xmrig | 7e03188111f95eed98c3ccc38232bd44573aa84897a183f476f49dd82008c7bd

Analysis

max time kernel
120s
max time network
116s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 13:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be7712b6ad67434f11f1907acf5c84c0N.exe
Size

916KB
MD5

be7712b6ad67434f11f1907acf5c84c0
SHA1

6dde3ba132777829eaf9daa918cb57fc47aaa063
SHA256

7e03188111f95eed98c3ccc38232bd44573aa84897a183f476f49dd82008c7bd
SHA512

50eef59b60043eaaaf8aa345108545a91e72745998fe0dcb4026736f416261587d8c2a503d6d3f29e4c4d31332318adf138fbdd5c198c564a271d4555ee26fd2
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMzjkE4OpYOjh23:Lz071uv4BPMzsOpS3

Score

10^/10

xmrig execution miner persistence privilege_escalation upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 24 IoCs

miner

resource	yara_rule
behavioral1/memory/2968-188-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	xmrig
behavioral1/memory/2948-214-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	xmrig
behavioral1/memory/1784-204-0x000000013F030000-0x000000013F422000-memory.dmp	xmrig
behavioral1/memory/2340-174-0x000000013F470000-0x000000013F862000-memory.dmp	xmrig
behavioral1/memory/1768-172-0x000000013FC00000-0x000000013FFF2000-memory.dmp	xmrig
behavioral1/memory/1572-170-0x000000013FA90000-0x000000013FE82000-memory.dmp	xmrig
behavioral1/memory/2728-168-0x000000013FC70000-0x0000000140062000-memory.dmp	xmrig
behavioral1/memory/3036-166-0x000000013FA10000-0x000000013FE02000-memory.dmp	xmrig
behavioral1/memory/2548-164-0x000000013FC20000-0x0000000140012000-memory.dmp	xmrig
behavioral1/memory/2672-163-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	xmrig
behavioral1/memory/2308-160-0x000000013FCA0000-0x0000000140092000-memory.dmp	xmrig
behavioral1/memory/2812-16-0x000000013F570000-0x000000013F962000-memory.dmp	xmrig
behavioral1/memory/1572-5365-0x000000013FA90000-0x000000013FE82000-memory.dmp	xmrig
behavioral1/memory/1784-6459-0x000000013F030000-0x000000013F422000-memory.dmp	xmrig
behavioral1/memory/2672-6456-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	xmrig
behavioral1/memory/2340-6478-0x000000013F470000-0x000000013F862000-memory.dmp	xmrig
behavioral1/memory/2948-6487-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	xmrig
behavioral1/memory/3036-6483-0x000000013FA10000-0x000000013FE02000-memory.dmp	xmrig
behavioral1/memory/1768-6535-0x000000013FC00000-0x000000013FFF2000-memory.dmp	xmrig
behavioral1/memory/2548-6537-0x000000013FC20000-0x0000000140012000-memory.dmp	xmrig
behavioral1/memory/2308-6655-0x000000013FCA0000-0x0000000140092000-memory.dmp	xmrig
behavioral1/memory/2812-6671-0x000000013F570000-0x000000013F962000-memory.dmp	xmrig
behavioral1/memory/2968-6536-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	xmrig
behavioral1/memory/2728-6550-0x000000013FC70000-0x0000000140062000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2708	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2812	YDNegng.exe
2948	aIiGBtR.exe
2308	ewlRgJP.exe
2672	zzRaRMW.exe
2548	JJYVrjH.exe
3036	etsqJDf.exe
2728	DmxGeGR.exe
1572	zdqUBrK.exe
1768	TpYgyMI.exe
2340	SJCkGBz.exe
2968	JsVsIbo.exe
1784	JQGbxBa.exe
1188	CYhjOBV.exe
2008	ElWYhLY.exe
2436	DcOXatM.exe
1952	Nczzudf.exe
2840	VgeUuHC.exe
1444	PdlMASN.exe
2380	bkhjIeo.exe
1628	xiUZVPM.exe
2136	qzWQJpu.exe
2264	DPYOsZp.exe
264	trXUXFN.exe
1832	VvUCcys.exe
1384	PyVdyQy.exe
2464	BoxDTax.exe
2360	qbHnZIn.exe
2984	MtrqavY.exe
1636	TMAfKkg.exe
1852	Ykoikld.exe
1544	fTehMGe.exe
2036	EAcqsTR.exe
1980	Mputnno.exe
2992	WEPkvtB.exe
624	TmHoEOQ.exe
1928	IqvnnTF.exe
3048	dbJWQoD.exe
2632	BtTwPNl.exe
1856	cfjDIgu.exe
1696	cAuMAwT.exe
2276	NiQKUUd.exe
288	ANODqJj.exe
2596	JyFqmyX.exe
1492	rXcXqbC.exe
1584	mqZqYeu.exe
864	dexKGJj.exe
328	WCaFbDr.exe
1732	eYQAHBj.exe
2372	sCJTJiH.exe
2244	DsPeHoW.exe
768	kJhxElL.exe
1716	KwKWdlZ.exe
2816	zvAQFCK.exe
1632	sJRWoAi.exe
1296	enGsvUo.exe
2896	CbMgXex.exe
3008	mEFEErw.exe
684	HRGIFkE.exe
1592	DuMeKgc.exe
2056	bnKgkxb.exe
108	HuurdxI.exe
1224	HXkMSyK.exe
2108	gNNDPhi.exe
3056	GpRBSoK.exe

Loads dropped DLL 64 IoCs

pid	Process
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe
2252	be7712b6ad67434f11f1907acf5c84c0N.exe

UPX packed file 59 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000012115-2.dat	upx
behavioral1/memory/2252-6-0x000000013FA70000-0x000000013FE62000-memory.dmp	upx
behavioral1/files/0x0008000000017292-32.dat	upx
behavioral1/files/0x00080000000175e4-41.dat	upx
behavioral1/files/0x0005000000019419-61.dat	upx
behavioral1/files/0x00050000000194d4-74.dat	upx
behavioral1/files/0x0005000000019571-108.dat	upx
behavioral1/files/0x000500000001960a-123.dat	upx
behavioral1/files/0x00050000000195c9-120.dat	upx
behavioral1/files/0x0005000000019612-144.dat	upx
behavioral1/files/0x0005000000019616-157.dat	upx
behavioral1/files/0x0005000000019614-147.dat	upx
behavioral1/files/0x0018000000016dbf-154.dat	upx
behavioral1/memory/2968-188-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	upx
behavioral1/files/0x000500000001961c-185.dat	upx
behavioral1/files/0x0005000000019618-178.dat	upx
behavioral1/files/0x0005000000019610-140.dat	upx
behavioral1/memory/2948-214-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	upx
behavioral1/memory/1784-204-0x000000013F030000-0x000000013F422000-memory.dmp	upx
behavioral1/files/0x000500000001961a-182.dat	upx
behavioral1/memory/2340-174-0x000000013F470000-0x000000013F862000-memory.dmp	upx
behavioral1/memory/1768-172-0x000000013FC00000-0x000000013FFF2000-memory.dmp	upx
behavioral1/memory/1572-170-0x000000013FA90000-0x000000013FE82000-memory.dmp	upx
behavioral1/memory/2728-168-0x000000013FC70000-0x0000000140062000-memory.dmp	upx
behavioral1/memory/3036-166-0x000000013FA10000-0x000000013FE02000-memory.dmp	upx
behavioral1/memory/2548-164-0x000000013FC20000-0x0000000140012000-memory.dmp	upx
behavioral1/memory/2672-163-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/memory/2308-160-0x000000013FCA0000-0x0000000140092000-memory.dmp	upx
behavioral1/files/0x0005000000019615-158.dat	upx
behavioral1/files/0x000500000001960c-130.dat	upx
behavioral1/files/0x000500000001960e-134.dat	upx
behavioral1/files/0x0005000000019557-118.dat	upx
behavioral1/files/0x0005000000019553-105.dat	upx
behavioral1/files/0x0005000000019526-99.dat	upx
behavioral1/files/0x00050000000194f3-86.dat	upx
behavioral1/files/0x00050000000194e0-79.dat	upx
behavioral1/files/0x0005000000019503-91.dat	upx
behavioral1/files/0x00050000000194e9-84.dat	upx
behavioral1/files/0x00050000000194cc-69.dat	upx
behavioral1/files/0x000500000001940f-59.dat	upx
behavioral1/files/0x00050000000193e6-54.dat	upx
behavioral1/files/0x0007000000018716-49.dat	upx
behavioral1/files/0x00070000000175d2-40.dat	upx
behavioral1/files/0x001c000000005591-31.dat	upx
behavioral1/memory/2812-16-0x000000013F570000-0x000000013F962000-memory.dmp	upx
behavioral1/files/0x0008000000016ddf-15.dat	upx
behavioral1/files/0x00070000000170f2-23.dat	upx
behavioral1/memory/1572-5365-0x000000013FA90000-0x000000013FE82000-memory.dmp	upx
behavioral1/memory/1784-6459-0x000000013F030000-0x000000013F422000-memory.dmp	upx
behavioral1/memory/2672-6456-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/memory/2340-6478-0x000000013F470000-0x000000013F862000-memory.dmp	upx
behavioral1/memory/2948-6487-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	upx
behavioral1/memory/3036-6483-0x000000013FA10000-0x000000013FE02000-memory.dmp	upx
behavioral1/memory/1768-6535-0x000000013FC00000-0x000000013FFF2000-memory.dmp	upx
behavioral1/memory/2548-6537-0x000000013FC20000-0x0000000140012000-memory.dmp	upx
behavioral1/memory/2308-6655-0x000000013FCA0000-0x0000000140092000-memory.dmp	upx
behavioral1/memory/2812-6671-0x000000013F570000-0x000000013F962000-memory.dmp	upx
behavioral1/memory/2968-6536-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	upx
behavioral1/memory/2728-6550-0x000000013FC70000-0x0000000140062000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\tRJSooH.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\XEtrZRh.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\sLgUyaf.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\TtnjWza.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\QAuVSgX.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\ZmUdVHy.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\zxpWKXf.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\dyAxkSF.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\qeXTuXx.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\uHxmnNo.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\sxImcIR.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\HWgXZKF.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\FTVtbFm.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\qOhMKFB.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\FJGckFj.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\xoaSHCG.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\XnwjBEf.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\qadZhji.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\BYSJJXy.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\YIEMiCT.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\FdZutzO.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\aQkbOrV.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\RTTSqIF.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\phfLXvM.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\ynXHOpE.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\FOfVDiI.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\uuWnXEm.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\nTMUkuf.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\CNQiAdE.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\hcetSaN.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\zZnYuSO.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\aFKulqr.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\mVZcbiP.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\YjxBehD.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\vbAcAxC.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\FbxNNLK.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\napuTBc.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\jKrmhOQ.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\eKlkIuc.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\UArIjOz.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\rEBqZyg.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\LNkwlDb.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\dLZsMhG.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\fmmLvCA.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\yagJIrO.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\INQQCpA.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\cqAnzTg.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\XugSzSi.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\tIkAvUa.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\gHiGAOC.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\tfDbbuP.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\LqEwEjX.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\XAJbfXO.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\nfUodBN.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\OJfaqzp.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\zAYFKNO.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\CaXCTGE.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\KEYayCp.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\POKMAIc.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\nKmVERn.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\WKUTArE.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\fHaolOf.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\PKpPmSq.exe	be7712b6ad67434f11f1907acf5c84c0N.exe
File created	C:\Windows\System\SuidbeC.exe	be7712b6ad67434f11f1907acf5c84c0N.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2708	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2252	be7712b6ad67434f11f1907acf5c84c0N.exe
Token: SeLockMemoryPrivilege	2252	be7712b6ad67434f11f1907acf5c84c0N.exe
Token: SeDebugPrivilege	2708	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2708	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	31
PID 2252 wrote to memory of 2708	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	31
PID 2252 wrote to memory of 2708	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	31
PID 2252 wrote to memory of 2812	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	32
PID 2252 wrote to memory of 2812	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	32
PID 2252 wrote to memory of 2812	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	32
PID 2252 wrote to memory of 2948	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	33
PID 2252 wrote to memory of 2948	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	33
PID 2252 wrote to memory of 2948	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	33
PID 2252 wrote to memory of 2308	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	34
PID 2252 wrote to memory of 2308	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	34
PID 2252 wrote to memory of 2308	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	34
PID 2252 wrote to memory of 2672	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	35
PID 2252 wrote to memory of 2672	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	35
PID 2252 wrote to memory of 2672	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	35
PID 2252 wrote to memory of 2548	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	36
PID 2252 wrote to memory of 2548	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	36
PID 2252 wrote to memory of 2548	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	36
PID 2252 wrote to memory of 3036	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	37
PID 2252 wrote to memory of 3036	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	37
PID 2252 wrote to memory of 3036	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	37
PID 2252 wrote to memory of 2728	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	38
PID 2252 wrote to memory of 2728	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	38
PID 2252 wrote to memory of 2728	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	38
PID 2252 wrote to memory of 1572	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	39
PID 2252 wrote to memory of 1572	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	39
PID 2252 wrote to memory of 1572	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	39
PID 2252 wrote to memory of 1768	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	40
PID 2252 wrote to memory of 1768	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	40
PID 2252 wrote to memory of 1768	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	40
PID 2252 wrote to memory of 2340	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	41
PID 2252 wrote to memory of 2340	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	41
PID 2252 wrote to memory of 2340	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	41
PID 2252 wrote to memory of 2968	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	42
PID 2252 wrote to memory of 2968	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	42
PID 2252 wrote to memory of 2968	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	42
PID 2252 wrote to memory of 1784	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	43
PID 2252 wrote to memory of 1784	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	43
PID 2252 wrote to memory of 1784	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	43
PID 2252 wrote to memory of 1188	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	44
PID 2252 wrote to memory of 1188	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	44
PID 2252 wrote to memory of 1188	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	44
PID 2252 wrote to memory of 2008	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	45
PID 2252 wrote to memory of 2008	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	45
PID 2252 wrote to memory of 2008	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	45
PID 2252 wrote to memory of 2436	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	46
PID 2252 wrote to memory of 2436	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	46
PID 2252 wrote to memory of 2436	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	46
PID 2252 wrote to memory of 2840	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	47
PID 2252 wrote to memory of 2840	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	47
PID 2252 wrote to memory of 2840	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	47
PID 2252 wrote to memory of 1952	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	48
PID 2252 wrote to memory of 1952	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	48
PID 2252 wrote to memory of 1952	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	48
PID 2252 wrote to memory of 1444	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	49
PID 2252 wrote to memory of 1444	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	49
PID 2252 wrote to memory of 1444	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	49
PID 2252 wrote to memory of 2380	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	50
PID 2252 wrote to memory of 2380	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	50
PID 2252 wrote to memory of 2380	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	50
PID 2252 wrote to memory of 2136	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	51
PID 2252 wrote to memory of 2136	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	51
PID 2252 wrote to memory of 2136	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	51
PID 2252 wrote to memory of 1628	2252	be7712b6ad67434f11f1907acf5c84c0N.exe	52

C:\Users\Admin\AppData\Local\Temp\be7712b6ad67434f11f1907acf5c84c0N.exe
"C:\Users\Admin\AppData\Local\Temp\be7712b6ad67434f11f1907acf5c84c0N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2708
- C:\Windows\System\YDNegng.exe
  C:\Windows\System\YDNegng.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\aIiGBtR.exe
  C:\Windows\System\aIiGBtR.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\ewlRgJP.exe
  C:\Windows\System\ewlRgJP.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\zzRaRMW.exe
  C:\Windows\System\zzRaRMW.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\JJYVrjH.exe
  C:\Windows\System\JJYVrjH.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\etsqJDf.exe
  C:\Windows\System\etsqJDf.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\DmxGeGR.exe
  C:\Windows\System\DmxGeGR.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\zdqUBrK.exe
  C:\Windows\System\zdqUBrK.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\TpYgyMI.exe
  C:\Windows\System\TpYgyMI.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\SJCkGBz.exe
  C:\Windows\System\SJCkGBz.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\JsVsIbo.exe
  C:\Windows\System\JsVsIbo.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\JQGbxBa.exe
  C:\Windows\System\JQGbxBa.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\CYhjOBV.exe
  C:\Windows\System\CYhjOBV.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\ElWYhLY.exe
  C:\Windows\System\ElWYhLY.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\DcOXatM.exe
  C:\Windows\System\DcOXatM.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\VgeUuHC.exe
  C:\Windows\System\VgeUuHC.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\Nczzudf.exe
  C:\Windows\System\Nczzudf.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\PdlMASN.exe
  C:\Windows\System\PdlMASN.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\bkhjIeo.exe
  C:\Windows\System\bkhjIeo.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\qzWQJpu.exe
  C:\Windows\System\qzWQJpu.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\xiUZVPM.exe
  C:\Windows\System\xiUZVPM.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\DPYOsZp.exe
  C:\Windows\System\DPYOsZp.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\trXUXFN.exe
  C:\Windows\System\trXUXFN.exe
  2⤵
  - Executes dropped EXE
  PID:264
- C:\Windows\System\VvUCcys.exe
  C:\Windows\System\VvUCcys.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\PyVdyQy.exe
  C:\Windows\System\PyVdyQy.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\BoxDTax.exe
  C:\Windows\System\BoxDTax.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\qbHnZIn.exe
  C:\Windows\System\qbHnZIn.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\MtrqavY.exe
  C:\Windows\System\MtrqavY.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\TMAfKkg.exe
  C:\Windows\System\TMAfKkg.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\ANODqJj.exe
  C:\Windows\System\ANODqJj.exe
  2⤵
  - Executes dropped EXE
  PID:288
- C:\Windows\System\Ykoikld.exe
  C:\Windows\System\Ykoikld.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\rXcXqbC.exe
  C:\Windows\System\rXcXqbC.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\fTehMGe.exe
  C:\Windows\System\fTehMGe.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\kJhxElL.exe
  C:\Windows\System\kJhxElL.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\EAcqsTR.exe
  C:\Windows\System\EAcqsTR.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\KwKWdlZ.exe
  C:\Windows\System\KwKWdlZ.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\Mputnno.exe
  C:\Windows\System\Mputnno.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\sJRWoAi.exe
  C:\Windows\System\sJRWoAi.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\WEPkvtB.exe
  C:\Windows\System\WEPkvtB.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\pvNdGeV.exe
  C:\Windows\System\pvNdGeV.exe
  2⤵
  PID:3000
- C:\Windows\System\TmHoEOQ.exe
  C:\Windows\System\TmHoEOQ.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\OmQPCwf.exe
  C:\Windows\System\OmQPCwf.exe
  2⤵
  PID:2032
- C:\Windows\System\IqvnnTF.exe
  C:\Windows\System\IqvnnTF.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\oaKCuxp.exe
  C:\Windows\System\oaKCuxp.exe
  2⤵
  PID:2800
- C:\Windows\System\dbJWQoD.exe
  C:\Windows\System\dbJWQoD.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\GgjCFRJ.exe
  C:\Windows\System\GgjCFRJ.exe
  2⤵
  PID:2300
- C:\Windows\System\BtTwPNl.exe
  C:\Windows\System\BtTwPNl.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\wWfILCu.exe
  C:\Windows\System\wWfILCu.exe
  2⤵
  PID:988
- C:\Windows\System\cfjDIgu.exe
  C:\Windows\System\cfjDIgu.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\zWxCumv.exe
  C:\Windows\System\zWxCumv.exe
  2⤵
  PID:868
- C:\Windows\System\cAuMAwT.exe
  C:\Windows\System\cAuMAwT.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\WUPCEzQ.exe
  C:\Windows\System\WUPCEzQ.exe
  2⤵
  PID:1448
- C:\Windows\System\NiQKUUd.exe
  C:\Windows\System\NiQKUUd.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\MyjHZty.exe
  C:\Windows\System\MyjHZty.exe
  2⤵
  PID:1704
- C:\Windows\System\JyFqmyX.exe
  C:\Windows\System\JyFqmyX.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\IZiSANc.exe
  C:\Windows\System\IZiSANc.exe
  2⤵
  PID:2920
- C:\Windows\System\mqZqYeu.exe
  C:\Windows\System\mqZqYeu.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\pEfWXls.exe
  C:\Windows\System\pEfWXls.exe
  2⤵
  PID:2256
- C:\Windows\System\dexKGJj.exe
  C:\Windows\System\dexKGJj.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\hLTDfrU.exe
  C:\Windows\System\hLTDfrU.exe
  2⤵
  PID:2980
- C:\Windows\System\WCaFbDr.exe
  C:\Windows\System\WCaFbDr.exe
  2⤵
  - Executes dropped EXE
  PID:328
- C:\Windows\System\DKTNkgy.exe
  C:\Windows\System\DKTNkgy.exe
  2⤵
  PID:2088
- C:\Windows\System\eYQAHBj.exe
  C:\Windows\System\eYQAHBj.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\eqxMSfi.exe
  C:\Windows\System\eqxMSfi.exe
  2⤵
  PID:1772
- C:\Windows\System\sCJTJiH.exe
  C:\Windows\System\sCJTJiH.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\nOAnCpH.exe
  C:\Windows\System\nOAnCpH.exe
  2⤵
  PID:1348
- C:\Windows\System\DsPeHoW.exe
  C:\Windows\System\DsPeHoW.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\XwmpGKO.exe
  C:\Windows\System\XwmpGKO.exe
  2⤵
  PID:1604
- C:\Windows\System\zvAQFCK.exe
  C:\Windows\System\zvAQFCK.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\jhjpWNK.exe
  C:\Windows\System\jhjpWNK.exe
  2⤵
  PID:2668
- C:\Windows\System\enGsvUo.exe
  C:\Windows\System\enGsvUo.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\oczoIHG.exe
  C:\Windows\System\oczoIHG.exe
  2⤵
  PID:2724
- C:\Windows\System\CbMgXex.exe
  C:\Windows\System\CbMgXex.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\PzauUtr.exe
  C:\Windows\System\PzauUtr.exe
  2⤵
  PID:1640
- C:\Windows\System\mEFEErw.exe
  C:\Windows\System\mEFEErw.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\rqGCaMb.exe
  C:\Windows\System\rqGCaMb.exe
  2⤵
  PID:1684
- C:\Windows\System\HRGIFkE.exe
  C:\Windows\System\HRGIFkE.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\vLPRCXc.exe
  C:\Windows\System\vLPRCXc.exe
  2⤵
  PID:2180
- C:\Windows\System\DuMeKgc.exe
  C:\Windows\System\DuMeKgc.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\IWwAESF.exe
  C:\Windows\System\IWwAESF.exe
  2⤵
  PID:1748
- C:\Windows\System\bnKgkxb.exe
  C:\Windows\System\bnKgkxb.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\REYdgwb.exe
  C:\Windows\System\REYdgwb.exe
  2⤵
  PID:2560
- C:\Windows\System\HuurdxI.exe
  C:\Windows\System\HuurdxI.exe
  2⤵
  - Executes dropped EXE
  PID:108
- C:\Windows\System\HqDdtPh.exe
  C:\Windows\System\HqDdtPh.exe
  2⤵
  PID:1988
- C:\Windows\System\HXkMSyK.exe
  C:\Windows\System\HXkMSyK.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\GDOdTHB.exe
  C:\Windows\System\GDOdTHB.exe
  2⤵
  PID:1900
- C:\Windows\System\gNNDPhi.exe
  C:\Windows\System\gNNDPhi.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\jbUiDYz.exe
  C:\Windows\System\jbUiDYz.exe
  2⤵
  PID:1512
- C:\Windows\System\GpRBSoK.exe
  C:\Windows\System\GpRBSoK.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\onXeRwy.exe
  C:\Windows\System\onXeRwy.exe
  2⤵
  PID:1568
- C:\Windows\System\lmRYeTH.exe
  C:\Windows\System\lmRYeTH.exe
  2⤵
  PID:3076
- C:\Windows\System\WkuTkIg.exe
  C:\Windows\System\WkuTkIg.exe
  2⤵
  PID:3096
- C:\Windows\System\UeCUIQn.exe
  C:\Windows\System\UeCUIQn.exe
  2⤵
  PID:3112
- C:\Windows\System\CUkpVCm.exe
  C:\Windows\System\CUkpVCm.exe
  2⤵
  PID:3136
- C:\Windows\System\unJhtlt.exe
  C:\Windows\System\unJhtlt.exe
  2⤵
  PID:3152
- C:\Windows\System\xUOKzfM.exe
  C:\Windows\System\xUOKzfM.exe
  2⤵
  PID:3168
- C:\Windows\System\GoSwqJF.exe
  C:\Windows\System\GoSwqJF.exe
  2⤵
  PID:3200
- C:\Windows\System\CbDIaOT.exe
  C:\Windows\System\CbDIaOT.exe
  2⤵
  PID:3216
- C:\Windows\System\lYOyBfN.exe
  C:\Windows\System\lYOyBfN.exe
  2⤵
  PID:3232
- C:\Windows\System\tErfmjq.exe
  C:\Windows\System\tErfmjq.exe
  2⤵
  PID:3248
- C:\Windows\System\oQUllJe.exe
  C:\Windows\System\oQUllJe.exe
  2⤵
  PID:3264
- C:\Windows\System\PAYHxRC.exe
  C:\Windows\System\PAYHxRC.exe
  2⤵
  PID:3280
- C:\Windows\System\zKaufJr.exe
  C:\Windows\System\zKaufJr.exe
  2⤵
  PID:3300
- C:\Windows\System\yWMkqHz.exe
  C:\Windows\System\yWMkqHz.exe
  2⤵
  PID:3316
- C:\Windows\System\DIgHwyU.exe
  C:\Windows\System\DIgHwyU.exe
  2⤵
  PID:3332
- C:\Windows\System\JtmpPXX.exe
  C:\Windows\System\JtmpPXX.exe
  2⤵
  PID:3348
- C:\Windows\System\bQZnHmZ.exe
  C:\Windows\System\bQZnHmZ.exe
  2⤵
  PID:3364
- C:\Windows\System\ccmRFuB.exe
  C:\Windows\System\ccmRFuB.exe
  2⤵
  PID:3380
- C:\Windows\System\hMWZEkk.exe
  C:\Windows\System\hMWZEkk.exe
  2⤵
  PID:3396
- C:\Windows\System\ivuuwud.exe
  C:\Windows\System\ivuuwud.exe
  2⤵
  PID:3412
- C:\Windows\System\NJFEewx.exe
  C:\Windows\System\NJFEewx.exe
  2⤵
  PID:3428
- C:\Windows\System\JOPxVMI.exe
  C:\Windows\System\JOPxVMI.exe
  2⤵
  PID:3444
- C:\Windows\System\mJapyEX.exe
  C:\Windows\System\mJapyEX.exe
  2⤵
  PID:3460
- C:\Windows\System\ptVWjUL.exe
  C:\Windows\System\ptVWjUL.exe
  2⤵
  PID:3476
- C:\Windows\System\oenGzMN.exe
  C:\Windows\System\oenGzMN.exe
  2⤵
  PID:3492
- C:\Windows\System\yCIEMIg.exe
  C:\Windows\System\yCIEMIg.exe
  2⤵
  PID:3508
- C:\Windows\System\dRGpsOe.exe
  C:\Windows\System\dRGpsOe.exe
  2⤵
  PID:3524
- C:\Windows\System\ChlgzzT.exe
  C:\Windows\System\ChlgzzT.exe
  2⤵
  PID:3560
- C:\Windows\System\pBjwIsj.exe
  C:\Windows\System\pBjwIsj.exe
  2⤵
  PID:3576
- C:\Windows\System\yRWtArB.exe
  C:\Windows\System\yRWtArB.exe
  2⤵
  PID:3592
- C:\Windows\System\eyqiSch.exe
  C:\Windows\System\eyqiSch.exe
  2⤵
  PID:3608
- C:\Windows\System\vBfFVOB.exe
  C:\Windows\System\vBfFVOB.exe
  2⤵
  PID:3624
- C:\Windows\System\WWabObz.exe
  C:\Windows\System\WWabObz.exe
  2⤵
  PID:3640
- C:\Windows\System\NWfePia.exe
  C:\Windows\System\NWfePia.exe
  2⤵
  PID:3660
- C:\Windows\System\ckVcewA.exe
  C:\Windows\System\ckVcewA.exe
  2⤵
  PID:3676
- C:\Windows\System\ummqpLo.exe
  C:\Windows\System\ummqpLo.exe
  2⤵
  PID:3692
- C:\Windows\System\sRJETlI.exe
  C:\Windows\System\sRJETlI.exe
  2⤵
  PID:3708
- C:\Windows\System\LaBvuhr.exe
  C:\Windows\System\LaBvuhr.exe
  2⤵
  PID:3728
- C:\Windows\System\yKxnuFY.exe
  C:\Windows\System\yKxnuFY.exe
  2⤵
  PID:3744
- C:\Windows\System\EAOgwHh.exe
  C:\Windows\System\EAOgwHh.exe
  2⤵
  PID:3820
- C:\Windows\System\UTWVVFT.exe
  C:\Windows\System\UTWVVFT.exe
  2⤵
  PID:3868
- C:\Windows\System\pDVHbUz.exe
  C:\Windows\System\pDVHbUz.exe
  2⤵
  PID:3888
- C:\Windows\System\sABACPs.exe
  C:\Windows\System\sABACPs.exe
  2⤵
  PID:3912
- C:\Windows\System\dXSfgKC.exe
  C:\Windows\System\dXSfgKC.exe
  2⤵
  PID:3932
- C:\Windows\System\IKilVhc.exe
  C:\Windows\System\IKilVhc.exe
  2⤵
  PID:3948
- C:\Windows\System\xbqdxFl.exe
  C:\Windows\System\xbqdxFl.exe
  2⤵
  PID:3964
- C:\Windows\System\rGzuBkQ.exe
  C:\Windows\System\rGzuBkQ.exe
  2⤵
  PID:3980
- C:\Windows\System\ZMzgUur.exe
  C:\Windows\System\ZMzgUur.exe
  2⤵
  PID:3996
- C:\Windows\System\rsZdXdD.exe
  C:\Windows\System\rsZdXdD.exe
  2⤵
  PID:4012
- C:\Windows\System\wVElrfq.exe
  C:\Windows\System\wVElrfq.exe
  2⤵
  PID:4028
- C:\Windows\System\zWnVxFS.exe
  C:\Windows\System\zWnVxFS.exe
  2⤵
  PID:4044
- C:\Windows\System\MzcQnWa.exe
  C:\Windows\System\MzcQnWa.exe
  2⤵
  PID:4060
- C:\Windows\System\miqAJOU.exe
  C:\Windows\System\miqAJOU.exe
  2⤵
  PID:4076
- C:\Windows\System\eTfmsTT.exe
  C:\Windows\System\eTfmsTT.exe
  2⤵
  PID:4092
- C:\Windows\System\goxPyNt.exe
  C:\Windows\System\goxPyNt.exe
  2⤵
  PID:2312
- C:\Windows\System\vTwTOTJ.exe
  C:\Windows\System\vTwTOTJ.exe
  2⤵
  PID:532
- C:\Windows\System\TAgDVlb.exe
  C:\Windows\System\TAgDVlb.exe
  2⤵
  PID:3084
- C:\Windows\System\lzsNmwR.exe
  C:\Windows\System\lzsNmwR.exe
  2⤵
  PID:3124
- C:\Windows\System\kkazpnX.exe
  C:\Windows\System\kkazpnX.exe
  2⤵
  PID:3160
- C:\Windows\System\vZAzBxv.exe
  C:\Windows\System\vZAzBxv.exe
  2⤵
  PID:1468
- C:\Windows\System\AtRZKcU.exe
  C:\Windows\System\AtRZKcU.exe
  2⤵
  PID:3212
- C:\Windows\System\VDAfMbC.exe
  C:\Windows\System\VDAfMbC.exe
  2⤵
  PID:3272
- C:\Windows\System\OSLwhkH.exe
  C:\Windows\System\OSLwhkH.exe
  2⤵
  PID:1756
- C:\Windows\System\AuvGaoC.exe
  C:\Windows\System\AuvGaoC.exe
  2⤵
  PID:980
- C:\Windows\System\YfcySrv.exe
  C:\Windows\System\YfcySrv.exe
  2⤵
  PID:860
- C:\Windows\System\qVMWLNB.exe
  C:\Windows\System\qVMWLNB.exe
  2⤵
  PID:2772
- C:\Windows\System\aIRFseJ.exe
  C:\Windows\System\aIRFseJ.exe
  2⤵
  PID:2796
- C:\Windows\System\mZMdwrF.exe
  C:\Windows\System\mZMdwrF.exe
  2⤵
  PID:2756
- C:\Windows\System\TLKKKtb.exe
  C:\Windows\System\TLKKKtb.exe
  2⤵
  PID:2344
- C:\Windows\System\YelHWHk.exe
  C:\Windows\System\YelHWHk.exe
  2⤵
  PID:3404
- C:\Windows\System\XvpBLUi.exe
  C:\Windows\System\XvpBLUi.exe
  2⤵
  PID:3468
- C:\Windows\System\zEqcBYC.exe
  C:\Windows\System\zEqcBYC.exe
  2⤵
  PID:3532
- C:\Windows\System\mzpnQZg.exe
  C:\Windows\System\mzpnQZg.exe
  2⤵
  PID:3552
- C:\Windows\System\npCiEtY.exe
  C:\Windows\System\npCiEtY.exe
  2⤵
  PID:3588
- C:\Windows\System\sPwpBsM.exe
  C:\Windows\System\sPwpBsM.exe
  2⤵
  PID:3648
- C:\Windows\System\ddOufmz.exe
  C:\Windows\System\ddOufmz.exe
  2⤵
  PID:3688
- C:\Windows\System\xVweCcN.exe
  C:\Windows\System\xVweCcN.exe
  2⤵
  PID:3752
- C:\Windows\System\aJvnpdb.exe
  C:\Windows\System\aJvnpdb.exe
  2⤵
  PID:3772
- C:\Windows\System\FYstfKh.exe
  C:\Windows\System\FYstfKh.exe
  2⤵
  PID:3788
- C:\Windows\System\NfyEqfS.exe
  C:\Windows\System\NfyEqfS.exe
  2⤵
  PID:3804
- C:\Windows\System\SGBEZrz.exe
  C:\Windows\System\SGBEZrz.exe
  2⤵
  PID:2228
- C:\Windows\System\GQqiELb.exe
  C:\Windows\System\GQqiELb.exe
  2⤵
  PID:2164
- C:\Windows\System\OFtUSaI.exe
  C:\Windows\System\OFtUSaI.exe
  2⤵
  PID:808
- C:\Windows\System\MnIpfXd.exe
  C:\Windows\System\MnIpfXd.exe
  2⤵
  PID:3876
- C:\Windows\System\CQOXiDy.exe
  C:\Windows\System\CQOXiDy.exe
  2⤵
  PID:3928
- C:\Windows\System\pxsuwzh.exe
  C:\Windows\System\pxsuwzh.exe
  2⤵
  PID:3988
- C:\Windows\System\lAkqZsN.exe
  C:\Windows\System\lAkqZsN.exe
  2⤵
  PID:4052
- C:\Windows\System\IzBOCtb.exe
  C:\Windows\System\IzBOCtb.exe
  2⤵
  PID:464
- C:\Windows\System\MYmtbVi.exe
  C:\Windows\System\MYmtbVi.exe
  2⤵
  PID:3164
- C:\Windows\System\AmAOZZp.exe
  C:\Windows\System\AmAOZZp.exe
  2⤵
  PID:2492
- C:\Windows\System\VMakyCH.exe
  C:\Windows\System\VMakyCH.exe
  2⤵
  PID:3340
- C:\Windows\System\bOGnOFl.exe
  C:\Windows\System\bOGnOFl.exe
  2⤵
  PID:3500
- C:\Windows\System\XeFpWlo.exe
  C:\Windows\System\XeFpWlo.exe
  2⤵
  PID:3656
- C:\Windows\System\cdKwCPR.exe
  C:\Windows\System\cdKwCPR.exe
  2⤵
  PID:4124
- C:\Windows\System\kQaUcCw.exe
  C:\Windows\System\kQaUcCw.exe
  2⤵
  PID:4140
- C:\Windows\System\MuhdpVt.exe
  C:\Windows\System\MuhdpVt.exe
  2⤵
  PID:4156
- C:\Windows\System\nCXNZia.exe
  C:\Windows\System\nCXNZia.exe
  2⤵
  PID:4176
- C:\Windows\System\WgHkElO.exe
  C:\Windows\System\WgHkElO.exe
  2⤵
  PID:4192
- C:\Windows\System\iCkUXbQ.exe
  C:\Windows\System\iCkUXbQ.exe
  2⤵
  PID:4348
- C:\Windows\System\LQwGKiK.exe
  C:\Windows\System\LQwGKiK.exe
  2⤵
  PID:4368
- C:\Windows\System\YgNjIIK.exe
  C:\Windows\System\YgNjIIK.exe
  2⤵
  PID:4388
- C:\Windows\System\gpXkYZf.exe
  C:\Windows\System\gpXkYZf.exe
  2⤵
  PID:4404
- C:\Windows\System\ikEVMXh.exe
  C:\Windows\System\ikEVMXh.exe
  2⤵
  PID:4420
- C:\Windows\System\WpuLNei.exe
  C:\Windows\System\WpuLNei.exe
  2⤵
  PID:4436
- C:\Windows\System\RqBsVwg.exe
  C:\Windows\System\RqBsVwg.exe
  2⤵
  PID:4452
- C:\Windows\System\aDsgkGd.exe
  C:\Windows\System\aDsgkGd.exe
  2⤵
  PID:4468
- C:\Windows\System\iFnpJRG.exe
  C:\Windows\System\iFnpJRG.exe
  2⤵
  PID:4484
- C:\Windows\System\mCLwxnk.exe
  C:\Windows\System\mCLwxnk.exe
  2⤵
  PID:4500
- C:\Windows\System\TaaVPKl.exe
  C:\Windows\System\TaaVPKl.exe
  2⤵
  PID:4516
- C:\Windows\System\GJSqxEu.exe
  C:\Windows\System\GJSqxEu.exe
  2⤵
  PID:4536
- C:\Windows\System\yLALzFg.exe
  C:\Windows\System\yLALzFg.exe
  2⤵
  PID:4556
- C:\Windows\System\mMhDfVN.exe
  C:\Windows\System\mMhDfVN.exe
  2⤵
  PID:4572
- C:\Windows\System\cHvCopl.exe
  C:\Windows\System\cHvCopl.exe
  2⤵
  PID:4588
- C:\Windows\System\rtyaYRu.exe
  C:\Windows\System\rtyaYRu.exe
  2⤵
  PID:4612
- C:\Windows\System\kDyLADo.exe
  C:\Windows\System\kDyLADo.exe
  2⤵
  PID:4628
- C:\Windows\System\iwsWIBd.exe
  C:\Windows\System\iwsWIBd.exe
  2⤵
  PID:4672
- C:\Windows\System\CLfcxZO.exe
  C:\Windows\System\CLfcxZO.exe
  2⤵
  PID:4876
- C:\Windows\System\ZsvjrFQ.exe
  C:\Windows\System\ZsvjrFQ.exe
  2⤵
  PID:4896
- C:\Windows\System\WKixJAP.exe
  C:\Windows\System\WKixJAP.exe
  2⤵
  PID:4912
- C:\Windows\System\qlFRSER.exe
  C:\Windows\System\qlFRSER.exe
  2⤵
  PID:4932
- C:\Windows\System\wOfMGbe.exe
  C:\Windows\System\wOfMGbe.exe
  2⤵
  PID:4952
- C:\Windows\System\SunvuNb.exe
  C:\Windows\System\SunvuNb.exe
  2⤵
  PID:4984
- C:\Windows\System\CRAiHOT.exe
  C:\Windows\System\CRAiHOT.exe
  2⤵
  PID:5004
- C:\Windows\System\GZIXQHS.exe
  C:\Windows\System\GZIXQHS.exe
  2⤵
  PID:5020
- C:\Windows\System\bXoZqXM.exe
  C:\Windows\System\bXoZqXM.exe
  2⤵
  PID:5036
- C:\Windows\System\veVMLvk.exe
  C:\Windows\System\veVMLvk.exe
  2⤵
  PID:5052
- C:\Windows\System\hwdKRHB.exe
  C:\Windows\System\hwdKRHB.exe
  2⤵
  PID:5068
- C:\Windows\System\QIrKhhF.exe
  C:\Windows\System\QIrKhhF.exe
  2⤵
  PID:5084
- C:\Windows\System\XJYQvJR.exe
  C:\Windows\System\XJYQvJR.exe
  2⤵
  PID:5100
- C:\Windows\System\FfNvKSw.exe
  C:\Windows\System\FfNvKSw.exe
  2⤵
  PID:5116
- C:\Windows\System\fxxjbyf.exe
  C:\Windows\System\fxxjbyf.exe
  2⤵
  PID:2364
- C:\Windows\System\MgUkrAD.exe
  C:\Windows\System\MgUkrAD.exe
  2⤵
  PID:4116
- C:\Windows\System\GpVmnQS.exe
  C:\Windows\System\GpVmnQS.exe
  2⤵
  PID:4104
- C:\Windows\System\PLdHzqg.exe
  C:\Windows\System\PLdHzqg.exe
  2⤵
  PID:3372
- C:\Windows\System\zEckwuI.exe
  C:\Windows\System\zEckwuI.exe
  2⤵
  PID:4084
- C:\Windows\System\cZuxLRx.exe
  C:\Windows\System\cZuxLRx.exe
  2⤵
  PID:4184
- C:\Windows\System\ARiclIH.exe
  C:\Windows\System\ARiclIH.exe
  2⤵
  PID:2692
- C:\Windows\System\yoUoJbu.exe
  C:\Windows\System\yoUoJbu.exe
  2⤵
  PID:4428
- C:\Windows\System\UmIuamN.exe
  C:\Windows\System\UmIuamN.exe
  2⤵
  PID:3864
- C:\Windows\System\RjTcsnB.exe
  C:\Windows\System\RjTcsnB.exe
  2⤵
  PID:4528
- C:\Windows\System\FKhJSLB.exe
  C:\Windows\System\FKhJSLB.exe
  2⤵
  PID:2204
- C:\Windows\System\wrEbZpX.exe
  C:\Windows\System\wrEbZpX.exe
  2⤵
  PID:2500
- C:\Windows\System\duAVjJw.exe
  C:\Windows\System\duAVjJw.exe
  2⤵
  PID:800
- C:\Windows\System\hiaDzZU.exe
  C:\Windows\System\hiaDzZU.exe
  2⤵
  PID:1984
- C:\Windows\System\lIhmdCE.exe
  C:\Windows\System\lIhmdCE.exe
  2⤵
  PID:680
- C:\Windows\System\SBuKDbl.exe
  C:\Windows\System\SBuKDbl.exe
  2⤵
  PID:3188
- C:\Windows\System\SlcZJpP.exe
  C:\Windows\System\SlcZJpP.exe
  2⤵
  PID:3260
- C:\Windows\System\LxyfuEy.exe
  C:\Windows\System\LxyfuEy.exe
  2⤵
  PID:3360
- C:\Windows\System\WIDBvpM.exe
  C:\Windows\System\WIDBvpM.exe
  2⤵
  PID:3452
- C:\Windows\System\aMngFsK.exe
  C:\Windows\System\aMngFsK.exe
  2⤵
  PID:3520
- C:\Windows\System\PNhFnfs.exe
  C:\Windows\System\PNhFnfs.exe
  2⤵
  PID:3632
- C:\Windows\System\CVfqDWZ.exe
  C:\Windows\System\CVfqDWZ.exe
  2⤵
  PID:3704
- C:\Windows\System\dSSYWgy.exe
  C:\Windows\System\dSSYWgy.exe
  2⤵
  PID:3840
- C:\Windows\System\cbvllGL.exe
  C:\Windows\System\cbvllGL.exe
  2⤵
  PID:2564
- C:\Windows\System\FLjZyAH.exe
  C:\Windows\System\FLjZyAH.exe
  2⤵
  PID:4636
- C:\Windows\System\JVqwErM.exe
  C:\Windows\System\JVqwErM.exe
  2⤵
  PID:2440
- C:\Windows\System\bcmpIyl.exe
  C:\Windows\System\bcmpIyl.exe
  2⤵
  PID:2072
- C:\Windows\System\mkUYawF.exe
  C:\Windows\System\mkUYawF.exe
  2⤵
  PID:1780
- C:\Windows\System\LvBVtjh.exe
  C:\Windows\System\LvBVtjh.exe
  2⤵
  PID:3976
- C:\Windows\System\eKgNGtc.exe
  C:\Windows\System\eKgNGtc.exe
  2⤵
  PID:4668
- C:\Windows\System\wxKUpbg.exe
  C:\Windows\System\wxKUpbg.exe
  2⤵
  PID:2856
- C:\Windows\System\SiSBJbz.exe
  C:\Windows\System\SiSBJbz.exe
  2⤵
  PID:4020
- C:\Windows\System\bDlUfUD.exe
  C:\Windows\System\bDlUfUD.exe
  2⤵
  PID:2484
- C:\Windows\System\yzdQDBK.exe
  C:\Windows\System\yzdQDBK.exe
  2⤵
  PID:3180
- C:\Windows\System\iEUEiLN.exe
  C:\Windows\System\iEUEiLN.exe
  2⤵
  PID:4300
- C:\Windows\System\ZQipECD.exe
  C:\Windows\System\ZQipECD.exe
  2⤵
  PID:3896
- C:\Windows\System\sUhqxhM.exe
  C:\Windows\System\sUhqxhM.exe
  2⤵
  PID:1708
- C:\Windows\System\TeHKUbO.exe
  C:\Windows\System\TeHKUbO.exe
  2⤵
  PID:4136
- C:\Windows\System\iNOPHQA.exe
  C:\Windows\System\iNOPHQA.exe
  2⤵
  PID:4204
- C:\Windows\System\UZCvKbY.exe
  C:\Windows\System\UZCvKbY.exe
  2⤵
  PID:4228
- C:\Windows\System\olSCJxC.exe
  C:\Windows\System\olSCJxC.exe
  2⤵
  PID:4240
- C:\Windows\System\tDIDbzi.exe
  C:\Windows\System\tDIDbzi.exe
  2⤵
  PID:4272
- C:\Windows\System\EIlTRTv.exe
  C:\Windows\System\EIlTRTv.exe
  2⤵
  PID:4308
- C:\Windows\System\DbYsSFT.exe
  C:\Windows\System\DbYsSFT.exe
  2⤵
  PID:4332
- C:\Windows\System\XZhjMmp.exe
  C:\Windows\System\XZhjMmp.exe
  2⤵
  PID:4344
- C:\Windows\System\kYlffyj.exe
  C:\Windows\System\kYlffyj.exe
  2⤵
  PID:4384
- C:\Windows\System\ZXSQLuO.exe
  C:\Windows\System\ZXSQLuO.exe
  2⤵
  PID:4476
- C:\Windows\System\UoCtRQs.exe
  C:\Windows\System\UoCtRQs.exe
  2⤵
  PID:4544
- C:\Windows\System\hTqmVXQ.exe
  C:\Windows\System\hTqmVXQ.exe
  2⤵
  PID:4584
- C:\Windows\System\vTrnJkt.exe
  C:\Windows\System\vTrnJkt.exe
  2⤵
  PID:4004
- C:\Windows\System\dWbrSjw.exe
  C:\Windows\System\dWbrSjw.exe
  2⤵
  PID:2288
- C:\Windows\System\oNgOzFg.exe
  C:\Windows\System\oNgOzFg.exe
  2⤵
  PID:3812
- C:\Windows\System\PuTyPzT.exe
  C:\Windows\System\PuTyPzT.exe
  2⤵
  PID:1100
- C:\Windows\System\EnjlpDN.exe
  C:\Windows\System\EnjlpDN.exe
  2⤵
  PID:3440
- C:\Windows\System\gjruiDb.exe
  C:\Windows\System\gjruiDb.exe
  2⤵
  PID:1816
- C:\Windows\System\tqGEmtB.exe
  C:\Windows\System\tqGEmtB.exe
  2⤵
  PID:3208
- C:\Windows\System\slvfWjG.exe
  C:\Windows\System\slvfWjG.exe
  2⤵
  PID:1500
- C:\Windows\System\zioGfYd.exe
  C:\Windows\System\zioGfYd.exe
  2⤵
  PID:4072
- C:\Windows\System\smXkGaM.exe
  C:\Windows\System\smXkGaM.exe
  2⤵
  PID:4008
- C:\Windows\System\RxkDYdU.exe
  C:\Windows\System\RxkDYdU.exe
  2⤵
  PID:4908
- C:\Windows\System\yUWahWg.exe
  C:\Windows\System\yUWahWg.exe
  2⤵
  PID:4924
- C:\Windows\System\oqIrZQo.exe
  C:\Windows\System\oqIrZQo.exe
  2⤵
  PID:4720
- C:\Windows\System\CSJjXhf.exe
  C:\Windows\System\CSJjXhf.exe
  2⤵
  PID:4736
- C:\Windows\System\BaenWGr.exe
  C:\Windows\System\BaenWGr.exe
  2⤵
  PID:4760
- C:\Windows\System\JyfWvjT.exe
  C:\Windows\System\JyfWvjT.exe
  2⤵
  PID:4776
- C:\Windows\System\NsKlOFt.exe
  C:\Windows\System\NsKlOFt.exe
  2⤵
  PID:4792
- C:\Windows\System\TAUsYnp.exe
  C:\Windows\System\TAUsYnp.exe
  2⤵
  PID:4808
- C:\Windows\System\KYWVSiX.exe
  C:\Windows\System\KYWVSiX.exe
  2⤵
  PID:4828
- C:\Windows\System\AKVjSMH.exe
  C:\Windows\System\AKVjSMH.exe
  2⤵
  PID:4852
- C:\Windows\System\eWcanra.exe
  C:\Windows\System\eWcanra.exe
  2⤵
  PID:4944
- C:\Windows\System\ZMvVkNY.exe
  C:\Windows\System\ZMvVkNY.exe
  2⤵
  PID:4960
- C:\Windows\System\oxitKMG.exe
  C:\Windows\System\oxitKMG.exe
  2⤵
  PID:2316
- C:\Windows\System\sMmImkx.exe
  C:\Windows\System\sMmImkx.exe
  2⤵
  PID:2248
- C:\Windows\System\PfzJGvs.exe
  C:\Windows\System\PfzJGvs.exe
  2⤵
  PID:2532
- C:\Windows\System\UlBLiWW.exe
  C:\Windows\System\UlBLiWW.exe
  2⤵
  PID:1324
- C:\Windows\System\pBqjwDt.exe
  C:\Windows\System\pBqjwDt.exe
  2⤵
  PID:4496
- C:\Windows\System\UBSIfsT.exe
  C:\Windows\System\UBSIfsT.exe
  2⤵
  PID:2580
- C:\Windows\System\xzgTGEu.exe
  C:\Windows\System\xzgTGEu.exe
  2⤵
  PID:1680
- C:\Windows\System\ktmwnaR.exe
  C:\Windows\System\ktmwnaR.exe
  2⤵
  PID:1136
- C:\Windows\System\kQUlmbh.exe
  C:\Windows\System\kQUlmbh.exe
  2⤵
  PID:3052
- C:\Windows\System\HVhObxV.exe
  C:\Windows\System\HVhObxV.exe
  2⤵
  PID:616
- C:\Windows\System\xFenNst.exe
  C:\Windows\System\xFenNst.exe
  2⤵
  PID:5096
- C:\Windows\System\XCWJffj.exe
  C:\Windows\System\XCWJffj.exe
  2⤵
  PID:4108
- C:\Windows\System\PnSrxLC.exe
  C:\Windows\System\PnSrxLC.exe
  2⤵
  PID:3244
- C:\Windows\System\jgVXGJF.exe
  C:\Windows\System\jgVXGJF.exe
  2⤵
  PID:3108
- C:\Windows\System\pKGwXOK.exe
  C:\Windows\System\pKGwXOK.exe
  2⤵
  PID:4564
- C:\Windows\System\FbTQWop.exe
  C:\Windows\System\FbTQWop.exe
  2⤵
  PID:3184
- C:\Windows\System\yexUJeu.exe
  C:\Windows\System\yexUJeu.exe
  2⤵
  PID:3324
- C:\Windows\System\FBNJxDO.exe
  C:\Windows\System\FBNJxDO.exe
  2⤵
  PID:3296
- C:\Windows\System\hBtpDMZ.exe
  C:\Windows\System\hBtpDMZ.exe
  2⤵
  PID:3424
- C:\Windows\System\JcmvmbA.exe
  C:\Windows\System\JcmvmbA.exe
  2⤵
  PID:2576
- C:\Windows\System\AXfwYvv.exe
  C:\Windows\System\AXfwYvv.exe
  2⤵
  PID:3516
- C:\Windows\System\VLfUzgD.exe
  C:\Windows\System\VLfUzgD.exe
  2⤵
  PID:3600
- C:\Windows\System\IWAzmLy.exe
  C:\Windows\System\IWAzmLy.exe
  2⤵
  PID:4608
- C:\Windows\System\xgiHYNG.exe
  C:\Windows\System\xgiHYNG.exe
  2⤵
  PID:4656
- C:\Windows\System\DLAxDhx.exe
  C:\Windows\System\DLAxDhx.exe
  2⤵
  PID:1228
- C:\Windows\System\pordkyE.exe
  C:\Windows\System\pordkyE.exe
  2⤵
  PID:2404
- C:\Windows\System\okttETj.exe
  C:\Windows\System\okttETj.exe
  2⤵
  PID:4660
- C:\Windows\System\eLKwvui.exe
  C:\Windows\System\eLKwvui.exe
  2⤵
  PID:2928
- C:\Windows\System\SqWHONZ.exe
  C:\Windows\System\SqWHONZ.exe
  2⤵
  PID:2752
- C:\Windows\System\NBmeDGz.exe
  C:\Windows\System\NBmeDGz.exe
  2⤵
  PID:3908
- C:\Windows\System\ZaJBgSp.exe
  C:\Windows\System\ZaJBgSp.exe
  2⤵
  PID:4448
- C:\Windows\System\ozlzUun.exe
  C:\Windows\System\ozlzUun.exe
  2⤵
  PID:3584
- C:\Windows\System\hoABHsk.exe
  C:\Windows\System\hoABHsk.exe
  2⤵
  PID:4212
- C:\Windows\System\uVCUgji.exe
  C:\Windows\System\uVCUgji.exe
  2⤵
  PID:4244
- C:\Windows\System\KOYNZXO.exe
  C:\Windows\System\KOYNZXO.exe
  2⤵
  PID:4288
- C:\Windows\System\csrADXr.exe
  C:\Windows\System\csrADXr.exe
  2⤵
  PID:4316
- C:\Windows\System\MlCvenw.exe
  C:\Windows\System\MlCvenw.exe
  2⤵
  PID:4380
- C:\Windows\System\LJCRaDn.exe
  C:\Windows\System\LJCRaDn.exe
  2⤵
  PID:4508
- C:\Windows\System\ywFvxsI.exe
  C:\Windows\System\ywFvxsI.exe
  2⤵
  PID:3724
- C:\Windows\System\aVmiVRu.exe
  C:\Windows\System\aVmiVRu.exe
  2⤵
  PID:2760
- C:\Windows\System\cYyfaRC.exe
  C:\Windows\System\cYyfaRC.exe
  2⤵
  PID:3920
- C:\Windows\System\uXjBAUM.exe
  C:\Windows\System\uXjBAUM.exe
  2⤵
  PID:4928
- C:\Windows\System\SvxXaGe.exe
  C:\Windows\System\SvxXaGe.exe
  2⤵
  PID:4772
- C:\Windows\System\tqOcmAY.exe
  C:\Windows\System\tqOcmAY.exe
  2⤵
  PID:4848
- C:\Windows\System\DueoaKf.exe
  C:\Windows\System\DueoaKf.exe
  2⤵
  PID:2924
- C:\Windows\System\qTTJyao.exe
  C:\Windows\System\qTTJyao.exe
  2⤵
  PID:4892
- C:\Windows\System\HIOYNTs.exe
  C:\Windows\System\HIOYNTs.exe
  2⤵
  PID:2400
- C:\Windows\System\Estkngk.exe
  C:\Windows\System\Estkngk.exe
  2⤵
  PID:4716
- C:\Windows\System\DEowrFN.exe
  C:\Windows\System\DEowrFN.exe
  2⤵
  PID:2572
- C:\Windows\System\jdIYnJF.exe
  C:\Windows\System\jdIYnJF.exe
  2⤵
  PID:4820
- C:\Windows\System\rhOMOle.exe
  C:\Windows\System\rhOMOle.exe
  2⤵
  PID:444
- C:\Windows\System\MTQhSsy.exe
  C:\Windows\System\MTQhSsy.exe
  2⤵
  PID:1048
- C:\Windows\System\bszJPJk.exe
  C:\Windows\System\bszJPJk.exe
  2⤵
  PID:4688
- C:\Windows\System\ppWtlFt.exe
  C:\Windows\System\ppWtlFt.exe
  2⤵
  PID:2304
- C:\Windows\System\gkvcgNt.exe
  C:\Windows\System\gkvcgNt.exe
  2⤵
  PID:3784
- C:\Windows\System\lrHzdSo.exe
  C:\Windows\System\lrHzdSo.exe
  2⤵
  PID:4996
- C:\Windows\System\YcVSNRk.exe
  C:\Windows\System\YcVSNRk.exe
  2⤵
  PID:5048
- C:\Windows\System\rTBByyT.exe
  C:\Windows\System\rTBByyT.exe
  2⤵
  PID:1956
- C:\Windows\System\rGgiZVs.exe
  C:\Windows\System\rGgiZVs.exe
  2⤵
  PID:3956
- C:\Windows\System\qVShSRi.exe
  C:\Windows\System\qVShSRi.exe
  2⤵
  PID:3376
- C:\Windows\System\pItHvEB.exe
  C:\Windows\System\pItHvEB.exe
  2⤵
  PID:5012
- C:\Windows\System\fKmoEhM.exe
  C:\Windows\System\fKmoEhM.exe
  2⤵
  PID:1940
- C:\Windows\System\sKiEFiL.exe
  C:\Windows\System\sKiEFiL.exe
  2⤵
  PID:2020
- C:\Windows\System\jOmYBoV.exe
  C:\Windows\System\jOmYBoV.exe
  2⤵
  PID:1548
- C:\Windows\System\jfDIgBz.exe
  C:\Windows\System\jfDIgBz.exe
  2⤵
  PID:2528
- C:\Windows\System\cWRGMhs.exe
  C:\Windows\System\cWRGMhs.exe
  2⤵
  PID:5064
- C:\Windows\System\LQTIQPo.exe
  C:\Windows\System\LQTIQPo.exe
  2⤵
  PID:2452
- C:\Windows\System\ZFhfiED.exe
  C:\Windows\System\ZFhfiED.exe
  2⤵
  PID:3292
- C:\Windows\System\mvUoVCL.exe
  C:\Windows\System\mvUoVCL.exe
  2⤵
  PID:3392
- C:\Windows\System\omEinDs.exe
  C:\Windows\System\omEinDs.exe
  2⤵
  PID:3224
- C:\Windows\System\FtfYUta.exe
  C:\Windows\System\FtfYUta.exe
  2⤵
  PID:3488
- C:\Windows\System\zJNLwrE.exe
  C:\Windows\System\zJNLwrE.exe
  2⤵
  PID:3884
- C:\Windows\System\ctpPafe.exe
  C:\Windows\System\ctpPafe.exe
  2⤵
  PID:2000
- C:\Windows\System\kNKzHMa.exe
  C:\Windows\System\kNKzHMa.exe
  2⤵
  PID:1648
- C:\Windows\System\NSqyMco.exe
  C:\Windows\System\NSqyMco.exe
  2⤵
  PID:1808
- C:\Windows\System\fVJongr.exe
  C:\Windows\System\fVJongr.exe
  2⤵
  PID:4224
- C:\Windows\System\ctzCnTB.exe
  C:\Windows\System\ctzCnTB.exe
  2⤵
  PID:1080
- C:\Windows\System\ZAEwgMS.exe
  C:\Windows\System\ZAEwgMS.exe
  2⤵
  PID:4292
- C:\Windows\System\skFisbX.exe
  C:\Windows\System\skFisbX.exe
  2⤵
  PID:4132
- C:\Windows\System\OUxNFug.exe
  C:\Windows\System\OUxNFug.exe
  2⤵
  PID:4164
- C:\Windows\System\XfDZaqu.exe
  C:\Windows\System\XfDZaqu.exe
  2⤵
  PID:4376
- C:\Windows\System\BnYHxIH.exe
  C:\Windows\System\BnYHxIH.exe
  2⤵
  PID:2660
- C:\Windows\System\MLjjuoO.exe
  C:\Windows\System\MLjjuoO.exe
  2⤵
  PID:4036
- C:\Windows\System\VKNEEvF.exe
  C:\Windows\System\VKNEEvF.exe
  2⤵
  PID:2468
- C:\Windows\System\CxTdIAx.exe
  C:\Windows\System\CxTdIAx.exe
  2⤵
  PID:4712
- C:\Windows\System\VyVbNNu.exe
  C:\Windows\System\VyVbNNu.exe
  2⤵
  PID:2748
- C:\Windows\System\axhIwCn.exe
  C:\Windows\System\axhIwCn.exe
  2⤵
  PID:2556
- C:\Windows\System\yGyDZJi.exe
  C:\Windows\System\yGyDZJi.exe
  2⤵
  PID:5044
- C:\Windows\System\DhtzYaI.exe
  C:\Windows\System\DhtzYaI.exe
  2⤵
  PID:3148
- C:\Windows\System\vwSPodO.exe
  C:\Windows\System\vwSPodO.exe
  2⤵
  PID:3604
- C:\Windows\System\zTMgZRZ.exe
  C:\Windows\System\zTMgZRZ.exe
  2⤵
  PID:3740
- C:\Windows\System\UWHCssX.exe
  C:\Windows\System\UWHCssX.exe
  2⤵
  PID:4640
- C:\Windows\System\DJvtWGH.exe
  C:\Windows\System\DJvtWGH.exe
  2⤵
  PID:2148
- C:\Windows\System\PwXoRgA.exe
  C:\Windows\System\PwXoRgA.exe
  2⤵
  PID:2844
- C:\Windows\System\PKUNYHU.exe
  C:\Windows\System\PKUNYHU.exe
  2⤵
  PID:2964
- C:\Windows\System\BwUsueJ.exe
  C:\Windows\System\BwUsueJ.exe
  2⤵
  PID:4276
- C:\Windows\System\wFkyhlG.exe
  C:\Windows\System\wFkyhlG.exe
  2⤵
  PID:4768
- C:\Windows\System\xJrOCCl.exe
  C:\Windows\System\xJrOCCl.exe
  2⤵
  PID:816
- C:\Windows\System\BynabKj.exe
  C:\Windows\System\BynabKj.exe
  2⤵
  PID:3544
- C:\Windows\System\aBkXJfP.exe
  C:\Windows\System\aBkXJfP.exe
  2⤵
  PID:4648
- C:\Windows\System\OqpSkzD.exe
  C:\Windows\System\OqpSkzD.exe
  2⤵
  PID:748
- C:\Windows\System\wDZSkoW.exe
  C:\Windows\System\wDZSkoW.exe
  2⤵
  PID:4112
- C:\Windows\System\gLzcCIQ.exe
  C:\Windows\System\gLzcCIQ.exe
  2⤵
  PID:4968
- C:\Windows\System\XkjdEpd.exe
  C:\Windows\System\XkjdEpd.exe
  2⤵
  PID:2852
- C:\Windows\System\NddEobV.exe
  C:\Windows\System\NddEobV.exe
  2⤵
  PID:2156
- C:\Windows\System\LSCBhkj.exe
  C:\Windows\System\LSCBhkj.exe
  2⤵
  PID:5108
- C:\Windows\System\PtWNjzQ.exe
  C:\Windows\System\PtWNjzQ.exe
  2⤵
  PID:1532
- C:\Windows\System\YpcIWiN.exe
  C:\Windows\System\YpcIWiN.exe
  2⤵
  PID:3944
- C:\Windows\System\qKVkDdq.exe
  C:\Windows\System\qKVkDdq.exe
  2⤵
  PID:2432
- C:\Windows\System\rHRndou.exe
  C:\Windows\System\rHRndou.exe
  2⤵
  PID:3768
- C:\Windows\System\ilTVwBO.exe
  C:\Windows\System\ilTVwBO.exe
  2⤵
  PID:1844
- C:\Windows\System\phfLXvM.exe
  C:\Windows\System\phfLXvM.exe
  2⤵
  PID:2504
- C:\Windows\System\ODleLYm.exe
  C:\Windows\System\ODleLYm.exe
  2⤵
  PID:3828
- C:\Windows\System\dBVJvIy.exe
  C:\Windows\System\dBVJvIy.exe
  2⤵
  PID:4172
- C:\Windows\System\pmIQpiE.exe
  C:\Windows\System\pmIQpiE.exe
  2⤵
  PID:4264
- C:\Windows\System\xqRqGad.exe
  C:\Windows\System\xqRqGad.exe
  2⤵
  PID:3672
- C:\Windows\System\imMlUnn.exe
  C:\Windows\System\imMlUnn.exe
  2⤵
  PID:4624
- C:\Windows\System\uZBeRTq.exe
  C:\Windows\System\uZBeRTq.exe
  2⤵
  PID:4844
- C:\Windows\System\klXnVDa.exe
  C:\Windows\System\klXnVDa.exe
  2⤵
  PID:3756
- C:\Windows\System\ZjbLJdo.exe
  C:\Windows\System\ZjbLJdo.exe
  2⤵
  PID:628
- C:\Windows\System\tzUjghd.exe
  C:\Windows\System\tzUjghd.exe
  2⤵
  PID:4120
- C:\Windows\System\BLFlWbB.exe
  C:\Windows\System\BLFlWbB.exe
  2⤵
  PID:4552
- C:\Windows\System\YKhkUYh.exe
  C:\Windows\System\YKhkUYh.exe
  2⤵
  PID:5136
- C:\Windows\System\YTXdnPt.exe
  C:\Windows\System\YTXdnPt.exe
  2⤵
  PID:5212
- C:\Windows\System\cEQeLvy.exe
  C:\Windows\System\cEQeLvy.exe
  2⤵
  PID:5228
- C:\Windows\System\pwRPBGh.exe
  C:\Windows\System\pwRPBGh.exe
  2⤵
  PID:5244
- C:\Windows\System\GKyilbf.exe
  C:\Windows\System\GKyilbf.exe
  2⤵
  PID:5260
- C:\Windows\System\YrqfpAE.exe
  C:\Windows\System\YrqfpAE.exe
  2⤵
  PID:5276
- C:\Windows\System\pfTuyNZ.exe
  C:\Windows\System\pfTuyNZ.exe
  2⤵
  PID:5292
- C:\Windows\System\gbFVMTz.exe
  C:\Windows\System\gbFVMTz.exe
  2⤵
  PID:5308
- C:\Windows\System\VvZOCym.exe
  C:\Windows\System\VvZOCym.exe
  2⤵
  PID:5324
- C:\Windows\System\ELfCGeC.exe
  C:\Windows\System\ELfCGeC.exe
  2⤵
  PID:5340
- C:\Windows\System\vkENvvI.exe
  C:\Windows\System\vkENvvI.exe
  2⤵
  PID:5356
- C:\Windows\System\ndRmPJK.exe
  C:\Windows\System\ndRmPJK.exe
  2⤵
  PID:5372
- C:\Windows\System\ZWfpbkK.exe
  C:\Windows\System\ZWfpbkK.exe
  2⤵
  PID:5388
- C:\Windows\System\exRGmCr.exe
  C:\Windows\System\exRGmCr.exe
  2⤵
  PID:5404
- C:\Windows\System\CDGPlaU.exe
  C:\Windows\System\CDGPlaU.exe
  2⤵
  PID:5420
- C:\Windows\System\poxFpYn.exe
  C:\Windows\System\poxFpYn.exe
  2⤵
  PID:5436
- C:\Windows\System\cJtLDwV.exe
  C:\Windows\System\cJtLDwV.exe
  2⤵
  PID:5452
- C:\Windows\System\luStwJF.exe
  C:\Windows\System\luStwJF.exe
  2⤵
  PID:5468
- C:\Windows\System\hPluDZn.exe
  C:\Windows\System\hPluDZn.exe
  2⤵
  PID:5484
- C:\Windows\System\puefHuB.exe
  C:\Windows\System\puefHuB.exe
  2⤵
  PID:5500
- C:\Windows\System\Wxqcgdu.exe
  C:\Windows\System\Wxqcgdu.exe
  2⤵
  PID:5608
- C:\Windows\System\KEYayCp.exe
  C:\Windows\System\KEYayCp.exe
  2⤵
  PID:5624
- C:\Windows\System\tpAknpo.exe
  C:\Windows\System\tpAknpo.exe
  2⤵
  PID:5640
- C:\Windows\System\CQAIoyB.exe
  C:\Windows\System\CQAIoyB.exe
  2⤵
  PID:5656
- C:\Windows\System\RiNxhVx.exe
  C:\Windows\System\RiNxhVx.exe
  2⤵
  PID:5708
- C:\Windows\System\XpwPamS.exe
  C:\Windows\System\XpwPamS.exe
  2⤵
  PID:5724
- C:\Windows\System\lrBvbGh.exe
  C:\Windows\System\lrBvbGh.exe
  2⤵
  PID:5740
- C:\Windows\System\zaJLXJi.exe
  C:\Windows\System\zaJLXJi.exe
  2⤵
  PID:5760
- C:\Windows\System\gEoPggv.exe
  C:\Windows\System\gEoPggv.exe
  2⤵
  PID:5776
- C:\Windows\System\gpsTkzi.exe
  C:\Windows\System\gpsTkzi.exe
  2⤵
  PID:5792
- C:\Windows\System\xJlPuQg.exe
  C:\Windows\System\xJlPuQg.exe
  2⤵
  PID:5808
- C:\Windows\System\BYSJJXy.exe
  C:\Windows\System\BYSJJXy.exe
  2⤵
  PID:5824
- C:\Windows\System\BnbKeiQ.exe
  C:\Windows\System\BnbKeiQ.exe
  2⤵
  PID:5840
- C:\Windows\System\JEgLiam.exe
  C:\Windows\System\JEgLiam.exe
  2⤵
  PID:5856
- C:\Windows\System\kelcxYs.exe
  C:\Windows\System\kelcxYs.exe
  2⤵
  PID:5872
- C:\Windows\System\UEaxOBC.exe
  C:\Windows\System\UEaxOBC.exe
  2⤵
  PID:5888
- C:\Windows\System\FicmRVx.exe
  C:\Windows\System\FicmRVx.exe
  2⤵
  PID:5904
- C:\Windows\System\vGwxCjO.exe
  C:\Windows\System\vGwxCjO.exe
  2⤵
  PID:5920
- C:\Windows\System\FkzhiNV.exe
  C:\Windows\System\FkzhiNV.exe
  2⤵
  PID:5960
- C:\Windows\System\XYKFpLm.exe
  C:\Windows\System\XYKFpLm.exe
  2⤵
  PID:5976
- C:\Windows\System\aYFBVax.exe
  C:\Windows\System\aYFBVax.exe
  2⤵
  PID:5992
- C:\Windows\System\ycoqHTZ.exe
  C:\Windows\System\ycoqHTZ.exe
  2⤵
  PID:6008
- C:\Windows\System\HnKKQdV.exe
  C:\Windows\System\HnKKQdV.exe
  2⤵
  PID:6028
- C:\Windows\System\MHjVaoX.exe
  C:\Windows\System\MHjVaoX.exe
  2⤵
  PID:6044
- C:\Windows\System\KeBuBJb.exe
  C:\Windows\System\KeBuBJb.exe
  2⤵
  PID:6060
- C:\Windows\System\JiBRZXb.exe
  C:\Windows\System\JiBRZXb.exe
  2⤵
  PID:6076
- C:\Windows\System\AoPrtAC.exe
  C:\Windows\System\AoPrtAC.exe
  2⤵
  PID:6096
- C:\Windows\System\chFlsNV.exe
  C:\Windows\System\chFlsNV.exe
  2⤵
  PID:6112
- C:\Windows\System\nNaBYJP.exe
  C:\Windows\System\nNaBYJP.exe
  2⤵
  PID:6132
- C:\Windows\System\lUpvnmX.exe
  C:\Windows\System\lUpvnmX.exe
  2⤵
  PID:3548
- C:\Windows\System\ZxiwqyL.exe
  C:\Windows\System\ZxiwqyL.exe
  2⤵
  PID:1364
- C:\Windows\System\HHHIcBy.exe
  C:\Windows\System\HHHIcBy.exe
  2⤵
  PID:5156
- C:\Windows\System\FqQJEwL.exe
  C:\Windows\System\FqQJEwL.exe
  2⤵
  PID:5176
- C:\Windows\System\GpDqVvD.exe
  C:\Windows\System\GpDqVvD.exe
  2⤵
  PID:5132
- C:\Windows\System\IUhzgwc.exe
  C:\Windows\System\IUhzgwc.exe
  2⤵
  PID:4872
- C:\Windows\System\ncAUhCj.exe
  C:\Windows\System\ncAUhCj.exe
  2⤵
  PID:3092
- C:\Windows\System\ocpPsmk.exe
  C:\Windows\System\ocpPsmk.exe
  2⤵
  PID:5188
- C:\Windows\System\ISxcfYB.exe
  C:\Windows\System\ISxcfYB.exe
  2⤵
  PID:5204
- C:\Windows\System\McyVwWq.exe
  C:\Windows\System\McyVwWq.exe
  2⤵
  PID:5200
- C:\Windows\System\RVrWZlp.exe
  C:\Windows\System\RVrWZlp.exe
  2⤵
  PID:5220
- C:\Windows\System\AeAhJfe.exe
  C:\Windows\System\AeAhJfe.exe
  2⤵
  PID:5348
- C:\Windows\System\cHLkbOX.exe
  C:\Windows\System\cHLkbOX.exe
  2⤵
  PID:5412
- C:\Windows\System\YjynoTM.exe
  C:\Windows\System\YjynoTM.exe
  2⤵
  PID:5400
- C:\Windows\System\DXFqFhD.exe
  C:\Windows\System\DXFqFhD.exe
  2⤵
  PID:5224
- C:\Windows\System\rjFmAAO.exe
  C:\Windows\System\rjFmAAO.exe
  2⤵
  PID:5464
- C:\Windows\System\vzrThJE.exe
  C:\Windows\System\vzrThJE.exe
  2⤵
  PID:5284
- C:\Windows\System\vstdYZb.exe
  C:\Windows\System\vstdYZb.exe
  2⤵
  PID:5480
- C:\Windows\System\RnwtTrs.exe
  C:\Windows\System\RnwtTrs.exe
  2⤵
  PID:5252
- C:\Windows\System\oePhbqO.exe
  C:\Windows\System\oePhbqO.exe
  2⤵
  PID:5496
- C:\Windows\System\GMLvaiL.exe
  C:\Windows\System\GMLvaiL.exe
  2⤵
  PID:5536
- C:\Windows\System\hsKvrlY.exe
  C:\Windows\System\hsKvrlY.exe
  2⤵
  PID:5552
- C:\Windows\System\dUOoHDk.exe
  C:\Windows\System\dUOoHDk.exe
  2⤵
  PID:5568
- C:\Windows\System\FobucJY.exe
  C:\Windows\System\FobucJY.exe
  2⤵
  PID:5588
- C:\Windows\System\ZDlHrbn.exe
  C:\Windows\System\ZDlHrbn.exe
  2⤵
  PID:5616
- C:\Windows\System\pZmXQhw.exe
  C:\Windows\System\pZmXQhw.exe
  2⤵
  PID:5632
- C:\Windows\System\kFwtHHp.exe
  C:\Windows\System\kFwtHHp.exe
  2⤵
  PID:5600
- C:\Windows\System\hfcjxsc.exe
  C:\Windows\System\hfcjxsc.exe
  2⤵
  PID:5664
- C:\Windows\System\yNhezvN.exe
  C:\Windows\System\yNhezvN.exe
  2⤵
  PID:5700
- C:\Windows\System\PbZVJMD.exe
  C:\Windows\System\PbZVJMD.exe
  2⤵
  PID:5716
- C:\Windows\System\KbhIGGi.exe
  C:\Windows\System\KbhIGGi.exe
  2⤵
  PID:5832
- C:\Windows\System\UeenDXD.exe
  C:\Windows\System\UeenDXD.exe
  2⤵
  PID:5852
- C:\Windows\System\BQTJUGn.exe
  C:\Windows\System\BQTJUGn.exe
  2⤵
  PID:5720
- C:\Windows\System\ztMjlgw.exe
  C:\Windows\System\ztMjlgw.exe
  2⤵
  PID:5928
- C:\Windows\System\fycRerJ.exe
  C:\Windows\System\fycRerJ.exe
  2⤵
  PID:5864
- C:\Windows\System\hhEcJmp.exe
  C:\Windows\System\hhEcJmp.exe
  2⤵
  PID:5896
- C:\Windows\System\DkAYRXO.exe
  C:\Windows\System\DkAYRXO.exe
  2⤵
  PID:5948
- C:\Windows\System\GZbmEUm.exe
  C:\Windows\System\GZbmEUm.exe
  2⤵
  PID:6108
- C:\Windows\System\ylNDtKR.exe
  C:\Windows\System\ylNDtKR.exe
  2⤵
  PID:6036
- C:\Windows\System\zXtpwVx.exe
  C:\Windows\System\zXtpwVx.exe
  2⤵
  PID:6020
- C:\Windows\System\oqFRByI.exe
  C:\Windows\System\oqFRByI.exe
  2⤵
  PID:6016
- C:\Windows\System\rBnpXGl.exe
  C:\Windows\System\rBnpXGl.exe
  2⤵
  PID:1336
- C:\Windows\System\IzNficL.exe
  C:\Windows\System\IzNficL.exe
  2⤵
  PID:4600
- C:\Windows\System\bvraLKi.exe
  C:\Windows\System\bvraLKi.exe
  2⤵
  PID:5144
- C:\Windows\System\xaEQtGA.exe
  C:\Windows\System\xaEQtGA.exe
  2⤵
  PID:4732
- C:\Windows\System\letLnMK.exe
  C:\Windows\System\letLnMK.exe
  2⤵
  PID:5196
- C:\Windows\System\fgbkpqR.exe
  C:\Windows\System\fgbkpqR.exe
  2⤵
  PID:5380
- C:\Windows\System\JRArUsY.exe
  C:\Windows\System\JRArUsY.exe
  2⤵
  PID:5304
- C:\Windows\System\bPAjrUS.exe
  C:\Windows\System\bPAjrUS.exe
  2⤵
  PID:5396
- C:\Windows\System\xUkMtgc.exe
  C:\Windows\System\xUkMtgc.exe
  2⤵
  PID:5516
- C:\Windows\System\HOswkpt.exe
  C:\Windows\System\HOswkpt.exe
  2⤵
  PID:5528
- C:\Windows\System\LaqzoYG.exe
  C:\Windows\System\LaqzoYG.exe
  2⤵
  PID:5564
- C:\Windows\System\dzendhW.exe
  C:\Windows\System\dzendhW.exe
  2⤵
  PID:5676
- C:\Windows\System\UYWzItc.exe
  C:\Windows\System\UYWzItc.exe
  2⤵
  PID:5800
- C:\Windows\System\ZDFxqqL.exe
  C:\Windows\System\ZDFxqqL.exe
  2⤵
  PID:5912
- C:\Windows\System\mLmjnwQ.exe
  C:\Windows\System\mLmjnwQ.exe
  2⤵
  PID:5972
- C:\Windows\System\QwjKGuA.exe
  C:\Windows\System\QwjKGuA.exe
  2⤵
  PID:5508
- C:\Windows\System\BMgWaYT.exe
  C:\Windows\System\BMgWaYT.exe
  2⤵
  PID:6068
- C:\Windows\System\qohPNzM.exe
  C:\Windows\System\qohPNzM.exe
  2⤵
  PID:5648
- C:\Windows\System\dhtABsR.exe
  C:\Windows\System\dhtABsR.exe
  2⤵
  PID:6084
- C:\Windows\System\eQRxRLN.exe
  C:\Windows\System\eQRxRLN.exe
  2⤵
  PID:4304
- C:\Windows\System\ahIlPYU.exe
  C:\Windows\System\ahIlPYU.exe
  2⤵
  PID:5184
- C:\Windows\System\ZQJqKnO.exe
  C:\Windows\System\ZQJqKnO.exe
  2⤵
  PID:5820
- C:\Windows\System\MaBNCCg.exe
  C:\Windows\System\MaBNCCg.exe
  2⤵
  PID:5804
- C:\Windows\System\kCREoPC.exe
  C:\Windows\System\kCREoPC.exe
  2⤵
  PID:5432
- C:\Windows\System\NVfdHQE.exe
  C:\Windows\System\NVfdHQE.exe
  2⤵
  PID:5848
- C:\Windows\System\EOoXzPS.exe
  C:\Windows\System\EOoXzPS.exe
  2⤵
  PID:5160
- C:\Windows\System\weLfbZY.exe
  C:\Windows\System\weLfbZY.exe
  2⤵
  PID:5868
- C:\Windows\System\fdwexux.exe
  C:\Windows\System\fdwexux.exe
  2⤵
  PID:5548
- C:\Windows\System\nLNKZeD.exe
  C:\Windows\System\nLNKZeD.exe
  2⤵
  PID:5636
- C:\Windows\System\SvgflFD.exe
  C:\Windows\System\SvgflFD.exe
  2⤵
  PID:5448
- C:\Windows\System\WoVkbVI.exe
  C:\Windows\System\WoVkbVI.exe
  2⤵
  PID:5268
- C:\Windows\System\qYkCzVO.exe
  C:\Windows\System\qYkCzVO.exe
  2⤵
  PID:6056
- C:\Windows\System\rSxVlrr.exe
  C:\Windows\System\rSxVlrr.exe
  2⤵
  PID:5988
- C:\Windows\System\fAAZxzV.exe
  C:\Windows\System\fAAZxzV.exe
  2⤵
  PID:6140
- C:\Windows\System\AneZSpx.exe
  C:\Windows\System\AneZSpx.exe
  2⤵
  PID:5772
- C:\Windows\System\szJdXUJ.exe
  C:\Windows\System\szJdXUJ.exe
  2⤵
  PID:6092
- C:\Windows\System\tlfSHyo.exe
  C:\Windows\System\tlfSHyo.exe
  2⤵
  PID:2388
- C:\Windows\System\ynXHOpE.exe
  C:\Windows\System\ynXHOpE.exe
  2⤵
  PID:5092
- C:\Windows\System\AKQirSZ.exe
  C:\Windows\System\AKQirSZ.exe
  2⤵
  PID:5364
- C:\Windows\System\ZhWUGis.exe
  C:\Windows\System\ZhWUGis.exe
  2⤵
  PID:6120
- C:\Windows\System\vHjxoTy.exe
  C:\Windows\System\vHjxoTy.exe
  2⤵
  PID:5256
- C:\Windows\System\DoKWSbf.exe
  C:\Windows\System\DoKWSbf.exe
  2⤵
  PID:6156
- C:\Windows\System\SVFtLLs.exe
  C:\Windows\System\SVFtLLs.exe
  2⤵
  PID:6172
- C:\Windows\System\ItVjKtl.exe
  C:\Windows\System\ItVjKtl.exe
  2⤵
  PID:6188
- C:\Windows\System\jzIiJVR.exe
  C:\Windows\System\jzIiJVR.exe
  2⤵
  PID:6204
- C:\Windows\System\BlIQrYt.exe
  C:\Windows\System\BlIQrYt.exe
  2⤵
  PID:6224
- C:\Windows\System\kyEZKcU.exe
  C:\Windows\System\kyEZKcU.exe
  2⤵
  PID:6240
- C:\Windows\System\IQWPHkA.exe
  C:\Windows\System\IQWPHkA.exe
  2⤵
  PID:6256
- C:\Windows\System\LNMWQJL.exe
  C:\Windows\System\LNMWQJL.exe
  2⤵
  PID:6272
- C:\Windows\System\PLYaXFJ.exe
  C:\Windows\System\PLYaXFJ.exe
  2⤵
  PID:6288
- C:\Windows\System\dDLGBCW.exe
  C:\Windows\System\dDLGBCW.exe
  2⤵
  PID:6304
- C:\Windows\System\uZPiNyu.exe
  C:\Windows\System\uZPiNyu.exe
  2⤵
  PID:6320
- C:\Windows\System\VNwzULP.exe
  C:\Windows\System\VNwzULP.exe
  2⤵
  PID:6336
- C:\Windows\System\kpybcZN.exe
  C:\Windows\System\kpybcZN.exe
  2⤵
  PID:6352
- C:\Windows\System\qkjuSmS.exe
  C:\Windows\System\qkjuSmS.exe
  2⤵
  PID:6368
- C:\Windows\System\XADHZOP.exe
  C:\Windows\System\XADHZOP.exe
  2⤵
  PID:6384
- C:\Windows\System\wKogVlI.exe
  C:\Windows\System\wKogVlI.exe
  2⤵
  PID:6400
- C:\Windows\System\APlNZIC.exe
  C:\Windows\System\APlNZIC.exe
  2⤵
  PID:6416
- C:\Windows\System\RlwshLn.exe
  C:\Windows\System\RlwshLn.exe
  2⤵
  PID:6432
- C:\Windows\System\owlKaKR.exe
  C:\Windows\System\owlKaKR.exe
  2⤵
  PID:6452
- C:\Windows\System\wbGLdTm.exe
  C:\Windows\System\wbGLdTm.exe
  2⤵
  PID:6468
- C:\Windows\System\HqwmIYQ.exe
  C:\Windows\System\HqwmIYQ.exe
  2⤵
  PID:6484
- C:\Windows\System\ciJEgwa.exe
  C:\Windows\System\ciJEgwa.exe
  2⤵
  PID:6500
- C:\Windows\System\LNKuTJU.exe
  C:\Windows\System\LNKuTJU.exe
  2⤵
  PID:6516
- C:\Windows\System\imfUeco.exe
  C:\Windows\System\imfUeco.exe
  2⤵
  PID:6532
- C:\Windows\System\anoBAEx.exe
  C:\Windows\System\anoBAEx.exe
  2⤵
  PID:6552
- C:\Windows\System\FdAyTvh.exe
  C:\Windows\System\FdAyTvh.exe
  2⤵
  PID:6568
- C:\Windows\System\TQwyojm.exe
  C:\Windows\System\TQwyojm.exe
  2⤵
  PID:6584
- C:\Windows\System\zNDRxNU.exe
  C:\Windows\System\zNDRxNU.exe
  2⤵
  PID:6600
- C:\Windows\System\iMxDzLA.exe
  C:\Windows\System\iMxDzLA.exe
  2⤵
  PID:6620
- C:\Windows\System\XlBipYl.exe
  C:\Windows\System\XlBipYl.exe
  2⤵
  PID:6636
- C:\Windows\System\gLGtRtP.exe
  C:\Windows\System\gLGtRtP.exe
  2⤵
  PID:6652
- C:\Windows\System\fBZwYan.exe
  C:\Windows\System\fBZwYan.exe
  2⤵
  PID:6668
- C:\Windows\System\QGqnjpy.exe
  C:\Windows\System\QGqnjpy.exe
  2⤵
  PID:6684
- C:\Windows\System\dFkdJmJ.exe
  C:\Windows\System\dFkdJmJ.exe
  2⤵
  PID:6700
- C:\Windows\System\nTACeiG.exe
  C:\Windows\System\nTACeiG.exe
  2⤵
  PID:6716
- C:\Windows\System\heTcqZp.exe
  C:\Windows\System\heTcqZp.exe
  2⤵
  PID:6732
- C:\Windows\System\suuxKmr.exe
  C:\Windows\System\suuxKmr.exe
  2⤵
  PID:6748
- C:\Windows\System\PwbDGfI.exe
  C:\Windows\System\PwbDGfI.exe
  2⤵
  PID:6764
- C:\Windows\System\QCaOYlf.exe
  C:\Windows\System\QCaOYlf.exe
  2⤵
  PID:6780
- C:\Windows\System\LESHCNo.exe
  C:\Windows\System\LESHCNo.exe
  2⤵
  PID:6796
- C:\Windows\System\GmBwfrX.exe
  C:\Windows\System\GmBwfrX.exe
  2⤵
  PID:6812
- C:\Windows\System\HXGHstu.exe
  C:\Windows\System\HXGHstu.exe
  2⤵
  PID:6828
- C:\Windows\System\gtBefUd.exe
  C:\Windows\System\gtBefUd.exe
  2⤵
  PID:6844
- C:\Windows\System\KvtKpQa.exe
  C:\Windows\System\KvtKpQa.exe
  2⤵
  PID:6860
- C:\Windows\System\iaDwBfm.exe
  C:\Windows\System\iaDwBfm.exe
  2⤵
  PID:6876
- C:\Windows\System\DJIfvHF.exe
  C:\Windows\System\DJIfvHF.exe
  2⤵
  PID:6892
- C:\Windows\System\dZNoUri.exe
  C:\Windows\System\dZNoUri.exe
  2⤵
  PID:6908
- C:\Windows\System\MwqmmsM.exe
  C:\Windows\System\MwqmmsM.exe
  2⤵
  PID:6924
- C:\Windows\System\HqZsKUk.exe
  C:\Windows\System\HqZsKUk.exe
  2⤵
  PID:6940
- C:\Windows\System\vebdYgX.exe
  C:\Windows\System\vebdYgX.exe
  2⤵
  PID:6956
- C:\Windows\System\wNNvkpu.exe
  C:\Windows\System\wNNvkpu.exe
  2⤵
  PID:6972
- C:\Windows\System\NvvpKRL.exe
  C:\Windows\System\NvvpKRL.exe
  2⤵
  PID:6988
- C:\Windows\System\MiNKXpt.exe
  C:\Windows\System\MiNKXpt.exe
  2⤵
  PID:7008
- C:\Windows\System\CtAAell.exe
  C:\Windows\System\CtAAell.exe
  2⤵
  PID:7024
- C:\Windows\System\qHGaMCM.exe
  C:\Windows\System\qHGaMCM.exe
  2⤵
  PID:7040
- C:\Windows\System\GTlHJBv.exe
  C:\Windows\System\GTlHJBv.exe
  2⤵
  PID:7056
- C:\Windows\System\mckGOMN.exe
  C:\Windows\System\mckGOMN.exe
  2⤵
  PID:7076
- C:\Windows\System\hntRdkz.exe
  C:\Windows\System\hntRdkz.exe
  2⤵
  PID:7092
- C:\Windows\System\wOMrxXv.exe
  C:\Windows\System\wOMrxXv.exe
  2⤵
  PID:7108
- C:\Windows\System\stvLjcZ.exe
  C:\Windows\System\stvLjcZ.exe
  2⤵
  PID:7124
- C:\Windows\System\syexVnQ.exe
  C:\Windows\System\syexVnQ.exe
  2⤵
  PID:7140
- C:\Windows\System\fKLIrFx.exe
  C:\Windows\System\fKLIrFx.exe
  2⤵
  PID:7156
- C:\Windows\System\AxAwori.exe
  C:\Windows\System\AxAwori.exe
  2⤵
  PID:6180
- C:\Windows\System\qKqqJLd.exe
  C:\Windows\System\qKqqJLd.exe
  2⤵
  PID:6216
- C:\Windows\System\fjjaQrc.exe
  C:\Windows\System\fjjaQrc.exe
  2⤵
  PID:5368
- C:\Windows\System\sksVKpt.exe
  C:\Windows\System\sksVKpt.exe
  2⤵
  PID:5736
- C:\Windows\System\eeEssDu.exe
  C:\Windows\System\eeEssDu.exe
  2⤵
  PID:5784
- C:\Windows\System\QktgXAm.exe
  C:\Windows\System\QktgXAm.exe
  2⤵
  PID:5672
- C:\Windows\System\KyjVWjE.exe
  C:\Windows\System\KyjVWjE.exe
  2⤵
  PID:6380
- C:\Windows\System\IevzRyZ.exe
  C:\Windows\System\IevzRyZ.exe
  2⤵
  PID:6444
- C:\Windows\System\RTOiYtq.exe
  C:\Windows\System\RTOiYtq.exe
  2⤵
  PID:5520
- C:\Windows\System\RBPGdnZ.exe
  C:\Windows\System\RBPGdnZ.exe
  2⤵
  PID:6508
- C:\Windows\System\ommuAeu.exe
  C:\Windows\System\ommuAeu.exe
  2⤵
  PID:6164
- C:\Windows\System\CfeVnOD.exe
  C:\Windows\System\CfeVnOD.exe
  2⤵
  PID:6580
- C:\Windows\System\dMPQqiK.exe
  C:\Windows\System\dMPQqiK.exe
  2⤵
  PID:6608
- C:\Windows\System\KgOOsJZ.exe
  C:\Windows\System\KgOOsJZ.exe
  2⤵
  PID:6296
- C:\Windows\System\dDMrVqn.exe
  C:\Windows\System\dDMrVqn.exe
  2⤵
  PID:6332
- C:\Windows\System\DMnLuMC.exe
  C:\Windows\System\DMnLuMC.exe
  2⤵
  PID:6392
- C:\Windows\System\jiWhWaI.exe
  C:\Windows\System\jiWhWaI.exe
  2⤵
  PID:6464
- C:\Windows\System\WuthbYb.exe
  C:\Windows\System\WuthbYb.exe
  2⤵
  PID:6528
- C:\Windows\System\qadsZBc.exe
  C:\Windows\System\qadsZBc.exe
  2⤵
  PID:6592
- C:\Windows\System\olMMLDo.exe
  C:\Windows\System\olMMLDo.exe
  2⤵
  PID:6708
- C:\Windows\System\FrYxWLs.exe
  C:\Windows\System\FrYxWLs.exe
  2⤵
  PID:6596
- C:\Windows\System\tGUnCJq.exe
  C:\Windows\System\tGUnCJq.exe
  2⤵
  PID:6804
- C:\Windows\System\LKnepDy.exe
  C:\Windows\System\LKnepDy.exe
  2⤵
  PID:6756
- C:\Windows\System\kSLtvXk.exe
  C:\Windows\System\kSLtvXk.exe
  2⤵
  PID:6872
- C:\Windows\System\PNmNSPJ.exe
  C:\Windows\System\PNmNSPJ.exe
  2⤵
  PID:6936
- C:\Windows\System\BrfgjjC.exe
  C:\Windows\System\BrfgjjC.exe
  2⤵
  PID:7000
- C:\Windows\System\fzumeTF.exe
  C:\Windows\System\fzumeTF.exe
  2⤵
  PID:6692
- C:\Windows\System\Praipdz.exe
  C:\Windows\System\Praipdz.exe
  2⤵
  PID:7036
- C:\Windows\System\VxNFpFL.exe
  C:\Windows\System\VxNFpFL.exe
  2⤵
  PID:7068
- C:\Windows\System\gmRtLRw.exe
  C:\Windows\System\gmRtLRw.exe
  2⤵
  PID:6792
- C:\Windows\System\IXRLrpF.exe
  C:\Windows\System\IXRLrpF.exe
  2⤵
  PID:6148
- C:\Windows\System\nCpMXtI.exe
  C:\Windows\System\nCpMXtI.exe
  2⤵
  PID:6152
- C:\Windows\System\jdQKPKt.exe
  C:\Windows\System\jdQKPKt.exe
  2⤵
  PID:6888
- C:\Windows\System\AVOhhBV.exe
  C:\Windows\System\AVOhhBV.exe
  2⤵
  PID:6248
- C:\Windows\System\LXyHhNv.exe
  C:\Windows\System\LXyHhNv.exe
  2⤵
  PID:7048
- C:\Windows\System\LvssdZE.exe
  C:\Windows\System\LvssdZE.exe
  2⤵
  PID:6884
- C:\Windows\System\lwMVVQZ.exe
  C:\Windows\System\lwMVVQZ.exe
  2⤵
  PID:6212
- C:\Windows\System\wWczMEr.exe
  C:\Windows\System\wWczMEr.exe
  2⤵
  PID:5936
- C:\Windows\System\PoMyzvf.exe
  C:\Windows\System\PoMyzvf.exe
  2⤵
  PID:6316
- C:\Windows\System\bvWCkFh.exe
  C:\Windows\System\bvWCkFh.exe
  2⤵
  PID:5560
- C:\Windows\System\GOfzzUA.exe
  C:\Windows\System\GOfzzUA.exe
  2⤵
  PID:6544
- C:\Windows\System\VgihMcz.exe
  C:\Windows\System\VgihMcz.exe
  2⤵
  PID:6460
- C:\Windows\System\MKVMWqK.exe
  C:\Windows\System\MKVMWqK.exe
  2⤵
  PID:6564
- C:\Windows\System\WJQLlzT.exe
  C:\Windows\System\WJQLlzT.exe
  2⤵
  PID:6696
- C:\Windows\System\SaHwffB.exe
  C:\Windows\System\SaHwffB.exe
  2⤵
  PID:6664
- C:\Windows\System\PXUtTke.exe
  C:\Windows\System\PXUtTke.exe
  2⤵
  PID:6476
- C:\Windows\System\cQCanNa.exe
  C:\Windows\System\cQCanNa.exe
  2⤵
  PID:6824
- C:\Windows\System\dOaLBjE.exe
  C:\Windows\System\dOaLBjE.exe
  2⤵
  PID:6980
- C:\Windows\System\QhEqpLb.exe
  C:\Windows\System\QhEqpLb.exe
  2⤵
  PID:6512
- C:\Windows\System\giGAAVX.exe
  C:\Windows\System\giGAAVX.exe
  2⤵
  PID:6632
- C:\Windows\System\lUoFFMS.exe
  C:\Windows\System\lUoFFMS.exe
  2⤵
  PID:6548
- C:\Windows\System\WioIPcu.exe
  C:\Windows\System\WioIPcu.exe
  2⤵
  PID:6840
- C:\Windows\System\VUMcsXP.exe
  C:\Windows\System\VUMcsXP.exe
  2⤵
  PID:6496
- C:\Windows\System\tltlTvo.exe
  C:\Windows\System\tltlTvo.exe
  2⤵
  PID:6772
- C:\Windows\System\LIPiXDT.exe
  C:\Windows\System\LIPiXDT.exe
  2⤵
  PID:6724
- C:\Windows\System\ckeXCEw.exe
  C:\Windows\System\ckeXCEw.exe
  2⤵
  PID:6852
- C:\Windows\System\rMMgZmX.exe
  C:\Windows\System\rMMgZmX.exe
  2⤵
  PID:7088
- C:\Windows\System\ZneRzVn.exe
  C:\Windows\System\ZneRzVn.exe
  2⤵
  PID:6328
- C:\Windows\System\gKESuFT.exe
  C:\Windows\System\gKESuFT.exe
  2⤵
  PID:6808
- C:\Windows\System\FuxFLNQ.exe
  C:\Windows\System\FuxFLNQ.exe
  2⤵
  PID:6856
- C:\Windows\System\vJwShNn.exe
  C:\Windows\System\vJwShNn.exe
  2⤵
  PID:6644
- C:\Windows\System\ljufjOA.exe
  C:\Windows\System\ljufjOA.exe
  2⤵
  PID:6364
- C:\Windows\System\ndeziuD.exe
  C:\Windows\System\ndeziuD.exe
  2⤵
  PID:6996
- C:\Windows\System\gsstyXq.exe
  C:\Windows\System\gsstyXq.exe
  2⤵
  PID:6744
- C:\Windows\System\WyGGqgE.exe
  C:\Windows\System\WyGGqgE.exe
  2⤵
  PID:7176
- C:\Windows\System\aYGPZlH.exe
  C:\Windows\System\aYGPZlH.exe
  2⤵
  PID:7192
- C:\Windows\System\RXvgSnq.exe
  C:\Windows\System\RXvgSnq.exe
  2⤵
  PID:7208
- C:\Windows\System\uCwqmpO.exe
  C:\Windows\System\uCwqmpO.exe
  2⤵
  PID:7228
- C:\Windows\System\sOglMJe.exe
  C:\Windows\System\sOglMJe.exe
  2⤵
  PID:7244
- C:\Windows\System\qTZsePx.exe
  C:\Windows\System\qTZsePx.exe
  2⤵
  PID:7260
- C:\Windows\System\fmkSqLb.exe
  C:\Windows\System\fmkSqLb.exe
  2⤵
  PID:7276
- C:\Windows\System\bbXbnwm.exe
  C:\Windows\System\bbXbnwm.exe
  2⤵
  PID:7292
- C:\Windows\System\wvpXNRq.exe
  C:\Windows\System\wvpXNRq.exe
  2⤵
  PID:7308
- C:\Windows\System\qNkigmO.exe
  C:\Windows\System\qNkigmO.exe
  2⤵
  PID:7324
- C:\Windows\System\bHXVQSA.exe
  C:\Windows\System\bHXVQSA.exe
  2⤵
  PID:7340
- C:\Windows\System\jfDFPvD.exe
  C:\Windows\System\jfDFPvD.exe
  2⤵
  PID:7356
- C:\Windows\System\NvfeJUK.exe
  C:\Windows\System\NvfeJUK.exe
  2⤵
  PID:7372
- C:\Windows\System\RVDVoPP.exe
  C:\Windows\System\RVDVoPP.exe
  2⤵
  PID:7388
- C:\Windows\System\HNIozIA.exe
  C:\Windows\System\HNIozIA.exe
  2⤵
  PID:7404
- C:\Windows\System\uBXfOyb.exe
  C:\Windows\System\uBXfOyb.exe
  2⤵
  PID:7420
- C:\Windows\System\NWFxHJt.exe
  C:\Windows\System\NWFxHJt.exe
  2⤵
  PID:7436
- C:\Windows\System\TDAwYki.exe
  C:\Windows\System\TDAwYki.exe
  2⤵
  PID:7452
- C:\Windows\System\jXTuwOf.exe
  C:\Windows\System\jXTuwOf.exe
  2⤵
  PID:7468
- C:\Windows\System\HUZRfsU.exe
  C:\Windows\System\HUZRfsU.exe
  2⤵
  PID:7484
- C:\Windows\System\eqzZPNe.exe
  C:\Windows\System\eqzZPNe.exe
  2⤵
  PID:7500
- C:\Windows\System\UnRNPbw.exe
  C:\Windows\System\UnRNPbw.exe
  2⤵
  PID:7516
- C:\Windows\System\waQPUUE.exe
  C:\Windows\System\waQPUUE.exe
  2⤵
  PID:7532
- C:\Windows\System\JQVBXyb.exe
  C:\Windows\System\JQVBXyb.exe
  2⤵
  PID:7548
- C:\Windows\System\irJHYaO.exe
  C:\Windows\System\irJHYaO.exe
  2⤵
  PID:7564
- C:\Windows\System\AQhMuAr.exe
  C:\Windows\System\AQhMuAr.exe
  2⤵
  PID:7580
- C:\Windows\System\BKnJNBt.exe
  C:\Windows\System\BKnJNBt.exe
  2⤵
  PID:7596
- C:\Windows\System\iVEXGUL.exe
  C:\Windows\System\iVEXGUL.exe
  2⤵
  PID:7612
- C:\Windows\System\byIghRb.exe
  C:\Windows\System\byIghRb.exe
  2⤵
  PID:7628
- C:\Windows\System\mgqcxAJ.exe
  C:\Windows\System\mgqcxAJ.exe
  2⤵
  PID:7644
- C:\Windows\System\zdFgtBG.exe
  C:\Windows\System\zdFgtBG.exe
  2⤵
  PID:7660
- C:\Windows\System\BpUFRJz.exe
  C:\Windows\System\BpUFRJz.exe
  2⤵
  PID:7676
- C:\Windows\System\PJJZdOA.exe
  C:\Windows\System\PJJZdOA.exe
  2⤵
  PID:7692
- C:\Windows\System\qqdHIBm.exe
  C:\Windows\System\qqdHIBm.exe
  2⤵
  PID:7708
- C:\Windows\System\oaiDrot.exe
  C:\Windows\System\oaiDrot.exe
  2⤵
  PID:7724
- C:\Windows\System\uJsvDpu.exe
  C:\Windows\System\uJsvDpu.exe
  2⤵
  PID:7740
- C:\Windows\System\zkVJxzu.exe
  C:\Windows\System\zkVJxzu.exe
  2⤵
  PID:7756
- C:\Windows\System\iLAYrTu.exe
  C:\Windows\System\iLAYrTu.exe
  2⤵
  PID:7776
- C:\Windows\System\uePwrLt.exe
  C:\Windows\System\uePwrLt.exe
  2⤵
  PID:7796
- C:\Windows\System\QrNwrvE.exe
  C:\Windows\System\QrNwrvE.exe
  2⤵
  PID:7812
- C:\Windows\System\PHksFWe.exe
  C:\Windows\System\PHksFWe.exe
  2⤵
  PID:7828
- C:\Windows\System\XYjvlwu.exe
  C:\Windows\System\XYjvlwu.exe
  2⤵
  PID:7844
- C:\Windows\System\YcQJMUj.exe
  C:\Windows\System\YcQJMUj.exe
  2⤵
  PID:7860
- C:\Windows\System\QuTzBny.exe
  C:\Windows\System\QuTzBny.exe
  2⤵
  PID:7876
- C:\Windows\System\wjKqFAU.exe
  C:\Windows\System\wjKqFAU.exe
  2⤵
  PID:7892
- C:\Windows\System\zpHzZoL.exe
  C:\Windows\System\zpHzZoL.exe
  2⤵
  PID:7908
- C:\Windows\System\WSexWIs.exe
  C:\Windows\System\WSexWIs.exe
  2⤵
  PID:7924
- C:\Windows\System\FYqTjns.exe
  C:\Windows\System\FYqTjns.exe
  2⤵
  PID:7940
- C:\Windows\System\mYJPKqu.exe
  C:\Windows\System\mYJPKqu.exe
  2⤵
  PID:7956
- C:\Windows\System\MwnzHJV.exe
  C:\Windows\System\MwnzHJV.exe
  2⤵
  PID:7972
- C:\Windows\System\hLvIdRq.exe
  C:\Windows\System\hLvIdRq.exe
  2⤵
  PID:7992
- C:\Windows\System\StCzIWj.exe
  C:\Windows\System\StCzIWj.exe
  2⤵
  PID:8008
- C:\Windows\System\qrdWjiu.exe
  C:\Windows\System\qrdWjiu.exe
  2⤵
  PID:8024
- C:\Windows\System\XZiBxxj.exe
  C:\Windows\System\XZiBxxj.exe
  2⤵
  PID:8040
- C:\Windows\System\uWejtrB.exe
  C:\Windows\System\uWejtrB.exe
  2⤵
  PID:8056
- C:\Windows\System\BxEYGag.exe
  C:\Windows\System\BxEYGag.exe
  2⤵
  PID:8072
- C:\Windows\System\fvYRNKX.exe
  C:\Windows\System\fvYRNKX.exe
  2⤵
  PID:8088
- C:\Windows\System\IkwPjjG.exe
  C:\Windows\System\IkwPjjG.exe
  2⤵
  PID:8104
- C:\Windows\System\YRyJDdv.exe
  C:\Windows\System\YRyJDdv.exe
  2⤵
  PID:8120
- C:\Windows\System\yWPfjTM.exe
  C:\Windows\System\yWPfjTM.exe
  2⤵
  PID:8136
- C:\Windows\System\zDlhQIH.exe
  C:\Windows\System\zDlhQIH.exe
  2⤵
  PID:8152
- C:\Windows\System\NqsZvDf.exe
  C:\Windows\System\NqsZvDf.exe
  2⤵
  PID:8168
- C:\Windows\System\JrPyRmN.exe
  C:\Windows\System\JrPyRmN.exe
  2⤵
  PID:8184
- C:\Windows\System\PYpJGZA.exe
  C:\Windows\System\PYpJGZA.exe
  2⤵
  PID:7172
- C:\Windows\System\KYmPEUw.exe
  C:\Windows\System\KYmPEUw.exe
  2⤵
  PID:6676
- C:\Windows\System\GybNfVv.exe
  C:\Windows\System\GybNfVv.exe
  2⤵
  PID:7016
- C:\Windows\System\tlyMsal.exe
  C:\Windows\System\tlyMsal.exe
  2⤵
  PID:7300
- C:\Windows\System\xQVQJGZ.exe
  C:\Windows\System\xQVQJGZ.exe
  2⤵
  PID:7336
- C:\Windows\System\WxanWSd.exe
  C:\Windows\System\WxanWSd.exe
  2⤵
  PID:7400
- C:\Windows\System\PXRfUeQ.exe
  C:\Windows\System\PXRfUeQ.exe
  2⤵
  PID:7464
- C:\Windows\System\EFpshiR.exe
  C:\Windows\System\EFpshiR.exe
  2⤵
  PID:6376
- C:\Windows\System\ceRKWth.exe
  C:\Windows\System\ceRKWth.exe
  2⤵
  PID:7528
- C:\Windows\System\OJzrJVm.exe
  C:\Windows\System\OJzrJVm.exe
  2⤵
  PID:7620
- C:\Windows\System\dkhemrL.exe
  C:\Windows\System\dkhemrL.exe
  2⤵
  PID:7684
- C:\Windows\System\IujCJvo.exe
  C:\Windows\System\IujCJvo.exe
  2⤵
  PID:6440
- C:\Windows\System\biMRVhG.exe
  C:\Windows\System\biMRVhG.exe
  2⤵
  PID:7184
- C:\Windows\System\FxQwSHU.exe
  C:\Windows\System\FxQwSHU.exe
  2⤵
  PID:7224
- C:\Windows\System\evzeQUH.exe
  C:\Windows\System\evzeQUH.exe
  2⤵
  PID:7256
- C:\Windows\System\BWclQcE.exe
  C:\Windows\System\BWclQcE.exe
  2⤵
  PID:7508
- C:\Windows\System\eohqhEi.exe
  C:\Windows\System\eohqhEi.exe
  2⤵
  PID:7636
- C:\Windows\System\yjyHwAB.exe
  C:\Windows\System\yjyHwAB.exe
  2⤵
  PID:7820
- C:\Windows\System\lLrzWeX.exe
  C:\Windows\System\lLrzWeX.exe
  2⤵
  PID:7384
- C:\Windows\System\OJimPyr.exe
  C:\Windows\System\OJimPyr.exe
  2⤵
  PID:7448
- C:\Windows\System\jzUDyfT.exe
  C:\Windows\System\jzUDyfT.exe
  2⤵
  PID:7544
- C:\Windows\System\MhodjNH.exe
  C:\Windows\System\MhodjNH.exe
  2⤵
  PID:7668
- C:\Windows\System\tVWWsYb.exe
  C:\Windows\System\tVWWsYb.exe
  2⤵
  PID:7824
- C:\Windows\System\FGuAxTp.exe
  C:\Windows\System\FGuAxTp.exe
  2⤵
  PID:7836
- C:\Windows\System\oXeASQz.exe
  C:\Windows\System\oXeASQz.exe
  2⤵
  PID:7808
- C:\Windows\System\HjHcHLh.exe
  C:\Windows\System\HjHcHLh.exe
  2⤵
  PID:7920
- C:\Windows\System\rgIpreT.exe
  C:\Windows\System\rgIpreT.exe
  2⤵
  PID:7900
- C:\Windows\System\uiDbwYb.exe
  C:\Windows\System\uiDbwYb.exe
  2⤵
  PID:7868
- C:\Windows\System\lKoJFpr.exe
  C:\Windows\System\lKoJFpr.exe
  2⤵
  PID:8052
- C:\Windows\System\tqnzGTi.exe
  C:\Windows\System\tqnzGTi.exe
  2⤵
  PID:8116
- C:\Windows\System\mwquXTi.exe
  C:\Windows\System\mwquXTi.exe
  2⤵
  PID:8000
- C:\Windows\System\ijrquiW.exe
  C:\Windows\System\ijrquiW.exe
  2⤵
  PID:8176
- C:\Windows\System\yxigrUM.exe
  C:\Windows\System\yxigrUM.exe
  2⤵
  PID:7236
- C:\Windows\System\yvhznCo.exe
  C:\Windows\System\yvhznCo.exe
  2⤵
  PID:8100
- C:\Windows\System\EmVJpED.exe
  C:\Windows\System\EmVJpED.exe
  2⤵
  PID:5692
- C:\Windows\System\bnJlGDJ.exe
  C:\Windows\System\bnJlGDJ.exe
  2⤵
  PID:7588
- C:\Windows\System\UvGHebX.exe
  C:\Windows\System\UvGHebX.exe
  2⤵
  PID:7592
- C:\Windows\System\eHnhRJH.exe
  C:\Windows\System\eHnhRJH.exe
  2⤵
  PID:7716
- C:\Windows\System\dyrhBND.exe
  C:\Windows\System\dyrhBND.exe
  2⤵
  PID:7104
- C:\Windows\System\pQPWZgb.exe
  C:\Windows\System\pQPWZgb.exe
  2⤵
  PID:7652
- C:\Windows\System\wVXEZYD.exe
  C:\Windows\System\wVXEZYD.exe
  2⤵
  PID:7084
- C:\Windows\System\tuDLEEa.exe
  C:\Windows\System\tuDLEEa.exe
  2⤵
  PID:7748
- C:\Windows\System\BbBKfSM.exe
  C:\Windows\System\BbBKfSM.exe
  2⤵
  PID:7316
- C:\Windows\System\ukyineB.exe
  C:\Windows\System\ukyineB.exe
  2⤵
  PID:7348
- C:\Windows\System\TPDLWhR.exe
  C:\Windows\System\TPDLWhR.exe
  2⤵
  PID:7480
- C:\Windows\System\CbyxRuS.exe
  C:\Windows\System\CbyxRuS.exe
  2⤵
  PID:7804
- C:\Windows\System\Zsovrnl.exe
  C:\Windows\System\Zsovrnl.exe
  2⤵
  PID:7872
- C:\Windows\System\XXTQINC.exe
  C:\Windows\System\XXTQINC.exe
  2⤵
  PID:7768
- C:\Windows\System\fIiQVeR.exe
  C:\Windows\System\fIiQVeR.exe
  2⤵
  PID:7608
- C:\Windows\System\dbufkRV.exe
  C:\Windows\System\dbufkRV.exe
  2⤵
  PID:8112
- C:\Windows\System\oSdOVVu.exe
  C:\Windows\System\oSdOVVu.exe
  2⤵
  PID:7936
- C:\Windows\System\HUUaIZr.exe
  C:\Windows\System\HUUaIZr.exe
  2⤵
  PID:7204
- C:\Windows\System\SDxUwqQ.exe
  C:\Windows\System\SDxUwqQ.exe
  2⤵
  PID:8148
- C:\Windows\System\vZeJzKl.exe
  C:\Windows\System\vZeJzKl.exe
  2⤵
  PID:6264
- C:\Windows\System\nCRfCGa.exe
  C:\Windows\System\nCRfCGa.exe
  2⤵
  PID:7460
- C:\Windows\System\BvLwtwB.exe
  C:\Windows\System\BvLwtwB.exe
  2⤵
  PID:7512
- C:\Windows\System\PPEIVkN.exe
  C:\Windows\System\PPEIVkN.exe
  2⤵
  PID:7100
- C:\Windows\System\ljgRSal.exe
  C:\Windows\System\ljgRSal.exe
  2⤵
  PID:7416
- C:\Windows\System\LgwWJOU.exe
  C:\Windows\System\LgwWJOU.exe
  2⤵
  PID:7732
- C:\Windows\System\heMaMtH.exe
  C:\Windows\System\heMaMtH.exe
  2⤵
  PID:7640
- C:\Windows\System\LRVdFTA.exe
  C:\Windows\System\LRVdFTA.exe
  2⤵
  PID:8144
- C:\Windows\System\ohDdAgO.exe
  C:\Windows\System\ohDdAgO.exe
  2⤵
  PID:7396
- C:\Windows\System\HmanTkn.exe
  C:\Windows\System\HmanTkn.exe
  2⤵
  PID:7368
- C:\Windows\System\sJpOPRL.exe
  C:\Windows\System\sJpOPRL.exe
  2⤵
  PID:7380
- C:\Windows\System\EtkUSGH.exe
  C:\Windows\System\EtkUSGH.exe
  2⤵
  PID:7656
- C:\Windows\System\Iwuqmwl.exe
  C:\Windows\System\Iwuqmwl.exe
  2⤵
  PID:7704
- C:\Windows\System\CwNvHOX.exe
  C:\Windows\System\CwNvHOX.exe
  2⤵
  PID:8208
- C:\Windows\System\HoFkXcd.exe
  C:\Windows\System\HoFkXcd.exe
  2⤵
  PID:8224
- C:\Windows\System\TGgietc.exe
  C:\Windows\System\TGgietc.exe
  2⤵
  PID:8240
- C:\Windows\System\lNkyqMo.exe
  C:\Windows\System\lNkyqMo.exe
  2⤵
  PID:8256
- C:\Windows\System\lwTtycx.exe
  C:\Windows\System\lwTtycx.exe
  2⤵
  PID:8276
- C:\Windows\System\tpszaNK.exe
  C:\Windows\System\tpszaNK.exe
  2⤵
  PID:8292
- C:\Windows\System\rTesFWN.exe
  C:\Windows\System\rTesFWN.exe
  2⤵
  PID:8308
- C:\Windows\System\tVBdilA.exe
  C:\Windows\System\tVBdilA.exe
  2⤵
  PID:8332
- C:\Windows\System\DfoANiS.exe
  C:\Windows\System\DfoANiS.exe
  2⤵
  PID:8352
- C:\Windows\System\TSriyvw.exe
  C:\Windows\System\TSriyvw.exe
  2⤵
  PID:8368
- C:\Windows\System\YBXaKmo.exe
  C:\Windows\System\YBXaKmo.exe
  2⤵
  PID:8504
- C:\Windows\System\WXvzhQW.exe
  C:\Windows\System\WXvzhQW.exe
  2⤵
  PID:8520
- C:\Windows\System\RUWaUxL.exe
  C:\Windows\System\RUWaUxL.exe
  2⤵
  PID:8536
- C:\Windows\System\uXqfTyT.exe
  C:\Windows\System\uXqfTyT.exe
  2⤵
  PID:8552
- C:\Windows\System\dtKbOdN.exe
  C:\Windows\System\dtKbOdN.exe
  2⤵
  PID:8568
- C:\Windows\System\wNWkBLV.exe
  C:\Windows\System\wNWkBLV.exe
  2⤵
  PID:8584
- C:\Windows\System\LSkCbKE.exe
  C:\Windows\System\LSkCbKE.exe
  2⤵
  PID:8632
- C:\Windows\System\DhLxbVB.exe
  C:\Windows\System\DhLxbVB.exe
  2⤵
  PID:8648
- C:\Windows\System\OiAlmne.exe
  C:\Windows\System\OiAlmne.exe
  2⤵
  PID:8664
- C:\Windows\System\JbiykST.exe
  C:\Windows\System\JbiykST.exe
  2⤵
  PID:8680
- C:\Windows\System\gZhxaZb.exe
  C:\Windows\System\gZhxaZb.exe
  2⤵
  PID:8696
- C:\Windows\System\yVJBhHV.exe
  C:\Windows\System\yVJBhHV.exe
  2⤵
  PID:8712
- C:\Windows\System\CNmRuak.exe
  C:\Windows\System\CNmRuak.exe
  2⤵
  PID:8728
- C:\Windows\System\eYcbyhh.exe
  C:\Windows\System\eYcbyhh.exe
  2⤵
  PID:8744
- C:\Windows\System\WUAiiyT.exe
  C:\Windows\System\WUAiiyT.exe
  2⤵
  PID:8760
- C:\Windows\System\RgabHmq.exe
  C:\Windows\System\RgabHmq.exe
  2⤵
  PID:8776
- C:\Windows\System\wPFTqUO.exe
  C:\Windows\System\wPFTqUO.exe
  2⤵
  PID:8792
- C:\Windows\System\bCMsmrR.exe
  C:\Windows\System\bCMsmrR.exe
  2⤵
  PID:8808
- C:\Windows\System\xlBLFeJ.exe
  C:\Windows\System\xlBLFeJ.exe
  2⤵
  PID:8824
- C:\Windows\System\BlqswGp.exe
  C:\Windows\System\BlqswGp.exe
  2⤵
  PID:8840
- C:\Windows\System\wTnKdkC.exe
  C:\Windows\System\wTnKdkC.exe
  2⤵
  PID:8860
- C:\Windows\System\oyNcqem.exe
  C:\Windows\System\oyNcqem.exe
  2⤵
  PID:8876
- C:\Windows\System\WBGQIom.exe
  C:\Windows\System\WBGQIom.exe
  2⤵
  PID:8892
- C:\Windows\System\dRbxUii.exe
  C:\Windows\System\dRbxUii.exe
  2⤵
  PID:8908
- C:\Windows\System\LJtQwnP.exe
  C:\Windows\System\LJtQwnP.exe
  2⤵
  PID:8928
- C:\Windows\System\oSmySLT.exe
  C:\Windows\System\oSmySLT.exe
  2⤵
  PID:8944
- C:\Windows\System\LSVcwDc.exe
  C:\Windows\System\LSVcwDc.exe
  2⤵
  PID:8968
- C:\Windows\System\oBUBdWX.exe
  C:\Windows\System\oBUBdWX.exe
  2⤵
  PID:8984
- C:\Windows\System\KQjrwNs.exe
  C:\Windows\System\KQjrwNs.exe
  2⤵
  PID:9000
- C:\Windows\System\ufSdzdS.exe
  C:\Windows\System\ufSdzdS.exe
  2⤵
  PID:9016
- C:\Windows\System\jZtyMRB.exe
  C:\Windows\System\jZtyMRB.exe
  2⤵
  PID:9036
- C:\Windows\System\LFfpCwM.exe
  C:\Windows\System\LFfpCwM.exe
  2⤵
  PID:9052
- C:\Windows\System\WQpVdAP.exe
  C:\Windows\System\WQpVdAP.exe
  2⤵
  PID:9072
- C:\Windows\System\Qbfsbqf.exe
  C:\Windows\System\Qbfsbqf.exe
  2⤵
  PID:9088
- C:\Windows\System\axlaByN.exe
  C:\Windows\System\axlaByN.exe
  2⤵
  PID:9104
- C:\Windows\System\hIJNsoT.exe
  C:\Windows\System\hIJNsoT.exe
  2⤵
  PID:9192
- C:\Windows\System\DKdBPxD.exe
  C:\Windows\System\DKdBPxD.exe
  2⤵
  PID:9208
- C:\Windows\System\TJaidsO.exe
  C:\Windows\System\TJaidsO.exe
  2⤵
  PID:7288
- C:\Windows\System\wAYOAEy.exe
  C:\Windows\System\wAYOAEy.exe
  2⤵
  PID:8216
- C:\Windows\System\CLtuogt.exe
  C:\Windows\System\CLtuogt.exe
  2⤵
  PID:8284
- C:\Windows\System\JCRMhbo.exe
  C:\Windows\System\JCRMhbo.exe
  2⤵
  PID:8084
- C:\Windows\System\VTYkyRW.exe
  C:\Windows\System\VTYkyRW.exe
  2⤵
  PID:7524
- C:\Windows\System\ZZsUfjv.exe
  C:\Windows\System\ZZsUfjv.exe
  2⤵
  PID:8264
- C:\Windows\System\oMsmYEc.exe
  C:\Windows\System\oMsmYEc.exe
  2⤵
  PID:8304
- C:\Windows\System\EPQKFaX.exe
  C:\Windows\System\EPQKFaX.exe
  2⤵
  PID:8344
- C:\Windows\System\KNmMLlj.exe
  C:\Windows\System\KNmMLlj.exe
  2⤵
  PID:8388
- C:\Windows\System\eoYyBTA.exe
  C:\Windows\System\eoYyBTA.exe
  2⤵
  PID:8364
- C:\Windows\System\FEdyRpg.exe
  C:\Windows\System\FEdyRpg.exe
  2⤵
  PID:8408
- C:\Windows\System\IjlfhRq.exe
  C:\Windows\System\IjlfhRq.exe
  2⤵
  PID:8420
- C:\Windows\System\QrKSXuI.exe
  C:\Windows\System\QrKSXuI.exe
  2⤵
  PID:8440
- C:\Windows\System\GZqicBZ.exe
  C:\Windows\System\GZqicBZ.exe
  2⤵
  PID:8444
- C:\Windows\System\XrpqaFb.exe
  C:\Windows\System\XrpqaFb.exe
  2⤵
  PID:8476
- C:\Windows\System\QELlrXn.exe
  C:\Windows\System\QELlrXn.exe
  2⤵
  PID:8496
- C:\Windows\System\cqJIlsH.exe
  C:\Windows\System\cqJIlsH.exe
  2⤵
  PID:8516
- C:\Windows\System\yFFeexa.exe
  C:\Windows\System\yFFeexa.exe
  2⤵
  PID:8560
- C:\Windows\System\QRauKvK.exe
  C:\Windows\System\QRauKvK.exe
  2⤵
  PID:8596
- C:\Windows\System\ejDFJZR.exe
  C:\Windows\System\ejDFJZR.exe
  2⤵
  PID:8612
- C:\Windows\System\DcQaEfd.exe
  C:\Windows\System\DcQaEfd.exe
  2⤵
  PID:8640
- C:\Windows\System\KTpRlyf.exe
  C:\Windows\System\KTpRlyf.exe
  2⤵
  PID:8656
- C:\Windows\System\iQQSBje.exe
  C:\Windows\System\iQQSBje.exe
  2⤵
  PID:8708
- C:\Windows\System\ERqwofr.exe
  C:\Windows\System\ERqwofr.exe
  2⤵
  PID:8740
- C:\Windows\System\bjxiQwP.exe
  C:\Windows\System\bjxiQwP.exe
  2⤵
  PID:8784
- C:\Windows\System\tiICPit.exe
  C:\Windows\System\tiICPit.exe
  2⤵
  PID:8832
- C:\Windows\System\ZoyArWe.exe
  C:\Windows\System\ZoyArWe.exe
  2⤵
  PID:8852
- C:\Windows\System\RkDIAkp.exe
  C:\Windows\System\RkDIAkp.exe
  2⤵
  PID:8900
- C:\Windows\System\idKLafW.exe
  C:\Windows\System\idKLafW.exe
  2⤵
  PID:8888
- C:\Windows\System\DBpIJdZ.exe
  C:\Windows\System\DBpIJdZ.exe
  2⤵
  PID:8980
- C:\Windows\System\EIoFAmZ.exe
  C:\Windows\System\EIoFAmZ.exe
  2⤵
  PID:9048
- C:\Windows\System\ejjvuOy.exe
  C:\Windows\System\ejjvuOy.exe
  2⤵
  PID:8920
- C:\Windows\System\leuUjCS.exe
  C:\Windows\System\leuUjCS.exe
  2⤵
  PID:8952
- C:\Windows\System\JiiPpHI.exe
  C:\Windows\System\JiiPpHI.exe
  2⤵
  PID:9024
- C:\Windows\System\GaLbvhP.exe
  C:\Windows\System\GaLbvhP.exe
  2⤵
  PID:9100
- C:\Windows\System\iwFwlBr.exe
  C:\Windows\System\iwFwlBr.exe
  2⤵
  PID:9128
- C:\Windows\System\nxtQcZb.exe
  C:\Windows\System\nxtQcZb.exe
  2⤵
  PID:9204
- C:\Windows\System\dfrzPWF.exe
  C:\Windows\System\dfrzPWF.exe
  2⤵
  PID:8456
- C:\Windows\System\vUJYOlo.exe
  C:\Windows\System\vUJYOlo.exe
  2⤵
  PID:7932
- C:\Windows\System\RHZhyMX.exe
  C:\Windows\System\RHZhyMX.exe
  2⤵
  PID:8236
- C:\Windows\System\YvYVxmz.exe
  C:\Windows\System\YvYVxmz.exe
  2⤵
  PID:8340
- C:\Windows\System\CzZhTUl.exe
  C:\Windows\System\CzZhTUl.exe
  2⤵
  PID:8672
- C:\Windows\System\mrpWaHq.exe
  C:\Windows\System\mrpWaHq.exe
  2⤵
  PID:8604
- C:\Windows\System\fXsWhtE.exe
  C:\Windows\System\fXsWhtE.exe
  2⤵
  PID:8432
- C:\Windows\System\mxqoUce.exe
  C:\Windows\System\mxqoUce.exe
  2⤵
  PID:7064
- C:\Windows\System\WEPWvJO.exe
  C:\Windows\System\WEPWvJO.exe
  2⤵
  PID:7788
- C:\Windows\System\YjGCxeX.exe
  C:\Windows\System\YjGCxeX.exe
  2⤵
  PID:8248
- C:\Windows\System\tLAebet.exe
  C:\Windows\System\tLAebet.exe
  2⤵
  PID:9168
- C:\Windows\System\vCjnwRk.exe
  C:\Windows\System\vCjnwRk.exe
  2⤵
  PID:9144
- C:\Windows\System\IQQndNp.exe
  C:\Windows\System\IQQndNp.exe
  2⤵
  PID:8940
- C:\Windows\System\ERshbAg.exe
  C:\Windows\System\ERshbAg.exe
  2⤵
  PID:8468
- C:\Windows\System\GyNRosS.exe
  C:\Windows\System\GyNRosS.exe
  2⤵
  PID:8564
- C:\Windows\System\DJaAdIy.exe
  C:\Windows\System\DJaAdIy.exe
  2⤵
  PID:8624
- C:\Windows\System\fgLNqhH.exe
  C:\Windows\System\fgLNqhH.exe
  2⤵
  PID:8768
- C:\Windows\System\zRKNTXj.exe
  C:\Windows\System\zRKNTXj.exe
  2⤵
  PID:8848
- C:\Windows\System\iqTUnFq.exe
  C:\Windows\System\iqTUnFq.exe
  2⤵
  PID:9060
- C:\Windows\System\JZQGHyn.exe
  C:\Windows\System\JZQGHyn.exe
  2⤵
  PID:9200
- C:\Windows\System\hohSnmW.exe
  C:\Windows\System\hohSnmW.exe
  2⤵
  PID:8484
- C:\Windows\System\aIXjhut.exe
  C:\Windows\System\aIXjhut.exe
  2⤵
  PID:8400
- C:\Windows\System\RQDPnBc.exe
  C:\Windows\System\RQDPnBc.exe
  2⤵
  PID:8804
- C:\Windows\System\aChojTD.exe
  C:\Windows\System\aChojTD.exe
  2⤵
  PID:8724
- C:\Windows\System\wQBEHkp.exe
  C:\Windows\System\wQBEHkp.exe
  2⤵
  PID:9120
- C:\Windows\System\zoMFGce.exe
  C:\Windows\System\zoMFGce.exe
  2⤵
  PID:7604
- C:\Windows\System\BZbIpoO.exe
  C:\Windows\System\BZbIpoO.exe
  2⤵
  PID:8608
- C:\Windows\System\bAFjKeE.exe
  C:\Windows\System\bAFjKeE.exe
  2⤵
  PID:8300
- C:\Windows\System\MVATecO.exe
  C:\Windows\System\MVATecO.exe
  2⤵
  PID:9152
- C:\Windows\System\RTlVsbU.exe
  C:\Windows\System\RTlVsbU.exe
  2⤵
  PID:8704
- C:\Windows\System\ZIOWFiH.exe
  C:\Windows\System\ZIOWFiH.exe
  2⤵
  PID:9044
- C:\Windows\System\iNMIDgj.exe
  C:\Windows\System\iNMIDgj.exe
  2⤵
  PID:8328
- C:\Windows\System\FyyfhLJ.exe
  C:\Windows\System\FyyfhLJ.exe
  2⤵
  PID:8816
- C:\Windows\System\YhHVYsb.exe
  C:\Windows\System\YhHVYsb.exe
  2⤵
  PID:8512
- C:\Windows\System\OZHsloO.exe
  C:\Windows\System\OZHsloO.exe
  2⤵
  PID:8460
- C:\Windows\System\kBUdNEH.exe
  C:\Windows\System\kBUdNEH.exe
  2⤵
  PID:8620
- C:\Windows\System\RbWCABV.exe
  C:\Windows\System\RbWCABV.exe
  2⤵
  PID:9172
- C:\Windows\System\EUZxaYT.exe
  C:\Windows\System\EUZxaYT.exe
  2⤵
  PID:8964
- C:\Windows\System\dKiCDEc.exe
  C:\Windows\System\dKiCDEc.exe
  2⤵
  PID:8720
- C:\Windows\System\IQTjgyZ.exe
  C:\Windows\System\IQTjgyZ.exe
  2⤵
  PID:8320
- C:\Windows\System\wdiZEVo.exe
  C:\Windows\System\wdiZEVo.exe
  2⤵
  PID:9096
- C:\Windows\System\KYtPciD.exe
  C:\Windows\System\KYtPciD.exe
  2⤵
  PID:9012
- C:\Windows\System\KxhRTEl.exe
  C:\Windows\System\KxhRTEl.exe
  2⤵
  PID:9136
- C:\Windows\System\jmbVPnK.exe
  C:\Windows\System\jmbVPnK.exe
  2⤵
  PID:8836
- C:\Windows\System\eSdOSBh.exe
  C:\Windows\System\eSdOSBh.exe
  2⤵
  PID:9228
- C:\Windows\System\fYrCdNZ.exe
  C:\Windows\System\fYrCdNZ.exe
  2⤵
  PID:9244
- C:\Windows\System\VYAMSMa.exe
  C:\Windows\System\VYAMSMa.exe
  2⤵
  PID:9264
- C:\Windows\System\SeNSNJa.exe
  C:\Windows\System\SeNSNJa.exe
  2⤵
  PID:9280
- C:\Windows\System\FMGoMYa.exe
  C:\Windows\System\FMGoMYa.exe
  2⤵
  PID:9296
- C:\Windows\System\jycpSqV.exe
  C:\Windows\System\jycpSqV.exe
  2⤵
  PID:9312
- C:\Windows\System\rFiHbct.exe
  C:\Windows\System\rFiHbct.exe
  2⤵
  PID:9328
- C:\Windows\System\zCdeNTX.exe
  C:\Windows\System\zCdeNTX.exe
  2⤵
  PID:9344
- C:\Windows\System\McxUvgr.exe
  C:\Windows\System\McxUvgr.exe
  2⤵
  PID:9360
- C:\Windows\System\dIPtIiZ.exe
  C:\Windows\System\dIPtIiZ.exe
  2⤵
  PID:9376
- C:\Windows\System\OusyVQK.exe
  C:\Windows\System\OusyVQK.exe
  2⤵
  PID:9396
- C:\Windows\System\CCXnSny.exe
  C:\Windows\System\CCXnSny.exe
  2⤵
  PID:9424
- C:\Windows\System\ytOBFyA.exe
  C:\Windows\System\ytOBFyA.exe
  2⤵
  PID:9440
- C:\Windows\System\OAMpDvH.exe
  C:\Windows\System\OAMpDvH.exe
  2⤵
  PID:9460
- C:\Windows\System\GfbRavc.exe
  C:\Windows\System\GfbRavc.exe
  2⤵
  PID:9476
- C:\Windows\System\EkhCscY.exe
  C:\Windows\System\EkhCscY.exe
  2⤵
  PID:9492
- C:\Windows\System\TtALCGj.exe
  C:\Windows\System\TtALCGj.exe
  2⤵
  PID:9512
- C:\Windows\System\DZinDsX.exe
  C:\Windows\System\DZinDsX.exe
  2⤵
  PID:9532
- C:\Windows\System\yabkNdo.exe
  C:\Windows\System\yabkNdo.exe
  2⤵
  PID:9548
- C:\Windows\System\IrluySt.exe
  C:\Windows\System\IrluySt.exe
  2⤵
  PID:9568
- C:\Windows\System\BmtHtbr.exe
  C:\Windows\System\BmtHtbr.exe
  2⤵
  PID:9584
- C:\Windows\System\RSyTulK.exe
  C:\Windows\System\RSyTulK.exe
  2⤵
  PID:9604
- C:\Windows\System\zgoHeBX.exe
  C:\Windows\System\zgoHeBX.exe
  2⤵
  PID:9620
- C:\Windows\System\DTvpRjp.exe
  C:\Windows\System\DTvpRjp.exe
  2⤵
  PID:9636
- C:\Windows\System\VyrbHPX.exe
  C:\Windows\System\VyrbHPX.exe
  2⤵
  PID:9652
- C:\Windows\System\pgWoNcz.exe
  C:\Windows\System\pgWoNcz.exe
  2⤵
  PID:9668
- C:\Windows\System\qvHBmbK.exe
  C:\Windows\System\qvHBmbK.exe
  2⤵
  PID:9684
- C:\Windows\System\AYhqAyf.exe
  C:\Windows\System\AYhqAyf.exe
  2⤵
  PID:9700
- C:\Windows\System\JtIPyLb.exe
  C:\Windows\System\JtIPyLb.exe
  2⤵
  PID:9764
- C:\Windows\System\LEDGTVM.exe
  C:\Windows\System\LEDGTVM.exe
  2⤵
  PID:9780
- C:\Windows\System\fsPROxh.exe
  C:\Windows\System\fsPROxh.exe
  2⤵
  PID:9800
- C:\Windows\System\MVFRqwI.exe
  C:\Windows\System\MVFRqwI.exe
  2⤵
  PID:9816
- C:\Windows\System\CDHHZFO.exe
  C:\Windows\System\CDHHZFO.exe
  2⤵
  PID:9840
- C:\Windows\System\mqsaGWf.exe
  C:\Windows\System\mqsaGWf.exe
  2⤵
  PID:9860
- C:\Windows\System\svzzqnx.exe
  C:\Windows\System\svzzqnx.exe
  2⤵
  PID:9876
- C:\Windows\System\ZrQunKA.exe
  C:\Windows\System\ZrQunKA.exe
  2⤵
  PID:9892
- C:\Windows\System\FwXahmm.exe
  C:\Windows\System\FwXahmm.exe
  2⤵
  PID:9912
- C:\Windows\System\fqudLla.exe
  C:\Windows\System\fqudLla.exe
  2⤵
  PID:9928
- C:\Windows\System\NUSgyap.exe
  C:\Windows\System\NUSgyap.exe
  2⤵
  PID:9944
- C:\Windows\System\qJSBKDG.exe
  C:\Windows\System\qJSBKDG.exe
  2⤵
  PID:9960
- C:\Windows\System\YqvfAdF.exe
  C:\Windows\System\YqvfAdF.exe
  2⤵
  PID:9976
- C:\Windows\System\GwOUYfu.exe
  C:\Windows\System\GwOUYfu.exe
  2⤵
  PID:10008
- C:\Windows\System\kETtugk.exe
  C:\Windows\System\kETtugk.exe
  2⤵
  PID:10024
- C:\Windows\System\BdsxOin.exe
  C:\Windows\System\BdsxOin.exe
  2⤵
  PID:10040
- C:\Windows\System\YIEMiCT.exe
  C:\Windows\System\YIEMiCT.exe
  2⤵
  PID:10056
- C:\Windows\System\JoAHvOl.exe
  C:\Windows\System\JoAHvOl.exe
  2⤵
  PID:10072
- C:\Windows\System\leJqgbO.exe
  C:\Windows\System\leJqgbO.exe
  2⤵
  PID:10088
- C:\Windows\System\ZJoGkYn.exe
  C:\Windows\System\ZJoGkYn.exe
  2⤵
  PID:10104
- C:\Windows\System\ENicCJs.exe
  C:\Windows\System\ENicCJs.exe
  2⤵
  PID:10120
- C:\Windows\System\RxUmgus.exe
  C:\Windows\System\RxUmgus.exe
  2⤵
  PID:10140
- C:\Windows\System\hCdbimC.exe
  C:\Windows\System\hCdbimC.exe
  2⤵
  PID:10156
- C:\Windows\System\IaxBaKn.exe
  C:\Windows\System\IaxBaKn.exe
  2⤵
  PID:10172
- C:\Windows\System\AQYNfQY.exe
  C:\Windows\System\AQYNfQY.exe
  2⤵
  PID:10188
- C:\Windows\System\bZfInuw.exe
  C:\Windows\System\bZfInuw.exe
  2⤵
  PID:10204
- C:\Windows\System\nEtXBlG.exe
  C:\Windows\System\nEtXBlG.exe
  2⤵
  PID:10220
- C:\Windows\System\IiVRqSg.exe
  C:\Windows\System\IiVRqSg.exe
  2⤵
  PID:8464
- C:\Windows\System\xWlTIhs.exe
  C:\Windows\System\xWlTIhs.exe
  2⤵
  PID:8856
- C:\Windows\System\IOUWTPu.exe
  C:\Windows\System\IOUWTPu.exe
  2⤵
  PID:9184
- C:\Windows\System\afEKXdB.exe
  C:\Windows\System\afEKXdB.exe
  2⤵
  PID:9240
- C:\Windows\System\JlURrwR.exe
  C:\Windows\System\JlURrwR.exe
  2⤵
  PID:9336
- C:\Windows\System\cudyRhX.exe
  C:\Windows\System\cudyRhX.exe
  2⤵
  PID:9392
- C:\Windows\System\ZdfdLWW.exe
  C:\Windows\System\ZdfdLWW.exe
  2⤵
  PID:9416
- C:\Windows\System\ZHKHLos.exe
  C:\Windows\System\ZHKHLos.exe
  2⤵
  PID:9484
- C:\Windows\System\bbIkaVS.exe
  C:\Windows\System\bbIkaVS.exe
  2⤵
  PID:9524
- C:\Windows\System\yTbChvG.exe
  C:\Windows\System\yTbChvG.exe
  2⤵
  PID:9592
- C:\Windows\System\jYHBYvM.exe
  C:\Windows\System\jYHBYvM.exe
  2⤵
  PID:9664
- C:\Windows\System\QlukVwu.exe
  C:\Windows\System\QlukVwu.exe
  2⤵
  PID:9696
- C:\Windows\System\lYbSDUC.exe
  C:\Windows\System\lYbSDUC.exe
  2⤵
  PID:9468
- C:\Windows\System\ajSGudP.exe
  C:\Windows\System\ajSGudP.exe
  2⤵
  PID:9648
- C:\Windows\System\tcfexvA.exe
  C:\Windows\System\tcfexvA.exe
  2⤵
  PID:9288
- C:\Windows\System\MjRwGUd.exe
  C:\Windows\System\MjRwGUd.exe
  2⤵
  PID:9352
- C:\Windows\System\ZGbtedE.exe
  C:\Windows\System\ZGbtedE.exe
  2⤵
  PID:9432
- C:\Windows\System\SCDzBMM.exe
  C:\Windows\System\SCDzBMM.exe
  2⤵
  PID:9504
- C:\Windows\System\mRgpFdF.exe
  C:\Windows\System\mRgpFdF.exe
  2⤵
  PID:9616
- C:\Windows\System\EgGtAxS.exe
  C:\Windows\System\EgGtAxS.exe
  2⤵
  PID:9720
- C:\Windows\System\rfNETxx.exe
  C:\Windows\System\rfNETxx.exe
  2⤵
  PID:9736
- C:\Windows\System\DWrtCtk.exe
  C:\Windows\System\DWrtCtk.exe
  2⤵
  PID:9748
- C:\Windows\System\RoJcplP.exe
  C:\Windows\System\RoJcplP.exe
  2⤵
  PID:9812
- C:\Windows\System\bdJGaHK.exe
  C:\Windows\System\bdJGaHK.exe
  2⤵
  PID:9884
- C:\Windows\System\ZzrnepA.exe
  C:\Windows\System\ZzrnepA.exe
  2⤵
  PID:9952
- C:\Windows\System\yncVJiF.exe
  C:\Windows\System\yncVJiF.exe
  2⤵
  PID:9992
- C:\Windows\System\iCFWHiY.exe
  C:\Windows\System\iCFWHiY.exe
  2⤵
  PID:9788
- C:\Windows\System\SPSIomk.exe
  C:\Windows\System\SPSIomk.exe
  2⤵
  PID:9872
- C:\Windows\System\iQKBKsW.exe
  C:\Windows\System\iQKBKsW.exe
  2⤵
  PID:9796
- C:\Windows\System\WPWbzbn.exe
  C:\Windows\System\WPWbzbn.exe
  2⤵
  PID:9908
- C:\Windows\System\GocWAuD.exe
  C:\Windows\System\GocWAuD.exe
  2⤵
  PID:9972
- C:\Windows\System\HypAOOT.exe
  C:\Windows\System\HypAOOT.exe
  2⤵
  PID:10020
- C:\Windows\System\ExuksPU.exe
  C:\Windows\System\ExuksPU.exe
  2⤵
  PID:10100
- C:\Windows\System\BJjngIs.exe
  C:\Windows\System\BJjngIs.exe
  2⤵
  PID:10168
- C:\Windows\System\XbrdAJx.exe
  C:\Windows\System\XbrdAJx.exe
  2⤵
  PID:10052
- C:\Windows\System\pbkFFWe.exe
  C:\Windows\System\pbkFFWe.exe
  2⤵
  PID:10148
- C:\Windows\System\TnJMGjK.exe
  C:\Windows\System\TnJMGjK.exe
  2⤵
  PID:10232
- C:\Windows\System\ywZMEIB.exe
  C:\Windows\System\ywZMEIB.exe
  2⤵
  PID:10116
- C:\Windows\System\adVVsdc.exe
  C:\Windows\System\adVVsdc.exe
  2⤵
  PID:8232
- C:\Windows\System\szmvcHe.exe
  C:\Windows\System\szmvcHe.exe
  2⤵
  PID:9304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BoxDTax.exe

Filesize
922KB

MD5
115a6d94f91df7a0d267d0ab90901e7f

SHA1
3c94e1073c186895149fd65cb4ed4ee065006923

SHA256
7d4e7a90c71126129ffc0fa21c039cc0f990a95858e8cb0fa3747c2a4e4cde09

SHA512
e163ea04b1b107cf76a344b5df33d3d0a0f1137e8faa1f8f55cf0c2137c7832959c8d8399cc88f419644228a5ee5feae053fbdaa3cc513f138bf79fd511768bd

Download Submit
C:\Windows\system\CYhjOBV.exe

Filesize
919KB

MD5
60342f7e238d7ac691d3080259fff77f

SHA1
4ae75784743f89b6e675808268436a8105d2eeb8

SHA256
30050cc341c50004f0759c72ea3a93f3afc58d120a86327d3779778fa317d367

SHA512
911e2a76ebfa67d3876a3fcff96e1530ffb2add7e1b7bc9b538b35f7ba22deb6c4304736e8726a9459aefb2d4ee15116ebcbbbeaea7f0b24f0b16af653460d21

Download Submit
C:\Windows\system\DPYOsZp.exe

Filesize
921KB

MD5
a25d8d0bb60a83dd8fc1cb2163bd82e9

SHA1
5d7146111367b62f43defbfde561c6bcfc39c59c

SHA256
4eca726eaba846b23978045506724b679eaf20eecd819528f4326bb470382fb1

SHA512
226429893f7d4a01df461626204f22a3922fd91a8bc9f09f27e11bffab3b9c23012a08a38426af9a0ce63f599605d9653067276095ae7d713ec04ad97d503f80

Download Submit
C:\Windows\system\DcOXatM.exe

Filesize
920KB

MD5
2b9014b8be7ee21fd0157332e3ebe6b2

SHA1
29ecfe075476d06a0357d8830c7c8c028b346227

SHA256
af476f9e24d3b4428f01bd252a7f1749b1666a8b9ee093ec6cc464c47c25b764

SHA512
df2923b798cefbc41e229117ee574a689345d661367d263cf835964c511bde089743f10cfd89b6298fd8091b0e711e45c7437d45040b92d39fba416b62d1e687

Download Submit
C:\Windows\system\ElWYhLY.exe

Filesize
920KB

MD5
a4ea312edfae5f31f6d9c7ac23579471

SHA1
76e6edda2f1892611c664beadc9d7cac7841cac4

SHA256
bdbf89ede73377f95b717d33e35f0f79fc142632f2c8249fc1ebeee4aba4153e

SHA512
075301145bcf58c575eff47f685b8ec04d982747ffa50b96d03e114ca4c22573b94ac2495f6a8a09d94c13ff34d0d9fe6e3a625c9f81af76bae245ae024acefc

Download Submit
C:\Windows\system\JJYVrjH.exe

Filesize
917KB

MD5
989c8f116a0183d3b446acd1ed8e9376

SHA1
d75537ec0dd19721dd25f47cad5823efa3856e98

SHA256
e1717c6f5fe01e500871e37975f3346f43fe0ff7ee389c041752d0e29b1eca7e

SHA512
c7f59b1c7081b7d440c48a004575f885db3ef4949e8db1ad29c469f1535e15ca396a5295c7b815cbc9dddc732b985d044d6d77ddd58eb8e2d48e76d180e991db

Download Submit
C:\Windows\system\JQGbxBa.exe

Filesize
919KB

MD5
7ba1d0b9b3a7df0dbf513bf386311ba9

SHA1
3868fb1c2b31b6f90591c983fae5dd4d3466a0e4

SHA256
d204b67f3c87e0c30bc4bd60c76e85b6b46cf3c5143a5b25c4d9b8fce6dd7686

SHA512
90541d3c954db95865f1036f91c1ce55f376b561862973fa48586b34974575b14168d249aa9efe2ae53a2a4b85b80b54f8b0b826b23c9da7287fd827de1bf127

Download Submit
C:\Windows\system\Nczzudf.exe

Filesize
920KB

MD5
4122406b91dde4cd9acd772a3875866c

SHA1
c9ae6a61ea05a57e9caccc08d4e4764c948f9670

SHA256
575ec027ac30aeeaf91dfb374f0336f7bfe4a5d0e229f8fdd44a325965854519

SHA512
76e761314a5439952710eea862e6ad0f83c2e3f18b931228214dfd604ab6edd0016ed63e1f3d26d13f9488fa88c755bf90ef458de17e2fedf52e984a2e3a342b

Download Submit
C:\Windows\system\PdlMASN.exe

Filesize
920KB

MD5
0821d5d1fe5b6bd5e9689d77060ce865

SHA1
95e4a2f07e54f882c111cd0feaaf0a8fb1435370

SHA256
cc266125d9cbb2048a2d639c10c44f19bc5da69314ed9f216854fc39c8874c4c

SHA512
1d84539cea69b4c6e51bba3ffba0c1d586746ed5a513a09e9441649fda3133c391873043add7dcfaaeba1820c5a24a6a465391ded34b172d4c61033eab80c130

Download Submit
C:\Windows\system\PyVdyQy.exe

Filesize
922KB

MD5
a28f5291a5115c2cd09ac83969b13cf8

SHA1
68dbe6b50b287363b54cabc3cb3370d36d81e92f

SHA256
a740950efcc578e50aba2c879c8e83b9c458ef50554deec3a01c9a66977ff824

SHA512
18c3d5fc6ecfbab286a24e9ac3c62d0ff5a49c8f378db056a20117c59be26fe4ec8e534390e86d7918162c79aff074d6afd3eaa3afbf409cb435d610a928b840

Download Submit
C:\Windows\system\SJCkGBz.exe

Filesize
919KB

MD5
80ba6b9d05f9cbf2b844b0f29b66545d

SHA1
d24790cabb5afcf5b19922449fc756aa79449a64

SHA256
7692321a69b22a06c686441b1087334ffb74ed9700d497587b8a59fe18491b38

SHA512
2a586cbe892aba455e0660844e86d12e20812485c4f0a20ddc32410645b10210bb9128e4aafeb83db78d86a817232cf93ed32e8ff297b22cd71d56b02aec8246

Download Submit
C:\Windows\system\TMAfKkg.exe

Filesize
923KB

MD5
58682668e146607e2e4386b7b26bf560

SHA1
f01e9aa5bee80e47cd2360b1de16f381c49b15fc

SHA256
134425ee3c43841f026eaafb507e4bb5bac02d1fa91020c8b22a1c6f1b0fb877

SHA512
845ec8249c07e85abba81279d20040f8ab047b433d19644042f87fa0700f1452976d19a7ae92fd15dadafdf632d044ba4866233bebca94f13a8a4665df5157d2

Download Submit
C:\Windows\system\TpYgyMI.exe

Filesize
918KB

MD5
0ba7eaca0b54d204a61688580b86dd35

SHA1
1c0a24527160effd500b10c5bd6795c7046a9d4e

SHA256
e76345a27f9417c74cd6c8250dd291ba8d6e5a8655fdf5c9b520c28232f31cea

SHA512
b7300cdebf8a18f697d963917255c5a821845a5de218f94065f6cad5e238b12b0fa5b024389688a89765d69b485366d5cf83fc3ea5106e1fe06e1c7b48799afd

Download Submit
C:\Windows\system\VvUCcys.exe

Filesize
922KB

MD5
dfac2328f1d94f0e81f32e13436f42ce

SHA1
8fff154f759568ac6cadf218b60828325d454fe8

SHA256
b6ed517dc06aa842da8045096681d88ebc6e19511539f8c2495d818c69b4eb76

SHA512
b7213cebf8f3bd4af47ebd8067d623182c64f2e5cd3689c86478cf2ed92d2485d51fb5db664226698b116b03c606012dd23516e46866d4392a7fcf22cfc60b9f

Download Submit
C:\Windows\system\aIiGBtR.exe

Filesize
917KB

MD5
dfe50afa9e5a408f30cf933426e40dc4

SHA1
4c74d003aa77ea2ffdae7d1ae44a4714771c1b0b

SHA256
55e7c6cec95ed4a7e22b19965259a790fc00dfffca326891e7dee59046233889

SHA512
9335c707bc84a211ece2883c81f2f48e61f71c9dd5ccee7b987196dfc8ba19d23bf7fbe807f01948812cadf06ebe3799d76f3cae8a7ce57affbc1ca6411eb72c

Download Submit
C:\Windows\system\bkhjIeo.exe

Filesize
921KB

MD5
45c651f612904c18fe093b57d2064252

SHA1
82d297f0668b794dd209f5a13cffeffb17692a7e

SHA256
d782a9b5942fabc94e0fe0c0691a1036a3e70623d04ab9fa07dfd5da016dea1b

SHA512
6823cfacc19f1a363f894f744b8fab7a168843527ebb6517eacfaaa7f1c63bc0675512aa6fad94733aa6aaac4f29d3784813d7ebdac27a755fd91c44da55de54

Download Submit
C:\Windows\system\etsqJDf.exe

Filesize
918KB

MD5
2cdcea530184a2148983d6440841d8ed

SHA1
961842a26d6a189189f6f7dc8a033a1a681744ed

SHA256
e3c35120461e84cc9c069eceb3800e486738064f61696aab828de5c5bd71728b

SHA512
e0237690cb069daba28633a18ff333712360cf32daff42f0fd5170c4138fffbf5a4830f3d79b5ea64f07e5eb32c97f9a4fabe0b243b7eacbef09e10dfce63c9f

Download Submit
C:\Windows\system\ewlRgJP.exe

Filesize
917KB

MD5
1054ea99aaf63ef2fa50b9d0aabcb0a5

SHA1
a5503d96b04f5bc0668b0b1544c16946cc5006db

SHA256
0fb0c1693d0c5c68a224585146d71ec7930dda629370c41e8e672c7686ebca80

SHA512
c095310a80f8d8b00603636cc1d1e91479e6e1e9e57d8cb4c85f2df06e6ad2619a8c2271f214e126153ef30558232fdd79cc4ef6a6577dca1cb83da87c4e84db

Download Submit
C:\Windows\system\jGWfPvN.exe

Filesize
8B

MD5
ce3a90bee0163e3a194058d58c26aab7

SHA1
d9f0daa28c3cbff0b60db2c8d237ca270afe1d8b

SHA256
17e86a111bab66cee878394f00f9c8670a3c8a6559c6eec5d53f124dca33c9a4

SHA512
a727edbfd3e610781d8b751b02696bef878971a350f8911f0e09b6e778d06a34c40d2542b5d45c8b79feac500c811bbd40182a5c88654d794e08cb6f13c719af

Download Submit
C:\Windows\system\qbHnZIn.exe

Filesize
923KB

MD5
ed8854b16b83abe81dd8534aa222d698

SHA1
cb2279d0b134e5eabe76da737cd8219a4b3ae3fe

SHA256
18b3438a17776006f82a4ac100224140a2429fc6070ae21342e100e4f8fbdb46

SHA512
9bd9cdee7decc592bf32d425031e172d7b37502b7a0309c2fababd6331e694525512ea468c1c2b8b4e8ad4be76c904662a3f0aa19ec26273d7c41970099741c0

Download Submit
C:\Windows\system\qzWQJpu.exe

Filesize
921KB

MD5
7a94738520f82ed6578624a9b6162e71

SHA1
3d99a225a9acebefb34ffad12444667af0221dba

SHA256
af8375b12b4520a47408f3579c445d7e60c89f44d154651a4e88cd414c219f47

SHA512
53368fab2533c869e2a8875c4dc93919d8235d541c595241c0725561e3c166e0c8fc71cd382c7927608d67012c18b3c2bcc44bb0522ec696fc90849c0b4f4b85

Download Submit
C:\Windows\system\trXUXFN.exe

Filesize
922KB

MD5
80321f96ba060d815a79277ea2c46a7c

SHA1
69a761302ec24ca2df0ec531168110f4a731a3c6

SHA256
987c12cfcc810173d691826664ce97779fb6b733ca5baf33ef809cc445633da4

SHA512
322992468139011e695c6757792552650c0f24c3b679c5eea506de5f8e469caa604eaa6894a57f499e1b4830750a8c0622834b3d72d28d5dc54994657fc586ca

Download Submit
C:\Windows\system\zdqUBrK.exe

Filesize
918KB

MD5
17e05abfa907963d1ee054dc56bc97c2

SHA1
71218556a8096fe966297dfd7303b7ff6269eaed

SHA256
bb32a78ac5758bce10c88fb93e887da33c9e7f33c17b03fac1bbaea18b534d60

SHA512
fc142d0b72639f433563be185ce40b6f476228826bba44d99abb043dcb3c385f92027623b4dc7fd3d50253a616d1489af4289d72bd7c65b8736462265c2871d8

Download Submit
C:\Windows\system\zzRaRMW.exe

Filesize
917KB

MD5
d481856373399dfe9e027170bb632d59

SHA1
2e0ceca60c58a1910a2b1e33dc70c4479313e24e

SHA256
12514f2e0d00293adbe758c7f595adea8d4a50c781597787033a0cae1d615b1e

SHA512
9d32ac363c1cac34e397b20fa9954f42a5d61951679696ce725540c1c97cf7a1dc8a365f7d9c48780dbff0cda701453dc4868c3272231e095ad529b058fd2838

Download Submit
\Windows\system\ANODqJj.exe

Filesize
923KB

MD5
cc9556ea9b7ea5c04828f529ec3fc47a

SHA1
5c196e0ff5fe2a513bf62968e261ca551a8c73c4

SHA256
392714ffcc222bd017ea7578544a09ebaa0656cb9f8fcb1e629c14ec32107a78

SHA512
69cb409a9add00713fc43f32fd6c1d4ccdddcf6e807d471d41f230e6d6681be6009007181e6d5f9692a093130192d64763b24fcd72b651b24021b4edc28bcb6d

Download Submit
\Windows\system\DmxGeGR.exe

Filesize
918KB

MD5
306653b22bc17b3330e49567b35364ca

SHA1
6edf432d9525298c7cd01a0599f8083f7a2fa792

SHA256
a71475947be8dd699e7bba55b3b186e8ec3b392a96ebd85b936fd0ce66d0b654

SHA512
4866ccee623977e25d84d27cdafc21b451aa31ede25df3ba21970300b09ff5ab64c68bcbb670e7d611d7197bccdeecb1a43def06728b9231de4088fd28d35357

Download Submit
\Windows\system\JsVsIbo.exe

Filesize
919KB

MD5
3a25605db9111c4665abe62e981d218e

SHA1
fe1641831af85ce90c7185dcc601fda204256613

SHA256
e5597c9396d8a1082f6d47cc7443121bf827513c9ad5257acc817e66f99b25f5

SHA512
441715985b346387cfbafa8ebffbee65991fdfe74c761694981e821ee4731b44b94585f7e61dcdca38f6c36fda8d13a346d8d903f710aced96e5f2fa9cb6ec09

Download Submit
\Windows\system\MtrqavY.exe

Filesize
923KB

MD5
3f9c93460794f07695d99a182489edaf

SHA1
1ad9a00c2cfcd39a1ed8c93255b5589bb32d34a2

SHA256
330e1822d17a61a3c925dda09843a48acb8b08be843ea192a45163e093826aa1

SHA512
29e495ae8b276a17748714f6814270a7a2c0822f0c1a847b8b1fa4952e7dd350d0c268a3d1a5c48aa6d7ba3d1e7cf8b1652de4f038ea210e2769207cbf9a194c

Download Submit
\Windows\system\VgeUuHC.exe

Filesize
920KB

MD5
a672c39232fe112642bb26aab0d9651f

SHA1
360564d856e4753d79ad757cbf1d4b291e031daf

SHA256
6634363a96915d670aa14edc1cbd21549ba40e94f317818501b1c91794ee419d

SHA512
1cd283dbd52e7ebbe99c905e0ef6ef6d5e4ec84786f85ff42816f9ea74095c11b2a39b5995f790a30393f9dc10ddf61ac6d796d10937b7e1b185a0136aa00f11

Download Submit
\Windows\system\YDNegng.exe

Filesize
916KB

MD5
d4d91c1269b461991aba37e97ca5cd4a

SHA1
ff3517a29e63820dca3d35f53fe646eb6f76cdcd

SHA256
1e199ad0b9325905a39bea9dd67d85304ebc66ddd298b19c2f8848ee746d20fc

SHA512
190fb0c8926df68747cff8bbc3626b53d1d0a07fd79bcc4d6f8ca9a1029f7ceffd9516b4fd5f0a694c2a506218a6b9bf615f21197b9e82c4a58430fc930d8482

Download Submit
\Windows\system\Ykoikld.exe

Filesize
924KB

MD5
d801165128f7371b0a7eb50510714c2c

SHA1
91a7a9750d50f2cc31dd2e07585e8daa8f1067d7

SHA256
ebfacba365bffebbf94053531852f898599ddba662e832ac926b428a0e35ff29

SHA512
70f3aca9aafe9eb7cc2dc15ea904188e3e397e780b259e4bd5beb7fa23b2535ec422a1e15afdae7e086a496046ed102c23b5fe55cdde2bd32e5345bfb81b76d8

Download Submit
\Windows\system\fTehMGe.exe

Filesize
924KB

MD5
c1a3cd63531da405e17d05cc490198de

SHA1
126e6023b15d7f661f0946fc62297a620cc6c881

SHA256
ba367aa65a89586bb501af0ca595435c3ed0485fb2f1f0ee2a42cd66a1b1eadf

SHA512
345d8845f81002cefca7717e46f183b9d0f6da2a1e3d8e569a0db0e9c48637d9798b031fc872f1f0448b6f1619cd3156387d50245a887fadeff5dbdf70c1705c

Download Submit
\Windows\system\kJhxElL.exe

Filesize
924KB

MD5
48f87d5a99f68a0732ca9f77457365a6

SHA1
e85cb1db7407f949060f7cdd472c68c7aa98271b

SHA256
90404e2f86854ad0dc440b383e00d0f106caf5611aa961a0982486c3ba6400cf

SHA512
28b0c07f92668421842ea0357a2e402f904d8b5c12f2b544df889b37d91b4e419b0c3dab4525c7d9082b7c6ddefbf3226e420a38bb900d8c5a2dcdd7ddf86a80

Download Submit
\Windows\system\rXcXqbC.exe

Filesize
924KB

MD5
dc7427cde9d475e3a9d6654f54d68d65

SHA1
2a1bc27973e85f932231a1070aa782ca670a6884

SHA256
88493e65fbb9166a0afba77db831bced638856e44e0f21e40181635d7bc90241

SHA512
0cf3436519b62578f2b229ed5017149d033f70b69a22d5e7881692da0af58fc566cfec83e52bbb342987545b3def8360d984154df5aee7253a8de186fc2b7df9

Download Submit
\Windows\system\xiUZVPM.exe

Filesize
921KB

MD5
017cf631401fe7c9b162ae822f70fa58

SHA1
e33719ab6008d46b52576664ee51352f1b4963f0

SHA256
b109ed6c024d744da476d5b8cfdbfd301efdac628223013fbe2241c081dfe1c8

SHA512
9328c6a51b851683254a4d3ea44fb98d723f80db80cac269a7cc4b6d0b24293a06f3d2458d14447fa703e28bccbdd71f1d3eaa03475da1cc7c41003da097a4d2

Download Submit
memory/1572-5365-0x000000013FA90000-0x000000013FE82000-memory.dmp

Filesize
3.9MB

Download
memory/1572-170-0x000000013FA90000-0x000000013FE82000-memory.dmp

Filesize
3.9MB

Download
memory/1768-172-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download
memory/1768-6535-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download
memory/1784-204-0x000000013F030000-0x000000013F422000-memory.dmp

Filesize
3.9MB

Download
memory/1784-6459-0x000000013F030000-0x000000013F422000-memory.dmp

Filesize
3.9MB

Download
memory/2252-6-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download
memory/2252-173-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2252-169-0x0000000003420000-0x0000000003812000-memory.dmp

Filesize
3.9MB

Download
memory/2252-162-0x0000000003010000-0x0000000003402000-memory.dmp

Filesize
3.9MB

Download
memory/2252-215-0x0000000003010000-0x0000000003402000-memory.dmp

Filesize
3.9MB

Download
memory/2252-211-0x000000013F570000-0x000000013F962000-memory.dmp

Filesize
3.9MB

Download
memory/2252-17-0x0000000003010000-0x0000000003402000-memory.dmp

Filesize
3.9MB

Download
memory/2252-177-0x0000000003420000-0x0000000003812000-memory.dmp

Filesize
3.9MB

Download
memory/2252-161-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2252-165-0x0000000003420000-0x0000000003812000-memory.dmp

Filesize
3.9MB

Download
memory/2252-198-0x000000013F030000-0x000000013F422000-memory.dmp

Filesize
3.9MB

Download
memory/2252-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2252-171-0x0000000003420000-0x0000000003812000-memory.dmp

Filesize
3.9MB

Download
memory/2252-167-0x0000000003420000-0x0000000003812000-memory.dmp

Filesize
3.9MB

Download
memory/2308-6655-0x000000013FCA0000-0x0000000140092000-memory.dmp

Filesize
3.9MB

Download
memory/2308-160-0x000000013FCA0000-0x0000000140092000-memory.dmp

Filesize
3.9MB

Download
memory/2340-6478-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2340-174-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2548-164-0x000000013FC20000-0x0000000140012000-memory.dmp

Filesize
3.9MB

Download
memory/2548-6537-0x000000013FC20000-0x0000000140012000-memory.dmp

Filesize
3.9MB

Download
memory/2672-6456-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2672-163-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2708-27-0x000000001B760000-0x000000001BA42000-memory.dmp

Filesize
2.9MB

Download
memory/2708-159-0x000007FEF61B0000-0x000007FEF6B4D000-memory.dmp

Filesize
9.6MB

Download
memory/2708-780-0x000007FEF61B0000-0x000007FEF6B4D000-memory.dmp

Filesize
9.6MB

Download
memory/2708-34-0x0000000001D90000-0x0000000001D98000-memory.dmp

Filesize
32KB

Download
memory/2708-18-0x000007FEF646E000-0x000007FEF646F000-memory.dmp

Filesize
4KB

Download
memory/2728-168-0x000000013FC70000-0x0000000140062000-memory.dmp

Filesize
3.9MB

Download
memory/2728-6550-0x000000013FC70000-0x0000000140062000-memory.dmp

Filesize
3.9MB

Download
memory/2812-16-0x000000013F570000-0x000000013F962000-memory.dmp

Filesize
3.9MB

Download
memory/2812-6671-0x000000013F570000-0x000000013F962000-memory.dmp

Filesize
3.9MB

Download
memory/2948-6487-0x000000013F9C0000-0x000000013FDB2000-memory.dmp

Filesize
3.9MB

Download
memory/2948-214-0x000000013F9C0000-0x000000013FDB2000-memory.dmp

Filesize
3.9MB

Download
memory/2968-188-0x000000013FBF0000-0x000000013FFE2000-memory.dmp

Filesize
3.9MB

Download
memory/2968-6536-0x000000013FBF0000-0x000000013FFE2000-memory.dmp

Filesize
3.9MB

Download
memory/3036-166-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/3036-6483-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download