\Windows\System\yqAPfyQ.exe
  C:\Windows\System\yqAPfyQ.exe
  2⤵
  PID:9432
- C:\Windows\System\pUkGNIs.exe
  C:\Windows\System\pUkGNIs.exe
  2⤵
  PID:9448
- C:\Windows\System\uVqEsZK.exe
  C:\Windows\System\uVqEsZK.exe
  2⤵
  PID:9464
- C:\Windows\System\MnsGKrg.exe
  C:\Windows\System\MnsGKrg.exe
  2⤵
  PID:9480
- C:\Windows\System\EIeTrKN.exe
  C:\Windows\System\EIeTrKN.exe
  2⤵
  PID:9496
- C:\Windows\System\SaQwNhE.exe
  C:\Windows\System\SaQwNhE.exe
  2⤵
  PID:9512
- C:\Windows\System\ZNZyVYQ.exe
  C:\Windows\System\ZNZyVYQ.exe
  2⤵
  PID:9528
- C:\Windows\System\EiyKNIH.exe
  C:\Windows\System\EiyKNIH.exe
  2⤵
  PID:9544
- C:\Windows\System\Xkohbfs.exe
  C:\Windows\System\Xkohbfs.exe
  2⤵
  PID:9560
- C:\Windows\System\CKNMqYs.exe
  C:\Windows\System\CKNMqYs.exe
  2⤵
  PID:9576
- C:\Windows\System\JhDNdGT.exe
  C:\Windows\System\JhDNdGT.exe
  2⤵
  PID:9592
- C:\Windows\System\GAiHtYS.exe
  C:\Windows\System\GAiHtYS.exe
  2⤵
  PID:9608
- C:\Windows\System\BidoaON.exe
  C:\Windows\System\BidoaON.exe
  2⤵
  PID:9628
- C:\Windows\System\ROUGwch.exe
  C:\Windows\System\ROUGwch.exe
  2⤵
  PID:9644
- C:\Windows\System\mxhvfXv.exe
  C:\Windows\System\mxhvfXv.exe
  2⤵
  PID:9660
- C:\Windows\System\kmBTpjr.exe
  C:\Windows\System\kmBTpjr.exe
  2⤵
  PID:9676
- C:\Windows\System\AwDSmfy.exe
  C:\Windows\System\AwDSmfy.exe
  2⤵
  PID:9696
- C:\Windows\System\KmwmKIQ.exe
  C:\Windows\System\KmwmKIQ.exe
  2⤵
  PID:9712
- C:\Windows\System\hlfezPB.exe
  C:\Windows\System\hlfezPB.exe
  2⤵
  PID:9728
- C:\Windows\System\BEQuWET.exe
  C:\Windows\System\BEQuWET.exe
  2⤵
  PID:9748
- C:\Windows\System\eJbsEWt.exe
  C:\Windows\System\eJbsEWt.exe
  2⤵
  PID:9764
- C:\Windows\System\WrPLqAn.exe
  C:\Windows\System\WrPLqAn.exe
  2⤵
  PID:9780
- C:\Windows\System\lAxCWqo.exe
  C:\Windows\System\lAxCWqo.exe
  2⤵
  PID:9796
- C:\Windows\System\odGwdJZ.exe
  C:\Windows\System\odGwdJZ.exe
  2⤵
  PID:9812
- C:\Windows\System\dBUrJUA.exe
  C:\Windows\System\dBUrJUA.exe
  2⤵
  PID:9832
- C:\Windows\System\edLqWLP.exe
  C:\Windows\System\edLqWLP.exe
  2⤵
  PID:9848
- C:\Windows\System\YnjXDAo.exe
  C:\Windows\System\YnjXDAo.exe
  2⤵
  PID:9864
- C:\Windows\System\RdiQhIb.exe
  C:\Windows\System\RdiQhIb.exe
  2⤵
  PID:9880
- C:\Windows\System\GdqEiMA.exe
  C:\Windows\System\GdqEiMA.exe
  2⤵
  PID:9896
- C:\Windows\System\AIwfgCF.exe
  C:\Windows\System\AIwfgCF.exe
  2⤵
  PID:9912
- C:\Windows\System\RcbgPyd.exe
  C:\Windows\System\RcbgPyd.exe
  2⤵
  PID:9928
- C:\Windows\System\CMLdzEN.exe
  C:\Windows\System\CMLdzEN.exe
  2⤵
  PID:9948
- C:\Windows\System\cSaXpjX.exe
  C:\Windows\System\cSaXpjX.exe
  2⤵
  PID:9964
- C:\Windows\System\uVfGxnL.exe
  C:\Windows\System\uVfGxnL.exe
  2⤵
  PID:9980
- C:\Windows\System\ANcpaqh.exe
  C:\Windows\System\ANcpaqh.exe
  2⤵
  PID:10016
- C:\Windows\System\FSvkXiX.exe
  C:\Windows\System\FSvkXiX.exe
  2⤵
  PID:10032
- C:\Windows\System\RrQeGZQ.exe
  C:\Windows\System\RrQeGZQ.exe
  2⤵
  PID:10048
- C:\Windows\System\jHCJhUW.exe
  C:\Windows\System\jHCJhUW.exe
  2⤵
  PID:10064
- C:\Windows\System\IENWvMP.exe
  C:\Windows\System\IENWvMP.exe
  2⤵
  PID:10080
- C:\Windows\System\pdWuIUq.exe
  C:\Windows\System\pdWuIUq.exe
  2⤵
  PID:10096
- C:\Windows\System\gODrmRh.exe
  C:\Windows\System\gODrmRh.exe
  2⤵
  PID:10112
- C:\Windows\System\ZTLcFcE.exe
  C:\Windows\System\ZTLcFcE.exe
  2⤵
  PID:10128
- C:\Windows\System\ZpvlTsr.exe
  C:\Windows\System\ZpvlTsr.exe
  2⤵
  PID:10144
- C:\Windows\System\CZqgkbi.exe
  C:\Windows\System\CZqgkbi.exe
  2⤵
  PID:10160
- C:\Windows\System\mJunvUy.exe
  C:\Windows\System\mJunvUy.exe
  2⤵
  PID:10176
- C:\Windows\System\mmfUfQU.exe
  C:\Windows\System\mmfUfQU.exe
  2⤵
  PID:10192
- C:\Windows\System\ufDgZdO.exe
  C:\Windows\System\ufDgZdO.exe
  2⤵
  PID:10208
- C:\Windows\System\SvRsNzT.exe
  C:\Windows\System\SvRsNzT.exe
  2⤵
  PID:10224
- C:\Windows\System\nAwLkRO.exe
  C:\Windows\System\nAwLkRO.exe
  2⤵
  PID:9204
- C:\Windows\System\jIEhEiQ.exe
  C:\Windows\System\jIEhEiQ.exe
  2⤵
  PID:8704
- C:\Windows\System\qNtGLLd.exe
  C:\Windows\System\qNtGLLd.exe
  2⤵
  PID:9124
- C:\Windows\System\DvCXbcd.exe
  C:\Windows\System\DvCXbcd.exe
  2⤵
  PID:9012
- C:\Windows\System\mQVDlWo.exe
  C:\Windows\System\mQVDlWo.exe
  2⤵
  PID:9252
- C:\Windows\System\WWGqYbI.exe
  C:\Windows\System\WWGqYbI.exe
  2⤵
  PID:9312
- C:\Windows\System\tNJLMdi.exe
  C:\Windows\System\tNJLMdi.exe
  2⤵
  PID:9348
- C:\Windows\System\pufdgsB.exe
  C:\Windows\System\pufdgsB.exe
  2⤵
  PID:9412
- C:\Windows\System\zacvUFG.exe
  C:\Windows\System\zacvUFG.exe
  2⤵
  PID:9392
- C:\Windows\System\VxKYfkI.exe
  C:\Windows\System\VxKYfkI.exe
  2⤵
  PID:9472
- C:\Windows\System\nuabySM.exe
  C:\Windows\System\nuabySM.exe
  2⤵
  PID:9360
- C:\Windows\System\ivGqUun.exe
  C:\Windows\System\ivGqUun.exe
  2⤵
  PID:9540
- C:\Windows\System\tTihnvn.exe
  C:\Windows\System\tTihnvn.exe
  2⤵
  PID:9604
- C:\Windows\System\fejIDit.exe
  C:\Windows\System\fejIDit.exe
  2⤵
  PID:9668
- C:\Windows\System\zLmaBVC.exe
  C:\Windows\System\zLmaBVC.exe
  2⤵
  PID:9428
- C:\Windows\System\uHdiEqR.exe
  C:\Windows\System\uHdiEqR.exe
  2⤵
  PID:9584
- C:\Windows\System\NjcxLEQ.exe
  C:\Windows\System\NjcxLEQ.exe
  2⤵
  PID:9652
- C:\Windows\System\TpgdWwQ.exe
  C:\Windows\System\TpgdWwQ.exe
  2⤵
  PID:9552
- C:\Windows\System\ohRXTnB.exe
  C:\Windows\System\ohRXTnB.exe
  2⤵
  PID:9588
- C:\Windows\System\AMcoSew.exe
  C:\Windows\System\AMcoSew.exe
  2⤵
  PID:9684
- C:\Windows\System\teybFyg.exe
  C:\Windows\System\teybFyg.exe
  2⤵
  PID:9788
- C:\Windows\System\kKgLivh.exe
  C:\Windows\System\kKgLivh.exe
  2⤵
  PID:9820
- C:\Windows\System\jWswzpj.exe
  C:\Windows\System\jWswzpj.exe
  2⤵
  PID:9844
- C:\Windows\System\jfbyAfS.exe
  C:\Windows\System\jfbyAfS.exe
  2⤵
  PID:9904
- C:\Windows\System\AaFLKPR.exe
  C:\Windows\System\AaFLKPR.exe
  2⤵
  PID:9856
- C:\Windows\System\cwvZlwP.exe
  C:\Windows\System\cwvZlwP.exe
  2⤵
  PID:9860
- C:\Windows\System\mxFuHyZ.exe
  C:\Windows\System\mxFuHyZ.exe
  2⤵
  PID:9956
- C:\Windows\System\bQXvpDQ.exe
  C:\Windows\System\bQXvpDQ.exe
  2⤵
  PID:9992
- C:\Windows\System\DvJuBtt.exe
  C:\Windows\System\DvJuBtt.exe
  2⤵
  PID:10004
- C:\Windows\System\Qnjloxd.exe
  C:\Windows\System\Qnjloxd.exe
  2⤵
  PID:10056
- C:\Windows\System\lRtazSr.exe
  C:\Windows\System\lRtazSr.exe
  2⤵
  PID:10092
- C:\Windows\System\DfwQind.exe
  C:\Windows\System\DfwQind.exe
  2⤵
  PID:10184
- C:\Windows\System\YLcTnIE.exe
  C:\Windows\System\YLcTnIE.exe
  2⤵
  PID:10216
- C:\Windows\System\yXPSZnz.exe
  C:\Windows\System\yXPSZnz.exe
  2⤵
  PID:10172
- C:\Windows\System\zNkjoZf.exe
  C:\Windows\System\zNkjoZf.exe
  2⤵
  PID:10076
- C:\Windows\System\JTRyjDp.exe
  C:\Windows\System\JTRyjDp.exe
  2⤵
  PID:10200
- C:\Windows\System\LzJEwAe.exe
  C:\Windows\System\LzJEwAe.exe
  2⤵
  PID:8328
- C:\Windows\System\UwdpIrT.exe
  C:\Windows\System\UwdpIrT.exe
  2⤵
  PID:8584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BhViCdf.exe

Filesize
1.6MB

MD5
d0f3e140356fe56767d44e1bcd18bca5

SHA1
6c3d1ac74f8b448fd6bbebffce7b217fbbfd8cd5

SHA256
5ecf0261e8064813ac6ec09f55fd319de8ca1d5a2549f06dcd56f503ebf3bb8e

SHA512
21635811ac94a3ae95baad9c0e4180c683fcf3cabfbf36887ca5cc930fc2057226557d9dde7d7195338eb5ebe155ed9f4cb9cc7860523c842850a944d72a6ab9

Download Submit
C:\Windows\system\JgabAOC.exe

Filesize
1.6MB

MD5
b181f8d5ec1701b4b717c6cac6a21e24

SHA1
aae5b9ba569fb2a2233e8ec585e3967f4c157b5c

SHA256
cd8369796e2084d32aa9e390837cb39adf360aaf8cf981bd318312a73859b7ef

SHA512
2baf7b7de94628514b4ff1f6b5ea45215bb7beb6be20d82562812bceb1d5098c2e422b609b61b7ad6540f13a211d78725d4d8485323e9e052d6f7f8c3cc9bc2e

Download Submit
C:\Windows\system\KkCGLKk.exe

Filesize
1.6MB

MD5
d31b5ce7e219723ca7cbb812c74feaa1

SHA1
1e4da0a88f90a057a82290e659f7bc33c465ad2c

SHA256
ff50244efaa06b5e291f9628a3958fbd543f4cd07b7bb88592303e2ec273fb1d

SHA512
6c0ea9adfb49ebfff201168d02dbcb152a63915831e073e3167e3f83f3476c4d9ed5af0f8f7584fdee4f86dc8b42fd7d2f60374624ccb6526013877763a4a2d0

Download Submit
C:\Windows\system\LSySRlo.exe

Filesize
1.6MB

MD5
95c1466040368d3e59851aa65a8e0a9d

SHA1
c8dd1cf7f7c05b88b025f39be152fa7a036347ff

SHA256
da6dc8f6cf829c8ccdb606bc24266610d03c0dae5258cabc707117151ff2878c

SHA512
aae4ef09ae5dadfc1ffdd87770243d47803dc029e1869cfec5487fff480f877aa7b01e95adf4682445b9fc78b788ec09d7604c27a57deef1a4c3f0805a18c746

Download Submit
C:\Windows\system\MtvzshX.exe

Filesize
1.6MB

MD5
52a38545b062e4ad0e3b55cd387017df

SHA1
171e239c7b34ea23b02a2c57a60fe878809b9a42

SHA256
4a5967cf4c3ec59936b6ac11d7e1ee938250c5e004b61cdf1f67d3f73258e36a

SHA512
e0baac526ad6712d329d82eb517a58685a651b4abc92a262c5cf6f0731c7cb01a6e63cc2b66f70f073253a10a094eaede086d5f728b6fbc8c424b0ea6e76bb8f

Download Submit
C:\Windows\system\NbPzwQd.exe

Filesize
1.6MB

MD5
5a5f9fe99345b050ac264371eae4a7f3

SHA1
bc55ca7af14cc0e2446467b8f01f829f35fba322

SHA256
a910e5bf400d6ee3fc2a71d60755532bf091f18f16f994951974f0ca9bfae506

SHA512
99f2548d0132236722cd53d26003f16589973e950e838ef94fcf8dea6012deccd28ec7f467150e28dbb506354738d18dba568da4a9aaeb4f4f3d6b9a7f2778ee

Download Submit
C:\Windows\system\NoUQbVR.exe

Filesize
1.6MB

MD5
2fc687d36001d72dd7fd4623ed4d9be5

SHA1
0199fb55c491dea00ef4b0f715695bd078f86a89

SHA256
5bf52ea767b3685867be3ca2ae9cddf001ce7364445459d05131f7c210865ce8

SHA512
c84bfab780928c7f88e298a225819fd3d8d88a13f45e60cf4094ee8238dd43609d433c20ae7ac4d8d306d6f3aed47eb4475cd9f5fb414943c7651c3fef871fc5

Download Submit
C:\Windows\system\OSskYpu.exe

Filesize
1.6MB

MD5
5fdbfd4a82a98361f2e6352f7ac9ce1f

SHA1
b7f355c384ee8b902a6d17f2bbeac55c4d380dc6

SHA256
13b384cb5e5eb4599f7a2e127b8047f2ccfdf7e4e93bfd361893fbe69bdd5228

SHA512
ae80ed45cba28afac40a8c00f1f4b501894c48c0cb4b10d614c2700d1285a8ef32e8d1fc6b0c2c70dcd133a0175629c6cf195cb68483c67d9b61f20372882dc8

Download Submit
C:\Windows\system\QUIgsBh.exe

Filesize
1.6MB

MD5
72e2e7fe30d06b5d2ed12b51e0c3c3d8

SHA1
6aac765a562ab2f2429094d5f87b5071c43f2d9b

SHA256
48638f3f220f48139c1ae8306229cb865e578e6a1233c34e6a5c3926b2b05b79

SHA512
f83c0d53c16a9a506e530b308f6226dc6a197da24bda264d7daf9457a609de61cfad18a63b42072ef3209cd68a713cad644768166bc9a17b7ca1929e4557ebc9

Download Submit
C:\Windows\system\QkyMaAx.exe

Filesize
1.6MB

MD5
e1881bc850b13711e708c050cd78e1a5

SHA1
eaef8278e5c8a9e22bfedb1b5863db6367a7c295

SHA256
333bb7bd77d5839372639b3d0d2ccbbf4f42c5e98f2983c466d56285b8bea5d5

SHA512
725468a29570ed295f7abbe9a4a1e028ae7758e10fecdbfee8da0e0c14b7c8e4383b87df94be3c15a54183f18fef05da3de8d71e61feccb28e7728aec292362b

Download Submit
C:\Windows\system\RPmdQrM.exe

Filesize
1.6MB

MD5
3e1e30090cd884a1d8ff0abcd503f1d5

SHA1
747705bf4a1d5de014d2d42121cedd8691c44c46

SHA256
29ad08bf2d365287bda7ec17d8ddb0f5ce500b3d628496769475b9ff7f924fa9

SHA512
e67b0d366f1d61e5cc4ff9c4b9a23175786e0bccfa264b7db095e177c0bd8fb58317fb12d32a8701c1a4cdc4d7d8f63478edb4d1f577ead489e186db6cf8f1b6

Download Submit
C:\Windows\system\RXgJEBI.exe

Filesize
1.6MB

MD5
6950554b839435512d92227b7cef1780

SHA1
28f8b53f5557a73ad1a0ef6cd6278461a8642818

SHA256
5dcdbc676458d2813ec1dc857c8226c53920c9f4a88fc9ddd7ab2917fb7c8789

SHA512
ab910996d98dcc7f0efd53565f777630b4899e98986c7892338c2e09e586757ec2f927fbb54871b06618eb67c774e11bc56188491c4ccb35c2091936a7e8f81b

Download Submit
C:\Windows\system\TbJktBe.exe

Filesize
1.6MB

MD5
9f5e6353273d7f00b4419d40bd868b4f

SHA1
809518e246be2824cc1159d4cb57fa739a03e6ab

SHA256
699ced5f4e50123b2cd652b6edac46a7c64dc435a3b5cff75d5e1768d9535293

SHA512
ad2d8455cc95c0d527cc06e42e87db9e481b6e63931c5c1077b7ebf4859e032a0da9921c555ed1aae54d1888f1df02379a7a6a65bd0fc3e912e017908bc09f21

Download Submit
C:\Windows\system\UcdkQaK.exe

Filesize
1.6MB

MD5
5001bfaa63d3002be5e9e4bc07ccd8f3

SHA1
1f725a3bbe351b24efd69ee7ced1245d11a13189

SHA256
ff3f13e358475f6d51ff9b8fd8fc551dfc38d3bb8702fb57756ae8f042fdd29d

SHA512
deabcfbed9b92cb1c5fd3117ffbc30b5be62646a3fda22f0ef891b786d05fc0b2cbd490c0d056681eb203cb2ae3d1aa51d7ad3f8c79693c30abbec91172dd431

Download Submit
C:\Windows\system\VdtvGFW.exe

Filesize
1.6MB

MD5
70d03cf44abf1c294caab8dd98b437b2

SHA1
406845bba9b6a212434c5936149c87c29f6fad16

SHA256
127005827a467eed18282e3f08853c971b95419f3f5a27b6543b3ed486e70365

SHA512
e22607a483c7b39ff520c751620ad67b0b42595ff5a635b603d1a74153375931c08558589315eae2f773b9bba76516ad33aba00a872202b0d8b22bff0220c495

Download Submit
C:\Windows\system\VostJRc.exe

Filesize
1.6MB

MD5
70f4cedab69e6570da8a1e63603e9108

SHA1
bdd522145d544b1a8c05abe0608ab5c6ba29793e

SHA256
86603fe152ed80646fad307808beac3f21819c54a35e86244cd1a75a27e7a3e4

SHA512
32f45575268c8e5bba4acaa9e052efb885360ed90b35a07ba4b3b0be655110a5dde21a25b5f7b1b16e20715f8c5098c3f96eaaf95c5fc24e2f6552f737393b5b

Download Submit
C:\Windows\system\YgCIDSR.exe

Filesize
1.6MB

MD5
c2876b764a3c9ef060fe6d73562907dc

SHA1
af22aded7807fc7aa6913b3206019f000d1e5ff5

SHA256
3de9583f1f6ed5e095beaf3b605e0c6703bdc4c5fdbc5bd29b09b5e265b75bb3

SHA512
5f09982fe444dcdb2e2518faadfbd9cabf157981f1116e9711e09e7bd9aa433ed4080de7bb047bd41dc99290bac3dfcc7739b47e62a3a02c6638059949a1b0c0

Download Submit
C:\Windows\system\YrPMVqE.exe

Filesize
1.6MB

MD5
7745e8bfaf1a6af3f1525c8b57ef91da

SHA1
3f16de9f6b8cb40665c64df8f0208c9405b9845b

SHA256
cf913c0c100447f9a0fc45579f6af6ae69a4b6e59299e53d084e60bfd6eb1868

SHA512
1a5b7541cb7cea6527227a20ff40c97b070c1a603073c005d3f94423c1f1da0088706db80a840da56c52c5e6bdbf0f13c10b813618d65c4f8cd47e9b85c648cc

Download Submit
C:\Windows\system\YvtGhOa.exe

Filesize
1.6MB

MD5
633326a04b52ef302a5698adba32e4e8

SHA1
b9f141b7ce384fee9cf88d3f1d37f76a30f7f60f

SHA256
5ff55418375329d3fd7c66b7fd36ea759d6ff651efb35aa528d5bd4be2a0a148

SHA512
0de8700b0a722c7765d2d556e49be8eaf1ff1909297326a9395aae8632a0864f5c1ed3811ffbe9cd7d3cf7b4ab516b3eea5016337dabefff283d4bdfa4397fbf

Download Submit
C:\Windows\system\YypRyls.exe

Filesize
1.6MB

MD5
6f39723d52d5708037d2cf121b570e2f

SHA1
a2685aa91d33e604351672e25c32fa215c0db16c

SHA256
9b76721bdb58a1e14c5262a39da76be400378548acd0704769b696d9f5b5b30e

SHA512
2ecc28db706fe2680836eabd2bc6c9b43154fc666a2df1bddd8e6c5d857025f0cdc658016540d1fd02a5c43b98687e36edc90610f0f9a5638a4185c33c82587d

Download Submit
C:\Windows\system\cvCyCMg.exe

Filesize
1.6MB

MD5
83290ef757aed8b4f6cd1c1ae017c38d

SHA1
233f351446591904265952eee2e1e4e94cca87f1

SHA256
e1adafe9535cd48e159511892f3fe7305856f74f08c3f2f109c68d80520cd881

SHA512
2256c2d5993f6569f3f06a8d30cbe104bc85cfd1df922c8f998cbc88a8fe6168aad7eddabe6525e6be99c00b4590e05aeca2e2bfe8fd53c2f18aa2e01304e204

Download Submit
C:\Windows\system\gFBCKnl.exe

Filesize
1.6MB

MD5
36575d77575780949369c41121c502aa

SHA1
be2400efa6ae0c1a26a6b1dfe45e658df3c1e8f1

SHA256
fd138754380552b391a3bb502dc628731946644d7c9e7a8deac9bca8b8cf70b6

SHA512
40bccbc0c8280862f664ea1f47f245e5bb691b107ffb9e22ff03d00707a1279175722cf197fd57e5f52af8f5d351e7b7e169d4856889415cea48d909c3fd639f

Download Submit
C:\Windows\system\hHtZuGp.exe

Filesize
1.6MB

MD5
f03b860f03c29164f77406299c983bfa

SHA1
93a4d17b1d4ed9f8da9f696211939eb2368b171c

SHA256
46fc567d0f0dadd50b4628311fe91caa5f8285423649fe7f2d6104e863fabc1b

SHA512
04a083c57604361ca54a330d5987156119d56454be78009c0149af9836c90d850e7c1aa1fbfeabac491c697df7d9bee2da09d6899d7dfe452754fef9db56565c

Download Submit
C:\Windows\system\jmxnMuw.exe

Filesize
1.6MB

MD5
aee87c90927eb643e1da05b8cdc47e5b

SHA1
84c298595ebbe854b6cae0aa253f67adffc05e20

SHA256
ae530f78873d5bd874a3eab7ff30cdda9cb1308fab7994ade4b2438c664ba37b

SHA512
cc7196b170122786610436cec655ea5380ffdc4fce7a961c5e12bcb20eb1c7cf94877ae36c1a025d330c2741c7d4ee2b25cc3512df3e942fdeb9f5aaa90b4bb3

Download Submit
C:\Windows\system\lKFPXMw.exe

Filesize
1.6MB

MD5
4f660c06d498a1c4bfa35f13669bf111

SHA1
fc9639c29f0356946098bc4e180b6c350c7028be

SHA256
e14745f24164c5db2268628874c6983610ec9e23c8cb283462e8479d47379b94

SHA512
9a256eecc93e2b5f8bc654b80a98d4381667a01e2f8e10d3ea50f30f87aa2950a9d65e5a9a4cbbf60e9b18cd004947b8a2d4fadb940e80c9a3de9ae02d4cb952

Download Submit
C:\Windows\system\pdMZXBG.exe

Filesize
1.6MB

MD5
7374ec11710b24971214a270a600804e

SHA1
2b5765d4040e5a628a5078081dadee430364ca6e

SHA256
9f0e488c6efaaad17bc33c8ae6ef6d8bf1fb67057342d2bb9b08fa3151dbd291

SHA512
58273973ec8d1ba2cb4954af17a331b6222ec40df61995ff5dd342a19b9a53944001464960d75ecb59aac4a32b5246705c50ddd7eef14e6503bfa253bc689e4e

Download Submit
C:\Windows\system\rFUffSe.exe

Filesize
1.6MB

MD5
2de30e8911bac858f0cfd17c4790dc2d

SHA1
4788ba73f896ffce5f1c9f19d6dac1eb95f7db97

SHA256
1cc971f1849645692721023a41ecff46aa4e4d64a3e9fed91dab22bd2e878d93

SHA512
397275f73e9b46af5e4eb08ebe13168b274c9e1b715dfa5c1eb58f8ec0a98677a15b5210141d952e29e4ab754227e2c91f35ebd85d02d845fd76e899812f0e3b

Download Submit
C:\Windows\system\seKzebN.exe

Filesize
1.6MB

MD5
706672a1f05fc7f629eedb94afe6eeec

SHA1
1910cb3d8a19c1c814638f50c7d2ab281a270af5

SHA256
bd0d4fc42d743dd3f45c21c82242646d38d27d2b06aca70fc5ebabef4b5bd6cf

SHA512
70a7169cead80e3016ff33a536aad2bba53f367cfeb05f527d589b4fd87be2990ccdb0b288d779074947a4473b0e36e45877dd3830043482454850456b29e826

Download Submit
C:\Windows\system\ssYEPpt.exe

Filesize
1.6MB

MD5
c4b76a08658362dd9c07afe83215a38a

SHA1
d4baa5f19b09bbd1424873412b8da2679a0b86dd

SHA256
ac299f82295d841e2f4d76941d5bca153180b2d6e192cbf4d5c89d10dbe7178a

SHA512
bcaa0f489a86b25764ddee2c81f791c02ec94d21a6603f47ca1f1b9e95803424ab5454fcdf4ead09182295c53fa76255990ad319732218867c7939d8e6c7e537

Download Submit
C:\Windows\system\vkFKfqC.exe

Filesize
1.6MB

MD5
6110f68c4c50102b86df373e0d4cc203

SHA1
c111927b3da6508d2af21efc27aef3a01c2b4cb3

SHA256
5c485efebf9cabbbf135232d040f8c658f71bbf11fa0fe6b11eb9651acb6dc06

SHA512
eb8b4eb54cf5144cfa8e38688cbd4a9f4a555ada198400ec243662ad0877ce0cf9302d45fc073e961f256e5404d02ff1e2689e1b07e4eff88c62cd622d92409a

Download Submit
C:\Windows\system\wvevCjc.exe

Filesize
1.6MB

MD5
36792f47d3f676c684cbefc3307b0411

SHA1
af780af7a7d48fbe201274761a098e8d46288a5e

SHA256
3ece5b198143722362ee86a6dbd8a9486b31af1f0abcb62ce1ae0c5d91205857

SHA512
3fef78403aaefb872c3699622de5a101074ec9d6e3e24f9a9dbe1daf9e5eaef60ca5b73a750abc4c7750e71f31479b02a11afdd63f86e8012e66669a1ceb9f1f

Download Submit
\Windows\system\ILvGnkO.exe

Filesize
1.6MB

MD5
c95e0775171f67176a10387168ffbb0a

SHA1
ec375fc908451af51a62feb29ed2e52df57993cd

SHA256
a0b44ff0cbbd427942b7b50653dec37202319a9f12198e2919cb63fcd71a483d

SHA512
12fccc94969f8ff32ab644608906b5bee46ee78274e84d6f605b8ce2cca76b62f55779b357073270b8b83b41a38d27a0d965ad95f1a71385f29b104d2cb46e89

Download Submit
memory/340-39-0x000000013FD10000-0x0000000140102000-memory.dmp

Filesize
3.9MB

Download
memory/348-4410-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/348-354-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/764-419-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download
memory/764-4397-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download
memory/1252-411-0x000000013F3E0000-0x000000013F7D2000-memory.dmp

Filesize
3.9MB

Download
memory/1252-4449-0x000000013F3E0000-0x000000013F7D2000-memory.dmp

Filesize
3.9MB

Download
memory/1808-583-0x000007FEF5E60000-0x000007FEF67FD000-memory.dmp

Filesize
9.6MB

Download
memory/1808-43-0x000007FEF5E60000-0x000007FEF67FD000-memory.dmp

Filesize
9.6MB

Download
memory/1808-35-0x000007FEF5E60000-0x000007FEF67FD000-memory.dmp

Filesize
9.6MB

Download
memory/1808-33-0x000007FEF5E60000-0x000007FEF67FD000-memory.dmp

Filesize
9.6MB

Download
memory/1808-19-0x000007FEF611E000-0x000007FEF611F000-memory.dmp

Filesize
4KB

Download
memory/1808-25-0x000000001B670000-0x000000001B952000-memory.dmp

Filesize
2.9MB

Download
memory/1808-26-0x0000000001E90000-0x0000000001E98000-memory.dmp

Filesize
32KB

Download
memory/2044-434-0x000000013F910000-0x000000013FD02000-memory.dmp

Filesize
3.9MB

Download
memory/2044-4399-0x000000013F910000-0x000000013FD02000-memory.dmp

Filesize
3.9MB

Download
memory/2144-413-0x000000013F4E0000-0x000000013F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/2144-4401-0x000000013F4E0000-0x000000013F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/2200-352-0x000000013F650000-0x000000013FA42000-memory.dmp

Filesize
3.9MB

Download
memory/2200-4447-0x000000013F650000-0x000000013FA42000-memory.dmp

Filesize
3.9MB

Download
memory/2572-4400-0x000000013F1C0000-0x000000013F5B2000-memory.dmp

Filesize
3.9MB

Download
memory/2572-351-0x000000013F1C0000-0x000000013F5B2000-memory.dmp

Filesize
3.9MB

Download
memory/2744-13-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/2744-3406-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/2780-4402-0x000000013F1C0000-0x000000013F5B2000-memory.dmp

Filesize
3.9MB

Download
memory/2780-421-0x000000013F1C0000-0x000000013F5B2000-memory.dmp

Filesize
3.9MB

Download
memory/2824-37-0x000000013F0A0000-0x000000013F492000-memory.dmp

Filesize
3.9MB

Download
memory/2824-3531-0x000000013F0A0000-0x000000013F492000-memory.dmp

Filesize
3.9MB

Download
memory/2828-34-0x000000013FC80000-0x0000000140072000-memory.dmp

Filesize
3.9MB

Download
memory/2916-420-0x000000013F1C0000-0x000000013F5B2000-memory.dmp

Filesize
3.9MB

Download
memory/2916-36-0x000000013F0A0000-0x000000013F492000-memory.dmp

Filesize
3.9MB

Download
memory/2916-38-0x000000013FD10000-0x0000000140102000-memory.dmp

Filesize
3.9MB

Download
memory/2916-0-0x0000000000190000-0x00000000001A0000-memory.dmp

Filesize
64KB

Download
memory/2916-18-0x000000013FC80000-0x0000000140072000-memory.dmp

Filesize
3.9MB

Download
memory/2916-438-0x000000013F1C0000-0x000000013F5B2000-memory.dmp

Filesize
3.9MB

Download
memory/2916-1-0x000000013F6B0000-0x000000013FAA2000-memory.dmp

Filesize
3.9MB

Download
memory/2916-439-0x00000000035F0000-0x00000000039E2000-memory.dmp

Filesize
3.9MB

Download
memory/2916-8-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/2916-426-0x00000000035F0000-0x00000000039E2000-memory.dmp

Filesize
3.9MB

Download
memory/2916-418-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download
memory/2916-412-0x00000000035F0000-0x00000000039E2000-memory.dmp

Filesize
3.9MB

Download
memory/2916-355-0x00000000035F0000-0x00000000039E2000-memory.dmp

Filesize
3.9MB

Download
memory/2916-353-0x00000000035F0000-0x00000000039E2000-memory.dmp

Filesize
3.9MB

Download