xmrig | 3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
26-07-2024 20:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
Size

2.2MB
MD5

7fde849164847a13c6341b72e5bd8eca
SHA1

3bdc3d94109999e7214b7238d4c207cc30346d9d
SHA256

3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d
SHA512

08e6ad870e6c20a31be4b95b5264f208d92de1212b3738961aa8650e1d48698d351d5316f1c24f68a29700f0d177be3ccffff073c43031ac2194c3c1c091ba0e
SSDEEP

49152:oezaTF8FcNkNdfE0pZ9ozt4wIlMmSd/ayxv8:oemTLkNdfE0pZrL

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/files/0x0009000000015dac-68.dat	xmrig
behavioral1/files/0x0006000000018d6b-65.dat	xmrig
behavioral1/memory/2576-58-0x000000013F530000-0x000000013F884000-memory.dmp	xmrig
behavioral1/files/0x0006000000018c2e-55.dat	xmrig
behavioral1/memory/2680-64-0x000000013F800000-0x000000013FB54000-memory.dmp	xmrig
behavioral1/memory/2604-106-0x000000013FE20000-0x0000000140174000-memory.dmp	xmrig
behavioral1/files/0x00050000000191fe-128.dat	xmrig
behavioral1/files/0x0005000000019256-158.dat	xmrig
behavioral1/files/0x0005000000019358-188.dat	xmrig
behavioral1/files/0x0005000000019346-183.dat	xmrig
behavioral1/files/0x0005000000019309-179.dat	xmrig
behavioral1/files/0x0005000000019272-168.dat	xmrig
behavioral1/files/0x00050000000192fe-172.dat	xmrig
behavioral1/files/0x000500000001925b-163.dat	xmrig
behavioral1/files/0x0005000000019249-148.dat	xmrig
behavioral1/files/0x0005000000019253-153.dat	xmrig
behavioral1/files/0x0005000000019246-143.dat	xmrig
behavioral1/files/0x000500000001923a-138.dat	xmrig
behavioral1/files/0x0006000000018f94-118.dat	xmrig
behavioral1/files/0x0006000000018d87-109.dat	xmrig
behavioral1/files/0x0005000000019221-133.dat	xmrig
behavioral1/files/0x000600000001904f-123.dat	xmrig
behavioral1/files/0x0006000000018d89-113.dat	xmrig
behavioral1/memory/2896-105-0x000000013FAA0000-0x000000013FDF4000-memory.dmp	xmrig
behavioral1/memory/2456-104-0x000000013F0A0000-0x000000013F3F4000-memory.dmp	xmrig
behavioral1/files/0x0006000000018d74-93.dat	xmrig
behavioral1/files/0x0006000000018d40-92.dat	xmrig
behavioral1/files/0x0006000000018c27-89.dat	xmrig
behavioral1/memory/2680-88-0x000000013FE20000-0x0000000140174000-memory.dmp	xmrig
behavioral1/memory/2816-87-0x000000013FD90000-0x00000001400E4000-memory.dmp	xmrig
behavioral1/memory/2680-79-0x000000013F490000-0x000000013F7E4000-memory.dmp	xmrig
behavioral1/memory/2624-78-0x000000013F5E0000-0x000000013F934000-memory.dmp	xmrig
behavioral1/memory/2388-63-0x000000013F620000-0x000000013F974000-memory.dmp	xmrig
behavioral1/memory/2104-54-0x000000013F7E0000-0x000000013FB34000-memory.dmp	xmrig
behavioral1/files/0x0006000000018d80-99.dat	xmrig
behavioral1/memory/2720-76-0x000000013F560000-0x000000013F8B4000-memory.dmp	xmrig
behavioral1/memory/2892-75-0x000000013FA70000-0x000000013FDC4000-memory.dmp	xmrig
behavioral1/memory/2744-72-0x000000013F800000-0x000000013FB54000-memory.dmp	xmrig
behavioral1/memory/2220-71-0x000000013F760000-0x000000013FAB4000-memory.dmp	xmrig
behavioral1/memory/1668-48-0x000000013F490000-0x000000013F7E4000-memory.dmp	xmrig
behavioral1/files/0x0008000000015db6-45.dat	xmrig
behavioral1/files/0x0007000000015da2-44.dat	xmrig
behavioral1/files/0x0007000000015d98-42.dat	xmrig
behavioral1/files/0x0008000000015d78-29.dat	xmrig
behavioral1/files/0x0007000000015d8b-26.dat	xmrig
behavioral1/files/0x0008000000015d5f-25.dat	xmrig
behavioral1/files/0x0008000000015d3f-22.dat	xmrig
behavioral1/memory/2520-15-0x000000013F8E0000-0x000000013FC34000-memory.dmp	xmrig
behavioral1/files/0x00090000000120f8-6.dat	xmrig
behavioral1/memory/2680-2-0x000000013F0C0000-0x000000013F414000-memory.dmp	xmrig
behavioral1/memory/2680-2524-0x000000013F0C0000-0x000000013F414000-memory.dmp	xmrig
behavioral1/memory/2680-3946-0x000000013FE20000-0x0000000140174000-memory.dmp	xmrig
behavioral1/memory/2520-3947-0x000000013F8E0000-0x000000013FC34000-memory.dmp	xmrig
behavioral1/memory/1668-3949-0x000000013F490000-0x000000013F7E4000-memory.dmp	xmrig
behavioral1/memory/2388-3951-0x000000013F620000-0x000000013F974000-memory.dmp	xmrig
behavioral1/memory/2576-3950-0x000000013F530000-0x000000013F884000-memory.dmp	xmrig
behavioral1/memory/2104-3948-0x000000013F7E0000-0x000000013FB34000-memory.dmp	xmrig
behavioral1/memory/2744-3952-0x000000013F800000-0x000000013FB54000-memory.dmp	xmrig
behavioral1/memory/2892-3953-0x000000013FA70000-0x000000013FDC4000-memory.dmp	xmrig
behavioral1/memory/2624-3956-0x000000013F5E0000-0x000000013F934000-memory.dmp	xmrig
behavioral1/memory/2220-3955-0x000000013F760000-0x000000013FAB4000-memory.dmp	xmrig
behavioral1/memory/2720-3954-0x000000013F560000-0x000000013F8B4000-memory.dmp	xmrig
behavioral1/memory/2816-3957-0x000000013FD90000-0x00000001400E4000-memory.dmp	xmrig
behavioral1/memory/2456-3959-0x000000013F0A0000-0x000000013F3F4000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2520	QsOyWIG.exe
1668	AuLKrwS.exe
2104	pfwgEsN.exe
2576	fYdQwMQ.exe
2388	ZMxJoJh.exe
2220	jwhTGxh.exe
2744	YeMGCll.exe
2892	PCmbZsA.exe
2720	ncSxRFJ.exe
2816	AvJgrES.exe
2624	spRolyv.exe
2456	jIxNXBL.exe
2896	vPDyCQw.exe
2604	ovqgepF.exe
2300	hdRnQuG.exe
1548	fltAYfF.exe
1916	CeMVgee.exe
2504	mvBKJaa.exe
376	ozWndIc.exe
2872	IzlgiIt.exe
2884	EACTJId.exe
3000	zNUKFnz.exe
2968	HJJqfkr.exe
2052	pdaOVEv.exe
1300	qaLLYPG.exe
2184	xFBKZrd.exe
372	tvRlXad.exe
404	ElvuMBq.exe
544	elnZOPQ.exe
2996	jXwuDVF.exe
944	wrzaYyQ.exe
1912	IiYzoYG.exe
1624	cKygWSy.exe
1748	ARQaRwi.exe
1876	KcbhnPC.exe
1224	qosGffN.exe
896	vnCBEsw.exe
1588	xUCsLqg.exe
2328	LLAIeMy.exe
1140	ZTDLpFH.exe
1568	gXSwuHH.exe
2100	fGsNgtT.exe
2352	KwAqFhG.exe
2640	wyTPZLg.exe
2512	EYXntly.exe
524	hZgCLeh.exe
2364	wzOoNTY.exe
1892	JmhXPOc.exe
760	aGCdqtG.exe
1616	nrKBIiE.exe
1356	fmNEyRg.exe
1272	SxjjsMG.exe
2348	GMOSEDq.exe
2808	hSzIzZn.exe
2728	VYmRiwi.exe
2284	MCpjtGC.exe
2768	wLBTeCt.exe
1500	GBOAhyg.exe
3028	XdRSLFm.exe
1400	ewSjIMb.exe
2844	TteGguB.exe
2124	cnGKwHM.exe
1988	DqXnnwW.exe
2152	YcKEJrm.exe

Loads dropped DLL 64 IoCs

pid	Process
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe

UPX packed file 62 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0009000000015dac-68.dat	upx
behavioral1/files/0x0006000000018d6b-65.dat	upx
behavioral1/memory/2576-58-0x000000013F530000-0x000000013F884000-memory.dmp	upx
behavioral1/files/0x0006000000018c2e-55.dat	upx
behavioral1/memory/2604-106-0x000000013FE20000-0x0000000140174000-memory.dmp	upx
behavioral1/files/0x00050000000191fe-128.dat	upx
behavioral1/files/0x0005000000019256-158.dat	upx
behavioral1/files/0x0005000000019358-188.dat	upx
behavioral1/files/0x0005000000019346-183.dat	upx
behavioral1/files/0x0005000000019309-179.dat	upx
behavioral1/files/0x0005000000019272-168.dat	upx
behavioral1/files/0x00050000000192fe-172.dat	upx
behavioral1/files/0x000500000001925b-163.dat	upx
behavioral1/files/0x0005000000019249-148.dat	upx
behavioral1/files/0x0005000000019253-153.dat	upx
behavioral1/files/0x0005000000019246-143.dat	upx
behavioral1/files/0x000500000001923a-138.dat	upx
behavioral1/files/0x0006000000018f94-118.dat	upx
behavioral1/files/0x0006000000018d87-109.dat	upx
behavioral1/files/0x0005000000019221-133.dat	upx
behavioral1/files/0x000600000001904f-123.dat	upx
behavioral1/files/0x0006000000018d89-113.dat	upx
behavioral1/memory/2896-105-0x000000013FAA0000-0x000000013FDF4000-memory.dmp	upx
behavioral1/memory/2456-104-0x000000013F0A0000-0x000000013F3F4000-memory.dmp	upx
behavioral1/files/0x0006000000018d74-93.dat	upx
behavioral1/files/0x0006000000018d40-92.dat	upx
behavioral1/files/0x0006000000018c27-89.dat	upx
behavioral1/memory/2816-87-0x000000013FD90000-0x00000001400E4000-memory.dmp	upx
behavioral1/memory/2624-78-0x000000013F5E0000-0x000000013F934000-memory.dmp	upx
behavioral1/memory/2388-63-0x000000013F620000-0x000000013F974000-memory.dmp	upx
behavioral1/memory/2104-54-0x000000013F7E0000-0x000000013FB34000-memory.dmp	upx
behavioral1/files/0x0006000000018d80-99.dat	upx
behavioral1/memory/2720-76-0x000000013F560000-0x000000013F8B4000-memory.dmp	upx
behavioral1/memory/2892-75-0x000000013FA70000-0x000000013FDC4000-memory.dmp	upx
behavioral1/memory/2744-72-0x000000013F800000-0x000000013FB54000-memory.dmp	upx
behavioral1/memory/2220-71-0x000000013F760000-0x000000013FAB4000-memory.dmp	upx
behavioral1/memory/1668-48-0x000000013F490000-0x000000013F7E4000-memory.dmp	upx
behavioral1/files/0x0008000000015db6-45.dat	upx
behavioral1/files/0x0007000000015da2-44.dat	upx
behavioral1/files/0x0007000000015d98-42.dat	upx
behavioral1/files/0x0008000000015d78-29.dat	upx
behavioral1/files/0x0007000000015d8b-26.dat	upx
behavioral1/files/0x0008000000015d5f-25.dat	upx
behavioral1/files/0x0008000000015d3f-22.dat	upx
behavioral1/memory/2520-15-0x000000013F8E0000-0x000000013FC34000-memory.dmp	upx
behavioral1/files/0x00090000000120f8-6.dat	upx
behavioral1/memory/2680-2-0x000000013F0C0000-0x000000013F414000-memory.dmp	upx
behavioral1/memory/2680-2524-0x000000013F0C0000-0x000000013F414000-memory.dmp	upx
behavioral1/memory/2520-3947-0x000000013F8E0000-0x000000013FC34000-memory.dmp	upx
behavioral1/memory/1668-3949-0x000000013F490000-0x000000013F7E4000-memory.dmp	upx
behavioral1/memory/2388-3951-0x000000013F620000-0x000000013F974000-memory.dmp	upx
behavioral1/memory/2576-3950-0x000000013F530000-0x000000013F884000-memory.dmp	upx
behavioral1/memory/2104-3948-0x000000013F7E0000-0x000000013FB34000-memory.dmp	upx
behavioral1/memory/2744-3952-0x000000013F800000-0x000000013FB54000-memory.dmp	upx
behavioral1/memory/2892-3953-0x000000013FA70000-0x000000013FDC4000-memory.dmp	upx
behavioral1/memory/2624-3956-0x000000013F5E0000-0x000000013F934000-memory.dmp	upx
behavioral1/memory/2220-3955-0x000000013F760000-0x000000013FAB4000-memory.dmp	upx
behavioral1/memory/2720-3954-0x000000013F560000-0x000000013F8B4000-memory.dmp	upx
behavioral1/memory/2816-3957-0x000000013FD90000-0x00000001400E4000-memory.dmp	upx
behavioral1/memory/2456-3959-0x000000013F0A0000-0x000000013F3F4000-memory.dmp	upx
behavioral1/memory/2604-3958-0x000000013FE20000-0x0000000140174000-memory.dmp	upx
behavioral1/memory/2896-3960-0x000000013FAA0000-0x000000013FDF4000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\UrNiVhV.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\DMUhlXw.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\YYnQfqR.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\RzmDNkm.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\yRbwEPJ.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\nIIrFjn.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\kRboQJd.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\fKmuaSO.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\gfQTCXj.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\lnvWOGG.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\pLUylhn.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\JcjhTvh.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\gOiDivS.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\UqQqsTL.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\ztJKXOY.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\TePYgiY.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\dhmJMTv.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\sgcILVl.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\zJUNQdf.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\GiVNRbd.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\aJIImWp.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\PQDVtpi.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\KFiSHYU.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\MLVouSr.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\nhIpdHK.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\BeBsiCU.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\AuLKrwS.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\ZXIqMVG.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\hRDXlrQ.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\jsWpkhF.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\TwuFuuo.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\vUHrphH.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\neofVzj.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\AGlZDjk.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\NCIXuOd.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\mmKpJws.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\eLAotOd.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\cKygWSy.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\hmyAMbv.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\ldTZFUu.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\JGTvVdU.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\vHXtjtX.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\DQJiWSA.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\VRIrZni.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\cTvQOWf.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\zHMbTqi.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\WsnsLxL.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\sTVUMEx.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\PPVJDQv.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\uisiKgn.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\rEbXrFU.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\xEBgVDe.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\UAHTjrh.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\mParAUh.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\rHpoHjA.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\eEisGhA.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\OCtXUnp.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\jolkNHF.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\vnCBEsw.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\HvGNDFg.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\eEdQllY.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\VNBTGKN.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\bGsmODu.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
File created	C:\Windows\System\vIcqNSE.exe	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 2520	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	31
PID 2680 wrote to memory of 2520	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	31
PID 2680 wrote to memory of 2520	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	31
PID 2680 wrote to memory of 1668	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	32
PID 2680 wrote to memory of 1668	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	32
PID 2680 wrote to memory of 1668	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	32
PID 2680 wrote to memory of 2104	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	33
PID 2680 wrote to memory of 2104	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	33
PID 2680 wrote to memory of 2104	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	33
PID 2680 wrote to memory of 2388	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	34
PID 2680 wrote to memory of 2388	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	34
PID 2680 wrote to memory of 2388	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	34
PID 2680 wrote to memory of 2576	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	35
PID 2680 wrote to memory of 2576	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	35
PID 2680 wrote to memory of 2576	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	35
PID 2680 wrote to memory of 2220	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	36
PID 2680 wrote to memory of 2220	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	36
PID 2680 wrote to memory of 2220	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	36
PID 2680 wrote to memory of 2744	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	37
PID 2680 wrote to memory of 2744	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	37
PID 2680 wrote to memory of 2744	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	37
PID 2680 wrote to memory of 2816	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	38
PID 2680 wrote to memory of 2816	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	38
PID 2680 wrote to memory of 2816	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	38
PID 2680 wrote to memory of 2892	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	39
PID 2680 wrote to memory of 2892	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	39
PID 2680 wrote to memory of 2892	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	39
PID 2680 wrote to memory of 2456	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	40
PID 2680 wrote to memory of 2456	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	40
PID 2680 wrote to memory of 2456	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	40
PID 2680 wrote to memory of 2720	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	41
PID 2680 wrote to memory of 2720	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	41
PID 2680 wrote to memory of 2720	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	41
PID 2680 wrote to memory of 2896	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	42
PID 2680 wrote to memory of 2896	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	42
PID 2680 wrote to memory of 2896	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	42
PID 2680 wrote to memory of 2624	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	43
PID 2680 wrote to memory of 2624	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	43
PID 2680 wrote to memory of 2624	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	43
PID 2680 wrote to memory of 2604	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	44
PID 2680 wrote to memory of 2604	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	44
PID 2680 wrote to memory of 2604	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	44
PID 2680 wrote to memory of 2300	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	45
PID 2680 wrote to memory of 2300	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	45
PID 2680 wrote to memory of 2300	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	45
PID 2680 wrote to memory of 1548	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	46
PID 2680 wrote to memory of 1548	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	46
PID 2680 wrote to memory of 1548	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	46
PID 2680 wrote to memory of 1916	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	47
PID 2680 wrote to memory of 1916	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	47
PID 2680 wrote to memory of 1916	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	47
PID 2680 wrote to memory of 2504	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	48
PID 2680 wrote to memory of 2504	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	48
PID 2680 wrote to memory of 2504	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	48
PID 2680 wrote to memory of 376	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	49
PID 2680 wrote to memory of 376	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	49
PID 2680 wrote to memory of 376	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	49
PID 2680 wrote to memory of 2872	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	50
PID 2680 wrote to memory of 2872	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	50
PID 2680 wrote to memory of 2872	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	50
PID 2680 wrote to memory of 2884	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	51
PID 2680 wrote to memory of 2884	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	51
PID 2680 wrote to memory of 2884	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	51
PID 2680 wrote to memory of 3000	2680	3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe	52

C:\Users\Admin\AppData\Local\Temp\3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe
"C:\Users\Admin\AppData\Local\Temp\3af2f5dfbe8ffd72b3beeccdab8850522a185efed26509e6aaaf0f25281cd26d.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Windows\System\QsOyWIG.exe
  C:\Windows\System\QsOyWIG.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\AuLKrwS.exe
  C:\Windows\System\AuLKrwS.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\pfwgEsN.exe
  C:\Windows\System\pfwgEsN.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\ZMxJoJh.exe
  C:\Windows\System\ZMxJoJh.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\fYdQwMQ.exe
  C:\Windows\System\fYdQwMQ.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\jwhTGxh.exe
  C:\Windows\System\jwhTGxh.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\YeMGCll.exe
  C:\Windows\System\YeMGCll.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\AvJgrES.exe
  C:\Windows\System\AvJgrES.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\PCmbZsA.exe
  C:\Windows\System\PCmbZsA.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\jIxNXBL.exe
  C:\Windows\System\jIxNXBL.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\ncSxRFJ.exe
  C:\Windows\System\ncSxRFJ.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\vPDyCQw.exe
  C:\Windows\System\vPDyCQw.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\spRolyv.exe
  C:\Windows\System\spRolyv.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\ovqgepF.exe
  C:\Windows\System\ovqgepF.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\hdRnQuG.exe
  C:\Windows\System\hdRnQuG.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\fltAYfF.exe
  C:\Windows\System\fltAYfF.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\CeMVgee.exe
  C:\Windows\System\CeMVgee.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\mvBKJaa.exe
  C:\Windows\System\mvBKJaa.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\ozWndIc.exe
  C:\Windows\System\ozWndIc.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\IzlgiIt.exe
  C:\Windows\System\IzlgiIt.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\EACTJId.exe
  C:\Windows\System\EACTJId.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\zNUKFnz.exe
  C:\Windows\System\zNUKFnz.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\HJJqfkr.exe
  C:\Windows\System\HJJqfkr.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\pdaOVEv.exe
  C:\Windows\System\pdaOVEv.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\qaLLYPG.exe
  C:\Windows\System\qaLLYPG.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\xFBKZrd.exe
  C:\Windows\System\xFBKZrd.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\tvRlXad.exe
  C:\Windows\System\tvRlXad.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\ElvuMBq.exe
  C:\Windows\System\ElvuMBq.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\elnZOPQ.exe
  C:\Windows\System\elnZOPQ.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\jXwuDVF.exe
  C:\Windows\System\jXwuDVF.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\wrzaYyQ.exe
  C:\Windows\System\wrzaYyQ.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\IiYzoYG.exe
  C:\Windows\System\IiYzoYG.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\cKygWSy.exe
  C:\Windows\System\cKygWSy.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\ARQaRwi.exe
  C:\Windows\System\ARQaRwi.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\KcbhnPC.exe
  C:\Windows\System\KcbhnPC.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\qosGffN.exe
  C:\Windows\System\qosGffN.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\vnCBEsw.exe
  C:\Windows\System\vnCBEsw.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\xUCsLqg.exe
  C:\Windows\System\xUCsLqg.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\LLAIeMy.exe
  C:\Windows\System\LLAIeMy.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\ZTDLpFH.exe
  C:\Windows\System\ZTDLpFH.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\gXSwuHH.exe
  C:\Windows\System\gXSwuHH.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\KwAqFhG.exe
  C:\Windows\System\KwAqFhG.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\fGsNgtT.exe
  C:\Windows\System\fGsNgtT.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\wyTPZLg.exe
  C:\Windows\System\wyTPZLg.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\EYXntly.exe
  C:\Windows\System\EYXntly.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\hZgCLeh.exe
  C:\Windows\System\hZgCLeh.exe
  2⤵
  - Executes dropped EXE
  PID:524
- C:\Windows\System\wzOoNTY.exe
  C:\Windows\System\wzOoNTY.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\JmhXPOc.exe
  C:\Windows\System\JmhXPOc.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\aGCdqtG.exe
  C:\Windows\System\aGCdqtG.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\nrKBIiE.exe
  C:\Windows\System\nrKBIiE.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\fmNEyRg.exe
  C:\Windows\System\fmNEyRg.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\SxjjsMG.exe
  C:\Windows\System\SxjjsMG.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\GMOSEDq.exe
  C:\Windows\System\GMOSEDq.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\hSzIzZn.exe
  C:\Windows\System\hSzIzZn.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\VYmRiwi.exe
  C:\Windows\System\VYmRiwi.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\MCpjtGC.exe
  C:\Windows\System\MCpjtGC.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\wLBTeCt.exe
  C:\Windows\System\wLBTeCt.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\GBOAhyg.exe
  C:\Windows\System\GBOAhyg.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\XdRSLFm.exe
  C:\Windows\System\XdRSLFm.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\ewSjIMb.exe
  C:\Windows\System\ewSjIMb.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\TteGguB.exe
  C:\Windows\System\TteGguB.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\cnGKwHM.exe
  C:\Windows\System\cnGKwHM.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\DqXnnwW.exe
  C:\Windows\System\DqXnnwW.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\YcKEJrm.exe
  C:\Windows\System\YcKEJrm.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\lGjuqQo.exe
  C:\Windows\System\lGjuqQo.exe
  2⤵
  PID:2344
- C:\Windows\System\iovtaNo.exe
  C:\Windows\System\iovtaNo.exe
  2⤵
  PID:1872
- C:\Windows\System\VEXlQYc.exe
  C:\Windows\System\VEXlQYc.exe
  2⤵
  PID:2984
- C:\Windows\System\gEcWNsi.exe
  C:\Windows\System\gEcWNsi.exe
  2⤵
  PID:2192
- C:\Windows\System\uRForUK.exe
  C:\Windows\System\uRForUK.exe
  2⤵
  PID:1420
- C:\Windows\System\lYdBiOG.exe
  C:\Windows\System\lYdBiOG.exe
  2⤵
  PID:2268
- C:\Windows\System\UDsbQFw.exe
  C:\Windows\System\UDsbQFw.exe
  2⤵
  PID:1540
- C:\Windows\System\wvmhBSA.exe
  C:\Windows\System\wvmhBSA.exe
  2⤵
  PID:1464
- C:\Windows\System\liwUWuA.exe
  C:\Windows\System\liwUWuA.exe
  2⤵
  PID:1536
- C:\Windows\System\JcjhTvh.exe
  C:\Windows\System\JcjhTvh.exe
  2⤵
  PID:1848
- C:\Windows\System\ZXIqMVG.exe
  C:\Windows\System\ZXIqMVG.exe
  2⤵
  PID:1212
- C:\Windows\System\PtUSSMF.exe
  C:\Windows\System\PtUSSMF.exe
  2⤵
  PID:1208
- C:\Windows\System\ciYLJGD.exe
  C:\Windows\System\ciYLJGD.exe
  2⤵
  PID:600
- C:\Windows\System\WdwVFTo.exe
  C:\Windows\System\WdwVFTo.exe
  2⤵
  PID:2304
- C:\Windows\System\rPrSgCp.exe
  C:\Windows\System\rPrSgCp.exe
  2⤵
  PID:2360
- C:\Windows\System\zQjkaAb.exe
  C:\Windows\System\zQjkaAb.exe
  2⤵
  PID:2312
- C:\Windows\System\PFQagmv.exe
  C:\Windows\System\PFQagmv.exe
  2⤵
  PID:1908
- C:\Windows\System\UlcrVqL.exe
  C:\Windows\System\UlcrVqL.exe
  2⤵
  PID:1424
- C:\Windows\System\iuNAYdA.exe
  C:\Windows\System\iuNAYdA.exe
  2⤵
  PID:2308
- C:\Windows\System\VmRzyVb.exe
  C:\Windows\System\VmRzyVb.exe
  2⤵
  PID:2372
- C:\Windows\System\RUIAICy.exe
  C:\Windows\System\RUIAICy.exe
  2⤵
  PID:2760
- C:\Windows\System\hzOQloX.exe
  C:\Windows\System\hzOQloX.exe
  2⤵
  PID:2408
- C:\Windows\System\zNdnBZp.exe
  C:\Windows\System\zNdnBZp.exe
  2⤵
  PID:2912
- C:\Windows\System\BqGycFd.exe
  C:\Windows\System\BqGycFd.exe
  2⤵
  PID:1532
- C:\Windows\System\UtgUGiy.exe
  C:\Windows\System\UtgUGiy.exe
  2⤵
  PID:3076
- C:\Windows\System\oifaTNM.exe
  C:\Windows\System\oifaTNM.exe
  2⤵
  PID:3092
- C:\Windows\System\ILQtbWe.exe
  C:\Windows\System\ILQtbWe.exe
  2⤵
  PID:3108
- C:\Windows\System\JRgooLD.exe
  C:\Windows\System\JRgooLD.exe
  2⤵
  PID:3124
- C:\Windows\System\uOpKnFw.exe
  C:\Windows\System\uOpKnFw.exe
  2⤵
  PID:3144
- C:\Windows\System\mHOovoY.exe
  C:\Windows\System\mHOovoY.exe
  2⤵
  PID:3168
- C:\Windows\System\yiwYUmy.exe
  C:\Windows\System\yiwYUmy.exe
  2⤵
  PID:3188
- C:\Windows\System\extwNHX.exe
  C:\Windows\System\extwNHX.exe
  2⤵
  PID:3204
- C:\Windows\System\xuyXwNM.exe
  C:\Windows\System\xuyXwNM.exe
  2⤵
  PID:3224
- C:\Windows\System\LWoBzcx.exe
  C:\Windows\System\LWoBzcx.exe
  2⤵
  PID:3268
- C:\Windows\System\bQSJGTO.exe
  C:\Windows\System\bQSJGTO.exe
  2⤵
  PID:3312
- C:\Windows\System\hcSJWtO.exe
  C:\Windows\System\hcSJWtO.exe
  2⤵
  PID:3332
- C:\Windows\System\yJRqUty.exe
  C:\Windows\System\yJRqUty.exe
  2⤵
  PID:3348
- C:\Windows\System\YptYUeq.exe
  C:\Windows\System\YptYUeq.exe
  2⤵
  PID:3368
- C:\Windows\System\aDNMPZj.exe
  C:\Windows\System\aDNMPZj.exe
  2⤵
  PID:3392
- C:\Windows\System\neofVzj.exe
  C:\Windows\System\neofVzj.exe
  2⤵
  PID:3412
- C:\Windows\System\kDMorKZ.exe
  C:\Windows\System\kDMorKZ.exe
  2⤵
  PID:3432
- C:\Windows\System\RgdveBc.exe
  C:\Windows\System\RgdveBc.exe
  2⤵
  PID:3452
- C:\Windows\System\BapnXTj.exe
  C:\Windows\System\BapnXTj.exe
  2⤵
  PID:3468
- C:\Windows\System\MLRPdzL.exe
  C:\Windows\System\MLRPdzL.exe
  2⤵
  PID:3496
- C:\Windows\System\GgiRYQf.exe
  C:\Windows\System\GgiRYQf.exe
  2⤵
  PID:3512
- C:\Windows\System\eiTDexu.exe
  C:\Windows\System\eiTDexu.exe
  2⤵
  PID:3528
- C:\Windows\System\LeIQnyb.exe
  C:\Windows\System\LeIQnyb.exe
  2⤵
  PID:3552
- C:\Windows\System\tnZPKoK.exe
  C:\Windows\System\tnZPKoK.exe
  2⤵
  PID:3568
- C:\Windows\System\TDZwEcD.exe
  C:\Windows\System\TDZwEcD.exe
  2⤵
  PID:3588
- C:\Windows\System\mEWynZf.exe
  C:\Windows\System\mEWynZf.exe
  2⤵
  PID:3612
- C:\Windows\System\icNETZu.exe
  C:\Windows\System\icNETZu.exe
  2⤵
  PID:3632
- C:\Windows\System\zKSMNfM.exe
  C:\Windows\System\zKSMNfM.exe
  2⤵
  PID:3656
- C:\Windows\System\UhGhDfn.exe
  C:\Windows\System\UhGhDfn.exe
  2⤵
  PID:3672
- C:\Windows\System\QJlsMlP.exe
  C:\Windows\System\QJlsMlP.exe
  2⤵
  PID:3692
- C:\Windows\System\IcbCgGr.exe
  C:\Windows\System\IcbCgGr.exe
  2⤵
  PID:3712
- C:\Windows\System\pdpeaeK.exe
  C:\Windows\System\pdpeaeK.exe
  2⤵
  PID:3732
- C:\Windows\System\RqXYbKE.exe
  C:\Windows\System\RqXYbKE.exe
  2⤵
  PID:3752
- C:\Windows\System\luuBbKq.exe
  C:\Windows\System\luuBbKq.exe
  2⤵
  PID:3772
- C:\Windows\System\hmyAMbv.exe
  C:\Windows\System\hmyAMbv.exe
  2⤵
  PID:3792
- C:\Windows\System\yEsJFyC.exe
  C:\Windows\System\yEsJFyC.exe
  2⤵
  PID:3812
- C:\Windows\System\VhYPvkK.exe
  C:\Windows\System\VhYPvkK.exe
  2⤵
  PID:3832
- C:\Windows\System\dzGYIoF.exe
  C:\Windows\System\dzGYIoF.exe
  2⤵
  PID:3852
- C:\Windows\System\WPXsJno.exe
  C:\Windows\System\WPXsJno.exe
  2⤵
  PID:3868
- C:\Windows\System\jMNCQzD.exe
  C:\Windows\System\jMNCQzD.exe
  2⤵
  PID:3892
- C:\Windows\System\IGfLNRW.exe
  C:\Windows\System\IGfLNRW.exe
  2⤵
  PID:3908
- C:\Windows\System\PbXSLBh.exe
  C:\Windows\System\PbXSLBh.exe
  2⤵
  PID:3924
- C:\Windows\System\gOiDivS.exe
  C:\Windows\System\gOiDivS.exe
  2⤵
  PID:3956
- C:\Windows\System\VKGkWcY.exe
  C:\Windows\System\VKGkWcY.exe
  2⤵
  PID:3976
- C:\Windows\System\gvOWvbM.exe
  C:\Windows\System\gvOWvbM.exe
  2⤵
  PID:3992
- C:\Windows\System\OiSLJpY.exe
  C:\Windows\System\OiSLJpY.exe
  2⤵
  PID:4008
- C:\Windows\System\erfvxqD.exe
  C:\Windows\System\erfvxqD.exe
  2⤵
  PID:4028
- C:\Windows\System\vhXwUES.exe
  C:\Windows\System\vhXwUES.exe
  2⤵
  PID:4048
- C:\Windows\System\YSUFTil.exe
  C:\Windows\System\YSUFTil.exe
  2⤵
  PID:4076
- C:\Windows\System\UdugBJO.exe
  C:\Windows\System\UdugBJO.exe
  2⤵
  PID:2212
- C:\Windows\System\LjXBcZO.exe
  C:\Windows\System\LjXBcZO.exe
  2⤵
  PID:1800
- C:\Windows\System\aNbHRBW.exe
  C:\Windows\System\aNbHRBW.exe
  2⤵
  PID:2176
- C:\Windows\System\bhrdTAC.exe
  C:\Windows\System\bhrdTAC.exe
  2⤵
  PID:1632
- C:\Windows\System\aFRKcTL.exe
  C:\Windows\System\aFRKcTL.exe
  2⤵
  PID:1592
- C:\Windows\System\nbooQTp.exe
  C:\Windows\System\nbooQTp.exe
  2⤵
  PID:1768
- C:\Windows\System\PlTmuUg.exe
  C:\Windows\System\PlTmuUg.exe
  2⤵
  PID:2524
- C:\Windows\System\hsuTwQs.exe
  C:\Windows\System\hsuTwQs.exe
  2⤵
  PID:324
- C:\Windows\System\hIkTzVw.exe
  C:\Windows\System\hIkTzVw.exe
  2⤵
  PID:2880
- C:\Windows\System\HjyTYdc.exe
  C:\Windows\System\HjyTYdc.exe
  2⤵
  PID:1660
- C:\Windows\System\qsHrlzi.exe
  C:\Windows\System\qsHrlzi.exe
  2⤵
  PID:1564
- C:\Windows\System\yZTErya.exe
  C:\Windows\System\yZTErya.exe
  2⤵
  PID:832
- C:\Windows\System\wrzavjE.exe
  C:\Windows\System\wrzavjE.exe
  2⤵
  PID:2440
- C:\Windows\System\JIbNbrQ.exe
  C:\Windows\System\JIbNbrQ.exe
  2⤵
  PID:940
- C:\Windows\System\EvCofld.exe
  C:\Windows\System\EvCofld.exe
  2⤵
  PID:1648
- C:\Windows\System\PrQyzvf.exe
  C:\Windows\System\PrQyzvf.exe
  2⤵
  PID:1524
- C:\Windows\System\nwnMijK.exe
  C:\Windows\System\nwnMijK.exe
  2⤵
  PID:3088
- C:\Windows\System\PEzQRGm.exe
  C:\Windows\System\PEzQRGm.exe
  2⤵
  PID:3156
- C:\Windows\System\PkHiZNJ.exe
  C:\Windows\System\PkHiZNJ.exe
  2⤵
  PID:3200
- C:\Windows\System\VRIrZni.exe
  C:\Windows\System\VRIrZni.exe
  2⤵
  PID:2172
- C:\Windows\System\CSWGWxz.exe
  C:\Windows\System\CSWGWxz.exe
  2⤵
  PID:3104
- C:\Windows\System\VdXWYXo.exe
  C:\Windows\System\VdXWYXo.exe
  2⤵
  PID:2392
- C:\Windows\System\hdGANUj.exe
  C:\Windows\System\hdGANUj.exe
  2⤵
  PID:3264
- C:\Windows\System\xAlWmVb.exe
  C:\Windows\System\xAlWmVb.exe
  2⤵
  PID:3284
- C:\Windows\System\PPVJDQv.exe
  C:\Windows\System\PPVJDQv.exe
  2⤵
  PID:3328
- C:\Windows\System\QBRTmZp.exe
  C:\Windows\System\QBRTmZp.exe
  2⤵
  PID:3400
- C:\Windows\System\uZIhVbI.exe
  C:\Windows\System\uZIhVbI.exe
  2⤵
  PID:3408
- C:\Windows\System\YPsdFCX.exe
  C:\Windows\System\YPsdFCX.exe
  2⤵
  PID:3440
- C:\Windows\System\hVaBZjI.exe
  C:\Windows\System\hVaBZjI.exe
  2⤵
  PID:3424
- C:\Windows\System\izBcwKY.exe
  C:\Windows\System\izBcwKY.exe
  2⤵
  PID:3460
- C:\Windows\System\cRCRUoF.exe
  C:\Windows\System\cRCRUoF.exe
  2⤵
  PID:3524
- C:\Windows\System\SaeZbuc.exe
  C:\Windows\System\SaeZbuc.exe
  2⤵
  PID:3544
- C:\Windows\System\zaqrlow.exe
  C:\Windows\System\zaqrlow.exe
  2⤵
  PID:3508
- C:\Windows\System\uiiAEEu.exe
  C:\Windows\System\uiiAEEu.exe
  2⤵
  PID:3604
- C:\Windows\System\xLKswVX.exe
  C:\Windows\System\xLKswVX.exe
  2⤵
  PID:3644
- C:\Windows\System\rheStGv.exe
  C:\Windows\System\rheStGv.exe
  2⤵
  PID:3684
- C:\Windows\System\liJcBBT.exe
  C:\Windows\System\liJcBBT.exe
  2⤵
  PID:3700
- C:\Windows\System\AcUIxRy.exe
  C:\Windows\System\AcUIxRy.exe
  2⤵
  PID:3768
- C:\Windows\System\hADuTuS.exe
  C:\Windows\System\hADuTuS.exe
  2⤵
  PID:3780
- C:\Windows\System\OTXPxdF.exe
  C:\Windows\System\OTXPxdF.exe
  2⤵
  PID:3840
- C:\Windows\System\VVeNvcp.exe
  C:\Windows\System\VVeNvcp.exe
  2⤵
  PID:3884
- C:\Windows\System\tHuWuQK.exe
  C:\Windows\System\tHuWuQK.exe
  2⤵
  PID:3964
- C:\Windows\System\uisiKgn.exe
  C:\Windows\System\uisiKgn.exe
  2⤵
  PID:4004
- C:\Windows\System\RuYtkpG.exe
  C:\Windows\System\RuYtkpG.exe
  2⤵
  PID:3864
- C:\Windows\System\FXgVknA.exe
  C:\Windows\System\FXgVknA.exe
  2⤵
  PID:3936
- C:\Windows\System\FSTISBd.exe
  C:\Windows\System\FSTISBd.exe
  2⤵
  PID:4020
- C:\Windows\System\SNivwio.exe
  C:\Windows\System\SNivwio.exe
  2⤵
  PID:4064
- C:\Windows\System\DQouEXv.exe
  C:\Windows\System\DQouEXv.exe
  2⤵
  PID:1884
- C:\Windows\System\EZQsgtz.exe
  C:\Windows\System\EZQsgtz.exe
  2⤵
  PID:2260
- C:\Windows\System\wTnALYa.exe
  C:\Windows\System\wTnALYa.exe
  2⤵
  PID:4072
- C:\Windows\System\EzVCthK.exe
  C:\Windows\System\EzVCthK.exe
  2⤵
  PID:2796
- C:\Windows\System\mWYyEJa.exe
  C:\Windows\System\mWYyEJa.exe
  2⤵
  PID:1180
- C:\Windows\System\shDOLRO.exe
  C:\Windows\System\shDOLRO.exe
  2⤵
  PID:1984
- C:\Windows\System\KnmYevT.exe
  C:\Windows\System\KnmYevT.exe
  2⤵
  PID:772
- C:\Windows\System\hMRGUjO.exe
  C:\Windows\System\hMRGUjO.exe
  2⤵
  PID:568
- C:\Windows\System\svNghQV.exe
  C:\Windows\System\svNghQV.exe
  2⤵
  PID:3160
- C:\Windows\System\xDZSelw.exe
  C:\Windows\System\xDZSelw.exe
  2⤵
  PID:1868
- C:\Windows\System\XWSwqBu.exe
  C:\Windows\System\XWSwqBu.exe
  2⤵
  PID:3120
- C:\Windows\System\uYLBvta.exe
  C:\Windows\System\uYLBvta.exe
  2⤵
  PID:3100
- C:\Windows\System\iWfeVds.exe
  C:\Windows\System\iWfeVds.exe
  2⤵
  PID:3184
- C:\Windows\System\vMnxbxO.exe
  C:\Windows\System\vMnxbxO.exe
  2⤵
  PID:2792
- C:\Windows\System\dOEkllq.exe
  C:\Windows\System\dOEkllq.exe
  2⤵
  PID:2544
- C:\Windows\System\uPtuxUF.exe
  C:\Windows\System\uPtuxUF.exe
  2⤵
  PID:3364
- C:\Windows\System\UhmZfii.exe
  C:\Windows\System\UhmZfii.exe
  2⤵
  PID:3428
- C:\Windows\System\tzaUVJR.exe
  C:\Windows\System\tzaUVJR.exe
  2⤵
  PID:3388
- C:\Windows\System\MYjnekY.exe
  C:\Windows\System\MYjnekY.exe
  2⤵
  PID:3640
- C:\Windows\System\SFdMEcY.exe
  C:\Windows\System\SFdMEcY.exe
  2⤵
  PID:3492
- C:\Windows\System\iAEtDmv.exe
  C:\Windows\System\iAEtDmv.exe
  2⤵
  PID:3596
- C:\Windows\System\nQRfqjK.exe
  C:\Windows\System\nQRfqjK.exe
  2⤵
  PID:3664
- C:\Windows\System\prTyvJJ.exe
  C:\Windows\System\prTyvJJ.exe
  2⤵
  PID:3668
- C:\Windows\System\OryegbU.exe
  C:\Windows\System\OryegbU.exe
  2⤵
  PID:3708
- C:\Windows\System\kqbMHDO.exe
  C:\Windows\System\kqbMHDO.exe
  2⤵
  PID:4108
- C:\Windows\System\eQsyOHu.exe
  C:\Windows\System\eQsyOHu.exe
  2⤵
  PID:4124
- C:\Windows\System\MRjNSYd.exe
  C:\Windows\System\MRjNSYd.exe
  2⤵
  PID:4148
- C:\Windows\System\KGFGUGR.exe
  C:\Windows\System\KGFGUGR.exe
  2⤵
  PID:4164
- C:\Windows\System\LobZxCt.exe
  C:\Windows\System\LobZxCt.exe
  2⤵
  PID:4188
- C:\Windows\System\iWSoCbx.exe
  C:\Windows\System\iWSoCbx.exe
  2⤵
  PID:4204
- C:\Windows\System\ZqgGprc.exe
  C:\Windows\System\ZqgGprc.exe
  2⤵
  PID:4228
- C:\Windows\System\TOMMpFZ.exe
  C:\Windows\System\TOMMpFZ.exe
  2⤵
  PID:4244
- C:\Windows\System\Ixeschg.exe
  C:\Windows\System\Ixeschg.exe
  2⤵
  PID:4260
- C:\Windows\System\OcWszXW.exe
  C:\Windows\System\OcWszXW.exe
  2⤵
  PID:4280
- C:\Windows\System\pnvxgYZ.exe
  C:\Windows\System\pnvxgYZ.exe
  2⤵
  PID:4304
- C:\Windows\System\EjNbRdD.exe
  C:\Windows\System\EjNbRdD.exe
  2⤵
  PID:4324
- C:\Windows\System\QZzdNri.exe
  C:\Windows\System\QZzdNri.exe
  2⤵
  PID:4344
- C:\Windows\System\YUFcaDD.exe
  C:\Windows\System\YUFcaDD.exe
  2⤵
  PID:4364
- C:\Windows\System\eyVtTCX.exe
  C:\Windows\System\eyVtTCX.exe
  2⤵
  PID:4384
- C:\Windows\System\HCINBuS.exe
  C:\Windows\System\HCINBuS.exe
  2⤵
  PID:4400
- C:\Windows\System\uiHVHKu.exe
  C:\Windows\System\uiHVHKu.exe
  2⤵
  PID:4420
- C:\Windows\System\GiqkIbv.exe
  C:\Windows\System\GiqkIbv.exe
  2⤵
  PID:4436
- C:\Windows\System\ZDNDMTu.exe
  C:\Windows\System\ZDNDMTu.exe
  2⤵
  PID:4460
- C:\Windows\System\tcQIwDq.exe
  C:\Windows\System\tcQIwDq.exe
  2⤵
  PID:4476
- C:\Windows\System\FHEXAqK.exe
  C:\Windows\System\FHEXAqK.exe
  2⤵
  PID:4496
- C:\Windows\System\MIRFRlG.exe
  C:\Windows\System\MIRFRlG.exe
  2⤵
  PID:4512
- C:\Windows\System\cRIBJhS.exe
  C:\Windows\System\cRIBJhS.exe
  2⤵
  PID:4536
- C:\Windows\System\hXEenMy.exe
  C:\Windows\System\hXEenMy.exe
  2⤵
  PID:4552
- C:\Windows\System\SYderrL.exe
  C:\Windows\System\SYderrL.exe
  2⤵
  PID:4572
- C:\Windows\System\QcgBxCL.exe
  C:\Windows\System\QcgBxCL.exe
  2⤵
  PID:4596
- C:\Windows\System\nwIuPIU.exe
  C:\Windows\System\nwIuPIU.exe
  2⤵
  PID:4624
- C:\Windows\System\szCNbVL.exe
  C:\Windows\System\szCNbVL.exe
  2⤵
  PID:4648
- C:\Windows\System\UTjZgUl.exe
  C:\Windows\System\UTjZgUl.exe
  2⤵
  PID:4672
- C:\Windows\System\pwCZbyR.exe
  C:\Windows\System\pwCZbyR.exe
  2⤵
  PID:4688
- C:\Windows\System\mxTduyP.exe
  C:\Windows\System\mxTduyP.exe
  2⤵
  PID:4708
- C:\Windows\System\geJjpfd.exe
  C:\Windows\System\geJjpfd.exe
  2⤵
  PID:4724
- C:\Windows\System\TPjCSSc.exe
  C:\Windows\System\TPjCSSc.exe
  2⤵
  PID:4744
- C:\Windows\System\AMeadaR.exe
  C:\Windows\System\AMeadaR.exe
  2⤵
  PID:4768
- C:\Windows\System\UAHTjrh.exe
  C:\Windows\System\UAHTjrh.exe
  2⤵
  PID:4784
- C:\Windows\System\qVBMemL.exe
  C:\Windows\System\qVBMemL.exe
  2⤵
  PID:4808
- C:\Windows\System\dhWsamY.exe
  C:\Windows\System\dhWsamY.exe
  2⤵
  PID:4828
- C:\Windows\System\PQDVtpi.exe
  C:\Windows\System\PQDVtpi.exe
  2⤵
  PID:4852
- C:\Windows\System\XrJBQNX.exe
  C:\Windows\System\XrJBQNX.exe
  2⤵
  PID:4868
- C:\Windows\System\fKrOwxw.exe
  C:\Windows\System\fKrOwxw.exe
  2⤵
  PID:4892
- C:\Windows\System\rxYcNtT.exe
  C:\Windows\System\rxYcNtT.exe
  2⤵
  PID:4912
- C:\Windows\System\mxWJyHa.exe
  C:\Windows\System\mxWJyHa.exe
  2⤵
  PID:4932
- C:\Windows\System\aORqbok.exe
  C:\Windows\System\aORqbok.exe
  2⤵
  PID:4948
- C:\Windows\System\PJwkcxz.exe
  C:\Windows\System\PJwkcxz.exe
  2⤵
  PID:4964
- C:\Windows\System\rEbXrFU.exe
  C:\Windows\System\rEbXrFU.exe
  2⤵
  PID:4988
- C:\Windows\System\NLMguTg.exe
  C:\Windows\System\NLMguTg.exe
  2⤵
  PID:5004
- C:\Windows\System\YKnAbgi.exe
  C:\Windows\System\YKnAbgi.exe
  2⤵
  PID:5028
- C:\Windows\System\fCFlRBf.exe
  C:\Windows\System\fCFlRBf.exe
  2⤵
  PID:5048
- C:\Windows\System\mezFkHF.exe
  C:\Windows\System\mezFkHF.exe
  2⤵
  PID:5068
- C:\Windows\System\xImsCAN.exe
  C:\Windows\System\xImsCAN.exe
  2⤵
  PID:5088
- C:\Windows\System\WzXIvWN.exe
  C:\Windows\System\WzXIvWN.exe
  2⤵
  PID:5108
- C:\Windows\System\OwyfUQl.exe
  C:\Windows\System\OwyfUQl.exe
  2⤵
  PID:3904
- C:\Windows\System\vSZUdjf.exe
  C:\Windows\System\vSZUdjf.exe
  2⤵
  PID:3860
- C:\Windows\System\LBegVSV.exe
  C:\Windows\System\LBegVSV.exe
  2⤵
  PID:3828
- C:\Windows\System\tEUIGUb.exe
  C:\Windows\System\tEUIGUb.exe
  2⤵
  PID:2836
- C:\Windows\System\xboersP.exe
  C:\Windows\System\xboersP.exe
  2⤵
  PID:3944
- C:\Windows\System\KaLaaQs.exe
  C:\Windows\System\KaLaaQs.exe
  2⤵
  PID:4016
- C:\Windows\System\DKOjmBE.exe
  C:\Windows\System\DKOjmBE.exe
  2⤵
  PID:2024
- C:\Windows\System\pGXzGid.exe
  C:\Windows\System\pGXzGid.exe
  2⤵
  PID:2340
- C:\Windows\System\DMuZbDj.exe
  C:\Windows\System\DMuZbDj.exe
  2⤵
  PID:4068
- C:\Windows\System\dBpSkzP.exe
  C:\Windows\System\dBpSkzP.exe
  2⤵
  PID:2956
- C:\Windows\System\SrfIkBe.exe
  C:\Windows\System\SrfIkBe.exe
  2⤵
  PID:696
- C:\Windows\System\ISJNSMh.exe
  C:\Windows\System\ISJNSMh.exe
  2⤵
  PID:2420
- C:\Windows\System\ZSHIjqa.exe
  C:\Windows\System\ZSHIjqa.exe
  2⤵
  PID:3484
- C:\Windows\System\ZHTVOHF.exe
  C:\Windows\System\ZHTVOHF.exe
  2⤵
  PID:3648
- C:\Windows\System\LSpKWFX.exe
  C:\Windows\System\LSpKWFX.exe
  2⤵
  PID:3176
- C:\Windows\System\tMkBZay.exe
  C:\Windows\System\tMkBZay.exe
  2⤵
  PID:3444
- C:\Windows\System\PaxiSXF.exe
  C:\Windows\System\PaxiSXF.exe
  2⤵
  PID:3800
- C:\Windows\System\nzjtQtH.exe
  C:\Windows\System\nzjtQtH.exe
  2⤵
  PID:4200
- C:\Windows\System\tlXTUdn.exe
  C:\Windows\System\tlXTUdn.exe
  2⤵
  PID:3580
- C:\Windows\System\GPQASPB.exe
  C:\Windows\System\GPQASPB.exe
  2⤵
  PID:4272
- C:\Windows\System\mapOEHT.exe
  C:\Windows\System\mapOEHT.exe
  2⤵
  PID:3848
- C:\Windows\System\PFDCgHq.exe
  C:\Windows\System\PFDCgHq.exe
  2⤵
  PID:4136
- C:\Windows\System\NgTzSTZ.exe
  C:\Windows\System\NgTzSTZ.exe
  2⤵
  PID:4180
- C:\Windows\System\GOfJNOz.exe
  C:\Windows\System\GOfJNOz.exe
  2⤵
  PID:4312
- C:\Windows\System\awmhwuy.exe
  C:\Windows\System\awmhwuy.exe
  2⤵
  PID:4356
- C:\Windows\System\jOHJjDS.exe
  C:\Windows\System\jOHJjDS.exe
  2⤵
  PID:4224
- C:\Windows\System\rWLDomz.exe
  C:\Windows\System\rWLDomz.exe
  2⤵
  PID:4292
- C:\Windows\System\hHWDitr.exe
  C:\Windows\System\hHWDitr.exe
  2⤵
  PID:4428
- C:\Windows\System\dAHxUOb.exe
  C:\Windows\System\dAHxUOb.exe
  2⤵
  PID:4332
- C:\Windows\System\oCQJkEe.exe
  C:\Windows\System\oCQJkEe.exe
  2⤵
  PID:4544
- C:\Windows\System\EWpBseS.exe
  C:\Windows\System\EWpBseS.exe
  2⤵
  PID:4376
- C:\Windows\System\VieVgIe.exe
  C:\Windows\System\VieVgIe.exe
  2⤵
  PID:1404
- C:\Windows\System\lauMWgJ.exe
  C:\Windows\System\lauMWgJ.exe
  2⤵
  PID:4592
- C:\Windows\System\PHIewlw.exe
  C:\Windows\System\PHIewlw.exe
  2⤵
  PID:4564
- C:\Windows\System\gzQthph.exe
  C:\Windows\System\gzQthph.exe
  2⤵
  PID:4528
- C:\Windows\System\UrNiVhV.exe
  C:\Windows\System\UrNiVhV.exe
  2⤵
  PID:4632
- C:\Windows\System\ldTZFUu.exe
  C:\Windows\System\ldTZFUu.exe
  2⤵
  PID:4616
- C:\Windows\System\jaADyJQ.exe
  C:\Windows\System\jaADyJQ.exe
  2⤵
  PID:4716
- C:\Windows\System\GIrczjo.exe
  C:\Windows\System\GIrczjo.exe
  2⤵
  PID:4668
- C:\Windows\System\MmjzfsI.exe
  C:\Windows\System\MmjzfsI.exe
  2⤵
  PID:4764
- C:\Windows\System\opkepBw.exe
  C:\Windows\System\opkepBw.exe
  2⤵
  PID:4804
- C:\Windows\System\UWEKkUW.exe
  C:\Windows\System\UWEKkUW.exe
  2⤵
  PID:4848
- C:\Windows\System\rnuHxVf.exe
  C:\Windows\System\rnuHxVf.exe
  2⤵
  PID:4736
- C:\Windows\System\uuktjoA.exe
  C:\Windows\System\uuktjoA.exe
  2⤵
  PID:4888
- C:\Windows\System\GywPxrL.exe
  C:\Windows\System\GywPxrL.exe
  2⤵
  PID:4860
- C:\Windows\System\RdOxvMH.exe
  C:\Windows\System\RdOxvMH.exe
  2⤵
  PID:4924
- C:\Windows\System\zokRVHH.exe
  C:\Windows\System\zokRVHH.exe
  2⤵
  PID:4908
- C:\Windows\System\uNJehgP.exe
  C:\Windows\System\uNJehgP.exe
  2⤵
  PID:5036
- C:\Windows\System\wzIRuBH.exe
  C:\Windows\System\wzIRuBH.exe
  2⤵
  PID:5084
- C:\Windows\System\lFABiHV.exe
  C:\Windows\System\lFABiHV.exe
  2⤵
  PID:4000
- C:\Windows\System\fgculdI.exe
  C:\Windows\System\fgculdI.exe
  2⤵
  PID:3984
- C:\Windows\System\zUqHxeS.exe
  C:\Windows\System\zUqHxeS.exe
  2⤵
  PID:3016
- C:\Windows\System\bVZjajs.exe
  C:\Windows\System\bVZjajs.exe
  2⤵
  PID:1712
- C:\Windows\System\kpOauAf.exe
  C:\Windows\System\kpOauAf.exe
  2⤵
  PID:5064
- C:\Windows\System\lGtlBkx.exe
  C:\Windows\System\lGtlBkx.exe
  2⤵
  PID:5100
- C:\Windows\System\DKImQjp.exe
  C:\Windows\System\DKImQjp.exe
  2⤵
  PID:3276
- C:\Windows\System\UaaWMDk.exe
  C:\Windows\System\UaaWMDk.exe
  2⤵
  PID:3788
- C:\Windows\System\DcouzpJ.exe
  C:\Windows\System\DcouzpJ.exe
  2⤵
  PID:3952
- C:\Windows\System\XQXbxfv.exe
  C:\Windows\System\XQXbxfv.exe
  2⤵
  PID:3380
- C:\Windows\System\owPdkGa.exe
  C:\Windows\System\owPdkGa.exe
  2⤵
  PID:3344
- C:\Windows\System\FVaWpfU.exe
  C:\Windows\System\FVaWpfU.exe
  2⤵
  PID:3236
- C:\Windows\System\ZseLCwl.exe
  C:\Windows\System\ZseLCwl.exe
  2⤵
  PID:3560
- C:\Windows\System\KStIUNh.exe
  C:\Windows\System\KStIUNh.exe
  2⤵
  PID:4176
- C:\Windows\System\UhMRZfi.exe
  C:\Windows\System\UhMRZfi.exe
  2⤵
  PID:2804
- C:\Windows\System\DAcJMHQ.exe
  C:\Windows\System\DAcJMHQ.exe
  2⤵
  PID:3220
- C:\Windows\System\AfkACnc.exe
  C:\Windows\System\AfkACnc.exe
  2⤵
  PID:4468
- C:\Windows\System\QZLGjUA.exe
  C:\Windows\System\QZLGjUA.exe
  2⤵
  PID:4372
- C:\Windows\System\oOSROwc.exe
  C:\Windows\System\oOSROwc.exe
  2⤵
  PID:4584
- C:\Windows\System\nMfTkPo.exe
  C:\Windows\System\nMfTkPo.exe
  2⤵
  PID:4604
- C:\Windows\System\aDDbKqf.exe
  C:\Windows\System\aDDbKqf.exe
  2⤵
  PID:1184
- C:\Windows\System\MerQtsU.exe
  C:\Windows\System\MerQtsU.exe
  2⤵
  PID:4720
- C:\Windows\System\thUgPjE.exe
  C:\Windows\System\thUgPjE.exe
  2⤵
  PID:4656
- C:\Windows\System\OyaSZQC.exe
  C:\Windows\System\OyaSZQC.exe
  2⤵
  PID:4816
- C:\Windows\System\biayTTB.exe
  C:\Windows\System\biayTTB.exe
  2⤵
  PID:4524
- C:\Windows\System\fsHxFEr.exe
  C:\Windows\System\fsHxFEr.exe
  2⤵
  PID:4392
- C:\Windows\System\NUOPdZH.exe
  C:\Windows\System\NUOPdZH.exe
  2⤵
  PID:4452
- C:\Windows\System\fKcojjv.exe
  C:\Windows\System\fKcojjv.exe
  2⤵
  PID:4612
- C:\Windows\System\UbdaNIw.exe
  C:\Windows\System\UbdaNIw.exe
  2⤵
  PID:4980
- C:\Windows\System\PEvIdJf.exe
  C:\Windows\System\PEvIdJf.exe
  2⤵
  PID:5024
- C:\Windows\System\tsCSSHl.exe
  C:\Windows\System\tsCSSHl.exe
  2⤵
  PID:2824
- C:\Windows\System\xaLyAdx.exe
  C:\Windows\System\xaLyAdx.exe
  2⤵
  PID:4756
- C:\Windows\System\nIIrFjn.exe
  C:\Windows\System\nIIrFjn.exe
  2⤵
  PID:4876
- C:\Windows\System\hDAtqfW.exe
  C:\Windows\System\hDAtqfW.exe
  2⤵
  PID:4864
- C:\Windows\System\tPiCPxO.exe
  C:\Windows\System\tPiCPxO.exe
  2⤵
  PID:4944
- C:\Windows\System\YPgGUtj.exe
  C:\Windows\System\YPgGUtj.exe
  2⤵
  PID:2888
- C:\Windows\System\bVqohXl.exe
  C:\Windows\System\bVqohXl.exe
  2⤵
  PID:4088
- C:\Windows\System\LdMzCtm.exe
  C:\Windows\System\LdMzCtm.exe
  2⤵
  PID:3720
- C:\Windows\System\UqQqsTL.exe
  C:\Windows\System\UqQqsTL.exe
  2⤵
  PID:3384
- C:\Windows\System\VtFjDAV.exe
  C:\Windows\System\VtFjDAV.exe
  2⤵
  PID:2324
- C:\Windows\System\ljUvyeQ.exe
  C:\Windows\System\ljUvyeQ.exe
  2⤵
  PID:3480
- C:\Windows\System\AaHRHuI.exe
  C:\Windows\System\AaHRHuI.exe
  2⤵
  PID:4560
- C:\Windows\System\BmtelaA.exe
  C:\Windows\System\BmtelaA.exe
  2⤵
  PID:3540
- C:\Windows\System\qsurcZK.exe
  C:\Windows\System\qsurcZK.exe
  2⤵
  PID:4256
- C:\Windows\System\YifUoPr.exe
  C:\Windows\System\YifUoPr.exe
  2⤵
  PID:5132
- C:\Windows\System\iawQcbA.exe
  C:\Windows\System\iawQcbA.exe
  2⤵
  PID:5156
- C:\Windows\System\mWDeaQt.exe
  C:\Windows\System\mWDeaQt.exe
  2⤵
  PID:5172
- C:\Windows\System\bDXMwhx.exe
  C:\Windows\System\bDXMwhx.exe
  2⤵
  PID:5188
- C:\Windows\System\YBJzfLF.exe
  C:\Windows\System\YBJzfLF.exe
  2⤵
  PID:5212
- C:\Windows\System\OUpuxxl.exe
  C:\Windows\System\OUpuxxl.exe
  2⤵
  PID:5232
- C:\Windows\System\VolPtKQ.exe
  C:\Windows\System\VolPtKQ.exe
  2⤵
  PID:5256
- C:\Windows\System\ZgvKEaQ.exe
  C:\Windows\System\ZgvKEaQ.exe
  2⤵
  PID:5276
- C:\Windows\System\JOtIdMZ.exe
  C:\Windows\System\JOtIdMZ.exe
  2⤵
  PID:5292
- C:\Windows\System\KFiSHYU.exe
  C:\Windows\System\KFiSHYU.exe
  2⤵
  PID:5308
- C:\Windows\System\simOJKW.exe
  C:\Windows\System\simOJKW.exe
  2⤵
  PID:5324
- C:\Windows\System\GjsHfCG.exe
  C:\Windows\System\GjsHfCG.exe
  2⤵
  PID:5348
- C:\Windows\System\RSCJNUS.exe
  C:\Windows\System\RSCJNUS.exe
  2⤵
  PID:5368
- C:\Windows\System\GIMciUO.exe
  C:\Windows\System\GIMciUO.exe
  2⤵
  PID:5384
- C:\Windows\System\QBQGMHF.exe
  C:\Windows\System\QBQGMHF.exe
  2⤵
  PID:5408
- C:\Windows\System\cTvQOWf.exe
  C:\Windows\System\cTvQOWf.exe
  2⤵
  PID:5424
- C:\Windows\System\UPwwfky.exe
  C:\Windows\System\UPwwfky.exe
  2⤵
  PID:5448
- C:\Windows\System\dBizmvY.exe
  C:\Windows\System\dBizmvY.exe
  2⤵
  PID:5464
- C:\Windows\System\MIALhZv.exe
  C:\Windows\System\MIALhZv.exe
  2⤵
  PID:5492
- C:\Windows\System\nIurqFc.exe
  C:\Windows\System\nIurqFc.exe
  2⤵
  PID:5512
- C:\Windows\System\RmPIgXU.exe
  C:\Windows\System\RmPIgXU.exe
  2⤵
  PID:5532
- C:\Windows\System\AQDKMmz.exe
  C:\Windows\System\AQDKMmz.exe
  2⤵
  PID:5552
- C:\Windows\System\RzlZWFl.exe
  C:\Windows\System\RzlZWFl.exe
  2⤵
  PID:5572
- C:\Windows\System\XoszKIN.exe
  C:\Windows\System\XoszKIN.exe
  2⤵
  PID:5596
- C:\Windows\System\jgXUexw.exe
  C:\Windows\System\jgXUexw.exe
  2⤵
  PID:5616
- C:\Windows\System\mMMKeIx.exe
  C:\Windows\System\mMMKeIx.exe
  2⤵
  PID:5636
- C:\Windows\System\UrjssFg.exe
  C:\Windows\System\UrjssFg.exe
  2⤵
  PID:5656
- C:\Windows\System\SKqhfiy.exe
  C:\Windows\System\SKqhfiy.exe
  2⤵
  PID:5672
- C:\Windows\System\bgxsJrM.exe
  C:\Windows\System\bgxsJrM.exe
  2⤵
  PID:5692
- C:\Windows\System\HspBHIq.exe
  C:\Windows\System\HspBHIq.exe
  2⤵
  PID:5708
- C:\Windows\System\tdZyJdT.exe
  C:\Windows\System\tdZyJdT.exe
  2⤵
  PID:5724
- C:\Windows\System\OJzhGwX.exe
  C:\Windows\System\OJzhGwX.exe
  2⤵
  PID:5752
- C:\Windows\System\itJoNGy.exe
  C:\Windows\System\itJoNGy.exe
  2⤵
  PID:5768
- C:\Windows\System\umIKYOE.exe
  C:\Windows\System\umIKYOE.exe
  2⤵
  PID:5784
- C:\Windows\System\OfJgOKe.exe
  C:\Windows\System\OfJgOKe.exe
  2⤵
  PID:5800
- C:\Windows\System\KXknvLI.exe
  C:\Windows\System\KXknvLI.exe
  2⤵
  PID:5824
- C:\Windows\System\hRDXlrQ.exe
  C:\Windows\System\hRDXlrQ.exe
  2⤵
  PID:5844
- C:\Windows\System\DMUhlXw.exe
  C:\Windows\System\DMUhlXw.exe
  2⤵
  PID:5860
- C:\Windows\System\YyMOhWJ.exe
  C:\Windows\System\YyMOhWJ.exe
  2⤵
  PID:5884
- C:\Windows\System\JeDLdFQ.exe
  C:\Windows\System\JeDLdFQ.exe
  2⤵
  PID:5900
- C:\Windows\System\YzGZxOa.exe
  C:\Windows\System\YzGZxOa.exe
  2⤵
  PID:5924
- C:\Windows\System\ZfgvWaM.exe
  C:\Windows\System\ZfgvWaM.exe
  2⤵
  PID:5940
- C:\Windows\System\VNZoCHW.exe
  C:\Windows\System\VNZoCHW.exe
  2⤵
  PID:5968
- C:\Windows\System\zHMbTqi.exe
  C:\Windows\System\zHMbTqi.exe
  2⤵
  PID:5988
- C:\Windows\System\hJQYnma.exe
  C:\Windows\System\hJQYnma.exe
  2⤵
  PID:6008
- C:\Windows\System\hFLfaIJ.exe
  C:\Windows\System\hFLfaIJ.exe
  2⤵
  PID:6024
- C:\Windows\System\ztJKXOY.exe
  C:\Windows\System\ztJKXOY.exe
  2⤵
  PID:6052
- C:\Windows\System\hvWueUn.exe
  C:\Windows\System\hvWueUn.exe
  2⤵
  PID:6068
- C:\Windows\System\ByuUjOY.exe
  C:\Windows\System\ByuUjOY.exe
  2⤵
  PID:6088
- C:\Windows\System\LQpxxNa.exe
  C:\Windows\System\LQpxxNa.exe
  2⤵
  PID:6104
- C:\Windows\System\sZluZjq.exe
  C:\Windows\System\sZluZjq.exe
  2⤵
  PID:6124
- C:\Windows\System\mxwipTv.exe
  C:\Windows\System\mxwipTv.exe
  2⤵
  PID:6140
- C:\Windows\System\btGrDRd.exe
  C:\Windows\System\btGrDRd.exe
  2⤵
  PID:4776
- C:\Windows\System\YYnQfqR.exe
  C:\Windows\System\YYnQfqR.exe
  2⤵
  PID:4100
- C:\Windows\System\RizEIUk.exe
  C:\Windows\System\RizEIUk.exe
  2⤵
  PID:4504
- C:\Windows\System\ChXlzuy.exe
  C:\Windows\System\ChXlzuy.exe
  2⤵
  PID:4956
- C:\Windows\System\poEWAsA.exe
  C:\Windows\System\poEWAsA.exe
  2⤵
  PID:4488
- C:\Windows\System\QIVGoLW.exe
  C:\Windows\System\QIVGoLW.exe
  2⤵
  PID:4840
- C:\Windows\System\tomtEPS.exe
  C:\Windows\System\tomtEPS.exe
  2⤵
  PID:4928
- C:\Windows\System\WBDWWjF.exe
  C:\Windows\System\WBDWWjF.exe
  2⤵
  PID:904
- C:\Windows\System\zPRcrwt.exe
  C:\Windows\System\zPRcrwt.exe
  2⤵
  PID:3324
- C:\Windows\System\bdKzFom.exe
  C:\Windows\System\bdKzFom.exe
  2⤵
  PID:4836
- C:\Windows\System\fRTInwx.exe
  C:\Windows\System\fRTInwx.exe
  2⤵
  PID:840
- C:\Windows\System\PASzufw.exe
  C:\Windows\System\PASzufw.exe
  2⤵
  PID:1976
- C:\Windows\System\KdkTcYo.exe
  C:\Windows\System\KdkTcYo.exe
  2⤵
  PID:1192
- C:\Windows\System\UYLxLrw.exe
  C:\Windows\System\UYLxLrw.exe
  2⤵
  PID:5144
- C:\Windows\System\xEBgVDe.exe
  C:\Windows\System\xEBgVDe.exe
  2⤵
  PID:4220
- C:\Windows\System\vcrIiJh.exe
  C:\Windows\System\vcrIiJh.exe
  2⤵
  PID:5180
- C:\Windows\System\EEvjOkI.exe
  C:\Windows\System\EEvjOkI.exe
  2⤵
  PID:5224
- C:\Windows\System\GVMDgDG.exe
  C:\Windows\System\GVMDgDG.exe
  2⤵
  PID:5300
- C:\Windows\System\sozkwoc.exe
  C:\Windows\System\sozkwoc.exe
  2⤵
  PID:2148
- C:\Windows\System\xALVsAp.exe
  C:\Windows\System\xALVsAp.exe
  2⤵
  PID:5208
- C:\Windows\System\aCBtgAe.exe
  C:\Windows\System\aCBtgAe.exe
  2⤵
  PID:5248
- C:\Windows\System\viyGYzr.exe
  C:\Windows\System\viyGYzr.exe
  2⤵
  PID:5364
- C:\Windows\System\EXWndUw.exe
  C:\Windows\System\EXWndUw.exe
  2⤵
  PID:5416
- C:\Windows\System\aPAtlwo.exe
  C:\Windows\System\aPAtlwo.exe
  2⤵
  PID:5500
- C:\Windows\System\kfZOETo.exe
  C:\Windows\System\kfZOETo.exe
  2⤵
  PID:5396
- C:\Windows\System\jYsmbRK.exe
  C:\Windows\System\jYsmbRK.exe
  2⤵
  PID:5592
- C:\Windows\System\HUSPYXs.exe
  C:\Windows\System\HUSPYXs.exe
  2⤵
  PID:5668
- C:\Windows\System\qoHvJAu.exe
  C:\Windows\System\qoHvJAu.exe
  2⤵
  PID:5436
- C:\Windows\System\twYojlf.exe
  C:\Windows\System\twYojlf.exe
  2⤵
  PID:5480
- C:\Windows\System\vIcqNSE.exe
  C:\Windows\System\vIcqNSE.exe
  2⤵
  PID:5736
- C:\Windows\System\qYfOfpe.exe
  C:\Windows\System\qYfOfpe.exe
  2⤵
  PID:5808
- C:\Windows\System\kIOpeXu.exe
  C:\Windows\System\kIOpeXu.exe
  2⤵
  PID:5528
- C:\Windows\System\pgvVHSa.exe
  C:\Windows\System\pgvVHSa.exe
  2⤵
  PID:5892
- C:\Windows\System\LGBzXoD.exe
  C:\Windows\System\LGBzXoD.exe
  2⤵
  PID:5560
- C:\Windows\System\MavHCQp.exe
  C:\Windows\System\MavHCQp.exe
  2⤵
  PID:1856
- C:\Windows\System\HJjYfpq.exe
  C:\Windows\System\HJjYfpq.exe
  2⤵
  PID:5976
- C:\Windows\System\wTiWxee.exe
  C:\Windows\System\wTiWxee.exe
  2⤵
  PID:5716
- C:\Windows\System\AnAyprh.exe
  C:\Windows\System\AnAyprh.exe
  2⤵
  PID:5840
- C:\Windows\System\tdnVxvD.exe
  C:\Windows\System\tdnVxvD.exe
  2⤵
  PID:6064
- C:\Windows\System\CqtfJNA.exe
  C:\Windows\System\CqtfJNA.exe
  2⤵
  PID:4620
- C:\Windows\System\TyKYtFK.exe
  C:\Windows\System\TyKYtFK.exe
  2⤵
  PID:5916
- C:\Windows\System\ALNgxaq.exe
  C:\Windows\System\ALNgxaq.exe
  2⤵
  PID:5908
- C:\Windows\System\zCHCZxR.exe
  C:\Windows\System\zCHCZxR.exe
  2⤵
  PID:5956
- C:\Windows\System\XONiQMQ.exe
  C:\Windows\System\XONiQMQ.exe
  2⤵
  PID:5920
- C:\Windows\System\JCSuSZA.exe
  C:\Windows\System\JCSuSZA.exe
  2⤵
  PID:6032
- C:\Windows\System\dKwmlCW.exe
  C:\Windows\System\dKwmlCW.exe
  2⤵
  PID:6048
- C:\Windows\System\vcwWYRF.exe
  C:\Windows\System\vcwWYRF.exe
  2⤵
  PID:1260
- C:\Windows\System\PhkpflF.exe
  C:\Windows\System\PhkpflF.exe
  2⤵
  PID:316
- C:\Windows\System\JZzbKRm.exe
  C:\Windows\System\JZzbKRm.exe
  2⤵
  PID:4740
- C:\Windows\System\zKHcmTJ.exe
  C:\Windows\System\zKHcmTJ.exe
  2⤵
  PID:2432
- C:\Windows\System\JGTvVdU.exe
  C:\Windows\System\JGTvVdU.exe
  2⤵
  PID:1196
- C:\Windows\System\ipLtlyK.exe
  C:\Windows\System\ipLtlyK.exe
  2⤵
  PID:5140
- C:\Windows\System\vajePfZ.exe
  C:\Windows\System\vajePfZ.exe
  2⤵
  PID:4588
- C:\Windows\System\xyOEMDK.exe
  C:\Windows\System\xyOEMDK.exe
  2⤵
  PID:3820
- C:\Windows\System\NfMiuGz.exe
  C:\Windows\System\NfMiuGz.exe
  2⤵
  PID:3972
- C:\Windows\System\mYlYNdn.exe
  C:\Windows\System\mYlYNdn.exe
  2⤵
  PID:4960
- C:\Windows\System\PNbgdNS.exe
  C:\Windows\System\PNbgdNS.exe
  2⤵
  PID:4276
- C:\Windows\System\hdFoTlD.exe
  C:\Windows\System\hdFoTlD.exe
  2⤵
  PID:2708
- C:\Windows\System\HlbNppz.exe
  C:\Windows\System\HlbNppz.exe
  2⤵
  PID:1612
- C:\Windows\System\TyUjdvd.exe
  C:\Windows\System\TyUjdvd.exe
  2⤵
  PID:4216
- C:\Windows\System\jsWpkhF.exe
  C:\Windows\System\jsWpkhF.exe
  2⤵
  PID:5340
- C:\Windows\System\vpUbCkr.exe
  C:\Windows\System\vpUbCkr.exe
  2⤵
  PID:5228
- C:\Windows\System\MLVouSr.exe
  C:\Windows\System\MLVouSr.exe
  2⤵
  PID:5344
- C:\Windows\System\vzEGXDd.exe
  C:\Windows\System\vzEGXDd.exe
  2⤵
  PID:2228
- C:\Windows\System\qkYJPli.exe
  C:\Windows\System\qkYJPli.exe
  2⤵
  PID:5240
- C:\Windows\System\DwEDYbV.exe
  C:\Windows\System\DwEDYbV.exe
  2⤵
  PID:5400
- C:\Windows\System\HkLmsEq.exe
  C:\Windows\System\HkLmsEq.exe
  2⤵
  PID:5380
- C:\Windows\System\TwuFuuo.exe
  C:\Windows\System\TwuFuuo.exe
  2⤵
  PID:5704
- C:\Windows\System\VptxELA.exe
  C:\Windows\System\VptxELA.exe
  2⤵
  PID:5544
- C:\Windows\System\pkYasQx.exe
  C:\Windows\System\pkYasQx.exe
  2⤵
  PID:2584
- C:\Windows\System\ZLgHGav.exe
  C:\Windows\System\ZLgHGav.exe
  2⤵
  PID:6136
- C:\Windows\System\lgvcwUa.exe
  C:\Windows\System\lgvcwUa.exe
  2⤵
  PID:2612
- C:\Windows\System\YDjjFFM.exe
  C:\Windows\System\YDjjFFM.exe
  2⤵
  PID:5964
- C:\Windows\System\nYoKvCg.exe
  C:\Windows\System\nYoKvCg.exe
  2⤵
  PID:4760
- C:\Windows\System\KbsHRfO.exe
  C:\Windows\System\KbsHRfO.exe
  2⤵
  PID:5748
- C:\Windows\System\UmyBdNp.exe
  C:\Windows\System\UmyBdNp.exe
  2⤵
  PID:4940
- C:\Windows\System\OLFrACd.exe
  C:\Windows\System\OLFrACd.exe
  2⤵
  PID:2600
- C:\Windows\System\ecHsPLD.exe
  C:\Windows\System\ecHsPLD.exe
  2⤵
  PID:2776
- C:\Windows\System\EyopiJO.exe
  C:\Windows\System\EyopiJO.exe
  2⤵
  PID:5612
- C:\Windows\System\IoaUTte.exe
  C:\Windows\System\IoaUTte.exe
  2⤵
  PID:6020
- C:\Windows\System\EsZRYIa.exe
  C:\Windows\System\EsZRYIa.exe
  2⤵
  PID:6016
- C:\Windows\System\fBnUDOj.exe
  C:\Windows\System\fBnUDOj.exe
  2⤵
  PID:5012
- C:\Windows\System\gfIJbQw.exe
  C:\Windows\System\gfIJbQw.exe
  2⤵
  PID:1508
- C:\Windows\System\sKwODYM.exe
  C:\Windows\System\sKwODYM.exe
  2⤵
  PID:2932
- C:\Windows\System\wtvPSao.exe
  C:\Windows\System\wtvPSao.exe
  2⤵
  PID:2924
- C:\Windows\System\DVqtzyt.exe
  C:\Windows\System\DVqtzyt.exe
  2⤵
  PID:5952
- C:\Windows\System\AVqSmxs.exe
  C:\Windows\System\AVqSmxs.exe
  2⤵
  PID:2292
- C:\Windows\System\DjueuYL.exe
  C:\Windows\System\DjueuYL.exe
  2⤵
  PID:2200
- C:\Windows\System\wWUBFEh.exe
  C:\Windows\System\wWUBFEh.exe
  2⤵
  PID:1428
- C:\Windows\System\iTQDnuy.exe
  C:\Windows\System\iTQDnuy.exe
  2⤵
  PID:5128
- C:\Windows\System\UFwYskL.exe
  C:\Windows\System\UFwYskL.exe
  2⤵
  PID:1432
- C:\Windows\System\ozkFCOQ.exe
  C:\Windows\System\ozkFCOQ.exe
  2⤵
  PID:4092
- C:\Windows\System\oLLEnfA.exe
  C:\Windows\System\oLLEnfA.exe
  2⤵
  PID:2960
- C:\Windows\System\wvssNln.exe
  C:\Windows\System\wvssNln.exe
  2⤵
  PID:5288
- C:\Windows\System\XIbzuwg.exe
  C:\Windows\System\XIbzuwg.exe
  2⤵
  PID:5540
- C:\Windows\System\nomvhZE.exe
  C:\Windows\System\nomvhZE.exe
  2⤵
  PID:2820
- C:\Windows\System\EwbEYAy.exe
  C:\Windows\System\EwbEYAy.exe
  2⤵
  PID:2608
- C:\Windows\System\ggGMCPb.exe
  C:\Windows\System\ggGMCPb.exe
  2⤵
  PID:5628
- C:\Windows\System\JkUtqNu.exe
  C:\Windows\System\JkUtqNu.exe
  2⤵
  PID:5744
- C:\Windows\System\iLrcBUJ.exe
  C:\Windows\System\iLrcBUJ.exe
  2⤵
  PID:5760
- C:\Windows\System\SgohkBg.exe
  C:\Windows\System\SgohkBg.exe
  2⤵
  PID:5520
- C:\Windows\System\pTRDNWD.exe
  C:\Windows\System\pTRDNWD.exe
  2⤵
  PID:5604
- C:\Windows\System\NAATkXv.exe
  C:\Windows\System\NAATkXv.exe
  2⤵
  PID:2644
- C:\Windows\System\McjNEeL.exe
  C:\Windows\System\McjNEeL.exe
  2⤵
  PID:4976
- C:\Windows\System\OFFxWJT.exe
  C:\Windows\System\OFFxWJT.exe
  2⤵
  PID:2900
- C:\Windows\System\PNQGidf.exe
  C:\Windows\System\PNQGidf.exe
  2⤵
  PID:6040
- C:\Windows\System\EJvnkvr.exe
  C:\Windows\System\EJvnkvr.exe
  2⤵
  PID:5780
- C:\Windows\System\jMcVELg.exe
  C:\Windows\System\jMcVELg.exe
  2⤵
  PID:2632
- C:\Windows\System\BthTAZG.exe
  C:\Windows\System\BthTAZG.exe
  2⤵
  PID:2472
- C:\Windows\System\BgQosxi.exe
  C:\Windows\System\BgQosxi.exe
  2⤵
  PID:2032
- C:\Windows\System\FNPxvfi.exe
  C:\Windows\System\FNPxvfi.exe
  2⤵
  PID:5016
- C:\Windows\System\lLBziQW.exe
  C:\Windows\System\lLBziQW.exe
  2⤵
  PID:2840
- C:\Windows\System\xeUyMHw.exe
  C:\Windows\System\xeUyMHw.exe
  2⤵
  PID:2712
- C:\Windows\System\awsvHgy.exe
  C:\Windows\System\awsvHgy.exe
  2⤵
  PID:5444
- C:\Windows\System\douxURy.exe
  C:\Windows\System\douxURy.exe
  2⤵
  PID:5548
- C:\Windows\System\rdNFGaP.exe
  C:\Windows\System\rdNFGaP.exe
  2⤵
  PID:5948
- C:\Windows\System\glKHZlG.exe
  C:\Windows\System\glKHZlG.exe
  2⤵
  PID:2540
- C:\Windows\System\VtxLfAD.exe
  C:\Windows\System\VtxLfAD.exe
  2⤵
  PID:2508
- C:\Windows\System\IZWOYhG.exe
  C:\Windows\System\IZWOYhG.exe
  2⤵
  PID:2784
- C:\Windows\System\OvAOypk.exe
  C:\Windows\System\OvAOypk.exe
  2⤵
  PID:6152
- C:\Windows\System\QiGDxWU.exe
  C:\Windows\System\QiGDxWU.exe
  2⤵
  PID:6168
- C:\Windows\System\HUVuIkd.exe
  C:\Windows\System\HUVuIkd.exe
  2⤵
  PID:6184
- C:\Windows\System\xpcQLtK.exe
  C:\Windows\System\xpcQLtK.exe
  2⤵
  PID:6200
- C:\Windows\System\cdPOTaW.exe
  C:\Windows\System\cdPOTaW.exe
  2⤵
  PID:6216
- C:\Windows\System\mmkXeGy.exe
  C:\Windows\System\mmkXeGy.exe
  2⤵
  PID:6232
- C:\Windows\System\WvQwtVP.exe
  C:\Windows\System\WvQwtVP.exe
  2⤵
  PID:6248
- C:\Windows\System\fzpNgFW.exe
  C:\Windows\System\fzpNgFW.exe
  2⤵
  PID:6264
- C:\Windows\System\zIXaPMH.exe
  C:\Windows\System\zIXaPMH.exe
  2⤵
  PID:6280
- C:\Windows\System\BMyBBti.exe
  C:\Windows\System\BMyBBti.exe
  2⤵
  PID:6296
- C:\Windows\System\xDYCFod.exe
  C:\Windows\System\xDYCFod.exe
  2⤵
  PID:6316
- C:\Windows\System\fSRoQVN.exe
  C:\Windows\System\fSRoQVN.exe
  2⤵
  PID:6356
- C:\Windows\System\kRboQJd.exe
  C:\Windows\System\kRboQJd.exe
  2⤵
  PID:6376
- C:\Windows\System\SPQrvat.exe
  C:\Windows\System\SPQrvat.exe
  2⤵
  PID:6412
- C:\Windows\System\GlXJZoS.exe
  C:\Windows\System\GlXJZoS.exe
  2⤵
  PID:6440
- C:\Windows\System\FXDbZYf.exe
  C:\Windows\System\FXDbZYf.exe
  2⤵
  PID:6460
- C:\Windows\System\GuqbTlL.exe
  C:\Windows\System\GuqbTlL.exe
  2⤵
  PID:6484
- C:\Windows\System\ZwanxJS.exe
  C:\Windows\System\ZwanxJS.exe
  2⤵
  PID:6504
- C:\Windows\System\NCAhMmb.exe
  C:\Windows\System\NCAhMmb.exe
  2⤵
  PID:6528
- C:\Windows\System\rgfKLXt.exe
  C:\Windows\System\rgfKLXt.exe
  2⤵
  PID:6544
- C:\Windows\System\EtnVWaF.exe
  C:\Windows\System\EtnVWaF.exe
  2⤵
  PID:6572
- C:\Windows\System\bwLvLQI.exe
  C:\Windows\System\bwLvLQI.exe
  2⤵
  PID:6588
- C:\Windows\System\HgstUds.exe
  C:\Windows\System\HgstUds.exe
  2⤵
  PID:6604
- C:\Windows\System\TePYgiY.exe
  C:\Windows\System\TePYgiY.exe
  2⤵
  PID:6624
- C:\Windows\System\bWDoLmU.exe
  C:\Windows\System\bWDoLmU.exe
  2⤵
  PID:6640
- C:\Windows\System\cRQgTjD.exe
  C:\Windows\System\cRQgTjD.exe
  2⤵
  PID:6660
- C:\Windows\System\SzfdZCA.exe
  C:\Windows\System\SzfdZCA.exe
  2⤵
  PID:6676
- C:\Windows\System\rhcOeka.exe
  C:\Windows\System\rhcOeka.exe
  2⤵
  PID:6696
- C:\Windows\System\rVBRnAW.exe
  C:\Windows\System\rVBRnAW.exe
  2⤵
  PID:6712
- C:\Windows\System\PyIokMb.exe
  C:\Windows\System\PyIokMb.exe
  2⤵
  PID:6728
- C:\Windows\System\rGftwgx.exe
  C:\Windows\System\rGftwgx.exe
  2⤵
  PID:6748
- C:\Windows\System\vUHrphH.exe
  C:\Windows\System\vUHrphH.exe
  2⤵
  PID:6764
- C:\Windows\System\KSfnzxS.exe
  C:\Windows\System\KSfnzxS.exe
  2⤵
  PID:6784
- C:\Windows\System\zFHysdB.exe
  C:\Windows\System\zFHysdB.exe
  2⤵
  PID:6800
- C:\Windows\System\eiupoVP.exe
  C:\Windows\System\eiupoVP.exe
  2⤵
  PID:6820
- C:\Windows\System\eysFHaG.exe
  C:\Windows\System\eysFHaG.exe
  2⤵
  PID:6844
- C:\Windows\System\lsJRcaY.exe
  C:\Windows\System\lsJRcaY.exe
  2⤵
  PID:6860
- C:\Windows\System\BapHyuR.exe
  C:\Windows\System\BapHyuR.exe
  2⤵
  PID:6880
- C:\Windows\System\REIUrOM.exe
  C:\Windows\System\REIUrOM.exe
  2⤵
  PID:6900
- C:\Windows\System\EqXWPKg.exe
  C:\Windows\System\EqXWPKg.exe
  2⤵
  PID:6920
- C:\Windows\System\nevyzVC.exe
  C:\Windows\System\nevyzVC.exe
  2⤵
  PID:6940
- C:\Windows\System\iMlROxq.exe
  C:\Windows\System\iMlROxq.exe
  2⤵
  PID:6960
- C:\Windows\System\mQOhkTA.exe
  C:\Windows\System\mQOhkTA.exe
  2⤵
  PID:6976
- C:\Windows\System\YJskeCv.exe
  C:\Windows\System\YJskeCv.exe
  2⤵
  PID:7000
- C:\Windows\System\dWAKmDn.exe
  C:\Windows\System\dWAKmDn.exe
  2⤵
  PID:7036
- C:\Windows\System\OJNvflv.exe
  C:\Windows\System\OJNvflv.exe
  2⤵
  PID:7052
- C:\Windows\System\GpaLrjQ.exe
  C:\Windows\System\GpaLrjQ.exe
  2⤵
  PID:7068
- C:\Windows\System\pJxYgjm.exe
  C:\Windows\System\pJxYgjm.exe
  2⤵
  PID:7092
- C:\Windows\System\TSHgFsW.exe
  C:\Windows\System\TSHgFsW.exe
  2⤵
  PID:7108
- C:\Windows\System\RRTJFhW.exe
  C:\Windows\System\RRTJFhW.exe
  2⤵
  PID:7124
- C:\Windows\System\UGhpfNQ.exe
  C:\Windows\System\UGhpfNQ.exe
  2⤵
  PID:7140
- C:\Windows\System\eUNMoap.exe
  C:\Windows\System\eUNMoap.exe
  2⤵
  PID:7160
- C:\Windows\System\vbISChL.exe
  C:\Windows\System\vbISChL.exe
  2⤵
  PID:2672
- C:\Windows\System\nwDBJec.exe
  C:\Windows\System\nwDBJec.exe
  2⤵
  PID:6060
- C:\Windows\System\wDZkIoJ.exe
  C:\Windows\System\wDZkIoJ.exe
  2⤵
  PID:2716
- C:\Windows\System\RzmDNkm.exe
  C:\Windows\System\RzmDNkm.exe
  2⤵
  PID:6180
- C:\Windows\System\snOhkIE.exe
  C:\Windows\System\snOhkIE.exe
  2⤵
  PID:6244
- C:\Windows\System\VTFXwkf.exe
  C:\Windows\System\VTFXwkf.exe
  2⤵
  PID:6368
- C:\Windows\System\FMQCzrQ.exe
  C:\Windows\System\FMQCzrQ.exe
  2⤵
  PID:6424
- C:\Windows\System\qSHuWKC.exe
  C:\Windows\System\qSHuWKC.exe
  2⤵
  PID:6816
- C:\Windows\System\oiGcZma.exe
  C:\Windows\System\oiGcZma.exe
  2⤵
  PID:6812
- C:\Windows\System\CipdjcD.exe
  C:\Windows\System\CipdjcD.exe
  2⤵
  PID:6892
- C:\Windows\System\BOplFHW.exe
  C:\Windows\System\BOplFHW.exe
  2⤵
  PID:6968
- C:\Windows\System\TZOpIao.exe
  C:\Windows\System\TZOpIao.exe
  2⤵
  PID:7008
- C:\Windows\System\XtKLLua.exe
  C:\Windows\System\XtKLLua.exe
  2⤵
  PID:7020
- C:\Windows\System\kwLTiWR.exe
  C:\Windows\System\kwLTiWR.exe
  2⤵
  PID:7028
- C:\Windows\System\OiJUsXd.exe
  C:\Windows\System\OiJUsXd.exe
  2⤵
  PID:7064
- C:\Windows\System\sfjfANe.exe
  C:\Windows\System\sfjfANe.exe
  2⤵
  PID:5868
- C:\Windows\System\NKiiyAi.exe
  C:\Windows\System\NKiiyAi.exe
  2⤵
  PID:2864
- C:\Windows\System\AGlZDjk.exe
  C:\Windows\System\AGlZDjk.exe
  2⤵
  PID:6404
- C:\Windows\System\NCIXuOd.exe
  C:\Windows\System\NCIXuOd.exe
  2⤵
  PID:6536
- C:\Windows\System\BvOjbLr.exe
  C:\Windows\System\BvOjbLr.exe
  2⤵
  PID:6760
- C:\Windows\System\IQoCsmu.exe
  C:\Windows\System\IQoCsmu.exe
  2⤵
  PID:5304
- C:\Windows\System\cliUETd.exe
  C:\Windows\System\cliUETd.exe
  2⤵
  PID:2468
- C:\Windows\System\UhHNtrW.exe
  C:\Windows\System\UhHNtrW.exe
  2⤵
  PID:5776
- C:\Windows\System\Aapffwl.exe
  C:\Windows\System\Aapffwl.exe
  2⤵
  PID:7120
- C:\Windows\System\tecRTPA.exe
  C:\Windows\System\tecRTPA.exe
  2⤵
  PID:6100
- C:\Windows\System\ljmWOOq.exe
  C:\Windows\System\ljmWOOq.exe
  2⤵
  PID:3920
- C:\Windows\System\DPmukze.exe
  C:\Windows\System\DPmukze.exe
  2⤵
  PID:5852
- C:\Windows\System\hIPwSNO.exe
  C:\Windows\System\hIPwSNO.exe
  2⤵
  PID:2928
- C:\Windows\System\UoslUzR.exe
  C:\Windows\System\UoslUzR.exe
  2⤵
  PID:6612
- C:\Windows\System\qeVWPQi.exe
  C:\Windows\System\qeVWPQi.exe
  2⤵
  PID:5584
- C:\Windows\System\wfzEJOa.exe
  C:\Windows\System\wfzEJOa.exe
  2⤵
  PID:6832
- C:\Windows\System\KtdWYUA.exe
  C:\Windows\System\KtdWYUA.exe
  2⤵
  PID:6984
- C:\Windows\System\sRZnUhb.exe
  C:\Windows\System\sRZnUhb.exe
  2⤵
  PID:1992
- C:\Windows\System\KRBbqwP.exe
  C:\Windows\System\KRBbqwP.exe
  2⤵
  PID:6192
- C:\Windows\System\DdJJTjM.exe
  C:\Windows\System\DdJJTjM.exe
  2⤵
  PID:7152
- C:\Windows\System\qDngYTm.exe
  C:\Windows\System\qDngYTm.exe
  2⤵
  PID:6428
- C:\Windows\System\gUWNYYy.exe
  C:\Windows\System\gUWNYYy.exe
  2⤵
  PID:6776
- C:\Windows\System\HgHOMGy.exe
  C:\Windows\System\HgHOMGy.exe
  2⤵
  PID:6384
- C:\Windows\System\bVnirzb.exe
  C:\Windows\System\bVnirzb.exe
  2⤵
  PID:6400
- C:\Windows\System\CXuUsyf.exe
  C:\Windows\System\CXuUsyf.exe
  2⤵
  PID:6496
- C:\Windows\System\WFLOAnn.exe
  C:\Windows\System\WFLOAnn.exe
  2⤵
  PID:6616
- C:\Windows\System\UHAOiMC.exe
  C:\Windows\System\UHAOiMC.exe
  2⤵
  PID:6756
- C:\Windows\System\WLNDqNj.exe
  C:\Windows\System\WLNDqNj.exe
  2⤵
  PID:6876
- C:\Windows\System\VIJflEA.exe
  C:\Windows\System\VIJflEA.exe
  2⤵
  PID:6936
- C:\Windows\System\ikaVwrO.exe
  C:\Windows\System\ikaVwrO.exe
  2⤵
  PID:572
- C:\Windows\System\JWsqIFv.exe
  C:\Windows\System\JWsqIFv.exe
  2⤵
  PID:7076
- C:\Windows\System\QMqvgJh.exe
  C:\Windows\System\QMqvgJh.exe
  2⤵
  PID:6708
- C:\Windows\System\fKmuaSO.exe
  C:\Windows\System\fKmuaSO.exe
  2⤵
  PID:5196
- C:\Windows\System\iFvHIGb.exe
  C:\Windows\System\iFvHIGb.exe
  2⤵
  PID:6312
- C:\Windows\System\LxVndmL.exe
  C:\Windows\System\LxVndmL.exe
  2⤵
  PID:6952
- C:\Windows\System\CJEuzDz.exe
  C:\Windows\System\CJEuzDz.exe
  2⤵
  PID:5652
- C:\Windows\System\MKoztXL.exe
  C:\Windows\System\MKoztXL.exe
  2⤵
  PID:2772
- C:\Windows\System\xcIgtZi.exe
  C:\Windows\System\xcIgtZi.exe
  2⤵
  PID:2908
- C:\Windows\System\ReuJWJr.exe
  C:\Windows\System\ReuJWJr.exe
  2⤵
  PID:6780
- C:\Windows\System\qUQqzVJ.exe
  C:\Windows\System\qUQqzVJ.exe
  2⤵
  PID:6396
- C:\Windows\System\UZOGBhJ.exe
  C:\Windows\System\UZOGBhJ.exe
  2⤵
  PID:6480
- C:\Windows\System\jyxhwhH.exe
  C:\Windows\System\jyxhwhH.exe
  2⤵
  PID:6840
- C:\Windows\System\sAkOWeW.exe
  C:\Windows\System\sAkOWeW.exe
  2⤵
  PID:7060
- C:\Windows\System\yPkFzUX.exe
  C:\Windows\System\yPkFzUX.exe
  2⤵
  PID:5836
- C:\Windows\System\ZefXSmM.exe
  C:\Windows\System\ZefXSmM.exe
  2⤵
  PID:6796
- C:\Windows\System\sPSXPXz.exe
  C:\Windows\System\sPSXPXz.exe
  2⤵
  PID:6432
- C:\Windows\System\zCLLCoA.exe
  C:\Windows\System\zCLLCoA.exe
  2⤵
  PID:1716
- C:\Windows\System\SXmUoeC.exe
  C:\Windows\System\SXmUoeC.exe
  2⤵
  PID:6600
- C:\Windows\System\FGeSfxM.exe
  C:\Windows\System\FGeSfxM.exe
  2⤵
  PID:7184
- C:\Windows\System\jcExFuh.exe
  C:\Windows\System\jcExFuh.exe
  2⤵
  PID:7204
- C:\Windows\System\PeQLyxE.exe
  C:\Windows\System\PeQLyxE.exe
  2⤵
  PID:7220
- C:\Windows\System\eXHzupi.exe
  C:\Windows\System\eXHzupi.exe
  2⤵
  PID:7240
- C:\Windows\System\yiynHso.exe
  C:\Windows\System\yiynHso.exe
  2⤵
  PID:7260
- C:\Windows\System\uDBACZP.exe
  C:\Windows\System\uDBACZP.exe
  2⤵
  PID:7284
- C:\Windows\System\IWrSFEi.exe
  C:\Windows\System\IWrSFEi.exe
  2⤵
  PID:7300
- C:\Windows\System\LQvZTuP.exe
  C:\Windows\System\LQvZTuP.exe
  2⤵
  PID:7316
- C:\Windows\System\cjXTUwO.exe
  C:\Windows\System\cjXTUwO.exe
  2⤵
  PID:7336
- C:\Windows\System\AoxolwY.exe
  C:\Windows\System\AoxolwY.exe
  2⤵
  PID:7352
- C:\Windows\System\mParAUh.exe
  C:\Windows\System\mParAUh.exe
  2⤵
  PID:7368
- C:\Windows\System\EkxcAlQ.exe
  C:\Windows\System\EkxcAlQ.exe
  2⤵
  PID:7384
- C:\Windows\System\iCWhdbt.exe
  C:\Windows\System\iCWhdbt.exe
  2⤵
  PID:7408
- C:\Windows\System\HvGNDFg.exe
  C:\Windows\System\HvGNDFg.exe
  2⤵
  PID:7428
- C:\Windows\System\FjTehSg.exe
  C:\Windows\System\FjTehSg.exe
  2⤵
  PID:7444
- C:\Windows\System\XHyOvjN.exe
  C:\Windows\System\XHyOvjN.exe
  2⤵
  PID:7460
- C:\Windows\System\ZpBepoC.exe
  C:\Windows\System\ZpBepoC.exe
  2⤵
  PID:7480
- C:\Windows\System\agPlzCE.exe
  C:\Windows\System\agPlzCE.exe
  2⤵
  PID:7500
- C:\Windows\System\vGZPPuv.exe
  C:\Windows\System\vGZPPuv.exe
  2⤵
  PID:7520
- C:\Windows\System\XiFIprK.exe
  C:\Windows\System\XiFIprK.exe
  2⤵
  PID:7536
- C:\Windows\System\Adjfkvf.exe
  C:\Windows\System\Adjfkvf.exe
  2⤵
  PID:7552
- C:\Windows\System\LrffECS.exe
  C:\Windows\System\LrffECS.exe
  2⤵
  PID:7572
- C:\Windows\System\KPmchhm.exe
  C:\Windows\System\KPmchhm.exe
  2⤵
  PID:7592
- C:\Windows\System\luVMhDw.exe
  C:\Windows\System\luVMhDw.exe
  2⤵
  PID:7608
- C:\Windows\System\jehVCHh.exe
  C:\Windows\System\jehVCHh.exe
  2⤵
  PID:7624
- C:\Windows\System\tddUccZ.exe
  C:\Windows\System\tddUccZ.exe
  2⤵
  PID:7640
- C:\Windows\System\xGLwgEw.exe
  C:\Windows\System\xGLwgEw.exe
  2⤵
  PID:7656
- C:\Windows\System\feylkKV.exe
  C:\Windows\System\feylkKV.exe
  2⤵
  PID:7672
- C:\Windows\System\hWnUpGH.exe
  C:\Windows\System\hWnUpGH.exe
  2⤵
  PID:7688
- C:\Windows\System\HQUQVTL.exe
  C:\Windows\System\HQUQVTL.exe
  2⤵
  PID:7704
- C:\Windows\System\aqNzCze.exe
  C:\Windows\System\aqNzCze.exe
  2⤵
  PID:7724
- C:\Windows\System\SvVzZgy.exe
  C:\Windows\System\SvVzZgy.exe
  2⤵
  PID:7744
- C:\Windows\System\aglFsGL.exe
  C:\Windows\System\aglFsGL.exe
  2⤵
  PID:7764
- C:\Windows\System\XODMdQQ.exe
  C:\Windows\System\XODMdQQ.exe
  2⤵
  PID:7784
- C:\Windows\System\uclHgBb.exe
  C:\Windows\System\uclHgBb.exe
  2⤵
  PID:7804
- C:\Windows\System\YozuQET.exe
  C:\Windows\System\YozuQET.exe
  2⤵
  PID:7824
- C:\Windows\System\QhsnGuV.exe
  C:\Windows\System\QhsnGuV.exe
  2⤵
  PID:7848
- C:\Windows\System\uBRZAgl.exe
  C:\Windows\System\uBRZAgl.exe
  2⤵
  PID:7864
- C:\Windows\System\CjPimTM.exe
  C:\Windows\System\CjPimTM.exe
  2⤵
  PID:7884
- C:\Windows\System\VbJzBha.exe
  C:\Windows\System\VbJzBha.exe
  2⤵
  PID:7904
- C:\Windows\System\wPLpOge.exe
  C:\Windows\System\wPLpOge.exe
  2⤵
  PID:7924
- C:\Windows\System\AtGSbZW.exe
  C:\Windows\System\AtGSbZW.exe
  2⤵
  PID:7940
- C:\Windows\System\jXqIfBW.exe
  C:\Windows\System\jXqIfBW.exe
  2⤵
  PID:7956
- C:\Windows\System\BVrUeBN.exe
  C:\Windows\System\BVrUeBN.exe
  2⤵
  PID:7976
- C:\Windows\System\sSjYzqU.exe
  C:\Windows\System\sSjYzqU.exe
  2⤵
  PID:7996
- C:\Windows\System\wWgjoxT.exe
  C:\Windows\System\wWgjoxT.exe
  2⤵
  PID:8016
- C:\Windows\System\HchXudc.exe
  C:\Windows\System\HchXudc.exe
  2⤵
  PID:8036
- C:\Windows\System\cYFFbGT.exe
  C:\Windows\System\cYFFbGT.exe
  2⤵
  PID:8052
- C:\Windows\System\gKHTNeX.exe
  C:\Windows\System\gKHTNeX.exe
  2⤵
  PID:8068
- C:\Windows\System\qHybSEs.exe
  C:\Windows\System\qHybSEs.exe
  2⤵
  PID:8092
- C:\Windows\System\bGQfPbu.exe
  C:\Windows\System\bGQfPbu.exe
  2⤵
  PID:8108
- C:\Windows\System\egxmwGi.exe
  C:\Windows\System\egxmwGi.exe
  2⤵
  PID:8124
- C:\Windows\System\seCjFLU.exe
  C:\Windows\System\seCjFLU.exe
  2⤵
  PID:8144
- C:\Windows\System\pFfLDfe.exe
  C:\Windows\System\pFfLDfe.exe
  2⤵
  PID:8160
- C:\Windows\System\zdMeMgs.exe
  C:\Windows\System\zdMeMgs.exe
  2⤵
  PID:8180
- C:\Windows\System\MHtvELr.exe
  C:\Windows\System\MHtvELr.exe
  2⤵
  PID:7192
- C:\Windows\System\GJmpAxI.exe
  C:\Windows\System\GJmpAxI.exe
  2⤵
  PID:7232
- C:\Windows\System\RTjXfdS.exe
  C:\Windows\System\RTjXfdS.exe
  2⤵
  PID:7276
- C:\Windows\System\HvSRsEi.exe
  C:\Windows\System\HvSRsEi.exe
  2⤵
  PID:7312
- C:\Windows\System\CDetwwF.exe
  C:\Windows\System\CDetwwF.exe
  2⤵
  PID:7380
- C:\Windows\System\cliEdAZ.exe
  C:\Windows\System\cliEdAZ.exe
  2⤵
  PID:7456
- C:\Windows\System\uPkVMPX.exe
  C:\Windows\System\uPkVMPX.exe
  2⤵
  PID:7496
- C:\Windows\System\qEHXUik.exe
  C:\Windows\System\qEHXUik.exe
  2⤵
  PID:7568
- C:\Windows\System\WiwvZUE.exe
  C:\Windows\System\WiwvZUE.exe
  2⤵
  PID:6656
- C:\Windows\System\WzSPxGE.exe
  C:\Windows\System\WzSPxGE.exe
  2⤵
  PID:7604
- C:\Windows\System\qecLSPZ.exe
  C:\Windows\System\qecLSPZ.exe
  2⤵
  PID:6740
- C:\Windows\System\wfQdysk.exe
  C:\Windows\System\wfQdysk.exe
  2⤵
  PID:7736
- C:\Windows\System\MwNLaNS.exe
  C:\Windows\System\MwNLaNS.exe
  2⤵
  PID:7820
- C:\Windows\System\SHrhwjx.exe
  C:\Windows\System\SHrhwjx.exe
  2⤵
  PID:7892
- C:\Windows\System\xdeaEzO.exe
  C:\Windows\System\xdeaEzO.exe
  2⤵
  PID:4396
- C:\Windows\System\fuZLRnf.exe
  C:\Windows\System\fuZLRnf.exe
  2⤵
  PID:7280
- C:\Windows\System\lmEYuLW.exe
  C:\Windows\System\lmEYuLW.exe
  2⤵
  PID:7488
- C:\Windows\System\ELJtyfz.exe
  C:\Windows\System\ELJtyfz.exe
  2⤵
  PID:7616
- C:\Windows\System\UEQPfSl.exe
  C:\Windows\System\UEQPfSl.exe
  2⤵
  PID:7964
- C:\Windows\System\oKJlNCH.exe
  C:\Windows\System\oKJlNCH.exe
  2⤵
  PID:7816
- C:\Windows\System\HzFuMLJ.exe
  C:\Windows\System\HzFuMLJ.exe
  2⤵
  PID:6112
- C:\Windows\System\EgmogWY.exe
  C:\Windows\System\EgmogWY.exe
  2⤵
  PID:8008
- C:\Windows\System\DMiTbYb.exe
  C:\Windows\System\DMiTbYb.exe
  2⤵
  PID:6448
- C:\Windows\System\NIQGOBm.exe
  C:\Windows\System\NIQGOBm.exe
  2⤵
  PID:6344
- C:\Windows\System\JbbwvdJ.exe
  C:\Windows\System\JbbwvdJ.exe
  2⤵
  PID:6916
- C:\Windows\System\IpVNdnn.exe
  C:\Windows\System\IpVNdnn.exe
  2⤵
  PID:6868
- C:\Windows\System\yHsGtOo.exe
  C:\Windows\System\yHsGtOo.exe
  2⤵
  PID:5568
- C:\Windows\System\zFfJcWq.exe
  C:\Windows\System\zFfJcWq.exe
  2⤵
  PID:7292
- C:\Windows\System\BnWztOe.exe
  C:\Windows\System\BnWztOe.exe
  2⤵
  PID:7584
- C:\Windows\System\OsxSbXy.exe
  C:\Windows\System\OsxSbXy.exe
  2⤵
  PID:6240
- C:\Windows\System\fWaLUqy.exe
  C:\Windows\System\fWaLUqy.exe
  2⤵
  PID:7840
- C:\Windows\System\fSyvIWh.exe
  C:\Windows\System\fSyvIWh.exe
  2⤵
  PID:8060
- C:\Windows\System\DrRoYoL.exe
  C:\Windows\System\DrRoYoL.exe
  2⤵
  PID:7196
- C:\Windows\System\fVzkdcG.exe
  C:\Windows\System\fVzkdcG.exe
  2⤵
  PID:5664
- C:\Windows\System\BJXFCsq.exe
  C:\Windows\System\BJXFCsq.exe
  2⤵
  PID:6348
- C:\Windows\System\LEGjKfm.exe
  C:\Windows\System\LEGjKfm.exe
  2⤵
  PID:6692
- C:\Windows\System\bWTuKjm.exe
  C:\Windows\System\bWTuKjm.exe
  2⤵
  PID:5732
- C:\Windows\System\clEmaBf.exe
  C:\Windows\System\clEmaBf.exe
  2⤵
  PID:6468
- C:\Windows\System\pIrbCsn.exe
  C:\Windows\System\pIrbCsn.exe
  2⤵
  PID:7212
- C:\Windows\System\yXNfvsH.exe
  C:\Windows\System\yXNfvsH.exe
  2⤵
  PID:7296
- C:\Windows\System\wuBCejT.exe
  C:\Windows\System\wuBCejT.exe
  2⤵
  PID:7364
- C:\Windows\System\YWkwJas.exe
  C:\Windows\System\YWkwJas.exe
  2⤵
  PID:7440
- C:\Windows\System\iASGyin.exe
  C:\Windows\System\iASGyin.exe
  2⤵
  PID:7652
- C:\Windows\System\gfQTCXj.exe
  C:\Windows\System\gfQTCXj.exe
  2⤵
  PID:7916
- C:\Windows\System\srGGXIk.exe
  C:\Windows\System\srGGXIk.exe
  2⤵
  PID:7992
- C:\Windows\System\eEdQllY.exe
  C:\Windows\System\eEdQllY.exe
  2⤵
  PID:8136
- C:\Windows\System\ueGGzdI.exe
  C:\Windows\System\ueGGzdI.exe
  2⤵
  PID:8176
- C:\Windows\System\lIQtCAg.exe
  C:\Windows\System\lIQtCAg.exe
  2⤵
  PID:6632
- C:\Windows\System\JHaMzdR.exe
  C:\Windows\System\JHaMzdR.exe
  2⤵
  PID:7532
- C:\Windows\System\LTHTAQR.exe
  C:\Windows\System\LTHTAQR.exe
  2⤵
  PID:7696
- C:\Windows\System\uEJvgCw.exe
  C:\Windows\System\uEJvgCw.exe
  2⤵
  PID:7772
- C:\Windows\System\sbnlgrb.exe
  C:\Windows\System\sbnlgrb.exe
  2⤵
  PID:8120
- C:\Windows\System\khOLfAo.exe
  C:\Windows\System\khOLfAo.exe
  2⤵
  PID:3680
- C:\Windows\System\ioOYXwC.exe
  C:\Windows\System\ioOYXwC.exe
  2⤵
  PID:7812
- C:\Windows\System\UWwxMig.exe
  C:\Windows\System\UWwxMig.exe
  2⤵
  PID:5684
- C:\Windows\System\FLCHxvz.exe
  C:\Windows\System\FLCHxvz.exe
  2⤵
  PID:7116
- C:\Windows\System\ZozfGga.exe
  C:\Windows\System\ZozfGga.exe
  2⤵
  PID:1092
- C:\Windows\System\Uwjtrgk.exe
  C:\Windows\System\Uwjtrgk.exe
  2⤵
  PID:5932
- C:\Windows\System\GXNJJqM.exe
  C:\Windows\System\GXNJJqM.exe
  2⤵
  PID:7088
- C:\Windows\System\AmRYZxV.exe
  C:\Windows\System\AmRYZxV.exe
  2⤵
  PID:7360
- C:\Windows\System\WsnsLxL.exe
  C:\Windows\System\WsnsLxL.exe
  2⤵
  PID:7740
- C:\Windows\System\AbYoDrQ.exe
  C:\Windows\System\AbYoDrQ.exe
  2⤵
  PID:8048
- C:\Windows\System\GVgFVmG.exe
  C:\Windows\System\GVgFVmG.exe
  2⤵
  PID:7180
- C:\Windows\System\QlHOgHX.exe
  C:\Windows\System\QlHOgHX.exe
  2⤵
  PID:6292
- C:\Windows\System\nhIpdHK.exe
  C:\Windows\System\nhIpdHK.exe
  2⤵
  PID:6652
- C:\Windows\System\hDOruSz.exe
  C:\Windows\System\hDOruSz.exe
  2⤵
  PID:7252
- C:\Windows\System\HiCAoVg.exe
  C:\Windows\System\HiCAoVg.exe
  2⤵
  PID:7476
- C:\Windows\System\wlXoGbT.exe
  C:\Windows\System\wlXoGbT.exe
  2⤵
  PID:7544
- C:\Windows\System\RYJAPbt.exe
  C:\Windows\System\RYJAPbt.exe
  2⤵
  PID:7712
- C:\Windows\System\ztxXOdA.exe
  C:\Windows\System\ztxXOdA.exe
  2⤵
  PID:7792
- C:\Windows\System\rGAINhh.exe
  C:\Windows\System\rGAINhh.exe
  2⤵
  PID:7836
- C:\Windows\System\PrMxofv.exe
  C:\Windows\System\PrMxofv.exe
  2⤵
  PID:7952
- C:\Windows\System\MZWWNAD.exe
  C:\Windows\System\MZWWNAD.exe
  2⤵
  PID:6556
- C:\Windows\System\dfgMfAB.exe
  C:\Windows\System\dfgMfAB.exe
  2⤵
  PID:6744
- C:\Windows\System\xkKfJTD.exe
  C:\Windows\System\xkKfJTD.exe
  2⤵
  PID:7564
- C:\Windows\System\STiPKJE.exe
  C:\Windows\System\STiPKJE.exe
  2⤵
  PID:8172
- C:\Windows\System\SecSfVZ.exe
  C:\Windows\System\SecSfVZ.exe
  2⤵
  PID:7176
- C:\Windows\System\pxBZGJV.exe
  C:\Windows\System\pxBZGJV.exe
  2⤵
  PID:6856
- C:\Windows\System\FXDpmuJ.exe
  C:\Windows\System\FXDpmuJ.exe
  2⤵
  PID:7468
- C:\Windows\System\NPMyJhv.exe
  C:\Windows\System\NPMyJhv.exe
  2⤵
  PID:8024
- C:\Windows\System\uQoIapi.exe
  C:\Windows\System\uQoIapi.exe
  2⤵
  PID:5488
- C:\Windows\System\KWaXTgs.exe
  C:\Windows\System\KWaXTgs.exe
  2⤵
  PID:6476
- C:\Windows\System\EVDDLfo.exe
  C:\Windows\System\EVDDLfo.exe
  2⤵
  PID:7512
- C:\Windows\System\nRzKKgi.exe
  C:\Windows\System\nRzKKgi.exe
  2⤵
  PID:7376
- C:\Windows\System\xfGazgQ.exe
  C:\Windows\System\xfGazgQ.exe
  2⤵
  PID:7668
- C:\Windows\System\yXYcRhC.exe
  C:\Windows\System\yXYcRhC.exe
  2⤵
  PID:7084
- C:\Windows\System\ewMJXFX.exe
  C:\Windows\System\ewMJXFX.exe
  2⤵
  PID:6492
- C:\Windows\System\dhmJMTv.exe
  C:\Windows\System\dhmJMTv.exe
  2⤵
  PID:7796
- C:\Windows\System\tjyyGUG.exe
  C:\Windows\System\tjyyGUG.exe
  2⤵
  PID:8044
- C:\Windows\System\YtEBZDh.exe
  C:\Windows\System\YtEBZDh.exe
  2⤵
  PID:7248
- C:\Windows\System\OTJeBJM.exe
  C:\Windows\System\OTJeBJM.exe
  2⤵
  PID:7508
- C:\Windows\System\RqQDrqF.exe
  C:\Windows\System\RqQDrqF.exe
  2⤵
  PID:7988
- C:\Windows\System\DeYpKYo.exe
  C:\Windows\System\DeYpKYo.exe
  2⤵
  PID:7680
- C:\Windows\System\rwYKwyr.exe
  C:\Windows\System\rwYKwyr.exe
  2⤵
  PID:8080
- C:\Windows\System\dPXgTED.exe
  C:\Windows\System\dPXgTED.exe
  2⤵
  PID:7332
- C:\Windows\System\FXcYkqY.exe
  C:\Windows\System\FXcYkqY.exe
  2⤵
  PID:8156
- C:\Windows\System\PGXPfOC.exe
  C:\Windows\System\PGXPfOC.exe
  2⤵
  PID:7024
- C:\Windows\System\qXbXXdX.exe
  C:\Windows\System\qXbXXdX.exe
  2⤵
  PID:8088
- C:\Windows\System\UqOwqMx.exe
  C:\Windows\System\UqOwqMx.exe
  2⤵
  PID:7756
- C:\Windows\System\feseDuV.exe
  C:\Windows\System\feseDuV.exe
  2⤵
  PID:5460
- C:\Windows\System\SnVFqQC.exe
  C:\Windows\System\SnVFqQC.exe
  2⤵
  PID:7720
- C:\Windows\System\DtJPbcl.exe
  C:\Windows\System\DtJPbcl.exe
  2⤵
  PID:7968
- C:\Windows\System\sKISPWu.exe
  C:\Windows\System\sKISPWu.exe
  2⤵
  PID:7200
- C:\Windows\System\SZKEWtk.exe
  C:\Windows\System\SZKEWtk.exe
  2⤵
  PID:8116
- C:\Windows\System\xMsJtHM.exe
  C:\Windows\System\xMsJtHM.exe
  2⤵
  PID:7880
- C:\Windows\System\QYKQtiw.exe
  C:\Windows\System\QYKQtiw.exe
  2⤵
  PID:8208
- C:\Windows\System\RTefiQl.exe
  C:\Windows\System\RTefiQl.exe
  2⤵
  PID:8224
- C:\Windows\System\fgZvkSo.exe
  C:\Windows\System\fgZvkSo.exe
  2⤵
  PID:8240
- C:\Windows\System\zMFoTbU.exe
  C:\Windows\System\zMFoTbU.exe
  2⤵
  PID:8256
- C:\Windows\System\LkfcmbF.exe
  C:\Windows\System\LkfcmbF.exe
  2⤵
  PID:8272
- C:\Windows\System\LdVbzap.exe
  C:\Windows\System\LdVbzap.exe
  2⤵
  PID:8288
- C:\Windows\System\nByNnYf.exe
  C:\Windows\System\nByNnYf.exe
  2⤵
  PID:8304
- C:\Windows\System\iWViQVB.exe
  C:\Windows\System\iWViQVB.exe
  2⤵
  PID:8320
- C:\Windows\System\DeRBphk.exe
  C:\Windows\System\DeRBphk.exe
  2⤵
  PID:8336
- C:\Windows\System\LHpDWTN.exe
  C:\Windows\System\LHpDWTN.exe
  2⤵
  PID:8352
- C:\Windows\System\OxibsCY.exe
  C:\Windows\System\OxibsCY.exe
  2⤵
  PID:8368
- C:\Windows\System\yRKbaqX.exe
  C:\Windows\System\yRKbaqX.exe
  2⤵
  PID:8384
- C:\Windows\System\bUWJksX.exe
  C:\Windows\System\bUWJksX.exe
  2⤵
  PID:8400
- C:\Windows\System\xFLbjfS.exe
  C:\Windows\System\xFLbjfS.exe
  2⤵
  PID:8420
- C:\Windows\System\XHJFysW.exe
  C:\Windows\System\XHJFysW.exe
  2⤵
  PID:8436
- C:\Windows\System\cXHdRUO.exe
  C:\Windows\System\cXHdRUO.exe
  2⤵
  PID:8452
- C:\Windows\System\xVdaxXq.exe
  C:\Windows\System\xVdaxXq.exe
  2⤵
  PID:8468
- C:\Windows\System\OTwZuHz.exe
  C:\Windows\System\OTwZuHz.exe
  2⤵
  PID:8484
- C:\Windows\System\XyicjVi.exe
  C:\Windows\System\XyicjVi.exe
  2⤵
  PID:8500
- C:\Windows\System\pJhUXjG.exe
  C:\Windows\System\pJhUXjG.exe
  2⤵
  PID:8516
- C:\Windows\System\PyzwuVH.exe
  C:\Windows\System\PyzwuVH.exe
  2⤵
  PID:8532
- C:\Windows\System\JoJYWmE.exe
  C:\Windows\System\JoJYWmE.exe
  2⤵
  PID:8548
- C:\Windows\System\JZTwQgQ.exe
  C:\Windows\System\JZTwQgQ.exe
  2⤵
  PID:8564
- C:\Windows\System\YGqKafd.exe
  C:\Windows\System\YGqKafd.exe
  2⤵
  PID:8580
- C:\Windows\System\ixfyEdz.exe
  C:\Windows\System\ixfyEdz.exe
  2⤵
  PID:8596
- C:\Windows\System\ABxSDok.exe
  C:\Windows\System\ABxSDok.exe
  2⤵
  PID:8612
- C:\Windows\System\vmyDjUw.exe
  C:\Windows\System\vmyDjUw.exe
  2⤵
  PID:8628
- C:\Windows\System\FGJkzpV.exe
  C:\Windows\System\FGJkzpV.exe
  2⤵
  PID:8644
- C:\Windows\System\mWcUJlu.exe
  C:\Windows\System\mWcUJlu.exe
  2⤵
  PID:8660
- C:\Windows\System\gMXvRLD.exe
  C:\Windows\System\gMXvRLD.exe
  2⤵
  PID:8680
- C:\Windows\System\ZzpqNbB.exe
  C:\Windows\System\ZzpqNbB.exe
  2⤵
  PID:8716
- C:\Windows\System\rXOCEAz.exe
  C:\Windows\System\rXOCEAz.exe
  2⤵
  PID:8736
- C:\Windows\System\GidKlDa.exe
  C:\Windows\System\GidKlDa.exe
  2⤵
  PID:8752
- C:\Windows\System\TEswtNx.exe
  C:\Windows\System\TEswtNx.exe
  2⤵
  PID:8772
- C:\Windows\System\TqnmBvt.exe
  C:\Windows\System\TqnmBvt.exe
  2⤵
  PID:8788
- C:\Windows\System\jZUnaMW.exe
  C:\Windows\System\jZUnaMW.exe
  2⤵
  PID:8804
- C:\Windows\System\UzLkmeH.exe
  C:\Windows\System\UzLkmeH.exe
  2⤵
  PID:8820
- C:\Windows\System\zAyIPeC.exe
  C:\Windows\System\zAyIPeC.exe
  2⤵
  PID:8840
- C:\Windows\System\HaoAIvl.exe
  C:\Windows\System\HaoAIvl.exe
  2⤵
  PID:8860
- C:\Windows\System\YdHbwYT.exe
  C:\Windows\System\YdHbwYT.exe
  2⤵
  PID:8888
- C:\Windows\System\JNRQQFK.exe
  C:\Windows\System\JNRQQFK.exe
  2⤵
  PID:8904
- C:\Windows\System\jefOMfG.exe
  C:\Windows\System\jefOMfG.exe
  2⤵
  PID:8920
- C:\Windows\System\UrExqYV.exe
  C:\Windows\System\UrExqYV.exe
  2⤵
  PID:8936
- C:\Windows\System\XcsYHQW.exe
  C:\Windows\System\XcsYHQW.exe
  2⤵
  PID:8952
- C:\Windows\System\LPOjDTK.exe
  C:\Windows\System\LPOjDTK.exe
  2⤵
  PID:9108
- C:\Windows\System\KTobunn.exe
  C:\Windows\System\KTobunn.exe
  2⤵
  PID:9188
- C:\Windows\System\cMxWcED.exe
  C:\Windows\System\cMxWcED.exe
  2⤵
  PID:9204
- C:\Windows\System\nlkkoMg.exe
  C:\Windows\System\nlkkoMg.exe
  2⤵
  PID:6992
- C:\Windows\System\OMeQdcb.exe
  C:\Windows\System\OMeQdcb.exe
  2⤵
  PID:8252
- C:\Windows\System\BIvXzIW.exe
  C:\Windows\System\BIvXzIW.exe
  2⤵
  PID:8376
- C:\Windows\System\FLjpLRq.exe
  C:\Windows\System\FLjpLRq.exe
  2⤵
  PID:7752
- C:\Windows\System\MmLUGOB.exe
  C:\Windows\System\MmLUGOB.exe
  2⤵
  PID:8200
- C:\Windows\System\YhzNyIP.exe
  C:\Windows\System\YhzNyIP.exe
  2⤵
  PID:8264
- C:\Windows\System\JcKVSaV.exe
  C:\Windows\System\JcKVSaV.exe
  2⤵
  PID:8328
- C:\Windows\System\CopnSxt.exe
  C:\Windows\System\CopnSxt.exe
  2⤵
  PID:8556
- C:\Windows\System\VNBTGKN.exe
  C:\Windows\System\VNBTGKN.exe
  2⤵
  PID:8620
- C:\Windows\System\xAWVJYl.exe
  C:\Windows\System\xAWVJYl.exe
  2⤵
  PID:8640
- C:\Windows\System\vwptAfO.exe
  C:\Windows\System\vwptAfO.exe
  2⤵
  PID:8672
- C:\Windows\System\sfchNTN.exe
  C:\Windows\System\sfchNTN.exe
  2⤵
  PID:8696
- C:\Windows\System\lKrjTPp.exe
  C:\Windows\System\lKrjTPp.exe
  2⤵
  PID:8708
- C:\Windows\System\BzDFPue.exe
  C:\Windows\System\BzDFPue.exe
  2⤵
  PID:8764
- C:\Windows\System\YoAdjxP.exe
  C:\Windows\System\YoAdjxP.exe
  2⤵
  PID:8784
- C:\Windows\System\ZfEnmxv.exe
  C:\Windows\System\ZfEnmxv.exe
  2⤵
  PID:8728
- C:\Windows\System\zZBsRse.exe
  C:\Windows\System\zZBsRse.exe
  2⤵
  PID:8836
- C:\Windows\System\FZaTUca.exe
  C:\Windows\System\FZaTUca.exe
  2⤵
  PID:8880
- C:\Windows\System\QcaafoW.exe
  C:\Windows\System\QcaafoW.exe
  2⤵
  PID:8896
- C:\Windows\System\pRBjmfV.exe
  C:\Windows\System\pRBjmfV.exe
  2⤵
  PID:8912
- C:\Windows\System\OCRcZKX.exe
  C:\Windows\System\OCRcZKX.exe
  2⤵
  PID:8948
- C:\Windows\System\omJxBEF.exe
  C:\Windows\System\omJxBEF.exe
  2⤵
  PID:9120
- C:\Windows\System\SLcICtd.exe
  C:\Windows\System\SLcICtd.exe
  2⤵
  PID:9160
- C:\Windows\System\NosvbXB.exe
  C:\Windows\System\NosvbXB.exe
  2⤵
  PID:7948
- C:\Windows\System\llTjYri.exe
  C:\Windows\System\llTjYri.exe
  2⤵
  PID:9064
- C:\Windows\System\pIOiqbZ.exe
  C:\Windows\System\pIOiqbZ.exe
  2⤵
  PID:8248
- C:\Windows\System\EDCJvyo.exe
  C:\Windows\System\EDCJvyo.exe
  2⤵
  PID:9012
- C:\Windows\System\FKRWsmm.exe
  C:\Windows\System\FKRWsmm.exe
  2⤵
  PID:9036
- C:\Windows\System\ETKijoM.exe
  C:\Windows\System\ETKijoM.exe
  2⤵
  PID:8296
- C:\Windows\System\xwWdrQT.exe
  C:\Windows\System\xwWdrQT.exe
  2⤵
  PID:9072
- C:\Windows\System\EMdZupt.exe
  C:\Windows\System\EMdZupt.exe
  2⤵
  PID:9088
- C:\Windows\System\soXxZNS.exe
  C:\Windows\System\soXxZNS.exe
  2⤵
  PID:8316
- C:\Windows\System\opTsnMi.exe
  C:\Windows\System\opTsnMi.exe
  2⤵
  PID:8220
- C:\Windows\System\TOykmDB.exe
  C:\Windows\System\TOykmDB.exe
  2⤵
  PID:8392
- C:\Windows\System\FxdzIjY.exe
  C:\Windows\System\FxdzIjY.exe
  2⤵
  PID:8432
- C:\Windows\System\sYkYgFu.exe
  C:\Windows\System\sYkYgFu.exe
  2⤵
  PID:8480
- C:\Windows\System\AboTZcN.exe
  C:\Windows\System\AboTZcN.exe
  2⤵
  PID:8492
- C:\Windows\System\yJrKDLk.exe
  C:\Windows\System\yJrKDLk.exe
  2⤵
  PID:8572
- C:\Windows\System\lSvTvPa.exe
  C:\Windows\System\lSvTvPa.exe
  2⤵
  PID:8528
- C:\Windows\System\mALwDhd.exe
  C:\Windows\System\mALwDhd.exe
  2⤵
  PID:8700
- C:\Windows\System\GzvYrdR.exe
  C:\Windows\System\GzvYrdR.exe
  2⤵
  PID:8828
- C:\Windows\System\AFYFGAb.exe
  C:\Windows\System\AFYFGAb.exe
  2⤵
  PID:8944
- C:\Windows\System\RCUWUvn.exe
  C:\Windows\System\RCUWUvn.exe
  2⤵
  PID:8748
- C:\Windows\System\fjMWkZe.exe
  C:\Windows\System\fjMWkZe.exe
  2⤵
  PID:8900
- C:\Windows\System\HZxCJWG.exe
  C:\Windows\System\HZxCJWG.exe
  2⤵
  PID:9140
- C:\Windows\System\IYBgxBC.exe
  C:\Windows\System\IYBgxBC.exe
  2⤵
  PID:9124
- C:\Windows\System\MGgPVrW.exe
  C:\Windows\System\MGgPVrW.exe
  2⤵
  PID:9172
- C:\Windows\System\yRbwEPJ.exe
  C:\Windows\System\yRbwEPJ.exe
  2⤵
  PID:9184
- C:\Windows\System\kcRlbqX.exe
  C:\Windows\System\kcRlbqX.exe
  2⤵
  PID:9024
- C:\Windows\System\ocFMCMM.exe
  C:\Windows\System\ocFMCMM.exe
  2⤵
  PID:8984
- C:\Windows\System\aRKEfnB.exe
  C:\Windows\System\aRKEfnB.exe
  2⤵
  PID:9008
- C:\Windows\System\lVGoVeb.exe
  C:\Windows\System\lVGoVeb.exe
  2⤵
  PID:9052
- C:\Windows\System\MyQOjeG.exe
  C:\Windows\System\MyQOjeG.exe
  2⤵
  PID:9080
- C:\Windows\System\rHpoHjA.exe
  C:\Windows\System\rHpoHjA.exe
  2⤵
  PID:8300
- C:\Windows\System\fcrLHIn.exe
  C:\Windows\System\fcrLHIn.exe
  2⤵
  PID:8524
- C:\Windows\System\VlALYPm.exe
  C:\Windows\System\VlALYPm.exe
  2⤵
  PID:8496
- C:\Windows\System\EtUjTAA.exe
  C:\Windows\System\EtUjTAA.exe
  2⤵
  PID:8476
- C:\Windows\System\LCAatMx.exe
  C:\Windows\System\LCAatMx.exe
  2⤵
  PID:8852
- C:\Windows\System\GBcDjaW.exe
  C:\Windows\System\GBcDjaW.exe
  2⤵
  PID:7900
- C:\Windows\System\uYUXKlx.exe
  C:\Windows\System\uYUXKlx.exe
  2⤵
  PID:8688
- C:\Windows\System\xjbAUva.exe
  C:\Windows\System\xjbAUva.exe
  2⤵
  PID:9152
- C:\Windows\System\sgcILVl.exe
  C:\Windows\System\sgcILVl.exe
  2⤵
  PID:9000
- C:\Windows\System\ARLtRKI.exe
  C:\Windows\System\ARLtRKI.exe
  2⤵
  PID:9200
- C:\Windows\System\TEMthgh.exe
  C:\Windows\System\TEMthgh.exe
  2⤵
  PID:8608
- C:\Windows\System\CPALutr.exe
  C:\Windows\System\CPALutr.exe
  2⤵
  PID:8636
- C:\Windows\System\teiQorC.exe
  C:\Windows\System\teiQorC.exe
  2⤵
  PID:8744
- C:\Windows\System\ZyaOeZO.exe
  C:\Windows\System\ZyaOeZO.exe
  2⤵
  PID:8232
- C:\Windows\System\PEdYaQD.exe
  C:\Windows\System\PEdYaQD.exe
  2⤵
  PID:8668
- C:\Windows\System\BSSFjeN.exe
  C:\Windows\System\BSSFjeN.exe
  2⤵
  PID:8976
- C:\Windows\System\lnvWOGG.exe
  C:\Windows\System\lnvWOGG.exe
  2⤵
  PID:8868
- C:\Windows\System\mLUOdib.exe
  C:\Windows\System\mLUOdib.exe
  2⤵
  PID:8872
- C:\Windows\System\ivkIpEQ.exe
  C:\Windows\System\ivkIpEQ.exe
  2⤵
  PID:8996
- C:\Windows\System\EHUCFmS.exe
  C:\Windows\System\EHUCFmS.exe
  2⤵
  PID:8812
- C:\Windows\System\vAoknQg.exe
  C:\Windows\System\vAoknQg.exe
  2⤵
  PID:8884
- C:\Windows\System\OvBpXom.exe
  C:\Windows\System\OvBpXom.exe
  2⤵
  PID:9144
- C:\Windows\System\zGbpdFB.exe
  C:\Windows\System\zGbpdFB.exe
  2⤵
  PID:9156
- C:\Windows\System\seFCSGO.exe
  C:\Windows\System\seFCSGO.exe
  2⤵
  PID:8512
- C:\Windows\System\rpKFkLW.exe
  C:\Windows\System\rpKFkLW.exe
  2⤵
  PID:9060
- C:\Windows\System\aRzAjFs.exe
  C:\Windows\System\aRzAjFs.exe
  2⤵
  PID:8408
- C:\Windows\System\IsOJokI.exe
  C:\Windows\System\IsOJokI.exe
  2⤵
  PID:6888
- C:\Windows\System\jGFEUOp.exe
  C:\Windows\System\jGFEUOp.exe
  2⤵
  PID:9224
- C:\Windows\System\EFRXMDg.exe
  C:\Windows\System\EFRXMDg.exe
  2⤵
  PID:9240
- C:\Windows\System\eJzrWjZ.exe
  C:\Windows\System\eJzrWjZ.exe
  2⤵
  PID:9256
- C:\Windows\System\AVkwjcj.exe
  C:\Windows\System\AVkwjcj.exe
  2⤵
  PID:9272
- C:\Windows\System\RZZWwLA.exe
  C:\Windows\System\RZZWwLA.exe
  2⤵
  PID:9288
- C:\Windows\System\dMsEJsT.exe
  C:\Windows\System\dMsEJsT.exe
  2⤵
  PID:9304
- C:\Windows\System\zJUNQdf.exe
  C:\Windows\System\zJUNQdf.exe
  2⤵
  PID:9320
- C:\Windows\System\vgSgrpF.exe
  C:\Windows\System\vgSgrpF.exe
  2⤵
  PID:9336
- C:\Windows\System\CCvBxVv.exe
  C:\Windows\System\CCvBxVv.exe
  2⤵
  PID:9352
- C:\Windows\System\lZSISqK.exe
  C:\Windows\System\lZSISqK.exe
  2⤵
  PID:9368
- C:\Windows\System\NITtMBq.exe
  C:\Windows\System\NITtMBq.exe
  2⤵
  PID:9384
- C:\Windows\System\jXxYcIw.exe
  C:\Windows\System\jXxYcIw.exe
  2⤵
  PID:9400
- C:\Windows\System\Gqnvxws.exe
  C:\Windows\System\Gqnvxws.exe
  2⤵
  PID:9416
- C:\Windows\System\OOnbYqF.exe
  C:\Windows\System\OOnbYqF.exe
  2⤵
  PID:9432
- C:\Windows\System\ZuCrBwc.exe
  C:\Windows\System\ZuCrBwc.exe
  2⤵
  PID:9456
- C:\Windows\System\hbXftRm.exe
  C:\Windows\System\hbXftRm.exe
  2⤵
  PID:9500
- C:\Windows\System\ffQiJaX.exe
  C:\Windows\System\ffQiJaX.exe
  2⤵
  PID:9516
- C:\Windows\System\wdOKvMI.exe
  C:\Windows\System\wdOKvMI.exe
  2⤵
  PID:9532
- C:\Windows\System\EMCEROo.exe
  C:\Windows\System\EMCEROo.exe
  2⤵
  PID:9548
- C:\Windows\System\mGmZhPf.exe
  C:\Windows\System\mGmZhPf.exe
  2⤵
  PID:9564
- C:\Windows\System\HzkLhQW.exe
  C:\Windows\System\HzkLhQW.exe
  2⤵
  PID:9580
- C:\Windows\System\tKfGmIk.exe
  C:\Windows\System\tKfGmIk.exe
  2⤵
  PID:9596
- C:\Windows\System\fItqzio.exe
  C:\Windows\System\fItqzio.exe
  2⤵
  PID:9616
- C:\Windows\System\ebwibZg.exe
  C:\Windows\System\ebwibZg.exe
  2⤵
  PID:9632
- C:\Windows\System\SSeOXMa.exe
  C:\Windows\System\SSeOXMa.exe
  2⤵
  PID:9648
- C:\Windows\System\dFfMnIU.exe
  C:\Windows\System\dFfMnIU.exe
  2⤵
  PID:9668
- C:\Windows\System\qndRqwI.exe
  C:\Windows\System\qndRqwI.exe
  2⤵
  PID:9724
- C:\Windows\System\oSkJVIR.exe
  C:\Windows\System\oSkJVIR.exe
  2⤵
  PID:9740
- C:\Windows\System\OxKvpjL.exe
  C:\Windows\System\OxKvpjL.exe
  2⤵
  PID:9756
- C:\Windows\System\CPedrjN.exe
  C:\Windows\System\CPedrjN.exe
  2⤵
  PID:9772
- C:\Windows\System\VCQKpDl.exe
  C:\Windows\System\VCQKpDl.exe
  2⤵
  PID:9788
- C:\Windows\System\SbaxFhM.exe
  C:\Windows\System\SbaxFhM.exe
  2⤵
  PID:9808
- C:\Windows\System\eEisGhA.exe
  C:\Windows\System\eEisGhA.exe
  2⤵
  PID:9824
- C:\Windows\System\rWvFgdS.exe
  C:\Windows\System\rWvFgdS.exe
  2⤵
  PID:9840
- C:\Windows\System\TXlCHAP.exe
  C:\Windows\System\TXlCHAP.exe
  2⤵
  PID:9856
- C:\Windows\System\xKwfHKW.exe
  C:\Windows\System\xKwfHKW.exe
  2⤵
  PID:9872
- C:\Windows\System\FLdnpbI.exe
  C:\Windows\System\FLdnpbI.exe
  2⤵
  PID:9888
- C:\Windows\System\CMJuCek.exe
  C:\Windows\System\CMJuCek.exe
  2⤵
  PID:9904
- C:\Windows\System\RfricaN.exe
  C:\Windows\System\RfricaN.exe
  2⤵
  PID:9920
- C:\Windows\System\GiVNRbd.exe
  C:\Windows\System\GiVNRbd.exe
  2⤵
  PID:9936
- C:\Windows\System\pkwLNJp.exe
  C:\Windows\System\pkwLNJp.exe
  2⤵
  PID:9952
- C:\Windows\System\NrolFfc.exe
  C:\Windows\System\NrolFfc.exe
  2⤵
  PID:9968
- C:\Windows\System\pVuOrEW.exe
  C:\Windows\System\pVuOrEW.exe
  2⤵
  PID:9984
- C:\Windows\System\mMOJGTe.exe
  C:\Windows\System\mMOJGTe.exe
  2⤵
  PID:10000
- C:\Windows\System\aeiGbdN.exe
  C:\Windows\System\aeiGbdN.exe
  2⤵
  PID:10016
- C:\Windows\System\hzLXkNf.exe
  C:\Windows\System\hzLXkNf.exe
  2⤵
  PID:10032
- C:\Windows\System\XmVXPCx.exe
  C:\Windows\System\XmVXPCx.exe
  2⤵
  PID:10048
- C:\Windows\System\BhASgjR.exe
  C:\Windows\System\BhASgjR.exe
  2⤵
  PID:10064
- C:\Windows\System\jYrlsPO.exe
  C:\Windows\System\jYrlsPO.exe
  2⤵
  PID:10080
- C:\Windows\System\OTlUjbu.exe
  C:\Windows\System\OTlUjbu.exe
  2⤵
  PID:10096
- C:\Windows\System\zZJAHOu.exe
  C:\Windows\System\zZJAHOu.exe
  2⤵
  PID:10112
- C:\Windows\System\qzGXZkg.exe
  C:\Windows\System\qzGXZkg.exe
  2⤵
  PID:10128
- C:\Windows\System\OsmdduT.exe
  C:\Windows\System\OsmdduT.exe
  2⤵
  PID:10144
- C:\Windows\System\RvbdnOD.exe
  C:\Windows\System\RvbdnOD.exe
  2⤵
  PID:10160
- C:\Windows\System\xWFLDDi.exe
  C:\Windows\System\xWFLDDi.exe
  2⤵
  PID:10176
- C:\Windows\System\jXTvCBH.exe
  C:\Windows\System\jXTvCBH.exe
  2⤵
  PID:10192
- C:\Windows\System\tkTiPQy.exe
  C:\Windows\System\tkTiPQy.exe
  2⤵
  PID:10208
- C:\Windows\System\uAlIYxM.exe
  C:\Windows\System\uAlIYxM.exe
  2⤵
  PID:10224
- C:\Windows\System\RvaagFJ.exe
  C:\Windows\System\RvaagFJ.exe
  2⤵
  PID:8732
- C:\Windows\System\TltMytq.exe
  C:\Windows\System\TltMytq.exe
  2⤵
  PID:9220
- C:\Windows\System\KykIqoq.exe
  C:\Windows\System\KykIqoq.exe
  2⤵
  PID:9284
- C:\Windows\System\YBlArTk.exe
  C:\Windows\System\YBlArTk.exe
  2⤵
  PID:8760
- C:\Windows\System\aJIImWp.exe
  C:\Windows\System\aJIImWp.exe
  2⤵
  PID:9268
- C:\Windows\System\OVVBHSp.exe
  C:\Windows\System\OVVBHSp.exe
  2⤵
  PID:9296
- C:\Windows\System\YeMnbuk.exe
  C:\Windows\System\YeMnbuk.exe
  2⤵
  PID:9360
- C:\Windows\System\tkjXSer.exe
  C:\Windows\System\tkjXSer.exe
  2⤵
  PID:9380
- C:\Windows\System\nIlyCGv.exe
  C:\Windows\System\nIlyCGv.exe
  2⤵
  PID:9444
- C:\Windows\System\ocdNzDq.exe
  C:\Windows\System\ocdNzDq.exe
  2⤵
  PID:9540
- C:\Windows\System\wlbmpso.exe
  C:\Windows\System\wlbmpso.exe
  2⤵
  PID:9604
- C:\Windows\System\xUAWWrk.exe
  C:\Windows\System\xUAWWrk.exe
  2⤵
  PID:9656
- C:\Windows\System\BiUqijF.exe
  C:\Windows\System\BiUqijF.exe
  2⤵
  PID:9468
- C:\Windows\System\cJuHGCI.exe
  C:\Windows\System\cJuHGCI.exe
  2⤵
  PID:9488
- C:\Windows\System\QbDvINe.exe
  C:\Windows\System\QbDvINe.exe
  2⤵
  PID:9660
- C:\Windows\System\rlknOvX.exe
  C:\Windows\System\rlknOvX.exe
  2⤵
  PID:9684
- C:\Windows\System\dzRLrKa.exe
  C:\Windows\System\dzRLrKa.exe
  2⤵
  PID:9708
- C:\Windows\System\uHhabKf.exe
  C:\Windows\System\uHhabKf.exe
  2⤵
  PID:9748
- C:\Windows\System\zWIbtUy.exe
  C:\Windows\System\zWIbtUy.exe
  2⤵
  PID:9784
- C:\Windows\System\qhdDakG.exe
  C:\Windows\System\qhdDakG.exe
  2⤵
  PID:9880
- C:\Windows\System\DqRKfNg.exe
  C:\Windows\System\DqRKfNg.exe
  2⤵
  PID:9916
- C:\Windows\System\ViLrXoz.exe
  C:\Windows\System\ViLrXoz.exe
  2⤵
  PID:9736
- C:\Windows\System\eDQhnMQ.exe
  C:\Windows\System\eDQhnMQ.exe
  2⤵
  PID:9768
- C:\Windows\System\ScAsICY.exe
  C:\Windows\System\ScAsICY.exe
  2⤵
  PID:10008
- C:\Windows\System\qMjiqdL.exe
  C:\Windows\System\qMjiqdL.exe
  2⤵
  PID:9868
- C:\Windows\System\mPidVud.exe
  C:\Windows\System\mPidVud.exe
  2⤵
  PID:10056
- C:\Windows\System\JTMCHsp.exe
  C:\Windows\System\JTMCHsp.exe
  2⤵
  PID:10120
- C:\Windows\System\LoMMaMr.exe
  C:\Windows\System\LoMMaMr.exe
  2⤵
  PID:10172
- C:\Windows\System\LAhdDZf.exe
  C:\Windows\System\LAhdDZf.exe
  2⤵
  PID:10236
- C:\Windows\System\rzliBsZ.exe
  C:\Windows\System\rzliBsZ.exe
  2⤵
  PID:9348
- C:\Windows\System\wVoszYz.exe
  C:\Windows\System\wVoszYz.exe
  2⤵
  PID:9412
- C:\Windows\System\TQFTMiS.exe
  C:\Windows\System\TQFTMiS.exe
  2⤵
  PID:9316
- C:\Windows\System\mmKpJws.exe
  C:\Windows\System\mmKpJws.exe
  2⤵
  PID:10216
- C:\Windows\System\YhPVVMo.exe
  C:\Windows\System\YhPVVMo.exe
  2⤵
  PID:9392
- C:\Windows\System\QOAOiGy.exe
  C:\Windows\System\QOAOiGy.exe
  2⤵
  PID:10184
- C:\Windows\System\vHXtjtX.exe
  C:\Windows\System\vHXtjtX.exe
  2⤵
  PID:9492
- C:\Windows\System\zaDpYdd.exe
  C:\Windows\System\zaDpYdd.exe
  2⤵
  PID:9524
- C:\Windows\System\vDJYXHe.exe
  C:\Windows\System\vDJYXHe.exe
  2⤵
  PID:9560
- C:\Windows\System\brqcFhN.exe
  C:\Windows\System\brqcFhN.exe
  2⤵
  PID:9628
- C:\Windows\System\BuojkvF.exe
  C:\Windows\System\BuojkvF.exe
  2⤵
  PID:9700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AuLKrwS.exe

Filesize
2.2MB

MD5
6d24fec4de69ecefdde571f5697d1c37

SHA1
38176f8c24b65f21711dcdda6d19866e0c3b6891

SHA256
c54cbd552efb0e63ba62dd3bec7c14c3962c34b0118417c57b09a3531635ff06

SHA512
d67628fda4d823fb38d9336aadf1d4bac3ef75ff0a1a1cb53d656483c48ce159f83ad036fd3b88885318bf1a2be3f69ce1f47f2d19f882305c8febc08669bcda

Download Submit
C:\Windows\system\AvJgrES.exe

Filesize
2.2MB

MD5
c5681ca86d49e167a4b962da11844bd8

SHA1
37be4933b13137bc15078904a0e62b0aeed023f8

SHA256
1a9a9fbb0447f200bb1f33a7000965fc022b48a4a54d91b54ded66f9ed5a9c0b

SHA512
2fae571ce101986e8d2fb119ca06325fa1a78f7d5c0e3cf93ea95fb3b10dffc8b2be1aa993b6575b07b33c3537ead75fe27ec4f9af234f4bdf8b9836bf9c3e52

Download Submit
C:\Windows\system\CeMVgee.exe

Filesize
2.2MB

MD5
ec5033bf22af1f2776ff71f075a16a2d

SHA1
ca57956fa39feee8a032584c0cf161cd6012350c

SHA256
49cc1bcd3d7f851d9384fad513dd55d0c6908c31ce37d5cf41e09305559ce159

SHA512
f591b35f911f47e7ea126ed9a492c8822fa5038a9fd33e17d46ff2d097eb3ff19bea3e0bad72fdead398f7e6d3a2308109722c6b31a2b40304120f79821afa0c

Download Submit
C:\Windows\system\EACTJId.exe

Filesize
2.2MB

MD5
a010d5be9cc59c84e47a22304439502c

SHA1
2872b644e2ee06a8d2215860dd98a7e67cc930d8

SHA256
6ffa1d309a6e544402ca65508499246be3d16b611c6bc7343aa077ec548da82c

SHA512
41539c11a651fdd28c4c3a3e16eeb0bdf7c622c7c3e1b0072ad0662dee69dec03c2993f045fab576f3db0928c6235a75b995e9e7cecfb1c8e0f8090aa186b287

Download Submit
C:\Windows\system\ElvuMBq.exe

Filesize
2.2MB

MD5
a8a52d2347b5376537950ea57ca61e4c

SHA1
6c006b203067db8f44e27bed0ebb53a495ca7819

SHA256
46347e3d6a15907cb61fca42a888b84727995acb69b13366a9196566faa509a6

SHA512
cfb56a0823231c30e0bc72fb9b9b1c29870383a99e3a2e16e0d54866d3a4215c6e88625f0324cf5938c7d3de15eea71131446e2e0d30043b53e7688e12fc24e1

Download Submit
C:\Windows\system\HJJqfkr.exe

Filesize
2.2MB

MD5
de174e725bac33c31232ae29b4cd295b

SHA1
e705be3305acddb2b882d0fb164979c1e399d316

SHA256
4b5c1c2fef60a48ef51ad75d5f98c07a97b41c889f47b5d20acfe4533af4f25d

SHA512
89019983e74579f026ebff12e50f89d22887fbe37e7b324425d8eb31a8d4ab6f69b0390dbf252ef663838f0ba4e071cf16015a8b6ef2c6c54a6a222513b6411e

Download Submit
C:\Windows\system\IiYzoYG.exe

Filesize
2.2MB

MD5
76fdd8c86712ea7f01de346e27d374ee

SHA1
3f1695552716b0b05775e793772f8d4e3e194584

SHA256
e999814f643c0f24560bee336e7f48583e5833014a1aed05491a9b626fe65423

SHA512
c5a1ff266c34b01ad4a525734d96466728c986ef4025bd3b11a1072c0746cd7bf4c9d58ca31d804c0c17fb00e3c8a3e2614059da8bae2ab3f760218d737cf575

Download Submit
C:\Windows\system\IzlgiIt.exe

Filesize
2.2MB

MD5
2c88fe7d44446b61da79044ecf241034

SHA1
da72ca7995fcce4e8c136b9dbf748f783ac8246e

SHA256
f624540f415ecf2d423de6f00b8f21492a0867e85cc1f611e643b5674457604d

SHA512
d3cfea847e2bca23bc03ca4a6b91fb86b96a4bf2f0fbf700d33aef5a21f1486f7408388fba01690916a6c3317602acebd85cd4a135a4a5a944f688d9aadb53e4

Download Submit
C:\Windows\system\PCmbZsA.exe

Filesize
2.2MB

MD5
4b104d4a972e57c1755dbeab70440e58

SHA1
27474cce375eaa31db7e614f0228b2db8e5c15d5

SHA256
97d89f140c901be87fe6c78e2b040137d3eb4a757205bc3f701aafd79403a598

SHA512
5cb6af1e63212b3a8e6637ff261eaed2b70e6c1ee0c9ba4b9bfdfb0d83494297d65e35d5ae8edae316f6f68e33da06298695a4c76de2f7c69fba589aa10d5db9

Download Submit
C:\Windows\system\QsOyWIG.exe

Filesize
2.2MB

MD5
943d941a7de78eed8679242231e42b49

SHA1
a62d6a9bdd8ad353d74bd1c964036a4c4d9ad4ae

SHA256
7724153f111e48f089ecd1b1af0a2c4037686c485462e2cefd433990d3a76f0c

SHA512
9fd7a7e7c71a724defa008255f58d8bc14a58aaf111c074e6984fb5f0f071433cd1b584794d57d60475970cd19858c1763ad745a6a594e7488952ef0a66f5c96

Download Submit
C:\Windows\system\YeMGCll.exe

Filesize
2.2MB

MD5
997b9b605ab58fbb74cc29bd0bd6e8ba

SHA1
e2b46cb3e8c27acb96ef0ff88d9c426be9e13f6f

SHA256
e40be685ceec1dfa2be09d6c54ac2fe3671ef4ffa3f1f117c58e8135fcec1291

SHA512
4d535a25aab6435c61637c885b76bc38511fb49a0350693b194648a35379b18718e2e4c59fb19bdbae19f7aa1e67ae093a3a437d7a2331a66e9eac6f8cb8eb8f

Download Submit
C:\Windows\system\ZMxJoJh.exe

Filesize
2.2MB

MD5
14190270bb26a26e83a63fb3fe9a4dd7

SHA1
ce510f14a00261f47c3932b343f45ec492b6c242

SHA256
72366ae13d74b9ba9d9ae8edb1e9190dfcd7d269d575f7195d5bdd6def7f5f1c

SHA512
6c5ba12b42b2f2b643366ef01197a8ad585f06f6434a64798e3a88262420c9ee9e592a94782f1595b2e6df42144cdfe75c056fb0add47f4f3deacd1c37b6e73f

Download Submit
C:\Windows\system\elnZOPQ.exe

Filesize
2.2MB

MD5
ffa028525e7852a5af6514d2ee652cb5

SHA1
02dea4cf0c6ed9ba1121404188231b3c1574c487

SHA256
c0407298fdce164e5958d1c2f40f1b09778bc95befd34db0e104a1582b1295af

SHA512
f20c3b533d6904d2b1b7e144a25bffad473f67f1d18fcefa960fb0ab18b4e705d9ab2b6735debbd54204b82d449e36d2e8fc0493f316c4df61e35b8b4edddf91

Download Submit
C:\Windows\system\fYdQwMQ.exe

Filesize
2.2MB

MD5
96c8500b36a5ed78aa335e5bb40319a2

SHA1
76864ea54fd3dc38db6a943333caceaa289445bd

SHA256
982853c66b7057cc02139f3f8db07bee085932d9d8793b165a95a1302a772998

SHA512
fdbd5a651fd5d1b637fdd5c20c4ad3f81355c70c8e54a1f28413b61aa39b6ae743f927265726e36385291d353d0dadf1657cf8b852056190d991c17c2f4686b6

Download Submit
C:\Windows\system\fltAYfF.exe

Filesize
2.2MB

MD5
2dd0adc82b382670cdfd3677430cf3e9

SHA1
15d9d4dee88bd12a5502abaf75e093139c8b3829

SHA256
ade4fc14597b9383aa6382c82093365258febafa41bb528a035d03420298c512

SHA512
19276762fe82312d96214761576f69d1d3530f5ea925ca68057517335f74e1d654e799f0e96bba146b23592fada81c9c900b17708db05d135a394ffb400b47ad

Download Submit
C:\Windows\system\hdRnQuG.exe

Filesize
2.2MB

MD5
d7b5011205ecb8ad718d50b7d97eaa84

SHA1
baecdf39021350375cfaf4a0893d406b82ee709f

SHA256
05aa88d61c86bb7f0a446eba63ee480be67102ce649df3a482704df4968c4a5a

SHA512
2760bf44a27bc094be7d58b294782ec417ed3505c94122e905dcf13bbb2610804af07afe80dcf294aacd485f2e4ae3870a866c970b7d666bcbdaa47531537466

Download Submit
C:\Windows\system\jIxNXBL.exe

Filesize
2.2MB

MD5
59965e8b4653ddcadd370f378706c1b6

SHA1
8ca120393c99287ed42a24b32b1db83f82896c33

SHA256
df4b467c64f3ceb252f88d7c66ea602c350ab2f04fea240582e64ac27e269cb2

SHA512
2444cf1df917480ce7126e489ab2d4371a51d9ebdccd3d653187951c3815bf57a2171824d223fe0efd32c52a7f12ae4648b3ab007134261fa529d7c5ff288840

Download Submit
C:\Windows\system\jXwuDVF.exe

Filesize
2.2MB

MD5
f554abc04ceaf3f1c66e8b3816232921

SHA1
95d8c531b6ad8496172e1f8eff2c8b7ea0e937d1

SHA256
337f7d43c50f250ec92a820992311b441349765c65db6976ef12a16e4478e326

SHA512
aafa40e348dc1eb0c69e3defe7f1c3a47a3cc988b774dbcc582fe750c45887f2ef899c33bf27ed9d2b3e95404234f0abe3843cf8f2b358bb237e9b9d5a098496

Download Submit
C:\Windows\system\jwhTGxh.exe

Filesize
2.2MB

MD5
b729f16459a5377c04c49f628682b700

SHA1
2863e65672bfd241d14f86afa375c83f6168a23e

SHA256
2c586c9a4cd1fe593b2c57b95b5c643cee8676c39d0447f11cddf0e48cd69bc8

SHA512
cab15ba96f524671bc123ea62af9433efb1c42cadd030c5a11ebf3af2e478f8f580aac61f5b7c67e42b0db6d41a3508393dbe68867954e6d6b37099d5d9c829d

Download Submit
C:\Windows\system\mvBKJaa.exe

Filesize
2.2MB

MD5
998d4a11a365a6f7bb616bd2e4fa76ac

SHA1
afea1103d002306e24bd15852cbeddb5ef3d43e9

SHA256
273fa48600687f5ad54160a2eb10c859017935bb8273dd4e23ae0f6e26dcefcb

SHA512
909a45f771ae68c4950570d5976393ccf385fd683f275aa771194680595b835601fcf272096a6a3273f60904cd5d58cb7dd7f229c694f5b7f7255109c98d5eae

Download Submit
C:\Windows\system\ovqgepF.exe

Filesize
2.2MB

MD5
dbafa088eb5511a95ad4fca5f2c881c3

SHA1
2b201d8d13012e760e723091febe9738948a6829

SHA256
f7dade838d26d4853498681588c0c8f56218a9d77dde21b9fdf08cdd76387245

SHA512
270d796ca327221fc4edffa43ff4fcc738ceb8ea8f0a704cab4bb5b8b8c72295f8c572dcf7e90a1cfd73d4a24d1145fa33cb752f36248bc307a7df9d3d32137d

Download Submit
C:\Windows\system\ozWndIc.exe

Filesize
2.2MB

MD5
e519309e25f3e8e6ee06f83eab29eb0c

SHA1
ad34284b6a2d372b7def958356c69398ffd9152a

SHA256
898f2ac90d9e862803a96aa6c7ed107bf4c29427ccc7cdf84ba0d25d8593d6fa

SHA512
659f6ef06b220667b7da34a3734c0c20507bee496a2574b76918a8f1e4d68d0f065481b07919c38cc63f77756e1f54c4416b923bf998a77d4ddfda397b175eac

Download Submit
C:\Windows\system\pdaOVEv.exe

Filesize
2.2MB

MD5
7a1bf776df0e80682a4d08e5d69a217f

SHA1
010acf8c9cdd9e8f5b310212cb4f2eb088503953

SHA256
a3b37cc6f965114741832984d0cc82210bce79fe5b96c95cc8efe66b0b3c033a

SHA512
a2446a4da5eed0cd9ec1d653cf251ccf62f1ef47eb0aae73830659b017e9222cb9cb0e05d00d98f7c8e05819442eb7c0e2e8a74945797da069779eb0b7b1427e

Download Submit
C:\Windows\system\pfwgEsN.exe

Filesize
2.2MB

MD5
97e56f56fa64a0220c9e98e6b5d6c94a

SHA1
f0c9de481ab65cce3daa64083f720b2985bed582

SHA256
9fddaa3cec4f832a8458d9cb0ae96e93c1bd992abf8eb5459036cfed51261eb6

SHA512
dec5c114cee3f679c53256abfce55416281a5f10eb4ee1bb5e9dc96d1bc8832eedb2b7c6e6839a577e3ad27d9cc605f17cfa758117566c4caa4fa2a021277ce1

Download Submit
C:\Windows\system\qaLLYPG.exe

Filesize
2.2MB

MD5
70e3c17996ec3189c58cda3264e175b4

SHA1
280aecfa46022c0e30c6f9094620812ef59fe313

SHA256
d0a07de7aca0422ccc10ee4920047f7e186c892168930289417c6bcacb91062e

SHA512
4d4664b9c0a2484a195c3ef01cc7ed23db8be55f92bbcc3ee1fea210c6bf97e27f78e02a715c76d21d7045bf2592e8013bc922f8ac86f077f38ba31053642d52

Download Submit
C:\Windows\system\tvRlXad.exe

Filesize
2.2MB

MD5
137b7732932ddce96ea98a2bb742844d

SHA1
06c086be783e84b3a1678192c6b11e5380c0ffdf

SHA256
1770ecd813fb2982ba9108cf6968fe16d71cf2c4e26e1c03f908a695e72995e2

SHA512
c5ece8acc5051a54eaa947a26879bc8bee02b25dc84b35109ae226ad7f9a95a8b4b58913d8e8cbefb159379de58e47b82702448a6f7c858e91e98cc0bc2951ab

Download Submit
C:\Windows\system\vPDyCQw.exe

Filesize
2.2MB

MD5
08e501d6d6f88864792f7ef1640e5cdc

SHA1
91b0cb19b1686faa4ce627b8521afaeaa1dc3743

SHA256
1b0be79459f84b1d2b1185cabe945f15279fd33c6ec395219156e69926b94782

SHA512
ec7ae6004701892c484f88845a0a191a7024c2df8594f725b8651a4914939c7765f0febbc7c273d9bcdbc7b3b1218fca28acf64908149b48590b4afb9177aa14

Download Submit
C:\Windows\system\wrzaYyQ.exe

Filesize
2.2MB

MD5
657e2742b382294bb58fb7b88abc5745

SHA1
1fbe6415171498c917c6992d56c6d6c78d60664a

SHA256
67d026f0f9430f5f8c130b7e294682613076fcaea7faeade9fcdcec78687fead

SHA512
197fa94ce93b30782ad38a2b480306bc117de179cbc3191a7e6b04893157f643e5bc2755e126fa620c7b117828cd032616838aeb1f39e95b477620230fd090ff

Download Submit
C:\Windows\system\xFBKZrd.exe

Filesize
2.2MB

MD5
4e3316d3d317fe0a005fd4659d79bc26

SHA1
a6ce14bfc95bc5391e39da25a5546c3dfbf34a3d

SHA256
9199200993e488e7af4981ba54014818373c53f721329c7233ffafd49bc20534

SHA512
34262cf5a74fd95390c64abe1571bbe3417cceb4477a8976a6273b2100255d9e41c75cd9e9d92b2ed0da24cf13de6fe1918c879b0617ab1fe79c8e2bf96b4e54

Download Submit
C:\Windows\system\zNUKFnz.exe

Filesize
2.2MB

MD5
3afdf8374d0b46c0ff6b7bef8c394d0e

SHA1
aed3fe57891a411ce46d4fb73d04e6630fcecc85

SHA256
3fc18d47b547ab302fae0124e8189203f01fffdb92647c65f277be9c3eb70659

SHA512
e187302f1a82a80941893842592050b4773dbc1f708a34d0e00b48cc65266592661bf7d930de88be8d5f6861bd49e558b9966aabe94adf5de4168f1bf6b0a01e

Download Submit
\Windows\system\ncSxRFJ.exe

Filesize
2.2MB

MD5
2fbc1420d4cff380eac8131a3e6f5262

SHA1
69a7c38c47e95b6a9fb08e4088e9c41d3017ca01

SHA256
4767383b1b341e18466447541f5587f3d9ba2e0b13010bc014368e85c1b4d4e6

SHA512
31f8442cc8fd26ce2bb9754ef66c6e7d72daacfb9ac8e393bc72cbd5e3944952f923543496e7f57227402feca5776ae15fc62013e268e40bf30398c35b5ea723

Download Submit
\Windows\system\spRolyv.exe

Filesize
2.2MB

MD5
bfd3c74288856c1701b998dd5ddf575d

SHA1
00239a796879ec1c0ec07d6d582d7a73b221534a

SHA256
4838322be0a67ef1e5e43abf1c8e22864cb960190883f0636f6645e764af112e

SHA512
b7aab5e04fcf06f81e39b9db9f7b4b2106331eb25716b11735eb2fefd1440dee7db2ceb05a442c02695b80c23600a24fb61f8a50a34485b9224698529b0df2d9

Download Submit
memory/1668-3949-0x000000013F490000-0x000000013F7E4000-memory.dmp

Filesize
3.3MB

Download
memory/1668-48-0x000000013F490000-0x000000013F7E4000-memory.dmp

Filesize
3.3MB

Download
memory/2104-3948-0x000000013F7E0000-0x000000013FB34000-memory.dmp

Filesize
3.3MB

Download
memory/2104-54-0x000000013F7E0000-0x000000013FB34000-memory.dmp

Filesize
3.3MB

Download
memory/2220-71-0x000000013F760000-0x000000013FAB4000-memory.dmp

Filesize
3.3MB

Download
memory/2220-3955-0x000000013F760000-0x000000013FAB4000-memory.dmp

Filesize
3.3MB

Download
memory/2388-63-0x000000013F620000-0x000000013F974000-memory.dmp

Filesize
3.3MB

Download
memory/2388-3951-0x000000013F620000-0x000000013F974000-memory.dmp

Filesize
3.3MB

Download
memory/2456-3959-0x000000013F0A0000-0x000000013F3F4000-memory.dmp

Filesize
3.3MB

Download
memory/2456-104-0x000000013F0A0000-0x000000013F3F4000-memory.dmp

Filesize
3.3MB

Download
memory/2520-15-0x000000013F8E0000-0x000000013FC34000-memory.dmp

Filesize
3.3MB

Download
memory/2520-3947-0x000000013F8E0000-0x000000013FC34000-memory.dmp

Filesize
3.3MB

Download
memory/2576-58-0x000000013F530000-0x000000013F884000-memory.dmp

Filesize
3.3MB

Download
memory/2576-3950-0x000000013F530000-0x000000013F884000-memory.dmp

Filesize
3.3MB

Download
memory/2604-106-0x000000013FE20000-0x0000000140174000-memory.dmp

Filesize
3.3MB

Download
memory/2604-3958-0x000000013FE20000-0x0000000140174000-memory.dmp

Filesize
3.3MB

Download
memory/2624-78-0x000000013F5E0000-0x000000013F934000-memory.dmp

Filesize
3.3MB

Download
memory/2624-3956-0x000000013F5E0000-0x000000013F934000-memory.dmp

Filesize
3.3MB

Download
memory/2680-3944-0x000000013FD90000-0x00000001400E4000-memory.dmp

Filesize
3.3MB

Download
memory/2680-84-0x000000013F560000-0x000000013F8B4000-memory.dmp

Filesize
3.3MB

Download
memory/2680-3946-0x000000013FE20000-0x0000000140174000-memory.dmp

Filesize
3.3MB

Download
memory/2680-79-0x000000013F490000-0x000000013F7E4000-memory.dmp

Filesize
3.3MB

Download
memory/2680-80-0x000000013F530000-0x000000013F884000-memory.dmp

Filesize
3.3MB

Download
memory/2680-81-0x000000013FD90000-0x00000001400E4000-memory.dmp

Filesize
3.3MB

Download
memory/2680-82-0x000000013FA70000-0x000000013FDC4000-memory.dmp

Filesize
3.3MB

Download
memory/2680-83-0x0000000002110000-0x0000000002464000-memory.dmp

Filesize
3.3MB

Download
memory/2680-8-0x000000013F8E0000-0x000000013FC34000-memory.dmp

Filesize
3.3MB

Download
memory/2680-107-0x0000000002110000-0x0000000002464000-memory.dmp

Filesize
3.3MB

Download
memory/2680-2-0x000000013F0C0000-0x000000013F414000-memory.dmp

Filesize
3.3MB

Download
memory/2680-0-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/2680-2524-0x000000013F0C0000-0x000000013F414000-memory.dmp

Filesize
3.3MB

Download
memory/2680-3945-0x0000000002110000-0x0000000002464000-memory.dmp

Filesize
3.3MB

Download
memory/2680-50-0x000000013F760000-0x000000013FAB4000-memory.dmp

Filesize
3.3MB

Download
memory/2680-32-0x000000013F7E0000-0x000000013FB34000-memory.dmp

Filesize
3.3MB

Download
memory/2680-85-0x000000013FAA0000-0x000000013FDF4000-memory.dmp

Filesize
3.3MB

Download
memory/2680-86-0x000000013F5E0000-0x000000013F934000-memory.dmp

Filesize
3.3MB

Download
memory/2680-64-0x000000013F800000-0x000000013FB54000-memory.dmp

Filesize
3.3MB

Download
memory/2680-88-0x000000013FE20000-0x0000000140174000-memory.dmp

Filesize
3.3MB

Download
memory/2720-76-0x000000013F560000-0x000000013F8B4000-memory.dmp

Filesize
3.3MB

Download
memory/2720-3954-0x000000013F560000-0x000000013F8B4000-memory.dmp

Filesize
3.3MB

Download
memory/2744-3952-0x000000013F800000-0x000000013FB54000-memory.dmp

Filesize
3.3MB

Download
memory/2744-72-0x000000013F800000-0x000000013FB54000-memory.dmp

Filesize
3.3MB

Download
memory/2816-3957-0x000000013FD90000-0x00000001400E4000-memory.dmp

Filesize
3.3MB

Download
memory/2816-87-0x000000013FD90000-0x00000001400E4000-memory.dmp

Filesize
3.3MB

Download
memory/2892-3953-0x000000013FA70000-0x000000013FDC4000-memory.dmp

Filesize
3.3MB

Download
memory/2892-75-0x000000013FA70000-0x000000013FDC4000-memory.dmp

Filesize
3.3MB

Download
memory/2896-105-0x000000013FAA0000-0x000000013FDF4000-memory.dmp

Filesize
3.3MB

Download
memory/2896-3960-0x000000013FAA0000-0x000000013FDF4000-memory.dmp

Filesize
3.3MB

Download