xmrig | 3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5

Analysis

max time kernel
144s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 03:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
Size

1.0MB
MD5

c26e1c649cf8fbc77ca384efd7a106e0
SHA1

7e3d320f82d74634ebd83164c607feccdd40651d
SHA256

3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5
SHA512

9dd2dad2518f1f7e5489300175c8ca917b71fbcf1ac3e52e49f3b7634637c813f659e78d59032da52ed3fcaf919cc43793bc550fc3916e7ab25187013e17346a
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5JW4G5P8Bi:GezaTF8FcNkNdfE0pZ9oztFwIHT5Jx4

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x000d00000001226b-4.dat	xmrig
behavioral1/files/0x002a000000015d02-9.dat	xmrig
behavioral1/files/0x0007000000015d6b-15.dat	xmrig
behavioral1/files/0x0007000000015d77-23.dat	xmrig
behavioral1/files/0x0007000000015d7f-24.dat	xmrig
behavioral1/files/0x0009000000015f05-31.dat	xmrig
behavioral1/files/0x0007000000016c7a-32.dat	xmrig
behavioral1/files/0x0006000000016d4e-66.dat	xmrig
behavioral1/files/0x0006000000016dda-86.dat	xmrig
behavioral1/files/0x0006000000017042-102.dat	xmrig
behavioral1/files/0x0006000000018663-118.dat	xmrig
behavioral1/files/0x0005000000018686-130.dat	xmrig
behavioral1/files/0x001100000001867a-126.dat	xmrig
behavioral1/files/0x0014000000018669-122.dat	xmrig
behavioral1/files/0x0006000000017495-114.dat	xmrig
behavioral1/files/0x0006000000017486-110.dat	xmrig
behavioral1/files/0x0006000000017477-107.dat	xmrig
behavioral1/files/0x0006000000016eb9-98.dat	xmrig
behavioral1/files/0x0006000000016de7-94.dat	xmrig
behavioral1/files/0x0006000000016dde-90.dat	xmrig
behavioral1/files/0x0006000000016d71-82.dat	xmrig
behavioral1/files/0x0006000000016d69-78.dat	xmrig
behavioral1/files/0x0006000000016d65-74.dat	xmrig
behavioral1/files/0x0006000000016d61-70.dat	xmrig
behavioral1/files/0x0006000000016d45-62.dat	xmrig
behavioral1/files/0x0006000000016d3d-58.dat	xmrig
behavioral1/files/0x0006000000016d34-54.dat	xmrig
behavioral1/files/0x0006000000016d2c-50.dat	xmrig
behavioral1/files/0x0006000000016d1b-46.dat	xmrig
behavioral1/files/0x0006000000016ce7-42.dat	xmrig
behavioral1/files/0x0006000000016cc3-38.dat	xmrig
behavioral1/files/0x0007000000015d49-14.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1228	UjKFCna.exe
2916	jpPiSdD.exe
1736	jevKXVu.exe
2624	INOMaPJ.exe
2644	MWpFCzZ.exe
2808	MKNERkz.exe
2668	HSdEjwk.exe
2804	oczdiaF.exe
2932	ucNZHLA.exe
2100	zxMlMOC.exe
2540	WYnrInp.exe
2680	fDjFtiO.exe
2780	JTfajyO.exe
2528	CDjiCSR.exe
2592	RgftpSq.exe
3020	JNRCpfX.exe
1944	DVPpEbb.exe
844	rygDTog.exe
2884	omIhmnJ.exe
2904	KpGQCrX.exe
2988	sskIVFe.exe
3032	NglGwkc.exe
2728	tqZoJlN.exe
1240	BVKTuQZ.exe
112	oxsSalj.exe
2756	CQYyTua.exe
352	SwNOLfj.exe
1640	DpTsgHw.exe
1184	LAGwRMq.exe
1764	AwRMgJI.exe
2124	llcLhLr.exe
2096	FuAgMiy.exe
1280	XmymABJ.exe
1696	eNyVbnp.exe
2944	XDuBsoN.exe
2960	jmWgUxh.exe
2108	TjPiXJu.exe
2616	KELopTZ.exe
776	tjtpiGL.exe
304	KZPOLFD.exe
696	AUqyEsU.exe
1480	mYlyrxI.exe
1484	iZvQTtv.exe
1652	eWuGnwG.exe
1856	mQPiMPd.exe
628	nbNQlZF.exe
1836	ZQDEloR.exe
1516	difGYNF.exe
1752	BJgjsls.exe
2464	KllXvMI.exe
1288	UrOfyVx.exe
2144	BcnHcWC.exe
540	AGHFzee.exe
1924	WrQoiPo.exe
1780	YDverxe.exe
948	iNVyNtl.exe
772	lfFCFOg.exe
1796	emWOKEm.exe
2304	vYheqPr.exe
1940	EaGfjYo.exe
912	rQNiwLF.exe
556	REQLSmT.exe
1236	VblogdI.exe
2352	jsQPJsm.exe

Loads dropped DLL 64 IoCs

pid	Process
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\CrlwUAA.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\gFAZPZf.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\OSRoKzS.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\lfFCFOg.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\XDKVScO.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\poRCYJe.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\KvDzWVD.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\vptvVug.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\LDlXkxj.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\ZWqlkOP.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\QhjHNiY.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\XaORsHW.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\PdNmkDD.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\jvglHWK.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\BZEPuZm.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\NNdBZmp.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\mbsUjUl.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\ltfbezV.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\peGHDnA.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\ligBbNH.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\lXwjHAp.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\qcEeEoW.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\CNutBtv.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\odeqMXz.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\CCIyphI.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\vWwXphK.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\JrCBTdV.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\zbllrRI.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\TyzsffO.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\ufooYIz.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\YyCCkYR.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\xdurYrY.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\wnmnyrp.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\VknnZZL.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\whbrWlH.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\toLzRZW.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\oLDvuNx.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\BkPoUgv.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\pZvTuBi.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\RFoVOVJ.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\ukHlTPc.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\kQecVPl.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\PDSVsJP.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\sjRrZbi.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\xRYYAUm.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\Jlelmlu.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\iZvQTtv.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\qcVchmI.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\OGXroVj.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\oPKsMcf.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\RfjdwjJ.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\ieigCMH.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\OiPmTHN.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\lDxuWCT.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\NZPTNMy.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\qCeaxLj.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\SEEBqrj.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\UpGxBZC.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\LQjBXlM.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\SwlrmXm.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\TqCJKrl.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\TNYmaeJ.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\aJbyDfx.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
File created	C:\Windows\System\igDAGtc.exe	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 1228	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	29
PID 2980 wrote to memory of 1228	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	29
PID 2980 wrote to memory of 1228	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	29
PID 2980 wrote to memory of 2916	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	30
PID 2980 wrote to memory of 2916	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	30
PID 2980 wrote to memory of 2916	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	30
PID 2980 wrote to memory of 1736	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	31
PID 2980 wrote to memory of 1736	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	31
PID 2980 wrote to memory of 1736	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	31
PID 2980 wrote to memory of 2624	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	32
PID 2980 wrote to memory of 2624	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	32
PID 2980 wrote to memory of 2624	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	32
PID 2980 wrote to memory of 2644	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	33
PID 2980 wrote to memory of 2644	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	33
PID 2980 wrote to memory of 2644	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	33
PID 2980 wrote to memory of 2808	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	34
PID 2980 wrote to memory of 2808	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	34
PID 2980 wrote to memory of 2808	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	34
PID 2980 wrote to memory of 2668	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	35
PID 2980 wrote to memory of 2668	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	35
PID 2980 wrote to memory of 2668	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	35
PID 2980 wrote to memory of 2804	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	36
PID 2980 wrote to memory of 2804	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	36
PID 2980 wrote to memory of 2804	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	36
PID 2980 wrote to memory of 2932	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	37
PID 2980 wrote to memory of 2932	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	37
PID 2980 wrote to memory of 2932	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	37
PID 2980 wrote to memory of 2100	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	38
PID 2980 wrote to memory of 2100	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	38
PID 2980 wrote to memory of 2100	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	38
PID 2980 wrote to memory of 2540	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	39
PID 2980 wrote to memory of 2540	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	39
PID 2980 wrote to memory of 2540	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	39
PID 2980 wrote to memory of 2680	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	40
PID 2980 wrote to memory of 2680	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	40
PID 2980 wrote to memory of 2680	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	40
PID 2980 wrote to memory of 2780	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	41
PID 2980 wrote to memory of 2780	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	41
PID 2980 wrote to memory of 2780	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	41
PID 2980 wrote to memory of 2528	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	42
PID 2980 wrote to memory of 2528	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	42
PID 2980 wrote to memory of 2528	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	42
PID 2980 wrote to memory of 2592	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	43
PID 2980 wrote to memory of 2592	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	43
PID 2980 wrote to memory of 2592	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	43
PID 2980 wrote to memory of 3020	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	44
PID 2980 wrote to memory of 3020	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	44
PID 2980 wrote to memory of 3020	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	44
PID 2980 wrote to memory of 1944	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	45
PID 2980 wrote to memory of 1944	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	45
PID 2980 wrote to memory of 1944	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	45
PID 2980 wrote to memory of 844	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	46
PID 2980 wrote to memory of 844	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	46
PID 2980 wrote to memory of 844	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	46
PID 2980 wrote to memory of 2884	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	47
PID 2980 wrote to memory of 2884	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	47
PID 2980 wrote to memory of 2884	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	47
PID 2980 wrote to memory of 2904	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	48
PID 2980 wrote to memory of 2904	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	48
PID 2980 wrote to memory of 2904	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	48
PID 2980 wrote to memory of 2988	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	49
PID 2980 wrote to memory of 2988	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	49
PID 2980 wrote to memory of 2988	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	49
PID 2980 wrote to memory of 3032	2980	3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe	50

C:\Users\Admin\AppData\Local\Temp\3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe
"C:\Users\Admin\AppData\Local\Temp\3a2778be9dbeaffff635adbbebf670cfb6a9f5b9fd0be5c013805a31a1a9acf5.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\System\UjKFCna.exe
  C:\Windows\System\UjKFCna.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\jpPiSdD.exe
  C:\Windows\System\jpPiSdD.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\jevKXVu.exe
  C:\Windows\System\jevKXVu.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\INOMaPJ.exe
  C:\Windows\System\INOMaPJ.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\MWpFCzZ.exe
  C:\Windows\System\MWpFCzZ.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\MKNERkz.exe
  C:\Windows\System\MKNERkz.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\HSdEjwk.exe
  C:\Windows\System\HSdEjwk.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\oczdiaF.exe
  C:\Windows\System\oczdiaF.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\ucNZHLA.exe
  C:\Windows\System\ucNZHLA.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\zxMlMOC.exe
  C:\Windows\System\zxMlMOC.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\WYnrInp.exe
  C:\Windows\System\WYnrInp.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\fDjFtiO.exe
  C:\Windows\System\fDjFtiO.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\JTfajyO.exe
  C:\Windows\System\JTfajyO.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\CDjiCSR.exe
  C:\Windows\System\CDjiCSR.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\RgftpSq.exe
  C:\Windows\System\RgftpSq.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\JNRCpfX.exe
  C:\Windows\System\JNRCpfX.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\DVPpEbb.exe
  C:\Windows\System\DVPpEbb.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\rygDTog.exe
  C:\Windows\System\rygDTog.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\omIhmnJ.exe
  C:\Windows\System\omIhmnJ.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\KpGQCrX.exe
  C:\Windows\System\KpGQCrX.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\sskIVFe.exe
  C:\Windows\System\sskIVFe.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\NglGwkc.exe
  C:\Windows\System\NglGwkc.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\tqZoJlN.exe
  C:\Windows\System\tqZoJlN.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\BVKTuQZ.exe
  C:\Windows\System\BVKTuQZ.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\oxsSalj.exe
  C:\Windows\System\oxsSalj.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\CQYyTua.exe
  C:\Windows\System\CQYyTua.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\SwNOLfj.exe
  C:\Windows\System\SwNOLfj.exe
  2⤵
  - Executes dropped EXE
  PID:352
- C:\Windows\System\DpTsgHw.exe
  C:\Windows\System\DpTsgHw.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\LAGwRMq.exe
  C:\Windows\System\LAGwRMq.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\AwRMgJI.exe
  C:\Windows\System\AwRMgJI.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\llcLhLr.exe
  C:\Windows\System\llcLhLr.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\FuAgMiy.exe
  C:\Windows\System\FuAgMiy.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\XmymABJ.exe
  C:\Windows\System\XmymABJ.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\eNyVbnp.exe
  C:\Windows\System\eNyVbnp.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\XDuBsoN.exe
  C:\Windows\System\XDuBsoN.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\jmWgUxh.exe
  C:\Windows\System\jmWgUxh.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\TjPiXJu.exe
  C:\Windows\System\TjPiXJu.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\KELopTZ.exe
  C:\Windows\System\KELopTZ.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\tjtpiGL.exe
  C:\Windows\System\tjtpiGL.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\KZPOLFD.exe
  C:\Windows\System\KZPOLFD.exe
  2⤵
  - Executes dropped EXE
  PID:304
- C:\Windows\System\AUqyEsU.exe
  C:\Windows\System\AUqyEsU.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\mYlyrxI.exe
  C:\Windows\System\mYlyrxI.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\iZvQTtv.exe
  C:\Windows\System\iZvQTtv.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\eWuGnwG.exe
  C:\Windows\System\eWuGnwG.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\mQPiMPd.exe
  C:\Windows\System\mQPiMPd.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\nbNQlZF.exe
  C:\Windows\System\nbNQlZF.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\ZQDEloR.exe
  C:\Windows\System\ZQDEloR.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\difGYNF.exe
  C:\Windows\System\difGYNF.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\BJgjsls.exe
  C:\Windows\System\BJgjsls.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\KllXvMI.exe
  C:\Windows\System\KllXvMI.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\UrOfyVx.exe
  C:\Windows\System\UrOfyVx.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\BcnHcWC.exe
  C:\Windows\System\BcnHcWC.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\AGHFzee.exe
  C:\Windows\System\AGHFzee.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\WrQoiPo.exe
  C:\Windows\System\WrQoiPo.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\YDverxe.exe
  C:\Windows\System\YDverxe.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\iNVyNtl.exe
  C:\Windows\System\iNVyNtl.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\lfFCFOg.exe
  C:\Windows\System\lfFCFOg.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\emWOKEm.exe
  C:\Windows\System\emWOKEm.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\vYheqPr.exe
  C:\Windows\System\vYheqPr.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\EaGfjYo.exe
  C:\Windows\System\EaGfjYo.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\rQNiwLF.exe
  C:\Windows\System\rQNiwLF.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\REQLSmT.exe
  C:\Windows\System\REQLSmT.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\VblogdI.exe
  C:\Windows\System\VblogdI.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\jsQPJsm.exe
  C:\Windows\System\jsQPJsm.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\qZpHsTp.exe
  C:\Windows\System\qZpHsTp.exe
  2⤵
  PID:1956
- C:\Windows\System\Jlelmlu.exe
  C:\Windows\System\Jlelmlu.exe
  2⤵
  PID:820
- C:\Windows\System\SXZZSfE.exe
  C:\Windows\System\SXZZSfE.exe
  2⤵
  PID:840
- C:\Windows\System\qOUJRPZ.exe
  C:\Windows\System\qOUJRPZ.exe
  2⤵
  PID:2128
- C:\Windows\System\bqkfcKz.exe
  C:\Windows\System\bqkfcKz.exe
  2⤵
  PID:1380
- C:\Windows\System\ryPCrNR.exe
  C:\Windows\System\ryPCrNR.exe
  2⤵
  PID:2220
- C:\Windows\System\jqTCuqa.exe
  C:\Windows\System\jqTCuqa.exe
  2⤵
  PID:1508
- C:\Windows\System\yLLOLGC.exe
  C:\Windows\System\yLLOLGC.exe
  2⤵
  PID:1788
- C:\Windows\System\ztjwBNe.exe
  C:\Windows\System\ztjwBNe.exe
  2⤵
  PID:1248
- C:\Windows\System\paNpkBj.exe
  C:\Windows\System\paNpkBj.exe
  2⤵
  PID:2408
- C:\Windows\System\scuJdys.exe
  C:\Windows\System\scuJdys.exe
  2⤵
  PID:1608
- C:\Windows\System\AAjOjle.exe
  C:\Windows\System\AAjOjle.exe
  2⤵
  PID:2416
- C:\Windows\System\igBmWsw.exe
  C:\Windows\System\igBmWsw.exe
  2⤵
  PID:2600
- C:\Windows\System\pMvgTAz.exe
  C:\Windows\System\pMvgTAz.exe
  2⤵
  PID:2608
- C:\Windows\System\MdjqlYG.exe
  C:\Windows\System\MdjqlYG.exe
  2⤵
  PID:2656
- C:\Windows\System\ssrMmFv.exe
  C:\Windows\System\ssrMmFv.exe
  2⤵
  PID:2948
- C:\Windows\System\dvVoJMA.exe
  C:\Windows\System\dvVoJMA.exe
  2⤵
  PID:1928
- C:\Windows\System\tuGzSJH.exe
  C:\Windows\System\tuGzSJH.exe
  2⤵
  PID:2692
- C:\Windows\System\hFrMldd.exe
  C:\Windows\System\hFrMldd.exe
  2⤵
  PID:2628
- C:\Windows\System\egUFzaf.exe
  C:\Windows\System\egUFzaf.exe
  2⤵
  PID:2564
- C:\Windows\System\hDcYQAH.exe
  C:\Windows\System\hDcYQAH.exe
  2⤵
  PID:3016
- C:\Windows\System\NQOlSLg.exe
  C:\Windows\System\NQOlSLg.exe
  2⤵
  PID:2852
- C:\Windows\System\UYItJxJ.exe
  C:\Windows\System\UYItJxJ.exe
  2⤵
  PID:2920
- C:\Windows\System\TssetNF.exe
  C:\Windows\System\TssetNF.exe
  2⤵
  PID:3008
- C:\Windows\System\oLjYNlN.exe
  C:\Windows\System\oLjYNlN.exe
  2⤵
  PID:1708
- C:\Windows\System\AfXlJwQ.exe
  C:\Windows\System\AfXlJwQ.exe
  2⤵
  PID:2500
- C:\Windows\System\xNbTzYM.exe
  C:\Windows\System\xNbTzYM.exe
  2⤵
  PID:1560
- C:\Windows\System\aLojTHz.exe
  C:\Windows\System\aLojTHz.exe
  2⤵
  PID:2092
- C:\Windows\System\sdibavN.exe
  C:\Windows\System\sdibavN.exe
  2⤵
  PID:1524
- C:\Windows\System\NXFxKNV.exe
  C:\Windows\System\NXFxKNV.exe
  2⤵
  PID:1912
- C:\Windows\System\tTkWJNC.exe
  C:\Windows\System\tTkWJNC.exe
  2⤵
  PID:2276
- C:\Windows\System\HdXbblh.exe
  C:\Windows\System\HdXbblh.exe
  2⤵
  PID:2116
- C:\Windows\System\JrCBTdV.exe
  C:\Windows\System\JrCBTdV.exe
  2⤵
  PID:536
- C:\Windows\System\SEEBqrj.exe
  C:\Windows\System\SEEBqrj.exe
  2⤵
  PID:1152
- C:\Windows\System\QDaWlna.exe
  C:\Windows\System\QDaWlna.exe
  2⤵
  PID:824
- C:\Windows\System\Bdwftkn.exe
  C:\Windows\System\Bdwftkn.exe
  2⤵
  PID:836
- C:\Windows\System\dfOAhFF.exe
  C:\Windows\System\dfOAhFF.exe
  2⤵
  PID:2472
- C:\Windows\System\aWNbtYN.exe
  C:\Windows\System\aWNbtYN.exe
  2⤵
  PID:1988
- C:\Windows\System\JsHOQZt.exe
  C:\Windows\System\JsHOQZt.exe
  2⤵
  PID:1792
- C:\Windows\System\SiiBexG.exe
  C:\Windows\System\SiiBexG.exe
  2⤵
  PID:2172
- C:\Windows\System\oRsERvf.exe
  C:\Windows\System\oRsERvf.exe
  2⤵
  PID:1540
- C:\Windows\System\rGGafvC.exe
  C:\Windows\System\rGGafvC.exe
  2⤵
  PID:1676
- C:\Windows\System\EtWKAyj.exe
  C:\Windows\System\EtWKAyj.exe
  2⤵
  PID:1864
- C:\Windows\System\mPllRYi.exe
  C:\Windows\System\mPllRYi.exe
  2⤵
  PID:1660
- C:\Windows\System\EYDwdFy.exe
  C:\Windows\System\EYDwdFy.exe
  2⤵
  PID:2924
- C:\Windows\System\cZYZpkX.exe
  C:\Windows\System\cZYZpkX.exe
  2⤵
  PID:2204
- C:\Windows\System\xYMXSZP.exe
  C:\Windows\System\xYMXSZP.exe
  2⤵
  PID:2972
- C:\Windows\System\IKOIOuK.exe
  C:\Windows\System\IKOIOuK.exe
  2⤵
  PID:2324
- C:\Windows\System\cqvYXtC.exe
  C:\Windows\System\cqvYXtC.exe
  2⤵
  PID:2296
- C:\Windows\System\xNhdoJH.exe
  C:\Windows\System\xNhdoJH.exe
  2⤵
  PID:888
- C:\Windows\System\qNyUAXI.exe
  C:\Windows\System\qNyUAXI.exe
  2⤵
  PID:1716
- C:\Windows\System\WtThDYQ.exe
  C:\Windows\System\WtThDYQ.exe
  2⤵
  PID:1712
- C:\Windows\System\VizYanI.exe
  C:\Windows\System\VizYanI.exe
  2⤵
  PID:1604
- C:\Windows\System\nhVEmRu.exe
  C:\Windows\System\nhVEmRu.exe
  2⤵
  PID:804
- C:\Windows\System\uxJByOu.exe
  C:\Windows\System\uxJByOu.exe
  2⤵
  PID:2768
- C:\Windows\System\OXdvnaJ.exe
  C:\Windows\System\OXdvnaJ.exe
  2⤵
  PID:2828
- C:\Windows\System\TmaWarC.exe
  C:\Windows\System\TmaWarC.exe
  2⤵
  PID:2524
- C:\Windows\System\MmhNZwZ.exe
  C:\Windows\System\MmhNZwZ.exe
  2⤵
  PID:1868
- C:\Windows\System\ymfbvTN.exe
  C:\Windows\System\ymfbvTN.exe
  2⤵
  PID:2900
- C:\Windows\System\GVmxGeD.exe
  C:\Windows\System\GVmxGeD.exe
  2⤵
  PID:608
- C:\Windows\System\ZAnysKP.exe
  C:\Windows\System\ZAnysKP.exe
  2⤵
  PID:2956
- C:\Windows\System\VLXaIrz.exe
  C:\Windows\System\VLXaIrz.exe
  2⤵
  PID:2664
- C:\Windows\System\qWSwSiA.exe
  C:\Windows\System\qWSwSiA.exe
  2⤵
  PID:2812
- C:\Windows\System\BoviINv.exe
  C:\Windows\System\BoviINv.exe
  2⤵
  PID:2788
- C:\Windows\System\AXeXdfv.exe
  C:\Windows\System\AXeXdfv.exe
  2⤵
  PID:2184
- C:\Windows\System\ODurcyn.exe
  C:\Windows\System\ODurcyn.exe
  2⤵
  PID:2512
- C:\Windows\System\cWUwlKj.exe
  C:\Windows\System\cWUwlKj.exe
  2⤵
  PID:2064
- C:\Windows\System\xzbQAhR.exe
  C:\Windows\System\xzbQAhR.exe
  2⤵
  PID:2776
- C:\Windows\System\AszZSUG.exe
  C:\Windows\System\AszZSUG.exe
  2⤵
  PID:2712
- C:\Windows\System\sWGZZGD.exe
  C:\Windows\System\sWGZZGD.exe
  2⤵
  PID:2792
- C:\Windows\System\VEMtwLY.exe
  C:\Windows\System\VEMtwLY.exe
  2⤵
  PID:2772
- C:\Windows\System\bIffNOY.exe
  C:\Windows\System\bIffNOY.exe
  2⤵
  PID:756
- C:\Windows\System\iCAGVWe.exe
  C:\Windows\System\iCAGVWe.exe
  2⤵
  PID:1592
- C:\Windows\System\ZuBRsiy.exe
  C:\Windows\System\ZuBRsiy.exe
  2⤵
  PID:2112
- C:\Windows\System\mqZjrGp.exe
  C:\Windows\System\mqZjrGp.exe
  2⤵
  PID:1976
- C:\Windows\System\fBZQROm.exe
  C:\Windows\System\fBZQROm.exe
  2⤵
  PID:2572
- C:\Windows\System\VvzLmbE.exe
  C:\Windows\System\VvzLmbE.exe
  2⤵
  PID:1028
- C:\Windows\System\xmZEvxN.exe
  C:\Windows\System\xmZEvxN.exe
  2⤵
  PID:1264
- C:\Windows\System\cPGdJsH.exe
  C:\Windows\System\cPGdJsH.exe
  2⤵
  PID:2468
- C:\Windows\System\nOuagoB.exe
  C:\Windows\System\nOuagoB.exe
  2⤵
  PID:2696
- C:\Windows\System\BmGaSgA.exe
  C:\Windows\System\BmGaSgA.exe
  2⤵
  PID:2820
- C:\Windows\System\aOkzeTQ.exe
  C:\Windows\System\aOkzeTQ.exe
  2⤵
  PID:1664
- C:\Windows\System\pfVXqjL.exe
  C:\Windows\System\pfVXqjL.exe
  2⤵
  PID:2568
- C:\Windows\System\ErhPrDH.exe
  C:\Windows\System\ErhPrDH.exe
  2⤵
  PID:2764
- C:\Windows\System\RNMfkzO.exe
  C:\Windows\System\RNMfkzO.exe
  2⤵
  PID:1684
- C:\Windows\System\vUxuvwQ.exe
  C:\Windows\System\vUxuvwQ.exe
  2⤵
  PID:1056
- C:\Windows\System\UGanbEG.exe
  C:\Windows\System\UGanbEG.exe
  2⤵
  PID:2936
- C:\Windows\System\waDFVDg.exe
  C:\Windows\System\waDFVDg.exe
  2⤵
  PID:316
- C:\Windows\System\yugomrv.exe
  C:\Windows\System\yugomrv.exe
  2⤵
  PID:3004
- C:\Windows\System\ZkXARbV.exe
  C:\Windows\System\ZkXARbV.exe
  2⤵
  PID:2620
- C:\Windows\System\rYgYFOu.exe
  C:\Windows\System\rYgYFOu.exe
  2⤵
  PID:2484
- C:\Windows\System\LiHUdlW.exe
  C:\Windows\System\LiHUdlW.exe
  2⤵
  PID:1320
- C:\Windows\System\bhOVhLm.exe
  C:\Windows\System\bhOVhLm.exe
  2⤵
  PID:2376
- C:\Windows\System\nOnvbPK.exe
  C:\Windows\System\nOnvbPK.exe
  2⤵
  PID:2700
- C:\Windows\System\LFmqVaQ.exe
  C:\Windows\System\LFmqVaQ.exe
  2⤵
  PID:1760
- C:\Windows\System\gajuaAH.exe
  C:\Windows\System\gajuaAH.exe
  2⤵
  PID:1548
- C:\Windows\System\QPMeywO.exe
  C:\Windows\System\QPMeywO.exe
  2⤵
  PID:1420
- C:\Windows\System\UOuNqVL.exe
  C:\Windows\System\UOuNqVL.exe
  2⤵
  PID:1496
- C:\Windows\System\YhfXPag.exe
  C:\Windows\System\YhfXPag.exe
  2⤵
  PID:2720
- C:\Windows\System\FJBfFGx.exe
  C:\Windows\System\FJBfFGx.exe
  2⤵
  PID:2056
- C:\Windows\System\yGVCsja.exe
  C:\Windows\System\yGVCsja.exe
  2⤵
  PID:2340
- C:\Windows\System\PYJfkIl.exe
  C:\Windows\System\PYJfkIl.exe
  2⤵
  PID:2052
- C:\Windows\System\pxHoegC.exe
  C:\Windows\System\pxHoegC.exe
  2⤵
  PID:1952
- C:\Windows\System\RjQMOWM.exe
  C:\Windows\System\RjQMOWM.exe
  2⤵
  PID:2576
- C:\Windows\System\CDTQJxC.exe
  C:\Windows\System\CDTQJxC.exe
  2⤵
  PID:2864
- C:\Windows\System\LjPdUVm.exe
  C:\Windows\System\LjPdUVm.exe
  2⤵
  PID:1528
- C:\Windows\System\xRcUbVl.exe
  C:\Windows\System\xRcUbVl.exe
  2⤵
  PID:2520
- C:\Windows\System\fNruGyX.exe
  C:\Windows\System\fNruGyX.exe
  2⤵
  PID:944
- C:\Windows\System\pjIqQEu.exe
  C:\Windows\System\pjIqQEu.exe
  2⤵
  PID:620
- C:\Windows\System\bTlgpaR.exe
  C:\Windows\System\bTlgpaR.exe
  2⤵
  PID:900
- C:\Windows\System\qcEeEoW.exe
  C:\Windows\System\qcEeEoW.exe
  2⤵
  PID:2152
- C:\Windows\System\SFgZIwZ.exe
  C:\Windows\System\SFgZIwZ.exe
  2⤵
  PID:2928
- C:\Windows\System\FHRGGhF.exe
  C:\Windows\System\FHRGGhF.exe
  2⤵
  PID:2676
- C:\Windows\System\PQZHiEb.exe
  C:\Windows\System\PQZHiEb.exe
  2⤵
  PID:2404
- C:\Windows\System\kfTtyVN.exe
  C:\Windows\System\kfTtyVN.exe
  2⤵
  PID:1728
- C:\Windows\System\pDxMJwO.exe
  C:\Windows\System\pDxMJwO.exe
  2⤵
  PID:2556
- C:\Windows\System\tZTLrsl.exe
  C:\Windows\System\tZTLrsl.exe
  2⤵
  PID:532
- C:\Windows\System\FMRGBdd.exe
  C:\Windows\System\FMRGBdd.exe
  2⤵
  PID:588
- C:\Windows\System\gsqeomX.exe
  C:\Windows\System\gsqeomX.exe
  2⤵
  PID:1148
- C:\Windows\System\ZpdnZYb.exe
  C:\Windows\System\ZpdnZYb.exe
  2⤵
  PID:3076
- C:\Windows\System\bkCxveU.exe
  C:\Windows\System\bkCxveU.exe
  2⤵
  PID:3100
- C:\Windows\System\ppdjxEf.exe
  C:\Windows\System\ppdjxEf.exe
  2⤵
  PID:3116
- C:\Windows\System\svowBLM.exe
  C:\Windows\System\svowBLM.exe
  2⤵
  PID:3132
- C:\Windows\System\aAIAcOz.exe
  C:\Windows\System\aAIAcOz.exe
  2⤵
  PID:3148
- C:\Windows\System\KoxOxmz.exe
  C:\Windows\System\KoxOxmz.exe
  2⤵
  PID:3164
- C:\Windows\System\JaBrgKY.exe
  C:\Windows\System\JaBrgKY.exe
  2⤵
  PID:3184
- C:\Windows\System\srFNXGd.exe
  C:\Windows\System\srFNXGd.exe
  2⤵
  PID:3200
- C:\Windows\System\KTLhgTx.exe
  C:\Windows\System\KTLhgTx.exe
  2⤵
  PID:3356
- C:\Windows\System\QXZBdZt.exe
  C:\Windows\System\QXZBdZt.exe
  2⤵
  PID:3372
- C:\Windows\System\mRaMuLa.exe
  C:\Windows\System\mRaMuLa.exe
  2⤵
  PID:3400
- C:\Windows\System\yoamGGx.exe
  C:\Windows\System\yoamGGx.exe
  2⤵
  PID:3416
- C:\Windows\System\Fhlhhmp.exe
  C:\Windows\System\Fhlhhmp.exe
  2⤵
  PID:3432
- C:\Windows\System\dAmDisN.exe
  C:\Windows\System\dAmDisN.exe
  2⤵
  PID:3452
- C:\Windows\System\aSnCOBJ.exe
  C:\Windows\System\aSnCOBJ.exe
  2⤵
  PID:3472
- C:\Windows\System\UBvmRzV.exe
  C:\Windows\System\UBvmRzV.exe
  2⤵
  PID:3500
- C:\Windows\System\cjoLzLl.exe
  C:\Windows\System\cjoLzLl.exe
  2⤵
  PID:3516
- C:\Windows\System\nUuQZVZ.exe
  C:\Windows\System\nUuQZVZ.exe
  2⤵
  PID:3532
- C:\Windows\System\JAqEKyr.exe
  C:\Windows\System\JAqEKyr.exe
  2⤵
  PID:3548
- C:\Windows\System\PqAZDCM.exe
  C:\Windows\System\PqAZDCM.exe
  2⤵
  PID:3596
- C:\Windows\System\rIOLhhz.exe
  C:\Windows\System\rIOLhhz.exe
  2⤵
  PID:3612
- C:\Windows\System\cepWDCL.exe
  C:\Windows\System\cepWDCL.exe
  2⤵
  PID:3632
- C:\Windows\System\uAxJPUb.exe
  C:\Windows\System\uAxJPUb.exe
  2⤵
  PID:3648
- C:\Windows\System\eyWKnLv.exe
  C:\Windows\System\eyWKnLv.exe
  2⤵
  PID:3664
- C:\Windows\System\xmxfvYt.exe
  C:\Windows\System\xmxfvYt.exe
  2⤵
  PID:3680
- C:\Windows\System\eRsJqLU.exe
  C:\Windows\System\eRsJqLU.exe
  2⤵
  PID:3696
- C:\Windows\System\ZvmmTWw.exe
  C:\Windows\System\ZvmmTWw.exe
  2⤵
  PID:3712
- C:\Windows\System\QgshPew.exe
  C:\Windows\System\QgshPew.exe
  2⤵
  PID:3736
- C:\Windows\System\MbVDbHf.exe
  C:\Windows\System\MbVDbHf.exe
  2⤵
  PID:3752
- C:\Windows\System\BJoxoro.exe
  C:\Windows\System\BJoxoro.exe
  2⤵
  PID:3772
- C:\Windows\System\ytuIIwo.exe
  C:\Windows\System\ytuIIwo.exe
  2⤵
  PID:3788
- C:\Windows\System\GdBOhRq.exe
  C:\Windows\System\GdBOhRq.exe
  2⤵
  PID:3812
- C:\Windows\System\cbRDSRa.exe
  C:\Windows\System\cbRDSRa.exe
  2⤵
  PID:3836
- C:\Windows\System\gFnlTQF.exe
  C:\Windows\System\gFnlTQF.exe
  2⤵
  PID:3852
- C:\Windows\System\SwjaeWf.exe
  C:\Windows\System\SwjaeWf.exe
  2⤵
  PID:3876
- C:\Windows\System\lTuNYZL.exe
  C:\Windows\System\lTuNYZL.exe
  2⤵
  PID:3892
- C:\Windows\System\xyIuWnm.exe
  C:\Windows\System\xyIuWnm.exe
  2⤵
  PID:3912
- C:\Windows\System\ecvHIod.exe
  C:\Windows\System\ecvHIod.exe
  2⤵
  PID:3928
- C:\Windows\System\DVobXgv.exe
  C:\Windows\System\DVobXgv.exe
  2⤵
  PID:3944
- C:\Windows\System\lAqUXlX.exe
  C:\Windows\System\lAqUXlX.exe
  2⤵
  PID:3960
- C:\Windows\System\BOnUzoq.exe
  C:\Windows\System\BOnUzoq.exe
  2⤵
  PID:3976
- C:\Windows\System\AZsMclC.exe
  C:\Windows\System\AZsMclC.exe
  2⤵
  PID:3992
- C:\Windows\System\ejwogKB.exe
  C:\Windows\System\ejwogKB.exe
  2⤵
  PID:4008
- C:\Windows\System\frPDnGB.exe
  C:\Windows\System\frPDnGB.exe
  2⤵
  PID:4028
- C:\Windows\System\VFLgIXP.exe
  C:\Windows\System\VFLgIXP.exe
  2⤵
  PID:4044
- C:\Windows\System\ywkfUkV.exe
  C:\Windows\System\ywkfUkV.exe
  2⤵
  PID:4080
- C:\Windows\System\xTctyaZ.exe
  C:\Windows\System\xTctyaZ.exe
  2⤵
  PID:3128
- C:\Windows\System\CzNYqdE.exe
  C:\Windows\System\CzNYqdE.exe
  2⤵
  PID:3160
- C:\Windows\System\reSOEff.exe
  C:\Windows\System\reSOEff.exe
  2⤵
  PID:3196
- C:\Windows\System\dpNWhhZ.exe
  C:\Windows\System\dpNWhhZ.exe
  2⤵
  PID:3212
- C:\Windows\System\fmnAiFM.exe
  C:\Windows\System\fmnAiFM.exe
  2⤵
  PID:3236
- C:\Windows\System\ymvubnt.exe
  C:\Windows\System\ymvubnt.exe
  2⤵
  PID:3252
- C:\Windows\System\dsjkODL.exe
  C:\Windows\System\dsjkODL.exe
  2⤵
  PID:3268
- C:\Windows\System\WAcUPgT.exe
  C:\Windows\System\WAcUPgT.exe
  2⤵
  PID:3284
- C:\Windows\System\WqskQLb.exe
  C:\Windows\System\WqskQLb.exe
  2⤵
  PID:3300
- C:\Windows\System\IFxMciU.exe
  C:\Windows\System\IFxMciU.exe
  2⤵
  PID:3320
- C:\Windows\System\HXvrgqu.exe
  C:\Windows\System\HXvrgqu.exe
  2⤵
  PID:3336
- C:\Windows\System\GYkCznz.exe
  C:\Windows\System\GYkCznz.exe
  2⤵
  PID:3368
- C:\Windows\System\tZBRqzO.exe
  C:\Windows\System\tZBRqzO.exe
  2⤵
  PID:3384
- C:\Windows\System\pzYdOwY.exe
  C:\Windows\System\pzYdOwY.exe
  2⤵
  PID:3396
- C:\Windows\System\BJFpBrg.exe
  C:\Windows\System\BJFpBrg.exe
  2⤵
  PID:3440
- C:\Windows\System\sKLxgWz.exe
  C:\Windows\System\sKLxgWz.exe
  2⤵
  PID:3464
- C:\Windows\System\VjwJzsD.exe
  C:\Windows\System\VjwJzsD.exe
  2⤵
  PID:3492
- C:\Windows\System\sjhECFA.exe
  C:\Windows\System\sjhECFA.exe
  2⤵
  PID:3528
- C:\Windows\System\fQajlmH.exe
  C:\Windows\System\fQajlmH.exe
  2⤵
  PID:3568
- C:\Windows\System\EoFNswa.exe
  C:\Windows\System\EoFNswa.exe
  2⤵
  PID:3584
- C:\Windows\System\VCFhSGG.exe
  C:\Windows\System\VCFhSGG.exe
  2⤵
  PID:3628
- C:\Windows\System\JfqAgse.exe
  C:\Windows\System\JfqAgse.exe
  2⤵
  PID:3544
- C:\Windows\System\ucUJZMy.exe
  C:\Windows\System\ucUJZMy.exe
  2⤵
  PID:3608
- C:\Windows\System\OiPmTHN.exe
  C:\Windows\System\OiPmTHN.exe
  2⤵
  PID:3676
- C:\Windows\System\zeFOoUB.exe
  C:\Windows\System\zeFOoUB.exe
  2⤵
  PID:3720
- C:\Windows\System\rIiUGBh.exe
  C:\Windows\System\rIiUGBh.exe
  2⤵
  PID:3708
- C:\Windows\System\msTzhRO.exe
  C:\Windows\System\msTzhRO.exe
  2⤵
  PID:3744
- C:\Windows\System\demcVJI.exe
  C:\Windows\System\demcVJI.exe
  2⤵
  PID:3784
- C:\Windows\System\VEuNiyf.exe
  C:\Windows\System\VEuNiyf.exe
  2⤵
  PID:2704
- C:\Windows\System\adFdpWF.exe
  C:\Windows\System\adFdpWF.exe
  2⤵
  PID:3864
- C:\Windows\System\iwtTWCW.exe
  C:\Windows\System\iwtTWCW.exe
  2⤵
  PID:3884
- C:\Windows\System\xrBUjYB.exe
  C:\Windows\System\xrBUjYB.exe
  2⤵
  PID:3924
- C:\Windows\System\IIPAGbv.exe
  C:\Windows\System\IIPAGbv.exe
  2⤵
  PID:3988
- C:\Windows\System\ksVxhBT.exe
  C:\Windows\System\ksVxhBT.exe
  2⤵
  PID:4004
- C:\Windows\System\YqYjDVL.exe
  C:\Windows\System\YqYjDVL.exe
  2⤵
  PID:3940
- C:\Windows\System\UTThEDI.exe
  C:\Windows\System\UTThEDI.exe
  2⤵
  PID:4036
- C:\Windows\System\QhzHAcK.exe
  C:\Windows\System\QhzHAcK.exe
  2⤵
  PID:4060
- C:\Windows\System\aJbyDfx.exe
  C:\Windows\System\aJbyDfx.exe
  2⤵
  PID:4076
- C:\Windows\System\QqhdhQD.exe
  C:\Windows\System\QqhdhQD.exe
  2⤵
  PID:3220
- C:\Windows\System\SegqZKz.exe
  C:\Windows\System\SegqZKz.exe
  2⤵
  PID:3312
- C:\Windows\System\AsDQFuV.exe
  C:\Windows\System\AsDQFuV.exe
  2⤵
  PID:3364
- C:\Windows\System\cRlodIE.exe
  C:\Windows\System\cRlodIE.exe
  2⤵
  PID:3460
- C:\Windows\System\ytXYMNE.exe
  C:\Windows\System\ytXYMNE.exe
  2⤵
  PID:3576
- C:\Windows\System\tRZBxsR.exe
  C:\Windows\System\tRZBxsR.exe
  2⤵
  PID:2252
- C:\Windows\System\IwMSFVt.exe
  C:\Windows\System\IwMSFVt.exe
  2⤵
  PID:3672
- C:\Windows\System\inbrRVm.exe
  C:\Windows\System\inbrRVm.exe
  2⤵
  PID:3264
- C:\Windows\System\YoaNFFY.exe
  C:\Windows\System\YoaNFFY.exe
  2⤵
  PID:3332
- C:\Windows\System\bsIjzHE.exe
  C:\Windows\System\bsIjzHE.exe
  2⤵
  PID:3564
- C:\Windows\System\aiZoEqg.exe
  C:\Windows\System\aiZoEqg.exe
  2⤵
  PID:3732
- C:\Windows\System\whbrWlH.exe
  C:\Windows\System\whbrWlH.exe
  2⤵
  PID:3828
- C:\Windows\System\ImYwZvB.exe
  C:\Windows\System\ImYwZvB.exe
  2⤵
  PID:3904
- C:\Windows\System\ApEoijM.exe
  C:\Windows\System\ApEoijM.exe
  2⤵
  PID:3972
- C:\Windows\System\hfDskNE.exe
  C:\Windows\System\hfDskNE.exe
  2⤵
  PID:4052
- C:\Windows\System\hbgRjAS.exe
  C:\Windows\System\hbgRjAS.exe
  2⤵
  PID:3084
- C:\Windows\System\BugRTDl.exe
  C:\Windows\System\BugRTDl.exe
  2⤵
  PID:2072
- C:\Windows\System\PVrAIle.exe
  C:\Windows\System\PVrAIle.exe
  2⤵
  PID:3248
- C:\Windows\System\jqjAPHg.exe
  C:\Windows\System\jqjAPHg.exe
  2⤵
  PID:3176
- C:\Windows\System\JbQIZrl.exe
  C:\Windows\System\JbQIZrl.exe
  2⤵
  PID:3524
- C:\Windows\System\FpTKgFw.exe
  C:\Windows\System\FpTKgFw.exe
  2⤵
  PID:3172
- C:\Windows\System\GbiUFtH.exe
  C:\Windows\System\GbiUFtH.exe
  2⤵
  PID:3448
- C:\Windows\System\fSKLqlV.exe
  C:\Windows\System\fSKLqlV.exe
  2⤵
  PID:3692
- C:\Windows\System\BfwvwTM.exe
  C:\Windows\System\BfwvwTM.exe
  2⤵
  PID:3660
- C:\Windows\System\TKsXiex.exe
  C:\Windows\System\TKsXiex.exe
  2⤵
  PID:3808
- C:\Windows\System\tlXsGfb.exe
  C:\Windows\System\tlXsGfb.exe
  2⤵
  PID:4020
- C:\Windows\System\sDNUkTW.exe
  C:\Windows\System\sDNUkTW.exe
  2⤵
  PID:3112
- C:\Windows\System\VyGSCou.exe
  C:\Windows\System\VyGSCou.exe
  2⤵
  PID:3380
- C:\Windows\System\ZrFXyhh.exe
  C:\Windows\System\ZrFXyhh.exe
  2⤵
  PID:3216
- C:\Windows\System\xUMVjIh.exe
  C:\Windows\System\xUMVjIh.exe
  2⤵
  PID:3308
- C:\Windows\System\JNwXFkc.exe
  C:\Windows\System\JNwXFkc.exe
  2⤵
  PID:3232
- C:\Windows\System\tLvHkjQ.exe
  C:\Windows\System\tLvHkjQ.exe
  2⤵
  PID:3424
- C:\Windows\System\RXYASLI.exe
  C:\Windows\System\RXYASLI.exe
  2⤵
  PID:3468
- C:\Windows\System\NUUpskT.exe
  C:\Windows\System\NUUpskT.exe
  2⤵
  PID:3800
- C:\Windows\System\nReOWCJ.exe
  C:\Windows\System\nReOWCJ.exe
  2⤵
  PID:3872
- C:\Windows\System\veZbTLP.exe
  C:\Windows\System\veZbTLP.exe
  2⤵
  PID:4072
- C:\Windows\System\EbSQBNm.exe
  C:\Windows\System\EbSQBNm.exe
  2⤵
  PID:2168
- C:\Windows\System\xnebcPa.exe
  C:\Windows\System\xnebcPa.exe
  2⤵
  PID:3496
- C:\Windows\System\RFJRLie.exe
  C:\Windows\System\RFJRLie.exe
  2⤵
  PID:3108
- C:\Windows\System\FNtFbAt.exe
  C:\Windows\System\FNtFbAt.exe
  2⤵
  PID:3276
- C:\Windows\System\toLzRZW.exe
  C:\Windows\System\toLzRZW.exe
  2⤵
  PID:3956
- C:\Windows\System\CanDvtY.exe
  C:\Windows\System\CanDvtY.exe
  2⤵
  PID:3428
- C:\Windows\System\lXMdtiV.exe
  C:\Windows\System\lXMdtiV.exe
  2⤵
  PID:1964
- C:\Windows\System\RnZweep.exe
  C:\Windows\System\RnZweep.exe
  2⤵
  PID:3820
- C:\Windows\System\AKWXeJO.exe
  C:\Windows\System\AKWXeJO.exe
  2⤵
  PID:3620
- C:\Windows\System\jwNzrdZ.exe
  C:\Windows\System\jwNzrdZ.exe
  2⤵
  PID:4112
- C:\Windows\System\UyRXJcY.exe
  C:\Windows\System\UyRXJcY.exe
  2⤵
  PID:4128
- C:\Windows\System\hxJoBhq.exe
  C:\Windows\System\hxJoBhq.exe
  2⤵
  PID:4144
- C:\Windows\System\kcbjByq.exe
  C:\Windows\System\kcbjByq.exe
  2⤵
  PID:4160
- C:\Windows\System\yPWheNl.exe
  C:\Windows\System\yPWheNl.exe
  2⤵
  PID:4180
- C:\Windows\System\KTqSLtO.exe
  C:\Windows\System\KTqSLtO.exe
  2⤵
  PID:4196
- C:\Windows\System\bOxUqmu.exe
  C:\Windows\System\bOxUqmu.exe
  2⤵
  PID:4252
- C:\Windows\System\FsrFksF.exe
  C:\Windows\System\FsrFksF.exe
  2⤵
  PID:4272
- C:\Windows\System\fbxgHVf.exe
  C:\Windows\System\fbxgHVf.exe
  2⤵
  PID:4288
- C:\Windows\System\TrGaDgq.exe
  C:\Windows\System\TrGaDgq.exe
  2⤵
  PID:4304
- C:\Windows\System\qUkOIfP.exe
  C:\Windows\System\qUkOIfP.exe
  2⤵
  PID:4320
- C:\Windows\System\IHiPuta.exe
  C:\Windows\System\IHiPuta.exe
  2⤵
  PID:4340
- C:\Windows\System\kNotVFv.exe
  C:\Windows\System\kNotVFv.exe
  2⤵
  PID:4356
- C:\Windows\System\cdZcVvt.exe
  C:\Windows\System\cdZcVvt.exe
  2⤵
  PID:4372
- C:\Windows\System\RPwSICF.exe
  C:\Windows\System\RPwSICF.exe
  2⤵
  PID:4388
- C:\Windows\System\nXROsrQ.exe
  C:\Windows\System\nXROsrQ.exe
  2⤵
  PID:4404
- C:\Windows\System\yuajSrA.exe
  C:\Windows\System\yuajSrA.exe
  2⤵
  PID:4420
- C:\Windows\System\eVkhkCX.exe
  C:\Windows\System\eVkhkCX.exe
  2⤵
  PID:4436
- C:\Windows\System\VHGPNJZ.exe
  C:\Windows\System\VHGPNJZ.exe
  2⤵
  PID:4456
- C:\Windows\System\aieDAJE.exe
  C:\Windows\System\aieDAJE.exe
  2⤵
  PID:4472
- C:\Windows\System\XaORsHW.exe
  C:\Windows\System\XaORsHW.exe
  2⤵
  PID:4488
- C:\Windows\System\fLsRXSn.exe
  C:\Windows\System\fLsRXSn.exe
  2⤵
  PID:4504
- C:\Windows\System\sVOwOwJ.exe
  C:\Windows\System\sVOwOwJ.exe
  2⤵
  PID:4520
- C:\Windows\System\uSWRdWM.exe
  C:\Windows\System\uSWRdWM.exe
  2⤵
  PID:4536
- C:\Windows\System\AGoDPsK.exe
  C:\Windows\System\AGoDPsK.exe
  2⤵
  PID:4552
- C:\Windows\System\DrCQAVd.exe
  C:\Windows\System\DrCQAVd.exe
  2⤵
  PID:4568
- C:\Windows\System\UpGxBZC.exe
  C:\Windows\System\UpGxBZC.exe
  2⤵
  PID:4584
- C:\Windows\System\tNJoSao.exe
  C:\Windows\System\tNJoSao.exe
  2⤵
  PID:4608
- C:\Windows\System\xhENSwx.exe
  C:\Windows\System\xhENSwx.exe
  2⤵
  PID:4632
- C:\Windows\System\nQrFjTp.exe
  C:\Windows\System\nQrFjTp.exe
  2⤵
  PID:4648
- C:\Windows\System\bxHymIY.exe
  C:\Windows\System\bxHymIY.exe
  2⤵
  PID:4664
- C:\Windows\System\WDqSYLS.exe
  C:\Windows\System\WDqSYLS.exe
  2⤵
  PID:4680
- C:\Windows\System\FtTJJpm.exe
  C:\Windows\System\FtTJJpm.exe
  2⤵
  PID:4700
- C:\Windows\System\IsHWLRO.exe
  C:\Windows\System\IsHWLRO.exe
  2⤵
  PID:4716
- C:\Windows\System\NHnFYQf.exe
  C:\Windows\System\NHnFYQf.exe
  2⤵
  PID:4732
- C:\Windows\System\ButXeVt.exe
  C:\Windows\System\ButXeVt.exe
  2⤵
  PID:4756
- C:\Windows\System\cJshGPh.exe
  C:\Windows\System\cJshGPh.exe
  2⤵
  PID:4772
- C:\Windows\System\orMfxlh.exe
  C:\Windows\System\orMfxlh.exe
  2⤵
  PID:4788
- C:\Windows\System\SftpFIA.exe
  C:\Windows\System\SftpFIA.exe
  2⤵
  PID:4804
- C:\Windows\System\zSXfvGc.exe
  C:\Windows\System\zSXfvGc.exe
  2⤵
  PID:4820
- C:\Windows\System\IKjhNoU.exe
  C:\Windows\System\IKjhNoU.exe
  2⤵
  PID:4836
- C:\Windows\System\TkkiVMX.exe
  C:\Windows\System\TkkiVMX.exe
  2⤵
  PID:4852
- C:\Windows\System\KZFrBsd.exe
  C:\Windows\System\KZFrBsd.exe
  2⤵
  PID:4868
- C:\Windows\System\JoHkkbs.exe
  C:\Windows\System\JoHkkbs.exe
  2⤵
  PID:4884
- C:\Windows\System\YoCNIyG.exe
  C:\Windows\System\YoCNIyG.exe
  2⤵
  PID:4904
- C:\Windows\System\JjYVAzK.exe
  C:\Windows\System\JjYVAzK.exe
  2⤵
  PID:4920
- C:\Windows\System\ZesVdSU.exe
  C:\Windows\System\ZesVdSU.exe
  2⤵
  PID:4936
- C:\Windows\System\RIQEuDd.exe
  C:\Windows\System\RIQEuDd.exe
  2⤵
  PID:4952
- C:\Windows\System\qImaRyo.exe
  C:\Windows\System\qImaRyo.exe
  2⤵
  PID:4968
- C:\Windows\System\HpNeFlX.exe
  C:\Windows\System\HpNeFlX.exe
  2⤵
  PID:4984
- C:\Windows\System\HimIGfY.exe
  C:\Windows\System\HimIGfY.exe
  2⤵
  PID:5000
- C:\Windows\System\NDMSApc.exe
  C:\Windows\System\NDMSApc.exe
  2⤵
  PID:5016
- C:\Windows\System\sjlCaZZ.exe
  C:\Windows\System\sjlCaZZ.exe
  2⤵
  PID:5032
- C:\Windows\System\BNZtUHH.exe
  C:\Windows\System\BNZtUHH.exe
  2⤵
  PID:5048
- C:\Windows\System\vNrIJGm.exe
  C:\Windows\System\vNrIJGm.exe
  2⤵
  PID:5064
- C:\Windows\System\zmJUrQv.exe
  C:\Windows\System\zmJUrQv.exe
  2⤵
  PID:5080
- C:\Windows\System\taiuEah.exe
  C:\Windows\System\taiuEah.exe
  2⤵
  PID:5096
- C:\Windows\System\FPCaALt.exe
  C:\Windows\System\FPCaALt.exe
  2⤵
  PID:4104
- C:\Windows\System\sGakdoR.exe
  C:\Windows\System\sGakdoR.exe
  2⤵
  PID:4176
- C:\Windows\System\HcwQwpN.exe
  C:\Windows\System\HcwQwpN.exe
  2⤵
  PID:4092
- C:\Windows\System\XRYFDYX.exe
  C:\Windows\System\XRYFDYX.exe
  2⤵
  PID:4120
- C:\Windows\System\nXuQJqk.exe
  C:\Windows\System\nXuQJqk.exe
  2⤵
  PID:4124
- C:\Windows\System\zPASGaC.exe
  C:\Windows\System\zPASGaC.exe
  2⤵
  PID:4216
- C:\Windows\System\cHfqsdG.exe
  C:\Windows\System\cHfqsdG.exe
  2⤵
  PID:4232
- C:\Windows\System\uZXeFgr.exe
  C:\Windows\System\uZXeFgr.exe
  2⤵
  PID:4248
- C:\Windows\System\qcVchmI.exe
  C:\Windows\System\qcVchmI.exe
  2⤵
  PID:4300
- C:\Windows\System\gmDseHA.exe
  C:\Windows\System\gmDseHA.exe
  2⤵
  PID:4348
- C:\Windows\System\HRjbMCi.exe
  C:\Windows\System\HRjbMCi.exe
  2⤵
  PID:4352
- C:\Windows\System\MiYgOrX.exe
  C:\Windows\System\MiYgOrX.exe
  2⤵
  PID:4416
- C:\Windows\System\mAmkBBE.exe
  C:\Windows\System\mAmkBBE.exe
  2⤵
  PID:4480
- C:\Windows\System\IgfvQKv.exe
  C:\Windows\System\IgfvQKv.exe
  2⤵
  PID:4544
- C:\Windows\System\rKfabja.exe
  C:\Windows\System\rKfabja.exe
  2⤵
  PID:4364
- C:\Windows\System\GACvJDi.exe
  C:\Windows\System\GACvJDi.exe
  2⤵
  PID:4532
- C:\Windows\System\NUnHdUE.exe
  C:\Windows\System\NUnHdUE.exe
  2⤵
  PID:4368
- C:\Windows\System\NuHMwNb.exe
  C:\Windows\System\NuHMwNb.exe
  2⤵
  PID:4592
- C:\Windows\System\TXmVkGv.exe
  C:\Windows\System\TXmVkGv.exe
  2⤵
  PID:4628
- C:\Windows\System\WtgJgyX.exe
  C:\Windows\System\WtgJgyX.exe
  2⤵
  PID:4688
- C:\Windows\System\FkBybmM.exe
  C:\Windows\System\FkBybmM.exe
  2⤵
  PID:4724
- C:\Windows\System\PKWoDRD.exe
  C:\Windows\System\PKWoDRD.exe
  2⤵
  PID:4644
- C:\Windows\System\lCipbmH.exe
  C:\Windows\System\lCipbmH.exe
  2⤵
  PID:4752
- C:\Windows\System\KiPnrKj.exe
  C:\Windows\System\KiPnrKj.exe
  2⤵
  PID:4780
- C:\Windows\System\LvFsJlW.exe
  C:\Windows\System\LvFsJlW.exe
  2⤵
  PID:4784
- C:\Windows\System\vXZkkPS.exe
  C:\Windows\System\vXZkkPS.exe
  2⤵
  PID:4848
- C:\Windows\System\dudgGYJ.exe
  C:\Windows\System\dudgGYJ.exe
  2⤵
  PID:4928
- C:\Windows\System\jwxgNET.exe
  C:\Windows\System\jwxgNET.exe
  2⤵
  PID:4960
- C:\Windows\System\AMqnAJp.exe
  C:\Windows\System\AMqnAJp.exe
  2⤵
  PID:5028
- C:\Windows\System\IxFemye.exe
  C:\Windows\System\IxFemye.exe
  2⤵
  PID:5092
- C:\Windows\System\FmBRkzq.exe
  C:\Windows\System\FmBRkzq.exe
  2⤵
  PID:5104
- C:\Windows\System\QDpHhjP.exe
  C:\Windows\System\QDpHhjP.exe
  2⤵
  PID:5072
- C:\Windows\System\EdoHcub.exe
  C:\Windows\System\EdoHcub.exe
  2⤵
  PID:4976
- C:\Windows\System\tZhaxql.exe
  C:\Windows\System\tZhaxql.exe
  2⤵
  PID:4140
- C:\Windows\System\wPzFvSt.exe
  C:\Windows\System\wPzFvSt.exe
  2⤵
  PID:2008
- C:\Windows\System\yZdOWNV.exe
  C:\Windows\System\yZdOWNV.exe
  2⤵
  PID:4212
- C:\Windows\System\tXKNlvF.exe
  C:\Windows\System\tXKNlvF.exe
  2⤵
  PID:3796
- C:\Windows\System\MmVvtRe.exe
  C:\Windows\System\MmVvtRe.exe
  2⤵
  PID:2012
- C:\Windows\System\sjRrZbi.exe
  C:\Windows\System\sjRrZbi.exe
  2⤵
  PID:4228
- C:\Windows\System\WeZzHyV.exe
  C:\Windows\System\WeZzHyV.exe
  2⤵
  PID:4516
- C:\Windows\System\usnLbOH.exe
  C:\Windows\System\usnLbOH.exe
  2⤵
  PID:4528
- C:\Windows\System\chZlusm.exe
  C:\Windows\System\chZlusm.exe
  2⤵
  PID:4580
- C:\Windows\System\GcFNBnV.exe
  C:\Windows\System\GcFNBnV.exe
  2⤵
  PID:4564
- C:\Windows\System\oYEOFVP.exe
  C:\Windows\System\oYEOFVP.exe
  2⤵
  PID:4616
- C:\Windows\System\zMKwLOa.exe
  C:\Windows\System\zMKwLOa.exe
  2⤵
  PID:4708
- C:\Windows\System\gMfANfD.exe
  C:\Windows\System\gMfANfD.exe
  2⤵
  PID:4800
- C:\Windows\System\RaDtbsW.exe
  C:\Windows\System\RaDtbsW.exe
  2⤵
  PID:4864
- C:\Windows\System\IdRkkFl.exe
  C:\Windows\System\IdRkkFl.exe
  2⤵
  PID:5060
- C:\Windows\System\KoDcSEL.exe
  C:\Windows\System\KoDcSEL.exe
  2⤵
  PID:4604
- C:\Windows\System\LCKOcCQ.exe
  C:\Windows\System\LCKOcCQ.exe
  2⤵
  PID:4992
- C:\Windows\System\xOECkIq.exe
  C:\Windows\System\xOECkIq.exe
  2⤵
  PID:4812
- C:\Windows\System\BeZlMyv.exe
  C:\Windows\System\BeZlMyv.exe
  2⤵
  PID:4916
- C:\Windows\System\KstAAlP.exe
  C:\Windows\System\KstAAlP.exe
  2⤵
  PID:4464
- C:\Windows\System\xqlSzPe.exe
  C:\Windows\System\xqlSzPe.exe
  2⤵
  PID:4912
- C:\Windows\System\BmPxTzP.exe
  C:\Windows\System\BmPxTzP.exe
  2⤵
  PID:4696
- C:\Windows\System\wUKhxyY.exe
  C:\Windows\System\wUKhxyY.exe
  2⤵
  PID:4284
- C:\Windows\System\flLAzOr.exe
  C:\Windows\System\flLAzOr.exe
  2⤵
  PID:5044
- C:\Windows\System\pcVEVzP.exe
  C:\Windows\System\pcVEVzP.exe
  2⤵
  PID:4332
- C:\Windows\System\XzSZqCV.exe
  C:\Windows\System\XzSZqCV.exe
  2⤵
  PID:1996
- C:\Windows\System\KURednh.exe
  C:\Windows\System\KURednh.exe
  2⤵
  PID:5008
- C:\Windows\System\YyCCkYR.exe
  C:\Windows\System\YyCCkYR.exe
  2⤵
  PID:4208
- C:\Windows\System\sLbaDQV.exe
  C:\Windows\System\sLbaDQV.exe
  2⤵
  PID:5056
- C:\Windows\System\GHQQyon.exe
  C:\Windows\System\GHQQyon.exe
  2⤵
  PID:4296
- C:\Windows\System\uNACWUk.exe
  C:\Windows\System\uNACWUk.exe
  2⤵
  PID:4056
- C:\Windows\System\gMeezDy.exe
  C:\Windows\System\gMeezDy.exe
  2⤵
  PID:4816
- C:\Windows\System\OGXroVj.exe
  C:\Windows\System\OGXroVj.exe
  2⤵
  PID:4832
- C:\Windows\System\WEWtbsb.exe
  C:\Windows\System\WEWtbsb.exe
  2⤵
  PID:4448
- C:\Windows\System\YOMuoMM.exe
  C:\Windows\System\YOMuoMM.exe
  2⤵
  PID:4640
- C:\Windows\System\akvkhpa.exe
  C:\Windows\System\akvkhpa.exe
  2⤵
  PID:5136
- C:\Windows\System\CthtwUL.exe
  C:\Windows\System\CthtwUL.exe
  2⤵
  PID:5152
- C:\Windows\System\XDoRjRp.exe
  C:\Windows\System\XDoRjRp.exe
  2⤵
  PID:5168
- C:\Windows\System\KuIffWK.exe
  C:\Windows\System\KuIffWK.exe
  2⤵
  PID:5184
- C:\Windows\System\QhJhhFK.exe
  C:\Windows\System\QhJhhFK.exe
  2⤵
  PID:5200
- C:\Windows\System\vptvVug.exe
  C:\Windows\System\vptvVug.exe
  2⤵
  PID:5216
- C:\Windows\System\XDKVScO.exe
  C:\Windows\System\XDKVScO.exe
  2⤵
  PID:5236
- C:\Windows\System\BcDKDpo.exe
  C:\Windows\System\BcDKDpo.exe
  2⤵
  PID:5252
- C:\Windows\System\PmEjGzF.exe
  C:\Windows\System\PmEjGzF.exe
  2⤵
  PID:5268
- C:\Windows\System\XfGahYU.exe
  C:\Windows\System\XfGahYU.exe
  2⤵
  PID:5284
- C:\Windows\System\FPbTHfF.exe
  C:\Windows\System\FPbTHfF.exe
  2⤵
  PID:5300
- C:\Windows\System\iNavdnV.exe
  C:\Windows\System\iNavdnV.exe
  2⤵
  PID:5316
- C:\Windows\System\KEXXQUD.exe
  C:\Windows\System\KEXXQUD.exe
  2⤵
  PID:5340
- C:\Windows\System\TqCJKrl.exe
  C:\Windows\System\TqCJKrl.exe
  2⤵
  PID:5356
- C:\Windows\System\johUmtf.exe
  C:\Windows\System\johUmtf.exe
  2⤵
  PID:5376
- C:\Windows\System\jUPRIIa.exe
  C:\Windows\System\jUPRIIa.exe
  2⤵
  PID:5392
- C:\Windows\System\PzPOQAL.exe
  C:\Windows\System\PzPOQAL.exe
  2⤵
  PID:5408
- C:\Windows\System\nLdncfF.exe
  C:\Windows\System\nLdncfF.exe
  2⤵
  PID:5424
- C:\Windows\System\igDAGtc.exe
  C:\Windows\System\igDAGtc.exe
  2⤵
  PID:5440
- C:\Windows\System\XuaMUTP.exe
  C:\Windows\System\XuaMUTP.exe
  2⤵
  PID:5456
- C:\Windows\System\boyVnwQ.exe
  C:\Windows\System\boyVnwQ.exe
  2⤵
  PID:5472
- C:\Windows\System\YWhAjSe.exe
  C:\Windows\System\YWhAjSe.exe
  2⤵
  PID:5488
- C:\Windows\System\pvyKjve.exe
  C:\Windows\System\pvyKjve.exe
  2⤵
  PID:5504
- C:\Windows\System\jszOCyC.exe
  C:\Windows\System\jszOCyC.exe
  2⤵
  PID:5520
- C:\Windows\System\xdurYrY.exe
  C:\Windows\System\xdurYrY.exe
  2⤵
  PID:5536
- C:\Windows\System\iayBFTn.exe
  C:\Windows\System\iayBFTn.exe
  2⤵
  PID:5552
- C:\Windows\System\vhVJzCH.exe
  C:\Windows\System\vhVJzCH.exe
  2⤵
  PID:5568
- C:\Windows\System\qBIARMc.exe
  C:\Windows\System\qBIARMc.exe
  2⤵
  PID:5584
- C:\Windows\System\cZLROfD.exe
  C:\Windows\System\cZLROfD.exe
  2⤵
  PID:5600
- C:\Windows\System\NQkXPTK.exe
  C:\Windows\System\NQkXPTK.exe
  2⤵
  PID:5616
- C:\Windows\System\TCyEboh.exe
  C:\Windows\System\TCyEboh.exe
  2⤵
  PID:5632
- C:\Windows\System\KMxPcnn.exe
  C:\Windows\System\KMxPcnn.exe
  2⤵
  PID:5648
- C:\Windows\System\lWIFWRi.exe
  C:\Windows\System\lWIFWRi.exe
  2⤵
  PID:5664
- C:\Windows\System\ZnVtrsf.exe
  C:\Windows\System\ZnVtrsf.exe
  2⤵
  PID:5680
- C:\Windows\System\pWgfCPD.exe
  C:\Windows\System\pWgfCPD.exe
  2⤵
  PID:5696
- C:\Windows\System\NEkjYxj.exe
  C:\Windows\System\NEkjYxj.exe
  2⤵
  PID:5712
- C:\Windows\System\LOTnMEu.exe
  C:\Windows\System\LOTnMEu.exe
  2⤵
  PID:5728
- C:\Windows\System\mCbMthz.exe
  C:\Windows\System\mCbMthz.exe
  2⤵
  PID:5744
- C:\Windows\System\RSqyfGp.exe
  C:\Windows\System\RSqyfGp.exe
  2⤵
  PID:5760
- C:\Windows\System\TFlqpMK.exe
  C:\Windows\System\TFlqpMK.exe
  2⤵
  PID:5776
- C:\Windows\System\vWsKnKY.exe
  C:\Windows\System\vWsKnKY.exe
  2⤵
  PID:5792
- C:\Windows\System\rREZQJS.exe
  C:\Windows\System\rREZQJS.exe
  2⤵
  PID:5808
- C:\Windows\System\qYPlYuq.exe
  C:\Windows\System\qYPlYuq.exe
  2⤵
  PID:5824
- C:\Windows\System\RJSFmtq.exe
  C:\Windows\System\RJSFmtq.exe
  2⤵
  PID:5840
- C:\Windows\System\orRyUMe.exe
  C:\Windows\System\orRyUMe.exe
  2⤵
  PID:5856
- C:\Windows\System\OGnZIUN.exe
  C:\Windows\System\OGnZIUN.exe
  2⤵
  PID:5872
- C:\Windows\System\mxnePup.exe
  C:\Windows\System\mxnePup.exe
  2⤵
  PID:5888
- C:\Windows\System\SaRZJyX.exe
  C:\Windows\System\SaRZJyX.exe
  2⤵
  PID:5904
- C:\Windows\System\BFUMnar.exe
  C:\Windows\System\BFUMnar.exe
  2⤵
  PID:5920
- C:\Windows\System\LmXkUKB.exe
  C:\Windows\System\LmXkUKB.exe
  2⤵
  PID:5936
- C:\Windows\System\fUSGBaD.exe
  C:\Windows\System\fUSGBaD.exe
  2⤵
  PID:5956
- C:\Windows\System\XJAxVVA.exe
  C:\Windows\System\XJAxVVA.exe
  2⤵
  PID:5972
- C:\Windows\System\jfcxdjx.exe
  C:\Windows\System\jfcxdjx.exe
  2⤵
  PID:5988
- C:\Windows\System\egFgWBz.exe
  C:\Windows\System\egFgWBz.exe
  2⤵
  PID:6004
- C:\Windows\System\GBjmGyu.exe
  C:\Windows\System\GBjmGyu.exe
  2⤵
  PID:6020
- C:\Windows\System\SQiiNFH.exe
  C:\Windows\System\SQiiNFH.exe
  2⤵
  PID:6036
- C:\Windows\System\UfaJjzU.exe
  C:\Windows\System\UfaJjzU.exe
  2⤵
  PID:6052
- C:\Windows\System\KnJWUIk.exe
  C:\Windows\System\KnJWUIk.exe
  2⤵
  PID:6068
- C:\Windows\System\QErQXZc.exe
  C:\Windows\System\QErQXZc.exe
  2⤵
  PID:6084
- C:\Windows\System\AJYwoxT.exe
  C:\Windows\System\AJYwoxT.exe
  2⤵
  PID:6104
- C:\Windows\System\KwjentJ.exe
  C:\Windows\System\KwjentJ.exe
  2⤵
  PID:6120
- C:\Windows\System\EgUOxfa.exe
  C:\Windows\System\EgUOxfa.exe
  2⤵
  PID:6136
- C:\Windows\System\LdvVQKy.exe
  C:\Windows\System\LdvVQKy.exe
  2⤵
  PID:4676
- C:\Windows\System\DuVDWkz.exe
  C:\Windows\System\DuVDWkz.exe
  2⤵
  PID:4796
- C:\Windows\System\WWpdbrl.exe
  C:\Windows\System\WWpdbrl.exe
  2⤵
  PID:5176
- C:\Windows\System\aipOipA.exe
  C:\Windows\System\aipOipA.exe
  2⤵
  PID:5248
- C:\Windows\System\WlljrCC.exe
  C:\Windows\System\WlljrCC.exe
  2⤵
  PID:5348
- C:\Windows\System\EMGyrvN.exe
  C:\Windows\System\EMGyrvN.exe
  2⤵
  PID:5160
- C:\Windows\System\IFFijtS.exe
  C:\Windows\System\IFFijtS.exe
  2⤵
  PID:5388
- C:\Windows\System\APQugqi.exe
  C:\Windows\System\APQugqi.exe
  2⤵
  PID:5448
- C:\Windows\System\shKkAtS.exe
  C:\Windows\System\shKkAtS.exe
  2⤵
  PID:5484
- C:\Windows\System\KAKgJdX.exe
  C:\Windows\System\KAKgJdX.exe
  2⤵
  PID:5336
- C:\Windows\System\KNQgKrr.exe
  C:\Windows\System\KNQgKrr.exe
  2⤵
  PID:5228
- C:\Windows\System\vbwkmBN.exe
  C:\Windows\System\vbwkmBN.exe
  2⤵
  PID:5500
- C:\Windows\System\pnnIJAq.exe
  C:\Windows\System\pnnIJAq.exe
  2⤵
  PID:5468
- C:\Windows\System\gQwkxCQ.exe
  C:\Windows\System\gQwkxCQ.exe
  2⤵
  PID:5544
- C:\Windows\System\NuMPdwh.exe
  C:\Windows\System\NuMPdwh.exe
  2⤵
  PID:5528
- C:\Windows\System\gZCxkhh.exe
  C:\Windows\System\gZCxkhh.exe
  2⤵
  PID:5612
- C:\Windows\System\tRhBTzk.exe
  C:\Windows\System\tRhBTzk.exe
  2⤵
  PID:5624
- C:\Windows\System\fCPpZbf.exe
  C:\Windows\System\fCPpZbf.exe
  2⤵
  PID:5704
- C:\Windows\System\DTDXVwt.exe
  C:\Windows\System\DTDXVwt.exe
  2⤵
  PID:5628
- C:\Windows\System\vsTJdAQ.exe
  C:\Windows\System\vsTJdAQ.exe
  2⤵
  PID:5740
- C:\Windows\System\WVkPyGc.exe
  C:\Windows\System\WVkPyGc.exe
  2⤵
  PID:5724
- C:\Windows\System\wEHvToL.exe
  C:\Windows\System\wEHvToL.exe
  2⤵
  PID:5756
- C:\Windows\System\jzMXqwc.exe
  C:\Windows\System\jzMXqwc.exe
  2⤵
  PID:5868
- C:\Windows\System\FAAsYOo.exe
  C:\Windows\System\FAAsYOo.exe
  2⤵
  PID:5912
- C:\Windows\System\KsdOvfr.exe
  C:\Windows\System\KsdOvfr.exe
  2⤵
  PID:5884
- C:\Windows\System\xrWURwH.exe
  C:\Windows\System\xrWURwH.exe
  2⤵
  PID:5932
- C:\Windows\System\caNwHju.exe
  C:\Windows\System\caNwHju.exe
  2⤵
  PID:6000
- C:\Windows\System\pkptHHk.exe
  C:\Windows\System\pkptHHk.exe
  2⤵
  PID:6044
- C:\Windows\System\svwpMJa.exe
  C:\Windows\System\svwpMJa.exe
  2⤵
  PID:5980
- C:\Windows\System\YPxHBMx.exe
  C:\Windows\System\YPxHBMx.exe
  2⤵
  PID:6092
- C:\Windows\System\IMlCkBZ.exe
  C:\Windows\System\IMlCkBZ.exe
  2⤵
  PID:6128
- C:\Windows\System\jmvIWlx.exe
  C:\Windows\System\jmvIWlx.exe
  2⤵
  PID:6132
- C:\Windows\System\MVUwSlG.exe
  C:\Windows\System\MVUwSlG.exe
  2⤵
  PID:4900
- C:\Windows\System\JVycKOI.exe
  C:\Windows\System\JVycKOI.exe
  2⤵
  PID:5212
- C:\Windows\System\BmngCSL.exe
  C:\Windows\System\BmngCSL.exe
  2⤵
  PID:5364
- C:\Windows\System\MqQotXo.exe
  C:\Windows\System\MqQotXo.exe
  2⤵
  PID:5480
- C:\Windows\System\lcfkRhH.exe
  C:\Windows\System\lcfkRhH.exe
  2⤵
  PID:5328
- C:\Windows\System\pamgUbK.exe
  C:\Windows\System\pamgUbK.exe
  2⤵
  PID:5192
- C:\Windows\System\fHfoLKL.exe
  C:\Windows\System\fHfoLKL.exe
  2⤵
  PID:5264
- C:\Windows\System\fRmzGPm.exe
  C:\Windows\System\fRmzGPm.exe
  2⤵
  PID:5576
- C:\Windows\System\oIuUMNx.exe
  C:\Windows\System\oIuUMNx.exe
  2⤵
  PID:5560
- C:\Windows\System\aZCOOHw.exe
  C:\Windows\System\aZCOOHw.exe
  2⤵
  PID:5676
- C:\Windows\System\wlbuXMp.exe
  C:\Windows\System\wlbuXMp.exe
  2⤵
  PID:5784
- C:\Windows\System\zfDXGZd.exe
  C:\Windows\System\zfDXGZd.exe
  2⤵
  PID:5880
- C:\Windows\System\CVnKOJB.exe
  C:\Windows\System\CVnKOJB.exe
  2⤵
  PID:6064
- C:\Windows\System\LuAYDbX.exe
  C:\Windows\System\LuAYDbX.exe
  2⤵
  PID:5148
- C:\Windows\System\BZoEjlj.exe
  C:\Windows\System\BZoEjlj.exe
  2⤵
  PID:5232
- C:\Windows\System\NopnNDo.exe
  C:\Windows\System\NopnNDo.exe
  2⤵
  PID:5836
- C:\Windows\System\QItwycA.exe
  C:\Windows\System\QItwycA.exe
  2⤵
  PID:5372
- C:\Windows\System\yJxNKvN.exe
  C:\Windows\System\yJxNKvN.exe
  2⤵
  PID:5692
- C:\Windows\System\VMhuZmU.exe
  C:\Windows\System\VMhuZmU.exe
  2⤵
  PID:6048
- C:\Windows\System\PTUJQEP.exe
  C:\Windows\System\PTUJQEP.exe
  2⤵
  PID:5952
- C:\Windows\System\xwhGMjS.exe
  C:\Windows\System\xwhGMjS.exe
  2⤵
  PID:5864
- C:\Windows\System\beRrErY.exe
  C:\Windows\System\beRrErY.exe
  2⤵
  PID:5608
- C:\Windows\System\qgZedyq.exe
  C:\Windows\System\qgZedyq.exe
  2⤵
  PID:5772
- C:\Windows\System\ObMgbqG.exe
  C:\Windows\System\ObMgbqG.exe
  2⤵
  PID:6076
- C:\Windows\System\CCxZSkb.exe
  C:\Windows\System\CCxZSkb.exe
  2⤵
  PID:5948
- C:\Windows\System\aWbaeTX.exe
  C:\Windows\System\aWbaeTX.exe
  2⤵
  PID:5660
- C:\Windows\System\pFwRSQj.exe
  C:\Windows\System\pFwRSQj.exe
  2⤵
  PID:5312
- C:\Windows\System\ejOPHQL.exe
  C:\Windows\System\ejOPHQL.exe
  2⤵
  PID:5496
- C:\Windows\System\RaTvYaY.exe
  C:\Windows\System\RaTvYaY.exe
  2⤵
  PID:5132
- C:\Windows\System\Lmacqwy.exe
  C:\Windows\System\Lmacqwy.exe
  2⤵
  PID:5916
- C:\Windows\System\vKfGATO.exe
  C:\Windows\System\vKfGATO.exe
  2⤵
  PID:5532
- C:\Windows\System\ECaJCBg.exe
  C:\Windows\System\ECaJCBg.exe
  2⤵
  PID:5280
- C:\Windows\System\oSWaAil.exe
  C:\Windows\System\oSWaAil.exe
  2⤵
  PID:6100
- C:\Windows\System\KldLNJk.exe
  C:\Windows\System\KldLNJk.exe
  2⤵
  PID:6156
- C:\Windows\System\HACpZLs.exe
  C:\Windows\System\HACpZLs.exe
  2⤵
  PID:6172
- C:\Windows\System\MxiobNi.exe
  C:\Windows\System\MxiobNi.exe
  2⤵
  PID:6188
- C:\Windows\System\LaCtsog.exe
  C:\Windows\System\LaCtsog.exe
  2⤵
  PID:6204
- C:\Windows\System\avTyPOI.exe
  C:\Windows\System\avTyPOI.exe
  2⤵
  PID:6220
- C:\Windows\System\gwGiOyE.exe
  C:\Windows\System\gwGiOyE.exe
  2⤵
  PID:6240
- C:\Windows\System\hEqtxGD.exe
  C:\Windows\System\hEqtxGD.exe
  2⤵
  PID:6264
- C:\Windows\System\OAtVwBS.exe
  C:\Windows\System\OAtVwBS.exe
  2⤵
  PID:6284
- C:\Windows\System\SwtuFgf.exe
  C:\Windows\System\SwtuFgf.exe
  2⤵
  PID:6300
- C:\Windows\System\dQzfefc.exe
  C:\Windows\System\dQzfefc.exe
  2⤵
  PID:6316
- C:\Windows\System\zXYvJFy.exe
  C:\Windows\System\zXYvJFy.exe
  2⤵
  PID:6332
- C:\Windows\System\xusYQGW.exe
  C:\Windows\System\xusYQGW.exe
  2⤵
  PID:6348
- C:\Windows\System\SzXXUIP.exe
  C:\Windows\System\SzXXUIP.exe
  2⤵
  PID:6368
- C:\Windows\System\cTtyumw.exe
  C:\Windows\System\cTtyumw.exe
  2⤵
  PID:6384
- C:\Windows\System\kLJSQBr.exe
  C:\Windows\System\kLJSQBr.exe
  2⤵
  PID:6400
- C:\Windows\System\rqPXsYZ.exe
  C:\Windows\System\rqPXsYZ.exe
  2⤵
  PID:6416
- C:\Windows\System\XOCgYmN.exe
  C:\Windows\System\XOCgYmN.exe
  2⤵
  PID:6436
- C:\Windows\System\vrZBELM.exe
  C:\Windows\System\vrZBELM.exe
  2⤵
  PID:6452
- C:\Windows\System\tVHUwny.exe
  C:\Windows\System\tVHUwny.exe
  2⤵
  PID:6468
- C:\Windows\System\RJVQcGh.exe
  C:\Windows\System\RJVQcGh.exe
  2⤵
  PID:6488
- C:\Windows\System\DZaEJDL.exe
  C:\Windows\System\DZaEJDL.exe
  2⤵
  PID:6504
- C:\Windows\System\lBdQXZB.exe
  C:\Windows\System\lBdQXZB.exe
  2⤵
  PID:6520
- C:\Windows\System\kYcDPWk.exe
  C:\Windows\System\kYcDPWk.exe
  2⤵
  PID:6536
- C:\Windows\System\peGHDnA.exe
  C:\Windows\System\peGHDnA.exe
  2⤵
  PID:6552
- C:\Windows\System\zpRZJjD.exe
  C:\Windows\System\zpRZJjD.exe
  2⤵
  PID:6568
- C:\Windows\System\PgeHZmR.exe
  C:\Windows\System\PgeHZmR.exe
  2⤵
  PID:6584
- C:\Windows\System\ZnPgFCZ.exe
  C:\Windows\System\ZnPgFCZ.exe
  2⤵
  PID:6600
- C:\Windows\System\xTnoicL.exe
  C:\Windows\System\xTnoicL.exe
  2⤵
  PID:6616
- C:\Windows\System\saYMXCO.exe
  C:\Windows\System\saYMXCO.exe
  2⤵
  PID:6636
- C:\Windows\System\ymsUAfl.exe
  C:\Windows\System\ymsUAfl.exe
  2⤵
  PID:6652
- C:\Windows\System\VnbMGsm.exe
  C:\Windows\System\VnbMGsm.exe
  2⤵
  PID:6668
- C:\Windows\System\GhIOsxn.exe
  C:\Windows\System\GhIOsxn.exe
  2⤵
  PID:6684
- C:\Windows\System\LFjIWaW.exe
  C:\Windows\System\LFjIWaW.exe
  2⤵
  PID:6700
- C:\Windows\System\ffZcNeo.exe
  C:\Windows\System\ffZcNeo.exe
  2⤵
  PID:6716
- C:\Windows\System\sQwuBMK.exe
  C:\Windows\System\sQwuBMK.exe
  2⤵
  PID:6732
- C:\Windows\System\kQecVPl.exe
  C:\Windows\System\kQecVPl.exe
  2⤵
  PID:6752
- C:\Windows\System\XJevcTx.exe
  C:\Windows\System\XJevcTx.exe
  2⤵
  PID:6768
- C:\Windows\System\bzcIqRH.exe
  C:\Windows\System\bzcIqRH.exe
  2⤵
  PID:6788
- C:\Windows\System\zbllrRI.exe
  C:\Windows\System\zbllrRI.exe
  2⤵
  PID:6804
- C:\Windows\System\RYMgUGt.exe
  C:\Windows\System\RYMgUGt.exe
  2⤵
  PID:6820
- C:\Windows\System\LUvhEMc.exe
  C:\Windows\System\LUvhEMc.exe
  2⤵
  PID:6836
- C:\Windows\System\eIkvOgb.exe
  C:\Windows\System\eIkvOgb.exe
  2⤵
  PID:6852
- C:\Windows\System\casHrFE.exe
  C:\Windows\System\casHrFE.exe
  2⤵
  PID:6868
- C:\Windows\System\WREyhFh.exe
  C:\Windows\System\WREyhFh.exe
  2⤵
  PID:6884
- C:\Windows\System\CrlwUAA.exe
  C:\Windows\System\CrlwUAA.exe
  2⤵
  PID:6900
- C:\Windows\System\WhCZXSh.exe
  C:\Windows\System\WhCZXSh.exe
  2⤵
  PID:6916
- C:\Windows\System\zNORQTO.exe
  C:\Windows\System\zNORQTO.exe
  2⤵
  PID:6932
- C:\Windows\System\fYIDkYL.exe
  C:\Windows\System\fYIDkYL.exe
  2⤵
  PID:6948
- C:\Windows\System\hCcAJot.exe
  C:\Windows\System\hCcAJot.exe
  2⤵
  PID:6964
- C:\Windows\System\JeQdKsl.exe
  C:\Windows\System\JeQdKsl.exe
  2⤵
  PID:6980
- C:\Windows\System\fZDOPVm.exe
  C:\Windows\System\fZDOPVm.exe
  2⤵
  PID:7000
- C:\Windows\System\yXQyYUK.exe
  C:\Windows\System\yXQyYUK.exe
  2⤵
  PID:7016
- C:\Windows\System\ZYDKKTk.exe
  C:\Windows\System\ZYDKKTk.exe
  2⤵
  PID:7032
- C:\Windows\System\IvvHWNN.exe
  C:\Windows\System\IvvHWNN.exe
  2⤵
  PID:7048
- C:\Windows\System\kNwXadj.exe
  C:\Windows\System\kNwXadj.exe
  2⤵
  PID:7068
- C:\Windows\System\PhlxVsR.exe
  C:\Windows\System\PhlxVsR.exe
  2⤵
  PID:7084
- C:\Windows\System\VQQhRru.exe
  C:\Windows\System\VQQhRru.exe
  2⤵
  PID:7100
- C:\Windows\System\XQgfwJl.exe
  C:\Windows\System\XQgfwJl.exe
  2⤵
  PID:7116
- C:\Windows\System\CoIDixq.exe
  C:\Windows\System\CoIDixq.exe
  2⤵
  PID:7132
- C:\Windows\System\dMaOXga.exe
  C:\Windows\System\dMaOXga.exe
  2⤵
  PID:7148
- C:\Windows\System\EjrOKyl.exe
  C:\Windows\System\EjrOKyl.exe
  2⤵
  PID:7164
- C:\Windows\System\jvglHWK.exe
  C:\Windows\System\jvglHWK.exe
  2⤵
  PID:6060
- C:\Windows\System\MlvPZUw.exe
  C:\Windows\System\MlvPZUw.exe
  2⤵
  PID:5816
- C:\Windows\System\OdrgcdI.exe
  C:\Windows\System\OdrgcdI.exe
  2⤵
  PID:5688
- C:\Windows\System\kCCfRrM.exe
  C:\Windows\System\kCCfRrM.exe
  2⤵
  PID:6164
- C:\Windows\System\lDxuWCT.exe
  C:\Windows\System\lDxuWCT.exe
  2⤵
  PID:6248
- C:\Windows\System\qgVRfzg.exe
  C:\Windows\System\qgVRfzg.exe
  2⤵
  PID:6272
- C:\Windows\System\cxLbLGZ.exe
  C:\Windows\System\cxLbLGZ.exe
  2⤵
  PID:6324
- C:\Windows\System\ieigCMH.exe
  C:\Windows\System\ieigCMH.exe
  2⤵
  PID:6328
- C:\Windows\System\fRWOSXw.exe
  C:\Windows\System\fRWOSXw.exe
  2⤵
  PID:6396
- C:\Windows\System\VHdPPul.exe
  C:\Windows\System\VHdPPul.exe
  2⤵
  PID:6376
- C:\Windows\System\RzmcoAq.exe
  C:\Windows\System\RzmcoAq.exe
  2⤵
  PID:6380
- C:\Windows\System\BZEPuZm.exe
  C:\Windows\System\BZEPuZm.exe
  2⤵
  PID:6460
- C:\Windows\System\SXPnMIi.exe
  C:\Windows\System\SXPnMIi.exe
  2⤵
  PID:6528
- C:\Windows\System\ZcePUkc.exe
  C:\Windows\System\ZcePUkc.exe
  2⤵
  PID:6560
- C:\Windows\System\gDYkzUL.exe
  C:\Windows\System\gDYkzUL.exe
  2⤵
  PID:6624
- C:\Windows\System\OelQScS.exe
  C:\Windows\System\OelQScS.exe
  2⤵
  PID:6484
- C:\Windows\System\uaNlYfm.exe
  C:\Windows\System\uaNlYfm.exe
  2⤵
  PID:6548
- C:\Windows\System\AzBmNxs.exe
  C:\Windows\System\AzBmNxs.exe
  2⤵
  PID:6692
- C:\Windows\System\LxQLTYu.exe
  C:\Windows\System\LxQLTYu.exe
  2⤵
  PID:6608
- C:\Windows\System\BxmnDeu.exe
  C:\Windows\System\BxmnDeu.exe
  2⤵
  PID:6644
- C:\Windows\System\UQqmnEz.exe
  C:\Windows\System\UQqmnEz.exe
  2⤵
  PID:6728
- C:\Windows\System\IHZoblN.exe
  C:\Windows\System\IHZoblN.exe
  2⤵
  PID:6740
- C:\Windows\System\ofaOrct.exe
  C:\Windows\System\ofaOrct.exe
  2⤵
  PID:6776
- C:\Windows\System\fEPGLcr.exe
  C:\Windows\System\fEPGLcr.exe
  2⤵
  PID:6816
- C:\Windows\System\XmjpEiR.exe
  C:\Windows\System\XmjpEiR.exe
  2⤵
  PID:6896
- C:\Windows\System\vzAGWXO.exe
  C:\Windows\System\vzAGWXO.exe
  2⤵
  PID:6924
- C:\Windows\System\MJGqBVh.exe
  C:\Windows\System\MJGqBVh.exe
  2⤵
  PID:6912
- C:\Windows\System\rmUXCrs.exe
  C:\Windows\System\rmUXCrs.exe
  2⤵
  PID:6944
- C:\Windows\System\EbpcmMk.exe
  C:\Windows\System\EbpcmMk.exe
  2⤵
  PID:6992
- C:\Windows\System\qGaEBLC.exe
  C:\Windows\System\qGaEBLC.exe
  2⤵
  PID:7008
- C:\Windows\System\NZPTNMy.exe
  C:\Windows\System\NZPTNMy.exe
  2⤵
  PID:7096
- C:\Windows\System\peSiVzL.exe
  C:\Windows\System\peSiVzL.exe
  2⤵
  PID:7124
- C:\Windows\System\YefhZiz.exe
  C:\Windows\System\YefhZiz.exe
  2⤵
  PID:7040
- C:\Windows\System\vpSobHN.exe
  C:\Windows\System\vpSobHN.exe
  2⤵
  PID:7080
- C:\Windows\System\JGKpBPc.exe
  C:\Windows\System\JGKpBPc.exe
  2⤵
  PID:5848
- C:\Windows\System\cQfQXue.exe
  C:\Windows\System\cQfQXue.exe
  2⤵
  PID:6212
- C:\Windows\System\ysBackl.exe
  C:\Windows\System\ysBackl.exe
  2⤵
  PID:6260
- C:\Windows\System\tEKhlfr.exe
  C:\Windows\System\tEKhlfr.exe
  2⤵
  PID:6276
- C:\Windows\System\neKfOVZ.exe
  C:\Windows\System\neKfOVZ.exe
  2⤵
  PID:6236
- C:\Windows\System\xJoIqCU.exe
  C:\Windows\System\xJoIqCU.exe
  2⤵
  PID:6432
- C:\Windows\System\RJVvjgw.exe
  C:\Windows\System\RJVvjgw.exe
  2⤵
  PID:4000
- C:\Windows\System\WHwzxEL.exe
  C:\Windows\System\WHwzxEL.exe
  2⤵
  PID:6500
- C:\Windows\System\rzANrCh.exe
  C:\Windows\System\rzANrCh.exe
  2⤵
  PID:6596
- C:\Windows\System\jpAczhO.exe
  C:\Windows\System\jpAczhO.exe
  2⤵
  PID:6632
- C:\Windows\System\twMOsrd.exe
  C:\Windows\System\twMOsrd.exe
  2⤵
  PID:6712
- C:\Windows\System\XdHwneM.exe
  C:\Windows\System\XdHwneM.exe
  2⤵
  PID:6812
- C:\Windows\System\EHAiqBY.exe
  C:\Windows\System\EHAiqBY.exe
  2⤵
  PID:6796
- C:\Windows\System\uhoBbcF.exe
  C:\Windows\System\uhoBbcF.exe
  2⤵
  PID:6892
- C:\Windows\System\poRCYJe.exe
  C:\Windows\System\poRCYJe.exe
  2⤵
  PID:7092
- C:\Windows\System\UpADfPu.exe
  C:\Windows\System\UpADfPu.exe
  2⤵
  PID:7108
- C:\Windows\System\vRKEFvq.exe
  C:\Windows\System\vRKEFvq.exe
  2⤵
  PID:6184
- C:\Windows\System\nrcLCXj.exe
  C:\Windows\System\nrcLCXj.exe
  2⤵
  PID:7012
- C:\Windows\System\ESSCSxG.exe
  C:\Windows\System\ESSCSxG.exe
  2⤵
  PID:6280
- C:\Windows\System\EoMypkk.exe
  C:\Windows\System\EoMypkk.exe
  2⤵
  PID:6512
- C:\Windows\System\aADphNp.exe
  C:\Windows\System\aADphNp.exe
  2⤵
  PID:6748
- C:\Windows\System\PrDUISo.exe
  C:\Windows\System\PrDUISo.exe
  2⤵
  PID:6876
- C:\Windows\System\xRYYAUm.exe
  C:\Windows\System\xRYYAUm.exe
  2⤵
  PID:6340
- C:\Windows\System\HVcyCEG.exe
  C:\Windows\System\HVcyCEG.exe
  2⤵
  PID:6216
- C:\Windows\System\ZYoHLUa.exe
  C:\Windows\System\ZYoHLUa.exe
  2⤵
  PID:6664
- C:\Windows\System\gzNMYDe.exe
  C:\Windows\System\gzNMYDe.exe
  2⤵
  PID:6800
- C:\Windows\System\fPOvRAs.exe
  C:\Windows\System\fPOvRAs.exe
  2⤵
  PID:6864
- C:\Windows\System\AlpDMOC.exe
  C:\Windows\System\AlpDMOC.exe
  2⤵
  PID:7160
- C:\Windows\System\oAutWqi.exe
  C:\Windows\System\oAutWqi.exe
  2⤵
  PID:6360
- C:\Windows\System\NNdBZmp.exe
  C:\Windows\System\NNdBZmp.exe
  2⤵
  PID:6724
- C:\Windows\System\iWZzmhP.exe
  C:\Windows\System\iWZzmhP.exe
  2⤵
  PID:7140
- C:\Windows\System\qXlYQLO.exe
  C:\Windows\System\qXlYQLO.exe
  2⤵
  PID:7180
- C:\Windows\System\uzuRPSH.exe
  C:\Windows\System\uzuRPSH.exe
  2⤵
  PID:7196
- C:\Windows\System\ICrXCJd.exe
  C:\Windows\System\ICrXCJd.exe
  2⤵
  PID:7212
- C:\Windows\System\AWucmPe.exe
  C:\Windows\System\AWucmPe.exe
  2⤵
  PID:7228
- C:\Windows\System\CnDSuMl.exe
  C:\Windows\System\CnDSuMl.exe
  2⤵
  PID:7244
- C:\Windows\System\kLlcWwo.exe
  C:\Windows\System\kLlcWwo.exe
  2⤵
  PID:7260
- C:\Windows\System\jebjkYK.exe
  C:\Windows\System\jebjkYK.exe
  2⤵
  PID:7276
- C:\Windows\System\NAfVUEH.exe
  C:\Windows\System\NAfVUEH.exe
  2⤵
  PID:7300
- C:\Windows\System\XJodyoK.exe
  C:\Windows\System\XJodyoK.exe
  2⤵
  PID:7316
- C:\Windows\System\qYFQHVv.exe
  C:\Windows\System\qYFQHVv.exe
  2⤵
  PID:7332
- C:\Windows\System\bibYTyj.exe
  C:\Windows\System\bibYTyj.exe
  2⤵
  PID:7348
- C:\Windows\System\gQutOxE.exe
  C:\Windows\System\gQutOxE.exe
  2⤵
  PID:7364
- C:\Windows\System\QVqBClB.exe
  C:\Windows\System\QVqBClB.exe
  2⤵
  PID:7380
- C:\Windows\System\SuJLoqj.exe
  C:\Windows\System\SuJLoqj.exe
  2⤵
  PID:7396
- C:\Windows\System\HKVLfLW.exe
  C:\Windows\System\HKVLfLW.exe
  2⤵
  PID:7412
- C:\Windows\System\jtSAsGq.exe
  C:\Windows\System\jtSAsGq.exe
  2⤵
  PID:7428
- C:\Windows\System\OOMtPVH.exe
  C:\Windows\System\OOMtPVH.exe
  2⤵
  PID:7444
- C:\Windows\System\YQCVBmX.exe
  C:\Windows\System\YQCVBmX.exe
  2⤵
  PID:7464
- C:\Windows\System\XfamkSl.exe
  C:\Windows\System\XfamkSl.exe
  2⤵
  PID:7480
- C:\Windows\System\bawLhou.exe
  C:\Windows\System\bawLhou.exe
  2⤵
  PID:7496
- C:\Windows\System\oaxOpGM.exe
  C:\Windows\System\oaxOpGM.exe
  2⤵
  PID:7512
- C:\Windows\System\tTkXPaW.exe
  C:\Windows\System\tTkXPaW.exe
  2⤵
  PID:7532
- C:\Windows\System\hDjGcsD.exe
  C:\Windows\System\hDjGcsD.exe
  2⤵
  PID:7548
- C:\Windows\System\kFkFWMj.exe
  C:\Windows\System\kFkFWMj.exe
  2⤵
  PID:7568
- C:\Windows\System\stMdmUa.exe
  C:\Windows\System\stMdmUa.exe
  2⤵
  PID:7584
- C:\Windows\System\NMPvvaL.exe
  C:\Windows\System\NMPvvaL.exe
  2⤵
  PID:7600
- C:\Windows\System\rRsbQzo.exe
  C:\Windows\System\rRsbQzo.exe
  2⤵
  PID:7616
- C:\Windows\System\KHSnzAP.exe
  C:\Windows\System\KHSnzAP.exe
  2⤵
  PID:7632
- C:\Windows\System\odclpyM.exe
  C:\Windows\System\odclpyM.exe
  2⤵
  PID:7648
- C:\Windows\System\vevVeBf.exe
  C:\Windows\System\vevVeBf.exe
  2⤵
  PID:7664
- C:\Windows\System\jKleSbV.exe
  C:\Windows\System\jKleSbV.exe
  2⤵
  PID:7680
- C:\Windows\System\ZdOdDKk.exe
  C:\Windows\System\ZdOdDKk.exe
  2⤵
  PID:7696
- C:\Windows\System\HvyvJGK.exe
  C:\Windows\System\HvyvJGK.exe
  2⤵
  PID:7712
- C:\Windows\System\FryKJPp.exe
  C:\Windows\System\FryKJPp.exe
  2⤵
  PID:7728
- C:\Windows\System\ZBkoNWB.exe
  C:\Windows\System\ZBkoNWB.exe
  2⤵
  PID:7744
- C:\Windows\System\ienxBBi.exe
  C:\Windows\System\ienxBBi.exe
  2⤵
  PID:7760
- C:\Windows\System\XDfxMed.exe
  C:\Windows\System\XDfxMed.exe
  2⤵
  PID:7780
- C:\Windows\System\ogtGkkr.exe
  C:\Windows\System\ogtGkkr.exe
  2⤵
  PID:7796
- C:\Windows\System\UtQCksM.exe
  C:\Windows\System\UtQCksM.exe
  2⤵
  PID:7812
- C:\Windows\System\zWBSFYU.exe
  C:\Windows\System\zWBSFYU.exe
  2⤵
  PID:7828
- C:\Windows\System\dDntZEl.exe
  C:\Windows\System\dDntZEl.exe
  2⤵
  PID:7844
- C:\Windows\System\qkaAuoi.exe
  C:\Windows\System\qkaAuoi.exe
  2⤵
  PID:7860
- C:\Windows\System\jxRfLuS.exe
  C:\Windows\System\jxRfLuS.exe
  2⤵
  PID:7876
- C:\Windows\System\NxJnNpj.exe
  C:\Windows\System\NxJnNpj.exe
  2⤵
  PID:7892
- C:\Windows\System\uNknzTz.exe
  C:\Windows\System\uNknzTz.exe
  2⤵
  PID:7908
- C:\Windows\System\OYBlXWY.exe
  C:\Windows\System\OYBlXWY.exe
  2⤵
  PID:7924
- C:\Windows\System\jTxdear.exe
  C:\Windows\System\jTxdear.exe
  2⤵
  PID:7940
- C:\Windows\System\MpESuTV.exe
  C:\Windows\System\MpESuTV.exe
  2⤵
  PID:7956
- C:\Windows\System\oPKsMcf.exe
  C:\Windows\System\oPKsMcf.exe
  2⤵
  PID:7976
- C:\Windows\System\BCVmlAp.exe
  C:\Windows\System\BCVmlAp.exe
  2⤵
  PID:7992
- C:\Windows\System\gFAZPZf.exe
  C:\Windows\System\gFAZPZf.exe
  2⤵
  PID:8008
- C:\Windows\System\buZhOIQ.exe
  C:\Windows\System\buZhOIQ.exe
  2⤵
  PID:8024
- C:\Windows\System\jzTXPOX.exe
  C:\Windows\System\jzTXPOX.exe
  2⤵
  PID:8040
- C:\Windows\System\RYnUEAt.exe
  C:\Windows\System\RYnUEAt.exe
  2⤵
  PID:8056
- C:\Windows\System\byWCsTU.exe
  C:\Windows\System\byWCsTU.exe
  2⤵
  PID:8072
- C:\Windows\System\yuygHwR.exe
  C:\Windows\System\yuygHwR.exe
  2⤵
  PID:8088
- C:\Windows\System\AkgEzwM.exe
  C:\Windows\System\AkgEzwM.exe
  2⤵
  PID:8104
- C:\Windows\System\UrRCAqD.exe
  C:\Windows\System\UrRCAqD.exe
  2⤵
  PID:8120
- C:\Windows\System\tafvZLd.exe
  C:\Windows\System\tafvZLd.exe
  2⤵
  PID:8136
- C:\Windows\System\fPyINJD.exe
  C:\Windows\System\fPyINJD.exe
  2⤵
  PID:8152
- C:\Windows\System\XznWGZZ.exe
  C:\Windows\System\XznWGZZ.exe
  2⤵
  PID:8168
- C:\Windows\System\SiyfjZg.exe
  C:\Windows\System\SiyfjZg.exe
  2⤵
  PID:8184
- C:\Windows\System\IAOxMZE.exe
  C:\Windows\System\IAOxMZE.exe
  2⤵
  PID:6448
- C:\Windows\System\NZuKrlX.exe
  C:\Windows\System\NZuKrlX.exe
  2⤵
  PID:6444
- C:\Windows\System\UQiJloT.exe
  C:\Windows\System\UQiJloT.exe
  2⤵
  PID:6940
- C:\Windows\System\frPjIWe.exe
  C:\Windows\System\frPjIWe.exe
  2⤵
  PID:6988
- C:\Windows\System\QpMutsx.exe
  C:\Windows\System\QpMutsx.exe
  2⤵
  PID:7268
- C:\Windows\System\VOpAFnl.exe
  C:\Windows\System\VOpAFnl.exe
  2⤵
  PID:7292
- C:\Windows\System\OAjqVMb.exe
  C:\Windows\System\OAjqVMb.exe
  2⤵
  PID:7312
- C:\Windows\System\TgiJjIO.exe
  C:\Windows\System\TgiJjIO.exe
  2⤵
  PID:7344
- C:\Windows\System\FCWxtfd.exe
  C:\Windows\System\FCWxtfd.exe
  2⤵
  PID:7372
- C:\Windows\System\ySgUKTr.exe
  C:\Windows\System\ySgUKTr.exe
  2⤵
  PID:7388
- C:\Windows\System\JdjayiJ.exe
  C:\Windows\System\JdjayiJ.exe
  2⤵
  PID:7420
- C:\Windows\System\XcCKJIz.exe
  C:\Windows\System\XcCKJIz.exe
  2⤵
  PID:7504
- C:\Windows\System\UVuZigm.exe
  C:\Windows\System\UVuZigm.exe
  2⤵
  PID:7460
- C:\Windows\System\uFexnsG.exe
  C:\Windows\System\uFexnsG.exe
  2⤵
  PID:7524
- C:\Windows\System\ALgxPAD.exe
  C:\Windows\System\ALgxPAD.exe
  2⤵
  PID:7576
- C:\Windows\System\nAJvihE.exe
  C:\Windows\System\nAJvihE.exe
  2⤵
  PID:7640
- C:\Windows\System\tnzfQNJ.exe
  C:\Windows\System\tnzfQNJ.exe
  2⤵
  PID:7676
- C:\Windows\System\zhHeZFc.exe
  C:\Windows\System\zhHeZFc.exe
  2⤵
  PID:7740
- C:\Windows\System\UgQkePz.exe
  C:\Windows\System\UgQkePz.exe
  2⤵
  PID:7660
- C:\Windows\System\KTTQvbw.exe
  C:\Windows\System\KTTQvbw.exe
  2⤵
  PID:7768
- C:\Windows\System\Ujasanq.exe
  C:\Windows\System\Ujasanq.exe
  2⤵
  PID:7596
- C:\Windows\System\DsJnmLG.exe
  C:\Windows\System\DsJnmLG.exe
  2⤵
  PID:7840
- C:\Windows\System\tGPWaZb.exe
  C:\Windows\System\tGPWaZb.exe
  2⤵
  PID:7624
- C:\Windows\System\uHhwYcm.exe
  C:\Windows\System\uHhwYcm.exe
  2⤵
  PID:7820
- C:\Windows\System\DqBUMvY.exe
  C:\Windows\System\DqBUMvY.exe
  2⤵
  PID:7856
- C:\Windows\System\IHWlmqT.exe
  C:\Windows\System\IHWlmqT.exe
  2⤵
  PID:7932
- C:\Windows\System\hxEjImw.exe
  C:\Windows\System\hxEjImw.exe
  2⤵
  PID:7936
- C:\Windows\System\LQjBXlM.exe
  C:\Windows\System\LQjBXlM.exe
  2⤵
  PID:7972
- C:\Windows\System\uancrcd.exe
  C:\Windows\System\uancrcd.exe
  2⤵
  PID:7984
- C:\Windows\System\NfFrKri.exe
  C:\Windows\System\NfFrKri.exe
  2⤵
  PID:8064
- C:\Windows\System\wWEFjtd.exe
  C:\Windows\System\wWEFjtd.exe
  2⤵
  PID:8100
- C:\Windows\System\lKGnHLG.exe
  C:\Windows\System\lKGnHLG.exe
  2⤵
  PID:8048
- C:\Windows\System\KvDzWVD.exe
  C:\Windows\System\KvDzWVD.exe
  2⤵
  PID:8080
- C:\Windows\System\FihtaKz.exe
  C:\Windows\System\FihtaKz.exe
  2⤵
  PID:7176
- C:\Windows\System\inymtDV.exe
  C:\Windows\System\inymtDV.exe
  2⤵
  PID:6848
- C:\Windows\System\KEcpIPn.exe
  C:\Windows\System\KEcpIPn.exe
  2⤵
  PID:6424
- C:\Windows\System\gtuXYze.exe
  C:\Windows\System\gtuXYze.exe
  2⤵
  PID:7252
- C:\Windows\System\rYHKqoD.exe
  C:\Windows\System\rYHKqoD.exe
  2⤵
  PID:7424
- C:\Windows\System\DwGQmSH.exe
  C:\Windows\System\DwGQmSH.exe
  2⤵
  PID:7492
- C:\Windows\System\oIZRTwH.exe
  C:\Windows\System\oIZRTwH.exe
  2⤵
  PID:7560
- C:\Windows\System\dpyqoFv.exe
  C:\Windows\System\dpyqoFv.exe
  2⤵
  PID:7628
- C:\Windows\System\XpmRQld.exe
  C:\Windows\System\XpmRQld.exe
  2⤵
  PID:7256
- C:\Windows\System\qgWWyIl.exe
  C:\Windows\System\qgWWyIl.exe
  2⤵
  PID:7284
- C:\Windows\System\qFeNjly.exe
  C:\Windows\System\qFeNjly.exe
  2⤵
  PID:7964
- C:\Windows\System\mvXJNMc.exe
  C:\Windows\System\mvXJNMc.exe
  2⤵
  PID:7708
- C:\Windows\System\TuJSmid.exe
  C:\Windows\System\TuJSmid.exe
  2⤵
  PID:7724
- C:\Windows\System\PhzcldX.exe
  C:\Windows\System\PhzcldX.exe
  2⤵
  PID:7792
- C:\Windows\System\yQGUKYH.exe
  C:\Windows\System\yQGUKYH.exe
  2⤵
  PID:8036
- C:\Windows\System\aWUhMvR.exe
  C:\Windows\System\aWUhMvR.exe
  2⤵
  PID:7544
- C:\Windows\System\KdEyNjq.exe
  C:\Windows\System\KdEyNjq.exe
  2⤵
  PID:8052
- C:\Windows\System\jkDdFGb.exe
  C:\Windows\System\jkDdFGb.exe
  2⤵
  PID:8180
- C:\Windows\System\LcDLkEd.exe
  C:\Windows\System\LcDLkEd.exe
  2⤵
  PID:7452
- C:\Windows\System\hjkDldl.exe
  C:\Windows\System\hjkDldl.exe
  2⤵
  PID:7656
- C:\Windows\System\zuXhImB.exe
  C:\Windows\System\zuXhImB.exe
  2⤵
  PID:8016
- C:\Windows\System\uLsxcTG.exe
  C:\Windows\System\uLsxcTG.exe
  2⤵
  PID:7836
- C:\Windows\System\kTDrTrg.exe
  C:\Windows\System\kTDrTrg.exe
  2⤵
  PID:7672
- C:\Windows\System\QibHUrR.exe
  C:\Windows\System\QibHUrR.exe
  2⤵
  PID:7240
- C:\Windows\System\JVkIPdy.exe
  C:\Windows\System\JVkIPdy.exe
  2⤵
  PID:7872
- C:\Windows\System\gVYbpov.exe
  C:\Windows\System\gVYbpov.exe
  2⤵
  PID:7408
- C:\Windows\System\RUzfUax.exe
  C:\Windows\System\RUzfUax.exe
  2⤵
  PID:7852
- C:\Windows\System\erUNKVp.exe
  C:\Windows\System\erUNKVp.exe
  2⤵
  PID:7472
- C:\Windows\System\RLIzUBe.exe
  C:\Windows\System\RLIzUBe.exe
  2⤵
  PID:8004
- C:\Windows\System\TNYmaeJ.exe
  C:\Windows\System\TNYmaeJ.exe
  2⤵
  PID:7204
- C:\Windows\System\QPlVhdN.exe
  C:\Windows\System\QPlVhdN.exe
  2⤵
  PID:7968
- C:\Windows\System\InwYpbY.exe
  C:\Windows\System\InwYpbY.exe
  2⤵
  PID:8196
- C:\Windows\System\SNrgYyg.exe
  C:\Windows\System\SNrgYyg.exe
  2⤵
  PID:8212
- C:\Windows\System\JMgyDUh.exe
  C:\Windows\System\JMgyDUh.exe
  2⤵
  PID:8256
- C:\Windows\System\Ebiqxti.exe
  C:\Windows\System\Ebiqxti.exe
  2⤵
  PID:8272
- C:\Windows\System\YCpxBAL.exe
  C:\Windows\System\YCpxBAL.exe
  2⤵
  PID:8300
- C:\Windows\System\brqqbGt.exe
  C:\Windows\System\brqqbGt.exe
  2⤵
  PID:8316
- C:\Windows\System\ENdzeWR.exe
  C:\Windows\System\ENdzeWR.exe
  2⤵
  PID:8332
- C:\Windows\System\dDMyJcx.exe
  C:\Windows\System\dDMyJcx.exe
  2⤵
  PID:8348
- C:\Windows\System\oLDvuNx.exe
  C:\Windows\System\oLDvuNx.exe
  2⤵
  PID:8364
- C:\Windows\System\yXpHuKK.exe
  C:\Windows\System\yXpHuKK.exe
  2⤵
  PID:8380
- C:\Windows\System\bsGLMAO.exe
  C:\Windows\System\bsGLMAO.exe
  2⤵
  PID:8400
- C:\Windows\System\WCeCKjw.exe
  C:\Windows\System\WCeCKjw.exe
  2⤵
  PID:8416
- C:\Windows\System\oPetWCg.exe
  C:\Windows\System\oPetWCg.exe
  2⤵
  PID:8432
- C:\Windows\System\SOhWDOI.exe
  C:\Windows\System\SOhWDOI.exe
  2⤵
  PID:8448
- C:\Windows\System\GWIDfKY.exe
  C:\Windows\System\GWIDfKY.exe
  2⤵
  PID:8468
- C:\Windows\System\ThmJCRg.exe
  C:\Windows\System\ThmJCRg.exe
  2⤵
  PID:8488
- C:\Windows\System\cokYvdF.exe
  C:\Windows\System\cokYvdF.exe
  2⤵
  PID:8528
- C:\Windows\System\zVZYzpw.exe
  C:\Windows\System\zVZYzpw.exe
  2⤵
  PID:8544
- C:\Windows\System\lskjSNS.exe
  C:\Windows\System\lskjSNS.exe
  2⤵
  PID:8560
- C:\Windows\System\lTupoKC.exe
  C:\Windows\System\lTupoKC.exe
  2⤵
  PID:8576
- C:\Windows\System\fKXOddG.exe
  C:\Windows\System\fKXOddG.exe
  2⤵
  PID:8592
- C:\Windows\System\gDEkChh.exe
  C:\Windows\System\gDEkChh.exe
  2⤵
  PID:8608
- C:\Windows\System\TyzsffO.exe
  C:\Windows\System\TyzsffO.exe
  2⤵
  PID:8624
- C:\Windows\System\aBvpinI.exe
  C:\Windows\System\aBvpinI.exe
  2⤵
  PID:8640
- C:\Windows\System\SaQfDos.exe
  C:\Windows\System\SaQfDos.exe
  2⤵
  PID:8656
- C:\Windows\System\PLYkHBt.exe
  C:\Windows\System\PLYkHBt.exe
  2⤵
  PID:8672
- C:\Windows\System\JUsVGVB.exe
  C:\Windows\System\JUsVGVB.exe
  2⤵
  PID:8688
- C:\Windows\System\qNBtPnu.exe
  C:\Windows\System\qNBtPnu.exe
  2⤵
  PID:8704
- C:\Windows\System\AnuMzuR.exe
  C:\Windows\System\AnuMzuR.exe
  2⤵
  PID:8772
- C:\Windows\System\SsqUNcl.exe
  C:\Windows\System\SsqUNcl.exe
  2⤵
  PID:8808
- C:\Windows\System\AOZSJar.exe
  C:\Windows\System\AOZSJar.exe
  2⤵
  PID:8824
- C:\Windows\System\CNutBtv.exe
  C:\Windows\System\CNutBtv.exe
  2⤵
  PID:8844
- C:\Windows\System\XlDONug.exe
  C:\Windows\System\XlDONug.exe
  2⤵
  PID:8864
- C:\Windows\System\EawJyjH.exe
  C:\Windows\System\EawJyjH.exe
  2⤵
  PID:8880
- C:\Windows\System\xKyNtsb.exe
  C:\Windows\System\xKyNtsb.exe
  2⤵
  PID:8952
- C:\Windows\System\BbptrtA.exe
  C:\Windows\System\BbptrtA.exe
  2⤵
  PID:9088
- C:\Windows\System\PXLuMBg.exe
  C:\Windows\System\PXLuMBg.exe
  2⤵
  PID:9108
- C:\Windows\System\pXCcOOJ.exe
  C:\Windows\System\pXCcOOJ.exe
  2⤵
  PID:9128
- C:\Windows\System\XRjHrqB.exe
  C:\Windows\System\XRjHrqB.exe
  2⤵
  PID:9144
- C:\Windows\System\EKITwMa.exe
  C:\Windows\System\EKITwMa.exe
  2⤵
  PID:9164
- C:\Windows\System\vPeocAb.exe
  C:\Windows\System\vPeocAb.exe
  2⤵
  PID:9180
- C:\Windows\System\fczAMuJ.exe
  C:\Windows\System\fczAMuJ.exe
  2⤵
  PID:9196
- C:\Windows\System\fNFPAlf.exe
  C:\Windows\System\fNFPAlf.exe
  2⤵
  PID:9212
- C:\Windows\System\LDlXkxj.exe
  C:\Windows\System\LDlXkxj.exe
  2⤵
  PID:5968
- C:\Windows\System\okcrPzp.exe
  C:\Windows\System\okcrPzp.exe
  2⤵
  PID:7288
- C:\Windows\System\VkLSFRv.exe
  C:\Windows\System\VkLSFRv.exe
  2⤵
  PID:8204
- C:\Windows\System\xmsKbXb.exe
  C:\Windows\System\xmsKbXb.exe
  2⤵
  PID:8264
- C:\Windows\System\OufLuKQ.exe
  C:\Windows\System\OufLuKQ.exe
  2⤵
  PID:8280
- C:\Windows\System\ySuAdLq.exe
  C:\Windows\System\ySuAdLq.exe
  2⤵
  PID:8284
- C:\Windows\System\rsbKSPq.exe
  C:\Windows\System\rsbKSPq.exe
  2⤵
  PID:8360
- C:\Windows\System\ZgZqMcV.exe
  C:\Windows\System\ZgZqMcV.exe
  2⤵
  PID:8312
- C:\Windows\System\rKfkufo.exe
  C:\Windows\System\rKfkufo.exe
  2⤵
  PID:8396
- C:\Windows\System\gvdhdJN.exe
  C:\Windows\System\gvdhdJN.exe
  2⤵
  PID:8440
- C:\Windows\System\kfnTOTm.exe
  C:\Windows\System\kfnTOTm.exe
  2⤵
  PID:8456
- C:\Windows\System\nDwVDGd.exe
  C:\Windows\System\nDwVDGd.exe
  2⤵
  PID:8484
- C:\Windows\System\JQaJcaJ.exe
  C:\Windows\System\JQaJcaJ.exe
  2⤵
  PID:8508
- C:\Windows\System\KHGFayp.exe
  C:\Windows\System\KHGFayp.exe
  2⤵
  PID:8524
- C:\Windows\System\IPKrpih.exe
  C:\Windows\System\IPKrpih.exe
  2⤵
  PID:8616
- C:\Windows\System\MNUAoRt.exe
  C:\Windows\System\MNUAoRt.exe
  2⤵
  PID:8572
- C:\Windows\System\eskOsqb.exe
  C:\Windows\System\eskOsqb.exe
  2⤵
  PID:8600
- C:\Windows\System\teeTpbA.exe
  C:\Windows\System\teeTpbA.exe
  2⤵
  PID:8664
- C:\Windows\System\wIczKYB.exe
  C:\Windows\System\wIczKYB.exe
  2⤵
  PID:8696
- C:\Windows\System\cdHEFKp.exe
  C:\Windows\System\cdHEFKp.exe
  2⤵
  PID:8740
- C:\Windows\System\AbhOcBv.exe
  C:\Windows\System\AbhOcBv.exe
  2⤵
  PID:8756
- C:\Windows\System\gHhoGHk.exe
  C:\Windows\System\gHhoGHk.exe
  2⤵
  PID:8780
- C:\Windows\System\PBZJnDg.exe
  C:\Windows\System\PBZJnDg.exe
  2⤵
  PID:8732
- C:\Windows\System\ZyGHeKm.exe
  C:\Windows\System\ZyGHeKm.exe
  2⤵
  PID:8792
- C:\Windows\System\TsUvVah.exe
  C:\Windows\System\TsUvVah.exe
  2⤵
  PID:8820
- C:\Windows\System\yFjUZQf.exe
  C:\Windows\System\yFjUZQf.exe
  2⤵
  PID:8840
- C:\Windows\System\pMaBZHA.exe
  C:\Windows\System\pMaBZHA.exe
  2⤵
  PID:8924
- C:\Windows\System\XakRbTX.exe
  C:\Windows\System\XakRbTX.exe
  2⤵
  PID:8896
- C:\Windows\System\SZWuwxG.exe
  C:\Windows\System\SZWuwxG.exe
  2⤵
  PID:8912
- C:\Windows\System\MJPIBRE.exe
  C:\Windows\System\MJPIBRE.exe
  2⤵
  PID:8932
- C:\Windows\System\OTCRutH.exe
  C:\Windows\System\OTCRutH.exe
  2⤵
  PID:8948
- C:\Windows\System\fWqUSPh.exe
  C:\Windows\System\fWqUSPh.exe
  2⤵
  PID:8980
- C:\Windows\System\KsnLKXo.exe
  C:\Windows\System\KsnLKXo.exe
  2⤵
  PID:9004
- C:\Windows\System\gLNJYNH.exe
  C:\Windows\System\gLNJYNH.exe
  2⤵
  PID:9024
- C:\Windows\System\zoqBCSe.exe
  C:\Windows\System\zoqBCSe.exe
  2⤵
  PID:9048
- C:\Windows\System\wdrCmzq.exe
  C:\Windows\System\wdrCmzq.exe
  2⤵
  PID:9064
- C:\Windows\System\bBDkmuO.exe
  C:\Windows\System\bBDkmuO.exe
  2⤵
  PID:9104
- C:\Windows\System\oXyMWkl.exe
  C:\Windows\System\oXyMWkl.exe
  2⤵
  PID:9204
- C:\Windows\System\RLidedr.exe
  C:\Windows\System\RLidedr.exe
  2⤵
  PID:7888
- C:\Windows\System\RzYlbjX.exe
  C:\Windows\System\RzYlbjX.exe
  2⤵
  PID:8296
- C:\Windows\System\BkPoUgv.exe
  C:\Windows\System\BkPoUgv.exe
  2⤵
  PID:8476
- C:\Windows\System\bjHfdUj.exe
  C:\Windows\System\bjHfdUj.exe
  2⤵
  PID:8376
- C:\Windows\System\WXdHJZV.exe
  C:\Windows\System\WXdHJZV.exe
  2⤵
  PID:9076
- C:\Windows\System\SquXeAl.exe
  C:\Windows\System\SquXeAl.exe
  2⤵
  PID:8428
- C:\Windows\System\pdJdNHo.exe
  C:\Windows\System\pdJdNHo.exe
  2⤵
  PID:9120
- C:\Windows\System\HXiAxYR.exe
  C:\Windows\System\HXiAxYR.exe
  2⤵
  PID:7188
- C:\Windows\System\dCSExRq.exe
  C:\Windows\System\dCSExRq.exe
  2⤵
  PID:8340
- C:\Windows\System\QlADiUb.exe
  C:\Windows\System\QlADiUb.exe
  2⤵
  PID:8248
- C:\Windows\System\GuljSDU.exe
  C:\Windows\System\GuljSDU.exe
  2⤵
  PID:8588
- C:\Windows\System\peaIJIj.exe
  C:\Windows\System\peaIJIj.exe
  2⤵
  PID:8460
- C:\Windows\System\rlWnnYw.exe
  C:\Windows\System\rlWnnYw.exe
  2⤵
  PID:8736
- C:\Windows\System\iItAKxR.exe
  C:\Windows\System\iItAKxR.exe
  2⤵
  PID:8752
- C:\Windows\System\qCeaxLj.exe
  C:\Windows\System\qCeaxLj.exe
  2⤵
  PID:8748
- C:\Windows\System\gbJvshK.exe
  C:\Windows\System\gbJvshK.exe
  2⤵
  PID:8788
- C:\Windows\System\GNUQjZq.exe
  C:\Windows\System\GNUQjZq.exe
  2⤵
  PID:8888
- C:\Windows\System\XoCLDBe.exe
  C:\Windows\System\XoCLDBe.exe
  2⤵
  PID:8920
- C:\Windows\System\MSnrlxi.exe
  C:\Windows\System\MSnrlxi.exe
  2⤵
  PID:8944
- C:\Windows\System\xQIolIV.exe
  C:\Windows\System\xQIolIV.exe
  2⤵
  PID:8900
- C:\Windows\System\YviJxXu.exe
  C:\Windows\System\YviJxXu.exe
  2⤵
  PID:9012
- C:\Windows\System\lnCpncv.exe
  C:\Windows\System\lnCpncv.exe
  2⤵
  PID:9040
- C:\Windows\System\jsEFtRO.exe
  C:\Windows\System\jsEFtRO.exe
  2⤵
  PID:9056
- C:\Windows\System\JZFDzhS.exe
  C:\Windows\System\JZFDzhS.exe
  2⤵
  PID:9140
- C:\Windows\System\SkkeJUv.exe
  C:\Windows\System\SkkeJUv.exe
  2⤵
  PID:9080
- C:\Windows\System\rQorvPD.exe
  C:\Windows\System\rQorvPD.exe
  2⤵
  PID:9176
- C:\Windows\System\OlFfgfU.exe
  C:\Windows\System\OlFfgfU.exe
  2⤵
  PID:8424
- C:\Windows\System\AAKlTqj.exe
  C:\Windows\System\AAKlTqj.exe
  2⤵
  PID:8412
- C:\Windows\System\hnrXMbB.exe
  C:\Windows\System\hnrXMbB.exe
  2⤵
  PID:8344
- C:\Windows\System\sgMKUrD.exe
  C:\Windows\System\sgMKUrD.exe
  2⤵
  PID:8720
- C:\Windows\System\ligBbNH.exe
  C:\Windows\System\ligBbNH.exe
  2⤵
  PID:8800
- C:\Windows\System\qWxchBs.exe
  C:\Windows\System\qWxchBs.exe
  2⤵
  PID:8908
- C:\Windows\System\LRGVfgb.exe
  C:\Windows\System\LRGVfgb.exe
  2⤵
  PID:8968
- C:\Windows\System\bqgyQKx.exe
  C:\Windows\System\bqgyQKx.exe
  2⤵
  PID:8988
- C:\Windows\System\kVpAsoc.exe
  C:\Windows\System\kVpAsoc.exe
  2⤵
  PID:8292
- C:\Windows\System\rCRmFVk.exe
  C:\Windows\System\rCRmFVk.exe
  2⤵
  PID:9124
- C:\Windows\System\vllzXyQ.exe
  C:\Windows\System\vllzXyQ.exe
  2⤵
  PID:8308
- C:\Windows\System\VoBPWYc.exe
  C:\Windows\System\VoBPWYc.exe
  2⤵
  PID:8940
- C:\Windows\System\uoafRus.exe
  C:\Windows\System\uoafRus.exe
  2⤵
  PID:9160
- C:\Windows\System\VwPgAvO.exe
  C:\Windows\System\VwPgAvO.exe
  2⤵
  PID:9096
- C:\Windows\System\hLkuPgv.exe
  C:\Windows\System\hLkuPgv.exe
  2⤵
  PID:9020
- C:\Windows\System\ewRqYro.exe
  C:\Windows\System\ewRqYro.exe
  2⤵
  PID:8568
- C:\Windows\System\ZqXCGIl.exe
  C:\Windows\System\ZqXCGIl.exe
  2⤵
  PID:9000
- C:\Windows\System\QdDFhlt.exe
  C:\Windows\System\QdDFhlt.exe
  2⤵
  PID:7772
- C:\Windows\System\AWTZXZd.exe
  C:\Windows\System\AWTZXZd.exe
  2⤵
  PID:8784
- C:\Windows\System\eUUnwRN.exe
  C:\Windows\System\eUUnwRN.exe
  2⤵
  PID:9232
- C:\Windows\System\QieokWI.exe
  C:\Windows\System\QieokWI.exe
  2⤵
  PID:9248
- C:\Windows\System\agMBeOY.exe
  C:\Windows\System\agMBeOY.exe
  2⤵
  PID:9264
- C:\Windows\System\nreCbdC.exe
  C:\Windows\System\nreCbdC.exe
  2⤵
  PID:9280
- C:\Windows\System\JrovWEc.exe
  C:\Windows\System\JrovWEc.exe
  2⤵
  PID:9296
- C:\Windows\System\jBnmQiV.exe
  C:\Windows\System\jBnmQiV.exe
  2⤵
  PID:9312
- C:\Windows\System\zEUOjlZ.exe
  C:\Windows\System\zEUOjlZ.exe
  2⤵
  PID:9328
- C:\Windows\System\ReDmBLk.exe
  C:\Windows\System\ReDmBLk.exe
  2⤵
  PID:9344
- C:\Windows\System\rATCWCF.exe
  C:\Windows\System\rATCWCF.exe
  2⤵
  PID:9360
- C:\Windows\System\muMOsmq.exe
  C:\Windows\System\muMOsmq.exe
  2⤵
  PID:9376
- C:\Windows\System\CfYGXkc.exe
  C:\Windows\System\CfYGXkc.exe
  2⤵
  PID:9392
- C:\Windows\System\kBPnMle.exe
  C:\Windows\System\kBPnMle.exe
  2⤵
  PID:9408
- C:\Windows\System\OSRoKzS.exe
  C:\Windows\System\OSRoKzS.exe
  2⤵
  PID:9424
- C:\Windows\System\DSPZZrV.exe
  C:\Windows\System\DSPZZrV.exe
  2⤵
  PID:9440
- C:\Windows\System\mSBkypl.exe
  C:\Windows\System\mSBkypl.exe
  2⤵
  PID:9456
- C:\Windows\System\mfFtIZV.exe
  C:\Windows\System\mfFtIZV.exe
  2⤵
  PID:9472
- C:\Windows\System\wxUXojk.exe
  C:\Windows\System\wxUXojk.exe
  2⤵
  PID:9488
- C:\Windows\System\VHxabru.exe
  C:\Windows\System\VHxabru.exe
  2⤵
  PID:9504
- C:\Windows\System\BtnZziR.exe
  C:\Windows\System\BtnZziR.exe
  2⤵
  PID:9520
- C:\Windows\System\rQneaSr.exe
  C:\Windows\System\rQneaSr.exe
  2⤵
  PID:9536
- C:\Windows\System\EEsrOOz.exe
  C:\Windows\System\EEsrOOz.exe
  2⤵
  PID:9552
- C:\Windows\System\PKCkLFF.exe
  C:\Windows\System\PKCkLFF.exe
  2⤵
  PID:9568
- C:\Windows\System\lnPxOvz.exe
  C:\Windows\System\lnPxOvz.exe
  2⤵
  PID:9584
- C:\Windows\System\JLwzDrk.exe
  C:\Windows\System\JLwzDrk.exe
  2⤵
  PID:9600
- C:\Windows\System\LUvHYHg.exe
  C:\Windows\System\LUvHYHg.exe
  2⤵
  PID:9616
- C:\Windows\System\XkbUNka.exe
  C:\Windows\System\XkbUNka.exe
  2⤵
  PID:9632
- C:\Windows\System\AVmmard.exe
  C:\Windows\System\AVmmard.exe
  2⤵
  PID:9648
- C:\Windows\System\KIgmwlU.exe
  C:\Windows\System\KIgmwlU.exe
  2⤵
  PID:9664
- C:\Windows\System\ephczQU.exe
  C:\Windows\System\ephczQU.exe
  2⤵
  PID:9680
- C:\Windows\System\bIjugXm.exe
  C:\Windows\System\bIjugXm.exe
  2⤵
  PID:9696
- C:\Windows\System\xLKzXLL.exe
  C:\Windows\System\xLKzXLL.exe
  2⤵
  PID:9716
- C:\Windows\System\WHXUgHs.exe
  C:\Windows\System\WHXUgHs.exe
  2⤵
  PID:9736
- C:\Windows\System\xawoybX.exe
  C:\Windows\System\xawoybX.exe
  2⤵
  PID:9752
- C:\Windows\System\OWznSPZ.exe
  C:\Windows\System\OWznSPZ.exe
  2⤵
  PID:9768
- C:\Windows\System\jqhtBkw.exe
  C:\Windows\System\jqhtBkw.exe
  2⤵
  PID:9784
- C:\Windows\System\ouHPmHD.exe
  C:\Windows\System\ouHPmHD.exe
  2⤵
  PID:9804
- C:\Windows\System\TQeJREU.exe
  C:\Windows\System\TQeJREU.exe
  2⤵
  PID:9820
- C:\Windows\System\VpAPZxT.exe
  C:\Windows\System\VpAPZxT.exe
  2⤵
  PID:9836
- C:\Windows\System\OAiegfQ.exe
  C:\Windows\System\OAiegfQ.exe
  2⤵
  PID:9856
- C:\Windows\System\wXxurOk.exe
  C:\Windows\System\wXxurOk.exe
  2⤵
  PID:9872
- C:\Windows\System\TWDUmNt.exe
  C:\Windows\System\TWDUmNt.exe
  2⤵
  PID:9892
- C:\Windows\System\drwHUPF.exe
  C:\Windows\System\drwHUPF.exe
  2⤵
  PID:9908
- C:\Windows\System\dQlEVtS.exe
  C:\Windows\System\dQlEVtS.exe
  2⤵
  PID:9924
- C:\Windows\System\AEGcbOL.exe
  C:\Windows\System\AEGcbOL.exe
  2⤵
  PID:9940
- C:\Windows\System\imMvLxN.exe
  C:\Windows\System\imMvLxN.exe
  2⤵
  PID:9956
- C:\Windows\System\JsEFnAR.exe
  C:\Windows\System\JsEFnAR.exe
  2⤵
  PID:10072
- C:\Windows\System\FefqMGk.exe
  C:\Windows\System\FefqMGk.exe
  2⤵
  PID:10088
- C:\Windows\System\KSRjmzM.exe
  C:\Windows\System\KSRjmzM.exe
  2⤵
  PID:10104
- C:\Windows\System\wOmIoqX.exe
  C:\Windows\System\wOmIoqX.exe
  2⤵
  PID:10120
- C:\Windows\System\LyBrpwQ.exe
  C:\Windows\System\LyBrpwQ.exe
  2⤵
  PID:10136
- C:\Windows\System\UzLecea.exe
  C:\Windows\System\UzLecea.exe
  2⤵
  PID:10156
- C:\Windows\System\GReYWdn.exe
  C:\Windows\System\GReYWdn.exe
  2⤵
  PID:10172
- C:\Windows\System\fnuaxqj.exe
  C:\Windows\System\fnuaxqj.exe
  2⤵
  PID:10188
- C:\Windows\System\GZhVwAT.exe
  C:\Windows\System\GZhVwAT.exe
  2⤵
  PID:10204
- C:\Windows\System\wbaznno.exe
  C:\Windows\System\wbaznno.exe
  2⤵
  PID:10220
- C:\Windows\System\XsZQiwi.exe
  C:\Windows\System\XsZQiwi.exe
  2⤵
  PID:10236
- C:\Windows\System\YKtTgUk.exe
  C:\Windows\System\YKtTgUk.exe
  2⤵
  PID:9228
- C:\Windows\System\NOWFAbR.exe
  C:\Windows\System\NOWFAbR.exe
  2⤵
  PID:9292
- C:\Windows\System\ZCqpZjH.exe
  C:\Windows\System\ZCqpZjH.exe
  2⤵
  PID:9384
- C:\Windows\System\yeLxXrS.exe
  C:\Windows\System\yeLxXrS.exe
  2⤵
  PID:9368
- C:\Windows\System\sxRTiZG.exe
  C:\Windows\System\sxRTiZG.exe
  2⤵
  PID:8632
- C:\Windows\System\JgZsUQn.exe
  C:\Windows\System\JgZsUQn.exe
  2⤵
  PID:9188
- C:\Windows\System\mOROuUw.exe
  C:\Windows\System\mOROuUw.exe
  2⤵
  PID:9304
- C:\Windows\System\RUTFwJU.exe
  C:\Windows\System\RUTFwJU.exe
  2⤵
  PID:9388
- C:\Windows\System\KZfcmPd.exe
  C:\Windows\System\KZfcmPd.exe
  2⤵
  PID:9452
- C:\Windows\System\PfSQKsK.exe
  C:\Windows\System\PfSQKsK.exe
  2⤵
  PID:9516
- C:\Windows\System\mVZoxzE.exe
  C:\Windows\System\mVZoxzE.exe
  2⤵
  PID:9580
- C:\Windows\System\anMrYPO.exe
  C:\Windows\System\anMrYPO.exe
  2⤵
  PID:9640
- C:\Windows\System\XWDXQyh.exe
  C:\Windows\System\XWDXQyh.exe
  2⤵
  PID:9672
- C:\Windows\System\lvtuHhN.exe
  C:\Windows\System\lvtuHhN.exe
  2⤵
  PID:9748
- C:\Windows\System\gBSkGSp.exe
  C:\Windows\System\gBSkGSp.exe
  2⤵
  PID:9812
- C:\Windows\System\atjtNiH.exe
  C:\Windows\System\atjtNiH.exe
  2⤵
  PID:9848
- C:\Windows\System\lPPMBkM.exe
  C:\Windows\System\lPPMBkM.exe
  2⤵
  PID:9916
- C:\Windows\System\qZKBhks.exe
  C:\Windows\System\qZKBhks.exe
  2⤵
  PID:9404
- C:\Windows\System\USgxZuw.exe
  C:\Windows\System\USgxZuw.exe
  2⤵
  PID:9796
- C:\Windows\System\SZwwHmD.exe
  C:\Windows\System\SZwwHmD.exe
  2⤵
  PID:9532
- C:\Windows\System\JlgEGTx.exe
  C:\Windows\System\JlgEGTx.exe
  2⤵
  PID:9624
- C:\Windows\System\BehuYFW.exe
  C:\Windows\System\BehuYFW.exe
  2⤵
  PID:9688
- C:\Windows\System\ELFvldI.exe
  C:\Windows\System\ELFvldI.exe
  2⤵
  PID:9732
- C:\Windows\System\RjujBjX.exe
  C:\Windows\System\RjujBjX.exe
  2⤵
  PID:9832
- C:\Windows\System\IGypOZG.exe
  C:\Windows\System\IGypOZG.exe
  2⤵
  PID:9464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AwRMgJI.exe

Filesize
1.0MB

MD5
3a4d940a8a46fe453da17e5645700dac

SHA1
6671e5b9246f1525c62af7b04b0e1ebf623315c1

SHA256
85f9034785ed877d82b433e2f59af189e318e232ade49eaaba996c7ec2df2a77

SHA512
eb17eb4f9235aca3b113b9c34a0efaf724f8360635530c8d85dc8bc41e01212b3a3ad1ab286a14a5f3dc00e160205216e6dd41446e5a39b6a907fdbcbbfbba72

Download Submit
C:\Windows\system\BVKTuQZ.exe

Filesize
1.0MB

MD5
4289339c127fc2f515a5f1f0bce8d980

SHA1
f0a3795185a57c73bd52129436a0eb3910c50e11

SHA256
6a322ae08497826d080781b70a073a0063929700e3b7264dca5d76cd632e01f5

SHA512
7643560669a8e4998051d2dcc10a5a235479519f98439aa2f46cd9bc0a5397836567a4ef3fed2dc174cf8b412aa52f1189aff034241a25cdf7b551bb84e753a8

Download Submit
C:\Windows\system\CDjiCSR.exe

Filesize
1.0MB

MD5
8b8df048828131f81bb570f79e030eed

SHA1
5e1bc34060df5fba36b44bfe0b45c8b626881346

SHA256
d0286cba81371df2a8993ab6d0c1e7813af98ef74704875910986c397b37a645

SHA512
2f75d7a617004ef626b26cbc1eae7671fe7cfbffe514709a5a91fe7e03db3a2a136ee49e476bcea699dae6f89bb743143b55b91770b6a5470d07312fce617182

Download Submit
C:\Windows\system\CQYyTua.exe

Filesize
1.0MB

MD5
12e14afcb7c84f8ced59c7f1823bc009

SHA1
bda60ef62a3aad1be87472d22ae5e026949c0856

SHA256
86dec70a4fc5cf2023a7843615bc8100b3b7e4d2f602c10d97d07fc7f8cb3b6f

SHA512
4c6d8b92fd7e3d24c04b23dff61cd7fb1bafa9f6f574aaeeb5a60355fef358641a16cebe2b48d591dc39fff70f3ea80a108b2546c475b38dd975b3960c42f527

Download Submit
C:\Windows\system\DVPpEbb.exe

Filesize
1.0MB

MD5
76c7ca987c84b3d562c62e462127682b

SHA1
6f9f5d2d40950a12203c1bc6cb8f283cf66aafde

SHA256
c4f27d3fb76eb720dee886eea4958e1a63b1a125b9ba539d2329943444f6b4fc

SHA512
39cf42c4cb4a9e4cabbd0620ae1bdf0398a85e3fb788743db4f79c3489a9eb0e282915f885b056369d8717f8a5ab0f4da146826e6232ae95c960799b97544719

Download Submit
C:\Windows\system\DpTsgHw.exe

Filesize
1.0MB

MD5
15f2eee21c882baab886ac3c237f4ddf

SHA1
b12258ebb91399115edfad1263d50c9315b724e6

SHA256
bfead6a7cc8303fd142531480e0866b05788df2135baa84cbd1e48c75e40c8ab

SHA512
58d7b07391727371d5540c6e07aebe47cfa07c375f08e6ccaa820c73705a89a782957e2e9a5d5c5cdac82eb98af5cd7bdadff9f6c03c928d22d805f308cc5cd8

Download Submit
C:\Windows\system\FuAgMiy.exe

Filesize
1.0MB

MD5
62466e21c9a47a36dd3b6f022b22d679

SHA1
ac518f9c33233b36360c5118e6baf88fb0d8a634

SHA256
4f07fb304683de40f20513d827371a82cac8b71d6555314af855666a4005006f

SHA512
b282769881688c0c71dac7ba337729a54e87d9c350c7dc281ceab81858a8c2ba7dbb6a00af871d2baf11c135a9ba5ef9dc7fa419f307fc8c15059abcc835dbf6

Download Submit
C:\Windows\system\HSdEjwk.exe

Filesize
1.0MB

MD5
e8d6ea82b2e23197862ba5a723433df8

SHA1
0339392c667fb8ab8459b9864f1a129f6f865dc6

SHA256
9814ef480764d152de21f1f7f8b5d1a461405c4ad5bc91279ea476b20ce6990b

SHA512
607a21500763785ebb309336fbdc084cbb43e27208163c38c1cb2bb002219dd38ba80de5555499448a96d686b6be15f4780e757f8f6441f43dbbbb2ef6207594

Download Submit
C:\Windows\system\JNRCpfX.exe

Filesize
1.0MB

MD5
710c768a77f654bee4f66d9fddc6dc78

SHA1
4e558f8e5192ba3785513a8607ba1a4df0df0fa8

SHA256
aa9d6ec99d64cca3205f9c4598506703287c004c9d2bdeac77ebe431c45f9554

SHA512
d88edecf35299f9e7b491fb544aa0e9c5cad9c8cf8852654b2d3cbd34502be9f1b7f5a2450bd195b8e9d8676fb99848bc58fa724eb25c9651a4c87bfb25e9cba

Download Submit
C:\Windows\system\JTfajyO.exe

Filesize
1.0MB

MD5
40e560ea9da9a1a362b8874a5e0ba344

SHA1
93cc4398df8f1b34a3ce9a880790979225d5be78

SHA256
847549f0f51d6cdc0e4e44f3dfd675d7e6b4ebdb787477710c4a3199adbb6468

SHA512
068637e7f366b3061a01978dd3399a4c3ca6583aa9d1809ea31a5ce6d92d85f26e96a5ea9f6e4d9caba15f27de18e1627586cd2ae10a2dfb7bfd064641423a23

Download Submit
C:\Windows\system\KpGQCrX.exe

Filesize
1.0MB

MD5
80f98fc6124795930d5f097bcc960722

SHA1
cbe0cc76b86308a0c720662ef84151a319eb2972

SHA256
b267c76e46ae86c8a62a072d955d8a37e89562b4578e2c74fb8b43efaab3be22

SHA512
8a0f5add6c70afab65726e53895c09b15eccae2aafb962a5e6b472fb724921fe7fa1237ad3de975dc6ea9ae117f6f48c4f6cd8d7bca33f208fccec300708b4d0

Download Submit
C:\Windows\system\LAGwRMq.exe

Filesize
1.0MB

MD5
2f5563ade66ed4ca63d157dbec9fabb5

SHA1
e350d903e2fa0d3040a2febe95d821aaa3530b44

SHA256
0ec79d51c0e34f7beec0830e370451653e879d5902278e138171458e07e3343e

SHA512
d031d7413c80b91ce37370462c189617c529ef35067bc928327e0021c089ffb7c1d2f9e6a63d6fed69859e7c29d76554abf3124718f25bd59fb65b210a7e1712

Download Submit
C:\Windows\system\MWpFCzZ.exe

Filesize
1.0MB

MD5
a39cbbeef78bbb13da77c2dd61c4f2fc

SHA1
1bc9956e0a84044a32f84e4d1991d9a78b6550b0

SHA256
b78594e5581761819e26e262f59a4a18907d7be28c83bc4451d0b4a395eff08b

SHA512
8ae32d943844e997afba3664372b597e046b93e9bdae82309c6d82d088ed1de57906a592c9cda77f2b26f80db6cb86242238f5497bb60187270275575ffbe5df

Download Submit
C:\Windows\system\NglGwkc.exe

Filesize
1.0MB

MD5
166f5b2b0b13f7b12e399396c32f916f

SHA1
e31027322e663f9509815eead97572f0f5a51221

SHA256
0f353d77e3906ed735daf699f6703d1ea0e8ccec31cb5757e52ef55e359fc82b

SHA512
85218b972c84e6e5c4dc53cb2b046e676cee4abc15a574fc6eb0d2a0fc019ba8cbe8f1fe836f12e02a8b38339633d7575ad3e3fd05eead5dc3f1ec3b802783dd

Download Submit
C:\Windows\system\RgftpSq.exe

Filesize
1.0MB

MD5
f8fbae66848bdb0e75e541e3ab72bee4

SHA1
16e2013d1fc2df598f7859f787ede350ef2f8a94

SHA256
117c70d365d0a99d603b9e028e9b562cef64a8b796d875c64c08bdc6ff9a6148

SHA512
d68867387fb2ff421df9f124ecc9df92bb276f6bade4f44b672d5481fd6ccf193479d3e1cf942e6e92b4f4c8e56cb20b01268914da497f2d95c520d2ced01e3d

Download Submit
C:\Windows\system\SwNOLfj.exe

Filesize
1.0MB

MD5
8b6c9f542ae2c0e44b18705ba0bd78ca

SHA1
7a71b84fc11991c4cf468aa1a1a64208f6efd64b

SHA256
af56cf4c6560580c60520da53321763c60a471372cd9a8f4bd63728b6a1729bd

SHA512
c8fc66aff48239de16ac011cbf5544219b4d4baf18ec6fef1dc681dea0976ec774005897a3843dda510f99c3f69dd3050dd50e63fd102cab7e9d5b79818fb249

Download Submit
C:\Windows\system\UjKFCna.exe

Filesize
1.0MB

MD5
104244d9dfd324fec36fda17d2b63ce5

SHA1
16449b88e6ac3bd2748fd5c2c28f148176f5aa76

SHA256
ecece844f0accaf48b09f2867c792bbd3261076315daa8cb51404e877d903e54

SHA512
86c922e15002dd7383d5d90eabec53d15fec597190efa2f3306c9e16dd92ebeb8c14b33c7bfdf0fce7f4b8f80f9a51e3d8fe361e7f1f274f07b52ee96dca40dd

Download Submit
C:\Windows\system\WYnrInp.exe

Filesize
1.0MB

MD5
a414f119c1f974769f4ae890ac9b971a

SHA1
b7797a0cd7a87ab8a502e23f140be15bf6d9cc2d

SHA256
7fda63f1e5aabbeae4570449ef7985f9f603574f22f4567dfae7e4e2770e75ea

SHA512
2c4d03dfd08fb6e137a69464ac1ae1a099b5892384fa467f811d5a9f028b0c2b10ec6a94453158e318ac7a2414b0e8ccddde5c14faf73dd3d7e9796028ab5816

Download Submit
C:\Windows\system\fDjFtiO.exe

Filesize
1.0MB

MD5
be09a0a3c2bef7f274f96c88fd24923f

SHA1
9729ed9248dbfdf53806de1997b4b8ed60be1c12

SHA256
a18f9ddf5bfe1d7b5ba4ce8730e21acfa71547893c36de0a3dc3373ea121081e

SHA512
4de48d03bf26d33d34007bd55a0fe5faefe5d2f14df2bd2449dc0027b0bea42d92b5c6dbe72a120c793e6dcd345bba712d5116491df05b7381595ff2d96a8715

Download Submit
C:\Windows\system\jevKXVu.exe

Filesize
1.0MB

MD5
d64a6358d71c584ab06bc6462a01a9be

SHA1
3186c66cf8d70cb764383443d3384207832bdf6e

SHA256
8fed97b71a30b77d66d6df9836ad553bff068da713ecc27b94863b1586ed5bce

SHA512
03ac731ddfbd02a8f5efbc42d283c104b631d8ae2aa2046f25121d8ebb4ef21986d7f2b0fa4f7bac95e53cc8925a44270b7fc62a89c22c3c5fd0f7891c711fa1

Download Submit
C:\Windows\system\jpPiSdD.exe

Filesize
1.0MB

MD5
67b4caabe292bb6960b64661c5c7f9de

SHA1
57d1f36489275d7bb6b368cc254d56321161c243

SHA256
f800cc592a4f5172539b16f2b9d802a98af1fa1a681fb5b8f1823759a84d8284

SHA512
3f66ccbe03a9d0e307fcc129aa0d7616ccf7c6f00ab794ccbdcc12f4c009f980a6a16e627e582d58b142fc4a94be2553307fa17c9f9ae6bb31446edc0de83f7b

Download Submit
C:\Windows\system\llcLhLr.exe

Filesize
1.0MB

MD5
0df03b2efaa2dffd067d745940e437d8

SHA1
e0c4996f9ce95daa0dd0888baa7074ae12b569ec

SHA256
34adf22133c0e382952ea1dfee0baed1e681c2e6495dc1387f4e52af781a30ec

SHA512
ee43b288f033115826c00cf8935bb2a5068155ee3fcaf8b0d8cb1f025ab483deacc1ed2fd7f64a710c9bb00bb8a01a2d21581f64c708ca5f50bd00a80b1af4b5

Download Submit
C:\Windows\system\omIhmnJ.exe

Filesize
1.0MB

MD5
2b96f05a2a91902dc8e7778461a92a8c

SHA1
9393895f622db52a9e879d7ab09c2d0095f80253

SHA256
1cfc8e94daa14bdf86a1258fda51273453f2aa2a3b528c130cc6eea0675717a8

SHA512
a3616b4b3c19e3a85e9d6ace35595bc075969a12151a00732d54d1c6cac3f417f914fee8ca24892c4ac900496c24959d1617e8dd22f946f247bb82443c21a1ff

Download Submit
C:\Windows\system\oxsSalj.exe

Filesize
1.0MB

MD5
5e08867cba94c99e3be34afdcfc06637

SHA1
3e59a3c980d54324e0d862ab0e28f48b5414afb7

SHA256
0bd2cbdea466468e311b74a89452a181f168838f82c6eff5c70c362b65c31322

SHA512
da8bb5bf428c509d90f1f80477361034a3eef0e86eb1a4ff6d607b342b5493217ae272f90e7241ee854674ce20b125ce7de982aa3a6138cde3afc54df930369f

Download Submit
C:\Windows\system\rygDTog.exe

Filesize
1.0MB

MD5
20352e9f53fc3533f47b50bc37a8bd3c

SHA1
4e6688e3c3dbd3337c5202ef7e31c0ae6ddf7b1a

SHA256
2eb26a7274645af6a96dcf37da51d1fa23d2f5c2ce10156e4f3497f98e140b4d

SHA512
00674567daedef1b6032b1535bda94bda6233c6e68d57624c51442cb365ea715112cf3dc1334b625a422bf4cbd8208b3d395d4e29f5459e5e2f31455f1309cca

Download Submit
C:\Windows\system\sskIVFe.exe

Filesize
1.0MB

MD5
71241f5caf384d0d14083985881e619b

SHA1
f3e27d2e8e2f68c19852bf1c2baef212d63b1dfd

SHA256
95eae1214d4964a33bbadbc89d4f583239b0c601c78c14de9b5c7dbd97d25b4c

SHA512
9b333ace3b6dc93cc2e788b73b06259bd9f57f179814548fd8991e11610d675d74dd0ee324621bed6a7debfb155ceeb38420f7ef2e2e0a99b5e7d40803d4c167

Download Submit
C:\Windows\system\tqZoJlN.exe

Filesize
1.0MB

MD5
00f38713fb7b5c69095c309fed0deda6

SHA1
3b33d83324211f24d73aa17dbf2bf7efae8f7ff1

SHA256
2be5fb0345601847e60b71fc94e4a8fa5b17b1919f9293bcddd2ffb5e792a320

SHA512
acc8b01dc56a346a77ae316fa1c4fd3caadaea035d5cbdc02e4a899393a970f13744ae2d1ae378a49c74ead8abede70808e9b2630e5ae739e252e344e766b2d1

Download Submit
C:\Windows\system\ucNZHLA.exe

Filesize
1.0MB

MD5
b20919260736dbf5a77e28f65227922d

SHA1
3a1a523e5703facdee9771747a4c14f0569a54b8

SHA256
fea2493edb8e98735f7f4ceb034e4ed27569e3d9de4c1fde98341b3ed2027a1a

SHA512
b16d591568978448709b0021ce9ab46c0936e5ac7a84745c87a346622598e6c80b684029b35aef731740b60982adc02ee7a141a2859b9cbb2c54baeb57b69772

Download Submit
C:\Windows\system\zxMlMOC.exe

Filesize
1.0MB

MD5
1ae485db5859f0c4eeec8480faf07834

SHA1
6d6c407904eac9a56ecfc0344aadcc9b01b69b48

SHA256
d8ca59466f073f4280757382f4ee7c68f1bf175df2528a602816b600735d80f1

SHA512
1be05ab9687fcb492fe928a192a0222bbf01521e55a1fae4f15e0b1ac9795256cad682d2d42cf7bb8589a5eaa9ab24d525be2d704cf04caf95982937ca8a9b37

Download Submit
\Windows\system\INOMaPJ.exe

Filesize
1.0MB

MD5
8a574ee9ad94e9b750e8e8fd41cb4db0

SHA1
9ffbaac1a91eae7430ffb5ccf0ebf3ea3b1f0cc1

SHA256
7b81578c5087a52783ec185a2f00de6179bf75767f0f54e785455b0e32d81037

SHA512
9f12f9dd22e6607bbd99e1acae815b508c53f37bc2e44c21e96e492a7d51aacc1dc80bcf0aba356401a5570e82b2163c7a237914f2ee0b683aab5f331d508caa

Download Submit
\Windows\system\MKNERkz.exe

Filesize
1.0MB

MD5
690fab97edf7615f54da0e1deaff4d12

SHA1
305d26b8d54d1433940ded3bc2b87bfc8eec2ff3

SHA256
1c3cd931162a11a5efcff9375180c9a16720166dd339314b24e2c9c6e856596a

SHA512
4f71a04f1443ea6f054858a3f4252d524d3af2535c87da799589a35f1d3482edfe2c7dc4f56e22fe8a9552d03789e26691463f332b8f983726853440df700acb

Download Submit
\Windows\system\oczdiaF.exe

Filesize
1.0MB

MD5
df0fbb5f7785097279c89ba0141d48fb

SHA1
038a48d4fed7486c054587880de5bae41a3d2897

SHA256
54d66a11a1df5923290a25678cce7ba58f2cb255356658928a155d738cf9516d

SHA512
96ca577655ba26f3fcce5d303f1e13977aa59583c80040134a6ad3d46d1a877c25931884bbe33cd677c00eb670c8819445ee22822a38b1ee1b59322d28d46316

Download Submit
memory/2980-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download