xmrig | 7f2ae8daf25fd06de7c842c2eed3a19fb8298fd0bfe735f0c86949fc6a18f6bb

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
09/06/2024, 03:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f6de62a8012f8221a3899ae008c3ae0.exe
Size

2.3MB
MD5

6f6de62a8012f8221a3899ae008c3ae0
SHA1

b81089ebb90d1e5afb4a3887545cb105f6e6094d
SHA256

7f2ae8daf25fd06de7c842c2eed3a19fb8298fd0bfe735f0c86949fc6a18f6bb
SHA512

4e64cb76c1b9f6c9aa07fc755c146c6c7377a352e01304862d6dd57ce8004942bbe89ed2bf40e8cfcb00af607cdf899f8ba9bffac8833d736a07b9b447e1938e
SSDEEP

49152:oezaTF8FcNkNdfE0pZ9ozt4wIQHxlUyBGpI:oemTLkNdfE0pZrQX

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/2328-0-0x000000013FF20000-0x0000000140274000-memory.dmp	xmrig
behavioral1/files/0x000c000000015cbd-3.dat	xmrig
behavioral1/files/0x002e000000015d24-12.dat	xmrig
behavioral1/memory/2968-13-0x000000013FF70000-0x00000001402C4000-memory.dmp	xmrig
behavioral1/files/0x0008000000015e6d-16.dat	xmrig
behavioral1/memory/2316-42-0x000000013FEE0000-0x0000000140234000-memory.dmp	xmrig
behavioral1/files/0x0006000000016d0e-47.dat	xmrig
behavioral1/files/0x0006000000016d16-65.dat	xmrig
behavioral1/files/0x0006000000016d1f-64.dat	xmrig
behavioral1/memory/2412-53-0x000000013F6B0000-0x000000013FA04000-memory.dmp	xmrig
behavioral1/files/0x0008000000016d05-52.dat	xmrig
behavioral1/files/0x00070000000160cc-51.dat	xmrig
behavioral1/memory/2328-50-0x00000000020D0000-0x0000000002424000-memory.dmp	xmrig
behavioral1/memory/2568-46-0x000000013FD30000-0x0000000140084000-memory.dmp	xmrig
behavioral1/files/0x0007000000015f3c-24.dat	xmrig
behavioral1/files/0x00070000000161b3-39.dat	xmrig
behavioral1/memory/2592-30-0x000000013FF00000-0x0000000140254000-memory.dmp	xmrig
behavioral1/files/0x0006000000016e78-102.dat	xmrig
behavioral1/files/0x0006000000016db3-122.dat	xmrig
behavioral1/files/0x0006000000016fe8-123.dat	xmrig
behavioral1/files/0x0006000000016d9f-121.dat	xmrig
behavioral1/files/0x0006000000016d36-120.dat	xmrig
behavioral1/files/0x002e000000015d44-119.dat	xmrig
behavioral1/files/0x0006000000016da4-112.dat	xmrig
behavioral1/files/0x0006000000016d3a-107.dat	xmrig
behavioral1/memory/2436-94-0x000000013F640000-0x000000013F994000-memory.dmp	xmrig
behavioral1/files/0x000600000001739d-132.dat	xmrig
behavioral1/memory/2736-91-0x000000013FCA0000-0x000000013FFF4000-memory.dmp	xmrig
behavioral1/files/0x0006000000016d9f-90.dat	xmrig
behavioral1/memory/2904-84-0x000000013FEA0000-0x00000001401F4000-memory.dmp	xmrig
behavioral1/files/0x0006000000016d36-81.dat	xmrig
behavioral1/memory/2456-75-0x000000013FB10000-0x000000013FE64000-memory.dmp	xmrig
behavioral1/memory/2668-72-0x000000013F2E0000-0x000000013F634000-memory.dmp	xmrig
behavioral1/memory/2328-89-0x000000013F640000-0x000000013F994000-memory.dmp	xmrig
behavioral1/memory/2420-80-0x000000013FE70000-0x00000001401C4000-memory.dmp	xmrig
behavioral1/files/0x000600000001744c-140.dat	xmrig
behavioral1/files/0x00060000000175ac-146.dat	xmrig
behavioral1/files/0x00060000000175b2-151.dat	xmrig
behavioral1/files/0x0005000000018700-182.dat	xmrig
behavioral1/memory/2328-2743-0x000000013FF20000-0x0000000140274000-memory.dmp	xmrig
behavioral1/memory/2904-3305-0x000000013FEA0000-0x00000001401F4000-memory.dmp	xmrig
behavioral1/memory/2456-3586-0x000000013FB10000-0x000000013FE64000-memory.dmp	xmrig
behavioral1/memory/2412-3576-0x000000013F6B0000-0x000000013FA04000-memory.dmp	xmrig
behavioral1/memory/2592-2977-0x000000013FF00000-0x0000000140254000-memory.dmp	xmrig
behavioral1/memory/2552-4002-0x000000013FE60000-0x00000001401B4000-memory.dmp	xmrig
behavioral1/memory/2592-4003-0x000000013FF00000-0x0000000140254000-memory.dmp	xmrig
behavioral1/memory/2568-4005-0x000000013FD30000-0x0000000140084000-memory.dmp	xmrig
behavioral1/memory/2316-4004-0x000000013FEE0000-0x0000000140234000-memory.dmp	xmrig
behavioral1/memory/2736-4007-0x000000013FCA0000-0x000000013FFF4000-memory.dmp	xmrig
behavioral1/memory/2436-4009-0x000000013F640000-0x000000013F994000-memory.dmp	xmrig
behavioral1/memory/2668-4008-0x000000013F2E0000-0x000000013F634000-memory.dmp	xmrig
behavioral1/memory/2412-4006-0x000000013F6B0000-0x000000013FA04000-memory.dmp	xmrig
behavioral1/memory/2968-4001-0x000000013FF70000-0x00000001402C4000-memory.dmp	xmrig
behavioral1/memory/2420-4010-0x000000013FE70000-0x00000001401C4000-memory.dmp	xmrig
behavioral1/memory/2904-4011-0x000000013FEA0000-0x00000001401F4000-memory.dmp	xmrig
behavioral1/memory/2456-4012-0x000000013FB10000-0x000000013FE64000-memory.dmp	xmrig
behavioral1/files/0x00050000000186d3-179.dat	xmrig
behavioral1/files/0x000500000001865a-178.dat	xmrig
behavioral1/files/0x00050000000186c1-176.dat	xmrig
behavioral1/files/0x0009000000018640-174.dat	xmrig
behavioral1/files/0x001500000001863c-158.dat	xmrig
behavioral1/files/0x00060000000175b8-156.dat	xmrig
behavioral1/files/0x00060000000175b8-154.dat	xmrig
behavioral1/files/0x00060000000175b2-149.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2968	cymPSDk.exe
2552	yNXZvNf.exe
2592	AyHSWnp.exe
2412	lRkVXKJ.exe
2316	fKCkyWP.exe
2568	gsxLYgU.exe
2736	UWXEEOa.exe
2668	WGwwGvb.exe
2436	mQWlDOQ.exe
2456	jytfqXI.exe
2420	hBuPPfA.exe
2904	YGJWQts.exe
768	GkcTOXv.exe
1620	QIODyTD.exe
556	GdFGZaD.exe
2840	kYxilGv.exe
2464	axIkcut.exe
2292	lxhTxrT.exe
2016	OVewqeW.exe
2612	fsVOuoP.exe
1704	FsblTfv.exe
2236	uSbLqiE.exe
2264	efOYait.exe
2056	KwTIJRx.exe
2108	iTkNeHx.exe
2268	mupbyOk.exe
336	OACZdxK.exe
312	FnQIDZD.exe
1616	EHJcZWv.exe
1428	ONDJaZG.exe
1792	ScEEwkd.exe
1164	koNBTMQ.exe
1480	cCGfDby.exe
2960	UAZpOjF.exe
3024	FiKaHrE.exe
412	xmtaaWc.exe
1120	GQLQDuo.exe
2996	GwDJZpB.exe
2224	MIUsxNl.exe
896	EIsXgTu.exe
1292	Bvswrpw.exe
2792	gdZcJtD.exe
1896	LPXRidE.exe
1284	JNoRtXE.exe
1804	LBVSfuF.exe
3068	REMChIw.exe
2760	cfLQcRg.exe
292	xfIeiGv.exe
952	DTLAcwT.exe
636	ulyLxzL.exe
2160	mebGvhi.exe
2340	TvwrcmZ.exe
664	GCQjVRU.exe
2196	mEcIseR.exe
1132	rPFljUi.exe
1768	eXYXLbu.exe
1740	lBjGFUB.exe
1440	GWplVOD.exe
1548	ZyNeBdq.exe
688	BFIubZz.exe
2364	GxCAcMU.exe
2284	flIkhMy.exe
2524	rykETnj.exe
2876	jKQCBdM.exe

Loads dropped DLL 64 IoCs

pid	Process
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe
2328	6f6de62a8012f8221a3899ae008c3ae0.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2328-0-0x000000013FF20000-0x0000000140274000-memory.dmp	upx
behavioral1/files/0x000c000000015cbd-3.dat	upx
behavioral1/files/0x002e000000015d24-12.dat	upx
behavioral1/memory/2968-13-0x000000013FF70000-0x00000001402C4000-memory.dmp	upx
behavioral1/files/0x0008000000015e6d-16.dat	upx
behavioral1/memory/2316-42-0x000000013FEE0000-0x0000000140234000-memory.dmp	upx
behavioral1/files/0x0006000000016d0e-47.dat	upx
behavioral1/files/0x0006000000016d16-65.dat	upx
behavioral1/files/0x0006000000016d1f-64.dat	upx
behavioral1/memory/2412-53-0x000000013F6B0000-0x000000013FA04000-memory.dmp	upx
behavioral1/files/0x0008000000016d05-52.dat	upx
behavioral1/files/0x00070000000160cc-51.dat	upx
behavioral1/memory/2568-46-0x000000013FD30000-0x0000000140084000-memory.dmp	upx
behavioral1/files/0x0007000000015f3c-24.dat	upx
behavioral1/files/0x00070000000161b3-39.dat	upx
behavioral1/memory/2592-30-0x000000013FF00000-0x0000000140254000-memory.dmp	upx
behavioral1/files/0x0006000000016e78-102.dat	upx
behavioral1/files/0x0006000000016db3-122.dat	upx
behavioral1/files/0x0006000000016fe8-123.dat	upx
behavioral1/files/0x0006000000016d9f-121.dat	upx
behavioral1/files/0x0006000000016d36-120.dat	upx
behavioral1/files/0x002e000000015d44-119.dat	upx
behavioral1/files/0x0006000000016da4-112.dat	upx
behavioral1/files/0x0006000000016d3a-107.dat	upx
behavioral1/memory/2436-94-0x000000013F640000-0x000000013F994000-memory.dmp	upx
behavioral1/files/0x000600000001739d-132.dat	upx
behavioral1/memory/2736-91-0x000000013FCA0000-0x000000013FFF4000-memory.dmp	upx
behavioral1/files/0x0006000000016d9f-90.dat	upx
behavioral1/memory/2904-84-0x000000013FEA0000-0x00000001401F4000-memory.dmp	upx
behavioral1/files/0x0006000000016d36-81.dat	upx
behavioral1/memory/2456-75-0x000000013FB10000-0x000000013FE64000-memory.dmp	upx
behavioral1/memory/2668-72-0x000000013F2E0000-0x000000013F634000-memory.dmp	upx
behavioral1/memory/2420-80-0x000000013FE70000-0x00000001401C4000-memory.dmp	upx
behavioral1/files/0x000600000001744c-140.dat	upx
behavioral1/files/0x00060000000175ac-146.dat	upx
behavioral1/files/0x00060000000175b2-151.dat	upx
behavioral1/files/0x0005000000018700-182.dat	upx
behavioral1/memory/2328-2743-0x000000013FF20000-0x0000000140274000-memory.dmp	upx
behavioral1/memory/2904-3305-0x000000013FEA0000-0x00000001401F4000-memory.dmp	upx
behavioral1/memory/2456-3586-0x000000013FB10000-0x000000013FE64000-memory.dmp	upx
behavioral1/memory/2412-3576-0x000000013F6B0000-0x000000013FA04000-memory.dmp	upx
behavioral1/memory/2592-2977-0x000000013FF00000-0x0000000140254000-memory.dmp	upx
behavioral1/memory/2552-4002-0x000000013FE60000-0x00000001401B4000-memory.dmp	upx
behavioral1/memory/2592-4003-0x000000013FF00000-0x0000000140254000-memory.dmp	upx
behavioral1/memory/2568-4005-0x000000013FD30000-0x0000000140084000-memory.dmp	upx
behavioral1/memory/2316-4004-0x000000013FEE0000-0x0000000140234000-memory.dmp	upx
behavioral1/memory/2736-4007-0x000000013FCA0000-0x000000013FFF4000-memory.dmp	upx
behavioral1/memory/2436-4009-0x000000013F640000-0x000000013F994000-memory.dmp	upx
behavioral1/memory/2668-4008-0x000000013F2E0000-0x000000013F634000-memory.dmp	upx
behavioral1/memory/2412-4006-0x000000013F6B0000-0x000000013FA04000-memory.dmp	upx
behavioral1/memory/2968-4001-0x000000013FF70000-0x00000001402C4000-memory.dmp	upx
behavioral1/memory/2420-4010-0x000000013FE70000-0x00000001401C4000-memory.dmp	upx
behavioral1/memory/2904-4011-0x000000013FEA0000-0x00000001401F4000-memory.dmp	upx
behavioral1/memory/2456-4012-0x000000013FB10000-0x000000013FE64000-memory.dmp	upx
behavioral1/files/0x00050000000186d3-179.dat	upx
behavioral1/files/0x000500000001865a-178.dat	upx
behavioral1/files/0x00050000000186c1-176.dat	upx
behavioral1/files/0x0009000000018640-174.dat	upx
behavioral1/files/0x001500000001863c-158.dat	upx
behavioral1/files/0x00060000000175b8-156.dat	upx
behavioral1/files/0x00060000000175b8-154.dat	upx
behavioral1/files/0x00060000000175b2-149.dat	upx
behavioral1/files/0x00060000000173e5-137.dat	upx
behavioral1/files/0x0006000000016d32-79.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\JsDMQGA.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\sgtEeCQ.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\DLjjgcw.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\kCyegdY.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\CmgCawC.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\PwGYhSC.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\iheovKU.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\lxhTxrT.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\XCcfpGh.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\QhwGNdZ.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\olNUBSp.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\ivlyIRy.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\ZrZQfJo.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\fLqRyuT.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\GjKtyIL.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\qvVWgOM.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\xOYHAPU.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\psKmbkr.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\fczeIng.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\EXcXAnH.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\KtRGVcz.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\WKcPcdV.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\VHSdLhl.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\nHSXvNT.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\nduauTf.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\axIkcut.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\YZAVHBg.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\ciTRbrN.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\fgIQGAP.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\TDNhvnE.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\GNzvCjU.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\DFxflkp.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\QmomQbi.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\vecmqaA.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\pGaoSAy.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\wAXanuc.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\VIViFty.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\kmdkckq.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\eahFFEB.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\QqYqiHw.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\XHpmmIR.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\fipBdUa.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\NYBOnDq.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\oyllrLs.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\sPsrPTS.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\rvyApCP.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\ktGitjy.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\sqUznaP.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\OdOsTJX.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\omECcOm.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\FkgBLaX.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\aAQEkXX.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\uvHhxuX.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\gdZcJtD.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\CWOFgHJ.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\yTPgvzk.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\PzVCPYP.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\BdzlBGo.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\gCoPXvP.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\pNWTHJf.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\omlDWFF.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\koGLOrS.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\GwDJZpB.exe	6f6de62a8012f8221a3899ae008c3ae0.exe
File created	C:\Windows\System\gLTMqci.exe	6f6de62a8012f8221a3899ae008c3ae0.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 2968	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	29
PID 2328 wrote to memory of 2968	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	29
PID 2328 wrote to memory of 2968	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	29
PID 2328 wrote to memory of 2552	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	30
PID 2328 wrote to memory of 2552	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	30
PID 2328 wrote to memory of 2552	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	30
PID 2328 wrote to memory of 2592	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	31
PID 2328 wrote to memory of 2592	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	31
PID 2328 wrote to memory of 2592	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	31
PID 2328 wrote to memory of 2412	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	32
PID 2328 wrote to memory of 2412	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	32
PID 2328 wrote to memory of 2412	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	32
PID 2328 wrote to memory of 2316	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	33
PID 2328 wrote to memory of 2316	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	33
PID 2328 wrote to memory of 2316	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	33
PID 2328 wrote to memory of 2736	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	34
PID 2328 wrote to memory of 2736	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	34
PID 2328 wrote to memory of 2736	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	34
PID 2328 wrote to memory of 2568	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	35
PID 2328 wrote to memory of 2568	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	35
PID 2328 wrote to memory of 2568	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	35
PID 2328 wrote to memory of 2668	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	36
PID 2328 wrote to memory of 2668	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	36
PID 2328 wrote to memory of 2668	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	36
PID 2328 wrote to memory of 2436	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	37
PID 2328 wrote to memory of 2436	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	37
PID 2328 wrote to memory of 2436	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	37
PID 2328 wrote to memory of 2456	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	38
PID 2328 wrote to memory of 2456	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	38
PID 2328 wrote to memory of 2456	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	38
PID 2328 wrote to memory of 2420	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	39
PID 2328 wrote to memory of 2420	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	39
PID 2328 wrote to memory of 2420	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	39
PID 2328 wrote to memory of 2840	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	40
PID 2328 wrote to memory of 2840	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	40
PID 2328 wrote to memory of 2840	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	40
PID 2328 wrote to memory of 2904	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	41
PID 2328 wrote to memory of 2904	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	41
PID 2328 wrote to memory of 2904	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	41
PID 2328 wrote to memory of 2464	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	42
PID 2328 wrote to memory of 2464	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	42
PID 2328 wrote to memory of 2464	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	42
PID 2328 wrote to memory of 768	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	43
PID 2328 wrote to memory of 768	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	43
PID 2328 wrote to memory of 768	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	43
PID 2328 wrote to memory of 2292	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	44
PID 2328 wrote to memory of 2292	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	44
PID 2328 wrote to memory of 2292	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	44
PID 2328 wrote to memory of 1620	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	45
PID 2328 wrote to memory of 1620	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	45
PID 2328 wrote to memory of 1620	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	45
PID 2328 wrote to memory of 2016	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	46
PID 2328 wrote to memory of 2016	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	46
PID 2328 wrote to memory of 2016	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	46
PID 2328 wrote to memory of 556	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	47
PID 2328 wrote to memory of 556	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	47
PID 2328 wrote to memory of 556	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	47
PID 2328 wrote to memory of 2612	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	48
PID 2328 wrote to memory of 2612	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	48
PID 2328 wrote to memory of 2612	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	48
PID 2328 wrote to memory of 1704	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	49
PID 2328 wrote to memory of 1704	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	49
PID 2328 wrote to memory of 1704	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	49
PID 2328 wrote to memory of 2236	2328	6f6de62a8012f8221a3899ae008c3ae0.exe	50

C:\Users\Admin\AppData\Local\Temp\6f6de62a8012f8221a3899ae008c3ae0.exe
"C:\Users\Admin\AppData\Local\Temp\6f6de62a8012f8221a3899ae008c3ae0.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Windows\System\cymPSDk.exe
  C:\Windows\System\cymPSDk.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\yNXZvNf.exe
  C:\Windows\System\yNXZvNf.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\AyHSWnp.exe
  C:\Windows\System\AyHSWnp.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\lRkVXKJ.exe
  C:\Windows\System\lRkVXKJ.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\fKCkyWP.exe
  C:\Windows\System\fKCkyWP.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\UWXEEOa.exe
  C:\Windows\System\UWXEEOa.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\gsxLYgU.exe
  C:\Windows\System\gsxLYgU.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\WGwwGvb.exe
  C:\Windows\System\WGwwGvb.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\mQWlDOQ.exe
  C:\Windows\System\mQWlDOQ.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\jytfqXI.exe
  C:\Windows\System\jytfqXI.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\hBuPPfA.exe
  C:\Windows\System\hBuPPfA.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\kYxilGv.exe
  C:\Windows\System\kYxilGv.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\YGJWQts.exe
  C:\Windows\System\YGJWQts.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\axIkcut.exe
  C:\Windows\System\axIkcut.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\GkcTOXv.exe
  C:\Windows\System\GkcTOXv.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\lxhTxrT.exe
  C:\Windows\System\lxhTxrT.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\QIODyTD.exe
  C:\Windows\System\QIODyTD.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\OVewqeW.exe
  C:\Windows\System\OVewqeW.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\GdFGZaD.exe
  C:\Windows\System\GdFGZaD.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\fsVOuoP.exe
  C:\Windows\System\fsVOuoP.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\FsblTfv.exe
  C:\Windows\System\FsblTfv.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\uSbLqiE.exe
  C:\Windows\System\uSbLqiE.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\efOYait.exe
  C:\Windows\System\efOYait.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\KwTIJRx.exe
  C:\Windows\System\KwTIJRx.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\iTkNeHx.exe
  C:\Windows\System\iTkNeHx.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\mupbyOk.exe
  C:\Windows\System\mupbyOk.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\OACZdxK.exe
  C:\Windows\System\OACZdxK.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\FnQIDZD.exe
  C:\Windows\System\FnQIDZD.exe
  2⤵
  - Executes dropped EXE
  PID:312
- C:\Windows\System\ONDJaZG.exe
  C:\Windows\System\ONDJaZG.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\EHJcZWv.exe
  C:\Windows\System\EHJcZWv.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\ScEEwkd.exe
  C:\Windows\System\ScEEwkd.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\koNBTMQ.exe
  C:\Windows\System\koNBTMQ.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\cCGfDby.exe
  C:\Windows\System\cCGfDby.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\UAZpOjF.exe
  C:\Windows\System\UAZpOjF.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\FiKaHrE.exe
  C:\Windows\System\FiKaHrE.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\xmtaaWc.exe
  C:\Windows\System\xmtaaWc.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\GQLQDuo.exe
  C:\Windows\System\GQLQDuo.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\GwDJZpB.exe
  C:\Windows\System\GwDJZpB.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\MIUsxNl.exe
  C:\Windows\System\MIUsxNl.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\EIsXgTu.exe
  C:\Windows\System\EIsXgTu.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\Bvswrpw.exe
  C:\Windows\System\Bvswrpw.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\gdZcJtD.exe
  C:\Windows\System\gdZcJtD.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\LPXRidE.exe
  C:\Windows\System\LPXRidE.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\JNoRtXE.exe
  C:\Windows\System\JNoRtXE.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\LBVSfuF.exe
  C:\Windows\System\LBVSfuF.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\REMChIw.exe
  C:\Windows\System\REMChIw.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\cfLQcRg.exe
  C:\Windows\System\cfLQcRg.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\xfIeiGv.exe
  C:\Windows\System\xfIeiGv.exe
  2⤵
  - Executes dropped EXE
  PID:292
- C:\Windows\System\DTLAcwT.exe
  C:\Windows\System\DTLAcwT.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\ulyLxzL.exe
  C:\Windows\System\ulyLxzL.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\mebGvhi.exe
  C:\Windows\System\mebGvhi.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\TvwrcmZ.exe
  C:\Windows\System\TvwrcmZ.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\GCQjVRU.exe
  C:\Windows\System\GCQjVRU.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\mEcIseR.exe
  C:\Windows\System\mEcIseR.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\rPFljUi.exe
  C:\Windows\System\rPFljUi.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\eXYXLbu.exe
  C:\Windows\System\eXYXLbu.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\BFIubZz.exe
  C:\Windows\System\BFIubZz.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\lBjGFUB.exe
  C:\Windows\System\lBjGFUB.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\GxCAcMU.exe
  C:\Windows\System\GxCAcMU.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\GWplVOD.exe
  C:\Windows\System\GWplVOD.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\flIkhMy.exe
  C:\Windows\System\flIkhMy.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\ZyNeBdq.exe
  C:\Windows\System\ZyNeBdq.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\rykETnj.exe
  C:\Windows\System\rykETnj.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\jKQCBdM.exe
  C:\Windows\System\jKQCBdM.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\KBmQLag.exe
  C:\Windows\System\KBmQLag.exe
  2⤵
  PID:2380
- C:\Windows\System\OvPfFWR.exe
  C:\Windows\System\OvPfFWR.exe
  2⤵
  PID:864
- C:\Windows\System\CdqNtQR.exe
  C:\Windows\System\CdqNtQR.exe
  2⤵
  PID:2508
- C:\Windows\System\PUimAYk.exe
  C:\Windows\System\PUimAYk.exe
  2⤵
  PID:964
- C:\Windows\System\esQpmOd.exe
  C:\Windows\System\esQpmOd.exe
  2⤵
  PID:812
- C:\Windows\System\GDvSUrV.exe
  C:\Windows\System\GDvSUrV.exe
  2⤵
  PID:1200
- C:\Windows\System\ejuxNjt.exe
  C:\Windows\System\ejuxNjt.exe
  2⤵
  PID:2560
- C:\Windows\System\UzXwwuo.exe
  C:\Windows\System\UzXwwuo.exe
  2⤵
  PID:2256
- C:\Windows\System\oMjIDQG.exe
  C:\Windows\System\oMjIDQG.exe
  2⤵
  PID:1940
- C:\Windows\System\OzrxdtM.exe
  C:\Windows\System\OzrxdtM.exe
  2⤵
  PID:2584
- C:\Windows\System\LOIZUoY.exe
  C:\Windows\System\LOIZUoY.exe
  2⤵
  PID:2320
- C:\Windows\System\JhuHXXx.exe
  C:\Windows\System\JhuHXXx.exe
  2⤵
  PID:2052
- C:\Windows\System\ePVFJIo.exe
  C:\Windows\System\ePVFJIo.exe
  2⤵
  PID:1848
- C:\Windows\System\AEdJGxF.exe
  C:\Windows\System\AEdJGxF.exe
  2⤵
  PID:2660
- C:\Windows\System\bTgLXoD.exe
  C:\Windows\System\bTgLXoD.exe
  2⤵
  PID:2492
- C:\Windows\System\NrIEvcZ.exe
  C:\Windows\System\NrIEvcZ.exe
  2⤵
  PID:544
- C:\Windows\System\SAiujpJ.exe
  C:\Windows\System\SAiujpJ.exe
  2⤵
  PID:2200
- C:\Windows\System\vOIehue.exe
  C:\Windows\System\vOIehue.exe
  2⤵
  PID:2832
- C:\Windows\System\vZcDCfL.exe
  C:\Windows\System\vZcDCfL.exe
  2⤵
  PID:2228
- C:\Windows\System\zfSHygK.exe
  C:\Windows\System\zfSHygK.exe
  2⤵
  PID:1496
- C:\Windows\System\DtOdvEz.exe
  C:\Windows\System\DtOdvEz.exe
  2⤵
  PID:1484
- C:\Windows\System\TAobaSU.exe
  C:\Windows\System\TAobaSU.exe
  2⤵
  PID:956
- C:\Windows\System\IARoDRE.exe
  C:\Windows\System\IARoDRE.exe
  2⤵
  PID:1360
- C:\Windows\System\JsDMQGA.exe
  C:\Windows\System\JsDMQGA.exe
  2⤵
  PID:2956
- C:\Windows\System\eqXOCVw.exe
  C:\Windows\System\eqXOCVw.exe
  2⤵
  PID:2352
- C:\Windows\System\WQRmHTi.exe
  C:\Windows\System\WQRmHTi.exe
  2⤵
  PID:328
- C:\Windows\System\yGnDkFQ.exe
  C:\Windows\System\yGnDkFQ.exe
  2⤵
  PID:652
- C:\Windows\System\HySAWyE.exe
  C:\Windows\System\HySAWyE.exe
  2⤵
  PID:2096
- C:\Windows\System\dRRAlvk.exe
  C:\Windows\System\dRRAlvk.exe
  2⤵
  PID:1196
- C:\Windows\System\GswTfOR.exe
  C:\Windows\System\GswTfOR.exe
  2⤵
  PID:1652
- C:\Windows\System\qYhNRRW.exe
  C:\Windows\System\qYhNRRW.exe
  2⤵
  PID:900
- C:\Windows\System\YtlZVKj.exe
  C:\Windows\System\YtlZVKj.exe
  2⤵
  PID:2180
- C:\Windows\System\XUySGub.exe
  C:\Windows\System\XUySGub.exe
  2⤵
  PID:2548
- C:\Windows\System\rrGJnex.exe
  C:\Windows\System\rrGJnex.exe
  2⤵
  PID:2648
- C:\Windows\System\GyOiliy.exe
  C:\Windows\System\GyOiliy.exe
  2⤵
  PID:2672
- C:\Windows\System\xufzWdJ.exe
  C:\Windows\System\xufzWdJ.exe
  2⤵
  PID:2452
- C:\Windows\System\RuhkYGu.exe
  C:\Windows\System\RuhkYGu.exe
  2⤵
  PID:2432
- C:\Windows\System\BmXUWnh.exe
  C:\Windows\System\BmXUWnh.exe
  2⤵
  PID:2480
- C:\Windows\System\FdntuHo.exe
  C:\Windows\System\FdntuHo.exe
  2⤵
  PID:2868
- C:\Windows\System\ZyEVlEp.exe
  C:\Windows\System\ZyEVlEp.exe
  2⤵
  PID:1916
- C:\Windows\System\PCTBjqZ.exe
  C:\Windows\System\PCTBjqZ.exe
  2⤵
  PID:1568
- C:\Windows\System\ktGitjy.exe
  C:\Windows\System\ktGitjy.exe
  2⤵
  PID:1760
- C:\Windows\System\SrAXBmr.exe
  C:\Windows\System\SrAXBmr.exe
  2⤵
  PID:2892
- C:\Windows\System\RFTowsN.exe
  C:\Windows\System\RFTowsN.exe
  2⤵
  PID:2544
- C:\Windows\System\UjCWkLw.exe
  C:\Windows\System\UjCWkLw.exe
  2⤵
  PID:2440
- C:\Windows\System\qFbaXai.exe
  C:\Windows\System\qFbaXai.exe
  2⤵
  PID:2656
- C:\Windows\System\eabFsXd.exe
  C:\Windows\System\eabFsXd.exe
  2⤵
  PID:2060
- C:\Windows\System\eEyvJwR.exe
  C:\Windows\System\eEyvJwR.exe
  2⤵
  PID:296
- C:\Windows\System\OmzXXrF.exe
  C:\Windows\System\OmzXXrF.exe
  2⤵
  PID:268
- C:\Windows\System\lDBDrco.exe
  C:\Windows\System\lDBDrco.exe
  2⤵
  PID:1580
- C:\Windows\System\wHzgTYo.exe
  C:\Windows\System\wHzgTYo.exe
  2⤵
  PID:1988
- C:\Windows\System\RONIWmh.exe
  C:\Windows\System\RONIWmh.exe
  2⤵
  PID:1220
- C:\Windows\System\hbxySKP.exe
  C:\Windows\System\hbxySKP.exe
  2⤵
  PID:1592
- C:\Windows\System\VrqgaPS.exe
  C:\Windows\System\VrqgaPS.exe
  2⤵
  PID:2980
- C:\Windows\System\pXyUQTw.exe
  C:\Windows\System\pXyUQTw.exe
  2⤵
  PID:1020
- C:\Windows\System\jEtkECD.exe
  C:\Windows\System\jEtkECD.exe
  2⤵
  PID:1300
- C:\Windows\System\UOJFkuO.exe
  C:\Windows\System\UOJFkuO.exe
  2⤵
  PID:2836
- C:\Windows\System\qZmMLFf.exe
  C:\Windows\System\qZmMLFf.exe
  2⤵
  PID:2680
- C:\Windows\System\OSVuAQG.exe
  C:\Windows\System\OSVuAQG.exe
  2⤵
  PID:3032
- C:\Windows\System\bwZTAmT.exe
  C:\Windows\System\bwZTAmT.exe
  2⤵
  PID:1944
- C:\Windows\System\gObISAS.exe
  C:\Windows\System\gObISAS.exe
  2⤵
  PID:904
- C:\Windows\System\CVKMkoS.exe
  C:\Windows\System\CVKMkoS.exe
  2⤵
  PID:860
- C:\Windows\System\YnZPypG.exe
  C:\Windows\System\YnZPypG.exe
  2⤵
  PID:2532
- C:\Windows\System\fdWugjf.exe
  C:\Windows\System\fdWugjf.exe
  2⤵
  PID:2856
- C:\Windows\System\nnBoIqm.exe
  C:\Windows\System\nnBoIqm.exe
  2⤵
  PID:2416
- C:\Windows\System\fipBdUa.exe
  C:\Windows\System\fipBdUa.exe
  2⤵
  PID:2716
- C:\Windows\System\ZZPHSBR.exe
  C:\Windows\System\ZZPHSBR.exe
  2⤵
  PID:320
- C:\Windows\System\FkAxHMd.exe
  C:\Windows\System\FkAxHMd.exe
  2⤵
  PID:2640
- C:\Windows\System\aZZtlSr.exe
  C:\Windows\System\aZZtlSr.exe
  2⤵
  PID:1436
- C:\Windows\System\zxjhUKN.exe
  C:\Windows\System\zxjhUKN.exe
  2⤵
  PID:852
- C:\Windows\System\qeusOVj.exe
  C:\Windows\System\qeusOVj.exe
  2⤵
  PID:2028
- C:\Windows\System\iePToVJ.exe
  C:\Windows\System\iePToVJ.exe
  2⤵
  PID:2040
- C:\Windows\System\CRrfTjJ.exe
  C:\Windows\System\CRrfTjJ.exe
  2⤵
  PID:2376
- C:\Windows\System\Sammjfm.exe
  C:\Windows\System\Sammjfm.exe
  2⤵
  PID:3016
- C:\Windows\System\COACUNT.exe
  C:\Windows\System\COACUNT.exe
  2⤵
  PID:3012
- C:\Windows\System\sHXZuKR.exe
  C:\Windows\System\sHXZuKR.exe
  2⤵
  PID:1596
- C:\Windows\System\GCALSbI.exe
  C:\Windows\System\GCALSbI.exe
  2⤵
  PID:2824
- C:\Windows\System\gnFAMHF.exe
  C:\Windows\System\gnFAMHF.exe
  2⤵
  PID:2540
- C:\Windows\System\yrHFlDB.exe
  C:\Windows\System\yrHFlDB.exe
  2⤵
  PID:612
- C:\Windows\System\yfRpUdj.exe
  C:\Windows\System\yfRpUdj.exe
  2⤵
  PID:2460
- C:\Windows\System\WnuXYBA.exe
  C:\Windows\System\WnuXYBA.exe
  2⤵
  PID:1996
- C:\Windows\System\NBvAulV.exe
  C:\Windows\System\NBvAulV.exe
  2⤵
  PID:2676
- C:\Windows\System\LDIOiET.exe
  C:\Windows\System\LDIOiET.exe
  2⤵
  PID:2084
- C:\Windows\System\SGaQzhf.exe
  C:\Windows\System\SGaQzhf.exe
  2⤵
  PID:1656
- C:\Windows\System\uQeHdNB.exe
  C:\Windows\System\uQeHdNB.exe
  2⤵
  PID:1560
- C:\Windows\System\rDtHaJW.exe
  C:\Windows\System\rDtHaJW.exe
  2⤵
  PID:772
- C:\Windows\System\ZSMWWDx.exe
  C:\Windows\System\ZSMWWDx.exe
  2⤵
  PID:1488
- C:\Windows\System\EXcXAnH.exe
  C:\Windows\System\EXcXAnH.exe
  2⤵
  PID:1004
- C:\Windows\System\TFNgYda.exe
  C:\Windows\System\TFNgYda.exe
  2⤵
  PID:1800
- C:\Windows\System\IYDUmoH.exe
  C:\Windows\System\IYDUmoH.exe
  2⤵
  PID:2828
- C:\Windows\System\qmBJJRu.exe
  C:\Windows\System\qmBJJRu.exe
  2⤵
  PID:1124
- C:\Windows\System\maFEuWH.exe
  C:\Windows\System\maFEuWH.exe
  2⤵
  PID:3084
- C:\Windows\System\doQRiQG.exe
  C:\Windows\System\doQRiQG.exe
  2⤵
  PID:3164
- C:\Windows\System\ThmcjIo.exe
  C:\Windows\System\ThmcjIo.exe
  2⤵
  PID:3180
- C:\Windows\System\pFlAjXp.exe
  C:\Windows\System\pFlAjXp.exe
  2⤵
  PID:3196
- C:\Windows\System\gLTMqci.exe
  C:\Windows\System\gLTMqci.exe
  2⤵
  PID:3212
- C:\Windows\System\ZbpRiQl.exe
  C:\Windows\System\ZbpRiQl.exe
  2⤵
  PID:3228
- C:\Windows\System\vcRYfaM.exe
  C:\Windows\System\vcRYfaM.exe
  2⤵
  PID:3248
- C:\Windows\System\ffISSdg.exe
  C:\Windows\System\ffISSdg.exe
  2⤵
  PID:3264
- C:\Windows\System\rWpSjiz.exe
  C:\Windows\System\rWpSjiz.exe
  2⤵
  PID:3280
- C:\Windows\System\lOkcwqc.exe
  C:\Windows\System\lOkcwqc.exe
  2⤵
  PID:3300
- C:\Windows\System\nYzrZnO.exe
  C:\Windows\System\nYzrZnO.exe
  2⤵
  PID:3316
- C:\Windows\System\FPZnHEF.exe
  C:\Windows\System\FPZnHEF.exe
  2⤵
  PID:3332
- C:\Windows\System\CudGJZQ.exe
  C:\Windows\System\CudGJZQ.exe
  2⤵
  PID:3352
- C:\Windows\System\QllHEtz.exe
  C:\Windows\System\QllHEtz.exe
  2⤵
  PID:3368
- C:\Windows\System\cbQrAtN.exe
  C:\Windows\System\cbQrAtN.exe
  2⤵
  PID:3388
- C:\Windows\System\tCzbSPK.exe
  C:\Windows\System\tCzbSPK.exe
  2⤵
  PID:3404
- C:\Windows\System\UoJVTeQ.exe
  C:\Windows\System\UoJVTeQ.exe
  2⤵
  PID:3424
- C:\Windows\System\WPhSXlh.exe
  C:\Windows\System\WPhSXlh.exe
  2⤵
  PID:3440
- C:\Windows\System\BPxTRre.exe
  C:\Windows\System\BPxTRre.exe
  2⤵
  PID:3460
- C:\Windows\System\yiynIrf.exe
  C:\Windows\System\yiynIrf.exe
  2⤵
  PID:3516
- C:\Windows\System\bDqyklb.exe
  C:\Windows\System\bDqyklb.exe
  2⤵
  PID:3532
- C:\Windows\System\vqvMrHZ.exe
  C:\Windows\System\vqvMrHZ.exe
  2⤵
  PID:3548
- C:\Windows\System\FMNmLuV.exe
  C:\Windows\System\FMNmLuV.exe
  2⤵
  PID:3568
- C:\Windows\System\gHItSvZ.exe
  C:\Windows\System\gHItSvZ.exe
  2⤵
  PID:3584
- C:\Windows\System\hpByddr.exe
  C:\Windows\System\hpByddr.exe
  2⤵
  PID:3600
- C:\Windows\System\MlRgOny.exe
  C:\Windows\System\MlRgOny.exe
  2⤵
  PID:3620
- C:\Windows\System\CWOFgHJ.exe
  C:\Windows\System\CWOFgHJ.exe
  2⤵
  PID:3636
- C:\Windows\System\pCawLwo.exe
  C:\Windows\System\pCawLwo.exe
  2⤵
  PID:3652
- C:\Windows\System\EkwQMNb.exe
  C:\Windows\System\EkwQMNb.exe
  2⤵
  PID:3668
- C:\Windows\System\ROhReWi.exe
  C:\Windows\System\ROhReWi.exe
  2⤵
  PID:3684
- C:\Windows\System\fczeIng.exe
  C:\Windows\System\fczeIng.exe
  2⤵
  PID:3700
- C:\Windows\System\yluoTog.exe
  C:\Windows\System\yluoTog.exe
  2⤵
  PID:3716
- C:\Windows\System\SVhXNhM.exe
  C:\Windows\System\SVhXNhM.exe
  2⤵
  PID:3732
- C:\Windows\System\aiYPXbi.exe
  C:\Windows\System\aiYPXbi.exe
  2⤵
  PID:3748
- C:\Windows\System\ScmjjVp.exe
  C:\Windows\System\ScmjjVp.exe
  2⤵
  PID:3768
- C:\Windows\System\MvtCTMS.exe
  C:\Windows\System\MvtCTMS.exe
  2⤵
  PID:3792
- C:\Windows\System\DrbouhZ.exe
  C:\Windows\System\DrbouhZ.exe
  2⤵
  PID:3824
- C:\Windows\System\aeYESMF.exe
  C:\Windows\System\aeYESMF.exe
  2⤵
  PID:3848
- C:\Windows\System\VIViFty.exe
  C:\Windows\System\VIViFty.exe
  2⤵
  PID:3864
- C:\Windows\System\ccBESSk.exe
  C:\Windows\System\ccBESSk.exe
  2⤵
  PID:3880
- C:\Windows\System\sgtEeCQ.exe
  C:\Windows\System\sgtEeCQ.exe
  2⤵
  PID:3896
- C:\Windows\System\vwScaSk.exe
  C:\Windows\System\vwScaSk.exe
  2⤵
  PID:3912
- C:\Windows\System\evjiRjH.exe
  C:\Windows\System\evjiRjH.exe
  2⤵
  PID:3928
- C:\Windows\System\pCKEzEb.exe
  C:\Windows\System\pCKEzEb.exe
  2⤵
  PID:3944
- C:\Windows\System\iHNtjgp.exe
  C:\Windows\System\iHNtjgp.exe
  2⤵
  PID:3960
- C:\Windows\System\FqfcwFG.exe
  C:\Windows\System\FqfcwFG.exe
  2⤵
  PID:3976
- C:\Windows\System\vwbbjJR.exe
  C:\Windows\System\vwbbjJR.exe
  2⤵
  PID:3992
- C:\Windows\System\CPleeut.exe
  C:\Windows\System\CPleeut.exe
  2⤵
  PID:4012
- C:\Windows\System\edDAWvX.exe
  C:\Windows\System\edDAWvX.exe
  2⤵
  PID:4028
- C:\Windows\System\trjYBvs.exe
  C:\Windows\System\trjYBvs.exe
  2⤵
  PID:4056
- C:\Windows\System\WrJziOw.exe
  C:\Windows\System\WrJziOw.exe
  2⤵
  PID:4072
- C:\Windows\System\DLjjgcw.exe
  C:\Windows\System\DLjjgcw.exe
  2⤵
  PID:4088
- C:\Windows\System\gmAEQmx.exe
  C:\Windows\System\gmAEQmx.exe
  2⤵
  PID:1168
- C:\Windows\System\xnqofzA.exe
  C:\Windows\System\xnqofzA.exe
  2⤵
  PID:1072
- C:\Windows\System\zbkUWFv.exe
  C:\Windows\System\zbkUWFv.exe
  2⤵
  PID:1240
- C:\Windows\System\hreFZFO.exe
  C:\Windows\System\hreFZFO.exe
  2⤵
  PID:240
- C:\Windows\System\oRWzkZJ.exe
  C:\Windows\System\oRWzkZJ.exe
  2⤵
  PID:572
- C:\Windows\System\KmdRfnw.exe
  C:\Windows\System\KmdRfnw.exe
  2⤵
  PID:3104
- C:\Windows\System\mqWZzlC.exe
  C:\Windows\System\mqWZzlC.exe
  2⤵
  PID:2072
- C:\Windows\System\lfCAAvU.exe
  C:\Windows\System\lfCAAvU.exe
  2⤵
  PID:1540
- C:\Windows\System\nkLJsIJ.exe
  C:\Windows\System\nkLJsIJ.exe
  2⤵
  PID:3080
- C:\Windows\System\ofjmCQB.exe
  C:\Windows\System\ofjmCQB.exe
  2⤵
  PID:3156
- C:\Windows\System\dSPFcmJ.exe
  C:\Windows\System\dSPFcmJ.exe
  2⤵
  PID:3192
- C:\Windows\System\zYBCJJI.exe
  C:\Windows\System\zYBCJJI.exe
  2⤵
  PID:3256
- C:\Windows\System\dyDCPwr.exe
  C:\Windows\System\dyDCPwr.exe
  2⤵
  PID:3296
- C:\Windows\System\VoBiFqs.exe
  C:\Windows\System\VoBiFqs.exe
  2⤵
  PID:3204
- C:\Windows\System\jWYCWUp.exe
  C:\Windows\System\jWYCWUp.exe
  2⤵
  PID:3272
- C:\Windows\System\eyFsWwu.exe
  C:\Windows\System\eyFsWwu.exe
  2⤵
  PID:3400
- C:\Windows\System\dEeypuo.exe
  C:\Windows\System\dEeypuo.exe
  2⤵
  PID:3472
- C:\Windows\System\SVDuWTJ.exe
  C:\Windows\System\SVDuWTJ.exe
  2⤵
  PID:3488
- C:\Windows\System\DnpOGNq.exe
  C:\Windows\System\DnpOGNq.exe
  2⤵
  PID:3504
- C:\Windows\System\oDLYlEV.exe
  C:\Windows\System\oDLYlEV.exe
  2⤵
  PID:3544
- C:\Windows\System\YCKqIhC.exe
  C:\Windows\System\YCKqIhC.exe
  2⤵
  PID:3612
- C:\Windows\System\GYkSvHB.exe
  C:\Windows\System\GYkSvHB.exe
  2⤵
  PID:3644
- C:\Windows\System\cmfcMpN.exe
  C:\Windows\System\cmfcMpN.exe
  2⤵
  PID:2424
- C:\Windows\System\DwnRxqE.exe
  C:\Windows\System\DwnRxqE.exe
  2⤵
  PID:3712
- C:\Windows\System\zEHZXua.exe
  C:\Windows\System\zEHZXua.exe
  2⤵
  PID:3664
- C:\Windows\System\fUfitGa.exe
  C:\Windows\System\fUfitGa.exe
  2⤵
  PID:3728
- C:\Windows\System\FggLGYT.exe
  C:\Windows\System\FggLGYT.exe
  2⤵
  PID:3308
- C:\Windows\System\ZWXjWFc.exe
  C:\Windows\System\ZWXjWFc.exe
  2⤵
  PID:3348
- C:\Windows\System\RAjXyyd.exe
  C:\Windows\System\RAjXyyd.exe
  2⤵
  PID:3556
- C:\Windows\System\AVuxuyz.exe
  C:\Windows\System\AVuxuyz.exe
  2⤵
  PID:3956
- C:\Windows\System\vcjlsWH.exe
  C:\Windows\System\vcjlsWH.exe
  2⤵
  PID:3988
- C:\Windows\System\ZyxWlNY.exe
  C:\Windows\System\ZyxWlNY.exe
  2⤵
  PID:3760
- C:\Windows\System\Bsjpges.exe
  C:\Windows\System\Bsjpges.exe
  2⤵
  PID:3972
- C:\Windows\System\PaOGDiC.exe
  C:\Windows\System\PaOGDiC.exe
  2⤵
  PID:4048
- C:\Windows\System\BivQLLB.exe
  C:\Windows\System\BivQLLB.exe
  2⤵
  PID:2528
- C:\Windows\System\zgvZEau.exe
  C:\Windows\System\zgvZEau.exe
  2⤵
  PID:2684
- C:\Windows\System\YAxekKW.exe
  C:\Windows\System\YAxekKW.exe
  2⤵
  PID:3140
- C:\Windows\System\kCyegdY.exe
  C:\Windows\System\kCyegdY.exe
  2⤵
  PID:1276
- C:\Windows\System\nNHrEEt.exe
  C:\Windows\System\nNHrEEt.exe
  2⤵
  PID:3076
- C:\Windows\System\cGeteXd.exe
  C:\Windows\System\cGeteXd.exe
  2⤵
  PID:3324
- C:\Windows\System\aScArMH.exe
  C:\Windows\System\aScArMH.exe
  2⤵
  PID:3396
- C:\Windows\System\lvQjILI.exe
  C:\Windows\System\lvQjILI.exe
  2⤵
  PID:3512
- C:\Windows\System\CxRvzkx.exe
  C:\Windows\System\CxRvzkx.exe
  2⤵
  PID:3420
- C:\Windows\System\fmFggYR.exe
  C:\Windows\System\fmFggYR.exe
  2⤵
  PID:3312
- C:\Windows\System\MTxrBan.exe
  C:\Windows\System\MTxrBan.exe
  2⤵
  PID:3380
- C:\Windows\System\EHmuWfZ.exe
  C:\Windows\System\EHmuWfZ.exe
  2⤵
  PID:3244
- C:\Windows\System\ZrZQfJo.exe
  C:\Windows\System\ZrZQfJo.exe
  2⤵
  PID:3580
- C:\Windows\System\nIJjsSz.exe
  C:\Windows\System\nIJjsSz.exe
  2⤵
  PID:3660
- C:\Windows\System\FTEGWQM.exe
  C:\Windows\System\FTEGWQM.exe
  2⤵
  PID:3412
- C:\Windows\System\wpyldhO.exe
  C:\Windows\System\wpyldhO.exe
  2⤵
  PID:3456
- C:\Windows\System\sQSpDPL.exe
  C:\Windows\System\sQSpDPL.exe
  2⤵
  PID:3804
- C:\Windows\System\QhykYvH.exe
  C:\Windows\System\QhykYvH.exe
  2⤵
  PID:3808
- C:\Windows\System\rIONWbl.exe
  C:\Windows\System\rIONWbl.exe
  2⤵
  PID:3820
- C:\Windows\System\cJOmWjB.exe
  C:\Windows\System\cJOmWjB.exe
  2⤵
  PID:3920
- C:\Windows\System\oBTTSqr.exe
  C:\Windows\System\oBTTSqr.exe
  2⤵
  PID:3788
- C:\Windows\System\nhumyyx.exe
  C:\Windows\System\nhumyyx.exe
  2⤵
  PID:2744
- C:\Windows\System\Wmoysrl.exe
  C:\Windows\System\Wmoysrl.exe
  2⤵
  PID:4024
- C:\Windows\System\UHTNqRo.exe
  C:\Windows\System\UHTNqRo.exe
  2⤵
  PID:4044
- C:\Windows\System\EjeKagz.exe
  C:\Windows\System\EjeKagz.exe
  2⤵
  PID:2596
- C:\Windows\System\SXkpnQX.exe
  C:\Windows\System\SXkpnQX.exe
  2⤵
  PID:4068
- C:\Windows\System\SHedumS.exe
  C:\Windows\System\SHedumS.exe
  2⤵
  PID:3484
- C:\Windows\System\GqdYivr.exe
  C:\Windows\System\GqdYivr.exe
  2⤵
  PID:3240
- C:\Windows\System\EuJQqoA.exe
  C:\Windows\System\EuJQqoA.exe
  2⤵
  PID:3632
- C:\Windows\System\TLGvvjl.exe
  C:\Windows\System\TLGvvjl.exe
  2⤵
  PID:3756
- C:\Windows\System\CmgCawC.exe
  C:\Windows\System\CmgCawC.exe
  2⤵
  PID:3436
- C:\Windows\System\PmRrFHP.exe
  C:\Windows\System\PmRrFHP.exe
  2⤵
  PID:3500
- C:\Windows\System\FizcVRi.exe
  C:\Windows\System\FizcVRi.exe
  2⤵
  PID:3176
- C:\Windows\System\rBKbOmJ.exe
  C:\Windows\System\rBKbOmJ.exe
  2⤵
  PID:3592
- C:\Windows\System\oEWvejJ.exe
  C:\Windows\System\oEWvejJ.exe
  2⤵
  PID:3832
- C:\Windows\System\CpZWOAO.exe
  C:\Windows\System\CpZWOAO.exe
  2⤵
  PID:4036
- C:\Windows\System\YdWvZsL.exe
  C:\Windows\System\YdWvZsL.exe
  2⤵
  PID:3840
- C:\Windows\System\jZrIEBw.exe
  C:\Windows\System\jZrIEBw.exe
  2⤵
  PID:2600
- C:\Windows\System\XfEmuxr.exe
  C:\Windows\System\XfEmuxr.exe
  2⤵
  PID:3496
- C:\Windows\System\XGJycwG.exe
  C:\Windows\System\XGJycwG.exe
  2⤵
  PID:3524
- C:\Windows\System\kyceZvi.exe
  C:\Windows\System\kyceZvi.exe
  2⤵
  PID:3876
- C:\Windows\System\MMzOcqx.exe
  C:\Windows\System\MMzOcqx.exe
  2⤵
  PID:3968
- C:\Windows\System\SmgVYgl.exe
  C:\Windows\System\SmgVYgl.exe
  2⤵
  PID:3188
- C:\Windows\System\pvgKMYR.exe
  C:\Windows\System\pvgKMYR.exe
  2⤵
  PID:3776
- C:\Windows\System\ZTCtzPb.exe
  C:\Windows\System\ZTCtzPb.exe
  2⤵
  PID:2288
- C:\Windows\System\WLVplKV.exe
  C:\Windows\System\WLVplKV.exe
  2⤵
  PID:3344
- C:\Windows\System\SzLAiJP.exe
  C:\Windows\System\SzLAiJP.exe
  2⤵
  PID:3564
- C:\Windows\System\VcpYDhX.exe
  C:\Windows\System\VcpYDhX.exe
  2⤵
  PID:560
- C:\Windows\System\gsPYrJo.exe
  C:\Windows\System\gsPYrJo.exe
  2⤵
  PID:3292
- C:\Windows\System\elEKnLa.exe
  C:\Windows\System\elEKnLa.exe
  2⤵
  PID:3448
- C:\Windows\System\YDXrWaz.exe
  C:\Windows\System\YDXrWaz.exe
  2⤵
  PID:4112
- C:\Windows\System\EYzMMzq.exe
  C:\Windows\System\EYzMMzq.exe
  2⤵
  PID:4128
- C:\Windows\System\TMmaENF.exe
  C:\Windows\System\TMmaENF.exe
  2⤵
  PID:4144
- C:\Windows\System\gikhIjd.exe
  C:\Windows\System\gikhIjd.exe
  2⤵
  PID:4160
- C:\Windows\System\GdrssXE.exe
  C:\Windows\System\GdrssXE.exe
  2⤵
  PID:4176
- C:\Windows\System\FLoyTpk.exe
  C:\Windows\System\FLoyTpk.exe
  2⤵
  PID:4192
- C:\Windows\System\XStSWmV.exe
  C:\Windows\System\XStSWmV.exe
  2⤵
  PID:4208
- C:\Windows\System\WRNakCK.exe
  C:\Windows\System\WRNakCK.exe
  2⤵
  PID:4344
- C:\Windows\System\xkViHYT.exe
  C:\Windows\System\xkViHYT.exe
  2⤵
  PID:4360
- C:\Windows\System\DNcPuYU.exe
  C:\Windows\System\DNcPuYU.exe
  2⤵
  PID:4376
- C:\Windows\System\IhIxbea.exe
  C:\Windows\System\IhIxbea.exe
  2⤵
  PID:4392
- C:\Windows\System\OmUuStS.exe
  C:\Windows\System\OmUuStS.exe
  2⤵
  PID:4408
- C:\Windows\System\AALHksB.exe
  C:\Windows\System\AALHksB.exe
  2⤵
  PID:4424
- C:\Windows\System\aBiJdvC.exe
  C:\Windows\System\aBiJdvC.exe
  2⤵
  PID:4440
- C:\Windows\System\CrqFkpR.exe
  C:\Windows\System\CrqFkpR.exe
  2⤵
  PID:4456
- C:\Windows\System\onzlxdH.exe
  C:\Windows\System\onzlxdH.exe
  2⤵
  PID:4472
- C:\Windows\System\VvNWhdK.exe
  C:\Windows\System\VvNWhdK.exe
  2⤵
  PID:4496
- C:\Windows\System\BAlqtyq.exe
  C:\Windows\System\BAlqtyq.exe
  2⤵
  PID:4512
- C:\Windows\System\JoTqnIL.exe
  C:\Windows\System\JoTqnIL.exe
  2⤵
  PID:4528
- C:\Windows\System\OBhcisE.exe
  C:\Windows\System\OBhcisE.exe
  2⤵
  PID:4544
- C:\Windows\System\sqZblXL.exe
  C:\Windows\System\sqZblXL.exe
  2⤵
  PID:4568
- C:\Windows\System\bIkZnvH.exe
  C:\Windows\System\bIkZnvH.exe
  2⤵
  PID:4588
- C:\Windows\System\kNhrByC.exe
  C:\Windows\System\kNhrByC.exe
  2⤵
  PID:4604
- C:\Windows\System\dmecoVq.exe
  C:\Windows\System\dmecoVq.exe
  2⤵
  PID:4624
- C:\Windows\System\wdYgXFc.exe
  C:\Windows\System\wdYgXFc.exe
  2⤵
  PID:4644
- C:\Windows\System\nntgbPo.exe
  C:\Windows\System\nntgbPo.exe
  2⤵
  PID:4668
- C:\Windows\System\eGRZYaK.exe
  C:\Windows\System\eGRZYaK.exe
  2⤵
  PID:4684
- C:\Windows\System\klRAZlT.exe
  C:\Windows\System\klRAZlT.exe
  2⤵
  PID:4700
- C:\Windows\System\SlAfNit.exe
  C:\Windows\System\SlAfNit.exe
  2⤵
  PID:4732
- C:\Windows\System\FXIzkDF.exe
  C:\Windows\System\FXIzkDF.exe
  2⤵
  PID:4748
- C:\Windows\System\TTZIntn.exe
  C:\Windows\System\TTZIntn.exe
  2⤵
  PID:4768
- C:\Windows\System\cADrloe.exe
  C:\Windows\System\cADrloe.exe
  2⤵
  PID:4784
- C:\Windows\System\sVHuKlv.exe
  C:\Windows\System\sVHuKlv.exe
  2⤵
  PID:4800
- C:\Windows\System\OEjvtja.exe
  C:\Windows\System\OEjvtja.exe
  2⤵
  PID:4816
- C:\Windows\System\svSyUrE.exe
  C:\Windows\System\svSyUrE.exe
  2⤵
  PID:4836
- C:\Windows\System\bFlAhyY.exe
  C:\Windows\System\bFlAhyY.exe
  2⤵
  PID:4852
- C:\Windows\System\XINXoSx.exe
  C:\Windows\System\XINXoSx.exe
  2⤵
  PID:4868
- C:\Windows\System\dMuEcwE.exe
  C:\Windows\System\dMuEcwE.exe
  2⤵
  PID:4884
- C:\Windows\System\WFaxkaR.exe
  C:\Windows\System\WFaxkaR.exe
  2⤵
  PID:4900
- C:\Windows\System\PxFETNF.exe
  C:\Windows\System\PxFETNF.exe
  2⤵
  PID:4916
- C:\Windows\System\FBeGeEL.exe
  C:\Windows\System\FBeGeEL.exe
  2⤵
  PID:4932
- C:\Windows\System\nXQYyze.exe
  C:\Windows\System\nXQYyze.exe
  2⤵
  PID:4972
- C:\Windows\System\gNAWNEa.exe
  C:\Windows\System\gNAWNEa.exe
  2⤵
  PID:4988
- C:\Windows\System\KncMqYU.exe
  C:\Windows\System\KncMqYU.exe
  2⤵
  PID:5004
- C:\Windows\System\ppaASxf.exe
  C:\Windows\System\ppaASxf.exe
  2⤵
  PID:5020
- C:\Windows\System\nmoSlVf.exe
  C:\Windows\System\nmoSlVf.exe
  2⤵
  PID:5036
- C:\Windows\System\IwrXaBo.exe
  C:\Windows\System\IwrXaBo.exe
  2⤵
  PID:5052
- C:\Windows\System\uizotvk.exe
  C:\Windows\System\uizotvk.exe
  2⤵
  PID:5068
- C:\Windows\System\DIawIzC.exe
  C:\Windows\System\DIawIzC.exe
  2⤵
  PID:5084
- C:\Windows\System\jPKqgSP.exe
  C:\Windows\System\jPKqgSP.exe
  2⤵
  PID:5100
- C:\Windows\System\AMmfzNh.exe
  C:\Windows\System\AMmfzNh.exe
  2⤵
  PID:5116
- C:\Windows\System\ULcdgOB.exe
  C:\Windows\System\ULcdgOB.exe
  2⤵
  PID:4120
- C:\Windows\System\wAXanuc.exe
  C:\Windows\System\wAXanuc.exe
  2⤵
  PID:2064
- C:\Windows\System\lmmPkro.exe
  C:\Windows\System\lmmPkro.exe
  2⤵
  PID:4084
- C:\Windows\System\bwytQZe.exe
  C:\Windows\System\bwytQZe.exe
  2⤵
  PID:3480
- C:\Windows\System\ePuBNaR.exe
  C:\Windows\System\ePuBNaR.exe
  2⤵
  PID:4140
- C:\Windows\System\SelZueA.exe
  C:\Windows\System\SelZueA.exe
  2⤵
  PID:4200
- C:\Windows\System\ivlyIRy.exe
  C:\Windows\System\ivlyIRy.exe
  2⤵
  PID:4228
- C:\Windows\System\RJbxYTL.exe
  C:\Windows\System\RJbxYTL.exe
  2⤵
  PID:4264
- C:\Windows\System\RkFflfd.exe
  C:\Windows\System\RkFflfd.exe
  2⤵
  PID:4224
- C:\Windows\System\BIVAHHQ.exe
  C:\Windows\System\BIVAHHQ.exe
  2⤵
  PID:4252
- C:\Windows\System\HfvTxUe.exe
  C:\Windows\System\HfvTxUe.exe
  2⤵
  PID:4280
- C:\Windows\System\tMLkfJG.exe
  C:\Windows\System\tMLkfJG.exe
  2⤵
  PID:4300
- C:\Windows\System\pFXLHGO.exe
  C:\Windows\System\pFXLHGO.exe
  2⤵
  PID:4324
- C:\Windows\System\mHLaJui.exe
  C:\Windows\System\mHLaJui.exe
  2⤵
  PID:4332
- C:\Windows\System\KyHlQMG.exe
  C:\Windows\System\KyHlQMG.exe
  2⤵
  PID:4400
- C:\Windows\System\JCtRYoj.exe
  C:\Windows\System\JCtRYoj.exe
  2⤵
  PID:4464
- C:\Windows\System\QsuqTKn.exe
  C:\Windows\System\QsuqTKn.exe
  2⤵
  PID:4480
- C:\Windows\System\NHpyPBd.exe
  C:\Windows\System\NHpyPBd.exe
  2⤵
  PID:4536
- C:\Windows\System\FSdzRCS.exe
  C:\Windows\System\FSdzRCS.exe
  2⤵
  PID:4576
- C:\Windows\System\JXQYBJi.exe
  C:\Windows\System\JXQYBJi.exe
  2⤵
  PID:4524
- C:\Windows\System\nCBzZwM.exe
  C:\Windows\System\nCBzZwM.exe
  2⤵
  PID:4620
- C:\Windows\System\rUeGwxz.exe
  C:\Windows\System\rUeGwxz.exe
  2⤵
  PID:4600
- C:\Windows\System\mvEMyyZ.exe
  C:\Windows\System\mvEMyyZ.exe
  2⤵
  PID:4664
- C:\Windows\System\rfVdoNr.exe
  C:\Windows\System\rfVdoNr.exe
  2⤵
  PID:4596
- C:\Windows\System\HaaMsMh.exe
  C:\Windows\System\HaaMsMh.exe
  2⤵
  PID:4812
- C:\Windows\System\XRzlydC.exe
  C:\Windows\System\XRzlydC.exe
  2⤵
  PID:4712
- C:\Windows\System\gtUCybe.exe
  C:\Windows\System\gtUCybe.exe
  2⤵
  PID:4848
- C:\Windows\System\sqfFZXp.exe
  C:\Windows\System\sqfFZXp.exe
  2⤵
  PID:4912
- C:\Windows\System\RVFnQEz.exe
  C:\Windows\System\RVFnQEz.exe
  2⤵
  PID:4640
- C:\Windows\System\NmkkliZ.exe
  C:\Windows\System\NmkkliZ.exe
  2⤵
  PID:4860
- C:\Windows\System\KtRGVcz.exe
  C:\Windows\System\KtRGVcz.exe
  2⤵
  PID:4796
- C:\Windows\System\zPHCEOq.exe
  C:\Windows\System\zPHCEOq.exe
  2⤵
  PID:4864
- C:\Windows\System\aVELKvU.exe
  C:\Windows\System\aVELKvU.exe
  2⤵
  PID:4940
- C:\Windows\System\fAYdNTC.exe
  C:\Windows\System\fAYdNTC.exe
  2⤵
  PID:4956
- C:\Windows\System\EqXtGRN.exe
  C:\Windows\System\EqXtGRN.exe
  2⤵
  PID:4968
- C:\Windows\System\syrJSkr.exe
  C:\Windows\System\syrJSkr.exe
  2⤵
  PID:4984
- C:\Windows\System\DznejST.exe
  C:\Windows\System\DznejST.exe
  2⤵
  PID:5032
- C:\Windows\System\HsTfJiO.exe
  C:\Windows\System\HsTfJiO.exe
  2⤵
  PID:5096
- C:\Windows\System\HpuwDrn.exe
  C:\Windows\System\HpuwDrn.exe
  2⤵
  PID:5080
- C:\Windows\System\WykolmU.exe
  C:\Windows\System\WykolmU.exe
  2⤵
  PID:4152
- C:\Windows\System\cuYzgDo.exe
  C:\Windows\System\cuYzgDo.exe
  2⤵
  PID:4080
- C:\Windows\System\hptHvFT.exe
  C:\Windows\System\hptHvFT.exe
  2⤵
  PID:4108
- C:\Windows\System\MmKLQEB.exe
  C:\Windows\System\MmKLQEB.exe
  2⤵
  PID:4216
- C:\Windows\System\zHCHOfe.exe
  C:\Windows\System\zHCHOfe.exe
  2⤵
  PID:4296
- C:\Windows\System\BZXldhc.exe
  C:\Windows\System\BZXldhc.exe
  2⤵
  PID:4388
- C:\Windows\System\oBnpDqe.exe
  C:\Windows\System\oBnpDqe.exe
  2⤵
  PID:4420
- C:\Windows\System\gSqsugO.exe
  C:\Windows\System\gSqsugO.exe
  2⤵
  PID:4616
- C:\Windows\System\LNERPTj.exe
  C:\Windows\System\LNERPTj.exe
  2⤵
  PID:4780
- C:\Windows\System\aZYIMLR.exe
  C:\Windows\System\aZYIMLR.exe
  2⤵
  PID:4724
- C:\Windows\System\UXMTnuQ.exe
  C:\Windows\System\UXMTnuQ.exe
  2⤵
  PID:4656
- C:\Windows\System\ZFlsiQG.exe
  C:\Windows\System\ZFlsiQG.exe
  2⤵
  PID:4508
- C:\Windows\System\xxAXAZu.exe
  C:\Windows\System\xxAXAZu.exe
  2⤵
  PID:4824
- C:\Windows\System\BRYlljH.exe
  C:\Windows\System\BRYlljH.exe
  2⤵
  PID:4960
- C:\Windows\System\fXpVIEe.exe
  C:\Windows\System\fXpVIEe.exe
  2⤵
  PID:1972
- C:\Windows\System\RegmJfJ.exe
  C:\Windows\System\RegmJfJ.exe
  2⤵
  PID:4676
- C:\Windows\System\TpnNOKN.exe
  C:\Windows\System\TpnNOKN.exe
  2⤵
  PID:4892
- C:\Windows\System\oPCKbAN.exe
  C:\Windows\System\oPCKbAN.exe
  2⤵
  PID:5112
- C:\Windows\System\hNmtxLz.exe
  C:\Windows\System\hNmtxLz.exe
  2⤵
  PID:1912
- C:\Windows\System\iSzzNxM.exe
  C:\Windows\System\iSzzNxM.exe
  2⤵
  PID:2392
- C:\Windows\System\sslZWFR.exe
  C:\Windows\System\sslZWFR.exe
  2⤵
  PID:4272
- C:\Windows\System\JISQwRC.exe
  C:\Windows\System\JISQwRC.exe
  2⤵
  PID:4312
- C:\Windows\System\oDBikRx.exe
  C:\Windows\System\oDBikRx.exe
  2⤵
  PID:4236
- C:\Windows\System\FnZptEx.exe
  C:\Windows\System\FnZptEx.exe
  2⤵
  PID:4320
- C:\Windows\System\nwZkeku.exe
  C:\Windows\System\nwZkeku.exe
  2⤵
  PID:4484
- C:\Windows\System\DFxflkp.exe
  C:\Windows\System\DFxflkp.exe
  2⤵
  PID:4720
- C:\Windows\System\KvvKOQx.exe
  C:\Windows\System\KvvKOQx.exe
  2⤵
  PID:4876
- C:\Windows\System\BlWCQQc.exe
  C:\Windows\System\BlWCQQc.exe
  2⤵
  PID:2948
- C:\Windows\System\nRzQSmn.exe
  C:\Windows\System\nRzQSmn.exe
  2⤵
  PID:5092
- C:\Windows\System\BXbbBLK.exe
  C:\Windows\System\BXbbBLK.exe
  2⤵
  PID:5000
- C:\Windows\System\wWKqIiJ.exe
  C:\Windows\System\wWKqIiJ.exe
  2⤵
  PID:4292
- C:\Windows\System\YCLIcLz.exe
  C:\Windows\System\YCLIcLz.exe
  2⤵
  PID:4488
- C:\Windows\System\VuQuFWd.exe
  C:\Windows\System\VuQuFWd.exe
  2⤵
  PID:3872
- C:\Windows\System\SpgvNyX.exe
  C:\Windows\System\SpgvNyX.exe
  2⤵
  PID:4416
- C:\Windows\System\LrpAVGS.exe
  C:\Windows\System\LrpAVGS.exe
  2⤵
  PID:5064
- C:\Windows\System\ACRfXeL.exe
  C:\Windows\System\ACRfXeL.exe
  2⤵
  PID:4268
- C:\Windows\System\bdAgNJQ.exe
  C:\Windows\System\bdAgNJQ.exe
  2⤵
  PID:4636
- C:\Windows\System\JnfWiem.exe
  C:\Windows\System\JnfWiem.exe
  2⤵
  PID:4448
- C:\Windows\System\TXfNcQX.exe
  C:\Windows\System\TXfNcQX.exe
  2⤵
  PID:4340
- C:\Windows\System\oicxfZS.exe
  C:\Windows\System\oicxfZS.exe
  2⤵
  PID:4356
- C:\Windows\System\xxfppoj.exe
  C:\Windows\System\xxfppoj.exe
  2⤵
  PID:2356
- C:\Windows\System\eFOxfHv.exe
  C:\Windows\System\eFOxfHv.exe
  2⤵
  PID:4564
- C:\Windows\System\ocxUlmm.exe
  C:\Windows\System\ocxUlmm.exe
  2⤵
  PID:1964
- C:\Windows\System\YZqqkhn.exe
  C:\Windows\System\YZqqkhn.exe
  2⤵
  PID:4384
- C:\Windows\System\Emhdrsv.exe
  C:\Windows\System\Emhdrsv.exe
  2⤵
  PID:1448
- C:\Windows\System\dRWEwOZ.exe
  C:\Windows\System\dRWEwOZ.exe
  2⤵
  PID:4880
- C:\Windows\System\xtafJAU.exe
  C:\Windows\System\xtafJAU.exe
  2⤵
  PID:4504
- C:\Windows\System\uHdcMYZ.exe
  C:\Windows\System\uHdcMYZ.exe
  2⤵
  PID:5128
- C:\Windows\System\BgOnwbp.exe
  C:\Windows\System\BgOnwbp.exe
  2⤵
  PID:5144
- C:\Windows\System\dawznUW.exe
  C:\Windows\System\dawznUW.exe
  2⤵
  PID:5164
- C:\Windows\System\vdOpuLa.exe
  C:\Windows\System\vdOpuLa.exe
  2⤵
  PID:5180
- C:\Windows\System\IxjXpsl.exe
  C:\Windows\System\IxjXpsl.exe
  2⤵
  PID:5196
- C:\Windows\System\GXyNIZw.exe
  C:\Windows\System\GXyNIZw.exe
  2⤵
  PID:5212
- C:\Windows\System\eAthFIP.exe
  C:\Windows\System\eAthFIP.exe
  2⤵
  PID:5228
- C:\Windows\System\cazSzNw.exe
  C:\Windows\System\cazSzNw.exe
  2⤵
  PID:5244
- C:\Windows\System\sUPRHKQ.exe
  C:\Windows\System\sUPRHKQ.exe
  2⤵
  PID:5264
- C:\Windows\System\rvyApCP.exe
  C:\Windows\System\rvyApCP.exe
  2⤵
  PID:5280
- C:\Windows\System\BVnrXBG.exe
  C:\Windows\System\BVnrXBG.exe
  2⤵
  PID:5296
- C:\Windows\System\fcRened.exe
  C:\Windows\System\fcRened.exe
  2⤵
  PID:5312
- C:\Windows\System\IjRebNg.exe
  C:\Windows\System\IjRebNg.exe
  2⤵
  PID:5328
- C:\Windows\System\gdOExRv.exe
  C:\Windows\System\gdOExRv.exe
  2⤵
  PID:5344
- C:\Windows\System\unDgAKL.exe
  C:\Windows\System\unDgAKL.exe
  2⤵
  PID:5360
- C:\Windows\System\VOiaEZK.exe
  C:\Windows\System\VOiaEZK.exe
  2⤵
  PID:5376
- C:\Windows\System\LEpcmjF.exe
  C:\Windows\System\LEpcmjF.exe
  2⤵
  PID:5392
- C:\Windows\System\tqGgvTx.exe
  C:\Windows\System\tqGgvTx.exe
  2⤵
  PID:5408
- C:\Windows\System\ijLjqnK.exe
  C:\Windows\System\ijLjqnK.exe
  2⤵
  PID:5424
- C:\Windows\System\UzQmPHM.exe
  C:\Windows\System\UzQmPHM.exe
  2⤵
  PID:5440
- C:\Windows\System\KVPUFXb.exe
  C:\Windows\System\KVPUFXb.exe
  2⤵
  PID:5456
- C:\Windows\System\jaksMxW.exe
  C:\Windows\System\jaksMxW.exe
  2⤵
  PID:5472
- C:\Windows\System\jwoGzLK.exe
  C:\Windows\System\jwoGzLK.exe
  2⤵
  PID:5488
- C:\Windows\System\KyHlRss.exe
  C:\Windows\System\KyHlRss.exe
  2⤵
  PID:5504
- C:\Windows\System\TRmbqty.exe
  C:\Windows\System\TRmbqty.exe
  2⤵
  PID:5520
- C:\Windows\System\RQueqpD.exe
  C:\Windows\System\RQueqpD.exe
  2⤵
  PID:5536
- C:\Windows\System\LxDZEfw.exe
  C:\Windows\System\LxDZEfw.exe
  2⤵
  PID:5552
- C:\Windows\System\KFctAVX.exe
  C:\Windows\System\KFctAVX.exe
  2⤵
  PID:5568
- C:\Windows\System\fijlquN.exe
  C:\Windows\System\fijlquN.exe
  2⤵
  PID:5584
- C:\Windows\System\AfUvjwz.exe
  C:\Windows\System\AfUvjwz.exe
  2⤵
  PID:5600
- C:\Windows\System\bfYtiVE.exe
  C:\Windows\System\bfYtiVE.exe
  2⤵
  PID:5616
- C:\Windows\System\EVLNZpi.exe
  C:\Windows\System\EVLNZpi.exe
  2⤵
  PID:5632
- C:\Windows\System\bDzcDnb.exe
  C:\Windows\System\bDzcDnb.exe
  2⤵
  PID:5648
- C:\Windows\System\ENZJHiO.exe
  C:\Windows\System\ENZJHiO.exe
  2⤵
  PID:5672
- C:\Windows\System\EbURMBX.exe
  C:\Windows\System\EbURMBX.exe
  2⤵
  PID:5692
- C:\Windows\System\lkjxHVv.exe
  C:\Windows\System\lkjxHVv.exe
  2⤵
  PID:5712
- C:\Windows\System\nOJRaUg.exe
  C:\Windows\System\nOJRaUg.exe
  2⤵
  PID:5728
- C:\Windows\System\lGVecpC.exe
  C:\Windows\System\lGVecpC.exe
  2⤵
  PID:5744
- C:\Windows\System\xBGPxyU.exe
  C:\Windows\System\xBGPxyU.exe
  2⤵
  PID:5760
- C:\Windows\System\UPQpHRy.exe
  C:\Windows\System\UPQpHRy.exe
  2⤵
  PID:5776
- C:\Windows\System\PwGYhSC.exe
  C:\Windows\System\PwGYhSC.exe
  2⤵
  PID:5792
- C:\Windows\System\cXVyNBY.exe
  C:\Windows\System\cXVyNBY.exe
  2⤵
  PID:5808
- C:\Windows\System\CrieKhy.exe
  C:\Windows\System\CrieKhy.exe
  2⤵
  PID:5824
- C:\Windows\System\okUAcRG.exe
  C:\Windows\System\okUAcRG.exe
  2⤵
  PID:5840
- C:\Windows\System\YQTlsHK.exe
  C:\Windows\System\YQTlsHK.exe
  2⤵
  PID:5856
- C:\Windows\System\fTVBvYq.exe
  C:\Windows\System\fTVBvYq.exe
  2⤵
  PID:5872
- C:\Windows\System\kmdkckq.exe
  C:\Windows\System\kmdkckq.exe
  2⤵
  PID:5888
- C:\Windows\System\NvnEUQE.exe
  C:\Windows\System\NvnEUQE.exe
  2⤵
  PID:5904
- C:\Windows\System\fLqRyuT.exe
  C:\Windows\System\fLqRyuT.exe
  2⤵
  PID:5920
- C:\Windows\System\DssVomw.exe
  C:\Windows\System\DssVomw.exe
  2⤵
  PID:5936
- C:\Windows\System\BqOvTDG.exe
  C:\Windows\System\BqOvTDG.exe
  2⤵
  PID:5952
- C:\Windows\System\DxPKzlz.exe
  C:\Windows\System\DxPKzlz.exe
  2⤵
  PID:5968
- C:\Windows\System\fNuQuiC.exe
  C:\Windows\System\fNuQuiC.exe
  2⤵
  PID:5988
- C:\Windows\System\uRDTDlJ.exe
  C:\Windows\System\uRDTDlJ.exe
  2⤵
  PID:6004
- C:\Windows\System\JPZRcZa.exe
  C:\Windows\System\JPZRcZa.exe
  2⤵
  PID:6020
- C:\Windows\System\DEDmALp.exe
  C:\Windows\System\DEDmALp.exe
  2⤵
  PID:6036
- C:\Windows\System\EpngMeC.exe
  C:\Windows\System\EpngMeC.exe
  2⤵
  PID:6052
- C:\Windows\System\QnpPLTQ.exe
  C:\Windows\System\QnpPLTQ.exe
  2⤵
  PID:6068
- C:\Windows\System\jfXwYqM.exe
  C:\Windows\System\jfXwYqM.exe
  2⤵
  PID:6084
- C:\Windows\System\pXKIGIn.exe
  C:\Windows\System\pXKIGIn.exe
  2⤵
  PID:6100
- C:\Windows\System\qpOSAXZ.exe
  C:\Windows\System\qpOSAXZ.exe
  2⤵
  PID:6116
- C:\Windows\System\grvanHI.exe
  C:\Windows\System\grvanHI.exe
  2⤵
  PID:6132
- C:\Windows\System\vXxsTYu.exe
  C:\Windows\System\vXxsTYu.exe
  2⤵
  PID:4220
- C:\Windows\System\EJDWMtY.exe
  C:\Windows\System\EJDWMtY.exe
  2⤵
  PID:5136
- C:\Windows\System\XCcfpGh.exe
  C:\Windows\System\XCcfpGh.exe
  2⤵
  PID:5156
- C:\Windows\System\aauxyCd.exe
  C:\Windows\System\aauxyCd.exe
  2⤵
  PID:5192
- C:\Windows\System\LCWqyjh.exe
  C:\Windows\System\LCWqyjh.exe
  2⤵
  PID:2232
- C:\Windows\System\IDmEhxC.exe
  C:\Windows\System\IDmEhxC.exe
  2⤵
  PID:5528
- C:\Windows\System\XdheQMh.exe
  C:\Windows\System\XdheQMh.exe
  2⤵
  PID:5548
- C:\Windows\System\FGSzCLL.exe
  C:\Windows\System\FGSzCLL.exe
  2⤵
  PID:5608
- C:\Windows\System\haqSOkT.exe
  C:\Windows\System\haqSOkT.exe
  2⤵
  PID:5684
- C:\Windows\System\xOqmFCi.exe
  C:\Windows\System\xOqmFCi.exe
  2⤵
  PID:5700
- C:\Windows\System\WpqmcIB.exe
  C:\Windows\System\WpqmcIB.exe
  2⤵
  PID:5740
- C:\Windows\System\uSBezRG.exe
  C:\Windows\System\uSBezRG.exe
  2⤵
  PID:5816
- C:\Windows\System\SVRpBUu.exe
  C:\Windows\System\SVRpBUu.exe
  2⤵
  PID:5848
- C:\Windows\System\wTMqMyA.exe
  C:\Windows\System\wTMqMyA.exe
  2⤵
  PID:5800
- C:\Windows\System\GMrcQDo.exe
  C:\Windows\System\GMrcQDo.exe
  2⤵
  PID:5880
- C:\Windows\System\oLfFXHK.exe
  C:\Windows\System\oLfFXHK.exe
  2⤵
  PID:5900
- C:\Windows\System\yxYJQDb.exe
  C:\Windows\System\yxYJQDb.exe
  2⤵
  PID:5928
- C:\Windows\System\BEMrPif.exe
  C:\Windows\System\BEMrPif.exe
  2⤵
  PID:6048
- C:\Windows\System\caCPgXz.exe
  C:\Windows\System\caCPgXz.exe
  2⤵
  PID:6032
- C:\Windows\System\SpoZaTD.exe
  C:\Windows\System\SpoZaTD.exe
  2⤵
  PID:6108
- C:\Windows\System\bReQydj.exe
  C:\Windows\System\bReQydj.exe
  2⤵
  PID:5160
- C:\Windows\System\IwUcWKZ.exe
  C:\Windows\System\IwUcWKZ.exe
  2⤵
  PID:6124
- C:\Windows\System\qZwZScq.exe
  C:\Windows\System\qZwZScq.exe
  2⤵
  PID:5224
- C:\Windows\System\QCLQpTo.exe
  C:\Windows\System\QCLQpTo.exe
  2⤵
  PID:5292
- C:\Windows\System\ixiDkpL.exe
  C:\Windows\System\ixiDkpL.exe
  2⤵
  PID:5308
- C:\Windows\System\vmSyflr.exe
  C:\Windows\System\vmSyflr.exe
  2⤵
  PID:5324
- C:\Windows\System\rmYuBKi.exe
  C:\Windows\System\rmYuBKi.exe
  2⤵
  PID:5368
- C:\Windows\System\xqwEaoe.exe
  C:\Windows\System\xqwEaoe.exe
  2⤵
  PID:5388
- C:\Windows\System\YhxPpuA.exe
  C:\Windows\System\YhxPpuA.exe
  2⤵
  PID:5468
- C:\Windows\System\YtaLIhF.exe
  C:\Windows\System\YtaLIhF.exe
  2⤵
  PID:2920
- C:\Windows\System\koGLOrS.exe
  C:\Windows\System\koGLOrS.exe
  2⤵
  PID:5272
- C:\Windows\System\QXdbQTH.exe
  C:\Windows\System\QXdbQTH.exe
  2⤵
  PID:5560
- C:\Windows\System\hDBpiHN.exe
  C:\Windows\System\hDBpiHN.exe
  2⤵
  PID:5624
- C:\Windows\System\bcVCIpo.exe
  C:\Windows\System\bcVCIpo.exe
  2⤵
  PID:5704
- C:\Windows\System\qnzlPvh.exe
  C:\Windows\System\qnzlPvh.exe
  2⤵
  PID:5688
- C:\Windows\System\oMAexFN.exe
  C:\Windows\System\oMAexFN.exe
  2⤵
  PID:5784
- C:\Windows\System\CjBixdq.exe
  C:\Windows\System\CjBixdq.exe
  2⤵
  PID:2912
- C:\Windows\System\WpKcofL.exe
  C:\Windows\System\WpKcofL.exe
  2⤵
  PID:5660
- C:\Windows\System\PzrsvkY.exe
  C:\Windows\System\PzrsvkY.exe
  2⤵
  PID:6012
- C:\Windows\System\qeCudNr.exe
  C:\Windows\System\qeCudNr.exe
  2⤵
  PID:5964
- C:\Windows\System\xQUFMIx.exe
  C:\Windows\System\xQUFMIx.exe
  2⤵
  PID:6000
- C:\Windows\System\rCqSAwA.exe
  C:\Windows\System\rCqSAwA.exe
  2⤵
  PID:4744
- C:\Windows\System\Kxgpvsm.exe
  C:\Windows\System\Kxgpvsm.exe
  2⤵
  PID:6128
- C:\Windows\System\ITzRxNn.exe
  C:\Windows\System\ITzRxNn.exe
  2⤵
  PID:5220
- C:\Windows\System\ChOisvk.exe
  C:\Windows\System\ChOisvk.exe
  2⤵
  PID:5288
- C:\Windows\System\eMYaRXf.exe
  C:\Windows\System\eMYaRXf.exe
  2⤵
  PID:780
- C:\Windows\System\OMLZFgl.exe
  C:\Windows\System\OMLZFgl.exe
  2⤵
  PID:5404
- C:\Windows\System\ooIyemG.exe
  C:\Windows\System\ooIyemG.exe
  2⤵
  PID:5580
- C:\Windows\System\QfplJpB.exe
  C:\Windows\System\QfplJpB.exe
  2⤵
  PID:2908
- C:\Windows\System\ZfzrDUE.exe
  C:\Windows\System\ZfzrDUE.exe
  2⤵
  PID:5516
- C:\Windows\System\OCwWHwW.exe
  C:\Windows\System\OCwWHwW.exe
  2⤵
  PID:1532
- C:\Windows\System\PeEAKlN.exe
  C:\Windows\System\PeEAKlN.exe
  2⤵
  PID:5948
- C:\Windows\System\QDFRcKb.exe
  C:\Windows\System\QDFRcKb.exe
  2⤵
  PID:6080
- C:\Windows\System\rMGwrMP.exe
  C:\Windows\System\rMGwrMP.exe
  2⤵
  PID:3844
- C:\Windows\System\gUyTNEW.exe
  C:\Windows\System\gUyTNEW.exe
  2⤵
  PID:5480
- C:\Windows\System\ZGUgiaJ.exe
  C:\Windows\System\ZGUgiaJ.exe
  2⤵
  PID:5680
- C:\Windows\System\WKcPcdV.exe
  C:\Windows\System\WKcPcdV.exe
  2⤵
  PID:6148
- C:\Windows\System\pJeDhtB.exe
  C:\Windows\System\pJeDhtB.exe
  2⤵
  PID:6164
- C:\Windows\System\QmomQbi.exe
  C:\Windows\System\QmomQbi.exe
  2⤵
  PID:6180
- C:\Windows\System\qevZhwH.exe
  C:\Windows\System\qevZhwH.exe
  2⤵
  PID:6196
- C:\Windows\System\mCvQBvj.exe
  C:\Windows\System\mCvQBvj.exe
  2⤵
  PID:6212
- C:\Windows\System\NMUbBOz.exe
  C:\Windows\System\NMUbBOz.exe
  2⤵
  PID:6232
- C:\Windows\System\KgeKoKl.exe
  C:\Windows\System\KgeKoKl.exe
  2⤵
  PID:6248
- C:\Windows\System\ESbZeuA.exe
  C:\Windows\System\ESbZeuA.exe
  2⤵
  PID:6264
- C:\Windows\System\WupsXyP.exe
  C:\Windows\System\WupsXyP.exe
  2⤵
  PID:6288
- C:\Windows\System\HqPRizM.exe
  C:\Windows\System\HqPRizM.exe
  2⤵
  PID:6312
- C:\Windows\System\ALBtUNx.exe
  C:\Windows\System\ALBtUNx.exe
  2⤵
  PID:6344
- C:\Windows\System\ZMixMba.exe
  C:\Windows\System\ZMixMba.exe
  2⤵
  PID:6360
- C:\Windows\System\XynvmfS.exe
  C:\Windows\System\XynvmfS.exe
  2⤵
  PID:6384
- C:\Windows\System\RLvXzLB.exe
  C:\Windows\System\RLvXzLB.exe
  2⤵
  PID:6404
- C:\Windows\System\YaKBXlq.exe
  C:\Windows\System\YaKBXlq.exe
  2⤵
  PID:6420
- C:\Windows\System\AHIRmum.exe
  C:\Windows\System\AHIRmum.exe
  2⤵
  PID:6436
- C:\Windows\System\bGFhlTu.exe
  C:\Windows\System\bGFhlTu.exe
  2⤵
  PID:6460
- C:\Windows\System\ZVYLAap.exe
  C:\Windows\System\ZVYLAap.exe
  2⤵
  PID:6476
- C:\Windows\System\psYDPKB.exe
  C:\Windows\System\psYDPKB.exe
  2⤵
  PID:6496
- C:\Windows\System\jGUCNRW.exe
  C:\Windows\System\jGUCNRW.exe
  2⤵
  PID:6512
- C:\Windows\System\iZLgriI.exe
  C:\Windows\System\iZLgriI.exe
  2⤵
  PID:6528
- C:\Windows\System\tfglEyC.exe
  C:\Windows\System\tfglEyC.exe
  2⤵
  PID:6544
- C:\Windows\System\LmpbRDa.exe
  C:\Windows\System\LmpbRDa.exe
  2⤵
  PID:6560
- C:\Windows\System\iHJFzRm.exe
  C:\Windows\System\iHJFzRm.exe
  2⤵
  PID:6576
- C:\Windows\System\ScDRzwu.exe
  C:\Windows\System\ScDRzwu.exe
  2⤵
  PID:6596
- C:\Windows\System\QDuBfaq.exe
  C:\Windows\System\QDuBfaq.exe
  2⤵
  PID:6612
- C:\Windows\System\lfslIwd.exe
  C:\Windows\System\lfslIwd.exe
  2⤵
  PID:6628
- C:\Windows\System\mZKHdtr.exe
  C:\Windows\System\mZKHdtr.exe
  2⤵
  PID:6644
- C:\Windows\System\vecmqaA.exe
  C:\Windows\System\vecmqaA.exe
  2⤵
  PID:6664
- C:\Windows\System\AqrWzRd.exe
  C:\Windows\System\AqrWzRd.exe
  2⤵
  PID:6680
- C:\Windows\System\lMVEcjz.exe
  C:\Windows\System\lMVEcjz.exe
  2⤵
  PID:6696
- C:\Windows\System\eVRoUpD.exe
  C:\Windows\System\eVRoUpD.exe
  2⤵
  PID:6712
- C:\Windows\System\dJrnsqg.exe
  C:\Windows\System\dJrnsqg.exe
  2⤵
  PID:6728
- C:\Windows\System\GjKtyIL.exe
  C:\Windows\System\GjKtyIL.exe
  2⤵
  PID:6744
- C:\Windows\System\bazYubV.exe
  C:\Windows\System\bazYubV.exe
  2⤵
  PID:6764
- C:\Windows\System\chKjzah.exe
  C:\Windows\System\chKjzah.exe
  2⤵
  PID:6780
- C:\Windows\System\uhfKjSy.exe
  C:\Windows\System\uhfKjSy.exe
  2⤵
  PID:6796
- C:\Windows\System\MDtUjFb.exe
  C:\Windows\System\MDtUjFb.exe
  2⤵
  PID:6812
- C:\Windows\System\ABXTORl.exe
  C:\Windows\System\ABXTORl.exe
  2⤵
  PID:6828
- C:\Windows\System\EprHkic.exe
  C:\Windows\System\EprHkic.exe
  2⤵
  PID:6844
- C:\Windows\System\FisMMJl.exe
  C:\Windows\System\FisMMJl.exe
  2⤵
  PID:6860
- C:\Windows\System\wiHQrHo.exe
  C:\Windows\System\wiHQrHo.exe
  2⤵
  PID:6876
- C:\Windows\System\iRcRWnS.exe
  C:\Windows\System\iRcRWnS.exe
  2⤵
  PID:6892
- C:\Windows\System\KYtpbht.exe
  C:\Windows\System\KYtpbht.exe
  2⤵
  PID:6908
- C:\Windows\System\kwmfYyL.exe
  C:\Windows\System\kwmfYyL.exe
  2⤵
  PID:6924
- C:\Windows\System\sgGqfJS.exe
  C:\Windows\System\sgGqfJS.exe
  2⤵
  PID:6940
- C:\Windows\System\yrokdLH.exe
  C:\Windows\System\yrokdLH.exe
  2⤵
  PID:6956
- C:\Windows\System\ksVxdJT.exe
  C:\Windows\System\ksVxdJT.exe
  2⤵
  PID:6972
- C:\Windows\System\HVkSKaO.exe
  C:\Windows\System\HVkSKaO.exe
  2⤵
  PID:6992
- C:\Windows\System\QigHlEw.exe
  C:\Windows\System\QigHlEw.exe
  2⤵
  PID:7008
- C:\Windows\System\xTkmEuK.exe
  C:\Windows\System\xTkmEuK.exe
  2⤵
  PID:7036
- C:\Windows\System\WXqZSyA.exe
  C:\Windows\System\WXqZSyA.exe
  2⤵
  PID:7056
- C:\Windows\System\qHynDow.exe
  C:\Windows\System\qHynDow.exe
  2⤵
  PID:7076
- C:\Windows\System\idofYhv.exe
  C:\Windows\System\idofYhv.exe
  2⤵
  PID:7092
- C:\Windows\System\WjrfrTy.exe
  C:\Windows\System\WjrfrTy.exe
  2⤵
  PID:7112
- C:\Windows\System\hbNCUUJ.exe
  C:\Windows\System\hbNCUUJ.exe
  2⤵
  PID:7128
- C:\Windows\System\kyfEZCB.exe
  C:\Windows\System\kyfEZCB.exe
  2⤵
  PID:7144
- C:\Windows\System\LsLPELa.exe
  C:\Windows\System\LsLPELa.exe
  2⤵
  PID:7160
- C:\Windows\System\GHzyWqa.exe
  C:\Windows\System\GHzyWqa.exe
  2⤵
  PID:5944
- C:\Windows\System\KgnByWw.exe
  C:\Windows\System\KgnByWw.exe
  2⤵
  PID:5916
- C:\Windows\System\lhLHbTe.exe
  C:\Windows\System\lhLHbTe.exe
  2⤵
  PID:6016
- C:\Windows\System\TqHhKrr.exe
  C:\Windows\System\TqHhKrr.exe
  2⤵
  PID:5416
- C:\Windows\System\RUbWhBk.exe
  C:\Windows\System\RUbWhBk.exe
  2⤵
  PID:6172
- C:\Windows\System\BmCBJqm.exe
  C:\Windows\System\BmCBJqm.exe
  2⤵
  PID:6156
- C:\Windows\System\LadlPJM.exe
  C:\Windows\System\LadlPJM.exe
  2⤵
  PID:5352
- C:\Windows\System\CiNmalS.exe
  C:\Windows\System\CiNmalS.exe
  2⤵
  PID:5736
- C:\Windows\System\YAebeIZ.exe
  C:\Windows\System\YAebeIZ.exe
  2⤵
  PID:4436
- C:\Windows\System\mYoNEPM.exe
  C:\Windows\System\mYoNEPM.exe
  2⤵
  PID:5644
- C:\Windows\System\AAuGvaQ.exe
  C:\Windows\System\AAuGvaQ.exe
  2⤵
  PID:4368
- C:\Windows\System\nXFqDPj.exe
  C:\Windows\System\nXFqDPj.exe
  2⤵
  PID:6228
- C:\Windows\System\lsdIRQa.exe
  C:\Windows\System\lsdIRQa.exe
  2⤵
  PID:6260
- C:\Windows\System\EkxkvFR.exe
  C:\Windows\System\EkxkvFR.exe
  2⤵
  PID:6284
- C:\Windows\System\CjPuLwP.exe
  C:\Windows\System\CjPuLwP.exe
  2⤵
  PID:6340
- C:\Windows\System\MqyiOhT.exe
  C:\Windows\System\MqyiOhT.exe
  2⤵
  PID:6308
- C:\Windows\System\GNzvCjU.exe
  C:\Windows\System\GNzvCjU.exe
  2⤵
  PID:6380
- C:\Windows\System\zSVyKnR.exe
  C:\Windows\System\zSVyKnR.exe
  2⤵
  PID:6416
- C:\Windows\System\VTMBLWI.exe
  C:\Windows\System\VTMBLWI.exe
  2⤵
  PID:6400
- C:\Windows\System\PNXNABt.exe
  C:\Windows\System\PNXNABt.exe
  2⤵
  PID:6452
- C:\Windows\System\IeIGwRO.exe
  C:\Windows\System\IeIGwRO.exe
  2⤵
  PID:6492
- C:\Windows\System\EOkiNcg.exe
  C:\Windows\System\EOkiNcg.exe
  2⤵
  PID:6556
- C:\Windows\System\vcpICvB.exe
  C:\Windows\System\vcpICvB.exe
  2⤵
  PID:6472
- C:\Windows\System\ftWxHPK.exe
  C:\Windows\System\ftWxHPK.exe
  2⤵
  PID:6608
- C:\Windows\System\tJCYZMB.exe
  C:\Windows\System\tJCYZMB.exe
  2⤵
  PID:6656
- C:\Windows\System\TNuvcck.exe
  C:\Windows\System\TNuvcck.exe
  2⤵
  PID:6636
- C:\Windows\System\ZihIuiT.exe
  C:\Windows\System\ZihIuiT.exe
  2⤵
  PID:6704
- C:\Windows\System\emeLndc.exe
  C:\Windows\System\emeLndc.exe
  2⤵
  PID:6740
- C:\Windows\System\XgPHvhy.exe
  C:\Windows\System\XgPHvhy.exe
  2⤵
  PID:6760
- C:\Windows\System\TMJZmgM.exe
  C:\Windows\System\TMJZmgM.exe
  2⤵
  PID:6824
- C:\Windows\System\bOswUZZ.exe
  C:\Windows\System\bOswUZZ.exe
  2⤵
  PID:6804
- C:\Windows\System\KVYUEXv.exe
  C:\Windows\System\KVYUEXv.exe
  2⤵
  PID:6868
- C:\Windows\System\nBYracm.exe
  C:\Windows\System\nBYracm.exe
  2⤵
  PID:6776
- C:\Windows\System\QhwGNdZ.exe
  C:\Windows\System\QhwGNdZ.exe
  2⤵
  PID:6948
- C:\Windows\System\xQNNnwE.exe
  C:\Windows\System\xQNNnwE.exe
  2⤵
  PID:6988
- C:\Windows\System\dzOSvxp.exe
  C:\Windows\System\dzOSvxp.exe
  2⤵
  PID:7020
- C:\Windows\System\bTFQWMK.exe
  C:\Windows\System\bTFQWMK.exe
  2⤵
  PID:6968
- C:\Windows\System\IyQiJoh.exe
  C:\Windows\System\IyQiJoh.exe
  2⤵
  PID:7032
- C:\Windows\System\UGVNqUZ.exe
  C:\Windows\System\UGVNqUZ.exe
  2⤵
  PID:7072
- C:\Windows\System\NQQcxlV.exe
  C:\Windows\System\NQQcxlV.exe
  2⤵
  PID:7044
- C:\Windows\System\UIhldgM.exe
  C:\Windows\System\UIhldgM.exe
  2⤵
  PID:7108
- C:\Windows\System\eIrbQGP.exe
  C:\Windows\System\eIrbQGP.exe
  2⤵
  PID:5820
- C:\Windows\System\AWIGJsN.exe
  C:\Windows\System\AWIGJsN.exe
  2⤵
  PID:5896
- C:\Windows\System\brmAoJN.exe
  C:\Windows\System\brmAoJN.exe
  2⤵
  PID:5320
- C:\Windows\System\mrxTwOh.exe
  C:\Windows\System\mrxTwOh.exe
  2⤵
  PID:5340
- C:\Windows\System\ViIpXNv.exe
  C:\Windows\System\ViIpXNv.exe
  2⤵
  PID:5960
- C:\Windows\System\dWtCVHp.exe
  C:\Windows\System\dWtCVHp.exe
  2⤵
  PID:6204
- C:\Windows\System\hVkPbLl.exe
  C:\Windows\System\hVkPbLl.exe
  2⤵
  PID:5772
- C:\Windows\System\GILEDQz.exe
  C:\Windows\System\GILEDQz.exe
  2⤵
  PID:6240
- C:\Windows\System\vAfwqkb.exe
  C:\Windows\System\vAfwqkb.exe
  2⤵
  PID:6304
- C:\Windows\System\gUrqfCS.exe
  C:\Windows\System\gUrqfCS.exe
  2⤵
  PID:5984
- C:\Windows\System\ydEvxLN.exe
  C:\Windows\System\ydEvxLN.exe
  2⤵
  PID:6588
- C:\Windows\System\PzVCPYP.exe
  C:\Windows\System\PzVCPYP.exe
  2⤵
  PID:6444
- C:\Windows\System\GVJjvKz.exe
  C:\Windows\System\GVJjvKz.exe
  2⤵
  PID:6296
- C:\Windows\System\MIpLrEX.exe
  C:\Windows\System\MIpLrEX.exe
  2⤵
  PID:6468
- C:\Windows\System\cKqmafO.exe
  C:\Windows\System\cKqmafO.exe
  2⤵
  PID:6508
- C:\Windows\System\lzSFvsa.exe
  C:\Windows\System\lzSFvsa.exe
  2⤵
  PID:6688
- C:\Windows\System\sqUznaP.exe
  C:\Windows\System\sqUznaP.exe
  2⤵
  PID:2276
- C:\Windows\System\UJRGera.exe
  C:\Windows\System\UJRGera.exe
  2⤵
  PID:6756
- C:\Windows\System\iNbqanS.exe
  C:\Windows\System\iNbqanS.exe
  2⤵
  PID:6884
- C:\Windows\System\hDiulEd.exe
  C:\Windows\System\hDiulEd.exe
  2⤵
  PID:6792
- C:\Windows\System\IMIFQHQ.exe
  C:\Windows\System\IMIFQHQ.exe
  2⤵
  PID:6916
- C:\Windows\System\dDOnbvI.exe
  C:\Windows\System\dDOnbvI.exe
  2⤵
  PID:7028
- C:\Windows\System\sEyBcIZ.exe
  C:\Windows\System\sEyBcIZ.exe
  2⤵
  PID:7156
- C:\Windows\System\qzPVIlp.exe
  C:\Windows\System\qzPVIlp.exe
  2⤵
  PID:5664
- C:\Windows\System\QGLfyJs.exe
  C:\Windows\System\QGLfyJs.exe
  2⤵
  PID:7004
- C:\Windows\System\cPQbibm.exe
  C:\Windows\System\cPQbibm.exe
  2⤵
  PID:6060
- C:\Windows\System\hFZZjaX.exe
  C:\Windows\System\hFZZjaX.exe
  2⤵
  PID:1928
- C:\Windows\System\AbTLqDA.exe
  C:\Windows\System\AbTLqDA.exe
  2⤵
  PID:6332
- C:\Windows\System\KkuKiHF.exe
  C:\Windows\System\KkuKiHF.exe
  2⤵
  PID:6112
- C:\Windows\System\lhcBcxT.exe
  C:\Windows\System\lhcBcxT.exe
  2⤵
  PID:6276
- C:\Windows\System\OTsmIcd.exe
  C:\Windows\System\OTsmIcd.exe
  2⤵
  PID:6504
- C:\Windows\System\OdOsTJX.exe
  C:\Windows\System\OdOsTJX.exe
  2⤵
  PID:6624
- C:\Windows\System\hHNJHQi.exe
  C:\Windows\System\hHNJHQi.exe
  2⤵
  PID:6720
- C:\Windows\System\BqyZJwu.exe
  C:\Windows\System\BqyZJwu.exe
  2⤵
  PID:6840
- C:\Windows\System\JQfbjpq.exe
  C:\Windows\System\JQfbjpq.exe
  2⤵
  PID:7068
- C:\Windows\System\TcJbPEF.exe
  C:\Windows\System\TcJbPEF.exe
  2⤵
  PID:7100
- C:\Windows\System\SDkOLUM.exe
  C:\Windows\System\SDkOLUM.exe
  2⤵
  PID:7120
- C:\Windows\System\CzTPZWH.exe
  C:\Windows\System\CzTPZWH.exe
  2⤵
  PID:6244
- C:\Windows\System\HTiUeoS.exe
  C:\Windows\System\HTiUeoS.exe
  2⤵
  PID:6392
- C:\Windows\System\JiDszGf.exe
  C:\Windows\System\JiDszGf.exe
  2⤵
  PID:6652
- C:\Windows\System\LodkykW.exe
  C:\Windows\System\LodkykW.exe
  2⤵
  PID:1888
- C:\Windows\System\TAIwwfr.exe
  C:\Windows\System\TAIwwfr.exe
  2⤵
  PID:6552
- C:\Windows\System\hVwZbjj.exe
  C:\Windows\System\hVwZbjj.exe
  2⤵
  PID:6536
- C:\Windows\System\nfYcEzL.exe
  C:\Windows\System\nfYcEzL.exe
  2⤵
  PID:6964
- C:\Windows\System\NYBOnDq.exe
  C:\Windows\System\NYBOnDq.exe
  2⤵
  PID:6984
- C:\Windows\System\jYTeCnP.exe
  C:\Windows\System\jYTeCnP.exe
  2⤵
  PID:6936
- C:\Windows\System\NBvIDPw.exe
  C:\Windows\System\NBvIDPw.exe
  2⤵
  PID:7104
- C:\Windows\System\OMDHWmJ.exe
  C:\Windows\System\OMDHWmJ.exe
  2⤵
  PID:7176
- C:\Windows\System\tBgRsMg.exe
  C:\Windows\System\tBgRsMg.exe
  2⤵
  PID:7192
- C:\Windows\System\qWGtOYr.exe
  C:\Windows\System\qWGtOYr.exe
  2⤵
  PID:7208
- C:\Windows\System\QuZRURx.exe
  C:\Windows\System\QuZRURx.exe
  2⤵
  PID:7224
- C:\Windows\System\Fxwkixz.exe
  C:\Windows\System\Fxwkixz.exe
  2⤵
  PID:7240
- C:\Windows\System\OUjrkGX.exe
  C:\Windows\System\OUjrkGX.exe
  2⤵
  PID:7256
- C:\Windows\System\EneqnbE.exe
  C:\Windows\System\EneqnbE.exe
  2⤵
  PID:7276
- C:\Windows\System\CQBMxjZ.exe
  C:\Windows\System\CQBMxjZ.exe
  2⤵
  PID:7292
- C:\Windows\System\aJVTYJf.exe
  C:\Windows\System\aJVTYJf.exe
  2⤵
  PID:7308
- C:\Windows\System\KNZzZjg.exe
  C:\Windows\System\KNZzZjg.exe
  2⤵
  PID:7328
- C:\Windows\System\eJfKMgN.exe
  C:\Windows\System\eJfKMgN.exe
  2⤵
  PID:7344
- C:\Windows\System\bJDuiwd.exe
  C:\Windows\System\bJDuiwd.exe
  2⤵
  PID:7360
- C:\Windows\System\nLpNdMO.exe
  C:\Windows\System\nLpNdMO.exe
  2⤵
  PID:7376
- C:\Windows\System\XFcISGf.exe
  C:\Windows\System\XFcISGf.exe
  2⤵
  PID:7392
- C:\Windows\System\pCwXHCi.exe
  C:\Windows\System\pCwXHCi.exe
  2⤵
  PID:7408
- C:\Windows\System\NpHINId.exe
  C:\Windows\System\NpHINId.exe
  2⤵
  PID:7424
- C:\Windows\System\dYfJEGz.exe
  C:\Windows\System\dYfJEGz.exe
  2⤵
  PID:7440
- C:\Windows\System\CHUUyAi.exe
  C:\Windows\System\CHUUyAi.exe
  2⤵
  PID:7456
- C:\Windows\System\IyynzRq.exe
  C:\Windows\System\IyynzRq.exe
  2⤵
  PID:7472
- C:\Windows\System\spZDUdP.exe
  C:\Windows\System\spZDUdP.exe
  2⤵
  PID:7488
- C:\Windows\System\vhixulb.exe
  C:\Windows\System\vhixulb.exe
  2⤵
  PID:7504
- C:\Windows\System\bwKGshX.exe
  C:\Windows\System\bwKGshX.exe
  2⤵
  PID:7520
- C:\Windows\System\dpYDkFE.exe
  C:\Windows\System\dpYDkFE.exe
  2⤵
  PID:7536
- C:\Windows\System\jIqMrqw.exe
  C:\Windows\System\jIqMrqw.exe
  2⤵
  PID:7552
- C:\Windows\System\XqseTUY.exe
  C:\Windows\System\XqseTUY.exe
  2⤵
  PID:7568
- C:\Windows\System\TZgpaQm.exe
  C:\Windows\System\TZgpaQm.exe
  2⤵
  PID:7584
- C:\Windows\System\aRfZywn.exe
  C:\Windows\System\aRfZywn.exe
  2⤵
  PID:7604
- C:\Windows\System\pUAjZZr.exe
  C:\Windows\System\pUAjZZr.exe
  2⤵
  PID:7620
- C:\Windows\System\vsaAjnt.exe
  C:\Windows\System\vsaAjnt.exe
  2⤵
  PID:7636
- C:\Windows\System\BfrdUST.exe
  C:\Windows\System\BfrdUST.exe
  2⤵
  PID:7652
- C:\Windows\System\vlELbez.exe
  C:\Windows\System\vlELbez.exe
  2⤵
  PID:7668
- C:\Windows\System\aaLpgQx.exe
  C:\Windows\System\aaLpgQx.exe
  2⤵
  PID:7684
- C:\Windows\System\WFBUlWl.exe
  C:\Windows\System\WFBUlWl.exe
  2⤵
  PID:7704
- C:\Windows\System\EKyNtjk.exe
  C:\Windows\System\EKyNtjk.exe
  2⤵
  PID:7720
- C:\Windows\System\sAMNawC.exe
  C:\Windows\System\sAMNawC.exe
  2⤵
  PID:7736
- C:\Windows\System\STPRuhl.exe
  C:\Windows\System\STPRuhl.exe
  2⤵
  PID:7752
- C:\Windows\System\jHJlYUx.exe
  C:\Windows\System\jHJlYUx.exe
  2⤵
  PID:7768
- C:\Windows\System\ijVbTNe.exe
  C:\Windows\System\ijVbTNe.exe
  2⤵
  PID:7784
- C:\Windows\System\HOLBcAe.exe
  C:\Windows\System\HOLBcAe.exe
  2⤵
  PID:7800
- C:\Windows\System\gRRoGaX.exe
  C:\Windows\System\gRRoGaX.exe
  2⤵
  PID:7816
- C:\Windows\System\fApHRDb.exe
  C:\Windows\System\fApHRDb.exe
  2⤵
  PID:7832
- C:\Windows\System\lEuqXqq.exe
  C:\Windows\System\lEuqXqq.exe
  2⤵
  PID:7860
- C:\Windows\System\LANUhMg.exe
  C:\Windows\System\LANUhMg.exe
  2⤵
  PID:7884
- C:\Windows\System\LfRwPGP.exe
  C:\Windows\System\LfRwPGP.exe
  2⤵
  PID:7912
- C:\Windows\System\xXKMXfl.exe
  C:\Windows\System\xXKMXfl.exe
  2⤵
  PID:7928
- C:\Windows\System\TsrhRjN.exe
  C:\Windows\System\TsrhRjN.exe
  2⤵
  PID:7944
- C:\Windows\System\vNxooBF.exe
  C:\Windows\System\vNxooBF.exe
  2⤵
  PID:7960
- C:\Windows\System\soSDuYq.exe
  C:\Windows\System\soSDuYq.exe
  2⤵
  PID:7988
- C:\Windows\System\fIgnDOy.exe
  C:\Windows\System\fIgnDOy.exe
  2⤵
  PID:8004
- C:\Windows\System\iGCvrva.exe
  C:\Windows\System\iGCvrva.exe
  2⤵
  PID:8020
- C:\Windows\System\ARsJAzu.exe
  C:\Windows\System\ARsJAzu.exe
  2⤵
  PID:8036
- C:\Windows\System\svikOzO.exe
  C:\Windows\System\svikOzO.exe
  2⤵
  PID:8056
- C:\Windows\System\zbHnNCK.exe
  C:\Windows\System\zbHnNCK.exe
  2⤵
  PID:8072
- C:\Windows\System\QhFHybP.exe
  C:\Windows\System\QhFHybP.exe
  2⤵
  PID:8088
- C:\Windows\System\DdIcace.exe
  C:\Windows\System\DdIcace.exe
  2⤵
  PID:8104
- C:\Windows\System\pMArzJo.exe
  C:\Windows\System\pMArzJo.exe
  2⤵
  PID:8120
- C:\Windows\System\glRfGUh.exe
  C:\Windows\System\glRfGUh.exe
  2⤵
  PID:8136
- C:\Windows\System\DiPzyMQ.exe
  C:\Windows\System\DiPzyMQ.exe
  2⤵
  PID:8152
- C:\Windows\System\XdAAeql.exe
  C:\Windows\System\XdAAeql.exe
  2⤵
  PID:8168
- C:\Windows\System\sXOxomi.exe
  C:\Windows\System\sXOxomi.exe
  2⤵
  PID:8188
- C:\Windows\System\QvVnGbN.exe
  C:\Windows\System\QvVnGbN.exe
  2⤵
  PID:6484
- C:\Windows\System\evHZLNH.exe
  C:\Windows\System\evHZLNH.exe
  2⤵
  PID:6980
- C:\Windows\System\IiPIBTd.exe
  C:\Windows\System\IiPIBTd.exe
  2⤵
  PID:7232
- C:\Windows\System\YZAVHBg.exe
  C:\Windows\System\YZAVHBg.exe
  2⤵
  PID:7248
- C:\Windows\System\rqxFxYg.exe
  C:\Windows\System\rqxFxYg.exe
  2⤵
  PID:7300
- C:\Windows\System\CdxgETR.exe
  C:\Windows\System\CdxgETR.exe
  2⤵
  PID:7320
- C:\Windows\System\eDXbise.exe
  C:\Windows\System\eDXbise.exe
  2⤵
  PID:7316
- C:\Windows\System\bVCxcWC.exe
  C:\Windows\System\bVCxcWC.exe
  2⤵
  PID:7372
- C:\Windows\System\qvcqhoa.exe
  C:\Windows\System\qvcqhoa.exe
  2⤵
  PID:7416
- C:\Windows\System\JfiJUIx.exe
  C:\Windows\System\JfiJUIx.exe
  2⤵
  PID:7420
- C:\Windows\System\KdxECou.exe
  C:\Windows\System\KdxECou.exe
  2⤵
  PID:7480
- C:\Windows\System\VHSdLhl.exe
  C:\Windows\System\VHSdLhl.exe
  2⤵
  PID:7496
- C:\Windows\System\lYALEVr.exe
  C:\Windows\System\lYALEVr.exe
  2⤵
  PID:7528
- C:\Windows\System\hKFkPTQ.exe
  C:\Windows\System\hKFkPTQ.exe
  2⤵
  PID:7544
- C:\Windows\System\abEXavM.exe
  C:\Windows\System\abEXavM.exe
  2⤵
  PID:7596
- C:\Windows\System\xuyAvDw.exe
  C:\Windows\System\xuyAvDw.exe
  2⤵
  PID:7692
- C:\Windows\System\qPoohtA.exe
  C:\Windows\System\qPoohtA.exe
  2⤵
  PID:7728
- C:\Windows\System\qqSZttQ.exe
  C:\Windows\System\qqSZttQ.exe
  2⤵
  PID:7616
- C:\Windows\System\NLdAaJC.exe
  C:\Windows\System\NLdAaJC.exe
  2⤵
  PID:7780
- C:\Windows\System\RSVWSej.exe
  C:\Windows\System\RSVWSej.exe
  2⤵
  PID:7644
- C:\Windows\System\EaAARnN.exe
  C:\Windows\System\EaAARnN.exe
  2⤵
  PID:7744
- C:\Windows\System\dekCApW.exe
  C:\Windows\System\dekCApW.exe
  2⤵
  PID:7676
- C:\Windows\System\SjGxnbF.exe
  C:\Windows\System\SjGxnbF.exe
  2⤵
  PID:7856
- C:\Windows\System\RiquqJw.exe
  C:\Windows\System\RiquqJw.exe
  2⤵
  PID:7900
- C:\Windows\System\jjeHgCG.exe
  C:\Windows\System\jjeHgCG.exe
  2⤵
  PID:7968
- C:\Windows\System\ZluzMIu.exe
  C:\Windows\System\ZluzMIu.exe
  2⤵
  PID:7996
- C:\Windows\System\bmwnqfY.exe
  C:\Windows\System\bmwnqfY.exe
  2⤵
  PID:7980
- C:\Windows\System\JTSBkyk.exe
  C:\Windows\System\JTSBkyk.exe
  2⤵
  PID:8068
- C:\Windows\System\oiWLldk.exe
  C:\Windows\System\oiWLldk.exe
  2⤵
  PID:8012
- C:\Windows\System\ytUnKjn.exe
  C:\Windows\System\ytUnKjn.exe
  2⤵
  PID:8128
- C:\Windows\System\kKLCyIx.exe
  C:\Windows\System\kKLCyIx.exe
  2⤵
  PID:8112
- C:\Windows\System\MKyHQwi.exe
  C:\Windows\System\MKyHQwi.exe
  2⤵
  PID:8164
- C:\Windows\System\WFmQGYQ.exe
  C:\Windows\System\WFmQGYQ.exe
  2⤵
  PID:7204
- C:\Windows\System\hsnFMfi.exe
  C:\Windows\System\hsnFMfi.exe
  2⤵
  PID:7268
- C:\Windows\System\ekBOZUT.exe
  C:\Windows\System\ekBOZUT.exe
  2⤵
  PID:7384
- C:\Windows\System\bScWDry.exe
  C:\Windows\System\bScWDry.exe
  2⤵
  PID:7264
- C:\Windows\System\jSaymJc.exe
  C:\Windows\System\jSaymJc.exe
  2⤵
  PID:7468
- C:\Windows\System\OafhsXy.exe
  C:\Windows\System\OafhsXy.exe
  2⤵
  PID:7184
- C:\Windows\System\IKquOXL.exe
  C:\Windows\System\IKquOXL.exe
  2⤵
  PID:7560
- C:\Windows\System\UqtkFzg.exe
  C:\Windows\System\UqtkFzg.exe
  2⤵
  PID:7548
- C:\Windows\System\HXvKMhr.exe
  C:\Windows\System\HXvKMhr.exe
  2⤵
  PID:7580
- C:\Windows\System\qofEFUs.exe
  C:\Windows\System\qofEFUs.exe
  2⤵
  PID:7776
- C:\Windows\System\qvVWgOM.exe
  C:\Windows\System\qvVWgOM.exe
  2⤵
  PID:7872
- C:\Windows\System\KuPvsLF.exe
  C:\Windows\System\KuPvsLF.exe
  2⤵
  PID:7840
- C:\Windows\System\xclYYud.exe
  C:\Windows\System\xclYYud.exe
  2⤵
  PID:7952
- C:\Windows\System\omECcOm.exe
  C:\Windows\System\omECcOm.exe
  2⤵
  PID:7876
- C:\Windows\System\kSuqyMk.exe
  C:\Windows\System\kSuqyMk.exe
  2⤵
  PID:7924
- C:\Windows\System\xvniehG.exe
  C:\Windows\System\xvniehG.exe
  2⤵
  PID:8144
- C:\Windows\System\qqqndOY.exe
  C:\Windows\System\qqqndOY.exe
  2⤵
  PID:8044
- C:\Windows\System\hCWPrcI.exe
  C:\Windows\System\hCWPrcI.exe
  2⤵
  PID:7172
- C:\Windows\System\zcebPZr.exe
  C:\Windows\System\zcebPZr.exe
  2⤵
  PID:7324
- C:\Windows\System\BdzlBGo.exe
  C:\Windows\System\BdzlBGo.exe
  2⤵
  PID:7664
- C:\Windows\System\GBziVkU.exe
  C:\Windows\System\GBziVkU.exe
  2⤵
  PID:7852
- C:\Windows\System\mRyqYdb.exe
  C:\Windows\System\mRyqYdb.exe
  2⤵
  PID:7452
- C:\Windows\System\KIryPxv.exe
  C:\Windows\System\KIryPxv.exe
  2⤵
  PID:7824
- C:\Windows\System\PRDMoyg.exe
  C:\Windows\System\PRDMoyg.exe
  2⤵
  PID:752
- C:\Windows\System\CYKAoSg.exe
  C:\Windows\System\CYKAoSg.exe
  2⤵
  PID:8080
- C:\Windows\System\ikMDPvi.exe
  C:\Windows\System\ikMDPvi.exe
  2⤵
  PID:8016
- C:\Windows\System\VhXIFzV.exe
  C:\Windows\System\VhXIFzV.exe
  2⤵
  PID:7432
- C:\Windows\System\mNbzosn.exe
  C:\Windows\System\mNbzosn.exe
  2⤵
  PID:7220
- C:\Windows\System\QmIKgDw.exe
  C:\Windows\System\QmIKgDw.exe
  2⤵
  PID:6572
- C:\Windows\System\UdKIyGw.exe
  C:\Windows\System\UdKIyGw.exe
  2⤵
  PID:7796
- C:\Windows\System\VVgqMXM.exe
  C:\Windows\System\VVgqMXM.exe
  2⤵
  PID:7628
- C:\Windows\System\oYCYdIc.exe
  C:\Windows\System\oYCYdIc.exe
  2⤵
  PID:7920
- C:\Windows\System\IAlHYdl.exe
  C:\Windows\System\IAlHYdl.exe
  2⤵
  PID:8100
- C:\Windows\System\kRsTioU.exe
  C:\Windows\System\kRsTioU.exe
  2⤵
  PID:7016
- C:\Windows\System\pXkQGAn.exe
  C:\Windows\System\pXkQGAn.exe
  2⤵
  PID:7200
- C:\Windows\System\rKlKdZG.exe
  C:\Windows\System\rKlKdZG.exe
  2⤵
  PID:7956
- C:\Windows\System\gCoPXvP.exe
  C:\Windows\System\gCoPXvP.exe
  2⤵
  PID:8212
- C:\Windows\System\qdqcxAk.exe
  C:\Windows\System\qdqcxAk.exe
  2⤵
  PID:8228
- C:\Windows\System\pjbKqqd.exe
  C:\Windows\System\pjbKqqd.exe
  2⤵
  PID:8244
- C:\Windows\System\TyUpiSv.exe
  C:\Windows\System\TyUpiSv.exe
  2⤵
  PID:8264
- C:\Windows\System\qNNSFMj.exe
  C:\Windows\System\qNNSFMj.exe
  2⤵
  PID:8280
- C:\Windows\System\FzDKrrH.exe
  C:\Windows\System\FzDKrrH.exe
  2⤵
  PID:8296
- C:\Windows\System\ZFfkHKk.exe
  C:\Windows\System\ZFfkHKk.exe
  2⤵
  PID:8312
- C:\Windows\System\HmWTCBz.exe
  C:\Windows\System\HmWTCBz.exe
  2⤵
  PID:8328
- C:\Windows\System\dwdxCyX.exe
  C:\Windows\System\dwdxCyX.exe
  2⤵
  PID:8344
- C:\Windows\System\gCCnUaD.exe
  C:\Windows\System\gCCnUaD.exe
  2⤵
  PID:8360
- C:\Windows\System\QpMWlIU.exe
  C:\Windows\System\QpMWlIU.exe
  2⤵
  PID:8376
- C:\Windows\System\gVvinzD.exe
  C:\Windows\System\gVvinzD.exe
  2⤵
  PID:8392
- C:\Windows\System\kWXvRlA.exe
  C:\Windows\System\kWXvRlA.exe
  2⤵
  PID:8408
- C:\Windows\System\iViVWgF.exe
  C:\Windows\System\iViVWgF.exe
  2⤵
  PID:8424
- C:\Windows\System\zjEsADZ.exe
  C:\Windows\System\zjEsADZ.exe
  2⤵
  PID:8440
- C:\Windows\System\TsyZTNy.exe
  C:\Windows\System\TsyZTNy.exe
  2⤵
  PID:8456
- C:\Windows\System\iCSWFdq.exe
  C:\Windows\System\iCSWFdq.exe
  2⤵
  PID:8472
- C:\Windows\System\aJICPXZ.exe
  C:\Windows\System\aJICPXZ.exe
  2⤵
  PID:8488
- C:\Windows\System\IPTliAl.exe
  C:\Windows\System\IPTliAl.exe
  2⤵
  PID:8504
- C:\Windows\System\SUAznNE.exe
  C:\Windows\System\SUAznNE.exe
  2⤵
  PID:8524
- C:\Windows\System\pNWTHJf.exe
  C:\Windows\System\pNWTHJf.exe
  2⤵
  PID:8548
- C:\Windows\System\wTfmnEx.exe
  C:\Windows\System\wTfmnEx.exe
  2⤵
  PID:8564
- C:\Windows\System\hNiWzCi.exe
  C:\Windows\System\hNiWzCi.exe
  2⤵
  PID:8584
- C:\Windows\System\pGaoSAy.exe
  C:\Windows\System\pGaoSAy.exe
  2⤵
  PID:8608
- C:\Windows\System\iheovKU.exe
  C:\Windows\System\iheovKU.exe
  2⤵
  PID:8624
- C:\Windows\System\zVoCPQi.exe
  C:\Windows\System\zVoCPQi.exe
  2⤵
  PID:8640
- C:\Windows\System\bzjYLbR.exe
  C:\Windows\System\bzjYLbR.exe
  2⤵
  PID:8656
- C:\Windows\System\gloaCWb.exe
  C:\Windows\System\gloaCWb.exe
  2⤵
  PID:8676
- C:\Windows\System\nqqEPXR.exe
  C:\Windows\System\nqqEPXR.exe
  2⤵
  PID:8692
- C:\Windows\System\NPcVuoF.exe
  C:\Windows\System\NPcVuoF.exe
  2⤵
  PID:8708
- C:\Windows\System\eCrbOGG.exe
  C:\Windows\System\eCrbOGG.exe
  2⤵
  PID:8724
- C:\Windows\System\jfkQrcA.exe
  C:\Windows\System\jfkQrcA.exe
  2⤵
  PID:8740
- C:\Windows\System\ZtQftPb.exe
  C:\Windows\System\ZtQftPb.exe
  2⤵
  PID:8756
- C:\Windows\System\rDUCDFB.exe
  C:\Windows\System\rDUCDFB.exe
  2⤵
  PID:8772
- C:\Windows\System\SxFgrAK.exe
  C:\Windows\System\SxFgrAK.exe
  2⤵
  PID:8788
- C:\Windows\System\FkgBLaX.exe
  C:\Windows\System\FkgBLaX.exe
  2⤵
  PID:8804
- C:\Windows\System\eHhdgRG.exe
  C:\Windows\System\eHhdgRG.exe
  2⤵
  PID:8828
- C:\Windows\System\abypRmS.exe
  C:\Windows\System\abypRmS.exe
  2⤵
  PID:8852
- C:\Windows\System\xzxKaDO.exe
  C:\Windows\System\xzxKaDO.exe
  2⤵
  PID:8880
- C:\Windows\System\DXCEzWa.exe
  C:\Windows\System\DXCEzWa.exe
  2⤵
  PID:8904
- C:\Windows\System\zdmYuBv.exe
  C:\Windows\System\zdmYuBv.exe
  2⤵
  PID:8920
- C:\Windows\System\xlqbiHv.exe
  C:\Windows\System\xlqbiHv.exe
  2⤵
  PID:8940
- C:\Windows\System\TMPCfmN.exe
  C:\Windows\System\TMPCfmN.exe
  2⤵
  PID:8956
- C:\Windows\System\EBiAPZk.exe
  C:\Windows\System\EBiAPZk.exe
  2⤵
  PID:8972
- C:\Windows\System\xOYHAPU.exe
  C:\Windows\System\xOYHAPU.exe
  2⤵
  PID:8988
- C:\Windows\System\TuPpMdD.exe
  C:\Windows\System\TuPpMdD.exe
  2⤵
  PID:9004
- C:\Windows\System\eFqlVek.exe
  C:\Windows\System\eFqlVek.exe
  2⤵
  PID:9032
- C:\Windows\System\wKtMRbM.exe
  C:\Windows\System\wKtMRbM.exe
  2⤵
  PID:9048
- C:\Windows\System\RgcQmqJ.exe
  C:\Windows\System\RgcQmqJ.exe
  2⤵
  PID:9064
- C:\Windows\System\thOGVwS.exe
  C:\Windows\System\thOGVwS.exe
  2⤵
  PID:9080
- C:\Windows\System\bCZcoFO.exe
  C:\Windows\System\bCZcoFO.exe
  2⤵
  PID:9096
- C:\Windows\System\nQSPgwr.exe
  C:\Windows\System\nQSPgwr.exe
  2⤵
  PID:9112
- C:\Windows\System\PAsfbwA.exe
  C:\Windows\System\PAsfbwA.exe
  2⤵
  PID:8536
- C:\Windows\System\GuwuTDd.exe
  C:\Windows\System\GuwuTDd.exe
  2⤵
  PID:8484
- C:\Windows\System\LPonbdM.exe
  C:\Windows\System\LPonbdM.exe
  2⤵
  PID:8652
- C:\Windows\System\iCRcOWg.exe
  C:\Windows\System\iCRcOWg.exe
  2⤵
  PID:8688
- C:\Windows\System\olNUBSp.exe
  C:\Windows\System\olNUBSp.exe
  2⤵
  PID:8632
- C:\Windows\System\hbApzii.exe
  C:\Windows\System\hbApzii.exe
  2⤵
  PID:8820
- C:\Windows\System\yTPgvzk.exe
  C:\Windows\System\yTPgvzk.exe
  2⤵
  PID:8860
- C:\Windows\System\QCwiIbV.exe
  C:\Windows\System\QCwiIbV.exe
  2⤵
  PID:8876
- C:\Windows\System\HNVkvhr.exe
  C:\Windows\System\HNVkvhr.exe
  2⤵
  PID:8980
- C:\Windows\System\LtGAgLF.exe
  C:\Windows\System\LtGAgLF.exe
  2⤵
  PID:8836
- C:\Windows\System\DJLMzkt.exe
  C:\Windows\System\DJLMzkt.exe
  2⤵
  PID:9024
- C:\Windows\System\YWlhePh.exe
  C:\Windows\System\YWlhePh.exe
  2⤵
  PID:8896
- C:\Windows\System\OLyjMCF.exe
  C:\Windows\System\OLyjMCF.exe
  2⤵
  PID:8996
- C:\Windows\System\tyXKKHN.exe
  C:\Windows\System\tyXKKHN.exe
  2⤵
  PID:9092
- C:\Windows\System\KIfWImj.exe
  C:\Windows\System\KIfWImj.exe
  2⤵
  PID:9108
- C:\Windows\System\LdlYTSv.exe
  C:\Windows\System\LdlYTSv.exe
  2⤵
  PID:9124
- C:\Windows\System\IAxeuHZ.exe
  C:\Windows\System\IAxeuHZ.exe
  2⤵
  PID:9172
- C:\Windows\System\lhdSlSY.exe
  C:\Windows\System\lhdSlSY.exe
  2⤵
  PID:9184
- C:\Windows\System\womsGfm.exe
  C:\Windows\System\womsGfm.exe
  2⤵
  PID:9204
- C:\Windows\System\ztiTlzC.exe
  C:\Windows\System\ztiTlzC.exe
  2⤵
  PID:8048
- C:\Windows\System\ujjPnzX.exe
  C:\Windows\System\ujjPnzX.exe
  2⤵
  PID:8240
- C:\Windows\System\FXSCTGf.exe
  C:\Windows\System\FXSCTGf.exe
  2⤵
  PID:8084
- C:\Windows\System\dbhqwXi.exe
  C:\Windows\System\dbhqwXi.exe
  2⤵
  PID:8272
- C:\Windows\System\LuNjaeq.exe
  C:\Windows\System\LuNjaeq.exe
  2⤵
  PID:8384
- C:\Windows\System\cumEejx.exe
  C:\Windows\System\cumEejx.exe
  2⤵
  PID:8372
- C:\Windows\System\vigEuPa.exe
  C:\Windows\System\vigEuPa.exe
  2⤵
  PID:8388
- C:\Windows\System\hJgItJQ.exe
  C:\Windows\System\hJgItJQ.exe
  2⤵
  PID:8468
- C:\Windows\System\QJbllfu.exe
  C:\Windows\System\QJbllfu.exe
  2⤵
  PID:8532
- C:\Windows\System\GkiYDyw.exe
  C:\Windows\System\GkiYDyw.exe
  2⤵
  PID:1808
- C:\Windows\System\ScQDnch.exe
  C:\Windows\System\ScQDnch.exe
  2⤵
  PID:8572
- C:\Windows\System\DkbqLHr.exe
  C:\Windows\System\DkbqLHr.exe
  2⤵
  PID:8596
- C:\Windows\System\lBbsPec.exe
  C:\Windows\System\lBbsPec.exe
  2⤵
  PID:8664
- C:\Windows\System\RzOcjTq.exe
  C:\Windows\System\RzOcjTq.exe
  2⤵
  PID:8732
- C:\Windows\System\fwytkEv.exe
  C:\Windows\System\fwytkEv.exe
  2⤵
  PID:8780
- C:\Windows\System\rOhpeBN.exe
  C:\Windows\System\rOhpeBN.exe
  2⤵
  PID:8816
- C:\Windows\System\UdWwQJa.exe
  C:\Windows\System\UdWwQJa.exe
  2⤵
  PID:8952
- C:\Windows\System\BpMzSrM.exe
  C:\Windows\System\BpMzSrM.exe
  2⤵
  PID:9020
- C:\Windows\System\iewiMXS.exe
  C:\Windows\System\iewiMXS.exe
  2⤵
  PID:8888
- C:\Windows\System\SEGvgXq.exe
  C:\Windows\System\SEGvgXq.exe
  2⤵
  PID:8932
- C:\Windows\System\pnJDCRx.exe
  C:\Windows\System\pnJDCRx.exe
  2⤵
  PID:9076
- C:\Windows\System\XbSmMoI.exe
  C:\Windows\System\XbSmMoI.exe
  2⤵
  PID:9136
- C:\Windows\System\anHEPlc.exe
  C:\Windows\System\anHEPlc.exe
  2⤵
  PID:8800
- C:\Windows\System\KpjcpFe.exe
  C:\Windows\System\KpjcpFe.exe
  2⤵
  PID:9192
- C:\Windows\System\lrALbvs.exe
  C:\Windows\System\lrALbvs.exe
  2⤵
  PID:8208
- C:\Windows\System\EpcDXKN.exe
  C:\Windows\System\EpcDXKN.exe
  2⤵
  PID:7880
- C:\Windows\System\njEAbpL.exe
  C:\Windows\System\njEAbpL.exe
  2⤵
  PID:8404
- C:\Windows\System\egnDRoi.exe
  C:\Windows\System\egnDRoi.exe
  2⤵
  PID:1796
- C:\Windows\System\wpFNPMB.exe
  C:\Windows\System\wpFNPMB.exe
  2⤵
  PID:9164
- C:\Windows\System\LfrsdbP.exe
  C:\Windows\System\LfrsdbP.exe
  2⤵
  PID:9196
- C:\Windows\System\jhcQoVf.exe
  C:\Windows\System\jhcQoVf.exe
  2⤵
  PID:8700
- C:\Windows\System\YMbZrNH.exe
  C:\Windows\System\YMbZrNH.exe
  2⤵
  PID:9016
- C:\Windows\System\iAPCLnI.exe
  C:\Windows\System\iAPCLnI.exe
  2⤵
  PID:9132
- C:\Windows\System\yFmHCYt.exe
  C:\Windows\System\yFmHCYt.exe
  2⤵
  PID:8916
- C:\Windows\System\iHEVpHy.exe
  C:\Windows\System\iHEVpHy.exe
  2⤵
  PID:1524
- C:\Windows\System\xqPKkaY.exe
  C:\Windows\System\xqPKkaY.exe
  2⤵
  PID:9212
- C:\Windows\System\UFDAPYX.exe
  C:\Windows\System\UFDAPYX.exe
  2⤵
  PID:9088
- C:\Windows\System\eKvYjpC.exe
  C:\Windows\System\eKvYjpC.exe
  2⤵
  PID:8668
- C:\Windows\System\iRhisuJ.exe
  C:\Windows\System\iRhisuJ.exe
  2⤵
  PID:8356
- C:\Windows\System\XkHRFGh.exe
  C:\Windows\System\XkHRFGh.exe
  2⤵
  PID:8452
- C:\Windows\System\eoiRlyZ.exe
  C:\Windows\System\eoiRlyZ.exe
  2⤵
  PID:8512
- C:\Windows\System\ZmHNWrS.exe
  C:\Windows\System\ZmHNWrS.exe
  2⤵
  PID:9148
- C:\Windows\System\yAZrHOn.exe
  C:\Windows\System\yAZrHOn.exe
  2⤵
  PID:9044
- C:\Windows\System\KdvfRff.exe
  C:\Windows\System\KdvfRff.exe
  2⤵
  PID:8928
- C:\Windows\System\ciTRbrN.exe
  C:\Windows\System\ciTRbrN.exe
  2⤵
  PID:7896
- C:\Windows\System\zYmSThp.exe
  C:\Windows\System\zYmSThp.exe
  2⤵
  PID:1512
- C:\Windows\System\ZGNISyz.exe
  C:\Windows\System\ZGNISyz.exe
  2⤵
  PID:8968
- C:\Windows\System\abChsga.exe
  C:\Windows\System\abChsga.exe
  2⤵
  PID:8544
- C:\Windows\System\kHraVen.exe
  C:\Windows\System\kHraVen.exe
  2⤵
  PID:8768
- C:\Windows\System\ZjgJEpf.exe
  C:\Windows\System\ZjgJEpf.exe
  2⤵
  PID:9188
- C:\Windows\System\kmpQpcx.exe
  C:\Windows\System\kmpQpcx.exe
  2⤵
  PID:8600
- C:\Windows\System\uMegvUO.exe
  C:\Windows\System\uMegvUO.exe
  2⤵
  PID:8352
- C:\Windows\System\xrLwxKq.exe
  C:\Windows\System\xrLwxKq.exe
  2⤵
  PID:9156
- C:\Windows\System\IyIHqDb.exe
  C:\Windows\System\IyIHqDb.exe
  2⤵
  PID:8604
- C:\Windows\System\mrOVoyl.exe
  C:\Windows\System\mrOVoyl.exe
  2⤵
  PID:8636
- C:\Windows\System\yOUGNZi.exe
  C:\Windows\System\yOUGNZi.exe
  2⤵
  PID:8784
- C:\Windows\System\bHxgBfq.exe
  C:\Windows\System\bHxgBfq.exe
  2⤵
  PID:8288
- C:\Windows\System\xLJnPJn.exe
  C:\Windows\System\xLJnPJn.exe
  2⤵
  PID:8620
- C:\Windows\System\iCPENIb.exe
  C:\Windows\System\iCPENIb.exe
  2⤵
  PID:9236
- C:\Windows\System\adzwGVe.exe
  C:\Windows\System\adzwGVe.exe
  2⤵
  PID:9256
- C:\Windows\System\kvLanHL.exe
  C:\Windows\System\kvLanHL.exe
  2⤵
  PID:9280
- C:\Windows\System\sWYUHst.exe
  C:\Windows\System\sWYUHst.exe
  2⤵
  PID:9296
- C:\Windows\System\eahFFEB.exe
  C:\Windows\System\eahFFEB.exe
  2⤵
  PID:9316
- C:\Windows\System\kUqOZlH.exe
  C:\Windows\System\kUqOZlH.exe
  2⤵
  PID:9340
- C:\Windows\System\OdqTQvL.exe
  C:\Windows\System\OdqTQvL.exe
  2⤵
  PID:9356
- C:\Windows\System\foDkHIe.exe
  C:\Windows\System\foDkHIe.exe
  2⤵
  PID:9376
- C:\Windows\System\snxbaBE.exe
  C:\Windows\System\snxbaBE.exe
  2⤵
  PID:9396
- C:\Windows\System\caheAvW.exe
  C:\Windows\System\caheAvW.exe
  2⤵
  PID:9412
- C:\Windows\System\PaljzKo.exe
  C:\Windows\System\PaljzKo.exe
  2⤵
  PID:9428
- C:\Windows\System\PSEJkPE.exe
  C:\Windows\System\PSEJkPE.exe
  2⤵
  PID:9444
- C:\Windows\System\gSrmpya.exe
  C:\Windows\System\gSrmpya.exe
  2⤵
  PID:9460
- C:\Windows\System\wyzeIQv.exe
  C:\Windows\System\wyzeIQv.exe
  2⤵
  PID:9476
- C:\Windows\System\jvsqgPh.exe
  C:\Windows\System\jvsqgPh.exe
  2⤵
  PID:9528
- C:\Windows\System\yFTAgQF.exe
  C:\Windows\System\yFTAgQF.exe
  2⤵
  PID:9544
- C:\Windows\System\ZIbwLyG.exe
  C:\Windows\System\ZIbwLyG.exe
  2⤵
  PID:9560
- C:\Windows\System\KNWzYcv.exe
  C:\Windows\System\KNWzYcv.exe
  2⤵
  PID:9576
- C:\Windows\System\MEgUdKA.exe
  C:\Windows\System\MEgUdKA.exe
  2⤵
  PID:9596
- C:\Windows\System\VKWeHCS.exe
  C:\Windows\System\VKWeHCS.exe
  2⤵
  PID:9616
- C:\Windows\System\QbCbonZ.exe
  C:\Windows\System\QbCbonZ.exe
  2⤵
  PID:9632
- C:\Windows\System\alyekkj.exe
  C:\Windows\System\alyekkj.exe
  2⤵
  PID:9656
- C:\Windows\System\NgucfYP.exe
  C:\Windows\System\NgucfYP.exe
  2⤵
  PID:9672
- C:\Windows\System\RLnaZcr.exe
  C:\Windows\System\RLnaZcr.exe
  2⤵
  PID:9688
- C:\Windows\System\kbAvyMw.exe
  C:\Windows\System\kbAvyMw.exe
  2⤵
  PID:9704
- C:\Windows\System\DVxzaah.exe
  C:\Windows\System\DVxzaah.exe
  2⤵
  PID:9728
- C:\Windows\System\qnfYtES.exe
  C:\Windows\System\qnfYtES.exe
  2⤵
  PID:9744
- C:\Windows\System\JAhxKPE.exe
  C:\Windows\System\JAhxKPE.exe
  2⤵
  PID:9776
- C:\Windows\System\zSjiuuC.exe
  C:\Windows\System\zSjiuuC.exe
  2⤵
  PID:9792
- C:\Windows\System\frYdHTo.exe
  C:\Windows\System\frYdHTo.exe
  2⤵
  PID:9812
- C:\Windows\System\SQAcEAy.exe
  C:\Windows\System\SQAcEAy.exe
  2⤵
  PID:9844
- C:\Windows\System\vQirIxb.exe
  C:\Windows\System\vQirIxb.exe
  2⤵
  PID:9860
- C:\Windows\System\xHgDzPN.exe
  C:\Windows\System\xHgDzPN.exe
  2⤵
  PID:9876
- C:\Windows\System\FzQHbxQ.exe
  C:\Windows\System\FzQHbxQ.exe
  2⤵
  PID:9892
- C:\Windows\System\zjYViDT.exe
  C:\Windows\System\zjYViDT.exe
  2⤵
  PID:9928
- C:\Windows\System\LsQAPLS.exe
  C:\Windows\System\LsQAPLS.exe
  2⤵
  PID:9952
- C:\Windows\System\YUbPZcM.exe
  C:\Windows\System\YUbPZcM.exe
  2⤵
  PID:9972
- C:\Windows\System\ZEDYbrc.exe
  C:\Windows\System\ZEDYbrc.exe
  2⤵
  PID:9988
- C:\Windows\System\oyllrLs.exe
  C:\Windows\System\oyllrLs.exe
  2⤵
  PID:10008
- C:\Windows\System\iHOGuvi.exe
  C:\Windows\System\iHOGuvi.exe
  2⤵
  PID:10028
- C:\Windows\System\BGtJshK.exe
  C:\Windows\System\BGtJshK.exe
  2⤵
  PID:10048
- C:\Windows\System\SZqXicI.exe
  C:\Windows\System\SZqXicI.exe
  2⤵
  PID:10068
- C:\Windows\System\cYaQWAR.exe
  C:\Windows\System\cYaQWAR.exe
  2⤵
  PID:10088
- C:\Windows\System\uLtjbuC.exe
  C:\Windows\System\uLtjbuC.exe
  2⤵
  PID:10108
- C:\Windows\System\OdFNWjf.exe
  C:\Windows\System\OdFNWjf.exe
  2⤵
  PID:10124
- C:\Windows\System\Mlehbza.exe
  C:\Windows\System\Mlehbza.exe
  2⤵
  PID:10152
- C:\Windows\System\nmLaCyM.exe
  C:\Windows\System\nmLaCyM.exe
  2⤵
  PID:10168
- C:\Windows\System\JpThsBr.exe
  C:\Windows\System\JpThsBr.exe
  2⤵
  PID:10188
- C:\Windows\System\mvkWetB.exe
  C:\Windows\System\mvkWetB.exe
  2⤵
  PID:10208
- C:\Windows\System\cwcHajd.exe
  C:\Windows\System\cwcHajd.exe
  2⤵
  PID:10232
- C:\Windows\System\ZGxLVNW.exe
  C:\Windows\System\ZGxLVNW.exe
  2⤵
  PID:9232
- C:\Windows\System\iErHoTc.exe
  C:\Windows\System\iErHoTc.exe
  2⤵
  PID:9252
- C:\Windows\System\SoFSnyd.exe
  C:\Windows\System\SoFSnyd.exe
  2⤵
  PID:9292
- C:\Windows\System\VhSiPvc.exe
  C:\Windows\System\VhSiPvc.exe
  2⤵
  PID:9328
- C:\Windows\System\YBgGUXX.exe
  C:\Windows\System\YBgGUXX.exe
  2⤵
  PID:9352
- C:\Windows\System\fWklGYg.exe
  C:\Windows\System\fWklGYg.exe
  2⤵
  PID:9384
- C:\Windows\System\pIbnwAC.exe
  C:\Windows\System\pIbnwAC.exe
  2⤵
  PID:9456
- C:\Windows\System\kdJtDEy.exe
  C:\Windows\System\kdJtDEy.exe
  2⤵
  PID:9408
- C:\Windows\System\jOMklsP.exe
  C:\Windows\System\jOMklsP.exe
  2⤵
  PID:9604
- C:\Windows\System\AvfiWEw.exe
  C:\Windows\System\AvfiWEw.exe
  2⤵
  PID:9612
- C:\Windows\System\ePHwjdh.exe
  C:\Windows\System\ePHwjdh.exe
  2⤵
  PID:9508
- C:\Windows\System\hdiYGRa.exe
  C:\Windows\System\hdiYGRa.exe
  2⤵
  PID:9524
- C:\Windows\System\yPlVwth.exe
  C:\Windows\System\yPlVwth.exe
  2⤵
  PID:9584
- C:\Windows\System\BJlKJXx.exe
  C:\Windows\System\BJlKJXx.exe
  2⤵
  PID:9624
- C:\Windows\System\drXEbHD.exe
  C:\Windows\System\drXEbHD.exe
  2⤵
  PID:9764
- C:\Windows\System\AKWHFpH.exe
  C:\Windows\System\AKWHFpH.exe
  2⤵
  PID:9588
- C:\Windows\System\FiqTBnr.exe
  C:\Windows\System\FiqTBnr.exe
  2⤵
  PID:9740
- C:\Windows\System\EcMfJHX.exe
  C:\Windows\System\EcMfJHX.exe
  2⤵
  PID:9696
- C:\Windows\System\MEHjkLy.exe
  C:\Windows\System\MEHjkLy.exe
  2⤵
  PID:9868
- C:\Windows\System\ZPwgqzA.exe
  C:\Windows\System\ZPwgqzA.exe
  2⤵
  PID:9828
- C:\Windows\System\TEBxFyt.exe
  C:\Windows\System\TEBxFyt.exe
  2⤵
  PID:9856
- C:\Windows\System\BroMKBx.exe
  C:\Windows\System\BroMKBx.exe
  2⤵
  PID:9924
- C:\Windows\System\XUgtZCz.exe
  C:\Windows\System\XUgtZCz.exe
  2⤵
  PID:9944
- C:\Windows\System\aAQEkXX.exe
  C:\Windows\System\aAQEkXX.exe
  2⤵
  PID:9964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\EHJcZWv.exe

Filesize
2.3MB

MD5
74a67acca565945436ca08cedce56ac4

SHA1
d3ca5a663961c08c20baeefb2be7ded36b5c9f76

SHA256
7cbd72a43e6bc1bda86e37ab447bac9f6af45d20a6104b5d8a3804bdcc0e2fef

SHA512
d8264ebb84de24d6612f685462be397df2103eb3950b39f2460940d181c2bd93c50e41747a4471c1c7eee08cd4c6ff722d8afa8508806e79f24239ba40357e69

Download Submit
C:\Windows\system\FnQIDZD.exe

Filesize
2.3MB

MD5
65109fa3adc47dda4bb77dd58e6aea2a

SHA1
97598fd7b09c0a7235b0c3d3a615a5aa32a3ed73

SHA256
f732fb04098f7fcac960f46b08524c5e40521a1de0352233c71cb8d01b5a2cdb

SHA512
5a8eae0331c6cbdeeee95f911b0b090ebcc4b32e21c6b457ede1f4bb666df2f5cc6ff34fbe6c18b838fd1725602eb92f9b7447ae9829e3962630d4871f165dc2

Download Submit
C:\Windows\system\FsblTfv.exe

Filesize
2.3MB

MD5
6c2a6808c558dac9356470459b57cfbf

SHA1
b4f6de37c73bf8eac41ec0e6ff944e41274fe3d4

SHA256
6af76b222533ddfe212de8f4467d8b9939a28bf0db1626f92be3ef1446fcd7c5

SHA512
9ab8d286c5e079a13a5dffbe1eb954bc33913b8fa3bce33efbfa1c08cb010e6ceb5b6e46077c1f586cc9ac1bf3af3e65d48337e2e0edc9f28cb8941c047e5a5f

Download Submit
C:\Windows\system\GkcTOXv.exe

Filesize
2.3MB

MD5
a86e32474f116de8cf9093db94c5cc57

SHA1
7982d262848a914da5ee9cdc714444c499ae062d

SHA256
ed0889caf286b0d791180818a8395035a3c14711ab496785b10cb8d7da95d858

SHA512
d21d8dd834416189e8c073a10be6493fa5b1879b14b8f92da51e871500ff7d6f9288991553466e1c16930fb6ec49ef1320f30235ed43e3a449b157f54c0629c5

Download Submit
C:\Windows\system\KwTIJRx.exe

Filesize
2.3MB

MD5
b5fe39ec052055ab0aeb4284a09953c2

SHA1
a43b4fafe2e0f1eeb70bda55ef4fe75bc904ec45

SHA256
ee1432c6a4ab033f428c266747042aa93254b3cbd842fc829bc4616ac67a4a0c

SHA512
298ea2d6e2503c7917744c4ac72223dd1c1e6eac6c90fd0476c9d48a6b39bef1d7dcd4b2a1f023be829bab32eb144138032f8cde8f9c85e178e8410e0f3388bb

Download Submit
C:\Windows\system\ONDJaZG.exe

Filesize
2.3MB

MD5
a6c647f3bd9abee24af68861c382f72b

SHA1
0aec81b00049a999a6e022239a481c15cede94ff

SHA256
64dabcd2f74c5a41b0b77d616063ace6609dcde8a06bac6623c010f28c4d5f7a

SHA512
be3434f6097319749bcf34edbdfd5a0ccf2d76444d4d99b317ea4aaaf099723d50f93f994306028309098c558957625ac2e0a0d0060ca50640d15cb8c302034e

Download Submit
C:\Windows\system\OVewqeW.exe

Filesize
2.3MB

MD5
7a737ceed5aacd6092611a475a161a48

SHA1
6a90069ed44ef19ea0471830bcfecb2e1bfcbfa2

SHA256
9fd89cd315154e4860891424cca842be50ad4450417f87ab5d6cd0bc6f1ea853

SHA512
39f973e647d008e2f3662028dd21749e4ab002d996a180c4e39fb5afa48b5ac92ee55936eac7f90c4a9b205d916b56d723dfe362049acbfcb44589e19400f8b4

Download Submit
C:\Windows\system\QIODyTD.exe

Filesize
2.3MB

MD5
9152935fd3e7773b5e7fc8db13747f5d

SHA1
c619d42677a39a6ac127709be10f64a3ea9f0b29

SHA256
d51ec3e41ee31d68d29581faeb6a8d54d58a2c1a3db920145f3fefb8bc4e6dca

SHA512
d73feab103478e0cd8efec90f6775a819afa014f1ba4c5fe6391af0cdb721a2fd9deebb3754e7c42178a4d7f8c27fe0a2b6812c18e4b5c5b3b0d71fe8cc9c399

Download Submit
C:\Windows\system\ScEEwkd.exe

Filesize
2.3MB

MD5
ed8fed01a4e67ee5c72c2ce64b304532

SHA1
242502fa59bc6242dc003ba3370c3a7c63b5157e

SHA256
352e234fc9c682fa4295ca35b065083a01aae53bf70cefc6891a76084b40b830

SHA512
ccaefd35b72c7f2bff6c5bfd68a243cce5ad87ef920da6f867a14580de773378525a99d40ce92a306cf5b79582059cf9104dafa3ae289c2d54c70fd88bdad843

Download Submit
C:\Windows\system\UWXEEOa.exe

Filesize
2.3MB

MD5
086db6baeb58c6db0dde5efc087b099c

SHA1
f00d51534dfd6dc20bd2bae630a4acc91a569f09

SHA256
3a7c3b260dd4fb5e75808a93059351007933e804d27805585d9bbf366319c92b

SHA512
2ab1096e11f4aa5cda5e2c79c70a097afd0be6132385a636618bb558726016c064a0bb507e78c085460b8ee9060ab5f0650c747902d5c4ea149bbf5f6ed49f08

Download Submit
C:\Windows\system\WGwwGvb.exe

Filesize
2.3MB

MD5
7a94df12c074a114779dfe5bb348d858

SHA1
e7859d9a1e29a50782beb58aa0e7476a7e019bfd

SHA256
124bea5ec12efa9a7afc78231801f797bd42a0e5f7e949f625f3cd1eb85093c7

SHA512
f93b0a4eab6b8537e95b092a288664df9dcbdae2616e19848bedcecf209bda45533b73e5d41107496c8f0aa0cf2db403d29212071040b1bae3501340a232b523

Download Submit
C:\Windows\system\YGJWQts.exe

Filesize
2.3MB

MD5
93b058d4e5ca0219486d722e7f9ad510

SHA1
462a30260724754e38315dad63b580f7b9be0fcd

SHA256
414ab349b10fa4efd81d4ca2e4f166e2908c9aff8b091dc819e31fa7686795a3

SHA512
c96e3e4b814e8169f15bb92f50d2806f8863d6e5b8bfcfb18648adbd708d0b713075fa150654807a043139e62867baf09582095ce5d77efb7cbe11ed5dfd7615

Download Submit
C:\Windows\system\axIkcut.exe

Filesize
1.9MB

MD5
98aa8eb65c4b5d6d38b1e0eb60ea5a92

SHA1
73ddc8f874e1fdb4bf8c166cdae64aa889ac7e1c

SHA256
92369c67d72c1a513daa11fbbe11da2b9b868ec16fc2c13ec2d2485414250d99

SHA512
b4b15163386b124e63f324002f8d56e88b95760135a137c060a7eb41752dc5e88b3be5404db1982d88420303375150883308e50b36e0dd34b554dcccf8a47368

Download Submit
C:\Windows\system\fKCkyWP.exe

Filesize
2.3MB

MD5
266d843de6b999c3fefb9b5eb00f5265

SHA1
3db8289b821425f1a7e11e344e29062195b47c38

SHA256
7261574d426dd4e39177d0bfed4f411d5b923be1f8434603e17db0a99da984d7

SHA512
b215c651307a8df27d7d1db005979e58b25a18f1051f55687191fe508fa729a684978629f31225a60098d4c91ef7519f2103da017a7e994e35980e1653d7654a

Download Submit
C:\Windows\system\fsVOuoP.exe

Filesize
2.3MB

MD5
f8b8ea5eaeb894b2b7e698c241bbfe9c

SHA1
67f292ef11676c5fa76eedc4ff86200052611aa5

SHA256
9aefbb0eb98abbd3b0572b5f2241423cd5474d01274a5efb1a3a36805058d14a

SHA512
412f57e8d7d983ca28608240f5e22e7d91eb3251a245f62dc94c9a7896d319523ab6937ecc90edd0d8de2d80dedd8d1c49c0629bf844f330571880ed64291ceb

Download Submit
C:\Windows\system\gsxLYgU.exe

Filesize
2.3MB

MD5
43c7b86b40536cd7cdd52dadadc97800

SHA1
404a6e7c8fcf0b2d821e8e435da2d0cbccadde90

SHA256
47e6f53f119bb97e5ab2e964628605aab7b60f954c2d92b61072deb10d4c94d9

SHA512
c90823e161e6ea75923e340c96066937370dbcdaf78b38d89a7c9407bd367fd6f0cefef214ec75569d86df973b1f33e3a2750090356f28bcdb7784a5a4447c71

Download Submit
C:\Windows\system\iTkNeHx.exe

Filesize
1.8MB

MD5
adec4eefab1ea0fd1a4e347442feeaae

SHA1
d4769bb035e9b6d7afb44cebeacfd8cdf5dd6f5c

SHA256
ea0663bf850798c3eba1fe3c552d502c8af0b946e51a3fcbd36d4275ebbeeea4

SHA512
b7930688090eadf57acc39c394604a412d06202a589312431c7b736fd6023c21714c9c43fcf324ac7c66ded666e697b0e552cdd8da8b84ec323948da807ec503

Download Submit
C:\Windows\system\jytfqXI.exe

Filesize
2.3MB

MD5
5e167798643b85cf8a973b67736c3d20

SHA1
e2a1387a35d372fb17f605502786576695ae39f5

SHA256
725c69229b80fbe5b666a2d093e52ac08f0fa368121dd7719cfa0f8b99d90430

SHA512
1c0962727c4a83a365686cdb4d5984b96ff2f1fceb6e5ffbe43e810999647d427d9409a55a159eb242ef5f5015a61fdfd7176e105295e4bd7a2cb901da3cff4b

Download Submit
C:\Windows\system\kYxilGv.exe

Filesize
2.3MB

MD5
10b000c276cccd1d212e2e14b958ed84

SHA1
d99661936688880e20460ebdc48a166ffdbde736

SHA256
7446f1b86b999e0c120c792cfe48f20e5c13124a08fc17e8ba5e421e8d87b641

SHA512
a5cad391dd5898c8ea29659e57235a7aec172a67ac8c0a4c3bc9bf8c3e4f932aaf16061f01b8162900c070251336f3464ea9c34dfb7334d6c70a5704715ec6bd

Download Submit
C:\Windows\system\koNBTMQ.exe

Filesize
2.3MB

MD5
f0c4a478cb781e22d5ddeff9b9b3a798

SHA1
da19b42b00d064a20d51c2bc504b15e414af3987

SHA256
6ba176f03ecdba8772dde9703af7346789e1e2ed02d8d9e9d252f16bf419fbcd

SHA512
7d22e47de9c3dbb3183906469ef212e6a3c6f84cdb547822777a5f1189cd8a0ac8cedee153484815d79b323117d3166e7b283cd2da4d185029fce8f7ee3beba8

Download Submit
C:\Windows\system\lRkVXKJ.exe

Filesize
2.3MB

MD5
92aaac4fadb823d509cf6af3cdf044c0

SHA1
eff655fbe988d7679b30e2b3624c2adcbaba4178

SHA256
2937a83e57dd798af3d55d97affe7cfc5dab800c9d388cb907c84c58a69cf7ac

SHA512
5f4bb3eb9a41e08ff82b28081bfb277850499c618e086fa2cffeb5939808e4af9ae89339850d5b3da4574adfd5e7899656b64dda64248c960d241c2cd02b9049

Download Submit
C:\Windows\system\lxhTxrT.exe

Filesize
2.1MB

MD5
7c56ea02f0025aeaa570d4e8b42c7752

SHA1
f72e8b29fb78f303e623971464a7380cf0dd570b

SHA256
150ad53cea2347b680a4e1aab048ccaafa41aeb064ac24674ef2bbd9261341e9

SHA512
e77ec9bffccaeef3f2e33f5b2f80ace29d43cff9abfe5c692851e62aed306303da409bed3247cd81aca6630e91c6aa1b8eaec1a435a378e106a407c6901ad350

Download Submit
C:\Windows\system\mupbyOk.exe

Filesize
2.1MB

MD5
b935d4398a1fb3a531d0f11c429439cb

SHA1
1fe0dbc7ce353b8f857c702a4ec3b5c0b0139d2b

SHA256
1f19a8f73ce59d6a45aa38544c5298d6e5b118b417677a32bc4642bbaa37e66f

SHA512
405d9dd875fe860f637dbbb76c9835dcf05fdac73f0a26519c8011a09992b53653609eac34c1ee2f65c8dc8737bf0697182c7309d444622b2cbcaf98211bb29e

Download Submit
C:\Windows\system\uSbLqiE.exe

Filesize
2.3MB

MD5
31acfdccdd8765a9f021dec106a0f7bd

SHA1
64128a51a5609b0e7f5f3ad8c6175e021736d465

SHA256
0ac6336dce7b8da85d0722ab878fba68d16122bf8689739f6e89f1e46c7a4414

SHA512
f1347caa716f5e3cd2f80ead082cca60d83075a4d5b4ce9ac57a3bc4d6306ad805cbeff8a04096e2310981610ce9287b2f5ed6c14e9e71d68e6e1101d157aaf1

Download Submit
C:\Windows\system\yNXZvNf.exe

Filesize
2.3MB

MD5
7520413f012073608202e32f69a6277d

SHA1
5b1d2147e3424f3581dac552d412a0a770d2df21

SHA256
5467cc9be583c3bf03eae72df5394a35b84756c72cc78ef1b53ec539a96c62dc

SHA512
c329a1ccd288064c0a99dd01b3324f69e9058424fba3d33c0cd14ec60e7fc8fe82a734994fc26afb969c79d5f79204aac9fd36a47a1b394f6a10cc8212f1ed2a

Download Submit
\Windows\system\AyHSWnp.exe

Filesize
2.3MB

MD5
87b43e77b7d1661d7b273a7164dea95c

SHA1
eae49b6a38174ca71f2056003b66d9499b031fb0

SHA256
ebfc7ea0f0e7f5c2a7d99c5e8a8cfbe9893e00ff358c8c8ddc910a063b3ba27f

SHA512
3b1f56079be92a1c625d9bd7ac4e47f31a497071394a77d4234e2005cbfc1b9dc48e66327c571adbf8aa78c7b823ca905f98ccd61325bd7bbe4696f14d15bae1

Download Submit
\Windows\system\GdFGZaD.exe

Filesize
2.3MB

MD5
b679137e57ff598135a64b1e1f10623a

SHA1
b852ece5f2da2b88524f41f2b6e3a121c3c7c155

SHA256
e1b1e0591bc25ca0d29149999844b2e45c5f1ea0ed0d97b44d3424bf861e1c16

SHA512
9adb74150ff78f57f89be8b4e2ee3d609a12d0dd5df81387e9eb5a6e997b74770807ce42399e0de95cc2838a210b44b1350d581d4be90b82dfe03be53660c8dc

Download Submit
\Windows\system\OACZdxK.exe

Filesize
2.3MB

MD5
b962dd1f81d30f2eb0d5468b7b78531d

SHA1
7084e6ac897e81bf6f7e4bd56de29f211cc80610

SHA256
4e95fb1567cf2aa66270a0cdb184b99127aaf305a490e126174d77d214aa31e7

SHA512
43e78c613090cb468da6aa29439025cdc453fcb22970b006d31da05dc856b60430ae10490696d774bafb8022ad801c1183b51c807e4c44b99ec664fb25756a4c

Download Submit
\Windows\system\axIkcut.exe

Filesize
2.3MB

MD5
0bc068c2e0bbebe226cad0b71e50bf1d

SHA1
d3f762900bc916e86bfa151fe7209c2acc7fb0c9

SHA256
546e68c60450a8a94aac2f162426b3142c26f603acd3db7d469d613aa706c766

SHA512
fa2b3f18f900adf1baa439e27c749b650d24d98b850da70c5c840fa23823cef5c6e286c2d4da43a22b1de7141d63273aa2553bdfc45518b7e7fde2647460d683

Download Submit
\Windows\system\cymPSDk.exe

Filesize
2.3MB

MD5
1654ebb6fceb7a2256afca495260a18a

SHA1
33b8b8104cbf4730ed87bef1e5ec3615d7026083

SHA256
44e0880b83d309f67e639790f1a0e82e86389b703400ba950aef062d2f94ae2c

SHA512
e9954da67505f5fa9d05b94e8cd2e8006552c8535bd960e0bb1434a1b4b2d7652cac9f44d546fafc4258857dc556f8b8a4c82a8b251fceae9d44919d07ec18f0

Download Submit
\Windows\system\efOYait.exe

Filesize
2.3MB

MD5
a13f26f146106d39a9d7144438f28d60

SHA1
ca5bebe6d885e675b03f8888e46280bca4394e78

SHA256
5d7490ad449e3209d779886271414202839f2c50b1ec76be06e56053d0fb105e

SHA512
b71b33e94c53bff069679e5ab85158e38a5841d2ee5cde2d273dcfcdfeb60c9bd88e8c6e04eef83e2862998093e320369f0257e289a2e83d5a31dbf63d854d0c

Download Submit
\Windows\system\hBuPPfA.exe

Filesize
2.3MB

MD5
e5f020780447b15b10f9ba65ac4f66b2

SHA1
860e73a87b5240b26a2965d1208218a7706b1055

SHA256
9b5f7c45a406213233cd96085ad835c007c65c6250149fa8c2875909ea87e43c

SHA512
34ab41f1d9cd0f13a2e11d82ca3e8f80fe9c94d008da875664f4e7bdb4ad10d885ae46a23ca6191f3a12627a278c8f2f1386f6728ccd5a2d08e83de6f5d64781

Download Submit
\Windows\system\iTkNeHx.exe

Filesize
2.3MB

MD5
26f2e6732a63ff33ccaee131ce822ac0

SHA1
246989574473c772a16c400b9e73285263424fa8

SHA256
8302d6d67c1890aa23bfadd2de9209054f4921e0c0d956487f2d1839d06b42ff

SHA512
8aaf81afcf2129470767535e0d8c3e1154160f418d4838d719eb8795055b70f77bd7bf748b3b6802c5c540a7fc7610783c84276081e03ebf152d5992c98f6087

Download Submit
\Windows\system\lxhTxrT.exe

Filesize
2.3MB

MD5
41b12c00ac9dd934bfbb60914768bd76

SHA1
a2bc2e66434ee6da55b3788937a621fd5595e6d8

SHA256
2c25f8f37b1e0e1fa39e7300bf05a40f3b1db5b89916a92012ca2523c4f6b024

SHA512
3a1a4773a8f8cf7a1867e59d68095329f35bd1b7e7da75081ba6796358b7ca3c9aab5a7e8d64a3f50772478ca29dd4eff8614859bafb6818e80e6d557ee6a4f3

Download Submit
\Windows\system\mQWlDOQ.exe

Filesize
2.3MB

MD5
61794781264ec6f492a3583ab6353040

SHA1
0dc291233521c7df656e0073e9741dfa7f50dec2

SHA256
09c4f3f2bbd68c5e815a2f4160be0ba044aafd0f4914d7fdf359a81a2d9a0129

SHA512
0c3d3f9ea555711fb16689c2735bf2cf91042169f87810cf2295180265c0b8c55555124e38900237c609c648f8516ac666dbd2a4c0b86aae69f0e4cea6d90525

Download Submit
\Windows\system\mupbyOk.exe

Filesize
2.3MB

MD5
2c386c4b574f0e2101b8a7736bb201a8

SHA1
8b29f78ceaff63444d2f957eceb63040e284a6ae

SHA256
a8b79f2bd071fda2efe39b90c835de7f283356e8fe16238e4098a05afb05d324

SHA512
1c1612d6411f269e1f5409a0ac011d7d01e0a6751cd5ba8a6ed0ec97ae1bd1c25aa88ae585fe4c4688772eec6c3f26828aef29ff261d05d742d6643cce837837

Download Submit
memory/2316-4004-0x000000013FEE0000-0x0000000140234000-memory.dmp

Filesize
3.3MB

Download
memory/2316-42-0x000000013FEE0000-0x0000000140234000-memory.dmp

Filesize
3.3MB

Download
memory/2328-111-0x00000000020D0000-0x0000000002424000-memory.dmp

Filesize
3.3MB

Download
memory/2328-50-0x00000000020D0000-0x0000000002424000-memory.dmp

Filesize
3.3MB

Download
memory/2328-109-0x00000000020D0000-0x0000000002424000-memory.dmp

Filesize
3.3MB

Download
memory/2328-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2328-114-0x000000013F140000-0x000000013F494000-memory.dmp

Filesize
3.3MB

Download
memory/2328-0-0x000000013FF20000-0x0000000140274000-memory.dmp

Filesize
3.3MB

Download
memory/2328-117-0x00000000020D0000-0x0000000002424000-memory.dmp

Filesize
3.3MB

Download
memory/2328-89-0x000000013F640000-0x000000013F994000-memory.dmp

Filesize
3.3MB

Download
memory/2328-10-0x00000000020D0000-0x0000000002424000-memory.dmp

Filesize
3.3MB

Download
memory/2328-118-0x000000013F960000-0x000000013FCB4000-memory.dmp

Filesize
3.3MB

Download
memory/2328-98-0x000000013FB10000-0x000000013FE64000-memory.dmp

Filesize
3.3MB

Download
memory/2328-68-0x000000013F2E0000-0x000000013F634000-memory.dmp

Filesize
3.3MB

Download
memory/2328-40-0x00000000020D0000-0x0000000002424000-memory.dmp

Filesize
3.3MB

Download
memory/2328-2743-0x000000013FF20000-0x0000000140274000-memory.dmp

Filesize
3.3MB

Download
memory/2328-2843-0x00000000020D0000-0x0000000002424000-memory.dmp

Filesize
3.3MB

Download
memory/2328-3285-0x00000000020D0000-0x0000000002424000-memory.dmp

Filesize
3.3MB

Download
memory/2328-35-0x000000013F6B0000-0x000000013FA04000-memory.dmp

Filesize
3.3MB

Download
memory/2328-15-0x00000000020D0000-0x0000000002424000-memory.dmp

Filesize
3.3MB

Download
memory/2328-3944-0x00000000020D0000-0x0000000002424000-memory.dmp

Filesize
3.3MB

Download
memory/2328-3942-0x00000000020D0000-0x0000000002424000-memory.dmp

Filesize
3.3MB

Download
memory/2328-4000-0x00000000020D0000-0x0000000002424000-memory.dmp

Filesize
3.3MB

Download
memory/2328-3602-0x000000013FB10000-0x000000013FE64000-memory.dmp

Filesize
3.3MB

Download
memory/2328-63-0x00000000020D0000-0x0000000002424000-memory.dmp

Filesize
3.3MB

Download
memory/2328-3283-0x00000000020D0000-0x0000000002424000-memory.dmp

Filesize
3.3MB

Download
memory/2328-2979-0x00000000020D0000-0x0000000002424000-memory.dmp

Filesize
3.3MB

Download
memory/2328-58-0x00000000020D0000-0x0000000002424000-memory.dmp

Filesize
3.3MB

Download
memory/2412-53-0x000000013F6B0000-0x000000013FA04000-memory.dmp

Filesize
3.3MB

Download
memory/2412-3576-0x000000013F6B0000-0x000000013FA04000-memory.dmp

Filesize
3.3MB

Download
memory/2412-4006-0x000000013F6B0000-0x000000013FA04000-memory.dmp

Filesize
3.3MB

Download
memory/2420-80-0x000000013FE70000-0x00000001401C4000-memory.dmp

Filesize
3.3MB

Download
memory/2420-4010-0x000000013FE70000-0x00000001401C4000-memory.dmp

Filesize
3.3MB

Download
memory/2436-94-0x000000013F640000-0x000000013F994000-memory.dmp

Filesize
3.3MB

Download
memory/2436-4009-0x000000013F640000-0x000000013F994000-memory.dmp

Filesize
3.3MB

Download
memory/2456-75-0x000000013FB10000-0x000000013FE64000-memory.dmp

Filesize
3.3MB

Download
memory/2456-4012-0x000000013FB10000-0x000000013FE64000-memory.dmp

Filesize
3.3MB

Download
memory/2456-3586-0x000000013FB10000-0x000000013FE64000-memory.dmp

Filesize
3.3MB

Download
memory/2552-20-0x000000013FE60000-0x00000001401B4000-memory.dmp

Filesize
3.3MB

Download
memory/2552-4002-0x000000013FE60000-0x00000001401B4000-memory.dmp

Filesize
3.3MB

Download
memory/2568-46-0x000000013FD30000-0x0000000140084000-memory.dmp

Filesize
3.3MB

Download
memory/2568-4005-0x000000013FD30000-0x0000000140084000-memory.dmp

Filesize
3.3MB

Download
memory/2592-4003-0x000000013FF00000-0x0000000140254000-memory.dmp

Filesize
3.3MB

Download
memory/2592-2977-0x000000013FF00000-0x0000000140254000-memory.dmp

Filesize
3.3MB

Download
memory/2592-30-0x000000013FF00000-0x0000000140254000-memory.dmp

Filesize
3.3MB

Download
memory/2668-72-0x000000013F2E0000-0x000000013F634000-memory.dmp

Filesize
3.3MB

Download
memory/2668-4008-0x000000013F2E0000-0x000000013F634000-memory.dmp

Filesize
3.3MB

Download
memory/2736-4007-0x000000013FCA0000-0x000000013FFF4000-memory.dmp

Filesize
3.3MB

Download
memory/2736-91-0x000000013FCA0000-0x000000013FFF4000-memory.dmp

Filesize
3.3MB

Download
memory/2904-84-0x000000013FEA0000-0x00000001401F4000-memory.dmp

Filesize
3.3MB

Download
memory/2904-3305-0x000000013FEA0000-0x00000001401F4000-memory.dmp

Filesize
3.3MB

Download
memory/2904-4011-0x000000013FEA0000-0x00000001401F4000-memory.dmp

Filesize
3.3MB

Download
memory/2968-4001-0x000000013FF70000-0x00000001402C4000-memory.dmp

Filesize
3.3MB

Download
memory/2968-13-0x000000013FF70000-0x00000001402C4000-memory.dmp

Filesize
3.3MB

Download