xmrig | 6e25de4bfdc53db4470e54870660601fffd9a106e28aa294cfdb8cb4f1521fd0

Analysis

max time kernel
71s
max time network
36s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
01-09-2024 06:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1cbca49c859a8d7e1a703015295bb70N.exe
Size

2.8MB
MD5

b1cbca49c859a8d7e1a703015295bb70
SHA1

816f8980e035766670c7870795acfac0fd0510f5
SHA256

6e25de4bfdc53db4470e54870660601fffd9a106e28aa294cfdb8cb4f1521fd0
SHA512

818d4d44f8ee1bd2a05db6d59819b8f7dbbe9933948b0ac6a45141c03f366bc1d91d85e5c6799afe178330e88242b27e245cf16f1539bc815cd418f8a2adef5f
SSDEEP

49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BWgac+:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RK

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 59 IoCs

miner

resource	yara_rule
behavioral1/memory/2120-0-0x000000013F2C0000-0x000000013F6B6000-memory.dmp	xmrig
behavioral1/files/0x000b00000001225e-10.dat	xmrig
behavioral1/memory/2860-13-0x000000013F890000-0x000000013FC86000-memory.dmp	xmrig
behavioral1/files/0x000700000001930d-19.dat	xmrig
behavioral1/files/0x0007000000004e76-24.dat	xmrig
behavioral1/files/0x000700000001933b-29.dat	xmrig
behavioral1/files/0x000600000001939b-38.dat	xmrig
behavioral1/files/0x00070000000193b3-44.dat	xmrig
behavioral1/files/0x00070000000193b5-48.dat	xmrig
behavioral1/files/0x0005000000019dbf-53.dat	xmrig
behavioral1/files/0x000500000001a07e-74.dat	xmrig
behavioral1/files/0x000500000001a09e-80.dat	xmrig
behavioral1/files/0x000500000001a359-90.dat	xmrig
behavioral1/files/0x000500000001a499-130.dat	xmrig
behavioral1/files/0x000500000001a48b-122.dat	xmrig
behavioral1/files/0x000500000001a41d-101.dat	xmrig
behavioral1/files/0x000500000001a49a-133.dat	xmrig
behavioral1/memory/2628-154-0x000000013F1A0000-0x000000013F596000-memory.dmp	xmrig
behavioral1/memory/2784-161-0x000000013FD70000-0x0000000140166000-memory.dmp	xmrig
behavioral1/files/0x000500000001a4b1-175.dat	xmrig
behavioral1/memory/2120-180-0x0000000003850000-0x0000000003C46000-memory.dmp	xmrig
behavioral1/files/0x000500000001a4b5-192.dat	xmrig
behavioral1/memory/2116-183-0x000000013F0E0000-0x000000013F4D6000-memory.dmp	xmrig
behavioral1/files/0x000500000001a4b3-187.dat	xmrig
behavioral1/memory/2424-181-0x000000013F4A0000-0x000000013F896000-memory.dmp	xmrig
behavioral1/memory/2440-179-0x000000013FD60000-0x0000000140156000-memory.dmp	xmrig
behavioral1/memory/1572-173-0x000000013F700000-0x000000013FAF6000-memory.dmp	xmrig
behavioral1/memory/2360-171-0x000000013F520000-0x000000013F916000-memory.dmp	xmrig
behavioral1/memory/2256-169-0x000000013F800000-0x000000013FBF6000-memory.dmp	xmrig
behavioral1/memory/2612-166-0x000000013F2A0000-0x000000013F696000-memory.dmp	xmrig
behavioral1/files/0x0036000000019240-165.dat	xmrig
behavioral1/files/0x000500000001a4af-156.dat	xmrig
behavioral1/files/0x000500000001a48d-149.dat	xmrig
behavioral1/memory/2972-147-0x000000013F350000-0x000000013F746000-memory.dmp	xmrig
behavioral1/files/0x000500000001a46f-145.dat	xmrig
behavioral1/files/0x000500000001a427-144.dat	xmrig
behavioral1/files/0x000500000001a4a9-138.dat	xmrig
behavioral1/files/0x000500000001a42d-114.dat	xmrig
behavioral1/files/0x000500000001a41e-106.dat	xmrig
behavioral1/memory/2808-99-0x000000013FBF0000-0x000000013FFE6000-memory.dmp	xmrig
behavioral1/files/0x000500000001a41b-95.dat	xmrig
behavioral1/files/0x000500000001a307-85.dat	xmrig
behavioral1/files/0x000500000001a075-71.dat	xmrig
behavioral1/files/0x0005000000019f94-63.dat	xmrig
behavioral1/files/0x0005000000019f8a-58.dat	xmrig
behavioral1/files/0x0006000000019374-33.dat	xmrig
behavioral1/memory/2120-1878-0x000000013F2C0000-0x000000013F6B6000-memory.dmp	xmrig
behavioral1/memory/2860-4324-0x000000013F890000-0x000000013FC86000-memory.dmp	xmrig
behavioral1/memory/2808-4325-0x000000013FBF0000-0x000000013FFE6000-memory.dmp	xmrig
behavioral1/memory/2972-4326-0x000000013F350000-0x000000013F746000-memory.dmp	xmrig
behavioral1/memory/2784-4327-0x000000013FD70000-0x0000000140166000-memory.dmp	xmrig
behavioral1/memory/2612-4329-0x000000013F2A0000-0x000000013F696000-memory.dmp	xmrig
behavioral1/memory/2628-4328-0x000000013F1A0000-0x000000013F596000-memory.dmp	xmrig
behavioral1/memory/2256-4330-0x000000013F800000-0x000000013FBF6000-memory.dmp	xmrig
behavioral1/memory/1572-4331-0x000000013F700000-0x000000013FAF6000-memory.dmp	xmrig
behavioral1/memory/2424-4332-0x000000013F4A0000-0x000000013F896000-memory.dmp	xmrig
behavioral1/memory/2360-4333-0x000000013F520000-0x000000013F916000-memory.dmp	xmrig
behavioral1/memory/2116-4334-0x000000013F0E0000-0x000000013F4D6000-memory.dmp	xmrig
behavioral1/memory/2440-4335-0x000000013FD60000-0x0000000140156000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2728	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2860	PtFSlzq.exe
2808	VXlJeZk.exe
2972	wvkbhtg.exe
2628	vJHGRFo.exe
2784	rEFjOXU.exe
2612	UeXygAh.exe
2256	ffyoVKL.exe
2360	wHzYcDU.exe
1572	gdEUXPR.exe
2440	GWMtNwP.exe
2424	GwVzxXk.exe
2116	uuassxv.exe
1240	ojAYUbn.exe
1868	FRkDHUf.exe
1932	BYCallF.exe
568	HkGgiVG.exe
1652	hZwYvJp.exe
2852	hsjovCO.exe
2136	vUdGZzw.exe
1648	IAMXYNE.exe
2448	csMmaEw.exe
1920	TSNFcbm.exe
2680	CyuGlNu.exe
2140	vxMVGum.exe
536	oqipQWU.exe
2336	DRFGcoa.exe
1568	UwaIQSH.exe
2356	duiRLHX.exe
1148	DdsvbCm.exe
824	mFsVhtr.exe
764	WRDDswF.exe
1600	XsurDxH.exe
1684	JIQibux.exe
1328	wbysvQt.exe
2312	SxrFnWE.exe
2524	GuRMeNC.exe
1604	gvuIXvU.exe
2180	keJjSoL.exe
2664	gcEbnrU.exe
2516	LPZaqeF.exe
1924	xuwFbaM.exe
988	baGHfKe.exe
2496	KrnPDJP.exe
1656	RBTuZVk.exe
1628	zajpWWb.exe
2388	fHRoTLH.exe
1664	GROsmcA.exe
2404	xOExmFO.exe
1036	DFjAFoT.exe
664	tvvSTnZ.exe
2108	tLvAykR.exe
1880	DMRgfDJ.exe
1488	KPPXLhc.exe
872	xfZuNOt.exe
2588	urRzMTj.exe
2156	zOjpmag.exe
2720	VVhtmub.exe
2600	RXwZXOc.exe
2888	TLDhkjb.exe
2260	MBJttOD.exe
1792	GUiGFQQ.exe
3024	ZVZjMBJ.exe
2564	ssJmZPU.exe
1564	uaoctEn.exe

Loads dropped DLL 64 IoCs

pid	Process
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe
2120	b1cbca49c859a8d7e1a703015295bb70N.exe

UPX packed file 58 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2120-0-0x000000013F2C0000-0x000000013F6B6000-memory.dmp	upx
behavioral1/files/0x000b00000001225e-10.dat	upx
behavioral1/memory/2860-13-0x000000013F890000-0x000000013FC86000-memory.dmp	upx
behavioral1/files/0x000700000001930d-19.dat	upx
behavioral1/files/0x0007000000004e76-24.dat	upx
behavioral1/files/0x000700000001933b-29.dat	upx
behavioral1/files/0x000600000001939b-38.dat	upx
behavioral1/files/0x00070000000193b3-44.dat	upx
behavioral1/files/0x00070000000193b5-48.dat	upx
behavioral1/files/0x0005000000019dbf-53.dat	upx
behavioral1/files/0x000500000001a07e-74.dat	upx
behavioral1/files/0x000500000001a09e-80.dat	upx
behavioral1/files/0x000500000001a359-90.dat	upx
behavioral1/files/0x000500000001a499-130.dat	upx
behavioral1/files/0x000500000001a48b-122.dat	upx
behavioral1/files/0x000500000001a41d-101.dat	upx
behavioral1/files/0x000500000001a49a-133.dat	upx
behavioral1/memory/2628-154-0x000000013F1A0000-0x000000013F596000-memory.dmp	upx
behavioral1/memory/2784-161-0x000000013FD70000-0x0000000140166000-memory.dmp	upx
behavioral1/files/0x000500000001a4b1-175.dat	upx
behavioral1/files/0x000500000001a4b5-192.dat	upx
behavioral1/memory/2116-183-0x000000013F0E0000-0x000000013F4D6000-memory.dmp	upx
behavioral1/files/0x000500000001a4b3-187.dat	upx
behavioral1/memory/2424-181-0x000000013F4A0000-0x000000013F896000-memory.dmp	upx
behavioral1/memory/2440-179-0x000000013FD60000-0x0000000140156000-memory.dmp	upx
behavioral1/memory/1572-173-0x000000013F700000-0x000000013FAF6000-memory.dmp	upx
behavioral1/memory/2360-171-0x000000013F520000-0x000000013F916000-memory.dmp	upx
behavioral1/memory/2256-169-0x000000013F800000-0x000000013FBF6000-memory.dmp	upx
behavioral1/memory/2612-166-0x000000013F2A0000-0x000000013F696000-memory.dmp	upx
behavioral1/files/0x0036000000019240-165.dat	upx
behavioral1/files/0x000500000001a4af-156.dat	upx
behavioral1/files/0x000500000001a48d-149.dat	upx
behavioral1/memory/2972-147-0x000000013F350000-0x000000013F746000-memory.dmp	upx
behavioral1/files/0x000500000001a46f-145.dat	upx
behavioral1/files/0x000500000001a427-144.dat	upx
behavioral1/files/0x000500000001a4a9-138.dat	upx
behavioral1/files/0x000500000001a42d-114.dat	upx
behavioral1/files/0x000500000001a41e-106.dat	upx
behavioral1/memory/2808-99-0x000000013FBF0000-0x000000013FFE6000-memory.dmp	upx
behavioral1/files/0x000500000001a41b-95.dat	upx
behavioral1/files/0x000500000001a307-85.dat	upx
behavioral1/files/0x000500000001a075-71.dat	upx
behavioral1/files/0x0005000000019f94-63.dat	upx
behavioral1/files/0x0005000000019f8a-58.dat	upx
behavioral1/files/0x0006000000019374-33.dat	upx
behavioral1/memory/2120-1878-0x000000013F2C0000-0x000000013F6B6000-memory.dmp	upx
behavioral1/memory/2860-4324-0x000000013F890000-0x000000013FC86000-memory.dmp	upx
behavioral1/memory/2808-4325-0x000000013FBF0000-0x000000013FFE6000-memory.dmp	upx
behavioral1/memory/2972-4326-0x000000013F350000-0x000000013F746000-memory.dmp	upx
behavioral1/memory/2784-4327-0x000000013FD70000-0x0000000140166000-memory.dmp	upx
behavioral1/memory/2612-4329-0x000000013F2A0000-0x000000013F696000-memory.dmp	upx
behavioral1/memory/2628-4328-0x000000013F1A0000-0x000000013F596000-memory.dmp	upx
behavioral1/memory/2256-4330-0x000000013F800000-0x000000013FBF6000-memory.dmp	upx
behavioral1/memory/1572-4331-0x000000013F700000-0x000000013FAF6000-memory.dmp	upx
behavioral1/memory/2424-4332-0x000000013F4A0000-0x000000013F896000-memory.dmp	upx
behavioral1/memory/2360-4333-0x000000013F520000-0x000000013F916000-memory.dmp	upx
behavioral1/memory/2116-4334-0x000000013F0E0000-0x000000013F4D6000-memory.dmp	upx
behavioral1/memory/2440-4335-0x000000013FD60000-0x0000000140156000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ViiIxzY.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\yjAppXV.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\QNSvUrT.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\szdSKQb.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\AvFuQmI.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\IqHXUNz.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\BlRhbho.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\ZFwwIdo.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\EzJokTK.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\MVxnjzl.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\xCdRGSd.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\PAiKAiY.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\pfRDLXA.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\QDQdRIQ.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\MgRCknQ.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\EQgDMKs.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\RezkFsH.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\RKDypIS.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\PwNrepg.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\pnJQpgi.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\sfzyyVN.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\COybUSW.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\nCVvWGG.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\jEABJVD.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\nVKKWxU.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\cyNlcmi.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\eBbZYQD.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\WyWnIWE.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\nNIfnhE.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\ymCcOPE.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\CCoTpyg.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\KEpZWTS.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\UpFPsGt.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\QrnHHOo.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\UwFLMgy.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\acfyyfK.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\PDdVUTf.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\cHUTmhA.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\gXMhfbp.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\RVjcjwG.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\tkGGxAD.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\QPKhmzk.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\sgkXooi.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\ZIbhwRf.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\LFVgjug.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\VIeWUHV.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\YEsqdqY.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\zuLuDbd.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\qXPKXXY.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\eLarAEw.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\XniZhpF.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\dwNubFm.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\wrQRTas.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\eRYHztu.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\LrbpgQK.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\meXHwkJ.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\WWeFaKK.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\rqMDmdK.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\uHdMvgF.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\TptjbDl.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\wMRLWOZ.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\NKbyWto.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\qGKpors.exe	b1cbca49c859a8d7e1a703015295bb70N.exe
File created	C:\Windows\System\UVbGJvm.exe	b1cbca49c859a8d7e1a703015295bb70N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2728	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2120	b1cbca49c859a8d7e1a703015295bb70N.exe
Token: SeLockMemoryPrivilege	2120	b1cbca49c859a8d7e1a703015295bb70N.exe
Token: SeDebugPrivilege	2728	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2728	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	31
PID 2120 wrote to memory of 2728	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	31
PID 2120 wrote to memory of 2728	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	31
PID 2120 wrote to memory of 2860	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	32
PID 2120 wrote to memory of 2860	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	32
PID 2120 wrote to memory of 2860	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	32
PID 2120 wrote to memory of 2808	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	33
PID 2120 wrote to memory of 2808	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	33
PID 2120 wrote to memory of 2808	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	33
PID 2120 wrote to memory of 2972	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	34
PID 2120 wrote to memory of 2972	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	34
PID 2120 wrote to memory of 2972	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	34
PID 2120 wrote to memory of 2628	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	35
PID 2120 wrote to memory of 2628	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	35
PID 2120 wrote to memory of 2628	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	35
PID 2120 wrote to memory of 2784	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	36
PID 2120 wrote to memory of 2784	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	36
PID 2120 wrote to memory of 2784	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	36
PID 2120 wrote to memory of 2612	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	37
PID 2120 wrote to memory of 2612	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	37
PID 2120 wrote to memory of 2612	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	37
PID 2120 wrote to memory of 2256	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	38
PID 2120 wrote to memory of 2256	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	38
PID 2120 wrote to memory of 2256	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	38
PID 2120 wrote to memory of 2360	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	39
PID 2120 wrote to memory of 2360	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	39
PID 2120 wrote to memory of 2360	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	39
PID 2120 wrote to memory of 1572	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	40
PID 2120 wrote to memory of 1572	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	40
PID 2120 wrote to memory of 1572	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	40
PID 2120 wrote to memory of 2440	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	41
PID 2120 wrote to memory of 2440	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	41
PID 2120 wrote to memory of 2440	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	41
PID 2120 wrote to memory of 2424	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	42
PID 2120 wrote to memory of 2424	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	42
PID 2120 wrote to memory of 2424	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	42
PID 2120 wrote to memory of 2116	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	43
PID 2120 wrote to memory of 2116	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	43
PID 2120 wrote to memory of 2116	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	43
PID 2120 wrote to memory of 1240	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	44
PID 2120 wrote to memory of 1240	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	44
PID 2120 wrote to memory of 1240	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	44
PID 2120 wrote to memory of 1868	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	45
PID 2120 wrote to memory of 1868	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	45
PID 2120 wrote to memory of 1868	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	45
PID 2120 wrote to memory of 1932	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	46
PID 2120 wrote to memory of 1932	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	46
PID 2120 wrote to memory of 1932	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	46
PID 2120 wrote to memory of 568	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	47
PID 2120 wrote to memory of 568	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	47
PID 2120 wrote to memory of 568	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	47
PID 2120 wrote to memory of 1652	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	48
PID 2120 wrote to memory of 1652	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	48
PID 2120 wrote to memory of 1652	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	48
PID 2120 wrote to memory of 2680	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	49
PID 2120 wrote to memory of 2680	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	49
PID 2120 wrote to memory of 2680	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	49
PID 2120 wrote to memory of 2852	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	50
PID 2120 wrote to memory of 2852	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	50
PID 2120 wrote to memory of 2852	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	50
PID 2120 wrote to memory of 2140	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	51
PID 2120 wrote to memory of 2140	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	51
PID 2120 wrote to memory of 2140	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	51
PID 2120 wrote to memory of 2136	2120	b1cbca49c859a8d7e1a703015295bb70N.exe	52

C:\Users\Admin\AppData\Local\Temp\b1cbca49c859a8d7e1a703015295bb70N.exe
"C:\Users\Admin\AppData\Local\Temp\b1cbca49c859a8d7e1a703015295bb70N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2728
- C:\Windows\System\PtFSlzq.exe
  C:\Windows\System\PtFSlzq.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\VXlJeZk.exe
  C:\Windows\System\VXlJeZk.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\wvkbhtg.exe
  C:\Windows\System\wvkbhtg.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\vJHGRFo.exe
  C:\Windows\System\vJHGRFo.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\rEFjOXU.exe
  C:\Windows\System\rEFjOXU.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\UeXygAh.exe
  C:\Windows\System\UeXygAh.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\ffyoVKL.exe
  C:\Windows\System\ffyoVKL.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\wHzYcDU.exe
  C:\Windows\System\wHzYcDU.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\gdEUXPR.exe
  C:\Windows\System\gdEUXPR.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\GWMtNwP.exe
  C:\Windows\System\GWMtNwP.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\GwVzxXk.exe
  C:\Windows\System\GwVzxXk.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\uuassxv.exe
  C:\Windows\System\uuassxv.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\ojAYUbn.exe
  C:\Windows\System\ojAYUbn.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\FRkDHUf.exe
  C:\Windows\System\FRkDHUf.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\BYCallF.exe
  C:\Windows\System\BYCallF.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\HkGgiVG.exe
  C:\Windows\System\HkGgiVG.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\hZwYvJp.exe
  C:\Windows\System\hZwYvJp.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\CyuGlNu.exe
  C:\Windows\System\CyuGlNu.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\hsjovCO.exe
  C:\Windows\System\hsjovCO.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\vxMVGum.exe
  C:\Windows\System\vxMVGum.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\vUdGZzw.exe
  C:\Windows\System\vUdGZzw.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\oqipQWU.exe
  C:\Windows\System\oqipQWU.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\IAMXYNE.exe
  C:\Windows\System\IAMXYNE.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\DRFGcoa.exe
  C:\Windows\System\DRFGcoa.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\csMmaEw.exe
  C:\Windows\System\csMmaEw.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\UwaIQSH.exe
  C:\Windows\System\UwaIQSH.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\TSNFcbm.exe
  C:\Windows\System\TSNFcbm.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\duiRLHX.exe
  C:\Windows\System\duiRLHX.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\DdsvbCm.exe
  C:\Windows\System\DdsvbCm.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\mFsVhtr.exe
  C:\Windows\System\mFsVhtr.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\WRDDswF.exe
  C:\Windows\System\WRDDswF.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\XsurDxH.exe
  C:\Windows\System\XsurDxH.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\JIQibux.exe
  C:\Windows\System\JIQibux.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\wbysvQt.exe
  C:\Windows\System\wbysvQt.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\SxrFnWE.exe
  C:\Windows\System\SxrFnWE.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\GuRMeNC.exe
  C:\Windows\System\GuRMeNC.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\gvuIXvU.exe
  C:\Windows\System\gvuIXvU.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\keJjSoL.exe
  C:\Windows\System\keJjSoL.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\gcEbnrU.exe
  C:\Windows\System\gcEbnrU.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\LPZaqeF.exe
  C:\Windows\System\LPZaqeF.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\xuwFbaM.exe
  C:\Windows\System\xuwFbaM.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\baGHfKe.exe
  C:\Windows\System\baGHfKe.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\KrnPDJP.exe
  C:\Windows\System\KrnPDJP.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\RBTuZVk.exe
  C:\Windows\System\RBTuZVk.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\zajpWWb.exe
  C:\Windows\System\zajpWWb.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\fHRoTLH.exe
  C:\Windows\System\fHRoTLH.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\GROsmcA.exe
  C:\Windows\System\GROsmcA.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\xOExmFO.exe
  C:\Windows\System\xOExmFO.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\DFjAFoT.exe
  C:\Windows\System\DFjAFoT.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\tvvSTnZ.exe
  C:\Windows\System\tvvSTnZ.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\tLvAykR.exe
  C:\Windows\System\tLvAykR.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\DMRgfDJ.exe
  C:\Windows\System\DMRgfDJ.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\KPPXLhc.exe
  C:\Windows\System\KPPXLhc.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\xfZuNOt.exe
  C:\Windows\System\xfZuNOt.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\urRzMTj.exe
  C:\Windows\System\urRzMTj.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\zOjpmag.exe
  C:\Windows\System\zOjpmag.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\VVhtmub.exe
  C:\Windows\System\VVhtmub.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\RXwZXOc.exe
  C:\Windows\System\RXwZXOc.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\TLDhkjb.exe
  C:\Windows\System\TLDhkjb.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\MBJttOD.exe
  C:\Windows\System\MBJttOD.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\GUiGFQQ.exe
  C:\Windows\System\GUiGFQQ.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\ZVZjMBJ.exe
  C:\Windows\System\ZVZjMBJ.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\ssJmZPU.exe
  C:\Windows\System\ssJmZPU.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\uaoctEn.exe
  C:\Windows\System\uaoctEn.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\fNNCViQ.exe
  C:\Windows\System\fNNCViQ.exe
  2⤵
  PID:2100
- C:\Windows\System\gdsyunQ.exe
  C:\Windows\System\gdsyunQ.exe
  2⤵
  PID:1588
- C:\Windows\System\ugjaugl.exe
  C:\Windows\System\ugjaugl.exe
  2⤵
  PID:2480
- C:\Windows\System\CGDHTBw.exe
  C:\Windows\System\CGDHTBw.exe
  2⤵
  PID:2392
- C:\Windows\System\qHVfDJo.exe
  C:\Windows\System\qHVfDJo.exe
  2⤵
  PID:1976
- C:\Windows\System\pdLpxKW.exe
  C:\Windows\System\pdLpxKW.exe
  2⤵
  PID:680
- C:\Windows\System\bvgjUYR.exe
  C:\Windows\System\bvgjUYR.exe
  2⤵
  PID:2152
- C:\Windows\System\ebmRvew.exe
  C:\Windows\System\ebmRvew.exe
  2⤵
  PID:2604
- C:\Windows\System\zbffobU.exe
  C:\Windows\System\zbffobU.exe
  2⤵
  PID:2596
- C:\Windows\System\pxNSoOb.exe
  C:\Windows\System\pxNSoOb.exe
  2⤵
  PID:900
- C:\Windows\System\NePOjiq.exe
  C:\Windows\System\NePOjiq.exe
  2⤵
  PID:2192
- C:\Windows\System\fLnXeJT.exe
  C:\Windows\System\fLnXeJT.exe
  2⤵
  PID:448
- C:\Windows\System\IiCxZII.exe
  C:\Windows\System\IiCxZII.exe
  2⤵
  PID:2828
- C:\Windows\System\hpabipI.exe
  C:\Windows\System\hpabipI.exe
  2⤵
  PID:3060
- C:\Windows\System\mrBVyqS.exe
  C:\Windows\System\mrBVyqS.exe
  2⤵
  PID:2700
- C:\Windows\System\dzzWYCh.exe
  C:\Windows\System\dzzWYCh.exe
  2⤵
  PID:576
- C:\Windows\System\riMCams.exe
  C:\Windows\System\riMCams.exe
  2⤵
  PID:1632
- C:\Windows\System\DOfgHXX.exe
  C:\Windows\System\DOfgHXX.exe
  2⤵
  PID:3068
- C:\Windows\System\DNBKsgL.exe
  C:\Windows\System\DNBKsgL.exe
  2⤵
  PID:1292
- C:\Windows\System\CvDzHna.exe
  C:\Windows\System\CvDzHna.exe
  2⤵
  PID:892
- C:\Windows\System\nZKRzIJ.exe
  C:\Windows\System\nZKRzIJ.exe
  2⤵
  PID:2836
- C:\Windows\System\jpPOeGV.exe
  C:\Windows\System\jpPOeGV.exe
  2⤵
  PID:1300
- C:\Windows\System\mJrlicE.exe
  C:\Windows\System\mJrlicE.exe
  2⤵
  PID:1608
- C:\Windows\System\QAardUT.exe
  C:\Windows\System\QAardUT.exe
  2⤵
  PID:1796
- C:\Windows\System\iIBkWzh.exe
  C:\Windows\System\iIBkWzh.exe
  2⤵
  PID:2660
- C:\Windows\System\SatifVl.exe
  C:\Windows\System\SatifVl.exe
  2⤵
  PID:264
- C:\Windows\System\hHNKKoa.exe
  C:\Windows\System\hHNKKoa.exe
  2⤵
  PID:2288
- C:\Windows\System\MQtMNLh.exe
  C:\Windows\System\MQtMNLh.exe
  2⤵
  PID:1284
- C:\Windows\System\UyzSLUI.exe
  C:\Windows\System\UyzSLUI.exe
  2⤵
  PID:2300
- C:\Windows\System\cGEgfey.exe
  C:\Windows\System\cGEgfey.exe
  2⤵
  PID:1992
- C:\Windows\System\xNKpDMH.exe
  C:\Windows\System\xNKpDMH.exe
  2⤵
  PID:1712
- C:\Windows\System\twiNfZX.exe
  C:\Windows\System\twiNfZX.exe
  2⤵
  PID:2396
- C:\Windows\System\tqfoVTE.exe
  C:\Windows\System\tqfoVTE.exe
  2⤵
  PID:2068
- C:\Windows\System\dYWkBlP.exe
  C:\Windows\System\dYWkBlP.exe
  2⤵
  PID:1480
- C:\Windows\System\HVfPOpP.exe
  C:\Windows\System\HVfPOpP.exe
  2⤵
  PID:2444
- C:\Windows\System\boxvYnf.exe
  C:\Windows\System\boxvYnf.exe
  2⤵
  PID:2988
- C:\Windows\System\XPcsoSg.exe
  C:\Windows\System\XPcsoSg.exe
  2⤵
  PID:2696
- C:\Windows\System\XTpYFxA.exe
  C:\Windows\System\XTpYFxA.exe
  2⤵
  PID:2648
- C:\Windows\System\TIrueyM.exe
  C:\Windows\System\TIrueyM.exe
  2⤵
  PID:1740
- C:\Windows\System\brlurBq.exe
  C:\Windows\System\brlurBq.exe
  2⤵
  PID:292
- C:\Windows\System\HEoQnGl.exe
  C:\Windows\System\HEoQnGl.exe
  2⤵
  PID:1000
- C:\Windows\System\ZepxfOJ.exe
  C:\Windows\System\ZepxfOJ.exe
  2⤵
  PID:2456
- C:\Windows\System\ppvbGld.exe
  C:\Windows\System\ppvbGld.exe
  2⤵
  PID:2868
- C:\Windows\System\gWhlbuZ.exe
  C:\Windows\System\gWhlbuZ.exe
  2⤵
  PID:2332
- C:\Windows\System\lDplWyF.exe
  C:\Windows\System\lDplWyF.exe
  2⤵
  PID:2560
- C:\Windows\System\xyoxvym.exe
  C:\Windows\System\xyoxvym.exe
  2⤵
  PID:2880
- C:\Windows\System\UCZVIUq.exe
  C:\Windows\System\UCZVIUq.exe
  2⤵
  PID:1052
- C:\Windows\System\aOzwhgk.exe
  C:\Windows\System\aOzwhgk.exe
  2⤵
  PID:1544
- C:\Windows\System\NjrQNcK.exe
  C:\Windows\System\NjrQNcK.exe
  2⤵
  PID:2076
- C:\Windows\System\QmYXfNI.exe
  C:\Windows\System\QmYXfNI.exe
  2⤵
  PID:540
- C:\Windows\System\RHNFhSb.exe
  C:\Windows\System\RHNFhSb.exe
  2⤵
  PID:2540
- C:\Windows\System\ncjIpOV.exe
  C:\Windows\System\ncjIpOV.exe
  2⤵
  PID:332
- C:\Windows\System\exefqAZ.exe
  C:\Windows\System\exefqAZ.exe
  2⤵
  PID:3052
- C:\Windows\System\Avlpedn.exe
  C:\Windows\System\Avlpedn.exe
  2⤵
  PID:1800
- C:\Windows\System\QbiMqWa.exe
  C:\Windows\System\QbiMqWa.exe
  2⤵
  PID:1988
- C:\Windows\System\xUwxVCz.exe
  C:\Windows\System\xUwxVCz.exe
  2⤵
  PID:2376
- C:\Windows\System\uAnspxX.exe
  C:\Windows\System\uAnspxX.exe
  2⤵
  PID:2504
- C:\Windows\System\qdeZHzh.exe
  C:\Windows\System\qdeZHzh.exe
  2⤵
  PID:2896
- C:\Windows\System\yNZTCxX.exe
  C:\Windows\System\yNZTCxX.exe
  2⤵
  PID:2248
- C:\Windows\System\arlEKmb.exe
  C:\Windows\System\arlEKmb.exe
  2⤵
  PID:1032
- C:\Windows\System\xLavgNH.exe
  C:\Windows\System\xLavgNH.exe
  2⤵
  PID:2320
- C:\Windows\System\StiGeHm.exe
  C:\Windows\System\StiGeHm.exe
  2⤵
  PID:324
- C:\Windows\System\rFUdWGH.exe
  C:\Windows\System\rFUdWGH.exe
  2⤵
  PID:848
- C:\Windows\System\YjDPRuW.exe
  C:\Windows\System\YjDPRuW.exe
  2⤵
  PID:1580
- C:\Windows\System\wBMDumT.exe
  C:\Windows\System\wBMDumT.exe
  2⤵
  PID:772
- C:\Windows\System\HwAdGUW.exe
  C:\Windows\System\HwAdGUW.exe
  2⤵
  PID:1200
- C:\Windows\System\QTTwQud.exe
  C:\Windows\System\QTTwQud.exe
  2⤵
  PID:3012
- C:\Windows\System\slPtffy.exe
  C:\Windows\System\slPtffy.exe
  2⤵
  PID:2820
- C:\Windows\System\cIqIyWj.exe
  C:\Windows\System\cIqIyWj.exe
  2⤵
  PID:316
- C:\Windows\System\YcCEhtf.exe
  C:\Windows\System\YcCEhtf.exe
  2⤵
  PID:3048
- C:\Windows\System\tGZVPML.exe
  C:\Windows\System\tGZVPML.exe
  2⤵
  PID:1228
- C:\Windows\System\INiEbRi.exe
  C:\Windows\System\INiEbRi.exe
  2⤵
  PID:1784
- C:\Windows\System\YVVzkEM.exe
  C:\Windows\System\YVVzkEM.exe
  2⤵
  PID:1884
- C:\Windows\System\PFSlNnF.exe
  C:\Windows\System\PFSlNnF.exe
  2⤵
  PID:2744
- C:\Windows\System\htSnqUf.exe
  C:\Windows\System\htSnqUf.exe
  2⤵
  PID:1296
- C:\Windows\System\hcPjorT.exe
  C:\Windows\System\hcPjorT.exe
  2⤵
  PID:3088
- C:\Windows\System\KJxxswH.exe
  C:\Windows\System\KJxxswH.exe
  2⤵
  PID:3104
- C:\Windows\System\DkDENIa.exe
  C:\Windows\System\DkDENIa.exe
  2⤵
  PID:3120
- C:\Windows\System\pamViNo.exe
  C:\Windows\System\pamViNo.exe
  2⤵
  PID:3136
- C:\Windows\System\unELwaa.exe
  C:\Windows\System\unELwaa.exe
  2⤵
  PID:3152
- C:\Windows\System\OlApAFz.exe
  C:\Windows\System\OlApAFz.exe
  2⤵
  PID:3168
- C:\Windows\System\wQInSBn.exe
  C:\Windows\System\wQInSBn.exe
  2⤵
  PID:3184
- C:\Windows\System\poYCCNS.exe
  C:\Windows\System\poYCCNS.exe
  2⤵
  PID:3204
- C:\Windows\System\vIVAbRS.exe
  C:\Windows\System\vIVAbRS.exe
  2⤵
  PID:3220
- C:\Windows\System\jbXmPFR.exe
  C:\Windows\System\jbXmPFR.exe
  2⤵
  PID:3240
- C:\Windows\System\MnKvkHc.exe
  C:\Windows\System\MnKvkHc.exe
  2⤵
  PID:3256
- C:\Windows\System\uhGKUvt.exe
  C:\Windows\System\uhGKUvt.exe
  2⤵
  PID:3272
- C:\Windows\System\bEXDoHf.exe
  C:\Windows\System\bEXDoHf.exe
  2⤵
  PID:3288
- C:\Windows\System\FugHITT.exe
  C:\Windows\System\FugHITT.exe
  2⤵
  PID:3304
- C:\Windows\System\bVpSnge.exe
  C:\Windows\System\bVpSnge.exe
  2⤵
  PID:3320
- C:\Windows\System\AhSkowF.exe
  C:\Windows\System\AhSkowF.exe
  2⤵
  PID:3336
- C:\Windows\System\tJXjNMj.exe
  C:\Windows\System\tJXjNMj.exe
  2⤵
  PID:3352
- C:\Windows\System\hYDGgUx.exe
  C:\Windows\System\hYDGgUx.exe
  2⤵
  PID:3368
- C:\Windows\System\oGbQdQZ.exe
  C:\Windows\System\oGbQdQZ.exe
  2⤵
  PID:3384
- C:\Windows\System\uwliNdS.exe
  C:\Windows\System\uwliNdS.exe
  2⤵
  PID:3400
- C:\Windows\System\fOrhkxR.exe
  C:\Windows\System\fOrhkxR.exe
  2⤵
  PID:3416
- C:\Windows\System\UYpLHiK.exe
  C:\Windows\System\UYpLHiK.exe
  2⤵
  PID:3484
- C:\Windows\System\aOrStOO.exe
  C:\Windows\System\aOrStOO.exe
  2⤵
  PID:3632
- C:\Windows\System\bGvgfXX.exe
  C:\Windows\System\bGvgfXX.exe
  2⤵
  PID:3648
- C:\Windows\System\xVgXvPx.exe
  C:\Windows\System\xVgXvPx.exe
  2⤵
  PID:3664
- C:\Windows\System\ewoOgVf.exe
  C:\Windows\System\ewoOgVf.exe
  2⤵
  PID:3704
- C:\Windows\System\jjntnqe.exe
  C:\Windows\System\jjntnqe.exe
  2⤵
  PID:3720
- C:\Windows\System\TmxBtPl.exe
  C:\Windows\System\TmxBtPl.exe
  2⤵
  PID:3736
- C:\Windows\System\XHyoWjZ.exe
  C:\Windows\System\XHyoWjZ.exe
  2⤵
  PID:3752
- C:\Windows\System\LhTsyQM.exe
  C:\Windows\System\LhTsyQM.exe
  2⤵
  PID:3768
- C:\Windows\System\wytpBBu.exe
  C:\Windows\System\wytpBBu.exe
  2⤵
  PID:3784
- C:\Windows\System\kQctSpE.exe
  C:\Windows\System\kQctSpE.exe
  2⤵
  PID:3800
- C:\Windows\System\OHDVFYI.exe
  C:\Windows\System\OHDVFYI.exe
  2⤵
  PID:3816
- C:\Windows\System\RldgMZi.exe
  C:\Windows\System\RldgMZi.exe
  2⤵
  PID:3832
- C:\Windows\System\iZCWdhi.exe
  C:\Windows\System\iZCWdhi.exe
  2⤵
  PID:3848
- C:\Windows\System\gjuzrKA.exe
  C:\Windows\System\gjuzrKA.exe
  2⤵
  PID:3872
- C:\Windows\System\HHKmlNR.exe
  C:\Windows\System\HHKmlNR.exe
  2⤵
  PID:3892
- C:\Windows\System\ZYKJVpG.exe
  C:\Windows\System\ZYKJVpG.exe
  2⤵
  PID:3912
- C:\Windows\System\fZWBtDR.exe
  C:\Windows\System\fZWBtDR.exe
  2⤵
  PID:3932
- C:\Windows\System\lsxJfPH.exe
  C:\Windows\System\lsxJfPH.exe
  2⤵
  PID:3956
- C:\Windows\System\ViVEUOW.exe
  C:\Windows\System\ViVEUOW.exe
  2⤵
  PID:3976
- C:\Windows\System\pfJtDLQ.exe
  C:\Windows\System\pfJtDLQ.exe
  2⤵
  PID:3992
- C:\Windows\System\iDURCMe.exe
  C:\Windows\System\iDURCMe.exe
  2⤵
  PID:4012
- C:\Windows\System\XzqScat.exe
  C:\Windows\System\XzqScat.exe
  2⤵
  PID:4032
- C:\Windows\System\TmqkvBk.exe
  C:\Windows\System\TmqkvBk.exe
  2⤵
  PID:4064
- C:\Windows\System\gaUOYab.exe
  C:\Windows\System\gaUOYab.exe
  2⤵
  PID:880
- C:\Windows\System\AVIeEgZ.exe
  C:\Windows\System\AVIeEgZ.exe
  2⤵
  PID:2840
- C:\Windows\System\cnMGJjh.exe
  C:\Windows\System\cnMGJjh.exe
  2⤵
  PID:3144
- C:\Windows\System\ljsLXYc.exe
  C:\Windows\System\ljsLXYc.exe
  2⤵
  PID:3216
- C:\Windows\System\sMOHAta.exe
  C:\Windows\System\sMOHAta.exe
  2⤵
  PID:2144
- C:\Windows\System\NwWGvBA.exe
  C:\Windows\System\NwWGvBA.exe
  2⤵
  PID:3376
- C:\Windows\System\BJxYuFu.exe
  C:\Windows\System\BJxYuFu.exe
  2⤵
  PID:3496
- C:\Windows\System\WNDVzXn.exe
  C:\Windows\System\WNDVzXn.exe
  2⤵
  PID:3516
- C:\Windows\System\jtpkpHi.exe
  C:\Windows\System\jtpkpHi.exe
  2⤵
  PID:3548
- C:\Windows\System\FItydcn.exe
  C:\Windows\System\FItydcn.exe
  2⤵
  PID:3608
- C:\Windows\System\aiXzPAH.exe
  C:\Windows\System\aiXzPAH.exe
  2⤵
  PID:1676
- C:\Windows\System\nIFuMlc.exe
  C:\Windows\System\nIFuMlc.exe
  2⤵
  PID:3712
- C:\Windows\System\rZknyWN.exe
  C:\Windows\System\rZknyWN.exe
  2⤵
  PID:3164
- C:\Windows\System\ZJjDZRp.exe
  C:\Windows\System\ZJjDZRp.exe
  2⤵
  PID:3640
- C:\Windows\System\QVMEuWi.exe
  C:\Windows\System\QVMEuWi.exe
  2⤵
  PID:2216
- C:\Windows\System\torhtiv.exe
  C:\Windows\System\torhtiv.exe
  2⤵
  PID:2996
- C:\Windows\System\HxNbfyk.exe
  C:\Windows\System\HxNbfyk.exe
  2⤵
  PID:3924
- C:\Windows\System\aGouvbV.exe
  C:\Windows\System\aGouvbV.exe
  2⤵
  PID:3908
- C:\Windows\System\oMtOXFu.exe
  C:\Windows\System\oMtOXFu.exe
  2⤵
  PID:3944
- C:\Windows\System\ZTJvleI.exe
  C:\Windows\System\ZTJvleI.exe
  2⤵
  PID:3988
- C:\Windows\System\ZyMTJjV.exe
  C:\Windows\System\ZyMTJjV.exe
  2⤵
  PID:4024
- C:\Windows\System\aWetkgs.exe
  C:\Windows\System\aWetkgs.exe
  2⤵
  PID:4072
- C:\Windows\System\qsnIGRv.exe
  C:\Windows\System\qsnIGRv.exe
  2⤵
  PID:2128
- C:\Windows\System\mphiVFK.exe
  C:\Windows\System\mphiVFK.exe
  2⤵
  PID:3176
- C:\Windows\System\mUxcuUY.exe
  C:\Windows\System\mUxcuUY.exe
  2⤵
  PID:1004
- C:\Windows\System\siCRnaa.exe
  C:\Windows\System\siCRnaa.exe
  2⤵
  PID:1876
- C:\Windows\System\rTTwyOn.exe
  C:\Windows\System\rTTwyOn.exe
  2⤵
  PID:3512
- C:\Windows\System\thimnrf.exe
  C:\Windows\System\thimnrf.exe
  2⤵
  PID:3576
- C:\Windows\System\qiVBVZY.exe
  C:\Windows\System\qiVBVZY.exe
  2⤵
  PID:2608
- C:\Windows\System\Ggwpula.exe
  C:\Windows\System\Ggwpula.exe
  2⤵
  PID:3232
- C:\Windows\System\AMrIajG.exe
  C:\Windows\System\AMrIajG.exe
  2⤵
  PID:2252
- C:\Windows\System\nKFlIqW.exe
  C:\Windows\System\nKFlIqW.exe
  2⤵
  PID:3100
- C:\Windows\System\CoqyfBK.exe
  C:\Windows\System\CoqyfBK.exe
  2⤵
  PID:3300
- C:\Windows\System\kKVFFGV.exe
  C:\Windows\System\kKVFFGV.exe
  2⤵
  PID:3392
- C:\Windows\System\BovRJPz.exe
  C:\Windows\System\BovRJPz.exe
  2⤵
  PID:3432
- C:\Windows\System\HeHOKaK.exe
  C:\Windows\System\HeHOKaK.exe
  2⤵
  PID:3448
- C:\Windows\System\xvAFngt.exe
  C:\Windows\System\xvAFngt.exe
  2⤵
  PID:3464
- C:\Windows\System\hQoMKPW.exe
  C:\Windows\System\hQoMKPW.exe
  2⤵
  PID:3476
- C:\Windows\System\MyuLTTO.exe
  C:\Windows\System\MyuLTTO.exe
  2⤵
  PID:3732
- C:\Windows\System\BMhrjwh.exe
  C:\Windows\System\BMhrjwh.exe
  2⤵
  PID:3676
- C:\Windows\System\okleRZi.exe
  C:\Windows\System\okleRZi.exe
  2⤵
  PID:3792
- C:\Windows\System\iQIGKiZ.exe
  C:\Windows\System\iQIGKiZ.exe
  2⤵
  PID:3824
- C:\Windows\System\ywXrpwb.exe
  C:\Windows\System\ywXrpwb.exe
  2⤵
  PID:3888
- C:\Windows\System\lVBvpoX.exe
  C:\Windows\System\lVBvpoX.exe
  2⤵
  PID:3884
- C:\Windows\System\AasHozA.exe
  C:\Windows\System\AasHozA.exe
  2⤵
  PID:3860
- C:\Windows\System\UWPXYBw.exe
  C:\Windows\System\UWPXYBw.exe
  2⤵
  PID:3984
- C:\Windows\System\RgRzvwv.exe
  C:\Windows\System\RgRzvwv.exe
  2⤵
  PID:3972
- C:\Windows\System\SwHgXcM.exe
  C:\Windows\System\SwHgXcM.exe
  2⤵
  PID:4008
- C:\Windows\System\QthXOGa.exe
  C:\Windows\System\QthXOGa.exe
  2⤵
  PID:4020
- C:\Windows\System\mYZzkuq.exe
  C:\Windows\System\mYZzkuq.exe
  2⤵
  PID:3112
- C:\Windows\System\LVRCYwX.exe
  C:\Windows\System\LVRCYwX.exe
  2⤵
  PID:3280
- C:\Windows\System\oyqlSYP.exe
  C:\Windows\System\oyqlSYP.exe
  2⤵
  PID:3252
- C:\Windows\System\WVIZvYZ.exe
  C:\Windows\System\WVIZvYZ.exe
  2⤵
  PID:3504
- C:\Windows\System\IKvLERm.exe
  C:\Windows\System\IKvLERm.exe
  2⤵
  PID:2324
- C:\Windows\System\aOBkJUj.exe
  C:\Windows\System\aOBkJUj.exe
  2⤵
  PID:3540
- C:\Windows\System\EFeubuI.exe
  C:\Windows\System\EFeubuI.exe
  2⤵
  PID:3584
- C:\Windows\System\axXmhTj.exe
  C:\Windows\System\axXmhTj.exe
  2⤵
  PID:3600
- C:\Windows\System\NPUCNLJ.exe
  C:\Windows\System\NPUCNLJ.exe
  2⤵
  PID:3620
- C:\Windows\System\AmAGiTS.exe
  C:\Windows\System\AmAGiTS.exe
  2⤵
  PID:3332
- C:\Windows\System\wgcMOQD.exe
  C:\Windows\System\wgcMOQD.exe
  2⤵
  PID:3424
- C:\Windows\System\wuVxVJN.exe
  C:\Windows\System\wuVxVJN.exe
  2⤵
  PID:3472
- C:\Windows\System\plaANlh.exe
  C:\Windows\System\plaANlh.exe
  2⤵
  PID:3460
- C:\Windows\System\juocJzw.exe
  C:\Windows\System\juocJzw.exe
  2⤵
  PID:3796
- C:\Windows\System\EiQRmqY.exe
  C:\Windows\System\EiQRmqY.exe
  2⤵
  PID:3968
- C:\Windows\System\UfXZWkw.exe
  C:\Windows\System\UfXZWkw.exe
  2⤵
  PID:3776
- C:\Windows\System\QCeKCEo.exe
  C:\Windows\System\QCeKCEo.exe
  2⤵
  PID:3828
- C:\Windows\System\xDEUPLz.exe
  C:\Windows\System\xDEUPLz.exe
  2⤵
  PID:1144
- C:\Windows\System\SjaODHp.exe
  C:\Windows\System\SjaODHp.exe
  2⤵
  PID:1980
- C:\Windows\System\GaXEigm.exe
  C:\Windows\System\GaXEigm.exe
  2⤵
  PID:3864
- C:\Windows\System\lqoqtJe.exe
  C:\Windows\System\lqoqtJe.exe
  2⤵
  PID:3412
- C:\Windows\System\IpaEqSu.exe
  C:\Windows\System\IpaEqSu.exe
  2⤵
  PID:3568
- C:\Windows\System\DEDsrwz.exe
  C:\Windows\System\DEDsrwz.exe
  2⤵
  PID:3228
- C:\Windows\System\gfBtVJC.exe
  C:\Windows\System\gfBtVJC.exe
  2⤵
  PID:3160
- C:\Windows\System\DefxJfj.exe
  C:\Windows\System\DefxJfj.exe
  2⤵
  PID:948
- C:\Windows\System\THYptsP.exe
  C:\Windows\System\THYptsP.exe
  2⤵
  PID:3128
- C:\Windows\System\vFdYEtK.exe
  C:\Windows\System\vFdYEtK.exe
  2⤵
  PID:3596
- C:\Windows\System\loOxgSu.exe
  C:\Windows\System\loOxgSu.exe
  2⤵
  PID:4000
- C:\Windows\System\QhzTZqL.exe
  C:\Windows\System\QhzTZqL.exe
  2⤵
  PID:1940
- C:\Windows\System\lSarUci.exe
  C:\Windows\System\lSarUci.exe
  2⤵
  PID:3764
- C:\Windows\System\XQMMdnD.exe
  C:\Windows\System\XQMMdnD.exe
  2⤵
  PID:3728
- C:\Windows\System\XJMKWJy.exe
  C:\Windows\System\XJMKWJy.exe
  2⤵
  PID:3560
- C:\Windows\System\rIPNnHd.exe
  C:\Windows\System\rIPNnHd.exe
  2⤵
  PID:3572
- C:\Windows\System\alRvOFU.exe
  C:\Windows\System\alRvOFU.exe
  2⤵
  PID:3116
- C:\Windows\System\feaziql.exe
  C:\Windows\System\feaziql.exe
  2⤵
  PID:1616
- C:\Windows\System\rJlnnRR.exe
  C:\Windows\System\rJlnnRR.exe
  2⤵
  PID:3456
- C:\Windows\System\zHEuOpa.exe
  C:\Windows\System\zHEuOpa.exe
  2⤵
  PID:944
- C:\Windows\System\llaEGam.exe
  C:\Windows\System\llaEGam.exe
  2⤵
  PID:3812
- C:\Windows\System\fvgPILV.exe
  C:\Windows\System\fvgPILV.exe
  2⤵
  PID:1188
- C:\Windows\System\UaaDHpp.exe
  C:\Windows\System\UaaDHpp.exe
  2⤵
  PID:3440
- C:\Windows\System\kSVUiqn.exe
  C:\Windows\System\kSVUiqn.exe
  2⤵
  PID:3408
- C:\Windows\System\EErRIJU.exe
  C:\Windows\System\EErRIJU.exe
  2⤵
  PID:3364
- C:\Windows\System\FoFALbN.exe
  C:\Windows\System\FoFALbN.exe
  2⤵
  PID:3344
- C:\Windows\System\JOzCooZ.exe
  C:\Windows\System\JOzCooZ.exe
  2⤵
  PID:3096
- C:\Windows\System\uYxSfMe.exe
  C:\Windows\System\uYxSfMe.exe
  2⤵
  PID:1532
- C:\Windows\System\grqSrZY.exe
  C:\Windows\System\grqSrZY.exe
  2⤵
  PID:3964
- C:\Windows\System\GsHAibH.exe
  C:\Windows\System\GsHAibH.exe
  2⤵
  PID:3528
- C:\Windows\System\BoDkZzt.exe
  C:\Windows\System\BoDkZzt.exe
  2⤵
  PID:3524
- C:\Windows\System\lXeKMYL.exe
  C:\Windows\System\lXeKMYL.exe
  2⤵
  PID:3296
- C:\Windows\System\zsRoHJI.exe
  C:\Windows\System\zsRoHJI.exe
  2⤵
  PID:4104
- C:\Windows\System\rddFmRV.exe
  C:\Windows\System\rddFmRV.exe
  2⤵
  PID:4120
- C:\Windows\System\xgptwrn.exe
  C:\Windows\System\xgptwrn.exe
  2⤵
  PID:4144
- C:\Windows\System\tGEkvvq.exe
  C:\Windows\System\tGEkvvq.exe
  2⤵
  PID:4168
- C:\Windows\System\ceZVhCa.exe
  C:\Windows\System\ceZVhCa.exe
  2⤵
  PID:4192
- C:\Windows\System\yYsrLyR.exe
  C:\Windows\System\yYsrLyR.exe
  2⤵
  PID:4208
- C:\Windows\System\hQkFiSe.exe
  C:\Windows\System\hQkFiSe.exe
  2⤵
  PID:4228
- C:\Windows\System\mcyoVFC.exe
  C:\Windows\System\mcyoVFC.exe
  2⤵
  PID:4244
- C:\Windows\System\JTpnVQl.exe
  C:\Windows\System\JTpnVQl.exe
  2⤵
  PID:4260
- C:\Windows\System\aUZzvjG.exe
  C:\Windows\System\aUZzvjG.exe
  2⤵
  PID:4280
- C:\Windows\System\JGYiPof.exe
  C:\Windows\System\JGYiPof.exe
  2⤵
  PID:4296
- C:\Windows\System\rsnceoj.exe
  C:\Windows\System\rsnceoj.exe
  2⤵
  PID:4312
- C:\Windows\System\VdBSNjV.exe
  C:\Windows\System\VdBSNjV.exe
  2⤵
  PID:4328
- C:\Windows\System\prwGOwI.exe
  C:\Windows\System\prwGOwI.exe
  2⤵
  PID:4344
- C:\Windows\System\LFhXpSy.exe
  C:\Windows\System\LFhXpSy.exe
  2⤵
  PID:4368
- C:\Windows\System\DvKkFbJ.exe
  C:\Windows\System\DvKkFbJ.exe
  2⤵
  PID:4392
- C:\Windows\System\JmTAgtI.exe
  C:\Windows\System\JmTAgtI.exe
  2⤵
  PID:4412
- C:\Windows\System\xARRLQP.exe
  C:\Windows\System\xARRLQP.exe
  2⤵
  PID:4428
- C:\Windows\System\NqVZANP.exe
  C:\Windows\System\NqVZANP.exe
  2⤵
  PID:4444
- C:\Windows\System\zfvAiDf.exe
  C:\Windows\System\zfvAiDf.exe
  2⤵
  PID:4460
- C:\Windows\System\dxkmagT.exe
  C:\Windows\System\dxkmagT.exe
  2⤵
  PID:4476
- C:\Windows\System\YQywfWu.exe
  C:\Windows\System\YQywfWu.exe
  2⤵
  PID:4492
- C:\Windows\System\BsDTsms.exe
  C:\Windows\System\BsDTsms.exe
  2⤵
  PID:4512
- C:\Windows\System\ntbsWbA.exe
  C:\Windows\System\ntbsWbA.exe
  2⤵
  PID:4536
- C:\Windows\System\nillmFA.exe
  C:\Windows\System\nillmFA.exe
  2⤵
  PID:4560
- C:\Windows\System\JxDvwuN.exe
  C:\Windows\System\JxDvwuN.exe
  2⤵
  PID:4580
- C:\Windows\System\bbijRta.exe
  C:\Windows\System\bbijRta.exe
  2⤵
  PID:4608
- C:\Windows\System\tTGvIjl.exe
  C:\Windows\System\tTGvIjl.exe
  2⤵
  PID:4652
- C:\Windows\System\VkNyqNh.exe
  C:\Windows\System\VkNyqNh.exe
  2⤵
  PID:4668
- C:\Windows\System\tnrsvnT.exe
  C:\Windows\System\tnrsvnT.exe
  2⤵
  PID:4684
- C:\Windows\System\JzlcITi.exe
  C:\Windows\System\JzlcITi.exe
  2⤵
  PID:4700
- C:\Windows\System\BoasHaJ.exe
  C:\Windows\System\BoasHaJ.exe
  2⤵
  PID:4728
- C:\Windows\System\GAIEeDW.exe
  C:\Windows\System\GAIEeDW.exe
  2⤵
  PID:4748
- C:\Windows\System\xnWtfiX.exe
  C:\Windows\System\xnWtfiX.exe
  2⤵
  PID:4764
- C:\Windows\System\UBJwFfa.exe
  C:\Windows\System\UBJwFfa.exe
  2⤵
  PID:4784
- C:\Windows\System\PUSbuSC.exe
  C:\Windows\System\PUSbuSC.exe
  2⤵
  PID:4804
- C:\Windows\System\kTdvNMy.exe
  C:\Windows\System\kTdvNMy.exe
  2⤵
  PID:4828
- C:\Windows\System\oUQhITK.exe
  C:\Windows\System\oUQhITK.exe
  2⤵
  PID:4844
- C:\Windows\System\vYHOIoW.exe
  C:\Windows\System\vYHOIoW.exe
  2⤵
  PID:4860
- C:\Windows\System\BMlWTiN.exe
  C:\Windows\System\BMlWTiN.exe
  2⤵
  PID:4876
- C:\Windows\System\MEFtUcL.exe
  C:\Windows\System\MEFtUcL.exe
  2⤵
  PID:4892
- C:\Windows\System\uyouLyN.exe
  C:\Windows\System\uyouLyN.exe
  2⤵
  PID:4924
- C:\Windows\System\CMVpTUB.exe
  C:\Windows\System\CMVpTUB.exe
  2⤵
  PID:4944
- C:\Windows\System\bFmqwMC.exe
  C:\Windows\System\bFmqwMC.exe
  2⤵
  PID:4960
- C:\Windows\System\wfaiOPj.exe
  C:\Windows\System\wfaiOPj.exe
  2⤵
  PID:4976
- C:\Windows\System\jtmyajB.exe
  C:\Windows\System\jtmyajB.exe
  2⤵
  PID:4992
- C:\Windows\System\dcKmBVH.exe
  C:\Windows\System\dcKmBVH.exe
  2⤵
  PID:5008
- C:\Windows\System\lMbSJZn.exe
  C:\Windows\System\lMbSJZn.exe
  2⤵
  PID:5024
- C:\Windows\System\wTJXSoQ.exe
  C:\Windows\System\wTJXSoQ.exe
  2⤵
  PID:5040
- C:\Windows\System\SUyQzfb.exe
  C:\Windows\System\SUyQzfb.exe
  2⤵
  PID:5064
- C:\Windows\System\VIpKbCN.exe
  C:\Windows\System\VIpKbCN.exe
  2⤵
  PID:5084
- C:\Windows\System\ZHRLgnm.exe
  C:\Windows\System\ZHRLgnm.exe
  2⤵
  PID:5100
- C:\Windows\System\penfith.exe
  C:\Windows\System\penfith.exe
  2⤵
  PID:5116
- C:\Windows\System\zfWJRJi.exe
  C:\Windows\System\zfWJRJi.exe
  2⤵
  PID:3348
- C:\Windows\System\ofluAOO.exe
  C:\Windows\System\ofluAOO.exe
  2⤵
  PID:1688
- C:\Windows\System\UfcqeND.exe
  C:\Windows\System\UfcqeND.exe
  2⤵
  PID:4112
- C:\Windows\System\FigvvEP.exe
  C:\Windows\System\FigvvEP.exe
  2⤵
  PID:4128
- C:\Windows\System\fLnKHoM.exe
  C:\Windows\System\fLnKHoM.exe
  2⤵
  PID:4136
- C:\Windows\System\jLCZZLU.exe
  C:\Windows\System\jLCZZLU.exe
  2⤵
  PID:4236
- C:\Windows\System\DrwQwlS.exe
  C:\Windows\System\DrwQwlS.exe
  2⤵
  PID:4276
- C:\Windows\System\hIkoDnG.exe
  C:\Windows\System\hIkoDnG.exe
  2⤵
  PID:4176
- C:\Windows\System\xLbuSwf.exe
  C:\Windows\System\xLbuSwf.exe
  2⤵
  PID:1668
- C:\Windows\System\ZQmrPDN.exe
  C:\Windows\System\ZQmrPDN.exe
  2⤵
  PID:4420
- C:\Windows\System\JSActET.exe
  C:\Windows\System\JSActET.exe
  2⤵
  PID:4484
- C:\Windows\System\sVAADqP.exe
  C:\Windows\System\sVAADqP.exe
  2⤵
  PID:4528
- C:\Windows\System\VEPoGKe.exe
  C:\Windows\System\VEPoGKe.exe
  2⤵
  PID:4572
- C:\Windows\System\VVPASlI.exe
  C:\Windows\System\VVPASlI.exe
  2⤵
  PID:4436
- C:\Windows\System\pjeFwhc.exe
  C:\Windows\System\pjeFwhc.exe
  2⤵
  PID:4500
- C:\Windows\System\RDcrjHX.exe
  C:\Windows\System\RDcrjHX.exe
  2⤵
  PID:4624
- C:\Windows\System\vRXaFjO.exe
  C:\Windows\System\vRXaFjO.exe
  2⤵
  PID:4548
- C:\Windows\System\cfSMbsn.exe
  C:\Windows\System\cfSMbsn.exe
  2⤵
  PID:4556
- C:\Windows\System\JpEkGLN.exe
  C:\Windows\System\JpEkGLN.exe
  2⤵
  PID:4680
- C:\Windows\System\YTGyvwZ.exe
  C:\Windows\System\YTGyvwZ.exe
  2⤵
  PID:4720
- C:\Windows\System\drHXwmN.exe
  C:\Windows\System\drHXwmN.exe
  2⤵
  PID:4660
- C:\Windows\System\nGWufUK.exe
  C:\Windows\System\nGWufUK.exe
  2⤵
  PID:4288
- C:\Windows\System\kZRyTRa.exe
  C:\Windows\System\kZRyTRa.exe
  2⤵
  PID:4356
- C:\Windows\System\rSmxePA.exe
  C:\Windows\System\rSmxePA.exe
  2⤵
  PID:4404
- C:\Windows\System\MbDXSTA.exe
  C:\Windows\System\MbDXSTA.exe
  2⤵
  PID:4600
- C:\Windows\System\AHcPTvy.exe
  C:\Windows\System\AHcPTvy.exe
  2⤵
  PID:4760
- C:\Windows\System\kzAyffC.exe
  C:\Windows\System\kzAyffC.exe
  2⤵
  PID:4692
- C:\Windows\System\fNKoRyY.exe
  C:\Windows\System\fNKoRyY.exe
  2⤵
  PID:4872
- C:\Windows\System\LyWegCT.exe
  C:\Windows\System\LyWegCT.exe
  2⤵
  PID:4916
- C:\Windows\System\JbGeTKX.exe
  C:\Windows\System\JbGeTKX.exe
  2⤵
  PID:1856
- C:\Windows\System\RHRVrpx.exe
  C:\Windows\System\RHRVrpx.exe
  2⤵
  PID:4956
- C:\Windows\System\ivdAIxr.exe
  C:\Windows\System\ivdAIxr.exe
  2⤵
  PID:4080
- C:\Windows\System\okIwFVX.exe
  C:\Windows\System\okIwFVX.exe
  2⤵
  PID:4304
- C:\Windows\System\ObhpDei.exe
  C:\Windows\System\ObhpDei.exe
  2⤵
  PID:4796
- C:\Windows\System\YErRJqF.exe
  C:\Windows\System\YErRJqF.exe
  2⤵
  PID:4912
- C:\Windows\System\qmijkIw.exe
  C:\Windows\System\qmijkIw.exe
  2⤵
  PID:5056
- C:\Windows\System\rBQktig.exe
  C:\Windows\System\rBQktig.exe
  2⤵
  PID:4744
- C:\Windows\System\VhUfLpJ.exe
  C:\Windows\System\VhUfLpJ.exe
  2⤵
  PID:4400
- C:\Windows\System\ToEjLyi.exe
  C:\Windows\System\ToEjLyi.exe
  2⤵
  PID:4852
- C:\Windows\System\ltogugh.exe
  C:\Windows\System\ltogugh.exe
  2⤵
  PID:4132
- C:\Windows\System\BByFmEs.exe
  C:\Windows\System\BByFmEs.exe
  2⤵
  PID:5076
- C:\Windows\System\kLVXpTg.exe
  C:\Windows\System\kLVXpTg.exe
  2⤵
  PID:4340
- C:\Windows\System\xXxUZQN.exe
  C:\Windows\System\xXxUZQN.exe
  2⤵
  PID:4256
- C:\Windows\System\PFpmCaB.exe
  C:\Windows\System\PFpmCaB.exe
  2⤵
  PID:5020
- C:\Windows\System\mhZtqXN.exe
  C:\Windows\System\mhZtqXN.exe
  2⤵
  PID:4640
- C:\Windows\System\dlbiKoo.exe
  C:\Windows\System\dlbiKoo.exe
  2⤵
  PID:4520
- C:\Windows\System\DhhzyoZ.exe
  C:\Windows\System\DhhzyoZ.exe
  2⤵
  PID:4336
- C:\Windows\System\PVGvlPw.exe
  C:\Windows\System\PVGvlPw.exe
  2⤵
  PID:288
- C:\Windows\System\pdVRfqb.exe
  C:\Windows\System\pdVRfqb.exe
  2⤵
  PID:5036
- C:\Windows\System\DJIjvxP.exe
  C:\Windows\System\DJIjvxP.exe
  2⤵
  PID:4972
- C:\Windows\System\KUnyqzm.exe
  C:\Windows\System\KUnyqzm.exe
  2⤵
  PID:4388
- C:\Windows\System\dDQTcDN.exe
  C:\Windows\System\dDQTcDN.exe
  2⤵
  PID:4568
- C:\Windows\System\dWOcGQB.exe
  C:\Windows\System\dWOcGQB.exe
  2⤵
  PID:4628
- C:\Windows\System\btxTsWy.exe
  C:\Windows\System\btxTsWy.exe
  2⤵
  PID:4904
- C:\Windows\System\hoXqHfK.exe
  C:\Windows\System\hoXqHfK.exe
  2⤵
  PID:5096
- C:\Windows\System\QilZHsM.exe
  C:\Windows\System\QilZHsM.exe
  2⤵
  PID:4716
- C:\Windows\System\ETNdFGO.exe
  C:\Windows\System\ETNdFGO.exe
  2⤵
  PID:4648
- C:\Windows\System\kmqGnjS.exe
  C:\Windows\System\kmqGnjS.exe
  2⤵
  PID:4156
- C:\Windows\System\OMbSkDv.exe
  C:\Windows\System\OMbSkDv.exe
  2⤵
  PID:5072
- C:\Windows\System\ezWUULL.exe
  C:\Windows\System\ezWUULL.exe
  2⤵
  PID:4272
- C:\Windows\System\bBcccBK.exe
  C:\Windows\System\bBcccBK.exe
  2⤵
  PID:4908
- C:\Windows\System\GwLWUOG.exe
  C:\Windows\System\GwLWUOG.exe
  2⤵
  PID:4772
- C:\Windows\System\lDZhlea.exe
  C:\Windows\System\lDZhlea.exe
  2⤵
  PID:5080
- C:\Windows\System\iBAnRYi.exe
  C:\Windows\System\iBAnRYi.exe
  2⤵
  PID:5112
- C:\Windows\System\yTSvDJW.exe
  C:\Windows\System\yTSvDJW.exe
  2⤵
  PID:5136
- C:\Windows\System\qofaVdU.exe
  C:\Windows\System\qofaVdU.exe
  2⤵
  PID:5196
- C:\Windows\System\ntIOTUK.exe
  C:\Windows\System\ntIOTUK.exe
  2⤵
  PID:5212
- C:\Windows\System\SdiwQVo.exe
  C:\Windows\System\SdiwQVo.exe
  2⤵
  PID:5232
- C:\Windows\System\OcbAaDf.exe
  C:\Windows\System\OcbAaDf.exe
  2⤵
  PID:5248
- C:\Windows\System\NFWKfEf.exe
  C:\Windows\System\NFWKfEf.exe
  2⤵
  PID:5264
- C:\Windows\System\KmudROv.exe
  C:\Windows\System\KmudROv.exe
  2⤵
  PID:5288
- C:\Windows\System\HlByvDW.exe
  C:\Windows\System\HlByvDW.exe
  2⤵
  PID:5304
- C:\Windows\System\XcaPnTt.exe
  C:\Windows\System\XcaPnTt.exe
  2⤵
  PID:5320
- C:\Windows\System\nvUusHu.exe
  C:\Windows\System\nvUusHu.exe
  2⤵
  PID:5336
- C:\Windows\System\hNKNwXW.exe
  C:\Windows\System\hNKNwXW.exe
  2⤵
  PID:5352
- C:\Windows\System\tUrbcyU.exe
  C:\Windows\System\tUrbcyU.exe
  2⤵
  PID:5368
- C:\Windows\System\cujDxvS.exe
  C:\Windows\System\cujDxvS.exe
  2⤵
  PID:5384
- C:\Windows\System\cQdFqmj.exe
  C:\Windows\System\cQdFqmj.exe
  2⤵
  PID:5400
- C:\Windows\System\cHTRYfK.exe
  C:\Windows\System\cHTRYfK.exe
  2⤵
  PID:5416
- C:\Windows\System\ACoBDZN.exe
  C:\Windows\System\ACoBDZN.exe
  2⤵
  PID:5432
- C:\Windows\System\HryaFQL.exe
  C:\Windows\System\HryaFQL.exe
  2⤵
  PID:5448
- C:\Windows\System\tJWMLHE.exe
  C:\Windows\System\tJWMLHE.exe
  2⤵
  PID:5464
- C:\Windows\System\kvfPksH.exe
  C:\Windows\System\kvfPksH.exe
  2⤵
  PID:5480
- C:\Windows\System\CMtfrmh.exe
  C:\Windows\System\CMtfrmh.exe
  2⤵
  PID:5496
- C:\Windows\System\aQpzFOh.exe
  C:\Windows\System\aQpzFOh.exe
  2⤵
  PID:5512
- C:\Windows\System\EQHxpvP.exe
  C:\Windows\System\EQHxpvP.exe
  2⤵
  PID:5528
- C:\Windows\System\KZtTjju.exe
  C:\Windows\System\KZtTjju.exe
  2⤵
  PID:5544
- C:\Windows\System\WhbcXAH.exe
  C:\Windows\System\WhbcXAH.exe
  2⤵
  PID:5560
- C:\Windows\System\yQyNPSq.exe
  C:\Windows\System\yQyNPSq.exe
  2⤵
  PID:5576
- C:\Windows\System\aJJjNVj.exe
  C:\Windows\System\aJJjNVj.exe
  2⤵
  PID:5592
- C:\Windows\System\ZQWujna.exe
  C:\Windows\System\ZQWujna.exe
  2⤵
  PID:5608
- C:\Windows\System\BFtPgeu.exe
  C:\Windows\System\BFtPgeu.exe
  2⤵
  PID:5716
- C:\Windows\System\qCWiMpc.exe
  C:\Windows\System\qCWiMpc.exe
  2⤵
  PID:5732
- C:\Windows\System\EOcxXSe.exe
  C:\Windows\System\EOcxXSe.exe
  2⤵
  PID:5752
- C:\Windows\System\beVClBD.exe
  C:\Windows\System\beVClBD.exe
  2⤵
  PID:5768
- C:\Windows\System\lIwWVDX.exe
  C:\Windows\System\lIwWVDX.exe
  2⤵
  PID:5788
- C:\Windows\System\PNVOgXG.exe
  C:\Windows\System\PNVOgXG.exe
  2⤵
  PID:5808
- C:\Windows\System\kNOCZft.exe
  C:\Windows\System\kNOCZft.exe
  2⤵
  PID:5824
- C:\Windows\System\dYHgBQZ.exe
  C:\Windows\System\dYHgBQZ.exe
  2⤵
  PID:5840
- C:\Windows\System\UofiAZj.exe
  C:\Windows\System\UofiAZj.exe
  2⤵
  PID:5860
- C:\Windows\System\jUYsCjb.exe
  C:\Windows\System\jUYsCjb.exe
  2⤵
  PID:5880
- C:\Windows\System\vgKWOwu.exe
  C:\Windows\System\vgKWOwu.exe
  2⤵
  PID:5904
- C:\Windows\System\fsKHKCL.exe
  C:\Windows\System\fsKHKCL.exe
  2⤵
  PID:5920
- C:\Windows\System\jZmWCcv.exe
  C:\Windows\System\jZmWCcv.exe
  2⤵
  PID:5936
- C:\Windows\System\xwnwqnv.exe
  C:\Windows\System\xwnwqnv.exe
  2⤵
  PID:5952
- C:\Windows\System\dpdyuUv.exe
  C:\Windows\System\dpdyuUv.exe
  2⤵
  PID:5976
- C:\Windows\System\RAGOIVT.exe
  C:\Windows\System\RAGOIVT.exe
  2⤵
  PID:5992
- C:\Windows\System\MkGuZfe.exe
  C:\Windows\System\MkGuZfe.exe
  2⤵
  PID:6008
- C:\Windows\System\sGCsJOB.exe
  C:\Windows\System\sGCsJOB.exe
  2⤵
  PID:6024
- C:\Windows\System\SOWGlxF.exe
  C:\Windows\System\SOWGlxF.exe
  2⤵
  PID:6040
- C:\Windows\System\UIYPePK.exe
  C:\Windows\System\UIYPePK.exe
  2⤵
  PID:6056
- C:\Windows\System\LierDjm.exe
  C:\Windows\System\LierDjm.exe
  2⤵
  PID:6072
- C:\Windows\System\pUjmMsj.exe
  C:\Windows\System\pUjmMsj.exe
  2⤵
  PID:6092
- C:\Windows\System\AoEptGB.exe
  C:\Windows\System\AoEptGB.exe
  2⤵
  PID:6112
- C:\Windows\System\XAHvPQJ.exe
  C:\Windows\System\XAHvPQJ.exe
  2⤵
  PID:6132
- C:\Windows\System\JrenOhV.exe
  C:\Windows\System\JrenOhV.exe
  2⤵
  PID:4324
- C:\Windows\System\zlTOhLe.exe
  C:\Windows\System\zlTOhLe.exe
  2⤵
  PID:4812
- C:\Windows\System\gfxuOTP.exe
  C:\Windows\System\gfxuOTP.exe
  2⤵
  PID:5144
- C:\Windows\System\oWXyxoq.exe
  C:\Windows\System\oWXyxoq.exe
  2⤵
  PID:4676
- C:\Windows\System\exTEghF.exe
  C:\Windows\System\exTEghF.exe
  2⤵
  PID:4724
- C:\Windows\System\MzMrJAR.exe
  C:\Windows\System\MzMrJAR.exe
  2⤵
  PID:4712
- C:\Windows\System\hoVWVRR.exe
  C:\Windows\System\hoVWVRR.exe
  2⤵
  PID:5272
- C:\Windows\System\CqXbNUy.exe
  C:\Windows\System\CqXbNUy.exe
  2⤵
  PID:2884
- C:\Windows\System\TLUgslJ.exe
  C:\Windows\System\TLUgslJ.exe
  2⤵
  PID:972
- C:\Windows\System\lBtYQRp.exe
  C:\Windows\System\lBtYQRp.exe
  2⤵
  PID:5172
- C:\Windows\System\nelcvdL.exe
  C:\Windows\System\nelcvdL.exe
  2⤵
  PID:5192
- C:\Windows\System\TxrymOe.exe
  C:\Windows\System\TxrymOe.exe
  2⤵
  PID:5256
- C:\Windows\System\qsinzIr.exe
  C:\Windows\System\qsinzIr.exe
  2⤵
  PID:2552
- C:\Windows\System\mlWSHFk.exe
  C:\Windows\System\mlWSHFk.exe
  2⤵
  PID:5360
- C:\Windows\System\ZTXFRhn.exe
  C:\Windows\System\ZTXFRhn.exe
  2⤵
  PID:5392
- C:\Windows\System\egUMHNb.exe
  C:\Windows\System\egUMHNb.exe
  2⤵
  PID:5424
- C:\Windows\System\SpbabCp.exe
  C:\Windows\System\SpbabCp.exe
  2⤵
  PID:5456
- C:\Windows\System\DxSKZeu.exe
  C:\Windows\System\DxSKZeu.exe
  2⤵
  PID:1700
- C:\Windows\System\XEmOrJA.exe
  C:\Windows\System\XEmOrJA.exe
  2⤵
  PID:5520
- C:\Windows\System\LQDDFdc.exe
  C:\Windows\System\LQDDFdc.exe
  2⤵
  PID:5568
- C:\Windows\System\MAMsfwl.exe
  C:\Windows\System\MAMsfwl.exe
  2⤵
  PID:5664
- C:\Windows\System\tGHpeqe.exe
  C:\Windows\System\tGHpeqe.exe
  2⤵
  PID:5680
- C:\Windows\System\axsCNdT.exe
  C:\Windows\System\axsCNdT.exe
  2⤵
  PID:5660
- C:\Windows\System\cGlsgGo.exe
  C:\Windows\System\cGlsgGo.exe
  2⤵
  PID:5700
- C:\Windows\System\lDLdjhR.exe
  C:\Windows\System\lDLdjhR.exe
  2⤵
  PID:5628
- C:\Windows\System\RfuHUSM.exe
  C:\Windows\System\RfuHUSM.exe
  2⤵
  PID:5648
- C:\Windows\System\DcxMHqR.exe
  C:\Windows\System\DcxMHqR.exe
  2⤵
  PID:5708
- C:\Windows\System\QPHugnh.exe
  C:\Windows\System\QPHugnh.exe
  2⤵
  PID:5764
- C:\Windows\System\xkgLgTH.exe
  C:\Windows\System\xkgLgTH.exe
  2⤵
  PID:5832
- C:\Windows\System\vKCVeza.exe
  C:\Windows\System\vKCVeza.exe
  2⤵
  PID:5872
- C:\Windows\System\MCZnvTy.exe
  C:\Windows\System\MCZnvTy.exe
  2⤵
  PID:5816
- C:\Windows\System\fjTbQkk.exe
  C:\Windows\System\fjTbQkk.exe
  2⤵
  PID:5856
- C:\Windows\System\EbEXPsn.exe
  C:\Windows\System\EbEXPsn.exe
  2⤵
  PID:5780
- C:\Windows\System\IBwvmYa.exe
  C:\Windows\System\IBwvmYa.exe
  2⤵
  PID:5712
- C:\Windows\System\UuKmExG.exe
  C:\Windows\System\UuKmExG.exe
  2⤵
  PID:5944
- C:\Windows\System\mBZRjyC.exe
  C:\Windows\System\mBZRjyC.exe
  2⤵
  PID:6084
- C:\Windows\System\eIiIUqP.exe
  C:\Windows\System\eIiIUqP.exe
  2⤵
  PID:6120
- C:\Windows\System\wdxWnvv.exe
  C:\Windows\System\wdxWnvv.exe
  2⤵
  PID:6108
- C:\Windows\System\GCJEfYM.exe
  C:\Windows\System\GCJEfYM.exe
  2⤵
  PID:5004
- C:\Windows\System\uKlRVlI.exe
  C:\Windows\System\uKlRVlI.exe
  2⤵
  PID:4204
- C:\Windows\System\WFJIUyb.exe
  C:\Windows\System\WFJIUyb.exe
  2⤵
  PID:4576
- C:\Windows\System\AawLYVG.exe
  C:\Windows\System\AawLYVG.exe
  2⤵
  PID:4824
- C:\Windows\System\DamHllk.exe
  C:\Windows\System\DamHllk.exe
  2⤵
  PID:5208
- C:\Windows\System\YIRQKiS.exe
  C:\Windows\System\YIRQKiS.exe
  2⤵
  PID:5224
- C:\Windows\System\VsSsNil.exe
  C:\Windows\System\VsSsNil.exe
  2⤵
  PID:3624
- C:\Windows\System\WfQuxMg.exe
  C:\Windows\System\WfQuxMg.exe
  2⤵
  PID:5332
- C:\Windows\System\QSSrvqU.exe
  C:\Windows\System\QSSrvqU.exe
  2⤵
  PID:3268
- C:\Windows\System\GaYRYxA.exe
  C:\Windows\System\GaYRYxA.exe
  2⤵
  PID:5188
- C:\Windows\System\CaKkBph.exe
  C:\Windows\System\CaKkBph.exe
  2⤵
  PID:5440
- C:\Windows\System\BHqoCcr.exe
  C:\Windows\System\BHqoCcr.exe
  2⤵
  PID:1244
- C:\Windows\System\ZnQabef.exe
  C:\Windows\System\ZnQabef.exe
  2⤵
  PID:5476
- C:\Windows\System\cIxSMzw.exe
  C:\Windows\System\cIxSMzw.exe
  2⤵
  PID:5488
- C:\Windows\System\uEjAWix.exe
  C:\Windows\System\uEjAWix.exe
  2⤵
  PID:5672
- C:\Windows\System\BAjBDti.exe
  C:\Windows\System\BAjBDti.exe
  2⤵
  PID:5644
- C:\Windows\System\DzGpDiu.exe
  C:\Windows\System\DzGpDiu.exe
  2⤵
  PID:5704
- C:\Windows\System\kRnOJFp.exe
  C:\Windows\System\kRnOJFp.exe
  2⤵
  PID:5640
- C:\Windows\System\AFAkkYR.exe
  C:\Windows\System\AFAkkYR.exe
  2⤵
  PID:5868
- C:\Windows\System\PzmEMJM.exe
  C:\Windows\System\PzmEMJM.exe
  2⤵
  PID:6048
- C:\Windows\System\PYtIFxU.exe
  C:\Windows\System\PYtIFxU.exe
  2⤵
  PID:5600
- C:\Windows\System\DvlQWfH.exe
  C:\Windows\System\DvlQWfH.exe
  2⤵
  PID:5892
- C:\Windows\System\ohpLitk.exe
  C:\Windows\System\ohpLitk.exe
  2⤵
  PID:5800
- C:\Windows\System\NUZWeRl.exe
  C:\Windows\System\NUZWeRl.exe
  2⤵
  PID:6128
- C:\Windows\System\DbSurRP.exe
  C:\Windows\System\DbSurRP.exe
  2⤵
  PID:4736
- C:\Windows\System\caLnacc.exe
  C:\Windows\System\caLnacc.exe
  2⤵
  PID:6100
- C:\Windows\System\dAuheSx.exe
  C:\Windows\System\dAuheSx.exe
  2⤵
  PID:4220
- C:\Windows\System\qDCBQHH.exe
  C:\Windows\System\qDCBQHH.exe
  2⤵
  PID:5244
- C:\Windows\System\FeeBvCd.exe
  C:\Windows\System\FeeBvCd.exe
  2⤵
  PID:5160
- C:\Windows\System\FvGNTBb.exe
  C:\Windows\System\FvGNTBb.exe
  2⤵
  PID:856
- C:\Windows\System\GXQzAgU.exe
  C:\Windows\System\GXQzAgU.exe
  2⤵
  PID:5184
- C:\Windows\System\DHkbntf.exe
  C:\Windows\System\DHkbntf.exe
  2⤵
  PID:5472
- C:\Windows\System\UgmbPFw.exe
  C:\Windows\System\UgmbPFw.exe
  2⤵
  PID:5636
- C:\Windows\System\ngprbjk.exe
  C:\Windows\System\ngprbjk.exe
  2⤵
  PID:5760
- C:\Windows\System\somONhV.exe
  C:\Windows\System\somONhV.exe
  2⤵
  PID:6052
- C:\Windows\System\JIVxDxl.exe
  C:\Windows\System\JIVxDxl.exe
  2⤵
  PID:5380
- C:\Windows\System\kwDBEcO.exe
  C:\Windows\System\kwDBEcO.exe
  2⤵
  PID:5964
- C:\Windows\System\ijDgjcr.exe
  C:\Windows\System\ijDgjcr.exe
  2⤵
  PID:5624
- C:\Windows\System\DtwLiyl.exe
  C:\Windows\System\DtwLiyl.exe
  2⤵
  PID:6000
- C:\Windows\System\VcHfhst.exe
  C:\Windows\System\VcHfhst.exe
  2⤵
  PID:5128
- C:\Windows\System\ZqutRun.exe
  C:\Windows\System\ZqutRun.exe
  2⤵
  PID:6032
- C:\Windows\System\MoyYkKb.exe
  C:\Windows\System\MoyYkKb.exe
  2⤵
  PID:4780
- C:\Windows\System\NHmzXCg.exe
  C:\Windows\System\NHmzXCg.exe
  2⤵
  PID:5284
- C:\Windows\System\hdoRjyy.exe
  C:\Windows\System\hdoRjyy.exe
  2⤵
  PID:5168
- C:\Windows\System\wRHLRof.exe
  C:\Windows\System\wRHLRof.exe
  2⤵
  PID:4868
- C:\Windows\System\ZImRlhK.exe
  C:\Windows\System\ZImRlhK.exe
  2⤵
  PID:1436
- C:\Windows\System\hXXWjKu.exe
  C:\Windows\System\hXXWjKu.exe
  2⤵
  PID:5300
- C:\Windows\System\ucYJyIm.exe
  C:\Windows\System\ucYJyIm.exe
  2⤵
  PID:5688
- C:\Windows\System\biPhFwt.exe
  C:\Windows\System\biPhFwt.exe
  2⤵
  PID:4364
- C:\Windows\System\AwECWsZ.exe
  C:\Windows\System\AwECWsZ.exe
  2⤵
  PID:6016
- C:\Windows\System\RInIoUQ.exe
  C:\Windows\System\RInIoUQ.exe
  2⤵
  PID:6152
- C:\Windows\System\brLvqia.exe
  C:\Windows\System\brLvqia.exe
  2⤵
  PID:6176
- C:\Windows\System\qMEtCdq.exe
  C:\Windows\System\qMEtCdq.exe
  2⤵
  PID:6196
- C:\Windows\System\uJpOYHI.exe
  C:\Windows\System\uJpOYHI.exe
  2⤵
  PID:6228
- C:\Windows\System\MiqtgXO.exe
  C:\Windows\System\MiqtgXO.exe
  2⤵
  PID:6248
- C:\Windows\System\PGzmxyE.exe
  C:\Windows\System\PGzmxyE.exe
  2⤵
  PID:6264
- C:\Windows\System\gKvDjtN.exe
  C:\Windows\System\gKvDjtN.exe
  2⤵
  PID:6288
- C:\Windows\System\ODPmBDo.exe
  C:\Windows\System\ODPmBDo.exe
  2⤵
  PID:6304
- C:\Windows\System\aGsUecH.exe
  C:\Windows\System\aGsUecH.exe
  2⤵
  PID:6320
- C:\Windows\System\owroyvE.exe
  C:\Windows\System\owroyvE.exe
  2⤵
  PID:6340
- C:\Windows\System\tapBtWI.exe
  C:\Windows\System\tapBtWI.exe
  2⤵
  PID:6360
- C:\Windows\System\EHjfDqQ.exe
  C:\Windows\System\EHjfDqQ.exe
  2⤵
  PID:6380
- C:\Windows\System\NBsXheY.exe
  C:\Windows\System\NBsXheY.exe
  2⤵
  PID:6396
- C:\Windows\System\aZNRMEy.exe
  C:\Windows\System\aZNRMEy.exe
  2⤵
  PID:6412
- C:\Windows\System\gWYAdUe.exe
  C:\Windows\System\gWYAdUe.exe
  2⤵
  PID:6432
- C:\Windows\System\WJdywLx.exe
  C:\Windows\System\WJdywLx.exe
  2⤵
  PID:6448
- C:\Windows\System\fDSuqEP.exe
  C:\Windows\System\fDSuqEP.exe
  2⤵
  PID:6468
- C:\Windows\System\uxtrLmk.exe
  C:\Windows\System\uxtrLmk.exe
  2⤵
  PID:6484
- C:\Windows\System\hYdzUTs.exe
  C:\Windows\System\hYdzUTs.exe
  2⤵
  PID:6500
- C:\Windows\System\atrOKEG.exe
  C:\Windows\System\atrOKEG.exe
  2⤵
  PID:6516
- C:\Windows\System\jnridCr.exe
  C:\Windows\System\jnridCr.exe
  2⤵
  PID:6532
- C:\Windows\System\dnDkHgA.exe
  C:\Windows\System\dnDkHgA.exe
  2⤵
  PID:6548
- C:\Windows\System\RychpNo.exe
  C:\Windows\System\RychpNo.exe
  2⤵
  PID:6568
- C:\Windows\System\GZZFjVZ.exe
  C:\Windows\System\GZZFjVZ.exe
  2⤵
  PID:6592
- C:\Windows\System\saBccAZ.exe
  C:\Windows\System\saBccAZ.exe
  2⤵
  PID:6612
- C:\Windows\System\UYjJfLU.exe
  C:\Windows\System\UYjJfLU.exe
  2⤵
  PID:6672
- C:\Windows\System\KtkxFzy.exe
  C:\Windows\System\KtkxFzy.exe
  2⤵
  PID:6688
- C:\Windows\System\cikqquP.exe
  C:\Windows\System\cikqquP.exe
  2⤵
  PID:6704
- C:\Windows\System\OKbahIM.exe
  C:\Windows\System\OKbahIM.exe
  2⤵
  PID:6720
- C:\Windows\System\FedwDzj.exe
  C:\Windows\System\FedwDzj.exe
  2⤵
  PID:6740
- C:\Windows\System\vrXlfuO.exe
  C:\Windows\System\vrXlfuO.exe
  2⤵
  PID:6760
- C:\Windows\System\zAtIQps.exe
  C:\Windows\System\zAtIQps.exe
  2⤵
  PID:6780
- C:\Windows\System\ESPgKEI.exe
  C:\Windows\System\ESPgKEI.exe
  2⤵
  PID:6796
- C:\Windows\System\JakzTxh.exe
  C:\Windows\System\JakzTxh.exe
  2⤵
  PID:6816
- C:\Windows\System\bkVQXLa.exe
  C:\Windows\System\bkVQXLa.exe
  2⤵
  PID:6848
- C:\Windows\System\IFANaIN.exe
  C:\Windows\System\IFANaIN.exe
  2⤵
  PID:6868
- C:\Windows\System\rwzXwvT.exe
  C:\Windows\System\rwzXwvT.exe
  2⤵
  PID:6884
- C:\Windows\System\ZspgRly.exe
  C:\Windows\System\ZspgRly.exe
  2⤵
  PID:6900
- C:\Windows\System\oZvUYly.exe
  C:\Windows\System\oZvUYly.exe
  2⤵
  PID:6916
- C:\Windows\System\QFDpCzU.exe
  C:\Windows\System\QFDpCzU.exe
  2⤵
  PID:6940
- C:\Windows\System\UGGGgaC.exe
  C:\Windows\System\UGGGgaC.exe
  2⤵
  PID:6956
- C:\Windows\System\HcLfOMU.exe
  C:\Windows\System\HcLfOMU.exe
  2⤵
  PID:6980
- C:\Windows\System\tOrZcpP.exe
  C:\Windows\System\tOrZcpP.exe
  2⤵
  PID:7000
- C:\Windows\System\gDnFxYA.exe
  C:\Windows\System\gDnFxYA.exe
  2⤵
  PID:7016
- C:\Windows\System\rhXfhAL.exe
  C:\Windows\System\rhXfhAL.exe
  2⤵
  PID:7052
- C:\Windows\System\XlVxPZE.exe
  C:\Windows\System\XlVxPZE.exe
  2⤵
  PID:7072
- C:\Windows\System\RbuXwKB.exe
  C:\Windows\System\RbuXwKB.exe
  2⤵
  PID:7092
- C:\Windows\System\XEzJAOk.exe
  C:\Windows\System\XEzJAOk.exe
  2⤵
  PID:7108
- C:\Windows\System\JPZywFs.exe
  C:\Windows\System\JPZywFs.exe
  2⤵
  PID:7124
- C:\Windows\System\PjjOXHq.exe
  C:\Windows\System\PjjOXHq.exe
  2⤵
  PID:7148
- C:\Windows\System\ogzgmWH.exe
  C:\Windows\System\ogzgmWH.exe
  2⤵
  PID:7164
- C:\Windows\System\PfrSTGB.exe
  C:\Windows\System\PfrSTGB.exe
  2⤵
  PID:5988
- C:\Windows\System\laMHIZL.exe
  C:\Windows\System\laMHIZL.exe
  2⤵
  PID:3016
- C:\Windows\System\fIIWwGl.exe
  C:\Windows\System\fIIWwGl.exe
  2⤵
  PID:6212
- C:\Windows\System\EjssAsn.exe
  C:\Windows\System\EjssAsn.exe
  2⤵
  PID:6244
- C:\Windows\System\CdbDyBF.exe
  C:\Windows\System\CdbDyBF.exe
  2⤵
  PID:5696
- C:\Windows\System\RRtOxBd.exe
  C:\Windows\System\RRtOxBd.exe
  2⤵
  PID:6256
- C:\Windows\System\VkoHBsz.exe
  C:\Windows\System\VkoHBsz.exe
  2⤵
  PID:5584
- C:\Windows\System\BbZPUbN.exe
  C:\Windows\System\BbZPUbN.exe
  2⤵
  PID:5444
- C:\Windows\System\xcUvZmt.exe
  C:\Windows\System\xcUvZmt.exe
  2⤵
  PID:6020
- C:\Windows\System\BBvdSZz.exe
  C:\Windows\System\BBvdSZz.exe
  2⤵
  PID:6300
- C:\Windows\System\cAqfktc.exe
  C:\Windows\System\cAqfktc.exe
  2⤵
  PID:6368
- C:\Windows\System\OGZUFcv.exe
  C:\Windows\System\OGZUFcv.exe
  2⤵
  PID:6440
- C:\Windows\System\OcUNeEo.exe
  C:\Windows\System\OcUNeEo.exe
  2⤵
  PID:6540
- C:\Windows\System\MeUtuGB.exe
  C:\Windows\System\MeUtuGB.exe
  2⤵
  PID:6284
- C:\Windows\System\jCXCtLN.exe
  C:\Windows\System\jCXCtLN.exe
  2⤵
  PID:6352
- C:\Windows\System\ETVgHot.exe
  C:\Windows\System\ETVgHot.exe
  2⤵
  PID:6588
- C:\Windows\System\ZLCnfRI.exe
  C:\Windows\System\ZLCnfRI.exe
  2⤵
  PID:6424
- C:\Windows\System\EinHcoV.exe
  C:\Windows\System\EinHcoV.exe
  2⤵
  PID:6492
- C:\Windows\System\PjZtaMo.exe
  C:\Windows\System\PjZtaMo.exe
  2⤵
  PID:6564
- C:\Windows\System\NyHiWXE.exe
  C:\Windows\System\NyHiWXE.exe
  2⤵
  PID:6556
- C:\Windows\System\cFgbsWu.exe
  C:\Windows\System\cFgbsWu.exe
  2⤵
  PID:6696
- C:\Windows\System\PjEjiAO.exe
  C:\Windows\System\PjEjiAO.exe
  2⤵
  PID:6732
- C:\Windows\System\GTQcKPK.exe
  C:\Windows\System\GTQcKPK.exe
  2⤵
  PID:6804
- C:\Windows\System\gDFfIbd.exe
  C:\Windows\System\gDFfIbd.exe
  2⤵
  PID:6712
- C:\Windows\System\fhLJbHt.exe
  C:\Windows\System\fhLJbHt.exe
  2⤵
  PID:6832
- C:\Windows\System\wuMSVuF.exe
  C:\Windows\System\wuMSVuF.exe
  2⤵
  PID:6896
- C:\Windows\System\LxqiOwM.exe
  C:\Windows\System\LxqiOwM.exe
  2⤵
  PID:6840
- C:\Windows\System\HlFYShg.exe
  C:\Windows\System\HlFYShg.exe
  2⤵
  PID:6976
- C:\Windows\System\VCtNRHJ.exe
  C:\Windows\System\VCtNRHJ.exe
  2⤵
  PID:7012
- C:\Windows\System\rnrTSpN.exe
  C:\Windows\System\rnrTSpN.exe
  2⤵
  PID:6952
- C:\Windows\System\TnYsaYD.exe
  C:\Windows\System\TnYsaYD.exe
  2⤵
  PID:6948
- C:\Windows\System\AGcklsz.exe
  C:\Windows\System\AGcklsz.exe
  2⤵
  PID:7044
- C:\Windows\System\udDTirO.exe
  C:\Windows\System\udDTirO.exe
  2⤵
  PID:7080
- C:\Windows\System\WifYBzp.exe
  C:\Windows\System\WifYBzp.exe
  2⤵
  PID:7120
- C:\Windows\System\bzqhDQf.exe
  C:\Windows\System\bzqhDQf.exe
  2⤵
  PID:7132
- C:\Windows\System\kpJzSqs.exe
  C:\Windows\System\kpJzSqs.exe
  2⤵
  PID:7144
- C:\Windows\System\apnWBch.exe
  C:\Windows\System\apnWBch.exe
  2⤵
  PID:6208
- C:\Windows\System\BzUGZHY.exe
  C:\Windows\System\BzUGZHY.exe
  2⤵
  PID:6184
- C:\Windows\System\tRPVmIp.exe
  C:\Windows\System\tRPVmIp.exe
  2⤵
  PID:6336
- C:\Windows\System\XvnGhgT.exe
  C:\Windows\System\XvnGhgT.exe
  2⤵
  PID:6512
- C:\Windows\System\UTFqvFa.exe
  C:\Windows\System\UTFqvFa.exe
  2⤵
  PID:6420
- C:\Windows\System\hAhtkgH.exe
  C:\Windows\System\hAhtkgH.exe
  2⤵
  PID:6628
- C:\Windows\System\gIjugrH.exe
  C:\Windows\System\gIjugrH.exe
  2⤵
  PID:6276
- C:\Windows\System\BfWELOL.exe
  C:\Windows\System\BfWELOL.exe
  2⤵
  PID:6660
- C:\Windows\System\mTvYMjT.exe
  C:\Windows\System\mTvYMjT.exe
  2⤵
  PID:6216
- C:\Windows\System\LcifhAU.exe
  C:\Windows\System\LcifhAU.exe
  2⤵
  PID:5968
- C:\Windows\System\LJKrlDK.exe
  C:\Windows\System\LJKrlDK.exe
  2⤵
  PID:6752
- C:\Windows\System\rcqyeZO.exe
  C:\Windows\System\rcqyeZO.exe
  2⤵
  PID:6460
- C:\Windows\System\eWGBhuT.exe
  C:\Windows\System\eWGBhuT.exe
  2⤵
  PID:6728
- C:\Windows\System\kjrIJnD.exe
  C:\Windows\System\kjrIJnD.exe
  2⤵
  PID:6788
- C:\Windows\System\UKscrNO.exe
  C:\Windows\System\UKscrNO.exe
  2⤵
  PID:6892
- C:\Windows\System\TmzeZGa.exe
  C:\Windows\System\TmzeZGa.exe
  2⤵
  PID:6964
- C:\Windows\System\MxopIhc.exe
  C:\Windows\System\MxopIhc.exe
  2⤵
  PID:6844
- C:\Windows\System\jFLsLSX.exe
  C:\Windows\System\jFLsLSX.exe
  2⤵
  PID:7028
- C:\Windows\System\NFIqzKL.exe
  C:\Windows\System\NFIqzKL.exe
  2⤵
  PID:7104
- C:\Windows\System\YcpvcHr.exe
  C:\Windows\System\YcpvcHr.exe
  2⤵
  PID:6348
- C:\Windows\System\QCPVaAn.exe
  C:\Windows\System\QCPVaAn.exe
  2⤵
  PID:6404
- C:\Windows\System\yFoihhy.exe
  C:\Windows\System\yFoihhy.exe
  2⤵
  PID:5916
- C:\Windows\System\usOdlxv.exe
  C:\Windows\System\usOdlxv.exe
  2⤵
  PID:6576
- C:\Windows\System\aaFoFrl.exe
  C:\Windows\System\aaFoFrl.exe
  2⤵
  PID:7024
- C:\Windows\System\qhBNtBX.exe
  C:\Windows\System\qhBNtBX.exe
  2⤵
  PID:7116
- C:\Windows\System\BnIgFcN.exe
  C:\Windows\System\BnIgFcN.exe
  2⤵
  PID:5048
- C:\Windows\System\CAwrOCT.exe
  C:\Windows\System\CAwrOCT.exe
  2⤵
  PID:6640
- C:\Windows\System\ARipyaM.exe
  C:\Windows\System\ARipyaM.exe
  2⤵
  PID:5132
- C:\Windows\System\aTAHbqc.exe
  C:\Windows\System\aTAHbqc.exe
  2⤵
  PID:6768
- C:\Windows\System\hKHMRRu.exe
  C:\Windows\System\hKHMRRu.exe
  2⤵
  PID:6860
- C:\Windows\System\VhWodjL.exe
  C:\Windows\System\VhWodjL.exe
  2⤵
  PID:6988
- C:\Windows\System\UEcErvw.exe
  C:\Windows\System\UEcErvw.exe
  2⤵
  PID:6376
- C:\Windows\System\criLTsu.exe
  C:\Windows\System\criLTsu.exe
  2⤵
  PID:6972
- C:\Windows\System\cNNHgHx.exe
  C:\Windows\System\cNNHgHx.exe
  2⤵
  PID:6636
- C:\Windows\System\zuLuDbd.exe
  C:\Windows\System\zuLuDbd.exe
  2⤵
  PID:6172
- C:\Windows\System\KxbVpFm.exe
  C:\Windows\System\KxbVpFm.exe
  2⤵
  PID:6648
- C:\Windows\System\SbINMsA.exe
  C:\Windows\System\SbINMsA.exe
  2⤵
  PID:6776
- C:\Windows\System\yKfHdVl.exe
  C:\Windows\System\yKfHdVl.exe
  2⤵
  PID:6240
- C:\Windows\System\ExQskBh.exe
  C:\Windows\System\ExQskBh.exe
  2⤵
  PID:6716
- C:\Windows\System\HeRkhlW.exe
  C:\Windows\System\HeRkhlW.exe
  2⤵
  PID:6604
- C:\Windows\System\RktyDcV.exe
  C:\Windows\System\RktyDcV.exe
  2⤵
  PID:6684
- C:\Windows\System\wFuBuql.exe
  C:\Windows\System\wFuBuql.exe
  2⤵
  PID:7088
- C:\Windows\System\JUpKqtc.exe
  C:\Windows\System\JUpKqtc.exe
  2⤵
  PID:5960
- C:\Windows\System\imKytNr.exe
  C:\Windows\System\imKytNr.exe
  2⤵
  PID:7180
- C:\Windows\System\WTSgqYx.exe
  C:\Windows\System\WTSgqYx.exe
  2⤵
  PID:7196
- C:\Windows\System\FyWxUmN.exe
  C:\Windows\System\FyWxUmN.exe
  2⤵
  PID:7212
- C:\Windows\System\meHuUcP.exe
  C:\Windows\System\meHuUcP.exe
  2⤵
  PID:7228
- C:\Windows\System\xsSSJqE.exe
  C:\Windows\System\xsSSJqE.exe
  2⤵
  PID:7248
- C:\Windows\System\hbFydzv.exe
  C:\Windows\System\hbFydzv.exe
  2⤵
  PID:7316
- C:\Windows\System\MddBYXI.exe
  C:\Windows\System\MddBYXI.exe
  2⤵
  PID:7332
- C:\Windows\System\JBzhCgI.exe
  C:\Windows\System\JBzhCgI.exe
  2⤵
  PID:7348
- C:\Windows\System\QlVucHN.exe
  C:\Windows\System\QlVucHN.exe
  2⤵
  PID:7372
- C:\Windows\System\oKiXeRY.exe
  C:\Windows\System\oKiXeRY.exe
  2⤵
  PID:7388
- C:\Windows\System\eiLKgcv.exe
  C:\Windows\System\eiLKgcv.exe
  2⤵
  PID:7404
- C:\Windows\System\DyEZCPJ.exe
  C:\Windows\System\DyEZCPJ.exe
  2⤵
  PID:7420
- C:\Windows\System\EnptWMw.exe
  C:\Windows\System\EnptWMw.exe
  2⤵
  PID:7444
- C:\Windows\System\NLupIXP.exe
  C:\Windows\System\NLupIXP.exe
  2⤵
  PID:7464
- C:\Windows\System\XjVerKC.exe
  C:\Windows\System\XjVerKC.exe
  2⤵
  PID:7480
- C:\Windows\System\RMfttAu.exe
  C:\Windows\System\RMfttAu.exe
  2⤵
  PID:7496
- C:\Windows\System\FlhAcoF.exe
  C:\Windows\System\FlhAcoF.exe
  2⤵
  PID:7516
- C:\Windows\System\jliZKvz.exe
  C:\Windows\System\jliZKvz.exe
  2⤵
  PID:7540
- C:\Windows\System\nvZeYOs.exe
  C:\Windows\System\nvZeYOs.exe
  2⤵
  PID:7556
- C:\Windows\System\RlfQVrN.exe
  C:\Windows\System\RlfQVrN.exe
  2⤵
  PID:7572
- C:\Windows\System\NktZbUZ.exe
  C:\Windows\System\NktZbUZ.exe
  2⤵
  PID:7588
- C:\Windows\System\pKiuUyz.exe
  C:\Windows\System\pKiuUyz.exe
  2⤵
  PID:7604
- C:\Windows\System\SlYaHBZ.exe
  C:\Windows\System\SlYaHBZ.exe
  2⤵
  PID:7620
- C:\Windows\System\whBuGZj.exe
  C:\Windows\System\whBuGZj.exe
  2⤵
  PID:7636
- C:\Windows\System\vqMpvbP.exe
  C:\Windows\System\vqMpvbP.exe
  2⤵
  PID:7656
- C:\Windows\System\zEJPkqt.exe
  C:\Windows\System\zEJPkqt.exe
  2⤵
  PID:7676
- C:\Windows\System\FNZsftz.exe
  C:\Windows\System\FNZsftz.exe
  2⤵
  PID:7692
- C:\Windows\System\uodWezF.exe
  C:\Windows\System\uodWezF.exe
  2⤵
  PID:7708
- C:\Windows\System\sCXMjwY.exe
  C:\Windows\System\sCXMjwY.exe
  2⤵
  PID:7724
- C:\Windows\System\MMmLOFM.exe
  C:\Windows\System\MMmLOFM.exe
  2⤵
  PID:7740
- C:\Windows\System\ecqbKOI.exe
  C:\Windows\System\ecqbKOI.exe
  2⤵
  PID:7756
- C:\Windows\System\AHOXONT.exe
  C:\Windows\System\AHOXONT.exe
  2⤵
  PID:7772
- C:\Windows\System\ryMrDva.exe
  C:\Windows\System\ryMrDva.exe
  2⤵
  PID:7792
- C:\Windows\System\imDiTeO.exe
  C:\Windows\System\imDiTeO.exe
  2⤵
  PID:7812
- C:\Windows\System\DQxAfDz.exe
  C:\Windows\System\DQxAfDz.exe
  2⤵
  PID:7832
- C:\Windows\System\TVFeibs.exe
  C:\Windows\System\TVFeibs.exe
  2⤵
  PID:7852
- C:\Windows\System\zmVUaMa.exe
  C:\Windows\System\zmVUaMa.exe
  2⤵
  PID:7868
- C:\Windows\System\jvOPHmW.exe
  C:\Windows\System\jvOPHmW.exe
  2⤵
  PID:7884
- C:\Windows\System\iewdbEm.exe
  C:\Windows\System\iewdbEm.exe
  2⤵
  PID:7900
- C:\Windows\System\lYDBlKK.exe
  C:\Windows\System\lYDBlKK.exe
  2⤵
  PID:7916
- C:\Windows\System\wjowJdO.exe
  C:\Windows\System\wjowJdO.exe
  2⤵
  PID:7932
- C:\Windows\System\twtSPIN.exe
  C:\Windows\System\twtSPIN.exe
  2⤵
  PID:7948
- C:\Windows\System\WEoukLK.exe
  C:\Windows\System\WEoukLK.exe
  2⤵
  PID:7964
- C:\Windows\System\kMAjMjR.exe
  C:\Windows\System\kMAjMjR.exe
  2⤵
  PID:7992
- C:\Windows\System\qYawOGr.exe
  C:\Windows\System\qYawOGr.exe
  2⤵
  PID:8016
- C:\Windows\System\hXEDhOV.exe
  C:\Windows\System\hXEDhOV.exe
  2⤵
  PID:8144
- C:\Windows\System\NjQQviW.exe
  C:\Windows\System\NjQQviW.exe
  2⤵
  PID:8160
- C:\Windows\System\fNIEgOl.exe
  C:\Windows\System\fNIEgOl.exe
  2⤵
  PID:8180
- C:\Windows\System\HbfsUeW.exe
  C:\Windows\System\HbfsUeW.exe
  2⤵
  PID:6992
- C:\Windows\System\KOFdjjr.exe
  C:\Windows\System\KOFdjjr.exe
  2⤵
  PID:6272
- C:\Windows\System\rNEEmmt.exe
  C:\Windows\System\rNEEmmt.exe
  2⤵
  PID:7220
- C:\Windows\System\TcdEHvE.exe
  C:\Windows\System\TcdEHvE.exe
  2⤵
  PID:7268
- C:\Windows\System\NozISQV.exe
  C:\Windows\System\NozISQV.exe
  2⤵
  PID:6632
- C:\Windows\System\lPdGZOS.exe
  C:\Windows\System\lPdGZOS.exe
  2⤵
  PID:6748
- C:\Windows\System\yFuOKQg.exe
  C:\Windows\System\yFuOKQg.exe
  2⤵
  PID:7204
- C:\Windows\System\bIBlAWn.exe
  C:\Windows\System\bIBlAWn.exe
  2⤵
  PID:7288
- C:\Windows\System\KtehfGS.exe
  C:\Windows\System\KtehfGS.exe
  2⤵
  PID:7312
- C:\Windows\System\hNbTHrY.exe
  C:\Windows\System\hNbTHrY.exe
  2⤵
  PID:7412
- C:\Windows\System\xXQSTDj.exe
  C:\Windows\System\xXQSTDj.exe
  2⤵
  PID:7488
- C:\Windows\System\hEvnKpB.exe
  C:\Windows\System\hEvnKpB.exe
  2⤵
  PID:7456
- C:\Windows\System\ZYcwRPW.exe
  C:\Windows\System\ZYcwRPW.exe
  2⤵
  PID:7368
- C:\Windows\System\ztWWyAa.exe
  C:\Windows\System\ztWWyAa.exe
  2⤵
  PID:7440
- C:\Windows\System\uVcnkag.exe
  C:\Windows\System\uVcnkag.exe
  2⤵
  PID:7532
- C:\Windows\System\YKauEsE.exe
  C:\Windows\System\YKauEsE.exe
  2⤵
  PID:7600
- C:\Windows\System\nGPJRGD.exe
  C:\Windows\System\nGPJRGD.exe
  2⤵
  PID:7508
- C:\Windows\System\hrwdkce.exe
  C:\Windows\System\hrwdkce.exe
  2⤵
  PID:7584
- C:\Windows\System\UNEEXKe.exe
  C:\Windows\System\UNEEXKe.exe
  2⤵
  PID:7668
- C:\Windows\System\UFetcgN.exe
  C:\Windows\System\UFetcgN.exe
  2⤵
  PID:7800
- C:\Windows\System\qugaQrI.exe
  C:\Windows\System\qugaQrI.exe
  2⤵
  PID:7844
- C:\Windows\System\OrzfzkC.exe
  C:\Windows\System\OrzfzkC.exe
  2⤵
  PID:7908
- C:\Windows\System\tInckRE.exe
  C:\Windows\System\tInckRE.exe
  2⤵
  PID:7716
- C:\Windows\System\KmSuRuX.exe
  C:\Windows\System\KmSuRuX.exe
  2⤵
  PID:7780
- C:\Windows\System\HcaUiyP.exe
  C:\Windows\System\HcaUiyP.exe
  2⤵
  PID:7828
- C:\Windows\System\TiIZoNH.exe
  C:\Windows\System\TiIZoNH.exe
  2⤵
  PID:7896
- C:\Windows\System\xVxiUeJ.exe
  C:\Windows\System\xVxiUeJ.exe
  2⤵
  PID:8024
- C:\Windows\System\kZWCAxo.exe
  C:\Windows\System\kZWCAxo.exe
  2⤵
  PID:8052
- C:\Windows\System\aYcKrXX.exe
  C:\Windows\System\aYcKrXX.exe
  2⤵
  PID:7928
- C:\Windows\System\oOcBQio.exe
  C:\Windows\System\oOcBQio.exe
  2⤵
  PID:8004
- C:\Windows\System\PEbImdd.exe
  C:\Windows\System\PEbImdd.exe
  2⤵
  PID:8084
- C:\Windows\System\VQLuDsu.exe
  C:\Windows\System\VQLuDsu.exe
  2⤵
  PID:8100
- C:\Windows\System\DGxGIAd.exe
  C:\Windows\System\DGxGIAd.exe
  2⤵
  PID:8116
- C:\Windows\System\ODQjNps.exe
  C:\Windows\System\ODQjNps.exe
  2⤵
  PID:7552
- C:\Windows\System\WUVVXVc.exe
  C:\Windows\System\WUVVXVc.exe
  2⤵
  PID:8156
- C:\Windows\System\vMQIocJ.exe
  C:\Windows\System\vMQIocJ.exe
  2⤵
  PID:4988
- C:\Windows\System\ThTDnbP.exe
  C:\Windows\System\ThTDnbP.exe
  2⤵
  PID:6756
- C:\Windows\System\oIdXpsw.exe
  C:\Windows\System\oIdXpsw.exe
  2⤵
  PID:7260
- C:\Windows\System\ulVcPeh.exe
  C:\Windows\System\ulVcPeh.exe
  2⤵
  PID:6908
- C:\Windows\System\EImjlrN.exe
  C:\Windows\System\EImjlrN.exe
  2⤵
  PID:7344
- C:\Windows\System\nHtuWmm.exe
  C:\Windows\System\nHtuWmm.exe
  2⤵
  PID:7384
- C:\Windows\System\icHHsIS.exe
  C:\Windows\System\icHHsIS.exe
  2⤵
  PID:7400
- C:\Windows\System\OcgeRbk.exe
  C:\Windows\System\OcgeRbk.exe
  2⤵
  PID:7460
- C:\Windows\System\IRAXmCa.exe
  C:\Windows\System\IRAXmCa.exe
  2⤵
  PID:7476
- C:\Windows\System\xwwbOny.exe
  C:\Windows\System\xwwbOny.exe
  2⤵
  PID:7564
- C:\Windows\System\CWSTOlT.exe
  C:\Windows\System\CWSTOlT.exe
  2⤵
  PID:7940
- C:\Windows\System\FAPWMLi.exe
  C:\Windows\System\FAPWMLi.exe
  2⤵
  PID:7616
- C:\Windows\System\KUwvPlF.exe
  C:\Windows\System\KUwvPlF.exe
  2⤵
  PID:7732
- C:\Windows\System\CNJpKrX.exe
  C:\Windows\System\CNJpKrX.exe
  2⤵
  PID:7808
- C:\Windows\System\HanjOvR.exe
  C:\Windows\System\HanjOvR.exe
  2⤵
  PID:7652
- C:\Windows\System\fgDlztQ.exe
  C:\Windows\System\fgDlztQ.exe
  2⤵
  PID:7752
- C:\Windows\System\xVmbfQB.exe
  C:\Windows\System\xVmbfQB.exe
  2⤵
  PID:7820
- C:\Windows\System\hNuyjnL.exe
  C:\Windows\System\hNuyjnL.exe
  2⤵
  PID:7452
- C:\Windows\System\ytRjUeb.exe
  C:\Windows\System\ytRjUeb.exe
  2⤵
  PID:8068
- C:\Windows\System\gLmkqCQ.exe
  C:\Windows\System\gLmkqCQ.exe
  2⤵
  PID:7988
- C:\Windows\System\vfwjCnx.exe
  C:\Windows\System\vfwjCnx.exe
  2⤵
  PID:8140
- C:\Windows\System\CCnikFD.exe
  C:\Windows\System\CCnikFD.exe
  2⤵
  PID:8060
- C:\Windows\System\BSGOrql.exe
  C:\Windows\System\BSGOrql.exe
  2⤵
  PID:7188
- C:\Windows\System\IzzyHSz.exe
  C:\Windows\System\IzzyHSz.exe
  2⤵
  PID:7240
- C:\Windows\System\SBqPcpi.exe
  C:\Windows\System\SBqPcpi.exe
  2⤵
  PID:7296
- C:\Windows\System\DFGhGPV.exe
  C:\Windows\System\DFGhGPV.exe
  2⤵
  PID:7416
- C:\Windows\System\gvsfSil.exe
  C:\Windows\System\gvsfSil.exe
  2⤵
  PID:7876
- C:\Windows\System\FthCyrw.exe
  C:\Windows\System\FthCyrw.exe
  2⤵
  PID:7972
- C:\Windows\System\udiFGPv.exe
  C:\Windows\System\udiFGPv.exe
  2⤵
  PID:7596
- C:\Windows\System\rmgxbxo.exe
  C:\Windows\System\rmgxbxo.exe
  2⤵
  PID:7548
- C:\Windows\System\YcIUadz.exe
  C:\Windows\System\YcIUadz.exe
  2⤵
  PID:8040
- C:\Windows\System\rnQlnMt.exe
  C:\Windows\System\rnQlnMt.exe
  2⤵
  PID:8096
- C:\Windows\System\snUxrOE.exe
  C:\Windows\System\snUxrOE.exe
  2⤵
  PID:8168
- C:\Windows\System\oTAEYxH.exe
  C:\Windows\System\oTAEYxH.exe
  2⤵
  PID:8188
- C:\Windows\System\asYmkrw.exe
  C:\Windows\System\asYmkrw.exe
  2⤵
  PID:7276
- C:\Windows\System\JbnbwZt.exe
  C:\Windows\System\JbnbwZt.exe
  2⤵
  PID:8128
- C:\Windows\System\cQpAhvq.exe
  C:\Windows\System\cQpAhvq.exe
  2⤵
  PID:5912
- C:\Windows\System\mWhnbyw.exe
  C:\Windows\System\mWhnbyw.exe
  2⤵
  PID:7768
- C:\Windows\System\OnJqBYt.exe
  C:\Windows\System\OnJqBYt.exe
  2⤵
  PID:7704
- C:\Windows\System\FyBJdxW.exe
  C:\Windows\System\FyBJdxW.exe
  2⤵
  PID:6456
- C:\Windows\System\NriYtfL.exe
  C:\Windows\System\NriYtfL.exe
  2⤵
  PID:7788
- C:\Windows\System\YuarIXu.exe
  C:\Windows\System\YuarIXu.exe
  2⤵
  PID:8152
- C:\Windows\System\JossGKg.exe
  C:\Windows\System\JossGKg.exe
  2⤵
  PID:7284
- C:\Windows\System\Zeryjhi.exe
  C:\Windows\System\Zeryjhi.exe
  2⤵
  PID:7524
- C:\Windows\System\lOmOlcA.exe
  C:\Windows\System\lOmOlcA.exe
  2⤵
  PID:6508
- C:\Windows\System\oDOXLuy.exe
  C:\Windows\System\oDOXLuy.exe
  2⤵
  PID:7892
- C:\Windows\System\VCUGnRE.exe
  C:\Windows\System\VCUGnRE.exe
  2⤵
  PID:7880
- C:\Windows\System\VbtiVOD.exe
  C:\Windows\System\VbtiVOD.exe
  2⤵
  PID:8120
- C:\Windows\System\uyJnCDx.exe
  C:\Windows\System\uyJnCDx.exe
  2⤵
  PID:8200
- C:\Windows\System\MXsmetd.exe
  C:\Windows\System\MXsmetd.exe
  2⤵
  PID:8232
- C:\Windows\System\TsmGnsk.exe
  C:\Windows\System\TsmGnsk.exe
  2⤵
  PID:8264
- C:\Windows\System\hwVeNyo.exe
  C:\Windows\System\hwVeNyo.exe
  2⤵
  PID:8280
- C:\Windows\System\MLeCvZH.exe
  C:\Windows\System\MLeCvZH.exe
  2⤵
  PID:8300
- C:\Windows\System\KFALefU.exe
  C:\Windows\System\KFALefU.exe
  2⤵
  PID:8320
- C:\Windows\System\HRMYLlf.exe
  C:\Windows\System\HRMYLlf.exe
  2⤵
  PID:8340
- C:\Windows\System\yHJqemI.exe
  C:\Windows\System\yHJqemI.exe
  2⤵
  PID:8360
- C:\Windows\System\kspewOG.exe
  C:\Windows\System\kspewOG.exe
  2⤵
  PID:8380
- C:\Windows\System\eNpLvAE.exe
  C:\Windows\System\eNpLvAE.exe
  2⤵
  PID:8408
- C:\Windows\System\KWmGSIo.exe
  C:\Windows\System\KWmGSIo.exe
  2⤵
  PID:8428
- C:\Windows\System\qXarXEz.exe
  C:\Windows\System\qXarXEz.exe
  2⤵
  PID:8444
- C:\Windows\System\OXzDVWv.exe
  C:\Windows\System\OXzDVWv.exe
  2⤵
  PID:8460
- C:\Windows\System\fMTHuaY.exe
  C:\Windows\System\fMTHuaY.exe
  2⤵
  PID:8488
- C:\Windows\System\XlZeYLm.exe
  C:\Windows\System\XlZeYLm.exe
  2⤵
  PID:8504
- C:\Windows\System\uwFjKGx.exe
  C:\Windows\System\uwFjKGx.exe
  2⤵
  PID:8528
- C:\Windows\System\sodjxJs.exe
  C:\Windows\System\sodjxJs.exe
  2⤵
  PID:8544
- C:\Windows\System\HuvBgrR.exe
  C:\Windows\System\HuvBgrR.exe
  2⤵
  PID:8564
- C:\Windows\System\rDlXHss.exe
  C:\Windows\System\rDlXHss.exe
  2⤵
  PID:8580
- C:\Windows\System\GBKMFFA.exe
  C:\Windows\System\GBKMFFA.exe
  2⤵
  PID:8596
- C:\Windows\System\maWInDE.exe
  C:\Windows\System\maWInDE.exe
  2⤵
  PID:8624
- C:\Windows\System\XQHZvzL.exe
  C:\Windows\System\XQHZvzL.exe
  2⤵
  PID:8640
- C:\Windows\System\YOkbVnC.exe
  C:\Windows\System\YOkbVnC.exe
  2⤵
  PID:8664
- C:\Windows\System\SXuRfuV.exe
  C:\Windows\System\SXuRfuV.exe
  2⤵
  PID:8680
- C:\Windows\System\iqgLsER.exe
  C:\Windows\System\iqgLsER.exe
  2⤵
  PID:8700
- C:\Windows\System\bJqrtrp.exe
  C:\Windows\System\bJqrtrp.exe
  2⤵
  PID:8716
- C:\Windows\System\HZmmDhV.exe
  C:\Windows\System\HZmmDhV.exe
  2⤵
  PID:8736
- C:\Windows\System\HuQzoMr.exe
  C:\Windows\System\HuQzoMr.exe
  2⤵
  PID:8776
- C:\Windows\System\GEBvMmg.exe
  C:\Windows\System\GEBvMmg.exe
  2⤵
  PID:8792
- C:\Windows\System\BhoGnOA.exe
  C:\Windows\System\BhoGnOA.exe
  2⤵
  PID:8808
- C:\Windows\System\agBBjkK.exe
  C:\Windows\System\agBBjkK.exe
  2⤵
  PID:8832
- C:\Windows\System\AkPlUgG.exe
  C:\Windows\System\AkPlUgG.exe
  2⤵
  PID:8848
- C:\Windows\System\XTwVJFx.exe
  C:\Windows\System\XTwVJFx.exe
  2⤵
  PID:8872
- C:\Windows\System\MvBwTEA.exe
  C:\Windows\System\MvBwTEA.exe
  2⤵
  PID:8892
- C:\Windows\System\RQcFfBq.exe
  C:\Windows\System\RQcFfBq.exe
  2⤵
  PID:8908
- C:\Windows\System\SOEkBuo.exe
  C:\Windows\System\SOEkBuo.exe
  2⤵
  PID:8924
- C:\Windows\System\yFwCGce.exe
  C:\Windows\System\yFwCGce.exe
  2⤵
  PID:8964
- C:\Windows\System\pHHXIFn.exe
  C:\Windows\System\pHHXIFn.exe
  2⤵
  PID:8984
- C:\Windows\System\OymOLWZ.exe
  C:\Windows\System\OymOLWZ.exe
  2⤵
  PID:9000
- C:\Windows\System\voBaSqB.exe
  C:\Windows\System\voBaSqB.exe
  2⤵
  PID:9016
- C:\Windows\System\EHheiOt.exe
  C:\Windows\System\EHheiOt.exe
  2⤵
  PID:9036
- C:\Windows\System\KJdCVwk.exe
  C:\Windows\System\KJdCVwk.exe
  2⤵
  PID:9064
- C:\Windows\System\mfQxIuc.exe
  C:\Windows\System\mfQxIuc.exe
  2⤵
  PID:9080
- C:\Windows\System\UgKigEO.exe
  C:\Windows\System\UgKigEO.exe
  2⤵
  PID:9100
- C:\Windows\System\asDmYNS.exe
  C:\Windows\System\asDmYNS.exe
  2⤵
  PID:9120
- C:\Windows\System\VqGUvTw.exe
  C:\Windows\System\VqGUvTw.exe
  2⤵
  PID:9136
- C:\Windows\System\TWuuNAX.exe
  C:\Windows\System\TWuuNAX.exe
  2⤵
  PID:9156
- C:\Windows\System\IxrFvrm.exe
  C:\Windows\System\IxrFvrm.exe
  2⤵
  PID:9172
- C:\Windows\System\RrAdlBS.exe
  C:\Windows\System\RrAdlBS.exe
  2⤵
  PID:9208
- C:\Windows\System\VZUAaEB.exe
  C:\Windows\System\VZUAaEB.exe
  2⤵
  PID:8064
- C:\Windows\System\DholJLh.exe
  C:\Windows\System\DholJLh.exe
  2⤵
  PID:7504
- C:\Windows\System\uqIDNYN.exe
  C:\Windows\System\uqIDNYN.exe
  2⤵
  PID:8212
- C:\Windows\System\igMfxpd.exe
  C:\Windows\System\igMfxpd.exe
  2⤵
  PID:8208
- C:\Windows\System\JUZbNxM.exe
  C:\Windows\System\JUZbNxM.exe
  2⤵
  PID:8252
- C:\Windows\System\kPVIXRO.exe
  C:\Windows\System\kPVIXRO.exe
  2⤵
  PID:8228
- C:\Windows\System\nIEcvxW.exe
  C:\Windows\System\nIEcvxW.exe
  2⤵
  PID:8296
- C:\Windows\System\RfHHBhs.exe
  C:\Windows\System\RfHHBhs.exe
  2⤵
  PID:8312
- C:\Windows\System\xPizarP.exe
  C:\Windows\System\xPizarP.exe
  2⤵
  PID:8376
- C:\Windows\System\OXLvIrW.exe
  C:\Windows\System\OXLvIrW.exe
  2⤵
  PID:8404
- C:\Windows\System\fMCgozu.exe
  C:\Windows\System\fMCgozu.exe
  2⤵
  PID:8436
- C:\Windows\System\QqZvmKq.exe
  C:\Windows\System\QqZvmKq.exe
  2⤵
  PID:8476
- C:\Windows\System\VuVvCAc.exe
  C:\Windows\System\VuVvCAc.exe
  2⤵
  PID:8496
- C:\Windows\System\DwkfEoK.exe
  C:\Windows\System\DwkfEoK.exe
  2⤵
  PID:8572
- C:\Windows\System\oMUpYYl.exe
  C:\Windows\System\oMUpYYl.exe
  2⤵
  PID:8608
- C:\Windows\System\YQReNWE.exe
  C:\Windows\System\YQReNWE.exe
  2⤵
  PID:8620
- C:\Windows\System\ADvHQgH.exe
  C:\Windows\System\ADvHQgH.exe
  2⤵
  PID:8636
- C:\Windows\System\QayjEzE.exe
  C:\Windows\System\QayjEzE.exe
  2⤵
  PID:8660
- C:\Windows\System\xlsKUeB.exe
  C:\Windows\System\xlsKUeB.exe
  2⤵
  PID:8744
- C:\Windows\System\IqyrOFY.exe
  C:\Windows\System\IqyrOFY.exe
  2⤵
  PID:8712
- C:\Windows\System\YGCtjpL.exe
  C:\Windows\System\YGCtjpL.exe
  2⤵
  PID:8768
- C:\Windows\System\VjvuNTX.exe
  C:\Windows\System\VjvuNTX.exe
  2⤵
  PID:8828
- C:\Windows\System\MswGdzI.exe
  C:\Windows\System\MswGdzI.exe
  2⤵
  PID:8864
- C:\Windows\System\HBgjBvy.exe
  C:\Windows\System\HBgjBvy.exe
  2⤵
  PID:8868
- C:\Windows\System\IQRgWml.exe
  C:\Windows\System\IQRgWml.exe
  2⤵
  PID:8904
- C:\Windows\System\UzExllG.exe
  C:\Windows\System\UzExllG.exe
  2⤵
  PID:8948
- C:\Windows\System\NuisNiE.exe
  C:\Windows\System\NuisNiE.exe
  2⤵
  PID:8976
- C:\Windows\System\JGhNXgs.exe
  C:\Windows\System\JGhNXgs.exe
  2⤵
  PID:9008
- C:\Windows\System\QehFykp.exe
  C:\Windows\System\QehFykp.exe
  2⤵
  PID:9048
- C:\Windows\System\xSUsrPN.exe
  C:\Windows\System\xSUsrPN.exe
  2⤵
  PID:9072
- C:\Windows\System\oOGuMcW.exe
  C:\Windows\System\oOGuMcW.exe
  2⤵
  PID:9092
- C:\Windows\System\dRbIjRW.exe
  C:\Windows\System\dRbIjRW.exe
  2⤵
  PID:9148
- C:\Windows\System\VxTHHck.exe
  C:\Windows\System\VxTHHck.exe
  2⤵
  PID:9184
- C:\Windows\System\OzKxrwi.exe
  C:\Windows\System\OzKxrwi.exe
  2⤵
  PID:8136
- C:\Windows\System\GecDIRJ.exe
  C:\Windows\System\GecDIRJ.exe
  2⤵
  PID:8224
- C:\Windows\System\JzkpmPI.exe
  C:\Windows\System\JzkpmPI.exe
  2⤵
  PID:8220
- C:\Windows\System\uvBmSQb.exe
  C:\Windows\System\uvBmSQb.exe
  2⤵
  PID:7256
- C:\Windows\System\XsEkszg.exe
  C:\Windows\System\XsEkszg.exe
  2⤵
  PID:8332
- C:\Windows\System\ORjAwKv.exe
  C:\Windows\System\ORjAwKv.exe
  2⤵
  PID:8316
- C:\Windows\System\EBphQVP.exe
  C:\Windows\System\EBphQVP.exe
  2⤵
  PID:8396
- C:\Windows\System\DGgLbww.exe
  C:\Windows\System\DGgLbww.exe
  2⤵
  PID:8424
- C:\Windows\System\oCPvCQq.exe
  C:\Windows\System\oCPvCQq.exe
  2⤵
  PID:8468
- C:\Windows\System\hJGiuce.exe
  C:\Windows\System\hJGiuce.exe
  2⤵
  PID:8512
- C:\Windows\System\LDBMFYY.exe
  C:\Windows\System\LDBMFYY.exe
  2⤵
  PID:8540
- C:\Windows\System\oiXtpRv.exe
  C:\Windows\System\oiXtpRv.exe
  2⤵
  PID:8588
- C:\Windows\System\vCKqtHC.exe
  C:\Windows\System\vCKqtHC.exe
  2⤵
  PID:8556
- C:\Windows\System\jKRKYow.exe
  C:\Windows\System\jKRKYow.exe
  2⤵
  PID:8728
- C:\Windows\System\tliCxRj.exe
  C:\Windows\System\tliCxRj.exe
  2⤵
  PID:8676
- C:\Windows\System\dBgGilm.exe
  C:\Windows\System\dBgGilm.exe
  2⤵
  PID:8788
- C:\Windows\System\vFklzoo.exe
  C:\Windows\System\vFklzoo.exe
  2⤵
  PID:8824
- C:\Windows\System\kSQrXmv.exe
  C:\Windows\System\kSQrXmv.exe
  2⤵
  PID:8916
- C:\Windows\System\DGjOaPm.exe
  C:\Windows\System\DGjOaPm.exe
  2⤵
  PID:8860
- C:\Windows\System\vtUWOPW.exe
  C:\Windows\System\vtUWOPW.exe
  2⤵
  PID:8524
- C:\Windows\System\AiQjreV.exe
  C:\Windows\System\AiQjreV.exe
  2⤵
  PID:9032
- C:\Windows\System\BhxiIkn.exe
  C:\Windows\System\BhxiIkn.exe
  2⤵
  PID:9088
- C:\Windows\System\FmRKmtb.exe
  C:\Windows\System\FmRKmtb.exe
  2⤵
  PID:9164
- C:\Windows\System\bweTxyb.exe
  C:\Windows\System\bweTxyb.exe
  2⤵
  PID:9152
- C:\Windows\System\klBmlRt.exe
  C:\Windows\System\klBmlRt.exe
  2⤵
  PID:9192
- C:\Windows\System\vgUhHru.exe
  C:\Windows\System\vgUhHru.exe
  2⤵
  PID:8000
- C:\Windows\System\IGeLJQe.exe
  C:\Windows\System\IGeLJQe.exe
  2⤵
  PID:7436
- C:\Windows\System\YQstuNj.exe
  C:\Windows\System\YQstuNj.exe
  2⤵
  PID:7244
- C:\Windows\System\UeSgzgI.exe
  C:\Windows\System\UeSgzgI.exe
  2⤵
  PID:8348
- C:\Windows\System\SRAmPzs.exe
  C:\Windows\System\SRAmPzs.exe
  2⤵
  PID:8520
- C:\Windows\System\GVILIGf.exe
  C:\Windows\System\GVILIGf.exe
  2⤵
  PID:8940
- C:\Windows\System\HOnpQQZ.exe
  C:\Windows\System\HOnpQQZ.exe
  2⤵
  PID:8672
- C:\Windows\System\zcVyInp.exe
  C:\Windows\System\zcVyInp.exe
  2⤵
  PID:8604
- C:\Windows\System\kCbYHzg.exe
  C:\Windows\System\kCbYHzg.exe
  2⤵
  PID:8764
- C:\Windows\System\DmlOBMJ.exe
  C:\Windows\System\DmlOBMJ.exe
  2⤵
  PID:8888
- C:\Windows\System\couWMQE.exe
  C:\Windows\System\couWMQE.exe
  2⤵
  PID:9096
- C:\Windows\System\UHYnFsI.exe
  C:\Windows\System\UHYnFsI.exe
  2⤵
  PID:9188
- C:\Windows\System\vCOvAKC.exe
  C:\Windows\System\vCOvAKC.exe
  2⤵
  PID:9180
- C:\Windows\System\AVHgAJT.exe
  C:\Windows\System\AVHgAJT.exe
  2⤵
  PID:8308
- C:\Windows\System\IPZrJRl.exe
  C:\Windows\System\IPZrJRl.exe
  2⤵
  PID:8352
- C:\Windows\System\DMqxwzS.exe
  C:\Windows\System\DMqxwzS.exe
  2⤵
  PID:8560
- C:\Windows\System\VcTcKNM.exe
  C:\Windows\System\VcTcKNM.exe
  2⤵
  PID:8800
- C:\Windows\System\sZinysD.exe
  C:\Windows\System\sZinysD.exe
  2⤵
  PID:8996
- C:\Windows\System\FyAVHDp.exe
  C:\Windows\System\FyAVHDp.exe
  2⤵
  PID:8516
- C:\Windows\System\uBqBCbq.exe
  C:\Windows\System\uBqBCbq.exe
  2⤵
  PID:8760
- C:\Windows\System\wsacyiD.exe
  C:\Windows\System\wsacyiD.exe
  2⤵
  PID:8920
- C:\Windows\System\yTKsRzW.exe
  C:\Windows\System\yTKsRzW.exe
  2⤵
  PID:9056
- C:\Windows\System\eGYzuQe.exe
  C:\Windows\System\eGYzuQe.exe
  2⤵
  PID:8400
- C:\Windows\System\AVOvXBQ.exe
  C:\Windows\System\AVOvXBQ.exe
  2⤵
  PID:7176
- C:\Windows\System\EnLQkyV.exe
  C:\Windows\System\EnLQkyV.exe
  2⤵
  PID:8980
- C:\Windows\System\qMQJsPF.exe
  C:\Windows\System\qMQJsPF.exe
  2⤵
  PID:8656
- C:\Windows\System\yRtBGpV.exe
  C:\Windows\System\yRtBGpV.exe
  2⤵
  PID:9236
- C:\Windows\System\YoFtyyw.exe
  C:\Windows\System\YoFtyyw.exe
  2⤵
  PID:9252
- C:\Windows\System\MkxOLhw.exe
  C:\Windows\System\MkxOLhw.exe
  2⤵
  PID:9272
- C:\Windows\System\nLofrCR.exe
  C:\Windows\System\nLofrCR.exe
  2⤵
  PID:9292
- C:\Windows\System\rPDBVRH.exe
  C:\Windows\System\rPDBVRH.exe
  2⤵
  PID:9308
- C:\Windows\System\ypUriJH.exe
  C:\Windows\System\ypUriJH.exe
  2⤵
  PID:9324
- C:\Windows\System\ETOoNvr.exe
  C:\Windows\System\ETOoNvr.exe
  2⤵
  PID:9360
- C:\Windows\System\uPWeUkS.exe
  C:\Windows\System\uPWeUkS.exe
  2⤵
  PID:9376
- C:\Windows\System\AqEpPtN.exe
  C:\Windows\System\AqEpPtN.exe
  2⤵
  PID:9396
- C:\Windows\System\dyRuhTo.exe
  C:\Windows\System\dyRuhTo.exe
  2⤵
  PID:9420
- C:\Windows\System\TEvdiHn.exe
  C:\Windows\System\TEvdiHn.exe
  2⤵
  PID:9436
- C:\Windows\System\trGnscy.exe
  C:\Windows\System\trGnscy.exe
  2⤵
  PID:9456
- C:\Windows\System\AMldjOv.exe
  C:\Windows\System\AMldjOv.exe
  2⤵
  PID:9472
- C:\Windows\System\QNvloTn.exe
  C:\Windows\System\QNvloTn.exe
  2⤵
  PID:9492
- C:\Windows\System\ldffJXp.exe
  C:\Windows\System\ldffJXp.exe
  2⤵
  PID:9512
- C:\Windows\System\WLRywdg.exe
  C:\Windows\System\WLRywdg.exe
  2⤵
  PID:9528
- C:\Windows\System\RDgeKAa.exe
  C:\Windows\System\RDgeKAa.exe
  2⤵
  PID:9548
- C:\Windows\System\IdqkoEm.exe
  C:\Windows\System\IdqkoEm.exe
  2⤵
  PID:9572
- C:\Windows\System\VSqnBsu.exe
  C:\Windows\System\VSqnBsu.exe
  2⤵
  PID:9588
- C:\Windows\System\liuJpxA.exe
  C:\Windows\System\liuJpxA.exe
  2⤵
  PID:9604
- C:\Windows\System\NRwkeaM.exe
  C:\Windows\System\NRwkeaM.exe
  2⤵
  PID:9620
- C:\Windows\System\xTseSuC.exe
  C:\Windows\System\xTseSuC.exe
  2⤵
  PID:9636
- C:\Windows\System\qtoDVek.exe
  C:\Windows\System\qtoDVek.exe
  2⤵
  PID:9652
- C:\Windows\System\eCjcFDg.exe
  C:\Windows\System\eCjcFDg.exe
  2⤵
  PID:9672
- C:\Windows\System\mMfqUix.exe
  C:\Windows\System\mMfqUix.exe
  2⤵
  PID:9688
- C:\Windows\System\hWpvurw.exe
  C:\Windows\System\hWpvurw.exe
  2⤵
  PID:9716
- C:\Windows\System\AICbwej.exe
  C:\Windows\System\AICbwej.exe
  2⤵
  PID:9732
- C:\Windows\System\XRBsCIs.exe
  C:\Windows\System\XRBsCIs.exe
  2⤵
  PID:9752
- C:\Windows\System\QBkBmwt.exe
  C:\Windows\System\QBkBmwt.exe
  2⤵
  PID:9776
- C:\Windows\System\hXwYFyM.exe
  C:\Windows\System\hXwYFyM.exe
  2⤵
  PID:9796
- C:\Windows\System\NHjJmBZ.exe
  C:\Windows\System\NHjJmBZ.exe
  2⤵
  PID:9820
- C:\Windows\System\NOVdODQ.exe
  C:\Windows\System\NOVdODQ.exe
  2⤵
  PID:9836
- C:\Windows\System\pUhfKdr.exe
  C:\Windows\System\pUhfKdr.exe
  2⤵
  PID:9852
- C:\Windows\System\QVVIWTX.exe
  C:\Windows\System\QVVIWTX.exe
  2⤵
  PID:9876
- C:\Windows\System\MBEyybl.exe
  C:\Windows\System\MBEyybl.exe
  2⤵
  PID:9920
- C:\Windows\System\ynVBsoL.exe
  C:\Windows\System\ynVBsoL.exe
  2⤵
  PID:9936
- C:\Windows\System\lOeoMuL.exe
  C:\Windows\System\lOeoMuL.exe
  2⤵
  PID:9956
- C:\Windows\System\anbgrue.exe
  C:\Windows\System\anbgrue.exe
  2⤵
  PID:9972
- C:\Windows\System\RqHtTup.exe
  C:\Windows\System\RqHtTup.exe
  2⤵
  PID:9996
- C:\Windows\System\TbQFuRm.exe
  C:\Windows\System\TbQFuRm.exe
  2⤵
  PID:10012
- C:\Windows\System\GurVuZQ.exe
  C:\Windows\System\GurVuZQ.exe
  2⤵
  PID:10036
- C:\Windows\System\XKxbFJp.exe
  C:\Windows\System\XKxbFJp.exe
  2⤵
  PID:10056
- C:\Windows\System\jNULHBu.exe
  C:\Windows\System\jNULHBu.exe
  2⤵
  PID:10076
- C:\Windows\System\GcdEdrv.exe
  C:\Windows\System\GcdEdrv.exe
  2⤵
  PID:10100
- C:\Windows\System\DDYNpdY.exe
  C:\Windows\System\DDYNpdY.exe
  2⤵
  PID:10116
- C:\Windows\System\zQHBglL.exe
  C:\Windows\System\zQHBglL.exe
  2⤵
  PID:10132
- C:\Windows\System\BzikypZ.exe
  C:\Windows\System\BzikypZ.exe
  2⤵
  PID:10156
- C:\Windows\System\dwdBpxG.exe
  C:\Windows\System\dwdBpxG.exe
  2⤵
  PID:10184
- C:\Windows\System\fQcCxBG.exe
  C:\Windows\System\fQcCxBG.exe
  2⤵
  PID:10200
- C:\Windows\System\aZixSje.exe
  C:\Windows\System\aZixSje.exe
  2⤵
  PID:10220
- C:\Windows\System\cfqGRYP.exe
  C:\Windows\System\cfqGRYP.exe
  2⤵
  PID:9220
- C:\Windows\System\fYBPjxB.exe
  C:\Windows\System\fYBPjxB.exe
  2⤵
  PID:9248
- C:\Windows\System\dCuoWYT.exe
  C:\Windows\System\dCuoWYT.exe
  2⤵
  PID:9280
- C:\Windows\System\vGONlPl.exe
  C:\Windows\System\vGONlPl.exe
  2⤵
  PID:9316
- C:\Windows\System\qUnWGRC.exe
  C:\Windows\System\qUnWGRC.exe
  2⤵
  PID:9344
- C:\Windows\System\arBoSYC.exe
  C:\Windows\System\arBoSYC.exe
  2⤵
  PID:9372
- C:\Windows\System\ZeYpFQg.exe
  C:\Windows\System\ZeYpFQg.exe
  2⤵
  PID:9388
- C:\Windows\System\DtrenQh.exe
  C:\Windows\System\DtrenQh.exe
  2⤵
  PID:9432
- C:\Windows\System\BvrDXOP.exe
  C:\Windows\System\BvrDXOP.exe
  2⤵
  PID:9520
- C:\Windows\System\DPnHQzO.exe
  C:\Windows\System\DPnHQzO.exe
  2⤵
  PID:9560
- C:\Windows\System\SsALTBZ.exe
  C:\Windows\System\SsALTBZ.exe
  2⤵
  PID:9600
- C:\Windows\System\UdqcMWO.exe
  C:\Windows\System\UdqcMWO.exe
  2⤵
  PID:9664
- C:\Windows\System\PjrgWMo.exe
  C:\Windows\System\PjrgWMo.exe
  2⤵
  PID:9740
- C:\Windows\System\xWpGCNT.exe
  C:\Windows\System\xWpGCNT.exe
  2⤵
  PID:9788
- C:\Windows\System\QAwrusF.exe
  C:\Windows\System\QAwrusF.exe
  2⤵
  PID:9872
- C:\Windows\System\pJpkzuh.exe
  C:\Windows\System\pJpkzuh.exe
  2⤵
  PID:9864
- C:\Windows\System\WohatQR.exe
  C:\Windows\System\WohatQR.exe
  2⤵
  PID:9580
- C:\Windows\System\ReIhEtX.exe
  C:\Windows\System\ReIhEtX.exe
  2⤵
  PID:9844
- C:\Windows\System\UVkOcZl.exe
  C:\Windows\System\UVkOcZl.exe
  2⤵
  PID:9728
- C:\Windows\System\YwoSZwK.exe
  C:\Windows\System\YwoSZwK.exe
  2⤵
  PID:9804
- C:\Windows\System\KxDuerd.exe
  C:\Windows\System\KxDuerd.exe
  2⤵
  PID:9848
- C:\Windows\System\EQtYNVh.exe
  C:\Windows\System\EQtYNVh.exe
  2⤵
  PID:9904
- C:\Windows\System\sHjQmxo.exe
  C:\Windows\System\sHjQmxo.exe
  2⤵
  PID:9928
- C:\Windows\System\mdeZvhg.exe
  C:\Windows\System\mdeZvhg.exe
  2⤵
  PID:9948
- C:\Windows\System\AmuYTrC.exe
  C:\Windows\System\AmuYTrC.exe
  2⤵
  PID:9980
- C:\Windows\System\pzGhxON.exe
  C:\Windows\System\pzGhxON.exe
  2⤵
  PID:10028
- C:\Windows\System\tqWwCyQ.exe
  C:\Windows\System\tqWwCyQ.exe
  2⤵
  PID:10064
- C:\Windows\System\FbhfLlm.exe
  C:\Windows\System\FbhfLlm.exe
  2⤵
  PID:10092
- C:\Windows\System\kBeOfEY.exe
  C:\Windows\System\kBeOfEY.exe
  2⤵
  PID:10128
- C:\Windows\System\dSkjdcN.exe
  C:\Windows\System\dSkjdcN.exe
  2⤵
  PID:10172
- C:\Windows\System\HsUHUnz.exe
  C:\Windows\System\HsUHUnz.exe
  2⤵
  PID:10212
- C:\Windows\System\ieTdjmJ.exe
  C:\Windows\System\ieTdjmJ.exe
  2⤵
  PID:10196
- C:\Windows\System\VrEzOiF.exe
  C:\Windows\System\VrEzOiF.exe
  2⤵
  PID:8452
- C:\Windows\System\CzEwIdg.exe
  C:\Windows\System\CzEwIdg.exe
  2⤵
  PID:9264
- C:\Windows\System\gIrkzSJ.exe
  C:\Windows\System\gIrkzSJ.exe
  2⤵
  PID:9332
- C:\Windows\System\NBbHpPU.exe
  C:\Windows\System\NBbHpPU.exe
  2⤵
  PID:9412
- C:\Windows\System\HeMOyEp.exe
  C:\Windows\System\HeMOyEp.exe
  2⤵
  PID:9448
- C:\Windows\System\HbMBJDd.exe
  C:\Windows\System\HbMBJDd.exe
  2⤵
  PID:9488
- C:\Windows\System\rwgtdLh.exe
  C:\Windows\System\rwgtdLh.exe
  2⤵
  PID:9596
- C:\Windows\System\VaHxrsC.exe
  C:\Windows\System\VaHxrsC.exe
  2⤵
  PID:9696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BYCallF.exe

Filesize
2.8MB

MD5
f737f288fefdd9353794c6d7b0b1e277

SHA1
b91ae48c41b5f4a410248f73314a4175fbb69f57

SHA256
5c6abc1495fb3f4f13eeb89ceebabf612c7204cb11c97cdb4b6b1ae993393dfa

SHA512
8617356ae262d93de53f99d2ef36929e6f0db93365b4ac7f22d93cca84937e6819419b9043beeaebeefb599f45f487757d97c0301a66f32e5b0cb77491bc48dd

Download Submit
C:\Windows\system\DRFGcoa.exe

Filesize
2.8MB

MD5
f1d6d7b30ee4cc31a107123728439e82

SHA1
78522f3e2f4f2cda427c879166efa3af48c1c0d8

SHA256
2d8532a0c084570362e37143cbc8af03d61bbe9db7841a4217236cae3a736b44

SHA512
6b5a5d09e3e0d97265c7feb962eb8f593a90db008e7b391129a5f7ad3cbddccc1a7d8eb2f532d4cdc47f1b5adffb3342023c3550853ce8e50ac5600dc14a0b7e

Download Submit
C:\Windows\system\DdsvbCm.exe

Filesize
2.8MB

MD5
3d9c66d6b9f13d8afee029bfd49aa234

SHA1
104e0364f1bbbf6b4bd3ab913a0069da25b42238

SHA256
b90010dba59fba5a251807fd2818558543644240d63dffe31b9e60b38e93bbb4

SHA512
fa30b35fab22febf572c8700b731d9f6231464ee02ca6e9425fb8985fc5179581801bd1495f50c8b86dace46ab6985481707c34a7e4b8aa595b01081e0f513f2

Download Submit
C:\Windows\system\FRkDHUf.exe

Filesize
2.8MB

MD5
47b17b7cb3a63afd08ca0d88c02e1802

SHA1
570ab9d93175713ca691f023974783b0285fab19

SHA256
5bea0ba4c40b656f30e61259920ebcf981c98280157342dd711ba89f72a3ef9d

SHA512
f5502ba44f62b10187d1d9891ee60368abd220ed94e7a18be2f2301d843e6b6ec377af596aee7e6748abc4e9b2a48b607673410349143a39ca9197c4d984260c

Download Submit
C:\Windows\system\GWMtNwP.exe

Filesize
2.8MB

MD5
249546845d3e8551104b6e815b14c154

SHA1
e3e78764ad036ff2199431f53220b628a3a32cb3

SHA256
a8e148aac36480689be6b87121cf7e808f50880110c65e23b69be4707dabee3f

SHA512
df7b65293cd102c72be1357011eda20d795e53b5f253c3d897fd5cb76d9c8ca503b9fe09cd61e6e4a46dd24a499cf9c89e4325689051aede927d9749e004381b

Download Submit
C:\Windows\system\GwVzxXk.exe

Filesize
2.8MB

MD5
2a34845af6f5e98984a476b70768d793

SHA1
cc8651b4a22cd590dab59052cfe966462a940905

SHA256
3d18a26c6cdb4d1527467e3e9c9c6274a777ca4de4f8cf45e1e8924ae588754a

SHA512
07ffb88c3711d6c97593f975783d73e09c28e8975cdb3db356da76b8a07d30d4d9be616947ecd6079296bf15fd326b21914c90c5bf52395ed488c23d9a0ad01e

Download Submit
C:\Windows\system\HkGgiVG.exe

Filesize
2.8MB

MD5
45cd97f67628aaeb46d517fee8649408

SHA1
6efc4021aebf3376bb9e94402ba5055a6706c989

SHA256
89e48fc291aed02f3234e59c0579e2be52f3e897f9037e57f72d7de63bd9ae75

SHA512
28f4913cdd36e260678ec724fc2cca5db6172e9e023293a7eb1b7e3eaa6bb240cd035f1d5f19edcc1aa9f7439250ece7ac7cfe9f6b937c20f5624668f445f254

Download Submit
C:\Windows\system\IAMXYNE.exe

Filesize
2.8MB

MD5
98413b4e8caa04753b675a3e5ef6703d

SHA1
829b9974f29c0e5dfc9ab8f52abe37968bc89f82

SHA256
bda79ab247766acbe111d0fbfca98e5ca296735cd3c5772a8c9afe180622d35c

SHA512
afb173e7ddcc090f7a99cdb16a1c66cd3cc39346dda79072fdcb87b7aaf80709cc70468f641e154acf96e7c24185d8479bb96a58c84204cd89b3e735faf3d9f4

Download Submit
C:\Windows\system\PtFSlzq.exe

Filesize
2.8MB

MD5
d4dc9f5407a277570dbfd81913411ce2

SHA1
336fe995cf997ffe674bb0739830141c40bc37ec

SHA256
84629c2029493a9a18ea70cbbd72ee337cadc55f5bd22bd1b3466165b7f01060

SHA512
2bf2b7cf7484ff3822dea6e90819fd411dc5281b5cdb54300228d37e37f19d4db1d1fae6f2385ded883c8a9db87f621ccff917dca634eba8156198343f5277e0

Download Submit
C:\Windows\system\TSNFcbm.exe

Filesize
2.8MB

MD5
5e0e92b283a7cab5725908437de723ab

SHA1
780dc4638dbe60b598e0941d9ae2fe1be19ab936

SHA256
cd8e257d0d90330601a94a163766208d2aca4674f4e9284f982bf4a1b25970e0

SHA512
10f6bec66b53decab5357b625e2de6678ccb655de4d35bc400cab8ca1b0edbbd53be62a695a65d9c077d70c1eca0006b41be9a2f9cc297cc8ed4c168adc53eab

Download Submit
C:\Windows\system\UeXygAh.exe

Filesize
2.8MB

MD5
0c126fdca381cf2e4ec51c9963100e3e

SHA1
4b95ea3dfb66bb61a961c9e3721ef6e86f62ecb7

SHA256
8674907da030cd019c838669b9814a990acd940bd70e8f0f4aed5d493fc6d963

SHA512
1de6f0a1c157b80b5e60b97d648046dc3d314840be86d8432e6670af782a133d50e97d016023b41d5cff4f9c1eae2bded7c925bce5ba6452804f8f0de146eba8

Download Submit
C:\Windows\system\VXlJeZk.exe

Filesize
2.8MB

MD5
cbe20a6b6eb44010220770144c90cb2d

SHA1
4047ab9cf7982239b7f1306d3b4c19ff0481f6a6

SHA256
e5601c86946a79a5abc9cc991d52d60c17983027b8f5cfdcc4e053ba60746318

SHA512
a7870a6cea7e09b6c59b35ecefe57e263d338ec19475b98a48dd474ce7863e602f6053b71574f2115f7fae6fc63d65534b71d2d024fd0fcdf0db5fba48737c4d

Download Submit
C:\Windows\system\WRDDswF.exe

Filesize
2.8MB

MD5
2f55d2f2744355cccc4e1b17e8f9c016

SHA1
38d2b2f0551126e5d1b4ecca288fc18b54338ec6

SHA256
bae55f91e83d3083ff8e1988b7ff04385b09dd8b48c418d4f9a4a0d85cf5ba49

SHA512
91dfefcabf86eb8f0ec70284230e48164f6aaa704b1d2928aa5eaaee575e24bbfdb36730928daa929db03fbf571c8c459123b4e7edf0205d82b30c9adb7e928a

Download Submit
C:\Windows\system\XsurDxH.exe

Filesize
2.8MB

MD5
445bde95bd08da7de9f8d0e61ef82165

SHA1
64f5dfc1e6b75f1de97d37b56e47f6d23a050fe0

SHA256
e9ea68b85c34a6b5dd04481509b463750b71004bd664213f74fb584e66c8f81a

SHA512
33bfe4a0fccbf3ccf1d0459bc4bd0b4850d3f42b553996acf84f63d8897c2fa42c04fd22c2b3a3d3d10be9e139d652c8ce543e36ba75e83e371f7d1dc6ce8227

Download Submit
C:\Windows\system\csMmaEw.exe

Filesize
2.8MB

MD5
5b38f10b498c65147aead20f8894c4d7

SHA1
4a699f3bbbd4db84aca818cafffd7978639d0aa7

SHA256
7e8a303c2153a4aaa7e4869ef70b83cd3bad473bf5429ff9729f4d5350c01504

SHA512
c50a20c5209a84268e400a1a0ee32f759cc3f046195d8d08d6e0b9f5c303cd67cf939f6fd34ab6a9dd89e87596ecabe6af811d62a309847a5dc110cc884c4fc8

Download Submit
C:\Windows\system\duiRLHX.exe

Filesize
2.8MB

MD5
08dc0d55cef336bde7a07a983509611c

SHA1
235f09597d2574e8dc59fdd6db331fa8bc6a174c

SHA256
377e0845b21e94deb0aed5fac18f664a550c879b32a29992a8624da2f497732d

SHA512
2732657084a4e6fd9105d0e3f29644840e6a93c164395cdad4afa69000fde1884a20aa2bf97b5c967f4e47ad5768b3e822fe11accd35aeb906e974f3b47fe8b8

Download Submit
C:\Windows\system\ffyoVKL.exe

Filesize
2.8MB

MD5
def51f962650ca0268c2b14e9502909b

SHA1
f3764703999ff9ce2673d963b44551e8a1192e96

SHA256
7517ea103db9c7001444af47d0ddc2825e3fb1e2523cf16efa3ba3a23dd636bc

SHA512
83865a9d8fb044a9da8f0faf41e6775372d687dc14c05c78d839b3eaf5dd416848453ecd9f5b5ee21b9e2fa69fffabd72412380d4d645fa04ee500adb85b0e40

Download Submit
C:\Windows\system\gdEUXPR.exe

Filesize
2.8MB

MD5
072deec4ff4472e205a3fd401610ec35

SHA1
970b64e5e7c380edbb387ab4940abb809f15e85d

SHA256
39996e05be82d4874d0efcf631d2d0b52e1072dd1e5f710995fc029716eb2d91

SHA512
f26a258b0e02599988361bfac218440a5737e725daa5f0eafcf4b471d5c72a3f885fd6eb47500f42820e92d195c80bef1f3e78e3350f3ee003ee28e34311c9b4

Download Submit
C:\Windows\system\hZwYvJp.exe

Filesize
2.8MB

MD5
c43708ef4a265255c34b13fb745aef04

SHA1
d1734facd0517f128a245e5bf40386d5c653a935

SHA256
cace147e5e31102e5c2e59bde298feede3f01356103e555872614acc54d8eae0

SHA512
552a5804c5146af49f5d1139fc90ccadb7703f07c1f131a316c596ecae9ebc310905f45f4bcb824f34a1e509efa9cfd3f5f01a0af4128983eb6f0c326d092b25

Download Submit
C:\Windows\system\hsjovCO.exe

Filesize
2.8MB

MD5
886d7fc29da4ebba138307432ceb37fe

SHA1
923daddf8f924fabd1396114a574e61417ec2228

SHA256
b13beefd3880337d86e4542cf58039aef8fcb148388959434413e2b477aeb602

SHA512
4e41f608e7a3a8a84a08d67f37e86d99d4e429ccf58a5e5aa8ab8e39c3c0428428493387517cf056c90d35aa993b495cacbbabfdbb93188cbc2941b57765bd87

Download Submit
C:\Windows\system\ojAYUbn.exe

Filesize
2.8MB

MD5
0b25f85498e1e341eed65a0152cc4104

SHA1
a043ceb5452fcbf7366df0a616385533324c030b

SHA256
65b51cc066339ad9bfbd409ae4bbb170c3dd35556b1c06b56dedf3d99d2a5cdb

SHA512
52eeb3fe1eb56814a869356630c63009b9085439d5c6203ff1513e47937aefe061f0e2337964ed192d663c9660bfd3bc8e02a4e37612262c1ce1ab86ab5e8b8a

Download Submit
C:\Windows\system\oqipQWU.exe

Filesize
2.8MB

MD5
e0fb6edbbb721b78a3b1281bb9efba07

SHA1
205a17286cd9e032b56ee30130767741a0019cf2

SHA256
24b48b0d2f7a02c37fbe1e5463df6d777c459a2920c1006d775d705d63e95fb7

SHA512
1d6ba10f63406429a5d65b764e79ab14d7ca7b32911da6949b2747c4c02f4f7b5780b99db87e17579fa436c979557d2a433cab7c5162b5275da5556a1bdf9e02

Download Submit
C:\Windows\system\rEFjOXU.exe

Filesize
2.8MB

MD5
676d608b8bca31c7606b57c45cd4aaa6

SHA1
93142e62ecc52a1b10986f72a4d8722de8e36e4b

SHA256
3e6e3eba7455157a213dda47811f3e68973dcb47066cdbeb4cb495a7f8e12f3d

SHA512
30c82fb0ae37756cdfa22bc7bfdf2c778b5fd8578731473f28d8c41babd2b730e8f82b24c772d2fcf24acacf36ada3f0bfe94e9fb77795269c1d20bf34b4a731

Download Submit
C:\Windows\system\uuassxv.exe

Filesize
2.8MB

MD5
8a183139ddf072e87c28da1c632b31e6

SHA1
cc7763519a17edee1b78dd0ceb26e5605fab0539

SHA256
7275d55672379a71cb1c426ad7ec58b549665ef93b1487a557e2be67952cbbd9

SHA512
8b22f7142964071ba5e4f9fd043937ef09f149872fae6d89c666719fbdf0c408b4370319a433fd3baece47b77e7a4bbb32b039abe08d49467699234d6ec573df

Download Submit
C:\Windows\system\vJHGRFo.exe

Filesize
2.8MB

MD5
71b88013f0222a78ffc8fa34500b1340

SHA1
b940a41578405e6215493828c92b605642bfe2c3

SHA256
052ec63508f0a8a82bdd7c4c2f42fef816bd88d63d87a5e4b46d14e4a64f73ac

SHA512
eabe2871cc4503280f3bcbc3ea860639803c73249e876b8a34269f13703a3b53c461c0babdbc0b1b4802d7f843bd5dc68d69d10ecd21c17b629d6fbc3c6f0a58

Download Submit
C:\Windows\system\vUdGZzw.exe

Filesize
2.8MB

MD5
345b0b1f35fa8edb2e12be8f0c5a10bb

SHA1
c2da4a4fa8f4ee845e4942cc9eb5df04122e2cc2

SHA256
bf77caf987049a984718b9c3680361f4a04910ae8961388696d813d4b13707d2

SHA512
7739521ff3a330ff5d270712f60a2361608858d4c1080e5883573c89a97095899bfe183fadce19b06e316087407cbbca9ac33fdbeb6a01cb721a93e45f74755f

Download Submit
C:\Windows\system\vxMVGum.exe

Filesize
2.8MB

MD5
e285fabf30b476b66c2732bbb3496001

SHA1
94395fd1fadee6f94fe9547f8cd473c0ddaaf253

SHA256
a8b50f30220d07ce753d06f55339070dbe6a6a6a2687c4be180fb374a8a4fe20

SHA512
9a7b492b5fc3ea5a7d9f8ac18e15c56b6cc251c4ea49351c4dfcd585357c8a1687214986138435aef50940b4455556902730db26f9b69928270cebebb7a2187c

Download Submit
C:\Windows\system\wHzYcDU.exe

Filesize
2.8MB

MD5
4dbe68ae6bfe86ba38963885d5d9e9b2

SHA1
5dbccb1ef3f520f0dec3186d6a9efeeb4f9ebad1

SHA256
e9fb28aa3dbd9f0a5bdf8450013957d7e9ca9a9148281250083c07db26e4cfa8

SHA512
ad4c3aaaea0a79551a69c4caed73bb3c8238b26403d778e7315f22c69fe9b77f21530ba63626a773d43dca8be06a24f412dface15e3b67d95d34605fef8b6a78

Download Submit
C:\Windows\system\wvkbhtg.exe

Filesize
2.8MB

MD5
f264bbe8bc3d41376d412a4a2f3eb2d2

SHA1
4469f6b6d435c2431f66b2ad9a771e55dd46ffd8

SHA256
0c5fbb2d7e2d8ccb06ba51c3ff609997877d44c51f18c1df2eca16933e60e986

SHA512
acea6708abe4d7d59c28513ac1f7ab74ad286b379bb1de6f2e50657fd4603652ee63cc98fc4c6288795c11e119441967f3a3f69a52f39be287eb52ca59b07a4a

Download Submit
\Windows\system\CyuGlNu.exe

Filesize
2.8MB

MD5
80c8d22a0f2d67cb2df0fcde3aa5c508

SHA1
bbd7101ad22fb245ab7c8e2aa54beae84f991962

SHA256
2d862ebf26c97d155fff3b2fbc9a31b55c287cdeab96afb91437af61678374ca

SHA512
e48f6ba35aeb99a2e2db0d5d4d7a5e66bc66f048441877bba3a56d4f65e0df959572808b9e4517e9282d37f891d1f73791a9bdc026e649b3666a2c188fcffb11

Download Submit
\Windows\system\UwaIQSH.exe

Filesize
2.8MB

MD5
2a47ebb55f3ef91455469eb2037eacff

SHA1
017da584e77ae7f6c883736394abb7874af8a540

SHA256
3123e1f6ec2cc5fcba63554495855e21ce0619bcaa0f17dbe38e66462594840a

SHA512
a84fa202c4c73c7b7753dd24ec4638b78dc2b4de21510ed518ea85e4694f7c498ff7119986250bcbfe36c1fa375802e4a5b289cc836e377aef67932866bed752

Download Submit
\Windows\system\mFsVhtr.exe

Filesize
2.8MB

MD5
6fef582194439dc659b61ceab018e95a

SHA1
398bd87bf0534be4fb8bc9c08f4a231147f43b1d

SHA256
49f40df6b31171ca879b58cda55bf1d2659754ae294852b1fc98575006a7f36d

SHA512
9ded168770804f377cd4111fe1b6265469d0885af653eb03e8f0f7a705b317c2176b2ccada7761659555ff881d4a06e12f4e3e2af87d7f38a4d901012606a8f1

Download Submit
memory/1572-4331-0x000000013F700000-0x000000013FAF6000-memory.dmp

Filesize
4.0MB

Download
memory/1572-173-0x000000013F700000-0x000000013FAF6000-memory.dmp

Filesize
4.0MB

Download
memory/2116-183-0x000000013F0E0000-0x000000013F4D6000-memory.dmp

Filesize
4.0MB

Download
memory/2116-4334-0x000000013F0E0000-0x000000013F4D6000-memory.dmp

Filesize
4.0MB

Download
memory/2120-2166-0x0000000003850000-0x0000000003C46000-memory.dmp

Filesize
4.0MB

Download
memory/2120-182-0x0000000003850000-0x0000000003C46000-memory.dmp

Filesize
4.0MB

Download
memory/2120-2242-0x0000000003850000-0x0000000003C46000-memory.dmp

Filesize
4.0MB

Download
memory/2120-2247-0x0000000003850000-0x0000000003C46000-memory.dmp

Filesize
4.0MB

Download
memory/2120-2229-0x0000000003850000-0x0000000003C46000-memory.dmp

Filesize
4.0MB

Download
memory/2120-167-0x000000013F800000-0x000000013FBF6000-memory.dmp

Filesize
4.0MB

Download
memory/2120-2139-0x0000000003850000-0x0000000003C46000-memory.dmp

Filesize
4.0MB

Download
memory/2120-172-0x000000013F700000-0x000000013FAF6000-memory.dmp

Filesize
4.0MB

Download
memory/2120-2152-0x0000000003850000-0x0000000003C46000-memory.dmp

Filesize
4.0MB

Download
memory/2120-184-0x000000013FBF0000-0x000000013FFE6000-memory.dmp

Filesize
4.0MB

Download
memory/2120-155-0x000000013FD70000-0x0000000140166000-memory.dmp

Filesize
4.0MB

Download
memory/2120-1887-0x000000013F890000-0x000000013FC86000-memory.dmp

Filesize
4.0MB

Download
memory/2120-148-0x0000000003850000-0x0000000003C46000-memory.dmp

Filesize
4.0MB

Download
memory/2120-1878-0x000000013F2C0000-0x000000013F6B6000-memory.dmp

Filesize
4.0MB

Download
memory/2120-174-0x000000013FD60000-0x0000000140156000-memory.dmp

Filesize
4.0MB

Download
memory/2120-170-0x0000000003850000-0x0000000003C46000-memory.dmp

Filesize
4.0MB

Download
memory/2120-1-0x0000000000180000-0x0000000000190000-memory.dmp

Filesize
64KB

Download
memory/2120-12-0x000000013F890000-0x000000013FC86000-memory.dmp

Filesize
4.0MB

Download
memory/2120-0-0x000000013F2C0000-0x000000013F6B6000-memory.dmp

Filesize
4.0MB

Download
memory/2120-100-0x0000000003850000-0x0000000003C46000-memory.dmp

Filesize
4.0MB

Download
memory/2120-180-0x0000000003850000-0x0000000003C46000-memory.dmp

Filesize
4.0MB

Download
memory/2120-162-0x0000000003850000-0x0000000003C46000-memory.dmp

Filesize
4.0MB

Download
memory/2256-4330-0x000000013F800000-0x000000013FBF6000-memory.dmp

Filesize
4.0MB

Download
memory/2256-169-0x000000013F800000-0x000000013FBF6000-memory.dmp

Filesize
4.0MB

Download
memory/2360-4333-0x000000013F520000-0x000000013F916000-memory.dmp

Filesize
4.0MB

Download
memory/2360-171-0x000000013F520000-0x000000013F916000-memory.dmp

Filesize
4.0MB

Download
memory/2424-4332-0x000000013F4A0000-0x000000013F896000-memory.dmp

Filesize
4.0MB

Download
memory/2424-181-0x000000013F4A0000-0x000000013F896000-memory.dmp

Filesize
4.0MB

Download
memory/2440-4335-0x000000013FD60000-0x0000000140156000-memory.dmp

Filesize
4.0MB

Download
memory/2440-179-0x000000013FD60000-0x0000000140156000-memory.dmp

Filesize
4.0MB

Download
memory/2612-166-0x000000013F2A0000-0x000000013F696000-memory.dmp

Filesize
4.0MB

Download
memory/2612-4329-0x000000013F2A0000-0x000000013F696000-memory.dmp

Filesize
4.0MB

Download
memory/2628-4328-0x000000013F1A0000-0x000000013F596000-memory.dmp

Filesize
4.0MB

Download
memory/2628-154-0x000000013F1A0000-0x000000013F596000-memory.dmp

Filesize
4.0MB

Download
memory/2728-66-0x000000001B4B0000-0x000000001B792000-memory.dmp

Filesize
2.9MB

Download
memory/2728-98-0x000007FEF68A0000-0x000007FEF723D000-memory.dmp

Filesize
9.6MB

Download
memory/2728-159-0x000007FEF68A0000-0x000007FEF723D000-memory.dmp

Filesize
9.6MB

Download
memory/2728-15-0x000007FEF6B5E000-0x000007FEF6B5F000-memory.dmp

Filesize
4KB

Download
memory/2728-14-0x0000000002D60000-0x0000000002DE0000-memory.dmp

Filesize
512KB

Download
memory/2728-69-0x00000000020C0000-0x00000000020C8000-memory.dmp

Filesize
32KB

Download
memory/2728-158-0x0000000002D64000-0x0000000002D67000-memory.dmp

Filesize
12KB

Download
memory/2784-161-0x000000013FD70000-0x0000000140166000-memory.dmp

Filesize
4.0MB

Download
memory/2784-4327-0x000000013FD70000-0x0000000140166000-memory.dmp

Filesize
4.0MB

Download
memory/2808-4325-0x000000013FBF0000-0x000000013FFE6000-memory.dmp

Filesize
4.0MB

Download
memory/2808-99-0x000000013FBF0000-0x000000013FFE6000-memory.dmp

Filesize
4.0MB

Download
memory/2860-4324-0x000000013F890000-0x000000013FC86000-memory.dmp

Filesize
4.0MB

Download
memory/2860-13-0x000000013F890000-0x000000013FC86000-memory.dmp

Filesize
4.0MB

Download
memory/2972-4326-0x000000013F350000-0x000000013F746000-memory.dmp

Filesize
4.0MB

Download
memory/2972-147-0x000000013F350000-0x000000013F746000-memory.dmp

Filesize
4.0MB

Download