xmrig | ecff5435ed869f9b67f373909470b96afb8f3dbffc5511cb730d88df74414c14

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 03:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

548798b64900a39f22af3d91c6423f10N.exe
Size

1.4MB
MD5

548798b64900a39f22af3d91c6423f10
SHA1

032d404eb88765d840477e73755a027d48841e3a
SHA256

ecff5435ed869f9b67f373909470b96afb8f3dbffc5511cb730d88df74414c14
SHA512

8f1e04778951c48551e6c7eea41701e1fec1f86b74d78781fa659587fe11d11649e31bbd2aa5d12c2a8b6dc03da97b878a42e59a0eca2b5698eec88a2df50fe9
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYUA/02aHwaGA25E:Lz071uv4BPMkibTIA5UMrE

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 23 IoCs

miner

resource	yara_rule
behavioral1/memory/2408-189-0x000000013FFC0000-0x00000001403B2000-memory.dmp	xmrig
behavioral1/memory/2788-269-0x000000013F8F0000-0x000000013FCE2000-memory.dmp	xmrig
behavioral1/memory/2760-281-0x000000013F680000-0x000000013FA72000-memory.dmp	xmrig
behavioral1/memory/2872-279-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	xmrig
behavioral1/memory/2752-277-0x000000013FE00000-0x00000001401F2000-memory.dmp	xmrig
behavioral1/memory/2848-275-0x000000013F680000-0x000000013FA72000-memory.dmp	xmrig
behavioral1/memory/2716-271-0x000000013F9D0000-0x000000013FDC2000-memory.dmp	xmrig
behavioral1/memory/2988-289-0x000000013F470000-0x000000013F862000-memory.dmp	xmrig
behavioral1/memory/2640-287-0x000000013FA10000-0x000000013FE02000-memory.dmp	xmrig
behavioral1/memory/2592-285-0x000000013FF20000-0x0000000140312000-memory.dmp	xmrig
behavioral1/memory/2968-2922-0x000000013F620000-0x000000013FA12000-memory.dmp	xmrig
behavioral1/memory/1796-5192-0x000000013F7A0000-0x000000013FB92000-memory.dmp	xmrig
behavioral1/memory/2408-5196-0x000000013FFC0000-0x00000001403B2000-memory.dmp	xmrig
behavioral1/memory/2716-5198-0x000000013F9D0000-0x000000013FDC2000-memory.dmp	xmrig
behavioral1/memory/2752-5206-0x000000013FE00000-0x00000001401F2000-memory.dmp	xmrig
behavioral1/memory/3020-5203-0x000000013FDB0000-0x00000001401A2000-memory.dmp	xmrig
behavioral1/memory/2872-5217-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	xmrig
behavioral1/memory/2788-5222-0x000000013F8F0000-0x000000013FCE2000-memory.dmp	xmrig
behavioral1/memory/2848-5224-0x000000013F680000-0x000000013FA72000-memory.dmp	xmrig
behavioral1/memory/2988-5229-0x000000013F470000-0x000000013F862000-memory.dmp	xmrig
behavioral1/memory/2640-5215-0x000000013FA10000-0x000000013FE02000-memory.dmp	xmrig
behavioral1/memory/2592-5213-0x000000013FF20000-0x0000000140312000-memory.dmp	xmrig
behavioral1/memory/2760-5211-0x000000013F680000-0x000000013FA72000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2412	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1796	zNqXltj.exe
3020	NydjFAo.exe
2408	uhJQmsh.exe
2788	scCwhYt.exe
2716	rPyUmVA.exe
2848	zActqpq.exe
2752	DjQocqq.exe
2872	enxlVtS.exe
2760	ThLyNNh.exe
2592	OuDkXhT.exe
2640	mgDmLCL.exe
2988	CLEfnjR.exe
2248	PegFylz.exe
1708	wzBaYkS.exe
2040	DFwgvVE.exe
1984	oXfyaIG.exe
1968	DuXrnqu.exe
1924	OzZYZnF.exe
2124	HPuyqDG.exe
1956	AthRgvY.exe
1732	raPpMOE.exe
2012	LswzluO.exe
376	dxDfCjB.exe
2008	mccFSkT.exe
316	hdhuEKJ.exe
1728	xaTmflh.exe
2868	MaEVGNq.exe
2936	jtOvjmr.exe
700	KgHjQRS.exe
2120	JkUxcEg.exe
1476	WtpChgm.exe
964	izsnHXo.exe
108	pkmeApF.exe
1392	ttJggda.exe
2240	aSjQoOW.exe
2324	qaBUeFW.exe
1772	cZUWPOF.exe
572	IgVurXy.exe
840	bVvmUTj.exe
1036	poWfdNb.exe
2956	PGYVRRa.exe
2396	rhiBBLy.exe
2912	KBvnxQc.exe
3036	AixYAnr.exe
2548	QWhmcFM.exe
992	tEPHAKm.exe
2388	KKUdaAF.exe
896	PEHirVc.exe
2472	hLQEsRb.exe
3048	rNoaVwu.exe
1576	axYRVru.exe
1684	nrDkJMX.exe
1672	fDxIjDp.exe
2188	EawWUKB.exe
2832	rdWouAz.exe
2824	moCwGlS.exe
2172	peFyTQp.exe
2364	TEmSIms.exe
2704	uEmqSGh.exe
1784	EsDdHnH.exe
2992	WMBChLb.exe
676	pYLaRpr.exe
2416	wfqAszI.exe
1808	MLgUqAS.exe

Loads dropped DLL 64 IoCs

pid	Process
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe
2968	548798b64900a39f22af3d91c6423f10N.exe

UPX packed file 59 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2968-0-0x000000013F620000-0x000000013FA12000-memory.dmp	upx
behavioral1/files/0x0009000000012286-5.dat	upx
behavioral1/files/0x0008000000016140-7.dat	upx
behavioral1/files/0x0008000000016398-30.dat	upx
behavioral1/files/0x000700000001688f-45.dat	upx
behavioral1/files/0x0009000000016c88-50.dat	upx
behavioral1/files/0x0006000000016de2-59.dat	upx
behavioral1/files/0x0006000000016df2-69.dat	upx
behavioral1/files/0x0006000000016dff-79.dat	upx
behavioral1/files/0x00060000000170da-89.dat	upx
behavioral1/files/0x00060000000174f7-99.dat	upx
behavioral1/files/0x000500000001870a-114.dat	upx
behavioral1/files/0x00050000000187a7-124.dat	upx
behavioral1/files/0x0006000000018b7f-138.dat	upx
behavioral1/files/0x0006000000018be5-160.dat	upx
behavioral1/memory/2408-189-0x000000013FFC0000-0x00000001403B2000-memory.dmp	upx
behavioral1/files/0x0006000000018c11-171.dat	upx
behavioral1/files/0x0006000000018c05-157.dat	upx
behavioral1/files/0x0009000000015f4d-163.dat	upx
behavioral1/files/0x0006000000018bf9-153.dat	upx
behavioral1/files/0x0006000000018bb0-143.dat	upx
behavioral1/files/0x00050000000187c0-134.dat	upx
behavioral1/files/0x00050000000187ac-129.dat	upx
behavioral1/files/0x000500000001871a-119.dat	upx
behavioral1/files/0x0005000000018708-110.dat	upx
behavioral1/files/0x000600000001756f-104.dat	upx
behavioral1/files/0x0006000000017226-94.dat	upx
behavioral1/files/0x000600000001707e-84.dat	upx
behavioral1/memory/2788-269-0x000000013F8F0000-0x000000013FCE2000-memory.dmp	upx
behavioral1/files/0x0006000000016df7-74.dat	upx
behavioral1/files/0x0006000000016dec-64.dat	upx
behavioral1/files/0x0007000000016dd8-54.dat	upx
behavioral1/files/0x0008000000016688-40.dat	upx
behavioral1/files/0x000c00000000549e-34.dat	upx
behavioral1/memory/3020-21-0x000000013FDB0000-0x00000001401A2000-memory.dmp	upx
behavioral1/memory/2760-281-0x000000013F680000-0x000000013FA72000-memory.dmp	upx
behavioral1/memory/2872-279-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	upx
behavioral1/memory/2752-277-0x000000013FE00000-0x00000001401F2000-memory.dmp	upx
behavioral1/memory/2848-275-0x000000013F680000-0x000000013FA72000-memory.dmp	upx
behavioral1/memory/2716-271-0x000000013F9D0000-0x000000013FDC2000-memory.dmp	upx
behavioral1/files/0x00080000000162e3-18.dat	upx
behavioral1/memory/1796-16-0x000000013F7A0000-0x000000013FB92000-memory.dmp	upx
behavioral1/memory/2968-10-0x0000000002E20000-0x0000000003212000-memory.dmp	upx
behavioral1/memory/2988-289-0x000000013F470000-0x000000013F862000-memory.dmp	upx
behavioral1/memory/2640-287-0x000000013FA10000-0x000000013FE02000-memory.dmp	upx
behavioral1/memory/2592-285-0x000000013FF20000-0x0000000140312000-memory.dmp	upx
behavioral1/memory/2968-2922-0x000000013F620000-0x000000013FA12000-memory.dmp	upx
behavioral1/memory/1796-5192-0x000000013F7A0000-0x000000013FB92000-memory.dmp	upx
behavioral1/memory/2408-5196-0x000000013FFC0000-0x00000001403B2000-memory.dmp	upx
behavioral1/memory/2716-5198-0x000000013F9D0000-0x000000013FDC2000-memory.dmp	upx
behavioral1/memory/2752-5206-0x000000013FE00000-0x00000001401F2000-memory.dmp	upx
behavioral1/memory/3020-5203-0x000000013FDB0000-0x00000001401A2000-memory.dmp	upx
behavioral1/memory/2872-5217-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	upx
behavioral1/memory/2788-5222-0x000000013F8F0000-0x000000013FCE2000-memory.dmp	upx
behavioral1/memory/2848-5224-0x000000013F680000-0x000000013FA72000-memory.dmp	upx
behavioral1/memory/2988-5229-0x000000013F470000-0x000000013F862000-memory.dmp	upx
behavioral1/memory/2640-5215-0x000000013FA10000-0x000000013FE02000-memory.dmp	upx
behavioral1/memory/2592-5213-0x000000013FF20000-0x0000000140312000-memory.dmp	upx
behavioral1/memory/2760-5211-0x000000013F680000-0x000000013FA72000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\wfTSTGP.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\xRHWmBu.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\OzZYZnF.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\YgoYLuP.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\srlZIyq.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\ZPsaDTC.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\SFyKDHk.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\edyiRHx.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\DNLWoPF.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\gVmmHoe.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\jueDZiT.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\AWfLRmn.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\hHArQDz.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\CsnYszY.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\EZPHgLz.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\VIqarwM.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\HXRoQub.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\GrxViPF.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\bvyxPjA.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\iLwYoxY.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\JGAsRvg.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\CzIXlpq.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\itjXmHJ.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\EJcsLPR.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\voNKllK.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\QgNyMmj.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\sFtBAXH.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\NblIgfZ.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\MQxkRhJ.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\hELwgeU.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\YYVGpxe.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\rXuObtO.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\wHDVzDq.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\hzwMSUP.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\DILsohE.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\CbCvkyy.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\JKcMZoK.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\NycvRbB.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\yoFESXg.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\PfypSqM.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\JjpUEpq.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\kmnPZvx.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\uFUoBWJ.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\bashSYV.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\cZUWPOF.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\HRXKuih.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\OsFIkGU.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\zmOaEgk.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\KqHlGCu.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\DIsKVND.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\Omhyfss.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\JCtaYvD.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\MGjSzfy.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\BNXOHrv.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\WnLmost.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\knXfAYf.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\xbBjsof.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\CNByMjU.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\FznSdFE.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\wQvHHlI.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\ByFfSZp.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\HvOdlit.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\vbrxLOg.exe	548798b64900a39f22af3d91c6423f10N.exe
File created	C:\Windows\System\zykuIsM.exe	548798b64900a39f22af3d91c6423f10N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2412	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2968	548798b64900a39f22af3d91c6423f10N.exe
Token: SeDebugPrivilege	2412	powershell.exe
Token: SeLockMemoryPrivilege	2968	548798b64900a39f22af3d91c6423f10N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2412	2968	548798b64900a39f22af3d91c6423f10N.exe	31
PID 2968 wrote to memory of 2412	2968	548798b64900a39f22af3d91c6423f10N.exe	31
PID 2968 wrote to memory of 2412	2968	548798b64900a39f22af3d91c6423f10N.exe	31
PID 2968 wrote to memory of 1796	2968	548798b64900a39f22af3d91c6423f10N.exe	32
PID 2968 wrote to memory of 1796	2968	548798b64900a39f22af3d91c6423f10N.exe	32
PID 2968 wrote to memory of 1796	2968	548798b64900a39f22af3d91c6423f10N.exe	32
PID 2968 wrote to memory of 3020	2968	548798b64900a39f22af3d91c6423f10N.exe	33
PID 2968 wrote to memory of 3020	2968	548798b64900a39f22af3d91c6423f10N.exe	33
PID 2968 wrote to memory of 3020	2968	548798b64900a39f22af3d91c6423f10N.exe	33
PID 2968 wrote to memory of 2408	2968	548798b64900a39f22af3d91c6423f10N.exe	34
PID 2968 wrote to memory of 2408	2968	548798b64900a39f22af3d91c6423f10N.exe	34
PID 2968 wrote to memory of 2408	2968	548798b64900a39f22af3d91c6423f10N.exe	34
PID 2968 wrote to memory of 2788	2968	548798b64900a39f22af3d91c6423f10N.exe	35
PID 2968 wrote to memory of 2788	2968	548798b64900a39f22af3d91c6423f10N.exe	35
PID 2968 wrote to memory of 2788	2968	548798b64900a39f22af3d91c6423f10N.exe	35
PID 2968 wrote to memory of 2716	2968	548798b64900a39f22af3d91c6423f10N.exe	36
PID 2968 wrote to memory of 2716	2968	548798b64900a39f22af3d91c6423f10N.exe	36
PID 2968 wrote to memory of 2716	2968	548798b64900a39f22af3d91c6423f10N.exe	36
PID 2968 wrote to memory of 2848	2968	548798b64900a39f22af3d91c6423f10N.exe	37
PID 2968 wrote to memory of 2848	2968	548798b64900a39f22af3d91c6423f10N.exe	37
PID 2968 wrote to memory of 2848	2968	548798b64900a39f22af3d91c6423f10N.exe	37
PID 2968 wrote to memory of 2752	2968	548798b64900a39f22af3d91c6423f10N.exe	38
PID 2968 wrote to memory of 2752	2968	548798b64900a39f22af3d91c6423f10N.exe	38
PID 2968 wrote to memory of 2752	2968	548798b64900a39f22af3d91c6423f10N.exe	38
PID 2968 wrote to memory of 2872	2968	548798b64900a39f22af3d91c6423f10N.exe	39
PID 2968 wrote to memory of 2872	2968	548798b64900a39f22af3d91c6423f10N.exe	39
PID 2968 wrote to memory of 2872	2968	548798b64900a39f22af3d91c6423f10N.exe	39
PID 2968 wrote to memory of 2760	2968	548798b64900a39f22af3d91c6423f10N.exe	40
PID 2968 wrote to memory of 2760	2968	548798b64900a39f22af3d91c6423f10N.exe	40
PID 2968 wrote to memory of 2760	2968	548798b64900a39f22af3d91c6423f10N.exe	40
PID 2968 wrote to memory of 2592	2968	548798b64900a39f22af3d91c6423f10N.exe	41
PID 2968 wrote to memory of 2592	2968	548798b64900a39f22af3d91c6423f10N.exe	41
PID 2968 wrote to memory of 2592	2968	548798b64900a39f22af3d91c6423f10N.exe	41
PID 2968 wrote to memory of 2640	2968	548798b64900a39f22af3d91c6423f10N.exe	42
PID 2968 wrote to memory of 2640	2968	548798b64900a39f22af3d91c6423f10N.exe	42
PID 2968 wrote to memory of 2640	2968	548798b64900a39f22af3d91c6423f10N.exe	42
PID 2968 wrote to memory of 2988	2968	548798b64900a39f22af3d91c6423f10N.exe	43
PID 2968 wrote to memory of 2988	2968	548798b64900a39f22af3d91c6423f10N.exe	43
PID 2968 wrote to memory of 2988	2968	548798b64900a39f22af3d91c6423f10N.exe	43
PID 2968 wrote to memory of 2248	2968	548798b64900a39f22af3d91c6423f10N.exe	44
PID 2968 wrote to memory of 2248	2968	548798b64900a39f22af3d91c6423f10N.exe	44
PID 2968 wrote to memory of 2248	2968	548798b64900a39f22af3d91c6423f10N.exe	44
PID 2968 wrote to memory of 1708	2968	548798b64900a39f22af3d91c6423f10N.exe	45
PID 2968 wrote to memory of 1708	2968	548798b64900a39f22af3d91c6423f10N.exe	45
PID 2968 wrote to memory of 1708	2968	548798b64900a39f22af3d91c6423f10N.exe	45
PID 2968 wrote to memory of 2040	2968	548798b64900a39f22af3d91c6423f10N.exe	46
PID 2968 wrote to memory of 2040	2968	548798b64900a39f22af3d91c6423f10N.exe	46
PID 2968 wrote to memory of 2040	2968	548798b64900a39f22af3d91c6423f10N.exe	46
PID 2968 wrote to memory of 1984	2968	548798b64900a39f22af3d91c6423f10N.exe	47
PID 2968 wrote to memory of 1984	2968	548798b64900a39f22af3d91c6423f10N.exe	47
PID 2968 wrote to memory of 1984	2968	548798b64900a39f22af3d91c6423f10N.exe	47
PID 2968 wrote to memory of 1968	2968	548798b64900a39f22af3d91c6423f10N.exe	48
PID 2968 wrote to memory of 1968	2968	548798b64900a39f22af3d91c6423f10N.exe	48
PID 2968 wrote to memory of 1968	2968	548798b64900a39f22af3d91c6423f10N.exe	48
PID 2968 wrote to memory of 1924	2968	548798b64900a39f22af3d91c6423f10N.exe	49
PID 2968 wrote to memory of 1924	2968	548798b64900a39f22af3d91c6423f10N.exe	49
PID 2968 wrote to memory of 1924	2968	548798b64900a39f22af3d91c6423f10N.exe	49
PID 2968 wrote to memory of 2124	2968	548798b64900a39f22af3d91c6423f10N.exe	50
PID 2968 wrote to memory of 2124	2968	548798b64900a39f22af3d91c6423f10N.exe	50
PID 2968 wrote to memory of 2124	2968	548798b64900a39f22af3d91c6423f10N.exe	50
PID 2968 wrote to memory of 1956	2968	548798b64900a39f22af3d91c6423f10N.exe	51
PID 2968 wrote to memory of 1956	2968	548798b64900a39f22af3d91c6423f10N.exe	51
PID 2968 wrote to memory of 1956	2968	548798b64900a39f22af3d91c6423f10N.exe	51
PID 2968 wrote to memory of 1732	2968	548798b64900a39f22af3d91c6423f10N.exe	52

C:\Users\Admin\AppData\Local\Temp\548798b64900a39f22af3d91c6423f10N.exe
"C:\Users\Admin\AppData\Local\Temp\548798b64900a39f22af3d91c6423f10N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2412
- C:\Windows\System\zNqXltj.exe
  C:\Windows\System\zNqXltj.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\NydjFAo.exe
  C:\Windows\System\NydjFAo.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\uhJQmsh.exe
  C:\Windows\System\uhJQmsh.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\scCwhYt.exe
  C:\Windows\System\scCwhYt.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\rPyUmVA.exe
  C:\Windows\System\rPyUmVA.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\zActqpq.exe
  C:\Windows\System\zActqpq.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\DjQocqq.exe
  C:\Windows\System\DjQocqq.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\enxlVtS.exe
  C:\Windows\System\enxlVtS.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\ThLyNNh.exe
  C:\Windows\System\ThLyNNh.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\OuDkXhT.exe
  C:\Windows\System\OuDkXhT.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\mgDmLCL.exe
  C:\Windows\System\mgDmLCL.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\CLEfnjR.exe
  C:\Windows\System\CLEfnjR.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\PegFylz.exe
  C:\Windows\System\PegFylz.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\wzBaYkS.exe
  C:\Windows\System\wzBaYkS.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\DFwgvVE.exe
  C:\Windows\System\DFwgvVE.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\oXfyaIG.exe
  C:\Windows\System\oXfyaIG.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\DuXrnqu.exe
  C:\Windows\System\DuXrnqu.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\OzZYZnF.exe
  C:\Windows\System\OzZYZnF.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\HPuyqDG.exe
  C:\Windows\System\HPuyqDG.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\AthRgvY.exe
  C:\Windows\System\AthRgvY.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\raPpMOE.exe
  C:\Windows\System\raPpMOE.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\LswzluO.exe
  C:\Windows\System\LswzluO.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\dxDfCjB.exe
  C:\Windows\System\dxDfCjB.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\mccFSkT.exe
  C:\Windows\System\mccFSkT.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\hdhuEKJ.exe
  C:\Windows\System\hdhuEKJ.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\MaEVGNq.exe
  C:\Windows\System\MaEVGNq.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\xaTmflh.exe
  C:\Windows\System\xaTmflh.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\KgHjQRS.exe
  C:\Windows\System\KgHjQRS.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\jtOvjmr.exe
  C:\Windows\System\jtOvjmr.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\WtpChgm.exe
  C:\Windows\System\WtpChgm.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\JkUxcEg.exe
  C:\Windows\System\JkUxcEg.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\izsnHXo.exe
  C:\Windows\System\izsnHXo.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\pkmeApF.exe
  C:\Windows\System\pkmeApF.exe
  2⤵
  - Executes dropped EXE
  PID:108
- C:\Windows\System\ttJggda.exe
  C:\Windows\System\ttJggda.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\aSjQoOW.exe
  C:\Windows\System\aSjQoOW.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\qaBUeFW.exe
  C:\Windows\System\qaBUeFW.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\cZUWPOF.exe
  C:\Windows\System\cZUWPOF.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\IgVurXy.exe
  C:\Windows\System\IgVurXy.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\bVvmUTj.exe
  C:\Windows\System\bVvmUTj.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\poWfdNb.exe
  C:\Windows\System\poWfdNb.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\PGYVRRa.exe
  C:\Windows\System\PGYVRRa.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\rhiBBLy.exe
  C:\Windows\System\rhiBBLy.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\KBvnxQc.exe
  C:\Windows\System\KBvnxQc.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\AixYAnr.exe
  C:\Windows\System\AixYAnr.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\QWhmcFM.exe
  C:\Windows\System\QWhmcFM.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\tEPHAKm.exe
  C:\Windows\System\tEPHAKm.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\KKUdaAF.exe
  C:\Windows\System\KKUdaAF.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\PEHirVc.exe
  C:\Windows\System\PEHirVc.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\hLQEsRb.exe
  C:\Windows\System\hLQEsRb.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\rNoaVwu.exe
  C:\Windows\System\rNoaVwu.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\axYRVru.exe
  C:\Windows\System\axYRVru.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\nrDkJMX.exe
  C:\Windows\System\nrDkJMX.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\fDxIjDp.exe
  C:\Windows\System\fDxIjDp.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\EawWUKB.exe
  C:\Windows\System\EawWUKB.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\rdWouAz.exe
  C:\Windows\System\rdWouAz.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\moCwGlS.exe
  C:\Windows\System\moCwGlS.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\peFyTQp.exe
  C:\Windows\System\peFyTQp.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\TEmSIms.exe
  C:\Windows\System\TEmSIms.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\uEmqSGh.exe
  C:\Windows\System\uEmqSGh.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\EsDdHnH.exe
  C:\Windows\System\EsDdHnH.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\WMBChLb.exe
  C:\Windows\System\WMBChLb.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\pYLaRpr.exe
  C:\Windows\System\pYLaRpr.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System\wfqAszI.exe
  C:\Windows\System\wfqAszI.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\MLgUqAS.exe
  C:\Windows\System\MLgUqAS.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\bUSJoYl.exe
  C:\Windows\System\bUSJoYl.exe
  2⤵
  PID:2892
- C:\Windows\System\ePztZwi.exe
  C:\Windows\System\ePztZwi.exe
  2⤵
  PID:2316
- C:\Windows\System\fcrAPSs.exe
  C:\Windows\System\fcrAPSs.exe
  2⤵
  PID:2884
- C:\Windows\System\AmAtkmf.exe
  C:\Windows\System\AmAtkmf.exe
  2⤵
  PID:2064
- C:\Windows\System\oOXDxBG.exe
  C:\Windows\System\oOXDxBG.exe
  2⤵
  PID:996
- C:\Windows\System\dMQYsXY.exe
  C:\Windows\System\dMQYsXY.exe
  2⤵
  PID:1604
- C:\Windows\System\JOegLKA.exe
  C:\Windows\System\JOegLKA.exe
  2⤵
  PID:1524
- C:\Windows\System\WaiawKM.exe
  C:\Windows\System\WaiawKM.exe
  2⤵
  PID:2724
- C:\Windows\System\EtoXTyF.exe
  C:\Windows\System\EtoXTyF.exe
  2⤵
  PID:2636
- C:\Windows\System\ilrUBkM.exe
  C:\Windows\System\ilrUBkM.exe
  2⤵
  PID:3004
- C:\Windows\System\tcovfDm.exe
  C:\Windows\System\tcovfDm.exe
  2⤵
  PID:2016
- C:\Windows\System\puyqbmC.exe
  C:\Windows\System\puyqbmC.exe
  2⤵
  PID:588
- C:\Windows\System\ZibsTXU.exe
  C:\Windows\System\ZibsTXU.exe
  2⤵
  PID:1396
- C:\Windows\System\zHiLcYl.exe
  C:\Windows\System\zHiLcYl.exe
  2⤵
  PID:2700
- C:\Windows\System\YfaZDxG.exe
  C:\Windows\System\YfaZDxG.exe
  2⤵
  PID:816
- C:\Windows\System\jphyayV.exe
  C:\Windows\System\jphyayV.exe
  2⤵
  PID:1644
- C:\Windows\System\YgoYLuP.exe
  C:\Windows\System\YgoYLuP.exe
  2⤵
  PID:1160
- C:\Windows\System\XIOyTNG.exe
  C:\Windows\System\XIOyTNG.exe
  2⤵
  PID:1820
- C:\Windows\System\QdpMvXK.exe
  C:\Windows\System\QdpMvXK.exe
  2⤵
  PID:1588
- C:\Windows\System\HzranvS.exe
  C:\Windows\System\HzranvS.exe
  2⤵
  PID:556
- C:\Windows\System\lRBHIwd.exe
  C:\Windows\System\lRBHIwd.exe
  2⤵
  PID:2300
- C:\Windows\System\GimksZz.exe
  C:\Windows\System\GimksZz.exe
  2⤵
  PID:2080
- C:\Windows\System\hbsfrNi.exe
  C:\Windows\System\hbsfrNi.exe
  2⤵
  PID:2924
- C:\Windows\System\PALfrRP.exe
  C:\Windows\System\PALfrRP.exe
  2⤵
  PID:2404
- C:\Windows\System\EgdbBgR.exe
  C:\Windows\System\EgdbBgR.exe
  2⤵
  PID:2452
- C:\Windows\System\SPrumUr.exe
  C:\Windows\System\SPrumUr.exe
  2⤵
  PID:2152
- C:\Windows\System\dAoEuvY.exe
  C:\Windows\System\dAoEuvY.exe
  2⤵
  PID:2268
- C:\Windows\System\nKQinZe.exe
  C:\Windows\System\nKQinZe.exe
  2⤵
  PID:2380
- C:\Windows\System\ehjDKvL.exe
  C:\Windows\System\ehjDKvL.exe
  2⤵
  PID:2148
- C:\Windows\System\TEBiDpN.exe
  C:\Windows\System\TEBiDpN.exe
  2⤵
  PID:1868
- C:\Windows\System\KzgcNVg.exe
  C:\Windows\System\KzgcNVg.exe
  2⤵
  PID:2328
- C:\Windows\System\ZdAzkjV.exe
  C:\Windows\System\ZdAzkjV.exe
  2⤵
  PID:2500
- C:\Windows\System\FyvPAPG.exe
  C:\Windows\System\FyvPAPG.exe
  2⤵
  PID:2244
- C:\Windows\System\TNaeGVJ.exe
  C:\Windows\System\TNaeGVJ.exe
  2⤵
  PID:2916
- C:\Windows\System\lwEnStZ.exe
  C:\Windows\System\lwEnStZ.exe
  2⤵
  PID:2604
- C:\Windows\System\KPZramG.exe
  C:\Windows\System\KPZramG.exe
  2⤵
  PID:3064
- C:\Windows\System\ASKiKYV.exe
  C:\Windows\System\ASKiKYV.exe
  2⤵
  PID:2816
- C:\Windows\System\iyHrBwr.exe
  C:\Windows\System\iyHrBwr.exe
  2⤵
  PID:2464
- C:\Windows\System\yQcKtYd.exe
  C:\Windows\System\yQcKtYd.exe
  2⤵
  PID:3000
- C:\Windows\System\xeNnCPw.exe
  C:\Windows\System\xeNnCPw.exe
  2⤵
  PID:1928
- C:\Windows\System\iPtLyrL.exe
  C:\Windows\System\iPtLyrL.exe
  2⤵
  PID:1804
- C:\Windows\System\OKWTOIx.exe
  C:\Windows\System\OKWTOIx.exe
  2⤵
  PID:2420
- C:\Windows\System\bKhGAwA.exe
  C:\Windows\System\bKhGAwA.exe
  2⤵
  PID:2004
- C:\Windows\System\AxuQaPl.exe
  C:\Windows\System\AxuQaPl.exe
  2⤵
  PID:1032
- C:\Windows\System\yJWRvqd.exe
  C:\Windows\System\yJWRvqd.exe
  2⤵
  PID:2648
- C:\Windows\System\FMMoeWq.exe
  C:\Windows\System\FMMoeWq.exe
  2⤵
  PID:352
- C:\Windows\System\zKHsSLy.exe
  C:\Windows\System\zKHsSLy.exe
  2⤵
  PID:1944
- C:\Windows\System\ILSAnlp.exe
  C:\Windows\System\ILSAnlp.exe
  2⤵
  PID:2940
- C:\Windows\System\pLXfEIS.exe
  C:\Windows\System\pLXfEIS.exe
  2⤵
  PID:1884
- C:\Windows\System\GWfsovX.exe
  C:\Windows\System\GWfsovX.exe
  2⤵
  PID:1864
- C:\Windows\System\QWlSLre.exe
  C:\Windows\System\QWlSLre.exe
  2⤵
  PID:1600
- C:\Windows\System\VfuEHvI.exe
  C:\Windows\System\VfuEHvI.exe
  2⤵
  PID:2712
- C:\Windows\System\fbUDyAn.exe
  C:\Windows\System\fbUDyAn.exe
  2⤵
  PID:1268
- C:\Windows\System\OSoRTIR.exe
  C:\Windows\System\OSoRTIR.exe
  2⤵
  PID:2684
- C:\Windows\System\fbDMNyN.exe
  C:\Windows\System\fbDMNyN.exe
  2⤵
  PID:2972
- C:\Windows\System\srlZIyq.exe
  C:\Windows\System\srlZIyq.exe
  2⤵
  PID:1692
- C:\Windows\System\dCksqvB.exe
  C:\Windows\System\dCksqvB.exe
  2⤵
  PID:2000
- C:\Windows\System\YZaKoPj.exe
  C:\Windows\System\YZaKoPj.exe
  2⤵
  PID:2504
- C:\Windows\System\WwXXnWl.exe
  C:\Windows\System\WwXXnWl.exe
  2⤵
  PID:1656
- C:\Windows\System\aqjAzQQ.exe
  C:\Windows\System\aqjAzQQ.exe
  2⤵
  PID:1492
- C:\Windows\System\djNdtzP.exe
  C:\Windows\System\djNdtzP.exe
  2⤵
  PID:1736
- C:\Windows\System\fkLuFTz.exe
  C:\Windows\System\fkLuFTz.exe
  2⤵
  PID:1780
- C:\Windows\System\UNWWeWW.exe
  C:\Windows\System\UNWWeWW.exe
  2⤵
  PID:2204
- C:\Windows\System\BWopund.exe
  C:\Windows\System\BWopund.exe
  2⤵
  PID:2844
- C:\Windows\System\yYpVwVZ.exe
  C:\Windows\System\yYpVwVZ.exe
  2⤵
  PID:2696
- C:\Windows\System\LWjuTcV.exe
  C:\Windows\System\LWjuTcV.exe
  2⤵
  PID:2728
- C:\Windows\System\ipWGmFX.exe
  C:\Windows\System\ipWGmFX.exe
  2⤵
  PID:836
- C:\Windows\System\jcSrwxm.exe
  C:\Windows\System\jcSrwxm.exe
  2⤵
  PID:3032
- C:\Windows\System\nkVNmZx.exe
  C:\Windows\System\nkVNmZx.exe
  2⤵
  PID:1316
- C:\Windows\System\itMAGcM.exe
  C:\Windows\System\itMAGcM.exe
  2⤵
  PID:2608
- C:\Windows\System\taLlHVT.exe
  C:\Windows\System\taLlHVT.exe
  2⤵
  PID:2456
- C:\Windows\System\bzMiSoE.exe
  C:\Windows\System\bzMiSoE.exe
  2⤵
  PID:1348
- C:\Windows\System\gedpWNT.exe
  C:\Windows\System\gedpWNT.exe
  2⤵
  PID:1356
- C:\Windows\System\LXIzpbU.exe
  C:\Windows\System\LXIzpbU.exe
  2⤵
  PID:2372
- C:\Windows\System\wHrXdZQ.exe
  C:\Windows\System\wHrXdZQ.exe
  2⤵
  PID:2776
- C:\Windows\System\OsHOUTA.exe
  C:\Windows\System\OsHOUTA.exe
  2⤵
  PID:768
- C:\Windows\System\PUMGrsN.exe
  C:\Windows\System\PUMGrsN.exe
  2⤵
  PID:904
- C:\Windows\System\AAbQxZO.exe
  C:\Windows\System\AAbQxZO.exe
  2⤵
  PID:2076
- C:\Windows\System\LJPzUrx.exe
  C:\Windows\System\LJPzUrx.exe
  2⤵
  PID:1584
- C:\Windows\System\zydaFIg.exe
  C:\Windows\System\zydaFIg.exe
  2⤵
  PID:2664
- C:\Windows\System\gWppYPd.exe
  C:\Windows\System\gWppYPd.exe
  2⤵
  PID:1700
- C:\Windows\System\yckMLwo.exe
  C:\Windows\System\yckMLwo.exe
  2⤵
  PID:756
- C:\Windows\System\NkoSSHd.exe
  C:\Windows\System\NkoSSHd.exe
  2⤵
  PID:1508
- C:\Windows\System\BGRsKJd.exe
  C:\Windows\System\BGRsKJd.exe
  2⤵
  PID:1596
- C:\Windows\System\jGlxqSt.exe
  C:\Windows\System\jGlxqSt.exe
  2⤵
  PID:2928
- C:\Windows\System\wVACcKh.exe
  C:\Windows\System\wVACcKh.exe
  2⤵
  PID:1744
- C:\Windows\System\TFkLttx.exe
  C:\Windows\System\TFkLttx.exe
  2⤵
  PID:2820
- C:\Windows\System\pNYjuVD.exe
  C:\Windows\System\pNYjuVD.exe
  2⤵
  PID:3080
- C:\Windows\System\hQEdilK.exe
  C:\Windows\System\hQEdilK.exe
  2⤵
  PID:3096
- C:\Windows\System\hKQDdfI.exe
  C:\Windows\System\hKQDdfI.exe
  2⤵
  PID:3112
- C:\Windows\System\DwymXYy.exe
  C:\Windows\System\DwymXYy.exe
  2⤵
  PID:3128
- C:\Windows\System\iIItCEA.exe
  C:\Windows\System\iIItCEA.exe
  2⤵
  PID:3144
- C:\Windows\System\dvWSrgT.exe
  C:\Windows\System\dvWSrgT.exe
  2⤵
  PID:3160
- C:\Windows\System\dbZiuUd.exe
  C:\Windows\System\dbZiuUd.exe
  2⤵
  PID:3176
- C:\Windows\System\uPKpTYe.exe
  C:\Windows\System\uPKpTYe.exe
  2⤵
  PID:3192
- C:\Windows\System\BxlGYHC.exe
  C:\Windows\System\BxlGYHC.exe
  2⤵
  PID:3208
- C:\Windows\System\nAUxUPd.exe
  C:\Windows\System\nAUxUPd.exe
  2⤵
  PID:3224
- C:\Windows\System\YXImWoT.exe
  C:\Windows\System\YXImWoT.exe
  2⤵
  PID:3240
- C:\Windows\System\jcmRrvf.exe
  C:\Windows\System\jcmRrvf.exe
  2⤵
  PID:3256
- C:\Windows\System\gzYwyMo.exe
  C:\Windows\System\gzYwyMo.exe
  2⤵
  PID:3272
- C:\Windows\System\twNyamx.exe
  C:\Windows\System\twNyamx.exe
  2⤵
  PID:3288
- C:\Windows\System\uxFGgIy.exe
  C:\Windows\System\uxFGgIy.exe
  2⤵
  PID:3304
- C:\Windows\System\PXZMvQS.exe
  C:\Windows\System\PXZMvQS.exe
  2⤵
  PID:3320
- C:\Windows\System\SmTeJcB.exe
  C:\Windows\System\SmTeJcB.exe
  2⤵
  PID:3336
- C:\Windows\System\XjGqojJ.exe
  C:\Windows\System\XjGqojJ.exe
  2⤵
  PID:3352
- C:\Windows\System\hkoIGdv.exe
  C:\Windows\System\hkoIGdv.exe
  2⤵
  PID:3368
- C:\Windows\System\waNXqjc.exe
  C:\Windows\System\waNXqjc.exe
  2⤵
  PID:3384
- C:\Windows\System\HIrFNJE.exe
  C:\Windows\System\HIrFNJE.exe
  2⤵
  PID:3400
- C:\Windows\System\AKijjwK.exe
  C:\Windows\System\AKijjwK.exe
  2⤵
  PID:3416
- C:\Windows\System\TxcvBdI.exe
  C:\Windows\System\TxcvBdI.exe
  2⤵
  PID:3432
- C:\Windows\System\JqtFHJw.exe
  C:\Windows\System\JqtFHJw.exe
  2⤵
  PID:3448
- C:\Windows\System\mxztJee.exe
  C:\Windows\System\mxztJee.exe
  2⤵
  PID:3464
- C:\Windows\System\UTiXiwn.exe
  C:\Windows\System\UTiXiwn.exe
  2⤵
  PID:3480
- C:\Windows\System\pYwipFM.exe
  C:\Windows\System\pYwipFM.exe
  2⤵
  PID:3496
- C:\Windows\System\lQfbLSx.exe
  C:\Windows\System\lQfbLSx.exe
  2⤵
  PID:3512
- C:\Windows\System\WYeEfoq.exe
  C:\Windows\System\WYeEfoq.exe
  2⤵
  PID:3528
- C:\Windows\System\gFhrwUd.exe
  C:\Windows\System\gFhrwUd.exe
  2⤵
  PID:3544
- C:\Windows\System\PzfOrky.exe
  C:\Windows\System\PzfOrky.exe
  2⤵
  PID:3560
- C:\Windows\System\TNflhXA.exe
  C:\Windows\System\TNflhXA.exe
  2⤵
  PID:3576
- C:\Windows\System\Gnodxfy.exe
  C:\Windows\System\Gnodxfy.exe
  2⤵
  PID:3592
- C:\Windows\System\oCEGWtH.exe
  C:\Windows\System\oCEGWtH.exe
  2⤵
  PID:3608
- C:\Windows\System\dBnQCkJ.exe
  C:\Windows\System\dBnQCkJ.exe
  2⤵
  PID:3624
- C:\Windows\System\JdfSAxB.exe
  C:\Windows\System\JdfSAxB.exe
  2⤵
  PID:3640
- C:\Windows\System\vgbQFsz.exe
  C:\Windows\System\vgbQFsz.exe
  2⤵
  PID:3656
- C:\Windows\System\wJLEUEr.exe
  C:\Windows\System\wJLEUEr.exe
  2⤵
  PID:3672
- C:\Windows\System\nTKrmbs.exe
  C:\Windows\System\nTKrmbs.exe
  2⤵
  PID:3688
- C:\Windows\System\ofzZgQj.exe
  C:\Windows\System\ofzZgQj.exe
  2⤵
  PID:3704
- C:\Windows\System\DPiqBRr.exe
  C:\Windows\System\DPiqBRr.exe
  2⤵
  PID:3720
- C:\Windows\System\cIPmwsO.exe
  C:\Windows\System\cIPmwsO.exe
  2⤵
  PID:3736
- C:\Windows\System\hcYWEDX.exe
  C:\Windows\System\hcYWEDX.exe
  2⤵
  PID:3752
- C:\Windows\System\xgXzYwt.exe
  C:\Windows\System\xgXzYwt.exe
  2⤵
  PID:3768
- C:\Windows\System\tfwCFHr.exe
  C:\Windows\System\tfwCFHr.exe
  2⤵
  PID:3784
- C:\Windows\System\ibppidG.exe
  C:\Windows\System\ibppidG.exe
  2⤵
  PID:3800
- C:\Windows\System\KeflhXh.exe
  C:\Windows\System\KeflhXh.exe
  2⤵
  PID:3816
- C:\Windows\System\IZvLrVk.exe
  C:\Windows\System\IZvLrVk.exe
  2⤵
  PID:3832
- C:\Windows\System\oyIRrZN.exe
  C:\Windows\System\oyIRrZN.exe
  2⤵
  PID:3848
- C:\Windows\System\bPdtmCG.exe
  C:\Windows\System\bPdtmCG.exe
  2⤵
  PID:3864
- C:\Windows\System\gyLhEiF.exe
  C:\Windows\System\gyLhEiF.exe
  2⤵
  PID:3880
- C:\Windows\System\YscWCSe.exe
  C:\Windows\System\YscWCSe.exe
  2⤵
  PID:3896
- C:\Windows\System\brskOOx.exe
  C:\Windows\System\brskOOx.exe
  2⤵
  PID:3912
- C:\Windows\System\GwWsBaN.exe
  C:\Windows\System\GwWsBaN.exe
  2⤵
  PID:3928
- C:\Windows\System\EwLnCVA.exe
  C:\Windows\System\EwLnCVA.exe
  2⤵
  PID:3944
- C:\Windows\System\lvDatsq.exe
  C:\Windows\System\lvDatsq.exe
  2⤵
  PID:3960
- C:\Windows\System\bBfUTma.exe
  C:\Windows\System\bBfUTma.exe
  2⤵
  PID:3976
- C:\Windows\System\mkesqvp.exe
  C:\Windows\System\mkesqvp.exe
  2⤵
  PID:3992
- C:\Windows\System\tmDhCjl.exe
  C:\Windows\System\tmDhCjl.exe
  2⤵
  PID:4008
- C:\Windows\System\YKuCfSA.exe
  C:\Windows\System\YKuCfSA.exe
  2⤵
  PID:4024
- C:\Windows\System\VRaMCJD.exe
  C:\Windows\System\VRaMCJD.exe
  2⤵
  PID:4040
- C:\Windows\System\yZSpzYl.exe
  C:\Windows\System\yZSpzYl.exe
  2⤵
  PID:4056
- C:\Windows\System\IMClUxp.exe
  C:\Windows\System\IMClUxp.exe
  2⤵
  PID:4072
- C:\Windows\System\rfDAzjG.exe
  C:\Windows\System\rfDAzjG.exe
  2⤵
  PID:4088
- C:\Windows\System\kpmrxqS.exe
  C:\Windows\System\kpmrxqS.exe
  2⤵
  PID:2644
- C:\Windows\System\uLbvcjR.exe
  C:\Windows\System\uLbvcjR.exe
  2⤵
  PID:2904
- C:\Windows\System\AvffuSI.exe
  C:\Windows\System\AvffuSI.exe
  2⤵
  PID:2948
- C:\Windows\System\hiCnayv.exe
  C:\Windows\System\hiCnayv.exe
  2⤵
  PID:3076
- C:\Windows\System\YGbyRUs.exe
  C:\Windows\System\YGbyRUs.exe
  2⤵
  PID:3136
- C:\Windows\System\VITcTpa.exe
  C:\Windows\System\VITcTpa.exe
  2⤵
  PID:3120
- C:\Windows\System\vfUNGBP.exe
  C:\Windows\System\vfUNGBP.exe
  2⤵
  PID:3172
- C:\Windows\System\tTdSmVl.exe
  C:\Windows\System\tTdSmVl.exe
  2⤵
  PID:3204
- C:\Windows\System\xDsJOkm.exe
  C:\Windows\System\xDsJOkm.exe
  2⤵
  PID:3232
- C:\Windows\System\EqMspxN.exe
  C:\Windows\System\EqMspxN.exe
  2⤵
  PID:3264
- C:\Windows\System\rocqgAt.exe
  C:\Windows\System\rocqgAt.exe
  2⤵
  PID:3296
- C:\Windows\System\bPiKaKN.exe
  C:\Windows\System\bPiKaKN.exe
  2⤵
  PID:3328
- C:\Windows\System\JcglvRX.exe
  C:\Windows\System\JcglvRX.exe
  2⤵
  PID:3360
- C:\Windows\System\ylNAiZZ.exe
  C:\Windows\System\ylNAiZZ.exe
  2⤵
  PID:3392
- C:\Windows\System\VzmNHBq.exe
  C:\Windows\System\VzmNHBq.exe
  2⤵
  PID:3412
- C:\Windows\System\gzKKtxD.exe
  C:\Windows\System\gzKKtxD.exe
  2⤵
  PID:3444
- C:\Windows\System\woWJLaF.exe
  C:\Windows\System\woWJLaF.exe
  2⤵
  PID:3476
- C:\Windows\System\jMCWexJ.exe
  C:\Windows\System\jMCWexJ.exe
  2⤵
  PID:3520
- C:\Windows\System\URArMOZ.exe
  C:\Windows\System\URArMOZ.exe
  2⤵
  PID:3540
- C:\Windows\System\vgaAGHY.exe
  C:\Windows\System\vgaAGHY.exe
  2⤵
  PID:3584
- C:\Windows\System\BDAXNNp.exe
  C:\Windows\System\BDAXNNp.exe
  2⤵
  PID:3604
- C:\Windows\System\TBLInGy.exe
  C:\Windows\System\TBLInGy.exe
  2⤵
  PID:3648
- C:\Windows\System\QxYqtyn.exe
  C:\Windows\System\QxYqtyn.exe
  2⤵
  PID:3680
- C:\Windows\System\zekihgI.exe
  C:\Windows\System\zekihgI.exe
  2⤵
  PID:3712
- C:\Windows\System\RtdZmCe.exe
  C:\Windows\System\RtdZmCe.exe
  2⤵
  PID:3732
- C:\Windows\System\JrwhAvu.exe
  C:\Windows\System\JrwhAvu.exe
  2⤵
  PID:3776
- C:\Windows\System\waOqlIB.exe
  C:\Windows\System\waOqlIB.exe
  2⤵
  PID:3796
- C:\Windows\System\EtkPymM.exe
  C:\Windows\System\EtkPymM.exe
  2⤵
  PID:3840
- C:\Windows\System\iFNWfTK.exe
  C:\Windows\System\iFNWfTK.exe
  2⤵
  PID:3872
- C:\Windows\System\ZdzNQMz.exe
  C:\Windows\System\ZdzNQMz.exe
  2⤵
  PID:3904
- C:\Windows\System\PsLDfXU.exe
  C:\Windows\System\PsLDfXU.exe
  2⤵
  PID:3936
- C:\Windows\System\VoWzSTJ.exe
  C:\Windows\System\VoWzSTJ.exe
  2⤵
  PID:3968
- C:\Windows\System\BqGEBfh.exe
  C:\Windows\System\BqGEBfh.exe
  2⤵
  PID:288
- C:\Windows\System\iVLpylP.exe
  C:\Windows\System\iVLpylP.exe
  2⤵
  PID:2444
- C:\Windows\System\LnDSnNz.exe
  C:\Windows\System\LnDSnNz.exe
  2⤵
  PID:3088
- C:\Windows\System\moTpfNt.exe
  C:\Windows\System\moTpfNt.exe
  2⤵
  PID:3216
- C:\Windows\System\WWyCTFP.exe
  C:\Windows\System\WWyCTFP.exe
  2⤵
  PID:3236
- C:\Windows\System\dhjaVlq.exe
  C:\Windows\System\dhjaVlq.exe
  2⤵
  PID:3300
- C:\Windows\System\xmZucRu.exe
  C:\Windows\System\xmZucRu.exe
  2⤵
  PID:3364
- C:\Windows\System\qJHJjZt.exe
  C:\Windows\System\qJHJjZt.exe
  2⤵
  PID:3428
- C:\Windows\System\iSuyDTR.exe
  C:\Windows\System\iSuyDTR.exe
  2⤵
  PID:3492
- C:\Windows\System\MECXNRh.exe
  C:\Windows\System\MECXNRh.exe
  2⤵
  PID:3556
- C:\Windows\System\gDOCgvI.exe
  C:\Windows\System\gDOCgvI.exe
  2⤵
  PID:3600
- C:\Windows\System\ldWQtzD.exe
  C:\Windows\System\ldWQtzD.exe
  2⤵
  PID:3860
- C:\Windows\System\VepeGDN.exe
  C:\Windows\System\VepeGDN.exe
  2⤵
  PID:3716
- C:\Windows\System\VxeFxtc.exe
  C:\Windows\System\VxeFxtc.exe
  2⤵
  PID:3984
- C:\Windows\System\kmnPZvx.exe
  C:\Windows\System\kmnPZvx.exe
  2⤵
  PID:3844
- C:\Windows\System\qwYuHcn.exe
  C:\Windows\System\qwYuHcn.exe
  2⤵
  PID:3748
- C:\Windows\System\ynKDSrB.exe
  C:\Windows\System\ynKDSrB.exe
  2⤵
  PID:4032
- C:\Windows\System\osJaLtX.exe
  C:\Windows\System\osJaLtX.exe
  2⤵
  PID:4036
- C:\Windows\System\mMoetNQ.exe
  C:\Windows\System\mMoetNQ.exe
  2⤵
  PID:4080
- C:\Windows\System\ImyJGET.exe
  C:\Windows\System\ImyJGET.exe
  2⤵
  PID:3108
- C:\Windows\System\NyIuMfO.exe
  C:\Windows\System\NyIuMfO.exe
  2⤵
  PID:1364
- C:\Windows\System\dOWUehd.exe
  C:\Windows\System\dOWUehd.exe
  2⤵
  PID:3008
- C:\Windows\System\udvvcDV.exe
  C:\Windows\System\udvvcDV.exe
  2⤵
  PID:2060
- C:\Windows\System\mNnCrOh.exe
  C:\Windows\System\mNnCrOh.exe
  2⤵
  PID:760
- C:\Windows\System\UlmGHNI.exe
  C:\Windows\System\UlmGHNI.exe
  2⤵
  PID:3620
- C:\Windows\System\rCugUYi.exe
  C:\Windows\System\rCugUYi.exe
  2⤵
  PID:3248
- C:\Windows\System\NqQZzaR.exe
  C:\Windows\System\NqQZzaR.exe
  2⤵
  PID:4108
- C:\Windows\System\LOdBjKb.exe
  C:\Windows\System\LOdBjKb.exe
  2⤵
  PID:4124
- C:\Windows\System\UMXAGzd.exe
  C:\Windows\System\UMXAGzd.exe
  2⤵
  PID:4140
- C:\Windows\System\CCVhWDo.exe
  C:\Windows\System\CCVhWDo.exe
  2⤵
  PID:4156
- C:\Windows\System\rCfJgCT.exe
  C:\Windows\System\rCfJgCT.exe
  2⤵
  PID:4172
- C:\Windows\System\DurrqTM.exe
  C:\Windows\System\DurrqTM.exe
  2⤵
  PID:4188
- C:\Windows\System\zCzyVjJ.exe
  C:\Windows\System\zCzyVjJ.exe
  2⤵
  PID:4212
- C:\Windows\System\BfmDjAZ.exe
  C:\Windows\System\BfmDjAZ.exe
  2⤵
  PID:4280
- C:\Windows\System\EevnTFH.exe
  C:\Windows\System\EevnTFH.exe
  2⤵
  PID:4300
- C:\Windows\System\YSrPhbJ.exe
  C:\Windows\System\YSrPhbJ.exe
  2⤵
  PID:4316
- C:\Windows\System\ZobUpjd.exe
  C:\Windows\System\ZobUpjd.exe
  2⤵
  PID:4332
- C:\Windows\System\OvqtJKR.exe
  C:\Windows\System\OvqtJKR.exe
  2⤵
  PID:4348
- C:\Windows\System\nCzsaMK.exe
  C:\Windows\System\nCzsaMK.exe
  2⤵
  PID:4364
- C:\Windows\System\TTnAFwG.exe
  C:\Windows\System\TTnAFwG.exe
  2⤵
  PID:4380
- C:\Windows\System\CYtCbAe.exe
  C:\Windows\System\CYtCbAe.exe
  2⤵
  PID:4396
- C:\Windows\System\QgMIOlD.exe
  C:\Windows\System\QgMIOlD.exe
  2⤵
  PID:4412
- C:\Windows\System\mrGlFkS.exe
  C:\Windows\System\mrGlFkS.exe
  2⤵
  PID:4428
- C:\Windows\System\rzvWkdG.exe
  C:\Windows\System\rzvWkdG.exe
  2⤵
  PID:4444
- C:\Windows\System\EVXYNYM.exe
  C:\Windows\System\EVXYNYM.exe
  2⤵
  PID:4464
- C:\Windows\System\kjEGUjw.exe
  C:\Windows\System\kjEGUjw.exe
  2⤵
  PID:4480
- C:\Windows\System\nODODRU.exe
  C:\Windows\System\nODODRU.exe
  2⤵
  PID:4496
- C:\Windows\System\LyiyctL.exe
  C:\Windows\System\LyiyctL.exe
  2⤵
  PID:4512
- C:\Windows\System\rEeTfwh.exe
  C:\Windows\System\rEeTfwh.exe
  2⤵
  PID:4528
- C:\Windows\System\ShWbNGn.exe
  C:\Windows\System\ShWbNGn.exe
  2⤵
  PID:4544
- C:\Windows\System\JvaWxXL.exe
  C:\Windows\System\JvaWxXL.exe
  2⤵
  PID:4564
- C:\Windows\System\JkFItqb.exe
  C:\Windows\System\JkFItqb.exe
  2⤵
  PID:4580
- C:\Windows\System\FikyxYc.exe
  C:\Windows\System\FikyxYc.exe
  2⤵
  PID:4608
- C:\Windows\System\bGawpZK.exe
  C:\Windows\System\bGawpZK.exe
  2⤵
  PID:4628
- C:\Windows\System\AmEqlww.exe
  C:\Windows\System\AmEqlww.exe
  2⤵
  PID:4644
- C:\Windows\System\PeCtHWZ.exe
  C:\Windows\System\PeCtHWZ.exe
  2⤵
  PID:4660
- C:\Windows\System\ofNAWPN.exe
  C:\Windows\System\ofNAWPN.exe
  2⤵
  PID:4680
- C:\Windows\System\VLijeMm.exe
  C:\Windows\System\VLijeMm.exe
  2⤵
  PID:4696
- C:\Windows\System\YNOqgzB.exe
  C:\Windows\System\YNOqgzB.exe
  2⤵
  PID:4712
- C:\Windows\System\bIxKTWu.exe
  C:\Windows\System\bIxKTWu.exe
  2⤵
  PID:4728
- C:\Windows\System\cNgJQgg.exe
  C:\Windows\System\cNgJQgg.exe
  2⤵
  PID:4744
- C:\Windows\System\YbCqWwM.exe
  C:\Windows\System\YbCqWwM.exe
  2⤵
  PID:4760
- C:\Windows\System\twKSQTx.exe
  C:\Windows\System\twKSQTx.exe
  2⤵
  PID:4776
- C:\Windows\System\Omhyfss.exe
  C:\Windows\System\Omhyfss.exe
  2⤵
  PID:4796
- C:\Windows\System\pbtfLIA.exe
  C:\Windows\System\pbtfLIA.exe
  2⤵
  PID:4812
- C:\Windows\System\uFqebas.exe
  C:\Windows\System\uFqebas.exe
  2⤵
  PID:4828
- C:\Windows\System\xwEyKnF.exe
  C:\Windows\System\xwEyKnF.exe
  2⤵
  PID:4848
- C:\Windows\System\vxNygxg.exe
  C:\Windows\System\vxNygxg.exe
  2⤵
  PID:4868
- C:\Windows\System\MQxkRhJ.exe
  C:\Windows\System\MQxkRhJ.exe
  2⤵
  PID:4884
- C:\Windows\System\VyAjNTp.exe
  C:\Windows\System\VyAjNTp.exe
  2⤵
  PID:4900
- C:\Windows\System\bOUWeGD.exe
  C:\Windows\System\bOUWeGD.exe
  2⤵
  PID:4920
- C:\Windows\System\TvbGeXt.exe
  C:\Windows\System\TvbGeXt.exe
  2⤵
  PID:4936
- C:\Windows\System\icgNDqb.exe
  C:\Windows\System\icgNDqb.exe
  2⤵
  PID:4952
- C:\Windows\System\vFDmXQy.exe
  C:\Windows\System\vFDmXQy.exe
  2⤵
  PID:4968
- C:\Windows\System\XZzIzLW.exe
  C:\Windows\System\XZzIzLW.exe
  2⤵
  PID:4984
- C:\Windows\System\NRiAACA.exe
  C:\Windows\System\NRiAACA.exe
  2⤵
  PID:5000
- C:\Windows\System\wFxLcsR.exe
  C:\Windows\System\wFxLcsR.exe
  2⤵
  PID:5016
- C:\Windows\System\CFikCCR.exe
  C:\Windows\System\CFikCCR.exe
  2⤵
  PID:5036
- C:\Windows\System\hHZehOh.exe
  C:\Windows\System\hHZehOh.exe
  2⤵
  PID:5060
- C:\Windows\System\awwjAdr.exe
  C:\Windows\System\awwjAdr.exe
  2⤵
  PID:5080
- C:\Windows\System\pbmIAFJ.exe
  C:\Windows\System\pbmIAFJ.exe
  2⤵
  PID:5096
- C:\Windows\System\khQDwTi.exe
  C:\Windows\System\khQDwTi.exe
  2⤵
  PID:5112
- C:\Windows\System\ofiXBYk.exe
  C:\Windows\System\ofiXBYk.exe
  2⤵
  PID:3632
- C:\Windows\System\uvViUaA.exe
  C:\Windows\System\uvViUaA.exe
  2⤵
  PID:3940
- C:\Windows\System\PiEGyvS.exe
  C:\Windows\System\PiEGyvS.exe
  2⤵
  PID:1264
- C:\Windows\System\hGbkxfh.exe
  C:\Windows\System\hGbkxfh.exe
  2⤵
  PID:4052
- C:\Windows\System\LlfYjjO.exe
  C:\Windows\System\LlfYjjO.exe
  2⤵
  PID:3092
- C:\Windows\System\avjfqHJ.exe
  C:\Windows\System\avjfqHJ.exe
  2⤵
  PID:3472
- C:\Windows\System\ucrLyMx.exe
  C:\Windows\System\ucrLyMx.exe
  2⤵
  PID:4136
- C:\Windows\System\CsmqXUt.exe
  C:\Windows\System\CsmqXUt.exe
  2⤵
  PID:4200
- C:\Windows\System\tJfMMNJ.exe
  C:\Windows\System\tJfMMNJ.exe
  2⤵
  PID:3812
- C:\Windows\System\iQhsuil.exe
  C:\Windows\System\iQhsuil.exe
  2⤵
  PID:1676
- C:\Windows\System\pKAdHfq.exe
  C:\Windows\System\pKAdHfq.exe
  2⤵
  PID:2748
- C:\Windows\System\mFKosdj.exe
  C:\Windows\System\mFKosdj.exe
  2⤵
  PID:4204
- C:\Windows\System\QRPnGtu.exe
  C:\Windows\System\QRPnGtu.exe
  2⤵
  PID:4152
- C:\Windows\System\xIObRBb.exe
  C:\Windows\System\xIObRBb.exe
  2⤵
  PID:4228
- C:\Windows\System\vCcEhAA.exe
  C:\Windows\System\vCcEhAA.exe
  2⤵
  PID:4324
- C:\Windows\System\KnhwSvz.exe
  C:\Windows\System\KnhwSvz.exe
  2⤵
  PID:4388
- C:\Windows\System\JrJFFxD.exe
  C:\Windows\System\JrJFFxD.exe
  2⤵
  PID:4420
- C:\Windows\System\XhOumpi.exe
  C:\Windows\System\XhOumpi.exe
  2⤵
  PID:4460
- C:\Windows\System\AmuuCwI.exe
  C:\Windows\System\AmuuCwI.exe
  2⤵
  PID:4344
- C:\Windows\System\LISijXs.exe
  C:\Windows\System\LISijXs.exe
  2⤵
  PID:4520
- C:\Windows\System\haRMWOo.exe
  C:\Windows\System\haRMWOo.exe
  2⤵
  PID:4524
- C:\Windows\System\LIAMAFV.exe
  C:\Windows\System\LIAMAFV.exe
  2⤵
  PID:4476
- C:\Windows\System\oubXPRx.exe
  C:\Windows\System\oubXPRx.exe
  2⤵
  PID:4600
- C:\Windows\System\aWMSMnO.exe
  C:\Windows\System\aWMSMnO.exe
  2⤵
  PID:4536
- C:\Windows\System\pLpvpUX.exe
  C:\Windows\System\pLpvpUX.exe
  2⤵
  PID:4636
- C:\Windows\System\ciKpMUj.exe
  C:\Windows\System\ciKpMUj.exe
  2⤵
  PID:4676
- C:\Windows\System\DKtgrtP.exe
  C:\Windows\System\DKtgrtP.exe
  2⤵
  PID:4740
- C:\Windows\System\iksaAmz.exe
  C:\Windows\System\iksaAmz.exe
  2⤵
  PID:4804
- C:\Windows\System\HBEPnDA.exe
  C:\Windows\System\HBEPnDA.exe
  2⤵
  PID:4656
- C:\Windows\System\RBmrAvU.exe
  C:\Windows\System\RBmrAvU.exe
  2⤵
  PID:4724
- C:\Windows\System\efJvTyd.exe
  C:\Windows\System\efJvTyd.exe
  2⤵
  PID:4788
- C:\Windows\System\vCJuMEr.exe
  C:\Windows\System\vCJuMEr.exe
  2⤵
  PID:4876
- C:\Windows\System\mMdYolM.exe
  C:\Windows\System\mMdYolM.exe
  2⤵
  PID:4908
- C:\Windows\System\NSSTbum.exe
  C:\Windows\System\NSSTbum.exe
  2⤵
  PID:4944
- C:\Windows\System\gVwGqgw.exe
  C:\Windows\System\gVwGqgw.exe
  2⤵
  PID:4892
- C:\Windows\System\QWCvmva.exe
  C:\Windows\System\QWCvmva.exe
  2⤵
  PID:4960
- C:\Windows\System\ezXAihj.exe
  C:\Windows\System\ezXAihj.exe
  2⤵
  PID:5008
- C:\Windows\System\yfTlWGo.exe
  C:\Windows\System\yfTlWGo.exe
  2⤵
  PID:5052
- C:\Windows\System\IuTLAEN.exe
  C:\Windows\System\IuTLAEN.exe
  2⤵
  PID:5088
- C:\Windows\System\IUYXZiM.exe
  C:\Windows\System\IUYXZiM.exe
  2⤵
  PID:3856
- C:\Windows\System\ReQIOjd.exe
  C:\Windows\System\ReQIOjd.exe
  2⤵
  PID:4104
- C:\Windows\System\LtRQcTs.exe
  C:\Windows\System\LtRQcTs.exe
  2⤵
  PID:328
- C:\Windows\System\ByPtdwP.exe
  C:\Windows\System\ByPtdwP.exe
  2⤵
  PID:5028
- C:\Windows\System\yIQKcBt.exe
  C:\Windows\System\yIQKcBt.exe
  2⤵
  PID:4196
- C:\Windows\System\WJsuqlX.exe
  C:\Windows\System\WJsuqlX.exe
  2⤵
  PID:3780
- C:\Windows\System\NVsucvF.exe
  C:\Windows\System\NVsucvF.exe
  2⤵
  PID:3344
- C:\Windows\System\hqhUspi.exe
  C:\Windows\System\hqhUspi.exe
  2⤵
  PID:3664
- C:\Windows\System\ZxgjYyv.exe
  C:\Windows\System\ZxgjYyv.exe
  2⤵
  PID:3440
- C:\Windows\System\QKuesUi.exe
  C:\Windows\System\QKuesUi.exe
  2⤵
  PID:3280
- C:\Windows\System\xZRDRZX.exe
  C:\Windows\System\xZRDRZX.exe
  2⤵
  PID:4264
- C:\Windows\System\EOojsDV.exe
  C:\Windows\System\EOojsDV.exe
  2⤵
  PID:4360
- C:\Windows\System\XqDTfgL.exe
  C:\Windows\System\XqDTfgL.exe
  2⤵
  PID:4220
- C:\Windows\System\qOeetsZ.exe
  C:\Windows\System\qOeetsZ.exe
  2⤵
  PID:4452
- C:\Windows\System\mNjMerS.exe
  C:\Windows\System\mNjMerS.exe
  2⤵
  PID:4592
- C:\Windows\System\yvLDipA.exe
  C:\Windows\System\yvLDipA.exe
  2⤵
  PID:4836
- C:\Windows\System\QRBuBuk.exe
  C:\Windows\System\QRBuBuk.exe
  2⤵
  PID:4504
- C:\Windows\System\XJJpIIP.exe
  C:\Windows\System\XJJpIIP.exe
  2⤵
  PID:4672
- C:\Windows\System\SKMLpJp.exe
  C:\Windows\System\SKMLpJp.exe
  2⤵
  PID:1716
- C:\Windows\System\JcetCAD.exe
  C:\Windows\System\JcetCAD.exe
  2⤵
  PID:4560
- C:\Windows\System\mjeLqiO.exe
  C:\Windows\System\mjeLqiO.exe
  2⤵
  PID:4824
- C:\Windows\System\FgkKuLc.exe
  C:\Windows\System\FgkKuLc.exe
  2⤵
  PID:4720
- C:\Windows\System\tfMwWDd.exe
  C:\Windows\System\tfMwWDd.exe
  2⤵
  PID:5048
- C:\Windows\System\gUPkUfw.exe
  C:\Windows\System\gUPkUfw.exe
  2⤵
  PID:4996
- C:\Windows\System\uaIOdue.exe
  C:\Windows\System\uaIOdue.exe
  2⤵
  PID:4004
- C:\Windows\System\YxSbUML.exe
  C:\Windows\System\YxSbUML.exe
  2⤵
  PID:4624
- C:\Windows\System\rSriRwt.exe
  C:\Windows\System\rSriRwt.exe
  2⤵
  PID:5076
- C:\Windows\System\zJIuKIT.exe
  C:\Windows\System\zJIuKIT.exe
  2⤵
  PID:4168
- C:\Windows\System\uQjHrJF.exe
  C:\Windows\System\uQjHrJF.exe
  2⤵
  PID:3408
- C:\Windows\System\eqOOyBi.exe
  C:\Windows\System\eqOOyBi.exe
  2⤵
  PID:4084
- C:\Windows\System\QNeqFCT.exe
  C:\Windows\System\QNeqFCT.exe
  2⤵
  PID:4508
- C:\Windows\System\IxqPwKn.exe
  C:\Windows\System\IxqPwKn.exe
  2⤵
  PID:4668
- C:\Windows\System\AypouGK.exe
  C:\Windows\System\AypouGK.exe
  2⤵
  PID:4576
- C:\Windows\System\iRjqecB.exe
  C:\Windows\System\iRjqecB.exe
  2⤵
  PID:3152
- C:\Windows\System\qQgyEnP.exe
  C:\Windows\System\qQgyEnP.exe
  2⤵
  PID:2984
- C:\Windows\System\SGIslOI.exe
  C:\Windows\System\SGIslOI.exe
  2⤵
  PID:4840
- C:\Windows\System\HHwqRQK.exe
  C:\Windows\System\HHwqRQK.exe
  2⤵
  PID:4436
- C:\Windows\System\ZEIpMjH.exe
  C:\Windows\System\ZEIpMjH.exe
  2⤵
  PID:4000
- C:\Windows\System\RTwjlyh.exe
  C:\Windows\System\RTwjlyh.exe
  2⤵
  PID:4288
- C:\Windows\System\DEQFjJW.exe
  C:\Windows\System\DEQFjJW.exe
  2⤵
  PID:4784
- C:\Windows\System\WEzjCcb.exe
  C:\Windows\System\WEzjCcb.exe
  2⤵
  PID:4860
- C:\Windows\System\uXYafMC.exe
  C:\Windows\System\uXYafMC.exe
  2⤵
  PID:5124
- C:\Windows\System\vpDZBLm.exe
  C:\Windows\System\vpDZBLm.exe
  2⤵
  PID:5140
- C:\Windows\System\FMIaIDs.exe
  C:\Windows\System\FMIaIDs.exe
  2⤵
  PID:5160
- C:\Windows\System\JfvNGJi.exe
  C:\Windows\System\JfvNGJi.exe
  2⤵
  PID:5180
- C:\Windows\System\iaLZkle.exe
  C:\Windows\System\iaLZkle.exe
  2⤵
  PID:5196
- C:\Windows\System\hgONNdR.exe
  C:\Windows\System\hgONNdR.exe
  2⤵
  PID:5212
- C:\Windows\System\qfvzdKA.exe
  C:\Windows\System\qfvzdKA.exe
  2⤵
  PID:5232
- C:\Windows\System\aJfMjcU.exe
  C:\Windows\System\aJfMjcU.exe
  2⤵
  PID:5252
- C:\Windows\System\BiCoPJc.exe
  C:\Windows\System\BiCoPJc.exe
  2⤵
  PID:5268
- C:\Windows\System\xeHQHPQ.exe
  C:\Windows\System\xeHQHPQ.exe
  2⤵
  PID:5284
- C:\Windows\System\LLbEacQ.exe
  C:\Windows\System\LLbEacQ.exe
  2⤵
  PID:5300
- C:\Windows\System\ufJaEIR.exe
  C:\Windows\System\ufJaEIR.exe
  2⤵
  PID:5316
- C:\Windows\System\OsQycPp.exe
  C:\Windows\System\OsQycPp.exe
  2⤵
  PID:5332
- C:\Windows\System\xhFNkPf.exe
  C:\Windows\System\xhFNkPf.exe
  2⤵
  PID:5348
- C:\Windows\System\VbwLsoM.exe
  C:\Windows\System\VbwLsoM.exe
  2⤵
  PID:5364
- C:\Windows\System\PPkZAVA.exe
  C:\Windows\System\PPkZAVA.exe
  2⤵
  PID:5388
- C:\Windows\System\DTOdeGh.exe
  C:\Windows\System\DTOdeGh.exe
  2⤵
  PID:5404
- C:\Windows\System\dKwJjaB.exe
  C:\Windows\System\dKwJjaB.exe
  2⤵
  PID:5420
- C:\Windows\System\FBnvMLG.exe
  C:\Windows\System\FBnvMLG.exe
  2⤵
  PID:5436
- C:\Windows\System\Zjsytpp.exe
  C:\Windows\System\Zjsytpp.exe
  2⤵
  PID:5452
- C:\Windows\System\HXiXHRz.exe
  C:\Windows\System\HXiXHRz.exe
  2⤵
  PID:5468
- C:\Windows\System\fHYOSQt.exe
  C:\Windows\System\fHYOSQt.exe
  2⤵
  PID:5484
- C:\Windows\System\FxaEVkf.exe
  C:\Windows\System\FxaEVkf.exe
  2⤵
  PID:5500
- C:\Windows\System\WEhQFLz.exe
  C:\Windows\System\WEhQFLz.exe
  2⤵
  PID:5520
- C:\Windows\System\yRjGmuB.exe
  C:\Windows\System\yRjGmuB.exe
  2⤵
  PID:5536
- C:\Windows\System\IAipKDO.exe
  C:\Windows\System\IAipKDO.exe
  2⤵
  PID:5552
- C:\Windows\System\IktePVg.exe
  C:\Windows\System\IktePVg.exe
  2⤵
  PID:5568
- C:\Windows\System\uuHmrul.exe
  C:\Windows\System\uuHmrul.exe
  2⤵
  PID:5584
- C:\Windows\System\tTSvEOD.exe
  C:\Windows\System\tTSvEOD.exe
  2⤵
  PID:5600
- C:\Windows\System\nvGPHRb.exe
  C:\Windows\System\nvGPHRb.exe
  2⤵
  PID:5616
- C:\Windows\System\uvElTSU.exe
  C:\Windows\System\uvElTSU.exe
  2⤵
  PID:5632
- C:\Windows\System\KWiqrUv.exe
  C:\Windows\System\KWiqrUv.exe
  2⤵
  PID:5648
- C:\Windows\System\kmapduL.exe
  C:\Windows\System\kmapduL.exe
  2⤵
  PID:5664
- C:\Windows\System\bbvfnxF.exe
  C:\Windows\System\bbvfnxF.exe
  2⤵
  PID:5680
- C:\Windows\System\vNqUMfy.exe
  C:\Windows\System\vNqUMfy.exe
  2⤵
  PID:5696
- C:\Windows\System\FwzGsxl.exe
  C:\Windows\System\FwzGsxl.exe
  2⤵
  PID:5720
- C:\Windows\System\JqMkZpo.exe
  C:\Windows\System\JqMkZpo.exe
  2⤵
  PID:5740
- C:\Windows\System\YoCvbiJ.exe
  C:\Windows\System\YoCvbiJ.exe
  2⤵
  PID:5756
- C:\Windows\System\mNgVsgt.exe
  C:\Windows\System\mNgVsgt.exe
  2⤵
  PID:5772
- C:\Windows\System\MRCwAtU.exe
  C:\Windows\System\MRCwAtU.exe
  2⤵
  PID:5788
- C:\Windows\System\wTUiAgn.exe
  C:\Windows\System\wTUiAgn.exe
  2⤵
  PID:5808
- C:\Windows\System\QqfxCox.exe
  C:\Windows\System\QqfxCox.exe
  2⤵
  PID:5824
- C:\Windows\System\VTeBqSi.exe
  C:\Windows\System\VTeBqSi.exe
  2⤵
  PID:5840
- C:\Windows\System\QbBgZnW.exe
  C:\Windows\System\QbBgZnW.exe
  2⤵
  PID:5856
- C:\Windows\System\jtKnnik.exe
  C:\Windows\System\jtKnnik.exe
  2⤵
  PID:5872
- C:\Windows\System\HzHbBEN.exe
  C:\Windows\System\HzHbBEN.exe
  2⤵
  PID:5892
- C:\Windows\System\EUtkbZr.exe
  C:\Windows\System\EUtkbZr.exe
  2⤵
  PID:5908
- C:\Windows\System\fTKSsgI.exe
  C:\Windows\System\fTKSsgI.exe
  2⤵
  PID:5924
- C:\Windows\System\sVcJRna.exe
  C:\Windows\System\sVcJRna.exe
  2⤵
  PID:5944
- C:\Windows\System\OouycqN.exe
  C:\Windows\System\OouycqN.exe
  2⤵
  PID:5960
- C:\Windows\System\uQPQagO.exe
  C:\Windows\System\uQPQagO.exe
  2⤵
  PID:5980
- C:\Windows\System\DVEtIgQ.exe
  C:\Windows\System\DVEtIgQ.exe
  2⤵
  PID:5996
- C:\Windows\System\RfpFKFT.exe
  C:\Windows\System\RfpFKFT.exe
  2⤵
  PID:6012
- C:\Windows\System\UgZdxnq.exe
  C:\Windows\System\UgZdxnq.exe
  2⤵
  PID:6032
- C:\Windows\System\HcOOAFj.exe
  C:\Windows\System\HcOOAFj.exe
  2⤵
  PID:6048
- C:\Windows\System\phsLOCg.exe
  C:\Windows\System\phsLOCg.exe
  2⤵
  PID:6064
- C:\Windows\System\MPVQgAd.exe
  C:\Windows\System\MPVQgAd.exe
  2⤵
  PID:6080
- C:\Windows\System\jeUawDd.exe
  C:\Windows\System\jeUawDd.exe
  2⤵
  PID:6096
- C:\Windows\System\YBkUXSL.exe
  C:\Windows\System\YBkUXSL.exe
  2⤵
  PID:6112
- C:\Windows\System\JOIvYvU.exe
  C:\Windows\System\JOIvYvU.exe
  2⤵
  PID:6128
- C:\Windows\System\bcgVanS.exe
  C:\Windows\System\bcgVanS.exe
  2⤵
  PID:4312
- C:\Windows\System\dSiNisX.exe
  C:\Windows\System\dSiNisX.exe
  2⤵
  PID:4020
- C:\Windows\System\YINlgKc.exe
  C:\Windows\System\YINlgKc.exe
  2⤵
  PID:4772
- C:\Windows\System\ZUZmizA.exe
  C:\Windows\System\ZUZmizA.exe
  2⤵
  PID:5136
- C:\Windows\System\UoFLrcd.exe
  C:\Windows\System\UoFLrcd.exe
  2⤵
  PID:4556
- C:\Windows\System\AUZiXBv.exe
  C:\Windows\System\AUZiXBv.exe
  2⤵
  PID:4856
- C:\Windows\System\ufucawO.exe
  C:\Windows\System\ufucawO.exe
  2⤵
  PID:4180
- C:\Windows\System\HoekdaM.exe
  C:\Windows\System\HoekdaM.exe
  2⤵
  PID:5224
- C:\Windows\System\SGlQSfj.exe
  C:\Windows\System\SGlQSfj.exe
  2⤵
  PID:5260
- C:\Windows\System\bNOvKij.exe
  C:\Windows\System\bNOvKij.exe
  2⤵
  PID:5328
- C:\Windows\System\FRcCCjn.exe
  C:\Windows\System\FRcCCjn.exe
  2⤵
  PID:5400
- C:\Windows\System\SjqAWWu.exe
  C:\Windows\System\SjqAWWu.exe
  2⤵
  PID:5564
- C:\Windows\System\mbgsUJo.exe
  C:\Windows\System\mbgsUJo.exe
  2⤵
  PID:5244
- C:\Windows\System\TBFKNvB.exe
  C:\Windows\System\TBFKNvB.exe
  2⤵
  PID:5736
- C:\Windows\System\voNKllK.exe
  C:\Windows\System\voNKllK.exe
  2⤵
  PID:5764
- C:\Windows\System\BwJBSvP.exe
  C:\Windows\System\BwJBSvP.exe
  2⤵
  PID:5376
- C:\Windows\System\fMgCapY.exe
  C:\Windows\System\fMgCapY.exe
  2⤵
  PID:5608
- C:\Windows\System\ktoRtZP.exe
  C:\Windows\System\ktoRtZP.exe
  2⤵
  PID:5644
- C:\Windows\System\aqGuVaT.exe
  C:\Windows\System\aqGuVaT.exe
  2⤵
  PID:5676
- C:\Windows\System\lNbGxHy.exe
  C:\Windows\System\lNbGxHy.exe
  2⤵
  PID:5712
- C:\Windows\System\ZUQCnom.exe
  C:\Windows\System\ZUQCnom.exe
  2⤵
  PID:5544
- C:\Windows\System\OoAGqmD.exe
  C:\Windows\System\OoAGqmD.exe
  2⤵
  PID:5476
- C:\Windows\System\NEyymfi.exe
  C:\Windows\System\NEyymfi.exe
  2⤵
  PID:5416
- C:\Windows\System\qTUzDgg.exe
  C:\Windows\System\qTUzDgg.exe
  2⤵
  PID:5936
- C:\Windows\System\ToRyFCV.exe
  C:\Windows\System\ToRyFCV.exe
  2⤵
  PID:5748
- C:\Windows\System\ngRYKQH.exe
  C:\Windows\System\ngRYKQH.exe
  2⤵
  PID:5816
- C:\Windows\System\eJvFZJe.exe
  C:\Windows\System\eJvFZJe.exe
  2⤵
  PID:5884
- C:\Windows\System\KdmqGjB.exe
  C:\Windows\System\KdmqGjB.exe
  2⤵
  PID:5968
- C:\Windows\System\QjgrghE.exe
  C:\Windows\System\QjgrghE.exe
  2⤵
  PID:6008
- C:\Windows\System\JCtaYvD.exe
  C:\Windows\System\JCtaYvD.exe
  2⤵
  PID:6076
- C:\Windows\System\ShnMGZe.exe
  C:\Windows\System\ShnMGZe.exe
  2⤵
  PID:6140
- C:\Windows\System\enLoKnF.exe
  C:\Windows\System\enLoKnF.exe
  2⤵
  PID:6020
- C:\Windows\System\HYAprBg.exe
  C:\Windows\System\HYAprBg.exe
  2⤵
  PID:6088
- C:\Windows\System\fGEaSkD.exe
  C:\Windows\System\fGEaSkD.exe
  2⤵
  PID:5148
- C:\Windows\System\DWkBBMe.exe
  C:\Windows\System\DWkBBMe.exe
  2⤵
  PID:5156
- C:\Windows\System\qufKdgF.exe
  C:\Windows\System\qufKdgF.exe
  2⤵
  PID:5104
- C:\Windows\System\AtMfYvL.exe
  C:\Windows\System\AtMfYvL.exe
  2⤵
  PID:5360
- C:\Windows\System\WSCqddv.exe
  C:\Windows\System\WSCqddv.exe
  2⤵
  PID:5220
- C:\Windows\System\VfAepVN.exe
  C:\Windows\System\VfAepVN.exe
  2⤵
  PID:5492
- C:\Windows\System\MoNUgrD.exe
  C:\Windows\System\MoNUgrD.exe
  2⤵
  PID:5528
- C:\Windows\System\aqBcFUy.exe
  C:\Windows\System\aqBcFUy.exe
  2⤵
  PID:5532
- C:\Windows\System\taczYmu.exe
  C:\Windows\System\taczYmu.exe
  2⤵
  PID:5628
- C:\Windows\System\rgiBkXh.exe
  C:\Windows\System\rgiBkXh.exe
  2⤵
  PID:5832
- C:\Windows\System\vGTicbW.exe
  C:\Windows\System\vGTicbW.exe
  2⤵
  PID:5576
- C:\Windows\System\lLGKucf.exe
  C:\Windows\System\lLGKucf.exe
  2⤵
  PID:5280
- C:\Windows\System\mUUyhkO.exe
  C:\Windows\System\mUUyhkO.exe
  2⤵
  PID:5848
- C:\Windows\System\YSWFNvv.exe
  C:\Windows\System\YSWFNvv.exe
  2⤵
  PID:5852
- C:\Windows\System\uJJEioC.exe
  C:\Windows\System\uJJEioC.exe
  2⤵
  PID:6108
- C:\Windows\System\zTbatMC.exe
  C:\Windows\System\zTbatMC.exe
  2⤵
  PID:5920
- C:\Windows\System\fzGfQsu.exe
  C:\Windows\System\fzGfQsu.exe
  2⤵
  PID:5396
- C:\Windows\System\RaqCpve.exe
  C:\Windows\System\RaqCpve.exe
  2⤵
  PID:5372
- C:\Windows\System\DgNkDvH.exe
  C:\Windows\System\DgNkDvH.exe
  2⤵
  PID:5612
- C:\Windows\System\IXbLdPo.exe
  C:\Windows\System\IXbLdPo.exe
  2⤵
  PID:5780
- C:\Windows\System\dvSVaMN.exe
  C:\Windows\System\dvSVaMN.exe
  2⤵
  PID:5208
- C:\Windows\System\HMqXSGS.exe
  C:\Windows\System\HMqXSGS.exe
  2⤵
  PID:5512
- C:\Windows\System\RwOOLaq.exe
  C:\Windows\System\RwOOLaq.exe
  2⤵
  PID:5956
- C:\Windows\System\xEzemfG.exe
  C:\Windows\System\xEzemfG.exe
  2⤵
  PID:4340
- C:\Windows\System\oHAOJGH.exe
  C:\Windows\System\oHAOJGH.exe
  2⤵
  PID:6028
- C:\Windows\System\WSfYvYU.exe
  C:\Windows\System\WSfYvYU.exe
  2⤵
  PID:536
- C:\Windows\System\grvUnAA.exe
  C:\Windows\System\grvUnAA.exe
  2⤵
  PID:5624
- C:\Windows\System\CsVkArM.exe
  C:\Windows\System\CsVkArM.exe
  2⤵
  PID:5312
- C:\Windows\System\EWdCObC.exe
  C:\Windows\System\EWdCObC.exe
  2⤵
  PID:6056
- C:\Windows\System\ywEpWpl.exe
  C:\Windows\System\ywEpWpl.exe
  2⤵
  PID:5688
- C:\Windows\System\bkNbWKa.exe
  C:\Windows\System\bkNbWKa.exe
  2⤵
  PID:5460
- C:\Windows\System\BHjNugy.exe
  C:\Windows\System\BHjNugy.exe
  2⤵
  PID:5900
- C:\Windows\System\XxIZXxY.exe
  C:\Windows\System\XxIZXxY.exe
  2⤵
  PID:5976
- C:\Windows\System\azkcXPC.exe
  C:\Windows\System\azkcXPC.exe
  2⤵
  PID:5660
- C:\Windows\System\WgaOnEf.exe
  C:\Windows\System\WgaOnEf.exe
  2⤵
  PID:5708
- C:\Windows\System\jMIGpIn.exe
  C:\Windows\System\jMIGpIn.exe
  2⤵
  PID:6152
- C:\Windows\System\tpNzoEi.exe
  C:\Windows\System\tpNzoEi.exe
  2⤵
  PID:6168
- C:\Windows\System\BucGxrm.exe
  C:\Windows\System\BucGxrm.exe
  2⤵
  PID:6184
- C:\Windows\System\zDTmCEG.exe
  C:\Windows\System\zDTmCEG.exe
  2⤵
  PID:6200
- C:\Windows\System\BiWbsrR.exe
  C:\Windows\System\BiWbsrR.exe
  2⤵
  PID:6216
- C:\Windows\System\flreryn.exe
  C:\Windows\System\flreryn.exe
  2⤵
  PID:6232
- C:\Windows\System\NeQwhIF.exe
  C:\Windows\System\NeQwhIF.exe
  2⤵
  PID:6248
- C:\Windows\System\gWIROvf.exe
  C:\Windows\System\gWIROvf.exe
  2⤵
  PID:6268
- C:\Windows\System\oyUPkmk.exe
  C:\Windows\System\oyUPkmk.exe
  2⤵
  PID:6288
- C:\Windows\System\VmtSFqB.exe
  C:\Windows\System\VmtSFqB.exe
  2⤵
  PID:6304
- C:\Windows\System\tdzeywF.exe
  C:\Windows\System\tdzeywF.exe
  2⤵
  PID:6320
- C:\Windows\System\ucJDGaR.exe
  C:\Windows\System\ucJDGaR.exe
  2⤵
  PID:6336
- C:\Windows\System\rTcLZul.exe
  C:\Windows\System\rTcLZul.exe
  2⤵
  PID:6352
- C:\Windows\System\dhHFKhZ.exe
  C:\Windows\System\dhHFKhZ.exe
  2⤵
  PID:6368
- C:\Windows\System\aTVIIJN.exe
  C:\Windows\System\aTVIIJN.exe
  2⤵
  PID:6384
- C:\Windows\System\uONoWkH.exe
  C:\Windows\System\uONoWkH.exe
  2⤵
  PID:6400
- C:\Windows\System\IXoVyaG.exe
  C:\Windows\System\IXoVyaG.exe
  2⤵
  PID:6416
- C:\Windows\System\jYZjLbI.exe
  C:\Windows\System\jYZjLbI.exe
  2⤵
  PID:6432
- C:\Windows\System\UkdxBWP.exe
  C:\Windows\System\UkdxBWP.exe
  2⤵
  PID:6448
- C:\Windows\System\IodUUXa.exe
  C:\Windows\System\IodUUXa.exe
  2⤵
  PID:6464
- C:\Windows\System\JiDfkhg.exe
  C:\Windows\System\JiDfkhg.exe
  2⤵
  PID:6480
- C:\Windows\System\KgNrraH.exe
  C:\Windows\System\KgNrraH.exe
  2⤵
  PID:6496
- C:\Windows\System\bvyxPjA.exe
  C:\Windows\System\bvyxPjA.exe
  2⤵
  PID:6512
- C:\Windows\System\MVaJrUL.exe
  C:\Windows\System\MVaJrUL.exe
  2⤵
  PID:6528
- C:\Windows\System\bLOXONz.exe
  C:\Windows\System\bLOXONz.exe
  2⤵
  PID:6544
- C:\Windows\System\GtZpoUE.exe
  C:\Windows\System\GtZpoUE.exe
  2⤵
  PID:6560
- C:\Windows\System\fWAwVXu.exe
  C:\Windows\System\fWAwVXu.exe
  2⤵
  PID:6576
- C:\Windows\System\iuWCfsx.exe
  C:\Windows\System\iuWCfsx.exe
  2⤵
  PID:6596
- C:\Windows\System\klhlCSr.exe
  C:\Windows\System\klhlCSr.exe
  2⤵
  PID:6612
- C:\Windows\System\uVCphuA.exe
  C:\Windows\System\uVCphuA.exe
  2⤵
  PID:6628
- C:\Windows\System\VfBEeND.exe
  C:\Windows\System\VfBEeND.exe
  2⤵
  PID:6648
- C:\Windows\System\NycvRbB.exe
  C:\Windows\System\NycvRbB.exe
  2⤵
  PID:6664
- C:\Windows\System\haoUepX.exe
  C:\Windows\System\haoUepX.exe
  2⤵
  PID:6684
- C:\Windows\System\JgPIpJR.exe
  C:\Windows\System\JgPIpJR.exe
  2⤵
  PID:6700
- C:\Windows\System\Fyygmut.exe
  C:\Windows\System\Fyygmut.exe
  2⤵
  PID:6720
- C:\Windows\System\LjpmWVo.exe
  C:\Windows\System\LjpmWVo.exe
  2⤵
  PID:6736
- C:\Windows\System\qObAioR.exe
  C:\Windows\System\qObAioR.exe
  2⤵
  PID:6752
- C:\Windows\System\INzRydk.exe
  C:\Windows\System\INzRydk.exe
  2⤵
  PID:6768
- C:\Windows\System\ZSaxyWB.exe
  C:\Windows\System\ZSaxyWB.exe
  2⤵
  PID:6784
- C:\Windows\System\ADvpkbd.exe
  C:\Windows\System\ADvpkbd.exe
  2⤵
  PID:6800
- C:\Windows\System\jlVtbZL.exe
  C:\Windows\System\jlVtbZL.exe
  2⤵
  PID:6816
- C:\Windows\System\ZzfCDvF.exe
  C:\Windows\System\ZzfCDvF.exe
  2⤵
  PID:6832
- C:\Windows\System\ByFfSZp.exe
  C:\Windows\System\ByFfSZp.exe
  2⤵
  PID:6848
- C:\Windows\System\BJeAKlx.exe
  C:\Windows\System\BJeAKlx.exe
  2⤵
  PID:6864
- C:\Windows\System\TcNFgXB.exe
  C:\Windows\System\TcNFgXB.exe
  2⤵
  PID:6884
- C:\Windows\System\iLwYoxY.exe
  C:\Windows\System\iLwYoxY.exe
  2⤵
  PID:6900
- C:\Windows\System\mNAghmg.exe
  C:\Windows\System\mNAghmg.exe
  2⤵
  PID:6916
- C:\Windows\System\GCnSyhU.exe
  C:\Windows\System\GCnSyhU.exe
  2⤵
  PID:6932
- C:\Windows\System\RAkoQzi.exe
  C:\Windows\System\RAkoQzi.exe
  2⤵
  PID:6948
- C:\Windows\System\pcoLLel.exe
  C:\Windows\System\pcoLLel.exe
  2⤵
  PID:6964
- C:\Windows\System\LcUbrNA.exe
  C:\Windows\System\LcUbrNA.exe
  2⤵
  PID:6980
- C:\Windows\System\MNOSBhZ.exe
  C:\Windows\System\MNOSBhZ.exe
  2⤵
  PID:6996
- C:\Windows\System\ZpNDDAW.exe
  C:\Windows\System\ZpNDDAW.exe
  2⤵
  PID:7012
- C:\Windows\System\KtGgCMS.exe
  C:\Windows\System\KtGgCMS.exe
  2⤵
  PID:7032
- C:\Windows\System\Khbykwo.exe
  C:\Windows\System\Khbykwo.exe
  2⤵
  PID:7048
- C:\Windows\System\SSpaZNy.exe
  C:\Windows\System\SSpaZNy.exe
  2⤵
  PID:7064
- C:\Windows\System\dfCcOfX.exe
  C:\Windows\System\dfCcOfX.exe
  2⤵
  PID:7080
- C:\Windows\System\eFEJsEu.exe
  C:\Windows\System\eFEJsEu.exe
  2⤵
  PID:7096
- C:\Windows\System\mXrzSyY.exe
  C:\Windows\System\mXrzSyY.exe
  2⤵
  PID:7112
- C:\Windows\System\eMkKORr.exe
  C:\Windows\System\eMkKORr.exe
  2⤵
  PID:7128
- C:\Windows\System\dSSrBkv.exe
  C:\Windows\System\dSSrBkv.exe
  2⤵
  PID:7148
- C:\Windows\System\PgilBjO.exe
  C:\Windows\System\PgilBjO.exe
  2⤵
  PID:7164
- C:\Windows\System\wLkHlBf.exe
  C:\Windows\System\wLkHlBf.exe
  2⤵
  PID:6176
- C:\Windows\System\ihjgJgX.exe
  C:\Windows\System\ihjgJgX.exe
  2⤵
  PID:6240
- C:\Windows\System\CygFSUx.exe
  C:\Windows\System\CygFSUx.exe
  2⤵
  PID:4916
- C:\Windows\System\jAbSfCu.exe
  C:\Windows\System\jAbSfCu.exe
  2⤵
  PID:5836
- C:\Windows\System\iENFgpP.exe
  C:\Windows\System\iENFgpP.exe
  2⤵
  PID:5732
- C:\Windows\System\OkGDZub.exe
  C:\Windows\System\OkGDZub.exe
  2⤵
  PID:5940
- C:\Windows\System\aGzQPRd.exe
  C:\Windows\System\aGzQPRd.exe
  2⤵
  PID:6224
- C:\Windows\System\VOTCeoA.exe
  C:\Windows\System\VOTCeoA.exe
  2⤵
  PID:6300
- C:\Windows\System\pNYBrdH.exe
  C:\Windows\System\pNYBrdH.exe
  2⤵
  PID:6348
- C:\Windows\System\wNDvHSh.exe
  C:\Windows\System\wNDvHSh.exe
  2⤵
  PID:6440
- C:\Windows\System\GYGGiOA.exe
  C:\Windows\System\GYGGiOA.exe
  2⤵
  PID:6472
- C:\Windows\System\xdayUmI.exe
  C:\Windows\System\xdayUmI.exe
  2⤵
  PID:6536
- C:\Windows\System\SLgaWVD.exe
  C:\Windows\System\SLgaWVD.exe
  2⤵
  PID:6364
- C:\Windows\System\PZoMFdb.exe
  C:\Windows\System\PZoMFdb.exe
  2⤵
  PID:6428
- C:\Windows\System\OKftUoT.exe
  C:\Windows\System\OKftUoT.exe
  2⤵
  PID:6492
- C:\Windows\System\BFlmozQ.exe
  C:\Windows\System\BFlmozQ.exe
  2⤵
  PID:6568
- C:\Windows\System\kiaSZnv.exe
  C:\Windows\System\kiaSZnv.exe
  2⤵
  PID:6636
- C:\Windows\System\qUnOQbx.exe
  C:\Windows\System\qUnOQbx.exe
  2⤵
  PID:6672
- C:\Windows\System\DMSYYPq.exe
  C:\Windows\System\DMSYYPq.exe
  2⤵
  PID:6676
- C:\Windows\System\ZPsaDTC.exe
  C:\Windows\System\ZPsaDTC.exe
  2⤵
  PID:6588
- C:\Windows\System\FPnuVvZ.exe
  C:\Windows\System\FPnuVvZ.exe
  2⤵
  PID:6716
- C:\Windows\System\fMQEHlp.exe
  C:\Windows\System\fMQEHlp.exe
  2⤵
  PID:6748
- C:\Windows\System\yHhZTjK.exe
  C:\Windows\System\yHhZTjK.exe
  2⤵
  PID:6696
- C:\Windows\System\zJFUcqF.exe
  C:\Windows\System\zJFUcqF.exe
  2⤵
  PID:6812
- C:\Windows\System\CraLvQC.exe
  C:\Windows\System\CraLvQC.exe
  2⤵
  PID:6876
- C:\Windows\System\ZmWhdrU.exe
  C:\Windows\System\ZmWhdrU.exe
  2⤵
  PID:6908
- C:\Windows\System\CIWuOYG.exe
  C:\Windows\System\CIWuOYG.exe
  2⤵
  PID:6940
- C:\Windows\System\VWzkeYp.exe
  C:\Windows\System\VWzkeYp.exe
  2⤵
  PID:7004
- C:\Windows\System\CANMBvo.exe
  C:\Windows\System\CANMBvo.exe
  2⤵
  PID:7040
- C:\Windows\System\HzBDzpA.exe
  C:\Windows\System\HzBDzpA.exe
  2⤵
  PID:7044
- C:\Windows\System\XnWhzBT.exe
  C:\Windows\System\XnWhzBT.exe
  2⤵
  PID:6992
- C:\Windows\System\Qwfyuyz.exe
  C:\Windows\System\Qwfyuyz.exe
  2⤵
  PID:6924
- C:\Windows\System\MfMChLc.exe
  C:\Windows\System\MfMChLc.exe
  2⤵
  PID:7108
- C:\Windows\System\SnhtBni.exe
  C:\Windows\System\SnhtBni.exe
  2⤵
  PID:7144
- C:\Windows\System\LkdhePD.exe
  C:\Windows\System\LkdhePD.exe
  2⤵
  PID:6044
- C:\Windows\System\VUdRwqC.exe
  C:\Windows\System\VUdRwqC.exe
  2⤵
  PID:6276
- C:\Windows\System\QtDQXcs.exe
  C:\Windows\System\QtDQXcs.exe
  2⤵
  PID:7088
- C:\Windows\System\TvqOzjd.exe
  C:\Windows\System\TvqOzjd.exe
  2⤵
  PID:6192
- C:\Windows\System\AmLhMLl.exe
  C:\Windows\System\AmLhMLl.exe
  2⤵
  PID:6444
- C:\Windows\System\SUhkpeI.exe
  C:\Windows\System\SUhkpeI.exe
  2⤵
  PID:6212
- C:\Windows\System\IKXfkdh.exe
  C:\Windows\System\IKXfkdh.exe
  2⤵
  PID:6608
- C:\Windows\System\krbuNZa.exe
  C:\Windows\System\krbuNZa.exe
  2⤵
  PID:6712
- C:\Windows\System\xiluHOL.exe
  C:\Windows\System\xiluHOL.exe
  2⤵
  PID:6872
- C:\Windows\System\AhruvDF.exe
  C:\Windows\System\AhruvDF.exe
  2⤵
  PID:5916
- C:\Windows\System\dpsqPpl.exe
  C:\Windows\System\dpsqPpl.exe
  2⤵
  PID:6824
- C:\Windows\System\gnOjgeR.exe
  C:\Windows\System\gnOjgeR.exe
  2⤵
  PID:6256
- C:\Windows\System\VqmGPVW.exe
  C:\Windows\System\VqmGPVW.exe
  2⤵
  PID:7156
- C:\Windows\System\HjmSocB.exe
  C:\Windows\System\HjmSocB.exe
  2⤵
  PID:6808
- C:\Windows\System\ETbtUgm.exe
  C:\Windows\System\ETbtUgm.exe
  2⤵
  PID:6976
- C:\Windows\System\CHNFalz.exe
  C:\Windows\System\CHNFalz.exe
  2⤵
  PID:7092
- C:\Windows\System\fWCcxrM.exe
  C:\Windows\System\fWCcxrM.exe
  2⤵
  PID:6504
- C:\Windows\System\dgosrVk.exe
  C:\Windows\System\dgosrVk.exe
  2⤵
  PID:4620
- C:\Windows\System\dvGIZLP.exe
  C:\Windows\System\dvGIZLP.exe
  2⤵
  PID:6660
- C:\Windows\System\jPcBaYm.exe
  C:\Windows\System\jPcBaYm.exe
  2⤵
  PID:6508
- C:\Windows\System\HiPyVes.exe
  C:\Windows\System\HiPyVes.exe
  2⤵
  PID:6856
- C:\Windows\System\iokfEjL.exe
  C:\Windows\System\iokfEjL.exe
  2⤵
  PID:6604
- C:\Windows\System\bGAWkjL.exe
  C:\Windows\System\bGAWkjL.exe
  2⤵
  PID:6584
- C:\Windows\System\ylXoTnF.exe
  C:\Windows\System\ylXoTnF.exe
  2⤵
  PID:6988
- C:\Windows\System\xoxfsOJ.exe
  C:\Windows\System\xoxfsOJ.exe
  2⤵
  PID:6972
- C:\Windows\System\tppMstL.exe
  C:\Windows\System\tppMstL.exe
  2⤵
  PID:6792
- C:\Windows\System\YXCumZw.exe
  C:\Windows\System\YXCumZw.exe
  2⤵
  PID:6556
- C:\Windows\System\OmxdpQM.exe
  C:\Windows\System\OmxdpQM.exe
  2⤵
  PID:6796
- C:\Windows\System\rGRWOOj.exe
  C:\Windows\System\rGRWOOj.exe
  2⤵
  PID:7180
- C:\Windows\System\SrbOjoK.exe
  C:\Windows\System\SrbOjoK.exe
  2⤵
  PID:7196
- C:\Windows\System\veSpaek.exe
  C:\Windows\System\veSpaek.exe
  2⤵
  PID:7212
- C:\Windows\System\BtrXnNK.exe
  C:\Windows\System\BtrXnNK.exe
  2⤵
  PID:7248
- C:\Windows\System\CWOjCAa.exe
  C:\Windows\System\CWOjCAa.exe
  2⤵
  PID:7264
- C:\Windows\System\VJallMx.exe
  C:\Windows\System\VJallMx.exe
  2⤵
  PID:7280
- C:\Windows\System\zzWSAoC.exe
  C:\Windows\System\zzWSAoC.exe
  2⤵
  PID:7296
- C:\Windows\System\bMWnfwY.exe
  C:\Windows\System\bMWnfwY.exe
  2⤵
  PID:7312
- C:\Windows\System\imbmjFK.exe
  C:\Windows\System\imbmjFK.exe
  2⤵
  PID:7328
- C:\Windows\System\WLTfMEe.exe
  C:\Windows\System\WLTfMEe.exe
  2⤵
  PID:7348
- C:\Windows\System\OarZIaE.exe
  C:\Windows\System\OarZIaE.exe
  2⤵
  PID:7364
- C:\Windows\System\jHMOMfA.exe
  C:\Windows\System\jHMOMfA.exe
  2⤵
  PID:7380
- C:\Windows\System\QnZbfvv.exe
  C:\Windows\System\QnZbfvv.exe
  2⤵
  PID:7396
- C:\Windows\System\wSKViKU.exe
  C:\Windows\System\wSKViKU.exe
  2⤵
  PID:7412
- C:\Windows\System\tFsHcVy.exe
  C:\Windows\System\tFsHcVy.exe
  2⤵
  PID:7428
- C:\Windows\System\NQUMTQE.exe
  C:\Windows\System\NQUMTQE.exe
  2⤵
  PID:7448
- C:\Windows\System\HuCIvVy.exe
  C:\Windows\System\HuCIvVy.exe
  2⤵
  PID:7472
- C:\Windows\System\YpfpXYS.exe
  C:\Windows\System\YpfpXYS.exe
  2⤵
  PID:7488
- C:\Windows\System\SPAaKil.exe
  C:\Windows\System\SPAaKil.exe
  2⤵
  PID:7512
- C:\Windows\System\gJUymIM.exe
  C:\Windows\System\gJUymIM.exe
  2⤵
  PID:7528
- C:\Windows\System\vUZZQpd.exe
  C:\Windows\System\vUZZQpd.exe
  2⤵
  PID:7544
- C:\Windows\System\srdRKQr.exe
  C:\Windows\System\srdRKQr.exe
  2⤵
  PID:7560
- C:\Windows\System\RrRfhCq.exe
  C:\Windows\System\RrRfhCq.exe
  2⤵
  PID:7580
- C:\Windows\System\vCRyREu.exe
  C:\Windows\System\vCRyREu.exe
  2⤵
  PID:7596
- C:\Windows\System\ZAKdPCY.exe
  C:\Windows\System\ZAKdPCY.exe
  2⤵
  PID:7612
- C:\Windows\System\XiBNWdM.exe
  C:\Windows\System\XiBNWdM.exe
  2⤵
  PID:7628
- C:\Windows\System\pOstDhH.exe
  C:\Windows\System\pOstDhH.exe
  2⤵
  PID:7644
- C:\Windows\System\BbCPTda.exe
  C:\Windows\System\BbCPTda.exe
  2⤵
  PID:7664
- C:\Windows\System\CowxoUc.exe
  C:\Windows\System\CowxoUc.exe
  2⤵
  PID:7684
- C:\Windows\System\kWnZUVt.exe
  C:\Windows\System\kWnZUVt.exe
  2⤵
  PID:7700
- C:\Windows\System\ghByptj.exe
  C:\Windows\System\ghByptj.exe
  2⤵
  PID:7732
- C:\Windows\System\dCrTZqr.exe
  C:\Windows\System\dCrTZqr.exe
  2⤵
  PID:7748
- C:\Windows\System\dkvjPKi.exe
  C:\Windows\System\dkvjPKi.exe
  2⤵
  PID:7764
- C:\Windows\System\hzwMSUP.exe
  C:\Windows\System\hzwMSUP.exe
  2⤵
  PID:7784
- C:\Windows\System\bQZbXop.exe
  C:\Windows\System\bQZbXop.exe
  2⤵
  PID:7800
- C:\Windows\System\GUmJtCB.exe
  C:\Windows\System\GUmJtCB.exe
  2⤵
  PID:7816
- C:\Windows\System\pJroKRy.exe
  C:\Windows\System\pJroKRy.exe
  2⤵
  PID:7832
- C:\Windows\System\KKdWNCb.exe
  C:\Windows\System\KKdWNCb.exe
  2⤵
  PID:7848
- C:\Windows\System\aokVaZz.exe
  C:\Windows\System\aokVaZz.exe
  2⤵
  PID:7872
- C:\Windows\System\katGmhe.exe
  C:\Windows\System\katGmhe.exe
  2⤵
  PID:7888
- C:\Windows\System\pOkYmRz.exe
  C:\Windows\System\pOkYmRz.exe
  2⤵
  PID:7904
- C:\Windows\System\TXqjAZS.exe
  C:\Windows\System\TXqjAZS.exe
  2⤵
  PID:7920
- C:\Windows\System\jQXdEVg.exe
  C:\Windows\System\jQXdEVg.exe
  2⤵
  PID:7936
- C:\Windows\System\GcvfvFg.exe
  C:\Windows\System\GcvfvFg.exe
  2⤵
  PID:7956
- C:\Windows\System\oorUNCG.exe
  C:\Windows\System\oorUNCG.exe
  2⤵
  PID:7972
- C:\Windows\System\sSxkSLI.exe
  C:\Windows\System\sSxkSLI.exe
  2⤵
  PID:7988
- C:\Windows\System\stOeoUf.exe
  C:\Windows\System\stOeoUf.exe
  2⤵
  PID:8004
- C:\Windows\System\sQbAdDn.exe
  C:\Windows\System\sQbAdDn.exe
  2⤵
  PID:8020
- C:\Windows\System\xLCIHsk.exe
  C:\Windows\System\xLCIHsk.exe
  2⤵
  PID:8040
- C:\Windows\System\zPsJZCL.exe
  C:\Windows\System\zPsJZCL.exe
  2⤵
  PID:8056
- C:\Windows\System\acoZWPc.exe
  C:\Windows\System\acoZWPc.exe
  2⤵
  PID:8076
- C:\Windows\System\SFyKDHk.exe
  C:\Windows\System\SFyKDHk.exe
  2⤵
  PID:8092
- C:\Windows\System\NOiXdnh.exe
  C:\Windows\System\NOiXdnh.exe
  2⤵
  PID:8112
- C:\Windows\System\GqegQrv.exe
  C:\Windows\System\GqegQrv.exe
  2⤵
  PID:8128
- C:\Windows\System\nrYHIHd.exe
  C:\Windows\System\nrYHIHd.exe
  2⤵
  PID:8144
- C:\Windows\System\HYjINfM.exe
  C:\Windows\System\HYjINfM.exe
  2⤵
  PID:8160
- C:\Windows\System\gkQODDf.exe
  C:\Windows\System\gkQODDf.exe
  2⤵
  PID:7292
- C:\Windows\System\hjdjCYU.exe
  C:\Windows\System\hjdjCYU.exe
  2⤵
  PID:7236
- C:\Windows\System\QyiifaO.exe
  C:\Windows\System\QyiifaO.exe
  2⤵
  PID:7244
- C:\Windows\System\GkAIJAy.exe
  C:\Windows\System\GkAIJAy.exe
  2⤵
  PID:7344
- C:\Windows\System\RvCQnKj.exe
  C:\Windows\System\RvCQnKj.exe
  2⤵
  PID:7592
- C:\Windows\System\IMXliWr.exe
  C:\Windows\System\IMXliWr.exe
  2⤵
  PID:7828
- C:\Windows\System\mLYqLWO.exe
  C:\Windows\System\mLYqLWO.exe
  2⤵
  PID:7856
- C:\Windows\System\WuviHrh.exe
  C:\Windows\System\WuviHrh.exe
  2⤵
  PID:7808
- C:\Windows\System\RSYqPTk.exe
  C:\Windows\System\RSYqPTk.exe
  2⤵
  PID:7812
- C:\Windows\System\gGHQLvb.exe
  C:\Windows\System\gGHQLvb.exe
  2⤵
  PID:8000
- C:\Windows\System\rWSlxEg.exe
  C:\Windows\System\rWSlxEg.exe
  2⤵
  PID:8100
- C:\Windows\System\aKkfGRl.exe
  C:\Windows\System\aKkfGRl.exe
  2⤵
  PID:7952
- C:\Windows\System\bMxYdcv.exe
  C:\Windows\System\bMxYdcv.exe
  2⤵
  PID:8012
- C:\Windows\System\gwTfWXk.exe
  C:\Windows\System\gwTfWXk.exe
  2⤵
  PID:8052
- C:\Windows\System\lerbBSz.exe
  C:\Windows\System\lerbBSz.exe
  2⤵
  PID:8176
- C:\Windows\System\MNEuoCM.exe
  C:\Windows\System\MNEuoCM.exe
  2⤵
  PID:7056
- C:\Windows\System\srkVoTN.exe
  C:\Windows\System\srkVoTN.exe
  2⤵
  PID:7172
- C:\Windows\System\CkOhEWr.exe
  C:\Windows\System\CkOhEWr.exe
  2⤵
  PID:6412
- C:\Windows\System\rxHwrwp.exe
  C:\Windows\System\rxHwrwp.exe
  2⤵
  PID:6396
- C:\Windows\System\NamyOmZ.exe
  C:\Windows\System\NamyOmZ.exe
  2⤵
  PID:7228
- C:\Windows\System\EFiArIG.exe
  C:\Windows\System\EFiArIG.exe
  2⤵
  PID:7420
- C:\Windows\System\VVyvqaK.exe
  C:\Windows\System\VVyvqaK.exe
  2⤵
  PID:7272
- C:\Windows\System\XKFaNbO.exe
  C:\Windows\System\XKFaNbO.exe
  2⤵
  PID:7376
- C:\Windows\System\byKrLTk.exe
  C:\Windows\System\byKrLTk.exe
  2⤵
  PID:7484
- C:\Windows\System\fGoljvo.exe
  C:\Windows\System\fGoljvo.exe
  2⤵
  PID:7504
- C:\Windows\System\axJJiuU.exe
  C:\Windows\System\axJJiuU.exe
  2⤵
  PID:7568
- C:\Windows\System\huMaVkW.exe
  C:\Windows\System\huMaVkW.exe
  2⤵
  PID:7424
- C:\Windows\System\NrxURfl.exe
  C:\Windows\System\NrxURfl.exe
  2⤵
  PID:7556
- C:\Windows\System\cpmKfYg.exe
  C:\Windows\System\cpmKfYg.exe
  2⤵
  PID:7880
- C:\Windows\System\Xefmngn.exe
  C:\Windows\System\Xefmngn.exe
  2⤵
  PID:7884
- C:\Windows\System\XPfiavI.exe
  C:\Windows\System\XPfiavI.exe
  2⤵
  PID:7844
- C:\Windows\System\DKXktro.exe
  C:\Windows\System\DKXktro.exe
  2⤵
  PID:8088
- C:\Windows\System\ryLBoEl.exe
  C:\Windows\System\ryLBoEl.exe
  2⤵
  PID:7840
- C:\Windows\System\hjkEhWp.exe
  C:\Windows\System\hjkEhWp.exe
  2⤵
  PID:7912
- C:\Windows\System\QffTNbE.exe
  C:\Windows\System\QffTNbE.exe
  2⤵
  PID:8152
- C:\Windows\System\cIVtSkF.exe
  C:\Windows\System\cIVtSkF.exe
  2⤵
  PID:8120
- C:\Windows\System\imbWNka.exe
  C:\Windows\System\imbWNka.exe
  2⤵
  PID:6360
- C:\Windows\System\LkMGPGh.exe
  C:\Windows\System\LkMGPGh.exe
  2⤵
  PID:6316
- C:\Windows\System\FPmVKFI.exe
  C:\Windows\System\FPmVKFI.exe
  2⤵
  PID:6284
- C:\Windows\System\kfumHbG.exe
  C:\Windows\System\kfumHbG.exe
  2⤵
  PID:7540
- C:\Windows\System\qGvdFVJ.exe
  C:\Windows\System\qGvdFVJ.exe
  2⤵
  PID:7188
- C:\Windows\System\cbJHYQy.exe
  C:\Windows\System\cbJHYQy.exe
  2⤵
  PID:7356
- C:\Windows\System\LErLMmd.exe
  C:\Windows\System\LErLMmd.exe
  2⤵
  PID:7716
- C:\Windows\System\tpmdnWS.exe
  C:\Windows\System\tpmdnWS.exe
  2⤵
  PID:7340
- C:\Windows\System\sowLvXB.exe
  C:\Windows\System\sowLvXB.exe
  2⤵
  PID:7440
- C:\Windows\System\IDfBdjX.exe
  C:\Windows\System\IDfBdjX.exe
  2⤵
  PID:7588
- C:\Windows\System\uXAUBbx.exe
  C:\Windows\System\uXAUBbx.exe
  2⤵
  PID:7536
- C:\Windows\System\leGFtHG.exe
  C:\Windows\System\leGFtHG.exe
  2⤵
  PID:7240
- C:\Windows\System\hnAnNUz.exe
  C:\Windows\System\hnAnNUz.exe
  2⤵
  PID:7672
- C:\Windows\System\CmHcUCJ.exe
  C:\Windows\System\CmHcUCJ.exe
  2⤵
  PID:7692
- C:\Windows\System\HIkOLoL.exe
  C:\Windows\System\HIkOLoL.exe
  2⤵
  PID:7780
- C:\Windows\System\MeySZjs.exe
  C:\Windows\System\MeySZjs.exe
  2⤵
  PID:7860
- C:\Windows\System\IpngiPE.exe
  C:\Windows\System\IpngiPE.exe
  2⤵
  PID:2272
- C:\Windows\System\JkNyrXf.exe
  C:\Windows\System\JkNyrXf.exe
  2⤵
  PID:7928
- C:\Windows\System\xhMLzpO.exe
  C:\Windows\System\xhMLzpO.exe
  2⤵
  PID:8108
- C:\Windows\System\VnxJJBC.exe
  C:\Windows\System\VnxJJBC.exe
  2⤵
  PID:8016
- C:\Windows\System\RpWjIaJ.exe
  C:\Windows\System\RpWjIaJ.exe
  2⤵
  PID:6844
- C:\Windows\System\CAWxzBv.exe
  C:\Windows\System\CAWxzBv.exe
  2⤵
  PID:5340
- C:\Windows\System\VqfoaOt.exe
  C:\Windows\System\VqfoaOt.exe
  2⤵
  PID:7336
- C:\Windows\System\wHLEhLh.exe
  C:\Windows\System\wHLEhLh.exe
  2⤵
  PID:7208
- C:\Windows\System\UlUyDbq.exe
  C:\Windows\System\UlUyDbq.exe
  2⤵
  PID:7324
- C:\Windows\System\vNJndSp.exe
  C:\Windows\System\vNJndSp.exe
  2⤵
  PID:7708
- C:\Windows\System\yrFCzeX.exe
  C:\Windows\System\yrFCzeX.exe
  2⤵
  PID:7796
- C:\Windows\System\zkoROKB.exe
  C:\Windows\System\zkoROKB.exe
  2⤵
  PID:7696
- C:\Windows\System\jddWyKo.exe
  C:\Windows\System\jddWyKo.exe
  2⤵
  PID:7896
- C:\Windows\System\jGeoZsM.exe
  C:\Windows\System\jGeoZsM.exe
  2⤵
  PID:8072
- C:\Windows\System\ekzYgmN.exe
  C:\Windows\System\ekzYgmN.exe
  2⤵
  PID:7104
- C:\Windows\System\bbaWhyg.exe
  C:\Windows\System\bbaWhyg.exe
  2⤵
  PID:7624
- C:\Windows\System\mIgFOyE.exe
  C:\Windows\System\mIgFOyE.exe
  2⤵
  PID:8068
- C:\Windows\System\AlDdjTq.exe
  C:\Windows\System\AlDdjTq.exe
  2⤵
  PID:6196
- C:\Windows\System\yPiTExC.exe
  C:\Windows\System\yPiTExC.exe
  2⤵
  PID:7404
- C:\Windows\System\fUjzcep.exe
  C:\Windows\System\fUjzcep.exe
  2⤵
  PID:8196
- C:\Windows\System\FRWUxtO.exe
  C:\Windows\System\FRWUxtO.exe
  2⤵
  PID:8212
- C:\Windows\System\QVQoONW.exe
  C:\Windows\System\QVQoONW.exe
  2⤵
  PID:8228
- C:\Windows\System\nRbNnWY.exe
  C:\Windows\System\nRbNnWY.exe
  2⤵
  PID:8244
- C:\Windows\System\mvkwKKf.exe
  C:\Windows\System\mvkwKKf.exe
  2⤵
  PID:8260
- C:\Windows\System\IYOwWUU.exe
  C:\Windows\System\IYOwWUU.exe
  2⤵
  PID:8276
- C:\Windows\System\ISlMJmu.exe
  C:\Windows\System\ISlMJmu.exe
  2⤵
  PID:8292
- C:\Windows\System\HRXKuih.exe
  C:\Windows\System\HRXKuih.exe
  2⤵
  PID:8308
- C:\Windows\System\ZJHNwMY.exe
  C:\Windows\System\ZJHNwMY.exe
  2⤵
  PID:8324
- C:\Windows\System\xbftVLN.exe
  C:\Windows\System\xbftVLN.exe
  2⤵
  PID:8340
- C:\Windows\System\dpNNYGN.exe
  C:\Windows\System\dpNNYGN.exe
  2⤵
  PID:8356
- C:\Windows\System\hepbJVW.exe
  C:\Windows\System\hepbJVW.exe
  2⤵
  PID:8372
- C:\Windows\System\qqbUEnc.exe
  C:\Windows\System\qqbUEnc.exe
  2⤵
  PID:8388
- C:\Windows\System\wsJkJlM.exe
  C:\Windows\System\wsJkJlM.exe
  2⤵
  PID:8404
- C:\Windows\System\KSlQVqN.exe
  C:\Windows\System\KSlQVqN.exe
  2⤵
  PID:8420
- C:\Windows\System\LoFdgOA.exe
  C:\Windows\System\LoFdgOA.exe
  2⤵
  PID:8436
- C:\Windows\System\WqNGiLk.exe
  C:\Windows\System\WqNGiLk.exe
  2⤵
  PID:8452
- C:\Windows\System\eySOMsH.exe
  C:\Windows\System\eySOMsH.exe
  2⤵
  PID:8468
- C:\Windows\System\CWSaGrJ.exe
  C:\Windows\System\CWSaGrJ.exe
  2⤵
  PID:8484
- C:\Windows\System\YfWEaPn.exe
  C:\Windows\System\YfWEaPn.exe
  2⤵
  PID:8500
- C:\Windows\System\whWKBMk.exe
  C:\Windows\System\whWKBMk.exe
  2⤵
  PID:8516
- C:\Windows\System\ZdVaVqn.exe
  C:\Windows\System\ZdVaVqn.exe
  2⤵
  PID:8532
- C:\Windows\System\rnXfPxs.exe
  C:\Windows\System\rnXfPxs.exe
  2⤵
  PID:8548
- C:\Windows\System\IfoubLH.exe
  C:\Windows\System\IfoubLH.exe
  2⤵
  PID:8564
- C:\Windows\System\YVHKkHZ.exe
  C:\Windows\System\YVHKkHZ.exe
  2⤵
  PID:8580
- C:\Windows\System\gTkGRIz.exe
  C:\Windows\System\gTkGRIz.exe
  2⤵
  PID:8596
- C:\Windows\System\WUroMQb.exe
  C:\Windows\System\WUroMQb.exe
  2⤵
  PID:8612
- C:\Windows\System\VycnVgV.exe
  C:\Windows\System\VycnVgV.exe
  2⤵
  PID:8628
- C:\Windows\System\RJAJRKj.exe
  C:\Windows\System\RJAJRKj.exe
  2⤵
  PID:8644
- C:\Windows\System\obgnVEf.exe
  C:\Windows\System\obgnVEf.exe
  2⤵
  PID:8660
- C:\Windows\System\LcLaiPY.exe
  C:\Windows\System\LcLaiPY.exe
  2⤵
  PID:8676
- C:\Windows\System\shiRAHn.exe
  C:\Windows\System\shiRAHn.exe
  2⤵
  PID:8692
- C:\Windows\System\bCftydQ.exe
  C:\Windows\System\bCftydQ.exe
  2⤵
  PID:8708
- C:\Windows\System\BgrBvmL.exe
  C:\Windows\System\BgrBvmL.exe
  2⤵
  PID:8724
- C:\Windows\System\JWZbiyG.exe
  C:\Windows\System\JWZbiyG.exe
  2⤵
  PID:8740
- C:\Windows\System\ECLvHIp.exe
  C:\Windows\System\ECLvHIp.exe
  2⤵
  PID:8756
- C:\Windows\System\CpFbhpw.exe
  C:\Windows\System\CpFbhpw.exe
  2⤵
  PID:8772
- C:\Windows\System\HylkASk.exe
  C:\Windows\System\HylkASk.exe
  2⤵
  PID:8788
- C:\Windows\System\upCIrEj.exe
  C:\Windows\System\upCIrEj.exe
  2⤵
  PID:8804
- C:\Windows\System\dSIzgsA.exe
  C:\Windows\System\dSIzgsA.exe
  2⤵
  PID:8820
- C:\Windows\System\vBkXlBG.exe
  C:\Windows\System\vBkXlBG.exe
  2⤵
  PID:8836
- C:\Windows\System\DILsohE.exe
  C:\Windows\System\DILsohE.exe
  2⤵
  PID:8852
- C:\Windows\System\zdYysde.exe
  C:\Windows\System\zdYysde.exe
  2⤵
  PID:8868
- C:\Windows\System\XvmGEMq.exe
  C:\Windows\System\XvmGEMq.exe
  2⤵
  PID:8884
- C:\Windows\System\vrlSHXC.exe
  C:\Windows\System\vrlSHXC.exe
  2⤵
  PID:8900
- C:\Windows\System\ILMPlMD.exe
  C:\Windows\System\ILMPlMD.exe
  2⤵
  PID:8916
- C:\Windows\System\jYyrbXR.exe
  C:\Windows\System\jYyrbXR.exe
  2⤵
  PID:8932
- C:\Windows\System\NpOVCEf.exe
  C:\Windows\System\NpOVCEf.exe
  2⤵
  PID:8948
- C:\Windows\System\SPZxryU.exe
  C:\Windows\System\SPZxryU.exe
  2⤵
  PID:8964
- C:\Windows\System\LbqnFmG.exe
  C:\Windows\System\LbqnFmG.exe
  2⤵
  PID:8980
- C:\Windows\System\EoPSFrQ.exe
  C:\Windows\System\EoPSFrQ.exe
  2⤵
  PID:8996
- C:\Windows\System\BmQGpFG.exe
  C:\Windows\System\BmQGpFG.exe
  2⤵
  PID:9012
- C:\Windows\System\JVjaDxx.exe
  C:\Windows\System\JVjaDxx.exe
  2⤵
  PID:9028
- C:\Windows\System\QKzXUcm.exe
  C:\Windows\System\QKzXUcm.exe
  2⤵
  PID:9044
- C:\Windows\System\ezFCMtD.exe
  C:\Windows\System\ezFCMtD.exe
  2⤵
  PID:9060
- C:\Windows\System\VvOTXqE.exe
  C:\Windows\System\VvOTXqE.exe
  2⤵
  PID:9076
- C:\Windows\System\glLWjVa.exe
  C:\Windows\System\glLWjVa.exe
  2⤵
  PID:9092
- C:\Windows\System\RTNwyWn.exe
  C:\Windows\System\RTNwyWn.exe
  2⤵
  PID:9108
- C:\Windows\System\TuXyBeV.exe
  C:\Windows\System\TuXyBeV.exe
  2⤵
  PID:9132
- C:\Windows\System\sARKMGg.exe
  C:\Windows\System\sARKMGg.exe
  2⤵
  PID:9148
- C:\Windows\System\YiqQUrU.exe
  C:\Windows\System\YiqQUrU.exe
  2⤵
  PID:9164
- C:\Windows\System\PjoKXiu.exe
  C:\Windows\System\PjoKXiu.exe
  2⤵
  PID:9180
- C:\Windows\System\RUpFjYu.exe
  C:\Windows\System\RUpFjYu.exe
  2⤵
  PID:9196
- C:\Windows\System\YqAmWPH.exe
  C:\Windows\System\YqAmWPH.exe
  2⤵
  PID:9212
- C:\Windows\System\kYFPDGN.exe
  C:\Windows\System\kYFPDGN.exe
  2⤵
  PID:7392
- C:\Windows\System\XRYinlf.exe
  C:\Windows\System\XRYinlf.exe
  2⤵
  PID:8172
- C:\Windows\System\PJUdrEn.exe
  C:\Windows\System\PJUdrEn.exe
  2⤵
  PID:8224
- C:\Windows\System\sKKAAko.exe
  C:\Windows\System\sKKAAko.exe
  2⤵
  PID:8256
- C:\Windows\System\gMPyKSK.exe
  C:\Windows\System\gMPyKSK.exe
  2⤵
  PID:8268
- C:\Windows\System\SypPBcF.exe
  C:\Windows\System\SypPBcF.exe
  2⤵
  PID:8316
- C:\Windows\System\cxeUrRU.exe
  C:\Windows\System\cxeUrRU.exe
  2⤵
  PID:8352
- C:\Windows\System\norCYXF.exe
  C:\Windows\System\norCYXF.exe
  2⤵
  PID:8364
- C:\Windows\System\XXYCCuM.exe
  C:\Windows\System\XXYCCuM.exe
  2⤵
  PID:8448
- C:\Windows\System\JEPHCio.exe
  C:\Windows\System\JEPHCio.exe
  2⤵
  PID:8460
- C:\Windows\System\CHINRQI.exe
  C:\Windows\System\CHINRQI.exe
  2⤵
  PID:8396
- C:\Windows\System\EeosCXW.exe
  C:\Windows\System\EeosCXW.exe
  2⤵
  PID:8508
- C:\Windows\System\ZhEWXPB.exe
  C:\Windows\System\ZhEWXPB.exe
  2⤵
  PID:8544
- C:\Windows\System\MKRqqer.exe
  C:\Windows\System\MKRqqer.exe
  2⤵
  PID:8560
- C:\Windows\System\rWRhKSD.exe
  C:\Windows\System\rWRhKSD.exe
  2⤵
  PID:8608
- C:\Windows\System\yqkKTsU.exe
  C:\Windows\System\yqkKTsU.exe
  2⤵
  PID:8556
- C:\Windows\System\hYicgmM.exe
  C:\Windows\System\hYicgmM.exe
  2⤵
  PID:8624
- C:\Windows\System\LdLFuHQ.exe
  C:\Windows\System\LdLFuHQ.exe
  2⤵
  PID:8700
- C:\Windows\System\USLszCD.exe
  C:\Windows\System\USLszCD.exe
  2⤵
  PID:8732
- C:\Windows\System\gnFOmqs.exe
  C:\Windows\System\gnFOmqs.exe
  2⤵
  PID:8768
- C:\Windows\System\DPbFKnR.exe
  C:\Windows\System\DPbFKnR.exe
  2⤵
  PID:8752
- C:\Windows\System\PbdtRMt.exe
  C:\Windows\System\PbdtRMt.exe
  2⤵
  PID:8828
- C:\Windows\System\juwfpKz.exe
  C:\Windows\System\juwfpKz.exe
  2⤵
  PID:8816
- C:\Windows\System\gQpUVsR.exe
  C:\Windows\System\gQpUVsR.exe
  2⤵
  PID:8924
- C:\Windows\System\dhseiGt.exe
  C:\Windows\System\dhseiGt.exe
  2⤵
  PID:8876
- C:\Windows\System\XlwJPaa.exe
  C:\Windows\System\XlwJPaa.exe
  2⤵
  PID:8992
- C:\Windows\System\uSqAElT.exe
  C:\Windows\System\uSqAElT.exe
  2⤵
  PID:8880
- C:\Windows\System\JWTulKZ.exe
  C:\Windows\System\JWTulKZ.exe
  2⤵
  PID:8940
- C:\Windows\System\dTbySKZ.exe
  C:\Windows\System\dTbySKZ.exe
  2⤵
  PID:8976
- C:\Windows\System\JNzaUkw.exe
  C:\Windows\System\JNzaUkw.exe
  2⤵
  PID:9036
- C:\Windows\System\wmzRXwb.exe
  C:\Windows\System\wmzRXwb.exe
  2⤵
  PID:9116
- C:\Windows\System\mPpmWYn.exe
  C:\Windows\System\mPpmWYn.exe
  2⤵
  PID:9128
- C:\Windows\System\mvpKRSe.exe
  C:\Windows\System\mvpKRSe.exe
  2⤵
  PID:9188
- C:\Windows\System\jiDeSaa.exe
  C:\Windows\System\jiDeSaa.exe
  2⤵
  PID:7520
- C:\Windows\System\OekllGn.exe
  C:\Windows\System\OekllGn.exe
  2⤵
  PID:9176
- C:\Windows\System\FaJhBiR.exe
  C:\Windows\System\FaJhBiR.exe
  2⤵
  PID:7720
- C:\Windows\System\CDthrmw.exe
  C:\Windows\System\CDthrmw.exe
  2⤵
  PID:8240
- C:\Windows\System\zRFlzIi.exe
  C:\Windows\System\zRFlzIi.exe
  2⤵
  PID:8368
- C:\Windows\System\sSTCVon.exe
  C:\Windows\System\sSTCVon.exe
  2⤵
  PID:8304
- C:\Windows\System\KFwTwXk.exe
  C:\Windows\System\KFwTwXk.exe
  2⤵
  PID:8492
- C:\Windows\System\eakUNrq.exe
  C:\Windows\System\eakUNrq.exe
  2⤵
  PID:8480
- C:\Windows\System\cMeqkJz.exe
  C:\Windows\System\cMeqkJz.exe
  2⤵
  PID:8620
- C:\Windows\System\oBpxdCY.exe
  C:\Windows\System\oBpxdCY.exe
  2⤵
  PID:8688
- C:\Windows\System\YTWNMIw.exe
  C:\Windows\System\YTWNMIw.exe
  2⤵
  PID:8588
- C:\Windows\System\CcHjjut.exe
  C:\Windows\System\CcHjjut.exe
  2⤵
  PID:8716
- C:\Windows\System\JMzSDGQ.exe
  C:\Windows\System\JMzSDGQ.exe
  2⤵
  PID:8892
- C:\Windows\System\dvVbGTT.exe
  C:\Windows\System\dvVbGTT.exe
  2⤵
  PID:8844
- C:\Windows\System\wpPAlxK.exe
  C:\Windows\System\wpPAlxK.exe
  2⤵
  PID:9088
- C:\Windows\System\AerBYQi.exe
  C:\Windows\System\AerBYQi.exe
  2⤵
  PID:9008
- C:\Windows\System\vROwzIW.exe
  C:\Windows\System\vROwzIW.exe
  2⤵
  PID:7868
- C:\Windows\System\QlXtozH.exe
  C:\Windows\System\QlXtozH.exe
  2⤵
  PID:7060
- C:\Windows\System\aNiUysm.exe
  C:\Windows\System\aNiUysm.exe
  2⤵
  PID:8272
- C:\Windows\System\proyFSi.exe
  C:\Windows\System\proyFSi.exe
  2⤵
  PID:8348
- C:\Windows\System\YJAYYgC.exe
  C:\Windows\System\YJAYYgC.exe
  2⤵
  PID:9144
- C:\Windows\System\cnwfuYt.exe
  C:\Windows\System\cnwfuYt.exe
  2⤵
  PID:8764
- C:\Windows\System\KgXdXFu.exe
  C:\Windows\System\KgXdXFu.exe
  2⤵
  PID:8136
- C:\Windows\System\KIHeKda.exe
  C:\Windows\System\KIHeKda.exe
  2⤵
  PID:9120
- C:\Windows\System\tNJAyRI.exe
  C:\Windows\System\tNJAyRI.exe
  2⤵
  PID:8972
- C:\Windows\System\ixUilqo.exe
  C:\Windows\System\ixUilqo.exe
  2⤵
  PID:9104
- C:\Windows\System\oWELPFq.exe
  C:\Windows\System\oWELPFq.exe
  2⤵
  PID:8384
- C:\Windows\System\XKXPhOW.exe
  C:\Windows\System\XKXPhOW.exe
  2⤵
  PID:8860
- C:\Windows\System\VMJtvqC.exe
  C:\Windows\System\VMJtvqC.exe
  2⤵
  PID:9220
- C:\Windows\System\SZYAuxQ.exe
  C:\Windows\System\SZYAuxQ.exe
  2⤵
  PID:9236
- C:\Windows\System\ZDFRhOu.exe
  C:\Windows\System\ZDFRhOu.exe
  2⤵
  PID:9252
- C:\Windows\System\CjAmkxd.exe
  C:\Windows\System\CjAmkxd.exe
  2⤵
  PID:9268
- C:\Windows\System\YVxqWwg.exe
  C:\Windows\System\YVxqWwg.exe
  2⤵
  PID:9288
- C:\Windows\System\JxzLMpR.exe
  C:\Windows\System\JxzLMpR.exe
  2⤵
  PID:9304
- C:\Windows\System\qVGGHaL.exe
  C:\Windows\System\qVGGHaL.exe
  2⤵
  PID:9320
- C:\Windows\System\WJmFrsG.exe
  C:\Windows\System\WJmFrsG.exe
  2⤵
  PID:9336
- C:\Windows\System\gGhqYZh.exe
  C:\Windows\System\gGhqYZh.exe
  2⤵
  PID:9352
- C:\Windows\System\BPjwsTh.exe
  C:\Windows\System\BPjwsTh.exe
  2⤵
  PID:9368
- C:\Windows\System\OMDzevi.exe
  C:\Windows\System\OMDzevi.exe
  2⤵
  PID:9384
- C:\Windows\System\OrfPasD.exe
  C:\Windows\System\OrfPasD.exe
  2⤵
  PID:9400
- C:\Windows\System\vFmBVCH.exe
  C:\Windows\System\vFmBVCH.exe
  2⤵
  PID:9416
- C:\Windows\System\iAOzCcG.exe
  C:\Windows\System\iAOzCcG.exe
  2⤵
  PID:9536
- C:\Windows\System\nnFhxRC.exe
  C:\Windows\System\nnFhxRC.exe
  2⤵
  PID:9556
- C:\Windows\System\CAASzAH.exe
  C:\Windows\System\CAASzAH.exe
  2⤵
  PID:9572
- C:\Windows\System\FODJVbY.exe
  C:\Windows\System\FODJVbY.exe
  2⤵
  PID:9588
- C:\Windows\System\uzToPCp.exe
  C:\Windows\System\uzToPCp.exe
  2⤵
  PID:9604
- C:\Windows\System\oMgwHQl.exe
  C:\Windows\System\oMgwHQl.exe
  2⤵
  PID:9620
- C:\Windows\System\OsFIkGU.exe
  C:\Windows\System\OsFIkGU.exe
  2⤵
  PID:9636
- C:\Windows\System\zqZlsUC.exe
  C:\Windows\System\zqZlsUC.exe
  2⤵
  PID:9652
- C:\Windows\System\hbbDgzP.exe
  C:\Windows\System\hbbDgzP.exe
  2⤵
  PID:9668
- C:\Windows\System\xIyTxZs.exe
  C:\Windows\System\xIyTxZs.exe
  2⤵
  PID:9684
- C:\Windows\System\PFrSbFP.exe
  C:\Windows\System\PFrSbFP.exe
  2⤵
  PID:9700
- C:\Windows\System\KTbHIvX.exe
  C:\Windows\System\KTbHIvX.exe
  2⤵
  PID:9716
- C:\Windows\System\FrDSTvL.exe
  C:\Windows\System\FrDSTvL.exe
  2⤵
  PID:9732
- C:\Windows\System\GAxaQcv.exe
  C:\Windows\System\GAxaQcv.exe
  2⤵
  PID:9760
- C:\Windows\System\rPjhGxx.exe
  C:\Windows\System\rPjhGxx.exe
  2⤵
  PID:9776
- C:\Windows\System\pPgBlev.exe
  C:\Windows\System\pPgBlev.exe
  2⤵
  PID:9792
- C:\Windows\System\cPQKwQx.exe
  C:\Windows\System\cPQKwQx.exe
  2⤵
  PID:9808
- C:\Windows\System\LuXdboZ.exe
  C:\Windows\System\LuXdboZ.exe
  2⤵
  PID:9824
- C:\Windows\System\HcBkaYG.exe
  C:\Windows\System\HcBkaYG.exe
  2⤵
  PID:9840
- C:\Windows\System\gJbllRh.exe
  C:\Windows\System\gJbllRh.exe
  2⤵
  PID:9856
- C:\Windows\System\OKJIbKm.exe
  C:\Windows\System\OKJIbKm.exe
  2⤵
  PID:9872
- C:\Windows\System\uFUoBWJ.exe
  C:\Windows\System\uFUoBWJ.exe
  2⤵
  PID:9888
- C:\Windows\System\PXxPRMP.exe
  C:\Windows\System\PXxPRMP.exe
  2⤵
  PID:9908
- C:\Windows\System\HgycpDe.exe
  C:\Windows\System\HgycpDe.exe
  2⤵
  PID:9924
- C:\Windows\System\pacXohm.exe
  C:\Windows\System\pacXohm.exe
  2⤵
  PID:9940
- C:\Windows\System\bYkvxIA.exe
  C:\Windows\System\bYkvxIA.exe
  2⤵
  PID:9956
- C:\Windows\System\UUDVWxd.exe
  C:\Windows\System\UUDVWxd.exe
  2⤵
  PID:9972
- C:\Windows\System\sqGZwbM.exe
  C:\Windows\System\sqGZwbM.exe
  2⤵
  PID:9988
- C:\Windows\System\UQSPwqT.exe
  C:\Windows\System\UQSPwqT.exe
  2⤵
  PID:10176
- C:\Windows\System\ykTBJIH.exe
  C:\Windows\System\ykTBJIH.exe
  2⤵
  PID:10192
- C:\Windows\System\FlBAXyt.exe
  C:\Windows\System\FlBAXyt.exe
  2⤵
  PID:10208
- C:\Windows\System\AhlJtGw.exe
  C:\Windows\System\AhlJtGw.exe
  2⤵
  PID:10224
- C:\Windows\System\zkNqfeg.exe
  C:\Windows\System\zkNqfeg.exe
  2⤵
  PID:8300
- C:\Windows\System\WeEYevu.exe
  C:\Windows\System\WeEYevu.exe
  2⤵
  PID:9260
- C:\Windows\System\HKtNrmy.exe
  C:\Windows\System\HKtNrmy.exe
  2⤵
  PID:8252
- C:\Windows\System\WPYLgXa.exe
  C:\Windows\System\WPYLgXa.exe
  2⤵
  PID:9300
- C:\Windows\System\jsqqgjZ.exe
  C:\Windows\System\jsqqgjZ.exe
  2⤵
  PID:9280
- C:\Windows\System\xlBdVka.exe
  C:\Windows\System\xlBdVka.exe
  2⤵
  PID:9208
- C:\Windows\System\ubqzUVj.exe
  C:\Windows\System\ubqzUVj.exe
  2⤵
  PID:9424
- C:\Windows\System\abVnNoD.exe
  C:\Windows\System\abVnNoD.exe
  2⤵
  PID:8704
- C:\Windows\System\atoVjNX.exe
  C:\Windows\System\atoVjNX.exe
  2⤵
  PID:9412
- C:\Windows\System\bdVwzvK.exe
  C:\Windows\System\bdVwzvK.exe
  2⤵
  PID:9692
- C:\Windows\System\fFnnlop.exe
  C:\Windows\System\fFnnlop.exe
  2⤵
  PID:9768
- C:\Windows\System\JJLAexW.exe
  C:\Windows\System\JJLAexW.exe
  2⤵
  PID:9644
- C:\Windows\System\AicALre.exe
  C:\Windows\System\AicALre.exe
  2⤵
  PID:9816
- C:\Windows\System\yonncVm.exe
  C:\Windows\System\yonncVm.exe
  2⤵
  PID:9708
- C:\Windows\System\kydRsQS.exe
  C:\Windows\System\kydRsQS.exe
  2⤵
  PID:9752
- C:\Windows\System\tDNISzC.exe
  C:\Windows\System\tDNISzC.exe
  2⤵
  PID:9756
- C:\Windows\System\AIoGuwB.exe
  C:\Windows\System\AIoGuwB.exe
  2⤵
  PID:9836
- C:\Windows\System\nSVjAtU.exe
  C:\Windows\System\nSVjAtU.exe
  2⤵
  PID:9852
- C:\Windows\System\hFTIOXZ.exe
  C:\Windows\System\hFTIOXZ.exe
  2⤵
  PID:9904
- C:\Windows\System\wworVzD.exe
  C:\Windows\System\wworVzD.exe
  2⤵
  PID:9936
- C:\Windows\System\AwFKDCz.exe
  C:\Windows\System\AwFKDCz.exe
  2⤵
  PID:9980
- C:\Windows\System\NrqKUkj.exe
  C:\Windows\System\NrqKUkj.exe
  2⤵
  PID:10004
- C:\Windows\System\BLBEIJA.exe
  C:\Windows\System\BLBEIJA.exe
  2⤵
  PID:10020
- C:\Windows\System\suGyCdU.exe
  C:\Windows\System\suGyCdU.exe
  2⤵
  PID:10036
- C:\Windows\System\hwmextJ.exe
  C:\Windows\System\hwmextJ.exe
  2⤵
  PID:10056
- C:\Windows\System\cmcMlYy.exe
  C:\Windows\System\cmcMlYy.exe
  2⤵
  PID:10068
- C:\Windows\System\pGFtxcV.exe
  C:\Windows\System\pGFtxcV.exe
  2⤵
  PID:10076
- C:\Windows\System\LlLfppI.exe
  C:\Windows\System\LlLfppI.exe
  2⤵
  PID:10100
- C:\Windows\System\zqXKvnL.exe
  C:\Windows\System\zqXKvnL.exe
  2⤵
  PID:10116
- C:\Windows\System\HvOdlit.exe
  C:\Windows\System\HvOdlit.exe
  2⤵
  PID:10132
- C:\Windows\System\uxHKWLa.exe
  C:\Windows\System\uxHKWLa.exe
  2⤵
  PID:9360
- C:\Windows\System\wuhZoZh.exe
  C:\Windows\System\wuhZoZh.exe
  2⤵
  PID:9448
- C:\Windows\System\AZImEfh.exe
  C:\Windows\System\AZImEfh.exe
  2⤵
  PID:9440
- C:\Windows\System\jHLJDTK.exe
  C:\Windows\System\jHLJDTK.exe
  2⤵
  PID:9460
- C:\Windows\System\fsAKvMC.exe
  C:\Windows\System\fsAKvMC.exe
  2⤵
  PID:9480
- C:\Windows\System\nsamrJW.exe
  C:\Windows\System\nsamrJW.exe
  2⤵
  PID:9500
- C:\Windows\System\lDODdmi.exe
  C:\Windows\System\lDODdmi.exe
  2⤵
  PID:9516
- C:\Windows\System\teWPojI.exe
  C:\Windows\System\teWPojI.exe
  2⤵
  PID:9532
- C:\Windows\System\mmdAvaD.exe
  C:\Windows\System\mmdAvaD.exe
  2⤵
  PID:9492
- C:\Windows\System\lmmGPzW.exe
  C:\Windows\System\lmmGPzW.exe
  2⤵
  PID:9600
- C:\Windows\System\RUwzSCM.exe
  C:\Windows\System\RUwzSCM.exe
  2⤵
  PID:10008
- C:\Windows\System\yAQvzVk.exe
  C:\Windows\System\yAQvzVk.exe
  2⤵
  PID:9800
- C:\Windows\System\HPqXIFK.exe
  C:\Windows\System\HPqXIFK.exe
  2⤵
  PID:9616
- C:\Windows\System\VdCNapc.exe
  C:\Windows\System\VdCNapc.exe
  2⤵
  PID:9744
- C:\Windows\System\WuUJqgq.exe
  C:\Windows\System\WuUJqgq.exe
  2⤵
  PID:9884
- C:\Windows\System\fUpZjdc.exe
  C:\Windows\System\fUpZjdc.exe
  2⤵
  PID:9996
- C:\Windows\System\aMAMdRt.exe
  C:\Windows\System\aMAMdRt.exe
  2⤵
  PID:10168
- C:\Windows\System\NZgdFoG.exe
  C:\Windows\System\NZgdFoG.exe
  2⤵
  PID:10204
- C:\Windows\System\BlWiZRA.exe
  C:\Windows\System\BlWiZRA.exe
  2⤵
  PID:8416
- C:\Windows\System\VLNfvWl.exe
  C:\Windows\System\VLNfvWl.exe
  2⤵
  PID:9244
- C:\Windows\System\IuHzocI.exe
  C:\Windows\System\IuHzocI.exe
  2⤵
  PID:9072
- C:\Windows\System\nUlvUtx.exe
  C:\Windows\System\nUlvUtx.exe
  2⤵
  PID:10032
- C:\Windows\System\AQpllrE.exe
  C:\Windows\System\AQpllrE.exe
  2⤵
  PID:9312
- C:\Windows\System\pTLfpbU.exe
  C:\Windows\System\pTLfpbU.exe
  2⤵
  PID:9804
- C:\Windows\System\QsLGNaU.exe
  C:\Windows\System\QsLGNaU.exe
  2⤵
  PID:10052
- C:\Windows\System\ueZTlrp.exe
  C:\Windows\System\ueZTlrp.exe
  2⤵
  PID:10108
- C:\Windows\System\ixjqgJf.exe
  C:\Windows\System\ixjqgJf.exe
  2⤵
  PID:10092
- C:\Windows\System\xoFwUGy.exe
  C:\Windows\System\xoFwUGy.exe
  2⤵
  PID:9628
- C:\Windows\System\hNSGamY.exe
  C:\Windows\System\hNSGamY.exe
  2⤵
  PID:10128
- C:\Windows\System\dGJUpJh.exe
  C:\Windows\System\dGJUpJh.exe
  2⤵
  PID:2744
- C:\Windows\System\nVODnXe.exe
  C:\Windows\System\nVODnXe.exe
  2⤵
  PID:10096
- C:\Windows\System\RwCwLbf.exe
  C:\Windows\System\RwCwLbf.exe
  2⤵
  PID:10144
- C:\Windows\System\FCMbroA.exe
  C:\Windows\System\FCMbroA.exe
  2⤵
  PID:10160
- C:\Windows\System\mmcZuCG.exe
  C:\Windows\System\mmcZuCG.exe
  2⤵
  PID:8912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AthRgvY.exe

Filesize
1.4MB

MD5
55b9e722adc4cdaa031be83fba534141

SHA1
7a0eb8aac98253fe8b7eeb67783cd66f46709907

SHA256
a83f419f4eea764b5548a42fe0a875cb8f28e335ddf7c9109304cbf43f49b689

SHA512
ff78f971e1470f53cb79f24173fa7f5391f5ca6d46c716cd238910d774a638ee9c1d40e9f327f1694d0bf718a72a39ead2e4aab98e183a188de1bd0f32daa554

Download Submit
C:\Windows\system\CLEfnjR.exe

Filesize
1.4MB

MD5
e12bff30e8b2515709c2ed559f90ee94

SHA1
fb77ae482cf5f6a09b44ea6606297b7796991ba5

SHA256
3ae10c58a8448acdfae91cbb60f290398ca9be19510fde74a196465a09dfd623

SHA512
d23f7af4f9410d4e59fcb0c14fa08d29e8f026d7249db897e7aa7aec9f27f99adb2e70b26c765667b8e131ec8977cf658575366190983637c6c679091a48253d

Download Submit
C:\Windows\system\DFwgvVE.exe

Filesize
1.4MB

MD5
ebf3992ab272307e18602e926e233154

SHA1
da6095fbec2177a204230fe34f8f74cf60b76bb1

SHA256
106c920c359d84496a8476ec1557da0cb3f2180a7c96dfbdc6b86244baf2013f

SHA512
32509380e67bf837dd775e2a91f7ddb0900f4d9467751c7729b3fc335605d0f9a3aa5977f4eb21ad0fd15247dce70f9985febd7aaa51bb0134b6b82eeb8340b2

Download Submit
C:\Windows\system\DjQocqq.exe

Filesize
1.4MB

MD5
c967353e235949214c3d5763def60ce2

SHA1
5b810382c5ddb6f0b229baa8a52ba666b92404d4

SHA256
25362c45b5d1066e821d472637c8c3e994dae9ffc36f20a234ac41d203687fea

SHA512
0772e83dae8e211913884dcbd1e5980a9274ce6eb58663fd9e67d8de77101fa2e96f15161919e81bd1d7d3c48c2e968ec3e08bdc753eb0e0c65aa72b1db7ec40

Download Submit
C:\Windows\system\DuXrnqu.exe

Filesize
1.4MB

MD5
d34995f1f58de1b641462bd9355e0b3d

SHA1
6ecf5ed109d1606872a6178e4438caa3bea729a6

SHA256
3125cf94ab50b1a8ef312e45e7e313e7d34ff999143d9e37bedb2487a4d2fbb7

SHA512
c2dbc1cf0644a9f8af38e15e6e20c2d501eefcef94b18428069a8e18888cc0798cc5377290de34d6411e110c166405710baeae6d25193643a0a896249389f88e

Download Submit
C:\Windows\system\HPuyqDG.exe

Filesize
1.4MB

MD5
dcf3fdf162936d14e991c46fefa0422e

SHA1
be86008e9039474498590b7282dc028fc72da7f1

SHA256
8b14673f08b3d1d28239ed74485caffca3d713471624859f5842f2de63171ef5

SHA512
7096bcb4dbca6e8fe13bac5e5692a3ac21c37d908e0d64ea170e6f23452f87bd925c9a13c6fce89e6cbd82faac4c27ff9a25d6fd3122d7232f563ddd12c4eab1

Download Submit
C:\Windows\system\JkUxcEg.exe

Filesize
1.4MB

MD5
9c5e7159bd7b6fd060e91e421c8da0ea

SHA1
cb9f2e46bf588fccbbcb8f3ca995bf49b50acc8a

SHA256
5af28bb34067f7a949dc5d6567200de8a17356d7fd4588afa747295b68219f0a

SHA512
4d2900b9fac60bcdac9db96b40171de180954f0425f1e75cb2a8cd96f76f9a55af0588e126858987b1bb7fbdc445c0f1edf2480a1ae6ddb15491aa5809a3f21c

Download Submit
C:\Windows\system\KgHjQRS.exe

Filesize
1.4MB

MD5
20a60280b0cf2c2554e61f76729d0c29

SHA1
70589230e69ef6e5883a7caf197783269c8c3244

SHA256
837f73cbf505b6beea9d12eabd3a91ca4e0071c26757a3f5d825710627c1667d

SHA512
003e21ae34e91eab9b4e77e0722cd7ac190abcb9e53fdb72337b75d9de5c908d630d004b20c4eccb687161ebe858acc3cafed38303aa4f355d9e56095a54e703

Download Submit
C:\Windows\system\LswzluO.exe

Filesize
1.4MB

MD5
2ec91f2519c2e852576599af43370110

SHA1
127bcf0183e50d59dcb9df254977006ede56c67b

SHA256
22c203a0066f7dfb57dc9a776eba00a585895f025913547c2d89ae6a19f2b33c

SHA512
3e5268c742dfb5e03d64b80cd29b21c864f4d86dd1bd85b809adf8eca37330aa8057ec6ffad5dd06a1f7811dd4868fed9af577174aaf46762bf817d15a733e99

Download Submit
C:\Windows\system\OuDkXhT.exe

Filesize
1.4MB

MD5
77d6513b405d7f0284f690d5b164b56a

SHA1
58ee3c60b7659bcbd45d3872e53529275e57a435

SHA256
7451614c8e44c2d7053ea7685f66e93446bc52d2f19d76ce7c4a12ec0e94bd3e

SHA512
bd2307ba2a177a9486d8c9f932db536ce614a017eaf20fa4f88c7a0cd6dbae3054ecdbb2b5d49d41f735c03ee714394dc50b2b77282b93c9b80e98e480864b7f

Download Submit
C:\Windows\system\OzZYZnF.exe

Filesize
1.4MB

MD5
496b7ab06e3fef6e69ddb520bdedbc9c

SHA1
2650c6285ce496743c2d503baba54c784402ad21

SHA256
f296d3db4de84201591b484c24b6d9d64d8f22a7f3f2494ef4d2e94a88242c77

SHA512
75b7f4bbd5f551be4b3c1f9d794135e405af599b9b5f017351b341d3c6d658dde1ccee4b54ddf3d9f3e92d18ba308f2fb830613ec25327c6502a5132d9672181

Download Submit
C:\Windows\system\PegFylz.exe

Filesize
1.4MB

MD5
602f7f7063baa83ed045e434222f05e4

SHA1
b509108de098c5e6ac5bfb16975a852546ddfea7

SHA256
0e0eb62e936e1bad83d1c9f34d1d0c72537cebd6f8911c6bed4b8ab96ad74f25

SHA512
e4be8bf11af84d7b0d713a29d7581ddfe8aad3442d633cbeb5a4b6a6d2f676072f3fd962baf9f980b3f664fbe0779b2aa8c0a9a6e8f3f95f2b536469562bcc76

Download Submit
C:\Windows\system\ThLyNNh.exe

Filesize
1.4MB

MD5
35ad3572a03ade3fd108ab347c3ea832

SHA1
921c1c6a17cba68a8470be41b21c5bda1fbcd99b

SHA256
91a7594556cefa4d038e3cbf29373105c840da62e4f4e5917cd4130d26451206

SHA512
a61275bbd924bebd412776d3bf4fcf0f79cf2356912a19a49f3ce7fbfc2742873ab21cc32c18c74266bbafd643b7cafc050541a0cfcbb2db524443d7534ef3d3

Download Submit
C:\Windows\system\dxDfCjB.exe

Filesize
1.4MB

MD5
07e63ac2d06f80e47b7d7381c8439afe

SHA1
43f6da679c47d790b93382d954528da4f1cee73f

SHA256
6dcd3f9f21e36ae22c435b6dfb12e3e5f54dce0f6ce718635b4aa79dcf2da5f5

SHA512
5eb9d7c9f354118f858b0e913207886a8e74d6354b294f314a7aa5e67e37ee32e687107e7f4993729704a063981393abb6d054538d14fd838788d6c388f9013b

Download Submit
C:\Windows\system\enxlVtS.exe

Filesize
1.4MB

MD5
a4bf6a12aade56a59c13da8142ea37c7

SHA1
8ced77da397c0f35415ae9ea52460e96e06c8f00

SHA256
b41bc6bc3c213e03d873e3545b2e74a30b82af567590245807cb8dec3dc73ca9

SHA512
53c79be637f76bf0b14abbb2d9b8554740487bc8387eb6560d9de0939b693a9691cd8d848052dac0725b774eedd2bbc14ee2384ce4b030166d58e0696a96340c

Download Submit
C:\Windows\system\hdhuEKJ.exe

Filesize
1.4MB

MD5
1e1a692a6ba4a51f69ad75d5c88ae861

SHA1
c8dfbf444952234caaac9f407080cc413798d32d

SHA256
2c19e2788f1bc4ed701a9a3c1363f1faf6b88c220335947d63dbdf23c79bfa8f

SHA512
601c7c6119c3830e64fbb9d617bac4188ebb102f704dd2d04f2b61684ddab2cfcbc8bf77f0bd1465f09842bc4e8e4191e2cca99770fa8be5ab1da106ab2acb57

Download Submit
C:\Windows\system\izsnHXo.exe

Filesize
1.4MB

MD5
8aaa3b98656bda8cc6c2fde6eb8a3e0c

SHA1
8fcd9a3e88ad287201b591a7d679515dcdf1a5fb

SHA256
70ee2a10a0cf07b47c11cb11ad245b9736823a11db66a4609a9f0c25f506a7ff

SHA512
b0798e2b17a67e725f972b2e3914c19a8bb15ff19aa629d529e110ed7b5febaef9231426468d2592ecb8fdfc086b0fde1d6e28794d99aaf37200a1058e3aa443

Download Submit
C:\Windows\system\jtOvjmr.exe

Filesize
1.4MB

MD5
4fdbace019c5de9fcb5f6476e9623ad0

SHA1
5dcd2cc429f524748f8a4d94be5f13ad2b16dd07

SHA256
afdc00d74108c44ad2abec5cb6973ac33b8a58a42f5fac4076bca1e5a4349203

SHA512
5d8ce61d4138a0d1288aa6c3446a431900c54c93e6fb742207fc5a0ac27e8ab9130826af9f431a54a44543342a1053040f29038879b395856f1ff51a3687eeca

Download Submit
C:\Windows\system\mccFSkT.exe

Filesize
1.4MB

MD5
8667fef79ec604f54a7fdb0a12c28416

SHA1
d77f57c5388b674f48d9336a5ab49484f7df666e

SHA256
f7721dcf8263b625332627a2a7ee68029875bd5095e82ebbe4ff3533b72ab832

SHA512
eaa596d2bb3218113cab83e9026878014a40c5bedc7771c134e121a1e71363147f69677b75c1560ebf09578e4ab9b55e815ebd7fbc5141ff5f9dba12b67a2f2e

Download Submit
C:\Windows\system\mgDmLCL.exe

Filesize
1.4MB

MD5
9591f210760b2d15de57915eeaa278dc

SHA1
5303212fba295d92d3e43b64d169305f4cc6cd0c

SHA256
9a30af4518f52f52473afe3d7f434bf227c3216923d7d8932cc226675953de59

SHA512
79fc33d188492734430b8cd0c98d65375daadad1a6028c45ffe0a597c7f7a4176da7b637fe78009687c4d11e3ad22fc5610cd30518843e5bfb44df05efa7de8a

Download Submit
C:\Windows\system\oXfyaIG.exe

Filesize
1.4MB

MD5
f6c15d7b808eed45f426c9bccdc19a44

SHA1
0ca171a33efa605a25ae4047e93bf26d480500a8

SHA256
b01ff426cb176d8ccdff7f9712e408b34b7b0aafa8e6ff35864ebc50e19b1143

SHA512
61b33f08804770c7f87b645f90a6b9f60756bd601acdb4539aa4d6c558025ba69e1f1babee6b11a8d1ce4a6f988b6d47fe4567ead3ff42f60d5a03a2324ac4bf

Download Submit
C:\Windows\system\rPyUmVA.exe

Filesize
1.4MB

MD5
5cccf326f4c9a84103bb69aeeac841ae

SHA1
a3df61ff03b0a961b42d54ba4d2294390e8a1744

SHA256
9f29bc4a3b314710f7378ad143b6497d629f0525bfe3bea0a695d872d798d809

SHA512
b6a009b9fb03b0dda2bcb118620b60f816b0b9fffbaa1a4a30fd327c3dc49b712a0cb6ce821635d671a65e75a26a0e8d0b65dae4862f99d82e1db05e1d9e56f0

Download Submit
C:\Windows\system\raPpMOE.exe

Filesize
1.4MB

MD5
a9d7eeefc876c27f786740f2980a40a2

SHA1
5a5a7f430c7cd112549fc1ef99ffd1f55aeee7aa

SHA256
bcc613ddcde1305e2641dbc24f34e92708490cae221019af6c2fd83624017367

SHA512
2400462cbd17edd81eaeb86931aabfad402b5577ee95cef374898cb672ad36c608a85ffd11b171d369aefa4b29a34e86b35ccae8b50e94f80986813a4ddb396f

Download Submit
C:\Windows\system\scCwhYt.exe

Filesize
1.4MB

MD5
c55ea66c1ff8b044236f727d3252ca67

SHA1
dd7cd4a252fb76e3250cb8156c95cda2cb81f374

SHA256
f02d8a2ad381f2701d1b279591409a2d584dc831680125320724f5a329317a98

SHA512
2f3a72e508626745e236732a1fa9bcaad490ced9f5ff37ce07812977fcc287983b7e42627cef3eeeaedf8416ee03f4907424e564d88f842275beb846def4ae24

Download Submit
C:\Windows\system\uhJQmsh.exe

Filesize
1.4MB

MD5
ae7ddd2a5e7f26f79719be317eed831b

SHA1
e2e752761d1247e2182c1b9e4dd7ee109151be56

SHA256
03feec7047d59ce0d9ac3d12d4442bd22e966da1c49df72902b15cb268bc37cb

SHA512
24366b686626f97318fdcf310e381b0ce56c69a36c420003854208d42581e7ecaee5bde80617c1b4ae6f14127684f138bd4b435efced9352e381a5b82b2b980c

Download Submit
C:\Windows\system\wzBaYkS.exe

Filesize
1.4MB

MD5
b8c53629c8ff9880833ae7438b5535a5

SHA1
2b37e9299f2b7787184e7b22910da784f6351bdd

SHA256
3297618aa688382d781e13fec3e75639dcc3037b07a2c60d974fef6d9e75d86f

SHA512
ad7c10ec37801ef48144e5f42b4cbd5db74f3921fa32e9c7b9096c5b3beee66a14681a0297f8d2bc825e87ab1c5c54c3167c3c4ca1b01113b2ee0a899be73c78

Download Submit
C:\Windows\system\xaTmflh.exe

Filesize
1.4MB

MD5
b6bf0cd5989ab535e5edc960d39d94b8

SHA1
767a0ac61bf21dc4746502acf34f47694bac2480

SHA256
49d3d8e32b1e4108fc6a925ead668339b89ade8ecabf8a05add65e9bbd30ae9b

SHA512
1b07087cd0f26d18c2f33471989fa18dcbd8d37757944fe0b561f783cc73e43eaf398a761fe2c15696369507abdcc7c73f593d8a7a8dfd8378cab36a87cbdde7

Download Submit
C:\Windows\system\zActqpq.exe

Filesize
1.4MB

MD5
18c9e82d5bbd3eb7b1aa5726fa241011

SHA1
c04b5fcb286008914dad320c71699bd1d4e645ab

SHA256
cfb171d1d75bbbdcc710c256be081d175629ac1ec7e1a36c92ce606ea0907284

SHA512
0737447d9bd08f181ad4f49ff6ee9dd2a46f51534e1ed03581cc30bb861dabf9c30a8bd7532f06c704b2ec5a48f2d800e331998a8e7ef1c255572e2550c81af7

Download Submit
C:\Windows\system\zNqXltj.exe

Filesize
1.4MB

MD5
dce912f0012d03ae2a16b5fddb95f207

SHA1
90d9427830e572b90c5810f49d58cd2c5cda37f9

SHA256
0841eb63b5e993c3823a4c093c69504345861216b629f722e81f542a855b9a39

SHA512
10991c6304f3152c2ec02d1c330cb3b095aae2e0e202dd1fb803d522d0555ffddd809b0e2c63db0e41382b485d56c52725c2fc6750f0760f2a5821723702ca1c

Download Submit
\Windows\system\MaEVGNq.exe

Filesize
1.4MB

MD5
376b0986aac042d2afba65df90b23b90

SHA1
618f61e2cffabd8dfb5f20a949afdcb4fa2f6b02

SHA256
1f97bf90e2cd373b616c1a79c1fbabb9c3aa5e74bc7ea2529763ec650139941c

SHA512
3dea0ae4d12d48b07005867b9414150962575a07d613d37f65a3fce1b60e9f0424d8cd02416f311fdac1fd434da6585e0e889da0bfd93e545a57a9c613401ded

Download Submit
\Windows\system\NydjFAo.exe

Filesize
1.4MB

MD5
505e357c1cde41d34d1b643bda7564e6

SHA1
ecbc1df611c1898f9e50cc01f8988cd02840fc82

SHA256
af110aaeaa3e8ee2fbb16fc7e53c59728e12bab2c644dd03c5cce3ad22e037a3

SHA512
cdffcc001c69834d9905746414944d31cc8887500a831e94ca8e0b6f5319014abb42814125a5b82016a14bf6842641733e7e71fcef41f04308a5ac8131304f51

Download Submit
\Windows\system\WtpChgm.exe

Filesize
1.4MB

MD5
5989092bbc7ca0218d9c1948424308b7

SHA1
9d53a23d720246b42b4cf0504077b22d6b846527

SHA256
18f8ba326056e749bdd48dcdc31cd576bbeac2f3c61f88cec6d2944dd124b64a

SHA512
cbabd2dedb94d83963692540255e6b0d59fe569d112fc3a3501ada36b90db1206d458e79c2cac2b048d7e5c4b13304756d1e4644eaf1482fca137d58ba258f1b

Download Submit
memory/1796-16-0x000000013F7A0000-0x000000013FB92000-memory.dmp

Filesize
3.9MB

Download
memory/1796-5192-0x000000013F7A0000-0x000000013FB92000-memory.dmp

Filesize
3.9MB

Download
memory/2408-5196-0x000000013FFC0000-0x00000001403B2000-memory.dmp

Filesize
3.9MB

Download
memory/2408-189-0x000000013FFC0000-0x00000001403B2000-memory.dmp

Filesize
3.9MB

Download
memory/2412-137-0x000000001B7F0000-0x000000001BAD2000-memory.dmp

Filesize
2.9MB

Download
memory/2412-268-0x000007FEF5710000-0x000007FEF60AD000-memory.dmp

Filesize
9.6MB

Download
memory/2412-2615-0x000007FEF5710000-0x000007FEF60AD000-memory.dmp

Filesize
9.6MB

Download
memory/2412-190-0x000007FEF59CE000-0x000007FEF59CF000-memory.dmp

Filesize
4KB

Download
memory/2412-146-0x0000000002860000-0x0000000002868000-memory.dmp

Filesize
32KB

Download
memory/2592-5213-0x000000013FF20000-0x0000000140312000-memory.dmp

Filesize
3.9MB

Download
memory/2592-285-0x000000013FF20000-0x0000000140312000-memory.dmp

Filesize
3.9MB

Download
memory/2640-5215-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/2640-287-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/2716-5198-0x000000013F9D0000-0x000000013FDC2000-memory.dmp

Filesize
3.9MB

Download
memory/2716-271-0x000000013F9D0000-0x000000013FDC2000-memory.dmp

Filesize
3.9MB

Download
memory/2752-277-0x000000013FE00000-0x00000001401F2000-memory.dmp

Filesize
3.9MB

Download
memory/2752-5206-0x000000013FE00000-0x00000001401F2000-memory.dmp

Filesize
3.9MB

Download
memory/2760-5211-0x000000013F680000-0x000000013FA72000-memory.dmp

Filesize
3.9MB

Download
memory/2760-281-0x000000013F680000-0x000000013FA72000-memory.dmp

Filesize
3.9MB

Download
memory/2788-269-0x000000013F8F0000-0x000000013FCE2000-memory.dmp

Filesize
3.9MB

Download
memory/2788-5222-0x000000013F8F0000-0x000000013FCE2000-memory.dmp

Filesize
3.9MB

Download
memory/2848-275-0x000000013F680000-0x000000013FA72000-memory.dmp

Filesize
3.9MB

Download
memory/2848-5224-0x000000013F680000-0x000000013FA72000-memory.dmp

Filesize
3.9MB

Download
memory/2872-279-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

Filesize
3.9MB

Download
memory/2872-5217-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

Filesize
3.9MB

Download
memory/2968-276-0x000000013FE00000-0x00000001401F2000-memory.dmp

Filesize
3.9MB

Download
memory/2968-270-0x0000000002E20000-0x0000000003212000-memory.dmp

Filesize
3.9MB

Download
memory/2968-5747-0x0000000002E20000-0x0000000003212000-memory.dmp

Filesize
3.9MB

Download
memory/2968-286-0x0000000002E20000-0x0000000003212000-memory.dmp

Filesize
3.9MB

Download
memory/2968-290-0x0000000002E20000-0x0000000003212000-memory.dmp

Filesize
3.9MB

Download
memory/2968-10-0x0000000002E20000-0x0000000003212000-memory.dmp

Filesize
3.9MB

Download
memory/2968-2922-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/2968-4184-0x000000013FDB0000-0x00000001401A2000-memory.dmp

Filesize
3.9MB

Download
memory/2968-5134-0x0000000002E20000-0x0000000003212000-memory.dmp

Filesize
3.9MB

Download
memory/2968-5152-0x0000000002E20000-0x0000000003212000-memory.dmp

Filesize
3.9MB

Download
memory/2968-5151-0x000000013FE00000-0x00000001401F2000-memory.dmp

Filesize
3.9MB

Download
memory/2968-5150-0x0000000002E20000-0x0000000003212000-memory.dmp

Filesize
3.9MB

Download
memory/2968-5165-0x0000000002E20000-0x0000000003212000-memory.dmp

Filesize
3.9MB

Download
memory/2968-5175-0x000000013FF20000-0x0000000140312000-memory.dmp

Filesize
3.9MB

Download
memory/2968-14-0x000000013FDB0000-0x00000001401A2000-memory.dmp

Filesize
3.9MB

Download
memory/2968-288-0x0000000002E20000-0x0000000003212000-memory.dmp

Filesize
3.9MB

Download
memory/2968-272-0x0000000002E20000-0x0000000003212000-memory.dmp

Filesize
3.9MB

Download
memory/2968-278-0x0000000002E20000-0x0000000003212000-memory.dmp

Filesize
3.9MB

Download
memory/2968-5370-0x0000000002E20000-0x0000000003212000-memory.dmp

Filesize
3.9MB

Download
memory/2968-280-0x0000000002E20000-0x0000000003212000-memory.dmp

Filesize
3.9MB

Download
memory/2968-282-0x000000013FF20000-0x0000000140312000-memory.dmp

Filesize
3.9MB

Download
memory/2968-0-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/2968-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2968-5258-0x0000000002E20000-0x0000000003212000-memory.dmp

Filesize
3.9MB

Download
memory/2968-19-0x000000013FFC0000-0x00000001403B2000-memory.dmp

Filesize
3.9MB

Download
memory/2988-5229-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2988-289-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/3020-21-0x000000013FDB0000-0x00000001401A2000-memory.dmp

Filesize
3.9MB

Download
memory/3020-5203-0x000000013FDB0000-0x00000001401A2000-memory.dmp

Filesize
3.9MB

Download