xmrig | 48eee9c29b3600eba12281cc40517b32836445d507de4b3ef4f39ab51f180b7c

Analysis

max time kernel
94s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
20-07-2024 04:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48dbb3f5435fc8831c85bf79c2198dd0N.exe
Size

1.6MB
MD5

48dbb3f5435fc8831c85bf79c2198dd0
SHA1

7120215feb3ca7a8581f3ef4187185139c068713
SHA256

48eee9c29b3600eba12281cc40517b32836445d507de4b3ef4f39ab51f180b7c
SHA512

ff93e298a187041d23cf13f55a657c3cdfd25a03e9dd52f19e76de64a480e6855aa5397c075633ac771e9a00206d13dc6ab43461b93a8362e4083888352e1514
SSDEEP

24576:RVIl/WDGCi7/qkatuBF672l6i2Ncb2ygupgrnACAmZ/NwFC31G3AcMaMYXoGQqEN:ROdWCCi7/raU56uL3pgrCEd2hXsfzus

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 28 IoCs

miner

resource	yara_rule
behavioral1/memory/2740-109-0x000000013F2B0000-0x000000013F601000-memory.dmp	xmrig
behavioral1/memory/1584-138-0x000000013FD20000-0x0000000140071000-memory.dmp	xmrig
behavioral1/memory/3024-137-0x000000013F280000-0x000000013F5D1000-memory.dmp	xmrig
behavioral1/memory/2664-136-0x000000013FED0000-0x0000000140221000-memory.dmp	xmrig
behavioral1/memory/2676-130-0x000000013F260000-0x000000013F5B1000-memory.dmp	xmrig
behavioral1/memory/2848-121-0x000000013F420000-0x000000013F771000-memory.dmp	xmrig
behavioral1/memory/2260-120-0x000000013F120000-0x000000013F471000-memory.dmp	xmrig
behavioral1/memory/3048-119-0x000000013FD80000-0x00000001400D1000-memory.dmp	xmrig
behavioral1/memory/3012-100-0x000000013FC50000-0x000000013FFA1000-memory.dmp	xmrig
behavioral1/memory/1584-77-0x000000013F2B0000-0x000000013F601000-memory.dmp	xmrig
behavioral1/memory/2172-76-0x000000013FAB0000-0x000000013FE01000-memory.dmp	xmrig
behavioral1/memory/1584-66-0x000000013FD80000-0x00000001400D1000-memory.dmp	xmrig
behavioral1/memory/2440-52-0x000000013F0F0000-0x000000013F441000-memory.dmp	xmrig
behavioral1/memory/300-106-0x000000013F2B0000-0x000000013F601000-memory.dmp	xmrig
behavioral1/memory/2108-38-0x000000013F890000-0x000000013FBE1000-memory.dmp	xmrig
behavioral1/memory/1584-3324-0x000000013F740000-0x000000013FA91000-memory.dmp	xmrig
behavioral1/memory/2260-3996-0x000000013F120000-0x000000013F471000-memory.dmp	xmrig
behavioral1/memory/2664-4005-0x000000013FED0000-0x0000000140221000-memory.dmp	xmrig
behavioral1/memory/3012-3995-0x000000013FC50000-0x000000013FFA1000-memory.dmp	xmrig
behavioral1/memory/2740-3992-0x000000013F2B0000-0x000000013F601000-memory.dmp	xmrig
behavioral1/memory/2172-3989-0x000000013FAB0000-0x000000013FE01000-memory.dmp	xmrig
behavioral1/memory/300-3988-0x000000013F2B0000-0x000000013F601000-memory.dmp	xmrig
behavioral1/memory/2440-3985-0x000000013F0F0000-0x000000013F441000-memory.dmp	xmrig
behavioral1/memory/2108-3984-0x000000013F890000-0x000000013FBE1000-memory.dmp	xmrig
behavioral1/memory/2848-4002-0x000000013F420000-0x000000013F771000-memory.dmp	xmrig
behavioral1/memory/3024-4019-0x000000013F280000-0x000000013F5D1000-memory.dmp	xmrig
behavioral1/memory/3048-4017-0x000000013FD80000-0x00000001400D1000-memory.dmp	xmrig
behavioral1/memory/2676-4049-0x000000013F260000-0x000000013F5B1000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2108	LYSgEri.exe
2440	acgSNJI.exe
2172	NAhWFPb.exe
3012	sGqpBre.exe
300	nzZxCSQ.exe
2740	CakhCwL.exe
3048	PiznrIG.exe
2260	NeyjiIG.exe
2664	KQNxMOa.exe
2848	oGrdSkQ.exe
3024	hdlehcs.exe
2676	YwKMVkF.exe
2596	cCZTVpB.exe
760	elTMyeo.exe
1052	IVYReGM.exe
2500	lUUjkYF.exe
2880	GZwvWfC.exe
2024	mHmTLiq.exe
2868	OcqARZY.exe
2620	FGrkMFO.exe
1960	isvxtnM.exe
2952	NBhKpXr.exe
2304	KJBPZSa.exe
2844	IpozKIa.exe
1904	lnpLeiq.exe
2068	fJYGtmH.exe
1908	BuhGSkr.exe
2160	AvkjnXf.exe
1220	oAMRtJm.exe
2708	CuNArRo.exe
2368	jfqbRxY.exe
1280	xrCdvws.exe
2416	GdYsQgf.exe
1104	lxjBTTX.exe
484	JShmvXI.exe
2204	EBojuNu.exe
2224	EIOEyQd.exe
1296	pDZTjVo.exe
2220	zqtcMBM.exe
1700	eFInFcv.exe
1216	XaNElPh.exe
1492	qbXnceq.exe
1288	hPnUKUX.exe
2228	nplyhml.exe
2240	yCjojlC.exe
2828	OzUpFrB.exe
2104	fPTZWAa.exe
2188	MBXcdkD.exe
1260	jjvxxSe.exe
3008	jDbovFX.exe
896	YHQpkBF.exe
888	FTXyOjf.exe
2996	WcotJBh.exe
2292	WrNjVZb.exe
1436	KGGtVhS.exe
2616	LJLJZTy.exe
2132	AYiVWQu.exe
3064	raHyMnz.exe
3032	HUgsjOz.exe
2872	PbOOZUt.exe
1576	FFhbmzb.exe
2736	AcUIAmt.exe
856	QpQJzjy.exe
1912	CltIzzF.exe

Loads dropped DLL 64 IoCs

pid	Process
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe
1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe

UPX packed file 60 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1584-0-0x000000013F740000-0x000000013FA91000-memory.dmp	upx
behavioral1/files/0x000a000000012029-3.dat	upx
behavioral1/files/0x0008000000015f55-10.dat	upx
behavioral1/files/0x0008000000016148-23.dat	upx
behavioral1/files/0x0005000000019253-44.dat	upx
behavioral1/files/0x0005000000019249-40.dat	upx
behavioral1/files/0x0005000000019394-108.dat	upx
behavioral1/files/0x00050000000193c3-122.dat	upx
behavioral1/memory/2740-109-0x000000013F2B0000-0x000000013F601000-memory.dmp	upx
behavioral1/files/0x00050000000194f4-158.dat	upx
behavioral1/files/0x000500000001963f-181.dat	upx
behavioral1/files/0x0005000000019412-187.dat	upx
behavioral1/files/0x0005000000019947-184.dat	upx
behavioral1/files/0x000500000001951b-173.dat	upx
behavioral1/files/0x00050000000193cf-166.dat	upx
behavioral1/files/0x00050000000193a2-165.dat	upx
behavioral1/files/0x00050000000194fc-162.dat	upx
behavioral1/files/0x0005000000019358-155.dat	upx
behavioral1/files/0x0005000000019309-152.dat	upx
behavioral1/files/0x0005000000019272-143.dat	upx
behavioral1/files/0x0005000000019256-140.dat	upx
behavioral1/memory/3024-137-0x000000013F280000-0x000000013F5D1000-memory.dmp	upx
behavioral1/memory/2664-136-0x000000013FED0000-0x0000000140221000-memory.dmp	upx
behavioral1/memory/2676-130-0x000000013F260000-0x000000013F5B1000-memory.dmp	upx
behavioral1/memory/2848-121-0x000000013F420000-0x000000013F771000-memory.dmp	upx
behavioral1/memory/2260-120-0x000000013F120000-0x000000013F471000-memory.dmp	upx
behavioral1/memory/3048-119-0x000000013FD80000-0x00000001400D1000-memory.dmp	upx
behavioral1/memory/3012-100-0x000000013FC50000-0x000000013FFA1000-memory.dmp	upx
behavioral1/files/0x000500000001994b-189.dat	upx
behavioral1/files/0x0005000000019368-99.dat	upx
behavioral1/files/0x0005000000019346-98.dat	upx
behavioral1/files/0x00050000000192fe-97.dat	upx
behavioral1/files/0x0005000000019385-96.dat	upx
behavioral1/memory/2172-76-0x000000013FAB0000-0x000000013FE01000-memory.dmp	upx
behavioral1/files/0x000700000001661e-73.dat	upx
behavioral1/files/0x000500000001925b-68.dat	upx
behavioral1/files/0x00070000000163b9-65.dat	upx
behavioral1/files/0x0008000000015fa3-60.dat	upx
behavioral1/memory/2440-52-0x000000013F0F0000-0x000000013F441000-memory.dmp	upx
behavioral1/files/0x0005000000019515-170.dat	upx
behavioral1/files/0x00050000000193e5-146.dat	upx
behavioral1/memory/300-106-0x000000013F2B0000-0x000000013F601000-memory.dmp	upx
behavioral1/files/0x000500000001923a-79.dat	upx
behavioral1/files/0x0005000000019246-47.dat	upx
behavioral1/files/0x0008000000016884-46.dat	upx
behavioral1/files/0x00070000000164cf-45.dat	upx
behavioral1/memory/2108-38-0x000000013F890000-0x000000013FBE1000-memory.dmp	upx
behavioral1/memory/1584-3324-0x000000013F740000-0x000000013FA91000-memory.dmp	upx
behavioral1/memory/2260-3996-0x000000013F120000-0x000000013F471000-memory.dmp	upx
behavioral1/memory/2664-4005-0x000000013FED0000-0x0000000140221000-memory.dmp	upx
behavioral1/memory/3012-3995-0x000000013FC50000-0x000000013FFA1000-memory.dmp	upx
behavioral1/memory/2740-3992-0x000000013F2B0000-0x000000013F601000-memory.dmp	upx
behavioral1/memory/2172-3989-0x000000013FAB0000-0x000000013FE01000-memory.dmp	upx
behavioral1/memory/300-3988-0x000000013F2B0000-0x000000013F601000-memory.dmp	upx
behavioral1/memory/2440-3985-0x000000013F0F0000-0x000000013F441000-memory.dmp	upx
behavioral1/memory/2108-3984-0x000000013F890000-0x000000013FBE1000-memory.dmp	upx
behavioral1/memory/2848-4002-0x000000013F420000-0x000000013F771000-memory.dmp	upx
behavioral1/memory/3024-4019-0x000000013F280000-0x000000013F5D1000-memory.dmp	upx
behavioral1/memory/3048-4017-0x000000013FD80000-0x00000001400D1000-memory.dmp	upx
behavioral1/memory/2676-4049-0x000000013F260000-0x000000013F5B1000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ZQNzWcA.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\xJTrgaB.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\AkuAaSw.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\OPJWrgX.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\IcTdERD.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\dSIqnHf.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\vQhSFpA.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\iOfLyeR.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\ZuWrVQV.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\SBmtohx.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\LlhIKzB.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\mqxUZZw.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\rOIjJVx.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\IGRNwze.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\QRYjCUS.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\DRczRkF.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\lnvBUUK.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\lVyabWo.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\bqHPgDo.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\FeCqSXK.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\zZaVPjE.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\HTRNxWv.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\SWsIYPZ.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\wunRRvy.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\cyCwSor.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\eIRLDAG.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\tPDSqpd.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\TnUwKSh.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\gFRkZYu.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\Yverphi.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\ZuhULJu.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\DrKxxCZ.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\kWsMWMn.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\ChsiWAP.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\iuAxjvp.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\DBXwhfR.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\xbsnnIz.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\zdNKMxY.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\DphdoDA.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\hcigzUR.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\ltHAFEk.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\YnEYeVa.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\aBukWJN.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\eovMtzD.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\TlkDtWq.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\IoSKJfm.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\qXOAEzz.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\qrskkTz.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\KcQzYQx.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\ptlEnrX.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\HNTMXHJ.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\WhPHMBh.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\kMBpNtV.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\WTwBXjT.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\ahdbBAL.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\YwKMVkF.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\vmkGCxT.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\wGoXhAU.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\qNXZqcH.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\qmuQPqM.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\KQuRZko.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\ekWsaTp.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\QVGjuVQ.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe
File created	C:\Windows\System\PGfhZFW.exe	48dbb3f5435fc8831c85bf79c2198dd0N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 2108	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	31
PID 1584 wrote to memory of 2108	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	31
PID 1584 wrote to memory of 2108	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	31
PID 1584 wrote to memory of 2440	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	32
PID 1584 wrote to memory of 2440	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	32
PID 1584 wrote to memory of 2440	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	32
PID 1584 wrote to memory of 3048	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	33
PID 1584 wrote to memory of 3048	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	33
PID 1584 wrote to memory of 3048	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	33
PID 1584 wrote to memory of 2172	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	34
PID 1584 wrote to memory of 2172	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	34
PID 1584 wrote to memory of 2172	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	34
PID 1584 wrote to memory of 2260	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	35
PID 1584 wrote to memory of 2260	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	35
PID 1584 wrote to memory of 2260	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	35
PID 1584 wrote to memory of 3012	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	36
PID 1584 wrote to memory of 3012	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	36
PID 1584 wrote to memory of 3012	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	36
PID 1584 wrote to memory of 3024	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	37
PID 1584 wrote to memory of 3024	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	37
PID 1584 wrote to memory of 3024	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	37
PID 1584 wrote to memory of 300	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	38
PID 1584 wrote to memory of 300	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	38
PID 1584 wrote to memory of 300	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	38
PID 1584 wrote to memory of 2676	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	39
PID 1584 wrote to memory of 2676	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	39
PID 1584 wrote to memory of 2676	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	39
PID 1584 wrote to memory of 2740	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	40
PID 1584 wrote to memory of 2740	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	40
PID 1584 wrote to memory of 2740	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	40
PID 1584 wrote to memory of 2880	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	41
PID 1584 wrote to memory of 2880	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	41
PID 1584 wrote to memory of 2880	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	41
PID 1584 wrote to memory of 2664	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	42
PID 1584 wrote to memory of 2664	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	42
PID 1584 wrote to memory of 2664	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	42
PID 1584 wrote to memory of 2868	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	43
PID 1584 wrote to memory of 2868	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	43
PID 1584 wrote to memory of 2868	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	43
PID 1584 wrote to memory of 2848	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	44
PID 1584 wrote to memory of 2848	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	44
PID 1584 wrote to memory of 2848	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	44
PID 1584 wrote to memory of 2620	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	45
PID 1584 wrote to memory of 2620	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	45
PID 1584 wrote to memory of 2620	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	45
PID 1584 wrote to memory of 2596	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	46
PID 1584 wrote to memory of 2596	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	46
PID 1584 wrote to memory of 2596	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	46
PID 1584 wrote to memory of 2952	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	47
PID 1584 wrote to memory of 2952	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	47
PID 1584 wrote to memory of 2952	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	47
PID 1584 wrote to memory of 760	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	48
PID 1584 wrote to memory of 760	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	48
PID 1584 wrote to memory of 760	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	48
PID 1584 wrote to memory of 2304	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	49
PID 1584 wrote to memory of 2304	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	49
PID 1584 wrote to memory of 2304	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	49
PID 1584 wrote to memory of 1052	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	50
PID 1584 wrote to memory of 1052	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	50
PID 1584 wrote to memory of 1052	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	50
PID 1584 wrote to memory of 1904	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	51
PID 1584 wrote to memory of 1904	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	51
PID 1584 wrote to memory of 1904	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	51
PID 1584 wrote to memory of 2500	1584	48dbb3f5435fc8831c85bf79c2198dd0N.exe	52

C:\Users\Admin\AppData\Local\Temp\48dbb3f5435fc8831c85bf79c2198dd0N.exe
"C:\Users\Admin\AppData\Local\Temp\48dbb3f5435fc8831c85bf79c2198dd0N.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\System\LYSgEri.exe
  C:\Windows\System\LYSgEri.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\acgSNJI.exe
  C:\Windows\System\acgSNJI.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\PiznrIG.exe
  C:\Windows\System\PiznrIG.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\NAhWFPb.exe
  C:\Windows\System\NAhWFPb.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\NeyjiIG.exe
  C:\Windows\System\NeyjiIG.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\sGqpBre.exe
  C:\Windows\System\sGqpBre.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\hdlehcs.exe
  C:\Windows\System\hdlehcs.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\nzZxCSQ.exe
  C:\Windows\System\nzZxCSQ.exe
  2⤵
  - Executes dropped EXE
  PID:300
- C:\Windows\System\YwKMVkF.exe
  C:\Windows\System\YwKMVkF.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\CakhCwL.exe
  C:\Windows\System\CakhCwL.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\GZwvWfC.exe
  C:\Windows\System\GZwvWfC.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\KQNxMOa.exe
  C:\Windows\System\KQNxMOa.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\OcqARZY.exe
  C:\Windows\System\OcqARZY.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\oGrdSkQ.exe
  C:\Windows\System\oGrdSkQ.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\FGrkMFO.exe
  C:\Windows\System\FGrkMFO.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\cCZTVpB.exe
  C:\Windows\System\cCZTVpB.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\NBhKpXr.exe
  C:\Windows\System\NBhKpXr.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\elTMyeo.exe
  C:\Windows\System\elTMyeo.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\KJBPZSa.exe
  C:\Windows\System\KJBPZSa.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\IVYReGM.exe
  C:\Windows\System\IVYReGM.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\lnpLeiq.exe
  C:\Windows\System\lnpLeiq.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\lUUjkYF.exe
  C:\Windows\System\lUUjkYF.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\fJYGtmH.exe
  C:\Windows\System\fJYGtmH.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\mHmTLiq.exe
  C:\Windows\System\mHmTLiq.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\BuhGSkr.exe
  C:\Windows\System\BuhGSkr.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\isvxtnM.exe
  C:\Windows\System\isvxtnM.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\CuNArRo.exe
  C:\Windows\System\CuNArRo.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\IpozKIa.exe
  C:\Windows\System\IpozKIa.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\xrCdvws.exe
  C:\Windows\System\xrCdvws.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\AvkjnXf.exe
  C:\Windows\System\AvkjnXf.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\GdYsQgf.exe
  C:\Windows\System\GdYsQgf.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\oAMRtJm.exe
  C:\Windows\System\oAMRtJm.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\JShmvXI.exe
  C:\Windows\System\JShmvXI.exe
  2⤵
  - Executes dropped EXE
  PID:484
- C:\Windows\System\jfqbRxY.exe
  C:\Windows\System\jfqbRxY.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\EIOEyQd.exe
  C:\Windows\System\EIOEyQd.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\lxjBTTX.exe
  C:\Windows\System\lxjBTTX.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\pDZTjVo.exe
  C:\Windows\System\pDZTjVo.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\EBojuNu.exe
  C:\Windows\System\EBojuNu.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\eFInFcv.exe
  C:\Windows\System\eFInFcv.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\zqtcMBM.exe
  C:\Windows\System\zqtcMBM.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\qbXnceq.exe
  C:\Windows\System\qbXnceq.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\XaNElPh.exe
  C:\Windows\System\XaNElPh.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\nplyhml.exe
  C:\Windows\System\nplyhml.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\hPnUKUX.exe
  C:\Windows\System\hPnUKUX.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\yCjojlC.exe
  C:\Windows\System\yCjojlC.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\OzUpFrB.exe
  C:\Windows\System\OzUpFrB.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\fPTZWAa.exe
  C:\Windows\System\fPTZWAa.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\MBXcdkD.exe
  C:\Windows\System\MBXcdkD.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\jjvxxSe.exe
  C:\Windows\System\jjvxxSe.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\jDbovFX.exe
  C:\Windows\System\jDbovFX.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\YHQpkBF.exe
  C:\Windows\System\YHQpkBF.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\FTXyOjf.exe
  C:\Windows\System\FTXyOjf.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\WcotJBh.exe
  C:\Windows\System\WcotJBh.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\WrNjVZb.exe
  C:\Windows\System\WrNjVZb.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\KGGtVhS.exe
  C:\Windows\System\KGGtVhS.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\LJLJZTy.exe
  C:\Windows\System\LJLJZTy.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\AYiVWQu.exe
  C:\Windows\System\AYiVWQu.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\raHyMnz.exe
  C:\Windows\System\raHyMnz.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\HUgsjOz.exe
  C:\Windows\System\HUgsjOz.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\PbOOZUt.exe
  C:\Windows\System\PbOOZUt.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\FFhbmzb.exe
  C:\Windows\System\FFhbmzb.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\AcUIAmt.exe
  C:\Windows\System\AcUIAmt.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\QpQJzjy.exe
  C:\Windows\System\QpQJzjy.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\CltIzzF.exe
  C:\Windows\System\CltIzzF.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\gMsvhMy.exe
  C:\Windows\System\gMsvhMy.exe
  2⤵
  PID:2820
- C:\Windows\System\iGhjwLA.exe
  C:\Windows\System\iGhjwLA.exe
  2⤵
  PID:536
- C:\Windows\System\zKGUCqB.exe
  C:\Windows\System\zKGUCqB.exe
  2⤵
  PID:2512
- C:\Windows\System\CvCPXfs.exe
  C:\Windows\System\CvCPXfs.exe
  2⤵
  PID:2688
- C:\Windows\System\JPEggUm.exe
  C:\Windows\System\JPEggUm.exe
  2⤵
  PID:2760
- C:\Windows\System\mmqBNbD.exe
  C:\Windows\System\mmqBNbD.exe
  2⤵
  PID:2796
- C:\Windows\System\OufiLSZ.exe
  C:\Windows\System\OufiLSZ.exe
  2⤵
  PID:2532
- C:\Windows\System\SKHHhQz.exe
  C:\Windows\System\SKHHhQz.exe
  2⤵
  PID:2020
- C:\Windows\System\FdVXSxl.exe
  C:\Windows\System\FdVXSxl.exe
  2⤵
  PID:1688
- C:\Windows\System\ybkHOlp.exe
  C:\Windows\System\ybkHOlp.exe
  2⤵
  PID:2096
- C:\Windows\System\sQFNmfo.exe
  C:\Windows\System\sQFNmfo.exe
  2⤵
  PID:2280
- C:\Windows\System\UzoBQKY.exe
  C:\Windows\System\UzoBQKY.exe
  2⤵
  PID:1632
- C:\Windows\System\iIARkMv.exe
  C:\Windows\System\iIARkMv.exe
  2⤵
  PID:1800
- C:\Windows\System\mNnBZnH.exe
  C:\Windows\System\mNnBZnH.exe
  2⤵
  PID:1652
- C:\Windows\System\oCxGINx.exe
  C:\Windows\System\oCxGINx.exe
  2⤵
  PID:1472
- C:\Windows\System\XQKYcjj.exe
  C:\Windows\System\XQKYcjj.exe
  2⤵
  PID:1952
- C:\Windows\System\krMFVAg.exe
  C:\Windows\System\krMFVAg.exe
  2⤵
  PID:1664
- C:\Windows\System\cfSQUji.exe
  C:\Windows\System\cfSQUji.exe
  2⤵
  PID:2884
- C:\Windows\System\rXRykdY.exe
  C:\Windows\System\rXRykdY.exe
  2⤵
  PID:924
- C:\Windows\System\sIAkVKo.exe
  C:\Windows\System\sIAkVKo.exe
  2⤵
  PID:956
- C:\Windows\System\WhAmGVL.exe
  C:\Windows\System\WhAmGVL.exe
  2⤵
  PID:1720
- C:\Windows\System\KqswCJE.exe
  C:\Windows\System\KqswCJE.exe
  2⤵
  PID:2352
- C:\Windows\System\bSRYzNP.exe
  C:\Windows\System\bSRYzNP.exe
  2⤵
  PID:996
- C:\Windows\System\BjNwJLE.exe
  C:\Windows\System\BjNwJLE.exe
  2⤵
  PID:708
- C:\Windows\System\OHanjPx.exe
  C:\Windows\System\OHanjPx.exe
  2⤵
  PID:2908
- C:\Windows\System\NzHDoZR.exe
  C:\Windows\System\NzHDoZR.exe
  2⤵
  PID:1636
- C:\Windows\System\vTtCHOB.exe
  C:\Windows\System\vTtCHOB.exe
  2⤵
  PID:1540
- C:\Windows\System\kLmFKVq.exe
  C:\Windows\System\kLmFKVq.exe
  2⤵
  PID:2264
- C:\Windows\System\IomxZCF.exe
  C:\Windows\System\IomxZCF.exe
  2⤵
  PID:2692
- C:\Windows\System\stKUFQZ.exe
  C:\Windows\System\stKUFQZ.exe
  2⤵
  PID:2640
- C:\Windows\System\TzEyLxN.exe
  C:\Windows\System\TzEyLxN.exe
  2⤵
  PID:2464
- C:\Windows\System\JtWUqCc.exe
  C:\Windows\System\JtWUqCc.exe
  2⤵
  PID:1448
- C:\Windows\System\IcLkTQN.exe
  C:\Windows\System\IcLkTQN.exe
  2⤵
  PID:2836
- C:\Windows\System\hElUgXK.exe
  C:\Windows\System\hElUgXK.exe
  2⤵
  PID:2800
- C:\Windows\System\kDHOAGS.exe
  C:\Windows\System\kDHOAGS.exe
  2⤵
  PID:2580
- C:\Windows\System\LLFFlrR.exe
  C:\Windows\System\LLFFlrR.exe
  2⤵
  PID:1028
- C:\Windows\System\ZmTmbNd.exe
  C:\Windows\System\ZmTmbNd.exe
  2⤵
  PID:2028
- C:\Windows\System\NPwHdZt.exe
  C:\Windows\System\NPwHdZt.exe
  2⤵
  PID:1556
- C:\Windows\System\jbaAdvs.exe
  C:\Windows\System\jbaAdvs.exe
  2⤵
  PID:1656
- C:\Windows\System\lRYSvTW.exe
  C:\Windows\System\lRYSvTW.exe
  2⤵
  PID:2136
- C:\Windows\System\rdAIqMR.exe
  C:\Windows\System\rdAIqMR.exe
  2⤵
  PID:2148
- C:\Windows\System\vNlcufz.exe
  C:\Windows\System\vNlcufz.exe
  2⤵
  PID:2716
- C:\Windows\System\tiBSHtX.exe
  C:\Windows\System\tiBSHtX.exe
  2⤵
  PID:992
- C:\Windows\System\aHxePKB.exe
  C:\Windows\System\aHxePKB.exe
  2⤵
  PID:1520
- C:\Windows\System\ZxPVmck.exe
  C:\Windows\System\ZxPVmck.exe
  2⤵
  PID:696
- C:\Windows\System\fiLhUgj.exe
  C:\Windows\System\fiLhUgj.exe
  2⤵
  PID:788
- C:\Windows\System\EROmFzn.exe
  C:\Windows\System\EROmFzn.exe
  2⤵
  PID:772
- C:\Windows\System\METvBOI.exe
  C:\Windows\System\METvBOI.exe
  2⤵
  PID:1684
- C:\Windows\System\AUfjoAF.exe
  C:\Windows\System\AUfjoAF.exe
  2⤵
  PID:2496
- C:\Windows\System\gtPQpGo.exe
  C:\Windows\System\gtPQpGo.exe
  2⤵
  PID:2112
- C:\Windows\System\kRwXnkL.exe
  C:\Windows\System\kRwXnkL.exe
  2⤵
  PID:2768
- C:\Windows\System\zdQQkSc.exe
  C:\Windows\System\zdQQkSc.exe
  2⤵
  PID:2944
- C:\Windows\System\cGGHbjQ.exe
  C:\Windows\System\cGGHbjQ.exe
  2⤵
  PID:2404
- C:\Windows\System\IcWPCeX.exe
  C:\Windows\System\IcWPCeX.exe
  2⤵
  PID:2212
- C:\Windows\System\GjRszaq.exe
  C:\Windows\System\GjRszaq.exe
  2⤵
  PID:3060
- C:\Windows\System\gVAiHBG.exe
  C:\Windows\System\gVAiHBG.exe
  2⤵
  PID:2776
- C:\Windows\System\LxqfUxP.exe
  C:\Windows\System\LxqfUxP.exe
  2⤵
  PID:2804
- C:\Windows\System\bfKCBjc.exe
  C:\Windows\System\bfKCBjc.exe
  2⤵
  PID:1648
- C:\Windows\System\JGPYVhN.exe
  C:\Windows\System\JGPYVhN.exe
  2⤵
  PID:1076
- C:\Windows\System\HuzdhLp.exe
  C:\Windows\System\HuzdhLp.exe
  2⤵
  PID:1388
- C:\Windows\System\KZOrkVb.exe
  C:\Windows\System\KZOrkVb.exe
  2⤵
  PID:1812
- C:\Windows\System\IXQenxe.exe
  C:\Windows\System\IXQenxe.exe
  2⤵
  PID:3028
- C:\Windows\System\bqHPgDo.exe
  C:\Windows\System\bqHPgDo.exe
  2⤵
  PID:556
- C:\Windows\System\YYutWvj.exe
  C:\Windows\System\YYutWvj.exe
  2⤵
  PID:2712
- C:\Windows\System\pWOokcc.exe
  C:\Windows\System\pWOokcc.exe
  2⤵
  PID:1428
- C:\Windows\System\zDZUzOV.exe
  C:\Windows\System\zDZUzOV.exe
  2⤵
  PID:2808
- C:\Windows\System\RRFVgIo.exe
  C:\Windows\System\RRFVgIo.exe
  2⤵
  PID:2124
- C:\Windows\System\pbDGHqT.exe
  C:\Windows\System\pbDGHqT.exe
  2⤵
  PID:2840
- C:\Windows\System\SUJeHGA.exe
  C:\Windows\System\SUJeHGA.exe
  2⤵
  PID:2040
- C:\Windows\System\NyGwiiD.exe
  C:\Windows\System\NyGwiiD.exe
  2⤵
  PID:2552
- C:\Windows\System\fsHUDba.exe
  C:\Windows\System\fsHUDba.exe
  2⤵
  PID:1380
- C:\Windows\System\sVQRwDQ.exe
  C:\Windows\System\sVQRwDQ.exe
  2⤵
  PID:2144
- C:\Windows\System\OLZVdxb.exe
  C:\Windows\System\OLZVdxb.exe
  2⤵
  PID:2452
- C:\Windows\System\GMflBLL.exe
  C:\Windows\System\GMflBLL.exe
  2⤵
  PID:968
- C:\Windows\System\zTcIyMS.exe
  C:\Windows\System\zTcIyMS.exe
  2⤵
  PID:3076
- C:\Windows\System\pMVYqtF.exe
  C:\Windows\System\pMVYqtF.exe
  2⤵
  PID:3096
- C:\Windows\System\MbhrLDC.exe
  C:\Windows\System\MbhrLDC.exe
  2⤵
  PID:3116
- C:\Windows\System\Hacemtx.exe
  C:\Windows\System\Hacemtx.exe
  2⤵
  PID:3136
- C:\Windows\System\GkUrKkT.exe
  C:\Windows\System\GkUrKkT.exe
  2⤵
  PID:3152
- C:\Windows\System\gAGFqzA.exe
  C:\Windows\System\gAGFqzA.exe
  2⤵
  PID:3172
- C:\Windows\System\DPbHGdJ.exe
  C:\Windows\System\DPbHGdJ.exe
  2⤵
  PID:3192
- C:\Windows\System\rdXUKSl.exe
  C:\Windows\System\rdXUKSl.exe
  2⤵
  PID:3216
- C:\Windows\System\BtzAnQA.exe
  C:\Windows\System\BtzAnQA.exe
  2⤵
  PID:3236
- C:\Windows\System\sBRSOsP.exe
  C:\Windows\System\sBRSOsP.exe
  2⤵
  PID:3252
- C:\Windows\System\UNyaqdC.exe
  C:\Windows\System\UNyaqdC.exe
  2⤵
  PID:3276
- C:\Windows\System\aBukWJN.exe
  C:\Windows\System\aBukWJN.exe
  2⤵
  PID:3292
- C:\Windows\System\ujCQGPz.exe
  C:\Windows\System\ujCQGPz.exe
  2⤵
  PID:3312
- C:\Windows\System\NfzmrBK.exe
  C:\Windows\System\NfzmrBK.exe
  2⤵
  PID:3336
- C:\Windows\System\RsopBld.exe
  C:\Windows\System\RsopBld.exe
  2⤵
  PID:3356
- C:\Windows\System\NeYdXjj.exe
  C:\Windows\System\NeYdXjj.exe
  2⤵
  PID:3372
- C:\Windows\System\ijnFCji.exe
  C:\Windows\System\ijnFCji.exe
  2⤵
  PID:3392
- C:\Windows\System\EzMGSeh.exe
  C:\Windows\System\EzMGSeh.exe
  2⤵
  PID:3416
- C:\Windows\System\sEllLpj.exe
  C:\Windows\System\sEllLpj.exe
  2⤵
  PID:3436
- C:\Windows\System\gFxvBcy.exe
  C:\Windows\System\gFxvBcy.exe
  2⤵
  PID:3456
- C:\Windows\System\bTXnLss.exe
  C:\Windows\System\bTXnLss.exe
  2⤵
  PID:3472
- C:\Windows\System\XyajGtL.exe
  C:\Windows\System\XyajGtL.exe
  2⤵
  PID:3500
- C:\Windows\System\XExElbN.exe
  C:\Windows\System\XExElbN.exe
  2⤵
  PID:3520
- C:\Windows\System\Bpptrnl.exe
  C:\Windows\System\Bpptrnl.exe
  2⤵
  PID:3540
- C:\Windows\System\UyvjOxn.exe
  C:\Windows\System\UyvjOxn.exe
  2⤵
  PID:3560
- C:\Windows\System\BROrESm.exe
  C:\Windows\System\BROrESm.exe
  2⤵
  PID:3580
- C:\Windows\System\DQjWrtT.exe
  C:\Windows\System\DQjWrtT.exe
  2⤵
  PID:3600
- C:\Windows\System\hmtZxwZ.exe
  C:\Windows\System\hmtZxwZ.exe
  2⤵
  PID:3620
- C:\Windows\System\vqvzhNs.exe
  C:\Windows\System\vqvzhNs.exe
  2⤵
  PID:3640
- C:\Windows\System\ekWsaTp.exe
  C:\Windows\System\ekWsaTp.exe
  2⤵
  PID:3660
- C:\Windows\System\vEqSmOe.exe
  C:\Windows\System\vEqSmOe.exe
  2⤵
  PID:3680
- C:\Windows\System\NQHMTHG.exe
  C:\Windows\System\NQHMTHG.exe
  2⤵
  PID:3700
- C:\Windows\System\CigKpJS.exe
  C:\Windows\System\CigKpJS.exe
  2⤵
  PID:3720
- C:\Windows\System\bsbVxKY.exe
  C:\Windows\System\bsbVxKY.exe
  2⤵
  PID:3740
- C:\Windows\System\FgxmFge.exe
  C:\Windows\System\FgxmFge.exe
  2⤵
  PID:3760
- C:\Windows\System\cXyMRwR.exe
  C:\Windows\System\cXyMRwR.exe
  2⤵
  PID:3780
- C:\Windows\System\oNhtqGS.exe
  C:\Windows\System\oNhtqGS.exe
  2⤵
  PID:3800
- C:\Windows\System\qmyCCoX.exe
  C:\Windows\System\qmyCCoX.exe
  2⤵
  PID:3820
- C:\Windows\System\pSPUwAD.exe
  C:\Windows\System\pSPUwAD.exe
  2⤵
  PID:3840
- C:\Windows\System\OmGgzRZ.exe
  C:\Windows\System\OmGgzRZ.exe
  2⤵
  PID:3856
- C:\Windows\System\BqASSVE.exe
  C:\Windows\System\BqASSVE.exe
  2⤵
  PID:3876
- C:\Windows\System\skBJDLl.exe
  C:\Windows\System\skBJDLl.exe
  2⤵
  PID:3896
- C:\Windows\System\XkvMNKq.exe
  C:\Windows\System\XkvMNKq.exe
  2⤵
  PID:3920
- C:\Windows\System\zVMihGd.exe
  C:\Windows\System\zVMihGd.exe
  2⤵
  PID:3940
- C:\Windows\System\BtpEAGt.exe
  C:\Windows\System\BtpEAGt.exe
  2⤵
  PID:3960
- C:\Windows\System\jBXnskn.exe
  C:\Windows\System\jBXnskn.exe
  2⤵
  PID:3980
- C:\Windows\System\TfaDPUj.exe
  C:\Windows\System\TfaDPUj.exe
  2⤵
  PID:4000
- C:\Windows\System\IzrWeku.exe
  C:\Windows\System\IzrWeku.exe
  2⤵
  PID:4020
- C:\Windows\System\pYwYiNb.exe
  C:\Windows\System\pYwYiNb.exe
  2⤵
  PID:4040
- C:\Windows\System\PifraWD.exe
  C:\Windows\System\PifraWD.exe
  2⤵
  PID:4060
- C:\Windows\System\JlWYWBz.exe
  C:\Windows\System\JlWYWBz.exe
  2⤵
  PID:4080
- C:\Windows\System\ojRjXvW.exe
  C:\Windows\System\ojRjXvW.exe
  2⤵
  PID:644
- C:\Windows\System\xwcjzWt.exe
  C:\Windows\System\xwcjzWt.exe
  2⤵
  PID:1924
- C:\Windows\System\bWSaoYr.exe
  C:\Windows\System\bWSaoYr.exe
  2⤵
  PID:2892
- C:\Windows\System\CcFYMvK.exe
  C:\Windows\System\CcFYMvK.exe
  2⤵
  PID:2428
- C:\Windows\System\ZqPhluW.exe
  C:\Windows\System\ZqPhluW.exe
  2⤵
  PID:1704
- C:\Windows\System\pWeDRss.exe
  C:\Windows\System\pWeDRss.exe
  2⤵
  PID:3108
- C:\Windows\System\VIhIJhN.exe
  C:\Windows\System\VIhIJhN.exe
  2⤵
  PID:3144
- C:\Windows\System\xbtPwVC.exe
  C:\Windows\System\xbtPwVC.exe
  2⤵
  PID:2728
- C:\Windows\System\XDjddZV.exe
  C:\Windows\System\XDjddZV.exe
  2⤵
  PID:700
- C:\Windows\System\noXNQSJ.exe
  C:\Windows\System\noXNQSJ.exe
  2⤵
  PID:3224
- C:\Windows\System\vUjQPvZ.exe
  C:\Windows\System\vUjQPvZ.exe
  2⤵
  PID:2208
- C:\Windows\System\iLdgdcj.exe
  C:\Windows\System\iLdgdcj.exe
  2⤵
  PID:3124
- C:\Windows\System\FEFHkHC.exe
  C:\Windows\System\FEFHkHC.exe
  2⤵
  PID:3264
- C:\Windows\System\IoSKJfm.exe
  C:\Windows\System\IoSKJfm.exe
  2⤵
  PID:3164
- C:\Windows\System\pFJRdbc.exe
  C:\Windows\System\pFJRdbc.exe
  2⤵
  PID:3300
- C:\Windows\System\gFRkZYu.exe
  C:\Windows\System\gFRkZYu.exe
  2⤵
  PID:3348
- C:\Windows\System\DfZmYrW.exe
  C:\Windows\System\DfZmYrW.exe
  2⤵
  PID:3248
- C:\Windows\System\gmEtquw.exe
  C:\Windows\System\gmEtquw.exe
  2⤵
  PID:3332
- C:\Windows\System\aIEOUAn.exe
  C:\Windows\System\aIEOUAn.exe
  2⤵
  PID:3408
- C:\Windows\System\VAUndBX.exe
  C:\Windows\System\VAUndBX.exe
  2⤵
  PID:3448
- C:\Windows\System\IdrYUBc.exe
  C:\Windows\System\IdrYUBc.exe
  2⤵
  PID:3516
- C:\Windows\System\hVXvlpA.exe
  C:\Windows\System\hVXvlpA.exe
  2⤵
  PID:3588
- C:\Windows\System\ACiacFl.exe
  C:\Windows\System\ACiacFl.exe
  2⤵
  PID:3536
- C:\Windows\System\Vwixqmh.exe
  C:\Windows\System\Vwixqmh.exe
  2⤵
  PID:2544
- C:\Windows\System\uscdPsY.exe
  C:\Windows\System\uscdPsY.exe
  2⤵
  PID:636
- C:\Windows\System\GuBWnhQ.exe
  C:\Windows\System\GuBWnhQ.exe
  2⤵
  PID:3636
- C:\Windows\System\yacbMRt.exe
  C:\Windows\System\yacbMRt.exe
  2⤵
  PID:3568
- C:\Windows\System\UnTOpGx.exe
  C:\Windows\System\UnTOpGx.exe
  2⤵
  PID:3676
- C:\Windows\System\HDxcyPF.exe
  C:\Windows\System\HDxcyPF.exe
  2⤵
  PID:3652
- C:\Windows\System\iOfLyeR.exe
  C:\Windows\System\iOfLyeR.exe
  2⤵
  PID:3688
- C:\Windows\System\IwXUNSv.exe
  C:\Windows\System\IwXUNSv.exe
  2⤵
  PID:3752
- C:\Windows\System\SDmaFtt.exe
  C:\Windows\System\SDmaFtt.exe
  2⤵
  PID:3828
- C:\Windows\System\QOldCkt.exe
  C:\Windows\System\QOldCkt.exe
  2⤵
  PID:3728
- C:\Windows\System\DHcixHr.exe
  C:\Windows\System\DHcixHr.exe
  2⤵
  PID:2600
- C:\Windows\System\TtVSiYD.exe
  C:\Windows\System\TtVSiYD.exe
  2⤵
  PID:2380
- C:\Windows\System\itJboez.exe
  C:\Windows\System\itJboez.exe
  2⤵
  PID:1944
- C:\Windows\System\DAtKdrp.exe
  C:\Windows\System\DAtKdrp.exe
  2⤵
  PID:560
- C:\Windows\System\bvJpbtW.exe
  C:\Windows\System\bvJpbtW.exe
  2⤵
  PID:3812
- C:\Windows\System\epprIsJ.exe
  C:\Windows\System\epprIsJ.exe
  2⤵
  PID:3892
- C:\Windows\System\jBWhHGV.exe
  C:\Windows\System\jBWhHGV.exe
  2⤵
  PID:3884
- C:\Windows\System\BeKZHSV.exe
  C:\Windows\System\BeKZHSV.exe
  2⤵
  PID:3948
- C:\Windows\System\bySNcne.exe
  C:\Windows\System\bySNcne.exe
  2⤵
  PID:3988
- C:\Windows\System\QhuHMbs.exe
  C:\Windows\System\QhuHMbs.exe
  2⤵
  PID:3932
- C:\Windows\System\XgFanLK.exe
  C:\Windows\System\XgFanLK.exe
  2⤵
  PID:1252
- C:\Windows\System\gtEFflp.exe
  C:\Windows\System\gtEFflp.exe
  2⤵
  PID:4028
- C:\Windows\System\HtdruWG.exe
  C:\Windows\System\HtdruWG.exe
  2⤵
  PID:4068
- C:\Windows\System\nOjXhyz.exe
  C:\Windows\System\nOjXhyz.exe
  2⤵
  PID:3068
- C:\Windows\System\TOeIcWc.exe
  C:\Windows\System\TOeIcWc.exe
  2⤵
  PID:2468
- C:\Windows\System\VRxZIjt.exe
  C:\Windows\System\VRxZIjt.exe
  2⤵
  PID:4088
- C:\Windows\System\ICwaEjI.exe
  C:\Windows\System\ICwaEjI.exe
  2⤵
  PID:884
- C:\Windows\System\dTvtasZ.exe
  C:\Windows\System\dTvtasZ.exe
  2⤵
  PID:3188
- C:\Windows\System\dZzvlvT.exe
  C:\Windows\System\dZzvlvT.exe
  2⤵
  PID:3084
- C:\Windows\System\KSnogxD.exe
  C:\Windows\System\KSnogxD.exe
  2⤵
  PID:1660
- C:\Windows\System\sytIkCz.exe
  C:\Windows\System\sytIkCz.exe
  2⤵
  PID:2164
- C:\Windows\System\KsWgIUg.exe
  C:\Windows\System\KsWgIUg.exe
  2⤵
  PID:3432
- C:\Windows\System\hpbeuNS.exe
  C:\Windows\System\hpbeuNS.exe
  2⤵
  PID:3352
- C:\Windows\System\MPeKNIm.exe
  C:\Windows\System\MPeKNIm.exe
  2⤵
  PID:2592
- C:\Windows\System\MhSblda.exe
  C:\Windows\System\MhSblda.exe
  2⤵
  PID:3552
- C:\Windows\System\HLNpmIF.exe
  C:\Windows\System\HLNpmIF.exe
  2⤵
  PID:3608
- C:\Windows\System\OuLlXzm.exe
  C:\Windows\System\OuLlXzm.exe
  2⤵
  PID:1136
- C:\Windows\System\iKSaiHo.exe
  C:\Windows\System\iKSaiHo.exe
  2⤵
  PID:3576
- C:\Windows\System\iBcFwqZ.exe
  C:\Windows\System\iBcFwqZ.exe
  2⤵
  PID:2780
- C:\Windows\System\WEVuWbo.exe
  C:\Windows\System\WEVuWbo.exe
  2⤵
  PID:2324
- C:\Windows\System\ubpsnJD.exe
  C:\Windows\System\ubpsnJD.exe
  2⤵
  PID:2528
- C:\Windows\System\XQbRazp.exe
  C:\Windows\System\XQbRazp.exe
  2⤵
  PID:1196
- C:\Windows\System\CopoQMZ.exe
  C:\Windows\System\CopoQMZ.exe
  2⤵
  PID:3772
- C:\Windows\System\oHQHWFP.exe
  C:\Windows\System\oHQHWFP.exe
  2⤵
  PID:3888
- C:\Windows\System\mkpNadF.exe
  C:\Windows\System\mkpNadF.exe
  2⤵
  PID:2588
- C:\Windows\System\hdoeLPI.exe
  C:\Windows\System\hdoeLPI.exe
  2⤵
  PID:3868
- C:\Windows\System\aXFtXsk.exe
  C:\Windows\System\aXFtXsk.exe
  2⤵
  PID:4072
- C:\Windows\System\EHAbMCO.exe
  C:\Windows\System\EHAbMCO.exe
  2⤵
  PID:4032
- C:\Windows\System\WazNKVs.exe
  C:\Windows\System\WazNKVs.exe
  2⤵
  PID:4092
- C:\Windows\System\EWRsyql.exe
  C:\Windows\System\EWRsyql.exe
  2⤵
  PID:3184
- C:\Windows\System\TkwbklX.exe
  C:\Windows\System\TkwbklX.exe
  2⤵
  PID:1736
- C:\Windows\System\sZYqNof.exe
  C:\Windows\System\sZYqNof.exe
  2⤵
  PID:1740
- C:\Windows\System\iPOdHWP.exe
  C:\Windows\System\iPOdHWP.exe
  2⤵
  PID:1968
- C:\Windows\System\ZTJtaDy.exe
  C:\Windows\System\ZTJtaDy.exe
  2⤵
  PID:3848
- C:\Windows\System\fVftUGh.exe
  C:\Windows\System\fVftUGh.exe
  2⤵
  PID:1928
- C:\Windows\System\qUjQRMV.exe
  C:\Windows\System\qUjQRMV.exe
  2⤵
  PID:3364
- C:\Windows\System\NWYJIyz.exe
  C:\Windows\System\NWYJIyz.exe
  2⤵
  PID:2928
- C:\Windows\System\YiLAPAl.exe
  C:\Windows\System\YiLAPAl.exe
  2⤵
  PID:3496
- C:\Windows\System\yBslHbv.exe
  C:\Windows\System\yBslHbv.exe
  2⤵
  PID:3260
- C:\Windows\System\LbZjeqi.exe
  C:\Windows\System\LbZjeqi.exe
  2⤵
  PID:3656
- C:\Windows\System\MWxRNsZ.exe
  C:\Windows\System\MWxRNsZ.exe
  2⤵
  PID:328
- C:\Windows\System\ftJsduQ.exe
  C:\Windows\System\ftJsduQ.exe
  2⤵
  PID:2644
- C:\Windows\System\mRaGDzM.exe
  C:\Windows\System\mRaGDzM.exe
  2⤵
  PID:3592
- C:\Windows\System\LlIwrZR.exe
  C:\Windows\System\LlIwrZR.exe
  2⤵
  PID:3716
- C:\Windows\System\bPJluwh.exe
  C:\Windows\System\bPJluwh.exe
  2⤵
  PID:1756
- C:\Windows\System\BJGVSKD.exe
  C:\Windows\System\BJGVSKD.exe
  2⤵
  PID:4052
- C:\Windows\System\dqESSCd.exe
  C:\Windows\System\dqESSCd.exe
  2⤵
  PID:3796
- C:\Windows\System\ponIZlZ.exe
  C:\Windows\System\ponIZlZ.exe
  2⤵
  PID:3912
- C:\Windows\System\jLydmqf.exe
  C:\Windows\System\jLydmqf.exe
  2⤵
  PID:2696
- C:\Windows\System\GIsSIQs.exe
  C:\Windows\System\GIsSIQs.exe
  2⤵
  PID:1044
- C:\Windows\System\MdzSkGo.exe
  C:\Windows\System\MdzSkGo.exe
  2⤵
  PID:4100
- C:\Windows\System\XCzUpVj.exe
  C:\Windows\System\XCzUpVj.exe
  2⤵
  PID:4116
- C:\Windows\System\txWueKc.exe
  C:\Windows\System\txWueKc.exe
  2⤵
  PID:4132
- C:\Windows\System\DstclWr.exe
  C:\Windows\System\DstclWr.exe
  2⤵
  PID:4152
- C:\Windows\System\fxhjUJI.exe
  C:\Windows\System\fxhjUJI.exe
  2⤵
  PID:4168
- C:\Windows\System\FUKyCoD.exe
  C:\Windows\System\FUKyCoD.exe
  2⤵
  PID:4188
- C:\Windows\System\UPpbpEM.exe
  C:\Windows\System\UPpbpEM.exe
  2⤵
  PID:4204
- C:\Windows\System\eWzgTlh.exe
  C:\Windows\System\eWzgTlh.exe
  2⤵
  PID:4220
- C:\Windows\System\HUWDoaQ.exe
  C:\Windows\System\HUWDoaQ.exe
  2⤵
  PID:4240
- C:\Windows\System\vmkGCxT.exe
  C:\Windows\System\vmkGCxT.exe
  2⤵
  PID:4256
- C:\Windows\System\FuQxWRA.exe
  C:\Windows\System\FuQxWRA.exe
  2⤵
  PID:4272
- C:\Windows\System\QjAfCbT.exe
  C:\Windows\System\QjAfCbT.exe
  2⤵
  PID:4288
- C:\Windows\System\vjRMMbj.exe
  C:\Windows\System\vjRMMbj.exe
  2⤵
  PID:4308
- C:\Windows\System\PilpGRo.exe
  C:\Windows\System\PilpGRo.exe
  2⤵
  PID:4332
- C:\Windows\System\LdkVGnN.exe
  C:\Windows\System\LdkVGnN.exe
  2⤵
  PID:4348
- C:\Windows\System\NmUljNZ.exe
  C:\Windows\System\NmUljNZ.exe
  2⤵
  PID:4364
- C:\Windows\System\TXNHzoW.exe
  C:\Windows\System\TXNHzoW.exe
  2⤵
  PID:4380
- C:\Windows\System\QVGjuVQ.exe
  C:\Windows\System\QVGjuVQ.exe
  2⤵
  PID:4396
- C:\Windows\System\ffidycb.exe
  C:\Windows\System\ffidycb.exe
  2⤵
  PID:4416
- C:\Windows\System\BgVkhVP.exe
  C:\Windows\System\BgVkhVP.exe
  2⤵
  PID:4436
- C:\Windows\System\nkNOssx.exe
  C:\Windows\System\nkNOssx.exe
  2⤵
  PID:4456
- C:\Windows\System\uQQIFAd.exe
  C:\Windows\System\uQQIFAd.exe
  2⤵
  PID:4472
- C:\Windows\System\lOQYdGm.exe
  C:\Windows\System\lOQYdGm.exe
  2⤵
  PID:4488
- C:\Windows\System\rqHYxWx.exe
  C:\Windows\System\rqHYxWx.exe
  2⤵
  PID:4504
- C:\Windows\System\omGXmFi.exe
  C:\Windows\System\omGXmFi.exe
  2⤵
  PID:4520
- C:\Windows\System\qhMZeQF.exe
  C:\Windows\System\qhMZeQF.exe
  2⤵
  PID:4536
- C:\Windows\System\XlBTQCG.exe
  C:\Windows\System\XlBTQCG.exe
  2⤵
  PID:4552
- C:\Windows\System\KTlZziu.exe
  C:\Windows\System\KTlZziu.exe
  2⤵
  PID:4572
- C:\Windows\System\DBXwhfR.exe
  C:\Windows\System\DBXwhfR.exe
  2⤵
  PID:4588
- C:\Windows\System\dteuWNL.exe
  C:\Windows\System\dteuWNL.exe
  2⤵
  PID:4708
- C:\Windows\System\JPkpqAj.exe
  C:\Windows\System\JPkpqAj.exe
  2⤵
  PID:4756
- C:\Windows\System\vdFbiqc.exe
  C:\Windows\System\vdFbiqc.exe
  2⤵
  PID:4780
- C:\Windows\System\NpTlkJt.exe
  C:\Windows\System\NpTlkJt.exe
  2⤵
  PID:4800
- C:\Windows\System\peDrnMQ.exe
  C:\Windows\System\peDrnMQ.exe
  2⤵
  PID:4828
- C:\Windows\System\QZWgovJ.exe
  C:\Windows\System\QZWgovJ.exe
  2⤵
  PID:4844
- C:\Windows\System\OXlmVEi.exe
  C:\Windows\System\OXlmVEi.exe
  2⤵
  PID:4860
- C:\Windows\System\QweJihT.exe
  C:\Windows\System\QweJihT.exe
  2⤵
  PID:4880
- C:\Windows\System\CMEdvEj.exe
  C:\Windows\System\CMEdvEj.exe
  2⤵
  PID:4896
- C:\Windows\System\GoNxeLs.exe
  C:\Windows\System\GoNxeLs.exe
  2⤵
  PID:4912
- C:\Windows\System\zjvzBZT.exe
  C:\Windows\System\zjvzBZT.exe
  2⤵
  PID:4972
- C:\Windows\System\pjwrMWi.exe
  C:\Windows\System\pjwrMWi.exe
  2⤵
  PID:4988
- C:\Windows\System\ferQxnZ.exe
  C:\Windows\System\ferQxnZ.exe
  2⤵
  PID:5004
- C:\Windows\System\ksgXPCb.exe
  C:\Windows\System\ksgXPCb.exe
  2⤵
  PID:5024
- C:\Windows\System\xujZsrl.exe
  C:\Windows\System\xujZsrl.exe
  2⤵
  PID:5040
- C:\Windows\System\XutgAbX.exe
  C:\Windows\System\XutgAbX.exe
  2⤵
  PID:5056
- C:\Windows\System\GRBZzjh.exe
  C:\Windows\System\GRBZzjh.exe
  2⤵
  PID:5076
- C:\Windows\System\mhUhPQd.exe
  C:\Windows\System\mhUhPQd.exe
  2⤵
  PID:5092
- C:\Windows\System\zRMAcRK.exe
  C:\Windows\System\zRMAcRK.exe
  2⤵
  PID:5108
- C:\Windows\System\vJSbKbe.exe
  C:\Windows\System\vJSbKbe.exe
  2⤵
  PID:776
- C:\Windows\System\FAdtYNy.exe
  C:\Windows\System\FAdtYNy.exe
  2⤵
  PID:3384
- C:\Windows\System\jrFvVBp.exe
  C:\Windows\System\jrFvVBp.exe
  2⤵
  PID:4212
- C:\Windows\System\UBNQIwj.exe
  C:\Windows\System\UBNQIwj.exe
  2⤵
  PID:4316
- C:\Windows\System\HKYURrd.exe
  C:\Windows\System\HKYURrd.exe
  2⤵
  PID:1860
- C:\Windows\System\MxMJrGB.exe
  C:\Windows\System\MxMJrGB.exe
  2⤵
  PID:3872
- C:\Windows\System\RRqRnaR.exe
  C:\Windows\System\RRqRnaR.exe
  2⤵
  PID:4356
- C:\Windows\System\rMThVrh.exe
  C:\Windows\System\rMThVrh.exe
  2⤵
  PID:2700
- C:\Windows\System\ForcZtc.exe
  C:\Windows\System\ForcZtc.exe
  2⤵
  PID:3204
- C:\Windows\System\qYGpFnB.exe
  C:\Windows\System\qYGpFnB.exe
  2⤵
  PID:4140
- C:\Windows\System\tXGenUU.exe
  C:\Windows\System\tXGenUU.exe
  2⤵
  PID:4184
- C:\Windows\System\fvPYKtI.exe
  C:\Windows\System\fvPYKtI.exe
  2⤵
  PID:4560
- C:\Windows\System\CdtqGHS.exe
  C:\Windows\System\CdtqGHS.exe
  2⤵
  PID:4532
- C:\Windows\System\WnmadhL.exe
  C:\Windows\System\WnmadhL.exe
  2⤵
  PID:3320
- C:\Windows\System\ccZdyOX.exe
  C:\Windows\System\ccZdyOX.exe
  2⤵
  PID:4372
- C:\Windows\System\IONYLLn.exe
  C:\Windows\System\IONYLLn.exe
  2⤵
  PID:4484
- C:\Windows\System\eBfTzPi.exe
  C:\Windows\System\eBfTzPi.exe
  2⤵
  PID:1972
- C:\Windows\System\ifhLOYY.exe
  C:\Windows\System\ifhLOYY.exe
  2⤵
  PID:2948
- C:\Windows\System\WytGOwk.exe
  C:\Windows\System\WytGOwk.exe
  2⤵
  PID:4160
- C:\Windows\System\WcbCeif.exe
  C:\Windows\System\WcbCeif.exe
  2⤵
  PID:4444
- C:\Windows\System\QimZlKI.exe
  C:\Windows\System\QimZlKI.exe
  2⤵
  PID:4516
- C:\Windows\System\JztmMZQ.exe
  C:\Windows\System\JztmMZQ.exe
  2⤵
  PID:4164
- C:\Windows\System\iIgVNIm.exe
  C:\Windows\System\iIgVNIm.exe
  2⤵
  PID:4232
- C:\Windows\System\MTythsE.exe
  C:\Windows\System\MTythsE.exe
  2⤵
  PID:4612
- C:\Windows\System\TAzrKFg.exe
  C:\Windows\System\TAzrKFg.exe
  2⤵
  PID:4632
- C:\Windows\System\EFMdtBH.exe
  C:\Windows\System\EFMdtBH.exe
  2⤵
  PID:4660
- C:\Windows\System\Pmebnrr.exe
  C:\Windows\System\Pmebnrr.exe
  2⤵
  PID:4696
- C:\Windows\System\HtgOFrb.exe
  C:\Windows\System\HtgOFrb.exe
  2⤵
  PID:4716
- C:\Windows\System\EiHYXIl.exe
  C:\Windows\System\EiHYXIl.exe
  2⤵
  PID:4764
- C:\Windows\System\jHYmneO.exe
  C:\Windows\System\jHYmneO.exe
  2⤵
  PID:4776
- C:\Windows\System\zKeifVa.exe
  C:\Windows\System\zKeifVa.exe
  2⤵
  PID:4820
- C:\Windows\System\INIcDnq.exe
  C:\Windows\System\INIcDnq.exe
  2⤵
  PID:4888
- C:\Windows\System\zqrBiPr.exe
  C:\Windows\System\zqrBiPr.exe
  2⤵
  PID:4836
- C:\Windows\System\xbsnnIz.exe
  C:\Windows\System\xbsnnIz.exe
  2⤵
  PID:4920
- C:\Windows\System\FpalbjV.exe
  C:\Windows\System\FpalbjV.exe
  2⤵
  PID:4944
- C:\Windows\System\ePmcScU.exe
  C:\Windows\System\ePmcScU.exe
  2⤵
  PID:4960
- C:\Windows\System\RneklWt.exe
  C:\Windows\System\RneklWt.exe
  2⤵
  PID:4996
- C:\Windows\System\VzmPSAz.exe
  C:\Windows\System\VzmPSAz.exe
  2⤵
  PID:5064
- C:\Windows\System\OcllxoY.exe
  C:\Windows\System\OcllxoY.exe
  2⤵
  PID:5104
- C:\Windows\System\CcxakUl.exe
  C:\Windows\System\CcxakUl.exe
  2⤵
  PID:3864
- C:\Windows\System\jTLUCfh.exe
  C:\Windows\System\jTLUCfh.exe
  2⤵
  PID:5084
- C:\Windows\System\gsOJxgm.exe
  C:\Windows\System\gsOJxgm.exe
  2⤵
  PID:2032
- C:\Windows\System\uLpdmrk.exe
  C:\Windows\System\uLpdmrk.exe
  2⤵
  PID:5020
- C:\Windows\System\hnQIexE.exe
  C:\Windows\System\hnQIexE.exe
  2⤵
  PID:3736
- C:\Windows\System\pVVETfO.exe
  C:\Windows\System\pVVETfO.exe
  2⤵
  PID:4464
- C:\Windows\System\jECDNJj.exe
  C:\Windows\System\jECDNJj.exe
  2⤵
  PID:2792
- C:\Windows\System\hKuoezf.exe
  C:\Windows\System\hKuoezf.exe
  2⤵
  PID:4180
- C:\Windows\System\FgoCRwQ.exe
  C:\Windows\System\FgoCRwQ.exe
  2⤵
  PID:3324
- C:\Windows\System\cydLVva.exe
  C:\Windows\System\cydLVva.exe
  2⤵
  PID:4432
- C:\Windows\System\ESOxFWv.exe
  C:\Windows\System\ESOxFWv.exe
  2⤵
  PID:4480
- C:\Windows\System\BCkkHnO.exe
  C:\Windows\System\BCkkHnO.exe
  2⤵
  PID:4200
- C:\Windows\System\BpMvGCo.exe
  C:\Windows\System\BpMvGCo.exe
  2⤵
  PID:3972
- C:\Windows\System\SLcaEVs.exe
  C:\Windows\System\SLcaEVs.exe
  2⤵
  PID:4732
- C:\Windows\System\SeCqfLd.exe
  C:\Windows\System\SeCqfLd.exe
  2⤵
  PID:2632
- C:\Windows\System\zwFxKhi.exe
  C:\Windows\System\zwFxKhi.exe
  2⤵
  PID:4548
- C:\Windows\System\JbUxoBj.exe
  C:\Windows\System\JbUxoBj.exe
  2⤵
  PID:4928
- C:\Windows\System\xbzcQzP.exe
  C:\Windows\System\xbzcQzP.exe
  2⤵
  PID:4932
- C:\Windows\System\cJcYYAj.exe
  C:\Windows\System\cJcYYAj.exe
  2⤵
  PID:4968
- C:\Windows\System\qXOAEzz.exe
  C:\Windows\System\qXOAEzz.exe
  2⤵
  PID:400
- C:\Windows\System\OtLGHty.exe
  C:\Windows\System\OtLGHty.exe
  2⤵
  PID:4328
- C:\Windows\System\SRHvoKY.exe
  C:\Windows\System\SRHvoKY.exe
  2⤵
  PID:5088
- C:\Windows\System\lkOrkkB.exe
  C:\Windows\System\lkOrkkB.exe
  2⤵
  PID:1760
- C:\Windows\System\uvyTtQX.exe
  C:\Windows\System\uvyTtQX.exe
  2⤵
  PID:3556
- C:\Windows\System\BccOJtH.exe
  C:\Windows\System\BccOJtH.exe
  2⤵
  PID:4428
- C:\Windows\System\VMAUoIF.exe
  C:\Windows\System\VMAUoIF.exe
  2⤵
  PID:3088
- C:\Windows\System\QSkxrBf.exe
  C:\Windows\System\QSkxrBf.exe
  2⤵
  PID:4128
- C:\Windows\System\PeMWzPI.exe
  C:\Windows\System\PeMWzPI.exe
  2⤵
  PID:4672
- C:\Windows\System\sAZNeyK.exe
  C:\Windows\System\sAZNeyK.exe
  2⤵
  PID:4688
- C:\Windows\System\QKKecqW.exe
  C:\Windows\System\QKKecqW.exe
  2⤵
  PID:4744
- C:\Windows\System\zlwjLXo.exe
  C:\Windows\System\zlwjLXo.exe
  2⤵
  PID:4648
- C:\Windows\System\hyClGia.exe
  C:\Windows\System\hyClGia.exe
  2⤵
  PID:4812
- C:\Windows\System\OSlUnfs.exe
  C:\Windows\System\OSlUnfs.exe
  2⤵
  PID:4856
- C:\Windows\System\blWysYt.exe
  C:\Windows\System\blWysYt.exe
  2⤵
  PID:4904
- C:\Windows\System\YpbhHoS.exe
  C:\Windows\System\YpbhHoS.exe
  2⤵
  PID:4956
- C:\Windows\System\fPaCJtf.exe
  C:\Windows\System\fPaCJtf.exe
  2⤵
  PID:2564
- C:\Windows\System\BpLUQkB.exe
  C:\Windows\System\BpLUQkB.exe
  2⤵
  PID:3952
- C:\Windows\System\xGqoOWn.exe
  C:\Windows\System\xGqoOWn.exe
  2⤵
  PID:3160
- C:\Windows\System\oZyKqwz.exe
  C:\Windows\System\oZyKqwz.exe
  2⤵
  PID:2388
- C:\Windows\System\WjmPLFQ.exe
  C:\Windows\System\WjmPLFQ.exe
  2⤵
  PID:4580
- C:\Windows\System\VfxfhZg.exe
  C:\Windows\System\VfxfhZg.exe
  2⤵
  PID:4684
- C:\Windows\System\sNcYSNk.exe
  C:\Windows\System\sNcYSNk.exe
  2⤵
  PID:4692
- C:\Windows\System\VDevnAU.exe
  C:\Windows\System\VDevnAU.exe
  2⤵
  PID:4512
- C:\Windows\System\UnGWohf.exe
  C:\Windows\System\UnGWohf.exe
  2⤵
  PID:4656
- C:\Windows\System\lotTomR.exe
  C:\Windows\System\lotTomR.exe
  2⤵
  PID:4788
- C:\Windows\System\RXdZMRp.exe
  C:\Windows\System\RXdZMRp.exe
  2⤵
  PID:5100
- C:\Windows\System\HzzbExm.exe
  C:\Windows\System\HzzbExm.exe
  2⤵
  PID:5032
- C:\Windows\System\Ipbemor.exe
  C:\Windows\System\Ipbemor.exe
  2⤵
  PID:5132
- C:\Windows\System\wGoXhAU.exe
  C:\Windows\System\wGoXhAU.exe
  2⤵
  PID:5148
- C:\Windows\System\XnARfFb.exe
  C:\Windows\System\XnARfFb.exe
  2⤵
  PID:5164
- C:\Windows\System\IcTdERD.exe
  C:\Windows\System\IcTdERD.exe
  2⤵
  PID:5184
- C:\Windows\System\OJdJmrX.exe
  C:\Windows\System\OJdJmrX.exe
  2⤵
  PID:5200
- C:\Windows\System\OBpettV.exe
  C:\Windows\System\OBpettV.exe
  2⤵
  PID:5216
- C:\Windows\System\zJffcQu.exe
  C:\Windows\System\zJffcQu.exe
  2⤵
  PID:5236
- C:\Windows\System\SmBMxwG.exe
  C:\Windows\System\SmBMxwG.exe
  2⤵
  PID:5252
- C:\Windows\System\opveOOP.exe
  C:\Windows\System\opveOOP.exe
  2⤵
  PID:5272
- C:\Windows\System\bJZdTAs.exe
  C:\Windows\System\bJZdTAs.exe
  2⤵
  PID:5288
- C:\Windows\System\brIhakF.exe
  C:\Windows\System\brIhakF.exe
  2⤵
  PID:5304
- C:\Windows\System\IeFYhln.exe
  C:\Windows\System\IeFYhln.exe
  2⤵
  PID:5320
- C:\Windows\System\QCzgWXt.exe
  C:\Windows\System\QCzgWXt.exe
  2⤵
  PID:5340
- C:\Windows\System\RYXThyG.exe
  C:\Windows\System\RYXThyG.exe
  2⤵
  PID:5356
- C:\Windows\System\tmgvXZd.exe
  C:\Windows\System\tmgvXZd.exe
  2⤵
  PID:5388
- C:\Windows\System\oGgRUFP.exe
  C:\Windows\System\oGgRUFP.exe
  2⤵
  PID:5404
- C:\Windows\System\bOOxdMf.exe
  C:\Windows\System\bOOxdMf.exe
  2⤵
  PID:5492
- C:\Windows\System\iifFtBp.exe
  C:\Windows\System\iifFtBp.exe
  2⤵
  PID:5508
- C:\Windows\System\bjrBoms.exe
  C:\Windows\System\bjrBoms.exe
  2⤵
  PID:5524
- C:\Windows\System\yLNndrb.exe
  C:\Windows\System\yLNndrb.exe
  2⤵
  PID:5544
- C:\Windows\System\fhRwzkx.exe
  C:\Windows\System\fhRwzkx.exe
  2⤵
  PID:5560
- C:\Windows\System\HZXdAFR.exe
  C:\Windows\System\HZXdAFR.exe
  2⤵
  PID:5576
- C:\Windows\System\idXSzfx.exe
  C:\Windows\System\idXSzfx.exe
  2⤵
  PID:5592
- C:\Windows\System\hPxnrZK.exe
  C:\Windows\System\hPxnrZK.exe
  2⤵
  PID:5612
- C:\Windows\System\EblEpNQ.exe
  C:\Windows\System\EblEpNQ.exe
  2⤵
  PID:5628
- C:\Windows\System\rOIjJVx.exe
  C:\Windows\System\rOIjJVx.exe
  2⤵
  PID:5644
- C:\Windows\System\ijlhmiL.exe
  C:\Windows\System\ijlhmiL.exe
  2⤵
  PID:5664
- C:\Windows\System\xKtGFmd.exe
  C:\Windows\System\xKtGFmd.exe
  2⤵
  PID:5680
- C:\Windows\System\HHItCZI.exe
  C:\Windows\System\HHItCZI.exe
  2⤵
  PID:5696
- C:\Windows\System\BorHoKz.exe
  C:\Windows\System\BorHoKz.exe
  2⤵
  PID:5712
- C:\Windows\System\gFmQVyu.exe
  C:\Windows\System\gFmQVyu.exe
  2⤵
  PID:5732
- C:\Windows\System\VJkSGjM.exe
  C:\Windows\System\VJkSGjM.exe
  2⤵
  PID:5752
- C:\Windows\System\AZCqHhy.exe
  C:\Windows\System\AZCqHhy.exe
  2⤵
  PID:5768
- C:\Windows\System\HBYHMpG.exe
  C:\Windows\System\HBYHMpG.exe
  2⤵
  PID:5836
- C:\Windows\System\ToEyIOT.exe
  C:\Windows\System\ToEyIOT.exe
  2⤵
  PID:5852
- C:\Windows\System\xleKcEP.exe
  C:\Windows\System\xleKcEP.exe
  2⤵
  PID:5868
- C:\Windows\System\rldJRKv.exe
  C:\Windows\System\rldJRKv.exe
  2⤵
  PID:5884
- C:\Windows\System\thFTPFk.exe
  C:\Windows\System\thFTPFk.exe
  2⤵
  PID:5904
- C:\Windows\System\EvFeNTz.exe
  C:\Windows\System\EvFeNTz.exe
  2⤵
  PID:5920
- C:\Windows\System\APhLHct.exe
  C:\Windows\System\APhLHct.exe
  2⤵
  PID:5952
- C:\Windows\System\XLmZHEh.exe
  C:\Windows\System\XLmZHEh.exe
  2⤵
  PID:5972
- C:\Windows\System\NBpNvwh.exe
  C:\Windows\System\NBpNvwh.exe
  2⤵
  PID:5988
- C:\Windows\System\wunRRvy.exe
  C:\Windows\System\wunRRvy.exe
  2⤵
  PID:6004
- C:\Windows\System\OJGmcyp.exe
  C:\Windows\System\OJGmcyp.exe
  2⤵
  PID:6020
- C:\Windows\System\zgcDEdb.exe
  C:\Windows\System\zgcDEdb.exe
  2⤵
  PID:6036
- C:\Windows\System\hjDEkNV.exe
  C:\Windows\System\hjDEkNV.exe
  2⤵
  PID:6056
- C:\Windows\System\dbDIpgL.exe
  C:\Windows\System\dbDIpgL.exe
  2⤵
  PID:6072
- C:\Windows\System\oKjUokR.exe
  C:\Windows\System\oKjUokR.exe
  2⤵
  PID:6092
- C:\Windows\System\NXRpRCM.exe
  C:\Windows\System\NXRpRCM.exe
  2⤵
  PID:6108
- C:\Windows\System\JjQTkQG.exe
  C:\Windows\System\JjQTkQG.exe
  2⤵
  PID:6124
- C:\Windows\System\djtqsxC.exe
  C:\Windows\System\djtqsxC.exe
  2⤵
  PID:4724
- C:\Windows\System\XNlxmOL.exe
  C:\Windows\System\XNlxmOL.exe
  2⤵
  PID:4296
- C:\Windows\System\KvugRsy.exe
  C:\Windows\System\KvugRsy.exe
  2⤵
  PID:4892
- C:\Windows\System\DkoybjK.exe
  C:\Windows\System\DkoybjK.exe
  2⤵
  PID:5072
- C:\Windows\System\dNNeOqh.exe
  C:\Windows\System\dNNeOqh.exe
  2⤵
  PID:3284
- C:\Windows\System\WhPHMBh.exe
  C:\Windows\System\WhPHMBh.exe
  2⤵
  PID:4980
- C:\Windows\System\zdNKMxY.exe
  C:\Windows\System\zdNKMxY.exe
  2⤵
  PID:4452
- C:\Windows\System\wSACPgp.exe
  C:\Windows\System\wSACPgp.exe
  2⤵
  PID:4252
- C:\Windows\System\aOinzZE.exe
  C:\Windows\System\aOinzZE.exe
  2⤵
  PID:5260
- C:\Windows\System\FKuALYt.exe
  C:\Windows\System\FKuALYt.exe
  2⤵
  PID:5172
- C:\Windows\System\KcQzYQx.exe
  C:\Windows\System\KcQzYQx.exe
  2⤵
  PID:5208
- C:\Windows\System\XBYqlli.exe
  C:\Windows\System\XBYqlli.exe
  2⤵
  PID:5228
- C:\Windows\System\MXWYzkH.exe
  C:\Windows\System\MXWYzkH.exe
  2⤵
  PID:5336
- C:\Windows\System\kxxJWwn.exe
  C:\Windows\System\kxxJWwn.exe
  2⤵
  PID:5280
- C:\Windows\System\sBBwjVd.exe
  C:\Windows\System\sBBwjVd.exe
  2⤵
  PID:5348
- C:\Windows\System\kMBpNtV.exe
  C:\Windows\System\kMBpNtV.exe
  2⤵
  PID:5396
- C:\Windows\System\fjAOSvI.exe
  C:\Windows\System\fjAOSvI.exe
  2⤵
  PID:5416
- C:\Windows\System\vxcJqTc.exe
  C:\Windows\System\vxcJqTc.exe
  2⤵
  PID:5436
- C:\Windows\System\siNJupR.exe
  C:\Windows\System\siNJupR.exe
  2⤵
  PID:5452
- C:\Windows\System\URNTCvW.exe
  C:\Windows\System\URNTCvW.exe
  2⤵
  PID:5468
- C:\Windows\System\QHyahlE.exe
  C:\Windows\System\QHyahlE.exe
  2⤵
  PID:5488
- C:\Windows\System\IPORwBp.exe
  C:\Windows\System\IPORwBp.exe
  2⤵
  PID:5552
- C:\Windows\System\xHvTdpB.exe
  C:\Windows\System\xHvTdpB.exe
  2⤵
  PID:5556
- C:\Windows\System\ftdKnxm.exe
  C:\Windows\System\ftdKnxm.exe
  2⤵
  PID:5624
- C:\Windows\System\aKqABMq.exe
  C:\Windows\System\aKqABMq.exe
  2⤵
  PID:5504
- C:\Windows\System\hMAStCx.exe
  C:\Windows\System\hMAStCx.exe
  2⤵
  PID:5568
- C:\Windows\System\LhturbH.exe
  C:\Windows\System\LhturbH.exe
  2⤵
  PID:5608
- C:\Windows\System\UlONKcL.exe
  C:\Windows\System\UlONKcL.exe
  2⤵
  PID:5744
- C:\Windows\System\rQQXGRa.exe
  C:\Windows\System\rQQXGRa.exe
  2⤵
  PID:5640
- C:\Windows\System\LiLwMJO.exe
  C:\Windows\System\LiLwMJO.exe
  2⤵
  PID:5804
- C:\Windows\System\ZSGqhUc.exe
  C:\Windows\System\ZSGqhUc.exe
  2⤵
  PID:5824
- C:\Windows\System\bOrsSfK.exe
  C:\Windows\System\bOrsSfK.exe
  2⤵
  PID:5808
- C:\Windows\System\LjfBUzy.exe
  C:\Windows\System\LjfBUzy.exe
  2⤵
  PID:5832
- C:\Windows\System\qsvJxft.exe
  C:\Windows\System\qsvJxft.exe
  2⤵
  PID:5876
- C:\Windows\System\DAKViLJ.exe
  C:\Windows\System\DAKViLJ.exe
  2⤵
  PID:5864
- C:\Windows\System\FleoZdY.exe
  C:\Windows\System\FleoZdY.exe
  2⤵
  PID:5936
- C:\Windows\System\FgHcvbJ.exe
  C:\Windows\System\FgHcvbJ.exe
  2⤵
  PID:5948
- C:\Windows\System\PDUuuoz.exe
  C:\Windows\System\PDUuuoz.exe
  2⤵
  PID:5968
- C:\Windows\System\CHIVIXh.exe
  C:\Windows\System\CHIVIXh.exe
  2⤵
  PID:6032
- C:\Windows\System\LEXEUzO.exe
  C:\Windows\System\LEXEUzO.exe
  2⤵
  PID:6136
- C:\Windows\System\cIEZDAL.exe
  C:\Windows\System\cIEZDAL.exe
  2⤵
  PID:5412
- C:\Windows\System\QZmPhfc.exe
  C:\Windows\System\QZmPhfc.exe
  2⤵
  PID:6116
- C:\Windows\System\VRksDbV.exe
  C:\Windows\System\VRksDbV.exe
  2⤵
  PID:4768
- C:\Windows\System\iIatDwO.exe
  C:\Windows\System\iIatDwO.exe
  2⤵
  PID:5160
- C:\Windows\System\fHGWqoU.exe
  C:\Windows\System\fHGWqoU.exe
  2⤵
  PID:5376
- C:\Windows\System\MtacLhr.exe
  C:\Windows\System\MtacLhr.exe
  2⤵
  PID:5352
- C:\Windows\System\CAxYYze.exe
  C:\Windows\System\CAxYYze.exe
  2⤵
  PID:5516
- C:\Windows\System\vbKZMyZ.exe
  C:\Windows\System\vbKZMyZ.exe
  2⤵
  PID:5600
- C:\Windows\System\gDlOOAK.exe
  C:\Windows\System\gDlOOAK.exe
  2⤵
  PID:5740
- C:\Windows\System\ggPhcwo.exe
  C:\Windows\System\ggPhcwo.exe
  2⤵
  PID:5652
- C:\Windows\System\ngpJRkb.exe
  C:\Windows\System\ngpJRkb.exe
  2⤵
  PID:5708
- C:\Windows\System\DqJuBwU.exe
  C:\Windows\System\DqJuBwU.exe
  2⤵
  PID:5828
- C:\Windows\System\rBZhpYU.exe
  C:\Windows\System\rBZhpYU.exe
  2⤵
  PID:5916
- C:\Windows\System\LoQpwbK.exe
  C:\Windows\System\LoQpwbK.exe
  2⤵
  PID:5944
- C:\Windows\System\yzhATxz.exe
  C:\Windows\System\yzhATxz.exe
  2⤵
  PID:6028
- C:\Windows\System\aDkgoUb.exe
  C:\Windows\System\aDkgoUb.exe
  2⤵
  PID:5372
- C:\Windows\System\PGfhZFW.exe
  C:\Windows\System\PGfhZFW.exe
  2⤵
  PID:5980
- C:\Windows\System\tTPElxR.exe
  C:\Windows\System\tTPElxR.exe
  2⤵
  PID:5140
- C:\Windows\System\lfYNuSZ.exe
  C:\Windows\System\lfYNuSZ.exe
  2⤵
  PID:5268
- C:\Windows\System\BfukTWT.exe
  C:\Windows\System\BfukTWT.exe
  2⤵
  PID:4924
- C:\Windows\System\gamVlqU.exe
  C:\Windows\System\gamVlqU.exe
  2⤵
  PID:6120
- C:\Windows\System\dgeirLt.exe
  C:\Windows\System\dgeirLt.exe
  2⤵
  PID:6052
- C:\Windows\System\OfCuNjb.exe
  C:\Windows\System\OfCuNjb.exe
  2⤵
  PID:4872
- C:\Windows\System\BrqywSx.exe
  C:\Windows\System\BrqywSx.exe
  2⤵
  PID:5484
- C:\Windows\System\zGeNqOY.exe
  C:\Windows\System\zGeNqOY.exe
  2⤵
  PID:5540
- C:\Windows\System\LsLBAgx.exe
  C:\Windows\System\LsLBAgx.exe
  2⤵
  PID:5296
- C:\Windows\System\UkjAmPX.exe
  C:\Windows\System\UkjAmPX.exe
  2⤵
  PID:5792
- C:\Windows\System\QJZvBwc.exe
  C:\Windows\System\QJZvBwc.exe
  2⤵
  PID:5860
- C:\Windows\System\eovMtzD.exe
  C:\Windows\System\eovMtzD.exe
  2⤵
  PID:6100
- C:\Windows\System\PpFzsyF.exe
  C:\Windows\System\PpFzsyF.exe
  2⤵
  PID:4304
- C:\Windows\System\pnCBdjK.exe
  C:\Windows\System\pnCBdjK.exe
  2⤵
  PID:5928
- C:\Windows\System\NRalAJW.exe
  C:\Windows\System\NRalAJW.exe
  2⤵
  PID:5728
- C:\Windows\System\oZwLCMn.exe
  C:\Windows\System\oZwLCMn.exe
  2⤵
  PID:5300
- C:\Windows\System\TZlZiuX.exe
  C:\Windows\System\TZlZiuX.exe
  2⤵
  PID:5124
- C:\Windows\System\curDFjJ.exe
  C:\Windows\System\curDFjJ.exe
  2⤵
  PID:5448
- C:\Windows\System\hfkoDbW.exe
  C:\Windows\System\hfkoDbW.exe
  2⤵
  PID:5380
- C:\Windows\System\wWispRG.exe
  C:\Windows\System\wWispRG.exe
  2⤵
  PID:5432
- C:\Windows\System\kPTiBGT.exe
  C:\Windows\System\kPTiBGT.exe
  2⤵
  PID:5588
- C:\Windows\System\WEeSzPM.exe
  C:\Windows\System\WEeSzPM.exe
  2⤵
  PID:6160
- C:\Windows\System\TlkDtWq.exe
  C:\Windows\System\TlkDtWq.exe
  2⤵
  PID:6176
- C:\Windows\System\vYOVDBx.exe
  C:\Windows\System\vYOVDBx.exe
  2⤵
  PID:6196
- C:\Windows\System\mCcBgON.exe
  C:\Windows\System\mCcBgON.exe
  2⤵
  PID:6228
- C:\Windows\System\SUxMcvx.exe
  C:\Windows\System\SUxMcvx.exe
  2⤵
  PID:6244
- C:\Windows\System\PjHbsUl.exe
  C:\Windows\System\PjHbsUl.exe
  2⤵
  PID:6260
- C:\Windows\System\qNXZqcH.exe
  C:\Windows\System\qNXZqcH.exe
  2⤵
  PID:6276
- C:\Windows\System\XkYQyOu.exe
  C:\Windows\System\XkYQyOu.exe
  2⤵
  PID:6296
- C:\Windows\System\ZspoMhb.exe
  C:\Windows\System\ZspoMhb.exe
  2⤵
  PID:6312
- C:\Windows\System\FzzDqIk.exe
  C:\Windows\System\FzzDqIk.exe
  2⤵
  PID:6328
- C:\Windows\System\UGwoVUO.exe
  C:\Windows\System\UGwoVUO.exe
  2⤵
  PID:6344
- C:\Windows\System\nCXAqZG.exe
  C:\Windows\System\nCXAqZG.exe
  2⤵
  PID:6364
- C:\Windows\System\KcwRSiw.exe
  C:\Windows\System\KcwRSiw.exe
  2⤵
  PID:6396
- C:\Windows\System\OooBEOO.exe
  C:\Windows\System\OooBEOO.exe
  2⤵
  PID:6432
- C:\Windows\System\zJefgno.exe
  C:\Windows\System\zJefgno.exe
  2⤵
  PID:6448
- C:\Windows\System\BfjWqgz.exe
  C:\Windows\System\BfjWqgz.exe
  2⤵
  PID:6516
- C:\Windows\System\BWcTwWx.exe
  C:\Windows\System\BWcTwWx.exe
  2⤵
  PID:6536
- C:\Windows\System\qmuQPqM.exe
  C:\Windows\System\qmuQPqM.exe
  2⤵
  PID:6552
- C:\Windows\System\GlvWlbK.exe
  C:\Windows\System\GlvWlbK.exe
  2⤵
  PID:6568
- C:\Windows\System\Dhcchpk.exe
  C:\Windows\System\Dhcchpk.exe
  2⤵
  PID:6588
- C:\Windows\System\vIXEKBr.exe
  C:\Windows\System\vIXEKBr.exe
  2⤵
  PID:6604
- C:\Windows\System\iCCqHna.exe
  C:\Windows\System\iCCqHna.exe
  2⤵
  PID:6620
- C:\Windows\System\lyjSmhW.exe
  C:\Windows\System\lyjSmhW.exe
  2⤵
  PID:6636
- C:\Windows\System\kTcqLXH.exe
  C:\Windows\System\kTcqLXH.exe
  2⤵
  PID:6652
- C:\Windows\System\dSIqnHf.exe
  C:\Windows\System\dSIqnHf.exe
  2⤵
  PID:6688
- C:\Windows\System\scsBDmU.exe
  C:\Windows\System\scsBDmU.exe
  2⤵
  PID:6704
- C:\Windows\System\afxTbdV.exe
  C:\Windows\System\afxTbdV.exe
  2⤵
  PID:6720
- C:\Windows\System\lHSYsdw.exe
  C:\Windows\System\lHSYsdw.exe
  2⤵
  PID:6736
- C:\Windows\System\zMtRpDd.exe
  C:\Windows\System\zMtRpDd.exe
  2⤵
  PID:6756
- C:\Windows\System\mEKCEOO.exe
  C:\Windows\System\mEKCEOO.exe
  2⤵
  PID:6772
- C:\Windows\System\cYtXCQL.exe
  C:\Windows\System\cYtXCQL.exe
  2⤵
  PID:6788
- C:\Windows\System\WXpkJTU.exe
  C:\Windows\System\WXpkJTU.exe
  2⤵
  PID:6804
- C:\Windows\System\THTRcij.exe
  C:\Windows\System\THTRcij.exe
  2⤵
  PID:6820
- C:\Windows\System\QjTLnZo.exe
  C:\Windows\System\QjTLnZo.exe
  2⤵
  PID:6836
- C:\Windows\System\CDzwpNw.exe
  C:\Windows\System\CDzwpNw.exe
  2⤵
  PID:6852
- C:\Windows\System\tHGXMue.exe
  C:\Windows\System\tHGXMue.exe
  2⤵
  PID:6872
- C:\Windows\System\XMOSNBI.exe
  C:\Windows\System\XMOSNBI.exe
  2⤵
  PID:6888
- C:\Windows\System\eAEXcjP.exe
  C:\Windows\System\eAEXcjP.exe
  2⤵
  PID:6908
- C:\Windows\System\gqIUyvh.exe
  C:\Windows\System\gqIUyvh.exe
  2⤵
  PID:6924
- C:\Windows\System\RjxJeVz.exe
  C:\Windows\System\RjxJeVz.exe
  2⤵
  PID:6944
- C:\Windows\System\KFvDwXW.exe
  C:\Windows\System\KFvDwXW.exe
  2⤵
  PID:6960
- C:\Windows\System\Yverphi.exe
  C:\Windows\System\Yverphi.exe
  2⤵
  PID:6976
- C:\Windows\System\RKwmBJx.exe
  C:\Windows\System\RKwmBJx.exe
  2⤵
  PID:6992
- C:\Windows\System\ugzOxwZ.exe
  C:\Windows\System\ugzOxwZ.exe
  2⤵
  PID:7012
- C:\Windows\System\AXFilmN.exe
  C:\Windows\System\AXFilmN.exe
  2⤵
  PID:7028
- C:\Windows\System\dExsRXb.exe
  C:\Windows\System\dExsRXb.exe
  2⤵
  PID:7048
- C:\Windows\System\UFMnRGy.exe
  C:\Windows\System\UFMnRGy.exe
  2⤵
  PID:7064
- C:\Windows\System\tAqvAKL.exe
  C:\Windows\System\tAqvAKL.exe
  2⤵
  PID:7080
- C:\Windows\System\weFHoJS.exe
  C:\Windows\System\weFHoJS.exe
  2⤵
  PID:7096
- C:\Windows\System\DrKxxCZ.exe
  C:\Windows\System\DrKxxCZ.exe
  2⤵
  PID:7112
- C:\Windows\System\guDBGqq.exe
  C:\Windows\System\guDBGqq.exe
  2⤵
  PID:7132
- C:\Windows\System\lGHVlsw.exe
  C:\Windows\System\lGHVlsw.exe
  2⤵
  PID:7148
- C:\Windows\System\xjZqyRq.exe
  C:\Windows\System\xjZqyRq.exe
  2⤵
  PID:7164
- C:\Windows\System\lujpXca.exe
  C:\Windows\System\lujpXca.exe
  2⤵
  PID:5760
- C:\Windows\System\RhTOIVu.exe
  C:\Windows\System\RhTOIVu.exe
  2⤵
  PID:5720
- C:\Windows\System\kKXcKGg.exe
  C:\Windows\System\kKXcKGg.exe
  2⤵
  PID:6240
- C:\Windows\System\lzSAZJM.exe
  C:\Windows\System\lzSAZJM.exe
  2⤵
  PID:6284
- C:\Windows\System\zrjsNec.exe
  C:\Windows\System\zrjsNec.exe
  2⤵
  PID:6168
- C:\Windows\System\hEjTSXQ.exe
  C:\Windows\System\hEjTSXQ.exe
  2⤵
  PID:6320
- C:\Windows\System\rfGSORV.exe
  C:\Windows\System\rfGSORV.exe
  2⤵
  PID:6356
- C:\Windows\System\pySyhqF.exe
  C:\Windows\System\pySyhqF.exe
  2⤵
  PID:6336
- C:\Windows\System\HPIAaVo.exe
  C:\Windows\System\HPIAaVo.exe
  2⤵
  PID:6412
- C:\Windows\System\pgxkHPR.exe
  C:\Windows\System\pgxkHPR.exe
  2⤵
  PID:6420
- C:\Windows\System\Njeyuct.exe
  C:\Windows\System\Njeyuct.exe
  2⤵
  PID:6428
- C:\Windows\System\BmRTbvP.exe
  C:\Windows\System\BmRTbvP.exe
  2⤵
  PID:6468
- C:\Windows\System\fFaugFY.exe
  C:\Windows\System\fFaugFY.exe
  2⤵
  PID:6488
- C:\Windows\System\WjsulWM.exe
  C:\Windows\System\WjsulWM.exe
  2⤵
  PID:6500
- C:\Windows\System\sOzKBrv.exe
  C:\Windows\System\sOzKBrv.exe
  2⤵
  PID:6532
- C:\Windows\System\omalQLA.exe
  C:\Windows\System\omalQLA.exe
  2⤵
  PID:6512
- C:\Windows\System\cmdukQM.exe
  C:\Windows\System\cmdukQM.exe
  2⤵
  PID:6584
- C:\Windows\System\dhrkCjW.exe
  C:\Windows\System\dhrkCjW.exe
  2⤵
  PID:6600
- C:\Windows\System\BvqWRVS.exe
  C:\Windows\System\BvqWRVS.exe
  2⤵
  PID:6712
- C:\Windows\System\mQSNaRq.exe
  C:\Windows\System\mQSNaRq.exe
  2⤵
  PID:6668
- C:\Windows\System\IpUgVcs.exe
  C:\Windows\System\IpUgVcs.exe
  2⤵
  PID:6716
- C:\Windows\System\eizXPmM.exe
  C:\Windows\System\eizXPmM.exe
  2⤵
  PID:6696
- C:\Windows\System\bGXeadQ.exe
  C:\Windows\System\bGXeadQ.exe
  2⤵
  PID:6700
- C:\Windows\System\gZTTzwU.exe
  C:\Windows\System\gZTTzwU.exe
  2⤵
  PID:6816
- C:\Windows\System\TnkXhOL.exe
  C:\Windows\System\TnkXhOL.exe
  2⤵
  PID:6884
- C:\Windows\System\UxzbSlj.exe
  C:\Windows\System\UxzbSlj.exe
  2⤵
  PID:6952
- C:\Windows\System\kFPteuj.exe
  C:\Windows\System\kFPteuj.exe
  2⤵
  PID:6932
- C:\Windows\System\vJtHjkq.exe
  C:\Windows\System\vJtHjkq.exe
  2⤵
  PID:6864
- C:\Windows\System\zlMHXKK.exe
  C:\Windows\System\zlMHXKK.exe
  2⤵
  PID:6800
- C:\Windows\System\dfhmHTc.exe
  C:\Windows\System\dfhmHTc.exe
  2⤵
  PID:6988
- C:\Windows\System\aRzOYrz.exe
  C:\Windows\System\aRzOYrz.exe
  2⤵
  PID:7036
- C:\Windows\System\DphdoDA.exe
  C:\Windows\System\DphdoDA.exe
  2⤵
  PID:7088
- C:\Windows\System\LkeJShr.exe
  C:\Windows\System\LkeJShr.exe
  2⤵
  PID:7124
- C:\Windows\System\DoUIBET.exe
  C:\Windows\System\DoUIBET.exe
  2⤵
  PID:5688
- C:\Windows\System\dhBNxIR.exe
  C:\Windows\System\dhBNxIR.exe
  2⤵
  PID:7076
- C:\Windows\System\pcIbNoJ.exe
  C:\Windows\System\pcIbNoJ.exe
  2⤵
  PID:5900
- C:\Windows\System\TwHSuyS.exe
  C:\Windows\System\TwHSuyS.exe
  2⤵
  PID:6048
- C:\Windows\System\bQyLcmm.exe
  C:\Windows\System\bQyLcmm.exe
  2⤵
  PID:6216
- C:\Windows\System\QJARDVs.exe
  C:\Windows\System\QJARDVs.exe
  2⤵
  PID:5676
- C:\Windows\System\IMiMRHE.exe
  C:\Windows\System\IMiMRHE.exe
  2⤵
  PID:5764
- C:\Windows\System\pKvNyjG.exe
  C:\Windows\System\pKvNyjG.exe
  2⤵
  PID:4704
- C:\Windows\System\PADNhEn.exe
  C:\Windows\System\PADNhEn.exe
  2⤵
  PID:6012
- C:\Windows\System\sBYLdQH.exe
  C:\Windows\System\sBYLdQH.exe
  2⤵
  PID:5960
- C:\Windows\System\ZYDfkut.exe
  C:\Windows\System\ZYDfkut.exe
  2⤵
  PID:5328
- C:\Windows\System\XnuKPQd.exe
  C:\Windows\System\XnuKPQd.exe
  2⤵
  PID:6292
- C:\Windows\System\rIdgeGo.exe
  C:\Windows\System\rIdgeGo.exe
  2⤵
  PID:6156
- C:\Windows\System\XMUhLJs.exe
  C:\Windows\System\XMUhLJs.exe
  2⤵
  PID:6404
- C:\Windows\System\SenqcSt.exe
  C:\Windows\System\SenqcSt.exe
  2⤵
  PID:2384
- C:\Windows\System\vQhSFpA.exe
  C:\Windows\System\vQhSFpA.exe
  2⤵
  PID:6376
- C:\Windows\System\mCRjVPi.exe
  C:\Windows\System\mCRjVPi.exe
  2⤵
  PID:6508
- C:\Windows\System\vyFLKOW.exe
  C:\Windows\System\vyFLKOW.exe
  2⤵
  PID:6764
- C:\Windows\System\IDXCcrl.exe
  C:\Windows\System\IDXCcrl.exe
  2⤵
  PID:4344
- C:\Windows\System\FeCqSXK.exe
  C:\Windows\System\FeCqSXK.exe
  2⤵
  PID:6220
- C:\Windows\System\PHVOUZX.exe
  C:\Windows\System\PHVOUZX.exe
  2⤵
  PID:6880
- C:\Windows\System\NktoZtp.exe
  C:\Windows\System\NktoZtp.exe
  2⤵
  PID:6968
- C:\Windows\System\GdXFvGU.exe
  C:\Windows\System\GdXFvGU.exe
  2⤵
  PID:7004
- C:\Windows\System\IGRNwze.exe
  C:\Windows\System\IGRNwze.exe
  2⤵
  PID:7060
- C:\Windows\System\GuUxVjt.exe
  C:\Windows\System\GuUxVjt.exe
  2⤵
  PID:7140
- C:\Windows\System\JJzCGYR.exe
  C:\Windows\System\JJzCGYR.exe
  2⤵
  PID:6204
- C:\Windows\System\NFnQDkV.exe
  C:\Windows\System\NFnQDkV.exe
  2⤵
  PID:6152
- C:\Windows\System\ettxFbC.exe
  C:\Windows\System\ettxFbC.exe
  2⤵
  PID:5964
- C:\Windows\System\tAosARy.exe
  C:\Windows\System\tAosARy.exe
  2⤵
  PID:6492
- C:\Windows\System\JMCyyJM.exe
  C:\Windows\System\JMCyyJM.exe
  2⤵
  PID:6576
- C:\Windows\System\THMiSqo.exe
  C:\Windows\System\THMiSqo.exe
  2⤵
  PID:6612
- C:\Windows\System\mReqMXy.exe
  C:\Windows\System\mReqMXy.exe
  2⤵
  PID:6596
- C:\Windows\System\OayEjga.exe
  C:\Windows\System\OayEjga.exe
  2⤵
  PID:6548
- C:\Windows\System\hRisBBC.exe
  C:\Windows\System\hRisBBC.exe
  2⤵
  PID:6256
- C:\Windows\System\SXBjNpa.exe
  C:\Windows\System\SXBjNpa.exe
  2⤵
  PID:6860
- C:\Windows\System\atGrGtP.exe
  C:\Windows\System\atGrGtP.exe
  2⤵
  PID:6768
- C:\Windows\System\yBiIktg.exe
  C:\Windows\System\yBiIktg.exe
  2⤵
  PID:7024
- C:\Windows\System\kACYwFv.exe
  C:\Windows\System\kACYwFv.exe
  2⤵
  PID:6524
- C:\Windows\System\uCiSZHq.exe
  C:\Windows\System\uCiSZHq.exe
  2⤵
  PID:6476
- C:\Windows\System\gbxpYlU.exe
  C:\Windows\System\gbxpYlU.exe
  2⤵
  PID:6304
- C:\Windows\System\JiuMYvF.exe
  C:\Windows\System\JiuMYvF.exe
  2⤵
  PID:6528
- C:\Windows\System\FUqHVIu.exe
  C:\Windows\System\FUqHVIu.exe
  2⤵
  PID:7008
- C:\Windows\System\KrPlLDn.exe
  C:\Windows\System\KrPlLDn.exe
  2⤵
  PID:6940
- C:\Windows\System\dIHQfhC.exe
  C:\Windows\System\dIHQfhC.exe
  2⤵
  PID:6308
- C:\Windows\System\IqfhdGi.exe
  C:\Windows\System\IqfhdGi.exe
  2⤵
  PID:6812
- C:\Windows\System\PBkyKkG.exe
  C:\Windows\System\PBkyKkG.exe
  2⤵
  PID:6460
- C:\Windows\System\NmUvRjq.exe
  C:\Windows\System\NmUvRjq.exe
  2⤵
  PID:5264
- C:\Windows\System\qygKagg.exe
  C:\Windows\System\qygKagg.exe
  2⤵
  PID:6252
- C:\Windows\System\XtyzJkB.exe
  C:\Windows\System\XtyzJkB.exe
  2⤵
  PID:6680
- C:\Windows\System\GTpplUk.exe
  C:\Windows\System\GTpplUk.exe
  2⤵
  PID:5984
- C:\Windows\System\BfpTIjm.exe
  C:\Windows\System\BfpTIjm.exe
  2⤵
  PID:6868
- C:\Windows\System\uCoNIVE.exe
  C:\Windows\System\uCoNIVE.exe
  2⤵
  PID:1500
- C:\Windows\System\QwDUSYp.exe
  C:\Windows\System\QwDUSYp.exe
  2⤵
  PID:6956
- C:\Windows\System\FmrdCPn.exe
  C:\Windows\System\FmrdCPn.exe
  2⤵
  PID:6324
- C:\Windows\System\eTHfBJe.exe
  C:\Windows\System\eTHfBJe.exe
  2⤵
  PID:6784
- C:\Windows\System\gQgYWZM.exe
  C:\Windows\System\gQgYWZM.exe
  2⤵
  PID:2076
- C:\Windows\System\fYLLzAK.exe
  C:\Windows\System\fYLLzAK.exe
  2⤵
  PID:7184
- C:\Windows\System\FkUfTDB.exe
  C:\Windows\System\FkUfTDB.exe
  2⤵
  PID:7200
- C:\Windows\System\izwASsk.exe
  C:\Windows\System\izwASsk.exe
  2⤵
  PID:7216
- C:\Windows\System\tXgTrTw.exe
  C:\Windows\System\tXgTrTw.exe
  2⤵
  PID:7236
- C:\Windows\System\zLCsPiK.exe
  C:\Windows\System\zLCsPiK.exe
  2⤵
  PID:7256
- C:\Windows\System\iXRBfHX.exe
  C:\Windows\System\iXRBfHX.exe
  2⤵
  PID:7284
- C:\Windows\System\qrskkTz.exe
  C:\Windows\System\qrskkTz.exe
  2⤵
  PID:7300
- C:\Windows\System\XonrzeX.exe
  C:\Windows\System\XonrzeX.exe
  2⤵
  PID:7340
- C:\Windows\System\TEViXfN.exe
  C:\Windows\System\TEViXfN.exe
  2⤵
  PID:7356
- C:\Windows\System\VAKyhIO.exe
  C:\Windows\System\VAKyhIO.exe
  2⤵
  PID:7372
- C:\Windows\System\zZaVPjE.exe
  C:\Windows\System\zZaVPjE.exe
  2⤵
  PID:7388
- C:\Windows\System\oiyQpbF.exe
  C:\Windows\System\oiyQpbF.exe
  2⤵
  PID:7404
- C:\Windows\System\zFIJjxJ.exe
  C:\Windows\System\zFIJjxJ.exe
  2⤵
  PID:7424
- C:\Windows\System\MRFeChC.exe
  C:\Windows\System\MRFeChC.exe
  2⤵
  PID:7444
- C:\Windows\System\FtgSyCZ.exe
  C:\Windows\System\FtgSyCZ.exe
  2⤵
  PID:7460
- C:\Windows\System\smMJbfg.exe
  C:\Windows\System\smMJbfg.exe
  2⤵
  PID:7484
- C:\Windows\System\rXQzgun.exe
  C:\Windows\System\rXQzgun.exe
  2⤵
  PID:7500
- C:\Windows\System\ewwjmcN.exe
  C:\Windows\System\ewwjmcN.exe
  2⤵
  PID:7520
- C:\Windows\System\YVXhrHz.exe
  C:\Windows\System\YVXhrHz.exe
  2⤵
  PID:7536
- C:\Windows\System\QCUkRtR.exe
  C:\Windows\System\QCUkRtR.exe
  2⤵
  PID:7552
- C:\Windows\System\DuRilRz.exe
  C:\Windows\System\DuRilRz.exe
  2⤵
  PID:7572
- C:\Windows\System\PdZYCEH.exe
  C:\Windows\System\PdZYCEH.exe
  2⤵
  PID:7588
- C:\Windows\System\RYVscpU.exe
  C:\Windows\System\RYVscpU.exe
  2⤵
  PID:7604
- C:\Windows\System\pMCYnRY.exe
  C:\Windows\System\pMCYnRY.exe
  2⤵
  PID:7624
- C:\Windows\System\yVxbhVE.exe
  C:\Windows\System\yVxbhVE.exe
  2⤵
  PID:7656
- C:\Windows\System\kKDTLuo.exe
  C:\Windows\System\kKDTLuo.exe
  2⤵
  PID:7676
- C:\Windows\System\gMKSDTp.exe
  C:\Windows\System\gMKSDTp.exe
  2⤵
  PID:7692
- C:\Windows\System\nRNOOjy.exe
  C:\Windows\System\nRNOOjy.exe
  2⤵
  PID:7708
- C:\Windows\System\FGDEsZz.exe
  C:\Windows\System\FGDEsZz.exe
  2⤵
  PID:7728
- C:\Windows\System\ZzSflHL.exe
  C:\Windows\System\ZzSflHL.exe
  2⤵
  PID:7744
- C:\Windows\System\EfdFeQa.exe
  C:\Windows\System\EfdFeQa.exe
  2⤵
  PID:7764
- C:\Windows\System\DZtEkmA.exe
  C:\Windows\System\DZtEkmA.exe
  2⤵
  PID:7780
- C:\Windows\System\abzTclB.exe
  C:\Windows\System\abzTclB.exe
  2⤵
  PID:7796
- C:\Windows\System\xqkOCUw.exe
  C:\Windows\System\xqkOCUw.exe
  2⤵
  PID:7812
- C:\Windows\System\HKwRtZG.exe
  C:\Windows\System\HKwRtZG.exe
  2⤵
  PID:7828
- C:\Windows\System\jDrRcAX.exe
  C:\Windows\System\jDrRcAX.exe
  2⤵
  PID:7844
- C:\Windows\System\ZWvJnwY.exe
  C:\Windows\System\ZWvJnwY.exe
  2⤵
  PID:7860
- C:\Windows\System\WMjCzXA.exe
  C:\Windows\System\WMjCzXA.exe
  2⤵
  PID:7880
- C:\Windows\System\UbTolTx.exe
  C:\Windows\System\UbTolTx.exe
  2⤵
  PID:7896
- C:\Windows\System\qpZJKKJ.exe
  C:\Windows\System\qpZJKKJ.exe
  2⤵
  PID:7916
- C:\Windows\System\BeEKNNy.exe
  C:\Windows\System\BeEKNNy.exe
  2⤵
  PID:7932
- C:\Windows\System\BouOqna.exe
  C:\Windows\System\BouOqna.exe
  2⤵
  PID:8048
- C:\Windows\System\NqGLBah.exe
  C:\Windows\System\NqGLBah.exe
  2⤵
  PID:8096
- C:\Windows\System\QRYjCUS.exe
  C:\Windows\System\QRYjCUS.exe
  2⤵
  PID:8116
- C:\Windows\System\bLGvsOT.exe
  C:\Windows\System\bLGvsOT.exe
  2⤵
  PID:8136
- C:\Windows\System\jwgJfyL.exe
  C:\Windows\System\jwgJfyL.exe
  2⤵
  PID:8152
- C:\Windows\System\vEOYQrH.exe
  C:\Windows\System\vEOYQrH.exe
  2⤵
  PID:8168
- C:\Windows\System\hBTdHZA.exe
  C:\Windows\System\hBTdHZA.exe
  2⤵
  PID:8184
- C:\Windows\System\uWOUtnZ.exe
  C:\Windows\System\uWOUtnZ.exe
  2⤵
  PID:7180
- C:\Windows\System\wWWmZUR.exe
  C:\Windows\System\wWWmZUR.exe
  2⤵
  PID:7212
- C:\Windows\System\MnPTGRw.exe
  C:\Windows\System\MnPTGRw.exe
  2⤵
  PID:7224
- C:\Windows\System\ovOnhKi.exe
  C:\Windows\System\ovOnhKi.exe
  2⤵
  PID:7276
- C:\Windows\System\jziTapK.exe
  C:\Windows\System\jziTapK.exe
  2⤵
  PID:7312
- C:\Windows\System\QngHniB.exe
  C:\Windows\System\QngHniB.exe
  2⤵
  PID:7332
- C:\Windows\System\qTqIwGn.exe
  C:\Windows\System\qTqIwGn.exe
  2⤵
  PID:7364
- C:\Windows\System\TzPwRSk.exe
  C:\Windows\System\TzPwRSk.exe
  2⤵
  PID:7412
- C:\Windows\System\GEMLsKy.exe
  C:\Windows\System\GEMLsKy.exe
  2⤵
  PID:7492
- C:\Windows\System\vsVSEGR.exe
  C:\Windows\System\vsVSEGR.exe
  2⤵
  PID:7532
- C:\Windows\System\VKvQOar.exe
  C:\Windows\System\VKvQOar.exe
  2⤵
  PID:7396
- C:\Windows\System\MOWbOeI.exe
  C:\Windows\System\MOWbOeI.exe
  2⤵
  PID:7476
- C:\Windows\System\usLCHAI.exe
  C:\Windows\System\usLCHAI.exe
  2⤵
  PID:7436
- C:\Windows\System\UlVvFBD.exe
  C:\Windows\System\UlVvFBD.exe
  2⤵
  PID:7544
- C:\Windows\System\HyQtZNj.exe
  C:\Windows\System\HyQtZNj.exe
  2⤵
  PID:7612
- C:\Windows\System\FCxmikL.exe
  C:\Windows\System\FCxmikL.exe
  2⤵
  PID:7644
- C:\Windows\System\PvmrsBV.exe
  C:\Windows\System\PvmrsBV.exe
  2⤵
  PID:7688
- C:\Windows\System\bMKbNgS.exe
  C:\Windows\System\bMKbNgS.exe
  2⤵
  PID:7752
- C:\Windows\System\fgeNQRz.exe
  C:\Windows\System\fgeNQRz.exe
  2⤵
  PID:7704
- C:\Windows\System\xUjWuCg.exe
  C:\Windows\System\xUjWuCg.exe
  2⤵
  PID:7772
- C:\Windows\System\hcxwRwm.exe
  C:\Windows\System\hcxwRwm.exe
  2⤵
  PID:7808
- C:\Windows\System\dZCbaHP.exe
  C:\Windows\System\dZCbaHP.exe
  2⤵
  PID:7924
- C:\Windows\System\ofXmNzB.exe
  C:\Windows\System\ofXmNzB.exe
  2⤵
  PID:7872
- C:\Windows\System\nMQnOXF.exe
  C:\Windows\System\nMQnOXF.exe
  2⤵
  PID:7940
- C:\Windows\System\EokxBMc.exe
  C:\Windows\System\EokxBMc.exe
  2⤵
  PID:7952
- C:\Windows\System\JdIxTsW.exe
  C:\Windows\System\JdIxTsW.exe
  2⤵
  PID:7980
- C:\Windows\System\rZfmMKr.exe
  C:\Windows\System\rZfmMKr.exe
  2⤵
  PID:7988
- C:\Windows\System\qQLRPJN.exe
  C:\Windows\System\qQLRPJN.exe
  2⤵
  PID:8000
- C:\Windows\System\kriSPsX.exe
  C:\Windows\System\kriSPsX.exe
  2⤵
  PID:8032
- C:\Windows\System\VhNEQPT.exe
  C:\Windows\System\VhNEQPT.exe
  2⤵
  PID:8044
- C:\Windows\System\xPXBSEw.exe
  C:\Windows\System\xPXBSEw.exe
  2⤵
  PID:8068
- C:\Windows\System\zKmMkfE.exe
  C:\Windows\System\zKmMkfE.exe
  2⤵
  PID:8084
- C:\Windows\System\pVnaPhE.exe
  C:\Windows\System\pVnaPhE.exe
  2⤵
  PID:8128
- C:\Windows\System\bZdttcm.exe
  C:\Windows\System\bZdttcm.exe
  2⤵
  PID:6780
- C:\Windows\System\BJEbGlK.exe
  C:\Windows\System\BJEbGlK.exe
  2⤵
  PID:7176
- C:\Windows\System\aUJDLKb.exe
  C:\Windows\System\aUJDLKb.exe
  2⤵
  PID:7296
- C:\Windows\System\DRczRkF.exe
  C:\Windows\System\DRczRkF.exe
  2⤵
  PID:8112
- C:\Windows\System\xFQfElL.exe
  C:\Windows\System\xFQfElL.exe
  2⤵
  PID:7420
- C:\Windows\System\EMzsRQe.exe
  C:\Windows\System\EMzsRQe.exe
  2⤵
  PID:7568
- C:\Windows\System\WqojQVH.exe
  C:\Windows\System\WqojQVH.exe
  2⤵
  PID:7208
- C:\Windows\System\UsAmMbf.exe
  C:\Windows\System\UsAmMbf.exe
  2⤵
  PID:7316
- C:\Windows\System\toRKSCA.exe
  C:\Windows\System\toRKSCA.exe
  2⤵
  PID:7384
- C:\Windows\System\NsvZfpG.exe
  C:\Windows\System\NsvZfpG.exe
  2⤵
  PID:7440
- C:\Windows\System\vuLVazj.exe
  C:\Windows\System\vuLVazj.exe
  2⤵
  PID:7480
- C:\Windows\System\exSwmPV.exe
  C:\Windows\System\exSwmPV.exe
  2⤵
  PID:7640
- C:\Windows\System\fOtlQRI.exe
  C:\Windows\System\fOtlQRI.exe
  2⤵
  PID:7756
- C:\Windows\System\tnAQWay.exe
  C:\Windows\System\tnAQWay.exe
  2⤵
  PID:7720
- C:\Windows\System\KOaumAA.exe
  C:\Windows\System\KOaumAA.exe
  2⤵
  PID:7824
- C:\Windows\System\brhqXEx.exe
  C:\Windows\System\brhqXEx.exe
  2⤵
  PID:7740
- C:\Windows\System\MpSVMBX.exe
  C:\Windows\System\MpSVMBX.exe
  2⤵
  PID:7904
- C:\Windows\System\mLcmveH.exe
  C:\Windows\System\mLcmveH.exe
  2⤵
  PID:7992
- C:\Windows\System\KcPgTHc.exe
  C:\Windows\System\KcPgTHc.exe
  2⤵
  PID:8056
- C:\Windows\System\ZuhULJu.exe
  C:\Windows\System\ZuhULJu.exe
  2⤵
  PID:8124
- C:\Windows\System\JHLDXPE.exe
  C:\Windows\System\JHLDXPE.exe
  2⤵
  PID:7268
- C:\Windows\System\AxiNdmk.exe
  C:\Windows\System\AxiNdmk.exe
  2⤵
  PID:7856
- C:\Windows\System\OZROVoW.exe
  C:\Windows\System\OZROVoW.exe
  2⤵
  PID:8092
- C:\Windows\System\xRotDSP.exe
  C:\Windows\System\xRotDSP.exe
  2⤵
  PID:7456
- C:\Windows\System\hBWGokR.exe
  C:\Windows\System\hBWGokR.exe
  2⤵
  PID:7228
- C:\Windows\System\drDekLN.exe
  C:\Windows\System\drDekLN.exe
  2⤵
  PID:7528
- C:\Windows\System\PkQiGFe.exe
  C:\Windows\System\PkQiGFe.exe
  2⤵
  PID:7928
- C:\Windows\System\vmnJROk.exe
  C:\Windows\System\vmnJROk.exe
  2⤵
  PID:8004
- C:\Windows\System\XbFShgD.exe
  C:\Windows\System\XbFShgD.exe
  2⤵
  PID:8076
- C:\Windows\System\DHrxcrm.exe
  C:\Windows\System\DHrxcrm.exe
  2⤵
  PID:8160
- C:\Windows\System\eIRLDAG.exe
  C:\Windows\System\eIRLDAG.exe
  2⤵
  PID:7964
- C:\Windows\System\kGYEusX.exe
  C:\Windows\System\kGYEusX.exe
  2⤵
  PID:8148
- C:\Windows\System\HFPcHvf.exe
  C:\Windows\System\HFPcHvf.exe
  2⤵
  PID:7380
- C:\Windows\System\EPaGJQR.exe
  C:\Windows\System\EPaGJQR.exe
  2⤵
  PID:7888
- C:\Windows\System\FsImjgx.exe
  C:\Windows\System\FsImjgx.exe
  2⤵
  PID:7736
- C:\Windows\System\IlSidPF.exe
  C:\Windows\System\IlSidPF.exe
  2⤵
  PID:7368
- C:\Windows\System\OVbrHOB.exe
  C:\Windows\System\OVbrHOB.exe
  2⤵
  PID:7820
- C:\Windows\System\GOxToNy.exe
  C:\Windows\System\GOxToNy.exe
  2⤵
  PID:7348
- C:\Windows\System\ktDpyvq.exe
  C:\Windows\System\ktDpyvq.exe
  2⤵
  PID:8020
- C:\Windows\System\uRbCjsn.exe
  C:\Windows\System\uRbCjsn.exe
  2⤵
  PID:8216
- C:\Windows\System\UidyzDV.exe
  C:\Windows\System\UidyzDV.exe
  2⤵
  PID:8232
- C:\Windows\System\DvIVzig.exe
  C:\Windows\System\DvIVzig.exe
  2⤵
  PID:8316
- C:\Windows\System\RJTEMSt.exe
  C:\Windows\System\RJTEMSt.exe
  2⤵
  PID:8332
- C:\Windows\System\zIILFMS.exe
  C:\Windows\System\zIILFMS.exe
  2⤵
  PID:8348
- C:\Windows\System\BHWpkYT.exe
  C:\Windows\System\BHWpkYT.exe
  2⤵
  PID:8364
- C:\Windows\System\MaBdCYX.exe
  C:\Windows\System\MaBdCYX.exe
  2⤵
  PID:8384
- C:\Windows\System\uZijfVk.exe
  C:\Windows\System\uZijfVk.exe
  2⤵
  PID:8408
- C:\Windows\System\xojDVTG.exe
  C:\Windows\System\xojDVTG.exe
  2⤵
  PID:8424
- C:\Windows\System\oGMReHG.exe
  C:\Windows\System\oGMReHG.exe
  2⤵
  PID:8448
- C:\Windows\System\FEzbmTK.exe
  C:\Windows\System\FEzbmTK.exe
  2⤵
  PID:8468
- C:\Windows\System\WNdOJBw.exe
  C:\Windows\System\WNdOJBw.exe
  2⤵
  PID:8484
- C:\Windows\System\HOUehBw.exe
  C:\Windows\System\HOUehBw.exe
  2⤵
  PID:8500
- C:\Windows\System\QyFqMFc.exe
  C:\Windows\System\QyFqMFc.exe
  2⤵
  PID:8520
- C:\Windows\System\zfndIei.exe
  C:\Windows\System\zfndIei.exe
  2⤵
  PID:8540
- C:\Windows\System\TNiZXCh.exe
  C:\Windows\System\TNiZXCh.exe
  2⤵
  PID:8556
- C:\Windows\System\TmFbLeD.exe
  C:\Windows\System\TmFbLeD.exe
  2⤵
  PID:8572
- C:\Windows\System\JqCaWHM.exe
  C:\Windows\System\JqCaWHM.exe
  2⤵
  PID:8588
- C:\Windows\System\MMSrlGH.exe
  C:\Windows\System\MMSrlGH.exe
  2⤵
  PID:8608
- C:\Windows\System\KFKnAcd.exe
  C:\Windows\System\KFKnAcd.exe
  2⤵
  PID:8624
- C:\Windows\System\YTVUlJI.exe
  C:\Windows\System\YTVUlJI.exe
  2⤵
  PID:8640
- C:\Windows\System\wbnBOtZ.exe
  C:\Windows\System\wbnBOtZ.exe
  2⤵
  PID:8660
- C:\Windows\System\VjSzmZb.exe
  C:\Windows\System\VjSzmZb.exe
  2⤵
  PID:8676
- C:\Windows\System\tPstslU.exe
  C:\Windows\System\tPstslU.exe
  2⤵
  PID:8692
- C:\Windows\System\gWpoypN.exe
  C:\Windows\System\gWpoypN.exe
  2⤵
  PID:8712
- C:\Windows\System\cbSOGmJ.exe
  C:\Windows\System\cbSOGmJ.exe
  2⤵
  PID:8728
- C:\Windows\System\YMxyRtJ.exe
  C:\Windows\System\YMxyRtJ.exe
  2⤵
  PID:8796
- C:\Windows\System\mBcSZZR.exe
  C:\Windows\System\mBcSZZR.exe
  2⤵
  PID:8812
- C:\Windows\System\LeltXGN.exe
  C:\Windows\System\LeltXGN.exe
  2⤵
  PID:8832
- C:\Windows\System\EHCVjwT.exe
  C:\Windows\System\EHCVjwT.exe
  2⤵
  PID:8848
- C:\Windows\System\epuudxC.exe
  C:\Windows\System\epuudxC.exe
  2⤵
  PID:8868
- C:\Windows\System\KQuRZko.exe
  C:\Windows\System\KQuRZko.exe
  2⤵
  PID:8884
- C:\Windows\System\cltCHWe.exe
  C:\Windows\System\cltCHWe.exe
  2⤵
  PID:8908
- C:\Windows\System\qCnijQP.exe
  C:\Windows\System\qCnijQP.exe
  2⤵
  PID:8924
- C:\Windows\System\cbLhKfH.exe
  C:\Windows\System\cbLhKfH.exe
  2⤵
  PID:8940
- C:\Windows\System\EzvlutI.exe
  C:\Windows\System\EzvlutI.exe
  2⤵
  PID:8960
- C:\Windows\System\HKJKFgf.exe
  C:\Windows\System\HKJKFgf.exe
  2⤵
  PID:8980
- C:\Windows\System\ffnYnBT.exe
  C:\Windows\System\ffnYnBT.exe
  2⤵
  PID:8996
- C:\Windows\System\KXjdRPV.exe
  C:\Windows\System\KXjdRPV.exe
  2⤵
  PID:9012
- C:\Windows\System\grwlWND.exe
  C:\Windows\System\grwlWND.exe
  2⤵
  PID:9032
- C:\Windows\System\iuuAZBB.exe
  C:\Windows\System\iuuAZBB.exe
  2⤵
  PID:9048
- C:\Windows\System\HRQTzUU.exe
  C:\Windows\System\HRQTzUU.exe
  2⤵
  PID:9076
- C:\Windows\System\crKLpJl.exe
  C:\Windows\System\crKLpJl.exe
  2⤵
  PID:9092
- C:\Windows\System\CkaseLL.exe
  C:\Windows\System\CkaseLL.exe
  2⤵
  PID:9108
- C:\Windows\System\VuxpSmh.exe
  C:\Windows\System\VuxpSmh.exe
  2⤵
  PID:9128
- C:\Windows\System\KeRcbjO.exe
  C:\Windows\System\KeRcbjO.exe
  2⤵
  PID:9144
- C:\Windows\System\kgPcbAi.exe
  C:\Windows\System\kgPcbAi.exe
  2⤵
  PID:9160
- C:\Windows\System\drFpORG.exe
  C:\Windows\System\drFpORG.exe
  2⤵
  PID:9176
- C:\Windows\System\fHTIBFI.exe
  C:\Windows\System\fHTIBFI.exe
  2⤵
  PID:9196
- C:\Windows\System\BbiIQwP.exe
  C:\Windows\System\BbiIQwP.exe
  2⤵
  PID:9212
- C:\Windows\System\sstuzeq.exe
  C:\Windows\System\sstuzeq.exe
  2⤵
  PID:8180
- C:\Windows\System\gzHeCzT.exe
  C:\Windows\System\gzHeCzT.exe
  2⤵
  PID:8208
- C:\Windows\System\zCEEURE.exe
  C:\Windows\System\zCEEURE.exe
  2⤵
  PID:8260
- C:\Windows\System\ptlEnrX.exe
  C:\Windows\System\ptlEnrX.exe
  2⤵
  PID:8272
- C:\Windows\System\znlfZBT.exe
  C:\Windows\System\znlfZBT.exe
  2⤵
  PID:7912
- C:\Windows\System\ywsLJCO.exe
  C:\Windows\System\ywsLJCO.exe
  2⤵
  PID:7584
- C:\Windows\System\kxdxSbw.exe
  C:\Windows\System\kxdxSbw.exe
  2⤵
  PID:7192
- C:\Windows\System\aOdwuFc.exe
  C:\Windows\System\aOdwuFc.exe
  2⤵
  PID:7196
- C:\Windows\System\mNYcXAz.exe
  C:\Windows\System\mNYcXAz.exe
  2⤵
  PID:8288
- C:\Windows\System\oFAUNUC.exe
  C:\Windows\System\oFAUNUC.exe
  2⤵
  PID:8304
- C:\Windows\System\iofEOQe.exe
  C:\Windows\System\iofEOQe.exe
  2⤵
  PID:8340
- C:\Windows\System\aFMcDbJ.exe
  C:\Windows\System\aFMcDbJ.exe
  2⤵
  PID:8380
- C:\Windows\System\uZIgCaj.exe
  C:\Windows\System\uZIgCaj.exe
  2⤵
  PID:8396
- C:\Windows\System\oIwzJQf.exe
  C:\Windows\System\oIwzJQf.exe
  2⤵
  PID:8440
- C:\Windows\System\kaCKKsI.exe
  C:\Windows\System\kaCKKsI.exe
  2⤵
  PID:8436
- C:\Windows\System\xFKbJzT.exe
  C:\Windows\System\xFKbJzT.exe
  2⤵
  PID:8536
- C:\Windows\System\vkPjcwh.exe
  C:\Windows\System\vkPjcwh.exe
  2⤵
  PID:8476
- C:\Windows\System\rMfWNqj.exe
  C:\Windows\System\rMfWNqj.exe
  2⤵
  PID:8512
- C:\Windows\System\chlDNzT.exe
  C:\Windows\System\chlDNzT.exe
  2⤵
  PID:8584
- C:\Windows\System\rkhwPlw.exe
  C:\Windows\System\rkhwPlw.exe
  2⤵
  PID:8736
- C:\Windows\System\hjbfdeB.exe
  C:\Windows\System\hjbfdeB.exe
  2⤵
  PID:8632
- C:\Windows\System\mBAlVSh.exe
  C:\Windows\System\mBAlVSh.exe
  2⤵
  PID:8688
- C:\Windows\System\BFWgVOH.exe
  C:\Windows\System\BFWgVOH.exe
  2⤵
  PID:8648
- C:\Windows\System\csvpXyw.exe
  C:\Windows\System\csvpXyw.exe
  2⤵
  PID:8768
- C:\Windows\System\ZvTsjKe.exe
  C:\Windows\System\ZvTsjKe.exe
  2⤵
  PID:8780
- C:\Windows\System\pclqQqc.exe
  C:\Windows\System\pclqQqc.exe
  2⤵
  PID:8724
- C:\Windows\System\xigqGZR.exe
  C:\Windows\System\xigqGZR.exe
  2⤵
  PID:8824
- C:\Windows\System\WDfRKIB.exe
  C:\Windows\System\WDfRKIB.exe
  2⤵
  PID:8808
- C:\Windows\System\tVQDcop.exe
  C:\Windows\System\tVQDcop.exe
  2⤵
  PID:8876
- C:\Windows\System\aYNFBsl.exe
  C:\Windows\System\aYNFBsl.exe
  2⤵
  PID:8968
- C:\Windows\System\AcWCpSL.exe
  C:\Windows\System\AcWCpSL.exe
  2⤵
  PID:9008
- C:\Windows\System\gRmJLNx.exe
  C:\Windows\System\gRmJLNx.exe
  2⤵
  PID:8956
- C:\Windows\System\vjApqgE.exe
  C:\Windows\System\vjApqgE.exe
  2⤵
  PID:9024
- C:\Windows\System\EpNgKZi.exe
  C:\Windows\System\EpNgKZi.exe
  2⤵
  PID:8952
- C:\Windows\System\HTRNxWv.exe
  C:\Windows\System\HTRNxWv.exe
  2⤵
  PID:9084
- C:\Windows\System\JdIrvNw.exe
  C:\Windows\System\JdIrvNw.exe
  2⤵
  PID:9100
- C:\Windows\System\JnuSZRb.exe
  C:\Windows\System\JnuSZRb.exe
  2⤵
  PID:9192
- C:\Windows\System\nSzNxHa.exe
  C:\Windows\System\nSzNxHa.exe
  2⤵
  PID:8064
- C:\Windows\System\lHBKkOM.exe
  C:\Windows\System\lHBKkOM.exe
  2⤵
  PID:7840
- C:\Windows\System\BuoZcXb.exe
  C:\Windows\System\BuoZcXb.exe
  2⤵
  PID:8248
- C:\Windows\System\RygMQJp.exe
  C:\Windows\System\RygMQJp.exe
  2⤵
  PID:7336
- C:\Windows\System\HdGpzNA.exe
  C:\Windows\System\HdGpzNA.exe
  2⤵
  PID:8040
- C:\Windows\System\mzBOznw.exe
  C:\Windows\System\mzBOznw.exe
  2⤵
  PID:8324
- C:\Windows\System\JVKswfr.exe
  C:\Windows\System\JVKswfr.exe
  2⤵
  PID:8444
- C:\Windows\System\ULCWVGJ.exe
  C:\Windows\System\ULCWVGJ.exe
  2⤵
  PID:8372
- C:\Windows\System\CMlMxbM.exe
  C:\Windows\System\CMlMxbM.exe
  2⤵
  PID:8460
- C:\Windows\System\VRRitHa.exe
  C:\Windows\System\VRRitHa.exe
  2⤵
  PID:8496
- C:\Windows\System\mWjJxCV.exe
  C:\Windows\System\mWjJxCV.exe
  2⤵
  PID:8508
- C:\Windows\System\sydUozJ.exe
  C:\Windows\System\sydUozJ.exe
  2⤵
  PID:8756
- C:\Windows\System\HPKZlgi.exe
  C:\Windows\System\HPKZlgi.exe
  2⤵
  PID:8700
- C:\Windows\System\scZiehq.exe
  C:\Windows\System\scZiehq.exe
  2⤵
  PID:7668
- C:\Windows\System\MQTKRTu.exe
  C:\Windows\System\MQTKRTu.exe
  2⤵
  PID:8840
- C:\Windows\System\CRrdEXv.exe
  C:\Windows\System\CRrdEXv.exe
  2⤵
  PID:8992
- C:\Windows\System\qKenblF.exe
  C:\Windows\System\qKenblF.exe
  2⤵
  PID:8932
- C:\Windows\System\iEFezuu.exe
  C:\Windows\System\iEFezuu.exe
  2⤵
  PID:8748
- C:\Windows\System\hqfeAuo.exe
  C:\Windows\System\hqfeAuo.exe
  2⤵
  PID:9020
- C:\Windows\System\SWiNuwD.exe
  C:\Windows\System\SWiNuwD.exe
  2⤵
  PID:9064
- C:\Windows\System\wXrYFhx.exe
  C:\Windows\System\wXrYFhx.exe
  2⤵
  PID:9104
- C:\Windows\System\AkZguBw.exe
  C:\Windows\System\AkZguBw.exe
  2⤵
  PID:9184
- C:\Windows\System\wUrVjpH.exe
  C:\Windows\System\wUrVjpH.exe
  2⤵
  PID:9140
- C:\Windows\System\QdkQSuv.exe
  C:\Windows\System\QdkQSuv.exe
  2⤵
  PID:8224
- C:\Windows\System\VTemtZF.exe
  C:\Windows\System\VTemtZF.exe
  2⤵
  PID:8328
- C:\Windows\System\qsNGmlS.exe
  C:\Windows\System\qsNGmlS.exe
  2⤵
  PID:8652
- C:\Windows\System\kWsMWMn.exe
  C:\Windows\System\kWsMWMn.exe
  2⤵
  PID:8420
- C:\Windows\System\vcSJpfX.exe
  C:\Windows\System\vcSJpfX.exe
  2⤵
  PID:8256
- C:\Windows\System\SMUSBec.exe
  C:\Windows\System\SMUSBec.exe
  2⤵
  PID:8392
- C:\Windows\System\ivmugnn.exe
  C:\Windows\System\ivmugnn.exe
  2⤵
  PID:8404
- C:\Windows\System\trXCMsx.exe
  C:\Windows\System\trXCMsx.exe
  2⤵
  PID:8764
- C:\Windows\System\WwDkRHH.exe
  C:\Windows\System\WwDkRHH.exe
  2⤵
  PID:9044
- C:\Windows\System\uFbFdje.exe
  C:\Windows\System\uFbFdje.exe
  2⤵
  PID:8720
- C:\Windows\System\GXRlGXb.exe
  C:\Windows\System\GXRlGXb.exe
  2⤵
  PID:9072
- C:\Windows\System\AfbJsKX.exe
  C:\Windows\System\AfbJsKX.exe
  2⤵
  PID:9188
- C:\Windows\System\FbkSGpl.exe
  C:\Windows\System\FbkSGpl.exe
  2⤵
  PID:8656
- C:\Windows\System\opLMHMz.exe
  C:\Windows\System\opLMHMz.exe
  2⤵
  PID:8268
- C:\Windows\System\rMgDNFu.exe
  C:\Windows\System\rMgDNFu.exe
  2⤵
  PID:8464
- C:\Windows\System\IpAVnEq.exe
  C:\Windows\System\IpAVnEq.exe
  2⤵
  PID:8616
- C:\Windows\System\qNQoWag.exe
  C:\Windows\System\qNQoWag.exe
  2⤵
  PID:9124
- C:\Windows\System\olBkVkG.exe
  C:\Windows\System\olBkVkG.exe
  2⤵
  PID:7892
- C:\Windows\System\QizCodr.exe
  C:\Windows\System\QizCodr.exe
  2⤵
  PID:8804
- C:\Windows\System\BZsPACI.exe
  C:\Windows\System\BZsPACI.exe
  2⤵
  PID:8792
- C:\Windows\System\wQpBoWA.exe
  C:\Windows\System\wQpBoWA.exe
  2⤵
  PID:9204
- C:\Windows\System\LlhIKzB.exe
  C:\Windows\System\LlhIKzB.exe
  2⤵
  PID:8300
- C:\Windows\System\QgbYzVq.exe
  C:\Windows\System\QgbYzVq.exe
  2⤵
  PID:8744
- C:\Windows\System\TITHZPp.exe
  C:\Windows\System\TITHZPp.exe
  2⤵
  PID:9004
- C:\Windows\System\FZpzmsm.exe
  C:\Windows\System\FZpzmsm.exe
  2⤵
  PID:9224
- C:\Windows\System\OqyCxib.exe
  C:\Windows\System\OqyCxib.exe
  2⤵
  PID:9240
- C:\Windows\System\eEpANKk.exe
  C:\Windows\System\eEpANKk.exe
  2⤵
  PID:9256
- C:\Windows\System\hcigzUR.exe
  C:\Windows\System\hcigzUR.exe
  2⤵
  PID:9276
- C:\Windows\System\bulSBrT.exe
  C:\Windows\System\bulSBrT.exe
  2⤵
  PID:9292
- C:\Windows\System\yvICSsC.exe
  C:\Windows\System\yvICSsC.exe
  2⤵
  PID:9316
- C:\Windows\System\OKgEpkh.exe
  C:\Windows\System\OKgEpkh.exe
  2⤵
  PID:9332
- C:\Windows\System\xyYMnEA.exe
  C:\Windows\System\xyYMnEA.exe
  2⤵
  PID:9348
- C:\Windows\System\GkNfzJP.exe
  C:\Windows\System\GkNfzJP.exe
  2⤵
  PID:9364
- C:\Windows\System\xgRwgyj.exe
  C:\Windows\System\xgRwgyj.exe
  2⤵
  PID:9380
- C:\Windows\System\SxxlqqX.exe
  C:\Windows\System\SxxlqqX.exe
  2⤵
  PID:9408
- C:\Windows\System\nsxOxqx.exe
  C:\Windows\System\nsxOxqx.exe
  2⤵
  PID:9428
- C:\Windows\System\YNZrqbK.exe
  C:\Windows\System\YNZrqbK.exe
  2⤵
  PID:9448
- C:\Windows\System\HEqCPDs.exe
  C:\Windows\System\HEqCPDs.exe
  2⤵
  PID:9464
- C:\Windows\System\LNFHuep.exe
  C:\Windows\System\LNFHuep.exe
  2⤵
  PID:9484
- C:\Windows\System\QuUllSw.exe
  C:\Windows\System\QuUllSw.exe
  2⤵
  PID:9500
- C:\Windows\System\EpzYdQf.exe
  C:\Windows\System\EpzYdQf.exe
  2⤵
  PID:9516
- C:\Windows\System\lxPmzzy.exe
  C:\Windows\System\lxPmzzy.exe
  2⤵
  PID:9536
- C:\Windows\System\oWohCwy.exe
  C:\Windows\System\oWohCwy.exe
  2⤵
  PID:9676
- C:\Windows\System\deWZgAA.exe
  C:\Windows\System\deWZgAA.exe
  2⤵
  PID:9692
- C:\Windows\System\nDWbhHe.exe
  C:\Windows\System\nDWbhHe.exe
  2⤵
  PID:9712
- C:\Windows\System\WAeEoef.exe
  C:\Windows\System\WAeEoef.exe
  2⤵
  PID:9736
- C:\Windows\System\puntsLu.exe
  C:\Windows\System\puntsLu.exe
  2⤵
  PID:9752
- C:\Windows\System\TLuHiPB.exe
  C:\Windows\System\TLuHiPB.exe
  2⤵
  PID:9768
- C:\Windows\System\BCjRcyX.exe
  C:\Windows\System\BCjRcyX.exe
  2⤵
  PID:9784
- C:\Windows\System\ChsiWAP.exe
  C:\Windows\System\ChsiWAP.exe
  2⤵
  PID:9800
- C:\Windows\System\zFsVHEb.exe
  C:\Windows\System\zFsVHEb.exe
  2⤵
  PID:9896
- C:\Windows\System\izqmlrN.exe
  C:\Windows\System\izqmlrN.exe
  2⤵
  PID:9912
- C:\Windows\System\STXkeEc.exe
  C:\Windows\System\STXkeEc.exe
  2⤵
  PID:9928
- C:\Windows\System\fWwgkwl.exe
  C:\Windows\System\fWwgkwl.exe
  2⤵
  PID:9944
- C:\Windows\System\cjFMZAt.exe
  C:\Windows\System\cjFMZAt.exe
  2⤵
  PID:9960
- C:\Windows\System\XQLxPlS.exe
  C:\Windows\System\XQLxPlS.exe
  2⤵
  PID:9980
- C:\Windows\System\rowCOSf.exe
  C:\Windows\System\rowCOSf.exe
  2⤵
  PID:9996
- C:\Windows\System\UStzHZF.exe
  C:\Windows\System\UStzHZF.exe
  2⤵
  PID:10012
- C:\Windows\System\oBWJVgk.exe
  C:\Windows\System\oBWJVgk.exe
  2⤵
  PID:10032
- C:\Windows\System\fZbjCvK.exe
  C:\Windows\System\fZbjCvK.exe
  2⤵
  PID:10048
- C:\Windows\System\bIOGjhG.exe
  C:\Windows\System\bIOGjhG.exe
  2⤵
  PID:10076
- C:\Windows\System\HNTMXHJ.exe
  C:\Windows\System\HNTMXHJ.exe
  2⤵
  PID:10096
- C:\Windows\System\fzOBTkx.exe
  C:\Windows\System\fzOBTkx.exe
  2⤵
  PID:10112
- C:\Windows\System\oByuyHW.exe
  C:\Windows\System\oByuyHW.exe
  2⤵
  PID:10128
- C:\Windows\System\zmdjzbW.exe
  C:\Windows\System\zmdjzbW.exe
  2⤵
  PID:10148
- C:\Windows\System\DLYBGQW.exe
  C:\Windows\System\DLYBGQW.exe
  2⤵
  PID:10164
- C:\Windows\System\LtpdnmR.exe
  C:\Windows\System\LtpdnmR.exe
  2⤵
  PID:10180
- C:\Windows\System\HeiXFaW.exe
  C:\Windows\System\HeiXFaW.exe
  2⤵
  PID:10196
- C:\Windows\System\tAelcQZ.exe
  C:\Windows\System\tAelcQZ.exe
  2⤵
  PID:10216
- C:\Windows\System\CFFaXiC.exe
  C:\Windows\System\CFFaXiC.exe
  2⤵
  PID:10232
- C:\Windows\System\VZJWuBg.exe
  C:\Windows\System\VZJWuBg.exe
  2⤵
  PID:9248
- C:\Windows\System\KPAzlVO.exe
  C:\Windows\System\KPAzlVO.exe
  2⤵
  PID:9288
- C:\Windows\System\uqyztAi.exe
  C:\Windows\System\uqyztAi.exe
  2⤵
  PID:9340
- C:\Windows\System\VHDyzHb.exe
  C:\Windows\System\VHDyzHb.exe
  2⤵
  PID:9372
- C:\Windows\System\ycPuGDy.exe
  C:\Windows\System\ycPuGDy.exe
  2⤵
  PID:9396
- C:\Windows\System\CGWlyWZ.exe
  C:\Windows\System\CGWlyWZ.exe
  2⤵
  PID:9444
- C:\Windows\System\mkfpLno.exe
  C:\Windows\System\mkfpLno.exe
  2⤵
  PID:9508
- C:\Windows\System\mYtPjed.exe
  C:\Windows\System\mYtPjed.exe
  2⤵
  PID:9568
- C:\Windows\System\EtqlwIZ.exe
  C:\Windows\System\EtqlwIZ.exe
  2⤵
  PID:9580
- C:\Windows\System\zzXOKzI.exe
  C:\Windows\System\zzXOKzI.exe
  2⤵
  PID:9596
- C:\Windows\System\FXJRXSr.exe
  C:\Windows\System\FXJRXSr.exe
  2⤵
  PID:9616
- C:\Windows\System\siDDPrs.exe
  C:\Windows\System\siDDPrs.exe
  2⤵
  PID:9628
- C:\Windows\System\OSXxeAO.exe
  C:\Windows\System\OSXxeAO.exe
  2⤵
  PID:9652
- C:\Windows\System\YjSBxck.exe
  C:\Windows\System\YjSBxck.exe
  2⤵
  PID:9668
- C:\Windows\System\fXqKYmC.exe
  C:\Windows\System\fXqKYmC.exe
  2⤵
  PID:9708
- C:\Windows\System\IuaKzOM.exe
  C:\Windows\System\IuaKzOM.exe
  2⤵
  PID:9724
- C:\Windows\System\IjKHLCY.exe
  C:\Windows\System\IjKHLCY.exe
  2⤵
  PID:9776
- C:\Windows\System\pnjybxH.exe
  C:\Windows\System\pnjybxH.exe
  2⤵
  PID:9764
- C:\Windows\System\xNYOwZV.exe
  C:\Windows\System\xNYOwZV.exe
  2⤵
  PID:9832
- C:\Windows\System\xJaBvFd.exe
  C:\Windows\System\xJaBvFd.exe
  2⤵
  PID:9836
- C:\Windows\System\tXuxYvv.exe
  C:\Windows\System\tXuxYvv.exe
  2⤵
  PID:9852
- C:\Windows\System\ZlyEodl.exe
  C:\Windows\System\ZlyEodl.exe
  2⤵
  PID:9868
- C:\Windows\System\aQFzREQ.exe
  C:\Windows\System\aQFzREQ.exe
  2⤵
  PID:9888
- C:\Windows\System\EAJbYKn.exe
  C:\Windows\System\EAJbYKn.exe
  2⤵
  PID:9920
- C:\Windows\System\SPdwRus.exe
  C:\Windows\System\SPdwRus.exe
  2⤵
  PID:10208
- C:\Windows\System\GcTLEun.exe
  C:\Windows\System\GcTLEun.exe
  2⤵
  PID:10044
- C:\Windows\System\vEbFGKY.exe
  C:\Windows\System\vEbFGKY.exe
  2⤵
  PID:9236
- C:\Windows\System\wEtgaOH.exe
  C:\Windows\System\wEtgaOH.exe
  2⤵
  PID:9936
- C:\Windows\System\iBiQGcw.exe
  C:\Windows\System\iBiQGcw.exe
  2⤵
  PID:10228
- C:\Windows\System\uZiCGmv.exe
  C:\Windows\System\uZiCGmv.exe
  2⤵
  PID:10160
- C:\Windows\System\GZUhiec.exe
  C:\Windows\System\GZUhiec.exe
  2⤵
  PID:9328
- C:\Windows\System\bTtkbBW.exe
  C:\Windows\System\bTtkbBW.exe
  2⤵
  PID:9360
- C:\Windows\System\ycOAZxZ.exe
  C:\Windows\System\ycOAZxZ.exe
  2⤵
  PID:9480
- C:\Windows\System\QCmmNQw.exe
  C:\Windows\System\QCmmNQw.exe
  2⤵
  PID:9552
- C:\Windows\System\bzAcynd.exe
  C:\Windows\System\bzAcynd.exe
  2⤵
  PID:9532
- C:\Windows\System\iuAxjvp.exe
  C:\Windows\System\iuAxjvp.exe
  2⤵
  PID:9592
- C:\Windows\System\gxeQbsC.exe
  C:\Windows\System\gxeQbsC.exe
  2⤵
  PID:9644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AvkjnXf.exe

Filesize
1.6MB

MD5
c32196f75b2ee94ee2d6baec5cb79811

SHA1
9c951b06c224bb20a7fc6f17c3b9f0c33495a339

SHA256
ad382df0764c252cf376ae2e51e383ddc06ea21548081f91f5199f7586043f2f

SHA512
6bc683c1ab9f86e02de036fe78fa20491757500187439693201fd3e49b071e303e882f4730e8e5b0e4d6bb44f11033ac0c8aa61328923eb689a47984cf1d7860

Download Submit
C:\Windows\system\BuhGSkr.exe

Filesize
1.6MB

MD5
bbb88c6c8c69e8a27674c308832927b3

SHA1
2cfd870e29c935fc15891a623b32bd210ca032bc

SHA256
553ed0276808f8934b4e34b775c3cc54a25c6ab6e7e889dd5d889ba29b69d3b7

SHA512
ae15ee24e803dd825ce490a419fffa9ab631f0d9e3a596f8ee7fb68459560c5a7663bdf2690e4c33454d08c4ecac9ae6c0d22ca2144386dc21289ba5480d02ba

Download Submit
C:\Windows\system\CakhCwL.exe

Filesize
1.6MB

MD5
78cb7a4ce92f786294e7353357dc7557

SHA1
21dfbf636569676213503a630be0d3961718efb8

SHA256
fdb9d5dee5d6895717870f3d624c8c33f70e57f45b51dd47e12f1942130a8887

SHA512
94b5351ac37772af42e75eb52727423b1ffeb27eadf06f7513853e7874d7d260c3856ee05f6459ab6d8978518f13741a54cc8c7c41873fbf369697d2a692dad5

Download Submit
C:\Windows\system\CuNArRo.exe

Filesize
1.6MB

MD5
2be3b2bb9548e2f84fb2ea28a2350b37

SHA1
0e474511e684915e50e7c1a54758b27d9468a159

SHA256
2b238625ae9f54bd32a15994693c3e2ff664ef0986ec6f1fc256204316da9943

SHA512
b7e5a4b0820d9023e5f29dee9e4016d045d3c671bdcb75067ef8e2e7d66aca48bc8b2c9d176382dc15156de75a3cdc3f1d4efb50171c75ca78f9ab02de638e66

Download Submit
C:\Windows\system\FGrkMFO.exe

Filesize
1.6MB

MD5
cb25c498842a63a97af59287e09dcee4

SHA1
2bbcd801e254041492c2fd09eb1fc6871a841ba5

SHA256
04a69bc01fb4cafbddb461a228b4941e0d8f413b7cdc919c54e00f9677b728f2

SHA512
b0c22d3c48cac01bb77e33d0f0c1875a0c3b1cbb766720e3cbdcfdb3f4bbad93d0b467fb8571ec34ba6f32d94d99453c7ce5db3828e441f1650e7d66bf649990

Download Submit
C:\Windows\system\IVYReGM.exe

Filesize
1.6MB

MD5
2ceb7b0cb63d5a7f2abd725d55486606

SHA1
752a3f7191e0ebe52067cc836d0c5ab4e1bfdc65

SHA256
e7b3740b79e954cffbb4fca7932fce4af5e86168074953366a4e4a0db88fdbe2

SHA512
bbff0299bc8f132f147cfccf3730f8c5c8a4c1f3b0b4eb54ffc2a57605252e8c61ad9a316acb4287f7c429876d0b646a439882c25a898febb1130c9a89d05f44

Download Submit
C:\Windows\system\IpozKIa.exe

Filesize
1.6MB

MD5
38b7b7d97ed373ec650f9db5cb93a1a5

SHA1
38e99d63bfcf01e5763e410bac93963cacafc806

SHA256
e7d6c2c5bc8baeb1b7e16ee6e4b2939ffe31ed150e0759b12eff74b15cd9ad13

SHA512
7899469807ef93b1e8b2bb3b880c66d9a7b7e51c92994a55707c5ba44999f792ca09db013298690ddfadd23d703c154b123ccb5954c448a8adc2965b0e8320c6

Download Submit
C:\Windows\system\KJBPZSa.exe

Filesize
1.6MB

MD5
fa2fbc645adec5b97b062e71b1aae678

SHA1
1d225cfc77acf60856b4d00bb9770bc21f55c70f

SHA256
9e16f06fe810eb7d989bec496e5172a9ba7833c9951d80cd645ca2b25357982a

SHA512
ef70e2d879646409c14a8e021235bb92ae8a91ec1d692cb69660fae9efd377e9a202e18bdcfebf7df406d88f918602b13434f2ab6965f5589f335eb58b003ca3

Download Submit
C:\Windows\system\NAhWFPb.exe

Filesize
1.6MB

MD5
9efa2dc968f43f7a4df3d902193c81d3

SHA1
cb0d23c318e2b5f6e065048d1c6c82bf8b724926

SHA256
7518fbb3c0d0fa9d88c42b7bd1106afca13dc185537daa9337a534b103868dbc

SHA512
31870481f0a0d25afb0614ea21e787f585b46f71721e37202819c77491bdded4346cfac880cbcf99411077346e35535577f6ed325b57e0eec006a23068cec816

Download Submit
C:\Windows\system\NBhKpXr.exe

Filesize
1.6MB

MD5
97cd8e03dc64219dc8ff1f79d57b949f

SHA1
5cd68558404c320f1f5147390c48ada052291732

SHA256
5edec2eefe04948aca92aa97b6e780b12eb46dbe5df85ddd2b6c37f515d20311

SHA512
5895e56fc66e61c7e2394c97e8561da57ae0baae4f5c770fe5b8629821fad5a77ce7410ff7cd58e2e718377a4cdac2b43631e2d20170b556b82b7d73f9336074

Download Submit
C:\Windows\system\NeyjiIG.exe

Filesize
1.6MB

MD5
518ec01883dc910b7b0ce012f1b4bdf7

SHA1
df9d14f71e7af0eb524b4dc9a32dc0b127445291

SHA256
d81233c8bb61bdc852794fbc052b86e994619fedba1a1762d50468db7f84b320

SHA512
61a3d4b3c00bfa394baad4741a711e4cc8204990cd4a6e196e2178df9f3fda484956cb518add39b2ef82ce894c2abfc01fa3da789efc7cd3c7edee34d6cf89f5

Download Submit
C:\Windows\system\OcqARZY.exe

Filesize
1.6MB

MD5
290be321bac8a2b0c6069e7b69acbb63

SHA1
2432fb93d1831ad50b0117041ab20ad1c0b02898

SHA256
cbc473d246d58679f95d288a8177fd9ec93c21b2b5ddeae212e64584b559f0b5

SHA512
f55b284445dc530d65f5c23c463d2dc3ffeb4287897e8018365c0d8aa22148de9b0badcb3a1d597f496ce26833863a2273332df5e8e2a22031d0b0c468e0b21a

Download Submit
C:\Windows\system\PiznrIG.exe

Filesize
1.6MB

MD5
61cadf7bedb4b354a9db71864fa8c7b3

SHA1
687a16bccc175d37443f8eb3ef8faf418a463dd7

SHA256
59e927949c8349a6f27da84070cec0c81154a2ed7ee959aca3e49c70548d6fb9

SHA512
ae19489bffb15f1fe544bf7c06b4fe968cf4ddf6c7f87ba492c8d9ca1044a73cef571fce5d39d218e735d02c823478d90678ba859b6cbc350661507327b202a4

Download Submit
C:\Windows\system\YwKMVkF.exe

Filesize
1.6MB

MD5
6f800dfeba89b564cdf7078526fdd861

SHA1
6ee5636e6a07a281949d77e8c5f2a76d6809b7d4

SHA256
3173d441dde434d4b21a982d81d4b037bc76dce961b8d4857d979702bfe906f8

SHA512
d5fc27eed6777995fcc50fc333b0d45a540f35bceea0e0cdf58a6cf07e9104c496712b777077f66dfff12d91f3dbc93c21d70ae88274d196e105a22cd24ad51f

Download Submit
C:\Windows\system\acgSNJI.exe

Filesize
1.6MB

MD5
a39dbdb4f1f31670edfaa9fcbc743edc

SHA1
cb4f48ed2d974b2a29c928c9173e2b5b6eaa387e

SHA256
3c4c49e3458ed85a8964e38c53edaf4e203bbe5952fcbbd9c7d5b59f64b84dc6

SHA512
04bcb7c5efcc009afbc8ac8729293dfc98847185b2208bb135941a1cf946bbcd3a7169b7acf912a114e308fe2500b949d1e133d05836ac27fb95444d4d8214ca

Download Submit
C:\Windows\system\cCZTVpB.exe

Filesize
1.6MB

MD5
d678569a113f77cb953a42008bfc7d83

SHA1
bf99c68df6800a0d35581586b89af410dcb81bbe

SHA256
4e72887139dbf004c783e5922273f90013d693db169a406f8e57afc5d98fe1a6

SHA512
ca6224d46959fe2ca2bc3e266843cd69af55c2d5c0ab9ba182357bf6abbe824516f6b3870984458a9c97f0c41908c64d1a39013ded1bd6711d4f7cb54f245c0c

Download Submit
C:\Windows\system\elTMyeo.exe

Filesize
1.6MB

MD5
46613bff2f1f9055745d7882ae6d6696

SHA1
6393c45556e46f13532e4dbc155464024df4bdbc

SHA256
ce85a9ebcdda262d25a274373d05bd2aab8ecadec19a5cb573b9a3ae88f46244

SHA512
d1eb17354289d38f68ded705f6422b8efbabe95d438b5105fa84e3a1af2fd31db81f03621406752f40b59a3b956e5c9363f56d20df089dd222c25cb3a1ddba4c

Download Submit
C:\Windows\system\fJYGtmH.exe

Filesize
1.6MB

MD5
3095fc51ab324ceca5370a8c019398aa

SHA1
a79385a73a958887bdd3678df240d79c7fb870e7

SHA256
be11c70fafcce40db84b77dd17b090145350ab0ec9e2e0525552fc46280819a5

SHA512
9737b6772ff8e14b6fee512e1d5928d72112ab30db7fced80418852364507f27aece1576ce055a9029858d3a4303dee57f839ef858345d36ad811595f2dafc3a

Download Submit
C:\Windows\system\hdlehcs.exe

Filesize
1.6MB

MD5
e630faea31fb5958e74147a25439b0aa

SHA1
89b0b293987419bb1e3d64c9922299254e529adc

SHA256
6b5cdf925b81b2a702995f19b1ee5642aa47d4cea75662979713efcc5a7e6eaa

SHA512
d332eadded87dfc24d66fca6c26a12e5388213ad493ed1d4656e9a36b7fb45a23bc804c287813f8551e8fee49b8ce597a1d00d30b77acfcc4cbf9ff82f88c406

Download Submit
C:\Windows\system\isvxtnM.exe

Filesize
1.6MB

MD5
5234e03d1b1b3ba943aabf4d7f852656

SHA1
a35358b2eda5135c2a2583c0d733ad6b74c783b4

SHA256
4fb84627a1da991fdeda945e220b8ad17b55703f2d3c970a59bdcb9787154252

SHA512
2dbbf4a6d575b3707b1c5d0dfe2bc184ac2e58d6c8eccd5f4a2a22f79003502dd86544815da9b20eb3e4717b9993d8d52a42dcc01ffe9c31289c4d12a60a3299

Download Submit
C:\Windows\system\lUUjkYF.exe

Filesize
1.6MB

MD5
717aaa88cc5623fd599f3602b04000e3

SHA1
ae851ce79a77c20b5393db8b3dc235955fe4fb8b

SHA256
b7b4ba9d13ca9dedb3c5ea6d262cd8105b59b1c98569ac3367241fe340fd1a81

SHA512
69929fbbddf9a617f54a2ee4011511f560fb7263d58e87488c9f71fdb07912e20aacece22124b4ba73a6b4ea122333c05a238e5b88342aeebb3e541435c6538b

Download Submit
C:\Windows\system\nzZxCSQ.exe

Filesize
1.6MB

MD5
5b3bea4ca5e537481d6e6476b95481dd

SHA1
f076154b3117c51afbfc0b726133e5947cd2dd3c

SHA256
14e23b0e9afe4db1193be20d754e871a8dd43cd2acc6b95d7a746e883c8b0f3e

SHA512
3e151fdb73268a3a6805106b6c63079e57f4999e3b2cc8f8b0e55ec74423e6b05cc924bd7849163391afa5a50e17f47b04476afe64fce57572365dd46cf0d9f2

Download Submit
C:\Windows\system\oAMRtJm.exe

Filesize
1.6MB

MD5
40a0df495133e298f2a3ae5c259cf052

SHA1
244055583d7d5d6e53996511f660d8d71a085635

SHA256
2e36011efe240b0c91cc91e2c19a9884c57a40f8192cccf1a2bb67e7c38138f9

SHA512
7f86637a1a71e53f36fe2475bdf35a833522e3227841ab5605fc8332fc962e25743830f863bb00ce852f46deb5ab8a5984ad2a481f58b92093e99b9e65c64f6f

Download Submit
C:\Windows\system\oGrdSkQ.exe

Filesize
1.6MB

MD5
e153e69da91211db9c3d631e10181c3b

SHA1
df061640c10bb08d659e7de801e6243ada60bd95

SHA256
db87557ccc2d805c51feba24fd7535e2f17445249a52a54f9f5c7910fbac7a2c

SHA512
aac5f6a0eb53b2b601503f1ab339450559248f3d23521499e0d057fa0f6b0afd0a378d5b1bf66a9f569e3ae6eb1fed65fdd6db279e652365fd5462b664aa66ed

Download Submit
C:\Windows\system\sGqpBre.exe

Filesize
1.6MB

MD5
20c890f29671717251e8d4f6b0183179

SHA1
0474e9ea2a5bc04f34cdb2016e6a62ddb6d17ba8

SHA256
d2c5c9422b038a3c2714cff21c059f2791063a12c62e072d9ab4d5bd624dab85

SHA512
0860f3e50f3c11701d8cf251c9fdf361d796acb9521a62b88dd7c84cc22fa0a9525c0d22f6d3be6c692e14f899e2db67de459c95c5ca0209a0aabae165ae0436

Download Submit
\Windows\system\GZwvWfC.exe

Filesize
1.6MB

MD5
0e0e2c637b15a1cd36e891cb5d7f905c

SHA1
2b20f575594f25fc59a78ff52ab04b82c1666e39

SHA256
c843836ebfd510d4106c423ab08e3f72a09c9568d0d6a9679e9269925c65e8f9

SHA512
b84e9c48d929ffbe6099c8eefd71e0ac9548c12a5ac91a52c5f7a202f42be4dd5df245543c3fcd14c7a902a011dd8662180bb028bb664c095cfa529ab2911216

Download Submit
\Windows\system\GdYsQgf.exe

Filesize
1.6MB

MD5
114fa497cc8925ef002f243825cedf5a

SHA1
a6f301b09aa3e20b67597e2e3d9423623e0f232b

SHA256
78f68cb5b7d955c5ddd602960f1a4448de8fcb67177bc9acf86d2d16710a43b0

SHA512
ebecb25a33fc2a7a6fea5910b760a5cb6befe8c597878c74d604a2244996311bf0cbe751bd0636fd232cfeeab9e2d1aceb3a4af57fed2096ec4a45852b93b89e

Download Submit
\Windows\system\JShmvXI.exe

Filesize
1.6MB

MD5
2eebcf5db1bc98d254929d4f517f91c6

SHA1
42f16856b14d105774ef6d4611a24829880359b0

SHA256
055fb53902e81b8ad9542cb6f0ea44996c1e3915c7d30b1a087bd9b76f5e8bf4

SHA512
9c5428403c3612e5676802ef9a3faa9e3191c61004ff314183f5fc91bacd7c799d85c8e2a936ca8b0ad4423108b9128acf994e38c6d3b01ab19b0f9ecb852478

Download Submit
\Windows\system\KQNxMOa.exe

Filesize
1.6MB

MD5
7342e48eac8b895d0f71ca7204db0694

SHA1
ef2e9c51281fb3f3099cd08ca49c3f7a4c035adb

SHA256
eed9bcffea998d2d8f99cb8c4920325464034dd5b6601e2ccf6eb42323539cae

SHA512
addabe2ce8cfac6ea745062dde09d6a9c1a70871076eb55f9d4d252517f9dc6e83f93b68ed905ae4f9ad67687b422a6369d108e036e8d1b959b9a259a25da7ab

Download Submit
\Windows\system\LYSgEri.exe

Filesize
1.6MB

MD5
88047c6bd6695b34447f977cd424fb43

SHA1
251d421ec76e2ef598861ff202a27727eca7d353

SHA256
df5bf248f8fdadc528e5972b96ea16d21e5e2a162fa5c91f20067a1381e4e796

SHA512
5aa399f99e6a1a8f95f95b8d2352d812736111805de9b6f912dd2d0f05e183edf018569ba954960f00bd76a54aaf494f6780bdf9ee9a6cd054a93b5faa95e9db

Download Submit
\Windows\system\jfqbRxY.exe

Filesize
1.6MB

MD5
36ba98ba0cd1d8859ea6d861a4ff5d14

SHA1
ee0e5299e5e140e143d1dd19fbbd9071722aff22

SHA256
484515f917f0164adefa36cb65b6bada509006e5ba7ff9da33c14c201192e230

SHA512
6a9544ce1d50980a845edc5c4043a1d05168645915aa243de48129250814c8187ae59cb66c22a32c5a52a952bcb3d6c087f66a53043f4dcada87b6e4ad491954

Download Submit
\Windows\system\lnpLeiq.exe

Filesize
1.6MB

MD5
0d785c6d548ab00f6c02fa56a42c36f5

SHA1
437a0ee358f5bfed30ced463439e19f68418201b

SHA256
30eb9ad8131ae413ed5ef16e15a62ae73fbcb6510910463eccca96c49ef4156e

SHA512
a1cd9394c15e0973e7470bcc3c1931946dafea187772cfad8d593434886d8455a30800540fb7309596d7eb396bd737eabd99fabe9101d9dbc34f3db54e040a7f

Download Submit
\Windows\system\mHmTLiq.exe

Filesize
1.6MB

MD5
2be90a350021d68c3b89619164a7af0d

SHA1
488bca2848c7b04b52cf34cefb1106963af08ce6

SHA256
168470c4fd9b7dec10ccd05af79a9627827b6fd0cc0b9e8c88948a303f25bae2

SHA512
9ec981535992ea573fa789514eb87a9e4cb1220b8bf2dc0a387ac7087879c2b510dd95acf2b2262d315ed3ecc4e6cb6b09860b394bd653989f15c83c680c7073

Download Submit
\Windows\system\xrCdvws.exe

Filesize
1.6MB

MD5
d905aa3fe4d4b3ac025fc9d8a6f76d8e

SHA1
c823c75c36cf502ce1616779c3bc00d7d034c521

SHA256
f96b03933f055d80497965a9aff6e2e6d45eaa098b71386980731565b8ec6af1

SHA512
536394e16dbb51d1491066045c989dda1db40690f596e15493b59090cf80ffb0cea7846bb01599bb10384265430c871f9c13a9da8eb8696a86d274cab8fcebbf

Download Submit
memory/300-106-0x000000013F2B0000-0x000000013F601000-memory.dmp

Filesize
3.3MB

Download
memory/300-3988-0x000000013F2B0000-0x000000013F601000-memory.dmp

Filesize
3.3MB

Download
memory/1584-92-0x000000013F2B0000-0x000000013F601000-memory.dmp

Filesize
3.3MB

Download
memory/1584-139-0x000000013FE90000-0x00000001401E1000-memory.dmp

Filesize
3.3MB

Download
memory/1584-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/1584-3882-0x0000000001E90000-0x00000000021E1000-memory.dmp

Filesize
3.3MB

Download
memory/1584-3881-0x000000013FE80000-0x00000001401D1000-memory.dmp

Filesize
3.3MB

Download
memory/1584-3712-0x0000000001E90000-0x00000000021E1000-memory.dmp

Filesize
3.3MB

Download
memory/1584-0-0x000000013F740000-0x000000013FA91000-memory.dmp

Filesize
3.3MB

Download
memory/1584-77-0x000000013F2B0000-0x000000013F601000-memory.dmp

Filesize
3.3MB

Download
memory/1584-3705-0x000000013FED0000-0x0000000140221000-memory.dmp

Filesize
3.3MB

Download
memory/1584-74-0x000000013FC50000-0x000000013FFA1000-memory.dmp

Filesize
3.3MB

Download
memory/1584-131-0x000000013FAB0000-0x000000013FE01000-memory.dmp

Filesize
3.3MB

Download
memory/1584-72-0x000000013F120000-0x000000013F471000-memory.dmp

Filesize
3.3MB

Download
memory/1584-132-0x000000013F280000-0x000000013F5D1000-memory.dmp

Filesize
3.3MB

Download
memory/1584-66-0x000000013FD80000-0x00000001400D1000-memory.dmp

Filesize
3.3MB

Download
memory/1584-133-0x000000013FE80000-0x00000001401D1000-memory.dmp

Filesize
3.3MB

Download
memory/1584-134-0x000000013FFA0000-0x00000001402F1000-memory.dmp

Filesize
3.3MB

Download
memory/1584-3326-0x000000013F0F0000-0x000000013F441000-memory.dmp

Filesize
3.3MB

Download
memory/1584-43-0x000000013F0F0000-0x000000013F441000-memory.dmp

Filesize
3.3MB

Download
memory/1584-135-0x0000000001E90000-0x00000000021E1000-memory.dmp

Filesize
3.3MB

Download
memory/1584-3328-0x000000013F2B0000-0x000000013F601000-memory.dmp

Filesize
3.3MB

Download
memory/1584-3327-0x000000013F120000-0x000000013F471000-memory.dmp

Filesize
3.3MB

Download
memory/1584-82-0x000000013F260000-0x000000013F5B1000-memory.dmp

Filesize
3.3MB

Download
memory/1584-138-0x000000013FD20000-0x0000000140071000-memory.dmp

Filesize
3.3MB

Download
memory/1584-3325-0x0000000001E90000-0x00000000021E1000-memory.dmp

Filesize
3.3MB

Download
memory/1584-3324-0x000000013F740000-0x000000013FA91000-memory.dmp

Filesize
3.3MB

Download
memory/1584-110-0x0000000001E90000-0x00000000021E1000-memory.dmp

Filesize
3.3MB

Download
memory/2108-3984-0x000000013F890000-0x000000013FBE1000-memory.dmp

Filesize
3.3MB

Download
memory/2108-38-0x000000013F890000-0x000000013FBE1000-memory.dmp

Filesize
3.3MB

Download
memory/2172-76-0x000000013FAB0000-0x000000013FE01000-memory.dmp

Filesize
3.3MB

Download
memory/2172-3989-0x000000013FAB0000-0x000000013FE01000-memory.dmp

Filesize
3.3MB

Download
memory/2260-3996-0x000000013F120000-0x000000013F471000-memory.dmp

Filesize
3.3MB

Download
memory/2260-120-0x000000013F120000-0x000000013F471000-memory.dmp

Filesize
3.3MB

Download
memory/2440-52-0x000000013F0F0000-0x000000013F441000-memory.dmp

Filesize
3.3MB

Download
memory/2440-3985-0x000000013F0F0000-0x000000013F441000-memory.dmp

Filesize
3.3MB

Download
memory/2664-136-0x000000013FED0000-0x0000000140221000-memory.dmp

Filesize
3.3MB

Download
memory/2664-4005-0x000000013FED0000-0x0000000140221000-memory.dmp

Filesize
3.3MB

Download
memory/2676-130-0x000000013F260000-0x000000013F5B1000-memory.dmp

Filesize
3.3MB

Download
memory/2676-4049-0x000000013F260000-0x000000013F5B1000-memory.dmp

Filesize
3.3MB

Download
memory/2740-3992-0x000000013F2B0000-0x000000013F601000-memory.dmp

Filesize
3.3MB

Download
memory/2740-109-0x000000013F2B0000-0x000000013F601000-memory.dmp

Filesize
3.3MB

Download
memory/2848-4002-0x000000013F420000-0x000000013F771000-memory.dmp

Filesize
3.3MB

Download
memory/2848-121-0x000000013F420000-0x000000013F771000-memory.dmp

Filesize
3.3MB

Download
memory/3012-3995-0x000000013FC50000-0x000000013FFA1000-memory.dmp

Filesize
3.3MB

Download
memory/3012-100-0x000000013FC50000-0x000000013FFA1000-memory.dmp

Filesize
3.3MB

Download
memory/3024-137-0x000000013F280000-0x000000013F5D1000-memory.dmp

Filesize
3.3MB

Download
memory/3024-4019-0x000000013F280000-0x000000013F5D1000-memory.dmp

Filesize
3.3MB

Download
memory/3048-119-0x000000013FD80000-0x00000001400D1000-memory.dmp

Filesize
3.3MB

Download
memory/3048-4017-0x000000013FD80000-0x00000001400D1000-memory.dmp

Filesize
3.3MB

Download