xmrig | fbf37417765d8dd26a25853646f4465af663312a6897b5b0686caee57bf105fd

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 11:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4fe302233b57c1c6df8cbe3910dbbb40N.exe
Size

1.2MB
MD5

4fe302233b57c1c6df8cbe3910dbbb40
SHA1

04c534e319a85fe03ab0636f6423de169b7aa714
SHA256

fbf37417765d8dd26a25853646f4465af663312a6897b5b0686caee57bf105fd
SHA512

ec3e377835dc3e01494d026cc0c2c655f0b2be58b01626125c324f03ab4201a4d88ec428f0f2da61a75ecd0694f3e332172f2e57cf006d5714d9eefcb718ff68
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYRLZcyZGRoz:Lz071uv4BPMkibTIA5Jnsoz

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 28 IoCs

miner

resource	yara_rule
behavioral1/memory/1512-16-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	xmrig
behavioral1/memory/1256-61-0x000000013F350000-0x000000013F742000-memory.dmp	xmrig
behavioral1/memory/2576-50-0x000000013F040000-0x000000013F432000-memory.dmp	xmrig
behavioral1/memory/2712-72-0x00000000031F0000-0x00000000035E2000-memory.dmp	xmrig
behavioral1/memory/1444-76-0x000000013FEC0000-0x00000001402B2000-memory.dmp	xmrig
behavioral1/memory/600-70-0x000000013F750000-0x000000013FB42000-memory.dmp	xmrig
behavioral1/memory/1464-63-0x000000013FDE0000-0x00000001401D2000-memory.dmp	xmrig
behavioral1/memory/288-88-0x000000013F530000-0x000000013F922000-memory.dmp	xmrig
behavioral1/memory/2348-62-0x000000013F900000-0x000000013FCF2000-memory.dmp	xmrig
behavioral1/memory/2756-44-0x000000013F800000-0x000000013FBF2000-memory.dmp	xmrig
behavioral1/memory/2712-121-0x000000013FCB0000-0x00000001400A2000-memory.dmp	xmrig
behavioral1/memory/2912-65-0x000000013F080000-0x000000013F472000-memory.dmp	xmrig
behavioral1/memory/2712-299-0x000000013FCB0000-0x00000001400A2000-memory.dmp	xmrig
behavioral1/memory/2908-316-0x000000013FAB0000-0x000000013FEA2000-memory.dmp	xmrig
behavioral1/memory/288-409-0x000000013F530000-0x000000013F922000-memory.dmp	xmrig
behavioral1/memory/1992-569-0x000000013FF00000-0x00000001402F2000-memory.dmp	xmrig
behavioral1/memory/1512-2451-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	xmrig
behavioral1/memory/2912-2513-0x000000013F080000-0x000000013F472000-memory.dmp	xmrig
behavioral1/memory/2576-2517-0x000000013F040000-0x000000013F432000-memory.dmp	xmrig
behavioral1/memory/600-2548-0x000000013F750000-0x000000013FB42000-memory.dmp	xmrig
behavioral1/memory/1464-2539-0x000000013FDE0000-0x00000001401D2000-memory.dmp	xmrig
behavioral1/memory/288-2850-0x000000013F530000-0x000000013F922000-memory.dmp	xmrig
behavioral1/memory/2908-2851-0x000000013FAB0000-0x000000013FEA2000-memory.dmp	xmrig
behavioral1/memory/1256-2852-0x000000013F350000-0x000000013F742000-memory.dmp	xmrig
behavioral1/memory/2348-2853-0x000000013F900000-0x000000013FCF2000-memory.dmp	xmrig
behavioral1/memory/1444-2855-0x000000013FEC0000-0x00000001402B2000-memory.dmp	xmrig
behavioral1/memory/2756-2854-0x000000013F800000-0x000000013FBF2000-memory.dmp	xmrig
behavioral1/memory/1992-2856-0x000000013FF00000-0x00000001402F2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2780	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1512	YsmbFNB.exe
2912	uaTCsKN.exe
2756	LvgQdBm.exe
2576	mFFmJKo.exe
1256	KBBloiu.exe
600	rwddkXf.exe
2348	RkZAFjq.exe
1464	wYxWsUD.exe
1444	kNhLEGz.exe
2908	xrNZJOy.exe
288	hMtOpoT.exe
1992	oPLIrgs.exe
1664	bKNkYSm.exe
3004	rULKmzN.exe
864	DJHRiSz.exe
1924	dsEhdiF.exe
1844	BdKXkjt.exe
1936	gTMZtTP.exe
2980	DufOunF.exe
2040	AfMzyVP.exe
2032	bQSntcA.exe
2532	UnhnyPW.exe
2472	BBEacOE.exe
944	UslcWxT.exe
3008	MONkBGM.exe
2240	gdqcMsg.exe
2056	qcSBtJN.exe
1180	FKvdtkl.exe
2504	rSHwYpx.exe
1084	gRUbpsa.exe
692	fFPBBWx.exe
2224	EwKZdGi.exe
1484	PkbHhrr.exe
2516	sRWKuNS.exe
2304	chPqUQQ.exe
1956	RREdytw.exe
1544	KtZNjeN.exe
2072	AxUgqJG.exe
1968	yIAaMPh.exe
2388	MidNCAu.exe
3012	XaiMDHy.exe
1268	jjuavAN.exe
1620	obiEAOM.exe
592	mrRYoni.exe
1416	mMUkskJ.exe
2672	hCvTzeI.exe
2392	cXxDNar.exe
2268	UZfHNLT.exe
2188	WXYgymJ.exe
1724	DVjlrGx.exe
1004	HPumfCf.exe
868	nmcgIbA.exe
2856	GWojUIg.exe
1580	YouyohV.exe
2700	oYGhYcZ.exe
2020	NjGarNi.exe
2828	DzxpmHT.exe
836	AFnToxT.exe
2552	HsCQSlg.exe
3028	OHeAqOP.exe
2364	PnkXibL.exe
2964	WRTSrKZ.exe
3040	YwXfDRR.exe
2284	tezgDfk.exe

Loads dropped DLL 64 IoCs

pid	Process
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2712-0-0x000000013FCB0000-0x00000001400A2000-memory.dmp	upx
behavioral1/files/0x000c000000017444-3.dat	upx
behavioral1/files/0x0012000000017553-12.dat	upx
behavioral1/memory/1512-16-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	upx
behavioral1/files/0x001700000000558f-22.dat	upx
behavioral1/files/0x00180000000185f5-23.dat	upx
behavioral1/files/0x000500000001866b-31.dat	upx
behavioral1/files/0x0007000000018682-52.dat	upx
behavioral1/files/0x0005000000018671-55.dat	upx
behavioral1/memory/1256-61-0x000000013F350000-0x000000013F742000-memory.dmp	upx
behavioral1/memory/2576-50-0x000000013F040000-0x000000013F432000-memory.dmp	upx
behavioral1/files/0x0005000000018eb2-67.dat	upx
behavioral1/memory/1444-76-0x000000013FEC0000-0x00000001402B2000-memory.dmp	upx
behavioral1/memory/600-70-0x000000013F750000-0x000000013FB42000-memory.dmp	upx
behavioral1/memory/1464-63-0x000000013FDE0000-0x00000001401D2000-memory.dmp	upx
behavioral1/files/0x0005000000018eba-77.dat	upx
behavioral1/files/0x0005000000018ed5-84.dat	upx
behavioral1/memory/288-88-0x000000013F530000-0x000000013F922000-memory.dmp	upx
behavioral1/memory/2348-62-0x000000013F900000-0x000000013FCF2000-memory.dmp	upx
behavioral1/files/0x000500000001866f-45.dat	upx
behavioral1/memory/2756-44-0x000000013F800000-0x000000013FBF2000-memory.dmp	upx
behavioral1/memory/2908-81-0x000000013FAB0000-0x000000013FEA2000-memory.dmp	upx
behavioral1/files/0x0005000000018f08-99.dat	upx
behavioral1/files/0x0005000000018f80-118.dat	upx
behavioral1/files/0x0005000000018f40-109.dat	upx
behavioral1/files/0x0005000000018f2c-104.dat	upx
behavioral1/memory/1992-94-0x000000013FF00000-0x00000001402F2000-memory.dmp	upx
behavioral1/files/0x0005000000018f6e-114.dat	upx
behavioral1/memory/2712-121-0x000000013FCB0000-0x00000001400A2000-memory.dmp	upx
behavioral1/files/0x0005000000018ef7-93.dat	upx
behavioral1/memory/2912-65-0x000000013F080000-0x000000013F472000-memory.dmp	upx
behavioral1/files/0x0005000000018f88-127.dat	upx
behavioral1/files/0x0005000000018f94-136.dat	upx
behavioral1/files/0x0005000000018f9e-143.dat	upx
behavioral1/files/0x0005000000018faa-150.dat	upx
behavioral1/files/0x0005000000018fba-157.dat	upx
behavioral1/files/0x0005000000018fc4-165.dat	upx
behavioral1/files/0x0005000000018fca-179.dat	upx
behavioral1/files/0x0005000000018fe2-185.dat	upx
behavioral1/files/0x000500000001903d-200.dat	upx
behavioral1/files/0x0005000000018fb0-152.dat	upx
behavioral1/files/0x0005000000019028-197.dat	upx
behavioral1/memory/2712-299-0x000000013FCB0000-0x00000001400A2000-memory.dmp	upx
behavioral1/memory/2908-316-0x000000013FAB0000-0x000000013FEA2000-memory.dmp	upx
behavioral1/memory/288-409-0x000000013F530000-0x000000013F922000-memory.dmp	upx
behavioral1/files/0x0005000000018ffa-188.dat	upx
behavioral1/files/0x0005000000018fcd-181.dat	upx
behavioral1/files/0x0005000000018fc7-168.dat	upx
behavioral1/files/0x0005000000018fc2-159.dat	upx
behavioral1/files/0x0005000000018fa2-145.dat	upx
behavioral1/files/0x0005000000018f9a-138.dat	upx
behavioral1/files/0x0005000000018f8e-131.dat	upx
behavioral1/files/0x0005000000018f84-124.dat	upx
behavioral1/files/0x000500000001901a-195.dat	upx
behavioral1/memory/1992-569-0x000000013FF00000-0x00000001402F2000-memory.dmp	upx
behavioral1/memory/1512-2451-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	upx
behavioral1/memory/2912-2513-0x000000013F080000-0x000000013F472000-memory.dmp	upx
behavioral1/memory/2576-2517-0x000000013F040000-0x000000013F432000-memory.dmp	upx
behavioral1/memory/600-2548-0x000000013F750000-0x000000013FB42000-memory.dmp	upx
behavioral1/memory/1464-2539-0x000000013FDE0000-0x00000001401D2000-memory.dmp	upx
behavioral1/memory/288-2850-0x000000013F530000-0x000000013F922000-memory.dmp	upx
behavioral1/memory/2908-2851-0x000000013FAB0000-0x000000013FEA2000-memory.dmp	upx
behavioral1/memory/1256-2852-0x000000013F350000-0x000000013F742000-memory.dmp	upx
behavioral1/memory/2348-2853-0x000000013F900000-0x000000013FCF2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\jjuavAN.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\aBOTSuw.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\LmSFboP.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\woBCxxK.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\uoQKkeX.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\OUITHXT.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\ZXmbBkL.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\huhYKtS.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\nlArKxd.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\mGeWMOG.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\Hldeddb.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\ghEXwkw.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\JBNHzrO.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\tfLjjpN.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\RlGbhsH.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\YwXfDRR.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\EklHDua.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\UrLDEhK.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\kdlCnJf.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\lrGRgDr.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\qfHUgVL.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\wBGQaLu.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\ZneiipQ.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\qHlboYQ.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\fiWRWCP.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\bmQXnVO.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\WXFoXvU.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\qnSrPCH.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\VokAjsi.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\LLtvHdv.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\WucXkvM.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\tVTAodZ.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\PJFeEcN.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\PSCpsQc.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\xxIJBNk.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\KLjvxIi.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\KQGTTpu.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\lRVtpol.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\IXCQyZE.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\acudKSv.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\TQczoZm.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\MuximME.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\CLcGtMm.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\FrrfcUN.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\ZxDvOLU.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\lAYVmAv.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\SLiBLfX.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\PblcknB.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\KtZBINn.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\hfCEwQh.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\UqNZTTU.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\HAiZsyV.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\gDAIVyh.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\BzFYuwz.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\AjOBDNn.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\kGeAvfL.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\AxgwvUI.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\orMIhsw.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\sJBxItP.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\hFcicLE.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\dpmjiMW.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\fAcHbwg.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\lCImppe.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe
File created	C:\Windows\System\TGJTLZn.exe	4fe302233b57c1c6df8cbe3910dbbb40N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2780	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
Token: SeLockMemoryPrivilege	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe
Token: SeDebugPrivilege	2780	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 2780	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	31
PID 2712 wrote to memory of 2780	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	31
PID 2712 wrote to memory of 2780	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	31
PID 2712 wrote to memory of 1512	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	32
PID 2712 wrote to memory of 1512	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	32
PID 2712 wrote to memory of 1512	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	32
PID 2712 wrote to memory of 2912	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	33
PID 2712 wrote to memory of 2912	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	33
PID 2712 wrote to memory of 2912	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	33
PID 2712 wrote to memory of 2756	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	34
PID 2712 wrote to memory of 2756	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	34
PID 2712 wrote to memory of 2756	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	34
PID 2712 wrote to memory of 2576	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	35
PID 2712 wrote to memory of 2576	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	35
PID 2712 wrote to memory of 2576	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	35
PID 2712 wrote to memory of 1256	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	36
PID 2712 wrote to memory of 1256	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	36
PID 2712 wrote to memory of 1256	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	36
PID 2712 wrote to memory of 600	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	37
PID 2712 wrote to memory of 600	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	37
PID 2712 wrote to memory of 600	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	37
PID 2712 wrote to memory of 2348	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	38
PID 2712 wrote to memory of 2348	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	38
PID 2712 wrote to memory of 2348	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	38
PID 2712 wrote to memory of 1464	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	39
PID 2712 wrote to memory of 1464	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	39
PID 2712 wrote to memory of 1464	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	39
PID 2712 wrote to memory of 1444	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	40
PID 2712 wrote to memory of 1444	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	40
PID 2712 wrote to memory of 1444	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	40
PID 2712 wrote to memory of 2908	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	41
PID 2712 wrote to memory of 2908	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	41
PID 2712 wrote to memory of 2908	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	41
PID 2712 wrote to memory of 288	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	42
PID 2712 wrote to memory of 288	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	42
PID 2712 wrote to memory of 288	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	42
PID 2712 wrote to memory of 1992	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	43
PID 2712 wrote to memory of 1992	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	43
PID 2712 wrote to memory of 1992	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	43
PID 2712 wrote to memory of 1664	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	44
PID 2712 wrote to memory of 1664	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	44
PID 2712 wrote to memory of 1664	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	44
PID 2712 wrote to memory of 3004	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	45
PID 2712 wrote to memory of 3004	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	45
PID 2712 wrote to memory of 3004	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	45
PID 2712 wrote to memory of 864	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	46
PID 2712 wrote to memory of 864	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	46
PID 2712 wrote to memory of 864	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	46
PID 2712 wrote to memory of 1924	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	47
PID 2712 wrote to memory of 1924	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	47
PID 2712 wrote to memory of 1924	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	47
PID 2712 wrote to memory of 1844	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	48
PID 2712 wrote to memory of 1844	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	48
PID 2712 wrote to memory of 1844	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	48
PID 2712 wrote to memory of 1956	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	49
PID 2712 wrote to memory of 1956	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	49
PID 2712 wrote to memory of 1956	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	49
PID 2712 wrote to memory of 1936	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	50
PID 2712 wrote to memory of 1936	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	50
PID 2712 wrote to memory of 1936	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	50
PID 2712 wrote to memory of 1544	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	51
PID 2712 wrote to memory of 1544	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	51
PID 2712 wrote to memory of 1544	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	51
PID 2712 wrote to memory of 2980	2712	4fe302233b57c1c6df8cbe3910dbbb40N.exe	52

C:\Users\Admin\AppData\Local\Temp\4fe302233b57c1c6df8cbe3910dbbb40N.exe
"C:\Users\Admin\AppData\Local\Temp\4fe302233b57c1c6df8cbe3910dbbb40N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2780
- C:\Windows\System\YsmbFNB.exe
  C:\Windows\System\YsmbFNB.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\uaTCsKN.exe
  C:\Windows\System\uaTCsKN.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\LvgQdBm.exe
  C:\Windows\System\LvgQdBm.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\mFFmJKo.exe
  C:\Windows\System\mFFmJKo.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\KBBloiu.exe
  C:\Windows\System\KBBloiu.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\rwddkXf.exe
  C:\Windows\System\rwddkXf.exe
  2⤵
  - Executes dropped EXE
  PID:600
- C:\Windows\System\RkZAFjq.exe
  C:\Windows\System\RkZAFjq.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\wYxWsUD.exe
  C:\Windows\System\wYxWsUD.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\kNhLEGz.exe
  C:\Windows\System\kNhLEGz.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\xrNZJOy.exe
  C:\Windows\System\xrNZJOy.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\hMtOpoT.exe
  C:\Windows\System\hMtOpoT.exe
  2⤵
  - Executes dropped EXE
  PID:288
- C:\Windows\System\oPLIrgs.exe
  C:\Windows\System\oPLIrgs.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\bKNkYSm.exe
  C:\Windows\System\bKNkYSm.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\rULKmzN.exe
  C:\Windows\System\rULKmzN.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\DJHRiSz.exe
  C:\Windows\System\DJHRiSz.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\dsEhdiF.exe
  C:\Windows\System\dsEhdiF.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\BdKXkjt.exe
  C:\Windows\System\BdKXkjt.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\RREdytw.exe
  C:\Windows\System\RREdytw.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\gTMZtTP.exe
  C:\Windows\System\gTMZtTP.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\KtZNjeN.exe
  C:\Windows\System\KtZNjeN.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\DufOunF.exe
  C:\Windows\System\DufOunF.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\AxUgqJG.exe
  C:\Windows\System\AxUgqJG.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\AfMzyVP.exe
  C:\Windows\System\AfMzyVP.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\MidNCAu.exe
  C:\Windows\System\MidNCAu.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\bQSntcA.exe
  C:\Windows\System\bQSntcA.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\XaiMDHy.exe
  C:\Windows\System\XaiMDHy.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\UnhnyPW.exe
  C:\Windows\System\UnhnyPW.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\jjuavAN.exe
  C:\Windows\System\jjuavAN.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\BBEacOE.exe
  C:\Windows\System\BBEacOE.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\obiEAOM.exe
  C:\Windows\System\obiEAOM.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\UslcWxT.exe
  C:\Windows\System\UslcWxT.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\mrRYoni.exe
  C:\Windows\System\mrRYoni.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\MONkBGM.exe
  C:\Windows\System\MONkBGM.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\mMUkskJ.exe
  C:\Windows\System\mMUkskJ.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\gdqcMsg.exe
  C:\Windows\System\gdqcMsg.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\hCvTzeI.exe
  C:\Windows\System\hCvTzeI.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\qcSBtJN.exe
  C:\Windows\System\qcSBtJN.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\cXxDNar.exe
  C:\Windows\System\cXxDNar.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\FKvdtkl.exe
  C:\Windows\System\FKvdtkl.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\UZfHNLT.exe
  C:\Windows\System\UZfHNLT.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\rSHwYpx.exe
  C:\Windows\System\rSHwYpx.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\WXYgymJ.exe
  C:\Windows\System\WXYgymJ.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\gRUbpsa.exe
  C:\Windows\System\gRUbpsa.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\DVjlrGx.exe
  C:\Windows\System\DVjlrGx.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\fFPBBWx.exe
  C:\Windows\System\fFPBBWx.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\HPumfCf.exe
  C:\Windows\System\HPumfCf.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\EwKZdGi.exe
  C:\Windows\System\EwKZdGi.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\nmcgIbA.exe
  C:\Windows\System\nmcgIbA.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\PkbHhrr.exe
  C:\Windows\System\PkbHhrr.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\GWojUIg.exe
  C:\Windows\System\GWojUIg.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\sRWKuNS.exe
  C:\Windows\System\sRWKuNS.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\YouyohV.exe
  C:\Windows\System\YouyohV.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\chPqUQQ.exe
  C:\Windows\System\chPqUQQ.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\oYGhYcZ.exe
  C:\Windows\System\oYGhYcZ.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\yIAaMPh.exe
  C:\Windows\System\yIAaMPh.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\NjGarNi.exe
  C:\Windows\System\NjGarNi.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\DzxpmHT.exe
  C:\Windows\System\DzxpmHT.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\AFnToxT.exe
  C:\Windows\System\AFnToxT.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\HsCQSlg.exe
  C:\Windows\System\HsCQSlg.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\OHeAqOP.exe
  C:\Windows\System\OHeAqOP.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\PnkXibL.exe
  C:\Windows\System\PnkXibL.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\WRTSrKZ.exe
  C:\Windows\System\WRTSrKZ.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\YwXfDRR.exe
  C:\Windows\System\YwXfDRR.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\tezgDfk.exe
  C:\Windows\System\tezgDfk.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\ObMItaB.exe
  C:\Windows\System\ObMItaB.exe
  2⤵
  PID:1356
- C:\Windows\System\CyUSwdC.exe
  C:\Windows\System\CyUSwdC.exe
  2⤵
  PID:2652
- C:\Windows\System\diLQybf.exe
  C:\Windows\System\diLQybf.exe
  2⤵
  PID:1660
- C:\Windows\System\JuNbZsP.exe
  C:\Windows\System\JuNbZsP.exe
  2⤵
  PID:1524
- C:\Windows\System\SNyEpWM.exe
  C:\Windows\System\SNyEpWM.exe
  2⤵
  PID:2176
- C:\Windows\System\rMdkKJq.exe
  C:\Windows\System\rMdkKJq.exe
  2⤵
  PID:1716
- C:\Windows\System\llYgpfZ.exe
  C:\Windows\System\llYgpfZ.exe
  2⤵
  PID:2160
- C:\Windows\System\uTpCuwS.exe
  C:\Windows\System\uTpCuwS.exe
  2⤵
  PID:1952
- C:\Windows\System\pDnjCkq.exe
  C:\Windows\System\pDnjCkq.exe
  2⤵
  PID:1200
- C:\Windows\System\EnXlavC.exe
  C:\Windows\System\EnXlavC.exe
  2⤵
  PID:2924
- C:\Windows\System\JBNHzrO.exe
  C:\Windows\System\JBNHzrO.exe
  2⤵
  PID:2832
- C:\Windows\System\ixbeVnE.exe
  C:\Windows\System\ixbeVnE.exe
  2⤵
  PID:2212
- C:\Windows\System\PTzKJxV.exe
  C:\Windows\System\PTzKJxV.exe
  2⤵
  PID:596
- C:\Windows\System\VaZPKil.exe
  C:\Windows\System\VaZPKil.exe
  2⤵
  PID:1944
- C:\Windows\System\djETysF.exe
  C:\Windows\System\djETysF.exe
  2⤵
  PID:2288
- C:\Windows\System\KUfIiZB.exe
  C:\Windows\System\KUfIiZB.exe
  2⤵
  PID:1448
- C:\Windows\System\KIRJQZh.exe
  C:\Windows\System\KIRJQZh.exe
  2⤵
  PID:1880
- C:\Windows\System\aFofmMr.exe
  C:\Windows\System\aFofmMr.exe
  2⤵
  PID:2792
- C:\Windows\System\ywVpAYc.exe
  C:\Windows\System\ywVpAYc.exe
  2⤵
  PID:336
- C:\Windows\System\akotGyi.exe
  C:\Windows\System\akotGyi.exe
  2⤵
  PID:2984
- C:\Windows\System\esutaqo.exe
  C:\Windows\System\esutaqo.exe
  2⤵
  PID:2988
- C:\Windows\System\gkRAFkd.exe
  C:\Windows\System\gkRAFkd.exe
  2⤵
  PID:940
- C:\Windows\System\olRZEqa.exe
  C:\Windows\System\olRZEqa.exe
  2⤵
  PID:1752
- C:\Windows\System\TGJTLZn.exe
  C:\Windows\System\TGJTLZn.exe
  2⤵
  PID:1884
- C:\Windows\System\gjuBxAL.exe
  C:\Windows\System\gjuBxAL.exe
  2⤵
  PID:1804
- C:\Windows\System\UfRdGmN.exe
  C:\Windows\System\UfRdGmN.exe
  2⤵
  PID:1672
- C:\Windows\System\DZGOtQY.exe
  C:\Windows\System\DZGOtQY.exe
  2⤵
  PID:2796
- C:\Windows\System\UpoircK.exe
  C:\Windows\System\UpoircK.exe
  2⤵
  PID:2332
- C:\Windows\System\nGtWcWh.exe
  C:\Windows\System\nGtWcWh.exe
  2⤵
  PID:2064
- C:\Windows\System\qhPPqlQ.exe
  C:\Windows\System\qhPPqlQ.exe
  2⤵
  PID:2500
- C:\Windows\System\heIOcAh.exe
  C:\Windows\System\heIOcAh.exe
  2⤵
  PID:2336
- C:\Windows\System\wqygIFX.exe
  C:\Windows\System\wqygIFX.exe
  2⤵
  PID:3032
- C:\Windows\System\CXjEJpi.exe
  C:\Windows\System\CXjEJpi.exe
  2⤵
  PID:1316
- C:\Windows\System\vuyUeVo.exe
  C:\Windows\System\vuyUeVo.exe
  2⤵
  PID:2888
- C:\Windows\System\fejVXKv.exe
  C:\Windows\System\fejVXKv.exe
  2⤵
  PID:2644
- C:\Windows\System\HxrojJR.exe
  C:\Windows\System\HxrojJR.exe
  2⤵
  PID:276
- C:\Windows\System\MAHCmOT.exe
  C:\Windows\System\MAHCmOT.exe
  2⤵
  PID:2620
- C:\Windows\System\UYxmYbc.exe
  C:\Windows\System\UYxmYbc.exe
  2⤵
  PID:2068
- C:\Windows\System\PPILXku.exe
  C:\Windows\System\PPILXku.exe
  2⤵
  PID:2156
- C:\Windows\System\qbgUEPs.exe
  C:\Windows\System\qbgUEPs.exe
  2⤵
  PID:1076
- C:\Windows\System\erMSZzm.exe
  C:\Windows\System\erMSZzm.exe
  2⤵
  PID:2464
- C:\Windows\System\LIhnjxV.exe
  C:\Windows\System\LIhnjxV.exe
  2⤵
  PID:2384
- C:\Windows\System\HnMbLtF.exe
  C:\Windows\System\HnMbLtF.exe
  2⤵
  PID:2460
- C:\Windows\System\KOZdffo.exe
  C:\Windows\System\KOZdffo.exe
  2⤵
  PID:304
- C:\Windows\System\MsRYHAG.exe
  C:\Windows\System\MsRYHAG.exe
  2⤵
  PID:2004
- C:\Windows\System\DQeBuBy.exe
  C:\Windows\System\DQeBuBy.exe
  2⤵
  PID:2412
- C:\Windows\System\RUgSxfh.exe
  C:\Windows\System\RUgSxfh.exe
  2⤵
  PID:1120
- C:\Windows\System\LzyGozL.exe
  C:\Windows\System\LzyGozL.exe
  2⤵
  PID:2228
- C:\Windows\System\slaYqjI.exe
  C:\Windows\System\slaYqjI.exe
  2⤵
  PID:2320
- C:\Windows\System\hxhdpex.exe
  C:\Windows\System\hxhdpex.exe
  2⤵
  PID:1632
- C:\Windows\System\zkkeyxp.exe
  C:\Windows\System\zkkeyxp.exe
  2⤵
  PID:2164
- C:\Windows\System\PUBKMbj.exe
  C:\Windows\System\PUBKMbj.exe
  2⤵
  PID:2448
- C:\Windows\System\iQiUsNf.exe
  C:\Windows\System\iQiUsNf.exe
  2⤵
  PID:2420
- C:\Windows\System\LFiBVxu.exe
  C:\Windows\System\LFiBVxu.exe
  2⤵
  PID:804
- C:\Windows\System\EKvmNgn.exe
  C:\Windows\System\EKvmNgn.exe
  2⤵
  PID:1060
- C:\Windows\System\pdrputN.exe
  C:\Windows\System\pdrputN.exe
  2⤵
  PID:1616
- C:\Windows\System\WpPcoup.exe
  C:\Windows\System\WpPcoup.exe
  2⤵
  PID:1784
- C:\Windows\System\PjATVRK.exe
  C:\Windows\System\PjATVRK.exe
  2⤵
  PID:2208
- C:\Windows\System\EDOexTy.exe
  C:\Windows\System\EDOexTy.exe
  2⤵
  PID:2880
- C:\Windows\System\ZEOJdTH.exe
  C:\Windows\System\ZEOJdTH.exe
  2⤵
  PID:3048
- C:\Windows\System\JaSgQiu.exe
  C:\Windows\System\JaSgQiu.exe
  2⤵
  PID:1128
- C:\Windows\System\iTCnMax.exe
  C:\Windows\System\iTCnMax.exe
  2⤵
  PID:1520
- C:\Windows\System\THexZhv.exe
  C:\Windows\System\THexZhv.exe
  2⤵
  PID:2108
- C:\Windows\System\GZcvCGl.exe
  C:\Windows\System\GZcvCGl.exe
  2⤵
  PID:1896
- C:\Windows\System\kRqsJsU.exe
  C:\Windows\System\kRqsJsU.exe
  2⤵
  PID:2096
- C:\Windows\System\IGiTXFD.exe
  C:\Windows\System\IGiTXFD.exe
  2⤵
  PID:2560
- C:\Windows\System\VCllucY.exe
  C:\Windows\System\VCllucY.exe
  2⤵
  PID:1916
- C:\Windows\System\nadISmZ.exe
  C:\Windows\System\nadISmZ.exe
  2⤵
  PID:860
- C:\Windows\System\CJNoBgC.exe
  C:\Windows\System\CJNoBgC.exe
  2⤵
  PID:2852
- C:\Windows\System\bTQfOcg.exe
  C:\Windows\System\bTQfOcg.exe
  2⤵
  PID:2692
- C:\Windows\System\RKHoKLR.exe
  C:\Windows\System\RKHoKLR.exe
  2⤵
  PID:2232
- C:\Windows\System\ZkgFLDq.exe
  C:\Windows\System\ZkgFLDq.exe
  2⤵
  PID:2084
- C:\Windows\System\qLhGAPy.exe
  C:\Windows\System\qLhGAPy.exe
  2⤵
  PID:1856
- C:\Windows\System\UgLyzLe.exe
  C:\Windows\System\UgLyzLe.exe
  2⤵
  PID:2028
- C:\Windows\System\TzoBxBt.exe
  C:\Windows\System\TzoBxBt.exe
  2⤵
  PID:2496
- C:\Windows\System\itHrQsC.exe
  C:\Windows\System\itHrQsC.exe
  2⤵
  PID:732
- C:\Windows\System\pNqyxbI.exe
  C:\Windows\System\pNqyxbI.exe
  2⤵
  PID:2120
- C:\Windows\System\DyUsHhn.exe
  C:\Windows\System\DyUsHhn.exe
  2⤵
  PID:1796
- C:\Windows\System\BIiwbTZ.exe
  C:\Windows\System\BIiwbTZ.exe
  2⤵
  PID:2124
- C:\Windows\System\pxRlqSs.exe
  C:\Windows\System\pxRlqSs.exe
  2⤵
  PID:900
- C:\Windows\System\uykKKjM.exe
  C:\Windows\System\uykKKjM.exe
  2⤵
  PID:3016
- C:\Windows\System\ZNCiUCi.exe
  C:\Windows\System\ZNCiUCi.exe
  2⤵
  PID:740
- C:\Windows\System\pJAJmgJ.exe
  C:\Windows\System\pJAJmgJ.exe
  2⤵
  PID:2008
- C:\Windows\System\VNosPKR.exe
  C:\Windows\System\VNosPKR.exe
  2⤵
  PID:580
- C:\Windows\System\TkQJlcf.exe
  C:\Windows\System\TkQJlcf.exe
  2⤵
  PID:2144
- C:\Windows\System\qiJkmPa.exe
  C:\Windows\System\qiJkmPa.exe
  2⤵
  PID:2896
- C:\Windows\System\DWbzzjv.exe
  C:\Windows\System\DWbzzjv.exe
  2⤵
  PID:2016
- C:\Windows\System\cvDDIAk.exe
  C:\Windows\System\cvDDIAk.exe
  2⤵
  PID:2848
- C:\Windows\System\gpHeubM.exe
  C:\Windows\System\gpHeubM.exe
  2⤵
  PID:568
- C:\Windows\System\miVNLfU.exe
  C:\Windows\System\miVNLfU.exe
  2⤵
  PID:2904
- C:\Windows\System\bMSvoLe.exe
  C:\Windows\System\bMSvoLe.exe
  2⤵
  PID:760
- C:\Windows\System\FKedwGF.exe
  C:\Windows\System\FKedwGF.exe
  2⤵
  PID:1736
- C:\Windows\System\tMsQggW.exe
  C:\Windows\System\tMsQggW.exe
  2⤵
  PID:2484
- C:\Windows\System\HScSBxP.exe
  C:\Windows\System\HScSBxP.exe
  2⤵
  PID:2344
- C:\Windows\System\QjPwiXg.exe
  C:\Windows\System\QjPwiXg.exe
  2⤵
  PID:2720
- C:\Windows\System\fiWRWCP.exe
  C:\Windows\System\fiWRWCP.exe
  2⤵
  PID:1536
- C:\Windows\System\nKtUVSS.exe
  C:\Windows\System\nKtUVSS.exe
  2⤵
  PID:2000
- C:\Windows\System\dpBfehX.exe
  C:\Windows\System\dpBfehX.exe
  2⤵
  PID:1876
- C:\Windows\System\zMaDRii.exe
  C:\Windows\System\zMaDRii.exe
  2⤵
  PID:1384
- C:\Windows\System\wGQwVer.exe
  C:\Windows\System\wGQwVer.exe
  2⤵
  PID:3116
- C:\Windows\System\IhRFORF.exe
  C:\Windows\System\IhRFORF.exe
  2⤵
  PID:3132
- C:\Windows\System\HcgggxH.exe
  C:\Windows\System\HcgggxH.exe
  2⤵
  PID:3148
- C:\Windows\System\QCiJTsi.exe
  C:\Windows\System\QCiJTsi.exe
  2⤵
  PID:3164
- C:\Windows\System\CSAPPpa.exe
  C:\Windows\System\CSAPPpa.exe
  2⤵
  PID:3180
- C:\Windows\System\QbIvGWe.exe
  C:\Windows\System\QbIvGWe.exe
  2⤵
  PID:3196
- C:\Windows\System\GFEmnCl.exe
  C:\Windows\System\GFEmnCl.exe
  2⤵
  PID:3212
- C:\Windows\System\TBWYMwh.exe
  C:\Windows\System\TBWYMwh.exe
  2⤵
  PID:3228
- C:\Windows\System\UxPEdHu.exe
  C:\Windows\System\UxPEdHu.exe
  2⤵
  PID:3244
- C:\Windows\System\ykuJZeH.exe
  C:\Windows\System\ykuJZeH.exe
  2⤵
  PID:3260
- C:\Windows\System\GDTQpgw.exe
  C:\Windows\System\GDTQpgw.exe
  2⤵
  PID:3280
- C:\Windows\System\ReCHXgi.exe
  C:\Windows\System\ReCHXgi.exe
  2⤵
  PID:3296
- C:\Windows\System\xkzWcOH.exe
  C:\Windows\System\xkzWcOH.exe
  2⤵
  PID:3312
- C:\Windows\System\EUNVUTk.exe
  C:\Windows\System\EUNVUTk.exe
  2⤵
  PID:3328
- C:\Windows\System\cnwRJnv.exe
  C:\Windows\System\cnwRJnv.exe
  2⤵
  PID:3344
- C:\Windows\System\mQVPmVc.exe
  C:\Windows\System\mQVPmVc.exe
  2⤵
  PID:3360
- C:\Windows\System\WnoVBKT.exe
  C:\Windows\System\WnoVBKT.exe
  2⤵
  PID:3376
- C:\Windows\System\SYTYaEO.exe
  C:\Windows\System\SYTYaEO.exe
  2⤵
  PID:3396
- C:\Windows\System\xZjdaeA.exe
  C:\Windows\System\xZjdaeA.exe
  2⤵
  PID:3412
- C:\Windows\System\BqXNSeH.exe
  C:\Windows\System\BqXNSeH.exe
  2⤵
  PID:3428
- C:\Windows\System\KcGpBgw.exe
  C:\Windows\System\KcGpBgw.exe
  2⤵
  PID:3444
- C:\Windows\System\cutDASh.exe
  C:\Windows\System\cutDASh.exe
  2⤵
  PID:3460
- C:\Windows\System\wCwxCkt.exe
  C:\Windows\System\wCwxCkt.exe
  2⤵
  PID:3476
- C:\Windows\System\SiBNTQJ.exe
  C:\Windows\System\SiBNTQJ.exe
  2⤵
  PID:3492
- C:\Windows\System\rbCGtJt.exe
  C:\Windows\System\rbCGtJt.exe
  2⤵
  PID:3508
- C:\Windows\System\sCqGOUe.exe
  C:\Windows\System\sCqGOUe.exe
  2⤵
  PID:3524
- C:\Windows\System\FzxwlPH.exe
  C:\Windows\System\FzxwlPH.exe
  2⤵
  PID:3540
- C:\Windows\System\GhkjMro.exe
  C:\Windows\System\GhkjMro.exe
  2⤵
  PID:3560
- C:\Windows\System\UVfnllR.exe
  C:\Windows\System\UVfnllR.exe
  2⤵
  PID:3576
- C:\Windows\System\cmEouue.exe
  C:\Windows\System\cmEouue.exe
  2⤵
  PID:3592
- C:\Windows\System\nXvmVpR.exe
  C:\Windows\System\nXvmVpR.exe
  2⤵
  PID:3608
- C:\Windows\System\uyZUKMl.exe
  C:\Windows\System\uyZUKMl.exe
  2⤵
  PID:3624
- C:\Windows\System\IkugoIg.exe
  C:\Windows\System\IkugoIg.exe
  2⤵
  PID:3640
- C:\Windows\System\IODJMNY.exe
  C:\Windows\System\IODJMNY.exe
  2⤵
  PID:3656
- C:\Windows\System\uYsVmsI.exe
  C:\Windows\System\uYsVmsI.exe
  2⤵
  PID:3676
- C:\Windows\System\fAPYHnM.exe
  C:\Windows\System\fAPYHnM.exe
  2⤵
  PID:3696
- C:\Windows\System\RtYoPUV.exe
  C:\Windows\System\RtYoPUV.exe
  2⤵
  PID:3712
- C:\Windows\System\ibodkyt.exe
  C:\Windows\System\ibodkyt.exe
  2⤵
  PID:3728
- C:\Windows\System\huhYKtS.exe
  C:\Windows\System\huhYKtS.exe
  2⤵
  PID:3744
- C:\Windows\System\KFhFuZp.exe
  C:\Windows\System\KFhFuZp.exe
  2⤵
  PID:3764
- C:\Windows\System\qfHUgVL.exe
  C:\Windows\System\qfHUgVL.exe
  2⤵
  PID:3780
- C:\Windows\System\PTMsYko.exe
  C:\Windows\System\PTMsYko.exe
  2⤵
  PID:3796
- C:\Windows\System\wVXhdwc.exe
  C:\Windows\System\wVXhdwc.exe
  2⤵
  PID:3816
- C:\Windows\System\hIAYKan.exe
  C:\Windows\System\hIAYKan.exe
  2⤵
  PID:3832
- C:\Windows\System\tmooaag.exe
  C:\Windows\System\tmooaag.exe
  2⤵
  PID:3852
- C:\Windows\System\lbUaohc.exe
  C:\Windows\System\lbUaohc.exe
  2⤵
  PID:3872
- C:\Windows\System\uiXWmOi.exe
  C:\Windows\System\uiXWmOi.exe
  2⤵
  PID:3888
- C:\Windows\System\FUCAzHG.exe
  C:\Windows\System\FUCAzHG.exe
  2⤵
  PID:3904
- C:\Windows\System\eJXAMPq.exe
  C:\Windows\System\eJXAMPq.exe
  2⤵
  PID:3920
- C:\Windows\System\yodHTNK.exe
  C:\Windows\System\yodHTNK.exe
  2⤵
  PID:3936
- C:\Windows\System\gTeLUzK.exe
  C:\Windows\System\gTeLUzK.exe
  2⤵
  PID:3952
- C:\Windows\System\hOgYrNq.exe
  C:\Windows\System\hOgYrNq.exe
  2⤵
  PID:3968
- C:\Windows\System\VgDYMDJ.exe
  C:\Windows\System\VgDYMDJ.exe
  2⤵
  PID:3984
- C:\Windows\System\wRzzcUb.exe
  C:\Windows\System\wRzzcUb.exe
  2⤵
  PID:4000
- C:\Windows\System\aoAmvsr.exe
  C:\Windows\System\aoAmvsr.exe
  2⤵
  PID:4016
- C:\Windows\System\QQbZZtN.exe
  C:\Windows\System\QQbZZtN.exe
  2⤵
  PID:4032
- C:\Windows\System\stUMzUG.exe
  C:\Windows\System\stUMzUG.exe
  2⤵
  PID:4048
- C:\Windows\System\FmlTMRA.exe
  C:\Windows\System\FmlTMRA.exe
  2⤵
  PID:4064
- C:\Windows\System\sNZAxiM.exe
  C:\Windows\System\sNZAxiM.exe
  2⤵
  PID:4080
- C:\Windows\System\eCCCiyO.exe
  C:\Windows\System\eCCCiyO.exe
  2⤵
  PID:2360
- C:\Windows\System\HTFoAWs.exe
  C:\Windows\System\HTFoAWs.exe
  2⤵
  PID:2116
- C:\Windows\System\HMwbXaA.exe
  C:\Windows\System\HMwbXaA.exe
  2⤵
  PID:3076
- C:\Windows\System\JAffKcP.exe
  C:\Windows\System\JAffKcP.exe
  2⤵
  PID:1048
- C:\Windows\System\sXqLOqt.exe
  C:\Windows\System\sXqLOqt.exe
  2⤵
  PID:3516
- C:\Windows\System\pegRIjc.exe
  C:\Windows\System\pegRIjc.exe
  2⤵
  PID:3552
- C:\Windows\System\UyGVovb.exe
  C:\Windows\System\UyGVovb.exe
  2⤵
  PID:3648
- C:\Windows\System\CXgClng.exe
  C:\Windows\System\CXgClng.exe
  2⤵
  PID:3724
- C:\Windows\System\ookSrJP.exe
  C:\Windows\System\ookSrJP.exe
  2⤵
  PID:3792
- C:\Windows\System\nFVgwiX.exe
  C:\Windows\System\nFVgwiX.exe
  2⤵
  PID:3932
- C:\Windows\System\qqpYsOj.exe
  C:\Windows\System\qqpYsOj.exe
  2⤵
  PID:3252
- C:\Windows\System\OrGQWdZ.exe
  C:\Windows\System\OrGQWdZ.exe
  2⤵
  PID:4024
- C:\Windows\System\AUmGtiA.exe
  C:\Windows\System\AUmGtiA.exe
  2⤵
  PID:3292
- C:\Windows\System\pXdXbwJ.exe
  C:\Windows\System\pXdXbwJ.exe
  2⤵
  PID:2036
- C:\Windows\System\RVgjaRV.exe
  C:\Windows\System\RVgjaRV.exe
  2⤵
  PID:3092
- C:\Windows\System\puYOdYT.exe
  C:\Windows\System\puYOdYT.exe
  2⤵
  PID:2264
- C:\Windows\System\QTMkuuZ.exe
  C:\Windows\System\QTMkuuZ.exe
  2⤵
  PID:3108
- C:\Windows\System\nBFPjXT.exe
  C:\Windows\System\nBFPjXT.exe
  2⤵
  PID:3144
- C:\Windows\System\biYdjgd.exe
  C:\Windows\System\biYdjgd.exe
  2⤵
  PID:3192
- C:\Windows\System\FLuasuo.exe
  C:\Windows\System\FLuasuo.exe
  2⤵
  PID:3188
- C:\Windows\System\DlbKxaf.exe
  C:\Windows\System\DlbKxaf.exe
  2⤵
  PID:3824
- C:\Windows\System\fsIQLxx.exe
  C:\Windows\System\fsIQLxx.exe
  2⤵
  PID:1488
- C:\Windows\System\PEOMoyt.exe
  C:\Windows\System\PEOMoyt.exe
  2⤵
  PID:3992
- C:\Windows\System\KvsoQdZ.exe
  C:\Windows\System\KvsoQdZ.exe
  2⤵
  PID:2808
- C:\Windows\System\kpXsxcB.exe
  C:\Windows\System\kpXsxcB.exe
  2⤵
  PID:3456
- C:\Windows\System\sDfDWls.exe
  C:\Windows\System\sDfDWls.exe
  2⤵
  PID:3204
- C:\Windows\System\pdAWkHz.exe
  C:\Windows\System\pdAWkHz.exe
  2⤵
  PID:3240
- C:\Windows\System\mVqJGqY.exe
  C:\Windows\System\mVqJGqY.exe
  2⤵
  PID:3304
- C:\Windows\System\WutrEbr.exe
  C:\Windows\System\WutrEbr.exe
  2⤵
  PID:3372
- C:\Windows\System\oOqTOzG.exe
  C:\Windows\System\oOqTOzG.exe
  2⤵
  PID:3500
- C:\Windows\System\VfkGWgZ.exe
  C:\Windows\System\VfkGWgZ.exe
  2⤵
  PID:3616
- C:\Windows\System\Aassskn.exe
  C:\Windows\System\Aassskn.exe
  2⤵
  PID:3884
- C:\Windows\System\wiTtAxq.exe
  C:\Windows\System\wiTtAxq.exe
  2⤵
  PID:3976
- C:\Windows\System\TeUhymG.exe
  C:\Windows\System\TeUhymG.exe
  2⤵
  PID:4044
- C:\Windows\System\kZfPllp.exe
  C:\Windows\System\kZfPllp.exe
  2⤵
  PID:2716
- C:\Windows\System\DsGjaHO.exe
  C:\Windows\System\DsGjaHO.exe
  2⤵
  PID:3740
- C:\Windows\System\HLLNNnf.exe
  C:\Windows\System\HLLNNnf.exe
  2⤵
  PID:3964
- C:\Windows\System\MNWYQUi.exe
  C:\Windows\System\MNWYQUi.exe
  2⤵
  PID:3340
- C:\Windows\System\Pcrdrcu.exe
  C:\Windows\System\Pcrdrcu.exe
  2⤵
  PID:3084
- C:\Windows\System\TQczoZm.exe
  C:\Windows\System\TQczoZm.exe
  2⤵
  PID:3128
- C:\Windows\System\JanbXlV.exe
  C:\Windows\System\JanbXlV.exe
  2⤵
  PID:3420
- C:\Windows\System\rePqaoY.exe
  C:\Windows\System\rePqaoY.exe
  2⤵
  PID:3176
- C:\Windows\System\FpqbRyK.exe
  C:\Windows\System\FpqbRyK.exe
  2⤵
  PID:3572
- C:\Windows\System\clyxRGm.exe
  C:\Windows\System\clyxRGm.exe
  2⤵
  PID:3668
- C:\Windows\System\BkcfNkU.exe
  C:\Windows\System\BkcfNkU.exe
  2⤵
  PID:3812
- C:\Windows\System\NIbxqyi.exe
  C:\Windows\System\NIbxqyi.exe
  2⤵
  PID:3632
- C:\Windows\System\vCzPbzP.exe
  C:\Windows\System\vCzPbzP.exe
  2⤵
  PID:1040
- C:\Windows\System\waKpwRm.exe
  C:\Windows\System\waKpwRm.exe
  2⤵
  PID:3688
- C:\Windows\System\syKlxSM.exe
  C:\Windows\System\syKlxSM.exe
  2⤵
  PID:3684
- C:\Windows\System\nciMgBk.exe
  C:\Windows\System\nciMgBk.exe
  2⤵
  PID:1868
- C:\Windows\System\gyzSEgj.exe
  C:\Windows\System\gyzSEgj.exe
  2⤵
  PID:3320
- C:\Windows\System\boZknMB.exe
  C:\Windows\System\boZknMB.exe
  2⤵
  PID:4088
- C:\Windows\System\WnpQcQL.exe
  C:\Windows\System\WnpQcQL.exe
  2⤵
  PID:3276
- C:\Windows\System\vsHfLkV.exe
  C:\Windows\System\vsHfLkV.exe
  2⤵
  PID:4012
- C:\Windows\System\pBPjUoh.exe
  C:\Windows\System\pBPjUoh.exe
  2⤵
  PID:3368
- C:\Windows\System\YXzyfEo.exe
  C:\Windows\System\YXzyfEo.exe
  2⤵
  PID:4040
- C:\Windows\System\fcKhdbk.exe
  C:\Windows\System\fcKhdbk.exe
  2⤵
  PID:3912
- C:\Windows\System\gOCTffz.exe
  C:\Windows\System\gOCTffz.exe
  2⤵
  PID:3104
- C:\Windows\System\uPAHXxo.exe
  C:\Windows\System\uPAHXxo.exe
  2⤵
  PID:3604
- C:\Windows\System\mYhAHaa.exe
  C:\Windows\System\mYhAHaa.exe
  2⤵
  PID:2076
- C:\Windows\System\mcSFeOL.exe
  C:\Windows\System\mcSFeOL.exe
  2⤵
  PID:3948
- C:\Windows\System\rXiXuvt.exe
  C:\Windows\System\rXiXuvt.exe
  2⤵
  PID:3864
- C:\Windows\System\nlArKxd.exe
  C:\Windows\System\nlArKxd.exe
  2⤵
  PID:3928
- C:\Windows\System\QUeeCQX.exe
  C:\Windows\System\QUeeCQX.exe
  2⤵
  PID:4108
- C:\Windows\System\EklHDua.exe
  C:\Windows\System\EklHDua.exe
  2⤵
  PID:4124
- C:\Windows\System\doJdCIV.exe
  C:\Windows\System\doJdCIV.exe
  2⤵
  PID:4140
- C:\Windows\System\jViaqUc.exe
  C:\Windows\System\jViaqUc.exe
  2⤵
  PID:4156
- C:\Windows\System\dsHIRVq.exe
  C:\Windows\System\dsHIRVq.exe
  2⤵
  PID:4172
- C:\Windows\System\riqAKjZ.exe
  C:\Windows\System\riqAKjZ.exe
  2⤵
  PID:4192
- C:\Windows\System\JYRUIUn.exe
  C:\Windows\System\JYRUIUn.exe
  2⤵
  PID:4208
- C:\Windows\System\aIxcuUN.exe
  C:\Windows\System\aIxcuUN.exe
  2⤵
  PID:4224
- C:\Windows\System\fcwcDer.exe
  C:\Windows\System\fcwcDer.exe
  2⤵
  PID:4240
- C:\Windows\System\fJpTBOr.exe
  C:\Windows\System\fJpTBOr.exe
  2⤵
  PID:4256
- C:\Windows\System\tttiVpl.exe
  C:\Windows\System\tttiVpl.exe
  2⤵
  PID:4276
- C:\Windows\System\qLBwzGr.exe
  C:\Windows\System\qLBwzGr.exe
  2⤵
  PID:4292
- C:\Windows\System\TeJfgUN.exe
  C:\Windows\System\TeJfgUN.exe
  2⤵
  PID:4308
- C:\Windows\System\yngDQKo.exe
  C:\Windows\System\yngDQKo.exe
  2⤵
  PID:4324
- C:\Windows\System\VnIuLuv.exe
  C:\Windows\System\VnIuLuv.exe
  2⤵
  PID:4340
- C:\Windows\System\yOFLWgK.exe
  C:\Windows\System\yOFLWgK.exe
  2⤵
  PID:4356
- C:\Windows\System\GiyQvhJ.exe
  C:\Windows\System\GiyQvhJ.exe
  2⤵
  PID:4372
- C:\Windows\System\HCCsuAq.exe
  C:\Windows\System\HCCsuAq.exe
  2⤵
  PID:4388
- C:\Windows\System\XMurxzT.exe
  C:\Windows\System\XMurxzT.exe
  2⤵
  PID:4404
- C:\Windows\System\Jewxjql.exe
  C:\Windows\System\Jewxjql.exe
  2⤵
  PID:4420
- C:\Windows\System\vHpxLES.exe
  C:\Windows\System\vHpxLES.exe
  2⤵
  PID:4436
- C:\Windows\System\UqsnDbv.exe
  C:\Windows\System\UqsnDbv.exe
  2⤵
  PID:4452
- C:\Windows\System\IILrCle.exe
  C:\Windows\System\IILrCle.exe
  2⤵
  PID:4468
- C:\Windows\System\clvjgOU.exe
  C:\Windows\System\clvjgOU.exe
  2⤵
  PID:4484
- C:\Windows\System\iQxmkAP.exe
  C:\Windows\System\iQxmkAP.exe
  2⤵
  PID:4504
- C:\Windows\System\jiiPByS.exe
  C:\Windows\System\jiiPByS.exe
  2⤵
  PID:4520
- C:\Windows\System\nzCXChf.exe
  C:\Windows\System\nzCXChf.exe
  2⤵
  PID:4536
- C:\Windows\System\FrDEqlH.exe
  C:\Windows\System\FrDEqlH.exe
  2⤵
  PID:4552
- C:\Windows\System\aBOTSuw.exe
  C:\Windows\System\aBOTSuw.exe
  2⤵
  PID:4568
- C:\Windows\System\Djghclm.exe
  C:\Windows\System\Djghclm.exe
  2⤵
  PID:4584
- C:\Windows\System\gvPcouw.exe
  C:\Windows\System\gvPcouw.exe
  2⤵
  PID:4600
- C:\Windows\System\jpYTqbJ.exe
  C:\Windows\System\jpYTqbJ.exe
  2⤵
  PID:4648
- C:\Windows\System\JHvgQql.exe
  C:\Windows\System\JHvgQql.exe
  2⤵
  PID:4668
- C:\Windows\System\hpjCprT.exe
  C:\Windows\System\hpjCprT.exe
  2⤵
  PID:4684
- C:\Windows\System\jHPRbFX.exe
  C:\Windows\System\jHPRbFX.exe
  2⤵
  PID:4700
- C:\Windows\System\rzhSQNK.exe
  C:\Windows\System\rzhSQNK.exe
  2⤵
  PID:4716
- C:\Windows\System\kbLyiLk.exe
  C:\Windows\System\kbLyiLk.exe
  2⤵
  PID:4732
- C:\Windows\System\yUDHaUw.exe
  C:\Windows\System\yUDHaUw.exe
  2⤵
  PID:4748
- C:\Windows\System\LlfQYYm.exe
  C:\Windows\System\LlfQYYm.exe
  2⤵
  PID:4764
- C:\Windows\System\HKUmMWI.exe
  C:\Windows\System\HKUmMWI.exe
  2⤵
  PID:4780
- C:\Windows\System\onIJrme.exe
  C:\Windows\System\onIJrme.exe
  2⤵
  PID:4796
- C:\Windows\System\OGLaHyY.exe
  C:\Windows\System\OGLaHyY.exe
  2⤵
  PID:4812
- C:\Windows\System\VocBtnc.exe
  C:\Windows\System\VocBtnc.exe
  2⤵
  PID:4828
- C:\Windows\System\DlFyfzA.exe
  C:\Windows\System\DlFyfzA.exe
  2⤵
  PID:4844
- C:\Windows\System\XEIOvqW.exe
  C:\Windows\System\XEIOvqW.exe
  2⤵
  PID:4860
- C:\Windows\System\agZSEiw.exe
  C:\Windows\System\agZSEiw.exe
  2⤵
  PID:4876
- C:\Windows\System\jsbuwdK.exe
  C:\Windows\System\jsbuwdK.exe
  2⤵
  PID:4892
- C:\Windows\System\oFNMoYT.exe
  C:\Windows\System\oFNMoYT.exe
  2⤵
  PID:4908
- C:\Windows\System\HeqNsaz.exe
  C:\Windows\System\HeqNsaz.exe
  2⤵
  PID:4924
- C:\Windows\System\eTQhmve.exe
  C:\Windows\System\eTQhmve.exe
  2⤵
  PID:4940
- C:\Windows\System\xbaqJuf.exe
  C:\Windows\System\xbaqJuf.exe
  2⤵
  PID:4956
- C:\Windows\System\BXXSNoE.exe
  C:\Windows\System\BXXSNoE.exe
  2⤵
  PID:4972
- C:\Windows\System\pWSsbFp.exe
  C:\Windows\System\pWSsbFp.exe
  2⤵
  PID:4988
- C:\Windows\System\tavNTHR.exe
  C:\Windows\System\tavNTHR.exe
  2⤵
  PID:5004
- C:\Windows\System\ghSRPaT.exe
  C:\Windows\System\ghSRPaT.exe
  2⤵
  PID:5020
- C:\Windows\System\FWvIQRV.exe
  C:\Windows\System\FWvIQRV.exe
  2⤵
  PID:5036
- C:\Windows\System\QVoQjFv.exe
  C:\Windows\System\QVoQjFv.exe
  2⤵
  PID:5104
- C:\Windows\System\vBICvGf.exe
  C:\Windows\System\vBICvGf.exe
  2⤵
  PID:3140
- C:\Windows\System\jMacteF.exe
  C:\Windows\System\jMacteF.exe
  2⤵
  PID:3156
- C:\Windows\System\oQFDADo.exe
  C:\Windows\System\oQFDADo.exe
  2⤵
  PID:4120
- C:\Windows\System\UcsdKcq.exe
  C:\Windows\System\UcsdKcq.exe
  2⤵
  PID:2608
- C:\Windows\System\FNAXype.exe
  C:\Windows\System\FNAXype.exe
  2⤵
  PID:3896
- C:\Windows\System\ZzphXqS.exe
  C:\Windows\System\ZzphXqS.exe
  2⤵
  PID:4288
- C:\Windows\System\BJFmbTT.exe
  C:\Windows\System\BJFmbTT.exe
  2⤵
  PID:4544
- C:\Windows\System\LYrkxOh.exe
  C:\Windows\System\LYrkxOh.exe
  2⤵
  PID:3408
- C:\Windows\System\BMsIJnI.exe
  C:\Windows\System\BMsIJnI.exe
  2⤵
  PID:3100
- C:\Windows\System\ohngutd.exe
  C:\Windows\System\ohngutd.exe
  2⤵
  PID:4100
- C:\Windows\System\NQJlKST.exe
  C:\Windows\System\NQJlKST.exe
  2⤵
  PID:4132
- C:\Windows\System\zwNznxC.exe
  C:\Windows\System\zwNznxC.exe
  2⤵
  PID:4204
- C:\Windows\System\WiXreEc.exe
  C:\Windows\System\WiXreEc.exe
  2⤵
  PID:4268
- C:\Windows\System\cVdUFeH.exe
  C:\Windows\System\cVdUFeH.exe
  2⤵
  PID:4332
- C:\Windows\System\QiannDw.exe
  C:\Windows\System\QiannDw.exe
  2⤵
  PID:4492
- C:\Windows\System\skEGXFk.exe
  C:\Windows\System\skEGXFk.exe
  2⤵
  PID:4532
- C:\Windows\System\tVTAodZ.exe
  C:\Windows\System\tVTAodZ.exe
  2⤵
  PID:4596
- C:\Windows\System\MdnqpDq.exe
  C:\Windows\System\MdnqpDq.exe
  2⤵
  PID:4692
- C:\Windows\System\yvuwQnx.exe
  C:\Windows\System\yvuwQnx.exe
  2⤵
  PID:4788
- C:\Windows\System\ZFDIaVm.exe
  C:\Windows\System\ZFDIaVm.exe
  2⤵
  PID:5048
- C:\Windows\System\eTYtLVY.exe
  C:\Windows\System\eTYtLVY.exe
  2⤵
  PID:4632
- C:\Windows\System\xaKYINr.exe
  C:\Windows\System\xaKYINr.exe
  2⤵
  PID:4680
- C:\Windows\System\TkcxFNY.exe
  C:\Windows\System\TkcxFNY.exe
  2⤵
  PID:4776
- C:\Windows\System\TOHqaOJ.exe
  C:\Windows\System\TOHqaOJ.exe
  2⤵
  PID:4708
- C:\Windows\System\EYIYTjK.exe
  C:\Windows\System\EYIYTjK.exe
  2⤵
  PID:5068
- C:\Windows\System\sKBcmum.exe
  C:\Windows\System\sKBcmum.exe
  2⤵
  PID:5084
- C:\Windows\System\OdIxlEz.exe
  C:\Windows\System\OdIxlEz.exe
  2⤵
  PID:4968
- C:\Windows\System\GbjmQVj.exe
  C:\Windows\System\GbjmQVj.exe
  2⤵
  PID:3808
- C:\Windows\System\PkyagSi.exe
  C:\Windows\System\PkyagSi.exe
  2⤵
  PID:5112
- C:\Windows\System\jPzNONk.exe
  C:\Windows\System\jPzNONk.exe
  2⤵
  PID:4116
- C:\Windows\System\jHjfYpL.exe
  C:\Windows\System\jHjfYpL.exe
  2⤵
  PID:3532
- C:\Windows\System\SjOBUbs.exe
  C:\Windows\System\SjOBUbs.exe
  2⤵
  PID:4188
- C:\Windows\System\yDuuuGE.exe
  C:\Windows\System\yDuuuGE.exe
  2⤵
  PID:1144
- C:\Windows\System\sMMEyUT.exe
  C:\Windows\System\sMMEyUT.exe
  2⤵
  PID:2456
- C:\Windows\System\sXmCJzC.exe
  C:\Windows\System\sXmCJzC.exe
  2⤵
  PID:4352
- C:\Windows\System\ipMOokf.exe
  C:\Windows\System\ipMOokf.exe
  2⤵
  PID:4412
- C:\Windows\System\owYuzWF.exe
  C:\Windows\System\owYuzWF.exe
  2⤵
  PID:4448
- C:\Windows\System\sTDgfGY.exe
  C:\Windows\System\sTDgfGY.exe
  2⤵
  PID:4516
- C:\Windows\System\NPPrJpk.exe
  C:\Windows\System\NPPrJpk.exe
  2⤵
  PID:3704
- C:\Windows\System\KLjvxIi.exe
  C:\Windows\System\KLjvxIi.exe
  2⤵
  PID:4136
- C:\Windows\System\mGeWMOG.exe
  C:\Windows\System\mGeWMOG.exe
  2⤵
  PID:3324
- C:\Windows\System\kqxurrs.exe
  C:\Windows\System\kqxurrs.exe
  2⤵
  PID:4400
- C:\Windows\System\BgowFau.exe
  C:\Windows\System\BgowFau.exe
  2⤵
  PID:4432
- C:\Windows\System\KBySSji.exe
  C:\Windows\System\KBySSji.exe
  2⤵
  PID:4760
- C:\Windows\System\zGZjHjC.exe
  C:\Windows\System\zGZjHjC.exe
  2⤵
  PID:4836
- C:\Windows\System\qDIXqMo.exe
  C:\Windows\System\qDIXqMo.exe
  2⤵
  PID:5092
- C:\Windows\System\BBoItDz.exe
  C:\Windows\System\BBoItDz.exe
  2⤵
  PID:4964
- C:\Windows\System\JMsiHcR.exe
  C:\Windows\System\JMsiHcR.exe
  2⤵
  PID:4284
- C:\Windows\System\ytHwQlN.exe
  C:\Windows\System\ytHwQlN.exe
  2⤵
  PID:4320
- C:\Windows\System\BLrueMQ.exe
  C:\Windows\System\BLrueMQ.exe
  2⤵
  PID:4444
- C:\Windows\System\sgkreQB.exe
  C:\Windows\System\sgkreQB.exe
  2⤵
  PID:4264
- C:\Windows\System\IPxKsAf.exe
  C:\Windows\System\IPxKsAf.exe
  2⤵
  PID:4528
- C:\Windows\System\glwfnic.exe
  C:\Windows\System\glwfnic.exe
  2⤵
  PID:4636
- C:\Windows\System\EOkKQXx.exe
  C:\Windows\System\EOkKQXx.exe
  2⤵
  PID:4180
- C:\Windows\System\qyRfthm.exe
  C:\Windows\System\qyRfthm.exe
  2⤵
  PID:4620
- C:\Windows\System\NJVsdDm.exe
  C:\Windows\System\NJVsdDm.exe
  2⤵
  PID:4476
- C:\Windows\System\TiKgPUv.exe
  C:\Windows\System\TiKgPUv.exe
  2⤵
  PID:4104
- C:\Windows\System\YSsuyqf.exe
  C:\Windows\System\YSsuyqf.exe
  2⤵
  PID:4900
- C:\Windows\System\WnmqHNr.exe
  C:\Windows\System\WnmqHNr.exe
  2⤵
  PID:2104
- C:\Windows\System\ZRoaqlF.exe
  C:\Windows\System\ZRoaqlF.exe
  2⤵
  PID:4728
- C:\Windows\System\kneZmam.exe
  C:\Windows\System\kneZmam.exe
  2⤵
  PID:4884
- C:\Windows\System\LdePMFi.exe
  C:\Windows\System\LdePMFi.exe
  2⤵
  PID:4656
- C:\Windows\System\DkyooGo.exe
  C:\Windows\System\DkyooGo.exe
  2⤵
  PID:4612
- C:\Windows\System\LetbMTt.exe
  C:\Windows\System\LetbMTt.exe
  2⤵
  PID:4592
- C:\Windows\System\PsSSXCp.exe
  C:\Windows\System\PsSSXCp.exe
  2⤵
  PID:5096
- C:\Windows\System\wfIiKwq.exe
  C:\Windows\System\wfIiKwq.exe
  2⤵
  PID:4644
- C:\Windows\System\RIafNll.exe
  C:\Windows\System\RIafNll.exe
  2⤵
  PID:4660
- C:\Windows\System\PJFeEcN.exe
  C:\Windows\System\PJFeEcN.exe
  2⤵
  PID:1696
- C:\Windows\System\hzwyYHt.exe
  C:\Windows\System\hzwyYHt.exe
  2⤵
  PID:4576
- C:\Windows\System\FeXrpWC.exe
  C:\Windows\System\FeXrpWC.exe
  2⤵
  PID:4200
- C:\Windows\System\ExFSgwh.exe
  C:\Windows\System\ExFSgwh.exe
  2⤵
  PID:4384
- C:\Windows\System\lEJZJAA.exe
  C:\Windows\System\lEJZJAA.exe
  2⤵
  PID:4460
- C:\Windows\System\ojMRgdg.exe
  C:\Windows\System\ojMRgdg.exe
  2⤵
  PID:4740
- C:\Windows\System\vgYQVUr.exe
  C:\Windows\System\vgYQVUr.exe
  2⤵
  PID:4664
- C:\Windows\System\vWHMscD.exe
  C:\Windows\System\vWHMscD.exe
  2⤵
  PID:3272
- C:\Windows\System\uOCsnQO.exe
  C:\Windows\System\uOCsnQO.exe
  2⤵
  PID:5188
- C:\Windows\System\DuasEuQ.exe
  C:\Windows\System\DuasEuQ.exe
  2⤵
  PID:5208
- C:\Windows\System\KQGTTpu.exe
  C:\Windows\System\KQGTTpu.exe
  2⤵
  PID:5224
- C:\Windows\System\oepVsqq.exe
  C:\Windows\System\oepVsqq.exe
  2⤵
  PID:5240
- C:\Windows\System\DOsHDxk.exe
  C:\Windows\System\DOsHDxk.exe
  2⤵
  PID:5256
- C:\Windows\System\PblcknB.exe
  C:\Windows\System\PblcknB.exe
  2⤵
  PID:5276
- C:\Windows\System\YTngQPg.exe
  C:\Windows\System\YTngQPg.exe
  2⤵
  PID:5292
- C:\Windows\System\sRrYqVZ.exe
  C:\Windows\System\sRrYqVZ.exe
  2⤵
  PID:5308
- C:\Windows\System\wZOymJK.exe
  C:\Windows\System\wZOymJK.exe
  2⤵
  PID:5324
- C:\Windows\System\qsiYUeU.exe
  C:\Windows\System\qsiYUeU.exe
  2⤵
  PID:5340
- C:\Windows\System\MoFCmkB.exe
  C:\Windows\System\MoFCmkB.exe
  2⤵
  PID:5356
- C:\Windows\System\CmJJgQq.exe
  C:\Windows\System\CmJJgQq.exe
  2⤵
  PID:5372
- C:\Windows\System\bgMrygP.exe
  C:\Windows\System\bgMrygP.exe
  2⤵
  PID:5388
- C:\Windows\System\ZxDvOLU.exe
  C:\Windows\System\ZxDvOLU.exe
  2⤵
  PID:5408
- C:\Windows\System\WOmOKLb.exe
  C:\Windows\System\WOmOKLb.exe
  2⤵
  PID:5428
- C:\Windows\System\KXXQPDr.exe
  C:\Windows\System\KXXQPDr.exe
  2⤵
  PID:5448
- C:\Windows\System\GNWshYB.exe
  C:\Windows\System\GNWshYB.exe
  2⤵
  PID:5476
- C:\Windows\System\rXHetnO.exe
  C:\Windows\System\rXHetnO.exe
  2⤵
  PID:5492
- C:\Windows\System\SQLfAOt.exe
  C:\Windows\System\SQLfAOt.exe
  2⤵
  PID:5512
- C:\Windows\System\Xhwtzjn.exe
  C:\Windows\System\Xhwtzjn.exe
  2⤵
  PID:5528
- C:\Windows\System\kpbSmHv.exe
  C:\Windows\System\kpbSmHv.exe
  2⤵
  PID:5544
- C:\Windows\System\bRzUsOp.exe
  C:\Windows\System\bRzUsOp.exe
  2⤵
  PID:5560
- C:\Windows\System\pdfnZBP.exe
  C:\Windows\System\pdfnZBP.exe
  2⤵
  PID:5576
- C:\Windows\System\rbFbVha.exe
  C:\Windows\System\rbFbVha.exe
  2⤵
  PID:5592
- C:\Windows\System\wrEudCb.exe
  C:\Windows\System\wrEudCb.exe
  2⤵
  PID:5608
- C:\Windows\System\jWPQStw.exe
  C:\Windows\System\jWPQStw.exe
  2⤵
  PID:5624
- C:\Windows\System\eZkXYLr.exe
  C:\Windows\System\eZkXYLr.exe
  2⤵
  PID:5640
- C:\Windows\System\lZXHTRI.exe
  C:\Windows\System\lZXHTRI.exe
  2⤵
  PID:5656
- C:\Windows\System\hiKaLrE.exe
  C:\Windows\System\hiKaLrE.exe
  2⤵
  PID:5672
- C:\Windows\System\pzpHnyQ.exe
  C:\Windows\System\pzpHnyQ.exe
  2⤵
  PID:5688
- C:\Windows\System\mgMBdoV.exe
  C:\Windows\System\mgMBdoV.exe
  2⤵
  PID:5704
- C:\Windows\System\GbrnPXb.exe
  C:\Windows\System\GbrnPXb.exe
  2⤵
  PID:5720
- C:\Windows\System\OdfHEkr.exe
  C:\Windows\System\OdfHEkr.exe
  2⤵
  PID:5736
- C:\Windows\System\AdFdjhj.exe
  C:\Windows\System\AdFdjhj.exe
  2⤵
  PID:5752
- C:\Windows\System\DIhedlY.exe
  C:\Windows\System\DIhedlY.exe
  2⤵
  PID:5768
- C:\Windows\System\HAiZsyV.exe
  C:\Windows\System\HAiZsyV.exe
  2⤵
  PID:5784
- C:\Windows\System\EfszwCF.exe
  C:\Windows\System\EfszwCF.exe
  2⤵
  PID:5800
- C:\Windows\System\NLHazsQ.exe
  C:\Windows\System\NLHazsQ.exe
  2⤵
  PID:5816
- C:\Windows\System\pngkrwg.exe
  C:\Windows\System\pngkrwg.exe
  2⤵
  PID:5832
- C:\Windows\System\MyDJqGd.exe
  C:\Windows\System\MyDJqGd.exe
  2⤵
  PID:5848
- C:\Windows\System\anEPYpc.exe
  C:\Windows\System\anEPYpc.exe
  2⤵
  PID:5864
- C:\Windows\System\vySlsNU.exe
  C:\Windows\System\vySlsNU.exe
  2⤵
  PID:5880
- C:\Windows\System\sbwJUXW.exe
  C:\Windows\System\sbwJUXW.exe
  2⤵
  PID:5896
- C:\Windows\System\eCjLBXu.exe
  C:\Windows\System\eCjLBXu.exe
  2⤵
  PID:5912
- C:\Windows\System\zWNvglb.exe
  C:\Windows\System\zWNvglb.exe
  2⤵
  PID:5928
- C:\Windows\System\vQdTKiZ.exe
  C:\Windows\System\vQdTKiZ.exe
  2⤵
  PID:5944
- C:\Windows\System\NqwnicE.exe
  C:\Windows\System\NqwnicE.exe
  2⤵
  PID:5960
- C:\Windows\System\GiqpeiU.exe
  C:\Windows\System\GiqpeiU.exe
  2⤵
  PID:5976
- C:\Windows\System\lRVtpol.exe
  C:\Windows\System\lRVtpol.exe
  2⤵
  PID:5992
- C:\Windows\System\hwwxcDM.exe
  C:\Windows\System\hwwxcDM.exe
  2⤵
  PID:6008
- C:\Windows\System\xnupysc.exe
  C:\Windows\System\xnupysc.exe
  2⤵
  PID:6024
- C:\Windows\System\lfaQqVU.exe
  C:\Windows\System\lfaQqVU.exe
  2⤵
  PID:6040
- C:\Windows\System\tJnIDNp.exe
  C:\Windows\System\tJnIDNp.exe
  2⤵
  PID:6056
- C:\Windows\System\Sqgyzmw.exe
  C:\Windows\System\Sqgyzmw.exe
  2⤵
  PID:6072
- C:\Windows\System\mbVVCZI.exe
  C:\Windows\System\mbVVCZI.exe
  2⤵
  PID:6088
- C:\Windows\System\pvbTfsF.exe
  C:\Windows\System\pvbTfsF.exe
  2⤵
  PID:6104
- C:\Windows\System\rulmlWt.exe
  C:\Windows\System\rulmlWt.exe
  2⤵
  PID:6124
- C:\Windows\System\PlmLycw.exe
  C:\Windows\System\PlmLycw.exe
  2⤵
  PID:5352
- C:\Windows\System\dMuNcrP.exe
  C:\Windows\System\dMuNcrP.exe
  2⤵
  PID:5416
- C:\Windows\System\BiLXfQG.exe
  C:\Windows\System\BiLXfQG.exe
  2⤵
  PID:5460
- C:\Windows\System\WaiGFom.exe
  C:\Windows\System\WaiGFom.exe
  2⤵
  PID:5160
- C:\Windows\System\DRXtYbi.exe
  C:\Windows\System\DRXtYbi.exe
  2⤵
  PID:5464
- C:\Windows\System\YLSZkHs.exe
  C:\Windows\System\YLSZkHs.exe
  2⤵
  PID:5444
- C:\Windows\System\LPuKGAe.exe
  C:\Windows\System\LPuKGAe.exe
  2⤵
  PID:5520
- C:\Windows\System\OHIHYRW.exe
  C:\Windows\System\OHIHYRW.exe
  2⤵
  PID:5400
- C:\Windows\System\JbvqyEg.exe
  C:\Windows\System\JbvqyEg.exe
  2⤵
  PID:5632
- C:\Windows\System\ffHaLZU.exe
  C:\Windows\System\ffHaLZU.exe
  2⤵
  PID:5668
- C:\Windows\System\dpaMzqV.exe
  C:\Windows\System\dpaMzqV.exe
  2⤵
  PID:5840
- C:\Windows\System\uHUPhiZ.exe
  C:\Windows\System\uHUPhiZ.exe
  2⤵
  PID:6032
- C:\Windows\System\rksglzY.exe
  C:\Windows\System\rksglzY.exe
  2⤵
  PID:5700
- C:\Windows\System\pwFnWra.exe
  C:\Windows\System\pwFnWra.exe
  2⤵
  PID:5732
- C:\Windows\System\yPcvgDT.exe
  C:\Windows\System\yPcvgDT.exe
  2⤵
  PID:5988
- C:\Windows\System\dSUyWnX.exe
  C:\Windows\System\dSUyWnX.exe
  2⤵
  PID:5956
- C:\Windows\System\YxTadWk.exe
  C:\Windows\System\YxTadWk.exe
  2⤵
  PID:6068
- C:\Windows\System\pYzPiwp.exe
  C:\Windows\System\pYzPiwp.exe
  2⤵
  PID:6112
- C:\Windows\System\CdMipOb.exe
  C:\Windows\System\CdMipOb.exe
  2⤵
  PID:6140
- C:\Windows\System\OUiovLj.exe
  C:\Windows\System\OUiovLj.exe
  2⤵
  PID:5180
- C:\Windows\System\NkJCNzL.exe
  C:\Windows\System\NkJCNzL.exe
  2⤵
  PID:5320
- C:\Windows\System\tyNaVnz.exe
  C:\Windows\System\tyNaVnz.exe
  2⤵
  PID:5348
- C:\Windows\System\SjTvHSp.exe
  C:\Windows\System\SjTvHSp.exe
  2⤵
  PID:4696
- C:\Windows\System\jiIwtKT.exe
  C:\Windows\System\jiIwtKT.exe
  2⤵
  PID:5172
- C:\Windows\System\IqCLEbe.exe
  C:\Windows\System\IqCLEbe.exe
  2⤵
  PID:5176
- C:\Windows\System\ggPhqgb.exe
  C:\Windows\System\ggPhqgb.exe
  2⤵
  PID:5424
- C:\Windows\System\VowFFnK.exe
  C:\Windows\System\VowFFnK.exe
  2⤵
  PID:5152
- C:\Windows\System\SSgAFQY.exe
  C:\Windows\System\SSgAFQY.exe
  2⤵
  PID:5396
- C:\Windows\System\zjrGQKL.exe
  C:\Windows\System\zjrGQKL.exe
  2⤵
  PID:5272
- C:\Windows\System\jbJMjZT.exe
  C:\Windows\System\jbJMjZT.exe
  2⤵
  PID:5600
- C:\Windows\System\EMAJSFR.exe
  C:\Windows\System\EMAJSFR.exe
  2⤵
  PID:5552
- C:\Windows\System\KcbBuZr.exe
  C:\Windows\System\KcbBuZr.exe
  2⤵
  PID:5536
- C:\Windows\System\LwwLnnD.exe
  C:\Windows\System\LwwLnnD.exe
  2⤵
  PID:5508
- C:\Windows\System\jqhjVXr.exe
  C:\Windows\System\jqhjVXr.exe
  2⤵
  PID:5716
- C:\Windows\System\iIGukgQ.exe
  C:\Windows\System\iIGukgQ.exe
  2⤵
  PID:5572
- C:\Windows\System\AXipDLV.exe
  C:\Windows\System\AXipDLV.exe
  2⤵
  PID:5664
- C:\Windows\System\oGdvobD.exe
  C:\Windows\System\oGdvobD.exe
  2⤵
  PID:5828
- C:\Windows\System\tDyNDsa.exe
  C:\Windows\System\tDyNDsa.exe
  2⤵
  PID:5904
- C:\Windows\System\utCdGMv.exe
  C:\Windows\System\utCdGMv.exe
  2⤵
  PID:5940
- C:\Windows\System\KNrXGhp.exe
  C:\Windows\System\KNrXGhp.exe
  2⤵
  PID:5796
- C:\Windows\System\WQYwfqZ.exe
  C:\Windows\System\WQYwfqZ.exe
  2⤵
  PID:6064
- C:\Windows\System\MoJRxbW.exe
  C:\Windows\System\MoJRxbW.exe
  2⤵
  PID:5888
- C:\Windows\System\qknXzws.exe
  C:\Windows\System\qknXzws.exe
  2⤵
  PID:5924
- C:\Windows\System\SuVjmBY.exe
  C:\Windows\System\SuVjmBY.exe
  2⤵
  PID:5288
- C:\Windows\System\XjXQqEF.exe
  C:\Windows\System\XjXQqEF.exe
  2⤵
  PID:4904
- C:\Windows\System\jPLsCrs.exe
  C:\Windows\System\jPLsCrs.exe
  2⤵
  PID:5136
- C:\Windows\System\TzGeEgW.exe
  C:\Windows\System\TzGeEgW.exe
  2⤵
  PID:5504
- C:\Windows\System\JgRyQdA.exe
  C:\Windows\System\JgRyQdA.exe
  2⤵
  PID:5436
- C:\Windows\System\AnFhUWM.exe
  C:\Windows\System\AnFhUWM.exe
  2⤵
  PID:5652
- C:\Windows\System\rPxwifW.exe
  C:\Windows\System\rPxwifW.exe
  2⤵
  PID:5168
- C:\Windows\System\GUrhcty.exe
  C:\Windows\System\GUrhcty.exe
  2⤵
  PID:5252
- C:\Windows\System\vewerYO.exe
  C:\Windows\System\vewerYO.exe
  2⤵
  PID:5792
- C:\Windows\System\KRzOyRK.exe
  C:\Windows\System\KRzOyRK.exe
  2⤵
  PID:5364
- C:\Windows\System\XKyusVo.exe
  C:\Windows\System\XKyusVo.exe
  2⤵
  PID:5584
- C:\Windows\System\NsSMGwT.exe
  C:\Windows\System\NsSMGwT.exe
  2⤵
  PID:5776
- C:\Windows\System\vpoNqFd.exe
  C:\Windows\System\vpoNqFd.exe
  2⤵
  PID:5636
- C:\Windows\System\mNEIxam.exe
  C:\Windows\System\mNEIxam.exe
  2⤵
  PID:6020
- C:\Windows\System\uBOrFEj.exe
  C:\Windows\System\uBOrFEj.exe
  2⤵
  PID:5824
- C:\Windows\System\FexewGT.exe
  C:\Windows\System\FexewGT.exe
  2⤵
  PID:5284
- C:\Windows\System\OTwiaYb.exe
  C:\Windows\System\OTwiaYb.exe
  2⤵
  PID:5648
- C:\Windows\System\rXnylvC.exe
  C:\Windows\System\rXnylvC.exe
  2⤵
  PID:5248
- C:\Windows\System\NTYrygG.exe
  C:\Windows\System\NTYrygG.exe
  2⤵
  PID:5500
- C:\Windows\System\oUkFzDH.exe
  C:\Windows\System\oUkFzDH.exe
  2⤵
  PID:5876
- C:\Windows\System\ocuvljN.exe
  C:\Windows\System\ocuvljN.exe
  2⤵
  PID:5236
- C:\Windows\System\tsyhETv.exe
  C:\Windows\System\tsyhETv.exe
  2⤵
  PID:5016
- C:\Windows\System\IohSAEf.exe
  C:\Windows\System\IohSAEf.exe
  2⤵
  PID:5316
- C:\Windows\System\aoareeo.exe
  C:\Windows\System\aoareeo.exe
  2⤵
  PID:5680
- C:\Windows\System\GWsfvMp.exe
  C:\Windows\System\GWsfvMp.exe
  2⤵
  PID:5220
- C:\Windows\System\JlvcpZO.exe
  C:\Windows\System\JlvcpZO.exe
  2⤵
  PID:6160
- C:\Windows\System\GintVrN.exe
  C:\Windows\System\GintVrN.exe
  2⤵
  PID:6176
- C:\Windows\System\LGNPGQS.exe
  C:\Windows\System\LGNPGQS.exe
  2⤵
  PID:6196
- C:\Windows\System\bmQXnVO.exe
  C:\Windows\System\bmQXnVO.exe
  2⤵
  PID:6212
- C:\Windows\System\oBDmSMg.exe
  C:\Windows\System\oBDmSMg.exe
  2⤵
  PID:6228
- C:\Windows\System\fDMQbNf.exe
  C:\Windows\System\fDMQbNf.exe
  2⤵
  PID:6244
- C:\Windows\System\HSJZhlr.exe
  C:\Windows\System\HSJZhlr.exe
  2⤵
  PID:6268
- C:\Windows\System\UDNzkLJ.exe
  C:\Windows\System\UDNzkLJ.exe
  2⤵
  PID:6284
- C:\Windows\System\rryLvbI.exe
  C:\Windows\System\rryLvbI.exe
  2⤵
  PID:6300
- C:\Windows\System\zDRcTMA.exe
  C:\Windows\System\zDRcTMA.exe
  2⤵
  PID:6320
- C:\Windows\System\XqZmoVg.exe
  C:\Windows\System\XqZmoVg.exe
  2⤵
  PID:6336
- C:\Windows\System\GfUHdEU.exe
  C:\Windows\System\GfUHdEU.exe
  2⤵
  PID:6352
- C:\Windows\System\PHttRhY.exe
  C:\Windows\System\PHttRhY.exe
  2⤵
  PID:6368
- C:\Windows\System\CXqQqMD.exe
  C:\Windows\System\CXqQqMD.exe
  2⤵
  PID:6388
- C:\Windows\System\bBZYOHx.exe
  C:\Windows\System\bBZYOHx.exe
  2⤵
  PID:6404
- C:\Windows\System\cEUUNGB.exe
  C:\Windows\System\cEUUNGB.exe
  2⤵
  PID:6420
- C:\Windows\System\vuwpSIN.exe
  C:\Windows\System\vuwpSIN.exe
  2⤵
  PID:6436
- C:\Windows\System\JLiAbRH.exe
  C:\Windows\System\JLiAbRH.exe
  2⤵
  PID:6452
- C:\Windows\System\oevWESZ.exe
  C:\Windows\System\oevWESZ.exe
  2⤵
  PID:6468
- C:\Windows\System\qZMZEKt.exe
  C:\Windows\System\qZMZEKt.exe
  2⤵
  PID:6484
- C:\Windows\System\XObnHOu.exe
  C:\Windows\System\XObnHOu.exe
  2⤵
  PID:6500
- C:\Windows\System\RCzyKew.exe
  C:\Windows\System\RCzyKew.exe
  2⤵
  PID:6516
- C:\Windows\System\bgmCSiy.exe
  C:\Windows\System\bgmCSiy.exe
  2⤵
  PID:6532
- C:\Windows\System\ihCdBmv.exe
  C:\Windows\System\ihCdBmv.exe
  2⤵
  PID:6548
- C:\Windows\System\PHTDQEs.exe
  C:\Windows\System\PHTDQEs.exe
  2⤵
  PID:6568
- C:\Windows\System\nidCknX.exe
  C:\Windows\System\nidCknX.exe
  2⤵
  PID:6584
- C:\Windows\System\NhDxIgK.exe
  C:\Windows\System\NhDxIgK.exe
  2⤵
  PID:6600
- C:\Windows\System\OnzBhUP.exe
  C:\Windows\System\OnzBhUP.exe
  2⤵
  PID:6616
- C:\Windows\System\EorNEzy.exe
  C:\Windows\System\EorNEzy.exe
  2⤵
  PID:6632
- C:\Windows\System\QppmAtW.exe
  C:\Windows\System\QppmAtW.exe
  2⤵
  PID:6648
- C:\Windows\System\RAzSlRw.exe
  C:\Windows\System\RAzSlRw.exe
  2⤵
  PID:6668
- C:\Windows\System\iLtjjvv.exe
  C:\Windows\System\iLtjjvv.exe
  2⤵
  PID:6688
- C:\Windows\System\BbAqqIM.exe
  C:\Windows\System\BbAqqIM.exe
  2⤵
  PID:6704
- C:\Windows\System\WreLVKo.exe
  C:\Windows\System\WreLVKo.exe
  2⤵
  PID:6720
- C:\Windows\System\mWNqiyd.exe
  C:\Windows\System\mWNqiyd.exe
  2⤵
  PID:6736
- C:\Windows\System\AxgwvUI.exe
  C:\Windows\System\AxgwvUI.exe
  2⤵
  PID:6752
- C:\Windows\System\mMoIJCH.exe
  C:\Windows\System\mMoIJCH.exe
  2⤵
  PID:6768
- C:\Windows\System\UqDPuNK.exe
  C:\Windows\System\UqDPuNK.exe
  2⤵
  PID:6784
- C:\Windows\System\Hldeddb.exe
  C:\Windows\System\Hldeddb.exe
  2⤵
  PID:6800
- C:\Windows\System\QfZrtIB.exe
  C:\Windows\System\QfZrtIB.exe
  2⤵
  PID:6816
- C:\Windows\System\slIdnAE.exe
  C:\Windows\System\slIdnAE.exe
  2⤵
  PID:6836
- C:\Windows\System\aoomFUM.exe
  C:\Windows\System\aoomFUM.exe
  2⤵
  PID:6852
- C:\Windows\System\euebOnx.exe
  C:\Windows\System\euebOnx.exe
  2⤵
  PID:6868
- C:\Windows\System\hGEieDV.exe
  C:\Windows\System\hGEieDV.exe
  2⤵
  PID:6884
- C:\Windows\System\JqffwnA.exe
  C:\Windows\System\JqffwnA.exe
  2⤵
  PID:6900
- C:\Windows\System\yVuvxgP.exe
  C:\Windows\System\yVuvxgP.exe
  2⤵
  PID:6916
- C:\Windows\System\jaGYihe.exe
  C:\Windows\System\jaGYihe.exe
  2⤵
  PID:6932
- C:\Windows\System\TZYkccP.exe
  C:\Windows\System\TZYkccP.exe
  2⤵
  PID:6948
- C:\Windows\System\kQydDEF.exe
  C:\Windows\System\kQydDEF.exe
  2⤵
  PID:6964
- C:\Windows\System\hDCDqVw.exe
  C:\Windows\System\hDCDqVw.exe
  2⤵
  PID:6980
- C:\Windows\System\zAyOYmg.exe
  C:\Windows\System\zAyOYmg.exe
  2⤵
  PID:6996
- C:\Windows\System\qWNgjFB.exe
  C:\Windows\System\qWNgjFB.exe
  2⤵
  PID:7016
- C:\Windows\System\hDuoJMw.exe
  C:\Windows\System\hDuoJMw.exe
  2⤵
  PID:7032
- C:\Windows\System\HEqIFFt.exe
  C:\Windows\System\HEqIFFt.exe
  2⤵
  PID:7048
- C:\Windows\System\qCCaRDv.exe
  C:\Windows\System\qCCaRDv.exe
  2⤵
  PID:7064
- C:\Windows\System\mMhXXMQ.exe
  C:\Windows\System\mMhXXMQ.exe
  2⤵
  PID:7080
- C:\Windows\System\litlEcu.exe
  C:\Windows\System\litlEcu.exe
  2⤵
  PID:7100
- C:\Windows\System\VMVaUyc.exe
  C:\Windows\System\VMVaUyc.exe
  2⤵
  PID:7120
- C:\Windows\System\CYlEIoq.exe
  C:\Windows\System\CYlEIoq.exe
  2⤵
  PID:7136
- C:\Windows\System\XjuOofB.exe
  C:\Windows\System\XjuOofB.exe
  2⤵
  PID:7152
- C:\Windows\System\FvAZUcf.exe
  C:\Windows\System\FvAZUcf.exe
  2⤵
  PID:5728
- C:\Windows\System\fjfzJmJ.exe
  C:\Windows\System\fjfzJmJ.exe
  2⤵
  PID:5132
- C:\Windows\System\hGosELa.exe
  C:\Windows\System\hGosELa.exe
  2⤵
  PID:5540
- C:\Windows\System\Kmenmof.exe
  C:\Windows\System\Kmenmof.exe
  2⤵
  PID:6052
- C:\Windows\System\nIyAfdJ.exe
  C:\Windows\System\nIyAfdJ.exe
  2⤵
  PID:6172
- C:\Windows\System\ZXWJKLW.exe
  C:\Windows\System\ZXWJKLW.exe
  2⤵
  PID:6252
- C:\Windows\System\uwMZmcZ.exe
  C:\Windows\System\uwMZmcZ.exe
  2⤵
  PID:6264
- C:\Windows\System\NtrBpDa.exe
  C:\Windows\System\NtrBpDa.exe
  2⤵
  PID:6332
- C:\Windows\System\ELpLObw.exe
  C:\Windows\System\ELpLObw.exe
  2⤵
  PID:6400
- C:\Windows\System\SnNClBY.exe
  C:\Windows\System\SnNClBY.exe
  2⤵
  PID:6236
- C:\Windows\System\SnSjvbG.exe
  C:\Windows\System\SnSjvbG.exe
  2⤵
  PID:6524
- C:\Windows\System\xlJPrtT.exe
  C:\Windows\System\xlJPrtT.exe
  2⤵
  PID:6240
- C:\Windows\System\KpliGYu.exe
  C:\Windows\System\KpliGYu.exe
  2⤵
  PID:6312
- C:\Windows\System\zCMeYxS.exe
  C:\Windows\System\zCMeYxS.exe
  2⤵
  PID:6380
- C:\Windows\System\XpvEFxq.exe
  C:\Windows\System\XpvEFxq.exe
  2⤵
  PID:6448
- C:\Windows\System\ddmOHLV.exe
  C:\Windows\System\ddmOHLV.exe
  2⤵
  PID:6508
- C:\Windows\System\zCidkng.exe
  C:\Windows\System\zCidkng.exe
  2⤵
  PID:6540
- C:\Windows\System\KkVNXds.exe
  C:\Windows\System\KkVNXds.exe
  2⤵
  PID:6660
- C:\Windows\System\dKBJlzM.exe
  C:\Windows\System\dKBJlzM.exe
  2⤵
  PID:6696
- C:\Windows\System\xKNhctl.exe
  C:\Windows\System\xKNhctl.exe
  2⤵
  PID:6732
- C:\Windows\System\tfLjjpN.exe
  C:\Windows\System\tfLjjpN.exe
  2⤵
  PID:6796
- C:\Windows\System\vQKTZaj.exe
  C:\Windows\System\vQKTZaj.exe
  2⤵
  PID:6860
- C:\Windows\System\eLHgSXs.exe
  C:\Windows\System\eLHgSXs.exe
  2⤵
  PID:6680
- C:\Windows\System\RwaIupA.exe
  C:\Windows\System\RwaIupA.exe
  2⤵
  PID:6684
- C:\Windows\System\emKgMYy.exe
  C:\Windows\System\emKgMYy.exe
  2⤵
  PID:6928
- C:\Windows\System\ZDbPfhb.exe
  C:\Windows\System\ZDbPfhb.exe
  2⤵
  PID:6988
- C:\Windows\System\SYGgTsq.exe
  C:\Windows\System\SYGgTsq.exe
  2⤵
  PID:6712
- C:\Windows\System\KbXyKcR.exe
  C:\Windows\System\KbXyKcR.exe
  2⤵
  PID:6744
- C:\Windows\System\xBYkehL.exe
  C:\Windows\System\xBYkehL.exe
  2⤵
  PID:7096
- C:\Windows\System\odnmIET.exe
  C:\Windows\System\odnmIET.exe
  2⤵
  PID:6848
- C:\Windows\System\FkqOTll.exe
  C:\Windows\System\FkqOTll.exe
  2⤵
  PID:6944
- C:\Windows\System\juiigBb.exe
  C:\Windows\System\juiigBb.exe
  2⤵
  PID:6972
- C:\Windows\System\jjoDwiV.exe
  C:\Windows\System\jjoDwiV.exe
  2⤵
  PID:7008
- C:\Windows\System\IEiIAjH.exe
  C:\Windows\System\IEiIAjH.exe
  2⤵
  PID:7160
- C:\Windows\System\stCIkWw.exe
  C:\Windows\System\stCIkWw.exe
  2⤵
  PID:7072
- C:\Windows\System\jippRQg.exe
  C:\Windows\System\jippRQg.exe
  2⤵
  PID:7116
- C:\Windows\System\OAsRlJE.exe
  C:\Windows\System\OAsRlJE.exe
  2⤵
  PID:6260
- C:\Windows\System\QQkTtqN.exe
  C:\Windows\System\QQkTtqN.exe
  2⤵
  PID:6156
- C:\Windows\System\cNELztN.exe
  C:\Windows\System\cNELztN.exe
  2⤵
  PID:6308
- C:\Windows\System\TbgKPOa.exe
  C:\Windows\System\TbgKPOa.exe
  2⤵
  PID:6152
- C:\Windows\System\uZLfGcJ.exe
  C:\Windows\System\uZLfGcJ.exe
  2⤵
  PID:6564
- C:\Windows\System\PbcBYRN.exe
  C:\Windows\System\PbcBYRN.exe
  2⤵
  PID:6432
- C:\Windows\System\xbhfuMK.exe
  C:\Windows\System\xbhfuMK.exe
  2⤵
  PID:6376
- C:\Windows\System\UmqjqND.exe
  C:\Windows\System\UmqjqND.exe
  2⤵
  PID:6480
- C:\Windows\System\UPkSFJa.exe
  C:\Windows\System\UPkSFJa.exe
  2⤵
  PID:6624
- C:\Windows\System\utYBfMI.exe
  C:\Windows\System\utYBfMI.exe
  2⤵
  PID:6892
- C:\Windows\System\jbRrSLD.exe
  C:\Windows\System\jbRrSLD.exe
  2⤵
  PID:6576
- C:\Windows\System\awdYYEG.exe
  C:\Windows\System\awdYYEG.exe
  2⤵
  PID:6876
- C:\Windows\System\sRjSStx.exe
  C:\Windows\System\sRjSStx.exe
  2⤵
  PID:7092
- C:\Windows\System\vuPOVJa.exe
  C:\Windows\System\vuPOVJa.exe
  2⤵
  PID:7128
- C:\Windows\System\msKJToW.exe
  C:\Windows\System\msKJToW.exe
  2⤵
  PID:7108
- C:\Windows\System\eKMySMf.exe
  C:\Windows\System\eKMySMf.exe
  2⤵
  PID:5420
- C:\Windows\System\SaBXqUi.exe
  C:\Windows\System\SaBXqUi.exe
  2⤵
  PID:5196
- C:\Windows\System\dhpZHHR.exe
  C:\Windows\System\dhpZHHR.exe
  2⤵
  PID:7144
- C:\Windows\System\IXCQyZE.exe
  C:\Windows\System\IXCQyZE.exe
  2⤵
  PID:6444
- C:\Windows\System\uXAojPp.exe
  C:\Windows\System\uXAojPp.exe
  2⤵
  PID:6676
- C:\Windows\System\tqHyYxS.exe
  C:\Windows\System\tqHyYxS.exe
  2⤵
  PID:6220
- C:\Windows\System\XjKkfih.exe
  C:\Windows\System\XjKkfih.exe
  2⤵
  PID:6612
- C:\Windows\System\cTtYkJr.exe
  C:\Windows\System\cTtYkJr.exe
  2⤵
  PID:7060
- C:\Windows\System\uPTHkMm.exe
  C:\Windows\System\uPTHkMm.exe
  2⤵
  PID:6656
- C:\Windows\System\hkAQICo.exe
  C:\Windows\System\hkAQICo.exe
  2⤵
  PID:6960
- C:\Windows\System\DVYSmqH.exe
  C:\Windows\System\DVYSmqH.exe
  2⤵
  PID:6896
- C:\Windows\System\MWziKpE.exe
  C:\Windows\System\MWziKpE.exe
  2⤵
  PID:6844
- C:\Windows\System\KiMmGaV.exe
  C:\Windows\System\KiMmGaV.exe
  2⤵
  PID:6496
- C:\Windows\System\uPAfPJu.exe
  C:\Windows\System\uPAfPJu.exe
  2⤵
  PID:6628
- C:\Windows\System\csSjDxB.exe
  C:\Windows\System\csSjDxB.exe
  2⤵
  PID:6792
- C:\Windows\System\hpoSBuZ.exe
  C:\Windows\System\hpoSBuZ.exe
  2⤵
  PID:6344
- C:\Windows\System\IfIPapX.exe
  C:\Windows\System\IfIPapX.exe
  2⤵
  PID:7112
- C:\Windows\System\bmyzvFx.exe
  C:\Windows\System\bmyzvFx.exe
  2⤵
  PID:7044
- C:\Windows\System\pTrEmxk.exe
  C:\Windows\System\pTrEmxk.exe
  2⤵
  PID:7056
- C:\Windows\System\MsLJwxq.exe
  C:\Windows\System\MsLJwxq.exe
  2⤵
  PID:5972
- C:\Windows\System\YMIszsr.exe
  C:\Windows\System\YMIszsr.exe
  2⤵
  PID:7180
- C:\Windows\System\lGMrxlY.exe
  C:\Windows\System\lGMrxlY.exe
  2⤵
  PID:7200
- C:\Windows\System\VFjsLTk.exe
  C:\Windows\System\VFjsLTk.exe
  2⤵
  PID:7216
- C:\Windows\System\SEWjLgN.exe
  C:\Windows\System\SEWjLgN.exe
  2⤵
  PID:7232
- C:\Windows\System\dmqPUnv.exe
  C:\Windows\System\dmqPUnv.exe
  2⤵
  PID:7248
- C:\Windows\System\kCvpbpr.exe
  C:\Windows\System\kCvpbpr.exe
  2⤵
  PID:7264
- C:\Windows\System\vdAyfAp.exe
  C:\Windows\System\vdAyfAp.exe
  2⤵
  PID:7280
- C:\Windows\System\GuESQVj.exe
  C:\Windows\System\GuESQVj.exe
  2⤵
  PID:7296
- C:\Windows\System\UrLDEhK.exe
  C:\Windows\System\UrLDEhK.exe
  2⤵
  PID:7312
- C:\Windows\System\ohpTSXJ.exe
  C:\Windows\System\ohpTSXJ.exe
  2⤵
  PID:7332
- C:\Windows\System\plshirC.exe
  C:\Windows\System\plshirC.exe
  2⤵
  PID:7348
- C:\Windows\System\sLOWYli.exe
  C:\Windows\System\sLOWYli.exe
  2⤵
  PID:7364
- C:\Windows\System\lubMpyo.exe
  C:\Windows\System\lubMpyo.exe
  2⤵
  PID:7380
- C:\Windows\System\OiZpKvj.exe
  C:\Windows\System\OiZpKvj.exe
  2⤵
  PID:7396
- C:\Windows\System\ByXYquo.exe
  C:\Windows\System\ByXYquo.exe
  2⤵
  PID:7412
- C:\Windows\System\THDiZoQ.exe
  C:\Windows\System\THDiZoQ.exe
  2⤵
  PID:7428
- C:\Windows\System\CcHZIfi.exe
  C:\Windows\System\CcHZIfi.exe
  2⤵
  PID:7444
- C:\Windows\System\CLcGtMm.exe
  C:\Windows\System\CLcGtMm.exe
  2⤵
  PID:7460
- C:\Windows\System\orMIhsw.exe
  C:\Windows\System\orMIhsw.exe
  2⤵
  PID:7476
- C:\Windows\System\vtIdiAy.exe
  C:\Windows\System\vtIdiAy.exe
  2⤵
  PID:7496
- C:\Windows\System\hsFixGs.exe
  C:\Windows\System\hsFixGs.exe
  2⤵
  PID:7512
- C:\Windows\System\TzYdUYM.exe
  C:\Windows\System\TzYdUYM.exe
  2⤵
  PID:7528
- C:\Windows\System\iNfXDUj.exe
  C:\Windows\System\iNfXDUj.exe
  2⤵
  PID:7544
- C:\Windows\System\wCeCsOy.exe
  C:\Windows\System\wCeCsOy.exe
  2⤵
  PID:7560
- C:\Windows\System\hVXCatD.exe
  C:\Windows\System\hVXCatD.exe
  2⤵
  PID:7576
- C:\Windows\System\WcsIvsZ.exe
  C:\Windows\System\WcsIvsZ.exe
  2⤵
  PID:7592
- C:\Windows\System\vkIChie.exe
  C:\Windows\System\vkIChie.exe
  2⤵
  PID:7608
- C:\Windows\System\YCzLnoY.exe
  C:\Windows\System\YCzLnoY.exe
  2⤵
  PID:7624
- C:\Windows\System\LLtvHdv.exe
  C:\Windows\System\LLtvHdv.exe
  2⤵
  PID:7640
- C:\Windows\System\qCgMhjJ.exe
  C:\Windows\System\qCgMhjJ.exe
  2⤵
  PID:7656
- C:\Windows\System\CpYgEan.exe
  C:\Windows\System\CpYgEan.exe
  2⤵
  PID:7672
- C:\Windows\System\GmTslJL.exe
  C:\Windows\System\GmTslJL.exe
  2⤵
  PID:7688
- C:\Windows\System\mxeGaeg.exe
  C:\Windows\System\mxeGaeg.exe
  2⤵
  PID:7704
- C:\Windows\System\YuwzDdo.exe
  C:\Windows\System\YuwzDdo.exe
  2⤵
  PID:7720
- C:\Windows\System\tedefEp.exe
  C:\Windows\System\tedefEp.exe
  2⤵
  PID:7736
- C:\Windows\System\IhMaGCF.exe
  C:\Windows\System\IhMaGCF.exe
  2⤵
  PID:7752
- C:\Windows\System\kNOWPZI.exe
  C:\Windows\System\kNOWPZI.exe
  2⤵
  PID:7768
- C:\Windows\System\grZecDG.exe
  C:\Windows\System\grZecDG.exe
  2⤵
  PID:7784
- C:\Windows\System\TPNCwec.exe
  C:\Windows\System\TPNCwec.exe
  2⤵
  PID:7800
- C:\Windows\System\swwfvrK.exe
  C:\Windows\System\swwfvrK.exe
  2⤵
  PID:7816
- C:\Windows\System\APwcoTQ.exe
  C:\Windows\System\APwcoTQ.exe
  2⤵
  PID:7832
- C:\Windows\System\LcgzkLJ.exe
  C:\Windows\System\LcgzkLJ.exe
  2⤵
  PID:7848
- C:\Windows\System\YRQUCnQ.exe
  C:\Windows\System\YRQUCnQ.exe
  2⤵
  PID:7864
- C:\Windows\System\iohsQRy.exe
  C:\Windows\System\iohsQRy.exe
  2⤵
  PID:7880
- C:\Windows\System\EGIDJYM.exe
  C:\Windows\System\EGIDJYM.exe
  2⤵
  PID:7900
- C:\Windows\System\TTMJxgt.exe
  C:\Windows\System\TTMJxgt.exe
  2⤵
  PID:7916
- C:\Windows\System\qDVtvUd.exe
  C:\Windows\System\qDVtvUd.exe
  2⤵
  PID:7932
- C:\Windows\System\hYLemhG.exe
  C:\Windows\System\hYLemhG.exe
  2⤵
  PID:7948
- C:\Windows\System\bFapRwu.exe
  C:\Windows\System\bFapRwu.exe
  2⤵
  PID:7964
- C:\Windows\System\qxlFjkY.exe
  C:\Windows\System\qxlFjkY.exe
  2⤵
  PID:7980
- C:\Windows\System\eQLJVIX.exe
  C:\Windows\System\eQLJVIX.exe
  2⤵
  PID:7996
- C:\Windows\System\ncCHPvz.exe
  C:\Windows\System\ncCHPvz.exe
  2⤵
  PID:8012
- C:\Windows\System\wZpbvNa.exe
  C:\Windows\System\wZpbvNa.exe
  2⤵
  PID:8028
- C:\Windows\System\YlmSKdM.exe
  C:\Windows\System\YlmSKdM.exe
  2⤵
  PID:8044
- C:\Windows\System\NfVozVN.exe
  C:\Windows\System\NfVozVN.exe
  2⤵
  PID:8060
- C:\Windows\System\gDAIVyh.exe
  C:\Windows\System\gDAIVyh.exe
  2⤵
  PID:8076
- C:\Windows\System\zuLAkbx.exe
  C:\Windows\System\zuLAkbx.exe
  2⤵
  PID:8092
- C:\Windows\System\UEzSCQJ.exe
  C:\Windows\System\UEzSCQJ.exe
  2⤵
  PID:8112
- C:\Windows\System\kUKDjAD.exe
  C:\Windows\System\kUKDjAD.exe
  2⤵
  PID:8128
- C:\Windows\System\WwGaxsf.exe
  C:\Windows\System\WwGaxsf.exe
  2⤵
  PID:8148
- C:\Windows\System\CEuCHTZ.exe
  C:\Windows\System\CEuCHTZ.exe
  2⤵
  PID:8164
- C:\Windows\System\CeexztE.exe
  C:\Windows\System\CeexztE.exe
  2⤵
  PID:8180
- C:\Windows\System\blyoJZO.exe
  C:\Windows\System\blyoJZO.exe
  2⤵
  PID:6808
- C:\Windows\System\xjLyfTF.exe
  C:\Windows\System\xjLyfTF.exe
  2⤵
  PID:7192
- C:\Windows\System\tcjBbAb.exe
  C:\Windows\System\tcjBbAb.exe
  2⤵
  PID:6328
- C:\Windows\System\zmmPAhY.exe
  C:\Windows\System\zmmPAhY.exe
  2⤵
  PID:7176
- C:\Windows\System\mCAdzxJ.exe
  C:\Windows\System\mCAdzxJ.exe
  2⤵
  PID:7240
- C:\Windows\System\UTgxbfM.exe
  C:\Windows\System\UTgxbfM.exe
  2⤵
  PID:7328
- C:\Windows\System\NibKnrB.exe
  C:\Windows\System\NibKnrB.exe
  2⤵
  PID:7304
- C:\Windows\System\JNOXEHa.exe
  C:\Windows\System\JNOXEHa.exe
  2⤵
  PID:7372
- C:\Windows\System\tePwiWL.exe
  C:\Windows\System\tePwiWL.exe
  2⤵
  PID:7424
- C:\Windows\System\JVGYLBx.exe
  C:\Windows\System\JVGYLBx.exe
  2⤵
  PID:7488
- C:\Windows\System\BWtqsGv.exe
  C:\Windows\System\BWtqsGv.exe
  2⤵
  PID:7524
- C:\Windows\System\OdyzDxp.exe
  C:\Windows\System\OdyzDxp.exe
  2⤵
  PID:7588
- C:\Windows\System\gLbtCVL.exe
  C:\Windows\System\gLbtCVL.exe
  2⤵
  PID:7408
- C:\Windows\System\QEumCRw.exe
  C:\Windows\System\QEumCRw.exe
  2⤵
  PID:7712
- C:\Windows\System\VdRkyvI.exe
  C:\Windows\System\VdRkyvI.exe
  2⤵
  PID:7748
- C:\Windows\System\XAQuqGo.exe
  C:\Windows\System\XAQuqGo.exe
  2⤵
  PID:7468
- C:\Windows\System\ZdLrFgp.exe
  C:\Windows\System\ZdLrFgp.exe
  2⤵
  PID:7604
- C:\Windows\System\LuYLlar.exe
  C:\Windows\System\LuYLlar.exe
  2⤵
  PID:7696
- C:\Windows\System\LMlYMnF.exe
  C:\Windows\System\LMlYMnF.exe
  2⤵
  PID:7664
- C:\Windows\System\ARnmBvW.exe
  C:\Windows\System\ARnmBvW.exe
  2⤵
  PID:7776
- C:\Windows\System\DdQsQgP.exe
  C:\Windows\System\DdQsQgP.exe
  2⤵
  PID:7840
- C:\Windows\System\FKYjdLC.exe
  C:\Windows\System\FKYjdLC.exe
  2⤵
  PID:7908
- C:\Windows\System\PzXysqK.exe
  C:\Windows\System\PzXysqK.exe
  2⤵
  PID:7972
- C:\Windows\System\srBhMPU.exe
  C:\Windows\System\srBhMPU.exe
  2⤵
  PID:8036
- C:\Windows\System\BxFauqw.exe
  C:\Windows\System\BxFauqw.exe
  2⤵
  PID:8100
- C:\Windows\System\KWmFNcV.exe
  C:\Windows\System\KWmFNcV.exe
  2⤵
  PID:7828
- C:\Windows\System\wZuejvn.exe
  C:\Windows\System\wZuejvn.exe
  2⤵
  PID:7856
- C:\Windows\System\KxtKtIA.exe
  C:\Windows\System\KxtKtIA.exe
  2⤵
  PID:7924
- C:\Windows\System\FoxsTiz.exe
  C:\Windows\System\FoxsTiz.exe
  2⤵
  PID:8088
- C:\Windows\System\CAKwIqR.exe
  C:\Windows\System\CAKwIqR.exe
  2⤵
  PID:7992
- C:\Windows\System\WXFoXvU.exe
  C:\Windows\System\WXFoXvU.exe
  2⤵
  PID:8120
- C:\Windows\System\xIYrayV.exe
  C:\Windows\System\xIYrayV.exe
  2⤵
  PID:7224
- C:\Windows\System\eXSbTAk.exe
  C:\Windows\System\eXSbTAk.exe
  2⤵
  PID:7288
- C:\Windows\System\SveAhBX.exe
  C:\Windows\System\SveAhBX.exe
  2⤵
  PID:7344
- C:\Windows\System\PXeAIZL.exe
  C:\Windows\System\PXeAIZL.exe
  2⤵
  PID:8160
- C:\Windows\System\vQrYPQS.exe
  C:\Windows\System\vQrYPQS.exe
  2⤵
  PID:6776
- C:\Windows\System\eArXgks.exe
  C:\Windows\System\eArXgks.exe
  2⤵
  PID:7584
- C:\Windows\System\YrduWWk.exe
  C:\Windows\System\YrduWWk.exe
  2⤵
  PID:7440
- C:\Windows\System\fGLBebM.exe
  C:\Windows\System\fGLBebM.exe
  2⤵
  PID:7356
- C:\Windows\System\DFmDQlU.exe
  C:\Windows\System\DFmDQlU.exe
  2⤵
  PID:7732
- C:\Windows\System\datMczZ.exe
  C:\Windows\System\datMczZ.exe
  2⤵
  PID:7420
- C:\Windows\System\wbAOcEA.exe
  C:\Windows\System\wbAOcEA.exe
  2⤵
  PID:7620
- C:\Windows\System\LWphoVF.exe
  C:\Windows\System\LWphoVF.exe
  2⤵
  PID:7940
- C:\Windows\System\IkEahre.exe
  C:\Windows\System\IkEahre.exe
  2⤵
  PID:7568
- C:\Windows\System\ArBudis.exe
  C:\Windows\System\ArBudis.exe
  2⤵
  PID:7844
- C:\Windows\System\foyAfVn.exe
  C:\Windows\System\foyAfVn.exe
  2⤵
  PID:8004
- C:\Windows\System\VIUldyc.exe
  C:\Windows\System\VIUldyc.exe
  2⤵
  PID:8136
- C:\Windows\System\OGnSBxz.exe
  C:\Windows\System\OGnSBxz.exe
  2⤵
  PID:7988
- C:\Windows\System\pSMCHkW.exe
  C:\Windows\System\pSMCHkW.exe
  2⤵
  PID:7796
- C:\Windows\System\MATDPZR.exe
  C:\Windows\System\MATDPZR.exe
  2⤵
  PID:8172
- C:\Windows\System\yQRMfMC.exe
  C:\Windows\System\yQRMfMC.exe
  2⤵
  PID:8188
- C:\Windows\System\MpmKomf.exe
  C:\Windows\System\MpmKomf.exe
  2⤵
  PID:7668
- C:\Windows\System\IPbxJqr.exe
  C:\Windows\System\IPbxJqr.exe
  2⤵
  PID:7648
- C:\Windows\System\zlRcazT.exe
  C:\Windows\System\zlRcazT.exe
  2⤵
  PID:7484
- C:\Windows\System\OSHnjrJ.exe
  C:\Windows\System\OSHnjrJ.exe
  2⤵
  PID:7276
- C:\Windows\System\aMtosJj.exe
  C:\Windows\System\aMtosJj.exe
  2⤵
  PID:7600
- C:\Windows\System\NmAITrg.exe
  C:\Windows\System\NmAITrg.exe
  2⤵
  PID:908
- C:\Windows\System\cOeedob.exe
  C:\Windows\System\cOeedob.exe
  2⤵
  PID:7824
- C:\Windows\System\wfBsIjZ.exe
  C:\Windows\System\wfBsIjZ.exe
  2⤵
  PID:7960
- C:\Windows\System\PhzPvVJ.exe
  C:\Windows\System\PhzPvVJ.exe
  2⤵
  PID:7744
- C:\Windows\System\YrZPjbH.exe
  C:\Windows\System\YrZPjbH.exe
  2⤵
  PID:8084
- C:\Windows\System\EkPoZlt.exe
  C:\Windows\System\EkPoZlt.exe
  2⤵
  PID:7764
- C:\Windows\System\PvYNSmx.exe
  C:\Windows\System\PvYNSmx.exe
  2⤵
  PID:7172
- C:\Windows\System\tpSUxXx.exe
  C:\Windows\System\tpSUxXx.exe
  2⤵
  PID:2128
- C:\Windows\System\dLHGvZz.exe
  C:\Windows\System\dLHGvZz.exe
  2⤵
  PID:7504
- C:\Windows\System\tRGKLyD.exe
  C:\Windows\System\tRGKLyD.exe
  2⤵
  PID:8200
- C:\Windows\System\uZQjXeE.exe
  C:\Windows\System\uZQjXeE.exe
  2⤵
  PID:8216
- C:\Windows\System\HeamNnh.exe
  C:\Windows\System\HeamNnh.exe
  2⤵
  PID:8232
- C:\Windows\System\vxNOovR.exe
  C:\Windows\System\vxNOovR.exe
  2⤵
  PID:8248
- C:\Windows\System\mOzEyhX.exe
  C:\Windows\System\mOzEyhX.exe
  2⤵
  PID:8264
- C:\Windows\System\fgUpGmZ.exe
  C:\Windows\System\fgUpGmZ.exe
  2⤵
  PID:8280
- C:\Windows\System\JnNhnZz.exe
  C:\Windows\System\JnNhnZz.exe
  2⤵
  PID:8308
- C:\Windows\System\cjHPTSm.exe
  C:\Windows\System\cjHPTSm.exe
  2⤵
  PID:8324
- C:\Windows\System\WIrVDbm.exe
  C:\Windows\System\WIrVDbm.exe
  2⤵
  PID:8340
- C:\Windows\System\DidCQFJ.exe
  C:\Windows\System\DidCQFJ.exe
  2⤵
  PID:8356
- C:\Windows\System\ZalAISy.exe
  C:\Windows\System\ZalAISy.exe
  2⤵
  PID:8372
- C:\Windows\System\dZDxTQy.exe
  C:\Windows\System\dZDxTQy.exe
  2⤵
  PID:8388
- C:\Windows\System\RCgTXFv.exe
  C:\Windows\System\RCgTXFv.exe
  2⤵
  PID:8404
- C:\Windows\System\PLrXlsH.exe
  C:\Windows\System\PLrXlsH.exe
  2⤵
  PID:8420
- C:\Windows\System\OAnDvOm.exe
  C:\Windows\System\OAnDvOm.exe
  2⤵
  PID:8440
- C:\Windows\System\GMFnEFG.exe
  C:\Windows\System\GMFnEFG.exe
  2⤵
  PID:8456
- C:\Windows\System\eXsUydM.exe
  C:\Windows\System\eXsUydM.exe
  2⤵
  PID:8472
- C:\Windows\System\eFSIXGP.exe
  C:\Windows\System\eFSIXGP.exe
  2⤵
  PID:8488
- C:\Windows\System\TLNAwoD.exe
  C:\Windows\System\TLNAwoD.exe
  2⤵
  PID:8504
- C:\Windows\System\sihcoZU.exe
  C:\Windows\System\sihcoZU.exe
  2⤵
  PID:8520
- C:\Windows\System\foiOGwi.exe
  C:\Windows\System\foiOGwi.exe
  2⤵
  PID:8540
- C:\Windows\System\xxRaAKF.exe
  C:\Windows\System\xxRaAKF.exe
  2⤵
  PID:8556
- C:\Windows\System\sJOptLR.exe
  C:\Windows\System\sJOptLR.exe
  2⤵
  PID:8576
- C:\Windows\System\hepzzvY.exe
  C:\Windows\System\hepzzvY.exe
  2⤵
  PID:8592
- C:\Windows\System\DNVJACG.exe
  C:\Windows\System\DNVJACG.exe
  2⤵
  PID:8608
- C:\Windows\System\UOLVvAf.exe
  C:\Windows\System\UOLVvAf.exe
  2⤵
  PID:8624
- C:\Windows\System\keVKebs.exe
  C:\Windows\System\keVKebs.exe
  2⤵
  PID:8644
- C:\Windows\System\GOyGOSr.exe
  C:\Windows\System\GOyGOSr.exe
  2⤵
  PID:8660
- C:\Windows\System\JGMiVCZ.exe
  C:\Windows\System\JGMiVCZ.exe
  2⤵
  PID:8676
- C:\Windows\System\ohNdkKv.exe
  C:\Windows\System\ohNdkKv.exe
  2⤵
  PID:8692
- C:\Windows\System\fsUVFiH.exe
  C:\Windows\System\fsUVFiH.exe
  2⤵
  PID:8708
- C:\Windows\System\XZKoAsm.exe
  C:\Windows\System\XZKoAsm.exe
  2⤵
  PID:8760
- C:\Windows\System\emGcJeZ.exe
  C:\Windows\System\emGcJeZ.exe
  2⤵
  PID:8776
- C:\Windows\System\luILFHp.exe
  C:\Windows\System\luILFHp.exe
  2⤵
  PID:8792
- C:\Windows\System\jPkkius.exe
  C:\Windows\System\jPkkius.exe
  2⤵
  PID:8808
- C:\Windows\System\KVMYVZZ.exe
  C:\Windows\System\KVMYVZZ.exe
  2⤵
  PID:8824
- C:\Windows\System\RWckQOn.exe
  C:\Windows\System\RWckQOn.exe
  2⤵
  PID:8840
- C:\Windows\System\pNYwSNl.exe
  C:\Windows\System\pNYwSNl.exe
  2⤵
  PID:8856
- C:\Windows\System\kynadYj.exe
  C:\Windows\System\kynadYj.exe
  2⤵
  PID:8872
- C:\Windows\System\VhrcjPt.exe
  C:\Windows\System\VhrcjPt.exe
  2⤵
  PID:8892
- C:\Windows\System\fUolnmg.exe
  C:\Windows\System\fUolnmg.exe
  2⤵
  PID:8908
- C:\Windows\System\QeZoniO.exe
  C:\Windows\System\QeZoniO.exe
  2⤵
  PID:8924
- C:\Windows\System\ilzGNFm.exe
  C:\Windows\System\ilzGNFm.exe
  2⤵
  PID:8940
- C:\Windows\System\HoXDoNt.exe
  C:\Windows\System\HoXDoNt.exe
  2⤵
  PID:8956
- C:\Windows\System\hYkKmkf.exe
  C:\Windows\System\hYkKmkf.exe
  2⤵
  PID:8972
- C:\Windows\System\BlIFCPh.exe
  C:\Windows\System\BlIFCPh.exe
  2⤵
  PID:8988
- C:\Windows\System\xwWnXne.exe
  C:\Windows\System\xwWnXne.exe
  2⤵
  PID:9004
- C:\Windows\System\YeJZlWL.exe
  C:\Windows\System\YeJZlWL.exe
  2⤵
  PID:9020
- C:\Windows\System\LfAYVyr.exe
  C:\Windows\System\LfAYVyr.exe
  2⤵
  PID:9036
- C:\Windows\System\JPndgGv.exe
  C:\Windows\System\JPndgGv.exe
  2⤵
  PID:9052
- C:\Windows\System\jSAZdzp.exe
  C:\Windows\System\jSAZdzp.exe
  2⤵
  PID:9068
- C:\Windows\System\hyYYepq.exe
  C:\Windows\System\hyYYepq.exe
  2⤵
  PID:9084
- C:\Windows\System\VALGLeM.exe
  C:\Windows\System\VALGLeM.exe
  2⤵
  PID:9104
- C:\Windows\System\nRBPUVS.exe
  C:\Windows\System\nRBPUVS.exe
  2⤵
  PID:9120
- C:\Windows\System\UGwKAVT.exe
  C:\Windows\System\UGwKAVT.exe
  2⤵
  PID:9144
- C:\Windows\System\peBqmLW.exe
  C:\Windows\System\peBqmLW.exe
  2⤵
  PID:9160
- C:\Windows\System\HxUryPr.exe
  C:\Windows\System\HxUryPr.exe
  2⤵
  PID:9176
- C:\Windows\System\DklhwxS.exe
  C:\Windows\System\DklhwxS.exe
  2⤵
  PID:9192
- C:\Windows\System\bfySwOB.exe
  C:\Windows\System\bfySwOB.exe
  2⤵
  PID:9208
- C:\Windows\System\LIMmpoJ.exe
  C:\Windows\System\LIMmpoJ.exe
  2⤵
  PID:8224
- C:\Windows\System\LJlDzQo.exe
  C:\Windows\System\LJlDzQo.exe
  2⤵
  PID:8288
- C:\Windows\System\jpSYxRn.exe
  C:\Windows\System\jpSYxRn.exe
  2⤵
  PID:8296
- C:\Windows\System\zmeeAEo.exe
  C:\Windows\System\zmeeAEo.exe
  2⤵
  PID:8396
- C:\Windows\System\FmThMyN.exe
  C:\Windows\System\FmThMyN.exe
  2⤵
  PID:8436
- C:\Windows\System\VJyKMBO.exe
  C:\Windows\System\VJyKMBO.exe
  2⤵
  PID:8528
- C:\Windows\System\BXDQebk.exe
  C:\Windows\System\BXDQebk.exe
  2⤵
  PID:8600
- C:\Windows\System\vTQWNpF.exe
  C:\Windows\System\vTQWNpF.exe
  2⤵
  PID:8632
- C:\Windows\System\HDreuvn.exe
  C:\Windows\System\HDreuvn.exe
  2⤵
  PID:8668
- C:\Windows\System\KtZBINn.exe
  C:\Windows\System\KtZBINn.exe
  2⤵
  PID:8380
- C:\Windows\System\dtBjSHH.exe
  C:\Windows\System\dtBjSHH.exe
  2⤵
  PID:912
- C:\Windows\System\QvInvJO.exe
  C:\Windows\System\QvInvJO.exe
  2⤵
  PID:8208
- C:\Windows\System\AcKMYdo.exe
  C:\Windows\System\AcKMYdo.exe
  2⤵
  PID:8104
- C:\Windows\System\fJBmNVZ.exe
  C:\Windows\System\fJBmNVZ.exe
  2⤵
  PID:8804
- C:\Windows\System\SasDqvm.exe
  C:\Windows\System\SasDqvm.exe
  2⤵
  PID:8932
- C:\Windows\System\qnSrPCH.exe
  C:\Windows\System\qnSrPCH.exe
  2⤵
  PID:8968
- C:\Windows\System\ltqAVcj.exe
  C:\Windows\System\ltqAVcj.exe
  2⤵
  PID:9032
- C:\Windows\System\cVYennV.exe
  C:\Windows\System\cVYennV.exe
  2⤵
  PID:9100
- C:\Windows\System\VfGFwvI.exe
  C:\Windows\System\VfGFwvI.exe
  2⤵
  PID:9168
- C:\Windows\System\sXPwRqu.exe
  C:\Windows\System\sXPwRqu.exe
  2⤵
  PID:8516
- C:\Windows\System\bsllKUf.exe
  C:\Windows\System\bsllKUf.exe
  2⤵
  PID:8656
- C:\Windows\System\EfBJRkX.exe
  C:\Windows\System\EfBJRkX.exe
  2⤵
  PID:7324
- C:\Windows\System\CDMtGAG.exe
  C:\Windows\System\CDMtGAG.exe
  2⤵
  PID:8276
- C:\Windows\System\LmAUSUX.exe
  C:\Windows\System\LmAUSUX.exe
  2⤵
  PID:9200
- C:\Windows\System\ViNXunw.exe
  C:\Windows\System\ViNXunw.exe
  2⤵
  PID:8256
- C:\Windows\System\bXCAbsf.exe
  C:\Windows\System\bXCAbsf.exe
  2⤵
  PID:8736
- C:\Windows\System\hhzNqWD.exe
  C:\Windows\System\hhzNqWD.exe
  2⤵
  PID:8384
- C:\Windows\System\HencjrR.exe
  C:\Windows\System\HencjrR.exe
  2⤵
  PID:8552
- C:\Windows\System\iIUFAnV.exe
  C:\Windows\System\iIUFAnV.exe
  2⤵
  PID:8688
- C:\Windows\System\jKlIYpG.exe
  C:\Windows\System\jKlIYpG.exe
  2⤵
  PID:8732
- C:\Windows\System\VomRTAw.exe
  C:\Windows\System\VomRTAw.exe
  2⤵
  PID:8752
- C:\Windows\System\LRmTiVI.exe
  C:\Windows\System\LRmTiVI.exe
  2⤵
  PID:8788
- C:\Windows\System\KTgDiCA.exe
  C:\Windows\System\KTgDiCA.exe
  2⤵
  PID:8852
- C:\Windows\System\BRXvhEO.exe
  C:\Windows\System\BRXvhEO.exe
  2⤵
  PID:8948
- C:\Windows\System\KmWuGSB.exe
  C:\Windows\System\KmWuGSB.exe
  2⤵
  PID:9044
- C:\Windows\System\IPpOEer.exe
  C:\Windows\System\IPpOEer.exe
  2⤵
  PID:9188
- C:\Windows\System\xcAatXI.exe
  C:\Windows\System\xcAatXI.exe
  2⤵
  PID:9116
- C:\Windows\System\VrGsHfC.exe
  C:\Windows\System\VrGsHfC.exe
  2⤵
  PID:8332
- C:\Windows\System\pSQwtbs.exe
  C:\Windows\System\pSQwtbs.exe
  2⤵
  PID:8496
- C:\Windows\System\sSTQELb.exe
  C:\Windows\System\sSTQELb.exe
  2⤵
  PID:8704
- C:\Windows\System\uMSsIDk.exe
  C:\Windows\System\uMSsIDk.exe
  2⤵
  PID:8832
- C:\Windows\System\HOFIGfu.exe
  C:\Windows\System\HOFIGfu.exe
  2⤵
  PID:8240
- C:\Windows\System\evFKPAQ.exe
  C:\Windows\System\evFKPAQ.exe
  2⤵
  PID:8536
- C:\Windows\System\tKcWfDF.exe
  C:\Windows\System\tKcWfDF.exe
  2⤵
  PID:8640
- C:\Windows\System\RNzSKhK.exe
  C:\Windows\System\RNzSKhK.exe
  2⤵
  PID:8176
- C:\Windows\System\VokAjsi.exe
  C:\Windows\System\VokAjsi.exe
  2⤵
  PID:9028
- C:\Windows\System\xbLkBVo.exe
  C:\Windows\System\xbLkBVo.exe
  2⤵
  PID:8212
- C:\Windows\System\hjrkcGf.exe
  C:\Windows\System\hjrkcGf.exe
  2⤵
  PID:8352
- C:\Windows\System\hrQIFhd.exe
  C:\Windows\System\hrQIFhd.exe
  2⤵
  PID:8364
- C:\Windows\System\gRFuEBM.exe
  C:\Windows\System\gRFuEBM.exe
  2⤵
  PID:8756
- C:\Windows\System\EFkiEaZ.exe
  C:\Windows\System\EFkiEaZ.exe
  2⤵
  PID:8784
- C:\Windows\System\zcRXSlr.exe
  C:\Windows\System\zcRXSlr.exe
  2⤵
  PID:7212
- C:\Windows\System\USMyjLE.exe
  C:\Windows\System\USMyjLE.exe
  2⤵
  PID:8620
- C:\Windows\System\VossAXL.exe
  C:\Windows\System\VossAXL.exe
  2⤵
  PID:9016
- C:\Windows\System\JjOYVjs.exe
  C:\Windows\System\JjOYVjs.exe
  2⤵
  PID:8848
- C:\Windows\System\sfdZRSY.exe
  C:\Windows\System\sfdZRSY.exe
  2⤵
  PID:8468
- C:\Windows\System\RbNDgNe.exe
  C:\Windows\System\RbNDgNe.exe
  2⤵
  PID:9140
- C:\Windows\System\TjyyjDU.exe
  C:\Windows\System\TjyyjDU.exe
  2⤵
  PID:8452
- C:\Windows\System\bzXGWMt.exe
  C:\Windows\System\bzXGWMt.exe
  2⤵
  PID:8652
- C:\Windows\System\BWPLURC.exe
  C:\Windows\System\BWPLURC.exe
  2⤵
  PID:9076
- C:\Windows\System\PixtsGp.exe
  C:\Windows\System\PixtsGp.exe
  2⤵
  PID:8720
- C:\Windows\System\cWurxOa.exe
  C:\Windows\System\cWurxOa.exe
  2⤵
  PID:8056
- C:\Windows\System\zOcIvCO.exe
  C:\Windows\System\zOcIvCO.exe
  2⤵
  PID:8728
- C:\Windows\System\kCPCsZJ.exe
  C:\Windows\System\kCPCsZJ.exe
  2⤵
  PID:8936
- C:\Windows\System\JksJUxW.exe
  C:\Windows\System\JksJUxW.exe
  2⤵
  PID:9152
- C:\Windows\System\gylYYuH.exe
  C:\Windows\System\gylYYuH.exe
  2⤵
  PID:9232
- C:\Windows\System\OZICylo.exe
  C:\Windows\System\OZICylo.exe
  2⤵
  PID:9248
- C:\Windows\System\zaXTcvl.exe
  C:\Windows\System\zaXTcvl.exe
  2⤵
  PID:9264
- C:\Windows\System\thYzEDH.exe
  C:\Windows\System\thYzEDH.exe
  2⤵
  PID:9288
- C:\Windows\System\DERxGgA.exe
  C:\Windows\System\DERxGgA.exe
  2⤵
  PID:9312
- C:\Windows\System\phwesvR.exe
  C:\Windows\System\phwesvR.exe
  2⤵
  PID:9328
- C:\Windows\System\hQRPZtC.exe
  C:\Windows\System\hQRPZtC.exe
  2⤵
  PID:9344
- C:\Windows\System\GrtSiaj.exe
  C:\Windows\System\GrtSiaj.exe
  2⤵
  PID:9360
- C:\Windows\System\nZBXxEa.exe
  C:\Windows\System\nZBXxEa.exe
  2⤵
  PID:9376
- C:\Windows\System\ZUyhgkc.exe
  C:\Windows\System\ZUyhgkc.exe
  2⤵
  PID:9392
- C:\Windows\System\nvbQnkD.exe
  C:\Windows\System\nvbQnkD.exe
  2⤵
  PID:9412
- C:\Windows\System\ZWfCUaX.exe
  C:\Windows\System\ZWfCUaX.exe
  2⤵
  PID:9428
- C:\Windows\System\KsbbHHW.exe
  C:\Windows\System\KsbbHHW.exe
  2⤵
  PID:9444
- C:\Windows\System\ezRzkAs.exe
  C:\Windows\System\ezRzkAs.exe
  2⤵
  PID:9464
- C:\Windows\System\rlZEehk.exe
  C:\Windows\System\rlZEehk.exe
  2⤵
  PID:9480
- C:\Windows\System\dLGHgkq.exe
  C:\Windows\System\dLGHgkq.exe
  2⤵
  PID:9496
- C:\Windows\System\IRuWHXk.exe
  C:\Windows\System\IRuWHXk.exe
  2⤵
  PID:9512
- C:\Windows\System\afobBSS.exe
  C:\Windows\System\afobBSS.exe
  2⤵
  PID:9532
- C:\Windows\System\mdeFVOp.exe
  C:\Windows\System\mdeFVOp.exe
  2⤵
  PID:9548
- C:\Windows\System\eoLgTiA.exe
  C:\Windows\System\eoLgTiA.exe
  2⤵
  PID:9564
- C:\Windows\System\tGSdkgs.exe
  C:\Windows\System\tGSdkgs.exe
  2⤵
  PID:9580
- C:\Windows\System\DlNEYMt.exe
  C:\Windows\System\DlNEYMt.exe
  2⤵
  PID:9596
- C:\Windows\System\MCKNQvc.exe
  C:\Windows\System\MCKNQvc.exe
  2⤵
  PID:9612
- C:\Windows\System\NkmKgBJ.exe
  C:\Windows\System\NkmKgBJ.exe
  2⤵
  PID:9628
- C:\Windows\System\MfFmbTz.exe
  C:\Windows\System\MfFmbTz.exe
  2⤵
  PID:9644
- C:\Windows\System\gxJUxHv.exe
  C:\Windows\System\gxJUxHv.exe
  2⤵
  PID:9660
- C:\Windows\System\paMPCEq.exe
  C:\Windows\System\paMPCEq.exe
  2⤵
  PID:9680
- C:\Windows\System\tSUNzRO.exe
  C:\Windows\System\tSUNzRO.exe
  2⤵
  PID:9824
- C:\Windows\System\LOZKlNP.exe
  C:\Windows\System\LOZKlNP.exe
  2⤵
  PID:9840
- C:\Windows\System\gqnPFux.exe
  C:\Windows\System\gqnPFux.exe
  2⤵
  PID:9856
- C:\Windows\System\DQquyFk.exe
  C:\Windows\System\DQquyFk.exe
  2⤵
  PID:9872
- C:\Windows\System\eShQHcr.exe
  C:\Windows\System\eShQHcr.exe
  2⤵
  PID:9888
- C:\Windows\System\uxxwYqa.exe
  C:\Windows\System\uxxwYqa.exe
  2⤵
  PID:9904
- C:\Windows\System\CuGeNCg.exe
  C:\Windows\System\CuGeNCg.exe
  2⤵
  PID:9924
- C:\Windows\System\BcFYBbp.exe
  C:\Windows\System\BcFYBbp.exe
  2⤵
  PID:9940
- C:\Windows\System\hohSVVO.exe
  C:\Windows\System\hohSVVO.exe
  2⤵
  PID:9956
- C:\Windows\System\PQxDSJA.exe
  C:\Windows\System\PQxDSJA.exe
  2⤵
  PID:9972
- C:\Windows\System\hLSLFSb.exe
  C:\Windows\System\hLSLFSb.exe
  2⤵
  PID:9996
- C:\Windows\System\itNrBCm.exe
  C:\Windows\System\itNrBCm.exe
  2⤵
  PID:10012
- C:\Windows\System\ECYwQZF.exe
  C:\Windows\System\ECYwQZF.exe
  2⤵
  PID:10028
- C:\Windows\System\SXAhvwO.exe
  C:\Windows\System\SXAhvwO.exe
  2⤵
  PID:10044
- C:\Windows\System\OsfIBjy.exe
  C:\Windows\System\OsfIBjy.exe
  2⤵
  PID:10060
- C:\Windows\System\hZRVDry.exe
  C:\Windows\System\hZRVDry.exe
  2⤵
  PID:10080
- C:\Windows\System\XNlRHyT.exe
  C:\Windows\System\XNlRHyT.exe
  2⤵
  PID:10096
- C:\Windows\System\uDkDZiq.exe
  C:\Windows\System\uDkDZiq.exe
  2⤵
  PID:10112
- C:\Windows\System\cIjqSzN.exe
  C:\Windows\System\cIjqSzN.exe
  2⤵
  PID:10128
- C:\Windows\System\dBJrSac.exe
  C:\Windows\System\dBJrSac.exe
  2⤵
  PID:10144
- C:\Windows\System\OBaEuhb.exe
  C:\Windows\System\OBaEuhb.exe
  2⤵
  PID:10160
- C:\Windows\System\QvMTMBB.exe
  C:\Windows\System\QvMTMBB.exe
  2⤵
  PID:10176
- C:\Windows\System\ykJeAdr.exe
  C:\Windows\System\ykJeAdr.exe
  2⤵
  PID:10192
- C:\Windows\System\BzFYuwz.exe
  C:\Windows\System\BzFYuwz.exe
  2⤵
  PID:10212
- C:\Windows\System\eTBUXmh.exe
  C:\Windows\System\eTBUXmh.exe
  2⤵
  PID:10228
- C:\Windows\System\ukpksaF.exe
  C:\Windows\System\ukpksaF.exe
  2⤵
  PID:9064
- C:\Windows\System\vEoEsbd.exe
  C:\Windows\System\vEoEsbd.exe
  2⤵
  PID:9172
- C:\Windows\System\RdkXvgP.exe
  C:\Windows\System\RdkXvgP.exe
  2⤵
  PID:9240
- C:\Windows\System\suSyHxJ.exe
  C:\Windows\System\suSyHxJ.exe
  2⤵
  PID:8336
- C:\Windows\System\nCEAbTx.exe
  C:\Windows\System\nCEAbTx.exe
  2⤵
  PID:9228
- C:\Windows\System\SPpVqgW.exe
  C:\Windows\System\SPpVqgW.exe
  2⤵
  PID:9132
- C:\Windows\System\wBGQaLu.exe
  C:\Windows\System\wBGQaLu.exe
  2⤵
  PID:9276
- C:\Windows\System\uSCOVgw.exe
  C:\Windows\System\uSCOVgw.exe
  2⤵
  PID:9388
- C:\Windows\System\pRQIgeW.exe
  C:\Windows\System\pRQIgeW.exe
  2⤵
  PID:9424
- C:\Windows\System\IwkRxiL.exe
  C:\Windows\System\IwkRxiL.exe
  2⤵
  PID:9336
- C:\Windows\System\LlxAfKd.exe
  C:\Windows\System\LlxAfKd.exe
  2⤵
  PID:9400
- C:\Windows\System\eLAvAKh.exe
  C:\Windows\System\eLAvAKh.exe
  2⤵
  PID:9508
- C:\Windows\System\VEQzJTF.exe
  C:\Windows\System\VEQzJTF.exe
  2⤵
  PID:9572
- C:\Windows\System\gMXoIla.exe
  C:\Windows\System\gMXoIla.exe
  2⤵
  PID:9452
- C:\Windows\System\jZHEdCo.exe
  C:\Windows\System\jZHEdCo.exe
  2⤵
  PID:9492
- C:\Windows\System\flQlQCB.exe
  C:\Windows\System\flQlQCB.exe
  2⤵
  PID:9560
- C:\Windows\System\xKpkKlr.exe
  C:\Windows\System\xKpkKlr.exe
  2⤵
  PID:9624
- C:\Windows\System\yHbNlZy.exe
  C:\Windows\System\yHbNlZy.exe
  2⤵
  PID:9640
- C:\Windows\System\sGLjDbT.exe
  C:\Windows\System\sGLjDbT.exe
  2⤵
  PID:9652
- C:\Windows\System\oHziaPN.exe
  C:\Windows\System\oHziaPN.exe
  2⤵
  PID:9688
- C:\Windows\System\JyTvGmy.exe
  C:\Windows\System\JyTvGmy.exe
  2⤵
  PID:9864
- C:\Windows\System\xOfzKmW.exe
  C:\Windows\System\xOfzKmW.exe
  2⤵
  PID:9900
- C:\Windows\System\soytRVe.exe
  C:\Windows\System\soytRVe.exe
  2⤵
  PID:9708
- C:\Windows\System\npGqbDu.exe
  C:\Windows\System\npGqbDu.exe
  2⤵
  PID:10068
- C:\Windows\System\ZKpvjad.exe
  C:\Windows\System\ZKpvjad.exe
  2⤵
  PID:10072
- C:\Windows\System\EpQoFTR.exe
  C:\Windows\System\EpQoFTR.exe
  2⤵
  PID:10168
- C:\Windows\System\mTvaISB.exe
  C:\Windows\System\mTvaISB.exe
  2⤵
  PID:10236
- C:\Windows\System\sJBxItP.exe
  C:\Windows\System\sJBxItP.exe
  2⤵
  PID:9156
- C:\Windows\System\gJmwJvf.exe
  C:\Windows\System\gJmwJvf.exe
  2⤵
  PID:8428
- C:\Windows\System\ywjJjps.exe
  C:\Windows\System\ywjJjps.exe
  2⤵
  PID:10092
- C:\Windows\System\vhCBdra.exe
  C:\Windows\System\vhCBdra.exe
  2⤵
  PID:9724
- C:\Windows\System\naDlvfl.exe
  C:\Windows\System\naDlvfl.exe
  2⤵
  PID:9748
- C:\Windows\System\eLyZdAL.exe
  C:\Windows\System\eLyZdAL.exe
  2⤵
  PID:9784
- C:\Windows\System\RsMxNLY.exe
  C:\Windows\System\RsMxNLY.exe
  2⤵
  PID:9808
- C:\Windows\System\yiWgIsp.exe
  C:\Windows\System\yiWgIsp.exe
  2⤵
  PID:9372
- C:\Windows\System\XFjMcnB.exe
  C:\Windows\System\XFjMcnB.exe
  2⤵
  PID:9992
- C:\Windows\System\LiyDGwQ.exe
  C:\Windows\System\LiyDGwQ.exe
  2⤵
  PID:10120
- C:\Windows\System\nWvvVJl.exe
  C:\Windows\System\nWvvVJl.exe
  2⤵
  PID:10220
- C:\Windows\System\jBtOHFa.exe
  C:\Windows\System\jBtOHFa.exe
  2⤵
  PID:9544
- C:\Windows\System\wpLXGaj.exe
  C:\Windows\System\wpLXGaj.exe
  2⤵
  PID:9592
- C:\Windows\System\JpZIzJT.exe
  C:\Windows\System\JpZIzJT.exe
  2⤵
  PID:9832
- C:\Windows\System\HEuGKvV.exe
  C:\Windows\System\HEuGKvV.exe
  2⤵
  PID:10104
- C:\Windows\System\YvUjkMc.exe
  C:\Windows\System\YvUjkMc.exe
  2⤵
  PID:9732
- C:\Windows\System\QQXkumF.exe
  C:\Windows\System\QQXkumF.exe
  2⤵
  PID:9476
- C:\Windows\System\IhocXlT.exe
  C:\Windows\System\IhocXlT.exe
  2⤵
  PID:10140
- C:\Windows\System\CAnxhCe.exe
  C:\Windows\System\CAnxhCe.exe
  2⤵
  PID:9528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AfMzyVP.exe

Filesize
1.2MB

MD5
ff1a0f4d23df49949702f8e68475817e

SHA1
1cab9bda97ec3bea475bc9f81ec89d31cbd6e16c

SHA256
890a21f98cd8721f29209c6cd16a87f6dd21a9e2fcf7fe4375232387546f17c2

SHA512
2a2b300920c6fba0103b155823192125320f16723cad8a74e353c1cc65b6b2ea719390178b1d5bc5c3a29019a7bb437ce78734db410a0ae40328512829637064

Download Submit
C:\Windows\system\BBEacOE.exe

Filesize
1.2MB

MD5
db8aa01a667e7eb1f4ebba420d235766

SHA1
c4ad13363e39129adcce0c61217a3619f1ca8771

SHA256
ce8973f9afa849b7f08cea93fa77cbaaa47b904b721cd305c4f7ac779da2dc5a

SHA512
bf68315880b4090553e1d5137444831e2a699f9d7432997c93ef9aad98a0595a35793e102ad68cc8f1a7e06ca7b44547bda88701e958cd664574e80b0a69fad0

Download Submit
C:\Windows\system\BdKXkjt.exe

Filesize
1.2MB

MD5
2d254d300d077b58744f3c75087584b6

SHA1
64ee06501eedfb2b20d3de77da6a853adaff189b

SHA256
df47d7ea22cadab63b1e9baa69ccde680a35767453f6acf957946494f9d037e4

SHA512
6b24acdbb948b0935d9d6887bceb3380ef43bb09b4af79ab92072b1d29e9852a643727f774a1405c41d9e76e38ba0e18f74f4210601c0ee5bd766eca0862c2b0

Download Submit
C:\Windows\system\DJHRiSz.exe

Filesize
1.2MB

MD5
d2b1128ca39d8a58ad0ea0aec3b1ed75

SHA1
c097f1bcf76c67ab10317596f1d1d7e6f345fb07

SHA256
b101f35f0749aa6d79764a726a2c91684703a1276f5c1523b8532ccced7ae382

SHA512
6f75494effb956cca622d5b66edb5d2bbe5489c7007998636b1bd58596f76d6cf52279d2a4098d82577bc968d248ab9e68952f2eec2a692a2e623434ff1f1838

Download Submit
C:\Windows\system\DufOunF.exe

Filesize
1.2MB

MD5
84144dec200dd438350ab1b004d108d6

SHA1
41d0e0a94edbd3229cf8e74db39ad7cb2fc72561

SHA256
4879a33ff6ac3aa50d54dce25530987ed5643e83999d0ec1c9a2de8e8df737b4

SHA512
a398858eeea0901ea071ef58cb55490e71bcdd3dd6fd1fdfdc4ac1c414f890078bc7a5e639f072f71fb755eb4561380a88d8b8f2a711afa9485fa21a69a66b51

Download Submit
C:\Windows\system\LvgQdBm.exe

Filesize
1.2MB

MD5
03b24dce7cca02d886961647bed74105

SHA1
722474456ea9c10742aaed90e7ba86f5cabfdcef

SHA256
650104ffcc6f53028f92d71895318bf74696ee327e04af1aa3e100623eaa4cbe

SHA512
59036b7785e127a894470a83c8cd7f2c40f36232c720e60cd116705614c57483790c3229eb35ed587e14689f2f1d8361c79e87de84714137abb804a268292925

Download Submit
C:\Windows\system\RkZAFjq.exe

Filesize
1.2MB

MD5
e2c0cf76abe96a6a2519ece890a68ef3

SHA1
e0c1f6e226a3644e2faff80d0e5cf432cb1ff981

SHA256
0840bff2f814d0f99907f80ba7fed370c97e2825f022ae0ceca9ec02142dba29

SHA512
f875e974830563478a415a776a8bf5589b6596bb2846ddd1b56709e090c3467e3d731bafd6be2503607a367fb531927b49bd3647d3f4dbb8297d18912799e53e

Download Submit
C:\Windows\system\UnhnyPW.exe

Filesize
1.2MB

MD5
a502b82ee11db2e0e1d7ea465ba81038

SHA1
fd912e27392633590267f72b8b7aa26fb88a7af0

SHA256
16416eb21ea973f2b5c0329b016d3f3cec15730e75b8c6d760ba9335fd3f4093

SHA512
19dfda4e3775e7ab08221fd2041c177e62b675f5ae2ddffb6cb4d5487a18b2e6adf69d86b0568fb8d027fc35b06d1377f5aae87b98d7b98d3890c6d947f5ff35

Download Submit
C:\Windows\system\UslcWxT.exe

Filesize
1.2MB

MD5
147147b9ae48216148b785361ae629a2

SHA1
5c23d85c6bd38b91073d2ad22144f507434556aa

SHA256
9e29142c41e8e8a0da17ce0ebd54bb1b4076ff94ed86d07831222a92dade3949

SHA512
da2f26a3e283722e9917b3decff6304170d9616d2e325767850d6e36029d21dee1db1086445138a0d3803bcc9e6a2f119e835cf9ef5c94d1e1128e7113a03c65

Download Submit
C:\Windows\system\bKNkYSm.exe

Filesize
1.2MB

MD5
3793c9c7691fd69c72c1d6b40bfa2858

SHA1
150509528e50947650ce6bd0d33d01917a7ffc44

SHA256
e7832b01d4dad5277d0d31f88874a83ce103b5f3b292cb3a548b57e3a019d6b7

SHA512
59c0d383342fcb52f8f91b16c61b629da722a083b4454e07d6f26b220ad7bfe8167d0530cf62411c19e21b8bd0ae8aec91bc7cbf0791febffb8e4ab5b7339b7e

Download Submit
C:\Windows\system\bQSntcA.exe

Filesize
1.2MB

MD5
afc1f5479942e056e25315fdf970c65c

SHA1
5e946fcfe495b4bdb68df252f9670a0c5c349c1e

SHA256
00669d3916fc42d8331d5457469f2804a2898ff7bdeea112d3a9f8d97a1d0f93

SHA512
2b2fdd35b1f326812efbe07f88dfd88d7fd886e2f1d6fb013d8adf31a59976fef025755d11597c123b452cb431f5773b4cab37553853a3c6ea3b26056ab1f228

Download Submit
C:\Windows\system\dsEhdiF.exe

Filesize
1.2MB

MD5
5fd5a381d15ce8c2adb3cde992597604

SHA1
1eee54639763759e6eefb6947d855cf1910a6c8d

SHA256
aff0f28476e6b4e48f9d4bde03795d576b1d9129830ead1954e72366da43c089

SHA512
641b6cd123036734b2243c2dc127d451ab82a52bc52511ae7240f50e1c149bd42a632dd164c4cd8c4aae46769b7c2f9735a69ef541e3b8e0496b699afacc9742

Download Submit
C:\Windows\system\gdqcMsg.exe

Filesize
1.2MB

MD5
4ee6a33e1dad4f810b2ebcf03e0fcdc0

SHA1
73567722dd666bcc0b4db21c1332c2e707192056

SHA256
9fece02ae3e50c20d2d3febdd6f4ea26a038e1227a514ab4b650d4ca14d3fddd

SHA512
49fe474298d55d3f3e221bc8f17730c48c9505dc0d05201b8869ca9d0666aea0affe7318dba0a92fd3c76e3afadc41274a939464f2c5de73711414e16666f498

Download Submit
C:\Windows\system\hMtOpoT.exe

Filesize
1.2MB

MD5
6aee547d2b87d7af22c8032986f09225

SHA1
94c216ffd280242bbec5577aef669202fa92c6c7

SHA256
54948efc6bc13c16baac13d5395c9264fa603c261c695114d012c664680a0f42

SHA512
1a807c62cc3651e092aab467cba2bf07b82dff1a44d0cabb8fd73b026df9118fef9791d49d99daee0ff82068e7a7a561471f0c7fffd9a821d125a6f5d0bdc373

Download Submit
C:\Windows\system\oPLIrgs.exe

Filesize
1.2MB

MD5
7e46f18cc9fb2ff70302900e1bcf94c5

SHA1
8b86b5d34f475b25a5d19dc870ef6f71cad9928b

SHA256
7188eece4835a9018f947fd22a25d04b195f3ec8c4043602150489e9927bb2c2

SHA512
86c69b66adb72a800137080310c27e4b33673973b30bfe73b14440d8f6916c979d5e0a950d0d12c5f08a64425c1a90ad3503de9947f3482809d2c029963e7a28

Download Submit
C:\Windows\system\rULKmzN.exe

Filesize
1.2MB

MD5
77b9886da0b9702fc5800d562cd20119

SHA1
64ed9b6c42293139bbf8c6896e565451158823ff

SHA256
8926b9093bc5325d94378d2a6add4505a438b26ed74ad44b091a8ac5af9be590

SHA512
897028bba6294fcf1daaaee90381df0c6c349b219f6835d3539cb791964f9cfe4f227dc9c2f41ff5d62045ce243aecb4bad0c3d9c309c47c67c1cda269c326ce

Download Submit
C:\Windows\system\rwddkXf.exe

Filesize
1.2MB

MD5
e98eaf3094ef6e09f0b447790445f683

SHA1
71dcda5eced016b4b7987e6041b56bf172d457cf

SHA256
48e6f02f9cf85aaf517cdf9ee61ffac6737396bb60c9603d854e2c88e97105dd

SHA512
b26501e4b03e0598bf8206c5f4e4d0b6435a17bb0367238ffe0e57e4beaf29273f3a42791f2bee371b49537cf4b0d6b63e4a0f8af060b50b3e83f093660eea22

Download Submit
\Windows\system\AxUgqJG.exe

Filesize
1.2MB

MD5
40d4d208c54225d28b18220fa51b8cab

SHA1
0d5400be24b605a60d55104f7fc988a2b401a13d

SHA256
aca2261587bb9ae86fa2d7a4f0c9332edb34da6a327901cb353c4435978b3fa3

SHA512
6a18aa12f2e78f53bd26dfadfa62a1962eb5a586024dcaf358585bb6c5437ff16ac7b6287d6f151d6d03cbf16a31b9df5b4505eebf8175c371ba9ea520bb78fa

Download Submit
\Windows\system\KBBloiu.exe

Filesize
1.2MB

MD5
b61c942f8d203c70a27f43cad934b4b1

SHA1
36a04cb971b5b87b5d1a938f29978137fd0d9674

SHA256
03fcb9fbafd7613cf337869a868a5723dcf68b8aa5180b7a88144b96f72f3cc3

SHA512
156da3452758c8e412f90e6aeecbe6586b804e1da7a68c45a3174837d184bf5c008362f1c25802860f8e0f521a8f2bfe54e1bc8e96f7a58b2f0bea28c1f66c92

Download Submit
\Windows\system\KtZNjeN.exe

Filesize
1.2MB

MD5
d9fd7328563816dd34502f3ce665e7d0

SHA1
92dc06e2486d77a358cc2255d8456adbcbbfab8c

SHA256
fb0832ecca01c70c407a45788c70d9e4a36e6bf70e8f9d3cbb10cb34d2feab08

SHA512
1bd5ef5b2d0da3370e43317a5febc781aede101934d8118a47c2730ddbdafdcc41e10f4abb53444afab8f178e5adcf748fdba52e8a461a7bf33c3c4dd43aacdc

Download Submit
\Windows\system\MONkBGM.exe

Filesize
1.2MB

MD5
7374ad2e8b6bede66baa2da091204635

SHA1
97ac84d56b519021aa9ca4ed8d31d881fc71f6d2

SHA256
6ddc9ea7e7ee12e318aa1d502d4990ea539ea33074004c4e5cf51a7327cea491

SHA512
da204cfe62389ddd20af4429cf17131d118585823ffa908d7a6975176547f7aa078c9fd39b37f72edf149e7a9432d7ccbbb67878b8d8bf3f8030a8a10a9a51b6

Download Submit
\Windows\system\MidNCAu.exe

Filesize
1.2MB

MD5
bddd26b51a9dea58092b257bc3d3e3df

SHA1
491a5496112f5d551f6ccef8d9f89b65e19169a6

SHA256
c1abbf8e59ca59652d40acb8c2b9a41f426aea3e53160b814c287bca0be3fe98

SHA512
16f6a7b7b81d8c7ca10bc53b0021b6a33d0a03667c6bb5557d08d44c6204e201e46c2fa10b7291e3921171c56b5a79f5149213a8cd7649a2a02c222723f2c870

Download Submit
\Windows\system\RREdytw.exe

Filesize
1.2MB

MD5
a198b3bb3fe1fa2ba218eb4b4d35ceaf

SHA1
45c40cd575e6b13a746246644560498e60157db0

SHA256
2c88c3bb2289e92a94f188e49805fd30aa27e3ad6e2b5315d85625253376036b

SHA512
8345a6e0d26c7f7733b5046c4c53e2282b5d455738940decbb1dd9ffcf0cb8a61f6e2671892377dcb223b3beb3eba2bb1394cc0966a900462a746b0937273e14

Download Submit
\Windows\system\XaiMDHy.exe

Filesize
1.2MB

MD5
6928869c1cabbc9d6ea6fcc9210c9660

SHA1
001ffb338207ccfaf8d02bab01bc4fc2ad2581c5

SHA256
72093e09fc87ab51bf5740a4b11922fb562d80cf5e82904b5f2782e1253470a5

SHA512
8ac3cbcac3fc5f356a17a6e69267687ac9fc4a7d63ee28aa83e78ab031fe0fecc4669567e44432f5d2c5e54733bc5a2ced99c01abfd8919a65ef3f809d57244f

Download Submit
\Windows\system\YsmbFNB.exe

Filesize
1.2MB

MD5
d0455f8019b5969769f59f10cfd0a77d

SHA1
46940e8d6140119ef9b84588701a9108b159528f

SHA256
ca1c33bf6eba56cdc9493b3f421e4c1c119d09c82c278bdbb5f544679add5452

SHA512
af55088035cfcf6f33cf3fc3d1786f44fab20895969ec11cf607ef4ee1c8156ea2c31be6c7152ddc056e239935f7f5d1b247afd850d2cee05759b7bcfa6ad12b

Download Submit
\Windows\system\gTMZtTP.exe

Filesize
1.2MB

MD5
a8c39f19ea374573ba06dd527cb4af81

SHA1
5f2eac73fb8351f0d7d42d2aa4b18798159fe4b3

SHA256
80d69b945bfa1e141b49d806ace373b743bbc637116d4a8676ed2a7477137ed2

SHA512
00c07efbc7525c0e56310ae60ddb9ea8254b1091a3e2c9a8f7e924c861a1383ade8a9b931887d146ee062951acc0e59476e9a4bcf0b2466f47c5e27c82c6e792

Download Submit
\Windows\system\hCvTzeI.exe

Filesize
1.2MB

MD5
c7ec2d7a57c74660ced50cdef5edeea7

SHA1
6e114acfcbad98689bc44e7d64c6d13451b59a31

SHA256
5795fb5a491b9dd8076082943a84f3eaa22cee8297b05180dfad2d5dd6316f01

SHA512
cc1aa94f2feada631ee444d8d1a90731a7406535b1ddb6639816cd8b21a6bf659e87d96fd9de1c9819086a2a67565b827eaefc72136b5ecd59c6729b72f6c466

Download Submit
\Windows\system\jjuavAN.exe

Filesize
1.2MB

MD5
9098c07eb985e24f13ec99dad9100ed9

SHA1
562c8e4d3f180023d21028f665244f34e6f854f3

SHA256
8e9a1da1b44de697be5ee6e846b08dbf7cc3a9b6fdb4fe9cfaa6ddb906ea278f

SHA512
a3f1c4d94d784e163a094dce8b8787fef3a90644d269171fe311d9229692be8cca51aebc9ebfc5481eac426b53a062ec93c3d08e80e7c2e4fcc4ff3aa3c3fa24

Download Submit
\Windows\system\kNhLEGz.exe

Filesize
1.2MB

MD5
469ce2d86809646fbfa29fad3f49c6e4

SHA1
5ef77e0a626bb06f6d62332d4ee2e5e0b0edefda

SHA256
d4439132909bd5cbea7896dfdc93a50545b04167fbf6a6565f471af687b5c70f

SHA512
5e54c306368bc1ba19256542d66e5d7392bbc691bc13c5d739ef807ceba1d9736c34682ee271ab59fb49b7068b632abcd96779dc0dd681df130ea1aadbec88e4

Download Submit
\Windows\system\mFFmJKo.exe

Filesize
1.2MB

MD5
94958fb9695905cf7790013694e7e1a5

SHA1
4f0c555454d3583407dd7f4cd0351f729fcc9ea9

SHA256
ea082330ed40f4513cf795367376bcc00d8d302e135db42f57c6a2bfea2f5804

SHA512
c3b7f3e10019f73194410933360edcd5a1f8e8ccf9c79b3bae287e66527d8a5b07b43aa6aad457297621432f690283cf98e52140c9f0e57a019850b7084f06e6

Download Submit
\Windows\system\mMUkskJ.exe

Filesize
1.2MB

MD5
bce3d396e2f009745bb3e8ba69d3afb5

SHA1
1c72a4b53470b95014e774e3f8a6ef209221596e

SHA256
c65fcd00dff259e10354161466b01ca854555ef8566a85543c830d6b04d8d14d

SHA512
708c5075fe7eb7304d48ff4eec83419576e3a55915fba68e208192ab4abfca06432a84cfbeaa0a6586d5060bc4f64e26984075b2344f8dbe2aeaa24c4e050dac

Download Submit
\Windows\system\mrRYoni.exe

Filesize
1.2MB

MD5
323e5bdcd88739a8b81c6d4721645a60

SHA1
ceadbcc39a3e743537b317de1f728b25af6de07f

SHA256
9b52f3524a06f8c4908d6883dd7b82b014642ccf09461ae621459a6abd472927

SHA512
06251ac121f9a3b1ab08c0fa53e0903cd19e9092f186583c342c1ed4d20750626d23ae04fb4600ada0dd5968211f07c587f2189c69d3430df5a3ec75930b95e9

Download Submit
\Windows\system\obiEAOM.exe

Filesize
1.2MB

MD5
da62532e1cd24d9a5a4e62f272037967

SHA1
ab8fc98db414dcab8c4c1508b9622b2374c1734a

SHA256
8f48d9435091042ebc0c20c3a925dddfa7f2a1406fc5c6646c59543ababe70ff

SHA512
d8c6da9bfed99d86e13ddbeedda4fd9c6f9132b92cc2dc3e79254f996dd704306dd1803adc48b94b5dc891d44b3ec9ae17d4dbcf56bd13722bb16eaa916080c9

Download Submit
\Windows\system\qcSBtJN.exe

Filesize
1.2MB

MD5
735b2301e7276f289b3ff86e3d850f8f

SHA1
410a00edade2ec4279db4458038b103e2ce4a29a

SHA256
9579de62d39f9e32d7f7b2dfd8cbc119804c8de99fd779811cad0651c914f914

SHA512
07201c64fd2e39e0292f0ff59d1809f11d40dcbd23fee4b038137d420c64cf696189c98ccca3f8708e3078c2a9a786eb150e33352525e645510729bcfadba987

Download Submit
\Windows\system\uaTCsKN.exe

Filesize
1.2MB

MD5
d5074b09b84964d9392248c88669e3d9

SHA1
7b8d958cf483c7f8731203e719b6bbaa21577819

SHA256
235f863369885e1a040376f8fafa9ae9d21c46acc23d73f78bbffda11a2e322e

SHA512
e7ec9f3b1a1da4100f37dc367e4ccb18a318166ff1c9319f9a02dc18ca1a2d2f93d0645ed8ae4d25054ee870e93b33b9758edd8fce8e6a6c6b30aad024e20ba9

Download Submit
\Windows\system\wYxWsUD.exe

Filesize
1.2MB

MD5
de404f100b23ea66915bbcc2902362ee

SHA1
41b39415f47ea49db2f619d84418b67e8a99b592

SHA256
04162236ffd52d75b0212bb970fcd4723eae5b6f81e50dfc61fc526c2c4f5f09

SHA512
448b7961d47718f19681c967c0d754df291f99a499384fadf2f84f0953b9266f0345d9a9b49d828b7dce3698117e93303c5559ce1389b80ea45c10e04b27f3cc

Download Submit
\Windows\system\xrNZJOy.exe

Filesize
1.2MB

MD5
7171e3807d6c4132aa3290c49bf68a05

SHA1
f5f2bd210ecfc728f7d3de78450a0dbd3de5845b

SHA256
f53a949ace33a219a3966fd99971fa35e95d2109e49a07f1adb03d2f1b441027

SHA512
d939e047835ac23520416f679598a6bbea093703e8bd4792d72691ad6c31990d9c3cefb5bc526e320579dd905a0f57aa4f9b4538072ecbf7a484e4ee0729aa51

Download Submit
memory/288-409-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/288-88-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/288-2850-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/600-70-0x000000013F750000-0x000000013FB42000-memory.dmp

Filesize
3.9MB

Download
memory/600-2548-0x000000013F750000-0x000000013FB42000-memory.dmp

Filesize
3.9MB

Download
memory/1256-2852-0x000000013F350000-0x000000013F742000-memory.dmp

Filesize
3.9MB

Download
memory/1256-61-0x000000013F350000-0x000000013F742000-memory.dmp

Filesize
3.9MB

Download
memory/1444-76-0x000000013FEC0000-0x00000001402B2000-memory.dmp

Filesize
3.9MB

Download
memory/1444-2855-0x000000013FEC0000-0x00000001402B2000-memory.dmp

Filesize
3.9MB

Download
memory/1464-2539-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/1464-63-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/1512-16-0x000000013F1D0000-0x000000013F5C2000-memory.dmp

Filesize
3.9MB

Download
memory/1512-2451-0x000000013F1D0000-0x000000013F5C2000-memory.dmp

Filesize
3.9MB

Download
memory/1992-94-0x000000013FF00000-0x00000001402F2000-memory.dmp

Filesize
3.9MB

Download
memory/1992-569-0x000000013FF00000-0x00000001402F2000-memory.dmp

Filesize
3.9MB

Download
memory/1992-2856-0x000000013FF00000-0x00000001402F2000-memory.dmp

Filesize
3.9MB

Download
memory/2348-2853-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/2348-62-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/2576-2517-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/2576-50-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/2712-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2712-87-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/2712-72-0x00000000031F0000-0x00000000035E2000-memory.dmp

Filesize
3.9MB

Download
memory/2712-73-0x00000000031F0000-0x00000000035E2000-memory.dmp

Filesize
3.9MB

Download
memory/2712-43-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/2712-60-0x000000013F350000-0x000000013F742000-memory.dmp

Filesize
3.9MB

Download
memory/2712-121-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2712-299-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2712-90-0x00000000031F0000-0x00000000035E2000-memory.dmp

Filesize
3.9MB

Download
memory/2712-0-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2712-46-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/2712-75-0x00000000031F0000-0x00000000035E2000-memory.dmp

Filesize
3.9MB

Download
memory/2712-66-0x000000013F750000-0x000000013FB42000-memory.dmp

Filesize
3.9MB

Download
memory/2712-512-0x00000000031F0000-0x00000000035E2000-memory.dmp

Filesize
3.9MB

Download
memory/2712-64-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/2712-13-0x000000013F1D0000-0x000000013F5C2000-memory.dmp

Filesize
3.9MB

Download
memory/2756-44-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/2756-2854-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/2780-196-0x000007FEF4740000-0x000007FEF50DD000-memory.dmp

Filesize
9.6MB

Download
memory/2780-34-0x0000000001FC0000-0x0000000001FC8000-memory.dmp

Filesize
32KB

Download
memory/2780-37-0x000007FEF4740000-0x000007FEF50DD000-memory.dmp

Filesize
9.6MB

Download
memory/2780-38-0x000007FEF4740000-0x000007FEF50DD000-memory.dmp

Filesize
9.6MB

Download
memory/2780-17-0x000007FEF49FE000-0x000007FEF49FF000-memory.dmp

Filesize
4KB

Download
memory/2780-42-0x000007FEF4740000-0x000007FEF50DD000-memory.dmp

Filesize
9.6MB

Download
memory/2780-28-0x000000001B2A0000-0x000000001B582000-memory.dmp

Filesize
2.9MB

Download
memory/2780-167-0x000007FEF4740000-0x000007FEF50DD000-memory.dmp

Filesize
9.6MB

Download
memory/2780-123-0x000007FEF4740000-0x000007FEF50DD000-memory.dmp

Filesize
9.6MB

Download
memory/2780-58-0x000007FEF4740000-0x000007FEF50DD000-memory.dmp

Filesize
9.6MB

Download
memory/2780-166-0x000007FEF49FE000-0x000007FEF49FF000-memory.dmp

Filesize
4KB

Download
memory/2908-316-0x000000013FAB0000-0x000000013FEA2000-memory.dmp

Filesize
3.9MB

Download
memory/2908-2851-0x000000013FAB0000-0x000000013FEA2000-memory.dmp

Filesize
3.9MB

Download
memory/2908-81-0x000000013FAB0000-0x000000013FEA2000-memory.dmp

Filesize
3.9MB

Download
memory/2912-2513-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/2912-65-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download