xmrig | 9f991cd494335c11d6ae2bd4756b33574825f5b53e788132937e9d6ce92f6a70

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 03:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4726b9d1243b990575bc1245450fc0b0N.exe
Size

3.4MB
MD5

4726b9d1243b990575bc1245450fc0b0
SHA1

130d31067b2c1934bec5f0abeeb3abd9e42fda55
SHA256

9f991cd494335c11d6ae2bd4756b33574825f5b53e788132937e9d6ce92f6a70
SHA512

9322fbec8c028f672d2a5db1edd6cb27e8b92832203b66ebb339f4ef4c1fdd3bef25458d242dc14c5985e04992dc353745187791368668511974c3a366856da0
SSDEEP

98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW4:7bBeSFkE

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 51 IoCs

miner

resource	yara_rule
behavioral1/memory/1300-2-0x000000013F7B0000-0x000000013FBA6000-memory.dmp	xmrig
behavioral1/files/0x00090000000120fb-3.dat	xmrig
behavioral1/files/0x0008000000016ce0-12.dat	xmrig
behavioral1/memory/1084-13-0x000000013FE10000-0x0000000140206000-memory.dmp	xmrig
behavioral1/files/0x0008000000016ce8-11.dat	xmrig
behavioral1/files/0x0007000000004e74-29.dat	xmrig
behavioral1/memory/2352-31-0x000000013FDD0000-0x00000001401C6000-memory.dmp	xmrig
behavioral1/memory/1692-42-0x000000013F2B0000-0x000000013F6A6000-memory.dmp	xmrig
behavioral1/files/0x0009000000016d04-38.dat	xmrig
behavioral1/files/0x0007000000016d5a-43.dat	xmrig
behavioral1/files/0x0007000000016e1d-57.dat	xmrig
behavioral1/files/0x00050000000195c4-75.dat	xmrig
behavioral1/files/0x00050000000195c2-68.dat	xmrig
behavioral1/memory/2692-82-0x000000013F720000-0x000000013FB16000-memory.dmp	xmrig
behavioral1/memory/2868-95-0x000000013F340000-0x000000013F736000-memory.dmp	xmrig
behavioral1/memory/1300-108-0x000000013F7B0000-0x000000013FBA6000-memory.dmp	xmrig
behavioral1/files/0x00050000000196a0-139.dat	xmrig
behavioral1/files/0x0005000000019d5c-177.dat	xmrig
behavioral1/files/0x0005000000019f57-188.dat	xmrig
behavioral1/files/0x0005000000019cd5-179.dat	xmrig
behavioral1/files/0x0005000000019bf2-170.dat	xmrig
behavioral1/files/0x0005000000019f71-192.dat	xmrig
behavioral1/files/0x0005000000019bec-147.dat	xmrig
behavioral1/files/0x0005000000019d69-186.dat	xmrig
behavioral1/files/0x0005000000019cfc-173.dat	xmrig
behavioral1/files/0x0005000000019c0b-162.dat	xmrig
behavioral1/files/0x0005000000019bf0-154.dat	xmrig
behavioral1/files/0x0005000000019624-131.dat	xmrig
behavioral1/files/0x00050000000195d0-120.dat	xmrig
behavioral1/files/0x0005000000019931-144.dat	xmrig
behavioral1/files/0x0005000000019665-135.dat	xmrig
behavioral1/files/0x00050000000195e0-124.dat	xmrig
behavioral1/memory/840-107-0x000000013F430000-0x000000013F826000-memory.dmp	xmrig
behavioral1/files/0x00050000000195cc-103.dat	xmrig
behavioral1/files/0x00050000000195c8-92.dat	xmrig
behavioral1/files/0x00050000000195ce-112.dat	xmrig
behavioral1/files/0x00050000000195ca-99.dat	xmrig
behavioral1/files/0x00050000000195c6-77.dat	xmrig
behavioral1/memory/2684-71-0x000000013FC70000-0x0000000140066000-memory.dmp	xmrig
behavioral1/files/0x00050000000195c7-87.dat	xmrig
behavioral1/memory/3036-59-0x000000013F940000-0x000000013FD36000-memory.dmp	xmrig
behavioral1/memory/2636-66-0x000000013F1F0000-0x000000013F5E6000-memory.dmp	xmrig
behavioral1/files/0x0008000000017342-63.dat	xmrig
behavioral1/files/0x0007000000016d71-52.dat	xmrig
behavioral1/memory/2936-30-0x000000013F0A0000-0x000000013F496000-memory.dmp	xmrig
behavioral1/memory/2112-15-0x000000013F950000-0x000000013FD46000-memory.dmp	xmrig
behavioral1/memory/2112-2941-0x000000013F950000-0x000000013FD46000-memory.dmp	xmrig
behavioral1/memory/2936-3258-0x000000013F0A0000-0x000000013F496000-memory.dmp	xmrig
behavioral1/memory/2352-3643-0x000000013FDD0000-0x00000001401C6000-memory.dmp	xmrig
behavioral1/memory/2352-4493-0x000000013FDD0000-0x00000001401C6000-memory.dmp	xmrig
behavioral1/memory/840-4551-0x000000013F430000-0x000000013F826000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2500	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1084	wPxfeCP.exe
2112	pZGwTuk.exe
2936	gvdLShA.exe
2352	PcmZLrj.exe
1692	zRNyBKN.exe
3036	lMLRSQE.exe
2636	tHbRpeX.exe
2692	bIBIljs.exe
2684	jTApjEw.exe
2868	uNzmTCW.exe
840	PPZPOyQ.exe
2884	QMruVvI.exe
2044	epHYhHz.exe
2968	BlQCLVc.exe
2696	aujembr.exe
3024	jfXxfpK.exe
2904	qQlMNBw.exe
2000	SxpOWDb.exe
3056	OGySUbc.exe
2284	cWCPJcb.exe
2588	CBPTITv.exe
2416	IYQtKbL.exe
2424	ctwnVGE.exe
2504	DrRjGdZ.exe
2060	gTJdJSd.exe
1744	mZWPnBr.exe
884	icaXhfB.exe
1984	gBGmldS.exe
2552	puMRTeo.exe
2432	jQVQwnI.exe
700	mkWezpk.exe
1712	fuDgtQw.exe
1756	kNXXfXj.exe
1800	vsNjTxx.exe
1360	EaUtApK.exe
2604	aEbDnzf.exe
1752	UdxrPvZ.exe
968	RnrsHAw.exe
2108	rBYWMop.exe
2248	kXapdjE.exe
2368	PpsrWEi.exe
2564	phhYiKz.exe
1508	uThsoVl.exe
1796	rxFoVMH.exe
1784	SYEGSYe.exe
1260	xXyqjCU.exe
1568	VVJFsAi.exe
304	gkCYJkx.exe
372	VsIqpjH.exe
2096	cZYmQeF.exe
2324	mptIIsp.exe
2128	XsbPVdV.exe
1612	wfyjwiI.exe
1728	FwjVKOY.exe
2316	TbwINdG.exe
2920	pkCttkU.exe
2852	BzCyiNZ.exe
1936	ejoBJej.exe
1932	RltkuUc.exe
2652	vMrucDv.exe
3044	xuMbcBe.exe
1484	OqjXIVd.exe
1492	BqWiCZe.exe
2612	GyjthSw.exe

Loads dropped DLL 64 IoCs

pid	Process
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe
1300	4726b9d1243b990575bc1245450fc0b0N.exe

UPX packed file 51 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1300-2-0x000000013F7B0000-0x000000013FBA6000-memory.dmp	upx
behavioral1/files/0x00090000000120fb-3.dat	upx
behavioral1/files/0x0008000000016ce0-12.dat	upx
behavioral1/memory/1084-13-0x000000013FE10000-0x0000000140206000-memory.dmp	upx
behavioral1/files/0x0008000000016ce8-11.dat	upx
behavioral1/files/0x0007000000004e74-29.dat	upx
behavioral1/memory/2352-31-0x000000013FDD0000-0x00000001401C6000-memory.dmp	upx
behavioral1/memory/1692-42-0x000000013F2B0000-0x000000013F6A6000-memory.dmp	upx
behavioral1/files/0x0009000000016d04-38.dat	upx
behavioral1/files/0x0007000000016d5a-43.dat	upx
behavioral1/files/0x0007000000016e1d-57.dat	upx
behavioral1/files/0x00050000000195c4-75.dat	upx
behavioral1/files/0x00050000000195c2-68.dat	upx
behavioral1/memory/2692-82-0x000000013F720000-0x000000013FB16000-memory.dmp	upx
behavioral1/memory/2868-95-0x000000013F340000-0x000000013F736000-memory.dmp	upx
behavioral1/memory/1300-108-0x000000013F7B0000-0x000000013FBA6000-memory.dmp	upx
behavioral1/files/0x00050000000196a0-139.dat	upx
behavioral1/files/0x0005000000019d5c-177.dat	upx
behavioral1/files/0x0005000000019f57-188.dat	upx
behavioral1/files/0x0005000000019cd5-179.dat	upx
behavioral1/files/0x0005000000019bf2-170.dat	upx
behavioral1/files/0x0005000000019f71-192.dat	upx
behavioral1/files/0x0005000000019bec-147.dat	upx
behavioral1/files/0x0005000000019d69-186.dat	upx
behavioral1/files/0x0005000000019cfc-173.dat	upx
behavioral1/files/0x0005000000019c0b-162.dat	upx
behavioral1/files/0x0005000000019bf0-154.dat	upx
behavioral1/files/0x0005000000019624-131.dat	upx
behavioral1/files/0x00050000000195d0-120.dat	upx
behavioral1/files/0x0005000000019931-144.dat	upx
behavioral1/files/0x0005000000019665-135.dat	upx
behavioral1/files/0x00050000000195e0-124.dat	upx
behavioral1/memory/840-107-0x000000013F430000-0x000000013F826000-memory.dmp	upx
behavioral1/files/0x00050000000195cc-103.dat	upx
behavioral1/files/0x00050000000195c8-92.dat	upx
behavioral1/files/0x00050000000195ce-112.dat	upx
behavioral1/files/0x00050000000195ca-99.dat	upx
behavioral1/files/0x00050000000195c6-77.dat	upx
behavioral1/memory/2684-71-0x000000013FC70000-0x0000000140066000-memory.dmp	upx
behavioral1/files/0x00050000000195c7-87.dat	upx
behavioral1/memory/3036-59-0x000000013F940000-0x000000013FD36000-memory.dmp	upx
behavioral1/memory/2636-66-0x000000013F1F0000-0x000000013F5E6000-memory.dmp	upx
behavioral1/files/0x0008000000017342-63.dat	upx
behavioral1/files/0x0007000000016d71-52.dat	upx
behavioral1/memory/2936-30-0x000000013F0A0000-0x000000013F496000-memory.dmp	upx
behavioral1/memory/2112-15-0x000000013F950000-0x000000013FD46000-memory.dmp	upx
behavioral1/memory/2112-2941-0x000000013F950000-0x000000013FD46000-memory.dmp	upx
behavioral1/memory/2936-3258-0x000000013F0A0000-0x000000013F496000-memory.dmp	upx
behavioral1/memory/2352-3643-0x000000013FDD0000-0x00000001401C6000-memory.dmp	upx
behavioral1/memory/2352-4493-0x000000013FDD0000-0x00000001401C6000-memory.dmp	upx
behavioral1/memory/840-4551-0x000000013F430000-0x000000013F826000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\yoLKaAB.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\rcmuBse.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\tXbIpQM.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\oGOmDPo.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\NjjYSmh.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\UahJhkd.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\ENMwMSD.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\nJiNjfD.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\vCyZcZS.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\enFGrCz.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\ZEOqWIx.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\kkHCcdh.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\RxRTzGH.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\LZGBWvI.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\QAIXBqo.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\QkuFOIL.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\AWLZWTj.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\ExqHRLb.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\xpLlcsN.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\OZIglJs.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\VBXBZbj.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\UvMtaNW.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\JdUsqCx.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\jzqismi.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\ctVprkR.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\HDIbmgy.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\nMCgzxT.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\hiLSrdQ.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\iZMjepC.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\vbEctmA.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\eeYlZlu.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\nMiZtYd.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\UVkwRKS.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\kzVkYEq.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\aoAumfM.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\NBxyTlY.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\gOuffNm.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\fzEYScp.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\jqfjNYx.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\SoNYHrz.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\iLgDMcu.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\nplVTtY.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\gYvJHgy.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\aSqvdoU.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\zeLyujb.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\tkFaRKv.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\SEawUTT.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\jPgslWZ.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\jaKNifc.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\yzpjKpl.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\jcooJeT.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\tjPtILv.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\VVnwGvY.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\hUbTbgq.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\hCfcMAV.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\zAtUcKG.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\FLfQoFW.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\gJCpRGH.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\CMfLOtO.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\qzHCPZU.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\StQzIvs.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\cpTSUZU.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\qJwnHqd.exe	4726b9d1243b990575bc1245450fc0b0N.exe
File created	C:\Windows\System\FVKRVkl.exe	4726b9d1243b990575bc1245450fc0b0N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2500	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1300	4726b9d1243b990575bc1245450fc0b0N.exe
Token: SeLockMemoryPrivilege	1300	4726b9d1243b990575bc1245450fc0b0N.exe
Token: SeDebugPrivilege	2500	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 2500	1300	4726b9d1243b990575bc1245450fc0b0N.exe	31
PID 1300 wrote to memory of 2500	1300	4726b9d1243b990575bc1245450fc0b0N.exe	31
PID 1300 wrote to memory of 2500	1300	4726b9d1243b990575bc1245450fc0b0N.exe	31
PID 1300 wrote to memory of 1084	1300	4726b9d1243b990575bc1245450fc0b0N.exe	32
PID 1300 wrote to memory of 1084	1300	4726b9d1243b990575bc1245450fc0b0N.exe	32
PID 1300 wrote to memory of 1084	1300	4726b9d1243b990575bc1245450fc0b0N.exe	32
PID 1300 wrote to memory of 2112	1300	4726b9d1243b990575bc1245450fc0b0N.exe	33
PID 1300 wrote to memory of 2112	1300	4726b9d1243b990575bc1245450fc0b0N.exe	33
PID 1300 wrote to memory of 2112	1300	4726b9d1243b990575bc1245450fc0b0N.exe	33
PID 1300 wrote to memory of 2936	1300	4726b9d1243b990575bc1245450fc0b0N.exe	34
PID 1300 wrote to memory of 2936	1300	4726b9d1243b990575bc1245450fc0b0N.exe	34
PID 1300 wrote to memory of 2936	1300	4726b9d1243b990575bc1245450fc0b0N.exe	34
PID 1300 wrote to memory of 2352	1300	4726b9d1243b990575bc1245450fc0b0N.exe	35
PID 1300 wrote to memory of 2352	1300	4726b9d1243b990575bc1245450fc0b0N.exe	35
PID 1300 wrote to memory of 2352	1300	4726b9d1243b990575bc1245450fc0b0N.exe	35
PID 1300 wrote to memory of 1692	1300	4726b9d1243b990575bc1245450fc0b0N.exe	36
PID 1300 wrote to memory of 1692	1300	4726b9d1243b990575bc1245450fc0b0N.exe	36
PID 1300 wrote to memory of 1692	1300	4726b9d1243b990575bc1245450fc0b0N.exe	36
PID 1300 wrote to memory of 3036	1300	4726b9d1243b990575bc1245450fc0b0N.exe	37
PID 1300 wrote to memory of 3036	1300	4726b9d1243b990575bc1245450fc0b0N.exe	37
PID 1300 wrote to memory of 3036	1300	4726b9d1243b990575bc1245450fc0b0N.exe	37
PID 1300 wrote to memory of 2636	1300	4726b9d1243b990575bc1245450fc0b0N.exe	38
PID 1300 wrote to memory of 2636	1300	4726b9d1243b990575bc1245450fc0b0N.exe	38
PID 1300 wrote to memory of 2636	1300	4726b9d1243b990575bc1245450fc0b0N.exe	38
PID 1300 wrote to memory of 2692	1300	4726b9d1243b990575bc1245450fc0b0N.exe	39
PID 1300 wrote to memory of 2692	1300	4726b9d1243b990575bc1245450fc0b0N.exe	39
PID 1300 wrote to memory of 2692	1300	4726b9d1243b990575bc1245450fc0b0N.exe	39
PID 1300 wrote to memory of 2684	1300	4726b9d1243b990575bc1245450fc0b0N.exe	40
PID 1300 wrote to memory of 2684	1300	4726b9d1243b990575bc1245450fc0b0N.exe	40
PID 1300 wrote to memory of 2684	1300	4726b9d1243b990575bc1245450fc0b0N.exe	40
PID 1300 wrote to memory of 840	1300	4726b9d1243b990575bc1245450fc0b0N.exe	41
PID 1300 wrote to memory of 840	1300	4726b9d1243b990575bc1245450fc0b0N.exe	41
PID 1300 wrote to memory of 840	1300	4726b9d1243b990575bc1245450fc0b0N.exe	41
PID 1300 wrote to memory of 2868	1300	4726b9d1243b990575bc1245450fc0b0N.exe	42
PID 1300 wrote to memory of 2868	1300	4726b9d1243b990575bc1245450fc0b0N.exe	42
PID 1300 wrote to memory of 2868	1300	4726b9d1243b990575bc1245450fc0b0N.exe	42
PID 1300 wrote to memory of 2044	1300	4726b9d1243b990575bc1245450fc0b0N.exe	43
PID 1300 wrote to memory of 2044	1300	4726b9d1243b990575bc1245450fc0b0N.exe	43
PID 1300 wrote to memory of 2044	1300	4726b9d1243b990575bc1245450fc0b0N.exe	43
PID 1300 wrote to memory of 2884	1300	4726b9d1243b990575bc1245450fc0b0N.exe	44
PID 1300 wrote to memory of 2884	1300	4726b9d1243b990575bc1245450fc0b0N.exe	44
PID 1300 wrote to memory of 2884	1300	4726b9d1243b990575bc1245450fc0b0N.exe	44
PID 1300 wrote to memory of 2696	1300	4726b9d1243b990575bc1245450fc0b0N.exe	45
PID 1300 wrote to memory of 2696	1300	4726b9d1243b990575bc1245450fc0b0N.exe	45
PID 1300 wrote to memory of 2696	1300	4726b9d1243b990575bc1245450fc0b0N.exe	45
PID 1300 wrote to memory of 2968	1300	4726b9d1243b990575bc1245450fc0b0N.exe	46
PID 1300 wrote to memory of 2968	1300	4726b9d1243b990575bc1245450fc0b0N.exe	46
PID 1300 wrote to memory of 2968	1300	4726b9d1243b990575bc1245450fc0b0N.exe	46
PID 1300 wrote to memory of 2904	1300	4726b9d1243b990575bc1245450fc0b0N.exe	47
PID 1300 wrote to memory of 2904	1300	4726b9d1243b990575bc1245450fc0b0N.exe	47
PID 1300 wrote to memory of 2904	1300	4726b9d1243b990575bc1245450fc0b0N.exe	47
PID 1300 wrote to memory of 3024	1300	4726b9d1243b990575bc1245450fc0b0N.exe	48
PID 1300 wrote to memory of 3024	1300	4726b9d1243b990575bc1245450fc0b0N.exe	48
PID 1300 wrote to memory of 3024	1300	4726b9d1243b990575bc1245450fc0b0N.exe	48
PID 1300 wrote to memory of 2000	1300	4726b9d1243b990575bc1245450fc0b0N.exe	49
PID 1300 wrote to memory of 2000	1300	4726b9d1243b990575bc1245450fc0b0N.exe	49
PID 1300 wrote to memory of 2000	1300	4726b9d1243b990575bc1245450fc0b0N.exe	49
PID 1300 wrote to memory of 3056	1300	4726b9d1243b990575bc1245450fc0b0N.exe	50
PID 1300 wrote to memory of 3056	1300	4726b9d1243b990575bc1245450fc0b0N.exe	50
PID 1300 wrote to memory of 3056	1300	4726b9d1243b990575bc1245450fc0b0N.exe	50
PID 1300 wrote to memory of 2284	1300	4726b9d1243b990575bc1245450fc0b0N.exe	51
PID 1300 wrote to memory of 2284	1300	4726b9d1243b990575bc1245450fc0b0N.exe	51
PID 1300 wrote to memory of 2284	1300	4726b9d1243b990575bc1245450fc0b0N.exe	51
PID 1300 wrote to memory of 2588	1300	4726b9d1243b990575bc1245450fc0b0N.exe	52

C:\Users\Admin\AppData\Local\Temp\4726b9d1243b990575bc1245450fc0b0N.exe
"C:\Users\Admin\AppData\Local\Temp\4726b9d1243b990575bc1245450fc0b0N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2500
- C:\Windows\System\wPxfeCP.exe
  C:\Windows\System\wPxfeCP.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\pZGwTuk.exe
  C:\Windows\System\pZGwTuk.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\gvdLShA.exe
  C:\Windows\System\gvdLShA.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\PcmZLrj.exe
  C:\Windows\System\PcmZLrj.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\zRNyBKN.exe
  C:\Windows\System\zRNyBKN.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\lMLRSQE.exe
  C:\Windows\System\lMLRSQE.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\tHbRpeX.exe
  C:\Windows\System\tHbRpeX.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\bIBIljs.exe
  C:\Windows\System\bIBIljs.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\jTApjEw.exe
  C:\Windows\System\jTApjEw.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\PPZPOyQ.exe
  C:\Windows\System\PPZPOyQ.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\uNzmTCW.exe
  C:\Windows\System\uNzmTCW.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\epHYhHz.exe
  C:\Windows\System\epHYhHz.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\QMruVvI.exe
  C:\Windows\System\QMruVvI.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\aujembr.exe
  C:\Windows\System\aujembr.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\BlQCLVc.exe
  C:\Windows\System\BlQCLVc.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\qQlMNBw.exe
  C:\Windows\System\qQlMNBw.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\jfXxfpK.exe
  C:\Windows\System\jfXxfpK.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\SxpOWDb.exe
  C:\Windows\System\SxpOWDb.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\OGySUbc.exe
  C:\Windows\System\OGySUbc.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\cWCPJcb.exe
  C:\Windows\System\cWCPJcb.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\CBPTITv.exe
  C:\Windows\System\CBPTITv.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\ctwnVGE.exe
  C:\Windows\System\ctwnVGE.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\IYQtKbL.exe
  C:\Windows\System\IYQtKbL.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\mZWPnBr.exe
  C:\Windows\System\mZWPnBr.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\DrRjGdZ.exe
  C:\Windows\System\DrRjGdZ.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\icaXhfB.exe
  C:\Windows\System\icaXhfB.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\gTJdJSd.exe
  C:\Windows\System\gTJdJSd.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\puMRTeo.exe
  C:\Windows\System\puMRTeo.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\gBGmldS.exe
  C:\Windows\System\gBGmldS.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\jQVQwnI.exe
  C:\Windows\System\jQVQwnI.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\mkWezpk.exe
  C:\Windows\System\mkWezpk.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\aEbDnzf.exe
  C:\Windows\System\aEbDnzf.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\fuDgtQw.exe
  C:\Windows\System\fuDgtQw.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\UdxrPvZ.exe
  C:\Windows\System\UdxrPvZ.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\kNXXfXj.exe
  C:\Windows\System\kNXXfXj.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\RnrsHAw.exe
  C:\Windows\System\RnrsHAw.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\vsNjTxx.exe
  C:\Windows\System\vsNjTxx.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\rBYWMop.exe
  C:\Windows\System\rBYWMop.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\EaUtApK.exe
  C:\Windows\System\EaUtApK.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\kXapdjE.exe
  C:\Windows\System\kXapdjE.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\PpsrWEi.exe
  C:\Windows\System\PpsrWEi.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\phhYiKz.exe
  C:\Windows\System\phhYiKz.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\uThsoVl.exe
  C:\Windows\System\uThsoVl.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\rxFoVMH.exe
  C:\Windows\System\rxFoVMH.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\SYEGSYe.exe
  C:\Windows\System\SYEGSYe.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\xXyqjCU.exe
  C:\Windows\System\xXyqjCU.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\VVJFsAi.exe
  C:\Windows\System\VVJFsAi.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\gkCYJkx.exe
  C:\Windows\System\gkCYJkx.exe
  2⤵
  - Executes dropped EXE
  PID:304
- C:\Windows\System\VsIqpjH.exe
  C:\Windows\System\VsIqpjH.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\cZYmQeF.exe
  C:\Windows\System\cZYmQeF.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\mptIIsp.exe
  C:\Windows\System\mptIIsp.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\XsbPVdV.exe
  C:\Windows\System\XsbPVdV.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\wfyjwiI.exe
  C:\Windows\System\wfyjwiI.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\FwjVKOY.exe
  C:\Windows\System\FwjVKOY.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\TbwINdG.exe
  C:\Windows\System\TbwINdG.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\pkCttkU.exe
  C:\Windows\System\pkCttkU.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\BzCyiNZ.exe
  C:\Windows\System\BzCyiNZ.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\ejoBJej.exe
  C:\Windows\System\ejoBJej.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\RltkuUc.exe
  C:\Windows\System\RltkuUc.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\vMrucDv.exe
  C:\Windows\System\vMrucDv.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\xuMbcBe.exe
  C:\Windows\System\xuMbcBe.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\OqjXIVd.exe
  C:\Windows\System\OqjXIVd.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\BqWiCZe.exe
  C:\Windows\System\BqWiCZe.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\GyjthSw.exe
  C:\Windows\System\GyjthSw.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\NuieHbp.exe
  C:\Windows\System\NuieHbp.exe
  2⤵
  PID:3068
- C:\Windows\System\euVRJid.exe
  C:\Windows\System\euVRJid.exe
  2⤵
  PID:3060
- C:\Windows\System\GMyyZaR.exe
  C:\Windows\System\GMyyZaR.exe
  2⤵
  PID:2996
- C:\Windows\System\rjLkGZl.exe
  C:\Windows\System\rjLkGZl.exe
  2⤵
  PID:1340
- C:\Windows\System\wwVPaFn.exe
  C:\Windows\System\wwVPaFn.exe
  2⤵
  PID:2268
- C:\Windows\System\RSPdtwq.exe
  C:\Windows\System\RSPdtwq.exe
  2⤵
  PID:3020
- C:\Windows\System\jgOyZlA.exe
  C:\Windows\System\jgOyZlA.exe
  2⤵
  PID:2560
- C:\Windows\System\VNtDQgE.exe
  C:\Windows\System\VNtDQgE.exe
  2⤵
  PID:1996
- C:\Windows\System\YhjwLyF.exe
  C:\Windows\System\YhjwLyF.exe
  2⤵
  PID:1284
- C:\Windows\System\rCCkHGd.exe
  C:\Windows\System\rCCkHGd.exe
  2⤵
  PID:784
- C:\Windows\System\fWOfUUK.exe
  C:\Windows\System\fWOfUUK.exe
  2⤵
  PID:1620
- C:\Windows\System\ShtYOVz.exe
  C:\Windows\System\ShtYOVz.exe
  2⤵
  PID:1392
- C:\Windows\System\PGXFnjA.exe
  C:\Windows\System\PGXFnjA.exe
  2⤵
  PID:2644
- C:\Windows\System\kHwFHMG.exe
  C:\Windows\System\kHwFHMG.exe
  2⤵
  PID:3052
- C:\Windows\System\eXGYQfe.exe
  C:\Windows\System\eXGYQfe.exe
  2⤵
  PID:580
- C:\Windows\System\xLlfMOZ.exe
  C:\Windows\System\xLlfMOZ.exe
  2⤵
  PID:2984
- C:\Windows\System\VPAiPkG.exe
  C:\Windows\System\VPAiPkG.exe
  2⤵
  PID:1156
- C:\Windows\System\vAVSaBE.exe
  C:\Windows\System\vAVSaBE.exe
  2⤵
  PID:1832
- C:\Windows\System\tTCHWMf.exe
  C:\Windows\System\tTCHWMf.exe
  2⤵
  PID:2404
- C:\Windows\System\fIonZGI.exe
  C:\Windows\System\fIonZGI.exe
  2⤵
  PID:2296
- C:\Windows\System\VybbOQs.exe
  C:\Windows\System\VybbOQs.exe
  2⤵
  PID:1344
- C:\Windows\System\oZDWbZs.exe
  C:\Windows\System\oZDWbZs.exe
  2⤵
  PID:2088
- C:\Windows\System\UvMtaNW.exe
  C:\Windows\System\UvMtaNW.exe
  2⤵
  PID:916
- C:\Windows\System\Hwndshn.exe
  C:\Windows\System\Hwndshn.exe
  2⤵
  PID:2092
- C:\Windows\System\KvwKHap.exe
  C:\Windows\System\KvwKHap.exe
  2⤵
  PID:1020
- C:\Windows\System\nPOJAOf.exe
  C:\Windows\System\nPOJAOf.exe
  2⤵
  PID:1792
- C:\Windows\System\RSvPlMn.exe
  C:\Windows\System\RSvPlMn.exe
  2⤵
  PID:1872
- C:\Windows\System\aMOhhOy.exe
  C:\Windows\System\aMOhhOy.exe
  2⤵
  PID:712
- C:\Windows\System\KBscVAn.exe
  C:\Windows\System\KBscVAn.exe
  2⤵
  PID:1000
- C:\Windows\System\zPGjuUS.exe
  C:\Windows\System\zPGjuUS.exe
  2⤵
  PID:1724
- C:\Windows\System\nAQvIqT.exe
  C:\Windows\System\nAQvIqT.exe
  2⤵
  PID:1696
- C:\Windows\System\Lfrhrxr.exe
  C:\Windows\System\Lfrhrxr.exe
  2⤵
  PID:1636
- C:\Windows\System\omgOiTP.exe
  C:\Windows\System\omgOiTP.exe
  2⤵
  PID:1736
- C:\Windows\System\yhVYDCN.exe
  C:\Windows\System\yhVYDCN.exe
  2⤵
  PID:2100
- C:\Windows\System\aoFvQbO.exe
  C:\Windows\System\aoFvQbO.exe
  2⤵
  PID:628
- C:\Windows\System\pPoHysT.exe
  C:\Windows\System\pPoHysT.exe
  2⤵
  PID:1704
- C:\Windows\System\OgTnoqz.exe
  C:\Windows\System\OgTnoqz.exe
  2⤵
  PID:2340
- C:\Windows\System\iddaYSs.exe
  C:\Windows\System\iddaYSs.exe
  2⤵
  PID:1604
- C:\Windows\System\oBCrXky.exe
  C:\Windows\System\oBCrXky.exe
  2⤵
  PID:2292
- C:\Windows\System\mumhOwW.exe
  C:\Windows\System\mumhOwW.exe
  2⤵
  PID:2856
- C:\Windows\System\SCBnUre.exe
  C:\Windows\System\SCBnUre.exe
  2⤵
  PID:2764
- C:\Windows\System\pdKfGvc.exe
  C:\Windows\System\pdKfGvc.exe
  2⤵
  PID:2412
- C:\Windows\System\JAHcltt.exe
  C:\Windows\System\JAHcltt.exe
  2⤵
  PID:2240
- C:\Windows\System\rUBiVOm.exe
  C:\Windows\System\rUBiVOm.exe
  2⤵
  PID:1588
- C:\Windows\System\NsCBFoF.exe
  C:\Windows\System\NsCBFoF.exe
  2⤵
  PID:1040
- C:\Windows\System\dooDvIz.exe
  C:\Windows\System\dooDvIz.exe
  2⤵
  PID:1448
- C:\Windows\System\wQALuBo.exe
  C:\Windows\System\wQALuBo.exe
  2⤵
  PID:2608
- C:\Windows\System\BnhWoby.exe
  C:\Windows\System\BnhWoby.exe
  2⤵
  PID:608
- C:\Windows\System\OJQDlEk.exe
  C:\Windows\System\OJQDlEk.exe
  2⤵
  PID:1396
- C:\Windows\System\JbhaWoc.exe
  C:\Windows\System\JbhaWoc.exe
  2⤵
  PID:2772
- C:\Windows\System\pkeeYFi.exe
  C:\Windows\System\pkeeYFi.exe
  2⤵
  PID:3004
- C:\Windows\System\BTJqhmX.exe
  C:\Windows\System\BTJqhmX.exe
  2⤵
  PID:872
- C:\Windows\System\iXRWVQF.exe
  C:\Windows\System\iXRWVQF.exe
  2⤵
  PID:1668
- C:\Windows\System\BNDgVXp.exe
  C:\Windows\System\BNDgVXp.exe
  2⤵
  PID:1148
- C:\Windows\System\hRSaLfY.exe
  C:\Windows\System\hRSaLfY.exe
  2⤵
  PID:1780
- C:\Windows\System\HaYAnAC.exe
  C:\Windows\System\HaYAnAC.exe
  2⤵
  PID:2492
- C:\Windows\System\WTDrRHo.exe
  C:\Windows\System\WTDrRHo.exe
  2⤵
  PID:2520
- C:\Windows\System\RSjakrV.exe
  C:\Windows\System\RSjakrV.exe
  2⤵
  PID:1616
- C:\Windows\System\NdWgSfl.exe
  C:\Windows\System\NdWgSfl.exe
  2⤵
  PID:1544
- C:\Windows\System\uWPcZUA.exe
  C:\Windows\System\uWPcZUA.exe
  2⤵
  PID:1652
- C:\Windows\System\YfShmDR.exe
  C:\Windows\System\YfShmDR.exe
  2⤵
  PID:2084
- C:\Windows\System\MlKwwWG.exe
  C:\Windows\System\MlKwwWG.exe
  2⤵
  PID:2516
- C:\Windows\System\iLgDMcu.exe
  C:\Windows\System\iLgDMcu.exe
  2⤵
  PID:1608
- C:\Windows\System\lGjxoJg.exe
  C:\Windows\System\lGjxoJg.exe
  2⤵
  PID:2824
- C:\Windows\System\iDEQUsm.exe
  C:\Windows\System\iDEQUsm.exe
  2⤵
  PID:2232
- C:\Windows\System\lpOnOUX.exe
  C:\Windows\System\lpOnOUX.exe
  2⤵
  PID:1716
- C:\Windows\System\pZBrfum.exe
  C:\Windows\System\pZBrfum.exe
  2⤵
  PID:2276
- C:\Windows\System\GHfjJMp.exe
  C:\Windows\System\GHfjJMp.exe
  2⤵
  PID:2784
- C:\Windows\System\uUqmmjV.exe
  C:\Windows\System\uUqmmjV.exe
  2⤵
  PID:944
- C:\Windows\System\HLcMVRm.exe
  C:\Windows\System\HLcMVRm.exe
  2⤵
  PID:1316
- C:\Windows\System\EmqFygf.exe
  C:\Windows\System\EmqFygf.exe
  2⤵
  PID:1556
- C:\Windows\System\nXPTKEE.exe
  C:\Windows\System\nXPTKEE.exe
  2⤵
  PID:1860
- C:\Windows\System\xpOGhqM.exe
  C:\Windows\System\xpOGhqM.exe
  2⤵
  PID:1680
- C:\Windows\System\ROGuLwS.exe
  C:\Windows\System\ROGuLwS.exe
  2⤵
  PID:1352
- C:\Windows\System\YrjKZCH.exe
  C:\Windows\System\YrjKZCH.exe
  2⤵
  PID:2184
- C:\Windows\System\EXXxUfQ.exe
  C:\Windows\System\EXXxUfQ.exe
  2⤵
  PID:1008
- C:\Windows\System\fsBEISJ.exe
  C:\Windows\System\fsBEISJ.exe
  2⤵
  PID:2420
- C:\Windows\System\mSIISGk.exe
  C:\Windows\System\mSIISGk.exe
  2⤵
  PID:584
- C:\Windows\System\hYROfGZ.exe
  C:\Windows\System\hYROfGZ.exe
  2⤵
  PID:880
- C:\Windows\System\YyCQeyr.exe
  C:\Windows\System\YyCQeyr.exe
  2⤵
  PID:1920
- C:\Windows\System\qWgwoLJ.exe
  C:\Windows\System\qWgwoLJ.exe
  2⤵
  PID:3084
- C:\Windows\System\stAzcCp.exe
  C:\Windows\System\stAzcCp.exe
  2⤵
  PID:3100
- C:\Windows\System\htpJQtu.exe
  C:\Windows\System\htpJQtu.exe
  2⤵
  PID:3116
- C:\Windows\System\kxGKOhM.exe
  C:\Windows\System\kxGKOhM.exe
  2⤵
  PID:3132
- C:\Windows\System\GDJQjzV.exe
  C:\Windows\System\GDJQjzV.exe
  2⤵
  PID:3148
- C:\Windows\System\oEfFfEp.exe
  C:\Windows\System\oEfFfEp.exe
  2⤵
  PID:3164
- C:\Windows\System\HZPBEPI.exe
  C:\Windows\System\HZPBEPI.exe
  2⤵
  PID:3180
- C:\Windows\System\FYuRPwf.exe
  C:\Windows\System\FYuRPwf.exe
  2⤵
  PID:3196
- C:\Windows\System\RDagIon.exe
  C:\Windows\System\RDagIon.exe
  2⤵
  PID:3212
- C:\Windows\System\pmssrAF.exe
  C:\Windows\System\pmssrAF.exe
  2⤵
  PID:3228
- C:\Windows\System\bmjCspc.exe
  C:\Windows\System\bmjCspc.exe
  2⤵
  PID:3244
- C:\Windows\System\qBjuInz.exe
  C:\Windows\System\qBjuInz.exe
  2⤵
  PID:3260
- C:\Windows\System\BtorUxP.exe
  C:\Windows\System\BtorUxP.exe
  2⤵
  PID:3276
- C:\Windows\System\jVDelFu.exe
  C:\Windows\System\jVDelFu.exe
  2⤵
  PID:3292
- C:\Windows\System\Mmagind.exe
  C:\Windows\System\Mmagind.exe
  2⤵
  PID:3308
- C:\Windows\System\QQFImyj.exe
  C:\Windows\System\QQFImyj.exe
  2⤵
  PID:3324
- C:\Windows\System\McuYlLV.exe
  C:\Windows\System\McuYlLV.exe
  2⤵
  PID:3340
- C:\Windows\System\lZLnabI.exe
  C:\Windows\System\lZLnabI.exe
  2⤵
  PID:3356
- C:\Windows\System\WMyZDGx.exe
  C:\Windows\System\WMyZDGx.exe
  2⤵
  PID:3372
- C:\Windows\System\LVlRWZz.exe
  C:\Windows\System\LVlRWZz.exe
  2⤵
  PID:3388
- C:\Windows\System\LcAJDpd.exe
  C:\Windows\System\LcAJDpd.exe
  2⤵
  PID:3408
- C:\Windows\System\cvlBoWh.exe
  C:\Windows\System\cvlBoWh.exe
  2⤵
  PID:3424
- C:\Windows\System\nHLFWgY.exe
  C:\Windows\System\nHLFWgY.exe
  2⤵
  PID:3440
- C:\Windows\System\BSByJrs.exe
  C:\Windows\System\BSByJrs.exe
  2⤵
  PID:3456
- C:\Windows\System\RyuEUmw.exe
  C:\Windows\System\RyuEUmw.exe
  2⤵
  PID:3472
- C:\Windows\System\tNshRXV.exe
  C:\Windows\System\tNshRXV.exe
  2⤵
  PID:3488
- C:\Windows\System\FGHlRPi.exe
  C:\Windows\System\FGHlRPi.exe
  2⤵
  PID:3504
- C:\Windows\System\MFlgqIC.exe
  C:\Windows\System\MFlgqIC.exe
  2⤵
  PID:3520
- C:\Windows\System\ukRygOn.exe
  C:\Windows\System\ukRygOn.exe
  2⤵
  PID:3536
- C:\Windows\System\VzfQgan.exe
  C:\Windows\System\VzfQgan.exe
  2⤵
  PID:3552
- C:\Windows\System\TKTJJuV.exe
  C:\Windows\System\TKTJJuV.exe
  2⤵
  PID:3568
- C:\Windows\System\fDtJljD.exe
  C:\Windows\System\fDtJljD.exe
  2⤵
  PID:3584
- C:\Windows\System\zloIbxE.exe
  C:\Windows\System\zloIbxE.exe
  2⤵
  PID:3608
- C:\Windows\System\whpZOgL.exe
  C:\Windows\System\whpZOgL.exe
  2⤵
  PID:3624
- C:\Windows\System\mBSlsZH.exe
  C:\Windows\System\mBSlsZH.exe
  2⤵
  PID:3640
- C:\Windows\System\SpreDjH.exe
  C:\Windows\System\SpreDjH.exe
  2⤵
  PID:3668
- C:\Windows\System\lAWmGpC.exe
  C:\Windows\System\lAWmGpC.exe
  2⤵
  PID:3692
- C:\Windows\System\ERuGlkk.exe
  C:\Windows\System\ERuGlkk.exe
  2⤵
  PID:3708
- C:\Windows\System\dmoLjRh.exe
  C:\Windows\System\dmoLjRh.exe
  2⤵
  PID:3724
- C:\Windows\System\loJJgls.exe
  C:\Windows\System\loJJgls.exe
  2⤵
  PID:3740
- C:\Windows\System\CSjrpmR.exe
  C:\Windows\System\CSjrpmR.exe
  2⤵
  PID:3756
- C:\Windows\System\mKgPOSP.exe
  C:\Windows\System\mKgPOSP.exe
  2⤵
  PID:3772
- C:\Windows\System\ZKlqxOz.exe
  C:\Windows\System\ZKlqxOz.exe
  2⤵
  PID:3788
- C:\Windows\System\kxPySJn.exe
  C:\Windows\System\kxPySJn.exe
  2⤵
  PID:3808
- C:\Windows\System\AWLZWTj.exe
  C:\Windows\System\AWLZWTj.exe
  2⤵
  PID:3824
- C:\Windows\System\BKJJenW.exe
  C:\Windows\System\BKJJenW.exe
  2⤵
  PID:3840
- C:\Windows\System\ZGGgCLQ.exe
  C:\Windows\System\ZGGgCLQ.exe
  2⤵
  PID:3856
- C:\Windows\System\hKInHoU.exe
  C:\Windows\System\hKInHoU.exe
  2⤵
  PID:3872
- C:\Windows\System\xWdaTGZ.exe
  C:\Windows\System\xWdaTGZ.exe
  2⤵
  PID:3888
- C:\Windows\System\kTRKGpE.exe
  C:\Windows\System\kTRKGpE.exe
  2⤵
  PID:3904
- C:\Windows\System\FQLNlpb.exe
  C:\Windows\System\FQLNlpb.exe
  2⤵
  PID:3920
- C:\Windows\System\IHRJOTG.exe
  C:\Windows\System\IHRJOTG.exe
  2⤵
  PID:3936
- C:\Windows\System\FAFGdob.exe
  C:\Windows\System\FAFGdob.exe
  2⤵
  PID:3952
- C:\Windows\System\lbNYurh.exe
  C:\Windows\System\lbNYurh.exe
  2⤵
  PID:3968
- C:\Windows\System\MAaxUEB.exe
  C:\Windows\System\MAaxUEB.exe
  2⤵
  PID:3984
- C:\Windows\System\DFyRjuY.exe
  C:\Windows\System\DFyRjuY.exe
  2⤵
  PID:4000
- C:\Windows\System\hZMsrJO.exe
  C:\Windows\System\hZMsrJO.exe
  2⤵
  PID:4016
- C:\Windows\System\QqgWBYP.exe
  C:\Windows\System\QqgWBYP.exe
  2⤵
  PID:4032
- C:\Windows\System\XUfSECH.exe
  C:\Windows\System\XUfSECH.exe
  2⤵
  PID:4048
- C:\Windows\System\ujMBkVI.exe
  C:\Windows\System\ujMBkVI.exe
  2⤵
  PID:4064
- C:\Windows\System\sWVuFzF.exe
  C:\Windows\System\sWVuFzF.exe
  2⤵
  PID:4080
- C:\Windows\System\TEhDFNM.exe
  C:\Windows\System\TEhDFNM.exe
  2⤵
  PID:2760
- C:\Windows\System\zfgcjdf.exe
  C:\Windows\System\zfgcjdf.exe
  2⤵
  PID:1032
- C:\Windows\System\tiGSvgA.exe
  C:\Windows\System\tiGSvgA.exe
  2⤵
  PID:1824
- C:\Windows\System\SrpUKvV.exe
  C:\Windows\System\SrpUKvV.exe
  2⤵
  PID:2872
- C:\Windows\System\rxdPCtj.exe
  C:\Windows\System\rxdPCtj.exe
  2⤵
  PID:1328
- C:\Windows\System\LLONyUt.exe
  C:\Windows\System\LLONyUt.exe
  2⤵
  PID:3096
- C:\Windows\System\twIhoot.exe
  C:\Windows\System\twIhoot.exe
  2⤵
  PID:3112
- C:\Windows\System\DkEHPeb.exe
  C:\Windows\System\DkEHPeb.exe
  2⤵
  PID:3144
- C:\Windows\System\uRmLTYZ.exe
  C:\Windows\System\uRmLTYZ.exe
  2⤵
  PID:3176
- C:\Windows\System\lxzYuqg.exe
  C:\Windows\System\lxzYuqg.exe
  2⤵
  PID:3224
- C:\Windows\System\AhIvuNn.exe
  C:\Windows\System\AhIvuNn.exe
  2⤵
  PID:3256
- C:\Windows\System\eRBizrz.exe
  C:\Windows\System\eRBizrz.exe
  2⤵
  PID:3272
- C:\Windows\System\sOYUlNP.exe
  C:\Windows\System\sOYUlNP.exe
  2⤵
  PID:3320
- C:\Windows\System\brdSHZW.exe
  C:\Windows\System\brdSHZW.exe
  2⤵
  PID:3336
- C:\Windows\System\WIldwtx.exe
  C:\Windows\System\WIldwtx.exe
  2⤵
  PID:3368
- C:\Windows\System\OuGUXRw.exe
  C:\Windows\System\OuGUXRw.exe
  2⤵
  PID:2216
- C:\Windows\System\eScgsaF.exe
  C:\Windows\System\eScgsaF.exe
  2⤵
  PID:3436
- C:\Windows\System\DrIZQZA.exe
  C:\Windows\System\DrIZQZA.exe
  2⤵
  PID:3464
- C:\Windows\System\rZOIXCQ.exe
  C:\Windows\System\rZOIXCQ.exe
  2⤵
  PID:3512
- C:\Windows\System\XhzCcvJ.exe
  C:\Windows\System\XhzCcvJ.exe
  2⤵
  PID:3528
- C:\Windows\System\ZCIUHXL.exe
  C:\Windows\System\ZCIUHXL.exe
  2⤵
  PID:3576
- C:\Windows\System\rpgAeko.exe
  C:\Windows\System\rpgAeko.exe
  2⤵
  PID:3592
- C:\Windows\System\VqKrULu.exe
  C:\Windows\System\VqKrULu.exe
  2⤵
  PID:3616
- C:\Windows\System\VBuoafv.exe
  C:\Windows\System\VBuoafv.exe
  2⤵
  PID:3688
- C:\Windows\System\WkCwOyh.exe
  C:\Windows\System\WkCwOyh.exe
  2⤵
  PID:3720
- C:\Windows\System\sctmvYo.exe
  C:\Windows\System\sctmvYo.exe
  2⤵
  PID:3748
- C:\Windows\System\NnGdEBy.exe
  C:\Windows\System\NnGdEBy.exe
  2⤵
  PID:3764
- C:\Windows\System\uRWDFCp.exe
  C:\Windows\System\uRWDFCp.exe
  2⤵
  PID:3796
- C:\Windows\System\XKpcoda.exe
  C:\Windows\System\XKpcoda.exe
  2⤵
  PID:3832
- C:\Windows\System\nUGlcZG.exe
  C:\Windows\System\nUGlcZG.exe
  2⤵
  PID:3864
- C:\Windows\System\bVxKsHJ.exe
  C:\Windows\System\bVxKsHJ.exe
  2⤵
  PID:3912
- C:\Windows\System\Mdmsaye.exe
  C:\Windows\System\Mdmsaye.exe
  2⤵
  PID:3928
- C:\Windows\System\bIipKBf.exe
  C:\Windows\System\bIipKBf.exe
  2⤵
  PID:3980
- C:\Windows\System\VCWCpYs.exe
  C:\Windows\System\VCWCpYs.exe
  2⤵
  PID:4012
- C:\Windows\System\inseKHV.exe
  C:\Windows\System\inseKHV.exe
  2⤵
  PID:4040
- C:\Windows\System\vUJpSkJ.exe
  C:\Windows\System\vUJpSkJ.exe
  2⤵
  PID:4072
- C:\Windows\System\rBTVCib.exe
  C:\Windows\System\rBTVCib.exe
  2⤵
  PID:1212
- C:\Windows\System\YFcBCvw.exe
  C:\Windows\System\YFcBCvw.exe
  2⤵
  PID:2832
- C:\Windows\System\SattlUZ.exe
  C:\Windows\System\SattlUZ.exe
  2⤵
  PID:1028
- C:\Windows\System\JOlnGFH.exe
  C:\Windows\System\JOlnGFH.exe
  2⤵
  PID:3092
- C:\Windows\System\vIuEaGF.exe
  C:\Windows\System\vIuEaGF.exe
  2⤵
  PID:3404
- C:\Windows\System\pehkkdg.exe
  C:\Windows\System\pehkkdg.exe
  2⤵
  PID:3160
- C:\Windows\System\gvbvtum.exe
  C:\Windows\System\gvbvtum.exe
  2⤵
  PID:3204
- C:\Windows\System\tHErOtU.exe
  C:\Windows\System\tHErOtU.exe
  2⤵
  PID:3008
- C:\Windows\System\MiDzHgx.exe
  C:\Windows\System\MiDzHgx.exe
  2⤵
  PID:3016
- C:\Windows\System\vXaGjrN.exe
  C:\Windows\System\vXaGjrN.exe
  2⤵
  PID:3656
- C:\Windows\System\RonMEjo.exe
  C:\Windows\System\RonMEjo.exe
  2⤵
  PID:3784
- C:\Windows\System\pRSDCjW.exe
  C:\Windows\System\pRSDCjW.exe
  2⤵
  PID:2932
- C:\Windows\System\KawVoRj.exe
  C:\Windows\System\KawVoRj.exe
  2⤵
  PID:1664
- C:\Windows\System\UpswxPI.exe
  C:\Windows\System\UpswxPI.exe
  2⤵
  PID:2956
- C:\Windows\System\KAvioZR.exe
  C:\Windows\System\KAvioZR.exe
  2⤵
  PID:2132
- C:\Windows\System\cNnnPdK.exe
  C:\Windows\System\cNnnPdK.exe
  2⤵
  PID:4008
- C:\Windows\System\hvjgyMu.exe
  C:\Windows\System\hvjgyMu.exe
  2⤵
  PID:2844
- C:\Windows\System\uzGxJCR.exe
  C:\Windows\System\uzGxJCR.exe
  2⤵
  PID:4056
- C:\Windows\System\ZduLMbK.exe
  C:\Windows\System\ZduLMbK.exe
  2⤵
  PID:4076
- C:\Windows\System\WpvMDnG.exe
  C:\Windows\System\WpvMDnG.exe
  2⤵
  PID:2488
- C:\Windows\System\eJFzJhN.exe
  C:\Windows\System\eJFzJhN.exe
  2⤵
  PID:2952
- C:\Windows\System\QQFYoIg.exe
  C:\Windows\System\QQFYoIg.exe
  2⤵
  PID:3188
- C:\Windows\System\MRIZbHk.exe
  C:\Windows\System\MRIZbHk.exe
  2⤵
  PID:2728
- C:\Windows\System\MWryymB.exe
  C:\Windows\System\MWryymB.exe
  2⤵
  PID:3316
- C:\Windows\System\MEogjsh.exe
  C:\Windows\System\MEogjsh.exe
  2⤵
  PID:3420
- C:\Windows\System\PfksnQg.exe
  C:\Windows\System\PfksnQg.exe
  2⤵
  PID:3480
- C:\Windows\System\zyWoZIC.exe
  C:\Windows\System\zyWoZIC.exe
  2⤵
  PID:3432
- C:\Windows\System\WGohgLq.exe
  C:\Windows\System\WGohgLq.exe
  2⤵
  PID:3468
- C:\Windows\System\spyVuIi.exe
  C:\Windows\System\spyVuIi.exe
  2⤵
  PID:3548
- C:\Windows\System\JlnJPKD.exe
  C:\Windows\System\JlnJPKD.exe
  2⤵
  PID:2328
- C:\Windows\System\uaIdDsF.exe
  C:\Windows\System\uaIdDsF.exe
  2⤵
  PID:3128
- C:\Windows\System\izVVmgg.exe
  C:\Windows\System\izVVmgg.exe
  2⤵
  PID:3732
- C:\Windows\System\bnHTsrA.exe
  C:\Windows\System\bnHTsrA.exe
  2⤵
  PID:2688
- C:\Windows\System\xjlSeiJ.exe
  C:\Windows\System\xjlSeiJ.exe
  2⤵
  PID:3852
- C:\Windows\System\hKXcTso.exe
  C:\Windows\System\hKXcTso.exe
  2⤵
  PID:3964
- C:\Windows\System\yimzefk.exe
  C:\Windows\System\yimzefk.exe
  2⤵
  PID:2768
- C:\Windows\System\AlOxFEb.exe
  C:\Windows\System\AlOxFEb.exe
  2⤵
  PID:2732
- C:\Windows\System\CMfLOtO.exe
  C:\Windows\System\CMfLOtO.exe
  2⤵
  PID:2664
- C:\Windows\System\ArHSAsz.exe
  C:\Windows\System\ArHSAsz.exe
  2⤵
  PID:3352
- C:\Windows\System\PNscmfJ.exe
  C:\Windows\System\PNscmfJ.exe
  2⤵
  PID:3416
- C:\Windows\System\pmaHZYh.exe
  C:\Windows\System\pmaHZYh.exe
  2⤵
  PID:2756
- C:\Windows\System\zlllsnH.exe
  C:\Windows\System\zlllsnH.exe
  2⤵
  PID:3516
- C:\Windows\System\ACzJhLp.exe
  C:\Windows\System\ACzJhLp.exe
  2⤵
  PID:1804
- C:\Windows\System\coauUYN.exe
  C:\Windows\System\coauUYN.exe
  2⤵
  PID:3532
- C:\Windows\System\MudGOJi.exe
  C:\Windows\System\MudGOJi.exe
  2⤵
  PID:1640
- C:\Windows\System\hfWxpXt.exe
  C:\Windows\System\hfWxpXt.exe
  2⤵
  PID:2716
- C:\Windows\System\bPwSxcI.exe
  C:\Windows\System\bPwSxcI.exe
  2⤵
  PID:3648
- C:\Windows\System\BBljtQr.exe
  C:\Windows\System\BBljtQr.exe
  2⤵
  PID:2408
- C:\Windows\System\XMeScqv.exe
  C:\Windows\System\XMeScqv.exe
  2⤵
  PID:3380
- C:\Windows\System\QmRdwJw.exe
  C:\Windows\System\QmRdwJw.exe
  2⤵
  PID:3564
- C:\Windows\System\FRbVihf.exe
  C:\Windows\System\FRbVihf.exe
  2⤵
  PID:3736
- C:\Windows\System\AabJkIG.exe
  C:\Windows\System\AabJkIG.exe
  2⤵
  PID:3752
- C:\Windows\System\vzzrFWO.exe
  C:\Windows\System\vzzrFWO.exe
  2⤵
  PID:4108
- C:\Windows\System\lkfbdMT.exe
  C:\Windows\System\lkfbdMT.exe
  2⤵
  PID:4124
- C:\Windows\System\CBRKRJU.exe
  C:\Windows\System\CBRKRJU.exe
  2⤵
  PID:4140
- C:\Windows\System\uCXzfnn.exe
  C:\Windows\System\uCXzfnn.exe
  2⤵
  PID:4156
- C:\Windows\System\hHQExaL.exe
  C:\Windows\System\hHQExaL.exe
  2⤵
  PID:4172
- C:\Windows\System\piGlqJj.exe
  C:\Windows\System\piGlqJj.exe
  2⤵
  PID:4188
- C:\Windows\System\hDNfXea.exe
  C:\Windows\System\hDNfXea.exe
  2⤵
  PID:4204
- C:\Windows\System\bbScPyB.exe
  C:\Windows\System\bbScPyB.exe
  2⤵
  PID:4220
- C:\Windows\System\BIyJpBQ.exe
  C:\Windows\System\BIyJpBQ.exe
  2⤵
  PID:4236
- C:\Windows\System\iiBwaah.exe
  C:\Windows\System\iiBwaah.exe
  2⤵
  PID:4252
- C:\Windows\System\ucFEWpy.exe
  C:\Windows\System\ucFEWpy.exe
  2⤵
  PID:4268
- C:\Windows\System\etuZCnt.exe
  C:\Windows\System\etuZCnt.exe
  2⤵
  PID:4284
- C:\Windows\System\UUPaMgq.exe
  C:\Windows\System\UUPaMgq.exe
  2⤵
  PID:4300
- C:\Windows\System\XPcfcAu.exe
  C:\Windows\System\XPcfcAu.exe
  2⤵
  PID:4316
- C:\Windows\System\ahITJLW.exe
  C:\Windows\System\ahITJLW.exe
  2⤵
  PID:4332
- C:\Windows\System\ShmSgXN.exe
  C:\Windows\System\ShmSgXN.exe
  2⤵
  PID:4348
- C:\Windows\System\chWysVY.exe
  C:\Windows\System\chWysVY.exe
  2⤵
  PID:4364
- C:\Windows\System\UobVrox.exe
  C:\Windows\System\UobVrox.exe
  2⤵
  PID:4380
- C:\Windows\System\drwDYRw.exe
  C:\Windows\System\drwDYRw.exe
  2⤵
  PID:4968
- C:\Windows\System\LPJeIFF.exe
  C:\Windows\System\LPJeIFF.exe
  2⤵
  PID:4984
- C:\Windows\System\TaJIvEX.exe
  C:\Windows\System\TaJIvEX.exe
  2⤵
  PID:5008
- C:\Windows\System\CtlXoeW.exe
  C:\Windows\System\CtlXoeW.exe
  2⤵
  PID:5036
- C:\Windows\System\BdrhYOY.exe
  C:\Windows\System\BdrhYOY.exe
  2⤵
  PID:5052
- C:\Windows\System\HtvytBJ.exe
  C:\Windows\System\HtvytBJ.exe
  2⤵
  PID:5072
- C:\Windows\System\dxrJUID.exe
  C:\Windows\System\dxrJUID.exe
  2⤵
  PID:5096
- C:\Windows\System\OxWoWMX.exe
  C:\Windows\System\OxWoWMX.exe
  2⤵
  PID:2864
- C:\Windows\System\ZydjRdh.exe
  C:\Windows\System\ZydjRdh.exe
  2⤵
  PID:4180
- C:\Windows\System\ySlNssp.exe
  C:\Windows\System\ySlNssp.exe
  2⤵
  PID:4132
- C:\Windows\System\zrqjkej.exe
  C:\Windows\System\zrqjkej.exe
  2⤵
  PID:2704
- C:\Windows\System\liADpRC.exe
  C:\Windows\System\liADpRC.exe
  2⤵
  PID:4100
- C:\Windows\System\GSbJngw.exe
  C:\Windows\System\GSbJngw.exe
  2⤵
  PID:4244
- C:\Windows\System\wricFNI.exe
  C:\Windows\System\wricFNI.exe
  2⤵
  PID:4292
- C:\Windows\System\LuSWMws.exe
  C:\Windows\System\LuSWMws.exe
  2⤵
  PID:4360
- C:\Windows\System\urZKkRF.exe
  C:\Windows\System\urZKkRF.exe
  2⤵
  PID:4372
- C:\Windows\System\FEUGmPd.exe
  C:\Windows\System\FEUGmPd.exe
  2⤵
  PID:4392
- C:\Windows\System\eDarbbH.exe
  C:\Windows\System\eDarbbH.exe
  2⤵
  PID:4408
- C:\Windows\System\dtGkZiC.exe
  C:\Windows\System\dtGkZiC.exe
  2⤵
  PID:4420
- C:\Windows\System\VSIMlaM.exe
  C:\Windows\System\VSIMlaM.exe
  2⤵
  PID:4440
- C:\Windows\System\eEEHPYy.exe
  C:\Windows\System\eEEHPYy.exe
  2⤵
  PID:4456
- C:\Windows\System\yqwVnCf.exe
  C:\Windows\System\yqwVnCf.exe
  2⤵
  PID:4476
- C:\Windows\System\jBsTEQH.exe
  C:\Windows\System\jBsTEQH.exe
  2⤵
  PID:4488
- C:\Windows\System\WRLGlOx.exe
  C:\Windows\System\WRLGlOx.exe
  2⤵
  PID:4504
- C:\Windows\System\dkcfjYb.exe
  C:\Windows\System\dkcfjYb.exe
  2⤵
  PID:4524
- C:\Windows\System\ZRiNChc.exe
  C:\Windows\System\ZRiNChc.exe
  2⤵
  PID:4548
- C:\Windows\System\IddCske.exe
  C:\Windows\System\IddCske.exe
  2⤵
  PID:4568
- C:\Windows\System\VqGptKs.exe
  C:\Windows\System\VqGptKs.exe
  2⤵
  PID:4596
- C:\Windows\System\ciVbHZW.exe
  C:\Windows\System\ciVbHZW.exe
  2⤵
  PID:3884
- C:\Windows\System\exjRQOe.exe
  C:\Windows\System\exjRQOe.exe
  2⤵
  PID:4584
- C:\Windows\System\NgmfYJw.exe
  C:\Windows\System\NgmfYJw.exe
  2⤵
  PID:4640
- C:\Windows\System\apTyrae.exe
  C:\Windows\System\apTyrae.exe
  2⤵
  PID:4656
- C:\Windows\System\ZRJfdDc.exe
  C:\Windows\System\ZRJfdDc.exe
  2⤵
  PID:4688
- C:\Windows\System\ecXtvzp.exe
  C:\Windows\System\ecXtvzp.exe
  2⤵
  PID:4704
- C:\Windows\System\OTTqdpU.exe
  C:\Windows\System\OTTqdpU.exe
  2⤵
  PID:4720
- C:\Windows\System\IzHRJox.exe
  C:\Windows\System\IzHRJox.exe
  2⤵
  PID:4736
- C:\Windows\System\ymlAPWM.exe
  C:\Windows\System\ymlAPWM.exe
  2⤵
  PID:4764
- C:\Windows\System\amsuIRt.exe
  C:\Windows\System\amsuIRt.exe
  2⤵
  PID:4772
- C:\Windows\System\hkScAEg.exe
  C:\Windows\System\hkScAEg.exe
  2⤵
  PID:4784
- C:\Windows\System\bhEJqKJ.exe
  C:\Windows\System\bhEJqKJ.exe
  2⤵
  PID:4800
- C:\Windows\System\wRteBxx.exe
  C:\Windows\System\wRteBxx.exe
  2⤵
  PID:4816
- C:\Windows\System\XnnQmpH.exe
  C:\Windows\System\XnnQmpH.exe
  2⤵
  PID:4832
- C:\Windows\System\JqvuATO.exe
  C:\Windows\System\JqvuATO.exe
  2⤵
  PID:4844
- C:\Windows\System\fcHzeIM.exe
  C:\Windows\System\fcHzeIM.exe
  2⤵
  PID:4864
- C:\Windows\System\FzFKiQm.exe
  C:\Windows\System\FzFKiQm.exe
  2⤵
  PID:4876
- C:\Windows\System\cAJQlnw.exe
  C:\Windows\System\cAJQlnw.exe
  2⤵
  PID:4892
- C:\Windows\System\SqMaNUa.exe
  C:\Windows\System\SqMaNUa.exe
  2⤵
  PID:4912
- C:\Windows\System\GGxbwOT.exe
  C:\Windows\System\GGxbwOT.exe
  2⤵
  PID:4340
- C:\Windows\System\ZjiEycX.exe
  C:\Windows\System\ZjiEycX.exe
  2⤵
  PID:2972
- C:\Windows\System\eiouWIo.exe
  C:\Windows\System\eiouWIo.exe
  2⤵
  PID:4260
- C:\Windows\System\hOJjGlV.exe
  C:\Windows\System\hOJjGlV.exe
  2⤵
  PID:4948
- C:\Windows\System\FRVwrPY.exe
  C:\Windows\System\FRVwrPY.exe
  2⤵
  PID:4960
- C:\Windows\System\bJFIEKx.exe
  C:\Windows\System\bJFIEKx.exe
  2⤵
  PID:5016
- C:\Windows\System\PBYlfHw.exe
  C:\Windows\System\PBYlfHw.exe
  2⤵
  PID:5004
- C:\Windows\System\mnBcmdj.exe
  C:\Windows\System\mnBcmdj.exe
  2⤵
  PID:5020
- C:\Windows\System\vbEctmA.exe
  C:\Windows\System\vbEctmA.exe
  2⤵
  PID:5064
- C:\Windows\System\fRcJVRE.exe
  C:\Windows\System\fRcJVRE.exe
  2⤵
  PID:5116
- C:\Windows\System\ctbtnOe.exe
  C:\Windows\System\ctbtnOe.exe
  2⤵
  PID:5044
- C:\Windows\System\dxpWibG.exe
  C:\Windows\System\dxpWibG.exe
  2⤵
  PID:3448
- C:\Windows\System\bhjnRcA.exe
  C:\Windows\System\bhjnRcA.exe
  2⤵
  PID:4164
- C:\Windows\System\caCuSCg.exe
  C:\Windows\System\caCuSCg.exe
  2⤵
  PID:4200
- C:\Windows\System\ZshHOoT.exe
  C:\Windows\System\ZshHOoT.exe
  2⤵
  PID:4432
- C:\Windows\System\dhGfnga.exe
  C:\Windows\System\dhGfnga.exe
  2⤵
  PID:4496
- C:\Windows\System\ulhWuRE.exe
  C:\Windows\System\ulhWuRE.exe
  2⤵
  PID:4196
- C:\Windows\System\rrmFbrL.exe
  C:\Windows\System\rrmFbrL.exe
  2⤵
  PID:4536
- C:\Windows\System\FFyVsRE.exe
  C:\Windows\System\FFyVsRE.exe
  2⤵
  PID:4212
- C:\Windows\System\jEJLfnK.exe
  C:\Windows\System\jEJLfnK.exe
  2⤵
  PID:4276
- C:\Windows\System\aHmqkkE.exe
  C:\Windows\System\aHmqkkE.exe
  2⤵
  PID:4448
- C:\Windows\System\YlzCVxF.exe
  C:\Windows\System\YlzCVxF.exe
  2⤵
  PID:4520
- C:\Windows\System\GhXPPtb.exe
  C:\Windows\System\GhXPPtb.exe
  2⤵
  PID:4592
- C:\Windows\System\gWyUBrd.exe
  C:\Windows\System\gWyUBrd.exe
  2⤵
  PID:4612
- C:\Windows\System\ftkAchb.exe
  C:\Windows\System\ftkAchb.exe
  2⤵
  PID:4648
- C:\Windows\System\xEkGsHW.exe
  C:\Windows\System\xEkGsHW.exe
  2⤵
  PID:4696
- C:\Windows\System\fNfpXzO.exe
  C:\Windows\System\fNfpXzO.exe
  2⤵
  PID:4680
- C:\Windows\System\ODQzanJ.exe
  C:\Windows\System\ODQzanJ.exe
  2⤵
  PID:4712
- C:\Windows\System\krbGjww.exe
  C:\Windows\System\krbGjww.exe
  2⤵
  PID:4856
- C:\Windows\System\NBxyTlY.exe
  C:\Windows\System\NBxyTlY.exe
  2⤵
  PID:4884
- C:\Windows\System\WdkFxOr.exe
  C:\Windows\System\WdkFxOr.exe
  2⤵
  PID:4684
- C:\Windows\System\uqPMNgh.exe
  C:\Windows\System\uqPMNgh.exe
  2⤵
  PID:4900
- C:\Windows\System\MZRBGbh.exe
  C:\Windows\System\MZRBGbh.exe
  2⤵
  PID:4744
- C:\Windows\System\gNuWFRB.exe
  C:\Windows\System\gNuWFRB.exe
  2⤵
  PID:4812
- C:\Windows\System\vuKogwP.exe
  C:\Windows\System\vuKogwP.exe
  2⤵
  PID:4264
- C:\Windows\System\kIiZNjM.exe
  C:\Windows\System\kIiZNjM.exe
  2⤵
  PID:3240
- C:\Windows\System\PFWFOZl.exe
  C:\Windows\System\PFWFOZl.exe
  2⤵
  PID:5092
- C:\Windows\System\JdLGqNs.exe
  C:\Windows\System\JdLGqNs.exe
  2⤵
  PID:4936
- C:\Windows\System\jaHsVrY.exe
  C:\Windows\System\jaHsVrY.exe
  2⤵
  PID:5080
- C:\Windows\System\mnhNDUJ.exe
  C:\Windows\System\mnhNDUJ.exe
  2⤵
  PID:4512
- C:\Windows\System\BYqWgEt.exe
  C:\Windows\System\BYqWgEt.exe
  2⤵
  PID:5024
- C:\Windows\System\plKKxqB.exe
  C:\Windows\System\plKKxqB.exe
  2⤵
  PID:4516
- C:\Windows\System\iPPAznj.exe
  C:\Windows\System\iPPAznj.exe
  2⤵
  PID:4580
- C:\Windows\System\TcIOzPX.exe
  C:\Windows\System\TcIOzPX.exe
  2⤵
  PID:4780
- C:\Windows\System\dHhWkdY.exe
  C:\Windows\System\dHhWkdY.exe
  2⤵
  PID:4620
- C:\Windows\System\WtfxBOu.exe
  C:\Windows\System\WtfxBOu.exe
  2⤵
  PID:4860
- C:\Windows\System\PpdhaxL.exe
  C:\Windows\System\PpdhaxL.exe
  2⤵
  PID:2808
- C:\Windows\System\dJqAIDC.exe
  C:\Windows\System\dJqAIDC.exe
  2⤵
  PID:4424
- C:\Windows\System\ieDUheg.exe
  C:\Windows\System\ieDUheg.exe
  2⤵
  PID:4652
- C:\Windows\System\PXMRpUA.exe
  C:\Windows\System\PXMRpUA.exe
  2⤵
  PID:4228
- C:\Windows\System\JiTiZkD.exe
  C:\Windows\System\JiTiZkD.exe
  2⤵
  PID:4356
- C:\Windows\System\NdSQMeK.exe
  C:\Windows\System\NdSQMeK.exe
  2⤵
  PID:5128
- C:\Windows\System\bqfiIsb.exe
  C:\Windows\System\bqfiIsb.exe
  2⤵
  PID:5144
- C:\Windows\System\rlMXOWB.exe
  C:\Windows\System\rlMXOWB.exe
  2⤵
  PID:5160
- C:\Windows\System\iMgcQBO.exe
  C:\Windows\System\iMgcQBO.exe
  2⤵
  PID:5176
- C:\Windows\System\lFbmvfZ.exe
  C:\Windows\System\lFbmvfZ.exe
  2⤵
  PID:5200
- C:\Windows\System\zFCogCa.exe
  C:\Windows\System\zFCogCa.exe
  2⤵
  PID:5216
- C:\Windows\System\aUjfQVq.exe
  C:\Windows\System\aUjfQVq.exe
  2⤵
  PID:5232
- C:\Windows\System\rwlFlzC.exe
  C:\Windows\System\rwlFlzC.exe
  2⤵
  PID:5256
- C:\Windows\System\hlVHcPO.exe
  C:\Windows\System\hlVHcPO.exe
  2⤵
  PID:5272
- C:\Windows\System\LDMvSNX.exe
  C:\Windows\System\LDMvSNX.exe
  2⤵
  PID:5320
- C:\Windows\System\ckKnuPj.exe
  C:\Windows\System\ckKnuPj.exe
  2⤵
  PID:5344
- C:\Windows\System\aXKclNX.exe
  C:\Windows\System\aXKclNX.exe
  2⤵
  PID:5368
- C:\Windows\System\hCJUKVU.exe
  C:\Windows\System\hCJUKVU.exe
  2⤵
  PID:5388
- C:\Windows\System\VrHvIUu.exe
  C:\Windows\System\VrHvIUu.exe
  2⤵
  PID:5416
- C:\Windows\System\IGdoamN.exe
  C:\Windows\System\IGdoamN.exe
  2⤵
  PID:5432
- C:\Windows\System\hAmNaur.exe
  C:\Windows\System\hAmNaur.exe
  2⤵
  PID:5448
- C:\Windows\System\asgKezK.exe
  C:\Windows\System\asgKezK.exe
  2⤵
  PID:5464
- C:\Windows\System\OpiMkQR.exe
  C:\Windows\System\OpiMkQR.exe
  2⤵
  PID:5480
- C:\Windows\System\vcBlhPe.exe
  C:\Windows\System\vcBlhPe.exe
  2⤵
  PID:5496
- C:\Windows\System\gEHcrUX.exe
  C:\Windows\System\gEHcrUX.exe
  2⤵
  PID:5512
- C:\Windows\System\qgwAfZA.exe
  C:\Windows\System\qgwAfZA.exe
  2⤵
  PID:5528
- C:\Windows\System\KQElclp.exe
  C:\Windows\System\KQElclp.exe
  2⤵
  PID:5552
- C:\Windows\System\uPWuvQe.exe
  C:\Windows\System\uPWuvQe.exe
  2⤵
  PID:5572
- C:\Windows\System\ujQMtLC.exe
  C:\Windows\System\ujQMtLC.exe
  2⤵
  PID:5588
- C:\Windows\System\gqNKfqm.exe
  C:\Windows\System\gqNKfqm.exe
  2⤵
  PID:5616
- C:\Windows\System\gYDFZqJ.exe
  C:\Windows\System\gYDFZqJ.exe
  2⤵
  PID:5632
- C:\Windows\System\qnFrIhB.exe
  C:\Windows\System\qnFrIhB.exe
  2⤵
  PID:5648
- C:\Windows\System\UvyCXwY.exe
  C:\Windows\System\UvyCXwY.exe
  2⤵
  PID:5664
- C:\Windows\System\YnGAEIN.exe
  C:\Windows\System\YnGAEIN.exe
  2⤵
  PID:5680
- C:\Windows\System\zIPuKeZ.exe
  C:\Windows\System\zIPuKeZ.exe
  2⤵
  PID:5700
- C:\Windows\System\GYvglHR.exe
  C:\Windows\System\GYvglHR.exe
  2⤵
  PID:5716
- C:\Windows\System\JuMsMuS.exe
  C:\Windows\System\JuMsMuS.exe
  2⤵
  PID:5732
- C:\Windows\System\YaGHOpl.exe
  C:\Windows\System\YaGHOpl.exe
  2⤵
  PID:5748
- C:\Windows\System\vaeifRu.exe
  C:\Windows\System\vaeifRu.exe
  2⤵
  PID:5764
- C:\Windows\System\mjDbLBp.exe
  C:\Windows\System\mjDbLBp.exe
  2⤵
  PID:5788
- C:\Windows\System\XyYNIMq.exe
  C:\Windows\System\XyYNIMq.exe
  2⤵
  PID:5804
- C:\Windows\System\yiaQXvN.exe
  C:\Windows\System\yiaQXvN.exe
  2⤵
  PID:5824
- C:\Windows\System\vjDLrTC.exe
  C:\Windows\System\vjDLrTC.exe
  2⤵
  PID:5840
- C:\Windows\System\BYyebwP.exe
  C:\Windows\System\BYyebwP.exe
  2⤵
  PID:5860
- C:\Windows\System\jfhCygF.exe
  C:\Windows\System\jfhCygF.exe
  2⤵
  PID:5876
- C:\Windows\System\mVXyKGr.exe
  C:\Windows\System\mVXyKGr.exe
  2⤵
  PID:5900
- C:\Windows\System\QIlPVgq.exe
  C:\Windows\System\QIlPVgq.exe
  2⤵
  PID:5920
- C:\Windows\System\PHWngyf.exe
  C:\Windows\System\PHWngyf.exe
  2⤵
  PID:5936
- C:\Windows\System\eIAgZJi.exe
  C:\Windows\System\eIAgZJi.exe
  2⤵
  PID:5952
- C:\Windows\System\cgxCHcM.exe
  C:\Windows\System\cgxCHcM.exe
  2⤵
  PID:5968
- C:\Windows\System\VhOfcBb.exe
  C:\Windows\System\VhOfcBb.exe
  2⤵
  PID:5988
- C:\Windows\System\ZeXWySe.exe
  C:\Windows\System\ZeXWySe.exe
  2⤵
  PID:6004
- C:\Windows\System\fwBxPyw.exe
  C:\Windows\System\fwBxPyw.exe
  2⤵
  PID:6020
- C:\Windows\System\jXkEMap.exe
  C:\Windows\System\jXkEMap.exe
  2⤵
  PID:6036
- C:\Windows\System\OKWAWYq.exe
  C:\Windows\System\OKWAWYq.exe
  2⤵
  PID:6052
- C:\Windows\System\swlNeCc.exe
  C:\Windows\System\swlNeCc.exe
  2⤵
  PID:6068
- C:\Windows\System\kfUXOLN.exe
  C:\Windows\System\kfUXOLN.exe
  2⤵
  PID:6084
- C:\Windows\System\PLymrdB.exe
  C:\Windows\System\PLymrdB.exe
  2⤵
  PID:6100
- C:\Windows\System\ICZXAWz.exe
  C:\Windows\System\ICZXAWz.exe
  2⤵
  PID:6116
- C:\Windows\System\ysDmTyb.exe
  C:\Windows\System\ysDmTyb.exe
  2⤵
  PID:6132
- C:\Windows\System\juAoWlw.exe
  C:\Windows\System\juAoWlw.exe
  2⤵
  PID:5136
- C:\Windows\System\OzpbqNJ.exe
  C:\Windows\System\OzpbqNJ.exe
  2⤵
  PID:5172
- C:\Windows\System\fMnMhyk.exe
  C:\Windows\System\fMnMhyk.exe
  2⤵
  PID:2888
- C:\Windows\System\UjaCDwP.exe
  C:\Windows\System\UjaCDwP.exe
  2⤵
  PID:4924
- C:\Windows\System\lNVyuON.exe
  C:\Windows\System\lNVyuON.exe
  2⤵
  PID:5032
- C:\Windows\System\VYGJZhi.exe
  C:\Windows\System\VYGJZhi.exe
  2⤵
  PID:4388
- C:\Windows\System\gkzCMsQ.exe
  C:\Windows\System\gkzCMsQ.exe
  2⤵
  PID:4308
- C:\Windows\System\TGaNBLJ.exe
  C:\Windows\System\TGaNBLJ.exe
  2⤵
  PID:4664
- C:\Windows\System\vCmOglI.exe
  C:\Windows\System\vCmOglI.exe
  2⤵
  PID:5152
- C:\Windows\System\sbuLjpp.exe
  C:\Windows\System\sbuLjpp.exe
  2⤵
  PID:1516
- C:\Windows\System\vpuiXit.exe
  C:\Windows\System\vpuiXit.exe
  2⤵
  PID:5104
- C:\Windows\System\jzOVOuz.exe
  C:\Windows\System\jzOVOuz.exe
  2⤵
  PID:4732
- C:\Windows\System\LAWPXHo.exe
  C:\Windows\System\LAWPXHo.exe
  2⤵
  PID:5192
- C:\Windows\System\xQFrAnM.exe
  C:\Windows\System\xQFrAnM.exe
  2⤵
  PID:5244
- C:\Windows\System\LZJnvCS.exe
  C:\Windows\System\LZJnvCS.exe
  2⤵
  PID:5288
- C:\Windows\System\yXcuSHe.exe
  C:\Windows\System\yXcuSHe.exe
  2⤵
  PID:5300
- C:\Windows\System\jvzltKy.exe
  C:\Windows\System\jvzltKy.exe
  2⤵
  PID:5316
- C:\Windows\System\JNGmKmm.exe
  C:\Windows\System\JNGmKmm.exe
  2⤵
  PID:5364
- C:\Windows\System\oWPJZZT.exe
  C:\Windows\System\oWPJZZT.exe
  2⤵
  PID:5408
- C:\Windows\System\uLYAEnn.exe
  C:\Windows\System\uLYAEnn.exe
  2⤵
  PID:5472
- C:\Windows\System\gmddheO.exe
  C:\Windows\System\gmddheO.exe
  2⤵
  PID:5340
- C:\Windows\System\fmGytgo.exe
  C:\Windows\System\fmGytgo.exe
  2⤵
  PID:5268
- C:\Windows\System\zShfmCj.exe
  C:\Windows\System\zShfmCj.exe
  2⤵
  PID:5508
- C:\Windows\System\BFvVhmQ.exe
  C:\Windows\System\BFvVhmQ.exe
  2⤵
  PID:5456
- C:\Windows\System\GFzXvBI.exe
  C:\Windows\System\GFzXvBI.exe
  2⤵
  PID:5428
- C:\Windows\System\AMKoRgw.exe
  C:\Windows\System\AMKoRgw.exe
  2⤵
  PID:5544
- C:\Windows\System\omtRzsu.exe
  C:\Windows\System\omtRzsu.exe
  2⤵
  PID:5596
- C:\Windows\System\nvKZQQu.exe
  C:\Windows\System\nvKZQQu.exe
  2⤵
  PID:5608
- C:\Windows\System\vYVhpLG.exe
  C:\Windows\System\vYVhpLG.exe
  2⤵
  PID:5660
- C:\Windows\System\tcAfSfI.exe
  C:\Windows\System\tcAfSfI.exe
  2⤵
  PID:5696
- C:\Windows\System\ETrABuI.exe
  C:\Windows\System\ETrABuI.exe
  2⤵
  PID:5568
- C:\Windows\System\tOJigaA.exe
  C:\Windows\System\tOJigaA.exe
  2⤵
  PID:5744
- C:\Windows\System\yoVjEvc.exe
  C:\Windows\System\yoVjEvc.exe
  2⤵
  PID:5644
- C:\Windows\System\QsrJfbO.exe
  C:\Windows\System\QsrJfbO.exe
  2⤵
  PID:5832
- C:\Windows\System\bLRggHT.exe
  C:\Windows\System\bLRggHT.exe
  2⤵
  PID:5908
- C:\Windows\System\feLxTmA.exe
  C:\Windows\System\feLxTmA.exe
  2⤵
  PID:5944
- C:\Windows\System\tMWGHWy.exe
  C:\Windows\System\tMWGHWy.exe
  2⤵
  PID:5980
- C:\Windows\System\XcbJeZK.exe
  C:\Windows\System\XcbJeZK.exe
  2⤵
  PID:5884
- C:\Windows\System\zSadMsU.exe
  C:\Windows\System\zSadMsU.exe
  2⤵
  PID:5892
- C:\Windows\System\eySlxqw.exe
  C:\Windows\System\eySlxqw.exe
  2⤵
  PID:5784
- C:\Windows\System\RWpyOIZ.exe
  C:\Windows\System\RWpyOIZ.exe
  2⤵
  PID:5852
- C:\Windows\System\uweJbJP.exe
  C:\Windows\System\uweJbJP.exe
  2⤵
  PID:5932
- C:\Windows\System\RSDclRI.exe
  C:\Windows\System\RSDclRI.exe
  2⤵
  PID:6000
- C:\Windows\System\EocbSGj.exe
  C:\Windows\System\EocbSGj.exe
  2⤵
  PID:6076
- C:\Windows\System\IMTVMSS.exe
  C:\Windows\System\IMTVMSS.exe
  2⤵
  PID:4588
- C:\Windows\System\jtNquIf.exe
  C:\Windows\System\jtNquIf.exe
  2⤵
  PID:4468
- C:\Windows\System\enFGrCz.exe
  C:\Windows\System\enFGrCz.exe
  2⤵
  PID:1868
- C:\Windows\System\vbSANHA.exe
  C:\Windows\System\vbSANHA.exe
  2⤵
  PID:4824
- C:\Windows\System\WAbWbJH.exe
  C:\Windows\System\WAbWbJH.exe
  2⤵
  PID:4932
- C:\Windows\System\zytKWwd.exe
  C:\Windows\System\zytKWwd.exe
  2⤵
  PID:4796
- C:\Windows\System\ahlSmcz.exe
  C:\Windows\System\ahlSmcz.exe
  2⤵
  PID:4976
- C:\Windows\System\pIsDfFP.exe
  C:\Windows\System\pIsDfFP.exe
  2⤵
  PID:5188
- C:\Windows\System\DsmoAvI.exe
  C:\Windows\System\DsmoAvI.exe
  2⤵
  PID:5312
- C:\Windows\System\OYSzpRR.exe
  C:\Windows\System\OYSzpRR.exe
  2⤵
  PID:5296
- C:\Windows\System\kLeIcYy.exe
  C:\Windows\System\kLeIcYy.exe
  2⤵
  PID:4636
- C:\Windows\System\yUNErOT.exe
  C:\Windows\System\yUNErOT.exe
  2⤵
  PID:5332
- C:\Windows\System\vgwtTpY.exe
  C:\Windows\System\vgwtTpY.exe
  2⤵
  PID:5384
- C:\Windows\System\sjBYngL.exe
  C:\Windows\System\sjBYngL.exe
  2⤵
  PID:5488
- C:\Windows\System\LmMwFJI.exe
  C:\Windows\System\LmMwFJI.exe
  2⤵
  PID:5548
- C:\Windows\System\JZPXzTz.exe
  C:\Windows\System\JZPXzTz.exe
  2⤵
  PID:5604
- C:\Windows\System\zRnFGRi.exe
  C:\Windows\System\zRnFGRi.exe
  2⤵
  PID:5756
- C:\Windows\System\IfAGULs.exe
  C:\Windows\System\IfAGULs.exe
  2⤵
  PID:5676
- C:\Windows\System\eutuKNb.exe
  C:\Windows\System\eutuKNb.exe
  2⤵
  PID:5976
- C:\Windows\System\sTthzVh.exe
  C:\Windows\System\sTthzVh.exe
  2⤵
  PID:5796
- C:\Windows\System\bJebeFr.exe
  C:\Windows\System\bJebeFr.exe
  2⤵
  PID:6048
- C:\Windows\System\zXgbIVX.exe
  C:\Windows\System\zXgbIVX.exe
  2⤵
  PID:5780
- C:\Windows\System\WdawCHs.exe
  C:\Windows\System\WdawCHs.exe
  2⤵
  PID:4716
- C:\Windows\System\wbBIDqf.exe
  C:\Windows\System\wbBIDqf.exe
  2⤵
  PID:6016
- C:\Windows\System\wJYBuZX.exe
  C:\Windows\System\wJYBuZX.exe
  2⤵
  PID:6064
- C:\Windows\System\fbjpTwN.exe
  C:\Windows\System\fbjpTwN.exe
  2⤵
  PID:5060
- C:\Windows\System\eqbHQuy.exe
  C:\Windows\System\eqbHQuy.exe
  2⤵
  PID:5124
- C:\Windows\System\TWijXua.exe
  C:\Windows\System\TWijXua.exe
  2⤵
  PID:5184
- C:\Windows\System\hhhSITO.exe
  C:\Windows\System\hhhSITO.exe
  2⤵
  PID:5224
- C:\Windows\System\hKhMUGg.exe
  C:\Windows\System\hKhMUGg.exe
  2⤵
  PID:5424
- C:\Windows\System\cFSXRaP.exe
  C:\Windows\System\cFSXRaP.exe
  2⤵
  PID:5772
- C:\Windows\System\ePBvcjI.exe
  C:\Windows\System\ePBvcjI.exe
  2⤵
  PID:5760
- C:\Windows\System\qMfMYch.exe
  C:\Windows\System\qMfMYch.exe
  2⤵
  PID:5492
- C:\Windows\System\jqfjNYx.exe
  C:\Windows\System\jqfjNYx.exe
  2⤵
  PID:5812
- C:\Windows\System\OXsGcbc.exe
  C:\Windows\System\OXsGcbc.exe
  2⤵
  PID:5964
- C:\Windows\System\GYvzgMr.exe
  C:\Windows\System\GYvzgMr.exe
  2⤵
  PID:5168
- C:\Windows\System\iltFGhs.exe
  C:\Windows\System\iltFGhs.exe
  2⤵
  PID:6152
- C:\Windows\System\LlFrvjS.exe
  C:\Windows\System\LlFrvjS.exe
  2⤵
  PID:6172
- C:\Windows\System\OSMwgYT.exe
  C:\Windows\System\OSMwgYT.exe
  2⤵
  PID:6188
- C:\Windows\System\YxKwzAQ.exe
  C:\Windows\System\YxKwzAQ.exe
  2⤵
  PID:6208
- C:\Windows\System\EmWNPRt.exe
  C:\Windows\System\EmWNPRt.exe
  2⤵
  PID:6224
- C:\Windows\System\tQwLgPa.exe
  C:\Windows\System\tQwLgPa.exe
  2⤵
  PID:6240
- C:\Windows\System\BkYesZu.exe
  C:\Windows\System\BkYesZu.exe
  2⤵
  PID:6256
- C:\Windows\System\vhaQPpW.exe
  C:\Windows\System\vhaQPpW.exe
  2⤵
  PID:6272
- C:\Windows\System\PlllWwP.exe
  C:\Windows\System\PlllWwP.exe
  2⤵
  PID:6296
- C:\Windows\System\rMtjXLi.exe
  C:\Windows\System\rMtjXLi.exe
  2⤵
  PID:6312
- C:\Windows\System\zvaJeDT.exe
  C:\Windows\System\zvaJeDT.exe
  2⤵
  PID:6328
- C:\Windows\System\SUyxkaD.exe
  C:\Windows\System\SUyxkaD.exe
  2⤵
  PID:6344
- C:\Windows\System\eEBDvNx.exe
  C:\Windows\System\eEBDvNx.exe
  2⤵
  PID:6360
- C:\Windows\System\bfDxqVt.exe
  C:\Windows\System\bfDxqVt.exe
  2⤵
  PID:6380
- C:\Windows\System\WAXwXbB.exe
  C:\Windows\System\WAXwXbB.exe
  2⤵
  PID:6396
- C:\Windows\System\iaCXZDK.exe
  C:\Windows\System\iaCXZDK.exe
  2⤵
  PID:6412
- C:\Windows\System\WUCOwhY.exe
  C:\Windows\System\WUCOwhY.exe
  2⤵
  PID:6432
- C:\Windows\System\hKkFvnq.exe
  C:\Windows\System\hKkFvnq.exe
  2⤵
  PID:6448
- C:\Windows\System\uLuxfqp.exe
  C:\Windows\System\uLuxfqp.exe
  2⤵
  PID:6464
- C:\Windows\System\DLyOvGt.exe
  C:\Windows\System\DLyOvGt.exe
  2⤵
  PID:6480
- C:\Windows\System\fBLUWLc.exe
  C:\Windows\System\fBLUWLc.exe
  2⤵
  PID:6496
- C:\Windows\System\NQLhsOK.exe
  C:\Windows\System\NQLhsOK.exe
  2⤵
  PID:6512
- C:\Windows\System\aXYpLuu.exe
  C:\Windows\System\aXYpLuu.exe
  2⤵
  PID:6528
- C:\Windows\System\fQHDpLX.exe
  C:\Windows\System\fQHDpLX.exe
  2⤵
  PID:6544
- C:\Windows\System\LorEsav.exe
  C:\Windows\System\LorEsav.exe
  2⤵
  PID:6560
- C:\Windows\System\STkQsoO.exe
  C:\Windows\System\STkQsoO.exe
  2⤵
  PID:6576
- C:\Windows\System\JurErbS.exe
  C:\Windows\System\JurErbS.exe
  2⤵
  PID:6592
- C:\Windows\System\cogCWPb.exe
  C:\Windows\System\cogCWPb.exe
  2⤵
  PID:6608
- C:\Windows\System\zadDjiN.exe
  C:\Windows\System\zadDjiN.exe
  2⤵
  PID:6624
- C:\Windows\System\HOJlehf.exe
  C:\Windows\System\HOJlehf.exe
  2⤵
  PID:6640
- C:\Windows\System\xzkAsRu.exe
  C:\Windows\System\xzkAsRu.exe
  2⤵
  PID:6656
- C:\Windows\System\CQYnCNR.exe
  C:\Windows\System\CQYnCNR.exe
  2⤵
  PID:6672
- C:\Windows\System\ZbBZQCj.exe
  C:\Windows\System\ZbBZQCj.exe
  2⤵
  PID:6688
- C:\Windows\System\tVZXpoX.exe
  C:\Windows\System\tVZXpoX.exe
  2⤵
  PID:6704
- C:\Windows\System\RzXWOmZ.exe
  C:\Windows\System\RzXWOmZ.exe
  2⤵
  PID:6724
- C:\Windows\System\iTSziku.exe
  C:\Windows\System\iTSziku.exe
  2⤵
  PID:6740
- C:\Windows\System\JMmDmXM.exe
  C:\Windows\System\JMmDmXM.exe
  2⤵
  PID:6756
- C:\Windows\System\vgPUpqI.exe
  C:\Windows\System\vgPUpqI.exe
  2⤵
  PID:6772
- C:\Windows\System\sZqxFjo.exe
  C:\Windows\System\sZqxFjo.exe
  2⤵
  PID:6788
- C:\Windows\System\oiyEDoD.exe
  C:\Windows\System\oiyEDoD.exe
  2⤵
  PID:6808
- C:\Windows\System\BnYBstD.exe
  C:\Windows\System\BnYBstD.exe
  2⤵
  PID:6824
- C:\Windows\System\mnjGwAl.exe
  C:\Windows\System\mnjGwAl.exe
  2⤵
  PID:6840
- C:\Windows\System\hEkGLpp.exe
  C:\Windows\System\hEkGLpp.exe
  2⤵
  PID:6856
- C:\Windows\System\ZeWAemj.exe
  C:\Windows\System\ZeWAemj.exe
  2⤵
  PID:6876
- C:\Windows\System\jcooJeT.exe
  C:\Windows\System\jcooJeT.exe
  2⤵
  PID:6892
- C:\Windows\System\MRGHjJZ.exe
  C:\Windows\System\MRGHjJZ.exe
  2⤵
  PID:6908
- C:\Windows\System\UppGEUW.exe
  C:\Windows\System\UppGEUW.exe
  2⤵
  PID:6924
- C:\Windows\System\jyVszzz.exe
  C:\Windows\System\jyVszzz.exe
  2⤵
  PID:6940
- C:\Windows\System\SGTxHcY.exe
  C:\Windows\System\SGTxHcY.exe
  2⤵
  PID:6956
- C:\Windows\System\UMGkIgu.exe
  C:\Windows\System\UMGkIgu.exe
  2⤵
  PID:6972
- C:\Windows\System\yIsJehU.exe
  C:\Windows\System\yIsJehU.exe
  2⤵
  PID:6988
- C:\Windows\System\suYMgGh.exe
  C:\Windows\System\suYMgGh.exe
  2⤵
  PID:7004
- C:\Windows\System\NXMiNvF.exe
  C:\Windows\System\NXMiNvF.exe
  2⤵
  PID:7020
- C:\Windows\System\dMzlmsu.exe
  C:\Windows\System\dMzlmsu.exe
  2⤵
  PID:7036
- C:\Windows\System\XegMJNH.exe
  C:\Windows\System\XegMJNH.exe
  2⤵
  PID:7052
- C:\Windows\System\NLsaFLe.exe
  C:\Windows\System\NLsaFLe.exe
  2⤵
  PID:7084
- C:\Windows\System\tzFuqOP.exe
  C:\Windows\System\tzFuqOP.exe
  2⤵
  PID:7100
- C:\Windows\System\zhyaseP.exe
  C:\Windows\System\zhyaseP.exe
  2⤵
  PID:7116
- C:\Windows\System\Jttpuqm.exe
  C:\Windows\System\Jttpuqm.exe
  2⤵
  PID:7132
- C:\Windows\System\gmLhXxT.exe
  C:\Windows\System\gmLhXxT.exe
  2⤵
  PID:7148
- C:\Windows\System\RkWXJgm.exe
  C:\Windows\System\RkWXJgm.exe
  2⤵
  PID:7164
- C:\Windows\System\piYHodM.exe
  C:\Windows\System\piYHodM.exe
  2⤵
  PID:5248
- C:\Windows\System\EXakqUA.exe
  C:\Windows\System\EXakqUA.exe
  2⤵
  PID:5584
- C:\Windows\System\UIwNJbF.exe
  C:\Windows\System\UIwNJbF.exe
  2⤵
  PID:6148
- C:\Windows\System\vancMdl.exe
  C:\Windows\System\vancMdl.exe
  2⤵
  PID:5728
- C:\Windows\System\SmWlkze.exe
  C:\Windows\System\SmWlkze.exe
  2⤵
  PID:6160
- C:\Windows\System\GableCH.exe
  C:\Windows\System\GableCH.exe
  2⤵
  PID:5360
- C:\Windows\System\MdAUHZM.exe
  C:\Windows\System\MdAUHZM.exe
  2⤵
  PID:6184
- C:\Windows\System\wqZKRTs.exe
  C:\Windows\System\wqZKRTs.exe
  2⤵
  PID:6204
- C:\Windows\System\JYNYBTK.exe
  C:\Windows\System\JYNYBTK.exe
  2⤵
  PID:6280
- C:\Windows\System\pZiRYtf.exe
  C:\Windows\System\pZiRYtf.exe
  2⤵
  PID:6288
- C:\Windows\System\uGMNZbh.exe
  C:\Windows\System\uGMNZbh.exe
  2⤵
  PID:6352
- C:\Windows\System\LnGbyQs.exe
  C:\Windows\System\LnGbyQs.exe
  2⤵
  PID:6392
- C:\Windows\System\jAjQcxY.exe
  C:\Windows\System\jAjQcxY.exe
  2⤵
  PID:6336
- C:\Windows\System\rdZFkMA.exe
  C:\Windows\System\rdZFkMA.exe
  2⤵
  PID:6368
- C:\Windows\System\QvDFppH.exe
  C:\Windows\System\QvDFppH.exe
  2⤵
  PID:6408
- C:\Windows\System\LhsDApI.exe
  C:\Windows\System\LhsDApI.exe
  2⤵
  PID:6472
- C:\Windows\System\JUDzTjx.exe
  C:\Windows\System\JUDzTjx.exe
  2⤵
  PID:6520
- C:\Windows\System\jRjnKtl.exe
  C:\Windows\System\jRjnKtl.exe
  2⤵
  PID:6540
- C:\Windows\System\EGKNkSc.exe
  C:\Windows\System\EGKNkSc.exe
  2⤵
  PID:6568
- C:\Windows\System\ZmwQqjq.exe
  C:\Windows\System\ZmwQqjq.exe
  2⤵
  PID:6620
- C:\Windows\System\rVmHhNm.exe
  C:\Windows\System\rVmHhNm.exe
  2⤵
  PID:6652
- C:\Windows\System\HoxnoAX.exe
  C:\Windows\System\HoxnoAX.exe
  2⤵
  PID:6684
- C:\Windows\System\arFXUII.exe
  C:\Windows\System\arFXUII.exe
  2⤵
  PID:6604
- C:\Windows\System\SGvbZOe.exe
  C:\Windows\System\SGvbZOe.exe
  2⤵
  PID:6668
- C:\Windows\System\iecxQUg.exe
  C:\Windows\System\iecxQUg.exe
  2⤵
  PID:6720
- C:\Windows\System\QqbjLlF.exe
  C:\Windows\System\QqbjLlF.exe
  2⤵
  PID:6820
- C:\Windows\System\RbmMlkR.exe
  C:\Windows\System\RbmMlkR.exe
  2⤵
  PID:6832
- C:\Windows\System\NZAJoxu.exe
  C:\Windows\System\NZAJoxu.exe
  2⤵
  PID:6768
- C:\Windows\System\OjwRQNd.exe
  C:\Windows\System\OjwRQNd.exe
  2⤵
  PID:6888
- C:\Windows\System\VDoZvgV.exe
  C:\Windows\System\VDoZvgV.exe
  2⤵
  PID:6952
- C:\Windows\System\EKhaPxJ.exe
  C:\Windows\System\EKhaPxJ.exe
  2⤵
  PID:7016
- C:\Windows\System\TpNaySc.exe
  C:\Windows\System\TpNaySc.exe
  2⤵
  PID:6900
- C:\Windows\System\aitnriZ.exe
  C:\Windows\System\aitnriZ.exe
  2⤵
  PID:6936
- C:\Windows\System\GFTWaVT.exe
  C:\Windows\System\GFTWaVT.exe
  2⤵
  PID:7028
- C:\Windows\System\GJAtTym.exe
  C:\Windows\System\GJAtTym.exe
  2⤵
  PID:7072
- C:\Windows\System\CdshzhM.exe
  C:\Windows\System\CdshzhM.exe
  2⤵
  PID:7080
- C:\Windows\System\ZkTKAnB.exe
  C:\Windows\System\ZkTKAnB.exe
  2⤵
  PID:7124
- C:\Windows\System\pCkPOXk.exe
  C:\Windows\System\pCkPOXk.exe
  2⤵
  PID:7112
- C:\Windows\System\GtIbnbC.exe
  C:\Windows\System\GtIbnbC.exe
  2⤵
  PID:4608
- C:\Windows\System\JgsmrbD.exe
  C:\Windows\System\JgsmrbD.exe
  2⤵
  PID:7144
- C:\Windows\System\PmpNzQJ.exe
  C:\Windows\System\PmpNzQJ.exe
  2⤵
  PID:5928
- C:\Windows\System\mBvarPw.exe
  C:\Windows\System\mBvarPw.exe
  2⤵
  PID:6164
- C:\Windows\System\MRQWydk.exe
  C:\Windows\System\MRQWydk.exe
  2⤵
  PID:6324
- C:\Windows\System\fNccOVn.exe
  C:\Windows\System\fNccOVn.exe
  2⤵
  PID:6388
- C:\Windows\System\UgMltPj.exe
  C:\Windows\System\UgMltPj.exe
  2⤵
  PID:6200
- C:\Windows\System\zCqeQXW.exe
  C:\Windows\System\zCqeQXW.exe
  2⤵
  PID:6376
- C:\Windows\System\VxhKFNG.exe
  C:\Windows\System\VxhKFNG.exe
  2⤵
  PID:6552
- C:\Windows\System\UDUNLux.exe
  C:\Windows\System\UDUNLux.exe
  2⤵
  PID:6700
- C:\Windows\System\vdwPekH.exe
  C:\Windows\System\vdwPekH.exe
  2⤵
  PID:6736
- C:\Windows\System\wPQVgIj.exe
  C:\Windows\System\wPQVgIj.exe
  2⤵
  PID:6884
- C:\Windows\System\wDICOvJ.exe
  C:\Windows\System\wDICOvJ.exe
  2⤵
  PID:6536
- C:\Windows\System\dakjRNL.exe
  C:\Windows\System\dakjRNL.exe
  2⤵
  PID:6752
- C:\Windows\System\jlKOQmo.exe
  C:\Windows\System\jlKOQmo.exe
  2⤵
  PID:6800
- C:\Windows\System\wPoNRvU.exe
  C:\Windows\System\wPoNRvU.exe
  2⤵
  PID:7048
- C:\Windows\System\KrnFSFR.exe
  C:\Windows\System\KrnFSFR.exe
  2⤵
  PID:7076
- C:\Windows\System\egzsLkc.exe
  C:\Windows\System\egzsLkc.exe
  2⤵
  PID:6968
- C:\Windows\System\VPsRHwx.exe
  C:\Windows\System\VPsRHwx.exe
  2⤵
  PID:5504
- C:\Windows\System\XolNHEd.exe
  C:\Windows\System\XolNHEd.exe
  2⤵
  PID:4880
- C:\Windows\System\EAQTten.exe
  C:\Windows\System\EAQTten.exe
  2⤵
  PID:5712
- C:\Windows\System\sXtOUZy.exe
  C:\Windows\System\sXtOUZy.exe
  2⤵
  PID:6196
- C:\Windows\System\ChWeMtm.exe
  C:\Windows\System\ChWeMtm.exe
  2⤵
  PID:6964
- C:\Windows\System\tzWdKMw.exe
  C:\Windows\System\tzWdKMw.exe
  2⤵
  PID:6600
- C:\Windows\System\dkeaCHZ.exe
  C:\Windows\System\dkeaCHZ.exe
  2⤵
  PID:6492
- C:\Windows\System\pGCXJzU.exe
  C:\Windows\System\pGCXJzU.exe
  2⤵
  PID:6616
- C:\Windows\System\yeunYkG.exe
  C:\Windows\System\yeunYkG.exe
  2⤵
  PID:6796
- C:\Windows\System\ZehKgSa.exe
  C:\Windows\System\ZehKgSa.exe
  2⤵
  PID:6984
- C:\Windows\System\eeYlZlu.exe
  C:\Windows\System\eeYlZlu.exe
  2⤵
  PID:7172
- C:\Windows\System\JBavQqQ.exe
  C:\Windows\System\JBavQqQ.exe
  2⤵
  PID:7192
- C:\Windows\System\ePRNoZL.exe
  C:\Windows\System\ePRNoZL.exe
  2⤵
  PID:7208
- C:\Windows\System\SXtkmSj.exe
  C:\Windows\System\SXtkmSj.exe
  2⤵
  PID:7224
- C:\Windows\System\LVePIPd.exe
  C:\Windows\System\LVePIPd.exe
  2⤵
  PID:7240
- C:\Windows\System\evXIdvT.exe
  C:\Windows\System\evXIdvT.exe
  2⤵
  PID:7256
- C:\Windows\System\gkXlLrR.exe
  C:\Windows\System\gkXlLrR.exe
  2⤵
  PID:7272
- C:\Windows\System\FktAMWm.exe
  C:\Windows\System\FktAMWm.exe
  2⤵
  PID:7288
- C:\Windows\System\iPfPhDY.exe
  C:\Windows\System\iPfPhDY.exe
  2⤵
  PID:7304
- C:\Windows\System\bYMcqYb.exe
  C:\Windows\System\bYMcqYb.exe
  2⤵
  PID:7320
- C:\Windows\System\JGiSoxK.exe
  C:\Windows\System\JGiSoxK.exe
  2⤵
  PID:7336
- C:\Windows\System\xfvgFbS.exe
  C:\Windows\System\xfvgFbS.exe
  2⤵
  PID:7352
- C:\Windows\System\xVkIvAB.exe
  C:\Windows\System\xVkIvAB.exe
  2⤵
  PID:7368
- C:\Windows\System\oaIZzEY.exe
  C:\Windows\System\oaIZzEY.exe
  2⤵
  PID:7384
- C:\Windows\System\JsXRhiD.exe
  C:\Windows\System\JsXRhiD.exe
  2⤵
  PID:7400
- C:\Windows\System\XPKqSvL.exe
  C:\Windows\System\XPKqSvL.exe
  2⤵
  PID:7416
- C:\Windows\System\fOUenIe.exe
  C:\Windows\System\fOUenIe.exe
  2⤵
  PID:7432
- C:\Windows\System\mbxKoCj.exe
  C:\Windows\System\mbxKoCj.exe
  2⤵
  PID:7448
- C:\Windows\System\zJvmqjC.exe
  C:\Windows\System\zJvmqjC.exe
  2⤵
  PID:7464
- C:\Windows\System\BlaLpVR.exe
  C:\Windows\System\BlaLpVR.exe
  2⤵
  PID:7480
- C:\Windows\System\YOkHzOl.exe
  C:\Windows\System\YOkHzOl.exe
  2⤵
  PID:7496
- C:\Windows\System\iVlAmIZ.exe
  C:\Windows\System\iVlAmIZ.exe
  2⤵
  PID:7512
- C:\Windows\System\uLkphTw.exe
  C:\Windows\System\uLkphTw.exe
  2⤵
  PID:7528
- C:\Windows\System\yYxWENf.exe
  C:\Windows\System\yYxWENf.exe
  2⤵
  PID:7544
- C:\Windows\System\UqvZDKx.exe
  C:\Windows\System\UqvZDKx.exe
  2⤵
  PID:7560
- C:\Windows\System\qdiDhZA.exe
  C:\Windows\System\qdiDhZA.exe
  2⤵
  PID:7576
- C:\Windows\System\AkvMrSU.exe
  C:\Windows\System\AkvMrSU.exe
  2⤵
  PID:7592
- C:\Windows\System\DpQwjHb.exe
  C:\Windows\System\DpQwjHb.exe
  2⤵
  PID:7608
- C:\Windows\System\XXqJNnN.exe
  C:\Windows\System\XXqJNnN.exe
  2⤵
  PID:7624
- C:\Windows\System\AxbbonM.exe
  C:\Windows\System\AxbbonM.exe
  2⤵
  PID:7640
- C:\Windows\System\gNtdpZu.exe
  C:\Windows\System\gNtdpZu.exe
  2⤵
  PID:7656
- C:\Windows\System\vFuUVpu.exe
  C:\Windows\System\vFuUVpu.exe
  2⤵
  PID:7672
- C:\Windows\System\YnOzuib.exe
  C:\Windows\System\YnOzuib.exe
  2⤵
  PID:7688
- C:\Windows\System\fGerHEA.exe
  C:\Windows\System\fGerHEA.exe
  2⤵
  PID:7704
- C:\Windows\System\lIcLFRP.exe
  C:\Windows\System\lIcLFRP.exe
  2⤵
  PID:7720
- C:\Windows\System\WJGbEeS.exe
  C:\Windows\System\WJGbEeS.exe
  2⤵
  PID:7736
- C:\Windows\System\ptWioAN.exe
  C:\Windows\System\ptWioAN.exe
  2⤵
  PID:7760
- C:\Windows\System\RGxETsm.exe
  C:\Windows\System\RGxETsm.exe
  2⤵
  PID:7776
- C:\Windows\System\uCDWZLd.exe
  C:\Windows\System\uCDWZLd.exe
  2⤵
  PID:7796
- C:\Windows\System\zvIXbsz.exe
  C:\Windows\System\zvIXbsz.exe
  2⤵
  PID:7824
- C:\Windows\System\MspNgEF.exe
  C:\Windows\System\MspNgEF.exe
  2⤵
  PID:7840
- C:\Windows\System\rhTzJhl.exe
  C:\Windows\System\rhTzJhl.exe
  2⤵
  PID:7856
- C:\Windows\System\QCbnJRp.exe
  C:\Windows\System\QCbnJRp.exe
  2⤵
  PID:7872
- C:\Windows\System\XpmTFIw.exe
  C:\Windows\System\XpmTFIw.exe
  2⤵
  PID:7908
- C:\Windows\System\DGMTyAj.exe
  C:\Windows\System\DGMTyAj.exe
  2⤵
  PID:7932
- C:\Windows\System\zrhPQUe.exe
  C:\Windows\System\zrhPQUe.exe
  2⤵
  PID:7952
- C:\Windows\System\JgeGTXI.exe
  C:\Windows\System\JgeGTXI.exe
  2⤵
  PID:7968
- C:\Windows\System\TrMvYVx.exe
  C:\Windows\System\TrMvYVx.exe
  2⤵
  PID:7996
- C:\Windows\System\hodhljL.exe
  C:\Windows\System\hodhljL.exe
  2⤵
  PID:8012
- C:\Windows\System\GwGJMqV.exe
  C:\Windows\System\GwGJMqV.exe
  2⤵
  PID:8028
- C:\Windows\System\DXDerXC.exe
  C:\Windows\System\DXDerXC.exe
  2⤵
  PID:8044
- C:\Windows\System\qqOxPjE.exe
  C:\Windows\System\qqOxPjE.exe
  2⤵
  PID:8060
- C:\Windows\System\EneZVmE.exe
  C:\Windows\System\EneZVmE.exe
  2⤵
  PID:8076
- C:\Windows\System\xLgMMvK.exe
  C:\Windows\System\xLgMMvK.exe
  2⤵
  PID:8092
- C:\Windows\System\hKVAEpW.exe
  C:\Windows\System\hKVAEpW.exe
  2⤵
  PID:8108
- C:\Windows\System\yiJOPom.exe
  C:\Windows\System\yiJOPom.exe
  2⤵
  PID:8124
- C:\Windows\System\feDyhYB.exe
  C:\Windows\System\feDyhYB.exe
  2⤵
  PID:8140
- C:\Windows\System\zSolQVH.exe
  C:\Windows\System\zSolQVH.exe
  2⤵
  PID:8156
- C:\Windows\System\bqrYLTZ.exe
  C:\Windows\System\bqrYLTZ.exe
  2⤵
  PID:8172
- C:\Windows\System\pNZLWYn.exe
  C:\Windows\System\pNZLWYn.exe
  2⤵
  PID:8188
- C:\Windows\System\KAlrfRk.exe
  C:\Windows\System\KAlrfRk.exe
  2⤵
  PID:6424
- C:\Windows\System\HzRcxnN.exe
  C:\Windows\System\HzRcxnN.exe
  2⤵
  PID:6488
- C:\Windows\System\qfcDBSp.exe
  C:\Windows\System\qfcDBSp.exe
  2⤵
  PID:7064
- C:\Windows\System\RIYYwRe.exe
  C:\Windows\System\RIYYwRe.exe
  2⤵
  PID:5404
- C:\Windows\System\qEZjPmX.exe
  C:\Windows\System\qEZjPmX.exe
  2⤵
  PID:6632
- C:\Windows\System\xLRWgLZ.exe
  C:\Windows\System\xLRWgLZ.exe
  2⤵
  PID:7188
- C:\Windows\System\zVzfLuP.exe
  C:\Windows\System\zVzfLuP.exe
  2⤵
  PID:7236
- C:\Windows\System\stgEuNQ.exe
  C:\Windows\System\stgEuNQ.exe
  2⤵
  PID:7300
- C:\Windows\System\GmcGPyJ.exe
  C:\Windows\System\GmcGPyJ.exe
  2⤵
  PID:7364
- C:\Windows\System\pBGVJWv.exe
  C:\Windows\System\pBGVJWv.exe
  2⤵
  PID:7216
- C:\Windows\System\nShhZYV.exe
  C:\Windows\System\nShhZYV.exe
  2⤵
  PID:7280
- C:\Windows\System\AyMWSzf.exe
  C:\Windows\System\AyMWSzf.exe
  2⤵
  PID:7348
- C:\Windows\System\rZJrRyw.exe
  C:\Windows\System\rZJrRyw.exe
  2⤵
  PID:7412
- C:\Windows\System\VTOtwth.exe
  C:\Windows\System\VTOtwth.exe
  2⤵
  PID:7504
- C:\Windows\System\PMYuMMk.exe
  C:\Windows\System\PMYuMMk.exe
  2⤵
  PID:7540
- C:\Windows\System\zyOMhyk.exe
  C:\Windows\System\zyOMhyk.exe
  2⤵
  PID:7456
- C:\Windows\System\VOVnCQc.exe
  C:\Windows\System\VOVnCQc.exe
  2⤵
  PID:7488
- C:\Windows\System\jYyQWSE.exe
  C:\Windows\System\jYyQWSE.exe
  2⤵
  PID:7552
- C:\Windows\System\tOLXwaP.exe
  C:\Windows\System\tOLXwaP.exe
  2⤵
  PID:7604
- C:\Windows\System\iBOMXmm.exe
  C:\Windows\System\iBOMXmm.exe
  2⤵
  PID:7616
- C:\Windows\System\LDoYswd.exe
  C:\Windows\System\LDoYswd.exe
  2⤵
  PID:7696
- C:\Windows\System\rvjIEhB.exe
  C:\Windows\System\rvjIEhB.exe
  2⤵
  PID:7728
- C:\Windows\System\LJufLun.exe
  C:\Windows\System\LJufLun.exe
  2⤵
  PID:7812
- C:\Windows\System\TLkAgBE.exe
  C:\Windows\System\TLkAgBE.exe
  2⤵
  PID:7716
- C:\Windows\System\GQLfPdx.exe
  C:\Windows\System\GQLfPdx.exe
  2⤵
  PID:7756
- C:\Windows\System\bfVnLFH.exe
  C:\Windows\System\bfVnLFH.exe
  2⤵
  PID:7832
- C:\Windows\System\hfpUjuO.exe
  C:\Windows\System\hfpUjuO.exe
  2⤵
  PID:7852
- C:\Windows\System\zBAsGtf.exe
  C:\Windows\System\zBAsGtf.exe
  2⤵
  PID:7868
- C:\Windows\System\paHhIAE.exe
  C:\Windows\System\paHhIAE.exe
  2⤵
  PID:7900
- C:\Windows\System\GPkffBE.exe
  C:\Windows\System\GPkffBE.exe
  2⤵
  PID:7940
- C:\Windows\System\vxjReUP.exe
  C:\Windows\System\vxjReUP.exe
  2⤵
  PID:7924
- C:\Windows\System\uryRuhe.exe
  C:\Windows\System\uryRuhe.exe
  2⤵
  PID:7964
- C:\Windows\System\NjzUJCY.exe
  C:\Windows\System\NjzUJCY.exe
  2⤵
  PID:7988
- C:\Windows\System\utHaMTA.exe
  C:\Windows\System\utHaMTA.exe
  2⤵
  PID:8052
- C:\Windows\System\GSdWxEo.exe
  C:\Windows\System\GSdWxEo.exe
  2⤵
  PID:8040
- C:\Windows\System\bQVFOaj.exe
  C:\Windows\System\bQVFOaj.exe
  2⤵
  PID:8104
- C:\Windows\System\eJrENot.exe
  C:\Windows\System\eJrENot.exe
  2⤵
  PID:6996
- C:\Windows\System\uJhWcbK.exe
  C:\Windows\System\uJhWcbK.exe
  2⤵
  PID:7332
- C:\Windows\System\PoyZVVO.exe
  C:\Windows\System\PoyZVVO.exe
  2⤵
  PID:7380
- C:\Windows\System\ApPktoY.exe
  C:\Windows\System\ApPktoY.exe
  2⤵
  PID:8116
- C:\Windows\System\nEERrZe.exe
  C:\Windows\System\nEERrZe.exe
  2⤵
  PID:7428
- C:\Windows\System\uwLPLph.exe
  C:\Windows\System\uwLPLph.exe
  2⤵
  PID:7000
- C:\Windows\System\YOtuwiS.exe
  C:\Windows\System\YOtuwiS.exe
  2⤵
  PID:6460
- C:\Windows\System\zRMHTqj.exe
  C:\Windows\System\zRMHTqj.exe
  2⤵
  PID:6948
- C:\Windows\System\GNASlqj.exe
  C:\Windows\System\GNASlqj.exe
  2⤵
  PID:7396
- C:\Windows\System\DwfGGHe.exe
  C:\Windows\System\DwfGGHe.exe
  2⤵
  PID:7444
- C:\Windows\System\SgjVIyb.exe
  C:\Windows\System\SgjVIyb.exe
  2⤵
  PID:7520
- C:\Windows\System\UkNCAoV.exe
  C:\Windows\System\UkNCAoV.exe
  2⤵
  PID:7584
- C:\Windows\System\haXrvMa.exe
  C:\Windows\System\haXrvMa.exe
  2⤵
  PID:7652
- C:\Windows\System\mHYPZhc.exe
  C:\Windows\System\mHYPZhc.exe
  2⤵
  PID:7808
- C:\Windows\System\CKwKBDb.exe
  C:\Windows\System\CKwKBDb.exe
  2⤵
  PID:7752
- C:\Windows\System\eikpSOC.exe
  C:\Windows\System\eikpSOC.exe
  2⤵
  PID:7864
- C:\Windows\System\sVwuuEe.exe
  C:\Windows\System\sVwuuEe.exe
  2⤵
  PID:6168
- C:\Windows\System\fFQGwzk.exe
  C:\Windows\System\fFQGwzk.exe
  2⤵
  PID:7928
- C:\Windows\System\YGfchOV.exe
  C:\Windows\System\YGfchOV.exe
  2⤵
  PID:7984
- C:\Windows\System\NmiwhuI.exe
  C:\Windows\System\NmiwhuI.exe
  2⤵
  PID:8036
- C:\Windows\System\FSlVNLQ.exe
  C:\Windows\System\FSlVNLQ.exe
  2⤵
  PID:7204
- C:\Windows\System\xubtEJE.exe
  C:\Windows\System\xubtEJE.exe
  2⤵
  PID:8164
- C:\Windows\System\IfKzDyB.exe
  C:\Windows\System\IfKzDyB.exe
  2⤵
  PID:6784
- C:\Windows\System\shGRsYR.exe
  C:\Windows\System\shGRsYR.exe
  2⤵
  PID:7312
- C:\Windows\System\xEzyAla.exe
  C:\Windows\System\xEzyAla.exe
  2⤵
  PID:8152
- C:\Windows\System\ZIQvotO.exe
  C:\Windows\System\ZIQvotO.exe
  2⤵
  PID:7636
- C:\Windows\System\oniTUfU.exe
  C:\Windows\System\oniTUfU.exe
  2⤵
  PID:7648
- C:\Windows\System\ubyGwot.exe
  C:\Windows\System\ubyGwot.exe
  2⤵
  PID:7748
- C:\Windows\System\NzsXdxB.exe
  C:\Windows\System\NzsXdxB.exe
  2⤵
  PID:8100
- C:\Windows\System\BqOEvLL.exe
  C:\Windows\System\BqOEvLL.exe
  2⤵
  PID:7536
- C:\Windows\System\FYKOzKL.exe
  C:\Windows\System\FYKOzKL.exe
  2⤵
  PID:7884
- C:\Windows\System\oNntVkh.exe
  C:\Windows\System\oNntVkh.exe
  2⤵
  PID:8020
- C:\Windows\System\fPkuhmB.exe
  C:\Windows\System\fPkuhmB.exe
  2⤵
  PID:7140
- C:\Windows\System\EgnUydU.exe
  C:\Windows\System\EgnUydU.exe
  2⤵
  PID:7296
- C:\Windows\System\RESGtWE.exe
  C:\Windows\System\RESGtWE.exe
  2⤵
  PID:7600
- C:\Windows\System\PrqeJWw.exe
  C:\Windows\System\PrqeJWw.exe
  2⤵
  PID:8084
- C:\Windows\System\wjOdyBb.exe
  C:\Windows\System\wjOdyBb.exe
  2⤵
  PID:7792
- C:\Windows\System\FjoOkEO.exe
  C:\Windows\System\FjoOkEO.exe
  2⤵
  PID:7772
- C:\Windows\System\kWSFhyc.exe
  C:\Windows\System\kWSFhyc.exe
  2⤵
  PID:8204
- C:\Windows\System\uzygFRW.exe
  C:\Windows\System\uzygFRW.exe
  2⤵
  PID:8220
- C:\Windows\System\pDRBzzT.exe
  C:\Windows\System\pDRBzzT.exe
  2⤵
  PID:8236
- C:\Windows\System\CqgOPXc.exe
  C:\Windows\System\CqgOPXc.exe
  2⤵
  PID:8256
- C:\Windows\System\nuogiiO.exe
  C:\Windows\System\nuogiiO.exe
  2⤵
  PID:8272
- C:\Windows\System\nOgykKR.exe
  C:\Windows\System\nOgykKR.exe
  2⤵
  PID:8292
- C:\Windows\System\kSyBmBS.exe
  C:\Windows\System\kSyBmBS.exe
  2⤵
  PID:8308
- C:\Windows\System\fTzBwmL.exe
  C:\Windows\System\fTzBwmL.exe
  2⤵
  PID:8324
- C:\Windows\System\UYXYJfN.exe
  C:\Windows\System\UYXYJfN.exe
  2⤵
  PID:8340
- C:\Windows\System\sBrmxtg.exe
  C:\Windows\System\sBrmxtg.exe
  2⤵
  PID:8356
- C:\Windows\System\ExqHRLb.exe
  C:\Windows\System\ExqHRLb.exe
  2⤵
  PID:8372
- C:\Windows\System\LRsJhVa.exe
  C:\Windows\System\LRsJhVa.exe
  2⤵
  PID:8388
- C:\Windows\System\paDSnFQ.exe
  C:\Windows\System\paDSnFQ.exe
  2⤵
  PID:8404
- C:\Windows\System\fpKIrTW.exe
  C:\Windows\System\fpKIrTW.exe
  2⤵
  PID:8420
- C:\Windows\System\qAfXXMa.exe
  C:\Windows\System\qAfXXMa.exe
  2⤵
  PID:8436
- C:\Windows\System\SLTrTEy.exe
  C:\Windows\System\SLTrTEy.exe
  2⤵
  PID:8452
- C:\Windows\System\wVyqvCm.exe
  C:\Windows\System\wVyqvCm.exe
  2⤵
  PID:8468
- C:\Windows\System\aYXqZaN.exe
  C:\Windows\System\aYXqZaN.exe
  2⤵
  PID:8484
- C:\Windows\System\OfcWFAD.exe
  C:\Windows\System\OfcWFAD.exe
  2⤵
  PID:8500
- C:\Windows\System\OIWUPSS.exe
  C:\Windows\System\OIWUPSS.exe
  2⤵
  PID:8516
- C:\Windows\System\nypHDqX.exe
  C:\Windows\System\nypHDqX.exe
  2⤵
  PID:8532
- C:\Windows\System\aymrkJl.exe
  C:\Windows\System\aymrkJl.exe
  2⤵
  PID:8548
- C:\Windows\System\GJwSlOo.exe
  C:\Windows\System\GJwSlOo.exe
  2⤵
  PID:8564
- C:\Windows\System\NCJqwib.exe
  C:\Windows\System\NCJqwib.exe
  2⤵
  PID:8580
- C:\Windows\System\CKdriDl.exe
  C:\Windows\System\CKdriDl.exe
  2⤵
  PID:8596
- C:\Windows\System\SWYOXYr.exe
  C:\Windows\System\SWYOXYr.exe
  2⤵
  PID:8612
- C:\Windows\System\hkZuiQC.exe
  C:\Windows\System\hkZuiQC.exe
  2⤵
  PID:8628
- C:\Windows\System\NTIIini.exe
  C:\Windows\System\NTIIini.exe
  2⤵
  PID:8644
- C:\Windows\System\mNrZFIl.exe
  C:\Windows\System\mNrZFIl.exe
  2⤵
  PID:8660
- C:\Windows\System\zOpCixn.exe
  C:\Windows\System\zOpCixn.exe
  2⤵
  PID:8676
- C:\Windows\System\YaGzLyR.exe
  C:\Windows\System\YaGzLyR.exe
  2⤵
  PID:8692
- C:\Windows\System\VuUDNIl.exe
  C:\Windows\System\VuUDNIl.exe
  2⤵
  PID:8708
- C:\Windows\System\FrKBVua.exe
  C:\Windows\System\FrKBVua.exe
  2⤵
  PID:8724
- C:\Windows\System\fINCwMR.exe
  C:\Windows\System\fINCwMR.exe
  2⤵
  PID:8740
- C:\Windows\System\hdNoZrw.exe
  C:\Windows\System\hdNoZrw.exe
  2⤵
  PID:8756
- C:\Windows\System\KVPUHRQ.exe
  C:\Windows\System\KVPUHRQ.exe
  2⤵
  PID:8772
- C:\Windows\System\cjSCuJK.exe
  C:\Windows\System\cjSCuJK.exe
  2⤵
  PID:8788
- C:\Windows\System\fgmTLOj.exe
  C:\Windows\System\fgmTLOj.exe
  2⤵
  PID:8804
- C:\Windows\System\yxWImZr.exe
  C:\Windows\System\yxWImZr.exe
  2⤵
  PID:8820
- C:\Windows\System\SsqpxlK.exe
  C:\Windows\System\SsqpxlK.exe
  2⤵
  PID:8836
- C:\Windows\System\GfedkUR.exe
  C:\Windows\System\GfedkUR.exe
  2⤵
  PID:8852
- C:\Windows\System\QLhvlIN.exe
  C:\Windows\System\QLhvlIN.exe
  2⤵
  PID:8868
- C:\Windows\System\YvVISkM.exe
  C:\Windows\System\YvVISkM.exe
  2⤵
  PID:8884
- C:\Windows\System\aMZgSCG.exe
  C:\Windows\System\aMZgSCG.exe
  2⤵
  PID:8900
- C:\Windows\System\KpZHvnT.exe
  C:\Windows\System\KpZHvnT.exe
  2⤵
  PID:8916
- C:\Windows\System\OnsINrp.exe
  C:\Windows\System\OnsINrp.exe
  2⤵
  PID:8932
- C:\Windows\System\lwkwuEf.exe
  C:\Windows\System\lwkwuEf.exe
  2⤵
  PID:8948
- C:\Windows\System\WeQADiL.exe
  C:\Windows\System\WeQADiL.exe
  2⤵
  PID:8964
- C:\Windows\System\KiWaboy.exe
  C:\Windows\System\KiWaboy.exe
  2⤵
  PID:8980
- C:\Windows\System\VAHxhxO.exe
  C:\Windows\System\VAHxhxO.exe
  2⤵
  PID:8996
- C:\Windows\System\LTqcaAL.exe
  C:\Windows\System\LTqcaAL.exe
  2⤵
  PID:9012
- C:\Windows\System\VoJtaKn.exe
  C:\Windows\System\VoJtaKn.exe
  2⤵
  PID:9028
- C:\Windows\System\HxcIFhY.exe
  C:\Windows\System\HxcIFhY.exe
  2⤵
  PID:9044
- C:\Windows\System\JSxDhSg.exe
  C:\Windows\System\JSxDhSg.exe
  2⤵
  PID:9060
- C:\Windows\System\wwfPBpF.exe
  C:\Windows\System\wwfPBpF.exe
  2⤵
  PID:9076
- C:\Windows\System\VBmZEVZ.exe
  C:\Windows\System\VBmZEVZ.exe
  2⤵
  PID:9092
- C:\Windows\System\vfJxyNL.exe
  C:\Windows\System\vfJxyNL.exe
  2⤵
  PID:9108
- C:\Windows\System\fkzqgEN.exe
  C:\Windows\System\fkzqgEN.exe
  2⤵
  PID:9124
- C:\Windows\System\layPXTa.exe
  C:\Windows\System\layPXTa.exe
  2⤵
  PID:9140
- C:\Windows\System\inmqYfl.exe
  C:\Windows\System\inmqYfl.exe
  2⤵
  PID:9156
- C:\Windows\System\pHMzWok.exe
  C:\Windows\System\pHMzWok.exe
  2⤵
  PID:9172
- C:\Windows\System\mmtNrWh.exe
  C:\Windows\System\mmtNrWh.exe
  2⤵
  PID:9188
- C:\Windows\System\sGwjzpf.exe
  C:\Windows\System\sGwjzpf.exe
  2⤵
  PID:9204
- C:\Windows\System\yivyWEa.exe
  C:\Windows\System\yivyWEa.exe
  2⤵
  PID:7820
- C:\Windows\System\hJNougB.exe
  C:\Windows\System\hJNougB.exe
  2⤵
  PID:7804
- C:\Windows\System\vuBOFPY.exe
  C:\Windows\System\vuBOFPY.exe
  2⤵
  PID:8200
- C:\Windows\System\BzPstPC.exe
  C:\Windows\System\BzPstPC.exe
  2⤵
  PID:8228
- C:\Windows\System\TKSWLVW.exe
  C:\Windows\System\TKSWLVW.exe
  2⤵
  PID:8280
- C:\Windows\System\IhOHEmB.exe
  C:\Windows\System\IhOHEmB.exe
  2⤵
  PID:8320
- C:\Windows\System\IyLtKyL.exe
  C:\Windows\System\IyLtKyL.exe
  2⤵
  PID:8332
- C:\Windows\System\zonTICy.exe
  C:\Windows\System\zonTICy.exe
  2⤵
  PID:8380
- C:\Windows\System\YuCjCpr.exe
  C:\Windows\System\YuCjCpr.exe
  2⤵
  PID:8396
- C:\Windows\System\aDnsuwq.exe
  C:\Windows\System\aDnsuwq.exe
  2⤵
  PID:8476
- C:\Windows\System\lMrYBFI.exe
  C:\Windows\System\lMrYBFI.exe
  2⤵
  PID:8400
- C:\Windows\System\fEaQpFe.exe
  C:\Windows\System\fEaQpFe.exe
  2⤵
  PID:8540
- C:\Windows\System\bmuOLCo.exe
  C:\Windows\System\bmuOLCo.exe
  2⤵
  PID:8592
- C:\Windows\System\njCSylw.exe
  C:\Windows\System\njCSylw.exe
  2⤵
  PID:8624
- C:\Windows\System\hQBcJXh.exe
  C:\Windows\System\hQBcJXh.exe
  2⤵
  PID:8700
- C:\Windows\System\WWGahQK.exe
  C:\Windows\System\WWGahQK.exe
  2⤵
  PID:8716
- C:\Windows\System\VvDpdyc.exe
  C:\Windows\System\VvDpdyc.exe
  2⤵
  PID:8720
- C:\Windows\System\RWvRDaU.exe
  C:\Windows\System\RWvRDaU.exe
  2⤵
  PID:8780
- C:\Windows\System\BWOHNLd.exe
  C:\Windows\System\BWOHNLd.exe
  2⤵
  PID:8796
- C:\Windows\System\VQgEkvm.exe
  C:\Windows\System\VQgEkvm.exe
  2⤵
  PID:8860
- C:\Windows\System\YTgorzb.exe
  C:\Windows\System\YTgorzb.exe
  2⤵
  PID:8896
- C:\Windows\System\AJOOTiy.exe
  C:\Windows\System\AJOOTiy.exe
  2⤵
  PID:8880
- C:\Windows\System\fZxDpRE.exe
  C:\Windows\System\fZxDpRE.exe
  2⤵
  PID:8972
- C:\Windows\System\alhAvSv.exe
  C:\Windows\System\alhAvSv.exe
  2⤵
  PID:8960
- C:\Windows\System\ePFYrAT.exe
  C:\Windows\System\ePFYrAT.exe
  2⤵
  PID:9036
- C:\Windows\System\qodoHYY.exe
  C:\Windows\System\qodoHYY.exe
  2⤵
  PID:8876
- C:\Windows\System\Murzyqo.exe
  C:\Windows\System\Murzyqo.exe
  2⤵
  PID:9024
- C:\Windows\System\WMqZPjw.exe
  C:\Windows\System\WMqZPjw.exe
  2⤵
  PID:9116
- C:\Windows\System\PwLiZcQ.exe
  C:\Windows\System\PwLiZcQ.exe
  2⤵
  PID:9180
- C:\Windows\System\qXJDLCj.exe
  C:\Windows\System\qXJDLCj.exe
  2⤵
  PID:7180
- C:\Windows\System\gjyLSch.exe
  C:\Windows\System\gjyLSch.exe
  2⤵
  PID:7700
- C:\Windows\System\UmJZkoW.exe
  C:\Windows\System\UmJZkoW.exe
  2⤵
  PID:9104
- C:\Windows\System\xmamDlt.exe
  C:\Windows\System\xmamDlt.exe
  2⤵
  PID:8252
- C:\Windows\System\RYxlynA.exe
  C:\Windows\System\RYxlynA.exe
  2⤵
  PID:8316
- C:\Windows\System\qPbyLea.exe
  C:\Windows\System\qPbyLea.exe
  2⤵
  PID:8444
- C:\Windows\System\ZXcwQbV.exe
  C:\Windows\System\ZXcwQbV.exe
  2⤵
  PID:8480
- C:\Windows\System\cdgKqLN.exe
  C:\Windows\System\cdgKqLN.exe
  2⤵
  PID:8460
- C:\Windows\System\jiYkQis.exe
  C:\Windows\System\jiYkQis.exe
  2⤵
  PID:8764
- C:\Windows\System\KwMlNLh.exe
  C:\Windows\System\KwMlNLh.exe
  2⤵
  PID:8688
- C:\Windows\System\KCxbKni.exe
  C:\Windows\System\KCxbKni.exe
  2⤵
  PID:8656
- C:\Windows\System\sBGwbvQ.exe
  C:\Windows\System\sBGwbvQ.exe
  2⤵
  PID:8748
- C:\Windows\System\SCsnkeQ.exe
  C:\Windows\System\SCsnkeQ.exe
  2⤵
  PID:8848
- C:\Windows\System\YfFxtCG.exe
  C:\Windows\System\YfFxtCG.exe
  2⤵
  PID:1576
- C:\Windows\System\RKAYmzD.exe
  C:\Windows\System\RKAYmzD.exe
  2⤵
  PID:9068
- C:\Windows\System\xrboMpm.exe
  C:\Windows\System\xrboMpm.exe
  2⤵
  PID:9020
- C:\Windows\System\ptRJPzG.exe
  C:\Windows\System\ptRJPzG.exe
  2⤵
  PID:9152
- C:\Windows\System\cVwigPW.exe
  C:\Windows\System\cVwigPW.exe
  2⤵
  PID:9200
- C:\Windows\System\kwIrgDD.exe
  C:\Windows\System\kwIrgDD.exe
  2⤵
  PID:9132
- C:\Windows\System\suwRqdW.exe
  C:\Windows\System\suwRqdW.exe
  2⤵
  PID:9196
- C:\Windows\System\HoIYTPV.exe
  C:\Windows\System\HoIYTPV.exe
  2⤵
  PID:7896
- C:\Windows\System\WlwAcTJ.exe
  C:\Windows\System\WlwAcTJ.exe
  2⤵
  PID:8832
- C:\Windows\System\ivWPnqt.exe
  C:\Windows\System\ivWPnqt.exe
  2⤵
  PID:8352
- C:\Windows\System\dHRLNkC.exe
  C:\Windows\System\dHRLNkC.exe
  2⤵
  PID:8844
- C:\Windows\System\ecUWJnP.exe
  C:\Windows\System\ecUWJnP.exe
  2⤵
  PID:8752
- C:\Windows\System\QGGqCOf.exe
  C:\Windows\System\QGGqCOf.exe
  2⤵
  PID:8288
- C:\Windows\System\iEmrVlv.exe
  C:\Windows\System\iEmrVlv.exe
  2⤵
  PID:8588
- C:\Windows\System\SlDQpKv.exe
  C:\Windows\System\SlDQpKv.exe
  2⤵
  PID:8248
- C:\Windows\System\gdzzGuZ.exe
  C:\Windows\System\gdzzGuZ.exe
  2⤵
  PID:9228
- C:\Windows\System\AWSarlY.exe
  C:\Windows\System\AWSarlY.exe
  2⤵
  PID:9244
- C:\Windows\System\kGaVDos.exe
  C:\Windows\System\kGaVDos.exe
  2⤵
  PID:9260
- C:\Windows\System\MFpogWw.exe
  C:\Windows\System\MFpogWw.exe
  2⤵
  PID:9276
- C:\Windows\System\tHbFqBJ.exe
  C:\Windows\System\tHbFqBJ.exe
  2⤵
  PID:9480
- C:\Windows\System\LaXqxoF.exe
  C:\Windows\System\LaXqxoF.exe
  2⤵
  PID:9808
- C:\Windows\System\owvFodV.exe
  C:\Windows\System\owvFodV.exe
  2⤵
  PID:9860
- C:\Windows\System\ZWhfHLW.exe
  C:\Windows\System\ZWhfHLW.exe
  2⤵
  PID:9512
- C:\Windows\System\RfXDpHj.exe
  C:\Windows\System\RfXDpHj.exe
  2⤵
  PID:9420
- C:\Windows\System\DMVvuSs.exe
  C:\Windows\System\DMVvuSs.exe
  2⤵
  PID:9400
- C:\Windows\System\miPxyWa.exe
  C:\Windows\System\miPxyWa.exe
  2⤵
  PID:9892
- C:\Windows\System\bCsmAYK.exe
  C:\Windows\System\bCsmAYK.exe
  2⤵
  PID:9936
- C:\Windows\System\ydOAJZj.exe
  C:\Windows\System\ydOAJZj.exe
  2⤵
  PID:9984
- C:\Windows\System\lblGIEV.exe
  C:\Windows\System\lblGIEV.exe
  2⤵
  PID:10028
- C:\Windows\System\wBUdagB.exe
  C:\Windows\System\wBUdagB.exe
  2⤵
  PID:9272
- C:\Windows\System\OiaDCmr.exe
  C:\Windows\System\OiaDCmr.exe
  2⤵
  PID:9312
- C:\Windows\System\XCIhhNY.exe
  C:\Windows\System\XCIhhNY.exe
  2⤵
  PID:9384
- C:\Windows\System\VtjFVGe.exe
  C:\Windows\System\VtjFVGe.exe
  2⤵
  PID:9440
- C:\Windows\System\Cjszclh.exe
  C:\Windows\System\Cjszclh.exe
  2⤵
  PID:9588
- C:\Windows\System\lKwSmDZ.exe
  C:\Windows\System\lKwSmDZ.exe
  2⤵
  PID:9600
- C:\Windows\System\fpPgMFl.exe
  C:\Windows\System\fpPgMFl.exe
  2⤵
  PID:9468
- C:\Windows\System\XQWbqKc.exe
  C:\Windows\System\XQWbqKc.exe
  2⤵
  PID:9448
- C:\Windows\System\IQWZchs.exe
  C:\Windows\System\IQWZchs.exe
  2⤵
  PID:9540
- C:\Windows\System\SoNYHrz.exe
  C:\Windows\System\SoNYHrz.exe
  2⤵
  PID:9580
- C:\Windows\System\SRkzMvx.exe
  C:\Windows\System\SRkzMvx.exe
  2⤵
  PID:9876
- C:\Windows\System\XOBMjZP.exe
  C:\Windows\System\XOBMjZP.exe
  2⤵
  PID:9636
- C:\Windows\System\hORhvUi.exe
  C:\Windows\System\hORhvUi.exe
  2⤵
  PID:9652
- C:\Windows\System\JJycUZR.exe
  C:\Windows\System\JJycUZR.exe
  2⤵
  PID:9668
- C:\Windows\System\ufNcbIi.exe
  C:\Windows\System\ufNcbIi.exe
  2⤵
  PID:9688
- C:\Windows\System\dJhsFqf.exe
  C:\Windows\System\dJhsFqf.exe
  2⤵
  PID:9708
- C:\Windows\System\eVmRGbs.exe
  C:\Windows\System\eVmRGbs.exe
  2⤵
  PID:9724
- C:\Windows\System\PdTvJAn.exe
  C:\Windows\System\PdTvJAn.exe
  2⤵
  PID:9748
- C:\Windows\System\xBGUGsJ.exe
  C:\Windows\System\xBGUGsJ.exe
  2⤵
  PID:9764
- C:\Windows\System\hhrnOJw.exe
  C:\Windows\System\hhrnOJw.exe
  2⤵
  PID:9796
- C:\Windows\System\MwJubZS.exe
  C:\Windows\System\MwJubZS.exe
  2⤵
  PID:9844
- C:\Windows\System\snyDilt.exe
  C:\Windows\System\snyDilt.exe
  2⤵
  PID:9840
- C:\Windows\System\jtGiNKe.exe
  C:\Windows\System\jtGiNKe.exe
  2⤵
  PID:10152
- C:\Windows\System\NxlFduo.exe
  C:\Windows\System\NxlFduo.exe
  2⤵
  PID:9948
- C:\Windows\System\IVnDfjl.exe
  C:\Windows\System\IVnDfjl.exe
  2⤵
  PID:10004
- C:\Windows\System\KarmEFl.exe
  C:\Windows\System\KarmEFl.exe
  2⤵
  PID:9972
- C:\Windows\System\tXbIpQM.exe
  C:\Windows\System\tXbIpQM.exe
  2⤵
  PID:9956
- C:\Windows\System\nYAZTaN.exe
  C:\Windows\System\nYAZTaN.exe
  2⤵
  PID:10052
- C:\Windows\System\eBJarkD.exe
  C:\Windows\System\eBJarkD.exe
  2⤵
  PID:10040
- C:\Windows\System\WQoYuDE.exe
  C:\Windows\System\WQoYuDE.exe
  2⤵
  PID:10084
- C:\Windows\System\QmbMcrn.exe
  C:\Windows\System\QmbMcrn.exe
  2⤵
  PID:10100
- C:\Windows\System\uKFlmGr.exe
  C:\Windows\System\uKFlmGr.exe
  2⤵
  PID:10116
- C:\Windows\System\BXIXoZv.exe
  C:\Windows\System\BXIXoZv.exe
  2⤵
  PID:9524
- C:\Windows\System\nIIBtoq.exe
  C:\Windows\System\nIIBtoq.exe
  2⤵
  PID:10140
- C:\Windows\System\EjXVxIZ.exe
  C:\Windows\System\EjXVxIZ.exe
  2⤵
  PID:10192
- C:\Windows\System\gaFeKBt.exe
  C:\Windows\System\gaFeKBt.exe
  2⤵
  PID:9360
- C:\Windows\System\vFtqMFC.exe
  C:\Windows\System\vFtqMFC.exe
  2⤵
  PID:10208
- C:\Windows\System\HzJgMEc.exe
  C:\Windows\System\HzJgMEc.exe
  2⤵
  PID:9268
- C:\Windows\System\RVwPXKF.exe
  C:\Windows\System\RVwPXKF.exe
  2⤵
  PID:8464
- C:\Windows\System\iTPNneq.exe
  C:\Windows\System\iTPNneq.exe
  2⤵
  PID:9004
- C:\Windows\System\SOHGAmq.exe
  C:\Windows\System\SOHGAmq.exe
  2⤵
  PID:8268
- C:\Windows\System\fTpHPrM.exe
  C:\Windows\System\fTpHPrM.exe
  2⤵
  PID:9300
- C:\Windows\System\PxRyuiT.exe
  C:\Windows\System\PxRyuiT.exe
  2⤵
  PID:9284
- C:\Windows\System\hddzAKm.exe
  C:\Windows\System\hddzAKm.exe
  2⤵
  PID:9908
- C:\Windows\System\qXxsjXO.exe
  C:\Windows\System\qXxsjXO.exe
  2⤵
  PID:9324
- C:\Windows\System\AERdFeL.exe
  C:\Windows\System\AERdFeL.exe
  2⤵
  PID:9352
- C:\Windows\System\TztKNHr.exe
  C:\Windows\System\TztKNHr.exe
  2⤵
  PID:9408
- C:\Windows\System\FKRqipm.exe
  C:\Windows\System\FKRqipm.exe
  2⤵
  PID:9424
- C:\Windows\System\vbmDaLu.exe
  C:\Windows\System\vbmDaLu.exe
  2⤵
  PID:9916
- C:\Windows\System\gxqotWd.exe
  C:\Windows\System\gxqotWd.exe
  2⤵
  PID:9848
- C:\Windows\System\UhlZszh.exe
  C:\Windows\System\UhlZszh.exe
  2⤵
  PID:9596
- C:\Windows\System\NGFKrug.exe
  C:\Windows\System\NGFKrug.exe
  2⤵
  PID:9536
- C:\Windows\System\lCzFOTG.exe
  C:\Windows\System\lCzFOTG.exe
  2⤵
  PID:9476
- C:\Windows\System\lpUJVuq.exe
  C:\Windows\System\lpUJVuq.exe
  2⤵
  PID:9556
- C:\Windows\System\LghZRUG.exe
  C:\Windows\System\LghZRUG.exe
  2⤵
  PID:9620
- C:\Windows\System\mKvtZuK.exe
  C:\Windows\System\mKvtZuK.exe
  2⤵
  PID:9660
- C:\Windows\System\nwCjjea.exe
  C:\Windows\System\nwCjjea.exe
  2⤵
  PID:9784
- C:\Windows\System\oSJqIZl.exe
  C:\Windows\System\oSJqIZl.exe
  2⤵
  PID:9944
- C:\Windows\System\kIpSAqg.exe
  C:\Windows\System\kIpSAqg.exe
  2⤵
  PID:9980
- C:\Windows\System\zsgDdtN.exe
  C:\Windows\System\zsgDdtN.exe
  2⤵
  PID:10056
- C:\Windows\System\vbOTaXx.exe
  C:\Windows\System\vbOTaXx.exe
  2⤵
  PID:9828
- C:\Windows\System\xsnFTfk.exe
  C:\Windows\System\xsnFTfk.exe
  2⤵
  PID:9880
- C:\Windows\System\tBFjlPy.exe
  C:\Windows\System\tBFjlPy.exe
  2⤵
  PID:9756
- C:\Windows\System\sUJREpn.exe
  C:\Windows\System\sUJREpn.exe
  2⤵
  PID:9960
- C:\Windows\System\FAyuaGd.exe
  C:\Windows\System\FAyuaGd.exe
  2⤵
  PID:10072
- C:\Windows\System\SqFJBmP.exe
  C:\Windows\System\SqFJBmP.exe
  2⤵
  PID:10112
- C:\Windows\System\XnApcQs.exe
  C:\Windows\System\XnApcQs.exe
  2⤵
  PID:10108
- C:\Windows\System\dVAKbMb.exe
  C:\Windows\System\dVAKbMb.exe
  2⤵
  PID:10096
- C:\Windows\System\jasYCwP.exe
  C:\Windows\System\jasYCwP.exe
  2⤵
  PID:10200
- C:\Windows\System\yUTuixs.exe
  C:\Windows\System\yUTuixs.exe
  2⤵
  PID:8892
- C:\Windows\System\konbJTS.exe
  C:\Windows\System\konbJTS.exe
  2⤵
  PID:10212
- C:\Windows\System\mAObXQq.exe
  C:\Windows\System\mAObXQq.exe
  2⤵
  PID:9220
- C:\Windows\System\WERrIyv.exe
  C:\Windows\System\WERrIyv.exe
  2⤵
  PID:10224
- C:\Windows\System\HVmKQGe.exe
  C:\Windows\System\HVmKQGe.exe
  2⤵
  PID:9504
- C:\Windows\System\KnhMzhL.exe
  C:\Windows\System\KnhMzhL.exe
  2⤵
  PID:9328
- C:\Windows\System\sZZpFcL.exe
  C:\Windows\System\sZZpFcL.exe
  2⤵
  PID:9340
- C:\Windows\System\SZlDdEi.exe
  C:\Windows\System\SZlDdEi.exe
  2⤵
  PID:9344
- C:\Windows\System\aeVbjIh.exe
  C:\Windows\System\aeVbjIh.exe
  2⤵
  PID:9376
- C:\Windows\System\ZjabaOe.exe
  C:\Windows\System\ZjabaOe.exe
  2⤵
  PID:9456
- C:\Windows\System\sunbwnS.exe
  C:\Windows\System\sunbwnS.exe
  2⤵
  PID:9548
- C:\Windows\System\gnYvmYb.exe
  C:\Windows\System\gnYvmYb.exe
  2⤵
  PID:9472
- C:\Windows\System\eYohrPT.exe
  C:\Windows\System\eYohrPT.exe
  2⤵
  PID:9704
- C:\Windows\System\fhqkCaM.exe
  C:\Windows\System\fhqkCaM.exe
  2⤵
  PID:9772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BlQCLVc.exe

Filesize
3.4MB

MD5
c732ed2cd825f2d120adc9968c882168

SHA1
c5b33e642879a458ae26bdf9443afd0f3e520436

SHA256
92b03acd980d4f6fd11a948ba78bfc7384adda0832e3ee341aed8119f44504c6

SHA512
d6d5610ed1b5ad7c37a75d6c571c69d5ca70f83b756a54d88bcec70165b21a2b50688fa466530f625a47a783e650fc944a114e5a55f914e125d1e4e7cb8acbbd

Download Submit
C:\Windows\system\CBPTITv.exe

Filesize
3.4MB

MD5
a57c99f52750d53e4b3e4075b4ed7596

SHA1
e662d3e820a06b0079bb727f5ea656e91bc9c0c2

SHA256
003767120229ce61172d801d16d977480fc2bb63805bf9b16d1acd838d7c8c14

SHA512
cd59cc627834f5a43a4807a6768a9f5cda4f8ea9e97ab470b5b3c38d31bc155f1e3ff0f21e96702e628fc53fafb52cd7cf1311002147243b31e74f877ef990ff

Download Submit
C:\Windows\system\DrRjGdZ.exe

Filesize
3.4MB

MD5
36843a401b1b4dccb7976719d8666e70

SHA1
b0bdfc5d10da2a5bb24ec4c7683e6d62f6f7377f

SHA256
e8349e12de83bd6a23d12397d12012dcbb3f578f6934a737a6d26ab4dafc13af

SHA512
22a6c238a6a06eab9383e2847834088fc3893148f77b5a768f1261ba53becf59311eb858131b6674ddb2bc27f47978e8ec0b20719885010e3015118ae9225137

Download Submit
C:\Windows\system\IYQtKbL.exe

Filesize
3.4MB

MD5
ed06d11218b5a3387a397f8eb44f7274

SHA1
e4d0fe60a09d0b77256c60c002a52060c77b241c

SHA256
7566d51775dc535c6bdb0031ad86c618cffab81b7a9c4b9496ec906ccf394502

SHA512
9945dca294b6777e66730c8bc4c862177a100fecf146d494ab5c7021a3143c4d181ae1981efa187877a4b6f31dc4d09c8623129c6c6eacf97251b168283d420d

Download Submit
C:\Windows\system\OGySUbc.exe

Filesize
3.4MB

MD5
36761bfd46dcbf1068792a6233585c47

SHA1
ce00ce7afeb2dca9014241257b59e56209f5f11d

SHA256
60898955beeafa4f900f826a5d2e3d896090d99e0174aee2e1dbde95d3f7e429

SHA512
ef795d01dffcc265258037570bcbb8ca81826651f465e0b03270cc19a65961bac6b10ae5b92012fcdbc26e50d25d4e560a41f66330817ce56e4697c8790f2625

Download Submit
C:\Windows\system\PcmZLrj.exe

Filesize
3.4MB

MD5
390618984c86faa82829e790050a2768

SHA1
2fc7e084877a1fc17cbe84ee06f20f1541eb0c33

SHA256
e3c7b66920a1e3b320d6fa5d636fa06692c96ac05b394a92f7fc50ec4be1080a

SHA512
95cca7a765757340d67f9c1e3fb9bd8aa77148798a86df761a5bad19f7b2e2c26ce99543e4bfda9ca344f023e5f6966972b59194258546846a85f7b5326a5117

Download Submit
C:\Windows\system\QMruVvI.exe

Filesize
3.4MB

MD5
1a1052147c6c410b2dfc09839907f3c0

SHA1
b0d1676ce298729aa49e154e2fa429707650aba8

SHA256
116f1cb899de3f50c1168b294af4aa15e30e9d8af55a63da79058009e8fcff50

SHA512
1aff42fc210b0fd88a340cfdf3df3b814da260415ee5ccac8f9b9409d3183c1ac251f777c26472f2893559b58d3dfd5d54cc5ebf32f3e8279434fb44449b44e9

Download Submit
C:\Windows\system\SxpOWDb.exe

Filesize
3.4MB

MD5
71aab64c517cccd10a1311bebbfea2e3

SHA1
53773b581a56b68615c5d039812c66bd199ed11e

SHA256
1768fb51b55437b47099de08a1a7ff90fbe4ee9e2da441c3a3342a4ebedffc5c

SHA512
ef589e74dd17d98cbb58179e908681cb6e964d20b8e99aca3c23388dc3bacfae557c4e740147e39b2ee1977e3f2ffe3f5897ec7e65d84ab2a382c89fc23ab84c

Download Submit
C:\Windows\system\bIBIljs.exe

Filesize
3.4MB

MD5
df573bbae2f430cf77a520622f93364f

SHA1
64ce00bb7612fc6efbd5166565310dae8070944b

SHA256
f8d7d3252648bc0e151c2fd37dbe2527252d914afdfca3c4aaa40bc9655ae53d

SHA512
bb139579ce89692dd1a655c1937d4872b814a37041254f86afd3da32a8356392444ceb8b71bd8c0f5638fe1254f0a77e7212c28ab35548cba8e378068f8ad777

Download Submit
C:\Windows\system\cWCPJcb.exe

Filesize
3.4MB

MD5
0e490a714f835d6e54678e2f828c85cb

SHA1
c13db78baceb81a673a58e1d88aa677b12b42363

SHA256
2360deff85fee29c5104ded06e975d8a365a5fe0b64d921add94c4df96a3cf08

SHA512
a8439523c6e397ecdab4f38753f37628d8a4eef335f68c0daa3b47b1f5e2b8623aed72cf43838743ffee830bb5a13c294065043e197fde59574741d5aabb39cf

Download Submit
C:\Windows\system\gBGmldS.exe

Filesize
3.4MB

MD5
9a294cb4a9f3aaa968fa5e569464a829

SHA1
9f0045d9f5fd9219c283a56698331e8ef4a46e57

SHA256
15134a021ab59a40a0b613d7c25e8c81a30d3a3bd428517126fb231a3af925c5

SHA512
754d73af54ad228fee879f40c8b8cb28f1c31ec101931695cdce3e7ce4d030b5647483e391dad6fb53c3b54973236ef194a159a6d022dcd381287ab77920303a

Download Submit
C:\Windows\system\gTJdJSd.exe

Filesize
3.4MB

MD5
e0909697b4e2e213ea117b68f49d3e41

SHA1
06f50bef8803f413b4d920a5fdbe297033f68098

SHA256
864cdfd50062d341fc84285ad2ef1aadcb54bc8501ba2725acab939cd3a8c3d4

SHA512
4fcb6ffa1a588d712f52096365fed08c90c187dae17a333484cc7f624b1d8e01c12e8f190b2cb3e3fb2d69d836a406a4e57e77fbfecb9dafc5e79dbb9305be47

Download Submit
C:\Windows\system\gvdLShA.exe

Filesize
3.4MB

MD5
1c52f602fa062b8b725a1b0e6ce7da0d

SHA1
11f3d98087414cbb1a088c3f629f180df78157a4

SHA256
f997efc4804c2d6e857ba704fe8f0d19bd7fe6d7d09fbb79f760f072cf5e9423

SHA512
c433772ae695c7aa6cca1e1e926953a8ce115ceb3c5a5576d5b41e13ecfaa62c850456581a207ae79cb91bb795a25ddf343ead0a94509a458b8b956bbd9194f7

Download Submit
C:\Windows\system\icaXhfB.exe

Filesize
3.4MB

MD5
92c0224ed1a43875ae2016936481bf37

SHA1
fc910b0ab02982ecb349977b0358cf8dddf3ae44

SHA256
cb8c9dcc1ba11a26c7c1ab02df7cfbd0b49bea8cf1246d061000850e6d563f12

SHA512
95fb179e545dee7db21439f4291b7b10157c8d6a5edfa3a22e44300f28865bc1998d0d3797cc9d6a8149e6d7ff2adfa96bdc40acb8aeef1648a3dcd82e223538

Download Submit
C:\Windows\system\jTApjEw.exe

Filesize
3.4MB

MD5
ef580f837f8935fd5b346f729a137534

SHA1
08fe3da3fd26e3b9edaa2e26bb84058ef2a441e0

SHA256
2c9891b3f8c446a4d8edecf3bf9bdf00c89dc6dc9ff36501cb5d98df367ae1c2

SHA512
519060bea3e002cbf8fffd924702d57d7fdf65dfe0372610f9358123dcac3494f7ca0b4920dbecbcfeede663d34368148c98d29b417bc806d525e1a6ba5e8523

Download Submit
C:\Windows\system\jfXxfpK.exe

Filesize
3.4MB

MD5
35b9b13813699dd839a945ad0b95af67

SHA1
6c74c5ee48d17f0770f4b06bab68c5e0e1e69a13

SHA256
52a621ef8a4511f476c2c3e26b01633ce339ae6e80fbef7e24bb1e4f5c7db41c

SHA512
25d5c93b45aa32c1c94b3d9a7120b78a44138a5075969727837841c15d04e0755b7d4c0556bc4de196b37950c92bdb6f6b2679e5c299bfb71e202d90238bd40e

Download Submit
C:\Windows\system\mkWezpk.exe

Filesize
3.4MB

MD5
15691ca8d35556d5ee44b9ff85aaf583

SHA1
9a8291d69b3944c73872cfcb4a7383d7507ddbf8

SHA256
7bced46f55011926e3c222d98cb85653b8c06220b0681021d80c9e1288c5a0a7

SHA512
8b226e19a7bf6d8b97b387f4c1d8683b8daaf5b693cf740c4235bec340d8f253480ee2b973303a6c23884f615afabe02607bd0392ac32005985223cb9e649207

Download Submit
C:\Windows\system\pZGwTuk.exe

Filesize
3.4MB

MD5
903265d7f340b9f8af9c6081585069be

SHA1
44c8acf54fd7aa53449a122eeb450cd62eab806a

SHA256
dd5b35bf2d7c5dfedb9fc6e511087b36fe4c5cb307bfc4f45ad1edc880b66a2e

SHA512
3126369722ae6789d31f0a18c219e21932f192401c1432d34b935d944b65e5695c22451a998735b37abfa59ab980d9612b0d716e3281fc5e17fa63d51f29c844

Download Submit
C:\Windows\system\puMRTeo.exe

Filesize
3.4MB

MD5
f323ed3d91c9cad896e72415c3c87297

SHA1
38649c0ecc708e6aad296e80fb1b893071dab861

SHA256
587f26236a13fdd3c656831d20c7d813cb32bf17c37a50e4aa06a7aefd67b558

SHA512
850a6d72b75eeeaa51aab07074289aec04e237104f3066c67dc6aa3728ee65f5c6a04d4d59f22feaa958fd1a75b7e8d65b2144bce6b01d2e48f38a08e4f812e7

Download Submit
C:\Windows\system\tHbRpeX.exe

Filesize
3.4MB

MD5
1987fbc832b582942e671e08c8c91135

SHA1
1c099c95aab01bdf4d35252f32b529660b560ce6

SHA256
2954ec4ebe59e62c09bea043ee7b4ca89ff2fe7eb1b60259a9409f301dea3421

SHA512
e915feb4ab081c12450e43f1873eb2a4ac0727c419157803832439fe129898367de16261d00e938e8997e6de01b3e0b5edd087fc2ea8f20e5d9fd3c9615b2381

Download Submit
C:\Windows\system\uNzmTCW.exe

Filesize
3.4MB

MD5
39110c6443188554a30c917ebe4ccbc0

SHA1
931b87bd4da5b1c8a95b6df699319be4bc21a9a8

SHA256
41e4885417a4712153dd91de22fe58c8b1e888df8b4f8b553ffc564cf565b1b0

SHA512
3b89604bb0ac7396c93821a1c1c0d5af403be8f1abefc0d6eb5f005785717119b147a02688620569e452d5b406450641e0adb7461d65661647c0eddc334067fb

Download Submit
C:\Windows\system\zRNyBKN.exe

Filesize
3.4MB

MD5
8798388cff76a2621dc002a34bf0de55

SHA1
953339cc2d01577de540fdc73cdb78e5f0757a51

SHA256
bcdf66402cf071cbf56b54dfd92243699af5cd211ff4ea258c36a443b329ffe8

SHA512
5cf7279b837bed5f14aaaadcce97e275d3007eb629410cb534b08552c589704838bc8f71d39c11975f037e343295ffe1fb8aca75637834c6656ee7f510df201a

Download Submit
\Windows\system\PPZPOyQ.exe

Filesize
3.4MB

MD5
22bc567a8bdf99563090a7c1e67f125f

SHA1
67ebd43ec6def4ab138a8f54fa6e6962ccab7a96

SHA256
54a6b2148b8beeb6781e300147b866eb00f825e8f277ada8bcf9cddc1cd910d3

SHA512
3c6ef94e7d24f530e643b505604fce968b654f3f790a29f27dca3fdf4d26791ef71d62786557872081354d66c7f13f97b7c0007cef8e1584f92aa664493953c1

Download Submit
\Windows\system\aEbDnzf.exe

Filesize
3.4MB

MD5
941f8369a3bdb26819bdd8183248e857

SHA1
4933e1db3ecd20198723fe24da64b6f3a9da9971

SHA256
3c0dc87206b5923098d50f648d44d25d8b50f24d315bf9fd7eb63657334653d5

SHA512
3446df933ab6ab70e4c1b61310d03d1bc50aaec0e9401ad8187df0843878d3c9e6a1fbf34f59bd299d64b88e534b27991c9d78e0bc0240647056a5286e3ecd25

Download Submit
\Windows\system\aujembr.exe

Filesize
3.4MB

MD5
5c53582a42afe4867badb82e604eb5c4

SHA1
b695091c4540dc6f300d228a95c54e790ba05d39

SHA256
83430eb179d3ba89c1332e3d02355205cb0a50fdd2d0e1e8c1ab25a6b1fbfedb

SHA512
59fc5a0efe611ad45bccb0f81c0415caade653748752f06dd172e40a1117db9a02cc485e15ec5037e4c7375159206a32b188cdc56b1614a1597d98dc43a520ba

Download Submit
\Windows\system\ctwnVGE.exe

Filesize
3.4MB

MD5
d90989f0d2ca0ed7aae93e4892e4be13

SHA1
63a91d345b08253a138670169167c13c6439e56e

SHA256
628cfcc58cd7e4b930aaf22c2cf52d1c6684560af9a86722f1355ac09c3b0588

SHA512
51b3b60a42f66dfbab9e8949627640c22077b60599f1042eaf5b510304ac2959ba18eec64f12c45d839f65e39b0583bb871566dac122dce12535917cf0ab5e1b

Download Submit
\Windows\system\epHYhHz.exe

Filesize
3.4MB

MD5
ee407082163e44e09cacd4608dc96f02

SHA1
66806f794aa31176c2a534ae71981310420bf20b

SHA256
992e2695a3065f2dc0d3de0eb43df6041aafec8c34f9ec6025900467d11f31fe

SHA512
dcf25e5e9bb7e5ba15bb41f9cd8166245ea20033f228922237f914fc5e2af4a603b9d67c6e455dfd38d40aba748c6c37e9ed3af4aa155fb29d00a83bf2e46408

Download Submit
\Windows\system\fuDgtQw.exe

Filesize
3.4MB

MD5
956737f780d428f0b7d6a3d3fc796bd0

SHA1
b55a5d1a8e8b547618a37379c8bff9ef70a0fed4

SHA256
7b2192e26e16dc7cf86bbc4764230dfbdf4280f605fa765baa2fd5f2ee46f3db

SHA512
491bdf010a8993bbb5538e9e45b1881fad5f706170672f92cfe9e788cd095cc09504c7458e47b0d6448ddf2729a0be032e464dfcf011912ede709f764dd3044a

Download Submit
\Windows\system\jQVQwnI.exe

Filesize
3.4MB

MD5
ee45e1086928a5fd81d66ed5debdaff4

SHA1
d4f2f233840c14e3a3a03bc2187711886f06579c

SHA256
9d90f9e372decf2ba4b9d5629ceb4f45a1008d1f399cf5c3e242fe79a36ad4fc

SHA512
f240f714b1b93e966d5967715fc1750dfc7d976e76ab819d2109452d8ffb52678ae1873641e6347ce9ff6525f1b51f5b6e4d5ffe2a5a8708d8cec91451c7d3cf

Download Submit
\Windows\system\lMLRSQE.exe

Filesize
3.4MB

MD5
90421f8b9a7066a6b097816568d43c3f

SHA1
e99a0ca0a7b1933b7d2f46ac6c82769417e3cc41

SHA256
e8a893f47133ca00daf855d5ca7c5039df902bdbfa5f7f2ee140737dcc4292bf

SHA512
ba105a789fc635fe760057336b3c5b7863b8e0bc4d73737ebf92cb5fc4f97f00402c345394b45a57ea28f4dad43d8cbc2a78b873d2e7101ca5860e67f34b8f28

Download Submit
\Windows\system\mZWPnBr.exe

Filesize
3.4MB

MD5
1e61fa3e074e96cd13b4fa0c8b572e6a

SHA1
561d7fc887481f0309800f27672faf1441806ade

SHA256
a978ebabbc2f5030a9038e45c757a6b13af7bac5b543b7d33abd5edd25c93c0e

SHA512
2719bbbe269edfcddfb5f5a09deb66d3478f565fe8222b90d99c965766be968a2377e181871a0c57b7cacca2496368f6c3d8486ca629a2274eb6b3dc8a60dc62

Download Submit
\Windows\system\qQlMNBw.exe

Filesize
3.4MB

MD5
0d6c1fc59df1cf07d6d3bf7b20cf464e

SHA1
cccf225a6ce75c20f62b5b8030e93bb366018099

SHA256
2c335aa0eef4eeec05652c979b4b25e4ce10df3ede3f54c8689640de161de2ed

SHA512
0a0e5f7f192865d8f78c7e895c517682b5258c3a9fd5b1459879cbf85c6a1cde5fc880bd1a55282fb50b8018df2d3056c687e7378003e4da9ab08562ec38e0af

Download Submit
\Windows\system\wPxfeCP.exe

Filesize
3.4MB

MD5
481c4e81cac54f41addaec112aaec3b8

SHA1
1d82d50e1b2c89b0e7a7ab84f02fd9d111afc5e3

SHA256
fb14ca33ea1a73a75bf44606dc3383e63c4ff865dba87a4fcb7d024cb82c9e80

SHA512
a05eaf304e5a587edbc8f72b1d4971f2323ef2dc2f12b091db9e6d6f378e5313c61564ed2b4235308ac6188d019176b8f06f96f753f6a8c78fa87e12e21ab56a

Download Submit
memory/840-107-0x000000013F430000-0x000000013F826000-memory.dmp

Filesize
4.0MB

Download
memory/840-4551-0x000000013F430000-0x000000013F826000-memory.dmp

Filesize
4.0MB

Download
memory/1084-13-0x000000013FE10000-0x0000000140206000-memory.dmp

Filesize
4.0MB

Download
memory/1300-96-0x000000013FD10000-0x0000000140106000-memory.dmp

Filesize
4.0MB

Download
memory/1300-60-0x000000013F1F0000-0x000000013F5E6000-memory.dmp

Filesize
4.0MB

Download
memory/1300-5152-0x0000000003790000-0x0000000003B86000-memory.dmp

Filesize
4.0MB

Download
memory/1300-4774-0x0000000003790000-0x0000000003B86000-memory.dmp

Filesize
4.0MB

Download
memory/1300-109-0x0000000003790000-0x0000000003B86000-memory.dmp

Filesize
4.0MB

Download
memory/1300-25-0x000000013F0A0000-0x000000013F496000-memory.dmp

Filesize
4.0MB

Download
memory/1300-4579-0x0000000003790000-0x0000000003B86000-memory.dmp

Filesize
4.0MB

Download
memory/1300-108-0x000000013F7B0000-0x000000013FBA6000-memory.dmp

Filesize
4.0MB

Download
memory/1300-4423-0x0000000003790000-0x0000000003B86000-memory.dmp

Filesize
4.0MB

Download
memory/1300-33-0x000000013FDD0000-0x00000001401C6000-memory.dmp

Filesize
4.0MB

Download
memory/1300-16-0x0000000003790000-0x0000000003B86000-memory.dmp

Filesize
4.0MB

Download
memory/1300-84-0x0000000003790000-0x0000000003B86000-memory.dmp

Filesize
4.0MB

Download
memory/1300-83-0x000000013FC70000-0x0000000140066000-memory.dmp

Filesize
4.0MB

Download
memory/1300-2-0x000000013F7B0000-0x000000013FBA6000-memory.dmp

Filesize
4.0MB

Download
memory/1300-3257-0x0000000003790000-0x0000000003B86000-memory.dmp

Filesize
4.0MB

Download
memory/1300-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1300-4-0x000000013FE10000-0x0000000140206000-memory.dmp

Filesize
4.0MB

Download
memory/1300-41-0x000000013F2B0000-0x000000013F6A6000-memory.dmp

Filesize
4.0MB

Download
memory/1300-45-0x0000000003790000-0x0000000003B86000-memory.dmp

Filesize
4.0MB

Download
memory/1300-67-0x0000000003790000-0x0000000003B86000-memory.dmp

Filesize
4.0MB

Download
memory/1692-42-0x000000013F2B0000-0x000000013F6A6000-memory.dmp

Filesize
4.0MB

Download
memory/2112-15-0x000000013F950000-0x000000013FD46000-memory.dmp

Filesize
4.0MB

Download
memory/2112-2941-0x000000013F950000-0x000000013FD46000-memory.dmp

Filesize
4.0MB

Download
memory/2352-4493-0x000000013FDD0000-0x00000001401C6000-memory.dmp

Filesize
4.0MB

Download
memory/2352-31-0x000000013FDD0000-0x00000001401C6000-memory.dmp

Filesize
4.0MB

Download
memory/2352-3643-0x000000013FDD0000-0x00000001401C6000-memory.dmp

Filesize
4.0MB

Download
memory/2500-132-0x0000000002870000-0x0000000002878000-memory.dmp

Filesize
32KB

Download
memory/2500-127-0x000000001B5A0000-0x000000001B882000-memory.dmp

Filesize
2.9MB

Download
memory/2500-40-0x0000000002C90000-0x0000000002D10000-memory.dmp

Filesize
512KB

Download
memory/2636-66-0x000000013F1F0000-0x000000013F5E6000-memory.dmp

Filesize
4.0MB

Download
memory/2684-71-0x000000013FC70000-0x0000000140066000-memory.dmp

Filesize
4.0MB

Download
memory/2692-82-0x000000013F720000-0x000000013FB16000-memory.dmp

Filesize
4.0MB

Download
memory/2868-95-0x000000013F340000-0x000000013F736000-memory.dmp

Filesize
4.0MB

Download
memory/2936-3258-0x000000013F0A0000-0x000000013F496000-memory.dmp

Filesize
4.0MB

Download
memory/2936-30-0x000000013F0A0000-0x000000013F496000-memory.dmp

Filesize
4.0MB

Download
memory/3036-59-0x000000013F940000-0x000000013FD36000-memory.dmp

Filesize
4.0MB

Download