xmrig | cef7336bff8ba69f7df4bee85d31d8418d13214d5fac2cb5dc37e74521ea32d5

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/06/2024, 02:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e6afa169ea6557dcb5a167889db9120.exe
Size

2.2MB
MD5

6e6afa169ea6557dcb5a167889db9120
SHA1

8cc9934801c78fb17fab0420c31cf1b0ed2b6c07
SHA256

cef7336bff8ba69f7df4bee85d31d8418d13214d5fac2cb5dc37e74521ea32d5
SHA512

1332563ebca4b097f8c205b5ce90d5b4fa7f1fa1bfb4f788276576fa287e63f104a353095d16b7fdfd4fbd9e0829f10545358b1e24541904614d0e773790145d
SSDEEP

49152:oezaTF8FcNkNdfE0pZ9ozt4wIQwNUarmRknBhcO1:oemTLkNdfE0pZrQU

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/files/0x000700000001415f-21.dat	xmrig
behavioral1/memory/2368-20-0x000000013F9D0000-0x000000013FD24000-memory.dmp	xmrig
behavioral1/memory/2576-30-0x000000013F610000-0x000000013F964000-memory.dmp	xmrig
behavioral1/files/0x0007000000014186-38.dat	xmrig
behavioral1/files/0x0009000000014228-49.dat	xmrig
behavioral1/memory/2472-57-0x000000013F2C0000-0x000000013F614000-memory.dmp	xmrig
behavioral1/memory/2372-77-0x000000013F700000-0x000000013FA54000-memory.dmp	xmrig
behavioral1/memory/2476-75-0x000000013FCD0000-0x0000000140024000-memory.dmp	xmrig
behavioral1/files/0x000600000001487f-72.dat	xmrig
behavioral1/files/0x0006000000014b18-83.dat	xmrig
behavioral1/memory/2944-93-0x000000013FCD0000-0x0000000140024000-memory.dmp	xmrig
behavioral1/files/0x0006000000014b4c-92.dat	xmrig
behavioral1/files/0x0006000000014bbc-99.dat	xmrig
behavioral1/memory/2688-102-0x000000013F310000-0x000000013F664000-memory.dmp	xmrig
behavioral1/memory/2136-113-0x000000013F590000-0x000000013F8E4000-memory.dmp	xmrig
behavioral1/files/0x000600000001535e-117.dat	xmrig
behavioral1/files/0x000600000001564f-126.dat	xmrig
behavioral1/files/0x0006000000015677-141.dat	xmrig
behavioral1/files/0x0006000000015c87-153.dat	xmrig
behavioral1/files/0x0006000000015c9e-157.dat	xmrig
behavioral1/files/0x0006000000015ccd-172.dat	xmrig
behavioral1/memory/2944-2680-0x000000013FCD0000-0x0000000140024000-memory.dmp	xmrig
behavioral1/memory/2372-2679-0x000000013F700000-0x000000013FA54000-memory.dmp	xmrig
behavioral1/memory/2368-4026-0x000000013F9D0000-0x000000013FD24000-memory.dmp	xmrig
behavioral1/memory/2136-4027-0x000000013F590000-0x000000013F8E4000-memory.dmp	xmrig
behavioral1/memory/2576-4028-0x000000013F610000-0x000000013F964000-memory.dmp	xmrig
behavioral1/memory/2636-4029-0x000000013F290000-0x000000013F5E4000-memory.dmp	xmrig
behavioral1/memory/2452-4030-0x000000013FEF0000-0x0000000140244000-memory.dmp	xmrig
behavioral1/memory/2708-4032-0x000000013FEB0000-0x0000000140204000-memory.dmp	xmrig
behavioral1/memory/2560-4033-0x000000013F750000-0x000000013FAA4000-memory.dmp	xmrig
behavioral1/memory/2372-4035-0x000000013F700000-0x000000013FA54000-memory.dmp	xmrig
behavioral1/memory/2476-4034-0x000000013FCD0000-0x0000000140024000-memory.dmp	xmrig
behavioral1/memory/2472-4031-0x000000013F2C0000-0x000000013F614000-memory.dmp	xmrig
behavioral1/memory/2688-4038-0x000000013F310000-0x000000013F664000-memory.dmp	xmrig
behavioral1/memory/2944-4037-0x000000013FCD0000-0x0000000140024000-memory.dmp	xmrig
behavioral1/memory/1736-4036-0x000000013FDE0000-0x0000000140134000-memory.dmp	xmrig
behavioral1/memory/2916-4025-0x000000013F730000-0x000000013FA84000-memory.dmp	xmrig
behavioral1/files/0x0006000000015ce3-182.dat	xmrig
behavioral1/files/0x0006000000015cff-187.dat	xmrig
behavioral1/files/0x0006000000015cd9-177.dat	xmrig
behavioral1/files/0x0006000000015cb6-167.dat	xmrig
behavioral1/files/0x0006000000015cb6-165.dat	xmrig
behavioral1/files/0x0006000000015cae-162.dat	xmrig
behavioral1/files/0x0006000000015cae-160.dat	xmrig
behavioral1/files/0x0006000000015c87-149.dat	xmrig
behavioral1/files/0x0006000000015684-147.dat	xmrig
behavioral1/files/0x000600000001565d-135.dat	xmrig
behavioral1/files/0x000600000001565d-134.dat	xmrig
behavioral1/files/0x0006000000015653-132.dat	xmrig
behavioral1/files/0x0032000000013a46-121.dat	xmrig
behavioral1/files/0x000600000001535e-115.dat	xmrig
behavioral1/files/0x0006000000014fa2-109.dat	xmrig
behavioral1/files/0x0006000000014e71-106.dat	xmrig
behavioral1/memory/1736-101-0x000000013FDE0000-0x0000000140134000-memory.dmp	xmrig
behavioral1/memory/1940-90-0x000000013F3A0000-0x000000013F6F4000-memory.dmp	xmrig
behavioral1/files/0x0006000000014a9a-82.dat	xmrig
behavioral1/memory/2560-69-0x000000013F750000-0x000000013FAA4000-memory.dmp	xmrig
behavioral1/files/0x0006000000014826-68.dat	xmrig
behavioral1/memory/2708-56-0x000000013FEB0000-0x0000000140204000-memory.dmp	xmrig
behavioral1/files/0x000600000001471a-60.dat	xmrig
behavioral1/files/0x0007000000014712-47.dat	xmrig
behavioral1/memory/2636-42-0x000000013F290000-0x000000013F5E4000-memory.dmp	xmrig
behavioral1/memory/2452-45-0x000000013FEF0000-0x0000000140244000-memory.dmp	xmrig
behavioral1/files/0x0007000000014175-33.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2916	EKRPzFH.exe
2368	ZPxbxEZ.exe
2136	nbBbSwC.exe
2576	fhHTzuW.exe
2636	qNDGRTz.exe
2452	baNZxWJ.exe
2708	BXnpbNX.exe
2472	QSIHidE.exe
2560	oVIKTbB.exe
2476	QrYyBTK.exe
2372	YmxuMPy.exe
2944	kEJmsul.exe
1736	sYgyNmT.exe
2688	PsjUieR.exe
2788	tQSjwCO.exe
1664	mBocyzN.exe
1220	Nxwkcyk.exe
800	BUDBZMh.exe
1956	VatRSiz.exe
2220	DVPtYlD.exe
1968	ofaOkSW.exe
908	odLmzkr.exe
2432	tlWOOGH.exe
2196	sAHGNit.exe
1828	FUqacbh.exe
2872	fctOcFf.exe
692	xzdJmbf.exe
580	QhdooId.exe
1484	khcQKJw.exe
2908	tTLThNv.exe
900	kTRyecn.exe
820	paLhFXu.exe
2132	qvnrgjs.exe
1304	HOXBUeq.exe
1368	lJwAhWK.exe
1564	xelTnxS.exe
2036	uEFjdVU.exe
1100	DYDXjyM.exe
2236	PBVrHVD.exe
2012	fGNxqIE.exe
1992	ZQoBINe.exe
988	OafREQd.exe
2744	ukmDaxJ.exe
1832	YAGgMVY.exe
2252	dqJeFTV.exe
1624	zLkIxwO.exe
2256	TLLOGUc.exe
348	OCZjwIu.exe
1516	JgxEqAl.exe
1264	UadQyEN.exe
1740	aZKgfoT.exe
1620	bXtuPMV.exe
2900	sBuHbCU.exe
2096	xHgIynw.exe
2912	foRpVza.exe
2852	oIadbks.exe
2724	qbBfzPv.exe
2620	oJRsBrG.exe
2928	ZILybLK.exe
2680	GXiAWiS.exe
2780	OXmgnQl.exe
2536	sXintYk.exe
2164	sytRBqT.exe
2160	UPSgJCQ.exe

Loads dropped DLL 64 IoCs

pid	Process
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe
1940	6e6afa169ea6557dcb5a167889db9120.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000700000001415f-21.dat	upx
behavioral1/memory/2368-20-0x000000013F9D0000-0x000000013FD24000-memory.dmp	upx
behavioral1/memory/2576-30-0x000000013F610000-0x000000013F964000-memory.dmp	upx
behavioral1/files/0x0007000000014186-38.dat	upx
behavioral1/files/0x0009000000014228-49.dat	upx
behavioral1/memory/2472-57-0x000000013F2C0000-0x000000013F614000-memory.dmp	upx
behavioral1/memory/2372-77-0x000000013F700000-0x000000013FA54000-memory.dmp	upx
behavioral1/memory/2476-75-0x000000013FCD0000-0x0000000140024000-memory.dmp	upx
behavioral1/files/0x000600000001487f-72.dat	upx
behavioral1/files/0x0006000000014b18-83.dat	upx
behavioral1/memory/2944-93-0x000000013FCD0000-0x0000000140024000-memory.dmp	upx
behavioral1/files/0x0006000000014b4c-92.dat	upx
behavioral1/files/0x0006000000014bbc-99.dat	upx
behavioral1/memory/2688-102-0x000000013F310000-0x000000013F664000-memory.dmp	upx
behavioral1/memory/2136-113-0x000000013F590000-0x000000013F8E4000-memory.dmp	upx
behavioral1/files/0x000600000001535e-117.dat	upx
behavioral1/files/0x000600000001564f-126.dat	upx
behavioral1/files/0x0006000000015677-141.dat	upx
behavioral1/files/0x0006000000015c87-153.dat	upx
behavioral1/files/0x0006000000015c9e-157.dat	upx
behavioral1/files/0x0006000000015ccd-172.dat	upx
behavioral1/memory/2944-2680-0x000000013FCD0000-0x0000000140024000-memory.dmp	upx
behavioral1/memory/2372-2679-0x000000013F700000-0x000000013FA54000-memory.dmp	upx
behavioral1/memory/2368-4026-0x000000013F9D0000-0x000000013FD24000-memory.dmp	upx
behavioral1/memory/2136-4027-0x000000013F590000-0x000000013F8E4000-memory.dmp	upx
behavioral1/memory/2576-4028-0x000000013F610000-0x000000013F964000-memory.dmp	upx
behavioral1/memory/2636-4029-0x000000013F290000-0x000000013F5E4000-memory.dmp	upx
behavioral1/memory/2452-4030-0x000000013FEF0000-0x0000000140244000-memory.dmp	upx
behavioral1/memory/2708-4032-0x000000013FEB0000-0x0000000140204000-memory.dmp	upx
behavioral1/memory/2560-4033-0x000000013F750000-0x000000013FAA4000-memory.dmp	upx
behavioral1/memory/2372-4035-0x000000013F700000-0x000000013FA54000-memory.dmp	upx
behavioral1/memory/2476-4034-0x000000013FCD0000-0x0000000140024000-memory.dmp	upx
behavioral1/memory/2472-4031-0x000000013F2C0000-0x000000013F614000-memory.dmp	upx
behavioral1/memory/2688-4038-0x000000013F310000-0x000000013F664000-memory.dmp	upx
behavioral1/memory/2944-4037-0x000000013FCD0000-0x0000000140024000-memory.dmp	upx
behavioral1/memory/1736-4036-0x000000013FDE0000-0x0000000140134000-memory.dmp	upx
behavioral1/memory/2916-4025-0x000000013F730000-0x000000013FA84000-memory.dmp	upx
behavioral1/files/0x0006000000015ce3-182.dat	upx
behavioral1/files/0x0006000000015cff-187.dat	upx
behavioral1/files/0x0006000000015cd9-177.dat	upx
behavioral1/files/0x0006000000015cb6-167.dat	upx
behavioral1/files/0x0006000000015cb6-165.dat	upx
behavioral1/files/0x0006000000015cae-162.dat	upx
behavioral1/files/0x0006000000015cae-160.dat	upx
behavioral1/files/0x0006000000015c87-149.dat	upx
behavioral1/files/0x0006000000015684-147.dat	upx
behavioral1/files/0x000600000001565d-135.dat	upx
behavioral1/files/0x000600000001565d-134.dat	upx
behavioral1/files/0x0006000000015653-132.dat	upx
behavioral1/files/0x0032000000013a46-121.dat	upx
behavioral1/files/0x000600000001535e-115.dat	upx
behavioral1/files/0x0006000000014fa2-109.dat	upx
behavioral1/files/0x0006000000014e71-106.dat	upx
behavioral1/memory/1736-101-0x000000013FDE0000-0x0000000140134000-memory.dmp	upx
behavioral1/memory/1940-90-0x000000013F3A0000-0x000000013F6F4000-memory.dmp	upx
behavioral1/files/0x0006000000014a9a-82.dat	upx
behavioral1/memory/2560-69-0x000000013F750000-0x000000013FAA4000-memory.dmp	upx
behavioral1/files/0x0006000000014826-68.dat	upx
behavioral1/memory/2708-56-0x000000013FEB0000-0x0000000140204000-memory.dmp	upx
behavioral1/files/0x000600000001471a-60.dat	upx
behavioral1/files/0x0007000000014712-47.dat	upx
behavioral1/memory/2636-42-0x000000013F290000-0x000000013F5E4000-memory.dmp	upx
behavioral1/memory/2452-45-0x000000013FEF0000-0x0000000140244000-memory.dmp	upx
behavioral1/files/0x0007000000014175-33.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ClJmOhU.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\TlYcSnq.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\yjAcowc.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\hIUzFfh.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\PckfYAf.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\QYRYlrm.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\sNwfPEH.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\JBIgbiN.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\zHFDeSp.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\jbwgOkb.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\RXUzTew.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\jwXasud.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\ZGVntMi.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\oVIKTbB.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\zQEDnWN.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\EMBLCCU.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\yCBpmDf.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\rSjZeit.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\aaUKRoV.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\FdyAXyc.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\fRpYELy.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\RSQQMcc.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\xzRjPoi.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\yEiVuvF.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\xwGnjPP.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\BfIEilJ.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\nSddDAo.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\cNwuGPq.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\FOIVZen.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\NuVQByp.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\qvHMevE.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\PcPAqpR.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\CVfVlhH.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\NTGCHpW.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\grFAiyi.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\ZQwhCXK.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\IyAwJqc.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\BcQjgUC.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\sDVIQDQ.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\qjMsyZE.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\YAGgMVY.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\bNQyffx.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\wuQfyfa.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\RGJsBnH.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\xgqHojm.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\OCZjwIu.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\xHgIynw.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\GniVecT.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\trujYwl.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\TrwKSdg.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\WOjooEK.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\Fwlmttp.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\IqOyAPC.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\GciLPrF.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\fXvKMbt.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\JJaObhb.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\bILBHhh.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\CZhobdb.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\lSiJqyk.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\QdLkpVx.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\lTZYFJF.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\ynpqAAL.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\wFffnyw.exe	6e6afa169ea6557dcb5a167889db9120.exe
File created	C:\Windows\System\ZGJmlbB.exe	6e6afa169ea6557dcb5a167889db9120.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2916	1940	6e6afa169ea6557dcb5a167889db9120.exe	29
PID 1940 wrote to memory of 2916	1940	6e6afa169ea6557dcb5a167889db9120.exe	29
PID 1940 wrote to memory of 2916	1940	6e6afa169ea6557dcb5a167889db9120.exe	29
PID 1940 wrote to memory of 2368	1940	6e6afa169ea6557dcb5a167889db9120.exe	30
PID 1940 wrote to memory of 2368	1940	6e6afa169ea6557dcb5a167889db9120.exe	30
PID 1940 wrote to memory of 2368	1940	6e6afa169ea6557dcb5a167889db9120.exe	30
PID 1940 wrote to memory of 2136	1940	6e6afa169ea6557dcb5a167889db9120.exe	31
PID 1940 wrote to memory of 2136	1940	6e6afa169ea6557dcb5a167889db9120.exe	31
PID 1940 wrote to memory of 2136	1940	6e6afa169ea6557dcb5a167889db9120.exe	31
PID 1940 wrote to memory of 2576	1940	6e6afa169ea6557dcb5a167889db9120.exe	32
PID 1940 wrote to memory of 2576	1940	6e6afa169ea6557dcb5a167889db9120.exe	32
PID 1940 wrote to memory of 2576	1940	6e6afa169ea6557dcb5a167889db9120.exe	32
PID 1940 wrote to memory of 2636	1940	6e6afa169ea6557dcb5a167889db9120.exe	33
PID 1940 wrote to memory of 2636	1940	6e6afa169ea6557dcb5a167889db9120.exe	33
PID 1940 wrote to memory of 2636	1940	6e6afa169ea6557dcb5a167889db9120.exe	33
PID 1940 wrote to memory of 2452	1940	6e6afa169ea6557dcb5a167889db9120.exe	34
PID 1940 wrote to memory of 2452	1940	6e6afa169ea6557dcb5a167889db9120.exe	34
PID 1940 wrote to memory of 2452	1940	6e6afa169ea6557dcb5a167889db9120.exe	34
PID 1940 wrote to memory of 2708	1940	6e6afa169ea6557dcb5a167889db9120.exe	35
PID 1940 wrote to memory of 2708	1940	6e6afa169ea6557dcb5a167889db9120.exe	35
PID 1940 wrote to memory of 2708	1940	6e6afa169ea6557dcb5a167889db9120.exe	35
PID 1940 wrote to memory of 2472	1940	6e6afa169ea6557dcb5a167889db9120.exe	36
PID 1940 wrote to memory of 2472	1940	6e6afa169ea6557dcb5a167889db9120.exe	36
PID 1940 wrote to memory of 2472	1940	6e6afa169ea6557dcb5a167889db9120.exe	36
PID 1940 wrote to memory of 2560	1940	6e6afa169ea6557dcb5a167889db9120.exe	37
PID 1940 wrote to memory of 2560	1940	6e6afa169ea6557dcb5a167889db9120.exe	37
PID 1940 wrote to memory of 2560	1940	6e6afa169ea6557dcb5a167889db9120.exe	37
PID 1940 wrote to memory of 2476	1940	6e6afa169ea6557dcb5a167889db9120.exe	38
PID 1940 wrote to memory of 2476	1940	6e6afa169ea6557dcb5a167889db9120.exe	38
PID 1940 wrote to memory of 2476	1940	6e6afa169ea6557dcb5a167889db9120.exe	38
PID 1940 wrote to memory of 2372	1940	6e6afa169ea6557dcb5a167889db9120.exe	39
PID 1940 wrote to memory of 2372	1940	6e6afa169ea6557dcb5a167889db9120.exe	39
PID 1940 wrote to memory of 2372	1940	6e6afa169ea6557dcb5a167889db9120.exe	39
PID 1940 wrote to memory of 2944	1940	6e6afa169ea6557dcb5a167889db9120.exe	40
PID 1940 wrote to memory of 2944	1940	6e6afa169ea6557dcb5a167889db9120.exe	40
PID 1940 wrote to memory of 2944	1940	6e6afa169ea6557dcb5a167889db9120.exe	40
PID 1940 wrote to memory of 1736	1940	6e6afa169ea6557dcb5a167889db9120.exe	41
PID 1940 wrote to memory of 1736	1940	6e6afa169ea6557dcb5a167889db9120.exe	41
PID 1940 wrote to memory of 1736	1940	6e6afa169ea6557dcb5a167889db9120.exe	41
PID 1940 wrote to memory of 2688	1940	6e6afa169ea6557dcb5a167889db9120.exe	42
PID 1940 wrote to memory of 2688	1940	6e6afa169ea6557dcb5a167889db9120.exe	42
PID 1940 wrote to memory of 2688	1940	6e6afa169ea6557dcb5a167889db9120.exe	42
PID 1940 wrote to memory of 2788	1940	6e6afa169ea6557dcb5a167889db9120.exe	43
PID 1940 wrote to memory of 2788	1940	6e6afa169ea6557dcb5a167889db9120.exe	43
PID 1940 wrote to memory of 2788	1940	6e6afa169ea6557dcb5a167889db9120.exe	43
PID 1940 wrote to memory of 1664	1940	6e6afa169ea6557dcb5a167889db9120.exe	44
PID 1940 wrote to memory of 1664	1940	6e6afa169ea6557dcb5a167889db9120.exe	44
PID 1940 wrote to memory of 1664	1940	6e6afa169ea6557dcb5a167889db9120.exe	44
PID 1940 wrote to memory of 1220	1940	6e6afa169ea6557dcb5a167889db9120.exe	45
PID 1940 wrote to memory of 1220	1940	6e6afa169ea6557dcb5a167889db9120.exe	45
PID 1940 wrote to memory of 1220	1940	6e6afa169ea6557dcb5a167889db9120.exe	45
PID 1940 wrote to memory of 800	1940	6e6afa169ea6557dcb5a167889db9120.exe	46
PID 1940 wrote to memory of 800	1940	6e6afa169ea6557dcb5a167889db9120.exe	46
PID 1940 wrote to memory of 800	1940	6e6afa169ea6557dcb5a167889db9120.exe	46
PID 1940 wrote to memory of 1956	1940	6e6afa169ea6557dcb5a167889db9120.exe	47
PID 1940 wrote to memory of 1956	1940	6e6afa169ea6557dcb5a167889db9120.exe	47
PID 1940 wrote to memory of 1956	1940	6e6afa169ea6557dcb5a167889db9120.exe	47
PID 1940 wrote to memory of 2220	1940	6e6afa169ea6557dcb5a167889db9120.exe	48
PID 1940 wrote to memory of 2220	1940	6e6afa169ea6557dcb5a167889db9120.exe	48
PID 1940 wrote to memory of 2220	1940	6e6afa169ea6557dcb5a167889db9120.exe	48
PID 1940 wrote to memory of 1968	1940	6e6afa169ea6557dcb5a167889db9120.exe	49
PID 1940 wrote to memory of 1968	1940	6e6afa169ea6557dcb5a167889db9120.exe	49
PID 1940 wrote to memory of 1968	1940	6e6afa169ea6557dcb5a167889db9120.exe	49
PID 1940 wrote to memory of 908	1940	6e6afa169ea6557dcb5a167889db9120.exe	50

C:\Users\Admin\AppData\Local\Temp\6e6afa169ea6557dcb5a167889db9120.exe
"C:\Users\Admin\AppData\Local\Temp\6e6afa169ea6557dcb5a167889db9120.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\System\EKRPzFH.exe
  C:\Windows\System\EKRPzFH.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\ZPxbxEZ.exe
  C:\Windows\System\ZPxbxEZ.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\nbBbSwC.exe
  C:\Windows\System\nbBbSwC.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\fhHTzuW.exe
  C:\Windows\System\fhHTzuW.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\qNDGRTz.exe
  C:\Windows\System\qNDGRTz.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\baNZxWJ.exe
  C:\Windows\System\baNZxWJ.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\BXnpbNX.exe
  C:\Windows\System\BXnpbNX.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\QSIHidE.exe
  C:\Windows\System\QSIHidE.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\oVIKTbB.exe
  C:\Windows\System\oVIKTbB.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\QrYyBTK.exe
  C:\Windows\System\QrYyBTK.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\YmxuMPy.exe
  C:\Windows\System\YmxuMPy.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\kEJmsul.exe
  C:\Windows\System\kEJmsul.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\sYgyNmT.exe
  C:\Windows\System\sYgyNmT.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\PsjUieR.exe
  C:\Windows\System\PsjUieR.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\tQSjwCO.exe
  C:\Windows\System\tQSjwCO.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\mBocyzN.exe
  C:\Windows\System\mBocyzN.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\Nxwkcyk.exe
  C:\Windows\System\Nxwkcyk.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\BUDBZMh.exe
  C:\Windows\System\BUDBZMh.exe
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\System\VatRSiz.exe
  C:\Windows\System\VatRSiz.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\DVPtYlD.exe
  C:\Windows\System\DVPtYlD.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\ofaOkSW.exe
  C:\Windows\System\ofaOkSW.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\odLmzkr.exe
  C:\Windows\System\odLmzkr.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\tlWOOGH.exe
  C:\Windows\System\tlWOOGH.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\sAHGNit.exe
  C:\Windows\System\sAHGNit.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\FUqacbh.exe
  C:\Windows\System\FUqacbh.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\fctOcFf.exe
  C:\Windows\System\fctOcFf.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\xzdJmbf.exe
  C:\Windows\System\xzdJmbf.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\QhdooId.exe
  C:\Windows\System\QhdooId.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\khcQKJw.exe
  C:\Windows\System\khcQKJw.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\tTLThNv.exe
  C:\Windows\System\tTLThNv.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\kTRyecn.exe
  C:\Windows\System\kTRyecn.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\paLhFXu.exe
  C:\Windows\System\paLhFXu.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\qvnrgjs.exe
  C:\Windows\System\qvnrgjs.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\HOXBUeq.exe
  C:\Windows\System\HOXBUeq.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\lJwAhWK.exe
  C:\Windows\System\lJwAhWK.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\xelTnxS.exe
  C:\Windows\System\xelTnxS.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\uEFjdVU.exe
  C:\Windows\System\uEFjdVU.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\DYDXjyM.exe
  C:\Windows\System\DYDXjyM.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\PBVrHVD.exe
  C:\Windows\System\PBVrHVD.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\fGNxqIE.exe
  C:\Windows\System\fGNxqIE.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\ZQoBINe.exe
  C:\Windows\System\ZQoBINe.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\OafREQd.exe
  C:\Windows\System\OafREQd.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\ukmDaxJ.exe
  C:\Windows\System\ukmDaxJ.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\YAGgMVY.exe
  C:\Windows\System\YAGgMVY.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\dqJeFTV.exe
  C:\Windows\System\dqJeFTV.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\zLkIxwO.exe
  C:\Windows\System\zLkIxwO.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\TLLOGUc.exe
  C:\Windows\System\TLLOGUc.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\OCZjwIu.exe
  C:\Windows\System\OCZjwIu.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\JgxEqAl.exe
  C:\Windows\System\JgxEqAl.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\UadQyEN.exe
  C:\Windows\System\UadQyEN.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\aZKgfoT.exe
  C:\Windows\System\aZKgfoT.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\bXtuPMV.exe
  C:\Windows\System\bXtuPMV.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\sBuHbCU.exe
  C:\Windows\System\sBuHbCU.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\xHgIynw.exe
  C:\Windows\System\xHgIynw.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\foRpVza.exe
  C:\Windows\System\foRpVza.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\oIadbks.exe
  C:\Windows\System\oIadbks.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\qbBfzPv.exe
  C:\Windows\System\qbBfzPv.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\oJRsBrG.exe
  C:\Windows\System\oJRsBrG.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\ZILybLK.exe
  C:\Windows\System\ZILybLK.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\GXiAWiS.exe
  C:\Windows\System\GXiAWiS.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\OXmgnQl.exe
  C:\Windows\System\OXmgnQl.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\sXintYk.exe
  C:\Windows\System\sXintYk.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\sytRBqT.exe
  C:\Windows\System\sytRBqT.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\UPSgJCQ.exe
  C:\Windows\System\UPSgJCQ.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\jjHfEWb.exe
  C:\Windows\System\jjHfEWb.exe
  2⤵
  PID:2000
- C:\Windows\System\uJMqzfj.exe
  C:\Windows\System\uJMqzfj.exe
  2⤵
  PID:1460
- C:\Windows\System\UEFAMfZ.exe
  C:\Windows\System\UEFAMfZ.exe
  2⤵
  PID:1060
- C:\Windows\System\XYhMIAt.exe
  C:\Windows\System\XYhMIAt.exe
  2⤵
  PID:2392
- C:\Windows\System\VKltjxw.exe
  C:\Windows\System\VKltjxw.exe
  2⤵
  PID:1812
- C:\Windows\System\DbbatKj.exe
  C:\Windows\System\DbbatKj.exe
  2⤵
  PID:956
- C:\Windows\System\YYYNtVp.exe
  C:\Windows\System\YYYNtVp.exe
  2⤵
  PID:776
- C:\Windows\System\PMscUgh.exe
  C:\Windows\System\PMscUgh.exe
  2⤵
  PID:2412
- C:\Windows\System\VTbtqAz.exe
  C:\Windows\System\VTbtqAz.exe
  2⤵
  PID:3024
- C:\Windows\System\yqegAJN.exe
  C:\Windows\System\yqegAJN.exe
  2⤵
  PID:1804
- C:\Windows\System\rrRKpNn.exe
  C:\Windows\System\rrRKpNn.exe
  2⤵
  PID:2004
- C:\Windows\System\vxxtboY.exe
  C:\Windows\System\vxxtboY.exe
  2⤵
  PID:1636
- C:\Windows\System\pgJjdyK.exe
  C:\Windows\System\pgJjdyK.exe
  2⤵
  PID:2240
- C:\Windows\System\ClJmOhU.exe
  C:\Windows\System\ClJmOhU.exe
  2⤵
  PID:892
- C:\Windows\System\vxirxgM.exe
  C:\Windows\System\vxirxgM.exe
  2⤵
  PID:1052
- C:\Windows\System\uJSaabj.exe
  C:\Windows\System\uJSaabj.exe
  2⤵
  PID:2984
- C:\Windows\System\hxLVSUf.exe
  C:\Windows\System\hxLVSUf.exe
  2⤵
  PID:2528
- C:\Windows\System\yfWvZaY.exe
  C:\Windows\System\yfWvZaY.exe
  2⤵
  PID:2980
- C:\Windows\System\Zircvyc.exe
  C:\Windows\System\Zircvyc.exe
  2⤵
  PID:1944
- C:\Windows\System\VtLZvqA.exe
  C:\Windows\System\VtLZvqA.exe
  2⤵
  PID:1584
- C:\Windows\System\oNrjjKK.exe
  C:\Windows\System\oNrjjKK.exe
  2⤵
  PID:3004
- C:\Windows\System\wNJkwRt.exe
  C:\Windows\System\wNJkwRt.exe
  2⤵
  PID:2640
- C:\Windows\System\SSIBJJK.exe
  C:\Windows\System\SSIBJJK.exe
  2⤵
  PID:2800
- C:\Windows\System\MDHStla.exe
  C:\Windows\System\MDHStla.exe
  2⤵
  PID:2448
- C:\Windows\System\vyRHArM.exe
  C:\Windows\System\vyRHArM.exe
  2⤵
  PID:2516
- C:\Windows\System\jtkRRDU.exe
  C:\Windows\System\jtkRRDU.exe
  2⤵
  PID:2776
- C:\Windows\System\WrirBuy.exe
  C:\Windows\System\WrirBuy.exe
  2⤵
  PID:2796
- C:\Windows\System\cJyqdEi.exe
  C:\Windows\System\cJyqdEi.exe
  2⤵
  PID:1288
- C:\Windows\System\DfylnEz.exe
  C:\Windows\System\DfylnEz.exe
  2⤵
  PID:1668
- C:\Windows\System\ycmzfWg.exe
  C:\Windows\System\ycmzfWg.exe
  2⤵
  PID:2232
- C:\Windows\System\DasXwQy.exe
  C:\Windows\System\DasXwQy.exe
  2⤵
  PID:1512
- C:\Windows\System\VSwtRGo.exe
  C:\Windows\System\VSwtRGo.exe
  2⤵
  PID:1696
- C:\Windows\System\koLLZRB.exe
  C:\Windows\System\koLLZRB.exe
  2⤵
  PID:1136
- C:\Windows\System\UpElmyU.exe
  C:\Windows\System\UpElmyU.exe
  2⤵
  PID:300
- C:\Windows\System\SzKvUCH.exe
  C:\Windows\System\SzKvUCH.exe
  2⤵
  PID:2604
- C:\Windows\System\EpsdcTg.exe
  C:\Windows\System\EpsdcTg.exe
  2⤵
  PID:3044
- C:\Windows\System\MoDBWua.exe
  C:\Windows\System\MoDBWua.exe
  2⤵
  PID:2884
- C:\Windows\System\FdyAXyc.exe
  C:\Windows\System\FdyAXyc.exe
  2⤵
  PID:1284
- C:\Windows\System\ccduCYF.exe
  C:\Windows\System\ccduCYF.exe
  2⤵
  PID:2584
- C:\Windows\System\KovXdQc.exe
  C:\Windows\System\KovXdQc.exe
  2⤵
  PID:2188
- C:\Windows\System\SoCugRA.exe
  C:\Windows\System\SoCugRA.exe
  2⤵
  PID:1616
- C:\Windows\System\eDluyia.exe
  C:\Windows\System\eDluyia.exe
  2⤵
  PID:1600
- C:\Windows\System\AkWnKOP.exe
  C:\Windows\System\AkWnKOP.exe
  2⤵
  PID:2712
- C:\Windows\System\YyNxtqE.exe
  C:\Windows\System\YyNxtqE.exe
  2⤵
  PID:2500
- C:\Windows\System\urdriVK.exe
  C:\Windows\System\urdriVK.exe
  2⤵
  PID:2768
- C:\Windows\System\XeZgzyy.exe
  C:\Windows\System\XeZgzyy.exe
  2⤵
  PID:2332
- C:\Windows\System\RnJvKXy.exe
  C:\Windows\System\RnJvKXy.exe
  2⤵
  PID:1924
- C:\Windows\System\HlXoCjt.exe
  C:\Windows\System\HlXoCjt.exe
  2⤵
  PID:2868
- C:\Windows\System\bnxRYmr.exe
  C:\Windows\System\bnxRYmr.exe
  2⤵
  PID:2152
- C:\Windows\System\BjfTmsc.exe
  C:\Windows\System\BjfTmsc.exe
  2⤵
  PID:3032
- C:\Windows\System\ueagxOr.exe
  C:\Windows\System\ueagxOr.exe
  2⤵
  PID:1392
- C:\Windows\System\oLivKyh.exe
  C:\Windows\System\oLivKyh.exe
  2⤵
  PID:2840
- C:\Windows\System\RCvDMWV.exe
  C:\Windows\System\RCvDMWV.exe
  2⤵
  PID:848
- C:\Windows\System\AKHhPhg.exe
  C:\Windows\System\AKHhPhg.exe
  2⤵
  PID:1292
- C:\Windows\System\BjbpOci.exe
  C:\Windows\System\BjbpOci.exe
  2⤵
  PID:2968
- C:\Windows\System\QDkuIER.exe
  C:\Windows\System\QDkuIER.exe
  2⤵
  PID:2596
- C:\Windows\System\tqMClSX.exe
  C:\Windows\System\tqMClSX.exe
  2⤵
  PID:1880
- C:\Windows\System\Fwlmttp.exe
  C:\Windows\System\Fwlmttp.exe
  2⤵
  PID:1300
- C:\Windows\System\FKgqZxO.exe
  C:\Windows\System\FKgqZxO.exe
  2⤵
  PID:1952
- C:\Windows\System\fJmoxwf.exe
  C:\Windows\System\fJmoxwf.exe
  2⤵
  PID:756
- C:\Windows\System\xxqSOVP.exe
  C:\Windows\System\xxqSOVP.exe
  2⤵
  PID:2580
- C:\Windows\System\imnxlYB.exe
  C:\Windows\System\imnxlYB.exe
  2⤵
  PID:1608
- C:\Windows\System\VhaqHLM.exe
  C:\Windows\System\VhaqHLM.exe
  2⤵
  PID:1868
- C:\Windows\System\tdoYEsC.exe
  C:\Windows\System\tdoYEsC.exe
  2⤵
  PID:2684
- C:\Windows\System\VfJIRQn.exe
  C:\Windows\System\VfJIRQn.exe
  2⤵
  PID:1640
- C:\Windows\System\GVcTuMB.exe
  C:\Windows\System\GVcTuMB.exe
  2⤵
  PID:1500
- C:\Windows\System\JShEUAB.exe
  C:\Windows\System\JShEUAB.exe
  2⤵
  PID:2416
- C:\Windows\System\kzOqgTd.exe
  C:\Windows\System\kzOqgTd.exe
  2⤵
  PID:3076
- C:\Windows\System\BBcSrCD.exe
  C:\Windows\System\BBcSrCD.exe
  2⤵
  PID:3100
- C:\Windows\System\swwCpDp.exe
  C:\Windows\System\swwCpDp.exe
  2⤵
  PID:3128
- C:\Windows\System\ZZshqWQ.exe
  C:\Windows\System\ZZshqWQ.exe
  2⤵
  PID:3148
- C:\Windows\System\SXwjZuo.exe
  C:\Windows\System\SXwjZuo.exe
  2⤵
  PID:3164
- C:\Windows\System\fRpYELy.exe
  C:\Windows\System\fRpYELy.exe
  2⤵
  PID:3180
- C:\Windows\System\LllgNiH.exe
  C:\Windows\System\LllgNiH.exe
  2⤵
  PID:3200
- C:\Windows\System\LsSRbqe.exe
  C:\Windows\System\LsSRbqe.exe
  2⤵
  PID:3216
- C:\Windows\System\XZQhKDl.exe
  C:\Windows\System\XZQhKDl.exe
  2⤵
  PID:3232
- C:\Windows\System\SCTWjqj.exe
  C:\Windows\System\SCTWjqj.exe
  2⤵
  PID:3248
- C:\Windows\System\TilUBNp.exe
  C:\Windows\System\TilUBNp.exe
  2⤵
  PID:3268
- C:\Windows\System\UlMcFkI.exe
  C:\Windows\System\UlMcFkI.exe
  2⤵
  PID:3284
- C:\Windows\System\CCNKgrz.exe
  C:\Windows\System\CCNKgrz.exe
  2⤵
  PID:3308
- C:\Windows\System\DBILMrQ.exe
  C:\Windows\System\DBILMrQ.exe
  2⤵
  PID:3364
- C:\Windows\System\XwhodLB.exe
  C:\Windows\System\XwhodLB.exe
  2⤵
  PID:3384
- C:\Windows\System\kkqBmag.exe
  C:\Windows\System\kkqBmag.exe
  2⤵
  PID:3404
- C:\Windows\System\FBBWWhe.exe
  C:\Windows\System\FBBWWhe.exe
  2⤵
  PID:3424
- C:\Windows\System\zQEDnWN.exe
  C:\Windows\System\zQEDnWN.exe
  2⤵
  PID:3444
- C:\Windows\System\FEyZQvc.exe
  C:\Windows\System\FEyZQvc.exe
  2⤵
  PID:3464
- C:\Windows\System\YjxHYgK.exe
  C:\Windows\System\YjxHYgK.exe
  2⤵
  PID:3484
- C:\Windows\System\EMTlzbD.exe
  C:\Windows\System\EMTlzbD.exe
  2⤵
  PID:3504
- C:\Windows\System\yjAcowc.exe
  C:\Windows\System\yjAcowc.exe
  2⤵
  PID:3524
- C:\Windows\System\ifzFgpg.exe
  C:\Windows\System\ifzFgpg.exe
  2⤵
  PID:3544
- C:\Windows\System\IbPCaEP.exe
  C:\Windows\System\IbPCaEP.exe
  2⤵
  PID:3564
- C:\Windows\System\tcFXqKj.exe
  C:\Windows\System\tcFXqKj.exe
  2⤵
  PID:3584
- C:\Windows\System\kqEPaHx.exe
  C:\Windows\System\kqEPaHx.exe
  2⤵
  PID:3604
- C:\Windows\System\sgfrFZF.exe
  C:\Windows\System\sgfrFZF.exe
  2⤵
  PID:3624
- C:\Windows\System\HdHVtlF.exe
  C:\Windows\System\HdHVtlF.exe
  2⤵
  PID:3644
- C:\Windows\System\wwKYnYj.exe
  C:\Windows\System\wwKYnYj.exe
  2⤵
  PID:3664
- C:\Windows\System\NktopMc.exe
  C:\Windows\System\NktopMc.exe
  2⤵
  PID:3684
- C:\Windows\System\oZGHipd.exe
  C:\Windows\System\oZGHipd.exe
  2⤵
  PID:3704
- C:\Windows\System\DOMUQeX.exe
  C:\Windows\System\DOMUQeX.exe
  2⤵
  PID:3724
- C:\Windows\System\IkKfgTW.exe
  C:\Windows\System\IkKfgTW.exe
  2⤵
  PID:3744
- C:\Windows\System\BdyBsjj.exe
  C:\Windows\System\BdyBsjj.exe
  2⤵
  PID:3764
- C:\Windows\System\JsVVuMN.exe
  C:\Windows\System\JsVVuMN.exe
  2⤵
  PID:3784
- C:\Windows\System\ezVoJQk.exe
  C:\Windows\System\ezVoJQk.exe
  2⤵
  PID:3804
- C:\Windows\System\owOXnML.exe
  C:\Windows\System\owOXnML.exe
  2⤵
  PID:3824
- C:\Windows\System\dUbvgqI.exe
  C:\Windows\System\dUbvgqI.exe
  2⤵
  PID:3844
- C:\Windows\System\dloSqrO.exe
  C:\Windows\System\dloSqrO.exe
  2⤵
  PID:3864
- C:\Windows\System\FYzQfHE.exe
  C:\Windows\System\FYzQfHE.exe
  2⤵
  PID:3884
- C:\Windows\System\govXacU.exe
  C:\Windows\System\govXacU.exe
  2⤵
  PID:3904
- C:\Windows\System\DtlXRJv.exe
  C:\Windows\System\DtlXRJv.exe
  2⤵
  PID:3924
- C:\Windows\System\VEFQJFT.exe
  C:\Windows\System\VEFQJFT.exe
  2⤵
  PID:3944
- C:\Windows\System\InlfWDb.exe
  C:\Windows\System\InlfWDb.exe
  2⤵
  PID:3960
- C:\Windows\System\RoSXmWa.exe
  C:\Windows\System\RoSXmWa.exe
  2⤵
  PID:3980
- C:\Windows\System\MOfXNim.exe
  C:\Windows\System\MOfXNim.exe
  2⤵
  PID:4000
- C:\Windows\System\GcNBTzl.exe
  C:\Windows\System\GcNBTzl.exe
  2⤵
  PID:4016
- C:\Windows\System\xszjJLi.exe
  C:\Windows\System\xszjJLi.exe
  2⤵
  PID:4032
- C:\Windows\System\vvhoRtB.exe
  C:\Windows\System\vvhoRtB.exe
  2⤵
  PID:4048
- C:\Windows\System\CTZuLey.exe
  C:\Windows\System\CTZuLey.exe
  2⤵
  PID:4084
- C:\Windows\System\glRTHgx.exe
  C:\Windows\System\glRTHgx.exe
  2⤵
  PID:3056
- C:\Windows\System\EBLGjei.exe
  C:\Windows\System\EBLGjei.exe
  2⤵
  PID:2124
- C:\Windows\System\HcqKfMA.exe
  C:\Windows\System\HcqKfMA.exe
  2⤵
  PID:3088
- C:\Windows\System\mBCxmND.exe
  C:\Windows\System\mBCxmND.exe
  2⤵
  PID:1712
- C:\Windows\System\CFIWHru.exe
  C:\Windows\System\CFIWHru.exe
  2⤵
  PID:452
- C:\Windows\System\UNjJNOc.exe
  C:\Windows\System\UNjJNOc.exe
  2⤵
  PID:3124
- C:\Windows\System\RSQQMcc.exe
  C:\Windows\System\RSQQMcc.exe
  2⤵
  PID:3140
- C:\Windows\System\apmRaeU.exe
  C:\Windows\System\apmRaeU.exe
  2⤵
  PID:3176
- C:\Windows\System\xcQXIdD.exe
  C:\Windows\System\xcQXIdD.exe
  2⤵
  PID:3244
- C:\Windows\System\ZzqMoEC.exe
  C:\Windows\System\ZzqMoEC.exe
  2⤵
  PID:3196
- C:\Windows\System\OBKhViH.exe
  C:\Windows\System\OBKhViH.exe
  2⤵
  PID:3292
- C:\Windows\System\wXwcyws.exe
  C:\Windows\System\wXwcyws.exe
  2⤵
  PID:3332
- C:\Windows\System\JFcZrhU.exe
  C:\Windows\System\JFcZrhU.exe
  2⤵
  PID:1980
- C:\Windows\System\dBKGVKx.exe
  C:\Windows\System\dBKGVKx.exe
  2⤵
  PID:2408
- C:\Windows\System\TmloHjC.exe
  C:\Windows\System\TmloHjC.exe
  2⤵
  PID:3392
- C:\Windows\System\AZHVJCC.exe
  C:\Windows\System\AZHVJCC.exe
  2⤵
  PID:3420
- C:\Windows\System\OvYLANs.exe
  C:\Windows\System\OvYLANs.exe
  2⤵
  PID:3436
- C:\Windows\System\oVbanxD.exe
  C:\Windows\System\oVbanxD.exe
  2⤵
  PID:3472
- C:\Windows\System\cLlUbfz.exe
  C:\Windows\System\cLlUbfz.exe
  2⤵
  PID:2836
- C:\Windows\System\ThFLVyp.exe
  C:\Windows\System\ThFLVyp.exe
  2⤵
  PID:3516
- C:\Windows\System\oaELvno.exe
  C:\Windows\System\oaELvno.exe
  2⤵
  PID:3552
- C:\Windows\System\uUnKjKU.exe
  C:\Windows\System\uUnKjKU.exe
  2⤵
  PID:3600
- C:\Windows\System\EjNopjd.exe
  C:\Windows\System\EjNopjd.exe
  2⤵
  PID:3616
- C:\Windows\System\XMeLCYe.exe
  C:\Windows\System\XMeLCYe.exe
  2⤵
  PID:1628
- C:\Windows\System\yhMGRbq.exe
  C:\Windows\System\yhMGRbq.exe
  2⤵
  PID:3672
- C:\Windows\System\hkBVdBA.exe
  C:\Windows\System\hkBVdBA.exe
  2⤵
  PID:3692
- C:\Windows\System\hEkEDFW.exe
  C:\Windows\System\hEkEDFW.exe
  2⤵
  PID:3720
- C:\Windows\System\qLTxdwo.exe
  C:\Windows\System\qLTxdwo.exe
  2⤵
  PID:3752
- C:\Windows\System\IqOyAPC.exe
  C:\Windows\System\IqOyAPC.exe
  2⤵
  PID:3776
- C:\Windows\System\YWFRuJO.exe
  C:\Windows\System\YWFRuJO.exe
  2⤵
  PID:3820
- C:\Windows\System\aMODVEt.exe
  C:\Windows\System\aMODVEt.exe
  2⤵
  PID:3836
- C:\Windows\System\GMzYBNL.exe
  C:\Windows\System\GMzYBNL.exe
  2⤵
  PID:3872
- C:\Windows\System\BGVzICj.exe
  C:\Windows\System\BGVzICj.exe
  2⤵
  PID:3896
- C:\Windows\System\NTcmrtC.exe
  C:\Windows\System\NTcmrtC.exe
  2⤵
  PID:3940
- C:\Windows\System\bNQyffx.exe
  C:\Windows\System\bNQyffx.exe
  2⤵
  PID:3968
- C:\Windows\System\QMVhwiB.exe
  C:\Windows\System\QMVhwiB.exe
  2⤵
  PID:3996
- C:\Windows\System\deYklqf.exe
  C:\Windows\System\deYklqf.exe
  2⤵
  PID:4056
- C:\Windows\System\dQmDhxa.exe
  C:\Windows\System\dQmDhxa.exe
  2⤵
  PID:4012
- C:\Windows\System\EvnpyUh.exe
  C:\Windows\System\EvnpyUh.exe
  2⤵
  PID:3096
- C:\Windows\System\OKmArJF.exe
  C:\Windows\System\OKmArJF.exe
  2⤵
  PID:320
- C:\Windows\System\kEnvupb.exe
  C:\Windows\System\kEnvupb.exe
  2⤵
  PID:2512
- C:\Windows\System\lXvDKLG.exe
  C:\Windows\System\lXvDKLG.exe
  2⤵
  PID:3276
- C:\Windows\System\HuAcbpu.exe
  C:\Windows\System\HuAcbpu.exe
  2⤵
  PID:3192
- C:\Windows\System\GniVecT.exe
  C:\Windows\System\GniVecT.exe
  2⤵
  PID:3316
- C:\Windows\System\DGVnULU.exe
  C:\Windows\System\DGVnULU.exe
  2⤵
  PID:3260
- C:\Windows\System\fpfqmMO.exe
  C:\Windows\System\fpfqmMO.exe
  2⤵
  PID:3344
- C:\Windows\System\KdSxrQJ.exe
  C:\Windows\System\KdSxrQJ.exe
  2⤵
  PID:3360
- C:\Windows\System\BzSLNHv.exe
  C:\Windows\System\BzSLNHv.exe
  2⤵
  PID:332
- C:\Windows\System\DrFqJyb.exe
  C:\Windows\System\DrFqJyb.exe
  2⤵
  PID:3460
- C:\Windows\System\NcSfrNU.exe
  C:\Windows\System\NcSfrNU.exe
  2⤵
  PID:3456
- C:\Windows\System\XhJVafA.exe
  C:\Windows\System\XhJVafA.exe
  2⤵
  PID:3432
- C:\Windows\System\KSzUMYL.exe
  C:\Windows\System\KSzUMYL.exe
  2⤵
  PID:3540
- C:\Windows\System\IoLXDaw.exe
  C:\Windows\System\IoLXDaw.exe
  2⤵
  PID:3572
- C:\Windows\System\WWNwGLf.exe
  C:\Windows\System\WWNwGLf.exe
  2⤵
  PID:3636
- C:\Windows\System\DwkdCyh.exe
  C:\Windows\System\DwkdCyh.exe
  2⤵
  PID:3736
- C:\Windows\System\XslKpFd.exe
  C:\Windows\System\XslKpFd.exe
  2⤵
  PID:3796
- C:\Windows\System\MVjASFc.exe
  C:\Windows\System\MVjASFc.exe
  2⤵
  PID:3972
- C:\Windows\System\kJbEiZq.exe
  C:\Windows\System\kJbEiZq.exe
  2⤵
  PID:4040
- C:\Windows\System\qteAIUm.exe
  C:\Windows\System\qteAIUm.exe
  2⤵
  PID:4080
- C:\Windows\System\OAEduct.exe
  C:\Windows\System\OAEduct.exe
  2⤵
  PID:1208
- C:\Windows\System\bSoMLNM.exe
  C:\Windows\System\bSoMLNM.exe
  2⤵
  PID:3512
- C:\Windows\System\knoXmLr.exe
  C:\Windows\System\knoXmLr.exe
  2⤵
  PID:3492
- C:\Windows\System\XNoZrmi.exe
  C:\Windows\System\XNoZrmi.exe
  2⤵
  PID:3576
- C:\Windows\System\nqEjUwZ.exe
  C:\Windows\System\nqEjUwZ.exe
  2⤵
  PID:3856
- C:\Windows\System\OyaxDvf.exe
  C:\Windows\System\OyaxDvf.exe
  2⤵
  PID:3116
- C:\Windows\System\prBjEFf.exe
  C:\Windows\System\prBjEFf.exe
  2⤵
  PID:3656
- C:\Windows\System\LfJsvua.exe
  C:\Windows\System\LfJsvua.exe
  2⤵
  PID:3756
- C:\Windows\System\szagcGQ.exe
  C:\Windows\System\szagcGQ.exe
  2⤵
  PID:3840
- C:\Windows\System\raRkXHC.exe
  C:\Windows\System\raRkXHC.exe
  2⤵
  PID:2468
- C:\Windows\System\nFtBCjJ.exe
  C:\Windows\System\nFtBCjJ.exe
  2⤵
  PID:3520
- C:\Windows\System\lWhLWBO.exe
  C:\Windows\System\lWhLWBO.exe
  2⤵
  PID:3932
- C:\Windows\System\wFffnyw.exe
  C:\Windows\System\wFffnyw.exe
  2⤵
  PID:1064
- C:\Windows\System\egvVLbO.exe
  C:\Windows\System\egvVLbO.exe
  2⤵
  PID:3340
- C:\Windows\System\mBsmAfc.exe
  C:\Windows\System\mBsmAfc.exe
  2⤵
  PID:3860
- C:\Windows\System\feEJzyb.exe
  C:\Windows\System\feEJzyb.exe
  2⤵
  PID:3652
- C:\Windows\System\wBnpmUh.exe
  C:\Windows\System\wBnpmUh.exe
  2⤵
  PID:3188
- C:\Windows\System\BbVaOYz.exe
  C:\Windows\System\BbVaOYz.exe
  2⤵
  PID:3740
- C:\Windows\System\VGYKImr.exe
  C:\Windows\System\VGYKImr.exe
  2⤵
  PID:4060
- C:\Windows\System\IvbmvBr.exe
  C:\Windows\System\IvbmvBr.exe
  2⤵
  PID:636
- C:\Windows\System\amzOUJC.exe
  C:\Windows\System\amzOUJC.exe
  2⤵
  PID:2612
- C:\Windows\System\vJaoaQk.exe
  C:\Windows\System\vJaoaQk.exe
  2⤵
  PID:3592
- C:\Windows\System\BoYfjgL.exe
  C:\Windows\System\BoYfjgL.exe
  2⤵
  PID:3380
- C:\Windows\System\rseLLvv.exe
  C:\Windows\System\rseLLvv.exe
  2⤵
  PID:4112
- C:\Windows\System\dNNiXzW.exe
  C:\Windows\System\dNNiXzW.exe
  2⤵
  PID:4128
- C:\Windows\System\UITnUmM.exe
  C:\Windows\System\UITnUmM.exe
  2⤵
  PID:4144
- C:\Windows\System\pgZJxVV.exe
  C:\Windows\System\pgZJxVV.exe
  2⤵
  PID:4160
- C:\Windows\System\AxlQvFb.exe
  C:\Windows\System\AxlQvFb.exe
  2⤵
  PID:4176
- C:\Windows\System\HUVuHFo.exe
  C:\Windows\System\HUVuHFo.exe
  2⤵
  PID:4192
- C:\Windows\System\CkecoFb.exe
  C:\Windows\System\CkecoFb.exe
  2⤵
  PID:4208
- C:\Windows\System\ZGJmlbB.exe
  C:\Windows\System\ZGJmlbB.exe
  2⤵
  PID:4224
- C:\Windows\System\oTzoHCf.exe
  C:\Windows\System\oTzoHCf.exe
  2⤵
  PID:4240
- C:\Windows\System\gQOviqG.exe
  C:\Windows\System\gQOviqG.exe
  2⤵
  PID:4256
- C:\Windows\System\kkbqQvB.exe
  C:\Windows\System\kkbqQvB.exe
  2⤵
  PID:4272
- C:\Windows\System\DOcWxfe.exe
  C:\Windows\System\DOcWxfe.exe
  2⤵
  PID:4288
- C:\Windows\System\WuqkDFw.exe
  C:\Windows\System\WuqkDFw.exe
  2⤵
  PID:4304
- C:\Windows\System\QBWckrD.exe
  C:\Windows\System\QBWckrD.exe
  2⤵
  PID:4320
- C:\Windows\System\tDftsrb.exe
  C:\Windows\System\tDftsrb.exe
  2⤵
  PID:4336
- C:\Windows\System\jOGhhHX.exe
  C:\Windows\System\jOGhhHX.exe
  2⤵
  PID:4356
- C:\Windows\System\iUicYLv.exe
  C:\Windows\System\iUicYLv.exe
  2⤵
  PID:4380
- C:\Windows\System\fAVeHBW.exe
  C:\Windows\System\fAVeHBW.exe
  2⤵
  PID:4396
- C:\Windows\System\PSYxcig.exe
  C:\Windows\System\PSYxcig.exe
  2⤵
  PID:4412
- C:\Windows\System\ejdOVlF.exe
  C:\Windows\System\ejdOVlF.exe
  2⤵
  PID:4436
- C:\Windows\System\tkIzusA.exe
  C:\Windows\System\tkIzusA.exe
  2⤵
  PID:4472
- C:\Windows\System\TzuWmzY.exe
  C:\Windows\System\TzuWmzY.exe
  2⤵
  PID:4556
- C:\Windows\System\KahDnta.exe
  C:\Windows\System\KahDnta.exe
  2⤵
  PID:4576
- C:\Windows\System\tcDpeOX.exe
  C:\Windows\System\tcDpeOX.exe
  2⤵
  PID:4596
- C:\Windows\System\qSnroBX.exe
  C:\Windows\System\qSnroBX.exe
  2⤵
  PID:4616
- C:\Windows\System\GdqeZpq.exe
  C:\Windows\System\GdqeZpq.exe
  2⤵
  PID:4632
- C:\Windows\System\KkoBLEd.exe
  C:\Windows\System\KkoBLEd.exe
  2⤵
  PID:4652
- C:\Windows\System\zmjnWiP.exe
  C:\Windows\System\zmjnWiP.exe
  2⤵
  PID:4668
- C:\Windows\System\FCOTqms.exe
  C:\Windows\System\FCOTqms.exe
  2⤵
  PID:4684
- C:\Windows\System\aTqzWdU.exe
  C:\Windows\System\aTqzWdU.exe
  2⤵
  PID:4704
- C:\Windows\System\uFhPQuN.exe
  C:\Windows\System\uFhPQuN.exe
  2⤵
  PID:4720
- C:\Windows\System\zxLqxno.exe
  C:\Windows\System\zxLqxno.exe
  2⤵
  PID:4740
- C:\Windows\System\cHcFGkc.exe
  C:\Windows\System\cHcFGkc.exe
  2⤵
  PID:4772
- C:\Windows\System\UnSlfDU.exe
  C:\Windows\System\UnSlfDU.exe
  2⤵
  PID:4788
- C:\Windows\System\iNTrWFw.exe
  C:\Windows\System\iNTrWFw.exe
  2⤵
  PID:4808
- C:\Windows\System\fRDSLVh.exe
  C:\Windows\System\fRDSLVh.exe
  2⤵
  PID:4828
- C:\Windows\System\rHbbaab.exe
  C:\Windows\System\rHbbaab.exe
  2⤵
  PID:4848
- C:\Windows\System\HoLqnoP.exe
  C:\Windows\System\HoLqnoP.exe
  2⤵
  PID:4864
- C:\Windows\System\BtptSne.exe
  C:\Windows\System\BtptSne.exe
  2⤵
  PID:4880
- C:\Windows\System\HjopVfN.exe
  C:\Windows\System\HjopVfN.exe
  2⤵
  PID:4896
- C:\Windows\System\mjqDUFd.exe
  C:\Windows\System\mjqDUFd.exe
  2⤵
  PID:4912
- C:\Windows\System\uFcfnSQ.exe
  C:\Windows\System\uFcfnSQ.exe
  2⤵
  PID:4928
- C:\Windows\System\PZjCnSX.exe
  C:\Windows\System\PZjCnSX.exe
  2⤵
  PID:4944
- C:\Windows\System\nXeNtPL.exe
  C:\Windows\System\nXeNtPL.exe
  2⤵
  PID:4960
- C:\Windows\System\dPEiVnv.exe
  C:\Windows\System\dPEiVnv.exe
  2⤵
  PID:4976
- C:\Windows\System\HiLJWCi.exe
  C:\Windows\System\HiLJWCi.exe
  2⤵
  PID:4992
- C:\Windows\System\WDJjfZd.exe
  C:\Windows\System\WDJjfZd.exe
  2⤵
  PID:5012
- C:\Windows\System\IvSsEuo.exe
  C:\Windows\System\IvSsEuo.exe
  2⤵
  PID:5032
- C:\Windows\System\VGJUxAH.exe
  C:\Windows\System\VGJUxAH.exe
  2⤵
  PID:5052
- C:\Windows\System\kwBnxbK.exe
  C:\Windows\System\kwBnxbK.exe
  2⤵
  PID:5068
- C:\Windows\System\DVSIQrM.exe
  C:\Windows\System\DVSIQrM.exe
  2⤵
  PID:5088
- C:\Windows\System\NuVQByp.exe
  C:\Windows\System\NuVQByp.exe
  2⤵
  PID:5104
- C:\Windows\System\CNxDEwh.exe
  C:\Windows\System\CNxDEwh.exe
  2⤵
  PID:3620
- C:\Windows\System\xzRjPoi.exe
  C:\Windows\System\xzRjPoi.exe
  2⤵
  PID:3496
- C:\Windows\System\FYVEWHl.exe
  C:\Windows\System\FYVEWHl.exe
  2⤵
  PID:2460
- C:\Windows\System\AZpINig.exe
  C:\Windows\System\AZpINig.exe
  2⤵
  PID:3372
- C:\Windows\System\sQnvXWF.exe
  C:\Windows\System\sQnvXWF.exe
  2⤵
  PID:3300
- C:\Windows\System\nLwShOv.exe
  C:\Windows\System\nLwShOv.exe
  2⤵
  PID:4156
- C:\Windows\System\QVaBCHL.exe
  C:\Windows\System\QVaBCHL.exe
  2⤵
  PID:4248
- C:\Windows\System\tDaQoVo.exe
  C:\Windows\System\tDaQoVo.exe
  2⤵
  PID:4392
- C:\Windows\System\qvHMevE.exe
  C:\Windows\System\qvHMevE.exe
  2⤵
  PID:4420
- C:\Windows\System\AUXRZAZ.exe
  C:\Windows\System\AUXRZAZ.exe
  2⤵
  PID:4480
- C:\Windows\System\pnvdhwo.exe
  C:\Windows\System\pnvdhwo.exe
  2⤵
  PID:2732
- C:\Windows\System\PWQMjtT.exe
  C:\Windows\System\PWQMjtT.exe
  2⤵
  PID:4528
- C:\Windows\System\APYcoej.exe
  C:\Windows\System\APYcoej.exe
  2⤵
  PID:4544
- C:\Windows\System\EMOdXFm.exe
  C:\Windows\System\EMOdXFm.exe
  2⤵
  PID:4092
- C:\Windows\System\JTsOZgq.exe
  C:\Windows\System\JTsOZgq.exe
  2⤵
  PID:4140
- C:\Windows\System\nBXyMXc.exe
  C:\Windows\System\nBXyMXc.exe
  2⤵
  PID:4264
- C:\Windows\System\cOnAUfB.exe
  C:\Windows\System\cOnAUfB.exe
  2⤵
  PID:4492
- C:\Windows\System\zBAAKaZ.exe
  C:\Windows\System\zBAAKaZ.exe
  2⤵
  PID:4372
- C:\Windows\System\kGbaqJq.exe
  C:\Windows\System\kGbaqJq.exe
  2⤵
  PID:4448
- C:\Windows\System\akQvMWu.exe
  C:\Windows\System\akQvMWu.exe
  2⤵
  PID:4464
- C:\Windows\System\iEQeGPT.exe
  C:\Windows\System\iEQeGPT.exe
  2⤵
  PID:2740
- C:\Windows\System\iVShawU.exe
  C:\Windows\System\iVShawU.exe
  2⤵
  PID:4584
- C:\Windows\System\gIYZleC.exe
  C:\Windows\System\gIYZleC.exe
  2⤵
  PID:4660
- C:\Windows\System\dyBxwQK.exe
  C:\Windows\System\dyBxwQK.exe
  2⤵
  PID:4700
- C:\Windows\System\GLwetPg.exe
  C:\Windows\System\GLwetPg.exe
  2⤵
  PID:4608
- C:\Windows\System\uztKioC.exe
  C:\Windows\System\uztKioC.exe
  2⤵
  PID:4676
- C:\Windows\System\ELvvvpQ.exe
  C:\Windows\System\ELvvvpQ.exe
  2⤵
  PID:4780
- C:\Windows\System\mAXsXWB.exe
  C:\Windows\System\mAXsXWB.exe
  2⤵
  PID:4756
- C:\Windows\System\dwoFvfj.exe
  C:\Windows\System\dwoFvfj.exe
  2⤵
  PID:4860
- C:\Windows\System\fiTPGVc.exe
  C:\Windows\System\fiTPGVc.exe
  2⤵
  PID:4924
- C:\Windows\System\dHOAoir.exe
  C:\Windows\System\dHOAoir.exe
  2⤵
  PID:4988
- C:\Windows\System\aykcykK.exe
  C:\Windows\System\aykcykK.exe
  2⤵
  PID:5096
- C:\Windows\System\nxHpqRb.exe
  C:\Windows\System\nxHpqRb.exe
  2⤵
  PID:4152
- C:\Windows\System\UFyLuLN.exe
  C:\Windows\System\UFyLuLN.exe
  2⤵
  PID:5080
- C:\Windows\System\trujYwl.exe
  C:\Windows\System\trujYwl.exe
  2⤵
  PID:3228
- C:\Windows\System\DstXjrA.exe
  C:\Windows\System\DstXjrA.exe
  2⤵
  PID:4188
- C:\Windows\System\YGSIWIi.exe
  C:\Windows\System\YGSIWIi.exe
  2⤵
  PID:4760
- C:\Windows\System\jLBLBza.exe
  C:\Windows\System\jLBLBza.exe
  2⤵
  PID:4968
- C:\Windows\System\hnwBMtR.exe
  C:\Windows\System\hnwBMtR.exe
  2⤵
  PID:4872
- C:\Windows\System\GYsSrHb.exe
  C:\Windows\System\GYsSrHb.exe
  2⤵
  PID:4344
- C:\Windows\System\rGPtBlg.exe
  C:\Windows\System\rGPtBlg.exe
  2⤵
  PID:4432
- C:\Windows\System\yEiVuvF.exe
  C:\Windows\System\yEiVuvF.exe
  2⤵
  PID:2792
- C:\Windows\System\zCXYWzf.exe
  C:\Windows\System\zCXYWzf.exe
  2⤵
  PID:3304
- C:\Windows\System\GBWdbeF.exe
  C:\Windows\System\GBWdbeF.exe
  2⤵
  PID:1424
- C:\Windows\System\yKJkcNj.exe
  C:\Windows\System\yKJkcNj.exe
  2⤵
  PID:4488
- C:\Windows\System\AMrmlUR.exe
  C:\Windows\System\AMrmlUR.exe
  2⤵
  PID:4524
- C:\Windows\System\sLkcSnE.exe
  C:\Windows\System\sLkcSnE.exe
  2⤵
  PID:4172
- C:\Windows\System\jJyKxDO.exe
  C:\Windows\System\jJyKxDO.exe
  2⤵
  PID:2540
- C:\Windows\System\EOZZert.exe
  C:\Windows\System\EOZZert.exe
  2⤵
  PID:4456
- C:\Windows\System\rOlwaWn.exe
  C:\Windows\System\rOlwaWn.exe
  2⤵
  PID:4136
- C:\Windows\System\AFUVfFF.exe
  C:\Windows\System\AFUVfFF.exe
  2⤵
  PID:4300
- C:\Windows\System\rIALMHF.exe
  C:\Windows\System\rIALMHF.exe
  2⤵
  PID:4404
- C:\Windows\System\WaKhxdi.exe
  C:\Windows\System\WaKhxdi.exe
  2⤵
  PID:4588
- C:\Windows\System\AxmNQdR.exe
  C:\Windows\System\AxmNQdR.exe
  2⤵
  PID:4644
- C:\Windows\System\eqvJCao.exe
  C:\Windows\System\eqvJCao.exe
  2⤵
  PID:4816
- C:\Windows\System\ZYNmmpa.exe
  C:\Windows\System\ZYNmmpa.exe
  2⤵
  PID:5028
- C:\Windows\System\VXAHXNq.exe
  C:\Windows\System\VXAHXNq.exe
  2⤵
  PID:4612
- C:\Windows\System\XqHCCDX.exe
  C:\Windows\System\XqHCCDX.exe
  2⤵
  PID:4800
- C:\Windows\System\LLLpWzM.exe
  C:\Windows\System\LLLpWzM.exe
  2⤵
  PID:3832
- C:\Windows\System\ADSQrrO.exe
  C:\Windows\System\ADSQrrO.exe
  2⤵
  PID:4124
- C:\Windows\System\IquCdkv.exe
  C:\Windows\System\IquCdkv.exe
  2⤵
  PID:5048
- C:\Windows\System\hNfaBGs.exe
  C:\Windows\System\hNfaBGs.exe
  2⤵
  PID:4680
- C:\Windows\System\jNcSnGp.exe
  C:\Windows\System\jNcSnGp.exe
  2⤵
  PID:3396
- C:\Windows\System\HAhoxVr.exe
  C:\Windows\System\HAhoxVr.exe
  2⤵
  PID:4220
- C:\Windows\System\hIUzFfh.exe
  C:\Windows\System\hIUzFfh.exe
  2⤵
  PID:4508
- C:\Windows\System\xWDFHKP.exe
  C:\Windows\System\xWDFHKP.exe
  2⤵
  PID:3556
- C:\Windows\System\JXpSQfc.exe
  C:\Windows\System\JXpSQfc.exe
  2⤵
  PID:3676
- C:\Windows\System\BRkWMTk.exe
  C:\Windows\System\BRkWMTk.exe
  2⤵
  PID:4332
- C:\Windows\System\oUXbdFe.exe
  C:\Windows\System\oUXbdFe.exe
  2⤵
  PID:4444
- C:\Windows\System\rkUvFUd.exe
  C:\Windows\System\rkUvFUd.exe
  2⤵
  PID:4736
- C:\Windows\System\qxsfYFX.exe
  C:\Windows\System\qxsfYFX.exe
  2⤵
  PID:4368
- C:\Windows\System\QKtgGnT.exe
  C:\Windows\System\QKtgGnT.exe
  2⤵
  PID:4564
- C:\Windows\System\irunwXX.exe
  C:\Windows\System\irunwXX.exe
  2⤵
  PID:5020
- C:\Windows\System\GXYjLpj.exe
  C:\Windows\System\GXYjLpj.exe
  2⤵
  PID:3780
- C:\Windows\System\YoeyDOa.exe
  C:\Windows\System\YoeyDOa.exe
  2⤵
  PID:5116
- C:\Windows\System\PUOxGzd.exe
  C:\Windows\System\PUOxGzd.exe
  2⤵
  PID:4752
- C:\Windows\System\FbbgjpB.exe
  C:\Windows\System\FbbgjpB.exe
  2⤵
  PID:3008
- C:\Windows\System\VSvQssA.exe
  C:\Windows\System\VSvQssA.exe
  2⤵
  PID:4844
- C:\Windows\System\svkSYSO.exe
  C:\Windows\System\svkSYSO.exe
  2⤵
  PID:4076
- C:\Windows\System\VIGdFFW.exe
  C:\Windows\System\VIGdFFW.exe
  2⤵
  PID:4316
- C:\Windows\System\bKwUajY.exe
  C:\Windows\System\bKwUajY.exe
  2⤵
  PID:4204
- C:\Windows\System\zHFDeSp.exe
  C:\Windows\System\zHFDeSp.exe
  2⤵
  PID:1920
- C:\Windows\System\AquxUCc.exe
  C:\Windows\System\AquxUCc.exe
  2⤵
  PID:4388
- C:\Windows\System\hcFkTmc.exe
  C:\Windows\System\hcFkTmc.exe
  2⤵
  PID:2592
- C:\Windows\System\AplTiSy.exe
  C:\Windows\System\AplTiSy.exe
  2⤵
  PID:5064
- C:\Windows\System\yxSPbQr.exe
  C:\Windows\System\yxSPbQr.exe
  2⤵
  PID:4748
- C:\Windows\System\LObCpLS.exe
  C:\Windows\System\LObCpLS.exe
  2⤵
  PID:3240
- C:\Windows\System\skKbOcs.exe
  C:\Windows\System\skKbOcs.exe
  2⤵
  PID:4696
- C:\Windows\System\RXUzTew.exe
  C:\Windows\System\RXUzTew.exe
  2⤵
  PID:2364
- C:\Windows\System\ojJKAxw.exe
  C:\Windows\System\ojJKAxw.exe
  2⤵
  PID:2556
- C:\Windows\System\sDGNunx.exe
  C:\Windows\System\sDGNunx.exe
  2⤵
  PID:4876
- C:\Windows\System\HJKrgeQ.exe
  C:\Windows\System\HJKrgeQ.exe
  2⤵
  PID:5044
- C:\Windows\System\vFPgXhm.exe
  C:\Windows\System\vFPgXhm.exe
  2⤵
  PID:3020
- C:\Windows\System\aYYJgaC.exe
  C:\Windows\System\aYYJgaC.exe
  2⤵
  PID:1768
- C:\Windows\System\ryMCBEW.exe
  C:\Windows\System\ryMCBEW.exe
  2⤵
  PID:2664
- C:\Windows\System\OnhAuuN.exe
  C:\Windows\System\OnhAuuN.exe
  2⤵
  PID:4956
- C:\Windows\System\DhtLJrn.exe
  C:\Windows\System\DhtLJrn.exe
  2⤵
  PID:4296
- C:\Windows\System\cpyyLKq.exe
  C:\Windows\System\cpyyLKq.exe
  2⤵
  PID:2488
- C:\Windows\System\egawQbh.exe
  C:\Windows\System\egawQbh.exe
  2⤵
  PID:1104
- C:\Windows\System\CTCKSUy.exe
  C:\Windows\System\CTCKSUy.exe
  2⤵
  PID:5132
- C:\Windows\System\GciLPrF.exe
  C:\Windows\System\GciLPrF.exe
  2⤵
  PID:5148
- C:\Windows\System\iHGYQij.exe
  C:\Windows\System\iHGYQij.exe
  2⤵
  PID:5168
- C:\Windows\System\PDUHHIg.exe
  C:\Windows\System\PDUHHIg.exe
  2⤵
  PID:5188
- C:\Windows\System\eTZwWDS.exe
  C:\Windows\System\eTZwWDS.exe
  2⤵
  PID:5204
- C:\Windows\System\BFQErRN.exe
  C:\Windows\System\BFQErRN.exe
  2⤵
  PID:5228
- C:\Windows\System\NNomTRA.exe
  C:\Windows\System\NNomTRA.exe
  2⤵
  PID:5248
- C:\Windows\System\hLoZUdT.exe
  C:\Windows\System\hLoZUdT.exe
  2⤵
  PID:5272
- C:\Windows\System\uLggtPa.exe
  C:\Windows\System\uLggtPa.exe
  2⤵
  PID:5292
- C:\Windows\System\HCuYIVQ.exe
  C:\Windows\System\HCuYIVQ.exe
  2⤵
  PID:5316
- C:\Windows\System\GrOcslz.exe
  C:\Windows\System\GrOcslz.exe
  2⤵
  PID:5348
- C:\Windows\System\eVJQUZq.exe
  C:\Windows\System\eVJQUZq.exe
  2⤵
  PID:5364
- C:\Windows\System\HahBZIx.exe
  C:\Windows\System\HahBZIx.exe
  2⤵
  PID:5380
- C:\Windows\System\MTVbBus.exe
  C:\Windows\System\MTVbBus.exe
  2⤵
  PID:5396
- C:\Windows\System\qBgBbUS.exe
  C:\Windows\System\qBgBbUS.exe
  2⤵
  PID:5412
- C:\Windows\System\MHnOfsQ.exe
  C:\Windows\System\MHnOfsQ.exe
  2⤵
  PID:5444
- C:\Windows\System\gsCsTvZ.exe
  C:\Windows\System\gsCsTvZ.exe
  2⤵
  PID:5460
- C:\Windows\System\quwBEsO.exe
  C:\Windows\System\quwBEsO.exe
  2⤵
  PID:5476
- C:\Windows\System\fcvPcCm.exe
  C:\Windows\System\fcvPcCm.exe
  2⤵
  PID:5492
- C:\Windows\System\CPbXeZL.exe
  C:\Windows\System\CPbXeZL.exe
  2⤵
  PID:5508
- C:\Windows\System\UXgxcbL.exe
  C:\Windows\System\UXgxcbL.exe
  2⤵
  PID:5524
- C:\Windows\System\SfSNMJQ.exe
  C:\Windows\System\SfSNMJQ.exe
  2⤵
  PID:5540
- C:\Windows\System\GQQtsLN.exe
  C:\Windows\System\GQQtsLN.exe
  2⤵
  PID:5556
- C:\Windows\System\yyrbgeP.exe
  C:\Windows\System\yyrbgeP.exe
  2⤵
  PID:5572
- C:\Windows\System\CJNOjKF.exe
  C:\Windows\System\CJNOjKF.exe
  2⤵
  PID:5588
- C:\Windows\System\WHPKCMd.exe
  C:\Windows\System\WHPKCMd.exe
  2⤵
  PID:5624
- C:\Windows\System\gQjGNSv.exe
  C:\Windows\System\gQjGNSv.exe
  2⤵
  PID:5644
- C:\Windows\System\iKCrzgd.exe
  C:\Windows\System\iKCrzgd.exe
  2⤵
  PID:5660
- C:\Windows\System\BLFzcfI.exe
  C:\Windows\System\BLFzcfI.exe
  2⤵
  PID:5684
- C:\Windows\System\mpFkqPd.exe
  C:\Windows\System\mpFkqPd.exe
  2⤵
  PID:5716
- C:\Windows\System\hKSVSzC.exe
  C:\Windows\System\hKSVSzC.exe
  2⤵
  PID:5732
- C:\Windows\System\SGgVepl.exe
  C:\Windows\System\SGgVepl.exe
  2⤵
  PID:5752
- C:\Windows\System\XwOBoVA.exe
  C:\Windows\System\XwOBoVA.exe
  2⤵
  PID:5772
- C:\Windows\System\QsElkXa.exe
  C:\Windows\System\QsElkXa.exe
  2⤵
  PID:5788
- C:\Windows\System\UAKozQA.exe
  C:\Windows\System\UAKozQA.exe
  2⤵
  PID:5804
- C:\Windows\System\wqbWvSZ.exe
  C:\Windows\System\wqbWvSZ.exe
  2⤵
  PID:5820
- C:\Windows\System\fRguKJF.exe
  C:\Windows\System\fRguKJF.exe
  2⤵
  PID:5836
- C:\Windows\System\UtsJOsS.exe
  C:\Windows\System\UtsJOsS.exe
  2⤵
  PID:5876
- C:\Windows\System\EDaaLGY.exe
  C:\Windows\System\EDaaLGY.exe
  2⤵
  PID:5896
- C:\Windows\System\uPUwhFr.exe
  C:\Windows\System\uPUwhFr.exe
  2⤵
  PID:5916
- C:\Windows\System\oMriOOS.exe
  C:\Windows\System\oMriOOS.exe
  2⤵
  PID:5932
- C:\Windows\System\WPWqMri.exe
  C:\Windows\System\WPWqMri.exe
  2⤵
  PID:5960
- C:\Windows\System\DLqUUgu.exe
  C:\Windows\System\DLqUUgu.exe
  2⤵
  PID:5976
- C:\Windows\System\cVCZtbG.exe
  C:\Windows\System\cVCZtbG.exe
  2⤵
  PID:5992
- C:\Windows\System\fLymIGz.exe
  C:\Windows\System\fLymIGz.exe
  2⤵
  PID:6008
- C:\Windows\System\LqworQL.exe
  C:\Windows\System\LqworQL.exe
  2⤵
  PID:6024
- C:\Windows\System\WqOZAUT.exe
  C:\Windows\System\WqOZAUT.exe
  2⤵
  PID:6040
- C:\Windows\System\BmrfaQg.exe
  C:\Windows\System\BmrfaQg.exe
  2⤵
  PID:6056
- C:\Windows\System\JQZWhPT.exe
  C:\Windows\System\JQZWhPT.exe
  2⤵
  PID:6076
- C:\Windows\System\GcqePtH.exe
  C:\Windows\System\GcqePtH.exe
  2⤵
  PID:6100
- C:\Windows\System\sjkxGNm.exe
  C:\Windows\System\sjkxGNm.exe
  2⤵
  PID:6116
- C:\Windows\System\eIONxQB.exe
  C:\Windows\System\eIONxQB.exe
  2⤵
  PID:6132
- C:\Windows\System\xjvLlns.exe
  C:\Windows\System\xjvLlns.exe
  2⤵
  PID:5000
- C:\Windows\System\pTAcEWK.exe
  C:\Windows\System\pTAcEWK.exe
  2⤵
  PID:5124
- C:\Windows\System\RLWsxwA.exe
  C:\Windows\System\RLWsxwA.exe
  2⤵
  PID:5164
- C:\Windows\System\NJwgBnj.exe
  C:\Windows\System\NJwgBnj.exe
  2⤵
  PID:5240
- C:\Windows\System\OtACyTW.exe
  C:\Windows\System\OtACyTW.exe
  2⤵
  PID:5280
- C:\Windows\System\tvuWRmn.exe
  C:\Windows\System\tvuWRmn.exe
  2⤵
  PID:4984
- C:\Windows\System\xRIGylq.exe
  C:\Windows\System\xRIGylq.exe
  2⤵
  PID:5180
- C:\Windows\System\YaHxtKD.exe
  C:\Windows\System\YaHxtKD.exe
  2⤵
  PID:5304
- C:\Windows\System\lRqGPkP.exe
  C:\Windows\System\lRqGPkP.exe
  2⤵
  PID:5300
- C:\Windows\System\NgZlIav.exe
  C:\Windows\System\NgZlIav.exe
  2⤵
  PID:5328
- C:\Windows\System\AJzzTZE.exe
  C:\Windows\System\AJzzTZE.exe
  2⤵
  PID:5344
- C:\Windows\System\VcMwvfy.exe
  C:\Windows\System\VcMwvfy.exe
  2⤵
  PID:2464
- C:\Windows\System\XmdoebF.exe
  C:\Windows\System\XmdoebF.exe
  2⤵
  PID:5432
- C:\Windows\System\gXTctsq.exe
  C:\Windows\System\gXTctsq.exe
  2⤵
  PID:5376
- C:\Windows\System\OzmxDal.exe
  C:\Windows\System\OzmxDal.exe
  2⤵
  PID:5456
- C:\Windows\System\Bpdwrji.exe
  C:\Windows\System\Bpdwrji.exe
  2⤵
  PID:5520
- C:\Windows\System\wQTLCKP.exe
  C:\Windows\System\wQTLCKP.exe
  2⤵
  PID:5584
- C:\Windows\System\WjXyhri.exe
  C:\Windows\System\WjXyhri.exe
  2⤵
  PID:5440
- C:\Windows\System\tkusida.exe
  C:\Windows\System\tkusida.exe
  2⤵
  PID:5608
- C:\Windows\System\tevutcD.exe
  C:\Windows\System\tevutcD.exe
  2⤵
  PID:5632
- C:\Windows\System\MRhDOMF.exe
  C:\Windows\System\MRhDOMF.exe
  2⤵
  PID:2812
- C:\Windows\System\MzvfaFU.exe
  C:\Windows\System\MzvfaFU.exe
  2⤵
  PID:5680
- C:\Windows\System\BCdxNUF.exe
  C:\Windows\System\BCdxNUF.exe
  2⤵
  PID:5728
- C:\Windows\System\XlzqkZe.exe
  C:\Windows\System\XlzqkZe.exe
  2⤵
  PID:5700
- C:\Windows\System\uUhZepX.exe
  C:\Windows\System\uUhZepX.exe
  2⤵
  PID:5800
- C:\Windows\System\BARZPtc.exe
  C:\Windows\System\BARZPtc.exe
  2⤵
  PID:5832
- C:\Windows\System\lgTTCkz.exe
  C:\Windows\System\lgTTCkz.exe
  2⤵
  PID:5892
- C:\Windows\System\aUcmulU.exe
  C:\Windows\System\aUcmulU.exe
  2⤵
  PID:5744
- C:\Windows\System\nXHRJNi.exe
  C:\Windows\System\nXHRJNi.exe
  2⤵
  PID:5968
- C:\Windows\System\OzSKEiV.exe
  C:\Windows\System\OzSKEiV.exe
  2⤵
  PID:6032
- C:\Windows\System\DOWVrDT.exe
  C:\Windows\System\DOWVrDT.exe
  2⤵
  PID:5156
- C:\Windows\System\JuZTDQp.exe
  C:\Windows\System\JuZTDQp.exe
  2⤵
  PID:5268
- C:\Windows\System\haMyIwv.exe
  C:\Windows\System\haMyIwv.exe
  2⤵
  PID:5944
- C:\Windows\System\BmWaZiU.exe
  C:\Windows\System\BmWaZiU.exe
  2⤵
  PID:5656
- C:\Windows\System\RgdOHiP.exe
  C:\Windows\System\RgdOHiP.exe
  2⤵
  PID:5708
- C:\Windows\System\SguufXz.exe
  C:\Windows\System\SguufXz.exe
  2⤵
  PID:5884
- C:\Windows\System\irCzlqk.exe
  C:\Windows\System\irCzlqk.exe
  2⤵
  PID:6068
- C:\Windows\System\TqFwJHd.exe
  C:\Windows\System\TqFwJHd.exe
  2⤵
  PID:3000
- C:\Windows\System\xLeVhbW.exe
  C:\Windows\System\xLeVhbW.exe
  2⤵
  PID:5816
- C:\Windows\System\FQtVChL.exe
  C:\Windows\System\FQtVChL.exe
  2⤵
  PID:6088
- C:\Windows\System\rsSorUL.exe
  C:\Windows\System\rsSorUL.exe
  2⤵
  PID:6128
- C:\Windows\System\EKdsfpS.exe
  C:\Windows\System\EKdsfpS.exe
  2⤵
  PID:5908
- C:\Windows\System\BrFreAc.exe
  C:\Windows\System\BrFreAc.exe
  2⤵
  PID:6048
- C:\Windows\System\uXuvQkS.exe
  C:\Windows\System\uXuvQkS.exe
  2⤵
  PID:5324
- C:\Windows\System\SGXffYB.exe
  C:\Windows\System\SGXffYB.exe
  2⤵
  PID:6036
- C:\Windows\System\jlhldcY.exe
  C:\Windows\System\jlhldcY.exe
  2⤵
  PID:5868
- C:\Windows\System\TrwKSdg.exe
  C:\Windows\System\TrwKSdg.exe
  2⤵
  PID:5264
- C:\Windows\System\ygCcUPS.exe
  C:\Windows\System\ygCcUPS.exe
  2⤵
  PID:1632
- C:\Windows\System\GWsmTpV.exe
  C:\Windows\System\GWsmTpV.exe
  2⤵
  PID:5768
- C:\Windows\System\DjMsguR.exe
  C:\Windows\System\DjMsguR.exe
  2⤵
  PID:5504
- C:\Windows\System\VEMYsWn.exe
  C:\Windows\System\VEMYsWn.exe
  2⤵
  PID:5308
- C:\Windows\System\EOpNKQJ.exe
  C:\Windows\System\EOpNKQJ.exe
  2⤵
  PID:5340
- C:\Windows\System\zELbJiJ.exe
  C:\Windows\System\zELbJiJ.exe
  2⤵
  PID:5692
- C:\Windows\System\vRGJCjp.exe
  C:\Windows\System\vRGJCjp.exe
  2⤵
  PID:6096
- C:\Windows\System\XfPrchk.exe
  C:\Windows\System\XfPrchk.exe
  2⤵
  PID:5852
- C:\Windows\System\TLwugHf.exe
  C:\Windows\System\TLwugHf.exe
  2⤵
  PID:1672
- C:\Windows\System\gAWFoBa.exe
  C:\Windows\System\gAWFoBa.exe
  2⤵
  PID:5360
- C:\Windows\System\BYDlLhP.exe
  C:\Windows\System\BYDlLhP.exe
  2⤵
  PID:6004
- C:\Windows\System\xLrYgCn.exe
  C:\Windows\System\xLrYgCn.exe
  2⤵
  PID:6176
- C:\Windows\System\clvKoTQ.exe
  C:\Windows\System\clvKoTQ.exe
  2⤵
  PID:6192
- C:\Windows\System\XXbnHCy.exe
  C:\Windows\System\XXbnHCy.exe
  2⤵
  PID:6208
- C:\Windows\System\HExmbDD.exe
  C:\Windows\System\HExmbDD.exe
  2⤵
  PID:6232
- C:\Windows\System\EpJfSgG.exe
  C:\Windows\System\EpJfSgG.exe
  2⤵
  PID:6252
- C:\Windows\System\BjpygUH.exe
  C:\Windows\System\BjpygUH.exe
  2⤵
  PID:6272
- C:\Windows\System\XrVtSqs.exe
  C:\Windows\System\XrVtSqs.exe
  2⤵
  PID:6288
- C:\Windows\System\OBWGIzP.exe
  C:\Windows\System\OBWGIzP.exe
  2⤵
  PID:6308
- C:\Windows\System\GtMgbPr.exe
  C:\Windows\System\GtMgbPr.exe
  2⤵
  PID:6324
- C:\Windows\System\xzQmTUp.exe
  C:\Windows\System\xzQmTUp.exe
  2⤵
  PID:6348
- C:\Windows\System\ywMRqlq.exe
  C:\Windows\System\ywMRqlq.exe
  2⤵
  PID:6364
- C:\Windows\System\eGyZlDz.exe
  C:\Windows\System\eGyZlDz.exe
  2⤵
  PID:6384
- C:\Windows\System\vhSUcEh.exe
  C:\Windows\System\vhSUcEh.exe
  2⤵
  PID:6400
- C:\Windows\System\FiCHuee.exe
  C:\Windows\System\FiCHuee.exe
  2⤵
  PID:6424
- C:\Windows\System\ZkjGWkY.exe
  C:\Windows\System\ZkjGWkY.exe
  2⤵
  PID:6440
- C:\Windows\System\cewAyaQ.exe
  C:\Windows\System\cewAyaQ.exe
  2⤵
  PID:6464
- C:\Windows\System\wjpWkDa.exe
  C:\Windows\System\wjpWkDa.exe
  2⤵
  PID:6484
- C:\Windows\System\lfhpPEj.exe
  C:\Windows\System\lfhpPEj.exe
  2⤵
  PID:6512
- C:\Windows\System\NzrqwaE.exe
  C:\Windows\System\NzrqwaE.exe
  2⤵
  PID:6532
- C:\Windows\System\drFcIlN.exe
  C:\Windows\System\drFcIlN.exe
  2⤵
  PID:6552
- C:\Windows\System\AJYatgf.exe
  C:\Windows\System\AJYatgf.exe
  2⤵
  PID:6580
- C:\Windows\System\vgjqtBK.exe
  C:\Windows\System\vgjqtBK.exe
  2⤵
  PID:6596
- C:\Windows\System\fFlQQkn.exe
  C:\Windows\System\fFlQQkn.exe
  2⤵
  PID:6612
- C:\Windows\System\QksBXxU.exe
  C:\Windows\System\QksBXxU.exe
  2⤵
  PID:6628
- C:\Windows\System\bUYlOQb.exe
  C:\Windows\System\bUYlOQb.exe
  2⤵
  PID:6652
- C:\Windows\System\TQxQWJH.exe
  C:\Windows\System\TQxQWJH.exe
  2⤵
  PID:6668
- C:\Windows\System\MPMmefz.exe
  C:\Windows\System\MPMmefz.exe
  2⤵
  PID:6684
- C:\Windows\System\gFuEdnf.exe
  C:\Windows\System\gFuEdnf.exe
  2⤵
  PID:6704
- C:\Windows\System\mYGXHso.exe
  C:\Windows\System\mYGXHso.exe
  2⤵
  PID:6736
- C:\Windows\System\IaxiZMV.exe
  C:\Windows\System\IaxiZMV.exe
  2⤵
  PID:6756
- C:\Windows\System\pjCfVMT.exe
  C:\Windows\System\pjCfVMT.exe
  2⤵
  PID:6772
- C:\Windows\System\vUaIGtk.exe
  C:\Windows\System\vUaIGtk.exe
  2⤵
  PID:6788
- C:\Windows\System\IJzIODj.exe
  C:\Windows\System\IJzIODj.exe
  2⤵
  PID:6808
- C:\Windows\System\eVjbWXU.exe
  C:\Windows\System\eVjbWXU.exe
  2⤵
  PID:6824
- C:\Windows\System\gyHXnEX.exe
  C:\Windows\System\gyHXnEX.exe
  2⤵
  PID:6840
- C:\Windows\System\RtMuOwC.exe
  C:\Windows\System\RtMuOwC.exe
  2⤵
  PID:6856
- C:\Windows\System\aUInqSu.exe
  C:\Windows\System\aUInqSu.exe
  2⤵
  PID:6880
- C:\Windows\System\nuaZXJK.exe
  C:\Windows\System\nuaZXJK.exe
  2⤵
  PID:6896
- C:\Windows\System\mDQpRMq.exe
  C:\Windows\System\mDQpRMq.exe
  2⤵
  PID:6920
- C:\Windows\System\VkmEePg.exe
  C:\Windows\System\VkmEePg.exe
  2⤵
  PID:6936
- C:\Windows\System\sUHNAQP.exe
  C:\Windows\System\sUHNAQP.exe
  2⤵
  PID:6956
- C:\Windows\System\URIcVYs.exe
  C:\Windows\System\URIcVYs.exe
  2⤵
  PID:6984
- C:\Windows\System\TUicszE.exe
  C:\Windows\System\TUicszE.exe
  2⤵
  PID:7016
- C:\Windows\System\RybIBRg.exe
  C:\Windows\System\RybIBRg.exe
  2⤵
  PID:7040
- C:\Windows\System\PscZVpi.exe
  C:\Windows\System\PscZVpi.exe
  2⤵
  PID:7060
- C:\Windows\System\UctmhVo.exe
  C:\Windows\System\UctmhVo.exe
  2⤵
  PID:7080
- C:\Windows\System\zVgHxQl.exe
  C:\Windows\System\zVgHxQl.exe
  2⤵
  PID:7096
- C:\Windows\System\ktHcrQD.exe
  C:\Windows\System\ktHcrQD.exe
  2⤵
  PID:7120
- C:\Windows\System\tNangrp.exe
  C:\Windows\System\tNangrp.exe
  2⤵
  PID:7136
- C:\Windows\System\HfailYv.exe
  C:\Windows\System\HfailYv.exe
  2⤵
  PID:7152
- C:\Windows\System\XDmOKBr.exe
  C:\Windows\System\XDmOKBr.exe
  2⤵
  PID:5160
- C:\Windows\System\mwzDHMZ.exe
  C:\Windows\System\mwzDHMZ.exe
  2⤵
  PID:5408
- C:\Windows\System\ENjPALd.exe
  C:\Windows\System\ENjPALd.exe
  2⤵
  PID:5580
- C:\Windows\System\IrqTXiB.exe
  C:\Windows\System\IrqTXiB.exe
  2⤵
  PID:5640
- C:\Windows\System\cgJlaxh.exe
  C:\Windows\System\cgJlaxh.exe
  2⤵
  PID:5988
- C:\Windows\System\IQnieRp.exe
  C:\Windows\System\IQnieRp.exe
  2⤵
  PID:5484
- C:\Windows\System\pbfgkgR.exe
  C:\Windows\System\pbfgkgR.exe
  2⤵
  PID:5216
- C:\Windows\System\lMYazJM.exe
  C:\Windows\System\lMYazJM.exe
  2⤵
  PID:5212
- C:\Windows\System\jymUnTY.exe
  C:\Windows\System\jymUnTY.exe
  2⤵
  PID:5176
- C:\Windows\System\fEubaTD.exe
  C:\Windows\System\fEubaTD.exe
  2⤵
  PID:5388
- C:\Windows\System\BrAHjQg.exe
  C:\Windows\System\BrAHjQg.exe
  2⤵
  PID:6160
- C:\Windows\System\NfHxMOo.exe
  C:\Windows\System\NfHxMOo.exe
  2⤵
  PID:6204
- C:\Windows\System\BCrLGMY.exe
  C:\Windows\System\BCrLGMY.exe
  2⤵
  PID:1428
- C:\Windows\System\IVoRLcj.exe
  C:\Windows\System\IVoRLcj.exe
  2⤵
  PID:6248
- C:\Windows\System\noaWBnv.exe
  C:\Windows\System\noaWBnv.exe
  2⤵
  PID:6316
- C:\Windows\System\IgOFJXR.exe
  C:\Windows\System\IgOFJXR.exe
  2⤵
  PID:6360
- C:\Windows\System\uYshpVu.exe
  C:\Windows\System\uYshpVu.exe
  2⤵
  PID:6184
- C:\Windows\System\AgQBnMy.exe
  C:\Windows\System\AgQBnMy.exe
  2⤵
  PID:6224
- C:\Windows\System\VucStvn.exe
  C:\Windows\System\VucStvn.exe
  2⤵
  PID:6408
- C:\Windows\System\PwltUbP.exe
  C:\Windows\System\PwltUbP.exe
  2⤵
  PID:6448
- C:\Windows\System\wZEBgvp.exe
  C:\Windows\System\wZEBgvp.exe
  2⤵
  PID:6472
- C:\Windows\System\KDCghuS.exe
  C:\Windows\System\KDCghuS.exe
  2⤵
  PID:6524
- C:\Windows\System\HgWqyRA.exe
  C:\Windows\System\HgWqyRA.exe
  2⤵
  PID:6496
- C:\Windows\System\FAjxJmk.exe
  C:\Windows\System\FAjxJmk.exe
  2⤵
  PID:6560
- C:\Windows\System\QvTQzte.exe
  C:\Windows\System\QvTQzte.exe
  2⤵
  PID:6572
- C:\Windows\System\reXieqm.exe
  C:\Windows\System\reXieqm.exe
  2⤵
  PID:6620
- C:\Windows\System\iIHVVBa.exe
  C:\Windows\System\iIHVVBa.exe
  2⤵
  PID:6636
- C:\Windows\System\qEmyQek.exe
  C:\Windows\System\qEmyQek.exe
  2⤵
  PID:6660
- C:\Windows\System\DwVMGoX.exe
  C:\Windows\System\DwVMGoX.exe
  2⤵
  PID:6680
- C:\Windows\System\lLWaUby.exe
  C:\Windows\System\lLWaUby.exe
  2⤵
  PID:6732
- C:\Windows\System\DFDguQq.exe
  C:\Windows\System\DFDguQq.exe
  2⤵
  PID:6800
- C:\Windows\System\vVBOurR.exe
  C:\Windows\System\vVBOurR.exe
  2⤵
  PID:6836
- C:\Windows\System\xUABvbU.exe
  C:\Windows\System\xUABvbU.exe
  2⤵
  PID:6876
- C:\Windows\System\CUXVKpH.exe
  C:\Windows\System\CUXVKpH.exe
  2⤵
  PID:6944
- C:\Windows\System\jDdoLai.exe
  C:\Windows\System\jDdoLai.exe
  2⤵
  PID:6752
- C:\Windows\System\QPxHBGJ.exe
  C:\Windows\System\QPxHBGJ.exe
  2⤵
  PID:6892
- C:\Windows\System\BAIooVG.exe
  C:\Windows\System\BAIooVG.exe
  2⤵
  PID:6780
- C:\Windows\System\AJpYERy.exe
  C:\Windows\System\AJpYERy.exe
  2⤵
  PID:6972
- C:\Windows\System\KNUwELS.exe
  C:\Windows\System\KNUwELS.exe
  2⤵
  PID:6820
- C:\Windows\System\GKeBniJ.exe
  C:\Windows\System\GKeBniJ.exe
  2⤵
  PID:7008
- C:\Windows\System\hnxurir.exe
  C:\Windows\System\hnxurir.exe
  2⤵
  PID:7024
- C:\Windows\System\MNEnisQ.exe
  C:\Windows\System\MNEnisQ.exe
  2⤵
  PID:7032
- C:\Windows\System\ZVttcFz.exe
  C:\Windows\System\ZVttcFz.exe
  2⤵
  PID:7072
- C:\Windows\System\skxQonn.exe
  C:\Windows\System\skxQonn.exe
  2⤵
  PID:7128
- C:\Windows\System\oMDkWan.exe
  C:\Windows\System\oMDkWan.exe
  2⤵
  PID:5672
- C:\Windows\System\fXvKMbt.exe
  C:\Windows\System\fXvKMbt.exe
  2⤵
  PID:6072
- C:\Windows\System\azjjomG.exe
  C:\Windows\System\azjjomG.exe
  2⤵
  PID:7108
- C:\Windows\System\LRtcVRJ.exe
  C:\Windows\System\LRtcVRJ.exe
  2⤵
  PID:5196
- C:\Windows\System\OjpVAIi.exe
  C:\Windows\System\OjpVAIi.exe
  2⤵
  PID:6156
- C:\Windows\System\HdXoeQO.exe
  C:\Windows\System\HdXoeQO.exe
  2⤵
  PID:5600
- C:\Windows\System\CNVmhWB.exe
  C:\Windows\System\CNVmhWB.exe
  2⤵
  PID:7148
- C:\Windows\System\BHNxUCV.exe
  C:\Windows\System\BHNxUCV.exe
  2⤵
  PID:4628
- C:\Windows\System\PRNWpbP.exe
  C:\Windows\System\PRNWpbP.exe
  2⤵
  PID:6148
- C:\Windows\System\EJICGGl.exe
  C:\Windows\System\EJICGGl.exe
  2⤵
  PID:5796
- C:\Windows\System\LFhPGtC.exe
  C:\Windows\System\LFhPGtC.exe
  2⤵
  PID:5472
- C:\Windows\System\wuQfyfa.exe
  C:\Windows\System\wuQfyfa.exe
  2⤵
  PID:4236
- C:\Windows\System\WAoCCtl.exe
  C:\Windows\System\WAoCCtl.exe
  2⤵
  PID:6284
- C:\Windows\System\ZrmjzSG.exe
  C:\Windows\System\ZrmjzSG.exe
  2⤵
  PID:6356
- C:\Windows\System\nJwJIQX.exe
  C:\Windows\System\nJwJIQX.exe
  2⤵
  PID:6340
- C:\Windows\System\eslMblf.exe
  C:\Windows\System\eslMblf.exe
  2⤵
  PID:2668
- C:\Windows\System\Yszkgza.exe
  C:\Windows\System\Yszkgza.exe
  2⤵
  PID:6296
- C:\Windows\System\OcopbgN.exe
  C:\Windows\System\OcopbgN.exe
  2⤵
  PID:6416
- C:\Windows\System\wkKxDJI.exe
  C:\Windows\System\wkKxDJI.exe
  2⤵
  PID:6420
- C:\Windows\System\KjpxCRF.exe
  C:\Windows\System\KjpxCRF.exe
  2⤵
  PID:6452
- C:\Windows\System\aDggIiV.exe
  C:\Windows\System\aDggIiV.exe
  2⤵
  PID:6492
- C:\Windows\System\gAtAfXN.exe
  C:\Windows\System\gAtAfXN.exe
  2⤵
  PID:6500
- C:\Windows\System\ujiJmqW.exe
  C:\Windows\System\ujiJmqW.exe
  2⤵
  PID:6676
- C:\Windows\System\psndfgD.exe
  C:\Windows\System\psndfgD.exe
  2⤵
  PID:6624
- C:\Windows\System\aniabcu.exe
  C:\Windows\System\aniabcu.exe
  2⤵
  PID:6728
- C:\Windows\System\LEdZvFu.exe
  C:\Windows\System\LEdZvFu.exe
  2⤵
  PID:6872
- C:\Windows\System\tnCWkmB.exe
  C:\Windows\System\tnCWkmB.exe
  2⤵
  PID:1344
- C:\Windows\System\jCmgrbE.exe
  C:\Windows\System\jCmgrbE.exe
  2⤵
  PID:6700
- C:\Windows\System\qgzShxY.exe
  C:\Windows\System\qgzShxY.exe
  2⤵
  PID:6932
- C:\Windows\System\DMYfPef.exe
  C:\Windows\System\DMYfPef.exe
  2⤵
  PID:6744
- C:\Windows\System\gRzDuTj.exe
  C:\Windows\System\gRzDuTj.exe
  2⤵
  PID:2420
- C:\Windows\System\ErWjCkv.exe
  C:\Windows\System\ErWjCkv.exe
  2⤵
  PID:7160
- C:\Windows\System\qBJPVSI.exe
  C:\Windows\System\qBJPVSI.exe
  2⤵
  PID:6964
- C:\Windows\System\xePeftR.exe
  C:\Windows\System\xePeftR.exe
  2⤵
  PID:7004
- C:\Windows\System\NbIGIoF.exe
  C:\Windows\System\NbIGIoF.exe
  2⤵
  PID:6768
- C:\Windows\System\idIwtlq.exe
  C:\Windows\System\idIwtlq.exe
  2⤵
  PID:7052
- C:\Windows\System\cFbSaqy.exe
  C:\Windows\System\cFbSaqy.exe
  2⤵
  PID:6868
- C:\Windows\System\EqbqGIn.exe
  C:\Windows\System\EqbqGIn.exe
  2⤵
  PID:6588
- C:\Windows\System\sHacQzc.exe
  C:\Windows\System\sHacQzc.exe
  2⤵
  PID:6268
- C:\Windows\System\NRaOKKG.exe
  C:\Windows\System\NRaOKKG.exe
  2⤵
  PID:6020
- C:\Windows\System\pPQPosK.exe
  C:\Windows\System\pPQPosK.exe
  2⤵
  PID:6172
- C:\Windows\System\vESVBFJ.exe
  C:\Windows\System\vESVBFJ.exe
  2⤵
  PID:352
- C:\Windows\System\rUUfrNA.exe
  C:\Windows\System\rUUfrNA.exe
  2⤵
  PID:7028
- C:\Windows\System\EMBLCCU.exe
  C:\Windows\System\EMBLCCU.exe
  2⤵
  PID:824
- C:\Windows\System\sEZoTZb.exe
  C:\Windows\System\sEZoTZb.exe
  2⤵
  PID:5904
- C:\Windows\System\sDIytBr.exe
  C:\Windows\System\sDIytBr.exe
  2⤵
  PID:6216
- C:\Windows\System\DrTfmXH.exe
  C:\Windows\System\DrTfmXH.exe
  2⤵
  PID:6304
- C:\Windows\System\WXHQIdx.exe
  C:\Windows\System\WXHQIdx.exe
  2⤵
  PID:6608
- C:\Windows\System\GpIQQnO.exe
  C:\Windows\System\GpIQQnO.exe
  2⤵
  PID:6696
- C:\Windows\System\vwiROVo.exe
  C:\Windows\System\vwiROVo.exe
  2⤵
  PID:6748
- C:\Windows\System\SNKTiEk.exe
  C:\Windows\System\SNKTiEk.exe
  2⤵
  PID:7104
- C:\Windows\System\eCvLMjg.exe
  C:\Windows\System\eCvLMjg.exe
  2⤵
  PID:6480
- C:\Windows\System\agrophl.exe
  C:\Windows\System\agrophl.exe
  2⤵
  PID:7000
- C:\Windows\System\OrpMlMk.exe
  C:\Windows\System\OrpMlMk.exe
  2⤵
  PID:6376
- C:\Windows\System\lgVFhGJ.exe
  C:\Windows\System\lgVFhGJ.exe
  2⤵
  PID:6644
- C:\Windows\System\BQYhSaC.exe
  C:\Windows\System\BQYhSaC.exe
  2⤵
  PID:6200
- C:\Windows\System\OHfeeyH.exe
  C:\Windows\System\OHfeeyH.exe
  2⤵
  PID:6724
- C:\Windows\System\BQHepml.exe
  C:\Windows\System\BQHepml.exe
  2⤵
  PID:6508
- C:\Windows\System\cbjNEgb.exe
  C:\Windows\System\cbjNEgb.exe
  2⤵
  PID:1140
- C:\Windows\System\jPtPDJW.exe
  C:\Windows\System\jPtPDJW.exe
  2⤵
  PID:7176
- C:\Windows\System\MWGVaTP.exe
  C:\Windows\System\MWGVaTP.exe
  2⤵
  PID:7192
- C:\Windows\System\MaoQcVQ.exe
  C:\Windows\System\MaoQcVQ.exe
  2⤵
  PID:7212
- C:\Windows\System\dJEaVHY.exe
  C:\Windows\System\dJEaVHY.exe
  2⤵
  PID:7228
- C:\Windows\System\EIQtRVQ.exe
  C:\Windows\System\EIQtRVQ.exe
  2⤵
  PID:7244
- C:\Windows\System\axFjQAA.exe
  C:\Windows\System\axFjQAA.exe
  2⤵
  PID:7264
- C:\Windows\System\BNeFVdu.exe
  C:\Windows\System\BNeFVdu.exe
  2⤵
  PID:7284
- C:\Windows\System\QONgAED.exe
  C:\Windows\System\QONgAED.exe
  2⤵
  PID:7304
- C:\Windows\System\moeFvpb.exe
  C:\Windows\System\moeFvpb.exe
  2⤵
  PID:7324
- C:\Windows\System\GkqetCo.exe
  C:\Windows\System\GkqetCo.exe
  2⤵
  PID:7340
- C:\Windows\System\upjkDIc.exe
  C:\Windows\System\upjkDIc.exe
  2⤵
  PID:7356
- C:\Windows\System\TwohsHA.exe
  C:\Windows\System\TwohsHA.exe
  2⤵
  PID:7376
- C:\Windows\System\PtAMqur.exe
  C:\Windows\System\PtAMqur.exe
  2⤵
  PID:7392
- C:\Windows\System\YYPJFFP.exe
  C:\Windows\System\YYPJFFP.exe
  2⤵
  PID:7452
- C:\Windows\System\fmMbGWK.exe
  C:\Windows\System\fmMbGWK.exe
  2⤵
  PID:7468
- C:\Windows\System\ZIwauFT.exe
  C:\Windows\System\ZIwauFT.exe
  2⤵
  PID:7484
- C:\Windows\System\ZhzaEjY.exe
  C:\Windows\System\ZhzaEjY.exe
  2⤵
  PID:7500
- C:\Windows\System\KPBHsUq.exe
  C:\Windows\System\KPBHsUq.exe
  2⤵
  PID:7516
- C:\Windows\System\yVmLvrb.exe
  C:\Windows\System\yVmLvrb.exe
  2⤵
  PID:7532
- C:\Windows\System\hxXxvFw.exe
  C:\Windows\System\hxXxvFw.exe
  2⤵
  PID:7552
- C:\Windows\System\wqORWrN.exe
  C:\Windows\System\wqORWrN.exe
  2⤵
  PID:7572
- C:\Windows\System\MYiLxWO.exe
  C:\Windows\System\MYiLxWO.exe
  2⤵
  PID:7588
- C:\Windows\System\VWgJqYo.exe
  C:\Windows\System\VWgJqYo.exe
  2⤵
  PID:7604
- C:\Windows\System\GYQaITW.exe
  C:\Windows\System\GYQaITW.exe
  2⤵
  PID:7624
- C:\Windows\System\qNCYuDc.exe
  C:\Windows\System\qNCYuDc.exe
  2⤵
  PID:7648
- C:\Windows\System\uKZbqRk.exe
  C:\Windows\System\uKZbqRk.exe
  2⤵
  PID:7668
- C:\Windows\System\rdgXtuT.exe
  C:\Windows\System\rdgXtuT.exe
  2⤵
  PID:7688
- C:\Windows\System\uPeqryj.exe
  C:\Windows\System\uPeqryj.exe
  2⤵
  PID:7704
- C:\Windows\System\ptoBFWI.exe
  C:\Windows\System\ptoBFWI.exe
  2⤵
  PID:7720
- C:\Windows\System\rLwwNaT.exe
  C:\Windows\System\rLwwNaT.exe
  2⤵
  PID:7736
- C:\Windows\System\XvxEQbo.exe
  C:\Windows\System\XvxEQbo.exe
  2⤵
  PID:7792
- C:\Windows\System\FfXiTAM.exe
  C:\Windows\System\FfXiTAM.exe
  2⤵
  PID:7812
- C:\Windows\System\XyrmjaM.exe
  C:\Windows\System\XyrmjaM.exe
  2⤵
  PID:7828
- C:\Windows\System\yJyrvMI.exe
  C:\Windows\System\yJyrvMI.exe
  2⤵
  PID:7844
- C:\Windows\System\GpBRzYr.exe
  C:\Windows\System\GpBRzYr.exe
  2⤵
  PID:7860
- C:\Windows\System\ZPYfZEI.exe
  C:\Windows\System\ZPYfZEI.exe
  2⤵
  PID:7880
- C:\Windows\System\ehWKdVt.exe
  C:\Windows\System\ehWKdVt.exe
  2⤵
  PID:7896
- C:\Windows\System\KVfgjEf.exe
  C:\Windows\System\KVfgjEf.exe
  2⤵
  PID:7916
- C:\Windows\System\nuunKOy.exe
  C:\Windows\System\nuunKOy.exe
  2⤵
  PID:7936
- C:\Windows\System\OeQgMTl.exe
  C:\Windows\System\OeQgMTl.exe
  2⤵
  PID:7952
- C:\Windows\System\KRUrePA.exe
  C:\Windows\System\KRUrePA.exe
  2⤵
  PID:7968
- C:\Windows\System\atmgTwo.exe
  C:\Windows\System\atmgTwo.exe
  2⤵
  PID:7988
- C:\Windows\System\guDxqzn.exe
  C:\Windows\System\guDxqzn.exe
  2⤵
  PID:8004
- C:\Windows\System\gSfziVu.exe
  C:\Windows\System\gSfziVu.exe
  2⤵
  PID:8028
- C:\Windows\System\ronxJTL.exe
  C:\Windows\System\ronxJTL.exe
  2⤵
  PID:8044
- C:\Windows\System\huIPZQt.exe
  C:\Windows\System\huIPZQt.exe
  2⤵
  PID:8060
- C:\Windows\System\lknHgaQ.exe
  C:\Windows\System\lknHgaQ.exe
  2⤵
  PID:8080
- C:\Windows\System\jBopyVT.exe
  C:\Windows\System\jBopyVT.exe
  2⤵
  PID:8096
- C:\Windows\System\ozVSnqg.exe
  C:\Windows\System\ozVSnqg.exe
  2⤵
  PID:8116
- C:\Windows\System\RNdTOfp.exe
  C:\Windows\System\RNdTOfp.exe
  2⤵
  PID:8132
- C:\Windows\System\AyqnSfb.exe
  C:\Windows\System\AyqnSfb.exe
  2⤵
  PID:8148
- C:\Windows\System\JElpaOo.exe
  C:\Windows\System\JElpaOo.exe
  2⤵
  PID:8164
- C:\Windows\System\KzUoiXk.exe
  C:\Windows\System\KzUoiXk.exe
  2⤵
  PID:8180
- C:\Windows\System\sQnCjFO.exe
  C:\Windows\System\sQnCjFO.exe
  2⤵
  PID:2904
- C:\Windows\System\rDRDPBr.exe
  C:\Windows\System\rDRDPBr.exe
  2⤵
  PID:5956
- C:\Windows\System\ROGloHC.exe
  C:\Windows\System\ROGloHC.exe
  2⤵
  PID:6240
- C:\Windows\System\IWQAjDf.exe
  C:\Windows\System\IWQAjDf.exe
  2⤵
  PID:6140
- C:\Windows\System\GjBbvEK.exe
  C:\Windows\System\GjBbvEK.exe
  2⤵
  PID:6300
- C:\Windows\System\qaFGReM.exe
  C:\Windows\System\qaFGReM.exe
  2⤵
  PID:7172
- C:\Windows\System\jIzrCbV.exe
  C:\Windows\System\jIzrCbV.exe
  2⤵
  PID:7240
- C:\Windows\System\WKIeRNO.exe
  C:\Windows\System\WKIeRNO.exe
  2⤵
  PID:7348
- C:\Windows\System\cccmFxD.exe
  C:\Windows\System\cccmFxD.exe
  2⤵
  PID:7364
- C:\Windows\System\AzppugF.exe
  C:\Windows\System\AzppugF.exe
  2⤵
  PID:7416
- C:\Windows\System\GHsIJJA.exe
  C:\Windows\System\GHsIJJA.exe
  2⤵
  PID:7432
- C:\Windows\System\ezbZfsB.exe
  C:\Windows\System\ezbZfsB.exe
  2⤵
  PID:7476
- C:\Windows\System\ppxZahz.exe
  C:\Windows\System\ppxZahz.exe
  2⤵
  PID:7540
- C:\Windows\System\PckfYAf.exe
  C:\Windows\System\PckfYAf.exe
  2⤵
  PID:7580
- C:\Windows\System\GEEodqw.exe
  C:\Windows\System\GEEodqw.exe
  2⤵
  PID:7656
- C:\Windows\System\AkFbzpL.exe
  C:\Windows\System\AkFbzpL.exe
  2⤵
  PID:7728
- C:\Windows\System\QIgoUJJ.exe
  C:\Windows\System\QIgoUJJ.exe
  2⤵
  PID:1312
- C:\Windows\System\YXDTTxo.exe
  C:\Windows\System\YXDTTxo.exe
  2⤵
  PID:7464
- C:\Windows\System\luaHFlz.exe
  C:\Windows\System\luaHFlz.exe
  2⤵
  PID:7756
- C:\Windows\System\nSSulCx.exe
  C:\Windows\System\nSSulCx.exe
  2⤵
  PID:7768
- C:\Windows\System\wvaIyco.exe
  C:\Windows\System\wvaIyco.exe
  2⤵
  PID:7632
- C:\Windows\System\gXcCOzl.exe
  C:\Windows\System\gXcCOzl.exe
  2⤵
  PID:7744
- C:\Windows\System\WbCbKtc.exe
  C:\Windows\System\WbCbKtc.exe
  2⤵
  PID:7808
- C:\Windows\System\odcMqNA.exe
  C:\Windows\System\odcMqNA.exe
  2⤵
  PID:7872
- C:\Windows\System\AAZOkjt.exe
  C:\Windows\System\AAZOkjt.exe
  2⤵
  PID:7944
- C:\Windows\System\ZlTRpwU.exe
  C:\Windows\System\ZlTRpwU.exe
  2⤵
  PID:8012
- C:\Windows\System\yjcgodj.exe
  C:\Windows\System\yjcgodj.exe
  2⤵
  PID:8052
- C:\Windows\System\YsUpYMK.exe
  C:\Windows\System\YsUpYMK.exe
  2⤵
  PID:8124
- C:\Windows\System\huxdpEs.exe
  C:\Windows\System\huxdpEs.exe
  2⤵
  PID:8160
- C:\Windows\System\WoOWNqi.exe
  C:\Windows\System\WoOWNqi.exe
  2⤵
  PID:8140
- C:\Windows\System\woVZBye.exe
  C:\Windows\System\woVZBye.exe
  2⤵
  PID:8040
- C:\Windows\System\uIocmRG.exe
  C:\Windows\System\uIocmRG.exe
  2⤵
  PID:8068
- C:\Windows\System\oxVNTXc.exe
  C:\Windows\System\oxVNTXc.exe
  2⤵
  PID:6980
- C:\Windows\System\VvaehLv.exe
  C:\Windows\System\VvaehLv.exe
  2⤵
  PID:7824
- C:\Windows\System\ZqOQffn.exe
  C:\Windows\System\ZqOQffn.exe
  2⤵
  PID:7932
- C:\Windows\System\ELPXabQ.exe
  C:\Windows\System\ELPXabQ.exe
  2⤵
  PID:5848
- C:\Windows\System\UdgSQcc.exe
  C:\Windows\System\UdgSQcc.exe
  2⤵
  PID:7224
- C:\Windows\System\EzvPIHH.exe
  C:\Windows\System\EzvPIHH.exe
  2⤵
  PID:7296
- C:\Windows\System\cnmkAEm.exe
  C:\Windows\System\cnmkAEm.exe
  2⤵
  PID:5604
- C:\Windows\System\uMyPRHj.exe
  C:\Windows\System\uMyPRHj.exe
  2⤵
  PID:3212
- C:\Windows\System\sJOpRjm.exe
  C:\Windows\System\sJOpRjm.exe
  2⤵
  PID:7412
- C:\Windows\System\hpczABK.exe
  C:\Windows\System\hpczABK.exe
  2⤵
  PID:7368
- C:\Windows\System\VRzYPoW.exe
  C:\Windows\System\VRzYPoW.exe
  2⤵
  PID:7512
- C:\Windows\System\YZukvXZ.exe
  C:\Windows\System\YZukvXZ.exe
  2⤵
  PID:7612
- C:\Windows\System\fFhVklx.exe
  C:\Windows\System\fFhVklx.exe
  2⤵
  PID:7564
- C:\Windows\System\NAEKHxQ.exe
  C:\Windows\System\NAEKHxQ.exe
  2⤵
  PID:7748
- C:\Windows\System\UsQTPuV.exe
  C:\Windows\System\UsQTPuV.exe
  2⤵
  PID:7800
- C:\Windows\System\PcPAqpR.exe
  C:\Windows\System\PcPAqpR.exe
  2⤵
  PID:7772
- C:\Windows\System\JKqcpwN.exe
  C:\Windows\System\JKqcpwN.exe
  2⤵
  PID:7640
- C:\Windows\System\AFCPmQJ.exe
  C:\Windows\System\AFCPmQJ.exe
  2⤵
  PID:7676
- C:\Windows\System\srYcyRt.exe
  C:\Windows\System\srYcyRt.exe
  2⤵
  PID:7908
- C:\Windows\System\TBDCWzL.exe
  C:\Windows\System\TBDCWzL.exe
  2⤵
  PID:8156
- C:\Windows\System\bdKqjfx.exe
  C:\Windows\System\bdKqjfx.exe
  2⤵
  PID:8112
- C:\Windows\System\oyQbkaJ.exe
  C:\Windows\System\oyQbkaJ.exe
  2⤵
  PID:6540
- C:\Windows\System\SkOSocg.exe
  C:\Windows\System\SkOSocg.exe
  2⤵
  PID:7892
- C:\Windows\System\cYpjGzD.exe
  C:\Windows\System\cYpjGzD.exe
  2⤵
  PID:7980
- C:\Windows\System\dncytzj.exe
  C:\Windows\System\dncytzj.exe
  2⤵
  PID:8072
- C:\Windows\System\pDEtgUN.exe
  C:\Windows\System\pDEtgUN.exe
  2⤵
  PID:6832
- C:\Windows\System\CzcWrkI.exe
  C:\Windows\System\CzcWrkI.exe
  2⤵
  PID:7384
- C:\Windows\System\SBspMUV.exe
  C:\Windows\System\SBspMUV.exe
  2⤵
  PID:7388
- C:\Windows\System\AZkDZqr.exe
  C:\Windows\System\AZkDZqr.exe
  2⤵
  PID:7316
- C:\Windows\System\Qetvkcd.exe
  C:\Windows\System\Qetvkcd.exe
  2⤵
  PID:7548
- C:\Windows\System\ZdiDaOP.exe
  C:\Windows\System\ZdiDaOP.exe
  2⤵
  PID:7780
- C:\Windows\System\xsOqicK.exe
  C:\Windows\System\xsOqicK.exe
  2⤵
  PID:7976
- C:\Windows\System\VjDTsyC.exe
  C:\Windows\System\VjDTsyC.exe
  2⤵
  PID:7788
- C:\Windows\System\UumSMWj.exe
  C:\Windows\System\UumSMWj.exe
  2⤵
  PID:7868
- C:\Windows\System\jQiRkZV.exe
  C:\Windows\System\jQiRkZV.exe
  2⤵
  PID:8036
- C:\Windows\System\CVfVlhH.exe
  C:\Windows\System\CVfVlhH.exe
  2⤵
  PID:7960
- C:\Windows\System\WJhOUMM.exe
  C:\Windows\System\WJhOUMM.exe
  2⤵
  PID:6888
- C:\Windows\System\qyoynbu.exe
  C:\Windows\System\qyoynbu.exe
  2⤵
  PID:7260
- C:\Windows\System\YMgJvhe.exe
  C:\Windows\System\YMgJvhe.exe
  2⤵
  PID:7336
- C:\Windows\System\qJgpJzZ.exe
  C:\Windows\System\qJgpJzZ.exe
  2⤵
  PID:7420
- C:\Windows\System\kOMIZEp.exe
  C:\Windows\System\kOMIZEp.exe
  2⤵
  PID:7428
- C:\Windows\System\VFlpaHC.exe
  C:\Windows\System\VFlpaHC.exe
  2⤵
  PID:8024
- C:\Windows\System\THtxAhL.exe
  C:\Windows\System\THtxAhL.exe
  2⤵
  PID:7700
- C:\Windows\System\KyzffRE.exe
  C:\Windows\System\KyzffRE.exe
  2⤵
  PID:7804
- C:\Windows\System\XOuZJIQ.exe
  C:\Windows\System\XOuZJIQ.exe
  2⤵
  PID:7528
- C:\Windows\System\KqBspDc.exe
  C:\Windows\System\KqBspDc.exe
  2⤵
  PID:7888
- C:\Windows\System\eqErVru.exe
  C:\Windows\System\eqErVru.exe
  2⤵
  PID:7256
- C:\Windows\System\bqKYTFA.exe
  C:\Windows\System\bqKYTFA.exe
  2⤵
  PID:7712
- C:\Windows\System\ukrTKJM.exe
  C:\Windows\System\ukrTKJM.exe
  2⤵
  PID:6396
- C:\Windows\System\pDTCziP.exe
  C:\Windows\System\pDTCziP.exe
  2⤵
  PID:7856
- C:\Windows\System\uwJgIRO.exe
  C:\Windows\System\uwJgIRO.exe
  2⤵
  PID:5652
- C:\Windows\System\NfYzfxM.exe
  C:\Windows\System\NfYzfxM.exe
  2⤵
  PID:7400
- C:\Windows\System\XukGvzk.exe
  C:\Windows\System\XukGvzk.exe
  2⤵
  PID:7208
- C:\Windows\System\FGZDLpB.exe
  C:\Windows\System\FGZDLpB.exe
  2⤵
  PID:7188
- C:\Windows\System\jpuGsAR.exe
  C:\Windows\System\jpuGsAR.exe
  2⤵
  PID:7984
- C:\Windows\System\RJsDIDX.exe
  C:\Windows\System\RJsDIDX.exe
  2⤵
  PID:7600
- C:\Windows\System\YBgiAPi.exe
  C:\Windows\System\YBgiAPi.exe
  2⤵
  PID:8196
- C:\Windows\System\EcBYoee.exe
  C:\Windows\System\EcBYoee.exe
  2⤵
  PID:8212
- C:\Windows\System\roEYvkm.exe
  C:\Windows\System\roEYvkm.exe
  2⤵
  PID:8252
- C:\Windows\System\ViBkpex.exe
  C:\Windows\System\ViBkpex.exe
  2⤵
  PID:8272
- C:\Windows\System\gPzLeJC.exe
  C:\Windows\System\gPzLeJC.exe
  2⤵
  PID:8288
- C:\Windows\System\KoHvIxo.exe
  C:\Windows\System\KoHvIxo.exe
  2⤵
  PID:8308
- C:\Windows\System\dyNNPZR.exe
  C:\Windows\System\dyNNPZR.exe
  2⤵
  PID:8324
- C:\Windows\System\jEudpFV.exe
  C:\Windows\System\jEudpFV.exe
  2⤵
  PID:8348
- C:\Windows\System\ETCIbcs.exe
  C:\Windows\System\ETCIbcs.exe
  2⤵
  PID:8364
- C:\Windows\System\IEDHYeX.exe
  C:\Windows\System\IEDHYeX.exe
  2⤵
  PID:8388
- C:\Windows\System\jtgtLLa.exe
  C:\Windows\System\jtgtLLa.exe
  2⤵
  PID:8416
- C:\Windows\System\XEpKKbA.exe
  C:\Windows\System\XEpKKbA.exe
  2⤵
  PID:8432
- C:\Windows\System\oyGdhBU.exe
  C:\Windows\System\oyGdhBU.exe
  2⤵
  PID:8452
- C:\Windows\System\iesatoP.exe
  C:\Windows\System\iesatoP.exe
  2⤵
  PID:8472
- C:\Windows\System\TOIqRmN.exe
  C:\Windows\System\TOIqRmN.exe
  2⤵
  PID:8488
- C:\Windows\System\GfpLunt.exe
  C:\Windows\System\GfpLunt.exe
  2⤵
  PID:8504
- C:\Windows\System\NXSsOgA.exe
  C:\Windows\System\NXSsOgA.exe
  2⤵
  PID:8520
- C:\Windows\System\YStqgFF.exe
  C:\Windows\System\YStqgFF.exe
  2⤵
  PID:8540
- C:\Windows\System\QYRYlrm.exe
  C:\Windows\System\QYRYlrm.exe
  2⤵
  PID:8576
- C:\Windows\System\LssGeMS.exe
  C:\Windows\System\LssGeMS.exe
  2⤵
  PID:8592
- C:\Windows\System\CIRfhzS.exe
  C:\Windows\System\CIRfhzS.exe
  2⤵
  PID:8612
- C:\Windows\System\wHXgOCN.exe
  C:\Windows\System\wHXgOCN.exe
  2⤵
  PID:8628
- C:\Windows\System\QkjDNtf.exe
  C:\Windows\System\QkjDNtf.exe
  2⤵
  PID:8648
- C:\Windows\System\ssoHBpI.exe
  C:\Windows\System\ssoHBpI.exe
  2⤵
  PID:8664
- C:\Windows\System\loqiabZ.exe
  C:\Windows\System\loqiabZ.exe
  2⤵
  PID:8680
- C:\Windows\System\GrOMEMY.exe
  C:\Windows\System\GrOMEMY.exe
  2⤵
  PID:8696
- C:\Windows\System\tFtqKjq.exe
  C:\Windows\System\tFtqKjq.exe
  2⤵
  PID:8716
- C:\Windows\System\CskZhcK.exe
  C:\Windows\System\CskZhcK.exe
  2⤵
  PID:8732
- C:\Windows\System\VfGEMXY.exe
  C:\Windows\System\VfGEMXY.exe
  2⤵
  PID:8780
- C:\Windows\System\rHBKvTO.exe
  C:\Windows\System\rHBKvTO.exe
  2⤵
  PID:8796
- C:\Windows\System\KuspNnn.exe
  C:\Windows\System\KuspNnn.exe
  2⤵
  PID:8820
- C:\Windows\System\lBoHJrx.exe
  C:\Windows\System\lBoHJrx.exe
  2⤵
  PID:8836
- C:\Windows\System\dtWiVRX.exe
  C:\Windows\System\dtWiVRX.exe
  2⤵
  PID:8852
- C:\Windows\System\DhjwbGd.exe
  C:\Windows\System\DhjwbGd.exe
  2⤵
  PID:8868
- C:\Windows\System\JyERBrk.exe
  C:\Windows\System\JyERBrk.exe
  2⤵
  PID:8892
- C:\Windows\System\FWqcoCT.exe
  C:\Windows\System\FWqcoCT.exe
  2⤵
  PID:8912
- C:\Windows\System\pAlnYmR.exe
  C:\Windows\System\pAlnYmR.exe
  2⤵
  PID:8928
- C:\Windows\System\oOoZYIq.exe
  C:\Windows\System\oOoZYIq.exe
  2⤵
  PID:8944
- C:\Windows\System\zspOSDi.exe
  C:\Windows\System\zspOSDi.exe
  2⤵
  PID:8964
- C:\Windows\System\ITwivMj.exe
  C:\Windows\System\ITwivMj.exe
  2⤵
  PID:8992
- C:\Windows\System\DAwtTKv.exe
  C:\Windows\System\DAwtTKv.exe
  2⤵
  PID:9008
- C:\Windows\System\gYrRNPz.exe
  C:\Windows\System\gYrRNPz.exe
  2⤵
  PID:9024
- C:\Windows\System\kTTmhWA.exe
  C:\Windows\System\kTTmhWA.exe
  2⤵
  PID:9040
- C:\Windows\System\DAZfCoj.exe
  C:\Windows\System\DAZfCoj.exe
  2⤵
  PID:9064
- C:\Windows\System\JeoNOWr.exe
  C:\Windows\System\JeoNOWr.exe
  2⤵
  PID:9080
- C:\Windows\System\lQlcbzu.exe
  C:\Windows\System\lQlcbzu.exe
  2⤵
  PID:9112
- C:\Windows\System\mqnPDMT.exe
  C:\Windows\System\mqnPDMT.exe
  2⤵
  PID:9128
- C:\Windows\System\WepHvlq.exe
  C:\Windows\System\WepHvlq.exe
  2⤵
  PID:9152
- C:\Windows\System\ZpSobOq.exe
  C:\Windows\System\ZpSobOq.exe
  2⤵
  PID:9172
- C:\Windows\System\nKEwmvn.exe
  C:\Windows\System\nKEwmvn.exe
  2⤵
  PID:9192
- C:\Windows\System\gtroxgs.exe
  C:\Windows\System\gtroxgs.exe
  2⤵
  PID:8076
- C:\Windows\System\okrRqrU.exe
  C:\Windows\System\okrRqrU.exe
  2⤵
  PID:8204
- C:\Windows\System\jrmIoom.exe
  C:\Windows\System\jrmIoom.exe
  2⤵
  PID:8240
- C:\Windows\System\kCWgVJE.exe
  C:\Windows\System\kCWgVJE.exe
  2⤵
  PID:8268
- C:\Windows\System\TcClBAc.exe
  C:\Windows\System\TcClBAc.exe
  2⤵
  PID:8320
- C:\Windows\System\iwHaAkV.exe
  C:\Windows\System\iwHaAkV.exe
  2⤵
  PID:8356
- C:\Windows\System\bYDglMJ.exe
  C:\Windows\System\bYDglMJ.exe
  2⤵
  PID:8360
- C:\Windows\System\MPihMYT.exe
  C:\Windows\System\MPihMYT.exe
  2⤵
  PID:8428
- C:\Windows\System\vmsnMwz.exe
  C:\Windows\System\vmsnMwz.exe
  2⤵
  PID:8512
- C:\Windows\System\cvIBAog.exe
  C:\Windows\System\cvIBAog.exe
  2⤵
  PID:8548
- C:\Windows\System\QYNcOkB.exe
  C:\Windows\System\QYNcOkB.exe
  2⤵
  PID:8496
- C:\Windows\System\CCuFByD.exe
  C:\Windows\System\CCuFByD.exe
  2⤵
  PID:8556
- C:\Windows\System\iimRZpq.exe
  C:\Windows\System\iimRZpq.exe
  2⤵
  PID:8584
- C:\Windows\System\KzNLogF.exe
  C:\Windows\System\KzNLogF.exe
  2⤵
  PID:8636
- C:\Windows\System\fzgAxPe.exe
  C:\Windows\System\fzgAxPe.exe
  2⤵
  PID:8676
- C:\Windows\System\YNJKbNe.exe
  C:\Windows\System\YNJKbNe.exe
  2⤵
  PID:8688
- C:\Windows\System\kelCktT.exe
  C:\Windows\System\kelCktT.exe
  2⤵
  PID:8624
- C:\Windows\System\TLvrZZt.exe
  C:\Windows\System\TLvrZZt.exe
  2⤵
  PID:8760
- C:\Windows\System\yoUFXsN.exe
  C:\Windows\System\yoUFXsN.exe
  2⤵
  PID:8788
- C:\Windows\System\VBIqAyo.exe
  C:\Windows\System\VBIqAyo.exe
  2⤵
  PID:8812
- C:\Windows\System\PzvRARM.exe
  C:\Windows\System\PzvRARM.exe
  2⤵
  PID:8880
- C:\Windows\System\YFdkwRL.exe
  C:\Windows\System\YFdkwRL.exe
  2⤵
  PID:8956
- C:\Windows\System\PKPGlIf.exe
  C:\Windows\System\PKPGlIf.exe
  2⤵
  PID:8960
- C:\Windows\System\MHKcPeX.exe
  C:\Windows\System\MHKcPeX.exe
  2⤵
  PID:9072
- C:\Windows\System\IcnoJGY.exe
  C:\Windows\System\IcnoJGY.exe
  2⤵
  PID:8908
- C:\Windows\System\sIzelNV.exe
  C:\Windows\System\sIzelNV.exe
  2⤵
  PID:8984
- C:\Windows\System\hHyRqDF.exe
  C:\Windows\System\hHyRqDF.exe
  2⤵
  PID:9048
- C:\Windows\System\LetrsEd.exe
  C:\Windows\System\LetrsEd.exe
  2⤵
  PID:9124
- C:\Windows\System\YQBYFeo.exe
  C:\Windows\System\YQBYFeo.exe
  2⤵
  PID:9136
- C:\Windows\System\tUIpZGG.exe
  C:\Windows\System\tUIpZGG.exe
  2⤵
  PID:9212
- C:\Windows\System\tfNCdDs.exe
  C:\Windows\System\tfNCdDs.exe
  2⤵
  PID:9108
- C:\Windows\System\RXRprtQ.exe
  C:\Windows\System\RXRprtQ.exe
  2⤵
  PID:9104
- C:\Windows\System\jwXasud.exe
  C:\Windows\System\jwXasud.exe
  2⤵
  PID:8280
- C:\Windows\System\kWkgZys.exe
  C:\Windows\System\kWkgZys.exe
  2⤵
  PID:8376
- C:\Windows\System\vPdtCNR.exe
  C:\Windows\System\vPdtCNR.exe
  2⤵
  PID:8220
- C:\Windows\System\CsLomhQ.exe
  C:\Windows\System\CsLomhQ.exe
  2⤵
  PID:8444
- C:\Windows\System\SzsQGJt.exe
  C:\Windows\System\SzsQGJt.exe
  2⤵
  PID:8516
- C:\Windows\System\ZVuBBMm.exe
  C:\Windows\System\ZVuBBMm.exe
  2⤵
  PID:8640
- C:\Windows\System\QMyTcCY.exe
  C:\Windows\System\QMyTcCY.exe
  2⤵
  PID:8692
- C:\Windows\System\pccJXcP.exe
  C:\Windows\System\pccJXcP.exe
  2⤵
  PID:8728
- C:\Windows\System\xwGnjPP.exe
  C:\Windows\System\xwGnjPP.exe
  2⤵
  PID:8712
- C:\Windows\System\jxEJFZi.exe
  C:\Windows\System\jxEJFZi.exe
  2⤵
  PID:8844
- C:\Windows\System\sNwfPEH.exe
  C:\Windows\System\sNwfPEH.exe
  2⤵
  PID:8756
- C:\Windows\System\WOjooEK.exe
  C:\Windows\System\WOjooEK.exe
  2⤵
  PID:1580
- C:\Windows\System\bnMUXIv.exe
  C:\Windows\System\bnMUXIv.exe
  2⤵
  PID:8920
- C:\Windows\System\lXjApmD.exe
  C:\Windows\System\lXjApmD.exe
  2⤵
  PID:9020
- C:\Windows\System\ksUVMim.exe
  C:\Windows\System\ksUVMim.exe
  2⤵
  PID:9056
- C:\Windows\System\PeFaFeT.exe
  C:\Windows\System\PeFaFeT.exe
  2⤵
  PID:8952
- C:\Windows\System\MXJChkj.exe
  C:\Windows\System\MXJChkj.exe
  2⤵
  PID:8296
- C:\Windows\System\SfyrsmJ.exe
  C:\Windows\System\SfyrsmJ.exe
  2⤵
  PID:9148
- C:\Windows\System\PiGHLfp.exe
  C:\Windows\System\PiGHLfp.exe
  2⤵
  PID:9144
- C:\Windows\System\PMwtpXq.exe
  C:\Windows\System\PMwtpXq.exe
  2⤵
  PID:8336
- C:\Windows\System\eHbAuFR.exe
  C:\Windows\System\eHbAuFR.exe
  2⤵
  PID:8480
- C:\Windows\System\bmjcGoK.exe
  C:\Windows\System\bmjcGoK.exe
  2⤵
  PID:8404
- C:\Windows\System\oFtikVQ.exe
  C:\Windows\System\oFtikVQ.exe
  2⤵
  PID:8708
- C:\Windows\System\ZthwBuE.exe
  C:\Windows\System\ZthwBuE.exe
  2⤵
  PID:8776
- C:\Windows\System\mYJiPbR.exe
  C:\Windows\System\mYJiPbR.exe
  2⤵
  PID:8816
- C:\Windows\System\hhuELcM.exe
  C:\Windows\System\hhuELcM.exe
  2⤵
  PID:9200
- C:\Windows\System\BWKUagu.exe
  C:\Windows\System\BWKUagu.exe
  2⤵
  PID:8236
- C:\Windows\System\IvyYgzu.exe
  C:\Windows\System\IvyYgzu.exe
  2⤵
  PID:9120
- C:\Windows\System\GnZFXwF.exe
  C:\Windows\System\GnZFXwF.exe
  2⤵
  PID:8400
- C:\Windows\System\NTGCHpW.exe
  C:\Windows\System\NTGCHpW.exe
  2⤵
  PID:8248
- C:\Windows\System\hVsqDHu.exe
  C:\Windows\System\hVsqDHu.exe
  2⤵
  PID:9100
- C:\Windows\System\zKpfJww.exe
  C:\Windows\System\zKpfJww.exe
  2⤵
  PID:9016
- C:\Windows\System\NbRqres.exe
  C:\Windows\System\NbRqres.exe
  2⤵
  PID:8604
- C:\Windows\System\bhInZew.exe
  C:\Windows\System\bhInZew.exe
  2⤵
  PID:8980
- C:\Windows\System\hrZIqqZ.exe
  C:\Windows\System\hrZIqqZ.exe
  2⤵
  PID:8772
- C:\Windows\System\mUcFdWa.exe
  C:\Windows\System\mUcFdWa.exe
  2⤵
  PID:8396
- C:\Windows\System\qFDPMfX.exe
  C:\Windows\System\qFDPMfX.exe
  2⤵
  PID:8316
- C:\Windows\System\JgKXUjw.exe
  C:\Windows\System\JgKXUjw.exe
  2⤵
  PID:9224
- C:\Windows\System\IGLjSGV.exe
  C:\Windows\System\IGLjSGV.exe
  2⤵
  PID:9268
- C:\Windows\System\MtksoTK.exe
  C:\Windows\System\MtksoTK.exe
  2⤵
  PID:9288
- C:\Windows\System\jOkNuuf.exe
  C:\Windows\System\jOkNuuf.exe
  2⤵
  PID:9304
- C:\Windows\System\iXQiVAU.exe
  C:\Windows\System\iXQiVAU.exe
  2⤵
  PID:9320
- C:\Windows\System\WNcDWmy.exe
  C:\Windows\System\WNcDWmy.exe
  2⤵
  PID:9340
- C:\Windows\System\XjtWYaA.exe
  C:\Windows\System\XjtWYaA.exe
  2⤵
  PID:9356
- C:\Windows\System\mfrtCOg.exe
  C:\Windows\System\mfrtCOg.exe
  2⤵
  PID:9372
- C:\Windows\System\mdeuxYK.exe
  C:\Windows\System\mdeuxYK.exe
  2⤵
  PID:9408
- C:\Windows\System\aeEPBiE.exe
  C:\Windows\System\aeEPBiE.exe
  2⤵
  PID:9424
- C:\Windows\System\qyFMFKt.exe
  C:\Windows\System\qyFMFKt.exe
  2⤵
  PID:9444
- C:\Windows\System\hlqevGP.exe
  C:\Windows\System\hlqevGP.exe
  2⤵
  PID:9464
- C:\Windows\System\fPNCtlu.exe
  C:\Windows\System\fPNCtlu.exe
  2⤵
  PID:9484
- C:\Windows\System\UPHvfbd.exe
  C:\Windows\System\UPHvfbd.exe
  2⤵
  PID:9500
- C:\Windows\System\IMfPuDb.exe
  C:\Windows\System\IMfPuDb.exe
  2⤵
  PID:9520
- C:\Windows\System\rQhCWCA.exe
  C:\Windows\System\rQhCWCA.exe
  2⤵
  PID:9544
- C:\Windows\System\RXAmKsQ.exe
  C:\Windows\System\RXAmKsQ.exe
  2⤵
  PID:9568
- C:\Windows\System\GOYecrl.exe
  C:\Windows\System\GOYecrl.exe
  2⤵
  PID:9584
- C:\Windows\System\WtApZkB.exe
  C:\Windows\System\WtApZkB.exe
  2⤵
  PID:9604
- C:\Windows\System\llzhcQE.exe
  C:\Windows\System\llzhcQE.exe
  2⤵
  PID:9620
- C:\Windows\System\fDPhcXi.exe
  C:\Windows\System\fDPhcXi.exe
  2⤵
  PID:9640
- C:\Windows\System\grFAiyi.exe
  C:\Windows\System\grFAiyi.exe
  2⤵
  PID:9664
- C:\Windows\System\gHimUHV.exe
  C:\Windows\System\gHimUHV.exe
  2⤵
  PID:9692
- C:\Windows\System\XZQCRTw.exe
  C:\Windows\System\XZQCRTw.exe
  2⤵
  PID:9712
- C:\Windows\System\gmTpNAR.exe
  C:\Windows\System\gmTpNAR.exe
  2⤵
  PID:9728
- C:\Windows\System\NDCJWBj.exe
  C:\Windows\System\NDCJWBj.exe
  2⤵
  PID:9752
- C:\Windows\System\kToFTLM.exe
  C:\Windows\System\kToFTLM.exe
  2⤵
  PID:9768
- C:\Windows\System\ZGVntMi.exe
  C:\Windows\System\ZGVntMi.exe
  2⤵
  PID:9784
- C:\Windows\System\KmLucSj.exe
  C:\Windows\System\KmLucSj.exe
  2⤵
  PID:9808
- C:\Windows\System\tYrLKpb.exe
  C:\Windows\System\tYrLKpb.exe
  2⤵
  PID:9824
- C:\Windows\System\QyPHfQG.exe
  C:\Windows\System\QyPHfQG.exe
  2⤵
  PID:9840
- C:\Windows\System\lNwQXeI.exe
  C:\Windows\System\lNwQXeI.exe
  2⤵
  PID:9864
- C:\Windows\System\ZohRfpm.exe
  C:\Windows\System\ZohRfpm.exe
  2⤵
  PID:9880
- C:\Windows\System\nUqlPjl.exe
  C:\Windows\System\nUqlPjl.exe
  2⤵
  PID:9904
- C:\Windows\System\GkNLQSs.exe
  C:\Windows\System\GkNLQSs.exe
  2⤵
  PID:9928
- C:\Windows\System\ZQwhCXK.exe
  C:\Windows\System\ZQwhCXK.exe
  2⤵
  PID:9948
- C:\Windows\System\xKXozci.exe
  C:\Windows\System\xKXozci.exe
  2⤵
  PID:9968
- C:\Windows\System\OtZVLee.exe
  C:\Windows\System\OtZVLee.exe
  2⤵
  PID:9984
- C:\Windows\System\pFqXKQg.exe
  C:\Windows\System\pFqXKQg.exe
  2⤵
  PID:10008
- C:\Windows\System\GizfHiz.exe
  C:\Windows\System\GizfHiz.exe
  2⤵
  PID:10024
- C:\Windows\System\tyjQbwK.exe
  C:\Windows\System\tyjQbwK.exe
  2⤵
  PID:10044
- C:\Windows\System\rgKKUaM.exe
  C:\Windows\System\rgKKUaM.exe
  2⤵
  PID:10060
- C:\Windows\System\YeZYTQJ.exe
  C:\Windows\System\YeZYTQJ.exe
  2⤵
  PID:10076
- C:\Windows\System\SYHFKsY.exe
  C:\Windows\System\SYHFKsY.exe
  2⤵
  PID:10092
- C:\Windows\System\FagHnTA.exe
  C:\Windows\System\FagHnTA.exe
  2⤵
  PID:10108
- C:\Windows\System\HfkXJpd.exe
  C:\Windows\System\HfkXJpd.exe
  2⤵
  PID:10148
- C:\Windows\System\iTcXYWA.exe
  C:\Windows\System\iTcXYWA.exe
  2⤵
  PID:10168
- C:\Windows\System\LdwHJBF.exe
  C:\Windows\System\LdwHJBF.exe
  2⤵
  PID:10188
- C:\Windows\System\hPTZuOU.exe
  C:\Windows\System\hPTZuOU.exe
  2⤵
  PID:10208
- C:\Windows\System\AkPduwP.exe
  C:\Windows\System\AkPduwP.exe
  2⤵
  PID:10232
- C:\Windows\System\vtPbZOV.exe
  C:\Windows\System\vtPbZOV.exe
  2⤵
  PID:8232
- C:\Windows\System\rxLQMKR.exe
  C:\Windows\System\rxLQMKR.exe
  2⤵
  PID:8876
- C:\Windows\System\UqZqgGq.exe
  C:\Windows\System\UqZqgGq.exe
  2⤵
  PID:8440
- C:\Windows\System\bNHcjoG.exe
  C:\Windows\System\bNHcjoG.exe
  2⤵
  PID:8752
- C:\Windows\System\aTAKbxs.exe
  C:\Windows\System\aTAKbxs.exe
  2⤵
  PID:9252
- C:\Windows\System\vQSQjCD.exe
  C:\Windows\System\vQSQjCD.exe
  2⤵
  PID:9296
- C:\Windows\System\MZEHAdQ.exe
  C:\Windows\System\MZEHAdQ.exe
  2⤵
  PID:9316
- C:\Windows\System\lCvOBTg.exe
  C:\Windows\System\lCvOBTg.exe
  2⤵
  PID:9352
- C:\Windows\System\UJpfADf.exe
  C:\Windows\System\UJpfADf.exe
  2⤵
  PID:9392
- C:\Windows\System\JzkCSjr.exe
  C:\Windows\System\JzkCSjr.exe
  2⤵
  PID:9416
- C:\Windows\System\UdNSveB.exe
  C:\Windows\System\UdNSveB.exe
  2⤵
  PID:9440
- C:\Windows\System\gOvlEkU.exe
  C:\Windows\System\gOvlEkU.exe
  2⤵
  PID:9460
- C:\Windows\System\QKHVwGL.exe
  C:\Windows\System\QKHVwGL.exe
  2⤵
  PID:9512
- C:\Windows\System\Osmanze.exe
  C:\Windows\System\Osmanze.exe
  2⤵
  PID:9540
- C:\Windows\System\nxECcsx.exe
  C:\Windows\System\nxECcsx.exe
  2⤵
  PID:9556
- C:\Windows\System\waYIgHo.exe
  C:\Windows\System\waYIgHo.exe
  2⤵
  PID:9600
- C:\Windows\System\azUoAcb.exe
  C:\Windows\System\azUoAcb.exe
  2⤵
  PID:9648
- C:\Windows\System\nvcIOTx.exe
  C:\Windows\System\nvcIOTx.exe
  2⤵
  PID:9652
- C:\Windows\System\NRyIWmh.exe
  C:\Windows\System\NRyIWmh.exe
  2⤵
  PID:9688
- C:\Windows\System\zdWZZRc.exe
  C:\Windows\System\zdWZZRc.exe
  2⤵
  PID:9704
- C:\Windows\System\QVjgaJE.exe
  C:\Windows\System\QVjgaJE.exe
  2⤵
  PID:9740
- C:\Windows\System\MKkIrVz.exe
  C:\Windows\System\MKkIrVz.exe
  2⤵
  PID:9848
- C:\Windows\System\CFtLfcp.exe
  C:\Windows\System\CFtLfcp.exe
  2⤵
  PID:9832
- C:\Windows\System\pDZtiPh.exe
  C:\Windows\System\pDZtiPh.exe
  2⤵
  PID:9852
- C:\Windows\System\qeqvfEu.exe
  C:\Windows\System\qeqvfEu.exe
  2⤵
  PID:9892
- C:\Windows\System\JBIgbiN.exe
  C:\Windows\System\JBIgbiN.exe
  2⤵
  PID:9924
- C:\Windows\System\AqhdEzr.exe
  C:\Windows\System\AqhdEzr.exe
  2⤵
  PID:9960
- C:\Windows\System\daRlHkh.exe
  C:\Windows\System\daRlHkh.exe
  2⤵
  PID:10000
- C:\Windows\System\TjJiiHV.exe
  C:\Windows\System\TjJiiHV.exe
  2⤵
  PID:10040
- C:\Windows\System\lnFWeso.exe
  C:\Windows\System\lnFWeso.exe
  2⤵
  PID:10072
- C:\Windows\System\FOIVZen.exe
  C:\Windows\System\FOIVZen.exe
  2⤵
  PID:10120
- C:\Windows\System\kkSHtZW.exe
  C:\Windows\System\kkSHtZW.exe
  2⤵
  PID:10128
- C:\Windows\System\FDRHSuO.exe
  C:\Windows\System\FDRHSuO.exe
  2⤵
  PID:10136
- C:\Windows\System\WzQgxdv.exe
  C:\Windows\System\WzQgxdv.exe
  2⤵
  PID:10216
- C:\Windows\System\ImhBzDc.exe
  C:\Windows\System\ImhBzDc.exe
  2⤵
  PID:9232
- C:\Windows\System\JSDTvqo.exe
  C:\Windows\System\JSDTvqo.exe
  2⤵
  PID:8936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BUDBZMh.exe

Filesize
1.1MB

MD5
1000ef8ab21f81bf07e0b724345fe94f

SHA1
0a446161afe429ae4e42f7757ada36e31fea6db8

SHA256
b4ac6814c9012a24531ecc33cb27181991fad2a5c3e39bed55d3edcb00112994

SHA512
4183d74ee7e715d69babebfefdc12b0c73ef1e98f9fd68b233284396c28c057f547e08d3932bfbc6e703616bf9a2e986490187f52ade8a87f5d5f6e2d320b8ae

Download Submit
C:\Windows\system\BXnpbNX.exe

Filesize
2.2MB

MD5
1c7a3a6aa1638ee04b7a71d9e2dceb2b

SHA1
0c36194ed8c4429aa336627113e3aee6ea6279af

SHA256
637392576b79b4a2456d68938b66ac4750aa0341206b3f29d48471194878a344

SHA512
246925e21786453aac1a24ab8aaff6df89a53507ecf65f8538473fd208039472cdaf9bfdc4b98c0550f87ec62749101c836d749fbdcb1c10f3239c671ea9ca95

Download Submit
C:\Windows\system\DVPtYlD.exe

Filesize
2.2MB

MD5
cfb1741c04dac0e2b988698208e3a31b

SHA1
2863c74aad05a3d4ab04dc754b764acb08bb2473

SHA256
62ec5552db5f12e2dd8802487556d32bda370eb4182862280fa26662ddad0147

SHA512
fd20a26293b34d376d02b04a561cbb13abf04950c16bd385953106baf5f687a05841e80f7ec4c235988c2a36c18d4ef1a8030654573ae4079d8a9bf3e20cc8d2

Download Submit
C:\Windows\system\EKRPzFH.exe

Filesize
2.2MB

MD5
c3725616023e4ab29d7b07015b1b2b3c

SHA1
2f541314f71196dc2c193375a8ed8f05e2e68477

SHA256
da5db43b8371c591495c74cfce12025b5cacbdbca01bef78f945a64fd0b9d6a9

SHA512
5520459a1b5392ac92a634098135aeda792fdb5a6aeeaf638e74811bd0f169d9f2637a7dd878e23f1ecaed7d6955878064b13d4d26ad402f98d668341eca90a8

Download Submit
C:\Windows\system\FUqacbh.exe

Filesize
2.2MB

MD5
84604c098c256e0e9d389ac9ddaaeae9

SHA1
3f8e2e3cdfb3afc68f5cb60bbb9c8137967e1b8b

SHA256
4b8c4f83b2f7f2f4ca726accdcbbf082150ac6f23a58252685cc924f4e92e53b

SHA512
5155d016075577826c3cf5dae6b3c42d4bc77287242cc00b32c71977ade83536e8cad4733e774868a9efe7030f995820186a41ad76865eddcf0b8deb946812f6

Download Submit
C:\Windows\system\PsjUieR.exe

Filesize
2.2MB

MD5
7dd63c2f4487f5d55f8dcc5c54207441

SHA1
16a5d67e80ba299c5dc4a7f393a6a4c420b3647e

SHA256
fc4be5fa1683a52e34fac1e3afef9f8309d98848a6b105f55a12e020374502ce

SHA512
cea2cac5eb889d75acba73e1618bf3d56a4b8886d3c0b78a23b2f2273d368d53c12dd323cacfba6769b80a3ce636d04ad75b899a4472a6095cf4dc34bc2b6a02

Download Submit
C:\Windows\system\QhdooId.exe

Filesize
2.3MB

MD5
fb88d2ccad8d411af853b4be488f0c24

SHA1
f4ea70909cff9126ff6173a918ae1cde9ee32867

SHA256
311fa0506201abd66f97d810163452ef6a1cb85ce4a46bf144d707937970aba2

SHA512
2a67389c631b5fa559d35c54fdd1f7a125387583b5068defe128ae817a46548298af465b3724160eda438a9162e31d5c2ae5015dcefe656b0e52e195c36f0231

Download Submit
C:\Windows\system\QrYyBTK.exe

Filesize
2.2MB

MD5
794a8d7d28c2910ed22d982c24f995d8

SHA1
8cdb5b17f2b725a894fee9c3f5681dbaf8238175

SHA256
b7785060008c72175f2b69ead3386d0f54e642049fde1cabfb876e692c5f6d13

SHA512
d2b0d3427632b0c40fc874b9fd29c2accd07934a7887ab3b6690f68c0b4d9553b79bb14b3f535d64eee8eb10556622272c4ad2239eb938d019d8540956754a30

Download Submit
C:\Windows\system\VatRSiz.exe

Filesize
2.2MB

MD5
a163e0ea33caebd36e7d7b4f7c080542

SHA1
0e150b21d370b98d42eb1f8e50d46cc7d53afc49

SHA256
11ce370884022e1b70d26d10da92cce030d5777eb3294f6655029d6614f83a13

SHA512
8b74916f9b713256cdca749d8d6c2483efcfc81a85e0cbd6faba9229f7d0c11a829493cf7272d114e81f6262fc7dac9011a752a1c1728a2c7b3ec4505a6d018b

Download Submit
C:\Windows\system\YmxuMPy.exe

Filesize
2.2MB

MD5
3b68197b218ff57eb9eb0236330c5452

SHA1
c0a666828987eb2597c5047d0ff418658c0cec41

SHA256
3e9d9338fec7d5ee2612e928ad3a4eb8f6eeaaa37973ca582d74813df896d18b

SHA512
e3385a0c2b8d7536fce4959664725df80e0bdb738cdd46facf7f8d8e7490f5ac656df24b9722735cf062d9d0f03ee6b4cd83e07a7b9feb160bf9ef8a607fc54a

Download Submit
C:\Windows\system\ZPxbxEZ.exe

Filesize
2.2MB

MD5
6905a9806e76c66672ac3250b59ea521

SHA1
0bfd4d6eb3e50851ee296a93e19dbe6696c0b37d

SHA256
dde23f753cb2063029558964bb7ad7561df7af924d5405fefff0d923e5900675

SHA512
8303804056c4e79746a110259a345b36f581ae97e1d5ca367dd1cf03eb9eed88cd61d54b7591ac51b4c783bbc4c0f04ec406af1e6e80645385947bf2ea8d8690

Download Submit
C:\Windows\system\baNZxWJ.exe

Filesize
2.2MB

MD5
fa0ea454a26e08f3533a1736077b43c0

SHA1
647ad3b9b1495d0baf851ea512ccbf03652a256f

SHA256
a7f5374e162b557471044e53183770c22136221ff2b476ee9f89122ccaec2a65

SHA512
1e9cbde06cd6b3fd2713da93e5ed3cbe01b5f6d17c6e88e8b42c9f4a7b4df2474122dffc48994da3abb652ad09d33c65f0b5ba70fec530fac59d3c05a51230ce

Download Submit
C:\Windows\system\fctOcFf.exe

Filesize
2.3MB

MD5
7d896db9860932da7d016a9f46020aba

SHA1
7e057bf1abf1c0bfa0aa78785ca63cb4b3442454

SHA256
ed2be8093a02faf8a2cb8a3cc95d40222b917374667f85d01e126c42ee8bcc51

SHA512
a75cf992fbca02451bab871613cca39b9cb024dcaddf65010bfd78d8a2cae10e58a23536b022aaa02192146c7681a45d7fd29d64bb80611bcc69bf0174fc7e88

Download Submit
C:\Windows\system\kEJmsul.exe

Filesize
2.2MB

MD5
002bc74376da55e5351b0cad93aaaddd

SHA1
9d673df6d83cffd98a3c1747d0638846f2be8537

SHA256
cd0e0853c4b0da7fa21ed4bb0c570d5882b550b70cd1277f13392b9dae187ebb

SHA512
d37f4bc1392ffb55addec1b6e8e012f4fc2c061b068261cf836f5778f873a8fe2a5ff849b40ac1cec32a1a5e1cad5d708886dd6ec9b6e14be295c8005fdc4934

Download Submit
C:\Windows\system\kTRyecn.exe

Filesize
2.3MB

MD5
f99ba3c16d150fc5ecbcc308cdaca1dc

SHA1
adbdc816efa97af6210c2d09d738d07029b962a7

SHA256
f9a91debff02b93cad9806014c695730782745257d00fe1ef24eb4a2093a74cc

SHA512
fb755571a0c89a6158c4e60c64b5e213f8a9b9d2a9bc48f455a5b7d551c9af6c3d8e7020f2510034c5b995d6460e1df3e1610d4818e980ba93f8b2851c8390a0

Download Submit
C:\Windows\system\khcQKJw.exe

Filesize
2.3MB

MD5
ff933b74171b17a5eab5027856960c77

SHA1
711efef4126af129e867d15926423a2edd7dc1d0

SHA256
1dad798c3404c53d54c5d28e126dbe55fe2e86ac7ce715422201e88e7eca54fe

SHA512
e97a7f62f89074bce104de301752a9e04e9864c06f7294af6ee7379b9dd37f0a397de19ba1e529726f35ff463b4edc2037f83c0f3ac1f03afbf12a0fc817758d

Download Submit
C:\Windows\system\mBocyzN.exe

Filesize
2.2MB

MD5
322139b52a193363064f0e5713f7b258

SHA1
bdf11ed7c5c7647a0d2ab89bb40acecbd5163348

SHA256
eebd18052c2f42b210c946213c1ffeedf8f7612276767d6650d24a0eea0dd3ca

SHA512
e4b09716b500801d85b7bf35756cf03c473e21c379cf762644fd294fd923225cfbcbf5238c0ab9653682f7798ddc91a7c6067d2a5ac2cb963abc778aa5b3aa57

Download Submit
C:\Windows\system\nbBbSwC.exe

Filesize
2.2MB

MD5
875bfd6dcac6450ac9cbc26cbfe47cc0

SHA1
2e297f46dd061a7639ca6318a8f6d6e182c5ac64

SHA256
9e7c2b2277c6140268bb3acc6e6e1b42ecad2bd852014c18e5767c98d9ee44a4

SHA512
07ab480a7b994e3c2baa168435ff26eaff2d1fda768dc5a2e7bd602b5f3adaafcdeb9e536995326482598a3457bfc97c1741b84522efc7e751caab01ea0597d0

Download Submit
C:\Windows\system\oVIKTbB.exe

Filesize
2.2MB

MD5
fe8f810d114dd4014c29bf403d1ebf16

SHA1
a1f8bf41c83d601b746eff2568d11a8a8098d9d7

SHA256
b46cefbe94b88de469faa1c295ada9de851372d1c9c25622b999fc5a260e24dd

SHA512
b5b14fcb1c6f15f7c28075ff755fb84a292bc4ed9a154a460cadff9eb3a86aea556ddbc4148a1988ee19ddd30e0411f4579aed86e2b5ffc337e12c1b5ccfd84d

Download Submit
C:\Windows\system\odLmzkr.exe

Filesize
2.2MB

MD5
b571a191a282375cbfb9c5c42ca316c1

SHA1
918498d290cfabc8abe8bb2e9c157b53009d36b3

SHA256
1ab71ea4e4a857ac70d94f6d4eff737f5737ae97e8655003532ca4ed833a3ecc

SHA512
ca23b5366b3602a643398b667ec4918b4abd51e1c3f312051996b6a21b9217afb9f79109d1a0d79eeaa1410e037300b454fdb33c7f7c348d198feec3b20cb3c1

Download Submit
C:\Windows\system\ofaOkSW.exe

Filesize
2.2MB

MD5
7a44ca78f338f9eb6856af30e4e530d6

SHA1
4fa734aceda9bc902bc1f5e1cbbf306c1b463c0f

SHA256
04594fd31cc66353fab82b1e3bfcefec20adedc536b59f90f611212eccdce545

SHA512
ef9359d793fba0bb44ba4e1e2f6214418a6cefaecfb7c37b828a3a7787a264f0c7576da72c00abfaa48a8eb90e80b95c08c785ea922c257b142070027c17ee81

Download Submit
C:\Windows\system\paLhFXu.exe

Filesize
2.3MB

MD5
d0b85e1cea6b0b0ad19325821c925468

SHA1
ccb3b3fa29e05d6c1c2fd127ece96df0216e4e31

SHA256
fcac40a6b10a12937fca0ae790e5e6c91bf531de021c7c0033ecb6db7de08e8c

SHA512
4f647864e80ae7481f828b5cdfe39de9f8169a359e2fa7cd3c47ace663c4a9092edc97e6db796e95674cb79e9268e8b1c5dfc6ae7bf16e0515e43239e2da8cb5

Download Submit
C:\Windows\system\qNDGRTz.exe

Filesize
2.2MB

MD5
a82bc4cd5fe6c385c1aede674ae767b6

SHA1
cd1d6b72bbd435777a670168cf52f1eb90995c23

SHA256
44a3ac8c2f568a5f6d641e55d6390129a2a903a9975dee09f83cfcb7e93d05b4

SHA512
f914a2d6ac4088e05164ce9bfcaacfe052451515f06a7038ea7f710c391e986ac99e1c1614471666707670def5acc3fec301eb42a800b06871040c7a2a5cace0

Download Submit
C:\Windows\system\sAHGNit.exe

Filesize
2.2MB

MD5
ce068cff8f5bdbf719e747a1c1a92d9b

SHA1
15c14d4ad53dfc0b1e211bb913251c9769f4e4fd

SHA256
5bc92ab9e59763d77d5207e3a5df83ef5527113e80508070c8d4fb0bd0c01ec2

SHA512
b9c54e061d0035d829f491b9ee0066b29e7d79241a88a08a37b74e27491f6488288aedd7820123f31825b25962f99daa6e6a37ebc48effb2d14ca07a2e426a44

Download Submit
C:\Windows\system\tQSjwCO.exe

Filesize
2.2MB

MD5
6de75dbcb7252348101faec6d20bc1dc

SHA1
866ba94b58f3928870737f1df15657dc423842c5

SHA256
d93ef04d53186ba9106fa14f165abb98a9b34cfb8e269cfb0e5f6a8252f0caa8

SHA512
14a39583c36e43a807d18f0950aa7e2001301a6d6aa6e5c9907b11e601c04ddc694539a0916cefa0023c23d1c2655c252e38e41047a60ff00fa92857462f0727

Download Submit
C:\Windows\system\tTLThNv.exe

Filesize
2.3MB

MD5
e392cdbe000b0f4636a16ee7a8257a64

SHA1
50ab143d5cfcd65d6c1f373caf7a06a41e199b63

SHA256
64ad8f2353a017eb02b34bae1b8e2787b81163ea351b515d4e4e1c7529c7a685

SHA512
8f10a17e7ce102fe408e80fdf6198c26ab955cb7c931b72701540458fe2cbfb3cf0923471ec4bdfe22e9121b26c39fb5f09b63a45614c48cad8b8e78ca807c0c

Download Submit
C:\Windows\system\tlWOOGH.exe

Filesize
2.2MB

MD5
0558e513d9fe9673935763697dd1323d

SHA1
1fd3e5c68d8971fb015733a01e09b7983bf75fda

SHA256
897b918e9a05886162ceb50226487cf900f663a9ebe642f970ff3efbaa504df3

SHA512
19514c9d25e68265f3cbc098aaaecb240776a41d6ba7b5726ba00b51ba79e183df68f4b78d5a927801e3906973e60eee43b788aa2441a93b1814bd95929061d4

Download Submit
C:\Windows\system\xzdJmbf.exe

Filesize
2.3MB

MD5
7877325798580f2aaf65d3407d0b3a0d

SHA1
dbbb2e92d0c4a0e66694e894be9db121c08d5723

SHA256
6c723116a31151b7288f83b3ba20dedd8624b1086592b2d0df5442e93ed9530c

SHA512
90b3f19c7ebc1bce31db08607eb2b74e5df0d8584e59baf5956e361ac5a97452d855fda142b44b1f0f2f739b024e080ad68a00a083943b96fea80e62dbd0748d

Download Submit
\Windows\system\BUDBZMh.exe

Filesize
2.1MB

MD5
7db2d2efd498c242d4a8288f9a5eba44

SHA1
1b7069b295637f4121716b494a304e5bab17f2cb

SHA256
6c2037bfcc9f61751e1cb4c7d96ae31e0eeaaf38064a03e6b4808457e3a8d1bb

SHA512
e56201f8f5c790f349e8f1c1dd9b2a105dda29758d9aad65702dbe6aeb16e1c1f19d4e4ac1e16ad53ce876329e79608349ddcadcbcbc9e945561f7c8b9553ae4

Download Submit
\Windows\system\FUqacbh.exe

Filesize
1.1MB

MD5
7b97d9a40d46df96707bec171dd1e438

SHA1
90c01c3cf48181049941fa434936dc70e40e51c3

SHA256
1b27f91d7ac39cdd6d26151e84bb35b0cfe68eca9d96d42c0fd6b8b4ebc94ee5

SHA512
01d0991791cb7b3ea09d034ab22e25cbffef11fcd991cdd4181d97a4cee693d1a1ec0b2c08aeb508d0e73c60f07a5bd4652f8d0459017f78e6830b5ebf639889

Download Submit
\Windows\system\Nxwkcyk.exe

Filesize
2.2MB

MD5
619a8f86e531f660b710f62b25946620

SHA1
86689984cdacf310a4d062ae2be14d17f1c67292

SHA256
b68f5debeeee35e0827df1d1f9148279df8c646353b378e5f26bb8e910cc5ad6

SHA512
271302af554306ba491df54e9728e78b586b6b8a7fec71654399897432a64a2232a6443cefdb3e43dce36fc7531d159b40e8f66033a937f94339f139ce89d2bf

Download Submit
\Windows\system\QSIHidE.exe

Filesize
2.2MB

MD5
802bb2c6bd446fa7cbba5c85ffb05497

SHA1
3fb049c16907e22f9278fba0d5d5f6c7ede59d7d

SHA256
6d2f58ee0dcc9bd972d2a86aad58e7524c370e4e5035ae2d7b87b82e5ca78a53

SHA512
a9fd75dd3dcd1c0e6a1940e7e063729ffd17da9d4fa42a5b48c4da0067bf263d4ac2a0be1cc52258b9d3a4e435bfb7c8ba83d7ba2b7c1acb01a090375ae160d9

Download Submit
\Windows\system\QhdooId.exe

Filesize
1.9MB

MD5
0cc34abc10f39e1f6fcd285cb601256a

SHA1
4cf0a3cd63e450f874225d5208c37ebe285cff0e

SHA256
c1b426e9adb41449b7e17715ae1df2883170706c5fa68a0c1f160da9ec06a0f3

SHA512
b7787900817da1a201d982d55a7c2516e701d11ff7a5d970fe007eeb6c219232a34d46100b1934e6dd9b2ade3849de90d2c768fd78d1b369da9b56282a220987

Download Submit
\Windows\system\fhHTzuW.exe

Filesize
2.2MB

MD5
cbec3255c3d37564d8781e8bd49d59b6

SHA1
6d1e045cce8688a95afc4b253e66b0512a01bb95

SHA256
30ac46ea9d9dc514229f2d35f70828f1c9ff8758aed46e382b96ef594fc3c746

SHA512
a6560c9a0ce5230d64053491a6cf601edd863fb87e676a1f3a9b787f0ce4d9b8952573e2b90c9488341b09ec5e65f882d9694b03d901ad9b04c524d80916640f

Download Submit
\Windows\system\odLmzkr.exe

Filesize
1.6MB

MD5
985117e54b783015ed14a5f1fa94e0d8

SHA1
523fd9c9221a5e8b30d504b4534d3dab65f35d9b

SHA256
e02d390db086d7c82f158a5fe74ff6ec037fcaa909895c119e493f7e8992f871

SHA512
75101b8eb18f5d38d6b7284dfe35e30d74542fa3f594a6c51d538cd67304ed21762c5d93ad7744756399c0d514962ee1d763589175d98bbafea8158a4d6bb9ed

Download Submit
\Windows\system\sYgyNmT.exe

Filesize
2.2MB

MD5
97134afd609e18a7f5d00b37502718a3

SHA1
1039d0bc1ea75c72784d6ab07a22e18fc88e0633

SHA256
f400f3b7de451c7f994ae231c48bcfc00ed177b11bb2b470dbe0b6e391799daf

SHA512
a4994f3af851497d06b8884abe947ab1f52f25a25bc035cb8520ffd38d27f3135cdad296e30d92c20096f174fa4fbdf73a3e96ee33733c1cff110adc1415b224

Download Submit
\Windows\system\xzdJmbf.exe

Filesize
1.6MB

MD5
4ec6a13139c1cd55df20d6059a63c419

SHA1
f490a11b1494fd920e348309479caa8a5198e547

SHA256
6494fb566d4adcfeaad9869ffef5b5aef3fb0244c1ee7d78e793af2a129856b4

SHA512
d1af2b7d5870518f72df2ea5b9be33d1294eb37d72039a8bef1f1a69a067ac3951667696002862b2d1d07ba36bac7065526c265329c1ab5ad61a946c716012e1

Download Submit
memory/1736-101-0x000000013FDE0000-0x0000000140134000-memory.dmp

Filesize
3.3MB

Download
memory/1736-4036-0x000000013FDE0000-0x0000000140134000-memory.dmp

Filesize
3.3MB

Download
memory/1940-90-0x000000013F3A0000-0x000000013F6F4000-memory.dmp

Filesize
3.3MB

Download
memory/1940-1585-0x0000000001FE0000-0x0000000002334000-memory.dmp

Filesize
3.3MB

Download
memory/1940-0-0x000000013F3A0000-0x000000013F6F4000-memory.dmp

Filesize
3.3MB

Download
memory/1940-13-0x000000013F9D0000-0x000000013FD24000-memory.dmp

Filesize
3.3MB

Download
memory/1940-10-0x000000013F730000-0x000000013FA84000-memory.dmp

Filesize
3.3MB

Download
memory/1940-27-0x0000000001FE0000-0x0000000002334000-memory.dmp

Filesize
3.3MB

Download
memory/1940-29-0x0000000001FE0000-0x0000000002334000-memory.dmp

Filesize
3.3MB

Download
memory/1940-40-0x0000000001FE0000-0x0000000002334000-memory.dmp

Filesize
3.3MB

Download
memory/1940-63-0x0000000001FE0000-0x0000000002334000-memory.dmp

Filesize
3.3MB

Download
memory/1940-52-0x000000013FEF0000-0x0000000140244000-memory.dmp

Filesize
3.3MB

Download
memory/1940-55-0x000000013FEB0000-0x0000000140204000-memory.dmp

Filesize
3.3MB

Download
memory/1940-64-0x000000013F750000-0x000000013FAA4000-memory.dmp

Filesize
3.3MB

Download
memory/1940-81-0x000000013FCD0000-0x0000000140024000-memory.dmp

Filesize
3.3MB

Download
memory/1940-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1940-3068-0x0000000001FE0000-0x0000000002334000-memory.dmp

Filesize
3.3MB

Download
memory/1940-103-0x000000013FA60000-0x000000013FDB4000-memory.dmp

Filesize
3.3MB

Download
memory/1940-668-0x0000000001FE0000-0x0000000002334000-memory.dmp

Filesize
3.3MB

Download
memory/1940-2465-0x0000000001FE0000-0x0000000002334000-memory.dmp

Filesize
3.3MB

Download
memory/2136-4027-0x000000013F590000-0x000000013F8E4000-memory.dmp

Filesize
3.3MB

Download
memory/2136-113-0x000000013F590000-0x000000013F8E4000-memory.dmp

Filesize
3.3MB

Download
memory/2136-25-0x000000013F590000-0x000000013F8E4000-memory.dmp

Filesize
3.3MB

Download
memory/2368-4026-0x000000013F9D0000-0x000000013FD24000-memory.dmp

Filesize
3.3MB

Download
memory/2368-20-0x000000013F9D0000-0x000000013FD24000-memory.dmp

Filesize
3.3MB

Download
memory/2372-77-0x000000013F700000-0x000000013FA54000-memory.dmp

Filesize
3.3MB

Download
memory/2372-2679-0x000000013F700000-0x000000013FA54000-memory.dmp

Filesize
3.3MB

Download
memory/2372-4035-0x000000013F700000-0x000000013FA54000-memory.dmp

Filesize
3.3MB

Download
memory/2452-4030-0x000000013FEF0000-0x0000000140244000-memory.dmp

Filesize
3.3MB

Download
memory/2452-45-0x000000013FEF0000-0x0000000140244000-memory.dmp

Filesize
3.3MB

Download
memory/2472-4031-0x000000013F2C0000-0x000000013F614000-memory.dmp

Filesize
3.3MB

Download
memory/2472-57-0x000000013F2C0000-0x000000013F614000-memory.dmp

Filesize
3.3MB

Download
memory/2476-4034-0x000000013FCD0000-0x0000000140024000-memory.dmp

Filesize
3.3MB

Download
memory/2476-75-0x000000013FCD0000-0x0000000140024000-memory.dmp

Filesize
3.3MB

Download
memory/2560-69-0x000000013F750000-0x000000013FAA4000-memory.dmp

Filesize
3.3MB

Download
memory/2560-4033-0x000000013F750000-0x000000013FAA4000-memory.dmp

Filesize
3.3MB

Download
memory/2576-4028-0x000000013F610000-0x000000013F964000-memory.dmp

Filesize
3.3MB

Download
memory/2576-30-0x000000013F610000-0x000000013F964000-memory.dmp

Filesize
3.3MB

Download
memory/2636-42-0x000000013F290000-0x000000013F5E4000-memory.dmp

Filesize
3.3MB

Download
memory/2636-4029-0x000000013F290000-0x000000013F5E4000-memory.dmp

Filesize
3.3MB

Download
memory/2688-102-0x000000013F310000-0x000000013F664000-memory.dmp

Filesize
3.3MB

Download
memory/2688-4038-0x000000013F310000-0x000000013F664000-memory.dmp

Filesize
3.3MB

Download
memory/2708-56-0x000000013FEB0000-0x0000000140204000-memory.dmp

Filesize
3.3MB

Download
memory/2708-4032-0x000000013FEB0000-0x0000000140204000-memory.dmp

Filesize
3.3MB

Download
memory/2916-15-0x000000013F730000-0x000000013FA84000-memory.dmp

Filesize
3.3MB

Download
memory/2916-4025-0x000000013F730000-0x000000013FA84000-memory.dmp

Filesize
3.3MB

Download
memory/2944-93-0x000000013FCD0000-0x0000000140024000-memory.dmp

Filesize
3.3MB

Download
memory/2944-2680-0x000000013FCD0000-0x0000000140024000-memory.dmp

Filesize
3.3MB

Download
memory/2944-4037-0x000000013FCD0000-0x0000000140024000-memory.dmp

Filesize
3.3MB

Download