xmrig | 10d0a051b26fdd3661e1e1e241887b6dfbf47041bea56370c811f5138defa04c

Analysis

max time kernel
115s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 00:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
Size

1.8MB
MD5

2b78ed0cd094da5e1ae027c4ea6f9f30
SHA1

e43e5268ffd33a3c67844e1cc0482bf03a7704b8
SHA256

10d0a051b26fdd3661e1e1e241887b6dfbf47041bea56370c811f5138defa04c
SHA512

413296283566471247d1a21da0a251060b13b5fc398bead90c8386e73ce3d43099aa6c2357ccf99b90cc00a087d73249b5a005469172c364232ce3967b173c98
SSDEEP

49152:Lz071uv4BPMkHC0IlnASEx/RiNcT1DmbmHq:NABc

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 35 IoCs

miner

resource	yara_rule
behavioral1/memory/2088-9-0x000000013F750000-0x000000013FB42000-memory.dmp	xmrig
behavioral1/memory/1948-155-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	xmrig
behavioral1/memory/2884-153-0x000000013F640000-0x000000013FA32000-memory.dmp	xmrig
behavioral1/memory/2256-151-0x000000013F120000-0x000000013F512000-memory.dmp	xmrig
behavioral1/memory/2796-149-0x000000013F830000-0x000000013FC22000-memory.dmp	xmrig
behavioral1/memory/2692-147-0x000000013FA70000-0x000000013FE62000-memory.dmp	xmrig
behavioral1/memory/2976-145-0x000000013F820000-0x000000013FC12000-memory.dmp	xmrig
behavioral1/memory/2812-143-0x000000013F980000-0x000000013FD72000-memory.dmp	xmrig
behavioral1/memory/2852-141-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	xmrig
behavioral1/memory/2924-139-0x000000013F670000-0x000000013FA62000-memory.dmp	xmrig
behavioral1/memory/2372-136-0x000000013F290000-0x000000013F682000-memory.dmp	xmrig
behavioral1/memory/2192-291-0x000000013F760000-0x000000013FB52000-memory.dmp	xmrig
behavioral1/memory/2376-290-0x000000013F570000-0x000000013F962000-memory.dmp	xmrig
behavioral1/memory/3044-289-0x000000013F630000-0x000000013FA22000-memory.dmp	xmrig
behavioral1/memory/1676-288-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	xmrig
behavioral1/memory/1980-287-0x000000013FBE0000-0x000000013FFD2000-memory.dmp	xmrig
behavioral1/memory/1932-286-0x000000013F950000-0x000000013FD42000-memory.dmp	xmrig
behavioral1/memory/2344-285-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	xmrig
behavioral1/memory/1480-284-0x000000013F510000-0x000000013F902000-memory.dmp	xmrig
behavioral1/memory/1660-273-0x000000013F780000-0x000000013FB72000-memory.dmp	xmrig
behavioral1/memory/2088-272-0x000000013F750000-0x000000013FB42000-memory.dmp	xmrig
behavioral1/memory/1496-271-0x000000013F890000-0x000000013FC82000-memory.dmp	xmrig
behavioral1/memory/1948-3389-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	xmrig
behavioral1/memory/2256-3390-0x000000013F120000-0x000000013F512000-memory.dmp	xmrig
behavioral1/memory/2884-3391-0x000000013F640000-0x000000013FA32000-memory.dmp	xmrig
behavioral1/memory/2692-3402-0x000000013FA70000-0x000000013FE62000-memory.dmp	xmrig
behavioral1/memory/2924-3400-0x000000013F670000-0x000000013FA62000-memory.dmp	xmrig
behavioral1/memory/2812-3399-0x000000013F980000-0x000000013FD72000-memory.dmp	xmrig
behavioral1/memory/2796-3398-0x000000013F830000-0x000000013FC22000-memory.dmp	xmrig
behavioral1/memory/2976-3397-0x000000013F820000-0x000000013FC12000-memory.dmp	xmrig
behavioral1/memory/2088-3395-0x000000013F750000-0x000000013FB42000-memory.dmp	xmrig
behavioral1/memory/2852-3394-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	xmrig
behavioral1/memory/2372-3393-0x000000013F290000-0x000000013F682000-memory.dmp	xmrig
behavioral1/memory/1660-3405-0x000000013F780000-0x000000013FB72000-memory.dmp	xmrig
behavioral1/memory/1496-8385-0x000000013F890000-0x000000013FC82000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2916	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2088	ydcNQGq.exe
1660	UwbGeAk.exe
2372	RbZsWyh.exe
2924	daWiKci.exe
2852	oUizjmF.exe
2812	iIYHDmB.exe
2976	fKUiaaD.exe
2692	XOGeSHR.exe
2796	aDdKEzb.exe
2256	InIWzaG.exe
2884	dlmLJRo.exe
1948	hVtYjGv.exe
1480	YIIUzsk.exe
2344	tXELKRh.exe
1932	aDdaWhE.exe
1980	nQMMXZm.exe
1676	qPpjjEA.exe
3044	xFkPtgE.exe
2376	vRkJKBy.exe
2192	mvTGCwx.exe
2280	hcOUEpf.exe
1692	hFBADba.exe
2876	nzTLhKS.exe
2424	JkrGDvC.exe
884	zxFDOEo.exe
1052	JjJkHhz.exe
1160	mcrJWCO.exe
2452	rLUIOPL.exe
1552	ZwxkAkD.exe
2908	aErxzRJ.exe
1940	vWWGxuV.exe
1632	xLuuwcH.exe
1752	GWjMAvs.exe
1936	gSFuQzf.exe
812	BumGXEC.exe
272	rhCkfIt.exe
2624	sHUYTrQ.exe
436	yxdbwLx.exe
1720	OjonqQG.exe
1096	WmwqewQ.exe
2496	LLLrgwG.exe
1744	CVmansM.exe
2760	ahGUKEL.exe
900	VpXkZEd.exe
2236	MmHksDn.exe
380	SUkWIYF.exe
2768	YkmrRJV.exe
1716	JDyRUYq.exe
1612	hRyPuhZ.exe
2952	gOAlgdW.exe
580	SIMaWKA.exe
1080	dxRbzAT.exe
2212	IwVfJdd.exe
2680	cLyMbHt.exe
2728	urAsEGb.exe
2748	nrfEpdn.exe
2732	vTvqEVU.exe
2244	UdPTkhO.exe
2336	RsmmMHH.exe
2332	tkdGqAV.exe
644	YteSogF.exe
1920	edQcQOw.exe
3000	ehfhnFM.exe
2712	lGCCvia.exe

Loads dropped DLL 64 IoCs

pid	Process
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1496-0-0x000000013F890000-0x000000013FC82000-memory.dmp	upx
behavioral1/files/0x00080000000120f9-3.dat	upx
behavioral1/memory/2088-9-0x000000013F750000-0x000000013FB42000-memory.dmp	upx
behavioral1/files/0x000800000001659d-29.dat	upx
behavioral1/files/0x00080000000167b4-34.dat	upx
behavioral1/files/0x0007000000016a93-38.dat	upx
behavioral1/files/0x0007000000016c51-49.dat	upx
behavioral1/files/0x00050000000193c5-63.dat	upx
behavioral1/files/0x000500000001940b-78.dat	upx
behavioral1/files/0x0005000000019427-83.dat	upx
behavioral1/files/0x0005000000019452-88.dat	upx
behavioral1/files/0x0005000000019585-110.dat	upx
behavioral1/files/0x0005000000019609-127.dat	upx
behavioral1/files/0x000500000001960b-157.dat	upx
behavioral1/memory/1948-155-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/memory/2884-153-0x000000013F640000-0x000000013FA32000-memory.dmp	upx
behavioral1/memory/2256-151-0x000000013F120000-0x000000013F512000-memory.dmp	upx
behavioral1/memory/2796-149-0x000000013F830000-0x000000013FC22000-memory.dmp	upx
behavioral1/memory/2692-147-0x000000013FA70000-0x000000013FE62000-memory.dmp	upx
behavioral1/memory/2976-145-0x000000013F820000-0x000000013FC12000-memory.dmp	upx
behavioral1/memory/2812-143-0x000000013F980000-0x000000013FD72000-memory.dmp	upx
behavioral1/memory/2852-141-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	upx
behavioral1/memory/2924-139-0x000000013F670000-0x000000013FA62000-memory.dmp	upx
behavioral1/memory/2372-136-0x000000013F290000-0x000000013F682000-memory.dmp	upx
behavioral1/files/0x0037000000015fd2-132.dat	upx
behavioral1/files/0x0005000000019607-121.dat	upx
behavioral1/files/0x00050000000195d8-115.dat	upx
behavioral1/files/0x00050000000194f7-98.dat	upx
behavioral1/files/0x000500000001950b-103.dat	upx
behavioral1/files/0x000500000001945a-93.dat	upx
behavioral1/files/0x0005000000019409-74.dat	upx
behavioral1/files/0x00050000000193df-68.dat	upx
behavioral1/files/0x00050000000193bb-58.dat	upx
behavioral1/files/0x0009000000016c5a-53.dat	upx
behavioral1/files/0x0007000000016c49-44.dat	upx
behavioral1/memory/1660-19-0x000000013F780000-0x000000013FB72000-memory.dmp	upx
behavioral1/files/0x000f00000000549c-16.dat	upx
behavioral1/files/0x0009000000016433-17.dat	upx
behavioral1/files/0x000500000001960d-164.dat	upx
behavioral1/files/0x000500000001960f-167.dat	upx
behavioral1/files/0x0005000000019613-171.dat	upx
behavioral1/files/0x0005000000019615-175.dat	upx
behavioral1/files/0x000500000001961b-183.dat	upx
behavioral1/files/0x000500000001961d-188.dat	upx
behavioral1/files/0x0005000000019619-180.dat	upx
behavioral1/memory/2192-291-0x000000013F760000-0x000000013FB52000-memory.dmp	upx
behavioral1/memory/2376-290-0x000000013F570000-0x000000013F962000-memory.dmp	upx
behavioral1/memory/3044-289-0x000000013F630000-0x000000013FA22000-memory.dmp	upx
behavioral1/memory/1676-288-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	upx
behavioral1/memory/1980-287-0x000000013FBE0000-0x000000013FFD2000-memory.dmp	upx
behavioral1/memory/1932-286-0x000000013F950000-0x000000013FD42000-memory.dmp	upx
behavioral1/memory/2344-285-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	upx
behavioral1/memory/1480-284-0x000000013F510000-0x000000013F902000-memory.dmp	upx
behavioral1/memory/1660-273-0x000000013F780000-0x000000013FB72000-memory.dmp	upx
behavioral1/memory/2088-272-0x000000013F750000-0x000000013FB42000-memory.dmp	upx
behavioral1/memory/1496-271-0x000000013F890000-0x000000013FC82000-memory.dmp	upx
behavioral1/memory/1948-3389-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/memory/2256-3390-0x000000013F120000-0x000000013F512000-memory.dmp	upx
behavioral1/memory/2884-3391-0x000000013F640000-0x000000013FA32000-memory.dmp	upx
behavioral1/memory/2692-3402-0x000000013FA70000-0x000000013FE62000-memory.dmp	upx
behavioral1/memory/2924-3400-0x000000013F670000-0x000000013FA62000-memory.dmp	upx
behavioral1/memory/2812-3399-0x000000013F980000-0x000000013FD72000-memory.dmp	upx
behavioral1/memory/2796-3398-0x000000013F830000-0x000000013FC22000-memory.dmp	upx
behavioral1/memory/2976-3397-0x000000013F820000-0x000000013FC12000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\PIjVBKb.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\zPDlFyn.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\iVpJrMA.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\JPyLkJv.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\OQyflRI.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\wPWOWWy.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\QKjrByP.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\mLRKAoJ.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\VSgExGU.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\KdkaBGb.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\EdInaOb.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\wcvaUnx.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\ecdMAYr.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\dSeQzco.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\HoiIvQi.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\pzcdPbX.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\VdIdcBE.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\vQaxnfE.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\RntPAIq.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\pFKcFoC.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\ZutXzvl.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\GBLYcfc.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\goArmxd.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\pQOPMGK.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\GHOdVLd.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\upIMToT.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\LycHxzL.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\zednXnw.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\bIZrBnW.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\guMJORK.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\RnLfQvt.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\xktXAda.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\DzAbNjn.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\iRpzoVY.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\oueFAYi.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\CACyddL.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\vHGxmna.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\xCaflXk.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\xigeXAp.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\YqhVHxH.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\rgJmgEr.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\uDZNdpC.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\QVBgMjN.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\arGdNlu.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\MynIRZi.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\VgLaLCd.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\JTXVlPn.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\mcYQEdy.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\eAyZQtM.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\XcrCOCH.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\vaDpQTc.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\fhKMomV.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\oEjlXqa.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\UcUylWA.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\rWzaWhq.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\oCkNeVM.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\WGjkGNA.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\EDwjznG.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\HABMUmK.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\vZFqXVC.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\flFwAKU.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\DTKdjwi.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\vwKIiCg.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
File created	C:\Windows\System\WAxIfUQ.exe	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2916	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
Token: SeDebugPrivilege	2916	powershell.exe
Token: SeLockMemoryPrivilege	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 2916	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	31
PID 1496 wrote to memory of 2916	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	31
PID 1496 wrote to memory of 2916	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	31
PID 1496 wrote to memory of 2088	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	32
PID 1496 wrote to memory of 2088	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	32
PID 1496 wrote to memory of 2088	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	32
PID 1496 wrote to memory of 1660	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	33
PID 1496 wrote to memory of 1660	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	33
PID 1496 wrote to memory of 1660	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	33
PID 1496 wrote to memory of 2372	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	34
PID 1496 wrote to memory of 2372	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	34
PID 1496 wrote to memory of 2372	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	34
PID 1496 wrote to memory of 2924	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	35
PID 1496 wrote to memory of 2924	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	35
PID 1496 wrote to memory of 2924	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	35
PID 1496 wrote to memory of 2852	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	36
PID 1496 wrote to memory of 2852	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	36
PID 1496 wrote to memory of 2852	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	36
PID 1496 wrote to memory of 2812	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	37
PID 1496 wrote to memory of 2812	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	37
PID 1496 wrote to memory of 2812	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	37
PID 1496 wrote to memory of 2976	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	38
PID 1496 wrote to memory of 2976	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	38
PID 1496 wrote to memory of 2976	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	38
PID 1496 wrote to memory of 2692	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	39
PID 1496 wrote to memory of 2692	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	39
PID 1496 wrote to memory of 2692	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	39
PID 1496 wrote to memory of 2796	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	40
PID 1496 wrote to memory of 2796	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	40
PID 1496 wrote to memory of 2796	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	40
PID 1496 wrote to memory of 2256	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	41
PID 1496 wrote to memory of 2256	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	41
PID 1496 wrote to memory of 2256	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	41
PID 1496 wrote to memory of 2884	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	42
PID 1496 wrote to memory of 2884	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	42
PID 1496 wrote to memory of 2884	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	42
PID 1496 wrote to memory of 1948	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	43
PID 1496 wrote to memory of 1948	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	43
PID 1496 wrote to memory of 1948	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	43
PID 1496 wrote to memory of 1480	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	44
PID 1496 wrote to memory of 1480	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	44
PID 1496 wrote to memory of 1480	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	44
PID 1496 wrote to memory of 2344	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	45
PID 1496 wrote to memory of 2344	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	45
PID 1496 wrote to memory of 2344	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	45
PID 1496 wrote to memory of 1932	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	46
PID 1496 wrote to memory of 1932	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	46
PID 1496 wrote to memory of 1932	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	46
PID 1496 wrote to memory of 1980	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	47
PID 1496 wrote to memory of 1980	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	47
PID 1496 wrote to memory of 1980	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	47
PID 1496 wrote to memory of 1676	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	48
PID 1496 wrote to memory of 1676	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	48
PID 1496 wrote to memory of 1676	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	48
PID 1496 wrote to memory of 3044	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	49
PID 1496 wrote to memory of 3044	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	49
PID 1496 wrote to memory of 3044	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	49
PID 1496 wrote to memory of 2376	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	50
PID 1496 wrote to memory of 2376	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	50
PID 1496 wrote to memory of 2376	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	50
PID 1496 wrote to memory of 2192	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	51
PID 1496 wrote to memory of 2192	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	51
PID 1496 wrote to memory of 2192	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	51
PID 1496 wrote to memory of 2280	1496	2b78ed0cd094da5e1ae027c4ea6f9f30N.exe	52

C:\Users\Admin\AppData\Local\Temp\2b78ed0cd094da5e1ae027c4ea6f9f30N.exe
"C:\Users\Admin\AppData\Local\Temp\2b78ed0cd094da5e1ae027c4ea6f9f30N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2916
- C:\Windows\System\ydcNQGq.exe
  C:\Windows\System\ydcNQGq.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\UwbGeAk.exe
  C:\Windows\System\UwbGeAk.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\RbZsWyh.exe
  C:\Windows\System\RbZsWyh.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\daWiKci.exe
  C:\Windows\System\daWiKci.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\oUizjmF.exe
  C:\Windows\System\oUizjmF.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\iIYHDmB.exe
  C:\Windows\System\iIYHDmB.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\fKUiaaD.exe
  C:\Windows\System\fKUiaaD.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\XOGeSHR.exe
  C:\Windows\System\XOGeSHR.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\aDdKEzb.exe
  C:\Windows\System\aDdKEzb.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\InIWzaG.exe
  C:\Windows\System\InIWzaG.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\dlmLJRo.exe
  C:\Windows\System\dlmLJRo.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\hVtYjGv.exe
  C:\Windows\System\hVtYjGv.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\YIIUzsk.exe
  C:\Windows\System\YIIUzsk.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\tXELKRh.exe
  C:\Windows\System\tXELKRh.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\aDdaWhE.exe
  C:\Windows\System\aDdaWhE.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\nQMMXZm.exe
  C:\Windows\System\nQMMXZm.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\qPpjjEA.exe
  C:\Windows\System\qPpjjEA.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\xFkPtgE.exe
  C:\Windows\System\xFkPtgE.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\vRkJKBy.exe
  C:\Windows\System\vRkJKBy.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\mvTGCwx.exe
  C:\Windows\System\mvTGCwx.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\hcOUEpf.exe
  C:\Windows\System\hcOUEpf.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\hFBADba.exe
  C:\Windows\System\hFBADba.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\nzTLhKS.exe
  C:\Windows\System\nzTLhKS.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\JkrGDvC.exe
  C:\Windows\System\JkrGDvC.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\zxFDOEo.exe
  C:\Windows\System\zxFDOEo.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\JjJkHhz.exe
  C:\Windows\System\JjJkHhz.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\mcrJWCO.exe
  C:\Windows\System\mcrJWCO.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\rLUIOPL.exe
  C:\Windows\System\rLUIOPL.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\ZwxkAkD.exe
  C:\Windows\System\ZwxkAkD.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\aErxzRJ.exe
  C:\Windows\System\aErxzRJ.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\vWWGxuV.exe
  C:\Windows\System\vWWGxuV.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\xLuuwcH.exe
  C:\Windows\System\xLuuwcH.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\GWjMAvs.exe
  C:\Windows\System\GWjMAvs.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\gSFuQzf.exe
  C:\Windows\System\gSFuQzf.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\BumGXEC.exe
  C:\Windows\System\BumGXEC.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\rhCkfIt.exe
  C:\Windows\System\rhCkfIt.exe
  2⤵
  - Executes dropped EXE
  PID:272
- C:\Windows\System\sHUYTrQ.exe
  C:\Windows\System\sHUYTrQ.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\yxdbwLx.exe
  C:\Windows\System\yxdbwLx.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\OjonqQG.exe
  C:\Windows\System\OjonqQG.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\WmwqewQ.exe
  C:\Windows\System\WmwqewQ.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\LLLrgwG.exe
  C:\Windows\System\LLLrgwG.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\CVmansM.exe
  C:\Windows\System\CVmansM.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\ahGUKEL.exe
  C:\Windows\System\ahGUKEL.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\VpXkZEd.exe
  C:\Windows\System\VpXkZEd.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\MmHksDn.exe
  C:\Windows\System\MmHksDn.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\SUkWIYF.exe
  C:\Windows\System\SUkWIYF.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\YkmrRJV.exe
  C:\Windows\System\YkmrRJV.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\JDyRUYq.exe
  C:\Windows\System\JDyRUYq.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\hRyPuhZ.exe
  C:\Windows\System\hRyPuhZ.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\gOAlgdW.exe
  C:\Windows\System\gOAlgdW.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\SIMaWKA.exe
  C:\Windows\System\SIMaWKA.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\dxRbzAT.exe
  C:\Windows\System\dxRbzAT.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\IwVfJdd.exe
  C:\Windows\System\IwVfJdd.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\cLyMbHt.exe
  C:\Windows\System\cLyMbHt.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\urAsEGb.exe
  C:\Windows\System\urAsEGb.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\nrfEpdn.exe
  C:\Windows\System\nrfEpdn.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\vTvqEVU.exe
  C:\Windows\System\vTvqEVU.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\UdPTkhO.exe
  C:\Windows\System\UdPTkhO.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\RsmmMHH.exe
  C:\Windows\System\RsmmMHH.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\tkdGqAV.exe
  C:\Windows\System\tkdGqAV.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\YteSogF.exe
  C:\Windows\System\YteSogF.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\edQcQOw.exe
  C:\Windows\System\edQcQOw.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\ehfhnFM.exe
  C:\Windows\System\ehfhnFM.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\lGCCvia.exe
  C:\Windows\System\lGCCvia.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\NGNnyAs.exe
  C:\Windows\System\NGNnyAs.exe
  2⤵
  PID:2784
- C:\Windows\System\LwDUiyx.exe
  C:\Windows\System\LwDUiyx.exe
  2⤵
  PID:2888
- C:\Windows\System\LUrYtOo.exe
  C:\Windows\System\LUrYtOo.exe
  2⤵
  PID:2896
- C:\Windows\System\xvhzqfG.exe
  C:\Windows\System\xvhzqfG.exe
  2⤵
  PID:744
- C:\Windows\System\usisyMF.exe
  C:\Windows\System\usisyMF.exe
  2⤵
  PID:2964
- C:\Windows\System\ddoOXgn.exe
  C:\Windows\System\ddoOXgn.exe
  2⤵
  PID:2128
- C:\Windows\System\QdhHXQE.exe
  C:\Windows\System\QdhHXQE.exe
  2⤵
  PID:2040
- C:\Windows\System\GLZIxjf.exe
  C:\Windows\System\GLZIxjf.exe
  2⤵
  PID:2360
- C:\Windows\System\qTeGhqX.exe
  C:\Windows\System\qTeGhqX.exe
  2⤵
  PID:2268
- C:\Windows\System\HUBNeIx.exe
  C:\Windows\System\HUBNeIx.exe
  2⤵
  PID:1100
- C:\Windows\System\mgVizCt.exe
  C:\Windows\System\mgVizCt.exe
  2⤵
  PID:1012
- C:\Windows\System\hXmgNsb.exe
  C:\Windows\System\hXmgNsb.exe
  2⤵
  PID:1704
- C:\Windows\System\UObKbxN.exe
  C:\Windows\System\UObKbxN.exe
  2⤵
  PID:1348
- C:\Windows\System\fazKVzj.exe
  C:\Windows\System\fazKVzj.exe
  2⤵
  PID:592
- C:\Windows\System\ZTzXtew.exe
  C:\Windows\System\ZTzXtew.exe
  2⤵
  PID:560
- C:\Windows\System\XiawOcL.exe
  C:\Windows\System\XiawOcL.exe
  2⤵
  PID:1524
- C:\Windows\System\DUSaBvc.exe
  C:\Windows\System\DUSaBvc.exe
  2⤵
  PID:680
- C:\Windows\System\QhamPEl.exe
  C:\Windows\System\QhamPEl.exe
  2⤵
  PID:2304
- C:\Windows\System\TgDCiAQ.exe
  C:\Windows\System\TgDCiAQ.exe
  2⤵
  PID:3016
- C:\Windows\System\mrDmgqY.exe
  C:\Windows\System\mrDmgqY.exe
  2⤵
  PID:2792
- C:\Windows\System\ukjhYvn.exe
  C:\Windows\System\ukjhYvn.exe
  2⤵
  PID:1808
- C:\Windows\System\dakYTVH.exe
  C:\Windows\System\dakYTVH.exe
  2⤵
  PID:3028
- C:\Windows\System\WvcPTWS.exe
  C:\Windows\System\WvcPTWS.exe
  2⤵
  PID:2844
- C:\Windows\System\IiQrogU.exe
  C:\Windows\System\IiQrogU.exe
  2⤵
  PID:1384
- C:\Windows\System\NqTJotv.exe
  C:\Windows\System\NqTJotv.exe
  2⤵
  PID:1708
- C:\Windows\System\BhNGJlv.exe
  C:\Windows\System\BhNGJlv.exe
  2⤵
  PID:2156
- C:\Windows\System\ItwMHSo.exe
  C:\Windows\System\ItwMHSo.exe
  2⤵
  PID:1724
- C:\Windows\System\NyaaWid.exe
  C:\Windows\System\NyaaWid.exe
  2⤵
  PID:2872
- C:\Windows\System\VDOcnyB.exe
  C:\Windows\System\VDOcnyB.exe
  2⤵
  PID:3064
- C:\Windows\System\egiCaJS.exe
  C:\Windows\System\egiCaJS.exe
  2⤵
  PID:2972
- C:\Windows\System\kSvccwj.exe
  C:\Windows\System\kSvccwj.exe
  2⤵
  PID:1484
- C:\Windows\System\LJdOZzQ.exe
  C:\Windows\System\LJdOZzQ.exe
  2⤵
  PID:2284
- C:\Windows\System\dqqPLYx.exe
  C:\Windows\System\dqqPLYx.exe
  2⤵
  PID:2752
- C:\Windows\System\ZZzKiBL.exe
  C:\Windows\System\ZZzKiBL.exe
  2⤵
  PID:1688
- C:\Windows\System\YaigZlU.exe
  C:\Windows\System\YaigZlU.exe
  2⤵
  PID:1736
- C:\Windows\System\bhOioqD.exe
  C:\Windows\System\bhOioqD.exe
  2⤵
  PID:2120
- C:\Windows\System\aUHkirF.exe
  C:\Windows\System\aUHkirF.exe
  2⤵
  PID:2432
- C:\Windows\System\dtuKBoO.exe
  C:\Windows\System\dtuKBoO.exe
  2⤵
  PID:2780
- C:\Windows\System\GqHLKcz.exe
  C:\Windows\System\GqHLKcz.exe
  2⤵
  PID:2504
- C:\Windows\System\ezKCMRY.exe
  C:\Windows\System\ezKCMRY.exe
  2⤵
  PID:2168
- C:\Windows\System\RjPaFwx.exe
  C:\Windows\System\RjPaFwx.exe
  2⤵
  PID:2892
- C:\Windows\System\oTDRncs.exe
  C:\Windows\System\oTDRncs.exe
  2⤵
  PID:960
- C:\Windows\System\vGUAAgp.exe
  C:\Windows\System\vGUAAgp.exe
  2⤵
  PID:556
- C:\Windows\System\cvArzOk.exe
  C:\Windows\System\cvArzOk.exe
  2⤵
  PID:1836
- C:\Windows\System\GfnBzAv.exe
  C:\Windows\System\GfnBzAv.exe
  2⤵
  PID:2464
- C:\Windows\System\CkNgmDL.exe
  C:\Windows\System\CkNgmDL.exe
  2⤵
  PID:1252
- C:\Windows\System\xKlBZRf.exe
  C:\Windows\System\xKlBZRf.exe
  2⤵
  PID:956
- C:\Windows\System\YakRMWd.exe
  C:\Windows\System\YakRMWd.exe
  2⤵
  PID:616
- C:\Windows\System\WBkcYTz.exe
  C:\Windows\System\WBkcYTz.exe
  2⤵
  PID:2148
- C:\Windows\System\NiwKBoK.exe
  C:\Windows\System\NiwKBoK.exe
  2⤵
  PID:1412
- C:\Windows\System\MCoAhxJ.exe
  C:\Windows\System\MCoAhxJ.exe
  2⤵
  PID:1784
- C:\Windows\System\lHGMRRl.exe
  C:\Windows\System\lHGMRRl.exe
  2⤵
  PID:1504
- C:\Windows\System\EFSxmNu.exe
  C:\Windows\System\EFSxmNu.exe
  2⤵
  PID:2868
- C:\Windows\System\UeLhQVf.exe
  C:\Windows\System\UeLhQVf.exe
  2⤵
  PID:2260
- C:\Windows\System\ALwDKIo.exe
  C:\Windows\System\ALwDKIo.exe
  2⤵
  PID:1588
- C:\Windows\System\bJzWhkF.exe
  C:\Windows\System\bJzWhkF.exe
  2⤵
  PID:2288
- C:\Windows\System\vEIHFfC.exe
  C:\Windows\System\vEIHFfC.exe
  2⤵
  PID:2676
- C:\Windows\System\jtjQTrX.exe
  C:\Windows\System\jtjQTrX.exe
  2⤵
  PID:2160
- C:\Windows\System\GyMYppa.exe
  C:\Windows\System\GyMYppa.exe
  2⤵
  PID:1904
- C:\Windows\System\KwzkhVo.exe
  C:\Windows\System\KwzkhVo.exe
  2⤵
  PID:1376
- C:\Windows\System\SXRxJbG.exe
  C:\Windows\System\SXRxJbG.exe
  2⤵
  PID:1900
- C:\Windows\System\FRmEnmJ.exe
  C:\Windows\System\FRmEnmJ.exe
  2⤵
  PID:1416
- C:\Windows\System\DTKkPqo.exe
  C:\Windows\System\DTKkPqo.exe
  2⤵
  PID:924
- C:\Windows\System\bBRLgck.exe
  C:\Windows\System\bBRLgck.exe
  2⤵
  PID:780
- C:\Windows\System\aklrygP.exe
  C:\Windows\System\aklrygP.exe
  2⤵
  PID:676
- C:\Windows\System\ZmDgTUU.exe
  C:\Windows\System\ZmDgTUU.exe
  2⤵
  PID:2356
- C:\Windows\System\EjBEVIV.exe
  C:\Windows\System\EjBEVIV.exe
  2⤵
  PID:3036
- C:\Windows\System\CaCuwEl.exe
  C:\Windows\System\CaCuwEl.exe
  2⤵
  PID:2636
- C:\Windows\System\PnZcuWs.exe
  C:\Windows\System\PnZcuWs.exe
  2⤵
  PID:2460
- C:\Windows\System\driGGkx.exe
  C:\Windows\System\driGGkx.exe
  2⤵
  PID:528
- C:\Windows\System\DYPyYGW.exe
  C:\Windows\System\DYPyYGW.exe
  2⤵
  PID:2456
- C:\Windows\System\QXdPmwv.exe
  C:\Windows\System\QXdPmwv.exe
  2⤵
  PID:2112
- C:\Windows\System\uYJzJDi.exe
  C:\Windows\System\uYJzJDi.exe
  2⤵
  PID:1884
- C:\Windows\System\ZHOTOKH.exe
  C:\Windows\System\ZHOTOKH.exe
  2⤵
  PID:2592
- C:\Windows\System\eLzlqUD.exe
  C:\Windows\System\eLzlqUD.exe
  2⤵
  PID:2932
- C:\Windows\System\KRiqnbO.exe
  C:\Windows\System\KRiqnbO.exe
  2⤵
  PID:1640
- C:\Windows\System\jjFRlLs.exe
  C:\Windows\System\jjFRlLs.exe
  2⤵
  PID:2948
- C:\Windows\System\LKfPPwy.exe
  C:\Windows\System\LKfPPwy.exe
  2⤵
  PID:2176
- C:\Windows\System\uHnJzew.exe
  C:\Windows\System\uHnJzew.exe
  2⤵
  PID:1280
- C:\Windows\System\eyswbIr.exe
  C:\Windows\System\eyswbIr.exe
  2⤵
  PID:2036
- C:\Windows\System\gStQFUh.exe
  C:\Windows\System\gStQFUh.exe
  2⤵
  PID:1316
- C:\Windows\System\asRoebh.exe
  C:\Windows\System\asRoebh.exe
  2⤵
  PID:976
- C:\Windows\System\ZaNePhc.exe
  C:\Windows\System\ZaNePhc.exe
  2⤵
  PID:1232
- C:\Windows\System\qvddEqU.exe
  C:\Windows\System\qvddEqU.exe
  2⤵
  PID:1728
- C:\Windows\System\CjDiWBd.exe
  C:\Windows\System\CjDiWBd.exe
  2⤵
  PID:2292
- C:\Windows\System\CAOJKiX.exe
  C:\Windows\System\CAOJKiX.exe
  2⤵
  PID:2196
- C:\Windows\System\fYrUBlD.exe
  C:\Windows\System\fYrUBlD.exe
  2⤵
  PID:2004
- C:\Windows\System\ZbGLLLF.exe
  C:\Windows\System\ZbGLLLF.exe
  2⤵
  PID:2700
- C:\Windows\System\UgqNpIO.exe
  C:\Windows\System\UgqNpIO.exe
  2⤵
  PID:3084
- C:\Windows\System\HjpfUhK.exe
  C:\Windows\System\HjpfUhK.exe
  2⤵
  PID:3100
- C:\Windows\System\hwGKlSM.exe
  C:\Windows\System\hwGKlSM.exe
  2⤵
  PID:3116
- C:\Windows\System\IeeLgQU.exe
  C:\Windows\System\IeeLgQU.exe
  2⤵
  PID:3132
- C:\Windows\System\QkXALtY.exe
  C:\Windows\System\QkXALtY.exe
  2⤵
  PID:3148
- C:\Windows\System\UFbdpXI.exe
  C:\Windows\System\UFbdpXI.exe
  2⤵
  PID:3164
- C:\Windows\System\myfkiVR.exe
  C:\Windows\System\myfkiVR.exe
  2⤵
  PID:3180
- C:\Windows\System\dRkLzTm.exe
  C:\Windows\System\dRkLzTm.exe
  2⤵
  PID:3196
- C:\Windows\System\SyKoJkq.exe
  C:\Windows\System\SyKoJkq.exe
  2⤵
  PID:3212
- C:\Windows\System\xDpkCod.exe
  C:\Windows\System\xDpkCod.exe
  2⤵
  PID:3228
- C:\Windows\System\DJaComx.exe
  C:\Windows\System\DJaComx.exe
  2⤵
  PID:3244
- C:\Windows\System\dJoigrA.exe
  C:\Windows\System\dJoigrA.exe
  2⤵
  PID:3260
- C:\Windows\System\XZTIjnB.exe
  C:\Windows\System\XZTIjnB.exe
  2⤵
  PID:3276
- C:\Windows\System\JdlTCYC.exe
  C:\Windows\System\JdlTCYC.exe
  2⤵
  PID:3292
- C:\Windows\System\PJhMXKQ.exe
  C:\Windows\System\PJhMXKQ.exe
  2⤵
  PID:3308
- C:\Windows\System\uOveTCL.exe
  C:\Windows\System\uOveTCL.exe
  2⤵
  PID:3324
- C:\Windows\System\ZUSKVDd.exe
  C:\Windows\System\ZUSKVDd.exe
  2⤵
  PID:3340
- C:\Windows\System\KMsvDsu.exe
  C:\Windows\System\KMsvDsu.exe
  2⤵
  PID:3356
- C:\Windows\System\LNGzwIE.exe
  C:\Windows\System\LNGzwIE.exe
  2⤵
  PID:3372
- C:\Windows\System\PaPIZTw.exe
  C:\Windows\System\PaPIZTw.exe
  2⤵
  PID:3388
- C:\Windows\System\zrEhPeh.exe
  C:\Windows\System\zrEhPeh.exe
  2⤵
  PID:3404
- C:\Windows\System\MAoPTtu.exe
  C:\Windows\System\MAoPTtu.exe
  2⤵
  PID:3420
- C:\Windows\System\GtaoRpV.exe
  C:\Windows\System\GtaoRpV.exe
  2⤵
  PID:3436
- C:\Windows\System\nkqEhUF.exe
  C:\Windows\System\nkqEhUF.exe
  2⤵
  PID:3452
- C:\Windows\System\cZkuebH.exe
  C:\Windows\System\cZkuebH.exe
  2⤵
  PID:3468
- C:\Windows\System\JQYaGlh.exe
  C:\Windows\System\JQYaGlh.exe
  2⤵
  PID:3484
- C:\Windows\System\IgQOEeM.exe
  C:\Windows\System\IgQOEeM.exe
  2⤵
  PID:3500
- C:\Windows\System\uFhrsgy.exe
  C:\Windows\System\uFhrsgy.exe
  2⤵
  PID:3516
- C:\Windows\System\oRqKAex.exe
  C:\Windows\System\oRqKAex.exe
  2⤵
  PID:3532
- C:\Windows\System\eDlwEFi.exe
  C:\Windows\System\eDlwEFi.exe
  2⤵
  PID:3548
- C:\Windows\System\XAiaTAE.exe
  C:\Windows\System\XAiaTAE.exe
  2⤵
  PID:3564
- C:\Windows\System\KkGRuKM.exe
  C:\Windows\System\KkGRuKM.exe
  2⤵
  PID:3580
- C:\Windows\System\kmLSivl.exe
  C:\Windows\System\kmLSivl.exe
  2⤵
  PID:3596
- C:\Windows\System\OPjqySr.exe
  C:\Windows\System\OPjqySr.exe
  2⤵
  PID:3612
- C:\Windows\System\DrdmIYj.exe
  C:\Windows\System\DrdmIYj.exe
  2⤵
  PID:3628
- C:\Windows\System\QsWffEC.exe
  C:\Windows\System\QsWffEC.exe
  2⤵
  PID:3644
- C:\Windows\System\vjEnMmh.exe
  C:\Windows\System\vjEnMmh.exe
  2⤵
  PID:3660
- C:\Windows\System\ijOOVOC.exe
  C:\Windows\System\ijOOVOC.exe
  2⤵
  PID:3676
- C:\Windows\System\WVLMLjg.exe
  C:\Windows\System\WVLMLjg.exe
  2⤵
  PID:3692
- C:\Windows\System\hfAHaCc.exe
  C:\Windows\System\hfAHaCc.exe
  2⤵
  PID:3708
- C:\Windows\System\TKmRenS.exe
  C:\Windows\System\TKmRenS.exe
  2⤵
  PID:3724
- C:\Windows\System\DDMZtgV.exe
  C:\Windows\System\DDMZtgV.exe
  2⤵
  PID:3740
- C:\Windows\System\MGIcDNE.exe
  C:\Windows\System\MGIcDNE.exe
  2⤵
  PID:3756
- C:\Windows\System\kMNyCIl.exe
  C:\Windows\System\kMNyCIl.exe
  2⤵
  PID:3772
- C:\Windows\System\chpMsEB.exe
  C:\Windows\System\chpMsEB.exe
  2⤵
  PID:3788
- C:\Windows\System\eeqcEHI.exe
  C:\Windows\System\eeqcEHI.exe
  2⤵
  PID:3804
- C:\Windows\System\KgYeTRz.exe
  C:\Windows\System\KgYeTRz.exe
  2⤵
  PID:3820
- C:\Windows\System\VCthreB.exe
  C:\Windows\System\VCthreB.exe
  2⤵
  PID:3836
- C:\Windows\System\ItOSNzG.exe
  C:\Windows\System\ItOSNzG.exe
  2⤵
  PID:3852
- C:\Windows\System\yarZTkq.exe
  C:\Windows\System\yarZTkq.exe
  2⤵
  PID:3868
- C:\Windows\System\hXWQujY.exe
  C:\Windows\System\hXWQujY.exe
  2⤵
  PID:3884
- C:\Windows\System\skEpwyS.exe
  C:\Windows\System\skEpwyS.exe
  2⤵
  PID:3900
- C:\Windows\System\iioqDdJ.exe
  C:\Windows\System\iioqDdJ.exe
  2⤵
  PID:3916
- C:\Windows\System\nSdBMfo.exe
  C:\Windows\System\nSdBMfo.exe
  2⤵
  PID:3932
- C:\Windows\System\gQuxQhY.exe
  C:\Windows\System\gQuxQhY.exe
  2⤵
  PID:3948
- C:\Windows\System\sqaXhRw.exe
  C:\Windows\System\sqaXhRw.exe
  2⤵
  PID:3964
- C:\Windows\System\bJbHBgL.exe
  C:\Windows\System\bJbHBgL.exe
  2⤵
  PID:3980
- C:\Windows\System\Uivzugz.exe
  C:\Windows\System\Uivzugz.exe
  2⤵
  PID:3996
- C:\Windows\System\bbrZAGJ.exe
  C:\Windows\System\bbrZAGJ.exe
  2⤵
  PID:4012
- C:\Windows\System\bUmtQIr.exe
  C:\Windows\System\bUmtQIr.exe
  2⤵
  PID:4028
- C:\Windows\System\dwIbUYS.exe
  C:\Windows\System\dwIbUYS.exe
  2⤵
  PID:4044
- C:\Windows\System\wPNwQKr.exe
  C:\Windows\System\wPNwQKr.exe
  2⤵
  PID:4060
- C:\Windows\System\ptELxvj.exe
  C:\Windows\System\ptELxvj.exe
  2⤵
  PID:4076
- C:\Windows\System\aKMnaeT.exe
  C:\Windows\System\aKMnaeT.exe
  2⤵
  PID:4092
- C:\Windows\System\gSEeVel.exe
  C:\Windows\System\gSEeVel.exe
  2⤵
  PID:276
- C:\Windows\System\FeFEFmv.exe
  C:\Windows\System\FeFEFmv.exe
  2⤵
  PID:1212
- C:\Windows\System\RrzEBzj.exe
  C:\Windows\System\RrzEBzj.exe
  2⤵
  PID:3096
- C:\Windows\System\wiphCUn.exe
  C:\Windows\System\wiphCUn.exe
  2⤵
  PID:3128
- C:\Windows\System\mcYQEdy.exe
  C:\Windows\System\mcYQEdy.exe
  2⤵
  PID:3160
- C:\Windows\System\rCGGCch.exe
  C:\Windows\System\rCGGCch.exe
  2⤵
  PID:3192
- C:\Windows\System\irxBXcn.exe
  C:\Windows\System\irxBXcn.exe
  2⤵
  PID:3224
- C:\Windows\System\eUzbykP.exe
  C:\Windows\System\eUzbykP.exe
  2⤵
  PID:3256
- C:\Windows\System\seVKmvQ.exe
  C:\Windows\System\seVKmvQ.exe
  2⤵
  PID:3288
- C:\Windows\System\UzfjCMR.exe
  C:\Windows\System\UzfjCMR.exe
  2⤵
  PID:3320
- C:\Windows\System\xSKbUcb.exe
  C:\Windows\System\xSKbUcb.exe
  2⤵
  PID:3336
- C:\Windows\System\fPMbbWO.exe
  C:\Windows\System\fPMbbWO.exe
  2⤵
  PID:3380
- C:\Windows\System\PgevdAn.exe
  C:\Windows\System\PgevdAn.exe
  2⤵
  PID:2032
- C:\Windows\System\feFxBKf.exe
  C:\Windows\System\feFxBKf.exe
  2⤵
  PID:4108
- C:\Windows\System\dxNXqHW.exe
  C:\Windows\System\dxNXqHW.exe
  2⤵
  PID:4124
- C:\Windows\System\QYJeSIc.exe
  C:\Windows\System\QYJeSIc.exe
  2⤵
  PID:4140
- C:\Windows\System\NNmMEcN.exe
  C:\Windows\System\NNmMEcN.exe
  2⤵
  PID:4156
- C:\Windows\System\bYlhUNG.exe
  C:\Windows\System\bYlhUNG.exe
  2⤵
  PID:4172
- C:\Windows\System\VfVaIxW.exe
  C:\Windows\System\VfVaIxW.exe
  2⤵
  PID:4188
- C:\Windows\System\kNECxHQ.exe
  C:\Windows\System\kNECxHQ.exe
  2⤵
  PID:4204
- C:\Windows\System\nJhRkNd.exe
  C:\Windows\System\nJhRkNd.exe
  2⤵
  PID:4220
- C:\Windows\System\DYikodU.exe
  C:\Windows\System\DYikodU.exe
  2⤵
  PID:4236
- C:\Windows\System\UkOsIXH.exe
  C:\Windows\System\UkOsIXH.exe
  2⤵
  PID:4252
- C:\Windows\System\pQIgbzk.exe
  C:\Windows\System\pQIgbzk.exe
  2⤵
  PID:4268
- C:\Windows\System\smqyUWy.exe
  C:\Windows\System\smqyUWy.exe
  2⤵
  PID:4284
- C:\Windows\System\TNhSdGS.exe
  C:\Windows\System\TNhSdGS.exe
  2⤵
  PID:4300
- C:\Windows\System\DQRfwjt.exe
  C:\Windows\System\DQRfwjt.exe
  2⤵
  PID:4316
- C:\Windows\System\QdXoxSY.exe
  C:\Windows\System\QdXoxSY.exe
  2⤵
  PID:4332
- C:\Windows\System\agfqnfC.exe
  C:\Windows\System\agfqnfC.exe
  2⤵
  PID:4348
- C:\Windows\System\lUuEIIs.exe
  C:\Windows\System\lUuEIIs.exe
  2⤵
  PID:4364
- C:\Windows\System\AKycPOc.exe
  C:\Windows\System\AKycPOc.exe
  2⤵
  PID:4380
- C:\Windows\System\djuKUmC.exe
  C:\Windows\System\djuKUmC.exe
  2⤵
  PID:4396
- C:\Windows\System\flHiyXg.exe
  C:\Windows\System\flHiyXg.exe
  2⤵
  PID:4412
- C:\Windows\System\PUnnjNl.exe
  C:\Windows\System\PUnnjNl.exe
  2⤵
  PID:4428
- C:\Windows\System\njTLkPv.exe
  C:\Windows\System\njTLkPv.exe
  2⤵
  PID:4444
- C:\Windows\System\igUAdZJ.exe
  C:\Windows\System\igUAdZJ.exe
  2⤵
  PID:4460
- C:\Windows\System\qKjJPGF.exe
  C:\Windows\System\qKjJPGF.exe
  2⤵
  PID:4476
- C:\Windows\System\DcUJyMg.exe
  C:\Windows\System\DcUJyMg.exe
  2⤵
  PID:4492
- C:\Windows\System\mkyGtlE.exe
  C:\Windows\System\mkyGtlE.exe
  2⤵
  PID:4508
- C:\Windows\System\ZbHvNFC.exe
  C:\Windows\System\ZbHvNFC.exe
  2⤵
  PID:4524
- C:\Windows\System\WZOIVpS.exe
  C:\Windows\System\WZOIVpS.exe
  2⤵
  PID:4540
- C:\Windows\System\fLkhMgt.exe
  C:\Windows\System\fLkhMgt.exe
  2⤵
  PID:4556
- C:\Windows\System\MCKfaAy.exe
  C:\Windows\System\MCKfaAy.exe
  2⤵
  PID:4576
- C:\Windows\System\vQaxnfE.exe
  C:\Windows\System\vQaxnfE.exe
  2⤵
  PID:4592
- C:\Windows\System\ndITeTP.exe
  C:\Windows\System\ndITeTP.exe
  2⤵
  PID:4608
- C:\Windows\System\cdsrRBH.exe
  C:\Windows\System\cdsrRBH.exe
  2⤵
  PID:4624
- C:\Windows\System\XZfoSUw.exe
  C:\Windows\System\XZfoSUw.exe
  2⤵
  PID:4640
- C:\Windows\System\JHZbJlt.exe
  C:\Windows\System\JHZbJlt.exe
  2⤵
  PID:4896
- C:\Windows\System\rmdzjGK.exe
  C:\Windows\System\rmdzjGK.exe
  2⤵
  PID:4912
- C:\Windows\System\XmobNEf.exe
  C:\Windows\System\XmobNEf.exe
  2⤵
  PID:4928
- C:\Windows\System\kmEPHKP.exe
  C:\Windows\System\kmEPHKP.exe
  2⤵
  PID:4944
- C:\Windows\System\TgkXgLi.exe
  C:\Windows\System\TgkXgLi.exe
  2⤵
  PID:4960
- C:\Windows\System\rYvYTBh.exe
  C:\Windows\System\rYvYTBh.exe
  2⤵
  PID:4976
- C:\Windows\System\IXSZrUe.exe
  C:\Windows\System\IXSZrUe.exe
  2⤵
  PID:4992
- C:\Windows\System\LVKeMrZ.exe
  C:\Windows\System\LVKeMrZ.exe
  2⤵
  PID:5008
- C:\Windows\System\VbxCHmg.exe
  C:\Windows\System\VbxCHmg.exe
  2⤵
  PID:5024
- C:\Windows\System\XsiPryM.exe
  C:\Windows\System\XsiPryM.exe
  2⤵
  PID:5040
- C:\Windows\System\EGahQpL.exe
  C:\Windows\System\EGahQpL.exe
  2⤵
  PID:5056
- C:\Windows\System\kKqMPvZ.exe
  C:\Windows\System\kKqMPvZ.exe
  2⤵
  PID:5072
- C:\Windows\System\OWQOiuX.exe
  C:\Windows\System\OWQOiuX.exe
  2⤵
  PID:5088
- C:\Windows\System\PkRngbw.exe
  C:\Windows\System\PkRngbw.exe
  2⤵
  PID:5108
- C:\Windows\System\ISvhNkE.exe
  C:\Windows\System\ISvhNkE.exe
  2⤵
  PID:2804
- C:\Windows\System\kOcDAHU.exe
  C:\Windows\System\kOcDAHU.exe
  2⤵
  PID:2816
- C:\Windows\System\ecSbDBs.exe
  C:\Windows\System\ecSbDBs.exe
  2⤵
  PID:548
- C:\Windows\System\RBcBkKY.exe
  C:\Windows\System\RBcBkKY.exe
  2⤵
  PID:2848
- C:\Windows\System\SFptWHu.exe
  C:\Windows\System\SFptWHu.exe
  2⤵
  PID:2788
- C:\Windows\System\EYZxpgj.exe
  C:\Windows\System\EYZxpgj.exe
  2⤵
  PID:3460
- C:\Windows\System\SPCULbi.exe
  C:\Windows\System\SPCULbi.exe
  2⤵
  PID:3524
- C:\Windows\System\bzRQOdu.exe
  C:\Windows\System\bzRQOdu.exe
  2⤵
  PID:3412
- C:\Windows\System\GpjgPDW.exe
  C:\Windows\System\GpjgPDW.exe
  2⤵
  PID:3476
- C:\Windows\System\SBpsrum.exe
  C:\Windows\System\SBpsrum.exe
  2⤵
  PID:3540
- C:\Windows\System\iBXzWSr.exe
  C:\Windows\System\iBXzWSr.exe
  2⤵
  PID:3604
- C:\Windows\System\nTmKvUR.exe
  C:\Windows\System\nTmKvUR.exe
  2⤵
  PID:3668
- C:\Windows\System\KSaosUk.exe
  C:\Windows\System\KSaosUk.exe
  2⤵
  PID:3732
- C:\Windows\System\BaTQhbY.exe
  C:\Windows\System\BaTQhbY.exe
  2⤵
  PID:3796
- C:\Windows\System\rcWGugY.exe
  C:\Windows\System\rcWGugY.exe
  2⤵
  PID:3860
- C:\Windows\System\mtSrUaj.exe
  C:\Windows\System\mtSrUaj.exe
  2⤵
  PID:3924
- C:\Windows\System\CjducLP.exe
  C:\Windows\System\CjducLP.exe
  2⤵
  PID:3988
- C:\Windows\System\kuLYYzH.exe
  C:\Windows\System\kuLYYzH.exe
  2⤵
  PID:4052
- C:\Windows\System\yIbijfX.exe
  C:\Windows\System\yIbijfX.exe
  2⤵
  PID:2448
- C:\Windows\System\qbQrixN.exe
  C:\Windows\System\qbQrixN.exe
  2⤵
  PID:3176
- C:\Windows\System\DCKjPnt.exe
  C:\Windows\System\DCKjPnt.exe
  2⤵
  PID:3316
- C:\Windows\System\LsowCKe.exe
  C:\Windows\System\LsowCKe.exe
  2⤵
  PID:4104
- C:\Windows\System\mRbytyY.exe
  C:\Windows\System\mRbytyY.exe
  2⤵
  PID:4196
- C:\Windows\System\WayYTII.exe
  C:\Windows\System\WayYTII.exe
  2⤵
  PID:4260
- C:\Windows\System\juxvTMf.exe
  C:\Windows\System\juxvTMf.exe
  2⤵
  PID:4328
- C:\Windows\System\gnvWCUR.exe
  C:\Windows\System\gnvWCUR.exe
  2⤵
  PID:4392
- C:\Windows\System\VrfyCrc.exe
  C:\Windows\System\VrfyCrc.exe
  2⤵
  PID:4516
- C:\Windows\System\ITSvccF.exe
  C:\Windows\System\ITSvccF.exe
  2⤵
  PID:4584
- C:\Windows\System\VhtqJXZ.exe
  C:\Windows\System\VhtqJXZ.exe
  2⤵
  PID:4620
- C:\Windows\System\eXtwGJg.exe
  C:\Windows\System\eXtwGJg.exe
  2⤵
  PID:4672
- C:\Windows\System\TZLLFXd.exe
  C:\Windows\System\TZLLFXd.exe
  2⤵
  PID:4688
- C:\Windows\System\wBAWzEC.exe
  C:\Windows\System\wBAWzEC.exe
  2⤵
  PID:4704
- C:\Windows\System\VVQxHCn.exe
  C:\Windows\System\VVQxHCn.exe
  2⤵
  PID:4720
- C:\Windows\System\lclHqQR.exe
  C:\Windows\System\lclHqQR.exe
  2⤵
  PID:4736
- C:\Windows\System\eAyYnNR.exe
  C:\Windows\System\eAyYnNR.exe
  2⤵
  PID:4752
- C:\Windows\System\fwqMpET.exe
  C:\Windows\System\fwqMpET.exe
  2⤵
  PID:4768
- C:\Windows\System\QIjLJpB.exe
  C:\Windows\System\QIjLJpB.exe
  2⤵
  PID:4784
- C:\Windows\System\pFBNBOk.exe
  C:\Windows\System\pFBNBOk.exe
  2⤵
  PID:4800
- C:\Windows\System\rNLyJdc.exe
  C:\Windows\System\rNLyJdc.exe
  2⤵
  PID:4816
- C:\Windows\System\lIOSsfA.exe
  C:\Windows\System\lIOSsfA.exe
  2⤵
  PID:4832
- C:\Windows\System\pnEOeZl.exe
  C:\Windows\System\pnEOeZl.exe
  2⤵
  PID:4848
- C:\Windows\System\LkyWXHU.exe
  C:\Windows\System\LkyWXHU.exe
  2⤵
  PID:4864
- C:\Windows\System\tuajate.exe
  C:\Windows\System\tuajate.exe
  2⤵
  PID:4880
- C:\Windows\System\llYhbOR.exe
  C:\Windows\System\llYhbOR.exe
  2⤵
  PID:3556
- C:\Windows\System\XtxVVEC.exe
  C:\Windows\System\XtxVVEC.exe
  2⤵
  PID:3652
- C:\Windows\System\qmByiPR.exe
  C:\Windows\System\qmByiPR.exe
  2⤵
  PID:3716
- C:\Windows\System\cIxITIE.exe
  C:\Windows\System\cIxITIE.exe
  2⤵
  PID:3780
- C:\Windows\System\CQoeqrM.exe
  C:\Windows\System\CQoeqrM.exe
  2⤵
  PID:3844
- C:\Windows\System\jpwUqZB.exe
  C:\Windows\System\jpwUqZB.exe
  2⤵
  PID:3912
- C:\Windows\System\EWksINi.exe
  C:\Windows\System\EWksINi.exe
  2⤵
  PID:3976
- C:\Windows\System\IPRAhoL.exe
  C:\Windows\System\IPRAhoL.exe
  2⤵
  PID:4040
- C:\Windows\System\zdrJlIi.exe
  C:\Windows\System\zdrJlIi.exe
  2⤵
  PID:2880
- C:\Windows\System\yCSJAUP.exe
  C:\Windows\System\yCSJAUP.exe
  2⤵
  PID:3220
- C:\Windows\System\tgzVNic.exe
  C:\Windows\System\tgzVNic.exe
  2⤵
  PID:2928
- C:\Windows\System\kJTxXjm.exe
  C:\Windows\System\kJTxXjm.exe
  2⤵
  PID:4152
- C:\Windows\System\ABKpsEe.exe
  C:\Windows\System\ABKpsEe.exe
  2⤵
  PID:4216
- C:\Windows\System\zJZDfZp.exe
  C:\Windows\System\zJZDfZp.exe
  2⤵
  PID:4308
- C:\Windows\System\bfRJErN.exe
  C:\Windows\System\bfRJErN.exe
  2⤵
  PID:4376
- C:\Windows\System\aIDcTYF.exe
  C:\Windows\System\aIDcTYF.exe
  2⤵
  PID:4440
- C:\Windows\System\cHXZBPZ.exe
  C:\Windows\System\cHXZBPZ.exe
  2⤵
  PID:4504
- C:\Windows\System\TBorOTF.exe
  C:\Windows\System\TBorOTF.exe
  2⤵
  PID:4568
- C:\Windows\System\BYITIpf.exe
  C:\Windows\System\BYITIpf.exe
  2⤵
  PID:4636
- C:\Windows\System\OAdJUiL.exe
  C:\Windows\System\OAdJUiL.exe
  2⤵
  PID:3144
- C:\Windows\System\NDFTdPg.exe
  C:\Windows\System\NDFTdPg.exe
  2⤵
  PID:4652
- C:\Windows\System\YmaMlxt.exe
  C:\Windows\System\YmaMlxt.exe
  2⤵
  PID:4952
- C:\Windows\System\wFFxTNQ.exe
  C:\Windows\System\wFFxTNQ.exe
  2⤵
  PID:3624
- C:\Windows\System\tMAuBWX.exe
  C:\Windows\System\tMAuBWX.exe
  2⤵
  PID:5052
- C:\Windows\System\gNSafNL.exe
  C:\Windows\System\gNSafNL.exe
  2⤵
  PID:4656
- C:\Windows\System\TKydomH.exe
  C:\Windows\System\TKydomH.exe
  2⤵
  PID:2704
- C:\Windows\System\inribKK.exe
  C:\Windows\System\inribKK.exe
  2⤵
  PID:3448
- C:\Windows\System\ZsYprwZ.exe
  C:\Windows\System\ZsYprwZ.exe
  2⤵
  PID:4904
- C:\Windows\System\MoSzZiY.exe
  C:\Windows\System\MoSzZiY.exe
  2⤵
  PID:4968
- C:\Windows\System\rbSkbVE.exe
  C:\Windows\System\rbSkbVE.exe
  2⤵
  PID:5032
- C:\Windows\System\jnTguDc.exe
  C:\Windows\System\jnTguDc.exe
  2⤵
  PID:5096
- C:\Windows\System\dBejXEc.exe
  C:\Windows\System\dBejXEc.exe
  2⤵
  PID:3396
- C:\Windows\System\PpdwKvy.exe
  C:\Windows\System\PpdwKvy.exe
  2⤵
  PID:4452
- C:\Windows\System\bwZOjFF.exe
  C:\Windows\System\bwZOjFF.exe
  2⤵
  PID:3636
- C:\Windows\System\FpTlvuS.exe
  C:\Windows\System\FpTlvuS.exe
  2⤵
  PID:3828
- C:\Windows\System\gfTLwUF.exe
  C:\Windows\System\gfTLwUF.exe
  2⤵
  PID:3956
- C:\Windows\System\cVmdIUh.exe
  C:\Windows\System\cVmdIUh.exe
  2⤵
  PID:4088
- C:\Windows\System\BNmneyE.exe
  C:\Windows\System\BNmneyE.exe
  2⤵
  PID:3240
- C:\Windows\System\MIreRVt.exe
  C:\Windows\System\MIreRVt.exe
  2⤵
  PID:3188
- C:\Windows\System\rrdVlbR.exe
  C:\Windows\System\rrdVlbR.exe
  2⤵
  PID:4020
- C:\Windows\System\RuZEbLV.exe
  C:\Windows\System\RuZEbLV.exe
  2⤵
  PID:4232
- C:\Windows\System\xWsETJi.exe
  C:\Windows\System\xWsETJi.exe
  2⤵
  PID:4660
- C:\Windows\System\NTTGFsQ.exe
  C:\Windows\System\NTTGFsQ.exe
  2⤵
  PID:4520
- C:\Windows\System\VCwwMTg.exe
  C:\Windows\System\VCwwMTg.exe
  2⤵
  PID:4680
- C:\Windows\System\wanvKEc.exe
  C:\Windows\System\wanvKEc.exe
  2⤵
  PID:4696
- C:\Windows\System\sUjPGGd.exe
  C:\Windows\System\sUjPGGd.exe
  2⤵
  PID:4744
- C:\Windows\System\ZgTGLDw.exe
  C:\Windows\System\ZgTGLDw.exe
  2⤵
  PID:4760
- C:\Windows\System\FVpxiPf.exe
  C:\Windows\System\FVpxiPf.exe
  2⤵
  PID:4812
- C:\Windows\System\RBJGnog.exe
  C:\Windows\System\RBJGnog.exe
  2⤵
  PID:4872
- C:\Windows\System\urGyKle.exe
  C:\Windows\System\urGyKle.exe
  2⤵
  PID:4828
- C:\Windows\System\kISFFcx.exe
  C:\Windows\System\kISFFcx.exe
  2⤵
  PID:3688
- C:\Windows\System\XBIDQWX.exe
  C:\Windows\System\XBIDQWX.exe
  2⤵
  PID:4796
- C:\Windows\System\BJJGBLv.exe
  C:\Windows\System\BJJGBLv.exe
  2⤵
  PID:3156
- C:\Windows\System\uoRMwqi.exe
  C:\Windows\System\uoRMwqi.exe
  2⤵
  PID:3272
- C:\Windows\System\QWVsUky.exe
  C:\Windows\System\QWVsUky.exe
  2⤵
  PID:3812
- C:\Windows\System\nAmZkab.exe
  C:\Windows\System\nAmZkab.exe
  2⤵
  PID:3528
- C:\Windows\System\AczvDlu.exe
  C:\Windows\System\AczvDlu.exe
  2⤵
  PID:4248
- C:\Windows\System\vGcrklz.exe
  C:\Windows\System\vGcrklz.exe
  2⤵
  PID:4536
- C:\Windows\System\vKvJHXM.exe
  C:\Windows\System\vKvJHXM.exe
  2⤵
  PID:3620
- C:\Windows\System\oLlmBUn.exe
  C:\Windows\System\oLlmBUn.exe
  2⤵
  PID:4924
- C:\Windows\System\PhlXqEZ.exe
  C:\Windows\System\PhlXqEZ.exe
  2⤵
  PID:4372
- C:\Windows\System\hqOJWwv.exe
  C:\Windows\System\hqOJWwv.exe
  2⤵
  PID:2492
- C:\Windows\System\VRKTEHp.exe
  C:\Windows\System\VRKTEHp.exe
  2⤵
  PID:4892
- C:\Windows\System\nHeOodk.exe
  C:\Windows\System\nHeOodk.exe
  2⤵
  PID:5000
- C:\Windows\System\iBofUJI.exe
  C:\Windows\System\iBofUJI.exe
  2⤵
  PID:4940
- C:\Windows\System\umtISKW.exe
  C:\Windows\System\umtISKW.exe
  2⤵
  PID:3768
- C:\Windows\System\XbTVjaH.exe
  C:\Windows\System\XbTVjaH.exe
  2⤵
  PID:4984
- C:\Windows\System\NtGGDUk.exe
  C:\Windows\System\NtGGDUk.exe
  2⤵
  PID:3496
- C:\Windows\System\bmwVaUD.exe
  C:\Windows\System\bmwVaUD.exe
  2⤵
  PID:4296
- C:\Windows\System\sRGDdQc.exe
  C:\Windows\System\sRGDdQc.exe
  2⤵
  PID:3704
- C:\Windows\System\nojNdIE.exe
  C:\Windows\System\nojNdIE.exe
  2⤵
  PID:3112
- C:\Windows\System\SlhtxYs.exe
  C:\Windows\System\SlhtxYs.exe
  2⤵
  PID:4664
- C:\Windows\System\AMGZWEu.exe
  C:\Windows\System\AMGZWEu.exe
  2⤵
  PID:3588
- C:\Windows\System\RcjmEUN.exe
  C:\Windows\System\RcjmEUN.exe
  2⤵
  PID:4168
- C:\Windows\System\CJGvgST.exe
  C:\Windows\System\CJGvgST.exe
  2⤵
  PID:4072
- C:\Windows\System\tCPyOJa.exe
  C:\Windows\System\tCPyOJa.exe
  2⤵
  PID:4844
- C:\Windows\System\wYtyOBG.exe
  C:\Windows\System\wYtyOBG.exe
  2⤵
  PID:3092
- C:\Windows\System\LbliVoz.exe
  C:\Windows\System\LbliVoz.exe
  2⤵
  PID:4388
- C:\Windows\System\AGdyGlh.exe
  C:\Windows\System\AGdyGlh.exe
  2⤵
  PID:4120
- C:\Windows\System\FzRPkrR.exe
  C:\Windows\System\FzRPkrR.exe
  2⤵
  PID:4860
- C:\Windows\System\CIbFSXj.exe
  C:\Windows\System\CIbFSXj.exe
  2⤵
  PID:4920
- C:\Windows\System\mrvcipt.exe
  C:\Windows\System\mrvcipt.exe
  2⤵
  PID:4212
- C:\Windows\System\AtTCZUA.exe
  C:\Windows\System\AtTCZUA.exe
  2⤵
  PID:3892
- C:\Windows\System\vnoSlMn.exe
  C:\Windows\System\vnoSlMn.exe
  2⤵
  PID:4500
- C:\Windows\System\xIeaHkz.exe
  C:\Windows\System\xIeaHkz.exe
  2⤵
  PID:3432
- C:\Windows\System\OPwIAYm.exe
  C:\Windows\System\OPwIAYm.exe
  2⤵
  PID:2364
- C:\Windows\System\xApchGV.exe
  C:\Windows\System\xApchGV.exe
  2⤵
  PID:4732
- C:\Windows\System\PveNIrf.exe
  C:\Windows\System\PveNIrf.exe
  2⤵
  PID:3960
- C:\Windows\System\TxuYsfW.exe
  C:\Windows\System\TxuYsfW.exe
  2⤵
  PID:4840
- C:\Windows\System\SFyJgQq.exe
  C:\Windows\System\SFyJgQq.exe
  2⤵
  PID:4436
- C:\Windows\System\kZBHdoO.exe
  C:\Windows\System\kZBHdoO.exe
  2⤵
  PID:4564
- C:\Windows\System\EvtEeko.exe
  C:\Windows\System\EvtEeko.exe
  2⤵
  PID:4344
- C:\Windows\System\cvDqSHw.exe
  C:\Windows\System\cvDqSHw.exe
  2⤵
  PID:4136
- C:\Windows\System\xPQiaBy.exe
  C:\Windows\System\xPQiaBy.exe
  2⤵
  PID:3428
- C:\Windows\System\KqXaAWf.exe
  C:\Windows\System\KqXaAWf.exe
  2⤵
  PID:3640
- C:\Windows\System\MUFqJSP.exe
  C:\Windows\System\MUFqJSP.exe
  2⤵
  PID:3972
- C:\Windows\System\NICnZCs.exe
  C:\Windows\System\NICnZCs.exe
  2⤵
  PID:5048
- C:\Windows\System\EITjPLH.exe
  C:\Windows\System\EITjPLH.exe
  2⤵
  PID:4616
- C:\Windows\System\AawhXWz.exe
  C:\Windows\System\AawhXWz.exe
  2⤵
  PID:5124
- C:\Windows\System\raRNAMT.exe
  C:\Windows\System\raRNAMT.exe
  2⤵
  PID:5140
- C:\Windows\System\FoGwZLV.exe
  C:\Windows\System\FoGwZLV.exe
  2⤵
  PID:5156
- C:\Windows\System\eQlLHtN.exe
  C:\Windows\System\eQlLHtN.exe
  2⤵
  PID:5172
- C:\Windows\System\uKNyaCv.exe
  C:\Windows\System\uKNyaCv.exe
  2⤵
  PID:5188
- C:\Windows\System\jJcUYHs.exe
  C:\Windows\System\jJcUYHs.exe
  2⤵
  PID:5204
- C:\Windows\System\hRDPwti.exe
  C:\Windows\System\hRDPwti.exe
  2⤵
  PID:5220
- C:\Windows\System\gSZBgcU.exe
  C:\Windows\System\gSZBgcU.exe
  2⤵
  PID:5236
- C:\Windows\System\pFaPMrB.exe
  C:\Windows\System\pFaPMrB.exe
  2⤵
  PID:5252
- C:\Windows\System\VPIPKLg.exe
  C:\Windows\System\VPIPKLg.exe
  2⤵
  PID:5268
- C:\Windows\System\qFFiDFv.exe
  C:\Windows\System\qFFiDFv.exe
  2⤵
  PID:5284
- C:\Windows\System\rmzZDGw.exe
  C:\Windows\System\rmzZDGw.exe
  2⤵
  PID:5300
- C:\Windows\System\vJIgLta.exe
  C:\Windows\System\vJIgLta.exe
  2⤵
  PID:5316
- C:\Windows\System\clILUYw.exe
  C:\Windows\System\clILUYw.exe
  2⤵
  PID:5332
- C:\Windows\System\EwVTmTs.exe
  C:\Windows\System\EwVTmTs.exe
  2⤵
  PID:5348
- C:\Windows\System\rkPlNcl.exe
  C:\Windows\System\rkPlNcl.exe
  2⤵
  PID:5364
- C:\Windows\System\pYXlcLQ.exe
  C:\Windows\System\pYXlcLQ.exe
  2⤵
  PID:5380
- C:\Windows\System\hOsEDcJ.exe
  C:\Windows\System\hOsEDcJ.exe
  2⤵
  PID:5396
- C:\Windows\System\dvWdjKb.exe
  C:\Windows\System\dvWdjKb.exe
  2⤵
  PID:5412
- C:\Windows\System\czIRxRB.exe
  C:\Windows\System\czIRxRB.exe
  2⤵
  PID:5428
- C:\Windows\System\PRkqpGK.exe
  C:\Windows\System\PRkqpGK.exe
  2⤵
  PID:5444
- C:\Windows\System\WunGRvX.exe
  C:\Windows\System\WunGRvX.exe
  2⤵
  PID:5460
- C:\Windows\System\qcKocIa.exe
  C:\Windows\System\qcKocIa.exe
  2⤵
  PID:5476
- C:\Windows\System\OjQjUyA.exe
  C:\Windows\System\OjQjUyA.exe
  2⤵
  PID:5492
- C:\Windows\System\IdBKWnG.exe
  C:\Windows\System\IdBKWnG.exe
  2⤵
  PID:5508
- C:\Windows\System\SepQnSD.exe
  C:\Windows\System\SepQnSD.exe
  2⤵
  PID:5524
- C:\Windows\System\sUsDJNc.exe
  C:\Windows\System\sUsDJNc.exe
  2⤵
  PID:5540
- C:\Windows\System\pKWJUGN.exe
  C:\Windows\System\pKWJUGN.exe
  2⤵
  PID:5556
- C:\Windows\System\gOnSkdx.exe
  C:\Windows\System\gOnSkdx.exe
  2⤵
  PID:5572
- C:\Windows\System\hHxZLOx.exe
  C:\Windows\System\hHxZLOx.exe
  2⤵
  PID:5588
- C:\Windows\System\QaCPhyo.exe
  C:\Windows\System\QaCPhyo.exe
  2⤵
  PID:5604
- C:\Windows\System\QKmLZYE.exe
  C:\Windows\System\QKmLZYE.exe
  2⤵
  PID:5620
- C:\Windows\System\kMuHdWP.exe
  C:\Windows\System\kMuHdWP.exe
  2⤵
  PID:5636
- C:\Windows\System\giepxzU.exe
  C:\Windows\System\giepxzU.exe
  2⤵
  PID:5652
- C:\Windows\System\AKELMBA.exe
  C:\Windows\System\AKELMBA.exe
  2⤵
  PID:5668
- C:\Windows\System\BmrLstX.exe
  C:\Windows\System\BmrLstX.exe
  2⤵
  PID:5684
- C:\Windows\System\LeYINya.exe
  C:\Windows\System\LeYINya.exe
  2⤵
  PID:5700
- C:\Windows\System\QeJijAC.exe
  C:\Windows\System\QeJijAC.exe
  2⤵
  PID:5716
- C:\Windows\System\brMjRrT.exe
  C:\Windows\System\brMjRrT.exe
  2⤵
  PID:5732
- C:\Windows\System\iMhuKlJ.exe
  C:\Windows\System\iMhuKlJ.exe
  2⤵
  PID:5748
- C:\Windows\System\qgFUBHN.exe
  C:\Windows\System\qgFUBHN.exe
  2⤵
  PID:5764
- C:\Windows\System\MLagDnL.exe
  C:\Windows\System\MLagDnL.exe
  2⤵
  PID:5780
- C:\Windows\System\ChRzVpf.exe
  C:\Windows\System\ChRzVpf.exe
  2⤵
  PID:5796
- C:\Windows\System\AusCqVq.exe
  C:\Windows\System\AusCqVq.exe
  2⤵
  PID:5812
- C:\Windows\System\HNgIIDe.exe
  C:\Windows\System\HNgIIDe.exe
  2⤵
  PID:5828
- C:\Windows\System\IoUkGSD.exe
  C:\Windows\System\IoUkGSD.exe
  2⤵
  PID:5844
- C:\Windows\System\pNIPWJU.exe
  C:\Windows\System\pNIPWJU.exe
  2⤵
  PID:5860
- C:\Windows\System\APutzED.exe
  C:\Windows\System\APutzED.exe
  2⤵
  PID:5876
- C:\Windows\System\CIiQnHO.exe
  C:\Windows\System\CIiQnHO.exe
  2⤵
  PID:5892
- C:\Windows\System\xXZVdNf.exe
  C:\Windows\System\xXZVdNf.exe
  2⤵
  PID:5908
- C:\Windows\System\NksqKls.exe
  C:\Windows\System\NksqKls.exe
  2⤵
  PID:5924
- C:\Windows\System\FwUBXff.exe
  C:\Windows\System\FwUBXff.exe
  2⤵
  PID:5940
- C:\Windows\System\zvzWmGe.exe
  C:\Windows\System\zvzWmGe.exe
  2⤵
  PID:5956
- C:\Windows\System\JBYvQkr.exe
  C:\Windows\System\JBYvQkr.exe
  2⤵
  PID:5972
- C:\Windows\System\kaIYpTp.exe
  C:\Windows\System\kaIYpTp.exe
  2⤵
  PID:5988
- C:\Windows\System\UMjBVwA.exe
  C:\Windows\System\UMjBVwA.exe
  2⤵
  PID:6004
- C:\Windows\System\sWDnRsp.exe
  C:\Windows\System\sWDnRsp.exe
  2⤵
  PID:6020
- C:\Windows\System\hdERtrP.exe
  C:\Windows\System\hdERtrP.exe
  2⤵
  PID:6036
- C:\Windows\System\SqRsTma.exe
  C:\Windows\System\SqRsTma.exe
  2⤵
  PID:6052
- C:\Windows\System\oznFItT.exe
  C:\Windows\System\oznFItT.exe
  2⤵
  PID:6068
- C:\Windows\System\KNtaSop.exe
  C:\Windows\System\KNtaSop.exe
  2⤵
  PID:6084
- C:\Windows\System\FhNEMWB.exe
  C:\Windows\System\FhNEMWB.exe
  2⤵
  PID:6100
- C:\Windows\System\zjNgzzR.exe
  C:\Windows\System\zjNgzzR.exe
  2⤵
  PID:6116
- C:\Windows\System\TjqoAFE.exe
  C:\Windows\System\TjqoAFE.exe
  2⤵
  PID:6132
- C:\Windows\System\HKBxcDm.exe
  C:\Windows\System\HKBxcDm.exe
  2⤵
  PID:5136
- C:\Windows\System\yxthwJq.exe
  C:\Windows\System\yxthwJq.exe
  2⤵
  PID:2512
- C:\Windows\System\tCeSTub.exe
  C:\Windows\System\tCeSTub.exe
  2⤵
  PID:5200
- C:\Windows\System\kUHkslK.exe
  C:\Windows\System\kUHkslK.exe
  2⤵
  PID:5180
- C:\Windows\System\oddEixN.exe
  C:\Windows\System\oddEixN.exe
  2⤵
  PID:5228
- C:\Windows\System\COCGJTe.exe
  C:\Windows\System\COCGJTe.exe
  2⤵
  PID:5244
- C:\Windows\System\mRkInhi.exe
  C:\Windows\System\mRkInhi.exe
  2⤵
  PID:5292
- C:\Windows\System\honFecl.exe
  C:\Windows\System\honFecl.exe
  2⤵
  PID:5328
- C:\Windows\System\kOpQGmj.exe
  C:\Windows\System\kOpQGmj.exe
  2⤵
  PID:5420
- C:\Windows\System\GJZkfxd.exe
  C:\Windows\System\GJZkfxd.exe
  2⤵
  PID:5404
- C:\Windows\System\ieKAduU.exe
  C:\Windows\System\ieKAduU.exe
  2⤵
  PID:5308
- C:\Windows\System\yZhdwJb.exe
  C:\Windows\System\yZhdwJb.exe
  2⤵
  PID:5372
- C:\Windows\System\KyALuih.exe
  C:\Windows\System\KyALuih.exe
  2⤵
  PID:5484
- C:\Windows\System\DcCYbxH.exe
  C:\Windows\System\DcCYbxH.exe
  2⤵
  PID:5504
- C:\Windows\System\YngxjBc.exe
  C:\Windows\System\YngxjBc.exe
  2⤵
  PID:5644
- C:\Windows\System\CgEHInn.exe
  C:\Windows\System\CgEHInn.exe
  2⤵
  PID:5584
- C:\Windows\System\ZaYhBiZ.exe
  C:\Windows\System\ZaYhBiZ.exe
  2⤵
  PID:5580
- C:\Windows\System\bIKPJwn.exe
  C:\Windows\System\bIKPJwn.exe
  2⤵
  PID:5564
- C:\Windows\System\wgngPxN.exe
  C:\Windows\System\wgngPxN.exe
  2⤵
  PID:5660
- C:\Windows\System\TStgtaE.exe
  C:\Windows\System\TStgtaE.exe
  2⤵
  PID:5696
- C:\Windows\System\QhlWOTT.exe
  C:\Windows\System\QhlWOTT.exe
  2⤵
  PID:5692
- C:\Windows\System\FnDiwxR.exe
  C:\Windows\System\FnDiwxR.exe
  2⤵
  PID:5712
- C:\Windows\System\lNwHcmF.exe
  C:\Windows\System\lNwHcmF.exe
  2⤵
  PID:5808
- C:\Windows\System\MDlvFAK.exe
  C:\Windows\System\MDlvFAK.exe
  2⤵
  PID:5872
- C:\Windows\System\ssraapF.exe
  C:\Windows\System\ssraapF.exe
  2⤵
  PID:5936
- C:\Windows\System\qdnDZmm.exe
  C:\Windows\System\qdnDZmm.exe
  2⤵
  PID:6000
- C:\Windows\System\hlUXBka.exe
  C:\Windows\System\hlUXBka.exe
  2⤵
  PID:6064
- C:\Windows\System\rOlfmqm.exe
  C:\Windows\System\rOlfmqm.exe
  2⤵
  PID:6128
- C:\Windows\System\AgaGDLu.exe
  C:\Windows\System\AgaGDLu.exe
  2⤵
  PID:5116
- C:\Windows\System\SOxMTQb.exe
  C:\Windows\System\SOxMTQb.exe
  2⤵
  PID:5324
- C:\Windows\System\fDeRcPs.exe
  C:\Windows\System\fDeRcPs.exe
  2⤵
  PID:5792
- C:\Windows\System\hELSkOU.exe
  C:\Windows\System\hELSkOU.exe
  2⤵
  PID:5856
- C:\Windows\System\gnxZErQ.exe
  C:\Windows\System\gnxZErQ.exe
  2⤵
  PID:5952
- C:\Windows\System\AMcWuwI.exe
  C:\Windows\System\AMcWuwI.exe
  2⤵
  PID:5984
- C:\Windows\System\YAwtzfQ.exe
  C:\Windows\System\YAwtzfQ.exe
  2⤵
  PID:5552
- C:\Windows\System\kglViFu.exe
  C:\Windows\System\kglViFu.exe
  2⤵
  PID:5628
- C:\Windows\System\BBnkgPQ.exe
  C:\Windows\System\BBnkgPQ.exe
  2⤵
  PID:5888
- C:\Windows\System\tmmCWtP.exe
  C:\Windows\System\tmmCWtP.exe
  2⤵
  PID:6048
- C:\Windows\System\OEMSFIz.exe
  C:\Windows\System\OEMSFIz.exe
  2⤵
  PID:6108
- C:\Windows\System\DkHjUXC.exe
  C:\Windows\System\DkHjUXC.exe
  2⤵
  PID:5168
- C:\Windows\System\oCkNeVM.exe
  C:\Windows\System\oCkNeVM.exe
  2⤵
  PID:5264
- C:\Windows\System\buCzkGf.exe
  C:\Windows\System\buCzkGf.exe
  2⤵
  PID:5280
- C:\Windows\System\RCgnmPr.exe
  C:\Windows\System\RCgnmPr.exe
  2⤵
  PID:5676
- C:\Windows\System\yNVJKtR.exe
  C:\Windows\System\yNVJKtR.exe
  2⤵
  PID:5840
- C:\Windows\System\qxdUVXT.exe
  C:\Windows\System\qxdUVXT.exe
  2⤵
  PID:6096
- C:\Windows\System\hJTCdOL.exe
  C:\Windows\System\hJTCdOL.exe
  2⤵
  PID:5360
- C:\Windows\System\JGkKdGu.exe
  C:\Windows\System\JGkKdGu.exe
  2⤵
  PID:5532
- C:\Windows\System\dmhRdUk.exe
  C:\Windows\System\dmhRdUk.exe
  2⤵
  PID:5568
- C:\Windows\System\IONZHLa.exe
  C:\Windows\System\IONZHLa.exe
  2⤵
  PID:5904
- C:\Windows\System\YfctBxv.exe
  C:\Windows\System\YfctBxv.exe
  2⤵
  PID:6060
- C:\Windows\System\TeFgqve.exe
  C:\Windows\System\TeFgqve.exe
  2⤵
  PID:5788
- C:\Windows\System\EiKJEbQ.exe
  C:\Windows\System\EiKJEbQ.exe
  2⤵
  PID:5132
- C:\Windows\System\PkXUCFb.exe
  C:\Windows\System\PkXUCFb.exe
  2⤵
  PID:5616
- C:\Windows\System\pFvRNCU.exe
  C:\Windows\System\pFvRNCU.exe
  2⤵
  PID:5344
- C:\Windows\System\RXECRKp.exe
  C:\Windows\System\RXECRKp.exe
  2⤵
  PID:5708
- C:\Windows\System\aFEwKEf.exe
  C:\Windows\System\aFEwKEf.exe
  2⤵
  PID:5728
- C:\Windows\System\cuVPOXu.exe
  C:\Windows\System\cuVPOXu.exe
  2⤵
  PID:6140
- C:\Windows\System\nZWjmRv.exe
  C:\Windows\System\nZWjmRv.exe
  2⤵
  PID:5920
- C:\Windows\System\ULiCmQz.exe
  C:\Windows\System\ULiCmQz.exe
  2⤵
  PID:5964
- C:\Windows\System\NPBudvh.exe
  C:\Windows\System\NPBudvh.exe
  2⤵
  PID:5824
- C:\Windows\System\PduXutQ.exe
  C:\Windows\System\PduXutQ.exe
  2⤵
  PID:6156
- C:\Windows\System\xtVrJSN.exe
  C:\Windows\System\xtVrJSN.exe
  2⤵
  PID:6172
- C:\Windows\System\PXKqMmP.exe
  C:\Windows\System\PXKqMmP.exe
  2⤵
  PID:6188
- C:\Windows\System\mwlwCYX.exe
  C:\Windows\System\mwlwCYX.exe
  2⤵
  PID:6204
- C:\Windows\System\MIGdtsX.exe
  C:\Windows\System\MIGdtsX.exe
  2⤵
  PID:6220
- C:\Windows\System\OiYeniM.exe
  C:\Windows\System\OiYeniM.exe
  2⤵
  PID:6236
- C:\Windows\System\paDLzuD.exe
  C:\Windows\System\paDLzuD.exe
  2⤵
  PID:6252
- C:\Windows\System\QPqjvpA.exe
  C:\Windows\System\QPqjvpA.exe
  2⤵
  PID:6268
- C:\Windows\System\ksbnoYP.exe
  C:\Windows\System\ksbnoYP.exe
  2⤵
  PID:6284
- C:\Windows\System\Udsoall.exe
  C:\Windows\System\Udsoall.exe
  2⤵
  PID:6300
- C:\Windows\System\QiLVGgL.exe
  C:\Windows\System\QiLVGgL.exe
  2⤵
  PID:6316
- C:\Windows\System\BcNStkA.exe
  C:\Windows\System\BcNStkA.exe
  2⤵
  PID:6332
- C:\Windows\System\nxQpcaI.exe
  C:\Windows\System\nxQpcaI.exe
  2⤵
  PID:6348
- C:\Windows\System\MMRGPKN.exe
  C:\Windows\System\MMRGPKN.exe
  2⤵
  PID:6364
- C:\Windows\System\CZIuEAq.exe
  C:\Windows\System\CZIuEAq.exe
  2⤵
  PID:6380
- C:\Windows\System\rFxGUum.exe
  C:\Windows\System\rFxGUum.exe
  2⤵
  PID:6396
- C:\Windows\System\uQSnlZU.exe
  C:\Windows\System\uQSnlZU.exe
  2⤵
  PID:6412
- C:\Windows\System\sCBtXHI.exe
  C:\Windows\System\sCBtXHI.exe
  2⤵
  PID:6428
- C:\Windows\System\JThNItj.exe
  C:\Windows\System\JThNItj.exe
  2⤵
  PID:6444
- C:\Windows\System\IyZmRLq.exe
  C:\Windows\System\IyZmRLq.exe
  2⤵
  PID:6460
- C:\Windows\System\oHlArLt.exe
  C:\Windows\System\oHlArLt.exe
  2⤵
  PID:6476
- C:\Windows\System\TDfwZLy.exe
  C:\Windows\System\TDfwZLy.exe
  2⤵
  PID:6492
- C:\Windows\System\eEIPEap.exe
  C:\Windows\System\eEIPEap.exe
  2⤵
  PID:6508
- C:\Windows\System\cOgosKf.exe
  C:\Windows\System\cOgosKf.exe
  2⤵
  PID:6524
- C:\Windows\System\iSAUJjJ.exe
  C:\Windows\System\iSAUJjJ.exe
  2⤵
  PID:6540
- C:\Windows\System\zvwmvHW.exe
  C:\Windows\System\zvwmvHW.exe
  2⤵
  PID:6556
- C:\Windows\System\VvjIkSd.exe
  C:\Windows\System\VvjIkSd.exe
  2⤵
  PID:6572
- C:\Windows\System\NpCOwen.exe
  C:\Windows\System\NpCOwen.exe
  2⤵
  PID:6588
- C:\Windows\System\IQhqkLY.exe
  C:\Windows\System\IQhqkLY.exe
  2⤵
  PID:6604
- C:\Windows\System\qtjEmke.exe
  C:\Windows\System\qtjEmke.exe
  2⤵
  PID:6620
- C:\Windows\System\wCjjuzB.exe
  C:\Windows\System\wCjjuzB.exe
  2⤵
  PID:6636
- C:\Windows\System\mTSniVM.exe
  C:\Windows\System\mTSniVM.exe
  2⤵
  PID:6652
- C:\Windows\System\RmUYlnT.exe
  C:\Windows\System\RmUYlnT.exe
  2⤵
  PID:6668
- C:\Windows\System\KrtmMCU.exe
  C:\Windows\System\KrtmMCU.exe
  2⤵
  PID:6684
- C:\Windows\System\PVpMfRs.exe
  C:\Windows\System\PVpMfRs.exe
  2⤵
  PID:6704
- C:\Windows\System\JZQsJRK.exe
  C:\Windows\System\JZQsJRK.exe
  2⤵
  PID:6720
- C:\Windows\System\jJEikhN.exe
  C:\Windows\System\jJEikhN.exe
  2⤵
  PID:6736
- C:\Windows\System\pvjEvzQ.exe
  C:\Windows\System\pvjEvzQ.exe
  2⤵
  PID:6752
- C:\Windows\System\TiRyrBt.exe
  C:\Windows\System\TiRyrBt.exe
  2⤵
  PID:6784
- C:\Windows\System\gailzMu.exe
  C:\Windows\System\gailzMu.exe
  2⤵
  PID:6800
- C:\Windows\System\rlxmyzu.exe
  C:\Windows\System\rlxmyzu.exe
  2⤵
  PID:6816
- C:\Windows\System\MUmiWKu.exe
  C:\Windows\System\MUmiWKu.exe
  2⤵
  PID:6832
- C:\Windows\System\TwFLvQE.exe
  C:\Windows\System\TwFLvQE.exe
  2⤵
  PID:6848
- C:\Windows\System\fmofImL.exe
  C:\Windows\System\fmofImL.exe
  2⤵
  PID:6864
- C:\Windows\System\TSQZlre.exe
  C:\Windows\System\TSQZlre.exe
  2⤵
  PID:6880
- C:\Windows\System\wFZJAxg.exe
  C:\Windows\System\wFZJAxg.exe
  2⤵
  PID:6896
- C:\Windows\System\mVsuHVd.exe
  C:\Windows\System\mVsuHVd.exe
  2⤵
  PID:6912
- C:\Windows\System\JlZZCIE.exe
  C:\Windows\System\JlZZCIE.exe
  2⤵
  PID:6928
- C:\Windows\System\fBktNxA.exe
  C:\Windows\System\fBktNxA.exe
  2⤵
  PID:6944
- C:\Windows\System\CQdbuuW.exe
  C:\Windows\System\CQdbuuW.exe
  2⤵
  PID:6960
- C:\Windows\System\Poqvwig.exe
  C:\Windows\System\Poqvwig.exe
  2⤵
  PID:6976
- C:\Windows\System\lfUlsUD.exe
  C:\Windows\System\lfUlsUD.exe
  2⤵
  PID:6992
- C:\Windows\System\IzkLjwN.exe
  C:\Windows\System\IzkLjwN.exe
  2⤵
  PID:7008
- C:\Windows\System\EgCqrHD.exe
  C:\Windows\System\EgCqrHD.exe
  2⤵
  PID:7024
- C:\Windows\System\JPyLkJv.exe
  C:\Windows\System\JPyLkJv.exe
  2⤵
  PID:7040
- C:\Windows\System\lwSmJnd.exe
  C:\Windows\System\lwSmJnd.exe
  2⤵
  PID:7056
- C:\Windows\System\jwZlVGo.exe
  C:\Windows\System\jwZlVGo.exe
  2⤵
  PID:7072
- C:\Windows\System\IEpHjFf.exe
  C:\Windows\System\IEpHjFf.exe
  2⤵
  PID:7088
- C:\Windows\System\oFbhYAh.exe
  C:\Windows\System\oFbhYAh.exe
  2⤵
  PID:7104
- C:\Windows\System\agoLxAB.exe
  C:\Windows\System\agoLxAB.exe
  2⤵
  PID:7120
- C:\Windows\System\DIzywwd.exe
  C:\Windows\System\DIzywwd.exe
  2⤵
  PID:7136
- C:\Windows\System\mNdqmhm.exe
  C:\Windows\System\mNdqmhm.exe
  2⤵
  PID:7152
- C:\Windows\System\VOYDhUF.exe
  C:\Windows\System\VOYDhUF.exe
  2⤵
  PID:5488
- C:\Windows\System\OJMYmLs.exe
  C:\Windows\System\OJMYmLs.exe
  2⤵
  PID:6164
- C:\Windows\System\cicKeIz.exe
  C:\Windows\System\cicKeIz.exe
  2⤵
  PID:6228
- C:\Windows\System\pDhJvWC.exe
  C:\Windows\System\pDhJvWC.exe
  2⤵
  PID:6292
- C:\Windows\System\ofanQoF.exe
  C:\Windows\System\ofanQoF.exe
  2⤵
  PID:6356
- C:\Windows\System\AFAYRjM.exe
  C:\Windows\System\AFAYRjM.exe
  2⤵
  PID:6420
- C:\Windows\System\IxzkkGy.exe
  C:\Windows\System\IxzkkGy.exe
  2⤵
  PID:6484
- C:\Windows\System\AvBWFJm.exe
  C:\Windows\System\AvBWFJm.exe
  2⤵
  PID:6548
- C:\Windows\System\PkPxIni.exe
  C:\Windows\System\PkPxIni.exe
  2⤵
  PID:6612
- C:\Windows\System\QAAHdvF.exe
  C:\Windows\System\QAAHdvF.exe
  2⤵
  PID:5520
- C:\Windows\System\FQAAuoh.exe
  C:\Windows\System\FQAAuoh.exe
  2⤵
  PID:6500
- C:\Windows\System\NmfidaT.exe
  C:\Windows\System\NmfidaT.exe
  2⤵
  PID:6664
- C:\Windows\System\DTEdfJr.exe
  C:\Windows\System\DTEdfJr.exe
  2⤵
  PID:6372
- C:\Windows\System\YDKJpdh.exe
  C:\Windows\System\YDKJpdh.exe
  2⤵
  PID:940
- C:\Windows\System\cmfWXPu.exe
  C:\Windows\System\cmfWXPu.exe
  2⤵
  PID:6824
- C:\Windows\System\AfjOiSa.exe
  C:\Windows\System\AfjOiSa.exe
  2⤵
  PID:6888
- C:\Windows\System\MwtTUDv.exe
  C:\Windows\System\MwtTUDv.exe
  2⤵
  PID:7020
- C:\Windows\System\AGDhvLJ.exe
  C:\Windows\System\AGDhvLJ.exe
  2⤵
  PID:7080
- C:\Windows\System\bfSyODT.exe
  C:\Windows\System\bfSyODT.exe
  2⤵
  PID:6940
- C:\Windows\System\EusCfeQ.exe
  C:\Windows\System\EusCfeQ.exe
  2⤵
  PID:6520
- C:\Windows\System\XLkLMMD.exe
  C:\Windows\System\XLkLMMD.exe
  2⤵
  PID:6564
- C:\Windows\System\iziMawU.exe
  C:\Windows\System\iziMawU.exe
  2⤵
  PID:5152
- C:\Windows\System\CvOUzsH.exe
  C:\Windows\System\CvOUzsH.exe
  2⤵
  PID:6472
- C:\Windows\System\oGRDltg.exe
  C:\Windows\System\oGRDltg.exe
  2⤵
  PID:6764
- C:\Windows\System\oPaRSab.exe
  C:\Windows\System\oPaRSab.exe
  2⤵
  PID:6936
- C:\Windows\System\hfxeLtD.exe
  C:\Windows\System\hfxeLtD.exe
  2⤵
  PID:7004
- C:\Windows\System\VbRnUZq.exe
  C:\Windows\System\VbRnUZq.exe
  2⤵
  PID:6744
- C:\Windows\System\MBUNEXE.exe
  C:\Windows\System\MBUNEXE.exe
  2⤵
  PID:6596
- C:\Windows\System\fVouOpY.exe
  C:\Windows\System\fVouOpY.exe
  2⤵
  PID:6728
- C:\Windows\System\FiLwXJV.exe
  C:\Windows\System\FiLwXJV.exe
  2⤵
  PID:6856
- C:\Windows\System\GQAJaWc.exe
  C:\Windows\System\GQAJaWc.exe
  2⤵
  PID:6920
- C:\Windows\System\oRWqOul.exe
  C:\Windows\System\oRWqOul.exe
  2⤵
  PID:7016
- C:\Windows\System\rNHvkHr.exe
  C:\Windows\System\rNHvkHr.exe
  2⤵
  PID:6808
- C:\Windows\System\adoYSLb.exe
  C:\Windows\System\adoYSLb.exe
  2⤵
  PID:7144
- C:\Windows\System\sVzQihk.exe
  C:\Windows\System\sVzQihk.exe
  2⤵
  PID:6468
- C:\Windows\System\ezlbudv.exe
  C:\Windows\System\ezlbudv.exe
  2⤵
  PID:5948
- C:\Windows\System\AcxlorY.exe
  C:\Windows\System\AcxlorY.exe
  2⤵
  PID:6280
- C:\Windows\System\RgZKPla.exe
  C:\Windows\System\RgZKPla.exe
  2⤵
  PID:6184
- C:\Windows\System\VGHrWPT.exe
  C:\Windows\System\VGHrWPT.exe
  2⤵
  PID:7036
- C:\Windows\System\DyZYjqV.exe
  C:\Windows\System\DyZYjqV.exe
  2⤵
  PID:7096
- C:\Windows\System\NKNHYoZ.exe
  C:\Windows\System\NKNHYoZ.exe
  2⤵
  PID:6264
- C:\Windows\System\IldaflJ.exe
  C:\Windows\System\IldaflJ.exe
  2⤵
  PID:6392
- C:\Windows\System\ihxOohU.exe
  C:\Windows\System\ihxOohU.exe
  2⤵
  PID:6456
- C:\Windows\System\ztrhHxq.exe
  C:\Windows\System\ztrhHxq.exe
  2⤵
  PID:6516
- C:\Windows\System\wmxBUGd.exe
  C:\Windows\System\wmxBUGd.exe
  2⤵
  PID:6600
- C:\Windows\System\OCyaZJd.exe
  C:\Windows\System\OCyaZJd.exe
  2⤵
  PID:6152
- C:\Windows\System\wRXSZyx.exe
  C:\Windows\System\wRXSZyx.exe
  2⤵
  PID:6180
- C:\Windows\System\KwOPKlk.exe
  C:\Windows\System\KwOPKlk.exe
  2⤵
  PID:6648
- C:\Windows\System\mOgySgl.exe
  C:\Windows\System\mOgySgl.exe
  2⤵
  PID:5276
- C:\Windows\System\JGaepmv.exe
  C:\Windows\System\JGaepmv.exe
  2⤵
  PID:6436
- C:\Windows\System\JOlEsKd.exe
  C:\Windows\System\JOlEsKd.exe
  2⤵
  PID:7172
- C:\Windows\System\CVAArTy.exe
  C:\Windows\System\CVAArTy.exe
  2⤵
  PID:7188
- C:\Windows\System\ZzyJhQi.exe
  C:\Windows\System\ZzyJhQi.exe
  2⤵
  PID:7204
- C:\Windows\System\YnbdwFv.exe
  C:\Windows\System\YnbdwFv.exe
  2⤵
  PID:7220
- C:\Windows\System\QuPXBNK.exe
  C:\Windows\System\QuPXBNK.exe
  2⤵
  PID:7244
- C:\Windows\System\VphmhUU.exe
  C:\Windows\System\VphmhUU.exe
  2⤵
  PID:7260
- C:\Windows\System\OjMNOdC.exe
  C:\Windows\System\OjMNOdC.exe
  2⤵
  PID:7392
- C:\Windows\System\wfVsNBP.exe
  C:\Windows\System\wfVsNBP.exe
  2⤵
  PID:7412
- C:\Windows\System\Ruhnbmx.exe
  C:\Windows\System\Ruhnbmx.exe
  2⤵
  PID:7432
- C:\Windows\System\nOMdmYg.exe
  C:\Windows\System\nOMdmYg.exe
  2⤵
  PID:7452
- C:\Windows\System\ooLyiAY.exe
  C:\Windows\System\ooLyiAY.exe
  2⤵
  PID:7468
- C:\Windows\System\SutxxWU.exe
  C:\Windows\System\SutxxWU.exe
  2⤵
  PID:7484
- C:\Windows\System\VkuFjdv.exe
  C:\Windows\System\VkuFjdv.exe
  2⤵
  PID:7500
- C:\Windows\System\DOqkara.exe
  C:\Windows\System\DOqkara.exe
  2⤵
  PID:7516
- C:\Windows\System\ptNFOoq.exe
  C:\Windows\System\ptNFOoq.exe
  2⤵
  PID:7536
- C:\Windows\System\Vzikhae.exe
  C:\Windows\System\Vzikhae.exe
  2⤵
  PID:7572
- C:\Windows\System\EblXBem.exe
  C:\Windows\System\EblXBem.exe
  2⤵
  PID:7588
- C:\Windows\System\cFJShTC.exe
  C:\Windows\System\cFJShTC.exe
  2⤵
  PID:7608
- C:\Windows\System\JsHYXlP.exe
  C:\Windows\System\JsHYXlP.exe
  2⤵
  PID:7624
- C:\Windows\System\cHcoSro.exe
  C:\Windows\System\cHcoSro.exe
  2⤵
  PID:7640
- C:\Windows\System\oNkPQYv.exe
  C:\Windows\System\oNkPQYv.exe
  2⤵
  PID:7656
- C:\Windows\System\SgkGnmJ.exe
  C:\Windows\System\SgkGnmJ.exe
  2⤵
  PID:7672
- C:\Windows\System\BCEatcK.exe
  C:\Windows\System\BCEatcK.exe
  2⤵
  PID:7688
- C:\Windows\System\FRYNjsC.exe
  C:\Windows\System\FRYNjsC.exe
  2⤵
  PID:7704
- C:\Windows\System\bNjTnoP.exe
  C:\Windows\System\bNjTnoP.exe
  2⤵
  PID:7724
- C:\Windows\System\qKOTslv.exe
  C:\Windows\System\qKOTslv.exe
  2⤵
  PID:7744
- C:\Windows\System\TBbWQRk.exe
  C:\Windows\System\TBbWQRk.exe
  2⤵
  PID:7760
- C:\Windows\System\fBABCSp.exe
  C:\Windows\System\fBABCSp.exe
  2⤵
  PID:7784
- C:\Windows\System\hnTafkH.exe
  C:\Windows\System\hnTafkH.exe
  2⤵
  PID:7800
- C:\Windows\System\oXnwVYr.exe
  C:\Windows\System\oXnwVYr.exe
  2⤵
  PID:7816
- C:\Windows\System\SRPRVKa.exe
  C:\Windows\System\SRPRVKa.exe
  2⤵
  PID:7832
- C:\Windows\System\rrwlGFk.exe
  C:\Windows\System\rrwlGFk.exe
  2⤵
  PID:7848
- C:\Windows\System\xrcazXW.exe
  C:\Windows\System\xrcazXW.exe
  2⤵
  PID:7868
- C:\Windows\System\sBnDFdJ.exe
  C:\Windows\System\sBnDFdJ.exe
  2⤵
  PID:7884
- C:\Windows\System\KohWztD.exe
  C:\Windows\System\KohWztD.exe
  2⤵
  PID:7900
- C:\Windows\System\vmTptdc.exe
  C:\Windows\System\vmTptdc.exe
  2⤵
  PID:7916
- C:\Windows\System\LaLuzdO.exe
  C:\Windows\System\LaLuzdO.exe
  2⤵
  PID:7932
- C:\Windows\System\KJxbcND.exe
  C:\Windows\System\KJxbcND.exe
  2⤵
  PID:7948
- C:\Windows\System\wgHrtwj.exe
  C:\Windows\System\wgHrtwj.exe
  2⤵
  PID:7964
- C:\Windows\System\okxNsCq.exe
  C:\Windows\System\okxNsCq.exe
  2⤵
  PID:7984
- C:\Windows\System\yJIEavP.exe
  C:\Windows\System\yJIEavP.exe
  2⤵
  PID:8000
- C:\Windows\System\pCNhOGM.exe
  C:\Windows\System\pCNhOGM.exe
  2⤵
  PID:8016
- C:\Windows\System\hYIxQuk.exe
  C:\Windows\System\hYIxQuk.exe
  2⤵
  PID:8044
- C:\Windows\System\JtILkFO.exe
  C:\Windows\System\JtILkFO.exe
  2⤵
  PID:8060
- C:\Windows\System\TGyImxi.exe
  C:\Windows\System\TGyImxi.exe
  2⤵
  PID:8076
- C:\Windows\System\femiSZp.exe
  C:\Windows\System\femiSZp.exe
  2⤵
  PID:8092
- C:\Windows\System\AaPykje.exe
  C:\Windows\System\AaPykje.exe
  2⤵
  PID:8148
- C:\Windows\System\LrRnxYJ.exe
  C:\Windows\System\LrRnxYJ.exe
  2⤵
  PID:8168
- C:\Windows\System\LAtFned.exe
  C:\Windows\System\LAtFned.exe
  2⤵
  PID:6580
- C:\Windows\System\gxZxJRc.exe
  C:\Windows\System\gxZxJRc.exe
  2⤵
  PID:6748
- C:\Windows\System\bXIENPs.exe
  C:\Windows\System\bXIENPs.exe
  2⤵
  PID:7000
- C:\Windows\System\PebLOhh.exe
  C:\Windows\System\PebLOhh.exe
  2⤵
  PID:7196
- C:\Windows\System\KtmwIOz.exe
  C:\Windows\System\KtmwIOz.exe
  2⤵
  PID:7236
- C:\Windows\System\CChFdfd.exe
  C:\Windows\System\CChFdfd.exe
  2⤵
  PID:6876
- C:\Windows\System\fkOQrcC.exe
  C:\Windows\System\fkOQrcC.exe
  2⤵
  PID:7284
- C:\Windows\System\uZmtWpV.exe
  C:\Windows\System\uZmtWpV.exe
  2⤵
  PID:7292
- C:\Windows\System\zWmrwZa.exe
  C:\Windows\System\zWmrwZa.exe
  2⤵
  PID:7320
- C:\Windows\System\tJIMZzF.exe
  C:\Windows\System\tJIMZzF.exe
  2⤵
  PID:7340
- C:\Windows\System\XEYVIYF.exe
  C:\Windows\System\XEYVIYF.exe
  2⤵
  PID:5600
- C:\Windows\System\gtdJXxR.exe
  C:\Windows\System\gtdJXxR.exe
  2⤵
  PID:6628
- C:\Windows\System\gfPZmuT.exe
  C:\Windows\System\gfPZmuT.exe
  2⤵
  PID:7408
- C:\Windows\System\BoNgABh.exe
  C:\Windows\System\BoNgABh.exe
  2⤵
  PID:7512
- C:\Windows\System\RmzxFon.exe
  C:\Windows\System\RmzxFon.exe
  2⤵
  PID:7944
- C:\Windows\System\SDhyDyr.exe
  C:\Windows\System\SDhyDyr.exe
  2⤵
  PID:7544
- C:\Windows\System\kMAZKOi.exe
  C:\Windows\System\kMAZKOi.exe
  2⤵
  PID:7404
- C:\Windows\System\FFrYGhR.exe
  C:\Windows\System\FFrYGhR.exe
  2⤵
  PID:7796
- C:\Windows\System\tjktuxI.exe
  C:\Windows\System\tjktuxI.exe
  2⤵
  PID:7716
- C:\Windows\System\KinRdvS.exe
  C:\Windows\System\KinRdvS.exe
  2⤵
  PID:7620
- C:\Windows\System\vfSsYDx.exe
  C:\Windows\System\vfSsYDx.exe
  2⤵
  PID:7528
- C:\Windows\System\MXWXJQg.exe
  C:\Windows\System\MXWXJQg.exe
  2⤵
  PID:7460
- C:\Windows\System\aZZKykM.exe
  C:\Windows\System\aZZKykM.exe
  2⤵
  PID:7856
- C:\Windows\System\frhcgRg.exe
  C:\Windows\System\frhcgRg.exe
  2⤵
  PID:7908
- C:\Windows\System\AIjnIsL.exe
  C:\Windows\System\AIjnIsL.exe
  2⤵
  PID:7924
- C:\Windows\System\xarGHAQ.exe
  C:\Windows\System\xarGHAQ.exe
  2⤵
  PID:7376
- C:\Windows\System\ZDecvnM.exe
  C:\Windows\System\ZDecvnM.exe
  2⤵
  PID:8132
- C:\Windows\System\JrXYvbu.exe
  C:\Windows\System\JrXYvbu.exe
  2⤵
  PID:7232
- C:\Windows\System\qkEwHry.exe
  C:\Windows\System\qkEwHry.exe
  2⤵
  PID:6532
- C:\Windows\System\cDOeNsS.exe
  C:\Windows\System\cDOeNsS.exe
  2⤵
  PID:7304
- C:\Windows\System\sePOccU.exe
  C:\Windows\System\sePOccU.exe
  2⤵
  PID:7256
- C:\Windows\System\YBKWocI.exe
  C:\Windows\System\YBKWocI.exe
  2⤵
  PID:6584
- C:\Windows\System\sxwlnqt.exe
  C:\Windows\System\sxwlnqt.exe
  2⤵
  PID:6988
- C:\Windows\System\eAxPtFY.exe
  C:\Windows\System\eAxPtFY.exe
  2⤵
  PID:7696
- C:\Windows\System\IxPQWpx.exe
  C:\Windows\System\IxPQWpx.exe
  2⤵
  PID:7768
- C:\Windows\System\IVzzfAp.exe
  C:\Windows\System\IVzzfAp.exe
  2⤵
  PID:7584
- C:\Windows\System\jQyddTu.exe
  C:\Windows\System\jQyddTu.exe
  2⤵
  PID:7556
- C:\Windows\System\OWdZHzP.exe
  C:\Windows\System\OWdZHzP.exe
  2⤵
  PID:7892
- C:\Windows\System\GysCcmZ.exe
  C:\Windows\System\GysCcmZ.exe
  2⤵
  PID:7636
- C:\Windows\System\cvCBMHE.exe
  C:\Windows\System\cvCBMHE.exe
  2⤵
  PID:7052
- C:\Windows\System\iWHrfSy.exe
  C:\Windows\System\iWHrfSy.exe
  2⤵
  PID:7580
- C:\Windows\System\NdhQtwp.exe
  C:\Windows\System\NdhQtwp.exe
  2⤵
  PID:8056
- C:\Windows\System\gfINkTR.exe
  C:\Windows\System\gfINkTR.exe
  2⤵
  PID:7444
- C:\Windows\System\dqjYNQe.exe
  C:\Windows\System\dqjYNQe.exe
  2⤵
  PID:7980
- C:\Windows\System\NGDltCi.exe
  C:\Windows\System\NGDltCi.exe
  2⤵
  PID:7384
- C:\Windows\System\aUVDulk.exe
  C:\Windows\System\aUVDulk.exe
  2⤵
  PID:7492
- C:\Windows\System\jMtVfxs.exe
  C:\Windows\System\jMtVfxs.exe
  2⤵
  PID:7464
- C:\Windows\System\TIObDTz.exe
  C:\Windows\System\TIObDTz.exe
  2⤵
  PID:8112
- C:\Windows\System\RTlvvup.exe
  C:\Windows\System\RTlvvup.exe
  2⤵
  PID:8144
- C:\Windows\System\ruaHpxx.exe
  C:\Windows\System\ruaHpxx.exe
  2⤵
  PID:7288
- C:\Windows\System\aOMPRCg.exe
  C:\Windows\System\aOMPRCg.exe
  2⤵
  PID:6340
- C:\Windows\System\yQdLxrS.exe
  C:\Windows\System\yQdLxrS.exe
  2⤵
  PID:6956
- C:\Windows\System\gPUhQLo.exe
  C:\Windows\System\gPUhQLo.exe
  2⤵
  PID:8184
- C:\Windows\System\NKYtbop.exe
  C:\Windows\System\NKYtbop.exe
  2⤵
  PID:6904
- C:\Windows\System\szxApuR.exe
  C:\Windows\System\szxApuR.exe
  2⤵
  PID:7132
- C:\Windows\System\IOumACq.exe
  C:\Windows\System\IOumACq.exe
  2⤵
  PID:7600
- C:\Windows\System\zDtPjCp.exe
  C:\Windows\System\zDtPjCp.exe
  2⤵
  PID:7840
- C:\Windows\System\YeOjdvj.exe
  C:\Windows\System\YeOjdvj.exe
  2⤵
  PID:6452
- C:\Windows\System\pMySEDU.exe
  C:\Windows\System\pMySEDU.exe
  2⤵
  PID:7352
- C:\Windows\System\jEVwmRl.exe
  C:\Windows\System\jEVwmRl.exe
  2⤵
  PID:8164
- C:\Windows\System\wuVajtq.exe
  C:\Windows\System\wuVajtq.exe
  2⤵
  PID:7732
- C:\Windows\System\jMJkkop.exe
  C:\Windows\System\jMJkkop.exe
  2⤵
  PID:7860
- C:\Windows\System\daDgQcs.exe
  C:\Windows\System\daDgQcs.exe
  2⤵
  PID:7712
- C:\Windows\System\ZyEXwHn.exe
  C:\Windows\System\ZyEXwHn.exe
  2⤵
  PID:8104
- C:\Windows\System\IdVYumK.exe
  C:\Windows\System\IdVYumK.exe
  2⤵
  PID:6248
- C:\Windows\System\laBGmJb.exe
  C:\Windows\System\laBGmJb.exe
  2⤵
  PID:7032
- C:\Windows\System\GDVgtSM.exe
  C:\Windows\System\GDVgtSM.exe
  2⤵
  PID:7568
- C:\Windows\System\NPYUOKp.exe
  C:\Windows\System\NPYUOKp.exe
  2⤵
  PID:6388
- C:\Windows\System\aCSgktZ.exe
  C:\Windows\System\aCSgktZ.exe
  2⤵
  PID:7064
- C:\Windows\System\biXEPCK.exe
  C:\Windows\System\biXEPCK.exe
  2⤵
  PID:8040
- C:\Windows\System\nCvAeUu.exe
  C:\Windows\System\nCvAeUu.exe
  2⤵
  PID:8036
- C:\Windows\System\qxtNcQM.exe
  C:\Windows\System\qxtNcQM.exe
  2⤵
  PID:8072
- C:\Windows\System\cYmGctZ.exe
  C:\Windows\System\cYmGctZ.exe
  2⤵
  PID:7336
- C:\Windows\System\mbJjQTm.exe
  C:\Windows\System\mbJjQTm.exe
  2⤵
  PID:7496
- C:\Windows\System\bLkTsvS.exe
  C:\Windows\System\bLkTsvS.exe
  2⤵
  PID:7356
- C:\Windows\System\dfboqJo.exe
  C:\Windows\System\dfboqJo.exe
  2⤵
  PID:7940
- C:\Windows\System\XfGBQGP.exe
  C:\Windows\System\XfGBQGP.exe
  2⤵
  PID:7720
- C:\Windows\System\eZmSire.exe
  C:\Windows\System\eZmSire.exe
  2⤵
  PID:7112
- C:\Windows\System\sVPbGEI.exe
  C:\Windows\System\sVPbGEI.exe
  2⤵
  PID:8204
- C:\Windows\System\JNreLIu.exe
  C:\Windows\System\JNreLIu.exe
  2⤵
  PID:8220
- C:\Windows\System\gausEAH.exe
  C:\Windows\System\gausEAH.exe
  2⤵
  PID:8236
- C:\Windows\System\gUnkuPp.exe
  C:\Windows\System\gUnkuPp.exe
  2⤵
  PID:8252
- C:\Windows\System\CntTRQC.exe
  C:\Windows\System\CntTRQC.exe
  2⤵
  PID:8268
- C:\Windows\System\ksiMMZn.exe
  C:\Windows\System\ksiMMZn.exe
  2⤵
  PID:8284
- C:\Windows\System\xgqwEKh.exe
  C:\Windows\System\xgqwEKh.exe
  2⤵
  PID:8300
- C:\Windows\System\sSiBhip.exe
  C:\Windows\System\sSiBhip.exe
  2⤵
  PID:8316
- C:\Windows\System\BiLUSlb.exe
  C:\Windows\System\BiLUSlb.exe
  2⤵
  PID:8336
- C:\Windows\System\XHUiWhO.exe
  C:\Windows\System\XHUiWhO.exe
  2⤵
  PID:8352
- C:\Windows\System\QrLgFlw.exe
  C:\Windows\System\QrLgFlw.exe
  2⤵
  PID:8368
- C:\Windows\System\KtaqsVZ.exe
  C:\Windows\System\KtaqsVZ.exe
  2⤵
  PID:8396
- C:\Windows\System\TbLsMVE.exe
  C:\Windows\System\TbLsMVE.exe
  2⤵
  PID:8412
- C:\Windows\System\HTIpdOG.exe
  C:\Windows\System\HTIpdOG.exe
  2⤵
  PID:8428
- C:\Windows\System\uqHXJtP.exe
  C:\Windows\System\uqHXJtP.exe
  2⤵
  PID:8444
- C:\Windows\System\bhLTncK.exe
  C:\Windows\System\bhLTncK.exe
  2⤵
  PID:8464
- C:\Windows\System\zlRSHRR.exe
  C:\Windows\System\zlRSHRR.exe
  2⤵
  PID:8484
- C:\Windows\System\pAsJtcq.exe
  C:\Windows\System\pAsJtcq.exe
  2⤵
  PID:8504
- C:\Windows\System\toEUgpN.exe
  C:\Windows\System\toEUgpN.exe
  2⤵
  PID:8520
- C:\Windows\System\jzdkaMo.exe
  C:\Windows\System\jzdkaMo.exe
  2⤵
  PID:8536
- C:\Windows\System\schFPDX.exe
  C:\Windows\System\schFPDX.exe
  2⤵
  PID:8556
- C:\Windows\System\klzuCVF.exe
  C:\Windows\System\klzuCVF.exe
  2⤵
  PID:8572
- C:\Windows\System\BxfjAzQ.exe
  C:\Windows\System\BxfjAzQ.exe
  2⤵
  PID:8588
- C:\Windows\System\jBYNvai.exe
  C:\Windows\System\jBYNvai.exe
  2⤵
  PID:8608
- C:\Windows\System\CAVKIRy.exe
  C:\Windows\System\CAVKIRy.exe
  2⤵
  PID:8628
- C:\Windows\System\gGGOkVi.exe
  C:\Windows\System\gGGOkVi.exe
  2⤵
  PID:8644
- C:\Windows\System\SImhjKM.exe
  C:\Windows\System\SImhjKM.exe
  2⤵
  PID:8660
- C:\Windows\System\gbcBPcN.exe
  C:\Windows\System\gbcBPcN.exe
  2⤵
  PID:8680
- C:\Windows\System\DWDSvoe.exe
  C:\Windows\System\DWDSvoe.exe
  2⤵
  PID:8696
- C:\Windows\System\KZRetjG.exe
  C:\Windows\System\KZRetjG.exe
  2⤵
  PID:8716
- C:\Windows\System\snyFQJX.exe
  C:\Windows\System\snyFQJX.exe
  2⤵
  PID:8732
- C:\Windows\System\NhdcLEY.exe
  C:\Windows\System\NhdcLEY.exe
  2⤵
  PID:8748
- C:\Windows\System\zKTGuGf.exe
  C:\Windows\System\zKTGuGf.exe
  2⤵
  PID:8764
- C:\Windows\System\sPrTIzb.exe
  C:\Windows\System\sPrTIzb.exe
  2⤵
  PID:8780
- C:\Windows\System\lvHWKAw.exe
  C:\Windows\System\lvHWKAw.exe
  2⤵
  PID:8796
- C:\Windows\System\wKBrtGm.exe
  C:\Windows\System\wKBrtGm.exe
  2⤵
  PID:8820
- C:\Windows\System\HMKBKMg.exe
  C:\Windows\System\HMKBKMg.exe
  2⤵
  PID:8836
- C:\Windows\System\ZZuPSpi.exe
  C:\Windows\System\ZZuPSpi.exe
  2⤵
  PID:8852
- C:\Windows\System\XianHaU.exe
  C:\Windows\System\XianHaU.exe
  2⤵
  PID:8868
- C:\Windows\System\FDxIsOQ.exe
  C:\Windows\System\FDxIsOQ.exe
  2⤵
  PID:8888
- C:\Windows\System\jdHlmNd.exe
  C:\Windows\System\jdHlmNd.exe
  2⤵
  PID:8904
- C:\Windows\System\pFapUFi.exe
  C:\Windows\System\pFapUFi.exe
  2⤵
  PID:8928
- C:\Windows\System\pulPPBK.exe
  C:\Windows\System\pulPPBK.exe
  2⤵
  PID:8944
- C:\Windows\System\CIveJrQ.exe
  C:\Windows\System\CIveJrQ.exe
  2⤵
  PID:8964
- C:\Windows\System\eAyZQtM.exe
  C:\Windows\System\eAyZQtM.exe
  2⤵
  PID:8980
- C:\Windows\System\xIzWRCe.exe
  C:\Windows\System\xIzWRCe.exe
  2⤵
  PID:8996
- C:\Windows\System\ASfZtOx.exe
  C:\Windows\System\ASfZtOx.exe
  2⤵
  PID:9012
- C:\Windows\System\gaabFlt.exe
  C:\Windows\System\gaabFlt.exe
  2⤵
  PID:9028
- C:\Windows\System\tJjryts.exe
  C:\Windows\System\tJjryts.exe
  2⤵
  PID:9044
- C:\Windows\System\IpFGhQS.exe
  C:\Windows\System\IpFGhQS.exe
  2⤵
  PID:9060
- C:\Windows\System\yWDdtQw.exe
  C:\Windows\System\yWDdtQw.exe
  2⤵
  PID:9076
- C:\Windows\System\eiJyTuI.exe
  C:\Windows\System\eiJyTuI.exe
  2⤵
  PID:9092
- C:\Windows\System\PQgeYPw.exe
  C:\Windows\System\PQgeYPw.exe
  2⤵
  PID:9108
- C:\Windows\System\tiuVzIw.exe
  C:\Windows\System\tiuVzIw.exe
  2⤵
  PID:9124
- C:\Windows\System\KrRktVG.exe
  C:\Windows\System\KrRktVG.exe
  2⤵
  PID:9140
- C:\Windows\System\MTHdFJP.exe
  C:\Windows\System\MTHdFJP.exe
  2⤵
  PID:9156
- C:\Windows\System\mCbMDFo.exe
  C:\Windows\System\mCbMDFo.exe
  2⤵
  PID:9172
- C:\Windows\System\CCCvyRw.exe
  C:\Windows\System\CCCvyRw.exe
  2⤵
  PID:9188
- C:\Windows\System\fKsaPHw.exe
  C:\Windows\System\fKsaPHw.exe
  2⤵
  PID:9204
- C:\Windows\System\ekmhtXW.exe
  C:\Windows\System\ekmhtXW.exe
  2⤵
  PID:8216
- C:\Windows\System\ASuqnOI.exe
  C:\Windows\System\ASuqnOI.exe
  2⤵
  PID:8276
- C:\Windows\System\WPRnWCI.exe
  C:\Windows\System\WPRnWCI.exe
  2⤵
  PID:8344
- C:\Windows\System\iymYPXh.exe
  C:\Windows\System\iymYPXh.exe
  2⤵
  PID:6972
- C:\Windows\System\zShaSoz.exe
  C:\Windows\System\zShaSoz.exe
  2⤵
  PID:7756
- C:\Windows\System\irQhsAS.exe
  C:\Windows\System\irQhsAS.exe
  2⤵
  PID:8052
- C:\Windows\System\FAypseW.exe
  C:\Windows\System\FAypseW.exe
  2⤵
  PID:7212
- C:\Windows\System\tRRIUZM.exe
  C:\Windows\System\tRRIUZM.exe
  2⤵
  PID:8012
- C:\Windows\System\VpOPraU.exe
  C:\Windows\System\VpOPraU.exe
  2⤵
  PID:8028
- C:\Windows\System\ELreAmJ.exe
  C:\Windows\System\ELreAmJ.exe
  2⤵
  PID:932
- C:\Windows\System\oPeOPEy.exe
  C:\Windows\System\oPeOPEy.exe
  2⤵
  PID:7116
- C:\Windows\System\ivdspRd.exe
  C:\Windows\System\ivdspRd.exe
  2⤵
  PID:8068
- C:\Windows\System\UdEFYLi.exe
  C:\Windows\System\UdEFYLi.exe
  2⤵
  PID:7996
- C:\Windows\System\cuBlcms.exe
  C:\Windows\System\cuBlcms.exe
  2⤵
  PID:8180
- C:\Windows\System\ZcACXPI.exe
  C:\Windows\System\ZcACXPI.exe
  2⤵
  PID:7216
- C:\Windows\System\pCiXdpC.exe
  C:\Windows\System\pCiXdpC.exe
  2⤵
  PID:8232
- C:\Windows\System\WqlyzOB.exe
  C:\Windows\System\WqlyzOB.exe
  2⤵
  PID:8384
- C:\Windows\System\XTSKfNg.exe
  C:\Windows\System\XTSKfNg.exe
  2⤵
  PID:8228
- C:\Windows\System\spJjMlA.exe
  C:\Windows\System\spJjMlA.exe
  2⤵
  PID:8492
- C:\Windows\System\xSqNHkn.exe
  C:\Windows\System\xSqNHkn.exe
  2⤵
  PID:8532
- C:\Windows\System\iXXxYDS.exe
  C:\Windows\System\iXXxYDS.exe
  2⤵
  PID:8596
- C:\Windows\System\AHnezrE.exe
  C:\Windows\System\AHnezrE.exe
  2⤵
  PID:8640
- C:\Windows\System\rgsyKHZ.exe
  C:\Windows\System\rgsyKHZ.exe
  2⤵
  PID:8704
- C:\Windows\System\YXUupLE.exe
  C:\Windows\System\YXUupLE.exe
  2⤵
  PID:8744
- C:\Windows\System\LAxdsff.exe
  C:\Windows\System\LAxdsff.exe
  2⤵
  PID:8808
- C:\Windows\System\ezRnsre.exe
  C:\Windows\System\ezRnsre.exe
  2⤵
  PID:8724
- C:\Windows\System\afGhGjK.exe
  C:\Windows\System\afGhGjK.exe
  2⤵
  PID:8880
- C:\Windows\System\hwxtDXk.exe
  C:\Windows\System\hwxtDXk.exe
  2⤵
  PID:8884
- C:\Windows\System\JxtWtbl.exe
  C:\Windows\System\JxtWtbl.exe
  2⤵
  PID:8480
- C:\Windows\System\hmeKZMF.exe
  C:\Windows\System\hmeKZMF.exe
  2⤵
  PID:8548
- C:\Windows\System\ElodHto.exe
  C:\Windows\System\ElodHto.exe
  2⤵
  PID:8620
- C:\Windows\System\DCjIpyP.exe
  C:\Windows\System\DCjIpyP.exe
  2⤵
  PID:8692
- C:\Windows\System\qfHJGww.exe
  C:\Windows\System\qfHJGww.exe
  2⤵
  PID:8760
- C:\Windows\System\uyFkmgj.exe
  C:\Windows\System\uyFkmgj.exe
  2⤵
  PID:8924
- C:\Windows\System\VWfVdKH.exe
  C:\Windows\System\VWfVdKH.exe
  2⤵
  PID:8900
- C:\Windows\System\WjSrzMS.exe
  C:\Windows\System\WjSrzMS.exe
  2⤵
  PID:8960
- C:\Windows\System\penHnKS.exe
  C:\Windows\System\penHnKS.exe
  2⤵
  PID:8976
- C:\Windows\System\HTNCPzB.exe
  C:\Windows\System\HTNCPzB.exe
  2⤵
  PID:9084
- C:\Windows\System\GNGMLVm.exe
  C:\Windows\System\GNGMLVm.exe
  2⤵
  PID:9152
- C:\Windows\System\vVMXAAA.exe
  C:\Windows\System\vVMXAAA.exe
  2⤵
  PID:9184
- C:\Windows\System\dJxWurm.exe
  C:\Windows\System\dJxWurm.exe
  2⤵
  PID:9072
- C:\Windows\System\uTxxDac.exe
  C:\Windows\System\uTxxDac.exe
  2⤵
  PID:9136
- C:\Windows\System\sswcUJI.exe
  C:\Windows\System\sswcUJI.exe
  2⤵
  PID:8212
- C:\Windows\System\qlPsHGK.exe
  C:\Windows\System\qlPsHGK.exe
  2⤵
  PID:8312
- C:\Windows\System\CAMVwCj.exe
  C:\Windows\System\CAMVwCj.exe
  2⤵
  PID:8328
- C:\Windows\System\JuFqUoQ.exe
  C:\Windows\System\JuFqUoQ.exe
  2⤵
  PID:8380
- C:\Windows\System\bkzBrKd.exe
  C:\Windows\System\bkzBrKd.exe
  2⤵
  PID:7480
- C:\Windows\System\dGyRmRQ.exe
  C:\Windows\System\dGyRmRQ.exe
  2⤵
  PID:6016
- C:\Windows\System\MJEYvNu.exe
  C:\Windows\System\MJEYvNu.exe
  2⤵
  PID:7548
- C:\Windows\System\nVAGrrM.exe
  C:\Windows\System\nVAGrrM.exe
  2⤵
  PID:8392
- C:\Windows\System\iYsLRLJ.exe
  C:\Windows\System\iYsLRLJ.exe
  2⤵
  PID:7316
- C:\Windows\System\bXCicDG.exe
  C:\Windows\System\bXCicDG.exe
  2⤵
  PID:8264
- C:\Windows\System\aFwsCRt.exe
  C:\Windows\System\aFwsCRt.exe
  2⤵
  PID:8672
- C:\Windows\System\krnhhLG.exe
  C:\Windows\System\krnhhLG.exe
  2⤵
  PID:8804
- C:\Windows\System\hxNVJtk.exe
  C:\Windows\System\hxNVJtk.exe
  2⤵
  PID:8712
- C:\Windows\System\VfjrvJl.exe
  C:\Windows\System\VfjrvJl.exe
  2⤵
  PID:8688
- C:\Windows\System\yEZnWLE.exe
  C:\Windows\System\yEZnWLE.exe
  2⤵
  PID:8740
- C:\Windows\System\BlZtebd.exe
  C:\Windows\System\BlZtebd.exe
  2⤵
  PID:8616
- C:\Windows\System\VQgOaes.exe
  C:\Windows\System\VQgOaes.exe
  2⤵
  PID:8920
- C:\Windows\System\gaxjvmd.exe
  C:\Windows\System\gaxjvmd.exe
  2⤵
  PID:8652
- C:\Windows\System\ztuwROg.exe
  C:\Windows\System\ztuwROg.exe
  2⤵
  PID:8828
- C:\Windows\System\hQUAgKA.exe
  C:\Windows\System\hQUAgKA.exe
  2⤵
  PID:8988
- C:\Windows\System\bflPalo.exe
  C:\Windows\System\bflPalo.exe
  2⤵
  PID:9116
- C:\Windows\System\rtUVJHS.exe
  C:\Windows\System\rtUVJHS.exe
  2⤵
  PID:9068
- C:\Windows\System\GbzXiAj.exe
  C:\Windows\System\GbzXiAj.exe
  2⤵
  PID:8248
- C:\Windows\System\CqjbInp.exe
  C:\Windows\System\CqjbInp.exe
  2⤵
  PID:9180
- C:\Windows\System\lKoZrTb.exe
  C:\Windows\System\lKoZrTb.exe
  2⤵
  PID:9132
- C:\Windows\System\ksSPsEZ.exe
  C:\Windows\System\ksSPsEZ.exe
  2⤵
  PID:7896
- C:\Windows\System\qBXnJPk.exe
  C:\Windows\System\qBXnJPk.exe
  2⤵
  PID:8424
- C:\Windows\System\CTIvjeT.exe
  C:\Windows\System\CTIvjeT.exe
  2⤵
  PID:8604
- C:\Windows\System\tjodDCV.exe
  C:\Windows\System\tjodDCV.exe
  2⤵
  PID:8260
- C:\Windows\System\jJXtsdu.exe
  C:\Windows\System\jJXtsdu.exe
  2⤵
  PID:6260
- C:\Windows\System\txNjxSF.exe
  C:\Windows\System\txNjxSF.exe
  2⤵
  PID:8776
- C:\Windows\System\XpYbOXz.exe
  C:\Windows\System\XpYbOXz.exe
  2⤵
  PID:8584
- C:\Windows\System\AedkcLP.exe
  C:\Windows\System\AedkcLP.exe
  2⤵
  PID:9212
- C:\Windows\System\johPvJC.exe
  C:\Windows\System\johPvJC.exe
  2⤵
  PID:8940
- C:\Windows\System\Kxojqjn.exe
  C:\Windows\System\Kxojqjn.exe
  2⤵
  PID:7252
- C:\Windows\System\BUnljns.exe
  C:\Windows\System\BUnljns.exe
  2⤵
  PID:8324
- C:\Windows\System\rOPLDvu.exe
  C:\Windows\System\rOPLDvu.exe
  2⤵
  PID:944
- C:\Windows\System\ruKADPk.exe
  C:\Windows\System\ruKADPk.exe
  2⤵
  PID:8364
- C:\Windows\System\pLwSToX.exe
  C:\Windows\System\pLwSToX.exe
  2⤵
  PID:8440
- C:\Windows\System\jwHpeLd.exe
  C:\Windows\System\jwHpeLd.exe
  2⤵
  PID:8792
- C:\Windows\System\NBrAppF.exe
  C:\Windows\System\NBrAppF.exe
  2⤵
  PID:5980
- C:\Windows\System\MldarAh.exe
  C:\Windows\System\MldarAh.exe
  2⤵
  PID:9024
- C:\Windows\System\jzpxAUW.exe
  C:\Windows\System\jzpxAUW.exe
  2⤵
  PID:9148
- C:\Windows\System\JwCKhWp.exe
  C:\Windows\System\JwCKhWp.exe
  2⤵
  PID:9232
- C:\Windows\System\iUXsOdQ.exe
  C:\Windows\System\iUXsOdQ.exe
  2⤵
  PID:9248
- C:\Windows\System\jaZNcLr.exe
  C:\Windows\System\jaZNcLr.exe
  2⤵
  PID:9264
- C:\Windows\System\aIWJsHb.exe
  C:\Windows\System\aIWJsHb.exe
  2⤵
  PID:9280
- C:\Windows\System\YynwTzc.exe
  C:\Windows\System\YynwTzc.exe
  2⤵
  PID:9296
- C:\Windows\System\bwSrbeG.exe
  C:\Windows\System\bwSrbeG.exe
  2⤵
  PID:9312
- C:\Windows\System\KbeGgwB.exe
  C:\Windows\System\KbeGgwB.exe
  2⤵
  PID:9328
- C:\Windows\System\kZZGbfA.exe
  C:\Windows\System\kZZGbfA.exe
  2⤵
  PID:9344
- C:\Windows\System\DdzGjEK.exe
  C:\Windows\System\DdzGjEK.exe
  2⤵
  PID:9360
- C:\Windows\System\egklhAR.exe
  C:\Windows\System\egklhAR.exe
  2⤵
  PID:9376
- C:\Windows\System\epLxPIq.exe
  C:\Windows\System\epLxPIq.exe
  2⤵
  PID:9392
- C:\Windows\System\bOONedE.exe
  C:\Windows\System\bOONedE.exe
  2⤵
  PID:9408
- C:\Windows\System\vOQbHHY.exe
  C:\Windows\System\vOQbHHY.exe
  2⤵
  PID:9424
- C:\Windows\System\UXezXyL.exe
  C:\Windows\System\UXezXyL.exe
  2⤵
  PID:9440
- C:\Windows\System\LKWygEj.exe
  C:\Windows\System\LKWygEj.exe
  2⤵
  PID:9456
- C:\Windows\System\CFgHVPT.exe
  C:\Windows\System\CFgHVPT.exe
  2⤵
  PID:9472
- C:\Windows\System\lmbNUMA.exe
  C:\Windows\System\lmbNUMA.exe
  2⤵
  PID:9488
- C:\Windows\System\CZmHOLC.exe
  C:\Windows\System\CZmHOLC.exe
  2⤵
  PID:9504
- C:\Windows\System\WbuCpTT.exe
  C:\Windows\System\WbuCpTT.exe
  2⤵
  PID:9520
- C:\Windows\System\ZGkNhxw.exe
  C:\Windows\System\ZGkNhxw.exe
  2⤵
  PID:9536
- C:\Windows\System\SzvvqyZ.exe
  C:\Windows\System\SzvvqyZ.exe
  2⤵
  PID:9552
- C:\Windows\System\dSyQnAg.exe
  C:\Windows\System\dSyQnAg.exe
  2⤵
  PID:9568
- C:\Windows\System\IiNpnev.exe
  C:\Windows\System\IiNpnev.exe
  2⤵
  PID:9584
- C:\Windows\System\VCMQstu.exe
  C:\Windows\System\VCMQstu.exe
  2⤵
  PID:9600
- C:\Windows\System\uCvKUER.exe
  C:\Windows\System\uCvKUER.exe
  2⤵
  PID:9616
- C:\Windows\System\ysrLheF.exe
  C:\Windows\System\ysrLheF.exe
  2⤵
  PID:9632
- C:\Windows\System\SGKkcxi.exe
  C:\Windows\System\SGKkcxi.exe
  2⤵
  PID:9648
- C:\Windows\System\RwpeFPn.exe
  C:\Windows\System\RwpeFPn.exe
  2⤵
  PID:9664
- C:\Windows\System\WikEarZ.exe
  C:\Windows\System\WikEarZ.exe
  2⤵
  PID:9680
- C:\Windows\System\RmiQOlz.exe
  C:\Windows\System\RmiQOlz.exe
  2⤵
  PID:9696
- C:\Windows\System\ZohAsJk.exe
  C:\Windows\System\ZohAsJk.exe
  2⤵
  PID:9712
- C:\Windows\System\xkpvOTp.exe
  C:\Windows\System\xkpvOTp.exe
  2⤵
  PID:9728
- C:\Windows\System\WXLmcaW.exe
  C:\Windows\System\WXLmcaW.exe
  2⤵
  PID:9744
- C:\Windows\System\TqSfdUb.exe
  C:\Windows\System\TqSfdUb.exe
  2⤵
  PID:9764
- C:\Windows\System\dBhPsdb.exe
  C:\Windows\System\dBhPsdb.exe
  2⤵
  PID:9780
- C:\Windows\System\tVarOtl.exe
  C:\Windows\System\tVarOtl.exe
  2⤵
  PID:9796
- C:\Windows\System\YygavyF.exe
  C:\Windows\System\YygavyF.exe
  2⤵
  PID:9812
- C:\Windows\System\QtFSVxX.exe
  C:\Windows\System\QtFSVxX.exe
  2⤵
  PID:9828
- C:\Windows\System\OLJCezx.exe
  C:\Windows\System\OLJCezx.exe
  2⤵
  PID:9844
- C:\Windows\System\SnmUoFB.exe
  C:\Windows\System\SnmUoFB.exe
  2⤵
  PID:9860
- C:\Windows\System\PZdvfEm.exe
  C:\Windows\System\PZdvfEm.exe
  2⤵
  PID:9876
- C:\Windows\System\SNmsiEE.exe
  C:\Windows\System\SNmsiEE.exe
  2⤵
  PID:9892
- C:\Windows\System\MgmIarR.exe
  C:\Windows\System\MgmIarR.exe
  2⤵
  PID:9912
- C:\Windows\System\YeoNJRL.exe
  C:\Windows\System\YeoNJRL.exe
  2⤵
  PID:9928
- C:\Windows\System\hPeZNni.exe
  C:\Windows\System\hPeZNni.exe
  2⤵
  PID:9944
- C:\Windows\System\cMumZug.exe
  C:\Windows\System\cMumZug.exe
  2⤵
  PID:9960
- C:\Windows\System\cUathaU.exe
  C:\Windows\System\cUathaU.exe
  2⤵
  PID:9976
- C:\Windows\System\ljCSMqS.exe
  C:\Windows\System\ljCSMqS.exe
  2⤵
  PID:9992
- C:\Windows\System\GiQlnAZ.exe
  C:\Windows\System\GiQlnAZ.exe
  2⤵
  PID:10008
- C:\Windows\System\vXonBox.exe
  C:\Windows\System\vXonBox.exe
  2⤵
  PID:10024
- C:\Windows\System\fpGsHbw.exe
  C:\Windows\System\fpGsHbw.exe
  2⤵
  PID:10040
- C:\Windows\System\tYFRYmw.exe
  C:\Windows\System\tYFRYmw.exe
  2⤵
  PID:10056
- C:\Windows\System\vLidjGS.exe
  C:\Windows\System\vLidjGS.exe
  2⤵
  PID:10072
- C:\Windows\System\OTBSWjT.exe
  C:\Windows\System\OTBSWjT.exe
  2⤵
  PID:10088
- C:\Windows\System\qNdGjph.exe
  C:\Windows\System\qNdGjph.exe
  2⤵
  PID:10104
- C:\Windows\System\FJKHjtk.exe
  C:\Windows\System\FJKHjtk.exe
  2⤵
  PID:10120
- C:\Windows\System\uolpbee.exe
  C:\Windows\System\uolpbee.exe
  2⤵
  PID:10136
- C:\Windows\System\PQMdbCA.exe
  C:\Windows\System\PQMdbCA.exe
  2⤵
  PID:10152
- C:\Windows\System\uCRuZcW.exe
  C:\Windows\System\uCRuZcW.exe
  2⤵
  PID:10168
- C:\Windows\System\LNYuEPH.exe
  C:\Windows\System\LNYuEPH.exe
  2⤵
  PID:10184
- C:\Windows\System\NCqWzVZ.exe
  C:\Windows\System\NCqWzVZ.exe
  2⤵
  PID:10200
- C:\Windows\System\ANsQHND.exe
  C:\Windows\System\ANsQHND.exe
  2⤵
  PID:10216
- C:\Windows\System\ZfgjDwd.exe
  C:\Windows\System\ZfgjDwd.exe
  2⤵
  PID:10232
- C:\Windows\System\VWJSzXP.exe
  C:\Windows\System\VWJSzXP.exe
  2⤵
  PID:7880
- C:\Windows\System\QLMJTlQ.exe
  C:\Windows\System\QLMJTlQ.exe
  2⤵
  PID:8544
- C:\Windows\System\itfUFpj.exe
  C:\Windows\System\itfUFpj.exe
  2⤵
  PID:9244
- C:\Windows\System\oXQWraL.exe
  C:\Windows\System\oXQWraL.exe
  2⤵
  PID:9304
- C:\Windows\System\ZCWYAfm.exe
  C:\Windows\System\ZCWYAfm.exe
  2⤵
  PID:9340
- C:\Windows\System\jSnNaFj.exe
  C:\Windows\System\jSnNaFj.exe
  2⤵
  PID:9368
- C:\Windows\System\wESBZts.exe
  C:\Windows\System\wESBZts.exe
  2⤵
  PID:9372
- C:\Windows\System\NvgLJOZ.exe
  C:\Windows\System\NvgLJOZ.exe
  2⤵
  PID:9404
- C:\Windows\System\VFmCsmb.exe
  C:\Windows\System\VFmCsmb.exe
  2⤵
  PID:8436
- C:\Windows\System\scgFDAN.exe
  C:\Windows\System\scgFDAN.exe
  2⤵
  PID:9452
- C:\Windows\System\hRnHumQ.exe
  C:\Windows\System\hRnHumQ.exe
  2⤵
  PID:9528
- C:\Windows\System\yBYDXwl.exe
  C:\Windows\System\yBYDXwl.exe
  2⤵
  PID:9560
- C:\Windows\System\TrpkzHb.exe
  C:\Windows\System\TrpkzHb.exe
  2⤵
  PID:9512
- C:\Windows\System\JvWZIYe.exe
  C:\Windows\System\JvWZIYe.exe
  2⤵
  PID:9548
- C:\Windows\System\zWpQyXJ.exe
  C:\Windows\System\zWpQyXJ.exe
  2⤵
  PID:9628
- C:\Windows\System\rgmEmcT.exe
  C:\Windows\System\rgmEmcT.exe
  2⤵
  PID:9720
- C:\Windows\System\YQaVIXc.exe
  C:\Windows\System\YQaVIXc.exe
  2⤵
  PID:9672
- C:\Windows\System\fciJvry.exe
  C:\Windows\System\fciJvry.exe
  2⤵
  PID:9736
- C:\Windows\System\KtloEaS.exe
  C:\Windows\System\KtloEaS.exe
  2⤵
  PID:8568
- C:\Windows\System\GlnOhtj.exe
  C:\Windows\System\GlnOhtj.exe
  2⤵
  PID:9820
- C:\Windows\System\FCgEhsA.exe
  C:\Windows\System\FCgEhsA.exe
  2⤵
  PID:9852
- C:\Windows\System\ybTGhUW.exe
  C:\Windows\System\ybTGhUW.exe
  2⤵
  PID:9884
- C:\Windows\System\pGYMUNb.exe
  C:\Windows\System\pGYMUNb.exe
  2⤵
  PID:9868
- C:\Windows\System\BVfCZGR.exe
  C:\Windows\System\BVfCZGR.exe
  2⤵
  PID:9920
- C:\Windows\System\ktcwbiB.exe
  C:\Windows\System\ktcwbiB.exe
  2⤵
  PID:9984
- C:\Windows\System\eIpaxAD.exe
  C:\Windows\System\eIpaxAD.exe
  2⤵
  PID:10048
- C:\Windows\System\DhlaewV.exe
  C:\Windows\System\DhlaewV.exe
  2⤵
  PID:10112
- C:\Windows\System\ULoRuLw.exe
  C:\Windows\System\ULoRuLw.exe
  2⤵
  PID:10176
- C:\Windows\System\seTHFuS.exe
  C:\Windows\System\seTHFuS.exe
  2⤵
  PID:10100
- C:\Windows\System\TIeMjNF.exe
  C:\Windows\System\TIeMjNF.exe
  2⤵
  PID:9940
- C:\Windows\System\IOXoEEu.exe
  C:\Windows\System\IOXoEEu.exe
  2⤵
  PID:10192
- C:\Windows\System\Ozphhcd.exe
  C:\Windows\System\Ozphhcd.exe
  2⤵
  PID:9972
- C:\Windows\System\ehIHooC.exe
  C:\Windows\System\ehIHooC.exe
  2⤵
  PID:10032
- C:\Windows\System\LpsPNCA.exe
  C:\Windows\System\LpsPNCA.exe
  2⤵
  PID:9336
- C:\Windows\System\pzKKfdK.exe
  C:\Windows\System\pzKKfdK.exe
  2⤵
  PID:10160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\InIWzaG.exe

Filesize
1.8MB

MD5
174ad574a60c1c66dbe2cc77a1804151

SHA1
e23277332116ffd58fdcd9d870521c91f37c5ad0

SHA256
05256970b48b3f0e8ba44281f6041739a1a4a13055bea67fe0fe7328e754f6b5

SHA512
60b73d443bcaea98f0052987b1b8ecaa83e73826754151355f04ea2e36058c30eb549a9886943a2f116d502ca2362be890848233c0f34025507a1430ed136d6a

Download Submit
C:\Windows\system\JjJkHhz.exe

Filesize
1.8MB

MD5
c483b6a69cdabdb35d83982308b1c17e

SHA1
078b876b431dbad6aeef76c58e710a8c86274061

SHA256
44c6b3560157ee542102aa4ea8e9f557f136597a9da021b1451dd2f929af59bb

SHA512
313e6f1d7f5d623fbbeeb9a5a2127781a23d41c62f6e32b85ca37b21044e8a5e58ebffc30393a3aeda045f14469eb52e069eb01ca2d51dd161251ff00970f6a3

Download Submit
C:\Windows\system\JkrGDvC.exe

Filesize
1.8MB

MD5
89a64c3e454fe5de380879f7a11f0a3c

SHA1
92c0871c03dffc0a0000cb48dba02900667c9883

SHA256
328876d00f9815d3d7c5ba357809720a3bfefde221ea9152954c25b5580619d3

SHA512
123b36f94e3c6e4cb2af26b4f3e39763924f2cc40b71119d6f5447be71d6290d18fccc340880e9ffa89ee357f17ceef551ac7edf9ada9e14dd003a45a26a4b5c

Download Submit
C:\Windows\system\RbZsWyh.exe

Filesize
1.8MB

MD5
ec36671d5fa832e7bf21e2afa0dd4fde

SHA1
739b22fc26e7ce3b881c4f510be8fdd75e56c5d9

SHA256
01f93d49e2d9cf9a8c981673f96ad42b0861e0154ce314cd264cff4877700de8

SHA512
90f1fb8ee8751364095533c156834992e26ce9e0cd101e71bbc86ad69130b7826a71d88c0401f1627e3689e5aa1c7df1742762ecc2f7f9fdc8ec6514aa641775

Download Submit
C:\Windows\system\UwbGeAk.exe

Filesize
1.8MB

MD5
5c424cb620638cf89ee4c1119f237964

SHA1
5705e7b3a4e9e7b447c9066404e86c06b93934be

SHA256
64ccdb3b0a87a471186969f3cab804808c11115881171b16d9dc4cf063a7cfe4

SHA512
1efa9898f63d1ff019b82b45e159b9c2422f84ed69770f53120b2b9ecb583c792540cac157372c078cc6160bf60b13f5fea97242f0fcfcc9ead498502a86544c

Download Submit
C:\Windows\system\XOGeSHR.exe

Filesize
1.8MB

MD5
68e1370346cc7aedfe091bdcc8fea2eb

SHA1
f6b55f1aac36f88526435dc5c2d658fae0315d51

SHA256
18e7804277366b198a1475e0382d5d0e7bf8a5026847744011ef26c99d691348

SHA512
23e4fea375909cbc4a56e99afe1b4454e6aed1905f6fd54d7a3504fe84e45e302af656392772d10518bf29847457d517d6c1814668ce663cc4b262889d6023b8

Download Submit
C:\Windows\system\YIIUzsk.exe

Filesize
1.8MB

MD5
53159138cf2729c9ff287bf086ee4d6c

SHA1
f477acd03404fde48715a89e80deaf3821ec7a73

SHA256
dcae015de50bacac733ca62434fbfb50f8ee11ad07fafaddffdf4ce8af0f6d30

SHA512
fec2fe6e71097b5baec5e4fe6581f24793acc880ce34be425a9ef864139ebd5b95c85bfe97749e1172db44bc756bc3a0201b8d241a084c97571b60c67558a443

Download Submit
C:\Windows\system\ZwxkAkD.exe

Filesize
1.8MB

MD5
5a40cef20a71e756b21cd64c0044664c

SHA1
b7f8c356ef0e57a76cfdd6cfec2a063ffeb329e6

SHA256
34feb73ff95ec72dbf4977da7349ab477b9f6fe052524c1a78d691a66bbfb2cb

SHA512
d626e9c5673649e9978be5d4c2f29aeb279f1ac94d302bdf00b81de4555ab72518f50f4da923a9e5f689a6250159a5d41c366f29b72d1f44d58a42d0db92a02d

Download Submit
C:\Windows\system\aDdKEzb.exe

Filesize
1.8MB

MD5
7f7ec8718b1fd70e3ab46e0cffe325f1

SHA1
dbdee3a9836324e3ca1ffd4bb4aed6b409f05cbe

SHA256
6d40dfe43a98a031f3f9a2c47c62bdf4c59d974d8314acefa9a3be13d6687fe6

SHA512
b6330eda31ce4c3d2ca0c99eaabf114f7ef5520112ccd5a14c8bd0740e5a05e19f7f29bb5188af2bf369994da720daf53dc1610030cca5d0baec625349fdbfd4

Download Submit
C:\Windows\system\aDdaWhE.exe

Filesize
1.8MB

MD5
237c3aec03180b58b24abab2db37c022

SHA1
31ad07712a907791685031a84601449e48487718

SHA256
c64590c28ae9d8f8c7a1d2b52b9cd8228c93eec7f985cc6103737e9ebf975d9e

SHA512
9f45904e9c24ae1de60e1741d544b727bc1e1768bbd7113a03e5ab5e85bdaa71a0ec21a9f0a4eeed2017a67a9e78fa0d7fc649739fb7eca5c10adf9e29b30c77

Download Submit
C:\Windows\system\aErxzRJ.exe

Filesize
1.8MB

MD5
0c132e4f3762390cf8ae8e16963efc41

SHA1
e33ab15a06619b94eb4883fcbe0f4ff9b2338006

SHA256
056ae5948d8a576b2cea0b3e3b84f63292d9cac5de79805fa639ca41249d04fd

SHA512
e202020cfc79c2d61f6ab00f08dad6e2486c23bd7e828113e4275dc90b32c3712e2085bf5a855c9eb2d869e48a4f86d4890e5664b46198a4d9477ac7de3e3119

Download Submit
C:\Windows\system\daWiKci.exe

Filesize
1.8MB

MD5
81522b01405c718b6091626bf3c1c1ca

SHA1
b6cf3de17da24e36ec1f67bab5bd3cd49f336974

SHA256
da35cec21b832e8623174bde39306cd68cb7aea58ac7461a48c1cbce1a78eb34

SHA512
e91f83a1948d198903906c0ba6d2d62c725ac650b405ffa6f7082a81b2d59b05486e33fded7725d92b3d27c2fac24be4c59e5a5465b21d23a998ac64f3ec0fdf

Download Submit
C:\Windows\system\dlmLJRo.exe

Filesize
1.8MB

MD5
232c94d4df0443c1787fd02f9f1e2743

SHA1
9879d771615033df84bf77e9490645fbe16b9304

SHA256
671594e80e28df59ed399dbc2503e41056414131e5a28fecb75ed9c4bc0a9a5e

SHA512
81bbfd5c60f7f467f23ba63c655291325a7d49dd233daacab25493cbc8428eea865d9a30509925a8aeca90a9b5f7d5d2bbb7fda20f3f5b1b30797cdaaf9973a0

Download Submit
C:\Windows\system\fKUiaaD.exe

Filesize
1.8MB

MD5
f6a9d04d0594282782cd22f2d0463fc9

SHA1
564bed73a7503d1d135346907b288d9a4f44bbe1

SHA256
2eedd96717961824a217e1d4d65c4da73e346544053c2d6f8fbb79e036aa8132

SHA512
62ad9148bb8f2446a4cca3248bfc2f022c1e36853f275c8c6998ac89778445dfc49a23197a80d392f4ff4e0f31e252fb6646dff5591000c13b3ed93b8be45e2d

Download Submit
C:\Windows\system\hFBADba.exe

Filesize
1.8MB

MD5
4d966bca6e92629dd2d1b65ec2722f1b

SHA1
bfa63469b63429ce6ed49002bc7f66ef779b7d41

SHA256
d16434414e867f9c6b1f3f30a35818e4a2911c56003ef0cefd0c086ba019d1e6

SHA512
909e135d97678e5a7a34a8c4ec8293cc1bd2e00db7dd9430b76977b15ca50c6443193643d42a44ba60705250f0491c31619e2183c375863bd005d0e7512cdee1

Download Submit
C:\Windows\system\hVtYjGv.exe

Filesize
1.8MB

MD5
8fd4161542ca2f7974d92c6d062cd8a3

SHA1
d2618ae1a6747a02d8b4c9095fd6da48c1f4f400

SHA256
ef89c55ba8fe8cd25489ef6f9e9d47f420ea15948c11902253fbb846381137a0

SHA512
9532f3211ec19ef2a20f39b47c5d14221dfcde9f0eadeb14a3b838d0e272a139127663ae1f7c9af255c0875dce0dc12118fe98c532a547c06bf05cbddbe9c343

Download Submit
C:\Windows\system\hcOUEpf.exe

Filesize
1.8MB

MD5
268988c352a2a84fb83bb89af9c12917

SHA1
cab364ca26adf187a774ce240102828c352cb6e1

SHA256
46cc095b9515e31b57ffbd8a11cd1dd393a99eac193502c0c5e09c098fe882ea

SHA512
ba28688a4166406cb3fd0afb95454c341f2178c4b6fa29324b8643b5285d12c745f707d778a64ebedafabc32b2f6edb3f8bc80ea539b0b44fc8bfad6e64b255b

Download Submit
C:\Windows\system\iIYHDmB.exe

Filesize
1.8MB

MD5
d6d8220092b4592f7628ff4b592cebfd

SHA1
b54696d6ee35aed8de61cea11e143487a6006e52

SHA256
ed89ba03eac89be16d3426d72cb3d06ddab67c7547d7515da3a6eeee7cb408ba

SHA512
e4c52c54cb8392f5b8816568562ca5afc10558f76d09917207938cae4fa3242aad3674367f2bdb4425a8c1a397a520f053b45459f211b1e32d348b039c598ee0

Download Submit
C:\Windows\system\mcrJWCO.exe

Filesize
1.8MB

MD5
67fb9b0c30023592804100ef0e15844f

SHA1
c89f2f7b21aec745d2c206095eb7d8b8ca951fd2

SHA256
1030ab60776baa994620dfbae5d70141122f97c302b53ee11b0503cff61330c4

SHA512
369f0aa6e3501a3fb836ec8068cf644e984b3f760d2ddf2caed3667b8049cb53ddfbb7d8ee887bc7b657bcbc8070a7c510d3878e1f213ff85a0972e8c7099084

Download Submit
C:\Windows\system\mvTGCwx.exe

Filesize
1.8MB

MD5
a9bbb78fcd8330b648bfeec5283f0d23

SHA1
4fe571720f238ee6f363a9b956e24544c1b9cfee

SHA256
051ecb9e2df6f7d1d83cebe1b40f2204cb7d573ff03c353bee45e0f2f482e6a0

SHA512
288ab68255bf49d71d1717dd428674b0dfddabd434f855685a216f5c97fb30231da791745c6254ee99e490e531b2ccc7d0341ef17faf7c77ece99903d947e11e

Download Submit
C:\Windows\system\nQMMXZm.exe

Filesize
1.8MB

MD5
518000cd08dce46e38da9f1f4772b119

SHA1
23eac1df394864ce332aa2da20d81caf4538351b

SHA256
d627e9c947d1e684d6d07da54f07176439e3cde98c7cba1eb3adf1d07111c27a

SHA512
417af4099bbddcab99140753e05d3e6800c61fc71d44b2893c815c3192d0a7e573c6510c52e6e4552b79fcf80535044b6847a4e39f36985f3ad0bf79d6388d57

Download Submit
C:\Windows\system\nzTLhKS.exe

Filesize
1.8MB

MD5
b8901262049090435c392371b0a69a2b

SHA1
04e4fe2550b2a4a8a84b30bc6e17097701c33702

SHA256
65b5af879c57ca0a6203bae199183fefc3d21b3bc63eba17cbe80dd835ad6098

SHA512
515a1b3c466d497c490029563ff2d3bff30000b002c880794a9ad126cdb0d90e9e822bc5747bb3570ba6da6c8719f08ea7c7f42bc91e321f9145b9a3cb96bee0

Download Submit
C:\Windows\system\oUizjmF.exe

Filesize
1.8MB

MD5
a0905fba7c97f41656916eb4d91b89b7

SHA1
7456a4dc866a401d65c67b2f1a782191d9e935d3

SHA256
c388bdf5ac5a8e9dae5440ac44edf0cd97a4aed4a3bc8146bc839ddbdb0cd427

SHA512
b4ee7c79fadc1376d45c58edbfdce6c3fd6e2a128aee661ff9b55fcaf9653694b8dc7034da6bed0dd7e502aa72c5fb86f7d50d9d0ca5010bdc3e80b61d92515e

Download Submit
C:\Windows\system\qPpjjEA.exe

Filesize
1.8MB

MD5
7dadadf349343ab828441e04b65d7c4f

SHA1
b5879c2d09dd5e11ea6cd0cad2d7b362dd31fbac

SHA256
d2c5c803686254750a33fecb367bb3e1dcf7cca2fac84901cf6a0c21a60a07a1

SHA512
566c2098c3e7639fd8bb334b428ece9697874853b69a885434ab8983afb79970747aea69274b44ce7fbefe850b864bac4b2ca8b69587d06b4f7899e2147e02ea

Download Submit
C:\Windows\system\rLUIOPL.exe

Filesize
1.8MB

MD5
5709d1c35dccd779a6b1ff1bc11c1da3

SHA1
c746631ba678bec734d6f1d780263c71da61e37f

SHA256
849caa4c0f66d4be669b951c8b373df414023c5307cfa6e64cd1b484ec70e148

SHA512
95943c0eedb8fa7d161f74f31362e8a5d359329156dde46052b95f62f156691f604e89faa4f6e97501f0b5be50f4548548d67937034c89d6ed08d0dff5baf7b2

Download Submit
C:\Windows\system\tXELKRh.exe

Filesize
1.8MB

MD5
d2d015730cd8392357d50bcf74bd6829

SHA1
2806717ca60a9b4e3236b50800ac3619da08b282

SHA256
7b0e7107a6a9dac9e4fbc10184432ca537fb273b7ff995537e684e66c902f54b

SHA512
26805b12e6306ff9171e1d6ca78ad62420b82b3cf5a991c41f9a833c2c4c8edf44ca6aeca77af1b11c5c7d8dd15c360ee97c5bb779b315bdbaf018effea749ae

Download Submit
C:\Windows\system\vRkJKBy.exe

Filesize
1.8MB

MD5
5a4bb0a5d6651bae8ac877d206942c08

SHA1
01c6af3e48a86082044a1f50fd3075a72b2442b4

SHA256
61c5dda4d75c83765eb7db748bdda48558c03c76d44e992983f0e4ac77995fe6

SHA512
2786918fa121e8f5012025a84d892062e60d16c95bc9e8a47bd7e9b32c57f1aef2a2e095cb852b8abf21f2f1d2522d6b0859ba436998c23029c3757e160e5beb

Download Submit
C:\Windows\system\vWWGxuV.exe

Filesize
1.8MB

MD5
601a8bfd8a555f4448aec12e7c94ae24

SHA1
7160a7b95c530f1d2c9cd1221f041a54ecd7333f

SHA256
c88b3bf39e0f44dc79e0752d305d475843504a0a0eb58409e9cf04179552ecad

SHA512
8b1db33b53e3930bb1f885cbb71e71d3b4d23753628092aba48e913d74008860e2d78f9b2a15e17acc61f8a8e324f25e4e787bcb56930f0a0a5f72b9a6f00386

Download Submit
C:\Windows\system\xFkPtgE.exe

Filesize
1.8MB

MD5
0770dc3e1c838a5dc54e4f3f4ec6ca10

SHA1
c77e1c2aade67f888c499ab04c1274734cc37ac0

SHA256
5fc497d4eba6b8d09592ea3cebbf74c5dbd5b84b61feb3023b1278f296e64c2f

SHA512
8a71b34ac438e33251ef4f9ec73c04b5732f3d310f5de7f91b48721dc0b3b845f95cc76fdb007d500027897a680251b2e02235e6aa475cecd4c59f87cdfa7c2d

Download Submit
C:\Windows\system\xLuuwcH.exe

Filesize
1.8MB

MD5
ea2d385a403787c273eb4da2a42ff4c4

SHA1
e3d18c8f1b7ad2b02003c15fb47b56b0a8462a00

SHA256
bd1c9acd8311e66cc99d53cda8a5b199c59762e21184369c8016ec987d58b9ff

SHA512
0889807f7bcea0d61d3027e4b3d9761739c8a437c4634357add8f5de21ed33ab044fb52d11934fb4bcfa4410adc54a14258a02118e9887806d40b7fe12cf6a28

Download Submit
\Windows\system\ydcNQGq.exe

Filesize
1.8MB

MD5
cadc0c1187a2621e2be017210f54de00

SHA1
b0721f448e20aca4c6b751d5774202bcdb0e3ed4

SHA256
80bcdc7097da9ba1982a01cfddfa4ffd9fe3238f24e65d976b3f30734d9365f7

SHA512
a626ed9a20141a0de23f4eaae564df5919dd6172784bb43e9df01e00903615524c649230118273da6158056dd2a423b1fa379400398d59f23106938e96f96b4e

Download Submit
\Windows\system\zxFDOEo.exe

Filesize
1.8MB

MD5
1fda40fbd9f427410b5c54e08472f562

SHA1
c0227a81dc7d57079747201576ae4d7d2dec38ee

SHA256
6f3d67b5ca5b55c3fcca135a1432c6cfcf57b48cec63ae23bbdc9f552d276bab

SHA512
9b4b77922d2b759790702a1e2e2fbad03770d344ffd122fc1d5838a293c77951c054baf20056eb07570912f9494b1f10ed72ec6e47a4140c9cbd5c44f66304ce

Download Submit
memory/1480-284-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/1496-140-0x0000000003140000-0x0000000003532000-memory.dmp

Filesize
3.9MB

Download
memory/1496-146-0x0000000003140000-0x0000000003532000-memory.dmp

Filesize
3.9MB

Download
memory/1496-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1496-138-0x0000000003140000-0x0000000003532000-memory.dmp

Filesize
3.9MB

Download
memory/1496-6-0x0000000003140000-0x0000000003532000-memory.dmp

Filesize
3.9MB

Download
memory/1496-8385-0x000000013F890000-0x000000013FC82000-memory.dmp

Filesize
3.9MB

Download
memory/1496-135-0x000000013F290000-0x000000013F682000-memory.dmp

Filesize
3.9MB

Download
memory/1496-154-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/1496-18-0x0000000003140000-0x0000000003532000-memory.dmp

Filesize
3.9MB

Download
memory/1496-148-0x0000000003140000-0x0000000003532000-memory.dmp

Filesize
3.9MB

Download
memory/1496-271-0x000000013F890000-0x000000013FC82000-memory.dmp

Filesize
3.9MB

Download
memory/1496-142-0x0000000003140000-0x0000000003532000-memory.dmp

Filesize
3.9MB

Download
memory/1496-150-0x000000013F120000-0x000000013F512000-memory.dmp

Filesize
3.9MB

Download
memory/1496-0-0x000000013F890000-0x000000013FC82000-memory.dmp

Filesize
3.9MB

Download
memory/1496-152-0x0000000003140000-0x0000000003532000-memory.dmp

Filesize
3.9MB

Download
memory/1496-144-0x0000000003140000-0x0000000003532000-memory.dmp

Filesize
3.9MB

Download
memory/1660-19-0x000000013F780000-0x000000013FB72000-memory.dmp

Filesize
3.9MB

Download
memory/1660-273-0x000000013F780000-0x000000013FB72000-memory.dmp

Filesize
3.9MB

Download
memory/1660-3405-0x000000013F780000-0x000000013FB72000-memory.dmp

Filesize
3.9MB

Download
memory/1676-288-0x000000013F5E0000-0x000000013F9D2000-memory.dmp

Filesize
3.9MB

Download
memory/1932-286-0x000000013F950000-0x000000013FD42000-memory.dmp

Filesize
3.9MB

Download
memory/1948-155-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/1948-3389-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/1980-287-0x000000013FBE0000-0x000000013FFD2000-memory.dmp

Filesize
3.9MB

Download
memory/2088-3395-0x000000013F750000-0x000000013FB42000-memory.dmp

Filesize
3.9MB

Download
memory/2088-272-0x000000013F750000-0x000000013FB42000-memory.dmp

Filesize
3.9MB

Download
memory/2088-9-0x000000013F750000-0x000000013FB42000-memory.dmp

Filesize
3.9MB

Download
memory/2192-291-0x000000013F760000-0x000000013FB52000-memory.dmp

Filesize
3.9MB

Download
memory/2256-151-0x000000013F120000-0x000000013F512000-memory.dmp

Filesize
3.9MB

Download
memory/2256-3390-0x000000013F120000-0x000000013F512000-memory.dmp

Filesize
3.9MB

Download
memory/2344-285-0x000000013F4C0000-0x000000013F8B2000-memory.dmp

Filesize
3.9MB

Download
memory/2372-136-0x000000013F290000-0x000000013F682000-memory.dmp

Filesize
3.9MB

Download
memory/2372-3393-0x000000013F290000-0x000000013F682000-memory.dmp

Filesize
3.9MB

Download
memory/2376-290-0x000000013F570000-0x000000013F962000-memory.dmp

Filesize
3.9MB

Download
memory/2692-3402-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download
memory/2692-147-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download
memory/2796-3398-0x000000013F830000-0x000000013FC22000-memory.dmp

Filesize
3.9MB

Download
memory/2796-149-0x000000013F830000-0x000000013FC22000-memory.dmp

Filesize
3.9MB

Download
memory/2812-3399-0x000000013F980000-0x000000013FD72000-memory.dmp

Filesize
3.9MB

Download
memory/2812-143-0x000000013F980000-0x000000013FD72000-memory.dmp

Filesize
3.9MB

Download
memory/2852-3394-0x000000013F5B0000-0x000000013F9A2000-memory.dmp

Filesize
3.9MB

Download
memory/2852-141-0x000000013F5B0000-0x000000013F9A2000-memory.dmp

Filesize
3.9MB

Download
memory/2884-3391-0x000000013F640000-0x000000013FA32000-memory.dmp

Filesize
3.9MB

Download
memory/2884-153-0x000000013F640000-0x000000013FA32000-memory.dmp

Filesize
3.9MB

Download
memory/2916-137-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmp

Filesize
9.6MB

Download
memory/2916-106-0x000000001B680000-0x000000001B962000-memory.dmp

Filesize
2.9MB

Download
memory/2916-156-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmp

Filesize
9.6MB

Download
memory/2916-724-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmp

Filesize
9.6MB

Download
memory/2916-134-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmp

Filesize
9.6MB

Download
memory/2916-107-0x0000000002910000-0x0000000002918000-memory.dmp

Filesize
32KB

Download
memory/2916-20-0x000007FEF5EAE000-0x000007FEF5EAF000-memory.dmp

Filesize
4KB

Download
memory/2924-139-0x000000013F670000-0x000000013FA62000-memory.dmp

Filesize
3.9MB

Download
memory/2924-3400-0x000000013F670000-0x000000013FA62000-memory.dmp

Filesize
3.9MB

Download
memory/2976-145-0x000000013F820000-0x000000013FC12000-memory.dmp

Filesize
3.9MB

Download
memory/2976-3397-0x000000013F820000-0x000000013FC12000-memory.dmp

Filesize
3.9MB

Download
memory/3044-289-0x000000013F630000-0x000000013FA22000-memory.dmp

Filesize
3.9MB

Download